<?xml version="1.0" encoding="UTF-8"?>
<otherdata xmlns="http://linux.duke.edu/metadata/other" packages="1169">
<package pkgid="f0cbf7f8a47733f80879d011c1d3d534d0d954bd831b3e8f99ecec54d6ca0cc4" name="ImageMagick" arch="src">
  <version epoch="0" ver="7.0.7.34" rel="10.21.1"/>
  <changelog author="pgajdos@suse.com" date="1559217600">- security update
- added patches
  CVE-2019-11598 [bsc#1136732]
  + ImageMagick-CVE-2019-11598.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1560859200">- security update
- disable indirect reads [bsc#1138425]
  (https://imagemagick.org/script/security-policy.php)
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1560945600">- security update
- added patches
  CVE-2019-11597 [bsc#1138464]
  + ImageMagick-CVE-2019-11597.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1563883200">- security update
- added patches
  CVE-2019-13301 [bsc#1140554] (core)
  + ImageMagick-CVE-2019-13301.patch
  CVE-2019-13309 [bsc#1140520] (wand)
  + ImageMagick-CVE-2019-13309.patch
  CVE-2019-13310 [bsc#1140501] (wand)
  + ImageMagick-CVE-2019-13310.patch
  CVE-2019-13311 [bsc#1140513] (wand)
  + ImageMagick-CVE-2019-13311.patch
  CVE-2019-13303 [bsc#1140549] (core)
  + ImageMagick-CVE-2019-13303.patch
  CVE-2019-13296 [bsc#1140665] (wand)
  + ImageMagick-CVE-2019-13296.patch
  CVE-2019-13299 [bsc#1140668] (core)
  + ImageMagick-CVE-2019-13299.patch
  CVE-2019-13454 [bsc#1141171] (core)
  + ImageMagick-CVE-2019-13454.patch
  CVE-2019-13295 [bsc#1140664], CVE-2019-13297 [bsc#1140666] (core)
  + ImageMagick-CVE-2019-13295,13297.patch
  CVE-2019-12979 [bsc#1139886] (core)
  + ImageMagick-CVE-2019-12979.patch
  CVE-2019-13391 [bsc#1140673], CVE-2019-13308 [bsc#1140534], CVE-2019-13302 [bsc#1140552] (core, gif.c)
  + ImageMagick-CVE-2019-13391,13308,13302.patch
  CVE-2019-13298 [bsc#1140667] (core)
  + ImageMagick-CVE-2019-13298.patch
  CVE-2019-13300 [bsc#1140669] (core)
  + ImageMagick-CVE-2019-13300.patch
  CVE-2019-13307 [bsc#1140538] (core)
  + ImageMagick-CVE-2019-13307.patch
  CVE-2019-12977 [bsc#1139884] (jp2.c)
  + ImageMagick-CVE-2019-12977.patch
  CVE-2019-12975 [bsc#1140106] (dpx.c)
  + ImageMagick-CVE-2019-12975.patch
  CVE-2019-13135 [bsc#1140103] (cut.c)
  + ImageMagick-CVE-2019-13135.patch
  CVE-2019-12978 [bsc#1139885] (pango.c)
  + ImageMagick-CVE-2019-12978.patch
  CVE-2019-12974 [bsc#1140111] (pango.c)
  + ImageMagick-CVE-2019-12974.patch
  CVE-2019-13304 [bsc#1140547], CVE-2019-13305 [bsc#1140545], CVE-2019-13306 [bsc#1140543] (pnm.c)
  + ImageMagick-CVE-2019-13304,13305,13306.patch
  CVE-2019-13133 [bsc#1140100], CVE-2019-13134 [bsc#1140102] (bmp.c,viff.c)
  + ImageMagick-CVE-2019-13133,13134.patch
  CVE-2019-13137 [bsc#1140105] (ps.c)
  + ImageMagick-CVE-2019-13137.patch
  CVE-2019-13136 [bsc#1140104] (tiff.c)
  + ImageMagick-CVE-2019-13136.patch
  CVE-2019-12976 [bsc#1140110] (pcl.c)
  + ImageMagick-CVE-2019-12976.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1567684800">- security update
- added patches
  CVE-2019-15139 [bsc#1146213]
  + ImageMagick-CVE-2019-15139.patch
  CVE-2019-15140 [bsc#1146212]
  + ImageMagick-CVE-2019-15140.patch
  CVE-2019-15141 [bsc#1146211]
  + ImageMagick-CVE-2019-15141.patch
  CVE-2019-14980 [bsc#1146068]
  + ImageMagick-CVE-2019-14980.patch
  CVE-2019-14981 [bsc#1146065]
  + ImageMagick-CVE-2019-14981.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1570536000">- security update
- added patches
  CVE-2019-16713 [bsc#1151786]
  + ImageMagick-CVE-2019-16713.patch
  CVE-2019-16711 [bsc#1151784]
  + ImageMagick-CVE-2019-16711.patch
  CVE-2019-16712 [bsc#1151785]
  + ImageMagick-CVE-2019-16712.patch
  CVE-2019-16710 [bsc#1151783]
  + ImageMagick-CVE-2019-16710.patch
  CVE-2019-16708 [bsc#1151781], CVE-2019-16709 [bsc#1151782]
  + ImageMagick-CVE-2019-16708,16709.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578052800">- security update
- added patches
  CVE-2019-19948 [bsc#1159861]
  + ImageMagick-CVE-2019-19948.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha() in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
</package>
<package pkgid="98f13cb71a273bd3f25f88466bcf458f9d1febe27fa058d26f9f4fe68b64e9fe" name="MozillaThunderbird" arch="aarch64">
  <version epoch="0" ver="91.6.1" rel="8.54.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
</package>
<package pkgid="511cd15dc9c7291adb1c1f4637d67803f10745897eda566f9485799fca9e8bf9" name="MozillaThunderbird" arch="ppc64le">
  <version epoch="0" ver="91.6.1" rel="8.54.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
</package>
<package pkgid="a3a0d7c443d64aa46652a444e41c5b0f760d4e61abfcb769fc23d042a72a104c" name="MozillaThunderbird" arch="s390x">
  <version epoch="0" ver="91.6.1" rel="8.54.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
</package>
<package pkgid="e748c0cc2bd6be86b2b63f2a4a6f414cc76be7f228262aad553ab90290071271" name="MozillaThunderbird" arch="src">
  <version epoch="0" ver="91.6.1" rel="8.54.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
</package>
<package pkgid="f76ba9a15dd433cc188228920cbbf64e754855b831e6a13e7e4592d42dbc4b59" name="MozillaThunderbird" arch="x86_64">
  <version epoch="0" ver="91.6.1" rel="8.54.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
</package>
<package pkgid="9278122f22defc892f2e5c86f58b3b1941a58bcbf45566fcf3d2a29790537202" name="MozillaThunderbird-translations-common" arch="aarch64">
  <version epoch="0" ver="91.6.1" rel="8.54.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
</package>
<package pkgid="76a9e84caa963a1859dbd95d288f368c13afd6520e00f71877e33e94e18420ec" name="MozillaThunderbird-translations-common" arch="ppc64le">
  <version epoch="0" ver="91.6.1" rel="8.54.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
</package>
<package pkgid="f0b105b8a2a45cd3daf8cf1d989a5ba6518da09ecf32306072ba4ce05aade6eb" name="MozillaThunderbird-translations-common" arch="s390x">
  <version epoch="0" ver="91.6.1" rel="8.54.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
</package>
<package pkgid="ef44947b5adbc3f3f4875b5267edb0ab593b215e7b1e15ee7162d6baebe38b09" name="MozillaThunderbird-translations-common" arch="x86_64">
  <version epoch="0" ver="91.6.1" rel="8.54.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
</package>
<package pkgid="753cae5b156324a044779861e9202c3010f2143762e602785fa37a22f9def831" name="MozillaThunderbird-translations-other" arch="aarch64">
  <version epoch="0" ver="91.6.1" rel="8.54.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
</package>
<package pkgid="6c57e6043aaa533d6dd112abb43abc11c0735b9e7408eb4f8d46a457ec114e7e" name="MozillaThunderbird-translations-other" arch="ppc64le">
  <version epoch="0" ver="91.6.1" rel="8.54.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
</package>
<package pkgid="f6c56882fc310a67faec120d5f975644423676a608dfb6bcb29bbde4bb60f63c" name="MozillaThunderbird-translations-other" arch="s390x">
  <version epoch="0" ver="91.6.1" rel="8.54.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
</package>
<package pkgid="1620ee6c6777f259ef42da0378a1c91e773ed09d9efe43e7120b23527d8fb315" name="MozillaThunderbird-translations-other" arch="x86_64">
  <version epoch="0" ver="91.6.1" rel="8.54.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1630670400">- Mozilla Thunderbird 91.0.3:
  * fixed: Folder icons could be overridden by linked favicons in
    HTML messages
  * fixed: Unified folders showed no messages when underlying
    folders were removed
  * fixed: Folder pane toolbar did not always persist after
    restarting Thunderbird
  * fixed: Compose window attachment pane did not close when
    disabling signing of an OpenPGP message
  * fixed: Using "Reply to List" with some list emails
    incorrectly opened a "no-reply" warning
  * fixed: Account setup UX issues with Exchange autodiscover
  * fixed: Account settings did not display non-UTF-8 server
    descriptions correctly
  * fixed: Thunderbird sometimes sent an unnecessary "SMTPUTF8",
    causing some servers to reject mail
  * fixed: No mouseover pop was displayed with event details for
    non-all-day events in the Today Pane
  * fixed: Filtering tasks in the Today Pane did not work
  * fixed: Email based event scheduling displayed the date and
    time in a format unreadable by humans
- Mozilla Thunderbird 91.0.2:
  * new: Tags are now colored in mail filter editor
  * changed: Context menu items related to OpenPGP and
    attachments are now hidden when not applicable
  * fixed: Creating a new account with manual setup failed
  * fixed: Recipient autocomplete always preferred the primary
    email address for a contact
  * fixed: LDAP performance improvements
  * fixed: Extensions listed on the Recommended Addons did not
    have a clear way to view details in a browser
  * fixed: Status checkmark on View &gt; Calendar &gt; Calendar Pane &gt;
    Show Calendar Pane was reversed
  * fixed: mid: URLs in calendar invites did not open the linked
    mail message
  * fixed: Various theme and UX fixes
- Mozilla Thunderbird 91.0.1
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- appdate screenshot URL updated (by mailaender@opensuse.org)
- Mozilla Thunderbird 91.0
  * based on Mozilla's 91 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/91.0/releasenotes/#whatsnew
  * Renamed "Add-ons" to "Add-ons and Themes" and "Options" to "Preferences"
  * Thunderbird now operates in multi-process (e10s) mode by default
  * New user interface for adding attachments
  * Enable redirect of messages
  * CardDAV address book support
- Removed obsolete patches:
  * mozilla-bmo1463035.patch
  * mozilla-ppc-altivec_static_inline.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1554971.patch
- add mozilla-libavcodec58_91.patch
- removed obsolete BigEndian ICU build workaround
- updated build requirements
- Readd mozilla-silence-no-return-type.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633521600">- Mozilla Thunderbird 91.1.2
  * Thunderbird will now warn if an S/MIME encrypted message includes
    BCC recipients
  * fixed: Message Security popup did not display all recipients
    due a missing scrollbar
  * fixed: Delivery Status Notifications were only shown for the
    first recipient
  * fixed: Composing a message from a template with attachments
    failed due to a temporary file being removed
  * fixed: Attachment sizes were no longer included on printed
    emails
  * fixed: A message sent with multiple attachments sometimes
    only sent one
  * fixed: Thunderbird sometimes attached the wrong messages when
    forwarding multiple messages by attachment
  * fixed: Thunderbird did not re-prompt for an SMTP username if
    one was not provided
  * fixed: Messages with BCC recipients that were held in the
    Outbox did not retain the BCC header when moved to the Sent
    folder
  * fixed: Thunderbird displayed reminders for events that were
    cancelled or declined
  * fixed: New Feed Account dialog did not honor dark mode
- Mozilla Thunderbird 91.1.1
  * Menu item for disabling subject encryption for a single message added
  * Printing messages that are not currently displayed is no longer
    supported, including printing multiple messages at once
  * fixed: Buttons on compose window dialogs did not have a
    visual indication of focus
  * fixed: Dropdown fields in message compose window were
    unreadable on Windows 7 with a dark theme
  * fixed: Multiple bulk mail notification warnings were
    displayed
  * fixed: Enabled/Disabled state of message filters did not
    persist as expected
  * fixed: Printing a message did not print a list of its
    attachments
  * fixed: Images attached from a web page were not sent as
    expected
  * fixed: OpenPGP public key was attached multiple times when
    forwading a message
  * fixed: Windows tray icon disappeared if Thunderbird was
    started by a shortcut with "Run" set to "Minimized"
  * fixed: Windows tray message count badge displayed the
    "unread" count instead of the "new" message count
  * fixed: Some downstream Thunderbird builds were incorrectly
    checking addons for a signature, causing all addons to be
    disabled
  * fixed: Addressbooks set up with autoconfig showed no search
    results
  * fixed: Various CardDAV setup and auto-detection fixes
  * fixed: Dates (such as birthday) stored in contacts may
    display the wrong date; a one-time manual fix may be needed
    for dates that are incorrect.
  * fixed: Attached VCards displayed as plain text when an email
    was HTML formatted
  * fixed: Mailing list names with non-ASCII characters
    incorrectly displayed with an error
  * fixed: LDAP directories were not searched for matches when
    adding recipients to an email
  * fixed: Clicking "Connect to an LDAP address book" in account
    setup opened CardDAV setup dialog
  * fixed: LDAP address books using Kerberos/GSS-API
    authentication did not authenticate
  * fixed: LDAP search queries containing non-ASCII characters
    produced no results
  * fixed: IRC server connections did not automatically retry
    after a timeout
  * fixed: Calendar event editor did not honor
    `mail.spellcheck.inline`
- MOZ_ENABLE_WAYLAND env variable now overrides automatic detection
  if already set before startup
- Mozilla Thunderbird 91.1.0
  * Thunderbird registered Accessibility Handlers using same GUIDs
    as Firefox, causing performance issues for NVDA users
  * Focus lost when reordering accounts by keyboard in the Account Manager
  * Account setup did not use provider display name for setting up
    calendars
  * Various theme and UX fixes
  MFSA 2021-41 (bsc#1190269)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Thunderbird 91.1
- add mozilla-bmo531915.patch to fix build for i586
- Remove obsolete patch mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634126400">- Mozilla Thunderbird 91.2
  * changed: Saving a single message as .eml now uses a unique
    filename
  * fixed: New mail notifications did not properly take
    subfolders into account
  * fixed: Decrypting binary attachments when using an external
    GnuPG configuration failed
  * fixed: Account name fields in the account manager were not
    big enough for long names
  * fixed: LDAP searches using an extensibleMatch filter returned
    no results
  * fixed: Read-only CalDAV calendars and CardDAV address books
    were not detected
  * fixed: Multipart messages containing a calendar invite did
    not display any of the human-readable alternatives
  * fixed: Some calendar days were displayed incorrectly or
    duplicated (eg. two "29th" days of a particular month)
  * fixed: Phantom event was shown at the end of each day in
    Calendar week view
  * fixed: Various security fixes
  MFSA 2021-47 (bsc#1191332)
  * CVE-2021-38502 (bmo#1733366)
    Downgrade attack on SMTP STARTTLS connections
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    bmo#https://github.com/crossbeam-
    rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Thunderbird 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Thunderbird 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1636113600">- Mozilla Thunderbird 91.3
  * fixed: Default mail headers were set incorrectly when the
    value contained a colon (:)
  * fixed: Thunderbird did not send the QUIT command when closing
    an SMTP connection
  * fixed: Mail tabs could not be closed using the context menu
  * fixed: "Print" context menu was still shown when no message
    pane was displayed
  * fixed: Windows tray icon did not reappear after restarting
    Windows Explorer
  * fixed: Compose window attachment drag and drop fixes
  * fixed: Various macOS stability improvements
  * fixed: Drag and Drop area for file attachments on Windows was
    incorrect
  * fixed: CardDAV address books without a name did not work
  * fixed: Thunderbird tried to refresh disabled and manual-only
    calendars when the network state changed from offline to
    online
  * fixed: Various Calendar event dialog fixes
  * fixed: Various security fixes
  MFSA 2021-50 (bsc#1192250)
  * CVE-2021-38503 (bmo#1729517)
    iframe sandbox rules did not apply to XSLT stylesheets
  * CVE-2021-38504 (bmo#1730156)
    Use-after-free in file picker dialog
  * CVE-2021-38505 (bmo#1730194)
    Windows 10 Cloud Clipboard may have recorded sensitive user
    data
  * CVE-2021-38506 (bmo#1730750)
    Thunderbird could be coaxed into going into fullscreen mode
    without notification or warning
  * CVE-2021-38507 (bmo#1730935)
    Opportunistic Encryption in HTTP2 could be used to bypass the
    Same-Origin-Policy on services hosted on other ports
  * MOZ-2021-0008 (bmo#1667102)
    Use-after-free in HTTP2 Session object
  * CVE-2021-38508 (bmo#1366818)
    Permission Prompt could be overlaid, resulting in user
    confusion and potential spoofing
  * CVE-2021-38509 (bmo#1718571)
    Javascript alert box could have been spoofed onto an
    arbitrary domain
  * CVE-2021-38510 (bmo#1731779)
    Download Protections were bypassed by .inetloc files on Mac
    OS
  * MOZ-2021-0007 (bmo#1606864, bmo#1712671, bmo#1730048,
    bmo#1735152)
    Memory safety bugs fixed in Thunderbird ESR 91.3
- Drop unused pkgconfig(gdk-x11-2.0) BuildRequires
- Drop mozilla-neqo-fix-fips-crash.patch which is now upstream
- add mozilla-bmo1724679.patch (bmo#1724679, boo#1182863)
  fix some env variables which are enabled for any value</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638360000">- Mozilla Thunderbird 91.3.2
  * changed: Date selection in Calendar print settings widget
    changed to use mini calendar widget
  * changed: OpenPGP: Botan updated to 2.18.2; addresses
    CVE-2021-40529
  * fixed: "Repair Text Encoding" menu item did not work
  * fixed: Troubleshoot Mode menu item did not always indicate
    whether troubleshooting mode was enabled
  * fixed: Message content could be unintentionally hidden due to
    CSS class names conflicting
  * fixed: SMTP server port was reset to "0" after clicking the
    "Re-Test" button in the Account Setup wizard
  * fixed: No "Paste" option was available in the config editor
    (about:config) context menu
  * fixed: Saving a PDF attachment opened in a separate tab saved
    the email message instead
  * fixed: Opening a PDF attachment from a message in a
    standalone or compose window did move the focus to opened
    attachment
  * fixed: After restart, Thunderbird was not able to restore
    opened message tabs when the message was in a folder with
    non-ASCII characters in its name
  * fixed: The "pill" indicator was incorrectly shown when
    sending a message to newsgroup
  * fixed: When printing from Calendar, after leaving the
    "Calendar" settings, there was no way to go back
  * fixed: Month pickers in the Calendar print UI lacked
    scrollbars when the content overflowed
  * fixed: Account Manager and Addons Manager were unreadable
    when using the Dark theme
- Mozilla Thunderbird 91.3.1
  * changed: OpenPGP public keys will no longer count as an
    attachment in the message list
  * changed: Adding a search engine via URL now supported
  * changed: FileLink messages' template updated; Thunderbird
    advertisement removed
  * changed: After an update, Thunderbird will now check
    installed addons for updates
  * fixed: New mail popups were displayed while running full
    screen applications
  * fixed: Messages received with non-standard "koi8r" encoding
    were not supported
  * fixed: Various macOS stability improvements
  * fixed: PDF attachments opened in Firefox while composing an
    email
  * fixed: Addons were disabled when "Offline Settings" were set
    to "Ask me for online state (on startup)"
  * fixed: Clicking '"addons://" links in the Addons Manager
    prompted for an application to open it, rather than opening
    internally
  * fixed: The Contacts sidebar "Address Book" drop down was
    unreadable on Windows
  * fixed: vCard attachments were not shown when using "inline"
    view for attachments
  * fixed: Importing an ICS file with TODO items failed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638964800">- Mozilla Thunderbird 91.4.0
  * fixed: IMAP startup performance improved for accounts with a
    multitude of folders
  * fixed: Thunderbird failed to send messages when configured to
    use an IPv6 SMTP server by IP address (instead of a hostname)
  * fixed: Forwarding messages with attachments sometimes failed
  * fixed: Printing multiple messages at once was not possible
  * fixed: Non-utf8 news groups were not supported
  * fixed: Thunderbird stalled after sending a message with NNTP
    and SMTP recipients
  * fixed: Using Thunderbird with multiple language packs caused
    high RAM and CPU use and sluggish performance
  * fixed: Clicking a "mailto:" started the composer with the
    default sending identity instead of a configured alternate
  * fixed: Drag and dropped text into a plain text message in the
    compose window was handled inconsistently
  * fixed: FileLink messages did not display correctly when
    viewed in Outlook
  * fixed: In account setup, after selecting an extension
    provided protocol, it was not possible to create an IMAP/POP
    account
  * fixed: Multiday selections were not cleared when changing
    week viewed
  * fixed: When creating a new event by clicking and dragging the
    mouse to create a box, the view did not auto-scroll after
    reaching the bottom
  * fixed: Calendar Invitation Panel did not scroll when multiple
    invitations were pending
  * fixed: Calendar print dialog did not have a cancel button
  * fixed: Various security fixes
  MFSA 2021-54 (bsc#1193485)
  * CVE-2021-43536 (bmo#1730120)
    URL leakage when navigating while executing asynchronous
    function
  * CVE-2021-43537 (bmo#1738237)
    Heap buffer overflow when using structured clone
  * CVE-2021-43538 (bmo#1739091)
    Missing fullscreen and pointer lock notification when
    requesting both
  * CVE-2021-43539 (bmo#1739683)
    GC rooting failure when calling wasm instance methods
  * CVE-2021-43541 (bmo#1696685)
    External protocol handler parameters were unescaped
  * CVE-2021-43542 (bmo#1723281)
    XMLHttpRequest error codes could have leaked the existence of
    an external protocol handler
  * CVE-2021-43543 (bmo#1738418)
    Bypass of CSP sandbox directive when embedding
  * CVE-2021-43545 (bmo#1720926)
    Denial of Service when using the Location API in a loop
  * CVE-2021-43546 (bmo#1737751)
    Cursor spoofing could overlay user interface when native
    cursor is zoomed
  * CVE-2021-43528 (bmo#1742579)
    JavaScript unexpectedly enabled for the composition area
  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,
    bmo#1737009, bmo#1739372, bmo#1739421)
    Memory safety bugs fixed in Thunderbird 91.4.0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1641211200">- Mozilla Thunderbird 91.4.1
  * fixed: Attachments that should open in Thunderbird, such as
    ICS attachments, offered to save the file instead
  * fixed: Saving attachments from IMAP accounts where usernames
    contained special characters failed
  * fixed: Temporary files created for forwarded attachments
    sometimes had the wrong extension
  * fixed: S/MIME signatures were shown as invalid by Outlook
  * fixed: URL input boxes on content tabs erroneously displayed
    a search glass icon on macOS
  * fixed: Message bars (such as content blocking) did not use
    high contrast theme colors
  * fixed: Some messages with autocrypt headers loaded slowly,
    causing Thunderbird to hang
  * fixed: Server hostnames were cut-off in the account manager
  * fixed: Account Setup did not support non-ASCII characters in
    passwords
  * fixed: Account Setup did not always retain set values
  * fixed: Virtual folders did not retain folder selection when a
    folder name contained non-ASCII characters
  * fixed: Messages saved as "html" or "eml" did not include
    message headers
  * fixed: "Private web page" field was not included when
    exporting a contact to a vCard
  * fixed: Addons were still active after restarting Thunderbird
    in troubleshooting mode with "disable all addons" checked
  * fixed: FileLink attachments did not always display the
    FileLink provider's icon
  * fixed: FileLink privacy notifications persisted in the
    compose window after removing all FileLink attachments
  * fixed: "Loading" icon remained after a FileLink upload failed
  * fixed: Lengthy event names for multiday events did not wrap
  * fixed: Various theme and UX improvements
  * fixed: Various security fixes
  MFSA 2021-55 (bsc#1194215)
  * CVE-2021-4126 (bmo#1732310)
    OpenPGP signature status doesn't consider additional message
    content
  * CVE-2021-44538 (bmo#1744056)
    Matrix chat library libolm bundled with Thunderbird
    vulnerable to a buffer overflow</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1642420800">- Mozilla Thunderbird 91.5
  * fixed: RSS keyword labels without a configured color were
    illegible
  * fixed: Thunderbird "about:" dialog did not identify third-
    party repackaged distributions such as Flatpaks
  * fixed: Various security fixes
  MFSA 2022-03 (bsc#1194547)
  * CVE-2022-22746 (bmo#1735071)
    Calling into reportValidity could have lead to fullscreen
    window spoof
  * CVE-2022-22743 (bmo#1739220)
    Browser window spoof using fullscreen mode
  * CVE-2022-22742 (bmo#1739923)
    Out-of-bounds memory access when inserting text in edit mode
  * CVE-2022-22741 (bmo#1740389)
    Browser window spoof using fullscreen mode
  * CVE-2022-22740 (bmo#1742334)
    Use-after-free of ChannelEventQueue::mOwner
  * CVE-2022-22738 (bmo#1742382)
    Heap-buffer-overflow in blendGaussianBlur
  * CVE-2022-22737 (bmo#1745874)
    Race condition when playing audio files
  * CVE-2021-4140 (bmo#1746720)
    Iframe sandbox bypass with XSLT
  * CVE-2022-22748 (bmo#1705211)
    Spoofed origin on external protocol launch dialog
  * CVE-2022-22745 (bmo#1735856)
    Leaking cross-origin URLs through securitypolicyviolation
    event
  * CVE-2022-22744 (bmo#1737252)
    The 'Copy as curl' feature in DevTools did not fully escape
    website-controlled data, potentially leading to command
    injection
  * CVE-2022-22747 (bmo#1735028)
    Crash when handling empty pkcs7 sequence
  * CVE-2022-22739 (bmo#1744158)
    Missing throttling on external protocol launch dialog
  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,
    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,
    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)
    Memory safety bugs fixed in Thunderbird 91.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1644926400">- Mozilla Thunderbird 91.6
  * new: Thunderbird will now offer to send large forwarded
    attachments via FileLink
  * fixed: Partially signed unencrypted messages displayed an
    incorrect "partially encrypted" notification
  * fixed: Attachments filenames were not sanitized before saving
    to disk
  * fixed: In the attachment bar, the "Import OpenPGP Key" item
    displayed for public keys displayed an error and did not
    import the key
  * fixed: "Open with" attachment dialog did not have a selected
    radio button option
  * fixed: Various security fixes
  MFSA 2022-06 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance
    Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during
    update
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22763 (bmo#1740534)
    Script Execution during invalid object state
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Thunderbird 91.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1645099200">- Mozilla Thunderbird 91.6.1
  * changed: Thunderbird generated views of meeting invitations
    are now expanded by default
  * fixed: Emails were not downloading at startup under some
    conditions
  * fixed: Port numbers were not shown in "Confirm Security
    Exception" dialog for CalDAV connections
  * fixed: Various security fixes
  MFSA 2022-07 (bsc#1196072)
  * CVE-2022-0566 (bmo#1753094)
    Crafted email could trigger an out-of-bounds write</changelog>
</package>
<package pkgid="53baad9df5e8359a0c7c2298578219ef619990223c94b168e2b01e8506ebda93" name="SDL2" arch="src">
  <version epoch="0" ver="2.0.8" rel="11.3.1"/>
  <changelog author="guillaume@opensuse.org" date="1506945600">- Enable KMS/DRM video driver</changelog>
  <changelog author="jengelh@inai.de" date="1506945601">- Add dbus.diff</changelog>
  <changelog author="wbauer@tmo.at" date="1508155200">- Disable SSE3 (and also SSE2 on ix86) to prevent crashes on older
  CPUs that don't support these instructions</changelog>
  <changelog author="sreeves@suse.com" date="1508414400">- Add SDL-bnc1062784-check-overflow-xcf-props.patch. CVE-2017-2888</changelog>
  <changelog author="adam@mizerski.pl" date="1509192000">- update to 2.0.7
  * Added audio stream conversion functions.
  * Added functions to query and set the SDL memory allocation
    functions.
  * Added locking functions for multi-threaded access to
    the joystick and game controller APIs.
  * Some functions are now thread-safe.
- removed patches, merged upstream
  * dbus.diff
  * SDL2-ppc64-declaration-after-statement.patch
  * SDL-bnc1062784-check-overflow-xcf-props.patch</changelog>
  <changelog author="jengelh@inai.de" date="1515585600">- Add sdl2-symvers.patch.</changelog>
  <changelog author="jengelh@inai.de" date="1520510400">- Update to new upstream release 2.0.8
  * Added SDL_fmod() and SDL_log10().
  * Each of the SDL math functions now has the corresponding
    float version.
  * Added SDL_SetYUVConversionMode() and
    SDL_GetYUVConversionMode() to control the formula used when
    converting to and from YUV colorspace. The options are JPEG,
    BT.601, and BT.709.
  * Added the hint SDL_HINT_VIDEO_X11_NET_WM_BYPASS_COMPOSITOR to
    control whether the X server should skip the compositor for
    the SDL application. This defaults to "1".
  * Added the hint SDL_HINT_VIDEO_DOUBLE_BUFFER to control
    whether the Raspberry Pi and KMSDRM video drivers should use
    double or triple buffering (the default).</changelog>
  <changelog author="ytz1995@hotmail.com" date="1521288000">- Build with Wayland support</changelog>
  <changelog author="qzheng@suse.com" date="1551268800">- Add CVE-2019-7577.patch to fix a buffer over-read issue
  (CVE-2019-7577, boo#1124800).</changelog>
  <changelog author="qzheng@suse.com" date="1551355200">- Add CVE-2019-7637.patch to fix a heap-base buffer overflow
  issue (CVE-2019-7637, boo#1124825).</changelog>
  <changelog author="qzheng@suse.com" date="1551355201">- Add CVE-2019-7575.patch to fix a heap-based buffer overflow
  issue (CVE-2019-7575, boo#1124802).</changelog>
  <changelog author="qzheng@suse.com" date="1553083200">- Add CVE-2019-7574.patch to fix a heap-based buffer over-read
  issue (CVE-2019-7574, boo#1124803).</changelog>
  <changelog author="qzheng@suse.com" date="1553083201">- Add CVE-2019-7572.patch to fix a buffer over-read issue
  (CVE-2019-7572, boo#1124806).</changelog>
  <changelog author="qzheng@suse.com" date="1553083202">- Add CVE-2019-7578.patch to fix a heap-based buffer over-read
  issue (CVE-2019-7578, boo#1125099, CVE-2019-7576, boo#1124799
  CVE-2019-7573, boo#1124805).</changelog>
  <changelog author="qzheng@suse.com" date="1553083203">- Add CVE-2019-7635.patch to fix a heap-based buffer over-read
  issue (CVE-2019-7635, boo#1124827).</changelog>
  <changelog author="qzheng@suse.com" date="1553083204">- Add CVE-2019-7636.patch to fix a heap-based buffer over-read
  issue (CVE-2019-7636, boo#1124826, CVE-2019-7638, boo#1124824).</changelog>
  <changelog author="qzheng@suse.com" date="1558612800">- Remove CVE-2019-7637.patch, the modification of function
  SDL_CalculatePitch is only suit for SDL not SDL2.</changelog>
  <changelog author="mgorse@suse.com" date="1566820800">- Add CVE-2019-13616.patch: fix heap buffer overflow when reading
  a crafted bmp file (boo#1141844 CVE-2019-13616).
- Add CVE-2019-13626.patch: add safeguards to the wav parser to
  prevent crashes (boo#1142031 CVE-2019-13626).
- Drop CVE-2019-7572.patch, CVE-2019-7574.patch,
  CVE-2019-7575.patch, CVE-2019-7577.patch, and
  CVE-2019-7578.patch: these are handled by the new code added in
  CVE-2019-13626.patch.</changelog>
  <changelog author="sndirsch@suse.com" date="1578225600">-  sdl2-khronos.patch
  * fixes build on i586 (boo#1158176)</changelog>
  <changelog author="mgorse@suse.com" date="1641902400">- Add sdl2-surface-pitch-overflow.patch: fix overflow in surface
  pitch calculation (boo#1181201 boo#1181202 CVE-2020-14410
  CVE-2020-14409).</changelog>
</package>
<package pkgid="961f20c450986a6cda97bdb7ab6b57770f261d78451a25a0f675038ada4b758d" name="aide" arch="aarch64">
  <version epoch="0" ver="0.16" rel="24.1"/>
  <changelog author="mmeister@suse.com" date="1366977600">- Removed AC_CONFIG_MACRO_DIR([m4]) from configure.in to fix
  build with new automake: aide-no_m4_dir.patch</changelog>
  <changelog author="meissner@suse.com" date="1389787200">- aide.conf: Move from md5 and sha1 as default to sha256+sha512, also
  to allow FIPS enabling with aide working. FATE#315925</changelog>
  <changelog author="meissner@suse.com" date="1390478400">- seperate a -test package to help with externalized testing.</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1401278400">- aide-xattr-in-libc.patch: Once upon a time, 10 years ago, basic extended
  attribute functionality moved to libc, therefore libattr is most of the
  time, not needed at all.</changelog>
  <changelog author="meissner@suse.com" date="1435838400">- aide-dynamic.patch: avoid overwriting dl* functions, as we might
  load libcrypto.so dynamically in FIPS mode.</changelog>
  <changelog author="meissner@suse.com" date="1484740800">- Updated to 0.16
  - lots of bugfixes
  - including regexp matching within subdirectories of expressions
- aide-0.16-as-needed.patch: replaces aide-0.15.1-as-needed.patch
- aide-no_m4_dir.patch: upstream
- aide.keyring: added from keyserver, cross checked key id on
  http://aide.sourceforge.net/ and a signature from someone
  I signed.</changelog>
  <changelog author="abergmann@suse.com" date="1562846400">- Remove not available gcrypt algorithm 7 DB_HAVAL (bsc#1098360).
  Add aide-define_hash_use_gcrypt.patch</changelog>
  <changelog author="meissner@suse.com" date="1610020800">- aide-0.15-syslog-format.patch: Add a syslog_format to aide (bsc#1180165)</changelog>
  <changelog author="ali.abdallah@suse.com" date="1637755200">- aide-disable-gcrypt-MD5-in-fips-mode.patch: gcrypt aborts if MD5
  is used in fips mode, so disable it also in aide (bsc#1191422).</changelog>
  <changelog author="meissner@suse.com" date="1642420800">- aide-0.16-cve-2021-45417.patch: Fix a bufferoverflow in base64
  functions (bsc#1194735 CVE-2021-45417)</changelog>
</package>
<package pkgid="61b1c5691ffc4c5d0fb6dc6bf942a1904c72d3115e0fe7b40e2ec53654cedb26" name="aide" arch="ppc64le">
  <version epoch="0" ver="0.16" rel="24.1"/>
  <changelog author="mmeister@suse.com" date="1366977600">- Removed AC_CONFIG_MACRO_DIR([m4]) from configure.in to fix
  build with new automake: aide-no_m4_dir.patch</changelog>
  <changelog author="meissner@suse.com" date="1389787200">- aide.conf: Move from md5 and sha1 as default to sha256+sha512, also
  to allow FIPS enabling with aide working. FATE#315925</changelog>
  <changelog author="meissner@suse.com" date="1390478400">- seperate a -test package to help with externalized testing.</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1401278400">- aide-xattr-in-libc.patch: Once upon a time, 10 years ago, basic extended
  attribute functionality moved to libc, therefore libattr is most of the
  time, not needed at all.</changelog>
  <changelog author="meissner@suse.com" date="1435838400">- aide-dynamic.patch: avoid overwriting dl* functions, as we might
  load libcrypto.so dynamically in FIPS mode.</changelog>
  <changelog author="meissner@suse.com" date="1484740800">- Updated to 0.16
  - lots of bugfixes
  - including regexp matching within subdirectories of expressions
- aide-0.16-as-needed.patch: replaces aide-0.15.1-as-needed.patch
- aide-no_m4_dir.patch: upstream
- aide.keyring: added from keyserver, cross checked key id on
  http://aide.sourceforge.net/ and a signature from someone
  I signed.</changelog>
  <changelog author="abergmann@suse.com" date="1562846400">- Remove not available gcrypt algorithm 7 DB_HAVAL (bsc#1098360).
  Add aide-define_hash_use_gcrypt.patch</changelog>
  <changelog author="meissner@suse.com" date="1610020800">- aide-0.15-syslog-format.patch: Add a syslog_format to aide (bsc#1180165)</changelog>
  <changelog author="ali.abdallah@suse.com" date="1637755200">- aide-disable-gcrypt-MD5-in-fips-mode.patch: gcrypt aborts if MD5
  is used in fips mode, so disable it also in aide (bsc#1191422).</changelog>
  <changelog author="meissner@suse.com" date="1642420800">- aide-0.16-cve-2021-45417.patch: Fix a bufferoverflow in base64
  functions (bsc#1194735 CVE-2021-45417)</changelog>
</package>
<package pkgid="b1eb01ee10b354ac9e6445f42d6e9681bcc1d7fe8359e7d565cdd860071bd958" name="aide" arch="s390x">
  <version epoch="0" ver="0.16" rel="24.1"/>
  <changelog author="mmeister@suse.com" date="1366977600">- Removed AC_CONFIG_MACRO_DIR([m4]) from configure.in to fix
  build with new automake: aide-no_m4_dir.patch</changelog>
  <changelog author="meissner@suse.com" date="1389787200">- aide.conf: Move from md5 and sha1 as default to sha256+sha512, also
  to allow FIPS enabling with aide working. FATE#315925</changelog>
  <changelog author="meissner@suse.com" date="1390478400">- seperate a -test package to help with externalized testing.</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1401278400">- aide-xattr-in-libc.patch: Once upon a time, 10 years ago, basic extended
  attribute functionality moved to libc, therefore libattr is most of the
  time, not needed at all.</changelog>
  <changelog author="meissner@suse.com" date="1435838400">- aide-dynamic.patch: avoid overwriting dl* functions, as we might
  load libcrypto.so dynamically in FIPS mode.</changelog>
  <changelog author="meissner@suse.com" date="1484740800">- Updated to 0.16
  - lots of bugfixes
  - including regexp matching within subdirectories of expressions
- aide-0.16-as-needed.patch: replaces aide-0.15.1-as-needed.patch
- aide-no_m4_dir.patch: upstream
- aide.keyring: added from keyserver, cross checked key id on
  http://aide.sourceforge.net/ and a signature from someone
  I signed.</changelog>
  <changelog author="abergmann@suse.com" date="1562846400">- Remove not available gcrypt algorithm 7 DB_HAVAL (bsc#1098360).
  Add aide-define_hash_use_gcrypt.patch</changelog>
  <changelog author="meissner@suse.com" date="1610020800">- aide-0.15-syslog-format.patch: Add a syslog_format to aide (bsc#1180165)</changelog>
  <changelog author="ali.abdallah@suse.com" date="1637755200">- aide-disable-gcrypt-MD5-in-fips-mode.patch: gcrypt aborts if MD5
  is used in fips mode, so disable it also in aide (bsc#1191422).</changelog>
  <changelog author="meissner@suse.com" date="1642420800">- aide-0.16-cve-2021-45417.patch: Fix a bufferoverflow in base64
  functions (bsc#1194735 CVE-2021-45417)</changelog>
</package>
<package pkgid="62aa71df532443dd2218bc7ca10762d48e1f9cff5d46a9bea34cd339cdcb1066" name="aide" arch="src">
  <version epoch="0" ver="0.16" rel="24.1"/>
  <changelog author="meissner@suse.de" date="1219406400">- enabled SELinux support [Fate#303662]
- enabled curl
- disable static (does not make much sense)</changelog>
  <changelog author="meissner@suse.de" date="1231156800">- fixed abort on check/update by removing the hash requirement bnc#406597
- fixed version output bnc#463511
- enhanced testcase to also run one aide --check</changelog>
  <changelog author="crrodriguez@suse.de" date="1245240000">- fix build when as-needed is a default liker option</changelog>
  <changelog author="mls@suse.de" date="1251288000">- make patch0 usage consistent</changelog>
  <changelog author="ro@suse.de" date="1272542400">- make aide check verbose to get started
- add sleep and sync to fix build</changelog>
  <changelog author="meissner@suse.de" date="1281441600">- updated to 0.15
  - lots of fixes and some new stuff</changelog>
  <changelog author="freespacer@gmx.de" date="1285934400">- updated to version 0.15.1
  - Ignore changed file name if attributes does not match
  - Allow absence of DB_CHECKINODE if file name has changed
- renew patch</changelog>
  <changelog author="jengelh@medozas.de" date="1316260800">- Remove redundant tags/sections from specfile
- Add missing call to make
- Use %_smp_mflags for parallel build</changelog>
  <changelog author="coolo@suse.com" date="1322827200">- add automake as buildrequire to avoid implicit dependency</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1325678400">- libmhash development was abandoned in 2007, so it is time
  for it to go into the library heaven, use libgcrypt instead.</changelog>
  <changelog author="mmeister@suse.com" date="1366977600">- Removed AC_CONFIG_MACRO_DIR([m4]) from configure.in to fix
  build with new automake: aide-no_m4_dir.patch</changelog>
  <changelog author="meissner@suse.com" date="1389787200">- aide.conf: Move from md5 and sha1 as default to sha256+sha512, also
  to allow FIPS enabling with aide working. FATE#315925</changelog>
  <changelog author="meissner@suse.com" date="1390478400">- seperate a -test package to help with externalized testing.</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1401278400">- aide-xattr-in-libc.patch: Once upon a time, 10 years ago, basic extended
  attribute functionality moved to libc, therefore libattr is most of the
  time, not needed at all.</changelog>
  <changelog author="meissner@suse.com" date="1435838400">- aide-dynamic.patch: avoid overwriting dl* functions, as we might
  load libcrypto.so dynamically in FIPS mode.</changelog>
  <changelog author="meissner@suse.com" date="1484740800">- Updated to 0.16
  - lots of bugfixes
  - including regexp matching within subdirectories of expressions
- aide-0.16-as-needed.patch: replaces aide-0.15.1-as-needed.patch
- aide-no_m4_dir.patch: upstream
- aide.keyring: added from keyserver, cross checked key id on
  http://aide.sourceforge.net/ and a signature from someone
  I signed.</changelog>
  <changelog author="abergmann@suse.com" date="1562846400">- Remove not available gcrypt algorithm 7 DB_HAVAL (bsc#1098360).
  Add aide-define_hash_use_gcrypt.patch</changelog>
  <changelog author="meissner@suse.com" date="1610020800">- aide-0.15-syslog-format.patch: Add a syslog_format to aide (bsc#1180165)</changelog>
  <changelog author="ali.abdallah@suse.com" date="1637755200">- aide-disable-gcrypt-MD5-in-fips-mode.patch: gcrypt aborts if MD5
  is used in fips mode, so disable it also in aide (bsc#1191422).</changelog>
  <changelog author="meissner@suse.com" date="1642420800">- aide-0.16-cve-2021-45417.patch: Fix a bufferoverflow in base64
  functions (bsc#1194735 CVE-2021-45417)</changelog>
</package>
<package pkgid="e11925980d88b782d432a4fbf67f6aeb2d9abe580970b1da31f056c1a3e78252" name="aide" arch="x86_64">
  <version epoch="0" ver="0.16" rel="24.1"/>
  <changelog author="mmeister@suse.com" date="1366977600">- Removed AC_CONFIG_MACRO_DIR([m4]) from configure.in to fix
  build with new automake: aide-no_m4_dir.patch</changelog>
  <changelog author="meissner@suse.com" date="1389787200">- aide.conf: Move from md5 and sha1 as default to sha256+sha512, also
  to allow FIPS enabling with aide working. FATE#315925</changelog>
  <changelog author="meissner@suse.com" date="1390478400">- seperate a -test package to help with externalized testing.</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1401278400">- aide-xattr-in-libc.patch: Once upon a time, 10 years ago, basic extended
  attribute functionality moved to libc, therefore libattr is most of the
  time, not needed at all.</changelog>
  <changelog author="meissner@suse.com" date="1435838400">- aide-dynamic.patch: avoid overwriting dl* functions, as we might
  load libcrypto.so dynamically in FIPS mode.</changelog>
  <changelog author="meissner@suse.com" date="1484740800">- Updated to 0.16
  - lots of bugfixes
  - including regexp matching within subdirectories of expressions
- aide-0.16-as-needed.patch: replaces aide-0.15.1-as-needed.patch
- aide-no_m4_dir.patch: upstream
- aide.keyring: added from keyserver, cross checked key id on
  http://aide.sourceforge.net/ and a signature from someone
  I signed.</changelog>
  <changelog author="abergmann@suse.com" date="1562846400">- Remove not available gcrypt algorithm 7 DB_HAVAL (bsc#1098360).
  Add aide-define_hash_use_gcrypt.patch</changelog>
  <changelog author="meissner@suse.com" date="1610020800">- aide-0.15-syslog-format.patch: Add a syslog_format to aide (bsc#1180165)</changelog>
  <changelog author="ali.abdallah@suse.com" date="1637755200">- aide-disable-gcrypt-MD5-in-fips-mode.patch: gcrypt aborts if MD5
  is used in fips mode, so disable it also in aide (bsc#1191422).</changelog>
  <changelog author="meissner@suse.com" date="1642420800">- aide-0.16-cve-2021-45417.patch: Fix a bufferoverflow in base64
  functions (bsc#1194735 CVE-2021-45417)</changelog>
</package>
<package pkgid="d8a35c5736ab73c20045dd1810bdbe0b3d6ce070233008bc0c14c78ff55df1dd" name="aide-test" arch="aarch64">
  <version epoch="0" ver="0.16" rel="24.1"/>
  <changelog author="mmeister@suse.com" date="1366977600">- Removed AC_CONFIG_MACRO_DIR([m4]) from configure.in to fix
  build with new automake: aide-no_m4_dir.patch</changelog>
  <changelog author="meissner@suse.com" date="1389787200">- aide.conf: Move from md5 and sha1 as default to sha256+sha512, also
  to allow FIPS enabling with aide working. FATE#315925</changelog>
  <changelog author="meissner@suse.com" date="1390478400">- seperate a -test package to help with externalized testing.</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1401278400">- aide-xattr-in-libc.patch: Once upon a time, 10 years ago, basic extended
  attribute functionality moved to libc, therefore libattr is most of the
  time, not needed at all.</changelog>
  <changelog author="meissner@suse.com" date="1435838400">- aide-dynamic.patch: avoid overwriting dl* functions, as we might
  load libcrypto.so dynamically in FIPS mode.</changelog>
  <changelog author="meissner@suse.com" date="1484740800">- Updated to 0.16
  - lots of bugfixes
  - including regexp matching within subdirectories of expressions
- aide-0.16-as-needed.patch: replaces aide-0.15.1-as-needed.patch
- aide-no_m4_dir.patch: upstream
- aide.keyring: added from keyserver, cross checked key id on
  http://aide.sourceforge.net/ and a signature from someone
  I signed.</changelog>
  <changelog author="abergmann@suse.com" date="1562846400">- Remove not available gcrypt algorithm 7 DB_HAVAL (bsc#1098360).
  Add aide-define_hash_use_gcrypt.patch</changelog>
  <changelog author="meissner@suse.com" date="1610020800">- aide-0.15-syslog-format.patch: Add a syslog_format to aide (bsc#1180165)</changelog>
  <changelog author="ali.abdallah@suse.com" date="1637755200">- aide-disable-gcrypt-MD5-in-fips-mode.patch: gcrypt aborts if MD5
  is used in fips mode, so disable it also in aide (bsc#1191422).</changelog>
  <changelog author="meissner@suse.com" date="1642420800">- aide-0.16-cve-2021-45417.patch: Fix a bufferoverflow in base64
  functions (bsc#1194735 CVE-2021-45417)</changelog>
</package>
<package pkgid="a6d3535ed0c5a7d2b5a367895a20211aa351a3ce99d0c6dd56f9d232c7301d5f" name="aide-test" arch="ppc64le">
  <version epoch="0" ver="0.16" rel="24.1"/>
  <changelog author="mmeister@suse.com" date="1366977600">- Removed AC_CONFIG_MACRO_DIR([m4]) from configure.in to fix
  build with new automake: aide-no_m4_dir.patch</changelog>
  <changelog author="meissner@suse.com" date="1389787200">- aide.conf: Move from md5 and sha1 as default to sha256+sha512, also
  to allow FIPS enabling with aide working. FATE#315925</changelog>
  <changelog author="meissner@suse.com" date="1390478400">- seperate a -test package to help with externalized testing.</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1401278400">- aide-xattr-in-libc.patch: Once upon a time, 10 years ago, basic extended
  attribute functionality moved to libc, therefore libattr is most of the
  time, not needed at all.</changelog>
  <changelog author="meissner@suse.com" date="1435838400">- aide-dynamic.patch: avoid overwriting dl* functions, as we might
  load libcrypto.so dynamically in FIPS mode.</changelog>
  <changelog author="meissner@suse.com" date="1484740800">- Updated to 0.16
  - lots of bugfixes
  - including regexp matching within subdirectories of expressions
- aide-0.16-as-needed.patch: replaces aide-0.15.1-as-needed.patch
- aide-no_m4_dir.patch: upstream
- aide.keyring: added from keyserver, cross checked key id on
  http://aide.sourceforge.net/ and a signature from someone
  I signed.</changelog>
  <changelog author="abergmann@suse.com" date="1562846400">- Remove not available gcrypt algorithm 7 DB_HAVAL (bsc#1098360).
  Add aide-define_hash_use_gcrypt.patch</changelog>
  <changelog author="meissner@suse.com" date="1610020800">- aide-0.15-syslog-format.patch: Add a syslog_format to aide (bsc#1180165)</changelog>
  <changelog author="ali.abdallah@suse.com" date="1637755200">- aide-disable-gcrypt-MD5-in-fips-mode.patch: gcrypt aborts if MD5
  is used in fips mode, so disable it also in aide (bsc#1191422).</changelog>
  <changelog author="meissner@suse.com" date="1642420800">- aide-0.16-cve-2021-45417.patch: Fix a bufferoverflow in base64
  functions (bsc#1194735 CVE-2021-45417)</changelog>
</package>
<package pkgid="31831b38570ca25f865e519e453967aff4a9d3ed03cbda93f68396002c92efaf" name="aide-test" arch="s390x">
  <version epoch="0" ver="0.16" rel="24.1"/>
  <changelog author="mmeister@suse.com" date="1366977600">- Removed AC_CONFIG_MACRO_DIR([m4]) from configure.in to fix
  build with new automake: aide-no_m4_dir.patch</changelog>
  <changelog author="meissner@suse.com" date="1389787200">- aide.conf: Move from md5 and sha1 as default to sha256+sha512, also
  to allow FIPS enabling with aide working. FATE#315925</changelog>
  <changelog author="meissner@suse.com" date="1390478400">- seperate a -test package to help with externalized testing.</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1401278400">- aide-xattr-in-libc.patch: Once upon a time, 10 years ago, basic extended
  attribute functionality moved to libc, therefore libattr is most of the
  time, not needed at all.</changelog>
  <changelog author="meissner@suse.com" date="1435838400">- aide-dynamic.patch: avoid overwriting dl* functions, as we might
  load libcrypto.so dynamically in FIPS mode.</changelog>
  <changelog author="meissner@suse.com" date="1484740800">- Updated to 0.16
  - lots of bugfixes
  - including regexp matching within subdirectories of expressions
- aide-0.16-as-needed.patch: replaces aide-0.15.1-as-needed.patch
- aide-no_m4_dir.patch: upstream
- aide.keyring: added from keyserver, cross checked key id on
  http://aide.sourceforge.net/ and a signature from someone
  I signed.</changelog>
  <changelog author="abergmann@suse.com" date="1562846400">- Remove not available gcrypt algorithm 7 DB_HAVAL (bsc#1098360).
  Add aide-define_hash_use_gcrypt.patch</changelog>
  <changelog author="meissner@suse.com" date="1610020800">- aide-0.15-syslog-format.patch: Add a syslog_format to aide (bsc#1180165)</changelog>
  <changelog author="ali.abdallah@suse.com" date="1637755200">- aide-disable-gcrypt-MD5-in-fips-mode.patch: gcrypt aborts if MD5
  is used in fips mode, so disable it also in aide (bsc#1191422).</changelog>
  <changelog author="meissner@suse.com" date="1642420800">- aide-0.16-cve-2021-45417.patch: Fix a bufferoverflow in base64
  functions (bsc#1194735 CVE-2021-45417)</changelog>
</package>
<package pkgid="3b32f90d38dc481fcc1d355c76d4ce6da1a4788219b4f2dde2dd7cb943e8525b" name="aide-test" arch="x86_64">
  <version epoch="0" ver="0.16" rel="24.1"/>
  <changelog author="mmeister@suse.com" date="1366977600">- Removed AC_CONFIG_MACRO_DIR([m4]) from configure.in to fix
  build with new automake: aide-no_m4_dir.patch</changelog>
  <changelog author="meissner@suse.com" date="1389787200">- aide.conf: Move from md5 and sha1 as default to sha256+sha512, also
  to allow FIPS enabling with aide working. FATE#315925</changelog>
  <changelog author="meissner@suse.com" date="1390478400">- seperate a -test package to help with externalized testing.</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1401278400">- aide-xattr-in-libc.patch: Once upon a time, 10 years ago, basic extended
  attribute functionality moved to libc, therefore libattr is most of the
  time, not needed at all.</changelog>
  <changelog author="meissner@suse.com" date="1435838400">- aide-dynamic.patch: avoid overwriting dl* functions, as we might
  load libcrypto.so dynamically in FIPS mode.</changelog>
  <changelog author="meissner@suse.com" date="1484740800">- Updated to 0.16
  - lots of bugfixes
  - including regexp matching within subdirectories of expressions
- aide-0.16-as-needed.patch: replaces aide-0.15.1-as-needed.patch
- aide-no_m4_dir.patch: upstream
- aide.keyring: added from keyserver, cross checked key id on
  http://aide.sourceforge.net/ and a signature from someone
  I signed.</changelog>
  <changelog author="abergmann@suse.com" date="1562846400">- Remove not available gcrypt algorithm 7 DB_HAVAL (bsc#1098360).
  Add aide-define_hash_use_gcrypt.patch</changelog>
  <changelog author="meissner@suse.com" date="1610020800">- aide-0.15-syslog-format.patch: Add a syslog_format to aide (bsc#1180165)</changelog>
  <changelog author="ali.abdallah@suse.com" date="1637755200">- aide-disable-gcrypt-MD5-in-fips-mode.patch: gcrypt aborts if MD5
  is used in fips mode, so disable it also in aide (bsc#1191422).</changelog>
  <changelog author="meissner@suse.com" date="1642420800">- aide-0.16-cve-2021-45417.patch: Fix a bufferoverflow in base64
  functions (bsc#1194735 CVE-2021-45417)</changelog>
</package>
<package pkgid="1e2510f442e7e5a198a61efffb847c013b77fccfc17f28c9371588cf5a26634d" name="ansible" arch="noarch">
  <version epoch="0" ver="2.9.21" rel="1.10.1"/>
  <changelog author="michael@stroeder.com" date="1589284800">- update to version 2.9.9
  * fix for a regression introduced in 2.9.8</changelog>
  <changelog author="mcepl@suse.com" date="1590494400">- Add CVE-2020-1733_avoid_mkdir_p.patch to fix CVE-2020-1733
  (bsc#1164140)
- Add metadata information to this file to mark which SUSE
  bugzilla have been already fixed.</changelog>
  <changelog author="mcepl@suse.com" date="1590667200">- Correct ID of CVE and rename the patch to
  CVE-2020-1744_avoid_mkdir_p.patch</changelog>
  <changelog author="michael@stroeder.com" date="1592827200">- update to version 2.9.10 with many bug fixes.
- removed CVE-2020-1744_avoid_mkdir_p.patch obsoleted by upstream update</changelog>
  <changelog author="egdfree@opensuse.org" date="1594641600">- added ansible_bugfix_640.diff to fix gh#ansible-collections/community.general#640</changelog>
  <changelog author="michael@stroeder.com" date="1595332800">- update to version 2.9.11 with many bug fixes
- removed ansible_bugfix_640.diff obsoleted by upstream update</changelog>
  <changelog author="michael@stroeder.com" date="1597147200">- update to version 2.9.12 with many bug fixes,
  most notably the following security fixes:
  * security issue - copy - Redact the value of the no_log 'content'
    parameter in the result's invocation.module_args in check mode.
    Previously when used with check mode and with '-vvv', the module would
    not censor the content if a change would be made to the destination path.
    (CVE-2020-14332)
  * security issue atomic_move - change default permissions when creating
    temporary files so they are not world readable
    (https://github.com/ansible/ansible/issues/67794) (CVE-2020-1736)
  * Fix warning for default permission change when no mode is specified.
    Follow up to https://github.com/ansible/ansible/issues/67794.
    (CVE-2020-1736)
  * Sanitize no_log values from any response keys that might be returned
    from the uri module (CVE-2020-14330).
  * reset logging level to INFO due to CVE-2019-14846.</changelog>
  <changelog author="michael@stroeder.com" date="1597233600">- added fix-cron-regression-71207.patch</changelog>
  <changelog author="michael@stroeder.com" date="1598961600">- update to version 2.9.13 with many bug fixes, most notably:
  * A security issue was addressed in the "dnf" module, which previously
    did not check GPG signatures of packages.
  * A bug in the "cron" module was fixed. In some cases prior to this
    fix, the module would inadvertently remove cron entries.
- removed obsolete fix-cron-regression-71207.patch</changelog>
  <changelog author="michael@stroeder.com" date="1601985600">- update to version 2.9.14 with many small improvements and bug fixes,
  most notably:
  * kubectl - connection plugin now redact kubectl_token and
    kubectl_password in console log (CVE-2020-1753).
- avoid trailing comments after %endif</changelog>
  <changelog author="michael@stroeder.com" date="1604404800">- update to version 2.9.15 with following breaking change:
  * ansible-galaxy login command has been removed</changelog>
  <changelog author="michael@stroeder.com" date="1608033600">- update to version 2.9.16 with minor changes and many bug fixes</changelog>
  <changelog author="michael@stroeder.com" date="1611057600">- update to version 2.9.17 with minor changes and a few bug fixes</changelog>
  <changelog author="michael@stroeder.com" date="1613736000">- update to version 2.9.18
  * CVE-2021-20228 where default and fallback values for no_log parameters
    to modules were not previously masked.
  * CVE-2021-20178 where several parameters to the snmp_facts module were
    logged and displayed despite containing sensitive information.
  * CVE-2021-20180 where several parameters to the
    bitbucket_pipeline_variable were logged and displayed despite
    containing sensitive information.
  * CVE-2021-20191 which addresses a number of modules whose parameters
    were logged and displayed despite containing sensitive
    information. For the full list of affected modules, refer to the
    changelog linked below.</changelog>
  <changelog author="michael@stroeder.com" date="1615896000">- update to version 2.9.19 with minor changes and a few bug fixes</changelog>
  <changelog author="michael@stroeder.com" date="1618315200">- update to version 2.9.20
  maintenance release containing numerous bugfixes</changelog>
  <changelog author="alexander.graul@suse.com" date="1618574400">- Switch to python3-cryptography in openSUSE/SLE</changelog>
  <changelog author="alexander.graul@suse.com" date="1618574401">- Drop python-coverage run-time requirement from openSUSE/SLE</changelog>
  <changelog author="michael@stroeder.com" date="1620129600">- update to 2.9.21</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1639483200">- Require python macros for building</changelog>
</package>
<package pkgid="e26aeba455a378cf51823f38429b34ae226d2aad5ef504c83d3527e81a207ed4" name="ansible" arch="src">
  <version epoch="0" ver="2.9.21" rel="1.10.1"/>
  <changelog author="michael@stroeder.com" date="1589284800">- update to version 2.9.9
  * fix for a regression introduced in 2.9.8</changelog>
  <changelog author="mcepl@suse.com" date="1590494400">- Add CVE-2020-1733_avoid_mkdir_p.patch to fix CVE-2020-1733
  (bsc#1164140)
- Add metadata information to this file to mark which SUSE
  bugzilla have been already fixed.</changelog>
  <changelog author="mcepl@suse.com" date="1590667200">- Correct ID of CVE and rename the patch to
  CVE-2020-1744_avoid_mkdir_p.patch</changelog>
  <changelog author="michael@stroeder.com" date="1592827200">- update to version 2.9.10 with many bug fixes.
- removed CVE-2020-1744_avoid_mkdir_p.patch obsoleted by upstream update</changelog>
  <changelog author="egdfree@opensuse.org" date="1594641600">- added ansible_bugfix_640.diff to fix gh#ansible-collections/community.general#640</changelog>
  <changelog author="michael@stroeder.com" date="1595332800">- update to version 2.9.11 with many bug fixes
- removed ansible_bugfix_640.diff obsoleted by upstream update</changelog>
  <changelog author="michael@stroeder.com" date="1597147200">- update to version 2.9.12 with many bug fixes,
  most notably the following security fixes:
  * security issue - copy - Redact the value of the no_log 'content'
    parameter in the result's invocation.module_args in check mode.
    Previously when used with check mode and with '-vvv', the module would
    not censor the content if a change would be made to the destination path.
    (CVE-2020-14332)
  * security issue atomic_move - change default permissions when creating
    temporary files so they are not world readable
    (https://github.com/ansible/ansible/issues/67794) (CVE-2020-1736)
  * Fix warning for default permission change when no mode is specified.
    Follow up to https://github.com/ansible/ansible/issues/67794.
    (CVE-2020-1736)
  * Sanitize no_log values from any response keys that might be returned
    from the uri module (CVE-2020-14330).
  * reset logging level to INFO due to CVE-2019-14846.</changelog>
  <changelog author="michael@stroeder.com" date="1597233600">- added fix-cron-regression-71207.patch</changelog>
  <changelog author="michael@stroeder.com" date="1598961600">- update to version 2.9.13 with many bug fixes, most notably:
  * A security issue was addressed in the "dnf" module, which previously
    did not check GPG signatures of packages.
  * A bug in the "cron" module was fixed. In some cases prior to this
    fix, the module would inadvertently remove cron entries.
- removed obsolete fix-cron-regression-71207.patch</changelog>
  <changelog author="michael@stroeder.com" date="1601985600">- update to version 2.9.14 with many small improvements and bug fixes,
  most notably:
  * kubectl - connection plugin now redact kubectl_token and
    kubectl_password in console log (CVE-2020-1753).
- avoid trailing comments after %endif</changelog>
  <changelog author="michael@stroeder.com" date="1604404800">- update to version 2.9.15 with following breaking change:
  * ansible-galaxy login command has been removed</changelog>
  <changelog author="michael@stroeder.com" date="1608033600">- update to version 2.9.16 with minor changes and many bug fixes</changelog>
  <changelog author="michael@stroeder.com" date="1611057600">- update to version 2.9.17 with minor changes and a few bug fixes</changelog>
  <changelog author="michael@stroeder.com" date="1613736000">- update to version 2.9.18
  * CVE-2021-20228 where default and fallback values for no_log parameters
    to modules were not previously masked.
  * CVE-2021-20178 where several parameters to the snmp_facts module were
    logged and displayed despite containing sensitive information.
  * CVE-2021-20180 where several parameters to the
    bitbucket_pipeline_variable were logged and displayed despite
    containing sensitive information.
  * CVE-2021-20191 which addresses a number of modules whose parameters
    were logged and displayed despite containing sensitive
    information. For the full list of affected modules, refer to the
    changelog linked below.</changelog>
  <changelog author="michael@stroeder.com" date="1615896000">- update to version 2.9.19 with minor changes and a few bug fixes</changelog>
  <changelog author="michael@stroeder.com" date="1618315200">- update to version 2.9.20
  maintenance release containing numerous bugfixes</changelog>
  <changelog author="alexander.graul@suse.com" date="1618574400">- Switch to python3-cryptography in openSUSE/SLE</changelog>
  <changelog author="alexander.graul@suse.com" date="1618574401">- Drop python-coverage run-time requirement from openSUSE/SLE</changelog>
  <changelog author="michael@stroeder.com" date="1620129600">- update to 2.9.21</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1639483200">- Require python macros for building</changelog>
</package>
<package pkgid="544779336d24ad695199c8b3a49441213e3900dbbfd401620cbec25fb0e8eff8" name="ansible-doc" arch="noarch">
  <version epoch="0" ver="2.9.21" rel="1.10.1"/>
  <changelog author="michael@stroeder.com" date="1589284800">- update to version 2.9.9
  * fix for a regression introduced in 2.9.8</changelog>
  <changelog author="mcepl@suse.com" date="1590494400">- Add CVE-2020-1733_avoid_mkdir_p.patch to fix CVE-2020-1733
  (bsc#1164140)
- Add metadata information to this file to mark which SUSE
  bugzilla have been already fixed.</changelog>
  <changelog author="mcepl@suse.com" date="1590667200">- Correct ID of CVE and rename the patch to
  CVE-2020-1744_avoid_mkdir_p.patch</changelog>
  <changelog author="michael@stroeder.com" date="1592827200">- update to version 2.9.10 with many bug fixes.
- removed CVE-2020-1744_avoid_mkdir_p.patch obsoleted by upstream update</changelog>
  <changelog author="egdfree@opensuse.org" date="1594641600">- added ansible_bugfix_640.diff to fix gh#ansible-collections/community.general#640</changelog>
  <changelog author="michael@stroeder.com" date="1595332800">- update to version 2.9.11 with many bug fixes
- removed ansible_bugfix_640.diff obsoleted by upstream update</changelog>
  <changelog author="michael@stroeder.com" date="1597147200">- update to version 2.9.12 with many bug fixes,
  most notably the following security fixes:
  * security issue - copy - Redact the value of the no_log 'content'
    parameter in the result's invocation.module_args in check mode.
    Previously when used with check mode and with '-vvv', the module would
    not censor the content if a change would be made to the destination path.
    (CVE-2020-14332)
  * security issue atomic_move - change default permissions when creating
    temporary files so they are not world readable
    (https://github.com/ansible/ansible/issues/67794) (CVE-2020-1736)
  * Fix warning for default permission change when no mode is specified.
    Follow up to https://github.com/ansible/ansible/issues/67794.
    (CVE-2020-1736)
  * Sanitize no_log values from any response keys that might be returned
    from the uri module (CVE-2020-14330).
  * reset logging level to INFO due to CVE-2019-14846.</changelog>
  <changelog author="michael@stroeder.com" date="1597233600">- added fix-cron-regression-71207.patch</changelog>
  <changelog author="michael@stroeder.com" date="1598961600">- update to version 2.9.13 with many bug fixes, most notably:
  * A security issue was addressed in the "dnf" module, which previously
    did not check GPG signatures of packages.
  * A bug in the "cron" module was fixed. In some cases prior to this
    fix, the module would inadvertently remove cron entries.
- removed obsolete fix-cron-regression-71207.patch</changelog>
  <changelog author="michael@stroeder.com" date="1601985600">- update to version 2.9.14 with many small improvements and bug fixes,
  most notably:
  * kubectl - connection plugin now redact kubectl_token and
    kubectl_password in console log (CVE-2020-1753).
- avoid trailing comments after %endif</changelog>
  <changelog author="michael@stroeder.com" date="1604404800">- update to version 2.9.15 with following breaking change:
  * ansible-galaxy login command has been removed</changelog>
  <changelog author="michael@stroeder.com" date="1608033600">- update to version 2.9.16 with minor changes and many bug fixes</changelog>
  <changelog author="michael@stroeder.com" date="1611057600">- update to version 2.9.17 with minor changes and a few bug fixes</changelog>
  <changelog author="michael@stroeder.com" date="1613736000">- update to version 2.9.18
  * CVE-2021-20228 where default and fallback values for no_log parameters
    to modules were not previously masked.
  * CVE-2021-20178 where several parameters to the snmp_facts module were
    logged and displayed despite containing sensitive information.
  * CVE-2021-20180 where several parameters to the
    bitbucket_pipeline_variable were logged and displayed despite
    containing sensitive information.
  * CVE-2021-20191 which addresses a number of modules whose parameters
    were logged and displayed despite containing sensitive
    information. For the full list of affected modules, refer to the
    changelog linked below.</changelog>
  <changelog author="michael@stroeder.com" date="1615896000">- update to version 2.9.19 with minor changes and a few bug fixes</changelog>
  <changelog author="michael@stroeder.com" date="1618315200">- update to version 2.9.20
  maintenance release containing numerous bugfixes</changelog>
  <changelog author="alexander.graul@suse.com" date="1618574400">- Switch to python3-cryptography in openSUSE/SLE</changelog>
  <changelog author="alexander.graul@suse.com" date="1618574401">- Drop python-coverage run-time requirement from openSUSE/SLE</changelog>
  <changelog author="michael@stroeder.com" date="1620129600">- update to 2.9.21</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1639483200">- Require python macros for building</changelog>
</package>
<package pkgid="b560ffef2d2f39ecceecf20cdf2f56db65477c5c3873ed359f0d6a3feff117cf" name="ansible-test" arch="noarch">
  <version epoch="0" ver="2.9.21" rel="1.10.1"/>
  <changelog author="michael@stroeder.com" date="1589284800">- update to version 2.9.9
  * fix for a regression introduced in 2.9.8</changelog>
  <changelog author="mcepl@suse.com" date="1590494400">- Add CVE-2020-1733_avoid_mkdir_p.patch to fix CVE-2020-1733
  (bsc#1164140)
- Add metadata information to this file to mark which SUSE
  bugzilla have been already fixed.</changelog>
  <changelog author="mcepl@suse.com" date="1590667200">- Correct ID of CVE and rename the patch to
  CVE-2020-1744_avoid_mkdir_p.patch</changelog>
  <changelog author="michael@stroeder.com" date="1592827200">- update to version 2.9.10 with many bug fixes.
- removed CVE-2020-1744_avoid_mkdir_p.patch obsoleted by upstream update</changelog>
  <changelog author="egdfree@opensuse.org" date="1594641600">- added ansible_bugfix_640.diff to fix gh#ansible-collections/community.general#640</changelog>
  <changelog author="michael@stroeder.com" date="1595332800">- update to version 2.9.11 with many bug fixes
- removed ansible_bugfix_640.diff obsoleted by upstream update</changelog>
  <changelog author="michael@stroeder.com" date="1597147200">- update to version 2.9.12 with many bug fixes,
  most notably the following security fixes:
  * security issue - copy - Redact the value of the no_log 'content'
    parameter in the result's invocation.module_args in check mode.
    Previously when used with check mode and with '-vvv', the module would
    not censor the content if a change would be made to the destination path.
    (CVE-2020-14332)
  * security issue atomic_move - change default permissions when creating
    temporary files so they are not world readable
    (https://github.com/ansible/ansible/issues/67794) (CVE-2020-1736)
  * Fix warning for default permission change when no mode is specified.
    Follow up to https://github.com/ansible/ansible/issues/67794.
    (CVE-2020-1736)
  * Sanitize no_log values from any response keys that might be returned
    from the uri module (CVE-2020-14330).
  * reset logging level to INFO due to CVE-2019-14846.</changelog>
  <changelog author="michael@stroeder.com" date="1597233600">- added fix-cron-regression-71207.patch</changelog>
  <changelog author="michael@stroeder.com" date="1598961600">- update to version 2.9.13 with many bug fixes, most notably:
  * A security issue was addressed in the "dnf" module, which previously
    did not check GPG signatures of packages.
  * A bug in the "cron" module was fixed. In some cases prior to this
    fix, the module would inadvertently remove cron entries.
- removed obsolete fix-cron-regression-71207.patch</changelog>
  <changelog author="michael@stroeder.com" date="1601985600">- update to version 2.9.14 with many small improvements and bug fixes,
  most notably:
  * kubectl - connection plugin now redact kubectl_token and
    kubectl_password in console log (CVE-2020-1753).
- avoid trailing comments after %endif</changelog>
  <changelog author="michael@stroeder.com" date="1604404800">- update to version 2.9.15 with following breaking change:
  * ansible-galaxy login command has been removed</changelog>
  <changelog author="michael@stroeder.com" date="1608033600">- update to version 2.9.16 with minor changes and many bug fixes</changelog>
  <changelog author="michael@stroeder.com" date="1611057600">- update to version 2.9.17 with minor changes and a few bug fixes</changelog>
  <changelog author="michael@stroeder.com" date="1613736000">- update to version 2.9.18
  * CVE-2021-20228 where default and fallback values for no_log parameters
    to modules were not previously masked.
  * CVE-2021-20178 where several parameters to the snmp_facts module were
    logged and displayed despite containing sensitive information.
  * CVE-2021-20180 where several parameters to the
    bitbucket_pipeline_variable were logged and displayed despite
    containing sensitive information.
  * CVE-2021-20191 which addresses a number of modules whose parameters
    were logged and displayed despite containing sensitive
    information. For the full list of affected modules, refer to the
    changelog linked below.</changelog>
  <changelog author="michael@stroeder.com" date="1615896000">- update to version 2.9.19 with minor changes and a few bug fixes</changelog>
  <changelog author="michael@stroeder.com" date="1618315200">- update to version 2.9.20
  maintenance release containing numerous bugfixes</changelog>
  <changelog author="alexander.graul@suse.com" date="1618574400">- Switch to python3-cryptography in openSUSE/SLE</changelog>
  <changelog author="alexander.graul@suse.com" date="1618574401">- Drop python-coverage run-time requirement from openSUSE/SLE</changelog>
  <changelog author="michael@stroeder.com" date="1620129600">- update to 2.9.21</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1639483200">- Require python macros for building</changelog>
</package>
<package pkgid="f1fe0108de4d69f782318db26cd6a71c552d33b838aef217afe20258a31bec6e" name="boost" arch="src">
  <version epoch="0" ver="1.66.0" rel="12.3.1"/>
  <changelog author="adam.majer@suse.de" date="1478606400">- Revert upstream change that set default python version and
  ignored user configuration.
  python-2059618.patch (boo#1006584)</changelog>
  <changelog author="adam.majer@suse.de" date="1483531200">- update to version 1.63.0
  * updated libraries: atomic, container, context, fiber,
    fusion, geometry, hash, interprocess, intrusive, lexical cast,
    log, metaparse, move, optional, phoenix, python, test,
    typeindex, units, unordered
  * see http://www.boost.org/users/history/version_1_63_0.html
    for complete list of changes
- refresh patches
  * boost-1.55.0-python-test-PyImport_AppendInittab.patch
  * boost-strict_aliasing.patch, and enable -fno-strict-aliasing
    for python module
- baselibs.conf:
  * add libboost_locale
  * rename python to include new soname
- remove python-2059618.patch, not needed
- make build condition --without buil_mpi work
- allow building without python3 bindings, for SLE11SP4
- remove versioned build dependency on libicu-devel, apparently
  not needed.
- split out the boost-devel package into individudal compiled
  libraries and their -devel subpackages and libboost_headers-devel
  package for header-only libraries.
- remove all the -mt.so symlinks, probably not needed anymore.
- ship MPI python bindings for both Python 2.7 and 3.x
  * add python_mpi.patch to allow proper compiled library loading
- dynamic_linking.patch: first attempt to remove static library
  generation during build process.</changelog>
  <changelog author="adam.majer@suse.de" date="1484481600">- remove non-existent dependency in the boost mpi python package</changelog>
  <changelog author="adam.majer@suse.de" date="1484654400">- test_lowcase.patch: downcase Boost::Test usage of uppercase
  variables. VERSION was clashing with GNU Autotools define
  resulting in compilation errors of various packages.
- recombine headers from various devel subpackages under the
  libboost_headers-devel package. Not all usage of headers that
  have compiled parts pull in their associated compiled symbols.
- general cleanup of the spec file from old, commented stuffs</changelog>
  <changelog author="adam.majer@suse.de" date="1485345600">- Fix dependency typos.</changelog>
  <changelog author="adam.majer@suse.de" date="1486123200">- baselibs.conf: (re)add python 2.7 and 3.x libraries</changelog>
  <changelog author="jmatejek@suse.com" date="1486728000">- update python macros</changelog>
  <changelog author="adam.majer@suse.de" date="1492689600">- New upstream version 1.64.0
  + process - new library providing cross platform methods to
  - create child processes
  - setup stream for child processes
  - sync and async communication streams with children
  - sync and async wait
  - process termination
  + geometry library had some breaking changes,
  - ublas_transformer is renamed to matrix_transformer
  - explicit modifier is added to constructors of rtree
    index::dynamic_* parameters
  - strategy::area::huiller replaced by strategy::area::spherical
  + context library updates
  - deprecated API:execution-context
  - fixed bad assembly for fcontext on ppc64/sysv/elf
  + Updated libraries: any, atomic, config, container, context,
    conversion, core, coroutine2, fiber, hash, interprocess,
    intrusive, lexicalcast, math, multi-index containers,
    multiprecision, predef, program options, regex, smart pointers,
    test ,typeindex, typetraits, unordered, variant
  + for details, see
    http://www.boost.org/users/history/version_1_64_0.html
- Build PyNumpy module
  + add build requires on python-numpy
- test_lowcase.patch: upstreamed
- refreshed patches: boost-strict_aliasing.patch, gcc_path.patch,
  python_mpi.patch
- mpi_upstream.patch: pending upstream fixes to OpenMPI build
- python_library_name.patch: we are building python versions in
  different stagings so drop library renames.
- python_numpy_retfunc.patch: rpmlint fixes</changelog>
  <changelog author="adam.majer@suse.de" date="1494244800">- make python-numpy optional build dependency
- fix building of mpi python3 plugin</changelog>
  <changelog author="adam.majer@suse.de" date="1494331200">- 1d862615.patch: Fix regression caused by refactoring of
  serialization code (bnc#1038083)</changelog>
  <changelog author="adam.majer@suse.de" date="1505908800">- New upstream version 1.65.1
  + config, fiber - Return a continuation from functions executed
    by resume_with.
  + stacktrace - Change preprocessor file extensions to work with
    the installation system.
- Changes in version 1.65.0
  + stacktrace - new library providing call sequence in human
    readable format.
  + polycollection - new library providing fast containers of
    polymorphic objects, from Joaquín M López Muñoz.
  + For full list of changes, see
    http://www.boost.org/users/history/version_1_65_1.html
- 1d862615.patch: upstreamed and removed
- gcc_path.patch: obsolete, tr1 module is removed
- mpi_upstream.patch: upstreamed and removed
- boost-1.57.0-python-abi_letters.patch: refreshed
- python_library_name.patch: refreshed and reverted upstream
  changes to mpi/build/Jamfile as we are building python2 and
  python3 versions of MPI separately.
- baselibs.conf
  + add libboost_stracktrace
  + update to version 1.65.1</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1507550400">- Setup MPI environment prior to building boost.
- Switch to OpenMPI2 as OpenMPI1 is becoming deprecated.</changelog>
  <changelog author="adam.majer@suse.de" date="1507636800">- Use multibuild setup - build no-dependency libraries in the
  base package and build the rest of the compiled libraries in
  the main variant. This should speed up bootstrapping.
- boost-devel not built by default anymore.
- libboost_headers-devel now provides boost-devel for legacy
  dependencies. If you need compiled boost libraries depend on
  the current compiled devel subpackage.
- run %fdupes only on the header files and documentation
- drop build dependencies on gcc-fortran, chrpath.</changelog>
  <changelog author="jmatejek@suse.com" date="1508846400">- build Python 2 conditionally</changelog>
  <changelog author="adam.majer@suse.de" date="1511956800">- re-enable Python 2 by default. It's still conditional, but
  remains enabled by default. This can be disabled in project
  config.</changelog>
  <changelog author="adam.majer@suse.de" date="1513598400">- Update to version 1.66.0
  + Beast: new portable HTTP, WebSocket and network operations
    using Boost.Asio. Header-only library.
  + Callable Traits: new library and successor to
    Boost.FunctionTypes. Header-only library.
  + Mp11: new metaprogramming library
  + Asio:
  * implemented interface changes to reflect the Networking TS
    (N4656)
  * functions and classes that have been superseded by
    Networking TS functionality have been deprecated.
  * added support for customized handler tracking
  * removed previously deprecated functions
  + Atomic: improved compatibility with GCC 7. 128-bit operations
    on x86_64 no longer require linking with compiled library.
  + DateTime: Fixed an integral overflow that could cause incorrect
    results when adding or subtracting many years from a date.
  + Format: New format specifiers added and volatile arguments
    can not be safely used with operator%
  + Fusion:
  * fix compile error with std::array
  * remove circular preprocessor include
  + PolyCollection: backported to GCC 4.8 and 4.9 with some
    limitations
  + Uuid: added RTF-4122 namespaces in boost::uuids::ns
  + for complete changelog, see
    http://www.boost.org/users/history/version_1_66_0.html
- refreshed patches: boost-rpmoptflags-only.patch</changelog>
  <changelog author="adam.majer@suse.de" date="1516363200">- Multibuild requires versioned Name: tag and doesn't seem to do
  this automatically. (bnc#1076640)</changelog>
  <changelog author="kukuk@suse.de" date="1522843200">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="adam.majer@suse.de" date="1584619200">- libreoffice_compat_backports.patch: add a backport of
  Boost.Optional::has_value() for LibreOffice</changelog>
  <changelog author="adam.majer@suse.de" date="1641816000">- variant.patch: backport fix allowing perfect forwarding in
  apply_visitor. Also fix wrong usage of boost::move (bsc#1194522)</changelog>
</package>
<package pkgid="4595a0ecf7cd25989f315ae71b0e73f949ff08a7e27660ef2a1998ed12dd7a54" name="cargo-doc" arch="noarch">
  <version epoch="0" ver="1.53.0" rel="22.1"/>
  <changelog author="luke@ljones.dev" date="1569844800">- Add patch add-option-to-allow-warnings.patch to add a config option
  which allows warnings and so enables v1.38 to bootstrap itself.</changelog>
  <changelog author="rhafer@suse.com" date="1571832000">- Switch to bundled version of libgit2 for now. libgit2-sys seems
  to expect using the bundled variant, which just seems to point
  to a snapshot of the master branch and doesn't match any released
  libgit2 (bsc#1154817).
  See: https://github.com/rust-lang/rust/issues/63476 and
  https://github.com/rust-lang/git2-rs/issues/458 for details.</changelog>
  <changelog author="aplanas@suse.com" date="1573128000">- Update to version 1.39.0
  + Language
  - You can now create async functions and blocks with async fn,
    async move {}, and async {} respectively, and you can now call
    .await on async expressions.
  - You can now use certain attributes on function, closure, and
    function pointer parameters.
  - You can now take shared references to bind-by-move patterns in
    the if guards of match arms.
  + Compiler
  - Added tier 3 support for the i686-unknown-uefi target.
  - Added tier 3 support for the sparc64-unknown-openbsd target.
  - rustc will now trim code snippets in diagnostics to fit in your
    terminal.
  - You can now pass --show-output argument to test binaries to
    print the output of successful tests.
  + For more details:
    https://github.com/rust-lang/rust/blob/stable/RELEASES.md#version-1390-2019-11-07
- Drop patches already merged in upstream:
  + rust-61206-assume-tarball-llvm-is-fresh.patch
  + add-option-to-allow-warnings.patch</changelog>
  <changelog author="aplanas@suse.com" date="1573214400">- Add hopefully-fix-rustdoc-build.patch to fix rustdoc compilation</changelog>
  <changelog author="aplanas@suse.com" date="1574683200">- Re-format the spec file
- Add a README to explain the update process
- Add _service file for download the assets and re-base the patches</changelog>
  <changelog author="ngompa13@gmail.com" date="1575028800">- Rename README to README.suse-maint and add it as a source
  to stop factory-auto from declining submissions automatically</changelog>
  <changelog author="opensuse-packaging@opensuse.org" date="1577707200">- Rebased patches:
  + hopefully-fix-rustdoc-build.patch dropped (merged upstream)</changelog>
  <changelog author="luke@ljones.dev" date="1577707201">- Update to version 1.40.0
  + Language
  - You can now use tuple `struct`s and tuple `enum` variant's constructors in
    `const` contexts. e.g.
    pub struct Point(i32, i32);
    const ORIGIN: Point = {
    let constructor = Point;
    constructor(0, 0)
    };
  - You can now mark `struct`s, `enum`s, and `enum` variants with the `#[non_exhaustive]` attribute to
    indicate that there may be variants or fields added in the future.
    For example this requires adding a wild-card branch (`_ =&gt; {}`) to any match
    statements on a non-exhaustive `enum`.
  - You can now use function-like procedural macros in `extern` blocks and in
    type positions. e.g. `type Generated = macro!();`
  - Function-like and attribute procedural macros can now emit
    `macro_rules!` items, so you can now have your macros generate macros.
  - The `meta` pattern matcher in `macro_rules!` now correctly matches the modern
    attribute syntax. For example `(#[$m:meta])` now matches `#[attr]`,
    `#[attr{tokens}]`, `#[attr[tokens]]`, and `#[attr(tokens)]`.
  + Compiler
  - Added tier 3 support\* for the
    `thumbv7neon-unknown-linux-musleabihf` target.
  - Added tier 3 support for the
    `aarch64-unknown-none-softfloat` target.
  - Added tier 3 support for the `mips64-unknown-linux-muslabi64`, and
    `mips64el-unknown-linux-muslabi64` targets.
  + Libraries
  - The `is_power_of_two` method on unsigned numeric types is now a `const` function.
  + Stabilized APIs
  - BTreeMap::get_key_value
  - HashMap::get_key_value
  - Option::as_deref_mut
  - Option::as_deref
  - Option::flatten
  - UdpSocket::peer_addr
  - f32::to_be_bytes
  - f32::to_le_bytes
  - f32::to_ne_bytes
  - f64::to_be_bytes
  - f64::to_le_bytes
  - f64::to_ne_bytes
  - f32::from_be_bytes
  - f32::from_le_bytes
  - f32::from_ne_bytes
  - f64::from_be_bytes
  - f64::from_le_bytes
  - f64::from_ne_bytes
  - mem::take
  - slice::repeat
  - todo!
  + Cargo
  - Cargo will now always display warnings, rather than only on
    fresh builds.
  - Feature flags (except `--all-features`) passed to a virtual workspace will
    now produce an error. Previously these flags were ignored.
  - You can now publish `dev-dependencies` without including
    a `version`.
  + Misc
  - You can now specify the `#[cfg(doctest)]` attribute to include an item only
    when running documentation tests with `rustdoc`.
  + Compatibility Notes
  - As previously announced, any previous NLL warnings in the 2015 edition are
    now hard errors.
  - The `include!` macro will now warn if it failed to include the
    entire file. The `include!` macro unintentionally only includes the
    first _expression_ in a file, and this can be unintuitive. This will become
    either a hard error in a future release, or the behavior may be fixed to include all expressions as expected.
  - Using `#[inline]` on function prototypes and consts now emits a warning under
    `unused_attribute` lint. Using `#[inline]` anywhere else inside traits
    or `extern` blocks now correctly emits a hard error.</changelog>
  <changelog author="federico@suse.com" date="1578484800">- Bump version of libssh2 for SLE15; we now need a version with
  libssh2_userauth_publickey_frommemory(), which appeared in libssh2
  1.6.0.
- Use the bundled libssh2 prior to SLE15.  SLE12 has 1.4.3, which is
  too old for the ssh crate now.</changelog>
  <changelog author="dimstar@opensuse.org" date="1579262400">- Adjust constraints: Request 20GB HDD for all archs. Simplify the
  file by removing the overrides for various disk sizes. All archs
  are curretnly at roughly 17GB storage in use.</changelog>
  <changelog author="federico@suse.com" date="1584964800">- Update to version 1.41.1:
  - Always check types of static items
  - Always check lifetime bounds of `Copy` impls
  - Fix miscompilation in callers of `Layout::repeat`
- Update to version 1.41.0:
  + Language
  - You can now pass type parameters to foreign items when implementing
    traits. E.g. You can now write `impl&lt;T&gt; From&lt;Foo&gt; for Vec&lt;T&gt; {}`.
  - You can now arbitrarily nest receiver types in the `self` position. E.g. you can
    now write `fn foo(self: Box&lt;Box&lt;Self&gt;&gt;) {}`. Previously only `Self`, `&amp;Self`,
    `&amp;mut Self`, `Arc&lt;Self&gt;`, `Rc&lt;Self&gt;`, and `Box&lt;Self&gt;` were allowed.
  - You can now use any valid identifier in a `format_args` macro.
    Previously identifiers starting with an underscore were not allowed.
  - Visibility modifiers (e.g. `pub`) are now syntactically allowed on trait items and
    enum variants. These are still rejected semantically, but
    can be seen and parsed by procedural macros and conditional compilation.
  + Compiler
  - Rustc will now warn if you have unused loop `'label`s.
  - Removed support for the `i686-unknown-dragonfly` target.
  - Added tier 3 support\* for the `riscv64gc-unknown-linux-gnu` target.
  - You can now pass an arguments file passing the `@path` syntax
    to rustc. Note that the format differs somewhat from what is
    found in other tooling; please see the documentation for
    more information.
  - You can now provide `--extern` flag without a path, indicating that it is
    available from the search path or specified with an `-L` flag.
    Refer to Rust's [platform support page][forge-platform-support] for more
    information on Rust's tiered platform support.
  + Libraries
  - The `core::panic` module is now stable. It was already stable
    through `std`.
  - `NonZero*` numerics now implement `From&lt;NonZero*&gt;` if it's a smaller integer
    width. E.g. `NonZeroU16` now implements `From&lt;NonZeroU8&gt;`.
  - `MaybeUninit&lt;T&gt;` now implements `fmt::Debug`.
  + Stabilized APIs
  - `Result::map_or`
  - `Result::map_or_else`
  - `std::rc::Weak::weak_count`
  - `std::rc::Weak::strong_count`
  - `std::sync::Weak::weak_count`
  - `std::sync::Weak::strong_count`
  + Cargo
  - Cargo will now document all the private items for binary crates
    by default.
  - `cargo-install` will now reinstall the package if it detects that it is out
    of date.
  - Cargo.lock now uses a more git friendly format that should help to reduce
    merge conflicts.
  - You can now override specific dependencies's build settings. E.g.
    `[profile.dev.package.image] opt-level = 2` sets the `image` crate's
    optimisation level to `2` for debug builds. You can also use
    `[profile.&lt;profile&gt;.build-override]` to override build scripts and
    their dependencies.
  + Misc
  - You can now specify `edition` in documentation code blocks to compile the block
    for that edition. E.g. `edition2018` tells rustdoc that the code sample
    should be compiled the 2018 edition of Rust.
  - You can now provide custom themes to rustdoc with `--theme`, and check the
    current theme with `--check-theme`.
  - You can use `#[cfg(doc)]` to compile an item when building documentation.
  + Compatibility Notes
  - As previously announced 1.41.0 will be the last tier 1 release for 32-bit
    Apple targets. This means that the source code is still
    available to build, but the targets are no longer being tested and release
    binaries for those platforms will no longer be distributed by the Rust project.
    Please refer to the linked blog post for more information.</changelog>
  <changelog author="alarrosa@suse.com" date="1585656000">- Rebased patches:
  + ignore-Wstring-conversion.patch (offset / fuzz)</changelog>
  <changelog author="alarrosa@suse.com" date="1585656001">- Update to version 1.42.0:
  + Language
  - You can now use the slice pattern syntax with subslices.
  - You can now use #[repr(transparent)] on univariant enums. Meaning
    that you can create an enum that has the exact layout and ABI of
    the type it contains.
  - There are some syntax-only changes:
  * default is syntactically allowed before items in trait
    definitions.
  * Items in impls (i.e. consts, types, and fns) may syntactically
    leave out their bodies in favor of ;.
  * Bounds on associated types in impls are now syntactically
    allowed (e.g. type Foo: Ord;).
  * ... (the C-variadic type) may occur syntactically directly
    as the type of any function parameter.
    These are still rejected semantically, so you will likely receive
    an error but these changes can be seen and parsed by procedural
    macros and conditional compilation.
  + Compiler
  - Added tier 2 support for armv7a-none-eabi.
  - Added tier 2 support for riscv64gc-unknown-linux-gnu.
  - Option::{expect,unwrap} and Result::{expect, expect_err, unwrap,
    unwrap_err} now produce panic messages pointing to the location
    where they were called, rather than core's internals.
    Refer to Rust's platform support page for more information on
    Rust's tiered platform support.
  + Libraries
  - iter::Empty&lt;T&gt; now implements Send and Sync for any T.
  - Pin::{map_unchecked, map_unchecked_mut} no longer require the
    return type to implement Sized.
  - io::Cursor now derives PartialEq and Eq.
  - Layout::new is now const.
  - Added Standard Library support for riscv64gc-unknown-linux-gnu.
  + Stabilized APIs
  - CondVar::wait_while
  - CondVar::wait_timeout_while
  - DebugMap::key
  - DebugMap::value
  - ManuallyDrop::take
  - matches!
  - ptr::slice_from_raw_parts_mut
  - ptr::slice_from_raw_parts
  + Cargo
  - You no longer need to include extern crate proc_macro; to be
    able to use proc_macro; in the 2018 edition.
  + Compatibility Notes
  - Error::description has been deprecated, and its use will now
    produce a warning. It's recommended to use Display/to_string
    instead.</changelog>
  <changelog author="schwab@suse.de" date="1586260800">- Avoid duplication of environment settings</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1588161600">- Update to version 1.43.0
  + Language
  - Fixed using binary operations with `&amp;{number}` (e.g. `&amp;1.0`)
    not having the type inferred correctly.
  - Attributes such as `#[cfg()]` can now be used on `if`
    expressions.
  - Syntax only changes:
  * Allow `type Foo: Ord` syntactically.
  * Fuse associated and extern items up to defaultness.
  * Syntactically allow `self` in all `fn` contexts.
  * Merge `fn` syntax + cleanup item parsing.
  * `item` macro fragments can be interpolated into `trait`s,
    `impl`s, and `extern` blocks.
    For example, you may now write:
    ```rust
    macro_rules! mac_trait {
    ($i:item) =&gt; {
    trait T { $i }
    }
    }
    mac_trait! {
    fn foo() {}
    }
    ```
  * These are still rejected *semantically*, so you will likely
    receive an error but these changes can be seen and parsed by
    macros and conditional compilation.
  + Compiler
  - You can now pass multiple lint flags to rustc to override the
    previous flags.
    For example; `rustc -D unused -A unused-variables` denies
    everything in the `unused` lint group except `unused-variables`
    which is explicitly allowed. However, passing
    `rustc -A unused-variables -D unused` denies everything in
    the `unused` lint group **including** `unused-variables` since
    the allow flag is specified before the deny flag (and therefore
    overridden).
  - rustc will now prefer your system MinGW libraries over its
    bundled libraries if they are available on `windows-gnu`.
  - rustc now buffers errors/warnings printed in JSON.
  + Libraries
  - `Arc&lt;[T; N]&gt;`, `Box&lt;[T; N]&gt;`, and `Rc&lt;[T; N]&gt;`, now implement
    `TryFrom&lt;Arc&lt;[T]&gt;&gt;`,`TryFrom&lt;Box&lt;[T]&gt;&gt;`, and `TryFrom&lt;Rc&lt;[T]&gt;&gt;`
    respectively.
  * *Note** These conversions are only available when `N` is
    `0..=32`.
  - You can now use associated constants on floats and integers
    directly, rather than having to import the module.
    e.g. You can now write `u32::MAX` or `f32::NAN` with no imports.
  - `u8::is_ascii` is now `const`.
  - `String` now implements `AsMut&lt;str&gt;`.
  - Added the `primitive` module to `std` and `core`.
    This module reexports Rust's primitive types. This is mainly
    useful in macros where you want avoid these types being shadowed.
  - Relaxed some of the trait bounds on `HashMap` and `HashSet`.
  - `string::FromUtf8Error` now implements `Clone + Eq`.
  + Stabilized APIs
  - `Once::is_completed`
  - `f32::LOG10_2`
  - `f32::LOG2_10`
  - `f64::LOG10_2`
  - `f64::LOG2_10`
  - `iter::once_with`
  + Cargo
  - You can now set config `[profile]`s in your `.cargo/config`,
    or through your environment.
  - Cargo will now set `CARGO_BIN_EXE_&lt;name&gt;` pointing to a
    binary's executable path when running integration tests or
    benchmarks.
    `&lt;name&gt;` is the name of your binary as-is e.g. If you wanted
    the executable path for a binary named `my-program`you would
    use `env!("CARGO_BIN_EXE_my-program")`.
  + Misc
  - Certain checks in the `const_err` lint were deemed unrelated
    to const evaluation, and have been moved to the
    `unconditional_panic` and `arithmetic_overflow` lints.
  + Compatibility Notes
  - Having trailing syntax in the `assert!` macro is now a hard
    error. This has been a warning since 1.36.0.
  - Fixed `Self` not having the correctly inferred type. This
    incorrectly led to some instances being accepted, and now
    correctly emits a hard error.</changelog>
  <changelog author="schwab@suse.de" date="1588593600">- Update rustfmt_version</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1589457600">- Update to version 1.43.1
  - Updated openssl-src to 1.1.1g for CVE-2020-1967.
  - Fixed the stabilization of AVX-512 features.
  - Fixed `cargo package --list` not working with unpublished
    dependencies.
- Check upstream signatures for binaries
- Add rust.keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1592827200">- Add patch Fix-big-endian-miscompile-of-bitcast-zex.patch
  to fix miscompilations with rustc 1.43 that lead to LTO failures
  (bsc#1173202)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1627387200">- Needed for Firefox91 (bsc#1188891)
- Rebased patches:
  + ignore-Wstring-conversion.patch (offset / fuzz)
  + Fix-big-endian-miscompile-of-bitcast-zex.patch dropped
- Add support for riscv64
- Make all shared libraries in %{common_libdir} executable; otherwise
  fdupes will not find any duplicates in %{rustlibdir}.
- rust-rpmlintrc: Reflect updated LLVM name in the filter.
- &lt;https://github.com/rust-lang/rust/issues/74976&gt;: Add "--stage 1"
  to the "./x.py doc" call to ensure the newly built compiler gets
  used.
- Resolve issue in constraints to select aarch64 builders in OBS that
  have correctly functioning CPU's.
- Resolve issue with zlib selection and buildrequires.
- Correct build issues with esoteric cpu architectures, by removing
  developer facing tools in some cases.
- Updates to spec file and legacy cleanups during build processes
- Correct issues with incorrect tuning of codegen units that caused
  builders to OOM
- Update to version 1.53:
  + Language
  - [You can now use unicode for identifiers.][83799] This allows multilingual
    identifiers but still doesn't allow glyphs that are not considered characters
    such as `?` or `?`. More specifically you can now use any identifier that
    matches the UAX #31 "Unicode Identifier and Pattern Syntax" standard. This
    is the same standard as languages like Python, however Rust uses NFC
    normalization which may be different from other languages.
  - [You can now specify "or patterns" inside pattern matches.][79278]
    Previously you could only use `|` (OR) on complete patterns. E.g.
    ```rust
    let x = Some(2u8);
    // Before
    matches!(x, Some(1) | Some(2));
    // Now
    matches!(x, Some(1 | 2));
    ```
  - [Added the `:pat_param` `macro_rules!` matcher.][83386] This matcher
    has the same semantics as the `:pat` matcher. This is to allow `:pat`
    to change semantics to being a pattern fragment in a future edition.
  + Compiler
  - [Updated the minimum external LLVM version to LLVM 10.][83387]
  - [Added Tier 3\* support for the `wasm64-unknown-unknown` target.][80525]
  - [Improved debuginfo for closures and async functions on Windows MSVC.][83941]
    \* Refer to Rust's [platform support page][platform-support-doc] for more
    information on Rust's tiered platform support.
  + Libraries
  - [Abort messages will now forward to `android_set_abort_message` on
    Android platforms when available.][81469]
  - [`slice::IterMut&lt;'_, T&gt;` now implements `AsRef&lt;[T]&gt;`][82771]
  - [Arrays of any length now implement `IntoIterator`.][84147]
    Currently calling `.into_iter()` as a method on an array will
    return `impl Iterator&lt;Item=&amp;T&gt;`, but this may change in a
    future edition to change `Item` to `T`. Calling `IntoIterator::into_iter`
    directly on arrays will provide `impl Iterator&lt;Item=T&gt;` as expected.
  - [`leading_zeros`, and `trailing_zeros` are now available on all
    `NonZero` integer types.][84082]
  - [`{f32, f64}::from_str` now parse and print special values
    (`NaN`, `-0`) according to IEEE RFC 754.][78618]
  - [You can now index into slices using `(Bound&lt;usize&gt;, Bound&lt;usize&gt;)`.][77704]
  - [Add the `BITS` associated constant to all numeric types.][82565]
  + Cargo
  - [Cargo now supports git repositories where the default `HEAD` branch is not
    "master".][cargo/9392] This also includes a switch to the version 3 `Cargo.lock` format
    which can handle default branches correctly.
  - [macOS targets now default to `unpacked` split-debuginfo.][cargo/9298]
  - [The `authors` field is no longer included in `Cargo.toml` for new
    projects.][cargo/9282]
  + Rustdoc
  - [Added the `rustdoc::bare_urls` lint that warns when you have URLs
    without hyperlinks.][81764]
  + Compatibility Notes
  - [Implement token-based handling of attributes during expansion][82608]
  - [`Ipv4::from_str` will now reject octal format IP addresses in addition
    to rejecting hexadecimal IP addresses.][83652] The octal format can lead
    to confusion and potential security vulnerabilities and [is no
    longer recommended][ietf6943].
- Update to version 1.52:
  + Language
  - [Added the `unsafe_op_in_unsafe_fn` lint, which checks whether the unsafe code
    in an `unsafe fn` is wrapped in a `unsafe` block.][79208] This lint
    is allowed by default, and may become a warning or hard error in a
    future edition.
  - [You can now cast mutable references to arrays to a pointer of the same type as
    the element.][81479]
  + Compiler
  - [Upgraded the default LLVM to LLVM 12.][81451]
  - Added tier 3\* support for the following targets.
  - [`s390x-unknown-linux-musl`][82166]
  - [`riscv32gc-unknown-linux-musl` &amp; `riscv64gc-unknown-linux-musl`][82202]
  - [`powerpc-unknown-openbsd`][82733]
  + Libraries
  - [`OsString` now implements `Extend` and `FromIterator`.][82121]
  - [`cmp::Reverse` now has `#[repr(transparent)]` representation.][81879]
  - [`Arc&lt;impl Error&gt;` now implements `error::Error`.][80553]
  - [All integer division and remainder operations are now `const`.][80962]
  + Stabilised APIs
  - [`Arguments::as_str`]
  - [`char::MAX`]
  - [`char::REPLACEMENT_CHARACTER`]
  - [`char::UNICODE_VERSION`]
  - [`char::decode_utf16`]
  - [`char::from_digit`]
  - [`char::from_u32_unchecked`]
  - [`char::from_u32`]
  - [`slice::partition_point`]
  - [`str::rsplit_once`]
  - [`str::split_once`]
    The following previously stable APIs are now `const`.
  - [`char::len_utf8`]
  - [`char::len_utf16`]
  - [`char::to_ascii_uppercase`]
  - [`char::to_ascii_lowercase`]
  - [`char::eq_ignore_ascii_case`]
  - [`u8::to_ascii_uppercase`]
  - [`u8::to_ascii_lowercase`]
  - [`u8::eq_ignore_ascii_case`]
  + Rustdoc
  - [Rustdoc lints are now treated as a tool lint, meaning that
    lints are now prefixed with `rustdoc::` (e.g. `#[warn(rustdoc::non_autolinks)]`).][80527]
    Using the old style is still allowed, and will become a warning in
    a future release.
  - [Rustdoc now supports argument files.][82261]
  - [Rustdoc now generates smart punctuation for documentation.][79423]
  - [You can now use "task lists" in Rustdoc Markdown.][81766] E.g.
    ```markdown
  - [x] Complete
  - [ ] Todo
    ```
  + Misc
  - [You can now pass multiple filters to tests.][81356] E.g.
    `cargo test -- foo bar` will run all tests that match `foo` and `bar`.
  - [Rustup now distributes PDB symbols for the `std` library on Windows,
    allowing you to see `std` symbols when debugging.][82218]
  + Internal Only
    These changes provide no direct user facing benefits, but represent significant
    improvements to the internals and overall performance of rustc and
    related tools.
  - [Check the result cache before the DepGraph when ensuring queries][81855]
  - [Try fast_reject::simplify_type in coherence before doing full check][81744]
  - [Only store a LocalDefId in some HIR nodes][81611]
  - [Store HIR attributes in a side table][79519]
  + Compatibility Notes
  - ------------------
  - [Cargo build scripts are now forbidden from setting `RUSTC_BOOTSTRAP`.][cargo/9181]
  - [Removed support for the `x86_64-rumprun-netbsd` target.][82594]
  - [Deprecated the `x86_64-sun-solaris` target in favor of `x86_64-pc-solaris`.][82216]
  - [Rustdoc now only accepts `,`, ` `, and `\t` as delimiters for specifying
    languages in code blocks.][78429]
  - [Rustc now catches more cases of `pub_use_of_private_extern_crate`][80763]
  - [Changes in how proc macros handle whitespace may lead to panics when used
    with older `proc-macro-hack` versions. A `cargo update` should be sufficient to fix
    this in all cases.][84136]
- Update to version 1.51:
  + Language
  - [You can now parameterize items such as functions, traits, and `struct`s by constant
    values in addition to by types and lifetimes.][79135] Also known as "const generics"
    E.g. you can now write the following. Note: Only values of primitive integers,
    `bool`, or `char` types are currently permitted.
  + Compiler
  - [Added the `-Csplit-debuginfo` codegen option for macOS platforms.][79570]
    This option controls whether debug information is split across multiple files
    or packed into a single file. **Note** This option is unstable on other platforms.
  - [Added tier 3\* support for `aarch64_be-unknown-linux-gnu`,
    `aarch64-unknown-linux-gnu_ilp32`, and `aarch64_be-unknown-linux-gnu_ilp32` targets.][81455]
  - [Added tier 3 support for `i386-unknown-linux-gnu` and `i486-unknown-linux-gnu` targets.][80662]
  - [The `target-cpu=native` option will now detect individual features of CPUs.][80749]
    \* Refer to Rust's [platform support page][platform-support-doc] for more
    information on Rust's tiered platform support.
  + Libraries
  - [`Box::downcast` is now also implemented for any `dyn Any + Send + Sync` object.][80945]
  - [`str` now implements `AsMut&lt;str&gt;`.][80279]
  - [`u64` and `u128` now implement `From&lt;char&gt;`.][79502]
  - [`Error` is now implemented for `&amp;T` where `T` implements `Error`.][75180]
  - [`Poll::{map_ok, map_err}` are now implemented for `Poll&lt;Option&lt;Result&lt;T, E&gt;&gt;&gt;`.][80968]
  - [`unsigned_abs` is now implemented for all signed integer types.][80959]
  - [`io::Empty` now implements `io::Seek`.][78044]
  - [`rc::Weak&lt;T&gt;` and `sync::Weak&lt;T&gt;`'s methods such as `as_ptr` are now implemented for
    `T: ?Sized` types.][80764]
  + Stabilized APIs
  - [`Arc::decrement_strong_count`]
  - [`Arc::increment_strong_count`]
  - [`Once::call_once_force`]
  - [`Peekable::next_if_eq`]
  - [`Peekable::next_if`]
  - [`Seek::stream_position`]
  - [`array::IntoIter`]
  - [`panic::panic_any`]
  - [`ptr::addr_of!`]
  - [`ptr::addr_of_mut!`]
  - [`slice::fill_with`]
  - [`slice::split_inclusive_mut`]
  - [`slice::split_inclusive`]
  - [`slice::strip_prefix`]
  - [`slice::strip_suffix`]
  - [`str::split_inclusive`]
  - [`sync::OnceState`]
  - [`task::Wake`]
  + Cargo
  - [Added the `split-debuginfo` profile option to control the -Csplit-debuginfo
    codegen option.][cargo/9112]
  - [Added the `resolver` field to `Cargo.toml` to enable the new feature resolver
    and CLI option behavior.][cargo/8997] Version 2 of the feature resolver will try
    to avoid unifying features of dependencies where that unification could be unwanted.
    Such as using the same dependency with a `std` feature in a build scripts and
    proc-macros, while using the `no-std` feature in the final binary. See the
    [Cargo book documentation][feature-resolver@2.0] for more information on the feature.
  + Rustdoc
  - [Rustdoc will now include documentation for methods available from _nested_ `Deref` traits.][80653]
  - [You can now provide a `--default-theme` flag which sets the default theme to use for
    documentation.][79642]
    Various improvements to intra-doc links:
  - [You can link to non-path primitives such as `slice`.][80181]
  - [You can link to associated items.][74489]
  - [You can now include generic parameters when linking to items, like `Vec&lt;T&gt;`.][76934]
  + Misc
  - [You can now pass `--include-ignored` to tests (e.g. with
    `cargo test -- --include-ignored`) to include testing tests marked `#[ignore]`.][80053]
  + Compatibility Notes
  - [WASI platforms no longer use the `wasm-bindgen` ABI, and instead use the wasm32 ABI.][79998]
  - [`rustc` no longer promotes division, modulo and indexing operations to `const` that
    could fail.][80579]
  - [The minimum version of glibc for the following platforms has been bumped to version 2.31
    for the distributed artifacts.][81521]
  - `armv5te-unknown-linux-gnueabi`
  - `sparc64-unknown-linux-gnu`
  - `thumbv7neon-unknown-linux-gnueabihf`
  - `armv7-unknown-linux-gnueabi`
  - `x86_64-unknown-linux-gnux32`
- Update to version 1.50:
  * This fixes build on armv7 - boo#1181643
  + Language
  - You can now use const values for x in [x; N] array expressions.
    This has been technically possible since 1.38.0, as it was
    unintentionally stabilized.
  - Assignments to ManuallyDrop&lt;T&gt; union fields are now considered safe.
  + Compiler
  - Added tier 3* support for the armv5te-unknown-linux-uclibceabi
    target.
  - Added tier 3 support for the aarch64-apple-ios-macabi target.
  - The x86_64-unknown-freebsd is now built with the full toolset.
  - Dropped support for all cloudabi targets.
  * Refer to Rust's platform support page for more information on
    Rust's tiered platform support.
  + Libraries
  - proc_macro::Punct now implements PartialEq&lt;char&gt;.
  - ops::{Index, IndexMut} are now implemented for fixed sized
    arrays of any length.
  - On Unix platforms, the std::fs::File type now has a "niche" of -1.
    This value cannot be a valid file descriptor, and now means Option&lt;File&gt;
    takes up the same amount of space as File.
  + Stabilized APIs
    bool::then
    btree_map::Entry::or_insert_with_key
    f32::clamp
    f64::clamp
    hash_map::Entry::or_insert_with_key
    Ord::clamp
    RefCell::take
    slice::fill
    UnsafeCell::get_mut
  - The following previously stable methods are now const.
    IpAddr::is_ipv4
    IpAddr::is_ipv6
    IpAddr::is_unspecified
    IpAddr::is_loopback
    IpAddr::is_multicast
    Ipv4Addr::octets
    Ipv4Addr::is_loopback
    Ipv4Addr::is_private
    Ipv4Addr::is_link_local
    Ipv4Addr::is_multicast
    Ipv4Addr::is_broadcast
    Ipv4Addr::is_documentation
    Ipv4Addr::to_ipv6_compatible
    Ipv4Addr::to_ipv6_mapped
    Ipv6Addr::segments
    Ipv6Addr::is_unspecified
    Ipv6Addr::is_loopback
    Ipv6Addr::is_multicast
    Ipv6Addr::to_ipv4
    Layout::size
    Layout::align
    Layout::from_size_align
    pow for all integer types.
    checked_pow for all integer types.
    saturating_pow for all integer types.
    wrapping_pow for all integer types.
    next_power_of_two for all unsigned integer types.
    checked_next_power_of_two for all unsigned integer types.
  + Cargo
  - Added the [build.rustc-workspace-wrapper] option. This option
    sets a wrapper to execute instead of rustc, for workspace members only.
  - cargo:rerun-if-changed will now, if provided a directory,
    scan the entire contents of that directory for changes.
  - Added the --workspace flag to the cargo update command.
  + Misc
  - The search results tab and the help button are focusable
    with keyboard in rustdoc.
  - Running tests will now print the total time taken to execute.
  + Compatibility Notes
  - The compare_and_swap method on atomics has been deprecated.
    It's recommended to use the compare_exchange and
    compare_exchange_weak methods instead.
  - Changes in how TokenStreams are checked have fixed some cases
    where you could write unhygenic macro_rules! macros.
  - #![test] as an inner attribute is now considered unstable
    like other inner macro attributes, and reports an error by
    default through the soft_unstable lint.
  - Overriding a forbid lint at the same level that it was set
    is now a hard error.
  - You can no longer intercept panic! calls by supplying your own
    macro. It's recommended to use the #[panic_handler] attribute
    to provide your own implementation.
  - Semi-colons after item statements (e.g. struct Foo {};)
    now produce a warning.
- Update to version 1.49.0
  + Language
  - Unions can now implement Drop, and you can now have a field in
    a union with ManuallyDrop&lt;T&gt;.
  - You can now cast uninhabited enums to integers.
  - You can now bind by reference and by move in patterns. This
    allows you to selectively borrow individual components of a type.
    E.g.
    [#][derive(Debug)]
    struct Person {
    name: String,
    age: u8,
    }
    let person = Person {
    name: String::from("Alice"),
    age: 20,
    };
    // `name` is moved out of person, but `age` is referenced.
    let Person { name, ref age } = person;
    println!("{} {}", name, age);
  + Compiler
  - Added tier 1* support for aarch64-unknown-linux-gnu.
  - Added tier 2 support for aarch64-apple-darwin.
  - Added tier 2 support for aarch64-pc-windows-msvc.
  - Added tier 3 support for mipsel-unknown-none.
  - Raised the minimum supported LLVM version to LLVM 9.
  - Output from threads spawned in tests is now captured.
  - Change os and vendor values to "none" and "unknown" for some targets
  * Refer to Rust's platform support page for more information on Rust's
    tiered platform support.
  + Libraries
  - RangeInclusive now checks for exhaustion when calling contains and
    indexing.
  - ToString::to_string now no longer shrinks the internal buffer in
    the default implementation.
  - ops::{Index, IndexMut} are now implemented for fixed sized arrays
    of any length.
  + Stabilized APIs
  - slice::select_nth_unstable
  - slice::select_nth_unstable_by
  - slice::select_nth_unstable_by_key
  The following previously stable methods are now const.
  - Poll::is_ready
  - Poll::is_pending
  + Cargo
  - Building a crate with cargo-package should now be independently
    reproducible.
  - cargo-tree now marks proc-macro crates.
  - Added CARGO_PRIMARY_PACKAGE build-time environment variable. This
    variable will be set if the crate being built is one the user
    selected to build, either with -p or through defaults.
  - You can now use glob patterns when specifying packages &amp; targets.
  + Compatibility Notes
  - Demoted i686-unknown-freebsd from host tier 2 to target tier 2
    support.
  - Macros that end with a semi-colon are now treated as statements
    even if they expand to nothing.
  - Rustc will now check for the validity of some built-in attributes
    on enum variants. Previously such invalid or unused attributes
    could be ignored.
  - Leading whitespace is stripped more uniformly in documentation
    comments, which may change behavior. You read this post about
    the changes for more details.
  - Trait bounds are no longer inferred for associated types.
  + Internal Only
  These changes provide no direct user facing benefits, but
  represent significant improvements to the internals and overall
  performance of rustc and related tools.
  - rustc's internal crates are now compiled using the initial-exec
    Thread Local Storage model.
  - Calculate visibilities once in resolve.
  - Added system to the llvm-libunwind bootstrap config option.
  - Added --color for configuring terminal color support to bootstrap.
- Update to version 1.48.0
  + Language
  - The `unsafe` keyword is now syntactically permitted on modules.
    This is still rejected semantically, but can now be parsed by procedural
    macros.
  + Compiler
  - Stabilised the `-C link-self-contained=&lt;yes|no&gt;` compiler flag.
    This tells `rustc` whether to link its own C runtime and libraries or to
    rely on a external linker to find them. (Supported only on `windows-gnu`,
    `linux-musl`, and `wasi` platforms.)
  - You can now use `-C target-feature=+crt-static` on `linux-gnu` targets.
    Note: If you're using cargo you must explicitly pass the `--target` flag.
  - Added tier 2* support for aarch64-unknown-linux-musl.
  * Refer to Rust's platform support page for more information on Rust's
    tiered platform support.
  + Libraries
  - io::Write is now implemented for &amp;ChildStdin &amp;Sink, &amp;Stdout, and &amp;Stderr.
  - All arrays of any length now implement TryFrom&lt;Vec&lt;T&gt;&gt;.
  - The matches! macro now supports having a trailing comma.
  - Vec&lt;A&gt; now implements PartialEq&lt;[B]&gt; where A: PartialEq&lt;B&gt;.
  - The RefCell::{replace, replace_with, clone} methods now all use #[track_caller].
  + Stabilized APIs
  - slice::as_ptr_range
  - slice::as_mut_ptr_range
  - VecDeque::make_contiguous
  - future::pending
  - future::ready
  The following previously stable methods are now `const fn's`:
  - Option::is_some
  - Option::is_none
  - Option::as_ref
  - Result::is_ok
  - Result::is_err
  - Result::as_ref
  - Ordering::reverse
  - Ordering::then
  + Cargo
  + Rustdoc
  - You can now link to items in rustdoc using the intra-doc link syntax.
    E.g. /// Uses [`std::future`] will automatically generate a link to
    std::future's documentation. See "Linking to items by name" for more
    information.
  - You can now specify #[doc(alias = "&lt;alias&gt;")] on items to add search
    aliases when searching through rustdoc's UI.
  + Compatibility Notes
  - Promotion of references to 'static lifetime inside const fn now
    follows the same rules as inside a fn body. In particular, &amp;foo()
    will not be promoted to 'static lifetime any more inside const fns.
  - Associated type bindings on trait objects are now verified to meet
    the bounds declared on the trait when checking that they implement
    the trait.
  - When trait bounds on associated types or opaque types are ambiguous,
    the compiler no longer makes an arbitrary choice on which bound to use.
  - Fixed recursive nonterminals not being expanded in macros during
    pretty-print/reparse check. This may cause errors if your macro
    wasn't correctly handling recursive nonterminal tokens.
  - &amp;mut references to non zero-sized types are no longer promoted.
  - rustc will now warn if you use attributes like #[link_name] or
    [#][cold] in places where they have no effect.
  - Updated _mm256_extract_epi8 and _mm256_extract_epi16 signatures
    in arch::{x86, x86_64} to return i32 to match the vendor signatures.
  - mem::uninitialized will now panic if any inner types inside a struct
    or enum disallow zero-initialization.
  - #[target_feature] will now error if used in a place where it has no effect.
  - Foreign exceptions are now caught by catch_unwind and will cause an
    abort. Note: This behaviour is not guaranteed and is still considered
    undefined behaviour, see the catch_unwind documentation for further
    information.
  + Internal Only
    These changes provide no direct user facing benefits, but represent
    significant improvements to the internals and overall performance of
    rustc and related tools.
  - Building rustc from source now uses ninja by default over make.
    You can continue building with make by setting ninja=false in
    your config.toml.
  - cg_llvm: fewer_names in uncached_llvm_type
  - Made ensure_sufficient_stack() non-generic
- Update to version 1.47.0
  + Language
  - [Closures will now warn when not used.][74869]
  + Compiler
  - [Stabilized the `-C control-flow-guard` codegen option][73893], which enables
    [Control Flow Guard][1.47.0-cfg] for Windows platforms, and is ignored on other
    platforms.
  - [Upgraded to LLVM 11.][73526]
  - [Added tier 3\* support for the `thumbv4t-none-eabi` target.][74419]
  - [Upgrade the FreeBSD toolchain to version 11.4][75204]
  - [`RUST_BACKTRACE`'s output is now more compact.][75048]
  \* Refer to Rust's [platform support page][forge-platform-support] for more
  information on Rust's tiered platform support.
  + Libraries
  - [`CStr` now implements `Index&lt;RangeFrom&lt;usize&gt;&gt;`.][74021]
  - [Traits in `std`/`core` are now implemented for arrays of any length, not just
    those of length less than 33.][74060]
  - [`ops::RangeFull` and `ops::Range` now implement Default.][73197]
  - [`panic::Location` now implements `Copy`, `Clone`, `Eq`, `Hash`, `Ord`,
    `PartialEq`, and `PartialOrd`.][73583]
  + Stabilized APIs
  - [`Ident::new_raw`]
  - [`Range::is_empty`]
  - [`RangeInclusive::is_empty`]
  - [`Result::as_deref`]
  - [`Result::as_deref_mut`]
  - [`Vec::leak`]
  - [`pointer::offset_from`]
  - [`f32::TAU`]
  - [`f64::TAU`]
  The following previously stable APIs have now been made const.
  - [The `new` method for all `NonZero` integers.][73858]
  - [The `checked_add`,`checked_sub`,`checked_mul`,`checked_neg`, `checked_shl`,
    `checked_shr`, `saturating_add`, `saturating_sub`, and `saturating_mul`
    methods for all integers.][73858]
  - [The `checked_abs`, `saturating_abs`, `saturating_neg`, and `signum`  for all
    signed integers.][73858]
  - [The `is_ascii_alphabetic`, `is_ascii_uppercase`, `is_ascii_lowercase`,
    `is_ascii_alphanumeric`, `is_ascii_digit`, `is_ascii_hexdigit`,
    `is_ascii_punctuation`, `is_ascii_graphic`, `is_ascii_whitespace`, and
    `is_ascii_control` methods for `char` and `u8`.][73858]
  + Cargo
  - [`build-dependencies` are now built with opt-level 0 by default.][cargo/8500]
    You can override this by setting the following in your `Cargo.toml`.
    ```toml
    [profile.release.build-override]
    opt-level = 3
    ```
  - [`cargo-help` will now display man pages for commands rather just the
    `--help` text.][cargo/8456]
  - [`cargo-metadata` now emits a `test` field indicating if a target has
    tests enabled.][cargo/8478]
  - [`workspace.default-members` now respects `workspace.exclude`.][cargo/8485]
  - [`cargo-publish` will now use an alternative registry by default if it's the
    only registry specified in `package.publish`.][cargo/8571]
  + Misc
  - [Added a help button beside Rustdoc's searchbar that explains rustdoc's
    type based search.][75366]
  - [Added the Ayu theme to rustdoc.][71237]
- Update to version 1.46.0
  + Language
  - [`if`, `match`, and `loop` expressions can now be used in const functions.][72437]
  - [Additionally you are now also able to coerce and cast to slices (`&amp;[T]`) in
    const functions.][73862]
  - [The `#[track_caller]` attribute can now be added to functions to use the
    function's caller's location information for panic messages.][72445]
  - [Recursively indexing into tuples no longer needs parentheses.][71322] E.g.
    `x.0.0` over `(x.0).0`.
  - [`mem::transmute` can now be used in statics and constants.][72920] **Note**
    You currently can't use `mem::transmute` in constant functions.
  + Compiler
  - [You can now use the `cdylib` target on Apple iOS and tvOS platforms.][73516]
  - [Enabled static "Position Independent Executables" by default
    for `x86_64-unknown-linux-musl`.][70740]
  + Libraries
  - [`mem::forget` is now a `const fn`.][73887]
  - [`String` now implements `From&lt;char&gt;`.][73466]
  - [The `leading_ones`, and `trailing_ones` methods have been stabilised for all
    integer types.][73032]
  - [`vec::IntoIter&lt;T&gt;` now implements `AsRef&lt;[T]&gt;`.][72583]
  - [All non-zero integer types (`NonZeroU8`) now implement `TryFrom` for their
    zero-able equivalent (e.g. `TryFrom&lt;u8&gt;`).][72717]
  - [`&amp;[T]` and `&amp;mut [T]` now implement `PartialEq&lt;Vec&lt;T&gt;&gt;`.][71660]
  - [`(String, u16)` now implements `ToSocketAddrs`.][73007]
  - [`vec::Drain&lt;'_, T&gt;` now implements `AsRef&lt;[T]&gt;`.][72584]
  + Stabilized APIs
  - [`Option::zip`]
  - [`vec::Drain::as_slice`]
  + Cargo
    Added a number of new environment variables that are now available when
    compiling your crate.
  - [`CARGO_BIN_NAME` and `CARGO_CRATE_NAME`][cargo/8270] Providing the name of
    the specific binary being compiled and the name of the crate.
  - [`CARGO_PKG_LICENSE`][cargo/8325] The license from the manifest of the package.
  - [`CARGO_PKG_LICENSE_FILE`][cargo/8387] The path to the license file.
- Update to version 1.44.1
  * rustfmt accepts rustfmt_skip in cfg_attr again.
  * Don't hash executable filenames on apple platforms, fixing backtraces.
  * Fix crashes when finding backtrace on macOS.
  * Clippy applies lint levels into different files.
- Update to version 1.44.0
  + Language
  - You can now use `async/.await` with `#[no_std]` enabled.
  - Added the `unused_braces` lint.
  - Expansion-driven outline module parsing
  + Compiler
  - Rustc now respects the `-C codegen-units` flag in incremental mode.
    Additionally when in incremental mode rustc defaults to 256 codegen units.
  - Refactored `catch_unwind` to have zero-cost, unless unwinding is enabled and
    a panic is thrown.
  - Added tier 3\* support for the `aarch64-unknown-none` and
    `aarch64-unknown-none-softfloat` targets.
  - Added tier 3 support for `arm64-apple-tvos` and
    `x86_64-apple-tvos` targets.
  + Libraries
  - Special cased `vec![]` to map directly to `Vec::new()`. This allows
    `vec![]` to be able to be used in `const` contexts.
  - `convert::Infallible` now implements `Hash`.
  - `OsString` now implements `DerefMut` and `IndexMut` returning
    a `&amp;mut OsStr`.
  - Unicode 13 is now supported.
  - `String` now implements `From&lt;&amp;mut str&gt;`.
  - `IoSlice` now implements `Copy`.
  - `Vec&lt;T&gt;` now implements `From&lt;[T; N]&gt;`. Where `N` is at most 32.
  - `proc_macro::LexError` now implements `fmt::Display` and `Error`.
  - `from_le_bytes`, `to_le_bytes`, `from_be_bytes`, `to_be_bytes`,
    `from_ne_bytes`, and `to_ne_bytes` methods are now `const` for all
    integer types.
  + Stabilizd APIs
  - [`PathBuf::with_capacity`]
  - [`PathBuf::capacity`]
  - [`PathBuf::clear`]
  - [`PathBuf::reserve`]
  - [`PathBuf::reserve_exact`]
  - [`PathBuf::shrink_to_fit`]
  - [`f32::to_int_unchecked`]
  - [`f64::to_int_unchecked`]
  - [`Layout::align_to`]
  - [`Layout::pad_to_align`]
  - [`Layout::array`]
  - [`Layout::extend`]
  + Cargo
  - Added the `cargo tree` command which will print a tree graph of
    your dependencies
  + Misc
  - Rustdoc now allows you to specify `--crate-version` to have rustdoc include
    the version in the sidebar.
  + Compatibility Notes
  - Rustc now correctly generates static libraries on Windows GNU targets with
    the `.a` extension, rather than the previous `.lib`.
  - Removed the `-C no_integrated_as` flag from rustc.
  - The `file_name` property in JSON output of macro errors now points the actual
    source file rather than the previous format of `&lt;NAME macros&gt;`.
  * *Note:** this may not point to a file that actually exists on the user's system.
  - The minimum required external LLVM version has been bumped to LLVM 8.
  - `mem::{zeroed, uninitialised}` will now panic when used with types that do
    not allow zero initialization such as `NonZeroU8`. This was
    previously a warning.
  - In 1.45.0 (the next release) converting a `f64` to `u32` using the `as`
    operator has been defined as a saturating operation. This was previously
    undefined behaviour, but you can use the `{f64, f32}::to_int_unchecked` methods to
    continue using the current behaviour, which may be desirable in rare performance
    sensitive situations.</changelog>
  <changelog author="william.brown@suse.com" date="1642680000">- bsc#1194767 - CVE-2022-21658 - Resolve race condition in std::fs::remove_dir_all
  - 0001-Fix-CVE-2022-21658-for-UNIX-like.patch</changelog>
</package>
<package pkgid="9b1662e6a9b331e777d332143083599e0257e3d5a02d25ca4b666ae3752d4ae3" name="clamav" arch="aarch64">
  <version epoch="0" ver="0.103.5" rel="3.35.1"/>
  <changelog author="egdfree@opensuse.org" date="1553688000">- Update to version 0.101.2 (bsc#1130721)
  * CVE-2019-1787:
    An out-of-bounds heap read condition may occur when scanning PDF
    documents. The defect is a failure to correctly keep track of the number
    of bytes remaining in a buffer when indexing file data.
  * CVE-2019-1789:
    An out-of-bounds heap read condition may occur when scanning PE files
    (i.e. Windows EXE and DLL files) that have been packed using Aspack as a
    result of inadequate bound-checking.
  * CVE-2019-1788:
    An out-of-bounds heap write condition may occur when scanning OLE2 files
    such as Microsoft Office 97-2003 documents. The invalid write happens when
    an invalid pointer is mistakenly used to initialize a 32bit integer to
    zero. This is likely to crash the application.
  * CVE-2019-1786:
    An out-of-bounds heap read condition may occur when scanning malformed
    PDF documents as a result of improper bounds-checking.
  * CVE-2019-1785:
    A path-traversal write condition may occur as a result of improper
    input validation when scanning RAR archives.
  * CVE-2019-1798:
    A use-after-free condition may occur as a result of improper error
    handling when scanning nested RAR archives.
- added clamav-max_patch.patch to fix build
- dropped clamav-freshclam-exit.patch</changelog>
  <changelog author="max@suse.com" date="1565092800">- Update to version 0.101.3:
  * bsc#1144504: ZIP bomb causes extreme CPU spikes</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1567598400">- update to 0.101.4:
  * CVE-2019-12900: An out of bounds write in the NSIS bzip2
    (boo#1149458)
  * CVE-2019-12625: Introduce a configurable time limit to mitigate
    zip bomb vulnerability completely. Default is 2 minutes,
    configurable useing the clamscan --max-scantime and for clamd
    using the MaxScanTime config option (boo#1144504)</changelog>
  <changelog author="max@suse.com" date="1572004800">- bsc#1151839: Increase the startup timeout of clamd to 5 minutes
  to cater for the grown virus database as a workaround until
  clamd has learned to talk to systemd to extend the timeout as
  long as needed.</changelog>
  <changelog author="suse+build@de-korte.org" date="1572609600">- update to 0.102.0
  * The On-Access Scanning feature has been migrated out of clamd
    and into a brand new utility named clamonacc. This utility is
    similar to clamdscan and clamav-milter in that it acts as a
    client to clamd. This separation from clamd means that clamd no
    longer needs to run with root privileges while scanning potentially
    malicious files. Instead, clamd may drop privileges to run under an
    account that does not have super-user. In addition to improving the
    security posture of running clamd with On-Access enabled, this
    update fixed a few outstanding defects:
  - On-Access scanning for created and moved files (Extra-Scanning)
    is fixed.
  - VirusEvent for On-Access scans is fixed.
  - With clamonacc, it is now possible to copy, move, or remove a
    file if the scan triggered an alert, just like with clamdscan.
  * The freshclam database update utility has undergone a significant
    update. This includes:
  - Added support for HTTPS.
  - Support for database mirrors hosted on ports other than 80.
  - Removal of the mirror management feature (mirrors.dat).
  - An all new libfreshclam library API.
- created new subpackage libfreshclam2
- dropped clamav-max_patch.patch (upstreamed)
- added clamav-fix_building_milter.patch to fix build of milter</changelog>
  <changelog author="suse+build@de-korte.org" date="1574251200">- update to 0.102.1
  * CVE-2019-15961, bsc#1157763: A Denial-of-Service (DoS)
    vulnerability may occur when scanning a specially crafted email
    file as a result of excessively long scan times. The issue is
    resolved by implementing several maximums in parsing MIME
    messages and by optimizing use of memory allocation.
  * Build system fixes to build clamav-milter, to correctly link
    with libxml2 when detected, and to correctly detect fanotify
    for on-access scanning feature support.
  * Signature load time is significantly reduced by changing to a
    more efficient algorithm for loading signature patterns and
    allocating the AC trie. Patch courtesy of Alberto Wu.
  * Introduced a new configure option to statically link libjson-c
    with libclamav. Static linking with libjson is highly
    recommended to prevent crashes in applications that use
    libclamav alongside another JSON parsing library.
  * Null-dereference fix in email parser when using the
  - -gen-json metadata option.
  * Fixes for Authenticode parsing and certificate signature
    (.crb database) bugs.
- dropped clamav-fix_building_milter.patch (upstreamed)</changelog>
  <changelog author="dimstar@opensuse.org" date="1576756800">- BuildRequire pkgconfig(libsystemd) instead of systemd-devel:
  Allow OBS to shortcut through the -mini flavors.</changelog>
  <changelog author="suse+build@de-korte.org" date="1577188800">- The freshclam.service should not be started before the network is
  online (it checks for updates immediately upon service start)</changelog>
  <changelog author="suse+build@de-korte.org" date="1580904000">- update to 0.102.2
  * CVE-2020-3123: A denial-of-service (DoS) condition may occur when
    using the optional credit card data-loss-prevention (DLP) feature.
    Improper bounds checking of an unsigned variable resulted in an
    out-of-bounds read, which causes a crash.
  * Significantly improved the scan speed of PDF files on Windows.
  * Re-applied a fix to alleviate file access issues when scanning RAR
    files in downstream projects that use libclamav where the scanning
    engine is operating in a low-privilege process. This bug was originally
    fixed in 0.101.2 and the fix was mistakenly omitted from 0.102.0.
  * Fixed an issue where freshclam failed to update if the database version
    downloaded is one version older than advertised. This situation may
    occur after a new database version is published. The issue affected
    users downloading the whole CVD database file.
  * Changed the default freshclam ReceiveTimeout setting to 0 (infinite).
    The ReceiveTimeout had caused needless database update failures for
    users with slower internet connections.
  * Correctly display the number of kilobytes (KiB) in progress bar and
    reduced the size of the progress bar to accommodate 80-character width
    terminals.
  * Fixed an issue where running freshclam manually causes a daemonized
    freshclam process to fail when it updates because the manual instance
    deletes the temporary download directory. The freshclam temporary files
    will now download to a unique directory created at the time of an update
    instead of using a hardcoded directory created/destroyed at the program
    start/exit.
  * Fix for freshclam's OnOutdatedExecute config option.
  * Fixes a memory leak in the error condition handling for the email
    parser.
  * Improved bound checking and error handling in ARJ archive parser.
  * Improved error handling in PDF parser.
  * Fix for memory leak in byte-compare signature handler.</changelog>
  <changelog author="mpluskal@suse.com" date="1585742400">- Drop python build dependency as it is not needed</changelog>
  <changelog author="suse+build@de-korte.org" date="1589284800">- Update to 0.102.3
  * CVE-2020-3327: Fix a vulnerability in the ARJ archive parsing
    module in ClamAV 0.102.2 that could cause a Denial-of-Service (DoS)
    condition. Improper bounds checking of an unsigned variable results
    in an out-of-bounds read which causes a crash.
  * CVE-2020-3341: Fix a vulnerability in the PDF parsing module in
    ClamAV 0.101 - 0.102.2 that could cause a Denial-of-Service (DoS)
    condition. Improper size checking of a buffer used to initialize AES
    decryption routines results in an out-of-bounds read which may cause
    a crash.
  * Fix "Attempt to allocate 0 bytes" error when parsing some PDF
    documents.
  * Fix a couple of minor memory leaks.
  * Updated libclamunrar to UnRAR 5.9.2.</changelog>
  <changelog author="suse+build@de-korte.org" date="1594900800">- Update to 0.102.4
  * CVE-2020-3350: Fix a vulnerability wherein a malicious user could
    replace a scan target's directory with a symlink to another path
    to trick clamscan, clamdscan, or clamonacc into removing or moving
    a different file (eg. a critical system file). The issue would
    affect users that use the --move or --remove options for clamscan,
    clamdscan, and clamonacc.
  * CVE-2020-3327: Fix a vulnerability in the ARJ archive parsing
    module in ClamAV 0.102.3 that could cause a Denial-of-Service
    (DoS) condition. Improper bounds checking results in an
    out-of-bounds read which could cause a crash. The previous fix for
    this CVE in 0.102.3 was incomplete. This fix correctly resolves
    the issue.
  * CVE-2020-3481: Fix a vulnerability in the EGG archive module in
    ClamAV 0.102.0 - 0.102.3 could cause a Denial-of-Service (DoS)
    condition. Improper error handling may result in a crash due to a
    NULL pointer dereference. This vulnerability is mitigated for
    those using the official ClamAV signature databases because the
    file type signatures in daily.cvd will not enable the EGG archive
    parser in versions affected by the vulnerability.</changelog>
  <changelog author="suse+build@de-korte.org" date="1600084800">- Update to 0.103.0
  * clamd can now reload the signature database without blocking
    scanning. This multi-threaded database reload improvement was made
    possible thanks to a community effort.
  - Non-blocking database reloads are now the default behavior. Some
    systems that are more constrained on RAM may need to disable
    non-blocking reloads as it will temporarily consume two times as
    much memory. We added a new clamd config option
    ConcurrentDatabaseReload, which may be set to no.
  * Dropped clamav-str-h.patch (no longer needed)
  * Fix clamav-milter.service (requires clamd.service to run)</changelog>
  <changelog author="max@suse.com" date="1605009600">- Sync Factory to SLE-15 to implement jsc#ECO-3010 and bsc#1118459.
- bsc#1119353, clamav-fips.patch: Fix freshclam crash in FIPS mode.
- Keep OBS from installing an existing clamav instance to scan the
  sources, because this makes "make check" use the old library
  instead of the just built one. This is only a workaround until
  we found a way to keep libtool from adding libdir to rpath and
  LD_LIBRARY_PATH of the binaries in the testsuite.</changelog>
  <changelog author="dimstar@opensuse.org" date="1605182400">- Do not hard-depend on systemd: use systemd_ordering instead of
  systemd_requires.</changelog>
  <changelog author="max@suse.com" date="1617969600">- Update clamav.keyring
- Update to 0.103.2
  * CVE-2021-1252, bsc#1184532: Fix for Excel XLM parser infinite
    loop. Affects 0.103.0 and 0.103.1 only.
  * CVE-2021-1404, bsc#1184533: Fix for PDF parser buffer over-read;
    possible crash. Affects 0.103.0 and 0.103.1 only.
  * CVE-2021-1405, bsc#1184534: Fix for mail parser
    NULL-dereference crash. Affects 0.103.1 and prior.
  * Fix possible memory leak in PNG parser.
  * Fix ClamOnAcc scan on file-creation race condition so files are
    scanned after their contents are written.
  * FreshClam: Deprecate the SafeBrowsing config option. The
    SafeBrowsing option will no longer do anything.
  * For more details, see our blog post from last year about the
    future of the ClamAV Safe Browsing database.
  * FreshClam: Improved HTTP 304, 403, &amp; 429 handling.
  * FreshClam: Added back the mirrors.dat file to the database directory.
  * FreshClam will now exit with a failure in daemon mode if an HTTP 403
    (Forbidden) was received, because retrying later won't help any. The
    FreshClam user will have to take actions to get unblocked.
  * Fix the FreshClam mirror-sync issue where a downloaded database is
    "older than the version advertised."
  * bsc#1181256: Fix errors when scanning files &gt; 4G
  * obsoletes clamav-disable-timestamps.patch
- Update to 0.103.1
  * Added a new scan option to alert on broken media (graphics) file
    formats. This feature mitigates the risk of malformed media files
    intended to exploit vulnerabilities in other software. At present
    media validation exists for JPEG, TIFF, PNG, and GIF files. To
    enable this feature, set AlertBrokenMedia yes in clamd.conf, or
    use the --alert-broken-media option when using clamscan. These
    options are disabled by default in this patch release, but may be
    enabled in a subsequent release. Application developers may enable
    this scan option by enabling CL_SCAN_HEURISTIC_BROKEN_MEDIA for
    the heuristic scan option bit field.
  * Added CL_TYPE_TIFF, CL_TYPE_JPEG types to match GIF, PNG typing
    behavior. BMP and JPEG 2000 files will continue to detect as
    CL_TYPE_GRAPHICS because ClamAV does not yet have BMP or JPEG
    2000 format checking capabilities.
  * Fixed PNG parser logic bugs that caused an excess of parsing
    errors and fixed a stack exhaustion issue affecting some systems
    when scanning PNG files. PNG file type detection was disabled via
    signature database update for ClamAV version 0.103.0 to mitigate
    the effects from these bugs.
  * Fixed an issue where PNG and GIF files no longer work with
    Target:5 graphics signatures if detected as CL_TYPE_PNG/GIF rather
    than as CL_TYPE_GRAPHICS. Target types now support up to 10
    possible file types to make way for additional graphics types in
    future releases.
  * Fixed clamonacc's --fdpass option.
  - Interprocess file descriptor passing for clamonacc was broken
    since version 0.102.0 due to a bug introduced by the switch to
    curl for communicating with clamd. On Linux, passing file
    descriptors from one process to another is handled by the
    kernel, so we reverted clamonacc to use standard system calls
    for socket communication when fd passing is enabled.
  * Fixed a clamonacc stack corruption issue on some systems when
    using an older version of libcurl.
  * Allow clamscan and clamdscan scans to proceed even if the
    realpath lookup failed. This alleviates an issue on Windows
    scanning files hosted on file- systems that do not support the
    GetMappedFileNameW() API such as on ImDisk RAM-disks.
  * Fixed freshclam --on-update-execute=EXIT_1 temporary directory
    cleanup issue.
  * clamd's log output and VirusEvent now provide the scan target's
    file path instead of a file descriptor. The clamd socket API for
    submitting a scan by FD-passing doesn't include a file path, this
    feature works by looking up the file path by file descriptor.
    This feature works on Mac and Linux but is not yet implemented
    for other UNIX operating systems. FD-passing is not available for
    Windows.
  * Fixed an issue where freshclam database validation didn't work
    correctly when run in daemon mode on Linux/Unix.</changelog>
  <changelog author="suse+build@de-korte.org" date="1624276800">- bsc#1188284: Update to 0.103.3
  * Fixed a scan performance issue when ENGINE_OPTIONS_FORCE_TO_DISK is
    enabled. This issue did not impacted most users but for those
    affected it caused every scanned file to be copied to the temp
    directory before the scan.
  * Fix ClamDScan crashes when using the --fdpass --multiscan
    command-line options in combination with the ClamD ExcludePath
    config file options.
  * Fixed an issue where the mirrors.dat file is owned by root when
    starting as root (or with sudo) and using daemon-mode. File
    ownership will be set to the DatabaseOwner just before FreshClam
    switches to run as that user.
  * Renamed the mirrors.dat file to freshclam.dat.
  * Disabled the HTTPUserAgent config option if the DatabaseMirror uses
    clamav.net. This will prevent users from being inadvertently blocked
    and will ensure that we can keep better metrics on which ClamAV
    versions are being used.
  * Moved the detection for Heuristics.PNG.CVE-2010-1205 behind the
    ClamScan --alert-broken-media option (ClamD AlertBrokenMedia yes)
    option. This type of PNG issue appears to be common enough to be an
    annoyance, and the CVE is old enough that no one should be
    vulnerable at this point.
  * Fix ClamSubmit failures after changes to Cloudflare "__cfduid"
    cookies. See: https://blog.cloudflare.com/deprecating-cfduid-cookie/</changelog>
  <changelog author="meissner@suse.com" date="1625054400">- clamav-document-maxsize.patch: in the "clamscan" and "clamdscan" manpages,
  document that files over a certain size by default will silently not be
  scanned and how this can be adjusted (bsc#1187509)</changelog>
  <changelog author="max@suse.com" date="1636372800">- bsc#1192346: Update to 0.103.4
  * FreshClam:
  - Add a 24-hour cool-down for FreshClam clients that have received
    an HTTP 403 (Forbidden) response from the CDN. This is to reduce
    the volume of 403-response data served to blocked FreshClam
    clients that are configured with a tight update-loop.
  - Fixed a bug where FreshClam treats an empty CDIFF as an
    incremental update failure instead of as an intentional request
    to download the whole CVD.
  * ClamDScan: Fix a scan error when broken symlinks are encountered on
    macOS with "FollowDirectorySymlinks" and "FollowFileSymlinks"
    options disabled.
  * Overhauled the scan recursion / nested archive extraction logic and
    added new limits on embedded file-type recognition performed during
    the "raw" scan of each file. This limits embedded file-type
    misidentification and prevents detecting embedded file content that
    is found/extracted and scanned at other layers in the scanning
    process.
  * Fix an issue with the FMap module that failed to read from some
    nested files.
  * Fixed an issue where failing to load some rules from a Yara file
    containing multiple rules may cause a crash.
  * Fixed assorted compiler warnings.
  * Fixed assorted Coverity static code analysis issues.
  * Scan limits:
  - Added virus-name suffixes to the alerts that trigger when a scan
    limit has been exceeded. Rather than simply
    Heuristics.Limits.Exceeded, you may now see limit-specific
    virus-names, to include:
    + Heuristics.Limits.Exceeded.MaxFileSize
    + Heuristics.Limits.Exceeded.MaxScanSize
    + Heuristics.Limits.Exceeded.MaxFiles
    + Heuristics.Limits.Exceeded.MaxRecursion
    + Heuristics.Limits.Exceeded.MaxScanTime
  - Renamed the Heuristics.Email.ExceedsMax.* alerts to align with
    the other limit alerts names. These alerts include:
    + Heuristics.Limits.Exceeded.EmailLineFoldcnt
    + Heuristics.Limits.Exceeded.EmailHeaderBytes
    + Heuristics.Limits.Exceeded.EmailHeaders
    + Heuristics.Limits.Exceeded.EmailMIMEPartsPerMessage
    + Heuristics.Limits.Exceeded.EmailMIMEArguments
  - Fixed an issue where the Email-related scan limits would alert
    even when the "AlertExceedsMax" (--alert-exceeds-max) scan option
    is not enabled.
  - Fixes an issue in the Zip parser where exceeding the "MaxFiles"
    limit or the "MaxFileSize" limit would abort the scan but would
    fail to alert. The Zip scan limit issues were independently
    identified and reported by Aaron Leliaert and Max Allan.
  * Fixed a leak in the Email parser when using the --gen-json scan
    option.
  * Fixed an issue where a failure to record metadata in the Email
    parser when using the --gen-json scan option could cause the Email
    parser to abort the scan early and fail to extract and scan
    additional content.
  * Fixed a file name memory leak in the Zip parser.
  * Fixed an issue where certain signature patterns may cause a crash or
    cause unintended matches on some systems when converting characters
    to uppercase if a UTF-8 unicode single-byte grapheme becomes a
    multi-byte grapheme. Patch courtesy of Andrea De Pasquale.
- Fix unit test
  + clamav-ck_assert_msg.patch</changelog>
  <changelog author="max@suse.com" date="1642420800">- Update to 0.103.5
  * bsc#1194731, CVE-2022-20698:
    Fix for invalid pointer read that may cause a crash.
    This issue affects 0.104.1, 0.103.4 and prior when ClamAV is compiled
    with libjson-c and the CL_SCAN_GENERAL_COLLECT_METADATA scan option
    (the clamscan --gen-json option) is enabled.
  * Fixed ability to disable the file size limit with libclamav C API,
    like this:
    cl_engine_set_num(engine, CL_ENGINE_MAX_FILESIZE, 0);
    This issue didn't affect ClamD or ClamScan which also can disable the
    limit by setting it to zero using MaxFileSize 0 in clamd.conf for ClamD,
    or clamscan --max-filesize=0 for ClamScan.
    Note: Internally, the max file size is still set to 2 GiB. Disabling the
    limit for a scan will fall back on the internal 2 GiB limitation.
  * Increased the maximum line length for ClamAV config files from 512 bytes
    to 1,024 bytes to allow for longer config option strings.
  * SigTool: Fix insufficient buffer size for --list-sigs that caused a
    failure when listing a database containing one or more very long
    signatures. This fix was backported from 0.104.</changelog>
</package>
<package pkgid="fa9fe68aa2db1b2d919d6a0977bbae037aedc274213b553eabd6ca2f3d1deff9" name="clamav" arch="ppc64le">
  <version epoch="0" ver="0.103.5" rel="3.35.1"/>
  <changelog author="egdfree@opensuse.org" date="1553688000">- Update to version 0.101.2 (bsc#1130721)
  * CVE-2019-1787:
    An out-of-bounds heap read condition may occur when scanning PDF
    documents. The defect is a failure to correctly keep track of the number
    of bytes remaining in a buffer when indexing file data.
  * CVE-2019-1789:
    An out-of-bounds heap read condition may occur when scanning PE files
    (i.e. Windows EXE and DLL files) that have been packed using Aspack as a
    result of inadequate bound-checking.
  * CVE-2019-1788:
    An out-of-bounds heap write condition may occur when scanning OLE2 files
    such as Microsoft Office 97-2003 documents. The invalid write happens when
    an invalid pointer is mistakenly used to initialize a 32bit integer to
    zero. This is likely to crash the application.
  * CVE-2019-1786:
    An out-of-bounds heap read condition may occur when scanning malformed
    PDF documents as a result of improper bounds-checking.
  * CVE-2019-1785:
    A path-traversal write condition may occur as a result of improper
    input validation when scanning RAR archives.
  * CVE-2019-1798:
    A use-after-free condition may occur as a result of improper error
    handling when scanning nested RAR archives.
- added clamav-max_patch.patch to fix build
- dropped clamav-freshclam-exit.patch</changelog>
  <changelog author="max@suse.com" date="1565092800">- Update to version 0.101.3:
  * bsc#1144504: ZIP bomb causes extreme CPU spikes</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1567598400">- update to 0.101.4:
  * CVE-2019-12900: An out of bounds write in the NSIS bzip2
    (boo#1149458)
  * CVE-2019-12625: Introduce a configurable time limit to mitigate
    zip bomb vulnerability completely. Default is 2 minutes,
    configurable useing the clamscan --max-scantime and for clamd
    using the MaxScanTime config option (boo#1144504)</changelog>
  <changelog author="max@suse.com" date="1572004800">- bsc#1151839: Increase the startup timeout of clamd to 5 minutes
  to cater for the grown virus database as a workaround until
  clamd has learned to talk to systemd to extend the timeout as
  long as needed.</changelog>
  <changelog author="suse+build@de-korte.org" date="1572609600">- update to 0.102.0
  * The On-Access Scanning feature has been migrated out of clamd
    and into a brand new utility named clamonacc. This utility is
    similar to clamdscan and clamav-milter in that it acts as a
    client to clamd. This separation from clamd means that clamd no
    longer needs to run with root privileges while scanning potentially
    malicious files. Instead, clamd may drop privileges to run under an
    account that does not have super-user. In addition to improving the
    security posture of running clamd with On-Access enabled, this
    update fixed a few outstanding defects:
  - On-Access scanning for created and moved files (Extra-Scanning)
    is fixed.
  - VirusEvent for On-Access scans is fixed.
  - With clamonacc, it is now possible to copy, move, or remove a
    file if the scan triggered an alert, just like with clamdscan.
  * The freshclam database update utility has undergone a significant
    update. This includes:
  - Added support for HTTPS.
  - Support for database mirrors hosted on ports other than 80.
  - Removal of the mirror management feature (mirrors.dat).
  - An all new libfreshclam library API.
- created new subpackage libfreshclam2
- dropped clamav-max_patch.patch (upstreamed)
- added clamav-fix_building_milter.patch to fix build of milter</changelog>
  <changelog author="suse+build@de-korte.org" date="1574251200">- update to 0.102.1
  * CVE-2019-15961, bsc#1157763: A Denial-of-Service (DoS)
    vulnerability may occur when scanning a specially crafted email
    file as a result of excessively long scan times. The issue is
    resolved by implementing several maximums in parsing MIME
    messages and by optimizing use of memory allocation.
  * Build system fixes to build clamav-milter, to correctly link
    with libxml2 when detected, and to correctly detect fanotify
    for on-access scanning feature support.
  * Signature load time is significantly reduced by changing to a
    more efficient algorithm for loading signature patterns and
    allocating the AC trie. Patch courtesy of Alberto Wu.
  * Introduced a new configure option to statically link libjson-c
    with libclamav. Static linking with libjson is highly
    recommended to prevent crashes in applications that use
    libclamav alongside another JSON parsing library.
  * Null-dereference fix in email parser when using the
  - -gen-json metadata option.
  * Fixes for Authenticode parsing and certificate signature
    (.crb database) bugs.
- dropped clamav-fix_building_milter.patch (upstreamed)</changelog>
  <changelog author="dimstar@opensuse.org" date="1576756800">- BuildRequire pkgconfig(libsystemd) instead of systemd-devel:
  Allow OBS to shortcut through the -mini flavors.</changelog>
  <changelog author="suse+build@de-korte.org" date="1577188800">- The freshclam.service should not be started before the network is
  online (it checks for updates immediately upon service start)</changelog>
  <changelog author="suse+build@de-korte.org" date="1580904000">- update to 0.102.2
  * CVE-2020-3123: A denial-of-service (DoS) condition may occur when
    using the optional credit card data-loss-prevention (DLP) feature.
    Improper bounds checking of an unsigned variable resulted in an
    out-of-bounds read, which causes a crash.
  * Significantly improved the scan speed of PDF files on Windows.
  * Re-applied a fix to alleviate file access issues when scanning RAR
    files in downstream projects that use libclamav where the scanning
    engine is operating in a low-privilege process. This bug was originally
    fixed in 0.101.2 and the fix was mistakenly omitted from 0.102.0.
  * Fixed an issue where freshclam failed to update if the database version
    downloaded is one version older than advertised. This situation may
    occur after a new database version is published. The issue affected
    users downloading the whole CVD database file.
  * Changed the default freshclam ReceiveTimeout setting to 0 (infinite).
    The ReceiveTimeout had caused needless database update failures for
    users with slower internet connections.
  * Correctly display the number of kilobytes (KiB) in progress bar and
    reduced the size of the progress bar to accommodate 80-character width
    terminals.
  * Fixed an issue where running freshclam manually causes a daemonized
    freshclam process to fail when it updates because the manual instance
    deletes the temporary download directory. The freshclam temporary files
    will now download to a unique directory created at the time of an update
    instead of using a hardcoded directory created/destroyed at the program
    start/exit.
  * Fix for freshclam's OnOutdatedExecute config option.
  * Fixes a memory leak in the error condition handling for the email
    parser.
  * Improved bound checking and error handling in ARJ archive parser.
  * Improved error handling in PDF parser.
  * Fix for memory leak in byte-compare signature handler.</changelog>
  <changelog author="mpluskal@suse.com" date="1585742400">- Drop python build dependency as it is not needed</changelog>
  <changelog author="suse+build@de-korte.org" date="1589284800">- Update to 0.102.3
  * CVE-2020-3327: Fix a vulnerability in the ARJ archive parsing
    module in ClamAV 0.102.2 that could cause a Denial-of-Service (DoS)
    condition. Improper bounds checking of an unsigned variable results
    in an out-of-bounds read which causes a crash.
  * CVE-2020-3341: Fix a vulnerability in the PDF parsing module in
    ClamAV 0.101 - 0.102.2 that could cause a Denial-of-Service (DoS)
    condition. Improper size checking of a buffer used to initialize AES
    decryption routines results in an out-of-bounds read which may cause
    a crash.
  * Fix "Attempt to allocate 0 bytes" error when parsing some PDF
    documents.
  * Fix a couple of minor memory leaks.
  * Updated libclamunrar to UnRAR 5.9.2.</changelog>
  <changelog author="suse+build@de-korte.org" date="1594900800">- Update to 0.102.4
  * CVE-2020-3350: Fix a vulnerability wherein a malicious user could
    replace a scan target's directory with a symlink to another path
    to trick clamscan, clamdscan, or clamonacc into removing or moving
    a different file (eg. a critical system file). The issue would
    affect users that use the --move or --remove options for clamscan,
    clamdscan, and clamonacc.
  * CVE-2020-3327: Fix a vulnerability in the ARJ archive parsing
    module in ClamAV 0.102.3 that could cause a Denial-of-Service
    (DoS) condition. Improper bounds checking results in an
    out-of-bounds read which could cause a crash. The previous fix for
    this CVE in 0.102.3 was incomplete. This fix correctly resolves
    the issue.
  * CVE-2020-3481: Fix a vulnerability in the EGG archive module in
    ClamAV 0.102.0 - 0.102.3 could cause a Denial-of-Service (DoS)
    condition. Improper error handling may result in a crash due to a
    NULL pointer dereference. This vulnerability is mitigated for
    those using the official ClamAV signature databases because the
    file type signatures in daily.cvd will not enable the EGG archive
    parser in versions affected by the vulnerability.</changelog>
  <changelog author="suse+build@de-korte.org" date="1600084800">- Update to 0.103.0
  * clamd can now reload the signature database without blocking
    scanning. This multi-threaded database reload improvement was made
    possible thanks to a community effort.
  - Non-blocking database reloads are now the default behavior. Some
    systems that are more constrained on RAM may need to disable
    non-blocking reloads as it will temporarily consume two times as
    much memory. We added a new clamd config option
    ConcurrentDatabaseReload, which may be set to no.
  * Dropped clamav-str-h.patch (no longer needed)
  * Fix clamav-milter.service (requires clamd.service to run)</changelog>
  <changelog author="max@suse.com" date="1605009600">- Sync Factory to SLE-15 to implement jsc#ECO-3010 and bsc#1118459.
- bsc#1119353, clamav-fips.patch: Fix freshclam crash in FIPS mode.
- Keep OBS from installing an existing clamav instance to scan the
  sources, because this makes "make check" use the old library
  instead of the just built one. This is only a workaround until
  we found a way to keep libtool from adding libdir to rpath and
  LD_LIBRARY_PATH of the binaries in the testsuite.</changelog>
  <changelog author="dimstar@opensuse.org" date="1605182400">- Do not hard-depend on systemd: use systemd_ordering instead of
  systemd_requires.</changelog>
  <changelog author="max@suse.com" date="1617969600">- Update clamav.keyring
- Update to 0.103.2
  * CVE-2021-1252, bsc#1184532: Fix for Excel XLM parser infinite
    loop. Affects 0.103.0 and 0.103.1 only.
  * CVE-2021-1404, bsc#1184533: Fix for PDF parser buffer over-read;
    possible crash. Affects 0.103.0 and 0.103.1 only.
  * CVE-2021-1405, bsc#1184534: Fix for mail parser
    NULL-dereference crash. Affects 0.103.1 and prior.
  * Fix possible memory leak in PNG parser.
  * Fix ClamOnAcc scan on file-creation race condition so files are
    scanned after their contents are written.
  * FreshClam: Deprecate the SafeBrowsing config option. The
    SafeBrowsing option will no longer do anything.
  * For more details, see our blog post from last year about the
    future of the ClamAV Safe Browsing database.
  * FreshClam: Improved HTTP 304, 403, &amp; 429 handling.
  * FreshClam: Added back the mirrors.dat file to the database directory.
  * FreshClam will now exit with a failure in daemon mode if an HTTP 403
    (Forbidden) was received, because retrying later won't help any. The
    FreshClam user will have to take actions to get unblocked.
  * Fix the FreshClam mirror-sync issue where a downloaded database is
    "older than the version advertised."
  * bsc#1181256: Fix errors when scanning files &gt; 4G
  * obsoletes clamav-disable-timestamps.patch
- Update to 0.103.1
  * Added a new scan option to alert on broken media (graphics) file
    formats. This feature mitigates the risk of malformed media files
    intended to exploit vulnerabilities in other software. At present
    media validation exists for JPEG, TIFF, PNG, and GIF files. To
    enable this feature, set AlertBrokenMedia yes in clamd.conf, or
    use the --alert-broken-media option when using clamscan. These
    options are disabled by default in this patch release, but may be
    enabled in a subsequent release. Application developers may enable
    this scan option by enabling CL_SCAN_HEURISTIC_BROKEN_MEDIA for
    the heuristic scan option bit field.
  * Added CL_TYPE_TIFF, CL_TYPE_JPEG types to match GIF, PNG typing
    behavior. BMP and JPEG 2000 files will continue to detect as
    CL_TYPE_GRAPHICS because ClamAV does not yet have BMP or JPEG
    2000 format checking capabilities.
  * Fixed PNG parser logic bugs that caused an excess of parsing
    errors and fixed a stack exhaustion issue affecting some systems
    when scanning PNG files. PNG file type detection was disabled via
    signature database update for ClamAV version 0.103.0 to mitigate
    the effects from these bugs.
  * Fixed an issue where PNG and GIF files no longer work with
    Target:5 graphics signatures if detected as CL_TYPE_PNG/GIF rather
    than as CL_TYPE_GRAPHICS. Target types now support up to 10
    possible file types to make way for additional graphics types in
    future releases.
  * Fixed clamonacc's --fdpass option.
  - Interprocess file descriptor passing for clamonacc was broken
    since version 0.102.0 due to a bug introduced by the switch to
    curl for communicating with clamd. On Linux, passing file
    descriptors from one process to another is handled by the
    kernel, so we reverted clamonacc to use standard system calls
    for socket communication when fd passing is enabled.
  * Fixed a clamonacc stack corruption issue on some systems when
    using an older version of libcurl.
  * Allow clamscan and clamdscan scans to proceed even if the
    realpath lookup failed. This alleviates an issue on Windows
    scanning files hosted on file- systems that do not support the
    GetMappedFileNameW() API such as on ImDisk RAM-disks.
  * Fixed freshclam --on-update-execute=EXIT_1 temporary directory
    cleanup issue.
  * clamd's log output and VirusEvent now provide the scan target's
    file path instead of a file descriptor. The clamd socket API for
    submitting a scan by FD-passing doesn't include a file path, this
    feature works by looking up the file path by file descriptor.
    This feature works on Mac and Linux but is not yet implemented
    for other UNIX operating systems. FD-passing is not available for
    Windows.
  * Fixed an issue where freshclam database validation didn't work
    correctly when run in daemon mode on Linux/Unix.</changelog>
  <changelog author="suse+build@de-korte.org" date="1624276800">- bsc#1188284: Update to 0.103.3
  * Fixed a scan performance issue when ENGINE_OPTIONS_FORCE_TO_DISK is
    enabled. This issue did not impacted most users but for those
    affected it caused every scanned file to be copied to the temp
    directory before the scan.
  * Fix ClamDScan crashes when using the --fdpass --multiscan
    command-line options in combination with the ClamD ExcludePath
    config file options.
  * Fixed an issue where the mirrors.dat file is owned by root when
    starting as root (or with sudo) and using daemon-mode. File
    ownership will be set to the DatabaseOwner just before FreshClam
    switches to run as that user.
  * Renamed the mirrors.dat file to freshclam.dat.
  * Disabled the HTTPUserAgent config option if the DatabaseMirror uses
    clamav.net. This will prevent users from being inadvertently blocked
    and will ensure that we can keep better metrics on which ClamAV
    versions are being used.
  * Moved the detection for Heuristics.PNG.CVE-2010-1205 behind the
    ClamScan --alert-broken-media option (ClamD AlertBrokenMedia yes)
    option. This type of PNG issue appears to be common enough to be an
    annoyance, and the CVE is old enough that no one should be
    vulnerable at this point.
  * Fix ClamSubmit failures after changes to Cloudflare "__cfduid"
    cookies. See: https://blog.cloudflare.com/deprecating-cfduid-cookie/</changelog>
  <changelog author="meissner@suse.com" date="1625054400">- clamav-document-maxsize.patch: in the "clamscan" and "clamdscan" manpages,
  document that files over a certain size by default will silently not be
  scanned and how this can be adjusted (bsc#1187509)</changelog>
  <changelog author="max@suse.com" date="1636372800">- bsc#1192346: Update to 0.103.4
  * FreshClam:
  - Add a 24-hour cool-down for FreshClam clients that have received
    an HTTP 403 (Forbidden) response from the CDN. This is to reduce
    the volume of 403-response data served to blocked FreshClam
    clients that are configured with a tight update-loop.
  - Fixed a bug where FreshClam treats an empty CDIFF as an
    incremental update failure instead of as an intentional request
    to download the whole CVD.
  * ClamDScan: Fix a scan error when broken symlinks are encountered on
    macOS with "FollowDirectorySymlinks" and "FollowFileSymlinks"
    options disabled.
  * Overhauled the scan recursion / nested archive extraction logic and
    added new limits on embedded file-type recognition performed during
    the "raw" scan of each file. This limits embedded file-type
    misidentification and prevents detecting embedded file content that
    is found/extracted and scanned at other layers in the scanning
    process.
  * Fix an issue with the FMap module that failed to read from some
    nested files.
  * Fixed an issue where failing to load some rules from a Yara file
    containing multiple rules may cause a crash.
  * Fixed assorted compiler warnings.
  * Fixed assorted Coverity static code analysis issues.
  * Scan limits:
  - Added virus-name suffixes to the alerts that trigger when a scan
    limit has been exceeded. Rather than simply
    Heuristics.Limits.Exceeded, you may now see limit-specific
    virus-names, to include:
    + Heuristics.Limits.Exceeded.MaxFileSize
    + Heuristics.Limits.Exceeded.MaxScanSize
    + Heuristics.Limits.Exceeded.MaxFiles
    + Heuristics.Limits.Exceeded.MaxRecursion
    + Heuristics.Limits.Exceeded.MaxScanTime
  - Renamed the Heuristics.Email.ExceedsMax.* alerts to align with
    the other limit alerts names. These alerts include:
    + Heuristics.Limits.Exceeded.EmailLineFoldcnt
    + Heuristics.Limits.Exceeded.EmailHeaderBytes
    + Heuristics.Limits.Exceeded.EmailHeaders
    + Heuristics.Limits.Exceeded.EmailMIMEPartsPerMessage
    + Heuristics.Limits.Exceeded.EmailMIMEArguments
  - Fixed an issue where the Email-related scan limits would alert
    even when the "AlertExceedsMax" (--alert-exceeds-max) scan option
    is not enabled.
  - Fixes an issue in the Zip parser where exceeding the "MaxFiles"
    limit or the "MaxFileSize" limit would abort the scan but would
    fail to alert. The Zip scan limit issues were independently
    identified and reported by Aaron Leliaert and Max Allan.
  * Fixed a leak in the Email parser when using the --gen-json scan
    option.
  * Fixed an issue where a failure to record metadata in the Email
    parser when using the --gen-json scan option could cause the Email
    parser to abort the scan early and fail to extract and scan
    additional content.
  * Fixed a file name memory leak in the Zip parser.
  * Fixed an issue where certain signature patterns may cause a crash or
    cause unintended matches on some systems when converting characters
    to uppercase if a UTF-8 unicode single-byte grapheme becomes a
    multi-byte grapheme. Patch courtesy of Andrea De Pasquale.
- Fix unit test
  + clamav-ck_assert_msg.patch</changelog>
  <changelog author="max@suse.com" date="1642420800">- Update to 0.103.5
  * bsc#1194731, CVE-2022-20698:
    Fix for invalid pointer read that may cause a crash.
    This issue affects 0.104.1, 0.103.4 and prior when ClamAV is compiled
    with libjson-c and the CL_SCAN_GENERAL_COLLECT_METADATA scan option
    (the clamscan --gen-json option) is enabled.
  * Fixed ability to disable the file size limit with libclamav C API,
    like this:
    cl_engine_set_num(engine, CL_ENGINE_MAX_FILESIZE, 0);
    This issue didn't affect ClamD or ClamScan which also can disable the
    limit by setting it to zero using MaxFileSize 0 in clamd.conf for ClamD,
    or clamscan --max-filesize=0 for ClamScan.
    Note: Internally, the max file size is still set to 2 GiB. Disabling the
    limit for a scan will fall back on the internal 2 GiB limitation.
  * Increased the maximum line length for ClamAV config files from 512 bytes
    to 1,024 bytes to allow for longer config option strings.
  * SigTool: Fix insufficient buffer size for --list-sigs that caused a
    failure when listing a database containing one or more very long
    signatures. This fix was backported from 0.104.</changelog>
</package>
<package pkgid="efe2277c73f39fc82f4fe68002823d0d430517a005f0a5250892ec8bd134b9b5" name="clamav" arch="s390x">
  <version epoch="0" ver="0.103.5" rel="3.35.1"/>
  <changelog author="egdfree@opensuse.org" date="1553688000">- Update to version 0.101.2 (bsc#1130721)
  * CVE-2019-1787:
    An out-of-bounds heap read condition may occur when scanning PDF
    documents. The defect is a failure to correctly keep track of the number
    of bytes remaining in a buffer when indexing file data.
  * CVE-2019-1789:
    An out-of-bounds heap read condition may occur when scanning PE files
    (i.e. Windows EXE and DLL files) that have been packed using Aspack as a
    result of inadequate bound-checking.
  * CVE-2019-1788:
    An out-of-bounds heap write condition may occur when scanning OLE2 files
    such as Microsoft Office 97-2003 documents. The invalid write happens when
    an invalid pointer is mistakenly used to initialize a 32bit integer to
    zero. This is likely to crash the application.
  * CVE-2019-1786:
    An out-of-bounds heap read condition may occur when scanning malformed
    PDF documents as a result of improper bounds-checking.
  * CVE-2019-1785:
    A path-traversal write condition may occur as a result of improper
    input validation when scanning RAR archives.
  * CVE-2019-1798:
    A use-after-free condition may occur as a result of improper error
    handling when scanning nested RAR archives.
- added clamav-max_patch.patch to fix build
- dropped clamav-freshclam-exit.patch</changelog>
  <changelog author="max@suse.com" date="1565092800">- Update to version 0.101.3:
  * bsc#1144504: ZIP bomb causes extreme CPU spikes</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1567598400">- update to 0.101.4:
  * CVE-2019-12900: An out of bounds write in the NSIS bzip2
    (boo#1149458)
  * CVE-2019-12625: Introduce a configurable time limit to mitigate
    zip bomb vulnerability completely. Default is 2 minutes,
    configurable useing the clamscan --max-scantime and for clamd
    using the MaxScanTime config option (boo#1144504)</changelog>
  <changelog author="max@suse.com" date="1572004800">- bsc#1151839: Increase the startup timeout of clamd to 5 minutes
  to cater for the grown virus database as a workaround until
  clamd has learned to talk to systemd to extend the timeout as
  long as needed.</changelog>
  <changelog author="suse+build@de-korte.org" date="1572609600">- update to 0.102.0
  * The On-Access Scanning feature has been migrated out of clamd
    and into a brand new utility named clamonacc. This utility is
    similar to clamdscan and clamav-milter in that it acts as a
    client to clamd. This separation from clamd means that clamd no
    longer needs to run with root privileges while scanning potentially
    malicious files. Instead, clamd may drop privileges to run under an
    account that does not have super-user. In addition to improving the
    security posture of running clamd with On-Access enabled, this
    update fixed a few outstanding defects:
  - On-Access scanning for created and moved files (Extra-Scanning)
    is fixed.
  - VirusEvent for On-Access scans is fixed.
  - With clamonacc, it is now possible to copy, move, or remove a
    file if the scan triggered an alert, just like with clamdscan.
  * The freshclam database update utility has undergone a significant
    update. This includes:
  - Added support for HTTPS.
  - Support for database mirrors hosted on ports other than 80.
  - Removal of the mirror management feature (mirrors.dat).
  - An all new libfreshclam library API.
- created new subpackage libfreshclam2
- dropped clamav-max_patch.patch (upstreamed)
- added clamav-fix_building_milter.patch to fix build of milter</changelog>
  <changelog author="suse+build@de-korte.org" date="1574251200">- update to 0.102.1
  * CVE-2019-15961, bsc#1157763: A Denial-of-Service (DoS)
    vulnerability may occur when scanning a specially crafted email
    file as a result of excessively long scan times. The issue is
    resolved by implementing several maximums in parsing MIME
    messages and by optimizing use of memory allocation.
  * Build system fixes to build clamav-milter, to correctly link
    with libxml2 when detected, and to correctly detect fanotify
    for on-access scanning feature support.
  * Signature load time is significantly reduced by changing to a
    more efficient algorithm for loading signature patterns and
    allocating the AC trie. Patch courtesy of Alberto Wu.
  * Introduced a new configure option to statically link libjson-c
    with libclamav. Static linking with libjson is highly
    recommended to prevent crashes in applications that use
    libclamav alongside another JSON parsing library.
  * Null-dereference fix in email parser when using the
  - -gen-json metadata option.
  * Fixes for Authenticode parsing and certificate signature
    (.crb database) bugs.
- dropped clamav-fix_building_milter.patch (upstreamed)</changelog>
  <changelog author="dimstar@opensuse.org" date="1576756800">- BuildRequire pkgconfig(libsystemd) instead of systemd-devel:
  Allow OBS to shortcut through the -mini flavors.</changelog>
  <changelog author="suse+build@de-korte.org" date="1577188800">- The freshclam.service should not be started before the network is
  online (it checks for updates immediately upon service start)</changelog>
  <changelog author="suse+build@de-korte.org" date="1580904000">- update to 0.102.2
  * CVE-2020-3123: A denial-of-service (DoS) condition may occur when
    using the optional credit card data-loss-prevention (DLP) feature.
    Improper bounds checking of an unsigned variable resulted in an
    out-of-bounds read, which causes a crash.
  * Significantly improved the scan speed of PDF files on Windows.
  * Re-applied a fix to alleviate file access issues when scanning RAR
    files in downstream projects that use libclamav where the scanning
    engine is operating in a low-privilege process. This bug was originally
    fixed in 0.101.2 and the fix was mistakenly omitted from 0.102.0.
  * Fixed an issue where freshclam failed to update if the database version
    downloaded is one version older than advertised. This situation may
    occur after a new database version is published. The issue affected
    users downloading the whole CVD database file.
  * Changed the default freshclam ReceiveTimeout setting to 0 (infinite).
    The ReceiveTimeout had caused needless database update failures for
    users with slower internet connections.
  * Correctly display the number of kilobytes (KiB) in progress bar and
    reduced the size of the progress bar to accommodate 80-character width
    terminals.
  * Fixed an issue where running freshclam manually causes a daemonized
    freshclam process to fail when it updates because the manual instance
    deletes the temporary download directory. The freshclam temporary files
    will now download to a unique directory created at the time of an update
    instead of using a hardcoded directory created/destroyed at the program
    start/exit.
  * Fix for freshclam's OnOutdatedExecute config option.
  * Fixes a memory leak in the error condition handling for the email
    parser.
  * Improved bound checking and error handling in ARJ archive parser.
  * Improved error handling in PDF parser.
  * Fix for memory leak in byte-compare signature handler.</changelog>
  <changelog author="mpluskal@suse.com" date="1585742400">- Drop python build dependency as it is not needed</changelog>
  <changelog author="suse+build@de-korte.org" date="1589284800">- Update to 0.102.3
  * CVE-2020-3327: Fix a vulnerability in the ARJ archive parsing
    module in ClamAV 0.102.2 that could cause a Denial-of-Service (DoS)
    condition. Improper bounds checking of an unsigned variable results
    in an out-of-bounds read which causes a crash.
  * CVE-2020-3341: Fix a vulnerability in the PDF parsing module in
    ClamAV 0.101 - 0.102.2 that could cause a Denial-of-Service (DoS)
    condition. Improper size checking of a buffer used to initialize AES
    decryption routines results in an out-of-bounds read which may cause
    a crash.
  * Fix "Attempt to allocate 0 bytes" error when parsing some PDF
    documents.
  * Fix a couple of minor memory leaks.
  * Updated libclamunrar to UnRAR 5.9.2.</changelog>
  <changelog author="suse+build@de-korte.org" date="1594900800">- Update to 0.102.4
  * CVE-2020-3350: Fix a vulnerability wherein a malicious user could
    replace a scan target's directory with a symlink to another path
    to trick clamscan, clamdscan, or clamonacc into removing or moving
    a different file (eg. a critical system file). The issue would
    affect users that use the --move or --remove options for clamscan,
    clamdscan, and clamonacc.
  * CVE-2020-3327: Fix a vulnerability in the ARJ archive parsing
    module in ClamAV 0.102.3 that could cause a Denial-of-Service
    (DoS) condition. Improper bounds checking results in an
    out-of-bounds read which could cause a crash. The previous fix for
    this CVE in 0.102.3 was incomplete. This fix correctly resolves
    the issue.
  * CVE-2020-3481: Fix a vulnerability in the EGG archive module in
    ClamAV 0.102.0 - 0.102.3 could cause a Denial-of-Service (DoS)
    condition. Improper error handling may result in a crash due to a
    NULL pointer dereference. This vulnerability is mitigated for
    those using the official ClamAV signature databases because the
    file type signatures in daily.cvd will not enable the EGG archive
    parser in versions affected by the vulnerability.</changelog>
  <changelog author="suse+build@de-korte.org" date="1600084800">- Update to 0.103.0
  * clamd can now reload the signature database without blocking
    scanning. This multi-threaded database reload improvement was made
    possible thanks to a community effort.
  - Non-blocking database reloads are now the default behavior. Some
    systems that are more constrained on RAM may need to disable
    non-blocking reloads as it will temporarily consume two times as
    much memory. We added a new clamd config option
    ConcurrentDatabaseReload, which may be set to no.
  * Dropped clamav-str-h.patch (no longer needed)
  * Fix clamav-milter.service (requires clamd.service to run)</changelog>
  <changelog author="max@suse.com" date="1605009600">- Sync Factory to SLE-15 to implement jsc#ECO-3010 and bsc#1118459.
- bsc#1119353, clamav-fips.patch: Fix freshclam crash in FIPS mode.
- Keep OBS from installing an existing clamav instance to scan the
  sources, because this makes "make check" use the old library
  instead of the just built one. This is only a workaround until
  we found a way to keep libtool from adding libdir to rpath and
  LD_LIBRARY_PATH of the binaries in the testsuite.</changelog>
  <changelog author="dimstar@opensuse.org" date="1605182400">- Do not hard-depend on systemd: use systemd_ordering instead of
  systemd_requires.</changelog>
  <changelog author="max@suse.com" date="1617969600">- Update clamav.keyring
- Update to 0.103.2
  * CVE-2021-1252, bsc#1184532: Fix for Excel XLM parser infinite
    loop. Affects 0.103.0 and 0.103.1 only.
  * CVE-2021-1404, bsc#1184533: Fix for PDF parser buffer over-read;
    possible crash. Affects 0.103.0 and 0.103.1 only.
  * CVE-2021-1405, bsc#1184534: Fix for mail parser
    NULL-dereference crash. Affects 0.103.1 and prior.
  * Fix possible memory leak in PNG parser.
  * Fix ClamOnAcc scan on file-creation race condition so files are
    scanned after their contents are written.
  * FreshClam: Deprecate the SafeBrowsing config option. The
    SafeBrowsing option will no longer do anything.
  * For more details, see our blog post from last year about the
    future of the ClamAV Safe Browsing database.
  * FreshClam: Improved HTTP 304, 403, &amp; 429 handling.
  * FreshClam: Added back the mirrors.dat file to the database directory.
  * FreshClam will now exit with a failure in daemon mode if an HTTP 403
    (Forbidden) was received, because retrying later won't help any. The
    FreshClam user will have to take actions to get unblocked.
  * Fix the FreshClam mirror-sync issue where a downloaded database is
    "older than the version advertised."
  * bsc#1181256: Fix errors when scanning files &gt; 4G
  * obsoletes clamav-disable-timestamps.patch
- Update to 0.103.1
  * Added a new scan option to alert on broken media (graphics) file
    formats. This feature mitigates the risk of malformed media files
    intended to exploit vulnerabilities in other software. At present
    media validation exists for JPEG, TIFF, PNG, and GIF files. To
    enable this feature, set AlertBrokenMedia yes in clamd.conf, or
    use the --alert-broken-media option when using clamscan. These
    options are disabled by default in this patch release, but may be
    enabled in a subsequent release. Application developers may enable
    this scan option by enabling CL_SCAN_HEURISTIC_BROKEN_MEDIA for
    the heuristic scan option bit field.
  * Added CL_TYPE_TIFF, CL_TYPE_JPEG types to match GIF, PNG typing
    behavior. BMP and JPEG 2000 files will continue to detect as
    CL_TYPE_GRAPHICS because ClamAV does not yet have BMP or JPEG
    2000 format checking capabilities.
  * Fixed PNG parser logic bugs that caused an excess of parsing
    errors and fixed a stack exhaustion issue affecting some systems
    when scanning PNG files. PNG file type detection was disabled via
    signature database update for ClamAV version 0.103.0 to mitigate
    the effects from these bugs.
  * Fixed an issue where PNG and GIF files no longer work with
    Target:5 graphics signatures if detected as CL_TYPE_PNG/GIF rather
    than as CL_TYPE_GRAPHICS. Target types now support up to 10
    possible file types to make way for additional graphics types in
    future releases.
  * Fixed clamonacc's --fdpass option.
  - Interprocess file descriptor passing for clamonacc was broken
    since version 0.102.0 due to a bug introduced by the switch to
    curl for communicating with clamd. On Linux, passing file
    descriptors from one process to another is handled by the
    kernel, so we reverted clamonacc to use standard system calls
    for socket communication when fd passing is enabled.
  * Fixed a clamonacc stack corruption issue on some systems when
    using an older version of libcurl.
  * Allow clamscan and clamdscan scans to proceed even if the
    realpath lookup failed. This alleviates an issue on Windows
    scanning files hosted on file- systems that do not support the
    GetMappedFileNameW() API such as on ImDisk RAM-disks.
  * Fixed freshclam --on-update-execute=EXIT_1 temporary directory
    cleanup issue.
  * clamd's log output and VirusEvent now provide the scan target's
    file path instead of a file descriptor. The clamd socket API for
    submitting a scan by FD-passing doesn't include a file path, this
    feature works by looking up the file path by file descriptor.
    This feature works on Mac and Linux but is not yet implemented
    for other UNIX operating systems. FD-passing is not available for
    Windows.
  * Fixed an issue where freshclam database validation didn't work
    correctly when run in daemon mode on Linux/Unix.</changelog>
  <changelog author="suse+build@de-korte.org" date="1624276800">- bsc#1188284: Update to 0.103.3
  * Fixed a scan performance issue when ENGINE_OPTIONS_FORCE_TO_DISK is
    enabled. This issue did not impacted most users but for those
    affected it caused every scanned file to be copied to the temp
    directory before the scan.
  * Fix ClamDScan crashes when using the --fdpass --multiscan
    command-line options in combination with the ClamD ExcludePath
    config file options.
  * Fixed an issue where the mirrors.dat file is owned by root when
    starting as root (or with sudo) and using daemon-mode. File
    ownership will be set to the DatabaseOwner just before FreshClam
    switches to run as that user.
  * Renamed the mirrors.dat file to freshclam.dat.
  * Disabled the HTTPUserAgent config option if the DatabaseMirror uses
    clamav.net. This will prevent users from being inadvertently blocked
    and will ensure that we can keep better metrics on which ClamAV
    versions are being used.
  * Moved the detection for Heuristics.PNG.CVE-2010-1205 behind the
    ClamScan --alert-broken-media option (ClamD AlertBrokenMedia yes)
    option. This type of PNG issue appears to be common enough to be an
    annoyance, and the CVE is old enough that no one should be
    vulnerable at this point.
  * Fix ClamSubmit failures after changes to Cloudflare "__cfduid"
    cookies. See: https://blog.cloudflare.com/deprecating-cfduid-cookie/</changelog>
  <changelog author="meissner@suse.com" date="1625054400">- clamav-document-maxsize.patch: in the "clamscan" and "clamdscan" manpages,
  document that files over a certain size by default will silently not be
  scanned and how this can be adjusted (bsc#1187509)</changelog>
  <changelog author="max@suse.com" date="1636372800">- bsc#1192346: Update to 0.103.4
  * FreshClam:
  - Add a 24-hour cool-down for FreshClam clients that have received
    an HTTP 403 (Forbidden) response from the CDN. This is to reduce
    the volume of 403-response data served to blocked FreshClam
    clients that are configured with a tight update-loop.
  - Fixed a bug where FreshClam treats an empty CDIFF as an
    incremental update failure instead of as an intentional request
    to download the whole CVD.
  * ClamDScan: Fix a scan error when broken symlinks are encountered on
    macOS with "FollowDirectorySymlinks" and "FollowFileSymlinks"
    options disabled.
  * Overhauled the scan recursion / nested archive extraction logic and
    added new limits on embedded file-type recognition performed during
    the "raw" scan of each file. This limits embedded file-type
    misidentification and prevents detecting embedded file content that
    is found/extracted and scanned at other layers in the scanning
    process.
  * Fix an issue with the FMap module that failed to read from some
    nested files.
  * Fixed an issue where failing to load some rules from a Yara file
    containing multiple rules may cause a crash.
  * Fixed assorted compiler warnings.
  * Fixed assorted Coverity static code analysis issues.
  * Scan limits:
  - Added virus-name suffixes to the alerts that trigger when a scan
    limit has been exceeded. Rather than simply
    Heuristics.Limits.Exceeded, you may now see limit-specific
    virus-names, to include:
    + Heuristics.Limits.Exceeded.MaxFileSize
    + Heuristics.Limits.Exceeded.MaxScanSize
    + Heuristics.Limits.Exceeded.MaxFiles
    + Heuristics.Limits.Exceeded.MaxRecursion
    + Heuristics.Limits.Exceeded.MaxScanTime
  - Renamed the Heuristics.Email.ExceedsMax.* alerts to align with
    the other limit alerts names. These alerts include:
    + Heuristics.Limits.Exceeded.EmailLineFoldcnt
    + Heuristics.Limits.Exceeded.EmailHeaderBytes
    + Heuristics.Limits.Exceeded.EmailHeaders
    + Heuristics.Limits.Exceeded.EmailMIMEPartsPerMessage
    + Heuristics.Limits.Exceeded.EmailMIMEArguments
  - Fixed an issue where the Email-related scan limits would alert
    even when the "AlertExceedsMax" (--alert-exceeds-max) scan option
    is not enabled.
  - Fixes an issue in the Zip parser where exceeding the "MaxFiles"
    limit or the "MaxFileSize" limit would abort the scan but would
    fail to alert. The Zip scan limit issues were independently
    identified and reported by Aaron Leliaert and Max Allan.
  * Fixed a leak in the Email parser when using the --gen-json scan
    option.
  * Fixed an issue where a failure to record metadata in the Email
    parser when using the --gen-json scan option could cause the Email
    parser to abort the scan early and fail to extract and scan
    additional content.
  * Fixed a file name memory leak in the Zip parser.
  * Fixed an issue where certain signature patterns may cause a crash or
    cause unintended matches on some systems when converting characters
    to uppercase if a UTF-8 unicode single-byte grapheme becomes a
    multi-byte grapheme. Patch courtesy of Andrea De Pasquale.
- Fix unit test
  + clamav-ck_assert_msg.patch</changelog>
  <changelog author="max@suse.com" date="1642420800">- Update to 0.103.5
  * bsc#1194731, CVE-2022-20698:
    Fix for invalid pointer read that may cause a crash.
    This issue affects 0.104.1, 0.103.4 and prior when ClamAV is compiled
    with libjson-c and the CL_SCAN_GENERAL_COLLECT_METADATA scan option
    (the clamscan --gen-json option) is enabled.
  * Fixed ability to disable the file size limit with libclamav C API,
    like this:
    cl_engine_set_num(engine, CL_ENGINE_MAX_FILESIZE, 0);
    This issue didn't affect ClamD or ClamScan which also can disable the
    limit by setting it to zero using MaxFileSize 0 in clamd.conf for ClamD,
    or clamscan --max-filesize=0 for ClamScan.
    Note: Internally, the max file size is still set to 2 GiB. Disabling the
    limit for a scan will fall back on the internal 2 GiB limitation.
  * Increased the maximum line length for ClamAV config files from 512 bytes
    to 1,024 bytes to allow for longer config option strings.
  * SigTool: Fix insufficient buffer size for --list-sigs that caused a
    failure when listing a database containing one or more very long
    signatures. This fix was backported from 0.104.</changelog>
</package>
<package pkgid="c76153bf89ce328eb1396a37b2019abc21ad2d0c83f1de659bdb341b6609751c" name="clamav" arch="src">
  <version epoch="0" ver="0.103.5" rel="3.35.1"/>
  <changelog author="egdfree@opensuse.org" date="1553688000">- Update to version 0.101.2 (bsc#1130721)
  * CVE-2019-1787:
    An out-of-bounds heap read condition may occur when scanning PDF
    documents. The defect is a failure to correctly keep track of the number
    of bytes remaining in a buffer when indexing file data.
  * CVE-2019-1789:
    An out-of-bounds heap read condition may occur when scanning PE files
    (i.e. Windows EXE and DLL files) that have been packed using Aspack as a
    result of inadequate bound-checking.
  * CVE-2019-1788:
    An out-of-bounds heap write condition may occur when scanning OLE2 files
    such as Microsoft Office 97-2003 documents. The invalid write happens when
    an invalid pointer is mistakenly used to initialize a 32bit integer to
    zero. This is likely to crash the application.
  * CVE-2019-1786:
    An out-of-bounds heap read condition may occur when scanning malformed
    PDF documents as a result of improper bounds-checking.
  * CVE-2019-1785:
    A path-traversal write condition may occur as a result of improper
    input validation when scanning RAR archives.
  * CVE-2019-1798:
    A use-after-free condition may occur as a result of improper error
    handling when scanning nested RAR archives.
- added clamav-max_patch.patch to fix build
- dropped clamav-freshclam-exit.patch</changelog>
  <changelog author="max@suse.com" date="1565092800">- Update to version 0.101.3:
  * bsc#1144504: ZIP bomb causes extreme CPU spikes</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1567598400">- update to 0.101.4:
  * CVE-2019-12900: An out of bounds write in the NSIS bzip2
    (boo#1149458)
  * CVE-2019-12625: Introduce a configurable time limit to mitigate
    zip bomb vulnerability completely. Default is 2 minutes,
    configurable useing the clamscan --max-scantime and for clamd
    using the MaxScanTime config option (boo#1144504)</changelog>
  <changelog author="max@suse.com" date="1572004800">- bsc#1151839: Increase the startup timeout of clamd to 5 minutes
  to cater for the grown virus database as a workaround until
  clamd has learned to talk to systemd to extend the timeout as
  long as needed.</changelog>
  <changelog author="suse+build@de-korte.org" date="1572609600">- update to 0.102.0
  * The On-Access Scanning feature has been migrated out of clamd
    and into a brand new utility named clamonacc. This utility is
    similar to clamdscan and clamav-milter in that it acts as a
    client to clamd. This separation from clamd means that clamd no
    longer needs to run with root privileges while scanning potentially
    malicious files. Instead, clamd may drop privileges to run under an
    account that does not have super-user. In addition to improving the
    security posture of running clamd with On-Access enabled, this
    update fixed a few outstanding defects:
  - On-Access scanning for created and moved files (Extra-Scanning)
    is fixed.
  - VirusEvent for On-Access scans is fixed.
  - With clamonacc, it is now possible to copy, move, or remove a
    file if the scan triggered an alert, just like with clamdscan.
  * The freshclam database update utility has undergone a significant
    update. This includes:
  - Added support for HTTPS.
  - Support for database mirrors hosted on ports other than 80.
  - Removal of the mirror management feature (mirrors.dat).
  - An all new libfreshclam library API.
- created new subpackage libfreshclam2
- dropped clamav-max_patch.patch (upstreamed)
- added clamav-fix_building_milter.patch to fix build of milter</changelog>
  <changelog author="suse+build@de-korte.org" date="1574251200">- update to 0.102.1
  * CVE-2019-15961, bsc#1157763: A Denial-of-Service (DoS)
    vulnerability may occur when scanning a specially crafted email
    file as a result of excessively long scan times. The issue is
    resolved by implementing several maximums in parsing MIME
    messages and by optimizing use of memory allocation.
  * Build system fixes to build clamav-milter, to correctly link
    with libxml2 when detected, and to correctly detect fanotify
    for on-access scanning feature support.
  * Signature load time is significantly reduced by changing to a
    more efficient algorithm for loading signature patterns and
    allocating the AC trie. Patch courtesy of Alberto Wu.
  * Introduced a new configure option to statically link libjson-c
    with libclamav. Static linking with libjson is highly
    recommended to prevent crashes in applications that use
    libclamav alongside another JSON parsing library.
  * Null-dereference fix in email parser when using the
  - -gen-json metadata option.
  * Fixes for Authenticode parsing and certificate signature
    (.crb database) bugs.
- dropped clamav-fix_building_milter.patch (upstreamed)</changelog>
  <changelog author="dimstar@opensuse.org" date="1576756800">- BuildRequire pkgconfig(libsystemd) instead of systemd-devel:
  Allow OBS to shortcut through the -mini flavors.</changelog>
  <changelog author="suse+build@de-korte.org" date="1577188800">- The freshclam.service should not be started before the network is
  online (it checks for updates immediately upon service start)</changelog>
  <changelog author="suse+build@de-korte.org" date="1580904000">- update to 0.102.2
  * CVE-2020-3123: A denial-of-service (DoS) condition may occur when
    using the optional credit card data-loss-prevention (DLP) feature.
    Improper bounds checking of an unsigned variable resulted in an
    out-of-bounds read, which causes a crash.
  * Significantly improved the scan speed of PDF files on Windows.
  * Re-applied a fix to alleviate file access issues when scanning RAR
    files in downstream projects that use libclamav where the scanning
    engine is operating in a low-privilege process. This bug was originally
    fixed in 0.101.2 and the fix was mistakenly omitted from 0.102.0.
  * Fixed an issue where freshclam failed to update if the database version
    downloaded is one version older than advertised. This situation may
    occur after a new database version is published. The issue affected
    users downloading the whole CVD database file.
  * Changed the default freshclam ReceiveTimeout setting to 0 (infinite).
    The ReceiveTimeout had caused needless database update failures for
    users with slower internet connections.
  * Correctly display the number of kilobytes (KiB) in progress bar and
    reduced the size of the progress bar to accommodate 80-character width
    terminals.
  * Fixed an issue where running freshclam manually causes a daemonized
    freshclam process to fail when it updates because the manual instance
    deletes the temporary download directory. The freshclam temporary files
    will now download to a unique directory created at the time of an update
    instead of using a hardcoded directory created/destroyed at the program
    start/exit.
  * Fix for freshclam's OnOutdatedExecute config option.
  * Fixes a memory leak in the error condition handling for the email
    parser.
  * Improved bound checking and error handling in ARJ archive parser.
  * Improved error handling in PDF parser.
  * Fix for memory leak in byte-compare signature handler.</changelog>
  <changelog author="mpluskal@suse.com" date="1585742400">- Drop python build dependency as it is not needed</changelog>
  <changelog author="suse+build@de-korte.org" date="1589284800">- Update to 0.102.3
  * CVE-2020-3327: Fix a vulnerability in the ARJ archive parsing
    module in ClamAV 0.102.2 that could cause a Denial-of-Service (DoS)
    condition. Improper bounds checking of an unsigned variable results
    in an out-of-bounds read which causes a crash.
  * CVE-2020-3341: Fix a vulnerability in the PDF parsing module in
    ClamAV 0.101 - 0.102.2 that could cause a Denial-of-Service (DoS)
    condition. Improper size checking of a buffer used to initialize AES
    decryption routines results in an out-of-bounds read which may cause
    a crash.
  * Fix "Attempt to allocate 0 bytes" error when parsing some PDF
    documents.
  * Fix a couple of minor memory leaks.
  * Updated libclamunrar to UnRAR 5.9.2.</changelog>
  <changelog author="suse+build@de-korte.org" date="1594900800">- Update to 0.102.4
  * CVE-2020-3350: Fix a vulnerability wherein a malicious user could
    replace a scan target's directory with a symlink to another path
    to trick clamscan, clamdscan, or clamonacc into removing or moving
    a different file (eg. a critical system file). The issue would
    affect users that use the --move or --remove options for clamscan,
    clamdscan, and clamonacc.
  * CVE-2020-3327: Fix a vulnerability in the ARJ archive parsing
    module in ClamAV 0.102.3 that could cause a Denial-of-Service
    (DoS) condition. Improper bounds checking results in an
    out-of-bounds read which could cause a crash. The previous fix for
    this CVE in 0.102.3 was incomplete. This fix correctly resolves
    the issue.
  * CVE-2020-3481: Fix a vulnerability in the EGG archive module in
    ClamAV 0.102.0 - 0.102.3 could cause a Denial-of-Service (DoS)
    condition. Improper error handling may result in a crash due to a
    NULL pointer dereference. This vulnerability is mitigated for
    those using the official ClamAV signature databases because the
    file type signatures in daily.cvd will not enable the EGG archive
    parser in versions affected by the vulnerability.</changelog>
  <changelog author="suse+build@de-korte.org" date="1600084800">- Update to 0.103.0
  * clamd can now reload the signature database without blocking
    scanning. This multi-threaded database reload improvement was made
    possible thanks to a community effort.
  - Non-blocking database reloads are now the default behavior. Some
    systems that are more constrained on RAM may need to disable
    non-blocking reloads as it will temporarily consume two times as
    much memory. We added a new clamd config option
    ConcurrentDatabaseReload, which may be set to no.
  * Dropped clamav-str-h.patch (no longer needed)
  * Fix clamav-milter.service (requires clamd.service to run)</changelog>
  <changelog author="max@suse.com" date="1605009600">- Sync Factory to SLE-15 to implement jsc#ECO-3010 and bsc#1118459.
- bsc#1119353, clamav-fips.patch: Fix freshclam crash in FIPS mode.
- Keep OBS from installing an existing clamav instance to scan the
  sources, because this makes "make check" use the old library
  instead of the just built one. This is only a workaround until
  we found a way to keep libtool from adding libdir to rpath and
  LD_LIBRARY_PATH of the binaries in the testsuite.</changelog>
  <changelog author="dimstar@opensuse.org" date="1605182400">- Do not hard-depend on systemd: use systemd_ordering instead of
  systemd_requires.</changelog>
  <changelog author="max@suse.com" date="1617969600">- Update clamav.keyring
- Update to 0.103.2
  * CVE-2021-1252, bsc#1184532: Fix for Excel XLM parser infinite
    loop. Affects 0.103.0 and 0.103.1 only.
  * CVE-2021-1404, bsc#1184533: Fix for PDF parser buffer over-read;
    possible crash. Affects 0.103.0 and 0.103.1 only.
  * CVE-2021-1405, bsc#1184534: Fix for mail parser
    NULL-dereference crash. Affects 0.103.1 and prior.
  * Fix possible memory leak in PNG parser.
  * Fix ClamOnAcc scan on file-creation race condition so files are
    scanned after their contents are written.
  * FreshClam: Deprecate the SafeBrowsing config option. The
    SafeBrowsing option will no longer do anything.
  * For more details, see our blog post from last year about the
    future of the ClamAV Safe Browsing database.
  * FreshClam: Improved HTTP 304, 403, &amp; 429 handling.
  * FreshClam: Added back the mirrors.dat file to the database directory.
  * FreshClam will now exit with a failure in daemon mode if an HTTP 403
    (Forbidden) was received, because retrying later won't help any. The
    FreshClam user will have to take actions to get unblocked.
  * Fix the FreshClam mirror-sync issue where a downloaded database is
    "older than the version advertised."
  * bsc#1181256: Fix errors when scanning files &gt; 4G
  * obsoletes clamav-disable-timestamps.patch
- Update to 0.103.1
  * Added a new scan option to alert on broken media (graphics) file
    formats. This feature mitigates the risk of malformed media files
    intended to exploit vulnerabilities in other software. At present
    media validation exists for JPEG, TIFF, PNG, and GIF files. To
    enable this feature, set AlertBrokenMedia yes in clamd.conf, or
    use the --alert-broken-media option when using clamscan. These
    options are disabled by default in this patch release, but may be
    enabled in a subsequent release. Application developers may enable
    this scan option by enabling CL_SCAN_HEURISTIC_BROKEN_MEDIA for
    the heuristic scan option bit field.
  * Added CL_TYPE_TIFF, CL_TYPE_JPEG types to match GIF, PNG typing
    behavior. BMP and JPEG 2000 files will continue to detect as
    CL_TYPE_GRAPHICS because ClamAV does not yet have BMP or JPEG
    2000 format checking capabilities.
  * Fixed PNG parser logic bugs that caused an excess of parsing
    errors and fixed a stack exhaustion issue affecting some systems
    when scanning PNG files. PNG file type detection was disabled via
    signature database update for ClamAV version 0.103.0 to mitigate
    the effects from these bugs.
  * Fixed an issue where PNG and GIF files no longer work with
    Target:5 graphics signatures if detected as CL_TYPE_PNG/GIF rather
    than as CL_TYPE_GRAPHICS. Target types now support up to 10
    possible file types to make way for additional graphics types in
    future releases.
  * Fixed clamonacc's --fdpass option.
  - Interprocess file descriptor passing for clamonacc was broken
    since version 0.102.0 due to a bug introduced by the switch to
    curl for communicating with clamd. On Linux, passing file
    descriptors from one process to another is handled by the
    kernel, so we reverted clamonacc to use standard system calls
    for socket communication when fd passing is enabled.
  * Fixed a clamonacc stack corruption issue on some systems when
    using an older version of libcurl.
  * Allow clamscan and clamdscan scans to proceed even if the
    realpath lookup failed. This alleviates an issue on Windows
    scanning files hosted on file- systems that do not support the
    GetMappedFileNameW() API such as on ImDisk RAM-disks.
  * Fixed freshclam --on-update-execute=EXIT_1 temporary directory
    cleanup issue.
  * clamd's log output and VirusEvent now provide the scan target's
    file path instead of a file descriptor. The clamd socket API for
    submitting a scan by FD-passing doesn't include a file path, this
    feature works by looking up the file path by file descriptor.
    This feature works on Mac and Linux but is not yet implemented
    for other UNIX operating systems. FD-passing is not available for
    Windows.
  * Fixed an issue where freshclam database validation didn't work
    correctly when run in daemon mode on Linux/Unix.</changelog>
  <changelog author="suse+build@de-korte.org" date="1624276800">- bsc#1188284: Update to 0.103.3
  * Fixed a scan performance issue when ENGINE_OPTIONS_FORCE_TO_DISK is
    enabled. This issue did not impacted most users but for those
    affected it caused every scanned file to be copied to the temp
    directory before the scan.
  * Fix ClamDScan crashes when using the --fdpass --multiscan
    command-line options in combination with the ClamD ExcludePath
    config file options.
  * Fixed an issue where the mirrors.dat file is owned by root when
    starting as root (or with sudo) and using daemon-mode. File
    ownership will be set to the DatabaseOwner just before FreshClam
    switches to run as that user.
  * Renamed the mirrors.dat file to freshclam.dat.
  * Disabled the HTTPUserAgent config option if the DatabaseMirror uses
    clamav.net. This will prevent users from being inadvertently blocked
    and will ensure that we can keep better metrics on which ClamAV
    versions are being used.
  * Moved the detection for Heuristics.PNG.CVE-2010-1205 behind the
    ClamScan --alert-broken-media option (ClamD AlertBrokenMedia yes)
    option. This type of PNG issue appears to be common enough to be an
    annoyance, and the CVE is old enough that no one should be
    vulnerable at this point.
  * Fix ClamSubmit failures after changes to Cloudflare "__cfduid"
    cookies. See: https://blog.cloudflare.com/deprecating-cfduid-cookie/</changelog>
  <changelog author="meissner@suse.com" date="1625054400">- clamav-document-maxsize.patch: in the "clamscan" and "clamdscan" manpages,
  document that files over a certain size by default will silently not be
  scanned and how this can be adjusted (bsc#1187509)</changelog>
  <changelog author="max@suse.com" date="1636372800">- bsc#1192346: Update to 0.103.4
  * FreshClam:
  - Add a 24-hour cool-down for FreshClam clients that have received
    an HTTP 403 (Forbidden) response from the CDN. This is to reduce
    the volume of 403-response data served to blocked FreshClam
    clients that are configured with a tight update-loop.
  - Fixed a bug where FreshClam treats an empty CDIFF as an
    incremental update failure instead of as an intentional request
    to download the whole CVD.
  * ClamDScan: Fix a scan error when broken symlinks are encountered on
    macOS with "FollowDirectorySymlinks" and "FollowFileSymlinks"
    options disabled.
  * Overhauled the scan recursion / nested archive extraction logic and
    added new limits on embedded file-type recognition performed during
    the "raw" scan of each file. This limits embedded file-type
    misidentification and prevents detecting embedded file content that
    is found/extracted and scanned at other layers in the scanning
    process.
  * Fix an issue with the FMap module that failed to read from some
    nested files.
  * Fixed an issue where failing to load some rules from a Yara file
    containing multiple rules may cause a crash.
  * Fixed assorted compiler warnings.
  * Fixed assorted Coverity static code analysis issues.
  * Scan limits:
  - Added virus-name suffixes to the alerts that trigger when a scan
    limit has been exceeded. Rather than simply
    Heuristics.Limits.Exceeded, you may now see limit-specific
    virus-names, to include:
    + Heuristics.Limits.Exceeded.MaxFileSize
    + Heuristics.Limits.Exceeded.MaxScanSize
    + Heuristics.Limits.Exceeded.MaxFiles
    + Heuristics.Limits.Exceeded.MaxRecursion
    + Heuristics.Limits.Exceeded.MaxScanTime
  - Renamed the Heuristics.Email.ExceedsMax.* alerts to align with
    the other limit alerts names. These alerts include:
    + Heuristics.Limits.Exceeded.EmailLineFoldcnt
    + Heuristics.Limits.Exceeded.EmailHeaderBytes
    + Heuristics.Limits.Exceeded.EmailHeaders
    + Heuristics.Limits.Exceeded.EmailMIMEPartsPerMessage
    + Heuristics.Limits.Exceeded.EmailMIMEArguments
  - Fixed an issue where the Email-related scan limits would alert
    even when the "AlertExceedsMax" (--alert-exceeds-max) scan option
    is not enabled.
  - Fixes an issue in the Zip parser where exceeding the "MaxFiles"
    limit or the "MaxFileSize" limit would abort the scan but would
    fail to alert. The Zip scan limit issues were independently
    identified and reported by Aaron Leliaert and Max Allan.
  * Fixed a leak in the Email parser when using the --gen-json scan
    option.
  * Fixed an issue where a failure to record metadata in the Email
    parser when using the --gen-json scan option could cause the Email
    parser to abort the scan early and fail to extract and scan
    additional content.
  * Fixed a file name memory leak in the Zip parser.
  * Fixed an issue where certain signature patterns may cause a crash or
    cause unintended matches on some systems when converting characters
    to uppercase if a UTF-8 unicode single-byte grapheme becomes a
    multi-byte grapheme. Patch courtesy of Andrea De Pasquale.
- Fix unit test
  + clamav-ck_assert_msg.patch</changelog>
  <changelog author="max@suse.com" date="1642420800">- Update to 0.103.5
  * bsc#1194731, CVE-2022-20698:
    Fix for invalid pointer read that may cause a crash.
    This issue affects 0.104.1, 0.103.4 and prior when ClamAV is compiled
    with libjson-c and the CL_SCAN_GENERAL_COLLECT_METADATA scan option
    (the clamscan --gen-json option) is enabled.
  * Fixed ability to disable the file size limit with libclamav C API,
    like this:
    cl_engine_set_num(engine, CL_ENGINE_MAX_FILESIZE, 0);
    This issue didn't affect ClamD or ClamScan which also can disable the
    limit by setting it to zero using MaxFileSize 0 in clamd.conf for ClamD,
    or clamscan --max-filesize=0 for ClamScan.
    Note: Internally, the max file size is still set to 2 GiB. Disabling the
    limit for a scan will fall back on the internal 2 GiB limitation.
  * Increased the maximum line length for ClamAV config files from 512 bytes
    to 1,024 bytes to allow for longer config option strings.
  * SigTool: Fix insufficient buffer size for --list-sigs that caused a
    failure when listing a database containing one or more very long
    signatures. This fix was backported from 0.104.</changelog>
</package>
<package pkgid="2b7f7f8ec2044ae09b14b08e53562564f3b30a8f10c1911ea9a1d87861641b54" name="clamav" arch="x86_64">
  <version epoch="0" ver="0.103.5" rel="3.35.1"/>
  <changelog author="egdfree@opensuse.org" date="1553688000">- Update to version 0.101.2 (bsc#1130721)
  * CVE-2019-1787:
    An out-of-bounds heap read condition may occur when scanning PDF
    documents. The defect is a failure to correctly keep track of the number
    of bytes remaining in a buffer when indexing file data.
  * CVE-2019-1789:
    An out-of-bounds heap read condition may occur when scanning PE files
    (i.e. Windows EXE and DLL files) that have been packed using Aspack as a
    result of inadequate bound-checking.
  * CVE-2019-1788:
    An out-of-bounds heap write condition may occur when scanning OLE2 files
    such as Microsoft Office 97-2003 documents. The invalid write happens when
    an invalid pointer is mistakenly used to initialize a 32bit integer to
    zero. This is likely to crash the application.
  * CVE-2019-1786:
    An out-of-bounds heap read condition may occur when scanning malformed
    PDF documents as a result of improper bounds-checking.
  * CVE-2019-1785:
    A path-traversal write condition may occur as a result of improper
    input validation when scanning RAR archives.
  * CVE-2019-1798:
    A use-after-free condition may occur as a result of improper error
    handling when scanning nested RAR archives.
- added clamav-max_patch.patch to fix build
- dropped clamav-freshclam-exit.patch</changelog>
  <changelog author="max@suse.com" date="1565092800">- Update to version 0.101.3:
  * bsc#1144504: ZIP bomb causes extreme CPU spikes</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1567598400">- update to 0.101.4:
  * CVE-2019-12900: An out of bounds write in the NSIS bzip2
    (boo#1149458)
  * CVE-2019-12625: Introduce a configurable time limit to mitigate
    zip bomb vulnerability completely. Default is 2 minutes,
    configurable useing the clamscan --max-scantime and for clamd
    using the MaxScanTime config option (boo#1144504)</changelog>
  <changelog author="max@suse.com" date="1572004800">- bsc#1151839: Increase the startup timeout of clamd to 5 minutes
  to cater for the grown virus database as a workaround until
  clamd has learned to talk to systemd to extend the timeout as
  long as needed.</changelog>
  <changelog author="suse+build@de-korte.org" date="1572609600">- update to 0.102.0
  * The On-Access Scanning feature has been migrated out of clamd
    and into a brand new utility named clamonacc. This utility is
    similar to clamdscan and clamav-milter in that it acts as a
    client to clamd. This separation from clamd means that clamd no
    longer needs to run with root privileges while scanning potentially
    malicious files. Instead, clamd may drop privileges to run under an
    account that does not have super-user. In addition to improving the
    security posture of running clamd with On-Access enabled, this
    update fixed a few outstanding defects:
  - On-Access scanning for created and moved files (Extra-Scanning)
    is fixed.
  - VirusEvent for On-Access scans is fixed.
  - With clamonacc, it is now possible to copy, move, or remove a
    file if the scan triggered an alert, just like with clamdscan.
  * The freshclam database update utility has undergone a significant
    update. This includes:
  - Added support for HTTPS.
  - Support for database mirrors hosted on ports other than 80.
  - Removal of the mirror management feature (mirrors.dat).
  - An all new libfreshclam library API.
- created new subpackage libfreshclam2
- dropped clamav-max_patch.patch (upstreamed)
- added clamav-fix_building_milter.patch to fix build of milter</changelog>
  <changelog author="suse+build@de-korte.org" date="1574251200">- update to 0.102.1
  * CVE-2019-15961, bsc#1157763: A Denial-of-Service (DoS)
    vulnerability may occur when scanning a specially crafted email
    file as a result of excessively long scan times. The issue is
    resolved by implementing several maximums in parsing MIME
    messages and by optimizing use of memory allocation.
  * Build system fixes to build clamav-milter, to correctly link
    with libxml2 when detected, and to correctly detect fanotify
    for on-access scanning feature support.
  * Signature load time is significantly reduced by changing to a
    more efficient algorithm for loading signature patterns and
    allocating the AC trie. Patch courtesy of Alberto Wu.
  * Introduced a new configure option to statically link libjson-c
    with libclamav. Static linking with libjson is highly
    recommended to prevent crashes in applications that use
    libclamav alongside another JSON parsing library.
  * Null-dereference fix in email parser when using the
  - -gen-json metadata option.
  * Fixes for Authenticode parsing and certificate signature
    (.crb database) bugs.
- dropped clamav-fix_building_milter.patch (upstreamed)</changelog>
  <changelog author="dimstar@opensuse.org" date="1576756800">- BuildRequire pkgconfig(libsystemd) instead of systemd-devel:
  Allow OBS to shortcut through the -mini flavors.</changelog>
  <changelog author="suse+build@de-korte.org" date="1577188800">- The freshclam.service should not be started before the network is
  online (it checks for updates immediately upon service start)</changelog>
  <changelog author="suse+build@de-korte.org" date="1580904000">- update to 0.102.2
  * CVE-2020-3123: A denial-of-service (DoS) condition may occur when
    using the optional credit card data-loss-prevention (DLP) feature.
    Improper bounds checking of an unsigned variable resulted in an
    out-of-bounds read, which causes a crash.
  * Significantly improved the scan speed of PDF files on Windows.
  * Re-applied a fix to alleviate file access issues when scanning RAR
    files in downstream projects that use libclamav where the scanning
    engine is operating in a low-privilege process. This bug was originally
    fixed in 0.101.2 and the fix was mistakenly omitted from 0.102.0.
  * Fixed an issue where freshclam failed to update if the database version
    downloaded is one version older than advertised. This situation may
    occur after a new database version is published. The issue affected
    users downloading the whole CVD database file.
  * Changed the default freshclam ReceiveTimeout setting to 0 (infinite).
    The ReceiveTimeout had caused needless database update failures for
    users with slower internet connections.
  * Correctly display the number of kilobytes (KiB) in progress bar and
    reduced the size of the progress bar to accommodate 80-character width
    terminals.
  * Fixed an issue where running freshclam manually causes a daemonized
    freshclam process to fail when it updates because the manual instance
    deletes the temporary download directory. The freshclam temporary files
    will now download to a unique directory created at the time of an update
    instead of using a hardcoded directory created/destroyed at the program
    start/exit.
  * Fix for freshclam's OnOutdatedExecute config option.
  * Fixes a memory leak in the error condition handling for the email
    parser.
  * Improved bound checking and error handling in ARJ archive parser.
  * Improved error handling in PDF parser.
  * Fix for memory leak in byte-compare signature handler.</changelog>
  <changelog author="mpluskal@suse.com" date="1585742400">- Drop python build dependency as it is not needed</changelog>
  <changelog author="suse+build@de-korte.org" date="1589284800">- Update to 0.102.3
  * CVE-2020-3327: Fix a vulnerability in the ARJ archive parsing
    module in ClamAV 0.102.2 that could cause a Denial-of-Service (DoS)
    condition. Improper bounds checking of an unsigned variable results
    in an out-of-bounds read which causes a crash.
  * CVE-2020-3341: Fix a vulnerability in the PDF parsing module in
    ClamAV 0.101 - 0.102.2 that could cause a Denial-of-Service (DoS)
    condition. Improper size checking of a buffer used to initialize AES
    decryption routines results in an out-of-bounds read which may cause
    a crash.
  * Fix "Attempt to allocate 0 bytes" error when parsing some PDF
    documents.
  * Fix a couple of minor memory leaks.
  * Updated libclamunrar to UnRAR 5.9.2.</changelog>
  <changelog author="suse+build@de-korte.org" date="1594900800">- Update to 0.102.4
  * CVE-2020-3350: Fix a vulnerability wherein a malicious user could
    replace a scan target's directory with a symlink to another path
    to trick clamscan, clamdscan, or clamonacc into removing or moving
    a different file (eg. a critical system file). The issue would
    affect users that use the --move or --remove options for clamscan,
    clamdscan, and clamonacc.
  * CVE-2020-3327: Fix a vulnerability in the ARJ archive parsing
    module in ClamAV 0.102.3 that could cause a Denial-of-Service
    (DoS) condition. Improper bounds checking results in an
    out-of-bounds read which could cause a crash. The previous fix for
    this CVE in 0.102.3 was incomplete. This fix correctly resolves
    the issue.
  * CVE-2020-3481: Fix a vulnerability in the EGG archive module in
    ClamAV 0.102.0 - 0.102.3 could cause a Denial-of-Service (DoS)
    condition. Improper error handling may result in a crash due to a
    NULL pointer dereference. This vulnerability is mitigated for
    those using the official ClamAV signature databases because the
    file type signatures in daily.cvd will not enable the EGG archive
    parser in versions affected by the vulnerability.</changelog>
  <changelog author="suse+build@de-korte.org" date="1600084800">- Update to 0.103.0
  * clamd can now reload the signature database without blocking
    scanning. This multi-threaded database reload improvement was made
    possible thanks to a community effort.
  - Non-blocking database reloads are now the default behavior. Some
    systems that are more constrained on RAM may need to disable
    non-blocking reloads as it will temporarily consume two times as
    much memory. We added a new clamd config option
    ConcurrentDatabaseReload, which may be set to no.
  * Dropped clamav-str-h.patch (no longer needed)
  * Fix clamav-milter.service (requires clamd.service to run)</changelog>
  <changelog author="max@suse.com" date="1605009600">- Sync Factory to SLE-15 to implement jsc#ECO-3010 and bsc#1118459.
- bsc#1119353, clamav-fips.patch: Fix freshclam crash in FIPS mode.
- Keep OBS from installing an existing clamav instance to scan the
  sources, because this makes "make check" use the old library
  instead of the just built one. This is only a workaround until
  we found a way to keep libtool from adding libdir to rpath and
  LD_LIBRARY_PATH of the binaries in the testsuite.</changelog>
  <changelog author="dimstar@opensuse.org" date="1605182400">- Do not hard-depend on systemd: use systemd_ordering instead of
  systemd_requires.</changelog>
  <changelog author="max@suse.com" date="1617969600">- Update clamav.keyring
- Update to 0.103.2
  * CVE-2021-1252, bsc#1184532: Fix for Excel XLM parser infinite
    loop. Affects 0.103.0 and 0.103.1 only.
  * CVE-2021-1404, bsc#1184533: Fix for PDF parser buffer over-read;
    possible crash. Affects 0.103.0 and 0.103.1 only.
  * CVE-2021-1405, bsc#1184534: Fix for mail parser
    NULL-dereference crash. Affects 0.103.1 and prior.
  * Fix possible memory leak in PNG parser.
  * Fix ClamOnAcc scan on file-creation race condition so files are
    scanned after their contents are written.
  * FreshClam: Deprecate the SafeBrowsing config option. The
    SafeBrowsing option will no longer do anything.
  * For more details, see our blog post from last year about the
    future of the ClamAV Safe Browsing database.
  * FreshClam: Improved HTTP 304, 403, &amp; 429 handling.
  * FreshClam: Added back the mirrors.dat file to the database directory.
  * FreshClam will now exit with a failure in daemon mode if an HTTP 403
    (Forbidden) was received, because retrying later won't help any. The
    FreshClam user will have to take actions to get unblocked.
  * Fix the FreshClam mirror-sync issue where a downloaded database is
    "older than the version advertised."
  * bsc#1181256: Fix errors when scanning files &gt; 4G
  * obsoletes clamav-disable-timestamps.patch
- Update to 0.103.1
  * Added a new scan option to alert on broken media (graphics) file
    formats. This feature mitigates the risk of malformed media files
    intended to exploit vulnerabilities in other software. At present
    media validation exists for JPEG, TIFF, PNG, and GIF files. To
    enable this feature, set AlertBrokenMedia yes in clamd.conf, or
    use the --alert-broken-media option when using clamscan. These
    options are disabled by default in this patch release, but may be
    enabled in a subsequent release. Application developers may enable
    this scan option by enabling CL_SCAN_HEURISTIC_BROKEN_MEDIA for
    the heuristic scan option bit field.
  * Added CL_TYPE_TIFF, CL_TYPE_JPEG types to match GIF, PNG typing
    behavior. BMP and JPEG 2000 files will continue to detect as
    CL_TYPE_GRAPHICS because ClamAV does not yet have BMP or JPEG
    2000 format checking capabilities.
  * Fixed PNG parser logic bugs that caused an excess of parsing
    errors and fixed a stack exhaustion issue affecting some systems
    when scanning PNG files. PNG file type detection was disabled via
    signature database update for ClamAV version 0.103.0 to mitigate
    the effects from these bugs.
  * Fixed an issue where PNG and GIF files no longer work with
    Target:5 graphics signatures if detected as CL_TYPE_PNG/GIF rather
    than as CL_TYPE_GRAPHICS. Target types now support up to 10
    possible file types to make way for additional graphics types in
    future releases.
  * Fixed clamonacc's --fdpass option.
  - Interprocess file descriptor passing for clamonacc was broken
    since version 0.102.0 due to a bug introduced by the switch to
    curl for communicating with clamd. On Linux, passing file
    descriptors from one process to another is handled by the
    kernel, so we reverted clamonacc to use standard system calls
    for socket communication when fd passing is enabled.
  * Fixed a clamonacc stack corruption issue on some systems when
    using an older version of libcurl.
  * Allow clamscan and clamdscan scans to proceed even if the
    realpath lookup failed. This alleviates an issue on Windows
    scanning files hosted on file- systems that do not support the
    GetMappedFileNameW() API such as on ImDisk RAM-disks.
  * Fixed freshclam --on-update-execute=EXIT_1 temporary directory
    cleanup issue.
  * clamd's log output and VirusEvent now provide the scan target's
    file path instead of a file descriptor. The clamd socket API for
    submitting a scan by FD-passing doesn't include a file path, this
    feature works by looking up the file path by file descriptor.
    This feature works on Mac and Linux but is not yet implemented
    for other UNIX operating systems. FD-passing is not available for
    Windows.
  * Fixed an issue where freshclam database validation didn't work
    correctly when run in daemon mode on Linux/Unix.</changelog>
  <changelog author="suse+build@de-korte.org" date="1624276800">- bsc#1188284: Update to 0.103.3
  * Fixed a scan performance issue when ENGINE_OPTIONS_FORCE_TO_DISK is
    enabled. This issue did not impacted most users but for those
    affected it caused every scanned file to be copied to the temp
    directory before the scan.
  * Fix ClamDScan crashes when using the --fdpass --multiscan
    command-line options in combination with the ClamD ExcludePath
    config file options.
  * Fixed an issue where the mirrors.dat file is owned by root when
    starting as root (or with sudo) and using daemon-mode. File
    ownership will be set to the DatabaseOwner just before FreshClam
    switches to run as that user.
  * Renamed the mirrors.dat file to freshclam.dat.
  * Disabled the HTTPUserAgent config option if the DatabaseMirror uses
    clamav.net. This will prevent users from being inadvertently blocked
    and will ensure that we can keep better metrics on which ClamAV
    versions are being used.
  * Moved the detection for Heuristics.PNG.CVE-2010-1205 behind the
    ClamScan --alert-broken-media option (ClamD AlertBrokenMedia yes)
    option. This type of PNG issue appears to be common enough to be an
    annoyance, and the CVE is old enough that no one should be
    vulnerable at this point.
  * Fix ClamSubmit failures after changes to Cloudflare "__cfduid"
    cookies. See: https://blog.cloudflare.com/deprecating-cfduid-cookie/</changelog>
  <changelog author="meissner@suse.com" date="1625054400">- clamav-document-maxsize.patch: in the "clamscan" and "clamdscan" manpages,
  document that files over a certain size by default will silently not be
  scanned and how this can be adjusted (bsc#1187509)</changelog>
  <changelog author="max@suse.com" date="1636372800">- bsc#1192346: Update to 0.103.4
  * FreshClam:
  - Add a 24-hour cool-down for FreshClam clients that have received
    an HTTP 403 (Forbidden) response from the CDN. This is to reduce
    the volume of 403-response data served to blocked FreshClam
    clients that are configured with a tight update-loop.
  - Fixed a bug where FreshClam treats an empty CDIFF as an
    incremental update failure instead of as an intentional request
    to download the whole CVD.
  * ClamDScan: Fix a scan error when broken symlinks are encountered on
    macOS with "FollowDirectorySymlinks" and "FollowFileSymlinks"
    options disabled.
  * Overhauled the scan recursion / nested archive extraction logic and
    added new limits on embedded file-type recognition performed during
    the "raw" scan of each file. This limits embedded file-type
    misidentification and prevents detecting embedded file content that
    is found/extracted and scanned at other layers in the scanning
    process.
  * Fix an issue with the FMap module that failed to read from some
    nested files.
  * Fixed an issue where failing to load some rules from a Yara file
    containing multiple rules may cause a crash.
  * Fixed assorted compiler warnings.
  * Fixed assorted Coverity static code analysis issues.
  * Scan limits:
  - Added virus-name suffixes to the alerts that trigger when a scan
    limit has been exceeded. Rather than simply
    Heuristics.Limits.Exceeded, you may now see limit-specific
    virus-names, to include:
    + Heuristics.Limits.Exceeded.MaxFileSize
    + Heuristics.Limits.Exceeded.MaxScanSize
    + Heuristics.Limits.Exceeded.MaxFiles
    + Heuristics.Limits.Exceeded.MaxRecursion
    + Heuristics.Limits.Exceeded.MaxScanTime
  - Renamed the Heuristics.Email.ExceedsMax.* alerts to align with
    the other limit alerts names. These alerts include:
    + Heuristics.Limits.Exceeded.EmailLineFoldcnt
    + Heuristics.Limits.Exceeded.EmailHeaderBytes
    + Heuristics.Limits.Exceeded.EmailHeaders
    + Heuristics.Limits.Exceeded.EmailMIMEPartsPerMessage
    + Heuristics.Limits.Exceeded.EmailMIMEArguments
  - Fixed an issue where the Email-related scan limits would alert
    even when the "AlertExceedsMax" (--alert-exceeds-max) scan option
    is not enabled.
  - Fixes an issue in the Zip parser where exceeding the "MaxFiles"
    limit or the "MaxFileSize" limit would abort the scan but would
    fail to alert. The Zip scan limit issues were independently
    identified and reported by Aaron Leliaert and Max Allan.
  * Fixed a leak in the Email parser when using the --gen-json scan
    option.
  * Fixed an issue where a failure to record metadata in the Email
    parser when using the --gen-json scan option could cause the Email
    parser to abort the scan early and fail to extract and scan
    additional content.
  * Fixed a file name memory leak in the Zip parser.
  * Fixed an issue where certain signature patterns may cause a crash or
    cause unintended matches on some systems when converting characters
    to uppercase if a UTF-8 unicode single-byte grapheme becomes a
    multi-byte grapheme. Patch courtesy of Andrea De Pasquale.
- Fix unit test
  + clamav-ck_assert_msg.patch</changelog>
  <changelog author="max@suse.com" date="1642420800">- Update to 0.103.5
  * bsc#1194731, CVE-2022-20698:
    Fix for invalid pointer read that may cause a crash.
    This issue affects 0.104.1, 0.103.4 and prior when ClamAV is compiled
    with libjson-c and the CL_SCAN_GENERAL_COLLECT_METADATA scan option
    (the clamscan --gen-json option) is enabled.
  * Fixed ability to disable the file size limit with libclamav C API,
    like this:
    cl_engine_set_num(engine, CL_ENGINE_MAX_FILESIZE, 0);
    This issue didn't affect ClamD or ClamScan which also can disable the
    limit by setting it to zero using MaxFileSize 0 in clamd.conf for ClamD,
    or clamscan --max-filesize=0 for ClamScan.
    Note: Internally, the max file size is still set to 2 GiB. Disabling the
    limit for a scan will fall back on the internal 2 GiB limitation.
  * Increased the maximum line length for ClamAV config files from 512 bytes
    to 1,024 bytes to allow for longer config option strings.
  * SigTool: Fix insufficient buffer size for --list-sigs that caused a
    failure when listing a database containing one or more very long
    signatures. This fix was backported from 0.104.</changelog>
</package>
<package pkgid="bc86d29d760a16a229323530dc2a458dadd64d02fd8b20628515645b0b4deb6a" name="clamav-devel" arch="aarch64">
  <version epoch="0" ver="0.103.5" rel="3.35.1"/>
  <changelog author="egdfree@opensuse.org" date="1553688000">- Update to version 0.101.2 (bsc#1130721)
  * CVE-2019-1787:
    An out-of-bounds heap read condition may occur when scanning PDF
    documents. The defect is a failure to correctly keep track of the number
    of bytes remaining in a buffer when indexing file data.
  * CVE-2019-1789:
    An out-of-bounds heap read condition may occur when scanning PE files
    (i.e. Windows EXE and DLL files) that have been packed using Aspack as a
    result of inadequate bound-checking.
  * CVE-2019-1788:
    An out-of-bounds heap write condition may occur when scanning OLE2 files
    such as Microsoft Office 97-2003 documents. The invalid write happens when
    an invalid pointer is mistakenly used to initialize a 32bit integer to
    zero. This is likely to crash the application.
  * CVE-2019-1786:
    An out-of-bounds heap read condition may occur when scanning malformed
    PDF documents as a result of improper bounds-checking.
  * CVE-2019-1785:
    A path-traversal write condition may occur as a result of improper
    input validation when scanning RAR archives.
  * CVE-2019-1798:
    A use-after-free condition may occur as a result of improper error
    handling when scanning nested RAR archives.
- added clamav-max_patch.patch to fix build
- dropped clamav-freshclam-exit.patch</changelog>
  <changelog author="max@suse.com" date="1565092800">- Update to version 0.101.3:
  * bsc#1144504: ZIP bomb causes extreme CPU spikes</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1567598400">- update to 0.101.4:
  * CVE-2019-12900: An out of bounds write in the NSIS bzip2
    (boo#1149458)
  * CVE-2019-12625: Introduce a configurable time limit to mitigate
    zip bomb vulnerability completely. Default is 2 minutes,
    configurable useing the clamscan --max-scantime and for clamd
    using the MaxScanTime config option (boo#1144504)</changelog>
  <changelog author="max@suse.com" date="1572004800">- bsc#1151839: Increase the startup timeout of clamd to 5 minutes
  to cater for the grown virus database as a workaround until
  clamd has learned to talk to systemd to extend the timeout as
  long as needed.</changelog>
  <changelog author="suse+build@de-korte.org" date="1572609600">- update to 0.102.0
  * The On-Access Scanning feature has been migrated out of clamd
    and into a brand new utility named clamonacc. This utility is
    similar to clamdscan and clamav-milter in that it acts as a
    client to clamd. This separation from clamd means that clamd no
    longer needs to run with root privileges while scanning potentially
    malicious files. Instead, clamd may drop privileges to run under an
    account that does not have super-user. In addition to improving the
    security posture of running clamd with On-Access enabled, this
    update fixed a few outstanding defects:
  - On-Access scanning for created and moved files (Extra-Scanning)
    is fixed.
  - VirusEvent for On-Access scans is fixed.
  - With clamonacc, it is now possible to copy, move, or remove a
    file if the scan triggered an alert, just like with clamdscan.
  * The freshclam database update utility has undergone a significant
    update. This includes:
  - Added support for HTTPS.
  - Support for database mirrors hosted on ports other than 80.
  - Removal of the mirror management feature (mirrors.dat).
  - An all new libfreshclam library API.
- created new subpackage libfreshclam2
- dropped clamav-max_patch.patch (upstreamed)
- added clamav-fix_building_milter.patch to fix build of milter</changelog>
  <changelog author="suse+build@de-korte.org" date="1574251200">- update to 0.102.1
  * CVE-2019-15961, bsc#1157763: A Denial-of-Service (DoS)
    vulnerability may occur when scanning a specially crafted email
    file as a result of excessively long scan times. The issue is
    resolved by implementing several maximums in parsing MIME
    messages and by optimizing use of memory allocation.
  * Build system fixes to build clamav-milter, to correctly link
    with libxml2 when detected, and to correctly detect fanotify
    for on-access scanning feature support.
  * Signature load time is significantly reduced by changing to a
    more efficient algorithm for loading signature patterns and
    allocating the AC trie. Patch courtesy of Alberto Wu.
  * Introduced a new configure option to statically link libjson-c
    with libclamav. Static linking with libjson is highly
    recommended to prevent crashes in applications that use
    libclamav alongside another JSON parsing library.
  * Null-dereference fix in email parser when using the
  - -gen-json metadata option.
  * Fixes for Authenticode parsing and certificate signature
    (.crb database) bugs.
- dropped clamav-fix_building_milter.patch (upstreamed)</changelog>
  <changelog author="dimstar@opensuse.org" date="1576756800">- BuildRequire pkgconfig(libsystemd) instead of systemd-devel:
  Allow OBS to shortcut through the -mini flavors.</changelog>
  <changelog author="suse+build@de-korte.org" date="1577188800">- The freshclam.service should not be started before the network is
  online (it checks for updates immediately upon service start)</changelog>
  <changelog author="suse+build@de-korte.org" date="1580904000">- update to 0.102.2
  * CVE-2020-3123: A denial-of-service (DoS) condition may occur when
    using the optional credit card data-loss-prevention (DLP) feature.
    Improper bounds checking of an unsigned variable resulted in an
    out-of-bounds read, which causes a crash.
  * Significantly improved the scan speed of PDF files on Windows.
  * Re-applied a fix to alleviate file access issues when scanning RAR
    files in downstream projects that use libclamav where the scanning
    engine is operating in a low-privilege process. This bug was originally
    fixed in 0.101.2 and the fix was mistakenly omitted from 0.102.0.
  * Fixed an issue where freshclam failed to update if the database version
    downloaded is one version older than advertised. This situation may
    occur after a new database version is published. The issue affected
    users downloading the whole CVD database file.
  * Changed the default freshclam ReceiveTimeout setting to 0 (infinite).
    The ReceiveTimeout had caused needless database update failures for
    users with slower internet connections.
  * Correctly display the number of kilobytes (KiB) in progress bar and
    reduced the size of the progress bar to accommodate 80-character width
    terminals.
  * Fixed an issue where running freshclam manually causes a daemonized
    freshclam process to fail when it updates because the manual instance
    deletes the temporary download directory. The freshclam temporary files
    will now download to a unique directory created at the time of an update
    instead of using a hardcoded directory created/destroyed at the program
    start/exit.
  * Fix for freshclam's OnOutdatedExecute config option.
  * Fixes a memory leak in the error condition handling for the email
    parser.
  * Improved bound checking and error handling in ARJ archive parser.
  * Improved error handling in PDF parser.
  * Fix for memory leak in byte-compare signature handler.</changelog>
  <changelog author="mpluskal@suse.com" date="1585742400">- Drop python build dependency as it is not needed</changelog>
  <changelog author="suse+build@de-korte.org" date="1589284800">- Update to 0.102.3
  * CVE-2020-3327: Fix a vulnerability in the ARJ archive parsing
    module in ClamAV 0.102.2 that could cause a Denial-of-Service (DoS)
    condition. Improper bounds checking of an unsigned variable results
    in an out-of-bounds read which causes a crash.
  * CVE-2020-3341: Fix a vulnerability in the PDF parsing module in
    ClamAV 0.101 - 0.102.2 that could cause a Denial-of-Service (DoS)
    condition. Improper size checking of a buffer used to initialize AES
    decryption routines results in an out-of-bounds read which may cause
    a crash.
  * Fix "Attempt to allocate 0 bytes" error when parsing some PDF
    documents.
  * Fix a couple of minor memory leaks.
  * Updated libclamunrar to UnRAR 5.9.2.</changelog>
  <changelog author="suse+build@de-korte.org" date="1594900800">- Update to 0.102.4
  * CVE-2020-3350: Fix a vulnerability wherein a malicious user could
    replace a scan target's directory with a symlink to another path
    to trick clamscan, clamdscan, or clamonacc into removing or moving
    a different file (eg. a critical system file). The issue would
    affect users that use the --move or --remove options for clamscan,
    clamdscan, and clamonacc.
  * CVE-2020-3327: Fix a vulnerability in the ARJ archive parsing
    module in ClamAV 0.102.3 that could cause a Denial-of-Service
    (DoS) condition. Improper bounds checking results in an
    out-of-bounds read which could cause a crash. The previous fix for
    this CVE in 0.102.3 was incomplete. This fix correctly resolves
    the issue.
  * CVE-2020-3481: Fix a vulnerability in the EGG archive module in
    ClamAV 0.102.0 - 0.102.3 could cause a Denial-of-Service (DoS)
    condition. Improper error handling may result in a crash due to a
    NULL pointer dereference. This vulnerability is mitigated for
    those using the official ClamAV signature databases because the
    file type signatures in daily.cvd will not enable the EGG archive
    parser in versions affected by the vulnerability.</changelog>
  <changelog author="suse+build@de-korte.org" date="1600084800">- Update to 0.103.0
  * clamd can now reload the signature database without blocking
    scanning. This multi-threaded database reload improvement was made
    possible thanks to a community effort.
  - Non-blocking database reloads are now the default behavior. Some
    systems that are more constrained on RAM may need to disable
    non-blocking reloads as it will temporarily consume two times as
    much memory. We added a new clamd config option
    ConcurrentDatabaseReload, which may be set to no.
  * Dropped clamav-str-h.patch (no longer needed)
  * Fix clamav-milter.service (requires clamd.service to run)</changelog>
  <changelog author="max@suse.com" date="1605009600">- Sync Factory to SLE-15 to implement jsc#ECO-3010 and bsc#1118459.
- bsc#1119353, clamav-fips.patch: Fix freshclam crash in FIPS mode.
- Keep OBS from installing an existing clamav instance to scan the
  sources, because this makes "make check" use the old library
  instead of the just built one. This is only a workaround until
  we found a way to keep libtool from adding libdir to rpath and
  LD_LIBRARY_PATH of the binaries in the testsuite.</changelog>
  <changelog author="dimstar@opensuse.org" date="1605182400">- Do not hard-depend on systemd: use systemd_ordering instead of
  systemd_requires.</changelog>
  <changelog author="max@suse.com" date="1617969600">- Update clamav.keyring
- Update to 0.103.2
  * CVE-2021-1252, bsc#1184532: Fix for Excel XLM parser infinite
    loop. Affects 0.103.0 and 0.103.1 only.
  * CVE-2021-1404, bsc#1184533: Fix for PDF parser buffer over-read;
    possible crash. Affects 0.103.0 and 0.103.1 only.
  * CVE-2021-1405, bsc#1184534: Fix for mail parser
    NULL-dereference crash. Affects 0.103.1 and prior.
  * Fix possible memory leak in PNG parser.
  * Fix ClamOnAcc scan on file-creation race condition so files are
    scanned after their contents are written.
  * FreshClam: Deprecate the SafeBrowsing config option. The
    SafeBrowsing option will no longer do anything.
  * For more details, see our blog post from last year about the
    future of the ClamAV Safe Browsing database.
  * FreshClam: Improved HTTP 304, 403, &amp; 429 handling.
  * FreshClam: Added back the mirrors.dat file to the database directory.
  * FreshClam will now exit with a failure in daemon mode if an HTTP 403
    (Forbidden) was received, because retrying later won't help any. The
    FreshClam user will have to take actions to get unblocked.
  * Fix the FreshClam mirror-sync issue where a downloaded database is
    "older than the version advertised."
  * bsc#1181256: Fix errors when scanning files &gt; 4G
  * obsoletes clamav-disable-timestamps.patch
- Update to 0.103.1
  * Added a new scan option to alert on broken media (graphics) file
    formats. This feature mitigates the risk of malformed media files
    intended to exploit vulnerabilities in other software. At present
    media validation exists for JPEG, TIFF, PNG, and GIF files. To
    enable this feature, set AlertBrokenMedia yes in clamd.conf, or
    use the --alert-broken-media option when using clamscan. These
    options are disabled by default in this patch release, but may be
    enabled in a subsequent release. Application developers may enable
    this scan option by enabling CL_SCAN_HEURISTIC_BROKEN_MEDIA for
    the heuristic scan option bit field.
  * Added CL_TYPE_TIFF, CL_TYPE_JPEG types to match GIF, PNG typing
    behavior. BMP and JPEG 2000 files will continue to detect as
    CL_TYPE_GRAPHICS because ClamAV does not yet have BMP or JPEG
    2000 format checking capabilities.
  * Fixed PNG parser logic bugs that caused an excess of parsing
    errors and fixed a stack exhaustion issue affecting some systems
    when scanning PNG files. PNG file type detection was disabled via
    signature database update for ClamAV version 0.103.0 to mitigate
    the effects from these bugs.
  * Fixed an issue where PNG and GIF files no longer work with
    Target:5 graphics signatures if detected as CL_TYPE_PNG/GIF rather
    than as CL_TYPE_GRAPHICS. Target types now support up to 10
    possible file types to make way for additional graphics types in
    future releases.
  * Fixed clamonacc's --fdpass option.
  - Interprocess file descriptor passing for clamonacc was broken
    since version 0.102.0 due to a bug introduced by the switch to
    curl for communicating with clamd. On Linux, passing file
    descriptors from one process to another is handled by the
    kernel, so we reverted clamonacc to use standard system calls
    for socket communication when fd passing is enabled.
  * Fixed a clamonacc stack corruption issue on some systems when
    using an older version of libcurl.
  * Allow clamscan and clamdscan scans to proceed even if the
    realpath lookup failed. This alleviates an issue on Windows
    scanning files hosted on file- systems that do not support the
    GetMappedFileNameW() API such as on ImDisk RAM-disks.
  * Fixed freshclam --on-update-execute=EXIT_1 temporary directory
    cleanup issue.
  * clamd's log output and VirusEvent now provide the scan target's
    file path instead of a file descriptor. The clamd socket API for
    submitting a scan by FD-passing doesn't include a file path, this
    feature works by looking up the file path by file descriptor.
    This feature works on Mac and Linux but is not yet implemented
    for other UNIX operating systems. FD-passing is not available for
    Windows.
  * Fixed an issue where freshclam database validation didn't work
    correctly when run in daemon mode on Linux/Unix.</changelog>
  <changelog author="suse+build@de-korte.org" date="1624276800">- bsc#1188284: Update to 0.103.3
  * Fixed a scan performance issue when ENGINE_OPTIONS_FORCE_TO_DISK is
    enabled. This issue did not impacted most users but for those
    affected it caused every scanned file to be copied to the temp
    directory before the scan.
  * Fix ClamDScan crashes when using the --fdpass --multiscan
    command-line options in combination with the ClamD ExcludePath
    config file options.
  * Fixed an issue where the mirrors.dat file is owned by root when
    starting as root (or with sudo) and using daemon-mode. File
    ownership will be set to the DatabaseOwner just before FreshClam
    switches to run as that user.
  * Renamed the mirrors.dat file to freshclam.dat.
  * Disabled the HTTPUserAgent config option if the DatabaseMirror uses
    clamav.net. This will prevent users from being inadvertently blocked
    and will ensure that we can keep better metrics on which ClamAV
    versions are being used.
  * Moved the detection for Heuristics.PNG.CVE-2010-1205 behind the
    ClamScan --alert-broken-media option (ClamD AlertBrokenMedia yes)
    option. This type of PNG issue appears to be common enough to be an
    annoyance, and the CVE is old enough that no one should be
    vulnerable at this point.
  * Fix ClamSubmit failures after changes to Cloudflare "__cfduid"
    cookies. See: https://blog.cloudflare.com/deprecating-cfduid-cookie/</changelog>
  <changelog author="meissner@suse.com" date="1625054400">- clamav-document-maxsize.patch: in the "clamscan" and "clamdscan" manpages,
  document that files over a certain size by default will silently not be
  scanned and how this can be adjusted (bsc#1187509)</changelog>
  <changelog author="max@suse.com" date="1636372800">- bsc#1192346: Update to 0.103.4
  * FreshClam:
  - Add a 24-hour cool-down for FreshClam clients that have received
    an HTTP 403 (Forbidden) response from the CDN. This is to reduce
    the volume of 403-response data served to blocked FreshClam
    clients that are configured with a tight update-loop.
  - Fixed a bug where FreshClam treats an empty CDIFF as an
    incremental update failure instead of as an intentional request
    to download the whole CVD.
  * ClamDScan: Fix a scan error when broken symlinks are encountered on
    macOS with "FollowDirectorySymlinks" and "FollowFileSymlinks"
    options disabled.
  * Overhauled the scan recursion / nested archive extraction logic and
    added new limits on embedded file-type recognition performed during
    the "raw" scan of each file. This limits embedded file-type
    misidentification and prevents detecting embedded file content that
    is found/extracted and scanned at other layers in the scanning
    process.
  * Fix an issue with the FMap module that failed to read from some
    nested files.
  * Fixed an issue where failing to load some rules from a Yara file
    containing multiple rules may cause a crash.
  * Fixed assorted compiler warnings.
  * Fixed assorted Coverity static code analysis issues.
  * Scan limits:
  - Added virus-name suffixes to the alerts that trigger when a scan
    limit has been exceeded. Rather than simply
    Heuristics.Limits.Exceeded, you may now see limit-specific
    virus-names, to include:
    + Heuristics.Limits.Exceeded.MaxFileSize
    + Heuristics.Limits.Exceeded.MaxScanSize
    + Heuristics.Limits.Exceeded.MaxFiles
    + Heuristics.Limits.Exceeded.MaxRecursion
    + Heuristics.Limits.Exceeded.MaxScanTime
  - Renamed the Heuristics.Email.ExceedsMax.* alerts to align with
    the other limit alerts names. These alerts include:
    + Heuristics.Limits.Exceeded.EmailLineFoldcnt
    + Heuristics.Limits.Exceeded.EmailHeaderBytes
    + Heuristics.Limits.Exceeded.EmailHeaders
    + Heuristics.Limits.Exceeded.EmailMIMEPartsPerMessage
    + Heuristics.Limits.Exceeded.EmailMIMEArguments
  - Fixed an issue where the Email-related scan limits would alert
    even when the "AlertExceedsMax" (--alert-exceeds-max) scan option
    is not enabled.
  - Fixes an issue in the Zip parser where exceeding the "MaxFiles"
    limit or the "MaxFileSize" limit would abort the scan but would
    fail to alert. The Zip scan limit issues were independently
    identified and reported by Aaron Leliaert and Max Allan.
  * Fixed a leak in the Email parser when using the --gen-json scan
    option.
  * Fixed an issue where a failure to record metadata in the Email
    parser when using the --gen-json scan option could cause the Email
    parser to abort the scan early and fail to extract and scan
    additional content.
  * Fixed a file name memory leak in the Zip parser.
  * Fixed an issue where certain signature patterns may cause a crash or
    cause unintended matches on some systems when converting characters
    to uppercase if a UTF-8 unicode single-byte grapheme becomes a
    multi-byte grapheme. Patch courtesy of Andrea De Pasquale.
- Fix unit test
  + clamav-ck_assert_msg.patch</changelog>
  <changelog author="max@suse.com" date="1642420800">- Update to 0.103.5
  * bsc#1194731, CVE-2022-20698:
    Fix for invalid pointer read that may cause a crash.
    This issue affects 0.104.1, 0.103.4 and prior when ClamAV is compiled
    with libjson-c and the CL_SCAN_GENERAL_COLLECT_METADATA scan option
    (the clamscan --gen-json option) is enabled.
  * Fixed ability to disable the file size limit with libclamav C API,
    like this:
    cl_engine_set_num(engine, CL_ENGINE_MAX_FILESIZE, 0);
    This issue didn't affect ClamD or ClamScan which also can disable the
    limit by setting it to zero using MaxFileSize 0 in clamd.conf for ClamD,
    or clamscan --max-filesize=0 for ClamScan.
    Note: Internally, the max file size is still set to 2 GiB. Disabling the
    limit for a scan will fall back on the internal 2 GiB limitation.
  * Increased the maximum line length for ClamAV config files from 512 bytes
    to 1,024 bytes to allow for longer config option strings.
  * SigTool: Fix insufficient buffer size for --list-sigs that caused a
    failure when listing a database containing one or more very long
    signatures. This fix was backported from 0.104.</changelog>
</package>
<package pkgid="4f44ccd8711f397af4b3911c029293dc1b61dc0329601868f3755e740e2b2d00" name="clamav-devel" arch="ppc64le">
  <version epoch="0" ver="0.103.5" rel="3.35.1"/>
  <changelog author="egdfree@opensuse.org" date="1553688000">- Update to version 0.101.2 (bsc#1130721)
  * CVE-2019-1787:
    An out-of-bounds heap read condition may occur when scanning PDF
    documents. The defect is a failure to correctly keep track of the number
    of bytes remaining in a buffer when indexing file data.
  * CVE-2019-1789:
    An out-of-bounds heap read condition may occur when scanning PE files
    (i.e. Windows EXE and DLL files) that have been packed using Aspack as a
    result of inadequate bound-checking.
  * CVE-2019-1788:
    An out-of-bounds heap write condition may occur when scanning OLE2 files
    such as Microsoft Office 97-2003 documents. The invalid write happens when
    an invalid pointer is mistakenly used to initialize a 32bit integer to
    zero. This is likely to crash the application.
  * CVE-2019-1786:
    An out-of-bounds heap read condition may occur when scanning malformed
    PDF documents as a result of improper bounds-checking.
  * CVE-2019-1785:
    A path-traversal write condition may occur as a result of improper
    input validation when scanning RAR archives.
  * CVE-2019-1798:
    A use-after-free condition may occur as a result of improper error
    handling when scanning nested RAR archives.
- added clamav-max_patch.patch to fix build
- dropped clamav-freshclam-exit.patch</changelog>
  <changelog author="max@suse.com" date="1565092800">- Update to version 0.101.3:
  * bsc#1144504: ZIP bomb causes extreme CPU spikes</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1567598400">- update to 0.101.4:
  * CVE-2019-12900: An out of bounds write in the NSIS bzip2
    (boo#1149458)
  * CVE-2019-12625: Introduce a configurable time limit to mitigate
    zip bomb vulnerability completely. Default is 2 minutes,
    configurable useing the clamscan --max-scantime and for clamd
    using the MaxScanTime config option (boo#1144504)</changelog>
  <changelog author="max@suse.com" date="1572004800">- bsc#1151839: Increase the startup timeout of clamd to 5 minutes
  to cater for the grown virus database as a workaround until
  clamd has learned to talk to systemd to extend the timeout as
  long as needed.</changelog>
  <changelog author="suse+build@de-korte.org" date="1572609600">- update to 0.102.0
  * The On-Access Scanning feature has been migrated out of clamd
    and into a brand new utility named clamonacc. This utility is
    similar to clamdscan and clamav-milter in that it acts as a
    client to clamd. This separation from clamd means that clamd no
    longer needs to run with root privileges while scanning potentially
    malicious files. Instead, clamd may drop privileges to run under an
    account that does not have super-user. In addition to improving the
    security posture of running clamd with On-Access enabled, this
    update fixed a few outstanding defects:
  - On-Access scanning for created and moved files (Extra-Scanning)
    is fixed.
  - VirusEvent for On-Access scans is fixed.
  - With clamonacc, it is now possible to copy, move, or remove a
    file if the scan triggered an alert, just like with clamdscan.
  * The freshclam database update utility has undergone a significant
    update. This includes:
  - Added support for HTTPS.
  - Support for database mirrors hosted on ports other than 80.
  - Removal of the mirror management feature (mirrors.dat).
  - An all new libfreshclam library API.
- created new subpackage libfreshclam2
- dropped clamav-max_patch.patch (upstreamed)
- added clamav-fix_building_milter.patch to fix build of milter</changelog>
  <changelog author="suse+build@de-korte.org" date="1574251200">- update to 0.102.1
  * CVE-2019-15961, bsc#1157763: A Denial-of-Service (DoS)
    vulnerability may occur when scanning a specially crafted email
    file as a result of excessively long scan times. The issue is
    resolved by implementing several maximums in parsing MIME
    messages and by optimizing use of memory allocation.
  * Build system fixes to build clamav-milter, to correctly link
    with libxml2 when detected, and to correctly detect fanotify
    for on-access scanning feature support.
  * Signature load time is significantly reduced by changing to a
    more efficient algorithm for loading signature patterns and
    allocating the AC trie. Patch courtesy of Alberto Wu.
  * Introduced a new configure option to statically link libjson-c
    with libclamav. Static linking with libjson is highly
    recommended to prevent crashes in applications that use
    libclamav alongside another JSON parsing library.
  * Null-dereference fix in email parser when using the
  - -gen-json metadata option.
  * Fixes for Authenticode parsing and certificate signature
    (.crb database) bugs.
- dropped clamav-fix_building_milter.patch (upstreamed)</changelog>
  <changelog author="dimstar@opensuse.org" date="1576756800">- BuildRequire pkgconfig(libsystemd) instead of systemd-devel:
  Allow OBS to shortcut through the -mini flavors.</changelog>
  <changelog author="suse+build@de-korte.org" date="1577188800">- The freshclam.service should not be started before the network is
  online (it checks for updates immediately upon service start)</changelog>
  <changelog author="suse+build@de-korte.org" date="1580904000">- update to 0.102.2
  * CVE-2020-3123: A denial-of-service (DoS) condition may occur when
    using the optional credit card data-loss-prevention (DLP) feature.
    Improper bounds checking of an unsigned variable resulted in an
    out-of-bounds read, which causes a crash.
  * Significantly improved the scan speed of PDF files on Windows.
  * Re-applied a fix to alleviate file access issues when scanning RAR
    files in downstream projects that use libclamav where the scanning
    engine is operating in a low-privilege process. This bug was originally
    fixed in 0.101.2 and the fix was mistakenly omitted from 0.102.0.
  * Fixed an issue where freshclam failed to update if the database version
    downloaded is one version older than advertised. This situation may
    occur after a new database version is published. The issue affected
    users downloading the whole CVD database file.
  * Changed the default freshclam ReceiveTimeout setting to 0 (infinite).
    The ReceiveTimeout had caused needless database update failures for
    users with slower internet connections.
  * Correctly display the number of kilobytes (KiB) in progress bar and
    reduced the size of the progress bar to accommodate 80-character width
    terminals.
  * Fixed an issue where running freshclam manually causes a daemonized
    freshclam process to fail when it updates because the manual instance
    deletes the temporary download directory. The freshclam temporary files
    will now download to a unique directory created at the time of an update
    instead of using a hardcoded directory created/destroyed at the program
    start/exit.
  * Fix for freshclam's OnOutdatedExecute config option.
  * Fixes a memory leak in the error condition handling for the email
    parser.
  * Improved bound checking and error handling in ARJ archive parser.
  * Improved error handling in PDF parser.
  * Fix for memory leak in byte-compare signature handler.</changelog>
  <changelog author="mpluskal@suse.com" date="1585742400">- Drop python build dependency as it is not needed</changelog>
  <changelog author="suse+build@de-korte.org" date="1589284800">- Update to 0.102.3
  * CVE-2020-3327: Fix a vulnerability in the ARJ archive parsing
    module in ClamAV 0.102.2 that could cause a Denial-of-Service (DoS)
    condition. Improper bounds checking of an unsigned variable results
    in an out-of-bounds read which causes a crash.
  * CVE-2020-3341: Fix a vulnerability in the PDF parsing module in
    ClamAV 0.101 - 0.102.2 that could cause a Denial-of-Service (DoS)
    condition. Improper size checking of a buffer used to initialize AES
    decryption routines results in an out-of-bounds read which may cause
    a crash.
  * Fix "Attempt to allocate 0 bytes" error when parsing some PDF
    documents.
  * Fix a couple of minor memory leaks.
  * Updated libclamunrar to UnRAR 5.9.2.</changelog>
  <changelog author="suse+build@de-korte.org" date="1594900800">- Update to 0.102.4
  * CVE-2020-3350: Fix a vulnerability wherein a malicious user could
    replace a scan target's directory with a symlink to another path
    to trick clamscan, clamdscan, or clamonacc into removing or moving
    a different file (eg. a critical system file). The issue would
    affect users that use the --move or --remove options for clamscan,
    clamdscan, and clamonacc.
  * CVE-2020-3327: Fix a vulnerability in the ARJ archive parsing
    module in ClamAV 0.102.3 that could cause a Denial-of-Service
    (DoS) condition. Improper bounds checking results in an
    out-of-bounds read which could cause a crash. The previous fix for
    this CVE in 0.102.3 was incomplete. This fix correctly resolves
    the issue.
  * CVE-2020-3481: Fix a vulnerability in the EGG archive module in
    ClamAV 0.102.0 - 0.102.3 could cause a Denial-of-Service (DoS)
    condition. Improper error handling may result in a crash due to a
    NULL pointer dereference. This vulnerability is mitigated for
    those using the official ClamAV signature databases because the
    file type signatures in daily.cvd will not enable the EGG archive
    parser in versions affected by the vulnerability.</changelog>
  <changelog author="suse+build@de-korte.org" date="1600084800">- Update to 0.103.0
  * clamd can now reload the signature database without blocking
    scanning. This multi-threaded database reload improvement was made
    possible thanks to a community effort.
  - Non-blocking database reloads are now the default behavior. Some
    systems that are more constrained on RAM may need to disable
    non-blocking reloads as it will temporarily consume two times as
    much memory. We added a new clamd config option
    ConcurrentDatabaseReload, which may be set to no.
  * Dropped clamav-str-h.patch (no longer needed)
  * Fix clamav-milter.service (requires clamd.service to run)</changelog>
  <changelog author="max@suse.com" date="1605009600">- Sync Factory to SLE-15 to implement jsc#ECO-3010 and bsc#1118459.
- bsc#1119353, clamav-fips.patch: Fix freshclam crash in FIPS mode.
- Keep OBS from installing an existing clamav instance to scan the
  sources, because this makes "make check" use the old library
  instead of the just built one. This is only a workaround until
  we found a way to keep libtool from adding libdir to rpath and
  LD_LIBRARY_PATH of the binaries in the testsuite.</changelog>
  <changelog author="dimstar@opensuse.org" date="1605182400">- Do not hard-depend on systemd: use systemd_ordering instead of
  systemd_requires.</changelog>
  <changelog author="max@suse.com" date="1617969600">- Update clamav.keyring
- Update to 0.103.2
  * CVE-2021-1252, bsc#1184532: Fix for Excel XLM parser infinite
    loop. Affects 0.103.0 and 0.103.1 only.
  * CVE-2021-1404, bsc#1184533: Fix for PDF parser buffer over-read;
    possible crash. Affects 0.103.0 and 0.103.1 only.
  * CVE-2021-1405, bsc#1184534: Fix for mail parser
    NULL-dereference crash. Affects 0.103.1 and prior.
  * Fix possible memory leak in PNG parser.
  * Fix ClamOnAcc scan on file-creation race condition so files are
    scanned after their contents are written.
  * FreshClam: Deprecate the SafeBrowsing config option. The
    SafeBrowsing option will no longer do anything.
  * For more details, see our blog post from last year about the
    future of the ClamAV Safe Browsing database.
  * FreshClam: Improved HTTP 304, 403, &amp; 429 handling.
  * FreshClam: Added back the mirrors.dat file to the database directory.
  * FreshClam will now exit with a failure in daemon mode if an HTTP 403
    (Forbidden) was received, because retrying later won't help any. The
    FreshClam user will have to take actions to get unblocked.
  * Fix the FreshClam mirror-sync issue where a downloaded database is
    "older than the version advertised."
  * bsc#1181256: Fix errors when scanning files &gt; 4G
  * obsoletes clamav-disable-timestamps.patch
- Update to 0.103.1
  * Added a new scan option to alert on broken media (graphics) file
    formats. This feature mitigates the risk of malformed media files
    intended to exploit vulnerabilities in other software. At present
    media validation exists for JPEG, TIFF, PNG, and GIF files. To
    enable this feature, set AlertBrokenMedia yes in clamd.conf, or
    use the --alert-broken-media option when using clamscan. These
    options are disabled by default in this patch release, but may be
    enabled in a subsequent release. Application developers may enable
    this scan option by enabling CL_SCAN_HEURISTIC_BROKEN_MEDIA for
    the heuristic scan option bit field.
  * Added CL_TYPE_TIFF, CL_TYPE_JPEG types to match GIF, PNG typing
    behavior. BMP and JPEG 2000 files will continue to detect as
    CL_TYPE_GRAPHICS because ClamAV does not yet have BMP or JPEG
    2000 format checking capabilities.
  * Fixed PNG parser logic bugs that caused an excess of parsing
    errors and fixed a stack exhaustion issue affecting some systems
    when scanning PNG files. PNG file type detection was disabled via
    signature database update for ClamAV version 0.103.0 to mitigate
    the effects from these bugs.
  * Fixed an issue where PNG and GIF files no longer work with
    Target:5 graphics signatures if detected as CL_TYPE_PNG/GIF rather
    than as CL_TYPE_GRAPHICS. Target types now support up to 10
    possible file types to make way for additional graphics types in
    future releases.
  * Fixed clamonacc's --fdpass option.
  - Interprocess file descriptor passing for clamonacc was broken
    since version 0.102.0 due to a bug introduced by the switch to
    curl for communicating with clamd. On Linux, passing file
    descriptors from one process to another is handled by the
    kernel, so we reverted clamonacc to use standard system calls
    for socket communication when fd passing is enabled.
  * Fixed a clamonacc stack corruption issue on some systems when
    using an older version of libcurl.
  * Allow clamscan and clamdscan scans to proceed even if the
    realpath lookup failed. This alleviates an issue on Windows
    scanning files hosted on file- systems that do not support the
    GetMappedFileNameW() API such as on ImDisk RAM-disks.
  * Fixed freshclam --on-update-execute=EXIT_1 temporary directory
    cleanup issue.
  * clamd's log output and VirusEvent now provide the scan target's
    file path instead of a file descriptor. The clamd socket API for
    submitting a scan by FD-passing doesn't include a file path, this
    feature works by looking up the file path by file descriptor.
    This feature works on Mac and Linux but is not yet implemented
    for other UNIX operating systems. FD-passing is not available for
    Windows.
  * Fixed an issue where freshclam database validation didn't work
    correctly when run in daemon mode on Linux/Unix.</changelog>
  <changelog author="suse+build@de-korte.org" date="1624276800">- bsc#1188284: Update to 0.103.3
  * Fixed a scan performance issue when ENGINE_OPTIONS_FORCE_TO_DISK is
    enabled. This issue did not impacted most users but for those
    affected it caused every scanned file to be copied to the temp
    directory before the scan.
  * Fix ClamDScan crashes when using the --fdpass --multiscan
    command-line options in combination with the ClamD ExcludePath
    config file options.
  * Fixed an issue where the mirrors.dat file is owned by root when
    starting as root (or with sudo) and using daemon-mode. File
    ownership will be set to the DatabaseOwner just before FreshClam
    switches to run as that user.
  * Renamed the mirrors.dat file to freshclam.dat.
  * Disabled the HTTPUserAgent config option if the DatabaseMirror uses
    clamav.net. This will prevent users from being inadvertently blocked
    and will ensure that we can keep better metrics on which ClamAV
    versions are being used.
  * Moved the detection for Heuristics.PNG.CVE-2010-1205 behind the
    ClamScan --alert-broken-media option (ClamD AlertBrokenMedia yes)
    option. This type of PNG issue appears to be common enough to be an
    annoyance, and the CVE is old enough that no one should be
    vulnerable at this point.
  * Fix ClamSubmit failures after changes to Cloudflare "__cfduid"
    cookies. See: https://blog.cloudflare.com/deprecating-cfduid-cookie/</changelog>
  <changelog author="meissner@suse.com" date="1625054400">- clamav-document-maxsize.patch: in the "clamscan" and "clamdscan" manpages,
  document that files over a certain size by default will silently not be
  scanned and how this can be adjusted (bsc#1187509)</changelog>
  <changelog author="max@suse.com" date="1636372800">- bsc#1192346: Update to 0.103.4
  * FreshClam:
  - Add a 24-hour cool-down for FreshClam clients that have received
    an HTTP 403 (Forbidden) response from the CDN. This is to reduce
    the volume of 403-response data served to blocked FreshClam
    clients that are configured with a tight update-loop.
  - Fixed a bug where FreshClam treats an empty CDIFF as an
    incremental update failure instead of as an intentional request
    to download the whole CVD.
  * ClamDScan: Fix a scan error when broken symlinks are encountered on
    macOS with "FollowDirectorySymlinks" and "FollowFileSymlinks"
    options disabled.
  * Overhauled the scan recursion / nested archive extraction logic and
    added new limits on embedded file-type recognition performed during
    the "raw" scan of each file. This limits embedded file-type
    misidentification and prevents detecting embedded file content that
    is found/extracted and scanned at other layers in the scanning
    process.
  * Fix an issue with the FMap module that failed to read from some
    nested files.
  * Fixed an issue where failing to load some rules from a Yara file
    containing multiple rules may cause a crash.
  * Fixed assorted compiler warnings.
  * Fixed assorted Coverity static code analysis issues.
  * Scan limits:
  - Added virus-name suffixes to the alerts that trigger when a scan
    limit has been exceeded. Rather than simply
    Heuristics.Limits.Exceeded, you may now see limit-specific
    virus-names, to include:
    + Heuristics.Limits.Exceeded.MaxFileSize
    + Heuristics.Limits.Exceeded.MaxScanSize
    + Heuristics.Limits.Exceeded.MaxFiles
    + Heuristics.Limits.Exceeded.MaxRecursion
    + Heuristics.Limits.Exceeded.MaxScanTime
  - Renamed the Heuristics.Email.ExceedsMax.* alerts to align with
    the other limit alerts names. These alerts include:
    + Heuristics.Limits.Exceeded.EmailLineFoldcnt
    + Heuristics.Limits.Exceeded.EmailHeaderBytes
    + Heuristics.Limits.Exceeded.EmailHeaders
    + Heuristics.Limits.Exceeded.EmailMIMEPartsPerMessage
    + Heuristics.Limits.Exceeded.EmailMIMEArguments
  - Fixed an issue where the Email-related scan limits would alert
    even when the "AlertExceedsMax" (--alert-exceeds-max) scan option
    is not enabled.
  - Fixes an issue in the Zip parser where exceeding the "MaxFiles"
    limit or the "MaxFileSize" limit would abort the scan but would
    fail to alert. The Zip scan limit issues were independently
    identified and reported by Aaron Leliaert and Max Allan.
  * Fixed a leak in the Email parser when using the --gen-json scan
    option.
  * Fixed an issue where a failure to record metadata in the Email
    parser when using the --gen-json scan option could cause the Email
    parser to abort the scan early and fail to extract and scan
    additional content.
  * Fixed a file name memory leak in the Zip parser.
  * Fixed an issue where certain signature patterns may cause a crash or
    cause unintended matches on some systems when converting characters
    to uppercase if a UTF-8 unicode single-byte grapheme becomes a
    multi-byte grapheme. Patch courtesy of Andrea De Pasquale.
- Fix unit test
  + clamav-ck_assert_msg.patch</changelog>
  <changelog author="max@suse.com" date="1642420800">- Update to 0.103.5
  * bsc#1194731, CVE-2022-20698:
    Fix for invalid pointer read that may cause a crash.
    This issue affects 0.104.1, 0.103.4 and prior when ClamAV is compiled
    with libjson-c and the CL_SCAN_GENERAL_COLLECT_METADATA scan option
    (the clamscan --gen-json option) is enabled.
  * Fixed ability to disable the file size limit with libclamav C API,
    like this:
    cl_engine_set_num(engine, CL_ENGINE_MAX_FILESIZE, 0);
    This issue didn't affect ClamD or ClamScan which also can disable the
    limit by setting it to zero using MaxFileSize 0 in clamd.conf for ClamD,
    or clamscan --max-filesize=0 for ClamScan.
    Note: Internally, the max file size is still set to 2 GiB. Disabling the
    limit for a scan will fall back on the internal 2 GiB limitation.
  * Increased the maximum line length for ClamAV config files from 512 bytes
    to 1,024 bytes to allow for longer config option strings.
  * SigTool: Fix insufficient buffer size for --list-sigs that caused a
    failure when listing a database containing one or more very long
    signatures. This fix was backported from 0.104.</changelog>
</package>
<package pkgid="3ecaaebb76bd4f01dcfaf4c772550c9d4c152772b87ac187e63792b3971054ab" name="clamav-devel" arch="s390x">
  <version epoch="0" ver="0.103.5" rel="3.35.1"/>
  <changelog author="egdfree@opensuse.org" date="1553688000">- Update to version 0.101.2 (bsc#1130721)
  * CVE-2019-1787:
    An out-of-bounds heap read condition may occur when scanning PDF
    documents. The defect is a failure to correctly keep track of the number
    of bytes remaining in a buffer when indexing file data.
  * CVE-2019-1789:
    An out-of-bounds heap read condition may occur when scanning PE files
    (i.e. Windows EXE and DLL files) that have been packed using Aspack as a
    result of inadequate bound-checking.
  * CVE-2019-1788:
    An out-of-bounds heap write condition may occur when scanning OLE2 files
    such as Microsoft Office 97-2003 documents. The invalid write happens when
    an invalid pointer is mistakenly used to initialize a 32bit integer to
    zero. This is likely to crash the application.
  * CVE-2019-1786:
    An out-of-bounds heap read condition may occur when scanning malformed
    PDF documents as a result of improper bounds-checking.
  * CVE-2019-1785:
    A path-traversal write condition may occur as a result of improper
    input validation when scanning RAR archives.
  * CVE-2019-1798:
    A use-after-free condition may occur as a result of improper error
    handling when scanning nested RAR archives.
- added clamav-max_patch.patch to fix build
- dropped clamav-freshclam-exit.patch</changelog>
  <changelog author="max@suse.com" date="1565092800">- Update to version 0.101.3:
  * bsc#1144504: ZIP bomb causes extreme CPU spikes</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1567598400">- update to 0.101.4:
  * CVE-2019-12900: An out of bounds write in the NSIS bzip2
    (boo#1149458)
  * CVE-2019-12625: Introduce a configurable time limit to mitigate
    zip bomb vulnerability completely. Default is 2 minutes,
    configurable useing the clamscan --max-scantime and for clamd
    using the MaxScanTime config option (boo#1144504)</changelog>
  <changelog author="max@suse.com" date="1572004800">- bsc#1151839: Increase the startup timeout of clamd to 5 minutes
  to cater for the grown virus database as a workaround until
  clamd has learned to talk to systemd to extend the timeout as
  long as needed.</changelog>
  <changelog author="suse+build@de-korte.org" date="1572609600">- update to 0.102.0
  * The On-Access Scanning feature has been migrated out of clamd
    and into a brand new utility named clamonacc. This utility is
    similar to clamdscan and clamav-milter in that it acts as a
    client to clamd. This separation from clamd means that clamd no
    longer needs to run with root privileges while scanning potentially
    malicious files. Instead, clamd may drop privileges to run under an
    account that does not have super-user. In addition to improving the
    security posture of running clamd with On-Access enabled, this
    update fixed a few outstanding defects:
  - On-Access scanning for created and moved files (Extra-Scanning)
    is fixed.
  - VirusEvent for On-Access scans is fixed.
  - With clamonacc, it is now possible to copy, move, or remove a
    file if the scan triggered an alert, just like with clamdscan.
  * The freshclam database update utility has undergone a significant
    update. This includes:
  - Added support for HTTPS.
  - Support for database mirrors hosted on ports other than 80.
  - Removal of the mirror management feature (mirrors.dat).
  - An all new libfreshclam library API.
- created new subpackage libfreshclam2
- dropped clamav-max_patch.patch (upstreamed)
- added clamav-fix_building_milter.patch to fix build of milter</changelog>
  <changelog author="suse+build@de-korte.org" date="1574251200">- update to 0.102.1
  * CVE-2019-15961, bsc#1157763: A Denial-of-Service (DoS)
    vulnerability may occur when scanning a specially crafted email
    file as a result of excessively long scan times. The issue is
    resolved by implementing several maximums in parsing MIME
    messages and by optimizing use of memory allocation.
  * Build system fixes to build clamav-milter, to correctly link
    with libxml2 when detected, and to correctly detect fanotify
    for on-access scanning feature support.
  * Signature load time is significantly reduced by changing to a
    more efficient algorithm for loading signature patterns and
    allocating the AC trie. Patch courtesy of Alberto Wu.
  * Introduced a new configure option to statically link libjson-c
    with libclamav. Static linking with libjson is highly
    recommended to prevent crashes in applications that use
    libclamav alongside another JSON parsing library.
  * Null-dereference fix in email parser when using the
  - -gen-json metadata option.
  * Fixes for Authenticode parsing and certificate signature
    (.crb database) bugs.
- dropped clamav-fix_building_milter.patch (upstreamed)</changelog>
  <changelog author="dimstar@opensuse.org" date="1576756800">- BuildRequire pkgconfig(libsystemd) instead of systemd-devel:
  Allow OBS to shortcut through the -mini flavors.</changelog>
  <changelog author="suse+build@de-korte.org" date="1577188800">- The freshclam.service should not be started before the network is
  online (it checks for updates immediately upon service start)</changelog>
  <changelog author="suse+build@de-korte.org" date="1580904000">- update to 0.102.2
  * CVE-2020-3123: A denial-of-service (DoS) condition may occur when
    using the optional credit card data-loss-prevention (DLP) feature.
    Improper bounds checking of an unsigned variable resulted in an
    out-of-bounds read, which causes a crash.
  * Significantly improved the scan speed of PDF files on Windows.
  * Re-applied a fix to alleviate file access issues when scanning RAR
    files in downstream projects that use libclamav where the scanning
    engine is operating in a low-privilege process. This bug was originally
    fixed in 0.101.2 and the fix was mistakenly omitted from 0.102.0.
  * Fixed an issue where freshclam failed to update if the database version
    downloaded is one version older than advertised. This situation may
    occur after a new database version is published. The issue affected
    users downloading the whole CVD database file.
  * Changed the default freshclam ReceiveTimeout setting to 0 (infinite).
    The ReceiveTimeout had caused needless database update failures for
    users with slower internet connections.
  * Correctly display the number of kilobytes (KiB) in progress bar and
    reduced the size of the progress bar to accommodate 80-character width
    terminals.
  * Fixed an issue where running freshclam manually causes a daemonized
    freshclam process to fail when it updates because the manual instance
    deletes the temporary download directory. The freshclam temporary files
    will now download to a unique directory created at the time of an update
    instead of using a hardcoded directory created/destroyed at the program
    start/exit.
  * Fix for freshclam's OnOutdatedExecute config option.
  * Fixes a memory leak in the error condition handling for the email
    parser.
  * Improved bound checking and error handling in ARJ archive parser.
  * Improved error handling in PDF parser.
  * Fix for memory leak in byte-compare signature handler.</changelog>
  <changelog author="mpluskal@suse.com" date="1585742400">- Drop python build dependency as it is not needed</changelog>
  <changelog author="suse+build@de-korte.org" date="1589284800">- Update to 0.102.3
  * CVE-2020-3327: Fix a vulnerability in the ARJ archive parsing
    module in ClamAV 0.102.2 that could cause a Denial-of-Service (DoS)
    condition. Improper bounds checking of an unsigned variable results
    in an out-of-bounds read which causes a crash.
  * CVE-2020-3341: Fix a vulnerability in the PDF parsing module in
    ClamAV 0.101 - 0.102.2 that could cause a Denial-of-Service (DoS)
    condition. Improper size checking of a buffer used to initialize AES
    decryption routines results in an out-of-bounds read which may cause
    a crash.
  * Fix "Attempt to allocate 0 bytes" error when parsing some PDF
    documents.
  * Fix a couple of minor memory leaks.
  * Updated libclamunrar to UnRAR 5.9.2.</changelog>
  <changelog author="suse+build@de-korte.org" date="1594900800">- Update to 0.102.4
  * CVE-2020-3350: Fix a vulnerability wherein a malicious user could
    replace a scan target's directory with a symlink to another path
    to trick clamscan, clamdscan, or clamonacc into removing or moving
    a different file (eg. a critical system file). The issue would
    affect users that use the --move or --remove options for clamscan,
    clamdscan, and clamonacc.
  * CVE-2020-3327: Fix a vulnerability in the ARJ archive parsing
    module in ClamAV 0.102.3 that could cause a Denial-of-Service
    (DoS) condition. Improper bounds checking results in an
    out-of-bounds read which could cause a crash. The previous fix for
    this CVE in 0.102.3 was incomplete. This fix correctly resolves
    the issue.
  * CVE-2020-3481: Fix a vulnerability in the EGG archive module in
    ClamAV 0.102.0 - 0.102.3 could cause a Denial-of-Service (DoS)
    condition. Improper error handling may result in a crash due to a
    NULL pointer dereference. This vulnerability is mitigated for
    those using the official ClamAV signature databases because the
    file type signatures in daily.cvd will not enable the EGG archive
    parser in versions affected by the vulnerability.</changelog>
  <changelog author="suse+build@de-korte.org" date="1600084800">- Update to 0.103.0
  * clamd can now reload the signature database without blocking
    scanning. This multi-threaded database reload improvement was made
    possible thanks to a community effort.
  - Non-blocking database reloads are now the default behavior. Some
    systems that are more constrained on RAM may need to disable
    non-blocking reloads as it will temporarily consume two times as
    much memory. We added a new clamd config option
    ConcurrentDatabaseReload, which may be set to no.
  * Dropped clamav-str-h.patch (no longer needed)
  * Fix clamav-milter.service (requires clamd.service to run)</changelog>
  <changelog author="max@suse.com" date="1605009600">- Sync Factory to SLE-15 to implement jsc#ECO-3010 and bsc#1118459.
- bsc#1119353, clamav-fips.patch: Fix freshclam crash in FIPS mode.
- Keep OBS from installing an existing clamav instance to scan the
  sources, because this makes "make check" use the old library
  instead of the just built one. This is only a workaround until
  we found a way to keep libtool from adding libdir to rpath and
  LD_LIBRARY_PATH of the binaries in the testsuite.</changelog>
  <changelog author="dimstar@opensuse.org" date="1605182400">- Do not hard-depend on systemd: use systemd_ordering instead of
  systemd_requires.</changelog>
  <changelog author="max@suse.com" date="1617969600">- Update clamav.keyring
- Update to 0.103.2
  * CVE-2021-1252, bsc#1184532: Fix for Excel XLM parser infinite
    loop. Affects 0.103.0 and 0.103.1 only.
  * CVE-2021-1404, bsc#1184533: Fix for PDF parser buffer over-read;
    possible crash. Affects 0.103.0 and 0.103.1 only.
  * CVE-2021-1405, bsc#1184534: Fix for mail parser
    NULL-dereference crash. Affects 0.103.1 and prior.
  * Fix possible memory leak in PNG parser.
  * Fix ClamOnAcc scan on file-creation race condition so files are
    scanned after their contents are written.
  * FreshClam: Deprecate the SafeBrowsing config option. The
    SafeBrowsing option will no longer do anything.
  * For more details, see our blog post from last year about the
    future of the ClamAV Safe Browsing database.
  * FreshClam: Improved HTTP 304, 403, &amp; 429 handling.
  * FreshClam: Added back the mirrors.dat file to the database directory.
  * FreshClam will now exit with a failure in daemon mode if an HTTP 403
    (Forbidden) was received, because retrying later won't help any. The
    FreshClam user will have to take actions to get unblocked.
  * Fix the FreshClam mirror-sync issue where a downloaded database is
    "older than the version advertised."
  * bsc#1181256: Fix errors when scanning files &gt; 4G
  * obsoletes clamav-disable-timestamps.patch
- Update to 0.103.1
  * Added a new scan option to alert on broken media (graphics) file
    formats. This feature mitigates the risk of malformed media files
    intended to exploit vulnerabilities in other software. At present
    media validation exists for JPEG, TIFF, PNG, and GIF files. To
    enable this feature, set AlertBrokenMedia yes in clamd.conf, or
    use the --alert-broken-media option when using clamscan. These
    options are disabled by default in this patch release, but may be
    enabled in a subsequent release. Application developers may enable
    this scan option by enabling CL_SCAN_HEURISTIC_BROKEN_MEDIA for
    the heuristic scan option bit field.
  * Added CL_TYPE_TIFF, CL_TYPE_JPEG types to match GIF, PNG typing
    behavior. BMP and JPEG 2000 files will continue to detect as
    CL_TYPE_GRAPHICS because ClamAV does not yet have BMP or JPEG
    2000 format checking capabilities.
  * Fixed PNG parser logic bugs that caused an excess of parsing
    errors and fixed a stack exhaustion issue affecting some systems
    when scanning PNG files. PNG file type detection was disabled via
    signature database update for ClamAV version 0.103.0 to mitigate
    the effects from these bugs.
  * Fixed an issue where PNG and GIF files no longer work with
    Target:5 graphics signatures if detected as CL_TYPE_PNG/GIF rather
    than as CL_TYPE_GRAPHICS. Target types now support up to 10
    possible file types to make way for additional graphics types in
    future releases.
  * Fixed clamonacc's --fdpass option.
  - Interprocess file descriptor passing for clamonacc was broken
    since version 0.102.0 due to a bug introduced by the switch to
    curl for communicating with clamd. On Linux, passing file
    descriptors from one process to another is handled by the
    kernel, so we reverted clamonacc to use standard system calls
    for socket communication when fd passing is enabled.
  * Fixed a clamonacc stack corruption issue on some systems when
    using an older version of libcurl.
  * Allow clamscan and clamdscan scans to proceed even if the
    realpath lookup failed. This alleviates an issue on Windows
    scanning files hosted on file- systems that do not support the
    GetMappedFileNameW() API such as on ImDisk RAM-disks.
  * Fixed freshclam --on-update-execute=EXIT_1 temporary directory
    cleanup issue.
  * clamd's log output and VirusEvent now provide the scan target's
    file path instead of a file descriptor. The clamd socket API for
    submitting a scan by FD-passing doesn't include a file path, this
    feature works by looking up the file path by file descriptor.
    This feature works on Mac and Linux but is not yet implemented
    for other UNIX operating systems. FD-passing is not available for
    Windows.
  * Fixed an issue where freshclam database validation didn't work
    correctly when run in daemon mode on Linux/Unix.</changelog>
  <changelog author="suse+build@de-korte.org" date="1624276800">- bsc#1188284: Update to 0.103.3
  * Fixed a scan performance issue when ENGINE_OPTIONS_FORCE_TO_DISK is
    enabled. This issue did not impacted most users but for those
    affected it caused every scanned file to be copied to the temp
    directory before the scan.
  * Fix ClamDScan crashes when using the --fdpass --multiscan
    command-line options in combination with the ClamD ExcludePath
    config file options.
  * Fixed an issue where the mirrors.dat file is owned by root when
    starting as root (or with sudo) and using daemon-mode. File
    ownership will be set to the DatabaseOwner just before FreshClam
    switches to run as that user.
  * Renamed the mirrors.dat file to freshclam.dat.
  * Disabled the HTTPUserAgent config option if the DatabaseMirror uses
    clamav.net. This will prevent users from being inadvertently blocked
    and will ensure that we can keep better metrics on which ClamAV
    versions are being used.
  * Moved the detection for Heuristics.PNG.CVE-2010-1205 behind the
    ClamScan --alert-broken-media option (ClamD AlertBrokenMedia yes)
    option. This type of PNG issue appears to be common enough to be an
    annoyance, and the CVE is old enough that no one should be
    vulnerable at this point.
  * Fix ClamSubmit failures after changes to Cloudflare "__cfduid"
    cookies. See: https://blog.cloudflare.com/deprecating-cfduid-cookie/</changelog>
  <changelog author="meissner@suse.com" date="1625054400">- clamav-document-maxsize.patch: in the "clamscan" and "clamdscan" manpages,
  document that files over a certain size by default will silently not be
  scanned and how this can be adjusted (bsc#1187509)</changelog>
  <changelog author="max@suse.com" date="1636372800">- bsc#1192346: Update to 0.103.4
  * FreshClam:
  - Add a 24-hour cool-down for FreshClam clients that have received
    an HTTP 403 (Forbidden) response from the CDN. This is to reduce
    the volume of 403-response data served to blocked FreshClam
    clients that are configured with a tight update-loop.
  - Fixed a bug where FreshClam treats an empty CDIFF as an
    incremental update failure instead of as an intentional request
    to download the whole CVD.
  * ClamDScan: Fix a scan error when broken symlinks are encountered on
    macOS with "FollowDirectorySymlinks" and "FollowFileSymlinks"
    options disabled.
  * Overhauled the scan recursion / nested archive extraction logic and
    added new limits on embedded file-type recognition performed during
    the "raw" scan of each file. This limits embedded file-type
    misidentification and prevents detecting embedded file content that
    is found/extracted and scanned at other layers in the scanning
    process.
  * Fix an issue with the FMap module that failed to read from some
    nested files.
  * Fixed an issue where failing to load some rules from a Yara file
    containing multiple rules may cause a crash.
  * Fixed assorted compiler warnings.
  * Fixed assorted Coverity static code analysis issues.
  * Scan limits:
  - Added virus-name suffixes to the alerts that trigger when a scan
    limit has been exceeded. Rather than simply
    Heuristics.Limits.Exceeded, you may now see limit-specific
    virus-names, to include:
    + Heuristics.Limits.Exceeded.MaxFileSize
    + Heuristics.Limits.Exceeded.MaxScanSize
    + Heuristics.Limits.Exceeded.MaxFiles
    + Heuristics.Limits.Exceeded.MaxRecursion
    + Heuristics.Limits.Exceeded.MaxScanTime
  - Renamed the Heuristics.Email.ExceedsMax.* alerts to align with
    the other limit alerts names. These alerts include:
    + Heuristics.Limits.Exceeded.EmailLineFoldcnt
    + Heuristics.Limits.Exceeded.EmailHeaderBytes
    + Heuristics.Limits.Exceeded.EmailHeaders
    + Heuristics.Limits.Exceeded.EmailMIMEPartsPerMessage
    + Heuristics.Limits.Exceeded.EmailMIMEArguments
  - Fixed an issue where the Email-related scan limits would alert
    even when the "AlertExceedsMax" (--alert-exceeds-max) scan option
    is not enabled.
  - Fixes an issue in the Zip parser where exceeding the "MaxFiles"
    limit or the "MaxFileSize" limit would abort the scan but would
    fail to alert. The Zip scan limit issues were independently
    identified and reported by Aaron Leliaert and Max Allan.
  * Fixed a leak in the Email parser when using the --gen-json scan
    option.
  * Fixed an issue where a failure to record metadata in the Email
    parser when using the --gen-json scan option could cause the Email
    parser to abort the scan early and fail to extract and scan
    additional content.
  * Fixed a file name memory leak in the Zip parser.
  * Fixed an issue where certain signature patterns may cause a crash or
    cause unintended matches on some systems when converting characters
    to uppercase if a UTF-8 unicode single-byte grapheme becomes a
    multi-byte grapheme. Patch courtesy of Andrea De Pasquale.
- Fix unit test
  + clamav-ck_assert_msg.patch</changelog>
  <changelog author="max@suse.com" date="1642420800">- Update to 0.103.5
  * bsc#1194731, CVE-2022-20698:
    Fix for invalid pointer read that may cause a crash.
    This issue affects 0.104.1, 0.103.4 and prior when ClamAV is compiled
    with libjson-c and the CL_SCAN_GENERAL_COLLECT_METADATA scan option
    (the clamscan --gen-json option) is enabled.
  * Fixed ability to disable the file size limit with libclamav C API,
    like this:
    cl_engine_set_num(engine, CL_ENGINE_MAX_FILESIZE, 0);
    This issue didn't affect ClamD or ClamScan which also can disable the
    limit by setting it to zero using MaxFileSize 0 in clamd.conf for ClamD,
    or clamscan --max-filesize=0 for ClamScan.
    Note: Internally, the max file size is still set to 2 GiB. Disabling the
    limit for a scan will fall back on the internal 2 GiB limitation.
  * Increased the maximum line length for ClamAV config files from 512 bytes
    to 1,024 bytes to allow for longer config option strings.
  * SigTool: Fix insufficient buffer size for --list-sigs that caused a
    failure when listing a database containing one or more very long
    signatures. This fix was backported from 0.104.</changelog>
</package>
<package pkgid="3ad72e9f896398ec4339ad2459c7341460dcb25ec0a3bda41d6d174d5f34fd8f" name="clamav-devel" arch="x86_64">
  <version epoch="0" ver="0.103.5" rel="3.35.1"/>
  <changelog author="egdfree@opensuse.org" date="1553688000">- Update to version 0.101.2 (bsc#1130721)
  * CVE-2019-1787:
    An out-of-bounds heap read condition may occur when scanning PDF
    documents. The defect is a failure to correctly keep track of the number
    of bytes remaining in a buffer when indexing file data.
  * CVE-2019-1789:
    An out-of-bounds heap read condition may occur when scanning PE files
    (i.e. Windows EXE and DLL files) that have been packed using Aspack as a
    result of inadequate bound-checking.
  * CVE-2019-1788:
    An out-of-bounds heap write condition may occur when scanning OLE2 files
    such as Microsoft Office 97-2003 documents. The invalid write happens when
    an invalid pointer is mistakenly used to initialize a 32bit integer to
    zero. This is likely to crash the application.
  * CVE-2019-1786:
    An out-of-bounds heap read condition may occur when scanning malformed
    PDF documents as a result of improper bounds-checking.
  * CVE-2019-1785:
    A path-traversal write condition may occur as a result of improper
    input validation when scanning RAR archives.
  * CVE-2019-1798:
    A use-after-free condition may occur as a result of improper error
    handling when scanning nested RAR archives.
- added clamav-max_patch.patch to fix build
- dropped clamav-freshclam-exit.patch</changelog>
  <changelog author="max@suse.com" date="1565092800">- Update to version 0.101.3:
  * bsc#1144504: ZIP bomb causes extreme CPU spikes</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1567598400">- update to 0.101.4:
  * CVE-2019-12900: An out of bounds write in the NSIS bzip2
    (boo#1149458)
  * CVE-2019-12625: Introduce a configurable time limit to mitigate
    zip bomb vulnerability completely. Default is 2 minutes,
    configurable useing the clamscan --max-scantime and for clamd
    using the MaxScanTime config option (boo#1144504)</changelog>
  <changelog author="max@suse.com" date="1572004800">- bsc#1151839: Increase the startup timeout of clamd to 5 minutes
  to cater for the grown virus database as a workaround until
  clamd has learned to talk to systemd to extend the timeout as
  long as needed.</changelog>
  <changelog author="suse+build@de-korte.org" date="1572609600">- update to 0.102.0
  * The On-Access Scanning feature has been migrated out of clamd
    and into a brand new utility named clamonacc. This utility is
    similar to clamdscan and clamav-milter in that it acts as a
    client to clamd. This separation from clamd means that clamd no
    longer needs to run with root privileges while scanning potentially
    malicious files. Instead, clamd may drop privileges to run under an
    account that does not have super-user. In addition to improving the
    security posture of running clamd with On-Access enabled, this
    update fixed a few outstanding defects:
  - On-Access scanning for created and moved files (Extra-Scanning)
    is fixed.
  - VirusEvent for On-Access scans is fixed.
  - With clamonacc, it is now possible to copy, move, or remove a
    file if the scan triggered an alert, just like with clamdscan.
  * The freshclam database update utility has undergone a significant
    update. This includes:
  - Added support for HTTPS.
  - Support for database mirrors hosted on ports other than 80.
  - Removal of the mirror management feature (mirrors.dat).
  - An all new libfreshclam library API.
- created new subpackage libfreshclam2
- dropped clamav-max_patch.patch (upstreamed)
- added clamav-fix_building_milter.patch to fix build of milter</changelog>
  <changelog author="suse+build@de-korte.org" date="1574251200">- update to 0.102.1
  * CVE-2019-15961, bsc#1157763: A Denial-of-Service (DoS)
    vulnerability may occur when scanning a specially crafted email
    file as a result of excessively long scan times. The issue is
    resolved by implementing several maximums in parsing MIME
    messages and by optimizing use of memory allocation.
  * Build system fixes to build clamav-milter, to correctly link
    with libxml2 when detected, and to correctly detect fanotify
    for on-access scanning feature support.
  * Signature load time is significantly reduced by changing to a
    more efficient algorithm for loading signature patterns and
    allocating the AC trie. Patch courtesy of Alberto Wu.
  * Introduced a new configure option to statically link libjson-c
    with libclamav. Static linking with libjson is highly
    recommended to prevent crashes in applications that use
    libclamav alongside another JSON parsing library.
  * Null-dereference fix in email parser when using the
  - -gen-json metadata option.
  * Fixes for Authenticode parsing and certificate signature
    (.crb database) bugs.
- dropped clamav-fix_building_milter.patch (upstreamed)</changelog>
  <changelog author="dimstar@opensuse.org" date="1576756800">- BuildRequire pkgconfig(libsystemd) instead of systemd-devel:
  Allow OBS to shortcut through the -mini flavors.</changelog>
  <changelog author="suse+build@de-korte.org" date="1577188800">- The freshclam.service should not be started before the network is
  online (it checks for updates immediately upon service start)</changelog>
  <changelog author="suse+build@de-korte.org" date="1580904000">- update to 0.102.2
  * CVE-2020-3123: A denial-of-service (DoS) condition may occur when
    using the optional credit card data-loss-prevention (DLP) feature.
    Improper bounds checking of an unsigned variable resulted in an
    out-of-bounds read, which causes a crash.
  * Significantly improved the scan speed of PDF files on Windows.
  * Re-applied a fix to alleviate file access issues when scanning RAR
    files in downstream projects that use libclamav where the scanning
    engine is operating in a low-privilege process. This bug was originally
    fixed in 0.101.2 and the fix was mistakenly omitted from 0.102.0.
  * Fixed an issue where freshclam failed to update if the database version
    downloaded is one version older than advertised. This situation may
    occur after a new database version is published. The issue affected
    users downloading the whole CVD database file.
  * Changed the default freshclam ReceiveTimeout setting to 0 (infinite).
    The ReceiveTimeout had caused needless database update failures for
    users with slower internet connections.
  * Correctly display the number of kilobytes (KiB) in progress bar and
    reduced the size of the progress bar to accommodate 80-character width
    terminals.
  * Fixed an issue where running freshclam manually causes a daemonized
    freshclam process to fail when it updates because the manual instance
    deletes the temporary download directory. The freshclam temporary files
    will now download to a unique directory created at the time of an update
    instead of using a hardcoded directory created/destroyed at the program
    start/exit.
  * Fix for freshclam's OnOutdatedExecute config option.
  * Fixes a memory leak in the error condition handling for the email
    parser.
  * Improved bound checking and error handling in ARJ archive parser.
  * Improved error handling in PDF parser.
  * Fix for memory leak in byte-compare signature handler.</changelog>
  <changelog author="mpluskal@suse.com" date="1585742400">- Drop python build dependency as it is not needed</changelog>
  <changelog author="suse+build@de-korte.org" date="1589284800">- Update to 0.102.3
  * CVE-2020-3327: Fix a vulnerability in the ARJ archive parsing
    module in ClamAV 0.102.2 that could cause a Denial-of-Service (DoS)
    condition. Improper bounds checking of an unsigned variable results
    in an out-of-bounds read which causes a crash.
  * CVE-2020-3341: Fix a vulnerability in the PDF parsing module in
    ClamAV 0.101 - 0.102.2 that could cause a Denial-of-Service (DoS)
    condition. Improper size checking of a buffer used to initialize AES
    decryption routines results in an out-of-bounds read which may cause
    a crash.
  * Fix "Attempt to allocate 0 bytes" error when parsing some PDF
    documents.
  * Fix a couple of minor memory leaks.
  * Updated libclamunrar to UnRAR 5.9.2.</changelog>
  <changelog author="suse+build@de-korte.org" date="1594900800">- Update to 0.102.4
  * CVE-2020-3350: Fix a vulnerability wherein a malicious user could
    replace a scan target's directory with a symlink to another path
    to trick clamscan, clamdscan, or clamonacc into removing or moving
    a different file (eg. a critical system file). The issue would
    affect users that use the --move or --remove options for clamscan,
    clamdscan, and clamonacc.
  * CVE-2020-3327: Fix a vulnerability in the ARJ archive parsing
    module in ClamAV 0.102.3 that could cause a Denial-of-Service
    (DoS) condition. Improper bounds checking results in an
    out-of-bounds read which could cause a crash. The previous fix for
    this CVE in 0.102.3 was incomplete. This fix correctly resolves
    the issue.
  * CVE-2020-3481: Fix a vulnerability in the EGG archive module in
    ClamAV 0.102.0 - 0.102.3 could cause a Denial-of-Service (DoS)
    condition. Improper error handling may result in a crash due to a
    NULL pointer dereference. This vulnerability is mitigated for
    those using the official ClamAV signature databases because the
    file type signatures in daily.cvd will not enable the EGG archive
    parser in versions affected by the vulnerability.</changelog>
  <changelog author="suse+build@de-korte.org" date="1600084800">- Update to 0.103.0
  * clamd can now reload the signature database without blocking
    scanning. This multi-threaded database reload improvement was made
    possible thanks to a community effort.
  - Non-blocking database reloads are now the default behavior. Some
    systems that are more constrained on RAM may need to disable
    non-blocking reloads as it will temporarily consume two times as
    much memory. We added a new clamd config option
    ConcurrentDatabaseReload, which may be set to no.
  * Dropped clamav-str-h.patch (no longer needed)
  * Fix clamav-milter.service (requires clamd.service to run)</changelog>
  <changelog author="max@suse.com" date="1605009600">- Sync Factory to SLE-15 to implement jsc#ECO-3010 and bsc#1118459.
- bsc#1119353, clamav-fips.patch: Fix freshclam crash in FIPS mode.
- Keep OBS from installing an existing clamav instance to scan the
  sources, because this makes "make check" use the old library
  instead of the just built one. This is only a workaround until
  we found a way to keep libtool from adding libdir to rpath and
  LD_LIBRARY_PATH of the binaries in the testsuite.</changelog>
  <changelog author="dimstar@opensuse.org" date="1605182400">- Do not hard-depend on systemd: use systemd_ordering instead of
  systemd_requires.</changelog>
  <changelog author="max@suse.com" date="1617969600">- Update clamav.keyring
- Update to 0.103.2
  * CVE-2021-1252, bsc#1184532: Fix for Excel XLM parser infinite
    loop. Affects 0.103.0 and 0.103.1 only.
  * CVE-2021-1404, bsc#1184533: Fix for PDF parser buffer over-read;
    possible crash. Affects 0.103.0 and 0.103.1 only.
  * CVE-2021-1405, bsc#1184534: Fix for mail parser
    NULL-dereference crash. Affects 0.103.1 and prior.
  * Fix possible memory leak in PNG parser.
  * Fix ClamOnAcc scan on file-creation race condition so files are
    scanned after their contents are written.
  * FreshClam: Deprecate the SafeBrowsing config option. The
    SafeBrowsing option will no longer do anything.
  * For more details, see our blog post from last year about the
    future of the ClamAV Safe Browsing database.
  * FreshClam: Improved HTTP 304, 403, &amp; 429 handling.
  * FreshClam: Added back the mirrors.dat file to the database directory.
  * FreshClam will now exit with a failure in daemon mode if an HTTP 403
    (Forbidden) was received, because retrying later won't help any. The
    FreshClam user will have to take actions to get unblocked.
  * Fix the FreshClam mirror-sync issue where a downloaded database is
    "older than the version advertised."
  * bsc#1181256: Fix errors when scanning files &gt; 4G
  * obsoletes clamav-disable-timestamps.patch
- Update to 0.103.1
  * Added a new scan option to alert on broken media (graphics) file
    formats. This feature mitigates the risk of malformed media files
    intended to exploit vulnerabilities in other software. At present
    media validation exists for JPEG, TIFF, PNG, and GIF files. To
    enable this feature, set AlertBrokenMedia yes in clamd.conf, or
    use the --alert-broken-media option when using clamscan. These
    options are disabled by default in this patch release, but may be
    enabled in a subsequent release. Application developers may enable
    this scan option by enabling CL_SCAN_HEURISTIC_BROKEN_MEDIA for
    the heuristic scan option bit field.
  * Added CL_TYPE_TIFF, CL_TYPE_JPEG types to match GIF, PNG typing
    behavior. BMP and JPEG 2000 files will continue to detect as
    CL_TYPE_GRAPHICS because ClamAV does not yet have BMP or JPEG
    2000 format checking capabilities.
  * Fixed PNG parser logic bugs that caused an excess of parsing
    errors and fixed a stack exhaustion issue affecting some systems
    when scanning PNG files. PNG file type detection was disabled via
    signature database update for ClamAV version 0.103.0 to mitigate
    the effects from these bugs.
  * Fixed an issue where PNG and GIF files no longer work with
    Target:5 graphics signatures if detected as CL_TYPE_PNG/GIF rather
    than as CL_TYPE_GRAPHICS. Target types now support up to 10
    possible file types to make way for additional graphics types in
    future releases.
  * Fixed clamonacc's --fdpass option.
  - Interprocess file descriptor passing for clamonacc was broken
    since version 0.102.0 due to a bug introduced by the switch to
    curl for communicating with clamd. On Linux, passing file
    descriptors from one process to another is handled by the
    kernel, so we reverted clamonacc to use standard system calls
    for socket communication when fd passing is enabled.
  * Fixed a clamonacc stack corruption issue on some systems when
    using an older version of libcurl.
  * Allow clamscan and clamdscan scans to proceed even if the
    realpath lookup failed. This alleviates an issue on Windows
    scanning files hosted on file- systems that do not support the
    GetMappedFileNameW() API such as on ImDisk RAM-disks.
  * Fixed freshclam --on-update-execute=EXIT_1 temporary directory
    cleanup issue.
  * clamd's log output and VirusEvent now provide the scan target's
    file path instead of a file descriptor. The clamd socket API for
    submitting a scan by FD-passing doesn't include a file path, this
    feature works by looking up the file path by file descriptor.
    This feature works on Mac and Linux but is not yet implemented
    for other UNIX operating systems. FD-passing is not available for
    Windows.
  * Fixed an issue where freshclam database validation didn't work
    correctly when run in daemon mode on Linux/Unix.</changelog>
  <changelog author="suse+build@de-korte.org" date="1624276800">- bsc#1188284: Update to 0.103.3
  * Fixed a scan performance issue when ENGINE_OPTIONS_FORCE_TO_DISK is
    enabled. This issue did not impacted most users but for those
    affected it caused every scanned file to be copied to the temp
    directory before the scan.
  * Fix ClamDScan crashes when using the --fdpass --multiscan
    command-line options in combination with the ClamD ExcludePath
    config file options.
  * Fixed an issue where the mirrors.dat file is owned by root when
    starting as root (or with sudo) and using daemon-mode. File
    ownership will be set to the DatabaseOwner just before FreshClam
    switches to run as that user.
  * Renamed the mirrors.dat file to freshclam.dat.
  * Disabled the HTTPUserAgent config option if the DatabaseMirror uses
    clamav.net. This will prevent users from being inadvertently blocked
    and will ensure that we can keep better metrics on which ClamAV
    versions are being used.
  * Moved the detection for Heuristics.PNG.CVE-2010-1205 behind the
    ClamScan --alert-broken-media option (ClamD AlertBrokenMedia yes)
    option. This type of PNG issue appears to be common enough to be an
    annoyance, and the CVE is old enough that no one should be
    vulnerable at this point.
  * Fix ClamSubmit failures after changes to Cloudflare "__cfduid"
    cookies. See: https://blog.cloudflare.com/deprecating-cfduid-cookie/</changelog>
  <changelog author="meissner@suse.com" date="1625054400">- clamav-document-maxsize.patch: in the "clamscan" and "clamdscan" manpages,
  document that files over a certain size by default will silently not be
  scanned and how this can be adjusted (bsc#1187509)</changelog>
  <changelog author="max@suse.com" date="1636372800">- bsc#1192346: Update to 0.103.4
  * FreshClam:
  - Add a 24-hour cool-down for FreshClam clients that have received
    an HTTP 403 (Forbidden) response from the CDN. This is to reduce
    the volume of 403-response data served to blocked FreshClam
    clients that are configured with a tight update-loop.
  - Fixed a bug where FreshClam treats an empty CDIFF as an
    incremental update failure instead of as an intentional request
    to download the whole CVD.
  * ClamDScan: Fix a scan error when broken symlinks are encountered on
    macOS with "FollowDirectorySymlinks" and "FollowFileSymlinks"
    options disabled.
  * Overhauled the scan recursion / nested archive extraction logic and
    added new limits on embedded file-type recognition performed during
    the "raw" scan of each file. This limits embedded file-type
    misidentification and prevents detecting embedded file content that
    is found/extracted and scanned at other layers in the scanning
    process.
  * Fix an issue with the FMap module that failed to read from some
    nested files.
  * Fixed an issue where failing to load some rules from a Yara file
    containing multiple rules may cause a crash.
  * Fixed assorted compiler warnings.
  * Fixed assorted Coverity static code analysis issues.
  * Scan limits:
  - Added virus-name suffixes to the alerts that trigger when a scan
    limit has been exceeded. Rather than simply
    Heuristics.Limits.Exceeded, you may now see limit-specific
    virus-names, to include:
    + Heuristics.Limits.Exceeded.MaxFileSize
    + Heuristics.Limits.Exceeded.MaxScanSize
    + Heuristics.Limits.Exceeded.MaxFiles
    + Heuristics.Limits.Exceeded.MaxRecursion
    + Heuristics.Limits.Exceeded.MaxScanTime
  - Renamed the Heuristics.Email.ExceedsMax.* alerts to align with
    the other limit alerts names. These alerts include:
    + Heuristics.Limits.Exceeded.EmailLineFoldcnt
    + Heuristics.Limits.Exceeded.EmailHeaderBytes
    + Heuristics.Limits.Exceeded.EmailHeaders
    + Heuristics.Limits.Exceeded.EmailMIMEPartsPerMessage
    + Heuristics.Limits.Exceeded.EmailMIMEArguments
  - Fixed an issue where the Email-related scan limits would alert
    even when the "AlertExceedsMax" (--alert-exceeds-max) scan option
    is not enabled.
  - Fixes an issue in the Zip parser where exceeding the "MaxFiles"
    limit or the "MaxFileSize" limit would abort the scan but would
    fail to alert. The Zip scan limit issues were independently
    identified and reported by Aaron Leliaert and Max Allan.
  * Fixed a leak in the Email parser when using the --gen-json scan
    option.
  * Fixed an issue where a failure to record metadata in the Email
    parser when using the --gen-json scan option could cause the Email
    parser to abort the scan early and fail to extract and scan
    additional content.
  * Fixed a file name memory leak in the Zip parser.
  * Fixed an issue where certain signature patterns may cause a crash or
    cause unintended matches on some systems when converting characters
    to uppercase if a UTF-8 unicode single-byte grapheme becomes a
    multi-byte grapheme. Patch courtesy of Andrea De Pasquale.
- Fix unit test
  + clamav-ck_assert_msg.patch</changelog>
  <changelog author="max@suse.com" date="1642420800">- Update to 0.103.5
  * bsc#1194731, CVE-2022-20698:
    Fix for invalid pointer read that may cause a crash.
    This issue affects 0.104.1, 0.103.4 and prior when ClamAV is compiled
    with libjson-c and the CL_SCAN_GENERAL_COLLECT_METADATA scan option
    (the clamscan --gen-json option) is enabled.
  * Fixed ability to disable the file size limit with libclamav C API,
    like this:
    cl_engine_set_num(engine, CL_ENGINE_MAX_FILESIZE, 0);
    This issue didn't affect ClamD or ClamScan which also can disable the
    limit by setting it to zero using MaxFileSize 0 in clamd.conf for ClamD,
    or clamscan --max-filesize=0 for ClamScan.
    Note: Internally, the max file size is still set to 2 GiB. Disabling the
    limit for a scan will fall back on the internal 2 GiB limitation.
  * Increased the maximum line length for ClamAV config files from 512 bytes
    to 1,024 bytes to allow for longer config option strings.
  * SigTool: Fix insufficient buffer size for --list-sigs that caused a
    failure when listing a database containing one or more very long
    signatures. This fix was backported from 0.104.</changelog>
</package>
<package pkgid="8b5c25b4839ddcf5a20b575c652451f311cc576f22364148d3915313c279567f" name="cluster-md-kmp-preempt" arch="x86_64">
  <version epoch="0" ver="5.3.18" rel="150300.59.43.1"/>
  <changelog author="tiwai@suse.de" date="1642593600">- Add cherry-picked IDs for qemu fw_cfg patches
- commit 8f947ad</changelog>
  <changelog author="msuchanek@suse.de" date="1642593601">- powerpc/pseries/cpuhp: delete add/remove_by_count code
  (bsc#1065729).
- powerpc/pseries/cpuhp: cache node corrections (bsc#1065729).
- commit 9c04898</changelog>
  <changelog author="tiwai@suse.de" date="1642593602">- dmaengine: at_xdmac: Fix at_xdmac_lld struct definition
  (git-fixes).
- dmaengine: at_xdmac: Fix lld view setting (git-fixes).
- dmaengine: at_xdmac: Fix concurrency over xfers_list
  (git-fixes).
- dmaengine: at_xdmac: Print debug message after realeasing the
  lock (git-fixes).
- dmaengine: at_xdmac: Don't start transactions at tx_submit level
  (git-fixes).
- Documentation: dmaengine: Correctly describe dmatest with
  channel unset (git-fixes).
- rpmsg: core: Clean up resources on announce_create failure
  (git-fixes).
- ACPI: APD: Check for NULL pointer after calling devm_ioremap()
  (git-fixes).
- Input: ti_am335x_tsc - fix STEPCONFIG setup for Z2 (git-fixes).
- Input: ti_am335x_tsc - set ADCREFM for X configuration
  (git-fixes).
- i3c: master: dw: check return of dw_i3c_master_get_free_pos()
  (git-fixes).
- i3c: fix incorrect address slot lookup on 64-bit (git-fixes).
- commit 3d8614c</changelog>
  <changelog author="msuchanek@suse.de" date="1642593603">- powerpc/prom_init: Fix improper check of prom_getprop()
  (bsc#1065729).
- commit 954fa51</changelog>
  <changelog author="msuchanek@suse.de" date="1642593604">- powerpc/perf: Fix PMU callbacks to clear pending PMI before
  resetting an overflown PMC (bsc#1156395).
- commit 8bdce1e</changelog>
  <changelog author="mbenes@suse.cz" date="1642593605">- livepatch: Avoid CPU hogging with cond_resched (bsc#1071995).
- commit 27c7aa0</changelog>
  <changelog author="msuchanek@suse.de" date="1642593606">- blacklist.conf: Add 79ca6f74dae0 tpm: fix Atmel TPM crash caused by too frequent queries
  Breaks kABI, there is no report of this problem affecting users, likely
  broken old TPM firmware.
- commit 4ea9f96</changelog>
  <changelog author="msuchanek@suse.de" date="1642593607">- Update patches.suse/tpm-fix-potential-NULL-pointer-access-in-tpm_del_cha.patch
  (git-fixes bsc#1193660 ltc#195634).
- commit 11ac3f6</changelog>
  <changelog author="lhenriques@suse.de" date="1642680000">- fuse: Pass correct lend value to filemap_write_and_wait_range()
  (bsc#1194953).
- commit d2355ea</changelog>
  <changelog author="msuchanek@suse.de" date="1642680001">- blacklist.conf: Add a2308836880b powerpc: Fix arch_stack_walk() to have
  running function as first entry
  The stacktrace interface in this kernel version does not provide the
  parameters used to implement the fix.
- commit ee041a3</changelog>
  <changelog author="msuchanek@suse.de" date="1642680002">- powerpc/64s: fix program check interrupt emergency stack path
  (bsc#1156395).
- commit a3c26ed</changelog>
  <changelog author="msuchanek@suse.de" date="1642680003">- powerpc/traps: do not enable irqs in _exception (bsc#1065729).
- powerpc: add interrupt_cond_local_irq_enable helper
  (bsc#1065729).
- commit 65f660c</changelog>
  <changelog author="msuchanek@suse.de" date="1642680004">- powerpc/pseries/mobility: ignore ibm, platform-facilities
  updates (bsc#1065729).
- commit b253330</changelog>
  <changelog author="rgoldwyn@suse.com" date="1642680005">- vfs: check fd has read access in kernel_read_file_from_fd() (bsc#1194888).
- commit 4717473</changelog>
  <changelog author="vkarasulli@suse.de" date="1642680006">- moxart: fix potential use-after-free on remove path
  (bsc#1194516).
- commit 3fae095</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1642766400">- sctp: account stream padding length for reconf chunk
  (bsc#1194985 CVE-2022-0322).
- commit a6cab40</changelog>
  <changelog author="ddiss@suse.de" date="1642766401">- vfs: fs_context: fix up param length parsing in
  legacy_parse_param (CVE-2022-0185 bsc#1194517).
- Rename and retag following upstream merge from:
  patches.suse/vfs-Out-of-bounds-write-of-heap-buffer-in-fs_context-c.patch
  to patches.suse/vfs-fs_context-fix-up-param-length-parsing-in-legacy.patch
- commit 33860f2</changelog>
  <changelog author="mkubecek@suse.cz" date="1642766402">- series.conf: cleanup
- move to "mainline soon" section:
  - patches.suse/0001-mmc-moxart_remove-Fix-UAF.patch
- commit 07d55c3</changelog>
  <changelog author="mkubecek@suse.cz" date="1642766403">- series.conf: refresh
- update upstream references and resort:
  - patches.suse/powerpc-fadump-Fix-inaccurate-CPU-state-info-in-vmco.patch
  - patches.suse/powerpc-handle-kdump-appropriately-with-crash_kexec_.patch
  - patches.suse/powerpc-watchdog-Avoid-holding-wd_smp_lock-over-prin.patch
  - patches.suse/powerpc-watchdog-Fix-missed-watchdog-reset-due-to-me.patch
  - patches.suse/powerpc-watchdog-Fix-wd_smp_last_reset_tb-reporting.patch
  - patches.suse/powerpc-watchdog-read-TB-close-to-where-it-is-used.patch
  - patches.suse/powerpc-watchdog-tighten-non-atomic-read-modify-writ.patch
- commit 72b7db7</changelog>
  <changelog author="osalvador@suse.de" date="1642939200">- Rename colliding patches before the next cve/linux-5.3 -&gt; SLE15-SP3 merge
- commit 84178b8</changelog>
</package>
<package pkgid="f5c418be24bde404bbdf727fa9336330763172f1c430129acdabe5fb8ea5f316" name="cluster-md-kmp-preempt" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="150300.59.49.1"/>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235200">- IB/mlx5: Add missing error code (git-fixes)
- commit 06919f0</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235201">- RDMA/cxgb4: Fix adapter LE hash errors while destroying ipv6 listening server (git-fixes)
- commit 0f86491</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235202">- RDMA/addr: Be strict with gid size (git-fixes)
- commit 0b96850</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235203">- IB/isert: Fix a use after free in isert_connect_request (git-fixes)
- commit fa7abfc</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235204">- RDMA/core: Fix corrupted SL on passive side (git-fixes)
- commit d86d9cb</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235205">- IB/hfi1: Use kzalloc() for mmu_rb_handler allocation (git-fixes)
- commit 05c0e16</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235206">- IB/hfi1: Fix error return code in parse_platform_config() (git-fixes)
- commit 270bb46</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235207">- RDMA/bnxt_re: Fix error return code in bnxt_qplib_cq_process_terminal() (git-fixes)
- commit 76267d4</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235208">- RDMA/core: Unify RoCE check and re-factor code (git-fixes)
- commit e5e3d6f</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235209">- RDMA/cxgb4: add missing qpid increment (git-fixes)
- commit 591cdce</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235210">- RDMA/i40iw: Fix error unwinding when i40iw_hmc_sd_one fails (git-fixes)
- commit 2db1c84</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235211">- RDMA/siw: Fix a use after free in siw_alloc_mr (git-fixes)
- commit a7eff62</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235212">- RDMA/bnxt_re: Fix a double free in bnxt_qplib_alloc_res (git-fixes)
- commit 8c226d5</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235213">- RDMA/siw: Properly check send and receive CQ pointers (git-fixes)
- commit d84b45b</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235214">- RDMA/rxe: Clear all QP fields if creation failed (git-fixes)
- commit 07c8b4d</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235215">- RDMA/mlx5: Recover from fatal event in dual port mode (git-fixes)
- commit 875e0ed</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235216">- RDMA/core: Don't access cm_id after its destruction (git-fixes)
- commit 4a117e6</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235217">- RDMA/mlx5: Fix query DCT via DEVX (git-fixes)
- commit 4b56cb2</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235218">- RDMA/uverbs: Fix a NULL vs IS_ERR() bug (git-fixes)
- commit 82ce09e</changelog>
  <changelog author="msuchanek@suse.de" date="1644235219">- powerpc/perf: Fix power_pmu_disable to call
  clear_pmi_irq_pending only if PMI is pending (bsc#1156395).
- commit a08ca77</changelog>
</package>
<package pkgid="6af7132f47afef272318182e3646098e7e56d09ca876d4530146dee9126e85bb" name="cluster-md-kmp-preempt" arch="x86_64">
  <version epoch="0" ver="5.3.18" rel="150300.59.49.1"/>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235200">- IB/mlx5: Add missing error code (git-fixes)
- commit 06919f0</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235201">- RDMA/cxgb4: Fix adapter LE hash errors while destroying ipv6 listening server (git-fixes)
- commit 0f86491</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235202">- RDMA/addr: Be strict with gid size (git-fixes)
- commit 0b96850</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235203">- IB/isert: Fix a use after free in isert_connect_request (git-fixes)
- commit fa7abfc</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235204">- RDMA/core: Fix corrupted SL on passive side (git-fixes)
- commit d86d9cb</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235205">- IB/hfi1: Use kzalloc() for mmu_rb_handler allocation (git-fixes)
- commit 05c0e16</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235206">- IB/hfi1: Fix error return code in parse_platform_config() (git-fixes)
- commit 270bb46</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235207">- RDMA/bnxt_re: Fix error return code in bnxt_qplib_cq_process_terminal() (git-fixes)
- commit 76267d4</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235208">- RDMA/core: Unify RoCE check and re-factor code (git-fixes)
- commit e5e3d6f</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235209">- RDMA/cxgb4: add missing qpid increment (git-fixes)
- commit 591cdce</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235210">- RDMA/i40iw: Fix error unwinding when i40iw_hmc_sd_one fails (git-fixes)
- commit 2db1c84</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235211">- RDMA/siw: Fix a use after free in siw_alloc_mr (git-fixes)
- commit a7eff62</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235212">- RDMA/bnxt_re: Fix a double free in bnxt_qplib_alloc_res (git-fixes)
- commit 8c226d5</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235213">- RDMA/siw: Properly check send and receive CQ pointers (git-fixes)
- commit d84b45b</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235214">- RDMA/rxe: Clear all QP fields if creation failed (git-fixes)
- commit 07c8b4d</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235215">- RDMA/mlx5: Recover from fatal event in dual port mode (git-fixes)
- commit 875e0ed</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235216">- RDMA/core: Don't access cm_id after its destruction (git-fixes)
- commit 4a117e6</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235217">- RDMA/mlx5: Fix query DCT via DEVX (git-fixes)
- commit 4b56cb2</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235218">- RDMA/uverbs: Fix a NULL vs IS_ERR() bug (git-fixes)
- commit 82ce09e</changelog>
  <changelog author="msuchanek@suse.de" date="1644235219">- powerpc/perf: Fix power_pmu_disable to call
  clear_pmi_irq_pending only if PMI is pending (bsc#1156395).
- commit a08ca77</changelog>
</package>
<package pkgid="7ca6a4e60e4f790df24314590ce4f87f24ae077f6a50acf455f840595f54e46b" name="dlm-kmp-preempt" arch="x86_64">
  <version epoch="0" ver="5.3.18" rel="150300.59.43.1"/>
  <changelog author="tiwai@suse.de" date="1642593600">- Add cherry-picked IDs for qemu fw_cfg patches
- commit 8f947ad</changelog>
  <changelog author="msuchanek@suse.de" date="1642593601">- powerpc/pseries/cpuhp: delete add/remove_by_count code
  (bsc#1065729).
- powerpc/pseries/cpuhp: cache node corrections (bsc#1065729).
- commit 9c04898</changelog>
  <changelog author="tiwai@suse.de" date="1642593602">- dmaengine: at_xdmac: Fix at_xdmac_lld struct definition
  (git-fixes).
- dmaengine: at_xdmac: Fix lld view setting (git-fixes).
- dmaengine: at_xdmac: Fix concurrency over xfers_list
  (git-fixes).
- dmaengine: at_xdmac: Print debug message after realeasing the
  lock (git-fixes).
- dmaengine: at_xdmac: Don't start transactions at tx_submit level
  (git-fixes).
- Documentation: dmaengine: Correctly describe dmatest with
  channel unset (git-fixes).
- rpmsg: core: Clean up resources on announce_create failure
  (git-fixes).
- ACPI: APD: Check for NULL pointer after calling devm_ioremap()
  (git-fixes).
- Input: ti_am335x_tsc - fix STEPCONFIG setup for Z2 (git-fixes).
- Input: ti_am335x_tsc - set ADCREFM for X configuration
  (git-fixes).
- i3c: master: dw: check return of dw_i3c_master_get_free_pos()
  (git-fixes).
- i3c: fix incorrect address slot lookup on 64-bit (git-fixes).
- commit 3d8614c</changelog>
  <changelog author="msuchanek@suse.de" date="1642593603">- powerpc/prom_init: Fix improper check of prom_getprop()
  (bsc#1065729).
- commit 954fa51</changelog>
  <changelog author="msuchanek@suse.de" date="1642593604">- powerpc/perf: Fix PMU callbacks to clear pending PMI before
  resetting an overflown PMC (bsc#1156395).
- commit 8bdce1e</changelog>
  <changelog author="mbenes@suse.cz" date="1642593605">- livepatch: Avoid CPU hogging with cond_resched (bsc#1071995).
- commit 27c7aa0</changelog>
  <changelog author="msuchanek@suse.de" date="1642593606">- blacklist.conf: Add 79ca6f74dae0 tpm: fix Atmel TPM crash caused by too frequent queries
  Breaks kABI, there is no report of this problem affecting users, likely
  broken old TPM firmware.
- commit 4ea9f96</changelog>
  <changelog author="msuchanek@suse.de" date="1642593607">- Update patches.suse/tpm-fix-potential-NULL-pointer-access-in-tpm_del_cha.patch
  (git-fixes bsc#1193660 ltc#195634).
- commit 11ac3f6</changelog>
  <changelog author="lhenriques@suse.de" date="1642680000">- fuse: Pass correct lend value to filemap_write_and_wait_range()
  (bsc#1194953).
- commit d2355ea</changelog>
  <changelog author="msuchanek@suse.de" date="1642680001">- blacklist.conf: Add a2308836880b powerpc: Fix arch_stack_walk() to have
  running function as first entry
  The stacktrace interface in this kernel version does not provide the
  parameters used to implement the fix.
- commit ee041a3</changelog>
  <changelog author="msuchanek@suse.de" date="1642680002">- powerpc/64s: fix program check interrupt emergency stack path
  (bsc#1156395).
- commit a3c26ed</changelog>
  <changelog author="msuchanek@suse.de" date="1642680003">- powerpc/traps: do not enable irqs in _exception (bsc#1065729).
- powerpc: add interrupt_cond_local_irq_enable helper
  (bsc#1065729).
- commit 65f660c</changelog>
  <changelog author="msuchanek@suse.de" date="1642680004">- powerpc/pseries/mobility: ignore ibm, platform-facilities
  updates (bsc#1065729).
- commit b253330</changelog>
  <changelog author="rgoldwyn@suse.com" date="1642680005">- vfs: check fd has read access in kernel_read_file_from_fd() (bsc#1194888).
- commit 4717473</changelog>
  <changelog author="vkarasulli@suse.de" date="1642680006">- moxart: fix potential use-after-free on remove path
  (bsc#1194516).
- commit 3fae095</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1642766400">- sctp: account stream padding length for reconf chunk
  (bsc#1194985 CVE-2022-0322).
- commit a6cab40</changelog>
  <changelog author="ddiss@suse.de" date="1642766401">- vfs: fs_context: fix up param length parsing in
  legacy_parse_param (CVE-2022-0185 bsc#1194517).
- Rename and retag following upstream merge from:
  patches.suse/vfs-Out-of-bounds-write-of-heap-buffer-in-fs_context-c.patch
  to patches.suse/vfs-fs_context-fix-up-param-length-parsing-in-legacy.patch
- commit 33860f2</changelog>
  <changelog author="mkubecek@suse.cz" date="1642766402">- series.conf: cleanup
- move to "mainline soon" section:
  - patches.suse/0001-mmc-moxart_remove-Fix-UAF.patch
- commit 07d55c3</changelog>
  <changelog author="mkubecek@suse.cz" date="1642766403">- series.conf: refresh
- update upstream references and resort:
  - patches.suse/powerpc-fadump-Fix-inaccurate-CPU-state-info-in-vmco.patch
  - patches.suse/powerpc-handle-kdump-appropriately-with-crash_kexec_.patch
  - patches.suse/powerpc-watchdog-Avoid-holding-wd_smp_lock-over-prin.patch
  - patches.suse/powerpc-watchdog-Fix-missed-watchdog-reset-due-to-me.patch
  - patches.suse/powerpc-watchdog-Fix-wd_smp_last_reset_tb-reporting.patch
  - patches.suse/powerpc-watchdog-read-TB-close-to-where-it-is-used.patch
  - patches.suse/powerpc-watchdog-tighten-non-atomic-read-modify-writ.patch
- commit 72b7db7</changelog>
  <changelog author="osalvador@suse.de" date="1642939200">- Rename colliding patches before the next cve/linux-5.3 -&gt; SLE15-SP3 merge
- commit 84178b8</changelog>
</package>
<package pkgid="439c4c0014d7f877f907f7aebd393c33303121a84631f7aa341d9475d27cfd20" name="dlm-kmp-preempt" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="150300.59.49.1"/>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235200">- IB/mlx5: Add missing error code (git-fixes)
- commit 06919f0</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235201">- RDMA/cxgb4: Fix adapter LE hash errors while destroying ipv6 listening server (git-fixes)
- commit 0f86491</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235202">- RDMA/addr: Be strict with gid size (git-fixes)
- commit 0b96850</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235203">- IB/isert: Fix a use after free in isert_connect_request (git-fixes)
- commit fa7abfc</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235204">- RDMA/core: Fix corrupted SL on passive side (git-fixes)
- commit d86d9cb</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235205">- IB/hfi1: Use kzalloc() for mmu_rb_handler allocation (git-fixes)
- commit 05c0e16</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235206">- IB/hfi1: Fix error return code in parse_platform_config() (git-fixes)
- commit 270bb46</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235207">- RDMA/bnxt_re: Fix error return code in bnxt_qplib_cq_process_terminal() (git-fixes)
- commit 76267d4</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235208">- RDMA/core: Unify RoCE check and re-factor code (git-fixes)
- commit e5e3d6f</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235209">- RDMA/cxgb4: add missing qpid increment (git-fixes)
- commit 591cdce</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235210">- RDMA/i40iw: Fix error unwinding when i40iw_hmc_sd_one fails (git-fixes)
- commit 2db1c84</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235211">- RDMA/siw: Fix a use after free in siw_alloc_mr (git-fixes)
- commit a7eff62</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235212">- RDMA/bnxt_re: Fix a double free in bnxt_qplib_alloc_res (git-fixes)
- commit 8c226d5</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235213">- RDMA/siw: Properly check send and receive CQ pointers (git-fixes)
- commit d84b45b</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235214">- RDMA/rxe: Clear all QP fields if creation failed (git-fixes)
- commit 07c8b4d</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235215">- RDMA/mlx5: Recover from fatal event in dual port mode (git-fixes)
- commit 875e0ed</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235216">- RDMA/core: Don't access cm_id after its destruction (git-fixes)
- commit 4a117e6</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235217">- RDMA/mlx5: Fix query DCT via DEVX (git-fixes)
- commit 4b56cb2</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235218">- RDMA/uverbs: Fix a NULL vs IS_ERR() bug (git-fixes)
- commit 82ce09e</changelog>
  <changelog author="msuchanek@suse.de" date="1644235219">- powerpc/perf: Fix power_pmu_disable to call
  clear_pmi_irq_pending only if PMI is pending (bsc#1156395).
- commit a08ca77</changelog>
</package>
<package pkgid="efdfb0fb46a7f7a816a63d226adcb99f77f7b97ba37a70f7f0474941634b55f2" name="dlm-kmp-preempt" arch="x86_64">
  <version epoch="0" ver="5.3.18" rel="150300.59.49.1"/>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235200">- IB/mlx5: Add missing error code (git-fixes)
- commit 06919f0</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235201">- RDMA/cxgb4: Fix adapter LE hash errors while destroying ipv6 listening server (git-fixes)
- commit 0f86491</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235202">- RDMA/addr: Be strict with gid size (git-fixes)
- commit 0b96850</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235203">- IB/isert: Fix a use after free in isert_connect_request (git-fixes)
- commit fa7abfc</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235204">- RDMA/core: Fix corrupted SL on passive side (git-fixes)
- commit d86d9cb</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235205">- IB/hfi1: Use kzalloc() for mmu_rb_handler allocation (git-fixes)
- commit 05c0e16</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235206">- IB/hfi1: Fix error return code in parse_platform_config() (git-fixes)
- commit 270bb46</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235207">- RDMA/bnxt_re: Fix error return code in bnxt_qplib_cq_process_terminal() (git-fixes)
- commit 76267d4</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235208">- RDMA/core: Unify RoCE check and re-factor code (git-fixes)
- commit e5e3d6f</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235209">- RDMA/cxgb4: add missing qpid increment (git-fixes)
- commit 591cdce</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235210">- RDMA/i40iw: Fix error unwinding when i40iw_hmc_sd_one fails (git-fixes)
- commit 2db1c84</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235211">- RDMA/siw: Fix a use after free in siw_alloc_mr (git-fixes)
- commit a7eff62</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235212">- RDMA/bnxt_re: Fix a double free in bnxt_qplib_alloc_res (git-fixes)
- commit 8c226d5</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235213">- RDMA/siw: Properly check send and receive CQ pointers (git-fixes)
- commit d84b45b</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235214">- RDMA/rxe: Clear all QP fields if creation failed (git-fixes)
- commit 07c8b4d</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235215">- RDMA/mlx5: Recover from fatal event in dual port mode (git-fixes)
- commit 875e0ed</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235216">- RDMA/core: Don't access cm_id after its destruction (git-fixes)
- commit 4a117e6</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235217">- RDMA/mlx5: Fix query DCT via DEVX (git-fixes)
- commit 4b56cb2</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235218">- RDMA/uverbs: Fix a NULL vs IS_ERR() bug (git-fixes)
- commit 82ce09e</changelog>
  <changelog author="msuchanek@suse.de" date="1644235219">- powerpc/perf: Fix power_pmu_disable to call
  clear_pmi_irq_pending only if PMI is pending (bsc#1156395).
- commit a08ca77</changelog>
</package>
<package pkgid="55fa3b1acc03021ecf33a26de0a064ede8ae29360fde8c70293a0b7b0953e9e5" name="dtb-aarch64" arch="src">
  <version epoch="0" ver="5.3.18" rel="150300.59.43.1"/>
  <changelog author="tiwai@suse.de" date="1642593600">- Add cherry-picked IDs for qemu fw_cfg patches
- commit 8f947ad</changelog>
  <changelog author="msuchanek@suse.de" date="1642593601">- powerpc/pseries/cpuhp: delete add/remove_by_count code
  (bsc#1065729).
- powerpc/pseries/cpuhp: cache node corrections (bsc#1065729).
- commit 9c04898</changelog>
  <changelog author="tiwai@suse.de" date="1642593602">- dmaengine: at_xdmac: Fix at_xdmac_lld struct definition
  (git-fixes).
- dmaengine: at_xdmac: Fix lld view setting (git-fixes).
- dmaengine: at_xdmac: Fix concurrency over xfers_list
  (git-fixes).
- dmaengine: at_xdmac: Print debug message after realeasing the
  lock (git-fixes).
- dmaengine: at_xdmac: Don't start transactions at tx_submit level
  (git-fixes).
- Documentation: dmaengine: Correctly describe dmatest with
  channel unset (git-fixes).
- rpmsg: core: Clean up resources on announce_create failure
  (git-fixes).
- ACPI: APD: Check for NULL pointer after calling devm_ioremap()
  (git-fixes).
- Input: ti_am335x_tsc - fix STEPCONFIG setup for Z2 (git-fixes).
- Input: ti_am335x_tsc - set ADCREFM for X configuration
  (git-fixes).
- i3c: master: dw: check return of dw_i3c_master_get_free_pos()
  (git-fixes).
- i3c: fix incorrect address slot lookup on 64-bit (git-fixes).
- commit 3d8614c</changelog>
  <changelog author="msuchanek@suse.de" date="1642593603">- powerpc/prom_init: Fix improper check of prom_getprop()
  (bsc#1065729).
- commit 954fa51</changelog>
  <changelog author="msuchanek@suse.de" date="1642593604">- powerpc/perf: Fix PMU callbacks to clear pending PMI before
  resetting an overflown PMC (bsc#1156395).
- commit 8bdce1e</changelog>
  <changelog author="mbenes@suse.cz" date="1642593605">- livepatch: Avoid CPU hogging with cond_resched (bsc#1071995).
- commit 27c7aa0</changelog>
  <changelog author="msuchanek@suse.de" date="1642593606">- blacklist.conf: Add 79ca6f74dae0 tpm: fix Atmel TPM crash caused by too frequent queries
  Breaks kABI, there is no report of this problem affecting users, likely
  broken old TPM firmware.
- commit 4ea9f96</changelog>
  <changelog author="msuchanek@suse.de" date="1642593607">- Update patches.suse/tpm-fix-potential-NULL-pointer-access-in-tpm_del_cha.patch
  (git-fixes bsc#1193660 ltc#195634).
- commit 11ac3f6</changelog>
  <changelog author="lhenriques@suse.de" date="1642680000">- fuse: Pass correct lend value to filemap_write_and_wait_range()
  (bsc#1194953).
- commit d2355ea</changelog>
  <changelog author="msuchanek@suse.de" date="1642680001">- blacklist.conf: Add a2308836880b powerpc: Fix arch_stack_walk() to have
  running function as first entry
  The stacktrace interface in this kernel version does not provide the
  parameters used to implement the fix.
- commit ee041a3</changelog>
  <changelog author="msuchanek@suse.de" date="1642680002">- powerpc/64s: fix program check interrupt emergency stack path
  (bsc#1156395).
- commit a3c26ed</changelog>
  <changelog author="msuchanek@suse.de" date="1642680003">- powerpc/traps: do not enable irqs in _exception (bsc#1065729).
- powerpc: add interrupt_cond_local_irq_enable helper
  (bsc#1065729).
- commit 65f660c</changelog>
  <changelog author="msuchanek@suse.de" date="1642680004">- powerpc/pseries/mobility: ignore ibm, platform-facilities
  updates (bsc#1065729).
- commit b253330</changelog>
  <changelog author="rgoldwyn@suse.com" date="1642680005">- vfs: check fd has read access in kernel_read_file_from_fd() (bsc#1194888).
- commit 4717473</changelog>
  <changelog author="vkarasulli@suse.de" date="1642680006">- moxart: fix potential use-after-free on remove path
  (bsc#1194516).
- commit 3fae095</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1642766400">- sctp: account stream padding length for reconf chunk
  (bsc#1194985 CVE-2022-0322).
- commit a6cab40</changelog>
  <changelog author="ddiss@suse.de" date="1642766401">- vfs: fs_context: fix up param length parsing in
  legacy_parse_param (CVE-2022-0185 bsc#1194517).
- Rename and retag following upstream merge from:
  patches.suse/vfs-Out-of-bounds-write-of-heap-buffer-in-fs_context-c.patch
  to patches.suse/vfs-fs_context-fix-up-param-length-parsing-in-legacy.patch
- commit 33860f2</changelog>
  <changelog author="mkubecek@suse.cz" date="1642766402">- series.conf: cleanup
- move to "mainline soon" section:
  - patches.suse/0001-mmc-moxart_remove-Fix-UAF.patch
- commit 07d55c3</changelog>
  <changelog author="mkubecek@suse.cz" date="1642766403">- series.conf: refresh
- update upstream references and resort:
  - patches.suse/powerpc-fadump-Fix-inaccurate-CPU-state-info-in-vmco.patch
  - patches.suse/powerpc-handle-kdump-appropriately-with-crash_kexec_.patch
  - patches.suse/powerpc-watchdog-Avoid-holding-wd_smp_lock-over-prin.patch
  - patches.suse/powerpc-watchdog-Fix-missed-watchdog-reset-due-to-me.patch
  - patches.suse/powerpc-watchdog-Fix-wd_smp_last_reset_tb-reporting.patch
  - patches.suse/powerpc-watchdog-read-TB-close-to-where-it-is-used.patch
  - patches.suse/powerpc-watchdog-tighten-non-atomic-read-modify-writ.patch
- commit 72b7db7</changelog>
  <changelog author="osalvador@suse.de" date="1642939200">- Rename colliding patches before the next cve/linux-5.3 -&gt; SLE15-SP3 merge
- commit 84178b8</changelog>
</package>
<package pkgid="f39ff20b05f27b98ca6e129098c82c5043e3fc217ee16897ac8072e988ff75e8" name="dtb-aarch64" arch="src">
  <version epoch="0" ver="5.3.18" rel="150300.59.49.1"/>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235200">- IB/mlx5: Add missing error code (git-fixes)
- commit 06919f0</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235201">- RDMA/cxgb4: Fix adapter LE hash errors while destroying ipv6 listening server (git-fixes)
- commit 0f86491</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235202">- RDMA/addr: Be strict with gid size (git-fixes)
- commit 0b96850</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235203">- IB/isert: Fix a use after free in isert_connect_request (git-fixes)
- commit fa7abfc</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235204">- RDMA/core: Fix corrupted SL on passive side (git-fixes)
- commit d86d9cb</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235205">- IB/hfi1: Use kzalloc() for mmu_rb_handler allocation (git-fixes)
- commit 05c0e16</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235206">- IB/hfi1: Fix error return code in parse_platform_config() (git-fixes)
- commit 270bb46</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235207">- RDMA/bnxt_re: Fix error return code in bnxt_qplib_cq_process_terminal() (git-fixes)
- commit 76267d4</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235208">- RDMA/core: Unify RoCE check and re-factor code (git-fixes)
- commit e5e3d6f</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235209">- RDMA/cxgb4: add missing qpid increment (git-fixes)
- commit 591cdce</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235210">- RDMA/i40iw: Fix error unwinding when i40iw_hmc_sd_one fails (git-fixes)
- commit 2db1c84</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235211">- RDMA/siw: Fix a use after free in siw_alloc_mr (git-fixes)
- commit a7eff62</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235212">- RDMA/bnxt_re: Fix a double free in bnxt_qplib_alloc_res (git-fixes)
- commit 8c226d5</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235213">- RDMA/siw: Properly check send and receive CQ pointers (git-fixes)
- commit d84b45b</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235214">- RDMA/rxe: Clear all QP fields if creation failed (git-fixes)
- commit 07c8b4d</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235215">- RDMA/mlx5: Recover from fatal event in dual port mode (git-fixes)
- commit 875e0ed</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235216">- RDMA/core: Don't access cm_id after its destruction (git-fixes)
- commit 4a117e6</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235217">- RDMA/mlx5: Fix query DCT via DEVX (git-fixes)
- commit 4b56cb2</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235218">- RDMA/uverbs: Fix a NULL vs IS_ERR() bug (git-fixes)
- commit 82ce09e</changelog>
  <changelog author="msuchanek@suse.de" date="1644235219">- powerpc/perf: Fix power_pmu_disable to call
  clear_pmi_irq_pending only if PMI is pending (bsc#1156395).
- commit a08ca77</changelog>
</package>
<package pkgid="9451b04b055997dab49b9d774e759828592e0fd8d310581a78b1a0e212fc242f" name="dtb-al" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="150300.59.43.1"/>
  <changelog author="tiwai@suse.de" date="1642593600">- Add cherry-picked IDs for qemu fw_cfg patches
- commit 8f947ad</changelog>
  <changelog author="msuchanek@suse.de" date="1642593601">- powerpc/pseries/cpuhp: delete add/remove_by_count code
  (bsc#1065729).
- powerpc/pseries/cpuhp: cache node corrections (bsc#1065729).
- commit 9c04898</changelog>
  <changelog author="tiwai@suse.de" date="1642593602">- dmaengine: at_xdmac: Fix at_xdmac_lld struct definition
  (git-fixes).
- dmaengine: at_xdmac: Fix lld view setting (git-fixes).
- dmaengine: at_xdmac: Fix concurrency over xfers_list
  (git-fixes).
- dmaengine: at_xdmac: Print debug message after realeasing the
  lock (git-fixes).
- dmaengine: at_xdmac: Don't start transactions at tx_submit level
  (git-fixes).
- Documentation: dmaengine: Correctly describe dmatest with
  channel unset (git-fixes).
- rpmsg: core: Clean up resources on announce_create failure
  (git-fixes).
- ACPI: APD: Check for NULL pointer after calling devm_ioremap()
  (git-fixes).
- Input: ti_am335x_tsc - fix STEPCONFIG setup for Z2 (git-fixes).
- Input: ti_am335x_tsc - set ADCREFM for X configuration
  (git-fixes).
- i3c: master: dw: check return of dw_i3c_master_get_free_pos()
  (git-fixes).
- i3c: fix incorrect address slot lookup on 64-bit (git-fixes).
- commit 3d8614c</changelog>
  <changelog author="msuchanek@suse.de" date="1642593603">- powerpc/prom_init: Fix improper check of prom_getprop()
  (bsc#1065729).
- commit 954fa51</changelog>
  <changelog author="msuchanek@suse.de" date="1642593604">- powerpc/perf: Fix PMU callbacks to clear pending PMI before
  resetting an overflown PMC (bsc#1156395).
- commit 8bdce1e</changelog>
  <changelog author="mbenes@suse.cz" date="1642593605">- livepatch: Avoid CPU hogging with cond_resched (bsc#1071995).
- commit 27c7aa0</changelog>
  <changelog author="msuchanek@suse.de" date="1642593606">- blacklist.conf: Add 79ca6f74dae0 tpm: fix Atmel TPM crash caused by too frequent queries
  Breaks kABI, there is no report of this problem affecting users, likely
  broken old TPM firmware.
- commit 4ea9f96</changelog>
  <changelog author="msuchanek@suse.de" date="1642593607">- Update patches.suse/tpm-fix-potential-NULL-pointer-access-in-tpm_del_cha.patch
  (git-fixes bsc#1193660 ltc#195634).
- commit 11ac3f6</changelog>
  <changelog author="lhenriques@suse.de" date="1642680000">- fuse: Pass correct lend value to filemap_write_and_wait_range()
  (bsc#1194953).
- commit d2355ea</changelog>
  <changelog author="msuchanek@suse.de" date="1642680001">- blacklist.conf: Add a2308836880b powerpc: Fix arch_stack_walk() to have
  running function as first entry
  The stacktrace interface in this kernel version does not provide the
  parameters used to implement the fix.
- commit ee041a3</changelog>
  <changelog author="msuchanek@suse.de" date="1642680002">- powerpc/64s: fix program check interrupt emergency stack path
  (bsc#1156395).
- commit a3c26ed</changelog>
  <changelog author="msuchanek@suse.de" date="1642680003">- powerpc/traps: do not enable irqs in _exception (bsc#1065729).
- powerpc: add interrupt_cond_local_irq_enable helper
  (bsc#1065729).
- commit 65f660c</changelog>
  <changelog author="msuchanek@suse.de" date="1642680004">- powerpc/pseries/mobility: ignore ibm, platform-facilities
  updates (bsc#1065729).
- commit b253330</changelog>
  <changelog author="rgoldwyn@suse.com" date="1642680005">- vfs: check fd has read access in kernel_read_file_from_fd() (bsc#1194888).
- commit 4717473</changelog>
  <changelog author="vkarasulli@suse.de" date="1642680006">- moxart: fix potential use-after-free on remove path
  (bsc#1194516).
- commit 3fae095</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1642766400">- sctp: account stream padding length for reconf chunk
  (bsc#1194985 CVE-2022-0322).
- commit a6cab40</changelog>
  <changelog author="ddiss@suse.de" date="1642766401">- vfs: fs_context: fix up param length parsing in
  legacy_parse_param (CVE-2022-0185 bsc#1194517).
- Rename and retag following upstream merge from:
  patches.suse/vfs-Out-of-bounds-write-of-heap-buffer-in-fs_context-c.patch
  to patches.suse/vfs-fs_context-fix-up-param-length-parsing-in-legacy.patch
- commit 33860f2</changelog>
  <changelog author="mkubecek@suse.cz" date="1642766402">- series.conf: cleanup
- move to "mainline soon" section:
  - patches.suse/0001-mmc-moxart_remove-Fix-UAF.patch
- commit 07d55c3</changelog>
  <changelog author="mkubecek@suse.cz" date="1642766403">- series.conf: refresh
- update upstream references and resort:
  - patches.suse/powerpc-fadump-Fix-inaccurate-CPU-state-info-in-vmco.patch
  - patches.suse/powerpc-handle-kdump-appropriately-with-crash_kexec_.patch
  - patches.suse/powerpc-watchdog-Avoid-holding-wd_smp_lock-over-prin.patch
  - patches.suse/powerpc-watchdog-Fix-missed-watchdog-reset-due-to-me.patch
  - patches.suse/powerpc-watchdog-Fix-wd_smp_last_reset_tb-reporting.patch
  - patches.suse/powerpc-watchdog-read-TB-close-to-where-it-is-used.patch
  - patches.suse/powerpc-watchdog-tighten-non-atomic-read-modify-writ.patch
- commit 72b7db7</changelog>
  <changelog author="osalvador@suse.de" date="1642939200">- Rename colliding patches before the next cve/linux-5.3 -&gt; SLE15-SP3 merge
- commit 84178b8</changelog>
</package>
<package pkgid="9279553975cfbff792fad96759677bf58904e1cedea908ea673cc9d880c32fc8" name="dtb-al" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="150300.59.49.1"/>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235200">- IB/mlx5: Add missing error code (git-fixes)
- commit 06919f0</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235201">- RDMA/cxgb4: Fix adapter LE hash errors while destroying ipv6 listening server (git-fixes)
- commit 0f86491</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235202">- RDMA/addr: Be strict with gid size (git-fixes)
- commit 0b96850</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235203">- IB/isert: Fix a use after free in isert_connect_request (git-fixes)
- commit fa7abfc</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235204">- RDMA/core: Fix corrupted SL on passive side (git-fixes)
- commit d86d9cb</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235205">- IB/hfi1: Use kzalloc() for mmu_rb_handler allocation (git-fixes)
- commit 05c0e16</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235206">- IB/hfi1: Fix error return code in parse_platform_config() (git-fixes)
- commit 270bb46</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235207">- RDMA/bnxt_re: Fix error return code in bnxt_qplib_cq_process_terminal() (git-fixes)
- commit 76267d4</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235208">- RDMA/core: Unify RoCE check and re-factor code (git-fixes)
- commit e5e3d6f</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235209">- RDMA/cxgb4: add missing qpid increment (git-fixes)
- commit 591cdce</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235210">- RDMA/i40iw: Fix error unwinding when i40iw_hmc_sd_one fails (git-fixes)
- commit 2db1c84</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235211">- RDMA/siw: Fix a use after free in siw_alloc_mr (git-fixes)
- commit a7eff62</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235212">- RDMA/bnxt_re: Fix a double free in bnxt_qplib_alloc_res (git-fixes)
- commit 8c226d5</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235213">- RDMA/siw: Properly check send and receive CQ pointers (git-fixes)
- commit d84b45b</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235214">- RDMA/rxe: Clear all QP fields if creation failed (git-fixes)
- commit 07c8b4d</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235215">- RDMA/mlx5: Recover from fatal event in dual port mode (git-fixes)
- commit 875e0ed</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235216">- RDMA/core: Don't access cm_id after its destruction (git-fixes)
- commit 4a117e6</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235217">- RDMA/mlx5: Fix query DCT via DEVX (git-fixes)
- commit 4b56cb2</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235218">- RDMA/uverbs: Fix a NULL vs IS_ERR() bug (git-fixes)
- commit 82ce09e</changelog>
  <changelog author="msuchanek@suse.de" date="1644235219">- powerpc/perf: Fix power_pmu_disable to call
  clear_pmi_irq_pending only if PMI is pending (bsc#1156395).
- commit a08ca77</changelog>
</package>
<package pkgid="840f75e8c11fdc76f3228d636a77a1c93fe3a29188c257c1f931e5e7071d0bd7" name="dtb-zte" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="150300.59.43.1"/>
  <changelog author="tiwai@suse.de" date="1642593600">- Add cherry-picked IDs for qemu fw_cfg patches
- commit 8f947ad</changelog>
  <changelog author="msuchanek@suse.de" date="1642593601">- powerpc/pseries/cpuhp: delete add/remove_by_count code
  (bsc#1065729).
- powerpc/pseries/cpuhp: cache node corrections (bsc#1065729).
- commit 9c04898</changelog>
  <changelog author="tiwai@suse.de" date="1642593602">- dmaengine: at_xdmac: Fix at_xdmac_lld struct definition
  (git-fixes).
- dmaengine: at_xdmac: Fix lld view setting (git-fixes).
- dmaengine: at_xdmac: Fix concurrency over xfers_list
  (git-fixes).
- dmaengine: at_xdmac: Print debug message after realeasing the
  lock (git-fixes).
- dmaengine: at_xdmac: Don't start transactions at tx_submit level
  (git-fixes).
- Documentation: dmaengine: Correctly describe dmatest with
  channel unset (git-fixes).
- rpmsg: core: Clean up resources on announce_create failure
  (git-fixes).
- ACPI: APD: Check for NULL pointer after calling devm_ioremap()
  (git-fixes).
- Input: ti_am335x_tsc - fix STEPCONFIG setup for Z2 (git-fixes).
- Input: ti_am335x_tsc - set ADCREFM for X configuration
  (git-fixes).
- i3c: master: dw: check return of dw_i3c_master_get_free_pos()
  (git-fixes).
- i3c: fix incorrect address slot lookup on 64-bit (git-fixes).
- commit 3d8614c</changelog>
  <changelog author="msuchanek@suse.de" date="1642593603">- powerpc/prom_init: Fix improper check of prom_getprop()
  (bsc#1065729).
- commit 954fa51</changelog>
  <changelog author="msuchanek@suse.de" date="1642593604">- powerpc/perf: Fix PMU callbacks to clear pending PMI before
  resetting an overflown PMC (bsc#1156395).
- commit 8bdce1e</changelog>
  <changelog author="mbenes@suse.cz" date="1642593605">- livepatch: Avoid CPU hogging with cond_resched (bsc#1071995).
- commit 27c7aa0</changelog>
  <changelog author="msuchanek@suse.de" date="1642593606">- blacklist.conf: Add 79ca6f74dae0 tpm: fix Atmel TPM crash caused by too frequent queries
  Breaks kABI, there is no report of this problem affecting users, likely
  broken old TPM firmware.
- commit 4ea9f96</changelog>
  <changelog author="msuchanek@suse.de" date="1642593607">- Update patches.suse/tpm-fix-potential-NULL-pointer-access-in-tpm_del_cha.patch
  (git-fixes bsc#1193660 ltc#195634).
- commit 11ac3f6</changelog>
  <changelog author="lhenriques@suse.de" date="1642680000">- fuse: Pass correct lend value to filemap_write_and_wait_range()
  (bsc#1194953).
- commit d2355ea</changelog>
  <changelog author="msuchanek@suse.de" date="1642680001">- blacklist.conf: Add a2308836880b powerpc: Fix arch_stack_walk() to have
  running function as first entry
  The stacktrace interface in this kernel version does not provide the
  parameters used to implement the fix.
- commit ee041a3</changelog>
  <changelog author="msuchanek@suse.de" date="1642680002">- powerpc/64s: fix program check interrupt emergency stack path
  (bsc#1156395).
- commit a3c26ed</changelog>
  <changelog author="msuchanek@suse.de" date="1642680003">- powerpc/traps: do not enable irqs in _exception (bsc#1065729).
- powerpc: add interrupt_cond_local_irq_enable helper
  (bsc#1065729).
- commit 65f660c</changelog>
  <changelog author="msuchanek@suse.de" date="1642680004">- powerpc/pseries/mobility: ignore ibm, platform-facilities
  updates (bsc#1065729).
- commit b253330</changelog>
  <changelog author="rgoldwyn@suse.com" date="1642680005">- vfs: check fd has read access in kernel_read_file_from_fd() (bsc#1194888).
- commit 4717473</changelog>
  <changelog author="vkarasulli@suse.de" date="1642680006">- moxart: fix potential use-after-free on remove path
  (bsc#1194516).
- commit 3fae095</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1642766400">- sctp: account stream padding length for reconf chunk
  (bsc#1194985 CVE-2022-0322).
- commit a6cab40</changelog>
  <changelog author="ddiss@suse.de" date="1642766401">- vfs: fs_context: fix up param length parsing in
  legacy_parse_param (CVE-2022-0185 bsc#1194517).
- Rename and retag following upstream merge from:
  patches.suse/vfs-Out-of-bounds-write-of-heap-buffer-in-fs_context-c.patch
  to patches.suse/vfs-fs_context-fix-up-param-length-parsing-in-legacy.patch
- commit 33860f2</changelog>
  <changelog author="mkubecek@suse.cz" date="1642766402">- series.conf: cleanup
- move to "mainline soon" section:
  - patches.suse/0001-mmc-moxart_remove-Fix-UAF.patch
- commit 07d55c3</changelog>
  <changelog author="mkubecek@suse.cz" date="1642766403">- series.conf: refresh
- update upstream references and resort:
  - patches.suse/powerpc-fadump-Fix-inaccurate-CPU-state-info-in-vmco.patch
  - patches.suse/powerpc-handle-kdump-appropriately-with-crash_kexec_.patch
  - patches.suse/powerpc-watchdog-Avoid-holding-wd_smp_lock-over-prin.patch
  - patches.suse/powerpc-watchdog-Fix-missed-watchdog-reset-due-to-me.patch
  - patches.suse/powerpc-watchdog-Fix-wd_smp_last_reset_tb-reporting.patch
  - patches.suse/powerpc-watchdog-read-TB-close-to-where-it-is-used.patch
  - patches.suse/powerpc-watchdog-tighten-non-atomic-read-modify-writ.patch
- commit 72b7db7</changelog>
  <changelog author="osalvador@suse.de" date="1642939200">- Rename colliding patches before the next cve/linux-5.3 -&gt; SLE15-SP3 merge
- commit 84178b8</changelog>
</package>
<package pkgid="933a24de99d8418f25fbf9e09952e02c227eed4120c3481abb5096ea16489991" name="dtb-zte" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="150300.59.49.1"/>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235200">- IB/mlx5: Add missing error code (git-fixes)
- commit 06919f0</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235201">- RDMA/cxgb4: Fix adapter LE hash errors while destroying ipv6 listening server (git-fixes)
- commit 0f86491</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235202">- RDMA/addr: Be strict with gid size (git-fixes)
- commit 0b96850</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235203">- IB/isert: Fix a use after free in isert_connect_request (git-fixes)
- commit fa7abfc</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235204">- RDMA/core: Fix corrupted SL on passive side (git-fixes)
- commit d86d9cb</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235205">- IB/hfi1: Use kzalloc() for mmu_rb_handler allocation (git-fixes)
- commit 05c0e16</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235206">- IB/hfi1: Fix error return code in parse_platform_config() (git-fixes)
- commit 270bb46</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235207">- RDMA/bnxt_re: Fix error return code in bnxt_qplib_cq_process_terminal() (git-fixes)
- commit 76267d4</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235208">- RDMA/core: Unify RoCE check and re-factor code (git-fixes)
- commit e5e3d6f</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235209">- RDMA/cxgb4: add missing qpid increment (git-fixes)
- commit 591cdce</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235210">- RDMA/i40iw: Fix error unwinding when i40iw_hmc_sd_one fails (git-fixes)
- commit 2db1c84</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235211">- RDMA/siw: Fix a use after free in siw_alloc_mr (git-fixes)
- commit a7eff62</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235212">- RDMA/bnxt_re: Fix a double free in bnxt_qplib_alloc_res (git-fixes)
- commit 8c226d5</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235213">- RDMA/siw: Properly check send and receive CQ pointers (git-fixes)
- commit d84b45b</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235214">- RDMA/rxe: Clear all QP fields if creation failed (git-fixes)
- commit 07c8b4d</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235215">- RDMA/mlx5: Recover from fatal event in dual port mode (git-fixes)
- commit 875e0ed</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235216">- RDMA/core: Don't access cm_id after its destruction (git-fixes)
- commit 4a117e6</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235217">- RDMA/mlx5: Fix query DCT via DEVX (git-fixes)
- commit 4b56cb2</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235218">- RDMA/uverbs: Fix a NULL vs IS_ERR() bug (git-fixes)
- commit 82ce09e</changelog>
  <changelog author="msuchanek@suse.de" date="1644235219">- powerpc/perf: Fix power_pmu_disable to call
  clear_pmi_irq_pending only if PMI is pending (bsc#1156395).
- commit a08ca77</changelog>
</package>
<package pkgid="e30dfa4970ad9d05328fe5670f7aeac17054f4f65e5b8c70f41e999a0cd32c2a" name="fetchmail" arch="aarch64">
  <version epoch="0" ver="6.4.22" rel="20.26.1"/>
  <changelog author="dmueller@suse.com" date="1599220800">- update to 6.4.12:
  [#] REGRESSION FIX:
  * configure: fetchmail 6.4.9 and 6.4.10 would miss checking for TLS v1.2 and
  TLS v1.3 support if AC_LIB_LINKFLAGS came up with something such as
  /path/to/libssl.so, rather than -lssl. (For instance on FreeBSD)
  * configure: fetchmail 6.4.9's configure was unable to pick up OpenSSL
  if it wasn't announced by pkg-config, for instance, on FreeBSD</changelog>
  <changelog author="kukuk@suse.com" date="1608292800">- Don't require systemd
- Use tmpfiles for all files
- Use systemd macro for tmpfiles
- Don't delete home directory if the user stays
- Use sysusers config to create system user</changelog>
  <changelog author="dmueller@suse.com" date="1608379200">- update to 6.4.14:
  * sr:    ???????? ??????? (Miroslav Nikoli?) [Serbian]
  * Errors about lock file (= pidfile) creation could be lost in daemon
  configurations (-d option, or set daemon) when using syslog. Now they are also
  logged to syslog.  Found verifying a pidfile creation issue on 6.4.12 that was
  previously reported by Alex Hall of Automatic Distributors.
  * If the lock file cannot be removed (no write permission on directory), try
  to truncate it, and if that fails, report error.
  * If the pidfile was non-default, fetchmail -q or --quit would malfunction and
  claim no other fetchmail were running, because it did not read the
  configuration files or merge the command line options, thus it would look for
  the PID in the wrong file.</changelog>
  <changelog author="dmueller@suse.com" date="1609761600">- update to 6.4.15:
  * Fix a typo in the manual page reported by David McKelvie.
  * Fix cross-compilation with openssl, by Fabrice Fontaine. Merge request !23.
  * Fix truncation of SMTP PLAIN AUTH with ^ in credentials, by Earl Chew.</changelog>
  <changelog author="pmonreal@suse.com" date="1614600000">- update to 6.4.16:
  * fetchmail's --configdump, and fetchmailconf, lacked support for
    the sslcertfile option.
  * fetchmail --version [fetchmail -V] now queries and prints the
    SSL/TLS library's "SSL default trusted certificate" file or
    directory (mind the word "default"), where the OpenSSL-compatible
    TLS implementation will look for trusted root, meaning
    certification authority (CA), certificates.
  * fetchmail --version now prints version of the OpenSSL library
    that it was compiled against, and that it is using at runtime,
    and also the OPENSSL_DIR and OPENSSL_ENGINES_DIR (if available).</changelog>
  <changelog author="pmonreal@suse.com" date="1614600001">- Set the hostname for SNI when using TLS [bsc#1182807]
- Add fetchmail-SNI-hostname-support.patch</changelog>
  <changelog author="dmueller@suse.com" date="1617710400">- update to 6.4.18:
  * fetchmailconf: fetchmail 6.4.16 added --sslcertfile to the configuration dump,
    but fetchmailconf support was incomplete in Git 7349f124 and it could not
    parse sslcertfile, thus the user settings editor came up empty with console
    errors printed.  Fix configuration parser in fetchmailconf.
  * fetchmailconf: do not require fetchmail for -V. do not require Tk (Tkinter)
    for -d option. This is to fail more gracefully on incomplete installs.
  * TLS code: remove OPENSSL_NO_DEPRECATED macros to avoid portability issues
    with OpenSSL v3 - these are for development purposes, not production.
  * TLS futureproofing: use SSL_use_PrivateKey_file instead of
    SSL_use_RSAPrivateKey_file, the latter will be deprecated with OpenSSL v3,
    and the user's key file might be something else than RSA.
  * IMAP client: it used to leak memory for username and password when trying
    the LOGIN (password-based) authentication and encountered a timeout situation.
  * dist-tools/getstats.py: also counts lines in *.py files, shown above.
  * fetchmail.man: now mentions that you may need to add --ssl when specifying
    a TLS-wrapped port.
  * fetchmailconf: --version (-V) now prints the Python version in use.</changelog>
  <changelog author="dmueller@suse.com" date="1620475200">- update to 6.4.19:
  * fetchmailconf: properly catch and report option parsing errors
  * LMTP: do not try to validate the last component of a UNIX-domain LMTP socket
    as though it were a TCP port.</changelog>
  <changelog author="jeffm@suse.com" date="1620907200">- Backported support for OAUTH2 authentication from Fetchmail 7.0.
  - add imap oauthbearer support
  - support oauthbearer/xoauth2 with pop3
  - add passwordfile and passwordfd options
  - add contrib/fetchnmail-oauth2.py token acquisition utility
  - FAQ: list gmail options including oauthbearer and app password
  - give each ctl it's own copy of password
  - re-read passwordfile on every poll
  - add query_to64_outsize() utility function
  - Chase and integrate interface change.
  - oauth2.c: calculate and pass in correct buffer size to to64frombits()
  - Increase max password length to handle oauth tokens
  - Bump max. passwordlen to 10000 bytes.
  - Add README.OAUTH2
- Added patches:
  * fetchmail-add-imap-oauthbearer-support.patch
  * fetchmail-support-oauthbearer-xoauth2-with-pop3.patch
  * fetchmail-add-passwordfile-and-passwordfd-options.patch
  * fetchmail-add-contrib-fetchnmail-oauth2.py-token-acquisition-u.patch
  * fetchmail-FAQ-list-gmail-options-including-oauthbearer-and-app.patch
  * fetchmail-give-each-ctl-it-s-own-copy-of-password.patch
  * fetchmail-re-read-passwordfile-on-every-poll.patch
  * fetchmail-add-query_to64_outsize-utility-function.patch
  * fetchmail-chase-and-integrate-interface-change.patch
  * fetchmail-oauth2-c-calculate-and-pass-in-correct-buffer-size-to-to64frombits.patch
  * fetchmail-increase-max-password-length-to-handle-oauth-tokens.patch
  * fetchmail-bump-max-passwordlen-to-1bytes.patch
  * fetchmail-add-readme-oauth2-issue-27.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1626091200">- Change PASSWORDLEN from 64 to 256 [bsc#1188034]
  * Add fetchmail-PASSWORDLEN-256.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1627560000">- Update to 6.4.20: [bsc#1188875, CVE-2021-36386]
  * CVE-2021-36386: DoS or information disclosure in some configurations.
    When a log message exceeds c. 2 kByte in size, for instance,
    with very long header contents, and depending on verbosity
    option, fetchmail can crash or misreport each first log message
    that requires a buffer reallocation. fetchmail then reallocates
    memory and re-runs vsnprintf() without another call to va_start(),
    so it reads garbage. The exact impact depends on many factors
    around the compiler and operating system configurations used and
    the implementation details of the stdarg.h interfaces of the two
    functions mentioned before.</changelog>
  <changelog author="pmonreal@suse.com" date="1627560001">- Security fix: [bsc#1188875, CVE-2021-36386]
  * DoS or information disclosure in some configurations.
  * See also: https://www.fetchmail.info/fetchmail-SA-2021-01.txt
  * Add fetchmail-CVE-2021-36386.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1629806400">- Update to 6.4.21:
  * REGRESSION FIX: The new security fix in 6.4.20 for
    CVE-2021-36386 caused truncation of messages logged to
    buffered outputs, predominantly --logfile.</changelog>
  <changelog author="pmonreal@suse.com" date="1629806401">- Update to 6.4.21 in SLE-15-SP2:
  [jsc#SLE-18159, jsc#SLE-17903, jsc#SLE-18059]
  * Remove patches fixed upstream:
  - fetchmail-SNI-hostname-support.patch
  - fetchmail-CVE-2021-36386.patch
  - fetchmail-PASSWORDLEN-256.patch</changelog>
  <changelog author="jsegitz@suse.com" date="1631620800">- Added hardening to systemd service(s) (bsc#1181400). Modified:
  * fetchmail.service</changelog>
  <changelog author="pmonreal@suse.com" date="1633694400">- Security fix: [bsc#1190069, CVE-2021-39272]
  * Fix failure to enforce STARTTLS session encryption in some
    circumstances, such as a certain situation with IMAP and PREAUTH.
  * Advisory: https://www.fetchmail.info/fetchmail-SA-2021-02.txt
  * Add fetchmail-CVE-2021-39272.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1635336000">- Update to 6.4.22: [bsc#1190069, CVE-2021-39272]
  * OPENSSL AND LICENSING NOTE:
  - fetchmail 6.4.22 is compatible with OpenSSL 1.1.1 and 3.0.0.
    OpenSSL's licensing changed between these releases from dual
    OpenSSL/SSLeay license to Apache License v2.0, which is
    considered incompatible with GPL v2 by the FSF. For
    implications and details, see the file COPYING.
  * SECURITY FIXES:
  - CVE-2021-39272: fetchmail-SA-2021-02: On IMAP connections,
    without --ssl and with nonempty --sslproto, meaning that
    fetchmail is to enforce TLS, and when the server or an attacker
    sends a PREAUTH greeting, fetchmail used to continue an
    unencrypted connection. Now, log the error and abort the
    connection. --Recommendation for servers that support
    SSL/TLS-wrapped or "implicit" mode on a dedicated port
    (default 993): use --ssl, or the ssl user option in an rcfile.
  - On IMAP and POP3 connections, --auth ssh no longer prevents
    STARTTLS negotiation.
  - On IMAP connections, fetchmail does not permit overriding
    a server-side LOGINDISABLED with --auth password any more.
  - On POP3 connections, the possibility for RPA authentication
    (by probing with an AUTH command without arguments) no longer
    prevents STARTTLS negotiation.
  - For POP3 connections, only attempt RPA if the authentication
    type is "any".
  * BUG FIXES:
  - On IMAP connections, when AUTHENTICATE EXTERNAL fails and we
    have received the tagged (= final) response, do not send "*".
  - On IMAP connections, AUTHENTICATE EXTERNAL without username
    will properly send a "=" for protocol compliance.
  - On IMAP connections, AUTHENTICATE EXTERNAL will now check if
    the server advertised SASL-IR (RFC-4959) support and otherwise
    refuse (fetchmail &lt;= 6.4 has not supported and does not support
    the separate challenge/response with command continuation)
  - On IMAP connections, when --auth external is requested but not
    advertised by the server, log a proper error message.
  - Fetchmail no longer crashes when attempting a connection with
  - -plugin "" or --plugout "".
  - Fetchmail no longer leaks memory when processing the arguments
    of --plugin or --plugout on connections.
  - On POP3 connections, the CAPAbilities parser is now caseblind.
  - Fix segfault on configurations with "defaults ... no envelope".
    This is a regression in fetchmail 6.4.3 and happened when
    plugging memory leaks, which did not account for that the
    envelope parameter is special when set as "no envelope". The
    segfault happens in a constant strlen(-1), triggered by trusted
    local input =&gt; no vulnerability.
  - Fix program abort (SIGABRT) with "internal error" when invalid
    sslproto is given with OpenSSL 1.1.0 API compatible SSL
    implementations.
  * CHANGES:
  - IMAP: When fetchmail is in not-authenticated state and the server
    volunteers CAPABILITY information, use it and do not re-probe.
    (After STARTTLS, fetchmail must and will re-probe explicitly.)
  - For typical POP3/IMAP ports 110, 143, 993, 995, if port and --ssl
    option do not match, emit a warning and continue.
  - fetchmail.man and README.SSL were updated in line with
    RFC-8314/8996/8997 recommendations to prefer Implicit TLS
    (--ssl/ssl) and TLS v1.2 or newer, placing --sslproto tls1.2+
    more prominently. The defaults shall not change between 6.4.X
    releases for compatibility.
  * Rebase patches:
    fetchmail-add-imap-oauthbearer-support.patch
    fetchmail-add-query_to64_outsize-utility-function.patch
    fetchmail-support-oauthbearer-xoauth2-with-pop3.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1635336001">- Update to 6.4.22 in SLE-15-SP2:
  [jsc#SLE-18159, jsc#SLE-17903, jsc#SLE-18059]
  * Remove all python2 dependencies [bsc#1190896]
  * Remove fetchmail-CVE-2021-39272.patch fixed in the update</changelog>
  <changelog author="david.anes@suse.com" date="1641988800">- fix [bsc#1194203]:
  * Always create fetchmail group, even if the user is already
  present, as a leftover from Leap 15.2 upgrade. This may happen
  also if user is messing with groups/users directly or upgrading
  from even an older fetchmail versions.</changelog>
  <changelog author="david.anes@suse.com" date="1643371200">- fix [bsc#1193894]
  * Restore autoprobe functionality behaviour as per 6.3.x version
  * Added patch fetchmail-restore-auto-probe-behaviour.patch</changelog>
</package>
<package pkgid="000988cdce3e04f1cf699815d864e9787ff31e8291781e7c1839a5073c4ebad4" name="fetchmail" arch="ppc64le">
  <version epoch="0" ver="6.4.22" rel="20.26.1"/>
  <changelog author="dmueller@suse.com" date="1599220800">- update to 6.4.12:
  [#] REGRESSION FIX:
  * configure: fetchmail 6.4.9 and 6.4.10 would miss checking for TLS v1.2 and
  TLS v1.3 support if AC_LIB_LINKFLAGS came up with something such as
  /path/to/libssl.so, rather than -lssl. (For instance on FreeBSD)
  * configure: fetchmail 6.4.9's configure was unable to pick up OpenSSL
  if it wasn't announced by pkg-config, for instance, on FreeBSD</changelog>
  <changelog author="kukuk@suse.com" date="1608292800">- Don't require systemd
- Use tmpfiles for all files
- Use systemd macro for tmpfiles
- Don't delete home directory if the user stays
- Use sysusers config to create system user</changelog>
  <changelog author="dmueller@suse.com" date="1608379200">- update to 6.4.14:
  * sr:    ???????? ??????? (Miroslav Nikoli?) [Serbian]
  * Errors about lock file (= pidfile) creation could be lost in daemon
  configurations (-d option, or set daemon) when using syslog. Now they are also
  logged to syslog.  Found verifying a pidfile creation issue on 6.4.12 that was
  previously reported by Alex Hall of Automatic Distributors.
  * If the lock file cannot be removed (no write permission on directory), try
  to truncate it, and if that fails, report error.
  * If the pidfile was non-default, fetchmail -q or --quit would malfunction and
  claim no other fetchmail were running, because it did not read the
  configuration files or merge the command line options, thus it would look for
  the PID in the wrong file.</changelog>
  <changelog author="dmueller@suse.com" date="1609761600">- update to 6.4.15:
  * Fix a typo in the manual page reported by David McKelvie.
  * Fix cross-compilation with openssl, by Fabrice Fontaine. Merge request !23.
  * Fix truncation of SMTP PLAIN AUTH with ^ in credentials, by Earl Chew.</changelog>
  <changelog author="pmonreal@suse.com" date="1614600000">- update to 6.4.16:
  * fetchmail's --configdump, and fetchmailconf, lacked support for
    the sslcertfile option.
  * fetchmail --version [fetchmail -V] now queries and prints the
    SSL/TLS library's "SSL default trusted certificate" file or
    directory (mind the word "default"), where the OpenSSL-compatible
    TLS implementation will look for trusted root, meaning
    certification authority (CA), certificates.
  * fetchmail --version now prints version of the OpenSSL library
    that it was compiled against, and that it is using at runtime,
    and also the OPENSSL_DIR and OPENSSL_ENGINES_DIR (if available).</changelog>
  <changelog author="pmonreal@suse.com" date="1614600001">- Set the hostname for SNI when using TLS [bsc#1182807]
- Add fetchmail-SNI-hostname-support.patch</changelog>
  <changelog author="dmueller@suse.com" date="1617710400">- update to 6.4.18:
  * fetchmailconf: fetchmail 6.4.16 added --sslcertfile to the configuration dump,
    but fetchmailconf support was incomplete in Git 7349f124 and it could not
    parse sslcertfile, thus the user settings editor came up empty with console
    errors printed.  Fix configuration parser in fetchmailconf.
  * fetchmailconf: do not require fetchmail for -V. do not require Tk (Tkinter)
    for -d option. This is to fail more gracefully on incomplete installs.
  * TLS code: remove OPENSSL_NO_DEPRECATED macros to avoid portability issues
    with OpenSSL v3 - these are for development purposes, not production.
  * TLS futureproofing: use SSL_use_PrivateKey_file instead of
    SSL_use_RSAPrivateKey_file, the latter will be deprecated with OpenSSL v3,
    and the user's key file might be something else than RSA.
  * IMAP client: it used to leak memory for username and password when trying
    the LOGIN (password-based) authentication and encountered a timeout situation.
  * dist-tools/getstats.py: also counts lines in *.py files, shown above.
  * fetchmail.man: now mentions that you may need to add --ssl when specifying
    a TLS-wrapped port.
  * fetchmailconf: --version (-V) now prints the Python version in use.</changelog>
  <changelog author="dmueller@suse.com" date="1620475200">- update to 6.4.19:
  * fetchmailconf: properly catch and report option parsing errors
  * LMTP: do not try to validate the last component of a UNIX-domain LMTP socket
    as though it were a TCP port.</changelog>
  <changelog author="jeffm@suse.com" date="1620907200">- Backported support for OAUTH2 authentication from Fetchmail 7.0.
  - add imap oauthbearer support
  - support oauthbearer/xoauth2 with pop3
  - add passwordfile and passwordfd options
  - add contrib/fetchnmail-oauth2.py token acquisition utility
  - FAQ: list gmail options including oauthbearer and app password
  - give each ctl it's own copy of password
  - re-read passwordfile on every poll
  - add query_to64_outsize() utility function
  - Chase and integrate interface change.
  - oauth2.c: calculate and pass in correct buffer size to to64frombits()
  - Increase max password length to handle oauth tokens
  - Bump max. passwordlen to 10000 bytes.
  - Add README.OAUTH2
- Added patches:
  * fetchmail-add-imap-oauthbearer-support.patch
  * fetchmail-support-oauthbearer-xoauth2-with-pop3.patch
  * fetchmail-add-passwordfile-and-passwordfd-options.patch
  * fetchmail-add-contrib-fetchnmail-oauth2.py-token-acquisition-u.patch
  * fetchmail-FAQ-list-gmail-options-including-oauthbearer-and-app.patch
  * fetchmail-give-each-ctl-it-s-own-copy-of-password.patch
  * fetchmail-re-read-passwordfile-on-every-poll.patch
  * fetchmail-add-query_to64_outsize-utility-function.patch
  * fetchmail-chase-and-integrate-interface-change.patch
  * fetchmail-oauth2-c-calculate-and-pass-in-correct-buffer-size-to-to64frombits.patch
  * fetchmail-increase-max-password-length-to-handle-oauth-tokens.patch
  * fetchmail-bump-max-passwordlen-to-1bytes.patch
  * fetchmail-add-readme-oauth2-issue-27.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1626091200">- Change PASSWORDLEN from 64 to 256 [bsc#1188034]
  * Add fetchmail-PASSWORDLEN-256.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1627560000">- Update to 6.4.20: [bsc#1188875, CVE-2021-36386]
  * CVE-2021-36386: DoS or information disclosure in some configurations.
    When a log message exceeds c. 2 kByte in size, for instance,
    with very long header contents, and depending on verbosity
    option, fetchmail can crash or misreport each first log message
    that requires a buffer reallocation. fetchmail then reallocates
    memory and re-runs vsnprintf() without another call to va_start(),
    so it reads garbage. The exact impact depends on many factors
    around the compiler and operating system configurations used and
    the implementation details of the stdarg.h interfaces of the two
    functions mentioned before.</changelog>
  <changelog author="pmonreal@suse.com" date="1627560001">- Security fix: [bsc#1188875, CVE-2021-36386]
  * DoS or information disclosure in some configurations.
  * See also: https://www.fetchmail.info/fetchmail-SA-2021-01.txt
  * Add fetchmail-CVE-2021-36386.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1629806400">- Update to 6.4.21:
  * REGRESSION FIX: The new security fix in 6.4.20 for
    CVE-2021-36386 caused truncation of messages logged to
    buffered outputs, predominantly --logfile.</changelog>
  <changelog author="pmonreal@suse.com" date="1629806401">- Update to 6.4.21 in SLE-15-SP2:
  [jsc#SLE-18159, jsc#SLE-17903, jsc#SLE-18059]
  * Remove patches fixed upstream:
  - fetchmail-SNI-hostname-support.patch
  - fetchmail-CVE-2021-36386.patch
  - fetchmail-PASSWORDLEN-256.patch</changelog>
  <changelog author="jsegitz@suse.com" date="1631620800">- Added hardening to systemd service(s) (bsc#1181400). Modified:
  * fetchmail.service</changelog>
  <changelog author="pmonreal@suse.com" date="1633694400">- Security fix: [bsc#1190069, CVE-2021-39272]
  * Fix failure to enforce STARTTLS session encryption in some
    circumstances, such as a certain situation with IMAP and PREAUTH.
  * Advisory: https://www.fetchmail.info/fetchmail-SA-2021-02.txt
  * Add fetchmail-CVE-2021-39272.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1635336000">- Update to 6.4.22: [bsc#1190069, CVE-2021-39272]
  * OPENSSL AND LICENSING NOTE:
  - fetchmail 6.4.22 is compatible with OpenSSL 1.1.1 and 3.0.0.
    OpenSSL's licensing changed between these releases from dual
    OpenSSL/SSLeay license to Apache License v2.0, which is
    considered incompatible with GPL v2 by the FSF. For
    implications and details, see the file COPYING.
  * SECURITY FIXES:
  - CVE-2021-39272: fetchmail-SA-2021-02: On IMAP connections,
    without --ssl and with nonempty --sslproto, meaning that
    fetchmail is to enforce TLS, and when the server or an attacker
    sends a PREAUTH greeting, fetchmail used to continue an
    unencrypted connection. Now, log the error and abort the
    connection. --Recommendation for servers that support
    SSL/TLS-wrapped or "implicit" mode on a dedicated port
    (default 993): use --ssl, or the ssl user option in an rcfile.
  - On IMAP and POP3 connections, --auth ssh no longer prevents
    STARTTLS negotiation.
  - On IMAP connections, fetchmail does not permit overriding
    a server-side LOGINDISABLED with --auth password any more.
  - On POP3 connections, the possibility for RPA authentication
    (by probing with an AUTH command without arguments) no longer
    prevents STARTTLS negotiation.
  - For POP3 connections, only attempt RPA if the authentication
    type is "any".
  * BUG FIXES:
  - On IMAP connections, when AUTHENTICATE EXTERNAL fails and we
    have received the tagged (= final) response, do not send "*".
  - On IMAP connections, AUTHENTICATE EXTERNAL without username
    will properly send a "=" for protocol compliance.
  - On IMAP connections, AUTHENTICATE EXTERNAL will now check if
    the server advertised SASL-IR (RFC-4959) support and otherwise
    refuse (fetchmail &lt;= 6.4 has not supported and does not support
    the separate challenge/response with command continuation)
  - On IMAP connections, when --auth external is requested but not
    advertised by the server, log a proper error message.
  - Fetchmail no longer crashes when attempting a connection with
  - -plugin "" or --plugout "".
  - Fetchmail no longer leaks memory when processing the arguments
    of --plugin or --plugout on connections.
  - On POP3 connections, the CAPAbilities parser is now caseblind.
  - Fix segfault on configurations with "defaults ... no envelope".
    This is a regression in fetchmail 6.4.3 and happened when
    plugging memory leaks, which did not account for that the
    envelope parameter is special when set as "no envelope". The
    segfault happens in a constant strlen(-1), triggered by trusted
    local input =&gt; no vulnerability.
  - Fix program abort (SIGABRT) with "internal error" when invalid
    sslproto is given with OpenSSL 1.1.0 API compatible SSL
    implementations.
  * CHANGES:
  - IMAP: When fetchmail is in not-authenticated state and the server
    volunteers CAPABILITY information, use it and do not re-probe.
    (After STARTTLS, fetchmail must and will re-probe explicitly.)
  - For typical POP3/IMAP ports 110, 143, 993, 995, if port and --ssl
    option do not match, emit a warning and continue.
  - fetchmail.man and README.SSL were updated in line with
    RFC-8314/8996/8997 recommendations to prefer Implicit TLS
    (--ssl/ssl) and TLS v1.2 or newer, placing --sslproto tls1.2+
    more prominently. The defaults shall not change between 6.4.X
    releases for compatibility.
  * Rebase patches:
    fetchmail-add-imap-oauthbearer-support.patch
    fetchmail-add-query_to64_outsize-utility-function.patch
    fetchmail-support-oauthbearer-xoauth2-with-pop3.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1635336001">- Update to 6.4.22 in SLE-15-SP2:
  [jsc#SLE-18159, jsc#SLE-17903, jsc#SLE-18059]
  * Remove all python2 dependencies [bsc#1190896]
  * Remove fetchmail-CVE-2021-39272.patch fixed in the update</changelog>
  <changelog author="david.anes@suse.com" date="1641988800">- fix [bsc#1194203]:
  * Always create fetchmail group, even if the user is already
  present, as a leftover from Leap 15.2 upgrade. This may happen
  also if user is messing with groups/users directly or upgrading
  from even an older fetchmail versions.</changelog>
  <changelog author="david.anes@suse.com" date="1643371200">- fix [bsc#1193894]
  * Restore autoprobe functionality behaviour as per 6.3.x version
  * Added patch fetchmail-restore-auto-probe-behaviour.patch</changelog>
</package>
<package pkgid="406aa7a01bec49fb7d4f1e3f7e031d62b44c3a6cc19b37a256d2792806be8431" name="fetchmail" arch="s390x">
  <version epoch="0" ver="6.4.22" rel="20.26.1"/>
  <changelog author="dmueller@suse.com" date="1599220800">- update to 6.4.12:
  [#] REGRESSION FIX:
  * configure: fetchmail 6.4.9 and 6.4.10 would miss checking for TLS v1.2 and
  TLS v1.3 support if AC_LIB_LINKFLAGS came up with something such as
  /path/to/libssl.so, rather than -lssl. (For instance on FreeBSD)
  * configure: fetchmail 6.4.9's configure was unable to pick up OpenSSL
  if it wasn't announced by pkg-config, for instance, on FreeBSD</changelog>
  <changelog author="kukuk@suse.com" date="1608292800">- Don't require systemd
- Use tmpfiles for all files
- Use systemd macro for tmpfiles
- Don't delete home directory if the user stays
- Use sysusers config to create system user</changelog>
  <changelog author="dmueller@suse.com" date="1608379200">- update to 6.4.14:
  * sr:    ???????? ??????? (Miroslav Nikoli?) [Serbian]
  * Errors about lock file (= pidfile) creation could be lost in daemon
  configurations (-d option, or set daemon) when using syslog. Now they are also
  logged to syslog.  Found verifying a pidfile creation issue on 6.4.12 that was
  previously reported by Alex Hall of Automatic Distributors.
  * If the lock file cannot be removed (no write permission on directory), try
  to truncate it, and if that fails, report error.
  * If the pidfile was non-default, fetchmail -q or --quit would malfunction and
  claim no other fetchmail were running, because it did not read the
  configuration files or merge the command line options, thus it would look for
  the PID in the wrong file.</changelog>
  <changelog author="dmueller@suse.com" date="1609761600">- update to 6.4.15:
  * Fix a typo in the manual page reported by David McKelvie.
  * Fix cross-compilation with openssl, by Fabrice Fontaine. Merge request !23.
  * Fix truncation of SMTP PLAIN AUTH with ^ in credentials, by Earl Chew.</changelog>
  <changelog author="pmonreal@suse.com" date="1614600000">- update to 6.4.16:
  * fetchmail's --configdump, and fetchmailconf, lacked support for
    the sslcertfile option.
  * fetchmail --version [fetchmail -V] now queries and prints the
    SSL/TLS library's "SSL default trusted certificate" file or
    directory (mind the word "default"), where the OpenSSL-compatible
    TLS implementation will look for trusted root, meaning
    certification authority (CA), certificates.
  * fetchmail --version now prints version of the OpenSSL library
    that it was compiled against, and that it is using at runtime,
    and also the OPENSSL_DIR and OPENSSL_ENGINES_DIR (if available).</changelog>
  <changelog author="pmonreal@suse.com" date="1614600001">- Set the hostname for SNI when using TLS [bsc#1182807]
- Add fetchmail-SNI-hostname-support.patch</changelog>
  <changelog author="dmueller@suse.com" date="1617710400">- update to 6.4.18:
  * fetchmailconf: fetchmail 6.4.16 added --sslcertfile to the configuration dump,
    but fetchmailconf support was incomplete in Git 7349f124 and it could not
    parse sslcertfile, thus the user settings editor came up empty with console
    errors printed.  Fix configuration parser in fetchmailconf.
  * fetchmailconf: do not require fetchmail for -V. do not require Tk (Tkinter)
    for -d option. This is to fail more gracefully on incomplete installs.
  * TLS code: remove OPENSSL_NO_DEPRECATED macros to avoid portability issues
    with OpenSSL v3 - these are for development purposes, not production.
  * TLS futureproofing: use SSL_use_PrivateKey_file instead of
    SSL_use_RSAPrivateKey_file, the latter will be deprecated with OpenSSL v3,
    and the user's key file might be something else than RSA.
  * IMAP client: it used to leak memory for username and password when trying
    the LOGIN (password-based) authentication and encountered a timeout situation.
  * dist-tools/getstats.py: also counts lines in *.py files, shown above.
  * fetchmail.man: now mentions that you may need to add --ssl when specifying
    a TLS-wrapped port.
  * fetchmailconf: --version (-V) now prints the Python version in use.</changelog>
  <changelog author="dmueller@suse.com" date="1620475200">- update to 6.4.19:
  * fetchmailconf: properly catch and report option parsing errors
  * LMTP: do not try to validate the last component of a UNIX-domain LMTP socket
    as though it were a TCP port.</changelog>
  <changelog author="jeffm@suse.com" date="1620907200">- Backported support for OAUTH2 authentication from Fetchmail 7.0.
  - add imap oauthbearer support
  - support oauthbearer/xoauth2 with pop3
  - add passwordfile and passwordfd options
  - add contrib/fetchnmail-oauth2.py token acquisition utility
  - FAQ: list gmail options including oauthbearer and app password
  - give each ctl it's own copy of password
  - re-read passwordfile on every poll
  - add query_to64_outsize() utility function
  - Chase and integrate interface change.
  - oauth2.c: calculate and pass in correct buffer size to to64frombits()
  - Increase max password length to handle oauth tokens
  - Bump max. passwordlen to 10000 bytes.
  - Add README.OAUTH2
- Added patches:
  * fetchmail-add-imap-oauthbearer-support.patch
  * fetchmail-support-oauthbearer-xoauth2-with-pop3.patch
  * fetchmail-add-passwordfile-and-passwordfd-options.patch
  * fetchmail-add-contrib-fetchnmail-oauth2.py-token-acquisition-u.patch
  * fetchmail-FAQ-list-gmail-options-including-oauthbearer-and-app.patch
  * fetchmail-give-each-ctl-it-s-own-copy-of-password.patch
  * fetchmail-re-read-passwordfile-on-every-poll.patch
  * fetchmail-add-query_to64_outsize-utility-function.patch
  * fetchmail-chase-and-integrate-interface-change.patch
  * fetchmail-oauth2-c-calculate-and-pass-in-correct-buffer-size-to-to64frombits.patch
  * fetchmail-increase-max-password-length-to-handle-oauth-tokens.patch
  * fetchmail-bump-max-passwordlen-to-1bytes.patch
  * fetchmail-add-readme-oauth2-issue-27.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1626091200">- Change PASSWORDLEN from 64 to 256 [bsc#1188034]
  * Add fetchmail-PASSWORDLEN-256.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1627560000">- Update to 6.4.20: [bsc#1188875, CVE-2021-36386]
  * CVE-2021-36386: DoS or information disclosure in some configurations.
    When a log message exceeds c. 2 kByte in size, for instance,
    with very long header contents, and depending on verbosity
    option, fetchmail can crash or misreport each first log message
    that requires a buffer reallocation. fetchmail then reallocates
    memory and re-runs vsnprintf() without another call to va_start(),
    so it reads garbage. The exact impact depends on many factors
    around the compiler and operating system configurations used and
    the implementation details of the stdarg.h interfaces of the two
    functions mentioned before.</changelog>
  <changelog author="pmonreal@suse.com" date="1627560001">- Security fix: [bsc#1188875, CVE-2021-36386]
  * DoS or information disclosure in some configurations.
  * See also: https://www.fetchmail.info/fetchmail-SA-2021-01.txt
  * Add fetchmail-CVE-2021-36386.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1629806400">- Update to 6.4.21:
  * REGRESSION FIX: The new security fix in 6.4.20 for
    CVE-2021-36386 caused truncation of messages logged to
    buffered outputs, predominantly --logfile.</changelog>
  <changelog author="pmonreal@suse.com" date="1629806401">- Update to 6.4.21 in SLE-15-SP2:
  [jsc#SLE-18159, jsc#SLE-17903, jsc#SLE-18059]
  * Remove patches fixed upstream:
  - fetchmail-SNI-hostname-support.patch
  - fetchmail-CVE-2021-36386.patch
  - fetchmail-PASSWORDLEN-256.patch</changelog>
  <changelog author="jsegitz@suse.com" date="1631620800">- Added hardening to systemd service(s) (bsc#1181400). Modified:
  * fetchmail.service</changelog>
  <changelog author="pmonreal@suse.com" date="1633694400">- Security fix: [bsc#1190069, CVE-2021-39272]
  * Fix failure to enforce STARTTLS session encryption in some
    circumstances, such as a certain situation with IMAP and PREAUTH.
  * Advisory: https://www.fetchmail.info/fetchmail-SA-2021-02.txt
  * Add fetchmail-CVE-2021-39272.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1635336000">- Update to 6.4.22: [bsc#1190069, CVE-2021-39272]
  * OPENSSL AND LICENSING NOTE:
  - fetchmail 6.4.22 is compatible with OpenSSL 1.1.1 and 3.0.0.
    OpenSSL's licensing changed between these releases from dual
    OpenSSL/SSLeay license to Apache License v2.0, which is
    considered incompatible with GPL v2 by the FSF. For
    implications and details, see the file COPYING.
  * SECURITY FIXES:
  - CVE-2021-39272: fetchmail-SA-2021-02: On IMAP connections,
    without --ssl and with nonempty --sslproto, meaning that
    fetchmail is to enforce TLS, and when the server or an attacker
    sends a PREAUTH greeting, fetchmail used to continue an
    unencrypted connection. Now, log the error and abort the
    connection. --Recommendation for servers that support
    SSL/TLS-wrapped or "implicit" mode on a dedicated port
    (default 993): use --ssl, or the ssl user option in an rcfile.
  - On IMAP and POP3 connections, --auth ssh no longer prevents
    STARTTLS negotiation.
  - On IMAP connections, fetchmail does not permit overriding
    a server-side LOGINDISABLED with --auth password any more.
  - On POP3 connections, the possibility for RPA authentication
    (by probing with an AUTH command without arguments) no longer
    prevents STARTTLS negotiation.
  - For POP3 connections, only attempt RPA if the authentication
    type is "any".
  * BUG FIXES:
  - On IMAP connections, when AUTHENTICATE EXTERNAL fails and we
    have received the tagged (= final) response, do not send "*".
  - On IMAP connections, AUTHENTICATE EXTERNAL without username
    will properly send a "=" for protocol compliance.
  - On IMAP connections, AUTHENTICATE EXTERNAL will now check if
    the server advertised SASL-IR (RFC-4959) support and otherwise
    refuse (fetchmail &lt;= 6.4 has not supported and does not support
    the separate challenge/response with command continuation)
  - On IMAP connections, when --auth external is requested but not
    advertised by the server, log a proper error message.
  - Fetchmail no longer crashes when attempting a connection with
  - -plugin "" or --plugout "".
  - Fetchmail no longer leaks memory when processing the arguments
    of --plugin or --plugout on connections.
  - On POP3 connections, the CAPAbilities parser is now caseblind.
  - Fix segfault on configurations with "defaults ... no envelope".
    This is a regression in fetchmail 6.4.3 and happened when
    plugging memory leaks, which did not account for that the
    envelope parameter is special when set as "no envelope". The
    segfault happens in a constant strlen(-1), triggered by trusted
    local input =&gt; no vulnerability.
  - Fix program abort (SIGABRT) with "internal error" when invalid
    sslproto is given with OpenSSL 1.1.0 API compatible SSL
    implementations.
  * CHANGES:
  - IMAP: When fetchmail is in not-authenticated state and the server
    volunteers CAPABILITY information, use it and do not re-probe.
    (After STARTTLS, fetchmail must and will re-probe explicitly.)
  - For typical POP3/IMAP ports 110, 143, 993, 995, if port and --ssl
    option do not match, emit a warning and continue.
  - fetchmail.man and README.SSL were updated in line with
    RFC-8314/8996/8997 recommendations to prefer Implicit TLS
    (--ssl/ssl) and TLS v1.2 or newer, placing --sslproto tls1.2+
    more prominently. The defaults shall not change between 6.4.X
    releases for compatibility.
  * Rebase patches:
    fetchmail-add-imap-oauthbearer-support.patch
    fetchmail-add-query_to64_outsize-utility-function.patch
    fetchmail-support-oauthbearer-xoauth2-with-pop3.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1635336001">- Update to 6.4.22 in SLE-15-SP2:
  [jsc#SLE-18159, jsc#SLE-17903, jsc#SLE-18059]
  * Remove all python2 dependencies [bsc#1190896]
  * Remove fetchmail-CVE-2021-39272.patch fixed in the update</changelog>
  <changelog author="david.anes@suse.com" date="1641988800">- fix [bsc#1194203]:
  * Always create fetchmail group, even if the user is already
  present, as a leftover from Leap 15.2 upgrade. This may happen
  also if user is messing with groups/users directly or upgrading
  from even an older fetchmail versions.</changelog>
  <changelog author="david.anes@suse.com" date="1643371200">- fix [bsc#1193894]
  * Restore autoprobe functionality behaviour as per 6.3.x version
  * Added patch fetchmail-restore-auto-probe-behaviour.patch</changelog>
</package>
<package pkgid="ab4794d6106bdf931d3fe6310d2c96cc0bafaeb0ed55e1c574510a9906bbbd8a" name="fetchmail" arch="src">
  <version epoch="0" ver="6.4.22" rel="20.26.1"/>
  <changelog author="dmueller@suse.com" date="1599220800">- update to 6.4.12:
  [#] REGRESSION FIX:
  * configure: fetchmail 6.4.9 and 6.4.10 would miss checking for TLS v1.2 and
  TLS v1.3 support if AC_LIB_LINKFLAGS came up with something such as
  /path/to/libssl.so, rather than -lssl. (For instance on FreeBSD)
  * configure: fetchmail 6.4.9's configure was unable to pick up OpenSSL
  if it wasn't announced by pkg-config, for instance, on FreeBSD</changelog>
  <changelog author="kukuk@suse.com" date="1608292800">- Don't require systemd
- Use tmpfiles for all files
- Use systemd macro for tmpfiles
- Don't delete home directory if the user stays
- Use sysusers config to create system user</changelog>
  <changelog author="dmueller@suse.com" date="1608379200">- update to 6.4.14:
  * sr:    ???????? ??????? (Miroslav Nikoli?) [Serbian]
  * Errors about lock file (= pidfile) creation could be lost in daemon
  configurations (-d option, or set daemon) when using syslog. Now they are also
  logged to syslog.  Found verifying a pidfile creation issue on 6.4.12 that was
  previously reported by Alex Hall of Automatic Distributors.
  * If the lock file cannot be removed (no write permission on directory), try
  to truncate it, and if that fails, report error.
  * If the pidfile was non-default, fetchmail -q or --quit would malfunction and
  claim no other fetchmail were running, because it did not read the
  configuration files or merge the command line options, thus it would look for
  the PID in the wrong file.</changelog>
  <changelog author="dmueller@suse.com" date="1609761600">- update to 6.4.15:
  * Fix a typo in the manual page reported by David McKelvie.
  * Fix cross-compilation with openssl, by Fabrice Fontaine. Merge request !23.
  * Fix truncation of SMTP PLAIN AUTH with ^ in credentials, by Earl Chew.</changelog>
  <changelog author="pmonreal@suse.com" date="1614600000">- update to 6.4.16:
  * fetchmail's --configdump, and fetchmailconf, lacked support for
    the sslcertfile option.
  * fetchmail --version [fetchmail -V] now queries and prints the
    SSL/TLS library's "SSL default trusted certificate" file or
    directory (mind the word "default"), where the OpenSSL-compatible
    TLS implementation will look for trusted root, meaning
    certification authority (CA), certificates.
  * fetchmail --version now prints version of the OpenSSL library
    that it was compiled against, and that it is using at runtime,
    and also the OPENSSL_DIR and OPENSSL_ENGINES_DIR (if available).</changelog>
  <changelog author="pmonreal@suse.com" date="1614600001">- Set the hostname for SNI when using TLS [bsc#1182807]
- Add fetchmail-SNI-hostname-support.patch</changelog>
  <changelog author="dmueller@suse.com" date="1617710400">- update to 6.4.18:
  * fetchmailconf: fetchmail 6.4.16 added --sslcertfile to the configuration dump,
    but fetchmailconf support was incomplete in Git 7349f124 and it could not
    parse sslcertfile, thus the user settings editor came up empty with console
    errors printed.  Fix configuration parser in fetchmailconf.
  * fetchmailconf: do not require fetchmail for -V. do not require Tk (Tkinter)
    for -d option. This is to fail more gracefully on incomplete installs.
  * TLS code: remove OPENSSL_NO_DEPRECATED macros to avoid portability issues
    with OpenSSL v3 - these are for development purposes, not production.
  * TLS futureproofing: use SSL_use_PrivateKey_file instead of
    SSL_use_RSAPrivateKey_file, the latter will be deprecated with OpenSSL v3,
    and the user's key file might be something else than RSA.
  * IMAP client: it used to leak memory for username and password when trying
    the LOGIN (password-based) authentication and encountered a timeout situation.
  * dist-tools/getstats.py: also counts lines in *.py files, shown above.
  * fetchmail.man: now mentions that you may need to add --ssl when specifying
    a TLS-wrapped port.
  * fetchmailconf: --version (-V) now prints the Python version in use.</changelog>
  <changelog author="dmueller@suse.com" date="1620475200">- update to 6.4.19:
  * fetchmailconf: properly catch and report option parsing errors
  * LMTP: do not try to validate the last component of a UNIX-domain LMTP socket
    as though it were a TCP port.</changelog>
  <changelog author="jeffm@suse.com" date="1620907200">- Backported support for OAUTH2 authentication from Fetchmail 7.0.
  - add imap oauthbearer support
  - support oauthbearer/xoauth2 with pop3
  - add passwordfile and passwordfd options
  - add contrib/fetchnmail-oauth2.py token acquisition utility
  - FAQ: list gmail options including oauthbearer and app password
  - give each ctl it's own copy of password
  - re-read passwordfile on every poll
  - add query_to64_outsize() utility function
  - Chase and integrate interface change.
  - oauth2.c: calculate and pass in correct buffer size to to64frombits()
  - Increase max password length to handle oauth tokens
  - Bump max. passwordlen to 10000 bytes.
  - Add README.OAUTH2
- Added patches:
  * fetchmail-add-imap-oauthbearer-support.patch
  * fetchmail-support-oauthbearer-xoauth2-with-pop3.patch
  * fetchmail-add-passwordfile-and-passwordfd-options.patch
  * fetchmail-add-contrib-fetchnmail-oauth2.py-token-acquisition-u.patch
  * fetchmail-FAQ-list-gmail-options-including-oauthbearer-and-app.patch
  * fetchmail-give-each-ctl-it-s-own-copy-of-password.patch
  * fetchmail-re-read-passwordfile-on-every-poll.patch
  * fetchmail-add-query_to64_outsize-utility-function.patch
  * fetchmail-chase-and-integrate-interface-change.patch
  * fetchmail-oauth2-c-calculate-and-pass-in-correct-buffer-size-to-to64frombits.patch
  * fetchmail-increase-max-password-length-to-handle-oauth-tokens.patch
  * fetchmail-bump-max-passwordlen-to-1bytes.patch
  * fetchmail-add-readme-oauth2-issue-27.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1626091200">- Change PASSWORDLEN from 64 to 256 [bsc#1188034]
  * Add fetchmail-PASSWORDLEN-256.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1627560000">- Update to 6.4.20: [bsc#1188875, CVE-2021-36386]
  * CVE-2021-36386: DoS or information disclosure in some configurations.
    When a log message exceeds c. 2 kByte in size, for instance,
    with very long header contents, and depending on verbosity
    option, fetchmail can crash or misreport each first log message
    that requires a buffer reallocation. fetchmail then reallocates
    memory and re-runs vsnprintf() without another call to va_start(),
    so it reads garbage. The exact impact depends on many factors
    around the compiler and operating system configurations used and
    the implementation details of the stdarg.h interfaces of the two
    functions mentioned before.</changelog>
  <changelog author="pmonreal@suse.com" date="1627560001">- Security fix: [bsc#1188875, CVE-2021-36386]
  * DoS or information disclosure in some configurations.
  * See also: https://www.fetchmail.info/fetchmail-SA-2021-01.txt
  * Add fetchmail-CVE-2021-36386.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1629806400">- Update to 6.4.21:
  * REGRESSION FIX: The new security fix in 6.4.20 for
    CVE-2021-36386 caused truncation of messages logged to
    buffered outputs, predominantly --logfile.</changelog>
  <changelog author="pmonreal@suse.com" date="1629806401">- Update to 6.4.21 in SLE-15-SP2:
  [jsc#SLE-18159, jsc#SLE-17903, jsc#SLE-18059]
  * Remove patches fixed upstream:
  - fetchmail-SNI-hostname-support.patch
  - fetchmail-CVE-2021-36386.patch
  - fetchmail-PASSWORDLEN-256.patch</changelog>
  <changelog author="jsegitz@suse.com" date="1631620800">- Added hardening to systemd service(s) (bsc#1181400). Modified:
  * fetchmail.service</changelog>
  <changelog author="pmonreal@suse.com" date="1633694400">- Security fix: [bsc#1190069, CVE-2021-39272]
  * Fix failure to enforce STARTTLS session encryption in some
    circumstances, such as a certain situation with IMAP and PREAUTH.
  * Advisory: https://www.fetchmail.info/fetchmail-SA-2021-02.txt
  * Add fetchmail-CVE-2021-39272.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1635336000">- Update to 6.4.22: [bsc#1190069, CVE-2021-39272]
  * OPENSSL AND LICENSING NOTE:
  - fetchmail 6.4.22 is compatible with OpenSSL 1.1.1 and 3.0.0.
    OpenSSL's licensing changed between these releases from dual
    OpenSSL/SSLeay license to Apache License v2.0, which is
    considered incompatible with GPL v2 by the FSF. For
    implications and details, see the file COPYING.
  * SECURITY FIXES:
  - CVE-2021-39272: fetchmail-SA-2021-02: On IMAP connections,
    without --ssl and with nonempty --sslproto, meaning that
    fetchmail is to enforce TLS, and when the server or an attacker
    sends a PREAUTH greeting, fetchmail used to continue an
    unencrypted connection. Now, log the error and abort the
    connection. --Recommendation for servers that support
    SSL/TLS-wrapped or "implicit" mode on a dedicated port
    (default 993): use --ssl, or the ssl user option in an rcfile.
  - On IMAP and POP3 connections, --auth ssh no longer prevents
    STARTTLS negotiation.
  - On IMAP connections, fetchmail does not permit overriding
    a server-side LOGINDISABLED with --auth password any more.
  - On POP3 connections, the possibility for RPA authentication
    (by probing with an AUTH command without arguments) no longer
    prevents STARTTLS negotiation.
  - For POP3 connections, only attempt RPA if the authentication
    type is "any".
  * BUG FIXES:
  - On IMAP connections, when AUTHENTICATE EXTERNAL fails and we
    have received the tagged (= final) response, do not send "*".
  - On IMAP connections, AUTHENTICATE EXTERNAL without username
    will properly send a "=" for protocol compliance.
  - On IMAP connections, AUTHENTICATE EXTERNAL will now check if
    the server advertised SASL-IR (RFC-4959) support and otherwise
    refuse (fetchmail &lt;= 6.4 has not supported and does not support
    the separate challenge/response with command continuation)
  - On IMAP connections, when --auth external is requested but not
    advertised by the server, log a proper error message.
  - Fetchmail no longer crashes when attempting a connection with
  - -plugin "" or --plugout "".
  - Fetchmail no longer leaks memory when processing the arguments
    of --plugin or --plugout on connections.
  - On POP3 connections, the CAPAbilities parser is now caseblind.
  - Fix segfault on configurations with "defaults ... no envelope".
    This is a regression in fetchmail 6.4.3 and happened when
    plugging memory leaks, which did not account for that the
    envelope parameter is special when set as "no envelope". The
    segfault happens in a constant strlen(-1), triggered by trusted
    local input =&gt; no vulnerability.
  - Fix program abort (SIGABRT) with "internal error" when invalid
    sslproto is given with OpenSSL 1.1.0 API compatible SSL
    implementations.
  * CHANGES:
  - IMAP: When fetchmail is in not-authenticated state and the server
    volunteers CAPABILITY information, use it and do not re-probe.
    (After STARTTLS, fetchmail must and will re-probe explicitly.)
  - For typical POP3/IMAP ports 110, 143, 993, 995, if port and --ssl
    option do not match, emit a warning and continue.
  - fetchmail.man and README.SSL were updated in line with
    RFC-8314/8996/8997 recommendations to prefer Implicit TLS
    (--ssl/ssl) and TLS v1.2 or newer, placing --sslproto tls1.2+
    more prominently. The defaults shall not change between 6.4.X
    releases for compatibility.
  * Rebase patches:
    fetchmail-add-imap-oauthbearer-support.patch
    fetchmail-add-query_to64_outsize-utility-function.patch
    fetchmail-support-oauthbearer-xoauth2-with-pop3.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1635336001">- Update to 6.4.22 in SLE-15-SP2:
  [jsc#SLE-18159, jsc#SLE-17903, jsc#SLE-18059]
  * Remove all python2 dependencies [bsc#1190896]
  * Remove fetchmail-CVE-2021-39272.patch fixed in the update</changelog>
  <changelog author="david.anes@suse.com" date="1641988800">- fix [bsc#1194203]:
  * Always create fetchmail group, even if the user is already
  present, as a leftover from Leap 15.2 upgrade. This may happen
  also if user is messing with groups/users directly or upgrading
  from even an older fetchmail versions.</changelog>
  <changelog author="david.anes@suse.com" date="1643371200">- fix [bsc#1193894]
  * Restore autoprobe functionality behaviour as per 6.3.x version
  * Added patch fetchmail-restore-auto-probe-behaviour.patch</changelog>
</package>
<package pkgid="eef61a53ce736e7604ee3ca0eaa7085cfe827297a134d9e5d77e32ec23fbe6f7" name="fetchmail" arch="x86_64">
  <version epoch="0" ver="6.4.22" rel="20.26.1"/>
  <changelog author="dmueller@suse.com" date="1599220800">- update to 6.4.12:
  [#] REGRESSION FIX:
  * configure: fetchmail 6.4.9 and 6.4.10 would miss checking for TLS v1.2 and
  TLS v1.3 support if AC_LIB_LINKFLAGS came up with something such as
  /path/to/libssl.so, rather than -lssl. (For instance on FreeBSD)
  * configure: fetchmail 6.4.9's configure was unable to pick up OpenSSL
  if it wasn't announced by pkg-config, for instance, on FreeBSD</changelog>
  <changelog author="kukuk@suse.com" date="1608292800">- Don't require systemd
- Use tmpfiles for all files
- Use systemd macro for tmpfiles
- Don't delete home directory if the user stays
- Use sysusers config to create system user</changelog>
  <changelog author="dmueller@suse.com" date="1608379200">- update to 6.4.14:
  * sr:    ???????? ??????? (Miroslav Nikoli?) [Serbian]
  * Errors about lock file (= pidfile) creation could be lost in daemon
  configurations (-d option, or set daemon) when using syslog. Now they are also
  logged to syslog.  Found verifying a pidfile creation issue on 6.4.12 that was
  previously reported by Alex Hall of Automatic Distributors.
  * If the lock file cannot be removed (no write permission on directory), try
  to truncate it, and if that fails, report error.
  * If the pidfile was non-default, fetchmail -q or --quit would malfunction and
  claim no other fetchmail were running, because it did not read the
  configuration files or merge the command line options, thus it would look for
  the PID in the wrong file.</changelog>
  <changelog author="dmueller@suse.com" date="1609761600">- update to 6.4.15:
  * Fix a typo in the manual page reported by David McKelvie.
  * Fix cross-compilation with openssl, by Fabrice Fontaine. Merge request !23.
  * Fix truncation of SMTP PLAIN AUTH with ^ in credentials, by Earl Chew.</changelog>
  <changelog author="pmonreal@suse.com" date="1614600000">- update to 6.4.16:
  * fetchmail's --configdump, and fetchmailconf, lacked support for
    the sslcertfile option.
  * fetchmail --version [fetchmail -V] now queries and prints the
    SSL/TLS library's "SSL default trusted certificate" file or
    directory (mind the word "default"), where the OpenSSL-compatible
    TLS implementation will look for trusted root, meaning
    certification authority (CA), certificates.
  * fetchmail --version now prints version of the OpenSSL library
    that it was compiled against, and that it is using at runtime,
    and also the OPENSSL_DIR and OPENSSL_ENGINES_DIR (if available).</changelog>
  <changelog author="pmonreal@suse.com" date="1614600001">- Set the hostname for SNI when using TLS [bsc#1182807]
- Add fetchmail-SNI-hostname-support.patch</changelog>
  <changelog author="dmueller@suse.com" date="1617710400">- update to 6.4.18:
  * fetchmailconf: fetchmail 6.4.16 added --sslcertfile to the configuration dump,
    but fetchmailconf support was incomplete in Git 7349f124 and it could not
    parse sslcertfile, thus the user settings editor came up empty with console
    errors printed.  Fix configuration parser in fetchmailconf.
  * fetchmailconf: do not require fetchmail for -V. do not require Tk (Tkinter)
    for -d option. This is to fail more gracefully on incomplete installs.
  * TLS code: remove OPENSSL_NO_DEPRECATED macros to avoid portability issues
    with OpenSSL v3 - these are for development purposes, not production.
  * TLS futureproofing: use SSL_use_PrivateKey_file instead of
    SSL_use_RSAPrivateKey_file, the latter will be deprecated with OpenSSL v3,
    and the user's key file might be something else than RSA.
  * IMAP client: it used to leak memory for username and password when trying
    the LOGIN (password-based) authentication and encountered a timeout situation.
  * dist-tools/getstats.py: also counts lines in *.py files, shown above.
  * fetchmail.man: now mentions that you may need to add --ssl when specifying
    a TLS-wrapped port.
  * fetchmailconf: --version (-V) now prints the Python version in use.</changelog>
  <changelog author="dmueller@suse.com" date="1620475200">- update to 6.4.19:
  * fetchmailconf: properly catch and report option parsing errors
  * LMTP: do not try to validate the last component of a UNIX-domain LMTP socket
    as though it were a TCP port.</changelog>
  <changelog author="jeffm@suse.com" date="1620907200">- Backported support for OAUTH2 authentication from Fetchmail 7.0.
  - add imap oauthbearer support
  - support oauthbearer/xoauth2 with pop3
  - add passwordfile and passwordfd options
  - add contrib/fetchnmail-oauth2.py token acquisition utility
  - FAQ: list gmail options including oauthbearer and app password
  - give each ctl it's own copy of password
  - re-read passwordfile on every poll
  - add query_to64_outsize() utility function
  - Chase and integrate interface change.
  - oauth2.c: calculate and pass in correct buffer size to to64frombits()
  - Increase max password length to handle oauth tokens
  - Bump max. passwordlen to 10000 bytes.
  - Add README.OAUTH2
- Added patches:
  * fetchmail-add-imap-oauthbearer-support.patch
  * fetchmail-support-oauthbearer-xoauth2-with-pop3.patch
  * fetchmail-add-passwordfile-and-passwordfd-options.patch
  * fetchmail-add-contrib-fetchnmail-oauth2.py-token-acquisition-u.patch
  * fetchmail-FAQ-list-gmail-options-including-oauthbearer-and-app.patch
  * fetchmail-give-each-ctl-it-s-own-copy-of-password.patch
  * fetchmail-re-read-passwordfile-on-every-poll.patch
  * fetchmail-add-query_to64_outsize-utility-function.patch
  * fetchmail-chase-and-integrate-interface-change.patch
  * fetchmail-oauth2-c-calculate-and-pass-in-correct-buffer-size-to-to64frombits.patch
  * fetchmail-increase-max-password-length-to-handle-oauth-tokens.patch
  * fetchmail-bump-max-passwordlen-to-1bytes.patch
  * fetchmail-add-readme-oauth2-issue-27.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1626091200">- Change PASSWORDLEN from 64 to 256 [bsc#1188034]
  * Add fetchmail-PASSWORDLEN-256.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1627560000">- Update to 6.4.20: [bsc#1188875, CVE-2021-36386]
  * CVE-2021-36386: DoS or information disclosure in some configurations.
    When a log message exceeds c. 2 kByte in size, for instance,
    with very long header contents, and depending on verbosity
    option, fetchmail can crash or misreport each first log message
    that requires a buffer reallocation. fetchmail then reallocates
    memory and re-runs vsnprintf() without another call to va_start(),
    so it reads garbage. The exact impact depends on many factors
    around the compiler and operating system configurations used and
    the implementation details of the stdarg.h interfaces of the two
    functions mentioned before.</changelog>
  <changelog author="pmonreal@suse.com" date="1627560001">- Security fix: [bsc#1188875, CVE-2021-36386]
  * DoS or information disclosure in some configurations.
  * See also: https://www.fetchmail.info/fetchmail-SA-2021-01.txt
  * Add fetchmail-CVE-2021-36386.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1629806400">- Update to 6.4.21:
  * REGRESSION FIX: The new security fix in 6.4.20 for
    CVE-2021-36386 caused truncation of messages logged to
    buffered outputs, predominantly --logfile.</changelog>
  <changelog author="pmonreal@suse.com" date="1629806401">- Update to 6.4.21 in SLE-15-SP2:
  [jsc#SLE-18159, jsc#SLE-17903, jsc#SLE-18059]
  * Remove patches fixed upstream:
  - fetchmail-SNI-hostname-support.patch
  - fetchmail-CVE-2021-36386.patch
  - fetchmail-PASSWORDLEN-256.patch</changelog>
  <changelog author="jsegitz@suse.com" date="1631620800">- Added hardening to systemd service(s) (bsc#1181400). Modified:
  * fetchmail.service</changelog>
  <changelog author="pmonreal@suse.com" date="1633694400">- Security fix: [bsc#1190069, CVE-2021-39272]
  * Fix failure to enforce STARTTLS session encryption in some
    circumstances, such as a certain situation with IMAP and PREAUTH.
  * Advisory: https://www.fetchmail.info/fetchmail-SA-2021-02.txt
  * Add fetchmail-CVE-2021-39272.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1635336000">- Update to 6.4.22: [bsc#1190069, CVE-2021-39272]
  * OPENSSL AND LICENSING NOTE:
  - fetchmail 6.4.22 is compatible with OpenSSL 1.1.1 and 3.0.0.
    OpenSSL's licensing changed between these releases from dual
    OpenSSL/SSLeay license to Apache License v2.0, which is
    considered incompatible with GPL v2 by the FSF. For
    implications and details, see the file COPYING.
  * SECURITY FIXES:
  - CVE-2021-39272: fetchmail-SA-2021-02: On IMAP connections,
    without --ssl and with nonempty --sslproto, meaning that
    fetchmail is to enforce TLS, and when the server or an attacker
    sends a PREAUTH greeting, fetchmail used to continue an
    unencrypted connection. Now, log the error and abort the
    connection. --Recommendation for servers that support
    SSL/TLS-wrapped or "implicit" mode on a dedicated port
    (default 993): use --ssl, or the ssl user option in an rcfile.
  - On IMAP and POP3 connections, --auth ssh no longer prevents
    STARTTLS negotiation.
  - On IMAP connections, fetchmail does not permit overriding
    a server-side LOGINDISABLED with --auth password any more.
  - On POP3 connections, the possibility for RPA authentication
    (by probing with an AUTH command without arguments) no longer
    prevents STARTTLS negotiation.
  - For POP3 connections, only attempt RPA if the authentication
    type is "any".
  * BUG FIXES:
  - On IMAP connections, when AUTHENTICATE EXTERNAL fails and we
    have received the tagged (= final) response, do not send "*".
  - On IMAP connections, AUTHENTICATE EXTERNAL without username
    will properly send a "=" for protocol compliance.
  - On IMAP connections, AUTHENTICATE EXTERNAL will now check if
    the server advertised SASL-IR (RFC-4959) support and otherwise
    refuse (fetchmail &lt;= 6.4 has not supported and does not support
    the separate challenge/response with command continuation)
  - On IMAP connections, when --auth external is requested but not
    advertised by the server, log a proper error message.
  - Fetchmail no longer crashes when attempting a connection with
  - -plugin "" or --plugout "".
  - Fetchmail no longer leaks memory when processing the arguments
    of --plugin or --plugout on connections.
  - On POP3 connections, the CAPAbilities parser is now caseblind.
  - Fix segfault on configurations with "defaults ... no envelope".
    This is a regression in fetchmail 6.4.3 and happened when
    plugging memory leaks, which did not account for that the
    envelope parameter is special when set as "no envelope". The
    segfault happens in a constant strlen(-1), triggered by trusted
    local input =&gt; no vulnerability.
  - Fix program abort (SIGABRT) with "internal error" when invalid
    sslproto is given with OpenSSL 1.1.0 API compatible SSL
    implementations.
  * CHANGES:
  - IMAP: When fetchmail is in not-authenticated state and the server
    volunteers CAPABILITY information, use it and do not re-probe.
    (After STARTTLS, fetchmail must and will re-probe explicitly.)
  - For typical POP3/IMAP ports 110, 143, 993, 995, if port and --ssl
    option do not match, emit a warning and continue.
  - fetchmail.man and README.SSL were updated in line with
    RFC-8314/8996/8997 recommendations to prefer Implicit TLS
    (--ssl/ssl) and TLS v1.2 or newer, placing --sslproto tls1.2+
    more prominently. The defaults shall not change between 6.4.X
    releases for compatibility.
  * Rebase patches:
    fetchmail-add-imap-oauthbearer-support.patch
    fetchmail-add-query_to64_outsize-utility-function.patch
    fetchmail-support-oauthbearer-xoauth2-with-pop3.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1635336001">- Update to 6.4.22 in SLE-15-SP2:
  [jsc#SLE-18159, jsc#SLE-17903, jsc#SLE-18059]
  * Remove all python2 dependencies [bsc#1190896]
  * Remove fetchmail-CVE-2021-39272.patch fixed in the update</changelog>
  <changelog author="david.anes@suse.com" date="1641988800">- fix [bsc#1194203]:
  * Always create fetchmail group, even if the user is already
  present, as a leftover from Leap 15.2 upgrade. This may happen
  also if user is messing with groups/users directly or upgrading
  from even an older fetchmail versions.</changelog>
  <changelog author="david.anes@suse.com" date="1643371200">- fix [bsc#1193894]
  * Restore autoprobe functionality behaviour as per 6.3.x version
  * Added patch fetchmail-restore-auto-probe-behaviour.patch</changelog>
</package>
<package pkgid="0873ab3aa03644d8bda4685f3200b39aebda2d9f765720f4ff427a5a720f35d3" name="fetchmailconf" arch="aarch64">
  <version epoch="0" ver="6.4.22" rel="20.26.1"/>
  <changelog author="dmueller@suse.com" date="1599220800">- update to 6.4.12:
  [#] REGRESSION FIX:
  * configure: fetchmail 6.4.9 and 6.4.10 would miss checking for TLS v1.2 and
  TLS v1.3 support if AC_LIB_LINKFLAGS came up with something such as
  /path/to/libssl.so, rather than -lssl. (For instance on FreeBSD)
  * configure: fetchmail 6.4.9's configure was unable to pick up OpenSSL
  if it wasn't announced by pkg-config, for instance, on FreeBSD</changelog>
  <changelog author="kukuk@suse.com" date="1608292800">- Don't require systemd
- Use tmpfiles for all files
- Use systemd macro for tmpfiles
- Don't delete home directory if the user stays
- Use sysusers config to create system user</changelog>
  <changelog author="dmueller@suse.com" date="1608379200">- update to 6.4.14:
  * sr:    ???????? ??????? (Miroslav Nikoli?) [Serbian]
  * Errors about lock file (= pidfile) creation could be lost in daemon
  configurations (-d option, or set daemon) when using syslog. Now they are also
  logged to syslog.  Found verifying a pidfile creation issue on 6.4.12 that was
  previously reported by Alex Hall of Automatic Distributors.
  * If the lock file cannot be removed (no write permission on directory), try
  to truncate it, and if that fails, report error.
  * If the pidfile was non-default, fetchmail -q or --quit would malfunction and
  claim no other fetchmail were running, because it did not read the
  configuration files or merge the command line options, thus it would look for
  the PID in the wrong file.</changelog>
  <changelog author="dmueller@suse.com" date="1609761600">- update to 6.4.15:
  * Fix a typo in the manual page reported by David McKelvie.
  * Fix cross-compilation with openssl, by Fabrice Fontaine. Merge request !23.
  * Fix truncation of SMTP PLAIN AUTH with ^ in credentials, by Earl Chew.</changelog>
  <changelog author="pmonreal@suse.com" date="1614600000">- update to 6.4.16:
  * fetchmail's --configdump, and fetchmailconf, lacked support for
    the sslcertfile option.
  * fetchmail --version [fetchmail -V] now queries and prints the
    SSL/TLS library's "SSL default trusted certificate" file or
    directory (mind the word "default"), where the OpenSSL-compatible
    TLS implementation will look for trusted root, meaning
    certification authority (CA), certificates.
  * fetchmail --version now prints version of the OpenSSL library
    that it was compiled against, and that it is using at runtime,
    and also the OPENSSL_DIR and OPENSSL_ENGINES_DIR (if available).</changelog>
  <changelog author="pmonreal@suse.com" date="1614600001">- Set the hostname for SNI when using TLS [bsc#1182807]
- Add fetchmail-SNI-hostname-support.patch</changelog>
  <changelog author="dmueller@suse.com" date="1617710400">- update to 6.4.18:
  * fetchmailconf: fetchmail 6.4.16 added --sslcertfile to the configuration dump,
    but fetchmailconf support was incomplete in Git 7349f124 and it could not
    parse sslcertfile, thus the user settings editor came up empty with console
    errors printed.  Fix configuration parser in fetchmailconf.
  * fetchmailconf: do not require fetchmail for -V. do not require Tk (Tkinter)
    for -d option. This is to fail more gracefully on incomplete installs.
  * TLS code: remove OPENSSL_NO_DEPRECATED macros to avoid portability issues
    with OpenSSL v3 - these are for development purposes, not production.
  * TLS futureproofing: use SSL_use_PrivateKey_file instead of
    SSL_use_RSAPrivateKey_file, the latter will be deprecated with OpenSSL v3,
    and the user's key file might be something else than RSA.
  * IMAP client: it used to leak memory for username and password when trying
    the LOGIN (password-based) authentication and encountered a timeout situation.
  * dist-tools/getstats.py: also counts lines in *.py files, shown above.
  * fetchmail.man: now mentions that you may need to add --ssl when specifying
    a TLS-wrapped port.
  * fetchmailconf: --version (-V) now prints the Python version in use.</changelog>
  <changelog author="dmueller@suse.com" date="1620475200">- update to 6.4.19:
  * fetchmailconf: properly catch and report option parsing errors
  * LMTP: do not try to validate the last component of a UNIX-domain LMTP socket
    as though it were a TCP port.</changelog>
  <changelog author="jeffm@suse.com" date="1620907200">- Backported support for OAUTH2 authentication from Fetchmail 7.0.
  - add imap oauthbearer support
  - support oauthbearer/xoauth2 with pop3
  - add passwordfile and passwordfd options
  - add contrib/fetchnmail-oauth2.py token acquisition utility
  - FAQ: list gmail options including oauthbearer and app password
  - give each ctl it's own copy of password
  - re-read passwordfile on every poll
  - add query_to64_outsize() utility function
  - Chase and integrate interface change.
  - oauth2.c: calculate and pass in correct buffer size to to64frombits()
  - Increase max password length to handle oauth tokens
  - Bump max. passwordlen to 10000 bytes.
  - Add README.OAUTH2
- Added patches:
  * fetchmail-add-imap-oauthbearer-support.patch
  * fetchmail-support-oauthbearer-xoauth2-with-pop3.patch
  * fetchmail-add-passwordfile-and-passwordfd-options.patch
  * fetchmail-add-contrib-fetchnmail-oauth2.py-token-acquisition-u.patch
  * fetchmail-FAQ-list-gmail-options-including-oauthbearer-and-app.patch
  * fetchmail-give-each-ctl-it-s-own-copy-of-password.patch
  * fetchmail-re-read-passwordfile-on-every-poll.patch
  * fetchmail-add-query_to64_outsize-utility-function.patch
  * fetchmail-chase-and-integrate-interface-change.patch
  * fetchmail-oauth2-c-calculate-and-pass-in-correct-buffer-size-to-to64frombits.patch
  * fetchmail-increase-max-password-length-to-handle-oauth-tokens.patch
  * fetchmail-bump-max-passwordlen-to-1bytes.patch
  * fetchmail-add-readme-oauth2-issue-27.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1626091200">- Change PASSWORDLEN from 64 to 256 [bsc#1188034]
  * Add fetchmail-PASSWORDLEN-256.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1627560000">- Update to 6.4.20: [bsc#1188875, CVE-2021-36386]
  * CVE-2021-36386: DoS or information disclosure in some configurations.
    When a log message exceeds c. 2 kByte in size, for instance,
    with very long header contents, and depending on verbosity
    option, fetchmail can crash or misreport each first log message
    that requires a buffer reallocation. fetchmail then reallocates
    memory and re-runs vsnprintf() without another call to va_start(),
    so it reads garbage. The exact impact depends on many factors
    around the compiler and operating system configurations used and
    the implementation details of the stdarg.h interfaces of the two
    functions mentioned before.</changelog>
  <changelog author="pmonreal@suse.com" date="1627560001">- Security fix: [bsc#1188875, CVE-2021-36386]
  * DoS or information disclosure in some configurations.
  * See also: https://www.fetchmail.info/fetchmail-SA-2021-01.txt
  * Add fetchmail-CVE-2021-36386.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1629806400">- Update to 6.4.21:
  * REGRESSION FIX: The new security fix in 6.4.20 for
    CVE-2021-36386 caused truncation of messages logged to
    buffered outputs, predominantly --logfile.</changelog>
  <changelog author="pmonreal@suse.com" date="1629806401">- Update to 6.4.21 in SLE-15-SP2:
  [jsc#SLE-18159, jsc#SLE-17903, jsc#SLE-18059]
  * Remove patches fixed upstream:
  - fetchmail-SNI-hostname-support.patch
  - fetchmail-CVE-2021-36386.patch
  - fetchmail-PASSWORDLEN-256.patch</changelog>
  <changelog author="jsegitz@suse.com" date="1631620800">- Added hardening to systemd service(s) (bsc#1181400). Modified:
  * fetchmail.service</changelog>
  <changelog author="pmonreal@suse.com" date="1633694400">- Security fix: [bsc#1190069, CVE-2021-39272]
  * Fix failure to enforce STARTTLS session encryption in some
    circumstances, such as a certain situation with IMAP and PREAUTH.
  * Advisory: https://www.fetchmail.info/fetchmail-SA-2021-02.txt
  * Add fetchmail-CVE-2021-39272.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1635336000">- Update to 6.4.22: [bsc#1190069, CVE-2021-39272]
  * OPENSSL AND LICENSING NOTE:
  - fetchmail 6.4.22 is compatible with OpenSSL 1.1.1 and 3.0.0.
    OpenSSL's licensing changed between these releases from dual
    OpenSSL/SSLeay license to Apache License v2.0, which is
    considered incompatible with GPL v2 by the FSF. For
    implications and details, see the file COPYING.
  * SECURITY FIXES:
  - CVE-2021-39272: fetchmail-SA-2021-02: On IMAP connections,
    without --ssl and with nonempty --sslproto, meaning that
    fetchmail is to enforce TLS, and when the server or an attacker
    sends a PREAUTH greeting, fetchmail used to continue an
    unencrypted connection. Now, log the error and abort the
    connection. --Recommendation for servers that support
    SSL/TLS-wrapped or "implicit" mode on a dedicated port
    (default 993): use --ssl, or the ssl user option in an rcfile.
  - On IMAP and POP3 connections, --auth ssh no longer prevents
    STARTTLS negotiation.
  - On IMAP connections, fetchmail does not permit overriding
    a server-side LOGINDISABLED with --auth password any more.
  - On POP3 connections, the possibility for RPA authentication
    (by probing with an AUTH command without arguments) no longer
    prevents STARTTLS negotiation.
  - For POP3 connections, only attempt RPA if the authentication
    type is "any".
  * BUG FIXES:
  - On IMAP connections, when AUTHENTICATE EXTERNAL fails and we
    have received the tagged (= final) response, do not send "*".
  - On IMAP connections, AUTHENTICATE EXTERNAL without username
    will properly send a "=" for protocol compliance.
  - On IMAP connections, AUTHENTICATE EXTERNAL will now check if
    the server advertised SASL-IR (RFC-4959) support and otherwise
    refuse (fetchmail &lt;= 6.4 has not supported and does not support
    the separate challenge/response with command continuation)
  - On IMAP connections, when --auth external is requested but not
    advertised by the server, log a proper error message.
  - Fetchmail no longer crashes when attempting a connection with
  - -plugin "" or --plugout "".
  - Fetchmail no longer leaks memory when processing the arguments
    of --plugin or --plugout on connections.
  - On POP3 connections, the CAPAbilities parser is now caseblind.
  - Fix segfault on configurations with "defaults ... no envelope".
    This is a regression in fetchmail 6.4.3 and happened when
    plugging memory leaks, which did not account for that the
    envelope parameter is special when set as "no envelope". The
    segfault happens in a constant strlen(-1), triggered by trusted
    local input =&gt; no vulnerability.
  - Fix program abort (SIGABRT) with "internal error" when invalid
    sslproto is given with OpenSSL 1.1.0 API compatible SSL
    implementations.
  * CHANGES:
  - IMAP: When fetchmail is in not-authenticated state and the server
    volunteers CAPABILITY information, use it and do not re-probe.
    (After STARTTLS, fetchmail must and will re-probe explicitly.)
  - For typical POP3/IMAP ports 110, 143, 993, 995, if port and --ssl
    option do not match, emit a warning and continue.
  - fetchmail.man and README.SSL were updated in line with
    RFC-8314/8996/8997 recommendations to prefer Implicit TLS
    (--ssl/ssl) and TLS v1.2 or newer, placing --sslproto tls1.2+
    more prominently. The defaults shall not change between 6.4.X
    releases for compatibility.
  * Rebase patches:
    fetchmail-add-imap-oauthbearer-support.patch
    fetchmail-add-query_to64_outsize-utility-function.patch
    fetchmail-support-oauthbearer-xoauth2-with-pop3.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1635336001">- Update to 6.4.22 in SLE-15-SP2:
  [jsc#SLE-18159, jsc#SLE-17903, jsc#SLE-18059]
  * Remove all python2 dependencies [bsc#1190896]
  * Remove fetchmail-CVE-2021-39272.patch fixed in the update</changelog>
  <changelog author="david.anes@suse.com" date="1641988800">- fix [bsc#1194203]:
  * Always create fetchmail group, even if the user is already
  present, as a leftover from Leap 15.2 upgrade. This may happen
  also if user is messing with groups/users directly or upgrading
  from even an older fetchmail versions.</changelog>
  <changelog author="david.anes@suse.com" date="1643371200">- fix [bsc#1193894]
  * Restore autoprobe functionality behaviour as per 6.3.x version
  * Added patch fetchmail-restore-auto-probe-behaviour.patch</changelog>
</package>
<package pkgid="056b62d2b901bf66b9497c505c69a9907182d30374eb3cd885a7bdcf9a58d68a" name="fetchmailconf" arch="ppc64le">
  <version epoch="0" ver="6.4.22" rel="20.26.1"/>
  <changelog author="dmueller@suse.com" date="1599220800">- update to 6.4.12:
  [#] REGRESSION FIX:
  * configure: fetchmail 6.4.9 and 6.4.10 would miss checking for TLS v1.2 and
  TLS v1.3 support if AC_LIB_LINKFLAGS came up with something such as
  /path/to/libssl.so, rather than -lssl. (For instance on FreeBSD)
  * configure: fetchmail 6.4.9's configure was unable to pick up OpenSSL
  if it wasn't announced by pkg-config, for instance, on FreeBSD</changelog>
  <changelog author="kukuk@suse.com" date="1608292800">- Don't require systemd
- Use tmpfiles for all files
- Use systemd macro for tmpfiles
- Don't delete home directory if the user stays
- Use sysusers config to create system user</changelog>
  <changelog author="dmueller@suse.com" date="1608379200">- update to 6.4.14:
  * sr:    ???????? ??????? (Miroslav Nikoli?) [Serbian]
  * Errors about lock file (= pidfile) creation could be lost in daemon
  configurations (-d option, or set daemon) when using syslog. Now they are also
  logged to syslog.  Found verifying a pidfile creation issue on 6.4.12 that was
  previously reported by Alex Hall of Automatic Distributors.
  * If the lock file cannot be removed (no write permission on directory), try
  to truncate it, and if that fails, report error.
  * If the pidfile was non-default, fetchmail -q or --quit would malfunction and
  claim no other fetchmail were running, because it did not read the
  configuration files or merge the command line options, thus it would look for
  the PID in the wrong file.</changelog>
  <changelog author="dmueller@suse.com" date="1609761600">- update to 6.4.15:
  * Fix a typo in the manual page reported by David McKelvie.
  * Fix cross-compilation with openssl, by Fabrice Fontaine. Merge request !23.
  * Fix truncation of SMTP PLAIN AUTH with ^ in credentials, by Earl Chew.</changelog>
  <changelog author="pmonreal@suse.com" date="1614600000">- update to 6.4.16:
  * fetchmail's --configdump, and fetchmailconf, lacked support for
    the sslcertfile option.
  * fetchmail --version [fetchmail -V] now queries and prints the
    SSL/TLS library's "SSL default trusted certificate" file or
    directory (mind the word "default"), where the OpenSSL-compatible
    TLS implementation will look for trusted root, meaning
    certification authority (CA), certificates.
  * fetchmail --version now prints version of the OpenSSL library
    that it was compiled against, and that it is using at runtime,
    and also the OPENSSL_DIR and OPENSSL_ENGINES_DIR (if available).</changelog>
  <changelog author="pmonreal@suse.com" date="1614600001">- Set the hostname for SNI when using TLS [bsc#1182807]
- Add fetchmail-SNI-hostname-support.patch</changelog>
  <changelog author="dmueller@suse.com" date="1617710400">- update to 6.4.18:
  * fetchmailconf: fetchmail 6.4.16 added --sslcertfile to the configuration dump,
    but fetchmailconf support was incomplete in Git 7349f124 and it could not
    parse sslcertfile, thus the user settings editor came up empty with console
    errors printed.  Fix configuration parser in fetchmailconf.
  * fetchmailconf: do not require fetchmail for -V. do not require Tk (Tkinter)
    for -d option. This is to fail more gracefully on incomplete installs.
  * TLS code: remove OPENSSL_NO_DEPRECATED macros to avoid portability issues
    with OpenSSL v3 - these are for development purposes, not production.
  * TLS futureproofing: use SSL_use_PrivateKey_file instead of
    SSL_use_RSAPrivateKey_file, the latter will be deprecated with OpenSSL v3,
    and the user's key file might be something else than RSA.
  * IMAP client: it used to leak memory for username and password when trying
    the LOGIN (password-based) authentication and encountered a timeout situation.
  * dist-tools/getstats.py: also counts lines in *.py files, shown above.
  * fetchmail.man: now mentions that you may need to add --ssl when specifying
    a TLS-wrapped port.
  * fetchmailconf: --version (-V) now prints the Python version in use.</changelog>
  <changelog author="dmueller@suse.com" date="1620475200">- update to 6.4.19:
  * fetchmailconf: properly catch and report option parsing errors
  * LMTP: do not try to validate the last component of a UNIX-domain LMTP socket
    as though it were a TCP port.</changelog>
  <changelog author="jeffm@suse.com" date="1620907200">- Backported support for OAUTH2 authentication from Fetchmail 7.0.
  - add imap oauthbearer support
  - support oauthbearer/xoauth2 with pop3
  - add passwordfile and passwordfd options
  - add contrib/fetchnmail-oauth2.py token acquisition utility
  - FAQ: list gmail options including oauthbearer and app password
  - give each ctl it's own copy of password
  - re-read passwordfile on every poll
  - add query_to64_outsize() utility function
  - Chase and integrate interface change.
  - oauth2.c: calculate and pass in correct buffer size to to64frombits()
  - Increase max password length to handle oauth tokens
  - Bump max. passwordlen to 10000 bytes.
  - Add README.OAUTH2
- Added patches:
  * fetchmail-add-imap-oauthbearer-support.patch
  * fetchmail-support-oauthbearer-xoauth2-with-pop3.patch
  * fetchmail-add-passwordfile-and-passwordfd-options.patch
  * fetchmail-add-contrib-fetchnmail-oauth2.py-token-acquisition-u.patch
  * fetchmail-FAQ-list-gmail-options-including-oauthbearer-and-app.patch
  * fetchmail-give-each-ctl-it-s-own-copy-of-password.patch
  * fetchmail-re-read-passwordfile-on-every-poll.patch
  * fetchmail-add-query_to64_outsize-utility-function.patch
  * fetchmail-chase-and-integrate-interface-change.patch
  * fetchmail-oauth2-c-calculate-and-pass-in-correct-buffer-size-to-to64frombits.patch
  * fetchmail-increase-max-password-length-to-handle-oauth-tokens.patch
  * fetchmail-bump-max-passwordlen-to-1bytes.patch
  * fetchmail-add-readme-oauth2-issue-27.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1626091200">- Change PASSWORDLEN from 64 to 256 [bsc#1188034]
  * Add fetchmail-PASSWORDLEN-256.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1627560000">- Update to 6.4.20: [bsc#1188875, CVE-2021-36386]
  * CVE-2021-36386: DoS or information disclosure in some configurations.
    When a log message exceeds c. 2 kByte in size, for instance,
    with very long header contents, and depending on verbosity
    option, fetchmail can crash or misreport each first log message
    that requires a buffer reallocation. fetchmail then reallocates
    memory and re-runs vsnprintf() without another call to va_start(),
    so it reads garbage. The exact impact depends on many factors
    around the compiler and operating system configurations used and
    the implementation details of the stdarg.h interfaces of the two
    functions mentioned before.</changelog>
  <changelog author="pmonreal@suse.com" date="1627560001">- Security fix: [bsc#1188875, CVE-2021-36386]
  * DoS or information disclosure in some configurations.
  * See also: https://www.fetchmail.info/fetchmail-SA-2021-01.txt
  * Add fetchmail-CVE-2021-36386.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1629806400">- Update to 6.4.21:
  * REGRESSION FIX: The new security fix in 6.4.20 for
    CVE-2021-36386 caused truncation of messages logged to
    buffered outputs, predominantly --logfile.</changelog>
  <changelog author="pmonreal@suse.com" date="1629806401">- Update to 6.4.21 in SLE-15-SP2:
  [jsc#SLE-18159, jsc#SLE-17903, jsc#SLE-18059]
  * Remove patches fixed upstream:
  - fetchmail-SNI-hostname-support.patch
  - fetchmail-CVE-2021-36386.patch
  - fetchmail-PASSWORDLEN-256.patch</changelog>
  <changelog author="jsegitz@suse.com" date="1631620800">- Added hardening to systemd service(s) (bsc#1181400). Modified:
  * fetchmail.service</changelog>
  <changelog author="pmonreal@suse.com" date="1633694400">- Security fix: [bsc#1190069, CVE-2021-39272]
  * Fix failure to enforce STARTTLS session encryption in some
    circumstances, such as a certain situation with IMAP and PREAUTH.
  * Advisory: https://www.fetchmail.info/fetchmail-SA-2021-02.txt
  * Add fetchmail-CVE-2021-39272.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1635336000">- Update to 6.4.22: [bsc#1190069, CVE-2021-39272]
  * OPENSSL AND LICENSING NOTE:
  - fetchmail 6.4.22 is compatible with OpenSSL 1.1.1 and 3.0.0.
    OpenSSL's licensing changed between these releases from dual
    OpenSSL/SSLeay license to Apache License v2.0, which is
    considered incompatible with GPL v2 by the FSF. For
    implications and details, see the file COPYING.
  * SECURITY FIXES:
  - CVE-2021-39272: fetchmail-SA-2021-02: On IMAP connections,
    without --ssl and with nonempty --sslproto, meaning that
    fetchmail is to enforce TLS, and when the server or an attacker
    sends a PREAUTH greeting, fetchmail used to continue an
    unencrypted connection. Now, log the error and abort the
    connection. --Recommendation for servers that support
    SSL/TLS-wrapped or "implicit" mode on a dedicated port
    (default 993): use --ssl, or the ssl user option in an rcfile.
  - On IMAP and POP3 connections, --auth ssh no longer prevents
    STARTTLS negotiation.
  - On IMAP connections, fetchmail does not permit overriding
    a server-side LOGINDISABLED with --auth password any more.
  - On POP3 connections, the possibility for RPA authentication
    (by probing with an AUTH command without arguments) no longer
    prevents STARTTLS negotiation.
  - For POP3 connections, only attempt RPA if the authentication
    type is "any".
  * BUG FIXES:
  - On IMAP connections, when AUTHENTICATE EXTERNAL fails and we
    have received the tagged (= final) response, do not send "*".
  - On IMAP connections, AUTHENTICATE EXTERNAL without username
    will properly send a "=" for protocol compliance.
  - On IMAP connections, AUTHENTICATE EXTERNAL will now check if
    the server advertised SASL-IR (RFC-4959) support and otherwise
    refuse (fetchmail &lt;= 6.4 has not supported and does not support
    the separate challenge/response with command continuation)
  - On IMAP connections, when --auth external is requested but not
    advertised by the server, log a proper error message.
  - Fetchmail no longer crashes when attempting a connection with
  - -plugin "" or --plugout "".
  - Fetchmail no longer leaks memory when processing the arguments
    of --plugin or --plugout on connections.
  - On POP3 connections, the CAPAbilities parser is now caseblind.
  - Fix segfault on configurations with "defaults ... no envelope".
    This is a regression in fetchmail 6.4.3 and happened when
    plugging memory leaks, which did not account for that the
    envelope parameter is special when set as "no envelope". The
    segfault happens in a constant strlen(-1), triggered by trusted
    local input =&gt; no vulnerability.
  - Fix program abort (SIGABRT) with "internal error" when invalid
    sslproto is given with OpenSSL 1.1.0 API compatible SSL
    implementations.
  * CHANGES:
  - IMAP: When fetchmail is in not-authenticated state and the server
    volunteers CAPABILITY information, use it and do not re-probe.
    (After STARTTLS, fetchmail must and will re-probe explicitly.)
  - For typical POP3/IMAP ports 110, 143, 993, 995, if port and --ssl
    option do not match, emit a warning and continue.
  - fetchmail.man and README.SSL were updated in line with
    RFC-8314/8996/8997 recommendations to prefer Implicit TLS
    (--ssl/ssl) and TLS v1.2 or newer, placing --sslproto tls1.2+
    more prominently. The defaults shall not change between 6.4.X
    releases for compatibility.
  * Rebase patches:
    fetchmail-add-imap-oauthbearer-support.patch
    fetchmail-add-query_to64_outsize-utility-function.patch
    fetchmail-support-oauthbearer-xoauth2-with-pop3.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1635336001">- Update to 6.4.22 in SLE-15-SP2:
  [jsc#SLE-18159, jsc#SLE-17903, jsc#SLE-18059]
  * Remove all python2 dependencies [bsc#1190896]
  * Remove fetchmail-CVE-2021-39272.patch fixed in the update</changelog>
  <changelog author="david.anes@suse.com" date="1641988800">- fix [bsc#1194203]:
  * Always create fetchmail group, even if the user is already
  present, as a leftover from Leap 15.2 upgrade. This may happen
  also if user is messing with groups/users directly or upgrading
  from even an older fetchmail versions.</changelog>
  <changelog author="david.anes@suse.com" date="1643371200">- fix [bsc#1193894]
  * Restore autoprobe functionality behaviour as per 6.3.x version
  * Added patch fetchmail-restore-auto-probe-behaviour.patch</changelog>
</package>
<package pkgid="2ec0e117ebd646c1e6c086988024df8dbe171f2e10d5b8951aafb54e99cce6b5" name="fetchmailconf" arch="s390x">
  <version epoch="0" ver="6.4.22" rel="20.26.1"/>
  <changelog author="dmueller@suse.com" date="1599220800">- update to 6.4.12:
  [#] REGRESSION FIX:
  * configure: fetchmail 6.4.9 and 6.4.10 would miss checking for TLS v1.2 and
  TLS v1.3 support if AC_LIB_LINKFLAGS came up with something such as
  /path/to/libssl.so, rather than -lssl. (For instance on FreeBSD)
  * configure: fetchmail 6.4.9's configure was unable to pick up OpenSSL
  if it wasn't announced by pkg-config, for instance, on FreeBSD</changelog>
  <changelog author="kukuk@suse.com" date="1608292800">- Don't require systemd
- Use tmpfiles for all files
- Use systemd macro for tmpfiles
- Don't delete home directory if the user stays
- Use sysusers config to create system user</changelog>
  <changelog author="dmueller@suse.com" date="1608379200">- update to 6.4.14:
  * sr:    ???????? ??????? (Miroslav Nikoli?) [Serbian]
  * Errors about lock file (= pidfile) creation could be lost in daemon
  configurations (-d option, or set daemon) when using syslog. Now they are also
  logged to syslog.  Found verifying a pidfile creation issue on 6.4.12 that was
  previously reported by Alex Hall of Automatic Distributors.
  * If the lock file cannot be removed (no write permission on directory), try
  to truncate it, and if that fails, report error.
  * If the pidfile was non-default, fetchmail -q or --quit would malfunction and
  claim no other fetchmail were running, because it did not read the
  configuration files or merge the command line options, thus it would look for
  the PID in the wrong file.</changelog>
  <changelog author="dmueller@suse.com" date="1609761600">- update to 6.4.15:
  * Fix a typo in the manual page reported by David McKelvie.
  * Fix cross-compilation with openssl, by Fabrice Fontaine. Merge request !23.
  * Fix truncation of SMTP PLAIN AUTH with ^ in credentials, by Earl Chew.</changelog>
  <changelog author="pmonreal@suse.com" date="1614600000">- update to 6.4.16:
  * fetchmail's --configdump, and fetchmailconf, lacked support for
    the sslcertfile option.
  * fetchmail --version [fetchmail -V] now queries and prints the
    SSL/TLS library's "SSL default trusted certificate" file or
    directory (mind the word "default"), where the OpenSSL-compatible
    TLS implementation will look for trusted root, meaning
    certification authority (CA), certificates.
  * fetchmail --version now prints version of the OpenSSL library
    that it was compiled against, and that it is using at runtime,
    and also the OPENSSL_DIR and OPENSSL_ENGINES_DIR (if available).</changelog>
  <changelog author="pmonreal@suse.com" date="1614600001">- Set the hostname for SNI when using TLS [bsc#1182807]
- Add fetchmail-SNI-hostname-support.patch</changelog>
  <changelog author="dmueller@suse.com" date="1617710400">- update to 6.4.18:
  * fetchmailconf: fetchmail 6.4.16 added --sslcertfile to the configuration dump,
    but fetchmailconf support was incomplete in Git 7349f124 and it could not
    parse sslcertfile, thus the user settings editor came up empty with console
    errors printed.  Fix configuration parser in fetchmailconf.
  * fetchmailconf: do not require fetchmail for -V. do not require Tk (Tkinter)
    for -d option. This is to fail more gracefully on incomplete installs.
  * TLS code: remove OPENSSL_NO_DEPRECATED macros to avoid portability issues
    with OpenSSL v3 - these are for development purposes, not production.
  * TLS futureproofing: use SSL_use_PrivateKey_file instead of
    SSL_use_RSAPrivateKey_file, the latter will be deprecated with OpenSSL v3,
    and the user's key file might be something else than RSA.
  * IMAP client: it used to leak memory for username and password when trying
    the LOGIN (password-based) authentication and encountered a timeout situation.
  * dist-tools/getstats.py: also counts lines in *.py files, shown above.
  * fetchmail.man: now mentions that you may need to add --ssl when specifying
    a TLS-wrapped port.
  * fetchmailconf: --version (-V) now prints the Python version in use.</changelog>
  <changelog author="dmueller@suse.com" date="1620475200">- update to 6.4.19:
  * fetchmailconf: properly catch and report option parsing errors
  * LMTP: do not try to validate the last component of a UNIX-domain LMTP socket
    as though it were a TCP port.</changelog>
  <changelog author="jeffm@suse.com" date="1620907200">- Backported support for OAUTH2 authentication from Fetchmail 7.0.
  - add imap oauthbearer support
  - support oauthbearer/xoauth2 with pop3
  - add passwordfile and passwordfd options
  - add contrib/fetchnmail-oauth2.py token acquisition utility
  - FAQ: list gmail options including oauthbearer and app password
  - give each ctl it's own copy of password
  - re-read passwordfile on every poll
  - add query_to64_outsize() utility function
  - Chase and integrate interface change.
  - oauth2.c: calculate and pass in correct buffer size to to64frombits()
  - Increase max password length to handle oauth tokens
  - Bump max. passwordlen to 10000 bytes.
  - Add README.OAUTH2
- Added patches:
  * fetchmail-add-imap-oauthbearer-support.patch
  * fetchmail-support-oauthbearer-xoauth2-with-pop3.patch
  * fetchmail-add-passwordfile-and-passwordfd-options.patch
  * fetchmail-add-contrib-fetchnmail-oauth2.py-token-acquisition-u.patch
  * fetchmail-FAQ-list-gmail-options-including-oauthbearer-and-app.patch
  * fetchmail-give-each-ctl-it-s-own-copy-of-password.patch
  * fetchmail-re-read-passwordfile-on-every-poll.patch
  * fetchmail-add-query_to64_outsize-utility-function.patch
  * fetchmail-chase-and-integrate-interface-change.patch
  * fetchmail-oauth2-c-calculate-and-pass-in-correct-buffer-size-to-to64frombits.patch
  * fetchmail-increase-max-password-length-to-handle-oauth-tokens.patch
  * fetchmail-bump-max-passwordlen-to-1bytes.patch
  * fetchmail-add-readme-oauth2-issue-27.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1626091200">- Change PASSWORDLEN from 64 to 256 [bsc#1188034]
  * Add fetchmail-PASSWORDLEN-256.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1627560000">- Update to 6.4.20: [bsc#1188875, CVE-2021-36386]
  * CVE-2021-36386: DoS or information disclosure in some configurations.
    When a log message exceeds c. 2 kByte in size, for instance,
    with very long header contents, and depending on verbosity
    option, fetchmail can crash or misreport each first log message
    that requires a buffer reallocation. fetchmail then reallocates
    memory and re-runs vsnprintf() without another call to va_start(),
    so it reads garbage. The exact impact depends on many factors
    around the compiler and operating system configurations used and
    the implementation details of the stdarg.h interfaces of the two
    functions mentioned before.</changelog>
  <changelog author="pmonreal@suse.com" date="1627560001">- Security fix: [bsc#1188875, CVE-2021-36386]
  * DoS or information disclosure in some configurations.
  * See also: https://www.fetchmail.info/fetchmail-SA-2021-01.txt
  * Add fetchmail-CVE-2021-36386.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1629806400">- Update to 6.4.21:
  * REGRESSION FIX: The new security fix in 6.4.20 for
    CVE-2021-36386 caused truncation of messages logged to
    buffered outputs, predominantly --logfile.</changelog>
  <changelog author="pmonreal@suse.com" date="1629806401">- Update to 6.4.21 in SLE-15-SP2:
  [jsc#SLE-18159, jsc#SLE-17903, jsc#SLE-18059]
  * Remove patches fixed upstream:
  - fetchmail-SNI-hostname-support.patch
  - fetchmail-CVE-2021-36386.patch
  - fetchmail-PASSWORDLEN-256.patch</changelog>
  <changelog author="jsegitz@suse.com" date="1631620800">- Added hardening to systemd service(s) (bsc#1181400). Modified:
  * fetchmail.service</changelog>
  <changelog author="pmonreal@suse.com" date="1633694400">- Security fix: [bsc#1190069, CVE-2021-39272]
  * Fix failure to enforce STARTTLS session encryption in some
    circumstances, such as a certain situation with IMAP and PREAUTH.
  * Advisory: https://www.fetchmail.info/fetchmail-SA-2021-02.txt
  * Add fetchmail-CVE-2021-39272.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1635336000">- Update to 6.4.22: [bsc#1190069, CVE-2021-39272]
  * OPENSSL AND LICENSING NOTE:
  - fetchmail 6.4.22 is compatible with OpenSSL 1.1.1 and 3.0.0.
    OpenSSL's licensing changed between these releases from dual
    OpenSSL/SSLeay license to Apache License v2.0, which is
    considered incompatible with GPL v2 by the FSF. For
    implications and details, see the file COPYING.
  * SECURITY FIXES:
  - CVE-2021-39272: fetchmail-SA-2021-02: On IMAP connections,
    without --ssl and with nonempty --sslproto, meaning that
    fetchmail is to enforce TLS, and when the server or an attacker
    sends a PREAUTH greeting, fetchmail used to continue an
    unencrypted connection. Now, log the error and abort the
    connection. --Recommendation for servers that support
    SSL/TLS-wrapped or "implicit" mode on a dedicated port
    (default 993): use --ssl, or the ssl user option in an rcfile.
  - On IMAP and POP3 connections, --auth ssh no longer prevents
    STARTTLS negotiation.
  - On IMAP connections, fetchmail does not permit overriding
    a server-side LOGINDISABLED with --auth password any more.
  - On POP3 connections, the possibility for RPA authentication
    (by probing with an AUTH command without arguments) no longer
    prevents STARTTLS negotiation.
  - For POP3 connections, only attempt RPA if the authentication
    type is "any".
  * BUG FIXES:
  - On IMAP connections, when AUTHENTICATE EXTERNAL fails and we
    have received the tagged (= final) response, do not send "*".
  - On IMAP connections, AUTHENTICATE EXTERNAL without username
    will properly send a "=" for protocol compliance.
  - On IMAP connections, AUTHENTICATE EXTERNAL will now check if
    the server advertised SASL-IR (RFC-4959) support and otherwise
    refuse (fetchmail &lt;= 6.4 has not supported and does not support
    the separate challenge/response with command continuation)
  - On IMAP connections, when --auth external is requested but not
    advertised by the server, log a proper error message.
  - Fetchmail no longer crashes when attempting a connection with
  - -plugin "" or --plugout "".
  - Fetchmail no longer leaks memory when processing the arguments
    of --plugin or --plugout on connections.
  - On POP3 connections, the CAPAbilities parser is now caseblind.
  - Fix segfault on configurations with "defaults ... no envelope".
    This is a regression in fetchmail 6.4.3 and happened when
    plugging memory leaks, which did not account for that the
    envelope parameter is special when set as "no envelope". The
    segfault happens in a constant strlen(-1), triggered by trusted
    local input =&gt; no vulnerability.
  - Fix program abort (SIGABRT) with "internal error" when invalid
    sslproto is given with OpenSSL 1.1.0 API compatible SSL
    implementations.
  * CHANGES:
  - IMAP: When fetchmail is in not-authenticated state and the server
    volunteers CAPABILITY information, use it and do not re-probe.
    (After STARTTLS, fetchmail must and will re-probe explicitly.)
  - For typical POP3/IMAP ports 110, 143, 993, 995, if port and --ssl
    option do not match, emit a warning and continue.
  - fetchmail.man and README.SSL were updated in line with
    RFC-8314/8996/8997 recommendations to prefer Implicit TLS
    (--ssl/ssl) and TLS v1.2 or newer, placing --sslproto tls1.2+
    more prominently. The defaults shall not change between 6.4.X
    releases for compatibility.
  * Rebase patches:
    fetchmail-add-imap-oauthbearer-support.patch
    fetchmail-add-query_to64_outsize-utility-function.patch
    fetchmail-support-oauthbearer-xoauth2-with-pop3.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1635336001">- Update to 6.4.22 in SLE-15-SP2:
  [jsc#SLE-18159, jsc#SLE-17903, jsc#SLE-18059]
  * Remove all python2 dependencies [bsc#1190896]
  * Remove fetchmail-CVE-2021-39272.patch fixed in the update</changelog>
  <changelog author="david.anes@suse.com" date="1641988800">- fix [bsc#1194203]:
  * Always create fetchmail group, even if the user is already
  present, as a leftover from Leap 15.2 upgrade. This may happen
  also if user is messing with groups/users directly or upgrading
  from even an older fetchmail versions.</changelog>
  <changelog author="david.anes@suse.com" date="1643371200">- fix [bsc#1193894]
  * Restore autoprobe functionality behaviour as per 6.3.x version
  * Added patch fetchmail-restore-auto-probe-behaviour.patch</changelog>
</package>
<package pkgid="d6952e5b41fba7d1f88f3400c050c2f8464903e49d22b1ac03a2ae03109367fd" name="fetchmailconf" arch="x86_64">
  <version epoch="0" ver="6.4.22" rel="20.26.1"/>
  <changelog author="dmueller@suse.com" date="1599220800">- update to 6.4.12:
  [#] REGRESSION FIX:
  * configure: fetchmail 6.4.9 and 6.4.10 would miss checking for TLS v1.2 and
  TLS v1.3 support if AC_LIB_LINKFLAGS came up with something such as
  /path/to/libssl.so, rather than -lssl. (For instance on FreeBSD)
  * configure: fetchmail 6.4.9's configure was unable to pick up OpenSSL
  if it wasn't announced by pkg-config, for instance, on FreeBSD</changelog>
  <changelog author="kukuk@suse.com" date="1608292800">- Don't require systemd
- Use tmpfiles for all files
- Use systemd macro for tmpfiles
- Don't delete home directory if the user stays
- Use sysusers config to create system user</changelog>
  <changelog author="dmueller@suse.com" date="1608379200">- update to 6.4.14:
  * sr:    ???????? ??????? (Miroslav Nikoli?) [Serbian]
  * Errors about lock file (= pidfile) creation could be lost in daemon
  configurations (-d option, or set daemon) when using syslog. Now they are also
  logged to syslog.  Found verifying a pidfile creation issue on 6.4.12 that was
  previously reported by Alex Hall of Automatic Distributors.
  * If the lock file cannot be removed (no write permission on directory), try
  to truncate it, and if that fails, report error.
  * If the pidfile was non-default, fetchmail -q or --quit would malfunction and
  claim no other fetchmail were running, because it did not read the
  configuration files or merge the command line options, thus it would look for
  the PID in the wrong file.</changelog>
  <changelog author="dmueller@suse.com" date="1609761600">- update to 6.4.15:
  * Fix a typo in the manual page reported by David McKelvie.
  * Fix cross-compilation with openssl, by Fabrice Fontaine. Merge request !23.
  * Fix truncation of SMTP PLAIN AUTH with ^ in credentials, by Earl Chew.</changelog>
  <changelog author="pmonreal@suse.com" date="1614600000">- update to 6.4.16:
  * fetchmail's --configdump, and fetchmailconf, lacked support for
    the sslcertfile option.
  * fetchmail --version [fetchmail -V] now queries and prints the
    SSL/TLS library's "SSL default trusted certificate" file or
    directory (mind the word "default"), where the OpenSSL-compatible
    TLS implementation will look for trusted root, meaning
    certification authority (CA), certificates.
  * fetchmail --version now prints version of the OpenSSL library
    that it was compiled against, and that it is using at runtime,
    and also the OPENSSL_DIR and OPENSSL_ENGINES_DIR (if available).</changelog>
  <changelog author="pmonreal@suse.com" date="1614600001">- Set the hostname for SNI when using TLS [bsc#1182807]
- Add fetchmail-SNI-hostname-support.patch</changelog>
  <changelog author="dmueller@suse.com" date="1617710400">- update to 6.4.18:
  * fetchmailconf: fetchmail 6.4.16 added --sslcertfile to the configuration dump,
    but fetchmailconf support was incomplete in Git 7349f124 and it could not
    parse sslcertfile, thus the user settings editor came up empty with console
    errors printed.  Fix configuration parser in fetchmailconf.
  * fetchmailconf: do not require fetchmail for -V. do not require Tk (Tkinter)
    for -d option. This is to fail more gracefully on incomplete installs.
  * TLS code: remove OPENSSL_NO_DEPRECATED macros to avoid portability issues
    with OpenSSL v3 - these are for development purposes, not production.
  * TLS futureproofing: use SSL_use_PrivateKey_file instead of
    SSL_use_RSAPrivateKey_file, the latter will be deprecated with OpenSSL v3,
    and the user's key file might be something else than RSA.
  * IMAP client: it used to leak memory for username and password when trying
    the LOGIN (password-based) authentication and encountered a timeout situation.
  * dist-tools/getstats.py: also counts lines in *.py files, shown above.
  * fetchmail.man: now mentions that you may need to add --ssl when specifying
    a TLS-wrapped port.
  * fetchmailconf: --version (-V) now prints the Python version in use.</changelog>
  <changelog author="dmueller@suse.com" date="1620475200">- update to 6.4.19:
  * fetchmailconf: properly catch and report option parsing errors
  * LMTP: do not try to validate the last component of a UNIX-domain LMTP socket
    as though it were a TCP port.</changelog>
  <changelog author="jeffm@suse.com" date="1620907200">- Backported support for OAUTH2 authentication from Fetchmail 7.0.
  - add imap oauthbearer support
  - support oauthbearer/xoauth2 with pop3
  - add passwordfile and passwordfd options
  - add contrib/fetchnmail-oauth2.py token acquisition utility
  - FAQ: list gmail options including oauthbearer and app password
  - give each ctl it's own copy of password
  - re-read passwordfile on every poll
  - add query_to64_outsize() utility function
  - Chase and integrate interface change.
  - oauth2.c: calculate and pass in correct buffer size to to64frombits()
  - Increase max password length to handle oauth tokens
  - Bump max. passwordlen to 10000 bytes.
  - Add README.OAUTH2
- Added patches:
  * fetchmail-add-imap-oauthbearer-support.patch
  * fetchmail-support-oauthbearer-xoauth2-with-pop3.patch
  * fetchmail-add-passwordfile-and-passwordfd-options.patch
  * fetchmail-add-contrib-fetchnmail-oauth2.py-token-acquisition-u.patch
  * fetchmail-FAQ-list-gmail-options-including-oauthbearer-and-app.patch
  * fetchmail-give-each-ctl-it-s-own-copy-of-password.patch
  * fetchmail-re-read-passwordfile-on-every-poll.patch
  * fetchmail-add-query_to64_outsize-utility-function.patch
  * fetchmail-chase-and-integrate-interface-change.patch
  * fetchmail-oauth2-c-calculate-and-pass-in-correct-buffer-size-to-to64frombits.patch
  * fetchmail-increase-max-password-length-to-handle-oauth-tokens.patch
  * fetchmail-bump-max-passwordlen-to-1bytes.patch
  * fetchmail-add-readme-oauth2-issue-27.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1626091200">- Change PASSWORDLEN from 64 to 256 [bsc#1188034]
  * Add fetchmail-PASSWORDLEN-256.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1627560000">- Update to 6.4.20: [bsc#1188875, CVE-2021-36386]
  * CVE-2021-36386: DoS or information disclosure in some configurations.
    When a log message exceeds c. 2 kByte in size, for instance,
    with very long header contents, and depending on verbosity
    option, fetchmail can crash or misreport each first log message
    that requires a buffer reallocation. fetchmail then reallocates
    memory and re-runs vsnprintf() without another call to va_start(),
    so it reads garbage. The exact impact depends on many factors
    around the compiler and operating system configurations used and
    the implementation details of the stdarg.h interfaces of the two
    functions mentioned before.</changelog>
  <changelog author="pmonreal@suse.com" date="1627560001">- Security fix: [bsc#1188875, CVE-2021-36386]
  * DoS or information disclosure in some configurations.
  * See also: https://www.fetchmail.info/fetchmail-SA-2021-01.txt
  * Add fetchmail-CVE-2021-36386.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1629806400">- Update to 6.4.21:
  * REGRESSION FIX: The new security fix in 6.4.20 for
    CVE-2021-36386 caused truncation of messages logged to
    buffered outputs, predominantly --logfile.</changelog>
  <changelog author="pmonreal@suse.com" date="1629806401">- Update to 6.4.21 in SLE-15-SP2:
  [jsc#SLE-18159, jsc#SLE-17903, jsc#SLE-18059]
  * Remove patches fixed upstream:
  - fetchmail-SNI-hostname-support.patch
  - fetchmail-CVE-2021-36386.patch
  - fetchmail-PASSWORDLEN-256.patch</changelog>
  <changelog author="jsegitz@suse.com" date="1631620800">- Added hardening to systemd service(s) (bsc#1181400). Modified:
  * fetchmail.service</changelog>
  <changelog author="pmonreal@suse.com" date="1633694400">- Security fix: [bsc#1190069, CVE-2021-39272]
  * Fix failure to enforce STARTTLS session encryption in some
    circumstances, such as a certain situation with IMAP and PREAUTH.
  * Advisory: https://www.fetchmail.info/fetchmail-SA-2021-02.txt
  * Add fetchmail-CVE-2021-39272.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1635336000">- Update to 6.4.22: [bsc#1190069, CVE-2021-39272]
  * OPENSSL AND LICENSING NOTE:
  - fetchmail 6.4.22 is compatible with OpenSSL 1.1.1 and 3.0.0.
    OpenSSL's licensing changed between these releases from dual
    OpenSSL/SSLeay license to Apache License v2.0, which is
    considered incompatible with GPL v2 by the FSF. For
    implications and details, see the file COPYING.
  * SECURITY FIXES:
  - CVE-2021-39272: fetchmail-SA-2021-02: On IMAP connections,
    without --ssl and with nonempty --sslproto, meaning that
    fetchmail is to enforce TLS, and when the server or an attacker
    sends a PREAUTH greeting, fetchmail used to continue an
    unencrypted connection. Now, log the error and abort the
    connection. --Recommendation for servers that support
    SSL/TLS-wrapped or "implicit" mode on a dedicated port
    (default 993): use --ssl, or the ssl user option in an rcfile.
  - On IMAP and POP3 connections, --auth ssh no longer prevents
    STARTTLS negotiation.
  - On IMAP connections, fetchmail does not permit overriding
    a server-side LOGINDISABLED with --auth password any more.
  - On POP3 connections, the possibility for RPA authentication
    (by probing with an AUTH command without arguments) no longer
    prevents STARTTLS negotiation.
  - For POP3 connections, only attempt RPA if the authentication
    type is "any".
  * BUG FIXES:
  - On IMAP connections, when AUTHENTICATE EXTERNAL fails and we
    have received the tagged (= final) response, do not send "*".
  - On IMAP connections, AUTHENTICATE EXTERNAL without username
    will properly send a "=" for protocol compliance.
  - On IMAP connections, AUTHENTICATE EXTERNAL will now check if
    the server advertised SASL-IR (RFC-4959) support and otherwise
    refuse (fetchmail &lt;= 6.4 has not supported and does not support
    the separate challenge/response with command continuation)
  - On IMAP connections, when --auth external is requested but not
    advertised by the server, log a proper error message.
  - Fetchmail no longer crashes when attempting a connection with
  - -plugin "" or --plugout "".
  - Fetchmail no longer leaks memory when processing the arguments
    of --plugin or --plugout on connections.
  - On POP3 connections, the CAPAbilities parser is now caseblind.
  - Fix segfault on configurations with "defaults ... no envelope".
    This is a regression in fetchmail 6.4.3 and happened when
    plugging memory leaks, which did not account for that the
    envelope parameter is special when set as "no envelope". The
    segfault happens in a constant strlen(-1), triggered by trusted
    local input =&gt; no vulnerability.
  - Fix program abort (SIGABRT) with "internal error" when invalid
    sslproto is given with OpenSSL 1.1.0 API compatible SSL
    implementations.
  * CHANGES:
  - IMAP: When fetchmail is in not-authenticated state and the server
    volunteers CAPABILITY information, use it and do not re-probe.
    (After STARTTLS, fetchmail must and will re-probe explicitly.)
  - For typical POP3/IMAP ports 110, 143, 993, 995, if port and --ssl
    option do not match, emit a warning and continue.
  - fetchmail.man and README.SSL were updated in line with
    RFC-8314/8996/8997 recommendations to prefer Implicit TLS
    (--ssl/ssl) and TLS v1.2 or newer, placing --sslproto tls1.2+
    more prominently. The defaults shall not change between 6.4.X
    releases for compatibility.
  * Rebase patches:
    fetchmail-add-imap-oauthbearer-support.patch
    fetchmail-add-query_to64_outsize-utility-function.patch
    fetchmail-support-oauthbearer-xoauth2-with-pop3.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1635336001">- Update to 6.4.22 in SLE-15-SP2:
  [jsc#SLE-18159, jsc#SLE-17903, jsc#SLE-18059]
  * Remove all python2 dependencies [bsc#1190896]
  * Remove fetchmail-CVE-2021-39272.patch fixed in the update</changelog>
  <changelog author="david.anes@suse.com" date="1641988800">- fix [bsc#1194203]:
  * Always create fetchmail group, even if the user is already
  present, as a leftover from Leap 15.2 upgrade. This may happen
  also if user is messing with groups/users directly or upgrading
  from even an older fetchmail versions.</changelog>
  <changelog author="david.anes@suse.com" date="1643371200">- fix [bsc#1193894]
  * Restore autoprobe functionality behaviour as per 6.3.x version
  * Added patch fetchmail-restore-auto-probe-behaviour.patch</changelog>
</package>
<package pkgid="34c90800f26388cd3963590893797e6c60a91a4f712a0f65cfee2505aa0a4419" name="freeradius-client" arch="aarch64">
  <version epoch="0" ver="1.1.7" rel="3.2.1"/>
  <changelog author="prusnak@suse.cz" date="1173355200">- created package from BuildService
  * project: network:aaa
  * package: freeradius-client
  * version: 1.1.5</changelog>
  <changelog author="prusnak@suse.cz" date="1194436800">- change %{version}-%{release} to %{version} in Requires tag</changelog>
  <changelog author="crrodriguez@suse.de" date="1204718400">- fix build in BETA
- disable static libraries</changelog>
  <changelog author="prusnak@suse.cz" date="1205928000">- updated to 1.1.6
  o Added dead_time functionality / configuration
  o Merge in fixes and enhancements from 'radiusclient-ng'
  o Improved functionality for embedded operation
  - In use in FreeSWITCH and OpenSER projects
  o Wrap gethostby*() family of calls with threadsafe variants
  o Change UINT4 to uint32_t, int to size_t, etc.
  o Fixed wrong usage of strncat function in several places
- dropped obsoleted patches:
  * return.patch (included in update)
  * strncat.patch (included in update)</changelog>
  <changelog author="prusnak@suse.cz" date="1234872000">- fix garbled login.example file [bnc#469682]</changelog>
  <changelog author="coolo@suse.com" date="1317470400">- add libtool as buildrequire to make the spec file more reliable</changelog>
  <changelog author="coolo@suse.com" date="1323172800">- BAD2c is not a license</changelog>
  <changelog author="vcizek@suse.com" date="1429790400">- update to 1.1.7:
  * Allow "configure --with-nettle" to use nettle MD5 implementation. Patch from Nikos Mavrogiannopoulos.
  * Clean up generation of random numbers. Patch from Nikos Mavrogiannopoulos.
  * Update BSD license as permitted by Christos Zoulas.
  * Define PW_MAX_MSG_SIZE for maximum message sice. Patch from Nikos Mavrogiannopoulos.
  * Allow the dictionary file parser to understand BEGIN-VENDOR / END-VENDOR as with FreeRADIUS server. Patch from Nikos Mavrogiannopoulos.
  * Added support for IPv6. Patch from Nikos Mavrogiannopoulos.
  * Don't crash if a config option is unset. Patch from Nikos Mavrogiannopoulos.
  * Fix encoding of "date" attributes. Patch from Christian Schoch.
  * Build fixes from Sven Neuhaus, Ghennadi Procopciuc, Daniel Pocock, and gureedo.
  * Fix memory leaks. Patches from Alex Massover, William King, gureedo, and FreeSWITCH.
  * Fixes to retry algorithm. Patch from Lewis Adam.
  * Zero out secret fields. Patch from Scott Neugroschl.
  * Update the dictionaries. Patches from Bogdan-Andrei Iancu and gureedo.
  * Make the library thread-safe. Based on a patch from Alex Massover.
  * Made rc_avpair_log thread-safe by using a buffer supplied by the caller. Patch from Alex Massover.
  * Removed lock file for sequence number. It isn't needed.
  * Use poll() where possible to avoid issues with FD_SETSIZE. Patch from Alfred E. Heggestad.
  * Set Acct-Delay-Time in Accounting-Request packets. Patch from Alfred E. Heggestad.
- add freeradius-client-missing_size_t_definition.patch to fix
  build on 13.2</changelog>
</package>
<package pkgid="846a0256e98a810118847e6f6a3cc5c4362565d33e1d3385d6f51ed555168064" name="freeradius-client" arch="ppc64le">
  <version epoch="0" ver="1.1.7" rel="3.2.1"/>
  <changelog author="prusnak@suse.cz" date="1173355200">- created package from BuildService
  * project: network:aaa
  * package: freeradius-client
  * version: 1.1.5</changelog>
  <changelog author="prusnak@suse.cz" date="1194436800">- change %{version}-%{release} to %{version} in Requires tag</changelog>
  <changelog author="crrodriguez@suse.de" date="1204718400">- fix build in BETA
- disable static libraries</changelog>
  <changelog author="prusnak@suse.cz" date="1205928000">- updated to 1.1.6
  o Added dead_time functionality / configuration
  o Merge in fixes and enhancements from 'radiusclient-ng'
  o Improved functionality for embedded operation
  - In use in FreeSWITCH and OpenSER projects
  o Wrap gethostby*() family of calls with threadsafe variants
  o Change UINT4 to uint32_t, int to size_t, etc.
  o Fixed wrong usage of strncat function in several places
- dropped obsoleted patches:
  * return.patch (included in update)
  * strncat.patch (included in update)</changelog>
  <changelog author="prusnak@suse.cz" date="1234872000">- fix garbled login.example file [bnc#469682]</changelog>
  <changelog author="coolo@suse.com" date="1317470400">- add libtool as buildrequire to make the spec file more reliable</changelog>
  <changelog author="coolo@suse.com" date="1323172800">- BAD2c is not a license</changelog>
  <changelog author="vcizek@suse.com" date="1429790400">- update to 1.1.7:
  * Allow "configure --with-nettle" to use nettle MD5 implementation. Patch from Nikos Mavrogiannopoulos.
  * Clean up generation of random numbers. Patch from Nikos Mavrogiannopoulos.
  * Update BSD license as permitted by Christos Zoulas.
  * Define PW_MAX_MSG_SIZE for maximum message sice. Patch from Nikos Mavrogiannopoulos.
  * Allow the dictionary file parser to understand BEGIN-VENDOR / END-VENDOR as with FreeRADIUS server. Patch from Nikos Mavrogiannopoulos.
  * Added support for IPv6. Patch from Nikos Mavrogiannopoulos.
  * Don't crash if a config option is unset. Patch from Nikos Mavrogiannopoulos.
  * Fix encoding of "date" attributes. Patch from Christian Schoch.
  * Build fixes from Sven Neuhaus, Ghennadi Procopciuc, Daniel Pocock, and gureedo.
  * Fix memory leaks. Patches from Alex Massover, William King, gureedo, and FreeSWITCH.
  * Fixes to retry algorithm. Patch from Lewis Adam.
  * Zero out secret fields. Patch from Scott Neugroschl.
  * Update the dictionaries. Patches from Bogdan-Andrei Iancu and gureedo.
  * Make the library thread-safe. Based on a patch from Alex Massover.
  * Made rc_avpair_log thread-safe by using a buffer supplied by the caller. Patch from Alex Massover.
  * Removed lock file for sequence number. It isn't needed.
  * Use poll() where possible to avoid issues with FD_SETSIZE. Patch from Alfred E. Heggestad.
  * Set Acct-Delay-Time in Accounting-Request packets. Patch from Alfred E. Heggestad.
- add freeradius-client-missing_size_t_definition.patch to fix
  build on 13.2</changelog>
</package>
<package pkgid="64d60fe80b072bae6a7afe018fdab5e9de35cdaac4bcc9c70157ea1719db025f" name="freeradius-client" arch="s390x">
  <version epoch="0" ver="1.1.7" rel="3.2.1"/>
  <changelog author="prusnak@suse.cz" date="1173355200">- created package from BuildService
  * project: network:aaa
  * package: freeradius-client
  * version: 1.1.5</changelog>
  <changelog author="prusnak@suse.cz" date="1194436800">- change %{version}-%{release} to %{version} in Requires tag</changelog>
  <changelog author="crrodriguez@suse.de" date="1204718400">- fix build in BETA
- disable static libraries</changelog>
  <changelog author="prusnak@suse.cz" date="1205928000">- updated to 1.1.6
  o Added dead_time functionality / configuration
  o Merge in fixes and enhancements from 'radiusclient-ng'
  o Improved functionality for embedded operation
  - In use in FreeSWITCH and OpenSER projects
  o Wrap gethostby*() family of calls with threadsafe variants
  o Change UINT4 to uint32_t, int to size_t, etc.
  o Fixed wrong usage of strncat function in several places
- dropped obsoleted patches:
  * return.patch (included in update)
  * strncat.patch (included in update)</changelog>
  <changelog author="prusnak@suse.cz" date="1234872000">- fix garbled login.example file [bnc#469682]</changelog>
  <changelog author="coolo@suse.com" date="1317470400">- add libtool as buildrequire to make the spec file more reliable</changelog>
  <changelog author="coolo@suse.com" date="1323172800">- BAD2c is not a license</changelog>
  <changelog author="vcizek@suse.com" date="1429790400">- update to 1.1.7:
  * Allow "configure --with-nettle" to use nettle MD5 implementation. Patch from Nikos Mavrogiannopoulos.
  * Clean up generation of random numbers. Patch from Nikos Mavrogiannopoulos.
  * Update BSD license as permitted by Christos Zoulas.
  * Define PW_MAX_MSG_SIZE for maximum message sice. Patch from Nikos Mavrogiannopoulos.
  * Allow the dictionary file parser to understand BEGIN-VENDOR / END-VENDOR as with FreeRADIUS server. Patch from Nikos Mavrogiannopoulos.
  * Added support for IPv6. Patch from Nikos Mavrogiannopoulos.
  * Don't crash if a config option is unset. Patch from Nikos Mavrogiannopoulos.
  * Fix encoding of "date" attributes. Patch from Christian Schoch.
  * Build fixes from Sven Neuhaus, Ghennadi Procopciuc, Daniel Pocock, and gureedo.
  * Fix memory leaks. Patches from Alex Massover, William King, gureedo, and FreeSWITCH.
  * Fixes to retry algorithm. Patch from Lewis Adam.
  * Zero out secret fields. Patch from Scott Neugroschl.
  * Update the dictionaries. Patches from Bogdan-Andrei Iancu and gureedo.
  * Make the library thread-safe. Based on a patch from Alex Massover.
  * Made rc_avpair_log thread-safe by using a buffer supplied by the caller. Patch from Alex Massover.
  * Removed lock file for sequence number. It isn't needed.
  * Use poll() where possible to avoid issues with FD_SETSIZE. Patch from Alfred E. Heggestad.
  * Set Acct-Delay-Time in Accounting-Request packets. Patch from Alfred E. Heggestad.
- add freeradius-client-missing_size_t_definition.patch to fix
  build on 13.2</changelog>
</package>
<package pkgid="f6b6de3b93138fc87f45a5107d86e071398e449a5e3f89b265eca84610dd2efb" name="freeradius-client" arch="src">
  <version epoch="0" ver="1.1.7" rel="3.2.1"/>
  <changelog author="prusnak@suse.cz" date="1173355200">- created package from BuildService
  * project: network:aaa
  * package: freeradius-client
  * version: 1.1.5</changelog>
  <changelog author="prusnak@suse.cz" date="1194436800">- change %{version}-%{release} to %{version} in Requires tag</changelog>
  <changelog author="crrodriguez@suse.de" date="1204718400">- fix build in BETA
- disable static libraries</changelog>
  <changelog author="prusnak@suse.cz" date="1205928000">- updated to 1.1.6
  o Added dead_time functionality / configuration
  o Merge in fixes and enhancements from 'radiusclient-ng'
  o Improved functionality for embedded operation
  - In use in FreeSWITCH and OpenSER projects
  o Wrap gethostby*() family of calls with threadsafe variants
  o Change UINT4 to uint32_t, int to size_t, etc.
  o Fixed wrong usage of strncat function in several places
- dropped obsoleted patches:
  * return.patch (included in update)
  * strncat.patch (included in update)</changelog>
  <changelog author="prusnak@suse.cz" date="1234872000">- fix garbled login.example file [bnc#469682]</changelog>
  <changelog author="coolo@suse.com" date="1317470400">- add libtool as buildrequire to make the spec file more reliable</changelog>
  <changelog author="coolo@suse.com" date="1323172800">- BAD2c is not a license</changelog>
  <changelog author="vcizek@suse.com" date="1429790400">- update to 1.1.7:
  * Allow "configure --with-nettle" to use nettle MD5 implementation. Patch from Nikos Mavrogiannopoulos.
  * Clean up generation of random numbers. Patch from Nikos Mavrogiannopoulos.
  * Update BSD license as permitted by Christos Zoulas.
  * Define PW_MAX_MSG_SIZE for maximum message sice. Patch from Nikos Mavrogiannopoulos.
  * Allow the dictionary file parser to understand BEGIN-VENDOR / END-VENDOR as with FreeRADIUS server. Patch from Nikos Mavrogiannopoulos.
  * Added support for IPv6. Patch from Nikos Mavrogiannopoulos.
  * Don't crash if a config option is unset. Patch from Nikos Mavrogiannopoulos.
  * Fix encoding of "date" attributes. Patch from Christian Schoch.
  * Build fixes from Sven Neuhaus, Ghennadi Procopciuc, Daniel Pocock, and gureedo.
  * Fix memory leaks. Patches from Alex Massover, William King, gureedo, and FreeSWITCH.
  * Fixes to retry algorithm. Patch from Lewis Adam.
  * Zero out secret fields. Patch from Scott Neugroschl.
  * Update the dictionaries. Patches from Bogdan-Andrei Iancu and gureedo.
  * Make the library thread-safe. Based on a patch from Alex Massover.
  * Made rc_avpair_log thread-safe by using a buffer supplied by the caller. Patch from Alex Massover.
  * Removed lock file for sequence number. It isn't needed.
  * Use poll() where possible to avoid issues with FD_SETSIZE. Patch from Alfred E. Heggestad.
  * Set Acct-Delay-Time in Accounting-Request packets. Patch from Alfred E. Heggestad.
- add freeradius-client-missing_size_t_definition.patch to fix
  build on 13.2</changelog>
</package>
<package pkgid="4686d8f08b83c8938e8924791acbce8e49a8b865520516f9c3bda0e2d8c136ae" name="freeradius-client" arch="x86_64">
  <version epoch="0" ver="1.1.7" rel="3.2.1"/>
  <changelog author="prusnak@suse.cz" date="1173355200">- created package from BuildService
  * project: network:aaa
  * package: freeradius-client
  * version: 1.1.5</changelog>
  <changelog author="prusnak@suse.cz" date="1194436800">- change %{version}-%{release} to %{version} in Requires tag</changelog>
  <changelog author="crrodriguez@suse.de" date="1204718400">- fix build in BETA
- disable static libraries</changelog>
  <changelog author="prusnak@suse.cz" date="1205928000">- updated to 1.1.6
  o Added dead_time functionality / configuration
  o Merge in fixes and enhancements from 'radiusclient-ng'
  o Improved functionality for embedded operation
  - In use in FreeSWITCH and OpenSER projects
  o Wrap gethostby*() family of calls with threadsafe variants
  o Change UINT4 to uint32_t, int to size_t, etc.
  o Fixed wrong usage of strncat function in several places
- dropped obsoleted patches:
  * return.patch (included in update)
  * strncat.patch (included in update)</changelog>
  <changelog author="prusnak@suse.cz" date="1234872000">- fix garbled login.example file [bnc#469682]</changelog>
  <changelog author="coolo@suse.com" date="1317470400">- add libtool as buildrequire to make the spec file more reliable</changelog>
  <changelog author="coolo@suse.com" date="1323172800">- BAD2c is not a license</changelog>
  <changelog author="vcizek@suse.com" date="1429790400">- update to 1.1.7:
  * Allow "configure --with-nettle" to use nettle MD5 implementation. Patch from Nikos Mavrogiannopoulos.
  * Clean up generation of random numbers. Patch from Nikos Mavrogiannopoulos.
  * Update BSD license as permitted by Christos Zoulas.
  * Define PW_MAX_MSG_SIZE for maximum message sice. Patch from Nikos Mavrogiannopoulos.
  * Allow the dictionary file parser to understand BEGIN-VENDOR / END-VENDOR as with FreeRADIUS server. Patch from Nikos Mavrogiannopoulos.
  * Added support for IPv6. Patch from Nikos Mavrogiannopoulos.
  * Don't crash if a config option is unset. Patch from Nikos Mavrogiannopoulos.
  * Fix encoding of "date" attributes. Patch from Christian Schoch.
  * Build fixes from Sven Neuhaus, Ghennadi Procopciuc, Daniel Pocock, and gureedo.
  * Fix memory leaks. Patches from Alex Massover, William King, gureedo, and FreeSWITCH.
  * Fixes to retry algorithm. Patch from Lewis Adam.
  * Zero out secret fields. Patch from Scott Neugroschl.
  * Update the dictionaries. Patches from Bogdan-Andrei Iancu and gureedo.
  * Make the library thread-safe. Based on a patch from Alex Massover.
  * Made rc_avpair_log thread-safe by using a buffer supplied by the caller. Patch from Alex Massover.
  * Removed lock file for sequence number. It isn't needed.
  * Use poll() where possible to avoid issues with FD_SETSIZE. Patch from Alfred E. Heggestad.
  * Set Acct-Delay-Time in Accounting-Request packets. Patch from Alfred E. Heggestad.
- add freeradius-client-missing_size_t_definition.patch to fix
  build on 13.2</changelog>
</package>
<package pkgid="724ff1a7e58893ceccf79f96183d1ce8a341aaef2534b49163c527334b3c3eed" name="freeradius-client-devel" arch="aarch64">
  <version epoch="0" ver="1.1.7" rel="3.2.1"/>
  <changelog author="prusnak@suse.cz" date="1173355200">- created package from BuildService
  * project: network:aaa
  * package: freeradius-client
  * version: 1.1.5</changelog>
  <changelog author="prusnak@suse.cz" date="1194436800">- change %{version}-%{release} to %{version} in Requires tag</changelog>
  <changelog author="crrodriguez@suse.de" date="1204718400">- fix build in BETA
- disable static libraries</changelog>
  <changelog author="prusnak@suse.cz" date="1205928000">- updated to 1.1.6
  o Added dead_time functionality / configuration
  o Merge in fixes and enhancements from 'radiusclient-ng'
  o Improved functionality for embedded operation
  - In use in FreeSWITCH and OpenSER projects
  o Wrap gethostby*() family of calls with threadsafe variants
  o Change UINT4 to uint32_t, int to size_t, etc.
  o Fixed wrong usage of strncat function in several places
- dropped obsoleted patches:
  * return.patch (included in update)
  * strncat.patch (included in update)</changelog>
  <changelog author="prusnak@suse.cz" date="1234872000">- fix garbled login.example file [bnc#469682]</changelog>
  <changelog author="coolo@suse.com" date="1317470400">- add libtool as buildrequire to make the spec file more reliable</changelog>
  <changelog author="coolo@suse.com" date="1323172800">- BAD2c is not a license</changelog>
  <changelog author="vcizek@suse.com" date="1429790400">- update to 1.1.7:
  * Allow "configure --with-nettle" to use nettle MD5 implementation. Patch from Nikos Mavrogiannopoulos.
  * Clean up generation of random numbers. Patch from Nikos Mavrogiannopoulos.
  * Update BSD license as permitted by Christos Zoulas.
  * Define PW_MAX_MSG_SIZE for maximum message sice. Patch from Nikos Mavrogiannopoulos.
  * Allow the dictionary file parser to understand BEGIN-VENDOR / END-VENDOR as with FreeRADIUS server. Patch from Nikos Mavrogiannopoulos.
  * Added support for IPv6. Patch from Nikos Mavrogiannopoulos.
  * Don't crash if a config option is unset. Patch from Nikos Mavrogiannopoulos.
  * Fix encoding of "date" attributes. Patch from Christian Schoch.
  * Build fixes from Sven Neuhaus, Ghennadi Procopciuc, Daniel Pocock, and gureedo.
  * Fix memory leaks. Patches from Alex Massover, William King, gureedo, and FreeSWITCH.
  * Fixes to retry algorithm. Patch from Lewis Adam.
  * Zero out secret fields. Patch from Scott Neugroschl.
  * Update the dictionaries. Patches from Bogdan-Andrei Iancu and gureedo.
  * Make the library thread-safe. Based on a patch from Alex Massover.
  * Made rc_avpair_log thread-safe by using a buffer supplied by the caller. Patch from Alex Massover.
  * Removed lock file for sequence number. It isn't needed.
  * Use poll() where possible to avoid issues with FD_SETSIZE. Patch from Alfred E. Heggestad.
  * Set Acct-Delay-Time in Accounting-Request packets. Patch from Alfred E. Heggestad.
- add freeradius-client-missing_size_t_definition.patch to fix
  build on 13.2</changelog>
</package>
<package pkgid="b0561cc1443d60b091663e3d3e72a55cdf3e8e8c576c5e6d3a5e2d2b32031c28" name="freeradius-client-devel" arch="ppc64le">
  <version epoch="0" ver="1.1.7" rel="3.2.1"/>
  <changelog author="prusnak@suse.cz" date="1173355200">- created package from BuildService
  * project: network:aaa
  * package: freeradius-client
  * version: 1.1.5</changelog>
  <changelog author="prusnak@suse.cz" date="1194436800">- change %{version}-%{release} to %{version} in Requires tag</changelog>
  <changelog author="crrodriguez@suse.de" date="1204718400">- fix build in BETA
- disable static libraries</changelog>
  <changelog author="prusnak@suse.cz" date="1205928000">- updated to 1.1.6
  o Added dead_time functionality / configuration
  o Merge in fixes and enhancements from 'radiusclient-ng'
  o Improved functionality for embedded operation
  - In use in FreeSWITCH and OpenSER projects
  o Wrap gethostby*() family of calls with threadsafe variants
  o Change UINT4 to uint32_t, int to size_t, etc.
  o Fixed wrong usage of strncat function in several places
- dropped obsoleted patches:
  * return.patch (included in update)
  * strncat.patch (included in update)</changelog>
  <changelog author="prusnak@suse.cz" date="1234872000">- fix garbled login.example file [bnc#469682]</changelog>
  <changelog author="coolo@suse.com" date="1317470400">- add libtool as buildrequire to make the spec file more reliable</changelog>
  <changelog author="coolo@suse.com" date="1323172800">- BAD2c is not a license</changelog>
  <changelog author="vcizek@suse.com" date="1429790400">- update to 1.1.7:
  * Allow "configure --with-nettle" to use nettle MD5 implementation. Patch from Nikos Mavrogiannopoulos.
  * Clean up generation of random numbers. Patch from Nikos Mavrogiannopoulos.
  * Update BSD license as permitted by Christos Zoulas.
  * Define PW_MAX_MSG_SIZE for maximum message sice. Patch from Nikos Mavrogiannopoulos.
  * Allow the dictionary file parser to understand BEGIN-VENDOR / END-VENDOR as with FreeRADIUS server. Patch from Nikos Mavrogiannopoulos.
  * Added support for IPv6. Patch from Nikos Mavrogiannopoulos.
  * Don't crash if a config option is unset. Patch from Nikos Mavrogiannopoulos.
  * Fix encoding of "date" attributes. Patch from Christian Schoch.
  * Build fixes from Sven Neuhaus, Ghennadi Procopciuc, Daniel Pocock, and gureedo.
  * Fix memory leaks. Patches from Alex Massover, William King, gureedo, and FreeSWITCH.
  * Fixes to retry algorithm. Patch from Lewis Adam.
  * Zero out secret fields. Patch from Scott Neugroschl.
  * Update the dictionaries. Patches from Bogdan-Andrei Iancu and gureedo.
  * Make the library thread-safe. Based on a patch from Alex Massover.
  * Made rc_avpair_log thread-safe by using a buffer supplied by the caller. Patch from Alex Massover.
  * Removed lock file for sequence number. It isn't needed.
  * Use poll() where possible to avoid issues with FD_SETSIZE. Patch from Alfred E. Heggestad.
  * Set Acct-Delay-Time in Accounting-Request packets. Patch from Alfred E. Heggestad.
- add freeradius-client-missing_size_t_definition.patch to fix
  build on 13.2</changelog>
</package>
<package pkgid="634cafd77baf39d123cfacc1982d620c2c8342510bbdf1855f4e0913e49b4d55" name="freeradius-client-devel" arch="s390x">
  <version epoch="0" ver="1.1.7" rel="3.2.1"/>
  <changelog author="prusnak@suse.cz" date="1173355200">- created package from BuildService
  * project: network:aaa
  * package: freeradius-client
  * version: 1.1.5</changelog>
  <changelog author="prusnak@suse.cz" date="1194436800">- change %{version}-%{release} to %{version} in Requires tag</changelog>
  <changelog author="crrodriguez@suse.de" date="1204718400">- fix build in BETA
- disable static libraries</changelog>
  <changelog author="prusnak@suse.cz" date="1205928000">- updated to 1.1.6
  o Added dead_time functionality / configuration
  o Merge in fixes and enhancements from 'radiusclient-ng'
  o Improved functionality for embedded operation
  - In use in FreeSWITCH and OpenSER projects
  o Wrap gethostby*() family of calls with threadsafe variants
  o Change UINT4 to uint32_t, int to size_t, etc.
  o Fixed wrong usage of strncat function in several places
- dropped obsoleted patches:
  * return.patch (included in update)
  * strncat.patch (included in update)</changelog>
  <changelog author="prusnak@suse.cz" date="1234872000">- fix garbled login.example file [bnc#469682]</changelog>
  <changelog author="coolo@suse.com" date="1317470400">- add libtool as buildrequire to make the spec file more reliable</changelog>
  <changelog author="coolo@suse.com" date="1323172800">- BAD2c is not a license</changelog>
  <changelog author="vcizek@suse.com" date="1429790400">- update to 1.1.7:
  * Allow "configure --with-nettle" to use nettle MD5 implementation. Patch from Nikos Mavrogiannopoulos.
  * Clean up generation of random numbers. Patch from Nikos Mavrogiannopoulos.
  * Update BSD license as permitted by Christos Zoulas.
  * Define PW_MAX_MSG_SIZE for maximum message sice. Patch from Nikos Mavrogiannopoulos.
  * Allow the dictionary file parser to understand BEGIN-VENDOR / END-VENDOR as with FreeRADIUS server. Patch from Nikos Mavrogiannopoulos.
  * Added support for IPv6. Patch from Nikos Mavrogiannopoulos.
  * Don't crash if a config option is unset. Patch from Nikos Mavrogiannopoulos.
  * Fix encoding of "date" attributes. Patch from Christian Schoch.
  * Build fixes from Sven Neuhaus, Ghennadi Procopciuc, Daniel Pocock, and gureedo.
  * Fix memory leaks. Patches from Alex Massover, William King, gureedo, and FreeSWITCH.
  * Fixes to retry algorithm. Patch from Lewis Adam.
  * Zero out secret fields. Patch from Scott Neugroschl.
  * Update the dictionaries. Patches from Bogdan-Andrei Iancu and gureedo.
  * Make the library thread-safe. Based on a patch from Alex Massover.
  * Made rc_avpair_log thread-safe by using a buffer supplied by the caller. Patch from Alex Massover.
  * Removed lock file for sequence number. It isn't needed.
  * Use poll() where possible to avoid issues with FD_SETSIZE. Patch from Alfred E. Heggestad.
  * Set Acct-Delay-Time in Accounting-Request packets. Patch from Alfred E. Heggestad.
- add freeradius-client-missing_size_t_definition.patch to fix
  build on 13.2</changelog>
</package>
<package pkgid="88a705d992bf0a6f847e8dea7586c53f2567547625463dade4ddc80421f184f7" name="freeradius-client-devel" arch="x86_64">
  <version epoch="0" ver="1.1.7" rel="3.2.1"/>
  <changelog author="prusnak@suse.cz" date="1173355200">- created package from BuildService
  * project: network:aaa
  * package: freeradius-client
  * version: 1.1.5</changelog>
  <changelog author="prusnak@suse.cz" date="1194436800">- change %{version}-%{release} to %{version} in Requires tag</changelog>
  <changelog author="crrodriguez@suse.de" date="1204718400">- fix build in BETA
- disable static libraries</changelog>
  <changelog author="prusnak@suse.cz" date="1205928000">- updated to 1.1.6
  o Added dead_time functionality / configuration
  o Merge in fixes and enhancements from 'radiusclient-ng'
  o Improved functionality for embedded operation
  - In use in FreeSWITCH and OpenSER projects
  o Wrap gethostby*() family of calls with threadsafe variants
  o Change UINT4 to uint32_t, int to size_t, etc.
  o Fixed wrong usage of strncat function in several places
- dropped obsoleted patches:
  * return.patch (included in update)
  * strncat.patch (included in update)</changelog>
  <changelog author="prusnak@suse.cz" date="1234872000">- fix garbled login.example file [bnc#469682]</changelog>
  <changelog author="coolo@suse.com" date="1317470400">- add libtool as buildrequire to make the spec file more reliable</changelog>
  <changelog author="coolo@suse.com" date="1323172800">- BAD2c is not a license</changelog>
  <changelog author="vcizek@suse.com" date="1429790400">- update to 1.1.7:
  * Allow "configure --with-nettle" to use nettle MD5 implementation. Patch from Nikos Mavrogiannopoulos.
  * Clean up generation of random numbers. Patch from Nikos Mavrogiannopoulos.
  * Update BSD license as permitted by Christos Zoulas.
  * Define PW_MAX_MSG_SIZE for maximum message sice. Patch from Nikos Mavrogiannopoulos.
  * Allow the dictionary file parser to understand BEGIN-VENDOR / END-VENDOR as with FreeRADIUS server. Patch from Nikos Mavrogiannopoulos.
  * Added support for IPv6. Patch from Nikos Mavrogiannopoulos.
  * Don't crash if a config option is unset. Patch from Nikos Mavrogiannopoulos.
  * Fix encoding of "date" attributes. Patch from Christian Schoch.
  * Build fixes from Sven Neuhaus, Ghennadi Procopciuc, Daniel Pocock, and gureedo.
  * Fix memory leaks. Patches from Alex Massover, William King, gureedo, and FreeSWITCH.
  * Fixes to retry algorithm. Patch from Lewis Adam.
  * Zero out secret fields. Patch from Scott Neugroschl.
  * Update the dictionaries. Patches from Bogdan-Andrei Iancu and gureedo.
  * Make the library thread-safe. Based on a patch from Alex Massover.
  * Made rc_avpair_log thread-safe by using a buffer supplied by the caller. Patch from Alex Massover.
  * Removed lock file for sequence number. It isn't needed.
  * Use poll() where possible to avoid issues with FD_SETSIZE. Patch from Alfred E. Heggestad.
  * Set Acct-Delay-Time in Accounting-Request packets. Patch from Alfred E. Heggestad.
- add freeradius-client-missing_size_t_definition.patch to fix
  build on 13.2</changelog>
</package>
<package pkgid="e78a49a03abf2cc64455af36d304444ef48e2dedd9402e869ebcdb7f0d187761" name="freeradius-client-libs" arch="aarch64">
  <version epoch="0" ver="1.1.7" rel="3.2.1"/>
  <changelog author="prusnak@suse.cz" date="1173355200">- created package from BuildService
  * project: network:aaa
  * package: freeradius-client
  * version: 1.1.5</changelog>
  <changelog author="prusnak@suse.cz" date="1194436800">- change %{version}-%{release} to %{version} in Requires tag</changelog>
  <changelog author="crrodriguez@suse.de" date="1204718400">- fix build in BETA
- disable static libraries</changelog>
  <changelog author="prusnak@suse.cz" date="1205928000">- updated to 1.1.6
  o Added dead_time functionality / configuration
  o Merge in fixes and enhancements from 'radiusclient-ng'
  o Improved functionality for embedded operation
  - In use in FreeSWITCH and OpenSER projects
  o Wrap gethostby*() family of calls with threadsafe variants
  o Change UINT4 to uint32_t, int to size_t, etc.
  o Fixed wrong usage of strncat function in several places
- dropped obsoleted patches:
  * return.patch (included in update)
  * strncat.patch (included in update)</changelog>
  <changelog author="prusnak@suse.cz" date="1234872000">- fix garbled login.example file [bnc#469682]</changelog>
  <changelog author="coolo@suse.com" date="1317470400">- add libtool as buildrequire to make the spec file more reliable</changelog>
  <changelog author="coolo@suse.com" date="1323172800">- BAD2c is not a license</changelog>
  <changelog author="vcizek@suse.com" date="1429790400">- update to 1.1.7:
  * Allow "configure --with-nettle" to use nettle MD5 implementation. Patch from Nikos Mavrogiannopoulos.
  * Clean up generation of random numbers. Patch from Nikos Mavrogiannopoulos.
  * Update BSD license as permitted by Christos Zoulas.
  * Define PW_MAX_MSG_SIZE for maximum message sice. Patch from Nikos Mavrogiannopoulos.
  * Allow the dictionary file parser to understand BEGIN-VENDOR / END-VENDOR as with FreeRADIUS server. Patch from Nikos Mavrogiannopoulos.
  * Added support for IPv6. Patch from Nikos Mavrogiannopoulos.
  * Don't crash if a config option is unset. Patch from Nikos Mavrogiannopoulos.
  * Fix encoding of "date" attributes. Patch from Christian Schoch.
  * Build fixes from Sven Neuhaus, Ghennadi Procopciuc, Daniel Pocock, and gureedo.
  * Fix memory leaks. Patches from Alex Massover, William King, gureedo, and FreeSWITCH.
  * Fixes to retry algorithm. Patch from Lewis Adam.
  * Zero out secret fields. Patch from Scott Neugroschl.
  * Update the dictionaries. Patches from Bogdan-Andrei Iancu and gureedo.
  * Make the library thread-safe. Based on a patch from Alex Massover.
  * Made rc_avpair_log thread-safe by using a buffer supplied by the caller. Patch from Alex Massover.
  * Removed lock file for sequence number. It isn't needed.
  * Use poll() where possible to avoid issues with FD_SETSIZE. Patch from Alfred E. Heggestad.
  * Set Acct-Delay-Time in Accounting-Request packets. Patch from Alfred E. Heggestad.
- add freeradius-client-missing_size_t_definition.patch to fix
  build on 13.2</changelog>
</package>
<package pkgid="31d76a479208d56e549a5184a579c6f0d951f1fa0dbe018327db91cb430b6aa1" name="freeradius-client-libs" arch="ppc64le">
  <version epoch="0" ver="1.1.7" rel="3.2.1"/>
  <changelog author="prusnak@suse.cz" date="1173355200">- created package from BuildService
  * project: network:aaa
  * package: freeradius-client
  * version: 1.1.5</changelog>
  <changelog author="prusnak@suse.cz" date="1194436800">- change %{version}-%{release} to %{version} in Requires tag</changelog>
  <changelog author="crrodriguez@suse.de" date="1204718400">- fix build in BETA
- disable static libraries</changelog>
  <changelog author="prusnak@suse.cz" date="1205928000">- updated to 1.1.6
  o Added dead_time functionality / configuration
  o Merge in fixes and enhancements from 'radiusclient-ng'
  o Improved functionality for embedded operation
  - In use in FreeSWITCH and OpenSER projects
  o Wrap gethostby*() family of calls with threadsafe variants
  o Change UINT4 to uint32_t, int to size_t, etc.
  o Fixed wrong usage of strncat function in several places
- dropped obsoleted patches:
  * return.patch (included in update)
  * strncat.patch (included in update)</changelog>
  <changelog author="prusnak@suse.cz" date="1234872000">- fix garbled login.example file [bnc#469682]</changelog>
  <changelog author="coolo@suse.com" date="1317470400">- add libtool as buildrequire to make the spec file more reliable</changelog>
  <changelog author="coolo@suse.com" date="1323172800">- BAD2c is not a license</changelog>
  <changelog author="vcizek@suse.com" date="1429790400">- update to 1.1.7:
  * Allow "configure --with-nettle" to use nettle MD5 implementation. Patch from Nikos Mavrogiannopoulos.
  * Clean up generation of random numbers. Patch from Nikos Mavrogiannopoulos.
  * Update BSD license as permitted by Christos Zoulas.
  * Define PW_MAX_MSG_SIZE for maximum message sice. Patch from Nikos Mavrogiannopoulos.
  * Allow the dictionary file parser to understand BEGIN-VENDOR / END-VENDOR as with FreeRADIUS server. Patch from Nikos Mavrogiannopoulos.
  * Added support for IPv6. Patch from Nikos Mavrogiannopoulos.
  * Don't crash if a config option is unset. Patch from Nikos Mavrogiannopoulos.
  * Fix encoding of "date" attributes. Patch from Christian Schoch.
  * Build fixes from Sven Neuhaus, Ghennadi Procopciuc, Daniel Pocock, and gureedo.
  * Fix memory leaks. Patches from Alex Massover, William King, gureedo, and FreeSWITCH.
  * Fixes to retry algorithm. Patch from Lewis Adam.
  * Zero out secret fields. Patch from Scott Neugroschl.
  * Update the dictionaries. Patches from Bogdan-Andrei Iancu and gureedo.
  * Make the library thread-safe. Based on a patch from Alex Massover.
  * Made rc_avpair_log thread-safe by using a buffer supplied by the caller. Patch from Alex Massover.
  * Removed lock file for sequence number. It isn't needed.
  * Use poll() where possible to avoid issues with FD_SETSIZE. Patch from Alfred E. Heggestad.
  * Set Acct-Delay-Time in Accounting-Request packets. Patch from Alfred E. Heggestad.
- add freeradius-client-missing_size_t_definition.patch to fix
  build on 13.2</changelog>
</package>
<package pkgid="a7c4f459eb376de17e4365d948bb73a8dad8878f16af0d9c5a3bf7304beb0ce6" name="freeradius-client-libs" arch="s390x">
  <version epoch="0" ver="1.1.7" rel="3.2.1"/>
  <changelog author="prusnak@suse.cz" date="1173355200">- created package from BuildService
  * project: network:aaa
  * package: freeradius-client
  * version: 1.1.5</changelog>
  <changelog author="prusnak@suse.cz" date="1194436800">- change %{version}-%{release} to %{version} in Requires tag</changelog>
  <changelog author="crrodriguez@suse.de" date="1204718400">- fix build in BETA
- disable static libraries</changelog>
  <changelog author="prusnak@suse.cz" date="1205928000">- updated to 1.1.6
  o Added dead_time functionality / configuration
  o Merge in fixes and enhancements from 'radiusclient-ng'
  o Improved functionality for embedded operation
  - In use in FreeSWITCH and OpenSER projects
  o Wrap gethostby*() family of calls with threadsafe variants
  o Change UINT4 to uint32_t, int to size_t, etc.
  o Fixed wrong usage of strncat function in several places
- dropped obsoleted patches:
  * return.patch (included in update)
  * strncat.patch (included in update)</changelog>
  <changelog author="prusnak@suse.cz" date="1234872000">- fix garbled login.example file [bnc#469682]</changelog>
  <changelog author="coolo@suse.com" date="1317470400">- add libtool as buildrequire to make the spec file more reliable</changelog>
  <changelog author="coolo@suse.com" date="1323172800">- BAD2c is not a license</changelog>
  <changelog author="vcizek@suse.com" date="1429790400">- update to 1.1.7:
  * Allow "configure --with-nettle" to use nettle MD5 implementation. Patch from Nikos Mavrogiannopoulos.
  * Clean up generation of random numbers. Patch from Nikos Mavrogiannopoulos.
  * Update BSD license as permitted by Christos Zoulas.
  * Define PW_MAX_MSG_SIZE for maximum message sice. Patch from Nikos Mavrogiannopoulos.
  * Allow the dictionary file parser to understand BEGIN-VENDOR / END-VENDOR as with FreeRADIUS server. Patch from Nikos Mavrogiannopoulos.
  * Added support for IPv6. Patch from Nikos Mavrogiannopoulos.
  * Don't crash if a config option is unset. Patch from Nikos Mavrogiannopoulos.
  * Fix encoding of "date" attributes. Patch from Christian Schoch.
  * Build fixes from Sven Neuhaus, Ghennadi Procopciuc, Daniel Pocock, and gureedo.
  * Fix memory leaks. Patches from Alex Massover, William King, gureedo, and FreeSWITCH.
  * Fixes to retry algorithm. Patch from Lewis Adam.
  * Zero out secret fields. Patch from Scott Neugroschl.
  * Update the dictionaries. Patches from Bogdan-Andrei Iancu and gureedo.
  * Make the library thread-safe. Based on a patch from Alex Massover.
  * Made rc_avpair_log thread-safe by using a buffer supplied by the caller. Patch from Alex Massover.
  * Removed lock file for sequence number. It isn't needed.
  * Use poll() where possible to avoid issues with FD_SETSIZE. Patch from Alfred E. Heggestad.
  * Set Acct-Delay-Time in Accounting-Request packets. Patch from Alfred E. Heggestad.
- add freeradius-client-missing_size_t_definition.patch to fix
  build on 13.2</changelog>
</package>
<package pkgid="cfbac406bb1f1435c865319e663dfae23a4dd68473aaea63e5feaea589a35437" name="freeradius-client-libs" arch="x86_64">
  <version epoch="0" ver="1.1.7" rel="3.2.1"/>
  <changelog author="prusnak@suse.cz" date="1173355200">- created package from BuildService
  * project: network:aaa
  * package: freeradius-client
  * version: 1.1.5</changelog>
  <changelog author="prusnak@suse.cz" date="1194436800">- change %{version}-%{release} to %{version} in Requires tag</changelog>
  <changelog author="crrodriguez@suse.de" date="1204718400">- fix build in BETA
- disable static libraries</changelog>
  <changelog author="prusnak@suse.cz" date="1205928000">- updated to 1.1.6
  o Added dead_time functionality / configuration
  o Merge in fixes and enhancements from 'radiusclient-ng'
  o Improved functionality for embedded operation
  - In use in FreeSWITCH and OpenSER projects
  o Wrap gethostby*() family of calls with threadsafe variants
  o Change UINT4 to uint32_t, int to size_t, etc.
  o Fixed wrong usage of strncat function in several places
- dropped obsoleted patches:
  * return.patch (included in update)
  * strncat.patch (included in update)</changelog>
  <changelog author="prusnak@suse.cz" date="1234872000">- fix garbled login.example file [bnc#469682]</changelog>
  <changelog author="coolo@suse.com" date="1317470400">- add libtool as buildrequire to make the spec file more reliable</changelog>
  <changelog author="coolo@suse.com" date="1323172800">- BAD2c is not a license</changelog>
  <changelog author="vcizek@suse.com" date="1429790400">- update to 1.1.7:
  * Allow "configure --with-nettle" to use nettle MD5 implementation. Patch from Nikos Mavrogiannopoulos.
  * Clean up generation of random numbers. Patch from Nikos Mavrogiannopoulos.
  * Update BSD license as permitted by Christos Zoulas.
  * Define PW_MAX_MSG_SIZE for maximum message sice. Patch from Nikos Mavrogiannopoulos.
  * Allow the dictionary file parser to understand BEGIN-VENDOR / END-VENDOR as with FreeRADIUS server. Patch from Nikos Mavrogiannopoulos.
  * Added support for IPv6. Patch from Nikos Mavrogiannopoulos.
  * Don't crash if a config option is unset. Patch from Nikos Mavrogiannopoulos.
  * Fix encoding of "date" attributes. Patch from Christian Schoch.
  * Build fixes from Sven Neuhaus, Ghennadi Procopciuc, Daniel Pocock, and gureedo.
  * Fix memory leaks. Patches from Alex Massover, William King, gureedo, and FreeSWITCH.
  * Fixes to retry algorithm. Patch from Lewis Adam.
  * Zero out secret fields. Patch from Scott Neugroschl.
  * Update the dictionaries. Patches from Bogdan-Andrei Iancu and gureedo.
  * Make the library thread-safe. Based on a patch from Alex Massover.
  * Made rc_avpair_log thread-safe by using a buffer supplied by the caller. Patch from Alex Massover.
  * Removed lock file for sequence number. It isn't needed.
  * Use poll() where possible to avoid issues with FD_SETSIZE. Patch from Alfred E. Heggestad.
  * Set Acct-Delay-Time in Accounting-Request packets. Patch from Alfred E. Heggestad.
- add freeradius-client-missing_size_t_definition.patch to fix
  build on 13.2</changelog>
</package>
<package pkgid="8b641c6d573dcd193ec84080c0eb14797b80df1e6e761e83e51695c1d897fc61" name="gfs2-kmp-preempt" arch="x86_64">
  <version epoch="0" ver="5.3.18" rel="150300.59.43.1"/>
  <changelog author="tiwai@suse.de" date="1642593600">- Add cherry-picked IDs for qemu fw_cfg patches
- commit 8f947ad</changelog>
  <changelog author="msuchanek@suse.de" date="1642593601">- powerpc/pseries/cpuhp: delete add/remove_by_count code
  (bsc#1065729).
- powerpc/pseries/cpuhp: cache node corrections (bsc#1065729).
- commit 9c04898</changelog>
  <changelog author="tiwai@suse.de" date="1642593602">- dmaengine: at_xdmac: Fix at_xdmac_lld struct definition
  (git-fixes).
- dmaengine: at_xdmac: Fix lld view setting (git-fixes).
- dmaengine: at_xdmac: Fix concurrency over xfers_list
  (git-fixes).
- dmaengine: at_xdmac: Print debug message after realeasing the
  lock (git-fixes).
- dmaengine: at_xdmac: Don't start transactions at tx_submit level
  (git-fixes).
- Documentation: dmaengine: Correctly describe dmatest with
  channel unset (git-fixes).
- rpmsg: core: Clean up resources on announce_create failure
  (git-fixes).
- ACPI: APD: Check for NULL pointer after calling devm_ioremap()
  (git-fixes).
- Input: ti_am335x_tsc - fix STEPCONFIG setup for Z2 (git-fixes).
- Input: ti_am335x_tsc - set ADCREFM for X configuration
  (git-fixes).
- i3c: master: dw: check return of dw_i3c_master_get_free_pos()
  (git-fixes).
- i3c: fix incorrect address slot lookup on 64-bit (git-fixes).
- commit 3d8614c</changelog>
  <changelog author="msuchanek@suse.de" date="1642593603">- powerpc/prom_init: Fix improper check of prom_getprop()
  (bsc#1065729).
- commit 954fa51</changelog>
  <changelog author="msuchanek@suse.de" date="1642593604">- powerpc/perf: Fix PMU callbacks to clear pending PMI before
  resetting an overflown PMC (bsc#1156395).
- commit 8bdce1e</changelog>
  <changelog author="mbenes@suse.cz" date="1642593605">- livepatch: Avoid CPU hogging with cond_resched (bsc#1071995).
- commit 27c7aa0</changelog>
  <changelog author="msuchanek@suse.de" date="1642593606">- blacklist.conf: Add 79ca6f74dae0 tpm: fix Atmel TPM crash caused by too frequent queries
  Breaks kABI, there is no report of this problem affecting users, likely
  broken old TPM firmware.
- commit 4ea9f96</changelog>
  <changelog author="msuchanek@suse.de" date="1642593607">- Update patches.suse/tpm-fix-potential-NULL-pointer-access-in-tpm_del_cha.patch
  (git-fixes bsc#1193660 ltc#195634).
- commit 11ac3f6</changelog>
  <changelog author="lhenriques@suse.de" date="1642680000">- fuse: Pass correct lend value to filemap_write_and_wait_range()
  (bsc#1194953).
- commit d2355ea</changelog>
  <changelog author="msuchanek@suse.de" date="1642680001">- blacklist.conf: Add a2308836880b powerpc: Fix arch_stack_walk() to have
  running function as first entry
  The stacktrace interface in this kernel version does not provide the
  parameters used to implement the fix.
- commit ee041a3</changelog>
  <changelog author="msuchanek@suse.de" date="1642680002">- powerpc/64s: fix program check interrupt emergency stack path
  (bsc#1156395).
- commit a3c26ed</changelog>
  <changelog author="msuchanek@suse.de" date="1642680003">- powerpc/traps: do not enable irqs in _exception (bsc#1065729).
- powerpc: add interrupt_cond_local_irq_enable helper
  (bsc#1065729).
- commit 65f660c</changelog>
  <changelog author="msuchanek@suse.de" date="1642680004">- powerpc/pseries/mobility: ignore ibm, platform-facilities
  updates (bsc#1065729).
- commit b253330</changelog>
  <changelog author="rgoldwyn@suse.com" date="1642680005">- vfs: check fd has read access in kernel_read_file_from_fd() (bsc#1194888).
- commit 4717473</changelog>
  <changelog author="vkarasulli@suse.de" date="1642680006">- moxart: fix potential use-after-free on remove path
  (bsc#1194516).
- commit 3fae095</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1642766400">- sctp: account stream padding length for reconf chunk
  (bsc#1194985 CVE-2022-0322).
- commit a6cab40</changelog>
  <changelog author="ddiss@suse.de" date="1642766401">- vfs: fs_context: fix up param length parsing in
  legacy_parse_param (CVE-2022-0185 bsc#1194517).
- Rename and retag following upstream merge from:
  patches.suse/vfs-Out-of-bounds-write-of-heap-buffer-in-fs_context-c.patch
  to patches.suse/vfs-fs_context-fix-up-param-length-parsing-in-legacy.patch
- commit 33860f2</changelog>
  <changelog author="mkubecek@suse.cz" date="1642766402">- series.conf: cleanup
- move to "mainline soon" section:
  - patches.suse/0001-mmc-moxart_remove-Fix-UAF.patch
- commit 07d55c3</changelog>
  <changelog author="mkubecek@suse.cz" date="1642766403">- series.conf: refresh
- update upstream references and resort:
  - patches.suse/powerpc-fadump-Fix-inaccurate-CPU-state-info-in-vmco.patch
  - patches.suse/powerpc-handle-kdump-appropriately-with-crash_kexec_.patch
  - patches.suse/powerpc-watchdog-Avoid-holding-wd_smp_lock-over-prin.patch
  - patches.suse/powerpc-watchdog-Fix-missed-watchdog-reset-due-to-me.patch
  - patches.suse/powerpc-watchdog-Fix-wd_smp_last_reset_tb-reporting.patch
  - patches.suse/powerpc-watchdog-read-TB-close-to-where-it-is-used.patch
  - patches.suse/powerpc-watchdog-tighten-non-atomic-read-modify-writ.patch
- commit 72b7db7</changelog>
  <changelog author="osalvador@suse.de" date="1642939200">- Rename colliding patches before the next cve/linux-5.3 -&gt; SLE15-SP3 merge
- commit 84178b8</changelog>
</package>
<package pkgid="cf81cfd9a2d9297149b7c9074629a07dbfeabca1891edf0a9f298e98d3546345" name="gfs2-kmp-preempt" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="150300.59.49.1"/>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235200">- IB/mlx5: Add missing error code (git-fixes)
- commit 06919f0</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235201">- RDMA/cxgb4: Fix adapter LE hash errors while destroying ipv6 listening server (git-fixes)
- commit 0f86491</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235202">- RDMA/addr: Be strict with gid size (git-fixes)
- commit 0b96850</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235203">- IB/isert: Fix a use after free in isert_connect_request (git-fixes)
- commit fa7abfc</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235204">- RDMA/core: Fix corrupted SL on passive side (git-fixes)
- commit d86d9cb</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235205">- IB/hfi1: Use kzalloc() for mmu_rb_handler allocation (git-fixes)
- commit 05c0e16</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235206">- IB/hfi1: Fix error return code in parse_platform_config() (git-fixes)
- commit 270bb46</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235207">- RDMA/bnxt_re: Fix error return code in bnxt_qplib_cq_process_terminal() (git-fixes)
- commit 76267d4</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235208">- RDMA/core: Unify RoCE check and re-factor code (git-fixes)
- commit e5e3d6f</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235209">- RDMA/cxgb4: add missing qpid increment (git-fixes)
- commit 591cdce</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235210">- RDMA/i40iw: Fix error unwinding when i40iw_hmc_sd_one fails (git-fixes)
- commit 2db1c84</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235211">- RDMA/siw: Fix a use after free in siw_alloc_mr (git-fixes)
- commit a7eff62</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235212">- RDMA/bnxt_re: Fix a double free in bnxt_qplib_alloc_res (git-fixes)
- commit 8c226d5</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235213">- RDMA/siw: Properly check send and receive CQ pointers (git-fixes)
- commit d84b45b</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235214">- RDMA/rxe: Clear all QP fields if creation failed (git-fixes)
- commit 07c8b4d</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235215">- RDMA/mlx5: Recover from fatal event in dual port mode (git-fixes)
- commit 875e0ed</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235216">- RDMA/core: Don't access cm_id after its destruction (git-fixes)
- commit 4a117e6</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235217">- RDMA/mlx5: Fix query DCT via DEVX (git-fixes)
- commit 4b56cb2</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235218">- RDMA/uverbs: Fix a NULL vs IS_ERR() bug (git-fixes)
- commit 82ce09e</changelog>
  <changelog author="msuchanek@suse.de" date="1644235219">- powerpc/perf: Fix power_pmu_disable to call
  clear_pmi_irq_pending only if PMI is pending (bsc#1156395).
- commit a08ca77</changelog>
</package>
<package pkgid="c2faa787c09efa7c1dfd98adb919cf6bd58f4b5ab17b5eaa5962070c2ab290fa" name="gfs2-kmp-preempt" arch="x86_64">
  <version epoch="0" ver="5.3.18" rel="150300.59.49.1"/>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235200">- IB/mlx5: Add missing error code (git-fixes)
- commit 06919f0</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235201">- RDMA/cxgb4: Fix adapter LE hash errors while destroying ipv6 listening server (git-fixes)
- commit 0f86491</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235202">- RDMA/addr: Be strict with gid size (git-fixes)
- commit 0b96850</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235203">- IB/isert: Fix a use after free in isert_connect_request (git-fixes)
- commit fa7abfc</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235204">- RDMA/core: Fix corrupted SL on passive side (git-fixes)
- commit d86d9cb</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235205">- IB/hfi1: Use kzalloc() for mmu_rb_handler allocation (git-fixes)
- commit 05c0e16</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235206">- IB/hfi1: Fix error return code in parse_platform_config() (git-fixes)
- commit 270bb46</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235207">- RDMA/bnxt_re: Fix error return code in bnxt_qplib_cq_process_terminal() (git-fixes)
- commit 76267d4</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235208">- RDMA/core: Unify RoCE check and re-factor code (git-fixes)
- commit e5e3d6f</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235209">- RDMA/cxgb4: add missing qpid increment (git-fixes)
- commit 591cdce</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235210">- RDMA/i40iw: Fix error unwinding when i40iw_hmc_sd_one fails (git-fixes)
- commit 2db1c84</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235211">- RDMA/siw: Fix a use after free in siw_alloc_mr (git-fixes)
- commit a7eff62</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235212">- RDMA/bnxt_re: Fix a double free in bnxt_qplib_alloc_res (git-fixes)
- commit 8c226d5</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235213">- RDMA/siw: Properly check send and receive CQ pointers (git-fixes)
- commit d84b45b</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235214">- RDMA/rxe: Clear all QP fields if creation failed (git-fixes)
- commit 07c8b4d</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235215">- RDMA/mlx5: Recover from fatal event in dual port mode (git-fixes)
- commit 875e0ed</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235216">- RDMA/core: Don't access cm_id after its destruction (git-fixes)
- commit 4a117e6</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235217">- RDMA/mlx5: Fix query DCT via DEVX (git-fixes)
- commit 4b56cb2</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235218">- RDMA/uverbs: Fix a NULL vs IS_ERR() bug (git-fixes)
- commit 82ce09e</changelog>
  <changelog author="msuchanek@suse.de" date="1644235219">- powerpc/perf: Fix power_pmu_disable to call
  clear_pmi_irq_pending only if PMI is pending (bsc#1156395).
- commit a08ca77</changelog>
</package>
<package pkgid="d0349b6815964d1f7361ec0e5c05a04da88b8c5493e7273159cb59c01192b276" name="ghostscript" arch="aarch64">
  <version epoch="0" ver="9.52" rel="158.1"/>
  <changelog author="jsmeix@suse.de" date="1521720000">- Version upgrade to 9.23
  Highlights in this release include:
  * Ghostscript now has a family of 'pdfimage' devices
    (pdfimage8, pdfimage24 and pdfimage32) which produce
    rendered output wrapped up as an image in a PDF.
    Additionally, there is a 'pclm' device which
    produces PCLm format output.
  * There is now a ColorAccuracy parameter allowing the user
    to decide between speed or accuracy in ICC color transforms.
  * JPEG Passthrough: devices which support it can now receive
    the 'raw' JPEG stream from the interpreter.
    The main use of this is the pdfwrite/ps2write family of devices
    that can now take JPEG streams from the input file(s) and write
    them unchanged to the output (thus avoiding additional
    quantization effects).
  * PDF transparency performance improvements
  * IMPORTANT: We (i.e. Ghostscript upstream) are in the process
    of forking LittleCMS.
    LCMS2 is not thread safe, and cannot be made thread safe
    without breaking the ABI. Our fork will be thread safe,
    and include performance enhancements (these changes have all
    be been offered and rejected upstream). We will maintain
    compatibility between Ghostscript and LCMS2 for a time,
    but not in perpetuity. Our fork will be available as its own
    package separately from Ghostscript (and MuPDF).
  * We have continued the focus on code hygiene in this release
    cleaning up security issues, ignored return values,
    and compiler warnings.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  Incompatible changes
  * The planned device API tidy has, unfortunately, been
    indefinitely postponed, until appropriate resources
    are available.
  For a release summary see:
  http://www.ghostscript.com/doc/9.23/News.htm
  For details see the News.htm and History9.htm files.
  See also the entries below since "Version upgrade to 9.22"
  (boo#1082896 and boo#1074266).</changelog>
  <changelog author="jsmeix@suse.de" date="1528200000">- CVE-2018-10194.patch fixes stack-based buffer overflow
  in gdevpdts.c (bsc#1090099), see
  https://bugs.ghostscript.com/show_bug.cgi?id=699255 and
  http://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=39b1e54b2968620723bf32e96764c88797714879</changelog>
  <changelog author="jsmeix@suse.de" date="1536840000">- Version upgrade to 9.24
  Highlights in this release include:
  * Security issues have been the primary focus of this release,
    including solving several (well publicised)
    real and potential exploits.
    PLEASE NOTE:
    We (i.e. Ghostscript upstream) strongly urge users to upgrade
    to this latest release to avoid these issues.
  * As well as Ghostscript itself, jbig2dec has had a significant
    amount of work improving its robustness in the face of
    out specification files.
  * IMPORTANT: We (i.e. Ghostscript upstream) are in the process
    of forking LittleCMS. LCMS2 is not thread safe, and cannot
    be made thread safe without breaking the ABI. Our fork
    will be thread safe, and include performance enhancements
    (these changes have all be been offered and rejected upstream).
    We will maintain compatibility between Ghostscript and LCMS2
    for a time, but not in perpetuity. Our fork will be available
    as its own package separately from Ghostscript (and MuPDF).
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  For a release summary see:
  http://www.ghostscript.com/doc/9.24/News.htm
  For details see the News.htm and History9.htm files.
- fix_ln_docdir_gsdatadir.patch is no longer needed
  because the issue is fixed in the upstream sources.
- CVE-2018-10194.patch is no longer needed
  because the issue is fixed in the upstream sources.</changelog>
  <changelog author="jsmeix@suse.de" date="1536840001">- Version upgrade to 9.25rc1 (first release candidate for 9.25).
  Highlights in this release include:
  * This release fixes problems with argument handling, some
    unintended results of the security fixes to the SAFER file
    access restrictions (specifically accessing ICC profile files),
    and some additional security issues over the 9.24 release.
  * Security issues have been the primary focus of this release,
    including solving several (well publicised) real
    and potential exploits.
    PLEASE NOTE:
    We (i.e. Ghostscript upstream) strongly urge users to upgrade
    to this latest release to avoid these issues.
  * Avoid that ps2epsi fails with
    'Error: /undefined in --setpagedevice--'
    Recent changes required to harden SAFER mode mean that
    it is no longer possible to run ps2epsi in SAFER mode,
    because it relies upon unsafe Ghostscript non-standard
    extension operators.
    Removing SAFER and DELAYSAFER, and the code to reset SAFER,
    allow ps2epsi to run as well as it ever did (ie badly).
    This program (i.e. ps2epsi) should now be considered unsafe,
    you should not use it on untrusted PostScript programs.
    Likely we (i.e. Ghostscript upstream) will deprecate and
    remove this program in future.
  For details see the News.htm and History9.htm files.
  Regarding installing packages (in particular release candidates)
  from the openSUSE build service development project "Printing"
  see https://build.opensuse.org/project/show/Printing</changelog>
  <changelog author="jsmeix@suse.de" date="1536926400">- Version upgrade to 9.25
  For the highlights in this release see the highlights in the
  9.25rc1 first release candidate for 9.25 entry below.
  PLEASE NOTE:
  We (i.e. Ghostscript upstream) strongly urge users to upgrade
  to this latest release to avoid these issues.
  For a release summary see:
  http://www.ghostscript.com/doc/9.25/News.htm
  For details see the News.htm and History9.htm files.
  The Ghostscript 9.25 release should fix (see below)
  in particular those security issues:
  * CVE-2018-15909: shading_param incomplete type checking
    https://bugs.ghostscript.com/show_bug.cgi?id=699660
    https://bugzilla.suse.com/show_bug.cgi?id=1106172 bsc#1106172
  * CVE-2018-15908: .tempfile file permission issues
    https://bugs.ghostscript.com/show_bug.cgi?id=699657
    https://bugzilla.suse.com/show_bug.cgi?id=1106171 bsc#1106171
  * CVE-2018-15910: LockDistillerParams type confusion
    https://bugs.ghostscript.com/show_bug.cgi?id=699656
    https://bugzilla.suse.com/show_bug.cgi?id=1106173 bsc#1106173
  * CVE-2018-15911: uninitialized memory access in the aesdecode
    https://bugs.ghostscript.com/show_bug.cgi?id=699665
    https://bugzilla.suse.com/show_bug.cgi?id=1106195 bsc#1106195
  * CVE-2018-16513: setcolor missing type check
    https://bugs.ghostscript.com/show_bug.cgi?id=699655
    https://bugzilla.suse.com/show_bug.cgi?id=1107412 bsc#1107412
  * CVE-2018-16509: /invalidaccess bypass after failed restore
    https://bugs.ghostscript.com/show_bug.cgi?id=699654
    https://bugzilla.suse.com/show_bug.cgi?id=1107410 bsc#1107410
  * CVE-2018-16510: Incorrect exec stack handling in the "CS"
    and "SC" PDF primitives
    https://bugs.ghostscript.com/show_bug.cgi?id=699671
    https://bugzilla.suse.com/show_bug.cgi?id=1107411 bsc#1107411
  * CVE-2018-16542: .definemodifiedfont memory corruption
    if /typecheck is handled
    https://bugs.ghostscript.com/show_bug.cgi?id=699668
    https://bugzilla.suse.com/show_bug.cgi?id=1107413 bsc#1107413
  * CVE-2018-16541 incorrect free logic in pagedevice replacement
    https://bugs.ghostscript.com/show_bug.cgi?id=699664
    https://bugzilla.suse.com/show_bug.cgi?id=1107421 bsc#1107421
  * CVE-2018-16540 use-after-free in copydevice handling
    https://bugs.ghostscript.com/show_bug.cgi?id=699661
    https://bugzilla.suse.com/show_bug.cgi?id=1107420 bsc#1107420
  * CVE-2018-16539: incorrect access checking in temp file
    handling to disclose contents of files
    https://bugs.ghostscript.com/show_bug.cgi?id=699658
    https://bugzilla.suse.com/show_bug.cgi?id=1107422 bsc#1107422
  * CVE-2018-16543: gssetresolution and gsgetresolution allow
    for unspecified impact
    https://bugs.ghostscript.com/show_bug.cgi?id=699670
    https://bugzilla.suse.com/show_bug.cgi?id=1107423 bsc#1107423
  * CVE-2018-16511: type confusion in "ztype" could be used by
    remote attackers able to supply crafted PostScript to crash
    the interpreter or possibly have unspecified other impact
    https://bugs.ghostscript.com/show_bug.cgi?id=699659
    https://bugzilla.suse.com/show_bug.cgi?id=1107426 bsc#1107426
  * CVE-2018-16585 .setdistillerkeys PostScript command is
    accepted even though it is not intended for use
    https://bugzilla.suse.com/show_bug.cgi?id=1107581 bsc#1107581
  * CVE-2018-16802: Incorrect"restoration of privilege" checking
    when running out of stack during exceptionhandling could be
    used by attackers able to supply crafted PostScript to execute
    code using the "pipe" instruction. This is due to an incomplete
    fix for CVE-2018-16509
    https://bugs.ghostscript.com/show_bug.cgi?id=699714
    https://bugs.ghostscript.com/show_bug.cgi?id=699718
    https://bugzilla.suse.com/show_bug.cgi?id=1108027 bnc#1108027
  Regarding what the above "should fix" means:
  PostScript is a general purpose Turing-complete programming
  language (cf. https://en.wikipedia.org/wiki/PostScript)
  that supports in particular file access on the system disk.
  When Ghostscript processes PostScript it runs a PostScript
  program as the user who runs Ghostscript.
  When Ghostscript processes an arbitrary PostScript file,
  the user who runs Ghostscript runs an arbitrary program
  which can do anything on the system where Ghostscript runs
  that this user is allowed to do on that system.
  To make it safer when Ghostscript runs a PostScript program
  the Ghostscript command line option '-dSAFER' disables
  certain file access functionality, for details see
  /usr/share/doc/ghostscript/9.25/Use.htm
  Its name 'SAFER' says everything: It makes it 'safer'
  to let Ghostscript run a PostScript program,
  but it does not make it completely safe.
  In theory software is safe against misuse (i.e. has no bugs).
  In practice there is an endless sequence of various kind of
  security issues (i.e. software can be misused to do more than
  what is intended) that get fixed issue by issue ad infinitum.
  In the end all that means:
  In practice the user who runs Ghostscript must not let it
  process arbitrary PostScript files from untrusted origin.
  In particular Ghostscript is usually run when printing
  documents (with the '-dSAFER' option set), see the part about
  "It is crucial to limit access to CUPS to trusted users" in
  https://en.opensuse.org/SDB:CUPS_and_SANE_Firewall_settings</changelog>
  <changelog author="jsmeix@suse.de" date="1541764800">- Version upgrade to 9.26rc1 (first release candidate for 9.26).
  Highlights in this release include:
  * Purely security and a few bug fixes, there are no new features,
    and no API changes to report.</changelog>
  <changelog author="jsmeix@suse.de" date="1543579200">- Version upgrade to 9.26
  Highlights in this release include:
  * Security issues have been the primary focus of this release,
    including solving several (well publicised) real and potential
    exploits.
    Thanks to Man Yue Mo of Semmle Security Research Team,
    Jens Mueller of Ruhr-Universitaet Bochum and
    Tavis Ormandy of Google's Project Zero
    for their help to identify specific security issues.
    PLEASE NOTE:
    We (i.e. Ghostscript upstream) strongly urge users to upgrade
    to this latest release to avoid these issues.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  For a release summary see:
  http://www.ghostscript.com/doc/9.26/News.htm
  For details see the News.htm and History9.htm files.
  The Ghostscript 9.26 release should fix (cf. the entry below
  dated 'Fri Sep 14 10:47:33 CEST 2018' what "should fix" means)
  in particular those security issues (bsc#1117331)
  * CVE-2018-19475: psi/zdevice2.c allows attackers to bypass
    intended access restrictions
    https://bugs.ghostscript.com/show_bug.cgi?id=700153
    https://bugzilla.suse.com/show_bug.cgi?id=1117327 bsc#1117327
  * CVE-2018-19476: psi/zicc.c allows attackers to bypass
    intended access restrictions because of a setcolorspace
    type confusion
    https://bugs.ghostscript.com/show_bug.cgi?id=700169
    https://bugzilla.suse.com/show_bug.cgi?id=1117313 bsc#1117313
  * CVE-2018-19477: psi/zfjbig2.c allows attackers to bypass
    intended access restrictions because of a JBIG2Decode
    type confusion
    https://bugs.ghostscript.com/show_bug.cgi?id=700168
    https://bugzilla.suse.com/show_bug.cgi?id=1117274 bsc#1117274
  * CVE-2018-19409: LockSafetyParams is not checked correctly
    if another device is used
    https://bugs.ghostscript.com/show_bug.cgi?id=700176
    https://bugzilla.suse.com/show_bug.cgi?id=1117022 bsc#1117022
  and those security issues
  * CVE-2018-18284: 1Policy operator gives access to .forceput
    https://bugs.ghostscript.com/show_bug.cgi?id=69963
    https://bugzilla.suse.com/show_bug.cgi?id=1112229 bsc#1112229
  * CVE-2018-18073: saved execution stacks can leak operator arrays
    https://bugs.ghostscript.com/show_bug.cgi?id=699927
    https://bugzilla.suse.com/show_bug.cgi?id=1111480 bsc#1111480
  * CVE-2018-17961: bypassing executeonly to escape -dSAFER sandbox
    https://bugs.ghostscript.com/show_bug.cgi?id=699816
    https://bugzilla.suse.com/show_bug.cgi?id=1111479 bsc#1111479
  * CVE-2018-17183: remote attackers could be able to supply
    crafted PostScript to potentially overwrite or replace
    error handlers to inject code
    https://bugs.ghostscript.com/show_bug.cgi?id=699708
    https://bugzilla.suse.com/show_bug.cgi?id=1109105 bsc#1109105</changelog>
  <changelog author="jsmeix@suse.de" date="1547726400">- Version upgrade to 9.26a
  The version 9.26a is a special security bugfix version to fix
  * CVE-2019-6116: subroutines within pseudo-operators
    must themselves be pseudo-operators
    https://bugs.ghostscript.com/show_bug.cgi?id=700317
    https://bugzilla.suse.com/show_bug.cgi?id=1122319 bsc#1122319</changelog>
  <changelog author="jsmeix@suse.de" date="1552996800">- CVE-2019-3838.patch fixes CVE-2019-3838
  forceput in DefineResource is still accessible
  https://bugzilla.suse.com/show_bug.cgi?id=1129186 bsc#1129186
  https://bugs.ghostscript.com/show_bug.cgi?id=700576</changelog>
  <changelog author="jsmeix@suse.de" date="1554379200">- Version upgrade to 9.27
  Highlights in this release include:
  * We (i.e. Ghostscript upstream) have extensively cleaned up
    the Postscript name space: removing access to internal and/or
    undocumented Postscript operators, procedures and data.
    This has benefits for security and maintainability.
    Incompatible changes:
    The process of "tidying" the Postscript name space should
    have removed only non-standard and undocumented operators.
    Nevertheless, it is possible that any integrations or
    utilities that rely on those non-standard and undocumented
    operators may stop working, or may change behaviour.
    If you encounter such a case, please contact us (i.e.
    Ghostscript upstream) - (either the #ghostscript IRC channel,
    or the gs-devel mailing list would be best), and we'll work
    with you to either find an alternative solution.
  * Fontmap can now reference invidual fonts in a TrueType
    Collection for font subsitution. Previously, a Fontmap entry
    could only reference a TrueType collection and use the default
    (first) font.
    Now, the Fontmap syntax allows for specifying a specific index
    in a TTC. See the comments at the top of (the default)
    Fontmap.GS for details.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  IMPORTANT: It is our intention, within the next 12 months
    (ideally sooner, in time for the next release) to make SAFER
    the default mode of operation. For many users this will have
    no effect, since they use SAFER explicitly, but some niche
    uses which rely on SAFER being disabled may need to start
    explicitly adding the "-dNOSAFER" option.
  IMPORTANT: We (i.e. Ghostscript upstream) are in the process of
    forking LittleCMS. LCMS2 is not thread safe, and cannot be made
    thread safe without breaking the ABI. Our fork will be thread
    safe, and include performance enhancements (these changes have
    all be been offered and rejected upstream). We will maintain
    compatibility between Ghostscript and LCMS2 for a time, but not
    in perpetuity. Our fork will be available as its own package
    separately from Ghostscript (and MuPDF).
  For a release summary see:
  http://www.ghostscript.com/doc/9.27/News.htm
  For details see the News.htm and History9.htm files.
  The Ghostscript 9.27 release should fix (cf. the entry below
  dated 'Fri Sep 14 10:47:33 CEST 2018' what "should fix" means)
  in particular those security issues:
  * CVE-2019-3838 forceput in DefineResource is still accessible
    https://bugzilla.suse.com/show_bug.cgi?id=1129186 bsc#1129186
    https://bugs.ghostscript.com/show_bug.cgi?id=700576
  * CVE-2019-3835: superexec operator is available
    https://bugzilla.suse.com/show_bug.cgi?id=1129180 bsc#1129180
    https://bugs.ghostscript.com/show_bug.cgi?id=700585</changelog>
  <changelog author="werner@suse.de" date="1565611200">- CVE-2019-10216.patch fixes CVE-2019-10216
  forceput/superexec in .buildfont1 is still accessible
  https://bugzilla.suse.com/show_bug.cgi?id=1144621 bsc#1144621
  https://bugs.ghostscript.com/show_bug.cgi?id=701394</changelog>
  <changelog author="werner@suse.de" date="1568376000">- Add patch openjpeg4gs-CVE-2018-6616-8ee33522.patch
  to fix bsc#1140359 for CVE-2019-12973</changelog>
  <changelog author="werner@suse.de" date="1568635200">- Add patch gs-CVE-2019-14811-885444fc.patch to fix bsc#1146882
  for CVE-2019-14811,CVE-2019-14812,CVE-2019-14813
- Add patch gs-CVE-2019-14817-cd1b1cac.patch to fix bsc#1146884
  for CVE-2019-14817</changelog>
  <changelog author="werner@suse.de" date="1568635201">- Port latest ghostscript 9.27 from factory including latest
  security patches to SLES15/SLES12
  * Port patch CVE-2019-10216.patch to 9.27 which is the orignal
    upstream commit now
  * Drop patch CVE-2019-3838.patch as now part of 9.27</changelog>
  <changelog author="jsmeix@suse.de" date="1573473600">- CVE-2019-14869.patch contains commit from Ghostscript upstream
  https://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=485904772c5f
  to fix CVE-2019-14869 "-dSAFER escape in .charkeys"
  (bsc#1156275)</changelog>
  <changelog author="jsmeix@suse.de" date="1588075200">- The version upgrade to 9.52 fixes in particular
  CVE-2020-12268: jbic2dec: heap-based buffer overflow
  in jbig2_image_compose (bsc#1170603)
- Version upgrade to 9.52
  Highlights in this release include:
  * The 9.52 release replaces the 9.51 release after a problem
    was reported with 9.51 which warranted the quick turnaround.
    Thus, like 9.51, 9.52 is primarily a maintenance release,
    consolidating the changes we introduced in 9.50.
  * IMPORTANT: We have forked LittleCMS2 into LittleCMS2mt
    (the "mt" indicating "multi-thread").
    LCMS2 is not thread-safe, and cannot be made thread-safe
    without breaking the ABI. Our fork will be thread-safe and
    include performance enhancements (these changes have all
    been offered and rejected upstream). We will maintain
    compatibility between Ghostscript and LCMS2 for a time,
    but not in perpetuity. If there is sufficient interest,
    our fork will be available as its own package separately
    from Ghostscript (and MuPDF).
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  Incompatible changes:
  * New option -dALLOWPSTRANSPARENCY: The transparency compositor
    (and related features), whilst we are improving it, remains
    sensitive to being driven correctly, and incorrect use
    can have unexpected/undefined results. Hence, as part of
    improving security, we limited access to these operators,
    originally using the -dSAFER feature. As we made "SAFER"
    the default mode, that became unacceptable, hence the
    new option -dALLOWPSTRANSPARENCY which enables access
    to the operators, cf.
    https://www.ghostscript.com/doc/9.52/Use.htm#ALLOWPSTRANSPARENCY
  For a release summary see:
  https://www.ghostscript.com/doc/9.52/News.htm
  For details see the News.htm and History9.htm files.
- Version upgrade to 9.51
  Highlights in this release include:
  * 9.51 is primarily a maintainance release, consolidating
    the changes we introduced in 9.50.
  * We have continued our work on code hygiene for this release,
    with a focus on the static analysis tool Coverity
    (from Synopsys, Inc) and we are now maintaining a policy of
    zero Coverity issues in the Ghostscript/GhostPDL source base.
  * IMPORTANT: In consultation with a representative of
    OpenPrinting (http://www.openprinting.org/) it is our
    intention to deprecate and, in the not distant future,
    remove the OpenPrinting Vector/Raster Printer Drivers
    (that is, the opvp and oprp devices).
    If you rely on either of these devices, please get in touch
    with us (i.e. Ghostscript upstream), so we can discuss your
    use case, and revise our plans accordingly.
  * We (i.e. Ghostscript upstream) are in the process of forking
    LittleCMS, cf. the other release notes entries below.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  For a release summary see:
  https://www.ghostscript.com/doc/9.51/News.htm
  For details see the News.htm and History9.htm files.
- Version upgrade to 9.50
  Highlights in this release include:
  * The change to version 9.50 follows recognition
    of the extent and importance of the file access control
    redesign/reimplementation outlined below.
  * The file access control capability (enable with -dSAFER)
    has been completely rewritten, with a ground-up rethink
    of the design. For more details, see: "SAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#Safer
  * It is important to note that -dSAFER now only enables the
    file access controls, and no longer applies restrictions
    to standard Postscript functionality (specifically,
    restrictions on setpagedevice). If your application relies
    on these Postscript restrictions, see "OLDSAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#OldSafer
    and please get in touch, as we do plan to remove those
    Postscript restrictions unless we have reason not to.
  IMPORTANT: File access controls are now enabled by default.
    In order to run Ghostscript without these controls,
    see "NOSAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#NoSafer
  * We (i.e. Ghostscript upstream) are in the process of forking
    LittleCMS, cf. the other release notes entries below.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  Incompatible changes:
  * There are a couple of subtle incompatibilities between the old
    and new SAFER implementations. Firstly, as mentioned above,
    SAFER now leaves standard Postcript functionality unchanged
    (except for the file access limitations). Secondly, the
    interaction with save/restore operations, see "SAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#Safer
  * The following is not strictly speaking new to 9.50,
    as not much has changed since 9.27 in this area,
    but for those who don't upgrade with every release:
    The process of "tidying" the Postscript name space should have
    removed only non-standard and undocumented operators.
    Nevertheless, it is possible that any integrations or utilities
    that rely on those non-standard and undocumented operators
    may stop working, or may change behaviour.
    If you encounter such a case, please contact us
    (i.e. Ghostscript upstream, either the #ghostscript IRC channel
    or the gs-devel mailing list would be best), and we'll work
    with you to either find an alternative solution or return the
    previous functionality, if there is genuinely no other option.
    One case we know this has occurred is GSView 5 (and earlier).
    GSView 5 support for PDF files relied upon internal use only
    features which are no longer available. GSView 5 will still
    work as previously for Postscript files. For PDF files,
    users are encouraged to look at MuPDF https://www.mupdf.com/
  For a release summary see:
  https://www.ghostscript.com/doc/9.50/News.htm
  For details see the News.htm and History9.htm files.
- CVE-2019-10216.patch CVE-2019-14869.patch
  gs-CVE-2019-14811-885444fc.patch
  gs-CVE-2019-14817-cd1b1cac.patch
  openjpeg4gs-CVE-2018-6616-8ee33522.patch
  are fixed in the version 9.52 upstream sources.</changelog>
  <changelog author="jsmeix@suse.de" date="1595851200">- CVE-2020-15900.patch fixes CVE-2020-15900
  Memory Corruption (SAFER Sandbox Breakout)
  cf. https://bugs.ghostscript.com/show_bug.cgi?id=702582
  (bsc#1174415)</changelog>
  <changelog author="wolfgang.frisch@suse.com" date="1619006400">- Hardening: link as position independent executable (bsc#1184123).</changelog>
  <changelog author="jsmeix@suse.de" date="1631275200">- CVE-2021-3781.patch fixes CVE-2021-3781
  Trivial -dSAFER bypass
  cf. https://bugs.ghostscript.com/show_bug.cgi?id=704342
  (bsc#1190381)</changelog>
  <changelog author="werner@suse.de" date="1632916800">- Use update-alternatives to get the real ghostscript binary from
  /usr/bin/gs to /usr/bin/gs.bin and allow the gswrap package to
  use this with its wrapper script (jira#PM-3037)</changelog>
</package>
<package pkgid="9a1529a5a20ceb72c5f7fafd2a866371cb90c6a4435c936f8be388de1fc49c1b" name="ghostscript" arch="ppc64le">
  <version epoch="0" ver="9.52" rel="158.1"/>
  <changelog author="jsmeix@suse.de" date="1521720000">- Version upgrade to 9.23
  Highlights in this release include:
  * Ghostscript now has a family of 'pdfimage' devices
    (pdfimage8, pdfimage24 and pdfimage32) which produce
    rendered output wrapped up as an image in a PDF.
    Additionally, there is a 'pclm' device which
    produces PCLm format output.
  * There is now a ColorAccuracy parameter allowing the user
    to decide between speed or accuracy in ICC color transforms.
  * JPEG Passthrough: devices which support it can now receive
    the 'raw' JPEG stream from the interpreter.
    The main use of this is the pdfwrite/ps2write family of devices
    that can now take JPEG streams from the input file(s) and write
    them unchanged to the output (thus avoiding additional
    quantization effects).
  * PDF transparency performance improvements
  * IMPORTANT: We (i.e. Ghostscript upstream) are in the process
    of forking LittleCMS.
    LCMS2 is not thread safe, and cannot be made thread safe
    without breaking the ABI. Our fork will be thread safe,
    and include performance enhancements (these changes have all
    be been offered and rejected upstream). We will maintain
    compatibility between Ghostscript and LCMS2 for a time,
    but not in perpetuity. Our fork will be available as its own
    package separately from Ghostscript (and MuPDF).
  * We have continued the focus on code hygiene in this release
    cleaning up security issues, ignored return values,
    and compiler warnings.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  Incompatible changes
  * The planned device API tidy has, unfortunately, been
    indefinitely postponed, until appropriate resources
    are available.
  For a release summary see:
  http://www.ghostscript.com/doc/9.23/News.htm
  For details see the News.htm and History9.htm files.
  See also the entries below since "Version upgrade to 9.22"
  (boo#1082896 and boo#1074266).</changelog>
  <changelog author="jsmeix@suse.de" date="1528200000">- CVE-2018-10194.patch fixes stack-based buffer overflow
  in gdevpdts.c (bsc#1090099), see
  https://bugs.ghostscript.com/show_bug.cgi?id=699255 and
  http://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=39b1e54b2968620723bf32e96764c88797714879</changelog>
  <changelog author="jsmeix@suse.de" date="1536840000">- Version upgrade to 9.24
  Highlights in this release include:
  * Security issues have been the primary focus of this release,
    including solving several (well publicised)
    real and potential exploits.
    PLEASE NOTE:
    We (i.e. Ghostscript upstream) strongly urge users to upgrade
    to this latest release to avoid these issues.
  * As well as Ghostscript itself, jbig2dec has had a significant
    amount of work improving its robustness in the face of
    out specification files.
  * IMPORTANT: We (i.e. Ghostscript upstream) are in the process
    of forking LittleCMS. LCMS2 is not thread safe, and cannot
    be made thread safe without breaking the ABI. Our fork
    will be thread safe, and include performance enhancements
    (these changes have all be been offered and rejected upstream).
    We will maintain compatibility between Ghostscript and LCMS2
    for a time, but not in perpetuity. Our fork will be available
    as its own package separately from Ghostscript (and MuPDF).
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  For a release summary see:
  http://www.ghostscript.com/doc/9.24/News.htm
  For details see the News.htm and History9.htm files.
- fix_ln_docdir_gsdatadir.patch is no longer needed
  because the issue is fixed in the upstream sources.
- CVE-2018-10194.patch is no longer needed
  because the issue is fixed in the upstream sources.</changelog>
  <changelog author="jsmeix@suse.de" date="1536840001">- Version upgrade to 9.25rc1 (first release candidate for 9.25).
  Highlights in this release include:
  * This release fixes problems with argument handling, some
    unintended results of the security fixes to the SAFER file
    access restrictions (specifically accessing ICC profile files),
    and some additional security issues over the 9.24 release.
  * Security issues have been the primary focus of this release,
    including solving several (well publicised) real
    and potential exploits.
    PLEASE NOTE:
    We (i.e. Ghostscript upstream) strongly urge users to upgrade
    to this latest release to avoid these issues.
  * Avoid that ps2epsi fails with
    'Error: /undefined in --setpagedevice--'
    Recent changes required to harden SAFER mode mean that
    it is no longer possible to run ps2epsi in SAFER mode,
    because it relies upon unsafe Ghostscript non-standard
    extension operators.
    Removing SAFER and DELAYSAFER, and the code to reset SAFER,
    allow ps2epsi to run as well as it ever did (ie badly).
    This program (i.e. ps2epsi) should now be considered unsafe,
    you should not use it on untrusted PostScript programs.
    Likely we (i.e. Ghostscript upstream) will deprecate and
    remove this program in future.
  For details see the News.htm and History9.htm files.
  Regarding installing packages (in particular release candidates)
  from the openSUSE build service development project "Printing"
  see https://build.opensuse.org/project/show/Printing</changelog>
  <changelog author="jsmeix@suse.de" date="1536926400">- Version upgrade to 9.25
  For the highlights in this release see the highlights in the
  9.25rc1 first release candidate for 9.25 entry below.
  PLEASE NOTE:
  We (i.e. Ghostscript upstream) strongly urge users to upgrade
  to this latest release to avoid these issues.
  For a release summary see:
  http://www.ghostscript.com/doc/9.25/News.htm
  For details see the News.htm and History9.htm files.
  The Ghostscript 9.25 release should fix (see below)
  in particular those security issues:
  * CVE-2018-15909: shading_param incomplete type checking
    https://bugs.ghostscript.com/show_bug.cgi?id=699660
    https://bugzilla.suse.com/show_bug.cgi?id=1106172 bsc#1106172
  * CVE-2018-15908: .tempfile file permission issues
    https://bugs.ghostscript.com/show_bug.cgi?id=699657
    https://bugzilla.suse.com/show_bug.cgi?id=1106171 bsc#1106171
  * CVE-2018-15910: LockDistillerParams type confusion
    https://bugs.ghostscript.com/show_bug.cgi?id=699656
    https://bugzilla.suse.com/show_bug.cgi?id=1106173 bsc#1106173
  * CVE-2018-15911: uninitialized memory access in the aesdecode
    https://bugs.ghostscript.com/show_bug.cgi?id=699665
    https://bugzilla.suse.com/show_bug.cgi?id=1106195 bsc#1106195
  * CVE-2018-16513: setcolor missing type check
    https://bugs.ghostscript.com/show_bug.cgi?id=699655
    https://bugzilla.suse.com/show_bug.cgi?id=1107412 bsc#1107412
  * CVE-2018-16509: /invalidaccess bypass after failed restore
    https://bugs.ghostscript.com/show_bug.cgi?id=699654
    https://bugzilla.suse.com/show_bug.cgi?id=1107410 bsc#1107410
  * CVE-2018-16510: Incorrect exec stack handling in the "CS"
    and "SC" PDF primitives
    https://bugs.ghostscript.com/show_bug.cgi?id=699671
    https://bugzilla.suse.com/show_bug.cgi?id=1107411 bsc#1107411
  * CVE-2018-16542: .definemodifiedfont memory corruption
    if /typecheck is handled
    https://bugs.ghostscript.com/show_bug.cgi?id=699668
    https://bugzilla.suse.com/show_bug.cgi?id=1107413 bsc#1107413
  * CVE-2018-16541 incorrect free logic in pagedevice replacement
    https://bugs.ghostscript.com/show_bug.cgi?id=699664
    https://bugzilla.suse.com/show_bug.cgi?id=1107421 bsc#1107421
  * CVE-2018-16540 use-after-free in copydevice handling
    https://bugs.ghostscript.com/show_bug.cgi?id=699661
    https://bugzilla.suse.com/show_bug.cgi?id=1107420 bsc#1107420
  * CVE-2018-16539: incorrect access checking in temp file
    handling to disclose contents of files
    https://bugs.ghostscript.com/show_bug.cgi?id=699658
    https://bugzilla.suse.com/show_bug.cgi?id=1107422 bsc#1107422
  * CVE-2018-16543: gssetresolution and gsgetresolution allow
    for unspecified impact
    https://bugs.ghostscript.com/show_bug.cgi?id=699670
    https://bugzilla.suse.com/show_bug.cgi?id=1107423 bsc#1107423
  * CVE-2018-16511: type confusion in "ztype" could be used by
    remote attackers able to supply crafted PostScript to crash
    the interpreter or possibly have unspecified other impact
    https://bugs.ghostscript.com/show_bug.cgi?id=699659
    https://bugzilla.suse.com/show_bug.cgi?id=1107426 bsc#1107426
  * CVE-2018-16585 .setdistillerkeys PostScript command is
    accepted even though it is not intended for use
    https://bugzilla.suse.com/show_bug.cgi?id=1107581 bsc#1107581
  * CVE-2018-16802: Incorrect"restoration of privilege" checking
    when running out of stack during exceptionhandling could be
    used by attackers able to supply crafted PostScript to execute
    code using the "pipe" instruction. This is due to an incomplete
    fix for CVE-2018-16509
    https://bugs.ghostscript.com/show_bug.cgi?id=699714
    https://bugs.ghostscript.com/show_bug.cgi?id=699718
    https://bugzilla.suse.com/show_bug.cgi?id=1108027 bnc#1108027
  Regarding what the above "should fix" means:
  PostScript is a general purpose Turing-complete programming
  language (cf. https://en.wikipedia.org/wiki/PostScript)
  that supports in particular file access on the system disk.
  When Ghostscript processes PostScript it runs a PostScript
  program as the user who runs Ghostscript.
  When Ghostscript processes an arbitrary PostScript file,
  the user who runs Ghostscript runs an arbitrary program
  which can do anything on the system where Ghostscript runs
  that this user is allowed to do on that system.
  To make it safer when Ghostscript runs a PostScript program
  the Ghostscript command line option '-dSAFER' disables
  certain file access functionality, for details see
  /usr/share/doc/ghostscript/9.25/Use.htm
  Its name 'SAFER' says everything: It makes it 'safer'
  to let Ghostscript run a PostScript program,
  but it does not make it completely safe.
  In theory software is safe against misuse (i.e. has no bugs).
  In practice there is an endless sequence of various kind of
  security issues (i.e. software can be misused to do more than
  what is intended) that get fixed issue by issue ad infinitum.
  In the end all that means:
  In practice the user who runs Ghostscript must not let it
  process arbitrary PostScript files from untrusted origin.
  In particular Ghostscript is usually run when printing
  documents (with the '-dSAFER' option set), see the part about
  "It is crucial to limit access to CUPS to trusted users" in
  https://en.opensuse.org/SDB:CUPS_and_SANE_Firewall_settings</changelog>
  <changelog author="jsmeix@suse.de" date="1541764800">- Version upgrade to 9.26rc1 (first release candidate for 9.26).
  Highlights in this release include:
  * Purely security and a few bug fixes, there are no new features,
    and no API changes to report.</changelog>
  <changelog author="jsmeix@suse.de" date="1543579200">- Version upgrade to 9.26
  Highlights in this release include:
  * Security issues have been the primary focus of this release,
    including solving several (well publicised) real and potential
    exploits.
    Thanks to Man Yue Mo of Semmle Security Research Team,
    Jens Mueller of Ruhr-Universitaet Bochum and
    Tavis Ormandy of Google's Project Zero
    for their help to identify specific security issues.
    PLEASE NOTE:
    We (i.e. Ghostscript upstream) strongly urge users to upgrade
    to this latest release to avoid these issues.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  For a release summary see:
  http://www.ghostscript.com/doc/9.26/News.htm
  For details see the News.htm and History9.htm files.
  The Ghostscript 9.26 release should fix (cf. the entry below
  dated 'Fri Sep 14 10:47:33 CEST 2018' what "should fix" means)
  in particular those security issues (bsc#1117331)
  * CVE-2018-19475: psi/zdevice2.c allows attackers to bypass
    intended access restrictions
    https://bugs.ghostscript.com/show_bug.cgi?id=700153
    https://bugzilla.suse.com/show_bug.cgi?id=1117327 bsc#1117327
  * CVE-2018-19476: psi/zicc.c allows attackers to bypass
    intended access restrictions because of a setcolorspace
    type confusion
    https://bugs.ghostscript.com/show_bug.cgi?id=700169
    https://bugzilla.suse.com/show_bug.cgi?id=1117313 bsc#1117313
  * CVE-2018-19477: psi/zfjbig2.c allows attackers to bypass
    intended access restrictions because of a JBIG2Decode
    type confusion
    https://bugs.ghostscript.com/show_bug.cgi?id=700168
    https://bugzilla.suse.com/show_bug.cgi?id=1117274 bsc#1117274
  * CVE-2018-19409: LockSafetyParams is not checked correctly
    if another device is used
    https://bugs.ghostscript.com/show_bug.cgi?id=700176
    https://bugzilla.suse.com/show_bug.cgi?id=1117022 bsc#1117022
  and those security issues
  * CVE-2018-18284: 1Policy operator gives access to .forceput
    https://bugs.ghostscript.com/show_bug.cgi?id=69963
    https://bugzilla.suse.com/show_bug.cgi?id=1112229 bsc#1112229
  * CVE-2018-18073: saved execution stacks can leak operator arrays
    https://bugs.ghostscript.com/show_bug.cgi?id=699927
    https://bugzilla.suse.com/show_bug.cgi?id=1111480 bsc#1111480
  * CVE-2018-17961: bypassing executeonly to escape -dSAFER sandbox
    https://bugs.ghostscript.com/show_bug.cgi?id=699816
    https://bugzilla.suse.com/show_bug.cgi?id=1111479 bsc#1111479
  * CVE-2018-17183: remote attackers could be able to supply
    crafted PostScript to potentially overwrite or replace
    error handlers to inject code
    https://bugs.ghostscript.com/show_bug.cgi?id=699708
    https://bugzilla.suse.com/show_bug.cgi?id=1109105 bsc#1109105</changelog>
  <changelog author="jsmeix@suse.de" date="1547726400">- Version upgrade to 9.26a
  The version 9.26a is a special security bugfix version to fix
  * CVE-2019-6116: subroutines within pseudo-operators
    must themselves be pseudo-operators
    https://bugs.ghostscript.com/show_bug.cgi?id=700317
    https://bugzilla.suse.com/show_bug.cgi?id=1122319 bsc#1122319</changelog>
  <changelog author="jsmeix@suse.de" date="1552996800">- CVE-2019-3838.patch fixes CVE-2019-3838
  forceput in DefineResource is still accessible
  https://bugzilla.suse.com/show_bug.cgi?id=1129186 bsc#1129186
  https://bugs.ghostscript.com/show_bug.cgi?id=700576</changelog>
  <changelog author="jsmeix@suse.de" date="1554379200">- Version upgrade to 9.27
  Highlights in this release include:
  * We (i.e. Ghostscript upstream) have extensively cleaned up
    the Postscript name space: removing access to internal and/or
    undocumented Postscript operators, procedures and data.
    This has benefits for security and maintainability.
    Incompatible changes:
    The process of "tidying" the Postscript name space should
    have removed only non-standard and undocumented operators.
    Nevertheless, it is possible that any integrations or
    utilities that rely on those non-standard and undocumented
    operators may stop working, or may change behaviour.
    If you encounter such a case, please contact us (i.e.
    Ghostscript upstream) - (either the #ghostscript IRC channel,
    or the gs-devel mailing list would be best), and we'll work
    with you to either find an alternative solution.
  * Fontmap can now reference invidual fonts in a TrueType
    Collection for font subsitution. Previously, a Fontmap entry
    could only reference a TrueType collection and use the default
    (first) font.
    Now, the Fontmap syntax allows for specifying a specific index
    in a TTC. See the comments at the top of (the default)
    Fontmap.GS for details.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  IMPORTANT: It is our intention, within the next 12 months
    (ideally sooner, in time for the next release) to make SAFER
    the default mode of operation. For many users this will have
    no effect, since they use SAFER explicitly, but some niche
    uses which rely on SAFER being disabled may need to start
    explicitly adding the "-dNOSAFER" option.
  IMPORTANT: We (i.e. Ghostscript upstream) are in the process of
    forking LittleCMS. LCMS2 is not thread safe, and cannot be made
    thread safe without breaking the ABI. Our fork will be thread
    safe, and include performance enhancements (these changes have
    all be been offered and rejected upstream). We will maintain
    compatibility between Ghostscript and LCMS2 for a time, but not
    in perpetuity. Our fork will be available as its own package
    separately from Ghostscript (and MuPDF).
  For a release summary see:
  http://www.ghostscript.com/doc/9.27/News.htm
  For details see the News.htm and History9.htm files.
  The Ghostscript 9.27 release should fix (cf. the entry below
  dated 'Fri Sep 14 10:47:33 CEST 2018' what "should fix" means)
  in particular those security issues:
  * CVE-2019-3838 forceput in DefineResource is still accessible
    https://bugzilla.suse.com/show_bug.cgi?id=1129186 bsc#1129186
    https://bugs.ghostscript.com/show_bug.cgi?id=700576
  * CVE-2019-3835: superexec operator is available
    https://bugzilla.suse.com/show_bug.cgi?id=1129180 bsc#1129180
    https://bugs.ghostscript.com/show_bug.cgi?id=700585</changelog>
  <changelog author="werner@suse.de" date="1565611200">- CVE-2019-10216.patch fixes CVE-2019-10216
  forceput/superexec in .buildfont1 is still accessible
  https://bugzilla.suse.com/show_bug.cgi?id=1144621 bsc#1144621
  https://bugs.ghostscript.com/show_bug.cgi?id=701394</changelog>
  <changelog author="werner@suse.de" date="1568376000">- Add patch openjpeg4gs-CVE-2018-6616-8ee33522.patch
  to fix bsc#1140359 for CVE-2019-12973</changelog>
  <changelog author="werner@suse.de" date="1568635200">- Add patch gs-CVE-2019-14811-885444fc.patch to fix bsc#1146882
  for CVE-2019-14811,CVE-2019-14812,CVE-2019-14813
- Add patch gs-CVE-2019-14817-cd1b1cac.patch to fix bsc#1146884
  for CVE-2019-14817</changelog>
  <changelog author="werner@suse.de" date="1568635201">- Port latest ghostscript 9.27 from factory including latest
  security patches to SLES15/SLES12
  * Port patch CVE-2019-10216.patch to 9.27 which is the orignal
    upstream commit now
  * Drop patch CVE-2019-3838.patch as now part of 9.27</changelog>
  <changelog author="jsmeix@suse.de" date="1573473600">- CVE-2019-14869.patch contains commit from Ghostscript upstream
  https://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=485904772c5f
  to fix CVE-2019-14869 "-dSAFER escape in .charkeys"
  (bsc#1156275)</changelog>
  <changelog author="jsmeix@suse.de" date="1588075200">- The version upgrade to 9.52 fixes in particular
  CVE-2020-12268: jbic2dec: heap-based buffer overflow
  in jbig2_image_compose (bsc#1170603)
- Version upgrade to 9.52
  Highlights in this release include:
  * The 9.52 release replaces the 9.51 release after a problem
    was reported with 9.51 which warranted the quick turnaround.
    Thus, like 9.51, 9.52 is primarily a maintenance release,
    consolidating the changes we introduced in 9.50.
  * IMPORTANT: We have forked LittleCMS2 into LittleCMS2mt
    (the "mt" indicating "multi-thread").
    LCMS2 is not thread-safe, and cannot be made thread-safe
    without breaking the ABI. Our fork will be thread-safe and
    include performance enhancements (these changes have all
    been offered and rejected upstream). We will maintain
    compatibility between Ghostscript and LCMS2 for a time,
    but not in perpetuity. If there is sufficient interest,
    our fork will be available as its own package separately
    from Ghostscript (and MuPDF).
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  Incompatible changes:
  * New option -dALLOWPSTRANSPARENCY: The transparency compositor
    (and related features), whilst we are improving it, remains
    sensitive to being driven correctly, and incorrect use
    can have unexpected/undefined results. Hence, as part of
    improving security, we limited access to these operators,
    originally using the -dSAFER feature. As we made "SAFER"
    the default mode, that became unacceptable, hence the
    new option -dALLOWPSTRANSPARENCY which enables access
    to the operators, cf.
    https://www.ghostscript.com/doc/9.52/Use.htm#ALLOWPSTRANSPARENCY
  For a release summary see:
  https://www.ghostscript.com/doc/9.52/News.htm
  For details see the News.htm and History9.htm files.
- Version upgrade to 9.51
  Highlights in this release include:
  * 9.51 is primarily a maintainance release, consolidating
    the changes we introduced in 9.50.
  * We have continued our work on code hygiene for this release,
    with a focus on the static analysis tool Coverity
    (from Synopsys, Inc) and we are now maintaining a policy of
    zero Coverity issues in the Ghostscript/GhostPDL source base.
  * IMPORTANT: In consultation with a representative of
    OpenPrinting (http://www.openprinting.org/) it is our
    intention to deprecate and, in the not distant future,
    remove the OpenPrinting Vector/Raster Printer Drivers
    (that is, the opvp and oprp devices).
    If you rely on either of these devices, please get in touch
    with us (i.e. Ghostscript upstream), so we can discuss your
    use case, and revise our plans accordingly.
  * We (i.e. Ghostscript upstream) are in the process of forking
    LittleCMS, cf. the other release notes entries below.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  For a release summary see:
  https://www.ghostscript.com/doc/9.51/News.htm
  For details see the News.htm and History9.htm files.
- Version upgrade to 9.50
  Highlights in this release include:
  * The change to version 9.50 follows recognition
    of the extent and importance of the file access control
    redesign/reimplementation outlined below.
  * The file access control capability (enable with -dSAFER)
    has been completely rewritten, with a ground-up rethink
    of the design. For more details, see: "SAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#Safer
  * It is important to note that -dSAFER now only enables the
    file access controls, and no longer applies restrictions
    to standard Postscript functionality (specifically,
    restrictions on setpagedevice). If your application relies
    on these Postscript restrictions, see "OLDSAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#OldSafer
    and please get in touch, as we do plan to remove those
    Postscript restrictions unless we have reason not to.
  IMPORTANT: File access controls are now enabled by default.
    In order to run Ghostscript without these controls,
    see "NOSAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#NoSafer
  * We (i.e. Ghostscript upstream) are in the process of forking
    LittleCMS, cf. the other release notes entries below.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  Incompatible changes:
  * There are a couple of subtle incompatibilities between the old
    and new SAFER implementations. Firstly, as mentioned above,
    SAFER now leaves standard Postcript functionality unchanged
    (except for the file access limitations). Secondly, the
    interaction with save/restore operations, see "SAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#Safer
  * The following is not strictly speaking new to 9.50,
    as not much has changed since 9.27 in this area,
    but for those who don't upgrade with every release:
    The process of "tidying" the Postscript name space should have
    removed only non-standard and undocumented operators.
    Nevertheless, it is possible that any integrations or utilities
    that rely on those non-standard and undocumented operators
    may stop working, or may change behaviour.
    If you encounter such a case, please contact us
    (i.e. Ghostscript upstream, either the #ghostscript IRC channel
    or the gs-devel mailing list would be best), and we'll work
    with you to either find an alternative solution or return the
    previous functionality, if there is genuinely no other option.
    One case we know this has occurred is GSView 5 (and earlier).
    GSView 5 support for PDF files relied upon internal use only
    features which are no longer available. GSView 5 will still
    work as previously for Postscript files. For PDF files,
    users are encouraged to look at MuPDF https://www.mupdf.com/
  For a release summary see:
  https://www.ghostscript.com/doc/9.50/News.htm
  For details see the News.htm and History9.htm files.
- CVE-2019-10216.patch CVE-2019-14869.patch
  gs-CVE-2019-14811-885444fc.patch
  gs-CVE-2019-14817-cd1b1cac.patch
  openjpeg4gs-CVE-2018-6616-8ee33522.patch
  are fixed in the version 9.52 upstream sources.</changelog>
  <changelog author="jsmeix@suse.de" date="1595851200">- CVE-2020-15900.patch fixes CVE-2020-15900
  Memory Corruption (SAFER Sandbox Breakout)
  cf. https://bugs.ghostscript.com/show_bug.cgi?id=702582
  (bsc#1174415)</changelog>
  <changelog author="wolfgang.frisch@suse.com" date="1619006400">- Hardening: link as position independent executable (bsc#1184123).</changelog>
  <changelog author="jsmeix@suse.de" date="1631275200">- CVE-2021-3781.patch fixes CVE-2021-3781
  Trivial -dSAFER bypass
  cf. https://bugs.ghostscript.com/show_bug.cgi?id=704342
  (bsc#1190381)</changelog>
  <changelog author="werner@suse.de" date="1632916800">- Use update-alternatives to get the real ghostscript binary from
  /usr/bin/gs to /usr/bin/gs.bin and allow the gswrap package to
  use this with its wrapper script (jira#PM-3037)</changelog>
</package>
<package pkgid="e38313acf238b5007166f578356c8c74189689806ee973359fe4c163f3d2d38f" name="ghostscript" arch="s390x">
  <version epoch="0" ver="9.52" rel="158.1"/>
  <changelog author="jsmeix@suse.de" date="1521720000">- Version upgrade to 9.23
  Highlights in this release include:
  * Ghostscript now has a family of 'pdfimage' devices
    (pdfimage8, pdfimage24 and pdfimage32) which produce
    rendered output wrapped up as an image in a PDF.
    Additionally, there is a 'pclm' device which
    produces PCLm format output.
  * There is now a ColorAccuracy parameter allowing the user
    to decide between speed or accuracy in ICC color transforms.
  * JPEG Passthrough: devices which support it can now receive
    the 'raw' JPEG stream from the interpreter.
    The main use of this is the pdfwrite/ps2write family of devices
    that can now take JPEG streams from the input file(s) and write
    them unchanged to the output (thus avoiding additional
    quantization effects).
  * PDF transparency performance improvements
  * IMPORTANT: We (i.e. Ghostscript upstream) are in the process
    of forking LittleCMS.
    LCMS2 is not thread safe, and cannot be made thread safe
    without breaking the ABI. Our fork will be thread safe,
    and include performance enhancements (these changes have all
    be been offered and rejected upstream). We will maintain
    compatibility between Ghostscript and LCMS2 for a time,
    but not in perpetuity. Our fork will be available as its own
    package separately from Ghostscript (and MuPDF).
  * We have continued the focus on code hygiene in this release
    cleaning up security issues, ignored return values,
    and compiler warnings.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  Incompatible changes
  * The planned device API tidy has, unfortunately, been
    indefinitely postponed, until appropriate resources
    are available.
  For a release summary see:
  http://www.ghostscript.com/doc/9.23/News.htm
  For details see the News.htm and History9.htm files.
  See also the entries below since "Version upgrade to 9.22"
  (boo#1082896 and boo#1074266).</changelog>
  <changelog author="jsmeix@suse.de" date="1528200000">- CVE-2018-10194.patch fixes stack-based buffer overflow
  in gdevpdts.c (bsc#1090099), see
  https://bugs.ghostscript.com/show_bug.cgi?id=699255 and
  http://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=39b1e54b2968620723bf32e96764c88797714879</changelog>
  <changelog author="jsmeix@suse.de" date="1536840000">- Version upgrade to 9.24
  Highlights in this release include:
  * Security issues have been the primary focus of this release,
    including solving several (well publicised)
    real and potential exploits.
    PLEASE NOTE:
    We (i.e. Ghostscript upstream) strongly urge users to upgrade
    to this latest release to avoid these issues.
  * As well as Ghostscript itself, jbig2dec has had a significant
    amount of work improving its robustness in the face of
    out specification files.
  * IMPORTANT: We (i.e. Ghostscript upstream) are in the process
    of forking LittleCMS. LCMS2 is not thread safe, and cannot
    be made thread safe without breaking the ABI. Our fork
    will be thread safe, and include performance enhancements
    (these changes have all be been offered and rejected upstream).
    We will maintain compatibility between Ghostscript and LCMS2
    for a time, but not in perpetuity. Our fork will be available
    as its own package separately from Ghostscript (and MuPDF).
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  For a release summary see:
  http://www.ghostscript.com/doc/9.24/News.htm
  For details see the News.htm and History9.htm files.
- fix_ln_docdir_gsdatadir.patch is no longer needed
  because the issue is fixed in the upstream sources.
- CVE-2018-10194.patch is no longer needed
  because the issue is fixed in the upstream sources.</changelog>
  <changelog author="jsmeix@suse.de" date="1536840001">- Version upgrade to 9.25rc1 (first release candidate for 9.25).
  Highlights in this release include:
  * This release fixes problems with argument handling, some
    unintended results of the security fixes to the SAFER file
    access restrictions (specifically accessing ICC profile files),
    and some additional security issues over the 9.24 release.
  * Security issues have been the primary focus of this release,
    including solving several (well publicised) real
    and potential exploits.
    PLEASE NOTE:
    We (i.e. Ghostscript upstream) strongly urge users to upgrade
    to this latest release to avoid these issues.
  * Avoid that ps2epsi fails with
    'Error: /undefined in --setpagedevice--'
    Recent changes required to harden SAFER mode mean that
    it is no longer possible to run ps2epsi in SAFER mode,
    because it relies upon unsafe Ghostscript non-standard
    extension operators.
    Removing SAFER and DELAYSAFER, and the code to reset SAFER,
    allow ps2epsi to run as well as it ever did (ie badly).
    This program (i.e. ps2epsi) should now be considered unsafe,
    you should not use it on untrusted PostScript programs.
    Likely we (i.e. Ghostscript upstream) will deprecate and
    remove this program in future.
  For details see the News.htm and History9.htm files.
  Regarding installing packages (in particular release candidates)
  from the openSUSE build service development project "Printing"
  see https://build.opensuse.org/project/show/Printing</changelog>
  <changelog author="jsmeix@suse.de" date="1536926400">- Version upgrade to 9.25
  For the highlights in this release see the highlights in the
  9.25rc1 first release candidate for 9.25 entry below.
  PLEASE NOTE:
  We (i.e. Ghostscript upstream) strongly urge users to upgrade
  to this latest release to avoid these issues.
  For a release summary see:
  http://www.ghostscript.com/doc/9.25/News.htm
  For details see the News.htm and History9.htm files.
  The Ghostscript 9.25 release should fix (see below)
  in particular those security issues:
  * CVE-2018-15909: shading_param incomplete type checking
    https://bugs.ghostscript.com/show_bug.cgi?id=699660
    https://bugzilla.suse.com/show_bug.cgi?id=1106172 bsc#1106172
  * CVE-2018-15908: .tempfile file permission issues
    https://bugs.ghostscript.com/show_bug.cgi?id=699657
    https://bugzilla.suse.com/show_bug.cgi?id=1106171 bsc#1106171
  * CVE-2018-15910: LockDistillerParams type confusion
    https://bugs.ghostscript.com/show_bug.cgi?id=699656
    https://bugzilla.suse.com/show_bug.cgi?id=1106173 bsc#1106173
  * CVE-2018-15911: uninitialized memory access in the aesdecode
    https://bugs.ghostscript.com/show_bug.cgi?id=699665
    https://bugzilla.suse.com/show_bug.cgi?id=1106195 bsc#1106195
  * CVE-2018-16513: setcolor missing type check
    https://bugs.ghostscript.com/show_bug.cgi?id=699655
    https://bugzilla.suse.com/show_bug.cgi?id=1107412 bsc#1107412
  * CVE-2018-16509: /invalidaccess bypass after failed restore
    https://bugs.ghostscript.com/show_bug.cgi?id=699654
    https://bugzilla.suse.com/show_bug.cgi?id=1107410 bsc#1107410
  * CVE-2018-16510: Incorrect exec stack handling in the "CS"
    and "SC" PDF primitives
    https://bugs.ghostscript.com/show_bug.cgi?id=699671
    https://bugzilla.suse.com/show_bug.cgi?id=1107411 bsc#1107411
  * CVE-2018-16542: .definemodifiedfont memory corruption
    if /typecheck is handled
    https://bugs.ghostscript.com/show_bug.cgi?id=699668
    https://bugzilla.suse.com/show_bug.cgi?id=1107413 bsc#1107413
  * CVE-2018-16541 incorrect free logic in pagedevice replacement
    https://bugs.ghostscript.com/show_bug.cgi?id=699664
    https://bugzilla.suse.com/show_bug.cgi?id=1107421 bsc#1107421
  * CVE-2018-16540 use-after-free in copydevice handling
    https://bugs.ghostscript.com/show_bug.cgi?id=699661
    https://bugzilla.suse.com/show_bug.cgi?id=1107420 bsc#1107420
  * CVE-2018-16539: incorrect access checking in temp file
    handling to disclose contents of files
    https://bugs.ghostscript.com/show_bug.cgi?id=699658
    https://bugzilla.suse.com/show_bug.cgi?id=1107422 bsc#1107422
  * CVE-2018-16543: gssetresolution and gsgetresolution allow
    for unspecified impact
    https://bugs.ghostscript.com/show_bug.cgi?id=699670
    https://bugzilla.suse.com/show_bug.cgi?id=1107423 bsc#1107423
  * CVE-2018-16511: type confusion in "ztype" could be used by
    remote attackers able to supply crafted PostScript to crash
    the interpreter or possibly have unspecified other impact
    https://bugs.ghostscript.com/show_bug.cgi?id=699659
    https://bugzilla.suse.com/show_bug.cgi?id=1107426 bsc#1107426
  * CVE-2018-16585 .setdistillerkeys PostScript command is
    accepted even though it is not intended for use
    https://bugzilla.suse.com/show_bug.cgi?id=1107581 bsc#1107581
  * CVE-2018-16802: Incorrect"restoration of privilege" checking
    when running out of stack during exceptionhandling could be
    used by attackers able to supply crafted PostScript to execute
    code using the "pipe" instruction. This is due to an incomplete
    fix for CVE-2018-16509
    https://bugs.ghostscript.com/show_bug.cgi?id=699714
    https://bugs.ghostscript.com/show_bug.cgi?id=699718
    https://bugzilla.suse.com/show_bug.cgi?id=1108027 bnc#1108027
  Regarding what the above "should fix" means:
  PostScript is a general purpose Turing-complete programming
  language (cf. https://en.wikipedia.org/wiki/PostScript)
  that supports in particular file access on the system disk.
  When Ghostscript processes PostScript it runs a PostScript
  program as the user who runs Ghostscript.
  When Ghostscript processes an arbitrary PostScript file,
  the user who runs Ghostscript runs an arbitrary program
  which can do anything on the system where Ghostscript runs
  that this user is allowed to do on that system.
  To make it safer when Ghostscript runs a PostScript program
  the Ghostscript command line option '-dSAFER' disables
  certain file access functionality, for details see
  /usr/share/doc/ghostscript/9.25/Use.htm
  Its name 'SAFER' says everything: It makes it 'safer'
  to let Ghostscript run a PostScript program,
  but it does not make it completely safe.
  In theory software is safe against misuse (i.e. has no bugs).
  In practice there is an endless sequence of various kind of
  security issues (i.e. software can be misused to do more than
  what is intended) that get fixed issue by issue ad infinitum.
  In the end all that means:
  In practice the user who runs Ghostscript must not let it
  process arbitrary PostScript files from untrusted origin.
  In particular Ghostscript is usually run when printing
  documents (with the '-dSAFER' option set), see the part about
  "It is crucial to limit access to CUPS to trusted users" in
  https://en.opensuse.org/SDB:CUPS_and_SANE_Firewall_settings</changelog>
  <changelog author="jsmeix@suse.de" date="1541764800">- Version upgrade to 9.26rc1 (first release candidate for 9.26).
  Highlights in this release include:
  * Purely security and a few bug fixes, there are no new features,
    and no API changes to report.</changelog>
  <changelog author="jsmeix@suse.de" date="1543579200">- Version upgrade to 9.26
  Highlights in this release include:
  * Security issues have been the primary focus of this release,
    including solving several (well publicised) real and potential
    exploits.
    Thanks to Man Yue Mo of Semmle Security Research Team,
    Jens Mueller of Ruhr-Universitaet Bochum and
    Tavis Ormandy of Google's Project Zero
    for their help to identify specific security issues.
    PLEASE NOTE:
    We (i.e. Ghostscript upstream) strongly urge users to upgrade
    to this latest release to avoid these issues.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  For a release summary see:
  http://www.ghostscript.com/doc/9.26/News.htm
  For details see the News.htm and History9.htm files.
  The Ghostscript 9.26 release should fix (cf. the entry below
  dated 'Fri Sep 14 10:47:33 CEST 2018' what "should fix" means)
  in particular those security issues (bsc#1117331)
  * CVE-2018-19475: psi/zdevice2.c allows attackers to bypass
    intended access restrictions
    https://bugs.ghostscript.com/show_bug.cgi?id=700153
    https://bugzilla.suse.com/show_bug.cgi?id=1117327 bsc#1117327
  * CVE-2018-19476: psi/zicc.c allows attackers to bypass
    intended access restrictions because of a setcolorspace
    type confusion
    https://bugs.ghostscript.com/show_bug.cgi?id=700169
    https://bugzilla.suse.com/show_bug.cgi?id=1117313 bsc#1117313
  * CVE-2018-19477: psi/zfjbig2.c allows attackers to bypass
    intended access restrictions because of a JBIG2Decode
    type confusion
    https://bugs.ghostscript.com/show_bug.cgi?id=700168
    https://bugzilla.suse.com/show_bug.cgi?id=1117274 bsc#1117274
  * CVE-2018-19409: LockSafetyParams is not checked correctly
    if another device is used
    https://bugs.ghostscript.com/show_bug.cgi?id=700176
    https://bugzilla.suse.com/show_bug.cgi?id=1117022 bsc#1117022
  and those security issues
  * CVE-2018-18284: 1Policy operator gives access to .forceput
    https://bugs.ghostscript.com/show_bug.cgi?id=69963
    https://bugzilla.suse.com/show_bug.cgi?id=1112229 bsc#1112229
  * CVE-2018-18073: saved execution stacks can leak operator arrays
    https://bugs.ghostscript.com/show_bug.cgi?id=699927
    https://bugzilla.suse.com/show_bug.cgi?id=1111480 bsc#1111480
  * CVE-2018-17961: bypassing executeonly to escape -dSAFER sandbox
    https://bugs.ghostscript.com/show_bug.cgi?id=699816
    https://bugzilla.suse.com/show_bug.cgi?id=1111479 bsc#1111479
  * CVE-2018-17183: remote attackers could be able to supply
    crafted PostScript to potentially overwrite or replace
    error handlers to inject code
    https://bugs.ghostscript.com/show_bug.cgi?id=699708
    https://bugzilla.suse.com/show_bug.cgi?id=1109105 bsc#1109105</changelog>
  <changelog author="jsmeix@suse.de" date="1547726400">- Version upgrade to 9.26a
  The version 9.26a is a special security bugfix version to fix
  * CVE-2019-6116: subroutines within pseudo-operators
    must themselves be pseudo-operators
    https://bugs.ghostscript.com/show_bug.cgi?id=700317
    https://bugzilla.suse.com/show_bug.cgi?id=1122319 bsc#1122319</changelog>
  <changelog author="jsmeix@suse.de" date="1552996800">- CVE-2019-3838.patch fixes CVE-2019-3838
  forceput in DefineResource is still accessible
  https://bugzilla.suse.com/show_bug.cgi?id=1129186 bsc#1129186
  https://bugs.ghostscript.com/show_bug.cgi?id=700576</changelog>
  <changelog author="jsmeix@suse.de" date="1554379200">- Version upgrade to 9.27
  Highlights in this release include:
  * We (i.e. Ghostscript upstream) have extensively cleaned up
    the Postscript name space: removing access to internal and/or
    undocumented Postscript operators, procedures and data.
    This has benefits for security and maintainability.
    Incompatible changes:
    The process of "tidying" the Postscript name space should
    have removed only non-standard and undocumented operators.
    Nevertheless, it is possible that any integrations or
    utilities that rely on those non-standard and undocumented
    operators may stop working, or may change behaviour.
    If you encounter such a case, please contact us (i.e.
    Ghostscript upstream) - (either the #ghostscript IRC channel,
    or the gs-devel mailing list would be best), and we'll work
    with you to either find an alternative solution.
  * Fontmap can now reference invidual fonts in a TrueType
    Collection for font subsitution. Previously, a Fontmap entry
    could only reference a TrueType collection and use the default
    (first) font.
    Now, the Fontmap syntax allows for specifying a specific index
    in a TTC. See the comments at the top of (the default)
    Fontmap.GS for details.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  IMPORTANT: It is our intention, within the next 12 months
    (ideally sooner, in time for the next release) to make SAFER
    the default mode of operation. For many users this will have
    no effect, since they use SAFER explicitly, but some niche
    uses which rely on SAFER being disabled may need to start
    explicitly adding the "-dNOSAFER" option.
  IMPORTANT: We (i.e. Ghostscript upstream) are in the process of
    forking LittleCMS. LCMS2 is not thread safe, and cannot be made
    thread safe without breaking the ABI. Our fork will be thread
    safe, and include performance enhancements (these changes have
    all be been offered and rejected upstream). We will maintain
    compatibility between Ghostscript and LCMS2 for a time, but not
    in perpetuity. Our fork will be available as its own package
    separately from Ghostscript (and MuPDF).
  For a release summary see:
  http://www.ghostscript.com/doc/9.27/News.htm
  For details see the News.htm and History9.htm files.
  The Ghostscript 9.27 release should fix (cf. the entry below
  dated 'Fri Sep 14 10:47:33 CEST 2018' what "should fix" means)
  in particular those security issues:
  * CVE-2019-3838 forceput in DefineResource is still accessible
    https://bugzilla.suse.com/show_bug.cgi?id=1129186 bsc#1129186
    https://bugs.ghostscript.com/show_bug.cgi?id=700576
  * CVE-2019-3835: superexec operator is available
    https://bugzilla.suse.com/show_bug.cgi?id=1129180 bsc#1129180
    https://bugs.ghostscript.com/show_bug.cgi?id=700585</changelog>
  <changelog author="werner@suse.de" date="1565611200">- CVE-2019-10216.patch fixes CVE-2019-10216
  forceput/superexec in .buildfont1 is still accessible
  https://bugzilla.suse.com/show_bug.cgi?id=1144621 bsc#1144621
  https://bugs.ghostscript.com/show_bug.cgi?id=701394</changelog>
  <changelog author="werner@suse.de" date="1568376000">- Add patch openjpeg4gs-CVE-2018-6616-8ee33522.patch
  to fix bsc#1140359 for CVE-2019-12973</changelog>
  <changelog author="werner@suse.de" date="1568635200">- Add patch gs-CVE-2019-14811-885444fc.patch to fix bsc#1146882
  for CVE-2019-14811,CVE-2019-14812,CVE-2019-14813
- Add patch gs-CVE-2019-14817-cd1b1cac.patch to fix bsc#1146884
  for CVE-2019-14817</changelog>
  <changelog author="werner@suse.de" date="1568635201">- Port latest ghostscript 9.27 from factory including latest
  security patches to SLES15/SLES12
  * Port patch CVE-2019-10216.patch to 9.27 which is the orignal
    upstream commit now
  * Drop patch CVE-2019-3838.patch as now part of 9.27</changelog>
  <changelog author="jsmeix@suse.de" date="1573473600">- CVE-2019-14869.patch contains commit from Ghostscript upstream
  https://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=485904772c5f
  to fix CVE-2019-14869 "-dSAFER escape in .charkeys"
  (bsc#1156275)</changelog>
  <changelog author="jsmeix@suse.de" date="1588075200">- The version upgrade to 9.52 fixes in particular
  CVE-2020-12268: jbic2dec: heap-based buffer overflow
  in jbig2_image_compose (bsc#1170603)
- Version upgrade to 9.52
  Highlights in this release include:
  * The 9.52 release replaces the 9.51 release after a problem
    was reported with 9.51 which warranted the quick turnaround.
    Thus, like 9.51, 9.52 is primarily a maintenance release,
    consolidating the changes we introduced in 9.50.
  * IMPORTANT: We have forked LittleCMS2 into LittleCMS2mt
    (the "mt" indicating "multi-thread").
    LCMS2 is not thread-safe, and cannot be made thread-safe
    without breaking the ABI. Our fork will be thread-safe and
    include performance enhancements (these changes have all
    been offered and rejected upstream). We will maintain
    compatibility between Ghostscript and LCMS2 for a time,
    but not in perpetuity. If there is sufficient interest,
    our fork will be available as its own package separately
    from Ghostscript (and MuPDF).
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  Incompatible changes:
  * New option -dALLOWPSTRANSPARENCY: The transparency compositor
    (and related features), whilst we are improving it, remains
    sensitive to being driven correctly, and incorrect use
    can have unexpected/undefined results. Hence, as part of
    improving security, we limited access to these operators,
    originally using the -dSAFER feature. As we made "SAFER"
    the default mode, that became unacceptable, hence the
    new option -dALLOWPSTRANSPARENCY which enables access
    to the operators, cf.
    https://www.ghostscript.com/doc/9.52/Use.htm#ALLOWPSTRANSPARENCY
  For a release summary see:
  https://www.ghostscript.com/doc/9.52/News.htm
  For details see the News.htm and History9.htm files.
- Version upgrade to 9.51
  Highlights in this release include:
  * 9.51 is primarily a maintainance release, consolidating
    the changes we introduced in 9.50.
  * We have continued our work on code hygiene for this release,
    with a focus on the static analysis tool Coverity
    (from Synopsys, Inc) and we are now maintaining a policy of
    zero Coverity issues in the Ghostscript/GhostPDL source base.
  * IMPORTANT: In consultation with a representative of
    OpenPrinting (http://www.openprinting.org/) it is our
    intention to deprecate and, in the not distant future,
    remove the OpenPrinting Vector/Raster Printer Drivers
    (that is, the opvp and oprp devices).
    If you rely on either of these devices, please get in touch
    with us (i.e. Ghostscript upstream), so we can discuss your
    use case, and revise our plans accordingly.
  * We (i.e. Ghostscript upstream) are in the process of forking
    LittleCMS, cf. the other release notes entries below.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  For a release summary see:
  https://www.ghostscript.com/doc/9.51/News.htm
  For details see the News.htm and History9.htm files.
- Version upgrade to 9.50
  Highlights in this release include:
  * The change to version 9.50 follows recognition
    of the extent and importance of the file access control
    redesign/reimplementation outlined below.
  * The file access control capability (enable with -dSAFER)
    has been completely rewritten, with a ground-up rethink
    of the design. For more details, see: "SAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#Safer
  * It is important to note that -dSAFER now only enables the
    file access controls, and no longer applies restrictions
    to standard Postscript functionality (specifically,
    restrictions on setpagedevice). If your application relies
    on these Postscript restrictions, see "OLDSAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#OldSafer
    and please get in touch, as we do plan to remove those
    Postscript restrictions unless we have reason not to.
  IMPORTANT: File access controls are now enabled by default.
    In order to run Ghostscript without these controls,
    see "NOSAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#NoSafer
  * We (i.e. Ghostscript upstream) are in the process of forking
    LittleCMS, cf. the other release notes entries below.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  Incompatible changes:
  * There are a couple of subtle incompatibilities between the old
    and new SAFER implementations. Firstly, as mentioned above,
    SAFER now leaves standard Postcript functionality unchanged
    (except for the file access limitations). Secondly, the
    interaction with save/restore operations, see "SAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#Safer
  * The following is not strictly speaking new to 9.50,
    as not much has changed since 9.27 in this area,
    but for those who don't upgrade with every release:
    The process of "tidying" the Postscript name space should have
    removed only non-standard and undocumented operators.
    Nevertheless, it is possible that any integrations or utilities
    that rely on those non-standard and undocumented operators
    may stop working, or may change behaviour.
    If you encounter such a case, please contact us
    (i.e. Ghostscript upstream, either the #ghostscript IRC channel
    or the gs-devel mailing list would be best), and we'll work
    with you to either find an alternative solution or return the
    previous functionality, if there is genuinely no other option.
    One case we know this has occurred is GSView 5 (and earlier).
    GSView 5 support for PDF files relied upon internal use only
    features which are no longer available. GSView 5 will still
    work as previously for Postscript files. For PDF files,
    users are encouraged to look at MuPDF https://www.mupdf.com/
  For a release summary see:
  https://www.ghostscript.com/doc/9.50/News.htm
  For details see the News.htm and History9.htm files.
- CVE-2019-10216.patch CVE-2019-14869.patch
  gs-CVE-2019-14811-885444fc.patch
  gs-CVE-2019-14817-cd1b1cac.patch
  openjpeg4gs-CVE-2018-6616-8ee33522.patch
  are fixed in the version 9.52 upstream sources.</changelog>
  <changelog author="jsmeix@suse.de" date="1595851200">- CVE-2020-15900.patch fixes CVE-2020-15900
  Memory Corruption (SAFER Sandbox Breakout)
  cf. https://bugs.ghostscript.com/show_bug.cgi?id=702582
  (bsc#1174415)</changelog>
  <changelog author="wolfgang.frisch@suse.com" date="1619006400">- Hardening: link as position independent executable (bsc#1184123).</changelog>
  <changelog author="jsmeix@suse.de" date="1631275200">- CVE-2021-3781.patch fixes CVE-2021-3781
  Trivial -dSAFER bypass
  cf. https://bugs.ghostscript.com/show_bug.cgi?id=704342
  (bsc#1190381)</changelog>
  <changelog author="werner@suse.de" date="1632916800">- Use update-alternatives to get the real ghostscript binary from
  /usr/bin/gs to /usr/bin/gs.bin and allow the gswrap package to
  use this with its wrapper script (jira#PM-3037)</changelog>
</package>
<package pkgid="c32285ea0a163ca73dba0a1794b0cc3a33038c2754499826506ffec8ec2d7231" name="ghostscript" arch="src">
  <version epoch="0" ver="9.52" rel="158.1"/>
  <changelog author="jsmeix@suse.de" date="1521720000">- Version upgrade to 9.23
  Highlights in this release include:
  * Ghostscript now has a family of 'pdfimage' devices
    (pdfimage8, pdfimage24 and pdfimage32) which produce
    rendered output wrapped up as an image in a PDF.
    Additionally, there is a 'pclm' device which
    produces PCLm format output.
  * There is now a ColorAccuracy parameter allowing the user
    to decide between speed or accuracy in ICC color transforms.
  * JPEG Passthrough: devices which support it can now receive
    the 'raw' JPEG stream from the interpreter.
    The main use of this is the pdfwrite/ps2write family of devices
    that can now take JPEG streams from the input file(s) and write
    them unchanged to the output (thus avoiding additional
    quantization effects).
  * PDF transparency performance improvements
  * IMPORTANT: We (i.e. Ghostscript upstream) are in the process
    of forking LittleCMS.
    LCMS2 is not thread safe, and cannot be made thread safe
    without breaking the ABI. Our fork will be thread safe,
    and include performance enhancements (these changes have all
    be been offered and rejected upstream). We will maintain
    compatibility between Ghostscript and LCMS2 for a time,
    but not in perpetuity. Our fork will be available as its own
    package separately from Ghostscript (and MuPDF).
  * We have continued the focus on code hygiene in this release
    cleaning up security issues, ignored return values,
    and compiler warnings.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  Incompatible changes
  * The planned device API tidy has, unfortunately, been
    indefinitely postponed, until appropriate resources
    are available.
  For a release summary see:
  http://www.ghostscript.com/doc/9.23/News.htm
  For details see the News.htm and History9.htm files.
  See also the entries below since "Version upgrade to 9.22"
  (boo#1082896 and boo#1074266).</changelog>
  <changelog author="jsmeix@suse.de" date="1528200000">- CVE-2018-10194.patch fixes stack-based buffer overflow
  in gdevpdts.c (bsc#1090099), see
  https://bugs.ghostscript.com/show_bug.cgi?id=699255 and
  http://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=39b1e54b2968620723bf32e96764c88797714879</changelog>
  <changelog author="jsmeix@suse.de" date="1536840000">- Version upgrade to 9.24
  Highlights in this release include:
  * Security issues have been the primary focus of this release,
    including solving several (well publicised)
    real and potential exploits.
    PLEASE NOTE:
    We (i.e. Ghostscript upstream) strongly urge users to upgrade
    to this latest release to avoid these issues.
  * As well as Ghostscript itself, jbig2dec has had a significant
    amount of work improving its robustness in the face of
    out specification files.
  * IMPORTANT: We (i.e. Ghostscript upstream) are in the process
    of forking LittleCMS. LCMS2 is not thread safe, and cannot
    be made thread safe without breaking the ABI. Our fork
    will be thread safe, and include performance enhancements
    (these changes have all be been offered and rejected upstream).
    We will maintain compatibility between Ghostscript and LCMS2
    for a time, but not in perpetuity. Our fork will be available
    as its own package separately from Ghostscript (and MuPDF).
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  For a release summary see:
  http://www.ghostscript.com/doc/9.24/News.htm
  For details see the News.htm and History9.htm files.
- fix_ln_docdir_gsdatadir.patch is no longer needed
  because the issue is fixed in the upstream sources.
- CVE-2018-10194.patch is no longer needed
  because the issue is fixed in the upstream sources.</changelog>
  <changelog author="jsmeix@suse.de" date="1536840001">- Version upgrade to 9.25rc1 (first release candidate for 9.25).
  Highlights in this release include:
  * This release fixes problems with argument handling, some
    unintended results of the security fixes to the SAFER file
    access restrictions (specifically accessing ICC profile files),
    and some additional security issues over the 9.24 release.
  * Security issues have been the primary focus of this release,
    including solving several (well publicised) real
    and potential exploits.
    PLEASE NOTE:
    We (i.e. Ghostscript upstream) strongly urge users to upgrade
    to this latest release to avoid these issues.
  * Avoid that ps2epsi fails with
    'Error: /undefined in --setpagedevice--'
    Recent changes required to harden SAFER mode mean that
    it is no longer possible to run ps2epsi in SAFER mode,
    because it relies upon unsafe Ghostscript non-standard
    extension operators.
    Removing SAFER and DELAYSAFER, and the code to reset SAFER,
    allow ps2epsi to run as well as it ever did (ie badly).
    This program (i.e. ps2epsi) should now be considered unsafe,
    you should not use it on untrusted PostScript programs.
    Likely we (i.e. Ghostscript upstream) will deprecate and
    remove this program in future.
  For details see the News.htm and History9.htm files.
  Regarding installing packages (in particular release candidates)
  from the openSUSE build service development project "Printing"
  see https://build.opensuse.org/project/show/Printing</changelog>
  <changelog author="jsmeix@suse.de" date="1536926400">- Version upgrade to 9.25
  For the highlights in this release see the highlights in the
  9.25rc1 first release candidate for 9.25 entry below.
  PLEASE NOTE:
  We (i.e. Ghostscript upstream) strongly urge users to upgrade
  to this latest release to avoid these issues.
  For a release summary see:
  http://www.ghostscript.com/doc/9.25/News.htm
  For details see the News.htm and History9.htm files.
  The Ghostscript 9.25 release should fix (see below)
  in particular those security issues:
  * CVE-2018-15909: shading_param incomplete type checking
    https://bugs.ghostscript.com/show_bug.cgi?id=699660
    https://bugzilla.suse.com/show_bug.cgi?id=1106172 bsc#1106172
  * CVE-2018-15908: .tempfile file permission issues
    https://bugs.ghostscript.com/show_bug.cgi?id=699657
    https://bugzilla.suse.com/show_bug.cgi?id=1106171 bsc#1106171
  * CVE-2018-15910: LockDistillerParams type confusion
    https://bugs.ghostscript.com/show_bug.cgi?id=699656
    https://bugzilla.suse.com/show_bug.cgi?id=1106173 bsc#1106173
  * CVE-2018-15911: uninitialized memory access in the aesdecode
    https://bugs.ghostscript.com/show_bug.cgi?id=699665
    https://bugzilla.suse.com/show_bug.cgi?id=1106195 bsc#1106195
  * CVE-2018-16513: setcolor missing type check
    https://bugs.ghostscript.com/show_bug.cgi?id=699655
    https://bugzilla.suse.com/show_bug.cgi?id=1107412 bsc#1107412
  * CVE-2018-16509: /invalidaccess bypass after failed restore
    https://bugs.ghostscript.com/show_bug.cgi?id=699654
    https://bugzilla.suse.com/show_bug.cgi?id=1107410 bsc#1107410
  * CVE-2018-16510: Incorrect exec stack handling in the "CS"
    and "SC" PDF primitives
    https://bugs.ghostscript.com/show_bug.cgi?id=699671
    https://bugzilla.suse.com/show_bug.cgi?id=1107411 bsc#1107411
  * CVE-2018-16542: .definemodifiedfont memory corruption
    if /typecheck is handled
    https://bugs.ghostscript.com/show_bug.cgi?id=699668
    https://bugzilla.suse.com/show_bug.cgi?id=1107413 bsc#1107413
  * CVE-2018-16541 incorrect free logic in pagedevice replacement
    https://bugs.ghostscript.com/show_bug.cgi?id=699664
    https://bugzilla.suse.com/show_bug.cgi?id=1107421 bsc#1107421
  * CVE-2018-16540 use-after-free in copydevice handling
    https://bugs.ghostscript.com/show_bug.cgi?id=699661
    https://bugzilla.suse.com/show_bug.cgi?id=1107420 bsc#1107420
  * CVE-2018-16539: incorrect access checking in temp file
    handling to disclose contents of files
    https://bugs.ghostscript.com/show_bug.cgi?id=699658
    https://bugzilla.suse.com/show_bug.cgi?id=1107422 bsc#1107422
  * CVE-2018-16543: gssetresolution and gsgetresolution allow
    for unspecified impact
    https://bugs.ghostscript.com/show_bug.cgi?id=699670
    https://bugzilla.suse.com/show_bug.cgi?id=1107423 bsc#1107423
  * CVE-2018-16511: type confusion in "ztype" could be used by
    remote attackers able to supply crafted PostScript to crash
    the interpreter or possibly have unspecified other impact
    https://bugs.ghostscript.com/show_bug.cgi?id=699659
    https://bugzilla.suse.com/show_bug.cgi?id=1107426 bsc#1107426
  * CVE-2018-16585 .setdistillerkeys PostScript command is
    accepted even though it is not intended for use
    https://bugzilla.suse.com/show_bug.cgi?id=1107581 bsc#1107581
  * CVE-2018-16802: Incorrect"restoration of privilege" checking
    when running out of stack during exceptionhandling could be
    used by attackers able to supply crafted PostScript to execute
    code using the "pipe" instruction. This is due to an incomplete
    fix for CVE-2018-16509
    https://bugs.ghostscript.com/show_bug.cgi?id=699714
    https://bugs.ghostscript.com/show_bug.cgi?id=699718
    https://bugzilla.suse.com/show_bug.cgi?id=1108027 bnc#1108027
  Regarding what the above "should fix" means:
  PostScript is a general purpose Turing-complete programming
  language (cf. https://en.wikipedia.org/wiki/PostScript)
  that supports in particular file access on the system disk.
  When Ghostscript processes PostScript it runs a PostScript
  program as the user who runs Ghostscript.
  When Ghostscript processes an arbitrary PostScript file,
  the user who runs Ghostscript runs an arbitrary program
  which can do anything on the system where Ghostscript runs
  that this user is allowed to do on that system.
  To make it safer when Ghostscript runs a PostScript program
  the Ghostscript command line option '-dSAFER' disables
  certain file access functionality, for details see
  /usr/share/doc/ghostscript/9.25/Use.htm
  Its name 'SAFER' says everything: It makes it 'safer'
  to let Ghostscript run a PostScript program,
  but it does not make it completely safe.
  In theory software is safe against misuse (i.e. has no bugs).
  In practice there is an endless sequence of various kind of
  security issues (i.e. software can be misused to do more than
  what is intended) that get fixed issue by issue ad infinitum.
  In the end all that means:
  In practice the user who runs Ghostscript must not let it
  process arbitrary PostScript files from untrusted origin.
  In particular Ghostscript is usually run when printing
  documents (with the '-dSAFER' option set), see the part about
  "It is crucial to limit access to CUPS to trusted users" in
  https://en.opensuse.org/SDB:CUPS_and_SANE_Firewall_settings</changelog>
  <changelog author="jsmeix@suse.de" date="1541764800">- Version upgrade to 9.26rc1 (first release candidate for 9.26).
  Highlights in this release include:
  * Purely security and a few bug fixes, there are no new features,
    and no API changes to report.</changelog>
  <changelog author="jsmeix@suse.de" date="1543579200">- Version upgrade to 9.26
  Highlights in this release include:
  * Security issues have been the primary focus of this release,
    including solving several (well publicised) real and potential
    exploits.
    Thanks to Man Yue Mo of Semmle Security Research Team,
    Jens Mueller of Ruhr-Universitaet Bochum and
    Tavis Ormandy of Google's Project Zero
    for their help to identify specific security issues.
    PLEASE NOTE:
    We (i.e. Ghostscript upstream) strongly urge users to upgrade
    to this latest release to avoid these issues.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  For a release summary see:
  http://www.ghostscript.com/doc/9.26/News.htm
  For details see the News.htm and History9.htm files.
  The Ghostscript 9.26 release should fix (cf. the entry below
  dated 'Fri Sep 14 10:47:33 CEST 2018' what "should fix" means)
  in particular those security issues (bsc#1117331)
  * CVE-2018-19475: psi/zdevice2.c allows attackers to bypass
    intended access restrictions
    https://bugs.ghostscript.com/show_bug.cgi?id=700153
    https://bugzilla.suse.com/show_bug.cgi?id=1117327 bsc#1117327
  * CVE-2018-19476: psi/zicc.c allows attackers to bypass
    intended access restrictions because of a setcolorspace
    type confusion
    https://bugs.ghostscript.com/show_bug.cgi?id=700169
    https://bugzilla.suse.com/show_bug.cgi?id=1117313 bsc#1117313
  * CVE-2018-19477: psi/zfjbig2.c allows attackers to bypass
    intended access restrictions because of a JBIG2Decode
    type confusion
    https://bugs.ghostscript.com/show_bug.cgi?id=700168
    https://bugzilla.suse.com/show_bug.cgi?id=1117274 bsc#1117274
  * CVE-2018-19409: LockSafetyParams is not checked correctly
    if another device is used
    https://bugs.ghostscript.com/show_bug.cgi?id=700176
    https://bugzilla.suse.com/show_bug.cgi?id=1117022 bsc#1117022
  and those security issues
  * CVE-2018-18284: 1Policy operator gives access to .forceput
    https://bugs.ghostscript.com/show_bug.cgi?id=69963
    https://bugzilla.suse.com/show_bug.cgi?id=1112229 bsc#1112229
  * CVE-2018-18073: saved execution stacks can leak operator arrays
    https://bugs.ghostscript.com/show_bug.cgi?id=699927
    https://bugzilla.suse.com/show_bug.cgi?id=1111480 bsc#1111480
  * CVE-2018-17961: bypassing executeonly to escape -dSAFER sandbox
    https://bugs.ghostscript.com/show_bug.cgi?id=699816
    https://bugzilla.suse.com/show_bug.cgi?id=1111479 bsc#1111479
  * CVE-2018-17183: remote attackers could be able to supply
    crafted PostScript to potentially overwrite or replace
    error handlers to inject code
    https://bugs.ghostscript.com/show_bug.cgi?id=699708
    https://bugzilla.suse.com/show_bug.cgi?id=1109105 bsc#1109105</changelog>
  <changelog author="jsmeix@suse.de" date="1547726400">- Version upgrade to 9.26a
  The version 9.26a is a special security bugfix version to fix
  * CVE-2019-6116: subroutines within pseudo-operators
    must themselves be pseudo-operators
    https://bugs.ghostscript.com/show_bug.cgi?id=700317
    https://bugzilla.suse.com/show_bug.cgi?id=1122319 bsc#1122319</changelog>
  <changelog author="jsmeix@suse.de" date="1552996800">- CVE-2019-3838.patch fixes CVE-2019-3838
  forceput in DefineResource is still accessible
  https://bugzilla.suse.com/show_bug.cgi?id=1129186 bsc#1129186
  https://bugs.ghostscript.com/show_bug.cgi?id=700576</changelog>
  <changelog author="jsmeix@suse.de" date="1554379200">- Version upgrade to 9.27
  Highlights in this release include:
  * We (i.e. Ghostscript upstream) have extensively cleaned up
    the Postscript name space: removing access to internal and/or
    undocumented Postscript operators, procedures and data.
    This has benefits for security and maintainability.
    Incompatible changes:
    The process of "tidying" the Postscript name space should
    have removed only non-standard and undocumented operators.
    Nevertheless, it is possible that any integrations or
    utilities that rely on those non-standard and undocumented
    operators may stop working, or may change behaviour.
    If you encounter such a case, please contact us (i.e.
    Ghostscript upstream) - (either the #ghostscript IRC channel,
    or the gs-devel mailing list would be best), and we'll work
    with you to either find an alternative solution.
  * Fontmap can now reference invidual fonts in a TrueType
    Collection for font subsitution. Previously, a Fontmap entry
    could only reference a TrueType collection and use the default
    (first) font.
    Now, the Fontmap syntax allows for specifying a specific index
    in a TTC. See the comments at the top of (the default)
    Fontmap.GS for details.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  IMPORTANT: It is our intention, within the next 12 months
    (ideally sooner, in time for the next release) to make SAFER
    the default mode of operation. For many users this will have
    no effect, since they use SAFER explicitly, but some niche
    uses which rely on SAFER being disabled may need to start
    explicitly adding the "-dNOSAFER" option.
  IMPORTANT: We (i.e. Ghostscript upstream) are in the process of
    forking LittleCMS. LCMS2 is not thread safe, and cannot be made
    thread safe without breaking the ABI. Our fork will be thread
    safe, and include performance enhancements (these changes have
    all be been offered and rejected upstream). We will maintain
    compatibility between Ghostscript and LCMS2 for a time, but not
    in perpetuity. Our fork will be available as its own package
    separately from Ghostscript (and MuPDF).
  For a release summary see:
  http://www.ghostscript.com/doc/9.27/News.htm
  For details see the News.htm and History9.htm files.
  The Ghostscript 9.27 release should fix (cf. the entry below
  dated 'Fri Sep 14 10:47:33 CEST 2018' what "should fix" means)
  in particular those security issues:
  * CVE-2019-3838 forceput in DefineResource is still accessible
    https://bugzilla.suse.com/show_bug.cgi?id=1129186 bsc#1129186
    https://bugs.ghostscript.com/show_bug.cgi?id=700576
  * CVE-2019-3835: superexec operator is available
    https://bugzilla.suse.com/show_bug.cgi?id=1129180 bsc#1129180
    https://bugs.ghostscript.com/show_bug.cgi?id=700585</changelog>
  <changelog author="werner@suse.de" date="1565611200">- CVE-2019-10216.patch fixes CVE-2019-10216
  forceput/superexec in .buildfont1 is still accessible
  https://bugzilla.suse.com/show_bug.cgi?id=1144621 bsc#1144621
  https://bugs.ghostscript.com/show_bug.cgi?id=701394</changelog>
  <changelog author="werner@suse.de" date="1568376000">- Add patch openjpeg4gs-CVE-2018-6616-8ee33522.patch
  to fix bsc#1140359 for CVE-2019-12973</changelog>
  <changelog author="werner@suse.de" date="1568635200">- Add patch gs-CVE-2019-14811-885444fc.patch to fix bsc#1146882
  for CVE-2019-14811,CVE-2019-14812,CVE-2019-14813
- Add patch gs-CVE-2019-14817-cd1b1cac.patch to fix bsc#1146884
  for CVE-2019-14817</changelog>
  <changelog author="werner@suse.de" date="1568635201">- Port latest ghostscript 9.27 from factory including latest
  security patches to SLES15/SLES12
  * Port patch CVE-2019-10216.patch to 9.27 which is the orignal
    upstream commit now
  * Drop patch CVE-2019-3838.patch as now part of 9.27</changelog>
  <changelog author="jsmeix@suse.de" date="1573473600">- CVE-2019-14869.patch contains commit from Ghostscript upstream
  https://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=485904772c5f
  to fix CVE-2019-14869 "-dSAFER escape in .charkeys"
  (bsc#1156275)</changelog>
  <changelog author="jsmeix@suse.de" date="1588075200">- The version upgrade to 9.52 fixes in particular
  CVE-2020-12268: jbic2dec: heap-based buffer overflow
  in jbig2_image_compose (bsc#1170603)
- Version upgrade to 9.52
  Highlights in this release include:
  * The 9.52 release replaces the 9.51 release after a problem
    was reported with 9.51 which warranted the quick turnaround.
    Thus, like 9.51, 9.52 is primarily a maintenance release,
    consolidating the changes we introduced in 9.50.
  * IMPORTANT: We have forked LittleCMS2 into LittleCMS2mt
    (the "mt" indicating "multi-thread").
    LCMS2 is not thread-safe, and cannot be made thread-safe
    without breaking the ABI. Our fork will be thread-safe and
    include performance enhancements (these changes have all
    been offered and rejected upstream). We will maintain
    compatibility between Ghostscript and LCMS2 for a time,
    but not in perpetuity. If there is sufficient interest,
    our fork will be available as its own package separately
    from Ghostscript (and MuPDF).
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  Incompatible changes:
  * New option -dALLOWPSTRANSPARENCY: The transparency compositor
    (and related features), whilst we are improving it, remains
    sensitive to being driven correctly, and incorrect use
    can have unexpected/undefined results. Hence, as part of
    improving security, we limited access to these operators,
    originally using the -dSAFER feature. As we made "SAFER"
    the default mode, that became unacceptable, hence the
    new option -dALLOWPSTRANSPARENCY which enables access
    to the operators, cf.
    https://www.ghostscript.com/doc/9.52/Use.htm#ALLOWPSTRANSPARENCY
  For a release summary see:
  https://www.ghostscript.com/doc/9.52/News.htm
  For details see the News.htm and History9.htm files.
- Version upgrade to 9.51
  Highlights in this release include:
  * 9.51 is primarily a maintainance release, consolidating
    the changes we introduced in 9.50.
  * We have continued our work on code hygiene for this release,
    with a focus on the static analysis tool Coverity
    (from Synopsys, Inc) and we are now maintaining a policy of
    zero Coverity issues in the Ghostscript/GhostPDL source base.
  * IMPORTANT: In consultation with a representative of
    OpenPrinting (http://www.openprinting.org/) it is our
    intention to deprecate and, in the not distant future,
    remove the OpenPrinting Vector/Raster Printer Drivers
    (that is, the opvp and oprp devices).
    If you rely on either of these devices, please get in touch
    with us (i.e. Ghostscript upstream), so we can discuss your
    use case, and revise our plans accordingly.
  * We (i.e. Ghostscript upstream) are in the process of forking
    LittleCMS, cf. the other release notes entries below.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  For a release summary see:
  https://www.ghostscript.com/doc/9.51/News.htm
  For details see the News.htm and History9.htm files.
- Version upgrade to 9.50
  Highlights in this release include:
  * The change to version 9.50 follows recognition
    of the extent and importance of the file access control
    redesign/reimplementation outlined below.
  * The file access control capability (enable with -dSAFER)
    has been completely rewritten, with a ground-up rethink
    of the design. For more details, see: "SAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#Safer
  * It is important to note that -dSAFER now only enables the
    file access controls, and no longer applies restrictions
    to standard Postscript functionality (specifically,
    restrictions on setpagedevice). If your application relies
    on these Postscript restrictions, see "OLDSAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#OldSafer
    and please get in touch, as we do plan to remove those
    Postscript restrictions unless we have reason not to.
  IMPORTANT: File access controls are now enabled by default.
    In order to run Ghostscript without these controls,
    see "NOSAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#NoSafer
  * We (i.e. Ghostscript upstream) are in the process of forking
    LittleCMS, cf. the other release notes entries below.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  Incompatible changes:
  * There are a couple of subtle incompatibilities between the old
    and new SAFER implementations. Firstly, as mentioned above,
    SAFER now leaves standard Postcript functionality unchanged
    (except for the file access limitations). Secondly, the
    interaction with save/restore operations, see "SAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#Safer
  * The following is not strictly speaking new to 9.50,
    as not much has changed since 9.27 in this area,
    but for those who don't upgrade with every release:
    The process of "tidying" the Postscript name space should have
    removed only non-standard and undocumented operators.
    Nevertheless, it is possible that any integrations or utilities
    that rely on those non-standard and undocumented operators
    may stop working, or may change behaviour.
    If you encounter such a case, please contact us
    (i.e. Ghostscript upstream, either the #ghostscript IRC channel
    or the gs-devel mailing list would be best), and we'll work
    with you to either find an alternative solution or return the
    previous functionality, if there is genuinely no other option.
    One case we know this has occurred is GSView 5 (and earlier).
    GSView 5 support for PDF files relied upon internal use only
    features which are no longer available. GSView 5 will still
    work as previously for Postscript files. For PDF files,
    users are encouraged to look at MuPDF https://www.mupdf.com/
  For a release summary see:
  https://www.ghostscript.com/doc/9.50/News.htm
  For details see the News.htm and History9.htm files.
- CVE-2019-10216.patch CVE-2019-14869.patch
  gs-CVE-2019-14811-885444fc.patch
  gs-CVE-2019-14817-cd1b1cac.patch
  openjpeg4gs-CVE-2018-6616-8ee33522.patch
  are fixed in the version 9.52 upstream sources.</changelog>
  <changelog author="jsmeix@suse.de" date="1595851200">- CVE-2020-15900.patch fixes CVE-2020-15900
  Memory Corruption (SAFER Sandbox Breakout)
  cf. https://bugs.ghostscript.com/show_bug.cgi?id=702582
  (bsc#1174415)</changelog>
  <changelog author="wolfgang.frisch@suse.com" date="1619006400">- Hardening: link as position independent executable (bsc#1184123).</changelog>
  <changelog author="jsmeix@suse.de" date="1631275200">- CVE-2021-3781.patch fixes CVE-2021-3781
  Trivial -dSAFER bypass
  cf. https://bugs.ghostscript.com/show_bug.cgi?id=704342
  (bsc#1190381)</changelog>
  <changelog author="werner@suse.de" date="1632916800">- Use update-alternatives to get the real ghostscript binary from
  /usr/bin/gs to /usr/bin/gs.bin and allow the gswrap package to
  use this with its wrapper script (jira#PM-3037)</changelog>
</package>
<package pkgid="0737eb895095c25e55b1fcca84aea1e33d39ee3c395ec9d1c884352328934bf5" name="ghostscript" arch="x86_64">
  <version epoch="0" ver="9.52" rel="158.1"/>
  <changelog author="jsmeix@suse.de" date="1521720000">- Version upgrade to 9.23
  Highlights in this release include:
  * Ghostscript now has a family of 'pdfimage' devices
    (pdfimage8, pdfimage24 and pdfimage32) which produce
    rendered output wrapped up as an image in a PDF.
    Additionally, there is a 'pclm' device which
    produces PCLm format output.
  * There is now a ColorAccuracy parameter allowing the user
    to decide between speed or accuracy in ICC color transforms.
  * JPEG Passthrough: devices which support it can now receive
    the 'raw' JPEG stream from the interpreter.
    The main use of this is the pdfwrite/ps2write family of devices
    that can now take JPEG streams from the input file(s) and write
    them unchanged to the output (thus avoiding additional
    quantization effects).
  * PDF transparency performance improvements
  * IMPORTANT: We (i.e. Ghostscript upstream) are in the process
    of forking LittleCMS.
    LCMS2 is not thread safe, and cannot be made thread safe
    without breaking the ABI. Our fork will be thread safe,
    and include performance enhancements (these changes have all
    be been offered and rejected upstream). We will maintain
    compatibility between Ghostscript and LCMS2 for a time,
    but not in perpetuity. Our fork will be available as its own
    package separately from Ghostscript (and MuPDF).
  * We have continued the focus on code hygiene in this release
    cleaning up security issues, ignored return values,
    and compiler warnings.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  Incompatible changes
  * The planned device API tidy has, unfortunately, been
    indefinitely postponed, until appropriate resources
    are available.
  For a release summary see:
  http://www.ghostscript.com/doc/9.23/News.htm
  For details see the News.htm and History9.htm files.
  See also the entries below since "Version upgrade to 9.22"
  (boo#1082896 and boo#1074266).</changelog>
  <changelog author="jsmeix@suse.de" date="1528200000">- CVE-2018-10194.patch fixes stack-based buffer overflow
  in gdevpdts.c (bsc#1090099), see
  https://bugs.ghostscript.com/show_bug.cgi?id=699255 and
  http://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=39b1e54b2968620723bf32e96764c88797714879</changelog>
  <changelog author="jsmeix@suse.de" date="1536840000">- Version upgrade to 9.24
  Highlights in this release include:
  * Security issues have been the primary focus of this release,
    including solving several (well publicised)
    real and potential exploits.
    PLEASE NOTE:
    We (i.e. Ghostscript upstream) strongly urge users to upgrade
    to this latest release to avoid these issues.
  * As well as Ghostscript itself, jbig2dec has had a significant
    amount of work improving its robustness in the face of
    out specification files.
  * IMPORTANT: We (i.e. Ghostscript upstream) are in the process
    of forking LittleCMS. LCMS2 is not thread safe, and cannot
    be made thread safe without breaking the ABI. Our fork
    will be thread safe, and include performance enhancements
    (these changes have all be been offered and rejected upstream).
    We will maintain compatibility between Ghostscript and LCMS2
    for a time, but not in perpetuity. Our fork will be available
    as its own package separately from Ghostscript (and MuPDF).
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  For a release summary see:
  http://www.ghostscript.com/doc/9.24/News.htm
  For details see the News.htm and History9.htm files.
- fix_ln_docdir_gsdatadir.patch is no longer needed
  because the issue is fixed in the upstream sources.
- CVE-2018-10194.patch is no longer needed
  because the issue is fixed in the upstream sources.</changelog>
  <changelog author="jsmeix@suse.de" date="1536840001">- Version upgrade to 9.25rc1 (first release candidate for 9.25).
  Highlights in this release include:
  * This release fixes problems with argument handling, some
    unintended results of the security fixes to the SAFER file
    access restrictions (specifically accessing ICC profile files),
    and some additional security issues over the 9.24 release.
  * Security issues have been the primary focus of this release,
    including solving several (well publicised) real
    and potential exploits.
    PLEASE NOTE:
    We (i.e. Ghostscript upstream) strongly urge users to upgrade
    to this latest release to avoid these issues.
  * Avoid that ps2epsi fails with
    'Error: /undefined in --setpagedevice--'
    Recent changes required to harden SAFER mode mean that
    it is no longer possible to run ps2epsi in SAFER mode,
    because it relies upon unsafe Ghostscript non-standard
    extension operators.
    Removing SAFER and DELAYSAFER, and the code to reset SAFER,
    allow ps2epsi to run as well as it ever did (ie badly).
    This program (i.e. ps2epsi) should now be considered unsafe,
    you should not use it on untrusted PostScript programs.
    Likely we (i.e. Ghostscript upstream) will deprecate and
    remove this program in future.
  For details see the News.htm and History9.htm files.
  Regarding installing packages (in particular release candidates)
  from the openSUSE build service development project "Printing"
  see https://build.opensuse.org/project/show/Printing</changelog>
  <changelog author="jsmeix@suse.de" date="1536926400">- Version upgrade to 9.25
  For the highlights in this release see the highlights in the
  9.25rc1 first release candidate for 9.25 entry below.
  PLEASE NOTE:
  We (i.e. Ghostscript upstream) strongly urge users to upgrade
  to this latest release to avoid these issues.
  For a release summary see:
  http://www.ghostscript.com/doc/9.25/News.htm
  For details see the News.htm and History9.htm files.
  The Ghostscript 9.25 release should fix (see below)
  in particular those security issues:
  * CVE-2018-15909: shading_param incomplete type checking
    https://bugs.ghostscript.com/show_bug.cgi?id=699660
    https://bugzilla.suse.com/show_bug.cgi?id=1106172 bsc#1106172
  * CVE-2018-15908: .tempfile file permission issues
    https://bugs.ghostscript.com/show_bug.cgi?id=699657
    https://bugzilla.suse.com/show_bug.cgi?id=1106171 bsc#1106171
  * CVE-2018-15910: LockDistillerParams type confusion
    https://bugs.ghostscript.com/show_bug.cgi?id=699656
    https://bugzilla.suse.com/show_bug.cgi?id=1106173 bsc#1106173
  * CVE-2018-15911: uninitialized memory access in the aesdecode
    https://bugs.ghostscript.com/show_bug.cgi?id=699665
    https://bugzilla.suse.com/show_bug.cgi?id=1106195 bsc#1106195
  * CVE-2018-16513: setcolor missing type check
    https://bugs.ghostscript.com/show_bug.cgi?id=699655
    https://bugzilla.suse.com/show_bug.cgi?id=1107412 bsc#1107412
  * CVE-2018-16509: /invalidaccess bypass after failed restore
    https://bugs.ghostscript.com/show_bug.cgi?id=699654
    https://bugzilla.suse.com/show_bug.cgi?id=1107410 bsc#1107410
  * CVE-2018-16510: Incorrect exec stack handling in the "CS"
    and "SC" PDF primitives
    https://bugs.ghostscript.com/show_bug.cgi?id=699671
    https://bugzilla.suse.com/show_bug.cgi?id=1107411 bsc#1107411
  * CVE-2018-16542: .definemodifiedfont memory corruption
    if /typecheck is handled
    https://bugs.ghostscript.com/show_bug.cgi?id=699668
    https://bugzilla.suse.com/show_bug.cgi?id=1107413 bsc#1107413
  * CVE-2018-16541 incorrect free logic in pagedevice replacement
    https://bugs.ghostscript.com/show_bug.cgi?id=699664
    https://bugzilla.suse.com/show_bug.cgi?id=1107421 bsc#1107421
  * CVE-2018-16540 use-after-free in copydevice handling
    https://bugs.ghostscript.com/show_bug.cgi?id=699661
    https://bugzilla.suse.com/show_bug.cgi?id=1107420 bsc#1107420
  * CVE-2018-16539: incorrect access checking in temp file
    handling to disclose contents of files
    https://bugs.ghostscript.com/show_bug.cgi?id=699658
    https://bugzilla.suse.com/show_bug.cgi?id=1107422 bsc#1107422
  * CVE-2018-16543: gssetresolution and gsgetresolution allow
    for unspecified impact
    https://bugs.ghostscript.com/show_bug.cgi?id=699670
    https://bugzilla.suse.com/show_bug.cgi?id=1107423 bsc#1107423
  * CVE-2018-16511: type confusion in "ztype" could be used by
    remote attackers able to supply crafted PostScript to crash
    the interpreter or possibly have unspecified other impact
    https://bugs.ghostscript.com/show_bug.cgi?id=699659
    https://bugzilla.suse.com/show_bug.cgi?id=1107426 bsc#1107426
  * CVE-2018-16585 .setdistillerkeys PostScript command is
    accepted even though it is not intended for use
    https://bugzilla.suse.com/show_bug.cgi?id=1107581 bsc#1107581
  * CVE-2018-16802: Incorrect"restoration of privilege" checking
    when running out of stack during exceptionhandling could be
    used by attackers able to supply crafted PostScript to execute
    code using the "pipe" instruction. This is due to an incomplete
    fix for CVE-2018-16509
    https://bugs.ghostscript.com/show_bug.cgi?id=699714
    https://bugs.ghostscript.com/show_bug.cgi?id=699718
    https://bugzilla.suse.com/show_bug.cgi?id=1108027 bnc#1108027
  Regarding what the above "should fix" means:
  PostScript is a general purpose Turing-complete programming
  language (cf. https://en.wikipedia.org/wiki/PostScript)
  that supports in particular file access on the system disk.
  When Ghostscript processes PostScript it runs a PostScript
  program as the user who runs Ghostscript.
  When Ghostscript processes an arbitrary PostScript file,
  the user who runs Ghostscript runs an arbitrary program
  which can do anything on the system where Ghostscript runs
  that this user is allowed to do on that system.
  To make it safer when Ghostscript runs a PostScript program
  the Ghostscript command line option '-dSAFER' disables
  certain file access functionality, for details see
  /usr/share/doc/ghostscript/9.25/Use.htm
  Its name 'SAFER' says everything: It makes it 'safer'
  to let Ghostscript run a PostScript program,
  but it does not make it completely safe.
  In theory software is safe against misuse (i.e. has no bugs).
  In practice there is an endless sequence of various kind of
  security issues (i.e. software can be misused to do more than
  what is intended) that get fixed issue by issue ad infinitum.
  In the end all that means:
  In practice the user who runs Ghostscript must not let it
  process arbitrary PostScript files from untrusted origin.
  In particular Ghostscript is usually run when printing
  documents (with the '-dSAFER' option set), see the part about
  "It is crucial to limit access to CUPS to trusted users" in
  https://en.opensuse.org/SDB:CUPS_and_SANE_Firewall_settings</changelog>
  <changelog author="jsmeix@suse.de" date="1541764800">- Version upgrade to 9.26rc1 (first release candidate for 9.26).
  Highlights in this release include:
  * Purely security and a few bug fixes, there are no new features,
    and no API changes to report.</changelog>
  <changelog author="jsmeix@suse.de" date="1543579200">- Version upgrade to 9.26
  Highlights in this release include:
  * Security issues have been the primary focus of this release,
    including solving several (well publicised) real and potential
    exploits.
    Thanks to Man Yue Mo of Semmle Security Research Team,
    Jens Mueller of Ruhr-Universitaet Bochum and
    Tavis Ormandy of Google's Project Zero
    for their help to identify specific security issues.
    PLEASE NOTE:
    We (i.e. Ghostscript upstream) strongly urge users to upgrade
    to this latest release to avoid these issues.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  For a release summary see:
  http://www.ghostscript.com/doc/9.26/News.htm
  For details see the News.htm and History9.htm files.
  The Ghostscript 9.26 release should fix (cf. the entry below
  dated 'Fri Sep 14 10:47:33 CEST 2018' what "should fix" means)
  in particular those security issues (bsc#1117331)
  * CVE-2018-19475: psi/zdevice2.c allows attackers to bypass
    intended access restrictions
    https://bugs.ghostscript.com/show_bug.cgi?id=700153
    https://bugzilla.suse.com/show_bug.cgi?id=1117327 bsc#1117327
  * CVE-2018-19476: psi/zicc.c allows attackers to bypass
    intended access restrictions because of a setcolorspace
    type confusion
    https://bugs.ghostscript.com/show_bug.cgi?id=700169
    https://bugzilla.suse.com/show_bug.cgi?id=1117313 bsc#1117313
  * CVE-2018-19477: psi/zfjbig2.c allows attackers to bypass
    intended access restrictions because of a JBIG2Decode
    type confusion
    https://bugs.ghostscript.com/show_bug.cgi?id=700168
    https://bugzilla.suse.com/show_bug.cgi?id=1117274 bsc#1117274
  * CVE-2018-19409: LockSafetyParams is not checked correctly
    if another device is used
    https://bugs.ghostscript.com/show_bug.cgi?id=700176
    https://bugzilla.suse.com/show_bug.cgi?id=1117022 bsc#1117022
  and those security issues
  * CVE-2018-18284: 1Policy operator gives access to .forceput
    https://bugs.ghostscript.com/show_bug.cgi?id=69963
    https://bugzilla.suse.com/show_bug.cgi?id=1112229 bsc#1112229
  * CVE-2018-18073: saved execution stacks can leak operator arrays
    https://bugs.ghostscript.com/show_bug.cgi?id=699927
    https://bugzilla.suse.com/show_bug.cgi?id=1111480 bsc#1111480
  * CVE-2018-17961: bypassing executeonly to escape -dSAFER sandbox
    https://bugs.ghostscript.com/show_bug.cgi?id=699816
    https://bugzilla.suse.com/show_bug.cgi?id=1111479 bsc#1111479
  * CVE-2018-17183: remote attackers could be able to supply
    crafted PostScript to potentially overwrite or replace
    error handlers to inject code
    https://bugs.ghostscript.com/show_bug.cgi?id=699708
    https://bugzilla.suse.com/show_bug.cgi?id=1109105 bsc#1109105</changelog>
  <changelog author="jsmeix@suse.de" date="1547726400">- Version upgrade to 9.26a
  The version 9.26a is a special security bugfix version to fix
  * CVE-2019-6116: subroutines within pseudo-operators
    must themselves be pseudo-operators
    https://bugs.ghostscript.com/show_bug.cgi?id=700317
    https://bugzilla.suse.com/show_bug.cgi?id=1122319 bsc#1122319</changelog>
  <changelog author="jsmeix@suse.de" date="1552996800">- CVE-2019-3838.patch fixes CVE-2019-3838
  forceput in DefineResource is still accessible
  https://bugzilla.suse.com/show_bug.cgi?id=1129186 bsc#1129186
  https://bugs.ghostscript.com/show_bug.cgi?id=700576</changelog>
  <changelog author="jsmeix@suse.de" date="1554379200">- Version upgrade to 9.27
  Highlights in this release include:
  * We (i.e. Ghostscript upstream) have extensively cleaned up
    the Postscript name space: removing access to internal and/or
    undocumented Postscript operators, procedures and data.
    This has benefits for security and maintainability.
    Incompatible changes:
    The process of "tidying" the Postscript name space should
    have removed only non-standard and undocumented operators.
    Nevertheless, it is possible that any integrations or
    utilities that rely on those non-standard and undocumented
    operators may stop working, or may change behaviour.
    If you encounter such a case, please contact us (i.e.
    Ghostscript upstream) - (either the #ghostscript IRC channel,
    or the gs-devel mailing list would be best), and we'll work
    with you to either find an alternative solution.
  * Fontmap can now reference invidual fonts in a TrueType
    Collection for font subsitution. Previously, a Fontmap entry
    could only reference a TrueType collection and use the default
    (first) font.
    Now, the Fontmap syntax allows for specifying a specific index
    in a TTC. See the comments at the top of (the default)
    Fontmap.GS for details.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  IMPORTANT: It is our intention, within the next 12 months
    (ideally sooner, in time for the next release) to make SAFER
    the default mode of operation. For many users this will have
    no effect, since they use SAFER explicitly, but some niche
    uses which rely on SAFER being disabled may need to start
    explicitly adding the "-dNOSAFER" option.
  IMPORTANT: We (i.e. Ghostscript upstream) are in the process of
    forking LittleCMS. LCMS2 is not thread safe, and cannot be made
    thread safe without breaking the ABI. Our fork will be thread
    safe, and include performance enhancements (these changes have
    all be been offered and rejected upstream). We will maintain
    compatibility between Ghostscript and LCMS2 for a time, but not
    in perpetuity. Our fork will be available as its own package
    separately from Ghostscript (and MuPDF).
  For a release summary see:
  http://www.ghostscript.com/doc/9.27/News.htm
  For details see the News.htm and History9.htm files.
  The Ghostscript 9.27 release should fix (cf. the entry below
  dated 'Fri Sep 14 10:47:33 CEST 2018' what "should fix" means)
  in particular those security issues:
  * CVE-2019-3838 forceput in DefineResource is still accessible
    https://bugzilla.suse.com/show_bug.cgi?id=1129186 bsc#1129186
    https://bugs.ghostscript.com/show_bug.cgi?id=700576
  * CVE-2019-3835: superexec operator is available
    https://bugzilla.suse.com/show_bug.cgi?id=1129180 bsc#1129180
    https://bugs.ghostscript.com/show_bug.cgi?id=700585</changelog>
  <changelog author="werner@suse.de" date="1565611200">- CVE-2019-10216.patch fixes CVE-2019-10216
  forceput/superexec in .buildfont1 is still accessible
  https://bugzilla.suse.com/show_bug.cgi?id=1144621 bsc#1144621
  https://bugs.ghostscript.com/show_bug.cgi?id=701394</changelog>
  <changelog author="werner@suse.de" date="1568376000">- Add patch openjpeg4gs-CVE-2018-6616-8ee33522.patch
  to fix bsc#1140359 for CVE-2019-12973</changelog>
  <changelog author="werner@suse.de" date="1568635200">- Add patch gs-CVE-2019-14811-885444fc.patch to fix bsc#1146882
  for CVE-2019-14811,CVE-2019-14812,CVE-2019-14813
- Add patch gs-CVE-2019-14817-cd1b1cac.patch to fix bsc#1146884
  for CVE-2019-14817</changelog>
  <changelog author="werner@suse.de" date="1568635201">- Port latest ghostscript 9.27 from factory including latest
  security patches to SLES15/SLES12
  * Port patch CVE-2019-10216.patch to 9.27 which is the orignal
    upstream commit now
  * Drop patch CVE-2019-3838.patch as now part of 9.27</changelog>
  <changelog author="jsmeix@suse.de" date="1573473600">- CVE-2019-14869.patch contains commit from Ghostscript upstream
  https://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=485904772c5f
  to fix CVE-2019-14869 "-dSAFER escape in .charkeys"
  (bsc#1156275)</changelog>
  <changelog author="jsmeix@suse.de" date="1588075200">- The version upgrade to 9.52 fixes in particular
  CVE-2020-12268: jbic2dec: heap-based buffer overflow
  in jbig2_image_compose (bsc#1170603)
- Version upgrade to 9.52
  Highlights in this release include:
  * The 9.52 release replaces the 9.51 release after a problem
    was reported with 9.51 which warranted the quick turnaround.
    Thus, like 9.51, 9.52 is primarily a maintenance release,
    consolidating the changes we introduced in 9.50.
  * IMPORTANT: We have forked LittleCMS2 into LittleCMS2mt
    (the "mt" indicating "multi-thread").
    LCMS2 is not thread-safe, and cannot be made thread-safe
    without breaking the ABI. Our fork will be thread-safe and
    include performance enhancements (these changes have all
    been offered and rejected upstream). We will maintain
    compatibility between Ghostscript and LCMS2 for a time,
    but not in perpetuity. If there is sufficient interest,
    our fork will be available as its own package separately
    from Ghostscript (and MuPDF).
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  Incompatible changes:
  * New option -dALLOWPSTRANSPARENCY: The transparency compositor
    (and related features), whilst we are improving it, remains
    sensitive to being driven correctly, and incorrect use
    can have unexpected/undefined results. Hence, as part of
    improving security, we limited access to these operators,
    originally using the -dSAFER feature. As we made "SAFER"
    the default mode, that became unacceptable, hence the
    new option -dALLOWPSTRANSPARENCY which enables access
    to the operators, cf.
    https://www.ghostscript.com/doc/9.52/Use.htm#ALLOWPSTRANSPARENCY
  For a release summary see:
  https://www.ghostscript.com/doc/9.52/News.htm
  For details see the News.htm and History9.htm files.
- Version upgrade to 9.51
  Highlights in this release include:
  * 9.51 is primarily a maintainance release, consolidating
    the changes we introduced in 9.50.
  * We have continued our work on code hygiene for this release,
    with a focus on the static analysis tool Coverity
    (from Synopsys, Inc) and we are now maintaining a policy of
    zero Coverity issues in the Ghostscript/GhostPDL source base.
  * IMPORTANT: In consultation with a representative of
    OpenPrinting (http://www.openprinting.org/) it is our
    intention to deprecate and, in the not distant future,
    remove the OpenPrinting Vector/Raster Printer Drivers
    (that is, the opvp and oprp devices).
    If you rely on either of these devices, please get in touch
    with us (i.e. Ghostscript upstream), so we can discuss your
    use case, and revise our plans accordingly.
  * We (i.e. Ghostscript upstream) are in the process of forking
    LittleCMS, cf. the other release notes entries below.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  For a release summary see:
  https://www.ghostscript.com/doc/9.51/News.htm
  For details see the News.htm and History9.htm files.
- Version upgrade to 9.50
  Highlights in this release include:
  * The change to version 9.50 follows recognition
    of the extent and importance of the file access control
    redesign/reimplementation outlined below.
  * The file access control capability (enable with -dSAFER)
    has been completely rewritten, with a ground-up rethink
    of the design. For more details, see: "SAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#Safer
  * It is important to note that -dSAFER now only enables the
    file access controls, and no longer applies restrictions
    to standard Postscript functionality (specifically,
    restrictions on setpagedevice). If your application relies
    on these Postscript restrictions, see "OLDSAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#OldSafer
    and please get in touch, as we do plan to remove those
    Postscript restrictions unless we have reason not to.
  IMPORTANT: File access controls are now enabled by default.
    In order to run Ghostscript without these controls,
    see "NOSAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#NoSafer
  * We (i.e. Ghostscript upstream) are in the process of forking
    LittleCMS, cf. the other release notes entries below.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  Incompatible changes:
  * There are a couple of subtle incompatibilities between the old
    and new SAFER implementations. Firstly, as mentioned above,
    SAFER now leaves standard Postcript functionality unchanged
    (except for the file access limitations). Secondly, the
    interaction with save/restore operations, see "SAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#Safer
  * The following is not strictly speaking new to 9.50,
    as not much has changed since 9.27 in this area,
    but for those who don't upgrade with every release:
    The process of "tidying" the Postscript name space should have
    removed only non-standard and undocumented operators.
    Nevertheless, it is possible that any integrations or utilities
    that rely on those non-standard and undocumented operators
    may stop working, or may change behaviour.
    If you encounter such a case, please contact us
    (i.e. Ghostscript upstream, either the #ghostscript IRC channel
    or the gs-devel mailing list would be best), and we'll work
    with you to either find an alternative solution or return the
    previous functionality, if there is genuinely no other option.
    One case we know this has occurred is GSView 5 (and earlier).
    GSView 5 support for PDF files relied upon internal use only
    features which are no longer available. GSView 5 will still
    work as previously for Postscript files. For PDF files,
    users are encouraged to look at MuPDF https://www.mupdf.com/
  For a release summary see:
  https://www.ghostscript.com/doc/9.50/News.htm
  For details see the News.htm and History9.htm files.
- CVE-2019-10216.patch CVE-2019-14869.patch
  gs-CVE-2019-14811-885444fc.patch
  gs-CVE-2019-14817-cd1b1cac.patch
  openjpeg4gs-CVE-2018-6616-8ee33522.patch
  are fixed in the version 9.52 upstream sources.</changelog>
  <changelog author="jsmeix@suse.de" date="1595851200">- CVE-2020-15900.patch fixes CVE-2020-15900
  Memory Corruption (SAFER Sandbox Breakout)
  cf. https://bugs.ghostscript.com/show_bug.cgi?id=702582
  (bsc#1174415)</changelog>
  <changelog author="wolfgang.frisch@suse.com" date="1619006400">- Hardening: link as position independent executable (bsc#1184123).</changelog>
  <changelog author="jsmeix@suse.de" date="1631275200">- CVE-2021-3781.patch fixes CVE-2021-3781
  Trivial -dSAFER bypass
  cf. https://bugs.ghostscript.com/show_bug.cgi?id=704342
  (bsc#1190381)</changelog>
  <changelog author="werner@suse.de" date="1632916800">- Use update-alternatives to get the real ghostscript binary from
  /usr/bin/gs to /usr/bin/gs.bin and allow the gswrap package to
  use this with its wrapper script (jira#PM-3037)</changelog>
</package>
<package pkgid="67215658c0de7ff41ea6fd97b39140d42db537a579e8bd10bffb2bf805eb4e22" name="ghostscript" arch="aarch64">
  <version epoch="0" ver="9.52" rel="161.1"/>
  <changelog author="jsmeix@suse.de" date="1528200000">- CVE-2018-10194.patch fixes stack-based buffer overflow
  in gdevpdts.c (bsc#1090099), see
  https://bugs.ghostscript.com/show_bug.cgi?id=699255 and
  http://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=39b1e54b2968620723bf32e96764c88797714879</changelog>
  <changelog author="jsmeix@suse.de" date="1536840000">- Version upgrade to 9.24
  Highlights in this release include:
  * Security issues have been the primary focus of this release,
    including solving several (well publicised)
    real and potential exploits.
    PLEASE NOTE:
    We (i.e. Ghostscript upstream) strongly urge users to upgrade
    to this latest release to avoid these issues.
  * As well as Ghostscript itself, jbig2dec has had a significant
    amount of work improving its robustness in the face of
    out specification files.
  * IMPORTANT: We (i.e. Ghostscript upstream) are in the process
    of forking LittleCMS. LCMS2 is not thread safe, and cannot
    be made thread safe without breaking the ABI. Our fork
    will be thread safe, and include performance enhancements
    (these changes have all be been offered and rejected upstream).
    We will maintain compatibility between Ghostscript and LCMS2
    for a time, but not in perpetuity. Our fork will be available
    as its own package separately from Ghostscript (and MuPDF).
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  For a release summary see:
  http://www.ghostscript.com/doc/9.24/News.htm
  For details see the News.htm and History9.htm files.
- fix_ln_docdir_gsdatadir.patch is no longer needed
  because the issue is fixed in the upstream sources.
- CVE-2018-10194.patch is no longer needed
  because the issue is fixed in the upstream sources.</changelog>
  <changelog author="jsmeix@suse.de" date="1536840001">- Version upgrade to 9.25rc1 (first release candidate for 9.25).
  Highlights in this release include:
  * This release fixes problems with argument handling, some
    unintended results of the security fixes to the SAFER file
    access restrictions (specifically accessing ICC profile files),
    and some additional security issues over the 9.24 release.
  * Security issues have been the primary focus of this release,
    including solving several (well publicised) real
    and potential exploits.
    PLEASE NOTE:
    We (i.e. Ghostscript upstream) strongly urge users to upgrade
    to this latest release to avoid these issues.
  * Avoid that ps2epsi fails with
    'Error: /undefined in --setpagedevice--'
    Recent changes required to harden SAFER mode mean that
    it is no longer possible to run ps2epsi in SAFER mode,
    because it relies upon unsafe Ghostscript non-standard
    extension operators.
    Removing SAFER and DELAYSAFER, and the code to reset SAFER,
    allow ps2epsi to run as well as it ever did (ie badly).
    This program (i.e. ps2epsi) should now be considered unsafe,
    you should not use it on untrusted PostScript programs.
    Likely we (i.e. Ghostscript upstream) will deprecate and
    remove this program in future.
  For details see the News.htm and History9.htm files.
  Regarding installing packages (in particular release candidates)
  from the openSUSE build service development project "Printing"
  see https://build.opensuse.org/project/show/Printing</changelog>
  <changelog author="jsmeix@suse.de" date="1536926400">- Version upgrade to 9.25
  For the highlights in this release see the highlights in the
  9.25rc1 first release candidate for 9.25 entry below.
  PLEASE NOTE:
  We (i.e. Ghostscript upstream) strongly urge users to upgrade
  to this latest release to avoid these issues.
  For a release summary see:
  http://www.ghostscript.com/doc/9.25/News.htm
  For details see the News.htm and History9.htm files.
  The Ghostscript 9.25 release should fix (see below)
  in particular those security issues:
  * CVE-2018-15909: shading_param incomplete type checking
    https://bugs.ghostscript.com/show_bug.cgi?id=699660
    https://bugzilla.suse.com/show_bug.cgi?id=1106172 bsc#1106172
  * CVE-2018-15908: .tempfile file permission issues
    https://bugs.ghostscript.com/show_bug.cgi?id=699657
    https://bugzilla.suse.com/show_bug.cgi?id=1106171 bsc#1106171
  * CVE-2018-15910: LockDistillerParams type confusion
    https://bugs.ghostscript.com/show_bug.cgi?id=699656
    https://bugzilla.suse.com/show_bug.cgi?id=1106173 bsc#1106173
  * CVE-2018-15911: uninitialized memory access in the aesdecode
    https://bugs.ghostscript.com/show_bug.cgi?id=699665
    https://bugzilla.suse.com/show_bug.cgi?id=1106195 bsc#1106195
  * CVE-2018-16513: setcolor missing type check
    https://bugs.ghostscript.com/show_bug.cgi?id=699655
    https://bugzilla.suse.com/show_bug.cgi?id=1107412 bsc#1107412
  * CVE-2018-16509: /invalidaccess bypass after failed restore
    https://bugs.ghostscript.com/show_bug.cgi?id=699654
    https://bugzilla.suse.com/show_bug.cgi?id=1107410 bsc#1107410
  * CVE-2018-16510: Incorrect exec stack handling in the "CS"
    and "SC" PDF primitives
    https://bugs.ghostscript.com/show_bug.cgi?id=699671
    https://bugzilla.suse.com/show_bug.cgi?id=1107411 bsc#1107411
  * CVE-2018-16542: .definemodifiedfont memory corruption
    if /typecheck is handled
    https://bugs.ghostscript.com/show_bug.cgi?id=699668
    https://bugzilla.suse.com/show_bug.cgi?id=1107413 bsc#1107413
  * CVE-2018-16541 incorrect free logic in pagedevice replacement
    https://bugs.ghostscript.com/show_bug.cgi?id=699664
    https://bugzilla.suse.com/show_bug.cgi?id=1107421 bsc#1107421
  * CVE-2018-16540 use-after-free in copydevice handling
    https://bugs.ghostscript.com/show_bug.cgi?id=699661
    https://bugzilla.suse.com/show_bug.cgi?id=1107420 bsc#1107420
  * CVE-2018-16539: incorrect access checking in temp file
    handling to disclose contents of files
    https://bugs.ghostscript.com/show_bug.cgi?id=699658
    https://bugzilla.suse.com/show_bug.cgi?id=1107422 bsc#1107422
  * CVE-2018-16543: gssetresolution and gsgetresolution allow
    for unspecified impact
    https://bugs.ghostscript.com/show_bug.cgi?id=699670
    https://bugzilla.suse.com/show_bug.cgi?id=1107423 bsc#1107423
  * CVE-2018-16511: type confusion in "ztype" could be used by
    remote attackers able to supply crafted PostScript to crash
    the interpreter or possibly have unspecified other impact
    https://bugs.ghostscript.com/show_bug.cgi?id=699659
    https://bugzilla.suse.com/show_bug.cgi?id=1107426 bsc#1107426
  * CVE-2018-16585 .setdistillerkeys PostScript command is
    accepted even though it is not intended for use
    https://bugzilla.suse.com/show_bug.cgi?id=1107581 bsc#1107581
  * CVE-2018-16802: Incorrect"restoration of privilege" checking
    when running out of stack during exceptionhandling could be
    used by attackers able to supply crafted PostScript to execute
    code using the "pipe" instruction. This is due to an incomplete
    fix for CVE-2018-16509
    https://bugs.ghostscript.com/show_bug.cgi?id=699714
    https://bugs.ghostscript.com/show_bug.cgi?id=699718
    https://bugzilla.suse.com/show_bug.cgi?id=1108027 bnc#1108027
  Regarding what the above "should fix" means:
  PostScript is a general purpose Turing-complete programming
  language (cf. https://en.wikipedia.org/wiki/PostScript)
  that supports in particular file access on the system disk.
  When Ghostscript processes PostScript it runs a PostScript
  program as the user who runs Ghostscript.
  When Ghostscript processes an arbitrary PostScript file,
  the user who runs Ghostscript runs an arbitrary program
  which can do anything on the system where Ghostscript runs
  that this user is allowed to do on that system.
  To make it safer when Ghostscript runs a PostScript program
  the Ghostscript command line option '-dSAFER' disables
  certain file access functionality, for details see
  /usr/share/doc/ghostscript/9.25/Use.htm
  Its name 'SAFER' says everything: It makes it 'safer'
  to let Ghostscript run a PostScript program,
  but it does not make it completely safe.
  In theory software is safe against misuse (i.e. has no bugs).
  In practice there is an endless sequence of various kind of
  security issues (i.e. software can be misused to do more than
  what is intended) that get fixed issue by issue ad infinitum.
  In the end all that means:
  In practice the user who runs Ghostscript must not let it
  process arbitrary PostScript files from untrusted origin.
  In particular Ghostscript is usually run when printing
  documents (with the '-dSAFER' option set), see the part about
  "It is crucial to limit access to CUPS to trusted users" in
  https://en.opensuse.org/SDB:CUPS_and_SANE_Firewall_settings</changelog>
  <changelog author="jsmeix@suse.de" date="1541764800">- Version upgrade to 9.26rc1 (first release candidate for 9.26).
  Highlights in this release include:
  * Purely security and a few bug fixes, there are no new features,
    and no API changes to report.</changelog>
  <changelog author="jsmeix@suse.de" date="1543579200">- Version upgrade to 9.26
  Highlights in this release include:
  * Security issues have been the primary focus of this release,
    including solving several (well publicised) real and potential
    exploits.
    Thanks to Man Yue Mo of Semmle Security Research Team,
    Jens Mueller of Ruhr-Universitaet Bochum and
    Tavis Ormandy of Google's Project Zero
    for their help to identify specific security issues.
    PLEASE NOTE:
    We (i.e. Ghostscript upstream) strongly urge users to upgrade
    to this latest release to avoid these issues.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  For a release summary see:
  http://www.ghostscript.com/doc/9.26/News.htm
  For details see the News.htm and History9.htm files.
  The Ghostscript 9.26 release should fix (cf. the entry below
  dated 'Fri Sep 14 10:47:33 CEST 2018' what "should fix" means)
  in particular those security issues (bsc#1117331)
  * CVE-2018-19475: psi/zdevice2.c allows attackers to bypass
    intended access restrictions
    https://bugs.ghostscript.com/show_bug.cgi?id=700153
    https://bugzilla.suse.com/show_bug.cgi?id=1117327 bsc#1117327
  * CVE-2018-19476: psi/zicc.c allows attackers to bypass
    intended access restrictions because of a setcolorspace
    type confusion
    https://bugs.ghostscript.com/show_bug.cgi?id=700169
    https://bugzilla.suse.com/show_bug.cgi?id=1117313 bsc#1117313
  * CVE-2018-19477: psi/zfjbig2.c allows attackers to bypass
    intended access restrictions because of a JBIG2Decode
    type confusion
    https://bugs.ghostscript.com/show_bug.cgi?id=700168
    https://bugzilla.suse.com/show_bug.cgi?id=1117274 bsc#1117274
  * CVE-2018-19409: LockSafetyParams is not checked correctly
    if another device is used
    https://bugs.ghostscript.com/show_bug.cgi?id=700176
    https://bugzilla.suse.com/show_bug.cgi?id=1117022 bsc#1117022
  and those security issues
  * CVE-2018-18284: 1Policy operator gives access to .forceput
    https://bugs.ghostscript.com/show_bug.cgi?id=69963
    https://bugzilla.suse.com/show_bug.cgi?id=1112229 bsc#1112229
  * CVE-2018-18073: saved execution stacks can leak operator arrays
    https://bugs.ghostscript.com/show_bug.cgi?id=699927
    https://bugzilla.suse.com/show_bug.cgi?id=1111480 bsc#1111480
  * CVE-2018-17961: bypassing executeonly to escape -dSAFER sandbox
    https://bugs.ghostscript.com/show_bug.cgi?id=699816
    https://bugzilla.suse.com/show_bug.cgi?id=1111479 bsc#1111479
  * CVE-2018-17183: remote attackers could be able to supply
    crafted PostScript to potentially overwrite or replace
    error handlers to inject code
    https://bugs.ghostscript.com/show_bug.cgi?id=699708
    https://bugzilla.suse.com/show_bug.cgi?id=1109105 bsc#1109105</changelog>
  <changelog author="jsmeix@suse.de" date="1547726400">- Version upgrade to 9.26a
  The version 9.26a is a special security bugfix version to fix
  * CVE-2019-6116: subroutines within pseudo-operators
    must themselves be pseudo-operators
    https://bugs.ghostscript.com/show_bug.cgi?id=700317
    https://bugzilla.suse.com/show_bug.cgi?id=1122319 bsc#1122319</changelog>
  <changelog author="jsmeix@suse.de" date="1552996800">- CVE-2019-3838.patch fixes CVE-2019-3838
  forceput in DefineResource is still accessible
  https://bugzilla.suse.com/show_bug.cgi?id=1129186 bsc#1129186
  https://bugs.ghostscript.com/show_bug.cgi?id=700576</changelog>
  <changelog author="jsmeix@suse.de" date="1554379200">- Version upgrade to 9.27
  Highlights in this release include:
  * We (i.e. Ghostscript upstream) have extensively cleaned up
    the Postscript name space: removing access to internal and/or
    undocumented Postscript operators, procedures and data.
    This has benefits for security and maintainability.
    Incompatible changes:
    The process of "tidying" the Postscript name space should
    have removed only non-standard and undocumented operators.
    Nevertheless, it is possible that any integrations or
    utilities that rely on those non-standard and undocumented
    operators may stop working, or may change behaviour.
    If you encounter such a case, please contact us (i.e.
    Ghostscript upstream) - (either the #ghostscript IRC channel,
    or the gs-devel mailing list would be best), and we'll work
    with you to either find an alternative solution.
  * Fontmap can now reference invidual fonts in a TrueType
    Collection for font subsitution. Previously, a Fontmap entry
    could only reference a TrueType collection and use the default
    (first) font.
    Now, the Fontmap syntax allows for specifying a specific index
    in a TTC. See the comments at the top of (the default)
    Fontmap.GS for details.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  IMPORTANT: It is our intention, within the next 12 months
    (ideally sooner, in time for the next release) to make SAFER
    the default mode of operation. For many users this will have
    no effect, since they use SAFER explicitly, but some niche
    uses which rely on SAFER being disabled may need to start
    explicitly adding the "-dNOSAFER" option.
  IMPORTANT: We (i.e. Ghostscript upstream) are in the process of
    forking LittleCMS. LCMS2 is not thread safe, and cannot be made
    thread safe without breaking the ABI. Our fork will be thread
    safe, and include performance enhancements (these changes have
    all be been offered and rejected upstream). We will maintain
    compatibility between Ghostscript and LCMS2 for a time, but not
    in perpetuity. Our fork will be available as its own package
    separately from Ghostscript (and MuPDF).
  For a release summary see:
  http://www.ghostscript.com/doc/9.27/News.htm
  For details see the News.htm and History9.htm files.
  The Ghostscript 9.27 release should fix (cf. the entry below
  dated 'Fri Sep 14 10:47:33 CEST 2018' what "should fix" means)
  in particular those security issues:
  * CVE-2019-3838 forceput in DefineResource is still accessible
    https://bugzilla.suse.com/show_bug.cgi?id=1129186 bsc#1129186
    https://bugs.ghostscript.com/show_bug.cgi?id=700576
  * CVE-2019-3835: superexec operator is available
    https://bugzilla.suse.com/show_bug.cgi?id=1129180 bsc#1129180
    https://bugs.ghostscript.com/show_bug.cgi?id=700585</changelog>
  <changelog author="werner@suse.de" date="1565611200">- CVE-2019-10216.patch fixes CVE-2019-10216
  forceput/superexec in .buildfont1 is still accessible
  https://bugzilla.suse.com/show_bug.cgi?id=1144621 bsc#1144621
  https://bugs.ghostscript.com/show_bug.cgi?id=701394</changelog>
  <changelog author="werner@suse.de" date="1568376000">- Add patch openjpeg4gs-CVE-2018-6616-8ee33522.patch
  to fix bsc#1140359 for CVE-2019-12973</changelog>
  <changelog author="werner@suse.de" date="1568635200">- Add patch gs-CVE-2019-14811-885444fc.patch to fix bsc#1146882
  for CVE-2019-14811,CVE-2019-14812,CVE-2019-14813
- Add patch gs-CVE-2019-14817-cd1b1cac.patch to fix bsc#1146884
  for CVE-2019-14817</changelog>
  <changelog author="werner@suse.de" date="1568635201">- Port latest ghostscript 9.27 from factory including latest
  security patches to SLES15/SLES12
  * Port patch CVE-2019-10216.patch to 9.27 which is the orignal
    upstream commit now
  * Drop patch CVE-2019-3838.patch as now part of 9.27</changelog>
  <changelog author="jsmeix@suse.de" date="1573473600">- CVE-2019-14869.patch contains commit from Ghostscript upstream
  https://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=485904772c5f
  to fix CVE-2019-14869 "-dSAFER escape in .charkeys"
  (bsc#1156275)</changelog>
  <changelog author="jsmeix@suse.de" date="1588075200">- The version upgrade to 9.52 fixes in particular
  CVE-2020-12268: jbic2dec: heap-based buffer overflow
  in jbig2_image_compose (bsc#1170603)
- Version upgrade to 9.52
  Highlights in this release include:
  * The 9.52 release replaces the 9.51 release after a problem
    was reported with 9.51 which warranted the quick turnaround.
    Thus, like 9.51, 9.52 is primarily a maintenance release,
    consolidating the changes we introduced in 9.50.
  * IMPORTANT: We have forked LittleCMS2 into LittleCMS2mt
    (the "mt" indicating "multi-thread").
    LCMS2 is not thread-safe, and cannot be made thread-safe
    without breaking the ABI. Our fork will be thread-safe and
    include performance enhancements (these changes have all
    been offered and rejected upstream). We will maintain
    compatibility between Ghostscript and LCMS2 for a time,
    but not in perpetuity. If there is sufficient interest,
    our fork will be available as its own package separately
    from Ghostscript (and MuPDF).
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  Incompatible changes:
  * New option -dALLOWPSTRANSPARENCY: The transparency compositor
    (and related features), whilst we are improving it, remains
    sensitive to being driven correctly, and incorrect use
    can have unexpected/undefined results. Hence, as part of
    improving security, we limited access to these operators,
    originally using the -dSAFER feature. As we made "SAFER"
    the default mode, that became unacceptable, hence the
    new option -dALLOWPSTRANSPARENCY which enables access
    to the operators, cf.
    https://www.ghostscript.com/doc/9.52/Use.htm#ALLOWPSTRANSPARENCY
  For a release summary see:
  https://www.ghostscript.com/doc/9.52/News.htm
  For details see the News.htm and History9.htm files.
- Version upgrade to 9.51
  Highlights in this release include:
  * 9.51 is primarily a maintainance release, consolidating
    the changes we introduced in 9.50.
  * We have continued our work on code hygiene for this release,
    with a focus on the static analysis tool Coverity
    (from Synopsys, Inc) and we are now maintaining a policy of
    zero Coverity issues in the Ghostscript/GhostPDL source base.
  * IMPORTANT: In consultation with a representative of
    OpenPrinting (http://www.openprinting.org/) it is our
    intention to deprecate and, in the not distant future,
    remove the OpenPrinting Vector/Raster Printer Drivers
    (that is, the opvp and oprp devices).
    If you rely on either of these devices, please get in touch
    with us (i.e. Ghostscript upstream), so we can discuss your
    use case, and revise our plans accordingly.
  * We (i.e. Ghostscript upstream) are in the process of forking
    LittleCMS, cf. the other release notes entries below.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  For a release summary see:
  https://www.ghostscript.com/doc/9.51/News.htm
  For details see the News.htm and History9.htm files.
- Version upgrade to 9.50
  Highlights in this release include:
  * The change to version 9.50 follows recognition
    of the extent and importance of the file access control
    redesign/reimplementation outlined below.
  * The file access control capability (enable with -dSAFER)
    has been completely rewritten, with a ground-up rethink
    of the design. For more details, see: "SAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#Safer
  * It is important to note that -dSAFER now only enables the
    file access controls, and no longer applies restrictions
    to standard Postscript functionality (specifically,
    restrictions on setpagedevice). If your application relies
    on these Postscript restrictions, see "OLDSAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#OldSafer
    and please get in touch, as we do plan to remove those
    Postscript restrictions unless we have reason not to.
  IMPORTANT: File access controls are now enabled by default.
    In order to run Ghostscript without these controls,
    see "NOSAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#NoSafer
  * We (i.e. Ghostscript upstream) are in the process of forking
    LittleCMS, cf. the other release notes entries below.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  Incompatible changes:
  * There are a couple of subtle incompatibilities between the old
    and new SAFER implementations. Firstly, as mentioned above,
    SAFER now leaves standard Postcript functionality unchanged
    (except for the file access limitations). Secondly, the
    interaction with save/restore operations, see "SAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#Safer
  * The following is not strictly speaking new to 9.50,
    as not much has changed since 9.27 in this area,
    but for those who don't upgrade with every release:
    The process of "tidying" the Postscript name space should have
    removed only non-standard and undocumented operators.
    Nevertheless, it is possible that any integrations or utilities
    that rely on those non-standard and undocumented operators
    may stop working, or may change behaviour.
    If you encounter such a case, please contact us
    (i.e. Ghostscript upstream, either the #ghostscript IRC channel
    or the gs-devel mailing list would be best), and we'll work
    with you to either find an alternative solution or return the
    previous functionality, if there is genuinely no other option.
    One case we know this has occurred is GSView 5 (and earlier).
    GSView 5 support for PDF files relied upon internal use only
    features which are no longer available. GSView 5 will still
    work as previously for Postscript files. For PDF files,
    users are encouraged to look at MuPDF https://www.mupdf.com/
  For a release summary see:
  https://www.ghostscript.com/doc/9.50/News.htm
  For details see the News.htm and History9.htm files.
- CVE-2019-10216.patch CVE-2019-14869.patch
  gs-CVE-2019-14811-885444fc.patch
  gs-CVE-2019-14817-cd1b1cac.patch
  openjpeg4gs-CVE-2018-6616-8ee33522.patch
  are fixed in the version 9.52 upstream sources.</changelog>
  <changelog author="jsmeix@suse.de" date="1595851200">- CVE-2020-15900.patch fixes CVE-2020-15900
  Memory Corruption (SAFER Sandbox Breakout)
  cf. https://bugs.ghostscript.com/show_bug.cgi?id=702582
  (bsc#1174415)</changelog>
  <changelog author="wolfgang.frisch@suse.com" date="1619006400">- Hardening: link as position independent executable (bsc#1184123).</changelog>
  <changelog author="jsmeix@suse.de" date="1631275200">- CVE-2021-3781.patch fixes CVE-2021-3781
  Trivial -dSAFER bypass
  cf. https://bugs.ghostscript.com/show_bug.cgi?id=704342
  (bsc#1190381)</changelog>
  <changelog author="werner@suse.de" date="1632916800">- Use update-alternatives to get the real ghostscript binary from
  /usr/bin/gs to /usr/bin/gs.bin and allow the gswrap package to
  use this with its wrapper script (jira#PM-3037)</changelog>
  <changelog author="jsmeix@suse.de" date="1641902400">- CVE-2021-45944.patch fixes CVE-2021-45944
  use-after-free in sampled_data_sample
  cf. https://github.com/google/oss-fuzz-vulns/blob/main/vulns/ghostscript/OSV-2021-237.yaml
  (bsc#1194303)
- CVE-2021-45949.patch fixes CVE-2021-45949
  heap-based buffer overflow in sampled_data_finish
  cf. https://github.com/google/oss-fuzz-vulns/blob/main/vulns/ghostscript/OSV-2021-803.yaml
  (bsc#1194304)</changelog>
</package>
<package pkgid="9e3202c3d9aaa21187a6deda2b60796003de61383e614e9788956e488f496575" name="ghostscript" arch="ppc64le">
  <version epoch="0" ver="9.52" rel="161.1"/>
  <changelog author="jsmeix@suse.de" date="1528200000">- CVE-2018-10194.patch fixes stack-based buffer overflow
  in gdevpdts.c (bsc#1090099), see
  https://bugs.ghostscript.com/show_bug.cgi?id=699255 and
  http://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=39b1e54b2968620723bf32e96764c88797714879</changelog>
  <changelog author="jsmeix@suse.de" date="1536840000">- Version upgrade to 9.24
  Highlights in this release include:
  * Security issues have been the primary focus of this release,
    including solving several (well publicised)
    real and potential exploits.
    PLEASE NOTE:
    We (i.e. Ghostscript upstream) strongly urge users to upgrade
    to this latest release to avoid these issues.
  * As well as Ghostscript itself, jbig2dec has had a significant
    amount of work improving its robustness in the face of
    out specification files.
  * IMPORTANT: We (i.e. Ghostscript upstream) are in the process
    of forking LittleCMS. LCMS2 is not thread safe, and cannot
    be made thread safe without breaking the ABI. Our fork
    will be thread safe, and include performance enhancements
    (these changes have all be been offered and rejected upstream).
    We will maintain compatibility between Ghostscript and LCMS2
    for a time, but not in perpetuity. Our fork will be available
    as its own package separately from Ghostscript (and MuPDF).
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  For a release summary see:
  http://www.ghostscript.com/doc/9.24/News.htm
  For details see the News.htm and History9.htm files.
- fix_ln_docdir_gsdatadir.patch is no longer needed
  because the issue is fixed in the upstream sources.
- CVE-2018-10194.patch is no longer needed
  because the issue is fixed in the upstream sources.</changelog>
  <changelog author="jsmeix@suse.de" date="1536840001">- Version upgrade to 9.25rc1 (first release candidate for 9.25).
  Highlights in this release include:
  * This release fixes problems with argument handling, some
    unintended results of the security fixes to the SAFER file
    access restrictions (specifically accessing ICC profile files),
    and some additional security issues over the 9.24 release.
  * Security issues have been the primary focus of this release,
    including solving several (well publicised) real
    and potential exploits.
    PLEASE NOTE:
    We (i.e. Ghostscript upstream) strongly urge users to upgrade
    to this latest release to avoid these issues.
  * Avoid that ps2epsi fails with
    'Error: /undefined in --setpagedevice--'
    Recent changes required to harden SAFER mode mean that
    it is no longer possible to run ps2epsi in SAFER mode,
    because it relies upon unsafe Ghostscript non-standard
    extension operators.
    Removing SAFER and DELAYSAFER, and the code to reset SAFER,
    allow ps2epsi to run as well as it ever did (ie badly).
    This program (i.e. ps2epsi) should now be considered unsafe,
    you should not use it on untrusted PostScript programs.
    Likely we (i.e. Ghostscript upstream) will deprecate and
    remove this program in future.
  For details see the News.htm and History9.htm files.
  Regarding installing packages (in particular release candidates)
  from the openSUSE build service development project "Printing"
  see https://build.opensuse.org/project/show/Printing</changelog>
  <changelog author="jsmeix@suse.de" date="1536926400">- Version upgrade to 9.25
  For the highlights in this release see the highlights in the
  9.25rc1 first release candidate for 9.25 entry below.
  PLEASE NOTE:
  We (i.e. Ghostscript upstream) strongly urge users to upgrade
  to this latest release to avoid these issues.
  For a release summary see:
  http://www.ghostscript.com/doc/9.25/News.htm
  For details see the News.htm and History9.htm files.
  The Ghostscript 9.25 release should fix (see below)
  in particular those security issues:
  * CVE-2018-15909: shading_param incomplete type checking
    https://bugs.ghostscript.com/show_bug.cgi?id=699660
    https://bugzilla.suse.com/show_bug.cgi?id=1106172 bsc#1106172
  * CVE-2018-15908: .tempfile file permission issues
    https://bugs.ghostscript.com/show_bug.cgi?id=699657
    https://bugzilla.suse.com/show_bug.cgi?id=1106171 bsc#1106171
  * CVE-2018-15910: LockDistillerParams type confusion
    https://bugs.ghostscript.com/show_bug.cgi?id=699656
    https://bugzilla.suse.com/show_bug.cgi?id=1106173 bsc#1106173
  * CVE-2018-15911: uninitialized memory access in the aesdecode
    https://bugs.ghostscript.com/show_bug.cgi?id=699665
    https://bugzilla.suse.com/show_bug.cgi?id=1106195 bsc#1106195
  * CVE-2018-16513: setcolor missing type check
    https://bugs.ghostscript.com/show_bug.cgi?id=699655
    https://bugzilla.suse.com/show_bug.cgi?id=1107412 bsc#1107412
  * CVE-2018-16509: /invalidaccess bypass after failed restore
    https://bugs.ghostscript.com/show_bug.cgi?id=699654
    https://bugzilla.suse.com/show_bug.cgi?id=1107410 bsc#1107410
  * CVE-2018-16510: Incorrect exec stack handling in the "CS"
    and "SC" PDF primitives
    https://bugs.ghostscript.com/show_bug.cgi?id=699671
    https://bugzilla.suse.com/show_bug.cgi?id=1107411 bsc#1107411
  * CVE-2018-16542: .definemodifiedfont memory corruption
    if /typecheck is handled
    https://bugs.ghostscript.com/show_bug.cgi?id=699668
    https://bugzilla.suse.com/show_bug.cgi?id=1107413 bsc#1107413
  * CVE-2018-16541 incorrect free logic in pagedevice replacement
    https://bugs.ghostscript.com/show_bug.cgi?id=699664
    https://bugzilla.suse.com/show_bug.cgi?id=1107421 bsc#1107421
  * CVE-2018-16540 use-after-free in copydevice handling
    https://bugs.ghostscript.com/show_bug.cgi?id=699661
    https://bugzilla.suse.com/show_bug.cgi?id=1107420 bsc#1107420
  * CVE-2018-16539: incorrect access checking in temp file
    handling to disclose contents of files
    https://bugs.ghostscript.com/show_bug.cgi?id=699658
    https://bugzilla.suse.com/show_bug.cgi?id=1107422 bsc#1107422
  * CVE-2018-16543: gssetresolution and gsgetresolution allow
    for unspecified impact
    https://bugs.ghostscript.com/show_bug.cgi?id=699670
    https://bugzilla.suse.com/show_bug.cgi?id=1107423 bsc#1107423
  * CVE-2018-16511: type confusion in "ztype" could be used by
    remote attackers able to supply crafted PostScript to crash
    the interpreter or possibly have unspecified other impact
    https://bugs.ghostscript.com/show_bug.cgi?id=699659
    https://bugzilla.suse.com/show_bug.cgi?id=1107426 bsc#1107426
  * CVE-2018-16585 .setdistillerkeys PostScript command is
    accepted even though it is not intended for use
    https://bugzilla.suse.com/show_bug.cgi?id=1107581 bsc#1107581
  * CVE-2018-16802: Incorrect"restoration of privilege" checking
    when running out of stack during exceptionhandling could be
    used by attackers able to supply crafted PostScript to execute
    code using the "pipe" instruction. This is due to an incomplete
    fix for CVE-2018-16509
    https://bugs.ghostscript.com/show_bug.cgi?id=699714
    https://bugs.ghostscript.com/show_bug.cgi?id=699718
    https://bugzilla.suse.com/show_bug.cgi?id=1108027 bnc#1108027
  Regarding what the above "should fix" means:
  PostScript is a general purpose Turing-complete programming
  language (cf. https://en.wikipedia.org/wiki/PostScript)
  that supports in particular file access on the system disk.
  When Ghostscript processes PostScript it runs a PostScript
  program as the user who runs Ghostscript.
  When Ghostscript processes an arbitrary PostScript file,
  the user who runs Ghostscript runs an arbitrary program
  which can do anything on the system where Ghostscript runs
  that this user is allowed to do on that system.
  To make it safer when Ghostscript runs a PostScript program
  the Ghostscript command line option '-dSAFER' disables
  certain file access functionality, for details see
  /usr/share/doc/ghostscript/9.25/Use.htm
  Its name 'SAFER' says everything: It makes it 'safer'
  to let Ghostscript run a PostScript program,
  but it does not make it completely safe.
  In theory software is safe against misuse (i.e. has no bugs).
  In practice there is an endless sequence of various kind of
  security issues (i.e. software can be misused to do more than
  what is intended) that get fixed issue by issue ad infinitum.
  In the end all that means:
  In practice the user who runs Ghostscript must not let it
  process arbitrary PostScript files from untrusted origin.
  In particular Ghostscript is usually run when printing
  documents (with the '-dSAFER' option set), see the part about
  "It is crucial to limit access to CUPS to trusted users" in
  https://en.opensuse.org/SDB:CUPS_and_SANE_Firewall_settings</changelog>
  <changelog author="jsmeix@suse.de" date="1541764800">- Version upgrade to 9.26rc1 (first release candidate for 9.26).
  Highlights in this release include:
  * Purely security and a few bug fixes, there are no new features,
    and no API changes to report.</changelog>
  <changelog author="jsmeix@suse.de" date="1543579200">- Version upgrade to 9.26
  Highlights in this release include:
  * Security issues have been the primary focus of this release,
    including solving several (well publicised) real and potential
    exploits.
    Thanks to Man Yue Mo of Semmle Security Research Team,
    Jens Mueller of Ruhr-Universitaet Bochum and
    Tavis Ormandy of Google's Project Zero
    for their help to identify specific security issues.
    PLEASE NOTE:
    We (i.e. Ghostscript upstream) strongly urge users to upgrade
    to this latest release to avoid these issues.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  For a release summary see:
  http://www.ghostscript.com/doc/9.26/News.htm
  For details see the News.htm and History9.htm files.
  The Ghostscript 9.26 release should fix (cf. the entry below
  dated 'Fri Sep 14 10:47:33 CEST 2018' what "should fix" means)
  in particular those security issues (bsc#1117331)
  * CVE-2018-19475: psi/zdevice2.c allows attackers to bypass
    intended access restrictions
    https://bugs.ghostscript.com/show_bug.cgi?id=700153
    https://bugzilla.suse.com/show_bug.cgi?id=1117327 bsc#1117327
  * CVE-2018-19476: psi/zicc.c allows attackers to bypass
    intended access restrictions because of a setcolorspace
    type confusion
    https://bugs.ghostscript.com/show_bug.cgi?id=700169
    https://bugzilla.suse.com/show_bug.cgi?id=1117313 bsc#1117313
  * CVE-2018-19477: psi/zfjbig2.c allows attackers to bypass
    intended access restrictions because of a JBIG2Decode
    type confusion
    https://bugs.ghostscript.com/show_bug.cgi?id=700168
    https://bugzilla.suse.com/show_bug.cgi?id=1117274 bsc#1117274
  * CVE-2018-19409: LockSafetyParams is not checked correctly
    if another device is used
    https://bugs.ghostscript.com/show_bug.cgi?id=700176
    https://bugzilla.suse.com/show_bug.cgi?id=1117022 bsc#1117022
  and those security issues
  * CVE-2018-18284: 1Policy operator gives access to .forceput
    https://bugs.ghostscript.com/show_bug.cgi?id=69963
    https://bugzilla.suse.com/show_bug.cgi?id=1112229 bsc#1112229
  * CVE-2018-18073: saved execution stacks can leak operator arrays
    https://bugs.ghostscript.com/show_bug.cgi?id=699927
    https://bugzilla.suse.com/show_bug.cgi?id=1111480 bsc#1111480
  * CVE-2018-17961: bypassing executeonly to escape -dSAFER sandbox
    https://bugs.ghostscript.com/show_bug.cgi?id=699816
    https://bugzilla.suse.com/show_bug.cgi?id=1111479 bsc#1111479
  * CVE-2018-17183: remote attackers could be able to supply
    crafted PostScript to potentially overwrite or replace
    error handlers to inject code
    https://bugs.ghostscript.com/show_bug.cgi?id=699708
    https://bugzilla.suse.com/show_bug.cgi?id=1109105 bsc#1109105</changelog>
  <changelog author="jsmeix@suse.de" date="1547726400">- Version upgrade to 9.26a
  The version 9.26a is a special security bugfix version to fix
  * CVE-2019-6116: subroutines within pseudo-operators
    must themselves be pseudo-operators
    https://bugs.ghostscript.com/show_bug.cgi?id=700317
    https://bugzilla.suse.com/show_bug.cgi?id=1122319 bsc#1122319</changelog>
  <changelog author="jsmeix@suse.de" date="1552996800">- CVE-2019-3838.patch fixes CVE-2019-3838
  forceput in DefineResource is still accessible
  https://bugzilla.suse.com/show_bug.cgi?id=1129186 bsc#1129186
  https://bugs.ghostscript.com/show_bug.cgi?id=700576</changelog>
  <changelog author="jsmeix@suse.de" date="1554379200">- Version upgrade to 9.27
  Highlights in this release include:
  * We (i.e. Ghostscript upstream) have extensively cleaned up
    the Postscript name space: removing access to internal and/or
    undocumented Postscript operators, procedures and data.
    This has benefits for security and maintainability.
    Incompatible changes:
    The process of "tidying" the Postscript name space should
    have removed only non-standard and undocumented operators.
    Nevertheless, it is possible that any integrations or
    utilities that rely on those non-standard and undocumented
    operators may stop working, or may change behaviour.
    If you encounter such a case, please contact us (i.e.
    Ghostscript upstream) - (either the #ghostscript IRC channel,
    or the gs-devel mailing list would be best), and we'll work
    with you to either find an alternative solution.
  * Fontmap can now reference invidual fonts in a TrueType
    Collection for font subsitution. Previously, a Fontmap entry
    could only reference a TrueType collection and use the default
    (first) font.
    Now, the Fontmap syntax allows for specifying a specific index
    in a TTC. See the comments at the top of (the default)
    Fontmap.GS for details.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  IMPORTANT: It is our intention, within the next 12 months
    (ideally sooner, in time for the next release) to make SAFER
    the default mode of operation. For many users this will have
    no effect, since they use SAFER explicitly, but some niche
    uses which rely on SAFER being disabled may need to start
    explicitly adding the "-dNOSAFER" option.
  IMPORTANT: We (i.e. Ghostscript upstream) are in the process of
    forking LittleCMS. LCMS2 is not thread safe, and cannot be made
    thread safe without breaking the ABI. Our fork will be thread
    safe, and include performance enhancements (these changes have
    all be been offered and rejected upstream). We will maintain
    compatibility between Ghostscript and LCMS2 for a time, but not
    in perpetuity. Our fork will be available as its own package
    separately from Ghostscript (and MuPDF).
  For a release summary see:
  http://www.ghostscript.com/doc/9.27/News.htm
  For details see the News.htm and History9.htm files.
  The Ghostscript 9.27 release should fix (cf. the entry below
  dated 'Fri Sep 14 10:47:33 CEST 2018' what "should fix" means)
  in particular those security issues:
  * CVE-2019-3838 forceput in DefineResource is still accessible
    https://bugzilla.suse.com/show_bug.cgi?id=1129186 bsc#1129186
    https://bugs.ghostscript.com/show_bug.cgi?id=700576
  * CVE-2019-3835: superexec operator is available
    https://bugzilla.suse.com/show_bug.cgi?id=1129180 bsc#1129180
    https://bugs.ghostscript.com/show_bug.cgi?id=700585</changelog>
  <changelog author="werner@suse.de" date="1565611200">- CVE-2019-10216.patch fixes CVE-2019-10216
  forceput/superexec in .buildfont1 is still accessible
  https://bugzilla.suse.com/show_bug.cgi?id=1144621 bsc#1144621
  https://bugs.ghostscript.com/show_bug.cgi?id=701394</changelog>
  <changelog author="werner@suse.de" date="1568376000">- Add patch openjpeg4gs-CVE-2018-6616-8ee33522.patch
  to fix bsc#1140359 for CVE-2019-12973</changelog>
  <changelog author="werner@suse.de" date="1568635200">- Add patch gs-CVE-2019-14811-885444fc.patch to fix bsc#1146882
  for CVE-2019-14811,CVE-2019-14812,CVE-2019-14813
- Add patch gs-CVE-2019-14817-cd1b1cac.patch to fix bsc#1146884
  for CVE-2019-14817</changelog>
  <changelog author="werner@suse.de" date="1568635201">- Port latest ghostscript 9.27 from factory including latest
  security patches to SLES15/SLES12
  * Port patch CVE-2019-10216.patch to 9.27 which is the orignal
    upstream commit now
  * Drop patch CVE-2019-3838.patch as now part of 9.27</changelog>
  <changelog author="jsmeix@suse.de" date="1573473600">- CVE-2019-14869.patch contains commit from Ghostscript upstream
  https://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=485904772c5f
  to fix CVE-2019-14869 "-dSAFER escape in .charkeys"
  (bsc#1156275)</changelog>
  <changelog author="jsmeix@suse.de" date="1588075200">- The version upgrade to 9.52 fixes in particular
  CVE-2020-12268: jbic2dec: heap-based buffer overflow
  in jbig2_image_compose (bsc#1170603)
- Version upgrade to 9.52
  Highlights in this release include:
  * The 9.52 release replaces the 9.51 release after a problem
    was reported with 9.51 which warranted the quick turnaround.
    Thus, like 9.51, 9.52 is primarily a maintenance release,
    consolidating the changes we introduced in 9.50.
  * IMPORTANT: We have forked LittleCMS2 into LittleCMS2mt
    (the "mt" indicating "multi-thread").
    LCMS2 is not thread-safe, and cannot be made thread-safe
    without breaking the ABI. Our fork will be thread-safe and
    include performance enhancements (these changes have all
    been offered and rejected upstream). We will maintain
    compatibility between Ghostscript and LCMS2 for a time,
    but not in perpetuity. If there is sufficient interest,
    our fork will be available as its own package separately
    from Ghostscript (and MuPDF).
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  Incompatible changes:
  * New option -dALLOWPSTRANSPARENCY: The transparency compositor
    (and related features), whilst we are improving it, remains
    sensitive to being driven correctly, and incorrect use
    can have unexpected/undefined results. Hence, as part of
    improving security, we limited access to these operators,
    originally using the -dSAFER feature. As we made "SAFER"
    the default mode, that became unacceptable, hence the
    new option -dALLOWPSTRANSPARENCY which enables access
    to the operators, cf.
    https://www.ghostscript.com/doc/9.52/Use.htm#ALLOWPSTRANSPARENCY
  For a release summary see:
  https://www.ghostscript.com/doc/9.52/News.htm
  For details see the News.htm and History9.htm files.
- Version upgrade to 9.51
  Highlights in this release include:
  * 9.51 is primarily a maintainance release, consolidating
    the changes we introduced in 9.50.
  * We have continued our work on code hygiene for this release,
    with a focus on the static analysis tool Coverity
    (from Synopsys, Inc) and we are now maintaining a policy of
    zero Coverity issues in the Ghostscript/GhostPDL source base.
  * IMPORTANT: In consultation with a representative of
    OpenPrinting (http://www.openprinting.org/) it is our
    intention to deprecate and, in the not distant future,
    remove the OpenPrinting Vector/Raster Printer Drivers
    (that is, the opvp and oprp devices).
    If you rely on either of these devices, please get in touch
    with us (i.e. Ghostscript upstream), so we can discuss your
    use case, and revise our plans accordingly.
  * We (i.e. Ghostscript upstream) are in the process of forking
    LittleCMS, cf. the other release notes entries below.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  For a release summary see:
  https://www.ghostscript.com/doc/9.51/News.htm
  For details see the News.htm and History9.htm files.
- Version upgrade to 9.50
  Highlights in this release include:
  * The change to version 9.50 follows recognition
    of the extent and importance of the file access control
    redesign/reimplementation outlined below.
  * The file access control capability (enable with -dSAFER)
    has been completely rewritten, with a ground-up rethink
    of the design. For more details, see: "SAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#Safer
  * It is important to note that -dSAFER now only enables the
    file access controls, and no longer applies restrictions
    to standard Postscript functionality (specifically,
    restrictions on setpagedevice). If your application relies
    on these Postscript restrictions, see "OLDSAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#OldSafer
    and please get in touch, as we do plan to remove those
    Postscript restrictions unless we have reason not to.
  IMPORTANT: File access controls are now enabled by default.
    In order to run Ghostscript without these controls,
    see "NOSAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#NoSafer
  * We (i.e. Ghostscript upstream) are in the process of forking
    LittleCMS, cf. the other release notes entries below.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  Incompatible changes:
  * There are a couple of subtle incompatibilities between the old
    and new SAFER implementations. Firstly, as mentioned above,
    SAFER now leaves standard Postcript functionality unchanged
    (except for the file access limitations). Secondly, the
    interaction with save/restore operations, see "SAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#Safer
  * The following is not strictly speaking new to 9.50,
    as not much has changed since 9.27 in this area,
    but for those who don't upgrade with every release:
    The process of "tidying" the Postscript name space should have
    removed only non-standard and undocumented operators.
    Nevertheless, it is possible that any integrations or utilities
    that rely on those non-standard and undocumented operators
    may stop working, or may change behaviour.
    If you encounter such a case, please contact us
    (i.e. Ghostscript upstream, either the #ghostscript IRC channel
    or the gs-devel mailing list would be best), and we'll work
    with you to either find an alternative solution or return the
    previous functionality, if there is genuinely no other option.
    One case we know this has occurred is GSView 5 (and earlier).
    GSView 5 support for PDF files relied upon internal use only
    features which are no longer available. GSView 5 will still
    work as previously for Postscript files. For PDF files,
    users are encouraged to look at MuPDF https://www.mupdf.com/
  For a release summary see:
  https://www.ghostscript.com/doc/9.50/News.htm
  For details see the News.htm and History9.htm files.
- CVE-2019-10216.patch CVE-2019-14869.patch
  gs-CVE-2019-14811-885444fc.patch
  gs-CVE-2019-14817-cd1b1cac.patch
  openjpeg4gs-CVE-2018-6616-8ee33522.patch
  are fixed in the version 9.52 upstream sources.</changelog>
  <changelog author="jsmeix@suse.de" date="1595851200">- CVE-2020-15900.patch fixes CVE-2020-15900
  Memory Corruption (SAFER Sandbox Breakout)
  cf. https://bugs.ghostscript.com/show_bug.cgi?id=702582
  (bsc#1174415)</changelog>
  <changelog author="wolfgang.frisch@suse.com" date="1619006400">- Hardening: link as position independent executable (bsc#1184123).</changelog>
  <changelog author="jsmeix@suse.de" date="1631275200">- CVE-2021-3781.patch fixes CVE-2021-3781
  Trivial -dSAFER bypass
  cf. https://bugs.ghostscript.com/show_bug.cgi?id=704342
  (bsc#1190381)</changelog>
  <changelog author="werner@suse.de" date="1632916800">- Use update-alternatives to get the real ghostscript binary from
  /usr/bin/gs to /usr/bin/gs.bin and allow the gswrap package to
  use this with its wrapper script (jira#PM-3037)</changelog>
  <changelog author="jsmeix@suse.de" date="1641902400">- CVE-2021-45944.patch fixes CVE-2021-45944
  use-after-free in sampled_data_sample
  cf. https://github.com/google/oss-fuzz-vulns/blob/main/vulns/ghostscript/OSV-2021-237.yaml
  (bsc#1194303)
- CVE-2021-45949.patch fixes CVE-2021-45949
  heap-based buffer overflow in sampled_data_finish
  cf. https://github.com/google/oss-fuzz-vulns/blob/main/vulns/ghostscript/OSV-2021-803.yaml
  (bsc#1194304)</changelog>
</package>
<package pkgid="41f7ab6cf985ff431556be222816db70365b4303e5f16521895d56e3d62903ca" name="ghostscript" arch="s390x">
  <version epoch="0" ver="9.52" rel="161.1"/>
  <changelog author="jsmeix@suse.de" date="1528200000">- CVE-2018-10194.patch fixes stack-based buffer overflow
  in gdevpdts.c (bsc#1090099), see
  https://bugs.ghostscript.com/show_bug.cgi?id=699255 and
  http://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=39b1e54b2968620723bf32e96764c88797714879</changelog>
  <changelog author="jsmeix@suse.de" date="1536840000">- Version upgrade to 9.24
  Highlights in this release include:
  * Security issues have been the primary focus of this release,
    including solving several (well publicised)
    real and potential exploits.
    PLEASE NOTE:
    We (i.e. Ghostscript upstream) strongly urge users to upgrade
    to this latest release to avoid these issues.
  * As well as Ghostscript itself, jbig2dec has had a significant
    amount of work improving its robustness in the face of
    out specification files.
  * IMPORTANT: We (i.e. Ghostscript upstream) are in the process
    of forking LittleCMS. LCMS2 is not thread safe, and cannot
    be made thread safe without breaking the ABI. Our fork
    will be thread safe, and include performance enhancements
    (these changes have all be been offered and rejected upstream).
    We will maintain compatibility between Ghostscript and LCMS2
    for a time, but not in perpetuity. Our fork will be available
    as its own package separately from Ghostscript (and MuPDF).
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  For a release summary see:
  http://www.ghostscript.com/doc/9.24/News.htm
  For details see the News.htm and History9.htm files.
- fix_ln_docdir_gsdatadir.patch is no longer needed
  because the issue is fixed in the upstream sources.
- CVE-2018-10194.patch is no longer needed
  because the issue is fixed in the upstream sources.</changelog>
  <changelog author="jsmeix@suse.de" date="1536840001">- Version upgrade to 9.25rc1 (first release candidate for 9.25).
  Highlights in this release include:
  * This release fixes problems with argument handling, some
    unintended results of the security fixes to the SAFER file
    access restrictions (specifically accessing ICC profile files),
    and some additional security issues over the 9.24 release.
  * Security issues have been the primary focus of this release,
    including solving several (well publicised) real
    and potential exploits.
    PLEASE NOTE:
    We (i.e. Ghostscript upstream) strongly urge users to upgrade
    to this latest release to avoid these issues.
  * Avoid that ps2epsi fails with
    'Error: /undefined in --setpagedevice--'
    Recent changes required to harden SAFER mode mean that
    it is no longer possible to run ps2epsi in SAFER mode,
    because it relies upon unsafe Ghostscript non-standard
    extension operators.
    Removing SAFER and DELAYSAFER, and the code to reset SAFER,
    allow ps2epsi to run as well as it ever did (ie badly).
    This program (i.e. ps2epsi) should now be considered unsafe,
    you should not use it on untrusted PostScript programs.
    Likely we (i.e. Ghostscript upstream) will deprecate and
    remove this program in future.
  For details see the News.htm and History9.htm files.
  Regarding installing packages (in particular release candidates)
  from the openSUSE build service development project "Printing"
  see https://build.opensuse.org/project/show/Printing</changelog>
  <changelog author="jsmeix@suse.de" date="1536926400">- Version upgrade to 9.25
  For the highlights in this release see the highlights in the
  9.25rc1 first release candidate for 9.25 entry below.
  PLEASE NOTE:
  We (i.e. Ghostscript upstream) strongly urge users to upgrade
  to this latest release to avoid these issues.
  For a release summary see:
  http://www.ghostscript.com/doc/9.25/News.htm
  For details see the News.htm and History9.htm files.
  The Ghostscript 9.25 release should fix (see below)
  in particular those security issues:
  * CVE-2018-15909: shading_param incomplete type checking
    https://bugs.ghostscript.com/show_bug.cgi?id=699660
    https://bugzilla.suse.com/show_bug.cgi?id=1106172 bsc#1106172
  * CVE-2018-15908: .tempfile file permission issues
    https://bugs.ghostscript.com/show_bug.cgi?id=699657
    https://bugzilla.suse.com/show_bug.cgi?id=1106171 bsc#1106171
  * CVE-2018-15910: LockDistillerParams type confusion
    https://bugs.ghostscript.com/show_bug.cgi?id=699656
    https://bugzilla.suse.com/show_bug.cgi?id=1106173 bsc#1106173
  * CVE-2018-15911: uninitialized memory access in the aesdecode
    https://bugs.ghostscript.com/show_bug.cgi?id=699665
    https://bugzilla.suse.com/show_bug.cgi?id=1106195 bsc#1106195
  * CVE-2018-16513: setcolor missing type check
    https://bugs.ghostscript.com/show_bug.cgi?id=699655
    https://bugzilla.suse.com/show_bug.cgi?id=1107412 bsc#1107412
  * CVE-2018-16509: /invalidaccess bypass after failed restore
    https://bugs.ghostscript.com/show_bug.cgi?id=699654
    https://bugzilla.suse.com/show_bug.cgi?id=1107410 bsc#1107410
  * CVE-2018-16510: Incorrect exec stack handling in the "CS"
    and "SC" PDF primitives
    https://bugs.ghostscript.com/show_bug.cgi?id=699671
    https://bugzilla.suse.com/show_bug.cgi?id=1107411 bsc#1107411
  * CVE-2018-16542: .definemodifiedfont memory corruption
    if /typecheck is handled
    https://bugs.ghostscript.com/show_bug.cgi?id=699668
    https://bugzilla.suse.com/show_bug.cgi?id=1107413 bsc#1107413
  * CVE-2018-16541 incorrect free logic in pagedevice replacement
    https://bugs.ghostscript.com/show_bug.cgi?id=699664
    https://bugzilla.suse.com/show_bug.cgi?id=1107421 bsc#1107421
  * CVE-2018-16540 use-after-free in copydevice handling
    https://bugs.ghostscript.com/show_bug.cgi?id=699661
    https://bugzilla.suse.com/show_bug.cgi?id=1107420 bsc#1107420
  * CVE-2018-16539: incorrect access checking in temp file
    handling to disclose contents of files
    https://bugs.ghostscript.com/show_bug.cgi?id=699658
    https://bugzilla.suse.com/show_bug.cgi?id=1107422 bsc#1107422
  * CVE-2018-16543: gssetresolution and gsgetresolution allow
    for unspecified impact
    https://bugs.ghostscript.com/show_bug.cgi?id=699670
    https://bugzilla.suse.com/show_bug.cgi?id=1107423 bsc#1107423
  * CVE-2018-16511: type confusion in "ztype" could be used by
    remote attackers able to supply crafted PostScript to crash
    the interpreter or possibly have unspecified other impact
    https://bugs.ghostscript.com/show_bug.cgi?id=699659
    https://bugzilla.suse.com/show_bug.cgi?id=1107426 bsc#1107426
  * CVE-2018-16585 .setdistillerkeys PostScript command is
    accepted even though it is not intended for use
    https://bugzilla.suse.com/show_bug.cgi?id=1107581 bsc#1107581
  * CVE-2018-16802: Incorrect"restoration of privilege" checking
    when running out of stack during exceptionhandling could be
    used by attackers able to supply crafted PostScript to execute
    code using the "pipe" instruction. This is due to an incomplete
    fix for CVE-2018-16509
    https://bugs.ghostscript.com/show_bug.cgi?id=699714
    https://bugs.ghostscript.com/show_bug.cgi?id=699718
    https://bugzilla.suse.com/show_bug.cgi?id=1108027 bnc#1108027
  Regarding what the above "should fix" means:
  PostScript is a general purpose Turing-complete programming
  language (cf. https://en.wikipedia.org/wiki/PostScript)
  that supports in particular file access on the system disk.
  When Ghostscript processes PostScript it runs a PostScript
  program as the user who runs Ghostscript.
  When Ghostscript processes an arbitrary PostScript file,
  the user who runs Ghostscript runs an arbitrary program
  which can do anything on the system where Ghostscript runs
  that this user is allowed to do on that system.
  To make it safer when Ghostscript runs a PostScript program
  the Ghostscript command line option '-dSAFER' disables
  certain file access functionality, for details see
  /usr/share/doc/ghostscript/9.25/Use.htm
  Its name 'SAFER' says everything: It makes it 'safer'
  to let Ghostscript run a PostScript program,
  but it does not make it completely safe.
  In theory software is safe against misuse (i.e. has no bugs).
  In practice there is an endless sequence of various kind of
  security issues (i.e. software can be misused to do more than
  what is intended) that get fixed issue by issue ad infinitum.
  In the end all that means:
  In practice the user who runs Ghostscript must not let it
  process arbitrary PostScript files from untrusted origin.
  In particular Ghostscript is usually run when printing
  documents (with the '-dSAFER' option set), see the part about
  "It is crucial to limit access to CUPS to trusted users" in
  https://en.opensuse.org/SDB:CUPS_and_SANE_Firewall_settings</changelog>
  <changelog author="jsmeix@suse.de" date="1541764800">- Version upgrade to 9.26rc1 (first release candidate for 9.26).
  Highlights in this release include:
  * Purely security and a few bug fixes, there are no new features,
    and no API changes to report.</changelog>
  <changelog author="jsmeix@suse.de" date="1543579200">- Version upgrade to 9.26
  Highlights in this release include:
  * Security issues have been the primary focus of this release,
    including solving several (well publicised) real and potential
    exploits.
    Thanks to Man Yue Mo of Semmle Security Research Team,
    Jens Mueller of Ruhr-Universitaet Bochum and
    Tavis Ormandy of Google's Project Zero
    for their help to identify specific security issues.
    PLEASE NOTE:
    We (i.e. Ghostscript upstream) strongly urge users to upgrade
    to this latest release to avoid these issues.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  For a release summary see:
  http://www.ghostscript.com/doc/9.26/News.htm
  For details see the News.htm and History9.htm files.
  The Ghostscript 9.26 release should fix (cf. the entry below
  dated 'Fri Sep 14 10:47:33 CEST 2018' what "should fix" means)
  in particular those security issues (bsc#1117331)
  * CVE-2018-19475: psi/zdevice2.c allows attackers to bypass
    intended access restrictions
    https://bugs.ghostscript.com/show_bug.cgi?id=700153
    https://bugzilla.suse.com/show_bug.cgi?id=1117327 bsc#1117327
  * CVE-2018-19476: psi/zicc.c allows attackers to bypass
    intended access restrictions because of a setcolorspace
    type confusion
    https://bugs.ghostscript.com/show_bug.cgi?id=700169
    https://bugzilla.suse.com/show_bug.cgi?id=1117313 bsc#1117313
  * CVE-2018-19477: psi/zfjbig2.c allows attackers to bypass
    intended access restrictions because of a JBIG2Decode
    type confusion
    https://bugs.ghostscript.com/show_bug.cgi?id=700168
    https://bugzilla.suse.com/show_bug.cgi?id=1117274 bsc#1117274
  * CVE-2018-19409: LockSafetyParams is not checked correctly
    if another device is used
    https://bugs.ghostscript.com/show_bug.cgi?id=700176
    https://bugzilla.suse.com/show_bug.cgi?id=1117022 bsc#1117022
  and those security issues
  * CVE-2018-18284: 1Policy operator gives access to .forceput
    https://bugs.ghostscript.com/show_bug.cgi?id=69963
    https://bugzilla.suse.com/show_bug.cgi?id=1112229 bsc#1112229
  * CVE-2018-18073: saved execution stacks can leak operator arrays
    https://bugs.ghostscript.com/show_bug.cgi?id=699927
    https://bugzilla.suse.com/show_bug.cgi?id=1111480 bsc#1111480
  * CVE-2018-17961: bypassing executeonly to escape -dSAFER sandbox
    https://bugs.ghostscript.com/show_bug.cgi?id=699816
    https://bugzilla.suse.com/show_bug.cgi?id=1111479 bsc#1111479
  * CVE-2018-17183: remote attackers could be able to supply
    crafted PostScript to potentially overwrite or replace
    error handlers to inject code
    https://bugs.ghostscript.com/show_bug.cgi?id=699708
    https://bugzilla.suse.com/show_bug.cgi?id=1109105 bsc#1109105</changelog>
  <changelog author="jsmeix@suse.de" date="1547726400">- Version upgrade to 9.26a
  The version 9.26a is a special security bugfix version to fix
  * CVE-2019-6116: subroutines within pseudo-operators
    must themselves be pseudo-operators
    https://bugs.ghostscript.com/show_bug.cgi?id=700317
    https://bugzilla.suse.com/show_bug.cgi?id=1122319 bsc#1122319</changelog>
  <changelog author="jsmeix@suse.de" date="1552996800">- CVE-2019-3838.patch fixes CVE-2019-3838
  forceput in DefineResource is still accessible
  https://bugzilla.suse.com/show_bug.cgi?id=1129186 bsc#1129186
  https://bugs.ghostscript.com/show_bug.cgi?id=700576</changelog>
  <changelog author="jsmeix@suse.de" date="1554379200">- Version upgrade to 9.27
  Highlights in this release include:
  * We (i.e. Ghostscript upstream) have extensively cleaned up
    the Postscript name space: removing access to internal and/or
    undocumented Postscript operators, procedures and data.
    This has benefits for security and maintainability.
    Incompatible changes:
    The process of "tidying" the Postscript name space should
    have removed only non-standard and undocumented operators.
    Nevertheless, it is possible that any integrations or
    utilities that rely on those non-standard and undocumented
    operators may stop working, or may change behaviour.
    If you encounter such a case, please contact us (i.e.
    Ghostscript upstream) - (either the #ghostscript IRC channel,
    or the gs-devel mailing list would be best), and we'll work
    with you to either find an alternative solution.
  * Fontmap can now reference invidual fonts in a TrueType
    Collection for font subsitution. Previously, a Fontmap entry
    could only reference a TrueType collection and use the default
    (first) font.
    Now, the Fontmap syntax allows for specifying a specific index
    in a TTC. See the comments at the top of (the default)
    Fontmap.GS for details.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  IMPORTANT: It is our intention, within the next 12 months
    (ideally sooner, in time for the next release) to make SAFER
    the default mode of operation. For many users this will have
    no effect, since they use SAFER explicitly, but some niche
    uses which rely on SAFER being disabled may need to start
    explicitly adding the "-dNOSAFER" option.
  IMPORTANT: We (i.e. Ghostscript upstream) are in the process of
    forking LittleCMS. LCMS2 is not thread safe, and cannot be made
    thread safe without breaking the ABI. Our fork will be thread
    safe, and include performance enhancements (these changes have
    all be been offered and rejected upstream). We will maintain
    compatibility between Ghostscript and LCMS2 for a time, but not
    in perpetuity. Our fork will be available as its own package
    separately from Ghostscript (and MuPDF).
  For a release summary see:
  http://www.ghostscript.com/doc/9.27/News.htm
  For details see the News.htm and History9.htm files.
  The Ghostscript 9.27 release should fix (cf. the entry below
  dated 'Fri Sep 14 10:47:33 CEST 2018' what "should fix" means)
  in particular those security issues:
  * CVE-2019-3838 forceput in DefineResource is still accessible
    https://bugzilla.suse.com/show_bug.cgi?id=1129186 bsc#1129186
    https://bugs.ghostscript.com/show_bug.cgi?id=700576
  * CVE-2019-3835: superexec operator is available
    https://bugzilla.suse.com/show_bug.cgi?id=1129180 bsc#1129180
    https://bugs.ghostscript.com/show_bug.cgi?id=700585</changelog>
  <changelog author="werner@suse.de" date="1565611200">- CVE-2019-10216.patch fixes CVE-2019-10216
  forceput/superexec in .buildfont1 is still accessible
  https://bugzilla.suse.com/show_bug.cgi?id=1144621 bsc#1144621
  https://bugs.ghostscript.com/show_bug.cgi?id=701394</changelog>
  <changelog author="werner@suse.de" date="1568376000">- Add patch openjpeg4gs-CVE-2018-6616-8ee33522.patch
  to fix bsc#1140359 for CVE-2019-12973</changelog>
  <changelog author="werner@suse.de" date="1568635200">- Add patch gs-CVE-2019-14811-885444fc.patch to fix bsc#1146882
  for CVE-2019-14811,CVE-2019-14812,CVE-2019-14813
- Add patch gs-CVE-2019-14817-cd1b1cac.patch to fix bsc#1146884
  for CVE-2019-14817</changelog>
  <changelog author="werner@suse.de" date="1568635201">- Port latest ghostscript 9.27 from factory including latest
  security patches to SLES15/SLES12
  * Port patch CVE-2019-10216.patch to 9.27 which is the orignal
    upstream commit now
  * Drop patch CVE-2019-3838.patch as now part of 9.27</changelog>
  <changelog author="jsmeix@suse.de" date="1573473600">- CVE-2019-14869.patch contains commit from Ghostscript upstream
  https://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=485904772c5f
  to fix CVE-2019-14869 "-dSAFER escape in .charkeys"
  (bsc#1156275)</changelog>
  <changelog author="jsmeix@suse.de" date="1588075200">- The version upgrade to 9.52 fixes in particular
  CVE-2020-12268: jbic2dec: heap-based buffer overflow
  in jbig2_image_compose (bsc#1170603)
- Version upgrade to 9.52
  Highlights in this release include:
  * The 9.52 release replaces the 9.51 release after a problem
    was reported with 9.51 which warranted the quick turnaround.
    Thus, like 9.51, 9.52 is primarily a maintenance release,
    consolidating the changes we introduced in 9.50.
  * IMPORTANT: We have forked LittleCMS2 into LittleCMS2mt
    (the "mt" indicating "multi-thread").
    LCMS2 is not thread-safe, and cannot be made thread-safe
    without breaking the ABI. Our fork will be thread-safe and
    include performance enhancements (these changes have all
    been offered and rejected upstream). We will maintain
    compatibility between Ghostscript and LCMS2 for a time,
    but not in perpetuity. If there is sufficient interest,
    our fork will be available as its own package separately
    from Ghostscript (and MuPDF).
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  Incompatible changes:
  * New option -dALLOWPSTRANSPARENCY: The transparency compositor
    (and related features), whilst we are improving it, remains
    sensitive to being driven correctly, and incorrect use
    can have unexpected/undefined results. Hence, as part of
    improving security, we limited access to these operators,
    originally using the -dSAFER feature. As we made "SAFER"
    the default mode, that became unacceptable, hence the
    new option -dALLOWPSTRANSPARENCY which enables access
    to the operators, cf.
    https://www.ghostscript.com/doc/9.52/Use.htm#ALLOWPSTRANSPARENCY
  For a release summary see:
  https://www.ghostscript.com/doc/9.52/News.htm
  For details see the News.htm and History9.htm files.
- Version upgrade to 9.51
  Highlights in this release include:
  * 9.51 is primarily a maintainance release, consolidating
    the changes we introduced in 9.50.
  * We have continued our work on code hygiene for this release,
    with a focus on the static analysis tool Coverity
    (from Synopsys, Inc) and we are now maintaining a policy of
    zero Coverity issues in the Ghostscript/GhostPDL source base.
  * IMPORTANT: In consultation with a representative of
    OpenPrinting (http://www.openprinting.org/) it is our
    intention to deprecate and, in the not distant future,
    remove the OpenPrinting Vector/Raster Printer Drivers
    (that is, the opvp and oprp devices).
    If you rely on either of these devices, please get in touch
    with us (i.e. Ghostscript upstream), so we can discuss your
    use case, and revise our plans accordingly.
  * We (i.e. Ghostscript upstream) are in the process of forking
    LittleCMS, cf. the other release notes entries below.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  For a release summary see:
  https://www.ghostscript.com/doc/9.51/News.htm
  For details see the News.htm and History9.htm files.
- Version upgrade to 9.50
  Highlights in this release include:
  * The change to version 9.50 follows recognition
    of the extent and importance of the file access control
    redesign/reimplementation outlined below.
  * The file access control capability (enable with -dSAFER)
    has been completely rewritten, with a ground-up rethink
    of the design. For more details, see: "SAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#Safer
  * It is important to note that -dSAFER now only enables the
    file access controls, and no longer applies restrictions
    to standard Postscript functionality (specifically,
    restrictions on setpagedevice). If your application relies
    on these Postscript restrictions, see "OLDSAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#OldSafer
    and please get in touch, as we do plan to remove those
    Postscript restrictions unless we have reason not to.
  IMPORTANT: File access controls are now enabled by default.
    In order to run Ghostscript without these controls,
    see "NOSAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#NoSafer
  * We (i.e. Ghostscript upstream) are in the process of forking
    LittleCMS, cf. the other release notes entries below.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  Incompatible changes:
  * There are a couple of subtle incompatibilities between the old
    and new SAFER implementations. Firstly, as mentioned above,
    SAFER now leaves standard Postcript functionality unchanged
    (except for the file access limitations). Secondly, the
    interaction with save/restore operations, see "SAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#Safer
  * The following is not strictly speaking new to 9.50,
    as not much has changed since 9.27 in this area,
    but for those who don't upgrade with every release:
    The process of "tidying" the Postscript name space should have
    removed only non-standard and undocumented operators.
    Nevertheless, it is possible that any integrations or utilities
    that rely on those non-standard and undocumented operators
    may stop working, or may change behaviour.
    If you encounter such a case, please contact us
    (i.e. Ghostscript upstream, either the #ghostscript IRC channel
    or the gs-devel mailing list would be best), and we'll work
    with you to either find an alternative solution or return the
    previous functionality, if there is genuinely no other option.
    One case we know this has occurred is GSView 5 (and earlier).
    GSView 5 support for PDF files relied upon internal use only
    features which are no longer available. GSView 5 will still
    work as previously for Postscript files. For PDF files,
    users are encouraged to look at MuPDF https://www.mupdf.com/
  For a release summary see:
  https://www.ghostscript.com/doc/9.50/News.htm
  For details see the News.htm and History9.htm files.
- CVE-2019-10216.patch CVE-2019-14869.patch
  gs-CVE-2019-14811-885444fc.patch
  gs-CVE-2019-14817-cd1b1cac.patch
  openjpeg4gs-CVE-2018-6616-8ee33522.patch
  are fixed in the version 9.52 upstream sources.</changelog>
  <changelog author="jsmeix@suse.de" date="1595851200">- CVE-2020-15900.patch fixes CVE-2020-15900
  Memory Corruption (SAFER Sandbox Breakout)
  cf. https://bugs.ghostscript.com/show_bug.cgi?id=702582
  (bsc#1174415)</changelog>
  <changelog author="wolfgang.frisch@suse.com" date="1619006400">- Hardening: link as position independent executable (bsc#1184123).</changelog>
  <changelog author="jsmeix@suse.de" date="1631275200">- CVE-2021-3781.patch fixes CVE-2021-3781
  Trivial -dSAFER bypass
  cf. https://bugs.ghostscript.com/show_bug.cgi?id=704342
  (bsc#1190381)</changelog>
  <changelog author="werner@suse.de" date="1632916800">- Use update-alternatives to get the real ghostscript binary from
  /usr/bin/gs to /usr/bin/gs.bin and allow the gswrap package to
  use this with its wrapper script (jira#PM-3037)</changelog>
  <changelog author="jsmeix@suse.de" date="1641902400">- CVE-2021-45944.patch fixes CVE-2021-45944
  use-after-free in sampled_data_sample
  cf. https://github.com/google/oss-fuzz-vulns/blob/main/vulns/ghostscript/OSV-2021-237.yaml
  (bsc#1194303)
- CVE-2021-45949.patch fixes CVE-2021-45949
  heap-based buffer overflow in sampled_data_finish
  cf. https://github.com/google/oss-fuzz-vulns/blob/main/vulns/ghostscript/OSV-2021-803.yaml
  (bsc#1194304)</changelog>
</package>
<package pkgid="64317f2ee95fd8bbe94aec494b37092e1f66df32ebe14bca0d0e3c647a9b29f1" name="ghostscript" arch="src">
  <version epoch="0" ver="9.52" rel="161.1"/>
  <changelog author="jsmeix@suse.de" date="1528200000">- CVE-2018-10194.patch fixes stack-based buffer overflow
  in gdevpdts.c (bsc#1090099), see
  https://bugs.ghostscript.com/show_bug.cgi?id=699255 and
  http://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=39b1e54b2968620723bf32e96764c88797714879</changelog>
  <changelog author="jsmeix@suse.de" date="1536840000">- Version upgrade to 9.24
  Highlights in this release include:
  * Security issues have been the primary focus of this release,
    including solving several (well publicised)
    real and potential exploits.
    PLEASE NOTE:
    We (i.e. Ghostscript upstream) strongly urge users to upgrade
    to this latest release to avoid these issues.
  * As well as Ghostscript itself, jbig2dec has had a significant
    amount of work improving its robustness in the face of
    out specification files.
  * IMPORTANT: We (i.e. Ghostscript upstream) are in the process
    of forking LittleCMS. LCMS2 is not thread safe, and cannot
    be made thread safe without breaking the ABI. Our fork
    will be thread safe, and include performance enhancements
    (these changes have all be been offered and rejected upstream).
    We will maintain compatibility between Ghostscript and LCMS2
    for a time, but not in perpetuity. Our fork will be available
    as its own package separately from Ghostscript (and MuPDF).
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  For a release summary see:
  http://www.ghostscript.com/doc/9.24/News.htm
  For details see the News.htm and History9.htm files.
- fix_ln_docdir_gsdatadir.patch is no longer needed
  because the issue is fixed in the upstream sources.
- CVE-2018-10194.patch is no longer needed
  because the issue is fixed in the upstream sources.</changelog>
  <changelog author="jsmeix@suse.de" date="1536840001">- Version upgrade to 9.25rc1 (first release candidate for 9.25).
  Highlights in this release include:
  * This release fixes problems with argument handling, some
    unintended results of the security fixes to the SAFER file
    access restrictions (specifically accessing ICC profile files),
    and some additional security issues over the 9.24 release.
  * Security issues have been the primary focus of this release,
    including solving several (well publicised) real
    and potential exploits.
    PLEASE NOTE:
    We (i.e. Ghostscript upstream) strongly urge users to upgrade
    to this latest release to avoid these issues.
  * Avoid that ps2epsi fails with
    'Error: /undefined in --setpagedevice--'
    Recent changes required to harden SAFER mode mean that
    it is no longer possible to run ps2epsi in SAFER mode,
    because it relies upon unsafe Ghostscript non-standard
    extension operators.
    Removing SAFER and DELAYSAFER, and the code to reset SAFER,
    allow ps2epsi to run as well as it ever did (ie badly).
    This program (i.e. ps2epsi) should now be considered unsafe,
    you should not use it on untrusted PostScript programs.
    Likely we (i.e. Ghostscript upstream) will deprecate and
    remove this program in future.
  For details see the News.htm and History9.htm files.
  Regarding installing packages (in particular release candidates)
  from the openSUSE build service development project "Printing"
  see https://build.opensuse.org/project/show/Printing</changelog>
  <changelog author="jsmeix@suse.de" date="1536926400">- Version upgrade to 9.25
  For the highlights in this release see the highlights in the
  9.25rc1 first release candidate for 9.25 entry below.
  PLEASE NOTE:
  We (i.e. Ghostscript upstream) strongly urge users to upgrade
  to this latest release to avoid these issues.
  For a release summary see:
  http://www.ghostscript.com/doc/9.25/News.htm
  For details see the News.htm and History9.htm files.
  The Ghostscript 9.25 release should fix (see below)
  in particular those security issues:
  * CVE-2018-15909: shading_param incomplete type checking
    https://bugs.ghostscript.com/show_bug.cgi?id=699660
    https://bugzilla.suse.com/show_bug.cgi?id=1106172 bsc#1106172
  * CVE-2018-15908: .tempfile file permission issues
    https://bugs.ghostscript.com/show_bug.cgi?id=699657
    https://bugzilla.suse.com/show_bug.cgi?id=1106171 bsc#1106171
  * CVE-2018-15910: LockDistillerParams type confusion
    https://bugs.ghostscript.com/show_bug.cgi?id=699656
    https://bugzilla.suse.com/show_bug.cgi?id=1106173 bsc#1106173
  * CVE-2018-15911: uninitialized memory access in the aesdecode
    https://bugs.ghostscript.com/show_bug.cgi?id=699665
    https://bugzilla.suse.com/show_bug.cgi?id=1106195 bsc#1106195
  * CVE-2018-16513: setcolor missing type check
    https://bugs.ghostscript.com/show_bug.cgi?id=699655
    https://bugzilla.suse.com/show_bug.cgi?id=1107412 bsc#1107412
  * CVE-2018-16509: /invalidaccess bypass after failed restore
    https://bugs.ghostscript.com/show_bug.cgi?id=699654
    https://bugzilla.suse.com/show_bug.cgi?id=1107410 bsc#1107410
  * CVE-2018-16510: Incorrect exec stack handling in the "CS"
    and "SC" PDF primitives
    https://bugs.ghostscript.com/show_bug.cgi?id=699671
    https://bugzilla.suse.com/show_bug.cgi?id=1107411 bsc#1107411
  * CVE-2018-16542: .definemodifiedfont memory corruption
    if /typecheck is handled
    https://bugs.ghostscript.com/show_bug.cgi?id=699668
    https://bugzilla.suse.com/show_bug.cgi?id=1107413 bsc#1107413
  * CVE-2018-16541 incorrect free logic in pagedevice replacement
    https://bugs.ghostscript.com/show_bug.cgi?id=699664
    https://bugzilla.suse.com/show_bug.cgi?id=1107421 bsc#1107421
  * CVE-2018-16540 use-after-free in copydevice handling
    https://bugs.ghostscript.com/show_bug.cgi?id=699661
    https://bugzilla.suse.com/show_bug.cgi?id=1107420 bsc#1107420
  * CVE-2018-16539: incorrect access checking in temp file
    handling to disclose contents of files
    https://bugs.ghostscript.com/show_bug.cgi?id=699658
    https://bugzilla.suse.com/show_bug.cgi?id=1107422 bsc#1107422
  * CVE-2018-16543: gssetresolution and gsgetresolution allow
    for unspecified impact
    https://bugs.ghostscript.com/show_bug.cgi?id=699670
    https://bugzilla.suse.com/show_bug.cgi?id=1107423 bsc#1107423
  * CVE-2018-16511: type confusion in "ztype" could be used by
    remote attackers able to supply crafted PostScript to crash
    the interpreter or possibly have unspecified other impact
    https://bugs.ghostscript.com/show_bug.cgi?id=699659
    https://bugzilla.suse.com/show_bug.cgi?id=1107426 bsc#1107426
  * CVE-2018-16585 .setdistillerkeys PostScript command is
    accepted even though it is not intended for use
    https://bugzilla.suse.com/show_bug.cgi?id=1107581 bsc#1107581
  * CVE-2018-16802: Incorrect"restoration of privilege" checking
    when running out of stack during exceptionhandling could be
    used by attackers able to supply crafted PostScript to execute
    code using the "pipe" instruction. This is due to an incomplete
    fix for CVE-2018-16509
    https://bugs.ghostscript.com/show_bug.cgi?id=699714
    https://bugs.ghostscript.com/show_bug.cgi?id=699718
    https://bugzilla.suse.com/show_bug.cgi?id=1108027 bnc#1108027
  Regarding what the above "should fix" means:
  PostScript is a general purpose Turing-complete programming
  language (cf. https://en.wikipedia.org/wiki/PostScript)
  that supports in particular file access on the system disk.
  When Ghostscript processes PostScript it runs a PostScript
  program as the user who runs Ghostscript.
  When Ghostscript processes an arbitrary PostScript file,
  the user who runs Ghostscript runs an arbitrary program
  which can do anything on the system where Ghostscript runs
  that this user is allowed to do on that system.
  To make it safer when Ghostscript runs a PostScript program
  the Ghostscript command line option '-dSAFER' disables
  certain file access functionality, for details see
  /usr/share/doc/ghostscript/9.25/Use.htm
  Its name 'SAFER' says everything: It makes it 'safer'
  to let Ghostscript run a PostScript program,
  but it does not make it completely safe.
  In theory software is safe against misuse (i.e. has no bugs).
  In practice there is an endless sequence of various kind of
  security issues (i.e. software can be misused to do more than
  what is intended) that get fixed issue by issue ad infinitum.
  In the end all that means:
  In practice the user who runs Ghostscript must not let it
  process arbitrary PostScript files from untrusted origin.
  In particular Ghostscript is usually run when printing
  documents (with the '-dSAFER' option set), see the part about
  "It is crucial to limit access to CUPS to trusted users" in
  https://en.opensuse.org/SDB:CUPS_and_SANE_Firewall_settings</changelog>
  <changelog author="jsmeix@suse.de" date="1541764800">- Version upgrade to 9.26rc1 (first release candidate for 9.26).
  Highlights in this release include:
  * Purely security and a few bug fixes, there are no new features,
    and no API changes to report.</changelog>
  <changelog author="jsmeix@suse.de" date="1543579200">- Version upgrade to 9.26
  Highlights in this release include:
  * Security issues have been the primary focus of this release,
    including solving several (well publicised) real and potential
    exploits.
    Thanks to Man Yue Mo of Semmle Security Research Team,
    Jens Mueller of Ruhr-Universitaet Bochum and
    Tavis Ormandy of Google's Project Zero
    for their help to identify specific security issues.
    PLEASE NOTE:
    We (i.e. Ghostscript upstream) strongly urge users to upgrade
    to this latest release to avoid these issues.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  For a release summary see:
  http://www.ghostscript.com/doc/9.26/News.htm
  For details see the News.htm and History9.htm files.
  The Ghostscript 9.26 release should fix (cf. the entry below
  dated 'Fri Sep 14 10:47:33 CEST 2018' what "should fix" means)
  in particular those security issues (bsc#1117331)
  * CVE-2018-19475: psi/zdevice2.c allows attackers to bypass
    intended access restrictions
    https://bugs.ghostscript.com/show_bug.cgi?id=700153
    https://bugzilla.suse.com/show_bug.cgi?id=1117327 bsc#1117327
  * CVE-2018-19476: psi/zicc.c allows attackers to bypass
    intended access restrictions because of a setcolorspace
    type confusion
    https://bugs.ghostscript.com/show_bug.cgi?id=700169
    https://bugzilla.suse.com/show_bug.cgi?id=1117313 bsc#1117313
  * CVE-2018-19477: psi/zfjbig2.c allows attackers to bypass
    intended access restrictions because of a JBIG2Decode
    type confusion
    https://bugs.ghostscript.com/show_bug.cgi?id=700168
    https://bugzilla.suse.com/show_bug.cgi?id=1117274 bsc#1117274
  * CVE-2018-19409: LockSafetyParams is not checked correctly
    if another device is used
    https://bugs.ghostscript.com/show_bug.cgi?id=700176
    https://bugzilla.suse.com/show_bug.cgi?id=1117022 bsc#1117022
  and those security issues
  * CVE-2018-18284: 1Policy operator gives access to .forceput
    https://bugs.ghostscript.com/show_bug.cgi?id=69963
    https://bugzilla.suse.com/show_bug.cgi?id=1112229 bsc#1112229
  * CVE-2018-18073: saved execution stacks can leak operator arrays
    https://bugs.ghostscript.com/show_bug.cgi?id=699927
    https://bugzilla.suse.com/show_bug.cgi?id=1111480 bsc#1111480
  * CVE-2018-17961: bypassing executeonly to escape -dSAFER sandbox
    https://bugs.ghostscript.com/show_bug.cgi?id=699816
    https://bugzilla.suse.com/show_bug.cgi?id=1111479 bsc#1111479
  * CVE-2018-17183: remote attackers could be able to supply
    crafted PostScript to potentially overwrite or replace
    error handlers to inject code
    https://bugs.ghostscript.com/show_bug.cgi?id=699708
    https://bugzilla.suse.com/show_bug.cgi?id=1109105 bsc#1109105</changelog>
  <changelog author="jsmeix@suse.de" date="1547726400">- Version upgrade to 9.26a
  The version 9.26a is a special security bugfix version to fix
  * CVE-2019-6116: subroutines within pseudo-operators
    must themselves be pseudo-operators
    https://bugs.ghostscript.com/show_bug.cgi?id=700317
    https://bugzilla.suse.com/show_bug.cgi?id=1122319 bsc#1122319</changelog>
  <changelog author="jsmeix@suse.de" date="1552996800">- CVE-2019-3838.patch fixes CVE-2019-3838
  forceput in DefineResource is still accessible
  https://bugzilla.suse.com/show_bug.cgi?id=1129186 bsc#1129186
  https://bugs.ghostscript.com/show_bug.cgi?id=700576</changelog>
  <changelog author="jsmeix@suse.de" date="1554379200">- Version upgrade to 9.27
  Highlights in this release include:
  * We (i.e. Ghostscript upstream) have extensively cleaned up
    the Postscript name space: removing access to internal and/or
    undocumented Postscript operators, procedures and data.
    This has benefits for security and maintainability.
    Incompatible changes:
    The process of "tidying" the Postscript name space should
    have removed only non-standard and undocumented operators.
    Nevertheless, it is possible that any integrations or
    utilities that rely on those non-standard and undocumented
    operators may stop working, or may change behaviour.
    If you encounter such a case, please contact us (i.e.
    Ghostscript upstream) - (either the #ghostscript IRC channel,
    or the gs-devel mailing list would be best), and we'll work
    with you to either find an alternative solution.
  * Fontmap can now reference invidual fonts in a TrueType
    Collection for font subsitution. Previously, a Fontmap entry
    could only reference a TrueType collection and use the default
    (first) font.
    Now, the Fontmap syntax allows for specifying a specific index
    in a TTC. See the comments at the top of (the default)
    Fontmap.GS for details.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  IMPORTANT: It is our intention, within the next 12 months
    (ideally sooner, in time for the next release) to make SAFER
    the default mode of operation. For many users this will have
    no effect, since they use SAFER explicitly, but some niche
    uses which rely on SAFER being disabled may need to start
    explicitly adding the "-dNOSAFER" option.
  IMPORTANT: We (i.e. Ghostscript upstream) are in the process of
    forking LittleCMS. LCMS2 is not thread safe, and cannot be made
    thread safe without breaking the ABI. Our fork will be thread
    safe, and include performance enhancements (these changes have
    all be been offered and rejected upstream). We will maintain
    compatibility between Ghostscript and LCMS2 for a time, but not
    in perpetuity. Our fork will be available as its own package
    separately from Ghostscript (and MuPDF).
  For a release summary see:
  http://www.ghostscript.com/doc/9.27/News.htm
  For details see the News.htm and History9.htm files.
  The Ghostscript 9.27 release should fix (cf. the entry below
  dated 'Fri Sep 14 10:47:33 CEST 2018' what "should fix" means)
  in particular those security issues:
  * CVE-2019-3838 forceput in DefineResource is still accessible
    https://bugzilla.suse.com/show_bug.cgi?id=1129186 bsc#1129186
    https://bugs.ghostscript.com/show_bug.cgi?id=700576
  * CVE-2019-3835: superexec operator is available
    https://bugzilla.suse.com/show_bug.cgi?id=1129180 bsc#1129180
    https://bugs.ghostscript.com/show_bug.cgi?id=700585</changelog>
  <changelog author="werner@suse.de" date="1565611200">- CVE-2019-10216.patch fixes CVE-2019-10216
  forceput/superexec in .buildfont1 is still accessible
  https://bugzilla.suse.com/show_bug.cgi?id=1144621 bsc#1144621
  https://bugs.ghostscript.com/show_bug.cgi?id=701394</changelog>
  <changelog author="werner@suse.de" date="1568376000">- Add patch openjpeg4gs-CVE-2018-6616-8ee33522.patch
  to fix bsc#1140359 for CVE-2019-12973</changelog>
  <changelog author="werner@suse.de" date="1568635200">- Add patch gs-CVE-2019-14811-885444fc.patch to fix bsc#1146882
  for CVE-2019-14811,CVE-2019-14812,CVE-2019-14813
- Add patch gs-CVE-2019-14817-cd1b1cac.patch to fix bsc#1146884
  for CVE-2019-14817</changelog>
  <changelog author="werner@suse.de" date="1568635201">- Port latest ghostscript 9.27 from factory including latest
  security patches to SLES15/SLES12
  * Port patch CVE-2019-10216.patch to 9.27 which is the orignal
    upstream commit now
  * Drop patch CVE-2019-3838.patch as now part of 9.27</changelog>
  <changelog author="jsmeix@suse.de" date="1573473600">- CVE-2019-14869.patch contains commit from Ghostscript upstream
  https://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=485904772c5f
  to fix CVE-2019-14869 "-dSAFER escape in .charkeys"
  (bsc#1156275)</changelog>
  <changelog author="jsmeix@suse.de" date="1588075200">- The version upgrade to 9.52 fixes in particular
  CVE-2020-12268: jbic2dec: heap-based buffer overflow
  in jbig2_image_compose (bsc#1170603)
- Version upgrade to 9.52
  Highlights in this release include:
  * The 9.52 release replaces the 9.51 release after a problem
    was reported with 9.51 which warranted the quick turnaround.
    Thus, like 9.51, 9.52 is primarily a maintenance release,
    consolidating the changes we introduced in 9.50.
  * IMPORTANT: We have forked LittleCMS2 into LittleCMS2mt
    (the "mt" indicating "multi-thread").
    LCMS2 is not thread-safe, and cannot be made thread-safe
    without breaking the ABI. Our fork will be thread-safe and
    include performance enhancements (these changes have all
    been offered and rejected upstream). We will maintain
    compatibility between Ghostscript and LCMS2 for a time,
    but not in perpetuity. If there is sufficient interest,
    our fork will be available as its own package separately
    from Ghostscript (and MuPDF).
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  Incompatible changes:
  * New option -dALLOWPSTRANSPARENCY: The transparency compositor
    (and related features), whilst we are improving it, remains
    sensitive to being driven correctly, and incorrect use
    can have unexpected/undefined results. Hence, as part of
    improving security, we limited access to these operators,
    originally using the -dSAFER feature. As we made "SAFER"
    the default mode, that became unacceptable, hence the
    new option -dALLOWPSTRANSPARENCY which enables access
    to the operators, cf.
    https://www.ghostscript.com/doc/9.52/Use.htm#ALLOWPSTRANSPARENCY
  For a release summary see:
  https://www.ghostscript.com/doc/9.52/News.htm
  For details see the News.htm and History9.htm files.
- Version upgrade to 9.51
  Highlights in this release include:
  * 9.51 is primarily a maintainance release, consolidating
    the changes we introduced in 9.50.
  * We have continued our work on code hygiene for this release,
    with a focus on the static analysis tool Coverity
    (from Synopsys, Inc) and we are now maintaining a policy of
    zero Coverity issues in the Ghostscript/GhostPDL source base.
  * IMPORTANT: In consultation with a representative of
    OpenPrinting (http://www.openprinting.org/) it is our
    intention to deprecate and, in the not distant future,
    remove the OpenPrinting Vector/Raster Printer Drivers
    (that is, the opvp and oprp devices).
    If you rely on either of these devices, please get in touch
    with us (i.e. Ghostscript upstream), so we can discuss your
    use case, and revise our plans accordingly.
  * We (i.e. Ghostscript upstream) are in the process of forking
    LittleCMS, cf. the other release notes entries below.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  For a release summary see:
  https://www.ghostscript.com/doc/9.51/News.htm
  For details see the News.htm and History9.htm files.
- Version upgrade to 9.50
  Highlights in this release include:
  * The change to version 9.50 follows recognition
    of the extent and importance of the file access control
    redesign/reimplementation outlined below.
  * The file access control capability (enable with -dSAFER)
    has been completely rewritten, with a ground-up rethink
    of the design. For more details, see: "SAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#Safer
  * It is important to note that -dSAFER now only enables the
    file access controls, and no longer applies restrictions
    to standard Postscript functionality (specifically,
    restrictions on setpagedevice). If your application relies
    on these Postscript restrictions, see "OLDSAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#OldSafer
    and please get in touch, as we do plan to remove those
    Postscript restrictions unless we have reason not to.
  IMPORTANT: File access controls are now enabled by default.
    In order to run Ghostscript without these controls,
    see "NOSAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#NoSafer
  * We (i.e. Ghostscript upstream) are in the process of forking
    LittleCMS, cf. the other release notes entries below.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  Incompatible changes:
  * There are a couple of subtle incompatibilities between the old
    and new SAFER implementations. Firstly, as mentioned above,
    SAFER now leaves standard Postcript functionality unchanged
    (except for the file access limitations). Secondly, the
    interaction with save/restore operations, see "SAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#Safer
  * The following is not strictly speaking new to 9.50,
    as not much has changed since 9.27 in this area,
    but for those who don't upgrade with every release:
    The process of "tidying" the Postscript name space should have
    removed only non-standard and undocumented operators.
    Nevertheless, it is possible that any integrations or utilities
    that rely on those non-standard and undocumented operators
    may stop working, or may change behaviour.
    If you encounter such a case, please contact us
    (i.e. Ghostscript upstream, either the #ghostscript IRC channel
    or the gs-devel mailing list would be best), and we'll work
    with you to either find an alternative solution or return the
    previous functionality, if there is genuinely no other option.
    One case we know this has occurred is GSView 5 (and earlier).
    GSView 5 support for PDF files relied upon internal use only
    features which are no longer available. GSView 5 will still
    work as previously for Postscript files. For PDF files,
    users are encouraged to look at MuPDF https://www.mupdf.com/
  For a release summary see:
  https://www.ghostscript.com/doc/9.50/News.htm
  For details see the News.htm and History9.htm files.
- CVE-2019-10216.patch CVE-2019-14869.patch
  gs-CVE-2019-14811-885444fc.patch
  gs-CVE-2019-14817-cd1b1cac.patch
  openjpeg4gs-CVE-2018-6616-8ee33522.patch
  are fixed in the version 9.52 upstream sources.</changelog>
  <changelog author="jsmeix@suse.de" date="1595851200">- CVE-2020-15900.patch fixes CVE-2020-15900
  Memory Corruption (SAFER Sandbox Breakout)
  cf. https://bugs.ghostscript.com/show_bug.cgi?id=702582
  (bsc#1174415)</changelog>
  <changelog author="wolfgang.frisch@suse.com" date="1619006400">- Hardening: link as position independent executable (bsc#1184123).</changelog>
  <changelog author="jsmeix@suse.de" date="1631275200">- CVE-2021-3781.patch fixes CVE-2021-3781
  Trivial -dSAFER bypass
  cf. https://bugs.ghostscript.com/show_bug.cgi?id=704342
  (bsc#1190381)</changelog>
  <changelog author="werner@suse.de" date="1632916800">- Use update-alternatives to get the real ghostscript binary from
  /usr/bin/gs to /usr/bin/gs.bin and allow the gswrap package to
  use this with its wrapper script (jira#PM-3037)</changelog>
  <changelog author="jsmeix@suse.de" date="1641902400">- CVE-2021-45944.patch fixes CVE-2021-45944
  use-after-free in sampled_data_sample
  cf. https://github.com/google/oss-fuzz-vulns/blob/main/vulns/ghostscript/OSV-2021-237.yaml
  (bsc#1194303)
- CVE-2021-45949.patch fixes CVE-2021-45949
  heap-based buffer overflow in sampled_data_finish
  cf. https://github.com/google/oss-fuzz-vulns/blob/main/vulns/ghostscript/OSV-2021-803.yaml
  (bsc#1194304)</changelog>
</package>
<package pkgid="ab7847e2db2833526c04152fa2f4a505091618ee94a1aa2713cc92921c71a417" name="ghostscript" arch="x86_64">
  <version epoch="0" ver="9.52" rel="161.1"/>
  <changelog author="jsmeix@suse.de" date="1528200000">- CVE-2018-10194.patch fixes stack-based buffer overflow
  in gdevpdts.c (bsc#1090099), see
  https://bugs.ghostscript.com/show_bug.cgi?id=699255 and
  http://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=39b1e54b2968620723bf32e96764c88797714879</changelog>
  <changelog author="jsmeix@suse.de" date="1536840000">- Version upgrade to 9.24
  Highlights in this release include:
  * Security issues have been the primary focus of this release,
    including solving several (well publicised)
    real and potential exploits.
    PLEASE NOTE:
    We (i.e. Ghostscript upstream) strongly urge users to upgrade
    to this latest release to avoid these issues.
  * As well as Ghostscript itself, jbig2dec has had a significant
    amount of work improving its robustness in the face of
    out specification files.
  * IMPORTANT: We (i.e. Ghostscript upstream) are in the process
    of forking LittleCMS. LCMS2 is not thread safe, and cannot
    be made thread safe without breaking the ABI. Our fork
    will be thread safe, and include performance enhancements
    (these changes have all be been offered and rejected upstream).
    We will maintain compatibility between Ghostscript and LCMS2
    for a time, but not in perpetuity. Our fork will be available
    as its own package separately from Ghostscript (and MuPDF).
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  For a release summary see:
  http://www.ghostscript.com/doc/9.24/News.htm
  For details see the News.htm and History9.htm files.
- fix_ln_docdir_gsdatadir.patch is no longer needed
  because the issue is fixed in the upstream sources.
- CVE-2018-10194.patch is no longer needed
  because the issue is fixed in the upstream sources.</changelog>
  <changelog author="jsmeix@suse.de" date="1536840001">- Version upgrade to 9.25rc1 (first release candidate for 9.25).
  Highlights in this release include:
  * This release fixes problems with argument handling, some
    unintended results of the security fixes to the SAFER file
    access restrictions (specifically accessing ICC profile files),
    and some additional security issues over the 9.24 release.
  * Security issues have been the primary focus of this release,
    including solving several (well publicised) real
    and potential exploits.
    PLEASE NOTE:
    We (i.e. Ghostscript upstream) strongly urge users to upgrade
    to this latest release to avoid these issues.
  * Avoid that ps2epsi fails with
    'Error: /undefined in --setpagedevice--'
    Recent changes required to harden SAFER mode mean that
    it is no longer possible to run ps2epsi in SAFER mode,
    because it relies upon unsafe Ghostscript non-standard
    extension operators.
    Removing SAFER and DELAYSAFER, and the code to reset SAFER,
    allow ps2epsi to run as well as it ever did (ie badly).
    This program (i.e. ps2epsi) should now be considered unsafe,
    you should not use it on untrusted PostScript programs.
    Likely we (i.e. Ghostscript upstream) will deprecate and
    remove this program in future.
  For details see the News.htm and History9.htm files.
  Regarding installing packages (in particular release candidates)
  from the openSUSE build service development project "Printing"
  see https://build.opensuse.org/project/show/Printing</changelog>
  <changelog author="jsmeix@suse.de" date="1536926400">- Version upgrade to 9.25
  For the highlights in this release see the highlights in the
  9.25rc1 first release candidate for 9.25 entry below.
  PLEASE NOTE:
  We (i.e. Ghostscript upstream) strongly urge users to upgrade
  to this latest release to avoid these issues.
  For a release summary see:
  http://www.ghostscript.com/doc/9.25/News.htm
  For details see the News.htm and History9.htm files.
  The Ghostscript 9.25 release should fix (see below)
  in particular those security issues:
  * CVE-2018-15909: shading_param incomplete type checking
    https://bugs.ghostscript.com/show_bug.cgi?id=699660
    https://bugzilla.suse.com/show_bug.cgi?id=1106172 bsc#1106172
  * CVE-2018-15908: .tempfile file permission issues
    https://bugs.ghostscript.com/show_bug.cgi?id=699657
    https://bugzilla.suse.com/show_bug.cgi?id=1106171 bsc#1106171
  * CVE-2018-15910: LockDistillerParams type confusion
    https://bugs.ghostscript.com/show_bug.cgi?id=699656
    https://bugzilla.suse.com/show_bug.cgi?id=1106173 bsc#1106173
  * CVE-2018-15911: uninitialized memory access in the aesdecode
    https://bugs.ghostscript.com/show_bug.cgi?id=699665
    https://bugzilla.suse.com/show_bug.cgi?id=1106195 bsc#1106195
  * CVE-2018-16513: setcolor missing type check
    https://bugs.ghostscript.com/show_bug.cgi?id=699655
    https://bugzilla.suse.com/show_bug.cgi?id=1107412 bsc#1107412
  * CVE-2018-16509: /invalidaccess bypass after failed restore
    https://bugs.ghostscript.com/show_bug.cgi?id=699654
    https://bugzilla.suse.com/show_bug.cgi?id=1107410 bsc#1107410
  * CVE-2018-16510: Incorrect exec stack handling in the "CS"
    and "SC" PDF primitives
    https://bugs.ghostscript.com/show_bug.cgi?id=699671
    https://bugzilla.suse.com/show_bug.cgi?id=1107411 bsc#1107411
  * CVE-2018-16542: .definemodifiedfont memory corruption
    if /typecheck is handled
    https://bugs.ghostscript.com/show_bug.cgi?id=699668
    https://bugzilla.suse.com/show_bug.cgi?id=1107413 bsc#1107413
  * CVE-2018-16541 incorrect free logic in pagedevice replacement
    https://bugs.ghostscript.com/show_bug.cgi?id=699664
    https://bugzilla.suse.com/show_bug.cgi?id=1107421 bsc#1107421
  * CVE-2018-16540 use-after-free in copydevice handling
    https://bugs.ghostscript.com/show_bug.cgi?id=699661
    https://bugzilla.suse.com/show_bug.cgi?id=1107420 bsc#1107420
  * CVE-2018-16539: incorrect access checking in temp file
    handling to disclose contents of files
    https://bugs.ghostscript.com/show_bug.cgi?id=699658
    https://bugzilla.suse.com/show_bug.cgi?id=1107422 bsc#1107422
  * CVE-2018-16543: gssetresolution and gsgetresolution allow
    for unspecified impact
    https://bugs.ghostscript.com/show_bug.cgi?id=699670
    https://bugzilla.suse.com/show_bug.cgi?id=1107423 bsc#1107423
  * CVE-2018-16511: type confusion in "ztype" could be used by
    remote attackers able to supply crafted PostScript to crash
    the interpreter or possibly have unspecified other impact
    https://bugs.ghostscript.com/show_bug.cgi?id=699659
    https://bugzilla.suse.com/show_bug.cgi?id=1107426 bsc#1107426
  * CVE-2018-16585 .setdistillerkeys PostScript command is
    accepted even though it is not intended for use
    https://bugzilla.suse.com/show_bug.cgi?id=1107581 bsc#1107581
  * CVE-2018-16802: Incorrect"restoration of privilege" checking
    when running out of stack during exceptionhandling could be
    used by attackers able to supply crafted PostScript to execute
    code using the "pipe" instruction. This is due to an incomplete
    fix for CVE-2018-16509
    https://bugs.ghostscript.com/show_bug.cgi?id=699714
    https://bugs.ghostscript.com/show_bug.cgi?id=699718
    https://bugzilla.suse.com/show_bug.cgi?id=1108027 bnc#1108027
  Regarding what the above "should fix" means:
  PostScript is a general purpose Turing-complete programming
  language (cf. https://en.wikipedia.org/wiki/PostScript)
  that supports in particular file access on the system disk.
  When Ghostscript processes PostScript it runs a PostScript
  program as the user who runs Ghostscript.
  When Ghostscript processes an arbitrary PostScript file,
  the user who runs Ghostscript runs an arbitrary program
  which can do anything on the system where Ghostscript runs
  that this user is allowed to do on that system.
  To make it safer when Ghostscript runs a PostScript program
  the Ghostscript command line option '-dSAFER' disables
  certain file access functionality, for details see
  /usr/share/doc/ghostscript/9.25/Use.htm
  Its name 'SAFER' says everything: It makes it 'safer'
  to let Ghostscript run a PostScript program,
  but it does not make it completely safe.
  In theory software is safe against misuse (i.e. has no bugs).
  In practice there is an endless sequence of various kind of
  security issues (i.e. software can be misused to do more than
  what is intended) that get fixed issue by issue ad infinitum.
  In the end all that means:
  In practice the user who runs Ghostscript must not let it
  process arbitrary PostScript files from untrusted origin.
  In particular Ghostscript is usually run when printing
  documents (with the '-dSAFER' option set), see the part about
  "It is crucial to limit access to CUPS to trusted users" in
  https://en.opensuse.org/SDB:CUPS_and_SANE_Firewall_settings</changelog>
  <changelog author="jsmeix@suse.de" date="1541764800">- Version upgrade to 9.26rc1 (first release candidate for 9.26).
  Highlights in this release include:
  * Purely security and a few bug fixes, there are no new features,
    and no API changes to report.</changelog>
  <changelog author="jsmeix@suse.de" date="1543579200">- Version upgrade to 9.26
  Highlights in this release include:
  * Security issues have been the primary focus of this release,
    including solving several (well publicised) real and potential
    exploits.
    Thanks to Man Yue Mo of Semmle Security Research Team,
    Jens Mueller of Ruhr-Universitaet Bochum and
    Tavis Ormandy of Google's Project Zero
    for their help to identify specific security issues.
    PLEASE NOTE:
    We (i.e. Ghostscript upstream) strongly urge users to upgrade
    to this latest release to avoid these issues.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  For a release summary see:
  http://www.ghostscript.com/doc/9.26/News.htm
  For details see the News.htm and History9.htm files.
  The Ghostscript 9.26 release should fix (cf. the entry below
  dated 'Fri Sep 14 10:47:33 CEST 2018' what "should fix" means)
  in particular those security issues (bsc#1117331)
  * CVE-2018-19475: psi/zdevice2.c allows attackers to bypass
    intended access restrictions
    https://bugs.ghostscript.com/show_bug.cgi?id=700153
    https://bugzilla.suse.com/show_bug.cgi?id=1117327 bsc#1117327
  * CVE-2018-19476: psi/zicc.c allows attackers to bypass
    intended access restrictions because of a setcolorspace
    type confusion
    https://bugs.ghostscript.com/show_bug.cgi?id=700169
    https://bugzilla.suse.com/show_bug.cgi?id=1117313 bsc#1117313
  * CVE-2018-19477: psi/zfjbig2.c allows attackers to bypass
    intended access restrictions because of a JBIG2Decode
    type confusion
    https://bugs.ghostscript.com/show_bug.cgi?id=700168
    https://bugzilla.suse.com/show_bug.cgi?id=1117274 bsc#1117274
  * CVE-2018-19409: LockSafetyParams is not checked correctly
    if another device is used
    https://bugs.ghostscript.com/show_bug.cgi?id=700176
    https://bugzilla.suse.com/show_bug.cgi?id=1117022 bsc#1117022
  and those security issues
  * CVE-2018-18284: 1Policy operator gives access to .forceput
    https://bugs.ghostscript.com/show_bug.cgi?id=69963
    https://bugzilla.suse.com/show_bug.cgi?id=1112229 bsc#1112229
  * CVE-2018-18073: saved execution stacks can leak operator arrays
    https://bugs.ghostscript.com/show_bug.cgi?id=699927
    https://bugzilla.suse.com/show_bug.cgi?id=1111480 bsc#1111480
  * CVE-2018-17961: bypassing executeonly to escape -dSAFER sandbox
    https://bugs.ghostscript.com/show_bug.cgi?id=699816
    https://bugzilla.suse.com/show_bug.cgi?id=1111479 bsc#1111479
  * CVE-2018-17183: remote attackers could be able to supply
    crafted PostScript to potentially overwrite or replace
    error handlers to inject code
    https://bugs.ghostscript.com/show_bug.cgi?id=699708
    https://bugzilla.suse.com/show_bug.cgi?id=1109105 bsc#1109105</changelog>
  <changelog author="jsmeix@suse.de" date="1547726400">- Version upgrade to 9.26a
  The version 9.26a is a special security bugfix version to fix
  * CVE-2019-6116: subroutines within pseudo-operators
    must themselves be pseudo-operators
    https://bugs.ghostscript.com/show_bug.cgi?id=700317
    https://bugzilla.suse.com/show_bug.cgi?id=1122319 bsc#1122319</changelog>
  <changelog author="jsmeix@suse.de" date="1552996800">- CVE-2019-3838.patch fixes CVE-2019-3838
  forceput in DefineResource is still accessible
  https://bugzilla.suse.com/show_bug.cgi?id=1129186 bsc#1129186
  https://bugs.ghostscript.com/show_bug.cgi?id=700576</changelog>
  <changelog author="jsmeix@suse.de" date="1554379200">- Version upgrade to 9.27
  Highlights in this release include:
  * We (i.e. Ghostscript upstream) have extensively cleaned up
    the Postscript name space: removing access to internal and/or
    undocumented Postscript operators, procedures and data.
    This has benefits for security and maintainability.
    Incompatible changes:
    The process of "tidying" the Postscript name space should
    have removed only non-standard and undocumented operators.
    Nevertheless, it is possible that any integrations or
    utilities that rely on those non-standard and undocumented
    operators may stop working, or may change behaviour.
    If you encounter such a case, please contact us (i.e.
    Ghostscript upstream) - (either the #ghostscript IRC channel,
    or the gs-devel mailing list would be best), and we'll work
    with you to either find an alternative solution.
  * Fontmap can now reference invidual fonts in a TrueType
    Collection for font subsitution. Previously, a Fontmap entry
    could only reference a TrueType collection and use the default
    (first) font.
    Now, the Fontmap syntax allows for specifying a specific index
    in a TTC. See the comments at the top of (the default)
    Fontmap.GS for details.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  IMPORTANT: It is our intention, within the next 12 months
    (ideally sooner, in time for the next release) to make SAFER
    the default mode of operation. For many users this will have
    no effect, since they use SAFER explicitly, but some niche
    uses which rely on SAFER being disabled may need to start
    explicitly adding the "-dNOSAFER" option.
  IMPORTANT: We (i.e. Ghostscript upstream) are in the process of
    forking LittleCMS. LCMS2 is not thread safe, and cannot be made
    thread safe without breaking the ABI. Our fork will be thread
    safe, and include performance enhancements (these changes have
    all be been offered and rejected upstream). We will maintain
    compatibility between Ghostscript and LCMS2 for a time, but not
    in perpetuity. Our fork will be available as its own package
    separately from Ghostscript (and MuPDF).
  For a release summary see:
  http://www.ghostscript.com/doc/9.27/News.htm
  For details see the News.htm and History9.htm files.
  The Ghostscript 9.27 release should fix (cf. the entry below
  dated 'Fri Sep 14 10:47:33 CEST 2018' what "should fix" means)
  in particular those security issues:
  * CVE-2019-3838 forceput in DefineResource is still accessible
    https://bugzilla.suse.com/show_bug.cgi?id=1129186 bsc#1129186
    https://bugs.ghostscript.com/show_bug.cgi?id=700576
  * CVE-2019-3835: superexec operator is available
    https://bugzilla.suse.com/show_bug.cgi?id=1129180 bsc#1129180
    https://bugs.ghostscript.com/show_bug.cgi?id=700585</changelog>
  <changelog author="werner@suse.de" date="1565611200">- CVE-2019-10216.patch fixes CVE-2019-10216
  forceput/superexec in .buildfont1 is still accessible
  https://bugzilla.suse.com/show_bug.cgi?id=1144621 bsc#1144621
  https://bugs.ghostscript.com/show_bug.cgi?id=701394</changelog>
  <changelog author="werner@suse.de" date="1568376000">- Add patch openjpeg4gs-CVE-2018-6616-8ee33522.patch
  to fix bsc#1140359 for CVE-2019-12973</changelog>
  <changelog author="werner@suse.de" date="1568635200">- Add patch gs-CVE-2019-14811-885444fc.patch to fix bsc#1146882
  for CVE-2019-14811,CVE-2019-14812,CVE-2019-14813
- Add patch gs-CVE-2019-14817-cd1b1cac.patch to fix bsc#1146884
  for CVE-2019-14817</changelog>
  <changelog author="werner@suse.de" date="1568635201">- Port latest ghostscript 9.27 from factory including latest
  security patches to SLES15/SLES12
  * Port patch CVE-2019-10216.patch to 9.27 which is the orignal
    upstream commit now
  * Drop patch CVE-2019-3838.patch as now part of 9.27</changelog>
  <changelog author="jsmeix@suse.de" date="1573473600">- CVE-2019-14869.patch contains commit from Ghostscript upstream
  https://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=485904772c5f
  to fix CVE-2019-14869 "-dSAFER escape in .charkeys"
  (bsc#1156275)</changelog>
  <changelog author="jsmeix@suse.de" date="1588075200">- The version upgrade to 9.52 fixes in particular
  CVE-2020-12268: jbic2dec: heap-based buffer overflow
  in jbig2_image_compose (bsc#1170603)
- Version upgrade to 9.52
  Highlights in this release include:
  * The 9.52 release replaces the 9.51 release after a problem
    was reported with 9.51 which warranted the quick turnaround.
    Thus, like 9.51, 9.52 is primarily a maintenance release,
    consolidating the changes we introduced in 9.50.
  * IMPORTANT: We have forked LittleCMS2 into LittleCMS2mt
    (the "mt" indicating "multi-thread").
    LCMS2 is not thread-safe, and cannot be made thread-safe
    without breaking the ABI. Our fork will be thread-safe and
    include performance enhancements (these changes have all
    been offered and rejected upstream). We will maintain
    compatibility between Ghostscript and LCMS2 for a time,
    but not in perpetuity. If there is sufficient interest,
    our fork will be available as its own package separately
    from Ghostscript (and MuPDF).
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  Incompatible changes:
  * New option -dALLOWPSTRANSPARENCY: The transparency compositor
    (and related features), whilst we are improving it, remains
    sensitive to being driven correctly, and incorrect use
    can have unexpected/undefined results. Hence, as part of
    improving security, we limited access to these operators,
    originally using the -dSAFER feature. As we made "SAFER"
    the default mode, that became unacceptable, hence the
    new option -dALLOWPSTRANSPARENCY which enables access
    to the operators, cf.
    https://www.ghostscript.com/doc/9.52/Use.htm#ALLOWPSTRANSPARENCY
  For a release summary see:
  https://www.ghostscript.com/doc/9.52/News.htm
  For details see the News.htm and History9.htm files.
- Version upgrade to 9.51
  Highlights in this release include:
  * 9.51 is primarily a maintainance release, consolidating
    the changes we introduced in 9.50.
  * We have continued our work on code hygiene for this release,
    with a focus on the static analysis tool Coverity
    (from Synopsys, Inc) and we are now maintaining a policy of
    zero Coverity issues in the Ghostscript/GhostPDL source base.
  * IMPORTANT: In consultation with a representative of
    OpenPrinting (http://www.openprinting.org/) it is our
    intention to deprecate and, in the not distant future,
    remove the OpenPrinting Vector/Raster Printer Drivers
    (that is, the opvp and oprp devices).
    If you rely on either of these devices, please get in touch
    with us (i.e. Ghostscript upstream), so we can discuss your
    use case, and revise our plans accordingly.
  * We (i.e. Ghostscript upstream) are in the process of forking
    LittleCMS, cf. the other release notes entries below.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  For a release summary see:
  https://www.ghostscript.com/doc/9.51/News.htm
  For details see the News.htm and History9.htm files.
- Version upgrade to 9.50
  Highlights in this release include:
  * The change to version 9.50 follows recognition
    of the extent and importance of the file access control
    redesign/reimplementation outlined below.
  * The file access control capability (enable with -dSAFER)
    has been completely rewritten, with a ground-up rethink
    of the design. For more details, see: "SAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#Safer
  * It is important to note that -dSAFER now only enables the
    file access controls, and no longer applies restrictions
    to standard Postscript functionality (specifically,
    restrictions on setpagedevice). If your application relies
    on these Postscript restrictions, see "OLDSAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#OldSafer
    and please get in touch, as we do plan to remove those
    Postscript restrictions unless we have reason not to.
  IMPORTANT: File access controls are now enabled by default.
    In order to run Ghostscript without these controls,
    see "NOSAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#NoSafer
  * We (i.e. Ghostscript upstream) are in the process of forking
    LittleCMS, cf. the other release notes entries below.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  Incompatible changes:
  * There are a couple of subtle incompatibilities between the old
    and new SAFER implementations. Firstly, as mentioned above,
    SAFER now leaves standard Postcript functionality unchanged
    (except for the file access limitations). Secondly, the
    interaction with save/restore operations, see "SAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#Safer
  * The following is not strictly speaking new to 9.50,
    as not much has changed since 9.27 in this area,
    but for those who don't upgrade with every release:
    The process of "tidying" the Postscript name space should have
    removed only non-standard and undocumented operators.
    Nevertheless, it is possible that any integrations or utilities
    that rely on those non-standard and undocumented operators
    may stop working, or may change behaviour.
    If you encounter such a case, please contact us
    (i.e. Ghostscript upstream, either the #ghostscript IRC channel
    or the gs-devel mailing list would be best), and we'll work
    with you to either find an alternative solution or return the
    previous functionality, if there is genuinely no other option.
    One case we know this has occurred is GSView 5 (and earlier).
    GSView 5 support for PDF files relied upon internal use only
    features which are no longer available. GSView 5 will still
    work as previously for Postscript files. For PDF files,
    users are encouraged to look at MuPDF https://www.mupdf.com/
  For a release summary see:
  https://www.ghostscript.com/doc/9.50/News.htm
  For details see the News.htm and History9.htm files.
- CVE-2019-10216.patch CVE-2019-14869.patch
  gs-CVE-2019-14811-885444fc.patch
  gs-CVE-2019-14817-cd1b1cac.patch
  openjpeg4gs-CVE-2018-6616-8ee33522.patch
  are fixed in the version 9.52 upstream sources.</changelog>
  <changelog author="jsmeix@suse.de" date="1595851200">- CVE-2020-15900.patch fixes CVE-2020-15900
  Memory Corruption (SAFER Sandbox Breakout)
  cf. https://bugs.ghostscript.com/show_bug.cgi?id=702582
  (bsc#1174415)</changelog>
  <changelog author="wolfgang.frisch@suse.com" date="1619006400">- Hardening: link as position independent executable (bsc#1184123).</changelog>
  <changelog author="jsmeix@suse.de" date="1631275200">- CVE-2021-3781.patch fixes CVE-2021-3781
  Trivial -dSAFER bypass
  cf. https://bugs.ghostscript.com/show_bug.cgi?id=704342
  (bsc#1190381)</changelog>
  <changelog author="werner@suse.de" date="1632916800">- Use update-alternatives to get the real ghostscript binary from
  /usr/bin/gs to /usr/bin/gs.bin and allow the gswrap package to
  use this with its wrapper script (jira#PM-3037)</changelog>
  <changelog author="jsmeix@suse.de" date="1641902400">- CVE-2021-45944.patch fixes CVE-2021-45944
  use-after-free in sampled_data_sample
  cf. https://github.com/google/oss-fuzz-vulns/blob/main/vulns/ghostscript/OSV-2021-237.yaml
  (bsc#1194303)
- CVE-2021-45949.patch fixes CVE-2021-45949
  heap-based buffer overflow in sampled_data_finish
  cf. https://github.com/google/oss-fuzz-vulns/blob/main/vulns/ghostscript/OSV-2021-803.yaml
  (bsc#1194304)</changelog>
</package>
<package pkgid="60cfcbefc1041721f436a60b3e0c67c9b5c871cc3ce3bcbbe47aac118ff38736" name="ghostscript-devel" arch="aarch64">
  <version epoch="0" ver="9.52" rel="158.1"/>
  <changelog author="jsmeix@suse.de" date="1521720000">- Version upgrade to 9.23
  Highlights in this release include:
  * Ghostscript now has a family of 'pdfimage' devices
    (pdfimage8, pdfimage24 and pdfimage32) which produce
    rendered output wrapped up as an image in a PDF.
    Additionally, there is a 'pclm' device which
    produces PCLm format output.
  * There is now a ColorAccuracy parameter allowing the user
    to decide between speed or accuracy in ICC color transforms.
  * JPEG Passthrough: devices which support it can now receive
    the 'raw' JPEG stream from the interpreter.
    The main use of this is the pdfwrite/ps2write family of devices
    that can now take JPEG streams from the input file(s) and write
    them unchanged to the output (thus avoiding additional
    quantization effects).
  * PDF transparency performance improvements
  * IMPORTANT: We (i.e. Ghostscript upstream) are in the process
    of forking LittleCMS.
    LCMS2 is not thread safe, and cannot be made thread safe
    without breaking the ABI. Our fork will be thread safe,
    and include performance enhancements (these changes have all
    be been offered and rejected upstream). We will maintain
    compatibility between Ghostscript and LCMS2 for a time,
    but not in perpetuity. Our fork will be available as its own
    package separately from Ghostscript (and MuPDF).
  * We have continued the focus on code hygiene in this release
    cleaning up security issues, ignored return values,
    and compiler warnings.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  Incompatible changes
  * The planned device API tidy has, unfortunately, been
    indefinitely postponed, until appropriate resources
    are available.
  For a release summary see:
  http://www.ghostscript.com/doc/9.23/News.htm
  For details see the News.htm and History9.htm files.
  See also the entries below since "Version upgrade to 9.22"
  (boo#1082896 and boo#1074266).</changelog>
  <changelog author="jsmeix@suse.de" date="1528200000">- CVE-2018-10194.patch fixes stack-based buffer overflow
  in gdevpdts.c (bsc#1090099), see
  https://bugs.ghostscript.com/show_bug.cgi?id=699255 and
  http://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=39b1e54b2968620723bf32e96764c88797714879</changelog>
  <changelog author="jsmeix@suse.de" date="1536840000">- Version upgrade to 9.24
  Highlights in this release include:
  * Security issues have been the primary focus of this release,
    including solving several (well publicised)
    real and potential exploits.
    PLEASE NOTE:
    We (i.e. Ghostscript upstream) strongly urge users to upgrade
    to this latest release to avoid these issues.
  * As well as Ghostscript itself, jbig2dec has had a significant
    amount of work improving its robustness in the face of
    out specification files.
  * IMPORTANT: We (i.e. Ghostscript upstream) are in the process
    of forking LittleCMS. LCMS2 is not thread safe, and cannot
    be made thread safe without breaking the ABI. Our fork
    will be thread safe, and include performance enhancements
    (these changes have all be been offered and rejected upstream).
    We will maintain compatibility between Ghostscript and LCMS2
    for a time, but not in perpetuity. Our fork will be available
    as its own package separately from Ghostscript (and MuPDF).
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  For a release summary see:
  http://www.ghostscript.com/doc/9.24/News.htm
  For details see the News.htm and History9.htm files.
- fix_ln_docdir_gsdatadir.patch is no longer needed
  because the issue is fixed in the upstream sources.
- CVE-2018-10194.patch is no longer needed
  because the issue is fixed in the upstream sources.</changelog>
  <changelog author="jsmeix@suse.de" date="1536840001">- Version upgrade to 9.25rc1 (first release candidate for 9.25).
  Highlights in this release include:
  * This release fixes problems with argument handling, some
    unintended results of the security fixes to the SAFER file
    access restrictions (specifically accessing ICC profile files),
    and some additional security issues over the 9.24 release.
  * Security issues have been the primary focus of this release,
    including solving several (well publicised) real
    and potential exploits.
    PLEASE NOTE:
    We (i.e. Ghostscript upstream) strongly urge users to upgrade
    to this latest release to avoid these issues.
  * Avoid that ps2epsi fails with
    'Error: /undefined in --setpagedevice--'
    Recent changes required to harden SAFER mode mean that
    it is no longer possible to run ps2epsi in SAFER mode,
    because it relies upon unsafe Ghostscript non-standard
    extension operators.
    Removing SAFER and DELAYSAFER, and the code to reset SAFER,
    allow ps2epsi to run as well as it ever did (ie badly).
    This program (i.e. ps2epsi) should now be considered unsafe,
    you should not use it on untrusted PostScript programs.
    Likely we (i.e. Ghostscript upstream) will deprecate and
    remove this program in future.
  For details see the News.htm and History9.htm files.
  Regarding installing packages (in particular release candidates)
  from the openSUSE build service development project "Printing"
  see https://build.opensuse.org/project/show/Printing</changelog>
  <changelog author="jsmeix@suse.de" date="1536926400">- Version upgrade to 9.25
  For the highlights in this release see the highlights in the
  9.25rc1 first release candidate for 9.25 entry below.
  PLEASE NOTE:
  We (i.e. Ghostscript upstream) strongly urge users to upgrade
  to this latest release to avoid these issues.
  For a release summary see:
  http://www.ghostscript.com/doc/9.25/News.htm
  For details see the News.htm and History9.htm files.
  The Ghostscript 9.25 release should fix (see below)
  in particular those security issues:
  * CVE-2018-15909: shading_param incomplete type checking
    https://bugs.ghostscript.com/show_bug.cgi?id=699660
    https://bugzilla.suse.com/show_bug.cgi?id=1106172 bsc#1106172
  * CVE-2018-15908: .tempfile file permission issues
    https://bugs.ghostscript.com/show_bug.cgi?id=699657
    https://bugzilla.suse.com/show_bug.cgi?id=1106171 bsc#1106171
  * CVE-2018-15910: LockDistillerParams type confusion
    https://bugs.ghostscript.com/show_bug.cgi?id=699656
    https://bugzilla.suse.com/show_bug.cgi?id=1106173 bsc#1106173
  * CVE-2018-15911: uninitialized memory access in the aesdecode
    https://bugs.ghostscript.com/show_bug.cgi?id=699665
    https://bugzilla.suse.com/show_bug.cgi?id=1106195 bsc#1106195
  * CVE-2018-16513: setcolor missing type check
    https://bugs.ghostscript.com/show_bug.cgi?id=699655
    https://bugzilla.suse.com/show_bug.cgi?id=1107412 bsc#1107412
  * CVE-2018-16509: /invalidaccess bypass after failed restore
    https://bugs.ghostscript.com/show_bug.cgi?id=699654
    https://bugzilla.suse.com/show_bug.cgi?id=1107410 bsc#1107410
  * CVE-2018-16510: Incorrect exec stack handling in the "CS"
    and "SC" PDF primitives
    https://bugs.ghostscript.com/show_bug.cgi?id=699671
    https://bugzilla.suse.com/show_bug.cgi?id=1107411 bsc#1107411
  * CVE-2018-16542: .definemodifiedfont memory corruption
    if /typecheck is handled
    https://bugs.ghostscript.com/show_bug.cgi?id=699668
    https://bugzilla.suse.com/show_bug.cgi?id=1107413 bsc#1107413
  * CVE-2018-16541 incorrect free logic in pagedevice replacement
    https://bugs.ghostscript.com/show_bug.cgi?id=699664
    https://bugzilla.suse.com/show_bug.cgi?id=1107421 bsc#1107421
  * CVE-2018-16540 use-after-free in copydevice handling
    https://bugs.ghostscript.com/show_bug.cgi?id=699661
    https://bugzilla.suse.com/show_bug.cgi?id=1107420 bsc#1107420
  * CVE-2018-16539: incorrect access checking in temp file
    handling to disclose contents of files
    https://bugs.ghostscript.com/show_bug.cgi?id=699658
    https://bugzilla.suse.com/show_bug.cgi?id=1107422 bsc#1107422
  * CVE-2018-16543: gssetresolution and gsgetresolution allow
    for unspecified impact
    https://bugs.ghostscript.com/show_bug.cgi?id=699670
    https://bugzilla.suse.com/show_bug.cgi?id=1107423 bsc#1107423
  * CVE-2018-16511: type confusion in "ztype" could be used by
    remote attackers able to supply crafted PostScript to crash
    the interpreter or possibly have unspecified other impact
    https://bugs.ghostscript.com/show_bug.cgi?id=699659
    https://bugzilla.suse.com/show_bug.cgi?id=1107426 bsc#1107426
  * CVE-2018-16585 .setdistillerkeys PostScript command is
    accepted even though it is not intended for use
    https://bugzilla.suse.com/show_bug.cgi?id=1107581 bsc#1107581
  * CVE-2018-16802: Incorrect"restoration of privilege" checking
    when running out of stack during exceptionhandling could be
    used by attackers able to supply crafted PostScript to execute
    code using the "pipe" instruction. This is due to an incomplete
    fix for CVE-2018-16509
    https://bugs.ghostscript.com/show_bug.cgi?id=699714
    https://bugs.ghostscript.com/show_bug.cgi?id=699718
    https://bugzilla.suse.com/show_bug.cgi?id=1108027 bnc#1108027
  Regarding what the above "should fix" means:
  PostScript is a general purpose Turing-complete programming
  language (cf. https://en.wikipedia.org/wiki/PostScript)
  that supports in particular file access on the system disk.
  When Ghostscript processes PostScript it runs a PostScript
  program as the user who runs Ghostscript.
  When Ghostscript processes an arbitrary PostScript file,
  the user who runs Ghostscript runs an arbitrary program
  which can do anything on the system where Ghostscript runs
  that this user is allowed to do on that system.
  To make it safer when Ghostscript runs a PostScript program
  the Ghostscript command line option '-dSAFER' disables
  certain file access functionality, for details see
  /usr/share/doc/ghostscript/9.25/Use.htm
  Its name 'SAFER' says everything: It makes it 'safer'
  to let Ghostscript run a PostScript program,
  but it does not make it completely safe.
  In theory software is safe against misuse (i.e. has no bugs).
  In practice there is an endless sequence of various kind of
  security issues (i.e. software can be misused to do more than
  what is intended) that get fixed issue by issue ad infinitum.
  In the end all that means:
  In practice the user who runs Ghostscript must not let it
  process arbitrary PostScript files from untrusted origin.
  In particular Ghostscript is usually run when printing
  documents (with the '-dSAFER' option set), see the part about
  "It is crucial to limit access to CUPS to trusted users" in
  https://en.opensuse.org/SDB:CUPS_and_SANE_Firewall_settings</changelog>
  <changelog author="jsmeix@suse.de" date="1541764800">- Version upgrade to 9.26rc1 (first release candidate for 9.26).
  Highlights in this release include:
  * Purely security and a few bug fixes, there are no new features,
    and no API changes to report.</changelog>
  <changelog author="jsmeix@suse.de" date="1543579200">- Version upgrade to 9.26
  Highlights in this release include:
  * Security issues have been the primary focus of this release,
    including solving several (well publicised) real and potential
    exploits.
    Thanks to Man Yue Mo of Semmle Security Research Team,
    Jens Mueller of Ruhr-Universitaet Bochum and
    Tavis Ormandy of Google's Project Zero
    for their help to identify specific security issues.
    PLEASE NOTE:
    We (i.e. Ghostscript upstream) strongly urge users to upgrade
    to this latest release to avoid these issues.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  For a release summary see:
  http://www.ghostscript.com/doc/9.26/News.htm
  For details see the News.htm and History9.htm files.
  The Ghostscript 9.26 release should fix (cf. the entry below
  dated 'Fri Sep 14 10:47:33 CEST 2018' what "should fix" means)
  in particular those security issues (bsc#1117331)
  * CVE-2018-19475: psi/zdevice2.c allows attackers to bypass
    intended access restrictions
    https://bugs.ghostscript.com/show_bug.cgi?id=700153
    https://bugzilla.suse.com/show_bug.cgi?id=1117327 bsc#1117327
  * CVE-2018-19476: psi/zicc.c allows attackers to bypass
    intended access restrictions because of a setcolorspace
    type confusion
    https://bugs.ghostscript.com/show_bug.cgi?id=700169
    https://bugzilla.suse.com/show_bug.cgi?id=1117313 bsc#1117313
  * CVE-2018-19477: psi/zfjbig2.c allows attackers to bypass
    intended access restrictions because of a JBIG2Decode
    type confusion
    https://bugs.ghostscript.com/show_bug.cgi?id=700168
    https://bugzilla.suse.com/show_bug.cgi?id=1117274 bsc#1117274
  * CVE-2018-19409: LockSafetyParams is not checked correctly
    if another device is used
    https://bugs.ghostscript.com/show_bug.cgi?id=700176
    https://bugzilla.suse.com/show_bug.cgi?id=1117022 bsc#1117022
  and those security issues
  * CVE-2018-18284: 1Policy operator gives access to .forceput
    https://bugs.ghostscript.com/show_bug.cgi?id=69963
    https://bugzilla.suse.com/show_bug.cgi?id=1112229 bsc#1112229
  * CVE-2018-18073: saved execution stacks can leak operator arrays
    https://bugs.ghostscript.com/show_bug.cgi?id=699927
    https://bugzilla.suse.com/show_bug.cgi?id=1111480 bsc#1111480
  * CVE-2018-17961: bypassing executeonly to escape -dSAFER sandbox
    https://bugs.ghostscript.com/show_bug.cgi?id=699816
    https://bugzilla.suse.com/show_bug.cgi?id=1111479 bsc#1111479
  * CVE-2018-17183: remote attackers could be able to supply
    crafted PostScript to potentially overwrite or replace
    error handlers to inject code
    https://bugs.ghostscript.com/show_bug.cgi?id=699708
    https://bugzilla.suse.com/show_bug.cgi?id=1109105 bsc#1109105</changelog>
  <changelog author="jsmeix@suse.de" date="1547726400">- Version upgrade to 9.26a
  The version 9.26a is a special security bugfix version to fix
  * CVE-2019-6116: subroutines within pseudo-operators
    must themselves be pseudo-operators
    https://bugs.ghostscript.com/show_bug.cgi?id=700317
    https://bugzilla.suse.com/show_bug.cgi?id=1122319 bsc#1122319</changelog>
  <changelog author="jsmeix@suse.de" date="1552996800">- CVE-2019-3838.patch fixes CVE-2019-3838
  forceput in DefineResource is still accessible
  https://bugzilla.suse.com/show_bug.cgi?id=1129186 bsc#1129186
  https://bugs.ghostscript.com/show_bug.cgi?id=700576</changelog>
  <changelog author="jsmeix@suse.de" date="1554379200">- Version upgrade to 9.27
  Highlights in this release include:
  * We (i.e. Ghostscript upstream) have extensively cleaned up
    the Postscript name space: removing access to internal and/or
    undocumented Postscript operators, procedures and data.
    This has benefits for security and maintainability.
    Incompatible changes:
    The process of "tidying" the Postscript name space should
    have removed only non-standard and undocumented operators.
    Nevertheless, it is possible that any integrations or
    utilities that rely on those non-standard and undocumented
    operators may stop working, or may change behaviour.
    If you encounter such a case, please contact us (i.e.
    Ghostscript upstream) - (either the #ghostscript IRC channel,
    or the gs-devel mailing list would be best), and we'll work
    with you to either find an alternative solution.
  * Fontmap can now reference invidual fonts in a TrueType
    Collection for font subsitution. Previously, a Fontmap entry
    could only reference a TrueType collection and use the default
    (first) font.
    Now, the Fontmap syntax allows for specifying a specific index
    in a TTC. See the comments at the top of (the default)
    Fontmap.GS for details.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  IMPORTANT: It is our intention, within the next 12 months
    (ideally sooner, in time for the next release) to make SAFER
    the default mode of operation. For many users this will have
    no effect, since they use SAFER explicitly, but some niche
    uses which rely on SAFER being disabled may need to start
    explicitly adding the "-dNOSAFER" option.
  IMPORTANT: We (i.e. Ghostscript upstream) are in the process of
    forking LittleCMS. LCMS2 is not thread safe, and cannot be made
    thread safe without breaking the ABI. Our fork will be thread
    safe, and include performance enhancements (these changes have
    all be been offered and rejected upstream). We will maintain
    compatibility between Ghostscript and LCMS2 for a time, but not
    in perpetuity. Our fork will be available as its own package
    separately from Ghostscript (and MuPDF).
  For a release summary see:
  http://www.ghostscript.com/doc/9.27/News.htm
  For details see the News.htm and History9.htm files.
  The Ghostscript 9.27 release should fix (cf. the entry below
  dated 'Fri Sep 14 10:47:33 CEST 2018' what "should fix" means)
  in particular those security issues:
  * CVE-2019-3838 forceput in DefineResource is still accessible
    https://bugzilla.suse.com/show_bug.cgi?id=1129186 bsc#1129186
    https://bugs.ghostscript.com/show_bug.cgi?id=700576
  * CVE-2019-3835: superexec operator is available
    https://bugzilla.suse.com/show_bug.cgi?id=1129180 bsc#1129180
    https://bugs.ghostscript.com/show_bug.cgi?id=700585</changelog>
  <changelog author="werner@suse.de" date="1565611200">- CVE-2019-10216.patch fixes CVE-2019-10216
  forceput/superexec in .buildfont1 is still accessible
  https://bugzilla.suse.com/show_bug.cgi?id=1144621 bsc#1144621
  https://bugs.ghostscript.com/show_bug.cgi?id=701394</changelog>
  <changelog author="werner@suse.de" date="1568376000">- Add patch openjpeg4gs-CVE-2018-6616-8ee33522.patch
  to fix bsc#1140359 for CVE-2019-12973</changelog>
  <changelog author="werner@suse.de" date="1568635200">- Add patch gs-CVE-2019-14811-885444fc.patch to fix bsc#1146882
  for CVE-2019-14811,CVE-2019-14812,CVE-2019-14813
- Add patch gs-CVE-2019-14817-cd1b1cac.patch to fix bsc#1146884
  for CVE-2019-14817</changelog>
  <changelog author="werner@suse.de" date="1568635201">- Port latest ghostscript 9.27 from factory including latest
  security patches to SLES15/SLES12
  * Port patch CVE-2019-10216.patch to 9.27 which is the orignal
    upstream commit now
  * Drop patch CVE-2019-3838.patch as now part of 9.27</changelog>
  <changelog author="jsmeix@suse.de" date="1573473600">- CVE-2019-14869.patch contains commit from Ghostscript upstream
  https://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=485904772c5f
  to fix CVE-2019-14869 "-dSAFER escape in .charkeys"
  (bsc#1156275)</changelog>
  <changelog author="jsmeix@suse.de" date="1588075200">- The version upgrade to 9.52 fixes in particular
  CVE-2020-12268: jbic2dec: heap-based buffer overflow
  in jbig2_image_compose (bsc#1170603)
- Version upgrade to 9.52
  Highlights in this release include:
  * The 9.52 release replaces the 9.51 release after a problem
    was reported with 9.51 which warranted the quick turnaround.
    Thus, like 9.51, 9.52 is primarily a maintenance release,
    consolidating the changes we introduced in 9.50.
  * IMPORTANT: We have forked LittleCMS2 into LittleCMS2mt
    (the "mt" indicating "multi-thread").
    LCMS2 is not thread-safe, and cannot be made thread-safe
    without breaking the ABI. Our fork will be thread-safe and
    include performance enhancements (these changes have all
    been offered and rejected upstream). We will maintain
    compatibility between Ghostscript and LCMS2 for a time,
    but not in perpetuity. If there is sufficient interest,
    our fork will be available as its own package separately
    from Ghostscript (and MuPDF).
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  Incompatible changes:
  * New option -dALLOWPSTRANSPARENCY: The transparency compositor
    (and related features), whilst we are improving it, remains
    sensitive to being driven correctly, and incorrect use
    can have unexpected/undefined results. Hence, as part of
    improving security, we limited access to these operators,
    originally using the -dSAFER feature. As we made "SAFER"
    the default mode, that became unacceptable, hence the
    new option -dALLOWPSTRANSPARENCY which enables access
    to the operators, cf.
    https://www.ghostscript.com/doc/9.52/Use.htm#ALLOWPSTRANSPARENCY
  For a release summary see:
  https://www.ghostscript.com/doc/9.52/News.htm
  For details see the News.htm and History9.htm files.
- Version upgrade to 9.51
  Highlights in this release include:
  * 9.51 is primarily a maintainance release, consolidating
    the changes we introduced in 9.50.
  * We have continued our work on code hygiene for this release,
    with a focus on the static analysis tool Coverity
    (from Synopsys, Inc) and we are now maintaining a policy of
    zero Coverity issues in the Ghostscript/GhostPDL source base.
  * IMPORTANT: In consultation with a representative of
    OpenPrinting (http://www.openprinting.org/) it is our
    intention to deprecate and, in the not distant future,
    remove the OpenPrinting Vector/Raster Printer Drivers
    (that is, the opvp and oprp devices).
    If you rely on either of these devices, please get in touch
    with us (i.e. Ghostscript upstream), so we can discuss your
    use case, and revise our plans accordingly.
  * We (i.e. Ghostscript upstream) are in the process of forking
    LittleCMS, cf. the other release notes entries below.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  For a release summary see:
  https://www.ghostscript.com/doc/9.51/News.htm
  For details see the News.htm and History9.htm files.
- Version upgrade to 9.50
  Highlights in this release include:
  * The change to version 9.50 follows recognition
    of the extent and importance of the file access control
    redesign/reimplementation outlined below.
  * The file access control capability (enable with -dSAFER)
    has been completely rewritten, with a ground-up rethink
    of the design. For more details, see: "SAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#Safer
  * It is important to note that -dSAFER now only enables the
    file access controls, and no longer applies restrictions
    to standard Postscript functionality (specifically,
    restrictions on setpagedevice). If your application relies
    on these Postscript restrictions, see "OLDSAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#OldSafer
    and please get in touch, as we do plan to remove those
    Postscript restrictions unless we have reason not to.
  IMPORTANT: File access controls are now enabled by default.
    In order to run Ghostscript without these controls,
    see "NOSAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#NoSafer
  * We (i.e. Ghostscript upstream) are in the process of forking
    LittleCMS, cf. the other release notes entries below.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  Incompatible changes:
  * There are a couple of subtle incompatibilities between the old
    and new SAFER implementations. Firstly, as mentioned above,
    SAFER now leaves standard Postcript functionality unchanged
    (except for the file access limitations). Secondly, the
    interaction with save/restore operations, see "SAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#Safer
  * The following is not strictly speaking new to 9.50,
    as not much has changed since 9.27 in this area,
    but for those who don't upgrade with every release:
    The process of "tidying" the Postscript name space should have
    removed only non-standard and undocumented operators.
    Nevertheless, it is possible that any integrations or utilities
    that rely on those non-standard and undocumented operators
    may stop working, or may change behaviour.
    If you encounter such a case, please contact us
    (i.e. Ghostscript upstream, either the #ghostscript IRC channel
    or the gs-devel mailing list would be best), and we'll work
    with you to either find an alternative solution or return the
    previous functionality, if there is genuinely no other option.
    One case we know this has occurred is GSView 5 (and earlier).
    GSView 5 support for PDF files relied upon internal use only
    features which are no longer available. GSView 5 will still
    work as previously for Postscript files. For PDF files,
    users are encouraged to look at MuPDF https://www.mupdf.com/
  For a release summary see:
  https://www.ghostscript.com/doc/9.50/News.htm
  For details see the News.htm and History9.htm files.
- CVE-2019-10216.patch CVE-2019-14869.patch
  gs-CVE-2019-14811-885444fc.patch
  gs-CVE-2019-14817-cd1b1cac.patch
  openjpeg4gs-CVE-2018-6616-8ee33522.patch
  are fixed in the version 9.52 upstream sources.</changelog>
  <changelog author="jsmeix@suse.de" date="1595851200">- CVE-2020-15900.patch fixes CVE-2020-15900
  Memory Corruption (SAFER Sandbox Breakout)
  cf. https://bugs.ghostscript.com/show_bug.cgi?id=702582
  (bsc#1174415)</changelog>
  <changelog author="wolfgang.frisch@suse.com" date="1619006400">- Hardening: link as position independent executable (bsc#1184123).</changelog>
  <changelog author="jsmeix@suse.de" date="1631275200">- CVE-2021-3781.patch fixes CVE-2021-3781
  Trivial -dSAFER bypass
  cf. https://bugs.ghostscript.com/show_bug.cgi?id=704342
  (bsc#1190381)</changelog>
  <changelog author="werner@suse.de" date="1632916800">- Use update-alternatives to get the real ghostscript binary from
  /usr/bin/gs to /usr/bin/gs.bin and allow the gswrap package to
  use this with its wrapper script (jira#PM-3037)</changelog>
</package>
<package pkgid="1b231dd1d95f6176c7ba5b4e72d57493dd5202e153c55b6f8c0d7ca7187e88e9" name="ghostscript-devel" arch="ppc64le">
  <version epoch="0" ver="9.52" rel="158.1"/>
  <changelog author="jsmeix@suse.de" date="1521720000">- Version upgrade to 9.23
  Highlights in this release include:
  * Ghostscript now has a family of 'pdfimage' devices
    (pdfimage8, pdfimage24 and pdfimage32) which produce
    rendered output wrapped up as an image in a PDF.
    Additionally, there is a 'pclm' device which
    produces PCLm format output.
  * There is now a ColorAccuracy parameter allowing the user
    to decide between speed or accuracy in ICC color transforms.
  * JPEG Passthrough: devices which support it can now receive
    the 'raw' JPEG stream from the interpreter.
    The main use of this is the pdfwrite/ps2write family of devices
    that can now take JPEG streams from the input file(s) and write
    them unchanged to the output (thus avoiding additional
    quantization effects).
  * PDF transparency performance improvements
  * IMPORTANT: We (i.e. Ghostscript upstream) are in the process
    of forking LittleCMS.
    LCMS2 is not thread safe, and cannot be made thread safe
    without breaking the ABI. Our fork will be thread safe,
    and include performance enhancements (these changes have all
    be been offered and rejected upstream). We will maintain
    compatibility between Ghostscript and LCMS2 for a time,
    but not in perpetuity. Our fork will be available as its own
    package separately from Ghostscript (and MuPDF).
  * We have continued the focus on code hygiene in this release
    cleaning up security issues, ignored return values,
    and compiler warnings.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  Incompatible changes
  * The planned device API tidy has, unfortunately, been
    indefinitely postponed, until appropriate resources
    are available.
  For a release summary see:
  http://www.ghostscript.com/doc/9.23/News.htm
  For details see the News.htm and History9.htm files.
  See also the entries below since "Version upgrade to 9.22"
  (boo#1082896 and boo#1074266).</changelog>
  <changelog author="jsmeix@suse.de" date="1528200000">- CVE-2018-10194.patch fixes stack-based buffer overflow
  in gdevpdts.c (bsc#1090099), see
  https://bugs.ghostscript.com/show_bug.cgi?id=699255 and
  http://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=39b1e54b2968620723bf32e96764c88797714879</changelog>
  <changelog author="jsmeix@suse.de" date="1536840000">- Version upgrade to 9.24
  Highlights in this release include:
  * Security issues have been the primary focus of this release,
    including solving several (well publicised)
    real and potential exploits.
    PLEASE NOTE:
    We (i.e. Ghostscript upstream) strongly urge users to upgrade
    to this latest release to avoid these issues.
  * As well as Ghostscript itself, jbig2dec has had a significant
    amount of work improving its robustness in the face of
    out specification files.
  * IMPORTANT: We (i.e. Ghostscript upstream) are in the process
    of forking LittleCMS. LCMS2 is not thread safe, and cannot
    be made thread safe without breaking the ABI. Our fork
    will be thread safe, and include performance enhancements
    (these changes have all be been offered and rejected upstream).
    We will maintain compatibility between Ghostscript and LCMS2
    for a time, but not in perpetuity. Our fork will be available
    as its own package separately from Ghostscript (and MuPDF).
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  For a release summary see:
  http://www.ghostscript.com/doc/9.24/News.htm
  For details see the News.htm and History9.htm files.
- fix_ln_docdir_gsdatadir.patch is no longer needed
  because the issue is fixed in the upstream sources.
- CVE-2018-10194.patch is no longer needed
  because the issue is fixed in the upstream sources.</changelog>
  <changelog author="jsmeix@suse.de" date="1536840001">- Version upgrade to 9.25rc1 (first release candidate for 9.25).
  Highlights in this release include:
  * This release fixes problems with argument handling, some
    unintended results of the security fixes to the SAFER file
    access restrictions (specifically accessing ICC profile files),
    and some additional security issues over the 9.24 release.
  * Security issues have been the primary focus of this release,
    including solving several (well publicised) real
    and potential exploits.
    PLEASE NOTE:
    We (i.e. Ghostscript upstream) strongly urge users to upgrade
    to this latest release to avoid these issues.
  * Avoid that ps2epsi fails with
    'Error: /undefined in --setpagedevice--'
    Recent changes required to harden SAFER mode mean that
    it is no longer possible to run ps2epsi in SAFER mode,
    because it relies upon unsafe Ghostscript non-standard
    extension operators.
    Removing SAFER and DELAYSAFER, and the code to reset SAFER,
    allow ps2epsi to run as well as it ever did (ie badly).
    This program (i.e. ps2epsi) should now be considered unsafe,
    you should not use it on untrusted PostScript programs.
    Likely we (i.e. Ghostscript upstream) will deprecate and
    remove this program in future.
  For details see the News.htm and History9.htm files.
  Regarding installing packages (in particular release candidates)
  from the openSUSE build service development project "Printing"
  see https://build.opensuse.org/project/show/Printing</changelog>
  <changelog author="jsmeix@suse.de" date="1536926400">- Version upgrade to 9.25
  For the highlights in this release see the highlights in the
  9.25rc1 first release candidate for 9.25 entry below.
  PLEASE NOTE:
  We (i.e. Ghostscript upstream) strongly urge users to upgrade
  to this latest release to avoid these issues.
  For a release summary see:
  http://www.ghostscript.com/doc/9.25/News.htm
  For details see the News.htm and History9.htm files.
  The Ghostscript 9.25 release should fix (see below)
  in particular those security issues:
  * CVE-2018-15909: shading_param incomplete type checking
    https://bugs.ghostscript.com/show_bug.cgi?id=699660
    https://bugzilla.suse.com/show_bug.cgi?id=1106172 bsc#1106172
  * CVE-2018-15908: .tempfile file permission issues
    https://bugs.ghostscript.com/show_bug.cgi?id=699657
    https://bugzilla.suse.com/show_bug.cgi?id=1106171 bsc#1106171
  * CVE-2018-15910: LockDistillerParams type confusion
    https://bugs.ghostscript.com/show_bug.cgi?id=699656
    https://bugzilla.suse.com/show_bug.cgi?id=1106173 bsc#1106173
  * CVE-2018-15911: uninitialized memory access in the aesdecode
    https://bugs.ghostscript.com/show_bug.cgi?id=699665
    https://bugzilla.suse.com/show_bug.cgi?id=1106195 bsc#1106195
  * CVE-2018-16513: setcolor missing type check
    https://bugs.ghostscript.com/show_bug.cgi?id=699655
    https://bugzilla.suse.com/show_bug.cgi?id=1107412 bsc#1107412
  * CVE-2018-16509: /invalidaccess bypass after failed restore
    https://bugs.ghostscript.com/show_bug.cgi?id=699654
    https://bugzilla.suse.com/show_bug.cgi?id=1107410 bsc#1107410
  * CVE-2018-16510: Incorrect exec stack handling in the "CS"
    and "SC" PDF primitives
    https://bugs.ghostscript.com/show_bug.cgi?id=699671
    https://bugzilla.suse.com/show_bug.cgi?id=1107411 bsc#1107411
  * CVE-2018-16542: .definemodifiedfont memory corruption
    if /typecheck is handled
    https://bugs.ghostscript.com/show_bug.cgi?id=699668
    https://bugzilla.suse.com/show_bug.cgi?id=1107413 bsc#1107413
  * CVE-2018-16541 incorrect free logic in pagedevice replacement
    https://bugs.ghostscript.com/show_bug.cgi?id=699664
    https://bugzilla.suse.com/show_bug.cgi?id=1107421 bsc#1107421
  * CVE-2018-16540 use-after-free in copydevice handling
    https://bugs.ghostscript.com/show_bug.cgi?id=699661
    https://bugzilla.suse.com/show_bug.cgi?id=1107420 bsc#1107420
  * CVE-2018-16539: incorrect access checking in temp file
    handling to disclose contents of files
    https://bugs.ghostscript.com/show_bug.cgi?id=699658
    https://bugzilla.suse.com/show_bug.cgi?id=1107422 bsc#1107422
  * CVE-2018-16543: gssetresolution and gsgetresolution allow
    for unspecified impact
    https://bugs.ghostscript.com/show_bug.cgi?id=699670
    https://bugzilla.suse.com/show_bug.cgi?id=1107423 bsc#1107423
  * CVE-2018-16511: type confusion in "ztype" could be used by
    remote attackers able to supply crafted PostScript to crash
    the interpreter or possibly have unspecified other impact
    https://bugs.ghostscript.com/show_bug.cgi?id=699659
    https://bugzilla.suse.com/show_bug.cgi?id=1107426 bsc#1107426
  * CVE-2018-16585 .setdistillerkeys PostScript command is
    accepted even though it is not intended for use
    https://bugzilla.suse.com/show_bug.cgi?id=1107581 bsc#1107581
  * CVE-2018-16802: Incorrect"restoration of privilege" checking
    when running out of stack during exceptionhandling could be
    used by attackers able to supply crafted PostScript to execute
    code using the "pipe" instruction. This is due to an incomplete
    fix for CVE-2018-16509
    https://bugs.ghostscript.com/show_bug.cgi?id=699714
    https://bugs.ghostscript.com/show_bug.cgi?id=699718
    https://bugzilla.suse.com/show_bug.cgi?id=1108027 bnc#1108027
  Regarding what the above "should fix" means:
  PostScript is a general purpose Turing-complete programming
  language (cf. https://en.wikipedia.org/wiki/PostScript)
  that supports in particular file access on the system disk.
  When Ghostscript processes PostScript it runs a PostScript
  program as the user who runs Ghostscript.
  When Ghostscript processes an arbitrary PostScript file,
  the user who runs Ghostscript runs an arbitrary program
  which can do anything on the system where Ghostscript runs
  that this user is allowed to do on that system.
  To make it safer when Ghostscript runs a PostScript program
  the Ghostscript command line option '-dSAFER' disables
  certain file access functionality, for details see
  /usr/share/doc/ghostscript/9.25/Use.htm
  Its name 'SAFER' says everything: It makes it 'safer'
  to let Ghostscript run a PostScript program,
  but it does not make it completely safe.
  In theory software is safe against misuse (i.e. has no bugs).
  In practice there is an endless sequence of various kind of
  security issues (i.e. software can be misused to do more than
  what is intended) that get fixed issue by issue ad infinitum.
  In the end all that means:
  In practice the user who runs Ghostscript must not let it
  process arbitrary PostScript files from untrusted origin.
  In particular Ghostscript is usually run when printing
  documents (with the '-dSAFER' option set), see the part about
  "It is crucial to limit access to CUPS to trusted users" in
  https://en.opensuse.org/SDB:CUPS_and_SANE_Firewall_settings</changelog>
  <changelog author="jsmeix@suse.de" date="1541764800">- Version upgrade to 9.26rc1 (first release candidate for 9.26).
  Highlights in this release include:
  * Purely security and a few bug fixes, there are no new features,
    and no API changes to report.</changelog>
  <changelog author="jsmeix@suse.de" date="1543579200">- Version upgrade to 9.26
  Highlights in this release include:
  * Security issues have been the primary focus of this release,
    including solving several (well publicised) real and potential
    exploits.
    Thanks to Man Yue Mo of Semmle Security Research Team,
    Jens Mueller of Ruhr-Universitaet Bochum and
    Tavis Ormandy of Google's Project Zero
    for their help to identify specific security issues.
    PLEASE NOTE:
    We (i.e. Ghostscript upstream) strongly urge users to upgrade
    to this latest release to avoid these issues.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  For a release summary see:
  http://www.ghostscript.com/doc/9.26/News.htm
  For details see the News.htm and History9.htm files.
  The Ghostscript 9.26 release should fix (cf. the entry below
  dated 'Fri Sep 14 10:47:33 CEST 2018' what "should fix" means)
  in particular those security issues (bsc#1117331)
  * CVE-2018-19475: psi/zdevice2.c allows attackers to bypass
    intended access restrictions
    https://bugs.ghostscript.com/show_bug.cgi?id=700153
    https://bugzilla.suse.com/show_bug.cgi?id=1117327 bsc#1117327
  * CVE-2018-19476: psi/zicc.c allows attackers to bypass
    intended access restrictions because of a setcolorspace
    type confusion
    https://bugs.ghostscript.com/show_bug.cgi?id=700169
    https://bugzilla.suse.com/show_bug.cgi?id=1117313 bsc#1117313
  * CVE-2018-19477: psi/zfjbig2.c allows attackers to bypass
    intended access restrictions because of a JBIG2Decode
    type confusion
    https://bugs.ghostscript.com/show_bug.cgi?id=700168
    https://bugzilla.suse.com/show_bug.cgi?id=1117274 bsc#1117274
  * CVE-2018-19409: LockSafetyParams is not checked correctly
    if another device is used
    https://bugs.ghostscript.com/show_bug.cgi?id=700176
    https://bugzilla.suse.com/show_bug.cgi?id=1117022 bsc#1117022
  and those security issues
  * CVE-2018-18284: 1Policy operator gives access to .forceput
    https://bugs.ghostscript.com/show_bug.cgi?id=69963
    https://bugzilla.suse.com/show_bug.cgi?id=1112229 bsc#1112229
  * CVE-2018-18073: saved execution stacks can leak operator arrays
    https://bugs.ghostscript.com/show_bug.cgi?id=699927
    https://bugzilla.suse.com/show_bug.cgi?id=1111480 bsc#1111480
  * CVE-2018-17961: bypassing executeonly to escape -dSAFER sandbox
    https://bugs.ghostscript.com/show_bug.cgi?id=699816
    https://bugzilla.suse.com/show_bug.cgi?id=1111479 bsc#1111479
  * CVE-2018-17183: remote attackers could be able to supply
    crafted PostScript to potentially overwrite or replace
    error handlers to inject code
    https://bugs.ghostscript.com/show_bug.cgi?id=699708
    https://bugzilla.suse.com/show_bug.cgi?id=1109105 bsc#1109105</changelog>
  <changelog author="jsmeix@suse.de" date="1547726400">- Version upgrade to 9.26a
  The version 9.26a is a special security bugfix version to fix
  * CVE-2019-6116: subroutines within pseudo-operators
    must themselves be pseudo-operators
    https://bugs.ghostscript.com/show_bug.cgi?id=700317
    https://bugzilla.suse.com/show_bug.cgi?id=1122319 bsc#1122319</changelog>
  <changelog author="jsmeix@suse.de" date="1552996800">- CVE-2019-3838.patch fixes CVE-2019-3838
  forceput in DefineResource is still accessible
  https://bugzilla.suse.com/show_bug.cgi?id=1129186 bsc#1129186
  https://bugs.ghostscript.com/show_bug.cgi?id=700576</changelog>
  <changelog author="jsmeix@suse.de" date="1554379200">- Version upgrade to 9.27
  Highlights in this release include:
  * We (i.e. Ghostscript upstream) have extensively cleaned up
    the Postscript name space: removing access to internal and/or
    undocumented Postscript operators, procedures and data.
    This has benefits for security and maintainability.
    Incompatible changes:
    The process of "tidying" the Postscript name space should
    have removed only non-standard and undocumented operators.
    Nevertheless, it is possible that any integrations or
    utilities that rely on those non-standard and undocumented
    operators may stop working, or may change behaviour.
    If you encounter such a case, please contact us (i.e.
    Ghostscript upstream) - (either the #ghostscript IRC channel,
    or the gs-devel mailing list would be best), and we'll work
    with you to either find an alternative solution.
  * Fontmap can now reference invidual fonts in a TrueType
    Collection for font subsitution. Previously, a Fontmap entry
    could only reference a TrueType collection and use the default
    (first) font.
    Now, the Fontmap syntax allows for specifying a specific index
    in a TTC. See the comments at the top of (the default)
    Fontmap.GS for details.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  IMPORTANT: It is our intention, within the next 12 months
    (ideally sooner, in time for the next release) to make SAFER
    the default mode of operation. For many users this will have
    no effect, since they use SAFER explicitly, but some niche
    uses which rely on SAFER being disabled may need to start
    explicitly adding the "-dNOSAFER" option.
  IMPORTANT: We (i.e. Ghostscript upstream) are in the process of
    forking LittleCMS. LCMS2 is not thread safe, and cannot be made
    thread safe without breaking the ABI. Our fork will be thread
    safe, and include performance enhancements (these changes have
    all be been offered and rejected upstream). We will maintain
    compatibility between Ghostscript and LCMS2 for a time, but not
    in perpetuity. Our fork will be available as its own package
    separately from Ghostscript (and MuPDF).
  For a release summary see:
  http://www.ghostscript.com/doc/9.27/News.htm
  For details see the News.htm and History9.htm files.
  The Ghostscript 9.27 release should fix (cf. the entry below
  dated 'Fri Sep 14 10:47:33 CEST 2018' what "should fix" means)
  in particular those security issues:
  * CVE-2019-3838 forceput in DefineResource is still accessible
    https://bugzilla.suse.com/show_bug.cgi?id=1129186 bsc#1129186
    https://bugs.ghostscript.com/show_bug.cgi?id=700576
  * CVE-2019-3835: superexec operator is available
    https://bugzilla.suse.com/show_bug.cgi?id=1129180 bsc#1129180
    https://bugs.ghostscript.com/show_bug.cgi?id=700585</changelog>
  <changelog author="werner@suse.de" date="1565611200">- CVE-2019-10216.patch fixes CVE-2019-10216
  forceput/superexec in .buildfont1 is still accessible
  https://bugzilla.suse.com/show_bug.cgi?id=1144621 bsc#1144621
  https://bugs.ghostscript.com/show_bug.cgi?id=701394</changelog>
  <changelog author="werner@suse.de" date="1568376000">- Add patch openjpeg4gs-CVE-2018-6616-8ee33522.patch
  to fix bsc#1140359 for CVE-2019-12973</changelog>
  <changelog author="werner@suse.de" date="1568635200">- Add patch gs-CVE-2019-14811-885444fc.patch to fix bsc#1146882
  for CVE-2019-14811,CVE-2019-14812,CVE-2019-14813
- Add patch gs-CVE-2019-14817-cd1b1cac.patch to fix bsc#1146884
  for CVE-2019-14817</changelog>
  <changelog author="werner@suse.de" date="1568635201">- Port latest ghostscript 9.27 from factory including latest
  security patches to SLES15/SLES12
  * Port patch CVE-2019-10216.patch to 9.27 which is the orignal
    upstream commit now
  * Drop patch CVE-2019-3838.patch as now part of 9.27</changelog>
  <changelog author="jsmeix@suse.de" date="1573473600">- CVE-2019-14869.patch contains commit from Ghostscript upstream
  https://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=485904772c5f
  to fix CVE-2019-14869 "-dSAFER escape in .charkeys"
  (bsc#1156275)</changelog>
  <changelog author="jsmeix@suse.de" date="1588075200">- The version upgrade to 9.52 fixes in particular
  CVE-2020-12268: jbic2dec: heap-based buffer overflow
  in jbig2_image_compose (bsc#1170603)
- Version upgrade to 9.52
  Highlights in this release include:
  * The 9.52 release replaces the 9.51 release after a problem
    was reported with 9.51 which warranted the quick turnaround.
    Thus, like 9.51, 9.52 is primarily a maintenance release,
    consolidating the changes we introduced in 9.50.
  * IMPORTANT: We have forked LittleCMS2 into LittleCMS2mt
    (the "mt" indicating "multi-thread").
    LCMS2 is not thread-safe, and cannot be made thread-safe
    without breaking the ABI. Our fork will be thread-safe and
    include performance enhancements (these changes have all
    been offered and rejected upstream). We will maintain
    compatibility between Ghostscript and LCMS2 for a time,
    but not in perpetuity. If there is sufficient interest,
    our fork will be available as its own package separately
    from Ghostscript (and MuPDF).
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  Incompatible changes:
  * New option -dALLOWPSTRANSPARENCY: The transparency compositor
    (and related features), whilst we are improving it, remains
    sensitive to being driven correctly, and incorrect use
    can have unexpected/undefined results. Hence, as part of
    improving security, we limited access to these operators,
    originally using the -dSAFER feature. As we made "SAFER"
    the default mode, that became unacceptable, hence the
    new option -dALLOWPSTRANSPARENCY which enables access
    to the operators, cf.
    https://www.ghostscript.com/doc/9.52/Use.htm#ALLOWPSTRANSPARENCY
  For a release summary see:
  https://www.ghostscript.com/doc/9.52/News.htm
  For details see the News.htm and History9.htm files.
- Version upgrade to 9.51
  Highlights in this release include:
  * 9.51 is primarily a maintainance release, consolidating
    the changes we introduced in 9.50.
  * We have continued our work on code hygiene for this release,
    with a focus on the static analysis tool Coverity
    (from Synopsys, Inc) and we are now maintaining a policy of
    zero Coverity issues in the Ghostscript/GhostPDL source base.
  * IMPORTANT: In consultation with a representative of
    OpenPrinting (http://www.openprinting.org/) it is our
    intention to deprecate and, in the not distant future,
    remove the OpenPrinting Vector/Raster Printer Drivers
    (that is, the opvp and oprp devices).
    If you rely on either of these devices, please get in touch
    with us (i.e. Ghostscript upstream), so we can discuss your
    use case, and revise our plans accordingly.
  * We (i.e. Ghostscript upstream) are in the process of forking
    LittleCMS, cf. the other release notes entries below.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  For a release summary see:
  https://www.ghostscript.com/doc/9.51/News.htm
  For details see the News.htm and History9.htm files.
- Version upgrade to 9.50
  Highlights in this release include:
  * The change to version 9.50 follows recognition
    of the extent and importance of the file access control
    redesign/reimplementation outlined below.
  * The file access control capability (enable with -dSAFER)
    has been completely rewritten, with a ground-up rethink
    of the design. For more details, see: "SAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#Safer
  * It is important to note that -dSAFER now only enables the
    file access controls, and no longer applies restrictions
    to standard Postscript functionality (specifically,
    restrictions on setpagedevice). If your application relies
    on these Postscript restrictions, see "OLDSAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#OldSafer
    and please get in touch, as we do plan to remove those
    Postscript restrictions unless we have reason not to.
  IMPORTANT: File access controls are now enabled by default.
    In order to run Ghostscript without these controls,
    see "NOSAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#NoSafer
  * We (i.e. Ghostscript upstream) are in the process of forking
    LittleCMS, cf. the other release notes entries below.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  Incompatible changes:
  * There are a couple of subtle incompatibilities between the old
    and new SAFER implementations. Firstly, as mentioned above,
    SAFER now leaves standard Postcript functionality unchanged
    (except for the file access limitations). Secondly, the
    interaction with save/restore operations, see "SAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#Safer
  * The following is not strictly speaking new to 9.50,
    as not much has changed since 9.27 in this area,
    but for those who don't upgrade with every release:
    The process of "tidying" the Postscript name space should have
    removed only non-standard and undocumented operators.
    Nevertheless, it is possible that any integrations or utilities
    that rely on those non-standard and undocumented operators
    may stop working, or may change behaviour.
    If you encounter such a case, please contact us
    (i.e. Ghostscript upstream, either the #ghostscript IRC channel
    or the gs-devel mailing list would be best), and we'll work
    with you to either find an alternative solution or return the
    previous functionality, if there is genuinely no other option.
    One case we know this has occurred is GSView 5 (and earlier).
    GSView 5 support for PDF files relied upon internal use only
    features which are no longer available. GSView 5 will still
    work as previously for Postscript files. For PDF files,
    users are encouraged to look at MuPDF https://www.mupdf.com/
  For a release summary see:
  https://www.ghostscript.com/doc/9.50/News.htm
  For details see the News.htm and History9.htm files.
- CVE-2019-10216.patch CVE-2019-14869.patch
  gs-CVE-2019-14811-885444fc.patch
  gs-CVE-2019-14817-cd1b1cac.patch
  openjpeg4gs-CVE-2018-6616-8ee33522.patch
  are fixed in the version 9.52 upstream sources.</changelog>
  <changelog author="jsmeix@suse.de" date="1595851200">- CVE-2020-15900.patch fixes CVE-2020-15900
  Memory Corruption (SAFER Sandbox Breakout)
  cf. https://bugs.ghostscript.com/show_bug.cgi?id=702582
  (bsc#1174415)</changelog>
  <changelog author="wolfgang.frisch@suse.com" date="1619006400">- Hardening: link as position independent executable (bsc#1184123).</changelog>
  <changelog author="jsmeix@suse.de" date="1631275200">- CVE-2021-3781.patch fixes CVE-2021-3781
  Trivial -dSAFER bypass
  cf. https://bugs.ghostscript.com/show_bug.cgi?id=704342
  (bsc#1190381)</changelog>
  <changelog author="werner@suse.de" date="1632916800">- Use update-alternatives to get the real ghostscript binary from
  /usr/bin/gs to /usr/bin/gs.bin and allow the gswrap package to
  use this with its wrapper script (jira#PM-3037)</changelog>
</package>
<package pkgid="4e96473a7b52bc094ef5bd6a573408220796040cdd6792a579a3cb605ffbd290" name="ghostscript-devel" arch="s390x">
  <version epoch="0" ver="9.52" rel="158.1"/>
  <changelog author="jsmeix@suse.de" date="1521720000">- Version upgrade to 9.23
  Highlights in this release include:
  * Ghostscript now has a family of 'pdfimage' devices
    (pdfimage8, pdfimage24 and pdfimage32) which produce
    rendered output wrapped up as an image in a PDF.
    Additionally, there is a 'pclm' device which
    produces PCLm format output.
  * There is now a ColorAccuracy parameter allowing the user
    to decide between speed or accuracy in ICC color transforms.
  * JPEG Passthrough: devices which support it can now receive
    the 'raw' JPEG stream from the interpreter.
    The main use of this is the pdfwrite/ps2write family of devices
    that can now take JPEG streams from the input file(s) and write
    them unchanged to the output (thus avoiding additional
    quantization effects).
  * PDF transparency performance improvements
  * IMPORTANT: We (i.e. Ghostscript upstream) are in the process
    of forking LittleCMS.
    LCMS2 is not thread safe, and cannot be made thread safe
    without breaking the ABI. Our fork will be thread safe,
    and include performance enhancements (these changes have all
    be been offered and rejected upstream). We will maintain
    compatibility between Ghostscript and LCMS2 for a time,
    but not in perpetuity. Our fork will be available as its own
    package separately from Ghostscript (and MuPDF).
  * We have continued the focus on code hygiene in this release
    cleaning up security issues, ignored return values,
    and compiler warnings.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  Incompatible changes
  * The planned device API tidy has, unfortunately, been
    indefinitely postponed, until appropriate resources
    are available.
  For a release summary see:
  http://www.ghostscript.com/doc/9.23/News.htm
  For details see the News.htm and History9.htm files.
  See also the entries below since "Version upgrade to 9.22"
  (boo#1082896 and boo#1074266).</changelog>
  <changelog author="jsmeix@suse.de" date="1528200000">- CVE-2018-10194.patch fixes stack-based buffer overflow
  in gdevpdts.c (bsc#1090099), see
  https://bugs.ghostscript.com/show_bug.cgi?id=699255 and
  http://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=39b1e54b2968620723bf32e96764c88797714879</changelog>
  <changelog author="jsmeix@suse.de" date="1536840000">- Version upgrade to 9.24
  Highlights in this release include:
  * Security issues have been the primary focus of this release,
    including solving several (well publicised)
    real and potential exploits.
    PLEASE NOTE:
    We (i.e. Ghostscript upstream) strongly urge users to upgrade
    to this latest release to avoid these issues.
  * As well as Ghostscript itself, jbig2dec has had a significant
    amount of work improving its robustness in the face of
    out specification files.
  * IMPORTANT: We (i.e. Ghostscript upstream) are in the process
    of forking LittleCMS. LCMS2 is not thread safe, and cannot
    be made thread safe without breaking the ABI. Our fork
    will be thread safe, and include performance enhancements
    (these changes have all be been offered and rejected upstream).
    We will maintain compatibility between Ghostscript and LCMS2
    for a time, but not in perpetuity. Our fork will be available
    as its own package separately from Ghostscript (and MuPDF).
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  For a release summary see:
  http://www.ghostscript.com/doc/9.24/News.htm
  For details see the News.htm and History9.htm files.
- fix_ln_docdir_gsdatadir.patch is no longer needed
  because the issue is fixed in the upstream sources.
- CVE-2018-10194.patch is no longer needed
  because the issue is fixed in the upstream sources.</changelog>
  <changelog author="jsmeix@suse.de" date="1536840001">- Version upgrade to 9.25rc1 (first release candidate for 9.25).
  Highlights in this release include:
  * This release fixes problems with argument handling, some
    unintended results of the security fixes to the SAFER file
    access restrictions (specifically accessing ICC profile files),
    and some additional security issues over the 9.24 release.
  * Security issues have been the primary focus of this release,
    including solving several (well publicised) real
    and potential exploits.
    PLEASE NOTE:
    We (i.e. Ghostscript upstream) strongly urge users to upgrade
    to this latest release to avoid these issues.
  * Avoid that ps2epsi fails with
    'Error: /undefined in --setpagedevice--'
    Recent changes required to harden SAFER mode mean that
    it is no longer possible to run ps2epsi in SAFER mode,
    because it relies upon unsafe Ghostscript non-standard
    extension operators.
    Removing SAFER and DELAYSAFER, and the code to reset SAFER,
    allow ps2epsi to run as well as it ever did (ie badly).
    This program (i.e. ps2epsi) should now be considered unsafe,
    you should not use it on untrusted PostScript programs.
    Likely we (i.e. Ghostscript upstream) will deprecate and
    remove this program in future.
  For details see the News.htm and History9.htm files.
  Regarding installing packages (in particular release candidates)
  from the openSUSE build service development project "Printing"
  see https://build.opensuse.org/project/show/Printing</changelog>
  <changelog author="jsmeix@suse.de" date="1536926400">- Version upgrade to 9.25
  For the highlights in this release see the highlights in the
  9.25rc1 first release candidate for 9.25 entry below.
  PLEASE NOTE:
  We (i.e. Ghostscript upstream) strongly urge users to upgrade
  to this latest release to avoid these issues.
  For a release summary see:
  http://www.ghostscript.com/doc/9.25/News.htm
  For details see the News.htm and History9.htm files.
  The Ghostscript 9.25 release should fix (see below)
  in particular those security issues:
  * CVE-2018-15909: shading_param incomplete type checking
    https://bugs.ghostscript.com/show_bug.cgi?id=699660
    https://bugzilla.suse.com/show_bug.cgi?id=1106172 bsc#1106172
  * CVE-2018-15908: .tempfile file permission issues
    https://bugs.ghostscript.com/show_bug.cgi?id=699657
    https://bugzilla.suse.com/show_bug.cgi?id=1106171 bsc#1106171
  * CVE-2018-15910: LockDistillerParams type confusion
    https://bugs.ghostscript.com/show_bug.cgi?id=699656
    https://bugzilla.suse.com/show_bug.cgi?id=1106173 bsc#1106173
  * CVE-2018-15911: uninitialized memory access in the aesdecode
    https://bugs.ghostscript.com/show_bug.cgi?id=699665
    https://bugzilla.suse.com/show_bug.cgi?id=1106195 bsc#1106195
  * CVE-2018-16513: setcolor missing type check
    https://bugs.ghostscript.com/show_bug.cgi?id=699655
    https://bugzilla.suse.com/show_bug.cgi?id=1107412 bsc#1107412
  * CVE-2018-16509: /invalidaccess bypass after failed restore
    https://bugs.ghostscript.com/show_bug.cgi?id=699654
    https://bugzilla.suse.com/show_bug.cgi?id=1107410 bsc#1107410
  * CVE-2018-16510: Incorrect exec stack handling in the "CS"
    and "SC" PDF primitives
    https://bugs.ghostscript.com/show_bug.cgi?id=699671
    https://bugzilla.suse.com/show_bug.cgi?id=1107411 bsc#1107411
  * CVE-2018-16542: .definemodifiedfont memory corruption
    if /typecheck is handled
    https://bugs.ghostscript.com/show_bug.cgi?id=699668
    https://bugzilla.suse.com/show_bug.cgi?id=1107413 bsc#1107413
  * CVE-2018-16541 incorrect free logic in pagedevice replacement
    https://bugs.ghostscript.com/show_bug.cgi?id=699664
    https://bugzilla.suse.com/show_bug.cgi?id=1107421 bsc#1107421
  * CVE-2018-16540 use-after-free in copydevice handling
    https://bugs.ghostscript.com/show_bug.cgi?id=699661
    https://bugzilla.suse.com/show_bug.cgi?id=1107420 bsc#1107420
  * CVE-2018-16539: incorrect access checking in temp file
    handling to disclose contents of files
    https://bugs.ghostscript.com/show_bug.cgi?id=699658
    https://bugzilla.suse.com/show_bug.cgi?id=1107422 bsc#1107422
  * CVE-2018-16543: gssetresolution and gsgetresolution allow
    for unspecified impact
    https://bugs.ghostscript.com/show_bug.cgi?id=699670
    https://bugzilla.suse.com/show_bug.cgi?id=1107423 bsc#1107423
  * CVE-2018-16511: type confusion in "ztype" could be used by
    remote attackers able to supply crafted PostScript to crash
    the interpreter or possibly have unspecified other impact
    https://bugs.ghostscript.com/show_bug.cgi?id=699659
    https://bugzilla.suse.com/show_bug.cgi?id=1107426 bsc#1107426
  * CVE-2018-16585 .setdistillerkeys PostScript command is
    accepted even though it is not intended for use
    https://bugzilla.suse.com/show_bug.cgi?id=1107581 bsc#1107581
  * CVE-2018-16802: Incorrect"restoration of privilege" checking
    when running out of stack during exceptionhandling could be
    used by attackers able to supply crafted PostScript to execute
    code using the "pipe" instruction. This is due to an incomplete
    fix for CVE-2018-16509
    https://bugs.ghostscript.com/show_bug.cgi?id=699714
    https://bugs.ghostscript.com/show_bug.cgi?id=699718
    https://bugzilla.suse.com/show_bug.cgi?id=1108027 bnc#1108027
  Regarding what the above "should fix" means:
  PostScript is a general purpose Turing-complete programming
  language (cf. https://en.wikipedia.org/wiki/PostScript)
  that supports in particular file access on the system disk.
  When Ghostscript processes PostScript it runs a PostScript
  program as the user who runs Ghostscript.
  When Ghostscript processes an arbitrary PostScript file,
  the user who runs Ghostscript runs an arbitrary program
  which can do anything on the system where Ghostscript runs
  that this user is allowed to do on that system.
  To make it safer when Ghostscript runs a PostScript program
  the Ghostscript command line option '-dSAFER' disables
  certain file access functionality, for details see
  /usr/share/doc/ghostscript/9.25/Use.htm
  Its name 'SAFER' says everything: It makes it 'safer'
  to let Ghostscript run a PostScript program,
  but it does not make it completely safe.
  In theory software is safe against misuse (i.e. has no bugs).
  In practice there is an endless sequence of various kind of
  security issues (i.e. software can be misused to do more than
  what is intended) that get fixed issue by issue ad infinitum.
  In the end all that means:
  In practice the user who runs Ghostscript must not let it
  process arbitrary PostScript files from untrusted origin.
  In particular Ghostscript is usually run when printing
  documents (with the '-dSAFER' option set), see the part about
  "It is crucial to limit access to CUPS to trusted users" in
  https://en.opensuse.org/SDB:CUPS_and_SANE_Firewall_settings</changelog>
  <changelog author="jsmeix@suse.de" date="1541764800">- Version upgrade to 9.26rc1 (first release candidate for 9.26).
  Highlights in this release include:
  * Purely security and a few bug fixes, there are no new features,
    and no API changes to report.</changelog>
  <changelog author="jsmeix@suse.de" date="1543579200">- Version upgrade to 9.26
  Highlights in this release include:
  * Security issues have been the primary focus of this release,
    including solving several (well publicised) real and potential
    exploits.
    Thanks to Man Yue Mo of Semmle Security Research Team,
    Jens Mueller of Ruhr-Universitaet Bochum and
    Tavis Ormandy of Google's Project Zero
    for their help to identify specific security issues.
    PLEASE NOTE:
    We (i.e. Ghostscript upstream) strongly urge users to upgrade
    to this latest release to avoid these issues.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  For a release summary see:
  http://www.ghostscript.com/doc/9.26/News.htm
  For details see the News.htm and History9.htm files.
  The Ghostscript 9.26 release should fix (cf. the entry below
  dated 'Fri Sep 14 10:47:33 CEST 2018' what "should fix" means)
  in particular those security issues (bsc#1117331)
  * CVE-2018-19475: psi/zdevice2.c allows attackers to bypass
    intended access restrictions
    https://bugs.ghostscript.com/show_bug.cgi?id=700153
    https://bugzilla.suse.com/show_bug.cgi?id=1117327 bsc#1117327
  * CVE-2018-19476: psi/zicc.c allows attackers to bypass
    intended access restrictions because of a setcolorspace
    type confusion
    https://bugs.ghostscript.com/show_bug.cgi?id=700169
    https://bugzilla.suse.com/show_bug.cgi?id=1117313 bsc#1117313
  * CVE-2018-19477: psi/zfjbig2.c allows attackers to bypass
    intended access restrictions because of a JBIG2Decode
    type confusion
    https://bugs.ghostscript.com/show_bug.cgi?id=700168
    https://bugzilla.suse.com/show_bug.cgi?id=1117274 bsc#1117274
  * CVE-2018-19409: LockSafetyParams is not checked correctly
    if another device is used
    https://bugs.ghostscript.com/show_bug.cgi?id=700176
    https://bugzilla.suse.com/show_bug.cgi?id=1117022 bsc#1117022
  and those security issues
  * CVE-2018-18284: 1Policy operator gives access to .forceput
    https://bugs.ghostscript.com/show_bug.cgi?id=69963
    https://bugzilla.suse.com/show_bug.cgi?id=1112229 bsc#1112229
  * CVE-2018-18073: saved execution stacks can leak operator arrays
    https://bugs.ghostscript.com/show_bug.cgi?id=699927
    https://bugzilla.suse.com/show_bug.cgi?id=1111480 bsc#1111480
  * CVE-2018-17961: bypassing executeonly to escape -dSAFER sandbox
    https://bugs.ghostscript.com/show_bug.cgi?id=699816
    https://bugzilla.suse.com/show_bug.cgi?id=1111479 bsc#1111479
  * CVE-2018-17183: remote attackers could be able to supply
    crafted PostScript to potentially overwrite or replace
    error handlers to inject code
    https://bugs.ghostscript.com/show_bug.cgi?id=699708
    https://bugzilla.suse.com/show_bug.cgi?id=1109105 bsc#1109105</changelog>
  <changelog author="jsmeix@suse.de" date="1547726400">- Version upgrade to 9.26a
  The version 9.26a is a special security bugfix version to fix
  * CVE-2019-6116: subroutines within pseudo-operators
    must themselves be pseudo-operators
    https://bugs.ghostscript.com/show_bug.cgi?id=700317
    https://bugzilla.suse.com/show_bug.cgi?id=1122319 bsc#1122319</changelog>
  <changelog author="jsmeix@suse.de" date="1552996800">- CVE-2019-3838.patch fixes CVE-2019-3838
  forceput in DefineResource is still accessible
  https://bugzilla.suse.com/show_bug.cgi?id=1129186 bsc#1129186
  https://bugs.ghostscript.com/show_bug.cgi?id=700576</changelog>
  <changelog author="jsmeix@suse.de" date="1554379200">- Version upgrade to 9.27
  Highlights in this release include:
  * We (i.e. Ghostscript upstream) have extensively cleaned up
    the Postscript name space: removing access to internal and/or
    undocumented Postscript operators, procedures and data.
    This has benefits for security and maintainability.
    Incompatible changes:
    The process of "tidying" the Postscript name space should
    have removed only non-standard and undocumented operators.
    Nevertheless, it is possible that any integrations or
    utilities that rely on those non-standard and undocumented
    operators may stop working, or may change behaviour.
    If you encounter such a case, please contact us (i.e.
    Ghostscript upstream) - (either the #ghostscript IRC channel,
    or the gs-devel mailing list would be best), and we'll work
    with you to either find an alternative solution.
  * Fontmap can now reference invidual fonts in a TrueType
    Collection for font subsitution. Previously, a Fontmap entry
    could only reference a TrueType collection and use the default
    (first) font.
    Now, the Fontmap syntax allows for specifying a specific index
    in a TTC. See the comments at the top of (the default)
    Fontmap.GS for details.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  IMPORTANT: It is our intention, within the next 12 months
    (ideally sooner, in time for the next release) to make SAFER
    the default mode of operation. For many users this will have
    no effect, since they use SAFER explicitly, but some niche
    uses which rely on SAFER being disabled may need to start
    explicitly adding the "-dNOSAFER" option.
  IMPORTANT: We (i.e. Ghostscript upstream) are in the process of
    forking LittleCMS. LCMS2 is not thread safe, and cannot be made
    thread safe without breaking the ABI. Our fork will be thread
    safe, and include performance enhancements (these changes have
    all be been offered and rejected upstream). We will maintain
    compatibility between Ghostscript and LCMS2 for a time, but not
    in perpetuity. Our fork will be available as its own package
    separately from Ghostscript (and MuPDF).
  For a release summary see:
  http://www.ghostscript.com/doc/9.27/News.htm
  For details see the News.htm and History9.htm files.
  The Ghostscript 9.27 release should fix (cf. the entry below
  dated 'Fri Sep 14 10:47:33 CEST 2018' what "should fix" means)
  in particular those security issues:
  * CVE-2019-3838 forceput in DefineResource is still accessible
    https://bugzilla.suse.com/show_bug.cgi?id=1129186 bsc#1129186
    https://bugs.ghostscript.com/show_bug.cgi?id=700576
  * CVE-2019-3835: superexec operator is available
    https://bugzilla.suse.com/show_bug.cgi?id=1129180 bsc#1129180
    https://bugs.ghostscript.com/show_bug.cgi?id=700585</changelog>
  <changelog author="werner@suse.de" date="1565611200">- CVE-2019-10216.patch fixes CVE-2019-10216
  forceput/superexec in .buildfont1 is still accessible
  https://bugzilla.suse.com/show_bug.cgi?id=1144621 bsc#1144621
  https://bugs.ghostscript.com/show_bug.cgi?id=701394</changelog>
  <changelog author="werner@suse.de" date="1568376000">- Add patch openjpeg4gs-CVE-2018-6616-8ee33522.patch
  to fix bsc#1140359 for CVE-2019-12973</changelog>
  <changelog author="werner@suse.de" date="1568635200">- Add patch gs-CVE-2019-14811-885444fc.patch to fix bsc#1146882
  for CVE-2019-14811,CVE-2019-14812,CVE-2019-14813
- Add patch gs-CVE-2019-14817-cd1b1cac.patch to fix bsc#1146884
  for CVE-2019-14817</changelog>
  <changelog author="werner@suse.de" date="1568635201">- Port latest ghostscript 9.27 from factory including latest
  security patches to SLES15/SLES12
  * Port patch CVE-2019-10216.patch to 9.27 which is the orignal
    upstream commit now
  * Drop patch CVE-2019-3838.patch as now part of 9.27</changelog>
  <changelog author="jsmeix@suse.de" date="1573473600">- CVE-2019-14869.patch contains commit from Ghostscript upstream
  https://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=485904772c5f
  to fix CVE-2019-14869 "-dSAFER escape in .charkeys"
  (bsc#1156275)</changelog>
  <changelog author="jsmeix@suse.de" date="1588075200">- The version upgrade to 9.52 fixes in particular
  CVE-2020-12268: jbic2dec: heap-based buffer overflow
  in jbig2_image_compose (bsc#1170603)
- Version upgrade to 9.52
  Highlights in this release include:
  * The 9.52 release replaces the 9.51 release after a problem
    was reported with 9.51 which warranted the quick turnaround.
    Thus, like 9.51, 9.52 is primarily a maintenance release,
    consolidating the changes we introduced in 9.50.
  * IMPORTANT: We have forked LittleCMS2 into LittleCMS2mt
    (the "mt" indicating "multi-thread").
    LCMS2 is not thread-safe, and cannot be made thread-safe
    without breaking the ABI. Our fork will be thread-safe and
    include performance enhancements (these changes have all
    been offered and rejected upstream). We will maintain
    compatibility between Ghostscript and LCMS2 for a time,
    but not in perpetuity. If there is sufficient interest,
    our fork will be available as its own package separately
    from Ghostscript (and MuPDF).
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  Incompatible changes:
  * New option -dALLOWPSTRANSPARENCY: The transparency compositor
    (and related features), whilst we are improving it, remains
    sensitive to being driven correctly, and incorrect use
    can have unexpected/undefined results. Hence, as part of
    improving security, we limited access to these operators,
    originally using the -dSAFER feature. As we made "SAFER"
    the default mode, that became unacceptable, hence the
    new option -dALLOWPSTRANSPARENCY which enables access
    to the operators, cf.
    https://www.ghostscript.com/doc/9.52/Use.htm#ALLOWPSTRANSPARENCY
  For a release summary see:
  https://www.ghostscript.com/doc/9.52/News.htm
  For details see the News.htm and History9.htm files.
- Version upgrade to 9.51
  Highlights in this release include:
  * 9.51 is primarily a maintainance release, consolidating
    the changes we introduced in 9.50.
  * We have continued our work on code hygiene for this release,
    with a focus on the static analysis tool Coverity
    (from Synopsys, Inc) and we are now maintaining a policy of
    zero Coverity issues in the Ghostscript/GhostPDL source base.
  * IMPORTANT: In consultation with a representative of
    OpenPrinting (http://www.openprinting.org/) it is our
    intention to deprecate and, in the not distant future,
    remove the OpenPrinting Vector/Raster Printer Drivers
    (that is, the opvp and oprp devices).
    If you rely on either of these devices, please get in touch
    with us (i.e. Ghostscript upstream), so we can discuss your
    use case, and revise our plans accordingly.
  * We (i.e. Ghostscript upstream) are in the process of forking
    LittleCMS, cf. the other release notes entries below.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  For a release summary see:
  https://www.ghostscript.com/doc/9.51/News.htm
  For details see the News.htm and History9.htm files.
- Version upgrade to 9.50
  Highlights in this release include:
  * The change to version 9.50 follows recognition
    of the extent and importance of the file access control
    redesign/reimplementation outlined below.
  * The file access control capability (enable with -dSAFER)
    has been completely rewritten, with a ground-up rethink
    of the design. For more details, see: "SAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#Safer
  * It is important to note that -dSAFER now only enables the
    file access controls, and no longer applies restrictions
    to standard Postscript functionality (specifically,
    restrictions on setpagedevice). If your application relies
    on these Postscript restrictions, see "OLDSAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#OldSafer
    and please get in touch, as we do plan to remove those
    Postscript restrictions unless we have reason not to.
  IMPORTANT: File access controls are now enabled by default.
    In order to run Ghostscript without these controls,
    see "NOSAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#NoSafer
  * We (i.e. Ghostscript upstream) are in the process of forking
    LittleCMS, cf. the other release notes entries below.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  Incompatible changes:
  * There are a couple of subtle incompatibilities between the old
    and new SAFER implementations. Firstly, as mentioned above,
    SAFER now leaves standard Postcript functionality unchanged
    (except for the file access limitations). Secondly, the
    interaction with save/restore operations, see "SAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#Safer
  * The following is not strictly speaking new to 9.50,
    as not much has changed since 9.27 in this area,
    but for those who don't upgrade with every release:
    The process of "tidying" the Postscript name space should have
    removed only non-standard and undocumented operators.
    Nevertheless, it is possible that any integrations or utilities
    that rely on those non-standard and undocumented operators
    may stop working, or may change behaviour.
    If you encounter such a case, please contact us
    (i.e. Ghostscript upstream, either the #ghostscript IRC channel
    or the gs-devel mailing list would be best), and we'll work
    with you to either find an alternative solution or return the
    previous functionality, if there is genuinely no other option.
    One case we know this has occurred is GSView 5 (and earlier).
    GSView 5 support for PDF files relied upon internal use only
    features which are no longer available. GSView 5 will still
    work as previously for Postscript files. For PDF files,
    users are encouraged to look at MuPDF https://www.mupdf.com/
  For a release summary see:
  https://www.ghostscript.com/doc/9.50/News.htm
  For details see the News.htm and History9.htm files.
- CVE-2019-10216.patch CVE-2019-14869.patch
  gs-CVE-2019-14811-885444fc.patch
  gs-CVE-2019-14817-cd1b1cac.patch
  openjpeg4gs-CVE-2018-6616-8ee33522.patch
  are fixed in the version 9.52 upstream sources.</changelog>
  <changelog author="jsmeix@suse.de" date="1595851200">- CVE-2020-15900.patch fixes CVE-2020-15900
  Memory Corruption (SAFER Sandbox Breakout)
  cf. https://bugs.ghostscript.com/show_bug.cgi?id=702582
  (bsc#1174415)</changelog>
  <changelog author="wolfgang.frisch@suse.com" date="1619006400">- Hardening: link as position independent executable (bsc#1184123).</changelog>
  <changelog author="jsmeix@suse.de" date="1631275200">- CVE-2021-3781.patch fixes CVE-2021-3781
  Trivial -dSAFER bypass
  cf. https://bugs.ghostscript.com/show_bug.cgi?id=704342
  (bsc#1190381)</changelog>
  <changelog author="werner@suse.de" date="1632916800">- Use update-alternatives to get the real ghostscript binary from
  /usr/bin/gs to /usr/bin/gs.bin and allow the gswrap package to
  use this with its wrapper script (jira#PM-3037)</changelog>
</package>
<package pkgid="6d2e2b9b977c38ed579fa45456c348e0972b079635be17a862b32006d5f699b9" name="ghostscript-devel" arch="x86_64">
  <version epoch="0" ver="9.52" rel="158.1"/>
  <changelog author="jsmeix@suse.de" date="1521720000">- Version upgrade to 9.23
  Highlights in this release include:
  * Ghostscript now has a family of 'pdfimage' devices
    (pdfimage8, pdfimage24 and pdfimage32) which produce
    rendered output wrapped up as an image in a PDF.
    Additionally, there is a 'pclm' device which
    produces PCLm format output.
  * There is now a ColorAccuracy parameter allowing the user
    to decide between speed or accuracy in ICC color transforms.
  * JPEG Passthrough: devices which support it can now receive
    the 'raw' JPEG stream from the interpreter.
    The main use of this is the pdfwrite/ps2write family of devices
    that can now take JPEG streams from the input file(s) and write
    them unchanged to the output (thus avoiding additional
    quantization effects).
  * PDF transparency performance improvements
  * IMPORTANT: We (i.e. Ghostscript upstream) are in the process
    of forking LittleCMS.
    LCMS2 is not thread safe, and cannot be made thread safe
    without breaking the ABI. Our fork will be thread safe,
    and include performance enhancements (these changes have all
    be been offered and rejected upstream). We will maintain
    compatibility between Ghostscript and LCMS2 for a time,
    but not in perpetuity. Our fork will be available as its own
    package separately from Ghostscript (and MuPDF).
  * We have continued the focus on code hygiene in this release
    cleaning up security issues, ignored return values,
    and compiler warnings.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  Incompatible changes
  * The planned device API tidy has, unfortunately, been
    indefinitely postponed, until appropriate resources
    are available.
  For a release summary see:
  http://www.ghostscript.com/doc/9.23/News.htm
  For details see the News.htm and History9.htm files.
  See also the entries below since "Version upgrade to 9.22"
  (boo#1082896 and boo#1074266).</changelog>
  <changelog author="jsmeix@suse.de" date="1528200000">- CVE-2018-10194.patch fixes stack-based buffer overflow
  in gdevpdts.c (bsc#1090099), see
  https://bugs.ghostscript.com/show_bug.cgi?id=699255 and
  http://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=39b1e54b2968620723bf32e96764c88797714879</changelog>
  <changelog author="jsmeix@suse.de" date="1536840000">- Version upgrade to 9.24
  Highlights in this release include:
  * Security issues have been the primary focus of this release,
    including solving several (well publicised)
    real and potential exploits.
    PLEASE NOTE:
    We (i.e. Ghostscript upstream) strongly urge users to upgrade
    to this latest release to avoid these issues.
  * As well as Ghostscript itself, jbig2dec has had a significant
    amount of work improving its robustness in the face of
    out specification files.
  * IMPORTANT: We (i.e. Ghostscript upstream) are in the process
    of forking LittleCMS. LCMS2 is not thread safe, and cannot
    be made thread safe without breaking the ABI. Our fork
    will be thread safe, and include performance enhancements
    (these changes have all be been offered and rejected upstream).
    We will maintain compatibility between Ghostscript and LCMS2
    for a time, but not in perpetuity. Our fork will be available
    as its own package separately from Ghostscript (and MuPDF).
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  For a release summary see:
  http://www.ghostscript.com/doc/9.24/News.htm
  For details see the News.htm and History9.htm files.
- fix_ln_docdir_gsdatadir.patch is no longer needed
  because the issue is fixed in the upstream sources.
- CVE-2018-10194.patch is no longer needed
  because the issue is fixed in the upstream sources.</changelog>
  <changelog author="jsmeix@suse.de" date="1536840001">- Version upgrade to 9.25rc1 (first release candidate for 9.25).
  Highlights in this release include:
  * This release fixes problems with argument handling, some
    unintended results of the security fixes to the SAFER file
    access restrictions (specifically accessing ICC profile files),
    and some additional security issues over the 9.24 release.
  * Security issues have been the primary focus of this release,
    including solving several (well publicised) real
    and potential exploits.
    PLEASE NOTE:
    We (i.e. Ghostscript upstream) strongly urge users to upgrade
    to this latest release to avoid these issues.
  * Avoid that ps2epsi fails with
    'Error: /undefined in --setpagedevice--'
    Recent changes required to harden SAFER mode mean that
    it is no longer possible to run ps2epsi in SAFER mode,
    because it relies upon unsafe Ghostscript non-standard
    extension operators.
    Removing SAFER and DELAYSAFER, and the code to reset SAFER,
    allow ps2epsi to run as well as it ever did (ie badly).
    This program (i.e. ps2epsi) should now be considered unsafe,
    you should not use it on untrusted PostScript programs.
    Likely we (i.e. Ghostscript upstream) will deprecate and
    remove this program in future.
  For details see the News.htm and History9.htm files.
  Regarding installing packages (in particular release candidates)
  from the openSUSE build service development project "Printing"
  see https://build.opensuse.org/project/show/Printing</changelog>
  <changelog author="jsmeix@suse.de" date="1536926400">- Version upgrade to 9.25
  For the highlights in this release see the highlights in the
  9.25rc1 first release candidate for 9.25 entry below.
  PLEASE NOTE:
  We (i.e. Ghostscript upstream) strongly urge users to upgrade
  to this latest release to avoid these issues.
  For a release summary see:
  http://www.ghostscript.com/doc/9.25/News.htm
  For details see the News.htm and History9.htm files.
  The Ghostscript 9.25 release should fix (see below)
  in particular those security issues:
  * CVE-2018-15909: shading_param incomplete type checking
    https://bugs.ghostscript.com/show_bug.cgi?id=699660
    https://bugzilla.suse.com/show_bug.cgi?id=1106172 bsc#1106172
  * CVE-2018-15908: .tempfile file permission issues
    https://bugs.ghostscript.com/show_bug.cgi?id=699657
    https://bugzilla.suse.com/show_bug.cgi?id=1106171 bsc#1106171
  * CVE-2018-15910: LockDistillerParams type confusion
    https://bugs.ghostscript.com/show_bug.cgi?id=699656
    https://bugzilla.suse.com/show_bug.cgi?id=1106173 bsc#1106173
  * CVE-2018-15911: uninitialized memory access in the aesdecode
    https://bugs.ghostscript.com/show_bug.cgi?id=699665
    https://bugzilla.suse.com/show_bug.cgi?id=1106195 bsc#1106195
  * CVE-2018-16513: setcolor missing type check
    https://bugs.ghostscript.com/show_bug.cgi?id=699655
    https://bugzilla.suse.com/show_bug.cgi?id=1107412 bsc#1107412
  * CVE-2018-16509: /invalidaccess bypass after failed restore
    https://bugs.ghostscript.com/show_bug.cgi?id=699654
    https://bugzilla.suse.com/show_bug.cgi?id=1107410 bsc#1107410
  * CVE-2018-16510: Incorrect exec stack handling in the "CS"
    and "SC" PDF primitives
    https://bugs.ghostscript.com/show_bug.cgi?id=699671
    https://bugzilla.suse.com/show_bug.cgi?id=1107411 bsc#1107411
  * CVE-2018-16542: .definemodifiedfont memory corruption
    if /typecheck is handled
    https://bugs.ghostscript.com/show_bug.cgi?id=699668
    https://bugzilla.suse.com/show_bug.cgi?id=1107413 bsc#1107413
  * CVE-2018-16541 incorrect free logic in pagedevice replacement
    https://bugs.ghostscript.com/show_bug.cgi?id=699664
    https://bugzilla.suse.com/show_bug.cgi?id=1107421 bsc#1107421
  * CVE-2018-16540 use-after-free in copydevice handling
    https://bugs.ghostscript.com/show_bug.cgi?id=699661
    https://bugzilla.suse.com/show_bug.cgi?id=1107420 bsc#1107420
  * CVE-2018-16539: incorrect access checking in temp file
    handling to disclose contents of files
    https://bugs.ghostscript.com/show_bug.cgi?id=699658
    https://bugzilla.suse.com/show_bug.cgi?id=1107422 bsc#1107422
  * CVE-2018-16543: gssetresolution and gsgetresolution allow
    for unspecified impact
    https://bugs.ghostscript.com/show_bug.cgi?id=699670
    https://bugzilla.suse.com/show_bug.cgi?id=1107423 bsc#1107423
  * CVE-2018-16511: type confusion in "ztype" could be used by
    remote attackers able to supply crafted PostScript to crash
    the interpreter or possibly have unspecified other impact
    https://bugs.ghostscript.com/show_bug.cgi?id=699659
    https://bugzilla.suse.com/show_bug.cgi?id=1107426 bsc#1107426
  * CVE-2018-16585 .setdistillerkeys PostScript command is
    accepted even though it is not intended for use
    https://bugzilla.suse.com/show_bug.cgi?id=1107581 bsc#1107581
  * CVE-2018-16802: Incorrect"restoration of privilege" checking
    when running out of stack during exceptionhandling could be
    used by attackers able to supply crafted PostScript to execute
    code using the "pipe" instruction. This is due to an incomplete
    fix for CVE-2018-16509
    https://bugs.ghostscript.com/show_bug.cgi?id=699714
    https://bugs.ghostscript.com/show_bug.cgi?id=699718
    https://bugzilla.suse.com/show_bug.cgi?id=1108027 bnc#1108027
  Regarding what the above "should fix" means:
  PostScript is a general purpose Turing-complete programming
  language (cf. https://en.wikipedia.org/wiki/PostScript)
  that supports in particular file access on the system disk.
  When Ghostscript processes PostScript it runs a PostScript
  program as the user who runs Ghostscript.
  When Ghostscript processes an arbitrary PostScript file,
  the user who runs Ghostscript runs an arbitrary program
  which can do anything on the system where Ghostscript runs
  that this user is allowed to do on that system.
  To make it safer when Ghostscript runs a PostScript program
  the Ghostscript command line option '-dSAFER' disables
  certain file access functionality, for details see
  /usr/share/doc/ghostscript/9.25/Use.htm
  Its name 'SAFER' says everything: It makes it 'safer'
  to let Ghostscript run a PostScript program,
  but it does not make it completely safe.
  In theory software is safe against misuse (i.e. has no bugs).
  In practice there is an endless sequence of various kind of
  security issues (i.e. software can be misused to do more than
  what is intended) that get fixed issue by issue ad infinitum.
  In the end all that means:
  In practice the user who runs Ghostscript must not let it
  process arbitrary PostScript files from untrusted origin.
  In particular Ghostscript is usually run when printing
  documents (with the '-dSAFER' option set), see the part about
  "It is crucial to limit access to CUPS to trusted users" in
  https://en.opensuse.org/SDB:CUPS_and_SANE_Firewall_settings</changelog>
  <changelog author="jsmeix@suse.de" date="1541764800">- Version upgrade to 9.26rc1 (first release candidate for 9.26).
  Highlights in this release include:
  * Purely security and a few bug fixes, there are no new features,
    and no API changes to report.</changelog>
  <changelog author="jsmeix@suse.de" date="1543579200">- Version upgrade to 9.26
  Highlights in this release include:
  * Security issues have been the primary focus of this release,
    including solving several (well publicised) real and potential
    exploits.
    Thanks to Man Yue Mo of Semmle Security Research Team,
    Jens Mueller of Ruhr-Universitaet Bochum and
    Tavis Ormandy of Google's Project Zero
    for their help to identify specific security issues.
    PLEASE NOTE:
    We (i.e. Ghostscript upstream) strongly urge users to upgrade
    to this latest release to avoid these issues.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  For a release summary see:
  http://www.ghostscript.com/doc/9.26/News.htm
  For details see the News.htm and History9.htm files.
  The Ghostscript 9.26 release should fix (cf. the entry below
  dated 'Fri Sep 14 10:47:33 CEST 2018' what "should fix" means)
  in particular those security issues (bsc#1117331)
  * CVE-2018-19475: psi/zdevice2.c allows attackers to bypass
    intended access restrictions
    https://bugs.ghostscript.com/show_bug.cgi?id=700153
    https://bugzilla.suse.com/show_bug.cgi?id=1117327 bsc#1117327
  * CVE-2018-19476: psi/zicc.c allows attackers to bypass
    intended access restrictions because of a setcolorspace
    type confusion
    https://bugs.ghostscript.com/show_bug.cgi?id=700169
    https://bugzilla.suse.com/show_bug.cgi?id=1117313 bsc#1117313
  * CVE-2018-19477: psi/zfjbig2.c allows attackers to bypass
    intended access restrictions because of a JBIG2Decode
    type confusion
    https://bugs.ghostscript.com/show_bug.cgi?id=700168
    https://bugzilla.suse.com/show_bug.cgi?id=1117274 bsc#1117274
  * CVE-2018-19409: LockSafetyParams is not checked correctly
    if another device is used
    https://bugs.ghostscript.com/show_bug.cgi?id=700176
    https://bugzilla.suse.com/show_bug.cgi?id=1117022 bsc#1117022
  and those security issues
  * CVE-2018-18284: 1Policy operator gives access to .forceput
    https://bugs.ghostscript.com/show_bug.cgi?id=69963
    https://bugzilla.suse.com/show_bug.cgi?id=1112229 bsc#1112229
  * CVE-2018-18073: saved execution stacks can leak operator arrays
    https://bugs.ghostscript.com/show_bug.cgi?id=699927
    https://bugzilla.suse.com/show_bug.cgi?id=1111480 bsc#1111480
  * CVE-2018-17961: bypassing executeonly to escape -dSAFER sandbox
    https://bugs.ghostscript.com/show_bug.cgi?id=699816
    https://bugzilla.suse.com/show_bug.cgi?id=1111479 bsc#1111479
  * CVE-2018-17183: remote attackers could be able to supply
    crafted PostScript to potentially overwrite or replace
    error handlers to inject code
    https://bugs.ghostscript.com/show_bug.cgi?id=699708
    https://bugzilla.suse.com/show_bug.cgi?id=1109105 bsc#1109105</changelog>
  <changelog author="jsmeix@suse.de" date="1547726400">- Version upgrade to 9.26a
  The version 9.26a is a special security bugfix version to fix
  * CVE-2019-6116: subroutines within pseudo-operators
    must themselves be pseudo-operators
    https://bugs.ghostscript.com/show_bug.cgi?id=700317
    https://bugzilla.suse.com/show_bug.cgi?id=1122319 bsc#1122319</changelog>
  <changelog author="jsmeix@suse.de" date="1552996800">- CVE-2019-3838.patch fixes CVE-2019-3838
  forceput in DefineResource is still accessible
  https://bugzilla.suse.com/show_bug.cgi?id=1129186 bsc#1129186
  https://bugs.ghostscript.com/show_bug.cgi?id=700576</changelog>
  <changelog author="jsmeix@suse.de" date="1554379200">- Version upgrade to 9.27
  Highlights in this release include:
  * We (i.e. Ghostscript upstream) have extensively cleaned up
    the Postscript name space: removing access to internal and/or
    undocumented Postscript operators, procedures and data.
    This has benefits for security and maintainability.
    Incompatible changes:
    The process of "tidying" the Postscript name space should
    have removed only non-standard and undocumented operators.
    Nevertheless, it is possible that any integrations or
    utilities that rely on those non-standard and undocumented
    operators may stop working, or may change behaviour.
    If you encounter such a case, please contact us (i.e.
    Ghostscript upstream) - (either the #ghostscript IRC channel,
    or the gs-devel mailing list would be best), and we'll work
    with you to either find an alternative solution.
  * Fontmap can now reference invidual fonts in a TrueType
    Collection for font subsitution. Previously, a Fontmap entry
    could only reference a TrueType collection and use the default
    (first) font.
    Now, the Fontmap syntax allows for specifying a specific index
    in a TTC. See the comments at the top of (the default)
    Fontmap.GS for details.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  IMPORTANT: It is our intention, within the next 12 months
    (ideally sooner, in time for the next release) to make SAFER
    the default mode of operation. For many users this will have
    no effect, since they use SAFER explicitly, but some niche
    uses which rely on SAFER being disabled may need to start
    explicitly adding the "-dNOSAFER" option.
  IMPORTANT: We (i.e. Ghostscript upstream) are in the process of
    forking LittleCMS. LCMS2 is not thread safe, and cannot be made
    thread safe without breaking the ABI. Our fork will be thread
    safe, and include performance enhancements (these changes have
    all be been offered and rejected upstream). We will maintain
    compatibility between Ghostscript and LCMS2 for a time, but not
    in perpetuity. Our fork will be available as its own package
    separately from Ghostscript (and MuPDF).
  For a release summary see:
  http://www.ghostscript.com/doc/9.27/News.htm
  For details see the News.htm and History9.htm files.
  The Ghostscript 9.27 release should fix (cf. the entry below
  dated 'Fri Sep 14 10:47:33 CEST 2018' what "should fix" means)
  in particular those security issues:
  * CVE-2019-3838 forceput in DefineResource is still accessible
    https://bugzilla.suse.com/show_bug.cgi?id=1129186 bsc#1129186
    https://bugs.ghostscript.com/show_bug.cgi?id=700576
  * CVE-2019-3835: superexec operator is available
    https://bugzilla.suse.com/show_bug.cgi?id=1129180 bsc#1129180
    https://bugs.ghostscript.com/show_bug.cgi?id=700585</changelog>
  <changelog author="werner@suse.de" date="1565611200">- CVE-2019-10216.patch fixes CVE-2019-10216
  forceput/superexec in .buildfont1 is still accessible
  https://bugzilla.suse.com/show_bug.cgi?id=1144621 bsc#1144621
  https://bugs.ghostscript.com/show_bug.cgi?id=701394</changelog>
  <changelog author="werner@suse.de" date="1568376000">- Add patch openjpeg4gs-CVE-2018-6616-8ee33522.patch
  to fix bsc#1140359 for CVE-2019-12973</changelog>
  <changelog author="werner@suse.de" date="1568635200">- Add patch gs-CVE-2019-14811-885444fc.patch to fix bsc#1146882
  for CVE-2019-14811,CVE-2019-14812,CVE-2019-14813
- Add patch gs-CVE-2019-14817-cd1b1cac.patch to fix bsc#1146884
  for CVE-2019-14817</changelog>
  <changelog author="werner@suse.de" date="1568635201">- Port latest ghostscript 9.27 from factory including latest
  security patches to SLES15/SLES12
  * Port patch CVE-2019-10216.patch to 9.27 which is the orignal
    upstream commit now
  * Drop patch CVE-2019-3838.patch as now part of 9.27</changelog>
  <changelog author="jsmeix@suse.de" date="1573473600">- CVE-2019-14869.patch contains commit from Ghostscript upstream
  https://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=485904772c5f
  to fix CVE-2019-14869 "-dSAFER escape in .charkeys"
  (bsc#1156275)</changelog>
  <changelog author="jsmeix@suse.de" date="1588075200">- The version upgrade to 9.52 fixes in particular
  CVE-2020-12268: jbic2dec: heap-based buffer overflow
  in jbig2_image_compose (bsc#1170603)
- Version upgrade to 9.52
  Highlights in this release include:
  * The 9.52 release replaces the 9.51 release after a problem
    was reported with 9.51 which warranted the quick turnaround.
    Thus, like 9.51, 9.52 is primarily a maintenance release,
    consolidating the changes we introduced in 9.50.
  * IMPORTANT: We have forked LittleCMS2 into LittleCMS2mt
    (the "mt" indicating "multi-thread").
    LCMS2 is not thread-safe, and cannot be made thread-safe
    without breaking the ABI. Our fork will be thread-safe and
    include performance enhancements (these changes have all
    been offered and rejected upstream). We will maintain
    compatibility between Ghostscript and LCMS2 for a time,
    but not in perpetuity. If there is sufficient interest,
    our fork will be available as its own package separately
    from Ghostscript (and MuPDF).
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  Incompatible changes:
  * New option -dALLOWPSTRANSPARENCY: The transparency compositor
    (and related features), whilst we are improving it, remains
    sensitive to being driven correctly, and incorrect use
    can have unexpected/undefined results. Hence, as part of
    improving security, we limited access to these operators,
    originally using the -dSAFER feature. As we made "SAFER"
    the default mode, that became unacceptable, hence the
    new option -dALLOWPSTRANSPARENCY which enables access
    to the operators, cf.
    https://www.ghostscript.com/doc/9.52/Use.htm#ALLOWPSTRANSPARENCY
  For a release summary see:
  https://www.ghostscript.com/doc/9.52/News.htm
  For details see the News.htm and History9.htm files.
- Version upgrade to 9.51
  Highlights in this release include:
  * 9.51 is primarily a maintainance release, consolidating
    the changes we introduced in 9.50.
  * We have continued our work on code hygiene for this release,
    with a focus on the static analysis tool Coverity
    (from Synopsys, Inc) and we are now maintaining a policy of
    zero Coverity issues in the Ghostscript/GhostPDL source base.
  * IMPORTANT: In consultation with a representative of
    OpenPrinting (http://www.openprinting.org/) it is our
    intention to deprecate and, in the not distant future,
    remove the OpenPrinting Vector/Raster Printer Drivers
    (that is, the opvp and oprp devices).
    If you rely on either of these devices, please get in touch
    with us (i.e. Ghostscript upstream), so we can discuss your
    use case, and revise our plans accordingly.
  * We (i.e. Ghostscript upstream) are in the process of forking
    LittleCMS, cf. the other release notes entries below.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  For a release summary see:
  https://www.ghostscript.com/doc/9.51/News.htm
  For details see the News.htm and History9.htm files.
- Version upgrade to 9.50
  Highlights in this release include:
  * The change to version 9.50 follows recognition
    of the extent and importance of the file access control
    redesign/reimplementation outlined below.
  * The file access control capability (enable with -dSAFER)
    has been completely rewritten, with a ground-up rethink
    of the design. For more details, see: "SAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#Safer
  * It is important to note that -dSAFER now only enables the
    file access controls, and no longer applies restrictions
    to standard Postscript functionality (specifically,
    restrictions on setpagedevice). If your application relies
    on these Postscript restrictions, see "OLDSAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#OldSafer
    and please get in touch, as we do plan to remove those
    Postscript restrictions unless we have reason not to.
  IMPORTANT: File access controls are now enabled by default.
    In order to run Ghostscript without these controls,
    see "NOSAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#NoSafer
  * We (i.e. Ghostscript upstream) are in the process of forking
    LittleCMS, cf. the other release notes entries below.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  Incompatible changes:
  * There are a couple of subtle incompatibilities between the old
    and new SAFER implementations. Firstly, as mentioned above,
    SAFER now leaves standard Postcript functionality unchanged
    (except for the file access limitations). Secondly, the
    interaction with save/restore operations, see "SAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#Safer
  * The following is not strictly speaking new to 9.50,
    as not much has changed since 9.27 in this area,
    but for those who don't upgrade with every release:
    The process of "tidying" the Postscript name space should have
    removed only non-standard and undocumented operators.
    Nevertheless, it is possible that any integrations or utilities
    that rely on those non-standard and undocumented operators
    may stop working, or may change behaviour.
    If you encounter such a case, please contact us
    (i.e. Ghostscript upstream, either the #ghostscript IRC channel
    or the gs-devel mailing list would be best), and we'll work
    with you to either find an alternative solution or return the
    previous functionality, if there is genuinely no other option.
    One case we know this has occurred is GSView 5 (and earlier).
    GSView 5 support for PDF files relied upon internal use only
    features which are no longer available. GSView 5 will still
    work as previously for Postscript files. For PDF files,
    users are encouraged to look at MuPDF https://www.mupdf.com/
  For a release summary see:
  https://www.ghostscript.com/doc/9.50/News.htm
  For details see the News.htm and History9.htm files.
- CVE-2019-10216.patch CVE-2019-14869.patch
  gs-CVE-2019-14811-885444fc.patch
  gs-CVE-2019-14817-cd1b1cac.patch
  openjpeg4gs-CVE-2018-6616-8ee33522.patch
  are fixed in the version 9.52 upstream sources.</changelog>
  <changelog author="jsmeix@suse.de" date="1595851200">- CVE-2020-15900.patch fixes CVE-2020-15900
  Memory Corruption (SAFER Sandbox Breakout)
  cf. https://bugs.ghostscript.com/show_bug.cgi?id=702582
  (bsc#1174415)</changelog>
  <changelog author="wolfgang.frisch@suse.com" date="1619006400">- Hardening: link as position independent executable (bsc#1184123).</changelog>
  <changelog author="jsmeix@suse.de" date="1631275200">- CVE-2021-3781.patch fixes CVE-2021-3781
  Trivial -dSAFER bypass
  cf. https://bugs.ghostscript.com/show_bug.cgi?id=704342
  (bsc#1190381)</changelog>
  <changelog author="werner@suse.de" date="1632916800">- Use update-alternatives to get the real ghostscript binary from
  /usr/bin/gs to /usr/bin/gs.bin and allow the gswrap package to
  use this with its wrapper script (jira#PM-3037)</changelog>
</package>
<package pkgid="d23657a8ad63a8d3463b9635835d862f07038ac86888655ec53af2669e55a26c" name="ghostscript-devel" arch="aarch64">
  <version epoch="0" ver="9.52" rel="161.1"/>
  <changelog author="jsmeix@suse.de" date="1528200000">- CVE-2018-10194.patch fixes stack-based buffer overflow
  in gdevpdts.c (bsc#1090099), see
  https://bugs.ghostscript.com/show_bug.cgi?id=699255 and
  http://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=39b1e54b2968620723bf32e96764c88797714879</changelog>
  <changelog author="jsmeix@suse.de" date="1536840000">- Version upgrade to 9.24
  Highlights in this release include:
  * Security issues have been the primary focus of this release,
    including solving several (well publicised)
    real and potential exploits.
    PLEASE NOTE:
    We (i.e. Ghostscript upstream) strongly urge users to upgrade
    to this latest release to avoid these issues.
  * As well as Ghostscript itself, jbig2dec has had a significant
    amount of work improving its robustness in the face of
    out specification files.
  * IMPORTANT: We (i.e. Ghostscript upstream) are in the process
    of forking LittleCMS. LCMS2 is not thread safe, and cannot
    be made thread safe without breaking the ABI. Our fork
    will be thread safe, and include performance enhancements
    (these changes have all be been offered and rejected upstream).
    We will maintain compatibility between Ghostscript and LCMS2
    for a time, but not in perpetuity. Our fork will be available
    as its own package separately from Ghostscript (and MuPDF).
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  For a release summary see:
  http://www.ghostscript.com/doc/9.24/News.htm
  For details see the News.htm and History9.htm files.
- fix_ln_docdir_gsdatadir.patch is no longer needed
  because the issue is fixed in the upstream sources.
- CVE-2018-10194.patch is no longer needed
  because the issue is fixed in the upstream sources.</changelog>
  <changelog author="jsmeix@suse.de" date="1536840001">- Version upgrade to 9.25rc1 (first release candidate for 9.25).
  Highlights in this release include:
  * This release fixes problems with argument handling, some
    unintended results of the security fixes to the SAFER file
    access restrictions (specifically accessing ICC profile files),
    and some additional security issues over the 9.24 release.
  * Security issues have been the primary focus of this release,
    including solving several (well publicised) real
    and potential exploits.
    PLEASE NOTE:
    We (i.e. Ghostscript upstream) strongly urge users to upgrade
    to this latest release to avoid these issues.
  * Avoid that ps2epsi fails with
    'Error: /undefined in --setpagedevice--'
    Recent changes required to harden SAFER mode mean that
    it is no longer possible to run ps2epsi in SAFER mode,
    because it relies upon unsafe Ghostscript non-standard
    extension operators.
    Removing SAFER and DELAYSAFER, and the code to reset SAFER,
    allow ps2epsi to run as well as it ever did (ie badly).
    This program (i.e. ps2epsi) should now be considered unsafe,
    you should not use it on untrusted PostScript programs.
    Likely we (i.e. Ghostscript upstream) will deprecate and
    remove this program in future.
  For details see the News.htm and History9.htm files.
  Regarding installing packages (in particular release candidates)
  from the openSUSE build service development project "Printing"
  see https://build.opensuse.org/project/show/Printing</changelog>
  <changelog author="jsmeix@suse.de" date="1536926400">- Version upgrade to 9.25
  For the highlights in this release see the highlights in the
  9.25rc1 first release candidate for 9.25 entry below.
  PLEASE NOTE:
  We (i.e. Ghostscript upstream) strongly urge users to upgrade
  to this latest release to avoid these issues.
  For a release summary see:
  http://www.ghostscript.com/doc/9.25/News.htm
  For details see the News.htm and History9.htm files.
  The Ghostscript 9.25 release should fix (see below)
  in particular those security issues:
  * CVE-2018-15909: shading_param incomplete type checking
    https://bugs.ghostscript.com/show_bug.cgi?id=699660
    https://bugzilla.suse.com/show_bug.cgi?id=1106172 bsc#1106172
  * CVE-2018-15908: .tempfile file permission issues
    https://bugs.ghostscript.com/show_bug.cgi?id=699657
    https://bugzilla.suse.com/show_bug.cgi?id=1106171 bsc#1106171
  * CVE-2018-15910: LockDistillerParams type confusion
    https://bugs.ghostscript.com/show_bug.cgi?id=699656
    https://bugzilla.suse.com/show_bug.cgi?id=1106173 bsc#1106173
  * CVE-2018-15911: uninitialized memory access in the aesdecode
    https://bugs.ghostscript.com/show_bug.cgi?id=699665
    https://bugzilla.suse.com/show_bug.cgi?id=1106195 bsc#1106195
  * CVE-2018-16513: setcolor missing type check
    https://bugs.ghostscript.com/show_bug.cgi?id=699655
    https://bugzilla.suse.com/show_bug.cgi?id=1107412 bsc#1107412
  * CVE-2018-16509: /invalidaccess bypass after failed restore
    https://bugs.ghostscript.com/show_bug.cgi?id=699654
    https://bugzilla.suse.com/show_bug.cgi?id=1107410 bsc#1107410
  * CVE-2018-16510: Incorrect exec stack handling in the "CS"
    and "SC" PDF primitives
    https://bugs.ghostscript.com/show_bug.cgi?id=699671
    https://bugzilla.suse.com/show_bug.cgi?id=1107411 bsc#1107411
  * CVE-2018-16542: .definemodifiedfont memory corruption
    if /typecheck is handled
    https://bugs.ghostscript.com/show_bug.cgi?id=699668
    https://bugzilla.suse.com/show_bug.cgi?id=1107413 bsc#1107413
  * CVE-2018-16541 incorrect free logic in pagedevice replacement
    https://bugs.ghostscript.com/show_bug.cgi?id=699664
    https://bugzilla.suse.com/show_bug.cgi?id=1107421 bsc#1107421
  * CVE-2018-16540 use-after-free in copydevice handling
    https://bugs.ghostscript.com/show_bug.cgi?id=699661
    https://bugzilla.suse.com/show_bug.cgi?id=1107420 bsc#1107420
  * CVE-2018-16539: incorrect access checking in temp file
    handling to disclose contents of files
    https://bugs.ghostscript.com/show_bug.cgi?id=699658
    https://bugzilla.suse.com/show_bug.cgi?id=1107422 bsc#1107422
  * CVE-2018-16543: gssetresolution and gsgetresolution allow
    for unspecified impact
    https://bugs.ghostscript.com/show_bug.cgi?id=699670
    https://bugzilla.suse.com/show_bug.cgi?id=1107423 bsc#1107423
  * CVE-2018-16511: type confusion in "ztype" could be used by
    remote attackers able to supply crafted PostScript to crash
    the interpreter or possibly have unspecified other impact
    https://bugs.ghostscript.com/show_bug.cgi?id=699659
    https://bugzilla.suse.com/show_bug.cgi?id=1107426 bsc#1107426
  * CVE-2018-16585 .setdistillerkeys PostScript command is
    accepted even though it is not intended for use
    https://bugzilla.suse.com/show_bug.cgi?id=1107581 bsc#1107581
  * CVE-2018-16802: Incorrect"restoration of privilege" checking
    when running out of stack during exceptionhandling could be
    used by attackers able to supply crafted PostScript to execute
    code using the "pipe" instruction. This is due to an incomplete
    fix for CVE-2018-16509
    https://bugs.ghostscript.com/show_bug.cgi?id=699714
    https://bugs.ghostscript.com/show_bug.cgi?id=699718
    https://bugzilla.suse.com/show_bug.cgi?id=1108027 bnc#1108027
  Regarding what the above "should fix" means:
  PostScript is a general purpose Turing-complete programming
  language (cf. https://en.wikipedia.org/wiki/PostScript)
  that supports in particular file access on the system disk.
  When Ghostscript processes PostScript it runs a PostScript
  program as the user who runs Ghostscript.
  When Ghostscript processes an arbitrary PostScript file,
  the user who runs Ghostscript runs an arbitrary program
  which can do anything on the system where Ghostscript runs
  that this user is allowed to do on that system.
  To make it safer when Ghostscript runs a PostScript program
  the Ghostscript command line option '-dSAFER' disables
  certain file access functionality, for details see
  /usr/share/doc/ghostscript/9.25/Use.htm
  Its name 'SAFER' says everything: It makes it 'safer'
  to let Ghostscript run a PostScript program,
  but it does not make it completely safe.
  In theory software is safe against misuse (i.e. has no bugs).
  In practice there is an endless sequence of various kind of
  security issues (i.e. software can be misused to do more than
  what is intended) that get fixed issue by issue ad infinitum.
  In the end all that means:
  In practice the user who runs Ghostscript must not let it
  process arbitrary PostScript files from untrusted origin.
  In particular Ghostscript is usually run when printing
  documents (with the '-dSAFER' option set), see the part about
  "It is crucial to limit access to CUPS to trusted users" in
  https://en.opensuse.org/SDB:CUPS_and_SANE_Firewall_settings</changelog>
  <changelog author="jsmeix@suse.de" date="1541764800">- Version upgrade to 9.26rc1 (first release candidate for 9.26).
  Highlights in this release include:
  * Purely security and a few bug fixes, there are no new features,
    and no API changes to report.</changelog>
  <changelog author="jsmeix@suse.de" date="1543579200">- Version upgrade to 9.26
  Highlights in this release include:
  * Security issues have been the primary focus of this release,
    including solving several (well publicised) real and potential
    exploits.
    Thanks to Man Yue Mo of Semmle Security Research Team,
    Jens Mueller of Ruhr-Universitaet Bochum and
    Tavis Ormandy of Google's Project Zero
    for their help to identify specific security issues.
    PLEASE NOTE:
    We (i.e. Ghostscript upstream) strongly urge users to upgrade
    to this latest release to avoid these issues.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  For a release summary see:
  http://www.ghostscript.com/doc/9.26/News.htm
  For details see the News.htm and History9.htm files.
  The Ghostscript 9.26 release should fix (cf. the entry below
  dated 'Fri Sep 14 10:47:33 CEST 2018' what "should fix" means)
  in particular those security issues (bsc#1117331)
  * CVE-2018-19475: psi/zdevice2.c allows attackers to bypass
    intended access restrictions
    https://bugs.ghostscript.com/show_bug.cgi?id=700153
    https://bugzilla.suse.com/show_bug.cgi?id=1117327 bsc#1117327
  * CVE-2018-19476: psi/zicc.c allows attackers to bypass
    intended access restrictions because of a setcolorspace
    type confusion
    https://bugs.ghostscript.com/show_bug.cgi?id=700169
    https://bugzilla.suse.com/show_bug.cgi?id=1117313 bsc#1117313
  * CVE-2018-19477: psi/zfjbig2.c allows attackers to bypass
    intended access restrictions because of a JBIG2Decode
    type confusion
    https://bugs.ghostscript.com/show_bug.cgi?id=700168
    https://bugzilla.suse.com/show_bug.cgi?id=1117274 bsc#1117274
  * CVE-2018-19409: LockSafetyParams is not checked correctly
    if another device is used
    https://bugs.ghostscript.com/show_bug.cgi?id=700176
    https://bugzilla.suse.com/show_bug.cgi?id=1117022 bsc#1117022
  and those security issues
  * CVE-2018-18284: 1Policy operator gives access to .forceput
    https://bugs.ghostscript.com/show_bug.cgi?id=69963
    https://bugzilla.suse.com/show_bug.cgi?id=1112229 bsc#1112229
  * CVE-2018-18073: saved execution stacks can leak operator arrays
    https://bugs.ghostscript.com/show_bug.cgi?id=699927
    https://bugzilla.suse.com/show_bug.cgi?id=1111480 bsc#1111480
  * CVE-2018-17961: bypassing executeonly to escape -dSAFER sandbox
    https://bugs.ghostscript.com/show_bug.cgi?id=699816
    https://bugzilla.suse.com/show_bug.cgi?id=1111479 bsc#1111479
  * CVE-2018-17183: remote attackers could be able to supply
    crafted PostScript to potentially overwrite or replace
    error handlers to inject code
    https://bugs.ghostscript.com/show_bug.cgi?id=699708
    https://bugzilla.suse.com/show_bug.cgi?id=1109105 bsc#1109105</changelog>
  <changelog author="jsmeix@suse.de" date="1547726400">- Version upgrade to 9.26a
  The version 9.26a is a special security bugfix version to fix
  * CVE-2019-6116: subroutines within pseudo-operators
    must themselves be pseudo-operators
    https://bugs.ghostscript.com/show_bug.cgi?id=700317
    https://bugzilla.suse.com/show_bug.cgi?id=1122319 bsc#1122319</changelog>
  <changelog author="jsmeix@suse.de" date="1552996800">- CVE-2019-3838.patch fixes CVE-2019-3838
  forceput in DefineResource is still accessible
  https://bugzilla.suse.com/show_bug.cgi?id=1129186 bsc#1129186
  https://bugs.ghostscript.com/show_bug.cgi?id=700576</changelog>
  <changelog author="jsmeix@suse.de" date="1554379200">- Version upgrade to 9.27
  Highlights in this release include:
  * We (i.e. Ghostscript upstream) have extensively cleaned up
    the Postscript name space: removing access to internal and/or
    undocumented Postscript operators, procedures and data.
    This has benefits for security and maintainability.
    Incompatible changes:
    The process of "tidying" the Postscript name space should
    have removed only non-standard and undocumented operators.
    Nevertheless, it is possible that any integrations or
    utilities that rely on those non-standard and undocumented
    operators may stop working, or may change behaviour.
    If you encounter such a case, please contact us (i.e.
    Ghostscript upstream) - (either the #ghostscript IRC channel,
    or the gs-devel mailing list would be best), and we'll work
    with you to either find an alternative solution.
  * Fontmap can now reference invidual fonts in a TrueType
    Collection for font subsitution. Previously, a Fontmap entry
    could only reference a TrueType collection and use the default
    (first) font.
    Now, the Fontmap syntax allows for specifying a specific index
    in a TTC. See the comments at the top of (the default)
    Fontmap.GS for details.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  IMPORTANT: It is our intention, within the next 12 months
    (ideally sooner, in time for the next release) to make SAFER
    the default mode of operation. For many users this will have
    no effect, since they use SAFER explicitly, but some niche
    uses which rely on SAFER being disabled may need to start
    explicitly adding the "-dNOSAFER" option.
  IMPORTANT: We (i.e. Ghostscript upstream) are in the process of
    forking LittleCMS. LCMS2 is not thread safe, and cannot be made
    thread safe without breaking the ABI. Our fork will be thread
    safe, and include performance enhancements (these changes have
    all be been offered and rejected upstream). We will maintain
    compatibility between Ghostscript and LCMS2 for a time, but not
    in perpetuity. Our fork will be available as its own package
    separately from Ghostscript (and MuPDF).
  For a release summary see:
  http://www.ghostscript.com/doc/9.27/News.htm
  For details see the News.htm and History9.htm files.
  The Ghostscript 9.27 release should fix (cf. the entry below
  dated 'Fri Sep 14 10:47:33 CEST 2018' what "should fix" means)
  in particular those security issues:
  * CVE-2019-3838 forceput in DefineResource is still accessible
    https://bugzilla.suse.com/show_bug.cgi?id=1129186 bsc#1129186
    https://bugs.ghostscript.com/show_bug.cgi?id=700576
  * CVE-2019-3835: superexec operator is available
    https://bugzilla.suse.com/show_bug.cgi?id=1129180 bsc#1129180
    https://bugs.ghostscript.com/show_bug.cgi?id=700585</changelog>
  <changelog author="werner@suse.de" date="1565611200">- CVE-2019-10216.patch fixes CVE-2019-10216
  forceput/superexec in .buildfont1 is still accessible
  https://bugzilla.suse.com/show_bug.cgi?id=1144621 bsc#1144621
  https://bugs.ghostscript.com/show_bug.cgi?id=701394</changelog>
  <changelog author="werner@suse.de" date="1568376000">- Add patch openjpeg4gs-CVE-2018-6616-8ee33522.patch
  to fix bsc#1140359 for CVE-2019-12973</changelog>
  <changelog author="werner@suse.de" date="1568635200">- Add patch gs-CVE-2019-14811-885444fc.patch to fix bsc#1146882
  for CVE-2019-14811,CVE-2019-14812,CVE-2019-14813
- Add patch gs-CVE-2019-14817-cd1b1cac.patch to fix bsc#1146884
  for CVE-2019-14817</changelog>
  <changelog author="werner@suse.de" date="1568635201">- Port latest ghostscript 9.27 from factory including latest
  security patches to SLES15/SLES12
  * Port patch CVE-2019-10216.patch to 9.27 which is the orignal
    upstream commit now
  * Drop patch CVE-2019-3838.patch as now part of 9.27</changelog>
  <changelog author="jsmeix@suse.de" date="1573473600">- CVE-2019-14869.patch contains commit from Ghostscript upstream
  https://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=485904772c5f
  to fix CVE-2019-14869 "-dSAFER escape in .charkeys"
  (bsc#1156275)</changelog>
  <changelog author="jsmeix@suse.de" date="1588075200">- The version upgrade to 9.52 fixes in particular
  CVE-2020-12268: jbic2dec: heap-based buffer overflow
  in jbig2_image_compose (bsc#1170603)
- Version upgrade to 9.52
  Highlights in this release include:
  * The 9.52 release replaces the 9.51 release after a problem
    was reported with 9.51 which warranted the quick turnaround.
    Thus, like 9.51, 9.52 is primarily a maintenance release,
    consolidating the changes we introduced in 9.50.
  * IMPORTANT: We have forked LittleCMS2 into LittleCMS2mt
    (the "mt" indicating "multi-thread").
    LCMS2 is not thread-safe, and cannot be made thread-safe
    without breaking the ABI. Our fork will be thread-safe and
    include performance enhancements (these changes have all
    been offered and rejected upstream). We will maintain
    compatibility between Ghostscript and LCMS2 for a time,
    but not in perpetuity. If there is sufficient interest,
    our fork will be available as its own package separately
    from Ghostscript (and MuPDF).
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  Incompatible changes:
  * New option -dALLOWPSTRANSPARENCY: The transparency compositor
    (and related features), whilst we are improving it, remains
    sensitive to being driven correctly, and incorrect use
    can have unexpected/undefined results. Hence, as part of
    improving security, we limited access to these operators,
    originally using the -dSAFER feature. As we made "SAFER"
    the default mode, that became unacceptable, hence the
    new option -dALLOWPSTRANSPARENCY which enables access
    to the operators, cf.
    https://www.ghostscript.com/doc/9.52/Use.htm#ALLOWPSTRANSPARENCY
  For a release summary see:
  https://www.ghostscript.com/doc/9.52/News.htm
  For details see the News.htm and History9.htm files.
- Version upgrade to 9.51
  Highlights in this release include:
  * 9.51 is primarily a maintainance release, consolidating
    the changes we introduced in 9.50.
  * We have continued our work on code hygiene for this release,
    with a focus on the static analysis tool Coverity
    (from Synopsys, Inc) and we are now maintaining a policy of
    zero Coverity issues in the Ghostscript/GhostPDL source base.
  * IMPORTANT: In consultation with a representative of
    OpenPrinting (http://www.openprinting.org/) it is our
    intention to deprecate and, in the not distant future,
    remove the OpenPrinting Vector/Raster Printer Drivers
    (that is, the opvp and oprp devices).
    If you rely on either of these devices, please get in touch
    with us (i.e. Ghostscript upstream), so we can discuss your
    use case, and revise our plans accordingly.
  * We (i.e. Ghostscript upstream) are in the process of forking
    LittleCMS, cf. the other release notes entries below.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  For a release summary see:
  https://www.ghostscript.com/doc/9.51/News.htm
  For details see the News.htm and History9.htm files.
- Version upgrade to 9.50
  Highlights in this release include:
  * The change to version 9.50 follows recognition
    of the extent and importance of the file access control
    redesign/reimplementation outlined below.
  * The file access control capability (enable with -dSAFER)
    has been completely rewritten, with a ground-up rethink
    of the design. For more details, see: "SAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#Safer
  * It is important to note that -dSAFER now only enables the
    file access controls, and no longer applies restrictions
    to standard Postscript functionality (specifically,
    restrictions on setpagedevice). If your application relies
    on these Postscript restrictions, see "OLDSAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#OldSafer
    and please get in touch, as we do plan to remove those
    Postscript restrictions unless we have reason not to.
  IMPORTANT: File access controls are now enabled by default.
    In order to run Ghostscript without these controls,
    see "NOSAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#NoSafer
  * We (i.e. Ghostscript upstream) are in the process of forking
    LittleCMS, cf. the other release notes entries below.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  Incompatible changes:
  * There are a couple of subtle incompatibilities between the old
    and new SAFER implementations. Firstly, as mentioned above,
    SAFER now leaves standard Postcript functionality unchanged
    (except for the file access limitations). Secondly, the
    interaction with save/restore operations, see "SAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#Safer
  * The following is not strictly speaking new to 9.50,
    as not much has changed since 9.27 in this area,
    but for those who don't upgrade with every release:
    The process of "tidying" the Postscript name space should have
    removed only non-standard and undocumented operators.
    Nevertheless, it is possible that any integrations or utilities
    that rely on those non-standard and undocumented operators
    may stop working, or may change behaviour.
    If you encounter such a case, please contact us
    (i.e. Ghostscript upstream, either the #ghostscript IRC channel
    or the gs-devel mailing list would be best), and we'll work
    with you to either find an alternative solution or return the
    previous functionality, if there is genuinely no other option.
    One case we know this has occurred is GSView 5 (and earlier).
    GSView 5 support for PDF files relied upon internal use only
    features which are no longer available. GSView 5 will still
    work as previously for Postscript files. For PDF files,
    users are encouraged to look at MuPDF https://www.mupdf.com/
  For a release summary see:
  https://www.ghostscript.com/doc/9.50/News.htm
  For details see the News.htm and History9.htm files.
- CVE-2019-10216.patch CVE-2019-14869.patch
  gs-CVE-2019-14811-885444fc.patch
  gs-CVE-2019-14817-cd1b1cac.patch
  openjpeg4gs-CVE-2018-6616-8ee33522.patch
  are fixed in the version 9.52 upstream sources.</changelog>
  <changelog author="jsmeix@suse.de" date="1595851200">- CVE-2020-15900.patch fixes CVE-2020-15900
  Memory Corruption (SAFER Sandbox Breakout)
  cf. https://bugs.ghostscript.com/show_bug.cgi?id=702582
  (bsc#1174415)</changelog>
  <changelog author="wolfgang.frisch@suse.com" date="1619006400">- Hardening: link as position independent executable (bsc#1184123).</changelog>
  <changelog author="jsmeix@suse.de" date="1631275200">- CVE-2021-3781.patch fixes CVE-2021-3781
  Trivial -dSAFER bypass
  cf. https://bugs.ghostscript.com/show_bug.cgi?id=704342
  (bsc#1190381)</changelog>
  <changelog author="werner@suse.de" date="1632916800">- Use update-alternatives to get the real ghostscript binary from
  /usr/bin/gs to /usr/bin/gs.bin and allow the gswrap package to
  use this with its wrapper script (jira#PM-3037)</changelog>
  <changelog author="jsmeix@suse.de" date="1641902400">- CVE-2021-45944.patch fixes CVE-2021-45944
  use-after-free in sampled_data_sample
  cf. https://github.com/google/oss-fuzz-vulns/blob/main/vulns/ghostscript/OSV-2021-237.yaml
  (bsc#1194303)
- CVE-2021-45949.patch fixes CVE-2021-45949
  heap-based buffer overflow in sampled_data_finish
  cf. https://github.com/google/oss-fuzz-vulns/blob/main/vulns/ghostscript/OSV-2021-803.yaml
  (bsc#1194304)</changelog>
</package>
<package pkgid="4a81459bd20b7aca89fcc344263de2fa393543f27994360821c517eb49b8e55c" name="ghostscript-devel" arch="ppc64le">
  <version epoch="0" ver="9.52" rel="161.1"/>
  <changelog author="jsmeix@suse.de" date="1528200000">- CVE-2018-10194.patch fixes stack-based buffer overflow
  in gdevpdts.c (bsc#1090099), see
  https://bugs.ghostscript.com/show_bug.cgi?id=699255 and
  http://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=39b1e54b2968620723bf32e96764c88797714879</changelog>
  <changelog author="jsmeix@suse.de" date="1536840000">- Version upgrade to 9.24
  Highlights in this release include:
  * Security issues have been the primary focus of this release,
    including solving several (well publicised)
    real and potential exploits.
    PLEASE NOTE:
    We (i.e. Ghostscript upstream) strongly urge users to upgrade
    to this latest release to avoid these issues.
  * As well as Ghostscript itself, jbig2dec has had a significant
    amount of work improving its robustness in the face of
    out specification files.
  * IMPORTANT: We (i.e. Ghostscript upstream) are in the process
    of forking LittleCMS. LCMS2 is not thread safe, and cannot
    be made thread safe without breaking the ABI. Our fork
    will be thread safe, and include performance enhancements
    (these changes have all be been offered and rejected upstream).
    We will maintain compatibility between Ghostscript and LCMS2
    for a time, but not in perpetuity. Our fork will be available
    as its own package separately from Ghostscript (and MuPDF).
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  For a release summary see:
  http://www.ghostscript.com/doc/9.24/News.htm
  For details see the News.htm and History9.htm files.
- fix_ln_docdir_gsdatadir.patch is no longer needed
  because the issue is fixed in the upstream sources.
- CVE-2018-10194.patch is no longer needed
  because the issue is fixed in the upstream sources.</changelog>
  <changelog author="jsmeix@suse.de" date="1536840001">- Version upgrade to 9.25rc1 (first release candidate for 9.25).
  Highlights in this release include:
  * This release fixes problems with argument handling, some
    unintended results of the security fixes to the SAFER file
    access restrictions (specifically accessing ICC profile files),
    and some additional security issues over the 9.24 release.
  * Security issues have been the primary focus of this release,
    including solving several (well publicised) real
    and potential exploits.
    PLEASE NOTE:
    We (i.e. Ghostscript upstream) strongly urge users to upgrade
    to this latest release to avoid these issues.
  * Avoid that ps2epsi fails with
    'Error: /undefined in --setpagedevice--'
    Recent changes required to harden SAFER mode mean that
    it is no longer possible to run ps2epsi in SAFER mode,
    because it relies upon unsafe Ghostscript non-standard
    extension operators.
    Removing SAFER and DELAYSAFER, and the code to reset SAFER,
    allow ps2epsi to run as well as it ever did (ie badly).
    This program (i.e. ps2epsi) should now be considered unsafe,
    you should not use it on untrusted PostScript programs.
    Likely we (i.e. Ghostscript upstream) will deprecate and
    remove this program in future.
  For details see the News.htm and History9.htm files.
  Regarding installing packages (in particular release candidates)
  from the openSUSE build service development project "Printing"
  see https://build.opensuse.org/project/show/Printing</changelog>
  <changelog author="jsmeix@suse.de" date="1536926400">- Version upgrade to 9.25
  For the highlights in this release see the highlights in the
  9.25rc1 first release candidate for 9.25 entry below.
  PLEASE NOTE:
  We (i.e. Ghostscript upstream) strongly urge users to upgrade
  to this latest release to avoid these issues.
  For a release summary see:
  http://www.ghostscript.com/doc/9.25/News.htm
  For details see the News.htm and History9.htm files.
  The Ghostscript 9.25 release should fix (see below)
  in particular those security issues:
  * CVE-2018-15909: shading_param incomplete type checking
    https://bugs.ghostscript.com/show_bug.cgi?id=699660
    https://bugzilla.suse.com/show_bug.cgi?id=1106172 bsc#1106172
  * CVE-2018-15908: .tempfile file permission issues
    https://bugs.ghostscript.com/show_bug.cgi?id=699657
    https://bugzilla.suse.com/show_bug.cgi?id=1106171 bsc#1106171
  * CVE-2018-15910: LockDistillerParams type confusion
    https://bugs.ghostscript.com/show_bug.cgi?id=699656
    https://bugzilla.suse.com/show_bug.cgi?id=1106173 bsc#1106173
  * CVE-2018-15911: uninitialized memory access in the aesdecode
    https://bugs.ghostscript.com/show_bug.cgi?id=699665
    https://bugzilla.suse.com/show_bug.cgi?id=1106195 bsc#1106195
  * CVE-2018-16513: setcolor missing type check
    https://bugs.ghostscript.com/show_bug.cgi?id=699655
    https://bugzilla.suse.com/show_bug.cgi?id=1107412 bsc#1107412
  * CVE-2018-16509: /invalidaccess bypass after failed restore
    https://bugs.ghostscript.com/show_bug.cgi?id=699654
    https://bugzilla.suse.com/show_bug.cgi?id=1107410 bsc#1107410
  * CVE-2018-16510: Incorrect exec stack handling in the "CS"
    and "SC" PDF primitives
    https://bugs.ghostscript.com/show_bug.cgi?id=699671
    https://bugzilla.suse.com/show_bug.cgi?id=1107411 bsc#1107411
  * CVE-2018-16542: .definemodifiedfont memory corruption
    if /typecheck is handled
    https://bugs.ghostscript.com/show_bug.cgi?id=699668
    https://bugzilla.suse.com/show_bug.cgi?id=1107413 bsc#1107413
  * CVE-2018-16541 incorrect free logic in pagedevice replacement
    https://bugs.ghostscript.com/show_bug.cgi?id=699664
    https://bugzilla.suse.com/show_bug.cgi?id=1107421 bsc#1107421
  * CVE-2018-16540 use-after-free in copydevice handling
    https://bugs.ghostscript.com/show_bug.cgi?id=699661
    https://bugzilla.suse.com/show_bug.cgi?id=1107420 bsc#1107420
  * CVE-2018-16539: incorrect access checking in temp file
    handling to disclose contents of files
    https://bugs.ghostscript.com/show_bug.cgi?id=699658
    https://bugzilla.suse.com/show_bug.cgi?id=1107422 bsc#1107422
  * CVE-2018-16543: gssetresolution and gsgetresolution allow
    for unspecified impact
    https://bugs.ghostscript.com/show_bug.cgi?id=699670
    https://bugzilla.suse.com/show_bug.cgi?id=1107423 bsc#1107423
  * CVE-2018-16511: type confusion in "ztype" could be used by
    remote attackers able to supply crafted PostScript to crash
    the interpreter or possibly have unspecified other impact
    https://bugs.ghostscript.com/show_bug.cgi?id=699659
    https://bugzilla.suse.com/show_bug.cgi?id=1107426 bsc#1107426
  * CVE-2018-16585 .setdistillerkeys PostScript command is
    accepted even though it is not intended for use
    https://bugzilla.suse.com/show_bug.cgi?id=1107581 bsc#1107581
  * CVE-2018-16802: Incorrect"restoration of privilege" checking
    when running out of stack during exceptionhandling could be
    used by attackers able to supply crafted PostScript to execute
    code using the "pipe" instruction. This is due to an incomplete
    fix for CVE-2018-16509
    https://bugs.ghostscript.com/show_bug.cgi?id=699714
    https://bugs.ghostscript.com/show_bug.cgi?id=699718
    https://bugzilla.suse.com/show_bug.cgi?id=1108027 bnc#1108027
  Regarding what the above "should fix" means:
  PostScript is a general purpose Turing-complete programming
  language (cf. https://en.wikipedia.org/wiki/PostScript)
  that supports in particular file access on the system disk.
  When Ghostscript processes PostScript it runs a PostScript
  program as the user who runs Ghostscript.
  When Ghostscript processes an arbitrary PostScript file,
  the user who runs Ghostscript runs an arbitrary program
  which can do anything on the system where Ghostscript runs
  that this user is allowed to do on that system.
  To make it safer when Ghostscript runs a PostScript program
  the Ghostscript command line option '-dSAFER' disables
  certain file access functionality, for details see
  /usr/share/doc/ghostscript/9.25/Use.htm
  Its name 'SAFER' says everything: It makes it 'safer'
  to let Ghostscript run a PostScript program,
  but it does not make it completely safe.
  In theory software is safe against misuse (i.e. has no bugs).
  In practice there is an endless sequence of various kind of
  security issues (i.e. software can be misused to do more than
  what is intended) that get fixed issue by issue ad infinitum.
  In the end all that means:
  In practice the user who runs Ghostscript must not let it
  process arbitrary PostScript files from untrusted origin.
  In particular Ghostscript is usually run when printing
  documents (with the '-dSAFER' option set), see the part about
  "It is crucial to limit access to CUPS to trusted users" in
  https://en.opensuse.org/SDB:CUPS_and_SANE_Firewall_settings</changelog>
  <changelog author="jsmeix@suse.de" date="1541764800">- Version upgrade to 9.26rc1 (first release candidate for 9.26).
  Highlights in this release include:
  * Purely security and a few bug fixes, there are no new features,
    and no API changes to report.</changelog>
  <changelog author="jsmeix@suse.de" date="1543579200">- Version upgrade to 9.26
  Highlights in this release include:
  * Security issues have been the primary focus of this release,
    including solving several (well publicised) real and potential
    exploits.
    Thanks to Man Yue Mo of Semmle Security Research Team,
    Jens Mueller of Ruhr-Universitaet Bochum and
    Tavis Ormandy of Google's Project Zero
    for their help to identify specific security issues.
    PLEASE NOTE:
    We (i.e. Ghostscript upstream) strongly urge users to upgrade
    to this latest release to avoid these issues.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  For a release summary see:
  http://www.ghostscript.com/doc/9.26/News.htm
  For details see the News.htm and History9.htm files.
  The Ghostscript 9.26 release should fix (cf. the entry below
  dated 'Fri Sep 14 10:47:33 CEST 2018' what "should fix" means)
  in particular those security issues (bsc#1117331)
  * CVE-2018-19475: psi/zdevice2.c allows attackers to bypass
    intended access restrictions
    https://bugs.ghostscript.com/show_bug.cgi?id=700153
    https://bugzilla.suse.com/show_bug.cgi?id=1117327 bsc#1117327
  * CVE-2018-19476: psi/zicc.c allows attackers to bypass
    intended access restrictions because of a setcolorspace
    type confusion
    https://bugs.ghostscript.com/show_bug.cgi?id=700169
    https://bugzilla.suse.com/show_bug.cgi?id=1117313 bsc#1117313
  * CVE-2018-19477: psi/zfjbig2.c allows attackers to bypass
    intended access restrictions because of a JBIG2Decode
    type confusion
    https://bugs.ghostscript.com/show_bug.cgi?id=700168
    https://bugzilla.suse.com/show_bug.cgi?id=1117274 bsc#1117274
  * CVE-2018-19409: LockSafetyParams is not checked correctly
    if another device is used
    https://bugs.ghostscript.com/show_bug.cgi?id=700176
    https://bugzilla.suse.com/show_bug.cgi?id=1117022 bsc#1117022
  and those security issues
  * CVE-2018-18284: 1Policy operator gives access to .forceput
    https://bugs.ghostscript.com/show_bug.cgi?id=69963
    https://bugzilla.suse.com/show_bug.cgi?id=1112229 bsc#1112229
  * CVE-2018-18073: saved execution stacks can leak operator arrays
    https://bugs.ghostscript.com/show_bug.cgi?id=699927
    https://bugzilla.suse.com/show_bug.cgi?id=1111480 bsc#1111480
  * CVE-2018-17961: bypassing executeonly to escape -dSAFER sandbox
    https://bugs.ghostscript.com/show_bug.cgi?id=699816
    https://bugzilla.suse.com/show_bug.cgi?id=1111479 bsc#1111479
  * CVE-2018-17183: remote attackers could be able to supply
    crafted PostScript to potentially overwrite or replace
    error handlers to inject code
    https://bugs.ghostscript.com/show_bug.cgi?id=699708
    https://bugzilla.suse.com/show_bug.cgi?id=1109105 bsc#1109105</changelog>
  <changelog author="jsmeix@suse.de" date="1547726400">- Version upgrade to 9.26a
  The version 9.26a is a special security bugfix version to fix
  * CVE-2019-6116: subroutines within pseudo-operators
    must themselves be pseudo-operators
    https://bugs.ghostscript.com/show_bug.cgi?id=700317
    https://bugzilla.suse.com/show_bug.cgi?id=1122319 bsc#1122319</changelog>
  <changelog author="jsmeix@suse.de" date="1552996800">- CVE-2019-3838.patch fixes CVE-2019-3838
  forceput in DefineResource is still accessible
  https://bugzilla.suse.com/show_bug.cgi?id=1129186 bsc#1129186
  https://bugs.ghostscript.com/show_bug.cgi?id=700576</changelog>
  <changelog author="jsmeix@suse.de" date="1554379200">- Version upgrade to 9.27
  Highlights in this release include:
  * We (i.e. Ghostscript upstream) have extensively cleaned up
    the Postscript name space: removing access to internal and/or
    undocumented Postscript operators, procedures and data.
    This has benefits for security and maintainability.
    Incompatible changes:
    The process of "tidying" the Postscript name space should
    have removed only non-standard and undocumented operators.
    Nevertheless, it is possible that any integrations or
    utilities that rely on those non-standard and undocumented
    operators may stop working, or may change behaviour.
    If you encounter such a case, please contact us (i.e.
    Ghostscript upstream) - (either the #ghostscript IRC channel,
    or the gs-devel mailing list would be best), and we'll work
    with you to either find an alternative solution.
  * Fontmap can now reference invidual fonts in a TrueType
    Collection for font subsitution. Previously, a Fontmap entry
    could only reference a TrueType collection and use the default
    (first) font.
    Now, the Fontmap syntax allows for specifying a specific index
    in a TTC. See the comments at the top of (the default)
    Fontmap.GS for details.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  IMPORTANT: It is our intention, within the next 12 months
    (ideally sooner, in time for the next release) to make SAFER
    the default mode of operation. For many users this will have
    no effect, since they use SAFER explicitly, but some niche
    uses which rely on SAFER being disabled may need to start
    explicitly adding the "-dNOSAFER" option.
  IMPORTANT: We (i.e. Ghostscript upstream) are in the process of
    forking LittleCMS. LCMS2 is not thread safe, and cannot be made
    thread safe without breaking the ABI. Our fork will be thread
    safe, and include performance enhancements (these changes have
    all be been offered and rejected upstream). We will maintain
    compatibility between Ghostscript and LCMS2 for a time, but not
    in perpetuity. Our fork will be available as its own package
    separately from Ghostscript (and MuPDF).
  For a release summary see:
  http://www.ghostscript.com/doc/9.27/News.htm
  For details see the News.htm and History9.htm files.
  The Ghostscript 9.27 release should fix (cf. the entry below
  dated 'Fri Sep 14 10:47:33 CEST 2018' what "should fix" means)
  in particular those security issues:
  * CVE-2019-3838 forceput in DefineResource is still accessible
    https://bugzilla.suse.com/show_bug.cgi?id=1129186 bsc#1129186
    https://bugs.ghostscript.com/show_bug.cgi?id=700576
  * CVE-2019-3835: superexec operator is available
    https://bugzilla.suse.com/show_bug.cgi?id=1129180 bsc#1129180
    https://bugs.ghostscript.com/show_bug.cgi?id=700585</changelog>
  <changelog author="werner@suse.de" date="1565611200">- CVE-2019-10216.patch fixes CVE-2019-10216
  forceput/superexec in .buildfont1 is still accessible
  https://bugzilla.suse.com/show_bug.cgi?id=1144621 bsc#1144621
  https://bugs.ghostscript.com/show_bug.cgi?id=701394</changelog>
  <changelog author="werner@suse.de" date="1568376000">- Add patch openjpeg4gs-CVE-2018-6616-8ee33522.patch
  to fix bsc#1140359 for CVE-2019-12973</changelog>
  <changelog author="werner@suse.de" date="1568635200">- Add patch gs-CVE-2019-14811-885444fc.patch to fix bsc#1146882
  for CVE-2019-14811,CVE-2019-14812,CVE-2019-14813
- Add patch gs-CVE-2019-14817-cd1b1cac.patch to fix bsc#1146884
  for CVE-2019-14817</changelog>
  <changelog author="werner@suse.de" date="1568635201">- Port latest ghostscript 9.27 from factory including latest
  security patches to SLES15/SLES12
  * Port patch CVE-2019-10216.patch to 9.27 which is the orignal
    upstream commit now
  * Drop patch CVE-2019-3838.patch as now part of 9.27</changelog>
  <changelog author="jsmeix@suse.de" date="1573473600">- CVE-2019-14869.patch contains commit from Ghostscript upstream
  https://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=485904772c5f
  to fix CVE-2019-14869 "-dSAFER escape in .charkeys"
  (bsc#1156275)</changelog>
  <changelog author="jsmeix@suse.de" date="1588075200">- The version upgrade to 9.52 fixes in particular
  CVE-2020-12268: jbic2dec: heap-based buffer overflow
  in jbig2_image_compose (bsc#1170603)
- Version upgrade to 9.52
  Highlights in this release include:
  * The 9.52 release replaces the 9.51 release after a problem
    was reported with 9.51 which warranted the quick turnaround.
    Thus, like 9.51, 9.52 is primarily a maintenance release,
    consolidating the changes we introduced in 9.50.
  * IMPORTANT: We have forked LittleCMS2 into LittleCMS2mt
    (the "mt" indicating "multi-thread").
    LCMS2 is not thread-safe, and cannot be made thread-safe
    without breaking the ABI. Our fork will be thread-safe and
    include performance enhancements (these changes have all
    been offered and rejected upstream). We will maintain
    compatibility between Ghostscript and LCMS2 for a time,
    but not in perpetuity. If there is sufficient interest,
    our fork will be available as its own package separately
    from Ghostscript (and MuPDF).
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  Incompatible changes:
  * New option -dALLOWPSTRANSPARENCY: The transparency compositor
    (and related features), whilst we are improving it, remains
    sensitive to being driven correctly, and incorrect use
    can have unexpected/undefined results. Hence, as part of
    improving security, we limited access to these operators,
    originally using the -dSAFER feature. As we made "SAFER"
    the default mode, that became unacceptable, hence the
    new option -dALLOWPSTRANSPARENCY which enables access
    to the operators, cf.
    https://www.ghostscript.com/doc/9.52/Use.htm#ALLOWPSTRANSPARENCY
  For a release summary see:
  https://www.ghostscript.com/doc/9.52/News.htm
  For details see the News.htm and History9.htm files.
- Version upgrade to 9.51
  Highlights in this release include:
  * 9.51 is primarily a maintainance release, consolidating
    the changes we introduced in 9.50.
  * We have continued our work on code hygiene for this release,
    with a focus on the static analysis tool Coverity
    (from Synopsys, Inc) and we are now maintaining a policy of
    zero Coverity issues in the Ghostscript/GhostPDL source base.
  * IMPORTANT: In consultation with a representative of
    OpenPrinting (http://www.openprinting.org/) it is our
    intention to deprecate and, in the not distant future,
    remove the OpenPrinting Vector/Raster Printer Drivers
    (that is, the opvp and oprp devices).
    If you rely on either of these devices, please get in touch
    with us (i.e. Ghostscript upstream), so we can discuss your
    use case, and revise our plans accordingly.
  * We (i.e. Ghostscript upstream) are in the process of forking
    LittleCMS, cf. the other release notes entries below.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  For a release summary see:
  https://www.ghostscript.com/doc/9.51/News.htm
  For details see the News.htm and History9.htm files.
- Version upgrade to 9.50
  Highlights in this release include:
  * The change to version 9.50 follows recognition
    of the extent and importance of the file access control
    redesign/reimplementation outlined below.
  * The file access control capability (enable with -dSAFER)
    has been completely rewritten, with a ground-up rethink
    of the design. For more details, see: "SAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#Safer
  * It is important to note that -dSAFER now only enables the
    file access controls, and no longer applies restrictions
    to standard Postscript functionality (specifically,
    restrictions on setpagedevice). If your application relies
    on these Postscript restrictions, see "OLDSAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#OldSafer
    and please get in touch, as we do plan to remove those
    Postscript restrictions unless we have reason not to.
  IMPORTANT: File access controls are now enabled by default.
    In order to run Ghostscript without these controls,
    see "NOSAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#NoSafer
  * We (i.e. Ghostscript upstream) are in the process of forking
    LittleCMS, cf. the other release notes entries below.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  Incompatible changes:
  * There are a couple of subtle incompatibilities between the old
    and new SAFER implementations. Firstly, as mentioned above,
    SAFER now leaves standard Postcript functionality unchanged
    (except for the file access limitations). Secondly, the
    interaction with save/restore operations, see "SAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#Safer
  * The following is not strictly speaking new to 9.50,
    as not much has changed since 9.27 in this area,
    but for those who don't upgrade with every release:
    The process of "tidying" the Postscript name space should have
    removed only non-standard and undocumented operators.
    Nevertheless, it is possible that any integrations or utilities
    that rely on those non-standard and undocumented operators
    may stop working, or may change behaviour.
    If you encounter such a case, please contact us
    (i.e. Ghostscript upstream, either the #ghostscript IRC channel
    or the gs-devel mailing list would be best), and we'll work
    with you to either find an alternative solution or return the
    previous functionality, if there is genuinely no other option.
    One case we know this has occurred is GSView 5 (and earlier).
    GSView 5 support for PDF files relied upon internal use only
    features which are no longer available. GSView 5 will still
    work as previously for Postscript files. For PDF files,
    users are encouraged to look at MuPDF https://www.mupdf.com/
  For a release summary see:
  https://www.ghostscript.com/doc/9.50/News.htm
  For details see the News.htm and History9.htm files.
- CVE-2019-10216.patch CVE-2019-14869.patch
  gs-CVE-2019-14811-885444fc.patch
  gs-CVE-2019-14817-cd1b1cac.patch
  openjpeg4gs-CVE-2018-6616-8ee33522.patch
  are fixed in the version 9.52 upstream sources.</changelog>
  <changelog author="jsmeix@suse.de" date="1595851200">- CVE-2020-15900.patch fixes CVE-2020-15900
  Memory Corruption (SAFER Sandbox Breakout)
  cf. https://bugs.ghostscript.com/show_bug.cgi?id=702582
  (bsc#1174415)</changelog>
  <changelog author="wolfgang.frisch@suse.com" date="1619006400">- Hardening: link as position independent executable (bsc#1184123).</changelog>
  <changelog author="jsmeix@suse.de" date="1631275200">- CVE-2021-3781.patch fixes CVE-2021-3781
  Trivial -dSAFER bypass
  cf. https://bugs.ghostscript.com/show_bug.cgi?id=704342
  (bsc#1190381)</changelog>
  <changelog author="werner@suse.de" date="1632916800">- Use update-alternatives to get the real ghostscript binary from
  /usr/bin/gs to /usr/bin/gs.bin and allow the gswrap package to
  use this with its wrapper script (jira#PM-3037)</changelog>
  <changelog author="jsmeix@suse.de" date="1641902400">- CVE-2021-45944.patch fixes CVE-2021-45944
  use-after-free in sampled_data_sample
  cf. https://github.com/google/oss-fuzz-vulns/blob/main/vulns/ghostscript/OSV-2021-237.yaml
  (bsc#1194303)
- CVE-2021-45949.patch fixes CVE-2021-45949
  heap-based buffer overflow in sampled_data_finish
  cf. https://github.com/google/oss-fuzz-vulns/blob/main/vulns/ghostscript/OSV-2021-803.yaml
  (bsc#1194304)</changelog>
</package>
<package pkgid="63fa62d56d08e6480b97fc20857561dee7fd49ba36a4739eb2cd50519f9ccf83" name="ghostscript-devel" arch="s390x">
  <version epoch="0" ver="9.52" rel="161.1"/>
  <changelog author="jsmeix@suse.de" date="1528200000">- CVE-2018-10194.patch fixes stack-based buffer overflow
  in gdevpdts.c (bsc#1090099), see
  https://bugs.ghostscript.com/show_bug.cgi?id=699255 and
  http://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=39b1e54b2968620723bf32e96764c88797714879</changelog>
  <changelog author="jsmeix@suse.de" date="1536840000">- Version upgrade to 9.24
  Highlights in this release include:
  * Security issues have been the primary focus of this release,
    including solving several (well publicised)
    real and potential exploits.
    PLEASE NOTE:
    We (i.e. Ghostscript upstream) strongly urge users to upgrade
    to this latest release to avoid these issues.
  * As well as Ghostscript itself, jbig2dec has had a significant
    amount of work improving its robustness in the face of
    out specification files.
  * IMPORTANT: We (i.e. Ghostscript upstream) are in the process
    of forking LittleCMS. LCMS2 is not thread safe, and cannot
    be made thread safe without breaking the ABI. Our fork
    will be thread safe, and include performance enhancements
    (these changes have all be been offered and rejected upstream).
    We will maintain compatibility between Ghostscript and LCMS2
    for a time, but not in perpetuity. Our fork will be available
    as its own package separately from Ghostscript (and MuPDF).
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  For a release summary see:
  http://www.ghostscript.com/doc/9.24/News.htm
  For details see the News.htm and History9.htm files.
- fix_ln_docdir_gsdatadir.patch is no longer needed
  because the issue is fixed in the upstream sources.
- CVE-2018-10194.patch is no longer needed
  because the issue is fixed in the upstream sources.</changelog>
  <changelog author="jsmeix@suse.de" date="1536840001">- Version upgrade to 9.25rc1 (first release candidate for 9.25).
  Highlights in this release include:
  * This release fixes problems with argument handling, some
    unintended results of the security fixes to the SAFER file
    access restrictions (specifically accessing ICC profile files),
    and some additional security issues over the 9.24 release.
  * Security issues have been the primary focus of this release,
    including solving several (well publicised) real
    and potential exploits.
    PLEASE NOTE:
    We (i.e. Ghostscript upstream) strongly urge users to upgrade
    to this latest release to avoid these issues.
  * Avoid that ps2epsi fails with
    'Error: /undefined in --setpagedevice--'
    Recent changes required to harden SAFER mode mean that
    it is no longer possible to run ps2epsi in SAFER mode,
    because it relies upon unsafe Ghostscript non-standard
    extension operators.
    Removing SAFER and DELAYSAFER, and the code to reset SAFER,
    allow ps2epsi to run as well as it ever did (ie badly).
    This program (i.e. ps2epsi) should now be considered unsafe,
    you should not use it on untrusted PostScript programs.
    Likely we (i.e. Ghostscript upstream) will deprecate and
    remove this program in future.
  For details see the News.htm and History9.htm files.
  Regarding installing packages (in particular release candidates)
  from the openSUSE build service development project "Printing"
  see https://build.opensuse.org/project/show/Printing</changelog>
  <changelog author="jsmeix@suse.de" date="1536926400">- Version upgrade to 9.25
  For the highlights in this release see the highlights in the
  9.25rc1 first release candidate for 9.25 entry below.
  PLEASE NOTE:
  We (i.e. Ghostscript upstream) strongly urge users to upgrade
  to this latest release to avoid these issues.
  For a release summary see:
  http://www.ghostscript.com/doc/9.25/News.htm
  For details see the News.htm and History9.htm files.
  The Ghostscript 9.25 release should fix (see below)
  in particular those security issues:
  * CVE-2018-15909: shading_param incomplete type checking
    https://bugs.ghostscript.com/show_bug.cgi?id=699660
    https://bugzilla.suse.com/show_bug.cgi?id=1106172 bsc#1106172
  * CVE-2018-15908: .tempfile file permission issues
    https://bugs.ghostscript.com/show_bug.cgi?id=699657
    https://bugzilla.suse.com/show_bug.cgi?id=1106171 bsc#1106171
  * CVE-2018-15910: LockDistillerParams type confusion
    https://bugs.ghostscript.com/show_bug.cgi?id=699656
    https://bugzilla.suse.com/show_bug.cgi?id=1106173 bsc#1106173
  * CVE-2018-15911: uninitialized memory access in the aesdecode
    https://bugs.ghostscript.com/show_bug.cgi?id=699665
    https://bugzilla.suse.com/show_bug.cgi?id=1106195 bsc#1106195
  * CVE-2018-16513: setcolor missing type check
    https://bugs.ghostscript.com/show_bug.cgi?id=699655
    https://bugzilla.suse.com/show_bug.cgi?id=1107412 bsc#1107412
  * CVE-2018-16509: /invalidaccess bypass after failed restore
    https://bugs.ghostscript.com/show_bug.cgi?id=699654
    https://bugzilla.suse.com/show_bug.cgi?id=1107410 bsc#1107410
  * CVE-2018-16510: Incorrect exec stack handling in the "CS"
    and "SC" PDF primitives
    https://bugs.ghostscript.com/show_bug.cgi?id=699671
    https://bugzilla.suse.com/show_bug.cgi?id=1107411 bsc#1107411
  * CVE-2018-16542: .definemodifiedfont memory corruption
    if /typecheck is handled
    https://bugs.ghostscript.com/show_bug.cgi?id=699668
    https://bugzilla.suse.com/show_bug.cgi?id=1107413 bsc#1107413
  * CVE-2018-16541 incorrect free logic in pagedevice replacement
    https://bugs.ghostscript.com/show_bug.cgi?id=699664
    https://bugzilla.suse.com/show_bug.cgi?id=1107421 bsc#1107421
  * CVE-2018-16540 use-after-free in copydevice handling
    https://bugs.ghostscript.com/show_bug.cgi?id=699661
    https://bugzilla.suse.com/show_bug.cgi?id=1107420 bsc#1107420
  * CVE-2018-16539: incorrect access checking in temp file
    handling to disclose contents of files
    https://bugs.ghostscript.com/show_bug.cgi?id=699658
    https://bugzilla.suse.com/show_bug.cgi?id=1107422 bsc#1107422
  * CVE-2018-16543: gssetresolution and gsgetresolution allow
    for unspecified impact
    https://bugs.ghostscript.com/show_bug.cgi?id=699670
    https://bugzilla.suse.com/show_bug.cgi?id=1107423 bsc#1107423
  * CVE-2018-16511: type confusion in "ztype" could be used by
    remote attackers able to supply crafted PostScript to crash
    the interpreter or possibly have unspecified other impact
    https://bugs.ghostscript.com/show_bug.cgi?id=699659
    https://bugzilla.suse.com/show_bug.cgi?id=1107426 bsc#1107426
  * CVE-2018-16585 .setdistillerkeys PostScript command is
    accepted even though it is not intended for use
    https://bugzilla.suse.com/show_bug.cgi?id=1107581 bsc#1107581
  * CVE-2018-16802: Incorrect"restoration of privilege" checking
    when running out of stack during exceptionhandling could be
    used by attackers able to supply crafted PostScript to execute
    code using the "pipe" instruction. This is due to an incomplete
    fix for CVE-2018-16509
    https://bugs.ghostscript.com/show_bug.cgi?id=699714
    https://bugs.ghostscript.com/show_bug.cgi?id=699718
    https://bugzilla.suse.com/show_bug.cgi?id=1108027 bnc#1108027
  Regarding what the above "should fix" means:
  PostScript is a general purpose Turing-complete programming
  language (cf. https://en.wikipedia.org/wiki/PostScript)
  that supports in particular file access on the system disk.
  When Ghostscript processes PostScript it runs a PostScript
  program as the user who runs Ghostscript.
  When Ghostscript processes an arbitrary PostScript file,
  the user who runs Ghostscript runs an arbitrary program
  which can do anything on the system where Ghostscript runs
  that this user is allowed to do on that system.
  To make it safer when Ghostscript runs a PostScript program
  the Ghostscript command line option '-dSAFER' disables
  certain file access functionality, for details see
  /usr/share/doc/ghostscript/9.25/Use.htm
  Its name 'SAFER' says everything: It makes it 'safer'
  to let Ghostscript run a PostScript program,
  but it does not make it completely safe.
  In theory software is safe against misuse (i.e. has no bugs).
  In practice there is an endless sequence of various kind of
  security issues (i.e. software can be misused to do more than
  what is intended) that get fixed issue by issue ad infinitum.
  In the end all that means:
  In practice the user who runs Ghostscript must not let it
  process arbitrary PostScript files from untrusted origin.
  In particular Ghostscript is usually run when printing
  documents (with the '-dSAFER' option set), see the part about
  "It is crucial to limit access to CUPS to trusted users" in
  https://en.opensuse.org/SDB:CUPS_and_SANE_Firewall_settings</changelog>
  <changelog author="jsmeix@suse.de" date="1541764800">- Version upgrade to 9.26rc1 (first release candidate for 9.26).
  Highlights in this release include:
  * Purely security and a few bug fixes, there are no new features,
    and no API changes to report.</changelog>
  <changelog author="jsmeix@suse.de" date="1543579200">- Version upgrade to 9.26
  Highlights in this release include:
  * Security issues have been the primary focus of this release,
    including solving several (well publicised) real and potential
    exploits.
    Thanks to Man Yue Mo of Semmle Security Research Team,
    Jens Mueller of Ruhr-Universitaet Bochum and
    Tavis Ormandy of Google's Project Zero
    for their help to identify specific security issues.
    PLEASE NOTE:
    We (i.e. Ghostscript upstream) strongly urge users to upgrade
    to this latest release to avoid these issues.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  For a release summary see:
  http://www.ghostscript.com/doc/9.26/News.htm
  For details see the News.htm and History9.htm files.
  The Ghostscript 9.26 release should fix (cf. the entry below
  dated 'Fri Sep 14 10:47:33 CEST 2018' what "should fix" means)
  in particular those security issues (bsc#1117331)
  * CVE-2018-19475: psi/zdevice2.c allows attackers to bypass
    intended access restrictions
    https://bugs.ghostscript.com/show_bug.cgi?id=700153
    https://bugzilla.suse.com/show_bug.cgi?id=1117327 bsc#1117327
  * CVE-2018-19476: psi/zicc.c allows attackers to bypass
    intended access restrictions because of a setcolorspace
    type confusion
    https://bugs.ghostscript.com/show_bug.cgi?id=700169
    https://bugzilla.suse.com/show_bug.cgi?id=1117313 bsc#1117313
  * CVE-2018-19477: psi/zfjbig2.c allows attackers to bypass
    intended access restrictions because of a JBIG2Decode
    type confusion
    https://bugs.ghostscript.com/show_bug.cgi?id=700168
    https://bugzilla.suse.com/show_bug.cgi?id=1117274 bsc#1117274
  * CVE-2018-19409: LockSafetyParams is not checked correctly
    if another device is used
    https://bugs.ghostscript.com/show_bug.cgi?id=700176
    https://bugzilla.suse.com/show_bug.cgi?id=1117022 bsc#1117022
  and those security issues
  * CVE-2018-18284: 1Policy operator gives access to .forceput
    https://bugs.ghostscript.com/show_bug.cgi?id=69963
    https://bugzilla.suse.com/show_bug.cgi?id=1112229 bsc#1112229
  * CVE-2018-18073: saved execution stacks can leak operator arrays
    https://bugs.ghostscript.com/show_bug.cgi?id=699927
    https://bugzilla.suse.com/show_bug.cgi?id=1111480 bsc#1111480
  * CVE-2018-17961: bypassing executeonly to escape -dSAFER sandbox
    https://bugs.ghostscript.com/show_bug.cgi?id=699816
    https://bugzilla.suse.com/show_bug.cgi?id=1111479 bsc#1111479
  * CVE-2018-17183: remote attackers could be able to supply
    crafted PostScript to potentially overwrite or replace
    error handlers to inject code
    https://bugs.ghostscript.com/show_bug.cgi?id=699708
    https://bugzilla.suse.com/show_bug.cgi?id=1109105 bsc#1109105</changelog>
  <changelog author="jsmeix@suse.de" date="1547726400">- Version upgrade to 9.26a
  The version 9.26a is a special security bugfix version to fix
  * CVE-2019-6116: subroutines within pseudo-operators
    must themselves be pseudo-operators
    https://bugs.ghostscript.com/show_bug.cgi?id=700317
    https://bugzilla.suse.com/show_bug.cgi?id=1122319 bsc#1122319</changelog>
  <changelog author="jsmeix@suse.de" date="1552996800">- CVE-2019-3838.patch fixes CVE-2019-3838
  forceput in DefineResource is still accessible
  https://bugzilla.suse.com/show_bug.cgi?id=1129186 bsc#1129186
  https://bugs.ghostscript.com/show_bug.cgi?id=700576</changelog>
  <changelog author="jsmeix@suse.de" date="1554379200">- Version upgrade to 9.27
  Highlights in this release include:
  * We (i.e. Ghostscript upstream) have extensively cleaned up
    the Postscript name space: removing access to internal and/or
    undocumented Postscript operators, procedures and data.
    This has benefits for security and maintainability.
    Incompatible changes:
    The process of "tidying" the Postscript name space should
    have removed only non-standard and undocumented operators.
    Nevertheless, it is possible that any integrations or
    utilities that rely on those non-standard and undocumented
    operators may stop working, or may change behaviour.
    If you encounter such a case, please contact us (i.e.
    Ghostscript upstream) - (either the #ghostscript IRC channel,
    or the gs-devel mailing list would be best), and we'll work
    with you to either find an alternative solution.
  * Fontmap can now reference invidual fonts in a TrueType
    Collection for font subsitution. Previously, a Fontmap entry
    could only reference a TrueType collection and use the default
    (first) font.
    Now, the Fontmap syntax allows for specifying a specific index
    in a TTC. See the comments at the top of (the default)
    Fontmap.GS for details.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  IMPORTANT: It is our intention, within the next 12 months
    (ideally sooner, in time for the next release) to make SAFER
    the default mode of operation. For many users this will have
    no effect, since they use SAFER explicitly, but some niche
    uses which rely on SAFER being disabled may need to start
    explicitly adding the "-dNOSAFER" option.
  IMPORTANT: We (i.e. Ghostscript upstream) are in the process of
    forking LittleCMS. LCMS2 is not thread safe, and cannot be made
    thread safe without breaking the ABI. Our fork will be thread
    safe, and include performance enhancements (these changes have
    all be been offered and rejected upstream). We will maintain
    compatibility between Ghostscript and LCMS2 for a time, but not
    in perpetuity. Our fork will be available as its own package
    separately from Ghostscript (and MuPDF).
  For a release summary see:
  http://www.ghostscript.com/doc/9.27/News.htm
  For details see the News.htm and History9.htm files.
  The Ghostscript 9.27 release should fix (cf. the entry below
  dated 'Fri Sep 14 10:47:33 CEST 2018' what "should fix" means)
  in particular those security issues:
  * CVE-2019-3838 forceput in DefineResource is still accessible
    https://bugzilla.suse.com/show_bug.cgi?id=1129186 bsc#1129186
    https://bugs.ghostscript.com/show_bug.cgi?id=700576
  * CVE-2019-3835: superexec operator is available
    https://bugzilla.suse.com/show_bug.cgi?id=1129180 bsc#1129180
    https://bugs.ghostscript.com/show_bug.cgi?id=700585</changelog>
  <changelog author="werner@suse.de" date="1565611200">- CVE-2019-10216.patch fixes CVE-2019-10216
  forceput/superexec in .buildfont1 is still accessible
  https://bugzilla.suse.com/show_bug.cgi?id=1144621 bsc#1144621
  https://bugs.ghostscript.com/show_bug.cgi?id=701394</changelog>
  <changelog author="werner@suse.de" date="1568376000">- Add patch openjpeg4gs-CVE-2018-6616-8ee33522.patch
  to fix bsc#1140359 for CVE-2019-12973</changelog>
  <changelog author="werner@suse.de" date="1568635200">- Add patch gs-CVE-2019-14811-885444fc.patch to fix bsc#1146882
  for CVE-2019-14811,CVE-2019-14812,CVE-2019-14813
- Add patch gs-CVE-2019-14817-cd1b1cac.patch to fix bsc#1146884
  for CVE-2019-14817</changelog>
  <changelog author="werner@suse.de" date="1568635201">- Port latest ghostscript 9.27 from factory including latest
  security patches to SLES15/SLES12
  * Port patch CVE-2019-10216.patch to 9.27 which is the orignal
    upstream commit now
  * Drop patch CVE-2019-3838.patch as now part of 9.27</changelog>
  <changelog author="jsmeix@suse.de" date="1573473600">- CVE-2019-14869.patch contains commit from Ghostscript upstream
  https://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=485904772c5f
  to fix CVE-2019-14869 "-dSAFER escape in .charkeys"
  (bsc#1156275)</changelog>
  <changelog author="jsmeix@suse.de" date="1588075200">- The version upgrade to 9.52 fixes in particular
  CVE-2020-12268: jbic2dec: heap-based buffer overflow
  in jbig2_image_compose (bsc#1170603)
- Version upgrade to 9.52
  Highlights in this release include:
  * The 9.52 release replaces the 9.51 release after a problem
    was reported with 9.51 which warranted the quick turnaround.
    Thus, like 9.51, 9.52 is primarily a maintenance release,
    consolidating the changes we introduced in 9.50.
  * IMPORTANT: We have forked LittleCMS2 into LittleCMS2mt
    (the "mt" indicating "multi-thread").
    LCMS2 is not thread-safe, and cannot be made thread-safe
    without breaking the ABI. Our fork will be thread-safe and
    include performance enhancements (these changes have all
    been offered and rejected upstream). We will maintain
    compatibility between Ghostscript and LCMS2 for a time,
    but not in perpetuity. If there is sufficient interest,
    our fork will be available as its own package separately
    from Ghostscript (and MuPDF).
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  Incompatible changes:
  * New option -dALLOWPSTRANSPARENCY: The transparency compositor
    (and related features), whilst we are improving it, remains
    sensitive to being driven correctly, and incorrect use
    can have unexpected/undefined results. Hence, as part of
    improving security, we limited access to these operators,
    originally using the -dSAFER feature. As we made "SAFER"
    the default mode, that became unacceptable, hence the
    new option -dALLOWPSTRANSPARENCY which enables access
    to the operators, cf.
    https://www.ghostscript.com/doc/9.52/Use.htm#ALLOWPSTRANSPARENCY
  For a release summary see:
  https://www.ghostscript.com/doc/9.52/News.htm
  For details see the News.htm and History9.htm files.
- Version upgrade to 9.51
  Highlights in this release include:
  * 9.51 is primarily a maintainance release, consolidating
    the changes we introduced in 9.50.
  * We have continued our work on code hygiene for this release,
    with a focus on the static analysis tool Coverity
    (from Synopsys, Inc) and we are now maintaining a policy of
    zero Coverity issues in the Ghostscript/GhostPDL source base.
  * IMPORTANT: In consultation with a representative of
    OpenPrinting (http://www.openprinting.org/) it is our
    intention to deprecate and, in the not distant future,
    remove the OpenPrinting Vector/Raster Printer Drivers
    (that is, the opvp and oprp devices).
    If you rely on either of these devices, please get in touch
    with us (i.e. Ghostscript upstream), so we can discuss your
    use case, and revise our plans accordingly.
  * We (i.e. Ghostscript upstream) are in the process of forking
    LittleCMS, cf. the other release notes entries below.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  For a release summary see:
  https://www.ghostscript.com/doc/9.51/News.htm
  For details see the News.htm and History9.htm files.
- Version upgrade to 9.50
  Highlights in this release include:
  * The change to version 9.50 follows recognition
    of the extent and importance of the file access control
    redesign/reimplementation outlined below.
  * The file access control capability (enable with -dSAFER)
    has been completely rewritten, with a ground-up rethink
    of the design. For more details, see: "SAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#Safer
  * It is important to note that -dSAFER now only enables the
    file access controls, and no longer applies restrictions
    to standard Postscript functionality (specifically,
    restrictions on setpagedevice). If your application relies
    on these Postscript restrictions, see "OLDSAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#OldSafer
    and please get in touch, as we do plan to remove those
    Postscript restrictions unless we have reason not to.
  IMPORTANT: File access controls are now enabled by default.
    In order to run Ghostscript without these controls,
    see "NOSAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#NoSafer
  * We (i.e. Ghostscript upstream) are in the process of forking
    LittleCMS, cf. the other release notes entries below.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  Incompatible changes:
  * There are a couple of subtle incompatibilities between the old
    and new SAFER implementations. Firstly, as mentioned above,
    SAFER now leaves standard Postcript functionality unchanged
    (except for the file access limitations). Secondly, the
    interaction with save/restore operations, see "SAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#Safer
  * The following is not strictly speaking new to 9.50,
    as not much has changed since 9.27 in this area,
    but for those who don't upgrade with every release:
    The process of "tidying" the Postscript name space should have
    removed only non-standard and undocumented operators.
    Nevertheless, it is possible that any integrations or utilities
    that rely on those non-standard and undocumented operators
    may stop working, or may change behaviour.
    If you encounter such a case, please contact us
    (i.e. Ghostscript upstream, either the #ghostscript IRC channel
    or the gs-devel mailing list would be best), and we'll work
    with you to either find an alternative solution or return the
    previous functionality, if there is genuinely no other option.
    One case we know this has occurred is GSView 5 (and earlier).
    GSView 5 support for PDF files relied upon internal use only
    features which are no longer available. GSView 5 will still
    work as previously for Postscript files. For PDF files,
    users are encouraged to look at MuPDF https://www.mupdf.com/
  For a release summary see:
  https://www.ghostscript.com/doc/9.50/News.htm
  For details see the News.htm and History9.htm files.
- CVE-2019-10216.patch CVE-2019-14869.patch
  gs-CVE-2019-14811-885444fc.patch
  gs-CVE-2019-14817-cd1b1cac.patch
  openjpeg4gs-CVE-2018-6616-8ee33522.patch
  are fixed in the version 9.52 upstream sources.</changelog>
  <changelog author="jsmeix@suse.de" date="1595851200">- CVE-2020-15900.patch fixes CVE-2020-15900
  Memory Corruption (SAFER Sandbox Breakout)
  cf. https://bugs.ghostscript.com/show_bug.cgi?id=702582
  (bsc#1174415)</changelog>
  <changelog author="wolfgang.frisch@suse.com" date="1619006400">- Hardening: link as position independent executable (bsc#1184123).</changelog>
  <changelog author="jsmeix@suse.de" date="1631275200">- CVE-2021-3781.patch fixes CVE-2021-3781
  Trivial -dSAFER bypass
  cf. https://bugs.ghostscript.com/show_bug.cgi?id=704342
  (bsc#1190381)</changelog>
  <changelog author="werner@suse.de" date="1632916800">- Use update-alternatives to get the real ghostscript binary from
  /usr/bin/gs to /usr/bin/gs.bin and allow the gswrap package to
  use this with its wrapper script (jira#PM-3037)</changelog>
  <changelog author="jsmeix@suse.de" date="1641902400">- CVE-2021-45944.patch fixes CVE-2021-45944
  use-after-free in sampled_data_sample
  cf. https://github.com/google/oss-fuzz-vulns/blob/main/vulns/ghostscript/OSV-2021-237.yaml
  (bsc#1194303)
- CVE-2021-45949.patch fixes CVE-2021-45949
  heap-based buffer overflow in sampled_data_finish
  cf. https://github.com/google/oss-fuzz-vulns/blob/main/vulns/ghostscript/OSV-2021-803.yaml
  (bsc#1194304)</changelog>
</package>
<package pkgid="e8a18641a9f228428439312fd557fb2532e89a51ac4847ea03e89a27f6c28f51" name="ghostscript-devel" arch="x86_64">
  <version epoch="0" ver="9.52" rel="161.1"/>
  <changelog author="jsmeix@suse.de" date="1528200000">- CVE-2018-10194.patch fixes stack-based buffer overflow
  in gdevpdts.c (bsc#1090099), see
  https://bugs.ghostscript.com/show_bug.cgi?id=699255 and
  http://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=39b1e54b2968620723bf32e96764c88797714879</changelog>
  <changelog author="jsmeix@suse.de" date="1536840000">- Version upgrade to 9.24
  Highlights in this release include:
  * Security issues have been the primary focus of this release,
    including solving several (well publicised)
    real and potential exploits.
    PLEASE NOTE:
    We (i.e. Ghostscript upstream) strongly urge users to upgrade
    to this latest release to avoid these issues.
  * As well as Ghostscript itself, jbig2dec has had a significant
    amount of work improving its robustness in the face of
    out specification files.
  * IMPORTANT: We (i.e. Ghostscript upstream) are in the process
    of forking LittleCMS. LCMS2 is not thread safe, and cannot
    be made thread safe without breaking the ABI. Our fork
    will be thread safe, and include performance enhancements
    (these changes have all be been offered and rejected upstream).
    We will maintain compatibility between Ghostscript and LCMS2
    for a time, but not in perpetuity. Our fork will be available
    as its own package separately from Ghostscript (and MuPDF).
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  For a release summary see:
  http://www.ghostscript.com/doc/9.24/News.htm
  For details see the News.htm and History9.htm files.
- fix_ln_docdir_gsdatadir.patch is no longer needed
  because the issue is fixed in the upstream sources.
- CVE-2018-10194.patch is no longer needed
  because the issue is fixed in the upstream sources.</changelog>
  <changelog author="jsmeix@suse.de" date="1536840001">- Version upgrade to 9.25rc1 (first release candidate for 9.25).
  Highlights in this release include:
  * This release fixes problems with argument handling, some
    unintended results of the security fixes to the SAFER file
    access restrictions (specifically accessing ICC profile files),
    and some additional security issues over the 9.24 release.
  * Security issues have been the primary focus of this release,
    including solving several (well publicised) real
    and potential exploits.
    PLEASE NOTE:
    We (i.e. Ghostscript upstream) strongly urge users to upgrade
    to this latest release to avoid these issues.
  * Avoid that ps2epsi fails with
    'Error: /undefined in --setpagedevice--'
    Recent changes required to harden SAFER mode mean that
    it is no longer possible to run ps2epsi in SAFER mode,
    because it relies upon unsafe Ghostscript non-standard
    extension operators.
    Removing SAFER and DELAYSAFER, and the code to reset SAFER,
    allow ps2epsi to run as well as it ever did (ie badly).
    This program (i.e. ps2epsi) should now be considered unsafe,
    you should not use it on untrusted PostScript programs.
    Likely we (i.e. Ghostscript upstream) will deprecate and
    remove this program in future.
  For details see the News.htm and History9.htm files.
  Regarding installing packages (in particular release candidates)
  from the openSUSE build service development project "Printing"
  see https://build.opensuse.org/project/show/Printing</changelog>
  <changelog author="jsmeix@suse.de" date="1536926400">- Version upgrade to 9.25
  For the highlights in this release see the highlights in the
  9.25rc1 first release candidate for 9.25 entry below.
  PLEASE NOTE:
  We (i.e. Ghostscript upstream) strongly urge users to upgrade
  to this latest release to avoid these issues.
  For a release summary see:
  http://www.ghostscript.com/doc/9.25/News.htm
  For details see the News.htm and History9.htm files.
  The Ghostscript 9.25 release should fix (see below)
  in particular those security issues:
  * CVE-2018-15909: shading_param incomplete type checking
    https://bugs.ghostscript.com/show_bug.cgi?id=699660
    https://bugzilla.suse.com/show_bug.cgi?id=1106172 bsc#1106172
  * CVE-2018-15908: .tempfile file permission issues
    https://bugs.ghostscript.com/show_bug.cgi?id=699657
    https://bugzilla.suse.com/show_bug.cgi?id=1106171 bsc#1106171
  * CVE-2018-15910: LockDistillerParams type confusion
    https://bugs.ghostscript.com/show_bug.cgi?id=699656
    https://bugzilla.suse.com/show_bug.cgi?id=1106173 bsc#1106173
  * CVE-2018-15911: uninitialized memory access in the aesdecode
    https://bugs.ghostscript.com/show_bug.cgi?id=699665
    https://bugzilla.suse.com/show_bug.cgi?id=1106195 bsc#1106195
  * CVE-2018-16513: setcolor missing type check
    https://bugs.ghostscript.com/show_bug.cgi?id=699655
    https://bugzilla.suse.com/show_bug.cgi?id=1107412 bsc#1107412
  * CVE-2018-16509: /invalidaccess bypass after failed restore
    https://bugs.ghostscript.com/show_bug.cgi?id=699654
    https://bugzilla.suse.com/show_bug.cgi?id=1107410 bsc#1107410
  * CVE-2018-16510: Incorrect exec stack handling in the "CS"
    and "SC" PDF primitives
    https://bugs.ghostscript.com/show_bug.cgi?id=699671
    https://bugzilla.suse.com/show_bug.cgi?id=1107411 bsc#1107411
  * CVE-2018-16542: .definemodifiedfont memory corruption
    if /typecheck is handled
    https://bugs.ghostscript.com/show_bug.cgi?id=699668
    https://bugzilla.suse.com/show_bug.cgi?id=1107413 bsc#1107413
  * CVE-2018-16541 incorrect free logic in pagedevice replacement
    https://bugs.ghostscript.com/show_bug.cgi?id=699664
    https://bugzilla.suse.com/show_bug.cgi?id=1107421 bsc#1107421
  * CVE-2018-16540 use-after-free in copydevice handling
    https://bugs.ghostscript.com/show_bug.cgi?id=699661
    https://bugzilla.suse.com/show_bug.cgi?id=1107420 bsc#1107420
  * CVE-2018-16539: incorrect access checking in temp file
    handling to disclose contents of files
    https://bugs.ghostscript.com/show_bug.cgi?id=699658
    https://bugzilla.suse.com/show_bug.cgi?id=1107422 bsc#1107422
  * CVE-2018-16543: gssetresolution and gsgetresolution allow
    for unspecified impact
    https://bugs.ghostscript.com/show_bug.cgi?id=699670
    https://bugzilla.suse.com/show_bug.cgi?id=1107423 bsc#1107423
  * CVE-2018-16511: type confusion in "ztype" could be used by
    remote attackers able to supply crafted PostScript to crash
    the interpreter or possibly have unspecified other impact
    https://bugs.ghostscript.com/show_bug.cgi?id=699659
    https://bugzilla.suse.com/show_bug.cgi?id=1107426 bsc#1107426
  * CVE-2018-16585 .setdistillerkeys PostScript command is
    accepted even though it is not intended for use
    https://bugzilla.suse.com/show_bug.cgi?id=1107581 bsc#1107581
  * CVE-2018-16802: Incorrect"restoration of privilege" checking
    when running out of stack during exceptionhandling could be
    used by attackers able to supply crafted PostScript to execute
    code using the "pipe" instruction. This is due to an incomplete
    fix for CVE-2018-16509
    https://bugs.ghostscript.com/show_bug.cgi?id=699714
    https://bugs.ghostscript.com/show_bug.cgi?id=699718
    https://bugzilla.suse.com/show_bug.cgi?id=1108027 bnc#1108027
  Regarding what the above "should fix" means:
  PostScript is a general purpose Turing-complete programming
  language (cf. https://en.wikipedia.org/wiki/PostScript)
  that supports in particular file access on the system disk.
  When Ghostscript processes PostScript it runs a PostScript
  program as the user who runs Ghostscript.
  When Ghostscript processes an arbitrary PostScript file,
  the user who runs Ghostscript runs an arbitrary program
  which can do anything on the system where Ghostscript runs
  that this user is allowed to do on that system.
  To make it safer when Ghostscript runs a PostScript program
  the Ghostscript command line option '-dSAFER' disables
  certain file access functionality, for details see
  /usr/share/doc/ghostscript/9.25/Use.htm
  Its name 'SAFER' says everything: It makes it 'safer'
  to let Ghostscript run a PostScript program,
  but it does not make it completely safe.
  In theory software is safe against misuse (i.e. has no bugs).
  In practice there is an endless sequence of various kind of
  security issues (i.e. software can be misused to do more than
  what is intended) that get fixed issue by issue ad infinitum.
  In the end all that means:
  In practice the user who runs Ghostscript must not let it
  process arbitrary PostScript files from untrusted origin.
  In particular Ghostscript is usually run when printing
  documents (with the '-dSAFER' option set), see the part about
  "It is crucial to limit access to CUPS to trusted users" in
  https://en.opensuse.org/SDB:CUPS_and_SANE_Firewall_settings</changelog>
  <changelog author="jsmeix@suse.de" date="1541764800">- Version upgrade to 9.26rc1 (first release candidate for 9.26).
  Highlights in this release include:
  * Purely security and a few bug fixes, there are no new features,
    and no API changes to report.</changelog>
  <changelog author="jsmeix@suse.de" date="1543579200">- Version upgrade to 9.26
  Highlights in this release include:
  * Security issues have been the primary focus of this release,
    including solving several (well publicised) real and potential
    exploits.
    Thanks to Man Yue Mo of Semmle Security Research Team,
    Jens Mueller of Ruhr-Universitaet Bochum and
    Tavis Ormandy of Google's Project Zero
    for their help to identify specific security issues.
    PLEASE NOTE:
    We (i.e. Ghostscript upstream) strongly urge users to upgrade
    to this latest release to avoid these issues.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  For a release summary see:
  http://www.ghostscript.com/doc/9.26/News.htm
  For details see the News.htm and History9.htm files.
  The Ghostscript 9.26 release should fix (cf. the entry below
  dated 'Fri Sep 14 10:47:33 CEST 2018' what "should fix" means)
  in particular those security issues (bsc#1117331)
  * CVE-2018-19475: psi/zdevice2.c allows attackers to bypass
    intended access restrictions
    https://bugs.ghostscript.com/show_bug.cgi?id=700153
    https://bugzilla.suse.com/show_bug.cgi?id=1117327 bsc#1117327
  * CVE-2018-19476: psi/zicc.c allows attackers to bypass
    intended access restrictions because of a setcolorspace
    type confusion
    https://bugs.ghostscript.com/show_bug.cgi?id=700169
    https://bugzilla.suse.com/show_bug.cgi?id=1117313 bsc#1117313
  * CVE-2018-19477: psi/zfjbig2.c allows attackers to bypass
    intended access restrictions because of a JBIG2Decode
    type confusion
    https://bugs.ghostscript.com/show_bug.cgi?id=700168
    https://bugzilla.suse.com/show_bug.cgi?id=1117274 bsc#1117274
  * CVE-2018-19409: LockSafetyParams is not checked correctly
    if another device is used
    https://bugs.ghostscript.com/show_bug.cgi?id=700176
    https://bugzilla.suse.com/show_bug.cgi?id=1117022 bsc#1117022
  and those security issues
  * CVE-2018-18284: 1Policy operator gives access to .forceput
    https://bugs.ghostscript.com/show_bug.cgi?id=69963
    https://bugzilla.suse.com/show_bug.cgi?id=1112229 bsc#1112229
  * CVE-2018-18073: saved execution stacks can leak operator arrays
    https://bugs.ghostscript.com/show_bug.cgi?id=699927
    https://bugzilla.suse.com/show_bug.cgi?id=1111480 bsc#1111480
  * CVE-2018-17961: bypassing executeonly to escape -dSAFER sandbox
    https://bugs.ghostscript.com/show_bug.cgi?id=699816
    https://bugzilla.suse.com/show_bug.cgi?id=1111479 bsc#1111479
  * CVE-2018-17183: remote attackers could be able to supply
    crafted PostScript to potentially overwrite or replace
    error handlers to inject code
    https://bugs.ghostscript.com/show_bug.cgi?id=699708
    https://bugzilla.suse.com/show_bug.cgi?id=1109105 bsc#1109105</changelog>
  <changelog author="jsmeix@suse.de" date="1547726400">- Version upgrade to 9.26a
  The version 9.26a is a special security bugfix version to fix
  * CVE-2019-6116: subroutines within pseudo-operators
    must themselves be pseudo-operators
    https://bugs.ghostscript.com/show_bug.cgi?id=700317
    https://bugzilla.suse.com/show_bug.cgi?id=1122319 bsc#1122319</changelog>
  <changelog author="jsmeix@suse.de" date="1552996800">- CVE-2019-3838.patch fixes CVE-2019-3838
  forceput in DefineResource is still accessible
  https://bugzilla.suse.com/show_bug.cgi?id=1129186 bsc#1129186
  https://bugs.ghostscript.com/show_bug.cgi?id=700576</changelog>
  <changelog author="jsmeix@suse.de" date="1554379200">- Version upgrade to 9.27
  Highlights in this release include:
  * We (i.e. Ghostscript upstream) have extensively cleaned up
    the Postscript name space: removing access to internal and/or
    undocumented Postscript operators, procedures and data.
    This has benefits for security and maintainability.
    Incompatible changes:
    The process of "tidying" the Postscript name space should
    have removed only non-standard and undocumented operators.
    Nevertheless, it is possible that any integrations or
    utilities that rely on those non-standard and undocumented
    operators may stop working, or may change behaviour.
    If you encounter such a case, please contact us (i.e.
    Ghostscript upstream) - (either the #ghostscript IRC channel,
    or the gs-devel mailing list would be best), and we'll work
    with you to either find an alternative solution.
  * Fontmap can now reference invidual fonts in a TrueType
    Collection for font subsitution. Previously, a Fontmap entry
    could only reference a TrueType collection and use the default
    (first) font.
    Now, the Fontmap syntax allows for specifying a specific index
    in a TTC. See the comments at the top of (the default)
    Fontmap.GS for details.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  IMPORTANT: It is our intention, within the next 12 months
    (ideally sooner, in time for the next release) to make SAFER
    the default mode of operation. For many users this will have
    no effect, since they use SAFER explicitly, but some niche
    uses which rely on SAFER being disabled may need to start
    explicitly adding the "-dNOSAFER" option.
  IMPORTANT: We (i.e. Ghostscript upstream) are in the process of
    forking LittleCMS. LCMS2 is not thread safe, and cannot be made
    thread safe without breaking the ABI. Our fork will be thread
    safe, and include performance enhancements (these changes have
    all be been offered and rejected upstream). We will maintain
    compatibility between Ghostscript and LCMS2 for a time, but not
    in perpetuity. Our fork will be available as its own package
    separately from Ghostscript (and MuPDF).
  For a release summary see:
  http://www.ghostscript.com/doc/9.27/News.htm
  For details see the News.htm and History9.htm files.
  The Ghostscript 9.27 release should fix (cf. the entry below
  dated 'Fri Sep 14 10:47:33 CEST 2018' what "should fix" means)
  in particular those security issues:
  * CVE-2019-3838 forceput in DefineResource is still accessible
    https://bugzilla.suse.com/show_bug.cgi?id=1129186 bsc#1129186
    https://bugs.ghostscript.com/show_bug.cgi?id=700576
  * CVE-2019-3835: superexec operator is available
    https://bugzilla.suse.com/show_bug.cgi?id=1129180 bsc#1129180
    https://bugs.ghostscript.com/show_bug.cgi?id=700585</changelog>
  <changelog author="werner@suse.de" date="1565611200">- CVE-2019-10216.patch fixes CVE-2019-10216
  forceput/superexec in .buildfont1 is still accessible
  https://bugzilla.suse.com/show_bug.cgi?id=1144621 bsc#1144621
  https://bugs.ghostscript.com/show_bug.cgi?id=701394</changelog>
  <changelog author="werner@suse.de" date="1568376000">- Add patch openjpeg4gs-CVE-2018-6616-8ee33522.patch
  to fix bsc#1140359 for CVE-2019-12973</changelog>
  <changelog author="werner@suse.de" date="1568635200">- Add patch gs-CVE-2019-14811-885444fc.patch to fix bsc#1146882
  for CVE-2019-14811,CVE-2019-14812,CVE-2019-14813
- Add patch gs-CVE-2019-14817-cd1b1cac.patch to fix bsc#1146884
  for CVE-2019-14817</changelog>
  <changelog author="werner@suse.de" date="1568635201">- Port latest ghostscript 9.27 from factory including latest
  security patches to SLES15/SLES12
  * Port patch CVE-2019-10216.patch to 9.27 which is the orignal
    upstream commit now
  * Drop patch CVE-2019-3838.patch as now part of 9.27</changelog>
  <changelog author="jsmeix@suse.de" date="1573473600">- CVE-2019-14869.patch contains commit from Ghostscript upstream
  https://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=485904772c5f
  to fix CVE-2019-14869 "-dSAFER escape in .charkeys"
  (bsc#1156275)</changelog>
  <changelog author="jsmeix@suse.de" date="1588075200">- The version upgrade to 9.52 fixes in particular
  CVE-2020-12268: jbic2dec: heap-based buffer overflow
  in jbig2_image_compose (bsc#1170603)
- Version upgrade to 9.52
  Highlights in this release include:
  * The 9.52 release replaces the 9.51 release after a problem
    was reported with 9.51 which warranted the quick turnaround.
    Thus, like 9.51, 9.52 is primarily a maintenance release,
    consolidating the changes we introduced in 9.50.
  * IMPORTANT: We have forked LittleCMS2 into LittleCMS2mt
    (the "mt" indicating "multi-thread").
    LCMS2 is not thread-safe, and cannot be made thread-safe
    without breaking the ABI. Our fork will be thread-safe and
    include performance enhancements (these changes have all
    been offered and rejected upstream). We will maintain
    compatibility between Ghostscript and LCMS2 for a time,
    but not in perpetuity. If there is sufficient interest,
    our fork will be available as its own package separately
    from Ghostscript (and MuPDF).
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  Incompatible changes:
  * New option -dALLOWPSTRANSPARENCY: The transparency compositor
    (and related features), whilst we are improving it, remains
    sensitive to being driven correctly, and incorrect use
    can have unexpected/undefined results. Hence, as part of
    improving security, we limited access to these operators,
    originally using the -dSAFER feature. As we made "SAFER"
    the default mode, that became unacceptable, hence the
    new option -dALLOWPSTRANSPARENCY which enables access
    to the operators, cf.
    https://www.ghostscript.com/doc/9.52/Use.htm#ALLOWPSTRANSPARENCY
  For a release summary see:
  https://www.ghostscript.com/doc/9.52/News.htm
  For details see the News.htm and History9.htm files.
- Version upgrade to 9.51
  Highlights in this release include:
  * 9.51 is primarily a maintainance release, consolidating
    the changes we introduced in 9.50.
  * We have continued our work on code hygiene for this release,
    with a focus on the static analysis tool Coverity
    (from Synopsys, Inc) and we are now maintaining a policy of
    zero Coverity issues in the Ghostscript/GhostPDL source base.
  * IMPORTANT: In consultation with a representative of
    OpenPrinting (http://www.openprinting.org/) it is our
    intention to deprecate and, in the not distant future,
    remove the OpenPrinting Vector/Raster Printer Drivers
    (that is, the opvp and oprp devices).
    If you rely on either of these devices, please get in touch
    with us (i.e. Ghostscript upstream), so we can discuss your
    use case, and revise our plans accordingly.
  * We (i.e. Ghostscript upstream) are in the process of forking
    LittleCMS, cf. the other release notes entries below.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  For a release summary see:
  https://www.ghostscript.com/doc/9.51/News.htm
  For details see the News.htm and History9.htm files.
- Version upgrade to 9.50
  Highlights in this release include:
  * The change to version 9.50 follows recognition
    of the extent and importance of the file access control
    redesign/reimplementation outlined below.
  * The file access control capability (enable with -dSAFER)
    has been completely rewritten, with a ground-up rethink
    of the design. For more details, see: "SAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#Safer
  * It is important to note that -dSAFER now only enables the
    file access controls, and no longer applies restrictions
    to standard Postscript functionality (specifically,
    restrictions on setpagedevice). If your application relies
    on these Postscript restrictions, see "OLDSAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#OldSafer
    and please get in touch, as we do plan to remove those
    Postscript restrictions unless we have reason not to.
  IMPORTANT: File access controls are now enabled by default.
    In order to run Ghostscript without these controls,
    see "NOSAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#NoSafer
  * We (i.e. Ghostscript upstream) are in the process of forking
    LittleCMS, cf. the other release notes entries below.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  Incompatible changes:
  * There are a couple of subtle incompatibilities between the old
    and new SAFER implementations. Firstly, as mentioned above,
    SAFER now leaves standard Postcript functionality unchanged
    (except for the file access limitations). Secondly, the
    interaction with save/restore operations, see "SAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#Safer
  * The following is not strictly speaking new to 9.50,
    as not much has changed since 9.27 in this area,
    but for those who don't upgrade with every release:
    The process of "tidying" the Postscript name space should have
    removed only non-standard and undocumented operators.
    Nevertheless, it is possible that any integrations or utilities
    that rely on those non-standard and undocumented operators
    may stop working, or may change behaviour.
    If you encounter such a case, please contact us
    (i.e. Ghostscript upstream, either the #ghostscript IRC channel
    or the gs-devel mailing list would be best), and we'll work
    with you to either find an alternative solution or return the
    previous functionality, if there is genuinely no other option.
    One case we know this has occurred is GSView 5 (and earlier).
    GSView 5 support for PDF files relied upon internal use only
    features which are no longer available. GSView 5 will still
    work as previously for Postscript files. For PDF files,
    users are encouraged to look at MuPDF https://www.mupdf.com/
  For a release summary see:
  https://www.ghostscript.com/doc/9.50/News.htm
  For details see the News.htm and History9.htm files.
- CVE-2019-10216.patch CVE-2019-14869.patch
  gs-CVE-2019-14811-885444fc.patch
  gs-CVE-2019-14817-cd1b1cac.patch
  openjpeg4gs-CVE-2018-6616-8ee33522.patch
  are fixed in the version 9.52 upstream sources.</changelog>
  <changelog author="jsmeix@suse.de" date="1595851200">- CVE-2020-15900.patch fixes CVE-2020-15900
  Memory Corruption (SAFER Sandbox Breakout)
  cf. https://bugs.ghostscript.com/show_bug.cgi?id=702582
  (bsc#1174415)</changelog>
  <changelog author="wolfgang.frisch@suse.com" date="1619006400">- Hardening: link as position independent executable (bsc#1184123).</changelog>
  <changelog author="jsmeix@suse.de" date="1631275200">- CVE-2021-3781.patch fixes CVE-2021-3781
  Trivial -dSAFER bypass
  cf. https://bugs.ghostscript.com/show_bug.cgi?id=704342
  (bsc#1190381)</changelog>
  <changelog author="werner@suse.de" date="1632916800">- Use update-alternatives to get the real ghostscript binary from
  /usr/bin/gs to /usr/bin/gs.bin and allow the gswrap package to
  use this with its wrapper script (jira#PM-3037)</changelog>
  <changelog author="jsmeix@suse.de" date="1641902400">- CVE-2021-45944.patch fixes CVE-2021-45944
  use-after-free in sampled_data_sample
  cf. https://github.com/google/oss-fuzz-vulns/blob/main/vulns/ghostscript/OSV-2021-237.yaml
  (bsc#1194303)
- CVE-2021-45949.patch fixes CVE-2021-45949
  heap-based buffer overflow in sampled_data_finish
  cf. https://github.com/google/oss-fuzz-vulns/blob/main/vulns/ghostscript/OSV-2021-803.yaml
  (bsc#1194304)</changelog>
</package>
<package pkgid="5c63c25f4e39889483b8d33e83075e3a938db7d50483e9d62033bfa38d284472" name="ghostscript-x11" arch="aarch64">
  <version epoch="0" ver="9.52" rel="158.1"/>
  <changelog author="jsmeix@suse.de" date="1521720000">- Version upgrade to 9.23
  Highlights in this release include:
  * Ghostscript now has a family of 'pdfimage' devices
    (pdfimage8, pdfimage24 and pdfimage32) which produce
    rendered output wrapped up as an image in a PDF.
    Additionally, there is a 'pclm' device which
    produces PCLm format output.
  * There is now a ColorAccuracy parameter allowing the user
    to decide between speed or accuracy in ICC color transforms.
  * JPEG Passthrough: devices which support it can now receive
    the 'raw' JPEG stream from the interpreter.
    The main use of this is the pdfwrite/ps2write family of devices
    that can now take JPEG streams from the input file(s) and write
    them unchanged to the output (thus avoiding additional
    quantization effects).
  * PDF transparency performance improvements
  * IMPORTANT: We (i.e. Ghostscript upstream) are in the process
    of forking LittleCMS.
    LCMS2 is not thread safe, and cannot be made thread safe
    without breaking the ABI. Our fork will be thread safe,
    and include performance enhancements (these changes have all
    be been offered and rejected upstream). We will maintain
    compatibility between Ghostscript and LCMS2 for a time,
    but not in perpetuity. Our fork will be available as its own
    package separately from Ghostscript (and MuPDF).
  * We have continued the focus on code hygiene in this release
    cleaning up security issues, ignored return values,
    and compiler warnings.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  Incompatible changes
  * The planned device API tidy has, unfortunately, been
    indefinitely postponed, until appropriate resources
    are available.
  For a release summary see:
  http://www.ghostscript.com/doc/9.23/News.htm
  For details see the News.htm and History9.htm files.
  See also the entries below since "Version upgrade to 9.22"
  (boo#1082896 and boo#1074266).</changelog>
  <changelog author="jsmeix@suse.de" date="1528200000">- CVE-2018-10194.patch fixes stack-based buffer overflow
  in gdevpdts.c (bsc#1090099), see
  https://bugs.ghostscript.com/show_bug.cgi?id=699255 and
  http://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=39b1e54b2968620723bf32e96764c88797714879</changelog>
  <changelog author="jsmeix@suse.de" date="1536840000">- Version upgrade to 9.24
  Highlights in this release include:
  * Security issues have been the primary focus of this release,
    including solving several (well publicised)
    real and potential exploits.
    PLEASE NOTE:
    We (i.e. Ghostscript upstream) strongly urge users to upgrade
    to this latest release to avoid these issues.
  * As well as Ghostscript itself, jbig2dec has had a significant
    amount of work improving its robustness in the face of
    out specification files.
  * IMPORTANT: We (i.e. Ghostscript upstream) are in the process
    of forking LittleCMS. LCMS2 is not thread safe, and cannot
    be made thread safe without breaking the ABI. Our fork
    will be thread safe, and include performance enhancements
    (these changes have all be been offered and rejected upstream).
    We will maintain compatibility between Ghostscript and LCMS2
    for a time, but not in perpetuity. Our fork will be available
    as its own package separately from Ghostscript (and MuPDF).
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  For a release summary see:
  http://www.ghostscript.com/doc/9.24/News.htm
  For details see the News.htm and History9.htm files.
- fix_ln_docdir_gsdatadir.patch is no longer needed
  because the issue is fixed in the upstream sources.
- CVE-2018-10194.patch is no longer needed
  because the issue is fixed in the upstream sources.</changelog>
  <changelog author="jsmeix@suse.de" date="1536840001">- Version upgrade to 9.25rc1 (first release candidate for 9.25).
  Highlights in this release include:
  * This release fixes problems with argument handling, some
    unintended results of the security fixes to the SAFER file
    access restrictions (specifically accessing ICC profile files),
    and some additional security issues over the 9.24 release.
  * Security issues have been the primary focus of this release,
    including solving several (well publicised) real
    and potential exploits.
    PLEASE NOTE:
    We (i.e. Ghostscript upstream) strongly urge users to upgrade
    to this latest release to avoid these issues.
  * Avoid that ps2epsi fails with
    'Error: /undefined in --setpagedevice--'
    Recent changes required to harden SAFER mode mean that
    it is no longer possible to run ps2epsi in SAFER mode,
    because it relies upon unsafe Ghostscript non-standard
    extension operators.
    Removing SAFER and DELAYSAFER, and the code to reset SAFER,
    allow ps2epsi to run as well as it ever did (ie badly).
    This program (i.e. ps2epsi) should now be considered unsafe,
    you should not use it on untrusted PostScript programs.
    Likely we (i.e. Ghostscript upstream) will deprecate and
    remove this program in future.
  For details see the News.htm and History9.htm files.
  Regarding installing packages (in particular release candidates)
  from the openSUSE build service development project "Printing"
  see https://build.opensuse.org/project/show/Printing</changelog>
  <changelog author="jsmeix@suse.de" date="1536926400">- Version upgrade to 9.25
  For the highlights in this release see the highlights in the
  9.25rc1 first release candidate for 9.25 entry below.
  PLEASE NOTE:
  We (i.e. Ghostscript upstream) strongly urge users to upgrade
  to this latest release to avoid these issues.
  For a release summary see:
  http://www.ghostscript.com/doc/9.25/News.htm
  For details see the News.htm and History9.htm files.
  The Ghostscript 9.25 release should fix (see below)
  in particular those security issues:
  * CVE-2018-15909: shading_param incomplete type checking
    https://bugs.ghostscript.com/show_bug.cgi?id=699660
    https://bugzilla.suse.com/show_bug.cgi?id=1106172 bsc#1106172
  * CVE-2018-15908: .tempfile file permission issues
    https://bugs.ghostscript.com/show_bug.cgi?id=699657
    https://bugzilla.suse.com/show_bug.cgi?id=1106171 bsc#1106171
  * CVE-2018-15910: LockDistillerParams type confusion
    https://bugs.ghostscript.com/show_bug.cgi?id=699656
    https://bugzilla.suse.com/show_bug.cgi?id=1106173 bsc#1106173
  * CVE-2018-15911: uninitialized memory access in the aesdecode
    https://bugs.ghostscript.com/show_bug.cgi?id=699665
    https://bugzilla.suse.com/show_bug.cgi?id=1106195 bsc#1106195
  * CVE-2018-16513: setcolor missing type check
    https://bugs.ghostscript.com/show_bug.cgi?id=699655
    https://bugzilla.suse.com/show_bug.cgi?id=1107412 bsc#1107412
  * CVE-2018-16509: /invalidaccess bypass after failed restore
    https://bugs.ghostscript.com/show_bug.cgi?id=699654
    https://bugzilla.suse.com/show_bug.cgi?id=1107410 bsc#1107410
  * CVE-2018-16510: Incorrect exec stack handling in the "CS"
    and "SC" PDF primitives
    https://bugs.ghostscript.com/show_bug.cgi?id=699671
    https://bugzilla.suse.com/show_bug.cgi?id=1107411 bsc#1107411
  * CVE-2018-16542: .definemodifiedfont memory corruption
    if /typecheck is handled
    https://bugs.ghostscript.com/show_bug.cgi?id=699668
    https://bugzilla.suse.com/show_bug.cgi?id=1107413 bsc#1107413
  * CVE-2018-16541 incorrect free logic in pagedevice replacement
    https://bugs.ghostscript.com/show_bug.cgi?id=699664
    https://bugzilla.suse.com/show_bug.cgi?id=1107421 bsc#1107421
  * CVE-2018-16540 use-after-free in copydevice handling
    https://bugs.ghostscript.com/show_bug.cgi?id=699661
    https://bugzilla.suse.com/show_bug.cgi?id=1107420 bsc#1107420
  * CVE-2018-16539: incorrect access checking in temp file
    handling to disclose contents of files
    https://bugs.ghostscript.com/show_bug.cgi?id=699658
    https://bugzilla.suse.com/show_bug.cgi?id=1107422 bsc#1107422
  * CVE-2018-16543: gssetresolution and gsgetresolution allow
    for unspecified impact
    https://bugs.ghostscript.com/show_bug.cgi?id=699670
    https://bugzilla.suse.com/show_bug.cgi?id=1107423 bsc#1107423
  * CVE-2018-16511: type confusion in "ztype" could be used by
    remote attackers able to supply crafted PostScript to crash
    the interpreter or possibly have unspecified other impact
    https://bugs.ghostscript.com/show_bug.cgi?id=699659
    https://bugzilla.suse.com/show_bug.cgi?id=1107426 bsc#1107426
  * CVE-2018-16585 .setdistillerkeys PostScript command is
    accepted even though it is not intended for use
    https://bugzilla.suse.com/show_bug.cgi?id=1107581 bsc#1107581
  * CVE-2018-16802: Incorrect"restoration of privilege" checking
    when running out of stack during exceptionhandling could be
    used by attackers able to supply crafted PostScript to execute
    code using the "pipe" instruction. This is due to an incomplete
    fix for CVE-2018-16509
    https://bugs.ghostscript.com/show_bug.cgi?id=699714
    https://bugs.ghostscript.com/show_bug.cgi?id=699718
    https://bugzilla.suse.com/show_bug.cgi?id=1108027 bnc#1108027
  Regarding what the above "should fix" means:
  PostScript is a general purpose Turing-complete programming
  language (cf. https://en.wikipedia.org/wiki/PostScript)
  that supports in particular file access on the system disk.
  When Ghostscript processes PostScript it runs a PostScript
  program as the user who runs Ghostscript.
  When Ghostscript processes an arbitrary PostScript file,
  the user who runs Ghostscript runs an arbitrary program
  which can do anything on the system where Ghostscript runs
  that this user is allowed to do on that system.
  To make it safer when Ghostscript runs a PostScript program
  the Ghostscript command line option '-dSAFER' disables
  certain file access functionality, for details see
  /usr/share/doc/ghostscript/9.25/Use.htm
  Its name 'SAFER' says everything: It makes it 'safer'
  to let Ghostscript run a PostScript program,
  but it does not make it completely safe.
  In theory software is safe against misuse (i.e. has no bugs).
  In practice there is an endless sequence of various kind of
  security issues (i.e. software can be misused to do more than
  what is intended) that get fixed issue by issue ad infinitum.
  In the end all that means:
  In practice the user who runs Ghostscript must not let it
  process arbitrary PostScript files from untrusted origin.
  In particular Ghostscript is usually run when printing
  documents (with the '-dSAFER' option set), see the part about
  "It is crucial to limit access to CUPS to trusted users" in
  https://en.opensuse.org/SDB:CUPS_and_SANE_Firewall_settings</changelog>
  <changelog author="jsmeix@suse.de" date="1541764800">- Version upgrade to 9.26rc1 (first release candidate for 9.26).
  Highlights in this release include:
  * Purely security and a few bug fixes, there are no new features,
    and no API changes to report.</changelog>
  <changelog author="jsmeix@suse.de" date="1543579200">- Version upgrade to 9.26
  Highlights in this release include:
  * Security issues have been the primary focus of this release,
    including solving several (well publicised) real and potential
    exploits.
    Thanks to Man Yue Mo of Semmle Security Research Team,
    Jens Mueller of Ruhr-Universitaet Bochum and
    Tavis Ormandy of Google's Project Zero
    for their help to identify specific security issues.
    PLEASE NOTE:
    We (i.e. Ghostscript upstream) strongly urge users to upgrade
    to this latest release to avoid these issues.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  For a release summary see:
  http://www.ghostscript.com/doc/9.26/News.htm
  For details see the News.htm and History9.htm files.
  The Ghostscript 9.26 release should fix (cf. the entry below
  dated 'Fri Sep 14 10:47:33 CEST 2018' what "should fix" means)
  in particular those security issues (bsc#1117331)
  * CVE-2018-19475: psi/zdevice2.c allows attackers to bypass
    intended access restrictions
    https://bugs.ghostscript.com/show_bug.cgi?id=700153
    https://bugzilla.suse.com/show_bug.cgi?id=1117327 bsc#1117327
  * CVE-2018-19476: psi/zicc.c allows attackers to bypass
    intended access restrictions because of a setcolorspace
    type confusion
    https://bugs.ghostscript.com/show_bug.cgi?id=700169
    https://bugzilla.suse.com/show_bug.cgi?id=1117313 bsc#1117313
  * CVE-2018-19477: psi/zfjbig2.c allows attackers to bypass
    intended access restrictions because of a JBIG2Decode
    type confusion
    https://bugs.ghostscript.com/show_bug.cgi?id=700168
    https://bugzilla.suse.com/show_bug.cgi?id=1117274 bsc#1117274
  * CVE-2018-19409: LockSafetyParams is not checked correctly
    if another device is used
    https://bugs.ghostscript.com/show_bug.cgi?id=700176
    https://bugzilla.suse.com/show_bug.cgi?id=1117022 bsc#1117022
  and those security issues
  * CVE-2018-18284: 1Policy operator gives access to .forceput
    https://bugs.ghostscript.com/show_bug.cgi?id=69963
    https://bugzilla.suse.com/show_bug.cgi?id=1112229 bsc#1112229
  * CVE-2018-18073: saved execution stacks can leak operator arrays
    https://bugs.ghostscript.com/show_bug.cgi?id=699927
    https://bugzilla.suse.com/show_bug.cgi?id=1111480 bsc#1111480
  * CVE-2018-17961: bypassing executeonly to escape -dSAFER sandbox
    https://bugs.ghostscript.com/show_bug.cgi?id=699816
    https://bugzilla.suse.com/show_bug.cgi?id=1111479 bsc#1111479
  * CVE-2018-17183: remote attackers could be able to supply
    crafted PostScript to potentially overwrite or replace
    error handlers to inject code
    https://bugs.ghostscript.com/show_bug.cgi?id=699708
    https://bugzilla.suse.com/show_bug.cgi?id=1109105 bsc#1109105</changelog>
  <changelog author="jsmeix@suse.de" date="1547726400">- Version upgrade to 9.26a
  The version 9.26a is a special security bugfix version to fix
  * CVE-2019-6116: subroutines within pseudo-operators
    must themselves be pseudo-operators
    https://bugs.ghostscript.com/show_bug.cgi?id=700317
    https://bugzilla.suse.com/show_bug.cgi?id=1122319 bsc#1122319</changelog>
  <changelog author="jsmeix@suse.de" date="1552996800">- CVE-2019-3838.patch fixes CVE-2019-3838
  forceput in DefineResource is still accessible
  https://bugzilla.suse.com/show_bug.cgi?id=1129186 bsc#1129186
  https://bugs.ghostscript.com/show_bug.cgi?id=700576</changelog>
  <changelog author="jsmeix@suse.de" date="1554379200">- Version upgrade to 9.27
  Highlights in this release include:
  * We (i.e. Ghostscript upstream) have extensively cleaned up
    the Postscript name space: removing access to internal and/or
    undocumented Postscript operators, procedures and data.
    This has benefits for security and maintainability.
    Incompatible changes:
    The process of "tidying" the Postscript name space should
    have removed only non-standard and undocumented operators.
    Nevertheless, it is possible that any integrations or
    utilities that rely on those non-standard and undocumented
    operators may stop working, or may change behaviour.
    If you encounter such a case, please contact us (i.e.
    Ghostscript upstream) - (either the #ghostscript IRC channel,
    or the gs-devel mailing list would be best), and we'll work
    with you to either find an alternative solution.
  * Fontmap can now reference invidual fonts in a TrueType
    Collection for font subsitution. Previously, a Fontmap entry
    could only reference a TrueType collection and use the default
    (first) font.
    Now, the Fontmap syntax allows for specifying a specific index
    in a TTC. See the comments at the top of (the default)
    Fontmap.GS for details.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  IMPORTANT: It is our intention, within the next 12 months
    (ideally sooner, in time for the next release) to make SAFER
    the default mode of operation. For many users this will have
    no effect, since they use SAFER explicitly, but some niche
    uses which rely on SAFER being disabled may need to start
    explicitly adding the "-dNOSAFER" option.
  IMPORTANT: We (i.e. Ghostscript upstream) are in the process of
    forking LittleCMS. LCMS2 is not thread safe, and cannot be made
    thread safe without breaking the ABI. Our fork will be thread
    safe, and include performance enhancements (these changes have
    all be been offered and rejected upstream). We will maintain
    compatibility between Ghostscript and LCMS2 for a time, but not
    in perpetuity. Our fork will be available as its own package
    separately from Ghostscript (and MuPDF).
  For a release summary see:
  http://www.ghostscript.com/doc/9.27/News.htm
  For details see the News.htm and History9.htm files.
  The Ghostscript 9.27 release should fix (cf. the entry below
  dated 'Fri Sep 14 10:47:33 CEST 2018' what "should fix" means)
  in particular those security issues:
  * CVE-2019-3838 forceput in DefineResource is still accessible
    https://bugzilla.suse.com/show_bug.cgi?id=1129186 bsc#1129186
    https://bugs.ghostscript.com/show_bug.cgi?id=700576
  * CVE-2019-3835: superexec operator is available
    https://bugzilla.suse.com/show_bug.cgi?id=1129180 bsc#1129180
    https://bugs.ghostscript.com/show_bug.cgi?id=700585</changelog>
  <changelog author="werner@suse.de" date="1565611200">- CVE-2019-10216.patch fixes CVE-2019-10216
  forceput/superexec in .buildfont1 is still accessible
  https://bugzilla.suse.com/show_bug.cgi?id=1144621 bsc#1144621
  https://bugs.ghostscript.com/show_bug.cgi?id=701394</changelog>
  <changelog author="werner@suse.de" date="1568376000">- Add patch openjpeg4gs-CVE-2018-6616-8ee33522.patch
  to fix bsc#1140359 for CVE-2019-12973</changelog>
  <changelog author="werner@suse.de" date="1568635200">- Add patch gs-CVE-2019-14811-885444fc.patch to fix bsc#1146882
  for CVE-2019-14811,CVE-2019-14812,CVE-2019-14813
- Add patch gs-CVE-2019-14817-cd1b1cac.patch to fix bsc#1146884
  for CVE-2019-14817</changelog>
  <changelog author="werner@suse.de" date="1568635201">- Port latest ghostscript 9.27 from factory including latest
  security patches to SLES15/SLES12
  * Port patch CVE-2019-10216.patch to 9.27 which is the orignal
    upstream commit now
  * Drop patch CVE-2019-3838.patch as now part of 9.27</changelog>
  <changelog author="jsmeix@suse.de" date="1573473600">- CVE-2019-14869.patch contains commit from Ghostscript upstream
  https://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=485904772c5f
  to fix CVE-2019-14869 "-dSAFER escape in .charkeys"
  (bsc#1156275)</changelog>
  <changelog author="jsmeix@suse.de" date="1588075200">- The version upgrade to 9.52 fixes in particular
  CVE-2020-12268: jbic2dec: heap-based buffer overflow
  in jbig2_image_compose (bsc#1170603)
- Version upgrade to 9.52
  Highlights in this release include:
  * The 9.52 release replaces the 9.51 release after a problem
    was reported with 9.51 which warranted the quick turnaround.
    Thus, like 9.51, 9.52 is primarily a maintenance release,
    consolidating the changes we introduced in 9.50.
  * IMPORTANT: We have forked LittleCMS2 into LittleCMS2mt
    (the "mt" indicating "multi-thread").
    LCMS2 is not thread-safe, and cannot be made thread-safe
    without breaking the ABI. Our fork will be thread-safe and
    include performance enhancements (these changes have all
    been offered and rejected upstream). We will maintain
    compatibility between Ghostscript and LCMS2 for a time,
    but not in perpetuity. If there is sufficient interest,
    our fork will be available as its own package separately
    from Ghostscript (and MuPDF).
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  Incompatible changes:
  * New option -dALLOWPSTRANSPARENCY: The transparency compositor
    (and related features), whilst we are improving it, remains
    sensitive to being driven correctly, and incorrect use
    can have unexpected/undefined results. Hence, as part of
    improving security, we limited access to these operators,
    originally using the -dSAFER feature. As we made "SAFER"
    the default mode, that became unacceptable, hence the
    new option -dALLOWPSTRANSPARENCY which enables access
    to the operators, cf.
    https://www.ghostscript.com/doc/9.52/Use.htm#ALLOWPSTRANSPARENCY
  For a release summary see:
  https://www.ghostscript.com/doc/9.52/News.htm
  For details see the News.htm and History9.htm files.
- Version upgrade to 9.51
  Highlights in this release include:
  * 9.51 is primarily a maintainance release, consolidating
    the changes we introduced in 9.50.
  * We have continued our work on code hygiene for this release,
    with a focus on the static analysis tool Coverity
    (from Synopsys, Inc) and we are now maintaining a policy of
    zero Coverity issues in the Ghostscript/GhostPDL source base.
  * IMPORTANT: In consultation with a representative of
    OpenPrinting (http://www.openprinting.org/) it is our
    intention to deprecate and, in the not distant future,
    remove the OpenPrinting Vector/Raster Printer Drivers
    (that is, the opvp and oprp devices).
    If you rely on either of these devices, please get in touch
    with us (i.e. Ghostscript upstream), so we can discuss your
    use case, and revise our plans accordingly.
  * We (i.e. Ghostscript upstream) are in the process of forking
    LittleCMS, cf. the other release notes entries below.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  For a release summary see:
  https://www.ghostscript.com/doc/9.51/News.htm
  For details see the News.htm and History9.htm files.
- Version upgrade to 9.50
  Highlights in this release include:
  * The change to version 9.50 follows recognition
    of the extent and importance of the file access control
    redesign/reimplementation outlined below.
  * The file access control capability (enable with -dSAFER)
    has been completely rewritten, with a ground-up rethink
    of the design. For more details, see: "SAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#Safer
  * It is important to note that -dSAFER now only enables the
    file access controls, and no longer applies restrictions
    to standard Postscript functionality (specifically,
    restrictions on setpagedevice). If your application relies
    on these Postscript restrictions, see "OLDSAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#OldSafer
    and please get in touch, as we do plan to remove those
    Postscript restrictions unless we have reason not to.
  IMPORTANT: File access controls are now enabled by default.
    In order to run Ghostscript without these controls,
    see "NOSAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#NoSafer
  * We (i.e. Ghostscript upstream) are in the process of forking
    LittleCMS, cf. the other release notes entries below.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  Incompatible changes:
  * There are a couple of subtle incompatibilities between the old
    and new SAFER implementations. Firstly, as mentioned above,
    SAFER now leaves standard Postcript functionality unchanged
    (except for the file access limitations). Secondly, the
    interaction with save/restore operations, see "SAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#Safer
  * The following is not strictly speaking new to 9.50,
    as not much has changed since 9.27 in this area,
    but for those who don't upgrade with every release:
    The process of "tidying" the Postscript name space should have
    removed only non-standard and undocumented operators.
    Nevertheless, it is possible that any integrations or utilities
    that rely on those non-standard and undocumented operators
    may stop working, or may change behaviour.
    If you encounter such a case, please contact us
    (i.e. Ghostscript upstream, either the #ghostscript IRC channel
    or the gs-devel mailing list would be best), and we'll work
    with you to either find an alternative solution or return the
    previous functionality, if there is genuinely no other option.
    One case we know this has occurred is GSView 5 (and earlier).
    GSView 5 support for PDF files relied upon internal use only
    features which are no longer available. GSView 5 will still
    work as previously for Postscript files. For PDF files,
    users are encouraged to look at MuPDF https://www.mupdf.com/
  For a release summary see:
  https://www.ghostscript.com/doc/9.50/News.htm
  For details see the News.htm and History9.htm files.
- CVE-2019-10216.patch CVE-2019-14869.patch
  gs-CVE-2019-14811-885444fc.patch
  gs-CVE-2019-14817-cd1b1cac.patch
  openjpeg4gs-CVE-2018-6616-8ee33522.patch
  are fixed in the version 9.52 upstream sources.</changelog>
  <changelog author="jsmeix@suse.de" date="1595851200">- CVE-2020-15900.patch fixes CVE-2020-15900
  Memory Corruption (SAFER Sandbox Breakout)
  cf. https://bugs.ghostscript.com/show_bug.cgi?id=702582
  (bsc#1174415)</changelog>
  <changelog author="wolfgang.frisch@suse.com" date="1619006400">- Hardening: link as position independent executable (bsc#1184123).</changelog>
  <changelog author="jsmeix@suse.de" date="1631275200">- CVE-2021-3781.patch fixes CVE-2021-3781
  Trivial -dSAFER bypass
  cf. https://bugs.ghostscript.com/show_bug.cgi?id=704342
  (bsc#1190381)</changelog>
  <changelog author="werner@suse.de" date="1632916800">- Use update-alternatives to get the real ghostscript binary from
  /usr/bin/gs to /usr/bin/gs.bin and allow the gswrap package to
  use this with its wrapper script (jira#PM-3037)</changelog>
</package>
<package pkgid="8fb9da7f495a298b89c3f175f7ee4ba756400012d211922d6d009508b0db8787" name="ghostscript-x11" arch="ppc64le">
  <version epoch="0" ver="9.52" rel="158.1"/>
  <changelog author="jsmeix@suse.de" date="1521720000">- Version upgrade to 9.23
  Highlights in this release include:
  * Ghostscript now has a family of 'pdfimage' devices
    (pdfimage8, pdfimage24 and pdfimage32) which produce
    rendered output wrapped up as an image in a PDF.
    Additionally, there is a 'pclm' device which
    produces PCLm format output.
  * There is now a ColorAccuracy parameter allowing the user
    to decide between speed or accuracy in ICC color transforms.
  * JPEG Passthrough: devices which support it can now receive
    the 'raw' JPEG stream from the interpreter.
    The main use of this is the pdfwrite/ps2write family of devices
    that can now take JPEG streams from the input file(s) and write
    them unchanged to the output (thus avoiding additional
    quantization effects).
  * PDF transparency performance improvements
  * IMPORTANT: We (i.e. Ghostscript upstream) are in the process
    of forking LittleCMS.
    LCMS2 is not thread safe, and cannot be made thread safe
    without breaking the ABI. Our fork will be thread safe,
    and include performance enhancements (these changes have all
    be been offered and rejected upstream). We will maintain
    compatibility between Ghostscript and LCMS2 for a time,
    but not in perpetuity. Our fork will be available as its own
    package separately from Ghostscript (and MuPDF).
  * We have continued the focus on code hygiene in this release
    cleaning up security issues, ignored return values,
    and compiler warnings.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  Incompatible changes
  * The planned device API tidy has, unfortunately, been
    indefinitely postponed, until appropriate resources
    are available.
  For a release summary see:
  http://www.ghostscript.com/doc/9.23/News.htm
  For details see the News.htm and History9.htm files.
  See also the entries below since "Version upgrade to 9.22"
  (boo#1082896 and boo#1074266).</changelog>
  <changelog author="jsmeix@suse.de" date="1528200000">- CVE-2018-10194.patch fixes stack-based buffer overflow
  in gdevpdts.c (bsc#1090099), see
  https://bugs.ghostscript.com/show_bug.cgi?id=699255 and
  http://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=39b1e54b2968620723bf32e96764c88797714879</changelog>
  <changelog author="jsmeix@suse.de" date="1536840000">- Version upgrade to 9.24
  Highlights in this release include:
  * Security issues have been the primary focus of this release,
    including solving several (well publicised)
    real and potential exploits.
    PLEASE NOTE:
    We (i.e. Ghostscript upstream) strongly urge users to upgrade
    to this latest release to avoid these issues.
  * As well as Ghostscript itself, jbig2dec has had a significant
    amount of work improving its robustness in the face of
    out specification files.
  * IMPORTANT: We (i.e. Ghostscript upstream) are in the process
    of forking LittleCMS. LCMS2 is not thread safe, and cannot
    be made thread safe without breaking the ABI. Our fork
    will be thread safe, and include performance enhancements
    (these changes have all be been offered and rejected upstream).
    We will maintain compatibility between Ghostscript and LCMS2
    for a time, but not in perpetuity. Our fork will be available
    as its own package separately from Ghostscript (and MuPDF).
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  For a release summary see:
  http://www.ghostscript.com/doc/9.24/News.htm
  For details see the News.htm and History9.htm files.
- fix_ln_docdir_gsdatadir.patch is no longer needed
  because the issue is fixed in the upstream sources.
- CVE-2018-10194.patch is no longer needed
  because the issue is fixed in the upstream sources.</changelog>
  <changelog author="jsmeix@suse.de" date="1536840001">- Version upgrade to 9.25rc1 (first release candidate for 9.25).
  Highlights in this release include:
  * This release fixes problems with argument handling, some
    unintended results of the security fixes to the SAFER file
    access restrictions (specifically accessing ICC profile files),
    and some additional security issues over the 9.24 release.
  * Security issues have been the primary focus of this release,
    including solving several (well publicised) real
    and potential exploits.
    PLEASE NOTE:
    We (i.e. Ghostscript upstream) strongly urge users to upgrade
    to this latest release to avoid these issues.
  * Avoid that ps2epsi fails with
    'Error: /undefined in --setpagedevice--'
    Recent changes required to harden SAFER mode mean that
    it is no longer possible to run ps2epsi in SAFER mode,
    because it relies upon unsafe Ghostscript non-standard
    extension operators.
    Removing SAFER and DELAYSAFER, and the code to reset SAFER,
    allow ps2epsi to run as well as it ever did (ie badly).
    This program (i.e. ps2epsi) should now be considered unsafe,
    you should not use it on untrusted PostScript programs.
    Likely we (i.e. Ghostscript upstream) will deprecate and
    remove this program in future.
  For details see the News.htm and History9.htm files.
  Regarding installing packages (in particular release candidates)
  from the openSUSE build service development project "Printing"
  see https://build.opensuse.org/project/show/Printing</changelog>
  <changelog author="jsmeix@suse.de" date="1536926400">- Version upgrade to 9.25
  For the highlights in this release see the highlights in the
  9.25rc1 first release candidate for 9.25 entry below.
  PLEASE NOTE:
  We (i.e. Ghostscript upstream) strongly urge users to upgrade
  to this latest release to avoid these issues.
  For a release summary see:
  http://www.ghostscript.com/doc/9.25/News.htm
  For details see the News.htm and History9.htm files.
  The Ghostscript 9.25 release should fix (see below)
  in particular those security issues:
  * CVE-2018-15909: shading_param incomplete type checking
    https://bugs.ghostscript.com/show_bug.cgi?id=699660
    https://bugzilla.suse.com/show_bug.cgi?id=1106172 bsc#1106172
  * CVE-2018-15908: .tempfile file permission issues
    https://bugs.ghostscript.com/show_bug.cgi?id=699657
    https://bugzilla.suse.com/show_bug.cgi?id=1106171 bsc#1106171
  * CVE-2018-15910: LockDistillerParams type confusion
    https://bugs.ghostscript.com/show_bug.cgi?id=699656
    https://bugzilla.suse.com/show_bug.cgi?id=1106173 bsc#1106173
  * CVE-2018-15911: uninitialized memory access in the aesdecode
    https://bugs.ghostscript.com/show_bug.cgi?id=699665
    https://bugzilla.suse.com/show_bug.cgi?id=1106195 bsc#1106195
  * CVE-2018-16513: setcolor missing type check
    https://bugs.ghostscript.com/show_bug.cgi?id=699655
    https://bugzilla.suse.com/show_bug.cgi?id=1107412 bsc#1107412
  * CVE-2018-16509: /invalidaccess bypass after failed restore
    https://bugs.ghostscript.com/show_bug.cgi?id=699654
    https://bugzilla.suse.com/show_bug.cgi?id=1107410 bsc#1107410
  * CVE-2018-16510: Incorrect exec stack handling in the "CS"
    and "SC" PDF primitives
    https://bugs.ghostscript.com/show_bug.cgi?id=699671
    https://bugzilla.suse.com/show_bug.cgi?id=1107411 bsc#1107411
  * CVE-2018-16542: .definemodifiedfont memory corruption
    if /typecheck is handled
    https://bugs.ghostscript.com/show_bug.cgi?id=699668
    https://bugzilla.suse.com/show_bug.cgi?id=1107413 bsc#1107413
  * CVE-2018-16541 incorrect free logic in pagedevice replacement
    https://bugs.ghostscript.com/show_bug.cgi?id=699664
    https://bugzilla.suse.com/show_bug.cgi?id=1107421 bsc#1107421
  * CVE-2018-16540 use-after-free in copydevice handling
    https://bugs.ghostscript.com/show_bug.cgi?id=699661
    https://bugzilla.suse.com/show_bug.cgi?id=1107420 bsc#1107420
  * CVE-2018-16539: incorrect access checking in temp file
    handling to disclose contents of files
    https://bugs.ghostscript.com/show_bug.cgi?id=699658
    https://bugzilla.suse.com/show_bug.cgi?id=1107422 bsc#1107422
  * CVE-2018-16543: gssetresolution and gsgetresolution allow
    for unspecified impact
    https://bugs.ghostscript.com/show_bug.cgi?id=699670
    https://bugzilla.suse.com/show_bug.cgi?id=1107423 bsc#1107423
  * CVE-2018-16511: type confusion in "ztype" could be used by
    remote attackers able to supply crafted PostScript to crash
    the interpreter or possibly have unspecified other impact
    https://bugs.ghostscript.com/show_bug.cgi?id=699659
    https://bugzilla.suse.com/show_bug.cgi?id=1107426 bsc#1107426
  * CVE-2018-16585 .setdistillerkeys PostScript command is
    accepted even though it is not intended for use
    https://bugzilla.suse.com/show_bug.cgi?id=1107581 bsc#1107581
  * CVE-2018-16802: Incorrect"restoration of privilege" checking
    when running out of stack during exceptionhandling could be
    used by attackers able to supply crafted PostScript to execute
    code using the "pipe" instruction. This is due to an incomplete
    fix for CVE-2018-16509
    https://bugs.ghostscript.com/show_bug.cgi?id=699714
    https://bugs.ghostscript.com/show_bug.cgi?id=699718
    https://bugzilla.suse.com/show_bug.cgi?id=1108027 bnc#1108027
  Regarding what the above "should fix" means:
  PostScript is a general purpose Turing-complete programming
  language (cf. https://en.wikipedia.org/wiki/PostScript)
  that supports in particular file access on the system disk.
  When Ghostscript processes PostScript it runs a PostScript
  program as the user who runs Ghostscript.
  When Ghostscript processes an arbitrary PostScript file,
  the user who runs Ghostscript runs an arbitrary program
  which can do anything on the system where Ghostscript runs
  that this user is allowed to do on that system.
  To make it safer when Ghostscript runs a PostScript program
  the Ghostscript command line option '-dSAFER' disables
  certain file access functionality, for details see
  /usr/share/doc/ghostscript/9.25/Use.htm
  Its name 'SAFER' says everything: It makes it 'safer'
  to let Ghostscript run a PostScript program,
  but it does not make it completely safe.
  In theory software is safe against misuse (i.e. has no bugs).
  In practice there is an endless sequence of various kind of
  security issues (i.e. software can be misused to do more than
  what is intended) that get fixed issue by issue ad infinitum.
  In the end all that means:
  In practice the user who runs Ghostscript must not let it
  process arbitrary PostScript files from untrusted origin.
  In particular Ghostscript is usually run when printing
  documents (with the '-dSAFER' option set), see the part about
  "It is crucial to limit access to CUPS to trusted users" in
  https://en.opensuse.org/SDB:CUPS_and_SANE_Firewall_settings</changelog>
  <changelog author="jsmeix@suse.de" date="1541764800">- Version upgrade to 9.26rc1 (first release candidate for 9.26).
  Highlights in this release include:
  * Purely security and a few bug fixes, there are no new features,
    and no API changes to report.</changelog>
  <changelog author="jsmeix@suse.de" date="1543579200">- Version upgrade to 9.26
  Highlights in this release include:
  * Security issues have been the primary focus of this release,
    including solving several (well publicised) real and potential
    exploits.
    Thanks to Man Yue Mo of Semmle Security Research Team,
    Jens Mueller of Ruhr-Universitaet Bochum and
    Tavis Ormandy of Google's Project Zero
    for their help to identify specific security issues.
    PLEASE NOTE:
    We (i.e. Ghostscript upstream) strongly urge users to upgrade
    to this latest release to avoid these issues.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  For a release summary see:
  http://www.ghostscript.com/doc/9.26/News.htm
  For details see the News.htm and History9.htm files.
  The Ghostscript 9.26 release should fix (cf. the entry below
  dated 'Fri Sep 14 10:47:33 CEST 2018' what "should fix" means)
  in particular those security issues (bsc#1117331)
  * CVE-2018-19475: psi/zdevice2.c allows attackers to bypass
    intended access restrictions
    https://bugs.ghostscript.com/show_bug.cgi?id=700153
    https://bugzilla.suse.com/show_bug.cgi?id=1117327 bsc#1117327
  * CVE-2018-19476: psi/zicc.c allows attackers to bypass
    intended access restrictions because of a setcolorspace
    type confusion
    https://bugs.ghostscript.com/show_bug.cgi?id=700169
    https://bugzilla.suse.com/show_bug.cgi?id=1117313 bsc#1117313
  * CVE-2018-19477: psi/zfjbig2.c allows attackers to bypass
    intended access restrictions because of a JBIG2Decode
    type confusion
    https://bugs.ghostscript.com/show_bug.cgi?id=700168
    https://bugzilla.suse.com/show_bug.cgi?id=1117274 bsc#1117274
  * CVE-2018-19409: LockSafetyParams is not checked correctly
    if another device is used
    https://bugs.ghostscript.com/show_bug.cgi?id=700176
    https://bugzilla.suse.com/show_bug.cgi?id=1117022 bsc#1117022
  and those security issues
  * CVE-2018-18284: 1Policy operator gives access to .forceput
    https://bugs.ghostscript.com/show_bug.cgi?id=69963
    https://bugzilla.suse.com/show_bug.cgi?id=1112229 bsc#1112229
  * CVE-2018-18073: saved execution stacks can leak operator arrays
    https://bugs.ghostscript.com/show_bug.cgi?id=699927
    https://bugzilla.suse.com/show_bug.cgi?id=1111480 bsc#1111480
  * CVE-2018-17961: bypassing executeonly to escape -dSAFER sandbox
    https://bugs.ghostscript.com/show_bug.cgi?id=699816
    https://bugzilla.suse.com/show_bug.cgi?id=1111479 bsc#1111479
  * CVE-2018-17183: remote attackers could be able to supply
    crafted PostScript to potentially overwrite or replace
    error handlers to inject code
    https://bugs.ghostscript.com/show_bug.cgi?id=699708
    https://bugzilla.suse.com/show_bug.cgi?id=1109105 bsc#1109105</changelog>
  <changelog author="jsmeix@suse.de" date="1547726400">- Version upgrade to 9.26a
  The version 9.26a is a special security bugfix version to fix
  * CVE-2019-6116: subroutines within pseudo-operators
    must themselves be pseudo-operators
    https://bugs.ghostscript.com/show_bug.cgi?id=700317
    https://bugzilla.suse.com/show_bug.cgi?id=1122319 bsc#1122319</changelog>
  <changelog author="jsmeix@suse.de" date="1552996800">- CVE-2019-3838.patch fixes CVE-2019-3838
  forceput in DefineResource is still accessible
  https://bugzilla.suse.com/show_bug.cgi?id=1129186 bsc#1129186
  https://bugs.ghostscript.com/show_bug.cgi?id=700576</changelog>
  <changelog author="jsmeix@suse.de" date="1554379200">- Version upgrade to 9.27
  Highlights in this release include:
  * We (i.e. Ghostscript upstream) have extensively cleaned up
    the Postscript name space: removing access to internal and/or
    undocumented Postscript operators, procedures and data.
    This has benefits for security and maintainability.
    Incompatible changes:
    The process of "tidying" the Postscript name space should
    have removed only non-standard and undocumented operators.
    Nevertheless, it is possible that any integrations or
    utilities that rely on those non-standard and undocumented
    operators may stop working, or may change behaviour.
    If you encounter such a case, please contact us (i.e.
    Ghostscript upstream) - (either the #ghostscript IRC channel,
    or the gs-devel mailing list would be best), and we'll work
    with you to either find an alternative solution.
  * Fontmap can now reference invidual fonts in a TrueType
    Collection for font subsitution. Previously, a Fontmap entry
    could only reference a TrueType collection and use the default
    (first) font.
    Now, the Fontmap syntax allows for specifying a specific index
    in a TTC. See the comments at the top of (the default)
    Fontmap.GS for details.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  IMPORTANT: It is our intention, within the next 12 months
    (ideally sooner, in time for the next release) to make SAFER
    the default mode of operation. For many users this will have
    no effect, since they use SAFER explicitly, but some niche
    uses which rely on SAFER being disabled may need to start
    explicitly adding the "-dNOSAFER" option.
  IMPORTANT: We (i.e. Ghostscript upstream) are in the process of
    forking LittleCMS. LCMS2 is not thread safe, and cannot be made
    thread safe without breaking the ABI. Our fork will be thread
    safe, and include performance enhancements (these changes have
    all be been offered and rejected upstream). We will maintain
    compatibility between Ghostscript and LCMS2 for a time, but not
    in perpetuity. Our fork will be available as its own package
    separately from Ghostscript (and MuPDF).
  For a release summary see:
  http://www.ghostscript.com/doc/9.27/News.htm
  For details see the News.htm and History9.htm files.
  The Ghostscript 9.27 release should fix (cf. the entry below
  dated 'Fri Sep 14 10:47:33 CEST 2018' what "should fix" means)
  in particular those security issues:
  * CVE-2019-3838 forceput in DefineResource is still accessible
    https://bugzilla.suse.com/show_bug.cgi?id=1129186 bsc#1129186
    https://bugs.ghostscript.com/show_bug.cgi?id=700576
  * CVE-2019-3835: superexec operator is available
    https://bugzilla.suse.com/show_bug.cgi?id=1129180 bsc#1129180
    https://bugs.ghostscript.com/show_bug.cgi?id=700585</changelog>
  <changelog author="werner@suse.de" date="1565611200">- CVE-2019-10216.patch fixes CVE-2019-10216
  forceput/superexec in .buildfont1 is still accessible
  https://bugzilla.suse.com/show_bug.cgi?id=1144621 bsc#1144621
  https://bugs.ghostscript.com/show_bug.cgi?id=701394</changelog>
  <changelog author="werner@suse.de" date="1568376000">- Add patch openjpeg4gs-CVE-2018-6616-8ee33522.patch
  to fix bsc#1140359 for CVE-2019-12973</changelog>
  <changelog author="werner@suse.de" date="1568635200">- Add patch gs-CVE-2019-14811-885444fc.patch to fix bsc#1146882
  for CVE-2019-14811,CVE-2019-14812,CVE-2019-14813
- Add patch gs-CVE-2019-14817-cd1b1cac.patch to fix bsc#1146884
  for CVE-2019-14817</changelog>
  <changelog author="werner@suse.de" date="1568635201">- Port latest ghostscript 9.27 from factory including latest
  security patches to SLES15/SLES12
  * Port patch CVE-2019-10216.patch to 9.27 which is the orignal
    upstream commit now
  * Drop patch CVE-2019-3838.patch as now part of 9.27</changelog>
  <changelog author="jsmeix@suse.de" date="1573473600">- CVE-2019-14869.patch contains commit from Ghostscript upstream
  https://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=485904772c5f
  to fix CVE-2019-14869 "-dSAFER escape in .charkeys"
  (bsc#1156275)</changelog>
  <changelog author="jsmeix@suse.de" date="1588075200">- The version upgrade to 9.52 fixes in particular
  CVE-2020-12268: jbic2dec: heap-based buffer overflow
  in jbig2_image_compose (bsc#1170603)
- Version upgrade to 9.52
  Highlights in this release include:
  * The 9.52 release replaces the 9.51 release after a problem
    was reported with 9.51 which warranted the quick turnaround.
    Thus, like 9.51, 9.52 is primarily a maintenance release,
    consolidating the changes we introduced in 9.50.
  * IMPORTANT: We have forked LittleCMS2 into LittleCMS2mt
    (the "mt" indicating "multi-thread").
    LCMS2 is not thread-safe, and cannot be made thread-safe
    without breaking the ABI. Our fork will be thread-safe and
    include performance enhancements (these changes have all
    been offered and rejected upstream). We will maintain
    compatibility between Ghostscript and LCMS2 for a time,
    but not in perpetuity. If there is sufficient interest,
    our fork will be available as its own package separately
    from Ghostscript (and MuPDF).
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  Incompatible changes:
  * New option -dALLOWPSTRANSPARENCY: The transparency compositor
    (and related features), whilst we are improving it, remains
    sensitive to being driven correctly, and incorrect use
    can have unexpected/undefined results. Hence, as part of
    improving security, we limited access to these operators,
    originally using the -dSAFER feature. As we made "SAFER"
    the default mode, that became unacceptable, hence the
    new option -dALLOWPSTRANSPARENCY which enables access
    to the operators, cf.
    https://www.ghostscript.com/doc/9.52/Use.htm#ALLOWPSTRANSPARENCY
  For a release summary see:
  https://www.ghostscript.com/doc/9.52/News.htm
  For details see the News.htm and History9.htm files.
- Version upgrade to 9.51
  Highlights in this release include:
  * 9.51 is primarily a maintainance release, consolidating
    the changes we introduced in 9.50.
  * We have continued our work on code hygiene for this release,
    with a focus on the static analysis tool Coverity
    (from Synopsys, Inc) and we are now maintaining a policy of
    zero Coverity issues in the Ghostscript/GhostPDL source base.
  * IMPORTANT: In consultation with a representative of
    OpenPrinting (http://www.openprinting.org/) it is our
    intention to deprecate and, in the not distant future,
    remove the OpenPrinting Vector/Raster Printer Drivers
    (that is, the opvp and oprp devices).
    If you rely on either of these devices, please get in touch
    with us (i.e. Ghostscript upstream), so we can discuss your
    use case, and revise our plans accordingly.
  * We (i.e. Ghostscript upstream) are in the process of forking
    LittleCMS, cf. the other release notes entries below.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  For a release summary see:
  https://www.ghostscript.com/doc/9.51/News.htm
  For details see the News.htm and History9.htm files.
- Version upgrade to 9.50
  Highlights in this release include:
  * The change to version 9.50 follows recognition
    of the extent and importance of the file access control
    redesign/reimplementation outlined below.
  * The file access control capability (enable with -dSAFER)
    has been completely rewritten, with a ground-up rethink
    of the design. For more details, see: "SAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#Safer
  * It is important to note that -dSAFER now only enables the
    file access controls, and no longer applies restrictions
    to standard Postscript functionality (specifically,
    restrictions on setpagedevice). If your application relies
    on these Postscript restrictions, see "OLDSAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#OldSafer
    and please get in touch, as we do plan to remove those
    Postscript restrictions unless we have reason not to.
  IMPORTANT: File access controls are now enabled by default.
    In order to run Ghostscript without these controls,
    see "NOSAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#NoSafer
  * We (i.e. Ghostscript upstream) are in the process of forking
    LittleCMS, cf. the other release notes entries below.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  Incompatible changes:
  * There are a couple of subtle incompatibilities between the old
    and new SAFER implementations. Firstly, as mentioned above,
    SAFER now leaves standard Postcript functionality unchanged
    (except for the file access limitations). Secondly, the
    interaction with save/restore operations, see "SAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#Safer
  * The following is not strictly speaking new to 9.50,
    as not much has changed since 9.27 in this area,
    but for those who don't upgrade with every release:
    The process of "tidying" the Postscript name space should have
    removed only non-standard and undocumented operators.
    Nevertheless, it is possible that any integrations or utilities
    that rely on those non-standard and undocumented operators
    may stop working, or may change behaviour.
    If you encounter such a case, please contact us
    (i.e. Ghostscript upstream, either the #ghostscript IRC channel
    or the gs-devel mailing list would be best), and we'll work
    with you to either find an alternative solution or return the
    previous functionality, if there is genuinely no other option.
    One case we know this has occurred is GSView 5 (and earlier).
    GSView 5 support for PDF files relied upon internal use only
    features which are no longer available. GSView 5 will still
    work as previously for Postscript files. For PDF files,
    users are encouraged to look at MuPDF https://www.mupdf.com/
  For a release summary see:
  https://www.ghostscript.com/doc/9.50/News.htm
  For details see the News.htm and History9.htm files.
- CVE-2019-10216.patch CVE-2019-14869.patch
  gs-CVE-2019-14811-885444fc.patch
  gs-CVE-2019-14817-cd1b1cac.patch
  openjpeg4gs-CVE-2018-6616-8ee33522.patch
  are fixed in the version 9.52 upstream sources.</changelog>
  <changelog author="jsmeix@suse.de" date="1595851200">- CVE-2020-15900.patch fixes CVE-2020-15900
  Memory Corruption (SAFER Sandbox Breakout)
  cf. https://bugs.ghostscript.com/show_bug.cgi?id=702582
  (bsc#1174415)</changelog>
  <changelog author="wolfgang.frisch@suse.com" date="1619006400">- Hardening: link as position independent executable (bsc#1184123).</changelog>
  <changelog author="jsmeix@suse.de" date="1631275200">- CVE-2021-3781.patch fixes CVE-2021-3781
  Trivial -dSAFER bypass
  cf. https://bugs.ghostscript.com/show_bug.cgi?id=704342
  (bsc#1190381)</changelog>
  <changelog author="werner@suse.de" date="1632916800">- Use update-alternatives to get the real ghostscript binary from
  /usr/bin/gs to /usr/bin/gs.bin and allow the gswrap package to
  use this with its wrapper script (jira#PM-3037)</changelog>
</package>
<package pkgid="c1992dbd1029ab46d94ca22a943d9c890ed5b4b91198c54510c9d991fece467c" name="ghostscript-x11" arch="s390x">
  <version epoch="0" ver="9.52" rel="158.1"/>
  <changelog author="jsmeix@suse.de" date="1521720000">- Version upgrade to 9.23
  Highlights in this release include:
  * Ghostscript now has a family of 'pdfimage' devices
    (pdfimage8, pdfimage24 and pdfimage32) which produce
    rendered output wrapped up as an image in a PDF.
    Additionally, there is a 'pclm' device which
    produces PCLm format output.
  * There is now a ColorAccuracy parameter allowing the user
    to decide between speed or accuracy in ICC color transforms.
  * JPEG Passthrough: devices which support it can now receive
    the 'raw' JPEG stream from the interpreter.
    The main use of this is the pdfwrite/ps2write family of devices
    that can now take JPEG streams from the input file(s) and write
    them unchanged to the output (thus avoiding additional
    quantization effects).
  * PDF transparency performance improvements
  * IMPORTANT: We (i.e. Ghostscript upstream) are in the process
    of forking LittleCMS.
    LCMS2 is not thread safe, and cannot be made thread safe
    without breaking the ABI. Our fork will be thread safe,
    and include performance enhancements (these changes have all
    be been offered and rejected upstream). We will maintain
    compatibility between Ghostscript and LCMS2 for a time,
    but not in perpetuity. Our fork will be available as its own
    package separately from Ghostscript (and MuPDF).
  * We have continued the focus on code hygiene in this release
    cleaning up security issues, ignored return values,
    and compiler warnings.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  Incompatible changes
  * The planned device API tidy has, unfortunately, been
    indefinitely postponed, until appropriate resources
    are available.
  For a release summary see:
  http://www.ghostscript.com/doc/9.23/News.htm
  For details see the News.htm and History9.htm files.
  See also the entries below since "Version upgrade to 9.22"
  (boo#1082896 and boo#1074266).</changelog>
  <changelog author="jsmeix@suse.de" date="1528200000">- CVE-2018-10194.patch fixes stack-based buffer overflow
  in gdevpdts.c (bsc#1090099), see
  https://bugs.ghostscript.com/show_bug.cgi?id=699255 and
  http://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=39b1e54b2968620723bf32e96764c88797714879</changelog>
  <changelog author="jsmeix@suse.de" date="1536840000">- Version upgrade to 9.24
  Highlights in this release include:
  * Security issues have been the primary focus of this release,
    including solving several (well publicised)
    real and potential exploits.
    PLEASE NOTE:
    We (i.e. Ghostscript upstream) strongly urge users to upgrade
    to this latest release to avoid these issues.
  * As well as Ghostscript itself, jbig2dec has had a significant
    amount of work improving its robustness in the face of
    out specification files.
  * IMPORTANT: We (i.e. Ghostscript upstream) are in the process
    of forking LittleCMS. LCMS2 is not thread safe, and cannot
    be made thread safe without breaking the ABI. Our fork
    will be thread safe, and include performance enhancements
    (these changes have all be been offered and rejected upstream).
    We will maintain compatibility between Ghostscript and LCMS2
    for a time, but not in perpetuity. Our fork will be available
    as its own package separately from Ghostscript (and MuPDF).
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  For a release summary see:
  http://www.ghostscript.com/doc/9.24/News.htm
  For details see the News.htm and History9.htm files.
- fix_ln_docdir_gsdatadir.patch is no longer needed
  because the issue is fixed in the upstream sources.
- CVE-2018-10194.patch is no longer needed
  because the issue is fixed in the upstream sources.</changelog>
  <changelog author="jsmeix@suse.de" date="1536840001">- Version upgrade to 9.25rc1 (first release candidate for 9.25).
  Highlights in this release include:
  * This release fixes problems with argument handling, some
    unintended results of the security fixes to the SAFER file
    access restrictions (specifically accessing ICC profile files),
    and some additional security issues over the 9.24 release.
  * Security issues have been the primary focus of this release,
    including solving several (well publicised) real
    and potential exploits.
    PLEASE NOTE:
    We (i.e. Ghostscript upstream) strongly urge users to upgrade
    to this latest release to avoid these issues.
  * Avoid that ps2epsi fails with
    'Error: /undefined in --setpagedevice--'
    Recent changes required to harden SAFER mode mean that
    it is no longer possible to run ps2epsi in SAFER mode,
    because it relies upon unsafe Ghostscript non-standard
    extension operators.
    Removing SAFER and DELAYSAFER, and the code to reset SAFER,
    allow ps2epsi to run as well as it ever did (ie badly).
    This program (i.e. ps2epsi) should now be considered unsafe,
    you should not use it on untrusted PostScript programs.
    Likely we (i.e. Ghostscript upstream) will deprecate and
    remove this program in future.
  For details see the News.htm and History9.htm files.
  Regarding installing packages (in particular release candidates)
  from the openSUSE build service development project "Printing"
  see https://build.opensuse.org/project/show/Printing</changelog>
  <changelog author="jsmeix@suse.de" date="1536926400">- Version upgrade to 9.25
  For the highlights in this release see the highlights in the
  9.25rc1 first release candidate for 9.25 entry below.
  PLEASE NOTE:
  We (i.e. Ghostscript upstream) strongly urge users to upgrade
  to this latest release to avoid these issues.
  For a release summary see:
  http://www.ghostscript.com/doc/9.25/News.htm
  For details see the News.htm and History9.htm files.
  The Ghostscript 9.25 release should fix (see below)
  in particular those security issues:
  * CVE-2018-15909: shading_param incomplete type checking
    https://bugs.ghostscript.com/show_bug.cgi?id=699660
    https://bugzilla.suse.com/show_bug.cgi?id=1106172 bsc#1106172
  * CVE-2018-15908: .tempfile file permission issues
    https://bugs.ghostscript.com/show_bug.cgi?id=699657
    https://bugzilla.suse.com/show_bug.cgi?id=1106171 bsc#1106171
  * CVE-2018-15910: LockDistillerParams type confusion
    https://bugs.ghostscript.com/show_bug.cgi?id=699656
    https://bugzilla.suse.com/show_bug.cgi?id=1106173 bsc#1106173
  * CVE-2018-15911: uninitialized memory access in the aesdecode
    https://bugs.ghostscript.com/show_bug.cgi?id=699665
    https://bugzilla.suse.com/show_bug.cgi?id=1106195 bsc#1106195
  * CVE-2018-16513: setcolor missing type check
    https://bugs.ghostscript.com/show_bug.cgi?id=699655
    https://bugzilla.suse.com/show_bug.cgi?id=1107412 bsc#1107412
  * CVE-2018-16509: /invalidaccess bypass after failed restore
    https://bugs.ghostscript.com/show_bug.cgi?id=699654
    https://bugzilla.suse.com/show_bug.cgi?id=1107410 bsc#1107410
  * CVE-2018-16510: Incorrect exec stack handling in the "CS"
    and "SC" PDF primitives
    https://bugs.ghostscript.com/show_bug.cgi?id=699671
    https://bugzilla.suse.com/show_bug.cgi?id=1107411 bsc#1107411
  * CVE-2018-16542: .definemodifiedfont memory corruption
    if /typecheck is handled
    https://bugs.ghostscript.com/show_bug.cgi?id=699668
    https://bugzilla.suse.com/show_bug.cgi?id=1107413 bsc#1107413
  * CVE-2018-16541 incorrect free logic in pagedevice replacement
    https://bugs.ghostscript.com/show_bug.cgi?id=699664
    https://bugzilla.suse.com/show_bug.cgi?id=1107421 bsc#1107421
  * CVE-2018-16540 use-after-free in copydevice handling
    https://bugs.ghostscript.com/show_bug.cgi?id=699661
    https://bugzilla.suse.com/show_bug.cgi?id=1107420 bsc#1107420
  * CVE-2018-16539: incorrect access checking in temp file
    handling to disclose contents of files
    https://bugs.ghostscript.com/show_bug.cgi?id=699658
    https://bugzilla.suse.com/show_bug.cgi?id=1107422 bsc#1107422
  * CVE-2018-16543: gssetresolution and gsgetresolution allow
    for unspecified impact
    https://bugs.ghostscript.com/show_bug.cgi?id=699670
    https://bugzilla.suse.com/show_bug.cgi?id=1107423 bsc#1107423
  * CVE-2018-16511: type confusion in "ztype" could be used by
    remote attackers able to supply crafted PostScript to crash
    the interpreter or possibly have unspecified other impact
    https://bugs.ghostscript.com/show_bug.cgi?id=699659
    https://bugzilla.suse.com/show_bug.cgi?id=1107426 bsc#1107426
  * CVE-2018-16585 .setdistillerkeys PostScript command is
    accepted even though it is not intended for use
    https://bugzilla.suse.com/show_bug.cgi?id=1107581 bsc#1107581
  * CVE-2018-16802: Incorrect"restoration of privilege" checking
    when running out of stack during exceptionhandling could be
    used by attackers able to supply crafted PostScript to execute
    code using the "pipe" instruction. This is due to an incomplete
    fix for CVE-2018-16509
    https://bugs.ghostscript.com/show_bug.cgi?id=699714
    https://bugs.ghostscript.com/show_bug.cgi?id=699718
    https://bugzilla.suse.com/show_bug.cgi?id=1108027 bnc#1108027
  Regarding what the above "should fix" means:
  PostScript is a general purpose Turing-complete programming
  language (cf. https://en.wikipedia.org/wiki/PostScript)
  that supports in particular file access on the system disk.
  When Ghostscript processes PostScript it runs a PostScript
  program as the user who runs Ghostscript.
  When Ghostscript processes an arbitrary PostScript file,
  the user who runs Ghostscript runs an arbitrary program
  which can do anything on the system where Ghostscript runs
  that this user is allowed to do on that system.
  To make it safer when Ghostscript runs a PostScript program
  the Ghostscript command line option '-dSAFER' disables
  certain file access functionality, for details see
  /usr/share/doc/ghostscript/9.25/Use.htm
  Its name 'SAFER' says everything: It makes it 'safer'
  to let Ghostscript run a PostScript program,
  but it does not make it completely safe.
  In theory software is safe against misuse (i.e. has no bugs).
  In practice there is an endless sequence of various kind of
  security issues (i.e. software can be misused to do more than
  what is intended) that get fixed issue by issue ad infinitum.
  In the end all that means:
  In practice the user who runs Ghostscript must not let it
  process arbitrary PostScript files from untrusted origin.
  In particular Ghostscript is usually run when printing
  documents (with the '-dSAFER' option set), see the part about
  "It is crucial to limit access to CUPS to trusted users" in
  https://en.opensuse.org/SDB:CUPS_and_SANE_Firewall_settings</changelog>
  <changelog author="jsmeix@suse.de" date="1541764800">- Version upgrade to 9.26rc1 (first release candidate for 9.26).
  Highlights in this release include:
  * Purely security and a few bug fixes, there are no new features,
    and no API changes to report.</changelog>
  <changelog author="jsmeix@suse.de" date="1543579200">- Version upgrade to 9.26
  Highlights in this release include:
  * Security issues have been the primary focus of this release,
    including solving several (well publicised) real and potential
    exploits.
    Thanks to Man Yue Mo of Semmle Security Research Team,
    Jens Mueller of Ruhr-Universitaet Bochum and
    Tavis Ormandy of Google's Project Zero
    for their help to identify specific security issues.
    PLEASE NOTE:
    We (i.e. Ghostscript upstream) strongly urge users to upgrade
    to this latest release to avoid these issues.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  For a release summary see:
  http://www.ghostscript.com/doc/9.26/News.htm
  For details see the News.htm and History9.htm files.
  The Ghostscript 9.26 release should fix (cf. the entry below
  dated 'Fri Sep 14 10:47:33 CEST 2018' what "should fix" means)
  in particular those security issues (bsc#1117331)
  * CVE-2018-19475: psi/zdevice2.c allows attackers to bypass
    intended access restrictions
    https://bugs.ghostscript.com/show_bug.cgi?id=700153
    https://bugzilla.suse.com/show_bug.cgi?id=1117327 bsc#1117327
  * CVE-2018-19476: psi/zicc.c allows attackers to bypass
    intended access restrictions because of a setcolorspace
    type confusion
    https://bugs.ghostscript.com/show_bug.cgi?id=700169
    https://bugzilla.suse.com/show_bug.cgi?id=1117313 bsc#1117313
  * CVE-2018-19477: psi/zfjbig2.c allows attackers to bypass
    intended access restrictions because of a JBIG2Decode
    type confusion
    https://bugs.ghostscript.com/show_bug.cgi?id=700168
    https://bugzilla.suse.com/show_bug.cgi?id=1117274 bsc#1117274
  * CVE-2018-19409: LockSafetyParams is not checked correctly
    if another device is used
    https://bugs.ghostscript.com/show_bug.cgi?id=700176
    https://bugzilla.suse.com/show_bug.cgi?id=1117022 bsc#1117022
  and those security issues
  * CVE-2018-18284: 1Policy operator gives access to .forceput
    https://bugs.ghostscript.com/show_bug.cgi?id=69963
    https://bugzilla.suse.com/show_bug.cgi?id=1112229 bsc#1112229
  * CVE-2018-18073: saved execution stacks can leak operator arrays
    https://bugs.ghostscript.com/show_bug.cgi?id=699927
    https://bugzilla.suse.com/show_bug.cgi?id=1111480 bsc#1111480
  * CVE-2018-17961: bypassing executeonly to escape -dSAFER sandbox
    https://bugs.ghostscript.com/show_bug.cgi?id=699816
    https://bugzilla.suse.com/show_bug.cgi?id=1111479 bsc#1111479
  * CVE-2018-17183: remote attackers could be able to supply
    crafted PostScript to potentially overwrite or replace
    error handlers to inject code
    https://bugs.ghostscript.com/show_bug.cgi?id=699708
    https://bugzilla.suse.com/show_bug.cgi?id=1109105 bsc#1109105</changelog>
  <changelog author="jsmeix@suse.de" date="1547726400">- Version upgrade to 9.26a
  The version 9.26a is a special security bugfix version to fix
  * CVE-2019-6116: subroutines within pseudo-operators
    must themselves be pseudo-operators
    https://bugs.ghostscript.com/show_bug.cgi?id=700317
    https://bugzilla.suse.com/show_bug.cgi?id=1122319 bsc#1122319</changelog>
  <changelog author="jsmeix@suse.de" date="1552996800">- CVE-2019-3838.patch fixes CVE-2019-3838
  forceput in DefineResource is still accessible
  https://bugzilla.suse.com/show_bug.cgi?id=1129186 bsc#1129186
  https://bugs.ghostscript.com/show_bug.cgi?id=700576</changelog>
  <changelog author="jsmeix@suse.de" date="1554379200">- Version upgrade to 9.27
  Highlights in this release include:
  * We (i.e. Ghostscript upstream) have extensively cleaned up
    the Postscript name space: removing access to internal and/or
    undocumented Postscript operators, procedures and data.
    This has benefits for security and maintainability.
    Incompatible changes:
    The process of "tidying" the Postscript name space should
    have removed only non-standard and undocumented operators.
    Nevertheless, it is possible that any integrations or
    utilities that rely on those non-standard and undocumented
    operators may stop working, or may change behaviour.
    If you encounter such a case, please contact us (i.e.
    Ghostscript upstream) - (either the #ghostscript IRC channel,
    or the gs-devel mailing list would be best), and we'll work
    with you to either find an alternative solution.
  * Fontmap can now reference invidual fonts in a TrueType
    Collection for font subsitution. Previously, a Fontmap entry
    could only reference a TrueType collection and use the default
    (first) font.
    Now, the Fontmap syntax allows for specifying a specific index
    in a TTC. See the comments at the top of (the default)
    Fontmap.GS for details.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  IMPORTANT: It is our intention, within the next 12 months
    (ideally sooner, in time for the next release) to make SAFER
    the default mode of operation. For many users this will have
    no effect, since they use SAFER explicitly, but some niche
    uses which rely on SAFER being disabled may need to start
    explicitly adding the "-dNOSAFER" option.
  IMPORTANT: We (i.e. Ghostscript upstream) are in the process of
    forking LittleCMS. LCMS2 is not thread safe, and cannot be made
    thread safe without breaking the ABI. Our fork will be thread
    safe, and include performance enhancements (these changes have
    all be been offered and rejected upstream). We will maintain
    compatibility between Ghostscript and LCMS2 for a time, but not
    in perpetuity. Our fork will be available as its own package
    separately from Ghostscript (and MuPDF).
  For a release summary see:
  http://www.ghostscript.com/doc/9.27/News.htm
  For details see the News.htm and History9.htm files.
  The Ghostscript 9.27 release should fix (cf. the entry below
  dated 'Fri Sep 14 10:47:33 CEST 2018' what "should fix" means)
  in particular those security issues:
  * CVE-2019-3838 forceput in DefineResource is still accessible
    https://bugzilla.suse.com/show_bug.cgi?id=1129186 bsc#1129186
    https://bugs.ghostscript.com/show_bug.cgi?id=700576
  * CVE-2019-3835: superexec operator is available
    https://bugzilla.suse.com/show_bug.cgi?id=1129180 bsc#1129180
    https://bugs.ghostscript.com/show_bug.cgi?id=700585</changelog>
  <changelog author="werner@suse.de" date="1565611200">- CVE-2019-10216.patch fixes CVE-2019-10216
  forceput/superexec in .buildfont1 is still accessible
  https://bugzilla.suse.com/show_bug.cgi?id=1144621 bsc#1144621
  https://bugs.ghostscript.com/show_bug.cgi?id=701394</changelog>
  <changelog author="werner@suse.de" date="1568376000">- Add patch openjpeg4gs-CVE-2018-6616-8ee33522.patch
  to fix bsc#1140359 for CVE-2019-12973</changelog>
  <changelog author="werner@suse.de" date="1568635200">- Add patch gs-CVE-2019-14811-885444fc.patch to fix bsc#1146882
  for CVE-2019-14811,CVE-2019-14812,CVE-2019-14813
- Add patch gs-CVE-2019-14817-cd1b1cac.patch to fix bsc#1146884
  for CVE-2019-14817</changelog>
  <changelog author="werner@suse.de" date="1568635201">- Port latest ghostscript 9.27 from factory including latest
  security patches to SLES15/SLES12
  * Port patch CVE-2019-10216.patch to 9.27 which is the orignal
    upstream commit now
  * Drop patch CVE-2019-3838.patch as now part of 9.27</changelog>
  <changelog author="jsmeix@suse.de" date="1573473600">- CVE-2019-14869.patch contains commit from Ghostscript upstream
  https://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=485904772c5f
  to fix CVE-2019-14869 "-dSAFER escape in .charkeys"
  (bsc#1156275)</changelog>
  <changelog author="jsmeix@suse.de" date="1588075200">- The version upgrade to 9.52 fixes in particular
  CVE-2020-12268: jbic2dec: heap-based buffer overflow
  in jbig2_image_compose (bsc#1170603)
- Version upgrade to 9.52
  Highlights in this release include:
  * The 9.52 release replaces the 9.51 release after a problem
    was reported with 9.51 which warranted the quick turnaround.
    Thus, like 9.51, 9.52 is primarily a maintenance release,
    consolidating the changes we introduced in 9.50.
  * IMPORTANT: We have forked LittleCMS2 into LittleCMS2mt
    (the "mt" indicating "multi-thread").
    LCMS2 is not thread-safe, and cannot be made thread-safe
    without breaking the ABI. Our fork will be thread-safe and
    include performance enhancements (these changes have all
    been offered and rejected upstream). We will maintain
    compatibility between Ghostscript and LCMS2 for a time,
    but not in perpetuity. If there is sufficient interest,
    our fork will be available as its own package separately
    from Ghostscript (and MuPDF).
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  Incompatible changes:
  * New option -dALLOWPSTRANSPARENCY: The transparency compositor
    (and related features), whilst we are improving it, remains
    sensitive to being driven correctly, and incorrect use
    can have unexpected/undefined results. Hence, as part of
    improving security, we limited access to these operators,
    originally using the -dSAFER feature. As we made "SAFER"
    the default mode, that became unacceptable, hence the
    new option -dALLOWPSTRANSPARENCY which enables access
    to the operators, cf.
    https://www.ghostscript.com/doc/9.52/Use.htm#ALLOWPSTRANSPARENCY
  For a release summary see:
  https://www.ghostscript.com/doc/9.52/News.htm
  For details see the News.htm and History9.htm files.
- Version upgrade to 9.51
  Highlights in this release include:
  * 9.51 is primarily a maintainance release, consolidating
    the changes we introduced in 9.50.
  * We have continued our work on code hygiene for this release,
    with a focus on the static analysis tool Coverity
    (from Synopsys, Inc) and we are now maintaining a policy of
    zero Coverity issues in the Ghostscript/GhostPDL source base.
  * IMPORTANT: In consultation with a representative of
    OpenPrinting (http://www.openprinting.org/) it is our
    intention to deprecate and, in the not distant future,
    remove the OpenPrinting Vector/Raster Printer Drivers
    (that is, the opvp and oprp devices).
    If you rely on either of these devices, please get in touch
    with us (i.e. Ghostscript upstream), so we can discuss your
    use case, and revise our plans accordingly.
  * We (i.e. Ghostscript upstream) are in the process of forking
    LittleCMS, cf. the other release notes entries below.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  For a release summary see:
  https://www.ghostscript.com/doc/9.51/News.htm
  For details see the News.htm and History9.htm files.
- Version upgrade to 9.50
  Highlights in this release include:
  * The change to version 9.50 follows recognition
    of the extent and importance of the file access control
    redesign/reimplementation outlined below.
  * The file access control capability (enable with -dSAFER)
    has been completely rewritten, with a ground-up rethink
    of the design. For more details, see: "SAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#Safer
  * It is important to note that -dSAFER now only enables the
    file access controls, and no longer applies restrictions
    to standard Postscript functionality (specifically,
    restrictions on setpagedevice). If your application relies
    on these Postscript restrictions, see "OLDSAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#OldSafer
    and please get in touch, as we do plan to remove those
    Postscript restrictions unless we have reason not to.
  IMPORTANT: File access controls are now enabled by default.
    In order to run Ghostscript without these controls,
    see "NOSAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#NoSafer
  * We (i.e. Ghostscript upstream) are in the process of forking
    LittleCMS, cf. the other release notes entries below.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  Incompatible changes:
  * There are a couple of subtle incompatibilities between the old
    and new SAFER implementations. Firstly, as mentioned above,
    SAFER now leaves standard Postcript functionality unchanged
    (except for the file access limitations). Secondly, the
    interaction with save/restore operations, see "SAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#Safer
  * The following is not strictly speaking new to 9.50,
    as not much has changed since 9.27 in this area,
    but for those who don't upgrade with every release:
    The process of "tidying" the Postscript name space should have
    removed only non-standard and undocumented operators.
    Nevertheless, it is possible that any integrations or utilities
    that rely on those non-standard and undocumented operators
    may stop working, or may change behaviour.
    If you encounter such a case, please contact us
    (i.e. Ghostscript upstream, either the #ghostscript IRC channel
    or the gs-devel mailing list would be best), and we'll work
    with you to either find an alternative solution or return the
    previous functionality, if there is genuinely no other option.
    One case we know this has occurred is GSView 5 (and earlier).
    GSView 5 support for PDF files relied upon internal use only
    features which are no longer available. GSView 5 will still
    work as previously for Postscript files. For PDF files,
    users are encouraged to look at MuPDF https://www.mupdf.com/
  For a release summary see:
  https://www.ghostscript.com/doc/9.50/News.htm
  For details see the News.htm and History9.htm files.
- CVE-2019-10216.patch CVE-2019-14869.patch
  gs-CVE-2019-14811-885444fc.patch
  gs-CVE-2019-14817-cd1b1cac.patch
  openjpeg4gs-CVE-2018-6616-8ee33522.patch
  are fixed in the version 9.52 upstream sources.</changelog>
  <changelog author="jsmeix@suse.de" date="1595851200">- CVE-2020-15900.patch fixes CVE-2020-15900
  Memory Corruption (SAFER Sandbox Breakout)
  cf. https://bugs.ghostscript.com/show_bug.cgi?id=702582
  (bsc#1174415)</changelog>
  <changelog author="wolfgang.frisch@suse.com" date="1619006400">- Hardening: link as position independent executable (bsc#1184123).</changelog>
  <changelog author="jsmeix@suse.de" date="1631275200">- CVE-2021-3781.patch fixes CVE-2021-3781
  Trivial -dSAFER bypass
  cf. https://bugs.ghostscript.com/show_bug.cgi?id=704342
  (bsc#1190381)</changelog>
  <changelog author="werner@suse.de" date="1632916800">- Use update-alternatives to get the real ghostscript binary from
  /usr/bin/gs to /usr/bin/gs.bin and allow the gswrap package to
  use this with its wrapper script (jira#PM-3037)</changelog>
</package>
<package pkgid="66d8af15d47fd402a43b662f7b4c6e249410e15863e10733b6783e1c70788009" name="ghostscript-x11" arch="x86_64">
  <version epoch="0" ver="9.52" rel="158.1"/>
  <changelog author="jsmeix@suse.de" date="1521720000">- Version upgrade to 9.23
  Highlights in this release include:
  * Ghostscript now has a family of 'pdfimage' devices
    (pdfimage8, pdfimage24 and pdfimage32) which produce
    rendered output wrapped up as an image in a PDF.
    Additionally, there is a 'pclm' device which
    produces PCLm format output.
  * There is now a ColorAccuracy parameter allowing the user
    to decide between speed or accuracy in ICC color transforms.
  * JPEG Passthrough: devices which support it can now receive
    the 'raw' JPEG stream from the interpreter.
    The main use of this is the pdfwrite/ps2write family of devices
    that can now take JPEG streams from the input file(s) and write
    them unchanged to the output (thus avoiding additional
    quantization effects).
  * PDF transparency performance improvements
  * IMPORTANT: We (i.e. Ghostscript upstream) are in the process
    of forking LittleCMS.
    LCMS2 is not thread safe, and cannot be made thread safe
    without breaking the ABI. Our fork will be thread safe,
    and include performance enhancements (these changes have all
    be been offered and rejected upstream). We will maintain
    compatibility between Ghostscript and LCMS2 for a time,
    but not in perpetuity. Our fork will be available as its own
    package separately from Ghostscript (and MuPDF).
  * We have continued the focus on code hygiene in this release
    cleaning up security issues, ignored return values,
    and compiler warnings.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  Incompatible changes
  * The planned device API tidy has, unfortunately, been
    indefinitely postponed, until appropriate resources
    are available.
  For a release summary see:
  http://www.ghostscript.com/doc/9.23/News.htm
  For details see the News.htm and History9.htm files.
  See also the entries below since "Version upgrade to 9.22"
  (boo#1082896 and boo#1074266).</changelog>
  <changelog author="jsmeix@suse.de" date="1528200000">- CVE-2018-10194.patch fixes stack-based buffer overflow
  in gdevpdts.c (bsc#1090099), see
  https://bugs.ghostscript.com/show_bug.cgi?id=699255 and
  http://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=39b1e54b2968620723bf32e96764c88797714879</changelog>
  <changelog author="jsmeix@suse.de" date="1536840000">- Version upgrade to 9.24
  Highlights in this release include:
  * Security issues have been the primary focus of this release,
    including solving several (well publicised)
    real and potential exploits.
    PLEASE NOTE:
    We (i.e. Ghostscript upstream) strongly urge users to upgrade
    to this latest release to avoid these issues.
  * As well as Ghostscript itself, jbig2dec has had a significant
    amount of work improving its robustness in the face of
    out specification files.
  * IMPORTANT: We (i.e. Ghostscript upstream) are in the process
    of forking LittleCMS. LCMS2 is not thread safe, and cannot
    be made thread safe without breaking the ABI. Our fork
    will be thread safe, and include performance enhancements
    (these changes have all be been offered and rejected upstream).
    We will maintain compatibility between Ghostscript and LCMS2
    for a time, but not in perpetuity. Our fork will be available
    as its own package separately from Ghostscript (and MuPDF).
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  For a release summary see:
  http://www.ghostscript.com/doc/9.24/News.htm
  For details see the News.htm and History9.htm files.
- fix_ln_docdir_gsdatadir.patch is no longer needed
  because the issue is fixed in the upstream sources.
- CVE-2018-10194.patch is no longer needed
  because the issue is fixed in the upstream sources.</changelog>
  <changelog author="jsmeix@suse.de" date="1536840001">- Version upgrade to 9.25rc1 (first release candidate for 9.25).
  Highlights in this release include:
  * This release fixes problems with argument handling, some
    unintended results of the security fixes to the SAFER file
    access restrictions (specifically accessing ICC profile files),
    and some additional security issues over the 9.24 release.
  * Security issues have been the primary focus of this release,
    including solving several (well publicised) real
    and potential exploits.
    PLEASE NOTE:
    We (i.e. Ghostscript upstream) strongly urge users to upgrade
    to this latest release to avoid these issues.
  * Avoid that ps2epsi fails with
    'Error: /undefined in --setpagedevice--'
    Recent changes required to harden SAFER mode mean that
    it is no longer possible to run ps2epsi in SAFER mode,
    because it relies upon unsafe Ghostscript non-standard
    extension operators.
    Removing SAFER and DELAYSAFER, and the code to reset SAFER,
    allow ps2epsi to run as well as it ever did (ie badly).
    This program (i.e. ps2epsi) should now be considered unsafe,
    you should not use it on untrusted PostScript programs.
    Likely we (i.e. Ghostscript upstream) will deprecate and
    remove this program in future.
  For details see the News.htm and History9.htm files.
  Regarding installing packages (in particular release candidates)
  from the openSUSE build service development project "Printing"
  see https://build.opensuse.org/project/show/Printing</changelog>
  <changelog author="jsmeix@suse.de" date="1536926400">- Version upgrade to 9.25
  For the highlights in this release see the highlights in the
  9.25rc1 first release candidate for 9.25 entry below.
  PLEASE NOTE:
  We (i.e. Ghostscript upstream) strongly urge users to upgrade
  to this latest release to avoid these issues.
  For a release summary see:
  http://www.ghostscript.com/doc/9.25/News.htm
  For details see the News.htm and History9.htm files.
  The Ghostscript 9.25 release should fix (see below)
  in particular those security issues:
  * CVE-2018-15909: shading_param incomplete type checking
    https://bugs.ghostscript.com/show_bug.cgi?id=699660
    https://bugzilla.suse.com/show_bug.cgi?id=1106172 bsc#1106172
  * CVE-2018-15908: .tempfile file permission issues
    https://bugs.ghostscript.com/show_bug.cgi?id=699657
    https://bugzilla.suse.com/show_bug.cgi?id=1106171 bsc#1106171
  * CVE-2018-15910: LockDistillerParams type confusion
    https://bugs.ghostscript.com/show_bug.cgi?id=699656
    https://bugzilla.suse.com/show_bug.cgi?id=1106173 bsc#1106173
  * CVE-2018-15911: uninitialized memory access in the aesdecode
    https://bugs.ghostscript.com/show_bug.cgi?id=699665
    https://bugzilla.suse.com/show_bug.cgi?id=1106195 bsc#1106195
  * CVE-2018-16513: setcolor missing type check
    https://bugs.ghostscript.com/show_bug.cgi?id=699655
    https://bugzilla.suse.com/show_bug.cgi?id=1107412 bsc#1107412
  * CVE-2018-16509: /invalidaccess bypass after failed restore
    https://bugs.ghostscript.com/show_bug.cgi?id=699654
    https://bugzilla.suse.com/show_bug.cgi?id=1107410 bsc#1107410
  * CVE-2018-16510: Incorrect exec stack handling in the "CS"
    and "SC" PDF primitives
    https://bugs.ghostscript.com/show_bug.cgi?id=699671
    https://bugzilla.suse.com/show_bug.cgi?id=1107411 bsc#1107411
  * CVE-2018-16542: .definemodifiedfont memory corruption
    if /typecheck is handled
    https://bugs.ghostscript.com/show_bug.cgi?id=699668
    https://bugzilla.suse.com/show_bug.cgi?id=1107413 bsc#1107413
  * CVE-2018-16541 incorrect free logic in pagedevice replacement
    https://bugs.ghostscript.com/show_bug.cgi?id=699664
    https://bugzilla.suse.com/show_bug.cgi?id=1107421 bsc#1107421
  * CVE-2018-16540 use-after-free in copydevice handling
    https://bugs.ghostscript.com/show_bug.cgi?id=699661
    https://bugzilla.suse.com/show_bug.cgi?id=1107420 bsc#1107420
  * CVE-2018-16539: incorrect access checking in temp file
    handling to disclose contents of files
    https://bugs.ghostscript.com/show_bug.cgi?id=699658
    https://bugzilla.suse.com/show_bug.cgi?id=1107422 bsc#1107422
  * CVE-2018-16543: gssetresolution and gsgetresolution allow
    for unspecified impact
    https://bugs.ghostscript.com/show_bug.cgi?id=699670
    https://bugzilla.suse.com/show_bug.cgi?id=1107423 bsc#1107423
  * CVE-2018-16511: type confusion in "ztype" could be used by
    remote attackers able to supply crafted PostScript to crash
    the interpreter or possibly have unspecified other impact
    https://bugs.ghostscript.com/show_bug.cgi?id=699659
    https://bugzilla.suse.com/show_bug.cgi?id=1107426 bsc#1107426
  * CVE-2018-16585 .setdistillerkeys PostScript command is
    accepted even though it is not intended for use
    https://bugzilla.suse.com/show_bug.cgi?id=1107581 bsc#1107581
  * CVE-2018-16802: Incorrect"restoration of privilege" checking
    when running out of stack during exceptionhandling could be
    used by attackers able to supply crafted PostScript to execute
    code using the "pipe" instruction. This is due to an incomplete
    fix for CVE-2018-16509
    https://bugs.ghostscript.com/show_bug.cgi?id=699714
    https://bugs.ghostscript.com/show_bug.cgi?id=699718
    https://bugzilla.suse.com/show_bug.cgi?id=1108027 bnc#1108027
  Regarding what the above "should fix" means:
  PostScript is a general purpose Turing-complete programming
  language (cf. https://en.wikipedia.org/wiki/PostScript)
  that supports in particular file access on the system disk.
  When Ghostscript processes PostScript it runs a PostScript
  program as the user who runs Ghostscript.
  When Ghostscript processes an arbitrary PostScript file,
  the user who runs Ghostscript runs an arbitrary program
  which can do anything on the system where Ghostscript runs
  that this user is allowed to do on that system.
  To make it safer when Ghostscript runs a PostScript program
  the Ghostscript command line option '-dSAFER' disables
  certain file access functionality, for details see
  /usr/share/doc/ghostscript/9.25/Use.htm
  Its name 'SAFER' says everything: It makes it 'safer'
  to let Ghostscript run a PostScript program,
  but it does not make it completely safe.
  In theory software is safe against misuse (i.e. has no bugs).
  In practice there is an endless sequence of various kind of
  security issues (i.e. software can be misused to do more than
  what is intended) that get fixed issue by issue ad infinitum.
  In the end all that means:
  In practice the user who runs Ghostscript must not let it
  process arbitrary PostScript files from untrusted origin.
  In particular Ghostscript is usually run when printing
  documents (with the '-dSAFER' option set), see the part about
  "It is crucial to limit access to CUPS to trusted users" in
  https://en.opensuse.org/SDB:CUPS_and_SANE_Firewall_settings</changelog>
  <changelog author="jsmeix@suse.de" date="1541764800">- Version upgrade to 9.26rc1 (first release candidate for 9.26).
  Highlights in this release include:
  * Purely security and a few bug fixes, there are no new features,
    and no API changes to report.</changelog>
  <changelog author="jsmeix@suse.de" date="1543579200">- Version upgrade to 9.26
  Highlights in this release include:
  * Security issues have been the primary focus of this release,
    including solving several (well publicised) real and potential
    exploits.
    Thanks to Man Yue Mo of Semmle Security Research Team,
    Jens Mueller of Ruhr-Universitaet Bochum and
    Tavis Ormandy of Google's Project Zero
    for their help to identify specific security issues.
    PLEASE NOTE:
    We (i.e. Ghostscript upstream) strongly urge users to upgrade
    to this latest release to avoid these issues.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  For a release summary see:
  http://www.ghostscript.com/doc/9.26/News.htm
  For details see the News.htm and History9.htm files.
  The Ghostscript 9.26 release should fix (cf. the entry below
  dated 'Fri Sep 14 10:47:33 CEST 2018' what "should fix" means)
  in particular those security issues (bsc#1117331)
  * CVE-2018-19475: psi/zdevice2.c allows attackers to bypass
    intended access restrictions
    https://bugs.ghostscript.com/show_bug.cgi?id=700153
    https://bugzilla.suse.com/show_bug.cgi?id=1117327 bsc#1117327
  * CVE-2018-19476: psi/zicc.c allows attackers to bypass
    intended access restrictions because of a setcolorspace
    type confusion
    https://bugs.ghostscript.com/show_bug.cgi?id=700169
    https://bugzilla.suse.com/show_bug.cgi?id=1117313 bsc#1117313
  * CVE-2018-19477: psi/zfjbig2.c allows attackers to bypass
    intended access restrictions because of a JBIG2Decode
    type confusion
    https://bugs.ghostscript.com/show_bug.cgi?id=700168
    https://bugzilla.suse.com/show_bug.cgi?id=1117274 bsc#1117274
  * CVE-2018-19409: LockSafetyParams is not checked correctly
    if another device is used
    https://bugs.ghostscript.com/show_bug.cgi?id=700176
    https://bugzilla.suse.com/show_bug.cgi?id=1117022 bsc#1117022
  and those security issues
  * CVE-2018-18284: 1Policy operator gives access to .forceput
    https://bugs.ghostscript.com/show_bug.cgi?id=69963
    https://bugzilla.suse.com/show_bug.cgi?id=1112229 bsc#1112229
  * CVE-2018-18073: saved execution stacks can leak operator arrays
    https://bugs.ghostscript.com/show_bug.cgi?id=699927
    https://bugzilla.suse.com/show_bug.cgi?id=1111480 bsc#1111480
  * CVE-2018-17961: bypassing executeonly to escape -dSAFER sandbox
    https://bugs.ghostscript.com/show_bug.cgi?id=699816
    https://bugzilla.suse.com/show_bug.cgi?id=1111479 bsc#1111479
  * CVE-2018-17183: remote attackers could be able to supply
    crafted PostScript to potentially overwrite or replace
    error handlers to inject code
    https://bugs.ghostscript.com/show_bug.cgi?id=699708
    https://bugzilla.suse.com/show_bug.cgi?id=1109105 bsc#1109105</changelog>
  <changelog author="jsmeix@suse.de" date="1547726400">- Version upgrade to 9.26a
  The version 9.26a is a special security bugfix version to fix
  * CVE-2019-6116: subroutines within pseudo-operators
    must themselves be pseudo-operators
    https://bugs.ghostscript.com/show_bug.cgi?id=700317
    https://bugzilla.suse.com/show_bug.cgi?id=1122319 bsc#1122319</changelog>
  <changelog author="jsmeix@suse.de" date="1552996800">- CVE-2019-3838.patch fixes CVE-2019-3838
  forceput in DefineResource is still accessible
  https://bugzilla.suse.com/show_bug.cgi?id=1129186 bsc#1129186
  https://bugs.ghostscript.com/show_bug.cgi?id=700576</changelog>
  <changelog author="jsmeix@suse.de" date="1554379200">- Version upgrade to 9.27
  Highlights in this release include:
  * We (i.e. Ghostscript upstream) have extensively cleaned up
    the Postscript name space: removing access to internal and/or
    undocumented Postscript operators, procedures and data.
    This has benefits for security and maintainability.
    Incompatible changes:
    The process of "tidying" the Postscript name space should
    have removed only non-standard and undocumented operators.
    Nevertheless, it is possible that any integrations or
    utilities that rely on those non-standard and undocumented
    operators may stop working, or may change behaviour.
    If you encounter such a case, please contact us (i.e.
    Ghostscript upstream) - (either the #ghostscript IRC channel,
    or the gs-devel mailing list would be best), and we'll work
    with you to either find an alternative solution.
  * Fontmap can now reference invidual fonts in a TrueType
    Collection for font subsitution. Previously, a Fontmap entry
    could only reference a TrueType collection and use the default
    (first) font.
    Now, the Fontmap syntax allows for specifying a specific index
    in a TTC. See the comments at the top of (the default)
    Fontmap.GS for details.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  IMPORTANT: It is our intention, within the next 12 months
    (ideally sooner, in time for the next release) to make SAFER
    the default mode of operation. For many users this will have
    no effect, since they use SAFER explicitly, but some niche
    uses which rely on SAFER being disabled may need to start
    explicitly adding the "-dNOSAFER" option.
  IMPORTANT: We (i.e. Ghostscript upstream) are in the process of
    forking LittleCMS. LCMS2 is not thread safe, and cannot be made
    thread safe without breaking the ABI. Our fork will be thread
    safe, and include performance enhancements (these changes have
    all be been offered and rejected upstream). We will maintain
    compatibility between Ghostscript and LCMS2 for a time, but not
    in perpetuity. Our fork will be available as its own package
    separately from Ghostscript (and MuPDF).
  For a release summary see:
  http://www.ghostscript.com/doc/9.27/News.htm
  For details see the News.htm and History9.htm files.
  The Ghostscript 9.27 release should fix (cf. the entry below
  dated 'Fri Sep 14 10:47:33 CEST 2018' what "should fix" means)
  in particular those security issues:
  * CVE-2019-3838 forceput in DefineResource is still accessible
    https://bugzilla.suse.com/show_bug.cgi?id=1129186 bsc#1129186
    https://bugs.ghostscript.com/show_bug.cgi?id=700576
  * CVE-2019-3835: superexec operator is available
    https://bugzilla.suse.com/show_bug.cgi?id=1129180 bsc#1129180
    https://bugs.ghostscript.com/show_bug.cgi?id=700585</changelog>
  <changelog author="werner@suse.de" date="1565611200">- CVE-2019-10216.patch fixes CVE-2019-10216
  forceput/superexec in .buildfont1 is still accessible
  https://bugzilla.suse.com/show_bug.cgi?id=1144621 bsc#1144621
  https://bugs.ghostscript.com/show_bug.cgi?id=701394</changelog>
  <changelog author="werner@suse.de" date="1568376000">- Add patch openjpeg4gs-CVE-2018-6616-8ee33522.patch
  to fix bsc#1140359 for CVE-2019-12973</changelog>
  <changelog author="werner@suse.de" date="1568635200">- Add patch gs-CVE-2019-14811-885444fc.patch to fix bsc#1146882
  for CVE-2019-14811,CVE-2019-14812,CVE-2019-14813
- Add patch gs-CVE-2019-14817-cd1b1cac.patch to fix bsc#1146884
  for CVE-2019-14817</changelog>
  <changelog author="werner@suse.de" date="1568635201">- Port latest ghostscript 9.27 from factory including latest
  security patches to SLES15/SLES12
  * Port patch CVE-2019-10216.patch to 9.27 which is the orignal
    upstream commit now
  * Drop patch CVE-2019-3838.patch as now part of 9.27</changelog>
  <changelog author="jsmeix@suse.de" date="1573473600">- CVE-2019-14869.patch contains commit from Ghostscript upstream
  https://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=485904772c5f
  to fix CVE-2019-14869 "-dSAFER escape in .charkeys"
  (bsc#1156275)</changelog>
  <changelog author="jsmeix@suse.de" date="1588075200">- The version upgrade to 9.52 fixes in particular
  CVE-2020-12268: jbic2dec: heap-based buffer overflow
  in jbig2_image_compose (bsc#1170603)
- Version upgrade to 9.52
  Highlights in this release include:
  * The 9.52 release replaces the 9.51 release after a problem
    was reported with 9.51 which warranted the quick turnaround.
    Thus, like 9.51, 9.52 is primarily a maintenance release,
    consolidating the changes we introduced in 9.50.
  * IMPORTANT: We have forked LittleCMS2 into LittleCMS2mt
    (the "mt" indicating "multi-thread").
    LCMS2 is not thread-safe, and cannot be made thread-safe
    without breaking the ABI. Our fork will be thread-safe and
    include performance enhancements (these changes have all
    been offered and rejected upstream). We will maintain
    compatibility between Ghostscript and LCMS2 for a time,
    but not in perpetuity. If there is sufficient interest,
    our fork will be available as its own package separately
    from Ghostscript (and MuPDF).
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  Incompatible changes:
  * New option -dALLOWPSTRANSPARENCY: The transparency compositor
    (and related features), whilst we are improving it, remains
    sensitive to being driven correctly, and incorrect use
    can have unexpected/undefined results. Hence, as part of
    improving security, we limited access to these operators,
    originally using the -dSAFER feature. As we made "SAFER"
    the default mode, that became unacceptable, hence the
    new option -dALLOWPSTRANSPARENCY which enables access
    to the operators, cf.
    https://www.ghostscript.com/doc/9.52/Use.htm#ALLOWPSTRANSPARENCY
  For a release summary see:
  https://www.ghostscript.com/doc/9.52/News.htm
  For details see the News.htm and History9.htm files.
- Version upgrade to 9.51
  Highlights in this release include:
  * 9.51 is primarily a maintainance release, consolidating
    the changes we introduced in 9.50.
  * We have continued our work on code hygiene for this release,
    with a focus on the static analysis tool Coverity
    (from Synopsys, Inc) and we are now maintaining a policy of
    zero Coverity issues in the Ghostscript/GhostPDL source base.
  * IMPORTANT: In consultation with a representative of
    OpenPrinting (http://www.openprinting.org/) it is our
    intention to deprecate and, in the not distant future,
    remove the OpenPrinting Vector/Raster Printer Drivers
    (that is, the opvp and oprp devices).
    If you rely on either of these devices, please get in touch
    with us (i.e. Ghostscript upstream), so we can discuss your
    use case, and revise our plans accordingly.
  * We (i.e. Ghostscript upstream) are in the process of forking
    LittleCMS, cf. the other release notes entries below.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  For a release summary see:
  https://www.ghostscript.com/doc/9.51/News.htm
  For details see the News.htm and History9.htm files.
- Version upgrade to 9.50
  Highlights in this release include:
  * The change to version 9.50 follows recognition
    of the extent and importance of the file access control
    redesign/reimplementation outlined below.
  * The file access control capability (enable with -dSAFER)
    has been completely rewritten, with a ground-up rethink
    of the design. For more details, see: "SAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#Safer
  * It is important to note that -dSAFER now only enables the
    file access controls, and no longer applies restrictions
    to standard Postscript functionality (specifically,
    restrictions on setpagedevice). If your application relies
    on these Postscript restrictions, see "OLDSAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#OldSafer
    and please get in touch, as we do plan to remove those
    Postscript restrictions unless we have reason not to.
  IMPORTANT: File access controls are now enabled by default.
    In order to run Ghostscript without these controls,
    see "NOSAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#NoSafer
  * We (i.e. Ghostscript upstream) are in the process of forking
    LittleCMS, cf. the other release notes entries below.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  Incompatible changes:
  * There are a couple of subtle incompatibilities between the old
    and new SAFER implementations. Firstly, as mentioned above,
    SAFER now leaves standard Postcript functionality unchanged
    (except for the file access limitations). Secondly, the
    interaction with save/restore operations, see "SAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#Safer
  * The following is not strictly speaking new to 9.50,
    as not much has changed since 9.27 in this area,
    but for those who don't upgrade with every release:
    The process of "tidying" the Postscript name space should have
    removed only non-standard and undocumented operators.
    Nevertheless, it is possible that any integrations or utilities
    that rely on those non-standard and undocumented operators
    may stop working, or may change behaviour.
    If you encounter such a case, please contact us
    (i.e. Ghostscript upstream, either the #ghostscript IRC channel
    or the gs-devel mailing list would be best), and we'll work
    with you to either find an alternative solution or return the
    previous functionality, if there is genuinely no other option.
    One case we know this has occurred is GSView 5 (and earlier).
    GSView 5 support for PDF files relied upon internal use only
    features which are no longer available. GSView 5 will still
    work as previously for Postscript files. For PDF files,
    users are encouraged to look at MuPDF https://www.mupdf.com/
  For a release summary see:
  https://www.ghostscript.com/doc/9.50/News.htm
  For details see the News.htm and History9.htm files.
- CVE-2019-10216.patch CVE-2019-14869.patch
  gs-CVE-2019-14811-885444fc.patch
  gs-CVE-2019-14817-cd1b1cac.patch
  openjpeg4gs-CVE-2018-6616-8ee33522.patch
  are fixed in the version 9.52 upstream sources.</changelog>
  <changelog author="jsmeix@suse.de" date="1595851200">- CVE-2020-15900.patch fixes CVE-2020-15900
  Memory Corruption (SAFER Sandbox Breakout)
  cf. https://bugs.ghostscript.com/show_bug.cgi?id=702582
  (bsc#1174415)</changelog>
  <changelog author="wolfgang.frisch@suse.com" date="1619006400">- Hardening: link as position independent executable (bsc#1184123).</changelog>
  <changelog author="jsmeix@suse.de" date="1631275200">- CVE-2021-3781.patch fixes CVE-2021-3781
  Trivial -dSAFER bypass
  cf. https://bugs.ghostscript.com/show_bug.cgi?id=704342
  (bsc#1190381)</changelog>
  <changelog author="werner@suse.de" date="1632916800">- Use update-alternatives to get the real ghostscript binary from
  /usr/bin/gs to /usr/bin/gs.bin and allow the gswrap package to
  use this with its wrapper script (jira#PM-3037)</changelog>
</package>
<package pkgid="df4b09760d1773cf248576a40b68f43f2e764ab5890170f87f3c30b913c8560f" name="ghostscript-x11" arch="aarch64">
  <version epoch="0" ver="9.52" rel="161.1"/>
  <changelog author="jsmeix@suse.de" date="1528200000">- CVE-2018-10194.patch fixes stack-based buffer overflow
  in gdevpdts.c (bsc#1090099), see
  https://bugs.ghostscript.com/show_bug.cgi?id=699255 and
  http://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=39b1e54b2968620723bf32e96764c88797714879</changelog>
  <changelog author="jsmeix@suse.de" date="1536840000">- Version upgrade to 9.24
  Highlights in this release include:
  * Security issues have been the primary focus of this release,
    including solving several (well publicised)
    real and potential exploits.
    PLEASE NOTE:
    We (i.e. Ghostscript upstream) strongly urge users to upgrade
    to this latest release to avoid these issues.
  * As well as Ghostscript itself, jbig2dec has had a significant
    amount of work improving its robustness in the face of
    out specification files.
  * IMPORTANT: We (i.e. Ghostscript upstream) are in the process
    of forking LittleCMS. LCMS2 is not thread safe, and cannot
    be made thread safe without breaking the ABI. Our fork
    will be thread safe, and include performance enhancements
    (these changes have all be been offered and rejected upstream).
    We will maintain compatibility between Ghostscript and LCMS2
    for a time, but not in perpetuity. Our fork will be available
    as its own package separately from Ghostscript (and MuPDF).
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  For a release summary see:
  http://www.ghostscript.com/doc/9.24/News.htm
  For details see the News.htm and History9.htm files.
- fix_ln_docdir_gsdatadir.patch is no longer needed
  because the issue is fixed in the upstream sources.
- CVE-2018-10194.patch is no longer needed
  because the issue is fixed in the upstream sources.</changelog>
  <changelog author="jsmeix@suse.de" date="1536840001">- Version upgrade to 9.25rc1 (first release candidate for 9.25).
  Highlights in this release include:
  * This release fixes problems with argument handling, some
    unintended results of the security fixes to the SAFER file
    access restrictions (specifically accessing ICC profile files),
    and some additional security issues over the 9.24 release.
  * Security issues have been the primary focus of this release,
    including solving several (well publicised) real
    and potential exploits.
    PLEASE NOTE:
    We (i.e. Ghostscript upstream) strongly urge users to upgrade
    to this latest release to avoid these issues.
  * Avoid that ps2epsi fails with
    'Error: /undefined in --setpagedevice--'
    Recent changes required to harden SAFER mode mean that
    it is no longer possible to run ps2epsi in SAFER mode,
    because it relies upon unsafe Ghostscript non-standard
    extension operators.
    Removing SAFER and DELAYSAFER, and the code to reset SAFER,
    allow ps2epsi to run as well as it ever did (ie badly).
    This program (i.e. ps2epsi) should now be considered unsafe,
    you should not use it on untrusted PostScript programs.
    Likely we (i.e. Ghostscript upstream) will deprecate and
    remove this program in future.
  For details see the News.htm and History9.htm files.
  Regarding installing packages (in particular release candidates)
  from the openSUSE build service development project "Printing"
  see https://build.opensuse.org/project/show/Printing</changelog>
  <changelog author="jsmeix@suse.de" date="1536926400">- Version upgrade to 9.25
  For the highlights in this release see the highlights in the
  9.25rc1 first release candidate for 9.25 entry below.
  PLEASE NOTE:
  We (i.e. Ghostscript upstream) strongly urge users to upgrade
  to this latest release to avoid these issues.
  For a release summary see:
  http://www.ghostscript.com/doc/9.25/News.htm
  For details see the News.htm and History9.htm files.
  The Ghostscript 9.25 release should fix (see below)
  in particular those security issues:
  * CVE-2018-15909: shading_param incomplete type checking
    https://bugs.ghostscript.com/show_bug.cgi?id=699660
    https://bugzilla.suse.com/show_bug.cgi?id=1106172 bsc#1106172
  * CVE-2018-15908: .tempfile file permission issues
    https://bugs.ghostscript.com/show_bug.cgi?id=699657
    https://bugzilla.suse.com/show_bug.cgi?id=1106171 bsc#1106171
  * CVE-2018-15910: LockDistillerParams type confusion
    https://bugs.ghostscript.com/show_bug.cgi?id=699656
    https://bugzilla.suse.com/show_bug.cgi?id=1106173 bsc#1106173
  * CVE-2018-15911: uninitialized memory access in the aesdecode
    https://bugs.ghostscript.com/show_bug.cgi?id=699665
    https://bugzilla.suse.com/show_bug.cgi?id=1106195 bsc#1106195
  * CVE-2018-16513: setcolor missing type check
    https://bugs.ghostscript.com/show_bug.cgi?id=699655
    https://bugzilla.suse.com/show_bug.cgi?id=1107412 bsc#1107412
  * CVE-2018-16509: /invalidaccess bypass after failed restore
    https://bugs.ghostscript.com/show_bug.cgi?id=699654
    https://bugzilla.suse.com/show_bug.cgi?id=1107410 bsc#1107410
  * CVE-2018-16510: Incorrect exec stack handling in the "CS"
    and "SC" PDF primitives
    https://bugs.ghostscript.com/show_bug.cgi?id=699671
    https://bugzilla.suse.com/show_bug.cgi?id=1107411 bsc#1107411
  * CVE-2018-16542: .definemodifiedfont memory corruption
    if /typecheck is handled
    https://bugs.ghostscript.com/show_bug.cgi?id=699668
    https://bugzilla.suse.com/show_bug.cgi?id=1107413 bsc#1107413
  * CVE-2018-16541 incorrect free logic in pagedevice replacement
    https://bugs.ghostscript.com/show_bug.cgi?id=699664
    https://bugzilla.suse.com/show_bug.cgi?id=1107421 bsc#1107421
  * CVE-2018-16540 use-after-free in copydevice handling
    https://bugs.ghostscript.com/show_bug.cgi?id=699661
    https://bugzilla.suse.com/show_bug.cgi?id=1107420 bsc#1107420
  * CVE-2018-16539: incorrect access checking in temp file
    handling to disclose contents of files
    https://bugs.ghostscript.com/show_bug.cgi?id=699658
    https://bugzilla.suse.com/show_bug.cgi?id=1107422 bsc#1107422
  * CVE-2018-16543: gssetresolution and gsgetresolution allow
    for unspecified impact
    https://bugs.ghostscript.com/show_bug.cgi?id=699670
    https://bugzilla.suse.com/show_bug.cgi?id=1107423 bsc#1107423
  * CVE-2018-16511: type confusion in "ztype" could be used by
    remote attackers able to supply crafted PostScript to crash
    the interpreter or possibly have unspecified other impact
    https://bugs.ghostscript.com/show_bug.cgi?id=699659
    https://bugzilla.suse.com/show_bug.cgi?id=1107426 bsc#1107426
  * CVE-2018-16585 .setdistillerkeys PostScript command is
    accepted even though it is not intended for use
    https://bugzilla.suse.com/show_bug.cgi?id=1107581 bsc#1107581
  * CVE-2018-16802: Incorrect"restoration of privilege" checking
    when running out of stack during exceptionhandling could be
    used by attackers able to supply crafted PostScript to execute
    code using the "pipe" instruction. This is due to an incomplete
    fix for CVE-2018-16509
    https://bugs.ghostscript.com/show_bug.cgi?id=699714
    https://bugs.ghostscript.com/show_bug.cgi?id=699718
    https://bugzilla.suse.com/show_bug.cgi?id=1108027 bnc#1108027
  Regarding what the above "should fix" means:
  PostScript is a general purpose Turing-complete programming
  language (cf. https://en.wikipedia.org/wiki/PostScript)
  that supports in particular file access on the system disk.
  When Ghostscript processes PostScript it runs a PostScript
  program as the user who runs Ghostscript.
  When Ghostscript processes an arbitrary PostScript file,
  the user who runs Ghostscript runs an arbitrary program
  which can do anything on the system where Ghostscript runs
  that this user is allowed to do on that system.
  To make it safer when Ghostscript runs a PostScript program
  the Ghostscript command line option '-dSAFER' disables
  certain file access functionality, for details see
  /usr/share/doc/ghostscript/9.25/Use.htm
  Its name 'SAFER' says everything: It makes it 'safer'
  to let Ghostscript run a PostScript program,
  but it does not make it completely safe.
  In theory software is safe against misuse (i.e. has no bugs).
  In practice there is an endless sequence of various kind of
  security issues (i.e. software can be misused to do more than
  what is intended) that get fixed issue by issue ad infinitum.
  In the end all that means:
  In practice the user who runs Ghostscript must not let it
  process arbitrary PostScript files from untrusted origin.
  In particular Ghostscript is usually run when printing
  documents (with the '-dSAFER' option set), see the part about
  "It is crucial to limit access to CUPS to trusted users" in
  https://en.opensuse.org/SDB:CUPS_and_SANE_Firewall_settings</changelog>
  <changelog author="jsmeix@suse.de" date="1541764800">- Version upgrade to 9.26rc1 (first release candidate for 9.26).
  Highlights in this release include:
  * Purely security and a few bug fixes, there are no new features,
    and no API changes to report.</changelog>
  <changelog author="jsmeix@suse.de" date="1543579200">- Version upgrade to 9.26
  Highlights in this release include:
  * Security issues have been the primary focus of this release,
    including solving several (well publicised) real and potential
    exploits.
    Thanks to Man Yue Mo of Semmle Security Research Team,
    Jens Mueller of Ruhr-Universitaet Bochum and
    Tavis Ormandy of Google's Project Zero
    for their help to identify specific security issues.
    PLEASE NOTE:
    We (i.e. Ghostscript upstream) strongly urge users to upgrade
    to this latest release to avoid these issues.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  For a release summary see:
  http://www.ghostscript.com/doc/9.26/News.htm
  For details see the News.htm and History9.htm files.
  The Ghostscript 9.26 release should fix (cf. the entry below
  dated 'Fri Sep 14 10:47:33 CEST 2018' what "should fix" means)
  in particular those security issues (bsc#1117331)
  * CVE-2018-19475: psi/zdevice2.c allows attackers to bypass
    intended access restrictions
    https://bugs.ghostscript.com/show_bug.cgi?id=700153
    https://bugzilla.suse.com/show_bug.cgi?id=1117327 bsc#1117327
  * CVE-2018-19476: psi/zicc.c allows attackers to bypass
    intended access restrictions because of a setcolorspace
    type confusion
    https://bugs.ghostscript.com/show_bug.cgi?id=700169
    https://bugzilla.suse.com/show_bug.cgi?id=1117313 bsc#1117313
  * CVE-2018-19477: psi/zfjbig2.c allows attackers to bypass
    intended access restrictions because of a JBIG2Decode
    type confusion
    https://bugs.ghostscript.com/show_bug.cgi?id=700168
    https://bugzilla.suse.com/show_bug.cgi?id=1117274 bsc#1117274
  * CVE-2018-19409: LockSafetyParams is not checked correctly
    if another device is used
    https://bugs.ghostscript.com/show_bug.cgi?id=700176
    https://bugzilla.suse.com/show_bug.cgi?id=1117022 bsc#1117022
  and those security issues
  * CVE-2018-18284: 1Policy operator gives access to .forceput
    https://bugs.ghostscript.com/show_bug.cgi?id=69963
    https://bugzilla.suse.com/show_bug.cgi?id=1112229 bsc#1112229
  * CVE-2018-18073: saved execution stacks can leak operator arrays
    https://bugs.ghostscript.com/show_bug.cgi?id=699927
    https://bugzilla.suse.com/show_bug.cgi?id=1111480 bsc#1111480
  * CVE-2018-17961: bypassing executeonly to escape -dSAFER sandbox
    https://bugs.ghostscript.com/show_bug.cgi?id=699816
    https://bugzilla.suse.com/show_bug.cgi?id=1111479 bsc#1111479
  * CVE-2018-17183: remote attackers could be able to supply
    crafted PostScript to potentially overwrite or replace
    error handlers to inject code
    https://bugs.ghostscript.com/show_bug.cgi?id=699708
    https://bugzilla.suse.com/show_bug.cgi?id=1109105 bsc#1109105</changelog>
  <changelog author="jsmeix@suse.de" date="1547726400">- Version upgrade to 9.26a
  The version 9.26a is a special security bugfix version to fix
  * CVE-2019-6116: subroutines within pseudo-operators
    must themselves be pseudo-operators
    https://bugs.ghostscript.com/show_bug.cgi?id=700317
    https://bugzilla.suse.com/show_bug.cgi?id=1122319 bsc#1122319</changelog>
  <changelog author="jsmeix@suse.de" date="1552996800">- CVE-2019-3838.patch fixes CVE-2019-3838
  forceput in DefineResource is still accessible
  https://bugzilla.suse.com/show_bug.cgi?id=1129186 bsc#1129186
  https://bugs.ghostscript.com/show_bug.cgi?id=700576</changelog>
  <changelog author="jsmeix@suse.de" date="1554379200">- Version upgrade to 9.27
  Highlights in this release include:
  * We (i.e. Ghostscript upstream) have extensively cleaned up
    the Postscript name space: removing access to internal and/or
    undocumented Postscript operators, procedures and data.
    This has benefits for security and maintainability.
    Incompatible changes:
    The process of "tidying" the Postscript name space should
    have removed only non-standard and undocumented operators.
    Nevertheless, it is possible that any integrations or
    utilities that rely on those non-standard and undocumented
    operators may stop working, or may change behaviour.
    If you encounter such a case, please contact us (i.e.
    Ghostscript upstream) - (either the #ghostscript IRC channel,
    or the gs-devel mailing list would be best), and we'll work
    with you to either find an alternative solution.
  * Fontmap can now reference invidual fonts in a TrueType
    Collection for font subsitution. Previously, a Fontmap entry
    could only reference a TrueType collection and use the default
    (first) font.
    Now, the Fontmap syntax allows for specifying a specific index
    in a TTC. See the comments at the top of (the default)
    Fontmap.GS for details.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  IMPORTANT: It is our intention, within the next 12 months
    (ideally sooner, in time for the next release) to make SAFER
    the default mode of operation. For many users this will have
    no effect, since they use SAFER explicitly, but some niche
    uses which rely on SAFER being disabled may need to start
    explicitly adding the "-dNOSAFER" option.
  IMPORTANT: We (i.e. Ghostscript upstream) are in the process of
    forking LittleCMS. LCMS2 is not thread safe, and cannot be made
    thread safe without breaking the ABI. Our fork will be thread
    safe, and include performance enhancements (these changes have
    all be been offered and rejected upstream). We will maintain
    compatibility between Ghostscript and LCMS2 for a time, but not
    in perpetuity. Our fork will be available as its own package
    separately from Ghostscript (and MuPDF).
  For a release summary see:
  http://www.ghostscript.com/doc/9.27/News.htm
  For details see the News.htm and History9.htm files.
  The Ghostscript 9.27 release should fix (cf. the entry below
  dated 'Fri Sep 14 10:47:33 CEST 2018' what "should fix" means)
  in particular those security issues:
  * CVE-2019-3838 forceput in DefineResource is still accessible
    https://bugzilla.suse.com/show_bug.cgi?id=1129186 bsc#1129186
    https://bugs.ghostscript.com/show_bug.cgi?id=700576
  * CVE-2019-3835: superexec operator is available
    https://bugzilla.suse.com/show_bug.cgi?id=1129180 bsc#1129180
    https://bugs.ghostscript.com/show_bug.cgi?id=700585</changelog>
  <changelog author="werner@suse.de" date="1565611200">- CVE-2019-10216.patch fixes CVE-2019-10216
  forceput/superexec in .buildfont1 is still accessible
  https://bugzilla.suse.com/show_bug.cgi?id=1144621 bsc#1144621
  https://bugs.ghostscript.com/show_bug.cgi?id=701394</changelog>
  <changelog author="werner@suse.de" date="1568376000">- Add patch openjpeg4gs-CVE-2018-6616-8ee33522.patch
  to fix bsc#1140359 for CVE-2019-12973</changelog>
  <changelog author="werner@suse.de" date="1568635200">- Add patch gs-CVE-2019-14811-885444fc.patch to fix bsc#1146882
  for CVE-2019-14811,CVE-2019-14812,CVE-2019-14813
- Add patch gs-CVE-2019-14817-cd1b1cac.patch to fix bsc#1146884
  for CVE-2019-14817</changelog>
  <changelog author="werner@suse.de" date="1568635201">- Port latest ghostscript 9.27 from factory including latest
  security patches to SLES15/SLES12
  * Port patch CVE-2019-10216.patch to 9.27 which is the orignal
    upstream commit now
  * Drop patch CVE-2019-3838.patch as now part of 9.27</changelog>
  <changelog author="jsmeix@suse.de" date="1573473600">- CVE-2019-14869.patch contains commit from Ghostscript upstream
  https://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=485904772c5f
  to fix CVE-2019-14869 "-dSAFER escape in .charkeys"
  (bsc#1156275)</changelog>
  <changelog author="jsmeix@suse.de" date="1588075200">- The version upgrade to 9.52 fixes in particular
  CVE-2020-12268: jbic2dec: heap-based buffer overflow
  in jbig2_image_compose (bsc#1170603)
- Version upgrade to 9.52
  Highlights in this release include:
  * The 9.52 release replaces the 9.51 release after a problem
    was reported with 9.51 which warranted the quick turnaround.
    Thus, like 9.51, 9.52 is primarily a maintenance release,
    consolidating the changes we introduced in 9.50.
  * IMPORTANT: We have forked LittleCMS2 into LittleCMS2mt
    (the "mt" indicating "multi-thread").
    LCMS2 is not thread-safe, and cannot be made thread-safe
    without breaking the ABI. Our fork will be thread-safe and
    include performance enhancements (these changes have all
    been offered and rejected upstream). We will maintain
    compatibility between Ghostscript and LCMS2 for a time,
    but not in perpetuity. If there is sufficient interest,
    our fork will be available as its own package separately
    from Ghostscript (and MuPDF).
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  Incompatible changes:
  * New option -dALLOWPSTRANSPARENCY: The transparency compositor
    (and related features), whilst we are improving it, remains
    sensitive to being driven correctly, and incorrect use
    can have unexpected/undefined results. Hence, as part of
    improving security, we limited access to these operators,
    originally using the -dSAFER feature. As we made "SAFER"
    the default mode, that became unacceptable, hence the
    new option -dALLOWPSTRANSPARENCY which enables access
    to the operators, cf.
    https://www.ghostscript.com/doc/9.52/Use.htm#ALLOWPSTRANSPARENCY
  For a release summary see:
  https://www.ghostscript.com/doc/9.52/News.htm
  For details see the News.htm and History9.htm files.
- Version upgrade to 9.51
  Highlights in this release include:
  * 9.51 is primarily a maintainance release, consolidating
    the changes we introduced in 9.50.
  * We have continued our work on code hygiene for this release,
    with a focus on the static analysis tool Coverity
    (from Synopsys, Inc) and we are now maintaining a policy of
    zero Coverity issues in the Ghostscript/GhostPDL source base.
  * IMPORTANT: In consultation with a representative of
    OpenPrinting (http://www.openprinting.org/) it is our
    intention to deprecate and, in the not distant future,
    remove the OpenPrinting Vector/Raster Printer Drivers
    (that is, the opvp and oprp devices).
    If you rely on either of these devices, please get in touch
    with us (i.e. Ghostscript upstream), so we can discuss your
    use case, and revise our plans accordingly.
  * We (i.e. Ghostscript upstream) are in the process of forking
    LittleCMS, cf. the other release notes entries below.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  For a release summary see:
  https://www.ghostscript.com/doc/9.51/News.htm
  For details see the News.htm and History9.htm files.
- Version upgrade to 9.50
  Highlights in this release include:
  * The change to version 9.50 follows recognition
    of the extent and importance of the file access control
    redesign/reimplementation outlined below.
  * The file access control capability (enable with -dSAFER)
    has been completely rewritten, with a ground-up rethink
    of the design. For more details, see: "SAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#Safer
  * It is important to note that -dSAFER now only enables the
    file access controls, and no longer applies restrictions
    to standard Postscript functionality (specifically,
    restrictions on setpagedevice). If your application relies
    on these Postscript restrictions, see "OLDSAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#OldSafer
    and please get in touch, as we do plan to remove those
    Postscript restrictions unless we have reason not to.
  IMPORTANT: File access controls are now enabled by default.
    In order to run Ghostscript without these controls,
    see "NOSAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#NoSafer
  * We (i.e. Ghostscript upstream) are in the process of forking
    LittleCMS, cf. the other release notes entries below.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  Incompatible changes:
  * There are a couple of subtle incompatibilities between the old
    and new SAFER implementations. Firstly, as mentioned above,
    SAFER now leaves standard Postcript functionality unchanged
    (except for the file access limitations). Secondly, the
    interaction with save/restore operations, see "SAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#Safer
  * The following is not strictly speaking new to 9.50,
    as not much has changed since 9.27 in this area,
    but for those who don't upgrade with every release:
    The process of "tidying" the Postscript name space should have
    removed only non-standard and undocumented operators.
    Nevertheless, it is possible that any integrations or utilities
    that rely on those non-standard and undocumented operators
    may stop working, or may change behaviour.
    If you encounter such a case, please contact us
    (i.e. Ghostscript upstream, either the #ghostscript IRC channel
    or the gs-devel mailing list would be best), and we'll work
    with you to either find an alternative solution or return the
    previous functionality, if there is genuinely no other option.
    One case we know this has occurred is GSView 5 (and earlier).
    GSView 5 support for PDF files relied upon internal use only
    features which are no longer available. GSView 5 will still
    work as previously for Postscript files. For PDF files,
    users are encouraged to look at MuPDF https://www.mupdf.com/
  For a release summary see:
  https://www.ghostscript.com/doc/9.50/News.htm
  For details see the News.htm and History9.htm files.
- CVE-2019-10216.patch CVE-2019-14869.patch
  gs-CVE-2019-14811-885444fc.patch
  gs-CVE-2019-14817-cd1b1cac.patch
  openjpeg4gs-CVE-2018-6616-8ee33522.patch
  are fixed in the version 9.52 upstream sources.</changelog>
  <changelog author="jsmeix@suse.de" date="1595851200">- CVE-2020-15900.patch fixes CVE-2020-15900
  Memory Corruption (SAFER Sandbox Breakout)
  cf. https://bugs.ghostscript.com/show_bug.cgi?id=702582
  (bsc#1174415)</changelog>
  <changelog author="wolfgang.frisch@suse.com" date="1619006400">- Hardening: link as position independent executable (bsc#1184123).</changelog>
  <changelog author="jsmeix@suse.de" date="1631275200">- CVE-2021-3781.patch fixes CVE-2021-3781
  Trivial -dSAFER bypass
  cf. https://bugs.ghostscript.com/show_bug.cgi?id=704342
  (bsc#1190381)</changelog>
  <changelog author="werner@suse.de" date="1632916800">- Use update-alternatives to get the real ghostscript binary from
  /usr/bin/gs to /usr/bin/gs.bin and allow the gswrap package to
  use this with its wrapper script (jira#PM-3037)</changelog>
  <changelog author="jsmeix@suse.de" date="1641902400">- CVE-2021-45944.patch fixes CVE-2021-45944
  use-after-free in sampled_data_sample
  cf. https://github.com/google/oss-fuzz-vulns/blob/main/vulns/ghostscript/OSV-2021-237.yaml
  (bsc#1194303)
- CVE-2021-45949.patch fixes CVE-2021-45949
  heap-based buffer overflow in sampled_data_finish
  cf. https://github.com/google/oss-fuzz-vulns/blob/main/vulns/ghostscript/OSV-2021-803.yaml
  (bsc#1194304)</changelog>
</package>
<package pkgid="458c9a1b864e176dd3f93fb331adf864055696c5565c4687871bc47488dfd71c" name="ghostscript-x11" arch="ppc64le">
  <version epoch="0" ver="9.52" rel="161.1"/>
  <changelog author="jsmeix@suse.de" date="1528200000">- CVE-2018-10194.patch fixes stack-based buffer overflow
  in gdevpdts.c (bsc#1090099), see
  https://bugs.ghostscript.com/show_bug.cgi?id=699255 and
  http://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=39b1e54b2968620723bf32e96764c88797714879</changelog>
  <changelog author="jsmeix@suse.de" date="1536840000">- Version upgrade to 9.24
  Highlights in this release include:
  * Security issues have been the primary focus of this release,
    including solving several (well publicised)
    real and potential exploits.
    PLEASE NOTE:
    We (i.e. Ghostscript upstream) strongly urge users to upgrade
    to this latest release to avoid these issues.
  * As well as Ghostscript itself, jbig2dec has had a significant
    amount of work improving its robustness in the face of
    out specification files.
  * IMPORTANT: We (i.e. Ghostscript upstream) are in the process
    of forking LittleCMS. LCMS2 is not thread safe, and cannot
    be made thread safe without breaking the ABI. Our fork
    will be thread safe, and include performance enhancements
    (these changes have all be been offered and rejected upstream).
    We will maintain compatibility between Ghostscript and LCMS2
    for a time, but not in perpetuity. Our fork will be available
    as its own package separately from Ghostscript (and MuPDF).
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  For a release summary see:
  http://www.ghostscript.com/doc/9.24/News.htm
  For details see the News.htm and History9.htm files.
- fix_ln_docdir_gsdatadir.patch is no longer needed
  because the issue is fixed in the upstream sources.
- CVE-2018-10194.patch is no longer needed
  because the issue is fixed in the upstream sources.</changelog>
  <changelog author="jsmeix@suse.de" date="1536840001">- Version upgrade to 9.25rc1 (first release candidate for 9.25).
  Highlights in this release include:
  * This release fixes problems with argument handling, some
    unintended results of the security fixes to the SAFER file
    access restrictions (specifically accessing ICC profile files),
    and some additional security issues over the 9.24 release.
  * Security issues have been the primary focus of this release,
    including solving several (well publicised) real
    and potential exploits.
    PLEASE NOTE:
    We (i.e. Ghostscript upstream) strongly urge users to upgrade
    to this latest release to avoid these issues.
  * Avoid that ps2epsi fails with
    'Error: /undefined in --setpagedevice--'
    Recent changes required to harden SAFER mode mean that
    it is no longer possible to run ps2epsi in SAFER mode,
    because it relies upon unsafe Ghostscript non-standard
    extension operators.
    Removing SAFER and DELAYSAFER, and the code to reset SAFER,
    allow ps2epsi to run as well as it ever did (ie badly).
    This program (i.e. ps2epsi) should now be considered unsafe,
    you should not use it on untrusted PostScript programs.
    Likely we (i.e. Ghostscript upstream) will deprecate and
    remove this program in future.
  For details see the News.htm and History9.htm files.
  Regarding installing packages (in particular release candidates)
  from the openSUSE build service development project "Printing"
  see https://build.opensuse.org/project/show/Printing</changelog>
  <changelog author="jsmeix@suse.de" date="1536926400">- Version upgrade to 9.25
  For the highlights in this release see the highlights in the
  9.25rc1 first release candidate for 9.25 entry below.
  PLEASE NOTE:
  We (i.e. Ghostscript upstream) strongly urge users to upgrade
  to this latest release to avoid these issues.
  For a release summary see:
  http://www.ghostscript.com/doc/9.25/News.htm
  For details see the News.htm and History9.htm files.
  The Ghostscript 9.25 release should fix (see below)
  in particular those security issues:
  * CVE-2018-15909: shading_param incomplete type checking
    https://bugs.ghostscript.com/show_bug.cgi?id=699660
    https://bugzilla.suse.com/show_bug.cgi?id=1106172 bsc#1106172
  * CVE-2018-15908: .tempfile file permission issues
    https://bugs.ghostscript.com/show_bug.cgi?id=699657
    https://bugzilla.suse.com/show_bug.cgi?id=1106171 bsc#1106171
  * CVE-2018-15910: LockDistillerParams type confusion
    https://bugs.ghostscript.com/show_bug.cgi?id=699656
    https://bugzilla.suse.com/show_bug.cgi?id=1106173 bsc#1106173
  * CVE-2018-15911: uninitialized memory access in the aesdecode
    https://bugs.ghostscript.com/show_bug.cgi?id=699665
    https://bugzilla.suse.com/show_bug.cgi?id=1106195 bsc#1106195
  * CVE-2018-16513: setcolor missing type check
    https://bugs.ghostscript.com/show_bug.cgi?id=699655
    https://bugzilla.suse.com/show_bug.cgi?id=1107412 bsc#1107412
  * CVE-2018-16509: /invalidaccess bypass after failed restore
    https://bugs.ghostscript.com/show_bug.cgi?id=699654
    https://bugzilla.suse.com/show_bug.cgi?id=1107410 bsc#1107410
  * CVE-2018-16510: Incorrect exec stack handling in the "CS"
    and "SC" PDF primitives
    https://bugs.ghostscript.com/show_bug.cgi?id=699671
    https://bugzilla.suse.com/show_bug.cgi?id=1107411 bsc#1107411
  * CVE-2018-16542: .definemodifiedfont memory corruption
    if /typecheck is handled
    https://bugs.ghostscript.com/show_bug.cgi?id=699668
    https://bugzilla.suse.com/show_bug.cgi?id=1107413 bsc#1107413
  * CVE-2018-16541 incorrect free logic in pagedevice replacement
    https://bugs.ghostscript.com/show_bug.cgi?id=699664
    https://bugzilla.suse.com/show_bug.cgi?id=1107421 bsc#1107421
  * CVE-2018-16540 use-after-free in copydevice handling
    https://bugs.ghostscript.com/show_bug.cgi?id=699661
    https://bugzilla.suse.com/show_bug.cgi?id=1107420 bsc#1107420
  * CVE-2018-16539: incorrect access checking in temp file
    handling to disclose contents of files
    https://bugs.ghostscript.com/show_bug.cgi?id=699658
    https://bugzilla.suse.com/show_bug.cgi?id=1107422 bsc#1107422
  * CVE-2018-16543: gssetresolution and gsgetresolution allow
    for unspecified impact
    https://bugs.ghostscript.com/show_bug.cgi?id=699670
    https://bugzilla.suse.com/show_bug.cgi?id=1107423 bsc#1107423
  * CVE-2018-16511: type confusion in "ztype" could be used by
    remote attackers able to supply crafted PostScript to crash
    the interpreter or possibly have unspecified other impact
    https://bugs.ghostscript.com/show_bug.cgi?id=699659
    https://bugzilla.suse.com/show_bug.cgi?id=1107426 bsc#1107426
  * CVE-2018-16585 .setdistillerkeys PostScript command is
    accepted even though it is not intended for use
    https://bugzilla.suse.com/show_bug.cgi?id=1107581 bsc#1107581
  * CVE-2018-16802: Incorrect"restoration of privilege" checking
    when running out of stack during exceptionhandling could be
    used by attackers able to supply crafted PostScript to execute
    code using the "pipe" instruction. This is due to an incomplete
    fix for CVE-2018-16509
    https://bugs.ghostscript.com/show_bug.cgi?id=699714
    https://bugs.ghostscript.com/show_bug.cgi?id=699718
    https://bugzilla.suse.com/show_bug.cgi?id=1108027 bnc#1108027
  Regarding what the above "should fix" means:
  PostScript is a general purpose Turing-complete programming
  language (cf. https://en.wikipedia.org/wiki/PostScript)
  that supports in particular file access on the system disk.
  When Ghostscript processes PostScript it runs a PostScript
  program as the user who runs Ghostscript.
  When Ghostscript processes an arbitrary PostScript file,
  the user who runs Ghostscript runs an arbitrary program
  which can do anything on the system where Ghostscript runs
  that this user is allowed to do on that system.
  To make it safer when Ghostscript runs a PostScript program
  the Ghostscript command line option '-dSAFER' disables
  certain file access functionality, for details see
  /usr/share/doc/ghostscript/9.25/Use.htm
  Its name 'SAFER' says everything: It makes it 'safer'
  to let Ghostscript run a PostScript program,
  but it does not make it completely safe.
  In theory software is safe against misuse (i.e. has no bugs).
  In practice there is an endless sequence of various kind of
  security issues (i.e. software can be misused to do more than
  what is intended) that get fixed issue by issue ad infinitum.
  In the end all that means:
  In practice the user who runs Ghostscript must not let it
  process arbitrary PostScript files from untrusted origin.
  In particular Ghostscript is usually run when printing
  documents (with the '-dSAFER' option set), see the part about
  "It is crucial to limit access to CUPS to trusted users" in
  https://en.opensuse.org/SDB:CUPS_and_SANE_Firewall_settings</changelog>
  <changelog author="jsmeix@suse.de" date="1541764800">- Version upgrade to 9.26rc1 (first release candidate for 9.26).
  Highlights in this release include:
  * Purely security and a few bug fixes, there are no new features,
    and no API changes to report.</changelog>
  <changelog author="jsmeix@suse.de" date="1543579200">- Version upgrade to 9.26
  Highlights in this release include:
  * Security issues have been the primary focus of this release,
    including solving several (well publicised) real and potential
    exploits.
    Thanks to Man Yue Mo of Semmle Security Research Team,
    Jens Mueller of Ruhr-Universitaet Bochum and
    Tavis Ormandy of Google's Project Zero
    for their help to identify specific security issues.
    PLEASE NOTE:
    We (i.e. Ghostscript upstream) strongly urge users to upgrade
    to this latest release to avoid these issues.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  For a release summary see:
  http://www.ghostscript.com/doc/9.26/News.htm
  For details see the News.htm and History9.htm files.
  The Ghostscript 9.26 release should fix (cf. the entry below
  dated 'Fri Sep 14 10:47:33 CEST 2018' what "should fix" means)
  in particular those security issues (bsc#1117331)
  * CVE-2018-19475: psi/zdevice2.c allows attackers to bypass
    intended access restrictions
    https://bugs.ghostscript.com/show_bug.cgi?id=700153
    https://bugzilla.suse.com/show_bug.cgi?id=1117327 bsc#1117327
  * CVE-2018-19476: psi/zicc.c allows attackers to bypass
    intended access restrictions because of a setcolorspace
    type confusion
    https://bugs.ghostscript.com/show_bug.cgi?id=700169
    https://bugzilla.suse.com/show_bug.cgi?id=1117313 bsc#1117313
  * CVE-2018-19477: psi/zfjbig2.c allows attackers to bypass
    intended access restrictions because of a JBIG2Decode
    type confusion
    https://bugs.ghostscript.com/show_bug.cgi?id=700168
    https://bugzilla.suse.com/show_bug.cgi?id=1117274 bsc#1117274
  * CVE-2018-19409: LockSafetyParams is not checked correctly
    if another device is used
    https://bugs.ghostscript.com/show_bug.cgi?id=700176
    https://bugzilla.suse.com/show_bug.cgi?id=1117022 bsc#1117022
  and those security issues
  * CVE-2018-18284: 1Policy operator gives access to .forceput
    https://bugs.ghostscript.com/show_bug.cgi?id=69963
    https://bugzilla.suse.com/show_bug.cgi?id=1112229 bsc#1112229
  * CVE-2018-18073: saved execution stacks can leak operator arrays
    https://bugs.ghostscript.com/show_bug.cgi?id=699927
    https://bugzilla.suse.com/show_bug.cgi?id=1111480 bsc#1111480
  * CVE-2018-17961: bypassing executeonly to escape -dSAFER sandbox
    https://bugs.ghostscript.com/show_bug.cgi?id=699816
    https://bugzilla.suse.com/show_bug.cgi?id=1111479 bsc#1111479
  * CVE-2018-17183: remote attackers could be able to supply
    crafted PostScript to potentially overwrite or replace
    error handlers to inject code
    https://bugs.ghostscript.com/show_bug.cgi?id=699708
    https://bugzilla.suse.com/show_bug.cgi?id=1109105 bsc#1109105</changelog>
  <changelog author="jsmeix@suse.de" date="1547726400">- Version upgrade to 9.26a
  The version 9.26a is a special security bugfix version to fix
  * CVE-2019-6116: subroutines within pseudo-operators
    must themselves be pseudo-operators
    https://bugs.ghostscript.com/show_bug.cgi?id=700317
    https://bugzilla.suse.com/show_bug.cgi?id=1122319 bsc#1122319</changelog>
  <changelog author="jsmeix@suse.de" date="1552996800">- CVE-2019-3838.patch fixes CVE-2019-3838
  forceput in DefineResource is still accessible
  https://bugzilla.suse.com/show_bug.cgi?id=1129186 bsc#1129186
  https://bugs.ghostscript.com/show_bug.cgi?id=700576</changelog>
  <changelog author="jsmeix@suse.de" date="1554379200">- Version upgrade to 9.27
  Highlights in this release include:
  * We (i.e. Ghostscript upstream) have extensively cleaned up
    the Postscript name space: removing access to internal and/or
    undocumented Postscript operators, procedures and data.
    This has benefits for security and maintainability.
    Incompatible changes:
    The process of "tidying" the Postscript name space should
    have removed only non-standard and undocumented operators.
    Nevertheless, it is possible that any integrations or
    utilities that rely on those non-standard and undocumented
    operators may stop working, or may change behaviour.
    If you encounter such a case, please contact us (i.e.
    Ghostscript upstream) - (either the #ghostscript IRC channel,
    or the gs-devel mailing list would be best), and we'll work
    with you to either find an alternative solution.
  * Fontmap can now reference invidual fonts in a TrueType
    Collection for font subsitution. Previously, a Fontmap entry
    could only reference a TrueType collection and use the default
    (first) font.
    Now, the Fontmap syntax allows for specifying a specific index
    in a TTC. See the comments at the top of (the default)
    Fontmap.GS for details.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  IMPORTANT: It is our intention, within the next 12 months
    (ideally sooner, in time for the next release) to make SAFER
    the default mode of operation. For many users this will have
    no effect, since they use SAFER explicitly, but some niche
    uses which rely on SAFER being disabled may need to start
    explicitly adding the "-dNOSAFER" option.
  IMPORTANT: We (i.e. Ghostscript upstream) are in the process of
    forking LittleCMS. LCMS2 is not thread safe, and cannot be made
    thread safe without breaking the ABI. Our fork will be thread
    safe, and include performance enhancements (these changes have
    all be been offered and rejected upstream). We will maintain
    compatibility between Ghostscript and LCMS2 for a time, but not
    in perpetuity. Our fork will be available as its own package
    separately from Ghostscript (and MuPDF).
  For a release summary see:
  http://www.ghostscript.com/doc/9.27/News.htm
  For details see the News.htm and History9.htm files.
  The Ghostscript 9.27 release should fix (cf. the entry below
  dated 'Fri Sep 14 10:47:33 CEST 2018' what "should fix" means)
  in particular those security issues:
  * CVE-2019-3838 forceput in DefineResource is still accessible
    https://bugzilla.suse.com/show_bug.cgi?id=1129186 bsc#1129186
    https://bugs.ghostscript.com/show_bug.cgi?id=700576
  * CVE-2019-3835: superexec operator is available
    https://bugzilla.suse.com/show_bug.cgi?id=1129180 bsc#1129180
    https://bugs.ghostscript.com/show_bug.cgi?id=700585</changelog>
  <changelog author="werner@suse.de" date="1565611200">- CVE-2019-10216.patch fixes CVE-2019-10216
  forceput/superexec in .buildfont1 is still accessible
  https://bugzilla.suse.com/show_bug.cgi?id=1144621 bsc#1144621
  https://bugs.ghostscript.com/show_bug.cgi?id=701394</changelog>
  <changelog author="werner@suse.de" date="1568376000">- Add patch openjpeg4gs-CVE-2018-6616-8ee33522.patch
  to fix bsc#1140359 for CVE-2019-12973</changelog>
  <changelog author="werner@suse.de" date="1568635200">- Add patch gs-CVE-2019-14811-885444fc.patch to fix bsc#1146882
  for CVE-2019-14811,CVE-2019-14812,CVE-2019-14813
- Add patch gs-CVE-2019-14817-cd1b1cac.patch to fix bsc#1146884
  for CVE-2019-14817</changelog>
  <changelog author="werner@suse.de" date="1568635201">- Port latest ghostscript 9.27 from factory including latest
  security patches to SLES15/SLES12
  * Port patch CVE-2019-10216.patch to 9.27 which is the orignal
    upstream commit now
  * Drop patch CVE-2019-3838.patch as now part of 9.27</changelog>
  <changelog author="jsmeix@suse.de" date="1573473600">- CVE-2019-14869.patch contains commit from Ghostscript upstream
  https://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=485904772c5f
  to fix CVE-2019-14869 "-dSAFER escape in .charkeys"
  (bsc#1156275)</changelog>
  <changelog author="jsmeix@suse.de" date="1588075200">- The version upgrade to 9.52 fixes in particular
  CVE-2020-12268: jbic2dec: heap-based buffer overflow
  in jbig2_image_compose (bsc#1170603)
- Version upgrade to 9.52
  Highlights in this release include:
  * The 9.52 release replaces the 9.51 release after a problem
    was reported with 9.51 which warranted the quick turnaround.
    Thus, like 9.51, 9.52 is primarily a maintenance release,
    consolidating the changes we introduced in 9.50.
  * IMPORTANT: We have forked LittleCMS2 into LittleCMS2mt
    (the "mt" indicating "multi-thread").
    LCMS2 is not thread-safe, and cannot be made thread-safe
    without breaking the ABI. Our fork will be thread-safe and
    include performance enhancements (these changes have all
    been offered and rejected upstream). We will maintain
    compatibility between Ghostscript and LCMS2 for a time,
    but not in perpetuity. If there is sufficient interest,
    our fork will be available as its own package separately
    from Ghostscript (and MuPDF).
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  Incompatible changes:
  * New option -dALLOWPSTRANSPARENCY: The transparency compositor
    (and related features), whilst we are improving it, remains
    sensitive to being driven correctly, and incorrect use
    can have unexpected/undefined results. Hence, as part of
    improving security, we limited access to these operators,
    originally using the -dSAFER feature. As we made "SAFER"
    the default mode, that became unacceptable, hence the
    new option -dALLOWPSTRANSPARENCY which enables access
    to the operators, cf.
    https://www.ghostscript.com/doc/9.52/Use.htm#ALLOWPSTRANSPARENCY
  For a release summary see:
  https://www.ghostscript.com/doc/9.52/News.htm
  For details see the News.htm and History9.htm files.
- Version upgrade to 9.51
  Highlights in this release include:
  * 9.51 is primarily a maintainance release, consolidating
    the changes we introduced in 9.50.
  * We have continued our work on code hygiene for this release,
    with a focus on the static analysis tool Coverity
    (from Synopsys, Inc) and we are now maintaining a policy of
    zero Coverity issues in the Ghostscript/GhostPDL source base.
  * IMPORTANT: In consultation with a representative of
    OpenPrinting (http://www.openprinting.org/) it is our
    intention to deprecate and, in the not distant future,
    remove the OpenPrinting Vector/Raster Printer Drivers
    (that is, the opvp and oprp devices).
    If you rely on either of these devices, please get in touch
    with us (i.e. Ghostscript upstream), so we can discuss your
    use case, and revise our plans accordingly.
  * We (i.e. Ghostscript upstream) are in the process of forking
    LittleCMS, cf. the other release notes entries below.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  For a release summary see:
  https://www.ghostscript.com/doc/9.51/News.htm
  For details see the News.htm and History9.htm files.
- Version upgrade to 9.50
  Highlights in this release include:
  * The change to version 9.50 follows recognition
    of the extent and importance of the file access control
    redesign/reimplementation outlined below.
  * The file access control capability (enable with -dSAFER)
    has been completely rewritten, with a ground-up rethink
    of the design. For more details, see: "SAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#Safer
  * It is important to note that -dSAFER now only enables the
    file access controls, and no longer applies restrictions
    to standard Postscript functionality (specifically,
    restrictions on setpagedevice). If your application relies
    on these Postscript restrictions, see "OLDSAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#OldSafer
    and please get in touch, as we do plan to remove those
    Postscript restrictions unless we have reason not to.
  IMPORTANT: File access controls are now enabled by default.
    In order to run Ghostscript without these controls,
    see "NOSAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#NoSafer
  * We (i.e. Ghostscript upstream) are in the process of forking
    LittleCMS, cf. the other release notes entries below.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  Incompatible changes:
  * There are a couple of subtle incompatibilities between the old
    and new SAFER implementations. Firstly, as mentioned above,
    SAFER now leaves standard Postcript functionality unchanged
    (except for the file access limitations). Secondly, the
    interaction with save/restore operations, see "SAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#Safer
  * The following is not strictly speaking new to 9.50,
    as not much has changed since 9.27 in this area,
    but for those who don't upgrade with every release:
    The process of "tidying" the Postscript name space should have
    removed only non-standard and undocumented operators.
    Nevertheless, it is possible that any integrations or utilities
    that rely on those non-standard and undocumented operators
    may stop working, or may change behaviour.
    If you encounter such a case, please contact us
    (i.e. Ghostscript upstream, either the #ghostscript IRC channel
    or the gs-devel mailing list would be best), and we'll work
    with you to either find an alternative solution or return the
    previous functionality, if there is genuinely no other option.
    One case we know this has occurred is GSView 5 (and earlier).
    GSView 5 support for PDF files relied upon internal use only
    features which are no longer available. GSView 5 will still
    work as previously for Postscript files. For PDF files,
    users are encouraged to look at MuPDF https://www.mupdf.com/
  For a release summary see:
  https://www.ghostscript.com/doc/9.50/News.htm
  For details see the News.htm and History9.htm files.
- CVE-2019-10216.patch CVE-2019-14869.patch
  gs-CVE-2019-14811-885444fc.patch
  gs-CVE-2019-14817-cd1b1cac.patch
  openjpeg4gs-CVE-2018-6616-8ee33522.patch
  are fixed in the version 9.52 upstream sources.</changelog>
  <changelog author="jsmeix@suse.de" date="1595851200">- CVE-2020-15900.patch fixes CVE-2020-15900
  Memory Corruption (SAFER Sandbox Breakout)
  cf. https://bugs.ghostscript.com/show_bug.cgi?id=702582
  (bsc#1174415)</changelog>
  <changelog author="wolfgang.frisch@suse.com" date="1619006400">- Hardening: link as position independent executable (bsc#1184123).</changelog>
  <changelog author="jsmeix@suse.de" date="1631275200">- CVE-2021-3781.patch fixes CVE-2021-3781
  Trivial -dSAFER bypass
  cf. https://bugs.ghostscript.com/show_bug.cgi?id=704342
  (bsc#1190381)</changelog>
  <changelog author="werner@suse.de" date="1632916800">- Use update-alternatives to get the real ghostscript binary from
  /usr/bin/gs to /usr/bin/gs.bin and allow the gswrap package to
  use this with its wrapper script (jira#PM-3037)</changelog>
  <changelog author="jsmeix@suse.de" date="1641902400">- CVE-2021-45944.patch fixes CVE-2021-45944
  use-after-free in sampled_data_sample
  cf. https://github.com/google/oss-fuzz-vulns/blob/main/vulns/ghostscript/OSV-2021-237.yaml
  (bsc#1194303)
- CVE-2021-45949.patch fixes CVE-2021-45949
  heap-based buffer overflow in sampled_data_finish
  cf. https://github.com/google/oss-fuzz-vulns/blob/main/vulns/ghostscript/OSV-2021-803.yaml
  (bsc#1194304)</changelog>
</package>
<package pkgid="29cfe7ff8b758f55fefe8c3f104a5dfc703a7fe24811acb9d5143fbdb43cb847" name="ghostscript-x11" arch="s390x">
  <version epoch="0" ver="9.52" rel="161.1"/>
  <changelog author="jsmeix@suse.de" date="1528200000">- CVE-2018-10194.patch fixes stack-based buffer overflow
  in gdevpdts.c (bsc#1090099), see
  https://bugs.ghostscript.com/show_bug.cgi?id=699255 and
  http://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=39b1e54b2968620723bf32e96764c88797714879</changelog>
  <changelog author="jsmeix@suse.de" date="1536840000">- Version upgrade to 9.24
  Highlights in this release include:
  * Security issues have been the primary focus of this release,
    including solving several (well publicised)
    real and potential exploits.
    PLEASE NOTE:
    We (i.e. Ghostscript upstream) strongly urge users to upgrade
    to this latest release to avoid these issues.
  * As well as Ghostscript itself, jbig2dec has had a significant
    amount of work improving its robustness in the face of
    out specification files.
  * IMPORTANT: We (i.e. Ghostscript upstream) are in the process
    of forking LittleCMS. LCMS2 is not thread safe, and cannot
    be made thread safe without breaking the ABI. Our fork
    will be thread safe, and include performance enhancements
    (these changes have all be been offered and rejected upstream).
    We will maintain compatibility between Ghostscript and LCMS2
    for a time, but not in perpetuity. Our fork will be available
    as its own package separately from Ghostscript (and MuPDF).
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  For a release summary see:
  http://www.ghostscript.com/doc/9.24/News.htm
  For details see the News.htm and History9.htm files.
- fix_ln_docdir_gsdatadir.patch is no longer needed
  because the issue is fixed in the upstream sources.
- CVE-2018-10194.patch is no longer needed
  because the issue is fixed in the upstream sources.</changelog>
  <changelog author="jsmeix@suse.de" date="1536840001">- Version upgrade to 9.25rc1 (first release candidate for 9.25).
  Highlights in this release include:
  * This release fixes problems with argument handling, some
    unintended results of the security fixes to the SAFER file
    access restrictions (specifically accessing ICC profile files),
    and some additional security issues over the 9.24 release.
  * Security issues have been the primary focus of this release,
    including solving several (well publicised) real
    and potential exploits.
    PLEASE NOTE:
    We (i.e. Ghostscript upstream) strongly urge users to upgrade
    to this latest release to avoid these issues.
  * Avoid that ps2epsi fails with
    'Error: /undefined in --setpagedevice--'
    Recent changes required to harden SAFER mode mean that
    it is no longer possible to run ps2epsi in SAFER mode,
    because it relies upon unsafe Ghostscript non-standard
    extension operators.
    Removing SAFER and DELAYSAFER, and the code to reset SAFER,
    allow ps2epsi to run as well as it ever did (ie badly).
    This program (i.e. ps2epsi) should now be considered unsafe,
    you should not use it on untrusted PostScript programs.
    Likely we (i.e. Ghostscript upstream) will deprecate and
    remove this program in future.
  For details see the News.htm and History9.htm files.
  Regarding installing packages (in particular release candidates)
  from the openSUSE build service development project "Printing"
  see https://build.opensuse.org/project/show/Printing</changelog>
  <changelog author="jsmeix@suse.de" date="1536926400">- Version upgrade to 9.25
  For the highlights in this release see the highlights in the
  9.25rc1 first release candidate for 9.25 entry below.
  PLEASE NOTE:
  We (i.e. Ghostscript upstream) strongly urge users to upgrade
  to this latest release to avoid these issues.
  For a release summary see:
  http://www.ghostscript.com/doc/9.25/News.htm
  For details see the News.htm and History9.htm files.
  The Ghostscript 9.25 release should fix (see below)
  in particular those security issues:
  * CVE-2018-15909: shading_param incomplete type checking
    https://bugs.ghostscript.com/show_bug.cgi?id=699660
    https://bugzilla.suse.com/show_bug.cgi?id=1106172 bsc#1106172
  * CVE-2018-15908: .tempfile file permission issues
    https://bugs.ghostscript.com/show_bug.cgi?id=699657
    https://bugzilla.suse.com/show_bug.cgi?id=1106171 bsc#1106171
  * CVE-2018-15910: LockDistillerParams type confusion
    https://bugs.ghostscript.com/show_bug.cgi?id=699656
    https://bugzilla.suse.com/show_bug.cgi?id=1106173 bsc#1106173
  * CVE-2018-15911: uninitialized memory access in the aesdecode
    https://bugs.ghostscript.com/show_bug.cgi?id=699665
    https://bugzilla.suse.com/show_bug.cgi?id=1106195 bsc#1106195
  * CVE-2018-16513: setcolor missing type check
    https://bugs.ghostscript.com/show_bug.cgi?id=699655
    https://bugzilla.suse.com/show_bug.cgi?id=1107412 bsc#1107412
  * CVE-2018-16509: /invalidaccess bypass after failed restore
    https://bugs.ghostscript.com/show_bug.cgi?id=699654
    https://bugzilla.suse.com/show_bug.cgi?id=1107410 bsc#1107410
  * CVE-2018-16510: Incorrect exec stack handling in the "CS"
    and "SC" PDF primitives
    https://bugs.ghostscript.com/show_bug.cgi?id=699671
    https://bugzilla.suse.com/show_bug.cgi?id=1107411 bsc#1107411
  * CVE-2018-16542: .definemodifiedfont memory corruption
    if /typecheck is handled
    https://bugs.ghostscript.com/show_bug.cgi?id=699668
    https://bugzilla.suse.com/show_bug.cgi?id=1107413 bsc#1107413
  * CVE-2018-16541 incorrect free logic in pagedevice replacement
    https://bugs.ghostscript.com/show_bug.cgi?id=699664
    https://bugzilla.suse.com/show_bug.cgi?id=1107421 bsc#1107421
  * CVE-2018-16540 use-after-free in copydevice handling
    https://bugs.ghostscript.com/show_bug.cgi?id=699661
    https://bugzilla.suse.com/show_bug.cgi?id=1107420 bsc#1107420
  * CVE-2018-16539: incorrect access checking in temp file
    handling to disclose contents of files
    https://bugs.ghostscript.com/show_bug.cgi?id=699658
    https://bugzilla.suse.com/show_bug.cgi?id=1107422 bsc#1107422
  * CVE-2018-16543: gssetresolution and gsgetresolution allow
    for unspecified impact
    https://bugs.ghostscript.com/show_bug.cgi?id=699670
    https://bugzilla.suse.com/show_bug.cgi?id=1107423 bsc#1107423
  * CVE-2018-16511: type confusion in "ztype" could be used by
    remote attackers able to supply crafted PostScript to crash
    the interpreter or possibly have unspecified other impact
    https://bugs.ghostscript.com/show_bug.cgi?id=699659
    https://bugzilla.suse.com/show_bug.cgi?id=1107426 bsc#1107426
  * CVE-2018-16585 .setdistillerkeys PostScript command is
    accepted even though it is not intended for use
    https://bugzilla.suse.com/show_bug.cgi?id=1107581 bsc#1107581
  * CVE-2018-16802: Incorrect"restoration of privilege" checking
    when running out of stack during exceptionhandling could be
    used by attackers able to supply crafted PostScript to execute
    code using the "pipe" instruction. This is due to an incomplete
    fix for CVE-2018-16509
    https://bugs.ghostscript.com/show_bug.cgi?id=699714
    https://bugs.ghostscript.com/show_bug.cgi?id=699718
    https://bugzilla.suse.com/show_bug.cgi?id=1108027 bnc#1108027
  Regarding what the above "should fix" means:
  PostScript is a general purpose Turing-complete programming
  language (cf. https://en.wikipedia.org/wiki/PostScript)
  that supports in particular file access on the system disk.
  When Ghostscript processes PostScript it runs a PostScript
  program as the user who runs Ghostscript.
  When Ghostscript processes an arbitrary PostScript file,
  the user who runs Ghostscript runs an arbitrary program
  which can do anything on the system where Ghostscript runs
  that this user is allowed to do on that system.
  To make it safer when Ghostscript runs a PostScript program
  the Ghostscript command line option '-dSAFER' disables
  certain file access functionality, for details see
  /usr/share/doc/ghostscript/9.25/Use.htm
  Its name 'SAFER' says everything: It makes it 'safer'
  to let Ghostscript run a PostScript program,
  but it does not make it completely safe.
  In theory software is safe against misuse (i.e. has no bugs).
  In practice there is an endless sequence of various kind of
  security issues (i.e. software can be misused to do more than
  what is intended) that get fixed issue by issue ad infinitum.
  In the end all that means:
  In practice the user who runs Ghostscript must not let it
  process arbitrary PostScript files from untrusted origin.
  In particular Ghostscript is usually run when printing
  documents (with the '-dSAFER' option set), see the part about
  "It is crucial to limit access to CUPS to trusted users" in
  https://en.opensuse.org/SDB:CUPS_and_SANE_Firewall_settings</changelog>
  <changelog author="jsmeix@suse.de" date="1541764800">- Version upgrade to 9.26rc1 (first release candidate for 9.26).
  Highlights in this release include:
  * Purely security and a few bug fixes, there are no new features,
    and no API changes to report.</changelog>
  <changelog author="jsmeix@suse.de" date="1543579200">- Version upgrade to 9.26
  Highlights in this release include:
  * Security issues have been the primary focus of this release,
    including solving several (well publicised) real and potential
    exploits.
    Thanks to Man Yue Mo of Semmle Security Research Team,
    Jens Mueller of Ruhr-Universitaet Bochum and
    Tavis Ormandy of Google's Project Zero
    for their help to identify specific security issues.
    PLEASE NOTE:
    We (i.e. Ghostscript upstream) strongly urge users to upgrade
    to this latest release to avoid these issues.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  For a release summary see:
  http://www.ghostscript.com/doc/9.26/News.htm
  For details see the News.htm and History9.htm files.
  The Ghostscript 9.26 release should fix (cf. the entry below
  dated 'Fri Sep 14 10:47:33 CEST 2018' what "should fix" means)
  in particular those security issues (bsc#1117331)
  * CVE-2018-19475: psi/zdevice2.c allows attackers to bypass
    intended access restrictions
    https://bugs.ghostscript.com/show_bug.cgi?id=700153
    https://bugzilla.suse.com/show_bug.cgi?id=1117327 bsc#1117327
  * CVE-2018-19476: psi/zicc.c allows attackers to bypass
    intended access restrictions because of a setcolorspace
    type confusion
    https://bugs.ghostscript.com/show_bug.cgi?id=700169
    https://bugzilla.suse.com/show_bug.cgi?id=1117313 bsc#1117313
  * CVE-2018-19477: psi/zfjbig2.c allows attackers to bypass
    intended access restrictions because of a JBIG2Decode
    type confusion
    https://bugs.ghostscript.com/show_bug.cgi?id=700168
    https://bugzilla.suse.com/show_bug.cgi?id=1117274 bsc#1117274
  * CVE-2018-19409: LockSafetyParams is not checked correctly
    if another device is used
    https://bugs.ghostscript.com/show_bug.cgi?id=700176
    https://bugzilla.suse.com/show_bug.cgi?id=1117022 bsc#1117022
  and those security issues
  * CVE-2018-18284: 1Policy operator gives access to .forceput
    https://bugs.ghostscript.com/show_bug.cgi?id=69963
    https://bugzilla.suse.com/show_bug.cgi?id=1112229 bsc#1112229
  * CVE-2018-18073: saved execution stacks can leak operator arrays
    https://bugs.ghostscript.com/show_bug.cgi?id=699927
    https://bugzilla.suse.com/show_bug.cgi?id=1111480 bsc#1111480
  * CVE-2018-17961: bypassing executeonly to escape -dSAFER sandbox
    https://bugs.ghostscript.com/show_bug.cgi?id=699816
    https://bugzilla.suse.com/show_bug.cgi?id=1111479 bsc#1111479
  * CVE-2018-17183: remote attackers could be able to supply
    crafted PostScript to potentially overwrite or replace
    error handlers to inject code
    https://bugs.ghostscript.com/show_bug.cgi?id=699708
    https://bugzilla.suse.com/show_bug.cgi?id=1109105 bsc#1109105</changelog>
  <changelog author="jsmeix@suse.de" date="1547726400">- Version upgrade to 9.26a
  The version 9.26a is a special security bugfix version to fix
  * CVE-2019-6116: subroutines within pseudo-operators
    must themselves be pseudo-operators
    https://bugs.ghostscript.com/show_bug.cgi?id=700317
    https://bugzilla.suse.com/show_bug.cgi?id=1122319 bsc#1122319</changelog>
  <changelog author="jsmeix@suse.de" date="1552996800">- CVE-2019-3838.patch fixes CVE-2019-3838
  forceput in DefineResource is still accessible
  https://bugzilla.suse.com/show_bug.cgi?id=1129186 bsc#1129186
  https://bugs.ghostscript.com/show_bug.cgi?id=700576</changelog>
  <changelog author="jsmeix@suse.de" date="1554379200">- Version upgrade to 9.27
  Highlights in this release include:
  * We (i.e. Ghostscript upstream) have extensively cleaned up
    the Postscript name space: removing access to internal and/or
    undocumented Postscript operators, procedures and data.
    This has benefits for security and maintainability.
    Incompatible changes:
    The process of "tidying" the Postscript name space should
    have removed only non-standard and undocumented operators.
    Nevertheless, it is possible that any integrations or
    utilities that rely on those non-standard and undocumented
    operators may stop working, or may change behaviour.
    If you encounter such a case, please contact us (i.e.
    Ghostscript upstream) - (either the #ghostscript IRC channel,
    or the gs-devel mailing list would be best), and we'll work
    with you to either find an alternative solution.
  * Fontmap can now reference invidual fonts in a TrueType
    Collection for font subsitution. Previously, a Fontmap entry
    could only reference a TrueType collection and use the default
    (first) font.
    Now, the Fontmap syntax allows for specifying a specific index
    in a TTC. See the comments at the top of (the default)
    Fontmap.GS for details.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  IMPORTANT: It is our intention, within the next 12 months
    (ideally sooner, in time for the next release) to make SAFER
    the default mode of operation. For many users this will have
    no effect, since they use SAFER explicitly, but some niche
    uses which rely on SAFER being disabled may need to start
    explicitly adding the "-dNOSAFER" option.
  IMPORTANT: We (i.e. Ghostscript upstream) are in the process of
    forking LittleCMS. LCMS2 is not thread safe, and cannot be made
    thread safe without breaking the ABI. Our fork will be thread
    safe, and include performance enhancements (these changes have
    all be been offered and rejected upstream). We will maintain
    compatibility between Ghostscript and LCMS2 for a time, but not
    in perpetuity. Our fork will be available as its own package
    separately from Ghostscript (and MuPDF).
  For a release summary see:
  http://www.ghostscript.com/doc/9.27/News.htm
  For details see the News.htm and History9.htm files.
  The Ghostscript 9.27 release should fix (cf. the entry below
  dated 'Fri Sep 14 10:47:33 CEST 2018' what "should fix" means)
  in particular those security issues:
  * CVE-2019-3838 forceput in DefineResource is still accessible
    https://bugzilla.suse.com/show_bug.cgi?id=1129186 bsc#1129186
    https://bugs.ghostscript.com/show_bug.cgi?id=700576
  * CVE-2019-3835: superexec operator is available
    https://bugzilla.suse.com/show_bug.cgi?id=1129180 bsc#1129180
    https://bugs.ghostscript.com/show_bug.cgi?id=700585</changelog>
  <changelog author="werner@suse.de" date="1565611200">- CVE-2019-10216.patch fixes CVE-2019-10216
  forceput/superexec in .buildfont1 is still accessible
  https://bugzilla.suse.com/show_bug.cgi?id=1144621 bsc#1144621
  https://bugs.ghostscript.com/show_bug.cgi?id=701394</changelog>
  <changelog author="werner@suse.de" date="1568376000">- Add patch openjpeg4gs-CVE-2018-6616-8ee33522.patch
  to fix bsc#1140359 for CVE-2019-12973</changelog>
  <changelog author="werner@suse.de" date="1568635200">- Add patch gs-CVE-2019-14811-885444fc.patch to fix bsc#1146882
  for CVE-2019-14811,CVE-2019-14812,CVE-2019-14813
- Add patch gs-CVE-2019-14817-cd1b1cac.patch to fix bsc#1146884
  for CVE-2019-14817</changelog>
  <changelog author="werner@suse.de" date="1568635201">- Port latest ghostscript 9.27 from factory including latest
  security patches to SLES15/SLES12
  * Port patch CVE-2019-10216.patch to 9.27 which is the orignal
    upstream commit now
  * Drop patch CVE-2019-3838.patch as now part of 9.27</changelog>
  <changelog author="jsmeix@suse.de" date="1573473600">- CVE-2019-14869.patch contains commit from Ghostscript upstream
  https://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=485904772c5f
  to fix CVE-2019-14869 "-dSAFER escape in .charkeys"
  (bsc#1156275)</changelog>
  <changelog author="jsmeix@suse.de" date="1588075200">- The version upgrade to 9.52 fixes in particular
  CVE-2020-12268: jbic2dec: heap-based buffer overflow
  in jbig2_image_compose (bsc#1170603)
- Version upgrade to 9.52
  Highlights in this release include:
  * The 9.52 release replaces the 9.51 release after a problem
    was reported with 9.51 which warranted the quick turnaround.
    Thus, like 9.51, 9.52 is primarily a maintenance release,
    consolidating the changes we introduced in 9.50.
  * IMPORTANT: We have forked LittleCMS2 into LittleCMS2mt
    (the "mt" indicating "multi-thread").
    LCMS2 is not thread-safe, and cannot be made thread-safe
    without breaking the ABI. Our fork will be thread-safe and
    include performance enhancements (these changes have all
    been offered and rejected upstream). We will maintain
    compatibility between Ghostscript and LCMS2 for a time,
    but not in perpetuity. If there is sufficient interest,
    our fork will be available as its own package separately
    from Ghostscript (and MuPDF).
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  Incompatible changes:
  * New option -dALLOWPSTRANSPARENCY: The transparency compositor
    (and related features), whilst we are improving it, remains
    sensitive to being driven correctly, and incorrect use
    can have unexpected/undefined results. Hence, as part of
    improving security, we limited access to these operators,
    originally using the -dSAFER feature. As we made "SAFER"
    the default mode, that became unacceptable, hence the
    new option -dALLOWPSTRANSPARENCY which enables access
    to the operators, cf.
    https://www.ghostscript.com/doc/9.52/Use.htm#ALLOWPSTRANSPARENCY
  For a release summary see:
  https://www.ghostscript.com/doc/9.52/News.htm
  For details see the News.htm and History9.htm files.
- Version upgrade to 9.51
  Highlights in this release include:
  * 9.51 is primarily a maintainance release, consolidating
    the changes we introduced in 9.50.
  * We have continued our work on code hygiene for this release,
    with a focus on the static analysis tool Coverity
    (from Synopsys, Inc) and we are now maintaining a policy of
    zero Coverity issues in the Ghostscript/GhostPDL source base.
  * IMPORTANT: In consultation with a representative of
    OpenPrinting (http://www.openprinting.org/) it is our
    intention to deprecate and, in the not distant future,
    remove the OpenPrinting Vector/Raster Printer Drivers
    (that is, the opvp and oprp devices).
    If you rely on either of these devices, please get in touch
    with us (i.e. Ghostscript upstream), so we can discuss your
    use case, and revise our plans accordingly.
  * We (i.e. Ghostscript upstream) are in the process of forking
    LittleCMS, cf. the other release notes entries below.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  For a release summary see:
  https://www.ghostscript.com/doc/9.51/News.htm
  For details see the News.htm and History9.htm files.
- Version upgrade to 9.50
  Highlights in this release include:
  * The change to version 9.50 follows recognition
    of the extent and importance of the file access control
    redesign/reimplementation outlined below.
  * The file access control capability (enable with -dSAFER)
    has been completely rewritten, with a ground-up rethink
    of the design. For more details, see: "SAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#Safer
  * It is important to note that -dSAFER now only enables the
    file access controls, and no longer applies restrictions
    to standard Postscript functionality (specifically,
    restrictions on setpagedevice). If your application relies
    on these Postscript restrictions, see "OLDSAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#OldSafer
    and please get in touch, as we do plan to remove those
    Postscript restrictions unless we have reason not to.
  IMPORTANT: File access controls are now enabled by default.
    In order to run Ghostscript without these controls,
    see "NOSAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#NoSafer
  * We (i.e. Ghostscript upstream) are in the process of forking
    LittleCMS, cf. the other release notes entries below.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  Incompatible changes:
  * There are a couple of subtle incompatibilities between the old
    and new SAFER implementations. Firstly, as mentioned above,
    SAFER now leaves standard Postcript functionality unchanged
    (except for the file access limitations). Secondly, the
    interaction with save/restore operations, see "SAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#Safer
  * The following is not strictly speaking new to 9.50,
    as not much has changed since 9.27 in this area,
    but for those who don't upgrade with every release:
    The process of "tidying" the Postscript name space should have
    removed only non-standard and undocumented operators.
    Nevertheless, it is possible that any integrations or utilities
    that rely on those non-standard and undocumented operators
    may stop working, or may change behaviour.
    If you encounter such a case, please contact us
    (i.e. Ghostscript upstream, either the #ghostscript IRC channel
    or the gs-devel mailing list would be best), and we'll work
    with you to either find an alternative solution or return the
    previous functionality, if there is genuinely no other option.
    One case we know this has occurred is GSView 5 (and earlier).
    GSView 5 support for PDF files relied upon internal use only
    features which are no longer available. GSView 5 will still
    work as previously for Postscript files. For PDF files,
    users are encouraged to look at MuPDF https://www.mupdf.com/
  For a release summary see:
  https://www.ghostscript.com/doc/9.50/News.htm
  For details see the News.htm and History9.htm files.
- CVE-2019-10216.patch CVE-2019-14869.patch
  gs-CVE-2019-14811-885444fc.patch
  gs-CVE-2019-14817-cd1b1cac.patch
  openjpeg4gs-CVE-2018-6616-8ee33522.patch
  are fixed in the version 9.52 upstream sources.</changelog>
  <changelog author="jsmeix@suse.de" date="1595851200">- CVE-2020-15900.patch fixes CVE-2020-15900
  Memory Corruption (SAFER Sandbox Breakout)
  cf. https://bugs.ghostscript.com/show_bug.cgi?id=702582
  (bsc#1174415)</changelog>
  <changelog author="wolfgang.frisch@suse.com" date="1619006400">- Hardening: link as position independent executable (bsc#1184123).</changelog>
  <changelog author="jsmeix@suse.de" date="1631275200">- CVE-2021-3781.patch fixes CVE-2021-3781
  Trivial -dSAFER bypass
  cf. https://bugs.ghostscript.com/show_bug.cgi?id=704342
  (bsc#1190381)</changelog>
  <changelog author="werner@suse.de" date="1632916800">- Use update-alternatives to get the real ghostscript binary from
  /usr/bin/gs to /usr/bin/gs.bin and allow the gswrap package to
  use this with its wrapper script (jira#PM-3037)</changelog>
  <changelog author="jsmeix@suse.de" date="1641902400">- CVE-2021-45944.patch fixes CVE-2021-45944
  use-after-free in sampled_data_sample
  cf. https://github.com/google/oss-fuzz-vulns/blob/main/vulns/ghostscript/OSV-2021-237.yaml
  (bsc#1194303)
- CVE-2021-45949.patch fixes CVE-2021-45949
  heap-based buffer overflow in sampled_data_finish
  cf. https://github.com/google/oss-fuzz-vulns/blob/main/vulns/ghostscript/OSV-2021-803.yaml
  (bsc#1194304)</changelog>
</package>
<package pkgid="3a49d565a6f4f5f832f94ddab3a784da7633aa366fd92661a08ab199cee3c7c2" name="ghostscript-x11" arch="x86_64">
  <version epoch="0" ver="9.52" rel="161.1"/>
  <changelog author="jsmeix@suse.de" date="1528200000">- CVE-2018-10194.patch fixes stack-based buffer overflow
  in gdevpdts.c (bsc#1090099), see
  https://bugs.ghostscript.com/show_bug.cgi?id=699255 and
  http://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=39b1e54b2968620723bf32e96764c88797714879</changelog>
  <changelog author="jsmeix@suse.de" date="1536840000">- Version upgrade to 9.24
  Highlights in this release include:
  * Security issues have been the primary focus of this release,
    including solving several (well publicised)
    real and potential exploits.
    PLEASE NOTE:
    We (i.e. Ghostscript upstream) strongly urge users to upgrade
    to this latest release to avoid these issues.
  * As well as Ghostscript itself, jbig2dec has had a significant
    amount of work improving its robustness in the face of
    out specification files.
  * IMPORTANT: We (i.e. Ghostscript upstream) are in the process
    of forking LittleCMS. LCMS2 is not thread safe, and cannot
    be made thread safe without breaking the ABI. Our fork
    will be thread safe, and include performance enhancements
    (these changes have all be been offered and rejected upstream).
    We will maintain compatibility between Ghostscript and LCMS2
    for a time, but not in perpetuity. Our fork will be available
    as its own package separately from Ghostscript (and MuPDF).
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  For a release summary see:
  http://www.ghostscript.com/doc/9.24/News.htm
  For details see the News.htm and History9.htm files.
- fix_ln_docdir_gsdatadir.patch is no longer needed
  because the issue is fixed in the upstream sources.
- CVE-2018-10194.patch is no longer needed
  because the issue is fixed in the upstream sources.</changelog>
  <changelog author="jsmeix@suse.de" date="1536840001">- Version upgrade to 9.25rc1 (first release candidate for 9.25).
  Highlights in this release include:
  * This release fixes problems with argument handling, some
    unintended results of the security fixes to the SAFER file
    access restrictions (specifically accessing ICC profile files),
    and some additional security issues over the 9.24 release.
  * Security issues have been the primary focus of this release,
    including solving several (well publicised) real
    and potential exploits.
    PLEASE NOTE:
    We (i.e. Ghostscript upstream) strongly urge users to upgrade
    to this latest release to avoid these issues.
  * Avoid that ps2epsi fails with
    'Error: /undefined in --setpagedevice--'
    Recent changes required to harden SAFER mode mean that
    it is no longer possible to run ps2epsi in SAFER mode,
    because it relies upon unsafe Ghostscript non-standard
    extension operators.
    Removing SAFER and DELAYSAFER, and the code to reset SAFER,
    allow ps2epsi to run as well as it ever did (ie badly).
    This program (i.e. ps2epsi) should now be considered unsafe,
    you should not use it on untrusted PostScript programs.
    Likely we (i.e. Ghostscript upstream) will deprecate and
    remove this program in future.
  For details see the News.htm and History9.htm files.
  Regarding installing packages (in particular release candidates)
  from the openSUSE build service development project "Printing"
  see https://build.opensuse.org/project/show/Printing</changelog>
  <changelog author="jsmeix@suse.de" date="1536926400">- Version upgrade to 9.25
  For the highlights in this release see the highlights in the
  9.25rc1 first release candidate for 9.25 entry below.
  PLEASE NOTE:
  We (i.e. Ghostscript upstream) strongly urge users to upgrade
  to this latest release to avoid these issues.
  For a release summary see:
  http://www.ghostscript.com/doc/9.25/News.htm
  For details see the News.htm and History9.htm files.
  The Ghostscript 9.25 release should fix (see below)
  in particular those security issues:
  * CVE-2018-15909: shading_param incomplete type checking
    https://bugs.ghostscript.com/show_bug.cgi?id=699660
    https://bugzilla.suse.com/show_bug.cgi?id=1106172 bsc#1106172
  * CVE-2018-15908: .tempfile file permission issues
    https://bugs.ghostscript.com/show_bug.cgi?id=699657
    https://bugzilla.suse.com/show_bug.cgi?id=1106171 bsc#1106171
  * CVE-2018-15910: LockDistillerParams type confusion
    https://bugs.ghostscript.com/show_bug.cgi?id=699656
    https://bugzilla.suse.com/show_bug.cgi?id=1106173 bsc#1106173
  * CVE-2018-15911: uninitialized memory access in the aesdecode
    https://bugs.ghostscript.com/show_bug.cgi?id=699665
    https://bugzilla.suse.com/show_bug.cgi?id=1106195 bsc#1106195
  * CVE-2018-16513: setcolor missing type check
    https://bugs.ghostscript.com/show_bug.cgi?id=699655
    https://bugzilla.suse.com/show_bug.cgi?id=1107412 bsc#1107412
  * CVE-2018-16509: /invalidaccess bypass after failed restore
    https://bugs.ghostscript.com/show_bug.cgi?id=699654
    https://bugzilla.suse.com/show_bug.cgi?id=1107410 bsc#1107410
  * CVE-2018-16510: Incorrect exec stack handling in the "CS"
    and "SC" PDF primitives
    https://bugs.ghostscript.com/show_bug.cgi?id=699671
    https://bugzilla.suse.com/show_bug.cgi?id=1107411 bsc#1107411
  * CVE-2018-16542: .definemodifiedfont memory corruption
    if /typecheck is handled
    https://bugs.ghostscript.com/show_bug.cgi?id=699668
    https://bugzilla.suse.com/show_bug.cgi?id=1107413 bsc#1107413
  * CVE-2018-16541 incorrect free logic in pagedevice replacement
    https://bugs.ghostscript.com/show_bug.cgi?id=699664
    https://bugzilla.suse.com/show_bug.cgi?id=1107421 bsc#1107421
  * CVE-2018-16540 use-after-free in copydevice handling
    https://bugs.ghostscript.com/show_bug.cgi?id=699661
    https://bugzilla.suse.com/show_bug.cgi?id=1107420 bsc#1107420
  * CVE-2018-16539: incorrect access checking in temp file
    handling to disclose contents of files
    https://bugs.ghostscript.com/show_bug.cgi?id=699658
    https://bugzilla.suse.com/show_bug.cgi?id=1107422 bsc#1107422
  * CVE-2018-16543: gssetresolution and gsgetresolution allow
    for unspecified impact
    https://bugs.ghostscript.com/show_bug.cgi?id=699670
    https://bugzilla.suse.com/show_bug.cgi?id=1107423 bsc#1107423
  * CVE-2018-16511: type confusion in "ztype" could be used by
    remote attackers able to supply crafted PostScript to crash
    the interpreter or possibly have unspecified other impact
    https://bugs.ghostscript.com/show_bug.cgi?id=699659
    https://bugzilla.suse.com/show_bug.cgi?id=1107426 bsc#1107426
  * CVE-2018-16585 .setdistillerkeys PostScript command is
    accepted even though it is not intended for use
    https://bugzilla.suse.com/show_bug.cgi?id=1107581 bsc#1107581
  * CVE-2018-16802: Incorrect"restoration of privilege" checking
    when running out of stack during exceptionhandling could be
    used by attackers able to supply crafted PostScript to execute
    code using the "pipe" instruction. This is due to an incomplete
    fix for CVE-2018-16509
    https://bugs.ghostscript.com/show_bug.cgi?id=699714
    https://bugs.ghostscript.com/show_bug.cgi?id=699718
    https://bugzilla.suse.com/show_bug.cgi?id=1108027 bnc#1108027
  Regarding what the above "should fix" means:
  PostScript is a general purpose Turing-complete programming
  language (cf. https://en.wikipedia.org/wiki/PostScript)
  that supports in particular file access on the system disk.
  When Ghostscript processes PostScript it runs a PostScript
  program as the user who runs Ghostscript.
  When Ghostscript processes an arbitrary PostScript file,
  the user who runs Ghostscript runs an arbitrary program
  which can do anything on the system where Ghostscript runs
  that this user is allowed to do on that system.
  To make it safer when Ghostscript runs a PostScript program
  the Ghostscript command line option '-dSAFER' disables
  certain file access functionality, for details see
  /usr/share/doc/ghostscript/9.25/Use.htm
  Its name 'SAFER' says everything: It makes it 'safer'
  to let Ghostscript run a PostScript program,
  but it does not make it completely safe.
  In theory software is safe against misuse (i.e. has no bugs).
  In practice there is an endless sequence of various kind of
  security issues (i.e. software can be misused to do more than
  what is intended) that get fixed issue by issue ad infinitum.
  In the end all that means:
  In practice the user who runs Ghostscript must not let it
  process arbitrary PostScript files from untrusted origin.
  In particular Ghostscript is usually run when printing
  documents (with the '-dSAFER' option set), see the part about
  "It is crucial to limit access to CUPS to trusted users" in
  https://en.opensuse.org/SDB:CUPS_and_SANE_Firewall_settings</changelog>
  <changelog author="jsmeix@suse.de" date="1541764800">- Version upgrade to 9.26rc1 (first release candidate for 9.26).
  Highlights in this release include:
  * Purely security and a few bug fixes, there are no new features,
    and no API changes to report.</changelog>
  <changelog author="jsmeix@suse.de" date="1543579200">- Version upgrade to 9.26
  Highlights in this release include:
  * Security issues have been the primary focus of this release,
    including solving several (well publicised) real and potential
    exploits.
    Thanks to Man Yue Mo of Semmle Security Research Team,
    Jens Mueller of Ruhr-Universitaet Bochum and
    Tavis Ormandy of Google's Project Zero
    for their help to identify specific security issues.
    PLEASE NOTE:
    We (i.e. Ghostscript upstream) strongly urge users to upgrade
    to this latest release to avoid these issues.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  For a release summary see:
  http://www.ghostscript.com/doc/9.26/News.htm
  For details see the News.htm and History9.htm files.
  The Ghostscript 9.26 release should fix (cf. the entry below
  dated 'Fri Sep 14 10:47:33 CEST 2018' what "should fix" means)
  in particular those security issues (bsc#1117331)
  * CVE-2018-19475: psi/zdevice2.c allows attackers to bypass
    intended access restrictions
    https://bugs.ghostscript.com/show_bug.cgi?id=700153
    https://bugzilla.suse.com/show_bug.cgi?id=1117327 bsc#1117327
  * CVE-2018-19476: psi/zicc.c allows attackers to bypass
    intended access restrictions because of a setcolorspace
    type confusion
    https://bugs.ghostscript.com/show_bug.cgi?id=700169
    https://bugzilla.suse.com/show_bug.cgi?id=1117313 bsc#1117313
  * CVE-2018-19477: psi/zfjbig2.c allows attackers to bypass
    intended access restrictions because of a JBIG2Decode
    type confusion
    https://bugs.ghostscript.com/show_bug.cgi?id=700168
    https://bugzilla.suse.com/show_bug.cgi?id=1117274 bsc#1117274
  * CVE-2018-19409: LockSafetyParams is not checked correctly
    if another device is used
    https://bugs.ghostscript.com/show_bug.cgi?id=700176
    https://bugzilla.suse.com/show_bug.cgi?id=1117022 bsc#1117022
  and those security issues
  * CVE-2018-18284: 1Policy operator gives access to .forceput
    https://bugs.ghostscript.com/show_bug.cgi?id=69963
    https://bugzilla.suse.com/show_bug.cgi?id=1112229 bsc#1112229
  * CVE-2018-18073: saved execution stacks can leak operator arrays
    https://bugs.ghostscript.com/show_bug.cgi?id=699927
    https://bugzilla.suse.com/show_bug.cgi?id=1111480 bsc#1111480
  * CVE-2018-17961: bypassing executeonly to escape -dSAFER sandbox
    https://bugs.ghostscript.com/show_bug.cgi?id=699816
    https://bugzilla.suse.com/show_bug.cgi?id=1111479 bsc#1111479
  * CVE-2018-17183: remote attackers could be able to supply
    crafted PostScript to potentially overwrite or replace
    error handlers to inject code
    https://bugs.ghostscript.com/show_bug.cgi?id=699708
    https://bugzilla.suse.com/show_bug.cgi?id=1109105 bsc#1109105</changelog>
  <changelog author="jsmeix@suse.de" date="1547726400">- Version upgrade to 9.26a
  The version 9.26a is a special security bugfix version to fix
  * CVE-2019-6116: subroutines within pseudo-operators
    must themselves be pseudo-operators
    https://bugs.ghostscript.com/show_bug.cgi?id=700317
    https://bugzilla.suse.com/show_bug.cgi?id=1122319 bsc#1122319</changelog>
  <changelog author="jsmeix@suse.de" date="1552996800">- CVE-2019-3838.patch fixes CVE-2019-3838
  forceput in DefineResource is still accessible
  https://bugzilla.suse.com/show_bug.cgi?id=1129186 bsc#1129186
  https://bugs.ghostscript.com/show_bug.cgi?id=700576</changelog>
  <changelog author="jsmeix@suse.de" date="1554379200">- Version upgrade to 9.27
  Highlights in this release include:
  * We (i.e. Ghostscript upstream) have extensively cleaned up
    the Postscript name space: removing access to internal and/or
    undocumented Postscript operators, procedures and data.
    This has benefits for security and maintainability.
    Incompatible changes:
    The process of "tidying" the Postscript name space should
    have removed only non-standard and undocumented operators.
    Nevertheless, it is possible that any integrations or
    utilities that rely on those non-standard and undocumented
    operators may stop working, or may change behaviour.
    If you encounter such a case, please contact us (i.e.
    Ghostscript upstream) - (either the #ghostscript IRC channel,
    or the gs-devel mailing list would be best), and we'll work
    with you to either find an alternative solution.
  * Fontmap can now reference invidual fonts in a TrueType
    Collection for font subsitution. Previously, a Fontmap entry
    could only reference a TrueType collection and use the default
    (first) font.
    Now, the Fontmap syntax allows for specifying a specific index
    in a TTC. See the comments at the top of (the default)
    Fontmap.GS for details.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  IMPORTANT: It is our intention, within the next 12 months
    (ideally sooner, in time for the next release) to make SAFER
    the default mode of operation. For many users this will have
    no effect, since they use SAFER explicitly, but some niche
    uses which rely on SAFER being disabled may need to start
    explicitly adding the "-dNOSAFER" option.
  IMPORTANT: We (i.e. Ghostscript upstream) are in the process of
    forking LittleCMS. LCMS2 is not thread safe, and cannot be made
    thread safe without breaking the ABI. Our fork will be thread
    safe, and include performance enhancements (these changes have
    all be been offered and rejected upstream). We will maintain
    compatibility between Ghostscript and LCMS2 for a time, but not
    in perpetuity. Our fork will be available as its own package
    separately from Ghostscript (and MuPDF).
  For a release summary see:
  http://www.ghostscript.com/doc/9.27/News.htm
  For details see the News.htm and History9.htm files.
  The Ghostscript 9.27 release should fix (cf. the entry below
  dated 'Fri Sep 14 10:47:33 CEST 2018' what "should fix" means)
  in particular those security issues:
  * CVE-2019-3838 forceput in DefineResource is still accessible
    https://bugzilla.suse.com/show_bug.cgi?id=1129186 bsc#1129186
    https://bugs.ghostscript.com/show_bug.cgi?id=700576
  * CVE-2019-3835: superexec operator is available
    https://bugzilla.suse.com/show_bug.cgi?id=1129180 bsc#1129180
    https://bugs.ghostscript.com/show_bug.cgi?id=700585</changelog>
  <changelog author="werner@suse.de" date="1565611200">- CVE-2019-10216.patch fixes CVE-2019-10216
  forceput/superexec in .buildfont1 is still accessible
  https://bugzilla.suse.com/show_bug.cgi?id=1144621 bsc#1144621
  https://bugs.ghostscript.com/show_bug.cgi?id=701394</changelog>
  <changelog author="werner@suse.de" date="1568376000">- Add patch openjpeg4gs-CVE-2018-6616-8ee33522.patch
  to fix bsc#1140359 for CVE-2019-12973</changelog>
  <changelog author="werner@suse.de" date="1568635200">- Add patch gs-CVE-2019-14811-885444fc.patch to fix bsc#1146882
  for CVE-2019-14811,CVE-2019-14812,CVE-2019-14813
- Add patch gs-CVE-2019-14817-cd1b1cac.patch to fix bsc#1146884
  for CVE-2019-14817</changelog>
  <changelog author="werner@suse.de" date="1568635201">- Port latest ghostscript 9.27 from factory including latest
  security patches to SLES15/SLES12
  * Port patch CVE-2019-10216.patch to 9.27 which is the orignal
    upstream commit now
  * Drop patch CVE-2019-3838.patch as now part of 9.27</changelog>
  <changelog author="jsmeix@suse.de" date="1573473600">- CVE-2019-14869.patch contains commit from Ghostscript upstream
  https://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=485904772c5f
  to fix CVE-2019-14869 "-dSAFER escape in .charkeys"
  (bsc#1156275)</changelog>
  <changelog author="jsmeix@suse.de" date="1588075200">- The version upgrade to 9.52 fixes in particular
  CVE-2020-12268: jbic2dec: heap-based buffer overflow
  in jbig2_image_compose (bsc#1170603)
- Version upgrade to 9.52
  Highlights in this release include:
  * The 9.52 release replaces the 9.51 release after a problem
    was reported with 9.51 which warranted the quick turnaround.
    Thus, like 9.51, 9.52 is primarily a maintenance release,
    consolidating the changes we introduced in 9.50.
  * IMPORTANT: We have forked LittleCMS2 into LittleCMS2mt
    (the "mt" indicating "multi-thread").
    LCMS2 is not thread-safe, and cannot be made thread-safe
    without breaking the ABI. Our fork will be thread-safe and
    include performance enhancements (these changes have all
    been offered and rejected upstream). We will maintain
    compatibility between Ghostscript and LCMS2 for a time,
    but not in perpetuity. If there is sufficient interest,
    our fork will be available as its own package separately
    from Ghostscript (and MuPDF).
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  Incompatible changes:
  * New option -dALLOWPSTRANSPARENCY: The transparency compositor
    (and related features), whilst we are improving it, remains
    sensitive to being driven correctly, and incorrect use
    can have unexpected/undefined results. Hence, as part of
    improving security, we limited access to these operators,
    originally using the -dSAFER feature. As we made "SAFER"
    the default mode, that became unacceptable, hence the
    new option -dALLOWPSTRANSPARENCY which enables access
    to the operators, cf.
    https://www.ghostscript.com/doc/9.52/Use.htm#ALLOWPSTRANSPARENCY
  For a release summary see:
  https://www.ghostscript.com/doc/9.52/News.htm
  For details see the News.htm and History9.htm files.
- Version upgrade to 9.51
  Highlights in this release include:
  * 9.51 is primarily a maintainance release, consolidating
    the changes we introduced in 9.50.
  * We have continued our work on code hygiene for this release,
    with a focus on the static analysis tool Coverity
    (from Synopsys, Inc) and we are now maintaining a policy of
    zero Coverity issues in the Ghostscript/GhostPDL source base.
  * IMPORTANT: In consultation with a representative of
    OpenPrinting (http://www.openprinting.org/) it is our
    intention to deprecate and, in the not distant future,
    remove the OpenPrinting Vector/Raster Printer Drivers
    (that is, the opvp and oprp devices).
    If you rely on either of these devices, please get in touch
    with us (i.e. Ghostscript upstream), so we can discuss your
    use case, and revise our plans accordingly.
  * We (i.e. Ghostscript upstream) are in the process of forking
    LittleCMS, cf. the other release notes entries below.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  For a release summary see:
  https://www.ghostscript.com/doc/9.51/News.htm
  For details see the News.htm and History9.htm files.
- Version upgrade to 9.50
  Highlights in this release include:
  * The change to version 9.50 follows recognition
    of the extent and importance of the file access control
    redesign/reimplementation outlined below.
  * The file access control capability (enable with -dSAFER)
    has been completely rewritten, with a ground-up rethink
    of the design. For more details, see: "SAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#Safer
  * It is important to note that -dSAFER now only enables the
    file access controls, and no longer applies restrictions
    to standard Postscript functionality (specifically,
    restrictions on setpagedevice). If your application relies
    on these Postscript restrictions, see "OLDSAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#OldSafer
    and please get in touch, as we do plan to remove those
    Postscript restrictions unless we have reason not to.
  IMPORTANT: File access controls are now enabled by default.
    In order to run Ghostscript without these controls,
    see "NOSAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#NoSafer
  * We (i.e. Ghostscript upstream) are in the process of forking
    LittleCMS, cf. the other release notes entries below.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  Incompatible changes:
  * There are a couple of subtle incompatibilities between the old
    and new SAFER implementations. Firstly, as mentioned above,
    SAFER now leaves standard Postcript functionality unchanged
    (except for the file access limitations). Secondly, the
    interaction with save/restore operations, see "SAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#Safer
  * The following is not strictly speaking new to 9.50,
    as not much has changed since 9.27 in this area,
    but for those who don't upgrade with every release:
    The process of "tidying" the Postscript name space should have
    removed only non-standard and undocumented operators.
    Nevertheless, it is possible that any integrations or utilities
    that rely on those non-standard and undocumented operators
    may stop working, or may change behaviour.
    If you encounter such a case, please contact us
    (i.e. Ghostscript upstream, either the #ghostscript IRC channel
    or the gs-devel mailing list would be best), and we'll work
    with you to either find an alternative solution or return the
    previous functionality, if there is genuinely no other option.
    One case we know this has occurred is GSView 5 (and earlier).
    GSView 5 support for PDF files relied upon internal use only
    features which are no longer available. GSView 5 will still
    work as previously for Postscript files. For PDF files,
    users are encouraged to look at MuPDF https://www.mupdf.com/
  For a release summary see:
  https://www.ghostscript.com/doc/9.50/News.htm
  For details see the News.htm and History9.htm files.
- CVE-2019-10216.patch CVE-2019-14869.patch
  gs-CVE-2019-14811-885444fc.patch
  gs-CVE-2019-14817-cd1b1cac.patch
  openjpeg4gs-CVE-2018-6616-8ee33522.patch
  are fixed in the version 9.52 upstream sources.</changelog>
  <changelog author="jsmeix@suse.de" date="1595851200">- CVE-2020-15900.patch fixes CVE-2020-15900
  Memory Corruption (SAFER Sandbox Breakout)
  cf. https://bugs.ghostscript.com/show_bug.cgi?id=702582
  (bsc#1174415)</changelog>
  <changelog author="wolfgang.frisch@suse.com" date="1619006400">- Hardening: link as position independent executable (bsc#1184123).</changelog>
  <changelog author="jsmeix@suse.de" date="1631275200">- CVE-2021-3781.patch fixes CVE-2021-3781
  Trivial -dSAFER bypass
  cf. https://bugs.ghostscript.com/show_bug.cgi?id=704342
  (bsc#1190381)</changelog>
  <changelog author="werner@suse.de" date="1632916800">- Use update-alternatives to get the real ghostscript binary from
  /usr/bin/gs to /usr/bin/gs.bin and allow the gswrap package to
  use this with its wrapper script (jira#PM-3037)</changelog>
  <changelog author="jsmeix@suse.de" date="1641902400">- CVE-2021-45944.patch fixes CVE-2021-45944
  use-after-free in sampled_data_sample
  cf. https://github.com/google/oss-fuzz-vulns/blob/main/vulns/ghostscript/OSV-2021-237.yaml
  (bsc#1194303)
- CVE-2021-45949.patch fixes CVE-2021-45949
  heap-based buffer overflow in sampled_data_finish
  cf. https://github.com/google/oss-fuzz-vulns/blob/main/vulns/ghostscript/OSV-2021-803.yaml
  (bsc#1194304)</changelog>
</package>
<package pkgid="ea48cdc94ca7075016c22ccc91f7882d676ecc2820abf78ef4a324aeea9fed49" name="glibc" arch="aarch64">
  <version epoch="0" ver="2.31" rel="150300.9.12.1"/>
  <changelog author="schwab@suse.de" date="1583841600">- dl-sort-maps.patch, dlopen-filter-object.patch: Allow dlopen of filter
  object to work (bsc#1166106, BZ #16272)</changelog>
  <changelog author="schwab@suse.de" date="1585137600">- glob-use-after-free.patch: Fix use-after-free in glob when expanding
  ~user (CVE-2020-1752, bsc#1167631, BZ #25414)</changelog>
  <changelog author="schwab@suse.de" date="1589371200">- nptl-setxid-race.patch: nptl: wait for pending setxid request also in
  detached thread (bsc#1162930, BZ #25942)</changelog>
  <changelog author="schwab@suse.de" date="1593518400">- nscd-senfile.patch: Fix concurrent changes on nscd aware files
  (bsc#1171878, BZ #23178)
- nscd-prune.patch: nscd: bump GC cycle during cache pruning (bsc#1171878,
  BZ #26130)
- syslog-locking.patch: Correct locking and cancellation cleanup in syslog
  functions (bsc#1172085, BZ #26100)</changelog>
  <changelog author="schwab@suse.de" date="1599048000">- Update to glibc 2.31
- glibc-2.14-crypt.diff, crypt_blowfish-const.patch,
  crypt_blowfish-1.2-sha.diff, crypt_blowfish-gensalt.patch,
  crypt_blowfish-1.2-hack_around_arm.diff, glibc-nodate.patch,
  powerpc-elision-enable-envvar.patch, s390-elision-enable-envvar.patch,
  crt-nocompress-debug-sections.patch, resolv-context-leak.patch,
  dl-runtime-resolve-opt-avx512f.patch, libpthread-compat-wrappers.patch,
  math-c++-compat.patch, remove-nss-nis-compat.patch,
  eh-frame-zero-terminator.patch, ld-so-hwcap-x86-64.patch,
  assert-pedantic.patch, getaddrinfo-errno.patch, resolv-conf-oom.patch,
  dynarray-allocation.patch, nearbyint-inexact.patch, nss-compat.patch,
  nscd-libnsl.patch, malloc-tcache-leak.patch,
  falkor-memcpy-memmove.patch, aarch64-cpu-features.patch,
  nss-files-large-buffers.patch, sysconf-uio-maxiov.patch,
  glob-tilde-overflow.patch, dl-runtime-resolve-xsave.patch,
  spawni-assert.patch, x86-64-dl-platform.patch, glob64-s390.patch,
  tst-tlsopt-powerpc.patch, powerpc-hwcap-bits.patch,
  malloc-tcache-check-overflow.patch, dl-init-paths-overflow.patch,
  fillin-rpath-empty-tokens.patch, getcwd-absolute.patch,
  memalign-overflow.patch, stack-guard-size-accounting.patch,
  libgcc-rtld-now.patch, res-send-enomem.patch,
  glibc-fix-avx512-mempcpy.patch, i386-memmove-sse2-unaligned.patch,
  realpath-ssize-max-overflow.patch, localtime-2039.patch,
  math-remove-slow-path.patch, aarch64-hwcap-atomics.patch,
  glibc-fix-aarch64-build.diff, absolute-symbols.patch,
  x86-haswell-string-flags.patch,
  pthread-cond-broadcast-waiters-after-spinning.patch,
  mman-map-sync.patch, mman-linux-map-shared-validate.patch,
  nptl-setxid-error.patch, pthread-mutex-trylock-barrier.patch,
  getaddrinfo-parse-ipv4-address.patch, japanese-era-name-may-2019.patch,
  force-elision-race.patch, regex-read-overrun.patch,
  regex-parse-reg-exp.patch,
  0001-S390-Add-configure-check-to-detect-z10-as-mininum-ar.patch,
  0002-S390-Use-hwcap-instead-of-dl_hwcap-in-ifunc-resolver.patch,
  0003-S390-Unify-31-64bit-memcpy.patch,
  0004-S390-Refactor-memcpy-mempcpy-ifunc-handling.patch,
  0005-S390-Remove-s390-specific-implementation-of-bcopy.patch,
  0006-S390-Use-memcpy-for-forward-cases-in-memmove.patch,
  0007-S390-Add-configure-check-to-detect-z13-as-mininum-ar.patch,
  0008-S390-Add-z13-memmove-ifunc-variant.patch,
  0009-S390-Add-z13-strstr-ifunc-variant.patch,
  0010-S390-Add-z13-memmem-ifunc-variant.patch,
  0011-S390-Cleanup-ifunc-resolve.h.patch,
  0012-S390-Mark-vx-and-vxe-as-important-hwcap.patch,
  0013-S390-Add-new-hwcap-values-for-new-cpu-architecture-a.patch,
  0014-S390-Add-configure-check-to-detect-support-for-arch1.patch,
  0015-S390-Add-arch13-memmove-ifunc-variant.patch,
  0016-S390-Add-arch13-strstr-ifunc-variant.patch,
  0017-S390-Add-arch13-memmem-ifunc-variant.patch,
  prefer-map-32bit-exec.patch, s390-strstr-page-boundary.patch,
  ppc-tle-htm-nosc.patch,
  posix-Add-internal-symbols-for-posix_spawn-interface.patch,
  glibc-2.29-posix-Use-posix_spawn-on-popen.patch,
  backtrace-powerpc.patch, pthread-rwlock-pwn.patch,
  manual-memory-protection.patch, ldbl-96-rem-pio2l.patch,
  dl-sort-maps.patch, dlopen-filter-object.patch,
  glob-use-after-free.patch, nptl-setxid-race.patch, nscd-senfile.patch,
  ldd-system-interp.patch, abort-no-flush.patch,
  fnmatch-collating-elements.patch, nss-files-long-lines-2.patch,
  iconv-reset-input-buffer.patch, nscd-prune.patch, syslog-locking.patch:
  Removed.
- long-double-alias.patch, glibc-nsswitch-usr.diff, euc-kr-overrun.patch,
  riscv-syscall-clobber.patch, nscd-gc-cycle.patch: Added.</changelog>
  <changelog author="schwab@suse.de" date="1604923200">- power10-support.patch: Add support for POWER10 (jsc#SLE-13520)
- iconv-option-parsing.patch: Rewrite iconv option parsing
  (CVE-2016-10228, bsc#1027496, BZ #19519)</changelog>
  <changelog author="schwab@suse.de" date="1608120000">- aarch64-getauxval.patch: aarch64: Accept PLT calls to __getauxval within
  libc.so (bsc#1167939)
- iconv-redundant-shift.patch: iconv: Accept redundant shift sequences in
  IBM1364 (CVE-2020-27618, bsc#1178386, BZ #26224)
- iconv-ucs4-loop-bounds.patch: iconv: Fix incorrect UCS4 inner loop
  bounds (CVE-2020-29562, bsc#1179694, BZ #26923)
- printf-long-double-non-normal.patch: x86: Harden printf against
  non-normal long double values (CVE-2020-29573, bsc#1179721, BZ #26649)
- get-nprocs-cpu-online-parsing.patch: Fix parsing of
  /sys/devices/system/cpu/online (bsc#1180038, BZ #25859)</changelog>
  <changelog author="schwab@suse.de" date="1609848000">- sysvipc-sem-stat-any.patch: sysvipc: Fix SEM_STAT_ANY kernel argument
  pass (bsc#1180557, BZ #26637)</changelog>
  <changelog author="schwab@suse.de" date="1611835200">- gconv-assertion-iso-2022-jp.patch: gconv: Fix assertion failure in
  ISO-2022-JP-3 module (CVE-2021-3326, bsc#1181505, BZ #27256)</changelog>
  <changelog author="schwab@suse.de" date="1614772800">- nscd-netgroupcache.patch: nscd: Fix double free in netgroupcache
  (CVE-2021-27645, bsc#1182733, BZ #27462)</changelog>
  <changelog author="rguenther@suse.com" date="1615377600">- Add glibc-2.31-HTM-vzeroupper.diff to avoid VZEROUPPER in the
  AVX2 accelerated string routines which cause HTM transaction
  aborts.  Instead use EVEX or SSE.  (bsc#1181403)</changelog>
  <changelog author="rguenther@suse.com" date="1615377601">- Update glibc-2.31-HTM-vzeroupper.diff with a AVX-SSE transition
  fix.</changelog>
  <changelog author="schwab@suse.de" date="1617019200">- s390-memmove-ifunc-selector-arch13.patch: S390: Also check vector
  support in memmove ifunc-selector (bsc#1184035, BZ #27511)</changelog>
  <changelog author="schwab@suse.de" date="1625140800">- wordexp-param-overflow.patch: wordexp: handle overflow in positional
  parameter number (CVE-2021-35942, bsc#1187911, BZ #28011)</changelog>
  <changelog author="schwab@suse.de" date="1630584000">- mq-notify-use-after-free.patch: Use __pthread_attr_copy in mq_notify
  (CVE-2021-33574, bsc#1186489, BZ #27896)</changelog>
  <changelog author="schwab@suse.de" date="1636027200">- 0001-s390x-Align-child-stack-while-clone.-BZ-27968.patch,
  0002-S390-Optimize-__memcpy_z196.patch,
  0003-S390-Optimize-__memset_z196.patch,
  0004-S390-Sync-HWCAP-names-with-kernel-by-adding-aliases-.patch,
  0005-S390-Add-new-hwcap-values.patch,
  0006-S390-Add-PCI_MIO-and-SIE-HWCAPs.patch: [15sp4 FEAT] GNU2007 -
  GLIBC: Support for new IBM Z Hardware (bsc#1191592, jsc#IBM-869)</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1640174400">- Add support for livepatches (jsc#SLE-20049).
- Enable livepatching on x86_64.
- Generate ipa-clones tarball artifact when livepatching is enabled.</changelog>
  <changelog author="schwab@suse.de" date="1642420800">- clnt-create-unix-overflow.patch: Buffer overflow in sunrpc clnt_create
  for "unix" (CVE-2022-23219, bsc#1194768, BZ #22542)
- svcunix-create-overflow.patch: Buffer overflow in sunrpc svcunix_create
  (CVE-2022-23218, bsc#1194770, BZ #28768)</changelog>
  <changelog author="schwab@suse.de" date="1642593600">- 0001-powerpc-Optimized-strcpy-for-POWER9.patch,
  0002-powerpc-Optimized-stpcpy-for-POWER9.patch,
  0003-powerpc-Optimized-rawmemchr-for-POWER9.patch,
  0004-powerpc64le-add-optimized-strlen-for-P9.patch,
  0005-powerpc-fix-ifunc-implementation-list-for-POWER9-str.patch,
  0006-powerpc-Add-optimized-strncpy-for-POWER9.patch,
  0007-powerpc-Add-optimized-stpncpy-for-POWER9.patch,
  0008-powerpc-Add-optimized-ilogb-for-POWER9.patch,
  0009-powerpc-Add-optimized-llogb-for-POWER9.patch,
  0010-powerpc-Add-optimized-strlen-for-POWER10.patch,
  0011-powerpc64le-Optimized-memmove-for-POWER10.patch,
  0012-powerpc64le-Optimize-memcpy-for-POWER10.patch,
  0013-powerpc64le-Optimize-memset-for-POWER10.patch,
  0014-powerpc64le-Fix-ifunc-selection-for-memset-memmove-b.patch,
  0015-powerpc-Add-optimized-rawmemchr-for-POWER10.patch: ppc64le ifunc
  improvements (bsc#1194785, jsc#SLE-18195)</changelog>
  <changelog author="schwab@suse.de" date="1643025600">- getcwd-erange.patch: getcwd: Set errno to ERANGE for size == 1
  (CVE-2021-3999, bsc#1194640, BZ #28769)</changelog>
</package>
<package pkgid="fc60904d7982a443c691ac992cba567fa9ef391efa533bb4a9029e3d994c9982" name="glibc" arch="ppc64le">
  <version epoch="0" ver="2.31" rel="150300.9.12.1"/>
  <changelog author="schwab@suse.de" date="1583841600">- dl-sort-maps.patch, dlopen-filter-object.patch: Allow dlopen of filter
  object to work (bsc#1166106, BZ #16272)</changelog>
  <changelog author="schwab@suse.de" date="1585137600">- glob-use-after-free.patch: Fix use-after-free in glob when expanding
  ~user (CVE-2020-1752, bsc#1167631, BZ #25414)</changelog>
  <changelog author="schwab@suse.de" date="1589371200">- nptl-setxid-race.patch: nptl: wait for pending setxid request also in
  detached thread (bsc#1162930, BZ #25942)</changelog>
  <changelog author="schwab@suse.de" date="1593518400">- nscd-senfile.patch: Fix concurrent changes on nscd aware files
  (bsc#1171878, BZ #23178)
- nscd-prune.patch: nscd: bump GC cycle during cache pruning (bsc#1171878,
  BZ #26130)
- syslog-locking.patch: Correct locking and cancellation cleanup in syslog
  functions (bsc#1172085, BZ #26100)</changelog>
  <changelog author="schwab@suse.de" date="1599048000">- Update to glibc 2.31
- glibc-2.14-crypt.diff, crypt_blowfish-const.patch,
  crypt_blowfish-1.2-sha.diff, crypt_blowfish-gensalt.patch,
  crypt_blowfish-1.2-hack_around_arm.diff, glibc-nodate.patch,
  powerpc-elision-enable-envvar.patch, s390-elision-enable-envvar.patch,
  crt-nocompress-debug-sections.patch, resolv-context-leak.patch,
  dl-runtime-resolve-opt-avx512f.patch, libpthread-compat-wrappers.patch,
  math-c++-compat.patch, remove-nss-nis-compat.patch,
  eh-frame-zero-terminator.patch, ld-so-hwcap-x86-64.patch,
  assert-pedantic.patch, getaddrinfo-errno.patch, resolv-conf-oom.patch,
  dynarray-allocation.patch, nearbyint-inexact.patch, nss-compat.patch,
  nscd-libnsl.patch, malloc-tcache-leak.patch,
  falkor-memcpy-memmove.patch, aarch64-cpu-features.patch,
  nss-files-large-buffers.patch, sysconf-uio-maxiov.patch,
  glob-tilde-overflow.patch, dl-runtime-resolve-xsave.patch,
  spawni-assert.patch, x86-64-dl-platform.patch, glob64-s390.patch,
  tst-tlsopt-powerpc.patch, powerpc-hwcap-bits.patch,
  malloc-tcache-check-overflow.patch, dl-init-paths-overflow.patch,
  fillin-rpath-empty-tokens.patch, getcwd-absolute.patch,
  memalign-overflow.patch, stack-guard-size-accounting.patch,
  libgcc-rtld-now.patch, res-send-enomem.patch,
  glibc-fix-avx512-mempcpy.patch, i386-memmove-sse2-unaligned.patch,
  realpath-ssize-max-overflow.patch, localtime-2039.patch,
  math-remove-slow-path.patch, aarch64-hwcap-atomics.patch,
  glibc-fix-aarch64-build.diff, absolute-symbols.patch,
  x86-haswell-string-flags.patch,
  pthread-cond-broadcast-waiters-after-spinning.patch,
  mman-map-sync.patch, mman-linux-map-shared-validate.patch,
  nptl-setxid-error.patch, pthread-mutex-trylock-barrier.patch,
  getaddrinfo-parse-ipv4-address.patch, japanese-era-name-may-2019.patch,
  force-elision-race.patch, regex-read-overrun.patch,
  regex-parse-reg-exp.patch,
  0001-S390-Add-configure-check-to-detect-z10-as-mininum-ar.patch,
  0002-S390-Use-hwcap-instead-of-dl_hwcap-in-ifunc-resolver.patch,
  0003-S390-Unify-31-64bit-memcpy.patch,
  0004-S390-Refactor-memcpy-mempcpy-ifunc-handling.patch,
  0005-S390-Remove-s390-specific-implementation-of-bcopy.patch,
  0006-S390-Use-memcpy-for-forward-cases-in-memmove.patch,
  0007-S390-Add-configure-check-to-detect-z13-as-mininum-ar.patch,
  0008-S390-Add-z13-memmove-ifunc-variant.patch,
  0009-S390-Add-z13-strstr-ifunc-variant.patch,
  0010-S390-Add-z13-memmem-ifunc-variant.patch,
  0011-S390-Cleanup-ifunc-resolve.h.patch,
  0012-S390-Mark-vx-and-vxe-as-important-hwcap.patch,
  0013-S390-Add-new-hwcap-values-for-new-cpu-architecture-a.patch,
  0014-S390-Add-configure-check-to-detect-support-for-arch1.patch,
  0015-S390-Add-arch13-memmove-ifunc-variant.patch,
  0016-S390-Add-arch13-strstr-ifunc-variant.patch,
  0017-S390-Add-arch13-memmem-ifunc-variant.patch,
  prefer-map-32bit-exec.patch, s390-strstr-page-boundary.patch,
  ppc-tle-htm-nosc.patch,
  posix-Add-internal-symbols-for-posix_spawn-interface.patch,
  glibc-2.29-posix-Use-posix_spawn-on-popen.patch,
  backtrace-powerpc.patch, pthread-rwlock-pwn.patch,
  manual-memory-protection.patch, ldbl-96-rem-pio2l.patch,
  dl-sort-maps.patch, dlopen-filter-object.patch,
  glob-use-after-free.patch, nptl-setxid-race.patch, nscd-senfile.patch,
  ldd-system-interp.patch, abort-no-flush.patch,
  fnmatch-collating-elements.patch, nss-files-long-lines-2.patch,
  iconv-reset-input-buffer.patch, nscd-prune.patch, syslog-locking.patch:
  Removed.
- long-double-alias.patch, glibc-nsswitch-usr.diff, euc-kr-overrun.patch,
  riscv-syscall-clobber.patch, nscd-gc-cycle.patch: Added.</changelog>
  <changelog author="schwab@suse.de" date="1604923200">- power10-support.patch: Add support for POWER10 (jsc#SLE-13520)
- iconv-option-parsing.patch: Rewrite iconv option parsing
  (CVE-2016-10228, bsc#1027496, BZ #19519)</changelog>
  <changelog author="schwab@suse.de" date="1608120000">- aarch64-getauxval.patch: aarch64: Accept PLT calls to __getauxval within
  libc.so (bsc#1167939)
- iconv-redundant-shift.patch: iconv: Accept redundant shift sequences in
  IBM1364 (CVE-2020-27618, bsc#1178386, BZ #26224)
- iconv-ucs4-loop-bounds.patch: iconv: Fix incorrect UCS4 inner loop
  bounds (CVE-2020-29562, bsc#1179694, BZ #26923)
- printf-long-double-non-normal.patch: x86: Harden printf against
  non-normal long double values (CVE-2020-29573, bsc#1179721, BZ #26649)
- get-nprocs-cpu-online-parsing.patch: Fix parsing of
  /sys/devices/system/cpu/online (bsc#1180038, BZ #25859)</changelog>
  <changelog author="schwab@suse.de" date="1609848000">- sysvipc-sem-stat-any.patch: sysvipc: Fix SEM_STAT_ANY kernel argument
  pass (bsc#1180557, BZ #26637)</changelog>
  <changelog author="schwab@suse.de" date="1611835200">- gconv-assertion-iso-2022-jp.patch: gconv: Fix assertion failure in
  ISO-2022-JP-3 module (CVE-2021-3326, bsc#1181505, BZ #27256)</changelog>
  <changelog author="schwab@suse.de" date="1614772800">- nscd-netgroupcache.patch: nscd: Fix double free in netgroupcache
  (CVE-2021-27645, bsc#1182733, BZ #27462)</changelog>
  <changelog author="rguenther@suse.com" date="1615377600">- Add glibc-2.31-HTM-vzeroupper.diff to avoid VZEROUPPER in the
  AVX2 accelerated string routines which cause HTM transaction
  aborts.  Instead use EVEX or SSE.  (bsc#1181403)</changelog>
  <changelog author="rguenther@suse.com" date="1615377601">- Update glibc-2.31-HTM-vzeroupper.diff with a AVX-SSE transition
  fix.</changelog>
  <changelog author="schwab@suse.de" date="1617019200">- s390-memmove-ifunc-selector-arch13.patch: S390: Also check vector
  support in memmove ifunc-selector (bsc#1184035, BZ #27511)</changelog>
  <changelog author="schwab@suse.de" date="1625140800">- wordexp-param-overflow.patch: wordexp: handle overflow in positional
  parameter number (CVE-2021-35942, bsc#1187911, BZ #28011)</changelog>
  <changelog author="schwab@suse.de" date="1630584000">- mq-notify-use-after-free.patch: Use __pthread_attr_copy in mq_notify
  (CVE-2021-33574, bsc#1186489, BZ #27896)</changelog>
  <changelog author="schwab@suse.de" date="1636027200">- 0001-s390x-Align-child-stack-while-clone.-BZ-27968.patch,
  0002-S390-Optimize-__memcpy_z196.patch,
  0003-S390-Optimize-__memset_z196.patch,
  0004-S390-Sync-HWCAP-names-with-kernel-by-adding-aliases-.patch,
  0005-S390-Add-new-hwcap-values.patch,
  0006-S390-Add-PCI_MIO-and-SIE-HWCAPs.patch: [15sp4 FEAT] GNU2007 -
  GLIBC: Support for new IBM Z Hardware (bsc#1191592, jsc#IBM-869)</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1640174400">- Add support for livepatches (jsc#SLE-20049).
- Enable livepatching on x86_64.
- Generate ipa-clones tarball artifact when livepatching is enabled.</changelog>
  <changelog author="schwab@suse.de" date="1642420800">- clnt-create-unix-overflow.patch: Buffer overflow in sunrpc clnt_create
  for "unix" (CVE-2022-23219, bsc#1194768, BZ #22542)
- svcunix-create-overflow.patch: Buffer overflow in sunrpc svcunix_create
  (CVE-2022-23218, bsc#1194770, BZ #28768)</changelog>
  <changelog author="schwab@suse.de" date="1642593600">- 0001-powerpc-Optimized-strcpy-for-POWER9.patch,
  0002-powerpc-Optimized-stpcpy-for-POWER9.patch,
  0003-powerpc-Optimized-rawmemchr-for-POWER9.patch,
  0004-powerpc64le-add-optimized-strlen-for-P9.patch,
  0005-powerpc-fix-ifunc-implementation-list-for-POWER9-str.patch,
  0006-powerpc-Add-optimized-strncpy-for-POWER9.patch,
  0007-powerpc-Add-optimized-stpncpy-for-POWER9.patch,
  0008-powerpc-Add-optimized-ilogb-for-POWER9.patch,
  0009-powerpc-Add-optimized-llogb-for-POWER9.patch,
  0010-powerpc-Add-optimized-strlen-for-POWER10.patch,
  0011-powerpc64le-Optimized-memmove-for-POWER10.patch,
  0012-powerpc64le-Optimize-memcpy-for-POWER10.patch,
  0013-powerpc64le-Optimize-memset-for-POWER10.patch,
  0014-powerpc64le-Fix-ifunc-selection-for-memset-memmove-b.patch,
  0015-powerpc-Add-optimized-rawmemchr-for-POWER10.patch: ppc64le ifunc
  improvements (bsc#1194785, jsc#SLE-18195)</changelog>
  <changelog author="schwab@suse.de" date="1643025600">- getcwd-erange.patch: getcwd: Set errno to ERANGE for size == 1
  (CVE-2021-3999, bsc#1194640, BZ #28769)</changelog>
</package>
<package pkgid="d04afaaa8f9c27d04bc7688a744944cf8485910aa928c821e1329ba8b1f242b1" name="glibc" arch="s390x">
  <version epoch="0" ver="2.31" rel="150300.9.12.1"/>
  <changelog author="schwab@suse.de" date="1583841600">- dl-sort-maps.patch, dlopen-filter-object.patch: Allow dlopen of filter
  object to work (bsc#1166106, BZ #16272)</changelog>
  <changelog author="schwab@suse.de" date="1585137600">- glob-use-after-free.patch: Fix use-after-free in glob when expanding
  ~user (CVE-2020-1752, bsc#1167631, BZ #25414)</changelog>
  <changelog author="schwab@suse.de" date="1589371200">- nptl-setxid-race.patch: nptl: wait for pending setxid request also in
  detached thread (bsc#1162930, BZ #25942)</changelog>
  <changelog author="schwab@suse.de" date="1593518400">- nscd-senfile.patch: Fix concurrent changes on nscd aware files
  (bsc#1171878, BZ #23178)
- nscd-prune.patch: nscd: bump GC cycle during cache pruning (bsc#1171878,
  BZ #26130)
- syslog-locking.patch: Correct locking and cancellation cleanup in syslog
  functions (bsc#1172085, BZ #26100)</changelog>
  <changelog author="schwab@suse.de" date="1599048000">- Update to glibc 2.31
- glibc-2.14-crypt.diff, crypt_blowfish-const.patch,
  crypt_blowfish-1.2-sha.diff, crypt_blowfish-gensalt.patch,
  crypt_blowfish-1.2-hack_around_arm.diff, glibc-nodate.patch,
  powerpc-elision-enable-envvar.patch, s390-elision-enable-envvar.patch,
  crt-nocompress-debug-sections.patch, resolv-context-leak.patch,
  dl-runtime-resolve-opt-avx512f.patch, libpthread-compat-wrappers.patch,
  math-c++-compat.patch, remove-nss-nis-compat.patch,
  eh-frame-zero-terminator.patch, ld-so-hwcap-x86-64.patch,
  assert-pedantic.patch, getaddrinfo-errno.patch, resolv-conf-oom.patch,
  dynarray-allocation.patch, nearbyint-inexact.patch, nss-compat.patch,
  nscd-libnsl.patch, malloc-tcache-leak.patch,
  falkor-memcpy-memmove.patch, aarch64-cpu-features.patch,
  nss-files-large-buffers.patch, sysconf-uio-maxiov.patch,
  glob-tilde-overflow.patch, dl-runtime-resolve-xsave.patch,
  spawni-assert.patch, x86-64-dl-platform.patch, glob64-s390.patch,
  tst-tlsopt-powerpc.patch, powerpc-hwcap-bits.patch,
  malloc-tcache-check-overflow.patch, dl-init-paths-overflow.patch,
  fillin-rpath-empty-tokens.patch, getcwd-absolute.patch,
  memalign-overflow.patch, stack-guard-size-accounting.patch,
  libgcc-rtld-now.patch, res-send-enomem.patch,
  glibc-fix-avx512-mempcpy.patch, i386-memmove-sse2-unaligned.patch,
  realpath-ssize-max-overflow.patch, localtime-2039.patch,
  math-remove-slow-path.patch, aarch64-hwcap-atomics.patch,
  glibc-fix-aarch64-build.diff, absolute-symbols.patch,
  x86-haswell-string-flags.patch,
  pthread-cond-broadcast-waiters-after-spinning.patch,
  mman-map-sync.patch, mman-linux-map-shared-validate.patch,
  nptl-setxid-error.patch, pthread-mutex-trylock-barrier.patch,
  getaddrinfo-parse-ipv4-address.patch, japanese-era-name-may-2019.patch,
  force-elision-race.patch, regex-read-overrun.patch,
  regex-parse-reg-exp.patch,
  0001-S390-Add-configure-check-to-detect-z10-as-mininum-ar.patch,
  0002-S390-Use-hwcap-instead-of-dl_hwcap-in-ifunc-resolver.patch,
  0003-S390-Unify-31-64bit-memcpy.patch,
  0004-S390-Refactor-memcpy-mempcpy-ifunc-handling.patch,
  0005-S390-Remove-s390-specific-implementation-of-bcopy.patch,
  0006-S390-Use-memcpy-for-forward-cases-in-memmove.patch,
  0007-S390-Add-configure-check-to-detect-z13-as-mininum-ar.patch,
  0008-S390-Add-z13-memmove-ifunc-variant.patch,
  0009-S390-Add-z13-strstr-ifunc-variant.patch,
  0010-S390-Add-z13-memmem-ifunc-variant.patch,
  0011-S390-Cleanup-ifunc-resolve.h.patch,
  0012-S390-Mark-vx-and-vxe-as-important-hwcap.patch,
  0013-S390-Add-new-hwcap-values-for-new-cpu-architecture-a.patch,
  0014-S390-Add-configure-check-to-detect-support-for-arch1.patch,
  0015-S390-Add-arch13-memmove-ifunc-variant.patch,
  0016-S390-Add-arch13-strstr-ifunc-variant.patch,
  0017-S390-Add-arch13-memmem-ifunc-variant.patch,
  prefer-map-32bit-exec.patch, s390-strstr-page-boundary.patch,
  ppc-tle-htm-nosc.patch,
  posix-Add-internal-symbols-for-posix_spawn-interface.patch,
  glibc-2.29-posix-Use-posix_spawn-on-popen.patch,
  backtrace-powerpc.patch, pthread-rwlock-pwn.patch,
  manual-memory-protection.patch, ldbl-96-rem-pio2l.patch,
  dl-sort-maps.patch, dlopen-filter-object.patch,
  glob-use-after-free.patch, nptl-setxid-race.patch, nscd-senfile.patch,
  ldd-system-interp.patch, abort-no-flush.patch,
  fnmatch-collating-elements.patch, nss-files-long-lines-2.patch,
  iconv-reset-input-buffer.patch, nscd-prune.patch, syslog-locking.patch:
  Removed.
- long-double-alias.patch, glibc-nsswitch-usr.diff, euc-kr-overrun.patch,
  riscv-syscall-clobber.patch, nscd-gc-cycle.patch: Added.</changelog>
  <changelog author="schwab@suse.de" date="1604923200">- power10-support.patch: Add support for POWER10 (jsc#SLE-13520)
- iconv-option-parsing.patch: Rewrite iconv option parsing
  (CVE-2016-10228, bsc#1027496, BZ #19519)</changelog>
  <changelog author="schwab@suse.de" date="1608120000">- aarch64-getauxval.patch: aarch64: Accept PLT calls to __getauxval within
  libc.so (bsc#1167939)
- iconv-redundant-shift.patch: iconv: Accept redundant shift sequences in
  IBM1364 (CVE-2020-27618, bsc#1178386, BZ #26224)
- iconv-ucs4-loop-bounds.patch: iconv: Fix incorrect UCS4 inner loop
  bounds (CVE-2020-29562, bsc#1179694, BZ #26923)
- printf-long-double-non-normal.patch: x86: Harden printf against
  non-normal long double values (CVE-2020-29573, bsc#1179721, BZ #26649)
- get-nprocs-cpu-online-parsing.patch: Fix parsing of
  /sys/devices/system/cpu/online (bsc#1180038, BZ #25859)</changelog>
  <changelog author="schwab@suse.de" date="1609848000">- sysvipc-sem-stat-any.patch: sysvipc: Fix SEM_STAT_ANY kernel argument
  pass (bsc#1180557, BZ #26637)</changelog>
  <changelog author="schwab@suse.de" date="1611835200">- gconv-assertion-iso-2022-jp.patch: gconv: Fix assertion failure in
  ISO-2022-JP-3 module (CVE-2021-3326, bsc#1181505, BZ #27256)</changelog>
  <changelog author="schwab@suse.de" date="1614772800">- nscd-netgroupcache.patch: nscd: Fix double free in netgroupcache
  (CVE-2021-27645, bsc#1182733, BZ #27462)</changelog>
  <changelog author="rguenther@suse.com" date="1615377600">- Add glibc-2.31-HTM-vzeroupper.diff to avoid VZEROUPPER in the
  AVX2 accelerated string routines which cause HTM transaction
  aborts.  Instead use EVEX or SSE.  (bsc#1181403)</changelog>
  <changelog author="rguenther@suse.com" date="1615377601">- Update glibc-2.31-HTM-vzeroupper.diff with a AVX-SSE transition
  fix.</changelog>
  <changelog author="schwab@suse.de" date="1617019200">- s390-memmove-ifunc-selector-arch13.patch: S390: Also check vector
  support in memmove ifunc-selector (bsc#1184035, BZ #27511)</changelog>
  <changelog author="schwab@suse.de" date="1625140800">- wordexp-param-overflow.patch: wordexp: handle overflow in positional
  parameter number (CVE-2021-35942, bsc#1187911, BZ #28011)</changelog>
  <changelog author="schwab@suse.de" date="1630584000">- mq-notify-use-after-free.patch: Use __pthread_attr_copy in mq_notify
  (CVE-2021-33574, bsc#1186489, BZ #27896)</changelog>
  <changelog author="schwab@suse.de" date="1636027200">- 0001-s390x-Align-child-stack-while-clone.-BZ-27968.patch,
  0002-S390-Optimize-__memcpy_z196.patch,
  0003-S390-Optimize-__memset_z196.patch,
  0004-S390-Sync-HWCAP-names-with-kernel-by-adding-aliases-.patch,
  0005-S390-Add-new-hwcap-values.patch,
  0006-S390-Add-PCI_MIO-and-SIE-HWCAPs.patch: [15sp4 FEAT] GNU2007 -
  GLIBC: Support for new IBM Z Hardware (bsc#1191592, jsc#IBM-869)</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1640174400">- Add support for livepatches (jsc#SLE-20049).
- Enable livepatching on x86_64.
- Generate ipa-clones tarball artifact when livepatching is enabled.</changelog>
  <changelog author="schwab@suse.de" date="1642420800">- clnt-create-unix-overflow.patch: Buffer overflow in sunrpc clnt_create
  for "unix" (CVE-2022-23219, bsc#1194768, BZ #22542)
- svcunix-create-overflow.patch: Buffer overflow in sunrpc svcunix_create
  (CVE-2022-23218, bsc#1194770, BZ #28768)</changelog>
  <changelog author="schwab@suse.de" date="1642593600">- 0001-powerpc-Optimized-strcpy-for-POWER9.patch,
  0002-powerpc-Optimized-stpcpy-for-POWER9.patch,
  0003-powerpc-Optimized-rawmemchr-for-POWER9.patch,
  0004-powerpc64le-add-optimized-strlen-for-P9.patch,
  0005-powerpc-fix-ifunc-implementation-list-for-POWER9-str.patch,
  0006-powerpc-Add-optimized-strncpy-for-POWER9.patch,
  0007-powerpc-Add-optimized-stpncpy-for-POWER9.patch,
  0008-powerpc-Add-optimized-ilogb-for-POWER9.patch,
  0009-powerpc-Add-optimized-llogb-for-POWER9.patch,
  0010-powerpc-Add-optimized-strlen-for-POWER10.patch,
  0011-powerpc64le-Optimized-memmove-for-POWER10.patch,
  0012-powerpc64le-Optimize-memcpy-for-POWER10.patch,
  0013-powerpc64le-Optimize-memset-for-POWER10.patch,
  0014-powerpc64le-Fix-ifunc-selection-for-memset-memmove-b.patch,
  0015-powerpc-Add-optimized-rawmemchr-for-POWER10.patch: ppc64le ifunc
  improvements (bsc#1194785, jsc#SLE-18195)</changelog>
  <changelog author="schwab@suse.de" date="1643025600">- getcwd-erange.patch: getcwd: Set errno to ERANGE for size == 1
  (CVE-2021-3999, bsc#1194640, BZ #28769)</changelog>
</package>
<package pkgid="8bc227df81839e9706735c3771318b5711bbd45c217a60944663972b7e3c71a1" name="glibc" arch="src">
  <version epoch="0" ver="2.31" rel="150300.9.12.1"/>
  <changelog author="schwab@suse.de" date="1583841600">- dl-sort-maps.patch, dlopen-filter-object.patch: Allow dlopen of filter
  object to work (bsc#1166106, BZ #16272)</changelog>
  <changelog author="schwab@suse.de" date="1585137600">- glob-use-after-free.patch: Fix use-after-free in glob when expanding
  ~user (CVE-2020-1752, bsc#1167631, BZ #25414)</changelog>
  <changelog author="schwab@suse.de" date="1589371200">- nptl-setxid-race.patch: nptl: wait for pending setxid request also in
  detached thread (bsc#1162930, BZ #25942)</changelog>
  <changelog author="schwab@suse.de" date="1593518400">- nscd-senfile.patch: Fix concurrent changes on nscd aware files
  (bsc#1171878, BZ #23178)
- nscd-prune.patch: nscd: bump GC cycle during cache pruning (bsc#1171878,
  BZ #26130)
- syslog-locking.patch: Correct locking and cancellation cleanup in syslog
  functions (bsc#1172085, BZ #26100)</changelog>
  <changelog author="schwab@suse.de" date="1599048000">- Update to glibc 2.31
- glibc-2.14-crypt.diff, crypt_blowfish-const.patch,
  crypt_blowfish-1.2-sha.diff, crypt_blowfish-gensalt.patch,
  crypt_blowfish-1.2-hack_around_arm.diff, glibc-nodate.patch,
  powerpc-elision-enable-envvar.patch, s390-elision-enable-envvar.patch,
  crt-nocompress-debug-sections.patch, resolv-context-leak.patch,
  dl-runtime-resolve-opt-avx512f.patch, libpthread-compat-wrappers.patch,
  math-c++-compat.patch, remove-nss-nis-compat.patch,
  eh-frame-zero-terminator.patch, ld-so-hwcap-x86-64.patch,
  assert-pedantic.patch, getaddrinfo-errno.patch, resolv-conf-oom.patch,
  dynarray-allocation.patch, nearbyint-inexact.patch, nss-compat.patch,
  nscd-libnsl.patch, malloc-tcache-leak.patch,
  falkor-memcpy-memmove.patch, aarch64-cpu-features.patch,
  nss-files-large-buffers.patch, sysconf-uio-maxiov.patch,
  glob-tilde-overflow.patch, dl-runtime-resolve-xsave.patch,
  spawni-assert.patch, x86-64-dl-platform.patch, glob64-s390.patch,
  tst-tlsopt-powerpc.patch, powerpc-hwcap-bits.patch,
  malloc-tcache-check-overflow.patch, dl-init-paths-overflow.patch,
  fillin-rpath-empty-tokens.patch, getcwd-absolute.patch,
  memalign-overflow.patch, stack-guard-size-accounting.patch,
  libgcc-rtld-now.patch, res-send-enomem.patch,
  glibc-fix-avx512-mempcpy.patch, i386-memmove-sse2-unaligned.patch,
  realpath-ssize-max-overflow.patch, localtime-2039.patch,
  math-remove-slow-path.patch, aarch64-hwcap-atomics.patch,
  glibc-fix-aarch64-build.diff, absolute-symbols.patch,
  x86-haswell-string-flags.patch,
  pthread-cond-broadcast-waiters-after-spinning.patch,
  mman-map-sync.patch, mman-linux-map-shared-validate.patch,
  nptl-setxid-error.patch, pthread-mutex-trylock-barrier.patch,
  getaddrinfo-parse-ipv4-address.patch, japanese-era-name-may-2019.patch,
  force-elision-race.patch, regex-read-overrun.patch,
  regex-parse-reg-exp.patch,
  0001-S390-Add-configure-check-to-detect-z10-as-mininum-ar.patch,
  0002-S390-Use-hwcap-instead-of-dl_hwcap-in-ifunc-resolver.patch,
  0003-S390-Unify-31-64bit-memcpy.patch,
  0004-S390-Refactor-memcpy-mempcpy-ifunc-handling.patch,
  0005-S390-Remove-s390-specific-implementation-of-bcopy.patch,
  0006-S390-Use-memcpy-for-forward-cases-in-memmove.patch,
  0007-S390-Add-configure-check-to-detect-z13-as-mininum-ar.patch,
  0008-S390-Add-z13-memmove-ifunc-variant.patch,
  0009-S390-Add-z13-strstr-ifunc-variant.patch,
  0010-S390-Add-z13-memmem-ifunc-variant.patch,
  0011-S390-Cleanup-ifunc-resolve.h.patch,
  0012-S390-Mark-vx-and-vxe-as-important-hwcap.patch,
  0013-S390-Add-new-hwcap-values-for-new-cpu-architecture-a.patch,
  0014-S390-Add-configure-check-to-detect-support-for-arch1.patch,
  0015-S390-Add-arch13-memmove-ifunc-variant.patch,
  0016-S390-Add-arch13-strstr-ifunc-variant.patch,
  0017-S390-Add-arch13-memmem-ifunc-variant.patch,
  prefer-map-32bit-exec.patch, s390-strstr-page-boundary.patch,
  ppc-tle-htm-nosc.patch,
  posix-Add-internal-symbols-for-posix_spawn-interface.patch,
  glibc-2.29-posix-Use-posix_spawn-on-popen.patch,
  backtrace-powerpc.patch, pthread-rwlock-pwn.patch,
  manual-memory-protection.patch, ldbl-96-rem-pio2l.patch,
  dl-sort-maps.patch, dlopen-filter-object.patch,
  glob-use-after-free.patch, nptl-setxid-race.patch, nscd-senfile.patch,
  ldd-system-interp.patch, abort-no-flush.patch,
  fnmatch-collating-elements.patch, nss-files-long-lines-2.patch,
  iconv-reset-input-buffer.patch, nscd-prune.patch, syslog-locking.patch:
  Removed.
- long-double-alias.patch, glibc-nsswitch-usr.diff, euc-kr-overrun.patch,
  riscv-syscall-clobber.patch, nscd-gc-cycle.patch: Added.</changelog>
  <changelog author="schwab@suse.de" date="1604923200">- power10-support.patch: Add support for POWER10 (jsc#SLE-13520)
- iconv-option-parsing.patch: Rewrite iconv option parsing
  (CVE-2016-10228, bsc#1027496, BZ #19519)</changelog>
  <changelog author="schwab@suse.de" date="1608120000">- aarch64-getauxval.patch: aarch64: Accept PLT calls to __getauxval within
  libc.so (bsc#1167939)
- iconv-redundant-shift.patch: iconv: Accept redundant shift sequences in
  IBM1364 (CVE-2020-27618, bsc#1178386, BZ #26224)
- iconv-ucs4-loop-bounds.patch: iconv: Fix incorrect UCS4 inner loop
  bounds (CVE-2020-29562, bsc#1179694, BZ #26923)
- printf-long-double-non-normal.patch: x86: Harden printf against
  non-normal long double values (CVE-2020-29573, bsc#1179721, BZ #26649)
- get-nprocs-cpu-online-parsing.patch: Fix parsing of
  /sys/devices/system/cpu/online (bsc#1180038, BZ #25859)</changelog>
  <changelog author="schwab@suse.de" date="1609848000">- sysvipc-sem-stat-any.patch: sysvipc: Fix SEM_STAT_ANY kernel argument
  pass (bsc#1180557, BZ #26637)</changelog>
  <changelog author="schwab@suse.de" date="1611835200">- gconv-assertion-iso-2022-jp.patch: gconv: Fix assertion failure in
  ISO-2022-JP-3 module (CVE-2021-3326, bsc#1181505, BZ #27256)</changelog>
  <changelog author="schwab@suse.de" date="1614772800">- nscd-netgroupcache.patch: nscd: Fix double free in netgroupcache
  (CVE-2021-27645, bsc#1182733, BZ #27462)</changelog>
  <changelog author="rguenther@suse.com" date="1615377600">- Add glibc-2.31-HTM-vzeroupper.diff to avoid VZEROUPPER in the
  AVX2 accelerated string routines which cause HTM transaction
  aborts.  Instead use EVEX or SSE.  (bsc#1181403)</changelog>
  <changelog author="rguenther@suse.com" date="1615377601">- Update glibc-2.31-HTM-vzeroupper.diff with a AVX-SSE transition
  fix.</changelog>
  <changelog author="schwab@suse.de" date="1617019200">- s390-memmove-ifunc-selector-arch13.patch: S390: Also check vector
  support in memmove ifunc-selector (bsc#1184035, BZ #27511)</changelog>
  <changelog author="schwab@suse.de" date="1625140800">- wordexp-param-overflow.patch: wordexp: handle overflow in positional
  parameter number (CVE-2021-35942, bsc#1187911, BZ #28011)</changelog>
  <changelog author="schwab@suse.de" date="1630584000">- mq-notify-use-after-free.patch: Use __pthread_attr_copy in mq_notify
  (CVE-2021-33574, bsc#1186489, BZ #27896)</changelog>
  <changelog author="schwab@suse.de" date="1636027200">- 0001-s390x-Align-child-stack-while-clone.-BZ-27968.patch,
  0002-S390-Optimize-__memcpy_z196.patch,
  0003-S390-Optimize-__memset_z196.patch,
  0004-S390-Sync-HWCAP-names-with-kernel-by-adding-aliases-.patch,
  0005-S390-Add-new-hwcap-values.patch,
  0006-S390-Add-PCI_MIO-and-SIE-HWCAPs.patch: [15sp4 FEAT] GNU2007 -
  GLIBC: Support for new IBM Z Hardware (bsc#1191592, jsc#IBM-869)</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1640174400">- Add support for livepatches (jsc#SLE-20049).
- Enable livepatching on x86_64.
- Generate ipa-clones tarball artifact when livepatching is enabled.</changelog>
  <changelog author="schwab@suse.de" date="1642420800">- clnt-create-unix-overflow.patch: Buffer overflow in sunrpc clnt_create
  for "unix" (CVE-2022-23219, bsc#1194768, BZ #22542)
- svcunix-create-overflow.patch: Buffer overflow in sunrpc svcunix_create
  (CVE-2022-23218, bsc#1194770, BZ #28768)</changelog>
  <changelog author="schwab@suse.de" date="1642593600">- 0001-powerpc-Optimized-strcpy-for-POWER9.patch,
  0002-powerpc-Optimized-stpcpy-for-POWER9.patch,
  0003-powerpc-Optimized-rawmemchr-for-POWER9.patch,
  0004-powerpc64le-add-optimized-strlen-for-P9.patch,
  0005-powerpc-fix-ifunc-implementation-list-for-POWER9-str.patch,
  0006-powerpc-Add-optimized-strncpy-for-POWER9.patch,
  0007-powerpc-Add-optimized-stpncpy-for-POWER9.patch,
  0008-powerpc-Add-optimized-ilogb-for-POWER9.patch,
  0009-powerpc-Add-optimized-llogb-for-POWER9.patch,
  0010-powerpc-Add-optimized-strlen-for-POWER10.patch,
  0011-powerpc64le-Optimized-memmove-for-POWER10.patch,
  0012-powerpc64le-Optimize-memcpy-for-POWER10.patch,
  0013-powerpc64le-Optimize-memset-for-POWER10.patch,
  0014-powerpc64le-Fix-ifunc-selection-for-memset-memmove-b.patch,
  0015-powerpc-Add-optimized-rawmemchr-for-POWER10.patch: ppc64le ifunc
  improvements (bsc#1194785, jsc#SLE-18195)</changelog>
  <changelog author="schwab@suse.de" date="1643025600">- getcwd-erange.patch: getcwd: Set errno to ERANGE for size == 1
  (CVE-2021-3999, bsc#1194640, BZ #28769)</changelog>
</package>
<package pkgid="b403340972b52b0e72fee57a7faac8c695bf6cce897a0a3af23c3f22299bf821" name="glibc" arch="x86_64">
  <version epoch="0" ver="2.31" rel="150300.9.12.1"/>
  <changelog author="schwab@suse.de" date="1583841600">- dl-sort-maps.patch, dlopen-filter-object.patch: Allow dlopen of filter
  object to work (bsc#1166106, BZ #16272)</changelog>
  <changelog author="schwab@suse.de" date="1585137600">- glob-use-after-free.patch: Fix use-after-free in glob when expanding
  ~user (CVE-2020-1752, bsc#1167631, BZ #25414)</changelog>
  <changelog author="schwab@suse.de" date="1589371200">- nptl-setxid-race.patch: nptl: wait for pending setxid request also in
  detached thread (bsc#1162930, BZ #25942)</changelog>
  <changelog author="schwab@suse.de" date="1593518400">- nscd-senfile.patch: Fix concurrent changes on nscd aware files
  (bsc#1171878, BZ #23178)
- nscd-prune.patch: nscd: bump GC cycle during cache pruning (bsc#1171878,
  BZ #26130)
- syslog-locking.patch: Correct locking and cancellation cleanup in syslog
  functions (bsc#1172085, BZ #26100)</changelog>
  <changelog author="schwab@suse.de" date="1599048000">- Update to glibc 2.31
- glibc-2.14-crypt.diff, crypt_blowfish-const.patch,
  crypt_blowfish-1.2-sha.diff, crypt_blowfish-gensalt.patch,
  crypt_blowfish-1.2-hack_around_arm.diff, glibc-nodate.patch,
  powerpc-elision-enable-envvar.patch, s390-elision-enable-envvar.patch,
  crt-nocompress-debug-sections.patch, resolv-context-leak.patch,
  dl-runtime-resolve-opt-avx512f.patch, libpthread-compat-wrappers.patch,
  math-c++-compat.patch, remove-nss-nis-compat.patch,
  eh-frame-zero-terminator.patch, ld-so-hwcap-x86-64.patch,
  assert-pedantic.patch, getaddrinfo-errno.patch, resolv-conf-oom.patch,
  dynarray-allocation.patch, nearbyint-inexact.patch, nss-compat.patch,
  nscd-libnsl.patch, malloc-tcache-leak.patch,
  falkor-memcpy-memmove.patch, aarch64-cpu-features.patch,
  nss-files-large-buffers.patch, sysconf-uio-maxiov.patch,
  glob-tilde-overflow.patch, dl-runtime-resolve-xsave.patch,
  spawni-assert.patch, x86-64-dl-platform.patch, glob64-s390.patch,
  tst-tlsopt-powerpc.patch, powerpc-hwcap-bits.patch,
  malloc-tcache-check-overflow.patch, dl-init-paths-overflow.patch,
  fillin-rpath-empty-tokens.patch, getcwd-absolute.patch,
  memalign-overflow.patch, stack-guard-size-accounting.patch,
  libgcc-rtld-now.patch, res-send-enomem.patch,
  glibc-fix-avx512-mempcpy.patch, i386-memmove-sse2-unaligned.patch,
  realpath-ssize-max-overflow.patch, localtime-2039.patch,
  math-remove-slow-path.patch, aarch64-hwcap-atomics.patch,
  glibc-fix-aarch64-build.diff, absolute-symbols.patch,
  x86-haswell-string-flags.patch,
  pthread-cond-broadcast-waiters-after-spinning.patch,
  mman-map-sync.patch, mman-linux-map-shared-validate.patch,
  nptl-setxid-error.patch, pthread-mutex-trylock-barrier.patch,
  getaddrinfo-parse-ipv4-address.patch, japanese-era-name-may-2019.patch,
  force-elision-race.patch, regex-read-overrun.patch,
  regex-parse-reg-exp.patch,
  0001-S390-Add-configure-check-to-detect-z10-as-mininum-ar.patch,
  0002-S390-Use-hwcap-instead-of-dl_hwcap-in-ifunc-resolver.patch,
  0003-S390-Unify-31-64bit-memcpy.patch,
  0004-S390-Refactor-memcpy-mempcpy-ifunc-handling.patch,
  0005-S390-Remove-s390-specific-implementation-of-bcopy.patch,
  0006-S390-Use-memcpy-for-forward-cases-in-memmove.patch,
  0007-S390-Add-configure-check-to-detect-z13-as-mininum-ar.patch,
  0008-S390-Add-z13-memmove-ifunc-variant.patch,
  0009-S390-Add-z13-strstr-ifunc-variant.patch,
  0010-S390-Add-z13-memmem-ifunc-variant.patch,
  0011-S390-Cleanup-ifunc-resolve.h.patch,
  0012-S390-Mark-vx-and-vxe-as-important-hwcap.patch,
  0013-S390-Add-new-hwcap-values-for-new-cpu-architecture-a.patch,
  0014-S390-Add-configure-check-to-detect-support-for-arch1.patch,
  0015-S390-Add-arch13-memmove-ifunc-variant.patch,
  0016-S390-Add-arch13-strstr-ifunc-variant.patch,
  0017-S390-Add-arch13-memmem-ifunc-variant.patch,
  prefer-map-32bit-exec.patch, s390-strstr-page-boundary.patch,
  ppc-tle-htm-nosc.patch,
  posix-Add-internal-symbols-for-posix_spawn-interface.patch,
  glibc-2.29-posix-Use-posix_spawn-on-popen.patch,
  backtrace-powerpc.patch, pthread-rwlock-pwn.patch,
  manual-memory-protection.patch, ldbl-96-rem-pio2l.patch,
  dl-sort-maps.patch, dlopen-filter-object.patch,
  glob-use-after-free.patch, nptl-setxid-race.patch, nscd-senfile.patch,
  ldd-system-interp.patch, abort-no-flush.patch,
  fnmatch-collating-elements.patch, nss-files-long-lines-2.patch,
  iconv-reset-input-buffer.patch, nscd-prune.patch, syslog-locking.patch:
  Removed.
- long-double-alias.patch, glibc-nsswitch-usr.diff, euc-kr-overrun.patch,
  riscv-syscall-clobber.patch, nscd-gc-cycle.patch: Added.</changelog>
  <changelog author="schwab@suse.de" date="1604923200">- power10-support.patch: Add support for POWER10 (jsc#SLE-13520)
- iconv-option-parsing.patch: Rewrite iconv option parsing
  (CVE-2016-10228, bsc#1027496, BZ #19519)</changelog>
  <changelog author="schwab@suse.de" date="1608120000">- aarch64-getauxval.patch: aarch64: Accept PLT calls to __getauxval within
  libc.so (bsc#1167939)
- iconv-redundant-shift.patch: iconv: Accept redundant shift sequences in
  IBM1364 (CVE-2020-27618, bsc#1178386, BZ #26224)
- iconv-ucs4-loop-bounds.patch: iconv: Fix incorrect UCS4 inner loop
  bounds (CVE-2020-29562, bsc#1179694, BZ #26923)
- printf-long-double-non-normal.patch: x86: Harden printf against
  non-normal long double values (CVE-2020-29573, bsc#1179721, BZ #26649)
- get-nprocs-cpu-online-parsing.patch: Fix parsing of
  /sys/devices/system/cpu/online (bsc#1180038, BZ #25859)</changelog>
  <changelog author="schwab@suse.de" date="1609848000">- sysvipc-sem-stat-any.patch: sysvipc: Fix SEM_STAT_ANY kernel argument
  pass (bsc#1180557, BZ #26637)</changelog>
  <changelog author="schwab@suse.de" date="1611835200">- gconv-assertion-iso-2022-jp.patch: gconv: Fix assertion failure in
  ISO-2022-JP-3 module (CVE-2021-3326, bsc#1181505, BZ #27256)</changelog>
  <changelog author="schwab@suse.de" date="1614772800">- nscd-netgroupcache.patch: nscd: Fix double free in netgroupcache
  (CVE-2021-27645, bsc#1182733, BZ #27462)</changelog>
  <changelog author="rguenther@suse.com" date="1615377600">- Add glibc-2.31-HTM-vzeroupper.diff to avoid VZEROUPPER in the
  AVX2 accelerated string routines which cause HTM transaction
  aborts.  Instead use EVEX or SSE.  (bsc#1181403)</changelog>
  <changelog author="rguenther@suse.com" date="1615377601">- Update glibc-2.31-HTM-vzeroupper.diff with a AVX-SSE transition
  fix.</changelog>
  <changelog author="schwab@suse.de" date="1617019200">- s390-memmove-ifunc-selector-arch13.patch: S390: Also check vector
  support in memmove ifunc-selector (bsc#1184035, BZ #27511)</changelog>
  <changelog author="schwab@suse.de" date="1625140800">- wordexp-param-overflow.patch: wordexp: handle overflow in positional
  parameter number (CVE-2021-35942, bsc#1187911, BZ #28011)</changelog>
  <changelog author="schwab@suse.de" date="1630584000">- mq-notify-use-after-free.patch: Use __pthread_attr_copy in mq_notify
  (CVE-2021-33574, bsc#1186489, BZ #27896)</changelog>
  <changelog author="schwab@suse.de" date="1636027200">- 0001-s390x-Align-child-stack-while-clone.-BZ-27968.patch,
  0002-S390-Optimize-__memcpy_z196.patch,
  0003-S390-Optimize-__memset_z196.patch,
  0004-S390-Sync-HWCAP-names-with-kernel-by-adding-aliases-.patch,
  0005-S390-Add-new-hwcap-values.patch,
  0006-S390-Add-PCI_MIO-and-SIE-HWCAPs.patch: [15sp4 FEAT] GNU2007 -
  GLIBC: Support for new IBM Z Hardware (bsc#1191592, jsc#IBM-869)</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1640174400">- Add support for livepatches (jsc#SLE-20049).
- Enable livepatching on x86_64.
- Generate ipa-clones tarball artifact when livepatching is enabled.</changelog>
  <changelog author="schwab@suse.de" date="1642420800">- clnt-create-unix-overflow.patch: Buffer overflow in sunrpc clnt_create
  for "unix" (CVE-2022-23219, bsc#1194768, BZ #22542)
- svcunix-create-overflow.patch: Buffer overflow in sunrpc svcunix_create
  (CVE-2022-23218, bsc#1194770, BZ #28768)</changelog>
  <changelog author="schwab@suse.de" date="1642593600">- 0001-powerpc-Optimized-strcpy-for-POWER9.patch,
  0002-powerpc-Optimized-stpcpy-for-POWER9.patch,
  0003-powerpc-Optimized-rawmemchr-for-POWER9.patch,
  0004-powerpc64le-add-optimized-strlen-for-P9.patch,
  0005-powerpc-fix-ifunc-implementation-list-for-POWER9-str.patch,
  0006-powerpc-Add-optimized-strncpy-for-POWER9.patch,
  0007-powerpc-Add-optimized-stpncpy-for-POWER9.patch,
  0008-powerpc-Add-optimized-ilogb-for-POWER9.patch,
  0009-powerpc-Add-optimized-llogb-for-POWER9.patch,
  0010-powerpc-Add-optimized-strlen-for-POWER10.patch,
  0011-powerpc64le-Optimized-memmove-for-POWER10.patch,
  0012-powerpc64le-Optimize-memcpy-for-POWER10.patch,
  0013-powerpc64le-Optimize-memset-for-POWER10.patch,
  0014-powerpc64le-Fix-ifunc-selection-for-memset-memmove-b.patch,
  0015-powerpc-Add-optimized-rawmemchr-for-POWER10.patch: ppc64le ifunc
  improvements (bsc#1194785, jsc#SLE-18195)</changelog>
  <changelog author="schwab@suse.de" date="1643025600">- getcwd-erange.patch: getcwd: Set errno to ERANGE for size == 1
  (CVE-2021-3999, bsc#1194640, BZ #28769)</changelog>
</package>
<package pkgid="a58a042c2130bbccc718697c921c4f381c00eeed745ba96b05d2471c24644385" name="glibc-32bit" arch="x86_64">
  <version epoch="0" ver="2.31" rel="150300.9.12.1"/>
  <changelog author="schwab@suse.de" date="1583841600">- dl-sort-maps.patch, dlopen-filter-object.patch: Allow dlopen of filter
  object to work (bsc#1166106, BZ #16272)</changelog>
  <changelog author="schwab@suse.de" date="1585137600">- glob-use-after-free.patch: Fix use-after-free in glob when expanding
  ~user (CVE-2020-1752, bsc#1167631, BZ #25414)</changelog>
  <changelog author="schwab@suse.de" date="1589371200">- nptl-setxid-race.patch: nptl: wait for pending setxid request also in
  detached thread (bsc#1162930, BZ #25942)</changelog>
  <changelog author="schwab@suse.de" date="1593518400">- nscd-senfile.patch: Fix concurrent changes on nscd aware files
  (bsc#1171878, BZ #23178)
- nscd-prune.patch: nscd: bump GC cycle during cache pruning (bsc#1171878,
  BZ #26130)
- syslog-locking.patch: Correct locking and cancellation cleanup in syslog
  functions (bsc#1172085, BZ #26100)</changelog>
  <changelog author="schwab@suse.de" date="1599048000">- Update to glibc 2.31
- glibc-2.14-crypt.diff, crypt_blowfish-const.patch,
  crypt_blowfish-1.2-sha.diff, crypt_blowfish-gensalt.patch,
  crypt_blowfish-1.2-hack_around_arm.diff, glibc-nodate.patch,
  powerpc-elision-enable-envvar.patch, s390-elision-enable-envvar.patch,
  crt-nocompress-debug-sections.patch, resolv-context-leak.patch,
  dl-runtime-resolve-opt-avx512f.patch, libpthread-compat-wrappers.patch,
  math-c++-compat.patch, remove-nss-nis-compat.patch,
  eh-frame-zero-terminator.patch, ld-so-hwcap-x86-64.patch,
  assert-pedantic.patch, getaddrinfo-errno.patch, resolv-conf-oom.patch,
  dynarray-allocation.patch, nearbyint-inexact.patch, nss-compat.patch,
  nscd-libnsl.patch, malloc-tcache-leak.patch,
  falkor-memcpy-memmove.patch, aarch64-cpu-features.patch,
  nss-files-large-buffers.patch, sysconf-uio-maxiov.patch,
  glob-tilde-overflow.patch, dl-runtime-resolve-xsave.patch,
  spawni-assert.patch, x86-64-dl-platform.patch, glob64-s390.patch,
  tst-tlsopt-powerpc.patch, powerpc-hwcap-bits.patch,
  malloc-tcache-check-overflow.patch, dl-init-paths-overflow.patch,
  fillin-rpath-empty-tokens.patch, getcwd-absolute.patch,
  memalign-overflow.patch, stack-guard-size-accounting.patch,
  libgcc-rtld-now.patch, res-send-enomem.patch,
  glibc-fix-avx512-mempcpy.patch, i386-memmove-sse2-unaligned.patch,
  realpath-ssize-max-overflow.patch, localtime-2039.patch,
  math-remove-slow-path.patch, aarch64-hwcap-atomics.patch,
  glibc-fix-aarch64-build.diff, absolute-symbols.patch,
  x86-haswell-string-flags.patch,
  pthread-cond-broadcast-waiters-after-spinning.patch,
  mman-map-sync.patch, mman-linux-map-shared-validate.patch,
  nptl-setxid-error.patch, pthread-mutex-trylock-barrier.patch,
  getaddrinfo-parse-ipv4-address.patch, japanese-era-name-may-2019.patch,
  force-elision-race.patch, regex-read-overrun.patch,
  regex-parse-reg-exp.patch,
  0001-S390-Add-configure-check-to-detect-z10-as-mininum-ar.patch,
  0002-S390-Use-hwcap-instead-of-dl_hwcap-in-ifunc-resolver.patch,
  0003-S390-Unify-31-64bit-memcpy.patch,
  0004-S390-Refactor-memcpy-mempcpy-ifunc-handling.patch,
  0005-S390-Remove-s390-specific-implementation-of-bcopy.patch,
  0006-S390-Use-memcpy-for-forward-cases-in-memmove.patch,
  0007-S390-Add-configure-check-to-detect-z13-as-mininum-ar.patch,
  0008-S390-Add-z13-memmove-ifunc-variant.patch,
  0009-S390-Add-z13-strstr-ifunc-variant.patch,
  0010-S390-Add-z13-memmem-ifunc-variant.patch,
  0011-S390-Cleanup-ifunc-resolve.h.patch,
  0012-S390-Mark-vx-and-vxe-as-important-hwcap.patch,
  0013-S390-Add-new-hwcap-values-for-new-cpu-architecture-a.patch,
  0014-S390-Add-configure-check-to-detect-support-for-arch1.patch,
  0015-S390-Add-arch13-memmove-ifunc-variant.patch,
  0016-S390-Add-arch13-strstr-ifunc-variant.patch,
  0017-S390-Add-arch13-memmem-ifunc-variant.patch,
  prefer-map-32bit-exec.patch, s390-strstr-page-boundary.patch,
  ppc-tle-htm-nosc.patch,
  posix-Add-internal-symbols-for-posix_spawn-interface.patch,
  glibc-2.29-posix-Use-posix_spawn-on-popen.patch,
  backtrace-powerpc.patch, pthread-rwlock-pwn.patch,
  manual-memory-protection.patch, ldbl-96-rem-pio2l.patch,
  dl-sort-maps.patch, dlopen-filter-object.patch,
  glob-use-after-free.patch, nptl-setxid-race.patch, nscd-senfile.patch,
  ldd-system-interp.patch, abort-no-flush.patch,
  fnmatch-collating-elements.patch, nss-files-long-lines-2.patch,
  iconv-reset-input-buffer.patch, nscd-prune.patch, syslog-locking.patch:
  Removed.
- long-double-alias.patch, glibc-nsswitch-usr.diff, euc-kr-overrun.patch,
  riscv-syscall-clobber.patch, nscd-gc-cycle.patch: Added.</changelog>
  <changelog author="schwab@suse.de" date="1604923200">- power10-support.patch: Add support for POWER10 (jsc#SLE-13520)
- iconv-option-parsing.patch: Rewrite iconv option parsing
  (CVE-2016-10228, bsc#1027496, BZ #19519)</changelog>
  <changelog author="schwab@suse.de" date="1608120000">- aarch64-getauxval.patch: aarch64: Accept PLT calls to __getauxval within
  libc.so (bsc#1167939)
- iconv-redundant-shift.patch: iconv: Accept redundant shift sequences in
  IBM1364 (CVE-2020-27618, bsc#1178386, BZ #26224)
- iconv-ucs4-loop-bounds.patch: iconv: Fix incorrect UCS4 inner loop
  bounds (CVE-2020-29562, bsc#1179694, BZ #26923)
- printf-long-double-non-normal.patch: x86: Harden printf against
  non-normal long double values (CVE-2020-29573, bsc#1179721, BZ #26649)
- get-nprocs-cpu-online-parsing.patch: Fix parsing of
  /sys/devices/system/cpu/online (bsc#1180038, BZ #25859)</changelog>
  <changelog author="schwab@suse.de" date="1609848000">- sysvipc-sem-stat-any.patch: sysvipc: Fix SEM_STAT_ANY kernel argument
  pass (bsc#1180557, BZ #26637)</changelog>
  <changelog author="schwab@suse.de" date="1611835200">- gconv-assertion-iso-2022-jp.patch: gconv: Fix assertion failure in
  ISO-2022-JP-3 module (CVE-2021-3326, bsc#1181505, BZ #27256)</changelog>
  <changelog author="schwab@suse.de" date="1614772800">- nscd-netgroupcache.patch: nscd: Fix double free in netgroupcache
  (CVE-2021-27645, bsc#1182733, BZ #27462)</changelog>
  <changelog author="rguenther@suse.com" date="1615377600">- Add glibc-2.31-HTM-vzeroupper.diff to avoid VZEROUPPER in the
  AVX2 accelerated string routines which cause HTM transaction
  aborts.  Instead use EVEX or SSE.  (bsc#1181403)</changelog>
  <changelog author="rguenther@suse.com" date="1615377601">- Update glibc-2.31-HTM-vzeroupper.diff with a AVX-SSE transition
  fix.</changelog>
  <changelog author="schwab@suse.de" date="1617019200">- s390-memmove-ifunc-selector-arch13.patch: S390: Also check vector
  support in memmove ifunc-selector (bsc#1184035, BZ #27511)</changelog>
  <changelog author="schwab@suse.de" date="1625140800">- wordexp-param-overflow.patch: wordexp: handle overflow in positional
  parameter number (CVE-2021-35942, bsc#1187911, BZ #28011)</changelog>
  <changelog author="schwab@suse.de" date="1630584000">- mq-notify-use-after-free.patch: Use __pthread_attr_copy in mq_notify
  (CVE-2021-33574, bsc#1186489, BZ #27896)</changelog>
  <changelog author="schwab@suse.de" date="1636027200">- 0001-s390x-Align-child-stack-while-clone.-BZ-27968.patch,
  0002-S390-Optimize-__memcpy_z196.patch,
  0003-S390-Optimize-__memset_z196.patch,
  0004-S390-Sync-HWCAP-names-with-kernel-by-adding-aliases-.patch,
  0005-S390-Add-new-hwcap-values.patch,
  0006-S390-Add-PCI_MIO-and-SIE-HWCAPs.patch: [15sp4 FEAT] GNU2007 -
  GLIBC: Support for new IBM Z Hardware (bsc#1191592, jsc#IBM-869)</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1640174400">- Add support for livepatches (jsc#SLE-20049).
- Enable livepatching on x86_64.
- Generate ipa-clones tarball artifact when livepatching is enabled.</changelog>
  <changelog author="schwab@suse.de" date="1642420800">- clnt-create-unix-overflow.patch: Buffer overflow in sunrpc clnt_create
  for "unix" (CVE-2022-23219, bsc#1194768, BZ #22542)
- svcunix-create-overflow.patch: Buffer overflow in sunrpc svcunix_create
  (CVE-2022-23218, bsc#1194770, BZ #28768)</changelog>
  <changelog author="schwab@suse.de" date="1642593600">- 0001-powerpc-Optimized-strcpy-for-POWER9.patch,
  0002-powerpc-Optimized-stpcpy-for-POWER9.patch,
  0003-powerpc-Optimized-rawmemchr-for-POWER9.patch,
  0004-powerpc64le-add-optimized-strlen-for-P9.patch,
  0005-powerpc-fix-ifunc-implementation-list-for-POWER9-str.patch,
  0006-powerpc-Add-optimized-strncpy-for-POWER9.patch,
  0007-powerpc-Add-optimized-stpncpy-for-POWER9.patch,
  0008-powerpc-Add-optimized-ilogb-for-POWER9.patch,
  0009-powerpc-Add-optimized-llogb-for-POWER9.patch,
  0010-powerpc-Add-optimized-strlen-for-POWER10.patch,
  0011-powerpc64le-Optimized-memmove-for-POWER10.patch,
  0012-powerpc64le-Optimize-memcpy-for-POWER10.patch,
  0013-powerpc64le-Optimize-memset-for-POWER10.patch,
  0014-powerpc64le-Fix-ifunc-selection-for-memset-memmove-b.patch,
  0015-powerpc-Add-optimized-rawmemchr-for-POWER10.patch: ppc64le ifunc
  improvements (bsc#1194785, jsc#SLE-18195)</changelog>
  <changelog author="schwab@suse.de" date="1643025600">- getcwd-erange.patch: getcwd: Set errno to ERANGE for size == 1
  (CVE-2021-3999, bsc#1194640, BZ #28769)</changelog>
</package>
<package pkgid="14909693a287bfb0fcd88a1ab165698085163646f880a25ad8088cbc87e63c48" name="glibc-devel" arch="aarch64">
  <version epoch="0" ver="2.31" rel="150300.9.12.1"/>
  <changelog author="schwab@suse.de" date="1583841600">- dl-sort-maps.patch, dlopen-filter-object.patch: Allow dlopen of filter
  object to work (bsc#1166106, BZ #16272)</changelog>
  <changelog author="schwab@suse.de" date="1585137600">- glob-use-after-free.patch: Fix use-after-free in glob when expanding
  ~user (CVE-2020-1752, bsc#1167631, BZ #25414)</changelog>
  <changelog author="schwab@suse.de" date="1589371200">- nptl-setxid-race.patch: nptl: wait for pending setxid request also in
  detached thread (bsc#1162930, BZ #25942)</changelog>
  <changelog author="schwab@suse.de" date="1593518400">- nscd-senfile.patch: Fix concurrent changes on nscd aware files
  (bsc#1171878, BZ #23178)
- nscd-prune.patch: nscd: bump GC cycle during cache pruning (bsc#1171878,
  BZ #26130)
- syslog-locking.patch: Correct locking and cancellation cleanup in syslog
  functions (bsc#1172085, BZ #26100)</changelog>
  <changelog author="schwab@suse.de" date="1599048000">- Update to glibc 2.31
- glibc-2.14-crypt.diff, crypt_blowfish-const.patch,
  crypt_blowfish-1.2-sha.diff, crypt_blowfish-gensalt.patch,
  crypt_blowfish-1.2-hack_around_arm.diff, glibc-nodate.patch,
  powerpc-elision-enable-envvar.patch, s390-elision-enable-envvar.patch,
  crt-nocompress-debug-sections.patch, resolv-context-leak.patch,
  dl-runtime-resolve-opt-avx512f.patch, libpthread-compat-wrappers.patch,
  math-c++-compat.patch, remove-nss-nis-compat.patch,
  eh-frame-zero-terminator.patch, ld-so-hwcap-x86-64.patch,
  assert-pedantic.patch, getaddrinfo-errno.patch, resolv-conf-oom.patch,
  dynarray-allocation.patch, nearbyint-inexact.patch, nss-compat.patch,
  nscd-libnsl.patch, malloc-tcache-leak.patch,
  falkor-memcpy-memmove.patch, aarch64-cpu-features.patch,
  nss-files-large-buffers.patch, sysconf-uio-maxiov.patch,
  glob-tilde-overflow.patch, dl-runtime-resolve-xsave.patch,
  spawni-assert.patch, x86-64-dl-platform.patch, glob64-s390.patch,
  tst-tlsopt-powerpc.patch, powerpc-hwcap-bits.patch,
  malloc-tcache-check-overflow.patch, dl-init-paths-overflow.patch,
  fillin-rpath-empty-tokens.patch, getcwd-absolute.patch,
  memalign-overflow.patch, stack-guard-size-accounting.patch,
  libgcc-rtld-now.patch, res-send-enomem.patch,
  glibc-fix-avx512-mempcpy.patch, i386-memmove-sse2-unaligned.patch,
  realpath-ssize-max-overflow.patch, localtime-2039.patch,
  math-remove-slow-path.patch, aarch64-hwcap-atomics.patch,
  glibc-fix-aarch64-build.diff, absolute-symbols.patch,
  x86-haswell-string-flags.patch,
  pthread-cond-broadcast-waiters-after-spinning.patch,
  mman-map-sync.patch, mman-linux-map-shared-validate.patch,
  nptl-setxid-error.patch, pthread-mutex-trylock-barrier.patch,
  getaddrinfo-parse-ipv4-address.patch, japanese-era-name-may-2019.patch,
  force-elision-race.patch, regex-read-overrun.patch,
  regex-parse-reg-exp.patch,
  0001-S390-Add-configure-check-to-detect-z10-as-mininum-ar.patch,
  0002-S390-Use-hwcap-instead-of-dl_hwcap-in-ifunc-resolver.patch,
  0003-S390-Unify-31-64bit-memcpy.patch,
  0004-S390-Refactor-memcpy-mempcpy-ifunc-handling.patch,
  0005-S390-Remove-s390-specific-implementation-of-bcopy.patch,
  0006-S390-Use-memcpy-for-forward-cases-in-memmove.patch,
  0007-S390-Add-configure-check-to-detect-z13-as-mininum-ar.patch,
  0008-S390-Add-z13-memmove-ifunc-variant.patch,
  0009-S390-Add-z13-strstr-ifunc-variant.patch,
  0010-S390-Add-z13-memmem-ifunc-variant.patch,
  0011-S390-Cleanup-ifunc-resolve.h.patch,
  0012-S390-Mark-vx-and-vxe-as-important-hwcap.patch,
  0013-S390-Add-new-hwcap-values-for-new-cpu-architecture-a.patch,
  0014-S390-Add-configure-check-to-detect-support-for-arch1.patch,
  0015-S390-Add-arch13-memmove-ifunc-variant.patch,
  0016-S390-Add-arch13-strstr-ifunc-variant.patch,
  0017-S390-Add-arch13-memmem-ifunc-variant.patch,
  prefer-map-32bit-exec.patch, s390-strstr-page-boundary.patch,
  ppc-tle-htm-nosc.patch,
  posix-Add-internal-symbols-for-posix_spawn-interface.patch,
  glibc-2.29-posix-Use-posix_spawn-on-popen.patch,
  backtrace-powerpc.patch, pthread-rwlock-pwn.patch,
  manual-memory-protection.patch, ldbl-96-rem-pio2l.patch,
  dl-sort-maps.patch, dlopen-filter-object.patch,
  glob-use-after-free.patch, nptl-setxid-race.patch, nscd-senfile.patch,
  ldd-system-interp.patch, abort-no-flush.patch,
  fnmatch-collating-elements.patch, nss-files-long-lines-2.patch,
  iconv-reset-input-buffer.patch, nscd-prune.patch, syslog-locking.patch:
  Removed.
- long-double-alias.patch, glibc-nsswitch-usr.diff, euc-kr-overrun.patch,
  riscv-syscall-clobber.patch, nscd-gc-cycle.patch: Added.</changelog>
  <changelog author="schwab@suse.de" date="1604923200">- power10-support.patch: Add support for POWER10 (jsc#SLE-13520)
- iconv-option-parsing.patch: Rewrite iconv option parsing
  (CVE-2016-10228, bsc#1027496, BZ #19519)</changelog>
  <changelog author="schwab@suse.de" date="1608120000">- aarch64-getauxval.patch: aarch64: Accept PLT calls to __getauxval within
  libc.so (bsc#1167939)
- iconv-redundant-shift.patch: iconv: Accept redundant shift sequences in
  IBM1364 (CVE-2020-27618, bsc#1178386, BZ #26224)
- iconv-ucs4-loop-bounds.patch: iconv: Fix incorrect UCS4 inner loop
  bounds (CVE-2020-29562, bsc#1179694, BZ #26923)
- printf-long-double-non-normal.patch: x86: Harden printf against
  non-normal long double values (CVE-2020-29573, bsc#1179721, BZ #26649)
- get-nprocs-cpu-online-parsing.patch: Fix parsing of
  /sys/devices/system/cpu/online (bsc#1180038, BZ #25859)</changelog>
  <changelog author="schwab@suse.de" date="1609848000">- sysvipc-sem-stat-any.patch: sysvipc: Fix SEM_STAT_ANY kernel argument
  pass (bsc#1180557, BZ #26637)</changelog>
  <changelog author="schwab@suse.de" date="1611835200">- gconv-assertion-iso-2022-jp.patch: gconv: Fix assertion failure in
  ISO-2022-JP-3 module (CVE-2021-3326, bsc#1181505, BZ #27256)</changelog>
  <changelog author="schwab@suse.de" date="1614772800">- nscd-netgroupcache.patch: nscd: Fix double free in netgroupcache
  (CVE-2021-27645, bsc#1182733, BZ #27462)</changelog>
  <changelog author="rguenther@suse.com" date="1615377600">- Add glibc-2.31-HTM-vzeroupper.diff to avoid VZEROUPPER in the
  AVX2 accelerated string routines which cause HTM transaction
  aborts.  Instead use EVEX or SSE.  (bsc#1181403)</changelog>
  <changelog author="rguenther@suse.com" date="1615377601">- Update glibc-2.31-HTM-vzeroupper.diff with a AVX-SSE transition
  fix.</changelog>
  <changelog author="schwab@suse.de" date="1617019200">- s390-memmove-ifunc-selector-arch13.patch: S390: Also check vector
  support in memmove ifunc-selector (bsc#1184035, BZ #27511)</changelog>
  <changelog author="schwab@suse.de" date="1625140800">- wordexp-param-overflow.patch: wordexp: handle overflow in positional
  parameter number (CVE-2021-35942, bsc#1187911, BZ #28011)</changelog>
  <changelog author="schwab@suse.de" date="1630584000">- mq-notify-use-after-free.patch: Use __pthread_attr_copy in mq_notify
  (CVE-2021-33574, bsc#1186489, BZ #27896)</changelog>
  <changelog author="schwab@suse.de" date="1636027200">- 0001-s390x-Align-child-stack-while-clone.-BZ-27968.patch,
  0002-S390-Optimize-__memcpy_z196.patch,
  0003-S390-Optimize-__memset_z196.patch,
  0004-S390-Sync-HWCAP-names-with-kernel-by-adding-aliases-.patch,
  0005-S390-Add-new-hwcap-values.patch,
  0006-S390-Add-PCI_MIO-and-SIE-HWCAPs.patch: [15sp4 FEAT] GNU2007 -
  GLIBC: Support for new IBM Z Hardware (bsc#1191592, jsc#IBM-869)</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1640174400">- Add support for livepatches (jsc#SLE-20049).
- Enable livepatching on x86_64.
- Generate ipa-clones tarball artifact when livepatching is enabled.</changelog>
  <changelog author="schwab@suse.de" date="1642420800">- clnt-create-unix-overflow.patch: Buffer overflow in sunrpc clnt_create
  for "unix" (CVE-2022-23219, bsc#1194768, BZ #22542)
- svcunix-create-overflow.patch: Buffer overflow in sunrpc svcunix_create
  (CVE-2022-23218, bsc#1194770, BZ #28768)</changelog>
  <changelog author="schwab@suse.de" date="1642593600">- 0001-powerpc-Optimized-strcpy-for-POWER9.patch,
  0002-powerpc-Optimized-stpcpy-for-POWER9.patch,
  0003-powerpc-Optimized-rawmemchr-for-POWER9.patch,
  0004-powerpc64le-add-optimized-strlen-for-P9.patch,
  0005-powerpc-fix-ifunc-implementation-list-for-POWER9-str.patch,
  0006-powerpc-Add-optimized-strncpy-for-POWER9.patch,
  0007-powerpc-Add-optimized-stpncpy-for-POWER9.patch,
  0008-powerpc-Add-optimized-ilogb-for-POWER9.patch,
  0009-powerpc-Add-optimized-llogb-for-POWER9.patch,
  0010-powerpc-Add-optimized-strlen-for-POWER10.patch,
  0011-powerpc64le-Optimized-memmove-for-POWER10.patch,
  0012-powerpc64le-Optimize-memcpy-for-POWER10.patch,
  0013-powerpc64le-Optimize-memset-for-POWER10.patch,
  0014-powerpc64le-Fix-ifunc-selection-for-memset-memmove-b.patch,
  0015-powerpc-Add-optimized-rawmemchr-for-POWER10.patch: ppc64le ifunc
  improvements (bsc#1194785, jsc#SLE-18195)</changelog>
  <changelog author="schwab@suse.de" date="1643025600">- getcwd-erange.patch: getcwd: Set errno to ERANGE for size == 1
  (CVE-2021-3999, bsc#1194640, BZ #28769)</changelog>
</package>
<package pkgid="829908861f6b2320dc6d1a9e54f7dca6cf810afd3a9ff45807729e8dd365ce26" name="glibc-devel" arch="ppc64le">
  <version epoch="0" ver="2.31" rel="150300.9.12.1"/>
  <changelog author="schwab@suse.de" date="1583841600">- dl-sort-maps.patch, dlopen-filter-object.patch: Allow dlopen of filter
  object to work (bsc#1166106, BZ #16272)</changelog>
  <changelog author="schwab@suse.de" date="1585137600">- glob-use-after-free.patch: Fix use-after-free in glob when expanding
  ~user (CVE-2020-1752, bsc#1167631, BZ #25414)</changelog>
  <changelog author="schwab@suse.de" date="1589371200">- nptl-setxid-race.patch: nptl: wait for pending setxid request also in
  detached thread (bsc#1162930, BZ #25942)</changelog>
  <changelog author="schwab@suse.de" date="1593518400">- nscd-senfile.patch: Fix concurrent changes on nscd aware files
  (bsc#1171878, BZ #23178)
- nscd-prune.patch: nscd: bump GC cycle during cache pruning (bsc#1171878,
  BZ #26130)
- syslog-locking.patch: Correct locking and cancellation cleanup in syslog
  functions (bsc#1172085, BZ #26100)</changelog>
  <changelog author="schwab@suse.de" date="1599048000">- Update to glibc 2.31
- glibc-2.14-crypt.diff, crypt_blowfish-const.patch,
  crypt_blowfish-1.2-sha.diff, crypt_blowfish-gensalt.patch,
  crypt_blowfish-1.2-hack_around_arm.diff, glibc-nodate.patch,
  powerpc-elision-enable-envvar.patch, s390-elision-enable-envvar.patch,
  crt-nocompress-debug-sections.patch, resolv-context-leak.patch,
  dl-runtime-resolve-opt-avx512f.patch, libpthread-compat-wrappers.patch,
  math-c++-compat.patch, remove-nss-nis-compat.patch,
  eh-frame-zero-terminator.patch, ld-so-hwcap-x86-64.patch,
  assert-pedantic.patch, getaddrinfo-errno.patch, resolv-conf-oom.patch,
  dynarray-allocation.patch, nearbyint-inexact.patch, nss-compat.patch,
  nscd-libnsl.patch, malloc-tcache-leak.patch,
  falkor-memcpy-memmove.patch, aarch64-cpu-features.patch,
  nss-files-large-buffers.patch, sysconf-uio-maxiov.patch,
  glob-tilde-overflow.patch, dl-runtime-resolve-xsave.patch,
  spawni-assert.patch, x86-64-dl-platform.patch, glob64-s390.patch,
  tst-tlsopt-powerpc.patch, powerpc-hwcap-bits.patch,
  malloc-tcache-check-overflow.patch, dl-init-paths-overflow.patch,
  fillin-rpath-empty-tokens.patch, getcwd-absolute.patch,
  memalign-overflow.patch, stack-guard-size-accounting.patch,
  libgcc-rtld-now.patch, res-send-enomem.patch,
  glibc-fix-avx512-mempcpy.patch, i386-memmove-sse2-unaligned.patch,
  realpath-ssize-max-overflow.patch, localtime-2039.patch,
  math-remove-slow-path.patch, aarch64-hwcap-atomics.patch,
  glibc-fix-aarch64-build.diff, absolute-symbols.patch,
  x86-haswell-string-flags.patch,
  pthread-cond-broadcast-waiters-after-spinning.patch,
  mman-map-sync.patch, mman-linux-map-shared-validate.patch,
  nptl-setxid-error.patch, pthread-mutex-trylock-barrier.patch,
  getaddrinfo-parse-ipv4-address.patch, japanese-era-name-may-2019.patch,
  force-elision-race.patch, regex-read-overrun.patch,
  regex-parse-reg-exp.patch,
  0001-S390-Add-configure-check-to-detect-z10-as-mininum-ar.patch,
  0002-S390-Use-hwcap-instead-of-dl_hwcap-in-ifunc-resolver.patch,
  0003-S390-Unify-31-64bit-memcpy.patch,
  0004-S390-Refactor-memcpy-mempcpy-ifunc-handling.patch,
  0005-S390-Remove-s390-specific-implementation-of-bcopy.patch,
  0006-S390-Use-memcpy-for-forward-cases-in-memmove.patch,
  0007-S390-Add-configure-check-to-detect-z13-as-mininum-ar.patch,
  0008-S390-Add-z13-memmove-ifunc-variant.patch,
  0009-S390-Add-z13-strstr-ifunc-variant.patch,
  0010-S390-Add-z13-memmem-ifunc-variant.patch,
  0011-S390-Cleanup-ifunc-resolve.h.patch,
  0012-S390-Mark-vx-and-vxe-as-important-hwcap.patch,
  0013-S390-Add-new-hwcap-values-for-new-cpu-architecture-a.patch,
  0014-S390-Add-configure-check-to-detect-support-for-arch1.patch,
  0015-S390-Add-arch13-memmove-ifunc-variant.patch,
  0016-S390-Add-arch13-strstr-ifunc-variant.patch,
  0017-S390-Add-arch13-memmem-ifunc-variant.patch,
  prefer-map-32bit-exec.patch, s390-strstr-page-boundary.patch,
  ppc-tle-htm-nosc.patch,
  posix-Add-internal-symbols-for-posix_spawn-interface.patch,
  glibc-2.29-posix-Use-posix_spawn-on-popen.patch,
  backtrace-powerpc.patch, pthread-rwlock-pwn.patch,
  manual-memory-protection.patch, ldbl-96-rem-pio2l.patch,
  dl-sort-maps.patch, dlopen-filter-object.patch,
  glob-use-after-free.patch, nptl-setxid-race.patch, nscd-senfile.patch,
  ldd-system-interp.patch, abort-no-flush.patch,
  fnmatch-collating-elements.patch, nss-files-long-lines-2.patch,
  iconv-reset-input-buffer.patch, nscd-prune.patch, syslog-locking.patch:
  Removed.
- long-double-alias.patch, glibc-nsswitch-usr.diff, euc-kr-overrun.patch,
  riscv-syscall-clobber.patch, nscd-gc-cycle.patch: Added.</changelog>
  <changelog author="schwab@suse.de" date="1604923200">- power10-support.patch: Add support for POWER10 (jsc#SLE-13520)
- iconv-option-parsing.patch: Rewrite iconv option parsing
  (CVE-2016-10228, bsc#1027496, BZ #19519)</changelog>
  <changelog author="schwab@suse.de" date="1608120000">- aarch64-getauxval.patch: aarch64: Accept PLT calls to __getauxval within
  libc.so (bsc#1167939)
- iconv-redundant-shift.patch: iconv: Accept redundant shift sequences in
  IBM1364 (CVE-2020-27618, bsc#1178386, BZ #26224)
- iconv-ucs4-loop-bounds.patch: iconv: Fix incorrect UCS4 inner loop
  bounds (CVE-2020-29562, bsc#1179694, BZ #26923)
- printf-long-double-non-normal.patch: x86: Harden printf against
  non-normal long double values (CVE-2020-29573, bsc#1179721, BZ #26649)
- get-nprocs-cpu-online-parsing.patch: Fix parsing of
  /sys/devices/system/cpu/online (bsc#1180038, BZ #25859)</changelog>
  <changelog author="schwab@suse.de" date="1609848000">- sysvipc-sem-stat-any.patch: sysvipc: Fix SEM_STAT_ANY kernel argument
  pass (bsc#1180557, BZ #26637)</changelog>
  <changelog author="schwab@suse.de" date="1611835200">- gconv-assertion-iso-2022-jp.patch: gconv: Fix assertion failure in
  ISO-2022-JP-3 module (CVE-2021-3326, bsc#1181505, BZ #27256)</changelog>
  <changelog author="schwab@suse.de" date="1614772800">- nscd-netgroupcache.patch: nscd: Fix double free in netgroupcache
  (CVE-2021-27645, bsc#1182733, BZ #27462)</changelog>
  <changelog author="rguenther@suse.com" date="1615377600">- Add glibc-2.31-HTM-vzeroupper.diff to avoid VZEROUPPER in the
  AVX2 accelerated string routines which cause HTM transaction
  aborts.  Instead use EVEX or SSE.  (bsc#1181403)</changelog>
  <changelog author="rguenther@suse.com" date="1615377601">- Update glibc-2.31-HTM-vzeroupper.diff with a AVX-SSE transition
  fix.</changelog>
  <changelog author="schwab@suse.de" date="1617019200">- s390-memmove-ifunc-selector-arch13.patch: S390: Also check vector
  support in memmove ifunc-selector (bsc#1184035, BZ #27511)</changelog>
  <changelog author="schwab@suse.de" date="1625140800">- wordexp-param-overflow.patch: wordexp: handle overflow in positional
  parameter number (CVE-2021-35942, bsc#1187911, BZ #28011)</changelog>
  <changelog author="schwab@suse.de" date="1630584000">- mq-notify-use-after-free.patch: Use __pthread_attr_copy in mq_notify
  (CVE-2021-33574, bsc#1186489, BZ #27896)</changelog>
  <changelog author="schwab@suse.de" date="1636027200">- 0001-s390x-Align-child-stack-while-clone.-BZ-27968.patch,
  0002-S390-Optimize-__memcpy_z196.patch,
  0003-S390-Optimize-__memset_z196.patch,
  0004-S390-Sync-HWCAP-names-with-kernel-by-adding-aliases-.patch,
  0005-S390-Add-new-hwcap-values.patch,
  0006-S390-Add-PCI_MIO-and-SIE-HWCAPs.patch: [15sp4 FEAT] GNU2007 -
  GLIBC: Support for new IBM Z Hardware (bsc#1191592, jsc#IBM-869)</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1640174400">- Add support for livepatches (jsc#SLE-20049).
- Enable livepatching on x86_64.
- Generate ipa-clones tarball artifact when livepatching is enabled.</changelog>
  <changelog author="schwab@suse.de" date="1642420800">- clnt-create-unix-overflow.patch: Buffer overflow in sunrpc clnt_create
  for "unix" (CVE-2022-23219, bsc#1194768, BZ #22542)
- svcunix-create-overflow.patch: Buffer overflow in sunrpc svcunix_create
  (CVE-2022-23218, bsc#1194770, BZ #28768)</changelog>
  <changelog author="schwab@suse.de" date="1642593600">- 0001-powerpc-Optimized-strcpy-for-POWER9.patch,
  0002-powerpc-Optimized-stpcpy-for-POWER9.patch,
  0003-powerpc-Optimized-rawmemchr-for-POWER9.patch,
  0004-powerpc64le-add-optimized-strlen-for-P9.patch,
  0005-powerpc-fix-ifunc-implementation-list-for-POWER9-str.patch,
  0006-powerpc-Add-optimized-strncpy-for-POWER9.patch,
  0007-powerpc-Add-optimized-stpncpy-for-POWER9.patch,
  0008-powerpc-Add-optimized-ilogb-for-POWER9.patch,
  0009-powerpc-Add-optimized-llogb-for-POWER9.patch,
  0010-powerpc-Add-optimized-strlen-for-POWER10.patch,
  0011-powerpc64le-Optimized-memmove-for-POWER10.patch,
  0012-powerpc64le-Optimize-memcpy-for-POWER10.patch,
  0013-powerpc64le-Optimize-memset-for-POWER10.patch,
  0014-powerpc64le-Fix-ifunc-selection-for-memset-memmove-b.patch,
  0015-powerpc-Add-optimized-rawmemchr-for-POWER10.patch: ppc64le ifunc
  improvements (bsc#1194785, jsc#SLE-18195)</changelog>
  <changelog author="schwab@suse.de" date="1643025600">- getcwd-erange.patch: getcwd: Set errno to ERANGE for size == 1
  (CVE-2021-3999, bsc#1194640, BZ #28769)</changelog>
</package>
<package pkgid="c39268042b331d0eb5dfcb2bccab61dd65a4721402c23c1bb2da6a3e1c6175a7" name="glibc-devel" arch="s390x">
  <version epoch="0" ver="2.31" rel="150300.9.12.1"/>
  <changelog author="schwab@suse.de" date="1583841600">- dl-sort-maps.patch, dlopen-filter-object.patch: Allow dlopen of filter
  object to work (bsc#1166106, BZ #16272)</changelog>
  <changelog author="schwab@suse.de" date="1585137600">- glob-use-after-free.patch: Fix use-after-free in glob when expanding
  ~user (CVE-2020-1752, bsc#1167631, BZ #25414)</changelog>
  <changelog author="schwab@suse.de" date="1589371200">- nptl-setxid-race.patch: nptl: wait for pending setxid request also in
  detached thread (bsc#1162930, BZ #25942)</changelog>
  <changelog author="schwab@suse.de" date="1593518400">- nscd-senfile.patch: Fix concurrent changes on nscd aware files
  (bsc#1171878, BZ #23178)
- nscd-prune.patch: nscd: bump GC cycle during cache pruning (bsc#1171878,
  BZ #26130)
- syslog-locking.patch: Correct locking and cancellation cleanup in syslog
  functions (bsc#1172085, BZ #26100)</changelog>
  <changelog author="schwab@suse.de" date="1599048000">- Update to glibc 2.31
- glibc-2.14-crypt.diff, crypt_blowfish-const.patch,
  crypt_blowfish-1.2-sha.diff, crypt_blowfish-gensalt.patch,
  crypt_blowfish-1.2-hack_around_arm.diff, glibc-nodate.patch,
  powerpc-elision-enable-envvar.patch, s390-elision-enable-envvar.patch,
  crt-nocompress-debug-sections.patch, resolv-context-leak.patch,
  dl-runtime-resolve-opt-avx512f.patch, libpthread-compat-wrappers.patch,
  math-c++-compat.patch, remove-nss-nis-compat.patch,
  eh-frame-zero-terminator.patch, ld-so-hwcap-x86-64.patch,
  assert-pedantic.patch, getaddrinfo-errno.patch, resolv-conf-oom.patch,
  dynarray-allocation.patch, nearbyint-inexact.patch, nss-compat.patch,
  nscd-libnsl.patch, malloc-tcache-leak.patch,
  falkor-memcpy-memmove.patch, aarch64-cpu-features.patch,
  nss-files-large-buffers.patch, sysconf-uio-maxiov.patch,
  glob-tilde-overflow.patch, dl-runtime-resolve-xsave.patch,
  spawni-assert.patch, x86-64-dl-platform.patch, glob64-s390.patch,
  tst-tlsopt-powerpc.patch, powerpc-hwcap-bits.patch,
  malloc-tcache-check-overflow.patch, dl-init-paths-overflow.patch,
  fillin-rpath-empty-tokens.patch, getcwd-absolute.patch,
  memalign-overflow.patch, stack-guard-size-accounting.patch,
  libgcc-rtld-now.patch, res-send-enomem.patch,
  glibc-fix-avx512-mempcpy.patch, i386-memmove-sse2-unaligned.patch,
  realpath-ssize-max-overflow.patch, localtime-2039.patch,
  math-remove-slow-path.patch, aarch64-hwcap-atomics.patch,
  glibc-fix-aarch64-build.diff, absolute-symbols.patch,
  x86-haswell-string-flags.patch,
  pthread-cond-broadcast-waiters-after-spinning.patch,
  mman-map-sync.patch, mman-linux-map-shared-validate.patch,
  nptl-setxid-error.patch, pthread-mutex-trylock-barrier.patch,
  getaddrinfo-parse-ipv4-address.patch, japanese-era-name-may-2019.patch,
  force-elision-race.patch, regex-read-overrun.patch,
  regex-parse-reg-exp.patch,
  0001-S390-Add-configure-check-to-detect-z10-as-mininum-ar.patch,
  0002-S390-Use-hwcap-instead-of-dl_hwcap-in-ifunc-resolver.patch,
  0003-S390-Unify-31-64bit-memcpy.patch,
  0004-S390-Refactor-memcpy-mempcpy-ifunc-handling.patch,
  0005-S390-Remove-s390-specific-implementation-of-bcopy.patch,
  0006-S390-Use-memcpy-for-forward-cases-in-memmove.patch,
  0007-S390-Add-configure-check-to-detect-z13-as-mininum-ar.patch,
  0008-S390-Add-z13-memmove-ifunc-variant.patch,
  0009-S390-Add-z13-strstr-ifunc-variant.patch,
  0010-S390-Add-z13-memmem-ifunc-variant.patch,
  0011-S390-Cleanup-ifunc-resolve.h.patch,
  0012-S390-Mark-vx-and-vxe-as-important-hwcap.patch,
  0013-S390-Add-new-hwcap-values-for-new-cpu-architecture-a.patch,
  0014-S390-Add-configure-check-to-detect-support-for-arch1.patch,
  0015-S390-Add-arch13-memmove-ifunc-variant.patch,
  0016-S390-Add-arch13-strstr-ifunc-variant.patch,
  0017-S390-Add-arch13-memmem-ifunc-variant.patch,
  prefer-map-32bit-exec.patch, s390-strstr-page-boundary.patch,
  ppc-tle-htm-nosc.patch,
  posix-Add-internal-symbols-for-posix_spawn-interface.patch,
  glibc-2.29-posix-Use-posix_spawn-on-popen.patch,
  backtrace-powerpc.patch, pthread-rwlock-pwn.patch,
  manual-memory-protection.patch, ldbl-96-rem-pio2l.patch,
  dl-sort-maps.patch, dlopen-filter-object.patch,
  glob-use-after-free.patch, nptl-setxid-race.patch, nscd-senfile.patch,
  ldd-system-interp.patch, abort-no-flush.patch,
  fnmatch-collating-elements.patch, nss-files-long-lines-2.patch,
  iconv-reset-input-buffer.patch, nscd-prune.patch, syslog-locking.patch:
  Removed.
- long-double-alias.patch, glibc-nsswitch-usr.diff, euc-kr-overrun.patch,
  riscv-syscall-clobber.patch, nscd-gc-cycle.patch: Added.</changelog>
  <changelog author="schwab@suse.de" date="1604923200">- power10-support.patch: Add support for POWER10 (jsc#SLE-13520)
- iconv-option-parsing.patch: Rewrite iconv option parsing
  (CVE-2016-10228, bsc#1027496, BZ #19519)</changelog>
  <changelog author="schwab@suse.de" date="1608120000">- aarch64-getauxval.patch: aarch64: Accept PLT calls to __getauxval within
  libc.so (bsc#1167939)
- iconv-redundant-shift.patch: iconv: Accept redundant shift sequences in
  IBM1364 (CVE-2020-27618, bsc#1178386, BZ #26224)
- iconv-ucs4-loop-bounds.patch: iconv: Fix incorrect UCS4 inner loop
  bounds (CVE-2020-29562, bsc#1179694, BZ #26923)
- printf-long-double-non-normal.patch: x86: Harden printf against
  non-normal long double values (CVE-2020-29573, bsc#1179721, BZ #26649)
- get-nprocs-cpu-online-parsing.patch: Fix parsing of
  /sys/devices/system/cpu/online (bsc#1180038, BZ #25859)</changelog>
  <changelog author="schwab@suse.de" date="1609848000">- sysvipc-sem-stat-any.patch: sysvipc: Fix SEM_STAT_ANY kernel argument
  pass (bsc#1180557, BZ #26637)</changelog>
  <changelog author="schwab@suse.de" date="1611835200">- gconv-assertion-iso-2022-jp.patch: gconv: Fix assertion failure in
  ISO-2022-JP-3 module (CVE-2021-3326, bsc#1181505, BZ #27256)</changelog>
  <changelog author="schwab@suse.de" date="1614772800">- nscd-netgroupcache.patch: nscd: Fix double free in netgroupcache
  (CVE-2021-27645, bsc#1182733, BZ #27462)</changelog>
  <changelog author="rguenther@suse.com" date="1615377600">- Add glibc-2.31-HTM-vzeroupper.diff to avoid VZEROUPPER in the
  AVX2 accelerated string routines which cause HTM transaction
  aborts.  Instead use EVEX or SSE.  (bsc#1181403)</changelog>
  <changelog author="rguenther@suse.com" date="1615377601">- Update glibc-2.31-HTM-vzeroupper.diff with a AVX-SSE transition
  fix.</changelog>
  <changelog author="schwab@suse.de" date="1617019200">- s390-memmove-ifunc-selector-arch13.patch: S390: Also check vector
  support in memmove ifunc-selector (bsc#1184035, BZ #27511)</changelog>
  <changelog author="schwab@suse.de" date="1625140800">- wordexp-param-overflow.patch: wordexp: handle overflow in positional
  parameter number (CVE-2021-35942, bsc#1187911, BZ #28011)</changelog>
  <changelog author="schwab@suse.de" date="1630584000">- mq-notify-use-after-free.patch: Use __pthread_attr_copy in mq_notify
  (CVE-2021-33574, bsc#1186489, BZ #27896)</changelog>
  <changelog author="schwab@suse.de" date="1636027200">- 0001-s390x-Align-child-stack-while-clone.-BZ-27968.patch,
  0002-S390-Optimize-__memcpy_z196.patch,
  0003-S390-Optimize-__memset_z196.patch,
  0004-S390-Sync-HWCAP-names-with-kernel-by-adding-aliases-.patch,
  0005-S390-Add-new-hwcap-values.patch,
  0006-S390-Add-PCI_MIO-and-SIE-HWCAPs.patch: [15sp4 FEAT] GNU2007 -
  GLIBC: Support for new IBM Z Hardware (bsc#1191592, jsc#IBM-869)</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1640174400">- Add support for livepatches (jsc#SLE-20049).
- Enable livepatching on x86_64.
- Generate ipa-clones tarball artifact when livepatching is enabled.</changelog>
  <changelog author="schwab@suse.de" date="1642420800">- clnt-create-unix-overflow.patch: Buffer overflow in sunrpc clnt_create
  for "unix" (CVE-2022-23219, bsc#1194768, BZ #22542)
- svcunix-create-overflow.patch: Buffer overflow in sunrpc svcunix_create
  (CVE-2022-23218, bsc#1194770, BZ #28768)</changelog>
  <changelog author="schwab@suse.de" date="1642593600">- 0001-powerpc-Optimized-strcpy-for-POWER9.patch,
  0002-powerpc-Optimized-stpcpy-for-POWER9.patch,
  0003-powerpc-Optimized-rawmemchr-for-POWER9.patch,
  0004-powerpc64le-add-optimized-strlen-for-P9.patch,
  0005-powerpc-fix-ifunc-implementation-list-for-POWER9-str.patch,
  0006-powerpc-Add-optimized-strncpy-for-POWER9.patch,
  0007-powerpc-Add-optimized-stpncpy-for-POWER9.patch,
  0008-powerpc-Add-optimized-ilogb-for-POWER9.patch,
  0009-powerpc-Add-optimized-llogb-for-POWER9.patch,
  0010-powerpc-Add-optimized-strlen-for-POWER10.patch,
  0011-powerpc64le-Optimized-memmove-for-POWER10.patch,
  0012-powerpc64le-Optimize-memcpy-for-POWER10.patch,
  0013-powerpc64le-Optimize-memset-for-POWER10.patch,
  0014-powerpc64le-Fix-ifunc-selection-for-memset-memmove-b.patch,
  0015-powerpc-Add-optimized-rawmemchr-for-POWER10.patch: ppc64le ifunc
  improvements (bsc#1194785, jsc#SLE-18195)</changelog>
  <changelog author="schwab@suse.de" date="1643025600">- getcwd-erange.patch: getcwd: Set errno to ERANGE for size == 1
  (CVE-2021-3999, bsc#1194640, BZ #28769)</changelog>
</package>
<package pkgid="cec29ec64d0a6f5cd2013e040ce3680d0ec9a164f0a536c1f4bb23fcff32406a" name="glibc-devel" arch="x86_64">
  <version epoch="0" ver="2.31" rel="150300.9.12.1"/>
  <changelog author="schwab@suse.de" date="1583841600">- dl-sort-maps.patch, dlopen-filter-object.patch: Allow dlopen of filter
  object to work (bsc#1166106, BZ #16272)</changelog>
  <changelog author="schwab@suse.de" date="1585137600">- glob-use-after-free.patch: Fix use-after-free in glob when expanding
  ~user (CVE-2020-1752, bsc#1167631, BZ #25414)</changelog>
  <changelog author="schwab@suse.de" date="1589371200">- nptl-setxid-race.patch: nptl: wait for pending setxid request also in
  detached thread (bsc#1162930, BZ #25942)</changelog>
  <changelog author="schwab@suse.de" date="1593518400">- nscd-senfile.patch: Fix concurrent changes on nscd aware files
  (bsc#1171878, BZ #23178)
- nscd-prune.patch: nscd: bump GC cycle during cache pruning (bsc#1171878,
  BZ #26130)
- syslog-locking.patch: Correct locking and cancellation cleanup in syslog
  functions (bsc#1172085, BZ #26100)</changelog>
  <changelog author="schwab@suse.de" date="1599048000">- Update to glibc 2.31
- glibc-2.14-crypt.diff, crypt_blowfish-const.patch,
  crypt_blowfish-1.2-sha.diff, crypt_blowfish-gensalt.patch,
  crypt_blowfish-1.2-hack_around_arm.diff, glibc-nodate.patch,
  powerpc-elision-enable-envvar.patch, s390-elision-enable-envvar.patch,
  crt-nocompress-debug-sections.patch, resolv-context-leak.patch,
  dl-runtime-resolve-opt-avx512f.patch, libpthread-compat-wrappers.patch,
  math-c++-compat.patch, remove-nss-nis-compat.patch,
  eh-frame-zero-terminator.patch, ld-so-hwcap-x86-64.patch,
  assert-pedantic.patch, getaddrinfo-errno.patch, resolv-conf-oom.patch,
  dynarray-allocation.patch, nearbyint-inexact.patch, nss-compat.patch,
  nscd-libnsl.patch, malloc-tcache-leak.patch,
  falkor-memcpy-memmove.patch, aarch64-cpu-features.patch,
  nss-files-large-buffers.patch, sysconf-uio-maxiov.patch,
  glob-tilde-overflow.patch, dl-runtime-resolve-xsave.patch,
  spawni-assert.patch, x86-64-dl-platform.patch, glob64-s390.patch,
  tst-tlsopt-powerpc.patch, powerpc-hwcap-bits.patch,
  malloc-tcache-check-overflow.patch, dl-init-paths-overflow.patch,
  fillin-rpath-empty-tokens.patch, getcwd-absolute.patch,
  memalign-overflow.patch, stack-guard-size-accounting.patch,
  libgcc-rtld-now.patch, res-send-enomem.patch,
  glibc-fix-avx512-mempcpy.patch, i386-memmove-sse2-unaligned.patch,
  realpath-ssize-max-overflow.patch, localtime-2039.patch,
  math-remove-slow-path.patch, aarch64-hwcap-atomics.patch,
  glibc-fix-aarch64-build.diff, absolute-symbols.patch,
  x86-haswell-string-flags.patch,
  pthread-cond-broadcast-waiters-after-spinning.patch,
  mman-map-sync.patch, mman-linux-map-shared-validate.patch,
  nptl-setxid-error.patch, pthread-mutex-trylock-barrier.patch,
  getaddrinfo-parse-ipv4-address.patch, japanese-era-name-may-2019.patch,
  force-elision-race.patch, regex-read-overrun.patch,
  regex-parse-reg-exp.patch,
  0001-S390-Add-configure-check-to-detect-z10-as-mininum-ar.patch,
  0002-S390-Use-hwcap-instead-of-dl_hwcap-in-ifunc-resolver.patch,
  0003-S390-Unify-31-64bit-memcpy.patch,
  0004-S390-Refactor-memcpy-mempcpy-ifunc-handling.patch,
  0005-S390-Remove-s390-specific-implementation-of-bcopy.patch,
  0006-S390-Use-memcpy-for-forward-cases-in-memmove.patch,
  0007-S390-Add-configure-check-to-detect-z13-as-mininum-ar.patch,
  0008-S390-Add-z13-memmove-ifunc-variant.patch,
  0009-S390-Add-z13-strstr-ifunc-variant.patch,
  0010-S390-Add-z13-memmem-ifunc-variant.patch,
  0011-S390-Cleanup-ifunc-resolve.h.patch,
  0012-S390-Mark-vx-and-vxe-as-important-hwcap.patch,
  0013-S390-Add-new-hwcap-values-for-new-cpu-architecture-a.patch,
  0014-S390-Add-configure-check-to-detect-support-for-arch1.patch,
  0015-S390-Add-arch13-memmove-ifunc-variant.patch,
  0016-S390-Add-arch13-strstr-ifunc-variant.patch,
  0017-S390-Add-arch13-memmem-ifunc-variant.patch,
  prefer-map-32bit-exec.patch, s390-strstr-page-boundary.patch,
  ppc-tle-htm-nosc.patch,
  posix-Add-internal-symbols-for-posix_spawn-interface.patch,
  glibc-2.29-posix-Use-posix_spawn-on-popen.patch,
  backtrace-powerpc.patch, pthread-rwlock-pwn.patch,
  manual-memory-protection.patch, ldbl-96-rem-pio2l.patch,
  dl-sort-maps.patch, dlopen-filter-object.patch,
  glob-use-after-free.patch, nptl-setxid-race.patch, nscd-senfile.patch,
  ldd-system-interp.patch, abort-no-flush.patch,
  fnmatch-collating-elements.patch, nss-files-long-lines-2.patch,
  iconv-reset-input-buffer.patch, nscd-prune.patch, syslog-locking.patch:
  Removed.
- long-double-alias.patch, glibc-nsswitch-usr.diff, euc-kr-overrun.patch,
  riscv-syscall-clobber.patch, nscd-gc-cycle.patch: Added.</changelog>
  <changelog author="schwab@suse.de" date="1604923200">- power10-support.patch: Add support for POWER10 (jsc#SLE-13520)
- iconv-option-parsing.patch: Rewrite iconv option parsing
  (CVE-2016-10228, bsc#1027496, BZ #19519)</changelog>
  <changelog author="schwab@suse.de" date="1608120000">- aarch64-getauxval.patch: aarch64: Accept PLT calls to __getauxval within
  libc.so (bsc#1167939)
- iconv-redundant-shift.patch: iconv: Accept redundant shift sequences in
  IBM1364 (CVE-2020-27618, bsc#1178386, BZ #26224)
- iconv-ucs4-loop-bounds.patch: iconv: Fix incorrect UCS4 inner loop
  bounds (CVE-2020-29562, bsc#1179694, BZ #26923)
- printf-long-double-non-normal.patch: x86: Harden printf against
  non-normal long double values (CVE-2020-29573, bsc#1179721, BZ #26649)
- get-nprocs-cpu-online-parsing.patch: Fix parsing of
  /sys/devices/system/cpu/online (bsc#1180038, BZ #25859)</changelog>
  <changelog author="schwab@suse.de" date="1609848000">- sysvipc-sem-stat-any.patch: sysvipc: Fix SEM_STAT_ANY kernel argument
  pass (bsc#1180557, BZ #26637)</changelog>
  <changelog author="schwab@suse.de" date="1611835200">- gconv-assertion-iso-2022-jp.patch: gconv: Fix assertion failure in
  ISO-2022-JP-3 module (CVE-2021-3326, bsc#1181505, BZ #27256)</changelog>
  <changelog author="schwab@suse.de" date="1614772800">- nscd-netgroupcache.patch: nscd: Fix double free in netgroupcache
  (CVE-2021-27645, bsc#1182733, BZ #27462)</changelog>
  <changelog author="rguenther@suse.com" date="1615377600">- Add glibc-2.31-HTM-vzeroupper.diff to avoid VZEROUPPER in the
  AVX2 accelerated string routines which cause HTM transaction
  aborts.  Instead use EVEX or SSE.  (bsc#1181403)</changelog>
  <changelog author="rguenther@suse.com" date="1615377601">- Update glibc-2.31-HTM-vzeroupper.diff with a AVX-SSE transition
  fix.</changelog>
  <changelog author="schwab@suse.de" date="1617019200">- s390-memmove-ifunc-selector-arch13.patch: S390: Also check vector
  support in memmove ifunc-selector (bsc#1184035, BZ #27511)</changelog>
  <changelog author="schwab@suse.de" date="1625140800">- wordexp-param-overflow.patch: wordexp: handle overflow in positional
  parameter number (CVE-2021-35942, bsc#1187911, BZ #28011)</changelog>
  <changelog author="schwab@suse.de" date="1630584000">- mq-notify-use-after-free.patch: Use __pthread_attr_copy in mq_notify
  (CVE-2021-33574, bsc#1186489, BZ #27896)</changelog>
  <changelog author="schwab@suse.de" date="1636027200">- 0001-s390x-Align-child-stack-while-clone.-BZ-27968.patch,
  0002-S390-Optimize-__memcpy_z196.patch,
  0003-S390-Optimize-__memset_z196.patch,
  0004-S390-Sync-HWCAP-names-with-kernel-by-adding-aliases-.patch,
  0005-S390-Add-new-hwcap-values.patch,
  0006-S390-Add-PCI_MIO-and-SIE-HWCAPs.patch: [15sp4 FEAT] GNU2007 -
  GLIBC: Support for new IBM Z Hardware (bsc#1191592, jsc#IBM-869)</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1640174400">- Add support for livepatches (jsc#SLE-20049).
- Enable livepatching on x86_64.
- Generate ipa-clones tarball artifact when livepatching is enabled.</changelog>
  <changelog author="schwab@suse.de" date="1642420800">- clnt-create-unix-overflow.patch: Buffer overflow in sunrpc clnt_create
  for "unix" (CVE-2022-23219, bsc#1194768, BZ #22542)
- svcunix-create-overflow.patch: Buffer overflow in sunrpc svcunix_create
  (CVE-2022-23218, bsc#1194770, BZ #28768)</changelog>
  <changelog author="schwab@suse.de" date="1642593600">- 0001-powerpc-Optimized-strcpy-for-POWER9.patch,
  0002-powerpc-Optimized-stpcpy-for-POWER9.patch,
  0003-powerpc-Optimized-rawmemchr-for-POWER9.patch,
  0004-powerpc64le-add-optimized-strlen-for-P9.patch,
  0005-powerpc-fix-ifunc-implementation-list-for-POWER9-str.patch,
  0006-powerpc-Add-optimized-strncpy-for-POWER9.patch,
  0007-powerpc-Add-optimized-stpncpy-for-POWER9.patch,
  0008-powerpc-Add-optimized-ilogb-for-POWER9.patch,
  0009-powerpc-Add-optimized-llogb-for-POWER9.patch,
  0010-powerpc-Add-optimized-strlen-for-POWER10.patch,
  0011-powerpc64le-Optimized-memmove-for-POWER10.patch,
  0012-powerpc64le-Optimize-memcpy-for-POWER10.patch,
  0013-powerpc64le-Optimize-memset-for-POWER10.patch,
  0014-powerpc64le-Fix-ifunc-selection-for-memset-memmove-b.patch,
  0015-powerpc-Add-optimized-rawmemchr-for-POWER10.patch: ppc64le ifunc
  improvements (bsc#1194785, jsc#SLE-18195)</changelog>
  <changelog author="schwab@suse.de" date="1643025600">- getcwd-erange.patch: getcwd: Set errno to ERANGE for size == 1
  (CVE-2021-3999, bsc#1194640, BZ #28769)</changelog>
</package>
<package pkgid="f0bd6b6e9fa2644680fe1de9fb06001a0e2cc14110aee0d9c4d73f9ca0bce7ee" name="glibc-devel-32bit" arch="x86_64">
  <version epoch="0" ver="2.31" rel="150300.9.12.1"/>
  <changelog author="schwab@suse.de" date="1583841600">- dl-sort-maps.patch, dlopen-filter-object.patch: Allow dlopen of filter
  object to work (bsc#1166106, BZ #16272)</changelog>
  <changelog author="schwab@suse.de" date="1585137600">- glob-use-after-free.patch: Fix use-after-free in glob when expanding
  ~user (CVE-2020-1752, bsc#1167631, BZ #25414)</changelog>
  <changelog author="schwab@suse.de" date="1589371200">- nptl-setxid-race.patch: nptl: wait for pending setxid request also in
  detached thread (bsc#1162930, BZ #25942)</changelog>
  <changelog author="schwab@suse.de" date="1593518400">- nscd-senfile.patch: Fix concurrent changes on nscd aware files
  (bsc#1171878, BZ #23178)
- nscd-prune.patch: nscd: bump GC cycle during cache pruning (bsc#1171878,
  BZ #26130)
- syslog-locking.patch: Correct locking and cancellation cleanup in syslog
  functions (bsc#1172085, BZ #26100)</changelog>
  <changelog author="schwab@suse.de" date="1599048000">- Update to glibc 2.31
- glibc-2.14-crypt.diff, crypt_blowfish-const.patch,
  crypt_blowfish-1.2-sha.diff, crypt_blowfish-gensalt.patch,
  crypt_blowfish-1.2-hack_around_arm.diff, glibc-nodate.patch,
  powerpc-elision-enable-envvar.patch, s390-elision-enable-envvar.patch,
  crt-nocompress-debug-sections.patch, resolv-context-leak.patch,
  dl-runtime-resolve-opt-avx512f.patch, libpthread-compat-wrappers.patch,
  math-c++-compat.patch, remove-nss-nis-compat.patch,
  eh-frame-zero-terminator.patch, ld-so-hwcap-x86-64.patch,
  assert-pedantic.patch, getaddrinfo-errno.patch, resolv-conf-oom.patch,
  dynarray-allocation.patch, nearbyint-inexact.patch, nss-compat.patch,
  nscd-libnsl.patch, malloc-tcache-leak.patch,
  falkor-memcpy-memmove.patch, aarch64-cpu-features.patch,
  nss-files-large-buffers.patch, sysconf-uio-maxiov.patch,
  glob-tilde-overflow.patch, dl-runtime-resolve-xsave.patch,
  spawni-assert.patch, x86-64-dl-platform.patch, glob64-s390.patch,
  tst-tlsopt-powerpc.patch, powerpc-hwcap-bits.patch,
  malloc-tcache-check-overflow.patch, dl-init-paths-overflow.patch,
  fillin-rpath-empty-tokens.patch, getcwd-absolute.patch,
  memalign-overflow.patch, stack-guard-size-accounting.patch,
  libgcc-rtld-now.patch, res-send-enomem.patch,
  glibc-fix-avx512-mempcpy.patch, i386-memmove-sse2-unaligned.patch,
  realpath-ssize-max-overflow.patch, localtime-2039.patch,
  math-remove-slow-path.patch, aarch64-hwcap-atomics.patch,
  glibc-fix-aarch64-build.diff, absolute-symbols.patch,
  x86-haswell-string-flags.patch,
  pthread-cond-broadcast-waiters-after-spinning.patch,
  mman-map-sync.patch, mman-linux-map-shared-validate.patch,
  nptl-setxid-error.patch, pthread-mutex-trylock-barrier.patch,
  getaddrinfo-parse-ipv4-address.patch, japanese-era-name-may-2019.patch,
  force-elision-race.patch, regex-read-overrun.patch,
  regex-parse-reg-exp.patch,
  0001-S390-Add-configure-check-to-detect-z10-as-mininum-ar.patch,
  0002-S390-Use-hwcap-instead-of-dl_hwcap-in-ifunc-resolver.patch,
  0003-S390-Unify-31-64bit-memcpy.patch,
  0004-S390-Refactor-memcpy-mempcpy-ifunc-handling.patch,
  0005-S390-Remove-s390-specific-implementation-of-bcopy.patch,
  0006-S390-Use-memcpy-for-forward-cases-in-memmove.patch,
  0007-S390-Add-configure-check-to-detect-z13-as-mininum-ar.patch,
  0008-S390-Add-z13-memmove-ifunc-variant.patch,
  0009-S390-Add-z13-strstr-ifunc-variant.patch,
  0010-S390-Add-z13-memmem-ifunc-variant.patch,
  0011-S390-Cleanup-ifunc-resolve.h.patch,
  0012-S390-Mark-vx-and-vxe-as-important-hwcap.patch,
  0013-S390-Add-new-hwcap-values-for-new-cpu-architecture-a.patch,
  0014-S390-Add-configure-check-to-detect-support-for-arch1.patch,
  0015-S390-Add-arch13-memmove-ifunc-variant.patch,
  0016-S390-Add-arch13-strstr-ifunc-variant.patch,
  0017-S390-Add-arch13-memmem-ifunc-variant.patch,
  prefer-map-32bit-exec.patch, s390-strstr-page-boundary.patch,
  ppc-tle-htm-nosc.patch,
  posix-Add-internal-symbols-for-posix_spawn-interface.patch,
  glibc-2.29-posix-Use-posix_spawn-on-popen.patch,
  backtrace-powerpc.patch, pthread-rwlock-pwn.patch,
  manual-memory-protection.patch, ldbl-96-rem-pio2l.patch,
  dl-sort-maps.patch, dlopen-filter-object.patch,
  glob-use-after-free.patch, nptl-setxid-race.patch, nscd-senfile.patch,
  ldd-system-interp.patch, abort-no-flush.patch,
  fnmatch-collating-elements.patch, nss-files-long-lines-2.patch,
  iconv-reset-input-buffer.patch, nscd-prune.patch, syslog-locking.patch:
  Removed.
- long-double-alias.patch, glibc-nsswitch-usr.diff, euc-kr-overrun.patch,
  riscv-syscall-clobber.patch, nscd-gc-cycle.patch: Added.</changelog>
  <changelog author="schwab@suse.de" date="1604923200">- power10-support.patch: Add support for POWER10 (jsc#SLE-13520)
- iconv-option-parsing.patch: Rewrite iconv option parsing
  (CVE-2016-10228, bsc#1027496, BZ #19519)</changelog>
  <changelog author="schwab@suse.de" date="1608120000">- aarch64-getauxval.patch: aarch64: Accept PLT calls to __getauxval within
  libc.so (bsc#1167939)
- iconv-redundant-shift.patch: iconv: Accept redundant shift sequences in
  IBM1364 (CVE-2020-27618, bsc#1178386, BZ #26224)
- iconv-ucs4-loop-bounds.patch: iconv: Fix incorrect UCS4 inner loop
  bounds (CVE-2020-29562, bsc#1179694, BZ #26923)
- printf-long-double-non-normal.patch: x86: Harden printf against
  non-normal long double values (CVE-2020-29573, bsc#1179721, BZ #26649)
- get-nprocs-cpu-online-parsing.patch: Fix parsing of
  /sys/devices/system/cpu/online (bsc#1180038, BZ #25859)</changelog>
  <changelog author="schwab@suse.de" date="1609848000">- sysvipc-sem-stat-any.patch: sysvipc: Fix SEM_STAT_ANY kernel argument
  pass (bsc#1180557, BZ #26637)</changelog>
  <changelog author="schwab@suse.de" date="1611835200">- gconv-assertion-iso-2022-jp.patch: gconv: Fix assertion failure in
  ISO-2022-JP-3 module (CVE-2021-3326, bsc#1181505, BZ #27256)</changelog>
  <changelog author="schwab@suse.de" date="1614772800">- nscd-netgroupcache.patch: nscd: Fix double free in netgroupcache
  (CVE-2021-27645, bsc#1182733, BZ #27462)</changelog>
  <changelog author="rguenther@suse.com" date="1615377600">- Add glibc-2.31-HTM-vzeroupper.diff to avoid VZEROUPPER in the
  AVX2 accelerated string routines which cause HTM transaction
  aborts.  Instead use EVEX or SSE.  (bsc#1181403)</changelog>
  <changelog author="rguenther@suse.com" date="1615377601">- Update glibc-2.31-HTM-vzeroupper.diff with a AVX-SSE transition
  fix.</changelog>
  <changelog author="schwab@suse.de" date="1617019200">- s390-memmove-ifunc-selector-arch13.patch: S390: Also check vector
  support in memmove ifunc-selector (bsc#1184035, BZ #27511)</changelog>
  <changelog author="schwab@suse.de" date="1625140800">- wordexp-param-overflow.patch: wordexp: handle overflow in positional
  parameter number (CVE-2021-35942, bsc#1187911, BZ #28011)</changelog>
  <changelog author="schwab@suse.de" date="1630584000">- mq-notify-use-after-free.patch: Use __pthread_attr_copy in mq_notify
  (CVE-2021-33574, bsc#1186489, BZ #27896)</changelog>
  <changelog author="schwab@suse.de" date="1636027200">- 0001-s390x-Align-child-stack-while-clone.-BZ-27968.patch,
  0002-S390-Optimize-__memcpy_z196.patch,
  0003-S390-Optimize-__memset_z196.patch,
  0004-S390-Sync-HWCAP-names-with-kernel-by-adding-aliases-.patch,
  0005-S390-Add-new-hwcap-values.patch,
  0006-S390-Add-PCI_MIO-and-SIE-HWCAPs.patch: [15sp4 FEAT] GNU2007 -
  GLIBC: Support for new IBM Z Hardware (bsc#1191592, jsc#IBM-869)</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1640174400">- Add support for livepatches (jsc#SLE-20049).
- Enable livepatching on x86_64.
- Generate ipa-clones tarball artifact when livepatching is enabled.</changelog>
  <changelog author="schwab@suse.de" date="1642420800">- clnt-create-unix-overflow.patch: Buffer overflow in sunrpc clnt_create
  for "unix" (CVE-2022-23219, bsc#1194768, BZ #22542)
- svcunix-create-overflow.patch: Buffer overflow in sunrpc svcunix_create
  (CVE-2022-23218, bsc#1194770, BZ #28768)</changelog>
  <changelog author="schwab@suse.de" date="1642593600">- 0001-powerpc-Optimized-strcpy-for-POWER9.patch,
  0002-powerpc-Optimized-stpcpy-for-POWER9.patch,
  0003-powerpc-Optimized-rawmemchr-for-POWER9.patch,
  0004-powerpc64le-add-optimized-strlen-for-P9.patch,
  0005-powerpc-fix-ifunc-implementation-list-for-POWER9-str.patch,
  0006-powerpc-Add-optimized-strncpy-for-POWER9.patch,
  0007-powerpc-Add-optimized-stpncpy-for-POWER9.patch,
  0008-powerpc-Add-optimized-ilogb-for-POWER9.patch,
  0009-powerpc-Add-optimized-llogb-for-POWER9.patch,
  0010-powerpc-Add-optimized-strlen-for-POWER10.patch,
  0011-powerpc64le-Optimized-memmove-for-POWER10.patch,
  0012-powerpc64le-Optimize-memcpy-for-POWER10.patch,
  0013-powerpc64le-Optimize-memset-for-POWER10.patch,
  0014-powerpc64le-Fix-ifunc-selection-for-memset-memmove-b.patch,
  0015-powerpc-Add-optimized-rawmemchr-for-POWER10.patch: ppc64le ifunc
  improvements (bsc#1194785, jsc#SLE-18195)</changelog>
  <changelog author="schwab@suse.de" date="1643025600">- getcwd-erange.patch: getcwd: Set errno to ERANGE for size == 1
  (CVE-2021-3999, bsc#1194640, BZ #28769)</changelog>
</package>
<package pkgid="6a477ea8ed4f03ddd61bddcb727ba0dbfb394ee8d168a91b40e5357310475a87" name="glibc-devel-static" arch="aarch64">
  <version epoch="0" ver="2.31" rel="150300.9.12.1"/>
  <changelog author="schwab@suse.de" date="1583841600">- dl-sort-maps.patch, dlopen-filter-object.patch: Allow dlopen of filter
  object to work (bsc#1166106, BZ #16272)</changelog>
  <changelog author="schwab@suse.de" date="1585137600">- glob-use-after-free.patch: Fix use-after-free in glob when expanding
  ~user (CVE-2020-1752, bsc#1167631, BZ #25414)</changelog>
  <changelog author="schwab@suse.de" date="1589371200">- nptl-setxid-race.patch: nptl: wait for pending setxid request also in
  detached thread (bsc#1162930, BZ #25942)</changelog>
  <changelog author="schwab@suse.de" date="1593518400">- nscd-senfile.patch: Fix concurrent changes on nscd aware files
  (bsc#1171878, BZ #23178)
- nscd-prune.patch: nscd: bump GC cycle during cache pruning (bsc#1171878,
  BZ #26130)
- syslog-locking.patch: Correct locking and cancellation cleanup in syslog
  functions (bsc#1172085, BZ #26100)</changelog>
  <changelog author="schwab@suse.de" date="1599048000">- Update to glibc 2.31
- glibc-2.14-crypt.diff, crypt_blowfish-const.patch,
  crypt_blowfish-1.2-sha.diff, crypt_blowfish-gensalt.patch,
  crypt_blowfish-1.2-hack_around_arm.diff, glibc-nodate.patch,
  powerpc-elision-enable-envvar.patch, s390-elision-enable-envvar.patch,
  crt-nocompress-debug-sections.patch, resolv-context-leak.patch,
  dl-runtime-resolve-opt-avx512f.patch, libpthread-compat-wrappers.patch,
  math-c++-compat.patch, remove-nss-nis-compat.patch,
  eh-frame-zero-terminator.patch, ld-so-hwcap-x86-64.patch,
  assert-pedantic.patch, getaddrinfo-errno.patch, resolv-conf-oom.patch,
  dynarray-allocation.patch, nearbyint-inexact.patch, nss-compat.patch,
  nscd-libnsl.patch, malloc-tcache-leak.patch,
  falkor-memcpy-memmove.patch, aarch64-cpu-features.patch,
  nss-files-large-buffers.patch, sysconf-uio-maxiov.patch,
  glob-tilde-overflow.patch, dl-runtime-resolve-xsave.patch,
  spawni-assert.patch, x86-64-dl-platform.patch, glob64-s390.patch,
  tst-tlsopt-powerpc.patch, powerpc-hwcap-bits.patch,
  malloc-tcache-check-overflow.patch, dl-init-paths-overflow.patch,
  fillin-rpath-empty-tokens.patch, getcwd-absolute.patch,
  memalign-overflow.patch, stack-guard-size-accounting.patch,
  libgcc-rtld-now.patch, res-send-enomem.patch,
  glibc-fix-avx512-mempcpy.patch, i386-memmove-sse2-unaligned.patch,
  realpath-ssize-max-overflow.patch, localtime-2039.patch,
  math-remove-slow-path.patch, aarch64-hwcap-atomics.patch,
  glibc-fix-aarch64-build.diff, absolute-symbols.patch,
  x86-haswell-string-flags.patch,
  pthread-cond-broadcast-waiters-after-spinning.patch,
  mman-map-sync.patch, mman-linux-map-shared-validate.patch,
  nptl-setxid-error.patch, pthread-mutex-trylock-barrier.patch,
  getaddrinfo-parse-ipv4-address.patch, japanese-era-name-may-2019.patch,
  force-elision-race.patch, regex-read-overrun.patch,
  regex-parse-reg-exp.patch,
  0001-S390-Add-configure-check-to-detect-z10-as-mininum-ar.patch,
  0002-S390-Use-hwcap-instead-of-dl_hwcap-in-ifunc-resolver.patch,
  0003-S390-Unify-31-64bit-memcpy.patch,
  0004-S390-Refactor-memcpy-mempcpy-ifunc-handling.patch,
  0005-S390-Remove-s390-specific-implementation-of-bcopy.patch,
  0006-S390-Use-memcpy-for-forward-cases-in-memmove.patch,
  0007-S390-Add-configure-check-to-detect-z13-as-mininum-ar.patch,
  0008-S390-Add-z13-memmove-ifunc-variant.patch,
  0009-S390-Add-z13-strstr-ifunc-variant.patch,
  0010-S390-Add-z13-memmem-ifunc-variant.patch,
  0011-S390-Cleanup-ifunc-resolve.h.patch,
  0012-S390-Mark-vx-and-vxe-as-important-hwcap.patch,
  0013-S390-Add-new-hwcap-values-for-new-cpu-architecture-a.patch,
  0014-S390-Add-configure-check-to-detect-support-for-arch1.patch,
  0015-S390-Add-arch13-memmove-ifunc-variant.patch,
  0016-S390-Add-arch13-strstr-ifunc-variant.patch,
  0017-S390-Add-arch13-memmem-ifunc-variant.patch,
  prefer-map-32bit-exec.patch, s390-strstr-page-boundary.patch,
  ppc-tle-htm-nosc.patch,
  posix-Add-internal-symbols-for-posix_spawn-interface.patch,
  glibc-2.29-posix-Use-posix_spawn-on-popen.patch,
  backtrace-powerpc.patch, pthread-rwlock-pwn.patch,
  manual-memory-protection.patch, ldbl-96-rem-pio2l.patch,
  dl-sort-maps.patch, dlopen-filter-object.patch,
  glob-use-after-free.patch, nptl-setxid-race.patch, nscd-senfile.patch,
  ldd-system-interp.patch, abort-no-flush.patch,
  fnmatch-collating-elements.patch, nss-files-long-lines-2.patch,
  iconv-reset-input-buffer.patch, nscd-prune.patch, syslog-locking.patch:
  Removed.
- long-double-alias.patch, glibc-nsswitch-usr.diff, euc-kr-overrun.patch,
  riscv-syscall-clobber.patch, nscd-gc-cycle.patch: Added.</changelog>
  <changelog author="schwab@suse.de" date="1604923200">- power10-support.patch: Add support for POWER10 (jsc#SLE-13520)
- iconv-option-parsing.patch: Rewrite iconv option parsing
  (CVE-2016-10228, bsc#1027496, BZ #19519)</changelog>
  <changelog author="schwab@suse.de" date="1608120000">- aarch64-getauxval.patch: aarch64: Accept PLT calls to __getauxval within
  libc.so (bsc#1167939)
- iconv-redundant-shift.patch: iconv: Accept redundant shift sequences in
  IBM1364 (CVE-2020-27618, bsc#1178386, BZ #26224)
- iconv-ucs4-loop-bounds.patch: iconv: Fix incorrect UCS4 inner loop
  bounds (CVE-2020-29562, bsc#1179694, BZ #26923)
- printf-long-double-non-normal.patch: x86: Harden printf against
  non-normal long double values (CVE-2020-29573, bsc#1179721, BZ #26649)
- get-nprocs-cpu-online-parsing.patch: Fix parsing of
  /sys/devices/system/cpu/online (bsc#1180038, BZ #25859)</changelog>
  <changelog author="schwab@suse.de" date="1609848000">- sysvipc-sem-stat-any.patch: sysvipc: Fix SEM_STAT_ANY kernel argument
  pass (bsc#1180557, BZ #26637)</changelog>
  <changelog author="schwab@suse.de" date="1611835200">- gconv-assertion-iso-2022-jp.patch: gconv: Fix assertion failure in
  ISO-2022-JP-3 module (CVE-2021-3326, bsc#1181505, BZ #27256)</changelog>
  <changelog author="schwab@suse.de" date="1614772800">- nscd-netgroupcache.patch: nscd: Fix double free in netgroupcache
  (CVE-2021-27645, bsc#1182733, BZ #27462)</changelog>
  <changelog author="rguenther@suse.com" date="1615377600">- Add glibc-2.31-HTM-vzeroupper.diff to avoid VZEROUPPER in the
  AVX2 accelerated string routines which cause HTM transaction
  aborts.  Instead use EVEX or SSE.  (bsc#1181403)</changelog>
  <changelog author="rguenther@suse.com" date="1615377601">- Update glibc-2.31-HTM-vzeroupper.diff with a AVX-SSE transition
  fix.</changelog>
  <changelog author="schwab@suse.de" date="1617019200">- s390-memmove-ifunc-selector-arch13.patch: S390: Also check vector
  support in memmove ifunc-selector (bsc#1184035, BZ #27511)</changelog>
  <changelog author="schwab@suse.de" date="1625140800">- wordexp-param-overflow.patch: wordexp: handle overflow in positional
  parameter number (CVE-2021-35942, bsc#1187911, BZ #28011)</changelog>
  <changelog author="schwab@suse.de" date="1630584000">- mq-notify-use-after-free.patch: Use __pthread_attr_copy in mq_notify
  (CVE-2021-33574, bsc#1186489, BZ #27896)</changelog>
  <changelog author="schwab@suse.de" date="1636027200">- 0001-s390x-Align-child-stack-while-clone.-BZ-27968.patch,
  0002-S390-Optimize-__memcpy_z196.patch,
  0003-S390-Optimize-__memset_z196.patch,
  0004-S390-Sync-HWCAP-names-with-kernel-by-adding-aliases-.patch,
  0005-S390-Add-new-hwcap-values.patch,
  0006-S390-Add-PCI_MIO-and-SIE-HWCAPs.patch: [15sp4 FEAT] GNU2007 -
  GLIBC: Support for new IBM Z Hardware (bsc#1191592, jsc#IBM-869)</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1640174400">- Add support for livepatches (jsc#SLE-20049).
- Enable livepatching on x86_64.
- Generate ipa-clones tarball artifact when livepatching is enabled.</changelog>
  <changelog author="schwab@suse.de" date="1642420800">- clnt-create-unix-overflow.patch: Buffer overflow in sunrpc clnt_create
  for "unix" (CVE-2022-23219, bsc#1194768, BZ #22542)
- svcunix-create-overflow.patch: Buffer overflow in sunrpc svcunix_create
  (CVE-2022-23218, bsc#1194770, BZ #28768)</changelog>
  <changelog author="schwab@suse.de" date="1642593600">- 0001-powerpc-Optimized-strcpy-for-POWER9.patch,
  0002-powerpc-Optimized-stpcpy-for-POWER9.patch,
  0003-powerpc-Optimized-rawmemchr-for-POWER9.patch,
  0004-powerpc64le-add-optimized-strlen-for-P9.patch,
  0005-powerpc-fix-ifunc-implementation-list-for-POWER9-str.patch,
  0006-powerpc-Add-optimized-strncpy-for-POWER9.patch,
  0007-powerpc-Add-optimized-stpncpy-for-POWER9.patch,
  0008-powerpc-Add-optimized-ilogb-for-POWER9.patch,
  0009-powerpc-Add-optimized-llogb-for-POWER9.patch,
  0010-powerpc-Add-optimized-strlen-for-POWER10.patch,
  0011-powerpc64le-Optimized-memmove-for-POWER10.patch,
  0012-powerpc64le-Optimize-memcpy-for-POWER10.patch,
  0013-powerpc64le-Optimize-memset-for-POWER10.patch,
  0014-powerpc64le-Fix-ifunc-selection-for-memset-memmove-b.patch,
  0015-powerpc-Add-optimized-rawmemchr-for-POWER10.patch: ppc64le ifunc
  improvements (bsc#1194785, jsc#SLE-18195)</changelog>
  <changelog author="schwab@suse.de" date="1643025600">- getcwd-erange.patch: getcwd: Set errno to ERANGE for size == 1
  (CVE-2021-3999, bsc#1194640, BZ #28769)</changelog>
</package>
<package pkgid="f576a204cfcc8a0e292e73ed2f7fced09ea6291898ee0127c2e608030bfa704f" name="glibc-devel-static" arch="ppc64le">
  <version epoch="0" ver="2.31" rel="150300.9.12.1"/>
  <changelog author="schwab@suse.de" date="1583841600">- dl-sort-maps.patch, dlopen-filter-object.patch: Allow dlopen of filter
  object to work (bsc#1166106, BZ #16272)</changelog>
  <changelog author="schwab@suse.de" date="1585137600">- glob-use-after-free.patch: Fix use-after-free in glob when expanding
  ~user (CVE-2020-1752, bsc#1167631, BZ #25414)</changelog>
  <changelog author="schwab@suse.de" date="1589371200">- nptl-setxid-race.patch: nptl: wait for pending setxid request also in
  detached thread (bsc#1162930, BZ #25942)</changelog>
  <changelog author="schwab@suse.de" date="1593518400">- nscd-senfile.patch: Fix concurrent changes on nscd aware files
  (bsc#1171878, BZ #23178)
- nscd-prune.patch: nscd: bump GC cycle during cache pruning (bsc#1171878,
  BZ #26130)
- syslog-locking.patch: Correct locking and cancellation cleanup in syslog
  functions (bsc#1172085, BZ #26100)</changelog>
  <changelog author="schwab@suse.de" date="1599048000">- Update to glibc 2.31
- glibc-2.14-crypt.diff, crypt_blowfish-const.patch,
  crypt_blowfish-1.2-sha.diff, crypt_blowfish-gensalt.patch,
  crypt_blowfish-1.2-hack_around_arm.diff, glibc-nodate.patch,
  powerpc-elision-enable-envvar.patch, s390-elision-enable-envvar.patch,
  crt-nocompress-debug-sections.patch, resolv-context-leak.patch,
  dl-runtime-resolve-opt-avx512f.patch, libpthread-compat-wrappers.patch,
  math-c++-compat.patch, remove-nss-nis-compat.patch,
  eh-frame-zero-terminator.patch, ld-so-hwcap-x86-64.patch,
  assert-pedantic.patch, getaddrinfo-errno.patch, resolv-conf-oom.patch,
  dynarray-allocation.patch, nearbyint-inexact.patch, nss-compat.patch,
  nscd-libnsl.patch, malloc-tcache-leak.patch,
  falkor-memcpy-memmove.patch, aarch64-cpu-features.patch,
  nss-files-large-buffers.patch, sysconf-uio-maxiov.patch,
  glob-tilde-overflow.patch, dl-runtime-resolve-xsave.patch,
  spawni-assert.patch, x86-64-dl-platform.patch, glob64-s390.patch,
  tst-tlsopt-powerpc.patch, powerpc-hwcap-bits.patch,
  malloc-tcache-check-overflow.patch, dl-init-paths-overflow.patch,
  fillin-rpath-empty-tokens.patch, getcwd-absolute.patch,
  memalign-overflow.patch, stack-guard-size-accounting.patch,
  libgcc-rtld-now.patch, res-send-enomem.patch,
  glibc-fix-avx512-mempcpy.patch, i386-memmove-sse2-unaligned.patch,
  realpath-ssize-max-overflow.patch, localtime-2039.patch,
  math-remove-slow-path.patch, aarch64-hwcap-atomics.patch,
  glibc-fix-aarch64-build.diff, absolute-symbols.patch,
  x86-haswell-string-flags.patch,
  pthread-cond-broadcast-waiters-after-spinning.patch,
  mman-map-sync.patch, mman-linux-map-shared-validate.patch,
  nptl-setxid-error.patch, pthread-mutex-trylock-barrier.patch,
  getaddrinfo-parse-ipv4-address.patch, japanese-era-name-may-2019.patch,
  force-elision-race.patch, regex-read-overrun.patch,
  regex-parse-reg-exp.patch,
  0001-S390-Add-configure-check-to-detect-z10-as-mininum-ar.patch,
  0002-S390-Use-hwcap-instead-of-dl_hwcap-in-ifunc-resolver.patch,
  0003-S390-Unify-31-64bit-memcpy.patch,
  0004-S390-Refactor-memcpy-mempcpy-ifunc-handling.patch,
  0005-S390-Remove-s390-specific-implementation-of-bcopy.patch,
  0006-S390-Use-memcpy-for-forward-cases-in-memmove.patch,
  0007-S390-Add-configure-check-to-detect-z13-as-mininum-ar.patch,
  0008-S390-Add-z13-memmove-ifunc-variant.patch,
  0009-S390-Add-z13-strstr-ifunc-variant.patch,
  0010-S390-Add-z13-memmem-ifunc-variant.patch,
  0011-S390-Cleanup-ifunc-resolve.h.patch,
  0012-S390-Mark-vx-and-vxe-as-important-hwcap.patch,
  0013-S390-Add-new-hwcap-values-for-new-cpu-architecture-a.patch,
  0014-S390-Add-configure-check-to-detect-support-for-arch1.patch,
  0015-S390-Add-arch13-memmove-ifunc-variant.patch,
  0016-S390-Add-arch13-strstr-ifunc-variant.patch,
  0017-S390-Add-arch13-memmem-ifunc-variant.patch,
  prefer-map-32bit-exec.patch, s390-strstr-page-boundary.patch,
  ppc-tle-htm-nosc.patch,
  posix-Add-internal-symbols-for-posix_spawn-interface.patch,
  glibc-2.29-posix-Use-posix_spawn-on-popen.patch,
  backtrace-powerpc.patch, pthread-rwlock-pwn.patch,
  manual-memory-protection.patch, ldbl-96-rem-pio2l.patch,
  dl-sort-maps.patch, dlopen-filter-object.patch,
  glob-use-after-free.patch, nptl-setxid-race.patch, nscd-senfile.patch,
  ldd-system-interp.patch, abort-no-flush.patch,
  fnmatch-collating-elements.patch, nss-files-long-lines-2.patch,
  iconv-reset-input-buffer.patch, nscd-prune.patch, syslog-locking.patch:
  Removed.
- long-double-alias.patch, glibc-nsswitch-usr.diff, euc-kr-overrun.patch,
  riscv-syscall-clobber.patch, nscd-gc-cycle.patch: Added.</changelog>
  <changelog author="schwab@suse.de" date="1604923200">- power10-support.patch: Add support for POWER10 (jsc#SLE-13520)
- iconv-option-parsing.patch: Rewrite iconv option parsing
  (CVE-2016-10228, bsc#1027496, BZ #19519)</changelog>
  <changelog author="schwab@suse.de" date="1608120000">- aarch64-getauxval.patch: aarch64: Accept PLT calls to __getauxval within
  libc.so (bsc#1167939)
- iconv-redundant-shift.patch: iconv: Accept redundant shift sequences in
  IBM1364 (CVE-2020-27618, bsc#1178386, BZ #26224)
- iconv-ucs4-loop-bounds.patch: iconv: Fix incorrect UCS4 inner loop
  bounds (CVE-2020-29562, bsc#1179694, BZ #26923)
- printf-long-double-non-normal.patch: x86: Harden printf against
  non-normal long double values (CVE-2020-29573, bsc#1179721, BZ #26649)
- get-nprocs-cpu-online-parsing.patch: Fix parsing of
  /sys/devices/system/cpu/online (bsc#1180038, BZ #25859)</changelog>
  <changelog author="schwab@suse.de" date="1609848000">- sysvipc-sem-stat-any.patch: sysvipc: Fix SEM_STAT_ANY kernel argument
  pass (bsc#1180557, BZ #26637)</changelog>
  <changelog author="schwab@suse.de" date="1611835200">- gconv-assertion-iso-2022-jp.patch: gconv: Fix assertion failure in
  ISO-2022-JP-3 module (CVE-2021-3326, bsc#1181505, BZ #27256)</changelog>
  <changelog author="schwab@suse.de" date="1614772800">- nscd-netgroupcache.patch: nscd: Fix double free in netgroupcache
  (CVE-2021-27645, bsc#1182733, BZ #27462)</changelog>
  <changelog author="rguenther@suse.com" date="1615377600">- Add glibc-2.31-HTM-vzeroupper.diff to avoid VZEROUPPER in the
  AVX2 accelerated string routines which cause HTM transaction
  aborts.  Instead use EVEX or SSE.  (bsc#1181403)</changelog>
  <changelog author="rguenther@suse.com" date="1615377601">- Update glibc-2.31-HTM-vzeroupper.diff with a AVX-SSE transition
  fix.</changelog>
  <changelog author="schwab@suse.de" date="1617019200">- s390-memmove-ifunc-selector-arch13.patch: S390: Also check vector
  support in memmove ifunc-selector (bsc#1184035, BZ #27511)</changelog>
  <changelog author="schwab@suse.de" date="1625140800">- wordexp-param-overflow.patch: wordexp: handle overflow in positional
  parameter number (CVE-2021-35942, bsc#1187911, BZ #28011)</changelog>
  <changelog author="schwab@suse.de" date="1630584000">- mq-notify-use-after-free.patch: Use __pthread_attr_copy in mq_notify
  (CVE-2021-33574, bsc#1186489, BZ #27896)</changelog>
  <changelog author="schwab@suse.de" date="1636027200">- 0001-s390x-Align-child-stack-while-clone.-BZ-27968.patch,
  0002-S390-Optimize-__memcpy_z196.patch,
  0003-S390-Optimize-__memset_z196.patch,
  0004-S390-Sync-HWCAP-names-with-kernel-by-adding-aliases-.patch,
  0005-S390-Add-new-hwcap-values.patch,
  0006-S390-Add-PCI_MIO-and-SIE-HWCAPs.patch: [15sp4 FEAT] GNU2007 -
  GLIBC: Support for new IBM Z Hardware (bsc#1191592, jsc#IBM-869)</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1640174400">- Add support for livepatches (jsc#SLE-20049).
- Enable livepatching on x86_64.
- Generate ipa-clones tarball artifact when livepatching is enabled.</changelog>
  <changelog author="schwab@suse.de" date="1642420800">- clnt-create-unix-overflow.patch: Buffer overflow in sunrpc clnt_create
  for "unix" (CVE-2022-23219, bsc#1194768, BZ #22542)
- svcunix-create-overflow.patch: Buffer overflow in sunrpc svcunix_create
  (CVE-2022-23218, bsc#1194770, BZ #28768)</changelog>
  <changelog author="schwab@suse.de" date="1642593600">- 0001-powerpc-Optimized-strcpy-for-POWER9.patch,
  0002-powerpc-Optimized-stpcpy-for-POWER9.patch,
  0003-powerpc-Optimized-rawmemchr-for-POWER9.patch,
  0004-powerpc64le-add-optimized-strlen-for-P9.patch,
  0005-powerpc-fix-ifunc-implementation-list-for-POWER9-str.patch,
  0006-powerpc-Add-optimized-strncpy-for-POWER9.patch,
  0007-powerpc-Add-optimized-stpncpy-for-POWER9.patch,
  0008-powerpc-Add-optimized-ilogb-for-POWER9.patch,
  0009-powerpc-Add-optimized-llogb-for-POWER9.patch,
  0010-powerpc-Add-optimized-strlen-for-POWER10.patch,
  0011-powerpc64le-Optimized-memmove-for-POWER10.patch,
  0012-powerpc64le-Optimize-memcpy-for-POWER10.patch,
  0013-powerpc64le-Optimize-memset-for-POWER10.patch,
  0014-powerpc64le-Fix-ifunc-selection-for-memset-memmove-b.patch,
  0015-powerpc-Add-optimized-rawmemchr-for-POWER10.patch: ppc64le ifunc
  improvements (bsc#1194785, jsc#SLE-18195)</changelog>
  <changelog author="schwab@suse.de" date="1643025600">- getcwd-erange.patch: getcwd: Set errno to ERANGE for size == 1
  (CVE-2021-3999, bsc#1194640, BZ #28769)</changelog>
</package>
<package pkgid="af9b45bf16eb71cc8c88a2f39c249cad88d681a0b7c1ac3e3951e9cfada3ffcf" name="glibc-devel-static" arch="s390x">
  <version epoch="0" ver="2.31" rel="150300.9.12.1"/>
  <changelog author="schwab@suse.de" date="1583841600">- dl-sort-maps.patch, dlopen-filter-object.patch: Allow dlopen of filter
  object to work (bsc#1166106, BZ #16272)</changelog>
  <changelog author="schwab@suse.de" date="1585137600">- glob-use-after-free.patch: Fix use-after-free in glob when expanding
  ~user (CVE-2020-1752, bsc#1167631, BZ #25414)</changelog>
  <changelog author="schwab@suse.de" date="1589371200">- nptl-setxid-race.patch: nptl: wait for pending setxid request also in
  detached thread (bsc#1162930, BZ #25942)</changelog>
  <changelog author="schwab@suse.de" date="1593518400">- nscd-senfile.patch: Fix concurrent changes on nscd aware files
  (bsc#1171878, BZ #23178)
- nscd-prune.patch: nscd: bump GC cycle during cache pruning (bsc#1171878,
  BZ #26130)
- syslog-locking.patch: Correct locking and cancellation cleanup in syslog
  functions (bsc#1172085, BZ #26100)</changelog>
  <changelog author="schwab@suse.de" date="1599048000">- Update to glibc 2.31
- glibc-2.14-crypt.diff, crypt_blowfish-const.patch,
  crypt_blowfish-1.2-sha.diff, crypt_blowfish-gensalt.patch,
  crypt_blowfish-1.2-hack_around_arm.diff, glibc-nodate.patch,
  powerpc-elision-enable-envvar.patch, s390-elision-enable-envvar.patch,
  crt-nocompress-debug-sections.patch, resolv-context-leak.patch,
  dl-runtime-resolve-opt-avx512f.patch, libpthread-compat-wrappers.patch,
  math-c++-compat.patch, remove-nss-nis-compat.patch,
  eh-frame-zero-terminator.patch, ld-so-hwcap-x86-64.patch,
  assert-pedantic.patch, getaddrinfo-errno.patch, resolv-conf-oom.patch,
  dynarray-allocation.patch, nearbyint-inexact.patch, nss-compat.patch,
  nscd-libnsl.patch, malloc-tcache-leak.patch,
  falkor-memcpy-memmove.patch, aarch64-cpu-features.patch,
  nss-files-large-buffers.patch, sysconf-uio-maxiov.patch,
  glob-tilde-overflow.patch, dl-runtime-resolve-xsave.patch,
  spawni-assert.patch, x86-64-dl-platform.patch, glob64-s390.patch,
  tst-tlsopt-powerpc.patch, powerpc-hwcap-bits.patch,
  malloc-tcache-check-overflow.patch, dl-init-paths-overflow.patch,
  fillin-rpath-empty-tokens.patch, getcwd-absolute.patch,
  memalign-overflow.patch, stack-guard-size-accounting.patch,
  libgcc-rtld-now.patch, res-send-enomem.patch,
  glibc-fix-avx512-mempcpy.patch, i386-memmove-sse2-unaligned.patch,
  realpath-ssize-max-overflow.patch, localtime-2039.patch,
  math-remove-slow-path.patch, aarch64-hwcap-atomics.patch,
  glibc-fix-aarch64-build.diff, absolute-symbols.patch,
  x86-haswell-string-flags.patch,
  pthread-cond-broadcast-waiters-after-spinning.patch,
  mman-map-sync.patch, mman-linux-map-shared-validate.patch,
  nptl-setxid-error.patch, pthread-mutex-trylock-barrier.patch,
  getaddrinfo-parse-ipv4-address.patch, japanese-era-name-may-2019.patch,
  force-elision-race.patch, regex-read-overrun.patch,
  regex-parse-reg-exp.patch,
  0001-S390-Add-configure-check-to-detect-z10-as-mininum-ar.patch,
  0002-S390-Use-hwcap-instead-of-dl_hwcap-in-ifunc-resolver.patch,
  0003-S390-Unify-31-64bit-memcpy.patch,
  0004-S390-Refactor-memcpy-mempcpy-ifunc-handling.patch,
  0005-S390-Remove-s390-specific-implementation-of-bcopy.patch,
  0006-S390-Use-memcpy-for-forward-cases-in-memmove.patch,
  0007-S390-Add-configure-check-to-detect-z13-as-mininum-ar.patch,
  0008-S390-Add-z13-memmove-ifunc-variant.patch,
  0009-S390-Add-z13-strstr-ifunc-variant.patch,
  0010-S390-Add-z13-memmem-ifunc-variant.patch,
  0011-S390-Cleanup-ifunc-resolve.h.patch,
  0012-S390-Mark-vx-and-vxe-as-important-hwcap.patch,
  0013-S390-Add-new-hwcap-values-for-new-cpu-architecture-a.patch,
  0014-S390-Add-configure-check-to-detect-support-for-arch1.patch,
  0015-S390-Add-arch13-memmove-ifunc-variant.patch,
  0016-S390-Add-arch13-strstr-ifunc-variant.patch,
  0017-S390-Add-arch13-memmem-ifunc-variant.patch,
  prefer-map-32bit-exec.patch, s390-strstr-page-boundary.patch,
  ppc-tle-htm-nosc.patch,
  posix-Add-internal-symbols-for-posix_spawn-interface.patch,
  glibc-2.29-posix-Use-posix_spawn-on-popen.patch,
  backtrace-powerpc.patch, pthread-rwlock-pwn.patch,
  manual-memory-protection.patch, ldbl-96-rem-pio2l.patch,
  dl-sort-maps.patch, dlopen-filter-object.patch,
  glob-use-after-free.patch, nptl-setxid-race.patch, nscd-senfile.patch,
  ldd-system-interp.patch, abort-no-flush.patch,
  fnmatch-collating-elements.patch, nss-files-long-lines-2.patch,
  iconv-reset-input-buffer.patch, nscd-prune.patch, syslog-locking.patch:
  Removed.
- long-double-alias.patch, glibc-nsswitch-usr.diff, euc-kr-overrun.patch,
  riscv-syscall-clobber.patch, nscd-gc-cycle.patch: Added.</changelog>
  <changelog author="schwab@suse.de" date="1604923200">- power10-support.patch: Add support for POWER10 (jsc#SLE-13520)
- iconv-option-parsing.patch: Rewrite iconv option parsing
  (CVE-2016-10228, bsc#1027496, BZ #19519)</changelog>
  <changelog author="schwab@suse.de" date="1608120000">- aarch64-getauxval.patch: aarch64: Accept PLT calls to __getauxval within
  libc.so (bsc#1167939)
- iconv-redundant-shift.patch: iconv: Accept redundant shift sequences in
  IBM1364 (CVE-2020-27618, bsc#1178386, BZ #26224)
- iconv-ucs4-loop-bounds.patch: iconv: Fix incorrect UCS4 inner loop
  bounds (CVE-2020-29562, bsc#1179694, BZ #26923)
- printf-long-double-non-normal.patch: x86: Harden printf against
  non-normal long double values (CVE-2020-29573, bsc#1179721, BZ #26649)
- get-nprocs-cpu-online-parsing.patch: Fix parsing of
  /sys/devices/system/cpu/online (bsc#1180038, BZ #25859)</changelog>
  <changelog author="schwab@suse.de" date="1609848000">- sysvipc-sem-stat-any.patch: sysvipc: Fix SEM_STAT_ANY kernel argument
  pass (bsc#1180557, BZ #26637)</changelog>
  <changelog author="schwab@suse.de" date="1611835200">- gconv-assertion-iso-2022-jp.patch: gconv: Fix assertion failure in
  ISO-2022-JP-3 module (CVE-2021-3326, bsc#1181505, BZ #27256)</changelog>
  <changelog author="schwab@suse.de" date="1614772800">- nscd-netgroupcache.patch: nscd: Fix double free in netgroupcache
  (CVE-2021-27645, bsc#1182733, BZ #27462)</changelog>
  <changelog author="rguenther@suse.com" date="1615377600">- Add glibc-2.31-HTM-vzeroupper.diff to avoid VZEROUPPER in the
  AVX2 accelerated string routines which cause HTM transaction
  aborts.  Instead use EVEX or SSE.  (bsc#1181403)</changelog>
  <changelog author="rguenther@suse.com" date="1615377601">- Update glibc-2.31-HTM-vzeroupper.diff with a AVX-SSE transition
  fix.</changelog>
  <changelog author="schwab@suse.de" date="1617019200">- s390-memmove-ifunc-selector-arch13.patch: S390: Also check vector
  support in memmove ifunc-selector (bsc#1184035, BZ #27511)</changelog>
  <changelog author="schwab@suse.de" date="1625140800">- wordexp-param-overflow.patch: wordexp: handle overflow in positional
  parameter number (CVE-2021-35942, bsc#1187911, BZ #28011)</changelog>
  <changelog author="schwab@suse.de" date="1630584000">- mq-notify-use-after-free.patch: Use __pthread_attr_copy in mq_notify
  (CVE-2021-33574, bsc#1186489, BZ #27896)</changelog>
  <changelog author="schwab@suse.de" date="1636027200">- 0001-s390x-Align-child-stack-while-clone.-BZ-27968.patch,
  0002-S390-Optimize-__memcpy_z196.patch,
  0003-S390-Optimize-__memset_z196.patch,
  0004-S390-Sync-HWCAP-names-with-kernel-by-adding-aliases-.patch,
  0005-S390-Add-new-hwcap-values.patch,
  0006-S390-Add-PCI_MIO-and-SIE-HWCAPs.patch: [15sp4 FEAT] GNU2007 -
  GLIBC: Support for new IBM Z Hardware (bsc#1191592, jsc#IBM-869)</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1640174400">- Add support for livepatches (jsc#SLE-20049).
- Enable livepatching on x86_64.
- Generate ipa-clones tarball artifact when livepatching is enabled.</changelog>
  <changelog author="schwab@suse.de" date="1642420800">- clnt-create-unix-overflow.patch: Buffer overflow in sunrpc clnt_create
  for "unix" (CVE-2022-23219, bsc#1194768, BZ #22542)
- svcunix-create-overflow.patch: Buffer overflow in sunrpc svcunix_create
  (CVE-2022-23218, bsc#1194770, BZ #28768)</changelog>
  <changelog author="schwab@suse.de" date="1642593600">- 0001-powerpc-Optimized-strcpy-for-POWER9.patch,
  0002-powerpc-Optimized-stpcpy-for-POWER9.patch,
  0003-powerpc-Optimized-rawmemchr-for-POWER9.patch,
  0004-powerpc64le-add-optimized-strlen-for-P9.patch,
  0005-powerpc-fix-ifunc-implementation-list-for-POWER9-str.patch,
  0006-powerpc-Add-optimized-strncpy-for-POWER9.patch,
  0007-powerpc-Add-optimized-stpncpy-for-POWER9.patch,
  0008-powerpc-Add-optimized-ilogb-for-POWER9.patch,
  0009-powerpc-Add-optimized-llogb-for-POWER9.patch,
  0010-powerpc-Add-optimized-strlen-for-POWER10.patch,
  0011-powerpc64le-Optimized-memmove-for-POWER10.patch,
  0012-powerpc64le-Optimize-memcpy-for-POWER10.patch,
  0013-powerpc64le-Optimize-memset-for-POWER10.patch,
  0014-powerpc64le-Fix-ifunc-selection-for-memset-memmove-b.patch,
  0015-powerpc-Add-optimized-rawmemchr-for-POWER10.patch: ppc64le ifunc
  improvements (bsc#1194785, jsc#SLE-18195)</changelog>
  <changelog author="schwab@suse.de" date="1643025600">- getcwd-erange.patch: getcwd: Set errno to ERANGE for size == 1
  (CVE-2021-3999, bsc#1194640, BZ #28769)</changelog>
</package>
<package pkgid="994dfe00c1a159ba2c232e26756623a2652750b6021507d045201d0066c4103e" name="glibc-devel-static" arch="x86_64">
  <version epoch="0" ver="2.31" rel="150300.9.12.1"/>
  <changelog author="schwab@suse.de" date="1583841600">- dl-sort-maps.patch, dlopen-filter-object.patch: Allow dlopen of filter
  object to work (bsc#1166106, BZ #16272)</changelog>
  <changelog author="schwab@suse.de" date="1585137600">- glob-use-after-free.patch: Fix use-after-free in glob when expanding
  ~user (CVE-2020-1752, bsc#1167631, BZ #25414)</changelog>
  <changelog author="schwab@suse.de" date="1589371200">- nptl-setxid-race.patch: nptl: wait for pending setxid request also in
  detached thread (bsc#1162930, BZ #25942)</changelog>
  <changelog author="schwab@suse.de" date="1593518400">- nscd-senfile.patch: Fix concurrent changes on nscd aware files
  (bsc#1171878, BZ #23178)
- nscd-prune.patch: nscd: bump GC cycle during cache pruning (bsc#1171878,
  BZ #26130)
- syslog-locking.patch: Correct locking and cancellation cleanup in syslog
  functions (bsc#1172085, BZ #26100)</changelog>
  <changelog author="schwab@suse.de" date="1599048000">- Update to glibc 2.31
- glibc-2.14-crypt.diff, crypt_blowfish-const.patch,
  crypt_blowfish-1.2-sha.diff, crypt_blowfish-gensalt.patch,
  crypt_blowfish-1.2-hack_around_arm.diff, glibc-nodate.patch,
  powerpc-elision-enable-envvar.patch, s390-elision-enable-envvar.patch,
  crt-nocompress-debug-sections.patch, resolv-context-leak.patch,
  dl-runtime-resolve-opt-avx512f.patch, libpthread-compat-wrappers.patch,
  math-c++-compat.patch, remove-nss-nis-compat.patch,
  eh-frame-zero-terminator.patch, ld-so-hwcap-x86-64.patch,
  assert-pedantic.patch, getaddrinfo-errno.patch, resolv-conf-oom.patch,
  dynarray-allocation.patch, nearbyint-inexact.patch, nss-compat.patch,
  nscd-libnsl.patch, malloc-tcache-leak.patch,
  falkor-memcpy-memmove.patch, aarch64-cpu-features.patch,
  nss-files-large-buffers.patch, sysconf-uio-maxiov.patch,
  glob-tilde-overflow.patch, dl-runtime-resolve-xsave.patch,
  spawni-assert.patch, x86-64-dl-platform.patch, glob64-s390.patch,
  tst-tlsopt-powerpc.patch, powerpc-hwcap-bits.patch,
  malloc-tcache-check-overflow.patch, dl-init-paths-overflow.patch,
  fillin-rpath-empty-tokens.patch, getcwd-absolute.patch,
  memalign-overflow.patch, stack-guard-size-accounting.patch,
  libgcc-rtld-now.patch, res-send-enomem.patch,
  glibc-fix-avx512-mempcpy.patch, i386-memmove-sse2-unaligned.patch,
  realpath-ssize-max-overflow.patch, localtime-2039.patch,
  math-remove-slow-path.patch, aarch64-hwcap-atomics.patch,
  glibc-fix-aarch64-build.diff, absolute-symbols.patch,
  x86-haswell-string-flags.patch,
  pthread-cond-broadcast-waiters-after-spinning.patch,
  mman-map-sync.patch, mman-linux-map-shared-validate.patch,
  nptl-setxid-error.patch, pthread-mutex-trylock-barrier.patch,
  getaddrinfo-parse-ipv4-address.patch, japanese-era-name-may-2019.patch,
  force-elision-race.patch, regex-read-overrun.patch,
  regex-parse-reg-exp.patch,
  0001-S390-Add-configure-check-to-detect-z10-as-mininum-ar.patch,
  0002-S390-Use-hwcap-instead-of-dl_hwcap-in-ifunc-resolver.patch,
  0003-S390-Unify-31-64bit-memcpy.patch,
  0004-S390-Refactor-memcpy-mempcpy-ifunc-handling.patch,
  0005-S390-Remove-s390-specific-implementation-of-bcopy.patch,
  0006-S390-Use-memcpy-for-forward-cases-in-memmove.patch,
  0007-S390-Add-configure-check-to-detect-z13-as-mininum-ar.patch,
  0008-S390-Add-z13-memmove-ifunc-variant.patch,
  0009-S390-Add-z13-strstr-ifunc-variant.patch,
  0010-S390-Add-z13-memmem-ifunc-variant.patch,
  0011-S390-Cleanup-ifunc-resolve.h.patch,
  0012-S390-Mark-vx-and-vxe-as-important-hwcap.patch,
  0013-S390-Add-new-hwcap-values-for-new-cpu-architecture-a.patch,
  0014-S390-Add-configure-check-to-detect-support-for-arch1.patch,
  0015-S390-Add-arch13-memmove-ifunc-variant.patch,
  0016-S390-Add-arch13-strstr-ifunc-variant.patch,
  0017-S390-Add-arch13-memmem-ifunc-variant.patch,
  prefer-map-32bit-exec.patch, s390-strstr-page-boundary.patch,
  ppc-tle-htm-nosc.patch,
  posix-Add-internal-symbols-for-posix_spawn-interface.patch,
  glibc-2.29-posix-Use-posix_spawn-on-popen.patch,
  backtrace-powerpc.patch, pthread-rwlock-pwn.patch,
  manual-memory-protection.patch, ldbl-96-rem-pio2l.patch,
  dl-sort-maps.patch, dlopen-filter-object.patch,
  glob-use-after-free.patch, nptl-setxid-race.patch, nscd-senfile.patch,
  ldd-system-interp.patch, abort-no-flush.patch,
  fnmatch-collating-elements.patch, nss-files-long-lines-2.patch,
  iconv-reset-input-buffer.patch, nscd-prune.patch, syslog-locking.patch:
  Removed.
- long-double-alias.patch, glibc-nsswitch-usr.diff, euc-kr-overrun.patch,
  riscv-syscall-clobber.patch, nscd-gc-cycle.patch: Added.</changelog>
  <changelog author="schwab@suse.de" date="1604923200">- power10-support.patch: Add support for POWER10 (jsc#SLE-13520)
- iconv-option-parsing.patch: Rewrite iconv option parsing
  (CVE-2016-10228, bsc#1027496, BZ #19519)</changelog>
  <changelog author="schwab@suse.de" date="1608120000">- aarch64-getauxval.patch: aarch64: Accept PLT calls to __getauxval within
  libc.so (bsc#1167939)
- iconv-redundant-shift.patch: iconv: Accept redundant shift sequences in
  IBM1364 (CVE-2020-27618, bsc#1178386, BZ #26224)
- iconv-ucs4-loop-bounds.patch: iconv: Fix incorrect UCS4 inner loop
  bounds (CVE-2020-29562, bsc#1179694, BZ #26923)
- printf-long-double-non-normal.patch: x86: Harden printf against
  non-normal long double values (CVE-2020-29573, bsc#1179721, BZ #26649)
- get-nprocs-cpu-online-parsing.patch: Fix parsing of
  /sys/devices/system/cpu/online (bsc#1180038, BZ #25859)</changelog>
  <changelog author="schwab@suse.de" date="1609848000">- sysvipc-sem-stat-any.patch: sysvipc: Fix SEM_STAT_ANY kernel argument
  pass (bsc#1180557, BZ #26637)</changelog>
  <changelog author="schwab@suse.de" date="1611835200">- gconv-assertion-iso-2022-jp.patch: gconv: Fix assertion failure in
  ISO-2022-JP-3 module (CVE-2021-3326, bsc#1181505, BZ #27256)</changelog>
  <changelog author="schwab@suse.de" date="1614772800">- nscd-netgroupcache.patch: nscd: Fix double free in netgroupcache
  (CVE-2021-27645, bsc#1182733, BZ #27462)</changelog>
  <changelog author="rguenther@suse.com" date="1615377600">- Add glibc-2.31-HTM-vzeroupper.diff to avoid VZEROUPPER in the
  AVX2 accelerated string routines which cause HTM transaction
  aborts.  Instead use EVEX or SSE.  (bsc#1181403)</changelog>
  <changelog author="rguenther@suse.com" date="1615377601">- Update glibc-2.31-HTM-vzeroupper.diff with a AVX-SSE transition
  fix.</changelog>
  <changelog author="schwab@suse.de" date="1617019200">- s390-memmove-ifunc-selector-arch13.patch: S390: Also check vector
  support in memmove ifunc-selector (bsc#1184035, BZ #27511)</changelog>
  <changelog author="schwab@suse.de" date="1625140800">- wordexp-param-overflow.patch: wordexp: handle overflow in positional
  parameter number (CVE-2021-35942, bsc#1187911, BZ #28011)</changelog>
  <changelog author="schwab@suse.de" date="1630584000">- mq-notify-use-after-free.patch: Use __pthread_attr_copy in mq_notify
  (CVE-2021-33574, bsc#1186489, BZ #27896)</changelog>
  <changelog author="schwab@suse.de" date="1636027200">- 0001-s390x-Align-child-stack-while-clone.-BZ-27968.patch,
  0002-S390-Optimize-__memcpy_z196.patch,
  0003-S390-Optimize-__memset_z196.patch,
  0004-S390-Sync-HWCAP-names-with-kernel-by-adding-aliases-.patch,
  0005-S390-Add-new-hwcap-values.patch,
  0006-S390-Add-PCI_MIO-and-SIE-HWCAPs.patch: [15sp4 FEAT] GNU2007 -
  GLIBC: Support for new IBM Z Hardware (bsc#1191592, jsc#IBM-869)</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1640174400">- Add support for livepatches (jsc#SLE-20049).
- Enable livepatching on x86_64.
- Generate ipa-clones tarball artifact when livepatching is enabled.</changelog>
  <changelog author="schwab@suse.de" date="1642420800">- clnt-create-unix-overflow.patch: Buffer overflow in sunrpc clnt_create
  for "unix" (CVE-2022-23219, bsc#1194768, BZ #22542)
- svcunix-create-overflow.patch: Buffer overflow in sunrpc svcunix_create
  (CVE-2022-23218, bsc#1194770, BZ #28768)</changelog>
  <changelog author="schwab@suse.de" date="1642593600">- 0001-powerpc-Optimized-strcpy-for-POWER9.patch,
  0002-powerpc-Optimized-stpcpy-for-POWER9.patch,
  0003-powerpc-Optimized-rawmemchr-for-POWER9.patch,
  0004-powerpc64le-add-optimized-strlen-for-P9.patch,
  0005-powerpc-fix-ifunc-implementation-list-for-POWER9-str.patch,
  0006-powerpc-Add-optimized-strncpy-for-POWER9.patch,
  0007-powerpc-Add-optimized-stpncpy-for-POWER9.patch,
  0008-powerpc-Add-optimized-ilogb-for-POWER9.patch,
  0009-powerpc-Add-optimized-llogb-for-POWER9.patch,
  0010-powerpc-Add-optimized-strlen-for-POWER10.patch,
  0011-powerpc64le-Optimized-memmove-for-POWER10.patch,
  0012-powerpc64le-Optimize-memcpy-for-POWER10.patch,
  0013-powerpc64le-Optimize-memset-for-POWER10.patch,
  0014-powerpc64le-Fix-ifunc-selection-for-memset-memmove-b.patch,
  0015-powerpc-Add-optimized-rawmemchr-for-POWER10.patch: ppc64le ifunc
  improvements (bsc#1194785, jsc#SLE-18195)</changelog>
  <changelog author="schwab@suse.de" date="1643025600">- getcwd-erange.patch: getcwd: Set errno to ERANGE for size == 1
  (CVE-2021-3999, bsc#1194640, BZ #28769)</changelog>
</package>
<package pkgid="52b4d7fbe23cbb60c4cb9fd23a8bca5b820d26d8fdf79940d07b4bdc5690e550" name="glibc-devel-static-32bit" arch="x86_64">
  <version epoch="0" ver="2.31" rel="150300.9.12.1"/>
  <changelog author="schwab@suse.de" date="1583841600">- dl-sort-maps.patch, dlopen-filter-object.patch: Allow dlopen of filter
  object to work (bsc#1166106, BZ #16272)</changelog>
  <changelog author="schwab@suse.de" date="1585137600">- glob-use-after-free.patch: Fix use-after-free in glob when expanding
  ~user (CVE-2020-1752, bsc#1167631, BZ #25414)</changelog>
  <changelog author="schwab@suse.de" date="1589371200">- nptl-setxid-race.patch: nptl: wait for pending setxid request also in
  detached thread (bsc#1162930, BZ #25942)</changelog>
  <changelog author="schwab@suse.de" date="1593518400">- nscd-senfile.patch: Fix concurrent changes on nscd aware files
  (bsc#1171878, BZ #23178)
- nscd-prune.patch: nscd: bump GC cycle during cache pruning (bsc#1171878,
  BZ #26130)
- syslog-locking.patch: Correct locking and cancellation cleanup in syslog
  functions (bsc#1172085, BZ #26100)</changelog>
  <changelog author="schwab@suse.de" date="1599048000">- Update to glibc 2.31
- glibc-2.14-crypt.diff, crypt_blowfish-const.patch,
  crypt_blowfish-1.2-sha.diff, crypt_blowfish-gensalt.patch,
  crypt_blowfish-1.2-hack_around_arm.diff, glibc-nodate.patch,
  powerpc-elision-enable-envvar.patch, s390-elision-enable-envvar.patch,
  crt-nocompress-debug-sections.patch, resolv-context-leak.patch,
  dl-runtime-resolve-opt-avx512f.patch, libpthread-compat-wrappers.patch,
  math-c++-compat.patch, remove-nss-nis-compat.patch,
  eh-frame-zero-terminator.patch, ld-so-hwcap-x86-64.patch,
  assert-pedantic.patch, getaddrinfo-errno.patch, resolv-conf-oom.patch,
  dynarray-allocation.patch, nearbyint-inexact.patch, nss-compat.patch,
  nscd-libnsl.patch, malloc-tcache-leak.patch,
  falkor-memcpy-memmove.patch, aarch64-cpu-features.patch,
  nss-files-large-buffers.patch, sysconf-uio-maxiov.patch,
  glob-tilde-overflow.patch, dl-runtime-resolve-xsave.patch,
  spawni-assert.patch, x86-64-dl-platform.patch, glob64-s390.patch,
  tst-tlsopt-powerpc.patch, powerpc-hwcap-bits.patch,
  malloc-tcache-check-overflow.patch, dl-init-paths-overflow.patch,
  fillin-rpath-empty-tokens.patch, getcwd-absolute.patch,
  memalign-overflow.patch, stack-guard-size-accounting.patch,
  libgcc-rtld-now.patch, res-send-enomem.patch,
  glibc-fix-avx512-mempcpy.patch, i386-memmove-sse2-unaligned.patch,
  realpath-ssize-max-overflow.patch, localtime-2039.patch,
  math-remove-slow-path.patch, aarch64-hwcap-atomics.patch,
  glibc-fix-aarch64-build.diff, absolute-symbols.patch,
  x86-haswell-string-flags.patch,
  pthread-cond-broadcast-waiters-after-spinning.patch,
  mman-map-sync.patch, mman-linux-map-shared-validate.patch,
  nptl-setxid-error.patch, pthread-mutex-trylock-barrier.patch,
  getaddrinfo-parse-ipv4-address.patch, japanese-era-name-may-2019.patch,
  force-elision-race.patch, regex-read-overrun.patch,
  regex-parse-reg-exp.patch,
  0001-S390-Add-configure-check-to-detect-z10-as-mininum-ar.patch,
  0002-S390-Use-hwcap-instead-of-dl_hwcap-in-ifunc-resolver.patch,
  0003-S390-Unify-31-64bit-memcpy.patch,
  0004-S390-Refactor-memcpy-mempcpy-ifunc-handling.patch,
  0005-S390-Remove-s390-specific-implementation-of-bcopy.patch,
  0006-S390-Use-memcpy-for-forward-cases-in-memmove.patch,
  0007-S390-Add-configure-check-to-detect-z13-as-mininum-ar.patch,
  0008-S390-Add-z13-memmove-ifunc-variant.patch,
  0009-S390-Add-z13-strstr-ifunc-variant.patch,
  0010-S390-Add-z13-memmem-ifunc-variant.patch,
  0011-S390-Cleanup-ifunc-resolve.h.patch,
  0012-S390-Mark-vx-and-vxe-as-important-hwcap.patch,
  0013-S390-Add-new-hwcap-values-for-new-cpu-architecture-a.patch,
  0014-S390-Add-configure-check-to-detect-support-for-arch1.patch,
  0015-S390-Add-arch13-memmove-ifunc-variant.patch,
  0016-S390-Add-arch13-strstr-ifunc-variant.patch,
  0017-S390-Add-arch13-memmem-ifunc-variant.patch,
  prefer-map-32bit-exec.patch, s390-strstr-page-boundary.patch,
  ppc-tle-htm-nosc.patch,
  posix-Add-internal-symbols-for-posix_spawn-interface.patch,
  glibc-2.29-posix-Use-posix_spawn-on-popen.patch,
  backtrace-powerpc.patch, pthread-rwlock-pwn.patch,
  manual-memory-protection.patch, ldbl-96-rem-pio2l.patch,
  dl-sort-maps.patch, dlopen-filter-object.patch,
  glob-use-after-free.patch, nptl-setxid-race.patch, nscd-senfile.patch,
  ldd-system-interp.patch, abort-no-flush.patch,
  fnmatch-collating-elements.patch, nss-files-long-lines-2.patch,
  iconv-reset-input-buffer.patch, nscd-prune.patch, syslog-locking.patch:
  Removed.
- long-double-alias.patch, glibc-nsswitch-usr.diff, euc-kr-overrun.patch,
  riscv-syscall-clobber.patch, nscd-gc-cycle.patch: Added.</changelog>
  <changelog author="schwab@suse.de" date="1604923200">- power10-support.patch: Add support for POWER10 (jsc#SLE-13520)
- iconv-option-parsing.patch: Rewrite iconv option parsing
  (CVE-2016-10228, bsc#1027496, BZ #19519)</changelog>
  <changelog author="schwab@suse.de" date="1608120000">- aarch64-getauxval.patch: aarch64: Accept PLT calls to __getauxval within
  libc.so (bsc#1167939)
- iconv-redundant-shift.patch: iconv: Accept redundant shift sequences in
  IBM1364 (CVE-2020-27618, bsc#1178386, BZ #26224)
- iconv-ucs4-loop-bounds.patch: iconv: Fix incorrect UCS4 inner loop
  bounds (CVE-2020-29562, bsc#1179694, BZ #26923)
- printf-long-double-non-normal.patch: x86: Harden printf against
  non-normal long double values (CVE-2020-29573, bsc#1179721, BZ #26649)
- get-nprocs-cpu-online-parsing.patch: Fix parsing of
  /sys/devices/system/cpu/online (bsc#1180038, BZ #25859)</changelog>
  <changelog author="schwab@suse.de" date="1609848000">- sysvipc-sem-stat-any.patch: sysvipc: Fix SEM_STAT_ANY kernel argument
  pass (bsc#1180557, BZ #26637)</changelog>
  <changelog author="schwab@suse.de" date="1611835200">- gconv-assertion-iso-2022-jp.patch: gconv: Fix assertion failure in
  ISO-2022-JP-3 module (CVE-2021-3326, bsc#1181505, BZ #27256)</changelog>
  <changelog author="schwab@suse.de" date="1614772800">- nscd-netgroupcache.patch: nscd: Fix double free in netgroupcache
  (CVE-2021-27645, bsc#1182733, BZ #27462)</changelog>
  <changelog author="rguenther@suse.com" date="1615377600">- Add glibc-2.31-HTM-vzeroupper.diff to avoid VZEROUPPER in the
  AVX2 accelerated string routines which cause HTM transaction
  aborts.  Instead use EVEX or SSE.  (bsc#1181403)</changelog>
  <changelog author="rguenther@suse.com" date="1615377601">- Update glibc-2.31-HTM-vzeroupper.diff with a AVX-SSE transition
  fix.</changelog>
  <changelog author="schwab@suse.de" date="1617019200">- s390-memmove-ifunc-selector-arch13.patch: S390: Also check vector
  support in memmove ifunc-selector (bsc#1184035, BZ #27511)</changelog>
  <changelog author="schwab@suse.de" date="1625140800">- wordexp-param-overflow.patch: wordexp: handle overflow in positional
  parameter number (CVE-2021-35942, bsc#1187911, BZ #28011)</changelog>
  <changelog author="schwab@suse.de" date="1630584000">- mq-notify-use-after-free.patch: Use __pthread_attr_copy in mq_notify
  (CVE-2021-33574, bsc#1186489, BZ #27896)</changelog>
  <changelog author="schwab@suse.de" date="1636027200">- 0001-s390x-Align-child-stack-while-clone.-BZ-27968.patch,
  0002-S390-Optimize-__memcpy_z196.patch,
  0003-S390-Optimize-__memset_z196.patch,
  0004-S390-Sync-HWCAP-names-with-kernel-by-adding-aliases-.patch,
  0005-S390-Add-new-hwcap-values.patch,
  0006-S390-Add-PCI_MIO-and-SIE-HWCAPs.patch: [15sp4 FEAT] GNU2007 -
  GLIBC: Support for new IBM Z Hardware (bsc#1191592, jsc#IBM-869)</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1640174400">- Add support for livepatches (jsc#SLE-20049).
- Enable livepatching on x86_64.
- Generate ipa-clones tarball artifact when livepatching is enabled.</changelog>
  <changelog author="schwab@suse.de" date="1642420800">- clnt-create-unix-overflow.patch: Buffer overflow in sunrpc clnt_create
  for "unix" (CVE-2022-23219, bsc#1194768, BZ #22542)
- svcunix-create-overflow.patch: Buffer overflow in sunrpc svcunix_create
  (CVE-2022-23218, bsc#1194770, BZ #28768)</changelog>
  <changelog author="schwab@suse.de" date="1642593600">- 0001-powerpc-Optimized-strcpy-for-POWER9.patch,
  0002-powerpc-Optimized-stpcpy-for-POWER9.patch,
  0003-powerpc-Optimized-rawmemchr-for-POWER9.patch,
  0004-powerpc64le-add-optimized-strlen-for-P9.patch,
  0005-powerpc-fix-ifunc-implementation-list-for-POWER9-str.patch,
  0006-powerpc-Add-optimized-strncpy-for-POWER9.patch,
  0007-powerpc-Add-optimized-stpncpy-for-POWER9.patch,
  0008-powerpc-Add-optimized-ilogb-for-POWER9.patch,
  0009-powerpc-Add-optimized-llogb-for-POWER9.patch,
  0010-powerpc-Add-optimized-strlen-for-POWER10.patch,
  0011-powerpc64le-Optimized-memmove-for-POWER10.patch,
  0012-powerpc64le-Optimize-memcpy-for-POWER10.patch,
  0013-powerpc64le-Optimize-memset-for-POWER10.patch,
  0014-powerpc64le-Fix-ifunc-selection-for-memset-memmove-b.patch,
  0015-powerpc-Add-optimized-rawmemchr-for-POWER10.patch: ppc64le ifunc
  improvements (bsc#1194785, jsc#SLE-18195)</changelog>
  <changelog author="schwab@suse.de" date="1643025600">- getcwd-erange.patch: getcwd: Set errno to ERANGE for size == 1
  (CVE-2021-3999, bsc#1194640, BZ #28769)</changelog>
</package>
<package pkgid="627c80edb79120ae1052000e3792733fcf5193027410335f47e25436f62b989d" name="glibc-extra" arch="aarch64">
  <version epoch="0" ver="2.31" rel="150300.9.12.1"/>
  <changelog author="schwab@suse.de" date="1583841600">- dl-sort-maps.patch, dlopen-filter-object.patch: Allow dlopen of filter
  object to work (bsc#1166106, BZ #16272)</changelog>
  <changelog author="schwab@suse.de" date="1585137600">- glob-use-after-free.patch: Fix use-after-free in glob when expanding
  ~user (CVE-2020-1752, bsc#1167631, BZ #25414)</changelog>
  <changelog author="schwab@suse.de" date="1589371200">- nptl-setxid-race.patch: nptl: wait for pending setxid request also in
  detached thread (bsc#1162930, BZ #25942)</changelog>
  <changelog author="schwab@suse.de" date="1593518400">- nscd-senfile.patch: Fix concurrent changes on nscd aware files
  (bsc#1171878, BZ #23178)
- nscd-prune.patch: nscd: bump GC cycle during cache pruning (bsc#1171878,
  BZ #26130)
- syslog-locking.patch: Correct locking and cancellation cleanup in syslog
  functions (bsc#1172085, BZ #26100)</changelog>
  <changelog author="schwab@suse.de" date="1599048000">- Update to glibc 2.31
- glibc-2.14-crypt.diff, crypt_blowfish-const.patch,
  crypt_blowfish-1.2-sha.diff, crypt_blowfish-gensalt.patch,
  crypt_blowfish-1.2-hack_around_arm.diff, glibc-nodate.patch,
  powerpc-elision-enable-envvar.patch, s390-elision-enable-envvar.patch,
  crt-nocompress-debug-sections.patch, resolv-context-leak.patch,
  dl-runtime-resolve-opt-avx512f.patch, libpthread-compat-wrappers.patch,
  math-c++-compat.patch, remove-nss-nis-compat.patch,
  eh-frame-zero-terminator.patch, ld-so-hwcap-x86-64.patch,
  assert-pedantic.patch, getaddrinfo-errno.patch, resolv-conf-oom.patch,
  dynarray-allocation.patch, nearbyint-inexact.patch, nss-compat.patch,
  nscd-libnsl.patch, malloc-tcache-leak.patch,
  falkor-memcpy-memmove.patch, aarch64-cpu-features.patch,
  nss-files-large-buffers.patch, sysconf-uio-maxiov.patch,
  glob-tilde-overflow.patch, dl-runtime-resolve-xsave.patch,
  spawni-assert.patch, x86-64-dl-platform.patch, glob64-s390.patch,
  tst-tlsopt-powerpc.patch, powerpc-hwcap-bits.patch,
  malloc-tcache-check-overflow.patch, dl-init-paths-overflow.patch,
  fillin-rpath-empty-tokens.patch, getcwd-absolute.patch,
  memalign-overflow.patch, stack-guard-size-accounting.patch,
  libgcc-rtld-now.patch, res-send-enomem.patch,
  glibc-fix-avx512-mempcpy.patch, i386-memmove-sse2-unaligned.patch,
  realpath-ssize-max-overflow.patch, localtime-2039.patch,
  math-remove-slow-path.patch, aarch64-hwcap-atomics.patch,
  glibc-fix-aarch64-build.diff, absolute-symbols.patch,
  x86-haswell-string-flags.patch,
  pthread-cond-broadcast-waiters-after-spinning.patch,
  mman-map-sync.patch, mman-linux-map-shared-validate.patch,
  nptl-setxid-error.patch, pthread-mutex-trylock-barrier.patch,
  getaddrinfo-parse-ipv4-address.patch, japanese-era-name-may-2019.patch,
  force-elision-race.patch, regex-read-overrun.patch,
  regex-parse-reg-exp.patch,
  0001-S390-Add-configure-check-to-detect-z10-as-mininum-ar.patch,
  0002-S390-Use-hwcap-instead-of-dl_hwcap-in-ifunc-resolver.patch,
  0003-S390-Unify-31-64bit-memcpy.patch,
  0004-S390-Refactor-memcpy-mempcpy-ifunc-handling.patch,
  0005-S390-Remove-s390-specific-implementation-of-bcopy.patch,
  0006-S390-Use-memcpy-for-forward-cases-in-memmove.patch,
  0007-S390-Add-configure-check-to-detect-z13-as-mininum-ar.patch,
  0008-S390-Add-z13-memmove-ifunc-variant.patch,
  0009-S390-Add-z13-strstr-ifunc-variant.patch,
  0010-S390-Add-z13-memmem-ifunc-variant.patch,
  0011-S390-Cleanup-ifunc-resolve.h.patch,
  0012-S390-Mark-vx-and-vxe-as-important-hwcap.patch,
  0013-S390-Add-new-hwcap-values-for-new-cpu-architecture-a.patch,
  0014-S390-Add-configure-check-to-detect-support-for-arch1.patch,
  0015-S390-Add-arch13-memmove-ifunc-variant.patch,
  0016-S390-Add-arch13-strstr-ifunc-variant.patch,
  0017-S390-Add-arch13-memmem-ifunc-variant.patch,
  prefer-map-32bit-exec.patch, s390-strstr-page-boundary.patch,
  ppc-tle-htm-nosc.patch,
  posix-Add-internal-symbols-for-posix_spawn-interface.patch,
  glibc-2.29-posix-Use-posix_spawn-on-popen.patch,
  backtrace-powerpc.patch, pthread-rwlock-pwn.patch,
  manual-memory-protection.patch, ldbl-96-rem-pio2l.patch,
  dl-sort-maps.patch, dlopen-filter-object.patch,
  glob-use-after-free.patch, nptl-setxid-race.patch, nscd-senfile.patch,
  ldd-system-interp.patch, abort-no-flush.patch,
  fnmatch-collating-elements.patch, nss-files-long-lines-2.patch,
  iconv-reset-input-buffer.patch, nscd-prune.patch, syslog-locking.patch:
  Removed.
- long-double-alias.patch, glibc-nsswitch-usr.diff, euc-kr-overrun.patch,
  riscv-syscall-clobber.patch, nscd-gc-cycle.patch: Added.</changelog>
  <changelog author="schwab@suse.de" date="1604923200">- power10-support.patch: Add support for POWER10 (jsc#SLE-13520)
- iconv-option-parsing.patch: Rewrite iconv option parsing
  (CVE-2016-10228, bsc#1027496, BZ #19519)</changelog>
  <changelog author="schwab@suse.de" date="1608120000">- aarch64-getauxval.patch: aarch64: Accept PLT calls to __getauxval within
  libc.so (bsc#1167939)
- iconv-redundant-shift.patch: iconv: Accept redundant shift sequences in
  IBM1364 (CVE-2020-27618, bsc#1178386, BZ #26224)
- iconv-ucs4-loop-bounds.patch: iconv: Fix incorrect UCS4 inner loop
  bounds (CVE-2020-29562, bsc#1179694, BZ #26923)
- printf-long-double-non-normal.patch: x86: Harden printf against
  non-normal long double values (CVE-2020-29573, bsc#1179721, BZ #26649)
- get-nprocs-cpu-online-parsing.patch: Fix parsing of
  /sys/devices/system/cpu/online (bsc#1180038, BZ #25859)</changelog>
  <changelog author="schwab@suse.de" date="1609848000">- sysvipc-sem-stat-any.patch: sysvipc: Fix SEM_STAT_ANY kernel argument
  pass (bsc#1180557, BZ #26637)</changelog>
  <changelog author="schwab@suse.de" date="1611835200">- gconv-assertion-iso-2022-jp.patch: gconv: Fix assertion failure in
  ISO-2022-JP-3 module (CVE-2021-3326, bsc#1181505, BZ #27256)</changelog>
  <changelog author="schwab@suse.de" date="1614772800">- nscd-netgroupcache.patch: nscd: Fix double free in netgroupcache
  (CVE-2021-27645, bsc#1182733, BZ #27462)</changelog>
  <changelog author="rguenther@suse.com" date="1615377600">- Add glibc-2.31-HTM-vzeroupper.diff to avoid VZEROUPPER in the
  AVX2 accelerated string routines which cause HTM transaction
  aborts.  Instead use EVEX or SSE.  (bsc#1181403)</changelog>
  <changelog author="rguenther@suse.com" date="1615377601">- Update glibc-2.31-HTM-vzeroupper.diff with a AVX-SSE transition
  fix.</changelog>
  <changelog author="schwab@suse.de" date="1617019200">- s390-memmove-ifunc-selector-arch13.patch: S390: Also check vector
  support in memmove ifunc-selector (bsc#1184035, BZ #27511)</changelog>
  <changelog author="schwab@suse.de" date="1625140800">- wordexp-param-overflow.patch: wordexp: handle overflow in positional
  parameter number (CVE-2021-35942, bsc#1187911, BZ #28011)</changelog>
  <changelog author="schwab@suse.de" date="1630584000">- mq-notify-use-after-free.patch: Use __pthread_attr_copy in mq_notify
  (CVE-2021-33574, bsc#1186489, BZ #27896)</changelog>
  <changelog author="schwab@suse.de" date="1636027200">- 0001-s390x-Align-child-stack-while-clone.-BZ-27968.patch,
  0002-S390-Optimize-__memcpy_z196.patch,
  0003-S390-Optimize-__memset_z196.patch,
  0004-S390-Sync-HWCAP-names-with-kernel-by-adding-aliases-.patch,
  0005-S390-Add-new-hwcap-values.patch,
  0006-S390-Add-PCI_MIO-and-SIE-HWCAPs.patch: [15sp4 FEAT] GNU2007 -
  GLIBC: Support for new IBM Z Hardware (bsc#1191592, jsc#IBM-869)</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1640174400">- Add support for livepatches (jsc#SLE-20049).
- Enable livepatching on x86_64.
- Generate ipa-clones tarball artifact when livepatching is enabled.</changelog>
  <changelog author="schwab@suse.de" date="1642420800">- clnt-create-unix-overflow.patch: Buffer overflow in sunrpc clnt_create
  for "unix" (CVE-2022-23219, bsc#1194768, BZ #22542)
- svcunix-create-overflow.patch: Buffer overflow in sunrpc svcunix_create
  (CVE-2022-23218, bsc#1194770, BZ #28768)</changelog>
  <changelog author="schwab@suse.de" date="1642593600">- 0001-powerpc-Optimized-strcpy-for-POWER9.patch,
  0002-powerpc-Optimized-stpcpy-for-POWER9.patch,
  0003-powerpc-Optimized-rawmemchr-for-POWER9.patch,
  0004-powerpc64le-add-optimized-strlen-for-P9.patch,
  0005-powerpc-fix-ifunc-implementation-list-for-POWER9-str.patch,
  0006-powerpc-Add-optimized-strncpy-for-POWER9.patch,
  0007-powerpc-Add-optimized-stpncpy-for-POWER9.patch,
  0008-powerpc-Add-optimized-ilogb-for-POWER9.patch,
  0009-powerpc-Add-optimized-llogb-for-POWER9.patch,
  0010-powerpc-Add-optimized-strlen-for-POWER10.patch,
  0011-powerpc64le-Optimized-memmove-for-POWER10.patch,
  0012-powerpc64le-Optimize-memcpy-for-POWER10.patch,
  0013-powerpc64le-Optimize-memset-for-POWER10.patch,
  0014-powerpc64le-Fix-ifunc-selection-for-memset-memmove-b.patch,
  0015-powerpc-Add-optimized-rawmemchr-for-POWER10.patch: ppc64le ifunc
  improvements (bsc#1194785, jsc#SLE-18195)</changelog>
  <changelog author="schwab@suse.de" date="1643025600">- getcwd-erange.patch: getcwd: Set errno to ERANGE for size == 1
  (CVE-2021-3999, bsc#1194640, BZ #28769)</changelog>
</package>
<package pkgid="bb48484542bee4f1b3a57b6a11406b6ef988b85f957d1589520eac5a72a7986d" name="glibc-extra" arch="ppc64le">
  <version epoch="0" ver="2.31" rel="150300.9.12.1"/>
  <changelog author="schwab@suse.de" date="1583841600">- dl-sort-maps.patch, dlopen-filter-object.patch: Allow dlopen of filter
  object to work (bsc#1166106, BZ #16272)</changelog>
  <changelog author="schwab@suse.de" date="1585137600">- glob-use-after-free.patch: Fix use-after-free in glob when expanding
  ~user (CVE-2020-1752, bsc#1167631, BZ #25414)</changelog>
  <changelog author="schwab@suse.de" date="1589371200">- nptl-setxid-race.patch: nptl: wait for pending setxid request also in
  detached thread (bsc#1162930, BZ #25942)</changelog>
  <changelog author="schwab@suse.de" date="1593518400">- nscd-senfile.patch: Fix concurrent changes on nscd aware files
  (bsc#1171878, BZ #23178)
- nscd-prune.patch: nscd: bump GC cycle during cache pruning (bsc#1171878,
  BZ #26130)
- syslog-locking.patch: Correct locking and cancellation cleanup in syslog
  functions (bsc#1172085, BZ #26100)</changelog>
  <changelog author="schwab@suse.de" date="1599048000">- Update to glibc 2.31
- glibc-2.14-crypt.diff, crypt_blowfish-const.patch,
  crypt_blowfish-1.2-sha.diff, crypt_blowfish-gensalt.patch,
  crypt_blowfish-1.2-hack_around_arm.diff, glibc-nodate.patch,
  powerpc-elision-enable-envvar.patch, s390-elision-enable-envvar.patch,
  crt-nocompress-debug-sections.patch, resolv-context-leak.patch,
  dl-runtime-resolve-opt-avx512f.patch, libpthread-compat-wrappers.patch,
  math-c++-compat.patch, remove-nss-nis-compat.patch,
  eh-frame-zero-terminator.patch, ld-so-hwcap-x86-64.patch,
  assert-pedantic.patch, getaddrinfo-errno.patch, resolv-conf-oom.patch,
  dynarray-allocation.patch, nearbyint-inexact.patch, nss-compat.patch,
  nscd-libnsl.patch, malloc-tcache-leak.patch,
  falkor-memcpy-memmove.patch, aarch64-cpu-features.patch,
  nss-files-large-buffers.patch, sysconf-uio-maxiov.patch,
  glob-tilde-overflow.patch, dl-runtime-resolve-xsave.patch,
  spawni-assert.patch, x86-64-dl-platform.patch, glob64-s390.patch,
  tst-tlsopt-powerpc.patch, powerpc-hwcap-bits.patch,
  malloc-tcache-check-overflow.patch, dl-init-paths-overflow.patch,
  fillin-rpath-empty-tokens.patch, getcwd-absolute.patch,
  memalign-overflow.patch, stack-guard-size-accounting.patch,
  libgcc-rtld-now.patch, res-send-enomem.patch,
  glibc-fix-avx512-mempcpy.patch, i386-memmove-sse2-unaligned.patch,
  realpath-ssize-max-overflow.patch, localtime-2039.patch,
  math-remove-slow-path.patch, aarch64-hwcap-atomics.patch,
  glibc-fix-aarch64-build.diff, absolute-symbols.patch,
  x86-haswell-string-flags.patch,
  pthread-cond-broadcast-waiters-after-spinning.patch,
  mman-map-sync.patch, mman-linux-map-shared-validate.patch,
  nptl-setxid-error.patch, pthread-mutex-trylock-barrier.patch,
  getaddrinfo-parse-ipv4-address.patch, japanese-era-name-may-2019.patch,
  force-elision-race.patch, regex-read-overrun.patch,
  regex-parse-reg-exp.patch,
  0001-S390-Add-configure-check-to-detect-z10-as-mininum-ar.patch,
  0002-S390-Use-hwcap-instead-of-dl_hwcap-in-ifunc-resolver.patch,
  0003-S390-Unify-31-64bit-memcpy.patch,
  0004-S390-Refactor-memcpy-mempcpy-ifunc-handling.patch,
  0005-S390-Remove-s390-specific-implementation-of-bcopy.patch,
  0006-S390-Use-memcpy-for-forward-cases-in-memmove.patch,
  0007-S390-Add-configure-check-to-detect-z13-as-mininum-ar.patch,
  0008-S390-Add-z13-memmove-ifunc-variant.patch,
  0009-S390-Add-z13-strstr-ifunc-variant.patch,
  0010-S390-Add-z13-memmem-ifunc-variant.patch,
  0011-S390-Cleanup-ifunc-resolve.h.patch,
  0012-S390-Mark-vx-and-vxe-as-important-hwcap.patch,
  0013-S390-Add-new-hwcap-values-for-new-cpu-architecture-a.patch,
  0014-S390-Add-configure-check-to-detect-support-for-arch1.patch,
  0015-S390-Add-arch13-memmove-ifunc-variant.patch,
  0016-S390-Add-arch13-strstr-ifunc-variant.patch,
  0017-S390-Add-arch13-memmem-ifunc-variant.patch,
  prefer-map-32bit-exec.patch, s390-strstr-page-boundary.patch,
  ppc-tle-htm-nosc.patch,
  posix-Add-internal-symbols-for-posix_spawn-interface.patch,
  glibc-2.29-posix-Use-posix_spawn-on-popen.patch,
  backtrace-powerpc.patch, pthread-rwlock-pwn.patch,
  manual-memory-protection.patch, ldbl-96-rem-pio2l.patch,
  dl-sort-maps.patch, dlopen-filter-object.patch,
  glob-use-after-free.patch, nptl-setxid-race.patch, nscd-senfile.patch,
  ldd-system-interp.patch, abort-no-flush.patch,
  fnmatch-collating-elements.patch, nss-files-long-lines-2.patch,
  iconv-reset-input-buffer.patch, nscd-prune.patch, syslog-locking.patch:
  Removed.
- long-double-alias.patch, glibc-nsswitch-usr.diff, euc-kr-overrun.patch,
  riscv-syscall-clobber.patch, nscd-gc-cycle.patch: Added.</changelog>
  <changelog author="schwab@suse.de" date="1604923200">- power10-support.patch: Add support for POWER10 (jsc#SLE-13520)
- iconv-option-parsing.patch: Rewrite iconv option parsing
  (CVE-2016-10228, bsc#1027496, BZ #19519)</changelog>
  <changelog author="schwab@suse.de" date="1608120000">- aarch64-getauxval.patch: aarch64: Accept PLT calls to __getauxval within
  libc.so (bsc#1167939)
- iconv-redundant-shift.patch: iconv: Accept redundant shift sequences in
  IBM1364 (CVE-2020-27618, bsc#1178386, BZ #26224)
- iconv-ucs4-loop-bounds.patch: iconv: Fix incorrect UCS4 inner loop
  bounds (CVE-2020-29562, bsc#1179694, BZ #26923)
- printf-long-double-non-normal.patch: x86: Harden printf against
  non-normal long double values (CVE-2020-29573, bsc#1179721, BZ #26649)
- get-nprocs-cpu-online-parsing.patch: Fix parsing of
  /sys/devices/system/cpu/online (bsc#1180038, BZ #25859)</changelog>
  <changelog author="schwab@suse.de" date="1609848000">- sysvipc-sem-stat-any.patch: sysvipc: Fix SEM_STAT_ANY kernel argument
  pass (bsc#1180557, BZ #26637)</changelog>
  <changelog author="schwab@suse.de" date="1611835200">- gconv-assertion-iso-2022-jp.patch: gconv: Fix assertion failure in
  ISO-2022-JP-3 module (CVE-2021-3326, bsc#1181505, BZ #27256)</changelog>
  <changelog author="schwab@suse.de" date="1614772800">- nscd-netgroupcache.patch: nscd: Fix double free in netgroupcache
  (CVE-2021-27645, bsc#1182733, BZ #27462)</changelog>
  <changelog author="rguenther@suse.com" date="1615377600">- Add glibc-2.31-HTM-vzeroupper.diff to avoid VZEROUPPER in the
  AVX2 accelerated string routines which cause HTM transaction
  aborts.  Instead use EVEX or SSE.  (bsc#1181403)</changelog>
  <changelog author="rguenther@suse.com" date="1615377601">- Update glibc-2.31-HTM-vzeroupper.diff with a AVX-SSE transition
  fix.</changelog>
  <changelog author="schwab@suse.de" date="1617019200">- s390-memmove-ifunc-selector-arch13.patch: S390: Also check vector
  support in memmove ifunc-selector (bsc#1184035, BZ #27511)</changelog>
  <changelog author="schwab@suse.de" date="1625140800">- wordexp-param-overflow.patch: wordexp: handle overflow in positional
  parameter number (CVE-2021-35942, bsc#1187911, BZ #28011)</changelog>
  <changelog author="schwab@suse.de" date="1630584000">- mq-notify-use-after-free.patch: Use __pthread_attr_copy in mq_notify
  (CVE-2021-33574, bsc#1186489, BZ #27896)</changelog>
  <changelog author="schwab@suse.de" date="1636027200">- 0001-s390x-Align-child-stack-while-clone.-BZ-27968.patch,
  0002-S390-Optimize-__memcpy_z196.patch,
  0003-S390-Optimize-__memset_z196.patch,
  0004-S390-Sync-HWCAP-names-with-kernel-by-adding-aliases-.patch,
  0005-S390-Add-new-hwcap-values.patch,
  0006-S390-Add-PCI_MIO-and-SIE-HWCAPs.patch: [15sp4 FEAT] GNU2007 -
  GLIBC: Support for new IBM Z Hardware (bsc#1191592, jsc#IBM-869)</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1640174400">- Add support for livepatches (jsc#SLE-20049).
- Enable livepatching on x86_64.
- Generate ipa-clones tarball artifact when livepatching is enabled.</changelog>
  <changelog author="schwab@suse.de" date="1642420800">- clnt-create-unix-overflow.patch: Buffer overflow in sunrpc clnt_create
  for "unix" (CVE-2022-23219, bsc#1194768, BZ #22542)
- svcunix-create-overflow.patch: Buffer overflow in sunrpc svcunix_create
  (CVE-2022-23218, bsc#1194770, BZ #28768)</changelog>
  <changelog author="schwab@suse.de" date="1642593600">- 0001-powerpc-Optimized-strcpy-for-POWER9.patch,
  0002-powerpc-Optimized-stpcpy-for-POWER9.patch,
  0003-powerpc-Optimized-rawmemchr-for-POWER9.patch,
  0004-powerpc64le-add-optimized-strlen-for-P9.patch,
  0005-powerpc-fix-ifunc-implementation-list-for-POWER9-str.patch,
  0006-powerpc-Add-optimized-strncpy-for-POWER9.patch,
  0007-powerpc-Add-optimized-stpncpy-for-POWER9.patch,
  0008-powerpc-Add-optimized-ilogb-for-POWER9.patch,
  0009-powerpc-Add-optimized-llogb-for-POWER9.patch,
  0010-powerpc-Add-optimized-strlen-for-POWER10.patch,
  0011-powerpc64le-Optimized-memmove-for-POWER10.patch,
  0012-powerpc64le-Optimize-memcpy-for-POWER10.patch,
  0013-powerpc64le-Optimize-memset-for-POWER10.patch,
  0014-powerpc64le-Fix-ifunc-selection-for-memset-memmove-b.patch,
  0015-powerpc-Add-optimized-rawmemchr-for-POWER10.patch: ppc64le ifunc
  improvements (bsc#1194785, jsc#SLE-18195)</changelog>
  <changelog author="schwab@suse.de" date="1643025600">- getcwd-erange.patch: getcwd: Set errno to ERANGE for size == 1
  (CVE-2021-3999, bsc#1194640, BZ #28769)</changelog>
</package>
<package pkgid="f4914cbd5bb24fc723ecffdf0846457f0e1e07532e09484286a41e0744526b0d" name="glibc-extra" arch="s390x">
  <version epoch="0" ver="2.31" rel="150300.9.12.1"/>
  <changelog author="schwab@suse.de" date="1583841600">- dl-sort-maps.patch, dlopen-filter-object.patch: Allow dlopen of filter
  object to work (bsc#1166106, BZ #16272)</changelog>
  <changelog author="schwab@suse.de" date="1585137600">- glob-use-after-free.patch: Fix use-after-free in glob when expanding
  ~user (CVE-2020-1752, bsc#1167631, BZ #25414)</changelog>
  <changelog author="schwab@suse.de" date="1589371200">- nptl-setxid-race.patch: nptl: wait for pending setxid request also in
  detached thread (bsc#1162930, BZ #25942)</changelog>
  <changelog author="schwab@suse.de" date="1593518400">- nscd-senfile.patch: Fix concurrent changes on nscd aware files
  (bsc#1171878, BZ #23178)
- nscd-prune.patch: nscd: bump GC cycle during cache pruning (bsc#1171878,
  BZ #26130)
- syslog-locking.patch: Correct locking and cancellation cleanup in syslog
  functions (bsc#1172085, BZ #26100)</changelog>
  <changelog author="schwab@suse.de" date="1599048000">- Update to glibc 2.31
- glibc-2.14-crypt.diff, crypt_blowfish-const.patch,
  crypt_blowfish-1.2-sha.diff, crypt_blowfish-gensalt.patch,
  crypt_blowfish-1.2-hack_around_arm.diff, glibc-nodate.patch,
  powerpc-elision-enable-envvar.patch, s390-elision-enable-envvar.patch,
  crt-nocompress-debug-sections.patch, resolv-context-leak.patch,
  dl-runtime-resolve-opt-avx512f.patch, libpthread-compat-wrappers.patch,
  math-c++-compat.patch, remove-nss-nis-compat.patch,
  eh-frame-zero-terminator.patch, ld-so-hwcap-x86-64.patch,
  assert-pedantic.patch, getaddrinfo-errno.patch, resolv-conf-oom.patch,
  dynarray-allocation.patch, nearbyint-inexact.patch, nss-compat.patch,
  nscd-libnsl.patch, malloc-tcache-leak.patch,
  falkor-memcpy-memmove.patch, aarch64-cpu-features.patch,
  nss-files-large-buffers.patch, sysconf-uio-maxiov.patch,
  glob-tilde-overflow.patch, dl-runtime-resolve-xsave.patch,
  spawni-assert.patch, x86-64-dl-platform.patch, glob64-s390.patch,
  tst-tlsopt-powerpc.patch, powerpc-hwcap-bits.patch,
  malloc-tcache-check-overflow.patch, dl-init-paths-overflow.patch,
  fillin-rpath-empty-tokens.patch, getcwd-absolute.patch,
  memalign-overflow.patch, stack-guard-size-accounting.patch,
  libgcc-rtld-now.patch, res-send-enomem.patch,
  glibc-fix-avx512-mempcpy.patch, i386-memmove-sse2-unaligned.patch,
  realpath-ssize-max-overflow.patch, localtime-2039.patch,
  math-remove-slow-path.patch, aarch64-hwcap-atomics.patch,
  glibc-fix-aarch64-build.diff, absolute-symbols.patch,
  x86-haswell-string-flags.patch,
  pthread-cond-broadcast-waiters-after-spinning.patch,
  mman-map-sync.patch, mman-linux-map-shared-validate.patch,
  nptl-setxid-error.patch, pthread-mutex-trylock-barrier.patch,
  getaddrinfo-parse-ipv4-address.patch, japanese-era-name-may-2019.patch,
  force-elision-race.patch, regex-read-overrun.patch,
  regex-parse-reg-exp.patch,
  0001-S390-Add-configure-check-to-detect-z10-as-mininum-ar.patch,
  0002-S390-Use-hwcap-instead-of-dl_hwcap-in-ifunc-resolver.patch,
  0003-S390-Unify-31-64bit-memcpy.patch,
  0004-S390-Refactor-memcpy-mempcpy-ifunc-handling.patch,
  0005-S390-Remove-s390-specific-implementation-of-bcopy.patch,
  0006-S390-Use-memcpy-for-forward-cases-in-memmove.patch,
  0007-S390-Add-configure-check-to-detect-z13-as-mininum-ar.patch,
  0008-S390-Add-z13-memmove-ifunc-variant.patch,
  0009-S390-Add-z13-strstr-ifunc-variant.patch,
  0010-S390-Add-z13-memmem-ifunc-variant.patch,
  0011-S390-Cleanup-ifunc-resolve.h.patch,
  0012-S390-Mark-vx-and-vxe-as-important-hwcap.patch,
  0013-S390-Add-new-hwcap-values-for-new-cpu-architecture-a.patch,
  0014-S390-Add-configure-check-to-detect-support-for-arch1.patch,
  0015-S390-Add-arch13-memmove-ifunc-variant.patch,
  0016-S390-Add-arch13-strstr-ifunc-variant.patch,
  0017-S390-Add-arch13-memmem-ifunc-variant.patch,
  prefer-map-32bit-exec.patch, s390-strstr-page-boundary.patch,
  ppc-tle-htm-nosc.patch,
  posix-Add-internal-symbols-for-posix_spawn-interface.patch,
  glibc-2.29-posix-Use-posix_spawn-on-popen.patch,
  backtrace-powerpc.patch, pthread-rwlock-pwn.patch,
  manual-memory-protection.patch, ldbl-96-rem-pio2l.patch,
  dl-sort-maps.patch, dlopen-filter-object.patch,
  glob-use-after-free.patch, nptl-setxid-race.patch, nscd-senfile.patch,
  ldd-system-interp.patch, abort-no-flush.patch,
  fnmatch-collating-elements.patch, nss-files-long-lines-2.patch,
  iconv-reset-input-buffer.patch, nscd-prune.patch, syslog-locking.patch:
  Removed.
- long-double-alias.patch, glibc-nsswitch-usr.diff, euc-kr-overrun.patch,
  riscv-syscall-clobber.patch, nscd-gc-cycle.patch: Added.</changelog>
  <changelog author="schwab@suse.de" date="1604923200">- power10-support.patch: Add support for POWER10 (jsc#SLE-13520)
- iconv-option-parsing.patch: Rewrite iconv option parsing
  (CVE-2016-10228, bsc#1027496, BZ #19519)</changelog>
  <changelog author="schwab@suse.de" date="1608120000">- aarch64-getauxval.patch: aarch64: Accept PLT calls to __getauxval within
  libc.so (bsc#1167939)
- iconv-redundant-shift.patch: iconv: Accept redundant shift sequences in
  IBM1364 (CVE-2020-27618, bsc#1178386, BZ #26224)
- iconv-ucs4-loop-bounds.patch: iconv: Fix incorrect UCS4 inner loop
  bounds (CVE-2020-29562, bsc#1179694, BZ #26923)
- printf-long-double-non-normal.patch: x86: Harden printf against
  non-normal long double values (CVE-2020-29573, bsc#1179721, BZ #26649)
- get-nprocs-cpu-online-parsing.patch: Fix parsing of
  /sys/devices/system/cpu/online (bsc#1180038, BZ #25859)</changelog>
  <changelog author="schwab@suse.de" date="1609848000">- sysvipc-sem-stat-any.patch: sysvipc: Fix SEM_STAT_ANY kernel argument
  pass (bsc#1180557, BZ #26637)</changelog>
  <changelog author="schwab@suse.de" date="1611835200">- gconv-assertion-iso-2022-jp.patch: gconv: Fix assertion failure in
  ISO-2022-JP-3 module (CVE-2021-3326, bsc#1181505, BZ #27256)</changelog>
  <changelog author="schwab@suse.de" date="1614772800">- nscd-netgroupcache.patch: nscd: Fix double free in netgroupcache
  (CVE-2021-27645, bsc#1182733, BZ #27462)</changelog>
  <changelog author="rguenther@suse.com" date="1615377600">- Add glibc-2.31-HTM-vzeroupper.diff to avoid VZEROUPPER in the
  AVX2 accelerated string routines which cause HTM transaction
  aborts.  Instead use EVEX or SSE.  (bsc#1181403)</changelog>
  <changelog author="rguenther@suse.com" date="1615377601">- Update glibc-2.31-HTM-vzeroupper.diff with a AVX-SSE transition
  fix.</changelog>
  <changelog author="schwab@suse.de" date="1617019200">- s390-memmove-ifunc-selector-arch13.patch: S390: Also check vector
  support in memmove ifunc-selector (bsc#1184035, BZ #27511)</changelog>
  <changelog author="schwab@suse.de" date="1625140800">- wordexp-param-overflow.patch: wordexp: handle overflow in positional
  parameter number (CVE-2021-35942, bsc#1187911, BZ #28011)</changelog>
  <changelog author="schwab@suse.de" date="1630584000">- mq-notify-use-after-free.patch: Use __pthread_attr_copy in mq_notify
  (CVE-2021-33574, bsc#1186489, BZ #27896)</changelog>
  <changelog author="schwab@suse.de" date="1636027200">- 0001-s390x-Align-child-stack-while-clone.-BZ-27968.patch,
  0002-S390-Optimize-__memcpy_z196.patch,
  0003-S390-Optimize-__memset_z196.patch,
  0004-S390-Sync-HWCAP-names-with-kernel-by-adding-aliases-.patch,
  0005-S390-Add-new-hwcap-values.patch,
  0006-S390-Add-PCI_MIO-and-SIE-HWCAPs.patch: [15sp4 FEAT] GNU2007 -
  GLIBC: Support for new IBM Z Hardware (bsc#1191592, jsc#IBM-869)</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1640174400">- Add support for livepatches (jsc#SLE-20049).
- Enable livepatching on x86_64.
- Generate ipa-clones tarball artifact when livepatching is enabled.</changelog>
  <changelog author="schwab@suse.de" date="1642420800">- clnt-create-unix-overflow.patch: Buffer overflow in sunrpc clnt_create
  for "unix" (CVE-2022-23219, bsc#1194768, BZ #22542)
- svcunix-create-overflow.patch: Buffer overflow in sunrpc svcunix_create
  (CVE-2022-23218, bsc#1194770, BZ #28768)</changelog>
  <changelog author="schwab@suse.de" date="1642593600">- 0001-powerpc-Optimized-strcpy-for-POWER9.patch,
  0002-powerpc-Optimized-stpcpy-for-POWER9.patch,
  0003-powerpc-Optimized-rawmemchr-for-POWER9.patch,
  0004-powerpc64le-add-optimized-strlen-for-P9.patch,
  0005-powerpc-fix-ifunc-implementation-list-for-POWER9-str.patch,
  0006-powerpc-Add-optimized-strncpy-for-POWER9.patch,
  0007-powerpc-Add-optimized-stpncpy-for-POWER9.patch,
  0008-powerpc-Add-optimized-ilogb-for-POWER9.patch,
  0009-powerpc-Add-optimized-llogb-for-POWER9.patch,
  0010-powerpc-Add-optimized-strlen-for-POWER10.patch,
  0011-powerpc64le-Optimized-memmove-for-POWER10.patch,
  0012-powerpc64le-Optimize-memcpy-for-POWER10.patch,
  0013-powerpc64le-Optimize-memset-for-POWER10.patch,
  0014-powerpc64le-Fix-ifunc-selection-for-memset-memmove-b.patch,
  0015-powerpc-Add-optimized-rawmemchr-for-POWER10.patch: ppc64le ifunc
  improvements (bsc#1194785, jsc#SLE-18195)</changelog>
  <changelog author="schwab@suse.de" date="1643025600">- getcwd-erange.patch: getcwd: Set errno to ERANGE for size == 1
  (CVE-2021-3999, bsc#1194640, BZ #28769)</changelog>
</package>
<package pkgid="2dd9a23e3724fa44d605fef4512dc07d0c81de2c28d0370dee0844c80db1bff3" name="glibc-extra" arch="x86_64">
  <version epoch="0" ver="2.31" rel="150300.9.12.1"/>
  <changelog author="schwab@suse.de" date="1583841600">- dl-sort-maps.patch, dlopen-filter-object.patch: Allow dlopen of filter
  object to work (bsc#1166106, BZ #16272)</changelog>
  <changelog author="schwab@suse.de" date="1585137600">- glob-use-after-free.patch: Fix use-after-free in glob when expanding
  ~user (CVE-2020-1752, bsc#1167631, BZ #25414)</changelog>
  <changelog author="schwab@suse.de" date="1589371200">- nptl-setxid-race.patch: nptl: wait for pending setxid request also in
  detached thread (bsc#1162930, BZ #25942)</changelog>
  <changelog author="schwab@suse.de" date="1593518400">- nscd-senfile.patch: Fix concurrent changes on nscd aware files
  (bsc#1171878, BZ #23178)
- nscd-prune.patch: nscd: bump GC cycle during cache pruning (bsc#1171878,
  BZ #26130)
- syslog-locking.patch: Correct locking and cancellation cleanup in syslog
  functions (bsc#1172085, BZ #26100)</changelog>
  <changelog author="schwab@suse.de" date="1599048000">- Update to glibc 2.31
- glibc-2.14-crypt.diff, crypt_blowfish-const.patch,
  crypt_blowfish-1.2-sha.diff, crypt_blowfish-gensalt.patch,
  crypt_blowfish-1.2-hack_around_arm.diff, glibc-nodate.patch,
  powerpc-elision-enable-envvar.patch, s390-elision-enable-envvar.patch,
  crt-nocompress-debug-sections.patch, resolv-context-leak.patch,
  dl-runtime-resolve-opt-avx512f.patch, libpthread-compat-wrappers.patch,
  math-c++-compat.patch, remove-nss-nis-compat.patch,
  eh-frame-zero-terminator.patch, ld-so-hwcap-x86-64.patch,
  assert-pedantic.patch, getaddrinfo-errno.patch, resolv-conf-oom.patch,
  dynarray-allocation.patch, nearbyint-inexact.patch, nss-compat.patch,
  nscd-libnsl.patch, malloc-tcache-leak.patch,
  falkor-memcpy-memmove.patch, aarch64-cpu-features.patch,
  nss-files-large-buffers.patch, sysconf-uio-maxiov.patch,
  glob-tilde-overflow.patch, dl-runtime-resolve-xsave.patch,
  spawni-assert.patch, x86-64-dl-platform.patch, glob64-s390.patch,
  tst-tlsopt-powerpc.patch, powerpc-hwcap-bits.patch,
  malloc-tcache-check-overflow.patch, dl-init-paths-overflow.patch,
  fillin-rpath-empty-tokens.patch, getcwd-absolute.patch,
  memalign-overflow.patch, stack-guard-size-accounting.patch,
  libgcc-rtld-now.patch, res-send-enomem.patch,
  glibc-fix-avx512-mempcpy.patch, i386-memmove-sse2-unaligned.patch,
  realpath-ssize-max-overflow.patch, localtime-2039.patch,
  math-remove-slow-path.patch, aarch64-hwcap-atomics.patch,
  glibc-fix-aarch64-build.diff, absolute-symbols.patch,
  x86-haswell-string-flags.patch,
  pthread-cond-broadcast-waiters-after-spinning.patch,
  mman-map-sync.patch, mman-linux-map-shared-validate.patch,
  nptl-setxid-error.patch, pthread-mutex-trylock-barrier.patch,
  getaddrinfo-parse-ipv4-address.patch, japanese-era-name-may-2019.patch,
  force-elision-race.patch, regex-read-overrun.patch,
  regex-parse-reg-exp.patch,
  0001-S390-Add-configure-check-to-detect-z10-as-mininum-ar.patch,
  0002-S390-Use-hwcap-instead-of-dl_hwcap-in-ifunc-resolver.patch,
  0003-S390-Unify-31-64bit-memcpy.patch,
  0004-S390-Refactor-memcpy-mempcpy-ifunc-handling.patch,
  0005-S390-Remove-s390-specific-implementation-of-bcopy.patch,
  0006-S390-Use-memcpy-for-forward-cases-in-memmove.patch,
  0007-S390-Add-configure-check-to-detect-z13-as-mininum-ar.patch,
  0008-S390-Add-z13-memmove-ifunc-variant.patch,
  0009-S390-Add-z13-strstr-ifunc-variant.patch,
  0010-S390-Add-z13-memmem-ifunc-variant.patch,
  0011-S390-Cleanup-ifunc-resolve.h.patch,
  0012-S390-Mark-vx-and-vxe-as-important-hwcap.patch,
  0013-S390-Add-new-hwcap-values-for-new-cpu-architecture-a.patch,
  0014-S390-Add-configure-check-to-detect-support-for-arch1.patch,
  0015-S390-Add-arch13-memmove-ifunc-variant.patch,
  0016-S390-Add-arch13-strstr-ifunc-variant.patch,
  0017-S390-Add-arch13-memmem-ifunc-variant.patch,
  prefer-map-32bit-exec.patch, s390-strstr-page-boundary.patch,
  ppc-tle-htm-nosc.patch,
  posix-Add-internal-symbols-for-posix_spawn-interface.patch,
  glibc-2.29-posix-Use-posix_spawn-on-popen.patch,
  backtrace-powerpc.patch, pthread-rwlock-pwn.patch,
  manual-memory-protection.patch, ldbl-96-rem-pio2l.patch,
  dl-sort-maps.patch, dlopen-filter-object.patch,
  glob-use-after-free.patch, nptl-setxid-race.patch, nscd-senfile.patch,
  ldd-system-interp.patch, abort-no-flush.patch,
  fnmatch-collating-elements.patch, nss-files-long-lines-2.patch,
  iconv-reset-input-buffer.patch, nscd-prune.patch, syslog-locking.patch:
  Removed.
- long-double-alias.patch, glibc-nsswitch-usr.diff, euc-kr-overrun.patch,
  riscv-syscall-clobber.patch, nscd-gc-cycle.patch: Added.</changelog>
  <changelog author="schwab@suse.de" date="1604923200">- power10-support.patch: Add support for POWER10 (jsc#SLE-13520)
- iconv-option-parsing.patch: Rewrite iconv option parsing
  (CVE-2016-10228, bsc#1027496, BZ #19519)</changelog>
  <changelog author="schwab@suse.de" date="1608120000">- aarch64-getauxval.patch: aarch64: Accept PLT calls to __getauxval within
  libc.so (bsc#1167939)
- iconv-redundant-shift.patch: iconv: Accept redundant shift sequences in
  IBM1364 (CVE-2020-27618, bsc#1178386, BZ #26224)
- iconv-ucs4-loop-bounds.patch: iconv: Fix incorrect UCS4 inner loop
  bounds (CVE-2020-29562, bsc#1179694, BZ #26923)
- printf-long-double-non-normal.patch: x86: Harden printf against
  non-normal long double values (CVE-2020-29573, bsc#1179721, BZ #26649)
- get-nprocs-cpu-online-parsing.patch: Fix parsing of
  /sys/devices/system/cpu/online (bsc#1180038, BZ #25859)</changelog>
  <changelog author="schwab@suse.de" date="1609848000">- sysvipc-sem-stat-any.patch: sysvipc: Fix SEM_STAT_ANY kernel argument
  pass (bsc#1180557, BZ #26637)</changelog>
  <changelog author="schwab@suse.de" date="1611835200">- gconv-assertion-iso-2022-jp.patch: gconv: Fix assertion failure in
  ISO-2022-JP-3 module (CVE-2021-3326, bsc#1181505, BZ #27256)</changelog>
  <changelog author="schwab@suse.de" date="1614772800">- nscd-netgroupcache.patch: nscd: Fix double free in netgroupcache
  (CVE-2021-27645, bsc#1182733, BZ #27462)</changelog>
  <changelog author="rguenther@suse.com" date="1615377600">- Add glibc-2.31-HTM-vzeroupper.diff to avoid VZEROUPPER in the
  AVX2 accelerated string routines which cause HTM transaction
  aborts.  Instead use EVEX or SSE.  (bsc#1181403)</changelog>
  <changelog author="rguenther@suse.com" date="1615377601">- Update glibc-2.31-HTM-vzeroupper.diff with a AVX-SSE transition
  fix.</changelog>
  <changelog author="schwab@suse.de" date="1617019200">- s390-memmove-ifunc-selector-arch13.patch: S390: Also check vector
  support in memmove ifunc-selector (bsc#1184035, BZ #27511)</changelog>
  <changelog author="schwab@suse.de" date="1625140800">- wordexp-param-overflow.patch: wordexp: handle overflow in positional
  parameter number (CVE-2021-35942, bsc#1187911, BZ #28011)</changelog>
  <changelog author="schwab@suse.de" date="1630584000">- mq-notify-use-after-free.patch: Use __pthread_attr_copy in mq_notify
  (CVE-2021-33574, bsc#1186489, BZ #27896)</changelog>
  <changelog author="schwab@suse.de" date="1636027200">- 0001-s390x-Align-child-stack-while-clone.-BZ-27968.patch,
  0002-S390-Optimize-__memcpy_z196.patch,
  0003-S390-Optimize-__memset_z196.patch,
  0004-S390-Sync-HWCAP-names-with-kernel-by-adding-aliases-.patch,
  0005-S390-Add-new-hwcap-values.patch,
  0006-S390-Add-PCI_MIO-and-SIE-HWCAPs.patch: [15sp4 FEAT] GNU2007 -
  GLIBC: Support for new IBM Z Hardware (bsc#1191592, jsc#IBM-869)</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1640174400">- Add support for livepatches (jsc#SLE-20049).
- Enable livepatching on x86_64.
- Generate ipa-clones tarball artifact when livepatching is enabled.</changelog>
  <changelog author="schwab@suse.de" date="1642420800">- clnt-create-unix-overflow.patch: Buffer overflow in sunrpc clnt_create
  for "unix" (CVE-2022-23219, bsc#1194768, BZ #22542)
- svcunix-create-overflow.patch: Buffer overflow in sunrpc svcunix_create
  (CVE-2022-23218, bsc#1194770, BZ #28768)</changelog>
  <changelog author="schwab@suse.de" date="1642593600">- 0001-powerpc-Optimized-strcpy-for-POWER9.patch,
  0002-powerpc-Optimized-stpcpy-for-POWER9.patch,
  0003-powerpc-Optimized-rawmemchr-for-POWER9.patch,
  0004-powerpc64le-add-optimized-strlen-for-P9.patch,
  0005-powerpc-fix-ifunc-implementation-list-for-POWER9-str.patch,
  0006-powerpc-Add-optimized-strncpy-for-POWER9.patch,
  0007-powerpc-Add-optimized-stpncpy-for-POWER9.patch,
  0008-powerpc-Add-optimized-ilogb-for-POWER9.patch,
  0009-powerpc-Add-optimized-llogb-for-POWER9.patch,
  0010-powerpc-Add-optimized-strlen-for-POWER10.patch,
  0011-powerpc64le-Optimized-memmove-for-POWER10.patch,
  0012-powerpc64le-Optimize-memcpy-for-POWER10.patch,
  0013-powerpc64le-Optimize-memset-for-POWER10.patch,
  0014-powerpc64le-Fix-ifunc-selection-for-memset-memmove-b.patch,
  0015-powerpc-Add-optimized-rawmemchr-for-POWER10.patch: ppc64le ifunc
  improvements (bsc#1194785, jsc#SLE-18195)</changelog>
  <changelog author="schwab@suse.de" date="1643025600">- getcwd-erange.patch: getcwd: Set errno to ERANGE for size == 1
  (CVE-2021-3999, bsc#1194640, BZ #28769)</changelog>
</package>
<package pkgid="acd16f1e5e419bc26e4986c009e342642db103cfda0048b061320fabf7e00031" name="glibc-html" arch="noarch">
  <version epoch="0" ver="2.31" rel="150300.9.12.1"/>
  <changelog author="schwab@suse.de" date="1583841600">- dl-sort-maps.patch, dlopen-filter-object.patch: Allow dlopen of filter
  object to work (bsc#1166106, BZ #16272)</changelog>
  <changelog author="schwab@suse.de" date="1585137600">- glob-use-after-free.patch: Fix use-after-free in glob when expanding
  ~user (CVE-2020-1752, bsc#1167631, BZ #25414)</changelog>
  <changelog author="schwab@suse.de" date="1589371200">- nptl-setxid-race.patch: nptl: wait for pending setxid request also in
  detached thread (bsc#1162930, BZ #25942)</changelog>
  <changelog author="schwab@suse.de" date="1593518400">- nscd-senfile.patch: Fix concurrent changes on nscd aware files
  (bsc#1171878, BZ #23178)
- nscd-prune.patch: nscd: bump GC cycle during cache pruning (bsc#1171878,
  BZ #26130)
- syslog-locking.patch: Correct locking and cancellation cleanup in syslog
  functions (bsc#1172085, BZ #26100)</changelog>
  <changelog author="schwab@suse.de" date="1599048000">- Update to glibc 2.31
- glibc-2.14-crypt.diff, crypt_blowfish-const.patch,
  crypt_blowfish-1.2-sha.diff, crypt_blowfish-gensalt.patch,
  crypt_blowfish-1.2-hack_around_arm.diff, glibc-nodate.patch,
  powerpc-elision-enable-envvar.patch, s390-elision-enable-envvar.patch,
  crt-nocompress-debug-sections.patch, resolv-context-leak.patch,
  dl-runtime-resolve-opt-avx512f.patch, libpthread-compat-wrappers.patch,
  math-c++-compat.patch, remove-nss-nis-compat.patch,
  eh-frame-zero-terminator.patch, ld-so-hwcap-x86-64.patch,
  assert-pedantic.patch, getaddrinfo-errno.patch, resolv-conf-oom.patch,
  dynarray-allocation.patch, nearbyint-inexact.patch, nss-compat.patch,
  nscd-libnsl.patch, malloc-tcache-leak.patch,
  falkor-memcpy-memmove.patch, aarch64-cpu-features.patch,
  nss-files-large-buffers.patch, sysconf-uio-maxiov.patch,
  glob-tilde-overflow.patch, dl-runtime-resolve-xsave.patch,
  spawni-assert.patch, x86-64-dl-platform.patch, glob64-s390.patch,
  tst-tlsopt-powerpc.patch, powerpc-hwcap-bits.patch,
  malloc-tcache-check-overflow.patch, dl-init-paths-overflow.patch,
  fillin-rpath-empty-tokens.patch, getcwd-absolute.patch,
  memalign-overflow.patch, stack-guard-size-accounting.patch,
  libgcc-rtld-now.patch, res-send-enomem.patch,
  glibc-fix-avx512-mempcpy.patch, i386-memmove-sse2-unaligned.patch,
  realpath-ssize-max-overflow.patch, localtime-2039.patch,
  math-remove-slow-path.patch, aarch64-hwcap-atomics.patch,
  glibc-fix-aarch64-build.diff, absolute-symbols.patch,
  x86-haswell-string-flags.patch,
  pthread-cond-broadcast-waiters-after-spinning.patch,
  mman-map-sync.patch, mman-linux-map-shared-validate.patch,
  nptl-setxid-error.patch, pthread-mutex-trylock-barrier.patch,
  getaddrinfo-parse-ipv4-address.patch, japanese-era-name-may-2019.patch,
  force-elision-race.patch, regex-read-overrun.patch,
  regex-parse-reg-exp.patch,
  0001-S390-Add-configure-check-to-detect-z10-as-mininum-ar.patch,
  0002-S390-Use-hwcap-instead-of-dl_hwcap-in-ifunc-resolver.patch,
  0003-S390-Unify-31-64bit-memcpy.patch,
  0004-S390-Refactor-memcpy-mempcpy-ifunc-handling.patch,
  0005-S390-Remove-s390-specific-implementation-of-bcopy.patch,
  0006-S390-Use-memcpy-for-forward-cases-in-memmove.patch,
  0007-S390-Add-configure-check-to-detect-z13-as-mininum-ar.patch,
  0008-S390-Add-z13-memmove-ifunc-variant.patch,
  0009-S390-Add-z13-strstr-ifunc-variant.patch,
  0010-S390-Add-z13-memmem-ifunc-variant.patch,
  0011-S390-Cleanup-ifunc-resolve.h.patch,
  0012-S390-Mark-vx-and-vxe-as-important-hwcap.patch,
  0013-S390-Add-new-hwcap-values-for-new-cpu-architecture-a.patch,
  0014-S390-Add-configure-check-to-detect-support-for-arch1.patch,
  0015-S390-Add-arch13-memmove-ifunc-variant.patch,
  0016-S390-Add-arch13-strstr-ifunc-variant.patch,
  0017-S390-Add-arch13-memmem-ifunc-variant.patch,
  prefer-map-32bit-exec.patch, s390-strstr-page-boundary.patch,
  ppc-tle-htm-nosc.patch,
  posix-Add-internal-symbols-for-posix_spawn-interface.patch,
  glibc-2.29-posix-Use-posix_spawn-on-popen.patch,
  backtrace-powerpc.patch, pthread-rwlock-pwn.patch,
  manual-memory-protection.patch, ldbl-96-rem-pio2l.patch,
  dl-sort-maps.patch, dlopen-filter-object.patch,
  glob-use-after-free.patch, nptl-setxid-race.patch, nscd-senfile.patch,
  ldd-system-interp.patch, abort-no-flush.patch,
  fnmatch-collating-elements.patch, nss-files-long-lines-2.patch,
  iconv-reset-input-buffer.patch, nscd-prune.patch, syslog-locking.patch:
  Removed.
- long-double-alias.patch, glibc-nsswitch-usr.diff, euc-kr-overrun.patch,
  riscv-syscall-clobber.patch, nscd-gc-cycle.patch: Added.</changelog>
  <changelog author="schwab@suse.de" date="1604923200">- power10-support.patch: Add support for POWER10 (jsc#SLE-13520)
- iconv-option-parsing.patch: Rewrite iconv option parsing
  (CVE-2016-10228, bsc#1027496, BZ #19519)</changelog>
  <changelog author="schwab@suse.de" date="1608120000">- aarch64-getauxval.patch: aarch64: Accept PLT calls to __getauxval within
  libc.so (bsc#1167939)
- iconv-redundant-shift.patch: iconv: Accept redundant shift sequences in
  IBM1364 (CVE-2020-27618, bsc#1178386, BZ #26224)
- iconv-ucs4-loop-bounds.patch: iconv: Fix incorrect UCS4 inner loop
  bounds (CVE-2020-29562, bsc#1179694, BZ #26923)
- printf-long-double-non-normal.patch: x86: Harden printf against
  non-normal long double values (CVE-2020-29573, bsc#1179721, BZ #26649)
- get-nprocs-cpu-online-parsing.patch: Fix parsing of
  /sys/devices/system/cpu/online (bsc#1180038, BZ #25859)</changelog>
  <changelog author="schwab@suse.de" date="1609848000">- sysvipc-sem-stat-any.patch: sysvipc: Fix SEM_STAT_ANY kernel argument
  pass (bsc#1180557, BZ #26637)</changelog>
  <changelog author="schwab@suse.de" date="1611835200">- gconv-assertion-iso-2022-jp.patch: gconv: Fix assertion failure in
  ISO-2022-JP-3 module (CVE-2021-3326, bsc#1181505, BZ #27256)</changelog>
  <changelog author="schwab@suse.de" date="1614772800">- nscd-netgroupcache.patch: nscd: Fix double free in netgroupcache
  (CVE-2021-27645, bsc#1182733, BZ #27462)</changelog>
  <changelog author="rguenther@suse.com" date="1615377600">- Add glibc-2.31-HTM-vzeroupper.diff to avoid VZEROUPPER in the
  AVX2 accelerated string routines which cause HTM transaction
  aborts.  Instead use EVEX or SSE.  (bsc#1181403)</changelog>
  <changelog author="rguenther@suse.com" date="1615377601">- Update glibc-2.31-HTM-vzeroupper.diff with a AVX-SSE transition
  fix.</changelog>
  <changelog author="schwab@suse.de" date="1617019200">- s390-memmove-ifunc-selector-arch13.patch: S390: Also check vector
  support in memmove ifunc-selector (bsc#1184035, BZ #27511)</changelog>
  <changelog author="schwab@suse.de" date="1625140800">- wordexp-param-overflow.patch: wordexp: handle overflow in positional
  parameter number (CVE-2021-35942, bsc#1187911, BZ #28011)</changelog>
  <changelog author="schwab@suse.de" date="1630584000">- mq-notify-use-after-free.patch: Use __pthread_attr_copy in mq_notify
  (CVE-2021-33574, bsc#1186489, BZ #27896)</changelog>
  <changelog author="schwab@suse.de" date="1636027200">- 0001-s390x-Align-child-stack-while-clone.-BZ-27968.patch,
  0002-S390-Optimize-__memcpy_z196.patch,
  0003-S390-Optimize-__memset_z196.patch,
  0004-S390-Sync-HWCAP-names-with-kernel-by-adding-aliases-.patch,
  0005-S390-Add-new-hwcap-values.patch,
  0006-S390-Add-PCI_MIO-and-SIE-HWCAPs.patch: [15sp4 FEAT] GNU2007 -
  GLIBC: Support for new IBM Z Hardware (bsc#1191592, jsc#IBM-869)</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1640174400">- Add support for livepatches (jsc#SLE-20049).
- Enable livepatching on x86_64.
- Generate ipa-clones tarball artifact when livepatching is enabled.</changelog>
  <changelog author="schwab@suse.de" date="1642420800">- clnt-create-unix-overflow.patch: Buffer overflow in sunrpc clnt_create
  for "unix" (CVE-2022-23219, bsc#1194768, BZ #22542)
- svcunix-create-overflow.patch: Buffer overflow in sunrpc svcunix_create
  (CVE-2022-23218, bsc#1194770, BZ #28768)</changelog>
  <changelog author="schwab@suse.de" date="1642593600">- 0001-powerpc-Optimized-strcpy-for-POWER9.patch,
  0002-powerpc-Optimized-stpcpy-for-POWER9.patch,
  0003-powerpc-Optimized-rawmemchr-for-POWER9.patch,
  0004-powerpc64le-add-optimized-strlen-for-P9.patch,
  0005-powerpc-fix-ifunc-implementation-list-for-POWER9-str.patch,
  0006-powerpc-Add-optimized-strncpy-for-POWER9.patch,
  0007-powerpc-Add-optimized-stpncpy-for-POWER9.patch,
  0008-powerpc-Add-optimized-ilogb-for-POWER9.patch,
  0009-powerpc-Add-optimized-llogb-for-POWER9.patch,
  0010-powerpc-Add-optimized-strlen-for-POWER10.patch,
  0011-powerpc64le-Optimized-memmove-for-POWER10.patch,
  0012-powerpc64le-Optimize-memcpy-for-POWER10.patch,
  0013-powerpc64le-Optimize-memset-for-POWER10.patch,
  0014-powerpc64le-Fix-ifunc-selection-for-memset-memmove-b.patch,
  0015-powerpc-Add-optimized-rawmemchr-for-POWER10.patch: ppc64le ifunc
  improvements (bsc#1194785, jsc#SLE-18195)</changelog>
  <changelog author="schwab@suse.de" date="1643025600">- getcwd-erange.patch: getcwd: Set errno to ERANGE for size == 1
  (CVE-2021-3999, bsc#1194640, BZ #28769)</changelog>
</package>
<package pkgid="d13b6b8a90dd33c1bcdb536b19e73dff346fe154e740e9881dea113f96b0cd8f" name="glibc-i18ndata" arch="noarch">
  <version epoch="0" ver="2.31" rel="150300.9.12.1"/>
  <changelog author="schwab@suse.de" date="1583841600">- dl-sort-maps.patch, dlopen-filter-object.patch: Allow dlopen of filter
  object to work (bsc#1166106, BZ #16272)</changelog>
  <changelog author="schwab@suse.de" date="1585137600">- glob-use-after-free.patch: Fix use-after-free in glob when expanding
  ~user (CVE-2020-1752, bsc#1167631, BZ #25414)</changelog>
  <changelog author="schwab@suse.de" date="1589371200">- nptl-setxid-race.patch: nptl: wait for pending setxid request also in
  detached thread (bsc#1162930, BZ #25942)</changelog>
  <changelog author="schwab@suse.de" date="1593518400">- nscd-senfile.patch: Fix concurrent changes on nscd aware files
  (bsc#1171878, BZ #23178)
- nscd-prune.patch: nscd: bump GC cycle during cache pruning (bsc#1171878,
  BZ #26130)
- syslog-locking.patch: Correct locking and cancellation cleanup in syslog
  functions (bsc#1172085, BZ #26100)</changelog>
  <changelog author="schwab@suse.de" date="1599048000">- Update to glibc 2.31
- glibc-2.14-crypt.diff, crypt_blowfish-const.patch,
  crypt_blowfish-1.2-sha.diff, crypt_blowfish-gensalt.patch,
  crypt_blowfish-1.2-hack_around_arm.diff, glibc-nodate.patch,
  powerpc-elision-enable-envvar.patch, s390-elision-enable-envvar.patch,
  crt-nocompress-debug-sections.patch, resolv-context-leak.patch,
  dl-runtime-resolve-opt-avx512f.patch, libpthread-compat-wrappers.patch,
  math-c++-compat.patch, remove-nss-nis-compat.patch,
  eh-frame-zero-terminator.patch, ld-so-hwcap-x86-64.patch,
  assert-pedantic.patch, getaddrinfo-errno.patch, resolv-conf-oom.patch,
  dynarray-allocation.patch, nearbyint-inexact.patch, nss-compat.patch,
  nscd-libnsl.patch, malloc-tcache-leak.patch,
  falkor-memcpy-memmove.patch, aarch64-cpu-features.patch,
  nss-files-large-buffers.patch, sysconf-uio-maxiov.patch,
  glob-tilde-overflow.patch, dl-runtime-resolve-xsave.patch,
  spawni-assert.patch, x86-64-dl-platform.patch, glob64-s390.patch,
  tst-tlsopt-powerpc.patch, powerpc-hwcap-bits.patch,
  malloc-tcache-check-overflow.patch, dl-init-paths-overflow.patch,
  fillin-rpath-empty-tokens.patch, getcwd-absolute.patch,
  memalign-overflow.patch, stack-guard-size-accounting.patch,
  libgcc-rtld-now.patch, res-send-enomem.patch,
  glibc-fix-avx512-mempcpy.patch, i386-memmove-sse2-unaligned.patch,
  realpath-ssize-max-overflow.patch, localtime-2039.patch,
  math-remove-slow-path.patch, aarch64-hwcap-atomics.patch,
  glibc-fix-aarch64-build.diff, absolute-symbols.patch,
  x86-haswell-string-flags.patch,
  pthread-cond-broadcast-waiters-after-spinning.patch,
  mman-map-sync.patch, mman-linux-map-shared-validate.patch,
  nptl-setxid-error.patch, pthread-mutex-trylock-barrier.patch,
  getaddrinfo-parse-ipv4-address.patch, japanese-era-name-may-2019.patch,
  force-elision-race.patch, regex-read-overrun.patch,
  regex-parse-reg-exp.patch,
  0001-S390-Add-configure-check-to-detect-z10-as-mininum-ar.patch,
  0002-S390-Use-hwcap-instead-of-dl_hwcap-in-ifunc-resolver.patch,
  0003-S390-Unify-31-64bit-memcpy.patch,
  0004-S390-Refactor-memcpy-mempcpy-ifunc-handling.patch,
  0005-S390-Remove-s390-specific-implementation-of-bcopy.patch,
  0006-S390-Use-memcpy-for-forward-cases-in-memmove.patch,
  0007-S390-Add-configure-check-to-detect-z13-as-mininum-ar.patch,
  0008-S390-Add-z13-memmove-ifunc-variant.patch,
  0009-S390-Add-z13-strstr-ifunc-variant.patch,
  0010-S390-Add-z13-memmem-ifunc-variant.patch,
  0011-S390-Cleanup-ifunc-resolve.h.patch,
  0012-S390-Mark-vx-and-vxe-as-important-hwcap.patch,
  0013-S390-Add-new-hwcap-values-for-new-cpu-architecture-a.patch,
  0014-S390-Add-configure-check-to-detect-support-for-arch1.patch,
  0015-S390-Add-arch13-memmove-ifunc-variant.patch,
  0016-S390-Add-arch13-strstr-ifunc-variant.patch,
  0017-S390-Add-arch13-memmem-ifunc-variant.patch,
  prefer-map-32bit-exec.patch, s390-strstr-page-boundary.patch,
  ppc-tle-htm-nosc.patch,
  posix-Add-internal-symbols-for-posix_spawn-interface.patch,
  glibc-2.29-posix-Use-posix_spawn-on-popen.patch,
  backtrace-powerpc.patch, pthread-rwlock-pwn.patch,
  manual-memory-protection.patch, ldbl-96-rem-pio2l.patch,
  dl-sort-maps.patch, dlopen-filter-object.patch,
  glob-use-after-free.patch, nptl-setxid-race.patch, nscd-senfile.patch,
  ldd-system-interp.patch, abort-no-flush.patch,
  fnmatch-collating-elements.patch, nss-files-long-lines-2.patch,
  iconv-reset-input-buffer.patch, nscd-prune.patch, syslog-locking.patch:
  Removed.
- long-double-alias.patch, glibc-nsswitch-usr.diff, euc-kr-overrun.patch,
  riscv-syscall-clobber.patch, nscd-gc-cycle.patch: Added.</changelog>
  <changelog author="schwab@suse.de" date="1604923200">- power10-support.patch: Add support for POWER10 (jsc#SLE-13520)
- iconv-option-parsing.patch: Rewrite iconv option parsing
  (CVE-2016-10228, bsc#1027496, BZ #19519)</changelog>
  <changelog author="schwab@suse.de" date="1608120000">- aarch64-getauxval.patch: aarch64: Accept PLT calls to __getauxval within
  libc.so (bsc#1167939)
- iconv-redundant-shift.patch: iconv: Accept redundant shift sequences in
  IBM1364 (CVE-2020-27618, bsc#1178386, BZ #26224)
- iconv-ucs4-loop-bounds.patch: iconv: Fix incorrect UCS4 inner loop
  bounds (CVE-2020-29562, bsc#1179694, BZ #26923)
- printf-long-double-non-normal.patch: x86: Harden printf against
  non-normal long double values (CVE-2020-29573, bsc#1179721, BZ #26649)
- get-nprocs-cpu-online-parsing.patch: Fix parsing of
  /sys/devices/system/cpu/online (bsc#1180038, BZ #25859)</changelog>
  <changelog author="schwab@suse.de" date="1609848000">- sysvipc-sem-stat-any.patch: sysvipc: Fix SEM_STAT_ANY kernel argument
  pass (bsc#1180557, BZ #26637)</changelog>
  <changelog author="schwab@suse.de" date="1611835200">- gconv-assertion-iso-2022-jp.patch: gconv: Fix assertion failure in
  ISO-2022-JP-3 module (CVE-2021-3326, bsc#1181505, BZ #27256)</changelog>
  <changelog author="schwab@suse.de" date="1614772800">- nscd-netgroupcache.patch: nscd: Fix double free in netgroupcache
  (CVE-2021-27645, bsc#1182733, BZ #27462)</changelog>
  <changelog author="rguenther@suse.com" date="1615377600">- Add glibc-2.31-HTM-vzeroupper.diff to avoid VZEROUPPER in the
  AVX2 accelerated string routines which cause HTM transaction
  aborts.  Instead use EVEX or SSE.  (bsc#1181403)</changelog>
  <changelog author="rguenther@suse.com" date="1615377601">- Update glibc-2.31-HTM-vzeroupper.diff with a AVX-SSE transition
  fix.</changelog>
  <changelog author="schwab@suse.de" date="1617019200">- s390-memmove-ifunc-selector-arch13.patch: S390: Also check vector
  support in memmove ifunc-selector (bsc#1184035, BZ #27511)</changelog>
  <changelog author="schwab@suse.de" date="1625140800">- wordexp-param-overflow.patch: wordexp: handle overflow in positional
  parameter number (CVE-2021-35942, bsc#1187911, BZ #28011)</changelog>
  <changelog author="schwab@suse.de" date="1630584000">- mq-notify-use-after-free.patch: Use __pthread_attr_copy in mq_notify
  (CVE-2021-33574, bsc#1186489, BZ #27896)</changelog>
  <changelog author="schwab@suse.de" date="1636027200">- 0001-s390x-Align-child-stack-while-clone.-BZ-27968.patch,
  0002-S390-Optimize-__memcpy_z196.patch,
  0003-S390-Optimize-__memset_z196.patch,
  0004-S390-Sync-HWCAP-names-with-kernel-by-adding-aliases-.patch,
  0005-S390-Add-new-hwcap-values.patch,
  0006-S390-Add-PCI_MIO-and-SIE-HWCAPs.patch: [15sp4 FEAT] GNU2007 -
  GLIBC: Support for new IBM Z Hardware (bsc#1191592, jsc#IBM-869)</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1640174400">- Add support for livepatches (jsc#SLE-20049).
- Enable livepatching on x86_64.
- Generate ipa-clones tarball artifact when livepatching is enabled.</changelog>
  <changelog author="schwab@suse.de" date="1642420800">- clnt-create-unix-overflow.patch: Buffer overflow in sunrpc clnt_create
  for "unix" (CVE-2022-23219, bsc#1194768, BZ #22542)
- svcunix-create-overflow.patch: Buffer overflow in sunrpc svcunix_create
  (CVE-2022-23218, bsc#1194770, BZ #28768)</changelog>
  <changelog author="schwab@suse.de" date="1642593600">- 0001-powerpc-Optimized-strcpy-for-POWER9.patch,
  0002-powerpc-Optimized-stpcpy-for-POWER9.patch,
  0003-powerpc-Optimized-rawmemchr-for-POWER9.patch,
  0004-powerpc64le-add-optimized-strlen-for-P9.patch,
  0005-powerpc-fix-ifunc-implementation-list-for-POWER9-str.patch,
  0006-powerpc-Add-optimized-strncpy-for-POWER9.patch,
  0007-powerpc-Add-optimized-stpncpy-for-POWER9.patch,
  0008-powerpc-Add-optimized-ilogb-for-POWER9.patch,
  0009-powerpc-Add-optimized-llogb-for-POWER9.patch,
  0010-powerpc-Add-optimized-strlen-for-POWER10.patch,
  0011-powerpc64le-Optimized-memmove-for-POWER10.patch,
  0012-powerpc64le-Optimize-memcpy-for-POWER10.patch,
  0013-powerpc64le-Optimize-memset-for-POWER10.patch,
  0014-powerpc64le-Fix-ifunc-selection-for-memset-memmove-b.patch,
  0015-powerpc-Add-optimized-rawmemchr-for-POWER10.patch: ppc64le ifunc
  improvements (bsc#1194785, jsc#SLE-18195)</changelog>
  <changelog author="schwab@suse.de" date="1643025600">- getcwd-erange.patch: getcwd: Set errno to ERANGE for size == 1
  (CVE-2021-3999, bsc#1194640, BZ #28769)</changelog>
</package>
<package pkgid="f5d549afa4b6c3e6263f92e562bc72b32531a44c55a82cabaef91f48ccf6575c" name="glibc-info" arch="noarch">
  <version epoch="0" ver="2.31" rel="150300.9.12.1"/>
  <changelog author="schwab@suse.de" date="1583841600">- dl-sort-maps.patch, dlopen-filter-object.patch: Allow dlopen of filter
  object to work (bsc#1166106, BZ #16272)</changelog>
  <changelog author="schwab@suse.de" date="1585137600">- glob-use-after-free.patch: Fix use-after-free in glob when expanding
  ~user (CVE-2020-1752, bsc#1167631, BZ #25414)</changelog>
  <changelog author="schwab@suse.de" date="1589371200">- nptl-setxid-race.patch: nptl: wait for pending setxid request also in
  detached thread (bsc#1162930, BZ #25942)</changelog>
  <changelog author="schwab@suse.de" date="1593518400">- nscd-senfile.patch: Fix concurrent changes on nscd aware files
  (bsc#1171878, BZ #23178)
- nscd-prune.patch: nscd: bump GC cycle during cache pruning (bsc#1171878,
  BZ #26130)
- syslog-locking.patch: Correct locking and cancellation cleanup in syslog
  functions (bsc#1172085, BZ #26100)</changelog>
  <changelog author="schwab@suse.de" date="1599048000">- Update to glibc 2.31
- glibc-2.14-crypt.diff, crypt_blowfish-const.patch,
  crypt_blowfish-1.2-sha.diff, crypt_blowfish-gensalt.patch,
  crypt_blowfish-1.2-hack_around_arm.diff, glibc-nodate.patch,
  powerpc-elision-enable-envvar.patch, s390-elision-enable-envvar.patch,
  crt-nocompress-debug-sections.patch, resolv-context-leak.patch,
  dl-runtime-resolve-opt-avx512f.patch, libpthread-compat-wrappers.patch,
  math-c++-compat.patch, remove-nss-nis-compat.patch,
  eh-frame-zero-terminator.patch, ld-so-hwcap-x86-64.patch,
  assert-pedantic.patch, getaddrinfo-errno.patch, resolv-conf-oom.patch,
  dynarray-allocation.patch, nearbyint-inexact.patch, nss-compat.patch,
  nscd-libnsl.patch, malloc-tcache-leak.patch,
  falkor-memcpy-memmove.patch, aarch64-cpu-features.patch,
  nss-files-large-buffers.patch, sysconf-uio-maxiov.patch,
  glob-tilde-overflow.patch, dl-runtime-resolve-xsave.patch,
  spawni-assert.patch, x86-64-dl-platform.patch, glob64-s390.patch,
  tst-tlsopt-powerpc.patch, powerpc-hwcap-bits.patch,
  malloc-tcache-check-overflow.patch, dl-init-paths-overflow.patch,
  fillin-rpath-empty-tokens.patch, getcwd-absolute.patch,
  memalign-overflow.patch, stack-guard-size-accounting.patch,
  libgcc-rtld-now.patch, res-send-enomem.patch,
  glibc-fix-avx512-mempcpy.patch, i386-memmove-sse2-unaligned.patch,
  realpath-ssize-max-overflow.patch, localtime-2039.patch,
  math-remove-slow-path.patch, aarch64-hwcap-atomics.patch,
  glibc-fix-aarch64-build.diff, absolute-symbols.patch,
  x86-haswell-string-flags.patch,
  pthread-cond-broadcast-waiters-after-spinning.patch,
  mman-map-sync.patch, mman-linux-map-shared-validate.patch,
  nptl-setxid-error.patch, pthread-mutex-trylock-barrier.patch,
  getaddrinfo-parse-ipv4-address.patch, japanese-era-name-may-2019.patch,
  force-elision-race.patch, regex-read-overrun.patch,
  regex-parse-reg-exp.patch,
  0001-S390-Add-configure-check-to-detect-z10-as-mininum-ar.patch,
  0002-S390-Use-hwcap-instead-of-dl_hwcap-in-ifunc-resolver.patch,
  0003-S390-Unify-31-64bit-memcpy.patch,
  0004-S390-Refactor-memcpy-mempcpy-ifunc-handling.patch,
  0005-S390-Remove-s390-specific-implementation-of-bcopy.patch,
  0006-S390-Use-memcpy-for-forward-cases-in-memmove.patch,
  0007-S390-Add-configure-check-to-detect-z13-as-mininum-ar.patch,
  0008-S390-Add-z13-memmove-ifunc-variant.patch,
  0009-S390-Add-z13-strstr-ifunc-variant.patch,
  0010-S390-Add-z13-memmem-ifunc-variant.patch,
  0011-S390-Cleanup-ifunc-resolve.h.patch,
  0012-S390-Mark-vx-and-vxe-as-important-hwcap.patch,
  0013-S390-Add-new-hwcap-values-for-new-cpu-architecture-a.patch,
  0014-S390-Add-configure-check-to-detect-support-for-arch1.patch,
  0015-S390-Add-arch13-memmove-ifunc-variant.patch,
  0016-S390-Add-arch13-strstr-ifunc-variant.patch,
  0017-S390-Add-arch13-memmem-ifunc-variant.patch,
  prefer-map-32bit-exec.patch, s390-strstr-page-boundary.patch,
  ppc-tle-htm-nosc.patch,
  posix-Add-internal-symbols-for-posix_spawn-interface.patch,
  glibc-2.29-posix-Use-posix_spawn-on-popen.patch,
  backtrace-powerpc.patch, pthread-rwlock-pwn.patch,
  manual-memory-protection.patch, ldbl-96-rem-pio2l.patch,
  dl-sort-maps.patch, dlopen-filter-object.patch,
  glob-use-after-free.patch, nptl-setxid-race.patch, nscd-senfile.patch,
  ldd-system-interp.patch, abort-no-flush.patch,
  fnmatch-collating-elements.patch, nss-files-long-lines-2.patch,
  iconv-reset-input-buffer.patch, nscd-prune.patch, syslog-locking.patch:
  Removed.
- long-double-alias.patch, glibc-nsswitch-usr.diff, euc-kr-overrun.patch,
  riscv-syscall-clobber.patch, nscd-gc-cycle.patch: Added.</changelog>
  <changelog author="schwab@suse.de" date="1604923200">- power10-support.patch: Add support for POWER10 (jsc#SLE-13520)
- iconv-option-parsing.patch: Rewrite iconv option parsing
  (CVE-2016-10228, bsc#1027496, BZ #19519)</changelog>
  <changelog author="schwab@suse.de" date="1608120000">- aarch64-getauxval.patch: aarch64: Accept PLT calls to __getauxval within
  libc.so (bsc#1167939)
- iconv-redundant-shift.patch: iconv: Accept redundant shift sequences in
  IBM1364 (CVE-2020-27618, bsc#1178386, BZ #26224)
- iconv-ucs4-loop-bounds.patch: iconv: Fix incorrect UCS4 inner loop
  bounds (CVE-2020-29562, bsc#1179694, BZ #26923)
- printf-long-double-non-normal.patch: x86: Harden printf against
  non-normal long double values (CVE-2020-29573, bsc#1179721, BZ #26649)
- get-nprocs-cpu-online-parsing.patch: Fix parsing of
  /sys/devices/system/cpu/online (bsc#1180038, BZ #25859)</changelog>
  <changelog author="schwab@suse.de" date="1609848000">- sysvipc-sem-stat-any.patch: sysvipc: Fix SEM_STAT_ANY kernel argument
  pass (bsc#1180557, BZ #26637)</changelog>
  <changelog author="schwab@suse.de" date="1611835200">- gconv-assertion-iso-2022-jp.patch: gconv: Fix assertion failure in
  ISO-2022-JP-3 module (CVE-2021-3326, bsc#1181505, BZ #27256)</changelog>
  <changelog author="schwab@suse.de" date="1614772800">- nscd-netgroupcache.patch: nscd: Fix double free in netgroupcache
  (CVE-2021-27645, bsc#1182733, BZ #27462)</changelog>
  <changelog author="rguenther@suse.com" date="1615377600">- Add glibc-2.31-HTM-vzeroupper.diff to avoid VZEROUPPER in the
  AVX2 accelerated string routines which cause HTM transaction
  aborts.  Instead use EVEX or SSE.  (bsc#1181403)</changelog>
  <changelog author="rguenther@suse.com" date="1615377601">- Update glibc-2.31-HTM-vzeroupper.diff with a AVX-SSE transition
  fix.</changelog>
  <changelog author="schwab@suse.de" date="1617019200">- s390-memmove-ifunc-selector-arch13.patch: S390: Also check vector
  support in memmove ifunc-selector (bsc#1184035, BZ #27511)</changelog>
  <changelog author="schwab@suse.de" date="1625140800">- wordexp-param-overflow.patch: wordexp: handle overflow in positional
  parameter number (CVE-2021-35942, bsc#1187911, BZ #28011)</changelog>
  <changelog author="schwab@suse.de" date="1630584000">- mq-notify-use-after-free.patch: Use __pthread_attr_copy in mq_notify
  (CVE-2021-33574, bsc#1186489, BZ #27896)</changelog>
  <changelog author="schwab@suse.de" date="1636027200">- 0001-s390x-Align-child-stack-while-clone.-BZ-27968.patch,
  0002-S390-Optimize-__memcpy_z196.patch,
  0003-S390-Optimize-__memset_z196.patch,
  0004-S390-Sync-HWCAP-names-with-kernel-by-adding-aliases-.patch,
  0005-S390-Add-new-hwcap-values.patch,
  0006-S390-Add-PCI_MIO-and-SIE-HWCAPs.patch: [15sp4 FEAT] GNU2007 -
  GLIBC: Support for new IBM Z Hardware (bsc#1191592, jsc#IBM-869)</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1640174400">- Add support for livepatches (jsc#SLE-20049).
- Enable livepatching on x86_64.
- Generate ipa-clones tarball artifact when livepatching is enabled.</changelog>
  <changelog author="schwab@suse.de" date="1642420800">- clnt-create-unix-overflow.patch: Buffer overflow in sunrpc clnt_create
  for "unix" (CVE-2022-23219, bsc#1194768, BZ #22542)
- svcunix-create-overflow.patch: Buffer overflow in sunrpc svcunix_create
  (CVE-2022-23218, bsc#1194770, BZ #28768)</changelog>
  <changelog author="schwab@suse.de" date="1642593600">- 0001-powerpc-Optimized-strcpy-for-POWER9.patch,
  0002-powerpc-Optimized-stpcpy-for-POWER9.patch,
  0003-powerpc-Optimized-rawmemchr-for-POWER9.patch,
  0004-powerpc64le-add-optimized-strlen-for-P9.patch,
  0005-powerpc-fix-ifunc-implementation-list-for-POWER9-str.patch,
  0006-powerpc-Add-optimized-strncpy-for-POWER9.patch,
  0007-powerpc-Add-optimized-stpncpy-for-POWER9.patch,
  0008-powerpc-Add-optimized-ilogb-for-POWER9.patch,
  0009-powerpc-Add-optimized-llogb-for-POWER9.patch,
  0010-powerpc-Add-optimized-strlen-for-POWER10.patch,
  0011-powerpc64le-Optimized-memmove-for-POWER10.patch,
  0012-powerpc64le-Optimize-memcpy-for-POWER10.patch,
  0013-powerpc64le-Optimize-memset-for-POWER10.patch,
  0014-powerpc64le-Fix-ifunc-selection-for-memset-memmove-b.patch,
  0015-powerpc-Add-optimized-rawmemchr-for-POWER10.patch: ppc64le ifunc
  improvements (bsc#1194785, jsc#SLE-18195)</changelog>
  <changelog author="schwab@suse.de" date="1643025600">- getcwd-erange.patch: getcwd: Set errno to ERANGE for size == 1
  (CVE-2021-3999, bsc#1194640, BZ #28769)</changelog>
</package>
<package pkgid="0cfd8a2baeac1623ee1c2a9d406403b620493285eb6dfb1e838f3f3803cd8345" name="glibc-lang" arch="noarch">
  <version epoch="0" ver="2.31" rel="150300.9.12.1"/>
  <changelog author="schwab@suse.de" date="1583841600">- dl-sort-maps.patch, dlopen-filter-object.patch: Allow dlopen of filter
  object to work (bsc#1166106, BZ #16272)</changelog>
  <changelog author="schwab@suse.de" date="1585137600">- glob-use-after-free.patch: Fix use-after-free in glob when expanding
  ~user (CVE-2020-1752, bsc#1167631, BZ #25414)</changelog>
  <changelog author="schwab@suse.de" date="1589371200">- nptl-setxid-race.patch: nptl: wait for pending setxid request also in
  detached thread (bsc#1162930, BZ #25942)</changelog>
  <changelog author="schwab@suse.de" date="1593518400">- nscd-senfile.patch: Fix concurrent changes on nscd aware files
  (bsc#1171878, BZ #23178)
- nscd-prune.patch: nscd: bump GC cycle during cache pruning (bsc#1171878,
  BZ #26130)
- syslog-locking.patch: Correct locking and cancellation cleanup in syslog
  functions (bsc#1172085, BZ #26100)</changelog>
  <changelog author="schwab@suse.de" date="1599048000">- Update to glibc 2.31
- glibc-2.14-crypt.diff, crypt_blowfish-const.patch,
  crypt_blowfish-1.2-sha.diff, crypt_blowfish-gensalt.patch,
  crypt_blowfish-1.2-hack_around_arm.diff, glibc-nodate.patch,
  powerpc-elision-enable-envvar.patch, s390-elision-enable-envvar.patch,
  crt-nocompress-debug-sections.patch, resolv-context-leak.patch,
  dl-runtime-resolve-opt-avx512f.patch, libpthread-compat-wrappers.patch,
  math-c++-compat.patch, remove-nss-nis-compat.patch,
  eh-frame-zero-terminator.patch, ld-so-hwcap-x86-64.patch,
  assert-pedantic.patch, getaddrinfo-errno.patch, resolv-conf-oom.patch,
  dynarray-allocation.patch, nearbyint-inexact.patch, nss-compat.patch,
  nscd-libnsl.patch, malloc-tcache-leak.patch,
  falkor-memcpy-memmove.patch, aarch64-cpu-features.patch,
  nss-files-large-buffers.patch, sysconf-uio-maxiov.patch,
  glob-tilde-overflow.patch, dl-runtime-resolve-xsave.patch,
  spawni-assert.patch, x86-64-dl-platform.patch, glob64-s390.patch,
  tst-tlsopt-powerpc.patch, powerpc-hwcap-bits.patch,
  malloc-tcache-check-overflow.patch, dl-init-paths-overflow.patch,
  fillin-rpath-empty-tokens.patch, getcwd-absolute.patch,
  memalign-overflow.patch, stack-guard-size-accounting.patch,
  libgcc-rtld-now.patch, res-send-enomem.patch,
  glibc-fix-avx512-mempcpy.patch, i386-memmove-sse2-unaligned.patch,
  realpath-ssize-max-overflow.patch, localtime-2039.patch,
  math-remove-slow-path.patch, aarch64-hwcap-atomics.patch,
  glibc-fix-aarch64-build.diff, absolute-symbols.patch,
  x86-haswell-string-flags.patch,
  pthread-cond-broadcast-waiters-after-spinning.patch,
  mman-map-sync.patch, mman-linux-map-shared-validate.patch,
  nptl-setxid-error.patch, pthread-mutex-trylock-barrier.patch,
  getaddrinfo-parse-ipv4-address.patch, japanese-era-name-may-2019.patch,
  force-elision-race.patch, regex-read-overrun.patch,
  regex-parse-reg-exp.patch,
  0001-S390-Add-configure-check-to-detect-z10-as-mininum-ar.patch,
  0002-S390-Use-hwcap-instead-of-dl_hwcap-in-ifunc-resolver.patch,
  0003-S390-Unify-31-64bit-memcpy.patch,
  0004-S390-Refactor-memcpy-mempcpy-ifunc-handling.patch,
  0005-S390-Remove-s390-specific-implementation-of-bcopy.patch,
  0006-S390-Use-memcpy-for-forward-cases-in-memmove.patch,
  0007-S390-Add-configure-check-to-detect-z13-as-mininum-ar.patch,
  0008-S390-Add-z13-memmove-ifunc-variant.patch,
  0009-S390-Add-z13-strstr-ifunc-variant.patch,
  0010-S390-Add-z13-memmem-ifunc-variant.patch,
  0011-S390-Cleanup-ifunc-resolve.h.patch,
  0012-S390-Mark-vx-and-vxe-as-important-hwcap.patch,
  0013-S390-Add-new-hwcap-values-for-new-cpu-architecture-a.patch,
  0014-S390-Add-configure-check-to-detect-support-for-arch1.patch,
  0015-S390-Add-arch13-memmove-ifunc-variant.patch,
  0016-S390-Add-arch13-strstr-ifunc-variant.patch,
  0017-S390-Add-arch13-memmem-ifunc-variant.patch,
  prefer-map-32bit-exec.patch, s390-strstr-page-boundary.patch,
  ppc-tle-htm-nosc.patch,
  posix-Add-internal-symbols-for-posix_spawn-interface.patch,
  glibc-2.29-posix-Use-posix_spawn-on-popen.patch,
  backtrace-powerpc.patch, pthread-rwlock-pwn.patch,
  manual-memory-protection.patch, ldbl-96-rem-pio2l.patch,
  dl-sort-maps.patch, dlopen-filter-object.patch,
  glob-use-after-free.patch, nptl-setxid-race.patch, nscd-senfile.patch,
  ldd-system-interp.patch, abort-no-flush.patch,
  fnmatch-collating-elements.patch, nss-files-long-lines-2.patch,
  iconv-reset-input-buffer.patch, nscd-prune.patch, syslog-locking.patch:
  Removed.
- long-double-alias.patch, glibc-nsswitch-usr.diff, euc-kr-overrun.patch,
  riscv-syscall-clobber.patch, nscd-gc-cycle.patch: Added.</changelog>
  <changelog author="schwab@suse.de" date="1604923200">- power10-support.patch: Add support for POWER10 (jsc#SLE-13520)
- iconv-option-parsing.patch: Rewrite iconv option parsing
  (CVE-2016-10228, bsc#1027496, BZ #19519)</changelog>
  <changelog author="schwab@suse.de" date="1608120000">- aarch64-getauxval.patch: aarch64: Accept PLT calls to __getauxval within
  libc.so (bsc#1167939)
- iconv-redundant-shift.patch: iconv: Accept redundant shift sequences in
  IBM1364 (CVE-2020-27618, bsc#1178386, BZ #26224)
- iconv-ucs4-loop-bounds.patch: iconv: Fix incorrect UCS4 inner loop
  bounds (CVE-2020-29562, bsc#1179694, BZ #26923)
- printf-long-double-non-normal.patch: x86: Harden printf against
  non-normal long double values (CVE-2020-29573, bsc#1179721, BZ #26649)
- get-nprocs-cpu-online-parsing.patch: Fix parsing of
  /sys/devices/system/cpu/online (bsc#1180038, BZ #25859)</changelog>
  <changelog author="schwab@suse.de" date="1609848000">- sysvipc-sem-stat-any.patch: sysvipc: Fix SEM_STAT_ANY kernel argument
  pass (bsc#1180557, BZ #26637)</changelog>
  <changelog author="schwab@suse.de" date="1611835200">- gconv-assertion-iso-2022-jp.patch: gconv: Fix assertion failure in
  ISO-2022-JP-3 module (CVE-2021-3326, bsc#1181505, BZ #27256)</changelog>
  <changelog author="schwab@suse.de" date="1614772800">- nscd-netgroupcache.patch: nscd: Fix double free in netgroupcache
  (CVE-2021-27645, bsc#1182733, BZ #27462)</changelog>
  <changelog author="rguenther@suse.com" date="1615377600">- Add glibc-2.31-HTM-vzeroupper.diff to avoid VZEROUPPER in the
  AVX2 accelerated string routines which cause HTM transaction
  aborts.  Instead use EVEX or SSE.  (bsc#1181403)</changelog>
  <changelog author="rguenther@suse.com" date="1615377601">- Update glibc-2.31-HTM-vzeroupper.diff with a AVX-SSE transition
  fix.</changelog>
  <changelog author="schwab@suse.de" date="1617019200">- s390-memmove-ifunc-selector-arch13.patch: S390: Also check vector
  support in memmove ifunc-selector (bsc#1184035, BZ #27511)</changelog>
  <changelog author="schwab@suse.de" date="1625140800">- wordexp-param-overflow.patch: wordexp: handle overflow in positional
  parameter number (CVE-2021-35942, bsc#1187911, BZ #28011)</changelog>
  <changelog author="schwab@suse.de" date="1630584000">- mq-notify-use-after-free.patch: Use __pthread_attr_copy in mq_notify
  (CVE-2021-33574, bsc#1186489, BZ #27896)</changelog>
  <changelog author="schwab@suse.de" date="1636027200">- 0001-s390x-Align-child-stack-while-clone.-BZ-27968.patch,
  0002-S390-Optimize-__memcpy_z196.patch,
  0003-S390-Optimize-__memset_z196.patch,
  0004-S390-Sync-HWCAP-names-with-kernel-by-adding-aliases-.patch,
  0005-S390-Add-new-hwcap-values.patch,
  0006-S390-Add-PCI_MIO-and-SIE-HWCAPs.patch: [15sp4 FEAT] GNU2007 -
  GLIBC: Support for new IBM Z Hardware (bsc#1191592, jsc#IBM-869)</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1640174400">- Add support for livepatches (jsc#SLE-20049).
- Enable livepatching on x86_64.
- Generate ipa-clones tarball artifact when livepatching is enabled.</changelog>
  <changelog author="schwab@suse.de" date="1642420800">- clnt-create-unix-overflow.patch: Buffer overflow in sunrpc clnt_create
  for "unix" (CVE-2022-23219, bsc#1194768, BZ #22542)
- svcunix-create-overflow.patch: Buffer overflow in sunrpc svcunix_create
  (CVE-2022-23218, bsc#1194770, BZ #28768)</changelog>
  <changelog author="schwab@suse.de" date="1642593600">- 0001-powerpc-Optimized-strcpy-for-POWER9.patch,
  0002-powerpc-Optimized-stpcpy-for-POWER9.patch,
  0003-powerpc-Optimized-rawmemchr-for-POWER9.patch,
  0004-powerpc64le-add-optimized-strlen-for-P9.patch,
  0005-powerpc-fix-ifunc-implementation-list-for-POWER9-str.patch,
  0006-powerpc-Add-optimized-strncpy-for-POWER9.patch,
  0007-powerpc-Add-optimized-stpncpy-for-POWER9.patch,
  0008-powerpc-Add-optimized-ilogb-for-POWER9.patch,
  0009-powerpc-Add-optimized-llogb-for-POWER9.patch,
  0010-powerpc-Add-optimized-strlen-for-POWER10.patch,
  0011-powerpc64le-Optimized-memmove-for-POWER10.patch,
  0012-powerpc64le-Optimize-memcpy-for-POWER10.patch,
  0013-powerpc64le-Optimize-memset-for-POWER10.patch,
  0014-powerpc64le-Fix-ifunc-selection-for-memset-memmove-b.patch,
  0015-powerpc-Add-optimized-rawmemchr-for-POWER10.patch: ppc64le ifunc
  improvements (bsc#1194785, jsc#SLE-18195)</changelog>
  <changelog author="schwab@suse.de" date="1643025600">- getcwd-erange.patch: getcwd: Set errno to ERANGE for size == 1
  (CVE-2021-3999, bsc#1194640, BZ #28769)</changelog>
</package>
<package pkgid="e7c3023bd9c4a80c2b71814cea47af8a2fd61b585d52dade9a93acc259b21906" name="glibc-locale" arch="aarch64">
  <version epoch="0" ver="2.31" rel="150300.9.12.1"/>
  <changelog author="schwab@suse.de" date="1583841600">- dl-sort-maps.patch, dlopen-filter-object.patch: Allow dlopen of filter
  object to work (bsc#1166106, BZ #16272)</changelog>
  <changelog author="schwab@suse.de" date="1585137600">- glob-use-after-free.patch: Fix use-after-free in glob when expanding
  ~user (CVE-2020-1752, bsc#1167631, BZ #25414)</changelog>
  <changelog author="schwab@suse.de" date="1589371200">- nptl-setxid-race.patch: nptl: wait for pending setxid request also in
  detached thread (bsc#1162930, BZ #25942)</changelog>
  <changelog author="schwab@suse.de" date="1593518400">- nscd-senfile.patch: Fix concurrent changes on nscd aware files
  (bsc#1171878, BZ #23178)
- nscd-prune.patch: nscd: bump GC cycle during cache pruning (bsc#1171878,
  BZ #26130)
- syslog-locking.patch: Correct locking and cancellation cleanup in syslog
  functions (bsc#1172085, BZ #26100)</changelog>
  <changelog author="schwab@suse.de" date="1599048000">- Update to glibc 2.31
- glibc-2.14-crypt.diff, crypt_blowfish-const.patch,
  crypt_blowfish-1.2-sha.diff, crypt_blowfish-gensalt.patch,
  crypt_blowfish-1.2-hack_around_arm.diff, glibc-nodate.patch,
  powerpc-elision-enable-envvar.patch, s390-elision-enable-envvar.patch,
  crt-nocompress-debug-sections.patch, resolv-context-leak.patch,
  dl-runtime-resolve-opt-avx512f.patch, libpthread-compat-wrappers.patch,
  math-c++-compat.patch, remove-nss-nis-compat.patch,
  eh-frame-zero-terminator.patch, ld-so-hwcap-x86-64.patch,
  assert-pedantic.patch, getaddrinfo-errno.patch, resolv-conf-oom.patch,
  dynarray-allocation.patch, nearbyint-inexact.patch, nss-compat.patch,
  nscd-libnsl.patch, malloc-tcache-leak.patch,
  falkor-memcpy-memmove.patch, aarch64-cpu-features.patch,
  nss-files-large-buffers.patch, sysconf-uio-maxiov.patch,
  glob-tilde-overflow.patch, dl-runtime-resolve-xsave.patch,
  spawni-assert.patch, x86-64-dl-platform.patch, glob64-s390.patch,
  tst-tlsopt-powerpc.patch, powerpc-hwcap-bits.patch,
  malloc-tcache-check-overflow.patch, dl-init-paths-overflow.patch,
  fillin-rpath-empty-tokens.patch, getcwd-absolute.patch,
  memalign-overflow.patch, stack-guard-size-accounting.patch,
  libgcc-rtld-now.patch, res-send-enomem.patch,
  glibc-fix-avx512-mempcpy.patch, i386-memmove-sse2-unaligned.patch,
  realpath-ssize-max-overflow.patch, localtime-2039.patch,
  math-remove-slow-path.patch, aarch64-hwcap-atomics.patch,
  glibc-fix-aarch64-build.diff, absolute-symbols.patch,
  x86-haswell-string-flags.patch,
  pthread-cond-broadcast-waiters-after-spinning.patch,
  mman-map-sync.patch, mman-linux-map-shared-validate.patch,
  nptl-setxid-error.patch, pthread-mutex-trylock-barrier.patch,
  getaddrinfo-parse-ipv4-address.patch, japanese-era-name-may-2019.patch,
  force-elision-race.patch, regex-read-overrun.patch,
  regex-parse-reg-exp.patch,
  0001-S390-Add-configure-check-to-detect-z10-as-mininum-ar.patch,
  0002-S390-Use-hwcap-instead-of-dl_hwcap-in-ifunc-resolver.patch,
  0003-S390-Unify-31-64bit-memcpy.patch,
  0004-S390-Refactor-memcpy-mempcpy-ifunc-handling.patch,
  0005-S390-Remove-s390-specific-implementation-of-bcopy.patch,
  0006-S390-Use-memcpy-for-forward-cases-in-memmove.patch,
  0007-S390-Add-configure-check-to-detect-z13-as-mininum-ar.patch,
  0008-S390-Add-z13-memmove-ifunc-variant.patch,
  0009-S390-Add-z13-strstr-ifunc-variant.patch,
  0010-S390-Add-z13-memmem-ifunc-variant.patch,
  0011-S390-Cleanup-ifunc-resolve.h.patch,
  0012-S390-Mark-vx-and-vxe-as-important-hwcap.patch,
  0013-S390-Add-new-hwcap-values-for-new-cpu-architecture-a.patch,
  0014-S390-Add-configure-check-to-detect-support-for-arch1.patch,
  0015-S390-Add-arch13-memmove-ifunc-variant.patch,
  0016-S390-Add-arch13-strstr-ifunc-variant.patch,
  0017-S390-Add-arch13-memmem-ifunc-variant.patch,
  prefer-map-32bit-exec.patch, s390-strstr-page-boundary.patch,
  ppc-tle-htm-nosc.patch,
  posix-Add-internal-symbols-for-posix_spawn-interface.patch,
  glibc-2.29-posix-Use-posix_spawn-on-popen.patch,
  backtrace-powerpc.patch, pthread-rwlock-pwn.patch,
  manual-memory-protection.patch, ldbl-96-rem-pio2l.patch,
  dl-sort-maps.patch, dlopen-filter-object.patch,
  glob-use-after-free.patch, nptl-setxid-race.patch, nscd-senfile.patch,
  ldd-system-interp.patch, abort-no-flush.patch,
  fnmatch-collating-elements.patch, nss-files-long-lines-2.patch,
  iconv-reset-input-buffer.patch, nscd-prune.patch, syslog-locking.patch:
  Removed.
- long-double-alias.patch, glibc-nsswitch-usr.diff, euc-kr-overrun.patch,
  riscv-syscall-clobber.patch, nscd-gc-cycle.patch: Added.</changelog>
  <changelog author="schwab@suse.de" date="1604923200">- power10-support.patch: Add support for POWER10 (jsc#SLE-13520)
- iconv-option-parsing.patch: Rewrite iconv option parsing
  (CVE-2016-10228, bsc#1027496, BZ #19519)</changelog>
  <changelog author="schwab@suse.de" date="1608120000">- aarch64-getauxval.patch: aarch64: Accept PLT calls to __getauxval within
  libc.so (bsc#1167939)
- iconv-redundant-shift.patch: iconv: Accept redundant shift sequences in
  IBM1364 (CVE-2020-27618, bsc#1178386, BZ #26224)
- iconv-ucs4-loop-bounds.patch: iconv: Fix incorrect UCS4 inner loop
  bounds (CVE-2020-29562, bsc#1179694, BZ #26923)
- printf-long-double-non-normal.patch: x86: Harden printf against
  non-normal long double values (CVE-2020-29573, bsc#1179721, BZ #26649)
- get-nprocs-cpu-online-parsing.patch: Fix parsing of
  /sys/devices/system/cpu/online (bsc#1180038, BZ #25859)</changelog>
  <changelog author="schwab@suse.de" date="1609848000">- sysvipc-sem-stat-any.patch: sysvipc: Fix SEM_STAT_ANY kernel argument
  pass (bsc#1180557, BZ #26637)</changelog>
  <changelog author="schwab@suse.de" date="1611835200">- gconv-assertion-iso-2022-jp.patch: gconv: Fix assertion failure in
  ISO-2022-JP-3 module (CVE-2021-3326, bsc#1181505, BZ #27256)</changelog>
  <changelog author="schwab@suse.de" date="1614772800">- nscd-netgroupcache.patch: nscd: Fix double free in netgroupcache
  (CVE-2021-27645, bsc#1182733, BZ #27462)</changelog>
  <changelog author="rguenther@suse.com" date="1615377600">- Add glibc-2.31-HTM-vzeroupper.diff to avoid VZEROUPPER in the
  AVX2 accelerated string routines which cause HTM transaction
  aborts.  Instead use EVEX or SSE.  (bsc#1181403)</changelog>
  <changelog author="rguenther@suse.com" date="1615377601">- Update glibc-2.31-HTM-vzeroupper.diff with a AVX-SSE transition
  fix.</changelog>
  <changelog author="schwab@suse.de" date="1617019200">- s390-memmove-ifunc-selector-arch13.patch: S390: Also check vector
  support in memmove ifunc-selector (bsc#1184035, BZ #27511)</changelog>
  <changelog author="schwab@suse.de" date="1625140800">- wordexp-param-overflow.patch: wordexp: handle overflow in positional
  parameter number (CVE-2021-35942, bsc#1187911, BZ #28011)</changelog>
  <changelog author="schwab@suse.de" date="1630584000">- mq-notify-use-after-free.patch: Use __pthread_attr_copy in mq_notify
  (CVE-2021-33574, bsc#1186489, BZ #27896)</changelog>
  <changelog author="schwab@suse.de" date="1636027200">- 0001-s390x-Align-child-stack-while-clone.-BZ-27968.patch,
  0002-S390-Optimize-__memcpy_z196.patch,
  0003-S390-Optimize-__memset_z196.patch,
  0004-S390-Sync-HWCAP-names-with-kernel-by-adding-aliases-.patch,
  0005-S390-Add-new-hwcap-values.patch,
  0006-S390-Add-PCI_MIO-and-SIE-HWCAPs.patch: [15sp4 FEAT] GNU2007 -
  GLIBC: Support for new IBM Z Hardware (bsc#1191592, jsc#IBM-869)</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1640174400">- Add support for livepatches (jsc#SLE-20049).
- Enable livepatching on x86_64.
- Generate ipa-clones tarball artifact when livepatching is enabled.</changelog>
  <changelog author="schwab@suse.de" date="1642420800">- clnt-create-unix-overflow.patch: Buffer overflow in sunrpc clnt_create
  for "unix" (CVE-2022-23219, bsc#1194768, BZ #22542)
- svcunix-create-overflow.patch: Buffer overflow in sunrpc svcunix_create
  (CVE-2022-23218, bsc#1194770, BZ #28768)</changelog>
  <changelog author="schwab@suse.de" date="1642593600">- 0001-powerpc-Optimized-strcpy-for-POWER9.patch,
  0002-powerpc-Optimized-stpcpy-for-POWER9.patch,
  0003-powerpc-Optimized-rawmemchr-for-POWER9.patch,
  0004-powerpc64le-add-optimized-strlen-for-P9.patch,
  0005-powerpc-fix-ifunc-implementation-list-for-POWER9-str.patch,
  0006-powerpc-Add-optimized-strncpy-for-POWER9.patch,
  0007-powerpc-Add-optimized-stpncpy-for-POWER9.patch,
  0008-powerpc-Add-optimized-ilogb-for-POWER9.patch,
  0009-powerpc-Add-optimized-llogb-for-POWER9.patch,
  0010-powerpc-Add-optimized-strlen-for-POWER10.patch,
  0011-powerpc64le-Optimized-memmove-for-POWER10.patch,
  0012-powerpc64le-Optimize-memcpy-for-POWER10.patch,
  0013-powerpc64le-Optimize-memset-for-POWER10.patch,
  0014-powerpc64le-Fix-ifunc-selection-for-memset-memmove-b.patch,
  0015-powerpc-Add-optimized-rawmemchr-for-POWER10.patch: ppc64le ifunc
  improvements (bsc#1194785, jsc#SLE-18195)</changelog>
  <changelog author="schwab@suse.de" date="1643025600">- getcwd-erange.patch: getcwd: Set errno to ERANGE for size == 1
  (CVE-2021-3999, bsc#1194640, BZ #28769)</changelog>
</package>
<package pkgid="1eee342e91c19c7527d8147640e203ac5744b3ab0a6e489bde48f53c3225bb2a" name="glibc-locale" arch="ppc64le">
  <version epoch="0" ver="2.31" rel="150300.9.12.1"/>
  <changelog author="schwab@suse.de" date="1583841600">- dl-sort-maps.patch, dlopen-filter-object.patch: Allow dlopen of filter
  object to work (bsc#1166106, BZ #16272)</changelog>
  <changelog author="schwab@suse.de" date="1585137600">- glob-use-after-free.patch: Fix use-after-free in glob when expanding
  ~user (CVE-2020-1752, bsc#1167631, BZ #25414)</changelog>
  <changelog author="schwab@suse.de" date="1589371200">- nptl-setxid-race.patch: nptl: wait for pending setxid request also in
  detached thread (bsc#1162930, BZ #25942)</changelog>
  <changelog author="schwab@suse.de" date="1593518400">- nscd-senfile.patch: Fix concurrent changes on nscd aware files
  (bsc#1171878, BZ #23178)
- nscd-prune.patch: nscd: bump GC cycle during cache pruning (bsc#1171878,
  BZ #26130)
- syslog-locking.patch: Correct locking and cancellation cleanup in syslog
  functions (bsc#1172085, BZ #26100)</changelog>
  <changelog author="schwab@suse.de" date="1599048000">- Update to glibc 2.31
- glibc-2.14-crypt.diff, crypt_blowfish-const.patch,
  crypt_blowfish-1.2-sha.diff, crypt_blowfish-gensalt.patch,
  crypt_blowfish-1.2-hack_around_arm.diff, glibc-nodate.patch,
  powerpc-elision-enable-envvar.patch, s390-elision-enable-envvar.patch,
  crt-nocompress-debug-sections.patch, resolv-context-leak.patch,
  dl-runtime-resolve-opt-avx512f.patch, libpthread-compat-wrappers.patch,
  math-c++-compat.patch, remove-nss-nis-compat.patch,
  eh-frame-zero-terminator.patch, ld-so-hwcap-x86-64.patch,
  assert-pedantic.patch, getaddrinfo-errno.patch, resolv-conf-oom.patch,
  dynarray-allocation.patch, nearbyint-inexact.patch, nss-compat.patch,
  nscd-libnsl.patch, malloc-tcache-leak.patch,
  falkor-memcpy-memmove.patch, aarch64-cpu-features.patch,
  nss-files-large-buffers.patch, sysconf-uio-maxiov.patch,
  glob-tilde-overflow.patch, dl-runtime-resolve-xsave.patch,
  spawni-assert.patch, x86-64-dl-platform.patch, glob64-s390.patch,
  tst-tlsopt-powerpc.patch, powerpc-hwcap-bits.patch,
  malloc-tcache-check-overflow.patch, dl-init-paths-overflow.patch,
  fillin-rpath-empty-tokens.patch, getcwd-absolute.patch,
  memalign-overflow.patch, stack-guard-size-accounting.patch,
  libgcc-rtld-now.patch, res-send-enomem.patch,
  glibc-fix-avx512-mempcpy.patch, i386-memmove-sse2-unaligned.patch,
  realpath-ssize-max-overflow.patch, localtime-2039.patch,
  math-remove-slow-path.patch, aarch64-hwcap-atomics.patch,
  glibc-fix-aarch64-build.diff, absolute-symbols.patch,
  x86-haswell-string-flags.patch,
  pthread-cond-broadcast-waiters-after-spinning.patch,
  mman-map-sync.patch, mman-linux-map-shared-validate.patch,
  nptl-setxid-error.patch, pthread-mutex-trylock-barrier.patch,
  getaddrinfo-parse-ipv4-address.patch, japanese-era-name-may-2019.patch,
  force-elision-race.patch, regex-read-overrun.patch,
  regex-parse-reg-exp.patch,
  0001-S390-Add-configure-check-to-detect-z10-as-mininum-ar.patch,
  0002-S390-Use-hwcap-instead-of-dl_hwcap-in-ifunc-resolver.patch,
  0003-S390-Unify-31-64bit-memcpy.patch,
  0004-S390-Refactor-memcpy-mempcpy-ifunc-handling.patch,
  0005-S390-Remove-s390-specific-implementation-of-bcopy.patch,
  0006-S390-Use-memcpy-for-forward-cases-in-memmove.patch,
  0007-S390-Add-configure-check-to-detect-z13-as-mininum-ar.patch,
  0008-S390-Add-z13-memmove-ifunc-variant.patch,
  0009-S390-Add-z13-strstr-ifunc-variant.patch,
  0010-S390-Add-z13-memmem-ifunc-variant.patch,
  0011-S390-Cleanup-ifunc-resolve.h.patch,
  0012-S390-Mark-vx-and-vxe-as-important-hwcap.patch,
  0013-S390-Add-new-hwcap-values-for-new-cpu-architecture-a.patch,
  0014-S390-Add-configure-check-to-detect-support-for-arch1.patch,
  0015-S390-Add-arch13-memmove-ifunc-variant.patch,
  0016-S390-Add-arch13-strstr-ifunc-variant.patch,
  0017-S390-Add-arch13-memmem-ifunc-variant.patch,
  prefer-map-32bit-exec.patch, s390-strstr-page-boundary.patch,
  ppc-tle-htm-nosc.patch,
  posix-Add-internal-symbols-for-posix_spawn-interface.patch,
  glibc-2.29-posix-Use-posix_spawn-on-popen.patch,
  backtrace-powerpc.patch, pthread-rwlock-pwn.patch,
  manual-memory-protection.patch, ldbl-96-rem-pio2l.patch,
  dl-sort-maps.patch, dlopen-filter-object.patch,
  glob-use-after-free.patch, nptl-setxid-race.patch, nscd-senfile.patch,
  ldd-system-interp.patch, abort-no-flush.patch,
  fnmatch-collating-elements.patch, nss-files-long-lines-2.patch,
  iconv-reset-input-buffer.patch, nscd-prune.patch, syslog-locking.patch:
  Removed.
- long-double-alias.patch, glibc-nsswitch-usr.diff, euc-kr-overrun.patch,
  riscv-syscall-clobber.patch, nscd-gc-cycle.patch: Added.</changelog>
  <changelog author="schwab@suse.de" date="1604923200">- power10-support.patch: Add support for POWER10 (jsc#SLE-13520)
- iconv-option-parsing.patch: Rewrite iconv option parsing
  (CVE-2016-10228, bsc#1027496, BZ #19519)</changelog>
  <changelog author="schwab@suse.de" date="1608120000">- aarch64-getauxval.patch: aarch64: Accept PLT calls to __getauxval within
  libc.so (bsc#1167939)
- iconv-redundant-shift.patch: iconv: Accept redundant shift sequences in
  IBM1364 (CVE-2020-27618, bsc#1178386, BZ #26224)
- iconv-ucs4-loop-bounds.patch: iconv: Fix incorrect UCS4 inner loop
  bounds (CVE-2020-29562, bsc#1179694, BZ #26923)
- printf-long-double-non-normal.patch: x86: Harden printf against
  non-normal long double values (CVE-2020-29573, bsc#1179721, BZ #26649)
- get-nprocs-cpu-online-parsing.patch: Fix parsing of
  /sys/devices/system/cpu/online (bsc#1180038, BZ #25859)</changelog>
  <changelog author="schwab@suse.de" date="1609848000">- sysvipc-sem-stat-any.patch: sysvipc: Fix SEM_STAT_ANY kernel argument
  pass (bsc#1180557, BZ #26637)</changelog>
  <changelog author="schwab@suse.de" date="1611835200">- gconv-assertion-iso-2022-jp.patch: gconv: Fix assertion failure in
  ISO-2022-JP-3 module (CVE-2021-3326, bsc#1181505, BZ #27256)</changelog>
  <changelog author="schwab@suse.de" date="1614772800">- nscd-netgroupcache.patch: nscd: Fix double free in netgroupcache
  (CVE-2021-27645, bsc#1182733, BZ #27462)</changelog>
  <changelog author="rguenther@suse.com" date="1615377600">- Add glibc-2.31-HTM-vzeroupper.diff to avoid VZEROUPPER in the
  AVX2 accelerated string routines which cause HTM transaction
  aborts.  Instead use EVEX or SSE.  (bsc#1181403)</changelog>
  <changelog author="rguenther@suse.com" date="1615377601">- Update glibc-2.31-HTM-vzeroupper.diff with a AVX-SSE transition
  fix.</changelog>
  <changelog author="schwab@suse.de" date="1617019200">- s390-memmove-ifunc-selector-arch13.patch: S390: Also check vector
  support in memmove ifunc-selector (bsc#1184035, BZ #27511)</changelog>
  <changelog author="schwab@suse.de" date="1625140800">- wordexp-param-overflow.patch: wordexp: handle overflow in positional
  parameter number (CVE-2021-35942, bsc#1187911, BZ #28011)</changelog>
  <changelog author="schwab@suse.de" date="1630584000">- mq-notify-use-after-free.patch: Use __pthread_attr_copy in mq_notify
  (CVE-2021-33574, bsc#1186489, BZ #27896)</changelog>
  <changelog author="schwab@suse.de" date="1636027200">- 0001-s390x-Align-child-stack-while-clone.-BZ-27968.patch,
  0002-S390-Optimize-__memcpy_z196.patch,
  0003-S390-Optimize-__memset_z196.patch,
  0004-S390-Sync-HWCAP-names-with-kernel-by-adding-aliases-.patch,
  0005-S390-Add-new-hwcap-values.patch,
  0006-S390-Add-PCI_MIO-and-SIE-HWCAPs.patch: [15sp4 FEAT] GNU2007 -
  GLIBC: Support for new IBM Z Hardware (bsc#1191592, jsc#IBM-869)</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1640174400">- Add support for livepatches (jsc#SLE-20049).
- Enable livepatching on x86_64.
- Generate ipa-clones tarball artifact when livepatching is enabled.</changelog>
  <changelog author="schwab@suse.de" date="1642420800">- clnt-create-unix-overflow.patch: Buffer overflow in sunrpc clnt_create
  for "unix" (CVE-2022-23219, bsc#1194768, BZ #22542)
- svcunix-create-overflow.patch: Buffer overflow in sunrpc svcunix_create
  (CVE-2022-23218, bsc#1194770, BZ #28768)</changelog>
  <changelog author="schwab@suse.de" date="1642593600">- 0001-powerpc-Optimized-strcpy-for-POWER9.patch,
  0002-powerpc-Optimized-stpcpy-for-POWER9.patch,
  0003-powerpc-Optimized-rawmemchr-for-POWER9.patch,
  0004-powerpc64le-add-optimized-strlen-for-P9.patch,
  0005-powerpc-fix-ifunc-implementation-list-for-POWER9-str.patch,
  0006-powerpc-Add-optimized-strncpy-for-POWER9.patch,
  0007-powerpc-Add-optimized-stpncpy-for-POWER9.patch,
  0008-powerpc-Add-optimized-ilogb-for-POWER9.patch,
  0009-powerpc-Add-optimized-llogb-for-POWER9.patch,
  0010-powerpc-Add-optimized-strlen-for-POWER10.patch,
  0011-powerpc64le-Optimized-memmove-for-POWER10.patch,
  0012-powerpc64le-Optimize-memcpy-for-POWER10.patch,
  0013-powerpc64le-Optimize-memset-for-POWER10.patch,
  0014-powerpc64le-Fix-ifunc-selection-for-memset-memmove-b.patch,
  0015-powerpc-Add-optimized-rawmemchr-for-POWER10.patch: ppc64le ifunc
  improvements (bsc#1194785, jsc#SLE-18195)</changelog>
  <changelog author="schwab@suse.de" date="1643025600">- getcwd-erange.patch: getcwd: Set errno to ERANGE for size == 1
  (CVE-2021-3999, bsc#1194640, BZ #28769)</changelog>
</package>
<package pkgid="4086f6806962bd5d7c0c1a65a11f3efe90db2f4a7d6ce1bbeb8e889b802aa91b" name="glibc-locale" arch="s390x">
  <version epoch="0" ver="2.31" rel="150300.9.12.1"/>
  <changelog author="schwab@suse.de" date="1583841600">- dl-sort-maps.patch, dlopen-filter-object.patch: Allow dlopen of filter
  object to work (bsc#1166106, BZ #16272)</changelog>
  <changelog author="schwab@suse.de" date="1585137600">- glob-use-after-free.patch: Fix use-after-free in glob when expanding
  ~user (CVE-2020-1752, bsc#1167631, BZ #25414)</changelog>
  <changelog author="schwab@suse.de" date="1589371200">- nptl-setxid-race.patch: nptl: wait for pending setxid request also in
  detached thread (bsc#1162930, BZ #25942)</changelog>
  <changelog author="schwab@suse.de" date="1593518400">- nscd-senfile.patch: Fix concurrent changes on nscd aware files
  (bsc#1171878, BZ #23178)
- nscd-prune.patch: nscd: bump GC cycle during cache pruning (bsc#1171878,
  BZ #26130)
- syslog-locking.patch: Correct locking and cancellation cleanup in syslog
  functions (bsc#1172085, BZ #26100)</changelog>
  <changelog author="schwab@suse.de" date="1599048000">- Update to glibc 2.31
- glibc-2.14-crypt.diff, crypt_blowfish-const.patch,
  crypt_blowfish-1.2-sha.diff, crypt_blowfish-gensalt.patch,
  crypt_blowfish-1.2-hack_around_arm.diff, glibc-nodate.patch,
  powerpc-elision-enable-envvar.patch, s390-elision-enable-envvar.patch,
  crt-nocompress-debug-sections.patch, resolv-context-leak.patch,
  dl-runtime-resolve-opt-avx512f.patch, libpthread-compat-wrappers.patch,
  math-c++-compat.patch, remove-nss-nis-compat.patch,
  eh-frame-zero-terminator.patch, ld-so-hwcap-x86-64.patch,
  assert-pedantic.patch, getaddrinfo-errno.patch, resolv-conf-oom.patch,
  dynarray-allocation.patch, nearbyint-inexact.patch, nss-compat.patch,
  nscd-libnsl.patch, malloc-tcache-leak.patch,
  falkor-memcpy-memmove.patch, aarch64-cpu-features.patch,
  nss-files-large-buffers.patch, sysconf-uio-maxiov.patch,
  glob-tilde-overflow.patch, dl-runtime-resolve-xsave.patch,
  spawni-assert.patch, x86-64-dl-platform.patch, glob64-s390.patch,
  tst-tlsopt-powerpc.patch, powerpc-hwcap-bits.patch,
  malloc-tcache-check-overflow.patch, dl-init-paths-overflow.patch,
  fillin-rpath-empty-tokens.patch, getcwd-absolute.patch,
  memalign-overflow.patch, stack-guard-size-accounting.patch,
  libgcc-rtld-now.patch, res-send-enomem.patch,
  glibc-fix-avx512-mempcpy.patch, i386-memmove-sse2-unaligned.patch,
  realpath-ssize-max-overflow.patch, localtime-2039.patch,
  math-remove-slow-path.patch, aarch64-hwcap-atomics.patch,
  glibc-fix-aarch64-build.diff, absolute-symbols.patch,
  x86-haswell-string-flags.patch,
  pthread-cond-broadcast-waiters-after-spinning.patch,
  mman-map-sync.patch, mman-linux-map-shared-validate.patch,
  nptl-setxid-error.patch, pthread-mutex-trylock-barrier.patch,
  getaddrinfo-parse-ipv4-address.patch, japanese-era-name-may-2019.patch,
  force-elision-race.patch, regex-read-overrun.patch,
  regex-parse-reg-exp.patch,
  0001-S390-Add-configure-check-to-detect-z10-as-mininum-ar.patch,
  0002-S390-Use-hwcap-instead-of-dl_hwcap-in-ifunc-resolver.patch,
  0003-S390-Unify-31-64bit-memcpy.patch,
  0004-S390-Refactor-memcpy-mempcpy-ifunc-handling.patch,
  0005-S390-Remove-s390-specific-implementation-of-bcopy.patch,
  0006-S390-Use-memcpy-for-forward-cases-in-memmove.patch,
  0007-S390-Add-configure-check-to-detect-z13-as-mininum-ar.patch,
  0008-S390-Add-z13-memmove-ifunc-variant.patch,
  0009-S390-Add-z13-strstr-ifunc-variant.patch,
  0010-S390-Add-z13-memmem-ifunc-variant.patch,
  0011-S390-Cleanup-ifunc-resolve.h.patch,
  0012-S390-Mark-vx-and-vxe-as-important-hwcap.patch,
  0013-S390-Add-new-hwcap-values-for-new-cpu-architecture-a.patch,
  0014-S390-Add-configure-check-to-detect-support-for-arch1.patch,
  0015-S390-Add-arch13-memmove-ifunc-variant.patch,
  0016-S390-Add-arch13-strstr-ifunc-variant.patch,
  0017-S390-Add-arch13-memmem-ifunc-variant.patch,
  prefer-map-32bit-exec.patch, s390-strstr-page-boundary.patch,
  ppc-tle-htm-nosc.patch,
  posix-Add-internal-symbols-for-posix_spawn-interface.patch,
  glibc-2.29-posix-Use-posix_spawn-on-popen.patch,
  backtrace-powerpc.patch, pthread-rwlock-pwn.patch,
  manual-memory-protection.patch, ldbl-96-rem-pio2l.patch,
  dl-sort-maps.patch, dlopen-filter-object.patch,
  glob-use-after-free.patch, nptl-setxid-race.patch, nscd-senfile.patch,
  ldd-system-interp.patch, abort-no-flush.patch,
  fnmatch-collating-elements.patch, nss-files-long-lines-2.patch,
  iconv-reset-input-buffer.patch, nscd-prune.patch, syslog-locking.patch:
  Removed.
- long-double-alias.patch, glibc-nsswitch-usr.diff, euc-kr-overrun.patch,
  riscv-syscall-clobber.patch, nscd-gc-cycle.patch: Added.</changelog>
  <changelog author="schwab@suse.de" date="1604923200">- power10-support.patch: Add support for POWER10 (jsc#SLE-13520)
- iconv-option-parsing.patch: Rewrite iconv option parsing
  (CVE-2016-10228, bsc#1027496, BZ #19519)</changelog>
  <changelog author="schwab@suse.de" date="1608120000">- aarch64-getauxval.patch: aarch64: Accept PLT calls to __getauxval within
  libc.so (bsc#1167939)
- iconv-redundant-shift.patch: iconv: Accept redundant shift sequences in
  IBM1364 (CVE-2020-27618, bsc#1178386, BZ #26224)
- iconv-ucs4-loop-bounds.patch: iconv: Fix incorrect UCS4 inner loop
  bounds (CVE-2020-29562, bsc#1179694, BZ #26923)
- printf-long-double-non-normal.patch: x86: Harden printf against
  non-normal long double values (CVE-2020-29573, bsc#1179721, BZ #26649)
- get-nprocs-cpu-online-parsing.patch: Fix parsing of
  /sys/devices/system/cpu/online (bsc#1180038, BZ #25859)</changelog>
  <changelog author="schwab@suse.de" date="1609848000">- sysvipc-sem-stat-any.patch: sysvipc: Fix SEM_STAT_ANY kernel argument
  pass (bsc#1180557, BZ #26637)</changelog>
  <changelog author="schwab@suse.de" date="1611835200">- gconv-assertion-iso-2022-jp.patch: gconv: Fix assertion failure in
  ISO-2022-JP-3 module (CVE-2021-3326, bsc#1181505, BZ #27256)</changelog>
  <changelog author="schwab@suse.de" date="1614772800">- nscd-netgroupcache.patch: nscd: Fix double free in netgroupcache
  (CVE-2021-27645, bsc#1182733, BZ #27462)</changelog>
  <changelog author="rguenther@suse.com" date="1615377600">- Add glibc-2.31-HTM-vzeroupper.diff to avoid VZEROUPPER in the
  AVX2 accelerated string routines which cause HTM transaction
  aborts.  Instead use EVEX or SSE.  (bsc#1181403)</changelog>
  <changelog author="rguenther@suse.com" date="1615377601">- Update glibc-2.31-HTM-vzeroupper.diff with a AVX-SSE transition
  fix.</changelog>
  <changelog author="schwab@suse.de" date="1617019200">- s390-memmove-ifunc-selector-arch13.patch: S390: Also check vector
  support in memmove ifunc-selector (bsc#1184035, BZ #27511)</changelog>
  <changelog author="schwab@suse.de" date="1625140800">- wordexp-param-overflow.patch: wordexp: handle overflow in positional
  parameter number (CVE-2021-35942, bsc#1187911, BZ #28011)</changelog>
  <changelog author="schwab@suse.de" date="1630584000">- mq-notify-use-after-free.patch: Use __pthread_attr_copy in mq_notify
  (CVE-2021-33574, bsc#1186489, BZ #27896)</changelog>
  <changelog author="schwab@suse.de" date="1636027200">- 0001-s390x-Align-child-stack-while-clone.-BZ-27968.patch,
  0002-S390-Optimize-__memcpy_z196.patch,
  0003-S390-Optimize-__memset_z196.patch,
  0004-S390-Sync-HWCAP-names-with-kernel-by-adding-aliases-.patch,
  0005-S390-Add-new-hwcap-values.patch,
  0006-S390-Add-PCI_MIO-and-SIE-HWCAPs.patch: [15sp4 FEAT] GNU2007 -
  GLIBC: Support for new IBM Z Hardware (bsc#1191592, jsc#IBM-869)</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1640174400">- Add support for livepatches (jsc#SLE-20049).
- Enable livepatching on x86_64.
- Generate ipa-clones tarball artifact when livepatching is enabled.</changelog>
  <changelog author="schwab@suse.de" date="1642420800">- clnt-create-unix-overflow.patch: Buffer overflow in sunrpc clnt_create
  for "unix" (CVE-2022-23219, bsc#1194768, BZ #22542)
- svcunix-create-overflow.patch: Buffer overflow in sunrpc svcunix_create
  (CVE-2022-23218, bsc#1194770, BZ #28768)</changelog>
  <changelog author="schwab@suse.de" date="1642593600">- 0001-powerpc-Optimized-strcpy-for-POWER9.patch,
  0002-powerpc-Optimized-stpcpy-for-POWER9.patch,
  0003-powerpc-Optimized-rawmemchr-for-POWER9.patch,
  0004-powerpc64le-add-optimized-strlen-for-P9.patch,
  0005-powerpc-fix-ifunc-implementation-list-for-POWER9-str.patch,
  0006-powerpc-Add-optimized-strncpy-for-POWER9.patch,
  0007-powerpc-Add-optimized-stpncpy-for-POWER9.patch,
  0008-powerpc-Add-optimized-ilogb-for-POWER9.patch,
  0009-powerpc-Add-optimized-llogb-for-POWER9.patch,
  0010-powerpc-Add-optimized-strlen-for-POWER10.patch,
  0011-powerpc64le-Optimized-memmove-for-POWER10.patch,
  0012-powerpc64le-Optimize-memcpy-for-POWER10.patch,
  0013-powerpc64le-Optimize-memset-for-POWER10.patch,
  0014-powerpc64le-Fix-ifunc-selection-for-memset-memmove-b.patch,
  0015-powerpc-Add-optimized-rawmemchr-for-POWER10.patch: ppc64le ifunc
  improvements (bsc#1194785, jsc#SLE-18195)</changelog>
  <changelog author="schwab@suse.de" date="1643025600">- getcwd-erange.patch: getcwd: Set errno to ERANGE for size == 1
  (CVE-2021-3999, bsc#1194640, BZ #28769)</changelog>
</package>
<package pkgid="5685744d5fc67e1e4c41d03146b192e782f4b433f200b62361638a4fb8347155" name="glibc-locale" arch="x86_64">
  <version epoch="0" ver="2.31" rel="150300.9.12.1"/>
  <changelog author="schwab@suse.de" date="1583841600">- dl-sort-maps.patch, dlopen-filter-object.patch: Allow dlopen of filter
  object to work (bsc#1166106, BZ #16272)</changelog>
  <changelog author="schwab@suse.de" date="1585137600">- glob-use-after-free.patch: Fix use-after-free in glob when expanding
  ~user (CVE-2020-1752, bsc#1167631, BZ #25414)</changelog>
  <changelog author="schwab@suse.de" date="1589371200">- nptl-setxid-race.patch: nptl: wait for pending setxid request also in
  detached thread (bsc#1162930, BZ #25942)</changelog>
  <changelog author="schwab@suse.de" date="1593518400">- nscd-senfile.patch: Fix concurrent changes on nscd aware files
  (bsc#1171878, BZ #23178)
- nscd-prune.patch: nscd: bump GC cycle during cache pruning (bsc#1171878,
  BZ #26130)
- syslog-locking.patch: Correct locking and cancellation cleanup in syslog
  functions (bsc#1172085, BZ #26100)</changelog>
  <changelog author="schwab@suse.de" date="1599048000">- Update to glibc 2.31
- glibc-2.14-crypt.diff, crypt_blowfish-const.patch,
  crypt_blowfish-1.2-sha.diff, crypt_blowfish-gensalt.patch,
  crypt_blowfish-1.2-hack_around_arm.diff, glibc-nodate.patch,
  powerpc-elision-enable-envvar.patch, s390-elision-enable-envvar.patch,
  crt-nocompress-debug-sections.patch, resolv-context-leak.patch,
  dl-runtime-resolve-opt-avx512f.patch, libpthread-compat-wrappers.patch,
  math-c++-compat.patch, remove-nss-nis-compat.patch,
  eh-frame-zero-terminator.patch, ld-so-hwcap-x86-64.patch,
  assert-pedantic.patch, getaddrinfo-errno.patch, resolv-conf-oom.patch,
  dynarray-allocation.patch, nearbyint-inexact.patch, nss-compat.patch,
  nscd-libnsl.patch, malloc-tcache-leak.patch,
  falkor-memcpy-memmove.patch, aarch64-cpu-features.patch,
  nss-files-large-buffers.patch, sysconf-uio-maxiov.patch,
  glob-tilde-overflow.patch, dl-runtime-resolve-xsave.patch,
  spawni-assert.patch, x86-64-dl-platform.patch, glob64-s390.patch,
  tst-tlsopt-powerpc.patch, powerpc-hwcap-bits.patch,
  malloc-tcache-check-overflow.patch, dl-init-paths-overflow.patch,
  fillin-rpath-empty-tokens.patch, getcwd-absolute.patch,
  memalign-overflow.patch, stack-guard-size-accounting.patch,
  libgcc-rtld-now.patch, res-send-enomem.patch,
  glibc-fix-avx512-mempcpy.patch, i386-memmove-sse2-unaligned.patch,
  realpath-ssize-max-overflow.patch, localtime-2039.patch,
  math-remove-slow-path.patch, aarch64-hwcap-atomics.patch,
  glibc-fix-aarch64-build.diff, absolute-symbols.patch,
  x86-haswell-string-flags.patch,
  pthread-cond-broadcast-waiters-after-spinning.patch,
  mman-map-sync.patch, mman-linux-map-shared-validate.patch,
  nptl-setxid-error.patch, pthread-mutex-trylock-barrier.patch,
  getaddrinfo-parse-ipv4-address.patch, japanese-era-name-may-2019.patch,
  force-elision-race.patch, regex-read-overrun.patch,
  regex-parse-reg-exp.patch,
  0001-S390-Add-configure-check-to-detect-z10-as-mininum-ar.patch,
  0002-S390-Use-hwcap-instead-of-dl_hwcap-in-ifunc-resolver.patch,
  0003-S390-Unify-31-64bit-memcpy.patch,
  0004-S390-Refactor-memcpy-mempcpy-ifunc-handling.patch,
  0005-S390-Remove-s390-specific-implementation-of-bcopy.patch,
  0006-S390-Use-memcpy-for-forward-cases-in-memmove.patch,
  0007-S390-Add-configure-check-to-detect-z13-as-mininum-ar.patch,
  0008-S390-Add-z13-memmove-ifunc-variant.patch,
  0009-S390-Add-z13-strstr-ifunc-variant.patch,
  0010-S390-Add-z13-memmem-ifunc-variant.patch,
  0011-S390-Cleanup-ifunc-resolve.h.patch,
  0012-S390-Mark-vx-and-vxe-as-important-hwcap.patch,
  0013-S390-Add-new-hwcap-values-for-new-cpu-architecture-a.patch,
  0014-S390-Add-configure-check-to-detect-support-for-arch1.patch,
  0015-S390-Add-arch13-memmove-ifunc-variant.patch,
  0016-S390-Add-arch13-strstr-ifunc-variant.patch,
  0017-S390-Add-arch13-memmem-ifunc-variant.patch,
  prefer-map-32bit-exec.patch, s390-strstr-page-boundary.patch,
  ppc-tle-htm-nosc.patch,
  posix-Add-internal-symbols-for-posix_spawn-interface.patch,
  glibc-2.29-posix-Use-posix_spawn-on-popen.patch,
  backtrace-powerpc.patch, pthread-rwlock-pwn.patch,
  manual-memory-protection.patch, ldbl-96-rem-pio2l.patch,
  dl-sort-maps.patch, dlopen-filter-object.patch,
  glob-use-after-free.patch, nptl-setxid-race.patch, nscd-senfile.patch,
  ldd-system-interp.patch, abort-no-flush.patch,
  fnmatch-collating-elements.patch, nss-files-long-lines-2.patch,
  iconv-reset-input-buffer.patch, nscd-prune.patch, syslog-locking.patch:
  Removed.
- long-double-alias.patch, glibc-nsswitch-usr.diff, euc-kr-overrun.patch,
  riscv-syscall-clobber.patch, nscd-gc-cycle.patch: Added.</changelog>
  <changelog author="schwab@suse.de" date="1604923200">- power10-support.patch: Add support for POWER10 (jsc#SLE-13520)
- iconv-option-parsing.patch: Rewrite iconv option parsing
  (CVE-2016-10228, bsc#1027496, BZ #19519)</changelog>
  <changelog author="schwab@suse.de" date="1608120000">- aarch64-getauxval.patch: aarch64: Accept PLT calls to __getauxval within
  libc.so (bsc#1167939)
- iconv-redundant-shift.patch: iconv: Accept redundant shift sequences in
  IBM1364 (CVE-2020-27618, bsc#1178386, BZ #26224)
- iconv-ucs4-loop-bounds.patch: iconv: Fix incorrect UCS4 inner loop
  bounds (CVE-2020-29562, bsc#1179694, BZ #26923)
- printf-long-double-non-normal.patch: x86: Harden printf against
  non-normal long double values (CVE-2020-29573, bsc#1179721, BZ #26649)
- get-nprocs-cpu-online-parsing.patch: Fix parsing of
  /sys/devices/system/cpu/online (bsc#1180038, BZ #25859)</changelog>
  <changelog author="schwab@suse.de" date="1609848000">- sysvipc-sem-stat-any.patch: sysvipc: Fix SEM_STAT_ANY kernel argument
  pass (bsc#1180557, BZ #26637)</changelog>
  <changelog author="schwab@suse.de" date="1611835200">- gconv-assertion-iso-2022-jp.patch: gconv: Fix assertion failure in
  ISO-2022-JP-3 module (CVE-2021-3326, bsc#1181505, BZ #27256)</changelog>
  <changelog author="schwab@suse.de" date="1614772800">- nscd-netgroupcache.patch: nscd: Fix double free in netgroupcache
  (CVE-2021-27645, bsc#1182733, BZ #27462)</changelog>
  <changelog author="rguenther@suse.com" date="1615377600">- Add glibc-2.31-HTM-vzeroupper.diff to avoid VZEROUPPER in the
  AVX2 accelerated string routines which cause HTM transaction
  aborts.  Instead use EVEX or SSE.  (bsc#1181403)</changelog>
  <changelog author="rguenther@suse.com" date="1615377601">- Update glibc-2.31-HTM-vzeroupper.diff with a AVX-SSE transition
  fix.</changelog>
  <changelog author="schwab@suse.de" date="1617019200">- s390-memmove-ifunc-selector-arch13.patch: S390: Also check vector
  support in memmove ifunc-selector (bsc#1184035, BZ #27511)</changelog>
  <changelog author="schwab@suse.de" date="1625140800">- wordexp-param-overflow.patch: wordexp: handle overflow in positional
  parameter number (CVE-2021-35942, bsc#1187911, BZ #28011)</changelog>
  <changelog author="schwab@suse.de" date="1630584000">- mq-notify-use-after-free.patch: Use __pthread_attr_copy in mq_notify
  (CVE-2021-33574, bsc#1186489, BZ #27896)</changelog>
  <changelog author="schwab@suse.de" date="1636027200">- 0001-s390x-Align-child-stack-while-clone.-BZ-27968.patch,
  0002-S390-Optimize-__memcpy_z196.patch,
  0003-S390-Optimize-__memset_z196.patch,
  0004-S390-Sync-HWCAP-names-with-kernel-by-adding-aliases-.patch,
  0005-S390-Add-new-hwcap-values.patch,
  0006-S390-Add-PCI_MIO-and-SIE-HWCAPs.patch: [15sp4 FEAT] GNU2007 -
  GLIBC: Support for new IBM Z Hardware (bsc#1191592, jsc#IBM-869)</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1640174400">- Add support for livepatches (jsc#SLE-20049).
- Enable livepatching on x86_64.
- Generate ipa-clones tarball artifact when livepatching is enabled.</changelog>
  <changelog author="schwab@suse.de" date="1642420800">- clnt-create-unix-overflow.patch: Buffer overflow in sunrpc clnt_create
  for "unix" (CVE-2022-23219, bsc#1194768, BZ #22542)
- svcunix-create-overflow.patch: Buffer overflow in sunrpc svcunix_create
  (CVE-2022-23218, bsc#1194770, BZ #28768)</changelog>
  <changelog author="schwab@suse.de" date="1642593600">- 0001-powerpc-Optimized-strcpy-for-POWER9.patch,
  0002-powerpc-Optimized-stpcpy-for-POWER9.patch,
  0003-powerpc-Optimized-rawmemchr-for-POWER9.patch,
  0004-powerpc64le-add-optimized-strlen-for-P9.patch,
  0005-powerpc-fix-ifunc-implementation-list-for-POWER9-str.patch,
  0006-powerpc-Add-optimized-strncpy-for-POWER9.patch,
  0007-powerpc-Add-optimized-stpncpy-for-POWER9.patch,
  0008-powerpc-Add-optimized-ilogb-for-POWER9.patch,
  0009-powerpc-Add-optimized-llogb-for-POWER9.patch,
  0010-powerpc-Add-optimized-strlen-for-POWER10.patch,
  0011-powerpc64le-Optimized-memmove-for-POWER10.patch,
  0012-powerpc64le-Optimize-memcpy-for-POWER10.patch,
  0013-powerpc64le-Optimize-memset-for-POWER10.patch,
  0014-powerpc64le-Fix-ifunc-selection-for-memset-memmove-b.patch,
  0015-powerpc-Add-optimized-rawmemchr-for-POWER10.patch: ppc64le ifunc
  improvements (bsc#1194785, jsc#SLE-18195)</changelog>
  <changelog author="schwab@suse.de" date="1643025600">- getcwd-erange.patch: getcwd: Set errno to ERANGE for size == 1
  (CVE-2021-3999, bsc#1194640, BZ #28769)</changelog>
</package>
<package pkgid="7852c7a1693d85b016944ddac3bd99f4745270b879523fa49a6b4a124b74f0c9" name="glibc-locale-base" arch="aarch64">
  <version epoch="0" ver="2.31" rel="150300.9.12.1"/>
  <changelog author="schwab@suse.de" date="1583841600">- dl-sort-maps.patch, dlopen-filter-object.patch: Allow dlopen of filter
  object to work (bsc#1166106, BZ #16272)</changelog>
  <changelog author="schwab@suse.de" date="1585137600">- glob-use-after-free.patch: Fix use-after-free in glob when expanding
  ~user (CVE-2020-1752, bsc#1167631, BZ #25414)</changelog>
  <changelog author="schwab@suse.de" date="1589371200">- nptl-setxid-race.patch: nptl: wait for pending setxid request also in
  detached thread (bsc#1162930, BZ #25942)</changelog>
  <changelog author="schwab@suse.de" date="1593518400">- nscd-senfile.patch: Fix concurrent changes on nscd aware files
  (bsc#1171878, BZ #23178)
- nscd-prune.patch: nscd: bump GC cycle during cache pruning (bsc#1171878,
  BZ #26130)
- syslog-locking.patch: Correct locking and cancellation cleanup in syslog
  functions (bsc#1172085, BZ #26100)</changelog>
  <changelog author="schwab@suse.de" date="1599048000">- Update to glibc 2.31
- glibc-2.14-crypt.diff, crypt_blowfish-const.patch,
  crypt_blowfish-1.2-sha.diff, crypt_blowfish-gensalt.patch,
  crypt_blowfish-1.2-hack_around_arm.diff, glibc-nodate.patch,
  powerpc-elision-enable-envvar.patch, s390-elision-enable-envvar.patch,
  crt-nocompress-debug-sections.patch, resolv-context-leak.patch,
  dl-runtime-resolve-opt-avx512f.patch, libpthread-compat-wrappers.patch,
  math-c++-compat.patch, remove-nss-nis-compat.patch,
  eh-frame-zero-terminator.patch, ld-so-hwcap-x86-64.patch,
  assert-pedantic.patch, getaddrinfo-errno.patch, resolv-conf-oom.patch,
  dynarray-allocation.patch, nearbyint-inexact.patch, nss-compat.patch,
  nscd-libnsl.patch, malloc-tcache-leak.patch,
  falkor-memcpy-memmove.patch, aarch64-cpu-features.patch,
  nss-files-large-buffers.patch, sysconf-uio-maxiov.patch,
  glob-tilde-overflow.patch, dl-runtime-resolve-xsave.patch,
  spawni-assert.patch, x86-64-dl-platform.patch, glob64-s390.patch,
  tst-tlsopt-powerpc.patch, powerpc-hwcap-bits.patch,
  malloc-tcache-check-overflow.patch, dl-init-paths-overflow.patch,
  fillin-rpath-empty-tokens.patch, getcwd-absolute.patch,
  memalign-overflow.patch, stack-guard-size-accounting.patch,
  libgcc-rtld-now.patch, res-send-enomem.patch,
  glibc-fix-avx512-mempcpy.patch, i386-memmove-sse2-unaligned.patch,
  realpath-ssize-max-overflow.patch, localtime-2039.patch,
  math-remove-slow-path.patch, aarch64-hwcap-atomics.patch,
  glibc-fix-aarch64-build.diff, absolute-symbols.patch,
  x86-haswell-string-flags.patch,
  pthread-cond-broadcast-waiters-after-spinning.patch,
  mman-map-sync.patch, mman-linux-map-shared-validate.patch,
  nptl-setxid-error.patch, pthread-mutex-trylock-barrier.patch,
  getaddrinfo-parse-ipv4-address.patch, japanese-era-name-may-2019.patch,
  force-elision-race.patch, regex-read-overrun.patch,
  regex-parse-reg-exp.patch,
  0001-S390-Add-configure-check-to-detect-z10-as-mininum-ar.patch,
  0002-S390-Use-hwcap-instead-of-dl_hwcap-in-ifunc-resolver.patch,
  0003-S390-Unify-31-64bit-memcpy.patch,
  0004-S390-Refactor-memcpy-mempcpy-ifunc-handling.patch,
  0005-S390-Remove-s390-specific-implementation-of-bcopy.patch,
  0006-S390-Use-memcpy-for-forward-cases-in-memmove.patch,
  0007-S390-Add-configure-check-to-detect-z13-as-mininum-ar.patch,
  0008-S390-Add-z13-memmove-ifunc-variant.patch,
  0009-S390-Add-z13-strstr-ifunc-variant.patch,
  0010-S390-Add-z13-memmem-ifunc-variant.patch,
  0011-S390-Cleanup-ifunc-resolve.h.patch,
  0012-S390-Mark-vx-and-vxe-as-important-hwcap.patch,
  0013-S390-Add-new-hwcap-values-for-new-cpu-architecture-a.patch,
  0014-S390-Add-configure-check-to-detect-support-for-arch1.patch,
  0015-S390-Add-arch13-memmove-ifunc-variant.patch,
  0016-S390-Add-arch13-strstr-ifunc-variant.patch,
  0017-S390-Add-arch13-memmem-ifunc-variant.patch,
  prefer-map-32bit-exec.patch, s390-strstr-page-boundary.patch,
  ppc-tle-htm-nosc.patch,
  posix-Add-internal-symbols-for-posix_spawn-interface.patch,
  glibc-2.29-posix-Use-posix_spawn-on-popen.patch,
  backtrace-powerpc.patch, pthread-rwlock-pwn.patch,
  manual-memory-protection.patch, ldbl-96-rem-pio2l.patch,
  dl-sort-maps.patch, dlopen-filter-object.patch,
  glob-use-after-free.patch, nptl-setxid-race.patch, nscd-senfile.patch,
  ldd-system-interp.patch, abort-no-flush.patch,
  fnmatch-collating-elements.patch, nss-files-long-lines-2.patch,
  iconv-reset-input-buffer.patch, nscd-prune.patch, syslog-locking.patch:
  Removed.
- long-double-alias.patch, glibc-nsswitch-usr.diff, euc-kr-overrun.patch,
  riscv-syscall-clobber.patch, nscd-gc-cycle.patch: Added.</changelog>
  <changelog author="schwab@suse.de" date="1604923200">- power10-support.patch: Add support for POWER10 (jsc#SLE-13520)
- iconv-option-parsing.patch: Rewrite iconv option parsing
  (CVE-2016-10228, bsc#1027496, BZ #19519)</changelog>
  <changelog author="schwab@suse.de" date="1608120000">- aarch64-getauxval.patch: aarch64: Accept PLT calls to __getauxval within
  libc.so (bsc#1167939)
- iconv-redundant-shift.patch: iconv: Accept redundant shift sequences in
  IBM1364 (CVE-2020-27618, bsc#1178386, BZ #26224)
- iconv-ucs4-loop-bounds.patch: iconv: Fix incorrect UCS4 inner loop
  bounds (CVE-2020-29562, bsc#1179694, BZ #26923)
- printf-long-double-non-normal.patch: x86: Harden printf against
  non-normal long double values (CVE-2020-29573, bsc#1179721, BZ #26649)
- get-nprocs-cpu-online-parsing.patch: Fix parsing of
  /sys/devices/system/cpu/online (bsc#1180038, BZ #25859)</changelog>
  <changelog author="schwab@suse.de" date="1609848000">- sysvipc-sem-stat-any.patch: sysvipc: Fix SEM_STAT_ANY kernel argument
  pass (bsc#1180557, BZ #26637)</changelog>
  <changelog author="schwab@suse.de" date="1611835200">- gconv-assertion-iso-2022-jp.patch: gconv: Fix assertion failure in
  ISO-2022-JP-3 module (CVE-2021-3326, bsc#1181505, BZ #27256)</changelog>
  <changelog author="schwab@suse.de" date="1614772800">- nscd-netgroupcache.patch: nscd: Fix double free in netgroupcache
  (CVE-2021-27645, bsc#1182733, BZ #27462)</changelog>
  <changelog author="rguenther@suse.com" date="1615377600">- Add glibc-2.31-HTM-vzeroupper.diff to avoid VZEROUPPER in the
  AVX2 accelerated string routines which cause HTM transaction
  aborts.  Instead use EVEX or SSE.  (bsc#1181403)</changelog>
  <changelog author="rguenther@suse.com" date="1615377601">- Update glibc-2.31-HTM-vzeroupper.diff with a AVX-SSE transition
  fix.</changelog>
  <changelog author="schwab@suse.de" date="1617019200">- s390-memmove-ifunc-selector-arch13.patch: S390: Also check vector
  support in memmove ifunc-selector (bsc#1184035, BZ #27511)</changelog>
  <changelog author="schwab@suse.de" date="1625140800">- wordexp-param-overflow.patch: wordexp: handle overflow in positional
  parameter number (CVE-2021-35942, bsc#1187911, BZ #28011)</changelog>
  <changelog author="schwab@suse.de" date="1630584000">- mq-notify-use-after-free.patch: Use __pthread_attr_copy in mq_notify
  (CVE-2021-33574, bsc#1186489, BZ #27896)</changelog>
  <changelog author="schwab@suse.de" date="1636027200">- 0001-s390x-Align-child-stack-while-clone.-BZ-27968.patch,
  0002-S390-Optimize-__memcpy_z196.patch,
  0003-S390-Optimize-__memset_z196.patch,
  0004-S390-Sync-HWCAP-names-with-kernel-by-adding-aliases-.patch,
  0005-S390-Add-new-hwcap-values.patch,
  0006-S390-Add-PCI_MIO-and-SIE-HWCAPs.patch: [15sp4 FEAT] GNU2007 -
  GLIBC: Support for new IBM Z Hardware (bsc#1191592, jsc#IBM-869)</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1640174400">- Add support for livepatches (jsc#SLE-20049).
- Enable livepatching on x86_64.
- Generate ipa-clones tarball artifact when livepatching is enabled.</changelog>
  <changelog author="schwab@suse.de" date="1642420800">- clnt-create-unix-overflow.patch: Buffer overflow in sunrpc clnt_create
  for "unix" (CVE-2022-23219, bsc#1194768, BZ #22542)
- svcunix-create-overflow.patch: Buffer overflow in sunrpc svcunix_create
  (CVE-2022-23218, bsc#1194770, BZ #28768)</changelog>
  <changelog author="schwab@suse.de" date="1642593600">- 0001-powerpc-Optimized-strcpy-for-POWER9.patch,
  0002-powerpc-Optimized-stpcpy-for-POWER9.patch,
  0003-powerpc-Optimized-rawmemchr-for-POWER9.patch,
  0004-powerpc64le-add-optimized-strlen-for-P9.patch,
  0005-powerpc-fix-ifunc-implementation-list-for-POWER9-str.patch,
  0006-powerpc-Add-optimized-strncpy-for-POWER9.patch,
  0007-powerpc-Add-optimized-stpncpy-for-POWER9.patch,
  0008-powerpc-Add-optimized-ilogb-for-POWER9.patch,
  0009-powerpc-Add-optimized-llogb-for-POWER9.patch,
  0010-powerpc-Add-optimized-strlen-for-POWER10.patch,
  0011-powerpc64le-Optimized-memmove-for-POWER10.patch,
  0012-powerpc64le-Optimize-memcpy-for-POWER10.patch,
  0013-powerpc64le-Optimize-memset-for-POWER10.patch,
  0014-powerpc64le-Fix-ifunc-selection-for-memset-memmove-b.patch,
  0015-powerpc-Add-optimized-rawmemchr-for-POWER10.patch: ppc64le ifunc
  improvements (bsc#1194785, jsc#SLE-18195)</changelog>
  <changelog author="schwab@suse.de" date="1643025600">- getcwd-erange.patch: getcwd: Set errno to ERANGE for size == 1
  (CVE-2021-3999, bsc#1194640, BZ #28769)</changelog>
</package>
<package pkgid="4944d3e15ce46580d5171cc58c9a2a9aeddc68e97b54cddb315ecdb2df2f0849" name="glibc-locale-base" arch="ppc64le">
  <version epoch="0" ver="2.31" rel="150300.9.12.1"/>
  <changelog author="schwab@suse.de" date="1583841600">- dl-sort-maps.patch, dlopen-filter-object.patch: Allow dlopen of filter
  object to work (bsc#1166106, BZ #16272)</changelog>
  <changelog author="schwab@suse.de" date="1585137600">- glob-use-after-free.patch: Fix use-after-free in glob when expanding
  ~user (CVE-2020-1752, bsc#1167631, BZ #25414)</changelog>
  <changelog author="schwab@suse.de" date="1589371200">- nptl-setxid-race.patch: nptl: wait for pending setxid request also in
  detached thread (bsc#1162930, BZ #25942)</changelog>
  <changelog author="schwab@suse.de" date="1593518400">- nscd-senfile.patch: Fix concurrent changes on nscd aware files
  (bsc#1171878, BZ #23178)
- nscd-prune.patch: nscd: bump GC cycle during cache pruning (bsc#1171878,
  BZ #26130)
- syslog-locking.patch: Correct locking and cancellation cleanup in syslog
  functions (bsc#1172085, BZ #26100)</changelog>
  <changelog author="schwab@suse.de" date="1599048000">- Update to glibc 2.31
- glibc-2.14-crypt.diff, crypt_blowfish-const.patch,
  crypt_blowfish-1.2-sha.diff, crypt_blowfish-gensalt.patch,
  crypt_blowfish-1.2-hack_around_arm.diff, glibc-nodate.patch,
  powerpc-elision-enable-envvar.patch, s390-elision-enable-envvar.patch,
  crt-nocompress-debug-sections.patch, resolv-context-leak.patch,
  dl-runtime-resolve-opt-avx512f.patch, libpthread-compat-wrappers.patch,
  math-c++-compat.patch, remove-nss-nis-compat.patch,
  eh-frame-zero-terminator.patch, ld-so-hwcap-x86-64.patch,
  assert-pedantic.patch, getaddrinfo-errno.patch, resolv-conf-oom.patch,
  dynarray-allocation.patch, nearbyint-inexact.patch, nss-compat.patch,
  nscd-libnsl.patch, malloc-tcache-leak.patch,
  falkor-memcpy-memmove.patch, aarch64-cpu-features.patch,
  nss-files-large-buffers.patch, sysconf-uio-maxiov.patch,
  glob-tilde-overflow.patch, dl-runtime-resolve-xsave.patch,
  spawni-assert.patch, x86-64-dl-platform.patch, glob64-s390.patch,
  tst-tlsopt-powerpc.patch, powerpc-hwcap-bits.patch,
  malloc-tcache-check-overflow.patch, dl-init-paths-overflow.patch,
  fillin-rpath-empty-tokens.patch, getcwd-absolute.patch,
  memalign-overflow.patch, stack-guard-size-accounting.patch,
  libgcc-rtld-now.patch, res-send-enomem.patch,
  glibc-fix-avx512-mempcpy.patch, i386-memmove-sse2-unaligned.patch,
  realpath-ssize-max-overflow.patch, localtime-2039.patch,
  math-remove-slow-path.patch, aarch64-hwcap-atomics.patch,
  glibc-fix-aarch64-build.diff, absolute-symbols.patch,
  x86-haswell-string-flags.patch,
  pthread-cond-broadcast-waiters-after-spinning.patch,
  mman-map-sync.patch, mman-linux-map-shared-validate.patch,
  nptl-setxid-error.patch, pthread-mutex-trylock-barrier.patch,
  getaddrinfo-parse-ipv4-address.patch, japanese-era-name-may-2019.patch,
  force-elision-race.patch, regex-read-overrun.patch,
  regex-parse-reg-exp.patch,
  0001-S390-Add-configure-check-to-detect-z10-as-mininum-ar.patch,
  0002-S390-Use-hwcap-instead-of-dl_hwcap-in-ifunc-resolver.patch,
  0003-S390-Unify-31-64bit-memcpy.patch,
  0004-S390-Refactor-memcpy-mempcpy-ifunc-handling.patch,
  0005-S390-Remove-s390-specific-implementation-of-bcopy.patch,
  0006-S390-Use-memcpy-for-forward-cases-in-memmove.patch,
  0007-S390-Add-configure-check-to-detect-z13-as-mininum-ar.patch,
  0008-S390-Add-z13-memmove-ifunc-variant.patch,
  0009-S390-Add-z13-strstr-ifunc-variant.patch,
  0010-S390-Add-z13-memmem-ifunc-variant.patch,
  0011-S390-Cleanup-ifunc-resolve.h.patch,
  0012-S390-Mark-vx-and-vxe-as-important-hwcap.patch,
  0013-S390-Add-new-hwcap-values-for-new-cpu-architecture-a.patch,
  0014-S390-Add-configure-check-to-detect-support-for-arch1.patch,
  0015-S390-Add-arch13-memmove-ifunc-variant.patch,
  0016-S390-Add-arch13-strstr-ifunc-variant.patch,
  0017-S390-Add-arch13-memmem-ifunc-variant.patch,
  prefer-map-32bit-exec.patch, s390-strstr-page-boundary.patch,
  ppc-tle-htm-nosc.patch,
  posix-Add-internal-symbols-for-posix_spawn-interface.patch,
  glibc-2.29-posix-Use-posix_spawn-on-popen.patch,
  backtrace-powerpc.patch, pthread-rwlock-pwn.patch,
  manual-memory-protection.patch, ldbl-96-rem-pio2l.patch,
  dl-sort-maps.patch, dlopen-filter-object.patch,
  glob-use-after-free.patch, nptl-setxid-race.patch, nscd-senfile.patch,
  ldd-system-interp.patch, abort-no-flush.patch,
  fnmatch-collating-elements.patch, nss-files-long-lines-2.patch,
  iconv-reset-input-buffer.patch, nscd-prune.patch, syslog-locking.patch:
  Removed.
- long-double-alias.patch, glibc-nsswitch-usr.diff, euc-kr-overrun.patch,
  riscv-syscall-clobber.patch, nscd-gc-cycle.patch: Added.</changelog>
  <changelog author="schwab@suse.de" date="1604923200">- power10-support.patch: Add support for POWER10 (jsc#SLE-13520)
- iconv-option-parsing.patch: Rewrite iconv option parsing
  (CVE-2016-10228, bsc#1027496, BZ #19519)</changelog>
  <changelog author="schwab@suse.de" date="1608120000">- aarch64-getauxval.patch: aarch64: Accept PLT calls to __getauxval within
  libc.so (bsc#1167939)
- iconv-redundant-shift.patch: iconv: Accept redundant shift sequences in
  IBM1364 (CVE-2020-27618, bsc#1178386, BZ #26224)
- iconv-ucs4-loop-bounds.patch: iconv: Fix incorrect UCS4 inner loop
  bounds (CVE-2020-29562, bsc#1179694, BZ #26923)
- printf-long-double-non-normal.patch: x86: Harden printf against
  non-normal long double values (CVE-2020-29573, bsc#1179721, BZ #26649)
- get-nprocs-cpu-online-parsing.patch: Fix parsing of
  /sys/devices/system/cpu/online (bsc#1180038, BZ #25859)</changelog>
  <changelog author="schwab@suse.de" date="1609848000">- sysvipc-sem-stat-any.patch: sysvipc: Fix SEM_STAT_ANY kernel argument
  pass (bsc#1180557, BZ #26637)</changelog>
  <changelog author="schwab@suse.de" date="1611835200">- gconv-assertion-iso-2022-jp.patch: gconv: Fix assertion failure in
  ISO-2022-JP-3 module (CVE-2021-3326, bsc#1181505, BZ #27256)</changelog>
  <changelog author="schwab@suse.de" date="1614772800">- nscd-netgroupcache.patch: nscd: Fix double free in netgroupcache
  (CVE-2021-27645, bsc#1182733, BZ #27462)</changelog>
  <changelog author="rguenther@suse.com" date="1615377600">- Add glibc-2.31-HTM-vzeroupper.diff to avoid VZEROUPPER in the
  AVX2 accelerated string routines which cause HTM transaction
  aborts.  Instead use EVEX or SSE.  (bsc#1181403)</changelog>
  <changelog author="rguenther@suse.com" date="1615377601">- Update glibc-2.31-HTM-vzeroupper.diff with a AVX-SSE transition
  fix.</changelog>
  <changelog author="schwab@suse.de" date="1617019200">- s390-memmove-ifunc-selector-arch13.patch: S390: Also check vector
  support in memmove ifunc-selector (bsc#1184035, BZ #27511)</changelog>
  <changelog author="schwab@suse.de" date="1625140800">- wordexp-param-overflow.patch: wordexp: handle overflow in positional
  parameter number (CVE-2021-35942, bsc#1187911, BZ #28011)</changelog>
  <changelog author="schwab@suse.de" date="1630584000">- mq-notify-use-after-free.patch: Use __pthread_attr_copy in mq_notify
  (CVE-2021-33574, bsc#1186489, BZ #27896)</changelog>
  <changelog author="schwab@suse.de" date="1636027200">- 0001-s390x-Align-child-stack-while-clone.-BZ-27968.patch,
  0002-S390-Optimize-__memcpy_z196.patch,
  0003-S390-Optimize-__memset_z196.patch,
  0004-S390-Sync-HWCAP-names-with-kernel-by-adding-aliases-.patch,
  0005-S390-Add-new-hwcap-values.patch,
  0006-S390-Add-PCI_MIO-and-SIE-HWCAPs.patch: [15sp4 FEAT] GNU2007 -
  GLIBC: Support for new IBM Z Hardware (bsc#1191592, jsc#IBM-869)</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1640174400">- Add support for livepatches (jsc#SLE-20049).
- Enable livepatching on x86_64.
- Generate ipa-clones tarball artifact when livepatching is enabled.</changelog>
  <changelog author="schwab@suse.de" date="1642420800">- clnt-create-unix-overflow.patch: Buffer overflow in sunrpc clnt_create
  for "unix" (CVE-2022-23219, bsc#1194768, BZ #22542)
- svcunix-create-overflow.patch: Buffer overflow in sunrpc svcunix_create
  (CVE-2022-23218, bsc#1194770, BZ #28768)</changelog>
  <changelog author="schwab@suse.de" date="1642593600">- 0001-powerpc-Optimized-strcpy-for-POWER9.patch,
  0002-powerpc-Optimized-stpcpy-for-POWER9.patch,
  0003-powerpc-Optimized-rawmemchr-for-POWER9.patch,
  0004-powerpc64le-add-optimized-strlen-for-P9.patch,
  0005-powerpc-fix-ifunc-implementation-list-for-POWER9-str.patch,
  0006-powerpc-Add-optimized-strncpy-for-POWER9.patch,
  0007-powerpc-Add-optimized-stpncpy-for-POWER9.patch,
  0008-powerpc-Add-optimized-ilogb-for-POWER9.patch,
  0009-powerpc-Add-optimized-llogb-for-POWER9.patch,
  0010-powerpc-Add-optimized-strlen-for-POWER10.patch,
  0011-powerpc64le-Optimized-memmove-for-POWER10.patch,
  0012-powerpc64le-Optimize-memcpy-for-POWER10.patch,
  0013-powerpc64le-Optimize-memset-for-POWER10.patch,
  0014-powerpc64le-Fix-ifunc-selection-for-memset-memmove-b.patch,
  0015-powerpc-Add-optimized-rawmemchr-for-POWER10.patch: ppc64le ifunc
  improvements (bsc#1194785, jsc#SLE-18195)</changelog>
  <changelog author="schwab@suse.de" date="1643025600">- getcwd-erange.patch: getcwd: Set errno to ERANGE for size == 1
  (CVE-2021-3999, bsc#1194640, BZ #28769)</changelog>
</package>
<package pkgid="c865c92b11eaf23e4020c50c450a7259b24743f1e41a5756a5e5480d7c57fa9c" name="glibc-locale-base" arch="s390x">
  <version epoch="0" ver="2.31" rel="150300.9.12.1"/>
  <changelog author="schwab@suse.de" date="1583841600">- dl-sort-maps.patch, dlopen-filter-object.patch: Allow dlopen of filter
  object to work (bsc#1166106, BZ #16272)</changelog>
  <changelog author="schwab@suse.de" date="1585137600">- glob-use-after-free.patch: Fix use-after-free in glob when expanding
  ~user (CVE-2020-1752, bsc#1167631, BZ #25414)</changelog>
  <changelog author="schwab@suse.de" date="1589371200">- nptl-setxid-race.patch: nptl: wait for pending setxid request also in
  detached thread (bsc#1162930, BZ #25942)</changelog>
  <changelog author="schwab@suse.de" date="1593518400">- nscd-senfile.patch: Fix concurrent changes on nscd aware files
  (bsc#1171878, BZ #23178)
- nscd-prune.patch: nscd: bump GC cycle during cache pruning (bsc#1171878,
  BZ #26130)
- syslog-locking.patch: Correct locking and cancellation cleanup in syslog
  functions (bsc#1172085, BZ #26100)</changelog>
  <changelog author="schwab@suse.de" date="1599048000">- Update to glibc 2.31
- glibc-2.14-crypt.diff, crypt_blowfish-const.patch,
  crypt_blowfish-1.2-sha.diff, crypt_blowfish-gensalt.patch,
  crypt_blowfish-1.2-hack_around_arm.diff, glibc-nodate.patch,
  powerpc-elision-enable-envvar.patch, s390-elision-enable-envvar.patch,
  crt-nocompress-debug-sections.patch, resolv-context-leak.patch,
  dl-runtime-resolve-opt-avx512f.patch, libpthread-compat-wrappers.patch,
  math-c++-compat.patch, remove-nss-nis-compat.patch,
  eh-frame-zero-terminator.patch, ld-so-hwcap-x86-64.patch,
  assert-pedantic.patch, getaddrinfo-errno.patch, resolv-conf-oom.patch,
  dynarray-allocation.patch, nearbyint-inexact.patch, nss-compat.patch,
  nscd-libnsl.patch, malloc-tcache-leak.patch,
  falkor-memcpy-memmove.patch, aarch64-cpu-features.patch,
  nss-files-large-buffers.patch, sysconf-uio-maxiov.patch,
  glob-tilde-overflow.patch, dl-runtime-resolve-xsave.patch,
  spawni-assert.patch, x86-64-dl-platform.patch, glob64-s390.patch,
  tst-tlsopt-powerpc.patch, powerpc-hwcap-bits.patch,
  malloc-tcache-check-overflow.patch, dl-init-paths-overflow.patch,
  fillin-rpath-empty-tokens.patch, getcwd-absolute.patch,
  memalign-overflow.patch, stack-guard-size-accounting.patch,
  libgcc-rtld-now.patch, res-send-enomem.patch,
  glibc-fix-avx512-mempcpy.patch, i386-memmove-sse2-unaligned.patch,
  realpath-ssize-max-overflow.patch, localtime-2039.patch,
  math-remove-slow-path.patch, aarch64-hwcap-atomics.patch,
  glibc-fix-aarch64-build.diff, absolute-symbols.patch,
  x86-haswell-string-flags.patch,
  pthread-cond-broadcast-waiters-after-spinning.patch,
  mman-map-sync.patch, mman-linux-map-shared-validate.patch,
  nptl-setxid-error.patch, pthread-mutex-trylock-barrier.patch,
  getaddrinfo-parse-ipv4-address.patch, japanese-era-name-may-2019.patch,
  force-elision-race.patch, regex-read-overrun.patch,
  regex-parse-reg-exp.patch,
  0001-S390-Add-configure-check-to-detect-z10-as-mininum-ar.patch,
  0002-S390-Use-hwcap-instead-of-dl_hwcap-in-ifunc-resolver.patch,
  0003-S390-Unify-31-64bit-memcpy.patch,
  0004-S390-Refactor-memcpy-mempcpy-ifunc-handling.patch,
  0005-S390-Remove-s390-specific-implementation-of-bcopy.patch,
  0006-S390-Use-memcpy-for-forward-cases-in-memmove.patch,
  0007-S390-Add-configure-check-to-detect-z13-as-mininum-ar.patch,
  0008-S390-Add-z13-memmove-ifunc-variant.patch,
  0009-S390-Add-z13-strstr-ifunc-variant.patch,
  0010-S390-Add-z13-memmem-ifunc-variant.patch,
  0011-S390-Cleanup-ifunc-resolve.h.patch,
  0012-S390-Mark-vx-and-vxe-as-important-hwcap.patch,
  0013-S390-Add-new-hwcap-values-for-new-cpu-architecture-a.patch,
  0014-S390-Add-configure-check-to-detect-support-for-arch1.patch,
  0015-S390-Add-arch13-memmove-ifunc-variant.patch,
  0016-S390-Add-arch13-strstr-ifunc-variant.patch,
  0017-S390-Add-arch13-memmem-ifunc-variant.patch,
  prefer-map-32bit-exec.patch, s390-strstr-page-boundary.patch,
  ppc-tle-htm-nosc.patch,
  posix-Add-internal-symbols-for-posix_spawn-interface.patch,
  glibc-2.29-posix-Use-posix_spawn-on-popen.patch,
  backtrace-powerpc.patch, pthread-rwlock-pwn.patch,
  manual-memory-protection.patch, ldbl-96-rem-pio2l.patch,
  dl-sort-maps.patch, dlopen-filter-object.patch,
  glob-use-after-free.patch, nptl-setxid-race.patch, nscd-senfile.patch,
  ldd-system-interp.patch, abort-no-flush.patch,
  fnmatch-collating-elements.patch, nss-files-long-lines-2.patch,
  iconv-reset-input-buffer.patch, nscd-prune.patch, syslog-locking.patch:
  Removed.
- long-double-alias.patch, glibc-nsswitch-usr.diff, euc-kr-overrun.patch,
  riscv-syscall-clobber.patch, nscd-gc-cycle.patch: Added.</changelog>
  <changelog author="schwab@suse.de" date="1604923200">- power10-support.patch: Add support for POWER10 (jsc#SLE-13520)
- iconv-option-parsing.patch: Rewrite iconv option parsing
  (CVE-2016-10228, bsc#1027496, BZ #19519)</changelog>
  <changelog author="schwab@suse.de" date="1608120000">- aarch64-getauxval.patch: aarch64: Accept PLT calls to __getauxval within
  libc.so (bsc#1167939)
- iconv-redundant-shift.patch: iconv: Accept redundant shift sequences in
  IBM1364 (CVE-2020-27618, bsc#1178386, BZ #26224)
- iconv-ucs4-loop-bounds.patch: iconv: Fix incorrect UCS4 inner loop
  bounds (CVE-2020-29562, bsc#1179694, BZ #26923)
- printf-long-double-non-normal.patch: x86: Harden printf against
  non-normal long double values (CVE-2020-29573, bsc#1179721, BZ #26649)
- get-nprocs-cpu-online-parsing.patch: Fix parsing of
  /sys/devices/system/cpu/online (bsc#1180038, BZ #25859)</changelog>
  <changelog author="schwab@suse.de" date="1609848000">- sysvipc-sem-stat-any.patch: sysvipc: Fix SEM_STAT_ANY kernel argument
  pass (bsc#1180557, BZ #26637)</changelog>
  <changelog author="schwab@suse.de" date="1611835200">- gconv-assertion-iso-2022-jp.patch: gconv: Fix assertion failure in
  ISO-2022-JP-3 module (CVE-2021-3326, bsc#1181505, BZ #27256)</changelog>
  <changelog author="schwab@suse.de" date="1614772800">- nscd-netgroupcache.patch: nscd: Fix double free in netgroupcache
  (CVE-2021-27645, bsc#1182733, BZ #27462)</changelog>
  <changelog author="rguenther@suse.com" date="1615377600">- Add glibc-2.31-HTM-vzeroupper.diff to avoid VZEROUPPER in the
  AVX2 accelerated string routines which cause HTM transaction
  aborts.  Instead use EVEX or SSE.  (bsc#1181403)</changelog>
  <changelog author="rguenther@suse.com" date="1615377601">- Update glibc-2.31-HTM-vzeroupper.diff with a AVX-SSE transition
  fix.</changelog>
  <changelog author="schwab@suse.de" date="1617019200">- s390-memmove-ifunc-selector-arch13.patch: S390: Also check vector
  support in memmove ifunc-selector (bsc#1184035, BZ #27511)</changelog>
  <changelog author="schwab@suse.de" date="1625140800">- wordexp-param-overflow.patch: wordexp: handle overflow in positional
  parameter number (CVE-2021-35942, bsc#1187911, BZ #28011)</changelog>
  <changelog author="schwab@suse.de" date="1630584000">- mq-notify-use-after-free.patch: Use __pthread_attr_copy in mq_notify
  (CVE-2021-33574, bsc#1186489, BZ #27896)</changelog>
  <changelog author="schwab@suse.de" date="1636027200">- 0001-s390x-Align-child-stack-while-clone.-BZ-27968.patch,
  0002-S390-Optimize-__memcpy_z196.patch,
  0003-S390-Optimize-__memset_z196.patch,
  0004-S390-Sync-HWCAP-names-with-kernel-by-adding-aliases-.patch,
  0005-S390-Add-new-hwcap-values.patch,
  0006-S390-Add-PCI_MIO-and-SIE-HWCAPs.patch: [15sp4 FEAT] GNU2007 -
  GLIBC: Support for new IBM Z Hardware (bsc#1191592, jsc#IBM-869)</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1640174400">- Add support for livepatches (jsc#SLE-20049).
- Enable livepatching on x86_64.
- Generate ipa-clones tarball artifact when livepatching is enabled.</changelog>
  <changelog author="schwab@suse.de" date="1642420800">- clnt-create-unix-overflow.patch: Buffer overflow in sunrpc clnt_create
  for "unix" (CVE-2022-23219, bsc#1194768, BZ #22542)
- svcunix-create-overflow.patch: Buffer overflow in sunrpc svcunix_create
  (CVE-2022-23218, bsc#1194770, BZ #28768)</changelog>
  <changelog author="schwab@suse.de" date="1642593600">- 0001-powerpc-Optimized-strcpy-for-POWER9.patch,
  0002-powerpc-Optimized-stpcpy-for-POWER9.patch,
  0003-powerpc-Optimized-rawmemchr-for-POWER9.patch,
  0004-powerpc64le-add-optimized-strlen-for-P9.patch,
  0005-powerpc-fix-ifunc-implementation-list-for-POWER9-str.patch,
  0006-powerpc-Add-optimized-strncpy-for-POWER9.patch,
  0007-powerpc-Add-optimized-stpncpy-for-POWER9.patch,
  0008-powerpc-Add-optimized-ilogb-for-POWER9.patch,
  0009-powerpc-Add-optimized-llogb-for-POWER9.patch,
  0010-powerpc-Add-optimized-strlen-for-POWER10.patch,
  0011-powerpc64le-Optimized-memmove-for-POWER10.patch,
  0012-powerpc64le-Optimize-memcpy-for-POWER10.patch,
  0013-powerpc64le-Optimize-memset-for-POWER10.patch,
  0014-powerpc64le-Fix-ifunc-selection-for-memset-memmove-b.patch,
  0015-powerpc-Add-optimized-rawmemchr-for-POWER10.patch: ppc64le ifunc
  improvements (bsc#1194785, jsc#SLE-18195)</changelog>
  <changelog author="schwab@suse.de" date="1643025600">- getcwd-erange.patch: getcwd: Set errno to ERANGE for size == 1
  (CVE-2021-3999, bsc#1194640, BZ #28769)</changelog>
</package>
<package pkgid="a78d38bb53f235b2002cf52578bde99171be40fd644832c47bf27e09ad33f182" name="glibc-locale-base" arch="x86_64">
  <version epoch="0" ver="2.31" rel="150300.9.12.1"/>
  <changelog author="schwab@suse.de" date="1583841600">- dl-sort-maps.patch, dlopen-filter-object.patch: Allow dlopen of filter
  object to work (bsc#1166106, BZ #16272)</changelog>
  <changelog author="schwab@suse.de" date="1585137600">- glob-use-after-free.patch: Fix use-after-free in glob when expanding
  ~user (CVE-2020-1752, bsc#1167631, BZ #25414)</changelog>
  <changelog author="schwab@suse.de" date="1589371200">- nptl-setxid-race.patch: nptl: wait for pending setxid request also in
  detached thread (bsc#1162930, BZ #25942)</changelog>
  <changelog author="schwab@suse.de" date="1593518400">- nscd-senfile.patch: Fix concurrent changes on nscd aware files
  (bsc#1171878, BZ #23178)
- nscd-prune.patch: nscd: bump GC cycle during cache pruning (bsc#1171878,
  BZ #26130)
- syslog-locking.patch: Correct locking and cancellation cleanup in syslog
  functions (bsc#1172085, BZ #26100)</changelog>
  <changelog author="schwab@suse.de" date="1599048000">- Update to glibc 2.31
- glibc-2.14-crypt.diff, crypt_blowfish-const.patch,
  crypt_blowfish-1.2-sha.diff, crypt_blowfish-gensalt.patch,
  crypt_blowfish-1.2-hack_around_arm.diff, glibc-nodate.patch,
  powerpc-elision-enable-envvar.patch, s390-elision-enable-envvar.patch,
  crt-nocompress-debug-sections.patch, resolv-context-leak.patch,
  dl-runtime-resolve-opt-avx512f.patch, libpthread-compat-wrappers.patch,
  math-c++-compat.patch, remove-nss-nis-compat.patch,
  eh-frame-zero-terminator.patch, ld-so-hwcap-x86-64.patch,
  assert-pedantic.patch, getaddrinfo-errno.patch, resolv-conf-oom.patch,
  dynarray-allocation.patch, nearbyint-inexact.patch, nss-compat.patch,
  nscd-libnsl.patch, malloc-tcache-leak.patch,
  falkor-memcpy-memmove.patch, aarch64-cpu-features.patch,
  nss-files-large-buffers.patch, sysconf-uio-maxiov.patch,
  glob-tilde-overflow.patch, dl-runtime-resolve-xsave.patch,
  spawni-assert.patch, x86-64-dl-platform.patch, glob64-s390.patch,
  tst-tlsopt-powerpc.patch, powerpc-hwcap-bits.patch,
  malloc-tcache-check-overflow.patch, dl-init-paths-overflow.patch,
  fillin-rpath-empty-tokens.patch, getcwd-absolute.patch,
  memalign-overflow.patch, stack-guard-size-accounting.patch,
  libgcc-rtld-now.patch, res-send-enomem.patch,
  glibc-fix-avx512-mempcpy.patch, i386-memmove-sse2-unaligned.patch,
  realpath-ssize-max-overflow.patch, localtime-2039.patch,
  math-remove-slow-path.patch, aarch64-hwcap-atomics.patch,
  glibc-fix-aarch64-build.diff, absolute-symbols.patch,
  x86-haswell-string-flags.patch,
  pthread-cond-broadcast-waiters-after-spinning.patch,
  mman-map-sync.patch, mman-linux-map-shared-validate.patch,
  nptl-setxid-error.patch, pthread-mutex-trylock-barrier.patch,
  getaddrinfo-parse-ipv4-address.patch, japanese-era-name-may-2019.patch,
  force-elision-race.patch, regex-read-overrun.patch,
  regex-parse-reg-exp.patch,
  0001-S390-Add-configure-check-to-detect-z10-as-mininum-ar.patch,
  0002-S390-Use-hwcap-instead-of-dl_hwcap-in-ifunc-resolver.patch,
  0003-S390-Unify-31-64bit-memcpy.patch,
  0004-S390-Refactor-memcpy-mempcpy-ifunc-handling.patch,
  0005-S390-Remove-s390-specific-implementation-of-bcopy.patch,
  0006-S390-Use-memcpy-for-forward-cases-in-memmove.patch,
  0007-S390-Add-configure-check-to-detect-z13-as-mininum-ar.patch,
  0008-S390-Add-z13-memmove-ifunc-variant.patch,
  0009-S390-Add-z13-strstr-ifunc-variant.patch,
  0010-S390-Add-z13-memmem-ifunc-variant.patch,
  0011-S390-Cleanup-ifunc-resolve.h.patch,
  0012-S390-Mark-vx-and-vxe-as-important-hwcap.patch,
  0013-S390-Add-new-hwcap-values-for-new-cpu-architecture-a.patch,
  0014-S390-Add-configure-check-to-detect-support-for-arch1.patch,
  0015-S390-Add-arch13-memmove-ifunc-variant.patch,
  0016-S390-Add-arch13-strstr-ifunc-variant.patch,
  0017-S390-Add-arch13-memmem-ifunc-variant.patch,
  prefer-map-32bit-exec.patch, s390-strstr-page-boundary.patch,
  ppc-tle-htm-nosc.patch,
  posix-Add-internal-symbols-for-posix_spawn-interface.patch,
  glibc-2.29-posix-Use-posix_spawn-on-popen.patch,
  backtrace-powerpc.patch, pthread-rwlock-pwn.patch,
  manual-memory-protection.patch, ldbl-96-rem-pio2l.patch,
  dl-sort-maps.patch, dlopen-filter-object.patch,
  glob-use-after-free.patch, nptl-setxid-race.patch, nscd-senfile.patch,
  ldd-system-interp.patch, abort-no-flush.patch,
  fnmatch-collating-elements.patch, nss-files-long-lines-2.patch,
  iconv-reset-input-buffer.patch, nscd-prune.patch, syslog-locking.patch:
  Removed.
- long-double-alias.patch, glibc-nsswitch-usr.diff, euc-kr-overrun.patch,
  riscv-syscall-clobber.patch, nscd-gc-cycle.patch: Added.</changelog>
  <changelog author="schwab@suse.de" date="1604923200">- power10-support.patch: Add support for POWER10 (jsc#SLE-13520)
- iconv-option-parsing.patch: Rewrite iconv option parsing
  (CVE-2016-10228, bsc#1027496, BZ #19519)</changelog>
  <changelog author="schwab@suse.de" date="1608120000">- aarch64-getauxval.patch: aarch64: Accept PLT calls to __getauxval within
  libc.so (bsc#1167939)
- iconv-redundant-shift.patch: iconv: Accept redundant shift sequences in
  IBM1364 (CVE-2020-27618, bsc#1178386, BZ #26224)
- iconv-ucs4-loop-bounds.patch: iconv: Fix incorrect UCS4 inner loop
  bounds (CVE-2020-29562, bsc#1179694, BZ #26923)
- printf-long-double-non-normal.patch: x86: Harden printf against
  non-normal long double values (CVE-2020-29573, bsc#1179721, BZ #26649)
- get-nprocs-cpu-online-parsing.patch: Fix parsing of
  /sys/devices/system/cpu/online (bsc#1180038, BZ #25859)</changelog>
  <changelog author="schwab@suse.de" date="1609848000">- sysvipc-sem-stat-any.patch: sysvipc: Fix SEM_STAT_ANY kernel argument
  pass (bsc#1180557, BZ #26637)</changelog>
  <changelog author="schwab@suse.de" date="1611835200">- gconv-assertion-iso-2022-jp.patch: gconv: Fix assertion failure in
  ISO-2022-JP-3 module (CVE-2021-3326, bsc#1181505, BZ #27256)</changelog>
  <changelog author="schwab@suse.de" date="1614772800">- nscd-netgroupcache.patch: nscd: Fix double free in netgroupcache
  (CVE-2021-27645, bsc#1182733, BZ #27462)</changelog>
  <changelog author="rguenther@suse.com" date="1615377600">- Add glibc-2.31-HTM-vzeroupper.diff to avoid VZEROUPPER in the
  AVX2 accelerated string routines which cause HTM transaction
  aborts.  Instead use EVEX or SSE.  (bsc#1181403)</changelog>
  <changelog author="rguenther@suse.com" date="1615377601">- Update glibc-2.31-HTM-vzeroupper.diff with a AVX-SSE transition
  fix.</changelog>
  <changelog author="schwab@suse.de" date="1617019200">- s390-memmove-ifunc-selector-arch13.patch: S390: Also check vector
  support in memmove ifunc-selector (bsc#1184035, BZ #27511)</changelog>
  <changelog author="schwab@suse.de" date="1625140800">- wordexp-param-overflow.patch: wordexp: handle overflow in positional
  parameter number (CVE-2021-35942, bsc#1187911, BZ #28011)</changelog>
  <changelog author="schwab@suse.de" date="1630584000">- mq-notify-use-after-free.patch: Use __pthread_attr_copy in mq_notify
  (CVE-2021-33574, bsc#1186489, BZ #27896)</changelog>
  <changelog author="schwab@suse.de" date="1636027200">- 0001-s390x-Align-child-stack-while-clone.-BZ-27968.patch,
  0002-S390-Optimize-__memcpy_z196.patch,
  0003-S390-Optimize-__memset_z196.patch,
  0004-S390-Sync-HWCAP-names-with-kernel-by-adding-aliases-.patch,
  0005-S390-Add-new-hwcap-values.patch,
  0006-S390-Add-PCI_MIO-and-SIE-HWCAPs.patch: [15sp4 FEAT] GNU2007 -
  GLIBC: Support for new IBM Z Hardware (bsc#1191592, jsc#IBM-869)</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1640174400">- Add support for livepatches (jsc#SLE-20049).
- Enable livepatching on x86_64.
- Generate ipa-clones tarball artifact when livepatching is enabled.</changelog>
  <changelog author="schwab@suse.de" date="1642420800">- clnt-create-unix-overflow.patch: Buffer overflow in sunrpc clnt_create
  for "unix" (CVE-2022-23219, bsc#1194768, BZ #22542)
- svcunix-create-overflow.patch: Buffer overflow in sunrpc svcunix_create
  (CVE-2022-23218, bsc#1194770, BZ #28768)</changelog>
  <changelog author="schwab@suse.de" date="1642593600">- 0001-powerpc-Optimized-strcpy-for-POWER9.patch,
  0002-powerpc-Optimized-stpcpy-for-POWER9.patch,
  0003-powerpc-Optimized-rawmemchr-for-POWER9.patch,
  0004-powerpc64le-add-optimized-strlen-for-P9.patch,
  0005-powerpc-fix-ifunc-implementation-list-for-POWER9-str.patch,
  0006-powerpc-Add-optimized-strncpy-for-POWER9.patch,
  0007-powerpc-Add-optimized-stpncpy-for-POWER9.patch,
  0008-powerpc-Add-optimized-ilogb-for-POWER9.patch,
  0009-powerpc-Add-optimized-llogb-for-POWER9.patch,
  0010-powerpc-Add-optimized-strlen-for-POWER10.patch,
  0011-powerpc64le-Optimized-memmove-for-POWER10.patch,
  0012-powerpc64le-Optimize-memcpy-for-POWER10.patch,
  0013-powerpc64le-Optimize-memset-for-POWER10.patch,
  0014-powerpc64le-Fix-ifunc-selection-for-memset-memmove-b.patch,
  0015-powerpc-Add-optimized-rawmemchr-for-POWER10.patch: ppc64le ifunc
  improvements (bsc#1194785, jsc#SLE-18195)</changelog>
  <changelog author="schwab@suse.de" date="1643025600">- getcwd-erange.patch: getcwd: Set errno to ERANGE for size == 1
  (CVE-2021-3999, bsc#1194640, BZ #28769)</changelog>
</package>
<package pkgid="c0937e125eedca213aa4832b2a6b9ebe1c866728de319d6bfa7d6c0babbbd4da" name="glibc-locale-base-32bit" arch="x86_64">
  <version epoch="0" ver="2.31" rel="150300.9.12.1"/>
  <changelog author="schwab@suse.de" date="1583841600">- dl-sort-maps.patch, dlopen-filter-object.patch: Allow dlopen of filter
  object to work (bsc#1166106, BZ #16272)</changelog>
  <changelog author="schwab@suse.de" date="1585137600">- glob-use-after-free.patch: Fix use-after-free in glob when expanding
  ~user (CVE-2020-1752, bsc#1167631, BZ #25414)</changelog>
  <changelog author="schwab@suse.de" date="1589371200">- nptl-setxid-race.patch: nptl: wait for pending setxid request also in
  detached thread (bsc#1162930, BZ #25942)</changelog>
  <changelog author="schwab@suse.de" date="1593518400">- nscd-senfile.patch: Fix concurrent changes on nscd aware files
  (bsc#1171878, BZ #23178)
- nscd-prune.patch: nscd: bump GC cycle during cache pruning (bsc#1171878,
  BZ #26130)
- syslog-locking.patch: Correct locking and cancellation cleanup in syslog
  functions (bsc#1172085, BZ #26100)</changelog>
  <changelog author="schwab@suse.de" date="1599048000">- Update to glibc 2.31
- glibc-2.14-crypt.diff, crypt_blowfish-const.patch,
  crypt_blowfish-1.2-sha.diff, crypt_blowfish-gensalt.patch,
  crypt_blowfish-1.2-hack_around_arm.diff, glibc-nodate.patch,
  powerpc-elision-enable-envvar.patch, s390-elision-enable-envvar.patch,
  crt-nocompress-debug-sections.patch, resolv-context-leak.patch,
  dl-runtime-resolve-opt-avx512f.patch, libpthread-compat-wrappers.patch,
  math-c++-compat.patch, remove-nss-nis-compat.patch,
  eh-frame-zero-terminator.patch, ld-so-hwcap-x86-64.patch,
  assert-pedantic.patch, getaddrinfo-errno.patch, resolv-conf-oom.patch,
  dynarray-allocation.patch, nearbyint-inexact.patch, nss-compat.patch,
  nscd-libnsl.patch, malloc-tcache-leak.patch,
  falkor-memcpy-memmove.patch, aarch64-cpu-features.patch,
  nss-files-large-buffers.patch, sysconf-uio-maxiov.patch,
  glob-tilde-overflow.patch, dl-runtime-resolve-xsave.patch,
  spawni-assert.patch, x86-64-dl-platform.patch, glob64-s390.patch,
  tst-tlsopt-powerpc.patch, powerpc-hwcap-bits.patch,
  malloc-tcache-check-overflow.patch, dl-init-paths-overflow.patch,
  fillin-rpath-empty-tokens.patch, getcwd-absolute.patch,
  memalign-overflow.patch, stack-guard-size-accounting.patch,
  libgcc-rtld-now.patch, res-send-enomem.patch,
  glibc-fix-avx512-mempcpy.patch, i386-memmove-sse2-unaligned.patch,
  realpath-ssize-max-overflow.patch, localtime-2039.patch,
  math-remove-slow-path.patch, aarch64-hwcap-atomics.patch,
  glibc-fix-aarch64-build.diff, absolute-symbols.patch,
  x86-haswell-string-flags.patch,
  pthread-cond-broadcast-waiters-after-spinning.patch,
  mman-map-sync.patch, mman-linux-map-shared-validate.patch,
  nptl-setxid-error.patch, pthread-mutex-trylock-barrier.patch,
  getaddrinfo-parse-ipv4-address.patch, japanese-era-name-may-2019.patch,
  force-elision-race.patch, regex-read-overrun.patch,
  regex-parse-reg-exp.patch,
  0001-S390-Add-configure-check-to-detect-z10-as-mininum-ar.patch,
  0002-S390-Use-hwcap-instead-of-dl_hwcap-in-ifunc-resolver.patch,
  0003-S390-Unify-31-64bit-memcpy.patch,
  0004-S390-Refactor-memcpy-mempcpy-ifunc-handling.patch,
  0005-S390-Remove-s390-specific-implementation-of-bcopy.patch,
  0006-S390-Use-memcpy-for-forward-cases-in-memmove.patch,
  0007-S390-Add-configure-check-to-detect-z13-as-mininum-ar.patch,
  0008-S390-Add-z13-memmove-ifunc-variant.patch,
  0009-S390-Add-z13-strstr-ifunc-variant.patch,
  0010-S390-Add-z13-memmem-ifunc-variant.patch,
  0011-S390-Cleanup-ifunc-resolve.h.patch,
  0012-S390-Mark-vx-and-vxe-as-important-hwcap.patch,
  0013-S390-Add-new-hwcap-values-for-new-cpu-architecture-a.patch,
  0014-S390-Add-configure-check-to-detect-support-for-arch1.patch,
  0015-S390-Add-arch13-memmove-ifunc-variant.patch,
  0016-S390-Add-arch13-strstr-ifunc-variant.patch,
  0017-S390-Add-arch13-memmem-ifunc-variant.patch,
  prefer-map-32bit-exec.patch, s390-strstr-page-boundary.patch,
  ppc-tle-htm-nosc.patch,
  posix-Add-internal-symbols-for-posix_spawn-interface.patch,
  glibc-2.29-posix-Use-posix_spawn-on-popen.patch,
  backtrace-powerpc.patch, pthread-rwlock-pwn.patch,
  manual-memory-protection.patch, ldbl-96-rem-pio2l.patch,
  dl-sort-maps.patch, dlopen-filter-object.patch,
  glob-use-after-free.patch, nptl-setxid-race.patch, nscd-senfile.patch,
  ldd-system-interp.patch, abort-no-flush.patch,
  fnmatch-collating-elements.patch, nss-files-long-lines-2.patch,
  iconv-reset-input-buffer.patch, nscd-prune.patch, syslog-locking.patch:
  Removed.
- long-double-alias.patch, glibc-nsswitch-usr.diff, euc-kr-overrun.patch,
  riscv-syscall-clobber.patch, nscd-gc-cycle.patch: Added.</changelog>
  <changelog author="schwab@suse.de" date="1604923200">- power10-support.patch: Add support for POWER10 (jsc#SLE-13520)
- iconv-option-parsing.patch: Rewrite iconv option parsing
  (CVE-2016-10228, bsc#1027496, BZ #19519)</changelog>
  <changelog author="schwab@suse.de" date="1608120000">- aarch64-getauxval.patch: aarch64: Accept PLT calls to __getauxval within
  libc.so (bsc#1167939)
- iconv-redundant-shift.patch: iconv: Accept redundant shift sequences in
  IBM1364 (CVE-2020-27618, bsc#1178386, BZ #26224)
- iconv-ucs4-loop-bounds.patch: iconv: Fix incorrect UCS4 inner loop
  bounds (CVE-2020-29562, bsc#1179694, BZ #26923)
- printf-long-double-non-normal.patch: x86: Harden printf against
  non-normal long double values (CVE-2020-29573, bsc#1179721, BZ #26649)
- get-nprocs-cpu-online-parsing.patch: Fix parsing of
  /sys/devices/system/cpu/online (bsc#1180038, BZ #25859)</changelog>
  <changelog author="schwab@suse.de" date="1609848000">- sysvipc-sem-stat-any.patch: sysvipc: Fix SEM_STAT_ANY kernel argument
  pass (bsc#1180557, BZ #26637)</changelog>
  <changelog author="schwab@suse.de" date="1611835200">- gconv-assertion-iso-2022-jp.patch: gconv: Fix assertion failure in
  ISO-2022-JP-3 module (CVE-2021-3326, bsc#1181505, BZ #27256)</changelog>
  <changelog author="schwab@suse.de" date="1614772800">- nscd-netgroupcache.patch: nscd: Fix double free in netgroupcache
  (CVE-2021-27645, bsc#1182733, BZ #27462)</changelog>
  <changelog author="rguenther@suse.com" date="1615377600">- Add glibc-2.31-HTM-vzeroupper.diff to avoid VZEROUPPER in the
  AVX2 accelerated string routines which cause HTM transaction
  aborts.  Instead use EVEX or SSE.  (bsc#1181403)</changelog>
  <changelog author="rguenther@suse.com" date="1615377601">- Update glibc-2.31-HTM-vzeroupper.diff with a AVX-SSE transition
  fix.</changelog>
  <changelog author="schwab@suse.de" date="1617019200">- s390-memmove-ifunc-selector-arch13.patch: S390: Also check vector
  support in memmove ifunc-selector (bsc#1184035, BZ #27511)</changelog>
  <changelog author="schwab@suse.de" date="1625140800">- wordexp-param-overflow.patch: wordexp: handle overflow in positional
  parameter number (CVE-2021-35942, bsc#1187911, BZ #28011)</changelog>
  <changelog author="schwab@suse.de" date="1630584000">- mq-notify-use-after-free.patch: Use __pthread_attr_copy in mq_notify
  (CVE-2021-33574, bsc#1186489, BZ #27896)</changelog>
  <changelog author="schwab@suse.de" date="1636027200">- 0001-s390x-Align-child-stack-while-clone.-BZ-27968.patch,
  0002-S390-Optimize-__memcpy_z196.patch,
  0003-S390-Optimize-__memset_z196.patch,
  0004-S390-Sync-HWCAP-names-with-kernel-by-adding-aliases-.patch,
  0005-S390-Add-new-hwcap-values.patch,
  0006-S390-Add-PCI_MIO-and-SIE-HWCAPs.patch: [15sp4 FEAT] GNU2007 -
  GLIBC: Support for new IBM Z Hardware (bsc#1191592, jsc#IBM-869)</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1640174400">- Add support for livepatches (jsc#SLE-20049).
- Enable livepatching on x86_64.
- Generate ipa-clones tarball artifact when livepatching is enabled.</changelog>
  <changelog author="schwab@suse.de" date="1642420800">- clnt-create-unix-overflow.patch: Buffer overflow in sunrpc clnt_create
  for "unix" (CVE-2022-23219, bsc#1194768, BZ #22542)
- svcunix-create-overflow.patch: Buffer overflow in sunrpc svcunix_create
  (CVE-2022-23218, bsc#1194770, BZ #28768)</changelog>
  <changelog author="schwab@suse.de" date="1642593600">- 0001-powerpc-Optimized-strcpy-for-POWER9.patch,
  0002-powerpc-Optimized-stpcpy-for-POWER9.patch,
  0003-powerpc-Optimized-rawmemchr-for-POWER9.patch,
  0004-powerpc64le-add-optimized-strlen-for-P9.patch,
  0005-powerpc-fix-ifunc-implementation-list-for-POWER9-str.patch,
  0006-powerpc-Add-optimized-strncpy-for-POWER9.patch,
  0007-powerpc-Add-optimized-stpncpy-for-POWER9.patch,
  0008-powerpc-Add-optimized-ilogb-for-POWER9.patch,
  0009-powerpc-Add-optimized-llogb-for-POWER9.patch,
  0010-powerpc-Add-optimized-strlen-for-POWER10.patch,
  0011-powerpc64le-Optimized-memmove-for-POWER10.patch,
  0012-powerpc64le-Optimize-memcpy-for-POWER10.patch,
  0013-powerpc64le-Optimize-memset-for-POWER10.patch,
  0014-powerpc64le-Fix-ifunc-selection-for-memset-memmove-b.patch,
  0015-powerpc-Add-optimized-rawmemchr-for-POWER10.patch: ppc64le ifunc
  improvements (bsc#1194785, jsc#SLE-18195)</changelog>
  <changelog author="schwab@suse.de" date="1643025600">- getcwd-erange.patch: getcwd: Set errno to ERANGE for size == 1
  (CVE-2021-3999, bsc#1194640, BZ #28769)</changelog>
</package>
<package pkgid="cb36747d23be9a9ecfed701e5eb6a1c454aa95a138afa0faad9efbc30fe557bc" name="glibc-profile" arch="aarch64">
  <version epoch="0" ver="2.31" rel="150300.9.12.1"/>
  <changelog author="schwab@suse.de" date="1583841600">- dl-sort-maps.patch, dlopen-filter-object.patch: Allow dlopen of filter
  object to work (bsc#1166106, BZ #16272)</changelog>
  <changelog author="schwab@suse.de" date="1585137600">- glob-use-after-free.patch: Fix use-after-free in glob when expanding
  ~user (CVE-2020-1752, bsc#1167631, BZ #25414)</changelog>
  <changelog author="schwab@suse.de" date="1589371200">- nptl-setxid-race.patch: nptl: wait for pending setxid request also in
  detached thread (bsc#1162930, BZ #25942)</changelog>
  <changelog author="schwab@suse.de" date="1593518400">- nscd-senfile.patch: Fix concurrent changes on nscd aware files
  (bsc#1171878, BZ #23178)
- nscd-prune.patch: nscd: bump GC cycle during cache pruning (bsc#1171878,
  BZ #26130)
- syslog-locking.patch: Correct locking and cancellation cleanup in syslog
  functions (bsc#1172085, BZ #26100)</changelog>
  <changelog author="schwab@suse.de" date="1599048000">- Update to glibc 2.31
- glibc-2.14-crypt.diff, crypt_blowfish-const.patch,
  crypt_blowfish-1.2-sha.diff, crypt_blowfish-gensalt.patch,
  crypt_blowfish-1.2-hack_around_arm.diff, glibc-nodate.patch,
  powerpc-elision-enable-envvar.patch, s390-elision-enable-envvar.patch,
  crt-nocompress-debug-sections.patch, resolv-context-leak.patch,
  dl-runtime-resolve-opt-avx512f.patch, libpthread-compat-wrappers.patch,
  math-c++-compat.patch, remove-nss-nis-compat.patch,
  eh-frame-zero-terminator.patch, ld-so-hwcap-x86-64.patch,
  assert-pedantic.patch, getaddrinfo-errno.patch, resolv-conf-oom.patch,
  dynarray-allocation.patch, nearbyint-inexact.patch, nss-compat.patch,
  nscd-libnsl.patch, malloc-tcache-leak.patch,
  falkor-memcpy-memmove.patch, aarch64-cpu-features.patch,
  nss-files-large-buffers.patch, sysconf-uio-maxiov.patch,
  glob-tilde-overflow.patch, dl-runtime-resolve-xsave.patch,
  spawni-assert.patch, x86-64-dl-platform.patch, glob64-s390.patch,
  tst-tlsopt-powerpc.patch, powerpc-hwcap-bits.patch,
  malloc-tcache-check-overflow.patch, dl-init-paths-overflow.patch,
  fillin-rpath-empty-tokens.patch, getcwd-absolute.patch,
  memalign-overflow.patch, stack-guard-size-accounting.patch,
  libgcc-rtld-now.patch, res-send-enomem.patch,
  glibc-fix-avx512-mempcpy.patch, i386-memmove-sse2-unaligned.patch,
  realpath-ssize-max-overflow.patch, localtime-2039.patch,
  math-remove-slow-path.patch, aarch64-hwcap-atomics.patch,
  glibc-fix-aarch64-build.diff, absolute-symbols.patch,
  x86-haswell-string-flags.patch,
  pthread-cond-broadcast-waiters-after-spinning.patch,
  mman-map-sync.patch, mman-linux-map-shared-validate.patch,
  nptl-setxid-error.patch, pthread-mutex-trylock-barrier.patch,
  getaddrinfo-parse-ipv4-address.patch, japanese-era-name-may-2019.patch,
  force-elision-race.patch, regex-read-overrun.patch,
  regex-parse-reg-exp.patch,
  0001-S390-Add-configure-check-to-detect-z10-as-mininum-ar.patch,
  0002-S390-Use-hwcap-instead-of-dl_hwcap-in-ifunc-resolver.patch,
  0003-S390-Unify-31-64bit-memcpy.patch,
  0004-S390-Refactor-memcpy-mempcpy-ifunc-handling.patch,
  0005-S390-Remove-s390-specific-implementation-of-bcopy.patch,
  0006-S390-Use-memcpy-for-forward-cases-in-memmove.patch,
  0007-S390-Add-configure-check-to-detect-z13-as-mininum-ar.patch,
  0008-S390-Add-z13-memmove-ifunc-variant.patch,
  0009-S390-Add-z13-strstr-ifunc-variant.patch,
  0010-S390-Add-z13-memmem-ifunc-variant.patch,
  0011-S390-Cleanup-ifunc-resolve.h.patch,
  0012-S390-Mark-vx-and-vxe-as-important-hwcap.patch,
  0013-S390-Add-new-hwcap-values-for-new-cpu-architecture-a.patch,
  0014-S390-Add-configure-check-to-detect-support-for-arch1.patch,
  0015-S390-Add-arch13-memmove-ifunc-variant.patch,
  0016-S390-Add-arch13-strstr-ifunc-variant.patch,
  0017-S390-Add-arch13-memmem-ifunc-variant.patch,
  prefer-map-32bit-exec.patch, s390-strstr-page-boundary.patch,
  ppc-tle-htm-nosc.patch,
  posix-Add-internal-symbols-for-posix_spawn-interface.patch,
  glibc-2.29-posix-Use-posix_spawn-on-popen.patch,
  backtrace-powerpc.patch, pthread-rwlock-pwn.patch,
  manual-memory-protection.patch, ldbl-96-rem-pio2l.patch,
  dl-sort-maps.patch, dlopen-filter-object.patch,
  glob-use-after-free.patch, nptl-setxid-race.patch, nscd-senfile.patch,
  ldd-system-interp.patch, abort-no-flush.patch,
  fnmatch-collating-elements.patch, nss-files-long-lines-2.patch,
  iconv-reset-input-buffer.patch, nscd-prune.patch, syslog-locking.patch:
  Removed.
- long-double-alias.patch, glibc-nsswitch-usr.diff, euc-kr-overrun.patch,
  riscv-syscall-clobber.patch, nscd-gc-cycle.patch: Added.</changelog>
  <changelog author="schwab@suse.de" date="1604923200">- power10-support.patch: Add support for POWER10 (jsc#SLE-13520)
- iconv-option-parsing.patch: Rewrite iconv option parsing
  (CVE-2016-10228, bsc#1027496, BZ #19519)</changelog>
  <changelog author="schwab@suse.de" date="1608120000">- aarch64-getauxval.patch: aarch64: Accept PLT calls to __getauxval within
  libc.so (bsc#1167939)
- iconv-redundant-shift.patch: iconv: Accept redundant shift sequences in
  IBM1364 (CVE-2020-27618, bsc#1178386, BZ #26224)
- iconv-ucs4-loop-bounds.patch: iconv: Fix incorrect UCS4 inner loop
  bounds (CVE-2020-29562, bsc#1179694, BZ #26923)
- printf-long-double-non-normal.patch: x86: Harden printf against
  non-normal long double values (CVE-2020-29573, bsc#1179721, BZ #26649)
- get-nprocs-cpu-online-parsing.patch: Fix parsing of
  /sys/devices/system/cpu/online (bsc#1180038, BZ #25859)</changelog>
  <changelog author="schwab@suse.de" date="1609848000">- sysvipc-sem-stat-any.patch: sysvipc: Fix SEM_STAT_ANY kernel argument
  pass (bsc#1180557, BZ #26637)</changelog>
  <changelog author="schwab@suse.de" date="1611835200">- gconv-assertion-iso-2022-jp.patch: gconv: Fix assertion failure in
  ISO-2022-JP-3 module (CVE-2021-3326, bsc#1181505, BZ #27256)</changelog>
  <changelog author="schwab@suse.de" date="1614772800">- nscd-netgroupcache.patch: nscd: Fix double free in netgroupcache
  (CVE-2021-27645, bsc#1182733, BZ #27462)</changelog>
  <changelog author="rguenther@suse.com" date="1615377600">- Add glibc-2.31-HTM-vzeroupper.diff to avoid VZEROUPPER in the
  AVX2 accelerated string routines which cause HTM transaction
  aborts.  Instead use EVEX or SSE.  (bsc#1181403)</changelog>
  <changelog author="rguenther@suse.com" date="1615377601">- Update glibc-2.31-HTM-vzeroupper.diff with a AVX-SSE transition
  fix.</changelog>
  <changelog author="schwab@suse.de" date="1617019200">- s390-memmove-ifunc-selector-arch13.patch: S390: Also check vector
  support in memmove ifunc-selector (bsc#1184035, BZ #27511)</changelog>
  <changelog author="schwab@suse.de" date="1625140800">- wordexp-param-overflow.patch: wordexp: handle overflow in positional
  parameter number (CVE-2021-35942, bsc#1187911, BZ #28011)</changelog>
  <changelog author="schwab@suse.de" date="1630584000">- mq-notify-use-after-free.patch: Use __pthread_attr_copy in mq_notify
  (CVE-2021-33574, bsc#1186489, BZ #27896)</changelog>
  <changelog author="schwab@suse.de" date="1636027200">- 0001-s390x-Align-child-stack-while-clone.-BZ-27968.patch,
  0002-S390-Optimize-__memcpy_z196.patch,
  0003-S390-Optimize-__memset_z196.patch,
  0004-S390-Sync-HWCAP-names-with-kernel-by-adding-aliases-.patch,
  0005-S390-Add-new-hwcap-values.patch,
  0006-S390-Add-PCI_MIO-and-SIE-HWCAPs.patch: [15sp4 FEAT] GNU2007 -
  GLIBC: Support for new IBM Z Hardware (bsc#1191592, jsc#IBM-869)</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1640174400">- Add support for livepatches (jsc#SLE-20049).
- Enable livepatching on x86_64.
- Generate ipa-clones tarball artifact when livepatching is enabled.</changelog>
  <changelog author="schwab@suse.de" date="1642420800">- clnt-create-unix-overflow.patch: Buffer overflow in sunrpc clnt_create
  for "unix" (CVE-2022-23219, bsc#1194768, BZ #22542)
- svcunix-create-overflow.patch: Buffer overflow in sunrpc svcunix_create
  (CVE-2022-23218, bsc#1194770, BZ #28768)</changelog>
  <changelog author="schwab@suse.de" date="1642593600">- 0001-powerpc-Optimized-strcpy-for-POWER9.patch,
  0002-powerpc-Optimized-stpcpy-for-POWER9.patch,
  0003-powerpc-Optimized-rawmemchr-for-POWER9.patch,
  0004-powerpc64le-add-optimized-strlen-for-P9.patch,
  0005-powerpc-fix-ifunc-implementation-list-for-POWER9-str.patch,
  0006-powerpc-Add-optimized-strncpy-for-POWER9.patch,
  0007-powerpc-Add-optimized-stpncpy-for-POWER9.patch,
  0008-powerpc-Add-optimized-ilogb-for-POWER9.patch,
  0009-powerpc-Add-optimized-llogb-for-POWER9.patch,
  0010-powerpc-Add-optimized-strlen-for-POWER10.patch,
  0011-powerpc64le-Optimized-memmove-for-POWER10.patch,
  0012-powerpc64le-Optimize-memcpy-for-POWER10.patch,
  0013-powerpc64le-Optimize-memset-for-POWER10.patch,
  0014-powerpc64le-Fix-ifunc-selection-for-memset-memmove-b.patch,
  0015-powerpc-Add-optimized-rawmemchr-for-POWER10.patch: ppc64le ifunc
  improvements (bsc#1194785, jsc#SLE-18195)</changelog>
  <changelog author="schwab@suse.de" date="1643025600">- getcwd-erange.patch: getcwd: Set errno to ERANGE for size == 1
  (CVE-2021-3999, bsc#1194640, BZ #28769)</changelog>
</package>
<package pkgid="c56e958ce198b7bd58b975861c3e295eaa1d4f94021a870959fcbd589696056a" name="glibc-profile" arch="ppc64le">
  <version epoch="0" ver="2.31" rel="150300.9.12.1"/>
  <changelog author="schwab@suse.de" date="1583841600">- dl-sort-maps.patch, dlopen-filter-object.patch: Allow dlopen of filter
  object to work (bsc#1166106, BZ #16272)</changelog>
  <changelog author="schwab@suse.de" date="1585137600">- glob-use-after-free.patch: Fix use-after-free in glob when expanding
  ~user (CVE-2020-1752, bsc#1167631, BZ #25414)</changelog>
  <changelog author="schwab@suse.de" date="1589371200">- nptl-setxid-race.patch: nptl: wait for pending setxid request also in
  detached thread (bsc#1162930, BZ #25942)</changelog>
  <changelog author="schwab@suse.de" date="1593518400">- nscd-senfile.patch: Fix concurrent changes on nscd aware files
  (bsc#1171878, BZ #23178)
- nscd-prune.patch: nscd: bump GC cycle during cache pruning (bsc#1171878,
  BZ #26130)
- syslog-locking.patch: Correct locking and cancellation cleanup in syslog
  functions (bsc#1172085, BZ #26100)</changelog>
  <changelog author="schwab@suse.de" date="1599048000">- Update to glibc 2.31
- glibc-2.14-crypt.diff, crypt_blowfish-const.patch,
  crypt_blowfish-1.2-sha.diff, crypt_blowfish-gensalt.patch,
  crypt_blowfish-1.2-hack_around_arm.diff, glibc-nodate.patch,
  powerpc-elision-enable-envvar.patch, s390-elision-enable-envvar.patch,
  crt-nocompress-debug-sections.patch, resolv-context-leak.patch,
  dl-runtime-resolve-opt-avx512f.patch, libpthread-compat-wrappers.patch,
  math-c++-compat.patch, remove-nss-nis-compat.patch,
  eh-frame-zero-terminator.patch, ld-so-hwcap-x86-64.patch,
  assert-pedantic.patch, getaddrinfo-errno.patch, resolv-conf-oom.patch,
  dynarray-allocation.patch, nearbyint-inexact.patch, nss-compat.patch,
  nscd-libnsl.patch, malloc-tcache-leak.patch,
  falkor-memcpy-memmove.patch, aarch64-cpu-features.patch,
  nss-files-large-buffers.patch, sysconf-uio-maxiov.patch,
  glob-tilde-overflow.patch, dl-runtime-resolve-xsave.patch,
  spawni-assert.patch, x86-64-dl-platform.patch, glob64-s390.patch,
  tst-tlsopt-powerpc.patch, powerpc-hwcap-bits.patch,
  malloc-tcache-check-overflow.patch, dl-init-paths-overflow.patch,
  fillin-rpath-empty-tokens.patch, getcwd-absolute.patch,
  memalign-overflow.patch, stack-guard-size-accounting.patch,
  libgcc-rtld-now.patch, res-send-enomem.patch,
  glibc-fix-avx512-mempcpy.patch, i386-memmove-sse2-unaligned.patch,
  realpath-ssize-max-overflow.patch, localtime-2039.patch,
  math-remove-slow-path.patch, aarch64-hwcap-atomics.patch,
  glibc-fix-aarch64-build.diff, absolute-symbols.patch,
  x86-haswell-string-flags.patch,
  pthread-cond-broadcast-waiters-after-spinning.patch,
  mman-map-sync.patch, mman-linux-map-shared-validate.patch,
  nptl-setxid-error.patch, pthread-mutex-trylock-barrier.patch,
  getaddrinfo-parse-ipv4-address.patch, japanese-era-name-may-2019.patch,
  force-elision-race.patch, regex-read-overrun.patch,
  regex-parse-reg-exp.patch,
  0001-S390-Add-configure-check-to-detect-z10-as-mininum-ar.patch,
  0002-S390-Use-hwcap-instead-of-dl_hwcap-in-ifunc-resolver.patch,
  0003-S390-Unify-31-64bit-memcpy.patch,
  0004-S390-Refactor-memcpy-mempcpy-ifunc-handling.patch,
  0005-S390-Remove-s390-specific-implementation-of-bcopy.patch,
  0006-S390-Use-memcpy-for-forward-cases-in-memmove.patch,
  0007-S390-Add-configure-check-to-detect-z13-as-mininum-ar.patch,
  0008-S390-Add-z13-memmove-ifunc-variant.patch,
  0009-S390-Add-z13-strstr-ifunc-variant.patch,
  0010-S390-Add-z13-memmem-ifunc-variant.patch,
  0011-S390-Cleanup-ifunc-resolve.h.patch,
  0012-S390-Mark-vx-and-vxe-as-important-hwcap.patch,
  0013-S390-Add-new-hwcap-values-for-new-cpu-architecture-a.patch,
  0014-S390-Add-configure-check-to-detect-support-for-arch1.patch,
  0015-S390-Add-arch13-memmove-ifunc-variant.patch,
  0016-S390-Add-arch13-strstr-ifunc-variant.patch,
  0017-S390-Add-arch13-memmem-ifunc-variant.patch,
  prefer-map-32bit-exec.patch, s390-strstr-page-boundary.patch,
  ppc-tle-htm-nosc.patch,
  posix-Add-internal-symbols-for-posix_spawn-interface.patch,
  glibc-2.29-posix-Use-posix_spawn-on-popen.patch,
  backtrace-powerpc.patch, pthread-rwlock-pwn.patch,
  manual-memory-protection.patch, ldbl-96-rem-pio2l.patch,
  dl-sort-maps.patch, dlopen-filter-object.patch,
  glob-use-after-free.patch, nptl-setxid-race.patch, nscd-senfile.patch,
  ldd-system-interp.patch, abort-no-flush.patch,
  fnmatch-collating-elements.patch, nss-files-long-lines-2.patch,
  iconv-reset-input-buffer.patch, nscd-prune.patch, syslog-locking.patch:
  Removed.
- long-double-alias.patch, glibc-nsswitch-usr.diff, euc-kr-overrun.patch,
  riscv-syscall-clobber.patch, nscd-gc-cycle.patch: Added.</changelog>
  <changelog author="schwab@suse.de" date="1604923200">- power10-support.patch: Add support for POWER10 (jsc#SLE-13520)
- iconv-option-parsing.patch: Rewrite iconv option parsing
  (CVE-2016-10228, bsc#1027496, BZ #19519)</changelog>
  <changelog author="schwab@suse.de" date="1608120000">- aarch64-getauxval.patch: aarch64: Accept PLT calls to __getauxval within
  libc.so (bsc#1167939)
- iconv-redundant-shift.patch: iconv: Accept redundant shift sequences in
  IBM1364 (CVE-2020-27618, bsc#1178386, BZ #26224)
- iconv-ucs4-loop-bounds.patch: iconv: Fix incorrect UCS4 inner loop
  bounds (CVE-2020-29562, bsc#1179694, BZ #26923)
- printf-long-double-non-normal.patch: x86: Harden printf against
  non-normal long double values (CVE-2020-29573, bsc#1179721, BZ #26649)
- get-nprocs-cpu-online-parsing.patch: Fix parsing of
  /sys/devices/system/cpu/online (bsc#1180038, BZ #25859)</changelog>
  <changelog author="schwab@suse.de" date="1609848000">- sysvipc-sem-stat-any.patch: sysvipc: Fix SEM_STAT_ANY kernel argument
  pass (bsc#1180557, BZ #26637)</changelog>
  <changelog author="schwab@suse.de" date="1611835200">- gconv-assertion-iso-2022-jp.patch: gconv: Fix assertion failure in
  ISO-2022-JP-3 module (CVE-2021-3326, bsc#1181505, BZ #27256)</changelog>
  <changelog author="schwab@suse.de" date="1614772800">- nscd-netgroupcache.patch: nscd: Fix double free in netgroupcache
  (CVE-2021-27645, bsc#1182733, BZ #27462)</changelog>
  <changelog author="rguenther@suse.com" date="1615377600">- Add glibc-2.31-HTM-vzeroupper.diff to avoid VZEROUPPER in the
  AVX2 accelerated string routines which cause HTM transaction
  aborts.  Instead use EVEX or SSE.  (bsc#1181403)</changelog>
  <changelog author="rguenther@suse.com" date="1615377601">- Update glibc-2.31-HTM-vzeroupper.diff with a AVX-SSE transition
  fix.</changelog>
  <changelog author="schwab@suse.de" date="1617019200">- s390-memmove-ifunc-selector-arch13.patch: S390: Also check vector
  support in memmove ifunc-selector (bsc#1184035, BZ #27511)</changelog>
  <changelog author="schwab@suse.de" date="1625140800">- wordexp-param-overflow.patch: wordexp: handle overflow in positional
  parameter number (CVE-2021-35942, bsc#1187911, BZ #28011)</changelog>
  <changelog author="schwab@suse.de" date="1630584000">- mq-notify-use-after-free.patch: Use __pthread_attr_copy in mq_notify
  (CVE-2021-33574, bsc#1186489, BZ #27896)</changelog>
  <changelog author="schwab@suse.de" date="1636027200">- 0001-s390x-Align-child-stack-while-clone.-BZ-27968.patch,
  0002-S390-Optimize-__memcpy_z196.patch,
  0003-S390-Optimize-__memset_z196.patch,
  0004-S390-Sync-HWCAP-names-with-kernel-by-adding-aliases-.patch,
  0005-S390-Add-new-hwcap-values.patch,
  0006-S390-Add-PCI_MIO-and-SIE-HWCAPs.patch: [15sp4 FEAT] GNU2007 -
  GLIBC: Support for new IBM Z Hardware (bsc#1191592, jsc#IBM-869)</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1640174400">- Add support for livepatches (jsc#SLE-20049).
- Enable livepatching on x86_64.
- Generate ipa-clones tarball artifact when livepatching is enabled.</changelog>
  <changelog author="schwab@suse.de" date="1642420800">- clnt-create-unix-overflow.patch: Buffer overflow in sunrpc clnt_create
  for "unix" (CVE-2022-23219, bsc#1194768, BZ #22542)
- svcunix-create-overflow.patch: Buffer overflow in sunrpc svcunix_create
  (CVE-2022-23218, bsc#1194770, BZ #28768)</changelog>
  <changelog author="schwab@suse.de" date="1642593600">- 0001-powerpc-Optimized-strcpy-for-POWER9.patch,
  0002-powerpc-Optimized-stpcpy-for-POWER9.patch,
  0003-powerpc-Optimized-rawmemchr-for-POWER9.patch,
  0004-powerpc64le-add-optimized-strlen-for-P9.patch,
  0005-powerpc-fix-ifunc-implementation-list-for-POWER9-str.patch,
  0006-powerpc-Add-optimized-strncpy-for-POWER9.patch,
  0007-powerpc-Add-optimized-stpncpy-for-POWER9.patch,
  0008-powerpc-Add-optimized-ilogb-for-POWER9.patch,
  0009-powerpc-Add-optimized-llogb-for-POWER9.patch,
  0010-powerpc-Add-optimized-strlen-for-POWER10.patch,
  0011-powerpc64le-Optimized-memmove-for-POWER10.patch,
  0012-powerpc64le-Optimize-memcpy-for-POWER10.patch,
  0013-powerpc64le-Optimize-memset-for-POWER10.patch,
  0014-powerpc64le-Fix-ifunc-selection-for-memset-memmove-b.patch,
  0015-powerpc-Add-optimized-rawmemchr-for-POWER10.patch: ppc64le ifunc
  improvements (bsc#1194785, jsc#SLE-18195)</changelog>
  <changelog author="schwab@suse.de" date="1643025600">- getcwd-erange.patch: getcwd: Set errno to ERANGE for size == 1
  (CVE-2021-3999, bsc#1194640, BZ #28769)</changelog>
</package>
<package pkgid="6583c386eeafceb9ef2853bc24d2d7a7df18509f2b9e2a6a7754b6d1bd093741" name="glibc-profile" arch="s390x">
  <version epoch="0" ver="2.31" rel="150300.9.12.1"/>
  <changelog author="schwab@suse.de" date="1583841600">- dl-sort-maps.patch, dlopen-filter-object.patch: Allow dlopen of filter
  object to work (bsc#1166106, BZ #16272)</changelog>
  <changelog author="schwab@suse.de" date="1585137600">- glob-use-after-free.patch: Fix use-after-free in glob when expanding
  ~user (CVE-2020-1752, bsc#1167631, BZ #25414)</changelog>
  <changelog author="schwab@suse.de" date="1589371200">- nptl-setxid-race.patch: nptl: wait for pending setxid request also in
  detached thread (bsc#1162930, BZ #25942)</changelog>
  <changelog author="schwab@suse.de" date="1593518400">- nscd-senfile.patch: Fix concurrent changes on nscd aware files
  (bsc#1171878, BZ #23178)
- nscd-prune.patch: nscd: bump GC cycle during cache pruning (bsc#1171878,
  BZ #26130)
- syslog-locking.patch: Correct locking and cancellation cleanup in syslog
  functions (bsc#1172085, BZ #26100)</changelog>
  <changelog author="schwab@suse.de" date="1599048000">- Update to glibc 2.31
- glibc-2.14-crypt.diff, crypt_blowfish-const.patch,
  crypt_blowfish-1.2-sha.diff, crypt_blowfish-gensalt.patch,
  crypt_blowfish-1.2-hack_around_arm.diff, glibc-nodate.patch,
  powerpc-elision-enable-envvar.patch, s390-elision-enable-envvar.patch,
  crt-nocompress-debug-sections.patch, resolv-context-leak.patch,
  dl-runtime-resolve-opt-avx512f.patch, libpthread-compat-wrappers.patch,
  math-c++-compat.patch, remove-nss-nis-compat.patch,
  eh-frame-zero-terminator.patch, ld-so-hwcap-x86-64.patch,
  assert-pedantic.patch, getaddrinfo-errno.patch, resolv-conf-oom.patch,
  dynarray-allocation.patch, nearbyint-inexact.patch, nss-compat.patch,
  nscd-libnsl.patch, malloc-tcache-leak.patch,
  falkor-memcpy-memmove.patch, aarch64-cpu-features.patch,
  nss-files-large-buffers.patch, sysconf-uio-maxiov.patch,
  glob-tilde-overflow.patch, dl-runtime-resolve-xsave.patch,
  spawni-assert.patch, x86-64-dl-platform.patch, glob64-s390.patch,
  tst-tlsopt-powerpc.patch, powerpc-hwcap-bits.patch,
  malloc-tcache-check-overflow.patch, dl-init-paths-overflow.patch,
  fillin-rpath-empty-tokens.patch, getcwd-absolute.patch,
  memalign-overflow.patch, stack-guard-size-accounting.patch,
  libgcc-rtld-now.patch, res-send-enomem.patch,
  glibc-fix-avx512-mempcpy.patch, i386-memmove-sse2-unaligned.patch,
  realpath-ssize-max-overflow.patch, localtime-2039.patch,
  math-remove-slow-path.patch, aarch64-hwcap-atomics.patch,
  glibc-fix-aarch64-build.diff, absolute-symbols.patch,
  x86-haswell-string-flags.patch,
  pthread-cond-broadcast-waiters-after-spinning.patch,
  mman-map-sync.patch, mman-linux-map-shared-validate.patch,
  nptl-setxid-error.patch, pthread-mutex-trylock-barrier.patch,
  getaddrinfo-parse-ipv4-address.patch, japanese-era-name-may-2019.patch,
  force-elision-race.patch, regex-read-overrun.patch,
  regex-parse-reg-exp.patch,
  0001-S390-Add-configure-check-to-detect-z10-as-mininum-ar.patch,
  0002-S390-Use-hwcap-instead-of-dl_hwcap-in-ifunc-resolver.patch,
  0003-S390-Unify-31-64bit-memcpy.patch,
  0004-S390-Refactor-memcpy-mempcpy-ifunc-handling.patch,
  0005-S390-Remove-s390-specific-implementation-of-bcopy.patch,
  0006-S390-Use-memcpy-for-forward-cases-in-memmove.patch,
  0007-S390-Add-configure-check-to-detect-z13-as-mininum-ar.patch,
  0008-S390-Add-z13-memmove-ifunc-variant.patch,
  0009-S390-Add-z13-strstr-ifunc-variant.patch,
  0010-S390-Add-z13-memmem-ifunc-variant.patch,
  0011-S390-Cleanup-ifunc-resolve.h.patch,
  0012-S390-Mark-vx-and-vxe-as-important-hwcap.patch,
  0013-S390-Add-new-hwcap-values-for-new-cpu-architecture-a.patch,
  0014-S390-Add-configure-check-to-detect-support-for-arch1.patch,
  0015-S390-Add-arch13-memmove-ifunc-variant.patch,
  0016-S390-Add-arch13-strstr-ifunc-variant.patch,
  0017-S390-Add-arch13-memmem-ifunc-variant.patch,
  prefer-map-32bit-exec.patch, s390-strstr-page-boundary.patch,
  ppc-tle-htm-nosc.patch,
  posix-Add-internal-symbols-for-posix_spawn-interface.patch,
  glibc-2.29-posix-Use-posix_spawn-on-popen.patch,
  backtrace-powerpc.patch, pthread-rwlock-pwn.patch,
  manual-memory-protection.patch, ldbl-96-rem-pio2l.patch,
  dl-sort-maps.patch, dlopen-filter-object.patch,
  glob-use-after-free.patch, nptl-setxid-race.patch, nscd-senfile.patch,
  ldd-system-interp.patch, abort-no-flush.patch,
  fnmatch-collating-elements.patch, nss-files-long-lines-2.patch,
  iconv-reset-input-buffer.patch, nscd-prune.patch, syslog-locking.patch:
  Removed.
- long-double-alias.patch, glibc-nsswitch-usr.diff, euc-kr-overrun.patch,
  riscv-syscall-clobber.patch, nscd-gc-cycle.patch: Added.</changelog>
  <changelog author="schwab@suse.de" date="1604923200">- power10-support.patch: Add support for POWER10 (jsc#SLE-13520)
- iconv-option-parsing.patch: Rewrite iconv option parsing
  (CVE-2016-10228, bsc#1027496, BZ #19519)</changelog>
  <changelog author="schwab@suse.de" date="1608120000">- aarch64-getauxval.patch: aarch64: Accept PLT calls to __getauxval within
  libc.so (bsc#1167939)
- iconv-redundant-shift.patch: iconv: Accept redundant shift sequences in
  IBM1364 (CVE-2020-27618, bsc#1178386, BZ #26224)
- iconv-ucs4-loop-bounds.patch: iconv: Fix incorrect UCS4 inner loop
  bounds (CVE-2020-29562, bsc#1179694, BZ #26923)
- printf-long-double-non-normal.patch: x86: Harden printf against
  non-normal long double values (CVE-2020-29573, bsc#1179721, BZ #26649)
- get-nprocs-cpu-online-parsing.patch: Fix parsing of
  /sys/devices/system/cpu/online (bsc#1180038, BZ #25859)</changelog>
  <changelog author="schwab@suse.de" date="1609848000">- sysvipc-sem-stat-any.patch: sysvipc: Fix SEM_STAT_ANY kernel argument
  pass (bsc#1180557, BZ #26637)</changelog>
  <changelog author="schwab@suse.de" date="1611835200">- gconv-assertion-iso-2022-jp.patch: gconv: Fix assertion failure in
  ISO-2022-JP-3 module (CVE-2021-3326, bsc#1181505, BZ #27256)</changelog>
  <changelog author="schwab@suse.de" date="1614772800">- nscd-netgroupcache.patch: nscd: Fix double free in netgroupcache
  (CVE-2021-27645, bsc#1182733, BZ #27462)</changelog>
  <changelog author="rguenther@suse.com" date="1615377600">- Add glibc-2.31-HTM-vzeroupper.diff to avoid VZEROUPPER in the
  AVX2 accelerated string routines which cause HTM transaction
  aborts.  Instead use EVEX or SSE.  (bsc#1181403)</changelog>
  <changelog author="rguenther@suse.com" date="1615377601">- Update glibc-2.31-HTM-vzeroupper.diff with a AVX-SSE transition
  fix.</changelog>
  <changelog author="schwab@suse.de" date="1617019200">- s390-memmove-ifunc-selector-arch13.patch: S390: Also check vector
  support in memmove ifunc-selector (bsc#1184035, BZ #27511)</changelog>
  <changelog author="schwab@suse.de" date="1625140800">- wordexp-param-overflow.patch: wordexp: handle overflow in positional
  parameter number (CVE-2021-35942, bsc#1187911, BZ #28011)</changelog>
  <changelog author="schwab@suse.de" date="1630584000">- mq-notify-use-after-free.patch: Use __pthread_attr_copy in mq_notify
  (CVE-2021-33574, bsc#1186489, BZ #27896)</changelog>
  <changelog author="schwab@suse.de" date="1636027200">- 0001-s390x-Align-child-stack-while-clone.-BZ-27968.patch,
  0002-S390-Optimize-__memcpy_z196.patch,
  0003-S390-Optimize-__memset_z196.patch,
  0004-S390-Sync-HWCAP-names-with-kernel-by-adding-aliases-.patch,
  0005-S390-Add-new-hwcap-values.patch,
  0006-S390-Add-PCI_MIO-and-SIE-HWCAPs.patch: [15sp4 FEAT] GNU2007 -
  GLIBC: Support for new IBM Z Hardware (bsc#1191592, jsc#IBM-869)</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1640174400">- Add support for livepatches (jsc#SLE-20049).
- Enable livepatching on x86_64.
- Generate ipa-clones tarball artifact when livepatching is enabled.</changelog>
  <changelog author="schwab@suse.de" date="1642420800">- clnt-create-unix-overflow.patch: Buffer overflow in sunrpc clnt_create
  for "unix" (CVE-2022-23219, bsc#1194768, BZ #22542)
- svcunix-create-overflow.patch: Buffer overflow in sunrpc svcunix_create
  (CVE-2022-23218, bsc#1194770, BZ #28768)</changelog>
  <changelog author="schwab@suse.de" date="1642593600">- 0001-powerpc-Optimized-strcpy-for-POWER9.patch,
  0002-powerpc-Optimized-stpcpy-for-POWER9.patch,
  0003-powerpc-Optimized-rawmemchr-for-POWER9.patch,
  0004-powerpc64le-add-optimized-strlen-for-P9.patch,
  0005-powerpc-fix-ifunc-implementation-list-for-POWER9-str.patch,
  0006-powerpc-Add-optimized-strncpy-for-POWER9.patch,
  0007-powerpc-Add-optimized-stpncpy-for-POWER9.patch,
  0008-powerpc-Add-optimized-ilogb-for-POWER9.patch,
  0009-powerpc-Add-optimized-llogb-for-POWER9.patch,
  0010-powerpc-Add-optimized-strlen-for-POWER10.patch,
  0011-powerpc64le-Optimized-memmove-for-POWER10.patch,
  0012-powerpc64le-Optimize-memcpy-for-POWER10.patch,
  0013-powerpc64le-Optimize-memset-for-POWER10.patch,
  0014-powerpc64le-Fix-ifunc-selection-for-memset-memmove-b.patch,
  0015-powerpc-Add-optimized-rawmemchr-for-POWER10.patch: ppc64le ifunc
  improvements (bsc#1194785, jsc#SLE-18195)</changelog>
  <changelog author="schwab@suse.de" date="1643025600">- getcwd-erange.patch: getcwd: Set errno to ERANGE for size == 1
  (CVE-2021-3999, bsc#1194640, BZ #28769)</changelog>
</package>
<package pkgid="aced65c3a19a0f7c627d17e3a7fcaea5f67b58fc0e08d175a0863012391c74c2" name="glibc-profile" arch="x86_64">
  <version epoch="0" ver="2.31" rel="150300.9.12.1"/>
  <changelog author="schwab@suse.de" date="1583841600">- dl-sort-maps.patch, dlopen-filter-object.patch: Allow dlopen of filter
  object to work (bsc#1166106, BZ #16272)</changelog>
  <changelog author="schwab@suse.de" date="1585137600">- glob-use-after-free.patch: Fix use-after-free in glob when expanding
  ~user (CVE-2020-1752, bsc#1167631, BZ #25414)</changelog>
  <changelog author="schwab@suse.de" date="1589371200">- nptl-setxid-race.patch: nptl: wait for pending setxid request also in
  detached thread (bsc#1162930, BZ #25942)</changelog>
  <changelog author="schwab@suse.de" date="1593518400">- nscd-senfile.patch: Fix concurrent changes on nscd aware files
  (bsc#1171878, BZ #23178)
- nscd-prune.patch: nscd: bump GC cycle during cache pruning (bsc#1171878,
  BZ #26130)
- syslog-locking.patch: Correct locking and cancellation cleanup in syslog
  functions (bsc#1172085, BZ #26100)</changelog>
  <changelog author="schwab@suse.de" date="1599048000">- Update to glibc 2.31
- glibc-2.14-crypt.diff, crypt_blowfish-const.patch,
  crypt_blowfish-1.2-sha.diff, crypt_blowfish-gensalt.patch,
  crypt_blowfish-1.2-hack_around_arm.diff, glibc-nodate.patch,
  powerpc-elision-enable-envvar.patch, s390-elision-enable-envvar.patch,
  crt-nocompress-debug-sections.patch, resolv-context-leak.patch,
  dl-runtime-resolve-opt-avx512f.patch, libpthread-compat-wrappers.patch,
  math-c++-compat.patch, remove-nss-nis-compat.patch,
  eh-frame-zero-terminator.patch, ld-so-hwcap-x86-64.patch,
  assert-pedantic.patch, getaddrinfo-errno.patch, resolv-conf-oom.patch,
  dynarray-allocation.patch, nearbyint-inexact.patch, nss-compat.patch,
  nscd-libnsl.patch, malloc-tcache-leak.patch,
  falkor-memcpy-memmove.patch, aarch64-cpu-features.patch,
  nss-files-large-buffers.patch, sysconf-uio-maxiov.patch,
  glob-tilde-overflow.patch, dl-runtime-resolve-xsave.patch,
  spawni-assert.patch, x86-64-dl-platform.patch, glob64-s390.patch,
  tst-tlsopt-powerpc.patch, powerpc-hwcap-bits.patch,
  malloc-tcache-check-overflow.patch, dl-init-paths-overflow.patch,
  fillin-rpath-empty-tokens.patch, getcwd-absolute.patch,
  memalign-overflow.patch, stack-guard-size-accounting.patch,
  libgcc-rtld-now.patch, res-send-enomem.patch,
  glibc-fix-avx512-mempcpy.patch, i386-memmove-sse2-unaligned.patch,
  realpath-ssize-max-overflow.patch, localtime-2039.patch,
  math-remove-slow-path.patch, aarch64-hwcap-atomics.patch,
  glibc-fix-aarch64-build.diff, absolute-symbols.patch,
  x86-haswell-string-flags.patch,
  pthread-cond-broadcast-waiters-after-spinning.patch,
  mman-map-sync.patch, mman-linux-map-shared-validate.patch,
  nptl-setxid-error.patch, pthread-mutex-trylock-barrier.patch,
  getaddrinfo-parse-ipv4-address.patch, japanese-era-name-may-2019.patch,
  force-elision-race.patch, regex-read-overrun.patch,
  regex-parse-reg-exp.patch,
  0001-S390-Add-configure-check-to-detect-z10-as-mininum-ar.patch,
  0002-S390-Use-hwcap-instead-of-dl_hwcap-in-ifunc-resolver.patch,
  0003-S390-Unify-31-64bit-memcpy.patch,
  0004-S390-Refactor-memcpy-mempcpy-ifunc-handling.patch,
  0005-S390-Remove-s390-specific-implementation-of-bcopy.patch,
  0006-S390-Use-memcpy-for-forward-cases-in-memmove.patch,
  0007-S390-Add-configure-check-to-detect-z13-as-mininum-ar.patch,
  0008-S390-Add-z13-memmove-ifunc-variant.patch,
  0009-S390-Add-z13-strstr-ifunc-variant.patch,
  0010-S390-Add-z13-memmem-ifunc-variant.patch,
  0011-S390-Cleanup-ifunc-resolve.h.patch,
  0012-S390-Mark-vx-and-vxe-as-important-hwcap.patch,
  0013-S390-Add-new-hwcap-values-for-new-cpu-architecture-a.patch,
  0014-S390-Add-configure-check-to-detect-support-for-arch1.patch,
  0015-S390-Add-arch13-memmove-ifunc-variant.patch,
  0016-S390-Add-arch13-strstr-ifunc-variant.patch,
  0017-S390-Add-arch13-memmem-ifunc-variant.patch,
  prefer-map-32bit-exec.patch, s390-strstr-page-boundary.patch,
  ppc-tle-htm-nosc.patch,
  posix-Add-internal-symbols-for-posix_spawn-interface.patch,
  glibc-2.29-posix-Use-posix_spawn-on-popen.patch,
  backtrace-powerpc.patch, pthread-rwlock-pwn.patch,
  manual-memory-protection.patch, ldbl-96-rem-pio2l.patch,
  dl-sort-maps.patch, dlopen-filter-object.patch,
  glob-use-after-free.patch, nptl-setxid-race.patch, nscd-senfile.patch,
  ldd-system-interp.patch, abort-no-flush.patch,
  fnmatch-collating-elements.patch, nss-files-long-lines-2.patch,
  iconv-reset-input-buffer.patch, nscd-prune.patch, syslog-locking.patch:
  Removed.
- long-double-alias.patch, glibc-nsswitch-usr.diff, euc-kr-overrun.patch,
  riscv-syscall-clobber.patch, nscd-gc-cycle.patch: Added.</changelog>
  <changelog author="schwab@suse.de" date="1604923200">- power10-support.patch: Add support for POWER10 (jsc#SLE-13520)
- iconv-option-parsing.patch: Rewrite iconv option parsing
  (CVE-2016-10228, bsc#1027496, BZ #19519)</changelog>
  <changelog author="schwab@suse.de" date="1608120000">- aarch64-getauxval.patch: aarch64: Accept PLT calls to __getauxval within
  libc.so (bsc#1167939)
- iconv-redundant-shift.patch: iconv: Accept redundant shift sequences in
  IBM1364 (CVE-2020-27618, bsc#1178386, BZ #26224)
- iconv-ucs4-loop-bounds.patch: iconv: Fix incorrect UCS4 inner loop
  bounds (CVE-2020-29562, bsc#1179694, BZ #26923)
- printf-long-double-non-normal.patch: x86: Harden printf against
  non-normal long double values (CVE-2020-29573, bsc#1179721, BZ #26649)
- get-nprocs-cpu-online-parsing.patch: Fix parsing of
  /sys/devices/system/cpu/online (bsc#1180038, BZ #25859)</changelog>
  <changelog author="schwab@suse.de" date="1609848000">- sysvipc-sem-stat-any.patch: sysvipc: Fix SEM_STAT_ANY kernel argument
  pass (bsc#1180557, BZ #26637)</changelog>
  <changelog author="schwab@suse.de" date="1611835200">- gconv-assertion-iso-2022-jp.patch: gconv: Fix assertion failure in
  ISO-2022-JP-3 module (CVE-2021-3326, bsc#1181505, BZ #27256)</changelog>
  <changelog author="schwab@suse.de" date="1614772800">- nscd-netgroupcache.patch: nscd: Fix double free in netgroupcache
  (CVE-2021-27645, bsc#1182733, BZ #27462)</changelog>
  <changelog author="rguenther@suse.com" date="1615377600">- Add glibc-2.31-HTM-vzeroupper.diff to avoid VZEROUPPER in the
  AVX2 accelerated string routines which cause HTM transaction
  aborts.  Instead use EVEX or SSE.  (bsc#1181403)</changelog>
  <changelog author="rguenther@suse.com" date="1615377601">- Update glibc-2.31-HTM-vzeroupper.diff with a AVX-SSE transition
  fix.</changelog>
  <changelog author="schwab@suse.de" date="1617019200">- s390-memmove-ifunc-selector-arch13.patch: S390: Also check vector
  support in memmove ifunc-selector (bsc#1184035, BZ #27511)</changelog>
  <changelog author="schwab@suse.de" date="1625140800">- wordexp-param-overflow.patch: wordexp: handle overflow in positional
  parameter number (CVE-2021-35942, bsc#1187911, BZ #28011)</changelog>
  <changelog author="schwab@suse.de" date="1630584000">- mq-notify-use-after-free.patch: Use __pthread_attr_copy in mq_notify
  (CVE-2021-33574, bsc#1186489, BZ #27896)</changelog>
  <changelog author="schwab@suse.de" date="1636027200">- 0001-s390x-Align-child-stack-while-clone.-BZ-27968.patch,
  0002-S390-Optimize-__memcpy_z196.patch,
  0003-S390-Optimize-__memset_z196.patch,
  0004-S390-Sync-HWCAP-names-with-kernel-by-adding-aliases-.patch,
  0005-S390-Add-new-hwcap-values.patch,
  0006-S390-Add-PCI_MIO-and-SIE-HWCAPs.patch: [15sp4 FEAT] GNU2007 -
  GLIBC: Support for new IBM Z Hardware (bsc#1191592, jsc#IBM-869)</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1640174400">- Add support for livepatches (jsc#SLE-20049).
- Enable livepatching on x86_64.
- Generate ipa-clones tarball artifact when livepatching is enabled.</changelog>
  <changelog author="schwab@suse.de" date="1642420800">- clnt-create-unix-overflow.patch: Buffer overflow in sunrpc clnt_create
  for "unix" (CVE-2022-23219, bsc#1194768, BZ #22542)
- svcunix-create-overflow.patch: Buffer overflow in sunrpc svcunix_create
  (CVE-2022-23218, bsc#1194770, BZ #28768)</changelog>
  <changelog author="schwab@suse.de" date="1642593600">- 0001-powerpc-Optimized-strcpy-for-POWER9.patch,
  0002-powerpc-Optimized-stpcpy-for-POWER9.patch,
  0003-powerpc-Optimized-rawmemchr-for-POWER9.patch,
  0004-powerpc64le-add-optimized-strlen-for-P9.patch,
  0005-powerpc-fix-ifunc-implementation-list-for-POWER9-str.patch,
  0006-powerpc-Add-optimized-strncpy-for-POWER9.patch,
  0007-powerpc-Add-optimized-stpncpy-for-POWER9.patch,
  0008-powerpc-Add-optimized-ilogb-for-POWER9.patch,
  0009-powerpc-Add-optimized-llogb-for-POWER9.patch,
  0010-powerpc-Add-optimized-strlen-for-POWER10.patch,
  0011-powerpc64le-Optimized-memmove-for-POWER10.patch,
  0012-powerpc64le-Optimize-memcpy-for-POWER10.patch,
  0013-powerpc64le-Optimize-memset-for-POWER10.patch,
  0014-powerpc64le-Fix-ifunc-selection-for-memset-memmove-b.patch,
  0015-powerpc-Add-optimized-rawmemchr-for-POWER10.patch: ppc64le ifunc
  improvements (bsc#1194785, jsc#SLE-18195)</changelog>
  <changelog author="schwab@suse.de" date="1643025600">- getcwd-erange.patch: getcwd: Set errno to ERANGE for size == 1
  (CVE-2021-3999, bsc#1194640, BZ #28769)</changelog>
</package>
<package pkgid="e2b1f6c39457f0d1cc6f185acf44174d25c80496687c6ec6a6b4d1513ebe7f8e" name="glibc-profile-32bit" arch="x86_64">
  <version epoch="0" ver="2.31" rel="150300.9.12.1"/>
  <changelog author="schwab@suse.de" date="1583841600">- dl-sort-maps.patch, dlopen-filter-object.patch: Allow dlopen of filter
  object to work (bsc#1166106, BZ #16272)</changelog>
  <changelog author="schwab@suse.de" date="1585137600">- glob-use-after-free.patch: Fix use-after-free in glob when expanding
  ~user (CVE-2020-1752, bsc#1167631, BZ #25414)</changelog>
  <changelog author="schwab@suse.de" date="1589371200">- nptl-setxid-race.patch: nptl: wait for pending setxid request also in
  detached thread (bsc#1162930, BZ #25942)</changelog>
  <changelog author="schwab@suse.de" date="1593518400">- nscd-senfile.patch: Fix concurrent changes on nscd aware files
  (bsc#1171878, BZ #23178)
- nscd-prune.patch: nscd: bump GC cycle during cache pruning (bsc#1171878,
  BZ #26130)
- syslog-locking.patch: Correct locking and cancellation cleanup in syslog
  functions (bsc#1172085, BZ #26100)</changelog>
  <changelog author="schwab@suse.de" date="1599048000">- Update to glibc 2.31
- glibc-2.14-crypt.diff, crypt_blowfish-const.patch,
  crypt_blowfish-1.2-sha.diff, crypt_blowfish-gensalt.patch,
  crypt_blowfish-1.2-hack_around_arm.diff, glibc-nodate.patch,
  powerpc-elision-enable-envvar.patch, s390-elision-enable-envvar.patch,
  crt-nocompress-debug-sections.patch, resolv-context-leak.patch,
  dl-runtime-resolve-opt-avx512f.patch, libpthread-compat-wrappers.patch,
  math-c++-compat.patch, remove-nss-nis-compat.patch,
  eh-frame-zero-terminator.patch, ld-so-hwcap-x86-64.patch,
  assert-pedantic.patch, getaddrinfo-errno.patch, resolv-conf-oom.patch,
  dynarray-allocation.patch, nearbyint-inexact.patch, nss-compat.patch,
  nscd-libnsl.patch, malloc-tcache-leak.patch,
  falkor-memcpy-memmove.patch, aarch64-cpu-features.patch,
  nss-files-large-buffers.patch, sysconf-uio-maxiov.patch,
  glob-tilde-overflow.patch, dl-runtime-resolve-xsave.patch,
  spawni-assert.patch, x86-64-dl-platform.patch, glob64-s390.patch,
  tst-tlsopt-powerpc.patch, powerpc-hwcap-bits.patch,
  malloc-tcache-check-overflow.patch, dl-init-paths-overflow.patch,
  fillin-rpath-empty-tokens.patch, getcwd-absolute.patch,
  memalign-overflow.patch, stack-guard-size-accounting.patch,
  libgcc-rtld-now.patch, res-send-enomem.patch,
  glibc-fix-avx512-mempcpy.patch, i386-memmove-sse2-unaligned.patch,
  realpath-ssize-max-overflow.patch, localtime-2039.patch,
  math-remove-slow-path.patch, aarch64-hwcap-atomics.patch,
  glibc-fix-aarch64-build.diff, absolute-symbols.patch,
  x86-haswell-string-flags.patch,
  pthread-cond-broadcast-waiters-after-spinning.patch,
  mman-map-sync.patch, mman-linux-map-shared-validate.patch,
  nptl-setxid-error.patch, pthread-mutex-trylock-barrier.patch,
  getaddrinfo-parse-ipv4-address.patch, japanese-era-name-may-2019.patch,
  force-elision-race.patch, regex-read-overrun.patch,
  regex-parse-reg-exp.patch,
  0001-S390-Add-configure-check-to-detect-z10-as-mininum-ar.patch,
  0002-S390-Use-hwcap-instead-of-dl_hwcap-in-ifunc-resolver.patch,
  0003-S390-Unify-31-64bit-memcpy.patch,
  0004-S390-Refactor-memcpy-mempcpy-ifunc-handling.patch,
  0005-S390-Remove-s390-specific-implementation-of-bcopy.patch,
  0006-S390-Use-memcpy-for-forward-cases-in-memmove.patch,
  0007-S390-Add-configure-check-to-detect-z13-as-mininum-ar.patch,
  0008-S390-Add-z13-memmove-ifunc-variant.patch,
  0009-S390-Add-z13-strstr-ifunc-variant.patch,
  0010-S390-Add-z13-memmem-ifunc-variant.patch,
  0011-S390-Cleanup-ifunc-resolve.h.patch,
  0012-S390-Mark-vx-and-vxe-as-important-hwcap.patch,
  0013-S390-Add-new-hwcap-values-for-new-cpu-architecture-a.patch,
  0014-S390-Add-configure-check-to-detect-support-for-arch1.patch,
  0015-S390-Add-arch13-memmove-ifunc-variant.patch,
  0016-S390-Add-arch13-strstr-ifunc-variant.patch,
  0017-S390-Add-arch13-memmem-ifunc-variant.patch,
  prefer-map-32bit-exec.patch, s390-strstr-page-boundary.patch,
  ppc-tle-htm-nosc.patch,
  posix-Add-internal-symbols-for-posix_spawn-interface.patch,
  glibc-2.29-posix-Use-posix_spawn-on-popen.patch,
  backtrace-powerpc.patch, pthread-rwlock-pwn.patch,
  manual-memory-protection.patch, ldbl-96-rem-pio2l.patch,
  dl-sort-maps.patch, dlopen-filter-object.patch,
  glob-use-after-free.patch, nptl-setxid-race.patch, nscd-senfile.patch,
  ldd-system-interp.patch, abort-no-flush.patch,
  fnmatch-collating-elements.patch, nss-files-long-lines-2.patch,
  iconv-reset-input-buffer.patch, nscd-prune.patch, syslog-locking.patch:
  Removed.
- long-double-alias.patch, glibc-nsswitch-usr.diff, euc-kr-overrun.patch,
  riscv-syscall-clobber.patch, nscd-gc-cycle.patch: Added.</changelog>
  <changelog author="schwab@suse.de" date="1604923200">- power10-support.patch: Add support for POWER10 (jsc#SLE-13520)
- iconv-option-parsing.patch: Rewrite iconv option parsing
  (CVE-2016-10228, bsc#1027496, BZ #19519)</changelog>
  <changelog author="schwab@suse.de" date="1608120000">- aarch64-getauxval.patch: aarch64: Accept PLT calls to __getauxval within
  libc.so (bsc#1167939)
- iconv-redundant-shift.patch: iconv: Accept redundant shift sequences in
  IBM1364 (CVE-2020-27618, bsc#1178386, BZ #26224)
- iconv-ucs4-loop-bounds.patch: iconv: Fix incorrect UCS4 inner loop
  bounds (CVE-2020-29562, bsc#1179694, BZ #26923)
- printf-long-double-non-normal.patch: x86: Harden printf against
  non-normal long double values (CVE-2020-29573, bsc#1179721, BZ #26649)
- get-nprocs-cpu-online-parsing.patch: Fix parsing of
  /sys/devices/system/cpu/online (bsc#1180038, BZ #25859)</changelog>
  <changelog author="schwab@suse.de" date="1609848000">- sysvipc-sem-stat-any.patch: sysvipc: Fix SEM_STAT_ANY kernel argument
  pass (bsc#1180557, BZ #26637)</changelog>
  <changelog author="schwab@suse.de" date="1611835200">- gconv-assertion-iso-2022-jp.patch: gconv: Fix assertion failure in
  ISO-2022-JP-3 module (CVE-2021-3326, bsc#1181505, BZ #27256)</changelog>
  <changelog author="schwab@suse.de" date="1614772800">- nscd-netgroupcache.patch: nscd: Fix double free in netgroupcache
  (CVE-2021-27645, bsc#1182733, BZ #27462)</changelog>
  <changelog author="rguenther@suse.com" date="1615377600">- Add glibc-2.31-HTM-vzeroupper.diff to avoid VZEROUPPER in the
  AVX2 accelerated string routines which cause HTM transaction
  aborts.  Instead use EVEX or SSE.  (bsc#1181403)</changelog>
  <changelog author="rguenther@suse.com" date="1615377601">- Update glibc-2.31-HTM-vzeroupper.diff with a AVX-SSE transition
  fix.</changelog>
  <changelog author="schwab@suse.de" date="1617019200">- s390-memmove-ifunc-selector-arch13.patch: S390: Also check vector
  support in memmove ifunc-selector (bsc#1184035, BZ #27511)</changelog>
  <changelog author="schwab@suse.de" date="1625140800">- wordexp-param-overflow.patch: wordexp: handle overflow in positional
  parameter number (CVE-2021-35942, bsc#1187911, BZ #28011)</changelog>
  <changelog author="schwab@suse.de" date="1630584000">- mq-notify-use-after-free.patch: Use __pthread_attr_copy in mq_notify
  (CVE-2021-33574, bsc#1186489, BZ #27896)</changelog>
  <changelog author="schwab@suse.de" date="1636027200">- 0001-s390x-Align-child-stack-while-clone.-BZ-27968.patch,
  0002-S390-Optimize-__memcpy_z196.patch,
  0003-S390-Optimize-__memset_z196.patch,
  0004-S390-Sync-HWCAP-names-with-kernel-by-adding-aliases-.patch,
  0005-S390-Add-new-hwcap-values.patch,
  0006-S390-Add-PCI_MIO-and-SIE-HWCAPs.patch: [15sp4 FEAT] GNU2007 -
  GLIBC: Support for new IBM Z Hardware (bsc#1191592, jsc#IBM-869)</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1640174400">- Add support for livepatches (jsc#SLE-20049).
- Enable livepatching on x86_64.
- Generate ipa-clones tarball artifact when livepatching is enabled.</changelog>
  <changelog author="schwab@suse.de" date="1642420800">- clnt-create-unix-overflow.patch: Buffer overflow in sunrpc clnt_create
  for "unix" (CVE-2022-23219, bsc#1194768, BZ #22542)
- svcunix-create-overflow.patch: Buffer overflow in sunrpc svcunix_create
  (CVE-2022-23218, bsc#1194770, BZ #28768)</changelog>
  <changelog author="schwab@suse.de" date="1642593600">- 0001-powerpc-Optimized-strcpy-for-POWER9.patch,
  0002-powerpc-Optimized-stpcpy-for-POWER9.patch,
  0003-powerpc-Optimized-rawmemchr-for-POWER9.patch,
  0004-powerpc64le-add-optimized-strlen-for-P9.patch,
  0005-powerpc-fix-ifunc-implementation-list-for-POWER9-str.patch,
  0006-powerpc-Add-optimized-strncpy-for-POWER9.patch,
  0007-powerpc-Add-optimized-stpncpy-for-POWER9.patch,
  0008-powerpc-Add-optimized-ilogb-for-POWER9.patch,
  0009-powerpc-Add-optimized-llogb-for-POWER9.patch,
  0010-powerpc-Add-optimized-strlen-for-POWER10.patch,
  0011-powerpc64le-Optimized-memmove-for-POWER10.patch,
  0012-powerpc64le-Optimize-memcpy-for-POWER10.patch,
  0013-powerpc64le-Optimize-memset-for-POWER10.patch,
  0014-powerpc64le-Fix-ifunc-selection-for-memset-memmove-b.patch,
  0015-powerpc-Add-optimized-rawmemchr-for-POWER10.patch: ppc64le ifunc
  improvements (bsc#1194785, jsc#SLE-18195)</changelog>
  <changelog author="schwab@suse.de" date="1643025600">- getcwd-erange.patch: getcwd: Set errno to ERANGE for size == 1
  (CVE-2021-3999, bsc#1194640, BZ #28769)</changelog>
</package>
<package pkgid="ae28aee7f7486ee06025c593655d1602935d470dad324a8723c0e578bfcda5d6" name="glibc-utils" arch="aarch64">
  <version epoch="0" ver="2.31" rel="150300.9.12.1"/>
  <changelog author="schwab@suse.de" date="1583841600">- dl-sort-maps.patch, dlopen-filter-object.patch: Allow dlopen of filter
  object to work (bsc#1166106, BZ #16272)</changelog>
  <changelog author="schwab@suse.de" date="1585137600">- glob-use-after-free.patch: Fix use-after-free in glob when expanding
  ~user (CVE-2020-1752, bsc#1167631, BZ #25414)</changelog>
  <changelog author="schwab@suse.de" date="1589371200">- nptl-setxid-race.patch: nptl: wait for pending setxid request also in
  detached thread (bsc#1162930, BZ #25942)</changelog>
  <changelog author="schwab@suse.de" date="1593518400">- nscd-senfile.patch: Fix concurrent changes on nscd aware files
  (bsc#1171878, BZ #23178)
- nscd-prune.patch: nscd: bump GC cycle during cache pruning (bsc#1171878,
  BZ #26130)
- syslog-locking.patch: Correct locking and cancellation cleanup in syslog
  functions (bsc#1172085, BZ #26100)</changelog>
  <changelog author="schwab@suse.de" date="1599048000">- Update to glibc 2.31
- glibc-2.14-crypt.diff, crypt_blowfish-const.patch,
  crypt_blowfish-1.2-sha.diff, crypt_blowfish-gensalt.patch,
  crypt_blowfish-1.2-hack_around_arm.diff, glibc-nodate.patch,
  powerpc-elision-enable-envvar.patch, s390-elision-enable-envvar.patch,
  crt-nocompress-debug-sections.patch, resolv-context-leak.patch,
  dl-runtime-resolve-opt-avx512f.patch, libpthread-compat-wrappers.patch,
  math-c++-compat.patch, remove-nss-nis-compat.patch,
  eh-frame-zero-terminator.patch, ld-so-hwcap-x86-64.patch,
  assert-pedantic.patch, getaddrinfo-errno.patch, resolv-conf-oom.patch,
  dynarray-allocation.patch, nearbyint-inexact.patch, nss-compat.patch,
  nscd-libnsl.patch, malloc-tcache-leak.patch,
  falkor-memcpy-memmove.patch, aarch64-cpu-features.patch,
  nss-files-large-buffers.patch, sysconf-uio-maxiov.patch,
  glob-tilde-overflow.patch, dl-runtime-resolve-xsave.patch,
  spawni-assert.patch, x86-64-dl-platform.patch, glob64-s390.patch,
  tst-tlsopt-powerpc.patch, powerpc-hwcap-bits.patch,
  malloc-tcache-check-overflow.patch, dl-init-paths-overflow.patch,
  fillin-rpath-empty-tokens.patch, getcwd-absolute.patch,
  memalign-overflow.patch, stack-guard-size-accounting.patch,
  libgcc-rtld-now.patch, res-send-enomem.patch,
  glibc-fix-avx512-mempcpy.patch, i386-memmove-sse2-unaligned.patch,
  realpath-ssize-max-overflow.patch, localtime-2039.patch,
  math-remove-slow-path.patch, aarch64-hwcap-atomics.patch,
  glibc-fix-aarch64-build.diff, absolute-symbols.patch,
  x86-haswell-string-flags.patch,
  pthread-cond-broadcast-waiters-after-spinning.patch,
  mman-map-sync.patch, mman-linux-map-shared-validate.patch,
  nptl-setxid-error.patch, pthread-mutex-trylock-barrier.patch,
  getaddrinfo-parse-ipv4-address.patch, japanese-era-name-may-2019.patch,
  force-elision-race.patch, regex-read-overrun.patch,
  regex-parse-reg-exp.patch,
  0001-S390-Add-configure-check-to-detect-z10-as-mininum-ar.patch,
  0002-S390-Use-hwcap-instead-of-dl_hwcap-in-ifunc-resolver.patch,
  0003-S390-Unify-31-64bit-memcpy.patch,
  0004-S390-Refactor-memcpy-mempcpy-ifunc-handling.patch,
  0005-S390-Remove-s390-specific-implementation-of-bcopy.patch,
  0006-S390-Use-memcpy-for-forward-cases-in-memmove.patch,
  0007-S390-Add-configure-check-to-detect-z13-as-mininum-ar.patch,
  0008-S390-Add-z13-memmove-ifunc-variant.patch,
  0009-S390-Add-z13-strstr-ifunc-variant.patch,
  0010-S390-Add-z13-memmem-ifunc-variant.patch,
  0011-S390-Cleanup-ifunc-resolve.h.patch,
  0012-S390-Mark-vx-and-vxe-as-important-hwcap.patch,
  0013-S390-Add-new-hwcap-values-for-new-cpu-architecture-a.patch,
  0014-S390-Add-configure-check-to-detect-support-for-arch1.patch,
  0015-S390-Add-arch13-memmove-ifunc-variant.patch,
  0016-S390-Add-arch13-strstr-ifunc-variant.patch,
  0017-S390-Add-arch13-memmem-ifunc-variant.patch,
  prefer-map-32bit-exec.patch, s390-strstr-page-boundary.patch,
  ppc-tle-htm-nosc.patch,
  posix-Add-internal-symbols-for-posix_spawn-interface.patch,
  glibc-2.29-posix-Use-posix_spawn-on-popen.patch,
  backtrace-powerpc.patch, pthread-rwlock-pwn.patch,
  manual-memory-protection.patch, ldbl-96-rem-pio2l.patch,
  dl-sort-maps.patch, dlopen-filter-object.patch,
  glob-use-after-free.patch, nptl-setxid-race.patch, nscd-senfile.patch,
  ldd-system-interp.patch, abort-no-flush.patch,
  fnmatch-collating-elements.patch, nss-files-long-lines-2.patch,
  iconv-reset-input-buffer.patch, nscd-prune.patch, syslog-locking.patch:
  Removed.
- long-double-alias.patch, glibc-nsswitch-usr.diff, euc-kr-overrun.patch,
  riscv-syscall-clobber.patch, nscd-gc-cycle.patch: Added.</changelog>
  <changelog author="schwab@suse.de" date="1604923200">- power10-support.patch: Add support for POWER10 (jsc#SLE-13520)
- iconv-option-parsing.patch: Rewrite iconv option parsing
  (CVE-2016-10228, bsc#1027496, BZ #19519)</changelog>
  <changelog author="schwab@suse.de" date="1608120000">- aarch64-getauxval.patch: aarch64: Accept PLT calls to __getauxval within
  libc.so (bsc#1167939)
- iconv-redundant-shift.patch: iconv: Accept redundant shift sequences in
  IBM1364 (CVE-2020-27618, bsc#1178386, BZ #26224)
- iconv-ucs4-loop-bounds.patch: iconv: Fix incorrect UCS4 inner loop
  bounds (CVE-2020-29562, bsc#1179694, BZ #26923)
- printf-long-double-non-normal.patch: x86: Harden printf against
  non-normal long double values (CVE-2020-29573, bsc#1179721, BZ #26649)
- get-nprocs-cpu-online-parsing.patch: Fix parsing of
  /sys/devices/system/cpu/online (bsc#1180038, BZ #25859)</changelog>
  <changelog author="schwab@suse.de" date="1609848000">- sysvipc-sem-stat-any.patch: sysvipc: Fix SEM_STAT_ANY kernel argument
  pass (bsc#1180557, BZ #26637)</changelog>
  <changelog author="schwab@suse.de" date="1611835200">- gconv-assertion-iso-2022-jp.patch: gconv: Fix assertion failure in
  ISO-2022-JP-3 module (CVE-2021-3326, bsc#1181505, BZ #27256)</changelog>
  <changelog author="schwab@suse.de" date="1614772800">- nscd-netgroupcache.patch: nscd: Fix double free in netgroupcache
  (CVE-2021-27645, bsc#1182733, BZ #27462)</changelog>
  <changelog author="rguenther@suse.com" date="1615377600">- Add glibc-2.31-HTM-vzeroupper.diff to avoid VZEROUPPER in the
  AVX2 accelerated string routines which cause HTM transaction
  aborts.  Instead use EVEX or SSE.  (bsc#1181403)</changelog>
  <changelog author="rguenther@suse.com" date="1615377601">- Update glibc-2.31-HTM-vzeroupper.diff with a AVX-SSE transition
  fix.</changelog>
  <changelog author="schwab@suse.de" date="1617019200">- s390-memmove-ifunc-selector-arch13.patch: S390: Also check vector
  support in memmove ifunc-selector (bsc#1184035, BZ #27511)</changelog>
  <changelog author="schwab@suse.de" date="1625140800">- wordexp-param-overflow.patch: wordexp: handle overflow in positional
  parameter number (CVE-2021-35942, bsc#1187911, BZ #28011)</changelog>
  <changelog author="schwab@suse.de" date="1630584000">- mq-notify-use-after-free.patch: Use __pthread_attr_copy in mq_notify
  (CVE-2021-33574, bsc#1186489, BZ #27896)</changelog>
  <changelog author="schwab@suse.de" date="1636027200">- 0001-s390x-Align-child-stack-while-clone.-BZ-27968.patch,
  0002-S390-Optimize-__memcpy_z196.patch,
  0003-S390-Optimize-__memset_z196.patch,
  0004-S390-Sync-HWCAP-names-with-kernel-by-adding-aliases-.patch,
  0005-S390-Add-new-hwcap-values.patch,
  0006-S390-Add-PCI_MIO-and-SIE-HWCAPs.patch: [15sp4 FEAT] GNU2007 -
  GLIBC: Support for new IBM Z Hardware (bsc#1191592, jsc#IBM-869)</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1640174400">- Add support for livepatches (jsc#SLE-20049).
- Enable livepatching on x86_64.
- Generate ipa-clones tarball artifact when livepatching is enabled.</changelog>
  <changelog author="schwab@suse.de" date="1642420800">- clnt-create-unix-overflow.patch: Buffer overflow in sunrpc clnt_create
  for "unix" (CVE-2022-23219, bsc#1194768, BZ #22542)
- svcunix-create-overflow.patch: Buffer overflow in sunrpc svcunix_create
  (CVE-2022-23218, bsc#1194770, BZ #28768)</changelog>
  <changelog author="schwab@suse.de" date="1642593600">- 0001-powerpc-Optimized-strcpy-for-POWER9.patch,
  0002-powerpc-Optimized-stpcpy-for-POWER9.patch,
  0003-powerpc-Optimized-rawmemchr-for-POWER9.patch,
  0004-powerpc64le-add-optimized-strlen-for-P9.patch,
  0005-powerpc-fix-ifunc-implementation-list-for-POWER9-str.patch,
  0006-powerpc-Add-optimized-strncpy-for-POWER9.patch,
  0007-powerpc-Add-optimized-stpncpy-for-POWER9.patch,
  0008-powerpc-Add-optimized-ilogb-for-POWER9.patch,
  0009-powerpc-Add-optimized-llogb-for-POWER9.patch,
  0010-powerpc-Add-optimized-strlen-for-POWER10.patch,
  0011-powerpc64le-Optimized-memmove-for-POWER10.patch,
  0012-powerpc64le-Optimize-memcpy-for-POWER10.patch,
  0013-powerpc64le-Optimize-memset-for-POWER10.patch,
  0014-powerpc64le-Fix-ifunc-selection-for-memset-memmove-b.patch,
  0015-powerpc-Add-optimized-rawmemchr-for-POWER10.patch: ppc64le ifunc
  improvements (bsc#1194785, jsc#SLE-18195)</changelog>
  <changelog author="schwab@suse.de" date="1643025600">- getcwd-erange.patch: getcwd: Set errno to ERANGE for size == 1
  (CVE-2021-3999, bsc#1194640, BZ #28769)</changelog>
</package>
<package pkgid="1332f3917718b1f5fd2f327aa01c12ab9babf78ff344bfa537018c633f2fa9d4" name="glibc-utils" arch="ppc64le">
  <version epoch="0" ver="2.31" rel="150300.9.12.1"/>
  <changelog author="schwab@suse.de" date="1583841600">- dl-sort-maps.patch, dlopen-filter-object.patch: Allow dlopen of filter
  object to work (bsc#1166106, BZ #16272)</changelog>
  <changelog author="schwab@suse.de" date="1585137600">- glob-use-after-free.patch: Fix use-after-free in glob when expanding
  ~user (CVE-2020-1752, bsc#1167631, BZ #25414)</changelog>
  <changelog author="schwab@suse.de" date="1589371200">- nptl-setxid-race.patch: nptl: wait for pending setxid request also in
  detached thread (bsc#1162930, BZ #25942)</changelog>
  <changelog author="schwab@suse.de" date="1593518400">- nscd-senfile.patch: Fix concurrent changes on nscd aware files
  (bsc#1171878, BZ #23178)
- nscd-prune.patch: nscd: bump GC cycle during cache pruning (bsc#1171878,
  BZ #26130)
- syslog-locking.patch: Correct locking and cancellation cleanup in syslog
  functions (bsc#1172085, BZ #26100)</changelog>
  <changelog author="schwab@suse.de" date="1599048000">- Update to glibc 2.31
- glibc-2.14-crypt.diff, crypt_blowfish-const.patch,
  crypt_blowfish-1.2-sha.diff, crypt_blowfish-gensalt.patch,
  crypt_blowfish-1.2-hack_around_arm.diff, glibc-nodate.patch,
  powerpc-elision-enable-envvar.patch, s390-elision-enable-envvar.patch,
  crt-nocompress-debug-sections.patch, resolv-context-leak.patch,
  dl-runtime-resolve-opt-avx512f.patch, libpthread-compat-wrappers.patch,
  math-c++-compat.patch, remove-nss-nis-compat.patch,
  eh-frame-zero-terminator.patch, ld-so-hwcap-x86-64.patch,
  assert-pedantic.patch, getaddrinfo-errno.patch, resolv-conf-oom.patch,
  dynarray-allocation.patch, nearbyint-inexact.patch, nss-compat.patch,
  nscd-libnsl.patch, malloc-tcache-leak.patch,
  falkor-memcpy-memmove.patch, aarch64-cpu-features.patch,
  nss-files-large-buffers.patch, sysconf-uio-maxiov.patch,
  glob-tilde-overflow.patch, dl-runtime-resolve-xsave.patch,
  spawni-assert.patch, x86-64-dl-platform.patch, glob64-s390.patch,
  tst-tlsopt-powerpc.patch, powerpc-hwcap-bits.patch,
  malloc-tcache-check-overflow.patch, dl-init-paths-overflow.patch,
  fillin-rpath-empty-tokens.patch, getcwd-absolute.patch,
  memalign-overflow.patch, stack-guard-size-accounting.patch,
  libgcc-rtld-now.patch, res-send-enomem.patch,
  glibc-fix-avx512-mempcpy.patch, i386-memmove-sse2-unaligned.patch,
  realpath-ssize-max-overflow.patch, localtime-2039.patch,
  math-remove-slow-path.patch, aarch64-hwcap-atomics.patch,
  glibc-fix-aarch64-build.diff, absolute-symbols.patch,
  x86-haswell-string-flags.patch,
  pthread-cond-broadcast-waiters-after-spinning.patch,
  mman-map-sync.patch, mman-linux-map-shared-validate.patch,
  nptl-setxid-error.patch, pthread-mutex-trylock-barrier.patch,
  getaddrinfo-parse-ipv4-address.patch, japanese-era-name-may-2019.patch,
  force-elision-race.patch, regex-read-overrun.patch,
  regex-parse-reg-exp.patch,
  0001-S390-Add-configure-check-to-detect-z10-as-mininum-ar.patch,
  0002-S390-Use-hwcap-instead-of-dl_hwcap-in-ifunc-resolver.patch,
  0003-S390-Unify-31-64bit-memcpy.patch,
  0004-S390-Refactor-memcpy-mempcpy-ifunc-handling.patch,
  0005-S390-Remove-s390-specific-implementation-of-bcopy.patch,
  0006-S390-Use-memcpy-for-forward-cases-in-memmove.patch,
  0007-S390-Add-configure-check-to-detect-z13-as-mininum-ar.patch,
  0008-S390-Add-z13-memmove-ifunc-variant.patch,
  0009-S390-Add-z13-strstr-ifunc-variant.patch,
  0010-S390-Add-z13-memmem-ifunc-variant.patch,
  0011-S390-Cleanup-ifunc-resolve.h.patch,
  0012-S390-Mark-vx-and-vxe-as-important-hwcap.patch,
  0013-S390-Add-new-hwcap-values-for-new-cpu-architecture-a.patch,
  0014-S390-Add-configure-check-to-detect-support-for-arch1.patch,
  0015-S390-Add-arch13-memmove-ifunc-variant.patch,
  0016-S390-Add-arch13-strstr-ifunc-variant.patch,
  0017-S390-Add-arch13-memmem-ifunc-variant.patch,
  prefer-map-32bit-exec.patch, s390-strstr-page-boundary.patch,
  ppc-tle-htm-nosc.patch,
  posix-Add-internal-symbols-for-posix_spawn-interface.patch,
  glibc-2.29-posix-Use-posix_spawn-on-popen.patch,
  backtrace-powerpc.patch, pthread-rwlock-pwn.patch,
  manual-memory-protection.patch, ldbl-96-rem-pio2l.patch,
  dl-sort-maps.patch, dlopen-filter-object.patch,
  glob-use-after-free.patch, nptl-setxid-race.patch, nscd-senfile.patch,
  ldd-system-interp.patch, abort-no-flush.patch,
  fnmatch-collating-elements.patch, nss-files-long-lines-2.patch,
  iconv-reset-input-buffer.patch, nscd-prune.patch, syslog-locking.patch:
  Removed.
- long-double-alias.patch, glibc-nsswitch-usr.diff, euc-kr-overrun.patch,
  riscv-syscall-clobber.patch, nscd-gc-cycle.patch: Added.</changelog>
  <changelog author="schwab@suse.de" date="1604923200">- power10-support.patch: Add support for POWER10 (jsc#SLE-13520)
- iconv-option-parsing.patch: Rewrite iconv option parsing
  (CVE-2016-10228, bsc#1027496, BZ #19519)</changelog>
  <changelog author="schwab@suse.de" date="1608120000">- aarch64-getauxval.patch: aarch64: Accept PLT calls to __getauxval within
  libc.so (bsc#1167939)
- iconv-redundant-shift.patch: iconv: Accept redundant shift sequences in
  IBM1364 (CVE-2020-27618, bsc#1178386, BZ #26224)
- iconv-ucs4-loop-bounds.patch: iconv: Fix incorrect UCS4 inner loop
  bounds (CVE-2020-29562, bsc#1179694, BZ #26923)
- printf-long-double-non-normal.patch: x86: Harden printf against
  non-normal long double values (CVE-2020-29573, bsc#1179721, BZ #26649)
- get-nprocs-cpu-online-parsing.patch: Fix parsing of
  /sys/devices/system/cpu/online (bsc#1180038, BZ #25859)</changelog>
  <changelog author="schwab@suse.de" date="1609848000">- sysvipc-sem-stat-any.patch: sysvipc: Fix SEM_STAT_ANY kernel argument
  pass (bsc#1180557, BZ #26637)</changelog>
  <changelog author="schwab@suse.de" date="1611835200">- gconv-assertion-iso-2022-jp.patch: gconv: Fix assertion failure in
  ISO-2022-JP-3 module (CVE-2021-3326, bsc#1181505, BZ #27256)</changelog>
  <changelog author="schwab@suse.de" date="1614772800">- nscd-netgroupcache.patch: nscd: Fix double free in netgroupcache
  (CVE-2021-27645, bsc#1182733, BZ #27462)</changelog>
  <changelog author="rguenther@suse.com" date="1615377600">- Add glibc-2.31-HTM-vzeroupper.diff to avoid VZEROUPPER in the
  AVX2 accelerated string routines which cause HTM transaction
  aborts.  Instead use EVEX or SSE.  (bsc#1181403)</changelog>
  <changelog author="rguenther@suse.com" date="1615377601">- Update glibc-2.31-HTM-vzeroupper.diff with a AVX-SSE transition
  fix.</changelog>
  <changelog author="schwab@suse.de" date="1617019200">- s390-memmove-ifunc-selector-arch13.patch: S390: Also check vector
  support in memmove ifunc-selector (bsc#1184035, BZ #27511)</changelog>
  <changelog author="schwab@suse.de" date="1625140800">- wordexp-param-overflow.patch: wordexp: handle overflow in positional
  parameter number (CVE-2021-35942, bsc#1187911, BZ #28011)</changelog>
  <changelog author="schwab@suse.de" date="1630584000">- mq-notify-use-after-free.patch: Use __pthread_attr_copy in mq_notify
  (CVE-2021-33574, bsc#1186489, BZ #27896)</changelog>
  <changelog author="schwab@suse.de" date="1636027200">- 0001-s390x-Align-child-stack-while-clone.-BZ-27968.patch,
  0002-S390-Optimize-__memcpy_z196.patch,
  0003-S390-Optimize-__memset_z196.patch,
  0004-S390-Sync-HWCAP-names-with-kernel-by-adding-aliases-.patch,
  0005-S390-Add-new-hwcap-values.patch,
  0006-S390-Add-PCI_MIO-and-SIE-HWCAPs.patch: [15sp4 FEAT] GNU2007 -
  GLIBC: Support for new IBM Z Hardware (bsc#1191592, jsc#IBM-869)</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1640174400">- Add support for livepatches (jsc#SLE-20049).
- Enable livepatching on x86_64.
- Generate ipa-clones tarball artifact when livepatching is enabled.</changelog>
  <changelog author="schwab@suse.de" date="1642420800">- clnt-create-unix-overflow.patch: Buffer overflow in sunrpc clnt_create
  for "unix" (CVE-2022-23219, bsc#1194768, BZ #22542)
- svcunix-create-overflow.patch: Buffer overflow in sunrpc svcunix_create
  (CVE-2022-23218, bsc#1194770, BZ #28768)</changelog>
  <changelog author="schwab@suse.de" date="1642593600">- 0001-powerpc-Optimized-strcpy-for-POWER9.patch,
  0002-powerpc-Optimized-stpcpy-for-POWER9.patch,
  0003-powerpc-Optimized-rawmemchr-for-POWER9.patch,
  0004-powerpc64le-add-optimized-strlen-for-P9.patch,
  0005-powerpc-fix-ifunc-implementation-list-for-POWER9-str.patch,
  0006-powerpc-Add-optimized-strncpy-for-POWER9.patch,
  0007-powerpc-Add-optimized-stpncpy-for-POWER9.patch,
  0008-powerpc-Add-optimized-ilogb-for-POWER9.patch,
  0009-powerpc-Add-optimized-llogb-for-POWER9.patch,
  0010-powerpc-Add-optimized-strlen-for-POWER10.patch,
  0011-powerpc64le-Optimized-memmove-for-POWER10.patch,
  0012-powerpc64le-Optimize-memcpy-for-POWER10.patch,
  0013-powerpc64le-Optimize-memset-for-POWER10.patch,
  0014-powerpc64le-Fix-ifunc-selection-for-memset-memmove-b.patch,
  0015-powerpc-Add-optimized-rawmemchr-for-POWER10.patch: ppc64le ifunc
  improvements (bsc#1194785, jsc#SLE-18195)</changelog>
  <changelog author="schwab@suse.de" date="1643025600">- getcwd-erange.patch: getcwd: Set errno to ERANGE for size == 1
  (CVE-2021-3999, bsc#1194640, BZ #28769)</changelog>
</package>
<package pkgid="96ee9e4f6c1bfa98dece64f8c7c35eb4c9e9ee5b07793b5b401e31105eaca334" name="glibc-utils" arch="s390x">
  <version epoch="0" ver="2.31" rel="150300.9.12.1"/>
  <changelog author="schwab@suse.de" date="1583841600">- dl-sort-maps.patch, dlopen-filter-object.patch: Allow dlopen of filter
  object to work (bsc#1166106, BZ #16272)</changelog>
  <changelog author="schwab@suse.de" date="1585137600">- glob-use-after-free.patch: Fix use-after-free in glob when expanding
  ~user (CVE-2020-1752, bsc#1167631, BZ #25414)</changelog>
  <changelog author="schwab@suse.de" date="1589371200">- nptl-setxid-race.patch: nptl: wait for pending setxid request also in
  detached thread (bsc#1162930, BZ #25942)</changelog>
  <changelog author="schwab@suse.de" date="1593518400">- nscd-senfile.patch: Fix concurrent changes on nscd aware files
  (bsc#1171878, BZ #23178)
- nscd-prune.patch: nscd: bump GC cycle during cache pruning (bsc#1171878,
  BZ #26130)
- syslog-locking.patch: Correct locking and cancellation cleanup in syslog
  functions (bsc#1172085, BZ #26100)</changelog>
  <changelog author="schwab@suse.de" date="1599048000">- Update to glibc 2.31
- glibc-2.14-crypt.diff, crypt_blowfish-const.patch,
  crypt_blowfish-1.2-sha.diff, crypt_blowfish-gensalt.patch,
  crypt_blowfish-1.2-hack_around_arm.diff, glibc-nodate.patch,
  powerpc-elision-enable-envvar.patch, s390-elision-enable-envvar.patch,
  crt-nocompress-debug-sections.patch, resolv-context-leak.patch,
  dl-runtime-resolve-opt-avx512f.patch, libpthread-compat-wrappers.patch,
  math-c++-compat.patch, remove-nss-nis-compat.patch,
  eh-frame-zero-terminator.patch, ld-so-hwcap-x86-64.patch,
  assert-pedantic.patch, getaddrinfo-errno.patch, resolv-conf-oom.patch,
  dynarray-allocation.patch, nearbyint-inexact.patch, nss-compat.patch,
  nscd-libnsl.patch, malloc-tcache-leak.patch,
  falkor-memcpy-memmove.patch, aarch64-cpu-features.patch,
  nss-files-large-buffers.patch, sysconf-uio-maxiov.patch,
  glob-tilde-overflow.patch, dl-runtime-resolve-xsave.patch,
  spawni-assert.patch, x86-64-dl-platform.patch, glob64-s390.patch,
  tst-tlsopt-powerpc.patch, powerpc-hwcap-bits.patch,
  malloc-tcache-check-overflow.patch, dl-init-paths-overflow.patch,
  fillin-rpath-empty-tokens.patch, getcwd-absolute.patch,
  memalign-overflow.patch, stack-guard-size-accounting.patch,
  libgcc-rtld-now.patch, res-send-enomem.patch,
  glibc-fix-avx512-mempcpy.patch, i386-memmove-sse2-unaligned.patch,
  realpath-ssize-max-overflow.patch, localtime-2039.patch,
  math-remove-slow-path.patch, aarch64-hwcap-atomics.patch,
  glibc-fix-aarch64-build.diff, absolute-symbols.patch,
  x86-haswell-string-flags.patch,
  pthread-cond-broadcast-waiters-after-spinning.patch,
  mman-map-sync.patch, mman-linux-map-shared-validate.patch,
  nptl-setxid-error.patch, pthread-mutex-trylock-barrier.patch,
  getaddrinfo-parse-ipv4-address.patch, japanese-era-name-may-2019.patch,
  force-elision-race.patch, regex-read-overrun.patch,
  regex-parse-reg-exp.patch,
  0001-S390-Add-configure-check-to-detect-z10-as-mininum-ar.patch,
  0002-S390-Use-hwcap-instead-of-dl_hwcap-in-ifunc-resolver.patch,
  0003-S390-Unify-31-64bit-memcpy.patch,
  0004-S390-Refactor-memcpy-mempcpy-ifunc-handling.patch,
  0005-S390-Remove-s390-specific-implementation-of-bcopy.patch,
  0006-S390-Use-memcpy-for-forward-cases-in-memmove.patch,
  0007-S390-Add-configure-check-to-detect-z13-as-mininum-ar.patch,
  0008-S390-Add-z13-memmove-ifunc-variant.patch,
  0009-S390-Add-z13-strstr-ifunc-variant.patch,
  0010-S390-Add-z13-memmem-ifunc-variant.patch,
  0011-S390-Cleanup-ifunc-resolve.h.patch,
  0012-S390-Mark-vx-and-vxe-as-important-hwcap.patch,
  0013-S390-Add-new-hwcap-values-for-new-cpu-architecture-a.patch,
  0014-S390-Add-configure-check-to-detect-support-for-arch1.patch,
  0015-S390-Add-arch13-memmove-ifunc-variant.patch,
  0016-S390-Add-arch13-strstr-ifunc-variant.patch,
  0017-S390-Add-arch13-memmem-ifunc-variant.patch,
  prefer-map-32bit-exec.patch, s390-strstr-page-boundary.patch,
  ppc-tle-htm-nosc.patch,
  posix-Add-internal-symbols-for-posix_spawn-interface.patch,
  glibc-2.29-posix-Use-posix_spawn-on-popen.patch,
  backtrace-powerpc.patch, pthread-rwlock-pwn.patch,
  manual-memory-protection.patch, ldbl-96-rem-pio2l.patch,
  dl-sort-maps.patch, dlopen-filter-object.patch,
  glob-use-after-free.patch, nptl-setxid-race.patch, nscd-senfile.patch,
  ldd-system-interp.patch, abort-no-flush.patch,
  fnmatch-collating-elements.patch, nss-files-long-lines-2.patch,
  iconv-reset-input-buffer.patch, nscd-prune.patch, syslog-locking.patch:
  Removed.
- long-double-alias.patch, glibc-nsswitch-usr.diff, euc-kr-overrun.patch,
  riscv-syscall-clobber.patch, nscd-gc-cycle.patch: Added.</changelog>
  <changelog author="schwab@suse.de" date="1604923200">- power10-support.patch: Add support for POWER10 (jsc#SLE-13520)
- iconv-option-parsing.patch: Rewrite iconv option parsing
  (CVE-2016-10228, bsc#1027496, BZ #19519)</changelog>
  <changelog author="schwab@suse.de" date="1608120000">- aarch64-getauxval.patch: aarch64: Accept PLT calls to __getauxval within
  libc.so (bsc#1167939)
- iconv-redundant-shift.patch: iconv: Accept redundant shift sequences in
  IBM1364 (CVE-2020-27618, bsc#1178386, BZ #26224)
- iconv-ucs4-loop-bounds.patch: iconv: Fix incorrect UCS4 inner loop
  bounds (CVE-2020-29562, bsc#1179694, BZ #26923)
- printf-long-double-non-normal.patch: x86: Harden printf against
  non-normal long double values (CVE-2020-29573, bsc#1179721, BZ #26649)
- get-nprocs-cpu-online-parsing.patch: Fix parsing of
  /sys/devices/system/cpu/online (bsc#1180038, BZ #25859)</changelog>
  <changelog author="schwab@suse.de" date="1609848000">- sysvipc-sem-stat-any.patch: sysvipc: Fix SEM_STAT_ANY kernel argument
  pass (bsc#1180557, BZ #26637)</changelog>
  <changelog author="schwab@suse.de" date="1611835200">- gconv-assertion-iso-2022-jp.patch: gconv: Fix assertion failure in
  ISO-2022-JP-3 module (CVE-2021-3326, bsc#1181505, BZ #27256)</changelog>
  <changelog author="schwab@suse.de" date="1614772800">- nscd-netgroupcache.patch: nscd: Fix double free in netgroupcache
  (CVE-2021-27645, bsc#1182733, BZ #27462)</changelog>
  <changelog author="rguenther@suse.com" date="1615377600">- Add glibc-2.31-HTM-vzeroupper.diff to avoid VZEROUPPER in the
  AVX2 accelerated string routines which cause HTM transaction
  aborts.  Instead use EVEX or SSE.  (bsc#1181403)</changelog>
  <changelog author="rguenther@suse.com" date="1615377601">- Update glibc-2.31-HTM-vzeroupper.diff with a AVX-SSE transition
  fix.</changelog>
  <changelog author="schwab@suse.de" date="1617019200">- s390-memmove-ifunc-selector-arch13.patch: S390: Also check vector
  support in memmove ifunc-selector (bsc#1184035, BZ #27511)</changelog>
  <changelog author="schwab@suse.de" date="1625140800">- wordexp-param-overflow.patch: wordexp: handle overflow in positional
  parameter number (CVE-2021-35942, bsc#1187911, BZ #28011)</changelog>
  <changelog author="schwab@suse.de" date="1630584000">- mq-notify-use-after-free.patch: Use __pthread_attr_copy in mq_notify
  (CVE-2021-33574, bsc#1186489, BZ #27896)</changelog>
  <changelog author="schwab@suse.de" date="1636027200">- 0001-s390x-Align-child-stack-while-clone.-BZ-27968.patch,
  0002-S390-Optimize-__memcpy_z196.patch,
  0003-S390-Optimize-__memset_z196.patch,
  0004-S390-Sync-HWCAP-names-with-kernel-by-adding-aliases-.patch,
  0005-S390-Add-new-hwcap-values.patch,
  0006-S390-Add-PCI_MIO-and-SIE-HWCAPs.patch: [15sp4 FEAT] GNU2007 -
  GLIBC: Support for new IBM Z Hardware (bsc#1191592, jsc#IBM-869)</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1640174400">- Add support for livepatches (jsc#SLE-20049).
- Enable livepatching on x86_64.
- Generate ipa-clones tarball artifact when livepatching is enabled.</changelog>
  <changelog author="schwab@suse.de" date="1642420800">- clnt-create-unix-overflow.patch: Buffer overflow in sunrpc clnt_create
  for "unix" (CVE-2022-23219, bsc#1194768, BZ #22542)
- svcunix-create-overflow.patch: Buffer overflow in sunrpc svcunix_create
  (CVE-2022-23218, bsc#1194770, BZ #28768)</changelog>
  <changelog author="schwab@suse.de" date="1642593600">- 0001-powerpc-Optimized-strcpy-for-POWER9.patch,
  0002-powerpc-Optimized-stpcpy-for-POWER9.patch,
  0003-powerpc-Optimized-rawmemchr-for-POWER9.patch,
  0004-powerpc64le-add-optimized-strlen-for-P9.patch,
  0005-powerpc-fix-ifunc-implementation-list-for-POWER9-str.patch,
  0006-powerpc-Add-optimized-strncpy-for-POWER9.patch,
  0007-powerpc-Add-optimized-stpncpy-for-POWER9.patch,
  0008-powerpc-Add-optimized-ilogb-for-POWER9.patch,
  0009-powerpc-Add-optimized-llogb-for-POWER9.patch,
  0010-powerpc-Add-optimized-strlen-for-POWER10.patch,
  0011-powerpc64le-Optimized-memmove-for-POWER10.patch,
  0012-powerpc64le-Optimize-memcpy-for-POWER10.patch,
  0013-powerpc64le-Optimize-memset-for-POWER10.patch,
  0014-powerpc64le-Fix-ifunc-selection-for-memset-memmove-b.patch,
  0015-powerpc-Add-optimized-rawmemchr-for-POWER10.patch: ppc64le ifunc
  improvements (bsc#1194785, jsc#SLE-18195)</changelog>
  <changelog author="schwab@suse.de" date="1643025600">- getcwd-erange.patch: getcwd: Set errno to ERANGE for size == 1
  (CVE-2021-3999, bsc#1194640, BZ #28769)</changelog>
</package>
<package pkgid="2e0be247b23fefcdd76b170018fc4908fe45ceeb890d5da402f7e95574bd576f" name="glibc-utils" arch="x86_64">
  <version epoch="0" ver="2.31" rel="150300.9.12.1"/>
  <changelog author="schwab@suse.de" date="1583841600">- dl-sort-maps.patch, dlopen-filter-object.patch: Allow dlopen of filter
  object to work (bsc#1166106, BZ #16272)</changelog>
  <changelog author="schwab@suse.de" date="1585137600">- glob-use-after-free.patch: Fix use-after-free in glob when expanding
  ~user (CVE-2020-1752, bsc#1167631, BZ #25414)</changelog>
  <changelog author="schwab@suse.de" date="1589371200">- nptl-setxid-race.patch: nptl: wait for pending setxid request also in
  detached thread (bsc#1162930, BZ #25942)</changelog>
  <changelog author="schwab@suse.de" date="1593518400">- nscd-senfile.patch: Fix concurrent changes on nscd aware files
  (bsc#1171878, BZ #23178)
- nscd-prune.patch: nscd: bump GC cycle during cache pruning (bsc#1171878,
  BZ #26130)
- syslog-locking.patch: Correct locking and cancellation cleanup in syslog
  functions (bsc#1172085, BZ #26100)</changelog>
  <changelog author="schwab@suse.de" date="1599048000">- Update to glibc 2.31
- glibc-2.14-crypt.diff, crypt_blowfish-const.patch,
  crypt_blowfish-1.2-sha.diff, crypt_blowfish-gensalt.patch,
  crypt_blowfish-1.2-hack_around_arm.diff, glibc-nodate.patch,
  powerpc-elision-enable-envvar.patch, s390-elision-enable-envvar.patch,
  crt-nocompress-debug-sections.patch, resolv-context-leak.patch,
  dl-runtime-resolve-opt-avx512f.patch, libpthread-compat-wrappers.patch,
  math-c++-compat.patch, remove-nss-nis-compat.patch,
  eh-frame-zero-terminator.patch, ld-so-hwcap-x86-64.patch,
  assert-pedantic.patch, getaddrinfo-errno.patch, resolv-conf-oom.patch,
  dynarray-allocation.patch, nearbyint-inexact.patch, nss-compat.patch,
  nscd-libnsl.patch, malloc-tcache-leak.patch,
  falkor-memcpy-memmove.patch, aarch64-cpu-features.patch,
  nss-files-large-buffers.patch, sysconf-uio-maxiov.patch,
  glob-tilde-overflow.patch, dl-runtime-resolve-xsave.patch,
  spawni-assert.patch, x86-64-dl-platform.patch, glob64-s390.patch,
  tst-tlsopt-powerpc.patch, powerpc-hwcap-bits.patch,
  malloc-tcache-check-overflow.patch, dl-init-paths-overflow.patch,
  fillin-rpath-empty-tokens.patch, getcwd-absolute.patch,
  memalign-overflow.patch, stack-guard-size-accounting.patch,
  libgcc-rtld-now.patch, res-send-enomem.patch,
  glibc-fix-avx512-mempcpy.patch, i386-memmove-sse2-unaligned.patch,
  realpath-ssize-max-overflow.patch, localtime-2039.patch,
  math-remove-slow-path.patch, aarch64-hwcap-atomics.patch,
  glibc-fix-aarch64-build.diff, absolute-symbols.patch,
  x86-haswell-string-flags.patch,
  pthread-cond-broadcast-waiters-after-spinning.patch,
  mman-map-sync.patch, mman-linux-map-shared-validate.patch,
  nptl-setxid-error.patch, pthread-mutex-trylock-barrier.patch,
  getaddrinfo-parse-ipv4-address.patch, japanese-era-name-may-2019.patch,
  force-elision-race.patch, regex-read-overrun.patch,
  regex-parse-reg-exp.patch,
  0001-S390-Add-configure-check-to-detect-z10-as-mininum-ar.patch,
  0002-S390-Use-hwcap-instead-of-dl_hwcap-in-ifunc-resolver.patch,
  0003-S390-Unify-31-64bit-memcpy.patch,
  0004-S390-Refactor-memcpy-mempcpy-ifunc-handling.patch,
  0005-S390-Remove-s390-specific-implementation-of-bcopy.patch,
  0006-S390-Use-memcpy-for-forward-cases-in-memmove.patch,
  0007-S390-Add-configure-check-to-detect-z13-as-mininum-ar.patch,
  0008-S390-Add-z13-memmove-ifunc-variant.patch,
  0009-S390-Add-z13-strstr-ifunc-variant.patch,
  0010-S390-Add-z13-memmem-ifunc-variant.patch,
  0011-S390-Cleanup-ifunc-resolve.h.patch,
  0012-S390-Mark-vx-and-vxe-as-important-hwcap.patch,
  0013-S390-Add-new-hwcap-values-for-new-cpu-architecture-a.patch,
  0014-S390-Add-configure-check-to-detect-support-for-arch1.patch,
  0015-S390-Add-arch13-memmove-ifunc-variant.patch,
  0016-S390-Add-arch13-strstr-ifunc-variant.patch,
  0017-S390-Add-arch13-memmem-ifunc-variant.patch,
  prefer-map-32bit-exec.patch, s390-strstr-page-boundary.patch,
  ppc-tle-htm-nosc.patch,
  posix-Add-internal-symbols-for-posix_spawn-interface.patch,
  glibc-2.29-posix-Use-posix_spawn-on-popen.patch,
  backtrace-powerpc.patch, pthread-rwlock-pwn.patch,
  manual-memory-protection.patch, ldbl-96-rem-pio2l.patch,
  dl-sort-maps.patch, dlopen-filter-object.patch,
  glob-use-after-free.patch, nptl-setxid-race.patch, nscd-senfile.patch,
  ldd-system-interp.patch, abort-no-flush.patch,
  fnmatch-collating-elements.patch, nss-files-long-lines-2.patch,
  iconv-reset-input-buffer.patch, nscd-prune.patch, syslog-locking.patch:
  Removed.
- long-double-alias.patch, glibc-nsswitch-usr.diff, euc-kr-overrun.patch,
  riscv-syscall-clobber.patch, nscd-gc-cycle.patch: Added.</changelog>
  <changelog author="schwab@suse.de" date="1604923200">- power10-support.patch: Add support for POWER10 (jsc#SLE-13520)
- iconv-option-parsing.patch: Rewrite iconv option parsing
  (CVE-2016-10228, bsc#1027496, BZ #19519)</changelog>
  <changelog author="schwab@suse.de" date="1608120000">- aarch64-getauxval.patch: aarch64: Accept PLT calls to __getauxval within
  libc.so (bsc#1167939)
- iconv-redundant-shift.patch: iconv: Accept redundant shift sequences in
  IBM1364 (CVE-2020-27618, bsc#1178386, BZ #26224)
- iconv-ucs4-loop-bounds.patch: iconv: Fix incorrect UCS4 inner loop
  bounds (CVE-2020-29562, bsc#1179694, BZ #26923)
- printf-long-double-non-normal.patch: x86: Harden printf against
  non-normal long double values (CVE-2020-29573, bsc#1179721, BZ #26649)
- get-nprocs-cpu-online-parsing.patch: Fix parsing of
  /sys/devices/system/cpu/online (bsc#1180038, BZ #25859)</changelog>
  <changelog author="schwab@suse.de" date="1609848000">- sysvipc-sem-stat-any.patch: sysvipc: Fix SEM_STAT_ANY kernel argument
  pass (bsc#1180557, BZ #26637)</changelog>
  <changelog author="schwab@suse.de" date="1611835200">- gconv-assertion-iso-2022-jp.patch: gconv: Fix assertion failure in
  ISO-2022-JP-3 module (CVE-2021-3326, bsc#1181505, BZ #27256)</changelog>
  <changelog author="schwab@suse.de" date="1614772800">- nscd-netgroupcache.patch: nscd: Fix double free in netgroupcache
  (CVE-2021-27645, bsc#1182733, BZ #27462)</changelog>
  <changelog author="rguenther@suse.com" date="1615377600">- Add glibc-2.31-HTM-vzeroupper.diff to avoid VZEROUPPER in the
  AVX2 accelerated string routines which cause HTM transaction
  aborts.  Instead use EVEX or SSE.  (bsc#1181403)</changelog>
  <changelog author="rguenther@suse.com" date="1615377601">- Update glibc-2.31-HTM-vzeroupper.diff with a AVX-SSE transition
  fix.</changelog>
  <changelog author="schwab@suse.de" date="1617019200">- s390-memmove-ifunc-selector-arch13.patch: S390: Also check vector
  support in memmove ifunc-selector (bsc#1184035, BZ #27511)</changelog>
  <changelog author="schwab@suse.de" date="1625140800">- wordexp-param-overflow.patch: wordexp: handle overflow in positional
  parameter number (CVE-2021-35942, bsc#1187911, BZ #28011)</changelog>
  <changelog author="schwab@suse.de" date="1630584000">- mq-notify-use-after-free.patch: Use __pthread_attr_copy in mq_notify
  (CVE-2021-33574, bsc#1186489, BZ #27896)</changelog>
  <changelog author="schwab@suse.de" date="1636027200">- 0001-s390x-Align-child-stack-while-clone.-BZ-27968.patch,
  0002-S390-Optimize-__memcpy_z196.patch,
  0003-S390-Optimize-__memset_z196.patch,
  0004-S390-Sync-HWCAP-names-with-kernel-by-adding-aliases-.patch,
  0005-S390-Add-new-hwcap-values.patch,
  0006-S390-Add-PCI_MIO-and-SIE-HWCAPs.patch: [15sp4 FEAT] GNU2007 -
  GLIBC: Support for new IBM Z Hardware (bsc#1191592, jsc#IBM-869)</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1640174400">- Add support for livepatches (jsc#SLE-20049).
- Enable livepatching on x86_64.
- Generate ipa-clones tarball artifact when livepatching is enabled.</changelog>
  <changelog author="schwab@suse.de" date="1642420800">- clnt-create-unix-overflow.patch: Buffer overflow in sunrpc clnt_create
  for "unix" (CVE-2022-23219, bsc#1194768, BZ #22542)
- svcunix-create-overflow.patch: Buffer overflow in sunrpc svcunix_create
  (CVE-2022-23218, bsc#1194770, BZ #28768)</changelog>
  <changelog author="schwab@suse.de" date="1642593600">- 0001-powerpc-Optimized-strcpy-for-POWER9.patch,
  0002-powerpc-Optimized-stpcpy-for-POWER9.patch,
  0003-powerpc-Optimized-rawmemchr-for-POWER9.patch,
  0004-powerpc64le-add-optimized-strlen-for-P9.patch,
  0005-powerpc-fix-ifunc-implementation-list-for-POWER9-str.patch,
  0006-powerpc-Add-optimized-strncpy-for-POWER9.patch,
  0007-powerpc-Add-optimized-stpncpy-for-POWER9.patch,
  0008-powerpc-Add-optimized-ilogb-for-POWER9.patch,
  0009-powerpc-Add-optimized-llogb-for-POWER9.patch,
  0010-powerpc-Add-optimized-strlen-for-POWER10.patch,
  0011-powerpc64le-Optimized-memmove-for-POWER10.patch,
  0012-powerpc64le-Optimize-memcpy-for-POWER10.patch,
  0013-powerpc64le-Optimize-memset-for-POWER10.patch,
  0014-powerpc64le-Fix-ifunc-selection-for-memset-memmove-b.patch,
  0015-powerpc-Add-optimized-rawmemchr-for-POWER10.patch: ppc64le ifunc
  improvements (bsc#1194785, jsc#SLE-18195)</changelog>
  <changelog author="schwab@suse.de" date="1643025600">- getcwd-erange.patch: getcwd: Set errno to ERANGE for size == 1
  (CVE-2021-3999, bsc#1194640, BZ #28769)</changelog>
</package>
<package pkgid="e7db9ca4ff925061220a76684df006aa53b2ac40ab12cd3b76562591dcb2d97c" name="glibc-utils-32bit" arch="x86_64">
  <version epoch="0" ver="2.31" rel="150300.9.12.1"/>
  <changelog author="schwab@suse.de" date="1583841600">- dl-sort-maps.patch, dlopen-filter-object.patch: Allow dlopen of filter
  object to work (bsc#1166106, BZ #16272)</changelog>
  <changelog author="schwab@suse.de" date="1585137600">- glob-use-after-free.patch: Fix use-after-free in glob when expanding
  ~user (CVE-2020-1752, bsc#1167631, BZ #25414)</changelog>
  <changelog author="schwab@suse.de" date="1589371200">- nptl-setxid-race.patch: nptl: wait for pending setxid request also in
  detached thread (bsc#1162930, BZ #25942)</changelog>
  <changelog author="schwab@suse.de" date="1593518400">- nscd-senfile.patch: Fix concurrent changes on nscd aware files
  (bsc#1171878, BZ #23178)
- nscd-prune.patch: nscd: bump GC cycle during cache pruning (bsc#1171878,
  BZ #26130)
- syslog-locking.patch: Correct locking and cancellation cleanup in syslog
  functions (bsc#1172085, BZ #26100)</changelog>
  <changelog author="schwab@suse.de" date="1599048000">- Update to glibc 2.31
- glibc-2.14-crypt.diff, crypt_blowfish-const.patch,
  crypt_blowfish-1.2-sha.diff, crypt_blowfish-gensalt.patch,
  crypt_blowfish-1.2-hack_around_arm.diff, glibc-nodate.patch,
  powerpc-elision-enable-envvar.patch, s390-elision-enable-envvar.patch,
  crt-nocompress-debug-sections.patch, resolv-context-leak.patch,
  dl-runtime-resolve-opt-avx512f.patch, libpthread-compat-wrappers.patch,
  math-c++-compat.patch, remove-nss-nis-compat.patch,
  eh-frame-zero-terminator.patch, ld-so-hwcap-x86-64.patch,
  assert-pedantic.patch, getaddrinfo-errno.patch, resolv-conf-oom.patch,
  dynarray-allocation.patch, nearbyint-inexact.patch, nss-compat.patch,
  nscd-libnsl.patch, malloc-tcache-leak.patch,
  falkor-memcpy-memmove.patch, aarch64-cpu-features.patch,
  nss-files-large-buffers.patch, sysconf-uio-maxiov.patch,
  glob-tilde-overflow.patch, dl-runtime-resolve-xsave.patch,
  spawni-assert.patch, x86-64-dl-platform.patch, glob64-s390.patch,
  tst-tlsopt-powerpc.patch, powerpc-hwcap-bits.patch,
  malloc-tcache-check-overflow.patch, dl-init-paths-overflow.patch,
  fillin-rpath-empty-tokens.patch, getcwd-absolute.patch,
  memalign-overflow.patch, stack-guard-size-accounting.patch,
  libgcc-rtld-now.patch, res-send-enomem.patch,
  glibc-fix-avx512-mempcpy.patch, i386-memmove-sse2-unaligned.patch,
  realpath-ssize-max-overflow.patch, localtime-2039.patch,
  math-remove-slow-path.patch, aarch64-hwcap-atomics.patch,
  glibc-fix-aarch64-build.diff, absolute-symbols.patch,
  x86-haswell-string-flags.patch,
  pthread-cond-broadcast-waiters-after-spinning.patch,
  mman-map-sync.patch, mman-linux-map-shared-validate.patch,
  nptl-setxid-error.patch, pthread-mutex-trylock-barrier.patch,
  getaddrinfo-parse-ipv4-address.patch, japanese-era-name-may-2019.patch,
  force-elision-race.patch, regex-read-overrun.patch,
  regex-parse-reg-exp.patch,
  0001-S390-Add-configure-check-to-detect-z10-as-mininum-ar.patch,
  0002-S390-Use-hwcap-instead-of-dl_hwcap-in-ifunc-resolver.patch,
  0003-S390-Unify-31-64bit-memcpy.patch,
  0004-S390-Refactor-memcpy-mempcpy-ifunc-handling.patch,
  0005-S390-Remove-s390-specific-implementation-of-bcopy.patch,
  0006-S390-Use-memcpy-for-forward-cases-in-memmove.patch,
  0007-S390-Add-configure-check-to-detect-z13-as-mininum-ar.patch,
  0008-S390-Add-z13-memmove-ifunc-variant.patch,
  0009-S390-Add-z13-strstr-ifunc-variant.patch,
  0010-S390-Add-z13-memmem-ifunc-variant.patch,
  0011-S390-Cleanup-ifunc-resolve.h.patch,
  0012-S390-Mark-vx-and-vxe-as-important-hwcap.patch,
  0013-S390-Add-new-hwcap-values-for-new-cpu-architecture-a.patch,
  0014-S390-Add-configure-check-to-detect-support-for-arch1.patch,
  0015-S390-Add-arch13-memmove-ifunc-variant.patch,
  0016-S390-Add-arch13-strstr-ifunc-variant.patch,
  0017-S390-Add-arch13-memmem-ifunc-variant.patch,
  prefer-map-32bit-exec.patch, s390-strstr-page-boundary.patch,
  ppc-tle-htm-nosc.patch,
  posix-Add-internal-symbols-for-posix_spawn-interface.patch,
  glibc-2.29-posix-Use-posix_spawn-on-popen.patch,
  backtrace-powerpc.patch, pthread-rwlock-pwn.patch,
  manual-memory-protection.patch, ldbl-96-rem-pio2l.patch,
  dl-sort-maps.patch, dlopen-filter-object.patch,
  glob-use-after-free.patch, nptl-setxid-race.patch, nscd-senfile.patch,
  ldd-system-interp.patch, abort-no-flush.patch,
  fnmatch-collating-elements.patch, nss-files-long-lines-2.patch,
  iconv-reset-input-buffer.patch, nscd-prune.patch, syslog-locking.patch:
  Removed.
- long-double-alias.patch, glibc-nsswitch-usr.diff, euc-kr-overrun.patch,
  riscv-syscall-clobber.patch, nscd-gc-cycle.patch: Added.</changelog>
  <changelog author="schwab@suse.de" date="1604923200">- power10-support.patch: Add support for POWER10 (jsc#SLE-13520)
- iconv-option-parsing.patch: Rewrite iconv option parsing
  (CVE-2016-10228, bsc#1027496, BZ #19519)</changelog>
  <changelog author="schwab@suse.de" date="1608120000">- aarch64-getauxval.patch: aarch64: Accept PLT calls to __getauxval within
  libc.so (bsc#1167939)
- iconv-redundant-shift.patch: iconv: Accept redundant shift sequences in
  IBM1364 (CVE-2020-27618, bsc#1178386, BZ #26224)
- iconv-ucs4-loop-bounds.patch: iconv: Fix incorrect UCS4 inner loop
  bounds (CVE-2020-29562, bsc#1179694, BZ #26923)
- printf-long-double-non-normal.patch: x86: Harden printf against
  non-normal long double values (CVE-2020-29573, bsc#1179721, BZ #26649)
- get-nprocs-cpu-online-parsing.patch: Fix parsing of
  /sys/devices/system/cpu/online (bsc#1180038, BZ #25859)</changelog>
  <changelog author="schwab@suse.de" date="1609848000">- sysvipc-sem-stat-any.patch: sysvipc: Fix SEM_STAT_ANY kernel argument
  pass (bsc#1180557, BZ #26637)</changelog>
  <changelog author="schwab@suse.de" date="1611835200">- gconv-assertion-iso-2022-jp.patch: gconv: Fix assertion failure in
  ISO-2022-JP-3 module (CVE-2021-3326, bsc#1181505, BZ #27256)</changelog>
  <changelog author="schwab@suse.de" date="1614772800">- nscd-netgroupcache.patch: nscd: Fix double free in netgroupcache
  (CVE-2021-27645, bsc#1182733, BZ #27462)</changelog>
  <changelog author="rguenther@suse.com" date="1615377600">- Add glibc-2.31-HTM-vzeroupper.diff to avoid VZEROUPPER in the
  AVX2 accelerated string routines which cause HTM transaction
  aborts.  Instead use EVEX or SSE.  (bsc#1181403)</changelog>
  <changelog author="rguenther@suse.com" date="1615377601">- Update glibc-2.31-HTM-vzeroupper.diff with a AVX-SSE transition
  fix.</changelog>
  <changelog author="schwab@suse.de" date="1617019200">- s390-memmove-ifunc-selector-arch13.patch: S390: Also check vector
  support in memmove ifunc-selector (bsc#1184035, BZ #27511)</changelog>
  <changelog author="schwab@suse.de" date="1625140800">- wordexp-param-overflow.patch: wordexp: handle overflow in positional
  parameter number (CVE-2021-35942, bsc#1187911, BZ #28011)</changelog>
  <changelog author="schwab@suse.de" date="1630584000">- mq-notify-use-after-free.patch: Use __pthread_attr_copy in mq_notify
  (CVE-2021-33574, bsc#1186489, BZ #27896)</changelog>
  <changelog author="schwab@suse.de" date="1636027200">- 0001-s390x-Align-child-stack-while-clone.-BZ-27968.patch,
  0002-S390-Optimize-__memcpy_z196.patch,
  0003-S390-Optimize-__memset_z196.patch,
  0004-S390-Sync-HWCAP-names-with-kernel-by-adding-aliases-.patch,
  0005-S390-Add-new-hwcap-values.patch,
  0006-S390-Add-PCI_MIO-and-SIE-HWCAPs.patch: [15sp4 FEAT] GNU2007 -
  GLIBC: Support for new IBM Z Hardware (bsc#1191592, jsc#IBM-869)</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1640174400">- Add support for livepatches (jsc#SLE-20049).
- Enable livepatching on x86_64.
- Generate ipa-clones tarball artifact when livepatching is enabled.</changelog>
  <changelog author="schwab@suse.de" date="1642420800">- clnt-create-unix-overflow.patch: Buffer overflow in sunrpc clnt_create
  for "unix" (CVE-2022-23219, bsc#1194768, BZ #22542)
- svcunix-create-overflow.patch: Buffer overflow in sunrpc svcunix_create
  (CVE-2022-23218, bsc#1194770, BZ #28768)</changelog>
  <changelog author="schwab@suse.de" date="1642593600">- 0001-powerpc-Optimized-strcpy-for-POWER9.patch,
  0002-powerpc-Optimized-stpcpy-for-POWER9.patch,
  0003-powerpc-Optimized-rawmemchr-for-POWER9.patch,
  0004-powerpc64le-add-optimized-strlen-for-P9.patch,
  0005-powerpc-fix-ifunc-implementation-list-for-POWER9-str.patch,
  0006-powerpc-Add-optimized-strncpy-for-POWER9.patch,
  0007-powerpc-Add-optimized-stpncpy-for-POWER9.patch,
  0008-powerpc-Add-optimized-ilogb-for-POWER9.patch,
  0009-powerpc-Add-optimized-llogb-for-POWER9.patch,
  0010-powerpc-Add-optimized-strlen-for-POWER10.patch,
  0011-powerpc64le-Optimized-memmove-for-POWER10.patch,
  0012-powerpc64le-Optimize-memcpy-for-POWER10.patch,
  0013-powerpc64le-Optimize-memset-for-POWER10.patch,
  0014-powerpc64le-Fix-ifunc-selection-for-memset-memmove-b.patch,
  0015-powerpc-Add-optimized-rawmemchr-for-POWER10.patch: ppc64le ifunc
  improvements (bsc#1194785, jsc#SLE-18195)</changelog>
  <changelog author="schwab@suse.de" date="1643025600">- getcwd-erange.patch: getcwd: Set errno to ERANGE for size == 1
  (CVE-2021-3999, bsc#1194640, BZ #28769)</changelog>
</package>
<package pkgid="66b41685169a7c353d35ed748bafadcb8b4267dbc48b91a4576fcf7a670bf9dc" name="glibc-utils-src" arch="src">
  <version epoch="0" ver="2.31" rel="150300.9.12.1"/>
  <changelog author="schwab@suse.de" date="1583841600">- dl-sort-maps.patch, dlopen-filter-object.patch: Allow dlopen of filter
  object to work (bsc#1166106, BZ #16272)</changelog>
  <changelog author="schwab@suse.de" date="1585137600">- glob-use-after-free.patch: Fix use-after-free in glob when expanding
  ~user (CVE-2020-1752, bsc#1167631, BZ #25414)</changelog>
  <changelog author="schwab@suse.de" date="1589371200">- nptl-setxid-race.patch: nptl: wait for pending setxid request also in
  detached thread (bsc#1162930, BZ #25942)</changelog>
  <changelog author="schwab@suse.de" date="1593518400">- nscd-senfile.patch: Fix concurrent changes on nscd aware files
  (bsc#1171878, BZ #23178)
- nscd-prune.patch: nscd: bump GC cycle during cache pruning (bsc#1171878,
  BZ #26130)
- syslog-locking.patch: Correct locking and cancellation cleanup in syslog
  functions (bsc#1172085, BZ #26100)</changelog>
  <changelog author="schwab@suse.de" date="1599048000">- Update to glibc 2.31
- glibc-2.14-crypt.diff, crypt_blowfish-const.patch,
  crypt_blowfish-1.2-sha.diff, crypt_blowfish-gensalt.patch,
  crypt_blowfish-1.2-hack_around_arm.diff, glibc-nodate.patch,
  powerpc-elision-enable-envvar.patch, s390-elision-enable-envvar.patch,
  crt-nocompress-debug-sections.patch, resolv-context-leak.patch,
  dl-runtime-resolve-opt-avx512f.patch, libpthread-compat-wrappers.patch,
  math-c++-compat.patch, remove-nss-nis-compat.patch,
  eh-frame-zero-terminator.patch, ld-so-hwcap-x86-64.patch,
  assert-pedantic.patch, getaddrinfo-errno.patch, resolv-conf-oom.patch,
  dynarray-allocation.patch, nearbyint-inexact.patch, nss-compat.patch,
  nscd-libnsl.patch, malloc-tcache-leak.patch,
  falkor-memcpy-memmove.patch, aarch64-cpu-features.patch,
  nss-files-large-buffers.patch, sysconf-uio-maxiov.patch,
  glob-tilde-overflow.patch, dl-runtime-resolve-xsave.patch,
  spawni-assert.patch, x86-64-dl-platform.patch, glob64-s390.patch,
  tst-tlsopt-powerpc.patch, powerpc-hwcap-bits.patch,
  malloc-tcache-check-overflow.patch, dl-init-paths-overflow.patch,
  fillin-rpath-empty-tokens.patch, getcwd-absolute.patch,
  memalign-overflow.patch, stack-guard-size-accounting.patch,
  libgcc-rtld-now.patch, res-send-enomem.patch,
  glibc-fix-avx512-mempcpy.patch, i386-memmove-sse2-unaligned.patch,
  realpath-ssize-max-overflow.patch, localtime-2039.patch,
  math-remove-slow-path.patch, aarch64-hwcap-atomics.patch,
  glibc-fix-aarch64-build.diff, absolute-symbols.patch,
  x86-haswell-string-flags.patch,
  pthread-cond-broadcast-waiters-after-spinning.patch,
  mman-map-sync.patch, mman-linux-map-shared-validate.patch,
  nptl-setxid-error.patch, pthread-mutex-trylock-barrier.patch,
  getaddrinfo-parse-ipv4-address.patch, japanese-era-name-may-2019.patch,
  force-elision-race.patch, regex-read-overrun.patch,
  regex-parse-reg-exp.patch,
  0001-S390-Add-configure-check-to-detect-z10-as-mininum-ar.patch,
  0002-S390-Use-hwcap-instead-of-dl_hwcap-in-ifunc-resolver.patch,
  0003-S390-Unify-31-64bit-memcpy.patch,
  0004-S390-Refactor-memcpy-mempcpy-ifunc-handling.patch,
  0005-S390-Remove-s390-specific-implementation-of-bcopy.patch,
  0006-S390-Use-memcpy-for-forward-cases-in-memmove.patch,
  0007-S390-Add-configure-check-to-detect-z13-as-mininum-ar.patch,
  0008-S390-Add-z13-memmove-ifunc-variant.patch,
  0009-S390-Add-z13-strstr-ifunc-variant.patch,
  0010-S390-Add-z13-memmem-ifunc-variant.patch,
  0011-S390-Cleanup-ifunc-resolve.h.patch,
  0012-S390-Mark-vx-and-vxe-as-important-hwcap.patch,
  0013-S390-Add-new-hwcap-values-for-new-cpu-architecture-a.patch,
  0014-S390-Add-configure-check-to-detect-support-for-arch1.patch,
  0015-S390-Add-arch13-memmove-ifunc-variant.patch,
  0016-S390-Add-arch13-strstr-ifunc-variant.patch,
  0017-S390-Add-arch13-memmem-ifunc-variant.patch,
  prefer-map-32bit-exec.patch, s390-strstr-page-boundary.patch,
  ppc-tle-htm-nosc.patch,
  posix-Add-internal-symbols-for-posix_spawn-interface.patch,
  glibc-2.29-posix-Use-posix_spawn-on-popen.patch,
  backtrace-powerpc.patch, pthread-rwlock-pwn.patch,
  manual-memory-protection.patch, ldbl-96-rem-pio2l.patch,
  dl-sort-maps.patch, dlopen-filter-object.patch,
  glob-use-after-free.patch, nptl-setxid-race.patch, nscd-senfile.patch,
  ldd-system-interp.patch, abort-no-flush.patch,
  fnmatch-collating-elements.patch, nss-files-long-lines-2.patch,
  iconv-reset-input-buffer.patch, nscd-prune.patch, syslog-locking.patch:
  Removed.
- long-double-alias.patch, glibc-nsswitch-usr.diff, euc-kr-overrun.patch,
  riscv-syscall-clobber.patch, nscd-gc-cycle.patch: Added.</changelog>
  <changelog author="schwab@suse.de" date="1604923200">- power10-support.patch: Add support for POWER10 (jsc#SLE-13520)
- iconv-option-parsing.patch: Rewrite iconv option parsing
  (CVE-2016-10228, bsc#1027496, BZ #19519)</changelog>
  <changelog author="schwab@suse.de" date="1608120000">- aarch64-getauxval.patch: aarch64: Accept PLT calls to __getauxval within
  libc.so (bsc#1167939)
- iconv-redundant-shift.patch: iconv: Accept redundant shift sequences in
  IBM1364 (CVE-2020-27618, bsc#1178386, BZ #26224)
- iconv-ucs4-loop-bounds.patch: iconv: Fix incorrect UCS4 inner loop
  bounds (CVE-2020-29562, bsc#1179694, BZ #26923)
- printf-long-double-non-normal.patch: x86: Harden printf against
  non-normal long double values (CVE-2020-29573, bsc#1179721, BZ #26649)
- get-nprocs-cpu-online-parsing.patch: Fix parsing of
  /sys/devices/system/cpu/online (bsc#1180038, BZ #25859)</changelog>
  <changelog author="schwab@suse.de" date="1609848000">- sysvipc-sem-stat-any.patch: sysvipc: Fix SEM_STAT_ANY kernel argument
  pass (bsc#1180557, BZ #26637)</changelog>
  <changelog author="schwab@suse.de" date="1611835200">- gconv-assertion-iso-2022-jp.patch: gconv: Fix assertion failure in
  ISO-2022-JP-3 module (CVE-2021-3326, bsc#1181505, BZ #27256)</changelog>
  <changelog author="schwab@suse.de" date="1614772800">- nscd-netgroupcache.patch: nscd: Fix double free in netgroupcache
  (CVE-2021-27645, bsc#1182733, BZ #27462)</changelog>
  <changelog author="rguenther@suse.com" date="1615377600">- Add glibc-2.31-HTM-vzeroupper.diff to avoid VZEROUPPER in the
  AVX2 accelerated string routines which cause HTM transaction
  aborts.  Instead use EVEX or SSE.  (bsc#1181403)</changelog>
  <changelog author="rguenther@suse.com" date="1615377601">- Update glibc-2.31-HTM-vzeroupper.diff with a AVX-SSE transition
  fix.</changelog>
  <changelog author="schwab@suse.de" date="1617019200">- s390-memmove-ifunc-selector-arch13.patch: S390: Also check vector
  support in memmove ifunc-selector (bsc#1184035, BZ #27511)</changelog>
  <changelog author="schwab@suse.de" date="1625140800">- wordexp-param-overflow.patch: wordexp: handle overflow in positional
  parameter number (CVE-2021-35942, bsc#1187911, BZ #28011)</changelog>
  <changelog author="schwab@suse.de" date="1630584000">- mq-notify-use-after-free.patch: Use __pthread_attr_copy in mq_notify
  (CVE-2021-33574, bsc#1186489, BZ #27896)</changelog>
  <changelog author="schwab@suse.de" date="1636027200">- 0001-s390x-Align-child-stack-while-clone.-BZ-27968.patch,
  0002-S390-Optimize-__memcpy_z196.patch,
  0003-S390-Optimize-__memset_z196.patch,
  0004-S390-Sync-HWCAP-names-with-kernel-by-adding-aliases-.patch,
  0005-S390-Add-new-hwcap-values.patch,
  0006-S390-Add-PCI_MIO-and-SIE-HWCAPs.patch: [15sp4 FEAT] GNU2007 -
  GLIBC: Support for new IBM Z Hardware (bsc#1191592, jsc#IBM-869)</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1640174400">- Add support for livepatches (jsc#SLE-20049).
- Enable livepatching on x86_64.
- Generate ipa-clones tarball artifact when livepatching is enabled.</changelog>
  <changelog author="schwab@suse.de" date="1642420800">- clnt-create-unix-overflow.patch: Buffer overflow in sunrpc clnt_create
  for "unix" (CVE-2022-23219, bsc#1194768, BZ #22542)
- svcunix-create-overflow.patch: Buffer overflow in sunrpc svcunix_create
  (CVE-2022-23218, bsc#1194770, BZ #28768)</changelog>
  <changelog author="schwab@suse.de" date="1642593600">- 0001-powerpc-Optimized-strcpy-for-POWER9.patch,
  0002-powerpc-Optimized-stpcpy-for-POWER9.patch,
  0003-powerpc-Optimized-rawmemchr-for-POWER9.patch,
  0004-powerpc64le-add-optimized-strlen-for-P9.patch,
  0005-powerpc-fix-ifunc-implementation-list-for-POWER9-str.patch,
  0006-powerpc-Add-optimized-strncpy-for-POWER9.patch,
  0007-powerpc-Add-optimized-stpncpy-for-POWER9.patch,
  0008-powerpc-Add-optimized-ilogb-for-POWER9.patch,
  0009-powerpc-Add-optimized-llogb-for-POWER9.patch,
  0010-powerpc-Add-optimized-strlen-for-POWER10.patch,
  0011-powerpc64le-Optimized-memmove-for-POWER10.patch,
  0012-powerpc64le-Optimize-memcpy-for-POWER10.patch,
  0013-powerpc64le-Optimize-memset-for-POWER10.patch,
  0014-powerpc64le-Fix-ifunc-selection-for-memset-memmove-b.patch,
  0015-powerpc-Add-optimized-rawmemchr-for-POWER10.patch: ppc64le ifunc
  improvements (bsc#1194785, jsc#SLE-18195)</changelog>
  <changelog author="schwab@suse.de" date="1643025600">- getcwd-erange.patch: getcwd: Set errno to ERANGE for size == 1
  (CVE-2021-3999, bsc#1194640, BZ #28769)</changelog>
</package>
<package pkgid="0621e44fc49d94f9d527e875d0d9b24df7ded2fc5e5d616207b9de00caadd4d6" name="go1.16" arch="aarch64">
  <version epoch="0" ver="1.16.13" rel="1.40.1"/>
  <changelog author="jkowalczyk@suse.com" date="1611835200">- go1.16rc1 (released 2021-01-28) is a release candidate of go1.16
  cut from the master branch at the revision tagged go1.16rc1.</changelog>
  <changelog author="jkowalczyk@suse.com" date="1613476800">- go1.16 (released 2021-02-16) Go 1.16 is a major release of Go.
  go1.16.x minor releases will be provided through February 2022.
  https://github.com/golang/go/wiki/Go-Release-Cycle
  Most changes are in the implementation of the toolchain, runtime,
  and libraries. As always, the release maintains the Go 1 promise
  of compatibility. We expect almost all Go programs to continue to
  compile and run as before.
  Refs boo#1182345 go1.16 release tracking
  * See release notes https://golang.org/doc/go1.16. Excerpts
    relevant to OBS environment and for SUSE/openSUSE follow:
  * Module-aware mode is enabled by default, regardless of whether
    a go.mod file is present in the current working directory or a
    parent directory. More precisely, the GO111MODULE environment
    variable now defaults to on. To switch to the previous
    behavior, set GO111MODULE to auto.
  * Build commands like go build and go test no longer modify
    go.mod and go.sum by default. Instead, they report an error if
    a module requirement or checksum needs to be added or updated
    (as if the -mod=readonly flag were used). Module requirements
    and sums may be adjusted with go mod tidy or go get.
  * go install now accepts arguments with version suffixes (for
    example, go install example.com/cmd@v1.0.0). This causes go
    install to build and install packages in module-aware mode,
    ignoring the go.mod file in the current directory or any parent
    directory, if there is one. This is useful for installing
    executables without affecting the dependencies of the main
    module.
  * go install, with or without a version suffix (as described
    above), is now the recommended way to build and install
    packages in module mode. go get should be used with the -d flag
    to adjust the current module's dependencies without building
    packages, and use of go get to build and install packages is
    deprecated. In a future release, the -d flag will always be
    enabled.
  * retract directives may now be used in a go.mod file to indicate
    that certain published versions of the module should not be
    used by other modules. A module author may retract a version
    after a severe problem is discovered or if the version was
    published unintentionally.
  * The go mod vendor and go mod tidy subcommands now accept the -e
    flag, which instructs them to proceed despite errors in
    resolving missing packages.
  * The go command now ignores requirements on module versions
    excluded by exclude directives in the main module. Previously,
    the go command used the next version higher than an excluded
    version, but that version could change over time, resulting in
    non-reproducible builds.
  * In module mode, the go command now disallows import paths that
    include non-ASCII characters or path elements with a leading
    dot character (.). Module paths with these characters were
    already disallowed (see Module paths and versions), so this
    change affects only paths within module subdirectories.
  * The go command now supports including static files and file
    trees as part of the final executable, using the new //go:embed
    directive. See the documentation for the new embed package for
    details.
  * When using go test, a test that calls os.Exit(0) during
    execution of a test function will now be considered to
    fail. This will help catch cases in which a test calls code
    that calls os.Exit(0) and thereby stops running all future
    tests. If a TestMain function calls os.Exit(0) that is still
    considered to be a passing test.
  * go test reports an error when the -c or -i flags are used
    together with unknown flags. Normally, unknown flags are passed
    to tests, but when -c or -i are used, tests are not run.
  * The go get -insecure flag is deprecated and will be removed in
    a future version. This flag permits fetching from repositories
    and resolving custom domains using insecure schemes such as
    HTTP, and also bypasses module sum validation using the
    checksum database. To permit the use of insecure schemes, use
    the GOINSECURE environment variable instead. To bypass module
    sum validation, use GOPRIVATE or GONOSUMDB. See go help
    environment for details.
  * go get example.com/mod@patch now requires that some version of
    example.com/mod already be required by the main
    module. (However, go get -u=patch continues to patch even
    newly-added dependencies.)
  * GOVCS is a new environment variable that limits which version
    control tools the go command may use to download source
    code. This mitigates security issues with tools that are
    typically used in trusted, authenticated environments. By
    default, git and hg may be used to download code from any
    repository. svn, bzr, and fossil may only be used to download
    code from repositories with module paths or package paths
    matching patterns in the GOPRIVATE environment variable. See go
    help vcs for details.
  * When the main module's go.mod file declares go 1.16 or higher,
    the all package pattern now matches only those packages that
    are transitively imported by a package or test found in the
    main module. (Packages imported by tests of packages imported
    by the main module are no longer included.) This is the same
    set of packages retained by go mod vendor since Go 1.11.
  * When the -toolexec build flag is specified to use a program
    when invoking toolchain programs like compile or asm, the
    environment variable TOOLEXEC_IMPORTPATH is now set to the
    import path of the package being built.
  * The -i flag accepted by go build, go install, and go test is
    now deprecated. The -i flag instructs the go command to install
    packages imported by packages named on the command line. Since
    the build cache was introduced in Go 1.10, the -i flag no
    longer has a significant effect on build times, and it causes
    errors when the install directory is not writable.
  * When the -export flag is specified, the BuildID field is now
    set to the build ID of the compiled package. This is equivalent
    to running go tool buildid on go list -exported -f {{.Export}},
    but without the extra step.
  * The -overlay flag specifies a JSON configuration file
    containing a set of file path replacements. The -overlay flag
    may be used with all build commands and go mod subcommands. It
    is primarily intended to be used by editor tooling such as
    gopls to understand the effects of unsaved changes to source
    files. The config file maps actual file paths to replacement
    file paths and the go command and its builds will run as if the
    actual file paths exist with the contents given by the
    replacement file paths, or don't exist if the replacement file
    paths are empty.
  * The cgo tool will no longer try to translate C struct bitfields
    into Go struct fields, even if their size can be represented in
    Go. The order in which C bitfields appear in memory is
    implementation dependent, so in some cases the cgo tool
    produced results that were silently incorrect.
  * The linux/riscv64 port now supports cgo and -buildmode=pie.
    This release also includes performance optimizations and code
    generation improvements for RISC-V.
  * The new runtime/metrics package introduces a stable interface
    for reading implementation-defined metrics from the Go
    runtime. It supersedes existing functions like
    runtime.ReadMemStats and debug.GCStats and is significantly
    more general and efficient. See the package documentation for
    more details.
  * Setting the GODEBUG environment variable to inittrace=1 now
    causes the runtime to emit a single line to standard error for
    each package init, summarizing its execution time and memory
    allocation. This trace can be used to find bottlenecks or
    regressions in Go startup performance. The GODEBUG
    documentation describes the format.
  * On Linux, the runtime now defaults to releasing memory to the
    operating system promptly (using MADV_DONTNEED), rather than
    lazily when the operating system is under memory pressure
    (using MADV_FREE). This means process-level memory statistics
    like RSS will more accurately reflect the amount of physical
    memory being used by Go processes. Systems that are currently
    using GODEBUG=madvdontneed=1 to improve memory monitoring
    behavior no longer need to set this environment variable.
  * Go 1.16 fixes a discrepancy between the race detector and the
    Go memory model. The race detector now more precisely follows
    the channel synchronization rules of the memory model. As a
    result, the detector may now report races it previously missed.
  * linker: This release includes additional improvements to the Go
    linker, reducing linker resource usage (both time and memory)
    and improving code robustness/maintainability. These changes
    form the second half of a two-release project to modernize the
    Go linker.
  * The linker changes in 1.16 extend the 1.15 improvements to all
    supported architecture/OS combinations (the 1.15 performance
    improvements were primarily focused on ELF-based OSes and amd64
    architectures). For a representative set of large Go programs,
    linking is 20-25% faster than 1.15 and requires 5-15% less
    memory on average for linux/amd64, with larger improvements for
    other architectures and OSes. Most binaries are also smaller as
    a result of more aggressive symbol pruning.
  * The new embed package provides access to files embedded in the
    program during compilation using the new //go:embed directive.
  * The new io/fs package defines the fs.FS interface, an
    abstraction for read-only trees of files. The standard library
    packages have been adapted to make use of the interface as
    appropriate.
  * For testing code that implements fs.FS, the new testing/fstest
    package provides a TestFS function that checks for and reports
    common mistakes. It also provides a simple in-memory file
    system implementation, MapFS, which can be useful for testing
    code that accepts fs.FS implementations.
  * syscall: On Linux, Setgid, Setuid, and related calls are now
    implemented. Previously, they returned an syscall.EOPNOTSUPP
    error. On Linux, the new functions AllThreadsSyscall and
    AllThreadsSyscall6 may be used to make a system call on all Go
    threads in the process. These functions may only be used by
    programs that do not use cgo; if a program uses cgo, they will
    always return syscall.ENOTSUP.
  * time/tzdata: The slim timezone data format is now used for the
    timezone database in $GOROOT/lib/time/zoneinfo.zip and the
    embedded copy in this package. This reduces the size of the
    timezone database by about 350 KB.</changelog>
  <changelog author="jkowalczyk@suse.com" date="1613649600">- gcc6-go.patch fix typo go-7 to go-6 for bootstrap on SLE-12 gcc6</changelog>
  <changelog author="jkowalczyk@suse.com" date="1615377600">- go1.16.1 (released 2021-03-10) includes security fixes to the
  archive/zip and encoding/xml packages.
  CVE-2021-27918 CVE-2021-27919
  Refs boo#1182345 go1.16 release tracking
  * boo#1183333 CVE-2021-27918
  * go#44915 encoding/xml: infinite loop when using `xml.NewTokenDecoder` with a custom `TokenReader`
  * boo#1183334 CVE-2021-27919
  * go#44917 archive/zip: can panic when calling Reader.Open</changelog>
  <changelog author="jkowalczyk@suse.com" date="1615550400">- go1.16.2 (released 2021-03-11) includes fixes to cgo, the
  compiler, linker, the go command, and the syscall and time
  packages.
  Refs boo#1182345 go1.16 release tracking
  * go#44793 cmd/go: mod tidy should ignore missing standard library packages
  * go#44746 cmd/go: improve error message when outside a module from "working directory is not part of a module"
  * go#44676 cmd/go: warning message when getting a retracted module version is missing a trailing newline
  * go#44659 runtime: marked free object in span
  * go#44647 cmd/go: "malformed import path" in Go 1.16 for packages with path elements containing a leading dot
  * go#44638 cmd/link: runtime crash, unexpected fault address 0xffffffffffffffff, h2_bundle.go, when using plugin
  * go#44618 time: LoadLocationFromTZData with slim tzdata uses incorrect zone
  * go#44593 syscall &amp; x/sys/windows: buffer overflow in GetQueuedCompletionStatus
  * go#44498 cmd/go: 'go mod edit -exclude' erroneously rejects '+incompatible' versions
  * go#44496 cmd/go: malformed module path with retract v2+
  * go#44464 cmd/compile: ICE on deferred call to syscall.LazyDLL.Call
  * go#44462 x/tools/go/analysis, syscall: ptrace redeclared in this block
  * go#44433 cmd/compile: Compiler regression in Go 1.16 - internal compiler error: child dcl collision on symbol
  * go#44402 doc: Broken image in readme
  * go#44358 cmd/compile: internal compiler error: Value live at entry. It shouldn't be.
  * go#44346 runtime/cgo: cannot build with -Wsign-compare</changelog>
  <changelog author="jkowalczyk@suse.com" date="1617364800">- go1.16.3 (released 2021-04-01) includes fixes to the compiler,
  linker, runtime, the go command, and the testing and time
  packages.
  Refs boo#1182345 go1.16 release tracking
  * go#45303 runtime: "invalid pc-encoded table" throw caused by bad cgo traceback
  * go#45253 cmd/compile: fix long RMW bit operations on AMD64
  * go#45240 all: run.{bash,bat,rc} sets GOPATH inconsistently
  * go#45192 Strange behaviour with loops
  * go#45030 cmd/link: go 1.16 plugin does not initialize global variables correctly when not used directly
  * go#44888 testing: Helper line number has changed in 1.16
  * go#44885 cmd/go: import paths ending with '+' are rejected (affects executable like g++ or clang++)
  * go#44869 time, runtime: zero duration timer takes 2 minutes to fire
  * go#44860 cmd/go: documentation at golang.org for cmd/go has confusing formatting
  * go#44812 cmd/go: 'go get' does not add missing hash to go.sum when ziphash file missing from cache
  * go#44640 cmd/link: fail to build when using time/tzdata on ARM</changelog>
  <changelog author="jkowalczyk@suse.com" date="1620388800">- go1.16.4 (released 2021-05-06) includes a security fix to the
  net/http package, as well as bug fixes to the runtime, the
  compiler, and the archive/zip, time, and syscall packages.
  CVE-2021-31525
  Refs boo#1182345 go1.16 release tracking
  * boo#1185790 CVE-2021-31525
  * go#45712 net/http: ReadRequest can stack overflow
  * go#45636 cmd/compile: internal compiler error: Invalid PPC64 rotate mask
  * go#45482 runtime: "invalid pc-encoded table" throw caused by bad cgo traceback (expandFinalInlineFrames)
  * go#45385 time: Europe/Dublin timezone handling broken with embedded timezone database
  * go#45347 archive/zip: duplicate entries in FS interface
  * go#45307 os/signal: timeout in TestAllThreadsSyscallSignals</changelog>
  <changelog author="jkowalczyk@suse.com" date="1622721600">- go1.16.5 (released 2021-06-03) includes security fixes to the
  archive/zip, math/big, net, and net/http/httputil packages, as
  well as bug fixes to the linker, the go command, and the net/http
  package.
  CVE-2021-33195 CVE-2021-33196 CVE-2021-33197 CVE-2021-33198
  Refs boo#1182345 go1.16 release tracking
  * boo#1187443 go#46241 CVE-2021-33195
  * go#46357 net: Lookup functions may return invalid host names
  * go#46530 net: Unix dnsclient test for CVE-2021-33195 assumes that 1.2.3.4 does not resolve
  * boo#1186622 go#46242 CVE-2021-33196
  * go#46397 archive/zip: malformed archive may cause panic or memory exhaustion
  * boo#1187444 go#46313 CVE-2021-33197
  * go#46315 net/http/httputil: ReverseProxy forwards Connection headers if first one is empty
  * boo#1187445 go#45910 CVE-2021-33198
  * go#46306 math/big: (*Rat).SetString with "1.770p02041010010011001001" crashes with "makeslice: len out of range"
  * go#46214 cmd/go: make go mod download with no arguments leave go.sum alone
  * go#46144 cmd/go: error out of 'go mod tidy' if the go.mod file specifies a newer-than-supported Go version
  * go#46128 cmd/link: internal error when externally linking very large binaries
  * go#45927 cmd/link: SIGSEGV running 'openshift-install version' for release-4.8 using external linking on PPC64LE
  * go#45832 cmd/link: unexpected trampoline when cross-compiling to ppc64le</changelog>
  <changelog author="jkowalczyk@suse.com" date="1623326400">- Fix extraneous trailing percent character %endif% in spec file.</changelog>
  <changelog author="jkowalczyk@suse.com" date="1626091200">- go1.16.6 (released 2021-07-12) includes a security fix to the
  crypto/tls package, as well as bug fixes to the compiler, and the
  net and net/http packages.
  CVE-2021-34558
  Refs boo#1182345 go1.16 release tracking
  * boo#1188229 go#47143 CVE-2021-34558
  * go#47145 security: fix CVE-2021-34558
  * go#46999 net: LookupMX behaviour broken
  * go#46981 net: TestCVE202133195 fails if /etc/resolv.conf specifies ndots larger than 3
  * go#46769 syscall: TestGroupCleanupUserNamespace test failure on Fedora
  * go#46657 runtime: deeply nested struct initialized with non-zero values
  * go#44984 net/http: server not setting Content-Length in certain cases</changelog>
  <changelog author="fvogt@suse.com" date="1626696000">- Add patch to fix crashes on PowerPC with kernel &gt;= 5.13:
  * fix-ppc64-crashes.patch</changelog>
  <changelog author="jkowalczyk@suse.com" date="1628164800">- Drop patch to fix crashes on PowerPC with kernel &gt;= 5.13, fixed
  in next upstream release:
  * drop fix-ppc64-crashes.patch</changelog>
  <changelog author="jkowalczyk@suse.com" date="1628164801">- go1.16.7 (released 2021-08-05) includes a security fix to the
  net/http/httputil package, as well as bug fixes to the compiler,
  the linker, the runtime, the go command, and the net/http
  package.
  CVE-2021-36221
  Refs boo#1182345 go1.16 release tracking
  * boo#1189162 go#46866 CVE-2021-36221
  * go#47474 net/http: panic due to racy read of persistConn after handler panic
  * go#47348 cmd/go: "go list -f '{{.Stale}}'" stack overflow with cyclic imports
  * go#47332 time: Timer reset broken under heavy use since go1.16 timer optimizations added
  * go#47289 cmd/link: build error with cgo in Windows, redefinition of go.map.zero
  * go#47015 cmd/go: go mod vendor: open C:\Users\LICENSE: Access is denied.
  * go#46928 cmd/compile: register conflict between external linker and duffzero on arm64
  * go#46858 runtime: ppc64x binaries randomly segfault on linux 5.13rc6
  * go#46551 cmd/go: unhelpful error message when running "go install" on a replaced-but-not-required package</changelog>
  <changelog author="jkowalczyk@suse.com" date="1628769600">- Add bash scripts used by go tool commands to provide a more
  complete cross-compiling go toolchain install.
  * Fixes "go tool dist list" error "all.bash does not exist"
  * Added to packaging:
    /usr/lib64/go/1.16/lib/time/update.bash (already packaged)
    /usr/lib64/go/1.16/src/all.bash
    /usr/lib64/go/1.16/src/bootstrap.bash
    /usr/lib64/go/1.16/src/buildall.bash
    /usr/lib64/go/1.16/src/clean.bash
    /usr/lib64/go/1.16/src/cmp.bash
    /usr/lib64/go/1.16/src/make.bash
    /usr/lib64/go/1.16/src/race.bash
    /usr/lib64/go/1.16/src/run.bash
    /usr/share/go/1.16/src/all.bash
    /usr/share/go/1.16/src/bootstrap.bash
    /usr/share/go/1.16/src/buildall.bash
    /usr/share/go/1.16/src/clean.bash
    /usr/share/go/1.16/src/cmd/compile/internal/ssa/gen/cover.bash
    /usr/share/go/1.16/src/cmd/vendor/golang.org/x/sys/windows/mkerrors.bash
    /usr/share/go/1.16/src/cmd/vendor/golang.org/x/sys/windows/mkknownfolderids.bash
    /usr/share/go/1.16/src/cmp.bash
    /usr/share/go/1.16/src/internal/trace/mkcanned.bash
    /usr/share/go/1.16/src/make.bash
    /usr/share/go/1.16/src/race.bash
    /usr/share/go/1.16/src/run.bash</changelog>
  <changelog author="jkowalczyk@suse.com" date="1631275200">- go1.16.8 (released 2021-09-09) includes a security fix to the
  archive/zip package, as well as bug fixes to the archive/zip,
  go/internal/gccgoimporter, html/template, net/http, and
  runtime/pprof packages.
  Refs boo#1182345 go1.16 release tracking
  CVE-2021-39293
  * boo#1190589 go#47801 CVE-2021-39293
  * go#47985 archive/zip: overflow in preallocation check can cause OOM panic
  * go#47691 x/net/http2: server sends RST_STREAM w/ PROTOCOL_ERROR to clients it incorrectly believes have violated max advertised num streams
  * go#47675 runtime/pprof: apparent deadlock in TestGoroutineSwitch on linux-armv6l
  * go#47610 go/internal/gccgoimporter: TestInstallationImporter broken with tip gccgo
  * go#47535 net/http: TestCancelRequestWhenSharingConnection can cause port exhaustion
  * go#47042 html/template: data race with concurrent ExecuteTemplate calls</changelog>
  <changelog author="jkowalczyk@suse.com" date="1633694400">- go1.16.9 (released 2021-10-07) includes a security fix to the
  linker and misc/wasm directory, as well as bug fixes to the
  runtime and to the text/template package.
  Refs boo#1182345 go1.16 release tracking
  CVE-2021-38297
  * boo#1191468 go#48797 CVE-2021-38297
  * go#48799 security: fix CVE-2021-38297 misc/wasm, cmd/link: do not let command line args overwrite global data
  * go#48443 text/template: should t.init() be executed before t.muTmpl.Lock() in AddParseTree() method?
  * go#47858 time: timer reset sometimes ignored, causing delayed ticks</changelog>
  <changelog author="jkowalczyk@suse.com" date="1636027200">- go1.16.10 (released 2021-11-04) includes security fixes to the
  archive/zip and debug/macho packages, as well as bug fixes to the
  compiler, linker, runtime, the misc/wasm directory, and to the
  net/http package.
  Refs boo#1182345 go1.16 release tracking
  CVE-2021-41771 CVE-2021-41772
  * boo#1192377 go#48990 CVE-2021-41771
  * go#48991 debug/macho: invalid dynamic symbol table command can cause panic
  * boo#1192378 go#48085 CVE-2021-41772
  * go#48251 archive/zip: Reader.Open panics on empty string
  * go#49153 misc/wasm, cmd/link: Go 1.17.2 causes WASM builds to throw command line too long with many environment variables
  * go#49076 x/net/http2: backport critical fixes
  * go#49009 net,runtime: apparent deadlock in (*net.conn).Close and runtime.netpollblock on arm64 platforms
  * go#48822 x/net/http2: client can hang forever if headers' size exceeds connection's buffer size and server hangs past request time
  * go#48649 x/net/http2: pool deadlock
  * go#48478 cmd/compile: 64 bits shifts on arm get wrong results
  * go#48474 cmd/compile: incorrect arm/arm64 simplification rules</changelog>
  <changelog author="jkowalczyk@suse.com" date="1638532800">- go1.16.11 (released 2021-12-02) includes fixes to the compiler,
  runtime, and the net/http, net/http/httptest, and time packages.
  Refs boo#1182345 go1.16 release tracking
  * go#49910 x/net/http2: frequent failures in TestClientConnCloseAtBody
  * go#49908 x/net/ipv6: TestPacketConnReadWriteMulticast{UDP,ICMP} failing with "i/o timeout" on OpenBSD 6.8 and 7.0
  * go#49904 x/net/http2: Client doesn't send body until ExpectContinueTimeout expires
  * go#49867 syscall: ntdll.dll errors in rtlGetNtVersionNumbers via os.StartProcess
  * go#49851 net/http/httptest: Close does not wait for the underlying Server's ConnState callbacks to complete
  * go#49728 runtime: "fatal error: unexpected signal during runtime execution" in cmd/go tests on darwin-amd64-race running macOS 12.0
  * go#49661 x/net/http2: TestUnreadFlowControlReturned_Server failures with stream error "NO_ERROR" since 2021-10-05
  * go#49623 net/http: Possible HTTP/2 busy loop regression in Go 1.17.3
  * go#49567 net/http: server responds with Transfer-Encoding: identity
  * go#49560 x/net/http2: setting Request.Close doesn't close TCP connections
  * go#49558 net/http: HTTP/2 response body Close method sometimes returns spurious context cancelation error (1.17.3 regression)
  * go#49406 time: ParseInLocation error
  * go#49391 cmd/compile: internal compiler error: Expand calls interface data problem</changelog>
  <changelog author="jkowalczyk@suse.com" date="1639051200">- go1.16.12 (released 2021-12-09) includes security fixes to the
  syscall and net/http packages.
  Refs boo#1182345 go1.16 release tracking
  CVE-2021-44716 CVE-2021-44717
  * boo#1193598 go#50057 CVE-2021-44717
  * go#50066 syscall: don?t close fd 0 on ForkExec error
  * boo#1193597 go#50058 CVE-2021-44716
  * go#50064 net/http: limit growth of header canonicalization cache</changelog>
  <changelog author="jkowalczyk@suse.com" date="1641470400">- go1.16.13 (released 2022-01-06) includes fixes to the compiler,
  linker, runtime, and the net/http package.
  Refs boo#1182345 go1.16 release tracking
  * go#50449 x/net/http2: http.Server.WriteTimeout does not fire if the http2 stream's window is out of space.
  * go#50296 cmd/link: does not set section type of .init_array correctly
  * go#50194 runtime/race: building for iOS, but linking in object file built for macOS
  * go#50072 runtime: race detector SIGABRT or SIGSEGV on macOS Monterey
  * go#49923 cmd/link: support more load commands on Mach-O
  * go#49412 cmd/compile: internal compiler error: Op...LECall and OpDereference have mismatched mem
  * go#48115 runtime: mallocs cause "base outside usable address space" panic when running on iOS 14</changelog>
</package>
<package pkgid="9272aeb8ed423823ab6654912f8afcc661183d928848fc865d5aef0c33eeafb2" name="go1.16" arch="ppc64le">
  <version epoch="0" ver="1.16.13" rel="1.40.1"/>
  <changelog author="jkowalczyk@suse.com" date="1611835200">- go1.16rc1 (released 2021-01-28) is a release candidate of go1.16
  cut from the master branch at the revision tagged go1.16rc1.</changelog>
  <changelog author="jkowalczyk@suse.com" date="1613476800">- go1.16 (released 2021-02-16) Go 1.16 is a major release of Go.
  go1.16.x minor releases will be provided through February 2022.
  https://github.com/golang/go/wiki/Go-Release-Cycle
  Most changes are in the implementation of the toolchain, runtime,
  and libraries. As always, the release maintains the Go 1 promise
  of compatibility. We expect almost all Go programs to continue to
  compile and run as before.
  Refs boo#1182345 go1.16 release tracking
  * See release notes https://golang.org/doc/go1.16. Excerpts
    relevant to OBS environment and for SUSE/openSUSE follow:
  * Module-aware mode is enabled by default, regardless of whether
    a go.mod file is present in the current working directory or a
    parent directory. More precisely, the GO111MODULE environment
    variable now defaults to on. To switch to the previous
    behavior, set GO111MODULE to auto.
  * Build commands like go build and go test no longer modify
    go.mod and go.sum by default. Instead, they report an error if
    a module requirement or checksum needs to be added or updated
    (as if the -mod=readonly flag were used). Module requirements
    and sums may be adjusted with go mod tidy or go get.
  * go install now accepts arguments with version suffixes (for
    example, go install example.com/cmd@v1.0.0). This causes go
    install to build and install packages in module-aware mode,
    ignoring the go.mod file in the current directory or any parent
    directory, if there is one. This is useful for installing
    executables without affecting the dependencies of the main
    module.
  * go install, with or without a version suffix (as described
    above), is now the recommended way to build and install
    packages in module mode. go get should be used with the -d flag
    to adjust the current module's dependencies without building
    packages, and use of go get to build and install packages is
    deprecated. In a future release, the -d flag will always be
    enabled.
  * retract directives may now be used in a go.mod file to indicate
    that certain published versions of the module should not be
    used by other modules. A module author may retract a version
    after a severe problem is discovered or if the version was
    published unintentionally.
  * The go mod vendor and go mod tidy subcommands now accept the -e
    flag, which instructs them to proceed despite errors in
    resolving missing packages.
  * The go command now ignores requirements on module versions
    excluded by exclude directives in the main module. Previously,
    the go command used the next version higher than an excluded
    version, but that version could change over time, resulting in
    non-reproducible builds.
  * In module mode, the go command now disallows import paths that
    include non-ASCII characters or path elements with a leading
    dot character (.). Module paths with these characters were
    already disallowed (see Module paths and versions), so this
    change affects only paths within module subdirectories.
  * The go command now supports including static files and file
    trees as part of the final executable, using the new //go:embed
    directive. See the documentation for the new embed package for
    details.
  * When using go test, a test that calls os.Exit(0) during
    execution of a test function will now be considered to
    fail. This will help catch cases in which a test calls code
    that calls os.Exit(0) and thereby stops running all future
    tests. If a TestMain function calls os.Exit(0) that is still
    considered to be a passing test.
  * go test reports an error when the -c or -i flags are used
    together with unknown flags. Normally, unknown flags are passed
    to tests, but when -c or -i are used, tests are not run.
  * The go get -insecure flag is deprecated and will be removed in
    a future version. This flag permits fetching from repositories
    and resolving custom domains using insecure schemes such as
    HTTP, and also bypasses module sum validation using the
    checksum database. To permit the use of insecure schemes, use
    the GOINSECURE environment variable instead. To bypass module
    sum validation, use GOPRIVATE or GONOSUMDB. See go help
    environment for details.
  * go get example.com/mod@patch now requires that some version of
    example.com/mod already be required by the main
    module. (However, go get -u=patch continues to patch even
    newly-added dependencies.)
  * GOVCS is a new environment variable that limits which version
    control tools the go command may use to download source
    code. This mitigates security issues with tools that are
    typically used in trusted, authenticated environments. By
    default, git and hg may be used to download code from any
    repository. svn, bzr, and fossil may only be used to download
    code from repositories with module paths or package paths
    matching patterns in the GOPRIVATE environment variable. See go
    help vcs for details.
  * When the main module's go.mod file declares go 1.16 or higher,
    the all package pattern now matches only those packages that
    are transitively imported by a package or test found in the
    main module. (Packages imported by tests of packages imported
    by the main module are no longer included.) This is the same
    set of packages retained by go mod vendor since Go 1.11.
  * When the -toolexec build flag is specified to use a program
    when invoking toolchain programs like compile or asm, the
    environment variable TOOLEXEC_IMPORTPATH is now set to the
    import path of the package being built.
  * The -i flag accepted by go build, go install, and go test is
    now deprecated. The -i flag instructs the go command to install
    packages imported by packages named on the command line. Since
    the build cache was introduced in Go 1.10, the -i flag no
    longer has a significant effect on build times, and it causes
    errors when the install directory is not writable.
  * When the -export flag is specified, the BuildID field is now
    set to the build ID of the compiled package. This is equivalent
    to running go tool buildid on go list -exported -f {{.Export}},
    but without the extra step.
  * The -overlay flag specifies a JSON configuration file
    containing a set of file path replacements. The -overlay flag
    may be used with all build commands and go mod subcommands. It
    is primarily intended to be used by editor tooling such as
    gopls to understand the effects of unsaved changes to source
    files. The config file maps actual file paths to replacement
    file paths and the go command and its builds will run as if the
    actual file paths exist with the contents given by the
    replacement file paths, or don't exist if the replacement file
    paths are empty.
  * The cgo tool will no longer try to translate C struct bitfields
    into Go struct fields, even if their size can be represented in
    Go. The order in which C bitfields appear in memory is
    implementation dependent, so in some cases the cgo tool
    produced results that were silently incorrect.
  * The linux/riscv64 port now supports cgo and -buildmode=pie.
    This release also includes performance optimizations and code
    generation improvements for RISC-V.
  * The new runtime/metrics package introduces a stable interface
    for reading implementation-defined metrics from the Go
    runtime. It supersedes existing functions like
    runtime.ReadMemStats and debug.GCStats and is significantly
    more general and efficient. See the package documentation for
    more details.
  * Setting the GODEBUG environment variable to inittrace=1 now
    causes the runtime to emit a single line to standard error for
    each package init, summarizing its execution time and memory
    allocation. This trace can be used to find bottlenecks or
    regressions in Go startup performance. The GODEBUG
    documentation describes the format.
  * On Linux, the runtime now defaults to releasing memory to the
    operating system promptly (using MADV_DONTNEED), rather than
    lazily when the operating system is under memory pressure
    (using MADV_FREE). This means process-level memory statistics
    like RSS will more accurately reflect the amount of physical
    memory being used by Go processes. Systems that are currently
    using GODEBUG=madvdontneed=1 to improve memory monitoring
    behavior no longer need to set this environment variable.
  * Go 1.16 fixes a discrepancy between the race detector and the
    Go memory model. The race detector now more precisely follows
    the channel synchronization rules of the memory model. As a
    result, the detector may now report races it previously missed.
  * linker: This release includes additional improvements to the Go
    linker, reducing linker resource usage (both time and memory)
    and improving code robustness/maintainability. These changes
    form the second half of a two-release project to modernize the
    Go linker.
  * The linker changes in 1.16 extend the 1.15 improvements to all
    supported architecture/OS combinations (the 1.15 performance
    improvements were primarily focused on ELF-based OSes and amd64
    architectures). For a representative set of large Go programs,
    linking is 20-25% faster than 1.15 and requires 5-15% less
    memory on average for linux/amd64, with larger improvements for
    other architectures and OSes. Most binaries are also smaller as
    a result of more aggressive symbol pruning.
  * The new embed package provides access to files embedded in the
    program during compilation using the new //go:embed directive.
  * The new io/fs package defines the fs.FS interface, an
    abstraction for read-only trees of files. The standard library
    packages have been adapted to make use of the interface as
    appropriate.
  * For testing code that implements fs.FS, the new testing/fstest
    package provides a TestFS function that checks for and reports
    common mistakes. It also provides a simple in-memory file
    system implementation, MapFS, which can be useful for testing
    code that accepts fs.FS implementations.
  * syscall: On Linux, Setgid, Setuid, and related calls are now
    implemented. Previously, they returned an syscall.EOPNOTSUPP
    error. On Linux, the new functions AllThreadsSyscall and
    AllThreadsSyscall6 may be used to make a system call on all Go
    threads in the process. These functions may only be used by
    programs that do not use cgo; if a program uses cgo, they will
    always return syscall.ENOTSUP.
  * time/tzdata: The slim timezone data format is now used for the
    timezone database in $GOROOT/lib/time/zoneinfo.zip and the
    embedded copy in this package. This reduces the size of the
    timezone database by about 350 KB.</changelog>
  <changelog author="jkowalczyk@suse.com" date="1613649600">- gcc6-go.patch fix typo go-7 to go-6 for bootstrap on SLE-12 gcc6</changelog>
  <changelog author="jkowalczyk@suse.com" date="1615377600">- go1.16.1 (released 2021-03-10) includes security fixes to the
  archive/zip and encoding/xml packages.
  CVE-2021-27918 CVE-2021-27919
  Refs boo#1182345 go1.16 release tracking
  * boo#1183333 CVE-2021-27918
  * go#44915 encoding/xml: infinite loop when using `xml.NewTokenDecoder` with a custom `TokenReader`
  * boo#1183334 CVE-2021-27919
  * go#44917 archive/zip: can panic when calling Reader.Open</changelog>
  <changelog author="jkowalczyk@suse.com" date="1615550400">- go1.16.2 (released 2021-03-11) includes fixes to cgo, the
  compiler, linker, the go command, and the syscall and time
  packages.
  Refs boo#1182345 go1.16 release tracking
  * go#44793 cmd/go: mod tidy should ignore missing standard library packages
  * go#44746 cmd/go: improve error message when outside a module from "working directory is not part of a module"
  * go#44676 cmd/go: warning message when getting a retracted module version is missing a trailing newline
  * go#44659 runtime: marked free object in span
  * go#44647 cmd/go: "malformed import path" in Go 1.16 for packages with path elements containing a leading dot
  * go#44638 cmd/link: runtime crash, unexpected fault address 0xffffffffffffffff, h2_bundle.go, when using plugin
  * go#44618 time: LoadLocationFromTZData with slim tzdata uses incorrect zone
  * go#44593 syscall &amp; x/sys/windows: buffer overflow in GetQueuedCompletionStatus
  * go#44498 cmd/go: 'go mod edit -exclude' erroneously rejects '+incompatible' versions
  * go#44496 cmd/go: malformed module path with retract v2+
  * go#44464 cmd/compile: ICE on deferred call to syscall.LazyDLL.Call
  * go#44462 x/tools/go/analysis, syscall: ptrace redeclared in this block
  * go#44433 cmd/compile: Compiler regression in Go 1.16 - internal compiler error: child dcl collision on symbol
  * go#44402 doc: Broken image in readme
  * go#44358 cmd/compile: internal compiler error: Value live at entry. It shouldn't be.
  * go#44346 runtime/cgo: cannot build with -Wsign-compare</changelog>
  <changelog author="jkowalczyk@suse.com" date="1617364800">- go1.16.3 (released 2021-04-01) includes fixes to the compiler,
  linker, runtime, the go command, and the testing and time
  packages.
  Refs boo#1182345 go1.16 release tracking
  * go#45303 runtime: "invalid pc-encoded table" throw caused by bad cgo traceback
  * go#45253 cmd/compile: fix long RMW bit operations on AMD64
  * go#45240 all: run.{bash,bat,rc} sets GOPATH inconsistently
  * go#45192 Strange behaviour with loops
  * go#45030 cmd/link: go 1.16 plugin does not initialize global variables correctly when not used directly
  * go#44888 testing: Helper line number has changed in 1.16
  * go#44885 cmd/go: import paths ending with '+' are rejected (affects executable like g++ or clang++)
  * go#44869 time, runtime: zero duration timer takes 2 minutes to fire
  * go#44860 cmd/go: documentation at golang.org for cmd/go has confusing formatting
  * go#44812 cmd/go: 'go get' does not add missing hash to go.sum when ziphash file missing from cache
  * go#44640 cmd/link: fail to build when using time/tzdata on ARM</changelog>
  <changelog author="jkowalczyk@suse.com" date="1620388800">- go1.16.4 (released 2021-05-06) includes a security fix to the
  net/http package, as well as bug fixes to the runtime, the
  compiler, and the archive/zip, time, and syscall packages.
  CVE-2021-31525
  Refs boo#1182345 go1.16 release tracking
  * boo#1185790 CVE-2021-31525
  * go#45712 net/http: ReadRequest can stack overflow
  * go#45636 cmd/compile: internal compiler error: Invalid PPC64 rotate mask
  * go#45482 runtime: "invalid pc-encoded table" throw caused by bad cgo traceback (expandFinalInlineFrames)
  * go#45385 time: Europe/Dublin timezone handling broken with embedded timezone database
  * go#45347 archive/zip: duplicate entries in FS interface
  * go#45307 os/signal: timeout in TestAllThreadsSyscallSignals</changelog>
  <changelog author="jkowalczyk@suse.com" date="1622721600">- go1.16.5 (released 2021-06-03) includes security fixes to the
  archive/zip, math/big, net, and net/http/httputil packages, as
  well as bug fixes to the linker, the go command, and the net/http
  package.
  CVE-2021-33195 CVE-2021-33196 CVE-2021-33197 CVE-2021-33198
  Refs boo#1182345 go1.16 release tracking
  * boo#1187443 go#46241 CVE-2021-33195
  * go#46357 net: Lookup functions may return invalid host names
  * go#46530 net: Unix dnsclient test for CVE-2021-33195 assumes that 1.2.3.4 does not resolve
  * boo#1186622 go#46242 CVE-2021-33196
  * go#46397 archive/zip: malformed archive may cause panic or memory exhaustion
  * boo#1187444 go#46313 CVE-2021-33197
  * go#46315 net/http/httputil: ReverseProxy forwards Connection headers if first one is empty
  * boo#1187445 go#45910 CVE-2021-33198
  * go#46306 math/big: (*Rat).SetString with "1.770p02041010010011001001" crashes with "makeslice: len out of range"
  * go#46214 cmd/go: make go mod download with no arguments leave go.sum alone
  * go#46144 cmd/go: error out of 'go mod tidy' if the go.mod file specifies a newer-than-supported Go version
  * go#46128 cmd/link: internal error when externally linking very large binaries
  * go#45927 cmd/link: SIGSEGV running 'openshift-install version' for release-4.8 using external linking on PPC64LE
  * go#45832 cmd/link: unexpected trampoline when cross-compiling to ppc64le</changelog>
  <changelog author="jkowalczyk@suse.com" date="1623326400">- Fix extraneous trailing percent character %endif% in spec file.</changelog>
  <changelog author="jkowalczyk@suse.com" date="1626091200">- go1.16.6 (released 2021-07-12) includes a security fix to the
  crypto/tls package, as well as bug fixes to the compiler, and the
  net and net/http packages.
  CVE-2021-34558
  Refs boo#1182345 go1.16 release tracking
  * boo#1188229 go#47143 CVE-2021-34558
  * go#47145 security: fix CVE-2021-34558
  * go#46999 net: LookupMX behaviour broken
  * go#46981 net: TestCVE202133195 fails if /etc/resolv.conf specifies ndots larger than 3
  * go#46769 syscall: TestGroupCleanupUserNamespace test failure on Fedora
  * go#46657 runtime: deeply nested struct initialized with non-zero values
  * go#44984 net/http: server not setting Content-Length in certain cases</changelog>
  <changelog author="fvogt@suse.com" date="1626696000">- Add patch to fix crashes on PowerPC with kernel &gt;= 5.13:
  * fix-ppc64-crashes.patch</changelog>
  <changelog author="jkowalczyk@suse.com" date="1628164800">- Drop patch to fix crashes on PowerPC with kernel &gt;= 5.13, fixed
  in next upstream release:
  * drop fix-ppc64-crashes.patch</changelog>
  <changelog author="jkowalczyk@suse.com" date="1628164801">- go1.16.7 (released 2021-08-05) includes a security fix to the
  net/http/httputil package, as well as bug fixes to the compiler,
  the linker, the runtime, the go command, and the net/http
  package.
  CVE-2021-36221
  Refs boo#1182345 go1.16 release tracking
  * boo#1189162 go#46866 CVE-2021-36221
  * go#47474 net/http: panic due to racy read of persistConn after handler panic
  * go#47348 cmd/go: "go list -f '{{.Stale}}'" stack overflow with cyclic imports
  * go#47332 time: Timer reset broken under heavy use since go1.16 timer optimizations added
  * go#47289 cmd/link: build error with cgo in Windows, redefinition of go.map.zero
  * go#47015 cmd/go: go mod vendor: open C:\Users\LICENSE: Access is denied.
  * go#46928 cmd/compile: register conflict between external linker and duffzero on arm64
  * go#46858 runtime: ppc64x binaries randomly segfault on linux 5.13rc6
  * go#46551 cmd/go: unhelpful error message when running "go install" on a replaced-but-not-required package</changelog>
  <changelog author="jkowalczyk@suse.com" date="1628769600">- Add bash scripts used by go tool commands to provide a more
  complete cross-compiling go toolchain install.
  * Fixes "go tool dist list" error "all.bash does not exist"
  * Added to packaging:
    /usr/lib64/go/1.16/lib/time/update.bash (already packaged)
    /usr/lib64/go/1.16/src/all.bash
    /usr/lib64/go/1.16/src/bootstrap.bash
    /usr/lib64/go/1.16/src/buildall.bash
    /usr/lib64/go/1.16/src/clean.bash
    /usr/lib64/go/1.16/src/cmp.bash
    /usr/lib64/go/1.16/src/make.bash
    /usr/lib64/go/1.16/src/race.bash
    /usr/lib64/go/1.16/src/run.bash
    /usr/share/go/1.16/src/all.bash
    /usr/share/go/1.16/src/bootstrap.bash
    /usr/share/go/1.16/src/buildall.bash
    /usr/share/go/1.16/src/clean.bash
    /usr/share/go/1.16/src/cmd/compile/internal/ssa/gen/cover.bash
    /usr/share/go/1.16/src/cmd/vendor/golang.org/x/sys/windows/mkerrors.bash
    /usr/share/go/1.16/src/cmd/vendor/golang.org/x/sys/windows/mkknownfolderids.bash
    /usr/share/go/1.16/src/cmp.bash
    /usr/share/go/1.16/src/internal/trace/mkcanned.bash
    /usr/share/go/1.16/src/make.bash
    /usr/share/go/1.16/src/race.bash
    /usr/share/go/1.16/src/run.bash</changelog>
  <changelog author="jkowalczyk@suse.com" date="1631275200">- go1.16.8 (released 2021-09-09) includes a security fix to the
  archive/zip package, as well as bug fixes to the archive/zip,
  go/internal/gccgoimporter, html/template, net/http, and
  runtime/pprof packages.
  Refs boo#1182345 go1.16 release tracking
  CVE-2021-39293
  * boo#1190589 go#47801 CVE-2021-39293
  * go#47985 archive/zip: overflow in preallocation check can cause OOM panic
  * go#47691 x/net/http2: server sends RST_STREAM w/ PROTOCOL_ERROR to clients it incorrectly believes have violated max advertised num streams
  * go#47675 runtime/pprof: apparent deadlock in TestGoroutineSwitch on linux-armv6l
  * go#47610 go/internal/gccgoimporter: TestInstallationImporter broken with tip gccgo
  * go#47535 net/http: TestCancelRequestWhenSharingConnection can cause port exhaustion
  * go#47042 html/template: data race with concurrent ExecuteTemplate calls</changelog>
  <changelog author="jkowalczyk@suse.com" date="1633694400">- go1.16.9 (released 2021-10-07) includes a security fix to the
  linker and misc/wasm directory, as well as bug fixes to the
  runtime and to the text/template package.
  Refs boo#1182345 go1.16 release tracking
  CVE-2021-38297
  * boo#1191468 go#48797 CVE-2021-38297
  * go#48799 security: fix CVE-2021-38297 misc/wasm, cmd/link: do not let command line args overwrite global data
  * go#48443 text/template: should t.init() be executed before t.muTmpl.Lock() in AddParseTree() method?
  * go#47858 time: timer reset sometimes ignored, causing delayed ticks</changelog>
  <changelog author="jkowalczyk@suse.com" date="1636027200">- go1.16.10 (released 2021-11-04) includes security fixes to the
  archive/zip and debug/macho packages, as well as bug fixes to the
  compiler, linker, runtime, the misc/wasm directory, and to the
  net/http package.
  Refs boo#1182345 go1.16 release tracking
  CVE-2021-41771 CVE-2021-41772
  * boo#1192377 go#48990 CVE-2021-41771
  * go#48991 debug/macho: invalid dynamic symbol table command can cause panic
  * boo#1192378 go#48085 CVE-2021-41772
  * go#48251 archive/zip: Reader.Open panics on empty string
  * go#49153 misc/wasm, cmd/link: Go 1.17.2 causes WASM builds to throw command line too long with many environment variables
  * go#49076 x/net/http2: backport critical fixes
  * go#49009 net,runtime: apparent deadlock in (*net.conn).Close and runtime.netpollblock on arm64 platforms
  * go#48822 x/net/http2: client can hang forever if headers' size exceeds connection's buffer size and server hangs past request time
  * go#48649 x/net/http2: pool deadlock
  * go#48478 cmd/compile: 64 bits shifts on arm get wrong results
  * go#48474 cmd/compile: incorrect arm/arm64 simplification rules</changelog>
  <changelog author="jkowalczyk@suse.com" date="1638532800">- go1.16.11 (released 2021-12-02) includes fixes to the compiler,
  runtime, and the net/http, net/http/httptest, and time packages.
  Refs boo#1182345 go1.16 release tracking
  * go#49910 x/net/http2: frequent failures in TestClientConnCloseAtBody
  * go#49908 x/net/ipv6: TestPacketConnReadWriteMulticast{UDP,ICMP} failing with "i/o timeout" on OpenBSD 6.8 and 7.0
  * go#49904 x/net/http2: Client doesn't send body until ExpectContinueTimeout expires
  * go#49867 syscall: ntdll.dll errors in rtlGetNtVersionNumbers via os.StartProcess
  * go#49851 net/http/httptest: Close does not wait for the underlying Server's ConnState callbacks to complete
  * go#49728 runtime: "fatal error: unexpected signal during runtime execution" in cmd/go tests on darwin-amd64-race running macOS 12.0
  * go#49661 x/net/http2: TestUnreadFlowControlReturned_Server failures with stream error "NO_ERROR" since 2021-10-05
  * go#49623 net/http: Possible HTTP/2 busy loop regression in Go 1.17.3
  * go#49567 net/http: server responds with Transfer-Encoding: identity
  * go#49560 x/net/http2: setting Request.Close doesn't close TCP connections
  * go#49558 net/http: HTTP/2 response body Close method sometimes returns spurious context cancelation error (1.17.3 regression)
  * go#49406 time: ParseInLocation error
  * go#49391 cmd/compile: internal compiler error: Expand calls interface data problem</changelog>
  <changelog author="jkowalczyk@suse.com" date="1639051200">- go1.16.12 (released 2021-12-09) includes security fixes to the
  syscall and net/http packages.
  Refs boo#1182345 go1.16 release tracking
  CVE-2021-44716 CVE-2021-44717
  * boo#1193598 go#50057 CVE-2021-44717
  * go#50066 syscall: don?t close fd 0 on ForkExec error
  * boo#1193597 go#50058 CVE-2021-44716
  * go#50064 net/http: limit growth of header canonicalization cache</changelog>
  <changelog author="jkowalczyk@suse.com" date="1641470400">- go1.16.13 (released 2022-01-06) includes fixes to the compiler,
  linker, runtime, and the net/http package.
  Refs boo#1182345 go1.16 release tracking
  * go#50449 x/net/http2: http.Server.WriteTimeout does not fire if the http2 stream's window is out of space.
  * go#50296 cmd/link: does not set section type of .init_array correctly
  * go#50194 runtime/race: building for iOS, but linking in object file built for macOS
  * go#50072 runtime: race detector SIGABRT or SIGSEGV on macOS Monterey
  * go#49923 cmd/link: support more load commands on Mach-O
  * go#49412 cmd/compile: internal compiler error: Op...LECall and OpDereference have mismatched mem
  * go#48115 runtime: mallocs cause "base outside usable address space" panic when running on iOS 14</changelog>
</package>
<package pkgid="d21d5477b977c0f8830ebcdda29f8292300b98dae579501f5d9a568bbe607e1b" name="go1.16" arch="s390x">
  <version epoch="0" ver="1.16.13" rel="1.40.1"/>
  <changelog author="jkowalczyk@suse.com" date="1611835200">- go1.16rc1 (released 2021-01-28) is a release candidate of go1.16
  cut from the master branch at the revision tagged go1.16rc1.</changelog>
  <changelog author="jkowalczyk@suse.com" date="1613476800">- go1.16 (released 2021-02-16) Go 1.16 is a major release of Go.
  go1.16.x minor releases will be provided through February 2022.
  https://github.com/golang/go/wiki/Go-Release-Cycle
  Most changes are in the implementation of the toolchain, runtime,
  and libraries. As always, the release maintains the Go 1 promise
  of compatibility. We expect almost all Go programs to continue to
  compile and run as before.
  Refs boo#1182345 go1.16 release tracking
  * See release notes https://golang.org/doc/go1.16. Excerpts
    relevant to OBS environment and for SUSE/openSUSE follow:
  * Module-aware mode is enabled by default, regardless of whether
    a go.mod file is present in the current working directory or a
    parent directory. More precisely, the GO111MODULE environment
    variable now defaults to on. To switch to the previous
    behavior, set GO111MODULE to auto.
  * Build commands like go build and go test no longer modify
    go.mod and go.sum by default. Instead, they report an error if
    a module requirement or checksum needs to be added or updated
    (as if the -mod=readonly flag were used). Module requirements
    and sums may be adjusted with go mod tidy or go get.
  * go install now accepts arguments with version suffixes (for
    example, go install example.com/cmd@v1.0.0). This causes go
    install to build and install packages in module-aware mode,
    ignoring the go.mod file in the current directory or any parent
    directory, if there is one. This is useful for installing
    executables without affecting the dependencies of the main
    module.
  * go install, with or without a version suffix (as described
    above), is now the recommended way to build and install
    packages in module mode. go get should be used with the -d flag
    to adjust the current module's dependencies without building
    packages, and use of go get to build and install packages is
    deprecated. In a future release, the -d flag will always be
    enabled.
  * retract directives may now be used in a go.mod file to indicate
    that certain published versions of the module should not be
    used by other modules. A module author may retract a version
    after a severe problem is discovered or if the version was
    published unintentionally.
  * The go mod vendor and go mod tidy subcommands now accept the -e
    flag, which instructs them to proceed despite errors in
    resolving missing packages.
  * The go command now ignores requirements on module versions
    excluded by exclude directives in the main module. Previously,
    the go command used the next version higher than an excluded
    version, but that version could change over time, resulting in
    non-reproducible builds.
  * In module mode, the go command now disallows import paths that
    include non-ASCII characters or path elements with a leading
    dot character (.). Module paths with these characters were
    already disallowed (see Module paths and versions), so this
    change affects only paths within module subdirectories.
  * The go command now supports including static files and file
    trees as part of the final executable, using the new //go:embed
    directive. See the documentation for the new embed package for
    details.
  * When using go test, a test that calls os.Exit(0) during
    execution of a test function will now be considered to
    fail. This will help catch cases in which a test calls code
    that calls os.Exit(0) and thereby stops running all future
    tests. If a TestMain function calls os.Exit(0) that is still
    considered to be a passing test.
  * go test reports an error when the -c or -i flags are used
    together with unknown flags. Normally, unknown flags are passed
    to tests, but when -c or -i are used, tests are not run.
  * The go get -insecure flag is deprecated and will be removed in
    a future version. This flag permits fetching from repositories
    and resolving custom domains using insecure schemes such as
    HTTP, and also bypasses module sum validation using the
    checksum database. To permit the use of insecure schemes, use
    the GOINSECURE environment variable instead. To bypass module
    sum validation, use GOPRIVATE or GONOSUMDB. See go help
    environment for details.
  * go get example.com/mod@patch now requires that some version of
    example.com/mod already be required by the main
    module. (However, go get -u=patch continues to patch even
    newly-added dependencies.)
  * GOVCS is a new environment variable that limits which version
    control tools the go command may use to download source
    code. This mitigates security issues with tools that are
    typically used in trusted, authenticated environments. By
    default, git and hg may be used to download code from any
    repository. svn, bzr, and fossil may only be used to download
    code from repositories with module paths or package paths
    matching patterns in the GOPRIVATE environment variable. See go
    help vcs for details.
  * When the main module's go.mod file declares go 1.16 or higher,
    the all package pattern now matches only those packages that
    are transitively imported by a package or test found in the
    main module. (Packages imported by tests of packages imported
    by the main module are no longer included.) This is the same
    set of packages retained by go mod vendor since Go 1.11.
  * When the -toolexec build flag is specified to use a program
    when invoking toolchain programs like compile or asm, the
    environment variable TOOLEXEC_IMPORTPATH is now set to the
    import path of the package being built.
  * The -i flag accepted by go build, go install, and go test is
    now deprecated. The -i flag instructs the go command to install
    packages imported by packages named on the command line. Since
    the build cache was introduced in Go 1.10, the -i flag no
    longer has a significant effect on build times, and it causes
    errors when the install directory is not writable.
  * When the -export flag is specified, the BuildID field is now
    set to the build ID of the compiled package. This is equivalent
    to running go tool buildid on go list -exported -f {{.Export}},
    but without the extra step.
  * The -overlay flag specifies a JSON configuration file
    containing a set of file path replacements. The -overlay flag
    may be used with all build commands and go mod subcommands. It
    is primarily intended to be used by editor tooling such as
    gopls to understand the effects of unsaved changes to source
    files. The config file maps actual file paths to replacement
    file paths and the go command and its builds will run as if the
    actual file paths exist with the contents given by the
    replacement file paths, or don't exist if the replacement file
    paths are empty.
  * The cgo tool will no longer try to translate C struct bitfields
    into Go struct fields, even if their size can be represented in
    Go. The order in which C bitfields appear in memory is
    implementation dependent, so in some cases the cgo tool
    produced results that were silently incorrect.
  * The linux/riscv64 port now supports cgo and -buildmode=pie.
    This release also includes performance optimizations and code
    generation improvements for RISC-V.
  * The new runtime/metrics package introduces a stable interface
    for reading implementation-defined metrics from the Go
    runtime. It supersedes existing functions like
    runtime.ReadMemStats and debug.GCStats and is significantly
    more general and efficient. See the package documentation for
    more details.
  * Setting the GODEBUG environment variable to inittrace=1 now
    causes the runtime to emit a single line to standard error for
    each package init, summarizing its execution time and memory
    allocation. This trace can be used to find bottlenecks or
    regressions in Go startup performance. The GODEBUG
    documentation describes the format.
  * On Linux, the runtime now defaults to releasing memory to the
    operating system promptly (using MADV_DONTNEED), rather than
    lazily when the operating system is under memory pressure
    (using MADV_FREE). This means process-level memory statistics
    like RSS will more accurately reflect the amount of physical
    memory being used by Go processes. Systems that are currently
    using GODEBUG=madvdontneed=1 to improve memory monitoring
    behavior no longer need to set this environment variable.
  * Go 1.16 fixes a discrepancy between the race detector and the
    Go memory model. The race detector now more precisely follows
    the channel synchronization rules of the memory model. As a
    result, the detector may now report races it previously missed.
  * linker: This release includes additional improvements to the Go
    linker, reducing linker resource usage (both time and memory)
    and improving code robustness/maintainability. These changes
    form the second half of a two-release project to modernize the
    Go linker.
  * The linker changes in 1.16 extend the 1.15 improvements to all
    supported architecture/OS combinations (the 1.15 performance
    improvements were primarily focused on ELF-based OSes and amd64
    architectures). For a representative set of large Go programs,
    linking is 20-25% faster than 1.15 and requires 5-15% less
    memory on average for linux/amd64, with larger improvements for
    other architectures and OSes. Most binaries are also smaller as
    a result of more aggressive symbol pruning.
  * The new embed package provides access to files embedded in the
    program during compilation using the new //go:embed directive.
  * The new io/fs package defines the fs.FS interface, an
    abstraction for read-only trees of files. The standard library
    packages have been adapted to make use of the interface as
    appropriate.
  * For testing code that implements fs.FS, the new testing/fstest
    package provides a TestFS function that checks for and reports
    common mistakes. It also provides a simple in-memory file
    system implementation, MapFS, which can be useful for testing
    code that accepts fs.FS implementations.
  * syscall: On Linux, Setgid, Setuid, and related calls are now
    implemented. Previously, they returned an syscall.EOPNOTSUPP
    error. On Linux, the new functions AllThreadsSyscall and
    AllThreadsSyscall6 may be used to make a system call on all Go
    threads in the process. These functions may only be used by
    programs that do not use cgo; if a program uses cgo, they will
    always return syscall.ENOTSUP.
  * time/tzdata: The slim timezone data format is now used for the
    timezone database in $GOROOT/lib/time/zoneinfo.zip and the
    embedded copy in this package. This reduces the size of the
    timezone database by about 350 KB.</changelog>
  <changelog author="jkowalczyk@suse.com" date="1613649600">- gcc6-go.patch fix typo go-7 to go-6 for bootstrap on SLE-12 gcc6</changelog>
  <changelog author="jkowalczyk@suse.com" date="1615377600">- go1.16.1 (released 2021-03-10) includes security fixes to the
  archive/zip and encoding/xml packages.
  CVE-2021-27918 CVE-2021-27919
  Refs boo#1182345 go1.16 release tracking
  * boo#1183333 CVE-2021-27918
  * go#44915 encoding/xml: infinite loop when using `xml.NewTokenDecoder` with a custom `TokenReader`
  * boo#1183334 CVE-2021-27919
  * go#44917 archive/zip: can panic when calling Reader.Open</changelog>
  <changelog author="jkowalczyk@suse.com" date="1615550400">- go1.16.2 (released 2021-03-11) includes fixes to cgo, the
  compiler, linker, the go command, and the syscall and time
  packages.
  Refs boo#1182345 go1.16 release tracking
  * go#44793 cmd/go: mod tidy should ignore missing standard library packages
  * go#44746 cmd/go: improve error message when outside a module from "working directory is not part of a module"
  * go#44676 cmd/go: warning message when getting a retracted module version is missing a trailing newline
  * go#44659 runtime: marked free object in span
  * go#44647 cmd/go: "malformed import path" in Go 1.16 for packages with path elements containing a leading dot
  * go#44638 cmd/link: runtime crash, unexpected fault address 0xffffffffffffffff, h2_bundle.go, when using plugin
  * go#44618 time: LoadLocationFromTZData with slim tzdata uses incorrect zone
  * go#44593 syscall &amp; x/sys/windows: buffer overflow in GetQueuedCompletionStatus
  * go#44498 cmd/go: 'go mod edit -exclude' erroneously rejects '+incompatible' versions
  * go#44496 cmd/go: malformed module path with retract v2+
  * go#44464 cmd/compile: ICE on deferred call to syscall.LazyDLL.Call
  * go#44462 x/tools/go/analysis, syscall: ptrace redeclared in this block
  * go#44433 cmd/compile: Compiler regression in Go 1.16 - internal compiler error: child dcl collision on symbol
  * go#44402 doc: Broken image in readme
  * go#44358 cmd/compile: internal compiler error: Value live at entry. It shouldn't be.
  * go#44346 runtime/cgo: cannot build with -Wsign-compare</changelog>
  <changelog author="jkowalczyk@suse.com" date="1617364800">- go1.16.3 (released 2021-04-01) includes fixes to the compiler,
  linker, runtime, the go command, and the testing and time
  packages.
  Refs boo#1182345 go1.16 release tracking
  * go#45303 runtime: "invalid pc-encoded table" throw caused by bad cgo traceback
  * go#45253 cmd/compile: fix long RMW bit operations on AMD64
  * go#45240 all: run.{bash,bat,rc} sets GOPATH inconsistently
  * go#45192 Strange behaviour with loops
  * go#45030 cmd/link: go 1.16 plugin does not initialize global variables correctly when not used directly
  * go#44888 testing: Helper line number has changed in 1.16
  * go#44885 cmd/go: import paths ending with '+' are rejected (affects executable like g++ or clang++)
  * go#44869 time, runtime: zero duration timer takes 2 minutes to fire
  * go#44860 cmd/go: documentation at golang.org for cmd/go has confusing formatting
  * go#44812 cmd/go: 'go get' does not add missing hash to go.sum when ziphash file missing from cache
  * go#44640 cmd/link: fail to build when using time/tzdata on ARM</changelog>
  <changelog author="jkowalczyk@suse.com" date="1620388800">- go1.16.4 (released 2021-05-06) includes a security fix to the
  net/http package, as well as bug fixes to the runtime, the
  compiler, and the archive/zip, time, and syscall packages.
  CVE-2021-31525
  Refs boo#1182345 go1.16 release tracking
  * boo#1185790 CVE-2021-31525
  * go#45712 net/http: ReadRequest can stack overflow
  * go#45636 cmd/compile: internal compiler error: Invalid PPC64 rotate mask
  * go#45482 runtime: "invalid pc-encoded table" throw caused by bad cgo traceback (expandFinalInlineFrames)
  * go#45385 time: Europe/Dublin timezone handling broken with embedded timezone database
  * go#45347 archive/zip: duplicate entries in FS interface
  * go#45307 os/signal: timeout in TestAllThreadsSyscallSignals</changelog>
  <changelog author="jkowalczyk@suse.com" date="1622721600">- go1.16.5 (released 2021-06-03) includes security fixes to the
  archive/zip, math/big, net, and net/http/httputil packages, as
  well as bug fixes to the linker, the go command, and the net/http
  package.
  CVE-2021-33195 CVE-2021-33196 CVE-2021-33197 CVE-2021-33198
  Refs boo#1182345 go1.16 release tracking
  * boo#1187443 go#46241 CVE-2021-33195
  * go#46357 net: Lookup functions may return invalid host names
  * go#46530 net: Unix dnsclient test for CVE-2021-33195 assumes that 1.2.3.4 does not resolve
  * boo#1186622 go#46242 CVE-2021-33196
  * go#46397 archive/zip: malformed archive may cause panic or memory exhaustion
  * boo#1187444 go#46313 CVE-2021-33197
  * go#46315 net/http/httputil: ReverseProxy forwards Connection headers if first one is empty
  * boo#1187445 go#45910 CVE-2021-33198
  * go#46306 math/big: (*Rat).SetString with "1.770p02041010010011001001" crashes with "makeslice: len out of range"
  * go#46214 cmd/go: make go mod download with no arguments leave go.sum alone
  * go#46144 cmd/go: error out of 'go mod tidy' if the go.mod file specifies a newer-than-supported Go version
  * go#46128 cmd/link: internal error when externally linking very large binaries
  * go#45927 cmd/link: SIGSEGV running 'openshift-install version' for release-4.8 using external linking on PPC64LE
  * go#45832 cmd/link: unexpected trampoline when cross-compiling to ppc64le</changelog>
  <changelog author="jkowalczyk@suse.com" date="1623326400">- Fix extraneous trailing percent character %endif% in spec file.</changelog>
  <changelog author="jkowalczyk@suse.com" date="1626091200">- go1.16.6 (released 2021-07-12) includes a security fix to the
  crypto/tls package, as well as bug fixes to the compiler, and the
  net and net/http packages.
  CVE-2021-34558
  Refs boo#1182345 go1.16 release tracking
  * boo#1188229 go#47143 CVE-2021-34558
  * go#47145 security: fix CVE-2021-34558
  * go#46999 net: LookupMX behaviour broken
  * go#46981 net: TestCVE202133195 fails if /etc/resolv.conf specifies ndots larger than 3
  * go#46769 syscall: TestGroupCleanupUserNamespace test failure on Fedora
  * go#46657 runtime: deeply nested struct initialized with non-zero values
  * go#44984 net/http: server not setting Content-Length in certain cases</changelog>
  <changelog author="fvogt@suse.com" date="1626696000">- Add patch to fix crashes on PowerPC with kernel &gt;= 5.13:
  * fix-ppc64-crashes.patch</changelog>
  <changelog author="jkowalczyk@suse.com" date="1628164800">- Drop patch to fix crashes on PowerPC with kernel &gt;= 5.13, fixed
  in next upstream release:
  * drop fix-ppc64-crashes.patch</changelog>
  <changelog author="jkowalczyk@suse.com" date="1628164801">- go1.16.7 (released 2021-08-05) includes a security fix to the
  net/http/httputil package, as well as bug fixes to the compiler,
  the linker, the runtime, the go command, and the net/http
  package.
  CVE-2021-36221
  Refs boo#1182345 go1.16 release tracking
  * boo#1189162 go#46866 CVE-2021-36221
  * go#47474 net/http: panic due to racy read of persistConn after handler panic
  * go#47348 cmd/go: "go list -f '{{.Stale}}'" stack overflow with cyclic imports
  * go#47332 time: Timer reset broken under heavy use since go1.16 timer optimizations added
  * go#47289 cmd/link: build error with cgo in Windows, redefinition of go.map.zero
  * go#47015 cmd/go: go mod vendor: open C:\Users\LICENSE: Access is denied.
  * go#46928 cmd/compile: register conflict between external linker and duffzero on arm64
  * go#46858 runtime: ppc64x binaries randomly segfault on linux 5.13rc6
  * go#46551 cmd/go: unhelpful error message when running "go install" on a replaced-but-not-required package</changelog>
  <changelog author="jkowalczyk@suse.com" date="1628769600">- Add bash scripts used by go tool commands to provide a more
  complete cross-compiling go toolchain install.
  * Fixes "go tool dist list" error "all.bash does not exist"
  * Added to packaging:
    /usr/lib64/go/1.16/lib/time/update.bash (already packaged)
    /usr/lib64/go/1.16/src/all.bash
    /usr/lib64/go/1.16/src/bootstrap.bash
    /usr/lib64/go/1.16/src/buildall.bash
    /usr/lib64/go/1.16/src/clean.bash
    /usr/lib64/go/1.16/src/cmp.bash
    /usr/lib64/go/1.16/src/make.bash
    /usr/lib64/go/1.16/src/race.bash
    /usr/lib64/go/1.16/src/run.bash
    /usr/share/go/1.16/src/all.bash
    /usr/share/go/1.16/src/bootstrap.bash
    /usr/share/go/1.16/src/buildall.bash
    /usr/share/go/1.16/src/clean.bash
    /usr/share/go/1.16/src/cmd/compile/internal/ssa/gen/cover.bash
    /usr/share/go/1.16/src/cmd/vendor/golang.org/x/sys/windows/mkerrors.bash
    /usr/share/go/1.16/src/cmd/vendor/golang.org/x/sys/windows/mkknownfolderids.bash
    /usr/share/go/1.16/src/cmp.bash
    /usr/share/go/1.16/src/internal/trace/mkcanned.bash
    /usr/share/go/1.16/src/make.bash
    /usr/share/go/1.16/src/race.bash
    /usr/share/go/1.16/src/run.bash</changelog>
  <changelog author="jkowalczyk@suse.com" date="1631275200">- go1.16.8 (released 2021-09-09) includes a security fix to the
  archive/zip package, as well as bug fixes to the archive/zip,
  go/internal/gccgoimporter, html/template, net/http, and
  runtime/pprof packages.
  Refs boo#1182345 go1.16 release tracking
  CVE-2021-39293
  * boo#1190589 go#47801 CVE-2021-39293
  * go#47985 archive/zip: overflow in preallocation check can cause OOM panic
  * go#47691 x/net/http2: server sends RST_STREAM w/ PROTOCOL_ERROR to clients it incorrectly believes have violated max advertised num streams
  * go#47675 runtime/pprof: apparent deadlock in TestGoroutineSwitch on linux-armv6l
  * go#47610 go/internal/gccgoimporter: TestInstallationImporter broken with tip gccgo
  * go#47535 net/http: TestCancelRequestWhenSharingConnection can cause port exhaustion
  * go#47042 html/template: data race with concurrent ExecuteTemplate calls</changelog>
  <changelog author="jkowalczyk@suse.com" date="1633694400">- go1.16.9 (released 2021-10-07) includes a security fix to the
  linker and misc/wasm directory, as well as bug fixes to the
  runtime and to the text/template package.
  Refs boo#1182345 go1.16 release tracking
  CVE-2021-38297
  * boo#1191468 go#48797 CVE-2021-38297
  * go#48799 security: fix CVE-2021-38297 misc/wasm, cmd/link: do not let command line args overwrite global data
  * go#48443 text/template: should t.init() be executed before t.muTmpl.Lock() in AddParseTree() method?
  * go#47858 time: timer reset sometimes ignored, causing delayed ticks</changelog>
  <changelog author="jkowalczyk@suse.com" date="1636027200">- go1.16.10 (released 2021-11-04) includes security fixes to the
  archive/zip and debug/macho packages, as well as bug fixes to the
  compiler, linker, runtime, the misc/wasm directory, and to the
  net/http package.
  Refs boo#1182345 go1.16 release tracking
  CVE-2021-41771 CVE-2021-41772
  * boo#1192377 go#48990 CVE-2021-41771
  * go#48991 debug/macho: invalid dynamic symbol table command can cause panic
  * boo#1192378 go#48085 CVE-2021-41772
  * go#48251 archive/zip: Reader.Open panics on empty string
  * go#49153 misc/wasm, cmd/link: Go 1.17.2 causes WASM builds to throw command line too long with many environment variables
  * go#49076 x/net/http2: backport critical fixes
  * go#49009 net,runtime: apparent deadlock in (*net.conn).Close and runtime.netpollblock on arm64 platforms
  * go#48822 x/net/http2: client can hang forever if headers' size exceeds connection's buffer size and server hangs past request time
  * go#48649 x/net/http2: pool deadlock
  * go#48478 cmd/compile: 64 bits shifts on arm get wrong results
  * go#48474 cmd/compile: incorrect arm/arm64 simplification rules</changelog>
  <changelog author="jkowalczyk@suse.com" date="1638532800">- go1.16.11 (released 2021-12-02) includes fixes to the compiler,
  runtime, and the net/http, net/http/httptest, and time packages.
  Refs boo#1182345 go1.16 release tracking
  * go#49910 x/net/http2: frequent failures in TestClientConnCloseAtBody
  * go#49908 x/net/ipv6: TestPacketConnReadWriteMulticast{UDP,ICMP} failing with "i/o timeout" on OpenBSD 6.8 and 7.0
  * go#49904 x/net/http2: Client doesn't send body until ExpectContinueTimeout expires
  * go#49867 syscall: ntdll.dll errors in rtlGetNtVersionNumbers via os.StartProcess
  * go#49851 net/http/httptest: Close does not wait for the underlying Server's ConnState callbacks to complete
  * go#49728 runtime: "fatal error: unexpected signal during runtime execution" in cmd/go tests on darwin-amd64-race running macOS 12.0
  * go#49661 x/net/http2: TestUnreadFlowControlReturned_Server failures with stream error "NO_ERROR" since 2021-10-05
  * go#49623 net/http: Possible HTTP/2 busy loop regression in Go 1.17.3
  * go#49567 net/http: server responds with Transfer-Encoding: identity
  * go#49560 x/net/http2: setting Request.Close doesn't close TCP connections
  * go#49558 net/http: HTTP/2 response body Close method sometimes returns spurious context cancelation error (1.17.3 regression)
  * go#49406 time: ParseInLocation error
  * go#49391 cmd/compile: internal compiler error: Expand calls interface data problem</changelog>
  <changelog author="jkowalczyk@suse.com" date="1639051200">- go1.16.12 (released 2021-12-09) includes security fixes to the
  syscall and net/http packages.
  Refs boo#1182345 go1.16 release tracking
  CVE-2021-44716 CVE-2021-44717
  * boo#1193598 go#50057 CVE-2021-44717
  * go#50066 syscall: don?t close fd 0 on ForkExec error
  * boo#1193597 go#50058 CVE-2021-44716
  * go#50064 net/http: limit growth of header canonicalization cache</changelog>
  <changelog author="jkowalczyk@suse.com" date="1641470400">- go1.16.13 (released 2022-01-06) includes fixes to the compiler,
  linker, runtime, and the net/http package.
  Refs boo#1182345 go1.16 release tracking
  * go#50449 x/net/http2: http.Server.WriteTimeout does not fire if the http2 stream's window is out of space.
  * go#50296 cmd/link: does not set section type of .init_array correctly
  * go#50194 runtime/race: building for iOS, but linking in object file built for macOS
  * go#50072 runtime: race detector SIGABRT or SIGSEGV on macOS Monterey
  * go#49923 cmd/link: support more load commands on Mach-O
  * go#49412 cmd/compile: internal compiler error: Op...LECall and OpDereference have mismatched mem
  * go#48115 runtime: mallocs cause "base outside usable address space" panic when running on iOS 14</changelog>
</package>
<package pkgid="fcf944d2ffb1a0c0446643f0a9c6b6a950d6d8f5cb0dcf274174df4cc4ad01a3" name="go1.16" arch="src">
  <version epoch="0" ver="1.16.13" rel="1.40.1"/>
  <changelog author="jkowalczyk@suse.com" date="1611835200">- go1.16rc1 (released 2021-01-28) is a release candidate of go1.16
  cut from the master branch at the revision tagged go1.16rc1.</changelog>
  <changelog author="jkowalczyk@suse.com" date="1613476800">- go1.16 (released 2021-02-16) Go 1.16 is a major release of Go.
  go1.16.x minor releases will be provided through February 2022.
  https://github.com/golang/go/wiki/Go-Release-Cycle
  Most changes are in the implementation of the toolchain, runtime,
  and libraries. As always, the release maintains the Go 1 promise
  of compatibility. We expect almost all Go programs to continue to
  compile and run as before.
  Refs boo#1182345 go1.16 release tracking
  * See release notes https://golang.org/doc/go1.16. Excerpts
    relevant to OBS environment and for SUSE/openSUSE follow:
  * Module-aware mode is enabled by default, regardless of whether
    a go.mod file is present in the current working directory or a
    parent directory. More precisely, the GO111MODULE environment
    variable now defaults to on. To switch to the previous
    behavior, set GO111MODULE to auto.
  * Build commands like go build and go test no longer modify
    go.mod and go.sum by default. Instead, they report an error if
    a module requirement or checksum needs to be added or updated
    (as if the -mod=readonly flag were used). Module requirements
    and sums may be adjusted with go mod tidy or go get.
  * go install now accepts arguments with version suffixes (for
    example, go install example.com/cmd@v1.0.0). This causes go
    install to build and install packages in module-aware mode,
    ignoring the go.mod file in the current directory or any parent
    directory, if there is one. This is useful for installing
    executables without affecting the dependencies of the main
    module.
  * go install, with or without a version suffix (as described
    above), is now the recommended way to build and install
    packages in module mode. go get should be used with the -d flag
    to adjust the current module's dependencies without building
    packages, and use of go get to build and install packages is
    deprecated. In a future release, the -d flag will always be
    enabled.
  * retract directives may now be used in a go.mod file to indicate
    that certain published versions of the module should not be
    used by other modules. A module author may retract a version
    after a severe problem is discovered or if the version was
    published unintentionally.
  * The go mod vendor and go mod tidy subcommands now accept the -e
    flag, which instructs them to proceed despite errors in
    resolving missing packages.
  * The go command now ignores requirements on module versions
    excluded by exclude directives in the main module. Previously,
    the go command used the next version higher than an excluded
    version, but that version could change over time, resulting in
    non-reproducible builds.
  * In module mode, the go command now disallows import paths that
    include non-ASCII characters or path elements with a leading
    dot character (.). Module paths with these characters were
    already disallowed (see Module paths and versions), so this
    change affects only paths within module subdirectories.
  * The go command now supports including static files and file
    trees as part of the final executable, using the new //go:embed
    directive. See the documentation for the new embed package for
    details.
  * When using go test, a test that calls os.Exit(0) during
    execution of a test function will now be considered to
    fail. This will help catch cases in which a test calls code
    that calls os.Exit(0) and thereby stops running all future
    tests. If a TestMain function calls os.Exit(0) that is still
    considered to be a passing test.
  * go test reports an error when the -c or -i flags are used
    together with unknown flags. Normally, unknown flags are passed
    to tests, but when -c or -i are used, tests are not run.
  * The go get -insecure flag is deprecated and will be removed in
    a future version. This flag permits fetching from repositories
    and resolving custom domains using insecure schemes such as
    HTTP, and also bypasses module sum validation using the
    checksum database. To permit the use of insecure schemes, use
    the GOINSECURE environment variable instead. To bypass module
    sum validation, use GOPRIVATE or GONOSUMDB. See go help
    environment for details.
  * go get example.com/mod@patch now requires that some version of
    example.com/mod already be required by the main
    module. (However, go get -u=patch continues to patch even
    newly-added dependencies.)
  * GOVCS is a new environment variable that limits which version
    control tools the go command may use to download source
    code. This mitigates security issues with tools that are
    typically used in trusted, authenticated environments. By
    default, git and hg may be used to download code from any
    repository. svn, bzr, and fossil may only be used to download
    code from repositories with module paths or package paths
    matching patterns in the GOPRIVATE environment variable. See go
    help vcs for details.
  * When the main module's go.mod file declares go 1.16 or higher,
    the all package pattern now matches only those packages that
    are transitively imported by a package or test found in the
    main module. (Packages imported by tests of packages imported
    by the main module are no longer included.) This is the same
    set of packages retained by go mod vendor since Go 1.11.
  * When the -toolexec build flag is specified to use a program
    when invoking toolchain programs like compile or asm, the
    environment variable TOOLEXEC_IMPORTPATH is now set to the
    import path of the package being built.
  * The -i flag accepted by go build, go install, and go test is
    now deprecated. The -i flag instructs the go command to install
    packages imported by packages named on the command line. Since
    the build cache was introduced in Go 1.10, the -i flag no
    longer has a significant effect on build times, and it causes
    errors when the install directory is not writable.
  * When the -export flag is specified, the BuildID field is now
    set to the build ID of the compiled package. This is equivalent
    to running go tool buildid on go list -exported -f {{.Export}},
    but without the extra step.
  * The -overlay flag specifies a JSON configuration file
    containing a set of file path replacements. The -overlay flag
    may be used with all build commands and go mod subcommands. It
    is primarily intended to be used by editor tooling such as
    gopls to understand the effects of unsaved changes to source
    files. The config file maps actual file paths to replacement
    file paths and the go command and its builds will run as if the
    actual file paths exist with the contents given by the
    replacement file paths, or don't exist if the replacement file
    paths are empty.
  * The cgo tool will no longer try to translate C struct bitfields
    into Go struct fields, even if their size can be represented in
    Go. The order in which C bitfields appear in memory is
    implementation dependent, so in some cases the cgo tool
    produced results that were silently incorrect.
  * The linux/riscv64 port now supports cgo and -buildmode=pie.
    This release also includes performance optimizations and code
    generation improvements for RISC-V.
  * The new runtime/metrics package introduces a stable interface
    for reading implementation-defined metrics from the Go
    runtime. It supersedes existing functions like
    runtime.ReadMemStats and debug.GCStats and is significantly
    more general and efficient. See the package documentation for
    more details.
  * Setting the GODEBUG environment variable to inittrace=1 now
    causes the runtime to emit a single line to standard error for
    each package init, summarizing its execution time and memory
    allocation. This trace can be used to find bottlenecks or
    regressions in Go startup performance. The GODEBUG
    documentation describes the format.
  * On Linux, the runtime now defaults to releasing memory to the
    operating system promptly (using MADV_DONTNEED), rather than
    lazily when the operating system is under memory pressure
    (using MADV_FREE). This means process-level memory statistics
    like RSS will more accurately reflect the amount of physical
    memory being used by Go processes. Systems that are currently
    using GODEBUG=madvdontneed=1 to improve memory monitoring
    behavior no longer need to set this environment variable.
  * Go 1.16 fixes a discrepancy between the race detector and the
    Go memory model. The race detector now more precisely follows
    the channel synchronization rules of the memory model. As a
    result, the detector may now report races it previously missed.
  * linker: This release includes additional improvements to the Go
    linker, reducing linker resource usage (both time and memory)
    and improving code robustness/maintainability. These changes
    form the second half of a two-release project to modernize the
    Go linker.
  * The linker changes in 1.16 extend the 1.15 improvements to all
    supported architecture/OS combinations (the 1.15 performance
    improvements were primarily focused on ELF-based OSes and amd64
    architectures). For a representative set of large Go programs,
    linking is 20-25% faster than 1.15 and requires 5-15% less
    memory on average for linux/amd64, with larger improvements for
    other architectures and OSes. Most binaries are also smaller as
    a result of more aggressive symbol pruning.
  * The new embed package provides access to files embedded in the
    program during compilation using the new //go:embed directive.
  * The new io/fs package defines the fs.FS interface, an
    abstraction for read-only trees of files. The standard library
    packages have been adapted to make use of the interface as
    appropriate.
  * For testing code that implements fs.FS, the new testing/fstest
    package provides a TestFS function that checks for and reports
    common mistakes. It also provides a simple in-memory file
    system implementation, MapFS, which can be useful for testing
    code that accepts fs.FS implementations.
  * syscall: On Linux, Setgid, Setuid, and related calls are now
    implemented. Previously, they returned an syscall.EOPNOTSUPP
    error. On Linux, the new functions AllThreadsSyscall and
    AllThreadsSyscall6 may be used to make a system call on all Go
    threads in the process. These functions may only be used by
    programs that do not use cgo; if a program uses cgo, they will
    always return syscall.ENOTSUP.
  * time/tzdata: The slim timezone data format is now used for the
    timezone database in $GOROOT/lib/time/zoneinfo.zip and the
    embedded copy in this package. This reduces the size of the
    timezone database by about 350 KB.</changelog>
  <changelog author="jkowalczyk@suse.com" date="1613649600">- gcc6-go.patch fix typo go-7 to go-6 for bootstrap on SLE-12 gcc6</changelog>
  <changelog author="jkowalczyk@suse.com" date="1615377600">- go1.16.1 (released 2021-03-10) includes security fixes to the
  archive/zip and encoding/xml packages.
  CVE-2021-27918 CVE-2021-27919
  Refs boo#1182345 go1.16 release tracking
  * boo#1183333 CVE-2021-27918
  * go#44915 encoding/xml: infinite loop when using `xml.NewTokenDecoder` with a custom `TokenReader`
  * boo#1183334 CVE-2021-27919
  * go#44917 archive/zip: can panic when calling Reader.Open</changelog>
  <changelog author="jkowalczyk@suse.com" date="1615550400">- go1.16.2 (released 2021-03-11) includes fixes to cgo, the
  compiler, linker, the go command, and the syscall and time
  packages.
  Refs boo#1182345 go1.16 release tracking
  * go#44793 cmd/go: mod tidy should ignore missing standard library packages
  * go#44746 cmd/go: improve error message when outside a module from "working directory is not part of a module"
  * go#44676 cmd/go: warning message when getting a retracted module version is missing a trailing newline
  * go#44659 runtime: marked free object in span
  * go#44647 cmd/go: "malformed import path" in Go 1.16 for packages with path elements containing a leading dot
  * go#44638 cmd/link: runtime crash, unexpected fault address 0xffffffffffffffff, h2_bundle.go, when using plugin
  * go#44618 time: LoadLocationFromTZData with slim tzdata uses incorrect zone
  * go#44593 syscall &amp; x/sys/windows: buffer overflow in GetQueuedCompletionStatus
  * go#44498 cmd/go: 'go mod edit -exclude' erroneously rejects '+incompatible' versions
  * go#44496 cmd/go: malformed module path with retract v2+
  * go#44464 cmd/compile: ICE on deferred call to syscall.LazyDLL.Call
  * go#44462 x/tools/go/analysis, syscall: ptrace redeclared in this block
  * go#44433 cmd/compile: Compiler regression in Go 1.16 - internal compiler error: child dcl collision on symbol
  * go#44402 doc: Broken image in readme
  * go#44358 cmd/compile: internal compiler error: Value live at entry. It shouldn't be.
  * go#44346 runtime/cgo: cannot build with -Wsign-compare</changelog>
  <changelog author="jkowalczyk@suse.com" date="1617364800">- go1.16.3 (released 2021-04-01) includes fixes to the compiler,
  linker, runtime, the go command, and the testing and time
  packages.
  Refs boo#1182345 go1.16 release tracking
  * go#45303 runtime: "invalid pc-encoded table" throw caused by bad cgo traceback
  * go#45253 cmd/compile: fix long RMW bit operations on AMD64
  * go#45240 all: run.{bash,bat,rc} sets GOPATH inconsistently
  * go#45192 Strange behaviour with loops
  * go#45030 cmd/link: go 1.16 plugin does not initialize global variables correctly when not used directly
  * go#44888 testing: Helper line number has changed in 1.16
  * go#44885 cmd/go: import paths ending with '+' are rejected (affects executable like g++ or clang++)
  * go#44869 time, runtime: zero duration timer takes 2 minutes to fire
  * go#44860 cmd/go: documentation at golang.org for cmd/go has confusing formatting
  * go#44812 cmd/go: 'go get' does not add missing hash to go.sum when ziphash file missing from cache
  * go#44640 cmd/link: fail to build when using time/tzdata on ARM</changelog>
  <changelog author="jkowalczyk@suse.com" date="1620388800">- go1.16.4 (released 2021-05-06) includes a security fix to the
  net/http package, as well as bug fixes to the runtime, the
  compiler, and the archive/zip, time, and syscall packages.
  CVE-2021-31525
  Refs boo#1182345 go1.16 release tracking
  * boo#1185790 CVE-2021-31525
  * go#45712 net/http: ReadRequest can stack overflow
  * go#45636 cmd/compile: internal compiler error: Invalid PPC64 rotate mask
  * go#45482 runtime: "invalid pc-encoded table" throw caused by bad cgo traceback (expandFinalInlineFrames)
  * go#45385 time: Europe/Dublin timezone handling broken with embedded timezone database
  * go#45347 archive/zip: duplicate entries in FS interface
  * go#45307 os/signal: timeout in TestAllThreadsSyscallSignals</changelog>
  <changelog author="jkowalczyk@suse.com" date="1622721600">- go1.16.5 (released 2021-06-03) includes security fixes to the
  archive/zip, math/big, net, and net/http/httputil packages, as
  well as bug fixes to the linker, the go command, and the net/http
  package.
  CVE-2021-33195 CVE-2021-33196 CVE-2021-33197 CVE-2021-33198
  Refs boo#1182345 go1.16 release tracking
  * boo#1187443 go#46241 CVE-2021-33195
  * go#46357 net: Lookup functions may return invalid host names
  * go#46530 net: Unix dnsclient test for CVE-2021-33195 assumes that 1.2.3.4 does not resolve
  * boo#1186622 go#46242 CVE-2021-33196
  * go#46397 archive/zip: malformed archive may cause panic or memory exhaustion
  * boo#1187444 go#46313 CVE-2021-33197
  * go#46315 net/http/httputil: ReverseProxy forwards Connection headers if first one is empty
  * boo#1187445 go#45910 CVE-2021-33198
  * go#46306 math/big: (*Rat).SetString with "1.770p02041010010011001001" crashes with "makeslice: len out of range"
  * go#46214 cmd/go: make go mod download with no arguments leave go.sum alone
  * go#46144 cmd/go: error out of 'go mod tidy' if the go.mod file specifies a newer-than-supported Go version
  * go#46128 cmd/link: internal error when externally linking very large binaries
  * go#45927 cmd/link: SIGSEGV running 'openshift-install version' for release-4.8 using external linking on PPC64LE
  * go#45832 cmd/link: unexpected trampoline when cross-compiling to ppc64le</changelog>
  <changelog author="jkowalczyk@suse.com" date="1623326400">- Fix extraneous trailing percent character %endif% in spec file.</changelog>
  <changelog author="jkowalczyk@suse.com" date="1626091200">- go1.16.6 (released 2021-07-12) includes a security fix to the
  crypto/tls package, as well as bug fixes to the compiler, and the
  net and net/http packages.
  CVE-2021-34558
  Refs boo#1182345 go1.16 release tracking
  * boo#1188229 go#47143 CVE-2021-34558
  * go#47145 security: fix CVE-2021-34558
  * go#46999 net: LookupMX behaviour broken
  * go#46981 net: TestCVE202133195 fails if /etc/resolv.conf specifies ndots larger than 3
  * go#46769 syscall: TestGroupCleanupUserNamespace test failure on Fedora
  * go#46657 runtime: deeply nested struct initialized with non-zero values
  * go#44984 net/http: server not setting Content-Length in certain cases</changelog>
  <changelog author="fvogt@suse.com" date="1626696000">- Add patch to fix crashes on PowerPC with kernel &gt;= 5.13:
  * fix-ppc64-crashes.patch</changelog>
  <changelog author="jkowalczyk@suse.com" date="1628164800">- Drop patch to fix crashes on PowerPC with kernel &gt;= 5.13, fixed
  in next upstream release:
  * drop fix-ppc64-crashes.patch</changelog>
  <changelog author="jkowalczyk@suse.com" date="1628164801">- go1.16.7 (released 2021-08-05) includes a security fix to the
  net/http/httputil package, as well as bug fixes to the compiler,
  the linker, the runtime, the go command, and the net/http
  package.
  CVE-2021-36221
  Refs boo#1182345 go1.16 release tracking
  * boo#1189162 go#46866 CVE-2021-36221
  * go#47474 net/http: panic due to racy read of persistConn after handler panic
  * go#47348 cmd/go: "go list -f '{{.Stale}}'" stack overflow with cyclic imports
  * go#47332 time: Timer reset broken under heavy use since go1.16 timer optimizations added
  * go#47289 cmd/link: build error with cgo in Windows, redefinition of go.map.zero
  * go#47015 cmd/go: go mod vendor: open C:\Users\LICENSE: Access is denied.
  * go#46928 cmd/compile: register conflict between external linker and duffzero on arm64
  * go#46858 runtime: ppc64x binaries randomly segfault on linux 5.13rc6
  * go#46551 cmd/go: unhelpful error message when running "go install" on a replaced-but-not-required package</changelog>
  <changelog author="jkowalczyk@suse.com" date="1628769600">- Add bash scripts used by go tool commands to provide a more
  complete cross-compiling go toolchain install.
  * Fixes "go tool dist list" error "all.bash does not exist"
  * Added to packaging:
    /usr/lib64/go/1.16/lib/time/update.bash (already packaged)
    /usr/lib64/go/1.16/src/all.bash
    /usr/lib64/go/1.16/src/bootstrap.bash
    /usr/lib64/go/1.16/src/buildall.bash
    /usr/lib64/go/1.16/src/clean.bash
    /usr/lib64/go/1.16/src/cmp.bash
    /usr/lib64/go/1.16/src/make.bash
    /usr/lib64/go/1.16/src/race.bash
    /usr/lib64/go/1.16/src/run.bash
    /usr/share/go/1.16/src/all.bash
    /usr/share/go/1.16/src/bootstrap.bash
    /usr/share/go/1.16/src/buildall.bash
    /usr/share/go/1.16/src/clean.bash
    /usr/share/go/1.16/src/cmd/compile/internal/ssa/gen/cover.bash
    /usr/share/go/1.16/src/cmd/vendor/golang.org/x/sys/windows/mkerrors.bash
    /usr/share/go/1.16/src/cmd/vendor/golang.org/x/sys/windows/mkknownfolderids.bash
    /usr/share/go/1.16/src/cmp.bash
    /usr/share/go/1.16/src/internal/trace/mkcanned.bash
    /usr/share/go/1.16/src/make.bash
    /usr/share/go/1.16/src/race.bash
    /usr/share/go/1.16/src/run.bash</changelog>
  <changelog author="jkowalczyk@suse.com" date="1631275200">- go1.16.8 (released 2021-09-09) includes a security fix to the
  archive/zip package, as well as bug fixes to the archive/zip,
  go/internal/gccgoimporter, html/template, net/http, and
  runtime/pprof packages.
  Refs boo#1182345 go1.16 release tracking
  CVE-2021-39293
  * boo#1190589 go#47801 CVE-2021-39293
  * go#47985 archive/zip: overflow in preallocation check can cause OOM panic
  * go#47691 x/net/http2: server sends RST_STREAM w/ PROTOCOL_ERROR to clients it incorrectly believes have violated max advertised num streams
  * go#47675 runtime/pprof: apparent deadlock in TestGoroutineSwitch on linux-armv6l
  * go#47610 go/internal/gccgoimporter: TestInstallationImporter broken with tip gccgo
  * go#47535 net/http: TestCancelRequestWhenSharingConnection can cause port exhaustion
  * go#47042 html/template: data race with concurrent ExecuteTemplate calls</changelog>
  <changelog author="jkowalczyk@suse.com" date="1633694400">- go1.16.9 (released 2021-10-07) includes a security fix to the
  linker and misc/wasm directory, as well as bug fixes to the
  runtime and to the text/template package.
  Refs boo#1182345 go1.16 release tracking
  CVE-2021-38297
  * boo#1191468 go#48797 CVE-2021-38297
  * go#48799 security: fix CVE-2021-38297 misc/wasm, cmd/link: do not let command line args overwrite global data
  * go#48443 text/template: should t.init() be executed before t.muTmpl.Lock() in AddParseTree() method?
  * go#47858 time: timer reset sometimes ignored, causing delayed ticks</changelog>
  <changelog author="jkowalczyk@suse.com" date="1636027200">- go1.16.10 (released 2021-11-04) includes security fixes to the
  archive/zip and debug/macho packages, as well as bug fixes to the
  compiler, linker, runtime, the misc/wasm directory, and to the
  net/http package.
  Refs boo#1182345 go1.16 release tracking
  CVE-2021-41771 CVE-2021-41772
  * boo#1192377 go#48990 CVE-2021-41771
  * go#48991 debug/macho: invalid dynamic symbol table command can cause panic
  * boo#1192378 go#48085 CVE-2021-41772
  * go#48251 archive/zip: Reader.Open panics on empty string
  * go#49153 misc/wasm, cmd/link: Go 1.17.2 causes WASM builds to throw command line too long with many environment variables
  * go#49076 x/net/http2: backport critical fixes
  * go#49009 net,runtime: apparent deadlock in (*net.conn).Close and runtime.netpollblock on arm64 platforms
  * go#48822 x/net/http2: client can hang forever if headers' size exceeds connection's buffer size and server hangs past request time
  * go#48649 x/net/http2: pool deadlock
  * go#48478 cmd/compile: 64 bits shifts on arm get wrong results
  * go#48474 cmd/compile: incorrect arm/arm64 simplification rules</changelog>
  <changelog author="jkowalczyk@suse.com" date="1638532800">- go1.16.11 (released 2021-12-02) includes fixes to the compiler,
  runtime, and the net/http, net/http/httptest, and time packages.
  Refs boo#1182345 go1.16 release tracking
  * go#49910 x/net/http2: frequent failures in TestClientConnCloseAtBody
  * go#49908 x/net/ipv6: TestPacketConnReadWriteMulticast{UDP,ICMP} failing with "i/o timeout" on OpenBSD 6.8 and 7.0
  * go#49904 x/net/http2: Client doesn't send body until ExpectContinueTimeout expires
  * go#49867 syscall: ntdll.dll errors in rtlGetNtVersionNumbers via os.StartProcess
  * go#49851 net/http/httptest: Close does not wait for the underlying Server's ConnState callbacks to complete
  * go#49728 runtime: "fatal error: unexpected signal during runtime execution" in cmd/go tests on darwin-amd64-race running macOS 12.0
  * go#49661 x/net/http2: TestUnreadFlowControlReturned_Server failures with stream error "NO_ERROR" since 2021-10-05
  * go#49623 net/http: Possible HTTP/2 busy loop regression in Go 1.17.3
  * go#49567 net/http: server responds with Transfer-Encoding: identity
  * go#49560 x/net/http2: setting Request.Close doesn't close TCP connections
  * go#49558 net/http: HTTP/2 response body Close method sometimes returns spurious context cancelation error (1.17.3 regression)
  * go#49406 time: ParseInLocation error
  * go#49391 cmd/compile: internal compiler error: Expand calls interface data problem</changelog>
  <changelog author="jkowalczyk@suse.com" date="1639051200">- go1.16.12 (released 2021-12-09) includes security fixes to the
  syscall and net/http packages.
  Refs boo#1182345 go1.16 release tracking
  CVE-2021-44716 CVE-2021-44717
  * boo#1193598 go#50057 CVE-2021-44717
  * go#50066 syscall: don?t close fd 0 on ForkExec error
  * boo#1193597 go#50058 CVE-2021-44716
  * go#50064 net/http: limit growth of header canonicalization cache</changelog>
  <changelog author="jkowalczyk@suse.com" date="1641470400">- go1.16.13 (released 2022-01-06) includes fixes to the compiler,
  linker, runtime, and the net/http package.
  Refs boo#1182345 go1.16 release tracking
  * go#50449 x/net/http2: http.Server.WriteTimeout does not fire if the http2 stream's window is out of space.
  * go#50296 cmd/link: does not set section type of .init_array correctly
  * go#50194 runtime/race: building for iOS, but linking in object file built for macOS
  * go#50072 runtime: race detector SIGABRT or SIGSEGV on macOS Monterey
  * go#49923 cmd/link: support more load commands on Mach-O
  * go#49412 cmd/compile: internal compiler error: Op...LECall and OpDereference have mismatched mem
  * go#48115 runtime: mallocs cause "base outside usable address space" panic when running on iOS 14</changelog>
</package>
<package pkgid="fbfcfdef7a6d4039c808318333b4197e999c685565f8c6180d620fffc09cb457" name="go1.16" arch="x86_64">
  <version epoch="0" ver="1.16.13" rel="1.40.1"/>
  <changelog author="jkowalczyk@suse.com" date="1611835200">- go1.16rc1 (released 2021-01-28) is a release candidate of go1.16
  cut from the master branch at the revision tagged go1.16rc1.</changelog>
  <changelog author="jkowalczyk@suse.com" date="1613476800">- go1.16 (released 2021-02-16) Go 1.16 is a major release of Go.
  go1.16.x minor releases will be provided through February 2022.
  https://github.com/golang/go/wiki/Go-Release-Cycle
  Most changes are in the implementation of the toolchain, runtime,
  and libraries. As always, the release maintains the Go 1 promise
  of compatibility. We expect almost all Go programs to continue to
  compile and run as before.
  Refs boo#1182345 go1.16 release tracking
  * See release notes https://golang.org/doc/go1.16. Excerpts
    relevant to OBS environment and for SUSE/openSUSE follow:
  * Module-aware mode is enabled by default, regardless of whether
    a go.mod file is present in the current working directory or a
    parent directory. More precisely, the GO111MODULE environment
    variable now defaults to on. To switch to the previous
    behavior, set GO111MODULE to auto.
  * Build commands like go build and go test no longer modify
    go.mod and go.sum by default. Instead, they report an error if
    a module requirement or checksum needs to be added or updated
    (as if the -mod=readonly flag were used). Module requirements
    and sums may be adjusted with go mod tidy or go get.
  * go install now accepts arguments with version suffixes (for
    example, go install example.com/cmd@v1.0.0). This causes go
    install to build and install packages in module-aware mode,
    ignoring the go.mod file in the current directory or any parent
    directory, if there is one. This is useful for installing
    executables without affecting the dependencies of the main
    module.
  * go install, with or without a version suffix (as described
    above), is now the recommended way to build and install
    packages in module mode. go get should be used with the -d flag
    to adjust the current module's dependencies without building
    packages, and use of go get to build and install packages is
    deprecated. In a future release, the -d flag will always be
    enabled.
  * retract directives may now be used in a go.mod file to indicate
    that certain published versions of the module should not be
    used by other modules. A module author may retract a version
    after a severe problem is discovered or if the version was
    published unintentionally.
  * The go mod vendor and go mod tidy subcommands now accept the -e
    flag, which instructs them to proceed despite errors in
    resolving missing packages.
  * The go command now ignores requirements on module versions
    excluded by exclude directives in the main module. Previously,
    the go command used the next version higher than an excluded
    version, but that version could change over time, resulting in
    non-reproducible builds.
  * In module mode, the go command now disallows import paths that
    include non-ASCII characters or path elements with a leading
    dot character (.). Module paths with these characters were
    already disallowed (see Module paths and versions), so this
    change affects only paths within module subdirectories.
  * The go command now supports including static files and file
    trees as part of the final executable, using the new //go:embed
    directive. See the documentation for the new embed package for
    details.
  * When using go test, a test that calls os.Exit(0) during
    execution of a test function will now be considered to
    fail. This will help catch cases in which a test calls code
    that calls os.Exit(0) and thereby stops running all future
    tests. If a TestMain function calls os.Exit(0) that is still
    considered to be a passing test.
  * go test reports an error when the -c or -i flags are used
    together with unknown flags. Normally, unknown flags are passed
    to tests, but when -c or -i are used, tests are not run.
  * The go get -insecure flag is deprecated and will be removed in
    a future version. This flag permits fetching from repositories
    and resolving custom domains using insecure schemes such as
    HTTP, and also bypasses module sum validation using the
    checksum database. To permit the use of insecure schemes, use
    the GOINSECURE environment variable instead. To bypass module
    sum validation, use GOPRIVATE or GONOSUMDB. See go help
    environment for details.
  * go get example.com/mod@patch now requires that some version of
    example.com/mod already be required by the main
    module. (However, go get -u=patch continues to patch even
    newly-added dependencies.)
  * GOVCS is a new environment variable that limits which version
    control tools the go command may use to download source
    code. This mitigates security issues with tools that are
    typically used in trusted, authenticated environments. By
    default, git and hg may be used to download code from any
    repository. svn, bzr, and fossil may only be used to download
    code from repositories with module paths or package paths
    matching patterns in the GOPRIVATE environment variable. See go
    help vcs for details.
  * When the main module's go.mod file declares go 1.16 or higher,
    the all package pattern now matches only those packages that
    are transitively imported by a package or test found in the
    main module. (Packages imported by tests of packages imported
    by the main module are no longer included.) This is the same
    set of packages retained by go mod vendor since Go 1.11.
  * When the -toolexec build flag is specified to use a program
    when invoking toolchain programs like compile or asm, the
    environment variable TOOLEXEC_IMPORTPATH is now set to the
    import path of the package being built.
  * The -i flag accepted by go build, go install, and go test is
    now deprecated. The -i flag instructs the go command to install
    packages imported by packages named on the command line. Since
    the build cache was introduced in Go 1.10, the -i flag no
    longer has a significant effect on build times, and it causes
    errors when the install directory is not writable.
  * When the -export flag is specified, the BuildID field is now
    set to the build ID of the compiled package. This is equivalent
    to running go tool buildid on go list -exported -f {{.Export}},
    but without the extra step.
  * The -overlay flag specifies a JSON configuration file
    containing a set of file path replacements. The -overlay flag
    may be used with all build commands and go mod subcommands. It
    is primarily intended to be used by editor tooling such as
    gopls to understand the effects of unsaved changes to source
    files. The config file maps actual file paths to replacement
    file paths and the go command and its builds will run as if the
    actual file paths exist with the contents given by the
    replacement file paths, or don't exist if the replacement file
    paths are empty.
  * The cgo tool will no longer try to translate C struct bitfields
    into Go struct fields, even if their size can be represented in
    Go. The order in which C bitfields appear in memory is
    implementation dependent, so in some cases the cgo tool
    produced results that were silently incorrect.
  * The linux/riscv64 port now supports cgo and -buildmode=pie.
    This release also includes performance optimizations and code
    generation improvements for RISC-V.
  * The new runtime/metrics package introduces a stable interface
    for reading implementation-defined metrics from the Go
    runtime. It supersedes existing functions like
    runtime.ReadMemStats and debug.GCStats and is significantly
    more general and efficient. See the package documentation for
    more details.
  * Setting the GODEBUG environment variable to inittrace=1 now
    causes the runtime to emit a single line to standard error for
    each package init, summarizing its execution time and memory
    allocation. This trace can be used to find bottlenecks or
    regressions in Go startup performance. The GODEBUG
    documentation describes the format.
  * On Linux, the runtime now defaults to releasing memory to the
    operating system promptly (using MADV_DONTNEED), rather than
    lazily when the operating system is under memory pressure
    (using MADV_FREE). This means process-level memory statistics
    like RSS will more accurately reflect the amount of physical
    memory being used by Go processes. Systems that are currently
    using GODEBUG=madvdontneed=1 to improve memory monitoring
    behavior no longer need to set this environment variable.
  * Go 1.16 fixes a discrepancy between the race detector and the
    Go memory model. The race detector now more precisely follows
    the channel synchronization rules of the memory model. As a
    result, the detector may now report races it previously missed.
  * linker: This release includes additional improvements to the Go
    linker, reducing linker resource usage (both time and memory)
    and improving code robustness/maintainability. These changes
    form the second half of a two-release project to modernize the
    Go linker.
  * The linker changes in 1.16 extend the 1.15 improvements to all
    supported architecture/OS combinations (the 1.15 performance
    improvements were primarily focused on ELF-based OSes and amd64
    architectures). For a representative set of large Go programs,
    linking is 20-25% faster than 1.15 and requires 5-15% less
    memory on average for linux/amd64, with larger improvements for
    other architectures and OSes. Most binaries are also smaller as
    a result of more aggressive symbol pruning.
  * The new embed package provides access to files embedded in the
    program during compilation using the new //go:embed directive.
  * The new io/fs package defines the fs.FS interface, an
    abstraction for read-only trees of files. The standard library
    packages have been adapted to make use of the interface as
    appropriate.
  * For testing code that implements fs.FS, the new testing/fstest
    package provides a TestFS function that checks for and reports
    common mistakes. It also provides a simple in-memory file
    system implementation, MapFS, which can be useful for testing
    code that accepts fs.FS implementations.
  * syscall: On Linux, Setgid, Setuid, and related calls are now
    implemented. Previously, they returned an syscall.EOPNOTSUPP
    error. On Linux, the new functions AllThreadsSyscall and
    AllThreadsSyscall6 may be used to make a system call on all Go
    threads in the process. These functions may only be used by
    programs that do not use cgo; if a program uses cgo, they will
    always return syscall.ENOTSUP.
  * time/tzdata: The slim timezone data format is now used for the
    timezone database in $GOROOT/lib/time/zoneinfo.zip and the
    embedded copy in this package. This reduces the size of the
    timezone database by about 350 KB.</changelog>
  <changelog author="jkowalczyk@suse.com" date="1613649600">- gcc6-go.patch fix typo go-7 to go-6 for bootstrap on SLE-12 gcc6</changelog>
  <changelog author="jkowalczyk@suse.com" date="1615377600">- go1.16.1 (released 2021-03-10) includes security fixes to the
  archive/zip and encoding/xml packages.
  CVE-2021-27918 CVE-2021-27919
  Refs boo#1182345 go1.16 release tracking
  * boo#1183333 CVE-2021-27918
  * go#44915 encoding/xml: infinite loop when using `xml.NewTokenDecoder` with a custom `TokenReader`
  * boo#1183334 CVE-2021-27919
  * go#44917 archive/zip: can panic when calling Reader.Open</changelog>
  <changelog author="jkowalczyk@suse.com" date="1615550400">- go1.16.2 (released 2021-03-11) includes fixes to cgo, the
  compiler, linker, the go command, and the syscall and time
  packages.
  Refs boo#1182345 go1.16 release tracking
  * go#44793 cmd/go: mod tidy should ignore missing standard library packages
  * go#44746 cmd/go: improve error message when outside a module from "working directory is not part of a module"
  * go#44676 cmd/go: warning message when getting a retracted module version is missing a trailing newline
  * go#44659 runtime: marked free object in span
  * go#44647 cmd/go: "malformed import path" in Go 1.16 for packages with path elements containing a leading dot
  * go#44638 cmd/link: runtime crash, unexpected fault address 0xffffffffffffffff, h2_bundle.go, when using plugin
  * go#44618 time: LoadLocationFromTZData with slim tzdata uses incorrect zone
  * go#44593 syscall &amp; x/sys/windows: buffer overflow in GetQueuedCompletionStatus
  * go#44498 cmd/go: 'go mod edit -exclude' erroneously rejects '+incompatible' versions
  * go#44496 cmd/go: malformed module path with retract v2+
  * go#44464 cmd/compile: ICE on deferred call to syscall.LazyDLL.Call
  * go#44462 x/tools/go/analysis, syscall: ptrace redeclared in this block
  * go#44433 cmd/compile: Compiler regression in Go 1.16 - internal compiler error: child dcl collision on symbol
  * go#44402 doc: Broken image in readme
  * go#44358 cmd/compile: internal compiler error: Value live at entry. It shouldn't be.
  * go#44346 runtime/cgo: cannot build with -Wsign-compare</changelog>
  <changelog author="jkowalczyk@suse.com" date="1617364800">- go1.16.3 (released 2021-04-01) includes fixes to the compiler,
  linker, runtime, the go command, and the testing and time
  packages.
  Refs boo#1182345 go1.16 release tracking
  * go#45303 runtime: "invalid pc-encoded table" throw caused by bad cgo traceback
  * go#45253 cmd/compile: fix long RMW bit operations on AMD64
  * go#45240 all: run.{bash,bat,rc} sets GOPATH inconsistently
  * go#45192 Strange behaviour with loops
  * go#45030 cmd/link: go 1.16 plugin does not initialize global variables correctly when not used directly
  * go#44888 testing: Helper line number has changed in 1.16
  * go#44885 cmd/go: import paths ending with '+' are rejected (affects executable like g++ or clang++)
  * go#44869 time, runtime: zero duration timer takes 2 minutes to fire
  * go#44860 cmd/go: documentation at golang.org for cmd/go has confusing formatting
  * go#44812 cmd/go: 'go get' does not add missing hash to go.sum when ziphash file missing from cache
  * go#44640 cmd/link: fail to build when using time/tzdata on ARM</changelog>
  <changelog author="jkowalczyk@suse.com" date="1620388800">- go1.16.4 (released 2021-05-06) includes a security fix to the
  net/http package, as well as bug fixes to the runtime, the
  compiler, and the archive/zip, time, and syscall packages.
  CVE-2021-31525
  Refs boo#1182345 go1.16 release tracking
  * boo#1185790 CVE-2021-31525
  * go#45712 net/http: ReadRequest can stack overflow
  * go#45636 cmd/compile: internal compiler error: Invalid PPC64 rotate mask
  * go#45482 runtime: "invalid pc-encoded table" throw caused by bad cgo traceback (expandFinalInlineFrames)
  * go#45385 time: Europe/Dublin timezone handling broken with embedded timezone database
  * go#45347 archive/zip: duplicate entries in FS interface
  * go#45307 os/signal: timeout in TestAllThreadsSyscallSignals</changelog>
  <changelog author="jkowalczyk@suse.com" date="1622721600">- go1.16.5 (released 2021-06-03) includes security fixes to the
  archive/zip, math/big, net, and net/http/httputil packages, as
  well as bug fixes to the linker, the go command, and the net/http
  package.
  CVE-2021-33195 CVE-2021-33196 CVE-2021-33197 CVE-2021-33198
  Refs boo#1182345 go1.16 release tracking
  * boo#1187443 go#46241 CVE-2021-33195
  * go#46357 net: Lookup functions may return invalid host names
  * go#46530 net: Unix dnsclient test for CVE-2021-33195 assumes that 1.2.3.4 does not resolve
  * boo#1186622 go#46242 CVE-2021-33196
  * go#46397 archive/zip: malformed archive may cause panic or memory exhaustion
  * boo#1187444 go#46313 CVE-2021-33197
  * go#46315 net/http/httputil: ReverseProxy forwards Connection headers if first one is empty
  * boo#1187445 go#45910 CVE-2021-33198
  * go#46306 math/big: (*Rat).SetString with "1.770p02041010010011001001" crashes with "makeslice: len out of range"
  * go#46214 cmd/go: make go mod download with no arguments leave go.sum alone
  * go#46144 cmd/go: error out of 'go mod tidy' if the go.mod file specifies a newer-than-supported Go version
  * go#46128 cmd/link: internal error when externally linking very large binaries
  * go#45927 cmd/link: SIGSEGV running 'openshift-install version' for release-4.8 using external linking on PPC64LE
  * go#45832 cmd/link: unexpected trampoline when cross-compiling to ppc64le</changelog>
  <changelog author="jkowalczyk@suse.com" date="1623326400">- Fix extraneous trailing percent character %endif% in spec file.</changelog>
  <changelog author="jkowalczyk@suse.com" date="1626091200">- go1.16.6 (released 2021-07-12) includes a security fix to the
  crypto/tls package, as well as bug fixes to the compiler, and the
  net and net/http packages.
  CVE-2021-34558
  Refs boo#1182345 go1.16 release tracking
  * boo#1188229 go#47143 CVE-2021-34558
  * go#47145 security: fix CVE-2021-34558
  * go#46999 net: LookupMX behaviour broken
  * go#46981 net: TestCVE202133195 fails if /etc/resolv.conf specifies ndots larger than 3
  * go#46769 syscall: TestGroupCleanupUserNamespace test failure on Fedora
  * go#46657 runtime: deeply nested struct initialized with non-zero values
  * go#44984 net/http: server not setting Content-Length in certain cases</changelog>
  <changelog author="fvogt@suse.com" date="1626696000">- Add patch to fix crashes on PowerPC with kernel &gt;= 5.13:
  * fix-ppc64-crashes.patch</changelog>
  <changelog author="jkowalczyk@suse.com" date="1628164800">- Drop patch to fix crashes on PowerPC with kernel &gt;= 5.13, fixed
  in next upstream release:
  * drop fix-ppc64-crashes.patch</changelog>
  <changelog author="jkowalczyk@suse.com" date="1628164801">- go1.16.7 (released 2021-08-05) includes a security fix to the
  net/http/httputil package, as well as bug fixes to the compiler,
  the linker, the runtime, the go command, and the net/http
  package.
  CVE-2021-36221
  Refs boo#1182345 go1.16 release tracking
  * boo#1189162 go#46866 CVE-2021-36221
  * go#47474 net/http: panic due to racy read of persistConn after handler panic
  * go#47348 cmd/go: "go list -f '{{.Stale}}'" stack overflow with cyclic imports
  * go#47332 time: Timer reset broken under heavy use since go1.16 timer optimizations added
  * go#47289 cmd/link: build error with cgo in Windows, redefinition of go.map.zero
  * go#47015 cmd/go: go mod vendor: open C:\Users\LICENSE: Access is denied.
  * go#46928 cmd/compile: register conflict between external linker and duffzero on arm64
  * go#46858 runtime: ppc64x binaries randomly segfault on linux 5.13rc6
  * go#46551 cmd/go: unhelpful error message when running "go install" on a replaced-but-not-required package</changelog>
  <changelog author="jkowalczyk@suse.com" date="1628769600">- Add bash scripts used by go tool commands to provide a more
  complete cross-compiling go toolchain install.
  * Fixes "go tool dist list" error "all.bash does not exist"
  * Added to packaging:
    /usr/lib64/go/1.16/lib/time/update.bash (already packaged)
    /usr/lib64/go/1.16/src/all.bash
    /usr/lib64/go/1.16/src/bootstrap.bash
    /usr/lib64/go/1.16/src/buildall.bash
    /usr/lib64/go/1.16/src/clean.bash
    /usr/lib64/go/1.16/src/cmp.bash
    /usr/lib64/go/1.16/src/make.bash
    /usr/lib64/go/1.16/src/race.bash
    /usr/lib64/go/1.16/src/run.bash
    /usr/share/go/1.16/src/all.bash
    /usr/share/go/1.16/src/bootstrap.bash
    /usr/share/go/1.16/src/buildall.bash
    /usr/share/go/1.16/src/clean.bash
    /usr/share/go/1.16/src/cmd/compile/internal/ssa/gen/cover.bash
    /usr/share/go/1.16/src/cmd/vendor/golang.org/x/sys/windows/mkerrors.bash
    /usr/share/go/1.16/src/cmd/vendor/golang.org/x/sys/windows/mkknownfolderids.bash
    /usr/share/go/1.16/src/cmp.bash
    /usr/share/go/1.16/src/internal/trace/mkcanned.bash
    /usr/share/go/1.16/src/make.bash
    /usr/share/go/1.16/src/race.bash
    /usr/share/go/1.16/src/run.bash</changelog>
  <changelog author="jkowalczyk@suse.com" date="1631275200">- go1.16.8 (released 2021-09-09) includes a security fix to the
  archive/zip package, as well as bug fixes to the archive/zip,
  go/internal/gccgoimporter, html/template, net/http, and
  runtime/pprof packages.
  Refs boo#1182345 go1.16 release tracking
  CVE-2021-39293
  * boo#1190589 go#47801 CVE-2021-39293
  * go#47985 archive/zip: overflow in preallocation check can cause OOM panic
  * go#47691 x/net/http2: server sends RST_STREAM w/ PROTOCOL_ERROR to clients it incorrectly believes have violated max advertised num streams
  * go#47675 runtime/pprof: apparent deadlock in TestGoroutineSwitch on linux-armv6l
  * go#47610 go/internal/gccgoimporter: TestInstallationImporter broken with tip gccgo
  * go#47535 net/http: TestCancelRequestWhenSharingConnection can cause port exhaustion
  * go#47042 html/template: data race with concurrent ExecuteTemplate calls</changelog>
  <changelog author="jkowalczyk@suse.com" date="1633694400">- go1.16.9 (released 2021-10-07) includes a security fix to the
  linker and misc/wasm directory, as well as bug fixes to the
  runtime and to the text/template package.
  Refs boo#1182345 go1.16 release tracking
  CVE-2021-38297
  * boo#1191468 go#48797 CVE-2021-38297
  * go#48799 security: fix CVE-2021-38297 misc/wasm, cmd/link: do not let command line args overwrite global data
  * go#48443 text/template: should t.init() be executed before t.muTmpl.Lock() in AddParseTree() method?
  * go#47858 time: timer reset sometimes ignored, causing delayed ticks</changelog>
  <changelog author="jkowalczyk@suse.com" date="1636027200">- go1.16.10 (released 2021-11-04) includes security fixes to the
  archive/zip and debug/macho packages, as well as bug fixes to the
  compiler, linker, runtime, the misc/wasm directory, and to the
  net/http package.
  Refs boo#1182345 go1.16 release tracking
  CVE-2021-41771 CVE-2021-41772
  * boo#1192377 go#48990 CVE-2021-41771
  * go#48991 debug/macho: invalid dynamic symbol table command can cause panic
  * boo#1192378 go#48085 CVE-2021-41772
  * go#48251 archive/zip: Reader.Open panics on empty string
  * go#49153 misc/wasm, cmd/link: Go 1.17.2 causes WASM builds to throw command line too long with many environment variables
  * go#49076 x/net/http2: backport critical fixes
  * go#49009 net,runtime: apparent deadlock in (*net.conn).Close and runtime.netpollblock on arm64 platforms
  * go#48822 x/net/http2: client can hang forever if headers' size exceeds connection's buffer size and server hangs past request time
  * go#48649 x/net/http2: pool deadlock
  * go#48478 cmd/compile: 64 bits shifts on arm get wrong results
  * go#48474 cmd/compile: incorrect arm/arm64 simplification rules</changelog>
  <changelog author="jkowalczyk@suse.com" date="1638532800">- go1.16.11 (released 2021-12-02) includes fixes to the compiler,
  runtime, and the net/http, net/http/httptest, and time packages.
  Refs boo#1182345 go1.16 release tracking
  * go#49910 x/net/http2: frequent failures in TestClientConnCloseAtBody
  * go#49908 x/net/ipv6: TestPacketConnReadWriteMulticast{UDP,ICMP} failing with "i/o timeout" on OpenBSD 6.8 and 7.0
  * go#49904 x/net/http2: Client doesn't send body until ExpectContinueTimeout expires
  * go#49867 syscall: ntdll.dll errors in rtlGetNtVersionNumbers via os.StartProcess
  * go#49851 net/http/httptest: Close does not wait for the underlying Server's ConnState callbacks to complete
  * go#49728 runtime: "fatal error: unexpected signal during runtime execution" in cmd/go tests on darwin-amd64-race running macOS 12.0
  * go#49661 x/net/http2: TestUnreadFlowControlReturned_Server failures with stream error "NO_ERROR" since 2021-10-05
  * go#49623 net/http: Possible HTTP/2 busy loop regression in Go 1.17.3
  * go#49567 net/http: server responds with Transfer-Encoding: identity
  * go#49560 x/net/http2: setting Request.Close doesn't close TCP connections
  * go#49558 net/http: HTTP/2 response body Close method sometimes returns spurious context cancelation error (1.17.3 regression)
  * go#49406 time: ParseInLocation error
  * go#49391 cmd/compile: internal compiler error: Expand calls interface data problem</changelog>
  <changelog author="jkowalczyk@suse.com" date="1639051200">- go1.16.12 (released 2021-12-09) includes security fixes to the
  syscall and net/http packages.
  Refs boo#1182345 go1.16 release tracking
  CVE-2021-44716 CVE-2021-44717
  * boo#1193598 go#50057 CVE-2021-44717
  * go#50066 syscall: don?t close fd 0 on ForkExec error
  * boo#1193597 go#50058 CVE-2021-44716
  * go#50064 net/http: limit growth of header canonicalization cache</changelog>
  <changelog author="jkowalczyk@suse.com" date="1641470400">- go1.16.13 (released 2022-01-06) includes fixes to the compiler,
  linker, runtime, and the net/http package.
  Refs boo#1182345 go1.16 release tracking
  * go#50449 x/net/http2: http.Server.WriteTimeout does not fire if the http2 stream's window is out of space.
  * go#50296 cmd/link: does not set section type of .init_array correctly
  * go#50194 runtime/race: building for iOS, but linking in object file built for macOS
  * go#50072 runtime: race detector SIGABRT or SIGSEGV on macOS Monterey
  * go#49923 cmd/link: support more load commands on Mach-O
  * go#49412 cmd/compile: internal compiler error: Op...LECall and OpDereference have mismatched mem
  * go#48115 runtime: mallocs cause "base outside usable address space" panic when running on iOS 14</changelog>
</package>
<package pkgid="8884683f9f57d0385361b62ea85d890e422979d9c4ca3803ce25a2b0baea9bd7" name="go1.16-doc" arch="aarch64">
  <version epoch="0" ver="1.16.13" rel="1.40.1"/>
  <changelog author="jkowalczyk@suse.com" date="1611835200">- go1.16rc1 (released 2021-01-28) is a release candidate of go1.16
  cut from the master branch at the revision tagged go1.16rc1.</changelog>
  <changelog author="jkowalczyk@suse.com" date="1613476800">- go1.16 (released 2021-02-16) Go 1.16 is a major release of Go.
  go1.16.x minor releases will be provided through February 2022.
  https://github.com/golang/go/wiki/Go-Release-Cycle
  Most changes are in the implementation of the toolchain, runtime,
  and libraries. As always, the release maintains the Go 1 promise
  of compatibility. We expect almost all Go programs to continue to
  compile and run as before.
  Refs boo#1182345 go1.16 release tracking
  * See release notes https://golang.org/doc/go1.16. Excerpts
    relevant to OBS environment and for SUSE/openSUSE follow:
  * Module-aware mode is enabled by default, regardless of whether
    a go.mod file is present in the current working directory or a
    parent directory. More precisely, the GO111MODULE environment
    variable now defaults to on. To switch to the previous
    behavior, set GO111MODULE to auto.
  * Build commands like go build and go test no longer modify
    go.mod and go.sum by default. Instead, they report an error if
    a module requirement or checksum needs to be added or updated
    (as if the -mod=readonly flag were used). Module requirements
    and sums may be adjusted with go mod tidy or go get.
  * go install now accepts arguments with version suffixes (for
    example, go install example.com/cmd@v1.0.0). This causes go
    install to build and install packages in module-aware mode,
    ignoring the go.mod file in the current directory or any parent
    directory, if there is one. This is useful for installing
    executables without affecting the dependencies of the main
    module.
  * go install, with or without a version suffix (as described
    above), is now the recommended way to build and install
    packages in module mode. go get should be used with the -d flag
    to adjust the current module's dependencies without building
    packages, and use of go get to build and install packages is
    deprecated. In a future release, the -d flag will always be
    enabled.
  * retract directives may now be used in a go.mod file to indicate
    that certain published versions of the module should not be
    used by other modules. A module author may retract a version
    after a severe problem is discovered or if the version was
    published unintentionally.
  * The go mod vendor and go mod tidy subcommands now accept the -e
    flag, which instructs them to proceed despite errors in
    resolving missing packages.
  * The go command now ignores requirements on module versions
    excluded by exclude directives in the main module. Previously,
    the go command used the next version higher than an excluded
    version, but that version could change over time, resulting in
    non-reproducible builds.
  * In module mode, the go command now disallows import paths that
    include non-ASCII characters or path elements with a leading
    dot character (.). Module paths with these characters were
    already disallowed (see Module paths and versions), so this
    change affects only paths within module subdirectories.
  * The go command now supports including static files and file
    trees as part of the final executable, using the new //go:embed
    directive. See the documentation for the new embed package for
    details.
  * When using go test, a test that calls os.Exit(0) during
    execution of a test function will now be considered to
    fail. This will help catch cases in which a test calls code
    that calls os.Exit(0) and thereby stops running all future
    tests. If a TestMain function calls os.Exit(0) that is still
    considered to be a passing test.
  * go test reports an error when the -c or -i flags are used
    together with unknown flags. Normally, unknown flags are passed
    to tests, but when -c or -i are used, tests are not run.
  * The go get -insecure flag is deprecated and will be removed in
    a future version. This flag permits fetching from repositories
    and resolving custom domains using insecure schemes such as
    HTTP, and also bypasses module sum validation using the
    checksum database. To permit the use of insecure schemes, use
    the GOINSECURE environment variable instead. To bypass module
    sum validation, use GOPRIVATE or GONOSUMDB. See go help
    environment for details.
  * go get example.com/mod@patch now requires that some version of
    example.com/mod already be required by the main
    module. (However, go get -u=patch continues to patch even
    newly-added dependencies.)
  * GOVCS is a new environment variable that limits which version
    control tools the go command may use to download source
    code. This mitigates security issues with tools that are
    typically used in trusted, authenticated environments. By
    default, git and hg may be used to download code from any
    repository. svn, bzr, and fossil may only be used to download
    code from repositories with module paths or package paths
    matching patterns in the GOPRIVATE environment variable. See go
    help vcs for details.
  * When the main module's go.mod file declares go 1.16 or higher,
    the all package pattern now matches only those packages that
    are transitively imported by a package or test found in the
    main module. (Packages imported by tests of packages imported
    by the main module are no longer included.) This is the same
    set of packages retained by go mod vendor since Go 1.11.
  * When the -toolexec build flag is specified to use a program
    when invoking toolchain programs like compile or asm, the
    environment variable TOOLEXEC_IMPORTPATH is now set to the
    import path of the package being built.
  * The -i flag accepted by go build, go install, and go test is
    now deprecated. The -i flag instructs the go command to install
    packages imported by packages named on the command line. Since
    the build cache was introduced in Go 1.10, the -i flag no
    longer has a significant effect on build times, and it causes
    errors when the install directory is not writable.
  * When the -export flag is specified, the BuildID field is now
    set to the build ID of the compiled package. This is equivalent
    to running go tool buildid on go list -exported -f {{.Export}},
    but without the extra step.
  * The -overlay flag specifies a JSON configuration file
    containing a set of file path replacements. The -overlay flag
    may be used with all build commands and go mod subcommands. It
    is primarily intended to be used by editor tooling such as
    gopls to understand the effects of unsaved changes to source
    files. The config file maps actual file paths to replacement
    file paths and the go command and its builds will run as if the
    actual file paths exist with the contents given by the
    replacement file paths, or don't exist if the replacement file
    paths are empty.
  * The cgo tool will no longer try to translate C struct bitfields
    into Go struct fields, even if their size can be represented in
    Go. The order in which C bitfields appear in memory is
    implementation dependent, so in some cases the cgo tool
    produced results that were silently incorrect.
  * The linux/riscv64 port now supports cgo and -buildmode=pie.
    This release also includes performance optimizations and code
    generation improvements for RISC-V.
  * The new runtime/metrics package introduces a stable interface
    for reading implementation-defined metrics from the Go
    runtime. It supersedes existing functions like
    runtime.ReadMemStats and debug.GCStats and is significantly
    more general and efficient. See the package documentation for
    more details.
  * Setting the GODEBUG environment variable to inittrace=1 now
    causes the runtime to emit a single line to standard error for
    each package init, summarizing its execution time and memory
    allocation. This trace can be used to find bottlenecks or
    regressions in Go startup performance. The GODEBUG
    documentation describes the format.
  * On Linux, the runtime now defaults to releasing memory to the
    operating system promptly (using MADV_DONTNEED), rather than
    lazily when the operating system is under memory pressure
    (using MADV_FREE). This means process-level memory statistics
    like RSS will more accurately reflect the amount of physical
    memory being used by Go processes. Systems that are currently
    using GODEBUG=madvdontneed=1 to improve memory monitoring
    behavior no longer need to set this environment variable.
  * Go 1.16 fixes a discrepancy between the race detector and the
    Go memory model. The race detector now more precisely follows
    the channel synchronization rules of the memory model. As a
    result, the detector may now report races it previously missed.
  * linker: This release includes additional improvements to the Go
    linker, reducing linker resource usage (both time and memory)
    and improving code robustness/maintainability. These changes
    form the second half of a two-release project to modernize the
    Go linker.
  * The linker changes in 1.16 extend the 1.15 improvements to all
    supported architecture/OS combinations (the 1.15 performance
    improvements were primarily focused on ELF-based OSes and amd64
    architectures). For a representative set of large Go programs,
    linking is 20-25% faster than 1.15 and requires 5-15% less
    memory on average for linux/amd64, with larger improvements for
    other architectures and OSes. Most binaries are also smaller as
    a result of more aggressive symbol pruning.
  * The new embed package provides access to files embedded in the
    program during compilation using the new //go:embed directive.
  * The new io/fs package defines the fs.FS interface, an
    abstraction for read-only trees of files. The standard library
    packages have been adapted to make use of the interface as
    appropriate.
  * For testing code that implements fs.FS, the new testing/fstest
    package provides a TestFS function that checks for and reports
    common mistakes. It also provides a simple in-memory file
    system implementation, MapFS, which can be useful for testing
    code that accepts fs.FS implementations.
  * syscall: On Linux, Setgid, Setuid, and related calls are now
    implemented. Previously, they returned an syscall.EOPNOTSUPP
    error. On Linux, the new functions AllThreadsSyscall and
    AllThreadsSyscall6 may be used to make a system call on all Go
    threads in the process. These functions may only be used by
    programs that do not use cgo; if a program uses cgo, they will
    always return syscall.ENOTSUP.
  * time/tzdata: The slim timezone data format is now used for the
    timezone database in $GOROOT/lib/time/zoneinfo.zip and the
    embedded copy in this package. This reduces the size of the
    timezone database by about 350 KB.</changelog>
  <changelog author="jkowalczyk@suse.com" date="1613649600">- gcc6-go.patch fix typo go-7 to go-6 for bootstrap on SLE-12 gcc6</changelog>
  <changelog author="jkowalczyk@suse.com" date="1615377600">- go1.16.1 (released 2021-03-10) includes security fixes to the
  archive/zip and encoding/xml packages.
  CVE-2021-27918 CVE-2021-27919
  Refs boo#1182345 go1.16 release tracking
  * boo#1183333 CVE-2021-27918
  * go#44915 encoding/xml: infinite loop when using `xml.NewTokenDecoder` with a custom `TokenReader`
  * boo#1183334 CVE-2021-27919
  * go#44917 archive/zip: can panic when calling Reader.Open</changelog>
  <changelog author="jkowalczyk@suse.com" date="1615550400">- go1.16.2 (released 2021-03-11) includes fixes to cgo, the
  compiler, linker, the go command, and the syscall and time
  packages.
  Refs boo#1182345 go1.16 release tracking
  * go#44793 cmd/go: mod tidy should ignore missing standard library packages
  * go#44746 cmd/go: improve error message when outside a module from "working directory is not part of a module"
  * go#44676 cmd/go: warning message when getting a retracted module version is missing a trailing newline
  * go#44659 runtime: marked free object in span
  * go#44647 cmd/go: "malformed import path" in Go 1.16 for packages with path elements containing a leading dot
  * go#44638 cmd/link: runtime crash, unexpected fault address 0xffffffffffffffff, h2_bundle.go, when using plugin
  * go#44618 time: LoadLocationFromTZData with slim tzdata uses incorrect zone
  * go#44593 syscall &amp; x/sys/windows: buffer overflow in GetQueuedCompletionStatus
  * go#44498 cmd/go: 'go mod edit -exclude' erroneously rejects '+incompatible' versions
  * go#44496 cmd/go: malformed module path with retract v2+
  * go#44464 cmd/compile: ICE on deferred call to syscall.LazyDLL.Call
  * go#44462 x/tools/go/analysis, syscall: ptrace redeclared in this block
  * go#44433 cmd/compile: Compiler regression in Go 1.16 - internal compiler error: child dcl collision on symbol
  * go#44402 doc: Broken image in readme
  * go#44358 cmd/compile: internal compiler error: Value live at entry. It shouldn't be.
  * go#44346 runtime/cgo: cannot build with -Wsign-compare</changelog>
  <changelog author="jkowalczyk@suse.com" date="1617364800">- go1.16.3 (released 2021-04-01) includes fixes to the compiler,
  linker, runtime, the go command, and the testing and time
  packages.
  Refs boo#1182345 go1.16 release tracking
  * go#45303 runtime: "invalid pc-encoded table" throw caused by bad cgo traceback
  * go#45253 cmd/compile: fix long RMW bit operations on AMD64
  * go#45240 all: run.{bash,bat,rc} sets GOPATH inconsistently
  * go#45192 Strange behaviour with loops
  * go#45030 cmd/link: go 1.16 plugin does not initialize global variables correctly when not used directly
  * go#44888 testing: Helper line number has changed in 1.16
  * go#44885 cmd/go: import paths ending with '+' are rejected (affects executable like g++ or clang++)
  * go#44869 time, runtime: zero duration timer takes 2 minutes to fire
  * go#44860 cmd/go: documentation at golang.org for cmd/go has confusing formatting
  * go#44812 cmd/go: 'go get' does not add missing hash to go.sum when ziphash file missing from cache
  * go#44640 cmd/link: fail to build when using time/tzdata on ARM</changelog>
  <changelog author="jkowalczyk@suse.com" date="1620388800">- go1.16.4 (released 2021-05-06) includes a security fix to the
  net/http package, as well as bug fixes to the runtime, the
  compiler, and the archive/zip, time, and syscall packages.
  CVE-2021-31525
  Refs boo#1182345 go1.16 release tracking
  * boo#1185790 CVE-2021-31525
  * go#45712 net/http: ReadRequest can stack overflow
  * go#45636 cmd/compile: internal compiler error: Invalid PPC64 rotate mask
  * go#45482 runtime: "invalid pc-encoded table" throw caused by bad cgo traceback (expandFinalInlineFrames)
  * go#45385 time: Europe/Dublin timezone handling broken with embedded timezone database
  * go#45347 archive/zip: duplicate entries in FS interface
  * go#45307 os/signal: timeout in TestAllThreadsSyscallSignals</changelog>
  <changelog author="jkowalczyk@suse.com" date="1622721600">- go1.16.5 (released 2021-06-03) includes security fixes to the
  archive/zip, math/big, net, and net/http/httputil packages, as
  well as bug fixes to the linker, the go command, and the net/http
  package.
  CVE-2021-33195 CVE-2021-33196 CVE-2021-33197 CVE-2021-33198
  Refs boo#1182345 go1.16 release tracking
  * boo#1187443 go#46241 CVE-2021-33195
  * go#46357 net: Lookup functions may return invalid host names
  * go#46530 net: Unix dnsclient test for CVE-2021-33195 assumes that 1.2.3.4 does not resolve
  * boo#1186622 go#46242 CVE-2021-33196
  * go#46397 archive/zip: malformed archive may cause panic or memory exhaustion
  * boo#1187444 go#46313 CVE-2021-33197
  * go#46315 net/http/httputil: ReverseProxy forwards Connection headers if first one is empty
  * boo#1187445 go#45910 CVE-2021-33198
  * go#46306 math/big: (*Rat).SetString with "1.770p02041010010011001001" crashes with "makeslice: len out of range"
  * go#46214 cmd/go: make go mod download with no arguments leave go.sum alone
  * go#46144 cmd/go: error out of 'go mod tidy' if the go.mod file specifies a newer-than-supported Go version
  * go#46128 cmd/link: internal error when externally linking very large binaries
  * go#45927 cmd/link: SIGSEGV running 'openshift-install version' for release-4.8 using external linking on PPC64LE
  * go#45832 cmd/link: unexpected trampoline when cross-compiling to ppc64le</changelog>
  <changelog author="jkowalczyk@suse.com" date="1623326400">- Fix extraneous trailing percent character %endif% in spec file.</changelog>
  <changelog author="jkowalczyk@suse.com" date="1626091200">- go1.16.6 (released 2021-07-12) includes a security fix to the
  crypto/tls package, as well as bug fixes to the compiler, and the
  net and net/http packages.
  CVE-2021-34558
  Refs boo#1182345 go1.16 release tracking
  * boo#1188229 go#47143 CVE-2021-34558
  * go#47145 security: fix CVE-2021-34558
  * go#46999 net: LookupMX behaviour broken
  * go#46981 net: TestCVE202133195 fails if /etc/resolv.conf specifies ndots larger than 3
  * go#46769 syscall: TestGroupCleanupUserNamespace test failure on Fedora
  * go#46657 runtime: deeply nested struct initialized with non-zero values
  * go#44984 net/http: server not setting Content-Length in certain cases</changelog>
  <changelog author="fvogt@suse.com" date="1626696000">- Add patch to fix crashes on PowerPC with kernel &gt;= 5.13:
  * fix-ppc64-crashes.patch</changelog>
  <changelog author="jkowalczyk@suse.com" date="1628164800">- Drop patch to fix crashes on PowerPC with kernel &gt;= 5.13, fixed
  in next upstream release:
  * drop fix-ppc64-crashes.patch</changelog>
  <changelog author="jkowalczyk@suse.com" date="1628164801">- go1.16.7 (released 2021-08-05) includes a security fix to the
  net/http/httputil package, as well as bug fixes to the compiler,
  the linker, the runtime, the go command, and the net/http
  package.
  CVE-2021-36221
  Refs boo#1182345 go1.16 release tracking
  * boo#1189162 go#46866 CVE-2021-36221
  * go#47474 net/http: panic due to racy read of persistConn after handler panic
  * go#47348 cmd/go: "go list -f '{{.Stale}}'" stack overflow with cyclic imports
  * go#47332 time: Timer reset broken under heavy use since go1.16 timer optimizations added
  * go#47289 cmd/link: build error with cgo in Windows, redefinition of go.map.zero
  * go#47015 cmd/go: go mod vendor: open C:\Users\LICENSE: Access is denied.
  * go#46928 cmd/compile: register conflict between external linker and duffzero on arm64
  * go#46858 runtime: ppc64x binaries randomly segfault on linux 5.13rc6
  * go#46551 cmd/go: unhelpful error message when running "go install" on a replaced-but-not-required package</changelog>
  <changelog author="jkowalczyk@suse.com" date="1628769600">- Add bash scripts used by go tool commands to provide a more
  complete cross-compiling go toolchain install.
  * Fixes "go tool dist list" error "all.bash does not exist"
  * Added to packaging:
    /usr/lib64/go/1.16/lib/time/update.bash (already packaged)
    /usr/lib64/go/1.16/src/all.bash
    /usr/lib64/go/1.16/src/bootstrap.bash
    /usr/lib64/go/1.16/src/buildall.bash
    /usr/lib64/go/1.16/src/clean.bash
    /usr/lib64/go/1.16/src/cmp.bash
    /usr/lib64/go/1.16/src/make.bash
    /usr/lib64/go/1.16/src/race.bash
    /usr/lib64/go/1.16/src/run.bash
    /usr/share/go/1.16/src/all.bash
    /usr/share/go/1.16/src/bootstrap.bash
    /usr/share/go/1.16/src/buildall.bash
    /usr/share/go/1.16/src/clean.bash
    /usr/share/go/1.16/src/cmd/compile/internal/ssa/gen/cover.bash
    /usr/share/go/1.16/src/cmd/vendor/golang.org/x/sys/windows/mkerrors.bash
    /usr/share/go/1.16/src/cmd/vendor/golang.org/x/sys/windows/mkknownfolderids.bash
    /usr/share/go/1.16/src/cmp.bash
    /usr/share/go/1.16/src/internal/trace/mkcanned.bash
    /usr/share/go/1.16/src/make.bash
    /usr/share/go/1.16/src/race.bash
    /usr/share/go/1.16/src/run.bash</changelog>
  <changelog author="jkowalczyk@suse.com" date="1631275200">- go1.16.8 (released 2021-09-09) includes a security fix to the
  archive/zip package, as well as bug fixes to the archive/zip,
  go/internal/gccgoimporter, html/template, net/http, and
  runtime/pprof packages.
  Refs boo#1182345 go1.16 release tracking
  CVE-2021-39293
  * boo#1190589 go#47801 CVE-2021-39293
  * go#47985 archive/zip: overflow in preallocation check can cause OOM panic
  * go#47691 x/net/http2: server sends RST_STREAM w/ PROTOCOL_ERROR to clients it incorrectly believes have violated max advertised num streams
  * go#47675 runtime/pprof: apparent deadlock in TestGoroutineSwitch on linux-armv6l
  * go#47610 go/internal/gccgoimporter: TestInstallationImporter broken with tip gccgo
  * go#47535 net/http: TestCancelRequestWhenSharingConnection can cause port exhaustion
  * go#47042 html/template: data race with concurrent ExecuteTemplate calls</changelog>
  <changelog author="jkowalczyk@suse.com" date="1633694400">- go1.16.9 (released 2021-10-07) includes a security fix to the
  linker and misc/wasm directory, as well as bug fixes to the
  runtime and to the text/template package.
  Refs boo#1182345 go1.16 release tracking
  CVE-2021-38297
  * boo#1191468 go#48797 CVE-2021-38297
  * go#48799 security: fix CVE-2021-38297 misc/wasm, cmd/link: do not let command line args overwrite global data
  * go#48443 text/template: should t.init() be executed before t.muTmpl.Lock() in AddParseTree() method?
  * go#47858 time: timer reset sometimes ignored, causing delayed ticks</changelog>
  <changelog author="jkowalczyk@suse.com" date="1636027200">- go1.16.10 (released 2021-11-04) includes security fixes to the
  archive/zip and debug/macho packages, as well as bug fixes to the
  compiler, linker, runtime, the misc/wasm directory, and to the
  net/http package.
  Refs boo#1182345 go1.16 release tracking
  CVE-2021-41771 CVE-2021-41772
  * boo#1192377 go#48990 CVE-2021-41771
  * go#48991 debug/macho: invalid dynamic symbol table command can cause panic
  * boo#1192378 go#48085 CVE-2021-41772
  * go#48251 archive/zip: Reader.Open panics on empty string
  * go#49153 misc/wasm, cmd/link: Go 1.17.2 causes WASM builds to throw command line too long with many environment variables
  * go#49076 x/net/http2: backport critical fixes
  * go#49009 net,runtime: apparent deadlock in (*net.conn).Close and runtime.netpollblock on arm64 platforms
  * go#48822 x/net/http2: client can hang forever if headers' size exceeds connection's buffer size and server hangs past request time
  * go#48649 x/net/http2: pool deadlock
  * go#48478 cmd/compile: 64 bits shifts on arm get wrong results
  * go#48474 cmd/compile: incorrect arm/arm64 simplification rules</changelog>
  <changelog author="jkowalczyk@suse.com" date="1638532800">- go1.16.11 (released 2021-12-02) includes fixes to the compiler,
  runtime, and the net/http, net/http/httptest, and time packages.
  Refs boo#1182345 go1.16 release tracking
  * go#49910 x/net/http2: frequent failures in TestClientConnCloseAtBody
  * go#49908 x/net/ipv6: TestPacketConnReadWriteMulticast{UDP,ICMP} failing with "i/o timeout" on OpenBSD 6.8 and 7.0
  * go#49904 x/net/http2: Client doesn't send body until ExpectContinueTimeout expires
  * go#49867 syscall: ntdll.dll errors in rtlGetNtVersionNumbers via os.StartProcess
  * go#49851 net/http/httptest: Close does not wait for the underlying Server's ConnState callbacks to complete
  * go#49728 runtime: "fatal error: unexpected signal during runtime execution" in cmd/go tests on darwin-amd64-race running macOS 12.0
  * go#49661 x/net/http2: TestUnreadFlowControlReturned_Server failures with stream error "NO_ERROR" since 2021-10-05
  * go#49623 net/http: Possible HTTP/2 busy loop regression in Go 1.17.3
  * go#49567 net/http: server responds with Transfer-Encoding: identity
  * go#49560 x/net/http2: setting Request.Close doesn't close TCP connections
  * go#49558 net/http: HTTP/2 response body Close method sometimes returns spurious context cancelation error (1.17.3 regression)
  * go#49406 time: ParseInLocation error
  * go#49391 cmd/compile: internal compiler error: Expand calls interface data problem</changelog>
  <changelog author="jkowalczyk@suse.com" date="1639051200">- go1.16.12 (released 2021-12-09) includes security fixes to the
  syscall and net/http packages.
  Refs boo#1182345 go1.16 release tracking
  CVE-2021-44716 CVE-2021-44717
  * boo#1193598 go#50057 CVE-2021-44717
  * go#50066 syscall: don?t close fd 0 on ForkExec error
  * boo#1193597 go#50058 CVE-2021-44716
  * go#50064 net/http: limit growth of header canonicalization cache</changelog>
  <changelog author="jkowalczyk@suse.com" date="1641470400">- go1.16.13 (released 2022-01-06) includes fixes to the compiler,
  linker, runtime, and the net/http package.
  Refs boo#1182345 go1.16 release tracking
  * go#50449 x/net/http2: http.Server.WriteTimeout does not fire if the http2 stream's window is out of space.
  * go#50296 cmd/link: does not set section type of .init_array correctly
  * go#50194 runtime/race: building for iOS, but linking in object file built for macOS
  * go#50072 runtime: race detector SIGABRT or SIGSEGV on macOS Monterey
  * go#49923 cmd/link: support more load commands on Mach-O
  * go#49412 cmd/compile: internal compiler error: Op...LECall and OpDereference have mismatched mem
  * go#48115 runtime: mallocs cause "base outside usable address space" panic when running on iOS 14</changelog>
</package>
<package pkgid="2621db05f6cca296b681fb0e03956c9464b69bd4f2641256121e598204b03665" name="go1.16-doc" arch="ppc64le">
  <version epoch="0" ver="1.16.13" rel="1.40.1"/>
  <changelog author="jkowalczyk@suse.com" date="1611835200">- go1.16rc1 (released 2021-01-28) is a release candidate of go1.16
  cut from the master branch at the revision tagged go1.16rc1.</changelog>
  <changelog author="jkowalczyk@suse.com" date="1613476800">- go1.16 (released 2021-02-16) Go 1.16 is a major release of Go.
  go1.16.x minor releases will be provided through February 2022.
  https://github.com/golang/go/wiki/Go-Release-Cycle
  Most changes are in the implementation of the toolchain, runtime,
  and libraries. As always, the release maintains the Go 1 promise
  of compatibility. We expect almost all Go programs to continue to
  compile and run as before.
  Refs boo#1182345 go1.16 release tracking
  * See release notes https://golang.org/doc/go1.16. Excerpts
    relevant to OBS environment and for SUSE/openSUSE follow:
  * Module-aware mode is enabled by default, regardless of whether
    a go.mod file is present in the current working directory or a
    parent directory. More precisely, the GO111MODULE environment
    variable now defaults to on. To switch to the previous
    behavior, set GO111MODULE to auto.
  * Build commands like go build and go test no longer modify
    go.mod and go.sum by default. Instead, they report an error if
    a module requirement or checksum needs to be added or updated
    (as if the -mod=readonly flag were used). Module requirements
    and sums may be adjusted with go mod tidy or go get.
  * go install now accepts arguments with version suffixes (for
    example, go install example.com/cmd@v1.0.0). This causes go
    install to build and install packages in module-aware mode,
    ignoring the go.mod file in the current directory or any parent
    directory, if there is one. This is useful for installing
    executables without affecting the dependencies of the main
    module.
  * go install, with or without a version suffix (as described
    above), is now the recommended way to build and install
    packages in module mode. go get should be used with the -d flag
    to adjust the current module's dependencies without building
    packages, and use of go get to build and install packages is
    deprecated. In a future release, the -d flag will always be
    enabled.
  * retract directives may now be used in a go.mod file to indicate
    that certain published versions of the module should not be
    used by other modules. A module author may retract a version
    after a severe problem is discovered or if the version was
    published unintentionally.
  * The go mod vendor and go mod tidy subcommands now accept the -e
    flag, which instructs them to proceed despite errors in
    resolving missing packages.
  * The go command now ignores requirements on module versions
    excluded by exclude directives in the main module. Previously,
    the go command used the next version higher than an excluded
    version, but that version could change over time, resulting in
    non-reproducible builds.
  * In module mode, the go command now disallows import paths that
    include non-ASCII characters or path elements with a leading
    dot character (.). Module paths with these characters were
    already disallowed (see Module paths and versions), so this
    change affects only paths within module subdirectories.
  * The go command now supports including static files and file
    trees as part of the final executable, using the new //go:embed
    directive. See the documentation for the new embed package for
    details.
  * When using go test, a test that calls os.Exit(0) during
    execution of a test function will now be considered to
    fail. This will help catch cases in which a test calls code
    that calls os.Exit(0) and thereby stops running all future
    tests. If a TestMain function calls os.Exit(0) that is still
    considered to be a passing test.
  * go test reports an error when the -c or -i flags are used
    together with unknown flags. Normally, unknown flags are passed
    to tests, but when -c or -i are used, tests are not run.
  * The go get -insecure flag is deprecated and will be removed in
    a future version. This flag permits fetching from repositories
    and resolving custom domains using insecure schemes such as
    HTTP, and also bypasses module sum validation using the
    checksum database. To permit the use of insecure schemes, use
    the GOINSECURE environment variable instead. To bypass module
    sum validation, use GOPRIVATE or GONOSUMDB. See go help
    environment for details.
  * go get example.com/mod@patch now requires that some version of
    example.com/mod already be required by the main
    module. (However, go get -u=patch continues to patch even
    newly-added dependencies.)
  * GOVCS is a new environment variable that limits which version
    control tools the go command may use to download source
    code. This mitigates security issues with tools that are
    typically used in trusted, authenticated environments. By
    default, git and hg may be used to download code from any
    repository. svn, bzr, and fossil may only be used to download
    code from repositories with module paths or package paths
    matching patterns in the GOPRIVATE environment variable. See go
    help vcs for details.
  * When the main module's go.mod file declares go 1.16 or higher,
    the all package pattern now matches only those packages that
    are transitively imported by a package or test found in the
    main module. (Packages imported by tests of packages imported
    by the main module are no longer included.) This is the same
    set of packages retained by go mod vendor since Go 1.11.
  * When the -toolexec build flag is specified to use a program
    when invoking toolchain programs like compile or asm, the
    environment variable TOOLEXEC_IMPORTPATH is now set to the
    import path of the package being built.
  * The -i flag accepted by go build, go install, and go test is
    now deprecated. The -i flag instructs the go command to install
    packages imported by packages named on the command line. Since
    the build cache was introduced in Go 1.10, the -i flag no
    longer has a significant effect on build times, and it causes
    errors when the install directory is not writable.
  * When the -export flag is specified, the BuildID field is now
    set to the build ID of the compiled package. This is equivalent
    to running go tool buildid on go list -exported -f {{.Export}},
    but without the extra step.
  * The -overlay flag specifies a JSON configuration file
    containing a set of file path replacements. The -overlay flag
    may be used with all build commands and go mod subcommands. It
    is primarily intended to be used by editor tooling such as
    gopls to understand the effects of unsaved changes to source
    files. The config file maps actual file paths to replacement
    file paths and the go command and its builds will run as if the
    actual file paths exist with the contents given by the
    replacement file paths, or don't exist if the replacement file
    paths are empty.
  * The cgo tool will no longer try to translate C struct bitfields
    into Go struct fields, even if their size can be represented in
    Go. The order in which C bitfields appear in memory is
    implementation dependent, so in some cases the cgo tool
    produced results that were silently incorrect.
  * The linux/riscv64 port now supports cgo and -buildmode=pie.
    This release also includes performance optimizations and code
    generation improvements for RISC-V.
  * The new runtime/metrics package introduces a stable interface
    for reading implementation-defined metrics from the Go
    runtime. It supersedes existing functions like
    runtime.ReadMemStats and debug.GCStats and is significantly
    more general and efficient. See the package documentation for
    more details.
  * Setting the GODEBUG environment variable to inittrace=1 now
    causes the runtime to emit a single line to standard error for
    each package init, summarizing its execution time and memory
    allocation. This trace can be used to find bottlenecks or
    regressions in Go startup performance. The GODEBUG
    documentation describes the format.
  * On Linux, the runtime now defaults to releasing memory to the
    operating system promptly (using MADV_DONTNEED), rather than
    lazily when the operating system is under memory pressure
    (using MADV_FREE). This means process-level memory statistics
    like RSS will more accurately reflect the amount of physical
    memory being used by Go processes. Systems that are currently
    using GODEBUG=madvdontneed=1 to improve memory monitoring
    behavior no longer need to set this environment variable.
  * Go 1.16 fixes a discrepancy between the race detector and the
    Go memory model. The race detector now more precisely follows
    the channel synchronization rules of the memory model. As a
    result, the detector may now report races it previously missed.
  * linker: This release includes additional improvements to the Go
    linker, reducing linker resource usage (both time and memory)
    and improving code robustness/maintainability. These changes
    form the second half of a two-release project to modernize the
    Go linker.
  * The linker changes in 1.16 extend the 1.15 improvements to all
    supported architecture/OS combinations (the 1.15 performance
    improvements were primarily focused on ELF-based OSes and amd64
    architectures). For a representative set of large Go programs,
    linking is 20-25% faster than 1.15 and requires 5-15% less
    memory on average for linux/amd64, with larger improvements for
    other architectures and OSes. Most binaries are also smaller as
    a result of more aggressive symbol pruning.
  * The new embed package provides access to files embedded in the
    program during compilation using the new //go:embed directive.
  * The new io/fs package defines the fs.FS interface, an
    abstraction for read-only trees of files. The standard library
    packages have been adapted to make use of the interface as
    appropriate.
  * For testing code that implements fs.FS, the new testing/fstest
    package provides a TestFS function that checks for and reports
    common mistakes. It also provides a simple in-memory file
    system implementation, MapFS, which can be useful for testing
    code that accepts fs.FS implementations.
  * syscall: On Linux, Setgid, Setuid, and related calls are now
    implemented. Previously, they returned an syscall.EOPNOTSUPP
    error. On Linux, the new functions AllThreadsSyscall and
    AllThreadsSyscall6 may be used to make a system call on all Go
    threads in the process. These functions may only be used by
    programs that do not use cgo; if a program uses cgo, they will
    always return syscall.ENOTSUP.
  * time/tzdata: The slim timezone data format is now used for the
    timezone database in $GOROOT/lib/time/zoneinfo.zip and the
    embedded copy in this package. This reduces the size of the
    timezone database by about 350 KB.</changelog>
  <changelog author="jkowalczyk@suse.com" date="1613649600">- gcc6-go.patch fix typo go-7 to go-6 for bootstrap on SLE-12 gcc6</changelog>
  <changelog author="jkowalczyk@suse.com" date="1615377600">- go1.16.1 (released 2021-03-10) includes security fixes to the
  archive/zip and encoding/xml packages.
  CVE-2021-27918 CVE-2021-27919
  Refs boo#1182345 go1.16 release tracking
  * boo#1183333 CVE-2021-27918
  * go#44915 encoding/xml: infinite loop when using `xml.NewTokenDecoder` with a custom `TokenReader`
  * boo#1183334 CVE-2021-27919
  * go#44917 archive/zip: can panic when calling Reader.Open</changelog>
  <changelog author="jkowalczyk@suse.com" date="1615550400">- go1.16.2 (released 2021-03-11) includes fixes to cgo, the
  compiler, linker, the go command, and the syscall and time
  packages.
  Refs boo#1182345 go1.16 release tracking
  * go#44793 cmd/go: mod tidy should ignore missing standard library packages
  * go#44746 cmd/go: improve error message when outside a module from "working directory is not part of a module"
  * go#44676 cmd/go: warning message when getting a retracted module version is missing a trailing newline
  * go#44659 runtime: marked free object in span
  * go#44647 cmd/go: "malformed import path" in Go 1.16 for packages with path elements containing a leading dot
  * go#44638 cmd/link: runtime crash, unexpected fault address 0xffffffffffffffff, h2_bundle.go, when using plugin
  * go#44618 time: LoadLocationFromTZData with slim tzdata uses incorrect zone
  * go#44593 syscall &amp; x/sys/windows: buffer overflow in GetQueuedCompletionStatus
  * go#44498 cmd/go: 'go mod edit -exclude' erroneously rejects '+incompatible' versions
  * go#44496 cmd/go: malformed module path with retract v2+
  * go#44464 cmd/compile: ICE on deferred call to syscall.LazyDLL.Call
  * go#44462 x/tools/go/analysis, syscall: ptrace redeclared in this block
  * go#44433 cmd/compile: Compiler regression in Go 1.16 - internal compiler error: child dcl collision on symbol
  * go#44402 doc: Broken image in readme
  * go#44358 cmd/compile: internal compiler error: Value live at entry. It shouldn't be.
  * go#44346 runtime/cgo: cannot build with -Wsign-compare</changelog>
  <changelog author="jkowalczyk@suse.com" date="1617364800">- go1.16.3 (released 2021-04-01) includes fixes to the compiler,
  linker, runtime, the go command, and the testing and time
  packages.
  Refs boo#1182345 go1.16 release tracking
  * go#45303 runtime: "invalid pc-encoded table" throw caused by bad cgo traceback
  * go#45253 cmd/compile: fix long RMW bit operations on AMD64
  * go#45240 all: run.{bash,bat,rc} sets GOPATH inconsistently
  * go#45192 Strange behaviour with loops
  * go#45030 cmd/link: go 1.16 plugin does not initialize global variables correctly when not used directly
  * go#44888 testing: Helper line number has changed in 1.16
  * go#44885 cmd/go: import paths ending with '+' are rejected (affects executable like g++ or clang++)
  * go#44869 time, runtime: zero duration timer takes 2 minutes to fire
  * go#44860 cmd/go: documentation at golang.org for cmd/go has confusing formatting
  * go#44812 cmd/go: 'go get' does not add missing hash to go.sum when ziphash file missing from cache
  * go#44640 cmd/link: fail to build when using time/tzdata on ARM</changelog>
  <changelog author="jkowalczyk@suse.com" date="1620388800">- go1.16.4 (released 2021-05-06) includes a security fix to the
  net/http package, as well as bug fixes to the runtime, the
  compiler, and the archive/zip, time, and syscall packages.
  CVE-2021-31525
  Refs boo#1182345 go1.16 release tracking
  * boo#1185790 CVE-2021-31525
  * go#45712 net/http: ReadRequest can stack overflow
  * go#45636 cmd/compile: internal compiler error: Invalid PPC64 rotate mask
  * go#45482 runtime: "invalid pc-encoded table" throw caused by bad cgo traceback (expandFinalInlineFrames)
  * go#45385 time: Europe/Dublin timezone handling broken with embedded timezone database
  * go#45347 archive/zip: duplicate entries in FS interface
  * go#45307 os/signal: timeout in TestAllThreadsSyscallSignals</changelog>
  <changelog author="jkowalczyk@suse.com" date="1622721600">- go1.16.5 (released 2021-06-03) includes security fixes to the
  archive/zip, math/big, net, and net/http/httputil packages, as
  well as bug fixes to the linker, the go command, and the net/http
  package.
  CVE-2021-33195 CVE-2021-33196 CVE-2021-33197 CVE-2021-33198
  Refs boo#1182345 go1.16 release tracking
  * boo#1187443 go#46241 CVE-2021-33195
  * go#46357 net: Lookup functions may return invalid host names
  * go#46530 net: Unix dnsclient test for CVE-2021-33195 assumes that 1.2.3.4 does not resolve
  * boo#1186622 go#46242 CVE-2021-33196
  * go#46397 archive/zip: malformed archive may cause panic or memory exhaustion
  * boo#1187444 go#46313 CVE-2021-33197
  * go#46315 net/http/httputil: ReverseProxy forwards Connection headers if first one is empty
  * boo#1187445 go#45910 CVE-2021-33198
  * go#46306 math/big: (*Rat).SetString with "1.770p02041010010011001001" crashes with "makeslice: len out of range"
  * go#46214 cmd/go: make go mod download with no arguments leave go.sum alone
  * go#46144 cmd/go: error out of 'go mod tidy' if the go.mod file specifies a newer-than-supported Go version
  * go#46128 cmd/link: internal error when externally linking very large binaries
  * go#45927 cmd/link: SIGSEGV running 'openshift-install version' for release-4.8 using external linking on PPC64LE
  * go#45832 cmd/link: unexpected trampoline when cross-compiling to ppc64le</changelog>
  <changelog author="jkowalczyk@suse.com" date="1623326400">- Fix extraneous trailing percent character %endif% in spec file.</changelog>
  <changelog author="jkowalczyk@suse.com" date="1626091200">- go1.16.6 (released 2021-07-12) includes a security fix to the
  crypto/tls package, as well as bug fixes to the compiler, and the
  net and net/http packages.
  CVE-2021-34558
  Refs boo#1182345 go1.16 release tracking
  * boo#1188229 go#47143 CVE-2021-34558
  * go#47145 security: fix CVE-2021-34558
  * go#46999 net: LookupMX behaviour broken
  * go#46981 net: TestCVE202133195 fails if /etc/resolv.conf specifies ndots larger than 3
  * go#46769 syscall: TestGroupCleanupUserNamespace test failure on Fedora
  * go#46657 runtime: deeply nested struct initialized with non-zero values
  * go#44984 net/http: server not setting Content-Length in certain cases</changelog>
  <changelog author="fvogt@suse.com" date="1626696000">- Add patch to fix crashes on PowerPC with kernel &gt;= 5.13:
  * fix-ppc64-crashes.patch</changelog>
  <changelog author="jkowalczyk@suse.com" date="1628164800">- Drop patch to fix crashes on PowerPC with kernel &gt;= 5.13, fixed
  in next upstream release:
  * drop fix-ppc64-crashes.patch</changelog>
  <changelog author="jkowalczyk@suse.com" date="1628164801">- go1.16.7 (released 2021-08-05) includes a security fix to the
  net/http/httputil package, as well as bug fixes to the compiler,
  the linker, the runtime, the go command, and the net/http
  package.
  CVE-2021-36221
  Refs boo#1182345 go1.16 release tracking
  * boo#1189162 go#46866 CVE-2021-36221
  * go#47474 net/http: panic due to racy read of persistConn after handler panic
  * go#47348 cmd/go: "go list -f '{{.Stale}}'" stack overflow with cyclic imports
  * go#47332 time: Timer reset broken under heavy use since go1.16 timer optimizations added
  * go#47289 cmd/link: build error with cgo in Windows, redefinition of go.map.zero
  * go#47015 cmd/go: go mod vendor: open C:\Users\LICENSE: Access is denied.
  * go#46928 cmd/compile: register conflict between external linker and duffzero on arm64
  * go#46858 runtime: ppc64x binaries randomly segfault on linux 5.13rc6
  * go#46551 cmd/go: unhelpful error message when running "go install" on a replaced-but-not-required package</changelog>
  <changelog author="jkowalczyk@suse.com" date="1628769600">- Add bash scripts used by go tool commands to provide a more
  complete cross-compiling go toolchain install.
  * Fixes "go tool dist list" error "all.bash does not exist"
  * Added to packaging:
    /usr/lib64/go/1.16/lib/time/update.bash (already packaged)
    /usr/lib64/go/1.16/src/all.bash
    /usr/lib64/go/1.16/src/bootstrap.bash
    /usr/lib64/go/1.16/src/buildall.bash
    /usr/lib64/go/1.16/src/clean.bash
    /usr/lib64/go/1.16/src/cmp.bash
    /usr/lib64/go/1.16/src/make.bash
    /usr/lib64/go/1.16/src/race.bash
    /usr/lib64/go/1.16/src/run.bash
    /usr/share/go/1.16/src/all.bash
    /usr/share/go/1.16/src/bootstrap.bash
    /usr/share/go/1.16/src/buildall.bash
    /usr/share/go/1.16/src/clean.bash
    /usr/share/go/1.16/src/cmd/compile/internal/ssa/gen/cover.bash
    /usr/share/go/1.16/src/cmd/vendor/golang.org/x/sys/windows/mkerrors.bash
    /usr/share/go/1.16/src/cmd/vendor/golang.org/x/sys/windows/mkknownfolderids.bash
    /usr/share/go/1.16/src/cmp.bash
    /usr/share/go/1.16/src/internal/trace/mkcanned.bash
    /usr/share/go/1.16/src/make.bash
    /usr/share/go/1.16/src/race.bash
    /usr/share/go/1.16/src/run.bash</changelog>
  <changelog author="jkowalczyk@suse.com" date="1631275200">- go1.16.8 (released 2021-09-09) includes a security fix to the
  archive/zip package, as well as bug fixes to the archive/zip,
  go/internal/gccgoimporter, html/template, net/http, and
  runtime/pprof packages.
  Refs boo#1182345 go1.16 release tracking
  CVE-2021-39293
  * boo#1190589 go#47801 CVE-2021-39293
  * go#47985 archive/zip: overflow in preallocation check can cause OOM panic
  * go#47691 x/net/http2: server sends RST_STREAM w/ PROTOCOL_ERROR to clients it incorrectly believes have violated max advertised num streams
  * go#47675 runtime/pprof: apparent deadlock in TestGoroutineSwitch on linux-armv6l
  * go#47610 go/internal/gccgoimporter: TestInstallationImporter broken with tip gccgo
  * go#47535 net/http: TestCancelRequestWhenSharingConnection can cause port exhaustion
  * go#47042 html/template: data race with concurrent ExecuteTemplate calls</changelog>
  <changelog author="jkowalczyk@suse.com" date="1633694400">- go1.16.9 (released 2021-10-07) includes a security fix to the
  linker and misc/wasm directory, as well as bug fixes to the
  runtime and to the text/template package.
  Refs boo#1182345 go1.16 release tracking
  CVE-2021-38297
  * boo#1191468 go#48797 CVE-2021-38297
  * go#48799 security: fix CVE-2021-38297 misc/wasm, cmd/link: do not let command line args overwrite global data
  * go#48443 text/template: should t.init() be executed before t.muTmpl.Lock() in AddParseTree() method?
  * go#47858 time: timer reset sometimes ignored, causing delayed ticks</changelog>
  <changelog author="jkowalczyk@suse.com" date="1636027200">- go1.16.10 (released 2021-11-04) includes security fixes to the
  archive/zip and debug/macho packages, as well as bug fixes to the
  compiler, linker, runtime, the misc/wasm directory, and to the
  net/http package.
  Refs boo#1182345 go1.16 release tracking
  CVE-2021-41771 CVE-2021-41772
  * boo#1192377 go#48990 CVE-2021-41771
  * go#48991 debug/macho: invalid dynamic symbol table command can cause panic
  * boo#1192378 go#48085 CVE-2021-41772
  * go#48251 archive/zip: Reader.Open panics on empty string
  * go#49153 misc/wasm, cmd/link: Go 1.17.2 causes WASM builds to throw command line too long with many environment variables
  * go#49076 x/net/http2: backport critical fixes
  * go#49009 net,runtime: apparent deadlock in (*net.conn).Close and runtime.netpollblock on arm64 platforms
  * go#48822 x/net/http2: client can hang forever if headers' size exceeds connection's buffer size and server hangs past request time
  * go#48649 x/net/http2: pool deadlock
  * go#48478 cmd/compile: 64 bits shifts on arm get wrong results
  * go#48474 cmd/compile: incorrect arm/arm64 simplification rules</changelog>
  <changelog author="jkowalczyk@suse.com" date="1638532800">- go1.16.11 (released 2021-12-02) includes fixes to the compiler,
  runtime, and the net/http, net/http/httptest, and time packages.
  Refs boo#1182345 go1.16 release tracking
  * go#49910 x/net/http2: frequent failures in TestClientConnCloseAtBody
  * go#49908 x/net/ipv6: TestPacketConnReadWriteMulticast{UDP,ICMP} failing with "i/o timeout" on OpenBSD 6.8 and 7.0
  * go#49904 x/net/http2: Client doesn't send body until ExpectContinueTimeout expires
  * go#49867 syscall: ntdll.dll errors in rtlGetNtVersionNumbers via os.StartProcess
  * go#49851 net/http/httptest: Close does not wait for the underlying Server's ConnState callbacks to complete
  * go#49728 runtime: "fatal error: unexpected signal during runtime execution" in cmd/go tests on darwin-amd64-race running macOS 12.0
  * go#49661 x/net/http2: TestUnreadFlowControlReturned_Server failures with stream error "NO_ERROR" since 2021-10-05
  * go#49623 net/http: Possible HTTP/2 busy loop regression in Go 1.17.3
  * go#49567 net/http: server responds with Transfer-Encoding: identity
  * go#49560 x/net/http2: setting Request.Close doesn't close TCP connections
  * go#49558 net/http: HTTP/2 response body Close method sometimes returns spurious context cancelation error (1.17.3 regression)
  * go#49406 time: ParseInLocation error
  * go#49391 cmd/compile: internal compiler error: Expand calls interface data problem</changelog>
  <changelog author="jkowalczyk@suse.com" date="1639051200">- go1.16.12 (released 2021-12-09) includes security fixes to the
  syscall and net/http packages.
  Refs boo#1182345 go1.16 release tracking
  CVE-2021-44716 CVE-2021-44717
  * boo#1193598 go#50057 CVE-2021-44717
  * go#50066 syscall: don?t close fd 0 on ForkExec error
  * boo#1193597 go#50058 CVE-2021-44716
  * go#50064 net/http: limit growth of header canonicalization cache</changelog>
  <changelog author="jkowalczyk@suse.com" date="1641470400">- go1.16.13 (released 2022-01-06) includes fixes to the compiler,
  linker, runtime, and the net/http package.
  Refs boo#1182345 go1.16 release tracking
  * go#50449 x/net/http2: http.Server.WriteTimeout does not fire if the http2 stream's window is out of space.
  * go#50296 cmd/link: does not set section type of .init_array correctly
  * go#50194 runtime/race: building for iOS, but linking in object file built for macOS
  * go#50072 runtime: race detector SIGABRT or SIGSEGV on macOS Monterey
  * go#49923 cmd/link: support more load commands on Mach-O
  * go#49412 cmd/compile: internal compiler error: Op...LECall and OpDereference have mismatched mem
  * go#48115 runtime: mallocs cause "base outside usable address space" panic when running on iOS 14</changelog>
</package>
<package pkgid="4c1c2b7f6d9010a80efb32cd26083a58fb97003bb37df9240861691a7c645576" name="go1.16-doc" arch="s390x">
  <version epoch="0" ver="1.16.13" rel="1.40.1"/>
  <changelog author="jkowalczyk@suse.com" date="1611835200">- go1.16rc1 (released 2021-01-28) is a release candidate of go1.16
  cut from the master branch at the revision tagged go1.16rc1.</changelog>
  <changelog author="jkowalczyk@suse.com" date="1613476800">- go1.16 (released 2021-02-16) Go 1.16 is a major release of Go.
  go1.16.x minor releases will be provided through February 2022.
  https://github.com/golang/go/wiki/Go-Release-Cycle
  Most changes are in the implementation of the toolchain, runtime,
  and libraries. As always, the release maintains the Go 1 promise
  of compatibility. We expect almost all Go programs to continue to
  compile and run as before.
  Refs boo#1182345 go1.16 release tracking
  * See release notes https://golang.org/doc/go1.16. Excerpts
    relevant to OBS environment and for SUSE/openSUSE follow:
  * Module-aware mode is enabled by default, regardless of whether
    a go.mod file is present in the current working directory or a
    parent directory. More precisely, the GO111MODULE environment
    variable now defaults to on. To switch to the previous
    behavior, set GO111MODULE to auto.
  * Build commands like go build and go test no longer modify
    go.mod and go.sum by default. Instead, they report an error if
    a module requirement or checksum needs to be added or updated
    (as if the -mod=readonly flag were used). Module requirements
    and sums may be adjusted with go mod tidy or go get.
  * go install now accepts arguments with version suffixes (for
    example, go install example.com/cmd@v1.0.0). This causes go
    install to build and install packages in module-aware mode,
    ignoring the go.mod file in the current directory or any parent
    directory, if there is one. This is useful for installing
    executables without affecting the dependencies of the main
    module.
  * go install, with or without a version suffix (as described
    above), is now the recommended way to build and install
    packages in module mode. go get should be used with the -d flag
    to adjust the current module's dependencies without building
    packages, and use of go get to build and install packages is
    deprecated. In a future release, the -d flag will always be
    enabled.
  * retract directives may now be used in a go.mod file to indicate
    that certain published versions of the module should not be
    used by other modules. A module author may retract a version
    after a severe problem is discovered or if the version was
    published unintentionally.
  * The go mod vendor and go mod tidy subcommands now accept the -e
    flag, which instructs them to proceed despite errors in
    resolving missing packages.
  * The go command now ignores requirements on module versions
    excluded by exclude directives in the main module. Previously,
    the go command used the next version higher than an excluded
    version, but that version could change over time, resulting in
    non-reproducible builds.
  * In module mode, the go command now disallows import paths that
    include non-ASCII characters or path elements with a leading
    dot character (.). Module paths with these characters were
    already disallowed (see Module paths and versions), so this
    change affects only paths within module subdirectories.
  * The go command now supports including static files and file
    trees as part of the final executable, using the new //go:embed
    directive. See the documentation for the new embed package for
    details.
  * When using go test, a test that calls os.Exit(0) during
    execution of a test function will now be considered to
    fail. This will help catch cases in which a test calls code
    that calls os.Exit(0) and thereby stops running all future
    tests. If a TestMain function calls os.Exit(0) that is still
    considered to be a passing test.
  * go test reports an error when the -c or -i flags are used
    together with unknown flags. Normally, unknown flags are passed
    to tests, but when -c or -i are used, tests are not run.
  * The go get -insecure flag is deprecated and will be removed in
    a future version. This flag permits fetching from repositories
    and resolving custom domains using insecure schemes such as
    HTTP, and also bypasses module sum validation using the
    checksum database. To permit the use of insecure schemes, use
    the GOINSECURE environment variable instead. To bypass module
    sum validation, use GOPRIVATE or GONOSUMDB. See go help
    environment for details.
  * go get example.com/mod@patch now requires that some version of
    example.com/mod already be required by the main
    module. (However, go get -u=patch continues to patch even
    newly-added dependencies.)
  * GOVCS is a new environment variable that limits which version
    control tools the go command may use to download source
    code. This mitigates security issues with tools that are
    typically used in trusted, authenticated environments. By
    default, git and hg may be used to download code from any
    repository. svn, bzr, and fossil may only be used to download
    code from repositories with module paths or package paths
    matching patterns in the GOPRIVATE environment variable. See go
    help vcs for details.
  * When the main module's go.mod file declares go 1.16 or higher,
    the all package pattern now matches only those packages that
    are transitively imported by a package or test found in the
    main module. (Packages imported by tests of packages imported
    by the main module are no longer included.) This is the same
    set of packages retained by go mod vendor since Go 1.11.
  * When the -toolexec build flag is specified to use a program
    when invoking toolchain programs like compile or asm, the
    environment variable TOOLEXEC_IMPORTPATH is now set to the
    import path of the package being built.
  * The -i flag accepted by go build, go install, and go test is
    now deprecated. The -i flag instructs the go command to install
    packages imported by packages named on the command line. Since
    the build cache was introduced in Go 1.10, the -i flag no
    longer has a significant effect on build times, and it causes
    errors when the install directory is not writable.
  * When the -export flag is specified, the BuildID field is now
    set to the build ID of the compiled package. This is equivalent
    to running go tool buildid on go list -exported -f {{.Export}},
    but without the extra step.
  * The -overlay flag specifies a JSON configuration file
    containing a set of file path replacements. The -overlay flag
    may be used with all build commands and go mod subcommands. It
    is primarily intended to be used by editor tooling such as
    gopls to understand the effects of unsaved changes to source
    files. The config file maps actual file paths to replacement
    file paths and the go command and its builds will run as if the
    actual file paths exist with the contents given by the
    replacement file paths, or don't exist if the replacement file
    paths are empty.
  * The cgo tool will no longer try to translate C struct bitfields
    into Go struct fields, even if their size can be represented in
    Go. The order in which C bitfields appear in memory is
    implementation dependent, so in some cases the cgo tool
    produced results that were silently incorrect.
  * The linux/riscv64 port now supports cgo and -buildmode=pie.
    This release also includes performance optimizations and code
    generation improvements for RISC-V.
  * The new runtime/metrics package introduces a stable interface
    for reading implementation-defined metrics from the Go
    runtime. It supersedes existing functions like
    runtime.ReadMemStats and debug.GCStats and is significantly
    more general and efficient. See the package documentation for
    more details.
  * Setting the GODEBUG environment variable to inittrace=1 now
    causes the runtime to emit a single line to standard error for
    each package init, summarizing its execution time and memory
    allocation. This trace can be used to find bottlenecks or
    regressions in Go startup performance. The GODEBUG
    documentation describes the format.
  * On Linux, the runtime now defaults to releasing memory to the
    operating system promptly (using MADV_DONTNEED), rather than
    lazily when the operating system is under memory pressure
    (using MADV_FREE). This means process-level memory statistics
    like RSS will more accurately reflect the amount of physical
    memory being used by Go processes. Systems that are currently
    using GODEBUG=madvdontneed=1 to improve memory monitoring
    behavior no longer need to set this environment variable.
  * Go 1.16 fixes a discrepancy between the race detector and the
    Go memory model. The race detector now more precisely follows
    the channel synchronization rules of the memory model. As a
    result, the detector may now report races it previously missed.
  * linker: This release includes additional improvements to the Go
    linker, reducing linker resource usage (both time and memory)
    and improving code robustness/maintainability. These changes
    form the second half of a two-release project to modernize the
    Go linker.
  * The linker changes in 1.16 extend the 1.15 improvements to all
    supported architecture/OS combinations (the 1.15 performance
    improvements were primarily focused on ELF-based OSes and amd64
    architectures). For a representative set of large Go programs,
    linking is 20-25% faster than 1.15 and requires 5-15% less
    memory on average for linux/amd64, with larger improvements for
    other architectures and OSes. Most binaries are also smaller as
    a result of more aggressive symbol pruning.
  * The new embed package provides access to files embedded in the
    program during compilation using the new //go:embed directive.
  * The new io/fs package defines the fs.FS interface, an
    abstraction for read-only trees of files. The standard library
    packages have been adapted to make use of the interface as
    appropriate.
  * For testing code that implements fs.FS, the new testing/fstest
    package provides a TestFS function that checks for and reports
    common mistakes. It also provides a simple in-memory file
    system implementation, MapFS, which can be useful for testing
    code that accepts fs.FS implementations.
  * syscall: On Linux, Setgid, Setuid, and related calls are now
    implemented. Previously, they returned an syscall.EOPNOTSUPP
    error. On Linux, the new functions AllThreadsSyscall and
    AllThreadsSyscall6 may be used to make a system call on all Go
    threads in the process. These functions may only be used by
    programs that do not use cgo; if a program uses cgo, they will
    always return syscall.ENOTSUP.
  * time/tzdata: The slim timezone data format is now used for the
    timezone database in $GOROOT/lib/time/zoneinfo.zip and the
    embedded copy in this package. This reduces the size of the
    timezone database by about 350 KB.</changelog>
  <changelog author="jkowalczyk@suse.com" date="1613649600">- gcc6-go.patch fix typo go-7 to go-6 for bootstrap on SLE-12 gcc6</changelog>
  <changelog author="jkowalczyk@suse.com" date="1615377600">- go1.16.1 (released 2021-03-10) includes security fixes to the
  archive/zip and encoding/xml packages.
  CVE-2021-27918 CVE-2021-27919
  Refs boo#1182345 go1.16 release tracking
  * boo#1183333 CVE-2021-27918
  * go#44915 encoding/xml: infinite loop when using `xml.NewTokenDecoder` with a custom `TokenReader`
  * boo#1183334 CVE-2021-27919
  * go#44917 archive/zip: can panic when calling Reader.Open</changelog>
  <changelog author="jkowalczyk@suse.com" date="1615550400">- go1.16.2 (released 2021-03-11) includes fixes to cgo, the
  compiler, linker, the go command, and the syscall and time
  packages.
  Refs boo#1182345 go1.16 release tracking
  * go#44793 cmd/go: mod tidy should ignore missing standard library packages
  * go#44746 cmd/go: improve error message when outside a module from "working directory is not part of a module"
  * go#44676 cmd/go: warning message when getting a retracted module version is missing a trailing newline
  * go#44659 runtime: marked free object in span
  * go#44647 cmd/go: "malformed import path" in Go 1.16 for packages with path elements containing a leading dot
  * go#44638 cmd/link: runtime crash, unexpected fault address 0xffffffffffffffff, h2_bundle.go, when using plugin
  * go#44618 time: LoadLocationFromTZData with slim tzdata uses incorrect zone
  * go#44593 syscall &amp; x/sys/windows: buffer overflow in GetQueuedCompletionStatus
  * go#44498 cmd/go: 'go mod edit -exclude' erroneously rejects '+incompatible' versions
  * go#44496 cmd/go: malformed module path with retract v2+
  * go#44464 cmd/compile: ICE on deferred call to syscall.LazyDLL.Call
  * go#44462 x/tools/go/analysis, syscall: ptrace redeclared in this block
  * go#44433 cmd/compile: Compiler regression in Go 1.16 - internal compiler error: child dcl collision on symbol
  * go#44402 doc: Broken image in readme
  * go#44358 cmd/compile: internal compiler error: Value live at entry. It shouldn't be.
  * go#44346 runtime/cgo: cannot build with -Wsign-compare</changelog>
  <changelog author="jkowalczyk@suse.com" date="1617364800">- go1.16.3 (released 2021-04-01) includes fixes to the compiler,
  linker, runtime, the go command, and the testing and time
  packages.
  Refs boo#1182345 go1.16 release tracking
  * go#45303 runtime: "invalid pc-encoded table" throw caused by bad cgo traceback
  * go#45253 cmd/compile: fix long RMW bit operations on AMD64
  * go#45240 all: run.{bash,bat,rc} sets GOPATH inconsistently
  * go#45192 Strange behaviour with loops
  * go#45030 cmd/link: go 1.16 plugin does not initialize global variables correctly when not used directly
  * go#44888 testing: Helper line number has changed in 1.16
  * go#44885 cmd/go: import paths ending with '+' are rejected (affects executable like g++ or clang++)
  * go#44869 time, runtime: zero duration timer takes 2 minutes to fire
  * go#44860 cmd/go: documentation at golang.org for cmd/go has confusing formatting
  * go#44812 cmd/go: 'go get' does not add missing hash to go.sum when ziphash file missing from cache
  * go#44640 cmd/link: fail to build when using time/tzdata on ARM</changelog>
  <changelog author="jkowalczyk@suse.com" date="1620388800">- go1.16.4 (released 2021-05-06) includes a security fix to the
  net/http package, as well as bug fixes to the runtime, the
  compiler, and the archive/zip, time, and syscall packages.
  CVE-2021-31525
  Refs boo#1182345 go1.16 release tracking
  * boo#1185790 CVE-2021-31525
  * go#45712 net/http: ReadRequest can stack overflow
  * go#45636 cmd/compile: internal compiler error: Invalid PPC64 rotate mask
  * go#45482 runtime: "invalid pc-encoded table" throw caused by bad cgo traceback (expandFinalInlineFrames)
  * go#45385 time: Europe/Dublin timezone handling broken with embedded timezone database
  * go#45347 archive/zip: duplicate entries in FS interface
  * go#45307 os/signal: timeout in TestAllThreadsSyscallSignals</changelog>
  <changelog author="jkowalczyk@suse.com" date="1622721600">- go1.16.5 (released 2021-06-03) includes security fixes to the
  archive/zip, math/big, net, and net/http/httputil packages, as
  well as bug fixes to the linker, the go command, and the net/http
  package.
  CVE-2021-33195 CVE-2021-33196 CVE-2021-33197 CVE-2021-33198
  Refs boo#1182345 go1.16 release tracking
  * boo#1187443 go#46241 CVE-2021-33195
  * go#46357 net: Lookup functions may return invalid host names
  * go#46530 net: Unix dnsclient test for CVE-2021-33195 assumes that 1.2.3.4 does not resolve
  * boo#1186622 go#46242 CVE-2021-33196
  * go#46397 archive/zip: malformed archive may cause panic or memory exhaustion
  * boo#1187444 go#46313 CVE-2021-33197
  * go#46315 net/http/httputil: ReverseProxy forwards Connection headers if first one is empty
  * boo#1187445 go#45910 CVE-2021-33198
  * go#46306 math/big: (*Rat).SetString with "1.770p02041010010011001001" crashes with "makeslice: len out of range"
  * go#46214 cmd/go: make go mod download with no arguments leave go.sum alone
  * go#46144 cmd/go: error out of 'go mod tidy' if the go.mod file specifies a newer-than-supported Go version
  * go#46128 cmd/link: internal error when externally linking very large binaries
  * go#45927 cmd/link: SIGSEGV running 'openshift-install version' for release-4.8 using external linking on PPC64LE
  * go#45832 cmd/link: unexpected trampoline when cross-compiling to ppc64le</changelog>
  <changelog author="jkowalczyk@suse.com" date="1623326400">- Fix extraneous trailing percent character %endif% in spec file.</changelog>
  <changelog author="jkowalczyk@suse.com" date="1626091200">- go1.16.6 (released 2021-07-12) includes a security fix to the
  crypto/tls package, as well as bug fixes to the compiler, and the
  net and net/http packages.
  CVE-2021-34558
  Refs boo#1182345 go1.16 release tracking
  * boo#1188229 go#47143 CVE-2021-34558
  * go#47145 security: fix CVE-2021-34558
  * go#46999 net: LookupMX behaviour broken
  * go#46981 net: TestCVE202133195 fails if /etc/resolv.conf specifies ndots larger than 3
  * go#46769 syscall: TestGroupCleanupUserNamespace test failure on Fedora
  * go#46657 runtime: deeply nested struct initialized with non-zero values
  * go#44984 net/http: server not setting Content-Length in certain cases</changelog>
  <changelog author="fvogt@suse.com" date="1626696000">- Add patch to fix crashes on PowerPC with kernel &gt;= 5.13:
  * fix-ppc64-crashes.patch</changelog>
  <changelog author="jkowalczyk@suse.com" date="1628164800">- Drop patch to fix crashes on PowerPC with kernel &gt;= 5.13, fixed
  in next upstream release:
  * drop fix-ppc64-crashes.patch</changelog>
  <changelog author="jkowalczyk@suse.com" date="1628164801">- go1.16.7 (released 2021-08-05) includes a security fix to the
  net/http/httputil package, as well as bug fixes to the compiler,
  the linker, the runtime, the go command, and the net/http
  package.
  CVE-2021-36221
  Refs boo#1182345 go1.16 release tracking
  * boo#1189162 go#46866 CVE-2021-36221
  * go#47474 net/http: panic due to racy read of persistConn after handler panic
  * go#47348 cmd/go: "go list -f '{{.Stale}}'" stack overflow with cyclic imports
  * go#47332 time: Timer reset broken under heavy use since go1.16 timer optimizations added
  * go#47289 cmd/link: build error with cgo in Windows, redefinition of go.map.zero
  * go#47015 cmd/go: go mod vendor: open C:\Users\LICENSE: Access is denied.
  * go#46928 cmd/compile: register conflict between external linker and duffzero on arm64
  * go#46858 runtime: ppc64x binaries randomly segfault on linux 5.13rc6
  * go#46551 cmd/go: unhelpful error message when running "go install" on a replaced-but-not-required package</changelog>
  <changelog author="jkowalczyk@suse.com" date="1628769600">- Add bash scripts used by go tool commands to provide a more
  complete cross-compiling go toolchain install.
  * Fixes "go tool dist list" error "all.bash does not exist"
  * Added to packaging:
    /usr/lib64/go/1.16/lib/time/update.bash (already packaged)
    /usr/lib64/go/1.16/src/all.bash
    /usr/lib64/go/1.16/src/bootstrap.bash
    /usr/lib64/go/1.16/src/buildall.bash
    /usr/lib64/go/1.16/src/clean.bash
    /usr/lib64/go/1.16/src/cmp.bash
    /usr/lib64/go/1.16/src/make.bash
    /usr/lib64/go/1.16/src/race.bash
    /usr/lib64/go/1.16/src/run.bash
    /usr/share/go/1.16/src/all.bash
    /usr/share/go/1.16/src/bootstrap.bash
    /usr/share/go/1.16/src/buildall.bash
    /usr/share/go/1.16/src/clean.bash
    /usr/share/go/1.16/src/cmd/compile/internal/ssa/gen/cover.bash
    /usr/share/go/1.16/src/cmd/vendor/golang.org/x/sys/windows/mkerrors.bash
    /usr/share/go/1.16/src/cmd/vendor/golang.org/x/sys/windows/mkknownfolderids.bash
    /usr/share/go/1.16/src/cmp.bash
    /usr/share/go/1.16/src/internal/trace/mkcanned.bash
    /usr/share/go/1.16/src/make.bash
    /usr/share/go/1.16/src/race.bash
    /usr/share/go/1.16/src/run.bash</changelog>
  <changelog author="jkowalczyk@suse.com" date="1631275200">- go1.16.8 (released 2021-09-09) includes a security fix to the
  archive/zip package, as well as bug fixes to the archive/zip,
  go/internal/gccgoimporter, html/template, net/http, and
  runtime/pprof packages.
  Refs boo#1182345 go1.16 release tracking
  CVE-2021-39293
  * boo#1190589 go#47801 CVE-2021-39293
  * go#47985 archive/zip: overflow in preallocation check can cause OOM panic
  * go#47691 x/net/http2: server sends RST_STREAM w/ PROTOCOL_ERROR to clients it incorrectly believes have violated max advertised num streams
  * go#47675 runtime/pprof: apparent deadlock in TestGoroutineSwitch on linux-armv6l
  * go#47610 go/internal/gccgoimporter: TestInstallationImporter broken with tip gccgo
  * go#47535 net/http: TestCancelRequestWhenSharingConnection can cause port exhaustion
  * go#47042 html/template: data race with concurrent ExecuteTemplate calls</changelog>
  <changelog author="jkowalczyk@suse.com" date="1633694400">- go1.16.9 (released 2021-10-07) includes a security fix to the
  linker and misc/wasm directory, as well as bug fixes to the
  runtime and to the text/template package.
  Refs boo#1182345 go1.16 release tracking
  CVE-2021-38297
  * boo#1191468 go#48797 CVE-2021-38297
  * go#48799 security: fix CVE-2021-38297 misc/wasm, cmd/link: do not let command line args overwrite global data
  * go#48443 text/template: should t.init() be executed before t.muTmpl.Lock() in AddParseTree() method?
  * go#47858 time: timer reset sometimes ignored, causing delayed ticks</changelog>
  <changelog author="jkowalczyk@suse.com" date="1636027200">- go1.16.10 (released 2021-11-04) includes security fixes to the
  archive/zip and debug/macho packages, as well as bug fixes to the
  compiler, linker, runtime, the misc/wasm directory, and to the
  net/http package.
  Refs boo#1182345 go1.16 release tracking
  CVE-2021-41771 CVE-2021-41772
  * boo#1192377 go#48990 CVE-2021-41771
  * go#48991 debug/macho: invalid dynamic symbol table command can cause panic
  * boo#1192378 go#48085 CVE-2021-41772
  * go#48251 archive/zip: Reader.Open panics on empty string
  * go#49153 misc/wasm, cmd/link: Go 1.17.2 causes WASM builds to throw command line too long with many environment variables
  * go#49076 x/net/http2: backport critical fixes
  * go#49009 net,runtime: apparent deadlock in (*net.conn).Close and runtime.netpollblock on arm64 platforms
  * go#48822 x/net/http2: client can hang forever if headers' size exceeds connection's buffer size and server hangs past request time
  * go#48649 x/net/http2: pool deadlock
  * go#48478 cmd/compile: 64 bits shifts on arm get wrong results
  * go#48474 cmd/compile: incorrect arm/arm64 simplification rules</changelog>
  <changelog author="jkowalczyk@suse.com" date="1638532800">- go1.16.11 (released 2021-12-02) includes fixes to the compiler,
  runtime, and the net/http, net/http/httptest, and time packages.
  Refs boo#1182345 go1.16 release tracking
  * go#49910 x/net/http2: frequent failures in TestClientConnCloseAtBody
  * go#49908 x/net/ipv6: TestPacketConnReadWriteMulticast{UDP,ICMP} failing with "i/o timeout" on OpenBSD 6.8 and 7.0
  * go#49904 x/net/http2: Client doesn't send body until ExpectContinueTimeout expires
  * go#49867 syscall: ntdll.dll errors in rtlGetNtVersionNumbers via os.StartProcess
  * go#49851 net/http/httptest: Close does not wait for the underlying Server's ConnState callbacks to complete
  * go#49728 runtime: "fatal error: unexpected signal during runtime execution" in cmd/go tests on darwin-amd64-race running macOS 12.0
  * go#49661 x/net/http2: TestUnreadFlowControlReturned_Server failures with stream error "NO_ERROR" since 2021-10-05
  * go#49623 net/http: Possible HTTP/2 busy loop regression in Go 1.17.3
  * go#49567 net/http: server responds with Transfer-Encoding: identity
  * go#49560 x/net/http2: setting Request.Close doesn't close TCP connections
  * go#49558 net/http: HTTP/2 response body Close method sometimes returns spurious context cancelation error (1.17.3 regression)
  * go#49406 time: ParseInLocation error
  * go#49391 cmd/compile: internal compiler error: Expand calls interface data problem</changelog>
  <changelog author="jkowalczyk@suse.com" date="1639051200">- go1.16.12 (released 2021-12-09) includes security fixes to the
  syscall and net/http packages.
  Refs boo#1182345 go1.16 release tracking
  CVE-2021-44716 CVE-2021-44717
  * boo#1193598 go#50057 CVE-2021-44717
  * go#50066 syscall: don?t close fd 0 on ForkExec error
  * boo#1193597 go#50058 CVE-2021-44716
  * go#50064 net/http: limit growth of header canonicalization cache</changelog>
  <changelog author="jkowalczyk@suse.com" date="1641470400">- go1.16.13 (released 2022-01-06) includes fixes to the compiler,
  linker, runtime, and the net/http package.
  Refs boo#1182345 go1.16 release tracking
  * go#50449 x/net/http2: http.Server.WriteTimeout does not fire if the http2 stream's window is out of space.
  * go#50296 cmd/link: does not set section type of .init_array correctly
  * go#50194 runtime/race: building for iOS, but linking in object file built for macOS
  * go#50072 runtime: race detector SIGABRT or SIGSEGV on macOS Monterey
  * go#49923 cmd/link: support more load commands on Mach-O
  * go#49412 cmd/compile: internal compiler error: Op...LECall and OpDereference have mismatched mem
  * go#48115 runtime: mallocs cause "base outside usable address space" panic when running on iOS 14</changelog>
</package>
<package pkgid="55d35f9351a4436e4bb6763c993c3ddbc4907f3688be4e4a7c64ea78eb0012fc" name="go1.16-doc" arch="x86_64">
  <version epoch="0" ver="1.16.13" rel="1.40.1"/>
  <changelog author="jkowalczyk@suse.com" date="1611835200">- go1.16rc1 (released 2021-01-28) is a release candidate of go1.16
  cut from the master branch at the revision tagged go1.16rc1.</changelog>
  <changelog author="jkowalczyk@suse.com" date="1613476800">- go1.16 (released 2021-02-16) Go 1.16 is a major release of Go.
  go1.16.x minor releases will be provided through February 2022.
  https://github.com/golang/go/wiki/Go-Release-Cycle
  Most changes are in the implementation of the toolchain, runtime,
  and libraries. As always, the release maintains the Go 1 promise
  of compatibility. We expect almost all Go programs to continue to
  compile and run as before.
  Refs boo#1182345 go1.16 release tracking
  * See release notes https://golang.org/doc/go1.16. Excerpts
    relevant to OBS environment and for SUSE/openSUSE follow:
  * Module-aware mode is enabled by default, regardless of whether
    a go.mod file is present in the current working directory or a
    parent directory. More precisely, the GO111MODULE environment
    variable now defaults to on. To switch to the previous
    behavior, set GO111MODULE to auto.
  * Build commands like go build and go test no longer modify
    go.mod and go.sum by default. Instead, they report an error if
    a module requirement or checksum needs to be added or updated
    (as if the -mod=readonly flag were used). Module requirements
    and sums may be adjusted with go mod tidy or go get.
  * go install now accepts arguments with version suffixes (for
    example, go install example.com/cmd@v1.0.0). This causes go
    install to build and install packages in module-aware mode,
    ignoring the go.mod file in the current directory or any parent
    directory, if there is one. This is useful for installing
    executables without affecting the dependencies of the main
    module.
  * go install, with or without a version suffix (as described
    above), is now the recommended way to build and install
    packages in module mode. go get should be used with the -d flag
    to adjust the current module's dependencies without building
    packages, and use of go get to build and install packages is
    deprecated. In a future release, the -d flag will always be
    enabled.
  * retract directives may now be used in a go.mod file to indicate
    that certain published versions of the module should not be
    used by other modules. A module author may retract a version
    after a severe problem is discovered or if the version was
    published unintentionally.
  * The go mod vendor and go mod tidy subcommands now accept the -e
    flag, which instructs them to proceed despite errors in
    resolving missing packages.
  * The go command now ignores requirements on module versions
    excluded by exclude directives in the main module. Previously,
    the go command used the next version higher than an excluded
    version, but that version could change over time, resulting in
    non-reproducible builds.
  * In module mode, the go command now disallows import paths that
    include non-ASCII characters or path elements with a leading
    dot character (.). Module paths with these characters were
    already disallowed (see Module paths and versions), so this
    change affects only paths within module subdirectories.
  * The go command now supports including static files and file
    trees as part of the final executable, using the new //go:embed
    directive. See the documentation for the new embed package for
    details.
  * When using go test, a test that calls os.Exit(0) during
    execution of a test function will now be considered to
    fail. This will help catch cases in which a test calls code
    that calls os.Exit(0) and thereby stops running all future
    tests. If a TestMain function calls os.Exit(0) that is still
    considered to be a passing test.
  * go test reports an error when the -c or -i flags are used
    together with unknown flags. Normally, unknown flags are passed
    to tests, but when -c or -i are used, tests are not run.
  * The go get -insecure flag is deprecated and will be removed in
    a future version. This flag permits fetching from repositories
    and resolving custom domains using insecure schemes such as
    HTTP, and also bypasses module sum validation using the
    checksum database. To permit the use of insecure schemes, use
    the GOINSECURE environment variable instead. To bypass module
    sum validation, use GOPRIVATE or GONOSUMDB. See go help
    environment for details.
  * go get example.com/mod@patch now requires that some version of
    example.com/mod already be required by the main
    module. (However, go get -u=patch continues to patch even
    newly-added dependencies.)
  * GOVCS is a new environment variable that limits which version
    control tools the go command may use to download source
    code. This mitigates security issues with tools that are
    typically used in trusted, authenticated environments. By
    default, git and hg may be used to download code from any
    repository. svn, bzr, and fossil may only be used to download
    code from repositories with module paths or package paths
    matching patterns in the GOPRIVATE environment variable. See go
    help vcs for details.
  * When the main module's go.mod file declares go 1.16 or higher,
    the all package pattern now matches only those packages that
    are transitively imported by a package or test found in the
    main module. (Packages imported by tests of packages imported
    by the main module are no longer included.) This is the same
    set of packages retained by go mod vendor since Go 1.11.
  * When the -toolexec build flag is specified to use a program
    when invoking toolchain programs like compile or asm, the
    environment variable TOOLEXEC_IMPORTPATH is now set to the
    import path of the package being built.
  * The -i flag accepted by go build, go install, and go test is
    now deprecated. The -i flag instructs the go command to install
    packages imported by packages named on the command line. Since
    the build cache was introduced in Go 1.10, the -i flag no
    longer has a significant effect on build times, and it causes
    errors when the install directory is not writable.
  * When the -export flag is specified, the BuildID field is now
    set to the build ID of the compiled package. This is equivalent
    to running go tool buildid on go list -exported -f {{.Export}},
    but without the extra step.
  * The -overlay flag specifies a JSON configuration file
    containing a set of file path replacements. The -overlay flag
    may be used with all build commands and go mod subcommands. It
    is primarily intended to be used by editor tooling such as
    gopls to understand the effects of unsaved changes to source
    files. The config file maps actual file paths to replacement
    file paths and the go command and its builds will run as if the
    actual file paths exist with the contents given by the
    replacement file paths, or don't exist if the replacement file
    paths are empty.
  * The cgo tool will no longer try to translate C struct bitfields
    into Go struct fields, even if their size can be represented in
    Go. The order in which C bitfields appear in memory is
    implementation dependent, so in some cases the cgo tool
    produced results that were silently incorrect.
  * The linux/riscv64 port now supports cgo and -buildmode=pie.
    This release also includes performance optimizations and code
    generation improvements for RISC-V.
  * The new runtime/metrics package introduces a stable interface
    for reading implementation-defined metrics from the Go
    runtime. It supersedes existing functions like
    runtime.ReadMemStats and debug.GCStats and is significantly
    more general and efficient. See the package documentation for
    more details.
  * Setting the GODEBUG environment variable to inittrace=1 now
    causes the runtime to emit a single line to standard error for
    each package init, summarizing its execution time and memory
    allocation. This trace can be used to find bottlenecks or
    regressions in Go startup performance. The GODEBUG
    documentation describes the format.
  * On Linux, the runtime now defaults to releasing memory to the
    operating system promptly (using MADV_DONTNEED), rather than
    lazily when the operating system is under memory pressure
    (using MADV_FREE). This means process-level memory statistics
    like RSS will more accurately reflect the amount of physical
    memory being used by Go processes. Systems that are currently
    using GODEBUG=madvdontneed=1 to improve memory monitoring
    behavior no longer need to set this environment variable.
  * Go 1.16 fixes a discrepancy between the race detector and the
    Go memory model. The race detector now more precisely follows
    the channel synchronization rules of the memory model. As a
    result, the detector may now report races it previously missed.
  * linker: This release includes additional improvements to the Go
    linker, reducing linker resource usage (both time and memory)
    and improving code robustness/maintainability. These changes
    form the second half of a two-release project to modernize the
    Go linker.
  * The linker changes in 1.16 extend the 1.15 improvements to all
    supported architecture/OS combinations (the 1.15 performance
    improvements were primarily focused on ELF-based OSes and amd64
    architectures). For a representative set of large Go programs,
    linking is 20-25% faster than 1.15 and requires 5-15% less
    memory on average for linux/amd64, with larger improvements for
    other architectures and OSes. Most binaries are also smaller as
    a result of more aggressive symbol pruning.
  * The new embed package provides access to files embedded in the
    program during compilation using the new //go:embed directive.
  * The new io/fs package defines the fs.FS interface, an
    abstraction for read-only trees of files. The standard library
    packages have been adapted to make use of the interface as
    appropriate.
  * For testing code that implements fs.FS, the new testing/fstest
    package provides a TestFS function that checks for and reports
    common mistakes. It also provides a simple in-memory file
    system implementation, MapFS, which can be useful for testing
    code that accepts fs.FS implementations.
  * syscall: On Linux, Setgid, Setuid, and related calls are now
    implemented. Previously, they returned an syscall.EOPNOTSUPP
    error. On Linux, the new functions AllThreadsSyscall and
    AllThreadsSyscall6 may be used to make a system call on all Go
    threads in the process. These functions may only be used by
    programs that do not use cgo; if a program uses cgo, they will
    always return syscall.ENOTSUP.
  * time/tzdata: The slim timezone data format is now used for the
    timezone database in $GOROOT/lib/time/zoneinfo.zip and the
    embedded copy in this package. This reduces the size of the
    timezone database by about 350 KB.</changelog>
  <changelog author="jkowalczyk@suse.com" date="1613649600">- gcc6-go.patch fix typo go-7 to go-6 for bootstrap on SLE-12 gcc6</changelog>
  <changelog author="jkowalczyk@suse.com" date="1615377600">- go1.16.1 (released 2021-03-10) includes security fixes to the
  archive/zip and encoding/xml packages.
  CVE-2021-27918 CVE-2021-27919
  Refs boo#1182345 go1.16 release tracking
  * boo#1183333 CVE-2021-27918
  * go#44915 encoding/xml: infinite loop when using `xml.NewTokenDecoder` with a custom `TokenReader`
  * boo#1183334 CVE-2021-27919
  * go#44917 archive/zip: can panic when calling Reader.Open</changelog>
  <changelog author="jkowalczyk@suse.com" date="1615550400">- go1.16.2 (released 2021-03-11) includes fixes to cgo, the
  compiler, linker, the go command, and the syscall and time
  packages.
  Refs boo#1182345 go1.16 release tracking
  * go#44793 cmd/go: mod tidy should ignore missing standard library packages
  * go#44746 cmd/go: improve error message when outside a module from "working directory is not part of a module"
  * go#44676 cmd/go: warning message when getting a retracted module version is missing a trailing newline
  * go#44659 runtime: marked free object in span
  * go#44647 cmd/go: "malformed import path" in Go 1.16 for packages with path elements containing a leading dot
  * go#44638 cmd/link: runtime crash, unexpected fault address 0xffffffffffffffff, h2_bundle.go, when using plugin
  * go#44618 time: LoadLocationFromTZData with slim tzdata uses incorrect zone
  * go#44593 syscall &amp; x/sys/windows: buffer overflow in GetQueuedCompletionStatus
  * go#44498 cmd/go: 'go mod edit -exclude' erroneously rejects '+incompatible' versions
  * go#44496 cmd/go: malformed module path with retract v2+
  * go#44464 cmd/compile: ICE on deferred call to syscall.LazyDLL.Call
  * go#44462 x/tools/go/analysis, syscall: ptrace redeclared in this block
  * go#44433 cmd/compile: Compiler regression in Go 1.16 - internal compiler error: child dcl collision on symbol
  * go#44402 doc: Broken image in readme
  * go#44358 cmd/compile: internal compiler error: Value live at entry. It shouldn't be.
  * go#44346 runtime/cgo: cannot build with -Wsign-compare</changelog>
  <changelog author="jkowalczyk@suse.com" date="1617364800">- go1.16.3 (released 2021-04-01) includes fixes to the compiler,
  linker, runtime, the go command, and the testing and time
  packages.
  Refs boo#1182345 go1.16 release tracking
  * go#45303 runtime: "invalid pc-encoded table" throw caused by bad cgo traceback
  * go#45253 cmd/compile: fix long RMW bit operations on AMD64
  * go#45240 all: run.{bash,bat,rc} sets GOPATH inconsistently
  * go#45192 Strange behaviour with loops
  * go#45030 cmd/link: go 1.16 plugin does not initialize global variables correctly when not used directly
  * go#44888 testing: Helper line number has changed in 1.16
  * go#44885 cmd/go: import paths ending with '+' are rejected (affects executable like g++ or clang++)
  * go#44869 time, runtime: zero duration timer takes 2 minutes to fire
  * go#44860 cmd/go: documentation at golang.org for cmd/go has confusing formatting
  * go#44812 cmd/go: 'go get' does not add missing hash to go.sum when ziphash file missing from cache
  * go#44640 cmd/link: fail to build when using time/tzdata on ARM</changelog>
  <changelog author="jkowalczyk@suse.com" date="1620388800">- go1.16.4 (released 2021-05-06) includes a security fix to the
  net/http package, as well as bug fixes to the runtime, the
  compiler, and the archive/zip, time, and syscall packages.
  CVE-2021-31525
  Refs boo#1182345 go1.16 release tracking
  * boo#1185790 CVE-2021-31525
  * go#45712 net/http: ReadRequest can stack overflow
  * go#45636 cmd/compile: internal compiler error: Invalid PPC64 rotate mask
  * go#45482 runtime: "invalid pc-encoded table" throw caused by bad cgo traceback (expandFinalInlineFrames)
  * go#45385 time: Europe/Dublin timezone handling broken with embedded timezone database
  * go#45347 archive/zip: duplicate entries in FS interface
  * go#45307 os/signal: timeout in TestAllThreadsSyscallSignals</changelog>
  <changelog author="jkowalczyk@suse.com" date="1622721600">- go1.16.5 (released 2021-06-03) includes security fixes to the
  archive/zip, math/big, net, and net/http/httputil packages, as
  well as bug fixes to the linker, the go command, and the net/http
  package.
  CVE-2021-33195 CVE-2021-33196 CVE-2021-33197 CVE-2021-33198
  Refs boo#1182345 go1.16 release tracking
  * boo#1187443 go#46241 CVE-2021-33195
  * go#46357 net: Lookup functions may return invalid host names
  * go#46530 net: Unix dnsclient test for CVE-2021-33195 assumes that 1.2.3.4 does not resolve
  * boo#1186622 go#46242 CVE-2021-33196
  * go#46397 archive/zip: malformed archive may cause panic or memory exhaustion
  * boo#1187444 go#46313 CVE-2021-33197
  * go#46315 net/http/httputil: ReverseProxy forwards Connection headers if first one is empty
  * boo#1187445 go#45910 CVE-2021-33198
  * go#46306 math/big: (*Rat).SetString with "1.770p02041010010011001001" crashes with "makeslice: len out of range"
  * go#46214 cmd/go: make go mod download with no arguments leave go.sum alone
  * go#46144 cmd/go: error out of 'go mod tidy' if the go.mod file specifies a newer-than-supported Go version
  * go#46128 cmd/link: internal error when externally linking very large binaries
  * go#45927 cmd/link: SIGSEGV running 'openshift-install version' for release-4.8 using external linking on PPC64LE
  * go#45832 cmd/link: unexpected trampoline when cross-compiling to ppc64le</changelog>
  <changelog author="jkowalczyk@suse.com" date="1623326400">- Fix extraneous trailing percent character %endif% in spec file.</changelog>
  <changelog author="jkowalczyk@suse.com" date="1626091200">- go1.16.6 (released 2021-07-12) includes a security fix to the
  crypto/tls package, as well as bug fixes to the compiler, and the
  net and net/http packages.
  CVE-2021-34558
  Refs boo#1182345 go1.16 release tracking
  * boo#1188229 go#47143 CVE-2021-34558
  * go#47145 security: fix CVE-2021-34558
  * go#46999 net: LookupMX behaviour broken
  * go#46981 net: TestCVE202133195 fails if /etc/resolv.conf specifies ndots larger than 3
  * go#46769 syscall: TestGroupCleanupUserNamespace test failure on Fedora
  * go#46657 runtime: deeply nested struct initialized with non-zero values
  * go#44984 net/http: server not setting Content-Length in certain cases</changelog>
  <changelog author="fvogt@suse.com" date="1626696000">- Add patch to fix crashes on PowerPC with kernel &gt;= 5.13:
  * fix-ppc64-crashes.patch</changelog>
  <changelog author="jkowalczyk@suse.com" date="1628164800">- Drop patch to fix crashes on PowerPC with kernel &gt;= 5.13, fixed
  in next upstream release:
  * drop fix-ppc64-crashes.patch</changelog>
  <changelog author="jkowalczyk@suse.com" date="1628164801">- go1.16.7 (released 2021-08-05) includes a security fix to the
  net/http/httputil package, as well as bug fixes to the compiler,
  the linker, the runtime, the go command, and the net/http
  package.
  CVE-2021-36221
  Refs boo#1182345 go1.16 release tracking
  * boo#1189162 go#46866 CVE-2021-36221
  * go#47474 net/http: panic due to racy read of persistConn after handler panic
  * go#47348 cmd/go: "go list -f '{{.Stale}}'" stack overflow with cyclic imports
  * go#47332 time: Timer reset broken under heavy use since go1.16 timer optimizations added
  * go#47289 cmd/link: build error with cgo in Windows, redefinition of go.map.zero
  * go#47015 cmd/go: go mod vendor: open C:\Users\LICENSE: Access is denied.
  * go#46928 cmd/compile: register conflict between external linker and duffzero on arm64
  * go#46858 runtime: ppc64x binaries randomly segfault on linux 5.13rc6
  * go#46551 cmd/go: unhelpful error message when running "go install" on a replaced-but-not-required package</changelog>
  <changelog author="jkowalczyk@suse.com" date="1628769600">- Add bash scripts used by go tool commands to provide a more
  complete cross-compiling go toolchain install.
  * Fixes "go tool dist list" error "all.bash does not exist"
  * Added to packaging:
    /usr/lib64/go/1.16/lib/time/update.bash (already packaged)
    /usr/lib64/go/1.16/src/all.bash
    /usr/lib64/go/1.16/src/bootstrap.bash
    /usr/lib64/go/1.16/src/buildall.bash
    /usr/lib64/go/1.16/src/clean.bash
    /usr/lib64/go/1.16/src/cmp.bash
    /usr/lib64/go/1.16/src/make.bash
    /usr/lib64/go/1.16/src/race.bash
    /usr/lib64/go/1.16/src/run.bash
    /usr/share/go/1.16/src/all.bash
    /usr/share/go/1.16/src/bootstrap.bash
    /usr/share/go/1.16/src/buildall.bash
    /usr/share/go/1.16/src/clean.bash
    /usr/share/go/1.16/src/cmd/compile/internal/ssa/gen/cover.bash
    /usr/share/go/1.16/src/cmd/vendor/golang.org/x/sys/windows/mkerrors.bash
    /usr/share/go/1.16/src/cmd/vendor/golang.org/x/sys/windows/mkknownfolderids.bash
    /usr/share/go/1.16/src/cmp.bash
    /usr/share/go/1.16/src/internal/trace/mkcanned.bash
    /usr/share/go/1.16/src/make.bash
    /usr/share/go/1.16/src/race.bash
    /usr/share/go/1.16/src/run.bash</changelog>
  <changelog author="jkowalczyk@suse.com" date="1631275200">- go1.16.8 (released 2021-09-09) includes a security fix to the
  archive/zip package, as well as bug fixes to the archive/zip,
  go/internal/gccgoimporter, html/template, net/http, and
  runtime/pprof packages.
  Refs boo#1182345 go1.16 release tracking
  CVE-2021-39293
  * boo#1190589 go#47801 CVE-2021-39293
  * go#47985 archive/zip: overflow in preallocation check can cause OOM panic
  * go#47691 x/net/http2: server sends RST_STREAM w/ PROTOCOL_ERROR to clients it incorrectly believes have violated max advertised num streams
  * go#47675 runtime/pprof: apparent deadlock in TestGoroutineSwitch on linux-armv6l
  * go#47610 go/internal/gccgoimporter: TestInstallationImporter broken with tip gccgo
  * go#47535 net/http: TestCancelRequestWhenSharingConnection can cause port exhaustion
  * go#47042 html/template: data race with concurrent ExecuteTemplate calls</changelog>
  <changelog author="jkowalczyk@suse.com" date="1633694400">- go1.16.9 (released 2021-10-07) includes a security fix to the
  linker and misc/wasm directory, as well as bug fixes to the
  runtime and to the text/template package.
  Refs boo#1182345 go1.16 release tracking
  CVE-2021-38297
  * boo#1191468 go#48797 CVE-2021-38297
  * go#48799 security: fix CVE-2021-38297 misc/wasm, cmd/link: do not let command line args overwrite global data
  * go#48443 text/template: should t.init() be executed before t.muTmpl.Lock() in AddParseTree() method?
  * go#47858 time: timer reset sometimes ignored, causing delayed ticks</changelog>
  <changelog author="jkowalczyk@suse.com" date="1636027200">- go1.16.10 (released 2021-11-04) includes security fixes to the
  archive/zip and debug/macho packages, as well as bug fixes to the
  compiler, linker, runtime, the misc/wasm directory, and to the
  net/http package.
  Refs boo#1182345 go1.16 release tracking
  CVE-2021-41771 CVE-2021-41772
  * boo#1192377 go#48990 CVE-2021-41771
  * go#48991 debug/macho: invalid dynamic symbol table command can cause panic
  * boo#1192378 go#48085 CVE-2021-41772
  * go#48251 archive/zip: Reader.Open panics on empty string
  * go#49153 misc/wasm, cmd/link: Go 1.17.2 causes WASM builds to throw command line too long with many environment variables
  * go#49076 x/net/http2: backport critical fixes
  * go#49009 net,runtime: apparent deadlock in (*net.conn).Close and runtime.netpollblock on arm64 platforms
  * go#48822 x/net/http2: client can hang forever if headers' size exceeds connection's buffer size and server hangs past request time
  * go#48649 x/net/http2: pool deadlock
  * go#48478 cmd/compile: 64 bits shifts on arm get wrong results
  * go#48474 cmd/compile: incorrect arm/arm64 simplification rules</changelog>
  <changelog author="jkowalczyk@suse.com" date="1638532800">- go1.16.11 (released 2021-12-02) includes fixes to the compiler,
  runtime, and the net/http, net/http/httptest, and time packages.
  Refs boo#1182345 go1.16 release tracking
  * go#49910 x/net/http2: frequent failures in TestClientConnCloseAtBody
  * go#49908 x/net/ipv6: TestPacketConnReadWriteMulticast{UDP,ICMP} failing with "i/o timeout" on OpenBSD 6.8 and 7.0
  * go#49904 x/net/http2: Client doesn't send body until ExpectContinueTimeout expires
  * go#49867 syscall: ntdll.dll errors in rtlGetNtVersionNumbers via os.StartProcess
  * go#49851 net/http/httptest: Close does not wait for the underlying Server's ConnState callbacks to complete
  * go#49728 runtime: "fatal error: unexpected signal during runtime execution" in cmd/go tests on darwin-amd64-race running macOS 12.0
  * go#49661 x/net/http2: TestUnreadFlowControlReturned_Server failures with stream error "NO_ERROR" since 2021-10-05
  * go#49623 net/http: Possible HTTP/2 busy loop regression in Go 1.17.3
  * go#49567 net/http: server responds with Transfer-Encoding: identity
  * go#49560 x/net/http2: setting Request.Close doesn't close TCP connections
  * go#49558 net/http: HTTP/2 response body Close method sometimes returns spurious context cancelation error (1.17.3 regression)
  * go#49406 time: ParseInLocation error
  * go#49391 cmd/compile: internal compiler error: Expand calls interface data problem</changelog>
  <changelog author="jkowalczyk@suse.com" date="1639051200">- go1.16.12 (released 2021-12-09) includes security fixes to the
  syscall and net/http packages.
  Refs boo#1182345 go1.16 release tracking
  CVE-2021-44716 CVE-2021-44717
  * boo#1193598 go#50057 CVE-2021-44717
  * go#50066 syscall: don?t close fd 0 on ForkExec error
  * boo#1193597 go#50058 CVE-2021-44716
  * go#50064 net/http: limit growth of header canonicalization cache</changelog>
  <changelog author="jkowalczyk@suse.com" date="1641470400">- go1.16.13 (released 2022-01-06) includes fixes to the compiler,
  linker, runtime, and the net/http package.
  Refs boo#1182345 go1.16 release tracking
  * go#50449 x/net/http2: http.Server.WriteTimeout does not fire if the http2 stream's window is out of space.
  * go#50296 cmd/link: does not set section type of .init_array correctly
  * go#50194 runtime/race: building for iOS, but linking in object file built for macOS
  * go#50072 runtime: race detector SIGABRT or SIGSEGV on macOS Monterey
  * go#49923 cmd/link: support more load commands on Mach-O
  * go#49412 cmd/compile: internal compiler error: Op...LECall and OpDereference have mismatched mem
  * go#48115 runtime: mallocs cause "base outside usable address space" panic when running on iOS 14</changelog>
</package>
<package pkgid="a20861c26777a71c0d009bff067127ea6aa115e9e2fb59b6cc7248806187b3e8" name="go1.16-race" arch="aarch64">
  <version epoch="0" ver="1.16.13" rel="1.40.1"/>
  <changelog author="jkowalczyk@suse.com" date="1611835200">- go1.16rc1 (released 2021-01-28) is a release candidate of go1.16
  cut from the master branch at the revision tagged go1.16rc1.</changelog>
  <changelog author="jkowalczyk@suse.com" date="1613476800">- go1.16 (released 2021-02-16) Go 1.16 is a major release of Go.
  go1.16.x minor releases will be provided through February 2022.
  https://github.com/golang/go/wiki/Go-Release-Cycle
  Most changes are in the implementation of the toolchain, runtime,
  and libraries. As always, the release maintains the Go 1 promise
  of compatibility. We expect almost all Go programs to continue to
  compile and run as before.
  Refs boo#1182345 go1.16 release tracking
  * See release notes https://golang.org/doc/go1.16. Excerpts
    relevant to OBS environment and for SUSE/openSUSE follow:
  * Module-aware mode is enabled by default, regardless of whether
    a go.mod file is present in the current working directory or a
    parent directory. More precisely, the GO111MODULE environment
    variable now defaults to on. To switch to the previous
    behavior, set GO111MODULE to auto.
  * Build commands like go build and go test no longer modify
    go.mod and go.sum by default. Instead, they report an error if
    a module requirement or checksum needs to be added or updated
    (as if the -mod=readonly flag were used). Module requirements
    and sums may be adjusted with go mod tidy or go get.
  * go install now accepts arguments with version suffixes (for
    example, go install example.com/cmd@v1.0.0). This causes go
    install to build and install packages in module-aware mode,
    ignoring the go.mod file in the current directory or any parent
    directory, if there is one. This is useful for installing
    executables without affecting the dependencies of the main
    module.
  * go install, with or without a version suffix (as described
    above), is now the recommended way to build and install
    packages in module mode. go get should be used with the -d flag
    to adjust the current module's dependencies without building
    packages, and use of go get to build and install packages is
    deprecated. In a future release, the -d flag will always be
    enabled.
  * retract directives may now be used in a go.mod file to indicate
    that certain published versions of the module should not be
    used by other modules. A module author may retract a version
    after a severe problem is discovered or if the version was
    published unintentionally.
  * The go mod vendor and go mod tidy subcommands now accept the -e
    flag, which instructs them to proceed despite errors in
    resolving missing packages.
  * The go command now ignores requirements on module versions
    excluded by exclude directives in the main module. Previously,
    the go command used the next version higher than an excluded
    version, but that version could change over time, resulting in
    non-reproducible builds.
  * In module mode, the go command now disallows import paths that
    include non-ASCII characters or path elements with a leading
    dot character (.). Module paths with these characters were
    already disallowed (see Module paths and versions), so this
    change affects only paths within module subdirectories.
  * The go command now supports including static files and file
    trees as part of the final executable, using the new //go:embed
    directive. See the documentation for the new embed package for
    details.
  * When using go test, a test that calls os.Exit(0) during
    execution of a test function will now be considered to
    fail. This will help catch cases in which a test calls code
    that calls os.Exit(0) and thereby stops running all future
    tests. If a TestMain function calls os.Exit(0) that is still
    considered to be a passing test.
  * go test reports an error when the -c or -i flags are used
    together with unknown flags. Normally, unknown flags are passed
    to tests, but when -c or -i are used, tests are not run.
  * The go get -insecure flag is deprecated and will be removed in
    a future version. This flag permits fetching from repositories
    and resolving custom domains using insecure schemes such as
    HTTP, and also bypasses module sum validation using the
    checksum database. To permit the use of insecure schemes, use
    the GOINSECURE environment variable instead. To bypass module
    sum validation, use GOPRIVATE or GONOSUMDB. See go help
    environment for details.
  * go get example.com/mod@patch now requires that some version of
    example.com/mod already be required by the main
    module. (However, go get -u=patch continues to patch even
    newly-added dependencies.)
  * GOVCS is a new environment variable that limits which version
    control tools the go command may use to download source
    code. This mitigates security issues with tools that are
    typically used in trusted, authenticated environments. By
    default, git and hg may be used to download code from any
    repository. svn, bzr, and fossil may only be used to download
    code from repositories with module paths or package paths
    matching patterns in the GOPRIVATE environment variable. See go
    help vcs for details.
  * When the main module's go.mod file declares go 1.16 or higher,
    the all package pattern now matches only those packages that
    are transitively imported by a package or test found in the
    main module. (Packages imported by tests of packages imported
    by the main module are no longer included.) This is the same
    set of packages retained by go mod vendor since Go 1.11.
  * When the -toolexec build flag is specified to use a program
    when invoking toolchain programs like compile or asm, the
    environment variable TOOLEXEC_IMPORTPATH is now set to the
    import path of the package being built.
  * The -i flag accepted by go build, go install, and go test is
    now deprecated. The -i flag instructs the go command to install
    packages imported by packages named on the command line. Since
    the build cache was introduced in Go 1.10, the -i flag no
    longer has a significant effect on build times, and it causes
    errors when the install directory is not writable.
  * When the -export flag is specified, the BuildID field is now
    set to the build ID of the compiled package. This is equivalent
    to running go tool buildid on go list -exported -f {{.Export}},
    but without the extra step.
  * The -overlay flag specifies a JSON configuration file
    containing a set of file path replacements. The -overlay flag
    may be used with all build commands and go mod subcommands. It
    is primarily intended to be used by editor tooling such as
    gopls to understand the effects of unsaved changes to source
    files. The config file maps actual file paths to replacement
    file paths and the go command and its builds will run as if the
    actual file paths exist with the contents given by the
    replacement file paths, or don't exist if the replacement file
    paths are empty.
  * The cgo tool will no longer try to translate C struct bitfields
    into Go struct fields, even if their size can be represented in
    Go. The order in which C bitfields appear in memory is
    implementation dependent, so in some cases the cgo tool
    produced results that were silently incorrect.
  * The linux/riscv64 port now supports cgo and -buildmode=pie.
    This release also includes performance optimizations and code
    generation improvements for RISC-V.
  * The new runtime/metrics package introduces a stable interface
    for reading implementation-defined metrics from the Go
    runtime. It supersedes existing functions like
    runtime.ReadMemStats and debug.GCStats and is significantly
    more general and efficient. See the package documentation for
    more details.
  * Setting the GODEBUG environment variable to inittrace=1 now
    causes the runtime to emit a single line to standard error for
    each package init, summarizing its execution time and memory
    allocation. This trace can be used to find bottlenecks or
    regressions in Go startup performance. The GODEBUG
    documentation describes the format.
  * On Linux, the runtime now defaults to releasing memory to the
    operating system promptly (using MADV_DONTNEED), rather than
    lazily when the operating system is under memory pressure
    (using MADV_FREE). This means process-level memory statistics
    like RSS will more accurately reflect the amount of physical
    memory being used by Go processes. Systems that are currently
    using GODEBUG=madvdontneed=1 to improve memory monitoring
    behavior no longer need to set this environment variable.
  * Go 1.16 fixes a discrepancy between the race detector and the
    Go memory model. The race detector now more precisely follows
    the channel synchronization rules of the memory model. As a
    result, the detector may now report races it previously missed.
  * linker: This release includes additional improvements to the Go
    linker, reducing linker resource usage (both time and memory)
    and improving code robustness/maintainability. These changes
    form the second half of a two-release project to modernize the
    Go linker.
  * The linker changes in 1.16 extend the 1.15 improvements to all
    supported architecture/OS combinations (the 1.15 performance
    improvements were primarily focused on ELF-based OSes and amd64
    architectures). For a representative set of large Go programs,
    linking is 20-25% faster than 1.15 and requires 5-15% less
    memory on average for linux/amd64, with larger improvements for
    other architectures and OSes. Most binaries are also smaller as
    a result of more aggressive symbol pruning.
  * The new embed package provides access to files embedded in the
    program during compilation using the new //go:embed directive.
  * The new io/fs package defines the fs.FS interface, an
    abstraction for read-only trees of files. The standard library
    packages have been adapted to make use of the interface as
    appropriate.
  * For testing code that implements fs.FS, the new testing/fstest
    package provides a TestFS function that checks for and reports
    common mistakes. It also provides a simple in-memory file
    system implementation, MapFS, which can be useful for testing
    code that accepts fs.FS implementations.
  * syscall: On Linux, Setgid, Setuid, and related calls are now
    implemented. Previously, they returned an syscall.EOPNOTSUPP
    error. On Linux, the new functions AllThreadsSyscall and
    AllThreadsSyscall6 may be used to make a system call on all Go
    threads in the process. These functions may only be used by
    programs that do not use cgo; if a program uses cgo, they will
    always return syscall.ENOTSUP.
  * time/tzdata: The slim timezone data format is now used for the
    timezone database in $GOROOT/lib/time/zoneinfo.zip and the
    embedded copy in this package. This reduces the size of the
    timezone database by about 350 KB.</changelog>
  <changelog author="jkowalczyk@suse.com" date="1613649600">- gcc6-go.patch fix typo go-7 to go-6 for bootstrap on SLE-12 gcc6</changelog>
  <changelog author="jkowalczyk@suse.com" date="1615377600">- go1.16.1 (released 2021-03-10) includes security fixes to the
  archive/zip and encoding/xml packages.
  CVE-2021-27918 CVE-2021-27919
  Refs boo#1182345 go1.16 release tracking
  * boo#1183333 CVE-2021-27918
  * go#44915 encoding/xml: infinite loop when using `xml.NewTokenDecoder` with a custom `TokenReader`
  * boo#1183334 CVE-2021-27919
  * go#44917 archive/zip: can panic when calling Reader.Open</changelog>
  <changelog author="jkowalczyk@suse.com" date="1615550400">- go1.16.2 (released 2021-03-11) includes fixes to cgo, the
  compiler, linker, the go command, and the syscall and time
  packages.
  Refs boo#1182345 go1.16 release tracking
  * go#44793 cmd/go: mod tidy should ignore missing standard library packages
  * go#44746 cmd/go: improve error message when outside a module from "working directory is not part of a module"
  * go#44676 cmd/go: warning message when getting a retracted module version is missing a trailing newline
  * go#44659 runtime: marked free object in span
  * go#44647 cmd/go: "malformed import path" in Go 1.16 for packages with path elements containing a leading dot
  * go#44638 cmd/link: runtime crash, unexpected fault address 0xffffffffffffffff, h2_bundle.go, when using plugin
  * go#44618 time: LoadLocationFromTZData with slim tzdata uses incorrect zone
  * go#44593 syscall &amp; x/sys/windows: buffer overflow in GetQueuedCompletionStatus
  * go#44498 cmd/go: 'go mod edit -exclude' erroneously rejects '+incompatible' versions
  * go#44496 cmd/go: malformed module path with retract v2+
  * go#44464 cmd/compile: ICE on deferred call to syscall.LazyDLL.Call
  * go#44462 x/tools/go/analysis, syscall: ptrace redeclared in this block
  * go#44433 cmd/compile: Compiler regression in Go 1.16 - internal compiler error: child dcl collision on symbol
  * go#44402 doc: Broken image in readme
  * go#44358 cmd/compile: internal compiler error: Value live at entry. It shouldn't be.
  * go#44346 runtime/cgo: cannot build with -Wsign-compare</changelog>
  <changelog author="jkowalczyk@suse.com" date="1617364800">- go1.16.3 (released 2021-04-01) includes fixes to the compiler,
  linker, runtime, the go command, and the testing and time
  packages.
  Refs boo#1182345 go1.16 release tracking
  * go#45303 runtime: "invalid pc-encoded table" throw caused by bad cgo traceback
  * go#45253 cmd/compile: fix long RMW bit operations on AMD64
  * go#45240 all: run.{bash,bat,rc} sets GOPATH inconsistently
  * go#45192 Strange behaviour with loops
  * go#45030 cmd/link: go 1.16 plugin does not initialize global variables correctly when not used directly
  * go#44888 testing: Helper line number has changed in 1.16
  * go#44885 cmd/go: import paths ending with '+' are rejected (affects executable like g++ or clang++)
  * go#44869 time, runtime: zero duration timer takes 2 minutes to fire
  * go#44860 cmd/go: documentation at golang.org for cmd/go has confusing formatting
  * go#44812 cmd/go: 'go get' does not add missing hash to go.sum when ziphash file missing from cache
  * go#44640 cmd/link: fail to build when using time/tzdata on ARM</changelog>
  <changelog author="jkowalczyk@suse.com" date="1620388800">- go1.16.4 (released 2021-05-06) includes a security fix to the
  net/http package, as well as bug fixes to the runtime, the
  compiler, and the archive/zip, time, and syscall packages.
  CVE-2021-31525
  Refs boo#1182345 go1.16 release tracking
  * boo#1185790 CVE-2021-31525
  * go#45712 net/http: ReadRequest can stack overflow
  * go#45636 cmd/compile: internal compiler error: Invalid PPC64 rotate mask
  * go#45482 runtime: "invalid pc-encoded table" throw caused by bad cgo traceback (expandFinalInlineFrames)
  * go#45385 time: Europe/Dublin timezone handling broken with embedded timezone database
  * go#45347 archive/zip: duplicate entries in FS interface
  * go#45307 os/signal: timeout in TestAllThreadsSyscallSignals</changelog>
  <changelog author="jkowalczyk@suse.com" date="1622721600">- go1.16.5 (released 2021-06-03) includes security fixes to the
  archive/zip, math/big, net, and net/http/httputil packages, as
  well as bug fixes to the linker, the go command, and the net/http
  package.
  CVE-2021-33195 CVE-2021-33196 CVE-2021-33197 CVE-2021-33198
  Refs boo#1182345 go1.16 release tracking
  * boo#1187443 go#46241 CVE-2021-33195
  * go#46357 net: Lookup functions may return invalid host names
  * go#46530 net: Unix dnsclient test for CVE-2021-33195 assumes that 1.2.3.4 does not resolve
  * boo#1186622 go#46242 CVE-2021-33196
  * go#46397 archive/zip: malformed archive may cause panic or memory exhaustion
  * boo#1187444 go#46313 CVE-2021-33197
  * go#46315 net/http/httputil: ReverseProxy forwards Connection headers if first one is empty
  * boo#1187445 go#45910 CVE-2021-33198
  * go#46306 math/big: (*Rat).SetString with "1.770p02041010010011001001" crashes with "makeslice: len out of range"
  * go#46214 cmd/go: make go mod download with no arguments leave go.sum alone
  * go#46144 cmd/go: error out of 'go mod tidy' if the go.mod file specifies a newer-than-supported Go version
  * go#46128 cmd/link: internal error when externally linking very large binaries
  * go#45927 cmd/link: SIGSEGV running 'openshift-install version' for release-4.8 using external linking on PPC64LE
  * go#45832 cmd/link: unexpected trampoline when cross-compiling to ppc64le</changelog>
  <changelog author="jkowalczyk@suse.com" date="1623326400">- Fix extraneous trailing percent character %endif% in spec file.</changelog>
  <changelog author="jkowalczyk@suse.com" date="1626091200">- go1.16.6 (released 2021-07-12) includes a security fix to the
  crypto/tls package, as well as bug fixes to the compiler, and the
  net and net/http packages.
  CVE-2021-34558
  Refs boo#1182345 go1.16 release tracking
  * boo#1188229 go#47143 CVE-2021-34558
  * go#47145 security: fix CVE-2021-34558
  * go#46999 net: LookupMX behaviour broken
  * go#46981 net: TestCVE202133195 fails if /etc/resolv.conf specifies ndots larger than 3
  * go#46769 syscall: TestGroupCleanupUserNamespace test failure on Fedora
  * go#46657 runtime: deeply nested struct initialized with non-zero values
  * go#44984 net/http: server not setting Content-Length in certain cases</changelog>
  <changelog author="fvogt@suse.com" date="1626696000">- Add patch to fix crashes on PowerPC with kernel &gt;= 5.13:
  * fix-ppc64-crashes.patch</changelog>
  <changelog author="jkowalczyk@suse.com" date="1628164800">- Drop patch to fix crashes on PowerPC with kernel &gt;= 5.13, fixed
  in next upstream release:
  * drop fix-ppc64-crashes.patch</changelog>
  <changelog author="jkowalczyk@suse.com" date="1628164801">- go1.16.7 (released 2021-08-05) includes a security fix to the
  net/http/httputil package, as well as bug fixes to the compiler,
  the linker, the runtime, the go command, and the net/http
  package.
  CVE-2021-36221
  Refs boo#1182345 go1.16 release tracking
  * boo#1189162 go#46866 CVE-2021-36221
  * go#47474 net/http: panic due to racy read of persistConn after handler panic
  * go#47348 cmd/go: "go list -f '{{.Stale}}'" stack overflow with cyclic imports
  * go#47332 time: Timer reset broken under heavy use since go1.16 timer optimizations added
  * go#47289 cmd/link: build error with cgo in Windows, redefinition of go.map.zero
  * go#47015 cmd/go: go mod vendor: open C:\Users\LICENSE: Access is denied.
  * go#46928 cmd/compile: register conflict between external linker and duffzero on arm64
  * go#46858 runtime: ppc64x binaries randomly segfault on linux 5.13rc6
  * go#46551 cmd/go: unhelpful error message when running "go install" on a replaced-but-not-required package</changelog>
  <changelog author="jkowalczyk@suse.com" date="1628769600">- Add bash scripts used by go tool commands to provide a more
  complete cross-compiling go toolchain install.
  * Fixes "go tool dist list" error "all.bash does not exist"
  * Added to packaging:
    /usr/lib64/go/1.16/lib/time/update.bash (already packaged)
    /usr/lib64/go/1.16/src/all.bash
    /usr/lib64/go/1.16/src/bootstrap.bash
    /usr/lib64/go/1.16/src/buildall.bash
    /usr/lib64/go/1.16/src/clean.bash
    /usr/lib64/go/1.16/src/cmp.bash
    /usr/lib64/go/1.16/src/make.bash
    /usr/lib64/go/1.16/src/race.bash
    /usr/lib64/go/1.16/src/run.bash
    /usr/share/go/1.16/src/all.bash
    /usr/share/go/1.16/src/bootstrap.bash
    /usr/share/go/1.16/src/buildall.bash
    /usr/share/go/1.16/src/clean.bash
    /usr/share/go/1.16/src/cmd/compile/internal/ssa/gen/cover.bash
    /usr/share/go/1.16/src/cmd/vendor/golang.org/x/sys/windows/mkerrors.bash
    /usr/share/go/1.16/src/cmd/vendor/golang.org/x/sys/windows/mkknownfolderids.bash
    /usr/share/go/1.16/src/cmp.bash
    /usr/share/go/1.16/src/internal/trace/mkcanned.bash
    /usr/share/go/1.16/src/make.bash
    /usr/share/go/1.16/src/race.bash
    /usr/share/go/1.16/src/run.bash</changelog>
  <changelog author="jkowalczyk@suse.com" date="1631275200">- go1.16.8 (released 2021-09-09) includes a security fix to the
  archive/zip package, as well as bug fixes to the archive/zip,
  go/internal/gccgoimporter, html/template, net/http, and
  runtime/pprof packages.
  Refs boo#1182345 go1.16 release tracking
  CVE-2021-39293
  * boo#1190589 go#47801 CVE-2021-39293
  * go#47985 archive/zip: overflow in preallocation check can cause OOM panic
  * go#47691 x/net/http2: server sends RST_STREAM w/ PROTOCOL_ERROR to clients it incorrectly believes have violated max advertised num streams
  * go#47675 runtime/pprof: apparent deadlock in TestGoroutineSwitch on linux-armv6l
  * go#47610 go/internal/gccgoimporter: TestInstallationImporter broken with tip gccgo
  * go#47535 net/http: TestCancelRequestWhenSharingConnection can cause port exhaustion
  * go#47042 html/template: data race with concurrent ExecuteTemplate calls</changelog>
  <changelog author="jkowalczyk@suse.com" date="1633694400">- go1.16.9 (released 2021-10-07) includes a security fix to the
  linker and misc/wasm directory, as well as bug fixes to the
  runtime and to the text/template package.
  Refs boo#1182345 go1.16 release tracking
  CVE-2021-38297
  * boo#1191468 go#48797 CVE-2021-38297
  * go#48799 security: fix CVE-2021-38297 misc/wasm, cmd/link: do not let command line args overwrite global data
  * go#48443 text/template: should t.init() be executed before t.muTmpl.Lock() in AddParseTree() method?
  * go#47858 time: timer reset sometimes ignored, causing delayed ticks</changelog>
  <changelog author="jkowalczyk@suse.com" date="1636027200">- go1.16.10 (released 2021-11-04) includes security fixes to the
  archive/zip and debug/macho packages, as well as bug fixes to the
  compiler, linker, runtime, the misc/wasm directory, and to the
  net/http package.
  Refs boo#1182345 go1.16 release tracking
  CVE-2021-41771 CVE-2021-41772
  * boo#1192377 go#48990 CVE-2021-41771
  * go#48991 debug/macho: invalid dynamic symbol table command can cause panic
  * boo#1192378 go#48085 CVE-2021-41772
  * go#48251 archive/zip: Reader.Open panics on empty string
  * go#49153 misc/wasm, cmd/link: Go 1.17.2 causes WASM builds to throw command line too long with many environment variables
  * go#49076 x/net/http2: backport critical fixes
  * go#49009 net,runtime: apparent deadlock in (*net.conn).Close and runtime.netpollblock on arm64 platforms
  * go#48822 x/net/http2: client can hang forever if headers' size exceeds connection's buffer size and server hangs past request time
  * go#48649 x/net/http2: pool deadlock
  * go#48478 cmd/compile: 64 bits shifts on arm get wrong results
  * go#48474 cmd/compile: incorrect arm/arm64 simplification rules</changelog>
  <changelog author="jkowalczyk@suse.com" date="1638532800">- go1.16.11 (released 2021-12-02) includes fixes to the compiler,
  runtime, and the net/http, net/http/httptest, and time packages.
  Refs boo#1182345 go1.16 release tracking
  * go#49910 x/net/http2: frequent failures in TestClientConnCloseAtBody
  * go#49908 x/net/ipv6: TestPacketConnReadWriteMulticast{UDP,ICMP} failing with "i/o timeout" on OpenBSD 6.8 and 7.0
  * go#49904 x/net/http2: Client doesn't send body until ExpectContinueTimeout expires
  * go#49867 syscall: ntdll.dll errors in rtlGetNtVersionNumbers via os.StartProcess
  * go#49851 net/http/httptest: Close does not wait for the underlying Server's ConnState callbacks to complete
  * go#49728 runtime: "fatal error: unexpected signal during runtime execution" in cmd/go tests on darwin-amd64-race running macOS 12.0
  * go#49661 x/net/http2: TestUnreadFlowControlReturned_Server failures with stream error "NO_ERROR" since 2021-10-05
  * go#49623 net/http: Possible HTTP/2 busy loop regression in Go 1.17.3
  * go#49567 net/http: server responds with Transfer-Encoding: identity
  * go#49560 x/net/http2: setting Request.Close doesn't close TCP connections
  * go#49558 net/http: HTTP/2 response body Close method sometimes returns spurious context cancelation error (1.17.3 regression)
  * go#49406 time: ParseInLocation error
  * go#49391 cmd/compile: internal compiler error: Expand calls interface data problem</changelog>
  <changelog author="jkowalczyk@suse.com" date="1639051200">- go1.16.12 (released 2021-12-09) includes security fixes to the
  syscall and net/http packages.
  Refs boo#1182345 go1.16 release tracking
  CVE-2021-44716 CVE-2021-44717
  * boo#1193598 go#50057 CVE-2021-44717
  * go#50066 syscall: don?t close fd 0 on ForkExec error
  * boo#1193597 go#50058 CVE-2021-44716
  * go#50064 net/http: limit growth of header canonicalization cache</changelog>
  <changelog author="jkowalczyk@suse.com" date="1641470400">- go1.16.13 (released 2022-01-06) includes fixes to the compiler,
  linker, runtime, and the net/http package.
  Refs boo#1182345 go1.16 release tracking
  * go#50449 x/net/http2: http.Server.WriteTimeout does not fire if the http2 stream's window is out of space.
  * go#50296 cmd/link: does not set section type of .init_array correctly
  * go#50194 runtime/race: building for iOS, but linking in object file built for macOS
  * go#50072 runtime: race detector SIGABRT or SIGSEGV on macOS Monterey
  * go#49923 cmd/link: support more load commands on Mach-O
  * go#49412 cmd/compile: internal compiler error: Op...LECall and OpDereference have mismatched mem
  * go#48115 runtime: mallocs cause "base outside usable address space" panic when running on iOS 14</changelog>
</package>
<package pkgid="d858d9c5488d7346d8c34719150d08bade88a3177d4552906c3492e7097da487" name="go1.16-race" arch="x86_64">
  <version epoch="0" ver="1.16.13" rel="1.40.1"/>
  <changelog author="jkowalczyk@suse.com" date="1611835200">- go1.16rc1 (released 2021-01-28) is a release candidate of go1.16
  cut from the master branch at the revision tagged go1.16rc1.</changelog>
  <changelog author="jkowalczyk@suse.com" date="1613476800">- go1.16 (released 2021-02-16) Go 1.16 is a major release of Go.
  go1.16.x minor releases will be provided through February 2022.
  https://github.com/golang/go/wiki/Go-Release-Cycle
  Most changes are in the implementation of the toolchain, runtime,
  and libraries. As always, the release maintains the Go 1 promise
  of compatibility. We expect almost all Go programs to continue to
  compile and run as before.
  Refs boo#1182345 go1.16 release tracking
  * See release notes https://golang.org/doc/go1.16. Excerpts
    relevant to OBS environment and for SUSE/openSUSE follow:
  * Module-aware mode is enabled by default, regardless of whether
    a go.mod file is present in the current working directory or a
    parent directory. More precisely, the GO111MODULE environment
    variable now defaults to on. To switch to the previous
    behavior, set GO111MODULE to auto.
  * Build commands like go build and go test no longer modify
    go.mod and go.sum by default. Instead, they report an error if
    a module requirement or checksum needs to be added or updated
    (as if the -mod=readonly flag were used). Module requirements
    and sums may be adjusted with go mod tidy or go get.
  * go install now accepts arguments with version suffixes (for
    example, go install example.com/cmd@v1.0.0). This causes go
    install to build and install packages in module-aware mode,
    ignoring the go.mod file in the current directory or any parent
    directory, if there is one. This is useful for installing
    executables without affecting the dependencies of the main
    module.
  * go install, with or without a version suffix (as described
    above), is now the recommended way to build and install
    packages in module mode. go get should be used with the -d flag
    to adjust the current module's dependencies without building
    packages, and use of go get to build and install packages is
    deprecated. In a future release, the -d flag will always be
    enabled.
  * retract directives may now be used in a go.mod file to indicate
    that certain published versions of the module should not be
    used by other modules. A module author may retract a version
    after a severe problem is discovered or if the version was
    published unintentionally.
  * The go mod vendor and go mod tidy subcommands now accept the -e
    flag, which instructs them to proceed despite errors in
    resolving missing packages.
  * The go command now ignores requirements on module versions
    excluded by exclude directives in the main module. Previously,
    the go command used the next version higher than an excluded
    version, but that version could change over time, resulting in
    non-reproducible builds.
  * In module mode, the go command now disallows import paths that
    include non-ASCII characters or path elements with a leading
    dot character (.). Module paths with these characters were
    already disallowed (see Module paths and versions), so this
    change affects only paths within module subdirectories.
  * The go command now supports including static files and file
    trees as part of the final executable, using the new //go:embed
    directive. See the documentation for the new embed package for
    details.
  * When using go test, a test that calls os.Exit(0) during
    execution of a test function will now be considered to
    fail. This will help catch cases in which a test calls code
    that calls os.Exit(0) and thereby stops running all future
    tests. If a TestMain function calls os.Exit(0) that is still
    considered to be a passing test.
  * go test reports an error when the -c or -i flags are used
    together with unknown flags. Normally, unknown flags are passed
    to tests, but when -c or -i are used, tests are not run.
  * The go get -insecure flag is deprecated and will be removed in
    a future version. This flag permits fetching from repositories
    and resolving custom domains using insecure schemes such as
    HTTP, and also bypasses module sum validation using the
    checksum database. To permit the use of insecure schemes, use
    the GOINSECURE environment variable instead. To bypass module
    sum validation, use GOPRIVATE or GONOSUMDB. See go help
    environment for details.
  * go get example.com/mod@patch now requires that some version of
    example.com/mod already be required by the main
    module. (However, go get -u=patch continues to patch even
    newly-added dependencies.)
  * GOVCS is a new environment variable that limits which version
    control tools the go command may use to download source
    code. This mitigates security issues with tools that are
    typically used in trusted, authenticated environments. By
    default, git and hg may be used to download code from any
    repository. svn, bzr, and fossil may only be used to download
    code from repositories with module paths or package paths
    matching patterns in the GOPRIVATE environment variable. See go
    help vcs for details.
  * When the main module's go.mod file declares go 1.16 or higher,
    the all package pattern now matches only those packages that
    are transitively imported by a package or test found in the
    main module. (Packages imported by tests of packages imported
    by the main module are no longer included.) This is the same
    set of packages retained by go mod vendor since Go 1.11.
  * When the -toolexec build flag is specified to use a program
    when invoking toolchain programs like compile or asm, the
    environment variable TOOLEXEC_IMPORTPATH is now set to the
    import path of the package being built.
  * The -i flag accepted by go build, go install, and go test is
    now deprecated. The -i flag instructs the go command to install
    packages imported by packages named on the command line. Since
    the build cache was introduced in Go 1.10, the -i flag no
    longer has a significant effect on build times, and it causes
    errors when the install directory is not writable.
  * When the -export flag is specified, the BuildID field is now
    set to the build ID of the compiled package. This is equivalent
    to running go tool buildid on go list -exported -f {{.Export}},
    but without the extra step.
  * The -overlay flag specifies a JSON configuration file
    containing a set of file path replacements. The -overlay flag
    may be used with all build commands and go mod subcommands. It
    is primarily intended to be used by editor tooling such as
    gopls to understand the effects of unsaved changes to source
    files. The config file maps actual file paths to replacement
    file paths and the go command and its builds will run as if the
    actual file paths exist with the contents given by the
    replacement file paths, or don't exist if the replacement file
    paths are empty.
  * The cgo tool will no longer try to translate C struct bitfields
    into Go struct fields, even if their size can be represented in
    Go. The order in which C bitfields appear in memory is
    implementation dependent, so in some cases the cgo tool
    produced results that were silently incorrect.
  * The linux/riscv64 port now supports cgo and -buildmode=pie.
    This release also includes performance optimizations and code
    generation improvements for RISC-V.
  * The new runtime/metrics package introduces a stable interface
    for reading implementation-defined metrics from the Go
    runtime. It supersedes existing functions like
    runtime.ReadMemStats and debug.GCStats and is significantly
    more general and efficient. See the package documentation for
    more details.
  * Setting the GODEBUG environment variable to inittrace=1 now
    causes the runtime to emit a single line to standard error for
    each package init, summarizing its execution time and memory
    allocation. This trace can be used to find bottlenecks or
    regressions in Go startup performance. The GODEBUG
    documentation describes the format.
  * On Linux, the runtime now defaults to releasing memory to the
    operating system promptly (using MADV_DONTNEED), rather than
    lazily when the operating system is under memory pressure
    (using MADV_FREE). This means process-level memory statistics
    like RSS will more accurately reflect the amount of physical
    memory being used by Go processes. Systems that are currently
    using GODEBUG=madvdontneed=1 to improve memory monitoring
    behavior no longer need to set this environment variable.
  * Go 1.16 fixes a discrepancy between the race detector and the
    Go memory model. The race detector now more precisely follows
    the channel synchronization rules of the memory model. As a
    result, the detector may now report races it previously missed.
  * linker: This release includes additional improvements to the Go
    linker, reducing linker resource usage (both time and memory)
    and improving code robustness/maintainability. These changes
    form the second half of a two-release project to modernize the
    Go linker.
  * The linker changes in 1.16 extend the 1.15 improvements to all
    supported architecture/OS combinations (the 1.15 performance
    improvements were primarily focused on ELF-based OSes and amd64
    architectures). For a representative set of large Go programs,
    linking is 20-25% faster than 1.15 and requires 5-15% less
    memory on average for linux/amd64, with larger improvements for
    other architectures and OSes. Most binaries are also smaller as
    a result of more aggressive symbol pruning.
  * The new embed package provides access to files embedded in the
    program during compilation using the new //go:embed directive.
  * The new io/fs package defines the fs.FS interface, an
    abstraction for read-only trees of files. The standard library
    packages have been adapted to make use of the interface as
    appropriate.
  * For testing code that implements fs.FS, the new testing/fstest
    package provides a TestFS function that checks for and reports
    common mistakes. It also provides a simple in-memory file
    system implementation, MapFS, which can be useful for testing
    code that accepts fs.FS implementations.
  * syscall: On Linux, Setgid, Setuid, and related calls are now
    implemented. Previously, they returned an syscall.EOPNOTSUPP
    error. On Linux, the new functions AllThreadsSyscall and
    AllThreadsSyscall6 may be used to make a system call on all Go
    threads in the process. These functions may only be used by
    programs that do not use cgo; if a program uses cgo, they will
    always return syscall.ENOTSUP.
  * time/tzdata: The slim timezone data format is now used for the
    timezone database in $GOROOT/lib/time/zoneinfo.zip and the
    embedded copy in this package. This reduces the size of the
    timezone database by about 350 KB.</changelog>
  <changelog author="jkowalczyk@suse.com" date="1613649600">- gcc6-go.patch fix typo go-7 to go-6 for bootstrap on SLE-12 gcc6</changelog>
  <changelog author="jkowalczyk@suse.com" date="1615377600">- go1.16.1 (released 2021-03-10) includes security fixes to the
  archive/zip and encoding/xml packages.
  CVE-2021-27918 CVE-2021-27919
  Refs boo#1182345 go1.16 release tracking
  * boo#1183333 CVE-2021-27918
  * go#44915 encoding/xml: infinite loop when using `xml.NewTokenDecoder` with a custom `TokenReader`
  * boo#1183334 CVE-2021-27919
  * go#44917 archive/zip: can panic when calling Reader.Open</changelog>
  <changelog author="jkowalczyk@suse.com" date="1615550400">- go1.16.2 (released 2021-03-11) includes fixes to cgo, the
  compiler, linker, the go command, and the syscall and time
  packages.
  Refs boo#1182345 go1.16 release tracking
  * go#44793 cmd/go: mod tidy should ignore missing standard library packages
  * go#44746 cmd/go: improve error message when outside a module from "working directory is not part of a module"
  * go#44676 cmd/go: warning message when getting a retracted module version is missing a trailing newline
  * go#44659 runtime: marked free object in span
  * go#44647 cmd/go: "malformed import path" in Go 1.16 for packages with path elements containing a leading dot
  * go#44638 cmd/link: runtime crash, unexpected fault address 0xffffffffffffffff, h2_bundle.go, when using plugin
  * go#44618 time: LoadLocationFromTZData with slim tzdata uses incorrect zone
  * go#44593 syscall &amp; x/sys/windows: buffer overflow in GetQueuedCompletionStatus
  * go#44498 cmd/go: 'go mod edit -exclude' erroneously rejects '+incompatible' versions
  * go#44496 cmd/go: malformed module path with retract v2+
  * go#44464 cmd/compile: ICE on deferred call to syscall.LazyDLL.Call
  * go#44462 x/tools/go/analysis, syscall: ptrace redeclared in this block
  * go#44433 cmd/compile: Compiler regression in Go 1.16 - internal compiler error: child dcl collision on symbol
  * go#44402 doc: Broken image in readme
  * go#44358 cmd/compile: internal compiler error: Value live at entry. It shouldn't be.
  * go#44346 runtime/cgo: cannot build with -Wsign-compare</changelog>
  <changelog author="jkowalczyk@suse.com" date="1617364800">- go1.16.3 (released 2021-04-01) includes fixes to the compiler,
  linker, runtime, the go command, and the testing and time
  packages.
  Refs boo#1182345 go1.16 release tracking
  * go#45303 runtime: "invalid pc-encoded table" throw caused by bad cgo traceback
  * go#45253 cmd/compile: fix long RMW bit operations on AMD64
  * go#45240 all: run.{bash,bat,rc} sets GOPATH inconsistently
  * go#45192 Strange behaviour with loops
  * go#45030 cmd/link: go 1.16 plugin does not initialize global variables correctly when not used directly
  * go#44888 testing: Helper line number has changed in 1.16
  * go#44885 cmd/go: import paths ending with '+' are rejected (affects executable like g++ or clang++)
  * go#44869 time, runtime: zero duration timer takes 2 minutes to fire
  * go#44860 cmd/go: documentation at golang.org for cmd/go has confusing formatting
  * go#44812 cmd/go: 'go get' does not add missing hash to go.sum when ziphash file missing from cache
  * go#44640 cmd/link: fail to build when using time/tzdata on ARM</changelog>
  <changelog author="jkowalczyk@suse.com" date="1620388800">- go1.16.4 (released 2021-05-06) includes a security fix to the
  net/http package, as well as bug fixes to the runtime, the
  compiler, and the archive/zip, time, and syscall packages.
  CVE-2021-31525
  Refs boo#1182345 go1.16 release tracking
  * boo#1185790 CVE-2021-31525
  * go#45712 net/http: ReadRequest can stack overflow
  * go#45636 cmd/compile: internal compiler error: Invalid PPC64 rotate mask
  * go#45482 runtime: "invalid pc-encoded table" throw caused by bad cgo traceback (expandFinalInlineFrames)
  * go#45385 time: Europe/Dublin timezone handling broken with embedded timezone database
  * go#45347 archive/zip: duplicate entries in FS interface
  * go#45307 os/signal: timeout in TestAllThreadsSyscallSignals</changelog>
  <changelog author="jkowalczyk@suse.com" date="1622721600">- go1.16.5 (released 2021-06-03) includes security fixes to the
  archive/zip, math/big, net, and net/http/httputil packages, as
  well as bug fixes to the linker, the go command, and the net/http
  package.
  CVE-2021-33195 CVE-2021-33196 CVE-2021-33197 CVE-2021-33198
  Refs boo#1182345 go1.16 release tracking
  * boo#1187443 go#46241 CVE-2021-33195
  * go#46357 net: Lookup functions may return invalid host names
  * go#46530 net: Unix dnsclient test for CVE-2021-33195 assumes that 1.2.3.4 does not resolve
  * boo#1186622 go#46242 CVE-2021-33196
  * go#46397 archive/zip: malformed archive may cause panic or memory exhaustion
  * boo#1187444 go#46313 CVE-2021-33197
  * go#46315 net/http/httputil: ReverseProxy forwards Connection headers if first one is empty
  * boo#1187445 go#45910 CVE-2021-33198
  * go#46306 math/big: (*Rat).SetString with "1.770p02041010010011001001" crashes with "makeslice: len out of range"
  * go#46214 cmd/go: make go mod download with no arguments leave go.sum alone
  * go#46144 cmd/go: error out of 'go mod tidy' if the go.mod file specifies a newer-than-supported Go version
  * go#46128 cmd/link: internal error when externally linking very large binaries
  * go#45927 cmd/link: SIGSEGV running 'openshift-install version' for release-4.8 using external linking on PPC64LE
  * go#45832 cmd/link: unexpected trampoline when cross-compiling to ppc64le</changelog>
  <changelog author="jkowalczyk@suse.com" date="1623326400">- Fix extraneous trailing percent character %endif% in spec file.</changelog>
  <changelog author="jkowalczyk@suse.com" date="1626091200">- go1.16.6 (released 2021-07-12) includes a security fix to the
  crypto/tls package, as well as bug fixes to the compiler, and the
  net and net/http packages.
  CVE-2021-34558
  Refs boo#1182345 go1.16 release tracking
  * boo#1188229 go#47143 CVE-2021-34558
  * go#47145 security: fix CVE-2021-34558
  * go#46999 net: LookupMX behaviour broken
  * go#46981 net: TestCVE202133195 fails if /etc/resolv.conf specifies ndots larger than 3
  * go#46769 syscall: TestGroupCleanupUserNamespace test failure on Fedora
  * go#46657 runtime: deeply nested struct initialized with non-zero values
  * go#44984 net/http: server not setting Content-Length in certain cases</changelog>
  <changelog author="fvogt@suse.com" date="1626696000">- Add patch to fix crashes on PowerPC with kernel &gt;= 5.13:
  * fix-ppc64-crashes.patch</changelog>
  <changelog author="jkowalczyk@suse.com" date="1628164800">- Drop patch to fix crashes on PowerPC with kernel &gt;= 5.13, fixed
  in next upstream release:
  * drop fix-ppc64-crashes.patch</changelog>
  <changelog author="jkowalczyk@suse.com" date="1628164801">- go1.16.7 (released 2021-08-05) includes a security fix to the
  net/http/httputil package, as well as bug fixes to the compiler,
  the linker, the runtime, the go command, and the net/http
  package.
  CVE-2021-36221
  Refs boo#1182345 go1.16 release tracking
  * boo#1189162 go#46866 CVE-2021-36221
  * go#47474 net/http: panic due to racy read of persistConn after handler panic
  * go#47348 cmd/go: "go list -f '{{.Stale}}'" stack overflow with cyclic imports
  * go#47332 time: Timer reset broken under heavy use since go1.16 timer optimizations added
  * go#47289 cmd/link: build error with cgo in Windows, redefinition of go.map.zero
  * go#47015 cmd/go: go mod vendor: open C:\Users\LICENSE: Access is denied.
  * go#46928 cmd/compile: register conflict between external linker and duffzero on arm64
  * go#46858 runtime: ppc64x binaries randomly segfault on linux 5.13rc6
  * go#46551 cmd/go: unhelpful error message when running "go install" on a replaced-but-not-required package</changelog>
  <changelog author="jkowalczyk@suse.com" date="1628769600">- Add bash scripts used by go tool commands to provide a more
  complete cross-compiling go toolchain install.
  * Fixes "go tool dist list" error "all.bash does not exist"
  * Added to packaging:
    /usr/lib64/go/1.16/lib/time/update.bash (already packaged)
    /usr/lib64/go/1.16/src/all.bash
    /usr/lib64/go/1.16/src/bootstrap.bash
    /usr/lib64/go/1.16/src/buildall.bash
    /usr/lib64/go/1.16/src/clean.bash
    /usr/lib64/go/1.16/src/cmp.bash
    /usr/lib64/go/1.16/src/make.bash
    /usr/lib64/go/1.16/src/race.bash
    /usr/lib64/go/1.16/src/run.bash
    /usr/share/go/1.16/src/all.bash
    /usr/share/go/1.16/src/bootstrap.bash
    /usr/share/go/1.16/src/buildall.bash
    /usr/share/go/1.16/src/clean.bash
    /usr/share/go/1.16/src/cmd/compile/internal/ssa/gen/cover.bash
    /usr/share/go/1.16/src/cmd/vendor/golang.org/x/sys/windows/mkerrors.bash
    /usr/share/go/1.16/src/cmd/vendor/golang.org/x/sys/windows/mkknownfolderids.bash
    /usr/share/go/1.16/src/cmp.bash
    /usr/share/go/1.16/src/internal/trace/mkcanned.bash
    /usr/share/go/1.16/src/make.bash
    /usr/share/go/1.16/src/race.bash
    /usr/share/go/1.16/src/run.bash</changelog>
  <changelog author="jkowalczyk@suse.com" date="1631275200">- go1.16.8 (released 2021-09-09) includes a security fix to the
  archive/zip package, as well as bug fixes to the archive/zip,
  go/internal/gccgoimporter, html/template, net/http, and
  runtime/pprof packages.
  Refs boo#1182345 go1.16 release tracking
  CVE-2021-39293
  * boo#1190589 go#47801 CVE-2021-39293
  * go#47985 archive/zip: overflow in preallocation check can cause OOM panic
  * go#47691 x/net/http2: server sends RST_STREAM w/ PROTOCOL_ERROR to clients it incorrectly believes have violated max advertised num streams
  * go#47675 runtime/pprof: apparent deadlock in TestGoroutineSwitch on linux-armv6l
  * go#47610 go/internal/gccgoimporter: TestInstallationImporter broken with tip gccgo
  * go#47535 net/http: TestCancelRequestWhenSharingConnection can cause port exhaustion
  * go#47042 html/template: data race with concurrent ExecuteTemplate calls</changelog>
  <changelog author="jkowalczyk@suse.com" date="1633694400">- go1.16.9 (released 2021-10-07) includes a security fix to the
  linker and misc/wasm directory, as well as bug fixes to the
  runtime and to the text/template package.
  Refs boo#1182345 go1.16 release tracking
  CVE-2021-38297
  * boo#1191468 go#48797 CVE-2021-38297
  * go#48799 security: fix CVE-2021-38297 misc/wasm, cmd/link: do not let command line args overwrite global data
  * go#48443 text/template: should t.init() be executed before t.muTmpl.Lock() in AddParseTree() method?
  * go#47858 time: timer reset sometimes ignored, causing delayed ticks</changelog>
  <changelog author="jkowalczyk@suse.com" date="1636027200">- go1.16.10 (released 2021-11-04) includes security fixes to the
  archive/zip and debug/macho packages, as well as bug fixes to the
  compiler, linker, runtime, the misc/wasm directory, and to the
  net/http package.
  Refs boo#1182345 go1.16 release tracking
  CVE-2021-41771 CVE-2021-41772
  * boo#1192377 go#48990 CVE-2021-41771
  * go#48991 debug/macho: invalid dynamic symbol table command can cause panic
  * boo#1192378 go#48085 CVE-2021-41772
  * go#48251 archive/zip: Reader.Open panics on empty string
  * go#49153 misc/wasm, cmd/link: Go 1.17.2 causes WASM builds to throw command line too long with many environment variables
  * go#49076 x/net/http2: backport critical fixes
  * go#49009 net,runtime: apparent deadlock in (*net.conn).Close and runtime.netpollblock on arm64 platforms
  * go#48822 x/net/http2: client can hang forever if headers' size exceeds connection's buffer size and server hangs past request time
  * go#48649 x/net/http2: pool deadlock
  * go#48478 cmd/compile: 64 bits shifts on arm get wrong results
  * go#48474 cmd/compile: incorrect arm/arm64 simplification rules</changelog>
  <changelog author="jkowalczyk@suse.com" date="1638532800">- go1.16.11 (released 2021-12-02) includes fixes to the compiler,
  runtime, and the net/http, net/http/httptest, and time packages.
  Refs boo#1182345 go1.16 release tracking
  * go#49910 x/net/http2: frequent failures in TestClientConnCloseAtBody
  * go#49908 x/net/ipv6: TestPacketConnReadWriteMulticast{UDP,ICMP} failing with "i/o timeout" on OpenBSD 6.8 and 7.0
  * go#49904 x/net/http2: Client doesn't send body until ExpectContinueTimeout expires
  * go#49867 syscall: ntdll.dll errors in rtlGetNtVersionNumbers via os.StartProcess
  * go#49851 net/http/httptest: Close does not wait for the underlying Server's ConnState callbacks to complete
  * go#49728 runtime: "fatal error: unexpected signal during runtime execution" in cmd/go tests on darwin-amd64-race running macOS 12.0
  * go#49661 x/net/http2: TestUnreadFlowControlReturned_Server failures with stream error "NO_ERROR" since 2021-10-05
  * go#49623 net/http: Possible HTTP/2 busy loop regression in Go 1.17.3
  * go#49567 net/http: server responds with Transfer-Encoding: identity
  * go#49560 x/net/http2: setting Request.Close doesn't close TCP connections
  * go#49558 net/http: HTTP/2 response body Close method sometimes returns spurious context cancelation error (1.17.3 regression)
  * go#49406 time: ParseInLocation error
  * go#49391 cmd/compile: internal compiler error: Expand calls interface data problem</changelog>
  <changelog author="jkowalczyk@suse.com" date="1639051200">- go1.16.12 (released 2021-12-09) includes security fixes to the
  syscall and net/http packages.
  Refs boo#1182345 go1.16 release tracking
  CVE-2021-44716 CVE-2021-44717
  * boo#1193598 go#50057 CVE-2021-44717
  * go#50066 syscall: don?t close fd 0 on ForkExec error
  * boo#1193597 go#50058 CVE-2021-44716
  * go#50064 net/http: limit growth of header canonicalization cache</changelog>
  <changelog author="jkowalczyk@suse.com" date="1641470400">- go1.16.13 (released 2022-01-06) includes fixes to the compiler,
  linker, runtime, and the net/http package.
  Refs boo#1182345 go1.16 release tracking
  * go#50449 x/net/http2: http.Server.WriteTimeout does not fire if the http2 stream's window is out of space.
  * go#50296 cmd/link: does not set section type of .init_array correctly
  * go#50194 runtime/race: building for iOS, but linking in object file built for macOS
  * go#50072 runtime: race detector SIGABRT or SIGSEGV on macOS Monterey
  * go#49923 cmd/link: support more load commands on Mach-O
  * go#49412 cmd/compile: internal compiler error: Op...LECall and OpDereference have mismatched mem
  * go#48115 runtime: mallocs cause "base outside usable address space" panic when running on iOS 14</changelog>
</package>
<package pkgid="2c22113cfecb15cba766d870dced0279e85a2bda684a54c79acc0e5f6c30b99d" name="golang-github-prometheus-prometheus" arch="aarch64">
  <version epoch="0" ver="2.32.1" rel="4.3.2"/>
  <changelog author="asn@cryptomilk.org" date="1564574400">- Build with PIE
  + Added 0004-prometheus-buildmode-pie.patch</changelog>
  <changelog author="jan.fajerski@suse.com" date="1564747200">- Add network-online (Wants and After) dependency to systemd unit bsc#1143913</changelog>
  <changelog author="jan.fajerski@suse.com" date="1565956800">- remove 0004-prometheus-buildmode-pie.patch
  + this patch produces binaries that crash immediately
- add -v to promu build command for better build debugging
- reorder some %install tasks</changelog>
  <changelog author="mrostecki@opensuse.org" date="1569240000">- Do not install the firewalld config file on Tumbleweed (on
  versions newer than Leap 15.1). It's installed in the main
  firewalld package.</changelog>
  <changelog author="jcavalheiro@suse.com" date="1574251200">- Update Uyuni/SUSE Manager service discovery patch
  + Modified 0003-Add-Uyuni-service-discovery.patch
  + Fixes crashes when systems have no FQDN
  + Adds Parallel calls to Uyuni API, meaningful performance increase
  + Adds Support for system group labels</changelog>
  <changelog author="mrostecki@opensuse.org" date="1574251201">- Remove firewalld files. They are installed in the main firewalld
  package.</changelog>
  <changelog author="jan.fajerski@suse.com" date="1574337600">- Remove prometheus.firewall.xml source file</changelog>
  <changelog author="jcavalheiro@suse.com" date="1574683200">- Patch macros on spec file to support builds on SLE 12</changelog>
  <changelog author="witold.bedyk@suse.com" date="1580126400">- Update to Prometheus 2.11.2</changelog>
  <changelog author="jcavalheiro@suse.com" date="1589371200">- Update Uyuni/SUSE Manager service discovery patch
  + Modified 0003-Add-Uyuni-service-discovery.patch:
  + Adapt service discovery to the new Uyuni API endpoints
  + Modified spec file: force golang 1.12 to fix build issues in SLE15SP2</changelog>
  <changelog author="jcavalheiro@suse.com" date="1591185600">- Update change log and spec file
  + Modified spec file: default to golang 1.14 to avoid "have choice" build issues in OBS.
  + Rebase and update patches for version 2.18.0
  + Changed:
  * 0001-Do-not-force-the-pure-Go-name-resolver.patch
  * 0002-Default-settings.patch Changed
  * 0003-Add-Uyuni-service-discovery.patch
- Update to 2.18.0
  + Features
  * Tracing: Added experimental Jaeger support #7148
  + Changes
  * Federation: Only use local TSDB for federation (ignore remote read). #7096
  * Rules: `rule_evaluations_total` and `rule_evaluation_failures_total` have a `rule_group` label now. #7094
  + Enhancements
  * TSDB: Significantly reduce WAL size kept around after a block cut. #7098
  * Discovery: Add `architecture` meta label for EC2. #7000
  + Bug fixes
  * UI: Fixed wrong MinTime reported by /status. #7182
  * React UI: Fixed multiselect legend on OSX. #6880
  * Remote Write: Fixed blocked resharding edge case. #7122
  * Remote Write: Fixed remote write not updating on relabel configs change. #7073
- Changes from 2.17.2
  + Bug fixes
  * Federation: Register federation metrics #7081
  * PromQL: Fix panic in parser error handling #7132
  * Rules: Fix reloads hanging when deleting a rule group that is being evaluated #7138
  * TSDB: Fix a memory leak when prometheus starts with an empty TSDB WAL #7135
  * TSDB: Make isolation more robust to panics in web handlers #7129 #7136
- Changes from 2.17.1
  + Bug fixes
  * TSDB: Fix query performance regression that increased memory and CPU usage #7051
- Changes from 2.17.0
  + Features
  * TSDB: Support isolation #6841
  * This release implements isolation in TSDB. API queries and recording rules are
    guaranteed to only see full scrapes and full recording rules. This comes with a
    certain overhead in resource usage. Depending on the situation, there might be
    some increase in memory usage, CPU usage, or query latency.
  + Enhancements
  * PromQL: Allow more keywords as metric names #6933
  * React UI: Add normalization of localhost URLs in targets page #6794
  * Remote read: Read from remote storage concurrently #6770
  * Rules: Mark deleted rule series as stale after a reload #6745
  * Scrape: Log scrape append failures as debug rather than warn #6852
  * TSDB: Improve query performance for queries that partially hit the head #6676
  * Consul SD: Expose service health as meta label #5313
  * EC2 SD: Expose EC2 instance lifecycle as meta label #6914
  * Kubernetes SD: Expose service type as meta label for K8s service role #6684
  * Kubernetes SD: Expose label_selector and field_selector #6807
  * Openstack SD: Expose hypervisor id as meta label #6962
  + Bug fixes
  * PromQL: Do not escape HTML-like chars in query log #6834 #6795
  * React UI: Fix data table matrix values #6896
  * React UI: Fix new targets page not loading when using non-ASCII characters #6892
  * Remote read: Fix duplication of metrics read from remote storage with external labels #6967 #7018
  * Remote write: Register WAL watcher and live reader metrics for all remotes, not just the first one #6998
  * Scrape: Prevent removal of metric names upon relabeling #6891
  * Scrape: Fix 'superfluous response.WriteHeader call' errors when scrape fails under some circonstances #6986
  * Scrape: Fix crash when reloads are separated by two scrape intervals #7011
- Changes from 2.16.0
  + Features
  * React UI: Support local timezone on /graph #6692
  * PromQL: add absent_over_time query function #6490
  * Adding optional logging of queries to their own file #6520
  + Enhancements
  * React UI: Add support for rules page and "Xs ago" duration displays #6503
  * React UI: alerts page, replace filtering togglers tabs with checkboxes #6543
  * TSDB: Export metric for WAL write errors #6647
  * TSDB: Improve query performance for queries that only touch the most recent 2h of data. #6651
  * PromQL: Refactoring in parser errors to improve error messages #6634
  * PromQL: Support trailing commas in grouping opts #6480
  * Scrape: Reduce memory usage on reloads by reusing scrape cache #6670
  * Scrape: Add metrics to track bytes and entries in the metadata cache #6675
  * promtool: Add support for line-column numbers for invalid rules output #6533
  * Avoid restarting rule groups when it is unnecessary #6450
  + Bug fixes
  * React UI: Send cookies on fetch() on older browsers #6553
  * React UI: adopt grafana flot fix for stacked graphs #6603
  * React UI: broken graph page browser history so that back button works as expected #6659
  * TSDB: ensure compactionsSkipped metric is registered, and log proper error if one is returned from head.Init #6616
  * TSDB: return an error on ingesting series with duplicate labels #6664
  * PromQL: Fix unary operator precedence #6579
  * PromQL: Respect query.timeout even when we reach query.max-concurrency #6712
  * PromQL: Fix string and parentheses handling in engine, which affected React UI #6612
  * PromQL: Remove output labels returned by absent() if they are produced by multiple identical label matchers #6493
  * Scrape: Validate that OpenMetrics input ends with `# EOF` #6505
  * Remote read: return the correct error if configs can't be marshal'd to JSON #6622
  * Remote write: Make remote client `Store` use passed context, which can affect shutdown timing #6673
  * Remote write: Improve sharding calculation in cases where we would always be consistently behind by tracking pendingSamples #6511
  * Ensure prometheus_rule_group metrics are deleted when a rule group is removed #6693
- Changes from 2.15.2
  + Bug fixes
  * TSDB: Fixed support for TSDB blocks built with Prometheus before 2.1.0. #6564
  * TSDB: Fixed block compaction issues on Windows. #6547
- Changes from 2.15.1
  + Bug fixes
  * TSDB: Fixed race on concurrent queries against same data. #6512
- Changes from 2.15.0
  + Features
  * API: Added new endpoint for exposing per metric metadata `/metadata`. #6420 #6442
  + Changes
  * Discovery: Removed `prometheus_sd_kubernetes_cache_*` metrics. Additionally `prometheus_sd_kubernetes_workqueue_latency_seconds` and `prometheus_sd_kubernetes_workqueue_work_duration_seconds` metrics now show correct values in seconds. #6393
  * Remote write: Changed `query` label on `prometheus_remote_storage_*` metrics to `remote_name` and `url`. #6043
  + Enhancements
  * TSDB: Significantly reduced memory footprint of loaded TSDB blocks. #6418 #6461
  * TSDB: Significantly optimized what we buffer during compaction which should result in lower memory footprint during compaction. #6422 #6452 #6468 #6475
  * TSDB: Improve replay latency. #6230
  * TSDB: WAL size is now used for size based retention calculation. #5886
  * Remote read: Added query grouping and range hints to the remote read request #6401
  * Remote write: Added `prometheus_remote_storage_sent_bytes_total` counter per queue. #6344
  * promql: Improved PromQL parser performance. #6356
  * React UI: Implemented missing pages like `/targets` #6276, TSDB status page #6281 #6267 and many other fixes and performance improvements.
  * promql: Prometheus now accepts spaces between time range and square bracket. e.g `[ 5m]` #6065
  + Bug fixes
  * Config: Fixed alertmanager configuration to not miss targets when configurations are similar. #6455
  * Remote write: Value of `prometheus_remote_storage_shards_desired` gauge shows raw value of desired shards and it's updated correctly. #6378
  * Rules: Prometheus now fails the evaluation of rules and alerts where metric results collide with labels specified in `labels` field. #6469
  * API: Targets Metadata API `/targets/metadata` now accepts empty `match_targets` parameter as in the spec. #6303
- Changes from 2.14.0
  + Features
  * API: `/api/v1/status/runtimeinfo` and `/api/v1/status/buildinfo` endpoints added for use by the React UI. #6243
  * React UI: implement the new experimental React based UI. #5694 and many more
  * Can be found by under `/new`.
  * Not all pages are implemented yet.
  * Status: Cardinality statistics added to the Runtime &amp; Build Information page. #6125
  + Enhancements
  * Remote write: fix delays in remote write after a compaction. #6021
  * UI: Alerts can be filtered by state. #5758
  + Bug fixes
  * Ensure warnings from the API are escaped. #6279
  * API: lifecycle endpoints return 403 when not enabled. #6057
  * Build: Fix Solaris build. #6149
  * Promtool: Remove false duplicate rule warnings when checking rule files with alerts. #6270
  * Remote write: restore use of deduplicating logger in remote write. #6113
  * Remote write: do not reshard when unable to send samples. #6111
  * Service discovery: errors are no longer logged on context cancellation. #6116, #6133
  * UI: handle null response from API properly. #6071
- Changes from 2.13.1
  + Bug fixes
  * Fix panic in ARM builds of Prometheus. #6110
  * promql: fix potential panic in the query logger. #6094
  * Multiple errors of http: superfluous response.WriteHeader call in the logs. #6145
- Changes from 2.13.0
  + Enhancements
  * Metrics: renamed prometheus_sd_configs_failed_total to prometheus_sd_failed_configs and changed to Gauge #5254
  * Include the tsdb tool in builds. #6089
  * Service discovery: add new node address types for kubernetes. #5902
  * UI: show warnings if query have returned some warnings. #5964
  * Remote write: reduce memory usage of the series cache. #5849
  * Remote read: use remote read streaming to reduce memory usage. #5703
  * Metrics: added metrics for remote write max/min/desired shards to queue manager. #5787
  * Promtool: show the warnings during label query. #5924
  * Promtool: improve error messages when parsing bad rules. #5965
  * Promtool: more promlint rules. #5515
  + Bug fixes
  * UI: Fix a Stored DOM XSS vulnerability with query history [CVE-2019-10215](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10215). #6098
  * Promtool: fix recording inconsistency due to duplicate labels. #6026
  * UI: fixes service-discovery view when accessed from unhealthy targets. #5915
  * Metrics format: OpenMetrics parser crashes on short input. #5939
  * UI: avoid truncated Y-axis values. #6014
- Changes from 2.12.0
  + Features
  * Track currently active PromQL queries in a log file. #5794
  * Enable and provide binaries for `mips64` / `mips64le` architectures. #5792
  + Enhancements
  * Improve responsiveness of targets web UI and API endpoint. #5740
  * Improve remote write desired shards calculation. #5763
  * Flush TSDB pages more precisely. tsdb#660
  * Add `prometheus_tsdb_retention_limit_bytes` metric. tsdb#667
  * Add logging during TSDB WAL replay on startup. tsdb#662
  * Improve TSDB memory usage. tsdb#653, tsdb#643, tsdb#654, tsdb#642, tsdb#627
  + Bug fixes
  * Check for duplicate label names in remote read. #5829
  * Mark deleted rules' series as stale on next evaluation. #5759
  * Fix JavaScript error when showing warning about out-of-sync server time. #5833
  * Fix `promtool test rules` panic when providing empty `exp_labels`. #5774
  * Only check last directory when discovering checkpoint number. #5756
  * Fix error propagation in WAL watcher helper functions. #5741
  * Correctly handle empty labels from alert templates. #5845</changelog>
  <changelog author="witold.bedyk@suse.com" date="1596196800">- Update 0003-Add-Uyuni-service-discovery.patch:
  + Add support for Prometheus exporters proxy</changelog>
  <changelog author="pseidensal@suse.com" date="1598875200">- Update package with changes from `server:monitoring` bsc#1175478
  Left out removal of firewalld related configuration files as SLE-15-SP1's
  `firewalld` package does not contain prometheus configuration yet.</changelog>
  <changelog author="stefano.torresi@suse.com" date="1604923200">- Update to upstream version 2.22.1
- Update packaging
  * Remove systemd and shadow hard requirements
  * use systemd-sysusers to configure the user in a dedicated 'system-user-prometheus' subpackage
  * add 'prometheus' package alias</changelog>
  <changelog author="witold.bedyk@suse.com" date="1615291200">- Uyuni: `hostname` label is now set to FQDN instead of IP
  + Changed:
  * 0003-Add-Uyuni-service-discovery.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1620129600">- Add tarball with vendor modules and web assets
- Uyuni: Read formula data from exporters map
- Uyuni: Add support for TLS targets
  + Changed:
  * 0003-Add-Uyuni-service-discovery.patch
  * 0002-Default-settings.patch Changed
  * 0003-Add-Uyuni-service-discovery.patch
- Upgrade to upstream version 2.26.0
  + Changes
  * Alerting: Using Alertmanager v2 API by default. #8626
  * Prometheus/Promtool: Binaries are now printing help and usage to stdout instead of stderr. #8542
  + Features
  * Remote: Add support for AWS SigV4 auth method for remote_write. #8509
  * PromQL: Allow negative offsets. Behind --enable-feature=promql-negative-offset flag. #8487
  * UI: Add advanced auto-completion, syntax highlighting and linting to graph page query input. #8634
  + Enhancements
  * PromQL: Add last_over_time, sgn, clamp functions. #8457
  * Scrape: Add support for specifying type of Authorization header credentials with Bearer by default. #8512
  * Scrape: Add follow_redirects option to scrape configuration. #8546
  * Remote: Allow retries on HTTP 429 response code for remote_write. #8237 #8477
  * Remote: Allow configuring custom headers for remote_read. #8516
  * UI: Hitting Enter now triggers new query. #8581
  * UI: Better handling of long rule and names on the /rules and /targets pages. #8608 #8609
  * UI: Add collapse/expand all button on the /targets page. #8486
- Upgrade to upstream version 2.25.0
  + Features
  * Include a new `--enable-feature=` flag that enables experimental features.
  + Enhancements
  * Add optional name property to testgroup for better test failure output. #8440
  * Add warnings into React Panel on the Graph page. #8427
  * TSDB: Increase the number of buckets for the compaction duration metric. #8342
  * Remote: Allow passing along custom remote_write HTTP headers. #8416
  * Mixins: Scope grafana configuration. #8332
  * Kubernetes SD: Add endpoint labels metadata. #8273
  * UI: Expose total number of label pairs in head in TSDB stats page. #8343
  * TSDB: Reload blocks every minute, to detect new blocks and enforce retention more often. #8343
  + Bug fixes
  * API: Fix global URL when external address has no port. #8359
  * Deprecate unused flag --alertmanager.timeout. #8407
- Upgrade to upstream version 2.24.1
  + Enhancements
  * Cache basic authentication results to significantly improve performance of HTTP endpoints.
- Upgrade to upstream version 2.24.0
  + Features
  * Add TLS and basic authentication to HTTP endpoints. #8316
  * promtool: Add check web-config subcommand to check web config files. #8319
  * promtool: Add tsdb create-blocks-from openmetrics subcommand to backfill metrics data from an OpenMetrics file. #8084
  + Enhancements
  * HTTP API: Fast-fail queries with only empty matchers. #8288
  * HTTP API: Support matchers for labels API. #8301
  * promtool: Improve checking of URLs passed on the command line. #7956
  * SD: Expose IPv6 as a label in EC2 SD. #7086
  * SD: Reuse EC2 client, reducing frequency of requesting credentials. #8311
  * TSDB: Add logging when compaction takes more than the block time range. #8151
  * TSDB: Avoid unnecessary GC runs after compaction. #8276
- Upgrade to upstream version 2.23.0
  + Changes
  * UI: Make the React UI default. #8142
  * Remote write: The following metrics were removed/renamed in remote write. #6815
    &gt; prometheus_remote_storage_succeeded_samples_total was removed and prometheus_remote_storage_samples_total was introduced for all the samples attempted to send.
    &gt; prometheus_remote_storage_sent_bytes_total was removed and replaced with prometheus_remote_storage_samples_bytes_total and prometheus_remote_storage_metadata_bytes_total.
    &gt; prometheus_remote_storage_failed_samples_total -&gt; prometheus_remote_storage_samples_failed_total .
    &gt; prometheus_remote_storage_retried_samples_total -&gt; prometheus_remote_storage_samples_retried_total.
    &gt; prometheus_remote_storage_dropped_samples_total -&gt; prometheus_remote_storage_samples_dropped_total.
    &gt; prometheus_remote_storage_pending_samples -&gt; prometheus_remote_storage_samples_pending.
  * Remote: Do not collect non-initialized timestamp metrics. #8060
  + Enhancements
  * Remote write: Added a metric prometheus_remote_storage_max_samples_per_send for remote write. #8102
  * TSDB: Make the snapshot directory name always the same length. #8138
  * TSDB: Create a checkpoint only once at the end of all head compactions. #8067
  * TSDB: Avoid Series API from hitting the chunks. #8050
  * TSDB: Cache label name and last value when adding series during compactions making compactions faster. #8192
  * PromQL: Improved performance of Hash method making queries a bit faster. #8025
  * promtool: tsdb list now prints block sizes. #7993
  * promtool: Calculate mint and maxt per test avoiding unnecessary calculations. #8096
  * SD: Add filtering of services to Docker Swarm SD. #8074</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1621425600">- Refresh patches
  + Changed:
  * 0001-Do-not-force-the-pure-Go-name-resolver.patch
  * 0002-Default-settings.patch
  * 0003-Add-Uyuni-service-discovery.patch
- Upgrade to upstream version 2.27.1 (jsc#SLE-18254)
  + Bugfix:
  * SECURITY: Fix arbitrary redirects under the /new endpoint (CVE-2021-29622, bsc#1186242)
- Upgrade to upstream version 2.27.0
  + Features:
  * Promtool: Retroactive rule evaluation functionality. #7675
  * Configuration: Environment variable expansion for external labels. Behind --enable-feature=expand-external-labels flag. #8649
  * TSDB: Add a flag(--storage.tsdb.max-block-chunk-segment-size) to control the max chunks file size of the blocks for small Prometheus instances. #8478
  * UI: Add a dark theme. #8604
  * AWS Lightsail Discovery: Add AWS Lightsail Discovery. #8693
  * Docker Discovery: Add Docker Service Discovery. #8629
  * OAuth: Allow OAuth 2.0 to be used anywhere an HTTP client is used. #8761
  * Remote Write: Send exemplars via remote write. Experimental and disabled by default. #8296
  + Enhancements:
  * Digital Ocean Discovery: Add __meta_digitalocean_vpc label. #8642
  * Scaleway Discovery: Read Scaleway secret from a file. #8643
  * Scrape: Add configurable limits for label size and count. #8777
  * UI: Add 16w and 26w time range steps. #8656
  * Templating: Enable parsing strings in humanize functions. #8682
  + Bugfixes:
  * UI: Provide errors instead of blank page on TSDB Status Page. #8654 #8659
  * TSDB: Do not panic when writing very large records to the WAL. #8790
  * TSDB: Avoid panic when mmaped memory is referenced after the file is closed. #8723
  * Scaleway Discovery: Fix nil pointer dereference. #8737
  * Consul Discovery: Restart no longer required after config update with no targets. #8766</changelog>
  <changelog author="witold.bedyk@suse.com" date="1625745600">- Provide and reload firewalld configuration only for:
  + openSUSE Leap 15.0, 15.1, 15.2
  + SUSE SLE15, SLE15 SP1, SLE15 SP2</changelog>
  <changelog author="jsegitz@suse.com" date="1632139200">- Added hardening to systemd service(s) (bsc#1181400). Modified:
  * prometheus.service</changelog>
  <changelog author="witold.bedyk@suse.com" date="1642593600">- Updated patches:
  + Changed:
  * 0002-Default-settings.patch
  + Removed:
  * 0003-Add-Uyuni-service-discovery.patch
- Use obs-service-go_modules
- Upgrade to upstream version 2.32.1 (jsc#SLE-22863)
  + Bugfixes:
  * Scrape: Fix reporting metrics when sample limit is reached
    during the report. #9996
  * Scrape: Ensure that scrape interval and scrape timeout are
    always set. #10023
  * TSDB: Expose and fix bug in iterators' Seek() method. #10030
- Upgrade to upstream version 2.32.0
  + Change:
  * remote-write: Change default max retry time from 100ms to
    5 seconds. #9634
  + Features:
  * Agent: New mode of operation optimized for remote-write only
    scenarios, without local storage.
  * Promtool: Add promtool check service-discovery command. #8970
  + Enhancements:
  * Promtool: Improve test output. #8064
  * Promtool: Use kahan summation for better numerical stability.
  * Remote-write: Reuse memory for marshalling. #9412
  * Scrape: Add scrape_body_size_bytes scrape metric behind the
  - -enable-feature=extra-scrape-metrics flag. #9569
  * TSDB: Add windows arm64 support. #9703
  * TSDB: Optimize query by skipping unneeded sorting in TSDB.
  * Templates: Support int and uint as datatypes for template
    formatting. #9680
  * UI: Prefer rate over rad, delta over deg, and count over cos
    in autocomplete. #9688
  + Bugfixes:
  * TSDB: Add more size checks when writing individual sections
    in the index. #9710
  * PromQL: Make deriv() return zero values for constant series.
  * TSDB: Fix panic when checkpoint directory is empty. #9687
  * TSDB: Fix panic, out of order chunks, and race warning during
    WAL replay. #9856
  * UI: Correctly render links for targets with IPv6 addresses
    that contain a Zone ID. #9853
  * Promtool: Fix checking of authorization.credentials_file and
    bearer_token_file fields. #9883
  * Uyuni SD: Fix null pointer exception during initialization.
  * TSDB: Fix queries after a failed snapshot replay. #9980
- Upgrade to upstream version 2.31.1
  + Bugfix:
  * SD: Fix a panic when the experimental discovery manager
    receives targets during a reload. #9656
- Upgrade to upstream version 2.31.0
  + Change:
  * UI: Remove standard PromQL editor in favour of the
    codemirror-based editor. #9452
  + Features:
  * PromQL: Add trigonometric functions and atan2 binary
    operator. #9239 #9248 #9515
  * Remote: Add support for exemplar in the remote write receiver
    endpoint. #9319 #9414
  * SD: Add PuppetDB service discovery. #8883
  * SD: Add Uyuni service discovery. #8190
  * Web: Add support for security-related HTTP headers. #9546
  + Enhancements:
  * Azure SD: Add proxy_url, follow_redirects, tls_config. #9267
  * Backfill: Add --max-block-duration in promtool
    create-blocks-from rules. #9511
  * Config: Print human-readable sizes with unit instead of raw
    numbers. #9361
  * HTTP: Re-enable HTTP/2. #9398
  * Kubernetes SD: Warn user if number of endpoints exceeds
    limit. #9467
  * OAuth2: Add TLS configuration to token requests. #9550
  * PromQL: Several optimizations. #9365 #9360 #9362 #9552
  * PromQL: Make aggregations deterministic in instant queries.
  * Rules: Add the ability to limit number of alerts or series.
  * SD: Experimental discovery manager to avoid restarts upon
    reload.
  * UI: Debounce timerange setting changes. #9359
  + Bugfixes:
  * Backfill: Apply rule labels after query labels. #9421
  * Scrape: Resolve conflicts between multiple exported label
    prefixes. #9479 #9518
  * Scrape: Restart scrape loops when __scrape_interval__ is
    changed. #9551
  * TSDB: Fix memory leak in samples deletion. #9151
  * UI: Use consistent margin-bottom for all alert kinds. #9318
- Upgrade to upstream version 2.30.3
  + Bugfixes:
  * TSDB: Fix panic on failed snapshot replay. #9438
  * TSDB: Don't fail snapshot replay with exemplar storage
    disabled when the snapshot contains exemplars. #9438
- Upgrade to upstream version 2.30.2
  + Bugfix:
  * TSDB: Don't error on overlapping m-mapped chunks during WAL
    replay. #9381
- Upgrade to upstream version 2.30.1
  + Enhancements:
  * Remote Write: Redact remote write URL when used for metric
    label. #9383
  * UI: Redact remote write URL and proxy URL passwords in the
    /config page. #9408
  + Bugfixes:
  * promtool rules backfill: Prevent creation of data before the
    start time. #9339
  * promtool rules backfill: Do not query after the end time.
  * Azure SD: Fix panic when no computername is set. #9387
- Upgrade to upstream version 2.30.0
  + Features:
  * experimental TSDB: Snapshot in-memory chunks on shutdown for
    faster restarts. #7229
  * experimental Scrape: Configure scrape interval and scrape
    timeout via relabeling using __scrape_interval__ and
    __scrape_timeout__ labels respectively. #8911
  * Scrape: Add scrape_timeout_seconds and scrape_sample_limit
    metric. #9247 #9295
  + Enhancements:
  * Scrape: Add --scrape.timestamp-tolerance flag to adjust
    scrape timestamp tolerance when enabled via
  - -scrape.adjust-timestamps. #9283
  * Remote Write: Improve throughput when sending exemplars.
  * TSDB: Optimise WAL loading by removing extra map and caching
    min-time #9160
  * promtool: Speed up checking for duplicate rules. #9262/#9306
  * Scrape: Reduce allocations when parsing the metrics. #9299
  * docker_sd: Support host network mode #9125
  + Bugfixes:
  * Exemplars: Fix panic when resizing exemplar storage from 0 to
    a non-zero size. #9286
  * TSDB: Correctly decrement
    prometheus_tsdb_head_active_appenders when the append has no
    samples. #9230
  * promtool rules backfill: Return 1 if backfill was
    unsuccessful. #9303
  * promtool rules backfill: Avoid creation of overlapping
    blocks. #9324
  * config: Fix a panic when reloading configuration with a null
    relabel action. #9224
- Upgrade to upstream version 2.29.2
  + Bugfixes:
  * Fix Kubernetes SD failing to discover Ingress in
    Kubernetes v1.22. #9205
  * Fix data race in loading write-ahead-log (WAL). #9259
- Upgrade to upstream version 2.29.1
  + Bugfixes:
  * TSDB: align atomically accessed int64 to prevent panic in
    32-bit archs. #9192
- Upgrade to upstream version 2.29.0
  + Changes:
  * Promote --storage.tsdb.allow-overlapping-blocks flag to
    stable. #9117
  * Promote --storage.tsdb.retention.size flag to stable. #9004
  + Features:
  * Add Kuma service discovery. #8844
  * Add present_over_time PromQL function. #9097
  * Allow configuring exemplar storage via file and make it
    reloadable. #8974
  * UI: Allow selecting time range with mouse drag. #8977
  * promtool: Add feature flags flag --enable-feature. #8958
  * promtool: Add file_sd file validation. #8950
  + Enhancements:
  * Reduce blocking of outgoing remote write requests from series
    garbage collection. #9109
  * Improve write-ahead-log decoding performance. #9106
  * Improve append performance in TSDB by reducing mutexes usage.
  * Allow configuring max_samples_per_send for remote write
    metadata. #8959
  * Add __meta_gce_interface_ipv4_&lt;name&gt; meta label to GCE
    discovery. #8978
  * Add __meta_ec2_availability_zone_id meta label to EC2
    discovery. #8896
  * Add __meta_azure_machine_computer_name meta label to Azure
    discovery. #9112
  * Add __meta_hetzner_hcloud_labelpresent_&lt;labelname&gt; meta label
    to Hetzner discovery. #9028
  * promtool: Add compaction efficiency to promtool tsdb analyze
    reports. #8940
  * promtool: Allow configuring max block duration for
    backfilling via --max-block-duration flag. #8919
  * UI: Add sorting and filtering to flags page. #8988
  * UI: Improve alerts page rendering performance. #9005
  + Bugfixes:
  * Log when total symbol size exceeds 2^32 bytes, causing
    compaction to fail, and skip compaction. #9104
  * Fix incorrect target_limit reloading of zero value. #9120
  * Fix head GC and pending readers race condition. #9081
  * Fix timestamp handling in OpenMetrics parser. #9008
  * Fix potential duplicate metrics in /federate endpoint when
    specifying multiple matchers. #8885
  * Fix server configuration and validation for authentication
    via client cert. #9123
  * Allow start and end again as label names in PromQL queries.
    They were disallowed since the introduction of @ timestamp
    feature. #9119
- Upgrade to upstream version 2.28.1
  + Bugfixes:
  * HTTP SD: Allow charset specification in Content-Type header.
  * HTTP SD: Fix handling of disappeared target groups. #9019
  * Fix incorrect log-level handling after moving to go-kit/log.
- Upgrade to upstream version 2.28.0
  + Change:
  * UI: Make the new experimental PromQL editor the default.
  + Features:
  * Linode SD: Add Linode service discovery. #8846
  * HTTP SD: Add generic HTTP-based service discovery. #8839
  * Kubernetes SD: Allow configuring API Server access via a
    kubeconfig file. #8811
  * UI: Add exemplar display support to the graphing interface.
  * Consul SD: Add namespace support for Consul Enterprise. #8900
  + Enhancements:
  * Promtool: Allow silencing output when importing / backfilling
    data. #8917
  * Consul SD: Support reading tokens from file. #8926
  * Rules: Add a new .ExternalURL alert field templating
    variable, containing the external URL of the Prometheus
    server. #8878
  * Scrape: Add experimental body_size_limit scrape configuration
    setting to limit the allowed response body size for target
    scrapes. #8833 #8886
  * Kubernetes SD: Add ingress class name label for ingress
    discovery. #8916
  * UI: Show a startup screen with progress bar when the TSDB is
    not ready yet. #8662 #8908 #8909 #8946
  * SD: Add a target creation failure counter
    prometheus_target_sync_failed_total and improve target
    creation failure handling. #8786
  * TSDB: Improve validation of exemplar label set length. #8816
  * TSDB: Add a prometheus_tsdb_clean_start metric that indicates
    whether a TSDB lockfile from a previous run still existed
    upon startup. #8824
  + Bugfixes:
  * UI: In the experimental PromQL editor, fix autocompletion and
    parsing for special float values and improve series metadata
    fetching. #8856
  * TSDB: When merging chunks, split resulting chunks if they
    would contain more than the maximum of 120 samples. #8582
  * SD: Fix the computation of the
    prometheus_sd_discovered_targets metric when using multiple
    service discoveries. #8828</changelog>
</package>
<package pkgid="cea2c4f051083f9ff1d098299dabc517bdf4633f663d2b16205da86cb841dda1" name="golang-github-prometheus-prometheus" arch="ppc64le">
  <version epoch="0" ver="2.32.1" rel="4.3.2"/>
  <changelog author="asn@cryptomilk.org" date="1564574400">- Build with PIE
  + Added 0004-prometheus-buildmode-pie.patch</changelog>
  <changelog author="jan.fajerski@suse.com" date="1564747200">- Add network-online (Wants and After) dependency to systemd unit bsc#1143913</changelog>
  <changelog author="jan.fajerski@suse.com" date="1565956800">- remove 0004-prometheus-buildmode-pie.patch
  + this patch produces binaries that crash immediately
- add -v to promu build command for better build debugging
- reorder some %install tasks</changelog>
  <changelog author="mrostecki@opensuse.org" date="1569240000">- Do not install the firewalld config file on Tumbleweed (on
  versions newer than Leap 15.1). It's installed in the main
  firewalld package.</changelog>
  <changelog author="jcavalheiro@suse.com" date="1574251200">- Update Uyuni/SUSE Manager service discovery patch
  + Modified 0003-Add-Uyuni-service-discovery.patch
  + Fixes crashes when systems have no FQDN
  + Adds Parallel calls to Uyuni API, meaningful performance increase
  + Adds Support for system group labels</changelog>
  <changelog author="mrostecki@opensuse.org" date="1574251201">- Remove firewalld files. They are installed in the main firewalld
  package.</changelog>
  <changelog author="jan.fajerski@suse.com" date="1574337600">- Remove prometheus.firewall.xml source file</changelog>
  <changelog author="jcavalheiro@suse.com" date="1574683200">- Patch macros on spec file to support builds on SLE 12</changelog>
  <changelog author="witold.bedyk@suse.com" date="1580126400">- Update to Prometheus 2.11.2</changelog>
  <changelog author="jcavalheiro@suse.com" date="1589371200">- Update Uyuni/SUSE Manager service discovery patch
  + Modified 0003-Add-Uyuni-service-discovery.patch:
  + Adapt service discovery to the new Uyuni API endpoints
  + Modified spec file: force golang 1.12 to fix build issues in SLE15SP2</changelog>
  <changelog author="jcavalheiro@suse.com" date="1591185600">- Update change log and spec file
  + Modified spec file: default to golang 1.14 to avoid "have choice" build issues in OBS.
  + Rebase and update patches for version 2.18.0
  + Changed:
  * 0001-Do-not-force-the-pure-Go-name-resolver.patch
  * 0002-Default-settings.patch Changed
  * 0003-Add-Uyuni-service-discovery.patch
- Update to 2.18.0
  + Features
  * Tracing: Added experimental Jaeger support #7148
  + Changes
  * Federation: Only use local TSDB for federation (ignore remote read). #7096
  * Rules: `rule_evaluations_total` and `rule_evaluation_failures_total` have a `rule_group` label now. #7094
  + Enhancements
  * TSDB: Significantly reduce WAL size kept around after a block cut. #7098
  * Discovery: Add `architecture` meta label for EC2. #7000
  + Bug fixes
  * UI: Fixed wrong MinTime reported by /status. #7182
  * React UI: Fixed multiselect legend on OSX. #6880
  * Remote Write: Fixed blocked resharding edge case. #7122
  * Remote Write: Fixed remote write not updating on relabel configs change. #7073
- Changes from 2.17.2
  + Bug fixes
  * Federation: Register federation metrics #7081
  * PromQL: Fix panic in parser error handling #7132
  * Rules: Fix reloads hanging when deleting a rule group that is being evaluated #7138
  * TSDB: Fix a memory leak when prometheus starts with an empty TSDB WAL #7135
  * TSDB: Make isolation more robust to panics in web handlers #7129 #7136
- Changes from 2.17.1
  + Bug fixes
  * TSDB: Fix query performance regression that increased memory and CPU usage #7051
- Changes from 2.17.0
  + Features
  * TSDB: Support isolation #6841
  * This release implements isolation in TSDB. API queries and recording rules are
    guaranteed to only see full scrapes and full recording rules. This comes with a
    certain overhead in resource usage. Depending on the situation, there might be
    some increase in memory usage, CPU usage, or query latency.
  + Enhancements
  * PromQL: Allow more keywords as metric names #6933
  * React UI: Add normalization of localhost URLs in targets page #6794
  * Remote read: Read from remote storage concurrently #6770
  * Rules: Mark deleted rule series as stale after a reload #6745
  * Scrape: Log scrape append failures as debug rather than warn #6852
  * TSDB: Improve query performance for queries that partially hit the head #6676
  * Consul SD: Expose service health as meta label #5313
  * EC2 SD: Expose EC2 instance lifecycle as meta label #6914
  * Kubernetes SD: Expose service type as meta label for K8s service role #6684
  * Kubernetes SD: Expose label_selector and field_selector #6807
  * Openstack SD: Expose hypervisor id as meta label #6962
  + Bug fixes
  * PromQL: Do not escape HTML-like chars in query log #6834 #6795
  * React UI: Fix data table matrix values #6896
  * React UI: Fix new targets page not loading when using non-ASCII characters #6892
  * Remote read: Fix duplication of metrics read from remote storage with external labels #6967 #7018
  * Remote write: Register WAL watcher and live reader metrics for all remotes, not just the first one #6998
  * Scrape: Prevent removal of metric names upon relabeling #6891
  * Scrape: Fix 'superfluous response.WriteHeader call' errors when scrape fails under some circonstances #6986
  * Scrape: Fix crash when reloads are separated by two scrape intervals #7011
- Changes from 2.16.0
  + Features
  * React UI: Support local timezone on /graph #6692
  * PromQL: add absent_over_time query function #6490
  * Adding optional logging of queries to their own file #6520
  + Enhancements
  * React UI: Add support for rules page and "Xs ago" duration displays #6503
  * React UI: alerts page, replace filtering togglers tabs with checkboxes #6543
  * TSDB: Export metric for WAL write errors #6647
  * TSDB: Improve query performance for queries that only touch the most recent 2h of data. #6651
  * PromQL: Refactoring in parser errors to improve error messages #6634
  * PromQL: Support trailing commas in grouping opts #6480
  * Scrape: Reduce memory usage on reloads by reusing scrape cache #6670
  * Scrape: Add metrics to track bytes and entries in the metadata cache #6675
  * promtool: Add support for line-column numbers for invalid rules output #6533
  * Avoid restarting rule groups when it is unnecessary #6450
  + Bug fixes
  * React UI: Send cookies on fetch() on older browsers #6553
  * React UI: adopt grafana flot fix for stacked graphs #6603
  * React UI: broken graph page browser history so that back button works as expected #6659
  * TSDB: ensure compactionsSkipped metric is registered, and log proper error if one is returned from head.Init #6616
  * TSDB: return an error on ingesting series with duplicate labels #6664
  * PromQL: Fix unary operator precedence #6579
  * PromQL: Respect query.timeout even when we reach query.max-concurrency #6712
  * PromQL: Fix string and parentheses handling in engine, which affected React UI #6612
  * PromQL: Remove output labels returned by absent() if they are produced by multiple identical label matchers #6493
  * Scrape: Validate that OpenMetrics input ends with `# EOF` #6505
  * Remote read: return the correct error if configs can't be marshal'd to JSON #6622
  * Remote write: Make remote client `Store` use passed context, which can affect shutdown timing #6673
  * Remote write: Improve sharding calculation in cases where we would always be consistently behind by tracking pendingSamples #6511
  * Ensure prometheus_rule_group metrics are deleted when a rule group is removed #6693
- Changes from 2.15.2
  + Bug fixes
  * TSDB: Fixed support for TSDB blocks built with Prometheus before 2.1.0. #6564
  * TSDB: Fixed block compaction issues on Windows. #6547
- Changes from 2.15.1
  + Bug fixes
  * TSDB: Fixed race on concurrent queries against same data. #6512
- Changes from 2.15.0
  + Features
  * API: Added new endpoint for exposing per metric metadata `/metadata`. #6420 #6442
  + Changes
  * Discovery: Removed `prometheus_sd_kubernetes_cache_*` metrics. Additionally `prometheus_sd_kubernetes_workqueue_latency_seconds` and `prometheus_sd_kubernetes_workqueue_work_duration_seconds` metrics now show correct values in seconds. #6393
  * Remote write: Changed `query` label on `prometheus_remote_storage_*` metrics to `remote_name` and `url`. #6043
  + Enhancements
  * TSDB: Significantly reduced memory footprint of loaded TSDB blocks. #6418 #6461
  * TSDB: Significantly optimized what we buffer during compaction which should result in lower memory footprint during compaction. #6422 #6452 #6468 #6475
  * TSDB: Improve replay latency. #6230
  * TSDB: WAL size is now used for size based retention calculation. #5886
  * Remote read: Added query grouping and range hints to the remote read request #6401
  * Remote write: Added `prometheus_remote_storage_sent_bytes_total` counter per queue. #6344
  * promql: Improved PromQL parser performance. #6356
  * React UI: Implemented missing pages like `/targets` #6276, TSDB status page #6281 #6267 and many other fixes and performance improvements.
  * promql: Prometheus now accepts spaces between time range and square bracket. e.g `[ 5m]` #6065
  + Bug fixes
  * Config: Fixed alertmanager configuration to not miss targets when configurations are similar. #6455
  * Remote write: Value of `prometheus_remote_storage_shards_desired` gauge shows raw value of desired shards and it's updated correctly. #6378
  * Rules: Prometheus now fails the evaluation of rules and alerts where metric results collide with labels specified in `labels` field. #6469
  * API: Targets Metadata API `/targets/metadata` now accepts empty `match_targets` parameter as in the spec. #6303
- Changes from 2.14.0
  + Features
  * API: `/api/v1/status/runtimeinfo` and `/api/v1/status/buildinfo` endpoints added for use by the React UI. #6243
  * React UI: implement the new experimental React based UI. #5694 and many more
  * Can be found by under `/new`.
  * Not all pages are implemented yet.
  * Status: Cardinality statistics added to the Runtime &amp; Build Information page. #6125
  + Enhancements
  * Remote write: fix delays in remote write after a compaction. #6021
  * UI: Alerts can be filtered by state. #5758
  + Bug fixes
  * Ensure warnings from the API are escaped. #6279
  * API: lifecycle endpoints return 403 when not enabled. #6057
  * Build: Fix Solaris build. #6149
  * Promtool: Remove false duplicate rule warnings when checking rule files with alerts. #6270
  * Remote write: restore use of deduplicating logger in remote write. #6113
  * Remote write: do not reshard when unable to send samples. #6111
  * Service discovery: errors are no longer logged on context cancellation. #6116, #6133
  * UI: handle null response from API properly. #6071
- Changes from 2.13.1
  + Bug fixes
  * Fix panic in ARM builds of Prometheus. #6110
  * promql: fix potential panic in the query logger. #6094
  * Multiple errors of http: superfluous response.WriteHeader call in the logs. #6145
- Changes from 2.13.0
  + Enhancements
  * Metrics: renamed prometheus_sd_configs_failed_total to prometheus_sd_failed_configs and changed to Gauge #5254
  * Include the tsdb tool in builds. #6089
  * Service discovery: add new node address types for kubernetes. #5902
  * UI: show warnings if query have returned some warnings. #5964
  * Remote write: reduce memory usage of the series cache. #5849
  * Remote read: use remote read streaming to reduce memory usage. #5703
  * Metrics: added metrics for remote write max/min/desired shards to queue manager. #5787
  * Promtool: show the warnings during label query. #5924
  * Promtool: improve error messages when parsing bad rules. #5965
  * Promtool: more promlint rules. #5515
  + Bug fixes
  * UI: Fix a Stored DOM XSS vulnerability with query history [CVE-2019-10215](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10215). #6098
  * Promtool: fix recording inconsistency due to duplicate labels. #6026
  * UI: fixes service-discovery view when accessed from unhealthy targets. #5915
  * Metrics format: OpenMetrics parser crashes on short input. #5939
  * UI: avoid truncated Y-axis values. #6014
- Changes from 2.12.0
  + Features
  * Track currently active PromQL queries in a log file. #5794
  * Enable and provide binaries for `mips64` / `mips64le` architectures. #5792
  + Enhancements
  * Improve responsiveness of targets web UI and API endpoint. #5740
  * Improve remote write desired shards calculation. #5763
  * Flush TSDB pages more precisely. tsdb#660
  * Add `prometheus_tsdb_retention_limit_bytes` metric. tsdb#667
  * Add logging during TSDB WAL replay on startup. tsdb#662
  * Improve TSDB memory usage. tsdb#653, tsdb#643, tsdb#654, tsdb#642, tsdb#627
  + Bug fixes
  * Check for duplicate label names in remote read. #5829
  * Mark deleted rules' series as stale on next evaluation. #5759
  * Fix JavaScript error when showing warning about out-of-sync server time. #5833
  * Fix `promtool test rules` panic when providing empty `exp_labels`. #5774
  * Only check last directory when discovering checkpoint number. #5756
  * Fix error propagation in WAL watcher helper functions. #5741
  * Correctly handle empty labels from alert templates. #5845</changelog>
  <changelog author="witold.bedyk@suse.com" date="1596196800">- Update 0003-Add-Uyuni-service-discovery.patch:
  + Add support for Prometheus exporters proxy</changelog>
  <changelog author="pseidensal@suse.com" date="1598875200">- Update package with changes from `server:monitoring` bsc#1175478
  Left out removal of firewalld related configuration files as SLE-15-SP1's
  `firewalld` package does not contain prometheus configuration yet.</changelog>
  <changelog author="stefano.torresi@suse.com" date="1604923200">- Update to upstream version 2.22.1
- Update packaging
  * Remove systemd and shadow hard requirements
  * use systemd-sysusers to configure the user in a dedicated 'system-user-prometheus' subpackage
  * add 'prometheus' package alias</changelog>
  <changelog author="witold.bedyk@suse.com" date="1615291200">- Uyuni: `hostname` label is now set to FQDN instead of IP
  + Changed:
  * 0003-Add-Uyuni-service-discovery.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1620129600">- Add tarball with vendor modules and web assets
- Uyuni: Read formula data from exporters map
- Uyuni: Add support for TLS targets
  + Changed:
  * 0003-Add-Uyuni-service-discovery.patch
  * 0002-Default-settings.patch Changed
  * 0003-Add-Uyuni-service-discovery.patch
- Upgrade to upstream version 2.26.0
  + Changes
  * Alerting: Using Alertmanager v2 API by default. #8626
  * Prometheus/Promtool: Binaries are now printing help and usage to stdout instead of stderr. #8542
  + Features
  * Remote: Add support for AWS SigV4 auth method for remote_write. #8509
  * PromQL: Allow negative offsets. Behind --enable-feature=promql-negative-offset flag. #8487
  * UI: Add advanced auto-completion, syntax highlighting and linting to graph page query input. #8634
  + Enhancements
  * PromQL: Add last_over_time, sgn, clamp functions. #8457
  * Scrape: Add support for specifying type of Authorization header credentials with Bearer by default. #8512
  * Scrape: Add follow_redirects option to scrape configuration. #8546
  * Remote: Allow retries on HTTP 429 response code for remote_write. #8237 #8477
  * Remote: Allow configuring custom headers for remote_read. #8516
  * UI: Hitting Enter now triggers new query. #8581
  * UI: Better handling of long rule and names on the /rules and /targets pages. #8608 #8609
  * UI: Add collapse/expand all button on the /targets page. #8486
- Upgrade to upstream version 2.25.0
  + Features
  * Include a new `--enable-feature=` flag that enables experimental features.
  + Enhancements
  * Add optional name property to testgroup for better test failure output. #8440
  * Add warnings into React Panel on the Graph page. #8427
  * TSDB: Increase the number of buckets for the compaction duration metric. #8342
  * Remote: Allow passing along custom remote_write HTTP headers. #8416
  * Mixins: Scope grafana configuration. #8332
  * Kubernetes SD: Add endpoint labels metadata. #8273
  * UI: Expose total number of label pairs in head in TSDB stats page. #8343
  * TSDB: Reload blocks every minute, to detect new blocks and enforce retention more often. #8343
  + Bug fixes
  * API: Fix global URL when external address has no port. #8359
  * Deprecate unused flag --alertmanager.timeout. #8407
- Upgrade to upstream version 2.24.1
  + Enhancements
  * Cache basic authentication results to significantly improve performance of HTTP endpoints.
- Upgrade to upstream version 2.24.0
  + Features
  * Add TLS and basic authentication to HTTP endpoints. #8316
  * promtool: Add check web-config subcommand to check web config files. #8319
  * promtool: Add tsdb create-blocks-from openmetrics subcommand to backfill metrics data from an OpenMetrics file. #8084
  + Enhancements
  * HTTP API: Fast-fail queries with only empty matchers. #8288
  * HTTP API: Support matchers for labels API. #8301
  * promtool: Improve checking of URLs passed on the command line. #7956
  * SD: Expose IPv6 as a label in EC2 SD. #7086
  * SD: Reuse EC2 client, reducing frequency of requesting credentials. #8311
  * TSDB: Add logging when compaction takes more than the block time range. #8151
  * TSDB: Avoid unnecessary GC runs after compaction. #8276
- Upgrade to upstream version 2.23.0
  + Changes
  * UI: Make the React UI default. #8142
  * Remote write: The following metrics were removed/renamed in remote write. #6815
    &gt; prometheus_remote_storage_succeeded_samples_total was removed and prometheus_remote_storage_samples_total was introduced for all the samples attempted to send.
    &gt; prometheus_remote_storage_sent_bytes_total was removed and replaced with prometheus_remote_storage_samples_bytes_total and prometheus_remote_storage_metadata_bytes_total.
    &gt; prometheus_remote_storage_failed_samples_total -&gt; prometheus_remote_storage_samples_failed_total .
    &gt; prometheus_remote_storage_retried_samples_total -&gt; prometheus_remote_storage_samples_retried_total.
    &gt; prometheus_remote_storage_dropped_samples_total -&gt; prometheus_remote_storage_samples_dropped_total.
    &gt; prometheus_remote_storage_pending_samples -&gt; prometheus_remote_storage_samples_pending.
  * Remote: Do not collect non-initialized timestamp metrics. #8060
  + Enhancements
  * Remote write: Added a metric prometheus_remote_storage_max_samples_per_send for remote write. #8102
  * TSDB: Make the snapshot directory name always the same length. #8138
  * TSDB: Create a checkpoint only once at the end of all head compactions. #8067
  * TSDB: Avoid Series API from hitting the chunks. #8050
  * TSDB: Cache label name and last value when adding series during compactions making compactions faster. #8192
  * PromQL: Improved performance of Hash method making queries a bit faster. #8025
  * promtool: tsdb list now prints block sizes. #7993
  * promtool: Calculate mint and maxt per test avoiding unnecessary calculations. #8096
  * SD: Add filtering of services to Docker Swarm SD. #8074</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1621425600">- Refresh patches
  + Changed:
  * 0001-Do-not-force-the-pure-Go-name-resolver.patch
  * 0002-Default-settings.patch
  * 0003-Add-Uyuni-service-discovery.patch
- Upgrade to upstream version 2.27.1 (jsc#SLE-18254)
  + Bugfix:
  * SECURITY: Fix arbitrary redirects under the /new endpoint (CVE-2021-29622, bsc#1186242)
- Upgrade to upstream version 2.27.0
  + Features:
  * Promtool: Retroactive rule evaluation functionality. #7675
  * Configuration: Environment variable expansion for external labels. Behind --enable-feature=expand-external-labels flag. #8649
  * TSDB: Add a flag(--storage.tsdb.max-block-chunk-segment-size) to control the max chunks file size of the blocks for small Prometheus instances. #8478
  * UI: Add a dark theme. #8604
  * AWS Lightsail Discovery: Add AWS Lightsail Discovery. #8693
  * Docker Discovery: Add Docker Service Discovery. #8629
  * OAuth: Allow OAuth 2.0 to be used anywhere an HTTP client is used. #8761
  * Remote Write: Send exemplars via remote write. Experimental and disabled by default. #8296
  + Enhancements:
  * Digital Ocean Discovery: Add __meta_digitalocean_vpc label. #8642
  * Scaleway Discovery: Read Scaleway secret from a file. #8643
  * Scrape: Add configurable limits for label size and count. #8777
  * UI: Add 16w and 26w time range steps. #8656
  * Templating: Enable parsing strings in humanize functions. #8682
  + Bugfixes:
  * UI: Provide errors instead of blank page on TSDB Status Page. #8654 #8659
  * TSDB: Do not panic when writing very large records to the WAL. #8790
  * TSDB: Avoid panic when mmaped memory is referenced after the file is closed. #8723
  * Scaleway Discovery: Fix nil pointer dereference. #8737
  * Consul Discovery: Restart no longer required after config update with no targets. #8766</changelog>
  <changelog author="witold.bedyk@suse.com" date="1625745600">- Provide and reload firewalld configuration only for:
  + openSUSE Leap 15.0, 15.1, 15.2
  + SUSE SLE15, SLE15 SP1, SLE15 SP2</changelog>
  <changelog author="jsegitz@suse.com" date="1632139200">- Added hardening to systemd service(s) (bsc#1181400). Modified:
  * prometheus.service</changelog>
  <changelog author="witold.bedyk@suse.com" date="1642593600">- Updated patches:
  + Changed:
  * 0002-Default-settings.patch
  + Removed:
  * 0003-Add-Uyuni-service-discovery.patch
- Use obs-service-go_modules
- Upgrade to upstream version 2.32.1 (jsc#SLE-22863)
  + Bugfixes:
  * Scrape: Fix reporting metrics when sample limit is reached
    during the report. #9996
  * Scrape: Ensure that scrape interval and scrape timeout are
    always set. #10023
  * TSDB: Expose and fix bug in iterators' Seek() method. #10030
- Upgrade to upstream version 2.32.0
  + Change:
  * remote-write: Change default max retry time from 100ms to
    5 seconds. #9634
  + Features:
  * Agent: New mode of operation optimized for remote-write only
    scenarios, without local storage.
  * Promtool: Add promtool check service-discovery command. #8970
  + Enhancements:
  * Promtool: Improve test output. #8064
  * Promtool: Use kahan summation for better numerical stability.
  * Remote-write: Reuse memory for marshalling. #9412
  * Scrape: Add scrape_body_size_bytes scrape metric behind the
  - -enable-feature=extra-scrape-metrics flag. #9569
  * TSDB: Add windows arm64 support. #9703
  * TSDB: Optimize query by skipping unneeded sorting in TSDB.
  * Templates: Support int and uint as datatypes for template
    formatting. #9680
  * UI: Prefer rate over rad, delta over deg, and count over cos
    in autocomplete. #9688
  + Bugfixes:
  * TSDB: Add more size checks when writing individual sections
    in the index. #9710
  * PromQL: Make deriv() return zero values for constant series.
  * TSDB: Fix panic when checkpoint directory is empty. #9687
  * TSDB: Fix panic, out of order chunks, and race warning during
    WAL replay. #9856
  * UI: Correctly render links for targets with IPv6 addresses
    that contain a Zone ID. #9853
  * Promtool: Fix checking of authorization.credentials_file and
    bearer_token_file fields. #9883
  * Uyuni SD: Fix null pointer exception during initialization.
  * TSDB: Fix queries after a failed snapshot replay. #9980
- Upgrade to upstream version 2.31.1
  + Bugfix:
  * SD: Fix a panic when the experimental discovery manager
    receives targets during a reload. #9656
- Upgrade to upstream version 2.31.0
  + Change:
  * UI: Remove standard PromQL editor in favour of the
    codemirror-based editor. #9452
  + Features:
  * PromQL: Add trigonometric functions and atan2 binary
    operator. #9239 #9248 #9515
  * Remote: Add support for exemplar in the remote write receiver
    endpoint. #9319 #9414
  * SD: Add PuppetDB service discovery. #8883
  * SD: Add Uyuni service discovery. #8190
  * Web: Add support for security-related HTTP headers. #9546
  + Enhancements:
  * Azure SD: Add proxy_url, follow_redirects, tls_config. #9267
  * Backfill: Add --max-block-duration in promtool
    create-blocks-from rules. #9511
  * Config: Print human-readable sizes with unit instead of raw
    numbers. #9361
  * HTTP: Re-enable HTTP/2. #9398
  * Kubernetes SD: Warn user if number of endpoints exceeds
    limit. #9467
  * OAuth2: Add TLS configuration to token requests. #9550
  * PromQL: Several optimizations. #9365 #9360 #9362 #9552
  * PromQL: Make aggregations deterministic in instant queries.
  * Rules: Add the ability to limit number of alerts or series.
  * SD: Experimental discovery manager to avoid restarts upon
    reload.
  * UI: Debounce timerange setting changes. #9359
  + Bugfixes:
  * Backfill: Apply rule labels after query labels. #9421
  * Scrape: Resolve conflicts between multiple exported label
    prefixes. #9479 #9518
  * Scrape: Restart scrape loops when __scrape_interval__ is
    changed. #9551
  * TSDB: Fix memory leak in samples deletion. #9151
  * UI: Use consistent margin-bottom for all alert kinds. #9318
- Upgrade to upstream version 2.30.3
  + Bugfixes:
  * TSDB: Fix panic on failed snapshot replay. #9438
  * TSDB: Don't fail snapshot replay with exemplar storage
    disabled when the snapshot contains exemplars. #9438
- Upgrade to upstream version 2.30.2
  + Bugfix:
  * TSDB: Don't error on overlapping m-mapped chunks during WAL
    replay. #9381
- Upgrade to upstream version 2.30.1
  + Enhancements:
  * Remote Write: Redact remote write URL when used for metric
    label. #9383
  * UI: Redact remote write URL and proxy URL passwords in the
    /config page. #9408
  + Bugfixes:
  * promtool rules backfill: Prevent creation of data before the
    start time. #9339
  * promtool rules backfill: Do not query after the end time.
  * Azure SD: Fix panic when no computername is set. #9387
- Upgrade to upstream version 2.30.0
  + Features:
  * experimental TSDB: Snapshot in-memory chunks on shutdown for
    faster restarts. #7229
  * experimental Scrape: Configure scrape interval and scrape
    timeout via relabeling using __scrape_interval__ and
    __scrape_timeout__ labels respectively. #8911
  * Scrape: Add scrape_timeout_seconds and scrape_sample_limit
    metric. #9247 #9295
  + Enhancements:
  * Scrape: Add --scrape.timestamp-tolerance flag to adjust
    scrape timestamp tolerance when enabled via
  - -scrape.adjust-timestamps. #9283
  * Remote Write: Improve throughput when sending exemplars.
  * TSDB: Optimise WAL loading by removing extra map and caching
    min-time #9160
  * promtool: Speed up checking for duplicate rules. #9262/#9306
  * Scrape: Reduce allocations when parsing the metrics. #9299
  * docker_sd: Support host network mode #9125
  + Bugfixes:
  * Exemplars: Fix panic when resizing exemplar storage from 0 to
    a non-zero size. #9286
  * TSDB: Correctly decrement
    prometheus_tsdb_head_active_appenders when the append has no
    samples. #9230
  * promtool rules backfill: Return 1 if backfill was
    unsuccessful. #9303
  * promtool rules backfill: Avoid creation of overlapping
    blocks. #9324
  * config: Fix a panic when reloading configuration with a null
    relabel action. #9224
- Upgrade to upstream version 2.29.2
  + Bugfixes:
  * Fix Kubernetes SD failing to discover Ingress in
    Kubernetes v1.22. #9205
  * Fix data race in loading write-ahead-log (WAL). #9259
- Upgrade to upstream version 2.29.1
  + Bugfixes:
  * TSDB: align atomically accessed int64 to prevent panic in
    32-bit archs. #9192
- Upgrade to upstream version 2.29.0
  + Changes:
  * Promote --storage.tsdb.allow-overlapping-blocks flag to
    stable. #9117
  * Promote --storage.tsdb.retention.size flag to stable. #9004
  + Features:
  * Add Kuma service discovery. #8844
  * Add present_over_time PromQL function. #9097
  * Allow configuring exemplar storage via file and make it
    reloadable. #8974
  * UI: Allow selecting time range with mouse drag. #8977
  * promtool: Add feature flags flag --enable-feature. #8958
  * promtool: Add file_sd file validation. #8950
  + Enhancements:
  * Reduce blocking of outgoing remote write requests from series
    garbage collection. #9109
  * Improve write-ahead-log decoding performance. #9106
  * Improve append performance in TSDB by reducing mutexes usage.
  * Allow configuring max_samples_per_send for remote write
    metadata. #8959
  * Add __meta_gce_interface_ipv4_&lt;name&gt; meta label to GCE
    discovery. #8978
  * Add __meta_ec2_availability_zone_id meta label to EC2
    discovery. #8896
  * Add __meta_azure_machine_computer_name meta label to Azure
    discovery. #9112
  * Add __meta_hetzner_hcloud_labelpresent_&lt;labelname&gt; meta label
    to Hetzner discovery. #9028
  * promtool: Add compaction efficiency to promtool tsdb analyze
    reports. #8940
  * promtool: Allow configuring max block duration for
    backfilling via --max-block-duration flag. #8919
  * UI: Add sorting and filtering to flags page. #8988
  * UI: Improve alerts page rendering performance. #9005
  + Bugfixes:
  * Log when total symbol size exceeds 2^32 bytes, causing
    compaction to fail, and skip compaction. #9104
  * Fix incorrect target_limit reloading of zero value. #9120
  * Fix head GC and pending readers race condition. #9081
  * Fix timestamp handling in OpenMetrics parser. #9008
  * Fix potential duplicate metrics in /federate endpoint when
    specifying multiple matchers. #8885
  * Fix server configuration and validation for authentication
    via client cert. #9123
  * Allow start and end again as label names in PromQL queries.
    They were disallowed since the introduction of @ timestamp
    feature. #9119
- Upgrade to upstream version 2.28.1
  + Bugfixes:
  * HTTP SD: Allow charset specification in Content-Type header.
  * HTTP SD: Fix handling of disappeared target groups. #9019
  * Fix incorrect log-level handling after moving to go-kit/log.
- Upgrade to upstream version 2.28.0
  + Change:
  * UI: Make the new experimental PromQL editor the default.
  + Features:
  * Linode SD: Add Linode service discovery. #8846
  * HTTP SD: Add generic HTTP-based service discovery. #8839
  * Kubernetes SD: Allow configuring API Server access via a
    kubeconfig file. #8811
  * UI: Add exemplar display support to the graphing interface.
  * Consul SD: Add namespace support for Consul Enterprise. #8900
  + Enhancements:
  * Promtool: Allow silencing output when importing / backfilling
    data. #8917
  * Consul SD: Support reading tokens from file. #8926
  * Rules: Add a new .ExternalURL alert field templating
    variable, containing the external URL of the Prometheus
    server. #8878
  * Scrape: Add experimental body_size_limit scrape configuration
    setting to limit the allowed response body size for target
    scrapes. #8833 #8886
  * Kubernetes SD: Add ingress class name label for ingress
    discovery. #8916
  * UI: Show a startup screen with progress bar when the TSDB is
    not ready yet. #8662 #8908 #8909 #8946
  * SD: Add a target creation failure counter
    prometheus_target_sync_failed_total and improve target
    creation failure handling. #8786
  * TSDB: Improve validation of exemplar label set length. #8816
  * TSDB: Add a prometheus_tsdb_clean_start metric that indicates
    whether a TSDB lockfile from a previous run still existed
    upon startup. #8824
  + Bugfixes:
  * UI: In the experimental PromQL editor, fix autocompletion and
    parsing for special float values and improve series metadata
    fetching. #8856
  * TSDB: When merging chunks, split resulting chunks if they
    would contain more than the maximum of 120 samples. #8582
  * SD: Fix the computation of the
    prometheus_sd_discovered_targets metric when using multiple
    service discoveries. #8828</changelog>
</package>
<package pkgid="b268ff4774d9a0ac685a65410a91333d9c74f47647f47df82ad4b24c9384712f" name="golang-github-prometheus-prometheus" arch="s390x">
  <version epoch="0" ver="2.32.1" rel="4.3.2"/>
  <changelog author="asn@cryptomilk.org" date="1564574400">- Build with PIE
  + Added 0004-prometheus-buildmode-pie.patch</changelog>
  <changelog author="jan.fajerski@suse.com" date="1564747200">- Add network-online (Wants and After) dependency to systemd unit bsc#1143913</changelog>
  <changelog author="jan.fajerski@suse.com" date="1565956800">- remove 0004-prometheus-buildmode-pie.patch
  + this patch produces binaries that crash immediately
- add -v to promu build command for better build debugging
- reorder some %install tasks</changelog>
  <changelog author="mrostecki@opensuse.org" date="1569240000">- Do not install the firewalld config file on Tumbleweed (on
  versions newer than Leap 15.1). It's installed in the main
  firewalld package.</changelog>
  <changelog author="jcavalheiro@suse.com" date="1574251200">- Update Uyuni/SUSE Manager service discovery patch
  + Modified 0003-Add-Uyuni-service-discovery.patch
  + Fixes crashes when systems have no FQDN
  + Adds Parallel calls to Uyuni API, meaningful performance increase
  + Adds Support for system group labels</changelog>
  <changelog author="mrostecki@opensuse.org" date="1574251201">- Remove firewalld files. They are installed in the main firewalld
  package.</changelog>
  <changelog author="jan.fajerski@suse.com" date="1574337600">- Remove prometheus.firewall.xml source file</changelog>
  <changelog author="jcavalheiro@suse.com" date="1574683200">- Patch macros on spec file to support builds on SLE 12</changelog>
  <changelog author="witold.bedyk@suse.com" date="1580126400">- Update to Prometheus 2.11.2</changelog>
  <changelog author="jcavalheiro@suse.com" date="1589371200">- Update Uyuni/SUSE Manager service discovery patch
  + Modified 0003-Add-Uyuni-service-discovery.patch:
  + Adapt service discovery to the new Uyuni API endpoints
  + Modified spec file: force golang 1.12 to fix build issues in SLE15SP2</changelog>
  <changelog author="jcavalheiro@suse.com" date="1591185600">- Update change log and spec file
  + Modified spec file: default to golang 1.14 to avoid "have choice" build issues in OBS.
  + Rebase and update patches for version 2.18.0
  + Changed:
  * 0001-Do-not-force-the-pure-Go-name-resolver.patch
  * 0002-Default-settings.patch Changed
  * 0003-Add-Uyuni-service-discovery.patch
- Update to 2.18.0
  + Features
  * Tracing: Added experimental Jaeger support #7148
  + Changes
  * Federation: Only use local TSDB for federation (ignore remote read). #7096
  * Rules: `rule_evaluations_total` and `rule_evaluation_failures_total` have a `rule_group` label now. #7094
  + Enhancements
  * TSDB: Significantly reduce WAL size kept around after a block cut. #7098
  * Discovery: Add `architecture` meta label for EC2. #7000
  + Bug fixes
  * UI: Fixed wrong MinTime reported by /status. #7182
  * React UI: Fixed multiselect legend on OSX. #6880
  * Remote Write: Fixed blocked resharding edge case. #7122
  * Remote Write: Fixed remote write not updating on relabel configs change. #7073
- Changes from 2.17.2
  + Bug fixes
  * Federation: Register federation metrics #7081
  * PromQL: Fix panic in parser error handling #7132
  * Rules: Fix reloads hanging when deleting a rule group that is being evaluated #7138
  * TSDB: Fix a memory leak when prometheus starts with an empty TSDB WAL #7135
  * TSDB: Make isolation more robust to panics in web handlers #7129 #7136
- Changes from 2.17.1
  + Bug fixes
  * TSDB: Fix query performance regression that increased memory and CPU usage #7051
- Changes from 2.17.0
  + Features
  * TSDB: Support isolation #6841
  * This release implements isolation in TSDB. API queries and recording rules are
    guaranteed to only see full scrapes and full recording rules. This comes with a
    certain overhead in resource usage. Depending on the situation, there might be
    some increase in memory usage, CPU usage, or query latency.
  + Enhancements
  * PromQL: Allow more keywords as metric names #6933
  * React UI: Add normalization of localhost URLs in targets page #6794
  * Remote read: Read from remote storage concurrently #6770
  * Rules: Mark deleted rule series as stale after a reload #6745
  * Scrape: Log scrape append failures as debug rather than warn #6852
  * TSDB: Improve query performance for queries that partially hit the head #6676
  * Consul SD: Expose service health as meta label #5313
  * EC2 SD: Expose EC2 instance lifecycle as meta label #6914
  * Kubernetes SD: Expose service type as meta label for K8s service role #6684
  * Kubernetes SD: Expose label_selector and field_selector #6807
  * Openstack SD: Expose hypervisor id as meta label #6962
  + Bug fixes
  * PromQL: Do not escape HTML-like chars in query log #6834 #6795
  * React UI: Fix data table matrix values #6896
  * React UI: Fix new targets page not loading when using non-ASCII characters #6892
  * Remote read: Fix duplication of metrics read from remote storage with external labels #6967 #7018
  * Remote write: Register WAL watcher and live reader metrics for all remotes, not just the first one #6998
  * Scrape: Prevent removal of metric names upon relabeling #6891
  * Scrape: Fix 'superfluous response.WriteHeader call' errors when scrape fails under some circonstances #6986
  * Scrape: Fix crash when reloads are separated by two scrape intervals #7011
- Changes from 2.16.0
  + Features
  * React UI: Support local timezone on /graph #6692
  * PromQL: add absent_over_time query function #6490
  * Adding optional logging of queries to their own file #6520
  + Enhancements
  * React UI: Add support for rules page and "Xs ago" duration displays #6503
  * React UI: alerts page, replace filtering togglers tabs with checkboxes #6543
  * TSDB: Export metric for WAL write errors #6647
  * TSDB: Improve query performance for queries that only touch the most recent 2h of data. #6651
  * PromQL: Refactoring in parser errors to improve error messages #6634
  * PromQL: Support trailing commas in grouping opts #6480
  * Scrape: Reduce memory usage on reloads by reusing scrape cache #6670
  * Scrape: Add metrics to track bytes and entries in the metadata cache #6675
  * promtool: Add support for line-column numbers for invalid rules output #6533
  * Avoid restarting rule groups when it is unnecessary #6450
  + Bug fixes
  * React UI: Send cookies on fetch() on older browsers #6553
  * React UI: adopt grafana flot fix for stacked graphs #6603
  * React UI: broken graph page browser history so that back button works as expected #6659
  * TSDB: ensure compactionsSkipped metric is registered, and log proper error if one is returned from head.Init #6616
  * TSDB: return an error on ingesting series with duplicate labels #6664
  * PromQL: Fix unary operator precedence #6579
  * PromQL: Respect query.timeout even when we reach query.max-concurrency #6712
  * PromQL: Fix string and parentheses handling in engine, which affected React UI #6612
  * PromQL: Remove output labels returned by absent() if they are produced by multiple identical label matchers #6493
  * Scrape: Validate that OpenMetrics input ends with `# EOF` #6505
  * Remote read: return the correct error if configs can't be marshal'd to JSON #6622
  * Remote write: Make remote client `Store` use passed context, which can affect shutdown timing #6673
  * Remote write: Improve sharding calculation in cases where we would always be consistently behind by tracking pendingSamples #6511
  * Ensure prometheus_rule_group metrics are deleted when a rule group is removed #6693
- Changes from 2.15.2
  + Bug fixes
  * TSDB: Fixed support for TSDB blocks built with Prometheus before 2.1.0. #6564
  * TSDB: Fixed block compaction issues on Windows. #6547
- Changes from 2.15.1
  + Bug fixes
  * TSDB: Fixed race on concurrent queries against same data. #6512
- Changes from 2.15.0
  + Features
  * API: Added new endpoint for exposing per metric metadata `/metadata`. #6420 #6442
  + Changes
  * Discovery: Removed `prometheus_sd_kubernetes_cache_*` metrics. Additionally `prometheus_sd_kubernetes_workqueue_latency_seconds` and `prometheus_sd_kubernetes_workqueue_work_duration_seconds` metrics now show correct values in seconds. #6393
  * Remote write: Changed `query` label on `prometheus_remote_storage_*` metrics to `remote_name` and `url`. #6043
  + Enhancements
  * TSDB: Significantly reduced memory footprint of loaded TSDB blocks. #6418 #6461
  * TSDB: Significantly optimized what we buffer during compaction which should result in lower memory footprint during compaction. #6422 #6452 #6468 #6475
  * TSDB: Improve replay latency. #6230
  * TSDB: WAL size is now used for size based retention calculation. #5886
  * Remote read: Added query grouping and range hints to the remote read request #6401
  * Remote write: Added `prometheus_remote_storage_sent_bytes_total` counter per queue. #6344
  * promql: Improved PromQL parser performance. #6356
  * React UI: Implemented missing pages like `/targets` #6276, TSDB status page #6281 #6267 and many other fixes and performance improvements.
  * promql: Prometheus now accepts spaces between time range and square bracket. e.g `[ 5m]` #6065
  + Bug fixes
  * Config: Fixed alertmanager configuration to not miss targets when configurations are similar. #6455
  * Remote write: Value of `prometheus_remote_storage_shards_desired` gauge shows raw value of desired shards and it's updated correctly. #6378
  * Rules: Prometheus now fails the evaluation of rules and alerts where metric results collide with labels specified in `labels` field. #6469
  * API: Targets Metadata API `/targets/metadata` now accepts empty `match_targets` parameter as in the spec. #6303
- Changes from 2.14.0
  + Features
  * API: `/api/v1/status/runtimeinfo` and `/api/v1/status/buildinfo` endpoints added for use by the React UI. #6243
  * React UI: implement the new experimental React based UI. #5694 and many more
  * Can be found by under `/new`.
  * Not all pages are implemented yet.
  * Status: Cardinality statistics added to the Runtime &amp; Build Information page. #6125
  + Enhancements
  * Remote write: fix delays in remote write after a compaction. #6021
  * UI: Alerts can be filtered by state. #5758
  + Bug fixes
  * Ensure warnings from the API are escaped. #6279
  * API: lifecycle endpoints return 403 when not enabled. #6057
  * Build: Fix Solaris build. #6149
  * Promtool: Remove false duplicate rule warnings when checking rule files with alerts. #6270
  * Remote write: restore use of deduplicating logger in remote write. #6113
  * Remote write: do not reshard when unable to send samples. #6111
  * Service discovery: errors are no longer logged on context cancellation. #6116, #6133
  * UI: handle null response from API properly. #6071
- Changes from 2.13.1
  + Bug fixes
  * Fix panic in ARM builds of Prometheus. #6110
  * promql: fix potential panic in the query logger. #6094
  * Multiple errors of http: superfluous response.WriteHeader call in the logs. #6145
- Changes from 2.13.0
  + Enhancements
  * Metrics: renamed prometheus_sd_configs_failed_total to prometheus_sd_failed_configs and changed to Gauge #5254
  * Include the tsdb tool in builds. #6089
  * Service discovery: add new node address types for kubernetes. #5902
  * UI: show warnings if query have returned some warnings. #5964
  * Remote write: reduce memory usage of the series cache. #5849
  * Remote read: use remote read streaming to reduce memory usage. #5703
  * Metrics: added metrics for remote write max/min/desired shards to queue manager. #5787
  * Promtool: show the warnings during label query. #5924
  * Promtool: improve error messages when parsing bad rules. #5965
  * Promtool: more promlint rules. #5515
  + Bug fixes
  * UI: Fix a Stored DOM XSS vulnerability with query history [CVE-2019-10215](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10215). #6098
  * Promtool: fix recording inconsistency due to duplicate labels. #6026
  * UI: fixes service-discovery view when accessed from unhealthy targets. #5915
  * Metrics format: OpenMetrics parser crashes on short input. #5939
  * UI: avoid truncated Y-axis values. #6014
- Changes from 2.12.0
  + Features
  * Track currently active PromQL queries in a log file. #5794
  * Enable and provide binaries for `mips64` / `mips64le` architectures. #5792
  + Enhancements
  * Improve responsiveness of targets web UI and API endpoint. #5740
  * Improve remote write desired shards calculation. #5763
  * Flush TSDB pages more precisely. tsdb#660
  * Add `prometheus_tsdb_retention_limit_bytes` metric. tsdb#667
  * Add logging during TSDB WAL replay on startup. tsdb#662
  * Improve TSDB memory usage. tsdb#653, tsdb#643, tsdb#654, tsdb#642, tsdb#627
  + Bug fixes
  * Check for duplicate label names in remote read. #5829
  * Mark deleted rules' series as stale on next evaluation. #5759
  * Fix JavaScript error when showing warning about out-of-sync server time. #5833
  * Fix `promtool test rules` panic when providing empty `exp_labels`. #5774
  * Only check last directory when discovering checkpoint number. #5756
  * Fix error propagation in WAL watcher helper functions. #5741
  * Correctly handle empty labels from alert templates. #5845</changelog>
  <changelog author="witold.bedyk@suse.com" date="1596196800">- Update 0003-Add-Uyuni-service-discovery.patch:
  + Add support for Prometheus exporters proxy</changelog>
  <changelog author="pseidensal@suse.com" date="1598875200">- Update package with changes from `server:monitoring` bsc#1175478
  Left out removal of firewalld related configuration files as SLE-15-SP1's
  `firewalld` package does not contain prometheus configuration yet.</changelog>
  <changelog author="stefano.torresi@suse.com" date="1604923200">- Update to upstream version 2.22.1
- Update packaging
  * Remove systemd and shadow hard requirements
  * use systemd-sysusers to configure the user in a dedicated 'system-user-prometheus' subpackage
  * add 'prometheus' package alias</changelog>
  <changelog author="witold.bedyk@suse.com" date="1615291200">- Uyuni: `hostname` label is now set to FQDN instead of IP
  + Changed:
  * 0003-Add-Uyuni-service-discovery.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1620129600">- Add tarball with vendor modules and web assets
- Uyuni: Read formula data from exporters map
- Uyuni: Add support for TLS targets
  + Changed:
  * 0003-Add-Uyuni-service-discovery.patch
  * 0002-Default-settings.patch Changed
  * 0003-Add-Uyuni-service-discovery.patch
- Upgrade to upstream version 2.26.0
  + Changes
  * Alerting: Using Alertmanager v2 API by default. #8626
  * Prometheus/Promtool: Binaries are now printing help and usage to stdout instead of stderr. #8542
  + Features
  * Remote: Add support for AWS SigV4 auth method for remote_write. #8509
  * PromQL: Allow negative offsets. Behind --enable-feature=promql-negative-offset flag. #8487
  * UI: Add advanced auto-completion, syntax highlighting and linting to graph page query input. #8634
  + Enhancements
  * PromQL: Add last_over_time, sgn, clamp functions. #8457
  * Scrape: Add support for specifying type of Authorization header credentials with Bearer by default. #8512
  * Scrape: Add follow_redirects option to scrape configuration. #8546
  * Remote: Allow retries on HTTP 429 response code for remote_write. #8237 #8477
  * Remote: Allow configuring custom headers for remote_read. #8516
  * UI: Hitting Enter now triggers new query. #8581
  * UI: Better handling of long rule and names on the /rules and /targets pages. #8608 #8609
  * UI: Add collapse/expand all button on the /targets page. #8486
- Upgrade to upstream version 2.25.0
  + Features
  * Include a new `--enable-feature=` flag that enables experimental features.
  + Enhancements
  * Add optional name property to testgroup for better test failure output. #8440
  * Add warnings into React Panel on the Graph page. #8427
  * TSDB: Increase the number of buckets for the compaction duration metric. #8342
  * Remote: Allow passing along custom remote_write HTTP headers. #8416
  * Mixins: Scope grafana configuration. #8332
  * Kubernetes SD: Add endpoint labels metadata. #8273
  * UI: Expose total number of label pairs in head in TSDB stats page. #8343
  * TSDB: Reload blocks every minute, to detect new blocks and enforce retention more often. #8343
  + Bug fixes
  * API: Fix global URL when external address has no port. #8359
  * Deprecate unused flag --alertmanager.timeout. #8407
- Upgrade to upstream version 2.24.1
  + Enhancements
  * Cache basic authentication results to significantly improve performance of HTTP endpoints.
- Upgrade to upstream version 2.24.0
  + Features
  * Add TLS and basic authentication to HTTP endpoints. #8316
  * promtool: Add check web-config subcommand to check web config files. #8319
  * promtool: Add tsdb create-blocks-from openmetrics subcommand to backfill metrics data from an OpenMetrics file. #8084
  + Enhancements
  * HTTP API: Fast-fail queries with only empty matchers. #8288
  * HTTP API: Support matchers for labels API. #8301
  * promtool: Improve checking of URLs passed on the command line. #7956
  * SD: Expose IPv6 as a label in EC2 SD. #7086
  * SD: Reuse EC2 client, reducing frequency of requesting credentials. #8311
  * TSDB: Add logging when compaction takes more than the block time range. #8151
  * TSDB: Avoid unnecessary GC runs after compaction. #8276
- Upgrade to upstream version 2.23.0
  + Changes
  * UI: Make the React UI default. #8142
  * Remote write: The following metrics were removed/renamed in remote write. #6815
    &gt; prometheus_remote_storage_succeeded_samples_total was removed and prometheus_remote_storage_samples_total was introduced for all the samples attempted to send.
    &gt; prometheus_remote_storage_sent_bytes_total was removed and replaced with prometheus_remote_storage_samples_bytes_total and prometheus_remote_storage_metadata_bytes_total.
    &gt; prometheus_remote_storage_failed_samples_total -&gt; prometheus_remote_storage_samples_failed_total .
    &gt; prometheus_remote_storage_retried_samples_total -&gt; prometheus_remote_storage_samples_retried_total.
    &gt; prometheus_remote_storage_dropped_samples_total -&gt; prometheus_remote_storage_samples_dropped_total.
    &gt; prometheus_remote_storage_pending_samples -&gt; prometheus_remote_storage_samples_pending.
  * Remote: Do not collect non-initialized timestamp metrics. #8060
  + Enhancements
  * Remote write: Added a metric prometheus_remote_storage_max_samples_per_send for remote write. #8102
  * TSDB: Make the snapshot directory name always the same length. #8138
  * TSDB: Create a checkpoint only once at the end of all head compactions. #8067
  * TSDB: Avoid Series API from hitting the chunks. #8050
  * TSDB: Cache label name and last value when adding series during compactions making compactions faster. #8192
  * PromQL: Improved performance of Hash method making queries a bit faster. #8025
  * promtool: tsdb list now prints block sizes. #7993
  * promtool: Calculate mint and maxt per test avoiding unnecessary calculations. #8096
  * SD: Add filtering of services to Docker Swarm SD. #8074</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1621425600">- Refresh patches
  + Changed:
  * 0001-Do-not-force-the-pure-Go-name-resolver.patch
  * 0002-Default-settings.patch
  * 0003-Add-Uyuni-service-discovery.patch
- Upgrade to upstream version 2.27.1 (jsc#SLE-18254)
  + Bugfix:
  * SECURITY: Fix arbitrary redirects under the /new endpoint (CVE-2021-29622, bsc#1186242)
- Upgrade to upstream version 2.27.0
  + Features:
  * Promtool: Retroactive rule evaluation functionality. #7675
  * Configuration: Environment variable expansion for external labels. Behind --enable-feature=expand-external-labels flag. #8649
  * TSDB: Add a flag(--storage.tsdb.max-block-chunk-segment-size) to control the max chunks file size of the blocks for small Prometheus instances. #8478
  * UI: Add a dark theme. #8604
  * AWS Lightsail Discovery: Add AWS Lightsail Discovery. #8693
  * Docker Discovery: Add Docker Service Discovery. #8629
  * OAuth: Allow OAuth 2.0 to be used anywhere an HTTP client is used. #8761
  * Remote Write: Send exemplars via remote write. Experimental and disabled by default. #8296
  + Enhancements:
  * Digital Ocean Discovery: Add __meta_digitalocean_vpc label. #8642
  * Scaleway Discovery: Read Scaleway secret from a file. #8643
  * Scrape: Add configurable limits for label size and count. #8777
  * UI: Add 16w and 26w time range steps. #8656
  * Templating: Enable parsing strings in humanize functions. #8682
  + Bugfixes:
  * UI: Provide errors instead of blank page on TSDB Status Page. #8654 #8659
  * TSDB: Do not panic when writing very large records to the WAL. #8790
  * TSDB: Avoid panic when mmaped memory is referenced after the file is closed. #8723
  * Scaleway Discovery: Fix nil pointer dereference. #8737
  * Consul Discovery: Restart no longer required after config update with no targets. #8766</changelog>
  <changelog author="witold.bedyk@suse.com" date="1625745600">- Provide and reload firewalld configuration only for:
  + openSUSE Leap 15.0, 15.1, 15.2
  + SUSE SLE15, SLE15 SP1, SLE15 SP2</changelog>
  <changelog author="jsegitz@suse.com" date="1632139200">- Added hardening to systemd service(s) (bsc#1181400). Modified:
  * prometheus.service</changelog>
  <changelog author="witold.bedyk@suse.com" date="1642593600">- Updated patches:
  + Changed:
  * 0002-Default-settings.patch
  + Removed:
  * 0003-Add-Uyuni-service-discovery.patch
- Use obs-service-go_modules
- Upgrade to upstream version 2.32.1 (jsc#SLE-22863)
  + Bugfixes:
  * Scrape: Fix reporting metrics when sample limit is reached
    during the report. #9996
  * Scrape: Ensure that scrape interval and scrape timeout are
    always set. #10023
  * TSDB: Expose and fix bug in iterators' Seek() method. #10030
- Upgrade to upstream version 2.32.0
  + Change:
  * remote-write: Change default max retry time from 100ms to
    5 seconds. #9634
  + Features:
  * Agent: New mode of operation optimized for remote-write only
    scenarios, without local storage.
  * Promtool: Add promtool check service-discovery command. #8970
  + Enhancements:
  * Promtool: Improve test output. #8064
  * Promtool: Use kahan summation for better numerical stability.
  * Remote-write: Reuse memory for marshalling. #9412
  * Scrape: Add scrape_body_size_bytes scrape metric behind the
  - -enable-feature=extra-scrape-metrics flag. #9569
  * TSDB: Add windows arm64 support. #9703
  * TSDB: Optimize query by skipping unneeded sorting in TSDB.
  * Templates: Support int and uint as datatypes for template
    formatting. #9680
  * UI: Prefer rate over rad, delta over deg, and count over cos
    in autocomplete. #9688
  + Bugfixes:
  * TSDB: Add more size checks when writing individual sections
    in the index. #9710
  * PromQL: Make deriv() return zero values for constant series.
  * TSDB: Fix panic when checkpoint directory is empty. #9687
  * TSDB: Fix panic, out of order chunks, and race warning during
    WAL replay. #9856
  * UI: Correctly render links for targets with IPv6 addresses
    that contain a Zone ID. #9853
  * Promtool: Fix checking of authorization.credentials_file and
    bearer_token_file fields. #9883
  * Uyuni SD: Fix null pointer exception during initialization.
  * TSDB: Fix queries after a failed snapshot replay. #9980
- Upgrade to upstream version 2.31.1
  + Bugfix:
  * SD: Fix a panic when the experimental discovery manager
    receives targets during a reload. #9656
- Upgrade to upstream version 2.31.0
  + Change:
  * UI: Remove standard PromQL editor in favour of the
    codemirror-based editor. #9452
  + Features:
  * PromQL: Add trigonometric functions and atan2 binary
    operator. #9239 #9248 #9515
  * Remote: Add support for exemplar in the remote write receiver
    endpoint. #9319 #9414
  * SD: Add PuppetDB service discovery. #8883
  * SD: Add Uyuni service discovery. #8190
  * Web: Add support for security-related HTTP headers. #9546
  + Enhancements:
  * Azure SD: Add proxy_url, follow_redirects, tls_config. #9267
  * Backfill: Add --max-block-duration in promtool
    create-blocks-from rules. #9511
  * Config: Print human-readable sizes with unit instead of raw
    numbers. #9361
  * HTTP: Re-enable HTTP/2. #9398
  * Kubernetes SD: Warn user if number of endpoints exceeds
    limit. #9467
  * OAuth2: Add TLS configuration to token requests. #9550
  * PromQL: Several optimizations. #9365 #9360 #9362 #9552
  * PromQL: Make aggregations deterministic in instant queries.
  * Rules: Add the ability to limit number of alerts or series.
  * SD: Experimental discovery manager to avoid restarts upon
    reload.
  * UI: Debounce timerange setting changes. #9359
  + Bugfixes:
  * Backfill: Apply rule labels after query labels. #9421
  * Scrape: Resolve conflicts between multiple exported label
    prefixes. #9479 #9518
  * Scrape: Restart scrape loops when __scrape_interval__ is
    changed. #9551
  * TSDB: Fix memory leak in samples deletion. #9151
  * UI: Use consistent margin-bottom for all alert kinds. #9318
- Upgrade to upstream version 2.30.3
  + Bugfixes:
  * TSDB: Fix panic on failed snapshot replay. #9438
  * TSDB: Don't fail snapshot replay with exemplar storage
    disabled when the snapshot contains exemplars. #9438
- Upgrade to upstream version 2.30.2
  + Bugfix:
  * TSDB: Don't error on overlapping m-mapped chunks during WAL
    replay. #9381
- Upgrade to upstream version 2.30.1
  + Enhancements:
  * Remote Write: Redact remote write URL when used for metric
    label. #9383
  * UI: Redact remote write URL and proxy URL passwords in the
    /config page. #9408
  + Bugfixes:
  * promtool rules backfill: Prevent creation of data before the
    start time. #9339
  * promtool rules backfill: Do not query after the end time.
  * Azure SD: Fix panic when no computername is set. #9387
- Upgrade to upstream version 2.30.0
  + Features:
  * experimental TSDB: Snapshot in-memory chunks on shutdown for
    faster restarts. #7229
  * experimental Scrape: Configure scrape interval and scrape
    timeout via relabeling using __scrape_interval__ and
    __scrape_timeout__ labels respectively. #8911
  * Scrape: Add scrape_timeout_seconds and scrape_sample_limit
    metric. #9247 #9295
  + Enhancements:
  * Scrape: Add --scrape.timestamp-tolerance flag to adjust
    scrape timestamp tolerance when enabled via
  - -scrape.adjust-timestamps. #9283
  * Remote Write: Improve throughput when sending exemplars.
  * TSDB: Optimise WAL loading by removing extra map and caching
    min-time #9160
  * promtool: Speed up checking for duplicate rules. #9262/#9306
  * Scrape: Reduce allocations when parsing the metrics. #9299
  * docker_sd: Support host network mode #9125
  + Bugfixes:
  * Exemplars: Fix panic when resizing exemplar storage from 0 to
    a non-zero size. #9286
  * TSDB: Correctly decrement
    prometheus_tsdb_head_active_appenders when the append has no
    samples. #9230
  * promtool rules backfill: Return 1 if backfill was
    unsuccessful. #9303
  * promtool rules backfill: Avoid creation of overlapping
    blocks. #9324
  * config: Fix a panic when reloading configuration with a null
    relabel action. #9224
- Upgrade to upstream version 2.29.2
  + Bugfixes:
  * Fix Kubernetes SD failing to discover Ingress in
    Kubernetes v1.22. #9205
  * Fix data race in loading write-ahead-log (WAL). #9259
- Upgrade to upstream version 2.29.1
  + Bugfixes:
  * TSDB: align atomically accessed int64 to prevent panic in
    32-bit archs. #9192
- Upgrade to upstream version 2.29.0
  + Changes:
  * Promote --storage.tsdb.allow-overlapping-blocks flag to
    stable. #9117
  * Promote --storage.tsdb.retention.size flag to stable. #9004
  + Features:
  * Add Kuma service discovery. #8844
  * Add present_over_time PromQL function. #9097
  * Allow configuring exemplar storage via file and make it
    reloadable. #8974
  * UI: Allow selecting time range with mouse drag. #8977
  * promtool: Add feature flags flag --enable-feature. #8958
  * promtool: Add file_sd file validation. #8950
  + Enhancements:
  * Reduce blocking of outgoing remote write requests from series
    garbage collection. #9109
  * Improve write-ahead-log decoding performance. #9106
  * Improve append performance in TSDB by reducing mutexes usage.
  * Allow configuring max_samples_per_send for remote write
    metadata. #8959
  * Add __meta_gce_interface_ipv4_&lt;name&gt; meta label to GCE
    discovery. #8978
  * Add __meta_ec2_availability_zone_id meta label to EC2
    discovery. #8896
  * Add __meta_azure_machine_computer_name meta label to Azure
    discovery. #9112
  * Add __meta_hetzner_hcloud_labelpresent_&lt;labelname&gt; meta label
    to Hetzner discovery. #9028
  * promtool: Add compaction efficiency to promtool tsdb analyze
    reports. #8940
  * promtool: Allow configuring max block duration for
    backfilling via --max-block-duration flag. #8919
  * UI: Add sorting and filtering to flags page. #8988
  * UI: Improve alerts page rendering performance. #9005
  + Bugfixes:
  * Log when total symbol size exceeds 2^32 bytes, causing
    compaction to fail, and skip compaction. #9104
  * Fix incorrect target_limit reloading of zero value. #9120
  * Fix head GC and pending readers race condition. #9081
  * Fix timestamp handling in OpenMetrics parser. #9008
  * Fix potential duplicate metrics in /federate endpoint when
    specifying multiple matchers. #8885
  * Fix server configuration and validation for authentication
    via client cert. #9123
  * Allow start and end again as label names in PromQL queries.
    They were disallowed since the introduction of @ timestamp
    feature. #9119
- Upgrade to upstream version 2.28.1
  + Bugfixes:
  * HTTP SD: Allow charset specification in Content-Type header.
  * HTTP SD: Fix handling of disappeared target groups. #9019
  * Fix incorrect log-level handling after moving to go-kit/log.
- Upgrade to upstream version 2.28.0
  + Change:
  * UI: Make the new experimental PromQL editor the default.
  + Features:
  * Linode SD: Add Linode service discovery. #8846
  * HTTP SD: Add generic HTTP-based service discovery. #8839
  * Kubernetes SD: Allow configuring API Server access via a
    kubeconfig file. #8811
  * UI: Add exemplar display support to the graphing interface.
  * Consul SD: Add namespace support for Consul Enterprise. #8900
  + Enhancements:
  * Promtool: Allow silencing output when importing / backfilling
    data. #8917
  * Consul SD: Support reading tokens from file. #8926
  * Rules: Add a new .ExternalURL alert field templating
    variable, containing the external URL of the Prometheus
    server. #8878
  * Scrape: Add experimental body_size_limit scrape configuration
    setting to limit the allowed response body size for target
    scrapes. #8833 #8886
  * Kubernetes SD: Add ingress class name label for ingress
    discovery. #8916
  * UI: Show a startup screen with progress bar when the TSDB is
    not ready yet. #8662 #8908 #8909 #8946
  * SD: Add a target creation failure counter
    prometheus_target_sync_failed_total and improve target
    creation failure handling. #8786
  * TSDB: Improve validation of exemplar label set length. #8816
  * TSDB: Add a prometheus_tsdb_clean_start metric that indicates
    whether a TSDB lockfile from a previous run still existed
    upon startup. #8824
  + Bugfixes:
  * UI: In the experimental PromQL editor, fix autocompletion and
    parsing for special float values and improve series metadata
    fetching. #8856
  * TSDB: When merging chunks, split resulting chunks if they
    would contain more than the maximum of 120 samples. #8582
  * SD: Fix the computation of the
    prometheus_sd_discovered_targets metric when using multiple
    service discoveries. #8828</changelog>
</package>
<package pkgid="f25fdd182eed8bbdc672c7e83500783c4e67e1e9dcd639339d63828436135b4c" name="golang-github-prometheus-prometheus" arch="src">
  <version epoch="0" ver="2.32.1" rel="4.3.2"/>
  <changelog author="asn@cryptomilk.org" date="1564574400">- Build with PIE
  + Added 0004-prometheus-buildmode-pie.patch</changelog>
  <changelog author="jan.fajerski@suse.com" date="1564747200">- Add network-online (Wants and After) dependency to systemd unit bsc#1143913</changelog>
  <changelog author="jan.fajerski@suse.com" date="1565956800">- remove 0004-prometheus-buildmode-pie.patch
  + this patch produces binaries that crash immediately
- add -v to promu build command for better build debugging
- reorder some %install tasks</changelog>
  <changelog author="mrostecki@opensuse.org" date="1569240000">- Do not install the firewalld config file on Tumbleweed (on
  versions newer than Leap 15.1). It's installed in the main
  firewalld package.</changelog>
  <changelog author="jcavalheiro@suse.com" date="1574251200">- Update Uyuni/SUSE Manager service discovery patch
  + Modified 0003-Add-Uyuni-service-discovery.patch
  + Fixes crashes when systems have no FQDN
  + Adds Parallel calls to Uyuni API, meaningful performance increase
  + Adds Support for system group labels</changelog>
  <changelog author="mrostecki@opensuse.org" date="1574251201">- Remove firewalld files. They are installed in the main firewalld
  package.</changelog>
  <changelog author="jan.fajerski@suse.com" date="1574337600">- Remove prometheus.firewall.xml source file</changelog>
  <changelog author="jcavalheiro@suse.com" date="1574683200">- Patch macros on spec file to support builds on SLE 12</changelog>
  <changelog author="witold.bedyk@suse.com" date="1580126400">- Update to Prometheus 2.11.2</changelog>
  <changelog author="jcavalheiro@suse.com" date="1589371200">- Update Uyuni/SUSE Manager service discovery patch
  + Modified 0003-Add-Uyuni-service-discovery.patch:
  + Adapt service discovery to the new Uyuni API endpoints
  + Modified spec file: force golang 1.12 to fix build issues in SLE15SP2</changelog>
  <changelog author="jcavalheiro@suse.com" date="1591185600">- Update change log and spec file
  + Modified spec file: default to golang 1.14 to avoid "have choice" build issues in OBS.
  + Rebase and update patches for version 2.18.0
  + Changed:
  * 0001-Do-not-force-the-pure-Go-name-resolver.patch
  * 0002-Default-settings.patch Changed
  * 0003-Add-Uyuni-service-discovery.patch
- Update to 2.18.0
  + Features
  * Tracing: Added experimental Jaeger support #7148
  + Changes
  * Federation: Only use local TSDB for federation (ignore remote read). #7096
  * Rules: `rule_evaluations_total` and `rule_evaluation_failures_total` have a `rule_group` label now. #7094
  + Enhancements
  * TSDB: Significantly reduce WAL size kept around after a block cut. #7098
  * Discovery: Add `architecture` meta label for EC2. #7000
  + Bug fixes
  * UI: Fixed wrong MinTime reported by /status. #7182
  * React UI: Fixed multiselect legend on OSX. #6880
  * Remote Write: Fixed blocked resharding edge case. #7122
  * Remote Write: Fixed remote write not updating on relabel configs change. #7073
- Changes from 2.17.2
  + Bug fixes
  * Federation: Register federation metrics #7081
  * PromQL: Fix panic in parser error handling #7132
  * Rules: Fix reloads hanging when deleting a rule group that is being evaluated #7138
  * TSDB: Fix a memory leak when prometheus starts with an empty TSDB WAL #7135
  * TSDB: Make isolation more robust to panics in web handlers #7129 #7136
- Changes from 2.17.1
  + Bug fixes
  * TSDB: Fix query performance regression that increased memory and CPU usage #7051
- Changes from 2.17.0
  + Features
  * TSDB: Support isolation #6841
  * This release implements isolation in TSDB. API queries and recording rules are
    guaranteed to only see full scrapes and full recording rules. This comes with a
    certain overhead in resource usage. Depending on the situation, there might be
    some increase in memory usage, CPU usage, or query latency.
  + Enhancements
  * PromQL: Allow more keywords as metric names #6933
  * React UI: Add normalization of localhost URLs in targets page #6794
  * Remote read: Read from remote storage concurrently #6770
  * Rules: Mark deleted rule series as stale after a reload #6745
  * Scrape: Log scrape append failures as debug rather than warn #6852
  * TSDB: Improve query performance for queries that partially hit the head #6676
  * Consul SD: Expose service health as meta label #5313
  * EC2 SD: Expose EC2 instance lifecycle as meta label #6914
  * Kubernetes SD: Expose service type as meta label for K8s service role #6684
  * Kubernetes SD: Expose label_selector and field_selector #6807
  * Openstack SD: Expose hypervisor id as meta label #6962
  + Bug fixes
  * PromQL: Do not escape HTML-like chars in query log #6834 #6795
  * React UI: Fix data table matrix values #6896
  * React UI: Fix new targets page not loading when using non-ASCII characters #6892
  * Remote read: Fix duplication of metrics read from remote storage with external labels #6967 #7018
  * Remote write: Register WAL watcher and live reader metrics for all remotes, not just the first one #6998
  * Scrape: Prevent removal of metric names upon relabeling #6891
  * Scrape: Fix 'superfluous response.WriteHeader call' errors when scrape fails under some circonstances #6986
  * Scrape: Fix crash when reloads are separated by two scrape intervals #7011
- Changes from 2.16.0
  + Features
  * React UI: Support local timezone on /graph #6692
  * PromQL: add absent_over_time query function #6490
  * Adding optional logging of queries to their own file #6520
  + Enhancements
  * React UI: Add support for rules page and "Xs ago" duration displays #6503
  * React UI: alerts page, replace filtering togglers tabs with checkboxes #6543
  * TSDB: Export metric for WAL write errors #6647
  * TSDB: Improve query performance for queries that only touch the most recent 2h of data. #6651
  * PromQL: Refactoring in parser errors to improve error messages #6634
  * PromQL: Support trailing commas in grouping opts #6480
  * Scrape: Reduce memory usage on reloads by reusing scrape cache #6670
  * Scrape: Add metrics to track bytes and entries in the metadata cache #6675
  * promtool: Add support for line-column numbers for invalid rules output #6533
  * Avoid restarting rule groups when it is unnecessary #6450
  + Bug fixes
  * React UI: Send cookies on fetch() on older browsers #6553
  * React UI: adopt grafana flot fix for stacked graphs #6603
  * React UI: broken graph page browser history so that back button works as expected #6659
  * TSDB: ensure compactionsSkipped metric is registered, and log proper error if one is returned from head.Init #6616
  * TSDB: return an error on ingesting series with duplicate labels #6664
  * PromQL: Fix unary operator precedence #6579
  * PromQL: Respect query.timeout even when we reach query.max-concurrency #6712
  * PromQL: Fix string and parentheses handling in engine, which affected React UI #6612
  * PromQL: Remove output labels returned by absent() if they are produced by multiple identical label matchers #6493
  * Scrape: Validate that OpenMetrics input ends with `# EOF` #6505
  * Remote read: return the correct error if configs can't be marshal'd to JSON #6622
  * Remote write: Make remote client `Store` use passed context, which can affect shutdown timing #6673
  * Remote write: Improve sharding calculation in cases where we would always be consistently behind by tracking pendingSamples #6511
  * Ensure prometheus_rule_group metrics are deleted when a rule group is removed #6693
- Changes from 2.15.2
  + Bug fixes
  * TSDB: Fixed support for TSDB blocks built with Prometheus before 2.1.0. #6564
  * TSDB: Fixed block compaction issues on Windows. #6547
- Changes from 2.15.1
  + Bug fixes
  * TSDB: Fixed race on concurrent queries against same data. #6512
- Changes from 2.15.0
  + Features
  * API: Added new endpoint for exposing per metric metadata `/metadata`. #6420 #6442
  + Changes
  * Discovery: Removed `prometheus_sd_kubernetes_cache_*` metrics. Additionally `prometheus_sd_kubernetes_workqueue_latency_seconds` and `prometheus_sd_kubernetes_workqueue_work_duration_seconds` metrics now show correct values in seconds. #6393
  * Remote write: Changed `query` label on `prometheus_remote_storage_*` metrics to `remote_name` and `url`. #6043
  + Enhancements
  * TSDB: Significantly reduced memory footprint of loaded TSDB blocks. #6418 #6461
  * TSDB: Significantly optimized what we buffer during compaction which should result in lower memory footprint during compaction. #6422 #6452 #6468 #6475
  * TSDB: Improve replay latency. #6230
  * TSDB: WAL size is now used for size based retention calculation. #5886
  * Remote read: Added query grouping and range hints to the remote read request #6401
  * Remote write: Added `prometheus_remote_storage_sent_bytes_total` counter per queue. #6344
  * promql: Improved PromQL parser performance. #6356
  * React UI: Implemented missing pages like `/targets` #6276, TSDB status page #6281 #6267 and many other fixes and performance improvements.
  * promql: Prometheus now accepts spaces between time range and square bracket. e.g `[ 5m]` #6065
  + Bug fixes
  * Config: Fixed alertmanager configuration to not miss targets when configurations are similar. #6455
  * Remote write: Value of `prometheus_remote_storage_shards_desired` gauge shows raw value of desired shards and it's updated correctly. #6378
  * Rules: Prometheus now fails the evaluation of rules and alerts where metric results collide with labels specified in `labels` field. #6469
  * API: Targets Metadata API `/targets/metadata` now accepts empty `match_targets` parameter as in the spec. #6303
- Changes from 2.14.0
  + Features
  * API: `/api/v1/status/runtimeinfo` and `/api/v1/status/buildinfo` endpoints added for use by the React UI. #6243
  * React UI: implement the new experimental React based UI. #5694 and many more
  * Can be found by under `/new`.
  * Not all pages are implemented yet.
  * Status: Cardinality statistics added to the Runtime &amp; Build Information page. #6125
  + Enhancements
  * Remote write: fix delays in remote write after a compaction. #6021
  * UI: Alerts can be filtered by state. #5758
  + Bug fixes
  * Ensure warnings from the API are escaped. #6279
  * API: lifecycle endpoints return 403 when not enabled. #6057
  * Build: Fix Solaris build. #6149
  * Promtool: Remove false duplicate rule warnings when checking rule files with alerts. #6270
  * Remote write: restore use of deduplicating logger in remote write. #6113
  * Remote write: do not reshard when unable to send samples. #6111
  * Service discovery: errors are no longer logged on context cancellation. #6116, #6133
  * UI: handle null response from API properly. #6071
- Changes from 2.13.1
  + Bug fixes
  * Fix panic in ARM builds of Prometheus. #6110
  * promql: fix potential panic in the query logger. #6094
  * Multiple errors of http: superfluous response.WriteHeader call in the logs. #6145
- Changes from 2.13.0
  + Enhancements
  * Metrics: renamed prometheus_sd_configs_failed_total to prometheus_sd_failed_configs and changed to Gauge #5254
  * Include the tsdb tool in builds. #6089
  * Service discovery: add new node address types for kubernetes. #5902
  * UI: show warnings if query have returned some warnings. #5964
  * Remote write: reduce memory usage of the series cache. #5849
  * Remote read: use remote read streaming to reduce memory usage. #5703
  * Metrics: added metrics for remote write max/min/desired shards to queue manager. #5787
  * Promtool: show the warnings during label query. #5924
  * Promtool: improve error messages when parsing bad rules. #5965
  * Promtool: more promlint rules. #5515
  + Bug fixes
  * UI: Fix a Stored DOM XSS vulnerability with query history [CVE-2019-10215](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10215). #6098
  * Promtool: fix recording inconsistency due to duplicate labels. #6026
  * UI: fixes service-discovery view when accessed from unhealthy targets. #5915
  * Metrics format: OpenMetrics parser crashes on short input. #5939
  * UI: avoid truncated Y-axis values. #6014
- Changes from 2.12.0
  + Features
  * Track currently active PromQL queries in a log file. #5794
  * Enable and provide binaries for `mips64` / `mips64le` architectures. #5792
  + Enhancements
  * Improve responsiveness of targets web UI and API endpoint. #5740
  * Improve remote write desired shards calculation. #5763
  * Flush TSDB pages more precisely. tsdb#660
  * Add `prometheus_tsdb_retention_limit_bytes` metric. tsdb#667
  * Add logging during TSDB WAL replay on startup. tsdb#662
  * Improve TSDB memory usage. tsdb#653, tsdb#643, tsdb#654, tsdb#642, tsdb#627
  + Bug fixes
  * Check for duplicate label names in remote read. #5829
  * Mark deleted rules' series as stale on next evaluation. #5759
  * Fix JavaScript error when showing warning about out-of-sync server time. #5833
  * Fix `promtool test rules` panic when providing empty `exp_labels`. #5774
  * Only check last directory when discovering checkpoint number. #5756
  * Fix error propagation in WAL watcher helper functions. #5741
  * Correctly handle empty labels from alert templates. #5845</changelog>
  <changelog author="witold.bedyk@suse.com" date="1596196800">- Update 0003-Add-Uyuni-service-discovery.patch:
  + Add support for Prometheus exporters proxy</changelog>
  <changelog author="pseidensal@suse.com" date="1598875200">- Update package with changes from `server:monitoring` bsc#1175478
  Left out removal of firewalld related configuration files as SLE-15-SP1's
  `firewalld` package does not contain prometheus configuration yet.</changelog>
  <changelog author="stefano.torresi@suse.com" date="1604923200">- Update to upstream version 2.22.1
- Update packaging
  * Remove systemd and shadow hard requirements
  * use systemd-sysusers to configure the user in a dedicated 'system-user-prometheus' subpackage
  * add 'prometheus' package alias</changelog>
  <changelog author="witold.bedyk@suse.com" date="1615291200">- Uyuni: `hostname` label is now set to FQDN instead of IP
  + Changed:
  * 0003-Add-Uyuni-service-discovery.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1620129600">- Add tarball with vendor modules and web assets
- Uyuni: Read formula data from exporters map
- Uyuni: Add support for TLS targets
  + Changed:
  * 0003-Add-Uyuni-service-discovery.patch
  * 0002-Default-settings.patch Changed
  * 0003-Add-Uyuni-service-discovery.patch
- Upgrade to upstream version 2.26.0
  + Changes
  * Alerting: Using Alertmanager v2 API by default. #8626
  * Prometheus/Promtool: Binaries are now printing help and usage to stdout instead of stderr. #8542
  + Features
  * Remote: Add support for AWS SigV4 auth method for remote_write. #8509
  * PromQL: Allow negative offsets. Behind --enable-feature=promql-negative-offset flag. #8487
  * UI: Add advanced auto-completion, syntax highlighting and linting to graph page query input. #8634
  + Enhancements
  * PromQL: Add last_over_time, sgn, clamp functions. #8457
  * Scrape: Add support for specifying type of Authorization header credentials with Bearer by default. #8512
  * Scrape: Add follow_redirects option to scrape configuration. #8546
  * Remote: Allow retries on HTTP 429 response code for remote_write. #8237 #8477
  * Remote: Allow configuring custom headers for remote_read. #8516
  * UI: Hitting Enter now triggers new query. #8581
  * UI: Better handling of long rule and names on the /rules and /targets pages. #8608 #8609
  * UI: Add collapse/expand all button on the /targets page. #8486
- Upgrade to upstream version 2.25.0
  + Features
  * Include a new `--enable-feature=` flag that enables experimental features.
  + Enhancements
  * Add optional name property to testgroup for better test failure output. #8440
  * Add warnings into React Panel on the Graph page. #8427
  * TSDB: Increase the number of buckets for the compaction duration metric. #8342
  * Remote: Allow passing along custom remote_write HTTP headers. #8416
  * Mixins: Scope grafana configuration. #8332
  * Kubernetes SD: Add endpoint labels metadata. #8273
  * UI: Expose total number of label pairs in head in TSDB stats page. #8343
  * TSDB: Reload blocks every minute, to detect new blocks and enforce retention more often. #8343
  + Bug fixes
  * API: Fix global URL when external address has no port. #8359
  * Deprecate unused flag --alertmanager.timeout. #8407
- Upgrade to upstream version 2.24.1
  + Enhancements
  * Cache basic authentication results to significantly improve performance of HTTP endpoints.
- Upgrade to upstream version 2.24.0
  + Features
  * Add TLS and basic authentication to HTTP endpoints. #8316
  * promtool: Add check web-config subcommand to check web config files. #8319
  * promtool: Add tsdb create-blocks-from openmetrics subcommand to backfill metrics data from an OpenMetrics file. #8084
  + Enhancements
  * HTTP API: Fast-fail queries with only empty matchers. #8288
  * HTTP API: Support matchers for labels API. #8301
  * promtool: Improve checking of URLs passed on the command line. #7956
  * SD: Expose IPv6 as a label in EC2 SD. #7086
  * SD: Reuse EC2 client, reducing frequency of requesting credentials. #8311
  * TSDB: Add logging when compaction takes more than the block time range. #8151
  * TSDB: Avoid unnecessary GC runs after compaction. #8276
- Upgrade to upstream version 2.23.0
  + Changes
  * UI: Make the React UI default. #8142
  * Remote write: The following metrics were removed/renamed in remote write. #6815
    &gt; prometheus_remote_storage_succeeded_samples_total was removed and prometheus_remote_storage_samples_total was introduced for all the samples attempted to send.
    &gt; prometheus_remote_storage_sent_bytes_total was removed and replaced with prometheus_remote_storage_samples_bytes_total and prometheus_remote_storage_metadata_bytes_total.
    &gt; prometheus_remote_storage_failed_samples_total -&gt; prometheus_remote_storage_samples_failed_total .
    &gt; prometheus_remote_storage_retried_samples_total -&gt; prometheus_remote_storage_samples_retried_total.
    &gt; prometheus_remote_storage_dropped_samples_total -&gt; prometheus_remote_storage_samples_dropped_total.
    &gt; prometheus_remote_storage_pending_samples -&gt; prometheus_remote_storage_samples_pending.
  * Remote: Do not collect non-initialized timestamp metrics. #8060
  + Enhancements
  * Remote write: Added a metric prometheus_remote_storage_max_samples_per_send for remote write. #8102
  * TSDB: Make the snapshot directory name always the same length. #8138
  * TSDB: Create a checkpoint only once at the end of all head compactions. #8067
  * TSDB: Avoid Series API from hitting the chunks. #8050
  * TSDB: Cache label name and last value when adding series during compactions making compactions faster. #8192
  * PromQL: Improved performance of Hash method making queries a bit faster. #8025
  * promtool: tsdb list now prints block sizes. #7993
  * promtool: Calculate mint and maxt per test avoiding unnecessary calculations. #8096
  * SD: Add filtering of services to Docker Swarm SD. #8074</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1621425600">- Refresh patches
  + Changed:
  * 0001-Do-not-force-the-pure-Go-name-resolver.patch
  * 0002-Default-settings.patch
  * 0003-Add-Uyuni-service-discovery.patch
- Upgrade to upstream version 2.27.1 (jsc#SLE-18254)
  + Bugfix:
  * SECURITY: Fix arbitrary redirects under the /new endpoint (CVE-2021-29622, bsc#1186242)
- Upgrade to upstream version 2.27.0
  + Features:
  * Promtool: Retroactive rule evaluation functionality. #7675
  * Configuration: Environment variable expansion for external labels. Behind --enable-feature=expand-external-labels flag. #8649
  * TSDB: Add a flag(--storage.tsdb.max-block-chunk-segment-size) to control the max chunks file size of the blocks for small Prometheus instances. #8478
  * UI: Add a dark theme. #8604
  * AWS Lightsail Discovery: Add AWS Lightsail Discovery. #8693
  * Docker Discovery: Add Docker Service Discovery. #8629
  * OAuth: Allow OAuth 2.0 to be used anywhere an HTTP client is used. #8761
  * Remote Write: Send exemplars via remote write. Experimental and disabled by default. #8296
  + Enhancements:
  * Digital Ocean Discovery: Add __meta_digitalocean_vpc label. #8642
  * Scaleway Discovery: Read Scaleway secret from a file. #8643
  * Scrape: Add configurable limits for label size and count. #8777
  * UI: Add 16w and 26w time range steps. #8656
  * Templating: Enable parsing strings in humanize functions. #8682
  + Bugfixes:
  * UI: Provide errors instead of blank page on TSDB Status Page. #8654 #8659
  * TSDB: Do not panic when writing very large records to the WAL. #8790
  * TSDB: Avoid panic when mmaped memory is referenced after the file is closed. #8723
  * Scaleway Discovery: Fix nil pointer dereference. #8737
  * Consul Discovery: Restart no longer required after config update with no targets. #8766</changelog>
  <changelog author="witold.bedyk@suse.com" date="1625745600">- Provide and reload firewalld configuration only for:
  + openSUSE Leap 15.0, 15.1, 15.2
  + SUSE SLE15, SLE15 SP1, SLE15 SP2</changelog>
  <changelog author="jsegitz@suse.com" date="1632139200">- Added hardening to systemd service(s) (bsc#1181400). Modified:
  * prometheus.service</changelog>
  <changelog author="witold.bedyk@suse.com" date="1642593600">- Updated patches:
  + Changed:
  * 0002-Default-settings.patch
  + Removed:
  * 0003-Add-Uyuni-service-discovery.patch
- Use obs-service-go_modules
- Upgrade to upstream version 2.32.1 (jsc#SLE-22863)
  + Bugfixes:
  * Scrape: Fix reporting metrics when sample limit is reached
    during the report. #9996
  * Scrape: Ensure that scrape interval and scrape timeout are
    always set. #10023
  * TSDB: Expose and fix bug in iterators' Seek() method. #10030
- Upgrade to upstream version 2.32.0
  + Change:
  * remote-write: Change default max retry time from 100ms to
    5 seconds. #9634
  + Features:
  * Agent: New mode of operation optimized for remote-write only
    scenarios, without local storage.
  * Promtool: Add promtool check service-discovery command. #8970
  + Enhancements:
  * Promtool: Improve test output. #8064
  * Promtool: Use kahan summation for better numerical stability.
  * Remote-write: Reuse memory for marshalling. #9412
  * Scrape: Add scrape_body_size_bytes scrape metric behind the
  - -enable-feature=extra-scrape-metrics flag. #9569
  * TSDB: Add windows arm64 support. #9703
  * TSDB: Optimize query by skipping unneeded sorting in TSDB.
  * Templates: Support int and uint as datatypes for template
    formatting. #9680
  * UI: Prefer rate over rad, delta over deg, and count over cos
    in autocomplete. #9688
  + Bugfixes:
  * TSDB: Add more size checks when writing individual sections
    in the index. #9710
  * PromQL: Make deriv() return zero values for constant series.
  * TSDB: Fix panic when checkpoint directory is empty. #9687
  * TSDB: Fix panic, out of order chunks, and race warning during
    WAL replay. #9856
  * UI: Correctly render links for targets with IPv6 addresses
    that contain a Zone ID. #9853
  * Promtool: Fix checking of authorization.credentials_file and
    bearer_token_file fields. #9883
  * Uyuni SD: Fix null pointer exception during initialization.
  * TSDB: Fix queries after a failed snapshot replay. #9980
- Upgrade to upstream version 2.31.1
  + Bugfix:
  * SD: Fix a panic when the experimental discovery manager
    receives targets during a reload. #9656
- Upgrade to upstream version 2.31.0
  + Change:
  * UI: Remove standard PromQL editor in favour of the
    codemirror-based editor. #9452
  + Features:
  * PromQL: Add trigonometric functions and atan2 binary
    operator. #9239 #9248 #9515
  * Remote: Add support for exemplar in the remote write receiver
    endpoint. #9319 #9414
  * SD: Add PuppetDB service discovery. #8883
  * SD: Add Uyuni service discovery. #8190
  * Web: Add support for security-related HTTP headers. #9546
  + Enhancements:
  * Azure SD: Add proxy_url, follow_redirects, tls_config. #9267
  * Backfill: Add --max-block-duration in promtool
    create-blocks-from rules. #9511
  * Config: Print human-readable sizes with unit instead of raw
    numbers. #9361
  * HTTP: Re-enable HTTP/2. #9398
  * Kubernetes SD: Warn user if number of endpoints exceeds
    limit. #9467
  * OAuth2: Add TLS configuration to token requests. #9550
  * PromQL: Several optimizations. #9365 #9360 #9362 #9552
  * PromQL: Make aggregations deterministic in instant queries.
  * Rules: Add the ability to limit number of alerts or series.
  * SD: Experimental discovery manager to avoid restarts upon
    reload.
  * UI: Debounce timerange setting changes. #9359
  + Bugfixes:
  * Backfill: Apply rule labels after query labels. #9421
  * Scrape: Resolve conflicts between multiple exported label
    prefixes. #9479 #9518
  * Scrape: Restart scrape loops when __scrape_interval__ is
    changed. #9551
  * TSDB: Fix memory leak in samples deletion. #9151
  * UI: Use consistent margin-bottom for all alert kinds. #9318
- Upgrade to upstream version 2.30.3
  + Bugfixes:
  * TSDB: Fix panic on failed snapshot replay. #9438
  * TSDB: Don't fail snapshot replay with exemplar storage
    disabled when the snapshot contains exemplars. #9438
- Upgrade to upstream version 2.30.2
  + Bugfix:
  * TSDB: Don't error on overlapping m-mapped chunks during WAL
    replay. #9381
- Upgrade to upstream version 2.30.1
  + Enhancements:
  * Remote Write: Redact remote write URL when used for metric
    label. #9383
  * UI: Redact remote write URL and proxy URL passwords in the
    /config page. #9408
  + Bugfixes:
  * promtool rules backfill: Prevent creation of data before the
    start time. #9339
  * promtool rules backfill: Do not query after the end time.
  * Azure SD: Fix panic when no computername is set. #9387
- Upgrade to upstream version 2.30.0
  + Features:
  * experimental TSDB: Snapshot in-memory chunks on shutdown for
    faster restarts. #7229
  * experimental Scrape: Configure scrape interval and scrape
    timeout via relabeling using __scrape_interval__ and
    __scrape_timeout__ labels respectively. #8911
  * Scrape: Add scrape_timeout_seconds and scrape_sample_limit
    metric. #9247 #9295
  + Enhancements:
  * Scrape: Add --scrape.timestamp-tolerance flag to adjust
    scrape timestamp tolerance when enabled via
  - -scrape.adjust-timestamps. #9283
  * Remote Write: Improve throughput when sending exemplars.
  * TSDB: Optimise WAL loading by removing extra map and caching
    min-time #9160
  * promtool: Speed up checking for duplicate rules. #9262/#9306
  * Scrape: Reduce allocations when parsing the metrics. #9299
  * docker_sd: Support host network mode #9125
  + Bugfixes:
  * Exemplars: Fix panic when resizing exemplar storage from 0 to
    a non-zero size. #9286
  * TSDB: Correctly decrement
    prometheus_tsdb_head_active_appenders when the append has no
    samples. #9230
  * promtool rules backfill: Return 1 if backfill was
    unsuccessful. #9303
  * promtool rules backfill: Avoid creation of overlapping
    blocks. #9324
  * config: Fix a panic when reloading configuration with a null
    relabel action. #9224
- Upgrade to upstream version 2.29.2
  + Bugfixes:
  * Fix Kubernetes SD failing to discover Ingress in
    Kubernetes v1.22. #9205
  * Fix data race in loading write-ahead-log (WAL). #9259
- Upgrade to upstream version 2.29.1
  + Bugfixes:
  * TSDB: align atomically accessed int64 to prevent panic in
    32-bit archs. #9192
- Upgrade to upstream version 2.29.0
  + Changes:
  * Promote --storage.tsdb.allow-overlapping-blocks flag to
    stable. #9117
  * Promote --storage.tsdb.retention.size flag to stable. #9004
  + Features:
  * Add Kuma service discovery. #8844
  * Add present_over_time PromQL function. #9097
  * Allow configuring exemplar storage via file and make it
    reloadable. #8974
  * UI: Allow selecting time range with mouse drag. #8977
  * promtool: Add feature flags flag --enable-feature. #8958
  * promtool: Add file_sd file validation. #8950
  + Enhancements:
  * Reduce blocking of outgoing remote write requests from series
    garbage collection. #9109
  * Improve write-ahead-log decoding performance. #9106
  * Improve append performance in TSDB by reducing mutexes usage.
  * Allow configuring max_samples_per_send for remote write
    metadata. #8959
  * Add __meta_gce_interface_ipv4_&lt;name&gt; meta label to GCE
    discovery. #8978
  * Add __meta_ec2_availability_zone_id meta label to EC2
    discovery. #8896
  * Add __meta_azure_machine_computer_name meta label to Azure
    discovery. #9112
  * Add __meta_hetzner_hcloud_labelpresent_&lt;labelname&gt; meta label
    to Hetzner discovery. #9028
  * promtool: Add compaction efficiency to promtool tsdb analyze
    reports. #8940
  * promtool: Allow configuring max block duration for
    backfilling via --max-block-duration flag. #8919
  * UI: Add sorting and filtering to flags page. #8988
  * UI: Improve alerts page rendering performance. #9005
  + Bugfixes:
  * Log when total symbol size exceeds 2^32 bytes, causing
    compaction to fail, and skip compaction. #9104
  * Fix incorrect target_limit reloading of zero value. #9120
  * Fix head GC and pending readers race condition. #9081
  * Fix timestamp handling in OpenMetrics parser. #9008
  * Fix potential duplicate metrics in /federate endpoint when
    specifying multiple matchers. #8885
  * Fix server configuration and validation for authentication
    via client cert. #9123
  * Allow start and end again as label names in PromQL queries.
    They were disallowed since the introduction of @ timestamp
    feature. #9119
- Upgrade to upstream version 2.28.1
  + Bugfixes:
  * HTTP SD: Allow charset specification in Content-Type header.
  * HTTP SD: Fix handling of disappeared target groups. #9019
  * Fix incorrect log-level handling after moving to go-kit/log.
- Upgrade to upstream version 2.28.0
  + Change:
  * UI: Make the new experimental PromQL editor the default.
  + Features:
  * Linode SD: Add Linode service discovery. #8846
  * HTTP SD: Add generic HTTP-based service discovery. #8839
  * Kubernetes SD: Allow configuring API Server access via a
    kubeconfig file. #8811
  * UI: Add exemplar display support to the graphing interface.
  * Consul SD: Add namespace support for Consul Enterprise. #8900
  + Enhancements:
  * Promtool: Allow silencing output when importing / backfilling
    data. #8917
  * Consul SD: Support reading tokens from file. #8926
  * Rules: Add a new .ExternalURL alert field templating
    variable, containing the external URL of the Prometheus
    server. #8878
  * Scrape: Add experimental body_size_limit scrape configuration
    setting to limit the allowed response body size for target
    scrapes. #8833 #8886
  * Kubernetes SD: Add ingress class name label for ingress
    discovery. #8916
  * UI: Show a startup screen with progress bar when the TSDB is
    not ready yet. #8662 #8908 #8909 #8946
  * SD: Add a target creation failure counter
    prometheus_target_sync_failed_total and improve target
    creation failure handling. #8786
  * TSDB: Improve validation of exemplar label set length. #8816
  * TSDB: Add a prometheus_tsdb_clean_start metric that indicates
    whether a TSDB lockfile from a previous run still existed
    upon startup. #8824
  + Bugfixes:
  * UI: In the experimental PromQL editor, fix autocompletion and
    parsing for special float values and improve series metadata
    fetching. #8856
  * TSDB: When merging chunks, split resulting chunks if they
    would contain more than the maximum of 120 samples. #8582
  * SD: Fix the computation of the
    prometheus_sd_discovered_targets metric when using multiple
    service discoveries. #8828</changelog>
</package>
<package pkgid="7598a6c9ef35783e30bcf2f738a4f362df99bff2cb02edb23395e54e8cdf43b5" name="golang-github-prometheus-prometheus" arch="x86_64">
  <version epoch="0" ver="2.32.1" rel="4.3.2"/>
  <changelog author="asn@cryptomilk.org" date="1564574400">- Build with PIE
  + Added 0004-prometheus-buildmode-pie.patch</changelog>
  <changelog author="jan.fajerski@suse.com" date="1564747200">- Add network-online (Wants and After) dependency to systemd unit bsc#1143913</changelog>
  <changelog author="jan.fajerski@suse.com" date="1565956800">- remove 0004-prometheus-buildmode-pie.patch
  + this patch produces binaries that crash immediately
- add -v to promu build command for better build debugging
- reorder some %install tasks</changelog>
  <changelog author="mrostecki@opensuse.org" date="1569240000">- Do not install the firewalld config file on Tumbleweed (on
  versions newer than Leap 15.1). It's installed in the main
  firewalld package.</changelog>
  <changelog author="jcavalheiro@suse.com" date="1574251200">- Update Uyuni/SUSE Manager service discovery patch
  + Modified 0003-Add-Uyuni-service-discovery.patch
  + Fixes crashes when systems have no FQDN
  + Adds Parallel calls to Uyuni API, meaningful performance increase
  + Adds Support for system group labels</changelog>
  <changelog author="mrostecki@opensuse.org" date="1574251201">- Remove firewalld files. They are installed in the main firewalld
  package.</changelog>
  <changelog author="jan.fajerski@suse.com" date="1574337600">- Remove prometheus.firewall.xml source file</changelog>
  <changelog author="jcavalheiro@suse.com" date="1574683200">- Patch macros on spec file to support builds on SLE 12</changelog>
  <changelog author="witold.bedyk@suse.com" date="1580126400">- Update to Prometheus 2.11.2</changelog>
  <changelog author="jcavalheiro@suse.com" date="1589371200">- Update Uyuni/SUSE Manager service discovery patch
  + Modified 0003-Add-Uyuni-service-discovery.patch:
  + Adapt service discovery to the new Uyuni API endpoints
  + Modified spec file: force golang 1.12 to fix build issues in SLE15SP2</changelog>
  <changelog author="jcavalheiro@suse.com" date="1591185600">- Update change log and spec file
  + Modified spec file: default to golang 1.14 to avoid "have choice" build issues in OBS.
  + Rebase and update patches for version 2.18.0
  + Changed:
  * 0001-Do-not-force-the-pure-Go-name-resolver.patch
  * 0002-Default-settings.patch Changed
  * 0003-Add-Uyuni-service-discovery.patch
- Update to 2.18.0
  + Features
  * Tracing: Added experimental Jaeger support #7148
  + Changes
  * Federation: Only use local TSDB for federation (ignore remote read). #7096
  * Rules: `rule_evaluations_total` and `rule_evaluation_failures_total` have a `rule_group` label now. #7094
  + Enhancements
  * TSDB: Significantly reduce WAL size kept around after a block cut. #7098
  * Discovery: Add `architecture` meta label for EC2. #7000
  + Bug fixes
  * UI: Fixed wrong MinTime reported by /status. #7182
  * React UI: Fixed multiselect legend on OSX. #6880
  * Remote Write: Fixed blocked resharding edge case. #7122
  * Remote Write: Fixed remote write not updating on relabel configs change. #7073
- Changes from 2.17.2
  + Bug fixes
  * Federation: Register federation metrics #7081
  * PromQL: Fix panic in parser error handling #7132
  * Rules: Fix reloads hanging when deleting a rule group that is being evaluated #7138
  * TSDB: Fix a memory leak when prometheus starts with an empty TSDB WAL #7135
  * TSDB: Make isolation more robust to panics in web handlers #7129 #7136
- Changes from 2.17.1
  + Bug fixes
  * TSDB: Fix query performance regression that increased memory and CPU usage #7051
- Changes from 2.17.0
  + Features
  * TSDB: Support isolation #6841
  * This release implements isolation in TSDB. API queries and recording rules are
    guaranteed to only see full scrapes and full recording rules. This comes with a
    certain overhead in resource usage. Depending on the situation, there might be
    some increase in memory usage, CPU usage, or query latency.
  + Enhancements
  * PromQL: Allow more keywords as metric names #6933
  * React UI: Add normalization of localhost URLs in targets page #6794
  * Remote read: Read from remote storage concurrently #6770
  * Rules: Mark deleted rule series as stale after a reload #6745
  * Scrape: Log scrape append failures as debug rather than warn #6852
  * TSDB: Improve query performance for queries that partially hit the head #6676
  * Consul SD: Expose service health as meta label #5313
  * EC2 SD: Expose EC2 instance lifecycle as meta label #6914
  * Kubernetes SD: Expose service type as meta label for K8s service role #6684
  * Kubernetes SD: Expose label_selector and field_selector #6807
  * Openstack SD: Expose hypervisor id as meta label #6962
  + Bug fixes
  * PromQL: Do not escape HTML-like chars in query log #6834 #6795
  * React UI: Fix data table matrix values #6896
  * React UI: Fix new targets page not loading when using non-ASCII characters #6892
  * Remote read: Fix duplication of metrics read from remote storage with external labels #6967 #7018
  * Remote write: Register WAL watcher and live reader metrics for all remotes, not just the first one #6998
  * Scrape: Prevent removal of metric names upon relabeling #6891
  * Scrape: Fix 'superfluous response.WriteHeader call' errors when scrape fails under some circonstances #6986
  * Scrape: Fix crash when reloads are separated by two scrape intervals #7011
- Changes from 2.16.0
  + Features
  * React UI: Support local timezone on /graph #6692
  * PromQL: add absent_over_time query function #6490
  * Adding optional logging of queries to their own file #6520
  + Enhancements
  * React UI: Add support for rules page and "Xs ago" duration displays #6503
  * React UI: alerts page, replace filtering togglers tabs with checkboxes #6543
  * TSDB: Export metric for WAL write errors #6647
  * TSDB: Improve query performance for queries that only touch the most recent 2h of data. #6651
  * PromQL: Refactoring in parser errors to improve error messages #6634
  * PromQL: Support trailing commas in grouping opts #6480
  * Scrape: Reduce memory usage on reloads by reusing scrape cache #6670
  * Scrape: Add metrics to track bytes and entries in the metadata cache #6675
  * promtool: Add support for line-column numbers for invalid rules output #6533
  * Avoid restarting rule groups when it is unnecessary #6450
  + Bug fixes
  * React UI: Send cookies on fetch() on older browsers #6553
  * React UI: adopt grafana flot fix for stacked graphs #6603
  * React UI: broken graph page browser history so that back button works as expected #6659
  * TSDB: ensure compactionsSkipped metric is registered, and log proper error if one is returned from head.Init #6616
  * TSDB: return an error on ingesting series with duplicate labels #6664
  * PromQL: Fix unary operator precedence #6579
  * PromQL: Respect query.timeout even when we reach query.max-concurrency #6712
  * PromQL: Fix string and parentheses handling in engine, which affected React UI #6612
  * PromQL: Remove output labels returned by absent() if they are produced by multiple identical label matchers #6493
  * Scrape: Validate that OpenMetrics input ends with `# EOF` #6505
  * Remote read: return the correct error if configs can't be marshal'd to JSON #6622
  * Remote write: Make remote client `Store` use passed context, which can affect shutdown timing #6673
  * Remote write: Improve sharding calculation in cases where we would always be consistently behind by tracking pendingSamples #6511
  * Ensure prometheus_rule_group metrics are deleted when a rule group is removed #6693
- Changes from 2.15.2
  + Bug fixes
  * TSDB: Fixed support for TSDB blocks built with Prometheus before 2.1.0. #6564
  * TSDB: Fixed block compaction issues on Windows. #6547
- Changes from 2.15.1
  + Bug fixes
  * TSDB: Fixed race on concurrent queries against same data. #6512
- Changes from 2.15.0
  + Features
  * API: Added new endpoint for exposing per metric metadata `/metadata`. #6420 #6442
  + Changes
  * Discovery: Removed `prometheus_sd_kubernetes_cache_*` metrics. Additionally `prometheus_sd_kubernetes_workqueue_latency_seconds` and `prometheus_sd_kubernetes_workqueue_work_duration_seconds` metrics now show correct values in seconds. #6393
  * Remote write: Changed `query` label on `prometheus_remote_storage_*` metrics to `remote_name` and `url`. #6043
  + Enhancements
  * TSDB: Significantly reduced memory footprint of loaded TSDB blocks. #6418 #6461
  * TSDB: Significantly optimized what we buffer during compaction which should result in lower memory footprint during compaction. #6422 #6452 #6468 #6475
  * TSDB: Improve replay latency. #6230
  * TSDB: WAL size is now used for size based retention calculation. #5886
  * Remote read: Added query grouping and range hints to the remote read request #6401
  * Remote write: Added `prometheus_remote_storage_sent_bytes_total` counter per queue. #6344
  * promql: Improved PromQL parser performance. #6356
  * React UI: Implemented missing pages like `/targets` #6276, TSDB status page #6281 #6267 and many other fixes and performance improvements.
  * promql: Prometheus now accepts spaces between time range and square bracket. e.g `[ 5m]` #6065
  + Bug fixes
  * Config: Fixed alertmanager configuration to not miss targets when configurations are similar. #6455
  * Remote write: Value of `prometheus_remote_storage_shards_desired` gauge shows raw value of desired shards and it's updated correctly. #6378
  * Rules: Prometheus now fails the evaluation of rules and alerts where metric results collide with labels specified in `labels` field. #6469
  * API: Targets Metadata API `/targets/metadata` now accepts empty `match_targets` parameter as in the spec. #6303
- Changes from 2.14.0
  + Features
  * API: `/api/v1/status/runtimeinfo` and `/api/v1/status/buildinfo` endpoints added for use by the React UI. #6243
  * React UI: implement the new experimental React based UI. #5694 and many more
  * Can be found by under `/new`.
  * Not all pages are implemented yet.
  * Status: Cardinality statistics added to the Runtime &amp; Build Information page. #6125
  + Enhancements
  * Remote write: fix delays in remote write after a compaction. #6021
  * UI: Alerts can be filtered by state. #5758
  + Bug fixes
  * Ensure warnings from the API are escaped. #6279
  * API: lifecycle endpoints return 403 when not enabled. #6057
  * Build: Fix Solaris build. #6149
  * Promtool: Remove false duplicate rule warnings when checking rule files with alerts. #6270
  * Remote write: restore use of deduplicating logger in remote write. #6113
  * Remote write: do not reshard when unable to send samples. #6111
  * Service discovery: errors are no longer logged on context cancellation. #6116, #6133
  * UI: handle null response from API properly. #6071
- Changes from 2.13.1
  + Bug fixes
  * Fix panic in ARM builds of Prometheus. #6110
  * promql: fix potential panic in the query logger. #6094
  * Multiple errors of http: superfluous response.WriteHeader call in the logs. #6145
- Changes from 2.13.0
  + Enhancements
  * Metrics: renamed prometheus_sd_configs_failed_total to prometheus_sd_failed_configs and changed to Gauge #5254
  * Include the tsdb tool in builds. #6089
  * Service discovery: add new node address types for kubernetes. #5902
  * UI: show warnings if query have returned some warnings. #5964
  * Remote write: reduce memory usage of the series cache. #5849
  * Remote read: use remote read streaming to reduce memory usage. #5703
  * Metrics: added metrics for remote write max/min/desired shards to queue manager. #5787
  * Promtool: show the warnings during label query. #5924
  * Promtool: improve error messages when parsing bad rules. #5965
  * Promtool: more promlint rules. #5515
  + Bug fixes
  * UI: Fix a Stored DOM XSS vulnerability with query history [CVE-2019-10215](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10215). #6098
  * Promtool: fix recording inconsistency due to duplicate labels. #6026
  * UI: fixes service-discovery view when accessed from unhealthy targets. #5915
  * Metrics format: OpenMetrics parser crashes on short input. #5939
  * UI: avoid truncated Y-axis values. #6014
- Changes from 2.12.0
  + Features
  * Track currently active PromQL queries in a log file. #5794
  * Enable and provide binaries for `mips64` / `mips64le` architectures. #5792
  + Enhancements
  * Improve responsiveness of targets web UI and API endpoint. #5740
  * Improve remote write desired shards calculation. #5763
  * Flush TSDB pages more precisely. tsdb#660
  * Add `prometheus_tsdb_retention_limit_bytes` metric. tsdb#667
  * Add logging during TSDB WAL replay on startup. tsdb#662
  * Improve TSDB memory usage. tsdb#653, tsdb#643, tsdb#654, tsdb#642, tsdb#627
  + Bug fixes
  * Check for duplicate label names in remote read. #5829
  * Mark deleted rules' series as stale on next evaluation. #5759
  * Fix JavaScript error when showing warning about out-of-sync server time. #5833
  * Fix `promtool test rules` panic when providing empty `exp_labels`. #5774
  * Only check last directory when discovering checkpoint number. #5756
  * Fix error propagation in WAL watcher helper functions. #5741
  * Correctly handle empty labels from alert templates. #5845</changelog>
  <changelog author="witold.bedyk@suse.com" date="1596196800">- Update 0003-Add-Uyuni-service-discovery.patch:
  + Add support for Prometheus exporters proxy</changelog>
  <changelog author="pseidensal@suse.com" date="1598875200">- Update package with changes from `server:monitoring` bsc#1175478
  Left out removal of firewalld related configuration files as SLE-15-SP1's
  `firewalld` package does not contain prometheus configuration yet.</changelog>
  <changelog author="stefano.torresi@suse.com" date="1604923200">- Update to upstream version 2.22.1
- Update packaging
  * Remove systemd and shadow hard requirements
  * use systemd-sysusers to configure the user in a dedicated 'system-user-prometheus' subpackage
  * add 'prometheus' package alias</changelog>
  <changelog author="witold.bedyk@suse.com" date="1615291200">- Uyuni: `hostname` label is now set to FQDN instead of IP
  + Changed:
  * 0003-Add-Uyuni-service-discovery.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1620129600">- Add tarball with vendor modules and web assets
- Uyuni: Read formula data from exporters map
- Uyuni: Add support for TLS targets
  + Changed:
  * 0003-Add-Uyuni-service-discovery.patch
  * 0002-Default-settings.patch Changed
  * 0003-Add-Uyuni-service-discovery.patch
- Upgrade to upstream version 2.26.0
  + Changes
  * Alerting: Using Alertmanager v2 API by default. #8626
  * Prometheus/Promtool: Binaries are now printing help and usage to stdout instead of stderr. #8542
  + Features
  * Remote: Add support for AWS SigV4 auth method for remote_write. #8509
  * PromQL: Allow negative offsets. Behind --enable-feature=promql-negative-offset flag. #8487
  * UI: Add advanced auto-completion, syntax highlighting and linting to graph page query input. #8634
  + Enhancements
  * PromQL: Add last_over_time, sgn, clamp functions. #8457
  * Scrape: Add support for specifying type of Authorization header credentials with Bearer by default. #8512
  * Scrape: Add follow_redirects option to scrape configuration. #8546
  * Remote: Allow retries on HTTP 429 response code for remote_write. #8237 #8477
  * Remote: Allow configuring custom headers for remote_read. #8516
  * UI: Hitting Enter now triggers new query. #8581
  * UI: Better handling of long rule and names on the /rules and /targets pages. #8608 #8609
  * UI: Add collapse/expand all button on the /targets page. #8486
- Upgrade to upstream version 2.25.0
  + Features
  * Include a new `--enable-feature=` flag that enables experimental features.
  + Enhancements
  * Add optional name property to testgroup for better test failure output. #8440
  * Add warnings into React Panel on the Graph page. #8427
  * TSDB: Increase the number of buckets for the compaction duration metric. #8342
  * Remote: Allow passing along custom remote_write HTTP headers. #8416
  * Mixins: Scope grafana configuration. #8332
  * Kubernetes SD: Add endpoint labels metadata. #8273
  * UI: Expose total number of label pairs in head in TSDB stats page. #8343
  * TSDB: Reload blocks every minute, to detect new blocks and enforce retention more often. #8343
  + Bug fixes
  * API: Fix global URL when external address has no port. #8359
  * Deprecate unused flag --alertmanager.timeout. #8407
- Upgrade to upstream version 2.24.1
  + Enhancements
  * Cache basic authentication results to significantly improve performance of HTTP endpoints.
- Upgrade to upstream version 2.24.0
  + Features
  * Add TLS and basic authentication to HTTP endpoints. #8316
  * promtool: Add check web-config subcommand to check web config files. #8319
  * promtool: Add tsdb create-blocks-from openmetrics subcommand to backfill metrics data from an OpenMetrics file. #8084
  + Enhancements
  * HTTP API: Fast-fail queries with only empty matchers. #8288
  * HTTP API: Support matchers for labels API. #8301
  * promtool: Improve checking of URLs passed on the command line. #7956
  * SD: Expose IPv6 as a label in EC2 SD. #7086
  * SD: Reuse EC2 client, reducing frequency of requesting credentials. #8311
  * TSDB: Add logging when compaction takes more than the block time range. #8151
  * TSDB: Avoid unnecessary GC runs after compaction. #8276
- Upgrade to upstream version 2.23.0
  + Changes
  * UI: Make the React UI default. #8142
  * Remote write: The following metrics were removed/renamed in remote write. #6815
    &gt; prometheus_remote_storage_succeeded_samples_total was removed and prometheus_remote_storage_samples_total was introduced for all the samples attempted to send.
    &gt; prometheus_remote_storage_sent_bytes_total was removed and replaced with prometheus_remote_storage_samples_bytes_total and prometheus_remote_storage_metadata_bytes_total.
    &gt; prometheus_remote_storage_failed_samples_total -&gt; prometheus_remote_storage_samples_failed_total .
    &gt; prometheus_remote_storage_retried_samples_total -&gt; prometheus_remote_storage_samples_retried_total.
    &gt; prometheus_remote_storage_dropped_samples_total -&gt; prometheus_remote_storage_samples_dropped_total.
    &gt; prometheus_remote_storage_pending_samples -&gt; prometheus_remote_storage_samples_pending.
  * Remote: Do not collect non-initialized timestamp metrics. #8060
  + Enhancements
  * Remote write: Added a metric prometheus_remote_storage_max_samples_per_send for remote write. #8102
  * TSDB: Make the snapshot directory name always the same length. #8138
  * TSDB: Create a checkpoint only once at the end of all head compactions. #8067
  * TSDB: Avoid Series API from hitting the chunks. #8050
  * TSDB: Cache label name and last value when adding series during compactions making compactions faster. #8192
  * PromQL: Improved performance of Hash method making queries a bit faster. #8025
  * promtool: tsdb list now prints block sizes. #7993
  * promtool: Calculate mint and maxt per test avoiding unnecessary calculations. #8096
  * SD: Add filtering of services to Docker Swarm SD. #8074</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1621425600">- Refresh patches
  + Changed:
  * 0001-Do-not-force-the-pure-Go-name-resolver.patch
  * 0002-Default-settings.patch
  * 0003-Add-Uyuni-service-discovery.patch
- Upgrade to upstream version 2.27.1 (jsc#SLE-18254)
  + Bugfix:
  * SECURITY: Fix arbitrary redirects under the /new endpoint (CVE-2021-29622, bsc#1186242)
- Upgrade to upstream version 2.27.0
  + Features:
  * Promtool: Retroactive rule evaluation functionality. #7675
  * Configuration: Environment variable expansion for external labels. Behind --enable-feature=expand-external-labels flag. #8649
  * TSDB: Add a flag(--storage.tsdb.max-block-chunk-segment-size) to control the max chunks file size of the blocks for small Prometheus instances. #8478
  * UI: Add a dark theme. #8604
  * AWS Lightsail Discovery: Add AWS Lightsail Discovery. #8693
  * Docker Discovery: Add Docker Service Discovery. #8629
  * OAuth: Allow OAuth 2.0 to be used anywhere an HTTP client is used. #8761
  * Remote Write: Send exemplars via remote write. Experimental and disabled by default. #8296
  + Enhancements:
  * Digital Ocean Discovery: Add __meta_digitalocean_vpc label. #8642
  * Scaleway Discovery: Read Scaleway secret from a file. #8643
  * Scrape: Add configurable limits for label size and count. #8777
  * UI: Add 16w and 26w time range steps. #8656
  * Templating: Enable parsing strings in humanize functions. #8682
  + Bugfixes:
  * UI: Provide errors instead of blank page on TSDB Status Page. #8654 #8659
  * TSDB: Do not panic when writing very large records to the WAL. #8790
  * TSDB: Avoid panic when mmaped memory is referenced after the file is closed. #8723
  * Scaleway Discovery: Fix nil pointer dereference. #8737
  * Consul Discovery: Restart no longer required after config update with no targets. #8766</changelog>
  <changelog author="witold.bedyk@suse.com" date="1625745600">- Provide and reload firewalld configuration only for:
  + openSUSE Leap 15.0, 15.1, 15.2
  + SUSE SLE15, SLE15 SP1, SLE15 SP2</changelog>
  <changelog author="jsegitz@suse.com" date="1632139200">- Added hardening to systemd service(s) (bsc#1181400). Modified:
  * prometheus.service</changelog>
  <changelog author="witold.bedyk@suse.com" date="1642593600">- Updated patches:
  + Changed:
  * 0002-Default-settings.patch
  + Removed:
  * 0003-Add-Uyuni-service-discovery.patch
- Use obs-service-go_modules
- Upgrade to upstream version 2.32.1 (jsc#SLE-22863)
  + Bugfixes:
  * Scrape: Fix reporting metrics when sample limit is reached
    during the report. #9996
  * Scrape: Ensure that scrape interval and scrape timeout are
    always set. #10023
  * TSDB: Expose and fix bug in iterators' Seek() method. #10030
- Upgrade to upstream version 2.32.0
  + Change:
  * remote-write: Change default max retry time from 100ms to
    5 seconds. #9634
  + Features:
  * Agent: New mode of operation optimized for remote-write only
    scenarios, without local storage.
  * Promtool: Add promtool check service-discovery command. #8970
  + Enhancements:
  * Promtool: Improve test output. #8064
  * Promtool: Use kahan summation for better numerical stability.
  * Remote-write: Reuse memory for marshalling. #9412
  * Scrape: Add scrape_body_size_bytes scrape metric behind the
  - -enable-feature=extra-scrape-metrics flag. #9569
  * TSDB: Add windows arm64 support. #9703
  * TSDB: Optimize query by skipping unneeded sorting in TSDB.
  * Templates: Support int and uint as datatypes for template
    formatting. #9680
  * UI: Prefer rate over rad, delta over deg, and count over cos
    in autocomplete. #9688
  + Bugfixes:
  * TSDB: Add more size checks when writing individual sections
    in the index. #9710
  * PromQL: Make deriv() return zero values for constant series.
  * TSDB: Fix panic when checkpoint directory is empty. #9687
  * TSDB: Fix panic, out of order chunks, and race warning during
    WAL replay. #9856
  * UI: Correctly render links for targets with IPv6 addresses
    that contain a Zone ID. #9853
  * Promtool: Fix checking of authorization.credentials_file and
    bearer_token_file fields. #9883
  * Uyuni SD: Fix null pointer exception during initialization.
  * TSDB: Fix queries after a failed snapshot replay. #9980
- Upgrade to upstream version 2.31.1
  + Bugfix:
  * SD: Fix a panic when the experimental discovery manager
    receives targets during a reload. #9656
- Upgrade to upstream version 2.31.0
  + Change:
  * UI: Remove standard PromQL editor in favour of the
    codemirror-based editor. #9452
  + Features:
  * PromQL: Add trigonometric functions and atan2 binary
    operator. #9239 #9248 #9515
  * Remote: Add support for exemplar in the remote write receiver
    endpoint. #9319 #9414
  * SD: Add PuppetDB service discovery. #8883
  * SD: Add Uyuni service discovery. #8190
  * Web: Add support for security-related HTTP headers. #9546
  + Enhancements:
  * Azure SD: Add proxy_url, follow_redirects, tls_config. #9267
  * Backfill: Add --max-block-duration in promtool
    create-blocks-from rules. #9511
  * Config: Print human-readable sizes with unit instead of raw
    numbers. #9361
  * HTTP: Re-enable HTTP/2. #9398
  * Kubernetes SD: Warn user if number of endpoints exceeds
    limit. #9467
  * OAuth2: Add TLS configuration to token requests. #9550
  * PromQL: Several optimizations. #9365 #9360 #9362 #9552
  * PromQL: Make aggregations deterministic in instant queries.
  * Rules: Add the ability to limit number of alerts or series.
  * SD: Experimental discovery manager to avoid restarts upon
    reload.
  * UI: Debounce timerange setting changes. #9359
  + Bugfixes:
  * Backfill: Apply rule labels after query labels. #9421
  * Scrape: Resolve conflicts between multiple exported label
    prefixes. #9479 #9518
  * Scrape: Restart scrape loops when __scrape_interval__ is
    changed. #9551
  * TSDB: Fix memory leak in samples deletion. #9151
  * UI: Use consistent margin-bottom for all alert kinds. #9318
- Upgrade to upstream version 2.30.3
  + Bugfixes:
  * TSDB: Fix panic on failed snapshot replay. #9438
  * TSDB: Don't fail snapshot replay with exemplar storage
    disabled when the snapshot contains exemplars. #9438
- Upgrade to upstream version 2.30.2
  + Bugfix:
  * TSDB: Don't error on overlapping m-mapped chunks during WAL
    replay. #9381
- Upgrade to upstream version 2.30.1
  + Enhancements:
  * Remote Write: Redact remote write URL when used for metric
    label. #9383
  * UI: Redact remote write URL and proxy URL passwords in the
    /config page. #9408
  + Bugfixes:
  * promtool rules backfill: Prevent creation of data before the
    start time. #9339
  * promtool rules backfill: Do not query after the end time.
  * Azure SD: Fix panic when no computername is set. #9387
- Upgrade to upstream version 2.30.0
  + Features:
  * experimental TSDB: Snapshot in-memory chunks on shutdown for
    faster restarts. #7229
  * experimental Scrape: Configure scrape interval and scrape
    timeout via relabeling using __scrape_interval__ and
    __scrape_timeout__ labels respectively. #8911
  * Scrape: Add scrape_timeout_seconds and scrape_sample_limit
    metric. #9247 #9295
  + Enhancements:
  * Scrape: Add --scrape.timestamp-tolerance flag to adjust
    scrape timestamp tolerance when enabled via
  - -scrape.adjust-timestamps. #9283
  * Remote Write: Improve throughput when sending exemplars.
  * TSDB: Optimise WAL loading by removing extra map and caching
    min-time #9160
  * promtool: Speed up checking for duplicate rules. #9262/#9306
  * Scrape: Reduce allocations when parsing the metrics. #9299
  * docker_sd: Support host network mode #9125
  + Bugfixes:
  * Exemplars: Fix panic when resizing exemplar storage from 0 to
    a non-zero size. #9286
  * TSDB: Correctly decrement
    prometheus_tsdb_head_active_appenders when the append has no
    samples. #9230
  * promtool rules backfill: Return 1 if backfill was
    unsuccessful. #9303
  * promtool rules backfill: Avoid creation of overlapping
    blocks. #9324
  * config: Fix a panic when reloading configuration with a null
    relabel action. #9224
- Upgrade to upstream version 2.29.2
  + Bugfixes:
  * Fix Kubernetes SD failing to discover Ingress in
    Kubernetes v1.22. #9205
  * Fix data race in loading write-ahead-log (WAL). #9259
- Upgrade to upstream version 2.29.1
  + Bugfixes:
  * TSDB: align atomically accessed int64 to prevent panic in
    32-bit archs. #9192
- Upgrade to upstream version 2.29.0
  + Changes:
  * Promote --storage.tsdb.allow-overlapping-blocks flag to
    stable. #9117
  * Promote --storage.tsdb.retention.size flag to stable. #9004
  + Features:
  * Add Kuma service discovery. #8844
  * Add present_over_time PromQL function. #9097
  * Allow configuring exemplar storage via file and make it
    reloadable. #8974
  * UI: Allow selecting time range with mouse drag. #8977
  * promtool: Add feature flags flag --enable-feature. #8958
  * promtool: Add file_sd file validation. #8950
  + Enhancements:
  * Reduce blocking of outgoing remote write requests from series
    garbage collection. #9109
  * Improve write-ahead-log decoding performance. #9106
  * Improve append performance in TSDB by reducing mutexes usage.
  * Allow configuring max_samples_per_send for remote write
    metadata. #8959
  * Add __meta_gce_interface_ipv4_&lt;name&gt; meta label to GCE
    discovery. #8978
  * Add __meta_ec2_availability_zone_id meta label to EC2
    discovery. #8896
  * Add __meta_azure_machine_computer_name meta label to Azure
    discovery. #9112
  * Add __meta_hetzner_hcloud_labelpresent_&lt;labelname&gt; meta label
    to Hetzner discovery. #9028
  * promtool: Add compaction efficiency to promtool tsdb analyze
    reports. #8940
  * promtool: Allow configuring max block duration for
    backfilling via --max-block-duration flag. #8919
  * UI: Add sorting and filtering to flags page. #8988
  * UI: Improve alerts page rendering performance. #9005
  + Bugfixes:
  * Log when total symbol size exceeds 2^32 bytes, causing
    compaction to fail, and skip compaction. #9104
  * Fix incorrect target_limit reloading of zero value. #9120
  * Fix head GC and pending readers race condition. #9081
  * Fix timestamp handling in OpenMetrics parser. #9008
  * Fix potential duplicate metrics in /federate endpoint when
    specifying multiple matchers. #8885
  * Fix server configuration and validation for authentication
    via client cert. #9123
  * Allow start and end again as label names in PromQL queries.
    They were disallowed since the introduction of @ timestamp
    feature. #9119
- Upgrade to upstream version 2.28.1
  + Bugfixes:
  * HTTP SD: Allow charset specification in Content-Type header.
  * HTTP SD: Fix handling of disappeared target groups. #9019
  * Fix incorrect log-level handling after moving to go-kit/log.
- Upgrade to upstream version 2.28.0
  + Change:
  * UI: Make the new experimental PromQL editor the default.
  + Features:
  * Linode SD: Add Linode service discovery. #8846
  * HTTP SD: Add generic HTTP-based service discovery. #8839
  * Kubernetes SD: Allow configuring API Server access via a
    kubeconfig file. #8811
  * UI: Add exemplar display support to the graphing interface.
  * Consul SD: Add namespace support for Consul Enterprise. #8900
  + Enhancements:
  * Promtool: Allow silencing output when importing / backfilling
    data. #8917
  * Consul SD: Support reading tokens from file. #8926
  * Rules: Add a new .ExternalURL alert field templating
    variable, containing the external URL of the Prometheus
    server. #8878
  * Scrape: Add experimental body_size_limit scrape configuration
    setting to limit the allowed response body size for target
    scrapes. #8833 #8886
  * Kubernetes SD: Add ingress class name label for ingress
    discovery. #8916
  * UI: Show a startup screen with progress bar when the TSDB is
    not ready yet. #8662 #8908 #8909 #8946
  * SD: Add a target creation failure counter
    prometheus_target_sync_failed_total and improve target
    creation failure handling. #8786
  * TSDB: Improve validation of exemplar label set length. #8816
  * TSDB: Add a prometheus_tsdb_clean_start metric that indicates
    whether a TSDB lockfile from a previous run still existed
    upon startup. #8824
  + Bugfixes:
  * UI: In the experimental PromQL editor, fix autocompletion and
    parsing for special float values and improve series metadata
    fetching. #8856
  * TSDB: When merging chunks, split resulting chunks if they
    would contain more than the maximum of 120 samples. #8582
  * SD: Fix the computation of the
    prometheus_sd_discovered_targets metric when using multiple
    service discoveries. #8828</changelog>
</package>
<package pkgid="ba63a5a655c6c1afcf6e47871c272a11270f7247b361affe04d439d882d4e34f" name="hunspell" arch="aarch64">
  <version epoch="0" ver="1.6.2" rel="3.8.1"/>
  <changelog author="tchvatal@suse.com" date="1459771200">- Version update to 1.3.4:
  * Various updates to the buildsystem
  * Various werror bugfixes
  * Loads of coverity fixes
- Add patch to build with grep 2.24:
  * hunspell-grep2.24.patch
- Remove upstreamed patch:
  * hunspell-emacs-utf8.patch
- Do not search for translations - broken automake from upstream
  * Not worth fixing only bit italian and mostly hungarian translations
    for cli anyway</changelog>
  <changelog author="mpluskal@suse.com" date="1461067200">- Update to 1.4.0
  * New release that strips out fixed length buffers from large
    parts of the library
  * Note: dictmgr.hxx header is dropped
- Drop upstreamed hunspell-grep2.24.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1462363200">- Update to 1.4.1:
  * Past begin() iterator decrement error
  * VS Debug build threw error on decrement past begin.
- Split shared library
- Do not call autoreconf
- Move manpages to corresponding packages</changelog>
  <changelog author="mpluskal@suse.com" date="1462968000">- Update baselibs.conf bnc#977784
- Add conflicts to hunspell 1.4.0</changelog>
  <changelog author="jengelh@inai.de" date="1463486400">- Drop Requires: pkgconfig because this is already autodetected
  by rpm. Use mode inheritance for defattr. Edit rpm group and
  description a tiny bit.</changelog>
  <changelog author="pgajdos@suse.com" date="1479729600">- update to 1.5.0:
  * Lot of stability fixes
  * Fixed compilation errors on various systems (Windows, FreeBSD)
  * Small performance improvement compared to 1.4.0
  * API is same as 1.4.</changelog>
  <changelog author="pgajdos@suse.com" date="1480593600">- update to 1.5.4:
  * fix API compatibility with 1.4</changelog>
  <changelog author="mpluskal@suse.com" date="1482494400">- Update to version 1.6.0:
  * Changes in the library:
    + Performance improvement in ngsuggest(), suggestions should be
    faster.
    + Revert MAXWORDLEN to 100 as in 1.3.3 for performance reasons.
    + MAXWORDLEN can be set during build time with -D defines.
    + Fix crash when word with 102 consecutive X is spelled.
  * Changes in the command line tool:
    + -D shows all loaded dictionares insted of only the first.
    + -D properly lists all available dictionaries on Windows.</changelog>
  <changelog author="mpluskal@suse.com" date="1496836800">- Update to version 1.6.1:
  * Library changes:
    + Performance improvements in suggest()
    + Fixes regressions for Hungarian related to compounding.
    + Fixes regressions for Korean related to ICONV.
  * Command line tool:
    + Added Tajik translation
    + Fix regarding serching of OOo dicts installed in user folder
  * Manpages:
    + Fix microsoft-cp1251 to cp1251. Dicts should not use the
    first.
    + Typos.</changelog>
  <changelog author="mpluskal@suse.com" date="1509105600">- Update to version 1.6.2:
  * Command line tool:
    + Added German translation
    + Fixed bug with wrong output encoding, not respecting system
    locale.</changelog>
  <changelog author="pgajdos@suse.com" date="1591704000">- security update
- added patches
  fix CVE-2019-16707 [bsc#1151867], invalid read operation in SuggestMgr:leftcommonsubstring in suggestmgr.cxx
  + hunspell-CVE-2019-16707.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1641470400">- suggests english directory [bsc#1193627]</changelog>
</package>
<package pkgid="7400f3aa1d346f90d7d3094a2affa793b543a6a52b26aef9d874d29d7240935e" name="hunspell" arch="ppc64le">
  <version epoch="0" ver="1.6.2" rel="3.8.1"/>
  <changelog author="tchvatal@suse.com" date="1459771200">- Version update to 1.3.4:
  * Various updates to the buildsystem
  * Various werror bugfixes
  * Loads of coverity fixes
- Add patch to build with grep 2.24:
  * hunspell-grep2.24.patch
- Remove upstreamed patch:
  * hunspell-emacs-utf8.patch
- Do not search for translations - broken automake from upstream
  * Not worth fixing only bit italian and mostly hungarian translations
    for cli anyway</changelog>
  <changelog author="mpluskal@suse.com" date="1461067200">- Update to 1.4.0
  * New release that strips out fixed length buffers from large
    parts of the library
  * Note: dictmgr.hxx header is dropped
- Drop upstreamed hunspell-grep2.24.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1462363200">- Update to 1.4.1:
  * Past begin() iterator decrement error
  * VS Debug build threw error on decrement past begin.
- Split shared library
- Do not call autoreconf
- Move manpages to corresponding packages</changelog>
  <changelog author="mpluskal@suse.com" date="1462968000">- Update baselibs.conf bnc#977784
- Add conflicts to hunspell 1.4.0</changelog>
  <changelog author="jengelh@inai.de" date="1463486400">- Drop Requires: pkgconfig because this is already autodetected
  by rpm. Use mode inheritance for defattr. Edit rpm group and
  description a tiny bit.</changelog>
  <changelog author="pgajdos@suse.com" date="1479729600">- update to 1.5.0:
  * Lot of stability fixes
  * Fixed compilation errors on various systems (Windows, FreeBSD)
  * Small performance improvement compared to 1.4.0
  * API is same as 1.4.</changelog>
  <changelog author="pgajdos@suse.com" date="1480593600">- update to 1.5.4:
  * fix API compatibility with 1.4</changelog>
  <changelog author="mpluskal@suse.com" date="1482494400">- Update to version 1.6.0:
  * Changes in the library:
    + Performance improvement in ngsuggest(), suggestions should be
    faster.
    + Revert MAXWORDLEN to 100 as in 1.3.3 for performance reasons.
    + MAXWORDLEN can be set during build time with -D defines.
    + Fix crash when word with 102 consecutive X is spelled.
  * Changes in the command line tool:
    + -D shows all loaded dictionares insted of only the first.
    + -D properly lists all available dictionaries on Windows.</changelog>
  <changelog author="mpluskal@suse.com" date="1496836800">- Update to version 1.6.1:
  * Library changes:
    + Performance improvements in suggest()
    + Fixes regressions for Hungarian related to compounding.
    + Fixes regressions for Korean related to ICONV.
  * Command line tool:
    + Added Tajik translation
    + Fix regarding serching of OOo dicts installed in user folder
  * Manpages:
    + Fix microsoft-cp1251 to cp1251. Dicts should not use the
    first.
    + Typos.</changelog>
  <changelog author="mpluskal@suse.com" date="1509105600">- Update to version 1.6.2:
  * Command line tool:
    + Added German translation
    + Fixed bug with wrong output encoding, not respecting system
    locale.</changelog>
  <changelog author="pgajdos@suse.com" date="1591704000">- security update
- added patches
  fix CVE-2019-16707 [bsc#1151867], invalid read operation in SuggestMgr:leftcommonsubstring in suggestmgr.cxx
  + hunspell-CVE-2019-16707.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1641470400">- suggests english directory [bsc#1193627]</changelog>
</package>
<package pkgid="dfedca4d0a9a40e1853b01d508f8bfd3eab1c21c72606e08fa3df6b51b607f21" name="hunspell" arch="s390x">
  <version epoch="0" ver="1.6.2" rel="3.8.1"/>
  <changelog author="tchvatal@suse.com" date="1459771200">- Version update to 1.3.4:
  * Various updates to the buildsystem
  * Various werror bugfixes
  * Loads of coverity fixes
- Add patch to build with grep 2.24:
  * hunspell-grep2.24.patch
- Remove upstreamed patch:
  * hunspell-emacs-utf8.patch
- Do not search for translations - broken automake from upstream
  * Not worth fixing only bit italian and mostly hungarian translations
    for cli anyway</changelog>
  <changelog author="mpluskal@suse.com" date="1461067200">- Update to 1.4.0
  * New release that strips out fixed length buffers from large
    parts of the library
  * Note: dictmgr.hxx header is dropped
- Drop upstreamed hunspell-grep2.24.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1462363200">- Update to 1.4.1:
  * Past begin() iterator decrement error
  * VS Debug build threw error on decrement past begin.
- Split shared library
- Do not call autoreconf
- Move manpages to corresponding packages</changelog>
  <changelog author="mpluskal@suse.com" date="1462968000">- Update baselibs.conf bnc#977784
- Add conflicts to hunspell 1.4.0</changelog>
  <changelog author="jengelh@inai.de" date="1463486400">- Drop Requires: pkgconfig because this is already autodetected
  by rpm. Use mode inheritance for defattr. Edit rpm group and
  description a tiny bit.</changelog>
  <changelog author="pgajdos@suse.com" date="1479729600">- update to 1.5.0:
  * Lot of stability fixes
  * Fixed compilation errors on various systems (Windows, FreeBSD)
  * Small performance improvement compared to 1.4.0
  * API is same as 1.4.</changelog>
  <changelog author="pgajdos@suse.com" date="1480593600">- update to 1.5.4:
  * fix API compatibility with 1.4</changelog>
  <changelog author="mpluskal@suse.com" date="1482494400">- Update to version 1.6.0:
  * Changes in the library:
    + Performance improvement in ngsuggest(), suggestions should be
    faster.
    + Revert MAXWORDLEN to 100 as in 1.3.3 for performance reasons.
    + MAXWORDLEN can be set during build time with -D defines.
    + Fix crash when word with 102 consecutive X is spelled.
  * Changes in the command line tool:
    + -D shows all loaded dictionares insted of only the first.
    + -D properly lists all available dictionaries on Windows.</changelog>
  <changelog author="mpluskal@suse.com" date="1496836800">- Update to version 1.6.1:
  * Library changes:
    + Performance improvements in suggest()
    + Fixes regressions for Hungarian related to compounding.
    + Fixes regressions for Korean related to ICONV.
  * Command line tool:
    + Added Tajik translation
    + Fix regarding serching of OOo dicts installed in user folder
  * Manpages:
    + Fix microsoft-cp1251 to cp1251. Dicts should not use the
    first.
    + Typos.</changelog>
  <changelog author="mpluskal@suse.com" date="1509105600">- Update to version 1.6.2:
  * Command line tool:
    + Added German translation
    + Fixed bug with wrong output encoding, not respecting system
    locale.</changelog>
  <changelog author="pgajdos@suse.com" date="1591704000">- security update
- added patches
  fix CVE-2019-16707 [bsc#1151867], invalid read operation in SuggestMgr:leftcommonsubstring in suggestmgr.cxx
  + hunspell-CVE-2019-16707.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1641470400">- suggests english directory [bsc#1193627]</changelog>
</package>
<package pkgid="42894b8175b5c30b3816d630f63768766df42f3ff68bdf96018ec41013c12e66" name="hunspell" arch="src">
  <version epoch="0" ver="1.6.2" rel="3.8.1"/>
  <changelog author="jengelh@medozas.de" date="1323432000">- Remove redundant/unwanted tags/section (cf. specfile guidelines)</changelog>
  <changelog author="cfarrell@suse.com" date="1323864000">- license update: (GPL-2.0+ or LGPL-2.1+ or MPL-1.1+) and LGPL-2.1+
  SPDX syntax describing the COPYING file statesments</changelog>
  <changelog author="pgajdos@suse.com" date="1346673600">- added /usr/lib64/libhunspell.so on request from egdfree@opensuse.org</changelog>
  <changelog author="mmeister@suse.com" date="1364472000">- Added url as source.
  Please see http://en.opensuse.org/SourceUrls</changelog>
  <changelog author="schwab@linux-m68k.org" date="1392984000">- hashmgr-add-word.patch: fix allocation error in HashMgr::add_word (from
  http://sourceforge.net/p/hunspell/patches/49/)</changelog>
  <changelog author="tchvatal@suse.com" date="1399291200">- Cleanup with spec-cleaner.
- Do not provide static package. Nothing should staticaly link here
  anyway. With this also remove libtool archive.
- Explicitely disable rpath and name all switches.
- Autoreconf the sources after the patching. Also makes aarch64
  happy this way.
- Paralelize the check phase, no need to run it in just one thread.
- Added patches:
  * hunspell-1.3.2-static-lib.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1403524800">- updated to 1.3.3:
  - OpenDocument (ODF and Flat ODF) support (ODF needs unzip program)
  - various bug fixes
- removed patches:
  * hashmgr-add-word.patch (upstreamed)
  * hunspell-1.3.2-static-lib.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1406894400">- make hunspell work with emacs and utf-8 [bnc#883505]
- added patches:
  * hunspell-emacs-utf8.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1459771200">- Version update to 1.3.4:
  * Various updates to the buildsystem
  * Various werror bugfixes
  * Loads of coverity fixes
- Add patch to build with grep 2.24:
  * hunspell-grep2.24.patch
- Remove upstreamed patch:
  * hunspell-emacs-utf8.patch
- Do not search for translations - broken automake from upstream
  * Not worth fixing only bit italian and mostly hungarian translations
    for cli anyway</changelog>
  <changelog author="mpluskal@suse.com" date="1461067200">- Update to 1.4.0
  * New release that strips out fixed length buffers from large
    parts of the library
  * Note: dictmgr.hxx header is dropped
- Drop upstreamed hunspell-grep2.24.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1462363200">- Update to 1.4.1:
  * Past begin() iterator decrement error
  * VS Debug build threw error on decrement past begin.
- Split shared library
- Do not call autoreconf
- Move manpages to corresponding packages</changelog>
  <changelog author="mpluskal@suse.com" date="1462968000">- Update baselibs.conf bnc#977784
- Add conflicts to hunspell 1.4.0</changelog>
  <changelog author="jengelh@inai.de" date="1463486400">- Drop Requires: pkgconfig because this is already autodetected
  by rpm. Use mode inheritance for defattr. Edit rpm group and
  description a tiny bit.</changelog>
  <changelog author="pgajdos@suse.com" date="1479729600">- update to 1.5.0:
  * Lot of stability fixes
  * Fixed compilation errors on various systems (Windows, FreeBSD)
  * Small performance improvement compared to 1.4.0
  * API is same as 1.4.</changelog>
  <changelog author="pgajdos@suse.com" date="1480593600">- update to 1.5.4:
  * fix API compatibility with 1.4</changelog>
  <changelog author="mpluskal@suse.com" date="1482494400">- Update to version 1.6.0:
  * Changes in the library:
    + Performance improvement in ngsuggest(), suggestions should be
    faster.
    + Revert MAXWORDLEN to 100 as in 1.3.3 for performance reasons.
    + MAXWORDLEN can be set during build time with -D defines.
    + Fix crash when word with 102 consecutive X is spelled.
  * Changes in the command line tool:
    + -D shows all loaded dictionares insted of only the first.
    + -D properly lists all available dictionaries on Windows.</changelog>
  <changelog author="mpluskal@suse.com" date="1496836800">- Update to version 1.6.1:
  * Library changes:
    + Performance improvements in suggest()
    + Fixes regressions for Hungarian related to compounding.
    + Fixes regressions for Korean related to ICONV.
  * Command line tool:
    + Added Tajik translation
    + Fix regarding serching of OOo dicts installed in user folder
  * Manpages:
    + Fix microsoft-cp1251 to cp1251. Dicts should not use the
    first.
    + Typos.</changelog>
  <changelog author="mpluskal@suse.com" date="1509105600">- Update to version 1.6.2:
  * Command line tool:
    + Added German translation
    + Fixed bug with wrong output encoding, not respecting system
    locale.</changelog>
  <changelog author="pgajdos@suse.com" date="1591704000">- security update
- added patches
  fix CVE-2019-16707 [bsc#1151867], invalid read operation in SuggestMgr:leftcommonsubstring in suggestmgr.cxx
  + hunspell-CVE-2019-16707.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1641470400">- suggests english directory [bsc#1193627]</changelog>
</package>
<package pkgid="7fcdb5e5d9e1fd642682902e0f5b33168e5c34cbba4b38c6488915e688c2dc41" name="hunspell" arch="x86_64">
  <version epoch="0" ver="1.6.2" rel="3.8.1"/>
  <changelog author="tchvatal@suse.com" date="1459771200">- Version update to 1.3.4:
  * Various updates to the buildsystem
  * Various werror bugfixes
  * Loads of coverity fixes
- Add patch to build with grep 2.24:
  * hunspell-grep2.24.patch
- Remove upstreamed patch:
  * hunspell-emacs-utf8.patch
- Do not search for translations - broken automake from upstream
  * Not worth fixing only bit italian and mostly hungarian translations
    for cli anyway</changelog>
  <changelog author="mpluskal@suse.com" date="1461067200">- Update to 1.4.0
  * New release that strips out fixed length buffers from large
    parts of the library
  * Note: dictmgr.hxx header is dropped
- Drop upstreamed hunspell-grep2.24.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1462363200">- Update to 1.4.1:
  * Past begin() iterator decrement error
  * VS Debug build threw error on decrement past begin.
- Split shared library
- Do not call autoreconf
- Move manpages to corresponding packages</changelog>
  <changelog author="mpluskal@suse.com" date="1462968000">- Update baselibs.conf bnc#977784
- Add conflicts to hunspell 1.4.0</changelog>
  <changelog author="jengelh@inai.de" date="1463486400">- Drop Requires: pkgconfig because this is already autodetected
  by rpm. Use mode inheritance for defattr. Edit rpm group and
  description a tiny bit.</changelog>
  <changelog author="pgajdos@suse.com" date="1479729600">- update to 1.5.0:
  * Lot of stability fixes
  * Fixed compilation errors on various systems (Windows, FreeBSD)
  * Small performance improvement compared to 1.4.0
  * API is same as 1.4.</changelog>
  <changelog author="pgajdos@suse.com" date="1480593600">- update to 1.5.4:
  * fix API compatibility with 1.4</changelog>
  <changelog author="mpluskal@suse.com" date="1482494400">- Update to version 1.6.0:
  * Changes in the library:
    + Performance improvement in ngsuggest(), suggestions should be
    faster.
    + Revert MAXWORDLEN to 100 as in 1.3.3 for performance reasons.
    + MAXWORDLEN can be set during build time with -D defines.
    + Fix crash when word with 102 consecutive X is spelled.
  * Changes in the command line tool:
    + -D shows all loaded dictionares insted of only the first.
    + -D properly lists all available dictionaries on Windows.</changelog>
  <changelog author="mpluskal@suse.com" date="1496836800">- Update to version 1.6.1:
  * Library changes:
    + Performance improvements in suggest()
    + Fixes regressions for Hungarian related to compounding.
    + Fixes regressions for Korean related to ICONV.
  * Command line tool:
    + Added Tajik translation
    + Fix regarding serching of OOo dicts installed in user folder
  * Manpages:
    + Fix microsoft-cp1251 to cp1251. Dicts should not use the
    first.
    + Typos.</changelog>
  <changelog author="mpluskal@suse.com" date="1509105600">- Update to version 1.6.2:
  * Command line tool:
    + Added German translation
    + Fixed bug with wrong output encoding, not respecting system
    locale.</changelog>
  <changelog author="pgajdos@suse.com" date="1591704000">- security update
- added patches
  fix CVE-2019-16707 [bsc#1151867], invalid read operation in SuggestMgr:leftcommonsubstring in suggestmgr.cxx
  + hunspell-CVE-2019-16707.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1641470400">- suggests english directory [bsc#1193627]</changelog>
</package>
<package pkgid="42d882cd7a6630456b2c1872378648ac2f960b2b6b8a036f947927953b8f727b" name="hunspell-devel" arch="aarch64">
  <version epoch="0" ver="1.6.2" rel="3.8.1"/>
  <changelog author="tchvatal@suse.com" date="1459771200">- Version update to 1.3.4:
  * Various updates to the buildsystem
  * Various werror bugfixes
  * Loads of coverity fixes
- Add patch to build with grep 2.24:
  * hunspell-grep2.24.patch
- Remove upstreamed patch:
  * hunspell-emacs-utf8.patch
- Do not search for translations - broken automake from upstream
  * Not worth fixing only bit italian and mostly hungarian translations
    for cli anyway</changelog>
  <changelog author="mpluskal@suse.com" date="1461067200">- Update to 1.4.0
  * New release that strips out fixed length buffers from large
    parts of the library
  * Note: dictmgr.hxx header is dropped
- Drop upstreamed hunspell-grep2.24.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1462363200">- Update to 1.4.1:
  * Past begin() iterator decrement error
  * VS Debug build threw error on decrement past begin.
- Split shared library
- Do not call autoreconf
- Move manpages to corresponding packages</changelog>
  <changelog author="mpluskal@suse.com" date="1462968000">- Update baselibs.conf bnc#977784
- Add conflicts to hunspell 1.4.0</changelog>
  <changelog author="jengelh@inai.de" date="1463486400">- Drop Requires: pkgconfig because this is already autodetected
  by rpm. Use mode inheritance for defattr. Edit rpm group and
  description a tiny bit.</changelog>
  <changelog author="pgajdos@suse.com" date="1479729600">- update to 1.5.0:
  * Lot of stability fixes
  * Fixed compilation errors on various systems (Windows, FreeBSD)
  * Small performance improvement compared to 1.4.0
  * API is same as 1.4.</changelog>
  <changelog author="pgajdos@suse.com" date="1480593600">- update to 1.5.4:
  * fix API compatibility with 1.4</changelog>
  <changelog author="mpluskal@suse.com" date="1482494400">- Update to version 1.6.0:
  * Changes in the library:
    + Performance improvement in ngsuggest(), suggestions should be
    faster.
    + Revert MAXWORDLEN to 100 as in 1.3.3 for performance reasons.
    + MAXWORDLEN can be set during build time with -D defines.
    + Fix crash when word with 102 consecutive X is spelled.
  * Changes in the command line tool:
    + -D shows all loaded dictionares insted of only the first.
    + -D properly lists all available dictionaries on Windows.</changelog>
  <changelog author="mpluskal@suse.com" date="1496836800">- Update to version 1.6.1:
  * Library changes:
    + Performance improvements in suggest()
    + Fixes regressions for Hungarian related to compounding.
    + Fixes regressions for Korean related to ICONV.
  * Command line tool:
    + Added Tajik translation
    + Fix regarding serching of OOo dicts installed in user folder
  * Manpages:
    + Fix microsoft-cp1251 to cp1251. Dicts should not use the
    first.
    + Typos.</changelog>
  <changelog author="mpluskal@suse.com" date="1509105600">- Update to version 1.6.2:
  * Command line tool:
    + Added German translation
    + Fixed bug with wrong output encoding, not respecting system
    locale.</changelog>
  <changelog author="pgajdos@suse.com" date="1591704000">- security update
- added patches
  fix CVE-2019-16707 [bsc#1151867], invalid read operation in SuggestMgr:leftcommonsubstring in suggestmgr.cxx
  + hunspell-CVE-2019-16707.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1641470400">- suggests english directory [bsc#1193627]</changelog>
</package>
<package pkgid="afbdfc73a188e41dff3f3499deb1ffb9257ede0e4daec791d10cc60697f6d80e" name="hunspell-devel" arch="ppc64le">
  <version epoch="0" ver="1.6.2" rel="3.8.1"/>
  <changelog author="tchvatal@suse.com" date="1459771200">- Version update to 1.3.4:
  * Various updates to the buildsystem
  * Various werror bugfixes
  * Loads of coverity fixes
- Add patch to build with grep 2.24:
  * hunspell-grep2.24.patch
- Remove upstreamed patch:
  * hunspell-emacs-utf8.patch
- Do not search for translations - broken automake from upstream
  * Not worth fixing only bit italian and mostly hungarian translations
    for cli anyway</changelog>
  <changelog author="mpluskal@suse.com" date="1461067200">- Update to 1.4.0
  * New release that strips out fixed length buffers from large
    parts of the library
  * Note: dictmgr.hxx header is dropped
- Drop upstreamed hunspell-grep2.24.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1462363200">- Update to 1.4.1:
  * Past begin() iterator decrement error
  * VS Debug build threw error on decrement past begin.
- Split shared library
- Do not call autoreconf
- Move manpages to corresponding packages</changelog>
  <changelog author="mpluskal@suse.com" date="1462968000">- Update baselibs.conf bnc#977784
- Add conflicts to hunspell 1.4.0</changelog>
  <changelog author="jengelh@inai.de" date="1463486400">- Drop Requires: pkgconfig because this is already autodetected
  by rpm. Use mode inheritance for defattr. Edit rpm group and
  description a tiny bit.</changelog>
  <changelog author="pgajdos@suse.com" date="1479729600">- update to 1.5.0:
  * Lot of stability fixes
  * Fixed compilation errors on various systems (Windows, FreeBSD)
  * Small performance improvement compared to 1.4.0
  * API is same as 1.4.</changelog>
  <changelog author="pgajdos@suse.com" date="1480593600">- update to 1.5.4:
  * fix API compatibility with 1.4</changelog>
  <changelog author="mpluskal@suse.com" date="1482494400">- Update to version 1.6.0:
  * Changes in the library:
    + Performance improvement in ngsuggest(), suggestions should be
    faster.
    + Revert MAXWORDLEN to 100 as in 1.3.3 for performance reasons.
    + MAXWORDLEN can be set during build time with -D defines.
    + Fix crash when word with 102 consecutive X is spelled.
  * Changes in the command line tool:
    + -D shows all loaded dictionares insted of only the first.
    + -D properly lists all available dictionaries on Windows.</changelog>
  <changelog author="mpluskal@suse.com" date="1496836800">- Update to version 1.6.1:
  * Library changes:
    + Performance improvements in suggest()
    + Fixes regressions for Hungarian related to compounding.
    + Fixes regressions for Korean related to ICONV.
  * Command line tool:
    + Added Tajik translation
    + Fix regarding serching of OOo dicts installed in user folder
  * Manpages:
    + Fix microsoft-cp1251 to cp1251. Dicts should not use the
    first.
    + Typos.</changelog>
  <changelog author="mpluskal@suse.com" date="1509105600">- Update to version 1.6.2:
  * Command line tool:
    + Added German translation
    + Fixed bug with wrong output encoding, not respecting system
    locale.</changelog>
  <changelog author="pgajdos@suse.com" date="1591704000">- security update
- added patches
  fix CVE-2019-16707 [bsc#1151867], invalid read operation in SuggestMgr:leftcommonsubstring in suggestmgr.cxx
  + hunspell-CVE-2019-16707.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1641470400">- suggests english directory [bsc#1193627]</changelog>
</package>
<package pkgid="7114f176013c0d950795861891e7907e52cec4eb947cd6f21f24336d43b5e90b" name="hunspell-devel" arch="s390x">
  <version epoch="0" ver="1.6.2" rel="3.8.1"/>
  <changelog author="tchvatal@suse.com" date="1459771200">- Version update to 1.3.4:
  * Various updates to the buildsystem
  * Various werror bugfixes
  * Loads of coverity fixes
- Add patch to build with grep 2.24:
  * hunspell-grep2.24.patch
- Remove upstreamed patch:
  * hunspell-emacs-utf8.patch
- Do not search for translations - broken automake from upstream
  * Not worth fixing only bit italian and mostly hungarian translations
    for cli anyway</changelog>
  <changelog author="mpluskal@suse.com" date="1461067200">- Update to 1.4.0
  * New release that strips out fixed length buffers from large
    parts of the library
  * Note: dictmgr.hxx header is dropped
- Drop upstreamed hunspell-grep2.24.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1462363200">- Update to 1.4.1:
  * Past begin() iterator decrement error
  * VS Debug build threw error on decrement past begin.
- Split shared library
- Do not call autoreconf
- Move manpages to corresponding packages</changelog>
  <changelog author="mpluskal@suse.com" date="1462968000">- Update baselibs.conf bnc#977784
- Add conflicts to hunspell 1.4.0</changelog>
  <changelog author="jengelh@inai.de" date="1463486400">- Drop Requires: pkgconfig because this is already autodetected
  by rpm. Use mode inheritance for defattr. Edit rpm group and
  description a tiny bit.</changelog>
  <changelog author="pgajdos@suse.com" date="1479729600">- update to 1.5.0:
  * Lot of stability fixes
  * Fixed compilation errors on various systems (Windows, FreeBSD)
  * Small performance improvement compared to 1.4.0
  * API is same as 1.4.</changelog>
  <changelog author="pgajdos@suse.com" date="1480593600">- update to 1.5.4:
  * fix API compatibility with 1.4</changelog>
  <changelog author="mpluskal@suse.com" date="1482494400">- Update to version 1.6.0:
  * Changes in the library:
    + Performance improvement in ngsuggest(), suggestions should be
    faster.
    + Revert MAXWORDLEN to 100 as in 1.3.3 for performance reasons.
    + MAXWORDLEN can be set during build time with -D defines.
    + Fix crash when word with 102 consecutive X is spelled.
  * Changes in the command line tool:
    + -D shows all loaded dictionares insted of only the first.
    + -D properly lists all available dictionaries on Windows.</changelog>
  <changelog author="mpluskal@suse.com" date="1496836800">- Update to version 1.6.1:
  * Library changes:
    + Performance improvements in suggest()
    + Fixes regressions for Hungarian related to compounding.
    + Fixes regressions for Korean related to ICONV.
  * Command line tool:
    + Added Tajik translation
    + Fix regarding serching of OOo dicts installed in user folder
  * Manpages:
    + Fix microsoft-cp1251 to cp1251. Dicts should not use the
    first.
    + Typos.</changelog>
  <changelog author="mpluskal@suse.com" date="1509105600">- Update to version 1.6.2:
  * Command line tool:
    + Added German translation
    + Fixed bug with wrong output encoding, not respecting system
    locale.</changelog>
  <changelog author="pgajdos@suse.com" date="1591704000">- security update
- added patches
  fix CVE-2019-16707 [bsc#1151867], invalid read operation in SuggestMgr:leftcommonsubstring in suggestmgr.cxx
  + hunspell-CVE-2019-16707.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1641470400">- suggests english directory [bsc#1193627]</changelog>
</package>
<package pkgid="a3a579bc1f91108af8b1a3b302d69035e2e9419052313eefc51dbab8ead90215" name="hunspell-devel" arch="x86_64">
  <version epoch="0" ver="1.6.2" rel="3.8.1"/>
  <changelog author="tchvatal@suse.com" date="1459771200">- Version update to 1.3.4:
  * Various updates to the buildsystem
  * Various werror bugfixes
  * Loads of coverity fixes
- Add patch to build with grep 2.24:
  * hunspell-grep2.24.patch
- Remove upstreamed patch:
  * hunspell-emacs-utf8.patch
- Do not search for translations - broken automake from upstream
  * Not worth fixing only bit italian and mostly hungarian translations
    for cli anyway</changelog>
  <changelog author="mpluskal@suse.com" date="1461067200">- Update to 1.4.0
  * New release that strips out fixed length buffers from large
    parts of the library
  * Note: dictmgr.hxx header is dropped
- Drop upstreamed hunspell-grep2.24.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1462363200">- Update to 1.4.1:
  * Past begin() iterator decrement error
  * VS Debug build threw error on decrement past begin.
- Split shared library
- Do not call autoreconf
- Move manpages to corresponding packages</changelog>
  <changelog author="mpluskal@suse.com" date="1462968000">- Update baselibs.conf bnc#977784
- Add conflicts to hunspell 1.4.0</changelog>
  <changelog author="jengelh@inai.de" date="1463486400">- Drop Requires: pkgconfig because this is already autodetected
  by rpm. Use mode inheritance for defattr. Edit rpm group and
  description a tiny bit.</changelog>
  <changelog author="pgajdos@suse.com" date="1479729600">- update to 1.5.0:
  * Lot of stability fixes
  * Fixed compilation errors on various systems (Windows, FreeBSD)
  * Small performance improvement compared to 1.4.0
  * API is same as 1.4.</changelog>
  <changelog author="pgajdos@suse.com" date="1480593600">- update to 1.5.4:
  * fix API compatibility with 1.4</changelog>
  <changelog author="mpluskal@suse.com" date="1482494400">- Update to version 1.6.0:
  * Changes in the library:
    + Performance improvement in ngsuggest(), suggestions should be
    faster.
    + Revert MAXWORDLEN to 100 as in 1.3.3 for performance reasons.
    + MAXWORDLEN can be set during build time with -D defines.
    + Fix crash when word with 102 consecutive X is spelled.
  * Changes in the command line tool:
    + -D shows all loaded dictionares insted of only the first.
    + -D properly lists all available dictionaries on Windows.</changelog>
  <changelog author="mpluskal@suse.com" date="1496836800">- Update to version 1.6.1:
  * Library changes:
    + Performance improvements in suggest()
    + Fixes regressions for Hungarian related to compounding.
    + Fixes regressions for Korean related to ICONV.
  * Command line tool:
    + Added Tajik translation
    + Fix regarding serching of OOo dicts installed in user folder
  * Manpages:
    + Fix microsoft-cp1251 to cp1251. Dicts should not use the
    first.
    + Typos.</changelog>
  <changelog author="mpluskal@suse.com" date="1509105600">- Update to version 1.6.2:
  * Command line tool:
    + Added German translation
    + Fixed bug with wrong output encoding, not respecting system
    locale.</changelog>
  <changelog author="pgajdos@suse.com" date="1591704000">- security update
- added patches
  fix CVE-2019-16707 [bsc#1151867], invalid read operation in SuggestMgr:leftcommonsubstring in suggestmgr.cxx
  + hunspell-CVE-2019-16707.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1641470400">- suggests english directory [bsc#1193627]</changelog>
</package>
<package pkgid="7d0ded5282698a9f25d5401228c3107ba4538659c80b6e15d7d4284e4a9f0c28" name="hunspell-devel-32bit" arch="x86_64">
  <version epoch="0" ver="1.6.2" rel="3.8.1"/>
  <changelog author="tchvatal@suse.com" date="1459771200">- Version update to 1.3.4:
  * Various updates to the buildsystem
  * Various werror bugfixes
  * Loads of coverity fixes
- Add patch to build with grep 2.24:
  * hunspell-grep2.24.patch
- Remove upstreamed patch:
  * hunspell-emacs-utf8.patch
- Do not search for translations - broken automake from upstream
  * Not worth fixing only bit italian and mostly hungarian translations
    for cli anyway</changelog>
  <changelog author="mpluskal@suse.com" date="1461067200">- Update to 1.4.0
  * New release that strips out fixed length buffers from large
    parts of the library
  * Note: dictmgr.hxx header is dropped
- Drop upstreamed hunspell-grep2.24.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1462363200">- Update to 1.4.1:
  * Past begin() iterator decrement error
  * VS Debug build threw error on decrement past begin.
- Split shared library
- Do not call autoreconf
- Move manpages to corresponding packages</changelog>
  <changelog author="mpluskal@suse.com" date="1462968000">- Update baselibs.conf bnc#977784
- Add conflicts to hunspell 1.4.0</changelog>
  <changelog author="jengelh@inai.de" date="1463486400">- Drop Requires: pkgconfig because this is already autodetected
  by rpm. Use mode inheritance for defattr. Edit rpm group and
  description a tiny bit.</changelog>
  <changelog author="pgajdos@suse.com" date="1479729600">- update to 1.5.0:
  * Lot of stability fixes
  * Fixed compilation errors on various systems (Windows, FreeBSD)
  * Small performance improvement compared to 1.4.0
  * API is same as 1.4.</changelog>
  <changelog author="pgajdos@suse.com" date="1480593600">- update to 1.5.4:
  * fix API compatibility with 1.4</changelog>
  <changelog author="mpluskal@suse.com" date="1482494400">- Update to version 1.6.0:
  * Changes in the library:
    + Performance improvement in ngsuggest(), suggestions should be
    faster.
    + Revert MAXWORDLEN to 100 as in 1.3.3 for performance reasons.
    + MAXWORDLEN can be set during build time with -D defines.
    + Fix crash when word with 102 consecutive X is spelled.
  * Changes in the command line tool:
    + -D shows all loaded dictionares insted of only the first.
    + -D properly lists all available dictionaries on Windows.</changelog>
  <changelog author="mpluskal@suse.com" date="1496836800">- Update to version 1.6.1:
  * Library changes:
    + Performance improvements in suggest()
    + Fixes regressions for Hungarian related to compounding.
    + Fixes regressions for Korean related to ICONV.
  * Command line tool:
    + Added Tajik translation
    + Fix regarding serching of OOo dicts installed in user folder
  * Manpages:
    + Fix microsoft-cp1251 to cp1251. Dicts should not use the
    first.
    + Typos.</changelog>
  <changelog author="mpluskal@suse.com" date="1509105600">- Update to version 1.6.2:
  * Command line tool:
    + Added German translation
    + Fixed bug with wrong output encoding, not respecting system
    locale.</changelog>
  <changelog author="pgajdos@suse.com" date="1591704000">- security update
- added patches
  fix CVE-2019-16707 [bsc#1151867], invalid read operation in SuggestMgr:leftcommonsubstring in suggestmgr.cxx
  + hunspell-CVE-2019-16707.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1641470400">- suggests english directory [bsc#1193627]</changelog>
</package>
<package pkgid="6c3db7b8cfb461fc7b36d6241595b59fa0ced01de8bb5a528c42c567fac16062" name="hunspell-tools" arch="aarch64">
  <version epoch="0" ver="1.6.2" rel="3.8.1"/>
  <changelog author="tchvatal@suse.com" date="1459771200">- Version update to 1.3.4:
  * Various updates to the buildsystem
  * Various werror bugfixes
  * Loads of coverity fixes
- Add patch to build with grep 2.24:
  * hunspell-grep2.24.patch
- Remove upstreamed patch:
  * hunspell-emacs-utf8.patch
- Do not search for translations - broken automake from upstream
  * Not worth fixing only bit italian and mostly hungarian translations
    for cli anyway</changelog>
  <changelog author="mpluskal@suse.com" date="1461067200">- Update to 1.4.0
  * New release that strips out fixed length buffers from large
    parts of the library
  * Note: dictmgr.hxx header is dropped
- Drop upstreamed hunspell-grep2.24.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1462363200">- Update to 1.4.1:
  * Past begin() iterator decrement error
  * VS Debug build threw error on decrement past begin.
- Split shared library
- Do not call autoreconf
- Move manpages to corresponding packages</changelog>
  <changelog author="mpluskal@suse.com" date="1462968000">- Update baselibs.conf bnc#977784
- Add conflicts to hunspell 1.4.0</changelog>
  <changelog author="jengelh@inai.de" date="1463486400">- Drop Requires: pkgconfig because this is already autodetected
  by rpm. Use mode inheritance for defattr. Edit rpm group and
  description a tiny bit.</changelog>
  <changelog author="pgajdos@suse.com" date="1479729600">- update to 1.5.0:
  * Lot of stability fixes
  * Fixed compilation errors on various systems (Windows, FreeBSD)
  * Small performance improvement compared to 1.4.0
  * API is same as 1.4.</changelog>
  <changelog author="pgajdos@suse.com" date="1480593600">- update to 1.5.4:
  * fix API compatibility with 1.4</changelog>
  <changelog author="mpluskal@suse.com" date="1482494400">- Update to version 1.6.0:
  * Changes in the library:
    + Performance improvement in ngsuggest(), suggestions should be
    faster.
    + Revert MAXWORDLEN to 100 as in 1.3.3 for performance reasons.
    + MAXWORDLEN can be set during build time with -D defines.
    + Fix crash when word with 102 consecutive X is spelled.
  * Changes in the command line tool:
    + -D shows all loaded dictionares insted of only the first.
    + -D properly lists all available dictionaries on Windows.</changelog>
  <changelog author="mpluskal@suse.com" date="1496836800">- Update to version 1.6.1:
  * Library changes:
    + Performance improvements in suggest()
    + Fixes regressions for Hungarian related to compounding.
    + Fixes regressions for Korean related to ICONV.
  * Command line tool:
    + Added Tajik translation
    + Fix regarding serching of OOo dicts installed in user folder
  * Manpages:
    + Fix microsoft-cp1251 to cp1251. Dicts should not use the
    first.
    + Typos.</changelog>
  <changelog author="mpluskal@suse.com" date="1509105600">- Update to version 1.6.2:
  * Command line tool:
    + Added German translation
    + Fixed bug with wrong output encoding, not respecting system
    locale.</changelog>
  <changelog author="pgajdos@suse.com" date="1591704000">- security update
- added patches
  fix CVE-2019-16707 [bsc#1151867], invalid read operation in SuggestMgr:leftcommonsubstring in suggestmgr.cxx
  + hunspell-CVE-2019-16707.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1641470400">- suggests english directory [bsc#1193627]</changelog>
</package>
<package pkgid="996b08ba0c10aa8fb5b6501e523e2c02d72ede75fb271b0aacbd5c46e87598ba" name="hunspell-tools" arch="ppc64le">
  <version epoch="0" ver="1.6.2" rel="3.8.1"/>
  <changelog author="tchvatal@suse.com" date="1459771200">- Version update to 1.3.4:
  * Various updates to the buildsystem
  * Various werror bugfixes
  * Loads of coverity fixes
- Add patch to build with grep 2.24:
  * hunspell-grep2.24.patch
- Remove upstreamed patch:
  * hunspell-emacs-utf8.patch
- Do not search for translations - broken automake from upstream
  * Not worth fixing only bit italian and mostly hungarian translations
    for cli anyway</changelog>
  <changelog author="mpluskal@suse.com" date="1461067200">- Update to 1.4.0
  * New release that strips out fixed length buffers from large
    parts of the library
  * Note: dictmgr.hxx header is dropped
- Drop upstreamed hunspell-grep2.24.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1462363200">- Update to 1.4.1:
  * Past begin() iterator decrement error
  * VS Debug build threw error on decrement past begin.
- Split shared library
- Do not call autoreconf
- Move manpages to corresponding packages</changelog>
  <changelog author="mpluskal@suse.com" date="1462968000">- Update baselibs.conf bnc#977784
- Add conflicts to hunspell 1.4.0</changelog>
  <changelog author="jengelh@inai.de" date="1463486400">- Drop Requires: pkgconfig because this is already autodetected
  by rpm. Use mode inheritance for defattr. Edit rpm group and
  description a tiny bit.</changelog>
  <changelog author="pgajdos@suse.com" date="1479729600">- update to 1.5.0:
  * Lot of stability fixes
  * Fixed compilation errors on various systems (Windows, FreeBSD)
  * Small performance improvement compared to 1.4.0
  * API is same as 1.4.</changelog>
  <changelog author="pgajdos@suse.com" date="1480593600">- update to 1.5.4:
  * fix API compatibility with 1.4</changelog>
  <changelog author="mpluskal@suse.com" date="1482494400">- Update to version 1.6.0:
  * Changes in the library:
    + Performance improvement in ngsuggest(), suggestions should be
    faster.
    + Revert MAXWORDLEN to 100 as in 1.3.3 for performance reasons.
    + MAXWORDLEN can be set during build time with -D defines.
    + Fix crash when word with 102 consecutive X is spelled.
  * Changes in the command line tool:
    + -D shows all loaded dictionares insted of only the first.
    + -D properly lists all available dictionaries on Windows.</changelog>
  <changelog author="mpluskal@suse.com" date="1496836800">- Update to version 1.6.1:
  * Library changes:
    + Performance improvements in suggest()
    + Fixes regressions for Hungarian related to compounding.
    + Fixes regressions for Korean related to ICONV.
  * Command line tool:
    + Added Tajik translation
    + Fix regarding serching of OOo dicts installed in user folder
  * Manpages:
    + Fix microsoft-cp1251 to cp1251. Dicts should not use the
    first.
    + Typos.</changelog>
  <changelog author="mpluskal@suse.com" date="1509105600">- Update to version 1.6.2:
  * Command line tool:
    + Added German translation
    + Fixed bug with wrong output encoding, not respecting system
    locale.</changelog>
  <changelog author="pgajdos@suse.com" date="1591704000">- security update
- added patches
  fix CVE-2019-16707 [bsc#1151867], invalid read operation in SuggestMgr:leftcommonsubstring in suggestmgr.cxx
  + hunspell-CVE-2019-16707.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1641470400">- suggests english directory [bsc#1193627]</changelog>
</package>
<package pkgid="23a5a57bd035be1c7e0a0270c9aaa4f8a2650c66a41b935bf088720bee971541" name="hunspell-tools" arch="s390x">
  <version epoch="0" ver="1.6.2" rel="3.8.1"/>
  <changelog author="tchvatal@suse.com" date="1459771200">- Version update to 1.3.4:
  * Various updates to the buildsystem
  * Various werror bugfixes
  * Loads of coverity fixes
- Add patch to build with grep 2.24:
  * hunspell-grep2.24.patch
- Remove upstreamed patch:
  * hunspell-emacs-utf8.patch
- Do not search for translations - broken automake from upstream
  * Not worth fixing only bit italian and mostly hungarian translations
    for cli anyway</changelog>
  <changelog author="mpluskal@suse.com" date="1461067200">- Update to 1.4.0
  * New release that strips out fixed length buffers from large
    parts of the library
  * Note: dictmgr.hxx header is dropped
- Drop upstreamed hunspell-grep2.24.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1462363200">- Update to 1.4.1:
  * Past begin() iterator decrement error
  * VS Debug build threw error on decrement past begin.
- Split shared library
- Do not call autoreconf
- Move manpages to corresponding packages</changelog>
  <changelog author="mpluskal@suse.com" date="1462968000">- Update baselibs.conf bnc#977784
- Add conflicts to hunspell 1.4.0</changelog>
  <changelog author="jengelh@inai.de" date="1463486400">- Drop Requires: pkgconfig because this is already autodetected
  by rpm. Use mode inheritance for defattr. Edit rpm group and
  description a tiny bit.</changelog>
  <changelog author="pgajdos@suse.com" date="1479729600">- update to 1.5.0:
  * Lot of stability fixes
  * Fixed compilation errors on various systems (Windows, FreeBSD)
  * Small performance improvement compared to 1.4.0
  * API is same as 1.4.</changelog>
  <changelog author="pgajdos@suse.com" date="1480593600">- update to 1.5.4:
  * fix API compatibility with 1.4</changelog>
  <changelog author="mpluskal@suse.com" date="1482494400">- Update to version 1.6.0:
  * Changes in the library:
    + Performance improvement in ngsuggest(), suggestions should be
    faster.
    + Revert MAXWORDLEN to 100 as in 1.3.3 for performance reasons.
    + MAXWORDLEN can be set during build time with -D defines.
    + Fix crash when word with 102 consecutive X is spelled.
  * Changes in the command line tool:
    + -D shows all loaded dictionares insted of only the first.
    + -D properly lists all available dictionaries on Windows.</changelog>
  <changelog author="mpluskal@suse.com" date="1496836800">- Update to version 1.6.1:
  * Library changes:
    + Performance improvements in suggest()
    + Fixes regressions for Hungarian related to compounding.
    + Fixes regressions for Korean related to ICONV.
  * Command line tool:
    + Added Tajik translation
    + Fix regarding serching of OOo dicts installed in user folder
  * Manpages:
    + Fix microsoft-cp1251 to cp1251. Dicts should not use the
    first.
    + Typos.</changelog>
  <changelog author="mpluskal@suse.com" date="1509105600">- Update to version 1.6.2:
  * Command line tool:
    + Added German translation
    + Fixed bug with wrong output encoding, not respecting system
    locale.</changelog>
  <changelog author="pgajdos@suse.com" date="1591704000">- security update
- added patches
  fix CVE-2019-16707 [bsc#1151867], invalid read operation in SuggestMgr:leftcommonsubstring in suggestmgr.cxx
  + hunspell-CVE-2019-16707.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1641470400">- suggests english directory [bsc#1193627]</changelog>
</package>
<package pkgid="6fb2fc75fc2f416d13deee55382a3009f1073a60134ba0d217b87ea06dfb2b75" name="hunspell-tools" arch="x86_64">
  <version epoch="0" ver="1.6.2" rel="3.8.1"/>
  <changelog author="tchvatal@suse.com" date="1459771200">- Version update to 1.3.4:
  * Various updates to the buildsystem
  * Various werror bugfixes
  * Loads of coverity fixes
- Add patch to build with grep 2.24:
  * hunspell-grep2.24.patch
- Remove upstreamed patch:
  * hunspell-emacs-utf8.patch
- Do not search for translations - broken automake from upstream
  * Not worth fixing only bit italian and mostly hungarian translations
    for cli anyway</changelog>
  <changelog author="mpluskal@suse.com" date="1461067200">- Update to 1.4.0
  * New release that strips out fixed length buffers from large
    parts of the library
  * Note: dictmgr.hxx header is dropped
- Drop upstreamed hunspell-grep2.24.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1462363200">- Update to 1.4.1:
  * Past begin() iterator decrement error
  * VS Debug build threw error on decrement past begin.
- Split shared library
- Do not call autoreconf
- Move manpages to corresponding packages</changelog>
  <changelog author="mpluskal@suse.com" date="1462968000">- Update baselibs.conf bnc#977784
- Add conflicts to hunspell 1.4.0</changelog>
  <changelog author="jengelh@inai.de" date="1463486400">- Drop Requires: pkgconfig because this is already autodetected
  by rpm. Use mode inheritance for defattr. Edit rpm group and
  description a tiny bit.</changelog>
  <changelog author="pgajdos@suse.com" date="1479729600">- update to 1.5.0:
  * Lot of stability fixes
  * Fixed compilation errors on various systems (Windows, FreeBSD)
  * Small performance improvement compared to 1.4.0
  * API is same as 1.4.</changelog>
  <changelog author="pgajdos@suse.com" date="1480593600">- update to 1.5.4:
  * fix API compatibility with 1.4</changelog>
  <changelog author="mpluskal@suse.com" date="1482494400">- Update to version 1.6.0:
  * Changes in the library:
    + Performance improvement in ngsuggest(), suggestions should be
    faster.
    + Revert MAXWORDLEN to 100 as in 1.3.3 for performance reasons.
    + MAXWORDLEN can be set during build time with -D defines.
    + Fix crash when word with 102 consecutive X is spelled.
  * Changes in the command line tool:
    + -D shows all loaded dictionares insted of only the first.
    + -D properly lists all available dictionaries on Windows.</changelog>
  <changelog author="mpluskal@suse.com" date="1496836800">- Update to version 1.6.1:
  * Library changes:
    + Performance improvements in suggest()
    + Fixes regressions for Hungarian related to compounding.
    + Fixes regressions for Korean related to ICONV.
  * Command line tool:
    + Added Tajik translation
    + Fix regarding serching of OOo dicts installed in user folder
  * Manpages:
    + Fix microsoft-cp1251 to cp1251. Dicts should not use the
    first.
    + Typos.</changelog>
  <changelog author="mpluskal@suse.com" date="1509105600">- Update to version 1.6.2:
  * Command line tool:
    + Added German translation
    + Fixed bug with wrong output encoding, not respecting system
    locale.</changelog>
  <changelog author="pgajdos@suse.com" date="1591704000">- security update
- added patches
  fix CVE-2019-16707 [bsc#1151867], invalid read operation in SuggestMgr:leftcommonsubstring in suggestmgr.cxx
  + hunspell-CVE-2019-16707.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1641470400">- suggests english directory [bsc#1193627]</changelog>
</package>
<package pkgid="41233edb6e9a63647fb56aef7dd172a5b5709e188c5874de513f46996cd4013f" name="hwdata" arch="noarch">
  <version epoch="0" ver="0.355" rel="3.39.1"/>
  <changelog author="mpluskal@suse.com" date="1594900800">- Update to version 0.337:
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1597147200">- Update to version 0.338:
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1600084800">- Update to version 0.339:
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1602158400">- Update to version 0.340:
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1604577600">- Update to version 0.341:
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1607342400">- Update to version 0.342:
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1609934400">- Update to version 0.343:
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1610020800">- Add merge-pciids.pl to fully duplicate behavior of pciutils-ids
  * Resolves SLE issue bsc#1180422 bsc#1180482</changelog>
  <changelog author="mpluskal@suse.com" date="1612267200">- Update to version 0.344:
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1614600000">- Update to version 0.345:
  + Updated pci, usb and vendor ids.
  + Resolves boo#1182482 jsc#SLE-13791 bnc#1170160</changelog>
  <changelog author="mpluskal@suse.com" date="1617710400">- Update to version 0.346:
  + Updated pci, usb and vendor ids.
  + Resolves boo#1182482 jsc#SLE-13791 bnc#1170160</changelog>
  <changelog author="mpluskal@suse.com" date="1620302400">- Update to version 0.347 (bsc#1185697):
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1622635200">- Update to version 0.348 (bsc#1186749):
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1625745600">- Update to version 0.349 (bsc#1187948):
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1627992000">- Update to version 0.350 (bsc#1189005):
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1630584000">- Update to version 0.351 (bsc#1190091):
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1633521600">- Update to version 0.352 (bsc#1191375):
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1636632000">- Update to version 0.353 (bsc#1192587):
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1638878400">- Update to version 0.354:
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1641384000">- Update to version 0.355 (bsc#1194338):
  + Updated pci, usb and vendor ids.</changelog>
</package>
<package pkgid="b7524a97a86fadcf70a424e5c384bdf1b8d84461993dbcbd6c5ff76fcc8d4e84" name="hwdata" arch="src">
  <version epoch="0" ver="0.355" rel="3.39.1"/>
  <changelog author="mpluskal@suse.com" date="1594900800">- Update to version 0.337:
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1597147200">- Update to version 0.338:
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1600084800">- Update to version 0.339:
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1602158400">- Update to version 0.340:
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1604577600">- Update to version 0.341:
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1607342400">- Update to version 0.342:
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1609934400">- Update to version 0.343:
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1610020800">- Add merge-pciids.pl to fully duplicate behavior of pciutils-ids
  * Resolves SLE issue bsc#1180422 bsc#1180482</changelog>
  <changelog author="mpluskal@suse.com" date="1612267200">- Update to version 0.344:
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1614600000">- Update to version 0.345:
  + Updated pci, usb and vendor ids.
  + Resolves boo#1182482 jsc#SLE-13791 bnc#1170160</changelog>
  <changelog author="mpluskal@suse.com" date="1617710400">- Update to version 0.346:
  + Updated pci, usb and vendor ids.
  + Resolves boo#1182482 jsc#SLE-13791 bnc#1170160</changelog>
  <changelog author="mpluskal@suse.com" date="1620302400">- Update to version 0.347 (bsc#1185697):
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1622635200">- Update to version 0.348 (bsc#1186749):
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1625745600">- Update to version 0.349 (bsc#1187948):
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1627992000">- Update to version 0.350 (bsc#1189005):
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1630584000">- Update to version 0.351 (bsc#1190091):
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1633521600">- Update to version 0.352 (bsc#1191375):
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1636632000">- Update to version 0.353 (bsc#1192587):
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1638878400">- Update to version 0.354:
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1641384000">- Update to version 0.355 (bsc#1194338):
  + Updated pci, usb and vendor ids.</changelog>
</package>
<package pkgid="eced73639af2ef1b573c93cc19906f7e7561c8b99dc57352c3d849b15232633b" name="jasper" arch="aarch64">
  <version epoch="0" ver="2.0.14" rel="3.22.1"/>
  <changelog author="sbrabec@suse.com" date="1488801600">- Add -D_BSD_SOURCE to fix redefinition of system types in
  jas_config.h and breakage in ppc64le, s390 and s390x
  (bsc#1028070).</changelog>
  <changelog author="fstrba@suse.com" date="1489665600">- Added patch:
  * jasper-CVE-2016-10251.patch
  - Upstream fix for bsc#1029497, CVE-2016-10251: Use of
    uninitialized value in jpc_pi_nextcprl (jpc_t2cod.c)</changelog>
  <changelog author="fstrba@suse.com" date="1489752000">- Added patches:
  * jasper-CVE-2017-5498.patch
  - Upstream changes putting braces and belts around
    CVE-2017-5498, bsc#1020353, left-shift undefined behaviour
  * jasper-CVE-2016-9600.patch
  - Upstream fix for "Null Pointer Dereference due to missing
    check for UNKNOWN color space in JP2 encoder" (CVE-2016-9600,
    bsc#1018088)</changelog>
  <changelog author="fstrba@suse.com" date="1490184000">- Added patches:
  * jasper-CVE-2016-9583.patch
  - Out of bounds heap read in jpc_pi_nextpcrl() (bsc#1015400,
    CVE-2016-9583)
  * jasper-CVE-2017-6850.patch
  - NULL pointer dereference in jp2_cdef_destroy (jp2_cod.c)
    (bsc#1021868, CVE-2017-6850)</changelog>
  <changelog author="fstrba@suse.com" date="1490875200">- Modified patch:
  * jasper-CVE-2016-9583.patch
    + integrate upstream change
    99a50593254d1b53002719bbecfc946c84b23d27, which fixed a null
    pointer dereferencing crash.</changelog>
  <changelog author="fstrba@suse.com" date="1499774400">- Added patch:
  * jasper-CVE-2017-1000050.patch
    + Upstream fix for NULL Pointer Dereference jp2_encode
    (bsc#1047958, CVE-2017-1000050)</changelog>
  <changelog author="fstrba@suse.com" date="1499774401">- Added patch:
  * jasper-CVE-2016-9262.patch
    + Fix for Multiple overflow vulnerabilities leading to use
    after free (bsc#1009994, CVE-2016-9262)</changelog>
  <changelog author="fstrba@suse.com" date="1499860800">- Other bugs fixed by existing patches:
  * jasper-CVE-2016-9395.patch
  - bsc#1010756, CVE-2016-9394: assertion in jas_matrix_t
  * jas_seq2d_create(int, int, int, int): Assertion
    `xstart &lt;= xend &amp;&amp; ystart &lt;= yend'
  - bsc#1010757, CVE-2016-9392: pc_dec.c:1637: void
    calcstepsizes(uint_fast16_t, int, uint_fast16_t *):
    Assertion `!((expn + (numrlvls - 1) - (numrlvls - 1 -
    ((bandno &gt; 0) ? ((bandno + 2) / 3) : (0)))) &amp; (~0x1f))'
    failed.
  - bsc#1010766, CVE-2016-9393: jpc_t2cod.c:297: int
    jpc_pi_nextrpcl(jpc_pi_t *): Assertion
    `pi-&gt;prcno pirlvl-&gt;numprcs' failed.
  - bsc#1010977, CVE-2016-9395: jas_seq.c:90: jas_matrix_t
  * jas_seq2d_create(int, int, int, int): Assertion `xstart
    &lt;= xend &amp;&amp; ystart &lt;= yend' failed.
- Other bugs fixed in current version:
  * bsc#1010774, CVE-2016-9390: jas_seq.c:90: jas_matrix_t
  * jas_seq2d_create(int, int, int, int): Assertion `xstart &lt;=
    xend &amp;&amp; ystart &lt;= yend' failed.
  * bsc#1010782, CVE-2016-9391: jpc_bs.c:197: long
    jpc_bitstream_getbits(jpc_bitstream_t *, int): Assertion
    `n &gt;= 0 &amp;&amp; n &lt; 32' failed.
  * bsc#1010968, CVE-2016-9389: Assertion `((c1)-&gt;numcols_) ==
    numcols &amp;&amp; ((c2)-&gt;numcols_) == numcols' failed.
  * bsc#1010975, CVE-2016-9388: ras_dec.c:330: int
    ras_getcmap(jas_stream_t *, ras_hdr_t *, ras_cmap_t *):
    Assertion `numcolors &lt;= 256' failed.
  * bsc#1010960, CVE-2016-9387: jas_seq.c:90: jas_matrix&lt;= yend'
    failed.</changelog>
  <changelog author="fstrba@suse.com" date="1522324800">- Upgrade to 2.0.14
  * Soname and package name change libjasper1 to libjasper4
  * Security fixes:
    + CVE-2016-9557 jasper: Signed integer overflow in jas_image.c
- Removed patches:
  * jasper-1.900.1-uninitialized.patch
    + not needed any more
  * jasper-CVE-2016-10251.patch
  * jasper-CVE-2016-8654.patch
  * jasper-CVE-2016-9262.patch
  * jasper-CVE-2016-9395.patch
  * jasper-CVE-2016-9560.patch
  * jasper-CVE-2016-9583.patch
  * jasper-CVE-2016-9591.patch
  * jasper-CVE-2016-9600.patch
  * jasper-CVE-2017-1000050.patch
  * jasper-CVE-2017-5498.patch
  * jasper-CVE-2017-6850.patch
    + Fixed upstream
- Added patches:
  * 0001-jpc_cs-reject-all-but-JPC_COX_INS-and-JPC_COX_RFT.patch
    + fix assertion failure JPC_NOMINALGAIN() which can be caused
    by a crafted JP2 file.
  * 0001-Added-a-fix-from-nrusch-to-allow-JasPer-to-be-build-.patch
    + allow JasPer to be build with CMake 2.x as well as CMake 3.x.</changelog>
  <changelog author="fstrba@suse.com" date="1522324801">- Added patch:
  * jasper-CVE-2018-9055.patch
    + fix CVE-2018-9055, bsc#1087020: jasper: denial of service via
    a reachable assertion in the function jpc_firstone in
    libjasper/jpc/jpc_math.c.</changelog>
  <changelog author="mvetter@suse.com" date="1552392000">- bsc#1117511 CVE-2018-19539 Fix access violation in jas_image_readcmpt:
  * Add jasper-CVE-2018-19539.patch</changelog>
  <changelog author="mvetter@suse.com" date="1553860800">- bsc#1117505 CVE-2018-19542 Fix NULL pointer dereference jp2_decode:
  Add jasper-CVE-2018-19542.patch
- bsc#1010783 CVE-2016-9396 Fix reachable assertion in jpc_cox_getcompparms:
  * Rename 0001-jpc_cs-reject-all-but-JPC_COX_INS-and-JPC_COX_RFT.patch
  to jasper-CVE-2016-9396.patch</changelog>
  <changelog author="mvetter@suse.com" date="1559822400">- bsc#1117508 CVE-2018-19540: Fix heap based overflow in jas_icctxtdesc_input
  Add jasper-CVE-2018-19540.patch: Make sure asclen is at least 1
- bsc#1117507 CVE-2018-19541: Fix heap based overread in jas_image_depalettize
  Add jasper-CVE-2018-19541.patch: Check number of lutents</changelog>
  <changelog author="adam.majer@suse.de" date="1569844800">- jasper-CVE-2018-19541.patch: verify color palette information
  in j2 files when it's read from the file as per specifications
  of JPEG2000. (bsc#1117507)</changelog>
  <changelog author="mvetter@suse.com" date="1584446400">- bsc#1092115 CVE-2018-9154: Fix possible denial of service
  Add jasper-CVE-2018-9154.patch: dont abort in jpc_dec_process_sot()</changelog>
  <changelog author="mvetter@suse.com" date="1597320000">- bsc#1010980 CVE-2016-9399: Fix assert in calcstepsizes
  Add jasper-CVE-2016-9399.patch
- bsc#1020451 CVE-2017-5499: Validate component depth bit
  Add jasper-CVE-2017-5499.patch
- bsc#1020456 CVE-2017-5503, bsc#1020458 CVE-2017-5504, bsc#1020460 CVE-2017-5505:
  Check bounds in jas_seq2d_bindsub()
  Add jasper-CVE-2017-5503-CVE-2017-5504-CVE-2017-5505.patch</changelog>
  <changelog author="mvetter@suse.com" date="1597665600">- bsc#1120807 CVE-2018-20570: Fix heap based buffer over-read in jp2_encode
  Add jasper-CVE-2018-20570.patch
- bsc#1120805 CVE-2018-20622: Fix memory leak in jas_malloc.c
  Add jasper-CVE-2018-20622.patch
- bsc#1117328 CVE-2018-19543, bsc#1045450 CVE-2017-9782: Fix numchans mixup
  Add jasper-CVE-2018-19543-CVE-2017-9782.patch
- bsc#1115637 CVE-2018-19139: Fix mem leaks by registering jpc_unk_destroyparms
  Add jasper-CVE-2018-19139.patch
- bsc#1114498 CVE-2018-18873: Fix null pointer deref in ras_putdatastd
  Add jasper-CVE-2018-18873.patch
- bsc#1088278 CVE-2018-9252: Fix reachable assertion in jpc_abstorelstepsize
  Add jasper-CVE-2018-9252.patch
- bsc#1057152 CVE-2017-14132: Fix heap base overflow in by checking components
  Add jasper-CVE-2017-14132.patch</changelog>
  <changelog author="mvetter@suse.com" date="1598443200">- bsc#1010979 CVE-2016-9398: Use new fix from upstream where we
  actually check for allowed value range instead of just negating
  Add jasper-CVE-2016-9398-upstream.patch</changelog>
  <changelog author="mvetter@suse.com" date="1612785600">- bsc#1179748 CVE-2020-27828: Fix heap overflow by checking maxrlvls
  Add jasper-CVE-2020-27828.patch
- bsc#1181483 CVE-2021-3272: Fix heap overflow by ensuring number
  of channels matches image components
  Add jasper-CVE-2021-3272.patch</changelog>
  <changelog author="mvetter@suse.com" date="1643803200">- bsc#1188437 CVE-2021-27845: Fix divide-by-zery in cp_create()
  Add jasper-CVE-2021-27845.patch</changelog>
</package>
<package pkgid="7842a918f83ab0ff4068f67879b7006b3558246479c3475b5cc51be347c31696" name="jasper" arch="ppc64le">
  <version epoch="0" ver="2.0.14" rel="3.22.1"/>
  <changelog author="sbrabec@suse.com" date="1488801600">- Add -D_BSD_SOURCE to fix redefinition of system types in
  jas_config.h and breakage in ppc64le, s390 and s390x
  (bsc#1028070).</changelog>
  <changelog author="fstrba@suse.com" date="1489665600">- Added patch:
  * jasper-CVE-2016-10251.patch
  - Upstream fix for bsc#1029497, CVE-2016-10251: Use of
    uninitialized value in jpc_pi_nextcprl (jpc_t2cod.c)</changelog>
  <changelog author="fstrba@suse.com" date="1489752000">- Added patches:
  * jasper-CVE-2017-5498.patch
  - Upstream changes putting braces and belts around
    CVE-2017-5498, bsc#1020353, left-shift undefined behaviour
  * jasper-CVE-2016-9600.patch
  - Upstream fix for "Null Pointer Dereference due to missing
    check for UNKNOWN color space in JP2 encoder" (CVE-2016-9600,
    bsc#1018088)</changelog>
  <changelog author="fstrba@suse.com" date="1490184000">- Added patches:
  * jasper-CVE-2016-9583.patch
  - Out of bounds heap read in jpc_pi_nextpcrl() (bsc#1015400,
    CVE-2016-9583)
  * jasper-CVE-2017-6850.patch
  - NULL pointer dereference in jp2_cdef_destroy (jp2_cod.c)
    (bsc#1021868, CVE-2017-6850)</changelog>
  <changelog author="fstrba@suse.com" date="1490875200">- Modified patch:
  * jasper-CVE-2016-9583.patch
    + integrate upstream change
    99a50593254d1b53002719bbecfc946c84b23d27, which fixed a null
    pointer dereferencing crash.</changelog>
  <changelog author="fstrba@suse.com" date="1499774400">- Added patch:
  * jasper-CVE-2017-1000050.patch
    + Upstream fix for NULL Pointer Dereference jp2_encode
    (bsc#1047958, CVE-2017-1000050)</changelog>
  <changelog author="fstrba@suse.com" date="1499774401">- Added patch:
  * jasper-CVE-2016-9262.patch
    + Fix for Multiple overflow vulnerabilities leading to use
    after free (bsc#1009994, CVE-2016-9262)</changelog>
  <changelog author="fstrba@suse.com" date="1499860800">- Other bugs fixed by existing patches:
  * jasper-CVE-2016-9395.patch
  - bsc#1010756, CVE-2016-9394: assertion in jas_matrix_t
  * jas_seq2d_create(int, int, int, int): Assertion
    `xstart &lt;= xend &amp;&amp; ystart &lt;= yend'
  - bsc#1010757, CVE-2016-9392: pc_dec.c:1637: void
    calcstepsizes(uint_fast16_t, int, uint_fast16_t *):
    Assertion `!((expn + (numrlvls - 1) - (numrlvls - 1 -
    ((bandno &gt; 0) ? ((bandno + 2) / 3) : (0)))) &amp; (~0x1f))'
    failed.
  - bsc#1010766, CVE-2016-9393: jpc_t2cod.c:297: int
    jpc_pi_nextrpcl(jpc_pi_t *): Assertion
    `pi-&gt;prcno pirlvl-&gt;numprcs' failed.
  - bsc#1010977, CVE-2016-9395: jas_seq.c:90: jas_matrix_t
  * jas_seq2d_create(int, int, int, int): Assertion `xstart
    &lt;= xend &amp;&amp; ystart &lt;= yend' failed.
- Other bugs fixed in current version:
  * bsc#1010774, CVE-2016-9390: jas_seq.c:90: jas_matrix_t
  * jas_seq2d_create(int, int, int, int): Assertion `xstart &lt;=
    xend &amp;&amp; ystart &lt;= yend' failed.
  * bsc#1010782, CVE-2016-9391: jpc_bs.c:197: long
    jpc_bitstream_getbits(jpc_bitstream_t *, int): Assertion
    `n &gt;= 0 &amp;&amp; n &lt; 32' failed.
  * bsc#1010968, CVE-2016-9389: Assertion `((c1)-&gt;numcols_) ==
    numcols &amp;&amp; ((c2)-&gt;numcols_) == numcols' failed.
  * bsc#1010975, CVE-2016-9388: ras_dec.c:330: int
    ras_getcmap(jas_stream_t *, ras_hdr_t *, ras_cmap_t *):
    Assertion `numcolors &lt;= 256' failed.
  * bsc#1010960, CVE-2016-9387: jas_seq.c:90: jas_matrix&lt;= yend'
    failed.</changelog>
  <changelog author="fstrba@suse.com" date="1522324800">- Upgrade to 2.0.14
  * Soname and package name change libjasper1 to libjasper4
  * Security fixes:
    + CVE-2016-9557 jasper: Signed integer overflow in jas_image.c
- Removed patches:
  * jasper-1.900.1-uninitialized.patch
    + not needed any more
  * jasper-CVE-2016-10251.patch
  * jasper-CVE-2016-8654.patch
  * jasper-CVE-2016-9262.patch
  * jasper-CVE-2016-9395.patch
  * jasper-CVE-2016-9560.patch
  * jasper-CVE-2016-9583.patch
  * jasper-CVE-2016-9591.patch
  * jasper-CVE-2016-9600.patch
  * jasper-CVE-2017-1000050.patch
  * jasper-CVE-2017-5498.patch
  * jasper-CVE-2017-6850.patch
    + Fixed upstream
- Added patches:
  * 0001-jpc_cs-reject-all-but-JPC_COX_INS-and-JPC_COX_RFT.patch
    + fix assertion failure JPC_NOMINALGAIN() which can be caused
    by a crafted JP2 file.
  * 0001-Added-a-fix-from-nrusch-to-allow-JasPer-to-be-build-.patch
    + allow JasPer to be build with CMake 2.x as well as CMake 3.x.</changelog>
  <changelog author="fstrba@suse.com" date="1522324801">- Added patch:
  * jasper-CVE-2018-9055.patch
    + fix CVE-2018-9055, bsc#1087020: jasper: denial of service via
    a reachable assertion in the function jpc_firstone in
    libjasper/jpc/jpc_math.c.</changelog>
  <changelog author="mvetter@suse.com" date="1552392000">- bsc#1117511 CVE-2018-19539 Fix access violation in jas_image_readcmpt:
  * Add jasper-CVE-2018-19539.patch</changelog>
  <changelog author="mvetter@suse.com" date="1553860800">- bsc#1117505 CVE-2018-19542 Fix NULL pointer dereference jp2_decode:
  Add jasper-CVE-2018-19542.patch
- bsc#1010783 CVE-2016-9396 Fix reachable assertion in jpc_cox_getcompparms:
  * Rename 0001-jpc_cs-reject-all-but-JPC_COX_INS-and-JPC_COX_RFT.patch
  to jasper-CVE-2016-9396.patch</changelog>
  <changelog author="mvetter@suse.com" date="1559822400">- bsc#1117508 CVE-2018-19540: Fix heap based overflow in jas_icctxtdesc_input
  Add jasper-CVE-2018-19540.patch: Make sure asclen is at least 1
- bsc#1117507 CVE-2018-19541: Fix heap based overread in jas_image_depalettize
  Add jasper-CVE-2018-19541.patch: Check number of lutents</changelog>
  <changelog author="adam.majer@suse.de" date="1569844800">- jasper-CVE-2018-19541.patch: verify color palette information
  in j2 files when it's read from the file as per specifications
  of JPEG2000. (bsc#1117507)</changelog>
  <changelog author="mvetter@suse.com" date="1584446400">- bsc#1092115 CVE-2018-9154: Fix possible denial of service
  Add jasper-CVE-2018-9154.patch: dont abort in jpc_dec_process_sot()</changelog>
  <changelog author="mvetter@suse.com" date="1597320000">- bsc#1010980 CVE-2016-9399: Fix assert in calcstepsizes
  Add jasper-CVE-2016-9399.patch
- bsc#1020451 CVE-2017-5499: Validate component depth bit
  Add jasper-CVE-2017-5499.patch
- bsc#1020456 CVE-2017-5503, bsc#1020458 CVE-2017-5504, bsc#1020460 CVE-2017-5505:
  Check bounds in jas_seq2d_bindsub()
  Add jasper-CVE-2017-5503-CVE-2017-5504-CVE-2017-5505.patch</changelog>
  <changelog author="mvetter@suse.com" date="1597665600">- bsc#1120807 CVE-2018-20570: Fix heap based buffer over-read in jp2_encode
  Add jasper-CVE-2018-20570.patch
- bsc#1120805 CVE-2018-20622: Fix memory leak in jas_malloc.c
  Add jasper-CVE-2018-20622.patch
- bsc#1117328 CVE-2018-19543, bsc#1045450 CVE-2017-9782: Fix numchans mixup
  Add jasper-CVE-2018-19543-CVE-2017-9782.patch
- bsc#1115637 CVE-2018-19139: Fix mem leaks by registering jpc_unk_destroyparms
  Add jasper-CVE-2018-19139.patch
- bsc#1114498 CVE-2018-18873: Fix null pointer deref in ras_putdatastd
  Add jasper-CVE-2018-18873.patch
- bsc#1088278 CVE-2018-9252: Fix reachable assertion in jpc_abstorelstepsize
  Add jasper-CVE-2018-9252.patch
- bsc#1057152 CVE-2017-14132: Fix heap base overflow in by checking components
  Add jasper-CVE-2017-14132.patch</changelog>
  <changelog author="mvetter@suse.com" date="1598443200">- bsc#1010979 CVE-2016-9398: Use new fix from upstream where we
  actually check for allowed value range instead of just negating
  Add jasper-CVE-2016-9398-upstream.patch</changelog>
  <changelog author="mvetter@suse.com" date="1612785600">- bsc#1179748 CVE-2020-27828: Fix heap overflow by checking maxrlvls
  Add jasper-CVE-2020-27828.patch
- bsc#1181483 CVE-2021-3272: Fix heap overflow by ensuring number
  of channels matches image components
  Add jasper-CVE-2021-3272.patch</changelog>
  <changelog author="mvetter@suse.com" date="1643803200">- bsc#1188437 CVE-2021-27845: Fix divide-by-zery in cp_create()
  Add jasper-CVE-2021-27845.patch</changelog>
</package>
<package pkgid="7ceb9b18b3e9167177d2f11e8af07e0900df010333e8c8124ba625268abf4a2c" name="jasper" arch="s390x">
  <version epoch="0" ver="2.0.14" rel="3.22.1"/>
  <changelog author="sbrabec@suse.com" date="1488801600">- Add -D_BSD_SOURCE to fix redefinition of system types in
  jas_config.h and breakage in ppc64le, s390 and s390x
  (bsc#1028070).</changelog>
  <changelog author="fstrba@suse.com" date="1489665600">- Added patch:
  * jasper-CVE-2016-10251.patch
  - Upstream fix for bsc#1029497, CVE-2016-10251: Use of
    uninitialized value in jpc_pi_nextcprl (jpc_t2cod.c)</changelog>
  <changelog author="fstrba@suse.com" date="1489752000">- Added patches:
  * jasper-CVE-2017-5498.patch
  - Upstream changes putting braces and belts around
    CVE-2017-5498, bsc#1020353, left-shift undefined behaviour
  * jasper-CVE-2016-9600.patch
  - Upstream fix for "Null Pointer Dereference due to missing
    check for UNKNOWN color space in JP2 encoder" (CVE-2016-9600,
    bsc#1018088)</changelog>
  <changelog author="fstrba@suse.com" date="1490184000">- Added patches:
  * jasper-CVE-2016-9583.patch
  - Out of bounds heap read in jpc_pi_nextpcrl() (bsc#1015400,
    CVE-2016-9583)
  * jasper-CVE-2017-6850.patch
  - NULL pointer dereference in jp2_cdef_destroy (jp2_cod.c)
    (bsc#1021868, CVE-2017-6850)</changelog>
  <changelog author="fstrba@suse.com" date="1490875200">- Modified patch:
  * jasper-CVE-2016-9583.patch
    + integrate upstream change
    99a50593254d1b53002719bbecfc946c84b23d27, which fixed a null
    pointer dereferencing crash.</changelog>
  <changelog author="fstrba@suse.com" date="1499774400">- Added patch:
  * jasper-CVE-2017-1000050.patch
    + Upstream fix for NULL Pointer Dereference jp2_encode
    (bsc#1047958, CVE-2017-1000050)</changelog>
  <changelog author="fstrba@suse.com" date="1499774401">- Added patch:
  * jasper-CVE-2016-9262.patch
    + Fix for Multiple overflow vulnerabilities leading to use
    after free (bsc#1009994, CVE-2016-9262)</changelog>
  <changelog author="fstrba@suse.com" date="1499860800">- Other bugs fixed by existing patches:
  * jasper-CVE-2016-9395.patch
  - bsc#1010756, CVE-2016-9394: assertion in jas_matrix_t
  * jas_seq2d_create(int, int, int, int): Assertion
    `xstart &lt;= xend &amp;&amp; ystart &lt;= yend'
  - bsc#1010757, CVE-2016-9392: pc_dec.c:1637: void
    calcstepsizes(uint_fast16_t, int, uint_fast16_t *):
    Assertion `!((expn + (numrlvls - 1) - (numrlvls - 1 -
    ((bandno &gt; 0) ? ((bandno + 2) / 3) : (0)))) &amp; (~0x1f))'
    failed.
  - bsc#1010766, CVE-2016-9393: jpc_t2cod.c:297: int
    jpc_pi_nextrpcl(jpc_pi_t *): Assertion
    `pi-&gt;prcno pirlvl-&gt;numprcs' failed.
  - bsc#1010977, CVE-2016-9395: jas_seq.c:90: jas_matrix_t
  * jas_seq2d_create(int, int, int, int): Assertion `xstart
    &lt;= xend &amp;&amp; ystart &lt;= yend' failed.
- Other bugs fixed in current version:
  * bsc#1010774, CVE-2016-9390: jas_seq.c:90: jas_matrix_t
  * jas_seq2d_create(int, int, int, int): Assertion `xstart &lt;=
    xend &amp;&amp; ystart &lt;= yend' failed.
  * bsc#1010782, CVE-2016-9391: jpc_bs.c:197: long
    jpc_bitstream_getbits(jpc_bitstream_t *, int): Assertion
    `n &gt;= 0 &amp;&amp; n &lt; 32' failed.
  * bsc#1010968, CVE-2016-9389: Assertion `((c1)-&gt;numcols_) ==
    numcols &amp;&amp; ((c2)-&gt;numcols_) == numcols' failed.
  * bsc#1010975, CVE-2016-9388: ras_dec.c:330: int
    ras_getcmap(jas_stream_t *, ras_hdr_t *, ras_cmap_t *):
    Assertion `numcolors &lt;= 256' failed.
  * bsc#1010960, CVE-2016-9387: jas_seq.c:90: jas_matrix&lt;= yend'
    failed.</changelog>
  <changelog author="fstrba@suse.com" date="1522324800">- Upgrade to 2.0.14
  * Soname and package name change libjasper1 to libjasper4
  * Security fixes:
    + CVE-2016-9557 jasper: Signed integer overflow in jas_image.c
- Removed patches:
  * jasper-1.900.1-uninitialized.patch
    + not needed any more
  * jasper-CVE-2016-10251.patch
  * jasper-CVE-2016-8654.patch
  * jasper-CVE-2016-9262.patch
  * jasper-CVE-2016-9395.patch
  * jasper-CVE-2016-9560.patch
  * jasper-CVE-2016-9583.patch
  * jasper-CVE-2016-9591.patch
  * jasper-CVE-2016-9600.patch
  * jasper-CVE-2017-1000050.patch
  * jasper-CVE-2017-5498.patch
  * jasper-CVE-2017-6850.patch
    + Fixed upstream
- Added patches:
  * 0001-jpc_cs-reject-all-but-JPC_COX_INS-and-JPC_COX_RFT.patch
    + fix assertion failure JPC_NOMINALGAIN() which can be caused
    by a crafted JP2 file.
  * 0001-Added-a-fix-from-nrusch-to-allow-JasPer-to-be-build-.patch
    + allow JasPer to be build with CMake 2.x as well as CMake 3.x.</changelog>
  <changelog author="fstrba@suse.com" date="1522324801">- Added patch:
  * jasper-CVE-2018-9055.patch
    + fix CVE-2018-9055, bsc#1087020: jasper: denial of service via
    a reachable assertion in the function jpc_firstone in
    libjasper/jpc/jpc_math.c.</changelog>
  <changelog author="mvetter@suse.com" date="1552392000">- bsc#1117511 CVE-2018-19539 Fix access violation in jas_image_readcmpt:
  * Add jasper-CVE-2018-19539.patch</changelog>
  <changelog author="mvetter@suse.com" date="1553860800">- bsc#1117505 CVE-2018-19542 Fix NULL pointer dereference jp2_decode:
  Add jasper-CVE-2018-19542.patch
- bsc#1010783 CVE-2016-9396 Fix reachable assertion in jpc_cox_getcompparms:
  * Rename 0001-jpc_cs-reject-all-but-JPC_COX_INS-and-JPC_COX_RFT.patch
  to jasper-CVE-2016-9396.patch</changelog>
  <changelog author="mvetter@suse.com" date="1559822400">- bsc#1117508 CVE-2018-19540: Fix heap based overflow in jas_icctxtdesc_input
  Add jasper-CVE-2018-19540.patch: Make sure asclen is at least 1
- bsc#1117507 CVE-2018-19541: Fix heap based overread in jas_image_depalettize
  Add jasper-CVE-2018-19541.patch: Check number of lutents</changelog>
  <changelog author="adam.majer@suse.de" date="1569844800">- jasper-CVE-2018-19541.patch: verify color palette information
  in j2 files when it's read from the file as per specifications
  of JPEG2000. (bsc#1117507)</changelog>
  <changelog author="mvetter@suse.com" date="1584446400">- bsc#1092115 CVE-2018-9154: Fix possible denial of service
  Add jasper-CVE-2018-9154.patch: dont abort in jpc_dec_process_sot()</changelog>
  <changelog author="mvetter@suse.com" date="1597320000">- bsc#1010980 CVE-2016-9399: Fix assert in calcstepsizes
  Add jasper-CVE-2016-9399.patch
- bsc#1020451 CVE-2017-5499: Validate component depth bit
  Add jasper-CVE-2017-5499.patch
- bsc#1020456 CVE-2017-5503, bsc#1020458 CVE-2017-5504, bsc#1020460 CVE-2017-5505:
  Check bounds in jas_seq2d_bindsub()
  Add jasper-CVE-2017-5503-CVE-2017-5504-CVE-2017-5505.patch</changelog>
  <changelog author="mvetter@suse.com" date="1597665600">- bsc#1120807 CVE-2018-20570: Fix heap based buffer over-read in jp2_encode
  Add jasper-CVE-2018-20570.patch
- bsc#1120805 CVE-2018-20622: Fix memory leak in jas_malloc.c
  Add jasper-CVE-2018-20622.patch
- bsc#1117328 CVE-2018-19543, bsc#1045450 CVE-2017-9782: Fix numchans mixup
  Add jasper-CVE-2018-19543-CVE-2017-9782.patch
- bsc#1115637 CVE-2018-19139: Fix mem leaks by registering jpc_unk_destroyparms
  Add jasper-CVE-2018-19139.patch
- bsc#1114498 CVE-2018-18873: Fix null pointer deref in ras_putdatastd
  Add jasper-CVE-2018-18873.patch
- bsc#1088278 CVE-2018-9252: Fix reachable assertion in jpc_abstorelstepsize
  Add jasper-CVE-2018-9252.patch
- bsc#1057152 CVE-2017-14132: Fix heap base overflow in by checking components
  Add jasper-CVE-2017-14132.patch</changelog>
  <changelog author="mvetter@suse.com" date="1598443200">- bsc#1010979 CVE-2016-9398: Use new fix from upstream where we
  actually check for allowed value range instead of just negating
  Add jasper-CVE-2016-9398-upstream.patch</changelog>
  <changelog author="mvetter@suse.com" date="1612785600">- bsc#1179748 CVE-2020-27828: Fix heap overflow by checking maxrlvls
  Add jasper-CVE-2020-27828.patch
- bsc#1181483 CVE-2021-3272: Fix heap overflow by ensuring number
  of channels matches image components
  Add jasper-CVE-2021-3272.patch</changelog>
  <changelog author="mvetter@suse.com" date="1643803200">- bsc#1188437 CVE-2021-27845: Fix divide-by-zery in cp_create()
  Add jasper-CVE-2021-27845.patch</changelog>
</package>
<package pkgid="7cfdbc83c82000649afc94b3ba15c75b356d74a6904bb6f716667c22ab88362e" name="jasper" arch="src">
  <version epoch="0" ver="2.0.14" rel="3.22.1"/>
  <changelog author="sbrabec@suse.com" date="1488801600">- Add -D_BSD_SOURCE to fix redefinition of system types in
  jas_config.h and breakage in ppc64le, s390 and s390x
  (bsc#1028070).</changelog>
  <changelog author="fstrba@suse.com" date="1489665600">- Added patch:
  * jasper-CVE-2016-10251.patch
  - Upstream fix for bsc#1029497, CVE-2016-10251: Use of
    uninitialized value in jpc_pi_nextcprl (jpc_t2cod.c)</changelog>
  <changelog author="fstrba@suse.com" date="1489752000">- Added patches:
  * jasper-CVE-2017-5498.patch
  - Upstream changes putting braces and belts around
    CVE-2017-5498, bsc#1020353, left-shift undefined behaviour
  * jasper-CVE-2016-9600.patch
  - Upstream fix for "Null Pointer Dereference due to missing
    check for UNKNOWN color space in JP2 encoder" (CVE-2016-9600,
    bsc#1018088)</changelog>
  <changelog author="fstrba@suse.com" date="1490184000">- Added patches:
  * jasper-CVE-2016-9583.patch
  - Out of bounds heap read in jpc_pi_nextpcrl() (bsc#1015400,
    CVE-2016-9583)
  * jasper-CVE-2017-6850.patch
  - NULL pointer dereference in jp2_cdef_destroy (jp2_cod.c)
    (bsc#1021868, CVE-2017-6850)</changelog>
  <changelog author="fstrba@suse.com" date="1490875200">- Modified patch:
  * jasper-CVE-2016-9583.patch
    + integrate upstream change
    99a50593254d1b53002719bbecfc946c84b23d27, which fixed a null
    pointer dereferencing crash.</changelog>
  <changelog author="fstrba@suse.com" date="1499774400">- Added patch:
  * jasper-CVE-2017-1000050.patch
    + Upstream fix for NULL Pointer Dereference jp2_encode
    (bsc#1047958, CVE-2017-1000050)</changelog>
  <changelog author="fstrba@suse.com" date="1499774401">- Added patch:
  * jasper-CVE-2016-9262.patch
    + Fix for Multiple overflow vulnerabilities leading to use
    after free (bsc#1009994, CVE-2016-9262)</changelog>
  <changelog author="fstrba@suse.com" date="1499860800">- Other bugs fixed by existing patches:
  * jasper-CVE-2016-9395.patch
  - bsc#1010756, CVE-2016-9394: assertion in jas_matrix_t
  * jas_seq2d_create(int, int, int, int): Assertion
    `xstart &lt;= xend &amp;&amp; ystart &lt;= yend'
  - bsc#1010757, CVE-2016-9392: pc_dec.c:1637: void
    calcstepsizes(uint_fast16_t, int, uint_fast16_t *):
    Assertion `!((expn + (numrlvls - 1) - (numrlvls - 1 -
    ((bandno &gt; 0) ? ((bandno + 2) / 3) : (0)))) &amp; (~0x1f))'
    failed.
  - bsc#1010766, CVE-2016-9393: jpc_t2cod.c:297: int
    jpc_pi_nextrpcl(jpc_pi_t *): Assertion
    `pi-&gt;prcno pirlvl-&gt;numprcs' failed.
  - bsc#1010977, CVE-2016-9395: jas_seq.c:90: jas_matrix_t
  * jas_seq2d_create(int, int, int, int): Assertion `xstart
    &lt;= xend &amp;&amp; ystart &lt;= yend' failed.
- Other bugs fixed in current version:
  * bsc#1010774, CVE-2016-9390: jas_seq.c:90: jas_matrix_t
  * jas_seq2d_create(int, int, int, int): Assertion `xstart &lt;=
    xend &amp;&amp; ystart &lt;= yend' failed.
  * bsc#1010782, CVE-2016-9391: jpc_bs.c:197: long
    jpc_bitstream_getbits(jpc_bitstream_t *, int): Assertion
    `n &gt;= 0 &amp;&amp; n &lt; 32' failed.
  * bsc#1010968, CVE-2016-9389: Assertion `((c1)-&gt;numcols_) ==
    numcols &amp;&amp; ((c2)-&gt;numcols_) == numcols' failed.
  * bsc#1010975, CVE-2016-9388: ras_dec.c:330: int
    ras_getcmap(jas_stream_t *, ras_hdr_t *, ras_cmap_t *):
    Assertion `numcolors &lt;= 256' failed.
  * bsc#1010960, CVE-2016-9387: jas_seq.c:90: jas_matrix&lt;= yend'
    failed.</changelog>
  <changelog author="fstrba@suse.com" date="1522324800">- Upgrade to 2.0.14
  * Soname and package name change libjasper1 to libjasper4
  * Security fixes:
    + CVE-2016-9557 jasper: Signed integer overflow in jas_image.c
- Removed patches:
  * jasper-1.900.1-uninitialized.patch
    + not needed any more
  * jasper-CVE-2016-10251.patch
  * jasper-CVE-2016-8654.patch
  * jasper-CVE-2016-9262.patch
  * jasper-CVE-2016-9395.patch
  * jasper-CVE-2016-9560.patch
  * jasper-CVE-2016-9583.patch
  * jasper-CVE-2016-9591.patch
  * jasper-CVE-2016-9600.patch
  * jasper-CVE-2017-1000050.patch
  * jasper-CVE-2017-5498.patch
  * jasper-CVE-2017-6850.patch
    + Fixed upstream
- Added patches:
  * 0001-jpc_cs-reject-all-but-JPC_COX_INS-and-JPC_COX_RFT.patch
    + fix assertion failure JPC_NOMINALGAIN() which can be caused
    by a crafted JP2 file.
  * 0001-Added-a-fix-from-nrusch-to-allow-JasPer-to-be-build-.patch
    + allow JasPer to be build with CMake 2.x as well as CMake 3.x.</changelog>
  <changelog author="fstrba@suse.com" date="1522324801">- Added patch:
  * jasper-CVE-2018-9055.patch
    + fix CVE-2018-9055, bsc#1087020: jasper: denial of service via
    a reachable assertion in the function jpc_firstone in
    libjasper/jpc/jpc_math.c.</changelog>
  <changelog author="mvetter@suse.com" date="1552392000">- bsc#1117511 CVE-2018-19539 Fix access violation in jas_image_readcmpt:
  * Add jasper-CVE-2018-19539.patch</changelog>
  <changelog author="mvetter@suse.com" date="1553860800">- bsc#1117505 CVE-2018-19542 Fix NULL pointer dereference jp2_decode:
  Add jasper-CVE-2018-19542.patch
- bsc#1010783 CVE-2016-9396 Fix reachable assertion in jpc_cox_getcompparms:
  * Rename 0001-jpc_cs-reject-all-but-JPC_COX_INS-and-JPC_COX_RFT.patch
  to jasper-CVE-2016-9396.patch</changelog>
  <changelog author="mvetter@suse.com" date="1559822400">- bsc#1117508 CVE-2018-19540: Fix heap based overflow in jas_icctxtdesc_input
  Add jasper-CVE-2018-19540.patch: Make sure asclen is at least 1
- bsc#1117507 CVE-2018-19541: Fix heap based overread in jas_image_depalettize
  Add jasper-CVE-2018-19541.patch: Check number of lutents</changelog>
  <changelog author="adam.majer@suse.de" date="1569844800">- jasper-CVE-2018-19541.patch: verify color palette information
  in j2 files when it's read from the file as per specifications
  of JPEG2000. (bsc#1117507)</changelog>
  <changelog author="mvetter@suse.com" date="1584446400">- bsc#1092115 CVE-2018-9154: Fix possible denial of service
  Add jasper-CVE-2018-9154.patch: dont abort in jpc_dec_process_sot()</changelog>
  <changelog author="mvetter@suse.com" date="1597320000">- bsc#1010980 CVE-2016-9399: Fix assert in calcstepsizes
  Add jasper-CVE-2016-9399.patch
- bsc#1020451 CVE-2017-5499: Validate component depth bit
  Add jasper-CVE-2017-5499.patch
- bsc#1020456 CVE-2017-5503, bsc#1020458 CVE-2017-5504, bsc#1020460 CVE-2017-5505:
  Check bounds in jas_seq2d_bindsub()
  Add jasper-CVE-2017-5503-CVE-2017-5504-CVE-2017-5505.patch</changelog>
  <changelog author="mvetter@suse.com" date="1597665600">- bsc#1120807 CVE-2018-20570: Fix heap based buffer over-read in jp2_encode
  Add jasper-CVE-2018-20570.patch
- bsc#1120805 CVE-2018-20622: Fix memory leak in jas_malloc.c
  Add jasper-CVE-2018-20622.patch
- bsc#1117328 CVE-2018-19543, bsc#1045450 CVE-2017-9782: Fix numchans mixup
  Add jasper-CVE-2018-19543-CVE-2017-9782.patch
- bsc#1115637 CVE-2018-19139: Fix mem leaks by registering jpc_unk_destroyparms
  Add jasper-CVE-2018-19139.patch
- bsc#1114498 CVE-2018-18873: Fix null pointer deref in ras_putdatastd
  Add jasper-CVE-2018-18873.patch
- bsc#1088278 CVE-2018-9252: Fix reachable assertion in jpc_abstorelstepsize
  Add jasper-CVE-2018-9252.patch
- bsc#1057152 CVE-2017-14132: Fix heap base overflow in by checking components
  Add jasper-CVE-2017-14132.patch</changelog>
  <changelog author="mvetter@suse.com" date="1598443200">- bsc#1010979 CVE-2016-9398: Use new fix from upstream where we
  actually check for allowed value range instead of just negating
  Add jasper-CVE-2016-9398-upstream.patch</changelog>
  <changelog author="mvetter@suse.com" date="1612785600">- bsc#1179748 CVE-2020-27828: Fix heap overflow by checking maxrlvls
  Add jasper-CVE-2020-27828.patch
- bsc#1181483 CVE-2021-3272: Fix heap overflow by ensuring number
  of channels matches image components
  Add jasper-CVE-2021-3272.patch</changelog>
  <changelog author="mvetter@suse.com" date="1643803200">- bsc#1188437 CVE-2021-27845: Fix divide-by-zery in cp_create()
  Add jasper-CVE-2021-27845.patch</changelog>
</package>
<package pkgid="de14e00a614a5da2418e84a4f5d3be687cb2431533adb2799fba91baa604f01d" name="jasper" arch="x86_64">
  <version epoch="0" ver="2.0.14" rel="3.22.1"/>
  <changelog author="sbrabec@suse.com" date="1488801600">- Add -D_BSD_SOURCE to fix redefinition of system types in
  jas_config.h and breakage in ppc64le, s390 and s390x
  (bsc#1028070).</changelog>
  <changelog author="fstrba@suse.com" date="1489665600">- Added patch:
  * jasper-CVE-2016-10251.patch
  - Upstream fix for bsc#1029497, CVE-2016-10251: Use of
    uninitialized value in jpc_pi_nextcprl (jpc_t2cod.c)</changelog>
  <changelog author="fstrba@suse.com" date="1489752000">- Added patches:
  * jasper-CVE-2017-5498.patch
  - Upstream changes putting braces and belts around
    CVE-2017-5498, bsc#1020353, left-shift undefined behaviour
  * jasper-CVE-2016-9600.patch
  - Upstream fix for "Null Pointer Dereference due to missing
    check for UNKNOWN color space in JP2 encoder" (CVE-2016-9600,
    bsc#1018088)</changelog>
  <changelog author="fstrba@suse.com" date="1490184000">- Added patches:
  * jasper-CVE-2016-9583.patch
  - Out of bounds heap read in jpc_pi_nextpcrl() (bsc#1015400,
    CVE-2016-9583)
  * jasper-CVE-2017-6850.patch
  - NULL pointer dereference in jp2_cdef_destroy (jp2_cod.c)
    (bsc#1021868, CVE-2017-6850)</changelog>
  <changelog author="fstrba@suse.com" date="1490875200">- Modified patch:
  * jasper-CVE-2016-9583.patch
    + integrate upstream change
    99a50593254d1b53002719bbecfc946c84b23d27, which fixed a null
    pointer dereferencing crash.</changelog>
  <changelog author="fstrba@suse.com" date="1499774400">- Added patch:
  * jasper-CVE-2017-1000050.patch
    + Upstream fix for NULL Pointer Dereference jp2_encode
    (bsc#1047958, CVE-2017-1000050)</changelog>
  <changelog author="fstrba@suse.com" date="1499774401">- Added patch:
  * jasper-CVE-2016-9262.patch
    + Fix for Multiple overflow vulnerabilities leading to use
    after free (bsc#1009994, CVE-2016-9262)</changelog>
  <changelog author="fstrba@suse.com" date="1499860800">- Other bugs fixed by existing patches:
  * jasper-CVE-2016-9395.patch
  - bsc#1010756, CVE-2016-9394: assertion in jas_matrix_t
  * jas_seq2d_create(int, int, int, int): Assertion
    `xstart &lt;= xend &amp;&amp; ystart &lt;= yend'
  - bsc#1010757, CVE-2016-9392: pc_dec.c:1637: void
    calcstepsizes(uint_fast16_t, int, uint_fast16_t *):
    Assertion `!((expn + (numrlvls - 1) - (numrlvls - 1 -
    ((bandno &gt; 0) ? ((bandno + 2) / 3) : (0)))) &amp; (~0x1f))'
    failed.
  - bsc#1010766, CVE-2016-9393: jpc_t2cod.c:297: int
    jpc_pi_nextrpcl(jpc_pi_t *): Assertion
    `pi-&gt;prcno pirlvl-&gt;numprcs' failed.
  - bsc#1010977, CVE-2016-9395: jas_seq.c:90: jas_matrix_t
  * jas_seq2d_create(int, int, int, int): Assertion `xstart
    &lt;= xend &amp;&amp; ystart &lt;= yend' failed.
- Other bugs fixed in current version:
  * bsc#1010774, CVE-2016-9390: jas_seq.c:90: jas_matrix_t
  * jas_seq2d_create(int, int, int, int): Assertion `xstart &lt;=
    xend &amp;&amp; ystart &lt;= yend' failed.
  * bsc#1010782, CVE-2016-9391: jpc_bs.c:197: long
    jpc_bitstream_getbits(jpc_bitstream_t *, int): Assertion
    `n &gt;= 0 &amp;&amp; n &lt; 32' failed.
  * bsc#1010968, CVE-2016-9389: Assertion `((c1)-&gt;numcols_) ==
    numcols &amp;&amp; ((c2)-&gt;numcols_) == numcols' failed.
  * bsc#1010975, CVE-2016-9388: ras_dec.c:330: int
    ras_getcmap(jas_stream_t *, ras_hdr_t *, ras_cmap_t *):
    Assertion `numcolors &lt;= 256' failed.
  * bsc#1010960, CVE-2016-9387: jas_seq.c:90: jas_matrix&lt;= yend'
    failed.</changelog>
  <changelog author="fstrba@suse.com" date="1522324800">- Upgrade to 2.0.14
  * Soname and package name change libjasper1 to libjasper4
  * Security fixes:
    + CVE-2016-9557 jasper: Signed integer overflow in jas_image.c
- Removed patches:
  * jasper-1.900.1-uninitialized.patch
    + not needed any more
  * jasper-CVE-2016-10251.patch
  * jasper-CVE-2016-8654.patch
  * jasper-CVE-2016-9262.patch
  * jasper-CVE-2016-9395.patch
  * jasper-CVE-2016-9560.patch
  * jasper-CVE-2016-9583.patch
  * jasper-CVE-2016-9591.patch
  * jasper-CVE-2016-9600.patch
  * jasper-CVE-2017-1000050.patch
  * jasper-CVE-2017-5498.patch
  * jasper-CVE-2017-6850.patch
    + Fixed upstream
- Added patches:
  * 0001-jpc_cs-reject-all-but-JPC_COX_INS-and-JPC_COX_RFT.patch
    + fix assertion failure JPC_NOMINALGAIN() which can be caused
    by a crafted JP2 file.
  * 0001-Added-a-fix-from-nrusch-to-allow-JasPer-to-be-build-.patch
    + allow JasPer to be build with CMake 2.x as well as CMake 3.x.</changelog>
  <changelog author="fstrba@suse.com" date="1522324801">- Added patch:
  * jasper-CVE-2018-9055.patch
    + fix CVE-2018-9055, bsc#1087020: jasper: denial of service via
    a reachable assertion in the function jpc_firstone in
    libjasper/jpc/jpc_math.c.</changelog>
  <changelog author="mvetter@suse.com" date="1552392000">- bsc#1117511 CVE-2018-19539 Fix access violation in jas_image_readcmpt:
  * Add jasper-CVE-2018-19539.patch</changelog>
  <changelog author="mvetter@suse.com" date="1553860800">- bsc#1117505 CVE-2018-19542 Fix NULL pointer dereference jp2_decode:
  Add jasper-CVE-2018-19542.patch
- bsc#1010783 CVE-2016-9396 Fix reachable assertion in jpc_cox_getcompparms:
  * Rename 0001-jpc_cs-reject-all-but-JPC_COX_INS-and-JPC_COX_RFT.patch
  to jasper-CVE-2016-9396.patch</changelog>
  <changelog author="mvetter@suse.com" date="1559822400">- bsc#1117508 CVE-2018-19540: Fix heap based overflow in jas_icctxtdesc_input
  Add jasper-CVE-2018-19540.patch: Make sure asclen is at least 1
- bsc#1117507 CVE-2018-19541: Fix heap based overread in jas_image_depalettize
  Add jasper-CVE-2018-19541.patch: Check number of lutents</changelog>
  <changelog author="adam.majer@suse.de" date="1569844800">- jasper-CVE-2018-19541.patch: verify color palette information
  in j2 files when it's read from the file as per specifications
  of JPEG2000. (bsc#1117507)</changelog>
  <changelog author="mvetter@suse.com" date="1584446400">- bsc#1092115 CVE-2018-9154: Fix possible denial of service
  Add jasper-CVE-2018-9154.patch: dont abort in jpc_dec_process_sot()</changelog>
  <changelog author="mvetter@suse.com" date="1597320000">- bsc#1010980 CVE-2016-9399: Fix assert in calcstepsizes
  Add jasper-CVE-2016-9399.patch
- bsc#1020451 CVE-2017-5499: Validate component depth bit
  Add jasper-CVE-2017-5499.patch
- bsc#1020456 CVE-2017-5503, bsc#1020458 CVE-2017-5504, bsc#1020460 CVE-2017-5505:
  Check bounds in jas_seq2d_bindsub()
  Add jasper-CVE-2017-5503-CVE-2017-5504-CVE-2017-5505.patch</changelog>
  <changelog author="mvetter@suse.com" date="1597665600">- bsc#1120807 CVE-2018-20570: Fix heap based buffer over-read in jp2_encode
  Add jasper-CVE-2018-20570.patch
- bsc#1120805 CVE-2018-20622: Fix memory leak in jas_malloc.c
  Add jasper-CVE-2018-20622.patch
- bsc#1117328 CVE-2018-19543, bsc#1045450 CVE-2017-9782: Fix numchans mixup
  Add jasper-CVE-2018-19543-CVE-2017-9782.patch
- bsc#1115637 CVE-2018-19139: Fix mem leaks by registering jpc_unk_destroyparms
  Add jasper-CVE-2018-19139.patch
- bsc#1114498 CVE-2018-18873: Fix null pointer deref in ras_putdatastd
  Add jasper-CVE-2018-18873.patch
- bsc#1088278 CVE-2018-9252: Fix reachable assertion in jpc_abstorelstepsize
  Add jasper-CVE-2018-9252.patch
- bsc#1057152 CVE-2017-14132: Fix heap base overflow in by checking components
  Add jasper-CVE-2017-14132.patch</changelog>
  <changelog author="mvetter@suse.com" date="1598443200">- bsc#1010979 CVE-2016-9398: Use new fix from upstream where we
  actually check for allowed value range instead of just negating
  Add jasper-CVE-2016-9398-upstream.patch</changelog>
  <changelog author="mvetter@suse.com" date="1612785600">- bsc#1179748 CVE-2020-27828: Fix heap overflow by checking maxrlvls
  Add jasper-CVE-2020-27828.patch
- bsc#1181483 CVE-2021-3272: Fix heap overflow by ensuring number
  of channels matches image components
  Add jasper-CVE-2021-3272.patch</changelog>
  <changelog author="mvetter@suse.com" date="1643803200">- bsc#1188437 CVE-2021-27845: Fix divide-by-zery in cp_create()
  Add jasper-CVE-2021-27845.patch</changelog>
</package>
<package pkgid="4b6cb82e713f680148f81587f0e58e30a161055d285d7509fd00ec7c94db78dc" name="java-11-openjdk" arch="aarch64">
  <version epoch="0" ver="11.0.13.0" rel="3.68.1"/>
  <changelog author="fstrba@suse.com" date="1586952000">- The pack200 and unpack200 alternatives should be slaves of java
  and not of javac, since they are part of JRE.</changelog>
  <changelog author="fstrba@suse.com" date="1587470400">- Update to upstream tag jdk-11.0.7+10 (April 2020 CPU,
  bsc#1169511)
  * Security fixes:
    + S8223898, CVE-2020-2754: Forward references to Nashorn
    + S8223904, CVE-2020-2755: Improve Nashorn matching
    + S8224541, CVE-2020-2756: Better mapping of serial ENUMs
    + S8224549, CVE-2020-2757: Less Blocking Array Queues
    + S8225603: Enhancement for big integers
    + S8226346: Build better binary builders
    + S8227467: Better class method invocations
    + S8227542: Manifest improved jar headers
    + S8229733: TLS message handling improvements
    + S8231415, CVE-2020-2773: Better signatures in XML
    + S8231785: Improved socket permissions
    + S8232424, CVE-2020-2778: More constrained algorithms
    + S8232581, CVE-2020-2767: Improve TLS verification
    + S8233250: Better X11 rendering
    + S8233410: Better Build Scripting
    + S8234027: Better JCEKS key support
    + S8234408, CVE-2020-2781: Improve TLS session handling
    + S8234825, CVE-2020-2800: Better Headings for HTTP Servers
    + S8234841, CVE-2020-2803: Enhance buffering of byte buffers
    + S8235274, CVE-2020-2805: Enhance typing of methods
    + S8235691, CVE-2020-2816: Enhance TLS connectivity
    + S8236201, CVE-2020-2830: Better Scanner conversions
    + S8238960: linux-i586 builds are inconsistent as the newly
    built jdk is not able to reserve enough space for object heap
  * Other changes:
    + S4919790: Errors in alert ssl message does not reflect the
    actual certificate status
    + S4949105: Access Bridge lacks html tags parsing
    + S7092821: java.security.Provider.getService() is synchronized
    and became scalability bottleneck
    + S7143743: Potential memory leak with zip provider
    + S8005819: Support cross-realm MSSFU
    + S8042383: [TEST_BUG] Test javax/swing/plaf/basic/BasicMenuUI/
    /4983388/bug4983388.java fails with shortcuts on menus do not
    work
    + S8068184: Fix for JDK-8032832 caused a deadlock
    + S8145845: [AOT] NullPointerException in
    compiler/whitebox/GetCodeHeapEntriesTest.java
    + S8152988: [AOT] Update test batch definitions to include
    aot-ed java.base module mode into hs-comp testing
    + S8160926: FLAGS_COMPILER_CHECK_ARGUMENTS doesn't handle
    cross-compilation
    + S8163083: SocketListeningConnector does not allow invocations
    with port 0
    + S8163251: Hard coded loop limit prevents reading of smart
    card data greater than 8k
    + S8167276: jvmci/compilerToVM/MaterializeVirtualObjectTest.java
    fails with -XX:-EliminateAllocations
    + S8169718: nsk/jdb/locals/locals002: ERROR: Cannot find
    boolVar with expected value: false
    + S8176556:
    java/awt/dnd/ImageTransferTest/ImageTransferTest.java fails
    for JFIF
    + S8178798: Two compiler/aot/verification/vmflags tests fail by
    timeout with UseAVX=3
    + S8183107: PKCS11 regression regarding checkKeySize
    + S8185005: Improve performance of
    ThreadMXBean.getThreadInfo(long ids[], int maxDepth)
    + S8189633: Missing -Xcheck:jni checking for DeleteWeakGlobalRef
    + S8189861: Refactor CacheFind
    + S8193042: NativeLookup::lookup_critical_entry() should only
    load shared library once
    + S8193596: java/net/DatagramPacket/ReuseBuf.java failed due to
    timeout
    + S8194944: Regression automated test 'open/test/jdk/javax/
    /swing/JInternalFrame/8145896/TestJInternalFrameMaximize.java'
    fails
    + S8196467: javax/swing/JInternalFrame/Test6325652.java fails
    + S8196969: JTreg Failure: serviceability/sa/ClhsdbJstack.java
    causes NPE
    + S8198321: javax/swing/JEditorPane/5076514/bug5076514.java
    fails
    + S8198398: Test javax/swing/JColorChooser/Test6199676.java
    fails in mach5
    + S8199072: Test javax/swing/GroupLayout/6613904/
    /bug6613904.java is unstable
    + S8200432: javadoc fails with ClassCastException on {@link
    byte[]}
    + S8201349: build broken when configured with
  - -with-zlib=bundled on gcc 7.3
    + S8201355: Avoid native memory allocation in
    sun.security.mscapi.PRNG.generateSeed
    + S8201513: nsk/jvmti/IterateThroughHeap/filter-* are broken
    + S8203364: Some serviceability/sa/ tests intermittently fail
    with java.io.IOException: LingeredApp terminated with non-zero
    exit code 3
    + S8203687: javax/net/ssl/compatibility/Compatibility.java
    supports TLS 1.3
    + S8203904: javax/swing/JSplitPane/4816114/bug4816114.java: The
    divider location is wrong
    + S8203911: Test runtime/modules/getModuleJNI/GetModule fails
    with -Xcheck:jni
    + S8204525: [TESTBUG] runtime/NMT/MallocStressTest.java ran out
    of java heap
    + S8204529: gc/TestAllocateHeapAtMultiple.java fail with Agent
    7 timed out
    + S8204551: Event descriptions are truncated in logs
    + S8206963: [AOT] bug with multiple class loaders
    + S8207367: 10 vmTestbase/nsk/jdi tests timed out when running
    with jtreg
    + S8207832: serviceability/sa/ClhsdbCDSCore.java failed with
    "Couldn't find core file location"
    + S8207938: At step6,Click Add button,case failed automatically.
    + S8208157: requires.VMProps throws NPE for missing properties
    in "release" file
    + S8208379: compiler/jvmci/events/
    /JvmciNotifyInstallEventTest.java failed with "Got unexpected
    event count after 2nd install attempt: expected 9 to equal 2"
    + S8208658: Make CDS archived heap regions usable even if
    compressed oop encoding has changed
    + S8208715: Conversion of milliseconds to nanoseconds in
    UNIXProcess contains bug
    + S8209361: [AOT] Unexpected number of references for
    JVMTI_HEAP_REFERENCE_CONSTANT_POOL [111--&gt;111]: 0 (expected
    at least 1)
    + S8209385: CDS runtime classpath checking is too strict when
    only classes from the system modules are archived
    + S8209389: SIGSEGV in WalkOopAndArchiveClosure::do_oop_work.
    + S8209418: Synchronize test/jdk/sanity/client/lib/jemmy with
    code-tools/jemmy/v2
    + S8209494: Create a test for SwingSet InternalFrameDemo
    + S8209499: Create test for SwingSet EditorPaneDemo
    + S8209574: [AOT] breakpoint events are generated in different
    threads does not meet expected count
    + S8209686: cleanup arguments to PhaseIdealLoop() constructor
    + S8209789: Synchronize test/jdk/sanity/client/lib/jemmy with
    code-tools/jemmy/v2
    + S8209802: Garbage collectors should register JFR types
    themselves to avoid build errors.
    + S8209807: improve handling exception in requires.VMProps
    + S8209817: stack is executable when building with Clang on
    Linux
    + S8209824: Improve the code coverage for ThreadLocal
    + S8209826: Undefined reference to os::write after JDK-8209657
    (filemap.hpp cleanup)
    + S8209850: Allow NamedThreads to use GlobalCounter critical
    sections
    + S8209976: Improve iteration over non-JavaThreads
    + S8209993: Create a test for SwingSet3 ToolTipDemo
    + S8210024: JFR calls virtual is_Java_thread from ~Thread()
    + S8210052: Enable testing for all the available look and feels
    in SwingSet3 demo tests
    + S8210055: Enable different look and feel tests in SwingSet3
    demo tests
    + S8210057: Enable different look and feels in SwingSet3 demo
    test InternalFrameDemoTest
    + S8210058: Algorithmic Italic font leans opposite angle in
    Printing
    + S8210220: [AOT] jdwp test cases are failing with error #
    ERROR: TEST FAILED: Cought IOException while receiving event
    packet
    + S8210289: ArchivedKlassSubGraphInfoRecord is incomplete
    + S8210459: Add support for generating compile_commands.json
    + S8210476: sun/security/mscapi/PrngSlow.java fails with Still
    too slow
    + S8210512: [Testbug] vmTestbase/nsk/jdi/ObjectReference/
    /referringObjects/referringObjects002/referringObjects002.java
    fails with unexpected size of
    ClassLoaderReference.referringObjects
    + S8210523: runtime/appcds/cacheObject/DifferentHeapSizes.java
    crash
    + S8210632: Add key exchange algorithm to
    javax/net/ssl/TLSCommon/CipherSuite.java
    + S8210699: Problem list tests which times out in Xcomp mode
    + S8210793: [JVMCI] AllocateCompileIdTest.java failed to find
    DiagnosticCommand.class
    + S8210910: Create test for FileChooserDemo
    + S8210994: Create test for SwingSet3 FrameDemo
    + S8211139: Increase timeout value in all tests under
    jdk/sanity/client/SwingSet/src
    + S8211160: Handle different look and feels in
    JInternalFrameOperator
    + S8211211: vmTestbase/metaspace/stressDictionary/
    /StressDictionary.java timeout
    + S8211322: Reduce the timeout of tooltip in SwingSet2DemoTest
    + S8211443: Enable different look and feels in SwingSet3 demo
    test SplitPaneDemoTest
    + S8211703: JInternalFrame : java.lang.AssertionError: cannot
    find the internal frame
    + S8211781: re-building fails after changing Graal sources
    + S8212897: Some improvements in the EditorPaneDemotest
    + S8212903: [TestBug] Tests test/jdk/javax/swing/LookAndFeel/
    /8145547/DemandGTK2.sh and DemandGTK3.sh fail on Ubuntu 18.04
    LTS
    + S8213009: Refactoring existing SunMSCAPI classes
    + S8213010: Supporting keys created with certmgr.exe
    + S8213168: Enable different look and feel tests in SwingSet3
    demo test FileChooserDemoTest
    + S8213348: jdk.internal.vm.compiler.management service
    providers missing in module descriptor
    + S8213906: Update arm devkits with libXrandr headers
    + S8213908: AssertionError in DeferredAttr at setOverloadKind
    + S8214124: [TESTBUG] Bugs in runtime/NMT/MallocStressTest.java
    + S8214344: C2: assert(con.basic_type() != T_ILLEGAL) failed:
    elembt=byte; loadbt=void; unsigned=0
    + S8214345: infinite recursion while checking super class
    + S8214471: Enable different look and feel tests in SwingSet3
    demo test ToolTipDemoTest
    + S8214534: Setting of THIS_FILE in the build is broken
    + S8214557: Filter out VM flags which don't affect AOT code
    generation
    + S8214578: [macos] Problem with backslashes on macOS/JIS
    keyboard: Java ignores system settings
    + S8214840: runtime/NMT/MallocStressTest.java timed out
    + S8214850: Rename vm_operations.?pp files to vmOperations.?pp
    files
    + S8214904: Test8004741.java failed due to "Too few ThreadDeath
    hits; expected at least 6 but saw only 5"
    + S8215322: add @file support to jaotc
    + S8215355: Object monitor deadlock with no threads holding the
    monitor (using jemalloc 5.1)
    + S8215396: JTabbedPane preferred size calculation is wrong for
    SCROLL_TAB_LAYOUT
    + S8216180: [AOT] compiler/intrinsics/bigInteger/TestMulAdd.java
    crashed with AOT enabled
    + S8216353: Use utility APIs introduced in org/netbeans/jemmy/
    /util/LookAndFeel class in client sanity test cases
    + S8216354: Syntax error in toolchain_windows.m4
    + S8216472: (se) Stack overflow during selection operation
    leads to crash (win)
    + S8216535: tools/jimage/JImageExtractTest.java timed out
    + S8217235: Create automated test for SwingSet
    ColorChooserDemoTest
    + S8217297: Add support for multiple look and feel for SwingSet
    SliderDemoTest
    + S8217338: [Containers] Improve systemd slice memory limit
    support
    + S8217613: [AOT] TEST_OPTS_AOT_MODULES doesn't work on mac
    + S8217634: RunTest documentation and usability update
    + S8217717: ZGC: Broken oop map in C1 load barrier stub
    + S8217728: Speed up incremental rerun of "make hotspot"
    + S8218268: Javac treats Manifest Class-Path entries as Paths
    instead of URLs
    + S8218662: Allow 204 responses with Content-Length:0
    + S8218882: NET_Writev is declared, NET_WriteV is defined
    + S8218889: Improperly use of the Optional API
    + S8219205: JFR file without license header
    + S8219597: (bf) Heap buffer state changes could provoke
    unexpected exceptions
    + S8219723: javax/net/ssl/compatibility/Compatibility.java
    failed on some SNI cases
    + S8220348: [ntintel] asserts about copying unaligned array
    + S8220451: jdi/EventQueue/remove/remove004 failed due to
    "ERROR: thread2 is not alive"
    + S8220456: jdi/EventQueue/remove_l/remove_l004 failed due to
    "TIMEOUT while waiting for event"
    + S8220479: java/nio/channels/Selector/SelectWithConsumer.java
    failed at testTwoChannels()
    + S8220613: java/util/Arrays/TimSortStackSize2.java times out
    with fastdebug build
    + S8220688: [TESTBUG] runtime/NMT/MallocStressTest.java timed
    out
    + S8220786: Create new switch to redirect error reporting
    output to stdout or stderr
    + S8221270: Duplicated synchronized keywords in SSLSocketImpl
    + S8221312: test/jdk/sanity/client/SwingSet/src/
    /ColorChooserDemoTest.java failed
    + S8221851: Use of THIS_FILE in hotspot invalidates precompiled
    header on Linux/GCC
    + S8221885: Add intermittent test in the JavaSound to the
    ProblemList
    + S8222264: Windows incremental build is broken with JDK-8217728
    + S8222391: javax/net/ssl/compatibility/Compatibility.java
    should be more flexible
    + S8222448: java/lang/reflect/PublicMethods/
    /PublicMethodsTest.java times out
    + S8222519: ButtonDemoScreenshotTest fails randomly with "still
    state to be reached"
    + S8222741: jdi/EventQueue/remove/remove004 fails due to
    VMDisconnectedException
    + S8223003: SunMSCAPI keys are not cleaned up
    + S8223063: Support CNG RSA keys
    + S8223158: Docked MacBook cannot start any Java Swing
    applications
    + S8223260: NamingManager should cache InitialContextFactory
    + S8223464: Improve version string for Oracle CI builds
    + S8223558: Java does not render Myanmar script correctly
    + S8223627: jdk-13+20 bundle name contains null instead of ea
    + S8223638: Replace wildcard address with loopback or local
    host in tests - part 6
    + S8223678: Add Visual Studio Code workspace generation support
    (for native code)
    + S8223727: com/sun/jndi/ldap/privconn/RunTest.java failed due
    to hang in LdapRequest.getReplyBer
    + S8223769: Assert triggers with -XX:+StressReflectiveCode
    + S8224187: Refactor arraycopy_prologue to allow ZGC read
    barriers on arraycopy
    + S8224475: JTextPane does not show images in HTML rendering
    + S8224673: Adjust permission for delayed starting of debugging
    + S8224705: Tests that need to be problem-listed or have
    printer resources
    + S8224778: test/jdk/demo/jfc/J2Ddemo/J2DdemoTest.java cannot
    find J2Ddemo.jar
    + S8224821: java/awt/Focus/NoAutotransferToDisabledCompTest/
    /NoAutotransferToDisabledCompTest.java fails linux-x64
    + S8224830: test/jdk/java/awt/Focus/
    /ModalExcludedWindowClickTest/
    /ModalExcludedWindowClickTest.java fails on linux-x64
    + S8224851: AArch64: fix warnings and errors with Clang and GCC
    8.3
    + S8224905: java/lang/ProcessBuilder/Basic.java#id1 failed with
    stream closed
    + S8225007: java/awt/print/PrinterJob/
    /LandscapeStackOverflow.java may hang
    + S8225105: java/awt/Focus/ShowFrameCheckForegroundTest/
    /ShowFrameCheckForegroundTest.java fails in Windows 10
    + S8225117: java/math/BigInteger/SymmetricRangeTests.java fails
    with ParseException
    + S8225128: Add exception for expiring DocuSign root to
    VerifyCACerts test
    + S8225130: Add exception for expiring Comodo roots to
    VerifyCACerts test
    + S8225144: [macos] In Aqua L&amp;F backspace key does not delete
    when Shift is pressed
    + S8225180: SignedObject with invalid Key not throwing the
    InvalidKeyException in Windows
    + S8225182: JNI exception pending in DestroyXIMCallback of
    awt_InputMethod.c:1327
    + S8225199: [Graal] compiler/jvmci/compilerToVM/
    /IsMatureVsReprofileTest.java fails with
  - XX:CompileThresholdScaling=0.1
    + S8225305: ProblemList java/lang/invoke/VarHandles tests
    + S8225350: compiler/jvmci/compilerToVM/IsCompilableTest.java
    timed out
    + S8225430: Replace wildcard address with loopback or local
    host in tests - part 14
    + S8225435: Upgrade IANA Language Subtag Registry to the latest
    for JDK14
    + S8225487: giflib legal file is missing attribution for
    openbsd-reallocarray.c
    + S8225567: Wrong file headers with 8202414 fix changeset
    + S8225684: [AOT] vmTestbase/vm/oom/production/
    /AlwaysOOMProduction tests fail with AOTed java.base
    + S8225766: Curve in certificate should not affect signature
    scheme when using TLSv1.3
    + S8225797: OldObjectSample event creates unexpected amount of
    checkpoint data
    + S8226381: ProblemList java/lang/reflect/PublicMethods/
    /PublicMethodsTest.java
    + S8226406: JVM fails to detect mismatched or corrupt CDS
    archive
    + S8226608: Hide the onjcmd option from the help output
    + S8226892: ActionListeners on JRadioButtons don't get notified
    when selection is changed with arrow keys
    + S8227112: exclude compiler/intrinsics/sha/sanity tests from
    AOT runs
    + S8227324: Upgrade to freetype 2.10.1
    + S8227528: TestAbortVMOnSafepointTimeout.java failed due to
    "RuntimeException: 'Safepoint sync time longer than' missing
    from stdout/stderr"
    + S8227645: Some tests in serviceability/sa run with fixed -Xmx
    values and risk running out of memory
    + S8227646: [TESTBUG] appcds/SharedArchiveConsistency timed out
    + S8227662: freetype seeks to index at the end of the font data
    + S8228479: Correct the format of ColorChooserDemoTest
    + S8228613: java.security.Provider#getServices order is no
    longer deterministic
    + S8228969: 2019-09-28 public suffix list update
    + S8229236: CriticalJNINatives: dll handling should be done in
    native thread state
    + S8229345: Memory leak due to vtable stubs not being shared on
    SPARC
    + S8229888: (zipfs) Updating an existing zip file does not
    preserve original permissions
    + S8229994: assert(false) failed: Bad graph detected in
    get_early_ctrl_for_expensive
    + S8230004: jdk/internal/jimage/JImageOpenTest.java runs no test
    + S8230235: Rendering HTML with empty img attribute and
    documentBaseKey cause Exception
    + S8230390: Problemlist SA tests with AOT
    + S8230400: Missing constant pool entry for a method in
    stacktrace
    + S8230459: Test failed to resume JVMCI CompilerThread
    + S8230480: check malloc/calloc results in java.desktop
    + S8230597: Update GIFlib library to the 5.2.1
    + S8230611: infinite loop in
    LogOutputList::wait_until_no_readers()
    + S8230624: [TESTBUG] Problemlist JFR
    compiler/TestCodeSweeper.java
    + S8230677: Should disable Escape Analysis if JVMTI capability
    can_get_owned_monitor_info was taken
    + S8230926: [macosx] Two apostrophes are entered instead of one
    with "U.S. International - PC" layout
    + S8231025: Incorrect method tag offset for big endian platform
    + S8231081: TestMetadataRetention fails due to missing symbol id
    + S8231387: java.security.Provider.getService returns random
    result due to race condition with mutating methods in the same
    class
    + S8231430: C2: Memory stomp in max_array_length() for
    T_ILLEGAL type
    + S8231445: check ZALLOC return values in awt coding
    + S8231507: Update Apache Santuario (XML Signature) to version
    2.1.4
    + S8231584: Deadlock with ClassLoader.findLibrary and
    System.loadLibrary call
    + S8231753: use more Posix functionality in aix
    os::print_os_info
    + S8231810: javax/net/ssl/templates/
    /SSLSocketSSLEngineTemplate.java fails intermittently with
    "java.lang.Exception: Unexpected EOF"
    + S8232003: (fs) Files.write can leak file descriptor in the
    exception case
    + S8232056: GetOwnedMonitorInfoWithEATest.java fails with ZGC:
    Heap too small
    + S8232060: add some initializations using sigemptyset in
    os_aix.cpp
    + S8232154: Update Mesa 3-D Headers to version 19.2.1
    + S8232167: Visual Studio install found through
  - -with-tools-dir value is discarded
    + S8232170: FSInfo#getJarClassPath throws an exception not
    declared in its throws clause
    + S8232200: [macos 10.15] Windows in fullscreen tests jumps
    around the screen
    + S8232207: Linux os::available_memory re-reads cgroup
    configuration on every invocation
    + S8232224: [TESTBUG] problemlist JFR TestLargeRootSet.java
    + S8232370: Refactor some com.sun.jdi tests to enable IDE
    integration
    + S8232433: [macos 10.15] java/awt/Window/
    /LocationAtScreenCorner/LocationAtScreenCorner.java may fail
    + S8232571: Add missing SIGINFO signal
    + S8232692: [TESTBUG] compiler/aot/fingerprint/
    /SelfChangedCDS.java fails when cds is disabled
    + S8232713: Update BCEL version to 6.3.1 in license file
    + S8232806: Introduce a system property to disable eager lambda
    initialization
    + S8232834: RunTest sometimes fails to produce valid
    exitcode.txt
    + S8232880: Update test documentation with additional settings
    for client UI tooltip tests
    + S8232950: SUNPKCS11 Provider incorrectly check key length for
    PSS Signatures.
    + S8233018: Add a new test to verify that DatagramSocket is not
    interruptible
    + S8233019: java.lang.Class.isPrimitive() (C1) returns wrong
    result if Klass* is aligned to 32bit
    + S8233032: assert(in_bb(n)) failed: must be
    + S8233078: fix minimal VM build on Linux ppc64(le)
    + S8233328: fix minimal VM build on Linux s390x
    + S8233383: Various minor fixes
    + S8233466: aarch64: remove unnecessary load of mdo when
    profiling return and parameters type
    + S8233491: Crash in AdapterHandlerLibrary::get_adapter with
    CDS due to code cache exhaustion
    + S8233529: loopTransform.cpp:2984: Error: assert(p_f-&gt;Opcode()
    == Op_IfFalse) failed
    + S8233548: Update CUP to v0.11b
    + S8233649: Update ProblemList.txt to exclude failing headful
    tests on macos
    + S8233656: assert(d-&gt;is_CFG() &amp;&amp; n-&gt;is_CFG()) failed: must
    have CFG nodes
    + S8233657: Intermittent NPE in Component.validate()
    + S8234288: Turkey Time Zone returns incorrect time zone name
    + S8234323: NULL-check return value of SurfaceData_InitOps on
    macosx
    + S8234339: replace JLI_StrTok in java_md_solinux.c
    + S8234340: Bump update version for OpenJDK: jdk-11.0.7
    + S8234350: assert(mode == ControlAroundStripMined &amp;&amp; (use ==
    sfpt || !use-&gt;is_reachable_from_root())) failed: missed a node
    + S8234386: [macos] NPE was thrown at expanding Choice from
    maximized frame
    + S8234397: add OS uptime information to os::print_os_info
    output
    + S8234423: Modifying ArrayList.subList().subList() resets
    modCount of subList
    + S8234466: Class loading deadlock involving
    X509Factory#commitEvent()
    + S8234501: remove obsolete NET_ReadV
    + S8234525: enable link-time section-gc for linux s390x to
    remove unused code
    + S8234610: MaxVectorSize set wrongly when UseAVX=3 is
    specified after JDK-8221092
    + S8234617: C1: Incorrect result of field load due to missing
    narrowing conversion
    + S8234723: javax/net/ssl/TLS tests support TLSv1.3
    + S8234724: javax/net/ssl/templates/
    /SSLSocketSSLEngineTemplate.java supports TLSv1.3
    + S8234741: enhance os::get_core_path on macOS
    + S8234769: Duplicate attribution in freetype.md
    + S8234786: Fix for JDK-8214578 breaks OS X 10.12 compatibility
    + S8234809: set relro in linker flags when building with gcc
    + S8234824: java/nio/channels/SocketChannel/AdaptSocket.java
    fails on Windows 10
    + S8235243: handle VS2017 15.9 and VS2019 in abstract_vm_version
    + S8235288: AVX 512 instructions inadvertently used on Xeon for
    small vector width operations
    + S8235325: build failure on Linux after 8235243
    + S8235383: C1 compilation fails with
  - XX:+PrintIRDuringConstruction -XX:+Verbose
    + S8235489: handle return values of sscanf calls in hotspot
    + S8235509: Backport for JDK-8209657 Refactor filemap.hpp to
    simplify integration with Serviceability Agent.
    + S8235510: java.util.zip.CRC32 performance drop after 8200067
    + S8235563: [TESTBUG] appcds/CommandLineFlagComboNegative.java
    does not handle archive mapping failure
    + S8235637: jhsdb jmap from OpenJDK 11.0.5 doesn't work if
    prelink is enabled
    + S8235671: enhance print_rlimit_info in os_posix
    + S8235744: PIT: test/jdk/javax/swing/text/html/
    /TestJLabelWithHTMLText.java times out in linux-x64
    + S8235904: Infinite loop when rendering huge lines
    + S8235998: [c2] Memory leaks during tracing after '8224193:
    stringStream should not use Resource Area'.
    + S8236039: JSSE Client does not accept status_request
    extension in CertificateRequest messages for TLS 1.3
    + S8236140: assert(!VerifyHashTableKeys || _hash_lock == 0)
    failed: remove node from hash table before modifying it
    + S8236179: C1 register allocation error with T_ADDRESS
    + S8236488: Support for configure option
  - -with-native-debug-symbols=internal is impossible on Windows
    + S8236500: Windows ucrt.dll should be looked up in versioned
    WINSDK subdirectory
    + S8236709: struct SwitchRange in HS violates C++ One
    Definition Rule
    + S8236848: [JDK 11u] make run-test-tier1 fails after backport
    of JDK-8232834
    + S8236873: Worker has a deadlock bug
    + S8237217: Incorrect G1StringDedupEntry type used in
    StringDedupTable destructor
    + S8237368: Problem with NullPointerException in RMI
    TCPEndpoint.read
    + S8237375: SimpleThresholdPolicy misses CounterDecay timestamp
    initialization
    + S8237508: Simplify JarFile.isInitializing
    + S8237540: Missing files in backport of JDK-8210910
    + S8237541: Missing files in backport of JDK-8236528
    + S8237600: Test SunJSSEFIPSInit fails on Ubuntu
    + S8237819: s390x - remove unused pd_zero_to_words_large
    + S8237869: exclude jtreg test security/infra/java/security/
    /cert/CertPathValidator/certification/LuxTrustCA.java because
    of instabilities
    + S8237879: make 4.3 breaks build
    + S8237945: CTW: C2 compilation fails with
    assert(just_allocated_object(alloc_ctl) == ptr) failed: most
    recent allo...
    + S8238225: Issues reported after replacing symlink at
    Contents/MacOS/libjli.dylib with binary
    + S8238247: CTW runner should sweep nmethods more aggressively
    + S8238366: CTW runner closes standard output on exit
    + S8238438: SuperWord::co_locate_pack picks memory state of
    first instead of last load
    + S8238502: sunmscapi.dll causing EXCEPTION_ACCESS_VIOLATION
    + S8238534: Deep sign macOS bundles before bundle archive is
    being created
    + S8238591: CTW: Split
    applications/ctw/modules/jdk_localedata.java
    + S8238596: AVX enabled by default for Skylake even when
    unsupported
    + S8238811: C2: assert(i &gt;= req() || i == 0 || is_Region() ||
    is_Phi()) with -XX:+VerifyGraphEdges
    + S8239005: [TESTBUG] test/hotspot/jtreg/runtime/
    /StackGuardPages/TestStackGuardPages.java: exeinvoke.c: must
    initialize static state before calling do_overflow()
    + S8239466: Loss of precision in counter decay calculation in
    11u backport of JDK-8237375
    + S8239856: [ntintel] asserts about copying unaligned array
    element
    + S8240724: [test] jdk11 downport of 8224475 misses binary file
    test/jdk/javax/swing/JTextPane/arrow.png
    + S8241296: Segfault in JNIHandleBlock::oops_do()
- Removed patch:
  * DependOnVariableHelper.patch
    + fixed upstream
- Added patch:
  * JDK-8228407.patch
    + fix crashes due to shared archive file mismatch</changelog>
  <changelog author="fstrba@suse.com" date="1594900800">- Update to upstream tag jdk-11.0.8+10 (July 2020 CPU, bsc#1174157)
  * Security fixes:
    + JDK-8230613: Better ASCII conversions
    + JDK-8231800: Better listing of arrays
    + JDK-8232014: Expand DTD support
    + JDK-8233234: Better Zip Naming
    + JDK-8233239, CVE-2020-14562: Enhance TIFF support
    + JDK-8233255: Better Swing Buttons
    + JDK-8234032: Improve basic calendar services
    + JDK-8234042: Better factory production of certificates
    + JDK-8234418: Better parsing with CertificateFactory
    + JDK-8234836: Improve serialization handling
    + JDK-8236191: Enhance OID processing
    + JDK-8236867, CVE-2020-14573: Enhance Graal interface handling
    + JDK-8237117, CVE-2020-14556: Better ForkJoinPool behavior
    + JDK-8237592, CVE-2020-14577: Enhance certificate verification
    + JDK-8238002, CVE-2020-14581: Better matrix operations
    + JDK-8238013: Enhance String writing
    + JDK-8238804: Enhance key handling process
    + JDK-8238842: AIOOBE in GIFImageReader.initializeStringTable
    + JDK-8238843: Enhanced font handing
    + JDK-8238920, CVE-2020-14583: Better Buffer support
    + JDK-8238925: Enhance WAV file playback
    + JDK-8240119, CVE-2020-14593: Less Affine Transformations
    + JDK-8240482: Improved WAV file playback
    + JDK-8241379: Update JCEKS support
    + JDK-8241522: Manifest improved jar headers redux
    + JDK-8242136, CVE-2020-14621: Better XML namespace handling
  * Other changes:
    + JDK-6933331: (d3d/ogl) java.lang.IllegalStateException:
    Buffers have not been created
    + JDK-7124307: JSpinner and changing value by mouse
    + JDK-8022574: remove HaltNode code after uncommon trap calls
    + JDK-8039082: [TEST_BUG] Test
    java/awt/dnd/BadSerializationTest/BadSerializationTest.java
    fails
    + JDK-8040630: Popup menus and tooltips flicker with previous
    popup contents when first shown
    + JDK-8044365: (dc) MulticastSendReceiveTests.java failing with
    ENOMEM when joining group (OS X 10.9)
    + JDK-8048215: [TESTBUG]
    java/lang/management/ManagementFactory/ThreadMXBeanProxy.java
    Expected non-null LockInfo
    + JDK-8051349: nsk/jvmti/scenarios/sampling/SP06/sp06t003 fails
    in nightly
    + JDK-8080353: JShell: Better error message on attempting to
    add default method
    + JDK-8139876: Exclude hanging nsk/stress/stack from execution
    with deoptimization enabled
    + JDK-8146090: java/lang/ref/ReachabilityFenceTest.java fails
    with -XX:+DeoptimizeALot
    + JDK-8153430: jdk regression test MletParserLocaleTest,
    ParserInfiniteLoopTest reduce default timeout
    + JDK-8156207: Resource allocated BitMaps are often cleared
    unnecessarily
    + JDK-8159740: JShell: corralled declarations do not have
    correct source to wrapper mapping
    + JDK-8175984: ICC_Profile has un-needed, not-empty finalize
    method
    + JDK-8176359: Frame#setMaximizedbounds not working properly in
    multi screen environments
    + JDK-8183369: RFC unconformity of HttpURLConnection with proxy
    + JDK-8187078: -XX:+VerifyOops finds numerous problems when
    running JPRT
    + JDK-8189861: Refactor CacheFind
    + JDK-8191169: java/net/Authenticator/B4769350.java failed
    intermittently
    + JDK-8191930: [Graal] emits unparseable XML into compile log
    + JDK-8193879: Java debugger hangs on method invocation
    + JDK-8196019: java/awt/Window/Grab/GrabTest.java fails on
    Windows
    + JDK-8196181: sun/java2d/GdiRendering/InsetClipping.java fails
    + JDK-8198000:
    java/awt/List/EmptyListEventTest/EmptyListEventTest.java
    debug assert on Windows
    + JDK-8198001: java/awt/Menu/WrongParentAfterRemoveMenu/
    /WrongParentAfterRemoveMenu.java debug assert on Windows
    + JDK-8198339: Test javax/swing/border/Test6981576.java is
    unstable
    + JDK-8200701: jdk/jshell/ExceptionsTest.java fails on Windows,
    after JDK-8198801
    + JDK-8203264: JNI exception pending in
    PlainDatagramSocketImpl.c:740
    + JDK-8203672: JNI exception pending in PlainSocketImpl.c
    + JDK-8203673: JNI exception pending in
    DualStackPlainDatagramSocketImpl.c:398
    + JDK-8204834: Fix confusing "allocate" naming in OopStorage
    + JDK-8205399: Set node color on pinned HashMap.TreeNode
    deletion
    + JDK-8205653: test/jdk/sun/management/jmxremote/bootstrap/
    /RmiRegistrySslTest.java and RmiSslBootstrapTest.sh fail with
    handshake_failure
    + JDK-8206179: com/sun/management/OperatingSystemMXBean/
    /GetCommittedVirtualMemorySize.java fails with Committed
    virtual memory size illegal value
    + JDK-8207334: VM times out in VM_HandshakeAllThreads::doit()
    with RunThese30M
    + JDK-8208277: Code cache heap (-XX:ReservedCodeCacheSize)
    doesn't work with 1GB LargePages
    + JDK-8209113: Use WeakReference for lastFontStrike for created
    Fonts
    + JDK-8209333: Socket reset issue for TLS 1.3 socket close
    + JDK-8209439: C2 library_call can potentially ignore Math.pow
    intrinsic or use null pointer
    + JDK-8209534: [TESTBUG]runtime/appcds/cacheObject/
    /ArchivedModuleCompareTest.java fails with EnableJVMCI.
    + JDK-8210147: adjust some WSAGetLastError usages in windows
    network coding
    + JDK-8210284: "assert((av &amp; 0x00000001) == 0) failed:
    unsupported V8" on Solaris 11.4
    + JDK-8210303: VM_HandshakeAllThreads fails assert with
    "failed: blocked and not walkable"
    + JDK-8210459: Add support for generating compile_commands.json
    + JDK-8210515: [TESTBUG]CheckArchivedModuleApp.java needs to
    check if EnableJVMCI is set.
    + JDK-8210788: Javadoc for Thread.join(long, int) should
    specify that it waits forever when both arguments are zero
    + JDK-8211301: [macos] support full window content options
    + JDK-8211332: Space for stub routines (code_size2) is too
    small on new Skylake CPUs
    + JDK-8211339: NPE during SSL handshake caused by
    HostnameChecker
    + JDK-8211392: compiler/profiling/
    /spectrapredefineclass_classloaders/Launcher.java times out
    in JDK12 CI
    + JDK-8211743: [AOT] crash in ScopeDesc::decode_body() when
    JVMTI walks AOT frames
    + JDK-8212154: [TESTBUG] CheckArchivedModuleApp fails with NPE
    when JVMCI is absent
    + JDK-8212167: JShell : Stack trace of exception has wrong line
    number
    + JDK-8212933: Thread-SMR: requesting a VM operation whilst
    holding a ThreadsListHandle can cause deadlocks
    + JDK-8212986: Make Visual Studio compiler check less strict
    + JDK-8213250: CDS archive creation aborts due to metaspace
    object allocation failure
    + JDK-8213516: jck test api/javax_accessibility/AccessibleState/
    /fields.html fails intermittent
    + JDK-8213947: ARM32: failed check_simd should set
    UsePopCountInstruction to false
    + JDK-8214418: half-closed SSLEngine status may cause
    application dead loop
    + JDK-8214440: ldap over a TLS connection negotiate failed with
    "javax.net.ssl.SSLPeerUnverifiedException: hostname of the
    server does not match the hostname in the server's
    certificate"
    + JDK-8214444: Wrong strncat limits in dfa.cpp
    + JDK-8214481: freetype path does not disable TrueType hinting
    with AA+FM hints
    + JDK-8214571: -Xdoclint of array serialField gives "error:
    array type not allowed here"
    + JDK-8214856: Errors with JSZip in web console after upgrade
    to 3.1.5
    + JDK-8214862: assert(proj != __null) at compile.cpp:3251
    + JDK-8215369: Jcstress pollute /var/tmp with temporary files.
    + JDK-8215551: Missing case label in nmethod::reloc_string_for()
    + JDK-8215555: TieredCompilation C2 threads can excessively
    block handshakes
    + JDK-8215711: Missing key_share extension for (EC)DHE key
    exchange should alert missing_extension
    + JDK-8216151: [Graal] Module
    jdk.internal.vm.compiler.management has not been granted
    accessClassInPackage.org.graalvm.compiler.debug
    + JDK-8216154: C4819 warnings at HotSpot sources on Windows
    + JDK-8216541: CompiledICHolders of VM locked unloaded nmethods
    are released too late
    + JDK-8217230: assert(t == t_no_spec) failure in
    NodeHash::check_no_speculative_types()
    + JDK-8217404: --with-jvm-features doesn't work when multiple
    features are explicitly disabled
    + JDK-8217447: Develop flag TraceICs is broken
    + JDK-8217606: LdapContext#reconnect always opens a new
    connection
    + JDK-8218807: Compilation database (compile_commands.json) may
    contain obsolete items
    + JDK-8219214: Infinite Loop in CodeSection::dump()
    + JDK-8219904: ClassCastException when calling
    FlightRecorderMXBean#getRecordings()
    + JDK-8219991: New fix of the deadlock in
    sun.security.ssl.SSLSocketImpl
    + JDK-8221121: applications/microbenchmarks are encountering
    crashes in tier5
    + JDK-8221445: FastSysexMessage constructor crashes MIDI
    receiption thread
    + JDK-8221482: Initialize VMRegImpl::regName[] earlier to
    prevent assert during PrintStubCode
    + JDK-8221741: ClassCastException can happen when
    fontconfig.properties is used
    + JDK-8221823: Requested JDialog width is ignored
    + JDK-8223108: Test java/awt/EventQueue/
    /NonComponentSourcePost.java is unstable
    + JDK-8223678: Add Visual Studio Code workspace generation
    support (for native code)
    + JDK-8223935: PIT: java/awt/font/WindowsIndicFonts.java fails
    on windows10
    + JDK-8224109: Text spaced incorrectly by drawString under
    rotation with fractional metric
    + JDK-8224632: testbug: java/awt/dnd/RemoveDropTargetCrashTest/
    /RemoveDropTargetCrashTest.java fails on MacOS
    + JDK-8224793: os::die() does not honor CreateCoredumpOnCrash
    option
    + JDK-8224847: gc/stress/TestReclaimStringsLeaksMemory.java
    fails with reserved greater than expected
    + JDK-8224931: disable JAOTC invokedynamic support until
    8223533 is fixed
    + JDK-8224997: ChaCha20-Poly1305 TLS cipher suite decryption
    throws ShortBufferException
    + JDK-8225068: Remove DocuSign root certificate that is
    expiring in May 2020
    + JDK-8225069: Remove Comodo root certificate that is expiring
    in May 2020
    + JDK-8225126: Test SetBoundsPaintTest.html faild on Windows
    when desktop is scaled
    + JDK-8225325: Add tests for redefining a class' private method
    during resolution of the bootstrap specifier
    + JDK-8225622: [AOT] runtime/SharedArchiveFile/
    /TestInterpreterMethodEntries.java crashed with AOTed
    java.base
    + JDK-8225653: Provide more information when hitting SIGILL
    from HaltNode
    + JDK-8225783: Incorrect use of binary operators on booleans in
    type.cpp
    + JDK-8225789: Empty method parameter type should generate
    ClassFormatError
    + JDK-8226198: use of &amp; instead of &amp;&amp; in
    LibraryCallKit::arraycopy_restore_alloc_state
    + JDK-8226253: JAWS reports wrong number of radio buttons when
    buttons are hidden.
    + JDK-8226653: [accessibility] Can edit text cell correctly,
    but Accessibility Tool reads nothing about editor
    + JDK-8226806: [macOS 10.14] Methods of Java Robot should be
    called from appropriate thread
    + JDK-8226879: Memory leak in Type::hashcons
    + JDK-8227632: Incorrect PrintCompilation message: made not
    compilable on levels 0 1 2 3 4
    + JDK-8228407: JVM crashes with shared archive file mismatch
    + JDK-8228482: fix xlc16/xlclang comparison of distinct pointer
    types and string literal conversion warnings
    + JDK-8228757: Fail fast if the handshake type is unknown
    + JDK-8229158: make UseSwitchProfiling non-experimental or
    false by-default
    + JDK-8229421: The logic of java/net/ipv6tests/TcpTest.java is
    flawed
    + JDK-8229855: C2 fails with assert(false) failed: bad AD file
    + JDK-8230591: AArch64: Missing intrinsics for Math.ceil,
    floor, rint
    + JDK-8231118: ARM32: Math tests failures
    + JDK-8231213: Migrate SimpleDateFormatConstTest to JDK Repo
    + JDK-8231243: [TESTBUG] CustomFont.java cannot find font file
    + JDK-8231438: [macOS] Dark mode for the desktop is not
    supported
    + JDK-8231550: C2: ShouldNotReachHere() in
    verify_strip_mined_scheduling
    + JDK-8231564: setMaximizedBounds is broken with large display
    scale and multiple monitors
    + JDK-8231572: Use -lobjc instead of -fobjc-link-runtime in
    libosxsecurity
    + JDK-8231631: sun/net/ftp/FtpURLConnectionLeak.java fails
    intermittently with NPE
    + JDK-8231671: Fix copyright headers in hotspot (missing comma
    after year)
    + JDK-8231720: Some perf regressions after 8225653
    + JDK-8231779: crash
    HeapWord*ParallelScavengeHeap::failed_mem_allocate
    + JDK-8231863: Crash if classpath is read from @argument file
    and the main gets option argument
    + JDK-8232080: jlink plugins for vendor information and
    run-time options
    + JDK-8232106: [x86] C2: SIGILL due to usage of SSSE3
    instructions on processors which don't support it
    + JDK-8232134: Change to Visual Studio 2017 15.9.16 for
    building on Windows at Oracle
    + JDK-8232226: [macos 10.15] test/jdk/java/awt/color/
    /EqualityTest/EqualityTest.java may fail
    + JDK-8232357: Compare version info of Santuario to legal notice
    + JDK-8232572: Add hooks for custom output dir in Bundles.gmk
    + JDK-8232634: Problem List ICMColorDataTest.java
    + JDK-8232748: Build static versions of certain JDK libraries
    + JDK-8232846: ProcessHandle.Info command with non-English
    shows question marks
    + JDK-8232880: Update test documentation with additional
    settings for client UI tooltip tests
    + JDK-8233033: C2 produces wrong result while unswitching a
    loop due to lost control dependencies
    + JDK-8233137: runtime/ErrorHandling/VeryEarlyAssertTest.java
    fails after 8232080
    + JDK-8233197: Invert JvmtiExport::post_vm_initialized() and
    Jfr:on_vm_start() start-up order for correct option parsing
    + JDK-8233291: [TESTBUG] tools/jlink/plugins/
    /VendorInfoPluginsTest.java fails with debug or non-server VMs
    + JDK-8233364: Fix undefined behavior in
    Canonicalizer::do_ShiftOp
    + JDK-8233494: Avoid calling MallocTracker::record_malloc and
    record_free when NMT is off
    + JDK-8233573: Toolkit.getScreenInsets(GraphicsConfiguration)
    may throw ClassCastException
    + JDK-8233608: Minimal build broken after JDK-8233494
    + JDK-8233621: Mismatch in jsse.enableMFLNExtension property
    name
    + JDK-8233696: [TESTBUG]Some jtreg tests fail when CAPS_LOCK is
    ON
    + JDK-8233707: systemScale.cpp could not compile with VS2019
    + JDK-8233801: GCMEmptyIv.java test fails on Solaris 11.4
    + JDK-8233880: Support compilers with multi-digit major version
    numbers
    + JDK-8233920: MethodHandles::tryFinally generates illegal
    bytecode for long/double return type
    + JDK-8234137: The "AutoTestOnTop.java" test may run external
    applications
    + JDK-8234146: compiler/jsr292/
    /ContinuousCallSiteTargetChange.java times out on SPARC
    + JDK-8234184: [TESTBUG] java/awt/Mouse/EnterExitEvents/
    /ModalDialogEnterExitEventsTest.java fails in Windows
    + JDK-8234270: [REDO] JDK-8204128 NMT might report incorrect
    numbers for Compiler area
    + JDK-8234332: [TESTBUG] java/awt/Focus/DisposedWindow/
    /DisposeDialogNotActivateOwnerTest/
    /DisposeDialogNotActivateOwnerTest.java fails on linux-x64
    nightly
    + JDK-8234398: Replace ID2D1Factory::GetDesktopDpi with
    GetDeviceCaps
    + JDK-8234522: [macos] Crash with use of native file dialog
    + JDK-8234691: Potential double-free in ParallelSPCleanupTask
    constructor
    + JDK-8234696: tools/jlink/plugins/VendorInfoPluginsTest.java
    times out
    + JDK-8234727: sun/security/ssl/X509TrustManagerImpl tests
    support TLSv1.3
    + JDK-8234728: Some security tests should support TLSv1.3
    + JDK-8234779: Provide idiom for declaring classes noncopyable
    + JDK-8234824: java/nio/channels/SocketChannel/AdaptSocket.java
    fails on Windows 10
    + JDK-8234968: check calloc rv in libinstrument
    InvocationAdapter
    + JDK-8235153: [TESTBUG] [macos 10.15] java/awt/Graphics/
    /DrawImageBG/SystemBgColorTest.java fails
    + JDK-8235183: Remove the "HACK CODE" in comment
    + JDK-8235263: Revert TLS 1.3 change that wrapped IOExceptions
    + JDK-8235311: Tag mismatch may alert bad_record_mac
    + JDK-8235332: TestInstanceCloneAsLoadsStores.java fails with
  - XX:+StressGCM
    + JDK-8235452: Strip mined loop verification fails with
    assert(is_OuterStripMinedLoop()) failed: invalid node class
    + JDK-8235584: UseProfiledLoopPredicate fails with
    assert(_phase-&gt;get_loop(c) == loop) failed: have to be in the
    same loop
    + JDK-8235620: Broken merge between JDK-8006406 and JDK-8003559
    + JDK-8235638: NPE in LWWindowPeer.getOnscreenGraphics()
    + JDK-8235686: Add more custom hooks in Bundles.gmk
    + JDK-8235739: Rare NPE at WComponentPeer.getGraphics()
    + JDK-8235762: JVM crash in SWPointer during C2 compilation
    + JDK-8235834: IBM-943 charset encoder needs updating
    + JDK-8235874: The ordering of Cipher Suites is not maintained
    provided through jdk.tls.client.cipherSuites and
    jdk.tls.server.cipherSuites system property.
    + JDK-8235908: omit ThreadPriorityPolicy warning when value is
    set from image
    + JDK-8235984: C2: assert(out-&gt;in(PhiNode::Region) == head ||
    out-&gt;in(PhiNode::Region) == slow_head) failed: phi must be
    either part of the slow or the fast loop
    + JDK-8236211: [Graal] compiler/graalunit/GraphTest.java is
    skipped in all testing
    + JDK-8236470: Deal with ECDSA using ecdsa-with-SHA2 plus hash
    algorithm as AlgorithmId
    + JDK-8236545: Compilation error in mach5
    java/awt/FileDialog/MacOSGoToFolderCrash.java
    + JDK-8236700: Upgrading JSZip from v3.1.5 to v3.2.2
    + JDK-8236759: ShouldNotReachHere in
    PhaseIdealLoop::verify_strip_mined_scheduling
    + JDK-8236897: Fix the copyright header for pkcs11gcm2.h
    + JDK-8236921: Add build target to produce a JDK image suitable
    for a Graal/SVM build
    + JDK-8236953: [macos] JavaFX SwingNode is not rendered on macOS
    + JDK-8236996: Incorrect Roboto font rendering on Windows with
    subpixel antialiasing
    + JDK-8237045: JVM uses excessive memory with -XX:+EnableJVMCI
  - XX:JVMCICounterSize=2147483648
    + JDK-8237055: [TESTBUG] compiler/c2/TestJumpTable.java fails
    with release VMs
    + JDK-8237086: assert(is_MachReturn()) running CTW with fix for
    JDK-8231291
    + JDK-8237192: Generate stripped/public pdbs on Windows for jdk
    images
    + JDK-8237396: JvmtiTagMap::weak_oops_do() should not trigger
    barriers
    + JDK-8237474: Default SSLEngine should create in server role
    + JDK-8237859: C2: Crash when loads float above range check
    + JDK-8237879: make 4.3 breaks build
    + JDK-8237951: CTW: C2 compilation fails with "malformed
    control flow"
    + JDK-8237962: give better error output for invalid OCSP
    response intervals in CertPathValidator checks
    + JDK-8238190: [JVMCI] Fix single implementor speculation for
    diamond shapes.
    + JDK-8238356: CodeHeap::blob_count() overestimates the number
    of blobs
    + JDK-8238452: Keytool generates wrong expiration date if
    validity is set to 2050/01/01
    + JDK-8238555: Allow Initialization of SunPKCS11 with NSS when
    there are external FIPS modules in the NSSDB
    + JDK-8238575: DragSourceEvent.getLocation() returns wrong
    value on HiDPI screens (Windows)
    + JDK-8238676: jni crashes on accessing it from process exit
    hook
    + JDK-8238721: Add failing client jtreg tests to the Problem
    List
    + JDK-8238738: AudioSystem.getMixerInfo() takes about 30 sec to
    report a gone audio device
    + JDK-8238756: C2: assert(((n) == __null || !VerifyIterativeGVN
    || !((n)-&gt;is_dead()))) failed: can not use dead node
    + JDK-8238765: PhaseCFG::schedule_pinned_nodes cannot handle
    precedence edges from unmatched CFG nodes correctly
    + JDK-8238898: Missing hash characters for header on license
    file
    + JDK-8238942: Rendering artifacts with LCD text and fractional
    metrics
    + JDK-8238985: [TESTBUG] The arrow image is blue instead of
    green
    + JDK-8239000: handle ContendedPaddingWidth in vm_version_ppc
    + JDK-8239055: Wrong implementation of VMState.hasListener
    + JDK-8239091: Reversed arguments in call to strstr in freetype
    "debug" code.
    + JDK-8239142: C2's UseUniqueSubclasses optimization is broken
    for array accesses
    + JDK-8239224: libproc_impl.c previous_thr may be used
    uninitialized warning
    + JDK-8239351: Give more meaningful InternalError messages in
    Deflater.c
    + JDK-8239365: ProcessBuilder test modifications for AIX
    execution
    + JDK-8239456: vtable stub generation: assert failure (code
    size estimate)
    + JDK-8239457: call ReleaseStringUTFChars before early returns
    in Java_sun_security_pkcs11_wrapper_PKCS11_connect
    + JDK-8239462: jdk.hotspot.agent misses some
    ReleaseStringUTFChars calls in case of early returns
    + JDK-8239557: [TESTBUG] VeryEarlyAssertTest.java validating
    "END." marker at lastline is not always true
    + JDK-8239787: AArch64: String.indexOf may incorrectly handle
    empty strings
    + JDK-8239792: Bump update version for OpenJDK: jdk-11.0.8
    + JDK-8239798: SSLSocket closes socket both socket endpoints on
    a SocketTimeoutException
    + JDK-8239819: XToolkit: Misread of screen information memory
    + JDK-8239852: java/util/concurrent tests fail with
  - XX:+VerifyGraphEdges: assert(!VerifyGraphEdges) failed:
    verification should have failed
    + JDK-8239893: Windows handle Leak when starting processes
    using ProcessBuilder
    + JDK-8239915: Zero VM crashes when handling dynamic constant
    + JDK-8239931: [win][x86] vtable stub generation: assert
    failure (code size estimate) follow-up
    + JDK-8239965: XMLEncoder/Test4625418.java fails due to "Error:
    Cp943 - can't read properly"
    + JDK-8239976: Put JDK-8239965 on the ProblemList.txt
    + JDK-8240073: Fix 'test-make' build target in 11u
    + JDK-8240197: Cannot start JVM when $JAVA_HOME includes CJK
    characters
    + JDK-8240202: A few client tests leave mouse buttons pressed
    + JDK-8240220: IdealLoopTree::dump_head predicate printing is
    broken
    + JDK-8240223: Use consistent predicate order in and with
    PhaseIdealLoop::find_predicate
    + JDK-8240227: Loop predicates should be copied to unswitched
    loops
    + JDK-8240286: [TESTBUG] Test command error in hotspot/jtreg/
    /compiler/loopopts/superword/SumRedAbsNeg_Float.java
    + JDK-8240518: Incorrect JNU_ReleaseStringPlatformChars in
    Windows Print
    + JDK-8240529: CheckUnhandledOops breaks NULL check in
    Modules::define_module
    + JDK-8240576: JVM crashes after transformation in C2
    IdealLoopTree::merge_many_backedges
    + JDK-8240603: Windows 32bit compile error after 8238676
    + JDK-8240629: argfiles parsing broken for argfiles with
    comment cross 4096 bytes chunk
    + JDK-8240711: TestJstatdPort.java failed due to
    "ExportException: Port already in use:"
    + JDK-8240786: [TESTBUG] The test java/awt/Window/
    /GetScreenLocation/GetScreenLocationTest.java fails on HiDPI
    screen
    + JDK-8240824: enhance print_full_memory_info on Linux by THP
    related information
    + JDK-8240827: Downport SSLSocketImpl.java from "8221882: Use
    fiber-friendly java.util.concurrent.locks in JSSE"
    + JDK-8240905: assert(mem == (Node*)1 || mem == mem2) failed:
    multiple Memories being matched at once?
    + JDK-8240972: macOS codesign fail on macOS 10.13.5 or older
    + JDK-8241445: Fix copyright in
    test/jdk/tools/launcher/ArgFileSyntax.java
    + JDK-8241458: [JVMCI] add mark value to expose
    CodeOffsets::Frame_Complete
    + JDK-8241464: [11u] Backport: make rehashing be a needed
    guaranteed safepoint cleanup action
    + JDK-8241556: Memory leak if -XX:CompileCommand is set
    + JDK-8241568: (fs) UserPrincipalLookupService.lookupXXX
    failure with IOE "Operation not permitted"
    + JDK-8241586: compiler/cpuflags/
    /TestAESIntrinsicsOnUnsupportedConfig.java fails on aarch64
    + JDK-8241638: launcher time metrics always report 1 on Linux
    when _JAVA_LAUNCHER_DEBUG set
    + JDK-8241660: Add virtualization information output to hs_err
    file on macOS
    + JDK-8241808: [TESTBUG] The JDK-8039467 bug appeared on macOS
    + JDK-8241888: Mirror jdk.security.allowNonCaAnchor system
    property with a security one
    + JDK-8241900: Loop unswitching may cause dependence on null
    check to be lost
    + JDK-8241948: enhance list of environment variables printed in
    hs_err file
    + JDK-8241996: on linux set full relro in the linker flags
    + JDK-8242108: Performance regression after fix for JDK-8229496
    + JDK-8242141: New System Properties to configure the TLS
    signature schemes
    + JDK-8242154: Backport parts of JDK-4947890 to OpenJDK 11u
    + JDK-8242174: [macos] The NestedModelessDialogTest test make
    the macOS unstable
    + JDK-8242239: [Graal] javax/management/generified/
    /GenericTest.java fails: FAILED: queryMBeans sets same
    + JDK-8242294: JSSE Client does not throw SSLException when an
    alert occurs during handshaking
    + JDK-8242379: [TESTBUG] compiler/loopopts/
    /TestLoopUnswitchingLostCastDependency.java fails with
    release VMs
    + JDK-8242470: Update Xerces to Version 2.12.1
    + JDK-8242498: Invalid "sun.awt.TimedWindowEvent" object leads
    to JVM crash
    + JDK-8242541: Small charset issues (ISO8859-16, x-eucJP-Open,
    x-IBM834 and x-IBM949C)
    + JDK-8242626: enhance posix print_rlimit_info
    + JDK-8243059: Build fails when --with-vendor-name contains a
    comma
    + JDK-8243539: Copyright info (Year) should be updated for fix
    of 8241638
    + JDK-8243541: (tz) Upgrade time-zone data to tzdata2020a
    + JDK-8244407: JVM crashes after transformation in C2
    IdealLoopTree::split_fall_in
    + JDK-8244520: problemlist
    java/awt/font/Rotate/RotatedFontTest.java on linux
    + JDK-8244777: ClassLoaderStats VM Op uses constant hash value
    + JDK-8244853: The static build of libextnet is missing the
    JNI_OnLoad_extnet function
    + JDK-8244951: Missing entitlements for hardened runtime
    + JDK-8245047: [PPC64] C2: ReverseBytes + Load always match to
    unordered Load (acquire semantics missing)
    + JDK-8245649: Revert 8245397 backport of 8230591
    + JDK-8246031: SSLSocket.getSession() doesn't close connection
    for timeout/ interrupts
    + JDK-8246613: Choose the default SecureRandom algo based on
    registration ordering
    + JDK-8248505: Unexpected NoSuchAlgorithmException when using
    secure random impl from BCFIPS provider
- Removed patch:
  * JDK-8228407.patch
    + integrated upstream</changelog>
  <changelog author="fstrba@suse.com" date="1604318400">- Update to upstream tag jdk-11.0.9-11 (October 2020 CPU,
  bsc#1177943)
  * New features
    + JDK-8250784: Shenandoah: A Low-Pause-Time Garbage Collector
  * Security fixes
    + JDK-8233624: Enhance JNI linkage
    + JDK-8236196: Improve string pooling
    + JDK-8236862, CVE-2020-14779: Enhance support of Proxy class
    + JDK-8237990, CVE-2020-14781: Enhanced LDAP contexts
    + JDK-8237995, CVE-2020-14782: Enhance certificate processing
    + JDK-8240124: Better VM Interning
    + JDK-8241114, CVE-2020-14792: Better range handling
    + JDK-8242680, CVE-2020-14796: Improved URI Support
    + JDK-8242685, CVE-2020-14797: Better Path Validation
    + JDK-8242695, CVE-2020-14798: Enhanced buffer support
    + JDK-8243302: Advanced class supports
    + JDK-8244136, CVE-2020-14803: Improved Buffer supports
    + JDK-8244479: Further constrain certificates
    + JDK-8244955: Additional Fix for JDK-8240124
    + JDK-8245407: Enhance zoning of times
    + JDK-8245412: Better class definitions
    + JDK-8245417: Improve certificate chain handling
    + JDK-8248574: Improve jpeg processing
    + JDK-8249927: Specify limits of jdk.serialProxyInterfaceLimit
    + JDK-8253019: Enhanced JPEG decoding
  * Other changes
    + JDK-6532025: GIF reader throws misleading exception with
    truncated images
    + JDK-6949753: [TEST BUG]: java/awt/print/PageFormat/
    /PDialogTest.java needs update by removing an infinite loop
    + JDK-8022535: [TEST BUG] javax/swing/text/html/parser/
    /Test8017492.java fails
    + JDK-8062947: Fix exception message to correctly represent
    LDAP connection failure
    + JDK-8067354: com/sun/jdi/GetLocalVariables4Test.sh failed
    + JDK-8134599: TEST_BUG: java/rmi/transport/closeServerSocket/
    /CloseServerSocket.java fails intermittently with Address
    already in use
    + JDK-8151678: com/sun/jndi/ldap/LdapTimeoutTest.java failed
    due to timeout on DeadServerNoTimeoutTest is incorrect
    + JDK-8160768: Add capability to custom resolve host/domain
    names within the default JNDI LDAP provider
    + JDK-8172404: Tools should warn if weak algorithms are used
    before restricting them
    + JDK-8193367: Annotated type variable bounds crash javac
    + JDK-8202117: com/sun/jndi/ldap/RemoveNamingListenerTest.java
    fails intermittently: Connection reset
    + JDK-8203026: java.rmi.NoSuchObjectException: no such object
    in table
    + JDK-8203281: [Windows] JComboBox change in ui when
    editor.setBorder() is called
    + JDK-8203382: Rename SystemDictionary::initialize_wk_klass to
    resolve_wk_klass
    + JDK-8203393: com/sun/jdi/JdbMethodExitTest.sh and
    JdbExprTest.sh fail due to timeout
    + JDK-8203928: [Test] Convert non-JDB scaffolding
    serviceability shell script tests to java
    + JDK-8204963: javax.swing.border.TitledBorder has a memory leak
    + JDK-8204994: SA might fail to attach to process with "Windbg
    Error: WaitForEvent failed"
    + JDK-8205534: Remove SymbolTable dependency from
    serviceability agent
    + JDK-8206309: Tier1 SA tests fail
    + JDK-8208281: java/nio/channels/
    /AsynchronousSocketChannel/Basic.java timed out
    + JDK-8209109: [TEST] rewrite com/sun/jdi shell tests to java
    version - step1
    + JDK-8209332: [TEST] test/jdk/com/sun/jdi/CatchPatternTest.sh
    is incorrect
    + JDK-8209342: Problemlist SA tests on Solaris due to Error
    attaching to process: Can't create thread_db agent!
    + JDK-8209343: Test javax/swing/border/TestTitledBorderLeak.java
    should be marked as headful
    + JDK-8209517: com/sun/jdi/BreakpointWithFullGC.java fails with
    timeout
    + JDK-8209604: [TEST] rewrite com/sun/jdi shell tests to java
    version - step2
    + JDK-8209605: com/sun/jdi/BreakpointWithFullGC.java fails with
    ZGC
    + JDK-8209608: Problem list com/sun/jdi/BreakpointWithFullGC.java
    + JDK-8210131: vmTestbase/nsk/jvmti/scenarios/allocation/AP10/
    /ap10t001/TestDescription.java failed with ObjectFree:
    GetCurrentThreadCpuTimerInfo returned unexpected error code
    + JDK-8210243: [TEST] rewrite com/sun/jdi shell tests to java
    version - step3
    + JDK-8210527: JShell: NullPointerException in
    jdk.jshell.Eval.translateExceptionStack
    + JDK-8210560: [TEST] convert com/sun/jdi redefineClass-related
    tests
    + JDK-8210725: com/sun/jdi/RedefineClearBreakpoint.java fails
    with waitForPrompt timed out after 60 seconds
    + JDK-8210748: [TESTBUG] lib.jdb.Jdb.waitForPrompt() should
    clarify which output is the pending reply after a timeout
    + JDK-8210760: [TEST] rewrite com/sun/jdi shell tests to java
    version - step4
    + JDK-8210977: jdk/jfr/event/oldobject/TestThreadLocalLeak.java
    fails to find ThreadLocalObject
    + JDK-8211292: [TEST] convert com/sun/jdi/DeferredStepTest.sh
    test
    + JDK-8211694: JShell: Redeclared variable should be reset
    + JDK-8212200: assert when shared java.lang.Object is redefined
    by JVMTI agent
    + JDK-8212629: [TEST] wrong breakpoint in
    test/jdk/com/sun/jdi/DeferredStepTest
    + JDK-8212665: com/sun/jdi/DeferredStepTest.java: jj1 (line 57)
  - unexpected. lastLine=52, minLine=52, maxLine=55
    + JDK-8212807: tools/jar/multiRelease/Basic.java times out
    + JDK-8213182: Minimal VM build failure after JDK-8212200
    (assert when shared java.lang.Object is redefined by JVMTI
    agent)
    + JDK-8213214: Set -Djava.io.tmpdir= when running tests
    + JDK-8213275: ReplaceCriticalClasses.java fails with
    jdk.internal.vm.PostVMInitHook not found
    + JDK-8213574: Deadlock in string table expansion when dumping
    lots of CDS classes
    + JDK-8213703: LambdaConversionException: Invalid receiver type
    not a subtype of implementation type interface
    + JDK-8214074: Ghash optimization using AVX instructions
    + JDK-8214491: Upgrade to JLine 3.9.0
    + JDK-8214797: TestJmapCoreMetaspace.java timed out
    + JDK-8215243: JShell tests failing intermitently with
    "Problem cleaning up the following threads:"
    + JDK-8215244: jdk/jshell/ToolBasicTest.java
    testHistoryReference failed
    + JDK-8215354: x86_32 build failures after JDK-8214074 (Ghash
    optimization using AVX instructions)
    + JDK-8215438: jshell tool: Ctrl-D causes EOF
    + JDK-8216021: RunTest.gmk might set concurrency level to 1 on
    Windows
    + JDK-8216974: HttpConnection not returned to the pool after
    204 response
    + JDK-8218948: SimpleDateFormat :: format - Zone Names are not
    reflected correctly during run time
    + JDK-8219712: code_size2 (defined in stub_routines_x86.hpp) is
    too small on new Skylake CPUs
    + JDK-8220150: macos10.14 Mojave returns anti-aliased glyphs
    instead of aliased B&amp;W glyphs
    + JDK-8221658: aarch64: add necessary predicate for ubfx
    patterns
    + JDK-8221759: Crash when completing "java.io.File.path"
    + JDK-8221918: runtime/SharedArchiveFile/serviceability/
    /ReplaceCriticalClasses.java fails: Shared archive not found
    + JDK-8222074: Enhance auto vectorization for x86
    + JDK-8222079: Don't use memset to initialize fields decode_env
    constructor in disassembler.cpp
    + JDK-8222769: [TESTBUG] TestJFRNetworkEvents should not rely
    on hostname command
    + JDK-8223688: JShell: crash on the instantiation of raw
    anonymous class
    + JDK-8223777: In posix_spawn mode, failing to exec()
    jspawnhelper does not result in an error
    + JDK-8223940: Private key not supported by chosen signature
    algorithm
    + JDK-8224184: jshell got IOException at exiting with AIX
    + JDK-8224234: compiler/codegen/TestCharVect2.java fails in
    test_mulc
    + JDK-8225037: java.net.JarURLConnection::getJarEntry() throws
    NullPointerException
    + JDK-8225625: AES Electronic Codebook (ECB) encryption and
    decryption optimization using AVX512 + VAES instructions
    + JDK-8226536: Catch OOM from deopt that fails rematerializing
    objects
    + JDK-8226575: OperatingSystemMXBean should be made container
    aware
    + JDK-8226697: Several tests which need the @key headful
    keyword are missing it.
    + JDK-8226809: Circular reference in printed stack trace is not
    correctly indented &amp; ambiguous
    + JDK-8227059: sun/security/tools/keytool/
    /DefaultSignatureAlgorithm.java timed out
    + JDK-8227269: Slow class loading when running with JDWP
    + JDK-8227595: keytool/fakegen/DefaultSignatureAlgorithm.java
    fails due to "exitValue = 6"
    + JDK-8228448: Jconsole can't connect to itself
    + JDK-8228967: Trust/Key store and SSL context utilities for
    tests
    + JDK-8229378: jdwp library loader in linker_md.c quietly
    truncates on buffer overflow
    + JDK-8229815: Upgrade Jline to 3.12.1
    + JDK-8230000: some httpclients testng tests run zero test
    + JDK-8230002: javax/xml/jaxp/unittest/transform/
    /SecureProcessingTest.java runs zero test
    + JDK-8230010: Remove jdk8037819/BasicTest1.java
    + JDK-8230094: CCE in createXMLEventWriter(Result) over an
    arbitrary XMLStreamWriter
    + JDK-8230402: Allocation of compile task fails with assert:
    "Leaking compilation tasks?"
    + JDK-8230767: FlightRecorderListener returns null recording
    + JDK-8230870: (zipfs) Add a ZIP FS test that is similar to
    test/jdk/java/util/zip/EntryCount64k.java
    + JDK-8231209: [REDO] ThreadMXBean::getThreadAllocatedBytes()
    can be quicker for self thread
    + JDK-8231586: enlarge encoding space for OopMapValue offsets
    + JDK-8231953: Wrong assumption in assertion in
    oop::register_oop
    + JDK-8231968: getCurrentThreadAllocatedBytes default
    implementation s/b getThreadAllocatedBytes
    + JDK-8232083: Minimal VM is broken after JDK-8231586
    + JDK-8232161: Align some one-way conversion in MS950 charset
    with Windows
    + JDK-8232855: jshell missing word in /help help
    + JDK-8233027: OopMapSet::all_do does oms.next() twice during
    iteration
    + JDK-8233228: Disable weak named curves by default in TLS,
    CertPath, and Signed JAR
    + JDK-8233386: Initialize NULL fields for unused decorations
    + JDK-8233452: java.math.BigDecimal.sqrt() with
    RoundingMode.FLOOR results in incorrect result
    + JDK-8233686: XML transformer uses excessive amount of memory
    + JDK-8233741: AES Countermode (AES-CTR) optimization using
    AVX512 + VAES instructions
    + JDK-8233829: javac cannot find non-ASCII module name under
    non-UTF8 environment
    + JDK-8233958: Memory retention due to HttpsURLConnection
    finalizer that serves no purpose
    + JDK-8234011: (zipfs) Memory leak in
    ZipFileSystem.releaseDeflater()
    + JDK-8234058: runtime/CompressedOops/
    /CompressedClassPointers.java fails with 'Narrow klass base:
    0x0000000000000000' missing from stdout/stderr
    + JDK-8234149: Several regression tests do not dispose Frame at
    end
    + JDK-8234347: "Turkey" meta time zone does not generate
    composed localized names
    + JDK-8234385: [TESTBUG] java/awt/EventQueue/6980209/
    /bug6980209.java fails in linux nightly
    + JDK-8234535: Cross compilation fails due to missing CFLAGS
    for the BUILD_CC
    + JDK-8234541: C1 emits an empty message when it inlines
    successfully
    + JDK-8234687: change javap reporting on unknown attributes
    + JDK-8236464: SO_LINGER option is ignored by SSLSocket in JDK
    11
    + JDK-8236548: Localized time zone name inconsistency between
    English and other locales
    + JDK-8236617: jtreg test containers/docker/
    /TestMemoryAwareness.java fails after 8226575
    + JDK-8237182: Update copyright header for shenandoah and
    epsilon files
    + JDK-8237888: security/infra/java/security/cert/
    /CertPathValidator/certification/LuxTrustCA.java fails when
    checking validity interval
    + JDK-8237977: Further update
    javax/net/ssl/compatibility/Compatibility.java
    + JDK-8238270: java.net HTTP/2 client does not decrease stream
    count when receives 204 response
    + JDK-8238284: [macos] Zero VM build fails due to an obvious
    typo
    + JDK-8238380: java.base/unix/native/libjava/childproc.c
    "multiple definition" link errors with GCC10
    + JDK-8238386: (sctp) jdk.sctp/unix/native/libsctp/SctpNet.c
    "multiple definition" link errors with GCC10
    + JDK-8238388: libj2gss/NativeFunc.o "multiple definition" link
    errors with GCC10
    + JDK-8238448: RSASSA-PSS signature verification fail when
    using certain odd key sizes
    + JDK-8238710: LingeredApp doesn't log stdout/stderr if exits
    with non-zero code
    + JDK-8239083: C1 assert(known_holder == NULL ||
    (known_holder-&gt;is_instance_klass() &amp;&amp;
    (!known_holder-&gt;is_interface() ||
    ((ciInstanceKlass*)known_holder)-&gt;has_nonstatic_concrete_methods())),
    "should be non-static concrete method");
    + JDK-8239385: KerberosTicket client name refers wrongly to
    sAMAccountName in AD
    + JDK-8240169: javadoc fails to link to non-modular api docs
    + JDK-8240295: hs_err elapsed time in seconds is not accurate
    enough
    + JDK-8240360: NativeLibraryEvent has wrong library name on
    Linux
    + JDK-8240676: Meet not symmetric failure when running lucene
    on jdk8
    + JDK-8241007: Shenandoah: remove
    ShenandoahCriticalControlThreadPriority support
    + JDK-8241065: Shenandoah: remove leftover code after
    JDK-8231086
    + JDK-8241086: Test runtime/NMT/HugeArenaTracking.java is
    failing on 32bit Windows
    + JDK-8241130: com.sun.jndi.ldap.EventSupport.removeDeadNotifier:
    java.lang.NullPointerException
    + JDK-8241138: http.nonProxyHosts=* causes
    StringIndexOutOfBoundsException in DefaultProxySelector
    + JDK-8241319: WB_GetCodeBlob doesn't have ResourceMark
    + JDK-8241478: vmTestbase/gc/gctests/Steal/steal001/steal001.java
    fails with OOME
    + JDK-8241574: Shenandoah: remove ShenandoahAssertToSpaceClosure
    + JDK-8241750: x86_32 build failure after JDK-8227269
    + JDK-8242184: CRL generation error with RSASSA-PSS
    + JDK-8242283: Can't start JVM when java home path includes
    non-ASCII character
    + JDK-8242556: Cannot load RSASSA-PSS public key with non-null
    params from byte array
    + JDK-8243029: Rewrite javax/net/ssl/compatibility/
    /Compatibility.java with a flexible interop test framework
    + JDK-8243138: Enhance BaseLdapServer to support starttls
    extended request
    + JDK-8243320: Add SSL root certificates to Oracle Root CA
    program
    + JDK-8243321: Add Entrust root CA - G4 to Oracle Root CA
    program
    + JDK-8243389: enhance os::pd_print_cpu_info on linux
    + JDK-8243453: java --describe-module failed with non-ASCII
    module name under non-UTF8 environment
    + JDK-8243470: [macos] bring back O2 opt level for unsafe.cpp
    + JDK-8243489: Thread CPU Load event may contain wrong data for
    CPU time under certain conditions
    + JDK-8243925: Toolkit#getScreenInsets() returns wrong value on
    HiDPI screens (Windows)
    + JDK-8244087: 2020-04-24 public suffix list update
    + JDK-8244151: Update MUSCLE PC/SC-Lite headers to the latest
    release 1.8.26
    + JDK-8244164: AArch64: jaotc generates incorrect code for
    compressed OOPs with non-zero heap base
    + JDK-8244196: adjust output in os_linux
    + JDK-8244225: stringop-overflow warning on strncpy call from
    compile_the_world_in
    + JDK-8244287: JFR: Methods samples have line number 0
    + JDK-8244703: "platform encoding not initialized" exceptions
    with debugger, JNI
    + JDK-8244719: CTW: C2 compilation fails with
    "assert(!VerifyHashTableKeys || _hash_lock == 0) failed:
    remove node from hash table before modifying it"
    + JDK-8244729: Shenandoah: remove resolve paths from
    SBSA::generate_shenandoah_lrb
    + JDK-8244763: Update --release 8 symbol information after JSR
    337 MR3
    + JDK-8244818: Java2D Queue Flusher crash while moving
    application window to external monitor
    + JDK-8245151: jarsigner should not raise duplicate warnings on
    verification
    + JDK-8245616: Bump update version for OpenJDK: jdk-11.0.9
    + JDK-8245714: "Bad graph detected in build_loop_late" when
    loads are pinned on loop limit check uncommon branch
    + JDK-8245801: StressRecompilation triggers assert "redundunt
    OSR recompilation detected. memory leak in CodeCache!"
    + JDK-8245832: JDK build make-static-libs should build all JDK
    libraries
    + JDK-8245880: Shenandoah: check class unloading flag early in
    concurrent code root scan
    + JDK-8245981: Upgrade to jQuery 3.5.1
    + JDK-8246027: Minimal fastdebug build broken after JDK-8245801
    + JDK-8246094: [macos] Sound Recording and playback is not
    working
    + JDK-8246153: TestEliminateArrayCopy fails with
  - XX:+StressReflectiveCode
    + JDK-8246193: Possible NPE in ENC-PA-REP search in AS-REQ
    + JDK-8246196: javax/management/MBeanServer/OldMBeanServerTest
    fails with AssertionError
    + JDK-8246203: Segmentation fault in verification due to stack
    overflow with -XX:+VerifyIterativeGVN
    + JDK-8246330: Add TLS Tests for Legacy ECDSA curves
    + JDK-8246453: TestClone crashes with "all collected exceptions
    must come from the same place"
    + JDK-8247246: Add explicit ResolvedJavaType.link and expose
    presence of default methods
    + JDK-8247350: [aarch64] assert(false) failed: wrong size of
    mach node
    + JDK-8247502: PhaseStringOpts crashes while optimising
    effectively dead code
    + JDK-8247615: Initialize the bytes left for the heap sampler
    + JDK-8247824: CTW: C2 (Shenandoah) compilation fails with SEGV
    in SBC2Support::pin_and_expand
    + JDK-8247874: Replacement in VersionProps.java.template not
    working when --with-vendor-bug-url contains '&amp;'
    + JDK-8247979: aarch64: missing side effect of killing flags
    for clearArray_reg_reg
    + JDK-8248214: Add paddings for TaskQueueSuper to reduce
    false-sharing cache contention
    + JDK-8248219: aarch64: missing memory barrier in
    fast_storefield and fast_accessfield
    + JDK-8248348: Regression caused by the update to BCEL 6.0
    + JDK-8248385: [testbug][11u] Adapt TestInitiExceptions to
    jtreg 5.1
    + JDK-8248495: [macos] zerovm is broken due to libffi headers
    location
    + JDK-8248851: CMS: Missing memory fences between free chunk
    check and klass read
    + JDK-8248987: AOT's Linker.java seems to eagerly fail-fast on
    Windows
    + JDK-8249159: Downport test rework for SSLSocketTemplate from
    8224650
    + JDK-8249215: JFrame::setVisible crashed with
  - Dfile.encoding=UTF-8 on Japanese Windows.
    + JDK-8249251: [dark_mode ubuntu 20.04] The selected menu is
    not highlighted in GTKLookAndFeel
    + JDK-8249255: Build fails if source code in cygwin home dir
    + JDK-8249277: TestVerifyIterativeGVN.java is failing with
    timeout in OpenJDK 11
    + JDK-8249278: Revert JDK-8226253 which breaks the spec of
    AccessibleState.SHOWING for JList
    + JDK-8249560: Shenandoah: Fix racy GC request handling
    + JDK-8249801: Shenandoah: Clear soft-refs on requested GC cycle
    + JDK-8249953: Shenandoah: gc/shenandoah/mxbeans tests should
    account for corner cases
    + JDK-8250582: Revert Principal Name type to NT-UNKNOWN when
    requesting TGS Kerberos tickets
    + JDK-8250609: C2 crash in IfNode::fold_compares
    + JDK-8250627: Use -XX:+/-UseContainerSupport for
    enabling/disabling Java container metrics
    + JDK-8250755: Better cleanup for
    jdk/test/javax/imageio/plugins/shared/CanWriteSequence.java
    + JDK-8250787: Provider.put no longer registering aliases in
    FIPS env
    + JDK-8250826: jhsdb does not work with coredump which comes
    from Substrate VM
    + JDK-8250827: Shenandoah: needs to reset/finish StringTable's
    dead count before/after parallel walk
    + JDK-8250844: Make sure {type,obj}ArrayOopDesc accessors check
    the bounds
    + JDK-8251117: Cannot check P11Key size in P11Cipher and
    P11AEADCipher
    + JDK-8251354: Shenandoah: Fix jdk/jfr/tool/TestPrintJSON.java
    test failure
    + JDK-8251451: Shenandoah: Remark ObjectSynchronizer roots with
    I-U
    + JDK-8251469: Better cleanup for
    test/jdk/javax/imageio/SetOutput.java
    + JDK-8251487: Shenandoah: missing detail timing tracking for
    final mark cleaning phase
    + JDK-8252120: compiler/oracle/TestCompileCommand.java
    misspells "occured"
    + JDK-8252157: JDK-8231209 11u backport breaks jmm binary
    compatibility
    + JDK-8252258: [11u] JDK-8242154 changes the default vendor
    + JDK-8252804: [test] Fix 'ReleaseDeflater.java' test after
    downport of 8234011
    + JDK-8253134: JMM_VERSION should remain at 0x20020000 (JDK 10)
    in JDK 11
    + JDK-8253283: [11u] Test build/translations/
    /VerifyTranslations.java failing after JDK-8252258
    + JDK-8253813: Backout JDK-8244287 from 11u: it causes several
    crashes
- Removed patch:
  * gcc-fno-common-fix.patch
    + not needed any more with this version
- Added patch:
  * JDK-8250861.patch
    + Fix regression "8250861: Crash in MinINode::Ideal(PhaseGVN*,
    bool)" introduced in jdk 11.0.9</changelog>
  <changelog author="fstrba@suse.com" date="1604491200">- Enable Sheandoah GC for x86_64 (jsc#ECO-3171)</changelog>
  <changelog author="fstrba@suse.com" date="1605528000">- Update to upstream tag jdk-11.0.9.1-1
  * Fix:
    + JDK-8250861: Crash in MinINode::Ideal(PhaseGVN*, bool)
- Removed patch:
  * JDK-8250861.patch
    + Integrated upstream</changelog>
  <changelog author="fstrba@suse.com" date="1611230400">- Update to upstream tag jdk-11.0.10+9 (January 2021 CPU,
  bsc#1181239)
  * Security fixes
    + JDK-8247619: Improve Direct Buffering of Characters
  * Other changes
    + JDK-6722928: Support SSPI as a native GSS-API provider
    + JDK-7185258: [macosx] Deadlock in SunToolKit.realSync()
    + JDK-8152332: [macosx] JFileChooser cannot be serialized on
    Mac OS X
    + JDK-8161684: [testconf] Add VerifyOops' testing into compiler
    tiers
    + JDK-8171279: Support X25519 and X448 in TLS
    + JDK-8173361: various crashes in
    JvmtiExport::post_compiled_method_load
    + JDK-8173658: JvmtiExport::post_class_unload() is broken for
    non-JavaThread initiators
    + JDK-8191006: hsdis disassembler plugin does not compile with
    binutils 2.29+
    + JDK-8197981: Missing return statement in
    __sync_val_compare_and_swap_8
    + JDK-8198334: java/awt/FileDialog/8003399/bug8003399.java
    fails in headless mode
    + JDK-8200151: Add 8 JNDI tests to com/sun/jndi/dns/ConfigTests/
    + JDK-8208279: Add 8 JNDI tests to com/sun/jndi/dns/EnvTests/
    + JDK-8208483: Add 5 JNDI tests to
    com/sun/jndi/dns/FactoryTests/
    + JDK-8208542: Add 4 JNDI tests to com/sun/jndi/dns/ListTests/
    + JDK-8208665: Amend cross-compilation docs with
    qemu-debootstrap recipe
    + JDK-8210088: ProblemList gc/epsilon/TestMemoryMXBeans.java
    + JDK-8210339: Add 10 JNDI tests to com/sun/jndi/dns/FedTests/
    + JDK-8211450: UndetVar::dup is not copying the kind field to
    the duplicated instance
    + JDK-8212160: JVMTI agent crashes with "assert(_value != 0LL)
    failed: resolving NULL _value"
    + JDK-8212226: SurfaceManager throws "Invalid Image variant"
    for MultiResolutionImage (Windows)
    + JDK-8213400: Support choosing group name in keytool keypair
    generation
    + JDK-8213535: Windows HiDPI html lightweight tooltips are
    truncated
    + JDK-8213698: Improve devkit creation and add support for
    linux/ppc64/ppc64le/s390x
    + JDK-8214025: assert(t-&gt;singleton()) failed: must be a
    constant when ScavengeRootsInCode &lt; 2
    + JDK-8214242: compiler/arguments/TestScavengeRootsInCode.java
    fails because of missing UnlockDiagnosticVMOptions
    + JDK-8214787: Zero builds fail with "undefined
    JavaThread::thread_state()"
    + JDK-8215583: Exclude
    runtime/handshake/HandshakeWalkSuspendExitTest.java
    + JDK-8216012: Infinite loop in RSA KeyPairGenerator
    + JDK-8216324: GetClassMethods is confused by the presence of
    default methods in super interfaces
    + JDK-8217429: WebSocket over authenticating proxy fails to
    send Upgrade headers
    + JDK-8217976: test/jdk/java/net/httpclient/websocket/
    /WebSocketProxyTest.java fails intermittently
    + JDK-8218021: Have jarsigner preserve posix permission
    attributes
    + JDK-8218287: jshell tool: input behavior unstable after
    12-ea+24 on Windows
    + JDK-8218851: JVM crash in custom classloader stress test, JDK
    12 &amp; 13
    + JDK-8220420: Cleanup c1_LinearScan
    + JDK-8222072: JVMTI GenerateEvents() sends CompiledMethodLoad
    events to wrong jvmtiEnv
    + JDK-8222286: Fix for JDK-8213419 is broken on s390
    + JDK-8222527: HttpClient doesn't send HOST header when
    tunelling HTTP/1.1 through http proxy
    + JDK-8222533: jtreg test jdk/internal/platform/cgroup/
    /TestCgroupMetrics.java fails on SLES12.3 linux ppc64le
    machine
    + JDK-8224506: [TESTBUG] TestDockerMemoryMetrics.java fails
    with exitValue = 137
    + JDK-8224555: vmTestbase/nsk/jvmti/scenarios/contention/TC02/
    /tc02t001/TestDescription.java failed
    + JDK-8224650: Add tests to support X25519 and X448 in TLS
    + JDK-8225072: Add LuxTrust certificate that is expiring in
    March 2021 to list of allowed but expired certs
    + JDK-8225329: -XX:+PrintBiasedLockingStatistics causes crash
    during initialization on Windows platforms
    + JDK-8225687: Newly added sspi.cpp in JDK-6722928 still
    contains some small errors
    + JDK-8227006: [linux] Runtime.availableProcessors execution
    time increased by factor of 100
    + JDK-8227275: Within native OOM error handling, assertions may
    hang the process
    + JDK-8227647: [Graal] Test8009761.java fails due to
    "RuntimeException: static java.lang.Object
    compiler.uncommontrap.Test8009761.m3(boolean,boolean) not
    compiled"
    + JDK-8229495: SIGILL in C2 generated OSR compilation
    + JDK-8230910: libsspi_bridge does not build on Windows 32bit
    + JDK-8232114: JVM crashed at imjpapi.dll in native code
    + JDK-8234147: Avoid looking up standard charsets in core
    libraries
    + JDK-8234393: [macos] printing ignores printer tray
    + JDK-8234863: Increase default value of MaxInlineLevel
    + JDK-8235218: Minimal VM is broken after JDK-8173361
    + JDK-8235456: Minimal VM is broken after JDK-8212160
    + JDK-8235829: graal crashes with Zombie.java test
    + JDK-8236124: Minimal VM slowdebug build failed after
    JDK-8212160
    + JDK-8236512: PKCS11 Connection closed after Cipher.doFinal
    and NoPadding
    + JDK-8236944: The legVecZ operand should be limited to
    zmm0-zmm15 registers
    + JDK-8237186: Fix typo in copyright header of
    java/io/Reader/TransferTo.java
    + JDK-8237499: JFR: Include stack trace in the ThreadStart event
    + JDK-8237512: AArch64: aarch64TestHook leaks a BufferBlob
    + JDK-8237524: AArch64: String.compareTo() may return incorrect
    result
    + JDK-8237950: C2 compilation fails with "Live Node limit
    exceeded limit" during ConvI2L::Ideal optimization
    + JDK-8238579: HttpsURLConnection drops the timeout and hangs
    forever in read
    + JDK-8239105: Add exception for expiring Digicert root
    certificates to VerifyCACerts test
    + JDK-8239477: jdk/jfr/jcmd/TestJcmdStartStopDefault.java fails
  - XX:+VerifyOops with "verify_oop: rsi: broken oop"
    + JDK-8239497: SEGV in EdgeUtils::field_name_symbol(Edge const&amp;)
    + JDK-8239886: Minimal VM build fails after JDK-8237499
    + JDK-8240633: Memory leaks in the implementations of
    FileChooserUI
    + JDK-8240690: Race condition between EDT and
    BasicDirectoryModel.FilesLoader.run0()
    + JDK-8241234: Unify monitor enter/exit runtime entries.
    + JDK-8241311: Move some charset mapping tests from closed to
    open
    + JDK-8241797: Add some tests to the problem list
    + JDK-8242029: AArch64: skip G1 array copy pre-barrier if
    marking not active
    + JDK-8242335: Additional Tests for RSASSA-PSS
    + JDK-8242480: Negative value may be returned by
    getFreeSwapSpaceSize() in the docker
    + JDK-8242614: cleanup duplicated test ldap server in some
    com/sun/jndi/ldap/ tests
    + JDK-8242846: Bring back test/jdk/tools/jlink/plugins/
    /OrderResourcesPluginTest.java
    + JDK-8243114: Implement montgomery{Multiply,Square}intrinsics
    on Windows
    + JDK-8243290: Improve diagnostic messages for class
    verification and redefinition failures
    + JDK-8243488: Add tests for set/get SendBufferSize and
    getReceiveBufferSize in DatagramSocket
    + JDK-8243549: sun/security/ssl/CipherSuite/
    /NamedGroupsWithCipherSuite.java failed with Unsupported
    signature algorithm: DSA
    + JDK-8243617: compiler/onSpinWait/TestOnSpinWaitC1.java test
    uses wrong class
    + JDK-8243619: compiler/codecache/CheckSegmentedCodeCache.java
    test misses -version
    + JDK-8244142: some hotspot/runtime tests don't check exit code
    of forked JVM
    + JDK-8244278: Excessive code cache flushes and sweeps
    + JDK-8244282: test/hotspot/jtreg/compiler/intrinsics/
    /Test8237524.java fails with --illegal-access=deny
    + JDK-8244621: [macos10.15] Garbled FX printing plus CoreText
    warnings on Catalina when building with Xcode 11
    + JDK-8244819: hsdis does not compile with binutils 2.34+
    + JDK-8245051: c1 is broken if it is compiled by gcc without
  - fno-lifetime-dse
    + JDK-8245168: jlink should not be treated as a "small" tool
    + JDK-8245400: Upgrade to LittleCMS 2.11
    + JDK-8246381: VM crashes with "Current BasicObjectLock* below
    than low_mark"
    + JDK-8246434: Threads::print_on_error assumes that the heap
    has been set up
    + JDK-8246648: issue with OperatingSystemImpl
    getFreeSwapSpaceSize in docker after 8242480
    + JDK-8247201: Print potential pointer value of readable stack
    memory in hs_err file
    + JDK-8247763: assert(outer-&gt;outcnt() == 2) failed: 'only phis'
    failure in LoopNode::verify_strip_mined()
    + JDK-8247867: Upgrade to freetype 2.10.2
    + JDK-8248190: Enable Power10 system and implement new
    byte-reverse instructions
    + JDK-8248226: TestCloneAccessStressGCM fails with
  - XX:-ReduceBulkZeroing
    + JDK-8248347: windows build broken by JDK-8243114
    + JDK-8248532: Every time I change keyboard language at my
    MacBook, Java crashes
    + JDK-8248552: C2 crashes with SIGFPE due to division by zero
    + JDK-8248596: [TESTBUG] compiler/loopopts/
    /PartialPeelingUnswitch.java times out with Graal enabled
    + JDK-8248745: Add jarsigner and keytool tests for restricted
    algorithms
    + JDK-8248791: sun/util/resources/cldr/TimeZoneNamesTest.java
    fails with -XX:-ReduceInitialCardMarks -XX:-ReduceBulkZeroing
    + JDK-8248845: AArch64: stack corruption after spilling vector
    register
    + JDK-8249176: Update GlobalSignR6CA test certificates
    + JDK-8249183: JVM crash in "AwtFrame::WmSize" method
    + JDK-8249192: MonitorInfo stores raw oops across safepoints
    + JDK-8249602: C2: assert(cnt == _outcnt) failed: no insertions
    allowed
    + JDK-8249603: C1: assert(has_error == false) failed: register
    allocation invalid
    + JDK-8249605: C2: assert(no_dead_loop) failed: dead loop
    detected
    + JDK-8249607: C2: assert(!had_error) failed: bad dominance
    + JDK-8249608: Vector register used by C2 compiled method
    corrupted at safepoint
    + JDK-8249672: Include microcode revision in features_string on
    x86
    + JDK-8249748: gtest silently ignores bad jvm arguments
    + JDK-8249821: Separate libharfbuzz from libfontmanager
    + JDK-8250598: Hyper-V is detected in spite of running on host
    OS
    + JDK-8250605: Linux x86_32 builds fail after JDK-8249821
    + JDK-8250636: iso8601_time returns incorrect offset part on
    MacOS
    + JDK-8250665: Wrong translation for the month name of May in
    ar_JO,LB,SY
    + JDK-8250772: Test com/sun/jndi/ldap/
    /NamingExceptionMessageTest.java fails intermittently with
    javax.naming.ServiceUnavailableException
    + JDK-8250825: C2 crashes with assert(field != __null) failed:
    missing field
    + JDK-8250894: Provide a configure option to build and run
    against the platform libharfbuzz
    + JDK-8250928: JFR: Improve hash algorithm for stack traces
    + JDK-8250968: Symlinks attributes not preserved when using
    jarsigner on zip files
    + JDK-8250984: Memory Docker tests fail on some Linux kernels
    w/o cgroupv1 swap limit capabilities
    + JDK-8251118: BiasedLocking::preserve_marks should not have a
    HandleMark
    + JDK-8251189: com/sun/jndi/ldap/LdapDnsProviderTest.java
    failed due to timeout
    + JDK-8251257: NMT: jcmd VM.native_memory scale=1 crashes
    target VM
    + JDK-8251365: Build failure on AIX after 8250636
    + JDK-8251397: NPE on ClassValue.ClassValueMap.cacheArray
    + JDK-8251456: [TESTBUG] compiler/vectorization/
    /TestVectorsNotSavedAtSafepoint.java failed OutOfMemoryError
    + JDK-8251458: Parse::do_lookupswitch fails with "assert(_cnt
    &gt;= 0) failed"
    + JDK-8251535: Partial peeling at unsigned test adds incorrect
    loop exit check
    + JDK-8251949: ZGC: Set explicit heap size for
    compiler/gcbarriers tests
    + JDK-8252090: JFR: StreamWriterHost::write_unbuffered() stucks
    in an infinite loop OpenJDK (build 13.0.1+9)
    + JDK-8252415: Bump update version for OpenJDK: jdk-11.0.10
    + JDK-8252470: java/awt/dnd/DisposeFrameOnDragCrash/
    /DisposeFrameOnDragTest.java fails on Windows
    + JDK-8252497: Incorrect numeric currency code for ROL
    + JDK-8252660: Shenandoah: support manageable SoftMaxHeapSize
    option
    + JDK-8252679: Two windows specific FileDIalog tests may fail
    on some Windows_Server_2016_Standard
    + JDK-8252696: Loop unswitching may cause out of bound array
    load to be executed
    + JDK-8252754: Hash code calculation of JfrStackTrace is
    inconsistent
    + JDK-8253219: Epsilon: clean up unnecessary includes
    + JDK-8253224: Shenandoah: ShenandoahStrDedupQueue destructor
    calls virtual num_queues()
    + JDK-8253226: Shenandoah: remove unimplemented
    ShenandoahStrDedupQueue::verify
    + JDK-8253269: The CheckCommonColors test should provide more
    info on failure
    + JDK-8253284: Zero OrderAccess barrier mappings are incorrect
    + JDK-8253375: OSX build fails with Xcode 12.0 (12A7209)
    + JDK-8253778: ShenandoahSafepoint::is_at_shenandoah_safepoint
    should not access VMThread state from other threads
    + JDK-8253791: Issue with useAppleColor check in CSystemColors.m
    + JDK-8254016: Test8237524 fails with -XX:-CompactStrings option
    + JDK-8254081: java/security/cert/PolicyNode/
    /GetPolicyQualifiers.java fails due to an expired certificate
    + JDK-8254144: Non-x86 Zero builds fail with return-type
    warning in os_linux_zero.cpp
    + JDK-8254166: Zero: return-type warning in
    zeroInterpreter_zero.cpp
    + JDK-8254177: (tz) Upgrade time-zone data to tzdata2020b
    + JDK-8254185: Fix Code cache sweeper heuristics for JDK 11
    + JDK-8254190: [s390] interpreter misses exception check after
    calling monitorenter
    + JDK-8254790: SIGSEGV in string_indexof_char and
    stringL_indexof_char intrinsics
    + JDK-8254854: [cgroups v1] Metric limits not properly detected
    on some join controller combinations
    + JDK-8254982: (tz) Upgrade time-zone data to tzdata2020c
    + JDK-8255050: Add pkcs11/KeyStore/ClientAuth.sh to Problem list
    + JDK-8255065: Zero: accessor_entry misses the IRIW case
    + JDK-8255226: (tz) Upgrade time-zone data to tzdata2020d
    + JDK-8255269: Unsigned overflow in g1Policy.cpp
    + JDK-8255365: Problem list failing client manual tests
    + JDK-8255457: Shenandoah: cleanup ShenandoahMarkTask
    + JDK-8255466: C2 crashes at ciObject::get_oop() const+0x0
    + JDK-8255550: x86: Assembler::cmpq(Address dst, Register src)
    encoding is incorrect
    + JDK-8255603: Memory/Performance regression after JDK-8210985
    + JDK-8255760: Shenandoah: match constants style in
    ShenandoahMarkTask fallback
    + JDK-8255781: Bump patch update version for OpenJDK:
    jdk-11.0.9.1
    + JDK-8255937: Better cleanup for
    test/jdk/javax/imageio/stream/StreamFlush.java
    + JDK-8256427: Test com/sun/jndi/dns/ConfigTests/
    /PortUnreachable.java does not work on AIX
    + JDK-8256452: Integrate missing part of JDK-8232370 to 11u
    + JDK-8256483: [TESTBUG] serviceability/jvmti/GetClassMethods/
    /libOverpassMethods.c fails to compile on gcc 4.4.x
    + JDK-8256557: libharfbuzz fails to link on gcc 4.4.x due to
  - Wl,-z,defs
    + JDK-8256618: Zero: Linux x86_32 build still fails
    + JDK-8256736: Zero: GTest tests fail with "unsuppported vm
    variant"
    + JDK-8256809: Annotation processing causes NPE during flow
    analysis
    + JDK-8257181: s390x builds are very noisy with gc-sections
    messages
    + JDK-8257242: [macOS] Java app crashes while switching input
    methods
    + JDK-8257545: SunJSSE FIPS regression in key exchange after
    JDK-8171279 11u backport
    + JDK-8257641: Shenandoah: Query is_at_shenandoah_safepoint()
    from control thread should return false
    + JDK-8257701: Shenandoah: objArrayKlass metadata is not marked
    with chunked arrays
    + JDK-8258630: Add expiry exception for QuoVadis root
    certificate
- New upstream dependency on libharfbuzz
- Regenerated patches: missing-return.patch system-pcsclite.patch</changelog>
  <changelog author="fstrba@suse.com" date="1616155200">- Added patches:
  * system-crypto-policy.patch
    + Let OpenJDK use system crypto policies unless explicitely told
    not to
  * nss-security-provider.patch
    + Add the NSS security provider with configuration in generated
    nss.cfg file
  * keytool-default-rsa.patch
    + Make keytool generate RSA keys by default, since only the
    LEGACY system crypto policy allows DSA</changelog>
  <changelog author="pujos.michael@gmail.com" date="1618488000">- moved mozilla-nss dependency to java-11-openjdk-headless package
  This is necessary to be able to do crypto with just
  java-11-openjdk-headless installed. Fixes boo#1184606</changelog>
  <changelog author="fstrba@suse.com" date="1619006400">- Update to upstream tag jdk-11.0.11+9 (April 2021, CPU)
  * Security fixes
    + JDK-8244473: Contextualize registration for JNDI
    + JDK-8244543: Enhanced handling of abstract classes
    + JDK-8249906, CVE-2021-2163, bsc#1185055: Enhance opening JARs
    + JDK-8250568, CVE-2021-2161, bsc#1185056: Less ambiguous
    processing
    + JDK-8253799: Make lists of normal filenames
    + JDK-8257001: Improve Http Client Support
  * Other changes
    + JDK-7107012: sun.jvm.hotspot.code.CompressedReadStream
    readDouble() conversion to long mishandled
    + JDK-7146776: deadlock between URLStreamHandler.getHostAddress
    and file.Handler.openconnection
    + JDK-8086003: Test fails on OSX with java.lang.RuntimeException
    'Narrow klass base: 0x0000000000000000, Narrow klass shift: 3'
    missing
    + JDK-8168869: jdeps: localized messages don't use proper line
    breaks
    + JDK-8180837: SunPKCS11-NSS tests failing with
    CKR_ATTRIBUTE_READ_ONLY and CKR_MECHANISM_PARAM_INVALID
    + JDK-8202343: Disable TLS 1.0 and 1.1
    + JDK-8205992: jhsdb cannot attach to Java processes running in
    Docker containers
    + JDK-8209193: Fix aarch64-linux compilation after -Wreorder
    changes
    + JDK-8210413: AArch64: Optimize div/rem by constant in C1
    + JDK-8210578: AArch64: Invalid encoding for fmlsvs instruction
    + JDK-8211051: jdeps usage of --dot-output doesn't provide
    valid output for modular jar
    + JDK-8211057: Gensrc step CompileProperties generates unstable
    CompilerProperties output
    + JDK-8211150: G1 Full GC not purging code root memory and
    hence causing memory leak
    + JDK-8211825: ModuleLayer.defineModulesWithXXX does not setup
    delegation when module reads automatic module
    + JDK-8212043: Add floating-point Math.min/max intrinsics
    + JDK-8212218: [TESTBUG] runtime/ErrorHandling/
    /TestHeapDumpOnOutOfMemoryErrorInMetaspace.java timed out
    + JDK-8213116: javax/swing/JComboBox/WindowsComboBoxSize/
    /WindowsComboBoxSizeTest.java fails in Windows
    + JDK-8213909: jdeps --print-module-deps should report missing
    dependences
    + JDK-8214180: Need better granularity for sleeping
    + JDK-8214223: tools/jdeps/listdeps/ListModuleDeps.java failed
    due to missing Lib2 file
    + JDK-8214230: Classes generated by SystemModulesPlugin.java
    are not reproducable
    + JDK-8214741: docs/index.html has no title or copyright
    + JDK-8215687: [Graal] unit test CheckGraalIntrinsics failed
    after 8212043
    + JDK-8217848: [Graal] vmTestbase/nsk/jvmti/ResourceExhausted/
    /resexhausted003/TestDescription.java fails
    + JDK-8218482: sun/security/krb5/auto/ReplayCachePrecise.java
    failed - no KrbException thrown
    + JDK-8218550: Add test omitted from JDK-8212043
    + JDK-8221584: SIGSEGV in os::PlatformEvent::unpark() in
    JvmtiRawMonitor::raw_exit while posting method exit event
    + JDK-8221995: AARCH64: problems with CAS instructions encoding
    + JDK-8222518: Remove unnecessary caching of Parker object in
    java.lang.Thread
    + JDK-8222785: aarch64: add necessary masking for immediate
    shift counts
    + JDK-8223186: HotSpot compile warnings from GCC 9
    + JDK-8225773: jdeps --check produces NPE if there are missing
    module dependences
    + JDK-8225805: Java Access Bridge does not close the logger
    + JDK-8226810: Failed to launch JVM because of
    NullPointerException occured on System.props
    + JDK-8229396: jdeps ignores multi-release when
    generate-module-info used on command line
    + JDK-8229474: Shenandoah: Cleanup CM::update_roots()
    + JDK-8232225: Rework the fix for JDK-8071483
    + JDK-8232905: JFR fails with assertion:
    assert(t-&gt;unflushed_size() == 0) failed: invariant
    + JDK-8233164: C2 fails with assert(phase-&gt;C-&gt;get_alias_index(t)
    == phase-&gt;C-&gt;get_alias_index(t_adr)) failed: correct memory
    chain
    + JDK-8233910: java/awt/ColorClass/AlphaColorTest.java is
    failing  intermittently in nightly lnux-x64 system
    + JDK-8233912: aarch64: minor improvements of atomic operations
    + JDK-8234508: VM_HeapWalkOperation::iterate_over_object reads
    non-strong fields with an on-strong load barrier
    + JDK-8234742: Improve handshake logging
    + JDK-8234796: Refactor Handshake::execute to take a more
    complex type than ThreadClosure
    + JDK-8235324: Dying objects are published from users of
    CollectedHeap::object_iterate
    + JDK-8235351: Lookup::unreflect should bind with the original
    caller independent of Method's accessible flag
    + JDK-8237369: Shenandoah: failed vmTestbase/nsk/jvmti/
    /AttachOnDemand/attach021/TestDescription.java test
    + JDK-8237392: Shenandoah: Remove unreliable assertion
    + JDK-8237483: AArch64 C1 OopMap inserted twice fatal error
    + JDK-8237495: Java MIDI fails with a dereferenced memory error
    when asked to send a raw 0xF7
    + JDK-8239355: (dc) Initial value of SO_SNDBUF should allow
    sending large datagrams (macOS)
    + JDK-8240353: AArch64: missing support for
  - XX:+ExtendedDTraceProbes in C1
    + JDK-8240704: CheckHandles.java failed "AssertionError: Handle
    use increased by more than 10 percent."
    + JDK-8240751: Shenandoah: fold ShenandoahTracer definition
    + JDK-8240795: [REDO] 8238384 CTW: C2 compilation fails with
    "assert(store != load-&gt;find_exact_control(load-&gt;in(0)))
    failed: dependence cycle found"
    + JDK-8241598: Upgrade JLine to 3.14.0
    + JDK-8241649: Optimize Character.toString
    + JDK-8241770: Module xxxAnnotation() methods throw NCDFE if
    module-info.class found as resource in unnamed module
    + JDK-8241911: AArch64: Fix a potential register clash issue in
    reduce_add2I
    + JDK-8242030: Wrong package declarations in jline classes after
    JDK-8241598
    + JDK-8242565: Policy initialization issues when the denyAfter
    constraint is enabled
    + JDK-8243618: compiler/rtm/cli tests can be run w/o WhiteBox
    + JDK-8243670: Unexpected test result caused by C2
    MergeMemNode::Ideal
    + JDK-8244088: [Regression] Switch of Gnome theme ends up in
    deadlocked UI
    + JDK-8244154: Update SunPKCS11 provider with PKCS11 v3.0 header
    files
    + JDK-8244340: Handshake processing thread lacks yielding
    + JDK-8244573: java.lang.ArrayIndexOutOfBoundsException thrown
    for malformed class file
    + JDK-8244683: A TSA server used by tests
    + JDK-8245005: javax/net/ssl/compatibility/BasicConnectTest.java
    failed with No enum constant
    + JDK-8245026: PsAdaptiveSizePolicy::_old_gen_policy_is_ready is
    unused
    + JDK-8245283: JFR: Can't handle constant dynamic used by Jacoco
    agent
    + JDK-8245512: CRC32 optimization using AVX512 instructions
    + JDK-8245527: LDAP Channel Binding support for Java
    GSS/Kerberos
    + JDK-8246707: (sc) SocketChannel.read/write throws
    AsynchronousCloseException on closed channel
    + JDK-8246709: sun/security/tools/jarsigner/
    /TsacertOptionTest.java compilation failed after JDK-8244683
    + JDK-8247200: assert((unsigned)fpargs &lt; 32)
    + JDK-8247766: [aarch64] guarantee(val &lt; (1U &lt;&lt; nbits))
    failed: Field too big for insn.
    + JDK-8248336: AArch64: C2: offset overflow in
    BoxLockNode::emit
    + JDK-8248865: Document JNDI/LDAP timeout properties
    + JDK-8248901: Signed immediate support in
    .../share/assembler.hpp is broken.
    + JDK-8249543: Force DirectBufferAllocTest to run with
  - ExplicitGCInvokesConcurrent
    + JDK-8249588: libwindowsaccessbridge issues on 64bit Windows
    + JDK-8249749: modify a primitive array through a stream and a
    for cycle causes jre crash
    + JDK-8249787: Make TestGCLocker more resilient with concurrent
    GCs
    + JDK-8249867: xml declaration is not followed by a newline
    + JDK-8250911: [windows] os::pd_map_memory() error detection
    broken
    + JDK-8251255: [linux] Add process-memory information to hs-err
    and VM.info
    + JDK-8251359: Shenandoah: filter null oops before calling
    enqueue/SATB barrier
    + JDK-8251925: C2: RenaissanceStressTest fails with
    assert(!had_error): bad dominance
    + JDK-8251944: Add Shenandoah test config to
    compiler/gcbarriers/UnsafeIntrinsicsTest.java
    + JDK-8251992: VM crashed running TestComplexAddrExpr.java test
    with -XX:UseAVX=X
    + JDK-8253220: Epsilon: clean up unused code/declarations
    + JDK-8253274: The CycleDMImagetest brokes the system
    + JDK-8253353: Crash in C2: guarantee(n != NULL) failed: No Node
    + JDK-8253368: TLS connection always receives close_notify
    exception
    + JDK-8253404: C2: assert(C-&gt;live_nodes() &lt;=
    C-&gt;max_node_limit()) failed: Live Node limit exceeded limit
    + JDK-8253409: Double-rounding possibility in float fma
    + JDK-8253476: TestUseContainerSupport.java fails on some Linux
    kernels w/o swap limit capabilities
    + JDK-8253524: C2: Refactor code that clones predicates during
    loop unswitching
    + JDK-8253644: C2: assert(skeleton_predicate_has_opaque(iff))
    failed: unexpected
    + JDK-8253681: closed java/awt/dnd/MouseEventAfterStartDragTest/
    /MouseEventAfterStartDragTest.html test failed
    + JDK-8253702: BigSur version number reported as 10.16, should
    be 11.nn
    + JDK-8253756: C2 CompilerThread0 crash in Node::add_req(Node*)
    + JDK-8254104: MethodCounters must exist before nmethod is
    installed
    + JDK-8254734: "dead loop detected" assert failure with patch
    from 8223051
    + JDK-8254748: Bad Copyright header format after JDK-8212218
    + JDK-8254799: runtime/ErrorHandling/
    /TestHeapDumpOnOutOfMemoryError.java fails with release VMs
    + JDK-8255058: C1: assert(is_virtual()) failed: type check
    + JDK-8255351: Add detection for Graviton 2 CPUs
    + JDK-8255368: Math.exp() gives wrong result for large values on
    x86 32-bit platforms
    + JDK-8255387: Japanese characters were printed upside down on
    AIX
    + JDK-8255401: Shenandoah: Allow oldval and newval registers to
    overlap in cmpxchg_oop()
    + JDK-8255479: [aarch64] assert(src-&gt;section_index_of(target) ==
    CodeBuffer::SECT_NONE) failed: sanity
    + JDK-8255544: Create a checked cast
    + JDK-8255559: Leak File Descriptors Because of
    ResolverLocalFilesystem#engineResolveURI()
    + JDK-8255681: print callstack in error case in
    runAWTLoopWithApp
    + JDK-8255734: VM should ignore SIGXFSZ on ppc64, s390 too
    + JDK-8255742: PrintInlining as compiler directive doesn't print
    virtual calls
    + JDK-8255845: Memory leak in imageFile.cpp
    + JDK-8255880: UI of Swing components is not redrawn after their
    internal state changed
    + JDK-8255908: ExceptionInInitializerError due to
    UncheckedIOException while initializing cgroupv1 subsystem
    + JDK-8256025: AArch64: MachCallRuntimeNode::ret_addr_offset()
    is incorrect for stub calls
    + JDK-8256056: Deoptimization stub doesn't save vector registers
    on x86
    + JDK-8256061: RegisterSaver::save_live_registers() omits upper
    halves of ZMM0-15 registers
    + JDK-8256187: [TEST_BUG] Automate bug4275046.java test
    + JDK-8256220: C1: x86_32 fails with -XX:UseSSE=1 after
    JDK-8210764 due to mishandled lir_neg
    + JDK-8256258: some missing NULL checks or asserts after
    CodeCache::find_blob_unsafe
    + JDK-8256264: Printed GlyphVector outline with low DPI has bad
    quality on Windows
    + JDK-8256290: javac/lambda/T8031967.java fails with
    StackOverflowError on x86_32
    + JDK-8256359: AArch64: runtime/ReservedStack/
    /ReservedStackTestCompiler.java fails
    + JDK-8256387: Unexpected result if patching an entire
    instruction on AArch64
    + JDK-8256421: Add 2 HARICA roots to cacerts truststore
    + JDK-8256488: [aarch64] Use ldpq/stpq instead of ld4/st4 for
    small copies in StubGenerator::copy_memory
    + JDK-8256489: Make gtest for long path names on Windows more
    resilient in the presence of virus scanners
    + JDK-8256501: libTestMainKeyWindow fails to build with Xcode
    12.2
    + JDK-8256633: Fix product build on Windows+Arm64
    + JDK-8256682: JDK-8202343 is incomplete
    + JDK-8256751: Incremental rebuild with precompiled header fails
    when touching a header file
    + JDK-8256757: Incorrect MachCallRuntimeNode::ret_addr_offset()
    for CallLeafNoFP on x86_32
    + JDK-8256806: Shenandoah: optimize shenandoah/jni/
    /TestPinnedGarbage.java test
    + JDK-8256807: C2: Not marking stores correctly as mismatched
    in string opts
    + JDK-8256810: Incremental rebuild broken on Macosx
    + JDK-8256818: SSLSocket that is never bound or connected leaks
    socket resources
    + JDK-8256888: Client manual test problem list update
    + JDK-8257083: Security infra test failures caused by
    JDK-8202343
    + JDK-8257408: Bump update version for OpenJDK: jdk-11.0.11
    + JDK-8257423: [PPC64] Support -XX:-UseInlineCaches
    + JDK-8257436: [aarch64] Regressions in ArrayCopyUnalignedDst
    .testByte/testChar for 65-78 bytes when UseSIMDForMemoryOps
    is on
    + JDK-8257513: C2: assert((constant_addr -
    _masm.code()-&gt;consts()-&gt;start()) == con.offset())
    + JDK-8257547: Handle multiple prereqs on the same line in deps
    files
    + JDK-8257561: Some code is not vectorized after 8251925 and
    8250607
    + JDK-8257565: epsilonBarrierSet.hpp should not include
    barrierSetAssembler
    + JDK-8257575: C2: "failed: only phis" assert failure in loop
    strip mining verification
    + JDK-8257594: C2 compiled checkcast of non-null object triggers
    endless deoptimization/recompilation cycle
    + JDK-8257633: Missing -mmacosx-version-min=X flag when linking
    libjvm
    + JDK-8257670: sun/security/ssl/SSLSocketImpl/SSLSocketLeak.java
    reports leaks
    + JDK-8257707: Fix incorrect format string in Http1HeaderParser
    + JDK-8257746: Regression introduced with JDK-8250984 - memory
    might be null in some machines
    + JDK-8257798: [PPC64] undefined reference to
    Klass::vtable_start_offset()
    + JDK-8257884: Re-enable sun/security/ssl/SSLSocketImpl/
    /SSLSocketLeak.java as automatic test
    + JDK-8257910: [JVMCI] Set exception_seen accordingly in the
    runtime.
    + JDK-8257997: sun/security/ssl/SSLSocketImpl/SSLSocketLeak.java
    again reports leaks after JDK-8257884
    + JDK-8257999: Parallel GC crash in gc/parallel/
    /TestDynShrinkHeap.java: new region is not in covered_region
    + JDK-8258077: Using -Xcheck:jni can lead to a double-free after
    JDK-8193234
    + JDK-8258247: Couple of issues in fix for JDK-8249906
    + JDK-8258373: Update the text handling in the JPasswordField
    + JDK-8258396: SIGILL in jdk.jfr.internal.PlatformRecorder
    .rotateDisk()
    + JDK-8258419: RSA cipher buffer cleanup
    + JDK-8258471: "search codecache" clhsdb command does not work
    + JDK-8258534: Epsilon: clean up unused includes
    + JDK-8258805: Japanese characters not entered by mouse click
    on Windows 10
    + JDK-8258833: Cancel multi-part cipher operations in SunPKCS11
    after failures
    + JDK-8258836: JNI local refs exceed capacity
    getDiagnosticCommandInfo
    + JDK-8258884: [TEST_BUG] Convert applet-based test
    open/test/jdk/javax/swing/JMenuItem/8031573/bug8031573.java
    to a regular java test
    + JDK-8259007: This test printed a blank page
    + JDK-8259048: (tz) Upgrade time-zone data to tzdata2020f
    + JDK-8259049: Uninitialized variable after JDK-8257513
    + JDK-8259231: Epsilon: improve performance under contention
    during virtual space expansion
    + JDK-8259271: gc/parallel/TestDynShrinkHeap.java still fails
    "assert(covered_region.contains(new_memregion)) failed: new
    region is not in covered_region"
    + JDK-8259312: VerifyCACerts.java fails as soneraclass2ca cert
    will expire in 90 days
    + JDK-8259319: Illegal package access when SunPKCS11 requires
    SunJCE's classes
    + JDK-8259339: AllocateUninitializedArray C2 intrinsic fails
    with void.class input
    + JDK-8259428: AlgorithmId.getEncodedParams() should return copy
    + JDK-8259446: runtime/jni/checked/
    /TestCheckedReleaseArrayElements.java fails with stderr not
    empty
    + JDK-8259451: Zero: skip serviceability/sa tests, set vm.hasSA
    to false
    + JDK-8259580: Shenandoah: uninitialized label in
    VerifyThreadGCState
    + JDK-8259619: C1: 3-arg StubAssembler::call_RT stack-use
    condition is incorrect
    + JDK-8259633: compiler/graalunit/CoreTest.java fails with NPE
    after JDK-8244543
    + JDK-8259706: C2 compilation fails with assert(vtable_index ==
    Method::invalid_vtable_index) failed: correct sentinel value
    + JDK-8259707: LDAP channel binding does not work with StartTLS
    extension
    + JDK-8259773: Incorrect encoding of AVX-512 kmovq instruction
    + JDK-8259849: Shenandoah: Rename store-val to IU-barrier
    + JDK-8259949: x86 32-bit build fails when -fcf-protection is
    passed in the compiler flags
    + JDK-8259954: gc/shenandoah/mxbeans tests fail with -Xcomp
    + JDK-8260029: aarch64: fix typo in verify_oop_array
    + JDK-8260308: Update LogCompilation junit to 4.13.1
    + JDK-8260338: Some fields in HaltNode is not cloned
    + JDK-8260349: Cannot programmatically retrieve Metaspace max
    set via JAVA_TOOL_OPTIONS
    + JDK-8260356: (tz) Upgrade time-zone data to tzdata2021a
    + JDK-8260378: [TESTBUG] DcmdMBeanTestCheckJni.java reports
    false positive
    + JDK-8260497: Shenandoah: Improve SATB flushing
    + JDK-8260502: [s390] NativeMovRegMem::verify() fails because
    it's too strict
    + JDK-8260632: Build failures after JDK-8253353
    + JDK-8260704: ParallelGC: oldgen expansion needs release-store
    for _end
    + JDK-8261022: Fix incorrect result of Math.abs() with char type
    + JDK-8261089: [TESTBUG] native library of test
    TestCheckedReleaseCriticalArray.java fails to compile with
    gcc 4.x
    + JDK-8261183: Follow on to Make lists of normal filenames
    + JDK-8261209: isStandalone property: remove dependency on
    pretty-print
    + JDK-8261231: Windows IME was disabled after DnD operation
    + JDK-8261251: Shenandoah: Use object size for full GC
    humongous compaction
    + JDK-8261310: PPC64 Zero build fails with
    'VMError::controlled_crash(int)::FunctionDescriptor
    functionDescriptor' has incomplete type and cannot be defined
    + JDK-8261334: NMT: tuning statistic shows incorrect hash
    distribution
    + JDK-8261413: Shenandoah: Disable class-unloading in I-U mode
    + JDK-8261522: [PPC64] AES intrinsics write beyond the
    destination array
    + JDK-8261534: Test sun/security/pkcs11/KeyAgreement/
    /IllegalPackageAccess.java fails on platforms where no nsslib
    artifacts are defined
    + JDK-8261585: Restore HandleArea used in
    Deoptimization::uncommon_trap
    + JDK-8261753: Test java/lang/System/OsVersionTest.java still
    failing on BigSur patch versions after JDK-8253702
    + JDK-8261829: Exclude tools/jlink/JLinkReproducibleTest.java
    in 11u
    + JDK-8261912: Code IfNode::fold_compares_helper more
    defensively
    + JDK-8261920: [AIX] jshell command throws java.io.IOError on
    non English locales
    + JDK-8262018: Wrong format in SAP copyright header of
    OsVersionTest
    + JDK-8263069: Exclude some failing tests from
    security/infra/java/security/cert/CertPathValidator</changelog>
  <changelog author="fstrba@suse.com" date="1620043200">- Remove all Jpackage provides for SLE12 in order to avoid
  installing this package as default Java on SLE12-SP5
  (bsc#1185476)</changelog>
  <changelog author="fstrba@suse.com" date="1621512000">- Modified patch:
  * nss-security-provider.patch
    + make the NSS provider first in the list</changelog>
  <changelog author="fstrba@suse.com" date="1626868800">- Update to upstream tag jdk-11.0.12+7 (July 2021, CPU)
  * Security fixes
    + JDK-8256157: Improve bytecode assembly
    + JDK-8256491: Better HTTP transport
    + JDK-8258432, CVE-2021-2341, bsc#1188564: Improve file
    transfers
    + JDK-8260453: Improve Font Bounding
    + JDK-8260960: Signs of jarsigner signing
    + JDK-8260967, CVE-2021-2369, bsc#1188565: Better jar file
    validation
    + JDK-8262380: Enhance XML processing passes
    + JDK-8262403: Enhanced data transfer
    + JDK-8262410: Enhanced rules for zones
    + JDK-8262477: Enhance String Conclusions
    + JDK-8262967: Improve Zip file support
    + JDK-8264066, CVE-2021-2388, bsc#1188566: Enhance compiler
    validation
    + JDK-8264079: Improve abstractions
    + JDK-8264460: Improve NTLM support
  * Other changes
    + JDK-6847157: java.lang.NullPointerException: HDC for
    component at sun.java2d.loops.Blit.Blit
    + JDK-7106851: Test should not use System.exit
    + JDK-8073446: TimeZone getOffset API does not  return a dst
    offset between years 2038-2137
    + JDK-8076190: Customizing the generation of a PKCS12 keystore
    + JDK-8153005: Upgrade the default PKCS12 encryption/MAC
    algorithms
    + JDK-8171303: sun/java2d/pipe/InterpolationQualityTest.java
    fails on Windows &amp; Linux
    + JDK-8177068: incomplete classpath causes NPE in Flow
    + JDK-8185734: [Windows] Structured Exception Catcher missing
    around gtest execution
    + JDK-8187450: JNI local refs exceeds capacity warning in
    NetworkInterface::getAll
    + JDK-8190763: Class cast exception on (CompoundEdit)
    UndoableEditEvent.getEdit()
    + JDK-8195841: PNGImageReader.readNullTerminatedString() doesnt
    check for non-null terminated strings with length equal to
    maxLen
    + JDK-8196100: javax/swing/text/JTextComponent/5074573/
    /bug5074573.java fails
    + JDK-8199646: JShell tests: jdk/jshell/
    /FailOverDirectExecutionControlTest.java failed with
    java.lang.UnsupportedOperationException
    + JDK-8206925: Support the certificate_authorities extension
    + JDK-8207160: ClassReader::adjustMethodParams can potentially
    return null if the args list is empty
    + JDK-8207247: AARCH64: Enable Minimal and Client VM builds
    + JDK-8207404: MulticastSocket tests failing on AIX
    + JDK-8207779: Method::is_valid_method() compares 'this' with
    NULL
    + JDK-8208061: runtime/LoadClass/TestResize.java fails with
    "Load factor too high" when running in CDS mode.
    + JDK-8209459: TestSHA512MultiBlockIntrinsics failed on AArch64
    + JDK-8210443: Migrate Locale matching tests to JDK Repo.
    + JDK-8213231: ThreadSnapshot::_threadObj can become stale
    + JDK-8213483: ARM32: runtime/ErrorHandling/
    /ShowRegistersOnAssertTest.java jtreg test fail
    + JDK-8213725: JShell NullPointerException due to class file
    with unexpected package
    + JDK-8213794: ARM32: disable TypeProfiling,
    CriticalJNINatives, Serviceablity tests for ARM32
    + JDK-8213845: ARM32: Interpreter doesn't call result handler
    after native calls
    + JDK-8214128: ARM32: wrong stack alignment on
    Deoptimization::unpack_frames
    + JDK-8214512: ARM32: Jtreg test compiler/c2/Test8062950.java
    fails on ARM
    + JDK-8214854: JDWP: Unforseen output truncation in logging
    + JDK-8214922: Add vectorization support for fmin/fmax
    + JDK-8215009: GCC 8 compilation error in libjli
    + JDK-8216184: CDS/appCDS tests failed on Windows due to long
    path to a classlist file
    + JDK-8216259: AArch64: Vectorize Adler32 intrinsics
    + JDK-8216314: SIGILL in CodeHeapState::print_names()
    + JDK-8217348: assert(thread-&gt;is_Java_thread()) failed: just
    checking
    + JDK-8217465: [REDO] - Optimize CodeHeap Analytics
    + JDK-8217561: X86: Add floating-point Math.min/max intrinsics
    + JDK-8217918: C2: -XX:+AggressiveUnboxing is broken
    + JDK-8218458: [TESTBUG] runtime/NMT/
    /CheckForProperDetailStackTrace.java fails with Expected
    stack trace missing from output
    + JDK-8219142: Remove unused JIMAGE_ResourcePath
    + JDK-8219586: CodeHeap State Analytics processes dead nmethods
    + JDK-8220074: Clean up GCC 8.3 errors in LittleCMS
    + JDK-8220407: compiler/intrinsics/math/
    /TestFpMinMaxIntrinsics.java timedout
    + JDK-8222302: [TESTBUG] test/hotspot/jtreg/compiler/intrinsics/
    /sha/cli/TestUseSHAOptionOnUnsupportedCPU.java fails on any
    other CPU
    + JDK-8222412: AARCH64: multiple instructions encoding issues
    + JDK-8223020: aarch64: expand minI_rReg and maxI_rReg patterns
    into separate instructions
    + JDK-8223444: Improve CodeHeap Free Space Management
    + JDK-8223504: Improve performance of forall loops by better
    inlining of "iterator()" methods
    + JDK-8223667: ASAN build broken
    + JDK-8225081: Remove Telia Company CA certificate expiring in
    April 2021
    + JDK-8225116: Test OwnedWindowsLeak.java intermittently fails
    + JDK-8225438: javax/net/ssl/TLSCommon/
    /TestSessionLocalPrincipal.java failed with Read timed out
    + JDK-8225756: [testbug] compiler/loopstripmining/
    /CheckLoopStripMining.java sets too short a
    SafepointTimeoutDelay
    + JDK-8226374: Restrict TLS signature schemes and named groups
    + JDK-8226627: assert(t-&gt;singleton()) failed: must be a constant
    + JDK-8226721: Missing intrinsics for Math.ceil, floor, rint
    + JDK-8227080: (fs) Files.newInputStream(...).skip(n) is slow
    + JDK-8227222: vmTestbase/jit/FloatingPoint/gen_math/Loops04/
    /Loops04.java failed XMM register should be 0-15
    + JDK-8227609: (fs) Files.newInputStream(...).skip(n) should
    allow skipping beyond file size
    + JDK-8230428: Cleanup dead CastIP node code in formssel.cpp
    + JDK-8231460: Performance issue (CodeHeap) with large free
    blocks
    + JDK-8231713: x86_32 build failures after JDK-8226721 (Missing
    intrinsics for Math.ceil, floor, rint)
    + JDK-8231841: AArch64: debug.cpp help() is missing an AArch64
    line for pns
    + JDK-8232084: HotSpot build failed with GCC 9.2.1
    + JDK-8232591: AArch64: Add missing match rules for smaddl,
    smsubl and smnegl
    + JDK-8233185: HttpServer.stop() blocks indefinitely when
    called on dispatch thread
    + JDK-8233787: Break cycle in vm_version* includes
    + JDK-8233948: AArch64: Incorrect mapping between OptoReg and
    VMReg for high 64 bits of Vector Register
    + JDK-8234355: Buffer overflow in jcmd GC.class_stats due to
    too many classes
    + JDK-8235368: Update BCEL to Version 6.4.1
    + JDK-8236859: WebSocket over authenticating proxy fails with
    NPE
    + JDK-8236992: AArch64: remove redundant load_klass in itable
    stub
    + JDK-8237743: test/langtools/jdk/jshell/
    /FailOverExecutionControlTest.java fails No
    ExecutionControlProvider with name 'nonExistent' and parameter
    keys: []
    + JDK-8237804: sun/security/mscapi tests fail with "Key pair
    not generated, alias &lt;nnnnnn&gt; already exists"
    + JDK-8238175: CTW: Class.getDeclaredMethods fails with
    assert(k-&gt;is_subclass_of(SystemDictionary::Throwable_klass()))
    failed: invalid exception class
    + JDK-8238567: SoftMainMixer.processAudioBuffers(): Wrong
    handling of stoppedMixers
    + JDK-8238812: assert(false) failed: bad AD file
    + JDK-8239312: [macos] javax/swing/JFrame/NSTexturedJFrame/
    /NSTexturedJFrame.java
    + JDK-8239386: handle ContendedPaddingWidth in
    vm_version_aarch64
    + JDK-8239536: Can't use 'java.util.List' object after
    importing 'java.awt.List'
    + JDK-8240487: Cleanup whitespace in .cc, .hh, .m, and .mm files
    + JDK-8240848: ArrayIndexOutOfBoundsException buf for
    TextCallbackHandler
    + JDK-8241082: Upgrade IANA Language Subtag Registry data to
    03-16-2020 version
    + JDK-8241087: Build failure with VS 2019 (16.5.0) due to C2039
    and C2873
    + JDK-8241101: [s390] jtreg test failure after JDK-8238696: not
    conformant features string
    + JDK-8241248: NullPointerException in
    sun.security.ssl.HKDF.extract(HKDF.java:93)
    + JDK-8241372: Several test failures due to
    javax.net.ssl.SSLException: Connection reset
    + JDK-8241475: AArch64: Add missing support for PopCountVI node
    + JDK-8241829: Cleanup the code for PrinterJob on windows
    + JDK-8241960: The SHA3 message digests impl of SUN provider
    are not thread safe after cloned
    + JDK-8242010: Upgrade IANA Language Subtag Registry to Version
    2020-04-01
    + JDK-8242429: Better implementation for sign extract
    + JDK-8242557: Add length limit for strings in PNGImageWriter
    + JDK-8242919: Paste locks up jshell
    + JDK-8243155: AArch64: Add support for SqrtVF
    + JDK-8243240: AArch64: Add support for MulVB
    + JDK-8243452: JFR: Could not create chunk in repository with
    over 200 recordings
    + JDK-8243559: Remove root certificates with 1024-bit keys
    + JDK-8243597: AArch64: Add support for integer vector abs
    + JDK-8244031: HttpClient should have more tests for HEAD
    requests
    + JDK-8244205: HTTP/2 tunnel connections through proxy may be
    reused regardless of which proxy is selected
    + JDK-8244847: Linux/PPC: runtime/CompressedOops/
    /CompressedClassPointers: smallHeapTest fails
    + JDK-8245511: G1 adaptive IHOP does not account for
    reclamation of humongous objects by young GC
    + JDK-8246274: G1 old gen allocation tracking is not in a
    separate class
    + JDK-8247354: [aarch64] PopFrame causes
    assert(oopDesc::is_oop(obj)) failed: not an oop
    + JDK-8247408: IdealGraph bit check expression canonicalization
    + JDK-8247432: Update IANA Language Subtag Registry to Version
    2020-09-29
    + JDK-8247438: JShell: When FailOverExecutionControlProvider
    fails the proximal cause is not shown
    + JDK-8247753: UIManager.getSytemLookAndFeelClassName() returns
    wrong value on Fedora 32
    + JDK-8248043: Need to eliminate excessive i2l conversions
    + JDK-8248411: [aarch64] Insufficient error handling when
    CodeBuffer is exhausted
    + JDK-8248568: compiler/c2/TestBit.java failed: test missing
    from stdout/stderr
    + JDK-8248870: AARCH64: I2L/L2I conversions can be skipped for
    masked positive values
    + JDK-8249142: java/awt/FontClass/CreateFont/DeleteFont.sh is
    unstable
    + JDK-8249189: AARCH64: more L2I conversions can be skipped
    + JDK-8249719: MethodHandle performance suffers from bad
    ResolvedMethodTable hash function
    + JDK-8249875: GCC 10 warnings -Wtype-limits with JFR code
    + JDK-8250635: MethodArityHistogram should use Compile_lock in
    favour of fancy checks
    + JDK-8250876: Fix issues with cross-compile on macos
    + JDK-8251031: Some vmTestbase/nsk/monitoring/RuntimeMXBean
    tests fail with hostnames starting from digits
    + JDK-8251525: AARCH64: Faster Math.signum(fp)
    + JDK-8252259: AArch64: Adjust default value of FLOATPRESSURE
    + JDK-8252311: AArch64: save two words in itable lookup stub
    + JDK-8252779: compiler/graalunit/HotspotTest.java failed after
    8251525
    + JDK-8252883: AccessDeniedException caused by delayed file
    deletion on Windows
    + JDK-8253167: ARM32 builds fail after JDK-8247910
    + JDK-8253572: [windows] CDS archive may fail to open with long
    file names
    + JDK-8253923: C2 doesn't always run loop opts for compilations
    that include loops
    + JDK-8253948: Memory leak in ImageFileReader
    + JDK-8254631: Better support ALPN byte wire values in SunJSSE
    + JDK-8254717: isAssignableFrom checks in
    KeyFactorySpi.engineGetKeySpec appear to be backwards
    + JDK-8255086: Update the root locale display names
    + JDK-8255625: AArch64: Implement Base64.encodeBlock
    accelerator/intrinsic
    + JDK-8255763: C2: OSR miscompilation caused by invalid memory
    instruction placement
    + JDK-8255992: JFR EventWriter does not use first string from
    StringPool with id 0
    + JDK-8256037: [TESTBUG] com/sun/jndi/dns/ConfigTests/
    /PortUnreachable.java fails due to the hard coded threshold
    is small
    + JDK-8256244: java/lang/ProcessHandle/PermissionTest.java
    fails with TestNG 7.1
    + JDK-8256287: [windows] add loop fuse to
    map_or_reserve_memory_aligned
    + JDK-8256523: Streamline Java SHA2 implementation
    + JDK-8257414: Drag n Drop target area is wrong on high DPI
    systems
    + JDK-8257569: Failure observed with
    JfrVirtualMemory::initialize
    + JDK-8257574: C2: "failed: parsing found no loops but there
    are some" assert failure
    + JDK-8257580: Bump update version for OpenJDK: jdk-11.0.12
    + JDK-8257604: JNI_ArgumentPusherVaArg leaks valist
    + JDK-8257621: JFR StringPool misses cached items across
    consecutive recordings
    + JDK-8257796: [TESTBUG]
    TestUseSHA512IntrinsicsOptionOnSupportedCPU.java fails
    on x86_32
    + JDK-8257822: C2 crashes with SIGFPE due to a division that
    floats above its zero check
    + JDK-8257828: SafeFetch may crash if invoked in non-JavaThreads
    + JDK-8257853: Remove dependencies on JNF's JNI utility
    functions in AWT and 2D code
    + JDK-8257858: [macOS]: Remove JNF dependency from
    libosxsecurity/KeystoreImpl.m
    + JDK-8257860: [macOS]: Remove JNF dependency from
    libosxkrb5/SCDynamicStoreConfig.m
    + JDK-8257988: Remove JNF dependency from
    libsaproc/MacosxDebuggerLocal.m
    + JDK-8258414: OldObjectSample events too expensive
    + JDK-8258505: [TESTBUG] TestDivZeroWithSplitIf.java fails due
    to missing UnlockDiagnosticVMOptions
    + JDK-8258753: StartTlsResponse.close() hangs due to
    synchronization issues
    + JDK-8259061: C2: assert(found) failed: memory-writing node is
    not placed in its original loop or an ancestor of it
    + JDK-8259227: C2 crashes with SIGFPE due to a division that
    floats above its zero check
    + JDK-8259232: Bad JNI lookup during printing
    + JDK-8259276: C2: Empty expression stack when reexecuting
    tableswitch/lookupswitch instructions after deoptimization
    + JDK-8259343: [macOS] Update JNI error handling in Cocoa code.
    + JDK-8259585: Accessible actions do not work on mac os x
    + JDK-8259651: [macOS] Replace JNF_COCOA_ENTER/EXIT macros
    + JDK-8259662: Don't wrap SocketExceptions into SSLExceptions
    in SSLSocketImpl
    + JDK-8259710: Inlining trace leaks memory
    + JDK-8259729: Missed JNFInstanceOf -&gt; IsInstanceOf conversion
    + JDK-8259777: Incorrect predication condition generated by ADLC
    + JDK-8259786: initialize last parameter of getpwuid_r
    + JDK-8259843: initialize dli_fname array before calling
    dll_address_to_library_name
    + JDK-8259869: [macOS] Remove desktop module dependencies on
    JNF Reference APIs
    + JDK-8259886: Improve SSL session cache performance and
    scalability
    + JDK-8259983: do not use uninitialized expand_ms value in
    G1CollectedHeap::expand_heap_after_young_collection
    + JDK-8260030: Improve stringStream buffer handling
    + JDK-8260236: better init AnnotationCollector _contended_group
    + JDK-8260255: C1: LoopInvariantCodeMotion constructor can
    leave some fields uninitialized
    + JDK-8260284: C2: assert(_base == Int) failed: Not an Int
    + JDK-8260380: Upgrade to LittleCMS 2.12
    + JDK-8260420: C2 compilation fails with assert(found_sfpt)
    failed: no node in loop that's not input to safepoint
    + JDK-8260426: awt debug_mem.c DMem_AllocateBlock might leak
    memory
    + JDK-8260432: allocateSpaceForGP in freetypeScaler.c might
    leak memory
    + JDK-8260616: Removing remaining JNF dependencies in the
    java.desktop module
    + JDK-8260653: Unreachable nodes keep speculative types alive
    + JDK-8260707: java/lang/instrument/PremainClass/
    /InheritAgent0100.java times out
    + JDK-8260925: HttpsURLConnection does not work  with other
    JSSE provider.
    + JDK-8260926: Trace resource exhausted events unconditionally
    + JDK-8261020: Wrong format parameter in
    create_emergency_chunk_path
    + JDK-8261027: AArch64: Support for LSE atomics C++ HotSpot code
    + JDK-8261167: print_process_memory_info add a close call after
    fopen
    + JDK-8261170: Upgrade to freetype 2.10.4
    + JDK-8261198: [macOS] Incorrect JNI parameters in number
    conversion in A11Y code
    + JDK-8261235: C1 compilation fails with
    assert(res-&gt;vreg_number() == index) failed: conversion check
    + JDK-8261261: The version extra fields needs to be overridable
    in jib-profiles.js
    + JDK-8261262: Kitchensink24HStress.java crashed with
    EXCEPTION_ACCESS_VIOLATION
    + JDK-8261354: SIGSEGV at MethodIteratorHost
    + JDK-8261355: No data buffering in SunPKCS11 Cipher encryption
    when the underlying mechanism has no padding
    + JDK-8261397: try catch Method failing to work when dividing
    an integer by 0
    + JDK-8261422: Adjust problematic String.format calls in
    jdk/internal/util/Preconditions.java outOfBoundsMessage
    + JDK-8261447: MethodInvocationCounters frequently run into
    overflow
    + JDK-8261481: Cannot read Kerberos settings in dynamic store
    on macOS Big Sur
    + JDK-8261505: Test test/hotspot/jtreg/gc/parallel/
    /TestDynShrinkHeap.java killed by Linux OOM Killer
    + JDK-8261601: free memory in early return in
    Java_sun_nio_ch_sctp_SctpChannelImpl_receive0
    + JDK-8261649: AArch64: Optimize LSE atomics in C++ code
    + JDK-8261730: C2 compilation fails with
    assert(store-&gt;find_edge(load) != -1) failed: missing
    precedence edge
    + JDK-8261752: Multiple GC test are missing memory requirements
    + JDK-8261791: (sctp) handleSendFailed in SctpChannelImpl.c
    potential leaks
    + JDK-8261812: C2 compilation fails with assert(!had_error)
    failed: bad dominance
    + JDK-8261914: IfNode::fold_compares_helper faces
    non-canonicalized bool when running JRuby JSON workload
    + JDK-8262093: java/util/concurrent/tck/JSR166TestCase.java
    failed "assert(false) failed: unexpected node"
    + JDK-8262110: DST starts from incorrect time in 2038
    + JDK-8262121: [11u] Redo 8244287: JFR: Methods samples have
    line number 0
    + JDK-8262163: Extend settings printout in jcmd VM.metaspace
    + JDK-8262295: C2: Out-of-Bounds Array Load from Clone Source
    + JDK-8262298: G1BarrierSetC2::step_over_gc_barrier fails with
    assert "bad barrier shape"
    + JDK-8262446: DragAndDrop hangs on Windows
    + JDK-8262461: handle wcstombsdmp return value correctly in
    unix awt_InputMethod.c
    + JDK-8262465: Very long compilation times and high memory
    consumption in C2 debug builds
    + JDK-8262726: AArch64: C1 StubAssembler::call_RT can corrupt
    stack
    + JDK-8262739: String inflation C2 intrinsic prevents insertion
    of anti-dependencies
    + JDK-8262829: Native crash in
    Win32PrintServiceLookup.getAllPrinterNames()
    + JDK-8262837: handle split_USE correctly
    + JDK-8262900: ToolBasicTest fails to access HTTP server it
    starts
    + JDK-8263260: [s390] Support latest hardware (z14 and z15)
    + JDK-8263311: Watch registry changes for remote printers
    update instead of polling
    + JDK-8263361: Incorrect arraycopy stub selected by C2 for SATB
    collectors
    + JDK-8263404: RsaPrivateKeySpec is always recognized as
    RSAPrivateCrtKeySpec in RSAKeyFactory.engineGetKeySpec
    + JDK-8263425: AArch64: two potential bugs in C1
    LIRGenerator::generate_address()
    + JDK-8263448: CTW: fatal error: meet not symmetric
    + JDK-8263504: Some OutputMachOpcodes fields are uninitialized
    + JDK-8263557: Possible NULL dereference in
    Arena::destruct_contents()
    + JDK-8263558: Possible NULL dereference in fast path arena
    free if ZapResourceArea is true
    + JDK-8263676: AArch64: one potential bug in C1
    LIRGenerator::generate_address()
    + JDK-8263729: [test] divert spurious output away from stream
    under test in ProcessBuilder Basic test
    + JDK-8263846: Bad JNI lookup getFocusOwner in accessibility
    code on Mac OS X
    + JDK-8264047: Duplicate global variable 'jvm' in libjavajpeg
    and libawt
    + JDK-8264096: slowdebug jvm crashes when StrInflatedCopy match
    rule is not supported
    + JDK-8264151: ciMethod::ensure_method_data() should return
    false is loading resulted in empty state
    + JDK-8264173: [s390] Improve Hardware Feature Detection And
    Reporting
    + JDK-8264190: Harden TLS interop tests
    + JDK-8264223: CodeHeap::verify fails extra_hops assertion in
    fastdebug test
    + JDK-8264328: Broken license in
    javax/swing/JComboBox/8072767/bug8072767.java
    + JDK-8264360: Loop strip mining verification fails with
    "should be on the backedge"
    + JDK-8264626: C1 should be able to inline excluded methods
    + JDK-8264640: CMS ParScanClosure misses a barrier
    + JDK-8264786: [macos] All Swing/AWT apps cause Allow
    Notifications prompt to appear when app is launched
    + JDK-8264821: DirectIOTest fails on a system with large block
    size
    + JDK-8264848: [macos] libjvm.dylib linker warning due to macOS
    version mismatch
    + JDK-8264923: PNGImageWriter.write_zTXt throws Exception with
    a typo
    + JDK-8264958: C2 compilation fails with assert "n is later
    than its clone"
    + JDK-8265099: Revert backport to 11u of 8236859: WebSocket
    over authenticating proxy fails with NPE
    + JDK-8265154: vinserti128 operand mix up for KNL platforms
    + JDK-8265239: Shenandoah: Shenandoah heap region count could
    be off by 1
    + JDK-8265417: Backport of JDK-8249672 breaks Solaris x86 build
    + JDK-8265421: java/lang/String/StringRepeat.java test is
    missing a memory requirement
    + JDK-8265462: Handle multiple slots in the NSS Internal Module
    from SunPKCS11's Secmod
    + JDK-8265537: x86 version string truncated after JDK-8249672
    11u backport
    + JDK-8265666: Enable AIX build platform to make external debug
    symbols
    + JDK-8265677: CMS: CardTableBarrierSet::write_ref_array_work()
    lacks storestore barrier
    + JDK-8265690: Use the latest Ubuntu base image version in
    Docker testing
    + JDK-8265718: Build failure after JDK-8258414 11u backport
    + JDK-8265750: Fatal error in safepoint.cpp after backport of
    8258414
    + JDK-8265784: [C2] Hoisting of DecodeN leaves MachTemp inputs
    behind
    + JDK-8265938: C2's conditional move optimization does not
    handle top Phi
    + JDK-8266220: keytool still prompt for store password on a
    password-less pkcs12 file if -storetype pkcs12 is specified
    + JDK-8266293: Key protection using PBEWithMD5AndDES fails with
    "java.security.InvalidAlgorithmParameterException: Salt must
    be 8 bytes long"
    + JDK-8266713: [AIX] Build failure after 11u backport of
    JDK-8247753
    + JDK-8266802: Shenandoah: Round up region size to page size
    unconditionally
    + JDK-8266892: avoid maybe-uninitialized gcc warnings on linux
    s390x
    + JDK-8266929: Unable to use algorithms from 3p providers
    + JDK-8267235: [macos_aarch64]
    InterpreterRuntime::throw_pending_exception messing up LR
    results in crash
    + JDK-8267561: Shenandoah: Reference processing not properly
    setup for outside of cycle degenerated GC
    + JDK-8267599: Revert the change to the default PKCS12
    macAlgorithm and macIterationCount props for 11u/8u/7u
    + JDK-8267641: [11u] 8227609 backport typo
    + JDK-8267721: Enable sun/security/pkcs11 tests for Amazon
    Linux 2 AArch64
    + JDK-8268678: LetsEncryptCA.java test fails as Let's Encrypt
    Authority X3 is retired</changelog>
  <changelog author="schwab@suse.de" date="1628078400">- riscv64-zero.patch: Add support for riscv64 (zero VM)</changelog>
  <changelog author="fstrba@suse.com" date="1629979200">- Added patch:
  * jdk11-glibc234.patch
    + fix build with glibc-2.34 (bsc#1189201)</changelog>
  <changelog author="fstrba@suse.com" date="1631534400">- Modified patch:
  * nss-security-provider.patch
    + revert recent changes making NSS provider the default one
    + fixes bsc#1190252</changelog>
  <changelog author="fstrba@suse.com" date="1631793600">- Added patch:
  * fips.patch
    + implement FIPS support in OpenJDK</changelog>
  <changelog author="fstrba@suse.com" date="1634817600">- Update to upstream tag jdk-11.0.13+8 (October 2021 CPU)
  * Security fixes
    + JDK-8163326, CVE-2021-35550, bsc#1191901: Update the default
    enabled cipher suites preference
    + JDK-8254967, CVE-2021-35565, bsc#1191909:
    com.sun.net.HttpsServer spins on TLS session close
    + JDK-8263314: Enhance XML Dsig modes
    + JDK-8265167, CVE-2021-35556, bsc#1191910: Richer Text Editors
    + JDK-8265574: Improve handling of sheets
    + JDK-8265580, CVE-2021-35559, bsc#1191911: Enhanced style for
    RTF kit
    + JDK-8265776: Improve Stream handling for SSL
    + JDK-8266097, CVE-2021-35561, bsc#1191912: Better hashing
    support
    + JDK-8266103: Better specified spec values
    + JDK-8266109: More Resilient Classloading
    + JDK-8266115: More Manifest Jar Loading
    + JDK-8266137, CVE-2021-35564, bsc#1191913: Improve Keystore
    integrity
    + JDK-8266689, CVE-2021-35567, bsc#1191903: More Constrained
    Delegation
    + JDK-8267086: ArrayIndexOutOfBoundsException in
    java.security.KeyFactory.generatePublic
    + JDK-8267712: Better LDAP reference processing
    + JDK-8267729, CVE-2021-35578, bsc#1191904: Improve TLS client
    handshaking
    + JDK-8267735, CVE-2021-35586, bsc#1191914: Better BMP support
    + JDK-8268193: Improve requests of certificates
    + JDK-8268199: Correct certificate requests
    + JDK-8268205: Enhance DTLS client handshake
    + JDK-8268506: More Manifest Digests
    + JDK-8269618, CVE-2021-35603, bsc#1191906: Better session
    identification
    + JDK-8269624: Enhance method selection support
    + JDK-8270398: Enhance canonicalization
    + JDK-8270404: Better canonicalization
  * Other changes
    + JDK-8024368: private methods are allocated vtable indices
    + JDK-8042902: Test java/net/Inet6Address/serialize/
    /Inet6AddressSerializationTest.java fails intermittently
    + JDK-8140466: ChaCha20 and Poly1305 TLS Cipher Suites
    + JDK-8157404: Unable to read certain PKCS12 keystores from
    SequenceInputStream
    + JDK-8158066: SourceDebugExtensionTest fails to rename file
    + JDK-8168304: Make all of DependencyContext_test available in
    product mode
    + JDK-8169246: java/net/DatagramSocket/ReportSocketClosed.java
    fails intermittently with BindException
    + JDK-8181313: SA: Remove libthread_db dependency on Linux
    + JDK-8193214: Incorrect annotations.without.processors
    warnings with JDK 9
    + JDK-8194230: jdk/internal/jrtfs/remote/
    /RemoteRuntimeImageTest.java fails with
    java.lang.NullPointerException
    + JDK-8196092: javax/swing/JComboBox/8032878/bug8032878.java
    fails
    + JDK-8199931: java/net/MulticastSocket/
    /UnreferencedMulticastSockets.java fails with "incorrect data
    received"
    + JDK-8206083: Make tools/javac/api/T6265137.java robust to JDK
    version changes
    + JDK-8206350: java/util/Locale/bcp47u/SystemPropertyTests.java
    failed on Mac 10.13 with zh_CN and zh_TW locales.
    + JDK-8207316: java/nio/channels/spi/SelectorProvider/
    /inheritedChannel/InheritedChannelTest.java failed
    + JDK-8208227: tools/jdeps/DotFileTest.java fails on Win-X64
    + JDK-8208363: test/jdk/java/lang/Package/
    /PackageFromManifest.java missing module dependencies
    declaration
    + JDK-8209380: ARM: cleanup maybe-uninitialized and reorder
    compiler warnings
    + JDK-8209768: Refactor java/util/prefs/CheckUserPrefsStorage.sh
    to plain java test
    + JDK-8209772: Refactor shell test java/util/ServiceLoader/
    /basic/basic.sh to java
    + JDK-8209773: Refactor shell test javax/naming/module/basic.sh
    to java
    + JDK-8209832: Refactor jdk/internal/reflect/Reflection/
    /GetCallerClassTest.sh to plain java test
    + JDK-8209930: Refactor java/util/zip/ZipFile/deletetempjar.sh
    to plain java test
    + JDK-8210406: Refactor java.util.PluggableLocale:i18n shell
    tests to plain java tests
    + JDK-8210407: Refactor java.util.Calendar:i18n shell tests to
    plain java tests
    + JDK-8210495: compiler crashes because of illegal signature in
    otherwise legal code
    + JDK-8210669: Some launcher tests assume a pre-JDK 9 run-time
    image layout
    + JDK-8210802: temp files left by tests in
    jdk/java/net/httpclient
    + JDK-8210819: Update the host name in CNameTest.java
    + JDK-8210908: Refactor java/util/prefs/PrefsSpi.sh to plain
    java test
    + JDK-8210934: Move sun/net/www/protocol/http/
    /GetErrorStream.java to OpenJDK
    + JDK-8210959: JShell fails and exits when statement throws an
    exception whose message contains a '%'.
    + JDK-8211055: Provide print to a file (PDF) feature even when
    printer was not connected
    + JDK-8211092: test/jdk/sun/net/www/http/HttpClient/
    /MultiThreadTest.java fails intermittently when cleaning up
    + JDK-8211296: Remove HotSpot deprecation warning suppression
    for Mac/clang
    + JDK-8211325: test/jdk/java/net/Socket/LingerTest.java fails
    with cleaning up
    + JDK-8212040: Compilation error due to wrong usage of
    NSPrintJobDispositionValue in mac10.12
    + JDK-8212695: Add explicit timeout to several HTTP Client tests
    + JDK-8212718: Refactor some annotation processor tests to
    better use collections
    + JDK-8213007: Update the link in test/jdk/sun/security/
    /provider/SecureRandom/DrbgCavp.java
    + JDK-8213137: Remove static initialization of monitor/mutex
    instances
    + JDK-8213235: java/nio/channels/SocketChannel/
    /AsyncCloseChannel.java fails with threads that didn't exit
    + JDK-8213409: Refactor sun.text.IntHashtable:i18n shell tests
    to plain java tests
    + JDK-8213576: Make test AsyncCloseChannel.java run in othervm
    + JDK-8213694: Test Timeout.java should run in othervm mode
    + JDK-8213718: [TEST] Wrong classname in vmTestbase/nsk/stress/
    /except/except002 and except003
    + JDK-8213922: fix ctw stand-alone build
    + JDK-8214195: Align stdout messages in
    test/jdk/java/math/BigInteger/PrimitiveConversionTests.java
    + JDK-8214520: [TEST_BUG] sun/security/mscapi/nonUniqueAliases/
    /NonUniqueAliases.java failed with incorrect jtreg tags order
    + JDK-8214937: sun/security/tools/jarsigner/warnings/
    /NoTimestampTest.java failed due to unexpected expiration date
    + JDK-8216532: tools/launcher/Test7029048.java fails (Solaris)
    + JDK-8217825: Verify @AfterTest is used correctly in WebSocket
    tests
    + JDK-8218145: block_if_requested is not proper inlined due to
    size
    + JDK-8219417: bump jtreg requiredVersion to b14
    + JDK-8219552: bump jtreg requiredVersion to b14 in
    test/jdk/sanity/client/
    + JDK-8219804: java/net/MulticastSocket/Promiscuous.java fails
    intermittently due to NumberFormatException
    + JDK-8220445: Support for side by side MSVC Toolset versions
    + JDK-8221988: add possibility to build with Visual Studio 2019
    + JDK-8222751: closed/test/jdk/sun/security/util/
    /DerIndefLenConverter/IndefBerPkcs12.java fail
    + JDK-8223050: JVMCI: findUniqueConcreteMethod() should not use
    Dependencies::find_unique_concrete_method() for non-virtual
    methods
    + JDK-8224853: CDS address sanitizer errors
    + JDK-8225082: Remove IdenTrust certificate that is expiring in
    September 2021
    + JDK-8225583: Examine the HttpResponse.BodySubscribers for
    null handling and multiple subscriptions
    + JDK-8225690: Multiple AttachListener threads can be created
    + JDK-8225790: Two NestedDialogs tests fail on Ubuntu
    + JDK-8226319: Add forgotten test/jdk/java/net/httpclient/
    /BodySubscribersTest.java
    + JDK-8226533: JVMCI: findUniqueConcreteMethod should handle
    statically bindable methods directly
    + JDK-8226602: Test convenience reactive primitives from
    java.net.http with RS TCK
    + JDK-8226683: Remove review suggestion from fix to 8219804
    + JDK-8227738: jvmti/DataDumpRequest/datadumpreq001 failed due
    to "exit code is 134"
    + JDK-8227766: CheckUnhandledOops is broken in MemAllocator
    + JDK-8227815: Minimal VM: set_state is not a member of
    AttachListener
    + JDK-8230674: Heap dumps should exclude dormant CDS archived
    objects of unloaded classes
    + JDK-8230808: Remove Access::equals()
    + JDK-8230841: Remove oopDesc::equals()
    + JDK-8231717: Improve performance of charset decoding when
    charset is always compactable
    + JDK-8232243: Wrong caret position in JTextPane on Windows
    with a screen resolution &gt; 100%
    + JDK-8232782: Shenandoah: streamline post-LRB CAS barrier
    (aarch64)
    + JDK-8233790: Forward output from heap dumper to jcmd/jmap
    + JDK-8233989: Create an IPv4 version of
    java/net/MulticastSocket/SetLoopbackMode.java
    + JDK-8234510: Remove file seeking requirement for writing a
    heap dump
    + JDK-8235211: serviceability/attach/
    /RemovingUnixDomainSocketTest.java fails with
    AttachNotSupportedException: Unable to open socket file
    + JDK-8235216: typo in test filename
    + JDK-8235866: bump jtreg requiredVersion to 4.2b16
    + JDK-8236111: narrow allowSmartActionArgs disabling
    + JDK-8236413: AbstractConnectTimeout should tolerate both
    NoRouteToHostException and UnresolvedAddressException
    + JDK-8236671: NullPointerException in JKS keystore
    + JDK-8238930: problem list compiler/c2/Test8004741.java
    + JDK-8238943: switch to jtreg 5.0
    + JDK-8240555: Using env of JAVA_TOOL_OPTIONS and _JAVA_OPTIONS
    breaks QuietOption.java test
    + JDK-8240983: Incorrect copyright header in Apache Santuario
    2.1.3 files
    + JDK-8241336: Some java.net tests failed with
    NoRouteToHostException on MacOS with special network
    configuration
    + JDK-8241353: NPE in ToolProvider.getSystemJavaCompiler
    + JDK-8241768: git needs .gitattributes
    + JDK-8242882: opening jar file with large manifest might throw
    NegativeArraySizeException
    + JDK-8244973: serviceability/attach/
    /RemovingUnixDomainSocketTest.java fails "stderr was not
    empty"
    + JDK-8245134: test/lib/jdk/test/lib/security/
    /KeyStoreUtils.java should allow to specify aliases
    + JDK-8246261: TCKLocalTime.java failed due to "AssertionError:
    expected [18:14:22] but found [18:14:23]"
    + JDK-8246387: switch to jtreg 5.1
    + JDK-8247421: [TESTBUG] ReturnBlobToWrongHeapTest.java failed
    allocating blob
    + JDK-8247469: getSystemCpuLoad() returns -1 on linux when some
    offline cpus are present and cpusets.effective_cpus is not
    available
    + JDK-8248352: [TEST_BUG] Test test/jdk/java/awt/font/
    /TextLayout/ArabicDiacriticTest.java can leave frame open
    + JDK-8248403: AArch64: Remove uses of kernel integer types
    + JDK-8248414: AArch64: Remove uses of long and unsigned long
    ints
    + JDK-8248657: Windows: strengthening in ThreadCritical
    regarding memory model
    + JDK-8248666: AArch64: Use THREAD_LOCAL instead of __thread
    + JDK-8248668: AArch64: Avoid MIN/MAX macros when using MSVC
    + JDK-8248671: AArch64: Remove unused variables
    + JDK-8248682: AArch64: Use ATTRIBUTE_ALIGNED helper
    + JDK-8248816: C1: Fix signature conflict in
    LIRGenerator::strength_reduce_multiply
    + JDK-8249095: tools/javac/launcher/SourceLauncherTest.java
    fails on Windows
    + JDK-8249548: backward focus traversal gets stuck in button
    group
    + JDK-8249773: Upgrade ReceiveISA.java test to be resilient to
    failure due to stray packets and interference
    + JDK-8249897: jdk/javadoc/tool/LangVers.java uses @ignore w/o
    bug-id
    + JDK-8249898: jdk/javadoc/tool/6176978/T6176978.java uses
    @ignore w/o bug-id
    + JDK-8249899: jdk/javadoc/tool/InlineTagsWithBraces.java uses
    @ignore w/o bug-id
    + JDK-8250588: Shenandoah: LRB needs to save/restore fp
    registers for runtime call
    + JDK-8250824: AArch64: follow up for JDK-8248414
    + JDK-8251166: Add automated testcases for changes done in
    JDK-8214112
    + JDK-8251252: Add automated testcase for fix done in
    JDK-8214253
    + JDK-8251254: Add automated test for fix done in JDK-8218472
    + JDK-8251361: Potential race between Logger configuration and
    GCs in HttpURLConWithProxy test
    + JDK-8251549: Update docs on building for Git
    + JDK-8251945: SIGSEGV in
    PackageEntry::purge_qualified_exports()
    + JDK-8252194: Add automated test for fix done in JDK-8218469
    + JDK-8252648: Shenandoah: name gang tasks consistently
    + JDK-8252825: Add automated test for fix done in JDK-8218479
    + JDK-8252853: AArch64: gc/shenandoah/TestVerifyJCStress.java
    fails intermittently with C1
    + JDK-8252857: AArch64: Shenandoah C1 CAS is not sequentially
    consistent
    + JDK-8253048: AArch64: When CallLeaf, no need to preserve
    callee-saved registers in caller
    + JDK-8253424: Add support for running pre-submit testing using
    GitHub Actions
    + JDK-8253631: Remove unimplemented CompileBroker methods after
    JEP-165
    + JDK-8253865: Pre-submit testing using GitHub Actions does not
    detect failures reliably
    + JDK-8253899: Make IsClassUnloadingEnabled signature match
    specification
    + JDK-8254024: Enhance native libs for AWT and Swing to work
    with GraalVM Native Image
    + JDK-8254054: Pre-submit testing using GitHub Actions should
    not use the deprecated set-env command
    + JDK-8254173: Add Zero, Minimal hotspot targets to submit
    workflow
    + JDK-8254175: Build no-pch configuration in debug mode for
    submit checks
    + JDK-8254244: Some code emitted by TemplateTable::branch is
    unused when running TieredCompilation
    + JDK-8254270: linux 32 bit build doesn't compile
    libjdwp/log_messages.c
    + JDK-8254282: Add Linux x86_32 builds to submit workflow
    + JDK-8254850: Update terminology in java.awt.GridBagLayout
    source code comments
    + JDK-8255255: Update Apache Santuario (XML Signature) to
    version 2.2.1
    + JDK-8255305: Add Linux x86_32 tier1 to submit workflow
    + JDK-8255352: Archive important test outputs in submit workflow
    + JDK-8255373: Submit workflow artifact name is always
    "test-results_.zip"
    + JDK-8255452: Doing GC during JVMTI MethodExit event posting
    breaks return oop
    + JDK-8255718: Zero: VM should know it runs in interpreter-only
    mode
    + JDK-8255790: GTKL&amp;F: Java 16 crashes on initialising GTKL&amp;F
    on Manjaro Linux
    + JDK-8255810: Zero: build fails without JVMTI
    + JDK-8255895: Submit workflow artifacts miss hs_errs/replays
    due to ZIP include mismatch
    + JDK-8256127: Add cross-compiled foreign architectures builds
    to submit workflow
    + JDK-8256215: Shenandoah: re-organize saving/restoring machine
    state in assembler code
    + JDK-8256267: Relax compiler/floatingpoint/NaNTest.java for
    x86_32 and lower -XX:+UseSSE
    + JDK-8256277: Github Action build on macOS should define OS
    and Xcode versions
    + JDK-8256354: Github Action build on Windows should define OS
    and MSVC versions
    + JDK-8256393: Github Actions build on Linux should define OS
    and GCC versions
    + JDK-8256414: add optimized build to submit workflow
    + JDK-8256747: GitHub Actions: decouple the hotspot build-only
    jobs from Linux x64 testing
    + JDK-8257056: Submit workflow should apt-get update to avoid
    package installation errors
    + JDK-8257148: Remove obsolete code in AWTView.m
    + JDK-8257497: Update keytool to create AKID from the SKID of
    the issuing certificate as specified by RFC 5280
    + JDK-8257620: Do not use objc_msgSend_stret to get macOS
    version
    + JDK-8257913: Add more known library locations to simplify
    Linux cross-compilation
    + JDK-8258703: Incorrect 512-bit vector registers restore on
    x86_32
    + JDK-8259338: Add expiry exception for identrustdstx3 alias to
    VerifyCACerts.java test
    + JDK-8259535: ECDSA SignatureValue do not always have the
    specified length
    + JDK-8259679: GitHub actions should use MSVC 14.28
    + JDK-8259924: GitHub actions fail on Linux x86_32 with "Could
    not configure libc6:i386"
    + JDK-8260460: GitHub actions still fail on Linux x86_32 with
    "Could not configure libc6:i386"
    + JDK-8260589: Crash in JfrTraceIdLoadBarrier::load(_jclass*)
    + JDK-8260923: Add more tests for SSLSocket input/output
    shutdown
    + JDK-8261072: AArch64: Fix MacroAssembler::get_thread
    convention
    + JDK-8261147: C2: Node is wrongly marked as reduction
    resulting in a wrong execution due to wrong vector instructions
    + JDK-8261238: NMT should not limit baselining by size threshold
    + JDK-8261496: Shenandoah: reconsider pacing updates memory
    ordering
    + JDK-8261652: Remove some dead comments from os_bsd_x86
    + JDK-8261846: [JVMCI] c2v_iterateFrames can get out of sync
    with the StackFrameStream
    + JDK-8262000: jdk/jfr/event/gc/detailed/
    /TestPromotionFailedEventWithParallelScavenge.java failed with
    "OutOfMemoryError: Java heap space"
    + JDK-8262017: C2: assert(n != __null) failed: Bad immediate
    dominator info.
    + JDK-8262392: Update Mesa 3-D Headers to version 21.0.3
    + JDK-8262409: sun/security/ssl/SSLSocketImpl/
    /SSLSocketImplThrowsWrongExceptions. SSL test failures caused
    by java failed with "Server reported the wrong exception"
    + JDK-8262470: Printed GlyphVector outline with low DPI has bad
    quality on Windows
    + JDK-8262862: Harden tests sun/security/x509/URICertStore/
    /ExtensionsWithLDAP.java and krb5/canonicalize/Test.java
    + JDK-8263136: C4530 was reported from VS 2019 at access bridge
    + JDK-8263227: C2: inconsistent spilling due to dead nodes in
    exception block
    + JDK-8263382: java/util/logging/ParentLoggersTest.java failed
    with "checkLoggers: getLoggerNames() returned unexpected
    loggers"
    + JDK-8263407: SPARC64 detection fails on Athena (SPARC64-X)
    + JDK-8263432: javac may report an invalid package/class clash
    on case insensitive filesystems
    + JDK-8263490: [macos] Crash occurs on JPasswordField with
    activated InputMethod
    + JDK-8263531: Remove unused buffer int
    + JDK-8263667: Avoid running GitHub actions on branches named
    pr/*
    + JDK-8263776: [JVMCI] add helper to perform Java upcalls
    + JDK-8264016: [JVMCI] add some thread local fields for use by
    JVMCI
    + JDK-8264752: SIGFPE crash with option
    FlightRecorderOptions:threadbuffersize=30M
    + JDK-8265132: C2 compilation fails with assert "missing
    precedence edge"
    + JDK-8265231: (fc) ReadDirect and WriteDirect tests fail after
    fix for JDK-8264821
    + JDK-8265335: Epsilon: Minor typo in EpsilonElasticTLABDecay
    description
    + JDK-8265756: AArch64: initialize memory allocated for locals
    according to Windows AArch64 stack page growth requirement in
    template interpreter
    + JDK-8265761: Font with missed font family name is not
    properly printed on Windows
    + JDK-8265773: incorrect jdeps message "jdk8internals" to
    describe a removed JDK internal API
    + JDK-8265836: OperatingSystemImpl.getCpuLoad() returns
    incorrect CPU load inside a container
    + JDK-8266018: Shenandoah: fix an incorrect assert
    + JDK-8266206: Build failure after JDK-8264752 with older GCCs
    + JDK-8266248: Compilation failure in
    PLATFORM_API_MacOSX_MidiUtils.c with Xcode 12.5
    + JDK-8266288: assert root method not found in
    witnessed_reabstraction_in_supers is too strong
    + JDK-8266404: Fatal error report generated with
  - XX:+CrashOnOutOfMemoryError should not contain suggestion to
    submit a bug report
    + JDK-8266480: Implicit null check optimization does not update
    control of hoisted memory operation
    + JDK-8266615: C2 incorrectly folds subtype checks involving an
    interface array
    + JDK-8266642: Improve ResolvedMethodTable hash function
    + JDK-8266749: AArch64: Backtracing broken on PAC enabled
    systems
    + JDK-8266761: AssertionError in
    sun.net.httpserver.ServerImpl.responseCompleted
    + JDK-8266813: Shenandoah: Use shorter instruction sequence for
    checking if marking in progress
    + JDK-8267042: bug in monitor locking/unlocking on ARM32 C1 due
    to uninitialized BasicObjectLock::_displaced_header
    + JDK-8267348: Rewrite gc/epsilon/TestClasses.java to use
    Metaspace with less classes
    + JDK-8267396: Avoid recording "pc" in unhandled oops detector
    for better performance
    + JDK-8267399: C2: java/text/Normalizer/ConformanceTest.java
    test failed with assertion
    + JDK-8267424: CTW: C1 fails with "State must not be null"
    + JDK-8267459: Pasting Unicode characters into JShell does not
    work.
    + JDK-8267625: AARCH64: typo in LIR_Assembler::emit_profile_type
    + JDK-8267666: Add option to jcmd GC.heap_dump to use existing
    file
    + JDK-8267695: Bump update version for OpenJDK: jdk-11.0.13
    + JDK-8267751: (test) jtreg.SkippedException has no serial
    VersionUID
    + JDK-8267773: PhaseStringOpts::int_stringSize doesn't handle
    min_jint correctly
    + JDK-8268103: JNI functions incorrectly return a double after
    JDK-8265836
    + JDK-8268127: Shenandoah: Heap size may be too small for
    region to align to large page size
    + JDK-8268261: C2: assert(n != __null) failed: Bad immediate
    dominator info.
    + JDK-8268347: C2: nested locks optimization may create
    unbalanced monitor enter/exit code
    + JDK-8268360: Missing check for infinite loop during node
    placement
    + JDK-8268362: [REDO] C2 crash when compile negative
    Arrays.copyOf length after loop
    + JDK-8268366: Incorrect calculation of has_fpu_registers in C1
    linear scan
    + JDK-8268369: SIGSEGV in PhaseCFG::implicit_null_check due to
    missing null check
    + JDK-8268417: Add test from JDK-8268360
    + JDK-8268427: Improve AlgorithmConstraints:checkAlgorithm
    performance
    + JDK-8268617: [11u REDO] - WebSocket over authenticating proxy
    fails with NPE
    + JDK-8268620: InfiniteLoopException test may fail on x86
    platforms
    + JDK-8268635: Corrupt oop in ClassLoaderData
    + JDK-8268699: Shenandoah: Add test for JDK-8268127
    + JDK-8268771: javadoc -notimestamp option does not work on
    index.html
    + JDK-8268775: Password is being converted to String in
    AccessibleJPasswordField
    + JDK-8268776: Test `ADatagramSocket.java` missing /othervm
    from @run tag
    + JDK-8268965: TCP Connection Reset when connecting simple
    socket to SSL server
    + JDK-8269304: Regression ~5% in 2005 in b27
    + JDK-8269415: [11u] Remove ea from
    DEFAULT_PROMOTED_VERSION_PRE in OpenJDK 11u
    + JDK-8269478: Shenandoah: gc/shenandoah/mxbeans tests should
    be more resilient
    + JDK-8269529: javax/swing/reliability/
    /HangDuringStaticInitialization.java fails in Windows debug
    build
    + JDK-8269594: assert(_handle_mark_nesting &gt; 1) failed: memory
    leak: allocating handle outside HandleMark
    + JDK-8269614: [s390] Interpreter checks wrong bit for slow
    path instance allocation
    + JDK-8269650: Optimize gc-locker in
    [Get|Release]StringCritical for latin string
    + JDK-8269661: JNI_GetStringCritical does not lock char array
    + JDK-8269668: [aarch64] java.library.path not including
    /usr/lib64
    + JDK-8269763: The JEditorPane is blank after JDK-8265167
    + JDK-8269795: C2: Out of bounds array load floats above its
    range check in loop peeling resulting in SEGV
    + JDK-8269847: JDK-8269594 backport breaks 11u builds
    + JDK-8269850: Most JDK releases report macOS version 12 as
    10.16 instead of 12.0
    + JDK-8269851: OperatingSystemMXBean getProcessCpuLoad reports
    incorrect process cpu usage in containers
    + JDK-8269882: stack-use-after-scope in NewObjectA
    + JDK-8269934: RunThese24H.java failed with
    EXCEPTION_ACCESS_VIOLATION in
    java_lang_Thread::get_thread_status
    + JDK-8270096: Shenandoah: Optimize gc/shenandoah/
    /TestRefprocSanity.java for interpreter mode
    + JDK-8270137: Kerberos Credential Retrieval from Cache not
    Working in Cross-Realm Setup
    + JDK-8270184: [TESTBUG] Add coverage for jvmci
    ResolvedJavaType.toJavaName() for lambdas
    + JDK-8270196: [11u] [JVMCI] JavaType.toJavaName() returns
    incorrect type name for lambdas
    + JDK-8270556: Exclude security/infra/java/security/cert/
    /CertPathValidator/certification/LetsEncryptCA
    + JDK-8270893: IndexOutOfBoundsException while reading large
    TIFF file
    + JDK-8272078: Wrong Checksums in Temurin BootJDK dependencies
    + JDK-8272124: Cgroup v1 initialization causes
    NullPointerException when cgroup path contains colon
    + JDK-8272131: PhaseMacroExpand::generate_slow_arraycopy crash
    when clone null CallProjections.fallthrough_ioproj
    + JDK-8272197: Update 11u GHA workflow with Shenandoah
    configurations
    + JDK-8272332: --with-harfbuzz=system doesn't add -lharfbuzz
    after JDK-8255790
    + JDK-8272472: StackGuardPages test doesn't build with glibc
    2.34
    + JDK-8272602: [macos] not all KEY_PRESSED events sent when
    control modifier is used
    + JDK-8272628: Problemlist gc/stress/gcbasher/
    /TestGCBasherWithCMS.java for x86_32
    + JDK-8272700: [macos] Build failure with Xcode 13.0 after
    JDK-8264848
    + JDK-8272772: Shenandoah: compiler/c2/aarch64/
    /TestVolatilesShenandoah.java fails in 11u
    + JDK-8273939: Backport of 8248414 to JDK11 breaks
    MacroAssembler::adrp
- Remove the unneeded icedtea-sound provider
- Removed patches:
  * icedtea-sound-1.0.1-jdk9.patch
  * icedtea-sound-soundproperties.patch
    + not needed since the icedtea-sound provider is removed
  * jdk11-glibc234.patch
    + integrated upstream</changelog>
  <changelog author="fstrba@suse.com" date="1635940800">- Modified patches:
  * system-crypto-policy.patch
    + rediff to changed context
  * fips.patch
    + Allow plain key import in fips mode unless
    com.suse.fips.plainKeySupport is set to false</changelog>
  <changelog author="fstrba@suse.com" date="1636113600">- Modified patch:
  * fips.patch
    + return in native code after generating java.io.IOException</changelog>
</package>
<package pkgid="82417ea51721a50275d4aed47c2516767f61c5f16dbdf6f2c7a22a7cc83b41cb" name="java-11-openjdk" arch="ppc64le">
  <version epoch="0" ver="11.0.13.0" rel="3.68.1"/>
  <changelog author="fstrba@suse.com" date="1586952000">- The pack200 and unpack200 alternatives should be slaves of java
  and not of javac, since they are part of JRE.</changelog>
  <changelog author="fstrba@suse.com" date="1587470400">- Update to upstream tag jdk-11.0.7+10 (April 2020 CPU,
  bsc#1169511)
  * Security fixes:
    + S8223898, CVE-2020-2754: Forward references to Nashorn
    + S8223904, CVE-2020-2755: Improve Nashorn matching
    + S8224541, CVE-2020-2756: Better mapping of serial ENUMs
    + S8224549, CVE-2020-2757: Less Blocking Array Queues
    + S8225603: Enhancement for big integers
    + S8226346: Build better binary builders
    + S8227467: Better class method invocations
    + S8227542: Manifest improved jar headers
    + S8229733: TLS message handling improvements
    + S8231415, CVE-2020-2773: Better signatures in XML
    + S8231785: Improved socket permissions
    + S8232424, CVE-2020-2778: More constrained algorithms
    + S8232581, CVE-2020-2767: Improve TLS verification
    + S8233250: Better X11 rendering
    + S8233410: Better Build Scripting
    + S8234027: Better JCEKS key support
    + S8234408, CVE-2020-2781: Improve TLS session handling
    + S8234825, CVE-2020-2800: Better Headings for HTTP Servers
    + S8234841, CVE-2020-2803: Enhance buffering of byte buffers
    + S8235274, CVE-2020-2805: Enhance typing of methods
    + S8235691, CVE-2020-2816: Enhance TLS connectivity
    + S8236201, CVE-2020-2830: Better Scanner conversions
    + S8238960: linux-i586 builds are inconsistent as the newly
    built jdk is not able to reserve enough space for object heap
  * Other changes:
    + S4919790: Errors in alert ssl message does not reflect the
    actual certificate status
    + S4949105: Access Bridge lacks html tags parsing
    + S7092821: java.security.Provider.getService() is synchronized
    and became scalability bottleneck
    + S7143743: Potential memory leak with zip provider
    + S8005819: Support cross-realm MSSFU
    + S8042383: [TEST_BUG] Test javax/swing/plaf/basic/BasicMenuUI/
    /4983388/bug4983388.java fails with shortcuts on menus do not
    work
    + S8068184: Fix for JDK-8032832 caused a deadlock
    + S8145845: [AOT] NullPointerException in
    compiler/whitebox/GetCodeHeapEntriesTest.java
    + S8152988: [AOT] Update test batch definitions to include
    aot-ed java.base module mode into hs-comp testing
    + S8160926: FLAGS_COMPILER_CHECK_ARGUMENTS doesn't handle
    cross-compilation
    + S8163083: SocketListeningConnector does not allow invocations
    with port 0
    + S8163251: Hard coded loop limit prevents reading of smart
    card data greater than 8k
    + S8167276: jvmci/compilerToVM/MaterializeVirtualObjectTest.java
    fails with -XX:-EliminateAllocations
    + S8169718: nsk/jdb/locals/locals002: ERROR: Cannot find
    boolVar with expected value: false
    + S8176556:
    java/awt/dnd/ImageTransferTest/ImageTransferTest.java fails
    for JFIF
    + S8178798: Two compiler/aot/verification/vmflags tests fail by
    timeout with UseAVX=3
    + S8183107: PKCS11 regression regarding checkKeySize
    + S8185005: Improve performance of
    ThreadMXBean.getThreadInfo(long ids[], int maxDepth)
    + S8189633: Missing -Xcheck:jni checking for DeleteWeakGlobalRef
    + S8189861: Refactor CacheFind
    + S8193042: NativeLookup::lookup_critical_entry() should only
    load shared library once
    + S8193596: java/net/DatagramPacket/ReuseBuf.java failed due to
    timeout
    + S8194944: Regression automated test 'open/test/jdk/javax/
    /swing/JInternalFrame/8145896/TestJInternalFrameMaximize.java'
    fails
    + S8196467: javax/swing/JInternalFrame/Test6325652.java fails
    + S8196969: JTreg Failure: serviceability/sa/ClhsdbJstack.java
    causes NPE
    + S8198321: javax/swing/JEditorPane/5076514/bug5076514.java
    fails
    + S8198398: Test javax/swing/JColorChooser/Test6199676.java
    fails in mach5
    + S8199072: Test javax/swing/GroupLayout/6613904/
    /bug6613904.java is unstable
    + S8200432: javadoc fails with ClassCastException on {@link
    byte[]}
    + S8201349: build broken when configured with
  - -with-zlib=bundled on gcc 7.3
    + S8201355: Avoid native memory allocation in
    sun.security.mscapi.PRNG.generateSeed
    + S8201513: nsk/jvmti/IterateThroughHeap/filter-* are broken
    + S8203364: Some serviceability/sa/ tests intermittently fail
    with java.io.IOException: LingeredApp terminated with non-zero
    exit code 3
    + S8203687: javax/net/ssl/compatibility/Compatibility.java
    supports TLS 1.3
    + S8203904: javax/swing/JSplitPane/4816114/bug4816114.java: The
    divider location is wrong
    + S8203911: Test runtime/modules/getModuleJNI/GetModule fails
    with -Xcheck:jni
    + S8204525: [TESTBUG] runtime/NMT/MallocStressTest.java ran out
    of java heap
    + S8204529: gc/TestAllocateHeapAtMultiple.java fail with Agent
    7 timed out
    + S8204551: Event descriptions are truncated in logs
    + S8206963: [AOT] bug with multiple class loaders
    + S8207367: 10 vmTestbase/nsk/jdi tests timed out when running
    with jtreg
    + S8207832: serviceability/sa/ClhsdbCDSCore.java failed with
    "Couldn't find core file location"
    + S8207938: At step6,Click Add button,case failed automatically.
    + S8208157: requires.VMProps throws NPE for missing properties
    in "release" file
    + S8208379: compiler/jvmci/events/
    /JvmciNotifyInstallEventTest.java failed with "Got unexpected
    event count after 2nd install attempt: expected 9 to equal 2"
    + S8208658: Make CDS archived heap regions usable even if
    compressed oop encoding has changed
    + S8208715: Conversion of milliseconds to nanoseconds in
    UNIXProcess contains bug
    + S8209361: [AOT] Unexpected number of references for
    JVMTI_HEAP_REFERENCE_CONSTANT_POOL [111--&gt;111]: 0 (expected
    at least 1)
    + S8209385: CDS runtime classpath checking is too strict when
    only classes from the system modules are archived
    + S8209389: SIGSEGV in WalkOopAndArchiveClosure::do_oop_work.
    + S8209418: Synchronize test/jdk/sanity/client/lib/jemmy with
    code-tools/jemmy/v2
    + S8209494: Create a test for SwingSet InternalFrameDemo
    + S8209499: Create test for SwingSet EditorPaneDemo
    + S8209574: [AOT] breakpoint events are generated in different
    threads does not meet expected count
    + S8209686: cleanup arguments to PhaseIdealLoop() constructor
    + S8209789: Synchronize test/jdk/sanity/client/lib/jemmy with
    code-tools/jemmy/v2
    + S8209802: Garbage collectors should register JFR types
    themselves to avoid build errors.
    + S8209807: improve handling exception in requires.VMProps
    + S8209817: stack is executable when building with Clang on
    Linux
    + S8209824: Improve the code coverage for ThreadLocal
    + S8209826: Undefined reference to os::write after JDK-8209657
    (filemap.hpp cleanup)
    + S8209850: Allow NamedThreads to use GlobalCounter critical
    sections
    + S8209976: Improve iteration over non-JavaThreads
    + S8209993: Create a test for SwingSet3 ToolTipDemo
    + S8210024: JFR calls virtual is_Java_thread from ~Thread()
    + S8210052: Enable testing for all the available look and feels
    in SwingSet3 demo tests
    + S8210055: Enable different look and feel tests in SwingSet3
    demo tests
    + S8210057: Enable different look and feels in SwingSet3 demo
    test InternalFrameDemoTest
    + S8210058: Algorithmic Italic font leans opposite angle in
    Printing
    + S8210220: [AOT] jdwp test cases are failing with error #
    ERROR: TEST FAILED: Cought IOException while receiving event
    packet
    + S8210289: ArchivedKlassSubGraphInfoRecord is incomplete
    + S8210459: Add support for generating compile_commands.json
    + S8210476: sun/security/mscapi/PrngSlow.java fails with Still
    too slow
    + S8210512: [Testbug] vmTestbase/nsk/jdi/ObjectReference/
    /referringObjects/referringObjects002/referringObjects002.java
    fails with unexpected size of
    ClassLoaderReference.referringObjects
    + S8210523: runtime/appcds/cacheObject/DifferentHeapSizes.java
    crash
    + S8210632: Add key exchange algorithm to
    javax/net/ssl/TLSCommon/CipherSuite.java
    + S8210699: Problem list tests which times out in Xcomp mode
    + S8210793: [JVMCI] AllocateCompileIdTest.java failed to find
    DiagnosticCommand.class
    + S8210910: Create test for FileChooserDemo
    + S8210994: Create test for SwingSet3 FrameDemo
    + S8211139: Increase timeout value in all tests under
    jdk/sanity/client/SwingSet/src
    + S8211160: Handle different look and feels in
    JInternalFrameOperator
    + S8211211: vmTestbase/metaspace/stressDictionary/
    /StressDictionary.java timeout
    + S8211322: Reduce the timeout of tooltip in SwingSet2DemoTest
    + S8211443: Enable different look and feels in SwingSet3 demo
    test SplitPaneDemoTest
    + S8211703: JInternalFrame : java.lang.AssertionError: cannot
    find the internal frame
    + S8211781: re-building fails after changing Graal sources
    + S8212897: Some improvements in the EditorPaneDemotest
    + S8212903: [TestBug] Tests test/jdk/javax/swing/LookAndFeel/
    /8145547/DemandGTK2.sh and DemandGTK3.sh fail on Ubuntu 18.04
    LTS
    + S8213009: Refactoring existing SunMSCAPI classes
    + S8213010: Supporting keys created with certmgr.exe
    + S8213168: Enable different look and feel tests in SwingSet3
    demo test FileChooserDemoTest
    + S8213348: jdk.internal.vm.compiler.management service
    providers missing in module descriptor
    + S8213906: Update arm devkits with libXrandr headers
    + S8213908: AssertionError in DeferredAttr at setOverloadKind
    + S8214124: [TESTBUG] Bugs in runtime/NMT/MallocStressTest.java
    + S8214344: C2: assert(con.basic_type() != T_ILLEGAL) failed:
    elembt=byte; loadbt=void; unsigned=0
    + S8214345: infinite recursion while checking super class
    + S8214471: Enable different look and feel tests in SwingSet3
    demo test ToolTipDemoTest
    + S8214534: Setting of THIS_FILE in the build is broken
    + S8214557: Filter out VM flags which don't affect AOT code
    generation
    + S8214578: [macos] Problem with backslashes on macOS/JIS
    keyboard: Java ignores system settings
    + S8214840: runtime/NMT/MallocStressTest.java timed out
    + S8214850: Rename vm_operations.?pp files to vmOperations.?pp
    files
    + S8214904: Test8004741.java failed due to "Too few ThreadDeath
    hits; expected at least 6 but saw only 5"
    + S8215322: add @file support to jaotc
    + S8215355: Object monitor deadlock with no threads holding the
    monitor (using jemalloc 5.1)
    + S8215396: JTabbedPane preferred size calculation is wrong for
    SCROLL_TAB_LAYOUT
    + S8216180: [AOT] compiler/intrinsics/bigInteger/TestMulAdd.java
    crashed with AOT enabled
    + S8216353: Use utility APIs introduced in org/netbeans/jemmy/
    /util/LookAndFeel class in client sanity test cases
    + S8216354: Syntax error in toolchain_windows.m4
    + S8216472: (se) Stack overflow during selection operation
    leads to crash (win)
    + S8216535: tools/jimage/JImageExtractTest.java timed out
    + S8217235: Create automated test for SwingSet
    ColorChooserDemoTest
    + S8217297: Add support for multiple look and feel for SwingSet
    SliderDemoTest
    + S8217338: [Containers] Improve systemd slice memory limit
    support
    + S8217613: [AOT] TEST_OPTS_AOT_MODULES doesn't work on mac
    + S8217634: RunTest documentation and usability update
    + S8217717: ZGC: Broken oop map in C1 load barrier stub
    + S8217728: Speed up incremental rerun of "make hotspot"
    + S8218268: Javac treats Manifest Class-Path entries as Paths
    instead of URLs
    + S8218662: Allow 204 responses with Content-Length:0
    + S8218882: NET_Writev is declared, NET_WriteV is defined
    + S8218889: Improperly use of the Optional API
    + S8219205: JFR file without license header
    + S8219597: (bf) Heap buffer state changes could provoke
    unexpected exceptions
    + S8219723: javax/net/ssl/compatibility/Compatibility.java
    failed on some SNI cases
    + S8220348: [ntintel] asserts about copying unaligned array
    + S8220451: jdi/EventQueue/remove/remove004 failed due to
    "ERROR: thread2 is not alive"
    + S8220456: jdi/EventQueue/remove_l/remove_l004 failed due to
    "TIMEOUT while waiting for event"
    + S8220479: java/nio/channels/Selector/SelectWithConsumer.java
    failed at testTwoChannels()
    + S8220613: java/util/Arrays/TimSortStackSize2.java times out
    with fastdebug build
    + S8220688: [TESTBUG] runtime/NMT/MallocStressTest.java timed
    out
    + S8220786: Create new switch to redirect error reporting
    output to stdout or stderr
    + S8221270: Duplicated synchronized keywords in SSLSocketImpl
    + S8221312: test/jdk/sanity/client/SwingSet/src/
    /ColorChooserDemoTest.java failed
    + S8221851: Use of THIS_FILE in hotspot invalidates precompiled
    header on Linux/GCC
    + S8221885: Add intermittent test in the JavaSound to the
    ProblemList
    + S8222264: Windows incremental build is broken with JDK-8217728
    + S8222391: javax/net/ssl/compatibility/Compatibility.java
    should be more flexible
    + S8222448: java/lang/reflect/PublicMethods/
    /PublicMethodsTest.java times out
    + S8222519: ButtonDemoScreenshotTest fails randomly with "still
    state to be reached"
    + S8222741: jdi/EventQueue/remove/remove004 fails due to
    VMDisconnectedException
    + S8223003: SunMSCAPI keys are not cleaned up
    + S8223063: Support CNG RSA keys
    + S8223158: Docked MacBook cannot start any Java Swing
    applications
    + S8223260: NamingManager should cache InitialContextFactory
    + S8223464: Improve version string for Oracle CI builds
    + S8223558: Java does not render Myanmar script correctly
    + S8223627: jdk-13+20 bundle name contains null instead of ea
    + S8223638: Replace wildcard address with loopback or local
    host in tests - part 6
    + S8223678: Add Visual Studio Code workspace generation support
    (for native code)
    + S8223727: com/sun/jndi/ldap/privconn/RunTest.java failed due
    to hang in LdapRequest.getReplyBer
    + S8223769: Assert triggers with -XX:+StressReflectiveCode
    + S8224187: Refactor arraycopy_prologue to allow ZGC read
    barriers on arraycopy
    + S8224475: JTextPane does not show images in HTML rendering
    + S8224673: Adjust permission for delayed starting of debugging
    + S8224705: Tests that need to be problem-listed or have
    printer resources
    + S8224778: test/jdk/demo/jfc/J2Ddemo/J2DdemoTest.java cannot
    find J2Ddemo.jar
    + S8224821: java/awt/Focus/NoAutotransferToDisabledCompTest/
    /NoAutotransferToDisabledCompTest.java fails linux-x64
    + S8224830: test/jdk/java/awt/Focus/
    /ModalExcludedWindowClickTest/
    /ModalExcludedWindowClickTest.java fails on linux-x64
    + S8224851: AArch64: fix warnings and errors with Clang and GCC
    8.3
    + S8224905: java/lang/ProcessBuilder/Basic.java#id1 failed with
    stream closed
    + S8225007: java/awt/print/PrinterJob/
    /LandscapeStackOverflow.java may hang
    + S8225105: java/awt/Focus/ShowFrameCheckForegroundTest/
    /ShowFrameCheckForegroundTest.java fails in Windows 10
    + S8225117: java/math/BigInteger/SymmetricRangeTests.java fails
    with ParseException
    + S8225128: Add exception for expiring DocuSign root to
    VerifyCACerts test
    + S8225130: Add exception for expiring Comodo roots to
    VerifyCACerts test
    + S8225144: [macos] In Aqua L&amp;F backspace key does not delete
    when Shift is pressed
    + S8225180: SignedObject with invalid Key not throwing the
    InvalidKeyException in Windows
    + S8225182: JNI exception pending in DestroyXIMCallback of
    awt_InputMethod.c:1327
    + S8225199: [Graal] compiler/jvmci/compilerToVM/
    /IsMatureVsReprofileTest.java fails with
  - XX:CompileThresholdScaling=0.1
    + S8225305: ProblemList java/lang/invoke/VarHandles tests
    + S8225350: compiler/jvmci/compilerToVM/IsCompilableTest.java
    timed out
    + S8225430: Replace wildcard address with loopback or local
    host in tests - part 14
    + S8225435: Upgrade IANA Language Subtag Registry to the latest
    for JDK14
    + S8225487: giflib legal file is missing attribution for
    openbsd-reallocarray.c
    + S8225567: Wrong file headers with 8202414 fix changeset
    + S8225684: [AOT] vmTestbase/vm/oom/production/
    /AlwaysOOMProduction tests fail with AOTed java.base
    + S8225766: Curve in certificate should not affect signature
    scheme when using TLSv1.3
    + S8225797: OldObjectSample event creates unexpected amount of
    checkpoint data
    + S8226381: ProblemList java/lang/reflect/PublicMethods/
    /PublicMethodsTest.java
    + S8226406: JVM fails to detect mismatched or corrupt CDS
    archive
    + S8226608: Hide the onjcmd option from the help output
    + S8226892: ActionListeners on JRadioButtons don't get notified
    when selection is changed with arrow keys
    + S8227112: exclude compiler/intrinsics/sha/sanity tests from
    AOT runs
    + S8227324: Upgrade to freetype 2.10.1
    + S8227528: TestAbortVMOnSafepointTimeout.java failed due to
    "RuntimeException: 'Safepoint sync time longer than' missing
    from stdout/stderr"
    + S8227645: Some tests in serviceability/sa run with fixed -Xmx
    values and risk running out of memory
    + S8227646: [TESTBUG] appcds/SharedArchiveConsistency timed out
    + S8227662: freetype seeks to index at the end of the font data
    + S8228479: Correct the format of ColorChooserDemoTest
    + S8228613: java.security.Provider#getServices order is no
    longer deterministic
    + S8228969: 2019-09-28 public suffix list update
    + S8229236: CriticalJNINatives: dll handling should be done in
    native thread state
    + S8229345: Memory leak due to vtable stubs not being shared on
    SPARC
    + S8229888: (zipfs) Updating an existing zip file does not
    preserve original permissions
    + S8229994: assert(false) failed: Bad graph detected in
    get_early_ctrl_for_expensive
    + S8230004: jdk/internal/jimage/JImageOpenTest.java runs no test
    + S8230235: Rendering HTML with empty img attribute and
    documentBaseKey cause Exception
    + S8230390: Problemlist SA tests with AOT
    + S8230400: Missing constant pool entry for a method in
    stacktrace
    + S8230459: Test failed to resume JVMCI CompilerThread
    + S8230480: check malloc/calloc results in java.desktop
    + S8230597: Update GIFlib library to the 5.2.1
    + S8230611: infinite loop in
    LogOutputList::wait_until_no_readers()
    + S8230624: [TESTBUG] Problemlist JFR
    compiler/TestCodeSweeper.java
    + S8230677: Should disable Escape Analysis if JVMTI capability
    can_get_owned_monitor_info was taken
    + S8230926: [macosx] Two apostrophes are entered instead of one
    with "U.S. International - PC" layout
    + S8231025: Incorrect method tag offset for big endian platform
    + S8231081: TestMetadataRetention fails due to missing symbol id
    + S8231387: java.security.Provider.getService returns random
    result due to race condition with mutating methods in the same
    class
    + S8231430: C2: Memory stomp in max_array_length() for
    T_ILLEGAL type
    + S8231445: check ZALLOC return values in awt coding
    + S8231507: Update Apache Santuario (XML Signature) to version
    2.1.4
    + S8231584: Deadlock with ClassLoader.findLibrary and
    System.loadLibrary call
    + S8231753: use more Posix functionality in aix
    os::print_os_info
    + S8231810: javax/net/ssl/templates/
    /SSLSocketSSLEngineTemplate.java fails intermittently with
    "java.lang.Exception: Unexpected EOF"
    + S8232003: (fs) Files.write can leak file descriptor in the
    exception case
    + S8232056: GetOwnedMonitorInfoWithEATest.java fails with ZGC:
    Heap too small
    + S8232060: add some initializations using sigemptyset in
    os_aix.cpp
    + S8232154: Update Mesa 3-D Headers to version 19.2.1
    + S8232167: Visual Studio install found through
  - -with-tools-dir value is discarded
    + S8232170: FSInfo#getJarClassPath throws an exception not
    declared in its throws clause
    + S8232200: [macos 10.15] Windows in fullscreen tests jumps
    around the screen
    + S8232207: Linux os::available_memory re-reads cgroup
    configuration on every invocation
    + S8232224: [TESTBUG] problemlist JFR TestLargeRootSet.java
    + S8232370: Refactor some com.sun.jdi tests to enable IDE
    integration
    + S8232433: [macos 10.15] java/awt/Window/
    /LocationAtScreenCorner/LocationAtScreenCorner.java may fail
    + S8232571: Add missing SIGINFO signal
    + S8232692: [TESTBUG] compiler/aot/fingerprint/
    /SelfChangedCDS.java fails when cds is disabled
    + S8232713: Update BCEL version to 6.3.1 in license file
    + S8232806: Introduce a system property to disable eager lambda
    initialization
    + S8232834: RunTest sometimes fails to produce valid
    exitcode.txt
    + S8232880: Update test documentation with additional settings
    for client UI tooltip tests
    + S8232950: SUNPKCS11 Provider incorrectly check key length for
    PSS Signatures.
    + S8233018: Add a new test to verify that DatagramSocket is not
    interruptible
    + S8233019: java.lang.Class.isPrimitive() (C1) returns wrong
    result if Klass* is aligned to 32bit
    + S8233032: assert(in_bb(n)) failed: must be
    + S8233078: fix minimal VM build on Linux ppc64(le)
    + S8233328: fix minimal VM build on Linux s390x
    + S8233383: Various minor fixes
    + S8233466: aarch64: remove unnecessary load of mdo when
    profiling return and parameters type
    + S8233491: Crash in AdapterHandlerLibrary::get_adapter with
    CDS due to code cache exhaustion
    + S8233529: loopTransform.cpp:2984: Error: assert(p_f-&gt;Opcode()
    == Op_IfFalse) failed
    + S8233548: Update CUP to v0.11b
    + S8233649: Update ProblemList.txt to exclude failing headful
    tests on macos
    + S8233656: assert(d-&gt;is_CFG() &amp;&amp; n-&gt;is_CFG()) failed: must
    have CFG nodes
    + S8233657: Intermittent NPE in Component.validate()
    + S8234288: Turkey Time Zone returns incorrect time zone name
    + S8234323: NULL-check return value of SurfaceData_InitOps on
    macosx
    + S8234339: replace JLI_StrTok in java_md_solinux.c
    + S8234340: Bump update version for OpenJDK: jdk-11.0.7
    + S8234350: assert(mode == ControlAroundStripMined &amp;&amp; (use ==
    sfpt || !use-&gt;is_reachable_from_root())) failed: missed a node
    + S8234386: [macos] NPE was thrown at expanding Choice from
    maximized frame
    + S8234397: add OS uptime information to os::print_os_info
    output
    + S8234423: Modifying ArrayList.subList().subList() resets
    modCount of subList
    + S8234466: Class loading deadlock involving
    X509Factory#commitEvent()
    + S8234501: remove obsolete NET_ReadV
    + S8234525: enable link-time section-gc for linux s390x to
    remove unused code
    + S8234610: MaxVectorSize set wrongly when UseAVX=3 is
    specified after JDK-8221092
    + S8234617: C1: Incorrect result of field load due to missing
    narrowing conversion
    + S8234723: javax/net/ssl/TLS tests support TLSv1.3
    + S8234724: javax/net/ssl/templates/
    /SSLSocketSSLEngineTemplate.java supports TLSv1.3
    + S8234741: enhance os::get_core_path on macOS
    + S8234769: Duplicate attribution in freetype.md
    + S8234786: Fix for JDK-8214578 breaks OS X 10.12 compatibility
    + S8234809: set relro in linker flags when building with gcc
    + S8234824: java/nio/channels/SocketChannel/AdaptSocket.java
    fails on Windows 10
    + S8235243: handle VS2017 15.9 and VS2019 in abstract_vm_version
    + S8235288: AVX 512 instructions inadvertently used on Xeon for
    small vector width operations
    + S8235325: build failure on Linux after 8235243
    + S8235383: C1 compilation fails with
  - XX:+PrintIRDuringConstruction -XX:+Verbose
    + S8235489: handle return values of sscanf calls in hotspot
    + S8235509: Backport for JDK-8209657 Refactor filemap.hpp to
    simplify integration with Serviceability Agent.
    + S8235510: java.util.zip.CRC32 performance drop after 8200067
    + S8235563: [TESTBUG] appcds/CommandLineFlagComboNegative.java
    does not handle archive mapping failure
    + S8235637: jhsdb jmap from OpenJDK 11.0.5 doesn't work if
    prelink is enabled
    + S8235671: enhance print_rlimit_info in os_posix
    + S8235744: PIT: test/jdk/javax/swing/text/html/
    /TestJLabelWithHTMLText.java times out in linux-x64
    + S8235904: Infinite loop when rendering huge lines
    + S8235998: [c2] Memory leaks during tracing after '8224193:
    stringStream should not use Resource Area'.
    + S8236039: JSSE Client does not accept status_request
    extension in CertificateRequest messages for TLS 1.3
    + S8236140: assert(!VerifyHashTableKeys || _hash_lock == 0)
    failed: remove node from hash table before modifying it
    + S8236179: C1 register allocation error with T_ADDRESS
    + S8236488: Support for configure option
  - -with-native-debug-symbols=internal is impossible on Windows
    + S8236500: Windows ucrt.dll should be looked up in versioned
    WINSDK subdirectory
    + S8236709: struct SwitchRange in HS violates C++ One
    Definition Rule
    + S8236848: [JDK 11u] make run-test-tier1 fails after backport
    of JDK-8232834
    + S8236873: Worker has a deadlock bug
    + S8237217: Incorrect G1StringDedupEntry type used in
    StringDedupTable destructor
    + S8237368: Problem with NullPointerException in RMI
    TCPEndpoint.read
    + S8237375: SimpleThresholdPolicy misses CounterDecay timestamp
    initialization
    + S8237508: Simplify JarFile.isInitializing
    + S8237540: Missing files in backport of JDK-8210910
    + S8237541: Missing files in backport of JDK-8236528
    + S8237600: Test SunJSSEFIPSInit fails on Ubuntu
    + S8237819: s390x - remove unused pd_zero_to_words_large
    + S8237869: exclude jtreg test security/infra/java/security/
    /cert/CertPathValidator/certification/LuxTrustCA.java because
    of instabilities
    + S8237879: make 4.3 breaks build
    + S8237945: CTW: C2 compilation fails with
    assert(just_allocated_object(alloc_ctl) == ptr) failed: most
    recent allo...
    + S8238225: Issues reported after replacing symlink at
    Contents/MacOS/libjli.dylib with binary
    + S8238247: CTW runner should sweep nmethods more aggressively
    + S8238366: CTW runner closes standard output on exit
    + S8238438: SuperWord::co_locate_pack picks memory state of
    first instead of last load
    + S8238502: sunmscapi.dll causing EXCEPTION_ACCESS_VIOLATION
    + S8238534: Deep sign macOS bundles before bundle archive is
    being created
    + S8238591: CTW: Split
    applications/ctw/modules/jdk_localedata.java
    + S8238596: AVX enabled by default for Skylake even when
    unsupported
    + S8238811: C2: assert(i &gt;= req() || i == 0 || is_Region() ||
    is_Phi()) with -XX:+VerifyGraphEdges
    + S8239005: [TESTBUG] test/hotspot/jtreg/runtime/
    /StackGuardPages/TestStackGuardPages.java: exeinvoke.c: must
    initialize static state before calling do_overflow()
    + S8239466: Loss of precision in counter decay calculation in
    11u backport of JDK-8237375
    + S8239856: [ntintel] asserts about copying unaligned array
    element
    + S8240724: [test] jdk11 downport of 8224475 misses binary file
    test/jdk/javax/swing/JTextPane/arrow.png
    + S8241296: Segfault in JNIHandleBlock::oops_do()
- Removed patch:
  * DependOnVariableHelper.patch
    + fixed upstream
- Added patch:
  * JDK-8228407.patch
    + fix crashes due to shared archive file mismatch</changelog>
  <changelog author="fstrba@suse.com" date="1594900800">- Update to upstream tag jdk-11.0.8+10 (July 2020 CPU, bsc#1174157)
  * Security fixes:
    + JDK-8230613: Better ASCII conversions
    + JDK-8231800: Better listing of arrays
    + JDK-8232014: Expand DTD support
    + JDK-8233234: Better Zip Naming
    + JDK-8233239, CVE-2020-14562: Enhance TIFF support
    + JDK-8233255: Better Swing Buttons
    + JDK-8234032: Improve basic calendar services
    + JDK-8234042: Better factory production of certificates
    + JDK-8234418: Better parsing with CertificateFactory
    + JDK-8234836: Improve serialization handling
    + JDK-8236191: Enhance OID processing
    + JDK-8236867, CVE-2020-14573: Enhance Graal interface handling
    + JDK-8237117, CVE-2020-14556: Better ForkJoinPool behavior
    + JDK-8237592, CVE-2020-14577: Enhance certificate verification
    + JDK-8238002, CVE-2020-14581: Better matrix operations
    + JDK-8238013: Enhance String writing
    + JDK-8238804: Enhance key handling process
    + JDK-8238842: AIOOBE in GIFImageReader.initializeStringTable
    + JDK-8238843: Enhanced font handing
    + JDK-8238920, CVE-2020-14583: Better Buffer support
    + JDK-8238925: Enhance WAV file playback
    + JDK-8240119, CVE-2020-14593: Less Affine Transformations
    + JDK-8240482: Improved WAV file playback
    + JDK-8241379: Update JCEKS support
    + JDK-8241522: Manifest improved jar headers redux
    + JDK-8242136, CVE-2020-14621: Better XML namespace handling
  * Other changes:
    + JDK-6933331: (d3d/ogl) java.lang.IllegalStateException:
    Buffers have not been created
    + JDK-7124307: JSpinner and changing value by mouse
    + JDK-8022574: remove HaltNode code after uncommon trap calls
    + JDK-8039082: [TEST_BUG] Test
    java/awt/dnd/BadSerializationTest/BadSerializationTest.java
    fails
    + JDK-8040630: Popup menus and tooltips flicker with previous
    popup contents when first shown
    + JDK-8044365: (dc) MulticastSendReceiveTests.java failing with
    ENOMEM when joining group (OS X 10.9)
    + JDK-8048215: [TESTBUG]
    java/lang/management/ManagementFactory/ThreadMXBeanProxy.java
    Expected non-null LockInfo
    + JDK-8051349: nsk/jvmti/scenarios/sampling/SP06/sp06t003 fails
    in nightly
    + JDK-8080353: JShell: Better error message on attempting to
    add default method
    + JDK-8139876: Exclude hanging nsk/stress/stack from execution
    with deoptimization enabled
    + JDK-8146090: java/lang/ref/ReachabilityFenceTest.java fails
    with -XX:+DeoptimizeALot
    + JDK-8153430: jdk regression test MletParserLocaleTest,
    ParserInfiniteLoopTest reduce default timeout
    + JDK-8156207: Resource allocated BitMaps are often cleared
    unnecessarily
    + JDK-8159740: JShell: corralled declarations do not have
    correct source to wrapper mapping
    + JDK-8175984: ICC_Profile has un-needed, not-empty finalize
    method
    + JDK-8176359: Frame#setMaximizedbounds not working properly in
    multi screen environments
    + JDK-8183369: RFC unconformity of HttpURLConnection with proxy
    + JDK-8187078: -XX:+VerifyOops finds numerous problems when
    running JPRT
    + JDK-8189861: Refactor CacheFind
    + JDK-8191169: java/net/Authenticator/B4769350.java failed
    intermittently
    + JDK-8191930: [Graal] emits unparseable XML into compile log
    + JDK-8193879: Java debugger hangs on method invocation
    + JDK-8196019: java/awt/Window/Grab/GrabTest.java fails on
    Windows
    + JDK-8196181: sun/java2d/GdiRendering/InsetClipping.java fails
    + JDK-8198000:
    java/awt/List/EmptyListEventTest/EmptyListEventTest.java
    debug assert on Windows
    + JDK-8198001: java/awt/Menu/WrongParentAfterRemoveMenu/
    /WrongParentAfterRemoveMenu.java debug assert on Windows
    + JDK-8198339: Test javax/swing/border/Test6981576.java is
    unstable
    + JDK-8200701: jdk/jshell/ExceptionsTest.java fails on Windows,
    after JDK-8198801
    + JDK-8203264: JNI exception pending in
    PlainDatagramSocketImpl.c:740
    + JDK-8203672: JNI exception pending in PlainSocketImpl.c
    + JDK-8203673: JNI exception pending in
    DualStackPlainDatagramSocketImpl.c:398
    + JDK-8204834: Fix confusing "allocate" naming in OopStorage
    + JDK-8205399: Set node color on pinned HashMap.TreeNode
    deletion
    + JDK-8205653: test/jdk/sun/management/jmxremote/bootstrap/
    /RmiRegistrySslTest.java and RmiSslBootstrapTest.sh fail with
    handshake_failure
    + JDK-8206179: com/sun/management/OperatingSystemMXBean/
    /GetCommittedVirtualMemorySize.java fails with Committed
    virtual memory size illegal value
    + JDK-8207334: VM times out in VM_HandshakeAllThreads::doit()
    with RunThese30M
    + JDK-8208277: Code cache heap (-XX:ReservedCodeCacheSize)
    doesn't work with 1GB LargePages
    + JDK-8209113: Use WeakReference for lastFontStrike for created
    Fonts
    + JDK-8209333: Socket reset issue for TLS 1.3 socket close
    + JDK-8209439: C2 library_call can potentially ignore Math.pow
    intrinsic or use null pointer
    + JDK-8209534: [TESTBUG]runtime/appcds/cacheObject/
    /ArchivedModuleCompareTest.java fails with EnableJVMCI.
    + JDK-8210147: adjust some WSAGetLastError usages in windows
    network coding
    + JDK-8210284: "assert((av &amp; 0x00000001) == 0) failed:
    unsupported V8" on Solaris 11.4
    + JDK-8210303: VM_HandshakeAllThreads fails assert with
    "failed: blocked and not walkable"
    + JDK-8210459: Add support for generating compile_commands.json
    + JDK-8210515: [TESTBUG]CheckArchivedModuleApp.java needs to
    check if EnableJVMCI is set.
    + JDK-8210788: Javadoc for Thread.join(long, int) should
    specify that it waits forever when both arguments are zero
    + JDK-8211301: [macos] support full window content options
    + JDK-8211332: Space for stub routines (code_size2) is too
    small on new Skylake CPUs
    + JDK-8211339: NPE during SSL handshake caused by
    HostnameChecker
    + JDK-8211392: compiler/profiling/
    /spectrapredefineclass_classloaders/Launcher.java times out
    in JDK12 CI
    + JDK-8211743: [AOT] crash in ScopeDesc::decode_body() when
    JVMTI walks AOT frames
    + JDK-8212154: [TESTBUG] CheckArchivedModuleApp fails with NPE
    when JVMCI is absent
    + JDK-8212167: JShell : Stack trace of exception has wrong line
    number
    + JDK-8212933: Thread-SMR: requesting a VM operation whilst
    holding a ThreadsListHandle can cause deadlocks
    + JDK-8212986: Make Visual Studio compiler check less strict
    + JDK-8213250: CDS archive creation aborts due to metaspace
    object allocation failure
    + JDK-8213516: jck test api/javax_accessibility/AccessibleState/
    /fields.html fails intermittent
    + JDK-8213947: ARM32: failed check_simd should set
    UsePopCountInstruction to false
    + JDK-8214418: half-closed SSLEngine status may cause
    application dead loop
    + JDK-8214440: ldap over a TLS connection negotiate failed with
    "javax.net.ssl.SSLPeerUnverifiedException: hostname of the
    server does not match the hostname in the server's
    certificate"
    + JDK-8214444: Wrong strncat limits in dfa.cpp
    + JDK-8214481: freetype path does not disable TrueType hinting
    with AA+FM hints
    + JDK-8214571: -Xdoclint of array serialField gives "error:
    array type not allowed here"
    + JDK-8214856: Errors with JSZip in web console after upgrade
    to 3.1.5
    + JDK-8214862: assert(proj != __null) at compile.cpp:3251
    + JDK-8215369: Jcstress pollute /var/tmp with temporary files.
    + JDK-8215551: Missing case label in nmethod::reloc_string_for()
    + JDK-8215555: TieredCompilation C2 threads can excessively
    block handshakes
    + JDK-8215711: Missing key_share extension for (EC)DHE key
    exchange should alert missing_extension
    + JDK-8216151: [Graal] Module
    jdk.internal.vm.compiler.management has not been granted
    accessClassInPackage.org.graalvm.compiler.debug
    + JDK-8216154: C4819 warnings at HotSpot sources on Windows
    + JDK-8216541: CompiledICHolders of VM locked unloaded nmethods
    are released too late
    + JDK-8217230: assert(t == t_no_spec) failure in
    NodeHash::check_no_speculative_types()
    + JDK-8217404: --with-jvm-features doesn't work when multiple
    features are explicitly disabled
    + JDK-8217447: Develop flag TraceICs is broken
    + JDK-8217606: LdapContext#reconnect always opens a new
    connection
    + JDK-8218807: Compilation database (compile_commands.json) may
    contain obsolete items
    + JDK-8219214: Infinite Loop in CodeSection::dump()
    + JDK-8219904: ClassCastException when calling
    FlightRecorderMXBean#getRecordings()
    + JDK-8219991: New fix of the deadlock in
    sun.security.ssl.SSLSocketImpl
    + JDK-8221121: applications/microbenchmarks are encountering
    crashes in tier5
    + JDK-8221445: FastSysexMessage constructor crashes MIDI
    receiption thread
    + JDK-8221482: Initialize VMRegImpl::regName[] earlier to
    prevent assert during PrintStubCode
    + JDK-8221741: ClassCastException can happen when
    fontconfig.properties is used
    + JDK-8221823: Requested JDialog width is ignored
    + JDK-8223108: Test java/awt/EventQueue/
    /NonComponentSourcePost.java is unstable
    + JDK-8223678: Add Visual Studio Code workspace generation
    support (for native code)
    + JDK-8223935: PIT: java/awt/font/WindowsIndicFonts.java fails
    on windows10
    + JDK-8224109: Text spaced incorrectly by drawString under
    rotation with fractional metric
    + JDK-8224632: testbug: java/awt/dnd/RemoveDropTargetCrashTest/
    /RemoveDropTargetCrashTest.java fails on MacOS
    + JDK-8224793: os::die() does not honor CreateCoredumpOnCrash
    option
    + JDK-8224847: gc/stress/TestReclaimStringsLeaksMemory.java
    fails with reserved greater than expected
    + JDK-8224931: disable JAOTC invokedynamic support until
    8223533 is fixed
    + JDK-8224997: ChaCha20-Poly1305 TLS cipher suite decryption
    throws ShortBufferException
    + JDK-8225068: Remove DocuSign root certificate that is
    expiring in May 2020
    + JDK-8225069: Remove Comodo root certificate that is expiring
    in May 2020
    + JDK-8225126: Test SetBoundsPaintTest.html faild on Windows
    when desktop is scaled
    + JDK-8225325: Add tests for redefining a class' private method
    during resolution of the bootstrap specifier
    + JDK-8225622: [AOT] runtime/SharedArchiveFile/
    /TestInterpreterMethodEntries.java crashed with AOTed
    java.base
    + JDK-8225653: Provide more information when hitting SIGILL
    from HaltNode
    + JDK-8225783: Incorrect use of binary operators on booleans in
    type.cpp
    + JDK-8225789: Empty method parameter type should generate
    ClassFormatError
    + JDK-8226198: use of &amp; instead of &amp;&amp; in
    LibraryCallKit::arraycopy_restore_alloc_state
    + JDK-8226253: JAWS reports wrong number of radio buttons when
    buttons are hidden.
    + JDK-8226653: [accessibility] Can edit text cell correctly,
    but Accessibility Tool reads nothing about editor
    + JDK-8226806: [macOS 10.14] Methods of Java Robot should be
    called from appropriate thread
    + JDK-8226879: Memory leak in Type::hashcons
    + JDK-8227632: Incorrect PrintCompilation message: made not
    compilable on levels 0 1 2 3 4
    + JDK-8228407: JVM crashes with shared archive file mismatch
    + JDK-8228482: fix xlc16/xlclang comparison of distinct pointer
    types and string literal conversion warnings
    + JDK-8228757: Fail fast if the handshake type is unknown
    + JDK-8229158: make UseSwitchProfiling non-experimental or
    false by-default
    + JDK-8229421: The logic of java/net/ipv6tests/TcpTest.java is
    flawed
    + JDK-8229855: C2 fails with assert(false) failed: bad AD file
    + JDK-8230591: AArch64: Missing intrinsics for Math.ceil,
    floor, rint
    + JDK-8231118: ARM32: Math tests failures
    + JDK-8231213: Migrate SimpleDateFormatConstTest to JDK Repo
    + JDK-8231243: [TESTBUG] CustomFont.java cannot find font file
    + JDK-8231438: [macOS] Dark mode for the desktop is not
    supported
    + JDK-8231550: C2: ShouldNotReachHere() in
    verify_strip_mined_scheduling
    + JDK-8231564: setMaximizedBounds is broken with large display
    scale and multiple monitors
    + JDK-8231572: Use -lobjc instead of -fobjc-link-runtime in
    libosxsecurity
    + JDK-8231631: sun/net/ftp/FtpURLConnectionLeak.java fails
    intermittently with NPE
    + JDK-8231671: Fix copyright headers in hotspot (missing comma
    after year)
    + JDK-8231720: Some perf regressions after 8225653
    + JDK-8231779: crash
    HeapWord*ParallelScavengeHeap::failed_mem_allocate
    + JDK-8231863: Crash if classpath is read from @argument file
    and the main gets option argument
    + JDK-8232080: jlink plugins for vendor information and
    run-time options
    + JDK-8232106: [x86] C2: SIGILL due to usage of SSSE3
    instructions on processors which don't support it
    + JDK-8232134: Change to Visual Studio 2017 15.9.16 for
    building on Windows at Oracle
    + JDK-8232226: [macos 10.15] test/jdk/java/awt/color/
    /EqualityTest/EqualityTest.java may fail
    + JDK-8232357: Compare version info of Santuario to legal notice
    + JDK-8232572: Add hooks for custom output dir in Bundles.gmk
    + JDK-8232634: Problem List ICMColorDataTest.java
    + JDK-8232748: Build static versions of certain JDK libraries
    + JDK-8232846: ProcessHandle.Info command with non-English
    shows question marks
    + JDK-8232880: Update test documentation with additional
    settings for client UI tooltip tests
    + JDK-8233033: C2 produces wrong result while unswitching a
    loop due to lost control dependencies
    + JDK-8233137: runtime/ErrorHandling/VeryEarlyAssertTest.java
    fails after 8232080
    + JDK-8233197: Invert JvmtiExport::post_vm_initialized() and
    Jfr:on_vm_start() start-up order for correct option parsing
    + JDK-8233291: [TESTBUG] tools/jlink/plugins/
    /VendorInfoPluginsTest.java fails with debug or non-server VMs
    + JDK-8233364: Fix undefined behavior in
    Canonicalizer::do_ShiftOp
    + JDK-8233494: Avoid calling MallocTracker::record_malloc and
    record_free when NMT is off
    + JDK-8233573: Toolkit.getScreenInsets(GraphicsConfiguration)
    may throw ClassCastException
    + JDK-8233608: Minimal build broken after JDK-8233494
    + JDK-8233621: Mismatch in jsse.enableMFLNExtension property
    name
    + JDK-8233696: [TESTBUG]Some jtreg tests fail when CAPS_LOCK is
    ON
    + JDK-8233707: systemScale.cpp could not compile with VS2019
    + JDK-8233801: GCMEmptyIv.java test fails on Solaris 11.4
    + JDK-8233880: Support compilers with multi-digit major version
    numbers
    + JDK-8233920: MethodHandles::tryFinally generates illegal
    bytecode for long/double return type
    + JDK-8234137: The "AutoTestOnTop.java" test may run external
    applications
    + JDK-8234146: compiler/jsr292/
    /ContinuousCallSiteTargetChange.java times out on SPARC
    + JDK-8234184: [TESTBUG] java/awt/Mouse/EnterExitEvents/
    /ModalDialogEnterExitEventsTest.java fails in Windows
    + JDK-8234270: [REDO] JDK-8204128 NMT might report incorrect
    numbers for Compiler area
    + JDK-8234332: [TESTBUG] java/awt/Focus/DisposedWindow/
    /DisposeDialogNotActivateOwnerTest/
    /DisposeDialogNotActivateOwnerTest.java fails on linux-x64
    nightly
    + JDK-8234398: Replace ID2D1Factory::GetDesktopDpi with
    GetDeviceCaps
    + JDK-8234522: [macos] Crash with use of native file dialog
    + JDK-8234691: Potential double-free in ParallelSPCleanupTask
    constructor
    + JDK-8234696: tools/jlink/plugins/VendorInfoPluginsTest.java
    times out
    + JDK-8234727: sun/security/ssl/X509TrustManagerImpl tests
    support TLSv1.3
    + JDK-8234728: Some security tests should support TLSv1.3
    + JDK-8234779: Provide idiom for declaring classes noncopyable
    + JDK-8234824: java/nio/channels/SocketChannel/AdaptSocket.java
    fails on Windows 10
    + JDK-8234968: check calloc rv in libinstrument
    InvocationAdapter
    + JDK-8235153: [TESTBUG] [macos 10.15] java/awt/Graphics/
    /DrawImageBG/SystemBgColorTest.java fails
    + JDK-8235183: Remove the "HACK CODE" in comment
    + JDK-8235263: Revert TLS 1.3 change that wrapped IOExceptions
    + JDK-8235311: Tag mismatch may alert bad_record_mac
    + JDK-8235332: TestInstanceCloneAsLoadsStores.java fails with
  - XX:+StressGCM
    + JDK-8235452: Strip mined loop verification fails with
    assert(is_OuterStripMinedLoop()) failed: invalid node class
    + JDK-8235584: UseProfiledLoopPredicate fails with
    assert(_phase-&gt;get_loop(c) == loop) failed: have to be in the
    same loop
    + JDK-8235620: Broken merge between JDK-8006406 and JDK-8003559
    + JDK-8235638: NPE in LWWindowPeer.getOnscreenGraphics()
    + JDK-8235686: Add more custom hooks in Bundles.gmk
    + JDK-8235739: Rare NPE at WComponentPeer.getGraphics()
    + JDK-8235762: JVM crash in SWPointer during C2 compilation
    + JDK-8235834: IBM-943 charset encoder needs updating
    + JDK-8235874: The ordering of Cipher Suites is not maintained
    provided through jdk.tls.client.cipherSuites and
    jdk.tls.server.cipherSuites system property.
    + JDK-8235908: omit ThreadPriorityPolicy warning when value is
    set from image
    + JDK-8235984: C2: assert(out-&gt;in(PhiNode::Region) == head ||
    out-&gt;in(PhiNode::Region) == slow_head) failed: phi must be
    either part of the slow or the fast loop
    + JDK-8236211: [Graal] compiler/graalunit/GraphTest.java is
    skipped in all testing
    + JDK-8236470: Deal with ECDSA using ecdsa-with-SHA2 plus hash
    algorithm as AlgorithmId
    + JDK-8236545: Compilation error in mach5
    java/awt/FileDialog/MacOSGoToFolderCrash.java
    + JDK-8236700: Upgrading JSZip from v3.1.5 to v3.2.2
    + JDK-8236759: ShouldNotReachHere in
    PhaseIdealLoop::verify_strip_mined_scheduling
    + JDK-8236897: Fix the copyright header for pkcs11gcm2.h
    + JDK-8236921: Add build target to produce a JDK image suitable
    for a Graal/SVM build
    + JDK-8236953: [macos] JavaFX SwingNode is not rendered on macOS
    + JDK-8236996: Incorrect Roboto font rendering on Windows with
    subpixel antialiasing
    + JDK-8237045: JVM uses excessive memory with -XX:+EnableJVMCI
  - XX:JVMCICounterSize=2147483648
    + JDK-8237055: [TESTBUG] compiler/c2/TestJumpTable.java fails
    with release VMs
    + JDK-8237086: assert(is_MachReturn()) running CTW with fix for
    JDK-8231291
    + JDK-8237192: Generate stripped/public pdbs on Windows for jdk
    images
    + JDK-8237396: JvmtiTagMap::weak_oops_do() should not trigger
    barriers
    + JDK-8237474: Default SSLEngine should create in server role
    + JDK-8237859: C2: Crash when loads float above range check
    + JDK-8237879: make 4.3 breaks build
    + JDK-8237951: CTW: C2 compilation fails with "malformed
    control flow"
    + JDK-8237962: give better error output for invalid OCSP
    response intervals in CertPathValidator checks
    + JDK-8238190: [JVMCI] Fix single implementor speculation for
    diamond shapes.
    + JDK-8238356: CodeHeap::blob_count() overestimates the number
    of blobs
    + JDK-8238452: Keytool generates wrong expiration date if
    validity is set to 2050/01/01
    + JDK-8238555: Allow Initialization of SunPKCS11 with NSS when
    there are external FIPS modules in the NSSDB
    + JDK-8238575: DragSourceEvent.getLocation() returns wrong
    value on HiDPI screens (Windows)
    + JDK-8238676: jni crashes on accessing it from process exit
    hook
    + JDK-8238721: Add failing client jtreg tests to the Problem
    List
    + JDK-8238738: AudioSystem.getMixerInfo() takes about 30 sec to
    report a gone audio device
    + JDK-8238756: C2: assert(((n) == __null || !VerifyIterativeGVN
    || !((n)-&gt;is_dead()))) failed: can not use dead node
    + JDK-8238765: PhaseCFG::schedule_pinned_nodes cannot handle
    precedence edges from unmatched CFG nodes correctly
    + JDK-8238898: Missing hash characters for header on license
    file
    + JDK-8238942: Rendering artifacts with LCD text and fractional
    metrics
    + JDK-8238985: [TESTBUG] The arrow image is blue instead of
    green
    + JDK-8239000: handle ContendedPaddingWidth in vm_version_ppc
    + JDK-8239055: Wrong implementation of VMState.hasListener
    + JDK-8239091: Reversed arguments in call to strstr in freetype
    "debug" code.
    + JDK-8239142: C2's UseUniqueSubclasses optimization is broken
    for array accesses
    + JDK-8239224: libproc_impl.c previous_thr may be used
    uninitialized warning
    + JDK-8239351: Give more meaningful InternalError messages in
    Deflater.c
    + JDK-8239365: ProcessBuilder test modifications for AIX
    execution
    + JDK-8239456: vtable stub generation: assert failure (code
    size estimate)
    + JDK-8239457: call ReleaseStringUTFChars before early returns
    in Java_sun_security_pkcs11_wrapper_PKCS11_connect
    + JDK-8239462: jdk.hotspot.agent misses some
    ReleaseStringUTFChars calls in case of early returns
    + JDK-8239557: [TESTBUG] VeryEarlyAssertTest.java validating
    "END." marker at lastline is not always true
    + JDK-8239787: AArch64: String.indexOf may incorrectly handle
    empty strings
    + JDK-8239792: Bump update version for OpenJDK: jdk-11.0.8
    + JDK-8239798: SSLSocket closes socket both socket endpoints on
    a SocketTimeoutException
    + JDK-8239819: XToolkit: Misread of screen information memory
    + JDK-8239852: java/util/concurrent tests fail with
  - XX:+VerifyGraphEdges: assert(!VerifyGraphEdges) failed:
    verification should have failed
    + JDK-8239893: Windows handle Leak when starting processes
    using ProcessBuilder
    + JDK-8239915: Zero VM crashes when handling dynamic constant
    + JDK-8239931: [win][x86] vtable stub generation: assert
    failure (code size estimate) follow-up
    + JDK-8239965: XMLEncoder/Test4625418.java fails due to "Error:
    Cp943 - can't read properly"
    + JDK-8239976: Put JDK-8239965 on the ProblemList.txt
    + JDK-8240073: Fix 'test-make' build target in 11u
    + JDK-8240197: Cannot start JVM when $JAVA_HOME includes CJK
    characters
    + JDK-8240202: A few client tests leave mouse buttons pressed
    + JDK-8240220: IdealLoopTree::dump_head predicate printing is
    broken
    + JDK-8240223: Use consistent predicate order in and with
    PhaseIdealLoop::find_predicate
    + JDK-8240227: Loop predicates should be copied to unswitched
    loops
    + JDK-8240286: [TESTBUG] Test command error in hotspot/jtreg/
    /compiler/loopopts/superword/SumRedAbsNeg_Float.java
    + JDK-8240518: Incorrect JNU_ReleaseStringPlatformChars in
    Windows Print
    + JDK-8240529: CheckUnhandledOops breaks NULL check in
    Modules::define_module
    + JDK-8240576: JVM crashes after transformation in C2
    IdealLoopTree::merge_many_backedges
    + JDK-8240603: Windows 32bit compile error after 8238676
    + JDK-8240629: argfiles parsing broken for argfiles with
    comment cross 4096 bytes chunk
    + JDK-8240711: TestJstatdPort.java failed due to
    "ExportException: Port already in use:"
    + JDK-8240786: [TESTBUG] The test java/awt/Window/
    /GetScreenLocation/GetScreenLocationTest.java fails on HiDPI
    screen
    + JDK-8240824: enhance print_full_memory_info on Linux by THP
    related information
    + JDK-8240827: Downport SSLSocketImpl.java from "8221882: Use
    fiber-friendly java.util.concurrent.locks in JSSE"
    + JDK-8240905: assert(mem == (Node*)1 || mem == mem2) failed:
    multiple Memories being matched at once?
    + JDK-8240972: macOS codesign fail on macOS 10.13.5 or older
    + JDK-8241445: Fix copyright in
    test/jdk/tools/launcher/ArgFileSyntax.java
    + JDK-8241458: [JVMCI] add mark value to expose
    CodeOffsets::Frame_Complete
    + JDK-8241464: [11u] Backport: make rehashing be a needed
    guaranteed safepoint cleanup action
    + JDK-8241556: Memory leak if -XX:CompileCommand is set
    + JDK-8241568: (fs) UserPrincipalLookupService.lookupXXX
    failure with IOE "Operation not permitted"
    + JDK-8241586: compiler/cpuflags/
    /TestAESIntrinsicsOnUnsupportedConfig.java fails on aarch64
    + JDK-8241638: launcher time metrics always report 1 on Linux
    when _JAVA_LAUNCHER_DEBUG set
    + JDK-8241660: Add virtualization information output to hs_err
    file on macOS
    + JDK-8241808: [TESTBUG] The JDK-8039467 bug appeared on macOS
    + JDK-8241888: Mirror jdk.security.allowNonCaAnchor system
    property with a security one
    + JDK-8241900: Loop unswitching may cause dependence on null
    check to be lost
    + JDK-8241948: enhance list of environment variables printed in
    hs_err file
    + JDK-8241996: on linux set full relro in the linker flags
    + JDK-8242108: Performance regression after fix for JDK-8229496
    + JDK-8242141: New System Properties to configure the TLS
    signature schemes
    + JDK-8242154: Backport parts of JDK-4947890 to OpenJDK 11u
    + JDK-8242174: [macos] The NestedModelessDialogTest test make
    the macOS unstable
    + JDK-8242239: [Graal] javax/management/generified/
    /GenericTest.java fails: FAILED: queryMBeans sets same
    + JDK-8242294: JSSE Client does not throw SSLException when an
    alert occurs during handshaking
    + JDK-8242379: [TESTBUG] compiler/loopopts/
    /TestLoopUnswitchingLostCastDependency.java fails with
    release VMs
    + JDK-8242470: Update Xerces to Version 2.12.1
    + JDK-8242498: Invalid "sun.awt.TimedWindowEvent" object leads
    to JVM crash
    + JDK-8242541: Small charset issues (ISO8859-16, x-eucJP-Open,
    x-IBM834 and x-IBM949C)
    + JDK-8242626: enhance posix print_rlimit_info
    + JDK-8243059: Build fails when --with-vendor-name contains a
    comma
    + JDK-8243539: Copyright info (Year) should be updated for fix
    of 8241638
    + JDK-8243541: (tz) Upgrade time-zone data to tzdata2020a
    + JDK-8244407: JVM crashes after transformation in C2
    IdealLoopTree::split_fall_in
    + JDK-8244520: problemlist
    java/awt/font/Rotate/RotatedFontTest.java on linux
    + JDK-8244777: ClassLoaderStats VM Op uses constant hash value
    + JDK-8244853: The static build of libextnet is missing the
    JNI_OnLoad_extnet function
    + JDK-8244951: Missing entitlements for hardened runtime
    + JDK-8245047: [PPC64] C2: ReverseBytes + Load always match to
    unordered Load (acquire semantics missing)
    + JDK-8245649: Revert 8245397 backport of 8230591
    + JDK-8246031: SSLSocket.getSession() doesn't close connection
    for timeout/ interrupts
    + JDK-8246613: Choose the default SecureRandom algo based on
    registration ordering
    + JDK-8248505: Unexpected NoSuchAlgorithmException when using
    secure random impl from BCFIPS provider
- Removed patch:
  * JDK-8228407.patch
    + integrated upstream</changelog>
  <changelog author="fstrba@suse.com" date="1604318400">- Update to upstream tag jdk-11.0.9-11 (October 2020 CPU,
  bsc#1177943)
  * New features
    + JDK-8250784: Shenandoah: A Low-Pause-Time Garbage Collector
  * Security fixes
    + JDK-8233624: Enhance JNI linkage
    + JDK-8236196: Improve string pooling
    + JDK-8236862, CVE-2020-14779: Enhance support of Proxy class
    + JDK-8237990, CVE-2020-14781: Enhanced LDAP contexts
    + JDK-8237995, CVE-2020-14782: Enhance certificate processing
    + JDK-8240124: Better VM Interning
    + JDK-8241114, CVE-2020-14792: Better range handling
    + JDK-8242680, CVE-2020-14796: Improved URI Support
    + JDK-8242685, CVE-2020-14797: Better Path Validation
    + JDK-8242695, CVE-2020-14798: Enhanced buffer support
    + JDK-8243302: Advanced class supports
    + JDK-8244136, CVE-2020-14803: Improved Buffer supports
    + JDK-8244479: Further constrain certificates
    + JDK-8244955: Additional Fix for JDK-8240124
    + JDK-8245407: Enhance zoning of times
    + JDK-8245412: Better class definitions
    + JDK-8245417: Improve certificate chain handling
    + JDK-8248574: Improve jpeg processing
    + JDK-8249927: Specify limits of jdk.serialProxyInterfaceLimit
    + JDK-8253019: Enhanced JPEG decoding
  * Other changes
    + JDK-6532025: GIF reader throws misleading exception with
    truncated images
    + JDK-6949753: [TEST BUG]: java/awt/print/PageFormat/
    /PDialogTest.java needs update by removing an infinite loop
    + JDK-8022535: [TEST BUG] javax/swing/text/html/parser/
    /Test8017492.java fails
    + JDK-8062947: Fix exception message to correctly represent
    LDAP connection failure
    + JDK-8067354: com/sun/jdi/GetLocalVariables4Test.sh failed
    + JDK-8134599: TEST_BUG: java/rmi/transport/closeServerSocket/
    /CloseServerSocket.java fails intermittently with Address
    already in use
    + JDK-8151678: com/sun/jndi/ldap/LdapTimeoutTest.java failed
    due to timeout on DeadServerNoTimeoutTest is incorrect
    + JDK-8160768: Add capability to custom resolve host/domain
    names within the default JNDI LDAP provider
    + JDK-8172404: Tools should warn if weak algorithms are used
    before restricting them
    + JDK-8193367: Annotated type variable bounds crash javac
    + JDK-8202117: com/sun/jndi/ldap/RemoveNamingListenerTest.java
    fails intermittently: Connection reset
    + JDK-8203026: java.rmi.NoSuchObjectException: no such object
    in table
    + JDK-8203281: [Windows] JComboBox change in ui when
    editor.setBorder() is called
    + JDK-8203382: Rename SystemDictionary::initialize_wk_klass to
    resolve_wk_klass
    + JDK-8203393: com/sun/jdi/JdbMethodExitTest.sh and
    JdbExprTest.sh fail due to timeout
    + JDK-8203928: [Test] Convert non-JDB scaffolding
    serviceability shell script tests to java
    + JDK-8204963: javax.swing.border.TitledBorder has a memory leak
    + JDK-8204994: SA might fail to attach to process with "Windbg
    Error: WaitForEvent failed"
    + JDK-8205534: Remove SymbolTable dependency from
    serviceability agent
    + JDK-8206309: Tier1 SA tests fail
    + JDK-8208281: java/nio/channels/
    /AsynchronousSocketChannel/Basic.java timed out
    + JDK-8209109: [TEST] rewrite com/sun/jdi shell tests to java
    version - step1
    + JDK-8209332: [TEST] test/jdk/com/sun/jdi/CatchPatternTest.sh
    is incorrect
    + JDK-8209342: Problemlist SA tests on Solaris due to Error
    attaching to process: Can't create thread_db agent!
    + JDK-8209343: Test javax/swing/border/TestTitledBorderLeak.java
    should be marked as headful
    + JDK-8209517: com/sun/jdi/BreakpointWithFullGC.java fails with
    timeout
    + JDK-8209604: [TEST] rewrite com/sun/jdi shell tests to java
    version - step2
    + JDK-8209605: com/sun/jdi/BreakpointWithFullGC.java fails with
    ZGC
    + JDK-8209608: Problem list com/sun/jdi/BreakpointWithFullGC.java
    + JDK-8210131: vmTestbase/nsk/jvmti/scenarios/allocation/AP10/
    /ap10t001/TestDescription.java failed with ObjectFree:
    GetCurrentThreadCpuTimerInfo returned unexpected error code
    + JDK-8210243: [TEST] rewrite com/sun/jdi shell tests to java
    version - step3
    + JDK-8210527: JShell: NullPointerException in
    jdk.jshell.Eval.translateExceptionStack
    + JDK-8210560: [TEST] convert com/sun/jdi redefineClass-related
    tests
    + JDK-8210725: com/sun/jdi/RedefineClearBreakpoint.java fails
    with waitForPrompt timed out after 60 seconds
    + JDK-8210748: [TESTBUG] lib.jdb.Jdb.waitForPrompt() should
    clarify which output is the pending reply after a timeout
    + JDK-8210760: [TEST] rewrite com/sun/jdi shell tests to java
    version - step4
    + JDK-8210977: jdk/jfr/event/oldobject/TestThreadLocalLeak.java
    fails to find ThreadLocalObject
    + JDK-8211292: [TEST] convert com/sun/jdi/DeferredStepTest.sh
    test
    + JDK-8211694: JShell: Redeclared variable should be reset
    + JDK-8212200: assert when shared java.lang.Object is redefined
    by JVMTI agent
    + JDK-8212629: [TEST] wrong breakpoint in
    test/jdk/com/sun/jdi/DeferredStepTest
    + JDK-8212665: com/sun/jdi/DeferredStepTest.java: jj1 (line 57)
  - unexpected. lastLine=52, minLine=52, maxLine=55
    + JDK-8212807: tools/jar/multiRelease/Basic.java times out
    + JDK-8213182: Minimal VM build failure after JDK-8212200
    (assert when shared java.lang.Object is redefined by JVMTI
    agent)
    + JDK-8213214: Set -Djava.io.tmpdir= when running tests
    + JDK-8213275: ReplaceCriticalClasses.java fails with
    jdk.internal.vm.PostVMInitHook not found
    + JDK-8213574: Deadlock in string table expansion when dumping
    lots of CDS classes
    + JDK-8213703: LambdaConversionException: Invalid receiver type
    not a subtype of implementation type interface
    + JDK-8214074: Ghash optimization using AVX instructions
    + JDK-8214491: Upgrade to JLine 3.9.0
    + JDK-8214797: TestJmapCoreMetaspace.java timed out
    + JDK-8215243: JShell tests failing intermitently with
    "Problem cleaning up the following threads:"
    + JDK-8215244: jdk/jshell/ToolBasicTest.java
    testHistoryReference failed
    + JDK-8215354: x86_32 build failures after JDK-8214074 (Ghash
    optimization using AVX instructions)
    + JDK-8215438: jshell tool: Ctrl-D causes EOF
    + JDK-8216021: RunTest.gmk might set concurrency level to 1 on
    Windows
    + JDK-8216974: HttpConnection not returned to the pool after
    204 response
    + JDK-8218948: SimpleDateFormat :: format - Zone Names are not
    reflected correctly during run time
    + JDK-8219712: code_size2 (defined in stub_routines_x86.hpp) is
    too small on new Skylake CPUs
    + JDK-8220150: macos10.14 Mojave returns anti-aliased glyphs
    instead of aliased B&amp;W glyphs
    + JDK-8221658: aarch64: add necessary predicate for ubfx
    patterns
    + JDK-8221759: Crash when completing "java.io.File.path"
    + JDK-8221918: runtime/SharedArchiveFile/serviceability/
    /ReplaceCriticalClasses.java fails: Shared archive not found
    + JDK-8222074: Enhance auto vectorization for x86
    + JDK-8222079: Don't use memset to initialize fields decode_env
    constructor in disassembler.cpp
    + JDK-8222769: [TESTBUG] TestJFRNetworkEvents should not rely
    on hostname command
    + JDK-8223688: JShell: crash on the instantiation of raw
    anonymous class
    + JDK-8223777: In posix_spawn mode, failing to exec()
    jspawnhelper does not result in an error
    + JDK-8223940: Private key not supported by chosen signature
    algorithm
    + JDK-8224184: jshell got IOException at exiting with AIX
    + JDK-8224234: compiler/codegen/TestCharVect2.java fails in
    test_mulc
    + JDK-8225037: java.net.JarURLConnection::getJarEntry() throws
    NullPointerException
    + JDK-8225625: AES Electronic Codebook (ECB) encryption and
    decryption optimization using AVX512 + VAES instructions
    + JDK-8226536: Catch OOM from deopt that fails rematerializing
    objects
    + JDK-8226575: OperatingSystemMXBean should be made container
    aware
    + JDK-8226697: Several tests which need the @key headful
    keyword are missing it.
    + JDK-8226809: Circular reference in printed stack trace is not
    correctly indented &amp; ambiguous
    + JDK-8227059: sun/security/tools/keytool/
    /DefaultSignatureAlgorithm.java timed out
    + JDK-8227269: Slow class loading when running with JDWP
    + JDK-8227595: keytool/fakegen/DefaultSignatureAlgorithm.java
    fails due to "exitValue = 6"
    + JDK-8228448: Jconsole can't connect to itself
    + JDK-8228967: Trust/Key store and SSL context utilities for
    tests
    + JDK-8229378: jdwp library loader in linker_md.c quietly
    truncates on buffer overflow
    + JDK-8229815: Upgrade Jline to 3.12.1
    + JDK-8230000: some httpclients testng tests run zero test
    + JDK-8230002: javax/xml/jaxp/unittest/transform/
    /SecureProcessingTest.java runs zero test
    + JDK-8230010: Remove jdk8037819/BasicTest1.java
    + JDK-8230094: CCE in createXMLEventWriter(Result) over an
    arbitrary XMLStreamWriter
    + JDK-8230402: Allocation of compile task fails with assert:
    "Leaking compilation tasks?"
    + JDK-8230767: FlightRecorderListener returns null recording
    + JDK-8230870: (zipfs) Add a ZIP FS test that is similar to
    test/jdk/java/util/zip/EntryCount64k.java
    + JDK-8231209: [REDO] ThreadMXBean::getThreadAllocatedBytes()
    can be quicker for self thread
    + JDK-8231586: enlarge encoding space for OopMapValue offsets
    + JDK-8231953: Wrong assumption in assertion in
    oop::register_oop
    + JDK-8231968: getCurrentThreadAllocatedBytes default
    implementation s/b getThreadAllocatedBytes
    + JDK-8232083: Minimal VM is broken after JDK-8231586
    + JDK-8232161: Align some one-way conversion in MS950 charset
    with Windows
    + JDK-8232855: jshell missing word in /help help
    + JDK-8233027: OopMapSet::all_do does oms.next() twice during
    iteration
    + JDK-8233228: Disable weak named curves by default in TLS,
    CertPath, and Signed JAR
    + JDK-8233386: Initialize NULL fields for unused decorations
    + JDK-8233452: java.math.BigDecimal.sqrt() with
    RoundingMode.FLOOR results in incorrect result
    + JDK-8233686: XML transformer uses excessive amount of memory
    + JDK-8233741: AES Countermode (AES-CTR) optimization using
    AVX512 + VAES instructions
    + JDK-8233829: javac cannot find non-ASCII module name under
    non-UTF8 environment
    + JDK-8233958: Memory retention due to HttpsURLConnection
    finalizer that serves no purpose
    + JDK-8234011: (zipfs) Memory leak in
    ZipFileSystem.releaseDeflater()
    + JDK-8234058: runtime/CompressedOops/
    /CompressedClassPointers.java fails with 'Narrow klass base:
    0x0000000000000000' missing from stdout/stderr
    + JDK-8234149: Several regression tests do not dispose Frame at
    end
    + JDK-8234347: "Turkey" meta time zone does not generate
    composed localized names
    + JDK-8234385: [TESTBUG] java/awt/EventQueue/6980209/
    /bug6980209.java fails in linux nightly
    + JDK-8234535: Cross compilation fails due to missing CFLAGS
    for the BUILD_CC
    + JDK-8234541: C1 emits an empty message when it inlines
    successfully
    + JDK-8234687: change javap reporting on unknown attributes
    + JDK-8236464: SO_LINGER option is ignored by SSLSocket in JDK
    11
    + JDK-8236548: Localized time zone name inconsistency between
    English and other locales
    + JDK-8236617: jtreg test containers/docker/
    /TestMemoryAwareness.java fails after 8226575
    + JDK-8237182: Update copyright header for shenandoah and
    epsilon files
    + JDK-8237888: security/infra/java/security/cert/
    /CertPathValidator/certification/LuxTrustCA.java fails when
    checking validity interval
    + JDK-8237977: Further update
    javax/net/ssl/compatibility/Compatibility.java
    + JDK-8238270: java.net HTTP/2 client does not decrease stream
    count when receives 204 response
    + JDK-8238284: [macos] Zero VM build fails due to an obvious
    typo
    + JDK-8238380: java.base/unix/native/libjava/childproc.c
    "multiple definition" link errors with GCC10
    + JDK-8238386: (sctp) jdk.sctp/unix/native/libsctp/SctpNet.c
    "multiple definition" link errors with GCC10
    + JDK-8238388: libj2gss/NativeFunc.o "multiple definition" link
    errors with GCC10
    + JDK-8238448: RSASSA-PSS signature verification fail when
    using certain odd key sizes
    + JDK-8238710: LingeredApp doesn't log stdout/stderr if exits
    with non-zero code
    + JDK-8239083: C1 assert(known_holder == NULL ||
    (known_holder-&gt;is_instance_klass() &amp;&amp;
    (!known_holder-&gt;is_interface() ||
    ((ciInstanceKlass*)known_holder)-&gt;has_nonstatic_concrete_methods())),
    "should be non-static concrete method");
    + JDK-8239385: KerberosTicket client name refers wrongly to
    sAMAccountName in AD
    + JDK-8240169: javadoc fails to link to non-modular api docs
    + JDK-8240295: hs_err elapsed time in seconds is not accurate
    enough
    + JDK-8240360: NativeLibraryEvent has wrong library name on
    Linux
    + JDK-8240676: Meet not symmetric failure when running lucene
    on jdk8
    + JDK-8241007: Shenandoah: remove
    ShenandoahCriticalControlThreadPriority support
    + JDK-8241065: Shenandoah: remove leftover code after
    JDK-8231086
    + JDK-8241086: Test runtime/NMT/HugeArenaTracking.java is
    failing on 32bit Windows
    + JDK-8241130: com.sun.jndi.ldap.EventSupport.removeDeadNotifier:
    java.lang.NullPointerException
    + JDK-8241138: http.nonProxyHosts=* causes
    StringIndexOutOfBoundsException in DefaultProxySelector
    + JDK-8241319: WB_GetCodeBlob doesn't have ResourceMark
    + JDK-8241478: vmTestbase/gc/gctests/Steal/steal001/steal001.java
    fails with OOME
    + JDK-8241574: Shenandoah: remove ShenandoahAssertToSpaceClosure
    + JDK-8241750: x86_32 build failure after JDK-8227269
    + JDK-8242184: CRL generation error with RSASSA-PSS
    + JDK-8242283: Can't start JVM when java home path includes
    non-ASCII character
    + JDK-8242556: Cannot load RSASSA-PSS public key with non-null
    params from byte array
    + JDK-8243029: Rewrite javax/net/ssl/compatibility/
    /Compatibility.java with a flexible interop test framework
    + JDK-8243138: Enhance BaseLdapServer to support starttls
    extended request
    + JDK-8243320: Add SSL root certificates to Oracle Root CA
    program
    + JDK-8243321: Add Entrust root CA - G4 to Oracle Root CA
    program
    + JDK-8243389: enhance os::pd_print_cpu_info on linux
    + JDK-8243453: java --describe-module failed with non-ASCII
    module name under non-UTF8 environment
    + JDK-8243470: [macos] bring back O2 opt level for unsafe.cpp
    + JDK-8243489: Thread CPU Load event may contain wrong data for
    CPU time under certain conditions
    + JDK-8243925: Toolkit#getScreenInsets() returns wrong value on
    HiDPI screens (Windows)
    + JDK-8244087: 2020-04-24 public suffix list update
    + JDK-8244151: Update MUSCLE PC/SC-Lite headers to the latest
    release 1.8.26
    + JDK-8244164: AArch64: jaotc generates incorrect code for
    compressed OOPs with non-zero heap base
    + JDK-8244196: adjust output in os_linux
    + JDK-8244225: stringop-overflow warning on strncpy call from
    compile_the_world_in
    + JDK-8244287: JFR: Methods samples have line number 0
    + JDK-8244703: "platform encoding not initialized" exceptions
    with debugger, JNI
    + JDK-8244719: CTW: C2 compilation fails with
    "assert(!VerifyHashTableKeys || _hash_lock == 0) failed:
    remove node from hash table before modifying it"
    + JDK-8244729: Shenandoah: remove resolve paths from
    SBSA::generate_shenandoah_lrb
    + JDK-8244763: Update --release 8 symbol information after JSR
    337 MR3
    + JDK-8244818: Java2D Queue Flusher crash while moving
    application window to external monitor
    + JDK-8245151: jarsigner should not raise duplicate warnings on
    verification
    + JDK-8245616: Bump update version for OpenJDK: jdk-11.0.9
    + JDK-8245714: "Bad graph detected in build_loop_late" when
    loads are pinned on loop limit check uncommon branch
    + JDK-8245801: StressRecompilation triggers assert "redundunt
    OSR recompilation detected. memory leak in CodeCache!"
    + JDK-8245832: JDK build make-static-libs should build all JDK
    libraries
    + JDK-8245880: Shenandoah: check class unloading flag early in
    concurrent code root scan
    + JDK-8245981: Upgrade to jQuery 3.5.1
    + JDK-8246027: Minimal fastdebug build broken after JDK-8245801
    + JDK-8246094: [macos] Sound Recording and playback is not
    working
    + JDK-8246153: TestEliminateArrayCopy fails with
  - XX:+StressReflectiveCode
    + JDK-8246193: Possible NPE in ENC-PA-REP search in AS-REQ
    + JDK-8246196: javax/management/MBeanServer/OldMBeanServerTest
    fails with AssertionError
    + JDK-8246203: Segmentation fault in verification due to stack
    overflow with -XX:+VerifyIterativeGVN
    + JDK-8246330: Add TLS Tests for Legacy ECDSA curves
    + JDK-8246453: TestClone crashes with "all collected exceptions
    must come from the same place"
    + JDK-8247246: Add explicit ResolvedJavaType.link and expose
    presence of default methods
    + JDK-8247350: [aarch64] assert(false) failed: wrong size of
    mach node
    + JDK-8247502: PhaseStringOpts crashes while optimising
    effectively dead code
    + JDK-8247615: Initialize the bytes left for the heap sampler
    + JDK-8247824: CTW: C2 (Shenandoah) compilation fails with SEGV
    in SBC2Support::pin_and_expand
    + JDK-8247874: Replacement in VersionProps.java.template not
    working when --with-vendor-bug-url contains '&amp;'
    + JDK-8247979: aarch64: missing side effect of killing flags
    for clearArray_reg_reg
    + JDK-8248214: Add paddings for TaskQueueSuper to reduce
    false-sharing cache contention
    + JDK-8248219: aarch64: missing memory barrier in
    fast_storefield and fast_accessfield
    + JDK-8248348: Regression caused by the update to BCEL 6.0
    + JDK-8248385: [testbug][11u] Adapt TestInitiExceptions to
    jtreg 5.1
    + JDK-8248495: [macos] zerovm is broken due to libffi headers
    location
    + JDK-8248851: CMS: Missing memory fences between free chunk
    check and klass read
    + JDK-8248987: AOT's Linker.java seems to eagerly fail-fast on
    Windows
    + JDK-8249159: Downport test rework for SSLSocketTemplate from
    8224650
    + JDK-8249215: JFrame::setVisible crashed with
  - Dfile.encoding=UTF-8 on Japanese Windows.
    + JDK-8249251: [dark_mode ubuntu 20.04] The selected menu is
    not highlighted in GTKLookAndFeel
    + JDK-8249255: Build fails if source code in cygwin home dir
    + JDK-8249277: TestVerifyIterativeGVN.java is failing with
    timeout in OpenJDK 11
    + JDK-8249278: Revert JDK-8226253 which breaks the spec of
    AccessibleState.SHOWING for JList
    + JDK-8249560: Shenandoah: Fix racy GC request handling
    + JDK-8249801: Shenandoah: Clear soft-refs on requested GC cycle
    + JDK-8249953: Shenandoah: gc/shenandoah/mxbeans tests should
    account for corner cases
    + JDK-8250582: Revert Principal Name type to NT-UNKNOWN when
    requesting TGS Kerberos tickets
    + JDK-8250609: C2 crash in IfNode::fold_compares
    + JDK-8250627: Use -XX:+/-UseContainerSupport for
    enabling/disabling Java container metrics
    + JDK-8250755: Better cleanup for
    jdk/test/javax/imageio/plugins/shared/CanWriteSequence.java
    + JDK-8250787: Provider.put no longer registering aliases in
    FIPS env
    + JDK-8250826: jhsdb does not work with coredump which comes
    from Substrate VM
    + JDK-8250827: Shenandoah: needs to reset/finish StringTable's
    dead count before/after parallel walk
    + JDK-8250844: Make sure {type,obj}ArrayOopDesc accessors check
    the bounds
    + JDK-8251117: Cannot check P11Key size in P11Cipher and
    P11AEADCipher
    + JDK-8251354: Shenandoah: Fix jdk/jfr/tool/TestPrintJSON.java
    test failure
    + JDK-8251451: Shenandoah: Remark ObjectSynchronizer roots with
    I-U
    + JDK-8251469: Better cleanup for
    test/jdk/javax/imageio/SetOutput.java
    + JDK-8251487: Shenandoah: missing detail timing tracking for
    final mark cleaning phase
    + JDK-8252120: compiler/oracle/TestCompileCommand.java
    misspells "occured"
    + JDK-8252157: JDK-8231209 11u backport breaks jmm binary
    compatibility
    + JDK-8252258: [11u] JDK-8242154 changes the default vendor
    + JDK-8252804: [test] Fix 'ReleaseDeflater.java' test after
    downport of 8234011
    + JDK-8253134: JMM_VERSION should remain at 0x20020000 (JDK 10)
    in JDK 11
    + JDK-8253283: [11u] Test build/translations/
    /VerifyTranslations.java failing after JDK-8252258
    + JDK-8253813: Backout JDK-8244287 from 11u: it causes several
    crashes
- Removed patch:
  * gcc-fno-common-fix.patch
    + not needed any more with this version
- Added patch:
  * JDK-8250861.patch
    + Fix regression "8250861: Crash in MinINode::Ideal(PhaseGVN*,
    bool)" introduced in jdk 11.0.9</changelog>
  <changelog author="fstrba@suse.com" date="1604491200">- Enable Sheandoah GC for x86_64 (jsc#ECO-3171)</changelog>
  <changelog author="fstrba@suse.com" date="1605528000">- Update to upstream tag jdk-11.0.9.1-1
  * Fix:
    + JDK-8250861: Crash in MinINode::Ideal(PhaseGVN*, bool)
- Removed patch:
  * JDK-8250861.patch
    + Integrated upstream</changelog>
  <changelog author="fstrba@suse.com" date="1611230400">- Update to upstream tag jdk-11.0.10+9 (January 2021 CPU,
  bsc#1181239)
  * Security fixes
    + JDK-8247619: Improve Direct Buffering of Characters
  * Other changes
    + JDK-6722928: Support SSPI as a native GSS-API provider
    + JDK-7185258: [macosx] Deadlock in SunToolKit.realSync()
    + JDK-8152332: [macosx] JFileChooser cannot be serialized on
    Mac OS X
    + JDK-8161684: [testconf] Add VerifyOops' testing into compiler
    tiers
    + JDK-8171279: Support X25519 and X448 in TLS
    + JDK-8173361: various crashes in
    JvmtiExport::post_compiled_method_load
    + JDK-8173658: JvmtiExport::post_class_unload() is broken for
    non-JavaThread initiators
    + JDK-8191006: hsdis disassembler plugin does not compile with
    binutils 2.29+
    + JDK-8197981: Missing return statement in
    __sync_val_compare_and_swap_8
    + JDK-8198334: java/awt/FileDialog/8003399/bug8003399.java
    fails in headless mode
    + JDK-8200151: Add 8 JNDI tests to com/sun/jndi/dns/ConfigTests/
    + JDK-8208279: Add 8 JNDI tests to com/sun/jndi/dns/EnvTests/
    + JDK-8208483: Add 5 JNDI tests to
    com/sun/jndi/dns/FactoryTests/
    + JDK-8208542: Add 4 JNDI tests to com/sun/jndi/dns/ListTests/
    + JDK-8208665: Amend cross-compilation docs with
    qemu-debootstrap recipe
    + JDK-8210088: ProblemList gc/epsilon/TestMemoryMXBeans.java
    + JDK-8210339: Add 10 JNDI tests to com/sun/jndi/dns/FedTests/
    + JDK-8211450: UndetVar::dup is not copying the kind field to
    the duplicated instance
    + JDK-8212160: JVMTI agent crashes with "assert(_value != 0LL)
    failed: resolving NULL _value"
    + JDK-8212226: SurfaceManager throws "Invalid Image variant"
    for MultiResolutionImage (Windows)
    + JDK-8213400: Support choosing group name in keytool keypair
    generation
    + JDK-8213535: Windows HiDPI html lightweight tooltips are
    truncated
    + JDK-8213698: Improve devkit creation and add support for
    linux/ppc64/ppc64le/s390x
    + JDK-8214025: assert(t-&gt;singleton()) failed: must be a
    constant when ScavengeRootsInCode &lt; 2
    + JDK-8214242: compiler/arguments/TestScavengeRootsInCode.java
    fails because of missing UnlockDiagnosticVMOptions
    + JDK-8214787: Zero builds fail with "undefined
    JavaThread::thread_state()"
    + JDK-8215583: Exclude
    runtime/handshake/HandshakeWalkSuspendExitTest.java
    + JDK-8216012: Infinite loop in RSA KeyPairGenerator
    + JDK-8216324: GetClassMethods is confused by the presence of
    default methods in super interfaces
    + JDK-8217429: WebSocket over authenticating proxy fails to
    send Upgrade headers
    + JDK-8217976: test/jdk/java/net/httpclient/websocket/
    /WebSocketProxyTest.java fails intermittently
    + JDK-8218021: Have jarsigner preserve posix permission
    attributes
    + JDK-8218287: jshell tool: input behavior unstable after
    12-ea+24 on Windows
    + JDK-8218851: JVM crash in custom classloader stress test, JDK
    12 &amp; 13
    + JDK-8220420: Cleanup c1_LinearScan
    + JDK-8222072: JVMTI GenerateEvents() sends CompiledMethodLoad
    events to wrong jvmtiEnv
    + JDK-8222286: Fix for JDK-8213419 is broken on s390
    + JDK-8222527: HttpClient doesn't send HOST header when
    tunelling HTTP/1.1 through http proxy
    + JDK-8222533: jtreg test jdk/internal/platform/cgroup/
    /TestCgroupMetrics.java fails on SLES12.3 linux ppc64le
    machine
    + JDK-8224506: [TESTBUG] TestDockerMemoryMetrics.java fails
    with exitValue = 137
    + JDK-8224555: vmTestbase/nsk/jvmti/scenarios/contention/TC02/
    /tc02t001/TestDescription.java failed
    + JDK-8224650: Add tests to support X25519 and X448 in TLS
    + JDK-8225072: Add LuxTrust certificate that is expiring in
    March 2021 to list of allowed but expired certs
    + JDK-8225329: -XX:+PrintBiasedLockingStatistics causes crash
    during initialization on Windows platforms
    + JDK-8225687: Newly added sspi.cpp in JDK-6722928 still
    contains some small errors
    + JDK-8227006: [linux] Runtime.availableProcessors execution
    time increased by factor of 100
    + JDK-8227275: Within native OOM error handling, assertions may
    hang the process
    + JDK-8227647: [Graal] Test8009761.java fails due to
    "RuntimeException: static java.lang.Object
    compiler.uncommontrap.Test8009761.m3(boolean,boolean) not
    compiled"
    + JDK-8229495: SIGILL in C2 generated OSR compilation
    + JDK-8230910: libsspi_bridge does not build on Windows 32bit
    + JDK-8232114: JVM crashed at imjpapi.dll in native code
    + JDK-8234147: Avoid looking up standard charsets in core
    libraries
    + JDK-8234393: [macos] printing ignores printer tray
    + JDK-8234863: Increase default value of MaxInlineLevel
    + JDK-8235218: Minimal VM is broken after JDK-8173361
    + JDK-8235456: Minimal VM is broken after JDK-8212160
    + JDK-8235829: graal crashes with Zombie.java test
    + JDK-8236124: Minimal VM slowdebug build failed after
    JDK-8212160
    + JDK-8236512: PKCS11 Connection closed after Cipher.doFinal
    and NoPadding
    + JDK-8236944: The legVecZ operand should be limited to
    zmm0-zmm15 registers
    + JDK-8237186: Fix typo in copyright header of
    java/io/Reader/TransferTo.java
    + JDK-8237499: JFR: Include stack trace in the ThreadStart event
    + JDK-8237512: AArch64: aarch64TestHook leaks a BufferBlob
    + JDK-8237524: AArch64: String.compareTo() may return incorrect
    result
    + JDK-8237950: C2 compilation fails with "Live Node limit
    exceeded limit" during ConvI2L::Ideal optimization
    + JDK-8238579: HttpsURLConnection drops the timeout and hangs
    forever in read
    + JDK-8239105: Add exception for expiring Digicert root
    certificates to VerifyCACerts test
    + JDK-8239477: jdk/jfr/jcmd/TestJcmdStartStopDefault.java fails
  - XX:+VerifyOops with "verify_oop: rsi: broken oop"
    + JDK-8239497: SEGV in EdgeUtils::field_name_symbol(Edge const&amp;)
    + JDK-8239886: Minimal VM build fails after JDK-8237499
    + JDK-8240633: Memory leaks in the implementations of
    FileChooserUI
    + JDK-8240690: Race condition between EDT and
    BasicDirectoryModel.FilesLoader.run0()
    + JDK-8241234: Unify monitor enter/exit runtime entries.
    + JDK-8241311: Move some charset mapping tests from closed to
    open
    + JDK-8241797: Add some tests to the problem list
    + JDK-8242029: AArch64: skip G1 array copy pre-barrier if
    marking not active
    + JDK-8242335: Additional Tests for RSASSA-PSS
    + JDK-8242480: Negative value may be returned by
    getFreeSwapSpaceSize() in the docker
    + JDK-8242614: cleanup duplicated test ldap server in some
    com/sun/jndi/ldap/ tests
    + JDK-8242846: Bring back test/jdk/tools/jlink/plugins/
    /OrderResourcesPluginTest.java
    + JDK-8243114: Implement montgomery{Multiply,Square}intrinsics
    on Windows
    + JDK-8243290: Improve diagnostic messages for class
    verification and redefinition failures
    + JDK-8243488: Add tests for set/get SendBufferSize and
    getReceiveBufferSize in DatagramSocket
    + JDK-8243549: sun/security/ssl/CipherSuite/
    /NamedGroupsWithCipherSuite.java failed with Unsupported
    signature algorithm: DSA
    + JDK-8243617: compiler/onSpinWait/TestOnSpinWaitC1.java test
    uses wrong class
    + JDK-8243619: compiler/codecache/CheckSegmentedCodeCache.java
    test misses -version
    + JDK-8244142: some hotspot/runtime tests don't check exit code
    of forked JVM
    + JDK-8244278: Excessive code cache flushes and sweeps
    + JDK-8244282: test/hotspot/jtreg/compiler/intrinsics/
    /Test8237524.java fails with --illegal-access=deny
    + JDK-8244621: [macos10.15] Garbled FX printing plus CoreText
    warnings on Catalina when building with Xcode 11
    + JDK-8244819: hsdis does not compile with binutils 2.34+
    + JDK-8245051: c1 is broken if it is compiled by gcc without
  - fno-lifetime-dse
    + JDK-8245168: jlink should not be treated as a "small" tool
    + JDK-8245400: Upgrade to LittleCMS 2.11
    + JDK-8246381: VM crashes with "Current BasicObjectLock* below
    than low_mark"
    + JDK-8246434: Threads::print_on_error assumes that the heap
    has been set up
    + JDK-8246648: issue with OperatingSystemImpl
    getFreeSwapSpaceSize in docker after 8242480
    + JDK-8247201: Print potential pointer value of readable stack
    memory in hs_err file
    + JDK-8247763: assert(outer-&gt;outcnt() == 2) failed: 'only phis'
    failure in LoopNode::verify_strip_mined()
    + JDK-8247867: Upgrade to freetype 2.10.2
    + JDK-8248190: Enable Power10 system and implement new
    byte-reverse instructions
    + JDK-8248226: TestCloneAccessStressGCM fails with
  - XX:-ReduceBulkZeroing
    + JDK-8248347: windows build broken by JDK-8243114
    + JDK-8248532: Every time I change keyboard language at my
    MacBook, Java crashes
    + JDK-8248552: C2 crashes with SIGFPE due to division by zero
    + JDK-8248596: [TESTBUG] compiler/loopopts/
    /PartialPeelingUnswitch.java times out with Graal enabled
    + JDK-8248745: Add jarsigner and keytool tests for restricted
    algorithms
    + JDK-8248791: sun/util/resources/cldr/TimeZoneNamesTest.java
    fails with -XX:-ReduceInitialCardMarks -XX:-ReduceBulkZeroing
    + JDK-8248845: AArch64: stack corruption after spilling vector
    register
    + JDK-8249176: Update GlobalSignR6CA test certificates
    + JDK-8249183: JVM crash in "AwtFrame::WmSize" method
    + JDK-8249192: MonitorInfo stores raw oops across safepoints
    + JDK-8249602: C2: assert(cnt == _outcnt) failed: no insertions
    allowed
    + JDK-8249603: C1: assert(has_error == false) failed: register
    allocation invalid
    + JDK-8249605: C2: assert(no_dead_loop) failed: dead loop
    detected
    + JDK-8249607: C2: assert(!had_error) failed: bad dominance
    + JDK-8249608: Vector register used by C2 compiled method
    corrupted at safepoint
    + JDK-8249672: Include microcode revision in features_string on
    x86
    + JDK-8249748: gtest silently ignores bad jvm arguments
    + JDK-8249821: Separate libharfbuzz from libfontmanager
    + JDK-8250598: Hyper-V is detected in spite of running on host
    OS
    + JDK-8250605: Linux x86_32 builds fail after JDK-8249821
    + JDK-8250636: iso8601_time returns incorrect offset part on
    MacOS
    + JDK-8250665: Wrong translation for the month name of May in
    ar_JO,LB,SY
    + JDK-8250772: Test com/sun/jndi/ldap/
    /NamingExceptionMessageTest.java fails intermittently with
    javax.naming.ServiceUnavailableException
    + JDK-8250825: C2 crashes with assert(field != __null) failed:
    missing field
    + JDK-8250894: Provide a configure option to build and run
    against the platform libharfbuzz
    + JDK-8250928: JFR: Improve hash algorithm for stack traces
    + JDK-8250968: Symlinks attributes not preserved when using
    jarsigner on zip files
    + JDK-8250984: Memory Docker tests fail on some Linux kernels
    w/o cgroupv1 swap limit capabilities
    + JDK-8251118: BiasedLocking::preserve_marks should not have a
    HandleMark
    + JDK-8251189: com/sun/jndi/ldap/LdapDnsProviderTest.java
    failed due to timeout
    + JDK-8251257: NMT: jcmd VM.native_memory scale=1 crashes
    target VM
    + JDK-8251365: Build failure on AIX after 8250636
    + JDK-8251397: NPE on ClassValue.ClassValueMap.cacheArray
    + JDK-8251456: [TESTBUG] compiler/vectorization/
    /TestVectorsNotSavedAtSafepoint.java failed OutOfMemoryError
    + JDK-8251458: Parse::do_lookupswitch fails with "assert(_cnt
    &gt;= 0) failed"
    + JDK-8251535: Partial peeling at unsigned test adds incorrect
    loop exit check
    + JDK-8251949: ZGC: Set explicit heap size for
    compiler/gcbarriers tests
    + JDK-8252090: JFR: StreamWriterHost::write_unbuffered() stucks
    in an infinite loop OpenJDK (build 13.0.1+9)
    + JDK-8252415: Bump update version for OpenJDK: jdk-11.0.10
    + JDK-8252470: java/awt/dnd/DisposeFrameOnDragCrash/
    /DisposeFrameOnDragTest.java fails on Windows
    + JDK-8252497: Incorrect numeric currency code for ROL
    + JDK-8252660: Shenandoah: support manageable SoftMaxHeapSize
    option
    + JDK-8252679: Two windows specific FileDIalog tests may fail
    on some Windows_Server_2016_Standard
    + JDK-8252696: Loop unswitching may cause out of bound array
    load to be executed
    + JDK-8252754: Hash code calculation of JfrStackTrace is
    inconsistent
    + JDK-8253219: Epsilon: clean up unnecessary includes
    + JDK-8253224: Shenandoah: ShenandoahStrDedupQueue destructor
    calls virtual num_queues()
    + JDK-8253226: Shenandoah: remove unimplemented
    ShenandoahStrDedupQueue::verify
    + JDK-8253269: The CheckCommonColors test should provide more
    info on failure
    + JDK-8253284: Zero OrderAccess barrier mappings are incorrect
    + JDK-8253375: OSX build fails with Xcode 12.0 (12A7209)
    + JDK-8253778: ShenandoahSafepoint::is_at_shenandoah_safepoint
    should not access VMThread state from other threads
    + JDK-8253791: Issue with useAppleColor check in CSystemColors.m
    + JDK-8254016: Test8237524 fails with -XX:-CompactStrings option
    + JDK-8254081: java/security/cert/PolicyNode/
    /GetPolicyQualifiers.java fails due to an expired certificate
    + JDK-8254144: Non-x86 Zero builds fail with return-type
    warning in os_linux_zero.cpp
    + JDK-8254166: Zero: return-type warning in
    zeroInterpreter_zero.cpp
    + JDK-8254177: (tz) Upgrade time-zone data to tzdata2020b
    + JDK-8254185: Fix Code cache sweeper heuristics for JDK 11
    + JDK-8254190: [s390] interpreter misses exception check after
    calling monitorenter
    + JDK-8254790: SIGSEGV in string_indexof_char and
    stringL_indexof_char intrinsics
    + JDK-8254854: [cgroups v1] Metric limits not properly detected
    on some join controller combinations
    + JDK-8254982: (tz) Upgrade time-zone data to tzdata2020c
    + JDK-8255050: Add pkcs11/KeyStore/ClientAuth.sh to Problem list
    + JDK-8255065: Zero: accessor_entry misses the IRIW case
    + JDK-8255226: (tz) Upgrade time-zone data to tzdata2020d
    + JDK-8255269: Unsigned overflow in g1Policy.cpp
    + JDK-8255365: Problem list failing client manual tests
    + JDK-8255457: Shenandoah: cleanup ShenandoahMarkTask
    + JDK-8255466: C2 crashes at ciObject::get_oop() const+0x0
    + JDK-8255550: x86: Assembler::cmpq(Address dst, Register src)
    encoding is incorrect
    + JDK-8255603: Memory/Performance regression after JDK-8210985
    + JDK-8255760: Shenandoah: match constants style in
    ShenandoahMarkTask fallback
    + JDK-8255781: Bump patch update version for OpenJDK:
    jdk-11.0.9.1
    + JDK-8255937: Better cleanup for
    test/jdk/javax/imageio/stream/StreamFlush.java
    + JDK-8256427: Test com/sun/jndi/dns/ConfigTests/
    /PortUnreachable.java does not work on AIX
    + JDK-8256452: Integrate missing part of JDK-8232370 to 11u
    + JDK-8256483: [TESTBUG] serviceability/jvmti/GetClassMethods/
    /libOverpassMethods.c fails to compile on gcc 4.4.x
    + JDK-8256557: libharfbuzz fails to link on gcc 4.4.x due to
  - Wl,-z,defs
    + JDK-8256618: Zero: Linux x86_32 build still fails
    + JDK-8256736: Zero: GTest tests fail with "unsuppported vm
    variant"
    + JDK-8256809: Annotation processing causes NPE during flow
    analysis
    + JDK-8257181: s390x builds are very noisy with gc-sections
    messages
    + JDK-8257242: [macOS] Java app crashes while switching input
    methods
    + JDK-8257545: SunJSSE FIPS regression in key exchange after
    JDK-8171279 11u backport
    + JDK-8257641: Shenandoah: Query is_at_shenandoah_safepoint()
    from control thread should return false
    + JDK-8257701: Shenandoah: objArrayKlass metadata is not marked
    with chunked arrays
    + JDK-8258630: Add expiry exception for QuoVadis root
    certificate
- New upstream dependency on libharfbuzz
- Regenerated patches: missing-return.patch system-pcsclite.patch</changelog>
  <changelog author="fstrba@suse.com" date="1616155200">- Added patches:
  * system-crypto-policy.patch
    + Let OpenJDK use system crypto policies unless explicitely told
    not to
  * nss-security-provider.patch
    + Add the NSS security provider with configuration in generated
    nss.cfg file
  * keytool-default-rsa.patch
    + Make keytool generate RSA keys by default, since only the
    LEGACY system crypto policy allows DSA</changelog>
  <changelog author="pujos.michael@gmail.com" date="1618488000">- moved mozilla-nss dependency to java-11-openjdk-headless package
  This is necessary to be able to do crypto with just
  java-11-openjdk-headless installed. Fixes boo#1184606</changelog>
  <changelog author="fstrba@suse.com" date="1619006400">- Update to upstream tag jdk-11.0.11+9 (April 2021, CPU)
  * Security fixes
    + JDK-8244473: Contextualize registration for JNDI
    + JDK-8244543: Enhanced handling of abstract classes
    + JDK-8249906, CVE-2021-2163, bsc#1185055: Enhance opening JARs
    + JDK-8250568, CVE-2021-2161, bsc#1185056: Less ambiguous
    processing
    + JDK-8253799: Make lists of normal filenames
    + JDK-8257001: Improve Http Client Support
  * Other changes
    + JDK-7107012: sun.jvm.hotspot.code.CompressedReadStream
    readDouble() conversion to long mishandled
    + JDK-7146776: deadlock between URLStreamHandler.getHostAddress
    and file.Handler.openconnection
    + JDK-8086003: Test fails on OSX with java.lang.RuntimeException
    'Narrow klass base: 0x0000000000000000, Narrow klass shift: 3'
    missing
    + JDK-8168869: jdeps: localized messages don't use proper line
    breaks
    + JDK-8180837: SunPKCS11-NSS tests failing with
    CKR_ATTRIBUTE_READ_ONLY and CKR_MECHANISM_PARAM_INVALID
    + JDK-8202343: Disable TLS 1.0 and 1.1
    + JDK-8205992: jhsdb cannot attach to Java processes running in
    Docker containers
    + JDK-8209193: Fix aarch64-linux compilation after -Wreorder
    changes
    + JDK-8210413: AArch64: Optimize div/rem by constant in C1
    + JDK-8210578: AArch64: Invalid encoding for fmlsvs instruction
    + JDK-8211051: jdeps usage of --dot-output doesn't provide
    valid output for modular jar
    + JDK-8211057: Gensrc step CompileProperties generates unstable
    CompilerProperties output
    + JDK-8211150: G1 Full GC not purging code root memory and
    hence causing memory leak
    + JDK-8211825: ModuleLayer.defineModulesWithXXX does not setup
    delegation when module reads automatic module
    + JDK-8212043: Add floating-point Math.min/max intrinsics
    + JDK-8212218: [TESTBUG] runtime/ErrorHandling/
    /TestHeapDumpOnOutOfMemoryErrorInMetaspace.java timed out
    + JDK-8213116: javax/swing/JComboBox/WindowsComboBoxSize/
    /WindowsComboBoxSizeTest.java fails in Windows
    + JDK-8213909: jdeps --print-module-deps should report missing
    dependences
    + JDK-8214180: Need better granularity for sleeping
    + JDK-8214223: tools/jdeps/listdeps/ListModuleDeps.java failed
    due to missing Lib2 file
    + JDK-8214230: Classes generated by SystemModulesPlugin.java
    are not reproducable
    + JDK-8214741: docs/index.html has no title or copyright
    + JDK-8215687: [Graal] unit test CheckGraalIntrinsics failed
    after 8212043
    + JDK-8217848: [Graal] vmTestbase/nsk/jvmti/ResourceExhausted/
    /resexhausted003/TestDescription.java fails
    + JDK-8218482: sun/security/krb5/auto/ReplayCachePrecise.java
    failed - no KrbException thrown
    + JDK-8218550: Add test omitted from JDK-8212043
    + JDK-8221584: SIGSEGV in os::PlatformEvent::unpark() in
    JvmtiRawMonitor::raw_exit while posting method exit event
    + JDK-8221995: AARCH64: problems with CAS instructions encoding
    + JDK-8222518: Remove unnecessary caching of Parker object in
    java.lang.Thread
    + JDK-8222785: aarch64: add necessary masking for immediate
    shift counts
    + JDK-8223186: HotSpot compile warnings from GCC 9
    + JDK-8225773: jdeps --check produces NPE if there are missing
    module dependences
    + JDK-8225805: Java Access Bridge does not close the logger
    + JDK-8226810: Failed to launch JVM because of
    NullPointerException occured on System.props
    + JDK-8229396: jdeps ignores multi-release when
    generate-module-info used on command line
    + JDK-8229474: Shenandoah: Cleanup CM::update_roots()
    + JDK-8232225: Rework the fix for JDK-8071483
    + JDK-8232905: JFR fails with assertion:
    assert(t-&gt;unflushed_size() == 0) failed: invariant
    + JDK-8233164: C2 fails with assert(phase-&gt;C-&gt;get_alias_index(t)
    == phase-&gt;C-&gt;get_alias_index(t_adr)) failed: correct memory
    chain
    + JDK-8233910: java/awt/ColorClass/AlphaColorTest.java is
    failing  intermittently in nightly lnux-x64 system
    + JDK-8233912: aarch64: minor improvements of atomic operations
    + JDK-8234508: VM_HeapWalkOperation::iterate_over_object reads
    non-strong fields with an on-strong load barrier
    + JDK-8234742: Improve handshake logging
    + JDK-8234796: Refactor Handshake::execute to take a more
    complex type than ThreadClosure
    + JDK-8235324: Dying objects are published from users of
    CollectedHeap::object_iterate
    + JDK-8235351: Lookup::unreflect should bind with the original
    caller independent of Method's accessible flag
    + JDK-8237369: Shenandoah: failed vmTestbase/nsk/jvmti/
    /AttachOnDemand/attach021/TestDescription.java test
    + JDK-8237392: Shenandoah: Remove unreliable assertion
    + JDK-8237483: AArch64 C1 OopMap inserted twice fatal error
    + JDK-8237495: Java MIDI fails with a dereferenced memory error
    when asked to send a raw 0xF7
    + JDK-8239355: (dc) Initial value of SO_SNDBUF should allow
    sending large datagrams (macOS)
    + JDK-8240353: AArch64: missing support for
  - XX:+ExtendedDTraceProbes in C1
    + JDK-8240704: CheckHandles.java failed "AssertionError: Handle
    use increased by more than 10 percent."
    + JDK-8240751: Shenandoah: fold ShenandoahTracer definition
    + JDK-8240795: [REDO] 8238384 CTW: C2 compilation fails with
    "assert(store != load-&gt;find_exact_control(load-&gt;in(0)))
    failed: dependence cycle found"
    + JDK-8241598: Upgrade JLine to 3.14.0
    + JDK-8241649: Optimize Character.toString
    + JDK-8241770: Module xxxAnnotation() methods throw NCDFE if
    module-info.class found as resource in unnamed module
    + JDK-8241911: AArch64: Fix a potential register clash issue in
    reduce_add2I
    + JDK-8242030: Wrong package declarations in jline classes after
    JDK-8241598
    + JDK-8242565: Policy initialization issues when the denyAfter
    constraint is enabled
    + JDK-8243618: compiler/rtm/cli tests can be run w/o WhiteBox
    + JDK-8243670: Unexpected test result caused by C2
    MergeMemNode::Ideal
    + JDK-8244088: [Regression] Switch of Gnome theme ends up in
    deadlocked UI
    + JDK-8244154: Update SunPKCS11 provider with PKCS11 v3.0 header
    files
    + JDK-8244340: Handshake processing thread lacks yielding
    + JDK-8244573: java.lang.ArrayIndexOutOfBoundsException thrown
    for malformed class file
    + JDK-8244683: A TSA server used by tests
    + JDK-8245005: javax/net/ssl/compatibility/BasicConnectTest.java
    failed with No enum constant
    + JDK-8245026: PsAdaptiveSizePolicy::_old_gen_policy_is_ready is
    unused
    + JDK-8245283: JFR: Can't handle constant dynamic used by Jacoco
    agent
    + JDK-8245512: CRC32 optimization using AVX512 instructions
    + JDK-8245527: LDAP Channel Binding support for Java
    GSS/Kerberos
    + JDK-8246707: (sc) SocketChannel.read/write throws
    AsynchronousCloseException on closed channel
    + JDK-8246709: sun/security/tools/jarsigner/
    /TsacertOptionTest.java compilation failed after JDK-8244683
    + JDK-8247200: assert((unsigned)fpargs &lt; 32)
    + JDK-8247766: [aarch64] guarantee(val &lt; (1U &lt;&lt; nbits))
    failed: Field too big for insn.
    + JDK-8248336: AArch64: C2: offset overflow in
    BoxLockNode::emit
    + JDK-8248865: Document JNDI/LDAP timeout properties
    + JDK-8248901: Signed immediate support in
    .../share/assembler.hpp is broken.
    + JDK-8249543: Force DirectBufferAllocTest to run with
  - ExplicitGCInvokesConcurrent
    + JDK-8249588: libwindowsaccessbridge issues on 64bit Windows
    + JDK-8249749: modify a primitive array through a stream and a
    for cycle causes jre crash
    + JDK-8249787: Make TestGCLocker more resilient with concurrent
    GCs
    + JDK-8249867: xml declaration is not followed by a newline
    + JDK-8250911: [windows] os::pd_map_memory() error detection
    broken
    + JDK-8251255: [linux] Add process-memory information to hs-err
    and VM.info
    + JDK-8251359: Shenandoah: filter null oops before calling
    enqueue/SATB barrier
    + JDK-8251925: C2: RenaissanceStressTest fails with
    assert(!had_error): bad dominance
    + JDK-8251944: Add Shenandoah test config to
    compiler/gcbarriers/UnsafeIntrinsicsTest.java
    + JDK-8251992: VM crashed running TestComplexAddrExpr.java test
    with -XX:UseAVX=X
    + JDK-8253220: Epsilon: clean up unused code/declarations
    + JDK-8253274: The CycleDMImagetest brokes the system
    + JDK-8253353: Crash in C2: guarantee(n != NULL) failed: No Node
    + JDK-8253368: TLS connection always receives close_notify
    exception
    + JDK-8253404: C2: assert(C-&gt;live_nodes() &lt;=
    C-&gt;max_node_limit()) failed: Live Node limit exceeded limit
    + JDK-8253409: Double-rounding possibility in float fma
    + JDK-8253476: TestUseContainerSupport.java fails on some Linux
    kernels w/o swap limit capabilities
    + JDK-8253524: C2: Refactor code that clones predicates during
    loop unswitching
    + JDK-8253644: C2: assert(skeleton_predicate_has_opaque(iff))
    failed: unexpected
    + JDK-8253681: closed java/awt/dnd/MouseEventAfterStartDragTest/
    /MouseEventAfterStartDragTest.html test failed
    + JDK-8253702: BigSur version number reported as 10.16, should
    be 11.nn
    + JDK-8253756: C2 CompilerThread0 crash in Node::add_req(Node*)
    + JDK-8254104: MethodCounters must exist before nmethod is
    installed
    + JDK-8254734: "dead loop detected" assert failure with patch
    from 8223051
    + JDK-8254748: Bad Copyright header format after JDK-8212218
    + JDK-8254799: runtime/ErrorHandling/
    /TestHeapDumpOnOutOfMemoryError.java fails with release VMs
    + JDK-8255058: C1: assert(is_virtual()) failed: type check
    + JDK-8255351: Add detection for Graviton 2 CPUs
    + JDK-8255368: Math.exp() gives wrong result for large values on
    x86 32-bit platforms
    + JDK-8255387: Japanese characters were printed upside down on
    AIX
    + JDK-8255401: Shenandoah: Allow oldval and newval registers to
    overlap in cmpxchg_oop()
    + JDK-8255479: [aarch64] assert(src-&gt;section_index_of(target) ==
    CodeBuffer::SECT_NONE) failed: sanity
    + JDK-8255544: Create a checked cast
    + JDK-8255559: Leak File Descriptors Because of
    ResolverLocalFilesystem#engineResolveURI()
    + JDK-8255681: print callstack in error case in
    runAWTLoopWithApp
    + JDK-8255734: VM should ignore SIGXFSZ on ppc64, s390 too
    + JDK-8255742: PrintInlining as compiler directive doesn't print
    virtual calls
    + JDK-8255845: Memory leak in imageFile.cpp
    + JDK-8255880: UI of Swing components is not redrawn after their
    internal state changed
    + JDK-8255908: ExceptionInInitializerError due to
    UncheckedIOException while initializing cgroupv1 subsystem
    + JDK-8256025: AArch64: MachCallRuntimeNode::ret_addr_offset()
    is incorrect for stub calls
    + JDK-8256056: Deoptimization stub doesn't save vector registers
    on x86
    + JDK-8256061: RegisterSaver::save_live_registers() omits upper
    halves of ZMM0-15 registers
    + JDK-8256187: [TEST_BUG] Automate bug4275046.java test
    + JDK-8256220: C1: x86_32 fails with -XX:UseSSE=1 after
    JDK-8210764 due to mishandled lir_neg
    + JDK-8256258: some missing NULL checks or asserts after
    CodeCache::find_blob_unsafe
    + JDK-8256264: Printed GlyphVector outline with low DPI has bad
    quality on Windows
    + JDK-8256290: javac/lambda/T8031967.java fails with
    StackOverflowError on x86_32
    + JDK-8256359: AArch64: runtime/ReservedStack/
    /ReservedStackTestCompiler.java fails
    + JDK-8256387: Unexpected result if patching an entire
    instruction on AArch64
    + JDK-8256421: Add 2 HARICA roots to cacerts truststore
    + JDK-8256488: [aarch64] Use ldpq/stpq instead of ld4/st4 for
    small copies in StubGenerator::copy_memory
    + JDK-8256489: Make gtest for long path names on Windows more
    resilient in the presence of virus scanners
    + JDK-8256501: libTestMainKeyWindow fails to build with Xcode
    12.2
    + JDK-8256633: Fix product build on Windows+Arm64
    + JDK-8256682: JDK-8202343 is incomplete
    + JDK-8256751: Incremental rebuild with precompiled header fails
    when touching a header file
    + JDK-8256757: Incorrect MachCallRuntimeNode::ret_addr_offset()
    for CallLeafNoFP on x86_32
    + JDK-8256806: Shenandoah: optimize shenandoah/jni/
    /TestPinnedGarbage.java test
    + JDK-8256807: C2: Not marking stores correctly as mismatched
    in string opts
    + JDK-8256810: Incremental rebuild broken on Macosx
    + JDK-8256818: SSLSocket that is never bound or connected leaks
    socket resources
    + JDK-8256888: Client manual test problem list update
    + JDK-8257083: Security infra test failures caused by
    JDK-8202343
    + JDK-8257408: Bump update version for OpenJDK: jdk-11.0.11
    + JDK-8257423: [PPC64] Support -XX:-UseInlineCaches
    + JDK-8257436: [aarch64] Regressions in ArrayCopyUnalignedDst
    .testByte/testChar for 65-78 bytes when UseSIMDForMemoryOps
    is on
    + JDK-8257513: C2: assert((constant_addr -
    _masm.code()-&gt;consts()-&gt;start()) == con.offset())
    + JDK-8257547: Handle multiple prereqs on the same line in deps
    files
    + JDK-8257561: Some code is not vectorized after 8251925 and
    8250607
    + JDK-8257565: epsilonBarrierSet.hpp should not include
    barrierSetAssembler
    + JDK-8257575: C2: "failed: only phis" assert failure in loop
    strip mining verification
    + JDK-8257594: C2 compiled checkcast of non-null object triggers
    endless deoptimization/recompilation cycle
    + JDK-8257633: Missing -mmacosx-version-min=X flag when linking
    libjvm
    + JDK-8257670: sun/security/ssl/SSLSocketImpl/SSLSocketLeak.java
    reports leaks
    + JDK-8257707: Fix incorrect format string in Http1HeaderParser
    + JDK-8257746: Regression introduced with JDK-8250984 - memory
    might be null in some machines
    + JDK-8257798: [PPC64] undefined reference to
    Klass::vtable_start_offset()
    + JDK-8257884: Re-enable sun/security/ssl/SSLSocketImpl/
    /SSLSocketLeak.java as automatic test
    + JDK-8257910: [JVMCI] Set exception_seen accordingly in the
    runtime.
    + JDK-8257997: sun/security/ssl/SSLSocketImpl/SSLSocketLeak.java
    again reports leaks after JDK-8257884
    + JDK-8257999: Parallel GC crash in gc/parallel/
    /TestDynShrinkHeap.java: new region is not in covered_region
    + JDK-8258077: Using -Xcheck:jni can lead to a double-free after
    JDK-8193234
    + JDK-8258247: Couple of issues in fix for JDK-8249906
    + JDK-8258373: Update the text handling in the JPasswordField
    + JDK-8258396: SIGILL in jdk.jfr.internal.PlatformRecorder
    .rotateDisk()
    + JDK-8258419: RSA cipher buffer cleanup
    + JDK-8258471: "search codecache" clhsdb command does not work
    + JDK-8258534: Epsilon: clean up unused includes
    + JDK-8258805: Japanese characters not entered by mouse click
    on Windows 10
    + JDK-8258833: Cancel multi-part cipher operations in SunPKCS11
    after failures
    + JDK-8258836: JNI local refs exceed capacity
    getDiagnosticCommandInfo
    + JDK-8258884: [TEST_BUG] Convert applet-based test
    open/test/jdk/javax/swing/JMenuItem/8031573/bug8031573.java
    to a regular java test
    + JDK-8259007: This test printed a blank page
    + JDK-8259048: (tz) Upgrade time-zone data to tzdata2020f
    + JDK-8259049: Uninitialized variable after JDK-8257513
    + JDK-8259231: Epsilon: improve performance under contention
    during virtual space expansion
    + JDK-8259271: gc/parallel/TestDynShrinkHeap.java still fails
    "assert(covered_region.contains(new_memregion)) failed: new
    region is not in covered_region"
    + JDK-8259312: VerifyCACerts.java fails as soneraclass2ca cert
    will expire in 90 days
    + JDK-8259319: Illegal package access when SunPKCS11 requires
    SunJCE's classes
    + JDK-8259339: AllocateUninitializedArray C2 intrinsic fails
    with void.class input
    + JDK-8259428: AlgorithmId.getEncodedParams() should return copy
    + JDK-8259446: runtime/jni/checked/
    /TestCheckedReleaseArrayElements.java fails with stderr not
    empty
    + JDK-8259451: Zero: skip serviceability/sa tests, set vm.hasSA
    to false
    + JDK-8259580: Shenandoah: uninitialized label in
    VerifyThreadGCState
    + JDK-8259619: C1: 3-arg StubAssembler::call_RT stack-use
    condition is incorrect
    + JDK-8259633: compiler/graalunit/CoreTest.java fails with NPE
    after JDK-8244543
    + JDK-8259706: C2 compilation fails with assert(vtable_index ==
    Method::invalid_vtable_index) failed: correct sentinel value
    + JDK-8259707: LDAP channel binding does not work with StartTLS
    extension
    + JDK-8259773: Incorrect encoding of AVX-512 kmovq instruction
    + JDK-8259849: Shenandoah: Rename store-val to IU-barrier
    + JDK-8259949: x86 32-bit build fails when -fcf-protection is
    passed in the compiler flags
    + JDK-8259954: gc/shenandoah/mxbeans tests fail with -Xcomp
    + JDK-8260029: aarch64: fix typo in verify_oop_array
    + JDK-8260308: Update LogCompilation junit to 4.13.1
    + JDK-8260338: Some fields in HaltNode is not cloned
    + JDK-8260349: Cannot programmatically retrieve Metaspace max
    set via JAVA_TOOL_OPTIONS
    + JDK-8260356: (tz) Upgrade time-zone data to tzdata2021a
    + JDK-8260378: [TESTBUG] DcmdMBeanTestCheckJni.java reports
    false positive
    + JDK-8260497: Shenandoah: Improve SATB flushing
    + JDK-8260502: [s390] NativeMovRegMem::verify() fails because
    it's too strict
    + JDK-8260632: Build failures after JDK-8253353
    + JDK-8260704: ParallelGC: oldgen expansion needs release-store
    for _end
    + JDK-8261022: Fix incorrect result of Math.abs() with char type
    + JDK-8261089: [TESTBUG] native library of test
    TestCheckedReleaseCriticalArray.java fails to compile with
    gcc 4.x
    + JDK-8261183: Follow on to Make lists of normal filenames
    + JDK-8261209: isStandalone property: remove dependency on
    pretty-print
    + JDK-8261231: Windows IME was disabled after DnD operation
    + JDK-8261251: Shenandoah: Use object size for full GC
    humongous compaction
    + JDK-8261310: PPC64 Zero build fails with
    'VMError::controlled_crash(int)::FunctionDescriptor
    functionDescriptor' has incomplete type and cannot be defined
    + JDK-8261334: NMT: tuning statistic shows incorrect hash
    distribution
    + JDK-8261413: Shenandoah: Disable class-unloading in I-U mode
    + JDK-8261522: [PPC64] AES intrinsics write beyond the
    destination array
    + JDK-8261534: Test sun/security/pkcs11/KeyAgreement/
    /IllegalPackageAccess.java fails on platforms where no nsslib
    artifacts are defined
    + JDK-8261585: Restore HandleArea used in
    Deoptimization::uncommon_trap
    + JDK-8261753: Test java/lang/System/OsVersionTest.java still
    failing on BigSur patch versions after JDK-8253702
    + JDK-8261829: Exclude tools/jlink/JLinkReproducibleTest.java
    in 11u
    + JDK-8261912: Code IfNode::fold_compares_helper more
    defensively
    + JDK-8261920: [AIX] jshell command throws java.io.IOError on
    non English locales
    + JDK-8262018: Wrong format in SAP copyright header of
    OsVersionTest
    + JDK-8263069: Exclude some failing tests from
    security/infra/java/security/cert/CertPathValidator</changelog>
  <changelog author="fstrba@suse.com" date="1620043200">- Remove all Jpackage provides for SLE12 in order to avoid
  installing this package as default Java on SLE12-SP5
  (bsc#1185476)</changelog>
  <changelog author="fstrba@suse.com" date="1621512000">- Modified patch:
  * nss-security-provider.patch
    + make the NSS provider first in the list</changelog>
  <changelog author="fstrba@suse.com" date="1626868800">- Update to upstream tag jdk-11.0.12+7 (July 2021, CPU)
  * Security fixes
    + JDK-8256157: Improve bytecode assembly
    + JDK-8256491: Better HTTP transport
    + JDK-8258432, CVE-2021-2341, bsc#1188564: Improve file
    transfers
    + JDK-8260453: Improve Font Bounding
    + JDK-8260960: Signs of jarsigner signing
    + JDK-8260967, CVE-2021-2369, bsc#1188565: Better jar file
    validation
    + JDK-8262380: Enhance XML processing passes
    + JDK-8262403: Enhanced data transfer
    + JDK-8262410: Enhanced rules for zones
    + JDK-8262477: Enhance String Conclusions
    + JDK-8262967: Improve Zip file support
    + JDK-8264066, CVE-2021-2388, bsc#1188566: Enhance compiler
    validation
    + JDK-8264079: Improve abstractions
    + JDK-8264460: Improve NTLM support
  * Other changes
    + JDK-6847157: java.lang.NullPointerException: HDC for
    component at sun.java2d.loops.Blit.Blit
    + JDK-7106851: Test should not use System.exit
    + JDK-8073446: TimeZone getOffset API does not  return a dst
    offset between years 2038-2137
    + JDK-8076190: Customizing the generation of a PKCS12 keystore
    + JDK-8153005: Upgrade the default PKCS12 encryption/MAC
    algorithms
    + JDK-8171303: sun/java2d/pipe/InterpolationQualityTest.java
    fails on Windows &amp; Linux
    + JDK-8177068: incomplete classpath causes NPE in Flow
    + JDK-8185734: [Windows] Structured Exception Catcher missing
    around gtest execution
    + JDK-8187450: JNI local refs exceeds capacity warning in
    NetworkInterface::getAll
    + JDK-8190763: Class cast exception on (CompoundEdit)
    UndoableEditEvent.getEdit()
    + JDK-8195841: PNGImageReader.readNullTerminatedString() doesnt
    check for non-null terminated strings with length equal to
    maxLen
    + JDK-8196100: javax/swing/text/JTextComponent/5074573/
    /bug5074573.java fails
    + JDK-8199646: JShell tests: jdk/jshell/
    /FailOverDirectExecutionControlTest.java failed with
    java.lang.UnsupportedOperationException
    + JDK-8206925: Support the certificate_authorities extension
    + JDK-8207160: ClassReader::adjustMethodParams can potentially
    return null if the args list is empty
    + JDK-8207247: AARCH64: Enable Minimal and Client VM builds
    + JDK-8207404: MulticastSocket tests failing on AIX
    + JDK-8207779: Method::is_valid_method() compares 'this' with
    NULL
    + JDK-8208061: runtime/LoadClass/TestResize.java fails with
    "Load factor too high" when running in CDS mode.
    + JDK-8209459: TestSHA512MultiBlockIntrinsics failed on AArch64
    + JDK-8210443: Migrate Locale matching tests to JDK Repo.
    + JDK-8213231: ThreadSnapshot::_threadObj can become stale
    + JDK-8213483: ARM32: runtime/ErrorHandling/
    /ShowRegistersOnAssertTest.java jtreg test fail
    + JDK-8213725: JShell NullPointerException due to class file
    with unexpected package
    + JDK-8213794: ARM32: disable TypeProfiling,
    CriticalJNINatives, Serviceablity tests for ARM32
    + JDK-8213845: ARM32: Interpreter doesn't call result handler
    after native calls
    + JDK-8214128: ARM32: wrong stack alignment on
    Deoptimization::unpack_frames
    + JDK-8214512: ARM32: Jtreg test compiler/c2/Test8062950.java
    fails on ARM
    + JDK-8214854: JDWP: Unforseen output truncation in logging
    + JDK-8214922: Add vectorization support for fmin/fmax
    + JDK-8215009: GCC 8 compilation error in libjli
    + JDK-8216184: CDS/appCDS tests failed on Windows due to long
    path to a classlist file
    + JDK-8216259: AArch64: Vectorize Adler32 intrinsics
    + JDK-8216314: SIGILL in CodeHeapState::print_names()
    + JDK-8217348: assert(thread-&gt;is_Java_thread()) failed: just
    checking
    + JDK-8217465: [REDO] - Optimize CodeHeap Analytics
    + JDK-8217561: X86: Add floating-point Math.min/max intrinsics
    + JDK-8217918: C2: -XX:+AggressiveUnboxing is broken
    + JDK-8218458: [TESTBUG] runtime/NMT/
    /CheckForProperDetailStackTrace.java fails with Expected
    stack trace missing from output
    + JDK-8219142: Remove unused JIMAGE_ResourcePath
    + JDK-8219586: CodeHeap State Analytics processes dead nmethods
    + JDK-8220074: Clean up GCC 8.3 errors in LittleCMS
    + JDK-8220407: compiler/intrinsics/math/
    /TestFpMinMaxIntrinsics.java timedout
    + JDK-8222302: [TESTBUG] test/hotspot/jtreg/compiler/intrinsics/
    /sha/cli/TestUseSHAOptionOnUnsupportedCPU.java fails on any
    other CPU
    + JDK-8222412: AARCH64: multiple instructions encoding issues
    + JDK-8223020: aarch64: expand minI_rReg and maxI_rReg patterns
    into separate instructions
    + JDK-8223444: Improve CodeHeap Free Space Management
    + JDK-8223504: Improve performance of forall loops by better
    inlining of "iterator()" methods
    + JDK-8223667: ASAN build broken
    + JDK-8225081: Remove Telia Company CA certificate expiring in
    April 2021
    + JDK-8225116: Test OwnedWindowsLeak.java intermittently fails
    + JDK-8225438: javax/net/ssl/TLSCommon/
    /TestSessionLocalPrincipal.java failed with Read timed out
    + JDK-8225756: [testbug] compiler/loopstripmining/
    /CheckLoopStripMining.java sets too short a
    SafepointTimeoutDelay
    + JDK-8226374: Restrict TLS signature schemes and named groups
    + JDK-8226627: assert(t-&gt;singleton()) failed: must be a constant
    + JDK-8226721: Missing intrinsics for Math.ceil, floor, rint
    + JDK-8227080: (fs) Files.newInputStream(...).skip(n) is slow
    + JDK-8227222: vmTestbase/jit/FloatingPoint/gen_math/Loops04/
    /Loops04.java failed XMM register should be 0-15
    + JDK-8227609: (fs) Files.newInputStream(...).skip(n) should
    allow skipping beyond file size
    + JDK-8230428: Cleanup dead CastIP node code in formssel.cpp
    + JDK-8231460: Performance issue (CodeHeap) with large free
    blocks
    + JDK-8231713: x86_32 build failures after JDK-8226721 (Missing
    intrinsics for Math.ceil, floor, rint)
    + JDK-8231841: AArch64: debug.cpp help() is missing an AArch64
    line for pns
    + JDK-8232084: HotSpot build failed with GCC 9.2.1
    + JDK-8232591: AArch64: Add missing match rules for smaddl,
    smsubl and smnegl
    + JDK-8233185: HttpServer.stop() blocks indefinitely when
    called on dispatch thread
    + JDK-8233787: Break cycle in vm_version* includes
    + JDK-8233948: AArch64: Incorrect mapping between OptoReg and
    VMReg for high 64 bits of Vector Register
    + JDK-8234355: Buffer overflow in jcmd GC.class_stats due to
    too many classes
    + JDK-8235368: Update BCEL to Version 6.4.1
    + JDK-8236859: WebSocket over authenticating proxy fails with
    NPE
    + JDK-8236992: AArch64: remove redundant load_klass in itable
    stub
    + JDK-8237743: test/langtools/jdk/jshell/
    /FailOverExecutionControlTest.java fails No
    ExecutionControlProvider with name 'nonExistent' and parameter
    keys: []
    + JDK-8237804: sun/security/mscapi tests fail with "Key pair
    not generated, alias &lt;nnnnnn&gt; already exists"
    + JDK-8238175: CTW: Class.getDeclaredMethods fails with
    assert(k-&gt;is_subclass_of(SystemDictionary::Throwable_klass()))
    failed: invalid exception class
    + JDK-8238567: SoftMainMixer.processAudioBuffers(): Wrong
    handling of stoppedMixers
    + JDK-8238812: assert(false) failed: bad AD file
    + JDK-8239312: [macos] javax/swing/JFrame/NSTexturedJFrame/
    /NSTexturedJFrame.java
    + JDK-8239386: handle ContendedPaddingWidth in
    vm_version_aarch64
    + JDK-8239536: Can't use 'java.util.List' object after
    importing 'java.awt.List'
    + JDK-8240487: Cleanup whitespace in .cc, .hh, .m, and .mm files
    + JDK-8240848: ArrayIndexOutOfBoundsException buf for
    TextCallbackHandler
    + JDK-8241082: Upgrade IANA Language Subtag Registry data to
    03-16-2020 version
    + JDK-8241087: Build failure with VS 2019 (16.5.0) due to C2039
    and C2873
    + JDK-8241101: [s390] jtreg test failure after JDK-8238696: not
    conformant features string
    + JDK-8241248: NullPointerException in
    sun.security.ssl.HKDF.extract(HKDF.java:93)
    + JDK-8241372: Several test failures due to
    javax.net.ssl.SSLException: Connection reset
    + JDK-8241475: AArch64: Add missing support for PopCountVI node
    + JDK-8241829: Cleanup the code for PrinterJob on windows
    + JDK-8241960: The SHA3 message digests impl of SUN provider
    are not thread safe after cloned
    + JDK-8242010: Upgrade IANA Language Subtag Registry to Version
    2020-04-01
    + JDK-8242429: Better implementation for sign extract
    + JDK-8242557: Add length limit for strings in PNGImageWriter
    + JDK-8242919: Paste locks up jshell
    + JDK-8243155: AArch64: Add support for SqrtVF
    + JDK-8243240: AArch64: Add support for MulVB
    + JDK-8243452: JFR: Could not create chunk in repository with
    over 200 recordings
    + JDK-8243559: Remove root certificates with 1024-bit keys
    + JDK-8243597: AArch64: Add support for integer vector abs
    + JDK-8244031: HttpClient should have more tests for HEAD
    requests
    + JDK-8244205: HTTP/2 tunnel connections through proxy may be
    reused regardless of which proxy is selected
    + JDK-8244847: Linux/PPC: runtime/CompressedOops/
    /CompressedClassPointers: smallHeapTest fails
    + JDK-8245511: G1 adaptive IHOP does not account for
    reclamation of humongous objects by young GC
    + JDK-8246274: G1 old gen allocation tracking is not in a
    separate class
    + JDK-8247354: [aarch64] PopFrame causes
    assert(oopDesc::is_oop(obj)) failed: not an oop
    + JDK-8247408: IdealGraph bit check expression canonicalization
    + JDK-8247432: Update IANA Language Subtag Registry to Version
    2020-09-29
    + JDK-8247438: JShell: When FailOverExecutionControlProvider
    fails the proximal cause is not shown
    + JDK-8247753: UIManager.getSytemLookAndFeelClassName() returns
    wrong value on Fedora 32
    + JDK-8248043: Need to eliminate excessive i2l conversions
    + JDK-8248411: [aarch64] Insufficient error handling when
    CodeBuffer is exhausted
    + JDK-8248568: compiler/c2/TestBit.java failed: test missing
    from stdout/stderr
    + JDK-8248870: AARCH64: I2L/L2I conversions can be skipped for
    masked positive values
    + JDK-8249142: java/awt/FontClass/CreateFont/DeleteFont.sh is
    unstable
    + JDK-8249189: AARCH64: more L2I conversions can be skipped
    + JDK-8249719: MethodHandle performance suffers from bad
    ResolvedMethodTable hash function
    + JDK-8249875: GCC 10 warnings -Wtype-limits with JFR code
    + JDK-8250635: MethodArityHistogram should use Compile_lock in
    favour of fancy checks
    + JDK-8250876: Fix issues with cross-compile on macos
    + JDK-8251031: Some vmTestbase/nsk/monitoring/RuntimeMXBean
    tests fail with hostnames starting from digits
    + JDK-8251525: AARCH64: Faster Math.signum(fp)
    + JDK-8252259: AArch64: Adjust default value of FLOATPRESSURE
    + JDK-8252311: AArch64: save two words in itable lookup stub
    + JDK-8252779: compiler/graalunit/HotspotTest.java failed after
    8251525
    + JDK-8252883: AccessDeniedException caused by delayed file
    deletion on Windows
    + JDK-8253167: ARM32 builds fail after JDK-8247910
    + JDK-8253572: [windows] CDS archive may fail to open with long
    file names
    + JDK-8253923: C2 doesn't always run loop opts for compilations
    that include loops
    + JDK-8253948: Memory leak in ImageFileReader
    + JDK-8254631: Better support ALPN byte wire values in SunJSSE
    + JDK-8254717: isAssignableFrom checks in
    KeyFactorySpi.engineGetKeySpec appear to be backwards
    + JDK-8255086: Update the root locale display names
    + JDK-8255625: AArch64: Implement Base64.encodeBlock
    accelerator/intrinsic
    + JDK-8255763: C2: OSR miscompilation caused by invalid memory
    instruction placement
    + JDK-8255992: JFR EventWriter does not use first string from
    StringPool with id 0
    + JDK-8256037: [TESTBUG] com/sun/jndi/dns/ConfigTests/
    /PortUnreachable.java fails due to the hard coded threshold
    is small
    + JDK-8256244: java/lang/ProcessHandle/PermissionTest.java
    fails with TestNG 7.1
    + JDK-8256287: [windows] add loop fuse to
    map_or_reserve_memory_aligned
    + JDK-8256523: Streamline Java SHA2 implementation
    + JDK-8257414: Drag n Drop target area is wrong on high DPI
    systems
    + JDK-8257569: Failure observed with
    JfrVirtualMemory::initialize
    + JDK-8257574: C2: "failed: parsing found no loops but there
    are some" assert failure
    + JDK-8257580: Bump update version for OpenJDK: jdk-11.0.12
    + JDK-8257604: JNI_ArgumentPusherVaArg leaks valist
    + JDK-8257621: JFR StringPool misses cached items across
    consecutive recordings
    + JDK-8257796: [TESTBUG]
    TestUseSHA512IntrinsicsOptionOnSupportedCPU.java fails
    on x86_32
    + JDK-8257822: C2 crashes with SIGFPE due to a division that
    floats above its zero check
    + JDK-8257828: SafeFetch may crash if invoked in non-JavaThreads
    + JDK-8257853: Remove dependencies on JNF's JNI utility
    functions in AWT and 2D code
    + JDK-8257858: [macOS]: Remove JNF dependency from
    libosxsecurity/KeystoreImpl.m
    + JDK-8257860: [macOS]: Remove JNF dependency from
    libosxkrb5/SCDynamicStoreConfig.m
    + JDK-8257988: Remove JNF dependency from
    libsaproc/MacosxDebuggerLocal.m
    + JDK-8258414: OldObjectSample events too expensive
    + JDK-8258505: [TESTBUG] TestDivZeroWithSplitIf.java fails due
    to missing UnlockDiagnosticVMOptions
    + JDK-8258753: StartTlsResponse.close() hangs due to
    synchronization issues
    + JDK-8259061: C2: assert(found) failed: memory-writing node is
    not placed in its original loop or an ancestor of it
    + JDK-8259227: C2 crashes with SIGFPE due to a division that
    floats above its zero check
    + JDK-8259232: Bad JNI lookup during printing
    + JDK-8259276: C2: Empty expression stack when reexecuting
    tableswitch/lookupswitch instructions after deoptimization
    + JDK-8259343: [macOS] Update JNI error handling in Cocoa code.
    + JDK-8259585: Accessible actions do not work on mac os x
    + JDK-8259651: [macOS] Replace JNF_COCOA_ENTER/EXIT macros
    + JDK-8259662: Don't wrap SocketExceptions into SSLExceptions
    in SSLSocketImpl
    + JDK-8259710: Inlining trace leaks memory
    + JDK-8259729: Missed JNFInstanceOf -&gt; IsInstanceOf conversion
    + JDK-8259777: Incorrect predication condition generated by ADLC
    + JDK-8259786: initialize last parameter of getpwuid_r
    + JDK-8259843: initialize dli_fname array before calling
    dll_address_to_library_name
    + JDK-8259869: [macOS] Remove desktop module dependencies on
    JNF Reference APIs
    + JDK-8259886: Improve SSL session cache performance and
    scalability
    + JDK-8259983: do not use uninitialized expand_ms value in
    G1CollectedHeap::expand_heap_after_young_collection
    + JDK-8260030: Improve stringStream buffer handling
    + JDK-8260236: better init AnnotationCollector _contended_group
    + JDK-8260255: C1: LoopInvariantCodeMotion constructor can
    leave some fields uninitialized
    + JDK-8260284: C2: assert(_base == Int) failed: Not an Int
    + JDK-8260380: Upgrade to LittleCMS 2.12
    + JDK-8260420: C2 compilation fails with assert(found_sfpt)
    failed: no node in loop that's not input to safepoint
    + JDK-8260426: awt debug_mem.c DMem_AllocateBlock might leak
    memory
    + JDK-8260432: allocateSpaceForGP in freetypeScaler.c might
    leak memory
    + JDK-8260616: Removing remaining JNF dependencies in the
    java.desktop module
    + JDK-8260653: Unreachable nodes keep speculative types alive
    + JDK-8260707: java/lang/instrument/PremainClass/
    /InheritAgent0100.java times out
    + JDK-8260925: HttpsURLConnection does not work  with other
    JSSE provider.
    + JDK-8260926: Trace resource exhausted events unconditionally
    + JDK-8261020: Wrong format parameter in
    create_emergency_chunk_path
    + JDK-8261027: AArch64: Support for LSE atomics C++ HotSpot code
    + JDK-8261167: print_process_memory_info add a close call after
    fopen
    + JDK-8261170: Upgrade to freetype 2.10.4
    + JDK-8261198: [macOS] Incorrect JNI parameters in number
    conversion in A11Y code
    + JDK-8261235: C1 compilation fails with
    assert(res-&gt;vreg_number() == index) failed: conversion check
    + JDK-8261261: The version extra fields needs to be overridable
    in jib-profiles.js
    + JDK-8261262: Kitchensink24HStress.java crashed with
    EXCEPTION_ACCESS_VIOLATION
    + JDK-8261354: SIGSEGV at MethodIteratorHost
    + JDK-8261355: No data buffering in SunPKCS11 Cipher encryption
    when the underlying mechanism has no padding
    + JDK-8261397: try catch Method failing to work when dividing
    an integer by 0
    + JDK-8261422: Adjust problematic String.format calls in
    jdk/internal/util/Preconditions.java outOfBoundsMessage
    + JDK-8261447: MethodInvocationCounters frequently run into
    overflow
    + JDK-8261481: Cannot read Kerberos settings in dynamic store
    on macOS Big Sur
    + JDK-8261505: Test test/hotspot/jtreg/gc/parallel/
    /TestDynShrinkHeap.java killed by Linux OOM Killer
    + JDK-8261601: free memory in early return in
    Java_sun_nio_ch_sctp_SctpChannelImpl_receive0
    + JDK-8261649: AArch64: Optimize LSE atomics in C++ code
    + JDK-8261730: C2 compilation fails with
    assert(store-&gt;find_edge(load) != -1) failed: missing
    precedence edge
    + JDK-8261752: Multiple GC test are missing memory requirements
    + JDK-8261791: (sctp) handleSendFailed in SctpChannelImpl.c
    potential leaks
    + JDK-8261812: C2 compilation fails with assert(!had_error)
    failed: bad dominance
    + JDK-8261914: IfNode::fold_compares_helper faces
    non-canonicalized bool when running JRuby JSON workload
    + JDK-8262093: java/util/concurrent/tck/JSR166TestCase.java
    failed "assert(false) failed: unexpected node"
    + JDK-8262110: DST starts from incorrect time in 2038
    + JDK-8262121: [11u] Redo 8244287: JFR: Methods samples have
    line number 0
    + JDK-8262163: Extend settings printout in jcmd VM.metaspace
    + JDK-8262295: C2: Out-of-Bounds Array Load from Clone Source
    + JDK-8262298: G1BarrierSetC2::step_over_gc_barrier fails with
    assert "bad barrier shape"
    + JDK-8262446: DragAndDrop hangs on Windows
    + JDK-8262461: handle wcstombsdmp return value correctly in
    unix awt_InputMethod.c
    + JDK-8262465: Very long compilation times and high memory
    consumption in C2 debug builds
    + JDK-8262726: AArch64: C1 StubAssembler::call_RT can corrupt
    stack
    + JDK-8262739: String inflation C2 intrinsic prevents insertion
    of anti-dependencies
    + JDK-8262829: Native crash in
    Win32PrintServiceLookup.getAllPrinterNames()
    + JDK-8262837: handle split_USE correctly
    + JDK-8262900: ToolBasicTest fails to access HTTP server it
    starts
    + JDK-8263260: [s390] Support latest hardware (z14 and z15)
    + JDK-8263311: Watch registry changes for remote printers
    update instead of polling
    + JDK-8263361: Incorrect arraycopy stub selected by C2 for SATB
    collectors
    + JDK-8263404: RsaPrivateKeySpec is always recognized as
    RSAPrivateCrtKeySpec in RSAKeyFactory.engineGetKeySpec
    + JDK-8263425: AArch64: two potential bugs in C1
    LIRGenerator::generate_address()
    + JDK-8263448: CTW: fatal error: meet not symmetric
    + JDK-8263504: Some OutputMachOpcodes fields are uninitialized
    + JDK-8263557: Possible NULL dereference in
    Arena::destruct_contents()
    + JDK-8263558: Possible NULL dereference in fast path arena
    free if ZapResourceArea is true
    + JDK-8263676: AArch64: one potential bug in C1
    LIRGenerator::generate_address()
    + JDK-8263729: [test] divert spurious output away from stream
    under test in ProcessBuilder Basic test
    + JDK-8263846: Bad JNI lookup getFocusOwner in accessibility
    code on Mac OS X
    + JDK-8264047: Duplicate global variable 'jvm' in libjavajpeg
    and libawt
    + JDK-8264096: slowdebug jvm crashes when StrInflatedCopy match
    rule is not supported
    + JDK-8264151: ciMethod::ensure_method_data() should return
    false is loading resulted in empty state
    + JDK-8264173: [s390] Improve Hardware Feature Detection And
    Reporting
    + JDK-8264190: Harden TLS interop tests
    + JDK-8264223: CodeHeap::verify fails extra_hops assertion in
    fastdebug test
    + JDK-8264328: Broken license in
    javax/swing/JComboBox/8072767/bug8072767.java
    + JDK-8264360: Loop strip mining verification fails with
    "should be on the backedge"
    + JDK-8264626: C1 should be able to inline excluded methods
    + JDK-8264640: CMS ParScanClosure misses a barrier
    + JDK-8264786: [macos] All Swing/AWT apps cause Allow
    Notifications prompt to appear when app is launched
    + JDK-8264821: DirectIOTest fails on a system with large block
    size
    + JDK-8264848: [macos] libjvm.dylib linker warning due to macOS
    version mismatch
    + JDK-8264923: PNGImageWriter.write_zTXt throws Exception with
    a typo
    + JDK-8264958: C2 compilation fails with assert "n is later
    than its clone"
    + JDK-8265099: Revert backport to 11u of 8236859: WebSocket
    over authenticating proxy fails with NPE
    + JDK-8265154: vinserti128 operand mix up for KNL platforms
    + JDK-8265239: Shenandoah: Shenandoah heap region count could
    be off by 1
    + JDK-8265417: Backport of JDK-8249672 breaks Solaris x86 build
    + JDK-8265421: java/lang/String/StringRepeat.java test is
    missing a memory requirement
    + JDK-8265462: Handle multiple slots in the NSS Internal Module
    from SunPKCS11's Secmod
    + JDK-8265537: x86 version string truncated after JDK-8249672
    11u backport
    + JDK-8265666: Enable AIX build platform to make external debug
    symbols
    + JDK-8265677: CMS: CardTableBarrierSet::write_ref_array_work()
    lacks storestore barrier
    + JDK-8265690: Use the latest Ubuntu base image version in
    Docker testing
    + JDK-8265718: Build failure after JDK-8258414 11u backport
    + JDK-8265750: Fatal error in safepoint.cpp after backport of
    8258414
    + JDK-8265784: [C2] Hoisting of DecodeN leaves MachTemp inputs
    behind
    + JDK-8265938: C2's conditional move optimization does not
    handle top Phi
    + JDK-8266220: keytool still prompt for store password on a
    password-less pkcs12 file if -storetype pkcs12 is specified
    + JDK-8266293: Key protection using PBEWithMD5AndDES fails with
    "java.security.InvalidAlgorithmParameterException: Salt must
    be 8 bytes long"
    + JDK-8266713: [AIX] Build failure after 11u backport of
    JDK-8247753
    + JDK-8266802: Shenandoah: Round up region size to page size
    unconditionally
    + JDK-8266892: avoid maybe-uninitialized gcc warnings on linux
    s390x
    + JDK-8266929: Unable to use algorithms from 3p providers
    + JDK-8267235: [macos_aarch64]
    InterpreterRuntime::throw_pending_exception messing up LR
    results in crash
    + JDK-8267561: Shenandoah: Reference processing not properly
    setup for outside of cycle degenerated GC
    + JDK-8267599: Revert the change to the default PKCS12
    macAlgorithm and macIterationCount props for 11u/8u/7u
    + JDK-8267641: [11u] 8227609 backport typo
    + JDK-8267721: Enable sun/security/pkcs11 tests for Amazon
    Linux 2 AArch64
    + JDK-8268678: LetsEncryptCA.java test fails as Let's Encrypt
    Authority X3 is retired</changelog>
  <changelog author="schwab@suse.de" date="1628078400">- riscv64-zero.patch: Add support for riscv64 (zero VM)</changelog>
  <changelog author="fstrba@suse.com" date="1629979200">- Added patch:
  * jdk11-glibc234.patch
    + fix build with glibc-2.34 (bsc#1189201)</changelog>
  <changelog author="fstrba@suse.com" date="1631534400">- Modified patch:
  * nss-security-provider.patch
    + revert recent changes making NSS provider the default one
    + fixes bsc#1190252</changelog>
  <changelog author="fstrba@suse.com" date="1631793600">- Added patch:
  * fips.patch
    + implement FIPS support in OpenJDK</changelog>
  <changelog author="fstrba@suse.com" date="1634817600">- Update to upstream tag jdk-11.0.13+8 (October 2021 CPU)
  * Security fixes
    + JDK-8163326, CVE-2021-35550, bsc#1191901: Update the default
    enabled cipher suites preference
    + JDK-8254967, CVE-2021-35565, bsc#1191909:
    com.sun.net.HttpsServer spins on TLS session close
    + JDK-8263314: Enhance XML Dsig modes
    + JDK-8265167, CVE-2021-35556, bsc#1191910: Richer Text Editors
    + JDK-8265574: Improve handling of sheets
    + JDK-8265580, CVE-2021-35559, bsc#1191911: Enhanced style for
    RTF kit
    + JDK-8265776: Improve Stream handling for SSL
    + JDK-8266097, CVE-2021-35561, bsc#1191912: Better hashing
    support
    + JDK-8266103: Better specified spec values
    + JDK-8266109: More Resilient Classloading
    + JDK-8266115: More Manifest Jar Loading
    + JDK-8266137, CVE-2021-35564, bsc#1191913: Improve Keystore
    integrity
    + JDK-8266689, CVE-2021-35567, bsc#1191903: More Constrained
    Delegation
    + JDK-8267086: ArrayIndexOutOfBoundsException in
    java.security.KeyFactory.generatePublic
    + JDK-8267712: Better LDAP reference processing
    + JDK-8267729, CVE-2021-35578, bsc#1191904: Improve TLS client
    handshaking
    + JDK-8267735, CVE-2021-35586, bsc#1191914: Better BMP support
    + JDK-8268193: Improve requests of certificates
    + JDK-8268199: Correct certificate requests
    + JDK-8268205: Enhance DTLS client handshake
    + JDK-8268506: More Manifest Digests
    + JDK-8269618, CVE-2021-35603, bsc#1191906: Better session
    identification
    + JDK-8269624: Enhance method selection support
    + JDK-8270398: Enhance canonicalization
    + JDK-8270404: Better canonicalization
  * Other changes
    + JDK-8024368: private methods are allocated vtable indices
    + JDK-8042902: Test java/net/Inet6Address/serialize/
    /Inet6AddressSerializationTest.java fails intermittently
    + JDK-8140466: ChaCha20 and Poly1305 TLS Cipher Suites
    + JDK-8157404: Unable to read certain PKCS12 keystores from
    SequenceInputStream
    + JDK-8158066: SourceDebugExtensionTest fails to rename file
    + JDK-8168304: Make all of DependencyContext_test available in
    product mode
    + JDK-8169246: java/net/DatagramSocket/ReportSocketClosed.java
    fails intermittently with BindException
    + JDK-8181313: SA: Remove libthread_db dependency on Linux
    + JDK-8193214: Incorrect annotations.without.processors
    warnings with JDK 9
    + JDK-8194230: jdk/internal/jrtfs/remote/
    /RemoteRuntimeImageTest.java fails with
    java.lang.NullPointerException
    + JDK-8196092: javax/swing/JComboBox/8032878/bug8032878.java
    fails
    + JDK-8199931: java/net/MulticastSocket/
    /UnreferencedMulticastSockets.java fails with "incorrect data
    received"
    + JDK-8206083: Make tools/javac/api/T6265137.java robust to JDK
    version changes
    + JDK-8206350: java/util/Locale/bcp47u/SystemPropertyTests.java
    failed on Mac 10.13 with zh_CN and zh_TW locales.
    + JDK-8207316: java/nio/channels/spi/SelectorProvider/
    /inheritedChannel/InheritedChannelTest.java failed
    + JDK-8208227: tools/jdeps/DotFileTest.java fails on Win-X64
    + JDK-8208363: test/jdk/java/lang/Package/
    /PackageFromManifest.java missing module dependencies
    declaration
    + JDK-8209380: ARM: cleanup maybe-uninitialized and reorder
    compiler warnings
    + JDK-8209768: Refactor java/util/prefs/CheckUserPrefsStorage.sh
    to plain java test
    + JDK-8209772: Refactor shell test java/util/ServiceLoader/
    /basic/basic.sh to java
    + JDK-8209773: Refactor shell test javax/naming/module/basic.sh
    to java
    + JDK-8209832: Refactor jdk/internal/reflect/Reflection/
    /GetCallerClassTest.sh to plain java test
    + JDK-8209930: Refactor java/util/zip/ZipFile/deletetempjar.sh
    to plain java test
    + JDK-8210406: Refactor java.util.PluggableLocale:i18n shell
    tests to plain java tests
    + JDK-8210407: Refactor java.util.Calendar:i18n shell tests to
    plain java tests
    + JDK-8210495: compiler crashes because of illegal signature in
    otherwise legal code
    + JDK-8210669: Some launcher tests assume a pre-JDK 9 run-time
    image layout
    + JDK-8210802: temp files left by tests in
    jdk/java/net/httpclient
    + JDK-8210819: Update the host name in CNameTest.java
    + JDK-8210908: Refactor java/util/prefs/PrefsSpi.sh to plain
    java test
    + JDK-8210934: Move sun/net/www/protocol/http/
    /GetErrorStream.java to OpenJDK
    + JDK-8210959: JShell fails and exits when statement throws an
    exception whose message contains a '%'.
    + JDK-8211055: Provide print to a file (PDF) feature even when
    printer was not connected
    + JDK-8211092: test/jdk/sun/net/www/http/HttpClient/
    /MultiThreadTest.java fails intermittently when cleaning up
    + JDK-8211296: Remove HotSpot deprecation warning suppression
    for Mac/clang
    + JDK-8211325: test/jdk/java/net/Socket/LingerTest.java fails
    with cleaning up
    + JDK-8212040: Compilation error due to wrong usage of
    NSPrintJobDispositionValue in mac10.12
    + JDK-8212695: Add explicit timeout to several HTTP Client tests
    + JDK-8212718: Refactor some annotation processor tests to
    better use collections
    + JDK-8213007: Update the link in test/jdk/sun/security/
    /provider/SecureRandom/DrbgCavp.java
    + JDK-8213137: Remove static initialization of monitor/mutex
    instances
    + JDK-8213235: java/nio/channels/SocketChannel/
    /AsyncCloseChannel.java fails with threads that didn't exit
    + JDK-8213409: Refactor sun.text.IntHashtable:i18n shell tests
    to plain java tests
    + JDK-8213576: Make test AsyncCloseChannel.java run in othervm
    + JDK-8213694: Test Timeout.java should run in othervm mode
    + JDK-8213718: [TEST] Wrong classname in vmTestbase/nsk/stress/
    /except/except002 and except003
    + JDK-8213922: fix ctw stand-alone build
    + JDK-8214195: Align stdout messages in
    test/jdk/java/math/BigInteger/PrimitiveConversionTests.java
    + JDK-8214520: [TEST_BUG] sun/security/mscapi/nonUniqueAliases/
    /NonUniqueAliases.java failed with incorrect jtreg tags order
    + JDK-8214937: sun/security/tools/jarsigner/warnings/
    /NoTimestampTest.java failed due to unexpected expiration date
    + JDK-8216532: tools/launcher/Test7029048.java fails (Solaris)
    + JDK-8217825: Verify @AfterTest is used correctly in WebSocket
    tests
    + JDK-8218145: block_if_requested is not proper inlined due to
    size
    + JDK-8219417: bump jtreg requiredVersion to b14
    + JDK-8219552: bump jtreg requiredVersion to b14 in
    test/jdk/sanity/client/
    + JDK-8219804: java/net/MulticastSocket/Promiscuous.java fails
    intermittently due to NumberFormatException
    + JDK-8220445: Support for side by side MSVC Toolset versions
    + JDK-8221988: add possibility to build with Visual Studio 2019
    + JDK-8222751: closed/test/jdk/sun/security/util/
    /DerIndefLenConverter/IndefBerPkcs12.java fail
    + JDK-8223050: JVMCI: findUniqueConcreteMethod() should not use
    Dependencies::find_unique_concrete_method() for non-virtual
    methods
    + JDK-8224853: CDS address sanitizer errors
    + JDK-8225082: Remove IdenTrust certificate that is expiring in
    September 2021
    + JDK-8225583: Examine the HttpResponse.BodySubscribers for
    null handling and multiple subscriptions
    + JDK-8225690: Multiple AttachListener threads can be created
    + JDK-8225790: Two NestedDialogs tests fail on Ubuntu
    + JDK-8226319: Add forgotten test/jdk/java/net/httpclient/
    /BodySubscribersTest.java
    + JDK-8226533: JVMCI: findUniqueConcreteMethod should handle
    statically bindable methods directly
    + JDK-8226602: Test convenience reactive primitives from
    java.net.http with RS TCK
    + JDK-8226683: Remove review suggestion from fix to 8219804
    + JDK-8227738: jvmti/DataDumpRequest/datadumpreq001 failed due
    to "exit code is 134"
    + JDK-8227766: CheckUnhandledOops is broken in MemAllocator
    + JDK-8227815: Minimal VM: set_state is not a member of
    AttachListener
    + JDK-8230674: Heap dumps should exclude dormant CDS archived
    objects of unloaded classes
    + JDK-8230808: Remove Access::equals()
    + JDK-8230841: Remove oopDesc::equals()
    + JDK-8231717: Improve performance of charset decoding when
    charset is always compactable
    + JDK-8232243: Wrong caret position in JTextPane on Windows
    with a screen resolution &gt; 100%
    + JDK-8232782: Shenandoah: streamline post-LRB CAS barrier
    (aarch64)
    + JDK-8233790: Forward output from heap dumper to jcmd/jmap
    + JDK-8233989: Create an IPv4 version of
    java/net/MulticastSocket/SetLoopbackMode.java
    + JDK-8234510: Remove file seeking requirement for writing a
    heap dump
    + JDK-8235211: serviceability/attach/
    /RemovingUnixDomainSocketTest.java fails with
    AttachNotSupportedException: Unable to open socket file
    + JDK-8235216: typo in test filename
    + JDK-8235866: bump jtreg requiredVersion to 4.2b16
    + JDK-8236111: narrow allowSmartActionArgs disabling
    + JDK-8236413: AbstractConnectTimeout should tolerate both
    NoRouteToHostException and UnresolvedAddressException
    + JDK-8236671: NullPointerException in JKS keystore
    + JDK-8238930: problem list compiler/c2/Test8004741.java
    + JDK-8238943: switch to jtreg 5.0
    + JDK-8240555: Using env of JAVA_TOOL_OPTIONS and _JAVA_OPTIONS
    breaks QuietOption.java test
    + JDK-8240983: Incorrect copyright header in Apache Santuario
    2.1.3 files
    + JDK-8241336: Some java.net tests failed with
    NoRouteToHostException on MacOS with special network
    configuration
    + JDK-8241353: NPE in ToolProvider.getSystemJavaCompiler
    + JDK-8241768: git needs .gitattributes
    + JDK-8242882: opening jar file with large manifest might throw
    NegativeArraySizeException
    + JDK-8244973: serviceability/attach/
    /RemovingUnixDomainSocketTest.java fails "stderr was not
    empty"
    + JDK-8245134: test/lib/jdk/test/lib/security/
    /KeyStoreUtils.java should allow to specify aliases
    + JDK-8246261: TCKLocalTime.java failed due to "AssertionError:
    expected [18:14:22] but found [18:14:23]"
    + JDK-8246387: switch to jtreg 5.1
    + JDK-8247421: [TESTBUG] ReturnBlobToWrongHeapTest.java failed
    allocating blob
    + JDK-8247469: getSystemCpuLoad() returns -1 on linux when some
    offline cpus are present and cpusets.effective_cpus is not
    available
    + JDK-8248352: [TEST_BUG] Test test/jdk/java/awt/font/
    /TextLayout/ArabicDiacriticTest.java can leave frame open
    + JDK-8248403: AArch64: Remove uses of kernel integer types
    + JDK-8248414: AArch64: Remove uses of long and unsigned long
    ints
    + JDK-8248657: Windows: strengthening in ThreadCritical
    regarding memory model
    + JDK-8248666: AArch64: Use THREAD_LOCAL instead of __thread
    + JDK-8248668: AArch64: Avoid MIN/MAX macros when using MSVC
    + JDK-8248671: AArch64: Remove unused variables
    + JDK-8248682: AArch64: Use ATTRIBUTE_ALIGNED helper
    + JDK-8248816: C1: Fix signature conflict in
    LIRGenerator::strength_reduce_multiply
    + JDK-8249095: tools/javac/launcher/SourceLauncherTest.java
    fails on Windows
    + JDK-8249548: backward focus traversal gets stuck in button
    group
    + JDK-8249773: Upgrade ReceiveISA.java test to be resilient to
    failure due to stray packets and interference
    + JDK-8249897: jdk/javadoc/tool/LangVers.java uses @ignore w/o
    bug-id
    + JDK-8249898: jdk/javadoc/tool/6176978/T6176978.java uses
    @ignore w/o bug-id
    + JDK-8249899: jdk/javadoc/tool/InlineTagsWithBraces.java uses
    @ignore w/o bug-id
    + JDK-8250588: Shenandoah: LRB needs to save/restore fp
    registers for runtime call
    + JDK-8250824: AArch64: follow up for JDK-8248414
    + JDK-8251166: Add automated testcases for changes done in
    JDK-8214112
    + JDK-8251252: Add automated testcase for fix done in
    JDK-8214253
    + JDK-8251254: Add automated test for fix done in JDK-8218472
    + JDK-8251361: Potential race between Logger configuration and
    GCs in HttpURLConWithProxy test
    + JDK-8251549: Update docs on building for Git
    + JDK-8251945: SIGSEGV in
    PackageEntry::purge_qualified_exports()
    + JDK-8252194: Add automated test for fix done in JDK-8218469
    + JDK-8252648: Shenandoah: name gang tasks consistently
    + JDK-8252825: Add automated test for fix done in JDK-8218479
    + JDK-8252853: AArch64: gc/shenandoah/TestVerifyJCStress.java
    fails intermittently with C1
    + JDK-8252857: AArch64: Shenandoah C1 CAS is not sequentially
    consistent
    + JDK-8253048: AArch64: When CallLeaf, no need to preserve
    callee-saved registers in caller
    + JDK-8253424: Add support for running pre-submit testing using
    GitHub Actions
    + JDK-8253631: Remove unimplemented CompileBroker methods after
    JEP-165
    + JDK-8253865: Pre-submit testing using GitHub Actions does not
    detect failures reliably
    + JDK-8253899: Make IsClassUnloadingEnabled signature match
    specification
    + JDK-8254024: Enhance native libs for AWT and Swing to work
    with GraalVM Native Image
    + JDK-8254054: Pre-submit testing using GitHub Actions should
    not use the deprecated set-env command
    + JDK-8254173: Add Zero, Minimal hotspot targets to submit
    workflow
    + JDK-8254175: Build no-pch configuration in debug mode for
    submit checks
    + JDK-8254244: Some code emitted by TemplateTable::branch is
    unused when running TieredCompilation
    + JDK-8254270: linux 32 bit build doesn't compile
    libjdwp/log_messages.c
    + JDK-8254282: Add Linux x86_32 builds to submit workflow
    + JDK-8254850: Update terminology in java.awt.GridBagLayout
    source code comments
    + JDK-8255255: Update Apache Santuario (XML Signature) to
    version 2.2.1
    + JDK-8255305: Add Linux x86_32 tier1 to submit workflow
    + JDK-8255352: Archive important test outputs in submit workflow
    + JDK-8255373: Submit workflow artifact name is always
    "test-results_.zip"
    + JDK-8255452: Doing GC during JVMTI MethodExit event posting
    breaks return oop
    + JDK-8255718: Zero: VM should know it runs in interpreter-only
    mode
    + JDK-8255790: GTKL&amp;F: Java 16 crashes on initialising GTKL&amp;F
    on Manjaro Linux
    + JDK-8255810: Zero: build fails without JVMTI
    + JDK-8255895: Submit workflow artifacts miss hs_errs/replays
    due to ZIP include mismatch
    + JDK-8256127: Add cross-compiled foreign architectures builds
    to submit workflow
    + JDK-8256215: Shenandoah: re-organize saving/restoring machine
    state in assembler code
    + JDK-8256267: Relax compiler/floatingpoint/NaNTest.java for
    x86_32 and lower -XX:+UseSSE
    + JDK-8256277: Github Action build on macOS should define OS
    and Xcode versions
    + JDK-8256354: Github Action build on Windows should define OS
    and MSVC versions
    + JDK-8256393: Github Actions build on Linux should define OS
    and GCC versions
    + JDK-8256414: add optimized build to submit workflow
    + JDK-8256747: GitHub Actions: decouple the hotspot build-only
    jobs from Linux x64 testing
    + JDK-8257056: Submit workflow should apt-get update to avoid
    package installation errors
    + JDK-8257148: Remove obsolete code in AWTView.m
    + JDK-8257497: Update keytool to create AKID from the SKID of
    the issuing certificate as specified by RFC 5280
    + JDK-8257620: Do not use objc_msgSend_stret to get macOS
    version
    + JDK-8257913: Add more known library locations to simplify
    Linux cross-compilation
    + JDK-8258703: Incorrect 512-bit vector registers restore on
    x86_32
    + JDK-8259338: Add expiry exception for identrustdstx3 alias to
    VerifyCACerts.java test
    + JDK-8259535: ECDSA SignatureValue do not always have the
    specified length
    + JDK-8259679: GitHub actions should use MSVC 14.28
    + JDK-8259924: GitHub actions fail on Linux x86_32 with "Could
    not configure libc6:i386"
    + JDK-8260460: GitHub actions still fail on Linux x86_32 with
    "Could not configure libc6:i386"
    + JDK-8260589: Crash in JfrTraceIdLoadBarrier::load(_jclass*)
    + JDK-8260923: Add more tests for SSLSocket input/output
    shutdown
    + JDK-8261072: AArch64: Fix MacroAssembler::get_thread
    convention
    + JDK-8261147: C2: Node is wrongly marked as reduction
    resulting in a wrong execution due to wrong vector instructions
    + JDK-8261238: NMT should not limit baselining by size threshold
    + JDK-8261496: Shenandoah: reconsider pacing updates memory
    ordering
    + JDK-8261652: Remove some dead comments from os_bsd_x86
    + JDK-8261846: [JVMCI] c2v_iterateFrames can get out of sync
    with the StackFrameStream
    + JDK-8262000: jdk/jfr/event/gc/detailed/
    /TestPromotionFailedEventWithParallelScavenge.java failed with
    "OutOfMemoryError: Java heap space"
    + JDK-8262017: C2: assert(n != __null) failed: Bad immediate
    dominator info.
    + JDK-8262392: Update Mesa 3-D Headers to version 21.0.3
    + JDK-8262409: sun/security/ssl/SSLSocketImpl/
    /SSLSocketImplThrowsWrongExceptions. SSL test failures caused
    by java failed with "Server reported the wrong exception"
    + JDK-8262470: Printed GlyphVector outline with low DPI has bad
    quality on Windows
    + JDK-8262862: Harden tests sun/security/x509/URICertStore/
    /ExtensionsWithLDAP.java and krb5/canonicalize/Test.java
    + JDK-8263136: C4530 was reported from VS 2019 at access bridge
    + JDK-8263227: C2: inconsistent spilling due to dead nodes in
    exception block
    + JDK-8263382: java/util/logging/ParentLoggersTest.java failed
    with "checkLoggers: getLoggerNames() returned unexpected
    loggers"
    + JDK-8263407: SPARC64 detection fails on Athena (SPARC64-X)
    + JDK-8263432: javac may report an invalid package/class clash
    on case insensitive filesystems
    + JDK-8263490: [macos] Crash occurs on JPasswordField with
    activated InputMethod
    + JDK-8263531: Remove unused buffer int
    + JDK-8263667: Avoid running GitHub actions on branches named
    pr/*
    + JDK-8263776: [JVMCI] add helper to perform Java upcalls
    + JDK-8264016: [JVMCI] add some thread local fields for use by
    JVMCI
    + JDK-8264752: SIGFPE crash with option
    FlightRecorderOptions:threadbuffersize=30M
    + JDK-8265132: C2 compilation fails with assert "missing
    precedence edge"
    + JDK-8265231: (fc) ReadDirect and WriteDirect tests fail after
    fix for JDK-8264821
    + JDK-8265335: Epsilon: Minor typo in EpsilonElasticTLABDecay
    description
    + JDK-8265756: AArch64: initialize memory allocated for locals
    according to Windows AArch64 stack page growth requirement in
    template interpreter
    + JDK-8265761: Font with missed font family name is not
    properly printed on Windows
    + JDK-8265773: incorrect jdeps message "jdk8internals" to
    describe a removed JDK internal API
    + JDK-8265836: OperatingSystemImpl.getCpuLoad() returns
    incorrect CPU load inside a container
    + JDK-8266018: Shenandoah: fix an incorrect assert
    + JDK-8266206: Build failure after JDK-8264752 with older GCCs
    + JDK-8266248: Compilation failure in
    PLATFORM_API_MacOSX_MidiUtils.c with Xcode 12.5
    + JDK-8266288: assert root method not found in
    witnessed_reabstraction_in_supers is too strong
    + JDK-8266404: Fatal error report generated with
  - XX:+CrashOnOutOfMemoryError should not contain suggestion to
    submit a bug report
    + JDK-8266480: Implicit null check optimization does not update
    control of hoisted memory operation
    + JDK-8266615: C2 incorrectly folds subtype checks involving an
    interface array
    + JDK-8266642: Improve ResolvedMethodTable hash function
    + JDK-8266749: AArch64: Backtracing broken on PAC enabled
    systems
    + JDK-8266761: AssertionError in
    sun.net.httpserver.ServerImpl.responseCompleted
    + JDK-8266813: Shenandoah: Use shorter instruction sequence for
    checking if marking in progress
    + JDK-8267042: bug in monitor locking/unlocking on ARM32 C1 due
    to uninitialized BasicObjectLock::_displaced_header
    + JDK-8267348: Rewrite gc/epsilon/TestClasses.java to use
    Metaspace with less classes
    + JDK-8267396: Avoid recording "pc" in unhandled oops detector
    for better performance
    + JDK-8267399: C2: java/text/Normalizer/ConformanceTest.java
    test failed with assertion
    + JDK-8267424: CTW: C1 fails with "State must not be null"
    + JDK-8267459: Pasting Unicode characters into JShell does not
    work.
    + JDK-8267625: AARCH64: typo in LIR_Assembler::emit_profile_type
    + JDK-8267666: Add option to jcmd GC.heap_dump to use existing
    file
    + JDK-8267695: Bump update version for OpenJDK: jdk-11.0.13
    + JDK-8267751: (test) jtreg.SkippedException has no serial
    VersionUID
    + JDK-8267773: PhaseStringOpts::int_stringSize doesn't handle
    min_jint correctly
    + JDK-8268103: JNI functions incorrectly return a double after
    JDK-8265836
    + JDK-8268127: Shenandoah: Heap size may be too small for
    region to align to large page size
    + JDK-8268261: C2: assert(n != __null) failed: Bad immediate
    dominator info.
    + JDK-8268347: C2: nested locks optimization may create
    unbalanced monitor enter/exit code
    + JDK-8268360: Missing check for infinite loop during node
    placement
    + JDK-8268362: [REDO] C2 crash when compile negative
    Arrays.copyOf length after loop
    + JDK-8268366: Incorrect calculation of has_fpu_registers in C1
    linear scan
    + JDK-8268369: SIGSEGV in PhaseCFG::implicit_null_check due to
    missing null check
    + JDK-8268417: Add test from JDK-8268360
    + JDK-8268427: Improve AlgorithmConstraints:checkAlgorithm
    performance
    + JDK-8268617: [11u REDO] - WebSocket over authenticating proxy
    fails with NPE
    + JDK-8268620: InfiniteLoopException test may fail on x86
    platforms
    + JDK-8268635: Corrupt oop in ClassLoaderData
    + JDK-8268699: Shenandoah: Add test for JDK-8268127
    + JDK-8268771: javadoc -notimestamp option does not work on
    index.html
    + JDK-8268775: Password is being converted to String in
    AccessibleJPasswordField
    + JDK-8268776: Test `ADatagramSocket.java` missing /othervm
    from @run tag
    + JDK-8268965: TCP Connection Reset when connecting simple
    socket to SSL server
    + JDK-8269304: Regression ~5% in 2005 in b27
    + JDK-8269415: [11u] Remove ea from
    DEFAULT_PROMOTED_VERSION_PRE in OpenJDK 11u
    + JDK-8269478: Shenandoah: gc/shenandoah/mxbeans tests should
    be more resilient
    + JDK-8269529: javax/swing/reliability/
    /HangDuringStaticInitialization.java fails in Windows debug
    build
    + JDK-8269594: assert(_handle_mark_nesting &gt; 1) failed: memory
    leak: allocating handle outside HandleMark
    + JDK-8269614: [s390] Interpreter checks wrong bit for slow
    path instance allocation
    + JDK-8269650: Optimize gc-locker in
    [Get|Release]StringCritical for latin string
    + JDK-8269661: JNI_GetStringCritical does not lock char array
    + JDK-8269668: [aarch64] java.library.path not including
    /usr/lib64
    + JDK-8269763: The JEditorPane is blank after JDK-8265167
    + JDK-8269795: C2: Out of bounds array load floats above its
    range check in loop peeling resulting in SEGV
    + JDK-8269847: JDK-8269594 backport breaks 11u builds
    + JDK-8269850: Most JDK releases report macOS version 12 as
    10.16 instead of 12.0
    + JDK-8269851: OperatingSystemMXBean getProcessCpuLoad reports
    incorrect process cpu usage in containers
    + JDK-8269882: stack-use-after-scope in NewObjectA
    + JDK-8269934: RunThese24H.java failed with
    EXCEPTION_ACCESS_VIOLATION in
    java_lang_Thread::get_thread_status
    + JDK-8270096: Shenandoah: Optimize gc/shenandoah/
    /TestRefprocSanity.java for interpreter mode
    + JDK-8270137: Kerberos Credential Retrieval from Cache not
    Working in Cross-Realm Setup
    + JDK-8270184: [TESTBUG] Add coverage for jvmci
    ResolvedJavaType.toJavaName() for lambdas
    + JDK-8270196: [11u] [JVMCI] JavaType.toJavaName() returns
    incorrect type name for lambdas
    + JDK-8270556: Exclude security/infra/java/security/cert/
    /CertPathValidator/certification/LetsEncryptCA
    + JDK-8270893: IndexOutOfBoundsException while reading large
    TIFF file
    + JDK-8272078: Wrong Checksums in Temurin BootJDK dependencies
    + JDK-8272124: Cgroup v1 initialization causes
    NullPointerException when cgroup path contains colon
    + JDK-8272131: PhaseMacroExpand::generate_slow_arraycopy crash
    when clone null CallProjections.fallthrough_ioproj
    + JDK-8272197: Update 11u GHA workflow with Shenandoah
    configurations
    + JDK-8272332: --with-harfbuzz=system doesn't add -lharfbuzz
    after JDK-8255790
    + JDK-8272472: StackGuardPages test doesn't build with glibc
    2.34
    + JDK-8272602: [macos] not all KEY_PRESSED events sent when
    control modifier is used
    + JDK-8272628: Problemlist gc/stress/gcbasher/
    /TestGCBasherWithCMS.java for x86_32
    + JDK-8272700: [macos] Build failure with Xcode 13.0 after
    JDK-8264848
    + JDK-8272772: Shenandoah: compiler/c2/aarch64/
    /TestVolatilesShenandoah.java fails in 11u
    + JDK-8273939: Backport of 8248414 to JDK11 breaks
    MacroAssembler::adrp
- Remove the unneeded icedtea-sound provider
- Removed patches:
  * icedtea-sound-1.0.1-jdk9.patch
  * icedtea-sound-soundproperties.patch
    + not needed since the icedtea-sound provider is removed
  * jdk11-glibc234.patch
    + integrated upstream</changelog>
  <changelog author="fstrba@suse.com" date="1635940800">- Modified patches:
  * system-crypto-policy.patch
    + rediff to changed context
  * fips.patch
    + Allow plain key import in fips mode unless
    com.suse.fips.plainKeySupport is set to false</changelog>
  <changelog author="fstrba@suse.com" date="1636113600">- Modified patch:
  * fips.patch
    + return in native code after generating java.io.IOException</changelog>
</package>
<package pkgid="f555770bc08624780f52982840d99fb72529ae49b561bbd8b8adf295ef610e26" name="java-11-openjdk" arch="s390x">
  <version epoch="0" ver="11.0.13.0" rel="3.68.1"/>
  <changelog author="fstrba@suse.com" date="1586952000">- The pack200 and unpack200 alternatives should be slaves of java
  and not of javac, since they are part of JRE.</changelog>
  <changelog author="fstrba@suse.com" date="1587470400">- Update to upstream tag jdk-11.0.7+10 (April 2020 CPU,
  bsc#1169511)
  * Security fixes:
    + S8223898, CVE-2020-2754: Forward references to Nashorn
    + S8223904, CVE-2020-2755: Improve Nashorn matching
    + S8224541, CVE-2020-2756: Better mapping of serial ENUMs
    + S8224549, CVE-2020-2757: Less Blocking Array Queues
    + S8225603: Enhancement for big integers
    + S8226346: Build better binary builders
    + S8227467: Better class method invocations
    + S8227542: Manifest improved jar headers
    + S8229733: TLS message handling improvements
    + S8231415, CVE-2020-2773: Better signatures in XML
    + S8231785: Improved socket permissions
    + S8232424, CVE-2020-2778: More constrained algorithms
    + S8232581, CVE-2020-2767: Improve TLS verification
    + S8233250: Better X11 rendering
    + S8233410: Better Build Scripting
    + S8234027: Better JCEKS key support
    + S8234408, CVE-2020-2781: Improve TLS session handling
    + S8234825, CVE-2020-2800: Better Headings for HTTP Servers
    + S8234841, CVE-2020-2803: Enhance buffering of byte buffers
    + S8235274, CVE-2020-2805: Enhance typing of methods
    + S8235691, CVE-2020-2816: Enhance TLS connectivity
    + S8236201, CVE-2020-2830: Better Scanner conversions
    + S8238960: linux-i586 builds are inconsistent as the newly
    built jdk is not able to reserve enough space for object heap
  * Other changes:
    + S4919790: Errors in alert ssl message does not reflect the
    actual certificate status
    + S4949105: Access Bridge lacks html tags parsing
    + S7092821: java.security.Provider.getService() is synchronized
    and became scalability bottleneck
    + S7143743: Potential memory leak with zip provider
    + S8005819: Support cross-realm MSSFU
    + S8042383: [TEST_BUG] Test javax/swing/plaf/basic/BasicMenuUI/
    /4983388/bug4983388.java fails with shortcuts on menus do not
    work
    + S8068184: Fix for JDK-8032832 caused a deadlock
    + S8145845: [AOT] NullPointerException in
    compiler/whitebox/GetCodeHeapEntriesTest.java
    + S8152988: [AOT] Update test batch definitions to include
    aot-ed java.base module mode into hs-comp testing
    + S8160926: FLAGS_COMPILER_CHECK_ARGUMENTS doesn't handle
    cross-compilation
    + S8163083: SocketListeningConnector does not allow invocations
    with port 0
    + S8163251: Hard coded loop limit prevents reading of smart
    card data greater than 8k
    + S8167276: jvmci/compilerToVM/MaterializeVirtualObjectTest.java
    fails with -XX:-EliminateAllocations
    + S8169718: nsk/jdb/locals/locals002: ERROR: Cannot find
    boolVar with expected value: false
    + S8176556:
    java/awt/dnd/ImageTransferTest/ImageTransferTest.java fails
    for JFIF
    + S8178798: Two compiler/aot/verification/vmflags tests fail by
    timeout with UseAVX=3
    + S8183107: PKCS11 regression regarding checkKeySize
    + S8185005: Improve performance of
    ThreadMXBean.getThreadInfo(long ids[], int maxDepth)
    + S8189633: Missing -Xcheck:jni checking for DeleteWeakGlobalRef
    + S8189861: Refactor CacheFind
    + S8193042: NativeLookup::lookup_critical_entry() should only
    load shared library once
    + S8193596: java/net/DatagramPacket/ReuseBuf.java failed due to
    timeout
    + S8194944: Regression automated test 'open/test/jdk/javax/
    /swing/JInternalFrame/8145896/TestJInternalFrameMaximize.java'
    fails
    + S8196467: javax/swing/JInternalFrame/Test6325652.java fails
    + S8196969: JTreg Failure: serviceability/sa/ClhsdbJstack.java
    causes NPE
    + S8198321: javax/swing/JEditorPane/5076514/bug5076514.java
    fails
    + S8198398: Test javax/swing/JColorChooser/Test6199676.java
    fails in mach5
    + S8199072: Test javax/swing/GroupLayout/6613904/
    /bug6613904.java is unstable
    + S8200432: javadoc fails with ClassCastException on {@link
    byte[]}
    + S8201349: build broken when configured with
  - -with-zlib=bundled on gcc 7.3
    + S8201355: Avoid native memory allocation in
    sun.security.mscapi.PRNG.generateSeed
    + S8201513: nsk/jvmti/IterateThroughHeap/filter-* are broken
    + S8203364: Some serviceability/sa/ tests intermittently fail
    with java.io.IOException: LingeredApp terminated with non-zero
    exit code 3
    + S8203687: javax/net/ssl/compatibility/Compatibility.java
    supports TLS 1.3
    + S8203904: javax/swing/JSplitPane/4816114/bug4816114.java: The
    divider location is wrong
    + S8203911: Test runtime/modules/getModuleJNI/GetModule fails
    with -Xcheck:jni
    + S8204525: [TESTBUG] runtime/NMT/MallocStressTest.java ran out
    of java heap
    + S8204529: gc/TestAllocateHeapAtMultiple.java fail with Agent
    7 timed out
    + S8204551: Event descriptions are truncated in logs
    + S8206963: [AOT] bug with multiple class loaders
    + S8207367: 10 vmTestbase/nsk/jdi tests timed out when running
    with jtreg
    + S8207832: serviceability/sa/ClhsdbCDSCore.java failed with
    "Couldn't find core file location"
    + S8207938: At step6,Click Add button,case failed automatically.
    + S8208157: requires.VMProps throws NPE for missing properties
    in "release" file
    + S8208379: compiler/jvmci/events/
    /JvmciNotifyInstallEventTest.java failed with "Got unexpected
    event count after 2nd install attempt: expected 9 to equal 2"
    + S8208658: Make CDS archived heap regions usable even if
    compressed oop encoding has changed
    + S8208715: Conversion of milliseconds to nanoseconds in
    UNIXProcess contains bug
    + S8209361: [AOT] Unexpected number of references for
    JVMTI_HEAP_REFERENCE_CONSTANT_POOL [111--&gt;111]: 0 (expected
    at least 1)
    + S8209385: CDS runtime classpath checking is too strict when
    only classes from the system modules are archived
    + S8209389: SIGSEGV in WalkOopAndArchiveClosure::do_oop_work.
    + S8209418: Synchronize test/jdk/sanity/client/lib/jemmy with
    code-tools/jemmy/v2
    + S8209494: Create a test for SwingSet InternalFrameDemo
    + S8209499: Create test for SwingSet EditorPaneDemo
    + S8209574: [AOT] breakpoint events are generated in different
    threads does not meet expected count
    + S8209686: cleanup arguments to PhaseIdealLoop() constructor
    + S8209789: Synchronize test/jdk/sanity/client/lib/jemmy with
    code-tools/jemmy/v2
    + S8209802: Garbage collectors should register JFR types
    themselves to avoid build errors.
    + S8209807: improve handling exception in requires.VMProps
    + S8209817: stack is executable when building with Clang on
    Linux
    + S8209824: Improve the code coverage for ThreadLocal
    + S8209826: Undefined reference to os::write after JDK-8209657
    (filemap.hpp cleanup)
    + S8209850: Allow NamedThreads to use GlobalCounter critical
    sections
    + S8209976: Improve iteration over non-JavaThreads
    + S8209993: Create a test for SwingSet3 ToolTipDemo
    + S8210024: JFR calls virtual is_Java_thread from ~Thread()
    + S8210052: Enable testing for all the available look and feels
    in SwingSet3 demo tests
    + S8210055: Enable different look and feel tests in SwingSet3
    demo tests
    + S8210057: Enable different look and feels in SwingSet3 demo
    test InternalFrameDemoTest
    + S8210058: Algorithmic Italic font leans opposite angle in
    Printing
    + S8210220: [AOT] jdwp test cases are failing with error #
    ERROR: TEST FAILED: Cought IOException while receiving event
    packet
    + S8210289: ArchivedKlassSubGraphInfoRecord is incomplete
    + S8210459: Add support for generating compile_commands.json
    + S8210476: sun/security/mscapi/PrngSlow.java fails with Still
    too slow
    + S8210512: [Testbug] vmTestbase/nsk/jdi/ObjectReference/
    /referringObjects/referringObjects002/referringObjects002.java
    fails with unexpected size of
    ClassLoaderReference.referringObjects
    + S8210523: runtime/appcds/cacheObject/DifferentHeapSizes.java
    crash
    + S8210632: Add key exchange algorithm to
    javax/net/ssl/TLSCommon/CipherSuite.java
    + S8210699: Problem list tests which times out in Xcomp mode
    + S8210793: [JVMCI] AllocateCompileIdTest.java failed to find
    DiagnosticCommand.class
    + S8210910: Create test for FileChooserDemo
    + S8210994: Create test for SwingSet3 FrameDemo
    + S8211139: Increase timeout value in all tests under
    jdk/sanity/client/SwingSet/src
    + S8211160: Handle different look and feels in
    JInternalFrameOperator
    + S8211211: vmTestbase/metaspace/stressDictionary/
    /StressDictionary.java timeout
    + S8211322: Reduce the timeout of tooltip in SwingSet2DemoTest
    + S8211443: Enable different look and feels in SwingSet3 demo
    test SplitPaneDemoTest
    + S8211703: JInternalFrame : java.lang.AssertionError: cannot
    find the internal frame
    + S8211781: re-building fails after changing Graal sources
    + S8212897: Some improvements in the EditorPaneDemotest
    + S8212903: [TestBug] Tests test/jdk/javax/swing/LookAndFeel/
    /8145547/DemandGTK2.sh and DemandGTK3.sh fail on Ubuntu 18.04
    LTS
    + S8213009: Refactoring existing SunMSCAPI classes
    + S8213010: Supporting keys created with certmgr.exe
    + S8213168: Enable different look and feel tests in SwingSet3
    demo test FileChooserDemoTest
    + S8213348: jdk.internal.vm.compiler.management service
    providers missing in module descriptor
    + S8213906: Update arm devkits with libXrandr headers
    + S8213908: AssertionError in DeferredAttr at setOverloadKind
    + S8214124: [TESTBUG] Bugs in runtime/NMT/MallocStressTest.java
    + S8214344: C2: assert(con.basic_type() != T_ILLEGAL) failed:
    elembt=byte; loadbt=void; unsigned=0
    + S8214345: infinite recursion while checking super class
    + S8214471: Enable different look and feel tests in SwingSet3
    demo test ToolTipDemoTest
    + S8214534: Setting of THIS_FILE in the build is broken
    + S8214557: Filter out VM flags which don't affect AOT code
    generation
    + S8214578: [macos] Problem with backslashes on macOS/JIS
    keyboard: Java ignores system settings
    + S8214840: runtime/NMT/MallocStressTest.java timed out
    + S8214850: Rename vm_operations.?pp files to vmOperations.?pp
    files
    + S8214904: Test8004741.java failed due to "Too few ThreadDeath
    hits; expected at least 6 but saw only 5"
    + S8215322: add @file support to jaotc
    + S8215355: Object monitor deadlock with no threads holding the
    monitor (using jemalloc 5.1)
    + S8215396: JTabbedPane preferred size calculation is wrong for
    SCROLL_TAB_LAYOUT
    + S8216180: [AOT] compiler/intrinsics/bigInteger/TestMulAdd.java
    crashed with AOT enabled
    + S8216353: Use utility APIs introduced in org/netbeans/jemmy/
    /util/LookAndFeel class in client sanity test cases
    + S8216354: Syntax error in toolchain_windows.m4
    + S8216472: (se) Stack overflow during selection operation
    leads to crash (win)
    + S8216535: tools/jimage/JImageExtractTest.java timed out
    + S8217235: Create automated test for SwingSet
    ColorChooserDemoTest
    + S8217297: Add support for multiple look and feel for SwingSet
    SliderDemoTest
    + S8217338: [Containers] Improve systemd slice memory limit
    support
    + S8217613: [AOT] TEST_OPTS_AOT_MODULES doesn't work on mac
    + S8217634: RunTest documentation and usability update
    + S8217717: ZGC: Broken oop map in C1 load barrier stub
    + S8217728: Speed up incremental rerun of "make hotspot"
    + S8218268: Javac treats Manifest Class-Path entries as Paths
    instead of URLs
    + S8218662: Allow 204 responses with Content-Length:0
    + S8218882: NET_Writev is declared, NET_WriteV is defined
    + S8218889: Improperly use of the Optional API
    + S8219205: JFR file without license header
    + S8219597: (bf) Heap buffer state changes could provoke
    unexpected exceptions
    + S8219723: javax/net/ssl/compatibility/Compatibility.java
    failed on some SNI cases
    + S8220348: [ntintel] asserts about copying unaligned array
    + S8220451: jdi/EventQueue/remove/remove004 failed due to
    "ERROR: thread2 is not alive"
    + S8220456: jdi/EventQueue/remove_l/remove_l004 failed due to
    "TIMEOUT while waiting for event"
    + S8220479: java/nio/channels/Selector/SelectWithConsumer.java
    failed at testTwoChannels()
    + S8220613: java/util/Arrays/TimSortStackSize2.java times out
    with fastdebug build
    + S8220688: [TESTBUG] runtime/NMT/MallocStressTest.java timed
    out
    + S8220786: Create new switch to redirect error reporting
    output to stdout or stderr
    + S8221270: Duplicated synchronized keywords in SSLSocketImpl
    + S8221312: test/jdk/sanity/client/SwingSet/src/
    /ColorChooserDemoTest.java failed
    + S8221851: Use of THIS_FILE in hotspot invalidates precompiled
    header on Linux/GCC
    + S8221885: Add intermittent test in the JavaSound to the
    ProblemList
    + S8222264: Windows incremental build is broken with JDK-8217728
    + S8222391: javax/net/ssl/compatibility/Compatibility.java
    should be more flexible
    + S8222448: java/lang/reflect/PublicMethods/
    /PublicMethodsTest.java times out
    + S8222519: ButtonDemoScreenshotTest fails randomly with "still
    state to be reached"
    + S8222741: jdi/EventQueue/remove/remove004 fails due to
    VMDisconnectedException
    + S8223003: SunMSCAPI keys are not cleaned up
    + S8223063: Support CNG RSA keys
    + S8223158: Docked MacBook cannot start any Java Swing
    applications
    + S8223260: NamingManager should cache InitialContextFactory
    + S8223464: Improve version string for Oracle CI builds
    + S8223558: Java does not render Myanmar script correctly
    + S8223627: jdk-13+20 bundle name contains null instead of ea
    + S8223638: Replace wildcard address with loopback or local
    host in tests - part 6
    + S8223678: Add Visual Studio Code workspace generation support
    (for native code)
    + S8223727: com/sun/jndi/ldap/privconn/RunTest.java failed due
    to hang in LdapRequest.getReplyBer
    + S8223769: Assert triggers with -XX:+StressReflectiveCode
    + S8224187: Refactor arraycopy_prologue to allow ZGC read
    barriers on arraycopy
    + S8224475: JTextPane does not show images in HTML rendering
    + S8224673: Adjust permission for delayed starting of debugging
    + S8224705: Tests that need to be problem-listed or have
    printer resources
    + S8224778: test/jdk/demo/jfc/J2Ddemo/J2DdemoTest.java cannot
    find J2Ddemo.jar
    + S8224821: java/awt/Focus/NoAutotransferToDisabledCompTest/
    /NoAutotransferToDisabledCompTest.java fails linux-x64
    + S8224830: test/jdk/java/awt/Focus/
    /ModalExcludedWindowClickTest/
    /ModalExcludedWindowClickTest.java fails on linux-x64
    + S8224851: AArch64: fix warnings and errors with Clang and GCC
    8.3
    + S8224905: java/lang/ProcessBuilder/Basic.java#id1 failed with
    stream closed
    + S8225007: java/awt/print/PrinterJob/
    /LandscapeStackOverflow.java may hang
    + S8225105: java/awt/Focus/ShowFrameCheckForegroundTest/
    /ShowFrameCheckForegroundTest.java fails in Windows 10
    + S8225117: java/math/BigInteger/SymmetricRangeTests.java fails
    with ParseException
    + S8225128: Add exception for expiring DocuSign root to
    VerifyCACerts test
    + S8225130: Add exception for expiring Comodo roots to
    VerifyCACerts test
    + S8225144: [macos] In Aqua L&amp;F backspace key does not delete
    when Shift is pressed
    + S8225180: SignedObject with invalid Key not throwing the
    InvalidKeyException in Windows
    + S8225182: JNI exception pending in DestroyXIMCallback of
    awt_InputMethod.c:1327
    + S8225199: [Graal] compiler/jvmci/compilerToVM/
    /IsMatureVsReprofileTest.java fails with
  - XX:CompileThresholdScaling=0.1
    + S8225305: ProblemList java/lang/invoke/VarHandles tests
    + S8225350: compiler/jvmci/compilerToVM/IsCompilableTest.java
    timed out
    + S8225430: Replace wildcard address with loopback or local
    host in tests - part 14
    + S8225435: Upgrade IANA Language Subtag Registry to the latest
    for JDK14
    + S8225487: giflib legal file is missing attribution for
    openbsd-reallocarray.c
    + S8225567: Wrong file headers with 8202414 fix changeset
    + S8225684: [AOT] vmTestbase/vm/oom/production/
    /AlwaysOOMProduction tests fail with AOTed java.base
    + S8225766: Curve in certificate should not affect signature
    scheme when using TLSv1.3
    + S8225797: OldObjectSample event creates unexpected amount of
    checkpoint data
    + S8226381: ProblemList java/lang/reflect/PublicMethods/
    /PublicMethodsTest.java
    + S8226406: JVM fails to detect mismatched or corrupt CDS
    archive
    + S8226608: Hide the onjcmd option from the help output
    + S8226892: ActionListeners on JRadioButtons don't get notified
    when selection is changed with arrow keys
    + S8227112: exclude compiler/intrinsics/sha/sanity tests from
    AOT runs
    + S8227324: Upgrade to freetype 2.10.1
    + S8227528: TestAbortVMOnSafepointTimeout.java failed due to
    "RuntimeException: 'Safepoint sync time longer than' missing
    from stdout/stderr"
    + S8227645: Some tests in serviceability/sa run with fixed -Xmx
    values and risk running out of memory
    + S8227646: [TESTBUG] appcds/SharedArchiveConsistency timed out
    + S8227662: freetype seeks to index at the end of the font data
    + S8228479: Correct the format of ColorChooserDemoTest
    + S8228613: java.security.Provider#getServices order is no
    longer deterministic
    + S8228969: 2019-09-28 public suffix list update
    + S8229236: CriticalJNINatives: dll handling should be done in
    native thread state
    + S8229345: Memory leak due to vtable stubs not being shared on
    SPARC
    + S8229888: (zipfs) Updating an existing zip file does not
    preserve original permissions
    + S8229994: assert(false) failed: Bad graph detected in
    get_early_ctrl_for_expensive
    + S8230004: jdk/internal/jimage/JImageOpenTest.java runs no test
    + S8230235: Rendering HTML with empty img attribute and
    documentBaseKey cause Exception
    + S8230390: Problemlist SA tests with AOT
    + S8230400: Missing constant pool entry for a method in
    stacktrace
    + S8230459: Test failed to resume JVMCI CompilerThread
    + S8230480: check malloc/calloc results in java.desktop
    + S8230597: Update GIFlib library to the 5.2.1
    + S8230611: infinite loop in
    LogOutputList::wait_until_no_readers()
    + S8230624: [TESTBUG] Problemlist JFR
    compiler/TestCodeSweeper.java
    + S8230677: Should disable Escape Analysis if JVMTI capability
    can_get_owned_monitor_info was taken
    + S8230926: [macosx] Two apostrophes are entered instead of one
    with "U.S. International - PC" layout
    + S8231025: Incorrect method tag offset for big endian platform
    + S8231081: TestMetadataRetention fails due to missing symbol id
    + S8231387: java.security.Provider.getService returns random
    result due to race condition with mutating methods in the same
    class
    + S8231430: C2: Memory stomp in max_array_length() for
    T_ILLEGAL type
    + S8231445: check ZALLOC return values in awt coding
    + S8231507: Update Apache Santuario (XML Signature) to version
    2.1.4
    + S8231584: Deadlock with ClassLoader.findLibrary and
    System.loadLibrary call
    + S8231753: use more Posix functionality in aix
    os::print_os_info
    + S8231810: javax/net/ssl/templates/
    /SSLSocketSSLEngineTemplate.java fails intermittently with
    "java.lang.Exception: Unexpected EOF"
    + S8232003: (fs) Files.write can leak file descriptor in the
    exception case
    + S8232056: GetOwnedMonitorInfoWithEATest.java fails with ZGC:
    Heap too small
    + S8232060: add some initializations using sigemptyset in
    os_aix.cpp
    + S8232154: Update Mesa 3-D Headers to version 19.2.1
    + S8232167: Visual Studio install found through
  - -with-tools-dir value is discarded
    + S8232170: FSInfo#getJarClassPath throws an exception not
    declared in its throws clause
    + S8232200: [macos 10.15] Windows in fullscreen tests jumps
    around the screen
    + S8232207: Linux os::available_memory re-reads cgroup
    configuration on every invocation
    + S8232224: [TESTBUG] problemlist JFR TestLargeRootSet.java
    + S8232370: Refactor some com.sun.jdi tests to enable IDE
    integration
    + S8232433: [macos 10.15] java/awt/Window/
    /LocationAtScreenCorner/LocationAtScreenCorner.java may fail
    + S8232571: Add missing SIGINFO signal
    + S8232692: [TESTBUG] compiler/aot/fingerprint/
    /SelfChangedCDS.java fails when cds is disabled
    + S8232713: Update BCEL version to 6.3.1 in license file
    + S8232806: Introduce a system property to disable eager lambda
    initialization
    + S8232834: RunTest sometimes fails to produce valid
    exitcode.txt
    + S8232880: Update test documentation with additional settings
    for client UI tooltip tests
    + S8232950: SUNPKCS11 Provider incorrectly check key length for
    PSS Signatures.
    + S8233018: Add a new test to verify that DatagramSocket is not
    interruptible
    + S8233019: java.lang.Class.isPrimitive() (C1) returns wrong
    result if Klass* is aligned to 32bit
    + S8233032: assert(in_bb(n)) failed: must be
    + S8233078: fix minimal VM build on Linux ppc64(le)
    + S8233328: fix minimal VM build on Linux s390x
    + S8233383: Various minor fixes
    + S8233466: aarch64: remove unnecessary load of mdo when
    profiling return and parameters type
    + S8233491: Crash in AdapterHandlerLibrary::get_adapter with
    CDS due to code cache exhaustion
    + S8233529: loopTransform.cpp:2984: Error: assert(p_f-&gt;Opcode()
    == Op_IfFalse) failed
    + S8233548: Update CUP to v0.11b
    + S8233649: Update ProblemList.txt to exclude failing headful
    tests on macos
    + S8233656: assert(d-&gt;is_CFG() &amp;&amp; n-&gt;is_CFG()) failed: must
    have CFG nodes
    + S8233657: Intermittent NPE in Component.validate()
    + S8234288: Turkey Time Zone returns incorrect time zone name
    + S8234323: NULL-check return value of SurfaceData_InitOps on
    macosx
    + S8234339: replace JLI_StrTok in java_md_solinux.c
    + S8234340: Bump update version for OpenJDK: jdk-11.0.7
    + S8234350: assert(mode == ControlAroundStripMined &amp;&amp; (use ==
    sfpt || !use-&gt;is_reachable_from_root())) failed: missed a node
    + S8234386: [macos] NPE was thrown at expanding Choice from
    maximized frame
    + S8234397: add OS uptime information to os::print_os_info
    output
    + S8234423: Modifying ArrayList.subList().subList() resets
    modCount of subList
    + S8234466: Class loading deadlock involving
    X509Factory#commitEvent()
    + S8234501: remove obsolete NET_ReadV
    + S8234525: enable link-time section-gc for linux s390x to
    remove unused code
    + S8234610: MaxVectorSize set wrongly when UseAVX=3 is
    specified after JDK-8221092
    + S8234617: C1: Incorrect result of field load due to missing
    narrowing conversion
    + S8234723: javax/net/ssl/TLS tests support TLSv1.3
    + S8234724: javax/net/ssl/templates/
    /SSLSocketSSLEngineTemplate.java supports TLSv1.3
    + S8234741: enhance os::get_core_path on macOS
    + S8234769: Duplicate attribution in freetype.md
    + S8234786: Fix for JDK-8214578 breaks OS X 10.12 compatibility
    + S8234809: set relro in linker flags when building with gcc
    + S8234824: java/nio/channels/SocketChannel/AdaptSocket.java
    fails on Windows 10
    + S8235243: handle VS2017 15.9 and VS2019 in abstract_vm_version
    + S8235288: AVX 512 instructions inadvertently used on Xeon for
    small vector width operations
    + S8235325: build failure on Linux after 8235243
    + S8235383: C1 compilation fails with
  - XX:+PrintIRDuringConstruction -XX:+Verbose
    + S8235489: handle return values of sscanf calls in hotspot
    + S8235509: Backport for JDK-8209657 Refactor filemap.hpp to
    simplify integration with Serviceability Agent.
    + S8235510: java.util.zip.CRC32 performance drop after 8200067
    + S8235563: [TESTBUG] appcds/CommandLineFlagComboNegative.java
    does not handle archive mapping failure
    + S8235637: jhsdb jmap from OpenJDK 11.0.5 doesn't work if
    prelink is enabled
    + S8235671: enhance print_rlimit_info in os_posix
    + S8235744: PIT: test/jdk/javax/swing/text/html/
    /TestJLabelWithHTMLText.java times out in linux-x64
    + S8235904: Infinite loop when rendering huge lines
    + S8235998: [c2] Memory leaks during tracing after '8224193:
    stringStream should not use Resource Area'.
    + S8236039: JSSE Client does not accept status_request
    extension in CertificateRequest messages for TLS 1.3
    + S8236140: assert(!VerifyHashTableKeys || _hash_lock == 0)
    failed: remove node from hash table before modifying it
    + S8236179: C1 register allocation error with T_ADDRESS
    + S8236488: Support for configure option
  - -with-native-debug-symbols=internal is impossible on Windows
    + S8236500: Windows ucrt.dll should be looked up in versioned
    WINSDK subdirectory
    + S8236709: struct SwitchRange in HS violates C++ One
    Definition Rule
    + S8236848: [JDK 11u] make run-test-tier1 fails after backport
    of JDK-8232834
    + S8236873: Worker has a deadlock bug
    + S8237217: Incorrect G1StringDedupEntry type used in
    StringDedupTable destructor
    + S8237368: Problem with NullPointerException in RMI
    TCPEndpoint.read
    + S8237375: SimpleThresholdPolicy misses CounterDecay timestamp
    initialization
    + S8237508: Simplify JarFile.isInitializing
    + S8237540: Missing files in backport of JDK-8210910
    + S8237541: Missing files in backport of JDK-8236528
    + S8237600: Test SunJSSEFIPSInit fails on Ubuntu
    + S8237819: s390x - remove unused pd_zero_to_words_large
    + S8237869: exclude jtreg test security/infra/java/security/
    /cert/CertPathValidator/certification/LuxTrustCA.java because
    of instabilities
    + S8237879: make 4.3 breaks build
    + S8237945: CTW: C2 compilation fails with
    assert(just_allocated_object(alloc_ctl) == ptr) failed: most
    recent allo...
    + S8238225: Issues reported after replacing symlink at
    Contents/MacOS/libjli.dylib with binary
    + S8238247: CTW runner should sweep nmethods more aggressively
    + S8238366: CTW runner closes standard output on exit
    + S8238438: SuperWord::co_locate_pack picks memory state of
    first instead of last load
    + S8238502: sunmscapi.dll causing EXCEPTION_ACCESS_VIOLATION
    + S8238534: Deep sign macOS bundles before bundle archive is
    being created
    + S8238591: CTW: Split
    applications/ctw/modules/jdk_localedata.java
    + S8238596: AVX enabled by default for Skylake even when
    unsupported
    + S8238811: C2: assert(i &gt;= req() || i == 0 || is_Region() ||
    is_Phi()) with -XX:+VerifyGraphEdges
    + S8239005: [TESTBUG] test/hotspot/jtreg/runtime/
    /StackGuardPages/TestStackGuardPages.java: exeinvoke.c: must
    initialize static state before calling do_overflow()
    + S8239466: Loss of precision in counter decay calculation in
    11u backport of JDK-8237375
    + S8239856: [ntintel] asserts about copying unaligned array
    element
    + S8240724: [test] jdk11 downport of 8224475 misses binary file
    test/jdk/javax/swing/JTextPane/arrow.png
    + S8241296: Segfault in JNIHandleBlock::oops_do()
- Removed patch:
  * DependOnVariableHelper.patch
    + fixed upstream
- Added patch:
  * JDK-8228407.patch
    + fix crashes due to shared archive file mismatch</changelog>
  <changelog author="fstrba@suse.com" date="1594900800">- Update to upstream tag jdk-11.0.8+10 (July 2020 CPU, bsc#1174157)
  * Security fixes:
    + JDK-8230613: Better ASCII conversions
    + JDK-8231800: Better listing of arrays
    + JDK-8232014: Expand DTD support
    + JDK-8233234: Better Zip Naming
    + JDK-8233239, CVE-2020-14562: Enhance TIFF support
    + JDK-8233255: Better Swing Buttons
    + JDK-8234032: Improve basic calendar services
    + JDK-8234042: Better factory production of certificates
    + JDK-8234418: Better parsing with CertificateFactory
    + JDK-8234836: Improve serialization handling
    + JDK-8236191: Enhance OID processing
    + JDK-8236867, CVE-2020-14573: Enhance Graal interface handling
    + JDK-8237117, CVE-2020-14556: Better ForkJoinPool behavior
    + JDK-8237592, CVE-2020-14577: Enhance certificate verification
    + JDK-8238002, CVE-2020-14581: Better matrix operations
    + JDK-8238013: Enhance String writing
    + JDK-8238804: Enhance key handling process
    + JDK-8238842: AIOOBE in GIFImageReader.initializeStringTable
    + JDK-8238843: Enhanced font handing
    + JDK-8238920, CVE-2020-14583: Better Buffer support
    + JDK-8238925: Enhance WAV file playback
    + JDK-8240119, CVE-2020-14593: Less Affine Transformations
    + JDK-8240482: Improved WAV file playback
    + JDK-8241379: Update JCEKS support
    + JDK-8241522: Manifest improved jar headers redux
    + JDK-8242136, CVE-2020-14621: Better XML namespace handling
  * Other changes:
    + JDK-6933331: (d3d/ogl) java.lang.IllegalStateException:
    Buffers have not been created
    + JDK-7124307: JSpinner and changing value by mouse
    + JDK-8022574: remove HaltNode code after uncommon trap calls
    + JDK-8039082: [TEST_BUG] Test
    java/awt/dnd/BadSerializationTest/BadSerializationTest.java
    fails
    + JDK-8040630: Popup menus and tooltips flicker with previous
    popup contents when first shown
    + JDK-8044365: (dc) MulticastSendReceiveTests.java failing with
    ENOMEM when joining group (OS X 10.9)
    + JDK-8048215: [TESTBUG]
    java/lang/management/ManagementFactory/ThreadMXBeanProxy.java
    Expected non-null LockInfo
    + JDK-8051349: nsk/jvmti/scenarios/sampling/SP06/sp06t003 fails
    in nightly
    + JDK-8080353: JShell: Better error message on attempting to
    add default method
    + JDK-8139876: Exclude hanging nsk/stress/stack from execution
    with deoptimization enabled
    + JDK-8146090: java/lang/ref/ReachabilityFenceTest.java fails
    with -XX:+DeoptimizeALot
    + JDK-8153430: jdk regression test MletParserLocaleTest,
    ParserInfiniteLoopTest reduce default timeout
    + JDK-8156207: Resource allocated BitMaps are often cleared
    unnecessarily
    + JDK-8159740: JShell: corralled declarations do not have
    correct source to wrapper mapping
    + JDK-8175984: ICC_Profile has un-needed, not-empty finalize
    method
    + JDK-8176359: Frame#setMaximizedbounds not working properly in
    multi screen environments
    + JDK-8183369: RFC unconformity of HttpURLConnection with proxy
    + JDK-8187078: -XX:+VerifyOops finds numerous problems when
    running JPRT
    + JDK-8189861: Refactor CacheFind
    + JDK-8191169: java/net/Authenticator/B4769350.java failed
    intermittently
    + JDK-8191930: [Graal] emits unparseable XML into compile log
    + JDK-8193879: Java debugger hangs on method invocation
    + JDK-8196019: java/awt/Window/Grab/GrabTest.java fails on
    Windows
    + JDK-8196181: sun/java2d/GdiRendering/InsetClipping.java fails
    + JDK-8198000:
    java/awt/List/EmptyListEventTest/EmptyListEventTest.java
    debug assert on Windows
    + JDK-8198001: java/awt/Menu/WrongParentAfterRemoveMenu/
    /WrongParentAfterRemoveMenu.java debug assert on Windows
    + JDK-8198339: Test javax/swing/border/Test6981576.java is
    unstable
    + JDK-8200701: jdk/jshell/ExceptionsTest.java fails on Windows,
    after JDK-8198801
    + JDK-8203264: JNI exception pending in
    PlainDatagramSocketImpl.c:740
    + JDK-8203672: JNI exception pending in PlainSocketImpl.c
    + JDK-8203673: JNI exception pending in
    DualStackPlainDatagramSocketImpl.c:398
    + JDK-8204834: Fix confusing "allocate" naming in OopStorage
    + JDK-8205399: Set node color on pinned HashMap.TreeNode
    deletion
    + JDK-8205653: test/jdk/sun/management/jmxremote/bootstrap/
    /RmiRegistrySslTest.java and RmiSslBootstrapTest.sh fail with
    handshake_failure
    + JDK-8206179: com/sun/management/OperatingSystemMXBean/
    /GetCommittedVirtualMemorySize.java fails with Committed
    virtual memory size illegal value
    + JDK-8207334: VM times out in VM_HandshakeAllThreads::doit()
    with RunThese30M
    + JDK-8208277: Code cache heap (-XX:ReservedCodeCacheSize)
    doesn't work with 1GB LargePages
    + JDK-8209113: Use WeakReference for lastFontStrike for created
    Fonts
    + JDK-8209333: Socket reset issue for TLS 1.3 socket close
    + JDK-8209439: C2 library_call can potentially ignore Math.pow
    intrinsic or use null pointer
    + JDK-8209534: [TESTBUG]runtime/appcds/cacheObject/
    /ArchivedModuleCompareTest.java fails with EnableJVMCI.
    + JDK-8210147: adjust some WSAGetLastError usages in windows
    network coding
    + JDK-8210284: "assert((av &amp; 0x00000001) == 0) failed:
    unsupported V8" on Solaris 11.4
    + JDK-8210303: VM_HandshakeAllThreads fails assert with
    "failed: blocked and not walkable"
    + JDK-8210459: Add support for generating compile_commands.json
    + JDK-8210515: [TESTBUG]CheckArchivedModuleApp.java needs to
    check if EnableJVMCI is set.
    + JDK-8210788: Javadoc for Thread.join(long, int) should
    specify that it waits forever when both arguments are zero
    + JDK-8211301: [macos] support full window content options
    + JDK-8211332: Space for stub routines (code_size2) is too
    small on new Skylake CPUs
    + JDK-8211339: NPE during SSL handshake caused by
    HostnameChecker
    + JDK-8211392: compiler/profiling/
    /spectrapredefineclass_classloaders/Launcher.java times out
    in JDK12 CI
    + JDK-8211743: [AOT] crash in ScopeDesc::decode_body() when
    JVMTI walks AOT frames
    + JDK-8212154: [TESTBUG] CheckArchivedModuleApp fails with NPE
    when JVMCI is absent
    + JDK-8212167: JShell : Stack trace of exception has wrong line
    number
    + JDK-8212933: Thread-SMR: requesting a VM operation whilst
    holding a ThreadsListHandle can cause deadlocks
    + JDK-8212986: Make Visual Studio compiler check less strict
    + JDK-8213250: CDS archive creation aborts due to metaspace
    object allocation failure
    + JDK-8213516: jck test api/javax_accessibility/AccessibleState/
    /fields.html fails intermittent
    + JDK-8213947: ARM32: failed check_simd should set
    UsePopCountInstruction to false
    + JDK-8214418: half-closed SSLEngine status may cause
    application dead loop
    + JDK-8214440: ldap over a TLS connection negotiate failed with
    "javax.net.ssl.SSLPeerUnverifiedException: hostname of the
    server does not match the hostname in the server's
    certificate"
    + JDK-8214444: Wrong strncat limits in dfa.cpp
    + JDK-8214481: freetype path does not disable TrueType hinting
    with AA+FM hints
    + JDK-8214571: -Xdoclint of array serialField gives "error:
    array type not allowed here"
    + JDK-8214856: Errors with JSZip in web console after upgrade
    to 3.1.5
    + JDK-8214862: assert(proj != __null) at compile.cpp:3251
    + JDK-8215369: Jcstress pollute /var/tmp with temporary files.
    + JDK-8215551: Missing case label in nmethod::reloc_string_for()
    + JDK-8215555: TieredCompilation C2 threads can excessively
    block handshakes
    + JDK-8215711: Missing key_share extension for (EC)DHE key
    exchange should alert missing_extension
    + JDK-8216151: [Graal] Module
    jdk.internal.vm.compiler.management has not been granted
    accessClassInPackage.org.graalvm.compiler.debug
    + JDK-8216154: C4819 warnings at HotSpot sources on Windows
    + JDK-8216541: CompiledICHolders of VM locked unloaded nmethods
    are released too late
    + JDK-8217230: assert(t == t_no_spec) failure in
    NodeHash::check_no_speculative_types()
    + JDK-8217404: --with-jvm-features doesn't work when multiple
    features are explicitly disabled
    + JDK-8217447: Develop flag TraceICs is broken
    + JDK-8217606: LdapContext#reconnect always opens a new
    connection
    + JDK-8218807: Compilation database (compile_commands.json) may
    contain obsolete items
    + JDK-8219214: Infinite Loop in CodeSection::dump()
    + JDK-8219904: ClassCastException when calling
    FlightRecorderMXBean#getRecordings()
    + JDK-8219991: New fix of the deadlock in
    sun.security.ssl.SSLSocketImpl
    + JDK-8221121: applications/microbenchmarks are encountering
    crashes in tier5
    + JDK-8221445: FastSysexMessage constructor crashes MIDI
    receiption thread
    + JDK-8221482: Initialize VMRegImpl::regName[] earlier to
    prevent assert during PrintStubCode
    + JDK-8221741: ClassCastException can happen when
    fontconfig.properties is used
    + JDK-8221823: Requested JDialog width is ignored
    + JDK-8223108: Test java/awt/EventQueue/
    /NonComponentSourcePost.java is unstable
    + JDK-8223678: Add Visual Studio Code workspace generation
    support (for native code)
    + JDK-8223935: PIT: java/awt/font/WindowsIndicFonts.java fails
    on windows10
    + JDK-8224109: Text spaced incorrectly by drawString under
    rotation with fractional metric
    + JDK-8224632: testbug: java/awt/dnd/RemoveDropTargetCrashTest/
    /RemoveDropTargetCrashTest.java fails on MacOS
    + JDK-8224793: os::die() does not honor CreateCoredumpOnCrash
    option
    + JDK-8224847: gc/stress/TestReclaimStringsLeaksMemory.java
    fails with reserved greater than expected
    + JDK-8224931: disable JAOTC invokedynamic support until
    8223533 is fixed
    + JDK-8224997: ChaCha20-Poly1305 TLS cipher suite decryption
    throws ShortBufferException
    + JDK-8225068: Remove DocuSign root certificate that is
    expiring in May 2020
    + JDK-8225069: Remove Comodo root certificate that is expiring
    in May 2020
    + JDK-8225126: Test SetBoundsPaintTest.html faild on Windows
    when desktop is scaled
    + JDK-8225325: Add tests for redefining a class' private method
    during resolution of the bootstrap specifier
    + JDK-8225622: [AOT] runtime/SharedArchiveFile/
    /TestInterpreterMethodEntries.java crashed with AOTed
    java.base
    + JDK-8225653: Provide more information when hitting SIGILL
    from HaltNode
    + JDK-8225783: Incorrect use of binary operators on booleans in
    type.cpp
    + JDK-8225789: Empty method parameter type should generate
    ClassFormatError
    + JDK-8226198: use of &amp; instead of &amp;&amp; in
    LibraryCallKit::arraycopy_restore_alloc_state
    + JDK-8226253: JAWS reports wrong number of radio buttons when
    buttons are hidden.
    + JDK-8226653: [accessibility] Can edit text cell correctly,
    but Accessibility Tool reads nothing about editor
    + JDK-8226806: [macOS 10.14] Methods of Java Robot should be
    called from appropriate thread
    + JDK-8226879: Memory leak in Type::hashcons
    + JDK-8227632: Incorrect PrintCompilation message: made not
    compilable on levels 0 1 2 3 4
    + JDK-8228407: JVM crashes with shared archive file mismatch
    + JDK-8228482: fix xlc16/xlclang comparison of distinct pointer
    types and string literal conversion warnings
    + JDK-8228757: Fail fast if the handshake type is unknown
    + JDK-8229158: make UseSwitchProfiling non-experimental or
    false by-default
    + JDK-8229421: The logic of java/net/ipv6tests/TcpTest.java is
    flawed
    + JDK-8229855: C2 fails with assert(false) failed: bad AD file
    + JDK-8230591: AArch64: Missing intrinsics for Math.ceil,
    floor, rint
    + JDK-8231118: ARM32: Math tests failures
    + JDK-8231213: Migrate SimpleDateFormatConstTest to JDK Repo
    + JDK-8231243: [TESTBUG] CustomFont.java cannot find font file
    + JDK-8231438: [macOS] Dark mode for the desktop is not
    supported
    + JDK-8231550: C2: ShouldNotReachHere() in
    verify_strip_mined_scheduling
    + JDK-8231564: setMaximizedBounds is broken with large display
    scale and multiple monitors
    + JDK-8231572: Use -lobjc instead of -fobjc-link-runtime in
    libosxsecurity
    + JDK-8231631: sun/net/ftp/FtpURLConnectionLeak.java fails
    intermittently with NPE
    + JDK-8231671: Fix copyright headers in hotspot (missing comma
    after year)
    + JDK-8231720: Some perf regressions after 8225653
    + JDK-8231779: crash
    HeapWord*ParallelScavengeHeap::failed_mem_allocate
    + JDK-8231863: Crash if classpath is read from @argument file
    and the main gets option argument
    + JDK-8232080: jlink plugins for vendor information and
    run-time options
    + JDK-8232106: [x86] C2: SIGILL due to usage of SSSE3
    instructions on processors which don't support it
    + JDK-8232134: Change to Visual Studio 2017 15.9.16 for
    building on Windows at Oracle
    + JDK-8232226: [macos 10.15] test/jdk/java/awt/color/
    /EqualityTest/EqualityTest.java may fail
    + JDK-8232357: Compare version info of Santuario to legal notice
    + JDK-8232572: Add hooks for custom output dir in Bundles.gmk
    + JDK-8232634: Problem List ICMColorDataTest.java
    + JDK-8232748: Build static versions of certain JDK libraries
    + JDK-8232846: ProcessHandle.Info command with non-English
    shows question marks
    + JDK-8232880: Update test documentation with additional
    settings for client UI tooltip tests
    + JDK-8233033: C2 produces wrong result while unswitching a
    loop due to lost control dependencies
    + JDK-8233137: runtime/ErrorHandling/VeryEarlyAssertTest.java
    fails after 8232080
    + JDK-8233197: Invert JvmtiExport::post_vm_initialized() and
    Jfr:on_vm_start() start-up order for correct option parsing
    + JDK-8233291: [TESTBUG] tools/jlink/plugins/
    /VendorInfoPluginsTest.java fails with debug or non-server VMs
    + JDK-8233364: Fix undefined behavior in
    Canonicalizer::do_ShiftOp
    + JDK-8233494: Avoid calling MallocTracker::record_malloc and
    record_free when NMT is off
    + JDK-8233573: Toolkit.getScreenInsets(GraphicsConfiguration)
    may throw ClassCastException
    + JDK-8233608: Minimal build broken after JDK-8233494
    + JDK-8233621: Mismatch in jsse.enableMFLNExtension property
    name
    + JDK-8233696: [TESTBUG]Some jtreg tests fail when CAPS_LOCK is
    ON
    + JDK-8233707: systemScale.cpp could not compile with VS2019
    + JDK-8233801: GCMEmptyIv.java test fails on Solaris 11.4
    + JDK-8233880: Support compilers with multi-digit major version
    numbers
    + JDK-8233920: MethodHandles::tryFinally generates illegal
    bytecode for long/double return type
    + JDK-8234137: The "AutoTestOnTop.java" test may run external
    applications
    + JDK-8234146: compiler/jsr292/
    /ContinuousCallSiteTargetChange.java times out on SPARC
    + JDK-8234184: [TESTBUG] java/awt/Mouse/EnterExitEvents/
    /ModalDialogEnterExitEventsTest.java fails in Windows
    + JDK-8234270: [REDO] JDK-8204128 NMT might report incorrect
    numbers for Compiler area
    + JDK-8234332: [TESTBUG] java/awt/Focus/DisposedWindow/
    /DisposeDialogNotActivateOwnerTest/
    /DisposeDialogNotActivateOwnerTest.java fails on linux-x64
    nightly
    + JDK-8234398: Replace ID2D1Factory::GetDesktopDpi with
    GetDeviceCaps
    + JDK-8234522: [macos] Crash with use of native file dialog
    + JDK-8234691: Potential double-free in ParallelSPCleanupTask
    constructor
    + JDK-8234696: tools/jlink/plugins/VendorInfoPluginsTest.java
    times out
    + JDK-8234727: sun/security/ssl/X509TrustManagerImpl tests
    support TLSv1.3
    + JDK-8234728: Some security tests should support TLSv1.3
    + JDK-8234779: Provide idiom for declaring classes noncopyable
    + JDK-8234824: java/nio/channels/SocketChannel/AdaptSocket.java
    fails on Windows 10
    + JDK-8234968: check calloc rv in libinstrument
    InvocationAdapter
    + JDK-8235153: [TESTBUG] [macos 10.15] java/awt/Graphics/
    /DrawImageBG/SystemBgColorTest.java fails
    + JDK-8235183: Remove the "HACK CODE" in comment
    + JDK-8235263: Revert TLS 1.3 change that wrapped IOExceptions
    + JDK-8235311: Tag mismatch may alert bad_record_mac
    + JDK-8235332: TestInstanceCloneAsLoadsStores.java fails with
  - XX:+StressGCM
    + JDK-8235452: Strip mined loop verification fails with
    assert(is_OuterStripMinedLoop()) failed: invalid node class
    + JDK-8235584: UseProfiledLoopPredicate fails with
    assert(_phase-&gt;get_loop(c) == loop) failed: have to be in the
    same loop
    + JDK-8235620: Broken merge between JDK-8006406 and JDK-8003559
    + JDK-8235638: NPE in LWWindowPeer.getOnscreenGraphics()
    + JDK-8235686: Add more custom hooks in Bundles.gmk
    + JDK-8235739: Rare NPE at WComponentPeer.getGraphics()
    + JDK-8235762: JVM crash in SWPointer during C2 compilation
    + JDK-8235834: IBM-943 charset encoder needs updating
    + JDK-8235874: The ordering of Cipher Suites is not maintained
    provided through jdk.tls.client.cipherSuites and
    jdk.tls.server.cipherSuites system property.
    + JDK-8235908: omit ThreadPriorityPolicy warning when value is
    set from image
    + JDK-8235984: C2: assert(out-&gt;in(PhiNode::Region) == head ||
    out-&gt;in(PhiNode::Region) == slow_head) failed: phi must be
    either part of the slow or the fast loop
    + JDK-8236211: [Graal] compiler/graalunit/GraphTest.java is
    skipped in all testing
    + JDK-8236470: Deal with ECDSA using ecdsa-with-SHA2 plus hash
    algorithm as AlgorithmId
    + JDK-8236545: Compilation error in mach5
    java/awt/FileDialog/MacOSGoToFolderCrash.java
    + JDK-8236700: Upgrading JSZip from v3.1.5 to v3.2.2
    + JDK-8236759: ShouldNotReachHere in
    PhaseIdealLoop::verify_strip_mined_scheduling
    + JDK-8236897: Fix the copyright header for pkcs11gcm2.h
    + JDK-8236921: Add build target to produce a JDK image suitable
    for a Graal/SVM build
    + JDK-8236953: [macos] JavaFX SwingNode is not rendered on macOS
    + JDK-8236996: Incorrect Roboto font rendering on Windows with
    subpixel antialiasing
    + JDK-8237045: JVM uses excessive memory with -XX:+EnableJVMCI
  - XX:JVMCICounterSize=2147483648
    + JDK-8237055: [TESTBUG] compiler/c2/TestJumpTable.java fails
    with release VMs
    + JDK-8237086: assert(is_MachReturn()) running CTW with fix for
    JDK-8231291
    + JDK-8237192: Generate stripped/public pdbs on Windows for jdk
    images
    + JDK-8237396: JvmtiTagMap::weak_oops_do() should not trigger
    barriers
    + JDK-8237474: Default SSLEngine should create in server role
    + JDK-8237859: C2: Crash when loads float above range check
    + JDK-8237879: make 4.3 breaks build
    + JDK-8237951: CTW: C2 compilation fails with "malformed
    control flow"
    + JDK-8237962: give better error output for invalid OCSP
    response intervals in CertPathValidator checks
    + JDK-8238190: [JVMCI] Fix single implementor speculation for
    diamond shapes.
    + JDK-8238356: CodeHeap::blob_count() overestimates the number
    of blobs
    + JDK-8238452: Keytool generates wrong expiration date if
    validity is set to 2050/01/01
    + JDK-8238555: Allow Initialization of SunPKCS11 with NSS when
    there are external FIPS modules in the NSSDB
    + JDK-8238575: DragSourceEvent.getLocation() returns wrong
    value on HiDPI screens (Windows)
    + JDK-8238676: jni crashes on accessing it from process exit
    hook
    + JDK-8238721: Add failing client jtreg tests to the Problem
    List
    + JDK-8238738: AudioSystem.getMixerInfo() takes about 30 sec to
    report a gone audio device
    + JDK-8238756: C2: assert(((n) == __null || !VerifyIterativeGVN
    || !((n)-&gt;is_dead()))) failed: can not use dead node
    + JDK-8238765: PhaseCFG::schedule_pinned_nodes cannot handle
    precedence edges from unmatched CFG nodes correctly
    + JDK-8238898: Missing hash characters for header on license
    file
    + JDK-8238942: Rendering artifacts with LCD text and fractional
    metrics
    + JDK-8238985: [TESTBUG] The arrow image is blue instead of
    green
    + JDK-8239000: handle ContendedPaddingWidth in vm_version_ppc
    + JDK-8239055: Wrong implementation of VMState.hasListener
    + JDK-8239091: Reversed arguments in call to strstr in freetype
    "debug" code.
    + JDK-8239142: C2's UseUniqueSubclasses optimization is broken
    for array accesses
    + JDK-8239224: libproc_impl.c previous_thr may be used
    uninitialized warning
    + JDK-8239351: Give more meaningful InternalError messages in
    Deflater.c
    + JDK-8239365: ProcessBuilder test modifications for AIX
    execution
    + JDK-8239456: vtable stub generation: assert failure (code
    size estimate)
    + JDK-8239457: call ReleaseStringUTFChars before early returns
    in Java_sun_security_pkcs11_wrapper_PKCS11_connect
    + JDK-8239462: jdk.hotspot.agent misses some
    ReleaseStringUTFChars calls in case of early returns
    + JDK-8239557: [TESTBUG] VeryEarlyAssertTest.java validating
    "END." marker at lastline is not always true
    + JDK-8239787: AArch64: String.indexOf may incorrectly handle
    empty strings
    + JDK-8239792: Bump update version for OpenJDK: jdk-11.0.8
    + JDK-8239798: SSLSocket closes socket both socket endpoints on
    a SocketTimeoutException
    + JDK-8239819: XToolkit: Misread of screen information memory
    + JDK-8239852: java/util/concurrent tests fail with
  - XX:+VerifyGraphEdges: assert(!VerifyGraphEdges) failed:
    verification should have failed
    + JDK-8239893: Windows handle Leak when starting processes
    using ProcessBuilder
    + JDK-8239915: Zero VM crashes when handling dynamic constant
    + JDK-8239931: [win][x86] vtable stub generation: assert
    failure (code size estimate) follow-up
    + JDK-8239965: XMLEncoder/Test4625418.java fails due to "Error:
    Cp943 - can't read properly"
    + JDK-8239976: Put JDK-8239965 on the ProblemList.txt
    + JDK-8240073: Fix 'test-make' build target in 11u
    + JDK-8240197: Cannot start JVM when $JAVA_HOME includes CJK
    characters
    + JDK-8240202: A few client tests leave mouse buttons pressed
    + JDK-8240220: IdealLoopTree::dump_head predicate printing is
    broken
    + JDK-8240223: Use consistent predicate order in and with
    PhaseIdealLoop::find_predicate
    + JDK-8240227: Loop predicates should be copied to unswitched
    loops
    + JDK-8240286: [TESTBUG] Test command error in hotspot/jtreg/
    /compiler/loopopts/superword/SumRedAbsNeg_Float.java
    + JDK-8240518: Incorrect JNU_ReleaseStringPlatformChars in
    Windows Print
    + JDK-8240529: CheckUnhandledOops breaks NULL check in
    Modules::define_module
    + JDK-8240576: JVM crashes after transformation in C2
    IdealLoopTree::merge_many_backedges
    + JDK-8240603: Windows 32bit compile error after 8238676
    + JDK-8240629: argfiles parsing broken for argfiles with
    comment cross 4096 bytes chunk
    + JDK-8240711: TestJstatdPort.java failed due to
    "ExportException: Port already in use:"
    + JDK-8240786: [TESTBUG] The test java/awt/Window/
    /GetScreenLocation/GetScreenLocationTest.java fails on HiDPI
    screen
    + JDK-8240824: enhance print_full_memory_info on Linux by THP
    related information
    + JDK-8240827: Downport SSLSocketImpl.java from "8221882: Use
    fiber-friendly java.util.concurrent.locks in JSSE"
    + JDK-8240905: assert(mem == (Node*)1 || mem == mem2) failed:
    multiple Memories being matched at once?
    + JDK-8240972: macOS codesign fail on macOS 10.13.5 or older
    + JDK-8241445: Fix copyright in
    test/jdk/tools/launcher/ArgFileSyntax.java
    + JDK-8241458: [JVMCI] add mark value to expose
    CodeOffsets::Frame_Complete
    + JDK-8241464: [11u] Backport: make rehashing be a needed
    guaranteed safepoint cleanup action
    + JDK-8241556: Memory leak if -XX:CompileCommand is set
    + JDK-8241568: (fs) UserPrincipalLookupService.lookupXXX
    failure with IOE "Operation not permitted"
    + JDK-8241586: compiler/cpuflags/
    /TestAESIntrinsicsOnUnsupportedConfig.java fails on aarch64
    + JDK-8241638: launcher time metrics always report 1 on Linux
    when _JAVA_LAUNCHER_DEBUG set
    + JDK-8241660: Add virtualization information output to hs_err
    file on macOS
    + JDK-8241808: [TESTBUG] The JDK-8039467 bug appeared on macOS
    + JDK-8241888: Mirror jdk.security.allowNonCaAnchor system
    property with a security one
    + JDK-8241900: Loop unswitching may cause dependence on null
    check to be lost
    + JDK-8241948: enhance list of environment variables printed in
    hs_err file
    + JDK-8241996: on linux set full relro in the linker flags
    + JDK-8242108: Performance regression after fix for JDK-8229496
    + JDK-8242141: New System Properties to configure the TLS
    signature schemes
    + JDK-8242154: Backport parts of JDK-4947890 to OpenJDK 11u
    + JDK-8242174: [macos] The NestedModelessDialogTest test make
    the macOS unstable
    + JDK-8242239: [Graal] javax/management/generified/
    /GenericTest.java fails: FAILED: queryMBeans sets same
    + JDK-8242294: JSSE Client does not throw SSLException when an
    alert occurs during handshaking
    + JDK-8242379: [TESTBUG] compiler/loopopts/
    /TestLoopUnswitchingLostCastDependency.java fails with
    release VMs
    + JDK-8242470: Update Xerces to Version 2.12.1
    + JDK-8242498: Invalid "sun.awt.TimedWindowEvent" object leads
    to JVM crash
    + JDK-8242541: Small charset issues (ISO8859-16, x-eucJP-Open,
    x-IBM834 and x-IBM949C)
    + JDK-8242626: enhance posix print_rlimit_info
    + JDK-8243059: Build fails when --with-vendor-name contains a
    comma
    + JDK-8243539: Copyright info (Year) should be updated for fix
    of 8241638
    + JDK-8243541: (tz) Upgrade time-zone data to tzdata2020a
    + JDK-8244407: JVM crashes after transformation in C2
    IdealLoopTree::split_fall_in
    + JDK-8244520: problemlist
    java/awt/font/Rotate/RotatedFontTest.java on linux
    + JDK-8244777: ClassLoaderStats VM Op uses constant hash value
    + JDK-8244853: The static build of libextnet is missing the
    JNI_OnLoad_extnet function
    + JDK-8244951: Missing entitlements for hardened runtime
    + JDK-8245047: [PPC64] C2: ReverseBytes + Load always match to
    unordered Load (acquire semantics missing)
    + JDK-8245649: Revert 8245397 backport of 8230591
    + JDK-8246031: SSLSocket.getSession() doesn't close connection
    for timeout/ interrupts
    + JDK-8246613: Choose the default SecureRandom algo based on
    registration ordering
    + JDK-8248505: Unexpected NoSuchAlgorithmException when using
    secure random impl from BCFIPS provider
- Removed patch:
  * JDK-8228407.patch
    + integrated upstream</changelog>
  <changelog author="fstrba@suse.com" date="1604318400">- Update to upstream tag jdk-11.0.9-11 (October 2020 CPU,
  bsc#1177943)
  * New features
    + JDK-8250784: Shenandoah: A Low-Pause-Time Garbage Collector
  * Security fixes
    + JDK-8233624: Enhance JNI linkage
    + JDK-8236196: Improve string pooling
    + JDK-8236862, CVE-2020-14779: Enhance support of Proxy class
    + JDK-8237990, CVE-2020-14781: Enhanced LDAP contexts
    + JDK-8237995, CVE-2020-14782: Enhance certificate processing
    + JDK-8240124: Better VM Interning
    + JDK-8241114, CVE-2020-14792: Better range handling
    + JDK-8242680, CVE-2020-14796: Improved URI Support
    + JDK-8242685, CVE-2020-14797: Better Path Validation
    + JDK-8242695, CVE-2020-14798: Enhanced buffer support
    + JDK-8243302: Advanced class supports
    + JDK-8244136, CVE-2020-14803: Improved Buffer supports
    + JDK-8244479: Further constrain certificates
    + JDK-8244955: Additional Fix for JDK-8240124
    + JDK-8245407: Enhance zoning of times
    + JDK-8245412: Better class definitions
    + JDK-8245417: Improve certificate chain handling
    + JDK-8248574: Improve jpeg processing
    + JDK-8249927: Specify limits of jdk.serialProxyInterfaceLimit
    + JDK-8253019: Enhanced JPEG decoding
  * Other changes
    + JDK-6532025: GIF reader throws misleading exception with
    truncated images
    + JDK-6949753: [TEST BUG]: java/awt/print/PageFormat/
    /PDialogTest.java needs update by removing an infinite loop
    + JDK-8022535: [TEST BUG] javax/swing/text/html/parser/
    /Test8017492.java fails
    + JDK-8062947: Fix exception message to correctly represent
    LDAP connection failure
    + JDK-8067354: com/sun/jdi/GetLocalVariables4Test.sh failed
    + JDK-8134599: TEST_BUG: java/rmi/transport/closeServerSocket/
    /CloseServerSocket.java fails intermittently with Address
    already in use
    + JDK-8151678: com/sun/jndi/ldap/LdapTimeoutTest.java failed
    due to timeout on DeadServerNoTimeoutTest is incorrect
    + JDK-8160768: Add capability to custom resolve host/domain
    names within the default JNDI LDAP provider
    + JDK-8172404: Tools should warn if weak algorithms are used
    before restricting them
    + JDK-8193367: Annotated type variable bounds crash javac
    + JDK-8202117: com/sun/jndi/ldap/RemoveNamingListenerTest.java
    fails intermittently: Connection reset
    + JDK-8203026: java.rmi.NoSuchObjectException: no such object
    in table
    + JDK-8203281: [Windows] JComboBox change in ui when
    editor.setBorder() is called
    + JDK-8203382: Rename SystemDictionary::initialize_wk_klass to
    resolve_wk_klass
    + JDK-8203393: com/sun/jdi/JdbMethodExitTest.sh and
    JdbExprTest.sh fail due to timeout
    + JDK-8203928: [Test] Convert non-JDB scaffolding
    serviceability shell script tests to java
    + JDK-8204963: javax.swing.border.TitledBorder has a memory leak
    + JDK-8204994: SA might fail to attach to process with "Windbg
    Error: WaitForEvent failed"
    + JDK-8205534: Remove SymbolTable dependency from
    serviceability agent
    + JDK-8206309: Tier1 SA tests fail
    + JDK-8208281: java/nio/channels/
    /AsynchronousSocketChannel/Basic.java timed out
    + JDK-8209109: [TEST] rewrite com/sun/jdi shell tests to java
    version - step1
    + JDK-8209332: [TEST] test/jdk/com/sun/jdi/CatchPatternTest.sh
    is incorrect
    + JDK-8209342: Problemlist SA tests on Solaris due to Error
    attaching to process: Can't create thread_db agent!
    + JDK-8209343: Test javax/swing/border/TestTitledBorderLeak.java
    should be marked as headful
    + JDK-8209517: com/sun/jdi/BreakpointWithFullGC.java fails with
    timeout
    + JDK-8209604: [TEST] rewrite com/sun/jdi shell tests to java
    version - step2
    + JDK-8209605: com/sun/jdi/BreakpointWithFullGC.java fails with
    ZGC
    + JDK-8209608: Problem list com/sun/jdi/BreakpointWithFullGC.java
    + JDK-8210131: vmTestbase/nsk/jvmti/scenarios/allocation/AP10/
    /ap10t001/TestDescription.java failed with ObjectFree:
    GetCurrentThreadCpuTimerInfo returned unexpected error code
    + JDK-8210243: [TEST] rewrite com/sun/jdi shell tests to java
    version - step3
    + JDK-8210527: JShell: NullPointerException in
    jdk.jshell.Eval.translateExceptionStack
    + JDK-8210560: [TEST] convert com/sun/jdi redefineClass-related
    tests
    + JDK-8210725: com/sun/jdi/RedefineClearBreakpoint.java fails
    with waitForPrompt timed out after 60 seconds
    + JDK-8210748: [TESTBUG] lib.jdb.Jdb.waitForPrompt() should
    clarify which output is the pending reply after a timeout
    + JDK-8210760: [TEST] rewrite com/sun/jdi shell tests to java
    version - step4
    + JDK-8210977: jdk/jfr/event/oldobject/TestThreadLocalLeak.java
    fails to find ThreadLocalObject
    + JDK-8211292: [TEST] convert com/sun/jdi/DeferredStepTest.sh
    test
    + JDK-8211694: JShell: Redeclared variable should be reset
    + JDK-8212200: assert when shared java.lang.Object is redefined
    by JVMTI agent
    + JDK-8212629: [TEST] wrong breakpoint in
    test/jdk/com/sun/jdi/DeferredStepTest
    + JDK-8212665: com/sun/jdi/DeferredStepTest.java: jj1 (line 57)
  - unexpected. lastLine=52, minLine=52, maxLine=55
    + JDK-8212807: tools/jar/multiRelease/Basic.java times out
    + JDK-8213182: Minimal VM build failure after JDK-8212200
    (assert when shared java.lang.Object is redefined by JVMTI
    agent)
    + JDK-8213214: Set -Djava.io.tmpdir= when running tests
    + JDK-8213275: ReplaceCriticalClasses.java fails with
    jdk.internal.vm.PostVMInitHook not found
    + JDK-8213574: Deadlock in string table expansion when dumping
    lots of CDS classes
    + JDK-8213703: LambdaConversionException: Invalid receiver type
    not a subtype of implementation type interface
    + JDK-8214074: Ghash optimization using AVX instructions
    + JDK-8214491: Upgrade to JLine 3.9.0
    + JDK-8214797: TestJmapCoreMetaspace.java timed out
    + JDK-8215243: JShell tests failing intermitently with
    "Problem cleaning up the following threads:"
    + JDK-8215244: jdk/jshell/ToolBasicTest.java
    testHistoryReference failed
    + JDK-8215354: x86_32 build failures after JDK-8214074 (Ghash
    optimization using AVX instructions)
    + JDK-8215438: jshell tool: Ctrl-D causes EOF
    + JDK-8216021: RunTest.gmk might set concurrency level to 1 on
    Windows
    + JDK-8216974: HttpConnection not returned to the pool after
    204 response
    + JDK-8218948: SimpleDateFormat :: format - Zone Names are not
    reflected correctly during run time
    + JDK-8219712: code_size2 (defined in stub_routines_x86.hpp) is
    too small on new Skylake CPUs
    + JDK-8220150: macos10.14 Mojave returns anti-aliased glyphs
    instead of aliased B&amp;W glyphs
    + JDK-8221658: aarch64: add necessary predicate for ubfx
    patterns
    + JDK-8221759: Crash when completing "java.io.File.path"
    + JDK-8221918: runtime/SharedArchiveFile/serviceability/
    /ReplaceCriticalClasses.java fails: Shared archive not found
    + JDK-8222074: Enhance auto vectorization for x86
    + JDK-8222079: Don't use memset to initialize fields decode_env
    constructor in disassembler.cpp
    + JDK-8222769: [TESTBUG] TestJFRNetworkEvents should not rely
    on hostname command
    + JDK-8223688: JShell: crash on the instantiation of raw
    anonymous class
    + JDK-8223777: In posix_spawn mode, failing to exec()
    jspawnhelper does not result in an error
    + JDK-8223940: Private key not supported by chosen signature
    algorithm
    + JDK-8224184: jshell got IOException at exiting with AIX
    + JDK-8224234: compiler/codegen/TestCharVect2.java fails in
    test_mulc
    + JDK-8225037: java.net.JarURLConnection::getJarEntry() throws
    NullPointerException
    + JDK-8225625: AES Electronic Codebook (ECB) encryption and
    decryption optimization using AVX512 + VAES instructions
    + JDK-8226536: Catch OOM from deopt that fails rematerializing
    objects
    + JDK-8226575: OperatingSystemMXBean should be made container
    aware
    + JDK-8226697: Several tests which need the @key headful
    keyword are missing it.
    + JDK-8226809: Circular reference in printed stack trace is not
    correctly indented &amp; ambiguous
    + JDK-8227059: sun/security/tools/keytool/
    /DefaultSignatureAlgorithm.java timed out
    + JDK-8227269: Slow class loading when running with JDWP
    + JDK-8227595: keytool/fakegen/DefaultSignatureAlgorithm.java
    fails due to "exitValue = 6"
    + JDK-8228448: Jconsole can't connect to itself
    + JDK-8228967: Trust/Key store and SSL context utilities for
    tests
    + JDK-8229378: jdwp library loader in linker_md.c quietly
    truncates on buffer overflow
    + JDK-8229815: Upgrade Jline to 3.12.1
    + JDK-8230000: some httpclients testng tests run zero test
    + JDK-8230002: javax/xml/jaxp/unittest/transform/
    /SecureProcessingTest.java runs zero test
    + JDK-8230010: Remove jdk8037819/BasicTest1.java
    + JDK-8230094: CCE in createXMLEventWriter(Result) over an
    arbitrary XMLStreamWriter
    + JDK-8230402: Allocation of compile task fails with assert:
    "Leaking compilation tasks?"
    + JDK-8230767: FlightRecorderListener returns null recording
    + JDK-8230870: (zipfs) Add a ZIP FS test that is similar to
    test/jdk/java/util/zip/EntryCount64k.java
    + JDK-8231209: [REDO] ThreadMXBean::getThreadAllocatedBytes()
    can be quicker for self thread
    + JDK-8231586: enlarge encoding space for OopMapValue offsets
    + JDK-8231953: Wrong assumption in assertion in
    oop::register_oop
    + JDK-8231968: getCurrentThreadAllocatedBytes default
    implementation s/b getThreadAllocatedBytes
    + JDK-8232083: Minimal VM is broken after JDK-8231586
    + JDK-8232161: Align some one-way conversion in MS950 charset
    with Windows
    + JDK-8232855: jshell missing word in /help help
    + JDK-8233027: OopMapSet::all_do does oms.next() twice during
    iteration
    + JDK-8233228: Disable weak named curves by default in TLS,
    CertPath, and Signed JAR
    + JDK-8233386: Initialize NULL fields for unused decorations
    + JDK-8233452: java.math.BigDecimal.sqrt() with
    RoundingMode.FLOOR results in incorrect result
    + JDK-8233686: XML transformer uses excessive amount of memory
    + JDK-8233741: AES Countermode (AES-CTR) optimization using
    AVX512 + VAES instructions
    + JDK-8233829: javac cannot find non-ASCII module name under
    non-UTF8 environment
    + JDK-8233958: Memory retention due to HttpsURLConnection
    finalizer that serves no purpose
    + JDK-8234011: (zipfs) Memory leak in
    ZipFileSystem.releaseDeflater()
    + JDK-8234058: runtime/CompressedOops/
    /CompressedClassPointers.java fails with 'Narrow klass base:
    0x0000000000000000' missing from stdout/stderr
    + JDK-8234149: Several regression tests do not dispose Frame at
    end
    + JDK-8234347: "Turkey" meta time zone does not generate
    composed localized names
    + JDK-8234385: [TESTBUG] java/awt/EventQueue/6980209/
    /bug6980209.java fails in linux nightly
    + JDK-8234535: Cross compilation fails due to missing CFLAGS
    for the BUILD_CC
    + JDK-8234541: C1 emits an empty message when it inlines
    successfully
    + JDK-8234687: change javap reporting on unknown attributes
    + JDK-8236464: SO_LINGER option is ignored by SSLSocket in JDK
    11
    + JDK-8236548: Localized time zone name inconsistency between
    English and other locales
    + JDK-8236617: jtreg test containers/docker/
    /TestMemoryAwareness.java fails after 8226575
    + JDK-8237182: Update copyright header for shenandoah and
    epsilon files
    + JDK-8237888: security/infra/java/security/cert/
    /CertPathValidator/certification/LuxTrustCA.java fails when
    checking validity interval
    + JDK-8237977: Further update
    javax/net/ssl/compatibility/Compatibility.java
    + JDK-8238270: java.net HTTP/2 client does not decrease stream
    count when receives 204 response
    + JDK-8238284: [macos] Zero VM build fails due to an obvious
    typo
    + JDK-8238380: java.base/unix/native/libjava/childproc.c
    "multiple definition" link errors with GCC10
    + JDK-8238386: (sctp) jdk.sctp/unix/native/libsctp/SctpNet.c
    "multiple definition" link errors with GCC10
    + JDK-8238388: libj2gss/NativeFunc.o "multiple definition" link
    errors with GCC10
    + JDK-8238448: RSASSA-PSS signature verification fail when
    using certain odd key sizes
    + JDK-8238710: LingeredApp doesn't log stdout/stderr if exits
    with non-zero code
    + JDK-8239083: C1 assert(known_holder == NULL ||
    (known_holder-&gt;is_instance_klass() &amp;&amp;
    (!known_holder-&gt;is_interface() ||
    ((ciInstanceKlass*)known_holder)-&gt;has_nonstatic_concrete_methods())),
    "should be non-static concrete method");
    + JDK-8239385: KerberosTicket client name refers wrongly to
    sAMAccountName in AD
    + JDK-8240169: javadoc fails to link to non-modular api docs
    + JDK-8240295: hs_err elapsed time in seconds is not accurate
    enough
    + JDK-8240360: NativeLibraryEvent has wrong library name on
    Linux
    + JDK-8240676: Meet not symmetric failure when running lucene
    on jdk8
    + JDK-8241007: Shenandoah: remove
    ShenandoahCriticalControlThreadPriority support
    + JDK-8241065: Shenandoah: remove leftover code after
    JDK-8231086
    + JDK-8241086: Test runtime/NMT/HugeArenaTracking.java is
    failing on 32bit Windows
    + JDK-8241130: com.sun.jndi.ldap.EventSupport.removeDeadNotifier:
    java.lang.NullPointerException
    + JDK-8241138: http.nonProxyHosts=* causes
    StringIndexOutOfBoundsException in DefaultProxySelector
    + JDK-8241319: WB_GetCodeBlob doesn't have ResourceMark
    + JDK-8241478: vmTestbase/gc/gctests/Steal/steal001/steal001.java
    fails with OOME
    + JDK-8241574: Shenandoah: remove ShenandoahAssertToSpaceClosure
    + JDK-8241750: x86_32 build failure after JDK-8227269
    + JDK-8242184: CRL generation error with RSASSA-PSS
    + JDK-8242283: Can't start JVM when java home path includes
    non-ASCII character
    + JDK-8242556: Cannot load RSASSA-PSS public key with non-null
    params from byte array
    + JDK-8243029: Rewrite javax/net/ssl/compatibility/
    /Compatibility.java with a flexible interop test framework
    + JDK-8243138: Enhance BaseLdapServer to support starttls
    extended request
    + JDK-8243320: Add SSL root certificates to Oracle Root CA
    program
    + JDK-8243321: Add Entrust root CA - G4 to Oracle Root CA
    program
    + JDK-8243389: enhance os::pd_print_cpu_info on linux
    + JDK-8243453: java --describe-module failed with non-ASCII
    module name under non-UTF8 environment
    + JDK-8243470: [macos] bring back O2 opt level for unsafe.cpp
    + JDK-8243489: Thread CPU Load event may contain wrong data for
    CPU time under certain conditions
    + JDK-8243925: Toolkit#getScreenInsets() returns wrong value on
    HiDPI screens (Windows)
    + JDK-8244087: 2020-04-24 public suffix list update
    + JDK-8244151: Update MUSCLE PC/SC-Lite headers to the latest
    release 1.8.26
    + JDK-8244164: AArch64: jaotc generates incorrect code for
    compressed OOPs with non-zero heap base
    + JDK-8244196: adjust output in os_linux
    + JDK-8244225: stringop-overflow warning on strncpy call from
    compile_the_world_in
    + JDK-8244287: JFR: Methods samples have line number 0
    + JDK-8244703: "platform encoding not initialized" exceptions
    with debugger, JNI
    + JDK-8244719: CTW: C2 compilation fails with
    "assert(!VerifyHashTableKeys || _hash_lock == 0) failed:
    remove node from hash table before modifying it"
    + JDK-8244729: Shenandoah: remove resolve paths from
    SBSA::generate_shenandoah_lrb
    + JDK-8244763: Update --release 8 symbol information after JSR
    337 MR3
    + JDK-8244818: Java2D Queue Flusher crash while moving
    application window to external monitor
    + JDK-8245151: jarsigner should not raise duplicate warnings on
    verification
    + JDK-8245616: Bump update version for OpenJDK: jdk-11.0.9
    + JDK-8245714: "Bad graph detected in build_loop_late" when
    loads are pinned on loop limit check uncommon branch
    + JDK-8245801: StressRecompilation triggers assert "redundunt
    OSR recompilation detected. memory leak in CodeCache!"
    + JDK-8245832: JDK build make-static-libs should build all JDK
    libraries
    + JDK-8245880: Shenandoah: check class unloading flag early in
    concurrent code root scan
    + JDK-8245981: Upgrade to jQuery 3.5.1
    + JDK-8246027: Minimal fastdebug build broken after JDK-8245801
    + JDK-8246094: [macos] Sound Recording and playback is not
    working
    + JDK-8246153: TestEliminateArrayCopy fails with
  - XX:+StressReflectiveCode
    + JDK-8246193: Possible NPE in ENC-PA-REP search in AS-REQ
    + JDK-8246196: javax/management/MBeanServer/OldMBeanServerTest
    fails with AssertionError
    + JDK-8246203: Segmentation fault in verification due to stack
    overflow with -XX:+VerifyIterativeGVN
    + JDK-8246330: Add TLS Tests for Legacy ECDSA curves
    + JDK-8246453: TestClone crashes with "all collected exceptions
    must come from the same place"
    + JDK-8247246: Add explicit ResolvedJavaType.link and expose
    presence of default methods
    + JDK-8247350: [aarch64] assert(false) failed: wrong size of
    mach node
    + JDK-8247502: PhaseStringOpts crashes while optimising
    effectively dead code
    + JDK-8247615: Initialize the bytes left for the heap sampler
    + JDK-8247824: CTW: C2 (Shenandoah) compilation fails with SEGV
    in SBC2Support::pin_and_expand
    + JDK-8247874: Replacement in VersionProps.java.template not
    working when --with-vendor-bug-url contains '&amp;'
    + JDK-8247979: aarch64: missing side effect of killing flags
    for clearArray_reg_reg
    + JDK-8248214: Add paddings for TaskQueueSuper to reduce
    false-sharing cache contention
    + JDK-8248219: aarch64: missing memory barrier in
    fast_storefield and fast_accessfield
    + JDK-8248348: Regression caused by the update to BCEL 6.0
    + JDK-8248385: [testbug][11u] Adapt TestInitiExceptions to
    jtreg 5.1
    + JDK-8248495: [macos] zerovm is broken due to libffi headers
    location
    + JDK-8248851: CMS: Missing memory fences between free chunk
    check and klass read
    + JDK-8248987: AOT's Linker.java seems to eagerly fail-fast on
    Windows
    + JDK-8249159: Downport test rework for SSLSocketTemplate from
    8224650
    + JDK-8249215: JFrame::setVisible crashed with
  - Dfile.encoding=UTF-8 on Japanese Windows.
    + JDK-8249251: [dark_mode ubuntu 20.04] The selected menu is
    not highlighted in GTKLookAndFeel
    + JDK-8249255: Build fails if source code in cygwin home dir
    + JDK-8249277: TestVerifyIterativeGVN.java is failing with
    timeout in OpenJDK 11
    + JDK-8249278: Revert JDK-8226253 which breaks the spec of
    AccessibleState.SHOWING for JList
    + JDK-8249560: Shenandoah: Fix racy GC request handling
    + JDK-8249801: Shenandoah: Clear soft-refs on requested GC cycle
    + JDK-8249953: Shenandoah: gc/shenandoah/mxbeans tests should
    account for corner cases
    + JDK-8250582: Revert Principal Name type to NT-UNKNOWN when
    requesting TGS Kerberos tickets
    + JDK-8250609: C2 crash in IfNode::fold_compares
    + JDK-8250627: Use -XX:+/-UseContainerSupport for
    enabling/disabling Java container metrics
    + JDK-8250755: Better cleanup for
    jdk/test/javax/imageio/plugins/shared/CanWriteSequence.java
    + JDK-8250787: Provider.put no longer registering aliases in
    FIPS env
    + JDK-8250826: jhsdb does not work with coredump which comes
    from Substrate VM
    + JDK-8250827: Shenandoah: needs to reset/finish StringTable's
    dead count before/after parallel walk
    + JDK-8250844: Make sure {type,obj}ArrayOopDesc accessors check
    the bounds
    + JDK-8251117: Cannot check P11Key size in P11Cipher and
    P11AEADCipher
    + JDK-8251354: Shenandoah: Fix jdk/jfr/tool/TestPrintJSON.java
    test failure
    + JDK-8251451: Shenandoah: Remark ObjectSynchronizer roots with
    I-U
    + JDK-8251469: Better cleanup for
    test/jdk/javax/imageio/SetOutput.java
    + JDK-8251487: Shenandoah: missing detail timing tracking for
    final mark cleaning phase
    + JDK-8252120: compiler/oracle/TestCompileCommand.java
    misspells "occured"
    + JDK-8252157: JDK-8231209 11u backport breaks jmm binary
    compatibility
    + JDK-8252258: [11u] JDK-8242154 changes the default vendor
    + JDK-8252804: [test] Fix 'ReleaseDeflater.java' test after
    downport of 8234011
    + JDK-8253134: JMM_VERSION should remain at 0x20020000 (JDK 10)
    in JDK 11
    + JDK-8253283: [11u] Test build/translations/
    /VerifyTranslations.java failing after JDK-8252258
    + JDK-8253813: Backout JDK-8244287 from 11u: it causes several
    crashes
- Removed patch:
  * gcc-fno-common-fix.patch
    + not needed any more with this version
- Added patch:
  * JDK-8250861.patch
    + Fix regression "8250861: Crash in MinINode::Ideal(PhaseGVN*,
    bool)" introduced in jdk 11.0.9</changelog>
  <changelog author="fstrba@suse.com" date="1604491200">- Enable Sheandoah GC for x86_64 (jsc#ECO-3171)</changelog>
  <changelog author="fstrba@suse.com" date="1605528000">- Update to upstream tag jdk-11.0.9.1-1
  * Fix:
    + JDK-8250861: Crash in MinINode::Ideal(PhaseGVN*, bool)
- Removed patch:
  * JDK-8250861.patch
    + Integrated upstream</changelog>
  <changelog author="fstrba@suse.com" date="1611230400">- Update to upstream tag jdk-11.0.10+9 (January 2021 CPU,
  bsc#1181239)
  * Security fixes
    + JDK-8247619: Improve Direct Buffering of Characters
  * Other changes
    + JDK-6722928: Support SSPI as a native GSS-API provider
    + JDK-7185258: [macosx] Deadlock in SunToolKit.realSync()
    + JDK-8152332: [macosx] JFileChooser cannot be serialized on
    Mac OS X
    + JDK-8161684: [testconf] Add VerifyOops' testing into compiler
    tiers
    + JDK-8171279: Support X25519 and X448 in TLS
    + JDK-8173361: various crashes in
    JvmtiExport::post_compiled_method_load
    + JDK-8173658: JvmtiExport::post_class_unload() is broken for
    non-JavaThread initiators
    + JDK-8191006: hsdis disassembler plugin does not compile with
    binutils 2.29+
    + JDK-8197981: Missing return statement in
    __sync_val_compare_and_swap_8
    + JDK-8198334: java/awt/FileDialog/8003399/bug8003399.java
    fails in headless mode
    + JDK-8200151: Add 8 JNDI tests to com/sun/jndi/dns/ConfigTests/
    + JDK-8208279: Add 8 JNDI tests to com/sun/jndi/dns/EnvTests/
    + JDK-8208483: Add 5 JNDI tests to
    com/sun/jndi/dns/FactoryTests/
    + JDK-8208542: Add 4 JNDI tests to com/sun/jndi/dns/ListTests/
    + JDK-8208665: Amend cross-compilation docs with
    qemu-debootstrap recipe
    + JDK-8210088: ProblemList gc/epsilon/TestMemoryMXBeans.java
    + JDK-8210339: Add 10 JNDI tests to com/sun/jndi/dns/FedTests/
    + JDK-8211450: UndetVar::dup is not copying the kind field to
    the duplicated instance
    + JDK-8212160: JVMTI agent crashes with "assert(_value != 0LL)
    failed: resolving NULL _value"
    + JDK-8212226: SurfaceManager throws "Invalid Image variant"
    for MultiResolutionImage (Windows)
    + JDK-8213400: Support choosing group name in keytool keypair
    generation
    + JDK-8213535: Windows HiDPI html lightweight tooltips are
    truncated
    + JDK-8213698: Improve devkit creation and add support for
    linux/ppc64/ppc64le/s390x
    + JDK-8214025: assert(t-&gt;singleton()) failed: must be a
    constant when ScavengeRootsInCode &lt; 2
    + JDK-8214242: compiler/arguments/TestScavengeRootsInCode.java
    fails because of missing UnlockDiagnosticVMOptions
    + JDK-8214787: Zero builds fail with "undefined
    JavaThread::thread_state()"
    + JDK-8215583: Exclude
    runtime/handshake/HandshakeWalkSuspendExitTest.java
    + JDK-8216012: Infinite loop in RSA KeyPairGenerator
    + JDK-8216324: GetClassMethods is confused by the presence of
    default methods in super interfaces
    + JDK-8217429: WebSocket over authenticating proxy fails to
    send Upgrade headers
    + JDK-8217976: test/jdk/java/net/httpclient/websocket/
    /WebSocketProxyTest.java fails intermittently
    + JDK-8218021: Have jarsigner preserve posix permission
    attributes
    + JDK-8218287: jshell tool: input behavior unstable after
    12-ea+24 on Windows
    + JDK-8218851: JVM crash in custom classloader stress test, JDK
    12 &amp; 13
    + JDK-8220420: Cleanup c1_LinearScan
    + JDK-8222072: JVMTI GenerateEvents() sends CompiledMethodLoad
    events to wrong jvmtiEnv
    + JDK-8222286: Fix for JDK-8213419 is broken on s390
    + JDK-8222527: HttpClient doesn't send HOST header when
    tunelling HTTP/1.1 through http proxy
    + JDK-8222533: jtreg test jdk/internal/platform/cgroup/
    /TestCgroupMetrics.java fails on SLES12.3 linux ppc64le
    machine
    + JDK-8224506: [TESTBUG] TestDockerMemoryMetrics.java fails
    with exitValue = 137
    + JDK-8224555: vmTestbase/nsk/jvmti/scenarios/contention/TC02/
    /tc02t001/TestDescription.java failed
    + JDK-8224650: Add tests to support X25519 and X448 in TLS
    + JDK-8225072: Add LuxTrust certificate that is expiring in
    March 2021 to list of allowed but expired certs
    + JDK-8225329: -XX:+PrintBiasedLockingStatistics causes crash
    during initialization on Windows platforms
    + JDK-8225687: Newly added sspi.cpp in JDK-6722928 still
    contains some small errors
    + JDK-8227006: [linux] Runtime.availableProcessors execution
    time increased by factor of 100
    + JDK-8227275: Within native OOM error handling, assertions may
    hang the process
    + JDK-8227647: [Graal] Test8009761.java fails due to
    "RuntimeException: static java.lang.Object
    compiler.uncommontrap.Test8009761.m3(boolean,boolean) not
    compiled"
    + JDK-8229495: SIGILL in C2 generated OSR compilation
    + JDK-8230910: libsspi_bridge does not build on Windows 32bit
    + JDK-8232114: JVM crashed at imjpapi.dll in native code
    + JDK-8234147: Avoid looking up standard charsets in core
    libraries
    + JDK-8234393: [macos] printing ignores printer tray
    + JDK-8234863: Increase default value of MaxInlineLevel
    + JDK-8235218: Minimal VM is broken after JDK-8173361
    + JDK-8235456: Minimal VM is broken after JDK-8212160
    + JDK-8235829: graal crashes with Zombie.java test
    + JDK-8236124: Minimal VM slowdebug build failed after
    JDK-8212160
    + JDK-8236512: PKCS11 Connection closed after Cipher.doFinal
    and NoPadding
    + JDK-8236944: The legVecZ operand should be limited to
    zmm0-zmm15 registers
    + JDK-8237186: Fix typo in copyright header of
    java/io/Reader/TransferTo.java
    + JDK-8237499: JFR: Include stack trace in the ThreadStart event
    + JDK-8237512: AArch64: aarch64TestHook leaks a BufferBlob
    + JDK-8237524: AArch64: String.compareTo() may return incorrect
    result
    + JDK-8237950: C2 compilation fails with "Live Node limit
    exceeded limit" during ConvI2L::Ideal optimization
    + JDK-8238579: HttpsURLConnection drops the timeout and hangs
    forever in read
    + JDK-8239105: Add exception for expiring Digicert root
    certificates to VerifyCACerts test
    + JDK-8239477: jdk/jfr/jcmd/TestJcmdStartStopDefault.java fails
  - XX:+VerifyOops with "verify_oop: rsi: broken oop"
    + JDK-8239497: SEGV in EdgeUtils::field_name_symbol(Edge const&amp;)
    + JDK-8239886: Minimal VM build fails after JDK-8237499
    + JDK-8240633: Memory leaks in the implementations of
    FileChooserUI
    + JDK-8240690: Race condition between EDT and
    BasicDirectoryModel.FilesLoader.run0()
    + JDK-8241234: Unify monitor enter/exit runtime entries.
    + JDK-8241311: Move some charset mapping tests from closed to
    open
    + JDK-8241797: Add some tests to the problem list
    + JDK-8242029: AArch64: skip G1 array copy pre-barrier if
    marking not active
    + JDK-8242335: Additional Tests for RSASSA-PSS
    + JDK-8242480: Negative value may be returned by
    getFreeSwapSpaceSize() in the docker
    + JDK-8242614: cleanup duplicated test ldap server in some
    com/sun/jndi/ldap/ tests
    + JDK-8242846: Bring back test/jdk/tools/jlink/plugins/
    /OrderResourcesPluginTest.java
    + JDK-8243114: Implement montgomery{Multiply,Square}intrinsics
    on Windows
    + JDK-8243290: Improve diagnostic messages for class
    verification and redefinition failures
    + JDK-8243488: Add tests for set/get SendBufferSize and
    getReceiveBufferSize in DatagramSocket
    + JDK-8243549: sun/security/ssl/CipherSuite/
    /NamedGroupsWithCipherSuite.java failed with Unsupported
    signature algorithm: DSA
    + JDK-8243617: compiler/onSpinWait/TestOnSpinWaitC1.java test
    uses wrong class
    + JDK-8243619: compiler/codecache/CheckSegmentedCodeCache.java
    test misses -version
    + JDK-8244142: some hotspot/runtime tests don't check exit code
    of forked JVM
    + JDK-8244278: Excessive code cache flushes and sweeps
    + JDK-8244282: test/hotspot/jtreg/compiler/intrinsics/
    /Test8237524.java fails with --illegal-access=deny
    + JDK-8244621: [macos10.15] Garbled FX printing plus CoreText
    warnings on Catalina when building with Xcode 11
    + JDK-8244819: hsdis does not compile with binutils 2.34+
    + JDK-8245051: c1 is broken if it is compiled by gcc without
  - fno-lifetime-dse
    + JDK-8245168: jlink should not be treated as a "small" tool
    + JDK-8245400: Upgrade to LittleCMS 2.11
    + JDK-8246381: VM crashes with "Current BasicObjectLock* below
    than low_mark"
    + JDK-8246434: Threads::print_on_error assumes that the heap
    has been set up
    + JDK-8246648: issue with OperatingSystemImpl
    getFreeSwapSpaceSize in docker after 8242480
    + JDK-8247201: Print potential pointer value of readable stack
    memory in hs_err file
    + JDK-8247763: assert(outer-&gt;outcnt() == 2) failed: 'only phis'
    failure in LoopNode::verify_strip_mined()
    + JDK-8247867: Upgrade to freetype 2.10.2
    + JDK-8248190: Enable Power10 system and implement new
    byte-reverse instructions
    + JDK-8248226: TestCloneAccessStressGCM fails with
  - XX:-ReduceBulkZeroing
    + JDK-8248347: windows build broken by JDK-8243114
    + JDK-8248532: Every time I change keyboard language at my
    MacBook, Java crashes
    + JDK-8248552: C2 crashes with SIGFPE due to division by zero
    + JDK-8248596: [TESTBUG] compiler/loopopts/
    /PartialPeelingUnswitch.java times out with Graal enabled
    + JDK-8248745: Add jarsigner and keytool tests for restricted
    algorithms
    + JDK-8248791: sun/util/resources/cldr/TimeZoneNamesTest.java
    fails with -XX:-ReduceInitialCardMarks -XX:-ReduceBulkZeroing
    + JDK-8248845: AArch64: stack corruption after spilling vector
    register
    + JDK-8249176: Update GlobalSignR6CA test certificates
    + JDK-8249183: JVM crash in "AwtFrame::WmSize" method
    + JDK-8249192: MonitorInfo stores raw oops across safepoints
    + JDK-8249602: C2: assert(cnt == _outcnt) failed: no insertions
    allowed
    + JDK-8249603: C1: assert(has_error == false) failed: register
    allocation invalid
    + JDK-8249605: C2: assert(no_dead_loop) failed: dead loop
    detected
    + JDK-8249607: C2: assert(!had_error) failed: bad dominance
    + JDK-8249608: Vector register used by C2 compiled method
    corrupted at safepoint
    + JDK-8249672: Include microcode revision in features_string on
    x86
    + JDK-8249748: gtest silently ignores bad jvm arguments
    + JDK-8249821: Separate libharfbuzz from libfontmanager
    + JDK-8250598: Hyper-V is detected in spite of running on host
    OS
    + JDK-8250605: Linux x86_32 builds fail after JDK-8249821
    + JDK-8250636: iso8601_time returns incorrect offset part on
    MacOS
    + JDK-8250665: Wrong translation for the month name of May in
    ar_JO,LB,SY
    + JDK-8250772: Test com/sun/jndi/ldap/
    /NamingExceptionMessageTest.java fails intermittently with
    javax.naming.ServiceUnavailableException
    + JDK-8250825: C2 crashes with assert(field != __null) failed:
    missing field
    + JDK-8250894: Provide a configure option to build and run
    against the platform libharfbuzz
    + JDK-8250928: JFR: Improve hash algorithm for stack traces
    + JDK-8250968: Symlinks attributes not preserved when using
    jarsigner on zip files
    + JDK-8250984: Memory Docker tests fail on some Linux kernels
    w/o cgroupv1 swap limit capabilities
    + JDK-8251118: BiasedLocking::preserve_marks should not have a
    HandleMark
    + JDK-8251189: com/sun/jndi/ldap/LdapDnsProviderTest.java
    failed due to timeout
    + JDK-8251257: NMT: jcmd VM.native_memory scale=1 crashes
    target VM
    + JDK-8251365: Build failure on AIX after 8250636
    + JDK-8251397: NPE on ClassValue.ClassValueMap.cacheArray
    + JDK-8251456: [TESTBUG] compiler/vectorization/
    /TestVectorsNotSavedAtSafepoint.java failed OutOfMemoryError
    + JDK-8251458: Parse::do_lookupswitch fails with "assert(_cnt
    &gt;= 0) failed"
    + JDK-8251535: Partial peeling at unsigned test adds incorrect
    loop exit check
    + JDK-8251949: ZGC: Set explicit heap size for
    compiler/gcbarriers tests
    + JDK-8252090: JFR: StreamWriterHost::write_unbuffered() stucks
    in an infinite loop OpenJDK (build 13.0.1+9)
    + JDK-8252415: Bump update version for OpenJDK: jdk-11.0.10
    + JDK-8252470: java/awt/dnd/DisposeFrameOnDragCrash/
    /DisposeFrameOnDragTest.java fails on Windows
    + JDK-8252497: Incorrect numeric currency code for ROL
    + JDK-8252660: Shenandoah: support manageable SoftMaxHeapSize
    option
    + JDK-8252679: Two windows specific FileDIalog tests may fail
    on some Windows_Server_2016_Standard
    + JDK-8252696: Loop unswitching may cause out of bound array
    load to be executed
    + JDK-8252754: Hash code calculation of JfrStackTrace is
    inconsistent
    + JDK-8253219: Epsilon: clean up unnecessary includes
    + JDK-8253224: Shenandoah: ShenandoahStrDedupQueue destructor
    calls virtual num_queues()
    + JDK-8253226: Shenandoah: remove unimplemented
    ShenandoahStrDedupQueue::verify
    + JDK-8253269: The CheckCommonColors test should provide more
    info on failure
    + JDK-8253284: Zero OrderAccess barrier mappings are incorrect
    + JDK-8253375: OSX build fails with Xcode 12.0 (12A7209)
    + JDK-8253778: ShenandoahSafepoint::is_at_shenandoah_safepoint
    should not access VMThread state from other threads
    + JDK-8253791: Issue with useAppleColor check in CSystemColors.m
    + JDK-8254016: Test8237524 fails with -XX:-CompactStrings option
    + JDK-8254081: java/security/cert/PolicyNode/
    /GetPolicyQualifiers.java fails due to an expired certificate
    + JDK-8254144: Non-x86 Zero builds fail with return-type
    warning in os_linux_zero.cpp
    + JDK-8254166: Zero: return-type warning in
    zeroInterpreter_zero.cpp
    + JDK-8254177: (tz) Upgrade time-zone data to tzdata2020b
    + JDK-8254185: Fix Code cache sweeper heuristics for JDK 11
    + JDK-8254190: [s390] interpreter misses exception check after
    calling monitorenter
    + JDK-8254790: SIGSEGV in string_indexof_char and
    stringL_indexof_char intrinsics
    + JDK-8254854: [cgroups v1] Metric limits not properly detected
    on some join controller combinations
    + JDK-8254982: (tz) Upgrade time-zone data to tzdata2020c
    + JDK-8255050: Add pkcs11/KeyStore/ClientAuth.sh to Problem list
    + JDK-8255065: Zero: accessor_entry misses the IRIW case
    + JDK-8255226: (tz) Upgrade time-zone data to tzdata2020d
    + JDK-8255269: Unsigned overflow in g1Policy.cpp
    + JDK-8255365: Problem list failing client manual tests
    + JDK-8255457: Shenandoah: cleanup ShenandoahMarkTask
    + JDK-8255466: C2 crashes at ciObject::get_oop() const+0x0
    + JDK-8255550: x86: Assembler::cmpq(Address dst, Register src)
    encoding is incorrect
    + JDK-8255603: Memory/Performance regression after JDK-8210985
    + JDK-8255760: Shenandoah: match constants style in
    ShenandoahMarkTask fallback
    + JDK-8255781: Bump patch update version for OpenJDK:
    jdk-11.0.9.1
    + JDK-8255937: Better cleanup for
    test/jdk/javax/imageio/stream/StreamFlush.java
    + JDK-8256427: Test com/sun/jndi/dns/ConfigTests/
    /PortUnreachable.java does not work on AIX
    + JDK-8256452: Integrate missing part of JDK-8232370 to 11u
    + JDK-8256483: [TESTBUG] serviceability/jvmti/GetClassMethods/
    /libOverpassMethods.c fails to compile on gcc 4.4.x
    + JDK-8256557: libharfbuzz fails to link on gcc 4.4.x due to
  - Wl,-z,defs
    + JDK-8256618: Zero: Linux x86_32 build still fails
    + JDK-8256736: Zero: GTest tests fail with "unsuppported vm
    variant"
    + JDK-8256809: Annotation processing causes NPE during flow
    analysis
    + JDK-8257181: s390x builds are very noisy with gc-sections
    messages
    + JDK-8257242: [macOS] Java app crashes while switching input
    methods
    + JDK-8257545: SunJSSE FIPS regression in key exchange after
    JDK-8171279 11u backport
    + JDK-8257641: Shenandoah: Query is_at_shenandoah_safepoint()
    from control thread should return false
    + JDK-8257701: Shenandoah: objArrayKlass metadata is not marked
    with chunked arrays
    + JDK-8258630: Add expiry exception for QuoVadis root
    certificate
- New upstream dependency on libharfbuzz
- Regenerated patches: missing-return.patch system-pcsclite.patch</changelog>
  <changelog author="fstrba@suse.com" date="1616155200">- Added patches:
  * system-crypto-policy.patch
    + Let OpenJDK use system crypto policies unless explicitely told
    not to
  * nss-security-provider.patch
    + Add the NSS security provider with configuration in generated
    nss.cfg file
  * keytool-default-rsa.patch
    + Make keytool generate RSA keys by default, since only the
    LEGACY system crypto policy allows DSA</changelog>
  <changelog author="pujos.michael@gmail.com" date="1618488000">- moved mozilla-nss dependency to java-11-openjdk-headless package
  This is necessary to be able to do crypto with just
  java-11-openjdk-headless installed. Fixes boo#1184606</changelog>
  <changelog author="fstrba@suse.com" date="1619006400">- Update to upstream tag jdk-11.0.11+9 (April 2021, CPU)
  * Security fixes
    + JDK-8244473: Contextualize registration for JNDI
    + JDK-8244543: Enhanced handling of abstract classes
    + JDK-8249906, CVE-2021-2163, bsc#1185055: Enhance opening JARs
    + JDK-8250568, CVE-2021-2161, bsc#1185056: Less ambiguous
    processing
    + JDK-8253799: Make lists of normal filenames
    + JDK-8257001: Improve Http Client Support
  * Other changes
    + JDK-7107012: sun.jvm.hotspot.code.CompressedReadStream
    readDouble() conversion to long mishandled
    + JDK-7146776: deadlock between URLStreamHandler.getHostAddress
    and file.Handler.openconnection
    + JDK-8086003: Test fails on OSX with java.lang.RuntimeException
    'Narrow klass base: 0x0000000000000000, Narrow klass shift: 3'
    missing
    + JDK-8168869: jdeps: localized messages don't use proper line
    breaks
    + JDK-8180837: SunPKCS11-NSS tests failing with
    CKR_ATTRIBUTE_READ_ONLY and CKR_MECHANISM_PARAM_INVALID
    + JDK-8202343: Disable TLS 1.0 and 1.1
    + JDK-8205992: jhsdb cannot attach to Java processes running in
    Docker containers
    + JDK-8209193: Fix aarch64-linux compilation after -Wreorder
    changes
    + JDK-8210413: AArch64: Optimize div/rem by constant in C1
    + JDK-8210578: AArch64: Invalid encoding for fmlsvs instruction
    + JDK-8211051: jdeps usage of --dot-output doesn't provide
    valid output for modular jar
    + JDK-8211057: Gensrc step CompileProperties generates unstable
    CompilerProperties output
    + JDK-8211150: G1 Full GC not purging code root memory and
    hence causing memory leak
    + JDK-8211825: ModuleLayer.defineModulesWithXXX does not setup
    delegation when module reads automatic module
    + JDK-8212043: Add floating-point Math.min/max intrinsics
    + JDK-8212218: [TESTBUG] runtime/ErrorHandling/
    /TestHeapDumpOnOutOfMemoryErrorInMetaspace.java timed out
    + JDK-8213116: javax/swing/JComboBox/WindowsComboBoxSize/
    /WindowsComboBoxSizeTest.java fails in Windows
    + JDK-8213909: jdeps --print-module-deps should report missing
    dependences
    + JDK-8214180: Need better granularity for sleeping
    + JDK-8214223: tools/jdeps/listdeps/ListModuleDeps.java failed
    due to missing Lib2 file
    + JDK-8214230: Classes generated by SystemModulesPlugin.java
    are not reproducable
    + JDK-8214741: docs/index.html has no title or copyright
    + JDK-8215687: [Graal] unit test CheckGraalIntrinsics failed
    after 8212043
    + JDK-8217848: [Graal] vmTestbase/nsk/jvmti/ResourceExhausted/
    /resexhausted003/TestDescription.java fails
    + JDK-8218482: sun/security/krb5/auto/ReplayCachePrecise.java
    failed - no KrbException thrown
    + JDK-8218550: Add test omitted from JDK-8212043
    + JDK-8221584: SIGSEGV in os::PlatformEvent::unpark() in
    JvmtiRawMonitor::raw_exit while posting method exit event
    + JDK-8221995: AARCH64: problems with CAS instructions encoding
    + JDK-8222518: Remove unnecessary caching of Parker object in
    java.lang.Thread
    + JDK-8222785: aarch64: add necessary masking for immediate
    shift counts
    + JDK-8223186: HotSpot compile warnings from GCC 9
    + JDK-8225773: jdeps --check produces NPE if there are missing
    module dependences
    + JDK-8225805: Java Access Bridge does not close the logger
    + JDK-8226810: Failed to launch JVM because of
    NullPointerException occured on System.props
    + JDK-8229396: jdeps ignores multi-release when
    generate-module-info used on command line
    + JDK-8229474: Shenandoah: Cleanup CM::update_roots()
    + JDK-8232225: Rework the fix for JDK-8071483
    + JDK-8232905: JFR fails with assertion:
    assert(t-&gt;unflushed_size() == 0) failed: invariant
    + JDK-8233164: C2 fails with assert(phase-&gt;C-&gt;get_alias_index(t)
    == phase-&gt;C-&gt;get_alias_index(t_adr)) failed: correct memory
    chain
    + JDK-8233910: java/awt/ColorClass/AlphaColorTest.java is
    failing  intermittently in nightly lnux-x64 system
    + JDK-8233912: aarch64: minor improvements of atomic operations
    + JDK-8234508: VM_HeapWalkOperation::iterate_over_object reads
    non-strong fields with an on-strong load barrier
    + JDK-8234742: Improve handshake logging
    + JDK-8234796: Refactor Handshake::execute to take a more
    complex type than ThreadClosure
    + JDK-8235324: Dying objects are published from users of
    CollectedHeap::object_iterate
    + JDK-8235351: Lookup::unreflect should bind with the original
    caller independent of Method's accessible flag
    + JDK-8237369: Shenandoah: failed vmTestbase/nsk/jvmti/
    /AttachOnDemand/attach021/TestDescription.java test
    + JDK-8237392: Shenandoah: Remove unreliable assertion
    + JDK-8237483: AArch64 C1 OopMap inserted twice fatal error
    + JDK-8237495: Java MIDI fails with a dereferenced memory error
    when asked to send a raw 0xF7
    + JDK-8239355: (dc) Initial value of SO_SNDBUF should allow
    sending large datagrams (macOS)
    + JDK-8240353: AArch64: missing support for
  - XX:+ExtendedDTraceProbes in C1
    + JDK-8240704: CheckHandles.java failed "AssertionError: Handle
    use increased by more than 10 percent."
    + JDK-8240751: Shenandoah: fold ShenandoahTracer definition
    + JDK-8240795: [REDO] 8238384 CTW: C2 compilation fails with
    "assert(store != load-&gt;find_exact_control(load-&gt;in(0)))
    failed: dependence cycle found"
    + JDK-8241598: Upgrade JLine to 3.14.0
    + JDK-8241649: Optimize Character.toString
    + JDK-8241770: Module xxxAnnotation() methods throw NCDFE if
    module-info.class found as resource in unnamed module
    + JDK-8241911: AArch64: Fix a potential register clash issue in
    reduce_add2I
    + JDK-8242030: Wrong package declarations in jline classes after
    JDK-8241598
    + JDK-8242565: Policy initialization issues when the denyAfter
    constraint is enabled
    + JDK-8243618: compiler/rtm/cli tests can be run w/o WhiteBox
    + JDK-8243670: Unexpected test result caused by C2
    MergeMemNode::Ideal
    + JDK-8244088: [Regression] Switch of Gnome theme ends up in
    deadlocked UI
    + JDK-8244154: Update SunPKCS11 provider with PKCS11 v3.0 header
    files
    + JDK-8244340: Handshake processing thread lacks yielding
    + JDK-8244573: java.lang.ArrayIndexOutOfBoundsException thrown
    for malformed class file
    + JDK-8244683: A TSA server used by tests
    + JDK-8245005: javax/net/ssl/compatibility/BasicConnectTest.java
    failed with No enum constant
    + JDK-8245026: PsAdaptiveSizePolicy::_old_gen_policy_is_ready is
    unused
    + JDK-8245283: JFR: Can't handle constant dynamic used by Jacoco
    agent
    + JDK-8245512: CRC32 optimization using AVX512 instructions
    + JDK-8245527: LDAP Channel Binding support for Java
    GSS/Kerberos
    + JDK-8246707: (sc) SocketChannel.read/write throws
    AsynchronousCloseException on closed channel
    + JDK-8246709: sun/security/tools/jarsigner/
    /TsacertOptionTest.java compilation failed after JDK-8244683
    + JDK-8247200: assert((unsigned)fpargs &lt; 32)
    + JDK-8247766: [aarch64] guarantee(val &lt; (1U &lt;&lt; nbits))
    failed: Field too big for insn.
    + JDK-8248336: AArch64: C2: offset overflow in
    BoxLockNode::emit
    + JDK-8248865: Document JNDI/LDAP timeout properties
    + JDK-8248901: Signed immediate support in
    .../share/assembler.hpp is broken.
    + JDK-8249543: Force DirectBufferAllocTest to run with
  - ExplicitGCInvokesConcurrent
    + JDK-8249588: libwindowsaccessbridge issues on 64bit Windows
    + JDK-8249749: modify a primitive array through a stream and a
    for cycle causes jre crash
    + JDK-8249787: Make TestGCLocker more resilient with concurrent
    GCs
    + JDK-8249867: xml declaration is not followed by a newline
    + JDK-8250911: [windows] os::pd_map_memory() error detection
    broken
    + JDK-8251255: [linux] Add process-memory information to hs-err
    and VM.info
    + JDK-8251359: Shenandoah: filter null oops before calling
    enqueue/SATB barrier
    + JDK-8251925: C2: RenaissanceStressTest fails with
    assert(!had_error): bad dominance
    + JDK-8251944: Add Shenandoah test config to
    compiler/gcbarriers/UnsafeIntrinsicsTest.java
    + JDK-8251992: VM crashed running TestComplexAddrExpr.java test
    with -XX:UseAVX=X
    + JDK-8253220: Epsilon: clean up unused code/declarations
    + JDK-8253274: The CycleDMImagetest brokes the system
    + JDK-8253353: Crash in C2: guarantee(n != NULL) failed: No Node
    + JDK-8253368: TLS connection always receives close_notify
    exception
    + JDK-8253404: C2: assert(C-&gt;live_nodes() &lt;=
    C-&gt;max_node_limit()) failed: Live Node limit exceeded limit
    + JDK-8253409: Double-rounding possibility in float fma
    + JDK-8253476: TestUseContainerSupport.java fails on some Linux
    kernels w/o swap limit capabilities
    + JDK-8253524: C2: Refactor code that clones predicates during
    loop unswitching
    + JDK-8253644: C2: assert(skeleton_predicate_has_opaque(iff))
    failed: unexpected
    + JDK-8253681: closed java/awt/dnd/MouseEventAfterStartDragTest/
    /MouseEventAfterStartDragTest.html test failed
    + JDK-8253702: BigSur version number reported as 10.16, should
    be 11.nn
    + JDK-8253756: C2 CompilerThread0 crash in Node::add_req(Node*)
    + JDK-8254104: MethodCounters must exist before nmethod is
    installed
    + JDK-8254734: "dead loop detected" assert failure with patch
    from 8223051
    + JDK-8254748: Bad Copyright header format after JDK-8212218
    + JDK-8254799: runtime/ErrorHandling/
    /TestHeapDumpOnOutOfMemoryError.java fails with release VMs
    + JDK-8255058: C1: assert(is_virtual()) failed: type check
    + JDK-8255351: Add detection for Graviton 2 CPUs
    + JDK-8255368: Math.exp() gives wrong result for large values on
    x86 32-bit platforms
    + JDK-8255387: Japanese characters were printed upside down on
    AIX
    + JDK-8255401: Shenandoah: Allow oldval and newval registers to
    overlap in cmpxchg_oop()
    + JDK-8255479: [aarch64] assert(src-&gt;section_index_of(target) ==
    CodeBuffer::SECT_NONE) failed: sanity
    + JDK-8255544: Create a checked cast
    + JDK-8255559: Leak File Descriptors Because of
    ResolverLocalFilesystem#engineResolveURI()
    + JDK-8255681: print callstack in error case in
    runAWTLoopWithApp
    + JDK-8255734: VM should ignore SIGXFSZ on ppc64, s390 too
    + JDK-8255742: PrintInlining as compiler directive doesn't print
    virtual calls
    + JDK-8255845: Memory leak in imageFile.cpp
    + JDK-8255880: UI of Swing components is not redrawn after their
    internal state changed
    + JDK-8255908: ExceptionInInitializerError due to
    UncheckedIOException while initializing cgroupv1 subsystem
    + JDK-8256025: AArch64: MachCallRuntimeNode::ret_addr_offset()
    is incorrect for stub calls
    + JDK-8256056: Deoptimization stub doesn't save vector registers
    on x86
    + JDK-8256061: RegisterSaver::save_live_registers() omits upper
    halves of ZMM0-15 registers
    + JDK-8256187: [TEST_BUG] Automate bug4275046.java test
    + JDK-8256220: C1: x86_32 fails with -XX:UseSSE=1 after
    JDK-8210764 due to mishandled lir_neg
    + JDK-8256258: some missing NULL checks or asserts after
    CodeCache::find_blob_unsafe
    + JDK-8256264: Printed GlyphVector outline with low DPI has bad
    quality on Windows
    + JDK-8256290: javac/lambda/T8031967.java fails with
    StackOverflowError on x86_32
    + JDK-8256359: AArch64: runtime/ReservedStack/
    /ReservedStackTestCompiler.java fails
    + JDK-8256387: Unexpected result if patching an entire
    instruction on AArch64
    + JDK-8256421: Add 2 HARICA roots to cacerts truststore
    + JDK-8256488: [aarch64] Use ldpq/stpq instead of ld4/st4 for
    small copies in StubGenerator::copy_memory
    + JDK-8256489: Make gtest for long path names on Windows more
    resilient in the presence of virus scanners
    + JDK-8256501: libTestMainKeyWindow fails to build with Xcode
    12.2
    + JDK-8256633: Fix product build on Windows+Arm64
    + JDK-8256682: JDK-8202343 is incomplete
    + JDK-8256751: Incremental rebuild with precompiled header fails
    when touching a header file
    + JDK-8256757: Incorrect MachCallRuntimeNode::ret_addr_offset()
    for CallLeafNoFP on x86_32
    + JDK-8256806: Shenandoah: optimize shenandoah/jni/
    /TestPinnedGarbage.java test
    + JDK-8256807: C2: Not marking stores correctly as mismatched
    in string opts
    + JDK-8256810: Incremental rebuild broken on Macosx
    + JDK-8256818: SSLSocket that is never bound or connected leaks
    socket resources
    + JDK-8256888: Client manual test problem list update
    + JDK-8257083: Security infra test failures caused by
    JDK-8202343
    + JDK-8257408: Bump update version for OpenJDK: jdk-11.0.11
    + JDK-8257423: [PPC64] Support -XX:-UseInlineCaches
    + JDK-8257436: [aarch64] Regressions in ArrayCopyUnalignedDst
    .testByte/testChar for 65-78 bytes when UseSIMDForMemoryOps
    is on
    + JDK-8257513: C2: assert((constant_addr -
    _masm.code()-&gt;consts()-&gt;start()) == con.offset())
    + JDK-8257547: Handle multiple prereqs on the same line in deps
    files
    + JDK-8257561: Some code is not vectorized after 8251925 and
    8250607
    + JDK-8257565: epsilonBarrierSet.hpp should not include
    barrierSetAssembler
    + JDK-8257575: C2: "failed: only phis" assert failure in loop
    strip mining verification
    + JDK-8257594: C2 compiled checkcast of non-null object triggers
    endless deoptimization/recompilation cycle
    + JDK-8257633: Missing -mmacosx-version-min=X flag when linking
    libjvm
    + JDK-8257670: sun/security/ssl/SSLSocketImpl/SSLSocketLeak.java
    reports leaks
    + JDK-8257707: Fix incorrect format string in Http1HeaderParser
    + JDK-8257746: Regression introduced with JDK-8250984 - memory
    might be null in some machines
    + JDK-8257798: [PPC64] undefined reference to
    Klass::vtable_start_offset()
    + JDK-8257884: Re-enable sun/security/ssl/SSLSocketImpl/
    /SSLSocketLeak.java as automatic test
    + JDK-8257910: [JVMCI] Set exception_seen accordingly in the
    runtime.
    + JDK-8257997: sun/security/ssl/SSLSocketImpl/SSLSocketLeak.java
    again reports leaks after JDK-8257884
    + JDK-8257999: Parallel GC crash in gc/parallel/
    /TestDynShrinkHeap.java: new region is not in covered_region
    + JDK-8258077: Using -Xcheck:jni can lead to a double-free after
    JDK-8193234
    + JDK-8258247: Couple of issues in fix for JDK-8249906
    + JDK-8258373: Update the text handling in the JPasswordField
    + JDK-8258396: SIGILL in jdk.jfr.internal.PlatformRecorder
    .rotateDisk()
    + JDK-8258419: RSA cipher buffer cleanup
    + JDK-8258471: "search codecache" clhsdb command does not work
    + JDK-8258534: Epsilon: clean up unused includes
    + JDK-8258805: Japanese characters not entered by mouse click
    on Windows 10
    + JDK-8258833: Cancel multi-part cipher operations in SunPKCS11
    after failures
    + JDK-8258836: JNI local refs exceed capacity
    getDiagnosticCommandInfo
    + JDK-8258884: [TEST_BUG] Convert applet-based test
    open/test/jdk/javax/swing/JMenuItem/8031573/bug8031573.java
    to a regular java test
    + JDK-8259007: This test printed a blank page
    + JDK-8259048: (tz) Upgrade time-zone data to tzdata2020f
    + JDK-8259049: Uninitialized variable after JDK-8257513
    + JDK-8259231: Epsilon: improve performance under contention
    during virtual space expansion
    + JDK-8259271: gc/parallel/TestDynShrinkHeap.java still fails
    "assert(covered_region.contains(new_memregion)) failed: new
    region is not in covered_region"
    + JDK-8259312: VerifyCACerts.java fails as soneraclass2ca cert
    will expire in 90 days
    + JDK-8259319: Illegal package access when SunPKCS11 requires
    SunJCE's classes
    + JDK-8259339: AllocateUninitializedArray C2 intrinsic fails
    with void.class input
    + JDK-8259428: AlgorithmId.getEncodedParams() should return copy
    + JDK-8259446: runtime/jni/checked/
    /TestCheckedReleaseArrayElements.java fails with stderr not
    empty
    + JDK-8259451: Zero: skip serviceability/sa tests, set vm.hasSA
    to false
    + JDK-8259580: Shenandoah: uninitialized label in
    VerifyThreadGCState
    + JDK-8259619: C1: 3-arg StubAssembler::call_RT stack-use
    condition is incorrect
    + JDK-8259633: compiler/graalunit/CoreTest.java fails with NPE
    after JDK-8244543
    + JDK-8259706: C2 compilation fails with assert(vtable_index ==
    Method::invalid_vtable_index) failed: correct sentinel value
    + JDK-8259707: LDAP channel binding does not work with StartTLS
    extension
    + JDK-8259773: Incorrect encoding of AVX-512 kmovq instruction
    + JDK-8259849: Shenandoah: Rename store-val to IU-barrier
    + JDK-8259949: x86 32-bit build fails when -fcf-protection is
    passed in the compiler flags
    + JDK-8259954: gc/shenandoah/mxbeans tests fail with -Xcomp
    + JDK-8260029: aarch64: fix typo in verify_oop_array
    + JDK-8260308: Update LogCompilation junit to 4.13.1
    + JDK-8260338: Some fields in HaltNode is not cloned
    + JDK-8260349: Cannot programmatically retrieve Metaspace max
    set via JAVA_TOOL_OPTIONS
    + JDK-8260356: (tz) Upgrade time-zone data to tzdata2021a
    + JDK-8260378: [TESTBUG] DcmdMBeanTestCheckJni.java reports
    false positive
    + JDK-8260497: Shenandoah: Improve SATB flushing
    + JDK-8260502: [s390] NativeMovRegMem::verify() fails because
    it's too strict
    + JDK-8260632: Build failures after JDK-8253353
    + JDK-8260704: ParallelGC: oldgen expansion needs release-store
    for _end
    + JDK-8261022: Fix incorrect result of Math.abs() with char type
    + JDK-8261089: [TESTBUG] native library of test
    TestCheckedReleaseCriticalArray.java fails to compile with
    gcc 4.x
    + JDK-8261183: Follow on to Make lists of normal filenames
    + JDK-8261209: isStandalone property: remove dependency on
    pretty-print
    + JDK-8261231: Windows IME was disabled after DnD operation
    + JDK-8261251: Shenandoah: Use object size for full GC
    humongous compaction
    + JDK-8261310: PPC64 Zero build fails with
    'VMError::controlled_crash(int)::FunctionDescriptor
    functionDescriptor' has incomplete type and cannot be defined
    + JDK-8261334: NMT: tuning statistic shows incorrect hash
    distribution
    + JDK-8261413: Shenandoah: Disable class-unloading in I-U mode
    + JDK-8261522: [PPC64] AES intrinsics write beyond the
    destination array
    + JDK-8261534: Test sun/security/pkcs11/KeyAgreement/
    /IllegalPackageAccess.java fails on platforms where no nsslib
    artifacts are defined
    + JDK-8261585: Restore HandleArea used in
    Deoptimization::uncommon_trap
    + JDK-8261753: Test java/lang/System/OsVersionTest.java still
    failing on BigSur patch versions after JDK-8253702
    + JDK-8261829: Exclude tools/jlink/JLinkReproducibleTest.java
    in 11u
    + JDK-8261912: Code IfNode::fold_compares_helper more
    defensively
    + JDK-8261920: [AIX] jshell command throws java.io.IOError on
    non English locales
    + JDK-8262018: Wrong format in SAP copyright header of
    OsVersionTest
    + JDK-8263069: Exclude some failing tests from
    security/infra/java/security/cert/CertPathValidator</changelog>
  <changelog author="fstrba@suse.com" date="1620043200">- Remove all Jpackage provides for SLE12 in order to avoid
  installing this package as default Java on SLE12-SP5
  (bsc#1185476)</changelog>
  <changelog author="fstrba@suse.com" date="1621512000">- Modified patch:
  * nss-security-provider.patch
    + make the NSS provider first in the list</changelog>
  <changelog author="fstrba@suse.com" date="1626868800">- Update to upstream tag jdk-11.0.12+7 (July 2021, CPU)
  * Security fixes
    + JDK-8256157: Improve bytecode assembly
    + JDK-8256491: Better HTTP transport
    + JDK-8258432, CVE-2021-2341, bsc#1188564: Improve file
    transfers
    + JDK-8260453: Improve Font Bounding
    + JDK-8260960: Signs of jarsigner signing
    + JDK-8260967, CVE-2021-2369, bsc#1188565: Better jar file
    validation
    + JDK-8262380: Enhance XML processing passes
    + JDK-8262403: Enhanced data transfer
    + JDK-8262410: Enhanced rules for zones
    + JDK-8262477: Enhance String Conclusions
    + JDK-8262967: Improve Zip file support
    + JDK-8264066, CVE-2021-2388, bsc#1188566: Enhance compiler
    validation
    + JDK-8264079: Improve abstractions
    + JDK-8264460: Improve NTLM support
  * Other changes
    + JDK-6847157: java.lang.NullPointerException: HDC for
    component at sun.java2d.loops.Blit.Blit
    + JDK-7106851: Test should not use System.exit
    + JDK-8073446: TimeZone getOffset API does not  return a dst
    offset between years 2038-2137
    + JDK-8076190: Customizing the generation of a PKCS12 keystore
    + JDK-8153005: Upgrade the default PKCS12 encryption/MAC
    algorithms
    + JDK-8171303: sun/java2d/pipe/InterpolationQualityTest.java
    fails on Windows &amp; Linux
    + JDK-8177068: incomplete classpath causes NPE in Flow
    + JDK-8185734: [Windows] Structured Exception Catcher missing
    around gtest execution
    + JDK-8187450: JNI local refs exceeds capacity warning in
    NetworkInterface::getAll
    + JDK-8190763: Class cast exception on (CompoundEdit)
    UndoableEditEvent.getEdit()
    + JDK-8195841: PNGImageReader.readNullTerminatedString() doesnt
    check for non-null terminated strings with length equal to
    maxLen
    + JDK-8196100: javax/swing/text/JTextComponent/5074573/
    /bug5074573.java fails
    + JDK-8199646: JShell tests: jdk/jshell/
    /FailOverDirectExecutionControlTest.java failed with
    java.lang.UnsupportedOperationException
    + JDK-8206925: Support the certificate_authorities extension
    + JDK-8207160: ClassReader::adjustMethodParams can potentially
    return null if the args list is empty
    + JDK-8207247: AARCH64: Enable Minimal and Client VM builds
    + JDK-8207404: MulticastSocket tests failing on AIX
    + JDK-8207779: Method::is_valid_method() compares 'this' with
    NULL
    + JDK-8208061: runtime/LoadClass/TestResize.java fails with
    "Load factor too high" when running in CDS mode.
    + JDK-8209459: TestSHA512MultiBlockIntrinsics failed on AArch64
    + JDK-8210443: Migrate Locale matching tests to JDK Repo.
    + JDK-8213231: ThreadSnapshot::_threadObj can become stale
    + JDK-8213483: ARM32: runtime/ErrorHandling/
    /ShowRegistersOnAssertTest.java jtreg test fail
    + JDK-8213725: JShell NullPointerException due to class file
    with unexpected package
    + JDK-8213794: ARM32: disable TypeProfiling,
    CriticalJNINatives, Serviceablity tests for ARM32
    + JDK-8213845: ARM32: Interpreter doesn't call result handler
    after native calls
    + JDK-8214128: ARM32: wrong stack alignment on
    Deoptimization::unpack_frames
    + JDK-8214512: ARM32: Jtreg test compiler/c2/Test8062950.java
    fails on ARM
    + JDK-8214854: JDWP: Unforseen output truncation in logging
    + JDK-8214922: Add vectorization support for fmin/fmax
    + JDK-8215009: GCC 8 compilation error in libjli
    + JDK-8216184: CDS/appCDS tests failed on Windows due to long
    path to a classlist file
    + JDK-8216259: AArch64: Vectorize Adler32 intrinsics
    + JDK-8216314: SIGILL in CodeHeapState::print_names()
    + JDK-8217348: assert(thread-&gt;is_Java_thread()) failed: just
    checking
    + JDK-8217465: [REDO] - Optimize CodeHeap Analytics
    + JDK-8217561: X86: Add floating-point Math.min/max intrinsics
    + JDK-8217918: C2: -XX:+AggressiveUnboxing is broken
    + JDK-8218458: [TESTBUG] runtime/NMT/
    /CheckForProperDetailStackTrace.java fails with Expected
    stack trace missing from output
    + JDK-8219142: Remove unused JIMAGE_ResourcePath
    + JDK-8219586: CodeHeap State Analytics processes dead nmethods
    + JDK-8220074: Clean up GCC 8.3 errors in LittleCMS
    + JDK-8220407: compiler/intrinsics/math/
    /TestFpMinMaxIntrinsics.java timedout
    + JDK-8222302: [TESTBUG] test/hotspot/jtreg/compiler/intrinsics/
    /sha/cli/TestUseSHAOptionOnUnsupportedCPU.java fails on any
    other CPU
    + JDK-8222412: AARCH64: multiple instructions encoding issues
    + JDK-8223020: aarch64: expand minI_rReg and maxI_rReg patterns
    into separate instructions
    + JDK-8223444: Improve CodeHeap Free Space Management
    + JDK-8223504: Improve performance of forall loops by better
    inlining of "iterator()" methods
    + JDK-8223667: ASAN build broken
    + JDK-8225081: Remove Telia Company CA certificate expiring in
    April 2021
    + JDK-8225116: Test OwnedWindowsLeak.java intermittently fails
    + JDK-8225438: javax/net/ssl/TLSCommon/
    /TestSessionLocalPrincipal.java failed with Read timed out
    + JDK-8225756: [testbug] compiler/loopstripmining/
    /CheckLoopStripMining.java sets too short a
    SafepointTimeoutDelay
    + JDK-8226374: Restrict TLS signature schemes and named groups
    + JDK-8226627: assert(t-&gt;singleton()) failed: must be a constant
    + JDK-8226721: Missing intrinsics for Math.ceil, floor, rint
    + JDK-8227080: (fs) Files.newInputStream(...).skip(n) is slow
    + JDK-8227222: vmTestbase/jit/FloatingPoint/gen_math/Loops04/
    /Loops04.java failed XMM register should be 0-15
    + JDK-8227609: (fs) Files.newInputStream(...).skip(n) should
    allow skipping beyond file size
    + JDK-8230428: Cleanup dead CastIP node code in formssel.cpp
    + JDK-8231460: Performance issue (CodeHeap) with large free
    blocks
    + JDK-8231713: x86_32 build failures after JDK-8226721 (Missing
    intrinsics for Math.ceil, floor, rint)
    + JDK-8231841: AArch64: debug.cpp help() is missing an AArch64
    line for pns
    + JDK-8232084: HotSpot build failed with GCC 9.2.1
    + JDK-8232591: AArch64: Add missing match rules for smaddl,
    smsubl and smnegl
    + JDK-8233185: HttpServer.stop() blocks indefinitely when
    called on dispatch thread
    + JDK-8233787: Break cycle in vm_version* includes
    + JDK-8233948: AArch64: Incorrect mapping between OptoReg and
    VMReg for high 64 bits of Vector Register
    + JDK-8234355: Buffer overflow in jcmd GC.class_stats due to
    too many classes
    + JDK-8235368: Update BCEL to Version 6.4.1
    + JDK-8236859: WebSocket over authenticating proxy fails with
    NPE
    + JDK-8236992: AArch64: remove redundant load_klass in itable
    stub
    + JDK-8237743: test/langtools/jdk/jshell/
    /FailOverExecutionControlTest.java fails No
    ExecutionControlProvider with name 'nonExistent' and parameter
    keys: []
    + JDK-8237804: sun/security/mscapi tests fail with "Key pair
    not generated, alias &lt;nnnnnn&gt; already exists"
    + JDK-8238175: CTW: Class.getDeclaredMethods fails with
    assert(k-&gt;is_subclass_of(SystemDictionary::Throwable_klass()))
    failed: invalid exception class
    + JDK-8238567: SoftMainMixer.processAudioBuffers(): Wrong
    handling of stoppedMixers
    + JDK-8238812: assert(false) failed: bad AD file
    + JDK-8239312: [macos] javax/swing/JFrame/NSTexturedJFrame/
    /NSTexturedJFrame.java
    + JDK-8239386: handle ContendedPaddingWidth in
    vm_version_aarch64
    + JDK-8239536: Can't use 'java.util.List' object after
    importing 'java.awt.List'
    + JDK-8240487: Cleanup whitespace in .cc, .hh, .m, and .mm files
    + JDK-8240848: ArrayIndexOutOfBoundsException buf for
    TextCallbackHandler
    + JDK-8241082: Upgrade IANA Language Subtag Registry data to
    03-16-2020 version
    + JDK-8241087: Build failure with VS 2019 (16.5.0) due to C2039
    and C2873
    + JDK-8241101: [s390] jtreg test failure after JDK-8238696: not
    conformant features string
    + JDK-8241248: NullPointerException in
    sun.security.ssl.HKDF.extract(HKDF.java:93)
    + JDK-8241372: Several test failures due to
    javax.net.ssl.SSLException: Connection reset
    + JDK-8241475: AArch64: Add missing support for PopCountVI node
    + JDK-8241829: Cleanup the code for PrinterJob on windows
    + JDK-8241960: The SHA3 message digests impl of SUN provider
    are not thread safe after cloned
    + JDK-8242010: Upgrade IANA Language Subtag Registry to Version
    2020-04-01
    + JDK-8242429: Better implementation for sign extract
    + JDK-8242557: Add length limit for strings in PNGImageWriter
    + JDK-8242919: Paste locks up jshell
    + JDK-8243155: AArch64: Add support for SqrtVF
    + JDK-8243240: AArch64: Add support for MulVB
    + JDK-8243452: JFR: Could not create chunk in repository with
    over 200 recordings
    + JDK-8243559: Remove root certificates with 1024-bit keys
    + JDK-8243597: AArch64: Add support for integer vector abs
    + JDK-8244031: HttpClient should have more tests for HEAD
    requests
    + JDK-8244205: HTTP/2 tunnel connections through proxy may be
    reused regardless of which proxy is selected
    + JDK-8244847: Linux/PPC: runtime/CompressedOops/
    /CompressedClassPointers: smallHeapTest fails
    + JDK-8245511: G1 adaptive IHOP does not account for
    reclamation of humongous objects by young GC
    + JDK-8246274: G1 old gen allocation tracking is not in a
    separate class
    + JDK-8247354: [aarch64] PopFrame causes
    assert(oopDesc::is_oop(obj)) failed: not an oop
    + JDK-8247408: IdealGraph bit check expression canonicalization
    + JDK-8247432: Update IANA Language Subtag Registry to Version
    2020-09-29
    + JDK-8247438: JShell: When FailOverExecutionControlProvider
    fails the proximal cause is not shown
    + JDK-8247753: UIManager.getSytemLookAndFeelClassName() returns
    wrong value on Fedora 32
    + JDK-8248043: Need to eliminate excessive i2l conversions
    + JDK-8248411: [aarch64] Insufficient error handling when
    CodeBuffer is exhausted
    + JDK-8248568: compiler/c2/TestBit.java failed: test missing
    from stdout/stderr
    + JDK-8248870: AARCH64: I2L/L2I conversions can be skipped for
    masked positive values
    + JDK-8249142: java/awt/FontClass/CreateFont/DeleteFont.sh is
    unstable
    + JDK-8249189: AARCH64: more L2I conversions can be skipped
    + JDK-8249719: MethodHandle performance suffers from bad
    ResolvedMethodTable hash function
    + JDK-8249875: GCC 10 warnings -Wtype-limits with JFR code
    + JDK-8250635: MethodArityHistogram should use Compile_lock in
    favour of fancy checks
    + JDK-8250876: Fix issues with cross-compile on macos
    + JDK-8251031: Some vmTestbase/nsk/monitoring/RuntimeMXBean
    tests fail with hostnames starting from digits
    + JDK-8251525: AARCH64: Faster Math.signum(fp)
    + JDK-8252259: AArch64: Adjust default value of FLOATPRESSURE
    + JDK-8252311: AArch64: save two words in itable lookup stub
    + JDK-8252779: compiler/graalunit/HotspotTest.java failed after
    8251525
    + JDK-8252883: AccessDeniedException caused by delayed file
    deletion on Windows
    + JDK-8253167: ARM32 builds fail after JDK-8247910
    + JDK-8253572: [windows] CDS archive may fail to open with long
    file names
    + JDK-8253923: C2 doesn't always run loop opts for compilations
    that include loops
    + JDK-8253948: Memory leak in ImageFileReader
    + JDK-8254631: Better support ALPN byte wire values in SunJSSE
    + JDK-8254717: isAssignableFrom checks in
    KeyFactorySpi.engineGetKeySpec appear to be backwards
    + JDK-8255086: Update the root locale display names
    + JDK-8255625: AArch64: Implement Base64.encodeBlock
    accelerator/intrinsic
    + JDK-8255763: C2: OSR miscompilation caused by invalid memory
    instruction placement
    + JDK-8255992: JFR EventWriter does not use first string from
    StringPool with id 0
    + JDK-8256037: [TESTBUG] com/sun/jndi/dns/ConfigTests/
    /PortUnreachable.java fails due to the hard coded threshold
    is small
    + JDK-8256244: java/lang/ProcessHandle/PermissionTest.java
    fails with TestNG 7.1
    + JDK-8256287: [windows] add loop fuse to
    map_or_reserve_memory_aligned
    + JDK-8256523: Streamline Java SHA2 implementation
    + JDK-8257414: Drag n Drop target area is wrong on high DPI
    systems
    + JDK-8257569: Failure observed with
    JfrVirtualMemory::initialize
    + JDK-8257574: C2: "failed: parsing found no loops but there
    are some" assert failure
    + JDK-8257580: Bump update version for OpenJDK: jdk-11.0.12
    + JDK-8257604: JNI_ArgumentPusherVaArg leaks valist
    + JDK-8257621: JFR StringPool misses cached items across
    consecutive recordings
    + JDK-8257796: [TESTBUG]
    TestUseSHA512IntrinsicsOptionOnSupportedCPU.java fails
    on x86_32
    + JDK-8257822: C2 crashes with SIGFPE due to a division that
    floats above its zero check
    + JDK-8257828: SafeFetch may crash if invoked in non-JavaThreads
    + JDK-8257853: Remove dependencies on JNF's JNI utility
    functions in AWT and 2D code
    + JDK-8257858: [macOS]: Remove JNF dependency from
    libosxsecurity/KeystoreImpl.m
    + JDK-8257860: [macOS]: Remove JNF dependency from
    libosxkrb5/SCDynamicStoreConfig.m
    + JDK-8257988: Remove JNF dependency from
    libsaproc/MacosxDebuggerLocal.m
    + JDK-8258414: OldObjectSample events too expensive
    + JDK-8258505: [TESTBUG] TestDivZeroWithSplitIf.java fails due
    to missing UnlockDiagnosticVMOptions
    + JDK-8258753: StartTlsResponse.close() hangs due to
    synchronization issues
    + JDK-8259061: C2: assert(found) failed: memory-writing node is
    not placed in its original loop or an ancestor of it
    + JDK-8259227: C2 crashes with SIGFPE due to a division that
    floats above its zero check
    + JDK-8259232: Bad JNI lookup during printing
    + JDK-8259276: C2: Empty expression stack when reexecuting
    tableswitch/lookupswitch instructions after deoptimization
    + JDK-8259343: [macOS] Update JNI error handling in Cocoa code.
    + JDK-8259585: Accessible actions do not work on mac os x
    + JDK-8259651: [macOS] Replace JNF_COCOA_ENTER/EXIT macros
    + JDK-8259662: Don't wrap SocketExceptions into SSLExceptions
    in SSLSocketImpl
    + JDK-8259710: Inlining trace leaks memory
    + JDK-8259729: Missed JNFInstanceOf -&gt; IsInstanceOf conversion
    + JDK-8259777: Incorrect predication condition generated by ADLC
    + JDK-8259786: initialize last parameter of getpwuid_r
    + JDK-8259843: initialize dli_fname array before calling
    dll_address_to_library_name
    + JDK-8259869: [macOS] Remove desktop module dependencies on
    JNF Reference APIs
    + JDK-8259886: Improve SSL session cache performance and
    scalability
    + JDK-8259983: do not use uninitialized expand_ms value in
    G1CollectedHeap::expand_heap_after_young_collection
    + JDK-8260030: Improve stringStream buffer handling
    + JDK-8260236: better init AnnotationCollector _contended_group
    + JDK-8260255: C1: LoopInvariantCodeMotion constructor can
    leave some fields uninitialized
    + JDK-8260284: C2: assert(_base == Int) failed: Not an Int
    + JDK-8260380: Upgrade to LittleCMS 2.12
    + JDK-8260420: C2 compilation fails with assert(found_sfpt)
    failed: no node in loop that's not input to safepoint
    + JDK-8260426: awt debug_mem.c DMem_AllocateBlock might leak
    memory
    + JDK-8260432: allocateSpaceForGP in freetypeScaler.c might
    leak memory
    + JDK-8260616: Removing remaining JNF dependencies in the
    java.desktop module
    + JDK-8260653: Unreachable nodes keep speculative types alive
    + JDK-8260707: java/lang/instrument/PremainClass/
    /InheritAgent0100.java times out
    + JDK-8260925: HttpsURLConnection does not work  with other
    JSSE provider.
    + JDK-8260926: Trace resource exhausted events unconditionally
    + JDK-8261020: Wrong format parameter in
    create_emergency_chunk_path
    + JDK-8261027: AArch64: Support for LSE atomics C++ HotSpot code
    + JDK-8261167: print_process_memory_info add a close call after
    fopen
    + JDK-8261170: Upgrade to freetype 2.10.4
    + JDK-8261198: [macOS] Incorrect JNI parameters in number
    conversion in A11Y code
    + JDK-8261235: C1 compilation fails with
    assert(res-&gt;vreg_number() == index) failed: conversion check
    + JDK-8261261: The version extra fields needs to be overridable
    in jib-profiles.js
    + JDK-8261262: Kitchensink24HStress.java crashed with
    EXCEPTION_ACCESS_VIOLATION
    + JDK-8261354: SIGSEGV at MethodIteratorHost
    + JDK-8261355: No data buffering in SunPKCS11 Cipher encryption
    when the underlying mechanism has no padding
    + JDK-8261397: try catch Method failing to work when dividing
    an integer by 0
    + JDK-8261422: Adjust problematic String.format calls in
    jdk/internal/util/Preconditions.java outOfBoundsMessage
    + JDK-8261447: MethodInvocationCounters frequently run into
    overflow
    + JDK-8261481: Cannot read Kerberos settings in dynamic store
    on macOS Big Sur
    + JDK-8261505: Test test/hotspot/jtreg/gc/parallel/
    /TestDynShrinkHeap.java killed by Linux OOM Killer
    + JDK-8261601: free memory in early return in
    Java_sun_nio_ch_sctp_SctpChannelImpl_receive0
    + JDK-8261649: AArch64: Optimize LSE atomics in C++ code
    + JDK-8261730: C2 compilation fails with
    assert(store-&gt;find_edge(load) != -1) failed: missing
    precedence edge
    + JDK-8261752: Multiple GC test are missing memory requirements
    + JDK-8261791: (sctp) handleSendFailed in SctpChannelImpl.c
    potential leaks
    + JDK-8261812: C2 compilation fails with assert(!had_error)
    failed: bad dominance
    + JDK-8261914: IfNode::fold_compares_helper faces
    non-canonicalized bool when running JRuby JSON workload
    + JDK-8262093: java/util/concurrent/tck/JSR166TestCase.java
    failed "assert(false) failed: unexpected node"
    + JDK-8262110: DST starts from incorrect time in 2038
    + JDK-8262121: [11u] Redo 8244287: JFR: Methods samples have
    line number 0
    + JDK-8262163: Extend settings printout in jcmd VM.metaspace
    + JDK-8262295: C2: Out-of-Bounds Array Load from Clone Source
    + JDK-8262298: G1BarrierSetC2::step_over_gc_barrier fails with
    assert "bad barrier shape"
    + JDK-8262446: DragAndDrop hangs on Windows
    + JDK-8262461: handle wcstombsdmp return value correctly in
    unix awt_InputMethod.c
    + JDK-8262465: Very long compilation times and high memory
    consumption in C2 debug builds
    + JDK-8262726: AArch64: C1 StubAssembler::call_RT can corrupt
    stack
    + JDK-8262739: String inflation C2 intrinsic prevents insertion
    of anti-dependencies
    + JDK-8262829: Native crash in
    Win32PrintServiceLookup.getAllPrinterNames()
    + JDK-8262837: handle split_USE correctly
    + JDK-8262900: ToolBasicTest fails to access HTTP server it
    starts
    + JDK-8263260: [s390] Support latest hardware (z14 and z15)
    + JDK-8263311: Watch registry changes for remote printers
    update instead of polling
    + JDK-8263361: Incorrect arraycopy stub selected by C2 for SATB
    collectors
    + JDK-8263404: RsaPrivateKeySpec is always recognized as
    RSAPrivateCrtKeySpec in RSAKeyFactory.engineGetKeySpec
    + JDK-8263425: AArch64: two potential bugs in C1
    LIRGenerator::generate_address()
    + JDK-8263448: CTW: fatal error: meet not symmetric
    + JDK-8263504: Some OutputMachOpcodes fields are uninitialized
    + JDK-8263557: Possible NULL dereference in
    Arena::destruct_contents()
    + JDK-8263558: Possible NULL dereference in fast path arena
    free if ZapResourceArea is true
    + JDK-8263676: AArch64: one potential bug in C1
    LIRGenerator::generate_address()
    + JDK-8263729: [test] divert spurious output away from stream
    under test in ProcessBuilder Basic test
    + JDK-8263846: Bad JNI lookup getFocusOwner in accessibility
    code on Mac OS X
    + JDK-8264047: Duplicate global variable 'jvm' in libjavajpeg
    and libawt
    + JDK-8264096: slowdebug jvm crashes when StrInflatedCopy match
    rule is not supported
    + JDK-8264151: ciMethod::ensure_method_data() should return
    false is loading resulted in empty state
    + JDK-8264173: [s390] Improve Hardware Feature Detection And
    Reporting
    + JDK-8264190: Harden TLS interop tests
    + JDK-8264223: CodeHeap::verify fails extra_hops assertion in
    fastdebug test
    + JDK-8264328: Broken license in
    javax/swing/JComboBox/8072767/bug8072767.java
    + JDK-8264360: Loop strip mining verification fails with
    "should be on the backedge"
    + JDK-8264626: C1 should be able to inline excluded methods
    + JDK-8264640: CMS ParScanClosure misses a barrier
    + JDK-8264786: [macos] All Swing/AWT apps cause Allow
    Notifications prompt to appear when app is launched
    + JDK-8264821: DirectIOTest fails on a system with large block
    size
    + JDK-8264848: [macos] libjvm.dylib linker warning due to macOS
    version mismatch
    + JDK-8264923: PNGImageWriter.write_zTXt throws Exception with
    a typo
    + JDK-8264958: C2 compilation fails with assert "n is later
    than its clone"
    + JDK-8265099: Revert backport to 11u of 8236859: WebSocket
    over authenticating proxy fails with NPE
    + JDK-8265154: vinserti128 operand mix up for KNL platforms
    + JDK-8265239: Shenandoah: Shenandoah heap region count could
    be off by 1
    + JDK-8265417: Backport of JDK-8249672 breaks Solaris x86 build
    + JDK-8265421: java/lang/String/StringRepeat.java test is
    missing a memory requirement
    + JDK-8265462: Handle multiple slots in the NSS Internal Module
    from SunPKCS11's Secmod
    + JDK-8265537: x86 version string truncated after JDK-8249672
    11u backport
    + JDK-8265666: Enable AIX build platform to make external debug
    symbols
    + JDK-8265677: CMS: CardTableBarrierSet::write_ref_array_work()
    lacks storestore barrier
    + JDK-8265690: Use the latest Ubuntu base image version in
    Docker testing
    + JDK-8265718: Build failure after JDK-8258414 11u backport
    + JDK-8265750: Fatal error in safepoint.cpp after backport of
    8258414
    + JDK-8265784: [C2] Hoisting of DecodeN leaves MachTemp inputs
    behind
    + JDK-8265938: C2's conditional move optimization does not
    handle top Phi
    + JDK-8266220: keytool still prompt for store password on a
    password-less pkcs12 file if -storetype pkcs12 is specified
    + JDK-8266293: Key protection using PBEWithMD5AndDES fails with
    "java.security.InvalidAlgorithmParameterException: Salt must
    be 8 bytes long"
    + JDK-8266713: [AIX] Build failure after 11u backport of
    JDK-8247753
    + JDK-8266802: Shenandoah: Round up region size to page size
    unconditionally
    + JDK-8266892: avoid maybe-uninitialized gcc warnings on linux
    s390x
    + JDK-8266929: Unable to use algorithms from 3p providers
    + JDK-8267235: [macos_aarch64]
    InterpreterRuntime::throw_pending_exception messing up LR
    results in crash
    + JDK-8267561: Shenandoah: Reference processing not properly
    setup for outside of cycle degenerated GC
    + JDK-8267599: Revert the change to the default PKCS12
    macAlgorithm and macIterationCount props for 11u/8u/7u
    + JDK-8267641: [11u] 8227609 backport typo
    + JDK-8267721: Enable sun/security/pkcs11 tests for Amazon
    Linux 2 AArch64
    + JDK-8268678: LetsEncryptCA.java test fails as Let's Encrypt
    Authority X3 is retired</changelog>
  <changelog author="schwab@suse.de" date="1628078400">- riscv64-zero.patch: Add support for riscv64 (zero VM)</changelog>
  <changelog author="fstrba@suse.com" date="1629979200">- Added patch:
  * jdk11-glibc234.patch
    + fix build with glibc-2.34 (bsc#1189201)</changelog>
  <changelog author="fstrba@suse.com" date="1631534400">- Modified patch:
  * nss-security-provider.patch
    + revert recent changes making NSS provider the default one
    + fixes bsc#1190252</changelog>
  <changelog author="fstrba@suse.com" date="1631793600">- Added patch:
  * fips.patch
    + implement FIPS support in OpenJDK</changelog>
  <changelog author="fstrba@suse.com" date="1634817600">- Update to upstream tag jdk-11.0.13+8 (October 2021 CPU)
  * Security fixes
    + JDK-8163326, CVE-2021-35550, bsc#1191901: Update the default
    enabled cipher suites preference
    + JDK-8254967, CVE-2021-35565, bsc#1191909:
    com.sun.net.HttpsServer spins on TLS session close
    + JDK-8263314: Enhance XML Dsig modes
    + JDK-8265167, CVE-2021-35556, bsc#1191910: Richer Text Editors
    + JDK-8265574: Improve handling of sheets
    + JDK-8265580, CVE-2021-35559, bsc#1191911: Enhanced style for
    RTF kit
    + JDK-8265776: Improve Stream handling for SSL
    + JDK-8266097, CVE-2021-35561, bsc#1191912: Better hashing
    support
    + JDK-8266103: Better specified spec values
    + JDK-8266109: More Resilient Classloading
    + JDK-8266115: More Manifest Jar Loading
    + JDK-8266137, CVE-2021-35564, bsc#1191913: Improve Keystore
    integrity
    + JDK-8266689, CVE-2021-35567, bsc#1191903: More Constrained
    Delegation
    + JDK-8267086: ArrayIndexOutOfBoundsException in
    java.security.KeyFactory.generatePublic
    + JDK-8267712: Better LDAP reference processing
    + JDK-8267729, CVE-2021-35578, bsc#1191904: Improve TLS client
    handshaking
    + JDK-8267735, CVE-2021-35586, bsc#1191914: Better BMP support
    + JDK-8268193: Improve requests of certificates
    + JDK-8268199: Correct certificate requests
    + JDK-8268205: Enhance DTLS client handshake
    + JDK-8268506: More Manifest Digests
    + JDK-8269618, CVE-2021-35603, bsc#1191906: Better session
    identification
    + JDK-8269624: Enhance method selection support
    + JDK-8270398: Enhance canonicalization
    + JDK-8270404: Better canonicalization
  * Other changes
    + JDK-8024368: private methods are allocated vtable indices
    + JDK-8042902: Test java/net/Inet6Address/serialize/
    /Inet6AddressSerializationTest.java fails intermittently
    + JDK-8140466: ChaCha20 and Poly1305 TLS Cipher Suites
    + JDK-8157404: Unable to read certain PKCS12 keystores from
    SequenceInputStream
    + JDK-8158066: SourceDebugExtensionTest fails to rename file
    + JDK-8168304: Make all of DependencyContext_test available in
    product mode
    + JDK-8169246: java/net/DatagramSocket/ReportSocketClosed.java
    fails intermittently with BindException
    + JDK-8181313: SA: Remove libthread_db dependency on Linux
    + JDK-8193214: Incorrect annotations.without.processors
    warnings with JDK 9
    + JDK-8194230: jdk/internal/jrtfs/remote/
    /RemoteRuntimeImageTest.java fails with
    java.lang.NullPointerException
    + JDK-8196092: javax/swing/JComboBox/8032878/bug8032878.java
    fails
    + JDK-8199931: java/net/MulticastSocket/
    /UnreferencedMulticastSockets.java fails with "incorrect data
    received"
    + JDK-8206083: Make tools/javac/api/T6265137.java robust to JDK
    version changes
    + JDK-8206350: java/util/Locale/bcp47u/SystemPropertyTests.java
    failed on Mac 10.13 with zh_CN and zh_TW locales.
    + JDK-8207316: java/nio/channels/spi/SelectorProvider/
    /inheritedChannel/InheritedChannelTest.java failed
    + JDK-8208227: tools/jdeps/DotFileTest.java fails on Win-X64
    + JDK-8208363: test/jdk/java/lang/Package/
    /PackageFromManifest.java missing module dependencies
    declaration
    + JDK-8209380: ARM: cleanup maybe-uninitialized and reorder
    compiler warnings
    + JDK-8209768: Refactor java/util/prefs/CheckUserPrefsStorage.sh
    to plain java test
    + JDK-8209772: Refactor shell test java/util/ServiceLoader/
    /basic/basic.sh to java
    + JDK-8209773: Refactor shell test javax/naming/module/basic.sh
    to java
    + JDK-8209832: Refactor jdk/internal/reflect/Reflection/
    /GetCallerClassTest.sh to plain java test
    + JDK-8209930: Refactor java/util/zip/ZipFile/deletetempjar.sh
    to plain java test
    + JDK-8210406: Refactor java.util.PluggableLocale:i18n shell
    tests to plain java tests
    + JDK-8210407: Refactor java.util.Calendar:i18n shell tests to
    plain java tests
    + JDK-8210495: compiler crashes because of illegal signature in
    otherwise legal code
    + JDK-8210669: Some launcher tests assume a pre-JDK 9 run-time
    image layout
    + JDK-8210802: temp files left by tests in
    jdk/java/net/httpclient
    + JDK-8210819: Update the host name in CNameTest.java
    + JDK-8210908: Refactor java/util/prefs/PrefsSpi.sh to plain
    java test
    + JDK-8210934: Move sun/net/www/protocol/http/
    /GetErrorStream.java to OpenJDK
    + JDK-8210959: JShell fails and exits when statement throws an
    exception whose message contains a '%'.
    + JDK-8211055: Provide print to a file (PDF) feature even when
    printer was not connected
    + JDK-8211092: test/jdk/sun/net/www/http/HttpClient/
    /MultiThreadTest.java fails intermittently when cleaning up
    + JDK-8211296: Remove HotSpot deprecation warning suppression
    for Mac/clang
    + JDK-8211325: test/jdk/java/net/Socket/LingerTest.java fails
    with cleaning up
    + JDK-8212040: Compilation error due to wrong usage of
    NSPrintJobDispositionValue in mac10.12
    + JDK-8212695: Add explicit timeout to several HTTP Client tests
    + JDK-8212718: Refactor some annotation processor tests to
    better use collections
    + JDK-8213007: Update the link in test/jdk/sun/security/
    /provider/SecureRandom/DrbgCavp.java
    + JDK-8213137: Remove static initialization of monitor/mutex
    instances
    + JDK-8213235: java/nio/channels/SocketChannel/
    /AsyncCloseChannel.java fails with threads that didn't exit
    + JDK-8213409: Refactor sun.text.IntHashtable:i18n shell tests
    to plain java tests
    + JDK-8213576: Make test AsyncCloseChannel.java run in othervm
    + JDK-8213694: Test Timeout.java should run in othervm mode
    + JDK-8213718: [TEST] Wrong classname in vmTestbase/nsk/stress/
    /except/except002 and except003
    + JDK-8213922: fix ctw stand-alone build
    + JDK-8214195: Align stdout messages in
    test/jdk/java/math/BigInteger/PrimitiveConversionTests.java
    + JDK-8214520: [TEST_BUG] sun/security/mscapi/nonUniqueAliases/
    /NonUniqueAliases.java failed with incorrect jtreg tags order
    + JDK-8214937: sun/security/tools/jarsigner/warnings/
    /NoTimestampTest.java failed due to unexpected expiration date
    + JDK-8216532: tools/launcher/Test7029048.java fails (Solaris)
    + JDK-8217825: Verify @AfterTest is used correctly in WebSocket
    tests
    + JDK-8218145: block_if_requested is not proper inlined due to
    size
    + JDK-8219417: bump jtreg requiredVersion to b14
    + JDK-8219552: bump jtreg requiredVersion to b14 in
    test/jdk/sanity/client/
    + JDK-8219804: java/net/MulticastSocket/Promiscuous.java fails
    intermittently due to NumberFormatException
    + JDK-8220445: Support for side by side MSVC Toolset versions
    + JDK-8221988: add possibility to build with Visual Studio 2019
    + JDK-8222751: closed/test/jdk/sun/security/util/
    /DerIndefLenConverter/IndefBerPkcs12.java fail
    + JDK-8223050: JVMCI: findUniqueConcreteMethod() should not use
    Dependencies::find_unique_concrete_method() for non-virtual
    methods
    + JDK-8224853: CDS address sanitizer errors
    + JDK-8225082: Remove IdenTrust certificate that is expiring in
    September 2021
    + JDK-8225583: Examine the HttpResponse.BodySubscribers for
    null handling and multiple subscriptions
    + JDK-8225690: Multiple AttachListener threads can be created
    + JDK-8225790: Two NestedDialogs tests fail on Ubuntu
    + JDK-8226319: Add forgotten test/jdk/java/net/httpclient/
    /BodySubscribersTest.java
    + JDK-8226533: JVMCI: findUniqueConcreteMethod should handle
    statically bindable methods directly
    + JDK-8226602: Test convenience reactive primitives from
    java.net.http with RS TCK
    + JDK-8226683: Remove review suggestion from fix to 8219804
    + JDK-8227738: jvmti/DataDumpRequest/datadumpreq001 failed due
    to "exit code is 134"
    + JDK-8227766: CheckUnhandledOops is broken in MemAllocator
    + JDK-8227815: Minimal VM: set_state is not a member of
    AttachListener
    + JDK-8230674: Heap dumps should exclude dormant CDS archived
    objects of unloaded classes
    + JDK-8230808: Remove Access::equals()
    + JDK-8230841: Remove oopDesc::equals()
    + JDK-8231717: Improve performance of charset decoding when
    charset is always compactable
    + JDK-8232243: Wrong caret position in JTextPane on Windows
    with a screen resolution &gt; 100%
    + JDK-8232782: Shenandoah: streamline post-LRB CAS barrier
    (aarch64)
    + JDK-8233790: Forward output from heap dumper to jcmd/jmap
    + JDK-8233989: Create an IPv4 version of
    java/net/MulticastSocket/SetLoopbackMode.java
    + JDK-8234510: Remove file seeking requirement for writing a
    heap dump
    + JDK-8235211: serviceability/attach/
    /RemovingUnixDomainSocketTest.java fails with
    AttachNotSupportedException: Unable to open socket file
    + JDK-8235216: typo in test filename
    + JDK-8235866: bump jtreg requiredVersion to 4.2b16
    + JDK-8236111: narrow allowSmartActionArgs disabling
    + JDK-8236413: AbstractConnectTimeout should tolerate both
    NoRouteToHostException and UnresolvedAddressException
    + JDK-8236671: NullPointerException in JKS keystore
    + JDK-8238930: problem list compiler/c2/Test8004741.java
    + JDK-8238943: switch to jtreg 5.0
    + JDK-8240555: Using env of JAVA_TOOL_OPTIONS and _JAVA_OPTIONS
    breaks QuietOption.java test
    + JDK-8240983: Incorrect copyright header in Apache Santuario
    2.1.3 files
    + JDK-8241336: Some java.net tests failed with
    NoRouteToHostException on MacOS with special network
    configuration
    + JDK-8241353: NPE in ToolProvider.getSystemJavaCompiler
    + JDK-8241768: git needs .gitattributes
    + JDK-8242882: opening jar file with large manifest might throw
    NegativeArraySizeException
    + JDK-8244973: serviceability/attach/
    /RemovingUnixDomainSocketTest.java fails "stderr was not
    empty"
    + JDK-8245134: test/lib/jdk/test/lib/security/
    /KeyStoreUtils.java should allow to specify aliases
    + JDK-8246261: TCKLocalTime.java failed due to "AssertionError:
    expected [18:14:22] but found [18:14:23]"
    + JDK-8246387: switch to jtreg 5.1
    + JDK-8247421: [TESTBUG] ReturnBlobToWrongHeapTest.java failed
    allocating blob
    + JDK-8247469: getSystemCpuLoad() returns -1 on linux when some
    offline cpus are present and cpusets.effective_cpus is not
    available
    + JDK-8248352: [TEST_BUG] Test test/jdk/java/awt/font/
    /TextLayout/ArabicDiacriticTest.java can leave frame open
    + JDK-8248403: AArch64: Remove uses of kernel integer types
    + JDK-8248414: AArch64: Remove uses of long and unsigned long
    ints
    + JDK-8248657: Windows: strengthening in ThreadCritical
    regarding memory model
    + JDK-8248666: AArch64: Use THREAD_LOCAL instead of __thread
    + JDK-8248668: AArch64: Avoid MIN/MAX macros when using MSVC
    + JDK-8248671: AArch64: Remove unused variables
    + JDK-8248682: AArch64: Use ATTRIBUTE_ALIGNED helper
    + JDK-8248816: C1: Fix signature conflict in
    LIRGenerator::strength_reduce_multiply
    + JDK-8249095: tools/javac/launcher/SourceLauncherTest.java
    fails on Windows
    + JDK-8249548: backward focus traversal gets stuck in button
    group
    + JDK-8249773: Upgrade ReceiveISA.java test to be resilient to
    failure due to stray packets and interference
    + JDK-8249897: jdk/javadoc/tool/LangVers.java uses @ignore w/o
    bug-id
    + JDK-8249898: jdk/javadoc/tool/6176978/T6176978.java uses
    @ignore w/o bug-id
    + JDK-8249899: jdk/javadoc/tool/InlineTagsWithBraces.java uses
    @ignore w/o bug-id
    + JDK-8250588: Shenandoah: LRB needs to save/restore fp
    registers for runtime call
    + JDK-8250824: AArch64: follow up for JDK-8248414
    + JDK-8251166: Add automated testcases for changes done in
    JDK-8214112
    + JDK-8251252: Add automated testcase for fix done in
    JDK-8214253
    + JDK-8251254: Add automated test for fix done in JDK-8218472
    + JDK-8251361: Potential race between Logger configuration and
    GCs in HttpURLConWithProxy test
    + JDK-8251549: Update docs on building for Git
    + JDK-8251945: SIGSEGV in
    PackageEntry::purge_qualified_exports()
    + JDK-8252194: Add automated test for fix done in JDK-8218469
    + JDK-8252648: Shenandoah: name gang tasks consistently
    + JDK-8252825: Add automated test for fix done in JDK-8218479
    + JDK-8252853: AArch64: gc/shenandoah/TestVerifyJCStress.java
    fails intermittently with C1
    + JDK-8252857: AArch64: Shenandoah C1 CAS is not sequentially
    consistent
    + JDK-8253048: AArch64: When CallLeaf, no need to preserve
    callee-saved registers in caller
    + JDK-8253424: Add support for running pre-submit testing using
    GitHub Actions
    + JDK-8253631: Remove unimplemented CompileBroker methods after
    JEP-165
    + JDK-8253865: Pre-submit testing using GitHub Actions does not
    detect failures reliably
    + JDK-8253899: Make IsClassUnloadingEnabled signature match
    specification
    + JDK-8254024: Enhance native libs for AWT and Swing to work
    with GraalVM Native Image
    + JDK-8254054: Pre-submit testing using GitHub Actions should
    not use the deprecated set-env command
    + JDK-8254173: Add Zero, Minimal hotspot targets to submit
    workflow
    + JDK-8254175: Build no-pch configuration in debug mode for
    submit checks
    + JDK-8254244: Some code emitted by TemplateTable::branch is
    unused when running TieredCompilation
    + JDK-8254270: linux 32 bit build doesn't compile
    libjdwp/log_messages.c
    + JDK-8254282: Add Linux x86_32 builds to submit workflow
    + JDK-8254850: Update terminology in java.awt.GridBagLayout
    source code comments
    + JDK-8255255: Update Apache Santuario (XML Signature) to
    version 2.2.1
    + JDK-8255305: Add Linux x86_32 tier1 to submit workflow
    + JDK-8255352: Archive important test outputs in submit workflow
    + JDK-8255373: Submit workflow artifact name is always
    "test-results_.zip"
    + JDK-8255452: Doing GC during JVMTI MethodExit event posting
    breaks return oop
    + JDK-8255718: Zero: VM should know it runs in interpreter-only
    mode
    + JDK-8255790: GTKL&amp;F: Java 16 crashes on initialising GTKL&amp;F
    on Manjaro Linux
    + JDK-8255810: Zero: build fails without JVMTI
    + JDK-8255895: Submit workflow artifacts miss hs_errs/replays
    due to ZIP include mismatch
    + JDK-8256127: Add cross-compiled foreign architectures builds
    to submit workflow
    + JDK-8256215: Shenandoah: re-organize saving/restoring machine
    state in assembler code
    + JDK-8256267: Relax compiler/floatingpoint/NaNTest.java for
    x86_32 and lower -XX:+UseSSE
    + JDK-8256277: Github Action build on macOS should define OS
    and Xcode versions
    + JDK-8256354: Github Action build on Windows should define OS
    and MSVC versions
    + JDK-8256393: Github Actions build on Linux should define OS
    and GCC versions
    + JDK-8256414: add optimized build to submit workflow
    + JDK-8256747: GitHub Actions: decouple the hotspot build-only
    jobs from Linux x64 testing
    + JDK-8257056: Submit workflow should apt-get update to avoid
    package installation errors
    + JDK-8257148: Remove obsolete code in AWTView.m
    + JDK-8257497: Update keytool to create AKID from the SKID of
    the issuing certificate as specified by RFC 5280
    + JDK-8257620: Do not use objc_msgSend_stret to get macOS
    version
    + JDK-8257913: Add more known library locations to simplify
    Linux cross-compilation
    + JDK-8258703: Incorrect 512-bit vector registers restore on
    x86_32
    + JDK-8259338: Add expiry exception for identrustdstx3 alias to
    VerifyCACerts.java test
    + JDK-8259535: ECDSA SignatureValue do not always have the
    specified length
    + JDK-8259679: GitHub actions should use MSVC 14.28
    + JDK-8259924: GitHub actions fail on Linux x86_32 with "Could
    not configure libc6:i386"
    + JDK-8260460: GitHub actions still fail on Linux x86_32 with
    "Could not configure libc6:i386"
    + JDK-8260589: Crash in JfrTraceIdLoadBarrier::load(_jclass*)
    + JDK-8260923: Add more tests for SSLSocket input/output
    shutdown
    + JDK-8261072: AArch64: Fix MacroAssembler::get_thread
    convention
    + JDK-8261147: C2: Node is wrongly marked as reduction
    resulting in a wrong execution due to wrong vector instructions
    + JDK-8261238: NMT should not limit baselining by size threshold
    + JDK-8261496: Shenandoah: reconsider pacing updates memory
    ordering
    + JDK-8261652: Remove some dead comments from os_bsd_x86
    + JDK-8261846: [JVMCI] c2v_iterateFrames can get out of sync
    with the StackFrameStream
    + JDK-8262000: jdk/jfr/event/gc/detailed/
    /TestPromotionFailedEventWithParallelScavenge.java failed with
    "OutOfMemoryError: Java heap space"
    + JDK-8262017: C2: assert(n != __null) failed: Bad immediate
    dominator info.
    + JDK-8262392: Update Mesa 3-D Headers to version 21.0.3
    + JDK-8262409: sun/security/ssl/SSLSocketImpl/
    /SSLSocketImplThrowsWrongExceptions. SSL test failures caused
    by java failed with "Server reported the wrong exception"
    + JDK-8262470: Printed GlyphVector outline with low DPI has bad
    quality on Windows
    + JDK-8262862: Harden tests sun/security/x509/URICertStore/
    /ExtensionsWithLDAP.java and krb5/canonicalize/Test.java
    + JDK-8263136: C4530 was reported from VS 2019 at access bridge
    + JDK-8263227: C2: inconsistent spilling due to dead nodes in
    exception block
    + JDK-8263382: java/util/logging/ParentLoggersTest.java failed
    with "checkLoggers: getLoggerNames() returned unexpected
    loggers"
    + JDK-8263407: SPARC64 detection fails on Athena (SPARC64-X)
    + JDK-8263432: javac may report an invalid package/class clash
    on case insensitive filesystems
    + JDK-8263490: [macos] Crash occurs on JPasswordField with
    activated InputMethod
    + JDK-8263531: Remove unused buffer int
    + JDK-8263667: Avoid running GitHub actions on branches named
    pr/*
    + JDK-8263776: [JVMCI] add helper to perform Java upcalls
    + JDK-8264016: [JVMCI] add some thread local fields for use by
    JVMCI
    + JDK-8264752: SIGFPE crash with option
    FlightRecorderOptions:threadbuffersize=30M
    + JDK-8265132: C2 compilation fails with assert "missing
    precedence edge"
    + JDK-8265231: (fc) ReadDirect and WriteDirect tests fail after
    fix for JDK-8264821
    + JDK-8265335: Epsilon: Minor typo in EpsilonElasticTLABDecay
    description
    + JDK-8265756: AArch64: initialize memory allocated for locals
    according to Windows AArch64 stack page growth requirement in
    template interpreter
    + JDK-8265761: Font with missed font family name is not
    properly printed on Windows
    + JDK-8265773: incorrect jdeps message "jdk8internals" to
    describe a removed JDK internal API
    + JDK-8265836: OperatingSystemImpl.getCpuLoad() returns
    incorrect CPU load inside a container
    + JDK-8266018: Shenandoah: fix an incorrect assert
    + JDK-8266206: Build failure after JDK-8264752 with older GCCs
    + JDK-8266248: Compilation failure in
    PLATFORM_API_MacOSX_MidiUtils.c with Xcode 12.5
    + JDK-8266288: assert root method not found in
    witnessed_reabstraction_in_supers is too strong
    + JDK-8266404: Fatal error report generated with
  - XX:+CrashOnOutOfMemoryError should not contain suggestion to
    submit a bug report
    + JDK-8266480: Implicit null check optimization does not update
    control of hoisted memory operation
    + JDK-8266615: C2 incorrectly folds subtype checks involving an
    interface array
    + JDK-8266642: Improve ResolvedMethodTable hash function
    + JDK-8266749: AArch64: Backtracing broken on PAC enabled
    systems
    + JDK-8266761: AssertionError in
    sun.net.httpserver.ServerImpl.responseCompleted
    + JDK-8266813: Shenandoah: Use shorter instruction sequence for
    checking if marking in progress
    + JDK-8267042: bug in monitor locking/unlocking on ARM32 C1 due
    to uninitialized BasicObjectLock::_displaced_header
    + JDK-8267348: Rewrite gc/epsilon/TestClasses.java to use
    Metaspace with less classes
    + JDK-8267396: Avoid recording "pc" in unhandled oops detector
    for better performance
    + JDK-8267399: C2: java/text/Normalizer/ConformanceTest.java
    test failed with assertion
    + JDK-8267424: CTW: C1 fails with "State must not be null"
    + JDK-8267459: Pasting Unicode characters into JShell does not
    work.
    + JDK-8267625: AARCH64: typo in LIR_Assembler::emit_profile_type
    + JDK-8267666: Add option to jcmd GC.heap_dump to use existing
    file
    + JDK-8267695: Bump update version for OpenJDK: jdk-11.0.13
    + JDK-8267751: (test) jtreg.SkippedException has no serial
    VersionUID
    + JDK-8267773: PhaseStringOpts::int_stringSize doesn't handle
    min_jint correctly
    + JDK-8268103: JNI functions incorrectly return a double after
    JDK-8265836
    + JDK-8268127: Shenandoah: Heap size may be too small for
    region to align to large page size
    + JDK-8268261: C2: assert(n != __null) failed: Bad immediate
    dominator info.
    + JDK-8268347: C2: nested locks optimization may create
    unbalanced monitor enter/exit code
    + JDK-8268360: Missing check for infinite loop during node
    placement
    + JDK-8268362: [REDO] C2 crash when compile negative
    Arrays.copyOf length after loop
    + JDK-8268366: Incorrect calculation of has_fpu_registers in C1
    linear scan
    + JDK-8268369: SIGSEGV in PhaseCFG::implicit_null_check due to
    missing null check
    + JDK-8268417: Add test from JDK-8268360
    + JDK-8268427: Improve AlgorithmConstraints:checkAlgorithm
    performance
    + JDK-8268617: [11u REDO] - WebSocket over authenticating proxy
    fails with NPE
    + JDK-8268620: InfiniteLoopException test may fail on x86
    platforms
    + JDK-8268635: Corrupt oop in ClassLoaderData
    + JDK-8268699: Shenandoah: Add test for JDK-8268127
    + JDK-8268771: javadoc -notimestamp option does not work on
    index.html
    + JDK-8268775: Password is being converted to String in
    AccessibleJPasswordField
    + JDK-8268776: Test `ADatagramSocket.java` missing /othervm
    from @run tag
    + JDK-8268965: TCP Connection Reset when connecting simple
    socket to SSL server
    + JDK-8269304: Regression ~5% in 2005 in b27
    + JDK-8269415: [11u] Remove ea from
    DEFAULT_PROMOTED_VERSION_PRE in OpenJDK 11u
    + JDK-8269478: Shenandoah: gc/shenandoah/mxbeans tests should
    be more resilient
    + JDK-8269529: javax/swing/reliability/
    /HangDuringStaticInitialization.java fails in Windows debug
    build
    + JDK-8269594: assert(_handle_mark_nesting &gt; 1) failed: memory
    leak: allocating handle outside HandleMark
    + JDK-8269614: [s390] Interpreter checks wrong bit for slow
    path instance allocation
    + JDK-8269650: Optimize gc-locker in
    [Get|Release]StringCritical for latin string
    + JDK-8269661: JNI_GetStringCritical does not lock char array
    + JDK-8269668: [aarch64] java.library.path not including
    /usr/lib64
    + JDK-8269763: The JEditorPane is blank after JDK-8265167
    + JDK-8269795: C2: Out of bounds array load floats above its
    range check in loop peeling resulting in SEGV
    + JDK-8269847: JDK-8269594 backport breaks 11u builds
    + JDK-8269850: Most JDK releases report macOS version 12 as
    10.16 instead of 12.0
    + JDK-8269851: OperatingSystemMXBean getProcessCpuLoad reports
    incorrect process cpu usage in containers
    + JDK-8269882: stack-use-after-scope in NewObjectA
    + JDK-8269934: RunThese24H.java failed with
    EXCEPTION_ACCESS_VIOLATION in
    java_lang_Thread::get_thread_status
    + JDK-8270096: Shenandoah: Optimize gc/shenandoah/
    /TestRefprocSanity.java for interpreter mode
    + JDK-8270137: Kerberos Credential Retrieval from Cache not
    Working in Cross-Realm Setup
    + JDK-8270184: [TESTBUG] Add coverage for jvmci
    ResolvedJavaType.toJavaName() for lambdas
    + JDK-8270196: [11u] [JVMCI] JavaType.toJavaName() returns
    incorrect type name for lambdas
    + JDK-8270556: Exclude security/infra/java/security/cert/
    /CertPathValidator/certification/LetsEncryptCA
    + JDK-8270893: IndexOutOfBoundsException while reading large
    TIFF file
    + JDK-8272078: Wrong Checksums in Temurin BootJDK dependencies
    + JDK-8272124: Cgroup v1 initialization causes
    NullPointerException when cgroup path contains colon
    + JDK-8272131: PhaseMacroExpand::generate_slow_arraycopy crash
    when clone null CallProjections.fallthrough_ioproj
    + JDK-8272197: Update 11u GHA workflow with Shenandoah
    configurations
    + JDK-8272332: --with-harfbuzz=system doesn't add -lharfbuzz
    after JDK-8255790
    + JDK-8272472: StackGuardPages test doesn't build with glibc
    2.34
    + JDK-8272602: [macos] not all KEY_PRESSED events sent when
    control modifier is used
    + JDK-8272628: Problemlist gc/stress/gcbasher/
    /TestGCBasherWithCMS.java for x86_32
    + JDK-8272700: [macos] Build failure with Xcode 13.0 after
    JDK-8264848
    + JDK-8272772: Shenandoah: compiler/c2/aarch64/
    /TestVolatilesShenandoah.java fails in 11u
    + JDK-8273939: Backport of 8248414 to JDK11 breaks
    MacroAssembler::adrp
- Remove the unneeded icedtea-sound provider
- Removed patches:
  * icedtea-sound-1.0.1-jdk9.patch
  * icedtea-sound-soundproperties.patch
    + not needed since the icedtea-sound provider is removed
  * jdk11-glibc234.patch
    + integrated upstream</changelog>
  <changelog author="fstrba@suse.com" date="1635940800">- Modified patches:
  * system-crypto-policy.patch
    + rediff to changed context
  * fips.patch
    + Allow plain key import in fips mode unless
    com.suse.fips.plainKeySupport is set to false</changelog>
  <changelog author="fstrba@suse.com" date="1636113600">- Modified patch:
  * fips.patch
    + return in native code after generating java.io.IOException</changelog>
</package>
<package pkgid="012fee54215976189d801201bf800745af50742c89d45268d1b3c2457d5332b6" name="java-11-openjdk" arch="src">
  <version epoch="0" ver="11.0.13.0" rel="3.68.1"/>
  <changelog author="fstrba@suse.com" date="1586952000">- The pack200 and unpack200 alternatives should be slaves of java
  and not of javac, since they are part of JRE.</changelog>
  <changelog author="fstrba@suse.com" date="1587470400">- Update to upstream tag jdk-11.0.7+10 (April 2020 CPU,
  bsc#1169511)
  * Security fixes:
    + S8223898, CVE-2020-2754: Forward references to Nashorn
    + S8223904, CVE-2020-2755: Improve Nashorn matching
    + S8224541, CVE-2020-2756: Better mapping of serial ENUMs
    + S8224549, CVE-2020-2757: Less Blocking Array Queues
    + S8225603: Enhancement for big integers
    + S8226346: Build better binary builders
    + S8227467: Better class method invocations
    + S8227542: Manifest improved jar headers
    + S8229733: TLS message handling improvements
    + S8231415, CVE-2020-2773: Better signatures in XML
    + S8231785: Improved socket permissions
    + S8232424, CVE-2020-2778: More constrained algorithms
    + S8232581, CVE-2020-2767: Improve TLS verification
    + S8233250: Better X11 rendering
    + S8233410: Better Build Scripting
    + S8234027: Better JCEKS key support
    + S8234408, CVE-2020-2781: Improve TLS session handling
    + S8234825, CVE-2020-2800: Better Headings for HTTP Servers
    + S8234841, CVE-2020-2803: Enhance buffering of byte buffers
    + S8235274, CVE-2020-2805: Enhance typing of methods
    + S8235691, CVE-2020-2816: Enhance TLS connectivity
    + S8236201, CVE-2020-2830: Better Scanner conversions
    + S8238960: linux-i586 builds are inconsistent as the newly
    built jdk is not able to reserve enough space for object heap
  * Other changes:
    + S4919790: Errors in alert ssl message does not reflect the
    actual certificate status
    + S4949105: Access Bridge lacks html tags parsing
    + S7092821: java.security.Provider.getService() is synchronized
    and became scalability bottleneck
    + S7143743: Potential memory leak with zip provider
    + S8005819: Support cross-realm MSSFU
    + S8042383: [TEST_BUG] Test javax/swing/plaf/basic/BasicMenuUI/
    /4983388/bug4983388.java fails with shortcuts on menus do not
    work
    + S8068184: Fix for JDK-8032832 caused a deadlock
    + S8145845: [AOT] NullPointerException in
    compiler/whitebox/GetCodeHeapEntriesTest.java
    + S8152988: [AOT] Update test batch definitions to include
    aot-ed java.base module mode into hs-comp testing
    + S8160926: FLAGS_COMPILER_CHECK_ARGUMENTS doesn't handle
    cross-compilation
    + S8163083: SocketListeningConnector does not allow invocations
    with port 0
    + S8163251: Hard coded loop limit prevents reading of smart
    card data greater than 8k
    + S8167276: jvmci/compilerToVM/MaterializeVirtualObjectTest.java
    fails with -XX:-EliminateAllocations
    + S8169718: nsk/jdb/locals/locals002: ERROR: Cannot find
    boolVar with expected value: false
    + S8176556:
    java/awt/dnd/ImageTransferTest/ImageTransferTest.java fails
    for JFIF
    + S8178798: Two compiler/aot/verification/vmflags tests fail by
    timeout with UseAVX=3
    + S8183107: PKCS11 regression regarding checkKeySize
    + S8185005: Improve performance of
    ThreadMXBean.getThreadInfo(long ids[], int maxDepth)
    + S8189633: Missing -Xcheck:jni checking for DeleteWeakGlobalRef
    + S8189861: Refactor CacheFind
    + S8193042: NativeLookup::lookup_critical_entry() should only
    load shared library once
    + S8193596: java/net/DatagramPacket/ReuseBuf.java failed due to
    timeout
    + S8194944: Regression automated test 'open/test/jdk/javax/
    /swing/JInternalFrame/8145896/TestJInternalFrameMaximize.java'
    fails
    + S8196467: javax/swing/JInternalFrame/Test6325652.java fails
    + S8196969: JTreg Failure: serviceability/sa/ClhsdbJstack.java
    causes NPE
    + S8198321: javax/swing/JEditorPane/5076514/bug5076514.java
    fails
    + S8198398: Test javax/swing/JColorChooser/Test6199676.java
    fails in mach5
    + S8199072: Test javax/swing/GroupLayout/6613904/
    /bug6613904.java is unstable
    + S8200432: javadoc fails with ClassCastException on {@link
    byte[]}
    + S8201349: build broken when configured with
  - -with-zlib=bundled on gcc 7.3
    + S8201355: Avoid native memory allocation in
    sun.security.mscapi.PRNG.generateSeed
    + S8201513: nsk/jvmti/IterateThroughHeap/filter-* are broken
    + S8203364: Some serviceability/sa/ tests intermittently fail
    with java.io.IOException: LingeredApp terminated with non-zero
    exit code 3
    + S8203687: javax/net/ssl/compatibility/Compatibility.java
    supports TLS 1.3
    + S8203904: javax/swing/JSplitPane/4816114/bug4816114.java: The
    divider location is wrong
    + S8203911: Test runtime/modules/getModuleJNI/GetModule fails
    with -Xcheck:jni
    + S8204525: [TESTBUG] runtime/NMT/MallocStressTest.java ran out
    of java heap
    + S8204529: gc/TestAllocateHeapAtMultiple.java fail with Agent
    7 timed out
    + S8204551: Event descriptions are truncated in logs
    + S8206963: [AOT] bug with multiple class loaders
    + S8207367: 10 vmTestbase/nsk/jdi tests timed out when running
    with jtreg
    + S8207832: serviceability/sa/ClhsdbCDSCore.java failed with
    "Couldn't find core file location"
    + S8207938: At step6,Click Add button,case failed automatically.
    + S8208157: requires.VMProps throws NPE for missing properties
    in "release" file
    + S8208379: compiler/jvmci/events/
    /JvmciNotifyInstallEventTest.java failed with "Got unexpected
    event count after 2nd install attempt: expected 9 to equal 2"
    + S8208658: Make CDS archived heap regions usable even if
    compressed oop encoding has changed
    + S8208715: Conversion of milliseconds to nanoseconds in
    UNIXProcess contains bug
    + S8209361: [AOT] Unexpected number of references for
    JVMTI_HEAP_REFERENCE_CONSTANT_POOL [111--&gt;111]: 0 (expected
    at least 1)
    + S8209385: CDS runtime classpath checking is too strict when
    only classes from the system modules are archived
    + S8209389: SIGSEGV in WalkOopAndArchiveClosure::do_oop_work.
    + S8209418: Synchronize test/jdk/sanity/client/lib/jemmy with
    code-tools/jemmy/v2
    + S8209494: Create a test for SwingSet InternalFrameDemo
    + S8209499: Create test for SwingSet EditorPaneDemo
    + S8209574: [AOT] breakpoint events are generated in different
    threads does not meet expected count
    + S8209686: cleanup arguments to PhaseIdealLoop() constructor
    + S8209789: Synchronize test/jdk/sanity/client/lib/jemmy with
    code-tools/jemmy/v2
    + S8209802: Garbage collectors should register JFR types
    themselves to avoid build errors.
    + S8209807: improve handling exception in requires.VMProps
    + S8209817: stack is executable when building with Clang on
    Linux
    + S8209824: Improve the code coverage for ThreadLocal
    + S8209826: Undefined reference to os::write after JDK-8209657
    (filemap.hpp cleanup)
    + S8209850: Allow NamedThreads to use GlobalCounter critical
    sections
    + S8209976: Improve iteration over non-JavaThreads
    + S8209993: Create a test for SwingSet3 ToolTipDemo
    + S8210024: JFR calls virtual is_Java_thread from ~Thread()
    + S8210052: Enable testing for all the available look and feels
    in SwingSet3 demo tests
    + S8210055: Enable different look and feel tests in SwingSet3
    demo tests
    + S8210057: Enable different look and feels in SwingSet3 demo
    test InternalFrameDemoTest
    + S8210058: Algorithmic Italic font leans opposite angle in
    Printing
    + S8210220: [AOT] jdwp test cases are failing with error #
    ERROR: TEST FAILED: Cought IOException while receiving event
    packet
    + S8210289: ArchivedKlassSubGraphInfoRecord is incomplete
    + S8210459: Add support for generating compile_commands.json
    + S8210476: sun/security/mscapi/PrngSlow.java fails with Still
    too slow
    + S8210512: [Testbug] vmTestbase/nsk/jdi/ObjectReference/
    /referringObjects/referringObjects002/referringObjects002.java
    fails with unexpected size of
    ClassLoaderReference.referringObjects
    + S8210523: runtime/appcds/cacheObject/DifferentHeapSizes.java
    crash
    + S8210632: Add key exchange algorithm to
    javax/net/ssl/TLSCommon/CipherSuite.java
    + S8210699: Problem list tests which times out in Xcomp mode
    + S8210793: [JVMCI] AllocateCompileIdTest.java failed to find
    DiagnosticCommand.class
    + S8210910: Create test for FileChooserDemo
    + S8210994: Create test for SwingSet3 FrameDemo
    + S8211139: Increase timeout value in all tests under
    jdk/sanity/client/SwingSet/src
    + S8211160: Handle different look and feels in
    JInternalFrameOperator
    + S8211211: vmTestbase/metaspace/stressDictionary/
    /StressDictionary.java timeout
    + S8211322: Reduce the timeout of tooltip in SwingSet2DemoTest
    + S8211443: Enable different look and feels in SwingSet3 demo
    test SplitPaneDemoTest
    + S8211703: JInternalFrame : java.lang.AssertionError: cannot
    find the internal frame
    + S8211781: re-building fails after changing Graal sources
    + S8212897: Some improvements in the EditorPaneDemotest
    + S8212903: [TestBug] Tests test/jdk/javax/swing/LookAndFeel/
    /8145547/DemandGTK2.sh and DemandGTK3.sh fail on Ubuntu 18.04
    LTS
    + S8213009: Refactoring existing SunMSCAPI classes
    + S8213010: Supporting keys created with certmgr.exe
    + S8213168: Enable different look and feel tests in SwingSet3
    demo test FileChooserDemoTest
    + S8213348: jdk.internal.vm.compiler.management service
    providers missing in module descriptor
    + S8213906: Update arm devkits with libXrandr headers
    + S8213908: AssertionError in DeferredAttr at setOverloadKind
    + S8214124: [TESTBUG] Bugs in runtime/NMT/MallocStressTest.java
    + S8214344: C2: assert(con.basic_type() != T_ILLEGAL) failed:
    elembt=byte; loadbt=void; unsigned=0
    + S8214345: infinite recursion while checking super class
    + S8214471: Enable different look and feel tests in SwingSet3
    demo test ToolTipDemoTest
    + S8214534: Setting of THIS_FILE in the build is broken
    + S8214557: Filter out VM flags which don't affect AOT code
    generation
    + S8214578: [macos] Problem with backslashes on macOS/JIS
    keyboard: Java ignores system settings
    + S8214840: runtime/NMT/MallocStressTest.java timed out
    + S8214850: Rename vm_operations.?pp files to vmOperations.?pp
    files
    + S8214904: Test8004741.java failed due to "Too few ThreadDeath
    hits; expected at least 6 but saw only 5"
    + S8215322: add @file support to jaotc
    + S8215355: Object monitor deadlock with no threads holding the
    monitor (using jemalloc 5.1)
    + S8215396: JTabbedPane preferred size calculation is wrong for
    SCROLL_TAB_LAYOUT
    + S8216180: [AOT] compiler/intrinsics/bigInteger/TestMulAdd.java
    crashed with AOT enabled
    + S8216353: Use utility APIs introduced in org/netbeans/jemmy/
    /util/LookAndFeel class in client sanity test cases
    + S8216354: Syntax error in toolchain_windows.m4
    + S8216472: (se) Stack overflow during selection operation
    leads to crash (win)
    + S8216535: tools/jimage/JImageExtractTest.java timed out
    + S8217235: Create automated test for SwingSet
    ColorChooserDemoTest
    + S8217297: Add support for multiple look and feel for SwingSet
    SliderDemoTest
    + S8217338: [Containers] Improve systemd slice memory limit
    support
    + S8217613: [AOT] TEST_OPTS_AOT_MODULES doesn't work on mac
    + S8217634: RunTest documentation and usability update
    + S8217717: ZGC: Broken oop map in C1 load barrier stub
    + S8217728: Speed up incremental rerun of "make hotspot"
    + S8218268: Javac treats Manifest Class-Path entries as Paths
    instead of URLs
    + S8218662: Allow 204 responses with Content-Length:0
    + S8218882: NET_Writev is declared, NET_WriteV is defined
    + S8218889: Improperly use of the Optional API
    + S8219205: JFR file without license header
    + S8219597: (bf) Heap buffer state changes could provoke
    unexpected exceptions
    + S8219723: javax/net/ssl/compatibility/Compatibility.java
    failed on some SNI cases
    + S8220348: [ntintel] asserts about copying unaligned array
    + S8220451: jdi/EventQueue/remove/remove004 failed due to
    "ERROR: thread2 is not alive"
    + S8220456: jdi/EventQueue/remove_l/remove_l004 failed due to
    "TIMEOUT while waiting for event"
    + S8220479: java/nio/channels/Selector/SelectWithConsumer.java
    failed at testTwoChannels()
    + S8220613: java/util/Arrays/TimSortStackSize2.java times out
    with fastdebug build
    + S8220688: [TESTBUG] runtime/NMT/MallocStressTest.java timed
    out
    + S8220786: Create new switch to redirect error reporting
    output to stdout or stderr
    + S8221270: Duplicated synchronized keywords in SSLSocketImpl
    + S8221312: test/jdk/sanity/client/SwingSet/src/
    /ColorChooserDemoTest.java failed
    + S8221851: Use of THIS_FILE in hotspot invalidates precompiled
    header on Linux/GCC
    + S8221885: Add intermittent test in the JavaSound to the
    ProblemList
    + S8222264: Windows incremental build is broken with JDK-8217728
    + S8222391: javax/net/ssl/compatibility/Compatibility.java
    should be more flexible
    + S8222448: java/lang/reflect/PublicMethods/
    /PublicMethodsTest.java times out
    + S8222519: ButtonDemoScreenshotTest fails randomly with "still
    state to be reached"
    + S8222741: jdi/EventQueue/remove/remove004 fails due to
    VMDisconnectedException
    + S8223003: SunMSCAPI keys are not cleaned up
    + S8223063: Support CNG RSA keys
    + S8223158: Docked MacBook cannot start any Java Swing
    applications
    + S8223260: NamingManager should cache InitialContextFactory
    + S8223464: Improve version string for Oracle CI builds
    + S8223558: Java does not render Myanmar script correctly
    + S8223627: jdk-13+20 bundle name contains null instead of ea
    + S8223638: Replace wildcard address with loopback or local
    host in tests - part 6
    + S8223678: Add Visual Studio Code workspace generation support
    (for native code)
    + S8223727: com/sun/jndi/ldap/privconn/RunTest.java failed due
    to hang in LdapRequest.getReplyBer
    + S8223769: Assert triggers with -XX:+StressReflectiveCode
    + S8224187: Refactor arraycopy_prologue to allow ZGC read
    barriers on arraycopy
    + S8224475: JTextPane does not show images in HTML rendering
    + S8224673: Adjust permission for delayed starting of debugging
    + S8224705: Tests that need to be problem-listed or have
    printer resources
    + S8224778: test/jdk/demo/jfc/J2Ddemo/J2DdemoTest.java cannot
    find J2Ddemo.jar
    + S8224821: java/awt/Focus/NoAutotransferToDisabledCompTest/
    /NoAutotransferToDisabledCompTest.java fails linux-x64
    + S8224830: test/jdk/java/awt/Focus/
    /ModalExcludedWindowClickTest/
    /ModalExcludedWindowClickTest.java fails on linux-x64
    + S8224851: AArch64: fix warnings and errors with Clang and GCC
    8.3
    + S8224905: java/lang/ProcessBuilder/Basic.java#id1 failed with
    stream closed
    + S8225007: java/awt/print/PrinterJob/
    /LandscapeStackOverflow.java may hang
    + S8225105: java/awt/Focus/ShowFrameCheckForegroundTest/
    /ShowFrameCheckForegroundTest.java fails in Windows 10
    + S8225117: java/math/BigInteger/SymmetricRangeTests.java fails
    with ParseException
    + S8225128: Add exception for expiring DocuSign root to
    VerifyCACerts test
    + S8225130: Add exception for expiring Comodo roots to
    VerifyCACerts test
    + S8225144: [macos] In Aqua L&amp;F backspace key does not delete
    when Shift is pressed
    + S8225180: SignedObject with invalid Key not throwing the
    InvalidKeyException in Windows
    + S8225182: JNI exception pending in DestroyXIMCallback of
    awt_InputMethod.c:1327
    + S8225199: [Graal] compiler/jvmci/compilerToVM/
    /IsMatureVsReprofileTest.java fails with
  - XX:CompileThresholdScaling=0.1
    + S8225305: ProblemList java/lang/invoke/VarHandles tests
    + S8225350: compiler/jvmci/compilerToVM/IsCompilableTest.java
    timed out
    + S8225430: Replace wildcard address with loopback or local
    host in tests - part 14
    + S8225435: Upgrade IANA Language Subtag Registry to the latest
    for JDK14
    + S8225487: giflib legal file is missing attribution for
    openbsd-reallocarray.c
    + S8225567: Wrong file headers with 8202414 fix changeset
    + S8225684: [AOT] vmTestbase/vm/oom/production/
    /AlwaysOOMProduction tests fail with AOTed java.base
    + S8225766: Curve in certificate should not affect signature
    scheme when using TLSv1.3
    + S8225797: OldObjectSample event creates unexpected amount of
    checkpoint data
    + S8226381: ProblemList java/lang/reflect/PublicMethods/
    /PublicMethodsTest.java
    + S8226406: JVM fails to detect mismatched or corrupt CDS
    archive
    + S8226608: Hide the onjcmd option from the help output
    + S8226892: ActionListeners on JRadioButtons don't get notified
    when selection is changed with arrow keys
    + S8227112: exclude compiler/intrinsics/sha/sanity tests from
    AOT runs
    + S8227324: Upgrade to freetype 2.10.1
    + S8227528: TestAbortVMOnSafepointTimeout.java failed due to
    "RuntimeException: 'Safepoint sync time longer than' missing
    from stdout/stderr"
    + S8227645: Some tests in serviceability/sa run with fixed -Xmx
    values and risk running out of memory
    + S8227646: [TESTBUG] appcds/SharedArchiveConsistency timed out
    + S8227662: freetype seeks to index at the end of the font data
    + S8228479: Correct the format of ColorChooserDemoTest
    + S8228613: java.security.Provider#getServices order is no
    longer deterministic
    + S8228969: 2019-09-28 public suffix list update
    + S8229236: CriticalJNINatives: dll handling should be done in
    native thread state
    + S8229345: Memory leak due to vtable stubs not being shared on
    SPARC
    + S8229888: (zipfs) Updating an existing zip file does not
    preserve original permissions
    + S8229994: assert(false) failed: Bad graph detected in
    get_early_ctrl_for_expensive
    + S8230004: jdk/internal/jimage/JImageOpenTest.java runs no test
    + S8230235: Rendering HTML with empty img attribute and
    documentBaseKey cause Exception
    + S8230390: Problemlist SA tests with AOT
    + S8230400: Missing constant pool entry for a method in
    stacktrace
    + S8230459: Test failed to resume JVMCI CompilerThread
    + S8230480: check malloc/calloc results in java.desktop
    + S8230597: Update GIFlib library to the 5.2.1
    + S8230611: infinite loop in
    LogOutputList::wait_until_no_readers()
    + S8230624: [TESTBUG] Problemlist JFR
    compiler/TestCodeSweeper.java
    + S8230677: Should disable Escape Analysis if JVMTI capability
    can_get_owned_monitor_info was taken
    + S8230926: [macosx] Two apostrophes are entered instead of one
    with "U.S. International - PC" layout
    + S8231025: Incorrect method tag offset for big endian platform
    + S8231081: TestMetadataRetention fails due to missing symbol id
    + S8231387: java.security.Provider.getService returns random
    result due to race condition with mutating methods in the same
    class
    + S8231430: C2: Memory stomp in max_array_length() for
    T_ILLEGAL type
    + S8231445: check ZALLOC return values in awt coding
    + S8231507: Update Apache Santuario (XML Signature) to version
    2.1.4
    + S8231584: Deadlock with ClassLoader.findLibrary and
    System.loadLibrary call
    + S8231753: use more Posix functionality in aix
    os::print_os_info
    + S8231810: javax/net/ssl/templates/
    /SSLSocketSSLEngineTemplate.java fails intermittently with
    "java.lang.Exception: Unexpected EOF"
    + S8232003: (fs) Files.write can leak file descriptor in the
    exception case
    + S8232056: GetOwnedMonitorInfoWithEATest.java fails with ZGC:
    Heap too small
    + S8232060: add some initializations using sigemptyset in
    os_aix.cpp
    + S8232154: Update Mesa 3-D Headers to version 19.2.1
    + S8232167: Visual Studio install found through
  - -with-tools-dir value is discarded
    + S8232170: FSInfo#getJarClassPath throws an exception not
    declared in its throws clause
    + S8232200: [macos 10.15] Windows in fullscreen tests jumps
    around the screen
    + S8232207: Linux os::available_memory re-reads cgroup
    configuration on every invocation
    + S8232224: [TESTBUG] problemlist JFR TestLargeRootSet.java
    + S8232370: Refactor some com.sun.jdi tests to enable IDE
    integration
    + S8232433: [macos 10.15] java/awt/Window/
    /LocationAtScreenCorner/LocationAtScreenCorner.java may fail
    + S8232571: Add missing SIGINFO signal
    + S8232692: [TESTBUG] compiler/aot/fingerprint/
    /SelfChangedCDS.java fails when cds is disabled
    + S8232713: Update BCEL version to 6.3.1 in license file
    + S8232806: Introduce a system property to disable eager lambda
    initialization
    + S8232834: RunTest sometimes fails to produce valid
    exitcode.txt
    + S8232880: Update test documentation with additional settings
    for client UI tooltip tests
    + S8232950: SUNPKCS11 Provider incorrectly check key length for
    PSS Signatures.
    + S8233018: Add a new test to verify that DatagramSocket is not
    interruptible
    + S8233019: java.lang.Class.isPrimitive() (C1) returns wrong
    result if Klass* is aligned to 32bit
    + S8233032: assert(in_bb(n)) failed: must be
    + S8233078: fix minimal VM build on Linux ppc64(le)
    + S8233328: fix minimal VM build on Linux s390x
    + S8233383: Various minor fixes
    + S8233466: aarch64: remove unnecessary load of mdo when
    profiling return and parameters type
    + S8233491: Crash in AdapterHandlerLibrary::get_adapter with
    CDS due to code cache exhaustion
    + S8233529: loopTransform.cpp:2984: Error: assert(p_f-&gt;Opcode()
    == Op_IfFalse) failed
    + S8233548: Update CUP to v0.11b
    + S8233649: Update ProblemList.txt to exclude failing headful
    tests on macos
    + S8233656: assert(d-&gt;is_CFG() &amp;&amp; n-&gt;is_CFG()) failed: must
    have CFG nodes
    + S8233657: Intermittent NPE in Component.validate()
    + S8234288: Turkey Time Zone returns incorrect time zone name
    + S8234323: NULL-check return value of SurfaceData_InitOps on
    macosx
    + S8234339: replace JLI_StrTok in java_md_solinux.c
    + S8234340: Bump update version for OpenJDK: jdk-11.0.7
    + S8234350: assert(mode == ControlAroundStripMined &amp;&amp; (use ==
    sfpt || !use-&gt;is_reachable_from_root())) failed: missed a node
    + S8234386: [macos] NPE was thrown at expanding Choice from
    maximized frame
    + S8234397: add OS uptime information to os::print_os_info
    output
    + S8234423: Modifying ArrayList.subList().subList() resets
    modCount of subList
    + S8234466: Class loading deadlock involving
    X509Factory#commitEvent()
    + S8234501: remove obsolete NET_ReadV
    + S8234525: enable link-time section-gc for linux s390x to
    remove unused code
    + S8234610: MaxVectorSize set wrongly when UseAVX=3 is
    specified after JDK-8221092
    + S8234617: C1: Incorrect result of field load due to missing
    narrowing conversion
    + S8234723: javax/net/ssl/TLS tests support TLSv1.3
    + S8234724: javax/net/ssl/templates/
    /SSLSocketSSLEngineTemplate.java supports TLSv1.3
    + S8234741: enhance os::get_core_path on macOS
    + S8234769: Duplicate attribution in freetype.md
    + S8234786: Fix for JDK-8214578 breaks OS X 10.12 compatibility
    + S8234809: set relro in linker flags when building with gcc
    + S8234824: java/nio/channels/SocketChannel/AdaptSocket.java
    fails on Windows 10
    + S8235243: handle VS2017 15.9 and VS2019 in abstract_vm_version
    + S8235288: AVX 512 instructions inadvertently used on Xeon for
    small vector width operations
    + S8235325: build failure on Linux after 8235243
    + S8235383: C1 compilation fails with
  - XX:+PrintIRDuringConstruction -XX:+Verbose
    + S8235489: handle return values of sscanf calls in hotspot
    + S8235509: Backport for JDK-8209657 Refactor filemap.hpp to
    simplify integration with Serviceability Agent.
    + S8235510: java.util.zip.CRC32 performance drop after 8200067
    + S8235563: [TESTBUG] appcds/CommandLineFlagComboNegative.java
    does not handle archive mapping failure
    + S8235637: jhsdb jmap from OpenJDK 11.0.5 doesn't work if
    prelink is enabled
    + S8235671: enhance print_rlimit_info in os_posix
    + S8235744: PIT: test/jdk/javax/swing/text/html/
    /TestJLabelWithHTMLText.java times out in linux-x64
    + S8235904: Infinite loop when rendering huge lines
    + S8235998: [c2] Memory leaks during tracing after '8224193:
    stringStream should not use Resource Area'.
    + S8236039: JSSE Client does not accept status_request
    extension in CertificateRequest messages for TLS 1.3
    + S8236140: assert(!VerifyHashTableKeys || _hash_lock == 0)
    failed: remove node from hash table before modifying it
    + S8236179: C1 register allocation error with T_ADDRESS
    + S8236488: Support for configure option
  - -with-native-debug-symbols=internal is impossible on Windows
    + S8236500: Windows ucrt.dll should be looked up in versioned
    WINSDK subdirectory
    + S8236709: struct SwitchRange in HS violates C++ One
    Definition Rule
    + S8236848: [JDK 11u] make run-test-tier1 fails after backport
    of JDK-8232834
    + S8236873: Worker has a deadlock bug
    + S8237217: Incorrect G1StringDedupEntry type used in
    StringDedupTable destructor
    + S8237368: Problem with NullPointerException in RMI
    TCPEndpoint.read
    + S8237375: SimpleThresholdPolicy misses CounterDecay timestamp
    initialization
    + S8237508: Simplify JarFile.isInitializing
    + S8237540: Missing files in backport of JDK-8210910
    + S8237541: Missing files in backport of JDK-8236528
    + S8237600: Test SunJSSEFIPSInit fails on Ubuntu
    + S8237819: s390x - remove unused pd_zero_to_words_large
    + S8237869: exclude jtreg test security/infra/java/security/
    /cert/CertPathValidator/certification/LuxTrustCA.java because
    of instabilities
    + S8237879: make 4.3 breaks build
    + S8237945: CTW: C2 compilation fails with
    assert(just_allocated_object(alloc_ctl) == ptr) failed: most
    recent allo...
    + S8238225: Issues reported after replacing symlink at
    Contents/MacOS/libjli.dylib with binary
    + S8238247: CTW runner should sweep nmethods more aggressively
    + S8238366: CTW runner closes standard output on exit
    + S8238438: SuperWord::co_locate_pack picks memory state of
    first instead of last load
    + S8238502: sunmscapi.dll causing EXCEPTION_ACCESS_VIOLATION
    + S8238534: Deep sign macOS bundles before bundle archive is
    being created
    + S8238591: CTW: Split
    applications/ctw/modules/jdk_localedata.java
    + S8238596: AVX enabled by default for Skylake even when
    unsupported
    + S8238811: C2: assert(i &gt;= req() || i == 0 || is_Region() ||
    is_Phi()) with -XX:+VerifyGraphEdges
    + S8239005: [TESTBUG] test/hotspot/jtreg/runtime/
    /StackGuardPages/TestStackGuardPages.java: exeinvoke.c: must
    initialize static state before calling do_overflow()
    + S8239466: Loss of precision in counter decay calculation in
    11u backport of JDK-8237375
    + S8239856: [ntintel] asserts about copying unaligned array
    element
    + S8240724: [test] jdk11 downport of 8224475 misses binary file
    test/jdk/javax/swing/JTextPane/arrow.png
    + S8241296: Segfault in JNIHandleBlock::oops_do()
- Removed patch:
  * DependOnVariableHelper.patch
    + fixed upstream
- Added patch:
  * JDK-8228407.patch
    + fix crashes due to shared archive file mismatch</changelog>
  <changelog author="fstrba@suse.com" date="1594900800">- Update to upstream tag jdk-11.0.8+10 (July 2020 CPU, bsc#1174157)
  * Security fixes:
    + JDK-8230613: Better ASCII conversions
    + JDK-8231800: Better listing of arrays
    + JDK-8232014: Expand DTD support
    + JDK-8233234: Better Zip Naming
    + JDK-8233239, CVE-2020-14562: Enhance TIFF support
    + JDK-8233255: Better Swing Buttons
    + JDK-8234032: Improve basic calendar services
    + JDK-8234042: Better factory production of certificates
    + JDK-8234418: Better parsing with CertificateFactory
    + JDK-8234836: Improve serialization handling
    + JDK-8236191: Enhance OID processing
    + JDK-8236867, CVE-2020-14573: Enhance Graal interface handling
    + JDK-8237117, CVE-2020-14556: Better ForkJoinPool behavior
    + JDK-8237592, CVE-2020-14577: Enhance certificate verification
    + JDK-8238002, CVE-2020-14581: Better matrix operations
    + JDK-8238013: Enhance String writing
    + JDK-8238804: Enhance key handling process
    + JDK-8238842: AIOOBE in GIFImageReader.initializeStringTable
    + JDK-8238843: Enhanced font handing
    + JDK-8238920, CVE-2020-14583: Better Buffer support
    + JDK-8238925: Enhance WAV file playback
    + JDK-8240119, CVE-2020-14593: Less Affine Transformations
    + JDK-8240482: Improved WAV file playback
    + JDK-8241379: Update JCEKS support
    + JDK-8241522: Manifest improved jar headers redux
    + JDK-8242136, CVE-2020-14621: Better XML namespace handling
  * Other changes:
    + JDK-6933331: (d3d/ogl) java.lang.IllegalStateException:
    Buffers have not been created
    + JDK-7124307: JSpinner and changing value by mouse
    + JDK-8022574: remove HaltNode code after uncommon trap calls
    + JDK-8039082: [TEST_BUG] Test
    java/awt/dnd/BadSerializationTest/BadSerializationTest.java
    fails
    + JDK-8040630: Popup menus and tooltips flicker with previous
    popup contents when first shown
    + JDK-8044365: (dc) MulticastSendReceiveTests.java failing with
    ENOMEM when joining group (OS X 10.9)
    + JDK-8048215: [TESTBUG]
    java/lang/management/ManagementFactory/ThreadMXBeanProxy.java
    Expected non-null LockInfo
    + JDK-8051349: nsk/jvmti/scenarios/sampling/SP06/sp06t003 fails
    in nightly
    + JDK-8080353: JShell: Better error message on attempting to
    add default method
    + JDK-8139876: Exclude hanging nsk/stress/stack from execution
    with deoptimization enabled
    + JDK-8146090: java/lang/ref/ReachabilityFenceTest.java fails
    with -XX:+DeoptimizeALot
    + JDK-8153430: jdk regression test MletParserLocaleTest,
    ParserInfiniteLoopTest reduce default timeout
    + JDK-8156207: Resource allocated BitMaps are often cleared
    unnecessarily
    + JDK-8159740: JShell: corralled declarations do not have
    correct source to wrapper mapping
    + JDK-8175984: ICC_Profile has un-needed, not-empty finalize
    method
    + JDK-8176359: Frame#setMaximizedbounds not working properly in
    multi screen environments
    + JDK-8183369: RFC unconformity of HttpURLConnection with proxy
    + JDK-8187078: -XX:+VerifyOops finds numerous problems when
    running JPRT
    + JDK-8189861: Refactor CacheFind
    + JDK-8191169: java/net/Authenticator/B4769350.java failed
    intermittently
    + JDK-8191930: [Graal] emits unparseable XML into compile log
    + JDK-8193879: Java debugger hangs on method invocation
    + JDK-8196019: java/awt/Window/Grab/GrabTest.java fails on
    Windows
    + JDK-8196181: sun/java2d/GdiRendering/InsetClipping.java fails
    + JDK-8198000:
    java/awt/List/EmptyListEventTest/EmptyListEventTest.java
    debug assert on Windows
    + JDK-8198001: java/awt/Menu/WrongParentAfterRemoveMenu/
    /WrongParentAfterRemoveMenu.java debug assert on Windows
    + JDK-8198339: Test javax/swing/border/Test6981576.java is
    unstable
    + JDK-8200701: jdk/jshell/ExceptionsTest.java fails on Windows,
    after JDK-8198801
    + JDK-8203264: JNI exception pending in
    PlainDatagramSocketImpl.c:740
    + JDK-8203672: JNI exception pending in PlainSocketImpl.c
    + JDK-8203673: JNI exception pending in
    DualStackPlainDatagramSocketImpl.c:398
    + JDK-8204834: Fix confusing "allocate" naming in OopStorage
    + JDK-8205399: Set node color on pinned HashMap.TreeNode
    deletion
    + JDK-8205653: test/jdk/sun/management/jmxremote/bootstrap/
    /RmiRegistrySslTest.java and RmiSslBootstrapTest.sh fail with
    handshake_failure
    + JDK-8206179: com/sun/management/OperatingSystemMXBean/
    /GetCommittedVirtualMemorySize.java fails with Committed
    virtual memory size illegal value
    + JDK-8207334: VM times out in VM_HandshakeAllThreads::doit()
    with RunThese30M
    + JDK-8208277: Code cache heap (-XX:ReservedCodeCacheSize)
    doesn't work with 1GB LargePages
    + JDK-8209113: Use WeakReference for lastFontStrike for created
    Fonts
    + JDK-8209333: Socket reset issue for TLS 1.3 socket close
    + JDK-8209439: C2 library_call can potentially ignore Math.pow
    intrinsic or use null pointer
    + JDK-8209534: [TESTBUG]runtime/appcds/cacheObject/
    /ArchivedModuleCompareTest.java fails with EnableJVMCI.
    + JDK-8210147: adjust some WSAGetLastError usages in windows
    network coding
    + JDK-8210284: "assert((av &amp; 0x00000001) == 0) failed:
    unsupported V8" on Solaris 11.4
    + JDK-8210303: VM_HandshakeAllThreads fails assert with
    "failed: blocked and not walkable"
    + JDK-8210459: Add support for generating compile_commands.json
    + JDK-8210515: [TESTBUG]CheckArchivedModuleApp.java needs to
    check if EnableJVMCI is set.
    + JDK-8210788: Javadoc for Thread.join(long, int) should
    specify that it waits forever when both arguments are zero
    + JDK-8211301: [macos] support full window content options
    + JDK-8211332: Space for stub routines (code_size2) is too
    small on new Skylake CPUs
    + JDK-8211339: NPE during SSL handshake caused by
    HostnameChecker
    + JDK-8211392: compiler/profiling/
    /spectrapredefineclass_classloaders/Launcher.java times out
    in JDK12 CI
    + JDK-8211743: [AOT] crash in ScopeDesc::decode_body() when
    JVMTI walks AOT frames
    + JDK-8212154: [TESTBUG] CheckArchivedModuleApp fails with NPE
    when JVMCI is absent
    + JDK-8212167: JShell : Stack trace of exception has wrong line
    number
    + JDK-8212933: Thread-SMR: requesting a VM operation whilst
    holding a ThreadsListHandle can cause deadlocks
    + JDK-8212986: Make Visual Studio compiler check less strict
    + JDK-8213250: CDS archive creation aborts due to metaspace
    object allocation failure
    + JDK-8213516: jck test api/javax_accessibility/AccessibleState/
    /fields.html fails intermittent
    + JDK-8213947: ARM32: failed check_simd should set
    UsePopCountInstruction to false
    + JDK-8214418: half-closed SSLEngine status may cause
    application dead loop
    + JDK-8214440: ldap over a TLS connection negotiate failed with
    "javax.net.ssl.SSLPeerUnverifiedException: hostname of the
    server does not match the hostname in the server's
    certificate"
    + JDK-8214444: Wrong strncat limits in dfa.cpp
    + JDK-8214481: freetype path does not disable TrueType hinting
    with AA+FM hints
    + JDK-8214571: -Xdoclint of array serialField gives "error:
    array type not allowed here"
    + JDK-8214856: Errors with JSZip in web console after upgrade
    to 3.1.5
    + JDK-8214862: assert(proj != __null) at compile.cpp:3251
    + JDK-8215369: Jcstress pollute /var/tmp with temporary files.
    + JDK-8215551: Missing case label in nmethod::reloc_string_for()
    + JDK-8215555: TieredCompilation C2 threads can excessively
    block handshakes
    + JDK-8215711: Missing key_share extension for (EC)DHE key
    exchange should alert missing_extension
    + JDK-8216151: [Graal] Module
    jdk.internal.vm.compiler.management has not been granted
    accessClassInPackage.org.graalvm.compiler.debug
    + JDK-8216154: C4819 warnings at HotSpot sources on Windows
    + JDK-8216541: CompiledICHolders of VM locked unloaded nmethods
    are released too late
    + JDK-8217230: assert(t == t_no_spec) failure in
    NodeHash::check_no_speculative_types()
    + JDK-8217404: --with-jvm-features doesn't work when multiple
    features are explicitly disabled
    + JDK-8217447: Develop flag TraceICs is broken
    + JDK-8217606: LdapContext#reconnect always opens a new
    connection
    + JDK-8218807: Compilation database (compile_commands.json) may
    contain obsolete items
    + JDK-8219214: Infinite Loop in CodeSection::dump()
    + JDK-8219904: ClassCastException when calling
    FlightRecorderMXBean#getRecordings()
    + JDK-8219991: New fix of the deadlock in
    sun.security.ssl.SSLSocketImpl
    + JDK-8221121: applications/microbenchmarks are encountering
    crashes in tier5
    + JDK-8221445: FastSysexMessage constructor crashes MIDI
    receiption thread
    + JDK-8221482: Initialize VMRegImpl::regName[] earlier to
    prevent assert during PrintStubCode
    + JDK-8221741: ClassCastException can happen when
    fontconfig.properties is used
    + JDK-8221823: Requested JDialog width is ignored
    + JDK-8223108: Test java/awt/EventQueue/
    /NonComponentSourcePost.java is unstable
    + JDK-8223678: Add Visual Studio Code workspace generation
    support (for native code)
    + JDK-8223935: PIT: java/awt/font/WindowsIndicFonts.java fails
    on windows10
    + JDK-8224109: Text spaced incorrectly by drawString under
    rotation with fractional metric
    + JDK-8224632: testbug: java/awt/dnd/RemoveDropTargetCrashTest/
    /RemoveDropTargetCrashTest.java fails on MacOS
    + JDK-8224793: os::die() does not honor CreateCoredumpOnCrash
    option
    + JDK-8224847: gc/stress/TestReclaimStringsLeaksMemory.java
    fails with reserved greater than expected
    + JDK-8224931: disable JAOTC invokedynamic support until
    8223533 is fixed
    + JDK-8224997: ChaCha20-Poly1305 TLS cipher suite decryption
    throws ShortBufferException
    + JDK-8225068: Remove DocuSign root certificate that is
    expiring in May 2020
    + JDK-8225069: Remove Comodo root certificate that is expiring
    in May 2020
    + JDK-8225126: Test SetBoundsPaintTest.html faild on Windows
    when desktop is scaled
    + JDK-8225325: Add tests for redefining a class' private method
    during resolution of the bootstrap specifier
    + JDK-8225622: [AOT] runtime/SharedArchiveFile/
    /TestInterpreterMethodEntries.java crashed with AOTed
    java.base
    + JDK-8225653: Provide more information when hitting SIGILL
    from HaltNode
    + JDK-8225783: Incorrect use of binary operators on booleans in
    type.cpp
    + JDK-8225789: Empty method parameter type should generate
    ClassFormatError
    + JDK-8226198: use of &amp; instead of &amp;&amp; in
    LibraryCallKit::arraycopy_restore_alloc_state
    + JDK-8226253: JAWS reports wrong number of radio buttons when
    buttons are hidden.
    + JDK-8226653: [accessibility] Can edit text cell correctly,
    but Accessibility Tool reads nothing about editor
    + JDK-8226806: [macOS 10.14] Methods of Java Robot should be
    called from appropriate thread
    + JDK-8226879: Memory leak in Type::hashcons
    + JDK-8227632: Incorrect PrintCompilation message: made not
    compilable on levels 0 1 2 3 4
    + JDK-8228407: JVM crashes with shared archive file mismatch
    + JDK-8228482: fix xlc16/xlclang comparison of distinct pointer
    types and string literal conversion warnings
    + JDK-8228757: Fail fast if the handshake type is unknown
    + JDK-8229158: make UseSwitchProfiling non-experimental or
    false by-default
    + JDK-8229421: The logic of java/net/ipv6tests/TcpTest.java is
    flawed
    + JDK-8229855: C2 fails with assert(false) failed: bad AD file
    + JDK-8230591: AArch64: Missing intrinsics for Math.ceil,
    floor, rint
    + JDK-8231118: ARM32: Math tests failures
    + JDK-8231213: Migrate SimpleDateFormatConstTest to JDK Repo
    + JDK-8231243: [TESTBUG] CustomFont.java cannot find font file
    + JDK-8231438: [macOS] Dark mode for the desktop is not
    supported
    + JDK-8231550: C2: ShouldNotReachHere() in
    verify_strip_mined_scheduling
    + JDK-8231564: setMaximizedBounds is broken with large display
    scale and multiple monitors
    + JDK-8231572: Use -lobjc instead of -fobjc-link-runtime in
    libosxsecurity
    + JDK-8231631: sun/net/ftp/FtpURLConnectionLeak.java fails
    intermittently with NPE
    + JDK-8231671: Fix copyright headers in hotspot (missing comma
    after year)
    + JDK-8231720: Some perf regressions after 8225653
    + JDK-8231779: crash
    HeapWord*ParallelScavengeHeap::failed_mem_allocate
    + JDK-8231863: Crash if classpath is read from @argument file
    and the main gets option argument
    + JDK-8232080: jlink plugins for vendor information and
    run-time options
    + JDK-8232106: [x86] C2: SIGILL due to usage of SSSE3
    instructions on processors which don't support it
    + JDK-8232134: Change to Visual Studio 2017 15.9.16 for
    building on Windows at Oracle
    + JDK-8232226: [macos 10.15] test/jdk/java/awt/color/
    /EqualityTest/EqualityTest.java may fail
    + JDK-8232357: Compare version info of Santuario to legal notice
    + JDK-8232572: Add hooks for custom output dir in Bundles.gmk
    + JDK-8232634: Problem List ICMColorDataTest.java
    + JDK-8232748: Build static versions of certain JDK libraries
    + JDK-8232846: ProcessHandle.Info command with non-English
    shows question marks
    + JDK-8232880: Update test documentation with additional
    settings for client UI tooltip tests
    + JDK-8233033: C2 produces wrong result while unswitching a
    loop due to lost control dependencies
    + JDK-8233137: runtime/ErrorHandling/VeryEarlyAssertTest.java
    fails after 8232080
    + JDK-8233197: Invert JvmtiExport::post_vm_initialized() and
    Jfr:on_vm_start() start-up order for correct option parsing
    + JDK-8233291: [TESTBUG] tools/jlink/plugins/
    /VendorInfoPluginsTest.java fails with debug or non-server VMs
    + JDK-8233364: Fix undefined behavior in
    Canonicalizer::do_ShiftOp
    + JDK-8233494: Avoid calling MallocTracker::record_malloc and
    record_free when NMT is off
    + JDK-8233573: Toolkit.getScreenInsets(GraphicsConfiguration)
    may throw ClassCastException
    + JDK-8233608: Minimal build broken after JDK-8233494
    + JDK-8233621: Mismatch in jsse.enableMFLNExtension property
    name
    + JDK-8233696: [TESTBUG]Some jtreg tests fail when CAPS_LOCK is
    ON
    + JDK-8233707: systemScale.cpp could not compile with VS2019
    + JDK-8233801: GCMEmptyIv.java test fails on Solaris 11.4
    + JDK-8233880: Support compilers with multi-digit major version
    numbers
    + JDK-8233920: MethodHandles::tryFinally generates illegal
    bytecode for long/double return type
    + JDK-8234137: The "AutoTestOnTop.java" test may run external
    applications
    + JDK-8234146: compiler/jsr292/
    /ContinuousCallSiteTargetChange.java times out on SPARC
    + JDK-8234184: [TESTBUG] java/awt/Mouse/EnterExitEvents/
    /ModalDialogEnterExitEventsTest.java fails in Windows
    + JDK-8234270: [REDO] JDK-8204128 NMT might report incorrect
    numbers for Compiler area
    + JDK-8234332: [TESTBUG] java/awt/Focus/DisposedWindow/
    /DisposeDialogNotActivateOwnerTest/
    /DisposeDialogNotActivateOwnerTest.java fails on linux-x64
    nightly
    + JDK-8234398: Replace ID2D1Factory::GetDesktopDpi with
    GetDeviceCaps
    + JDK-8234522: [macos] Crash with use of native file dialog
    + JDK-8234691: Potential double-free in ParallelSPCleanupTask
    constructor
    + JDK-8234696: tools/jlink/plugins/VendorInfoPluginsTest.java
    times out
    + JDK-8234727: sun/security/ssl/X509TrustManagerImpl tests
    support TLSv1.3
    + JDK-8234728: Some security tests should support TLSv1.3
    + JDK-8234779: Provide idiom for declaring classes noncopyable
    + JDK-8234824: java/nio/channels/SocketChannel/AdaptSocket.java
    fails on Windows 10
    + JDK-8234968: check calloc rv in libinstrument
    InvocationAdapter
    + JDK-8235153: [TESTBUG] [macos 10.15] java/awt/Graphics/
    /DrawImageBG/SystemBgColorTest.java fails
    + JDK-8235183: Remove the "HACK CODE" in comment
    + JDK-8235263: Revert TLS 1.3 change that wrapped IOExceptions
    + JDK-8235311: Tag mismatch may alert bad_record_mac
    + JDK-8235332: TestInstanceCloneAsLoadsStores.java fails with
  - XX:+StressGCM
    + JDK-8235452: Strip mined loop verification fails with
    assert(is_OuterStripMinedLoop()) failed: invalid node class
    + JDK-8235584: UseProfiledLoopPredicate fails with
    assert(_phase-&gt;get_loop(c) == loop) failed: have to be in the
    same loop
    + JDK-8235620: Broken merge between JDK-8006406 and JDK-8003559
    + JDK-8235638: NPE in LWWindowPeer.getOnscreenGraphics()
    + JDK-8235686: Add more custom hooks in Bundles.gmk
    + JDK-8235739: Rare NPE at WComponentPeer.getGraphics()
    + JDK-8235762: JVM crash in SWPointer during C2 compilation
    + JDK-8235834: IBM-943 charset encoder needs updating
    + JDK-8235874: The ordering of Cipher Suites is not maintained
    provided through jdk.tls.client.cipherSuites and
    jdk.tls.server.cipherSuites system property.
    + JDK-8235908: omit ThreadPriorityPolicy warning when value is
    set from image
    + JDK-8235984: C2: assert(out-&gt;in(PhiNode::Region) == head ||
    out-&gt;in(PhiNode::Region) == slow_head) failed: phi must be
    either part of the slow or the fast loop
    + JDK-8236211: [Graal] compiler/graalunit/GraphTest.java is
    skipped in all testing
    + JDK-8236470: Deal with ECDSA using ecdsa-with-SHA2 plus hash
    algorithm as AlgorithmId
    + JDK-8236545: Compilation error in mach5
    java/awt/FileDialog/MacOSGoToFolderCrash.java
    + JDK-8236700: Upgrading JSZip from v3.1.5 to v3.2.2
    + JDK-8236759: ShouldNotReachHere in
    PhaseIdealLoop::verify_strip_mined_scheduling
    + JDK-8236897: Fix the copyright header for pkcs11gcm2.h
    + JDK-8236921: Add build target to produce a JDK image suitable
    for a Graal/SVM build
    + JDK-8236953: [macos] JavaFX SwingNode is not rendered on macOS
    + JDK-8236996: Incorrect Roboto font rendering on Windows with
    subpixel antialiasing
    + JDK-8237045: JVM uses excessive memory with -XX:+EnableJVMCI
  - XX:JVMCICounterSize=2147483648
    + JDK-8237055: [TESTBUG] compiler/c2/TestJumpTable.java fails
    with release VMs
    + JDK-8237086: assert(is_MachReturn()) running CTW with fix for
    JDK-8231291
    + JDK-8237192: Generate stripped/public pdbs on Windows for jdk
    images
    + JDK-8237396: JvmtiTagMap::weak_oops_do() should not trigger
    barriers
    + JDK-8237474: Default SSLEngine should create in server role
    + JDK-8237859: C2: Crash when loads float above range check
    + JDK-8237879: make 4.3 breaks build
    + JDK-8237951: CTW: C2 compilation fails with "malformed
    control flow"
    + JDK-8237962: give better error output for invalid OCSP
    response intervals in CertPathValidator checks
    + JDK-8238190: [JVMCI] Fix single implementor speculation for
    diamond shapes.
    + JDK-8238356: CodeHeap::blob_count() overestimates the number
    of blobs
    + JDK-8238452: Keytool generates wrong expiration date if
    validity is set to 2050/01/01
    + JDK-8238555: Allow Initialization of SunPKCS11 with NSS when
    there are external FIPS modules in the NSSDB
    + JDK-8238575: DragSourceEvent.getLocation() returns wrong
    value on HiDPI screens (Windows)
    + JDK-8238676: jni crashes on accessing it from process exit
    hook
    + JDK-8238721: Add failing client jtreg tests to the Problem
    List
    + JDK-8238738: AudioSystem.getMixerInfo() takes about 30 sec to
    report a gone audio device
    + JDK-8238756: C2: assert(((n) == __null || !VerifyIterativeGVN
    || !((n)-&gt;is_dead()))) failed: can not use dead node
    + JDK-8238765: PhaseCFG::schedule_pinned_nodes cannot handle
    precedence edges from unmatched CFG nodes correctly
    + JDK-8238898: Missing hash characters for header on license
    file
    + JDK-8238942: Rendering artifacts with LCD text and fractional
    metrics
    + JDK-8238985: [TESTBUG] The arrow image is blue instead of
    green
    + JDK-8239000: handle ContendedPaddingWidth in vm_version_ppc
    + JDK-8239055: Wrong implementation of VMState.hasListener
    + JDK-8239091: Reversed arguments in call to strstr in freetype
    "debug" code.
    + JDK-8239142: C2's UseUniqueSubclasses optimization is broken
    for array accesses
    + JDK-8239224: libproc_impl.c previous_thr may be used
    uninitialized warning
    + JDK-8239351: Give more meaningful InternalError messages in
    Deflater.c
    + JDK-8239365: ProcessBuilder test modifications for AIX
    execution
    + JDK-8239456: vtable stub generation: assert failure (code
    size estimate)
    + JDK-8239457: call ReleaseStringUTFChars before early returns
    in Java_sun_security_pkcs11_wrapper_PKCS11_connect
    + JDK-8239462: jdk.hotspot.agent misses some
    ReleaseStringUTFChars calls in case of early returns
    + JDK-8239557: [TESTBUG] VeryEarlyAssertTest.java validating
    "END." marker at lastline is not always true
    + JDK-8239787: AArch64: String.indexOf may incorrectly handle
    empty strings
    + JDK-8239792: Bump update version for OpenJDK: jdk-11.0.8
    + JDK-8239798: SSLSocket closes socket both socket endpoints on
    a SocketTimeoutException
    + JDK-8239819: XToolkit: Misread of screen information memory
    + JDK-8239852: java/util/concurrent tests fail with
  - XX:+VerifyGraphEdges: assert(!VerifyGraphEdges) failed:
    verification should have failed
    + JDK-8239893: Windows handle Leak when starting processes
    using ProcessBuilder
    + JDK-8239915: Zero VM crashes when handling dynamic constant
    + JDK-8239931: [win][x86] vtable stub generation: assert
    failure (code size estimate) follow-up
    + JDK-8239965: XMLEncoder/Test4625418.java fails due to "Error:
    Cp943 - can't read properly"
    + JDK-8239976: Put JDK-8239965 on the ProblemList.txt
    + JDK-8240073: Fix 'test-make' build target in 11u
    + JDK-8240197: Cannot start JVM when $JAVA_HOME includes CJK
    characters
    + JDK-8240202: A few client tests leave mouse buttons pressed
    + JDK-8240220: IdealLoopTree::dump_head predicate printing is
    broken
    + JDK-8240223: Use consistent predicate order in and with
    PhaseIdealLoop::find_predicate
    + JDK-8240227: Loop predicates should be copied to unswitched
    loops
    + JDK-8240286: [TESTBUG] Test command error in hotspot/jtreg/
    /compiler/loopopts/superword/SumRedAbsNeg_Float.java
    + JDK-8240518: Incorrect JNU_ReleaseStringPlatformChars in
    Windows Print
    + JDK-8240529: CheckUnhandledOops breaks NULL check in
    Modules::define_module
    + JDK-8240576: JVM crashes after transformation in C2
    IdealLoopTree::merge_many_backedges
    + JDK-8240603: Windows 32bit compile error after 8238676
    + JDK-8240629: argfiles parsing broken for argfiles with
    comment cross 4096 bytes chunk
    + JDK-8240711: TestJstatdPort.java failed due to
    "ExportException: Port already in use:"
    + JDK-8240786: [TESTBUG] The test java/awt/Window/
    /GetScreenLocation/GetScreenLocationTest.java fails on HiDPI
    screen
    + JDK-8240824: enhance print_full_memory_info on Linux by THP
    related information
    + JDK-8240827: Downport SSLSocketImpl.java from "8221882: Use
    fiber-friendly java.util.concurrent.locks in JSSE"
    + JDK-8240905: assert(mem == (Node*)1 || mem == mem2) failed:
    multiple Memories being matched at once?
    + JDK-8240972: macOS codesign fail on macOS 10.13.5 or older
    + JDK-8241445: Fix copyright in
    test/jdk/tools/launcher/ArgFileSyntax.java
    + JDK-8241458: [JVMCI] add mark value to expose
    CodeOffsets::Frame_Complete
    + JDK-8241464: [11u] Backport: make rehashing be a needed
    guaranteed safepoint cleanup action
    + JDK-8241556: Memory leak if -XX:CompileCommand is set
    + JDK-8241568: (fs) UserPrincipalLookupService.lookupXXX
    failure with IOE "Operation not permitted"
    + JDK-8241586: compiler/cpuflags/
    /TestAESIntrinsicsOnUnsupportedConfig.java fails on aarch64
    + JDK-8241638: launcher time metrics always report 1 on Linux
    when _JAVA_LAUNCHER_DEBUG set
    + JDK-8241660: Add virtualization information output to hs_err
    file on macOS
    + JDK-8241808: [TESTBUG] The JDK-8039467 bug appeared on macOS
    + JDK-8241888: Mirror jdk.security.allowNonCaAnchor system
    property with a security one
    + JDK-8241900: Loop unswitching may cause dependence on null
    check to be lost
    + JDK-8241948: enhance list of environment variables printed in
    hs_err file
    + JDK-8241996: on linux set full relro in the linker flags
    + JDK-8242108: Performance regression after fix for JDK-8229496
    + JDK-8242141: New System Properties to configure the TLS
    signature schemes
    + JDK-8242154: Backport parts of JDK-4947890 to OpenJDK 11u
    + JDK-8242174: [macos] The NestedModelessDialogTest test make
    the macOS unstable
    + JDK-8242239: [Graal] javax/management/generified/
    /GenericTest.java fails: FAILED: queryMBeans sets same
    + JDK-8242294: JSSE Client does not throw SSLException when an
    alert occurs during handshaking
    + JDK-8242379: [TESTBUG] compiler/loopopts/
    /TestLoopUnswitchingLostCastDependency.java fails with
    release VMs
    + JDK-8242470: Update Xerces to Version 2.12.1
    + JDK-8242498: Invalid "sun.awt.TimedWindowEvent" object leads
    to JVM crash
    + JDK-8242541: Small charset issues (ISO8859-16, x-eucJP-Open,
    x-IBM834 and x-IBM949C)
    + JDK-8242626: enhance posix print_rlimit_info
    + JDK-8243059: Build fails when --with-vendor-name contains a
    comma
    + JDK-8243539: Copyright info (Year) should be updated for fix
    of 8241638
    + JDK-8243541: (tz) Upgrade time-zone data to tzdata2020a
    + JDK-8244407: JVM crashes after transformation in C2
    IdealLoopTree::split_fall_in
    + JDK-8244520: problemlist
    java/awt/font/Rotate/RotatedFontTest.java on linux
    + JDK-8244777: ClassLoaderStats VM Op uses constant hash value
    + JDK-8244853: The static build of libextnet is missing the
    JNI_OnLoad_extnet function
    + JDK-8244951: Missing entitlements for hardened runtime
    + JDK-8245047: [PPC64] C2: ReverseBytes + Load always match to
    unordered Load (acquire semantics missing)
    + JDK-8245649: Revert 8245397 backport of 8230591
    + JDK-8246031: SSLSocket.getSession() doesn't close connection
    for timeout/ interrupts
    + JDK-8246613: Choose the default SecureRandom algo based on
    registration ordering
    + JDK-8248505: Unexpected NoSuchAlgorithmException when using
    secure random impl from BCFIPS provider
- Removed patch:
  * JDK-8228407.patch
    + integrated upstream</changelog>
  <changelog author="fstrba@suse.com" date="1604318400">- Update to upstream tag jdk-11.0.9-11 (October 2020 CPU,
  bsc#1177943)
  * New features
    + JDK-8250784: Shenandoah: A Low-Pause-Time Garbage Collector
  * Security fixes
    + JDK-8233624: Enhance JNI linkage
    + JDK-8236196: Improve string pooling
    + JDK-8236862, CVE-2020-14779: Enhance support of Proxy class
    + JDK-8237990, CVE-2020-14781: Enhanced LDAP contexts
    + JDK-8237995, CVE-2020-14782: Enhance certificate processing
    + JDK-8240124: Better VM Interning
    + JDK-8241114, CVE-2020-14792: Better range handling
    + JDK-8242680, CVE-2020-14796: Improved URI Support
    + JDK-8242685, CVE-2020-14797: Better Path Validation
    + JDK-8242695, CVE-2020-14798: Enhanced buffer support
    + JDK-8243302: Advanced class supports
    + JDK-8244136, CVE-2020-14803: Improved Buffer supports
    + JDK-8244479: Further constrain certificates
    + JDK-8244955: Additional Fix for JDK-8240124
    + JDK-8245407: Enhance zoning of times
    + JDK-8245412: Better class definitions
    + JDK-8245417: Improve certificate chain handling
    + JDK-8248574: Improve jpeg processing
    + JDK-8249927: Specify limits of jdk.serialProxyInterfaceLimit
    + JDK-8253019: Enhanced JPEG decoding
  * Other changes
    + JDK-6532025: GIF reader throws misleading exception with
    truncated images
    + JDK-6949753: [TEST BUG]: java/awt/print/PageFormat/
    /PDialogTest.java needs update by removing an infinite loop
    + JDK-8022535: [TEST BUG] javax/swing/text/html/parser/
    /Test8017492.java fails
    + JDK-8062947: Fix exception message to correctly represent
    LDAP connection failure
    + JDK-8067354: com/sun/jdi/GetLocalVariables4Test.sh failed
    + JDK-8134599: TEST_BUG: java/rmi/transport/closeServerSocket/
    /CloseServerSocket.java fails intermittently with Address
    already in use
    + JDK-8151678: com/sun/jndi/ldap/LdapTimeoutTest.java failed
    due to timeout on DeadServerNoTimeoutTest is incorrect
    + JDK-8160768: Add capability to custom resolve host/domain
    names within the default JNDI LDAP provider
    + JDK-8172404: Tools should warn if weak algorithms are used
    before restricting them
    + JDK-8193367: Annotated type variable bounds crash javac
    + JDK-8202117: com/sun/jndi/ldap/RemoveNamingListenerTest.java
    fails intermittently: Connection reset
    + JDK-8203026: java.rmi.NoSuchObjectException: no such object
    in table
    + JDK-8203281: [Windows] JComboBox change in ui when
    editor.setBorder() is called
    + JDK-8203382: Rename SystemDictionary::initialize_wk_klass to
    resolve_wk_klass
    + JDK-8203393: com/sun/jdi/JdbMethodExitTest.sh and
    JdbExprTest.sh fail due to timeout
    + JDK-8203928: [Test] Convert non-JDB scaffolding
    serviceability shell script tests to java
    + JDK-8204963: javax.swing.border.TitledBorder has a memory leak
    + JDK-8204994: SA might fail to attach to process with "Windbg
    Error: WaitForEvent failed"
    + JDK-8205534: Remove SymbolTable dependency from
    serviceability agent
    + JDK-8206309: Tier1 SA tests fail
    + JDK-8208281: java/nio/channels/
    /AsynchronousSocketChannel/Basic.java timed out
    + JDK-8209109: [TEST] rewrite com/sun/jdi shell tests to java
    version - step1
    + JDK-8209332: [TEST] test/jdk/com/sun/jdi/CatchPatternTest.sh
    is incorrect
    + JDK-8209342: Problemlist SA tests on Solaris due to Error
    attaching to process: Can't create thread_db agent!
    + JDK-8209343: Test javax/swing/border/TestTitledBorderLeak.java
    should be marked as headful
    + JDK-8209517: com/sun/jdi/BreakpointWithFullGC.java fails with
    timeout
    + JDK-8209604: [TEST] rewrite com/sun/jdi shell tests to java
    version - step2
    + JDK-8209605: com/sun/jdi/BreakpointWithFullGC.java fails with
    ZGC
    + JDK-8209608: Problem list com/sun/jdi/BreakpointWithFullGC.java
    + JDK-8210131: vmTestbase/nsk/jvmti/scenarios/allocation/AP10/
    /ap10t001/TestDescription.java failed with ObjectFree:
    GetCurrentThreadCpuTimerInfo returned unexpected error code
    + JDK-8210243: [TEST] rewrite com/sun/jdi shell tests to java
    version - step3
    + JDK-8210527: JShell: NullPointerException in
    jdk.jshell.Eval.translateExceptionStack
    + JDK-8210560: [TEST] convert com/sun/jdi redefineClass-related
    tests
    + JDK-8210725: com/sun/jdi/RedefineClearBreakpoint.java fails
    with waitForPrompt timed out after 60 seconds
    + JDK-8210748: [TESTBUG] lib.jdb.Jdb.waitForPrompt() should
    clarify which output is the pending reply after a timeout
    + JDK-8210760: [TEST] rewrite com/sun/jdi shell tests to java
    version - step4
    + JDK-8210977: jdk/jfr/event/oldobject/TestThreadLocalLeak.java
    fails to find ThreadLocalObject
    + JDK-8211292: [TEST] convert com/sun/jdi/DeferredStepTest.sh
    test
    + JDK-8211694: JShell: Redeclared variable should be reset
    + JDK-8212200: assert when shared java.lang.Object is redefined
    by JVMTI agent
    + JDK-8212629: [TEST] wrong breakpoint in
    test/jdk/com/sun/jdi/DeferredStepTest
    + JDK-8212665: com/sun/jdi/DeferredStepTest.java: jj1 (line 57)
  - unexpected. lastLine=52, minLine=52, maxLine=55
    + JDK-8212807: tools/jar/multiRelease/Basic.java times out
    + JDK-8213182: Minimal VM build failure after JDK-8212200
    (assert when shared java.lang.Object is redefined by JVMTI
    agent)
    + JDK-8213214: Set -Djava.io.tmpdir= when running tests
    + JDK-8213275: ReplaceCriticalClasses.java fails with
    jdk.internal.vm.PostVMInitHook not found
    + JDK-8213574: Deadlock in string table expansion when dumping
    lots of CDS classes
    + JDK-8213703: LambdaConversionException: Invalid receiver type
    not a subtype of implementation type interface
    + JDK-8214074: Ghash optimization using AVX instructions
    + JDK-8214491: Upgrade to JLine 3.9.0
    + JDK-8214797: TestJmapCoreMetaspace.java timed out
    + JDK-8215243: JShell tests failing intermitently with
    "Problem cleaning up the following threads:"
    + JDK-8215244: jdk/jshell/ToolBasicTest.java
    testHistoryReference failed
    + JDK-8215354: x86_32 build failures after JDK-8214074 (Ghash
    optimization using AVX instructions)
    + JDK-8215438: jshell tool: Ctrl-D causes EOF
    + JDK-8216021: RunTest.gmk might set concurrency level to 1 on
    Windows
    + JDK-8216974: HttpConnection not returned to the pool after
    204 response
    + JDK-8218948: SimpleDateFormat :: format - Zone Names are not
    reflected correctly during run time
    + JDK-8219712: code_size2 (defined in stub_routines_x86.hpp) is
    too small on new Skylake CPUs
    + JDK-8220150: macos10.14 Mojave returns anti-aliased glyphs
    instead of aliased B&amp;W glyphs
    + JDK-8221658: aarch64: add necessary predicate for ubfx
    patterns
    + JDK-8221759: Crash when completing "java.io.File.path"
    + JDK-8221918: runtime/SharedArchiveFile/serviceability/
    /ReplaceCriticalClasses.java fails: Shared archive not found
    + JDK-8222074: Enhance auto vectorization for x86
    + JDK-8222079: Don't use memset to initialize fields decode_env
    constructor in disassembler.cpp
    + JDK-8222769: [TESTBUG] TestJFRNetworkEvents should not rely
    on hostname command
    + JDK-8223688: JShell: crash on the instantiation of raw
    anonymous class
    + JDK-8223777: In posix_spawn mode, failing to exec()
    jspawnhelper does not result in an error
    + JDK-8223940: Private key not supported by chosen signature
    algorithm
    + JDK-8224184: jshell got IOException at exiting with AIX
    + JDK-8224234: compiler/codegen/TestCharVect2.java fails in
    test_mulc
    + JDK-8225037: java.net.JarURLConnection::getJarEntry() throws
    NullPointerException
    + JDK-8225625: AES Electronic Codebook (ECB) encryption and
    decryption optimization using AVX512 + VAES instructions
    + JDK-8226536: Catch OOM from deopt that fails rematerializing
    objects
    + JDK-8226575: OperatingSystemMXBean should be made container
    aware
    + JDK-8226697: Several tests which need the @key headful
    keyword are missing it.
    + JDK-8226809: Circular reference in printed stack trace is not
    correctly indented &amp; ambiguous
    + JDK-8227059: sun/security/tools/keytool/
    /DefaultSignatureAlgorithm.java timed out
    + JDK-8227269: Slow class loading when running with JDWP
    + JDK-8227595: keytool/fakegen/DefaultSignatureAlgorithm.java
    fails due to "exitValue = 6"
    + JDK-8228448: Jconsole can't connect to itself
    + JDK-8228967: Trust/Key store and SSL context utilities for
    tests
    + JDK-8229378: jdwp library loader in linker_md.c quietly
    truncates on buffer overflow
    + JDK-8229815: Upgrade Jline to 3.12.1
    + JDK-8230000: some httpclients testng tests run zero test
    + JDK-8230002: javax/xml/jaxp/unittest/transform/
    /SecureProcessingTest.java runs zero test
    + JDK-8230010: Remove jdk8037819/BasicTest1.java
    + JDK-8230094: CCE in createXMLEventWriter(Result) over an
    arbitrary XMLStreamWriter
    + JDK-8230402: Allocation of compile task fails with assert:
    "Leaking compilation tasks?"
    + JDK-8230767: FlightRecorderListener returns null recording
    + JDK-8230870: (zipfs) Add a ZIP FS test that is similar to
    test/jdk/java/util/zip/EntryCount64k.java
    + JDK-8231209: [REDO] ThreadMXBean::getThreadAllocatedBytes()
    can be quicker for self thread
    + JDK-8231586: enlarge encoding space for OopMapValue offsets
    + JDK-8231953: Wrong assumption in assertion in
    oop::register_oop
    + JDK-8231968: getCurrentThreadAllocatedBytes default
    implementation s/b getThreadAllocatedBytes
    + JDK-8232083: Minimal VM is broken after JDK-8231586
    + JDK-8232161: Align some one-way conversion in MS950 charset
    with Windows
    + JDK-8232855: jshell missing word in /help help
    + JDK-8233027: OopMapSet::all_do does oms.next() twice during
    iteration
    + JDK-8233228: Disable weak named curves by default in TLS,
    CertPath, and Signed JAR
    + JDK-8233386: Initialize NULL fields for unused decorations
    + JDK-8233452: java.math.BigDecimal.sqrt() with
    RoundingMode.FLOOR results in incorrect result
    + JDK-8233686: XML transformer uses excessive amount of memory
    + JDK-8233741: AES Countermode (AES-CTR) optimization using
    AVX512 + VAES instructions
    + JDK-8233829: javac cannot find non-ASCII module name under
    non-UTF8 environment
    + JDK-8233958: Memory retention due to HttpsURLConnection
    finalizer that serves no purpose
    + JDK-8234011: (zipfs) Memory leak in
    ZipFileSystem.releaseDeflater()
    + JDK-8234058: runtime/CompressedOops/
    /CompressedClassPointers.java fails with 'Narrow klass base:
    0x0000000000000000' missing from stdout/stderr
    + JDK-8234149: Several regression tests do not dispose Frame at
    end
    + JDK-8234347: "Turkey" meta time zone does not generate
    composed localized names
    + JDK-8234385: [TESTBUG] java/awt/EventQueue/6980209/
    /bug6980209.java fails in linux nightly
    + JDK-8234535: Cross compilation fails due to missing CFLAGS
    for the BUILD_CC
    + JDK-8234541: C1 emits an empty message when it inlines
    successfully
    + JDK-8234687: change javap reporting on unknown attributes
    + JDK-8236464: SO_LINGER option is ignored by SSLSocket in JDK
    11
    + JDK-8236548: Localized time zone name inconsistency between
    English and other locales
    + JDK-8236617: jtreg test containers/docker/
    /TestMemoryAwareness.java fails after 8226575
    + JDK-8237182: Update copyright header for shenandoah and
    epsilon files
    + JDK-8237888: security/infra/java/security/cert/
    /CertPathValidator/certification/LuxTrustCA.java fails when
    checking validity interval
    + JDK-8237977: Further update
    javax/net/ssl/compatibility/Compatibility.java
    + JDK-8238270: java.net HTTP/2 client does not decrease stream
    count when receives 204 response
    + JDK-8238284: [macos] Zero VM build fails due to an obvious
    typo
    + JDK-8238380: java.base/unix/native/libjava/childproc.c
    "multiple definition" link errors with GCC10
    + JDK-8238386: (sctp) jdk.sctp/unix/native/libsctp/SctpNet.c
    "multiple definition" link errors with GCC10
    + JDK-8238388: libj2gss/NativeFunc.o "multiple definition" link
    errors with GCC10
    + JDK-8238448: RSASSA-PSS signature verification fail when
    using certain odd key sizes
    + JDK-8238710: LingeredApp doesn't log stdout/stderr if exits
    with non-zero code
    + JDK-8239083: C1 assert(known_holder == NULL ||
    (known_holder-&gt;is_instance_klass() &amp;&amp;
    (!known_holder-&gt;is_interface() ||
    ((ciInstanceKlass*)known_holder)-&gt;has_nonstatic_concrete_methods())),
    "should be non-static concrete method");
    + JDK-8239385: KerberosTicket client name refers wrongly to
    sAMAccountName in AD
    + JDK-8240169: javadoc fails to link to non-modular api docs
    + JDK-8240295: hs_err elapsed time in seconds is not accurate
    enough
    + JDK-8240360: NativeLibraryEvent has wrong library name on
    Linux
    + JDK-8240676: Meet not symmetric failure when running lucene
    on jdk8
    + JDK-8241007: Shenandoah: remove
    ShenandoahCriticalControlThreadPriority support
    + JDK-8241065: Shenandoah: remove leftover code after
    JDK-8231086
    + JDK-8241086: Test runtime/NMT/HugeArenaTracking.java is
    failing on 32bit Windows
    + JDK-8241130: com.sun.jndi.ldap.EventSupport.removeDeadNotifier:
    java.lang.NullPointerException
    + JDK-8241138: http.nonProxyHosts=* causes
    StringIndexOutOfBoundsException in DefaultProxySelector
    + JDK-8241319: WB_GetCodeBlob doesn't have ResourceMark
    + JDK-8241478: vmTestbase/gc/gctests/Steal/steal001/steal001.java
    fails with OOME
    + JDK-8241574: Shenandoah: remove ShenandoahAssertToSpaceClosure
    + JDK-8241750: x86_32 build failure after JDK-8227269
    + JDK-8242184: CRL generation error with RSASSA-PSS
    + JDK-8242283: Can't start JVM when java home path includes
    non-ASCII character
    + JDK-8242556: Cannot load RSASSA-PSS public key with non-null
    params from byte array
    + JDK-8243029: Rewrite javax/net/ssl/compatibility/
    /Compatibility.java with a flexible interop test framework
    + JDK-8243138: Enhance BaseLdapServer to support starttls
    extended request
    + JDK-8243320: Add SSL root certificates to Oracle Root CA
    program
    + JDK-8243321: Add Entrust root CA - G4 to Oracle Root CA
    program
    + JDK-8243389: enhance os::pd_print_cpu_info on linux
    + JDK-8243453: java --describe-module failed with non-ASCII
    module name under non-UTF8 environment
    + JDK-8243470: [macos] bring back O2 opt level for unsafe.cpp
    + JDK-8243489: Thread CPU Load event may contain wrong data for
    CPU time under certain conditions
    + JDK-8243925: Toolkit#getScreenInsets() returns wrong value on
    HiDPI screens (Windows)
    + JDK-8244087: 2020-04-24 public suffix list update
    + JDK-8244151: Update MUSCLE PC/SC-Lite headers to the latest
    release 1.8.26
    + JDK-8244164: AArch64: jaotc generates incorrect code for
    compressed OOPs with non-zero heap base
    + JDK-8244196: adjust output in os_linux
    + JDK-8244225: stringop-overflow warning on strncpy call from
    compile_the_world_in
    + JDK-8244287: JFR: Methods samples have line number 0
    + JDK-8244703: "platform encoding not initialized" exceptions
    with debugger, JNI
    + JDK-8244719: CTW: C2 compilation fails with
    "assert(!VerifyHashTableKeys || _hash_lock == 0) failed:
    remove node from hash table before modifying it"
    + JDK-8244729: Shenandoah: remove resolve paths from
    SBSA::generate_shenandoah_lrb
    + JDK-8244763: Update --release 8 symbol information after JSR
    337 MR3
    + JDK-8244818: Java2D Queue Flusher crash while moving
    application window to external monitor
    + JDK-8245151: jarsigner should not raise duplicate warnings on
    verification
    + JDK-8245616: Bump update version for OpenJDK: jdk-11.0.9
    + JDK-8245714: "Bad graph detected in build_loop_late" when
    loads are pinned on loop limit check uncommon branch
    + JDK-8245801: StressRecompilation triggers assert "redundunt
    OSR recompilation detected. memory leak in CodeCache!"
    + JDK-8245832: JDK build make-static-libs should build all JDK
    libraries
    + JDK-8245880: Shenandoah: check class unloading flag early in
    concurrent code root scan
    + JDK-8245981: Upgrade to jQuery 3.5.1
    + JDK-8246027: Minimal fastdebug build broken after JDK-8245801
    + JDK-8246094: [macos] Sound Recording and playback is not
    working
    + JDK-8246153: TestEliminateArrayCopy fails with
  - XX:+StressReflectiveCode
    + JDK-8246193: Possible NPE in ENC-PA-REP search in AS-REQ
    + JDK-8246196: javax/management/MBeanServer/OldMBeanServerTest
    fails with AssertionError
    + JDK-8246203: Segmentation fault in verification due to stack
    overflow with -XX:+VerifyIterativeGVN
    + JDK-8246330: Add TLS Tests for Legacy ECDSA curves
    + JDK-8246453: TestClone crashes with "all collected exceptions
    must come from the same place"
    + JDK-8247246: Add explicit ResolvedJavaType.link and expose
    presence of default methods
    + JDK-8247350: [aarch64] assert(false) failed: wrong size of
    mach node
    + JDK-8247502: PhaseStringOpts crashes while optimising
    effectively dead code
    + JDK-8247615: Initialize the bytes left for the heap sampler
    + JDK-8247824: CTW: C2 (Shenandoah) compilation fails with SEGV
    in SBC2Support::pin_and_expand
    + JDK-8247874: Replacement in VersionProps.java.template not
    working when --with-vendor-bug-url contains '&amp;'
    + JDK-8247979: aarch64: missing side effect of killing flags
    for clearArray_reg_reg
    + JDK-8248214: Add paddings for TaskQueueSuper to reduce
    false-sharing cache contention
    + JDK-8248219: aarch64: missing memory barrier in
    fast_storefield and fast_accessfield
    + JDK-8248348: Regression caused by the update to BCEL 6.0
    + JDK-8248385: [testbug][11u] Adapt TestInitiExceptions to
    jtreg 5.1
    + JDK-8248495: [macos] zerovm is broken due to libffi headers
    location
    + JDK-8248851: CMS: Missing memory fences between free chunk
    check and klass read
    + JDK-8248987: AOT's Linker.java seems to eagerly fail-fast on
    Windows
    + JDK-8249159: Downport test rework for SSLSocketTemplate from
    8224650
    + JDK-8249215: JFrame::setVisible crashed with
  - Dfile.encoding=UTF-8 on Japanese Windows.
    + JDK-8249251: [dark_mode ubuntu 20.04] The selected menu is
    not highlighted in GTKLookAndFeel
    + JDK-8249255: Build fails if source code in cygwin home dir
    + JDK-8249277: TestVerifyIterativeGVN.java is failing with
    timeout in OpenJDK 11
    + JDK-8249278: Revert JDK-8226253 which breaks the spec of
    AccessibleState.SHOWING for JList
    + JDK-8249560: Shenandoah: Fix racy GC request handling
    + JDK-8249801: Shenandoah: Clear soft-refs on requested GC cycle
    + JDK-8249953: Shenandoah: gc/shenandoah/mxbeans tests should
    account for corner cases
    + JDK-8250582: Revert Principal Name type to NT-UNKNOWN when
    requesting TGS Kerberos tickets
    + JDK-8250609: C2 crash in IfNode::fold_compares
    + JDK-8250627: Use -XX:+/-UseContainerSupport for
    enabling/disabling Java container metrics
    + JDK-8250755: Better cleanup for
    jdk/test/javax/imageio/plugins/shared/CanWriteSequence.java
    + JDK-8250787: Provider.put no longer registering aliases in
    FIPS env
    + JDK-8250826: jhsdb does not work with coredump which comes
    from Substrate VM
    + JDK-8250827: Shenandoah: needs to reset/finish StringTable's
    dead count before/after parallel walk
    + JDK-8250844: Make sure {type,obj}ArrayOopDesc accessors check
    the bounds
    + JDK-8251117: Cannot check P11Key size in P11Cipher and
    P11AEADCipher
    + JDK-8251354: Shenandoah: Fix jdk/jfr/tool/TestPrintJSON.java
    test failure
    + JDK-8251451: Shenandoah: Remark ObjectSynchronizer roots with
    I-U
    + JDK-8251469: Better cleanup for
    test/jdk/javax/imageio/SetOutput.java
    + JDK-8251487: Shenandoah: missing detail timing tracking for
    final mark cleaning phase
    + JDK-8252120: compiler/oracle/TestCompileCommand.java
    misspells "occured"
    + JDK-8252157: JDK-8231209 11u backport breaks jmm binary
    compatibility
    + JDK-8252258: [11u] JDK-8242154 changes the default vendor
    + JDK-8252804: [test] Fix 'ReleaseDeflater.java' test after
    downport of 8234011
    + JDK-8253134: JMM_VERSION should remain at 0x20020000 (JDK 10)
    in JDK 11
    + JDK-8253283: [11u] Test build/translations/
    /VerifyTranslations.java failing after JDK-8252258
    + JDK-8253813: Backout JDK-8244287 from 11u: it causes several
    crashes
- Removed patch:
  * gcc-fno-common-fix.patch
    + not needed any more with this version
- Added patch:
  * JDK-8250861.patch
    + Fix regression "8250861: Crash in MinINode::Ideal(PhaseGVN*,
    bool)" introduced in jdk 11.0.9</changelog>
  <changelog author="fstrba@suse.com" date="1604491200">- Enable Sheandoah GC for x86_64 (jsc#ECO-3171)</changelog>
  <changelog author="fstrba@suse.com" date="1605528000">- Update to upstream tag jdk-11.0.9.1-1
  * Fix:
    + JDK-8250861: Crash in MinINode::Ideal(PhaseGVN*, bool)
- Removed patch:
  * JDK-8250861.patch
    + Integrated upstream</changelog>
  <changelog author="fstrba@suse.com" date="1611230400">- Update to upstream tag jdk-11.0.10+9 (January 2021 CPU,
  bsc#1181239)
  * Security fixes
    + JDK-8247619: Improve Direct Buffering of Characters
  * Other changes
    + JDK-6722928: Support SSPI as a native GSS-API provider
    + JDK-7185258: [macosx] Deadlock in SunToolKit.realSync()
    + JDK-8152332: [macosx] JFileChooser cannot be serialized on
    Mac OS X
    + JDK-8161684: [testconf] Add VerifyOops' testing into compiler
    tiers
    + JDK-8171279: Support X25519 and X448 in TLS
    + JDK-8173361: various crashes in
    JvmtiExport::post_compiled_method_load
    + JDK-8173658: JvmtiExport::post_class_unload() is broken for
    non-JavaThread initiators
    + JDK-8191006: hsdis disassembler plugin does not compile with
    binutils 2.29+
    + JDK-8197981: Missing return statement in
    __sync_val_compare_and_swap_8
    + JDK-8198334: java/awt/FileDialog/8003399/bug8003399.java
    fails in headless mode
    + JDK-8200151: Add 8 JNDI tests to com/sun/jndi/dns/ConfigTests/
    + JDK-8208279: Add 8 JNDI tests to com/sun/jndi/dns/EnvTests/
    + JDK-8208483: Add 5 JNDI tests to
    com/sun/jndi/dns/FactoryTests/
    + JDK-8208542: Add 4 JNDI tests to com/sun/jndi/dns/ListTests/
    + JDK-8208665: Amend cross-compilation docs with
    qemu-debootstrap recipe
    + JDK-8210088: ProblemList gc/epsilon/TestMemoryMXBeans.java
    + JDK-8210339: Add 10 JNDI tests to com/sun/jndi/dns/FedTests/
    + JDK-8211450: UndetVar::dup is not copying the kind field to
    the duplicated instance
    + JDK-8212160: JVMTI agent crashes with "assert(_value != 0LL)
    failed: resolving NULL _value"
    + JDK-8212226: SurfaceManager throws "Invalid Image variant"
    for MultiResolutionImage (Windows)
    + JDK-8213400: Support choosing group name in keytool keypair
    generation
    + JDK-8213535: Windows HiDPI html lightweight tooltips are
    truncated
    + JDK-8213698: Improve devkit creation and add support for
    linux/ppc64/ppc64le/s390x
    + JDK-8214025: assert(t-&gt;singleton()) failed: must be a
    constant when ScavengeRootsInCode &lt; 2
    + JDK-8214242: compiler/arguments/TestScavengeRootsInCode.java
    fails because of missing UnlockDiagnosticVMOptions
    + JDK-8214787: Zero builds fail with "undefined
    JavaThread::thread_state()"
    + JDK-8215583: Exclude
    runtime/handshake/HandshakeWalkSuspendExitTest.java
    + JDK-8216012: Infinite loop in RSA KeyPairGenerator
    + JDK-8216324: GetClassMethods is confused by the presence of
    default methods in super interfaces
    + JDK-8217429: WebSocket over authenticating proxy fails to
    send Upgrade headers
    + JDK-8217976: test/jdk/java/net/httpclient/websocket/
    /WebSocketProxyTest.java fails intermittently
    + JDK-8218021: Have jarsigner preserve posix permission
    attributes
    + JDK-8218287: jshell tool: input behavior unstable after
    12-ea+24 on Windows
    + JDK-8218851: JVM crash in custom classloader stress test, JDK
    12 &amp; 13
    + JDK-8220420: Cleanup c1_LinearScan
    + JDK-8222072: JVMTI GenerateEvents() sends CompiledMethodLoad
    events to wrong jvmtiEnv
    + JDK-8222286: Fix for JDK-8213419 is broken on s390
    + JDK-8222527: HttpClient doesn't send HOST header when
    tunelling HTTP/1.1 through http proxy
    + JDK-8222533: jtreg test jdk/internal/platform/cgroup/
    /TestCgroupMetrics.java fails on SLES12.3 linux ppc64le
    machine
    + JDK-8224506: [TESTBUG] TestDockerMemoryMetrics.java fails
    with exitValue = 137
    + JDK-8224555: vmTestbase/nsk/jvmti/scenarios/contention/TC02/
    /tc02t001/TestDescription.java failed
    + JDK-8224650: Add tests to support X25519 and X448 in TLS
    + JDK-8225072: Add LuxTrust certificate that is expiring in
    March 2021 to list of allowed but expired certs
    + JDK-8225329: -XX:+PrintBiasedLockingStatistics causes crash
    during initialization on Windows platforms
    + JDK-8225687: Newly added sspi.cpp in JDK-6722928 still
    contains some small errors
    + JDK-8227006: [linux] Runtime.availableProcessors execution
    time increased by factor of 100
    + JDK-8227275: Within native OOM error handling, assertions may
    hang the process
    + JDK-8227647: [Graal] Test8009761.java fails due to
    "RuntimeException: static java.lang.Object
    compiler.uncommontrap.Test8009761.m3(boolean,boolean) not
    compiled"
    + JDK-8229495: SIGILL in C2 generated OSR compilation
    + JDK-8230910: libsspi_bridge does not build on Windows 32bit
    + JDK-8232114: JVM crashed at imjpapi.dll in native code
    + JDK-8234147: Avoid looking up standard charsets in core
    libraries
    + JDK-8234393: [macos] printing ignores printer tray
    + JDK-8234863: Increase default value of MaxInlineLevel
    + JDK-8235218: Minimal VM is broken after JDK-8173361
    + JDK-8235456: Minimal VM is broken after JDK-8212160
    + JDK-8235829: graal crashes with Zombie.java test
    + JDK-8236124: Minimal VM slowdebug build failed after
    JDK-8212160
    + JDK-8236512: PKCS11 Connection closed after Cipher.doFinal
    and NoPadding
    + JDK-8236944: The legVecZ operand should be limited to
    zmm0-zmm15 registers
    + JDK-8237186: Fix typo in copyright header of
    java/io/Reader/TransferTo.java
    + JDK-8237499: JFR: Include stack trace in the ThreadStart event
    + JDK-8237512: AArch64: aarch64TestHook leaks a BufferBlob
    + JDK-8237524: AArch64: String.compareTo() may return incorrect
    result
    + JDK-8237950: C2 compilation fails with "Live Node limit
    exceeded limit" during ConvI2L::Ideal optimization
    + JDK-8238579: HttpsURLConnection drops the timeout and hangs
    forever in read
    + JDK-8239105: Add exception for expiring Digicert root
    certificates to VerifyCACerts test
    + JDK-8239477: jdk/jfr/jcmd/TestJcmdStartStopDefault.java fails
  - XX:+VerifyOops with "verify_oop: rsi: broken oop"
    + JDK-8239497: SEGV in EdgeUtils::field_name_symbol(Edge const&amp;)
    + JDK-8239886: Minimal VM build fails after JDK-8237499
    + JDK-8240633: Memory leaks in the implementations of
    FileChooserUI
    + JDK-8240690: Race condition between EDT and
    BasicDirectoryModel.FilesLoader.run0()
    + JDK-8241234: Unify monitor enter/exit runtime entries.
    + JDK-8241311: Move some charset mapping tests from closed to
    open
    + JDK-8241797: Add some tests to the problem list
    + JDK-8242029: AArch64: skip G1 array copy pre-barrier if
    marking not active
    + JDK-8242335: Additional Tests for RSASSA-PSS
    + JDK-8242480: Negative value may be returned by
    getFreeSwapSpaceSize() in the docker
    + JDK-8242614: cleanup duplicated test ldap server in some
    com/sun/jndi/ldap/ tests
    + JDK-8242846: Bring back test/jdk/tools/jlink/plugins/
    /OrderResourcesPluginTest.java
    + JDK-8243114: Implement montgomery{Multiply,Square}intrinsics
    on Windows
    + JDK-8243290: Improve diagnostic messages for class
    verification and redefinition failures
    + JDK-8243488: Add tests for set/get SendBufferSize and
    getReceiveBufferSize in DatagramSocket
    + JDK-8243549: sun/security/ssl/CipherSuite/
    /NamedGroupsWithCipherSuite.java failed with Unsupported
    signature algorithm: DSA
    + JDK-8243617: compiler/onSpinWait/TestOnSpinWaitC1.java test
    uses wrong class
    + JDK-8243619: compiler/codecache/CheckSegmentedCodeCache.java
    test misses -version
    + JDK-8244142: some hotspot/runtime tests don't check exit code
    of forked JVM
    + JDK-8244278: Excessive code cache flushes and sweeps
    + JDK-8244282: test/hotspot/jtreg/compiler/intrinsics/
    /Test8237524.java fails with --illegal-access=deny
    + JDK-8244621: [macos10.15] Garbled FX printing plus CoreText
    warnings on Catalina when building with Xcode 11
    + JDK-8244819: hsdis does not compile with binutils 2.34+
    + JDK-8245051: c1 is broken if it is compiled by gcc without
  - fno-lifetime-dse
    + JDK-8245168: jlink should not be treated as a "small" tool
    + JDK-8245400: Upgrade to LittleCMS 2.11
    + JDK-8246381: VM crashes with "Current BasicObjectLock* below
    than low_mark"
    + JDK-8246434: Threads::print_on_error assumes that the heap
    has been set up
    + JDK-8246648: issue with OperatingSystemImpl
    getFreeSwapSpaceSize in docker after 8242480
    + JDK-8247201: Print potential pointer value of readable stack
    memory in hs_err file
    + JDK-8247763: assert(outer-&gt;outcnt() == 2) failed: 'only phis'
    failure in LoopNode::verify_strip_mined()
    + JDK-8247867: Upgrade to freetype 2.10.2
    + JDK-8248190: Enable Power10 system and implement new
    byte-reverse instructions
    + JDK-8248226: TestCloneAccessStressGCM fails with
  - XX:-ReduceBulkZeroing
    + JDK-8248347: windows build broken by JDK-8243114
    + JDK-8248532: Every time I change keyboard language at my
    MacBook, Java crashes
    + JDK-8248552: C2 crashes with SIGFPE due to division by zero
    + JDK-8248596: [TESTBUG] compiler/loopopts/
    /PartialPeelingUnswitch.java times out with Graal enabled
    + JDK-8248745: Add jarsigner and keytool tests for restricted
    algorithms
    + JDK-8248791: sun/util/resources/cldr/TimeZoneNamesTest.java
    fails with -XX:-ReduceInitialCardMarks -XX:-ReduceBulkZeroing
    + JDK-8248845: AArch64: stack corruption after spilling vector
    register
    + JDK-8249176: Update GlobalSignR6CA test certificates
    + JDK-8249183: JVM crash in "AwtFrame::WmSize" method
    + JDK-8249192: MonitorInfo stores raw oops across safepoints
    + JDK-8249602: C2: assert(cnt == _outcnt) failed: no insertions
    allowed
    + JDK-8249603: C1: assert(has_error == false) failed: register
    allocation invalid
    + JDK-8249605: C2: assert(no_dead_loop) failed: dead loop
    detected
    + JDK-8249607: C2: assert(!had_error) failed: bad dominance
    + JDK-8249608: Vector register used by C2 compiled method
    corrupted at safepoint
    + JDK-8249672: Include microcode revision in features_string on
    x86
    + JDK-8249748: gtest silently ignores bad jvm arguments
    + JDK-8249821: Separate libharfbuzz from libfontmanager
    + JDK-8250598: Hyper-V is detected in spite of running on host
    OS
    + JDK-8250605: Linux x86_32 builds fail after JDK-8249821
    + JDK-8250636: iso8601_time returns incorrect offset part on
    MacOS
    + JDK-8250665: Wrong translation for the month name of May in
    ar_JO,LB,SY
    + JDK-8250772: Test com/sun/jndi/ldap/
    /NamingExceptionMessageTest.java fails intermittently with
    javax.naming.ServiceUnavailableException
    + JDK-8250825: C2 crashes with assert(field != __null) failed:
    missing field
    + JDK-8250894: Provide a configure option to build and run
    against the platform libharfbuzz
    + JDK-8250928: JFR: Improve hash algorithm for stack traces
    + JDK-8250968: Symlinks attributes not preserved when using
    jarsigner on zip files
    + JDK-8250984: Memory Docker tests fail on some Linux kernels
    w/o cgroupv1 swap limit capabilities
    + JDK-8251118: BiasedLocking::preserve_marks should not have a
    HandleMark
    + JDK-8251189: com/sun/jndi/ldap/LdapDnsProviderTest.java
    failed due to timeout
    + JDK-8251257: NMT: jcmd VM.native_memory scale=1 crashes
    target VM
    + JDK-8251365: Build failure on AIX after 8250636
    + JDK-8251397: NPE on ClassValue.ClassValueMap.cacheArray
    + JDK-8251456: [TESTBUG] compiler/vectorization/
    /TestVectorsNotSavedAtSafepoint.java failed OutOfMemoryError
    + JDK-8251458: Parse::do_lookupswitch fails with "assert(_cnt
    &gt;= 0) failed"
    + JDK-8251535: Partial peeling at unsigned test adds incorrect
    loop exit check
    + JDK-8251949: ZGC: Set explicit heap size for
    compiler/gcbarriers tests
    + JDK-8252090: JFR: StreamWriterHost::write_unbuffered() stucks
    in an infinite loop OpenJDK (build 13.0.1+9)
    + JDK-8252415: Bump update version for OpenJDK: jdk-11.0.10
    + JDK-8252470: java/awt/dnd/DisposeFrameOnDragCrash/
    /DisposeFrameOnDragTest.java fails on Windows
    + JDK-8252497: Incorrect numeric currency code for ROL
    + JDK-8252660: Shenandoah: support manageable SoftMaxHeapSize
    option
    + JDK-8252679: Two windows specific FileDIalog tests may fail
    on some Windows_Server_2016_Standard
    + JDK-8252696: Loop unswitching may cause out of bound array
    load to be executed
    + JDK-8252754: Hash code calculation of JfrStackTrace is
    inconsistent
    + JDK-8253219: Epsilon: clean up unnecessary includes
    + JDK-8253224: Shenandoah: ShenandoahStrDedupQueue destructor
    calls virtual num_queues()
    + JDK-8253226: Shenandoah: remove unimplemented
    ShenandoahStrDedupQueue::verify
    + JDK-8253269: The CheckCommonColors test should provide more
    info on failure
    + JDK-8253284: Zero OrderAccess barrier mappings are incorrect
    + JDK-8253375: OSX build fails with Xcode 12.0 (12A7209)
    + JDK-8253778: ShenandoahSafepoint::is_at_shenandoah_safepoint
    should not access VMThread state from other threads
    + JDK-8253791: Issue with useAppleColor check in CSystemColors.m
    + JDK-8254016: Test8237524 fails with -XX:-CompactStrings option
    + JDK-8254081: java/security/cert/PolicyNode/
    /GetPolicyQualifiers.java fails due to an expired certificate
    + JDK-8254144: Non-x86 Zero builds fail with return-type
    warning in os_linux_zero.cpp
    + JDK-8254166: Zero: return-type warning in
    zeroInterpreter_zero.cpp
    + JDK-8254177: (tz) Upgrade time-zone data to tzdata2020b
    + JDK-8254185: Fix Code cache sweeper heuristics for JDK 11
    + JDK-8254190: [s390] interpreter misses exception check after
    calling monitorenter
    + JDK-8254790: SIGSEGV in string_indexof_char and
    stringL_indexof_char intrinsics
    + JDK-8254854: [cgroups v1] Metric limits not properly detected
    on some join controller combinations
    + JDK-8254982: (tz) Upgrade time-zone data to tzdata2020c
    + JDK-8255050: Add pkcs11/KeyStore/ClientAuth.sh to Problem list
    + JDK-8255065: Zero: accessor_entry misses the IRIW case
    + JDK-8255226: (tz) Upgrade time-zone data to tzdata2020d
    + JDK-8255269: Unsigned overflow in g1Policy.cpp
    + JDK-8255365: Problem list failing client manual tests
    + JDK-8255457: Shenandoah: cleanup ShenandoahMarkTask
    + JDK-8255466: C2 crashes at ciObject::get_oop() const+0x0
    + JDK-8255550: x86: Assembler::cmpq(Address dst, Register src)
    encoding is incorrect
    + JDK-8255603: Memory/Performance regression after JDK-8210985
    + JDK-8255760: Shenandoah: match constants style in
    ShenandoahMarkTask fallback
    + JDK-8255781: Bump patch update version for OpenJDK:
    jdk-11.0.9.1
    + JDK-8255937: Better cleanup for
    test/jdk/javax/imageio/stream/StreamFlush.java
    + JDK-8256427: Test com/sun/jndi/dns/ConfigTests/
    /PortUnreachable.java does not work on AIX
    + JDK-8256452: Integrate missing part of JDK-8232370 to 11u
    + JDK-8256483: [TESTBUG] serviceability/jvmti/GetClassMethods/
    /libOverpassMethods.c fails to compile on gcc 4.4.x
    + JDK-8256557: libharfbuzz fails to link on gcc 4.4.x due to
  - Wl,-z,defs
    + JDK-8256618: Zero: Linux x86_32 build still fails
    + JDK-8256736: Zero: GTest tests fail with "unsuppported vm
    variant"
    + JDK-8256809: Annotation processing causes NPE during flow
    analysis
    + JDK-8257181: s390x builds are very noisy with gc-sections
    messages
    + JDK-8257242: [macOS] Java app crashes while switching input
    methods
    + JDK-8257545: SunJSSE FIPS regression in key exchange after
    JDK-8171279 11u backport
    + JDK-8257641: Shenandoah: Query is_at_shenandoah_safepoint()
    from control thread should return false
    + JDK-8257701: Shenandoah: objArrayKlass metadata is not marked
    with chunked arrays
    + JDK-8258630: Add expiry exception for QuoVadis root
    certificate
- New upstream dependency on libharfbuzz
- Regenerated patches: missing-return.patch system-pcsclite.patch</changelog>
  <changelog author="fstrba@suse.com" date="1616155200">- Added patches:
  * system-crypto-policy.patch
    + Let OpenJDK use system crypto policies unless explicitely told
    not to
  * nss-security-provider.patch
    + Add the NSS security provider with configuration in generated
    nss.cfg file
  * keytool-default-rsa.patch
    + Make keytool generate RSA keys by default, since only the
    LEGACY system crypto policy allows DSA</changelog>
  <changelog author="pujos.michael@gmail.com" date="1618488000">- moved mozilla-nss dependency to java-11-openjdk-headless package
  This is necessary to be able to do crypto with just
  java-11-openjdk-headless installed. Fixes boo#1184606</changelog>
  <changelog author="fstrba@suse.com" date="1619006400">- Update to upstream tag jdk-11.0.11+9 (April 2021, CPU)
  * Security fixes
    + JDK-8244473: Contextualize registration for JNDI
    + JDK-8244543: Enhanced handling of abstract classes
    + JDK-8249906, CVE-2021-2163, bsc#1185055: Enhance opening JARs
    + JDK-8250568, CVE-2021-2161, bsc#1185056: Less ambiguous
    processing
    + JDK-8253799: Make lists of normal filenames
    + JDK-8257001: Improve Http Client Support
  * Other changes
    + JDK-7107012: sun.jvm.hotspot.code.CompressedReadStream
    readDouble() conversion to long mishandled
    + JDK-7146776: deadlock between URLStreamHandler.getHostAddress
    and file.Handler.openconnection
    + JDK-8086003: Test fails on OSX with java.lang.RuntimeException
    'Narrow klass base: 0x0000000000000000, Narrow klass shift: 3'
    missing
    + JDK-8168869: jdeps: localized messages don't use proper line
    breaks
    + JDK-8180837: SunPKCS11-NSS tests failing with
    CKR_ATTRIBUTE_READ_ONLY and CKR_MECHANISM_PARAM_INVALID
    + JDK-8202343: Disable TLS 1.0 and 1.1
    + JDK-8205992: jhsdb cannot attach to Java processes running in
    Docker containers
    + JDK-8209193: Fix aarch64-linux compilation after -Wreorder
    changes
    + JDK-8210413: AArch64: Optimize div/rem by constant in C1
    + JDK-8210578: AArch64: Invalid encoding for fmlsvs instruction
    + JDK-8211051: jdeps usage of --dot-output doesn't provide
    valid output for modular jar
    + JDK-8211057: Gensrc step CompileProperties generates unstable
    CompilerProperties output
    + JDK-8211150: G1 Full GC not purging code root memory and
    hence causing memory leak
    + JDK-8211825: ModuleLayer.defineModulesWithXXX does not setup
    delegation when module reads automatic module
    + JDK-8212043: Add floating-point Math.min/max intrinsics
    + JDK-8212218: [TESTBUG] runtime/ErrorHandling/
    /TestHeapDumpOnOutOfMemoryErrorInMetaspace.java timed out
    + JDK-8213116: javax/swing/JComboBox/WindowsComboBoxSize/
    /WindowsComboBoxSizeTest.java fails in Windows
    + JDK-8213909: jdeps --print-module-deps should report missing
    dependences
    + JDK-8214180: Need better granularity for sleeping
    + JDK-8214223: tools/jdeps/listdeps/ListModuleDeps.java failed
    due to missing Lib2 file
    + JDK-8214230: Classes generated by SystemModulesPlugin.java
    are not reproducable
    + JDK-8214741: docs/index.html has no title or copyright
    + JDK-8215687: [Graal] unit test CheckGraalIntrinsics failed
    after 8212043
    + JDK-8217848: [Graal] vmTestbase/nsk/jvmti/ResourceExhausted/
    /resexhausted003/TestDescription.java fails
    + JDK-8218482: sun/security/krb5/auto/ReplayCachePrecise.java
    failed - no KrbException thrown
    + JDK-8218550: Add test omitted from JDK-8212043
    + JDK-8221584: SIGSEGV in os::PlatformEvent::unpark() in
    JvmtiRawMonitor::raw_exit while posting method exit event
    + JDK-8221995: AARCH64: problems with CAS instructions encoding
    + JDK-8222518: Remove unnecessary caching of Parker object in
    java.lang.Thread
    + JDK-8222785: aarch64: add necessary masking for immediate
    shift counts
    + JDK-8223186: HotSpot compile warnings from GCC 9
    + JDK-8225773: jdeps --check produces NPE if there are missing
    module dependences
    + JDK-8225805: Java Access Bridge does not close the logger
    + JDK-8226810: Failed to launch JVM because of
    NullPointerException occured on System.props
    + JDK-8229396: jdeps ignores multi-release when
    generate-module-info used on command line
    + JDK-8229474: Shenandoah: Cleanup CM::update_roots()
    + JDK-8232225: Rework the fix for JDK-8071483
    + JDK-8232905: JFR fails with assertion:
    assert(t-&gt;unflushed_size() == 0) failed: invariant
    + JDK-8233164: C2 fails with assert(phase-&gt;C-&gt;get_alias_index(t)
    == phase-&gt;C-&gt;get_alias_index(t_adr)) failed: correct memory
    chain
    + JDK-8233910: java/awt/ColorClass/AlphaColorTest.java is
    failing  intermittently in nightly lnux-x64 system
    + JDK-8233912: aarch64: minor improvements of atomic operations
    + JDK-8234508: VM_HeapWalkOperation::iterate_over_object reads
    non-strong fields with an on-strong load barrier
    + JDK-8234742: Improve handshake logging
    + JDK-8234796: Refactor Handshake::execute to take a more
    complex type than ThreadClosure
    + JDK-8235324: Dying objects are published from users of
    CollectedHeap::object_iterate
    + JDK-8235351: Lookup::unreflect should bind with the original
    caller independent of Method's accessible flag
    + JDK-8237369: Shenandoah: failed vmTestbase/nsk/jvmti/
    /AttachOnDemand/attach021/TestDescription.java test
    + JDK-8237392: Shenandoah: Remove unreliable assertion
    + JDK-8237483: AArch64 C1 OopMap inserted twice fatal error
    + JDK-8237495: Java MIDI fails with a dereferenced memory error
    when asked to send a raw 0xF7
    + JDK-8239355: (dc) Initial value of SO_SNDBUF should allow
    sending large datagrams (macOS)
    + JDK-8240353: AArch64: missing support for
  - XX:+ExtendedDTraceProbes in C1
    + JDK-8240704: CheckHandles.java failed "AssertionError: Handle
    use increased by more than 10 percent."
    + JDK-8240751: Shenandoah: fold ShenandoahTracer definition
    + JDK-8240795: [REDO] 8238384 CTW: C2 compilation fails with
    "assert(store != load-&gt;find_exact_control(load-&gt;in(0)))
    failed: dependence cycle found"
    + JDK-8241598: Upgrade JLine to 3.14.0
    + JDK-8241649: Optimize Character.toString
    + JDK-8241770: Module xxxAnnotation() methods throw NCDFE if
    module-info.class found as resource in unnamed module
    + JDK-8241911: AArch64: Fix a potential register clash issue in
    reduce_add2I
    + JDK-8242030: Wrong package declarations in jline classes after
    JDK-8241598
    + JDK-8242565: Policy initialization issues when the denyAfter
    constraint is enabled
    + JDK-8243618: compiler/rtm/cli tests can be run w/o WhiteBox
    + JDK-8243670: Unexpected test result caused by C2
    MergeMemNode::Ideal
    + JDK-8244088: [Regression] Switch of Gnome theme ends up in
    deadlocked UI
    + JDK-8244154: Update SunPKCS11 provider with PKCS11 v3.0 header
    files
    + JDK-8244340: Handshake processing thread lacks yielding
    + JDK-8244573: java.lang.ArrayIndexOutOfBoundsException thrown
    for malformed class file
    + JDK-8244683: A TSA server used by tests
    + JDK-8245005: javax/net/ssl/compatibility/BasicConnectTest.java
    failed with No enum constant
    + JDK-8245026: PsAdaptiveSizePolicy::_old_gen_policy_is_ready is
    unused
    + JDK-8245283: JFR: Can't handle constant dynamic used by Jacoco
    agent
    + JDK-8245512: CRC32 optimization using AVX512 instructions
    + JDK-8245527: LDAP Channel Binding support for Java
    GSS/Kerberos
    + JDK-8246707: (sc) SocketChannel.read/write throws
    AsynchronousCloseException on closed channel
    + JDK-8246709: sun/security/tools/jarsigner/
    /TsacertOptionTest.java compilation failed after JDK-8244683
    + JDK-8247200: assert((unsigned)fpargs &lt; 32)
    + JDK-8247766: [aarch64] guarantee(val &lt; (1U &lt;&lt; nbits))
    failed: Field too big for insn.
    + JDK-8248336: AArch64: C2: offset overflow in
    BoxLockNode::emit
    + JDK-8248865: Document JNDI/LDAP timeout properties
    + JDK-8248901: Signed immediate support in
    .../share/assembler.hpp is broken.
    + JDK-8249543: Force DirectBufferAllocTest to run with
  - ExplicitGCInvokesConcurrent
    + JDK-8249588: libwindowsaccessbridge issues on 64bit Windows
    + JDK-8249749: modify a primitive array through a stream and a
    for cycle causes jre crash
    + JDK-8249787: Make TestGCLocker more resilient with concurrent
    GCs
    + JDK-8249867: xml declaration is not followed by a newline
    + JDK-8250911: [windows] os::pd_map_memory() error detection
    broken
    + JDK-8251255: [linux] Add process-memory information to hs-err
    and VM.info
    + JDK-8251359: Shenandoah: filter null oops before calling
    enqueue/SATB barrier
    + JDK-8251925: C2: RenaissanceStressTest fails with
    assert(!had_error): bad dominance
    + JDK-8251944: Add Shenandoah test config to
    compiler/gcbarriers/UnsafeIntrinsicsTest.java
    + JDK-8251992: VM crashed running TestComplexAddrExpr.java test
    with -XX:UseAVX=X
    + JDK-8253220: Epsilon: clean up unused code/declarations
    + JDK-8253274: The CycleDMImagetest brokes the system
    + JDK-8253353: Crash in C2: guarantee(n != NULL) failed: No Node
    + JDK-8253368: TLS connection always receives close_notify
    exception
    + JDK-8253404: C2: assert(C-&gt;live_nodes() &lt;=
    C-&gt;max_node_limit()) failed: Live Node limit exceeded limit
    + JDK-8253409: Double-rounding possibility in float fma
    + JDK-8253476: TestUseContainerSupport.java fails on some Linux
    kernels w/o swap limit capabilities
    + JDK-8253524: C2: Refactor code that clones predicates during
    loop unswitching
    + JDK-8253644: C2: assert(skeleton_predicate_has_opaque(iff))
    failed: unexpected
    + JDK-8253681: closed java/awt/dnd/MouseEventAfterStartDragTest/
    /MouseEventAfterStartDragTest.html test failed
    + JDK-8253702: BigSur version number reported as 10.16, should
    be 11.nn
    + JDK-8253756: C2 CompilerThread0 crash in Node::add_req(Node*)
    + JDK-8254104: MethodCounters must exist before nmethod is
    installed
    + JDK-8254734: "dead loop detected" assert failure with patch
    from 8223051
    + JDK-8254748: Bad Copyright header format after JDK-8212218
    + JDK-8254799: runtime/ErrorHandling/
    /TestHeapDumpOnOutOfMemoryError.java fails with release VMs
    + JDK-8255058: C1: assert(is_virtual()) failed: type check
    + JDK-8255351: Add detection for Graviton 2 CPUs
    + JDK-8255368: Math.exp() gives wrong result for large values on
    x86 32-bit platforms
    + JDK-8255387: Japanese characters were printed upside down on
    AIX
    + JDK-8255401: Shenandoah: Allow oldval and newval registers to
    overlap in cmpxchg_oop()
    + JDK-8255479: [aarch64] assert(src-&gt;section_index_of(target) ==
    CodeBuffer::SECT_NONE) failed: sanity
    + JDK-8255544: Create a checked cast
    + JDK-8255559: Leak File Descriptors Because of
    ResolverLocalFilesystem#engineResolveURI()
    + JDK-8255681: print callstack in error case in
    runAWTLoopWithApp
    + JDK-8255734: VM should ignore SIGXFSZ on ppc64, s390 too
    + JDK-8255742: PrintInlining as compiler directive doesn't print
    virtual calls
    + JDK-8255845: Memory leak in imageFile.cpp
    + JDK-8255880: UI of Swing components is not redrawn after their
    internal state changed
    + JDK-8255908: ExceptionInInitializerError due to
    UncheckedIOException while initializing cgroupv1 subsystem
    + JDK-8256025: AArch64: MachCallRuntimeNode::ret_addr_offset()
    is incorrect for stub calls
    + JDK-8256056: Deoptimization stub doesn't save vector registers
    on x86
    + JDK-8256061: RegisterSaver::save_live_registers() omits upper
    halves of ZMM0-15 registers
    + JDK-8256187: [TEST_BUG] Automate bug4275046.java test
    + JDK-8256220: C1: x86_32 fails with -XX:UseSSE=1 after
    JDK-8210764 due to mishandled lir_neg
    + JDK-8256258: some missing NULL checks or asserts after
    CodeCache::find_blob_unsafe
    + JDK-8256264: Printed GlyphVector outline with low DPI has bad
    quality on Windows
    + JDK-8256290: javac/lambda/T8031967.java fails with
    StackOverflowError on x86_32
    + JDK-8256359: AArch64: runtime/ReservedStack/
    /ReservedStackTestCompiler.java fails
    + JDK-8256387: Unexpected result if patching an entire
    instruction on AArch64
    + JDK-8256421: Add 2 HARICA roots to cacerts truststore
    + JDK-8256488: [aarch64] Use ldpq/stpq instead of ld4/st4 for
    small copies in StubGenerator::copy_memory
    + JDK-8256489: Make gtest for long path names on Windows more
    resilient in the presence of virus scanners
    + JDK-8256501: libTestMainKeyWindow fails to build with Xcode
    12.2
    + JDK-8256633: Fix product build on Windows+Arm64
    + JDK-8256682: JDK-8202343 is incomplete
    + JDK-8256751: Incremental rebuild with precompiled header fails
    when touching a header file
    + JDK-8256757: Incorrect MachCallRuntimeNode::ret_addr_offset()
    for CallLeafNoFP on x86_32
    + JDK-8256806: Shenandoah: optimize shenandoah/jni/
    /TestPinnedGarbage.java test
    + JDK-8256807: C2: Not marking stores correctly as mismatched
    in string opts
    + JDK-8256810: Incremental rebuild broken on Macosx
    + JDK-8256818: SSLSocket that is never bound or connected leaks
    socket resources
    + JDK-8256888: Client manual test problem list update
    + JDK-8257083: Security infra test failures caused by
    JDK-8202343
    + JDK-8257408: Bump update version for OpenJDK: jdk-11.0.11
    + JDK-8257423: [PPC64] Support -XX:-UseInlineCaches
    + JDK-8257436: [aarch64] Regressions in ArrayCopyUnalignedDst
    .testByte/testChar for 65-78 bytes when UseSIMDForMemoryOps
    is on
    + JDK-8257513: C2: assert((constant_addr -
    _masm.code()-&gt;consts()-&gt;start()) == con.offset())
    + JDK-8257547: Handle multiple prereqs on the same line in deps
    files
    + JDK-8257561: Some code is not vectorized after 8251925 and
    8250607
    + JDK-8257565: epsilonBarrierSet.hpp should not include
    barrierSetAssembler
    + JDK-8257575: C2: "failed: only phis" assert failure in loop
    strip mining verification
    + JDK-8257594: C2 compiled checkcast of non-null object triggers
    endless deoptimization/recompilation cycle
    + JDK-8257633: Missing -mmacosx-version-min=X flag when linking
    libjvm
    + JDK-8257670: sun/security/ssl/SSLSocketImpl/SSLSocketLeak.java
    reports leaks
    + JDK-8257707: Fix incorrect format string in Http1HeaderParser
    + JDK-8257746: Regression introduced with JDK-8250984 - memory
    might be null in some machines
    + JDK-8257798: [PPC64] undefined reference to
    Klass::vtable_start_offset()
    + JDK-8257884: Re-enable sun/security/ssl/SSLSocketImpl/
    /SSLSocketLeak.java as automatic test
    + JDK-8257910: [JVMCI] Set exception_seen accordingly in the
    runtime.
    + JDK-8257997: sun/security/ssl/SSLSocketImpl/SSLSocketLeak.java
    again reports leaks after JDK-8257884
    + JDK-8257999: Parallel GC crash in gc/parallel/
    /TestDynShrinkHeap.java: new region is not in covered_region
    + JDK-8258077: Using -Xcheck:jni can lead to a double-free after
    JDK-8193234
    + JDK-8258247: Couple of issues in fix for JDK-8249906
    + JDK-8258373: Update the text handling in the JPasswordField
    + JDK-8258396: SIGILL in jdk.jfr.internal.PlatformRecorder
    .rotateDisk()
    + JDK-8258419: RSA cipher buffer cleanup
    + JDK-8258471: "search codecache" clhsdb command does not work
    + JDK-8258534: Epsilon: clean up unused includes
    + JDK-8258805: Japanese characters not entered by mouse click
    on Windows 10
    + JDK-8258833: Cancel multi-part cipher operations in SunPKCS11
    after failures
    + JDK-8258836: JNI local refs exceed capacity
    getDiagnosticCommandInfo
    + JDK-8258884: [TEST_BUG] Convert applet-based test
    open/test/jdk/javax/swing/JMenuItem/8031573/bug8031573.java
    to a regular java test
    + JDK-8259007: This test printed a blank page
    + JDK-8259048: (tz) Upgrade time-zone data to tzdata2020f
    + JDK-8259049: Uninitialized variable after JDK-8257513
    + JDK-8259231: Epsilon: improve performance under contention
    during virtual space expansion
    + JDK-8259271: gc/parallel/TestDynShrinkHeap.java still fails
    "assert(covered_region.contains(new_memregion)) failed: new
    region is not in covered_region"
    + JDK-8259312: VerifyCACerts.java fails as soneraclass2ca cert
    will expire in 90 days
    + JDK-8259319: Illegal package access when SunPKCS11 requires
    SunJCE's classes
    + JDK-8259339: AllocateUninitializedArray C2 intrinsic fails
    with void.class input
    + JDK-8259428: AlgorithmId.getEncodedParams() should return copy
    + JDK-8259446: runtime/jni/checked/
    /TestCheckedReleaseArrayElements.java fails with stderr not
    empty
    + JDK-8259451: Zero: skip serviceability/sa tests, set vm.hasSA
    to false
    + JDK-8259580: Shenandoah: uninitialized label in
    VerifyThreadGCState
    + JDK-8259619: C1: 3-arg StubAssembler::call_RT stack-use
    condition is incorrect
    + JDK-8259633: compiler/graalunit/CoreTest.java fails with NPE
    after JDK-8244543
    + JDK-8259706: C2 compilation fails with assert(vtable_index ==
    Method::invalid_vtable_index) failed: correct sentinel value
    + JDK-8259707: LDAP channel binding does not work with StartTLS
    extension
    + JDK-8259773: Incorrect encoding of AVX-512 kmovq instruction
    + JDK-8259849: Shenandoah: Rename store-val to IU-barrier
    + JDK-8259949: x86 32-bit build fails when -fcf-protection is
    passed in the compiler flags
    + JDK-8259954: gc/shenandoah/mxbeans tests fail with -Xcomp
    + JDK-8260029: aarch64: fix typo in verify_oop_array
    + JDK-8260308: Update LogCompilation junit to 4.13.1
    + JDK-8260338: Some fields in HaltNode is not cloned
    + JDK-8260349: Cannot programmatically retrieve Metaspace max
    set via JAVA_TOOL_OPTIONS
    + JDK-8260356: (tz) Upgrade time-zone data to tzdata2021a
    + JDK-8260378: [TESTBUG] DcmdMBeanTestCheckJni.java reports
    false positive
    + JDK-8260497: Shenandoah: Improve SATB flushing
    + JDK-8260502: [s390] NativeMovRegMem::verify() fails because
    it's too strict
    + JDK-8260632: Build failures after JDK-8253353
    + JDK-8260704: ParallelGC: oldgen expansion needs release-store
    for _end
    + JDK-8261022: Fix incorrect result of Math.abs() with char type
    + JDK-8261089: [TESTBUG] native library of test
    TestCheckedReleaseCriticalArray.java fails to compile with
    gcc 4.x
    + JDK-8261183: Follow on to Make lists of normal filenames
    + JDK-8261209: isStandalone property: remove dependency on
    pretty-print
    + JDK-8261231: Windows IME was disabled after DnD operation
    + JDK-8261251: Shenandoah: Use object size for full GC
    humongous compaction
    + JDK-8261310: PPC64 Zero build fails with
    'VMError::controlled_crash(int)::FunctionDescriptor
    functionDescriptor' has incomplete type and cannot be defined
    + JDK-8261334: NMT: tuning statistic shows incorrect hash
    distribution
    + JDK-8261413: Shenandoah: Disable class-unloading in I-U mode
    + JDK-8261522: [PPC64] AES intrinsics write beyond the
    destination array
    + JDK-8261534: Test sun/security/pkcs11/KeyAgreement/
    /IllegalPackageAccess.java fails on platforms where no nsslib
    artifacts are defined
    + JDK-8261585: Restore HandleArea used in
    Deoptimization::uncommon_trap
    + JDK-8261753: Test java/lang/System/OsVersionTest.java still
    failing on BigSur patch versions after JDK-8253702
    + JDK-8261829: Exclude tools/jlink/JLinkReproducibleTest.java
    in 11u
    + JDK-8261912: Code IfNode::fold_compares_helper more
    defensively
    + JDK-8261920: [AIX] jshell command throws java.io.IOError on
    non English locales
    + JDK-8262018: Wrong format in SAP copyright header of
    OsVersionTest
    + JDK-8263069: Exclude some failing tests from
    security/infra/java/security/cert/CertPathValidator</changelog>
  <changelog author="fstrba@suse.com" date="1620043200">- Remove all Jpackage provides for SLE12 in order to avoid
  installing this package as default Java on SLE12-SP5
  (bsc#1185476)</changelog>
  <changelog author="fstrba@suse.com" date="1621512000">- Modified patch:
  * nss-security-provider.patch
    + make the NSS provider first in the list</changelog>
  <changelog author="fstrba@suse.com" date="1626868800">- Update to upstream tag jdk-11.0.12+7 (July 2021, CPU)
  * Security fixes
    + JDK-8256157: Improve bytecode assembly
    + JDK-8256491: Better HTTP transport
    + JDK-8258432, CVE-2021-2341, bsc#1188564: Improve file
    transfers
    + JDK-8260453: Improve Font Bounding
    + JDK-8260960: Signs of jarsigner signing
    + JDK-8260967, CVE-2021-2369, bsc#1188565: Better jar file
    validation
    + JDK-8262380: Enhance XML processing passes
    + JDK-8262403: Enhanced data transfer
    + JDK-8262410: Enhanced rules for zones
    + JDK-8262477: Enhance String Conclusions
    + JDK-8262967: Improve Zip file support
    + JDK-8264066, CVE-2021-2388, bsc#1188566: Enhance compiler
    validation
    + JDK-8264079: Improve abstractions
    + JDK-8264460: Improve NTLM support
  * Other changes
    + JDK-6847157: java.lang.NullPointerException: HDC for
    component at sun.java2d.loops.Blit.Blit
    + JDK-7106851: Test should not use System.exit
    + JDK-8073446: TimeZone getOffset API does not  return a dst
    offset between years 2038-2137
    + JDK-8076190: Customizing the generation of a PKCS12 keystore
    + JDK-8153005: Upgrade the default PKCS12 encryption/MAC
    algorithms
    + JDK-8171303: sun/java2d/pipe/InterpolationQualityTest.java
    fails on Windows &amp; Linux
    + JDK-8177068: incomplete classpath causes NPE in Flow
    + JDK-8185734: [Windows] Structured Exception Catcher missing
    around gtest execution
    + JDK-8187450: JNI local refs exceeds capacity warning in
    NetworkInterface::getAll
    + JDK-8190763: Class cast exception on (CompoundEdit)
    UndoableEditEvent.getEdit()
    + JDK-8195841: PNGImageReader.readNullTerminatedString() doesnt
    check for non-null terminated strings with length equal to
    maxLen
    + JDK-8196100: javax/swing/text/JTextComponent/5074573/
    /bug5074573.java fails
    + JDK-8199646: JShell tests: jdk/jshell/
    /FailOverDirectExecutionControlTest.java failed with
    java.lang.UnsupportedOperationException
    + JDK-8206925: Support the certificate_authorities extension
    + JDK-8207160: ClassReader::adjustMethodParams can potentially
    return null if the args list is empty
    + JDK-8207247: AARCH64: Enable Minimal and Client VM builds
    + JDK-8207404: MulticastSocket tests failing on AIX
    + JDK-8207779: Method::is_valid_method() compares 'this' with
    NULL
    + JDK-8208061: runtime/LoadClass/TestResize.java fails with
    "Load factor too high" when running in CDS mode.
    + JDK-8209459: TestSHA512MultiBlockIntrinsics failed on AArch64
    + JDK-8210443: Migrate Locale matching tests to JDK Repo.
    + JDK-8213231: ThreadSnapshot::_threadObj can become stale
    + JDK-8213483: ARM32: runtime/ErrorHandling/
    /ShowRegistersOnAssertTest.java jtreg test fail
    + JDK-8213725: JShell NullPointerException due to class file
    with unexpected package
    + JDK-8213794: ARM32: disable TypeProfiling,
    CriticalJNINatives, Serviceablity tests for ARM32
    + JDK-8213845: ARM32: Interpreter doesn't call result handler
    after native calls
    + JDK-8214128: ARM32: wrong stack alignment on
    Deoptimization::unpack_frames
    + JDK-8214512: ARM32: Jtreg test compiler/c2/Test8062950.java
    fails on ARM
    + JDK-8214854: JDWP: Unforseen output truncation in logging
    + JDK-8214922: Add vectorization support for fmin/fmax
    + JDK-8215009: GCC 8 compilation error in libjli
    + JDK-8216184: CDS/appCDS tests failed on Windows due to long
    path to a classlist file
    + JDK-8216259: AArch64: Vectorize Adler32 intrinsics
    + JDK-8216314: SIGILL in CodeHeapState::print_names()
    + JDK-8217348: assert(thread-&gt;is_Java_thread()) failed: just
    checking
    + JDK-8217465: [REDO] - Optimize CodeHeap Analytics
    + JDK-8217561: X86: Add floating-point Math.min/max intrinsics
    + JDK-8217918: C2: -XX:+AggressiveUnboxing is broken
    + JDK-8218458: [TESTBUG] runtime/NMT/
    /CheckForProperDetailStackTrace.java fails with Expected
    stack trace missing from output
    + JDK-8219142: Remove unused JIMAGE_ResourcePath
    + JDK-8219586: CodeHeap State Analytics processes dead nmethods
    + JDK-8220074: Clean up GCC 8.3 errors in LittleCMS
    + JDK-8220407: compiler/intrinsics/math/
    /TestFpMinMaxIntrinsics.java timedout
    + JDK-8222302: [TESTBUG] test/hotspot/jtreg/compiler/intrinsics/
    /sha/cli/TestUseSHAOptionOnUnsupportedCPU.java fails on any
    other CPU
    + JDK-8222412: AARCH64: multiple instructions encoding issues
    + JDK-8223020: aarch64: expand minI_rReg and maxI_rReg patterns
    into separate instructions
    + JDK-8223444: Improve CodeHeap Free Space Management
    + JDK-8223504: Improve performance of forall loops by better
    inlining of "iterator()" methods
    + JDK-8223667: ASAN build broken
    + JDK-8225081: Remove Telia Company CA certificate expiring in
    April 2021
    + JDK-8225116: Test OwnedWindowsLeak.java intermittently fails
    + JDK-8225438: javax/net/ssl/TLSCommon/
    /TestSessionLocalPrincipal.java failed with Read timed out
    + JDK-8225756: [testbug] compiler/loopstripmining/
    /CheckLoopStripMining.java sets too short a
    SafepointTimeoutDelay
    + JDK-8226374: Restrict TLS signature schemes and named groups
    + JDK-8226627: assert(t-&gt;singleton()) failed: must be a constant
    + JDK-8226721: Missing intrinsics for Math.ceil, floor, rint
    + JDK-8227080: (fs) Files.newInputStream(...).skip(n) is slow
    + JDK-8227222: vmTestbase/jit/FloatingPoint/gen_math/Loops04/
    /Loops04.java failed XMM register should be 0-15
    + JDK-8227609: (fs) Files.newInputStream(...).skip(n) should
    allow skipping beyond file size
    + JDK-8230428: Cleanup dead CastIP node code in formssel.cpp
    + JDK-8231460: Performance issue (CodeHeap) with large free
    blocks
    + JDK-8231713: x86_32 build failures after JDK-8226721 (Missing
    intrinsics for Math.ceil, floor, rint)
    + JDK-8231841: AArch64: debug.cpp help() is missing an AArch64
    line for pns
    + JDK-8232084: HotSpot build failed with GCC 9.2.1
    + JDK-8232591: AArch64: Add missing match rules for smaddl,
    smsubl and smnegl
    + JDK-8233185: HttpServer.stop() blocks indefinitely when
    called on dispatch thread
    + JDK-8233787: Break cycle in vm_version* includes
    + JDK-8233948: AArch64: Incorrect mapping between OptoReg and
    VMReg for high 64 bits of Vector Register
    + JDK-8234355: Buffer overflow in jcmd GC.class_stats due to
    too many classes
    + JDK-8235368: Update BCEL to Version 6.4.1
    + JDK-8236859: WebSocket over authenticating proxy fails with
    NPE
    + JDK-8236992: AArch64: remove redundant load_klass in itable
    stub
    + JDK-8237743: test/langtools/jdk/jshell/
    /FailOverExecutionControlTest.java fails No
    ExecutionControlProvider with name 'nonExistent' and parameter
    keys: []
    + JDK-8237804: sun/security/mscapi tests fail with "Key pair
    not generated, alias &lt;nnnnnn&gt; already exists"
    + JDK-8238175: CTW: Class.getDeclaredMethods fails with
    assert(k-&gt;is_subclass_of(SystemDictionary::Throwable_klass()))
    failed: invalid exception class
    + JDK-8238567: SoftMainMixer.processAudioBuffers(): Wrong
    handling of stoppedMixers
    + JDK-8238812: assert(false) failed: bad AD file
    + JDK-8239312: [macos] javax/swing/JFrame/NSTexturedJFrame/
    /NSTexturedJFrame.java
    + JDK-8239386: handle ContendedPaddingWidth in
    vm_version_aarch64
    + JDK-8239536: Can't use 'java.util.List' object after
    importing 'java.awt.List'
    + JDK-8240487: Cleanup whitespace in .cc, .hh, .m, and .mm files
    + JDK-8240848: ArrayIndexOutOfBoundsException buf for
    TextCallbackHandler
    + JDK-8241082: Upgrade IANA Language Subtag Registry data to
    03-16-2020 version
    + JDK-8241087: Build failure with VS 2019 (16.5.0) due to C2039
    and C2873
    + JDK-8241101: [s390] jtreg test failure after JDK-8238696: not
    conformant features string
    + JDK-8241248: NullPointerException in
    sun.security.ssl.HKDF.extract(HKDF.java:93)
    + JDK-8241372: Several test failures due to
    javax.net.ssl.SSLException: Connection reset
    + JDK-8241475: AArch64: Add missing support for PopCountVI node
    + JDK-8241829: Cleanup the code for PrinterJob on windows
    + JDK-8241960: The SHA3 message digests impl of SUN provider
    are not thread safe after cloned
    + JDK-8242010: Upgrade IANA Language Subtag Registry to Version
    2020-04-01
    + JDK-8242429: Better implementation for sign extract
    + JDK-8242557: Add length limit for strings in PNGImageWriter
    + JDK-8242919: Paste locks up jshell
    + JDK-8243155: AArch64: Add support for SqrtVF
    + JDK-8243240: AArch64: Add support for MulVB
    + JDK-8243452: JFR: Could not create chunk in repository with
    over 200 recordings
    + JDK-8243559: Remove root certificates with 1024-bit keys
    + JDK-8243597: AArch64: Add support for integer vector abs
    + JDK-8244031: HttpClient should have more tests for HEAD
    requests
    + JDK-8244205: HTTP/2 tunnel connections through proxy may be
    reused regardless of which proxy is selected
    + JDK-8244847: Linux/PPC: runtime/CompressedOops/
    /CompressedClassPointers: smallHeapTest fails
    + JDK-8245511: G1 adaptive IHOP does not account for
    reclamation of humongous objects by young GC
    + JDK-8246274: G1 old gen allocation tracking is not in a
    separate class
    + JDK-8247354: [aarch64] PopFrame causes
    assert(oopDesc::is_oop(obj)) failed: not an oop
    + JDK-8247408: IdealGraph bit check expression canonicalization
    + JDK-8247432: Update IANA Language Subtag Registry to Version
    2020-09-29
    + JDK-8247438: JShell: When FailOverExecutionControlProvider
    fails the proximal cause is not shown
    + JDK-8247753: UIManager.getSytemLookAndFeelClassName() returns
    wrong value on Fedora 32
    + JDK-8248043: Need to eliminate excessive i2l conversions
    + JDK-8248411: [aarch64] Insufficient error handling when
    CodeBuffer is exhausted
    + JDK-8248568: compiler/c2/TestBit.java failed: test missing
    from stdout/stderr
    + JDK-8248870: AARCH64: I2L/L2I conversions can be skipped for
    masked positive values
    + JDK-8249142: java/awt/FontClass/CreateFont/DeleteFont.sh is
    unstable
    + JDK-8249189: AARCH64: more L2I conversions can be skipped
    + JDK-8249719: MethodHandle performance suffers from bad
    ResolvedMethodTable hash function
    + JDK-8249875: GCC 10 warnings -Wtype-limits with JFR code
    + JDK-8250635: MethodArityHistogram should use Compile_lock in
    favour of fancy checks
    + JDK-8250876: Fix issues with cross-compile on macos
    + JDK-8251031: Some vmTestbase/nsk/monitoring/RuntimeMXBean
    tests fail with hostnames starting from digits
    + JDK-8251525: AARCH64: Faster Math.signum(fp)
    + JDK-8252259: AArch64: Adjust default value of FLOATPRESSURE
    + JDK-8252311: AArch64: save two words in itable lookup stub
    + JDK-8252779: compiler/graalunit/HotspotTest.java failed after
    8251525
    + JDK-8252883: AccessDeniedException caused by delayed file
    deletion on Windows
    + JDK-8253167: ARM32 builds fail after JDK-8247910
    + JDK-8253572: [windows] CDS archive may fail to open with long
    file names
    + JDK-8253923: C2 doesn't always run loop opts for compilations
    that include loops
    + JDK-8253948: Memory leak in ImageFileReader
    + JDK-8254631: Better support ALPN byte wire values in SunJSSE
    + JDK-8254717: isAssignableFrom checks in
    KeyFactorySpi.engineGetKeySpec appear to be backwards
    + JDK-8255086: Update the root locale display names
    + JDK-8255625: AArch64: Implement Base64.encodeBlock
    accelerator/intrinsic
    + JDK-8255763: C2: OSR miscompilation caused by invalid memory
    instruction placement
    + JDK-8255992: JFR EventWriter does not use first string from
    StringPool with id 0
    + JDK-8256037: [TESTBUG] com/sun/jndi/dns/ConfigTests/
    /PortUnreachable.java fails due to the hard coded threshold
    is small
    + JDK-8256244: java/lang/ProcessHandle/PermissionTest.java
    fails with TestNG 7.1
    + JDK-8256287: [windows] add loop fuse to
    map_or_reserve_memory_aligned
    + JDK-8256523: Streamline Java SHA2 implementation
    + JDK-8257414: Drag n Drop target area is wrong on high DPI
    systems
    + JDK-8257569: Failure observed with
    JfrVirtualMemory::initialize
    + JDK-8257574: C2: "failed: parsing found no loops but there
    are some" assert failure
    + JDK-8257580: Bump update version for OpenJDK: jdk-11.0.12
    + JDK-8257604: JNI_ArgumentPusherVaArg leaks valist
    + JDK-8257621: JFR StringPool misses cached items across
    consecutive recordings
    + JDK-8257796: [TESTBUG]
    TestUseSHA512IntrinsicsOptionOnSupportedCPU.java fails
    on x86_32
    + JDK-8257822: C2 crashes with SIGFPE due to a division that
    floats above its zero check
    + JDK-8257828: SafeFetch may crash if invoked in non-JavaThreads
    + JDK-8257853: Remove dependencies on JNF's JNI utility
    functions in AWT and 2D code
    + JDK-8257858: [macOS]: Remove JNF dependency from
    libosxsecurity/KeystoreImpl.m
    + JDK-8257860: [macOS]: Remove JNF dependency from
    libosxkrb5/SCDynamicStoreConfig.m
    + JDK-8257988: Remove JNF dependency from
    libsaproc/MacosxDebuggerLocal.m
    + JDK-8258414: OldObjectSample events too expensive
    + JDK-8258505: [TESTBUG] TestDivZeroWithSplitIf.java fails due
    to missing UnlockDiagnosticVMOptions
    + JDK-8258753: StartTlsResponse.close() hangs due to
    synchronization issues
    + JDK-8259061: C2: assert(found) failed: memory-writing node is
    not placed in its original loop or an ancestor of it
    + JDK-8259227: C2 crashes with SIGFPE due to a division that
    floats above its zero check
    + JDK-8259232: Bad JNI lookup during printing
    + JDK-8259276: C2: Empty expression stack when reexecuting
    tableswitch/lookupswitch instructions after deoptimization
    + JDK-8259343: [macOS] Update JNI error handling in Cocoa code.
    + JDK-8259585: Accessible actions do not work on mac os x
    + JDK-8259651: [macOS] Replace JNF_COCOA_ENTER/EXIT macros
    + JDK-8259662: Don't wrap SocketExceptions into SSLExceptions
    in SSLSocketImpl
    + JDK-8259710: Inlining trace leaks memory
    + JDK-8259729: Missed JNFInstanceOf -&gt; IsInstanceOf conversion
    + JDK-8259777: Incorrect predication condition generated by ADLC
    + JDK-8259786: initialize last parameter of getpwuid_r
    + JDK-8259843: initialize dli_fname array before calling
    dll_address_to_library_name
    + JDK-8259869: [macOS] Remove desktop module dependencies on
    JNF Reference APIs
    + JDK-8259886: Improve SSL session cache performance and
    scalability
    + JDK-8259983: do not use uninitialized expand_ms value in
    G1CollectedHeap::expand_heap_after_young_collection
    + JDK-8260030: Improve stringStream buffer handling
    + JDK-8260236: better init AnnotationCollector _contended_group
    + JDK-8260255: C1: LoopInvariantCodeMotion constructor can
    leave some fields uninitialized
    + JDK-8260284: C2: assert(_base == Int) failed: Not an Int
    + JDK-8260380: Upgrade to LittleCMS 2.12
    + JDK-8260420: C2 compilation fails with assert(found_sfpt)
    failed: no node in loop that's not input to safepoint
    + JDK-8260426: awt debug_mem.c DMem_AllocateBlock might leak
    memory
    + JDK-8260432: allocateSpaceForGP in freetypeScaler.c might
    leak memory
    + JDK-8260616: Removing remaining JNF dependencies in the
    java.desktop module
    + JDK-8260653: Unreachable nodes keep speculative types alive
    + JDK-8260707: java/lang/instrument/PremainClass/
    /InheritAgent0100.java times out
    + JDK-8260925: HttpsURLConnection does not work  with other
    JSSE provider.
    + JDK-8260926: Trace resource exhausted events unconditionally
    + JDK-8261020: Wrong format parameter in
    create_emergency_chunk_path
    + JDK-8261027: AArch64: Support for LSE atomics C++ HotSpot code
    + JDK-8261167: print_process_memory_info add a close call after
    fopen
    + JDK-8261170: Upgrade to freetype 2.10.4
    + JDK-8261198: [macOS] Incorrect JNI parameters in number
    conversion in A11Y code
    + JDK-8261235: C1 compilation fails with
    assert(res-&gt;vreg_number() == index) failed: conversion check
    + JDK-8261261: The version extra fields needs to be overridable
    in jib-profiles.js
    + JDK-8261262: Kitchensink24HStress.java crashed with
    EXCEPTION_ACCESS_VIOLATION
    + JDK-8261354: SIGSEGV at MethodIteratorHost
    + JDK-8261355: No data buffering in SunPKCS11 Cipher encryption
    when the underlying mechanism has no padding
    + JDK-8261397: try catch Method failing to work when dividing
    an integer by 0
    + JDK-8261422: Adjust problematic String.format calls in
    jdk/internal/util/Preconditions.java outOfBoundsMessage
    + JDK-8261447: MethodInvocationCounters frequently run into
    overflow
    + JDK-8261481: Cannot read Kerberos settings in dynamic store
    on macOS Big Sur
    + JDK-8261505: Test test/hotspot/jtreg/gc/parallel/
    /TestDynShrinkHeap.java killed by Linux OOM Killer
    + JDK-8261601: free memory in early return in
    Java_sun_nio_ch_sctp_SctpChannelImpl_receive0
    + JDK-8261649: AArch64: Optimize LSE atomics in C++ code
    + JDK-8261730: C2 compilation fails with
    assert(store-&gt;find_edge(load) != -1) failed: missing
    precedence edge
    + JDK-8261752: Multiple GC test are missing memory requirements
    + JDK-8261791: (sctp) handleSendFailed in SctpChannelImpl.c
    potential leaks
    + JDK-8261812: C2 compilation fails with assert(!had_error)
    failed: bad dominance
    + JDK-8261914: IfNode::fold_compares_helper faces
    non-canonicalized bool when running JRuby JSON workload
    + JDK-8262093: java/util/concurrent/tck/JSR166TestCase.java
    failed "assert(false) failed: unexpected node"
    + JDK-8262110: DST starts from incorrect time in 2038
    + JDK-8262121: [11u] Redo 8244287: JFR: Methods samples have
    line number 0
    + JDK-8262163: Extend settings printout in jcmd VM.metaspace
    + JDK-8262295: C2: Out-of-Bounds Array Load from Clone Source
    + JDK-8262298: G1BarrierSetC2::step_over_gc_barrier fails with
    assert "bad barrier shape"
    + JDK-8262446: DragAndDrop hangs on Windows
    + JDK-8262461: handle wcstombsdmp return value correctly in
    unix awt_InputMethod.c
    + JDK-8262465: Very long compilation times and high memory
    consumption in C2 debug builds
    + JDK-8262726: AArch64: C1 StubAssembler::call_RT can corrupt
    stack
    + JDK-8262739: String inflation C2 intrinsic prevents insertion
    of anti-dependencies
    + JDK-8262829: Native crash in
    Win32PrintServiceLookup.getAllPrinterNames()
    + JDK-8262837: handle split_USE correctly
    + JDK-8262900: ToolBasicTest fails to access HTTP server it
    starts
    + JDK-8263260: [s390] Support latest hardware (z14 and z15)
    + JDK-8263311: Watch registry changes for remote printers
    update instead of polling
    + JDK-8263361: Incorrect arraycopy stub selected by C2 for SATB
    collectors
    + JDK-8263404: RsaPrivateKeySpec is always recognized as
    RSAPrivateCrtKeySpec in RSAKeyFactory.engineGetKeySpec
    + JDK-8263425: AArch64: two potential bugs in C1
    LIRGenerator::generate_address()
    + JDK-8263448: CTW: fatal error: meet not symmetric
    + JDK-8263504: Some OutputMachOpcodes fields are uninitialized
    + JDK-8263557: Possible NULL dereference in
    Arena::destruct_contents()
    + JDK-8263558: Possible NULL dereference in fast path arena
    free if ZapResourceArea is true
    + JDK-8263676: AArch64: one potential bug in C1
    LIRGenerator::generate_address()
    + JDK-8263729: [test] divert spurious output away from stream
    under test in ProcessBuilder Basic test
    + JDK-8263846: Bad JNI lookup getFocusOwner in accessibility
    code on Mac OS X
    + JDK-8264047: Duplicate global variable 'jvm' in libjavajpeg
    and libawt
    + JDK-8264096: slowdebug jvm crashes when StrInflatedCopy match
    rule is not supported
    + JDK-8264151: ciMethod::ensure_method_data() should return
    false is loading resulted in empty state
    + JDK-8264173: [s390] Improve Hardware Feature Detection And
    Reporting
    + JDK-8264190: Harden TLS interop tests
    + JDK-8264223: CodeHeap::verify fails extra_hops assertion in
    fastdebug test
    + JDK-8264328: Broken license in
    javax/swing/JComboBox/8072767/bug8072767.java
    + JDK-8264360: Loop strip mining verification fails with
    "should be on the backedge"
    + JDK-8264626: C1 should be able to inline excluded methods
    + JDK-8264640: CMS ParScanClosure misses a barrier
    + JDK-8264786: [macos] All Swing/AWT apps cause Allow
    Notifications prompt to appear when app is launched
    + JDK-8264821: DirectIOTest fails on a system with large block
    size
    + JDK-8264848: [macos] libjvm.dylib linker warning due to macOS
    version mismatch
    + JDK-8264923: PNGImageWriter.write_zTXt throws Exception with
    a typo
    + JDK-8264958: C2 compilation fails with assert "n is later
    than its clone"
    + JDK-8265099: Revert backport to 11u of 8236859: WebSocket
    over authenticating proxy fails with NPE
    + JDK-8265154: vinserti128 operand mix up for KNL platforms
    + JDK-8265239: Shenandoah: Shenandoah heap region count could
    be off by 1
    + JDK-8265417: Backport of JDK-8249672 breaks Solaris x86 build
    + JDK-8265421: java/lang/String/StringRepeat.java test is
    missing a memory requirement
    + JDK-8265462: Handle multiple slots in the NSS Internal Module
    from SunPKCS11's Secmod
    + JDK-8265537: x86 version string truncated after JDK-8249672
    11u backport
    + JDK-8265666: Enable AIX build platform to make external debug
    symbols
    + JDK-8265677: CMS: CardTableBarrierSet::write_ref_array_work()
    lacks storestore barrier
    + JDK-8265690: Use the latest Ubuntu base image version in
    Docker testing
    + JDK-8265718: Build failure after JDK-8258414 11u backport
    + JDK-8265750: Fatal error in safepoint.cpp after backport of
    8258414
    + JDK-8265784: [C2] Hoisting of DecodeN leaves MachTemp inputs
    behind
    + JDK-8265938: C2's conditional move optimization does not
    handle top Phi
    + JDK-8266220: keytool still prompt for store password on a
    password-less pkcs12 file if -storetype pkcs12 is specified
    + JDK-8266293: Key protection using PBEWithMD5AndDES fails with
    "java.security.InvalidAlgorithmParameterException: Salt must
    be 8 bytes long"
    + JDK-8266713: [AIX] Build failure after 11u backport of
    JDK-8247753
    + JDK-8266802: Shenandoah: Round up region size to page size
    unconditionally
    + JDK-8266892: avoid maybe-uninitialized gcc warnings on linux
    s390x
    + JDK-8266929: Unable to use algorithms from 3p providers
    + JDK-8267235: [macos_aarch64]
    InterpreterRuntime::throw_pending_exception messing up LR
    results in crash
    + JDK-8267561: Shenandoah: Reference processing not properly
    setup for outside of cycle degenerated GC
    + JDK-8267599: Revert the change to the default PKCS12
    macAlgorithm and macIterationCount props for 11u/8u/7u
    + JDK-8267641: [11u] 8227609 backport typo
    + JDK-8267721: Enable sun/security/pkcs11 tests for Amazon
    Linux 2 AArch64
    + JDK-8268678: LetsEncryptCA.java test fails as Let's Encrypt
    Authority X3 is retired</changelog>
  <changelog author="schwab@suse.de" date="1628078400">- riscv64-zero.patch: Add support for riscv64 (zero VM)</changelog>
  <changelog author="fstrba@suse.com" date="1629979200">- Added patch:
  * jdk11-glibc234.patch
    + fix build with glibc-2.34 (bsc#1189201)</changelog>
  <changelog author="fstrba@suse.com" date="1631534400">- Modified patch:
  * nss-security-provider.patch
    + revert recent changes making NSS provider the default one
    + fixes bsc#1190252</changelog>
  <changelog author="fstrba@suse.com" date="1631793600">- Added patch:
  * fips.patch
    + implement FIPS support in OpenJDK</changelog>
  <changelog author="fstrba@suse.com" date="1634817600">- Update to upstream tag jdk-11.0.13+8 (October 2021 CPU)
  * Security fixes
    + JDK-8163326, CVE-2021-35550, bsc#1191901: Update the default
    enabled cipher suites preference
    + JDK-8254967, CVE-2021-35565, bsc#1191909:
    com.sun.net.HttpsServer spins on TLS session close
    + JDK-8263314: Enhance XML Dsig modes
    + JDK-8265167, CVE-2021-35556, bsc#1191910: Richer Text Editors
    + JDK-8265574: Improve handling of sheets
    + JDK-8265580, CVE-2021-35559, bsc#1191911: Enhanced style for
    RTF kit
    + JDK-8265776: Improve Stream handling for SSL
    + JDK-8266097, CVE-2021-35561, bsc#1191912: Better hashing
    support
    + JDK-8266103: Better specified spec values
    + JDK-8266109: More Resilient Classloading
    + JDK-8266115: More Manifest Jar Loading
    + JDK-8266137, CVE-2021-35564, bsc#1191913: Improve Keystore
    integrity
    + JDK-8266689, CVE-2021-35567, bsc#1191903: More Constrained
    Delegation
    + JDK-8267086: ArrayIndexOutOfBoundsException in
    java.security.KeyFactory.generatePublic
    + JDK-8267712: Better LDAP reference processing
    + JDK-8267729, CVE-2021-35578, bsc#1191904: Improve TLS client
    handshaking
    + JDK-8267735, CVE-2021-35586, bsc#1191914: Better BMP support
    + JDK-8268193: Improve requests of certificates
    + JDK-8268199: Correct certificate requests
    + JDK-8268205: Enhance DTLS client handshake
    + JDK-8268506: More Manifest Digests
    + JDK-8269618, CVE-2021-35603, bsc#1191906: Better session
    identification
    + JDK-8269624: Enhance method selection support
    + JDK-8270398: Enhance canonicalization
    + JDK-8270404: Better canonicalization
  * Other changes
    + JDK-8024368: private methods are allocated vtable indices
    + JDK-8042902: Test java/net/Inet6Address/serialize/
    /Inet6AddressSerializationTest.java fails intermittently
    + JDK-8140466: ChaCha20 and Poly1305 TLS Cipher Suites
    + JDK-8157404: Unable to read certain PKCS12 keystores from
    SequenceInputStream
    + JDK-8158066: SourceDebugExtensionTest fails to rename file
    + JDK-8168304: Make all of DependencyContext_test available in
    product mode
    + JDK-8169246: java/net/DatagramSocket/ReportSocketClosed.java
    fails intermittently with BindException
    + JDK-8181313: SA: Remove libthread_db dependency on Linux
    + JDK-8193214: Incorrect annotations.without.processors
    warnings with JDK 9
    + JDK-8194230: jdk/internal/jrtfs/remote/
    /RemoteRuntimeImageTest.java fails with
    java.lang.NullPointerException
    + JDK-8196092: javax/swing/JComboBox/8032878/bug8032878.java
    fails
    + JDK-8199931: java/net/MulticastSocket/
    /UnreferencedMulticastSockets.java fails with "incorrect data
    received"
    + JDK-8206083: Make tools/javac/api/T6265137.java robust to JDK
    version changes
    + JDK-8206350: java/util/Locale/bcp47u/SystemPropertyTests.java
    failed on Mac 10.13 with zh_CN and zh_TW locales.
    + JDK-8207316: java/nio/channels/spi/SelectorProvider/
    /inheritedChannel/InheritedChannelTest.java failed
    + JDK-8208227: tools/jdeps/DotFileTest.java fails on Win-X64
    + JDK-8208363: test/jdk/java/lang/Package/
    /PackageFromManifest.java missing module dependencies
    declaration
    + JDK-8209380: ARM: cleanup maybe-uninitialized and reorder
    compiler warnings
    + JDK-8209768: Refactor java/util/prefs/CheckUserPrefsStorage.sh
    to plain java test
    + JDK-8209772: Refactor shell test java/util/ServiceLoader/
    /basic/basic.sh to java
    + JDK-8209773: Refactor shell test javax/naming/module/basic.sh
    to java
    + JDK-8209832: Refactor jdk/internal/reflect/Reflection/
    /GetCallerClassTest.sh to plain java test
    + JDK-8209930: Refactor java/util/zip/ZipFile/deletetempjar.sh
    to plain java test
    + JDK-8210406: Refactor java.util.PluggableLocale:i18n shell
    tests to plain java tests
    + JDK-8210407: Refactor java.util.Calendar:i18n shell tests to
    plain java tests
    + JDK-8210495: compiler crashes because of illegal signature in
    otherwise legal code
    + JDK-8210669: Some launcher tests assume a pre-JDK 9 run-time
    image layout
    + JDK-8210802: temp files left by tests in
    jdk/java/net/httpclient
    + JDK-8210819: Update the host name in CNameTest.java
    + JDK-8210908: Refactor java/util/prefs/PrefsSpi.sh to plain
    java test
    + JDK-8210934: Move sun/net/www/protocol/http/
    /GetErrorStream.java to OpenJDK
    + JDK-8210959: JShell fails and exits when statement throws an
    exception whose message contains a '%'.
    + JDK-8211055: Provide print to a file (PDF) feature even when
    printer was not connected
    + JDK-8211092: test/jdk/sun/net/www/http/HttpClient/
    /MultiThreadTest.java fails intermittently when cleaning up
    + JDK-8211296: Remove HotSpot deprecation warning suppression
    for Mac/clang
    + JDK-8211325: test/jdk/java/net/Socket/LingerTest.java fails
    with cleaning up
    + JDK-8212040: Compilation error due to wrong usage of
    NSPrintJobDispositionValue in mac10.12
    + JDK-8212695: Add explicit timeout to several HTTP Client tests
    + JDK-8212718: Refactor some annotation processor tests to
    better use collections
    + JDK-8213007: Update the link in test/jdk/sun/security/
    /provider/SecureRandom/DrbgCavp.java
    + JDK-8213137: Remove static initialization of monitor/mutex
    instances
    + JDK-8213235: java/nio/channels/SocketChannel/
    /AsyncCloseChannel.java fails with threads that didn't exit
    + JDK-8213409: Refactor sun.text.IntHashtable:i18n shell tests
    to plain java tests
    + JDK-8213576: Make test AsyncCloseChannel.java run in othervm
    + JDK-8213694: Test Timeout.java should run in othervm mode
    + JDK-8213718: [TEST] Wrong classname in vmTestbase/nsk/stress/
    /except/except002 and except003
    + JDK-8213922: fix ctw stand-alone build
    + JDK-8214195: Align stdout messages in
    test/jdk/java/math/BigInteger/PrimitiveConversionTests.java
    + JDK-8214520: [TEST_BUG] sun/security/mscapi/nonUniqueAliases/
    /NonUniqueAliases.java failed with incorrect jtreg tags order
    + JDK-8214937: sun/security/tools/jarsigner/warnings/
    /NoTimestampTest.java failed due to unexpected expiration date
    + JDK-8216532: tools/launcher/Test7029048.java fails (Solaris)
    + JDK-8217825: Verify @AfterTest is used correctly in WebSocket
    tests
    + JDK-8218145: block_if_requested is not proper inlined due to
    size
    + JDK-8219417: bump jtreg requiredVersion to b14
    + JDK-8219552: bump jtreg requiredVersion to b14 in
    test/jdk/sanity/client/
    + JDK-8219804: java/net/MulticastSocket/Promiscuous.java fails
    intermittently due to NumberFormatException
    + JDK-8220445: Support for side by side MSVC Toolset versions
    + JDK-8221988: add possibility to build with Visual Studio 2019
    + JDK-8222751: closed/test/jdk/sun/security/util/
    /DerIndefLenConverter/IndefBerPkcs12.java fail
    + JDK-8223050: JVMCI: findUniqueConcreteMethod() should not use
    Dependencies::find_unique_concrete_method() for non-virtual
    methods
    + JDK-8224853: CDS address sanitizer errors
    + JDK-8225082: Remove IdenTrust certificate that is expiring in
    September 2021
    + JDK-8225583: Examine the HttpResponse.BodySubscribers for
    null handling and multiple subscriptions
    + JDK-8225690: Multiple AttachListener threads can be created
    + JDK-8225790: Two NestedDialogs tests fail on Ubuntu
    + JDK-8226319: Add forgotten test/jdk/java/net/httpclient/
    /BodySubscribersTest.java
    + JDK-8226533: JVMCI: findUniqueConcreteMethod should handle
    statically bindable methods directly
    + JDK-8226602: Test convenience reactive primitives from
    java.net.http with RS TCK
    + JDK-8226683: Remove review suggestion from fix to 8219804
    + JDK-8227738: jvmti/DataDumpRequest/datadumpreq001 failed due
    to "exit code is 134"
    + JDK-8227766: CheckUnhandledOops is broken in MemAllocator
    + JDK-8227815: Minimal VM: set_state is not a member of
    AttachListener
    + JDK-8230674: Heap dumps should exclude dormant CDS archived
    objects of unloaded classes
    + JDK-8230808: Remove Access::equals()
    + JDK-8230841: Remove oopDesc::equals()
    + JDK-8231717: Improve performance of charset decoding when
    charset is always compactable
    + JDK-8232243: Wrong caret position in JTextPane on Windows
    with a screen resolution &gt; 100%
    + JDK-8232782: Shenandoah: streamline post-LRB CAS barrier
    (aarch64)
    + JDK-8233790: Forward output from heap dumper to jcmd/jmap
    + JDK-8233989: Create an IPv4 version of
    java/net/MulticastSocket/SetLoopbackMode.java
    + JDK-8234510: Remove file seeking requirement for writing a
    heap dump
    + JDK-8235211: serviceability/attach/
    /RemovingUnixDomainSocketTest.java fails with
    AttachNotSupportedException: Unable to open socket file
    + JDK-8235216: typo in test filename
    + JDK-8235866: bump jtreg requiredVersion to 4.2b16
    + JDK-8236111: narrow allowSmartActionArgs disabling
    + JDK-8236413: AbstractConnectTimeout should tolerate both
    NoRouteToHostException and UnresolvedAddressException
    + JDK-8236671: NullPointerException in JKS keystore
    + JDK-8238930: problem list compiler/c2/Test8004741.java
    + JDK-8238943: switch to jtreg 5.0
    + JDK-8240555: Using env of JAVA_TOOL_OPTIONS and _JAVA_OPTIONS
    breaks QuietOption.java test
    + JDK-8240983: Incorrect copyright header in Apache Santuario
    2.1.3 files
    + JDK-8241336: Some java.net tests failed with
    NoRouteToHostException on MacOS with special network
    configuration
    + JDK-8241353: NPE in ToolProvider.getSystemJavaCompiler
    + JDK-8241768: git needs .gitattributes
    + JDK-8242882: opening jar file with large manifest might throw
    NegativeArraySizeException
    + JDK-8244973: serviceability/attach/
    /RemovingUnixDomainSocketTest.java fails "stderr was not
    empty"
    + JDK-8245134: test/lib/jdk/test/lib/security/
    /KeyStoreUtils.java should allow to specify aliases
    + JDK-8246261: TCKLocalTime.java failed due to "AssertionError:
    expected [18:14:22] but found [18:14:23]"
    + JDK-8246387: switch to jtreg 5.1
    + JDK-8247421: [TESTBUG] ReturnBlobToWrongHeapTest.java failed
    allocating blob
    + JDK-8247469: getSystemCpuLoad() returns -1 on linux when some
    offline cpus are present and cpusets.effective_cpus is not
    available
    + JDK-8248352: [TEST_BUG] Test test/jdk/java/awt/font/
    /TextLayout/ArabicDiacriticTest.java can leave frame open
    + JDK-8248403: AArch64: Remove uses of kernel integer types
    + JDK-8248414: AArch64: Remove uses of long and unsigned long
    ints
    + JDK-8248657: Windows: strengthening in ThreadCritical
    regarding memory model
    + JDK-8248666: AArch64: Use THREAD_LOCAL instead of __thread
    + JDK-8248668: AArch64: Avoid MIN/MAX macros when using MSVC
    + JDK-8248671: AArch64: Remove unused variables
    + JDK-8248682: AArch64: Use ATTRIBUTE_ALIGNED helper
    + JDK-8248816: C1: Fix signature conflict in
    LIRGenerator::strength_reduce_multiply
    + JDK-8249095: tools/javac/launcher/SourceLauncherTest.java
    fails on Windows
    + JDK-8249548: backward focus traversal gets stuck in button
    group
    + JDK-8249773: Upgrade ReceiveISA.java test to be resilient to
    failure due to stray packets and interference
    + JDK-8249897: jdk/javadoc/tool/LangVers.java uses @ignore w/o
    bug-id
    + JDK-8249898: jdk/javadoc/tool/6176978/T6176978.java uses
    @ignore w/o bug-id
    + JDK-8249899: jdk/javadoc/tool/InlineTagsWithBraces.java uses
    @ignore w/o bug-id
    + JDK-8250588: Shenandoah: LRB needs to save/restore fp
    registers for runtime call
    + JDK-8250824: AArch64: follow up for JDK-8248414
    + JDK-8251166: Add automated testcases for changes done in
    JDK-8214112
    + JDK-8251252: Add automated testcase for fix done in
    JDK-8214253
    + JDK-8251254: Add automated test for fix done in JDK-8218472
    + JDK-8251361: Potential race between Logger configuration and
    GCs in HttpURLConWithProxy test
    + JDK-8251549: Update docs on building for Git
    + JDK-8251945: SIGSEGV in
    PackageEntry::purge_qualified_exports()
    + JDK-8252194: Add automated test for fix done in JDK-8218469
    + JDK-8252648: Shenandoah: name gang tasks consistently
    + JDK-8252825: Add automated test for fix done in JDK-8218479
    + JDK-8252853: AArch64: gc/shenandoah/TestVerifyJCStress.java
    fails intermittently with C1
    + JDK-8252857: AArch64: Shenandoah C1 CAS is not sequentially
    consistent
    + JDK-8253048: AArch64: When CallLeaf, no need to preserve
    callee-saved registers in caller
    + JDK-8253424: Add support for running pre-submit testing using
    GitHub Actions
    + JDK-8253631: Remove unimplemented CompileBroker methods after
    JEP-165
    + JDK-8253865: Pre-submit testing using GitHub Actions does not
    detect failures reliably
    + JDK-8253899: Make IsClassUnloadingEnabled signature match
    specification
    + JDK-8254024: Enhance native libs for AWT and Swing to work
    with GraalVM Native Image
    + JDK-8254054: Pre-submit testing using GitHub Actions should
    not use the deprecated set-env command
    + JDK-8254173: Add Zero, Minimal hotspot targets to submit
    workflow
    + JDK-8254175: Build no-pch configuration in debug mode for
    submit checks
    + JDK-8254244: Some code emitted by TemplateTable::branch is
    unused when running TieredCompilation
    + JDK-8254270: linux 32 bit build doesn't compile
    libjdwp/log_messages.c
    + JDK-8254282: Add Linux x86_32 builds to submit workflow
    + JDK-8254850: Update terminology in java.awt.GridBagLayout
    source code comments
    + JDK-8255255: Update Apache Santuario (XML Signature) to
    version 2.2.1
    + JDK-8255305: Add Linux x86_32 tier1 to submit workflow
    + JDK-8255352: Archive important test outputs in submit workflow
    + JDK-8255373: Submit workflow artifact name is always
    "test-results_.zip"
    + JDK-8255452: Doing GC during JVMTI MethodExit event posting
    breaks return oop
    + JDK-8255718: Zero: VM should know it runs in interpreter-only
    mode
    + JDK-8255790: GTKL&amp;F: Java 16 crashes on initialising GTKL&amp;F
    on Manjaro Linux
    + JDK-8255810: Zero: build fails without JVMTI
    + JDK-8255895: Submit workflow artifacts miss hs_errs/replays
    due to ZIP include mismatch
    + JDK-8256127: Add cross-compiled foreign architectures builds
    to submit workflow
    + JDK-8256215: Shenandoah: re-organize saving/restoring machine
    state in assembler code
    + JDK-8256267: Relax compiler/floatingpoint/NaNTest.java for
    x86_32 and lower -XX:+UseSSE
    + JDK-8256277: Github Action build on macOS should define OS
    and Xcode versions
    + JDK-8256354: Github Action build on Windows should define OS
    and MSVC versions
    + JDK-8256393: Github Actions build on Linux should define OS
    and GCC versions
    + JDK-8256414: add optimized build to submit workflow
    + JDK-8256747: GitHub Actions: decouple the hotspot build-only
    jobs from Linux x64 testing
    + JDK-8257056: Submit workflow should apt-get update to avoid
    package installation errors
    + JDK-8257148: Remove obsolete code in AWTView.m
    + JDK-8257497: Update keytool to create AKID from the SKID of
    the issuing certificate as specified by RFC 5280
    + JDK-8257620: Do not use objc_msgSend_stret to get macOS
    version
    + JDK-8257913: Add more known library locations to simplify
    Linux cross-compilation
    + JDK-8258703: Incorrect 512-bit vector registers restore on
    x86_32
    + JDK-8259338: Add expiry exception for identrustdstx3 alias to
    VerifyCACerts.java test
    + JDK-8259535: ECDSA SignatureValue do not always have the
    specified length
    + JDK-8259679: GitHub actions should use MSVC 14.28
    + JDK-8259924: GitHub actions fail on Linux x86_32 with "Could
    not configure libc6:i386"
    + JDK-8260460: GitHub actions still fail on Linux x86_32 with
    "Could not configure libc6:i386"
    + JDK-8260589: Crash in JfrTraceIdLoadBarrier::load(_jclass*)
    + JDK-8260923: Add more tests for SSLSocket input/output
    shutdown
    + JDK-8261072: AArch64: Fix MacroAssembler::get_thread
    convention
    + JDK-8261147: C2: Node is wrongly marked as reduction
    resulting in a wrong execution due to wrong vector instructions
    + JDK-8261238: NMT should not limit baselining by size threshold
    + JDK-8261496: Shenandoah: reconsider pacing updates memory
    ordering
    + JDK-8261652: Remove some dead comments from os_bsd_x86
    + JDK-8261846: [JVMCI] c2v_iterateFrames can get out of sync
    with the StackFrameStream
    + JDK-8262000: jdk/jfr/event/gc/detailed/
    /TestPromotionFailedEventWithParallelScavenge.java failed with
    "OutOfMemoryError: Java heap space"
    + JDK-8262017: C2: assert(n != __null) failed: Bad immediate
    dominator info.
    + JDK-8262392: Update Mesa 3-D Headers to version 21.0.3
    + JDK-8262409: sun/security/ssl/SSLSocketImpl/
    /SSLSocketImplThrowsWrongExceptions. SSL test failures caused
    by java failed with "Server reported the wrong exception"
    + JDK-8262470: Printed GlyphVector outline with low DPI has bad
    quality on Windows
    + JDK-8262862: Harden tests sun/security/x509/URICertStore/
    /ExtensionsWithLDAP.java and krb5/canonicalize/Test.java
    + JDK-8263136: C4530 was reported from VS 2019 at access bridge
    + JDK-8263227: C2: inconsistent spilling due to dead nodes in
    exception block
    + JDK-8263382: java/util/logging/ParentLoggersTest.java failed
    with "checkLoggers: getLoggerNames() returned unexpected
    loggers"
    + JDK-8263407: SPARC64 detection fails on Athena (SPARC64-X)
    + JDK-8263432: javac may report an invalid package/class clash
    on case insensitive filesystems
    + JDK-8263490: [macos] Crash occurs on JPasswordField with
    activated InputMethod
    + JDK-8263531: Remove unused buffer int
    + JDK-8263667: Avoid running GitHub actions on branches named
    pr/*
    + JDK-8263776: [JVMCI] add helper to perform Java upcalls
    + JDK-8264016: [JVMCI] add some thread local fields for use by
    JVMCI
    + JDK-8264752: SIGFPE crash with option
    FlightRecorderOptions:threadbuffersize=30M
    + JDK-8265132: C2 compilation fails with assert "missing
    precedence edge"
    + JDK-8265231: (fc) ReadDirect and WriteDirect tests fail after
    fix for JDK-8264821
    + JDK-8265335: Epsilon: Minor typo in EpsilonElasticTLABDecay
    description
    + JDK-8265756: AArch64: initialize memory allocated for locals
    according to Windows AArch64 stack page growth requirement in
    template interpreter
    + JDK-8265761: Font with missed font family name is not
    properly printed on Windows
    + JDK-8265773: incorrect jdeps message "jdk8internals" to
    describe a removed JDK internal API
    + JDK-8265836: OperatingSystemImpl.getCpuLoad() returns
    incorrect CPU load inside a container
    + JDK-8266018: Shenandoah: fix an incorrect assert
    + JDK-8266206: Build failure after JDK-8264752 with older GCCs
    + JDK-8266248: Compilation failure in
    PLATFORM_API_MacOSX_MidiUtils.c with Xcode 12.5
    + JDK-8266288: assert root method not found in
    witnessed_reabstraction_in_supers is too strong
    + JDK-8266404: Fatal error report generated with
  - XX:+CrashOnOutOfMemoryError should not contain suggestion to
    submit a bug report
    + JDK-8266480: Implicit null check optimization does not update
    control of hoisted memory operation
    + JDK-8266615: C2 incorrectly folds subtype checks involving an
    interface array
    + JDK-8266642: Improve ResolvedMethodTable hash function
    + JDK-8266749: AArch64: Backtracing broken on PAC enabled
    systems
    + JDK-8266761: AssertionError in
    sun.net.httpserver.ServerImpl.responseCompleted
    + JDK-8266813: Shenandoah: Use shorter instruction sequence for
    checking if marking in progress
    + JDK-8267042: bug in monitor locking/unlocking on ARM32 C1 due
    to uninitialized BasicObjectLock::_displaced_header
    + JDK-8267348: Rewrite gc/epsilon/TestClasses.java to use
    Metaspace with less classes
    + JDK-8267396: Avoid recording "pc" in unhandled oops detector
    for better performance
    + JDK-8267399: C2: java/text/Normalizer/ConformanceTest.java
    test failed with assertion
    + JDK-8267424: CTW: C1 fails with "State must not be null"
    + JDK-8267459: Pasting Unicode characters into JShell does not
    work.
    + JDK-8267625: AARCH64: typo in LIR_Assembler::emit_profile_type
    + JDK-8267666: Add option to jcmd GC.heap_dump to use existing
    file
    + JDK-8267695: Bump update version for OpenJDK: jdk-11.0.13
    + JDK-8267751: (test) jtreg.SkippedException has no serial
    VersionUID
    + JDK-8267773: PhaseStringOpts::int_stringSize doesn't handle
    min_jint correctly
    + JDK-8268103: JNI functions incorrectly return a double after
    JDK-8265836
    + JDK-8268127: Shenandoah: Heap size may be too small for
    region to align to large page size
    + JDK-8268261: C2: assert(n != __null) failed: Bad immediate
    dominator info.
    + JDK-8268347: C2: nested locks optimization may create
    unbalanced monitor enter/exit code
    + JDK-8268360: Missing check for infinite loop during node
    placement
    + JDK-8268362: [REDO] C2 crash when compile negative
    Arrays.copyOf length after loop
    + JDK-8268366: Incorrect calculation of has_fpu_registers in C1
    linear scan
    + JDK-8268369: SIGSEGV in PhaseCFG::implicit_null_check due to
    missing null check
    + JDK-8268417: Add test from JDK-8268360
    + JDK-8268427: Improve AlgorithmConstraints:checkAlgorithm
    performance
    + JDK-8268617: [11u REDO] - WebSocket over authenticating proxy
    fails with NPE
    + JDK-8268620: InfiniteLoopException test may fail on x86
    platforms
    + JDK-8268635: Corrupt oop in ClassLoaderData
    + JDK-8268699: Shenandoah: Add test for JDK-8268127
    + JDK-8268771: javadoc -notimestamp option does not work on
    index.html
    + JDK-8268775: Password is being converted to String in
    AccessibleJPasswordField
    + JDK-8268776: Test `ADatagramSocket.java` missing /othervm
    from @run tag
    + JDK-8268965: TCP Connection Reset when connecting simple
    socket to SSL server
    + JDK-8269304: Regression ~5% in 2005 in b27
    + JDK-8269415: [11u] Remove ea from
    DEFAULT_PROMOTED_VERSION_PRE in OpenJDK 11u
    + JDK-8269478: Shenandoah: gc/shenandoah/mxbeans tests should
    be more resilient
    + JDK-8269529: javax/swing/reliability/
    /HangDuringStaticInitialization.java fails in Windows debug
    build
    + JDK-8269594: assert(_handle_mark_nesting &gt; 1) failed: memory
    leak: allocating handle outside HandleMark
    + JDK-8269614: [s390] Interpreter checks wrong bit for slow
    path instance allocation
    + JDK-8269650: Optimize gc-locker in
    [Get|Release]StringCritical for latin string
    + JDK-8269661: JNI_GetStringCritical does not lock char array
    + JDK-8269668: [aarch64] java.library.path not including
    /usr/lib64
    + JDK-8269763: The JEditorPane is blank after JDK-8265167
    + JDK-8269795: C2: Out of bounds array load floats above its
    range check in loop peeling resulting in SEGV
    + JDK-8269847: JDK-8269594 backport breaks 11u builds
    + JDK-8269850: Most JDK releases report macOS version 12 as
    10.16 instead of 12.0
    + JDK-8269851: OperatingSystemMXBean getProcessCpuLoad reports
    incorrect process cpu usage in containers
    + JDK-8269882: stack-use-after-scope in NewObjectA
    + JDK-8269934: RunThese24H.java failed with
    EXCEPTION_ACCESS_VIOLATION in
    java_lang_Thread::get_thread_status
    + JDK-8270096: Shenandoah: Optimize gc/shenandoah/
    /TestRefprocSanity.java for interpreter mode
    + JDK-8270137: Kerberos Credential Retrieval from Cache not
    Working in Cross-Realm Setup
    + JDK-8270184: [TESTBUG] Add coverage for jvmci
    ResolvedJavaType.toJavaName() for lambdas
    + JDK-8270196: [11u] [JVMCI] JavaType.toJavaName() returns
    incorrect type name for lambdas
    + JDK-8270556: Exclude security/infra/java/security/cert/
    /CertPathValidator/certification/LetsEncryptCA
    + JDK-8270893: IndexOutOfBoundsException while reading large
    TIFF file
    + JDK-8272078: Wrong Checksums in Temurin BootJDK dependencies
    + JDK-8272124: Cgroup v1 initialization causes
    NullPointerException when cgroup path contains colon
    + JDK-8272131: PhaseMacroExpand::generate_slow_arraycopy crash
    when clone null CallProjections.fallthrough_ioproj
    + JDK-8272197: Update 11u GHA workflow with Shenandoah
    configurations
    + JDK-8272332: --with-harfbuzz=system doesn't add -lharfbuzz
    after JDK-8255790
    + JDK-8272472: StackGuardPages test doesn't build with glibc
    2.34
    + JDK-8272602: [macos] not all KEY_PRESSED events sent when
    control modifier is used
    + JDK-8272628: Problemlist gc/stress/gcbasher/
    /TestGCBasherWithCMS.java for x86_32
    + JDK-8272700: [macos] Build failure with Xcode 13.0 after
    JDK-8264848
    + JDK-8272772: Shenandoah: compiler/c2/aarch64/
    /TestVolatilesShenandoah.java fails in 11u
    + JDK-8273939: Backport of 8248414 to JDK11 breaks
    MacroAssembler::adrp
- Remove the unneeded icedtea-sound provider
- Removed patches:
  * icedtea-sound-1.0.1-jdk9.patch
  * icedtea-sound-soundproperties.patch
    + not needed since the icedtea-sound provider is removed
  * jdk11-glibc234.patch
    + integrated upstream</changelog>
  <changelog author="fstrba@suse.com" date="1635940800">- Modified patches:
  * system-crypto-policy.patch
    + rediff to changed context
  * fips.patch
    + Allow plain key import in fips mode unless
    com.suse.fips.plainKeySupport is set to false</changelog>
  <changelog author="fstrba@suse.com" date="1636113600">- Modified patch:
  * fips.patch
    + return in native code after generating java.io.IOException</changelog>
</package>
<package pkgid="1f122f994d96d6ee697b2356174adee1869fe413d0dada95d0024f43df4501c6" name="java-11-openjdk" arch="x86_64">
  <version epoch="0" ver="11.0.13.0" rel="3.68.1"/>
  <changelog author="fstrba@suse.com" date="1586952000">- The pack200 and unpack200 alternatives should be slaves of java
  and not of javac, since they are part of JRE.</changelog>
  <changelog author="fstrba@suse.com" date="1587470400">- Update to upstream tag jdk-11.0.7+10 (April 2020 CPU,
  bsc#1169511)
  * Security fixes:
    + S8223898, CVE-2020-2754: Forward references to Nashorn
    + S8223904, CVE-2020-2755: Improve Nashorn matching
    + S8224541, CVE-2020-2756: Better mapping of serial ENUMs
    + S8224549, CVE-2020-2757: Less Blocking Array Queues
    + S8225603: Enhancement for big integers
    + S8226346: Build better binary builders
    + S8227467: Better class method invocations
    + S8227542: Manifest improved jar headers
    + S8229733: TLS message handling improvements
    + S8231415, CVE-2020-2773: Better signatures in XML
    + S8231785: Improved socket permissions
    + S8232424, CVE-2020-2778: More constrained algorithms
    + S8232581, CVE-2020-2767: Improve TLS verification
    + S8233250: Better X11 rendering
    + S8233410: Better Build Scripting
    + S8234027: Better JCEKS key support
    + S8234408, CVE-2020-2781: Improve TLS session handling
    + S8234825, CVE-2020-2800: Better Headings for HTTP Servers
    + S8234841, CVE-2020-2803: Enhance buffering of byte buffers
    + S8235274, CVE-2020-2805: Enhance typing of methods
    + S8235691, CVE-2020-2816: Enhance TLS connectivity
    + S8236201, CVE-2020-2830: Better Scanner conversions
    + S8238960: linux-i586 builds are inconsistent as the newly
    built jdk is not able to reserve enough space for object heap
  * Other changes:
    + S4919790: Errors in alert ssl message does not reflect the
    actual certificate status
    + S4949105: Access Bridge lacks html tags parsing
    + S7092821: java.security.Provider.getService() is synchronized
    and became scalability bottleneck
    + S7143743: Potential memory leak with zip provider
    + S8005819: Support cross-realm MSSFU
    + S8042383: [TEST_BUG] Test javax/swing/plaf/basic/BasicMenuUI/
    /4983388/bug4983388.java fails with shortcuts on menus do not
    work
    + S8068184: Fix for JDK-8032832 caused a deadlock
    + S8145845: [AOT] NullPointerException in
    compiler/whitebox/GetCodeHeapEntriesTest.java
    + S8152988: [AOT] Update test batch definitions to include
    aot-ed java.base module mode into hs-comp testing
    + S8160926: FLAGS_COMPILER_CHECK_ARGUMENTS doesn't handle
    cross-compilation
    + S8163083: SocketListeningConnector does not allow invocations
    with port 0
    + S8163251: Hard coded loop limit prevents reading of smart
    card data greater than 8k
    + S8167276: jvmci/compilerToVM/MaterializeVirtualObjectTest.java
    fails with -XX:-EliminateAllocations
    + S8169718: nsk/jdb/locals/locals002: ERROR: Cannot find
    boolVar with expected value: false
    + S8176556:
    java/awt/dnd/ImageTransferTest/ImageTransferTest.java fails
    for JFIF
    + S8178798: Two compiler/aot/verification/vmflags tests fail by
    timeout with UseAVX=3
    + S8183107: PKCS11 regression regarding checkKeySize
    + S8185005: Improve performance of
    ThreadMXBean.getThreadInfo(long ids[], int maxDepth)
    + S8189633: Missing -Xcheck:jni checking for DeleteWeakGlobalRef
    + S8189861: Refactor CacheFind
    + S8193042: NativeLookup::lookup_critical_entry() should only
    load shared library once
    + S8193596: java/net/DatagramPacket/ReuseBuf.java failed due to
    timeout
    + S8194944: Regression automated test 'open/test/jdk/javax/
    /swing/JInternalFrame/8145896/TestJInternalFrameMaximize.java'
    fails
    + S8196467: javax/swing/JInternalFrame/Test6325652.java fails
    + S8196969: JTreg Failure: serviceability/sa/ClhsdbJstack.java
    causes NPE
    + S8198321: javax/swing/JEditorPane/5076514/bug5076514.java
    fails
    + S8198398: Test javax/swing/JColorChooser/Test6199676.java
    fails in mach5
    + S8199072: Test javax/swing/GroupLayout/6613904/
    /bug6613904.java is unstable
    + S8200432: javadoc fails with ClassCastException on {@link
    byte[]}
    + S8201349: build broken when configured with
  - -with-zlib=bundled on gcc 7.3
    + S8201355: Avoid native memory allocation in
    sun.security.mscapi.PRNG.generateSeed
    + S8201513: nsk/jvmti/IterateThroughHeap/filter-* are broken
    + S8203364: Some serviceability/sa/ tests intermittently fail
    with java.io.IOException: LingeredApp terminated with non-zero
    exit code 3
    + S8203687: javax/net/ssl/compatibility/Compatibility.java
    supports TLS 1.3
    + S8203904: javax/swing/JSplitPane/4816114/bug4816114.java: The
    divider location is wrong
    + S8203911: Test runtime/modules/getModuleJNI/GetModule fails
    with -Xcheck:jni
    + S8204525: [TESTBUG] runtime/NMT/MallocStressTest.java ran out
    of java heap
    + S8204529: gc/TestAllocateHeapAtMultiple.java fail with Agent
    7 timed out
    + S8204551: Event descriptions are truncated in logs
    + S8206963: [AOT] bug with multiple class loaders
    + S8207367: 10 vmTestbase/nsk/jdi tests timed out when running
    with jtreg
    + S8207832: serviceability/sa/ClhsdbCDSCore.java failed with
    "Couldn't find core file location"
    + S8207938: At step6,Click Add button,case failed automatically.
    + S8208157: requires.VMProps throws NPE for missing properties
    in "release" file
    + S8208379: compiler/jvmci/events/
    /JvmciNotifyInstallEventTest.java failed with "Got unexpected
    event count after 2nd install attempt: expected 9 to equal 2"
    + S8208658: Make CDS archived heap regions usable even if
    compressed oop encoding has changed
    + S8208715: Conversion of milliseconds to nanoseconds in
    UNIXProcess contains bug
    + S8209361: [AOT] Unexpected number of references for
    JVMTI_HEAP_REFERENCE_CONSTANT_POOL [111--&gt;111]: 0 (expected
    at least 1)
    + S8209385: CDS runtime classpath checking is too strict when
    only classes from the system modules are archived
    + S8209389: SIGSEGV in WalkOopAndArchiveClosure::do_oop_work.
    + S8209418: Synchronize test/jdk/sanity/client/lib/jemmy with
    code-tools/jemmy/v2
    + S8209494: Create a test for SwingSet InternalFrameDemo
    + S8209499: Create test for SwingSet EditorPaneDemo
    + S8209574: [AOT] breakpoint events are generated in different
    threads does not meet expected count
    + S8209686: cleanup arguments to PhaseIdealLoop() constructor
    + S8209789: Synchronize test/jdk/sanity/client/lib/jemmy with
    code-tools/jemmy/v2
    + S8209802: Garbage collectors should register JFR types
    themselves to avoid build errors.
    + S8209807: improve handling exception in requires.VMProps
    + S8209817: stack is executable when building with Clang on
    Linux
    + S8209824: Improve the code coverage for ThreadLocal
    + S8209826: Undefined reference to os::write after JDK-8209657
    (filemap.hpp cleanup)
    + S8209850: Allow NamedThreads to use GlobalCounter critical
    sections
    + S8209976: Improve iteration over non-JavaThreads
    + S8209993: Create a test for SwingSet3 ToolTipDemo
    + S8210024: JFR calls virtual is_Java_thread from ~Thread()
    + S8210052: Enable testing for all the available look and feels
    in SwingSet3 demo tests
    + S8210055: Enable different look and feel tests in SwingSet3
    demo tests
    + S8210057: Enable different look and feels in SwingSet3 demo
    test InternalFrameDemoTest
    + S8210058: Algorithmic Italic font leans opposite angle in
    Printing
    + S8210220: [AOT] jdwp test cases are failing with error #
    ERROR: TEST FAILED: Cought IOException while receiving event
    packet
    + S8210289: ArchivedKlassSubGraphInfoRecord is incomplete
    + S8210459: Add support for generating compile_commands.json
    + S8210476: sun/security/mscapi/PrngSlow.java fails with Still
    too slow
    + S8210512: [Testbug] vmTestbase/nsk/jdi/ObjectReference/
    /referringObjects/referringObjects002/referringObjects002.java
    fails with unexpected size of
    ClassLoaderReference.referringObjects
    + S8210523: runtime/appcds/cacheObject/DifferentHeapSizes.java
    crash
    + S8210632: Add key exchange algorithm to
    javax/net/ssl/TLSCommon/CipherSuite.java
    + S8210699: Problem list tests which times out in Xcomp mode
    + S8210793: [JVMCI] AllocateCompileIdTest.java failed to find
    DiagnosticCommand.class
    + S8210910: Create test for FileChooserDemo
    + S8210994: Create test for SwingSet3 FrameDemo
    + S8211139: Increase timeout value in all tests under
    jdk/sanity/client/SwingSet/src
    + S8211160: Handle different look and feels in
    JInternalFrameOperator
    + S8211211: vmTestbase/metaspace/stressDictionary/
    /StressDictionary.java timeout
    + S8211322: Reduce the timeout of tooltip in SwingSet2DemoTest
    + S8211443: Enable different look and feels in SwingSet3 demo
    test SplitPaneDemoTest
    + S8211703: JInternalFrame : java.lang.AssertionError: cannot
    find the internal frame
    + S8211781: re-building fails after changing Graal sources
    + S8212897: Some improvements in the EditorPaneDemotest
    + S8212903: [TestBug] Tests test/jdk/javax/swing/LookAndFeel/
    /8145547/DemandGTK2.sh and DemandGTK3.sh fail on Ubuntu 18.04
    LTS
    + S8213009: Refactoring existing SunMSCAPI classes
    + S8213010: Supporting keys created with certmgr.exe
    + S8213168: Enable different look and feel tests in SwingSet3
    demo test FileChooserDemoTest
    + S8213348: jdk.internal.vm.compiler.management service
    providers missing in module descriptor
    + S8213906: Update arm devkits with libXrandr headers
    + S8213908: AssertionError in DeferredAttr at setOverloadKind
    + S8214124: [TESTBUG] Bugs in runtime/NMT/MallocStressTest.java
    + S8214344: C2: assert(con.basic_type() != T_ILLEGAL) failed:
    elembt=byte; loadbt=void; unsigned=0
    + S8214345: infinite recursion while checking super class
    + S8214471: Enable different look and feel tests in SwingSet3
    demo test ToolTipDemoTest
    + S8214534: Setting of THIS_FILE in the build is broken
    + S8214557: Filter out VM flags which don't affect AOT code
    generation
    + S8214578: [macos] Problem with backslashes on macOS/JIS
    keyboard: Java ignores system settings
    + S8214840: runtime/NMT/MallocStressTest.java timed out
    + S8214850: Rename vm_operations.?pp files to vmOperations.?pp
    files
    + S8214904: Test8004741.java failed due to "Too few ThreadDeath
    hits; expected at least 6 but saw only 5"
    + S8215322: add @file support to jaotc
    + S8215355: Object monitor deadlock with no threads holding the
    monitor (using jemalloc 5.1)
    + S8215396: JTabbedPane preferred size calculation is wrong for
    SCROLL_TAB_LAYOUT
    + S8216180: [AOT] compiler/intrinsics/bigInteger/TestMulAdd.java
    crashed with AOT enabled
    + S8216353: Use utility APIs introduced in org/netbeans/jemmy/
    /util/LookAndFeel class in client sanity test cases
    + S8216354: Syntax error in toolchain_windows.m4
    + S8216472: (se) Stack overflow during selection operation
    leads to crash (win)
    + S8216535: tools/jimage/JImageExtractTest.java timed out
    + S8217235: Create automated test for SwingSet
    ColorChooserDemoTest
    + S8217297: Add support for multiple look and feel for SwingSet
    SliderDemoTest
    + S8217338: [Containers] Improve systemd slice memory limit
    support
    + S8217613: [AOT] TEST_OPTS_AOT_MODULES doesn't work on mac
    + S8217634: RunTest documentation and usability update
    + S8217717: ZGC: Broken oop map in C1 load barrier stub
    + S8217728: Speed up incremental rerun of "make hotspot"
    + S8218268: Javac treats Manifest Class-Path entries as Paths
    instead of URLs
    + S8218662: Allow 204 responses with Content-Length:0
    + S8218882: NET_Writev is declared, NET_WriteV is defined
    + S8218889: Improperly use of the Optional API
    + S8219205: JFR file without license header
    + S8219597: (bf) Heap buffer state changes could provoke
    unexpected exceptions
    + S8219723: javax/net/ssl/compatibility/Compatibility.java
    failed on some SNI cases
    + S8220348: [ntintel] asserts about copying unaligned array
    + S8220451: jdi/EventQueue/remove/remove004 failed due to
    "ERROR: thread2 is not alive"
    + S8220456: jdi/EventQueue/remove_l/remove_l004 failed due to
    "TIMEOUT while waiting for event"
    + S8220479: java/nio/channels/Selector/SelectWithConsumer.java
    failed at testTwoChannels()
    + S8220613: java/util/Arrays/TimSortStackSize2.java times out
    with fastdebug build
    + S8220688: [TESTBUG] runtime/NMT/MallocStressTest.java timed
    out
    + S8220786: Create new switch to redirect error reporting
    output to stdout or stderr
    + S8221270: Duplicated synchronized keywords in SSLSocketImpl
    + S8221312: test/jdk/sanity/client/SwingSet/src/
    /ColorChooserDemoTest.java failed
    + S8221851: Use of THIS_FILE in hotspot invalidates precompiled
    header on Linux/GCC
    + S8221885: Add intermittent test in the JavaSound to the
    ProblemList
    + S8222264: Windows incremental build is broken with JDK-8217728
    + S8222391: javax/net/ssl/compatibility/Compatibility.java
    should be more flexible
    + S8222448: java/lang/reflect/PublicMethods/
    /PublicMethodsTest.java times out
    + S8222519: ButtonDemoScreenshotTest fails randomly with "still
    state to be reached"
    + S8222741: jdi/EventQueue/remove/remove004 fails due to
    VMDisconnectedException
    + S8223003: SunMSCAPI keys are not cleaned up
    + S8223063: Support CNG RSA keys
    + S8223158: Docked MacBook cannot start any Java Swing
    applications
    + S8223260: NamingManager should cache InitialContextFactory
    + S8223464: Improve version string for Oracle CI builds
    + S8223558: Java does not render Myanmar script correctly
    + S8223627: jdk-13+20 bundle name contains null instead of ea
    + S8223638: Replace wildcard address with loopback or local
    host in tests - part 6
    + S8223678: Add Visual Studio Code workspace generation support
    (for native code)
    + S8223727: com/sun/jndi/ldap/privconn/RunTest.java failed due
    to hang in LdapRequest.getReplyBer
    + S8223769: Assert triggers with -XX:+StressReflectiveCode
    + S8224187: Refactor arraycopy_prologue to allow ZGC read
    barriers on arraycopy
    + S8224475: JTextPane does not show images in HTML rendering
    + S8224673: Adjust permission for delayed starting of debugging
    + S8224705: Tests that need to be problem-listed or have
    printer resources
    + S8224778: test/jdk/demo/jfc/J2Ddemo/J2DdemoTest.java cannot
    find J2Ddemo.jar
    + S8224821: java/awt/Focus/NoAutotransferToDisabledCompTest/
    /NoAutotransferToDisabledCompTest.java fails linux-x64
    + S8224830: test/jdk/java/awt/Focus/
    /ModalExcludedWindowClickTest/
    /ModalExcludedWindowClickTest.java fails on linux-x64
    + S8224851: AArch64: fix warnings and errors with Clang and GCC
    8.3
    + S8224905: java/lang/ProcessBuilder/Basic.java#id1 failed with
    stream closed
    + S8225007: java/awt/print/PrinterJob/
    /LandscapeStackOverflow.java may hang
    + S8225105: java/awt/Focus/ShowFrameCheckForegroundTest/
    /ShowFrameCheckForegroundTest.java fails in Windows 10
    + S8225117: java/math/BigInteger/SymmetricRangeTests.java fails
    with ParseException
    + S8225128: Add exception for expiring DocuSign root to
    VerifyCACerts test
    + S8225130: Add exception for expiring Comodo roots to
    VerifyCACerts test
    + S8225144: [macos] In Aqua L&amp;F backspace key does not delete
    when Shift is pressed
    + S8225180: SignedObject with invalid Key not throwing the
    InvalidKeyException in Windows
    + S8225182: JNI exception pending in DestroyXIMCallback of
    awt_InputMethod.c:1327
    + S8225199: [Graal] compiler/jvmci/compilerToVM/
    /IsMatureVsReprofileTest.java fails with
  - XX:CompileThresholdScaling=0.1
    + S8225305: ProblemList java/lang/invoke/VarHandles tests
    + S8225350: compiler/jvmci/compilerToVM/IsCompilableTest.java
    timed out
    + S8225430: Replace wildcard address with loopback or local
    host in tests - part 14
    + S8225435: Upgrade IANA Language Subtag Registry to the latest
    for JDK14
    + S8225487: giflib legal file is missing attribution for
    openbsd-reallocarray.c
    + S8225567: Wrong file headers with 8202414 fix changeset
    + S8225684: [AOT] vmTestbase/vm/oom/production/
    /AlwaysOOMProduction tests fail with AOTed java.base
    + S8225766: Curve in certificate should not affect signature
    scheme when using TLSv1.3
    + S8225797: OldObjectSample event creates unexpected amount of
    checkpoint data
    + S8226381: ProblemList java/lang/reflect/PublicMethods/
    /PublicMethodsTest.java
    + S8226406: JVM fails to detect mismatched or corrupt CDS
    archive
    + S8226608: Hide the onjcmd option from the help output
    + S8226892: ActionListeners on JRadioButtons don't get notified
    when selection is changed with arrow keys
    + S8227112: exclude compiler/intrinsics/sha/sanity tests from
    AOT runs
    + S8227324: Upgrade to freetype 2.10.1
    + S8227528: TestAbortVMOnSafepointTimeout.java failed due to
    "RuntimeException: 'Safepoint sync time longer than' missing
    from stdout/stderr"
    + S8227645: Some tests in serviceability/sa run with fixed -Xmx
    values and risk running out of memory
    + S8227646: [TESTBUG] appcds/SharedArchiveConsistency timed out
    + S8227662: freetype seeks to index at the end of the font data
    + S8228479: Correct the format of ColorChooserDemoTest
    + S8228613: java.security.Provider#getServices order is no
    longer deterministic
    + S8228969: 2019-09-28 public suffix list update
    + S8229236: CriticalJNINatives: dll handling should be done in
    native thread state
    + S8229345: Memory leak due to vtable stubs not being shared on
    SPARC
    + S8229888: (zipfs) Updating an existing zip file does not
    preserve original permissions
    + S8229994: assert(false) failed: Bad graph detected in
    get_early_ctrl_for_expensive
    + S8230004: jdk/internal/jimage/JImageOpenTest.java runs no test
    + S8230235: Rendering HTML with empty img attribute and
    documentBaseKey cause Exception
    + S8230390: Problemlist SA tests with AOT
    + S8230400: Missing constant pool entry for a method in
    stacktrace
    + S8230459: Test failed to resume JVMCI CompilerThread
    + S8230480: check malloc/calloc results in java.desktop
    + S8230597: Update GIFlib library to the 5.2.1
    + S8230611: infinite loop in
    LogOutputList::wait_until_no_readers()
    + S8230624: [TESTBUG] Problemlist JFR
    compiler/TestCodeSweeper.java
    + S8230677: Should disable Escape Analysis if JVMTI capability
    can_get_owned_monitor_info was taken
    + S8230926: [macosx] Two apostrophes are entered instead of one
    with "U.S. International - PC" layout
    + S8231025: Incorrect method tag offset for big endian platform
    + S8231081: TestMetadataRetention fails due to missing symbol id
    + S8231387: java.security.Provider.getService returns random
    result due to race condition with mutating methods in the same
    class
    + S8231430: C2: Memory stomp in max_array_length() for
    T_ILLEGAL type
    + S8231445: check ZALLOC return values in awt coding
    + S8231507: Update Apache Santuario (XML Signature) to version
    2.1.4
    + S8231584: Deadlock with ClassLoader.findLibrary and
    System.loadLibrary call
    + S8231753: use more Posix functionality in aix
    os::print_os_info
    + S8231810: javax/net/ssl/templates/
    /SSLSocketSSLEngineTemplate.java fails intermittently with
    "java.lang.Exception: Unexpected EOF"
    + S8232003: (fs) Files.write can leak file descriptor in the
    exception case
    + S8232056: GetOwnedMonitorInfoWithEATest.java fails with ZGC:
    Heap too small
    + S8232060: add some initializations using sigemptyset in
    os_aix.cpp
    + S8232154: Update Mesa 3-D Headers to version 19.2.1
    + S8232167: Visual Studio install found through
  - -with-tools-dir value is discarded
    + S8232170: FSInfo#getJarClassPath throws an exception not
    declared in its throws clause
    + S8232200: [macos 10.15] Windows in fullscreen tests jumps
    around the screen
    + S8232207: Linux os::available_memory re-reads cgroup
    configuration on every invocation
    + S8232224: [TESTBUG] problemlist JFR TestLargeRootSet.java
    + S8232370: Refactor some com.sun.jdi tests to enable IDE
    integration
    + S8232433: [macos 10.15] java/awt/Window/
    /LocationAtScreenCorner/LocationAtScreenCorner.java may fail
    + S8232571: Add missing SIGINFO signal
    + S8232692: [TESTBUG] compiler/aot/fingerprint/
    /SelfChangedCDS.java fails when cds is disabled
    + S8232713: Update BCEL version to 6.3.1 in license file
    + S8232806: Introduce a system property to disable eager lambda
    initialization
    + S8232834: RunTest sometimes fails to produce valid
    exitcode.txt
    + S8232880: Update test documentation with additional settings
    for client UI tooltip tests
    + S8232950: SUNPKCS11 Provider incorrectly check key length for
    PSS Signatures.
    + S8233018: Add a new test to verify that DatagramSocket is not
    interruptible
    + S8233019: java.lang.Class.isPrimitive() (C1) returns wrong
    result if Klass* is aligned to 32bit
    + S8233032: assert(in_bb(n)) failed: must be
    + S8233078: fix minimal VM build on Linux ppc64(le)
    + S8233328: fix minimal VM build on Linux s390x
    + S8233383: Various minor fixes
    + S8233466: aarch64: remove unnecessary load of mdo when
    profiling return and parameters type
    + S8233491: Crash in AdapterHandlerLibrary::get_adapter with
    CDS due to code cache exhaustion
    + S8233529: loopTransform.cpp:2984: Error: assert(p_f-&gt;Opcode()
    == Op_IfFalse) failed
    + S8233548: Update CUP to v0.11b
    + S8233649: Update ProblemList.txt to exclude failing headful
    tests on macos
    + S8233656: assert(d-&gt;is_CFG() &amp;&amp; n-&gt;is_CFG()) failed: must
    have CFG nodes
    + S8233657: Intermittent NPE in Component.validate()
    + S8234288: Turkey Time Zone returns incorrect time zone name
    + S8234323: NULL-check return value of SurfaceData_InitOps on
    macosx
    + S8234339: replace JLI_StrTok in java_md_solinux.c
    + S8234340: Bump update version for OpenJDK: jdk-11.0.7
    + S8234350: assert(mode == ControlAroundStripMined &amp;&amp; (use ==
    sfpt || !use-&gt;is_reachable_from_root())) failed: missed a node
    + S8234386: [macos] NPE was thrown at expanding Choice from
    maximized frame
    + S8234397: add OS uptime information to os::print_os_info
    output
    + S8234423: Modifying ArrayList.subList().subList() resets
    modCount of subList
    + S8234466: Class loading deadlock involving
    X509Factory#commitEvent()
    + S8234501: remove obsolete NET_ReadV
    + S8234525: enable link-time section-gc for linux s390x to
    remove unused code
    + S8234610: MaxVectorSize set wrongly when UseAVX=3 is
    specified after JDK-8221092
    + S8234617: C1: Incorrect result of field load due to missing
    narrowing conversion
    + S8234723: javax/net/ssl/TLS tests support TLSv1.3
    + S8234724: javax/net/ssl/templates/
    /SSLSocketSSLEngineTemplate.java supports TLSv1.3
    + S8234741: enhance os::get_core_path on macOS
    + S8234769: Duplicate attribution in freetype.md
    + S8234786: Fix for JDK-8214578 breaks OS X 10.12 compatibility
    + S8234809: set relro in linker flags when building with gcc
    + S8234824: java/nio/channels/SocketChannel/AdaptSocket.java
    fails on Windows 10
    + S8235243: handle VS2017 15.9 and VS2019 in abstract_vm_version
    + S8235288: AVX 512 instructions inadvertently used on Xeon for
    small vector width operations
    + S8235325: build failure on Linux after 8235243
    + S8235383: C1 compilation fails with
  - XX:+PrintIRDuringConstruction -XX:+Verbose
    + S8235489: handle return values of sscanf calls in hotspot
    + S8235509: Backport for JDK-8209657 Refactor filemap.hpp to
    simplify integration with Serviceability Agent.
    + S8235510: java.util.zip.CRC32 performance drop after 8200067
    + S8235563: [TESTBUG] appcds/CommandLineFlagComboNegative.java
    does not handle archive mapping failure
    + S8235637: jhsdb jmap from OpenJDK 11.0.5 doesn't work if
    prelink is enabled
    + S8235671: enhance print_rlimit_info in os_posix
    + S8235744: PIT: test/jdk/javax/swing/text/html/
    /TestJLabelWithHTMLText.java times out in linux-x64
    + S8235904: Infinite loop when rendering huge lines
    + S8235998: [c2] Memory leaks during tracing after '8224193:
    stringStream should not use Resource Area'.
    + S8236039: JSSE Client does not accept status_request
    extension in CertificateRequest messages for TLS 1.3
    + S8236140: assert(!VerifyHashTableKeys || _hash_lock == 0)
    failed: remove node from hash table before modifying it
    + S8236179: C1 register allocation error with T_ADDRESS
    + S8236488: Support for configure option
  - -with-native-debug-symbols=internal is impossible on Windows
    + S8236500: Windows ucrt.dll should be looked up in versioned
    WINSDK subdirectory
    + S8236709: struct SwitchRange in HS violates C++ One
    Definition Rule
    + S8236848: [JDK 11u] make run-test-tier1 fails after backport
    of JDK-8232834
    + S8236873: Worker has a deadlock bug
    + S8237217: Incorrect G1StringDedupEntry type used in
    StringDedupTable destructor
    + S8237368: Problem with NullPointerException in RMI
    TCPEndpoint.read
    + S8237375: SimpleThresholdPolicy misses CounterDecay timestamp
    initialization
    + S8237508: Simplify JarFile.isInitializing
    + S8237540: Missing files in backport of JDK-8210910
    + S8237541: Missing files in backport of JDK-8236528
    + S8237600: Test SunJSSEFIPSInit fails on Ubuntu
    + S8237819: s390x - remove unused pd_zero_to_words_large
    + S8237869: exclude jtreg test security/infra/java/security/
    /cert/CertPathValidator/certification/LuxTrustCA.java because
    of instabilities
    + S8237879: make 4.3 breaks build
    + S8237945: CTW: C2 compilation fails with
    assert(just_allocated_object(alloc_ctl) == ptr) failed: most
    recent allo...
    + S8238225: Issues reported after replacing symlink at
    Contents/MacOS/libjli.dylib with binary
    + S8238247: CTW runner should sweep nmethods more aggressively
    + S8238366: CTW runner closes standard output on exit
    + S8238438: SuperWord::co_locate_pack picks memory state of
    first instead of last load
    + S8238502: sunmscapi.dll causing EXCEPTION_ACCESS_VIOLATION
    + S8238534: Deep sign macOS bundles before bundle archive is
    being created
    + S8238591: CTW: Split
    applications/ctw/modules/jdk_localedata.java
    + S8238596: AVX enabled by default for Skylake even when
    unsupported
    + S8238811: C2: assert(i &gt;= req() || i == 0 || is_Region() ||
    is_Phi()) with -XX:+VerifyGraphEdges
    + S8239005: [TESTBUG] test/hotspot/jtreg/runtime/
    /StackGuardPages/TestStackGuardPages.java: exeinvoke.c: must
    initialize static state before calling do_overflow()
    + S8239466: Loss of precision in counter decay calculation in
    11u backport of JDK-8237375
    + S8239856: [ntintel] asserts about copying unaligned array
    element
    + S8240724: [test] jdk11 downport of 8224475 misses binary file
    test/jdk/javax/swing/JTextPane/arrow.png
    + S8241296: Segfault in JNIHandleBlock::oops_do()
- Removed patch:
  * DependOnVariableHelper.patch
    + fixed upstream
- Added patch:
  * JDK-8228407.patch
    + fix crashes due to shared archive file mismatch</changelog>
  <changelog author="fstrba@suse.com" date="1594900800">- Update to upstream tag jdk-11.0.8+10 (July 2020 CPU, bsc#1174157)
  * Security fixes:
    + JDK-8230613: Better ASCII conversions
    + JDK-8231800: Better listing of arrays
    + JDK-8232014: Expand DTD support
    + JDK-8233234: Better Zip Naming
    + JDK-8233239, CVE-2020-14562: Enhance TIFF support
    + JDK-8233255: Better Swing Buttons
    + JDK-8234032: Improve basic calendar services
    + JDK-8234042: Better factory production of certificates
    + JDK-8234418: Better parsing with CertificateFactory
    + JDK-8234836: Improve serialization handling
    + JDK-8236191: Enhance OID processing
    + JDK-8236867, CVE-2020-14573: Enhance Graal interface handling
    + JDK-8237117, CVE-2020-14556: Better ForkJoinPool behavior
    + JDK-8237592, CVE-2020-14577: Enhance certificate verification
    + JDK-8238002, CVE-2020-14581: Better matrix operations
    + JDK-8238013: Enhance String writing
    + JDK-8238804: Enhance key handling process
    + JDK-8238842: AIOOBE in GIFImageReader.initializeStringTable
    + JDK-8238843: Enhanced font handing
    + JDK-8238920, CVE-2020-14583: Better Buffer support
    + JDK-8238925: Enhance WAV file playback
    + JDK-8240119, CVE-2020-14593: Less Affine Transformations
    + JDK-8240482: Improved WAV file playback
    + JDK-8241379: Update JCEKS support
    + JDK-8241522: Manifest improved jar headers redux
    + JDK-8242136, CVE-2020-14621: Better XML namespace handling
  * Other changes:
    + JDK-6933331: (d3d/ogl) java.lang.IllegalStateException:
    Buffers have not been created
    + JDK-7124307: JSpinner and changing value by mouse
    + JDK-8022574: remove HaltNode code after uncommon trap calls
    + JDK-8039082: [TEST_BUG] Test
    java/awt/dnd/BadSerializationTest/BadSerializationTest.java
    fails
    + JDK-8040630: Popup menus and tooltips flicker with previous
    popup contents when first shown
    + JDK-8044365: (dc) MulticastSendReceiveTests.java failing with
    ENOMEM when joining group (OS X 10.9)
    + JDK-8048215: [TESTBUG]
    java/lang/management/ManagementFactory/ThreadMXBeanProxy.java
    Expected non-null LockInfo
    + JDK-8051349: nsk/jvmti/scenarios/sampling/SP06/sp06t003 fails
    in nightly
    + JDK-8080353: JShell: Better error message on attempting to
    add default method
    + JDK-8139876: Exclude hanging nsk/stress/stack from execution
    with deoptimization enabled
    + JDK-8146090: java/lang/ref/ReachabilityFenceTest.java fails
    with -XX:+DeoptimizeALot
    + JDK-8153430: jdk regression test MletParserLocaleTest,
    ParserInfiniteLoopTest reduce default timeout
    + JDK-8156207: Resource allocated BitMaps are often cleared
    unnecessarily
    + JDK-8159740: JShell: corralled declarations do not have
    correct source to wrapper mapping
    + JDK-8175984: ICC_Profile has un-needed, not-empty finalize
    method
    + JDK-8176359: Frame#setMaximizedbounds not working properly in
    multi screen environments
    + JDK-8183369: RFC unconformity of HttpURLConnection with proxy
    + JDK-8187078: -XX:+VerifyOops finds numerous problems when
    running JPRT
    + JDK-8189861: Refactor CacheFind
    + JDK-8191169: java/net/Authenticator/B4769350.java failed
    intermittently
    + JDK-8191930: [Graal] emits unparseable XML into compile log
    + JDK-8193879: Java debugger hangs on method invocation
    + JDK-8196019: java/awt/Window/Grab/GrabTest.java fails on
    Windows
    + JDK-8196181: sun/java2d/GdiRendering/InsetClipping.java fails
    + JDK-8198000:
    java/awt/List/EmptyListEventTest/EmptyListEventTest.java
    debug assert on Windows
    + JDK-8198001: java/awt/Menu/WrongParentAfterRemoveMenu/
    /WrongParentAfterRemoveMenu.java debug assert on Windows
    + JDK-8198339: Test javax/swing/border/Test6981576.java is
    unstable
    + JDK-8200701: jdk/jshell/ExceptionsTest.java fails on Windows,
    after JDK-8198801
    + JDK-8203264: JNI exception pending in
    PlainDatagramSocketImpl.c:740
    + JDK-8203672: JNI exception pending in PlainSocketImpl.c
    + JDK-8203673: JNI exception pending in
    DualStackPlainDatagramSocketImpl.c:398
    + JDK-8204834: Fix confusing "allocate" naming in OopStorage
    + JDK-8205399: Set node color on pinned HashMap.TreeNode
    deletion
    + JDK-8205653: test/jdk/sun/management/jmxremote/bootstrap/
    /RmiRegistrySslTest.java and RmiSslBootstrapTest.sh fail with
    handshake_failure
    + JDK-8206179: com/sun/management/OperatingSystemMXBean/
    /GetCommittedVirtualMemorySize.java fails with Committed
    virtual memory size illegal value
    + JDK-8207334: VM times out in VM_HandshakeAllThreads::doit()
    with RunThese30M
    + JDK-8208277: Code cache heap (-XX:ReservedCodeCacheSize)
    doesn't work with 1GB LargePages
    + JDK-8209113: Use WeakReference for lastFontStrike for created
    Fonts
    + JDK-8209333: Socket reset issue for TLS 1.3 socket close
    + JDK-8209439: C2 library_call can potentially ignore Math.pow
    intrinsic or use null pointer
    + JDK-8209534: [TESTBUG]runtime/appcds/cacheObject/
    /ArchivedModuleCompareTest.java fails with EnableJVMCI.
    + JDK-8210147: adjust some WSAGetLastError usages in windows
    network coding
    + JDK-8210284: "assert((av &amp; 0x00000001) == 0) failed:
    unsupported V8" on Solaris 11.4
    + JDK-8210303: VM_HandshakeAllThreads fails assert with
    "failed: blocked and not walkable"
    + JDK-8210459: Add support for generating compile_commands.json
    + JDK-8210515: [TESTBUG]CheckArchivedModuleApp.java needs to
    check if EnableJVMCI is set.
    + JDK-8210788: Javadoc for Thread.join(long, int) should
    specify that it waits forever when both arguments are zero
    + JDK-8211301: [macos] support full window content options
    + JDK-8211332: Space for stub routines (code_size2) is too
    small on new Skylake CPUs
    + JDK-8211339: NPE during SSL handshake caused by
    HostnameChecker
    + JDK-8211392: compiler/profiling/
    /spectrapredefineclass_classloaders/Launcher.java times out
    in JDK12 CI
    + JDK-8211743: [AOT] crash in ScopeDesc::decode_body() when
    JVMTI walks AOT frames
    + JDK-8212154: [TESTBUG] CheckArchivedModuleApp fails with NPE
    when JVMCI is absent
    + JDK-8212167: JShell : Stack trace of exception has wrong line
    number
    + JDK-8212933: Thread-SMR: requesting a VM operation whilst
    holding a ThreadsListHandle can cause deadlocks
    + JDK-8212986: Make Visual Studio compiler check less strict
    + JDK-8213250: CDS archive creation aborts due to metaspace
    object allocation failure
    + JDK-8213516: jck test api/javax_accessibility/AccessibleState/
    /fields.html fails intermittent
    + JDK-8213947: ARM32: failed check_simd should set
    UsePopCountInstruction to false
    + JDK-8214418: half-closed SSLEngine status may cause
    application dead loop
    + JDK-8214440: ldap over a TLS connection negotiate failed with
    "javax.net.ssl.SSLPeerUnverifiedException: hostname of the
    server does not match the hostname in the server's
    certificate"
    + JDK-8214444: Wrong strncat limits in dfa.cpp
    + JDK-8214481: freetype path does not disable TrueType hinting
    with AA+FM hints
    + JDK-8214571: -Xdoclint of array serialField gives "error:
    array type not allowed here"
    + JDK-8214856: Errors with JSZip in web console after upgrade
    to 3.1.5
    + JDK-8214862: assert(proj != __null) at compile.cpp:3251
    + JDK-8215369: Jcstress pollute /var/tmp with temporary files.
    + JDK-8215551: Missing case label in nmethod::reloc_string_for()
    + JDK-8215555: TieredCompilation C2 threads can excessively
    block handshakes
    + JDK-8215711: Missing key_share extension for (EC)DHE key
    exchange should alert missing_extension
    + JDK-8216151: [Graal] Module
    jdk.internal.vm.compiler.management has not been granted
    accessClassInPackage.org.graalvm.compiler.debug
    + JDK-8216154: C4819 warnings at HotSpot sources on Windows
    + JDK-8216541: CompiledICHolders of VM locked unloaded nmethods
    are released too late
    + JDK-8217230: assert(t == t_no_spec) failure in
    NodeHash::check_no_speculative_types()
    + JDK-8217404: --with-jvm-features doesn't work when multiple
    features are explicitly disabled
    + JDK-8217447: Develop flag TraceICs is broken
    + JDK-8217606: LdapContext#reconnect always opens a new
    connection
    + JDK-8218807: Compilation database (compile_commands.json) may
    contain obsolete items
    + JDK-8219214: Infinite Loop in CodeSection::dump()
    + JDK-8219904: ClassCastException when calling
    FlightRecorderMXBean#getRecordings()
    + JDK-8219991: New fix of the deadlock in
    sun.security.ssl.SSLSocketImpl
    + JDK-8221121: applications/microbenchmarks are encountering
    crashes in tier5
    + JDK-8221445: FastSysexMessage constructor crashes MIDI
    receiption thread
    + JDK-8221482: Initialize VMRegImpl::regName[] earlier to
    prevent assert during PrintStubCode
    + JDK-8221741: ClassCastException can happen when
    fontconfig.properties is used
    + JDK-8221823: Requested JDialog width is ignored
    + JDK-8223108: Test java/awt/EventQueue/
    /NonComponentSourcePost.java is unstable
    + JDK-8223678: Add Visual Studio Code workspace generation
    support (for native code)
    + JDK-8223935: PIT: java/awt/font/WindowsIndicFonts.java fails
    on windows10
    + JDK-8224109: Text spaced incorrectly by drawString under
    rotation with fractional metric
    + JDK-8224632: testbug: java/awt/dnd/RemoveDropTargetCrashTest/
    /RemoveDropTargetCrashTest.java fails on MacOS
    + JDK-8224793: os::die() does not honor CreateCoredumpOnCrash
    option
    + JDK-8224847: gc/stress/TestReclaimStringsLeaksMemory.java
    fails with reserved greater than expected
    + JDK-8224931: disable JAOTC invokedynamic support until
    8223533 is fixed
    + JDK-8224997: ChaCha20-Poly1305 TLS cipher suite decryption
    throws ShortBufferException
    + JDK-8225068: Remove DocuSign root certificate that is
    expiring in May 2020
    + JDK-8225069: Remove Comodo root certificate that is expiring
    in May 2020
    + JDK-8225126: Test SetBoundsPaintTest.html faild on Windows
    when desktop is scaled
    + JDK-8225325: Add tests for redefining a class' private method
    during resolution of the bootstrap specifier
    + JDK-8225622: [AOT] runtime/SharedArchiveFile/
    /TestInterpreterMethodEntries.java crashed with AOTed
    java.base
    + JDK-8225653: Provide more information when hitting SIGILL
    from HaltNode
    + JDK-8225783: Incorrect use of binary operators on booleans in
    type.cpp
    + JDK-8225789: Empty method parameter type should generate
    ClassFormatError
    + JDK-8226198: use of &amp; instead of &amp;&amp; in
    LibraryCallKit::arraycopy_restore_alloc_state
    + JDK-8226253: JAWS reports wrong number of radio buttons when
    buttons are hidden.
    + JDK-8226653: [accessibility] Can edit text cell correctly,
    but Accessibility Tool reads nothing about editor
    + JDK-8226806: [macOS 10.14] Methods of Java Robot should be
    called from appropriate thread
    + JDK-8226879: Memory leak in Type::hashcons
    + JDK-8227632: Incorrect PrintCompilation message: made not
    compilable on levels 0 1 2 3 4
    + JDK-8228407: JVM crashes with shared archive file mismatch
    + JDK-8228482: fix xlc16/xlclang comparison of distinct pointer
    types and string literal conversion warnings
    + JDK-8228757: Fail fast if the handshake type is unknown
    + JDK-8229158: make UseSwitchProfiling non-experimental or
    false by-default
    + JDK-8229421: The logic of java/net/ipv6tests/TcpTest.java is
    flawed
    + JDK-8229855: C2 fails with assert(false) failed: bad AD file
    + JDK-8230591: AArch64: Missing intrinsics for Math.ceil,
    floor, rint
    + JDK-8231118: ARM32: Math tests failures
    + JDK-8231213: Migrate SimpleDateFormatConstTest to JDK Repo
    + JDK-8231243: [TESTBUG] CustomFont.java cannot find font file
    + JDK-8231438: [macOS] Dark mode for the desktop is not
    supported
    + JDK-8231550: C2: ShouldNotReachHere() in
    verify_strip_mined_scheduling
    + JDK-8231564: setMaximizedBounds is broken with large display
    scale and multiple monitors
    + JDK-8231572: Use -lobjc instead of -fobjc-link-runtime in
    libosxsecurity
    + JDK-8231631: sun/net/ftp/FtpURLConnectionLeak.java fails
    intermittently with NPE
    + JDK-8231671: Fix copyright headers in hotspot (missing comma
    after year)
    + JDK-8231720: Some perf regressions after 8225653
    + JDK-8231779: crash
    HeapWord*ParallelScavengeHeap::failed_mem_allocate
    + JDK-8231863: Crash if classpath is read from @argument file
    and the main gets option argument
    + JDK-8232080: jlink plugins for vendor information and
    run-time options
    + JDK-8232106: [x86] C2: SIGILL due to usage of SSSE3
    instructions on processors which don't support it
    + JDK-8232134: Change to Visual Studio 2017 15.9.16 for
    building on Windows at Oracle
    + JDK-8232226: [macos 10.15] test/jdk/java/awt/color/
    /EqualityTest/EqualityTest.java may fail
    + JDK-8232357: Compare version info of Santuario to legal notice
    + JDK-8232572: Add hooks for custom output dir in Bundles.gmk
    + JDK-8232634: Problem List ICMColorDataTest.java
    + JDK-8232748: Build static versions of certain JDK libraries
    + JDK-8232846: ProcessHandle.Info command with non-English
    shows question marks
    + JDK-8232880: Update test documentation with additional
    settings for client UI tooltip tests
    + JDK-8233033: C2 produces wrong result while unswitching a
    loop due to lost control dependencies
    + JDK-8233137: runtime/ErrorHandling/VeryEarlyAssertTest.java
    fails after 8232080
    + JDK-8233197: Invert JvmtiExport::post_vm_initialized() and
    Jfr:on_vm_start() start-up order for correct option parsing
    + JDK-8233291: [TESTBUG] tools/jlink/plugins/
    /VendorInfoPluginsTest.java fails with debug or non-server VMs
    + JDK-8233364: Fix undefined behavior in
    Canonicalizer::do_ShiftOp
    + JDK-8233494: Avoid calling MallocTracker::record_malloc and
    record_free when NMT is off
    + JDK-8233573: Toolkit.getScreenInsets(GraphicsConfiguration)
    may throw ClassCastException
    + JDK-8233608: Minimal build broken after JDK-8233494
    + JDK-8233621: Mismatch in jsse.enableMFLNExtension property
    name
    + JDK-8233696: [TESTBUG]Some jtreg tests fail when CAPS_LOCK is
    ON
    + JDK-8233707: systemScale.cpp could not compile with VS2019
    + JDK-8233801: GCMEmptyIv.java test fails on Solaris 11.4
    + JDK-8233880: Support compilers with multi-digit major version
    numbers
    + JDK-8233920: MethodHandles::tryFinally generates illegal
    bytecode for long/double return type
    + JDK-8234137: The "AutoTestOnTop.java" test may run external
    applications
    + JDK-8234146: compiler/jsr292/
    /ContinuousCallSiteTargetChange.java times out on SPARC
    + JDK-8234184: [TESTBUG] java/awt/Mouse/EnterExitEvents/
    /ModalDialogEnterExitEventsTest.java fails in Windows
    + JDK-8234270: [REDO] JDK-8204128 NMT might report incorrect
    numbers for Compiler area
    + JDK-8234332: [TESTBUG] java/awt/Focus/DisposedWindow/
    /DisposeDialogNotActivateOwnerTest/
    /DisposeDialogNotActivateOwnerTest.java fails on linux-x64
    nightly
    + JDK-8234398: Replace ID2D1Factory::GetDesktopDpi with
    GetDeviceCaps
    + JDK-8234522: [macos] Crash with use of native file dialog
    + JDK-8234691: Potential double-free in ParallelSPCleanupTask
    constructor
    + JDK-8234696: tools/jlink/plugins/VendorInfoPluginsTest.java
    times out
    + JDK-8234727: sun/security/ssl/X509TrustManagerImpl tests
    support TLSv1.3
    + JDK-8234728: Some security tests should support TLSv1.3
    + JDK-8234779: Provide idiom for declaring classes noncopyable
    + JDK-8234824: java/nio/channels/SocketChannel/AdaptSocket.java
    fails on Windows 10
    + JDK-8234968: check calloc rv in libinstrument
    InvocationAdapter
    + JDK-8235153: [TESTBUG] [macos 10.15] java/awt/Graphics/
    /DrawImageBG/SystemBgColorTest.java fails
    + JDK-8235183: Remove the "HACK CODE" in comment
    + JDK-8235263: Revert TLS 1.3 change that wrapped IOExceptions
    + JDK-8235311: Tag mismatch may alert bad_record_mac
    + JDK-8235332: TestInstanceCloneAsLoadsStores.java fails with
  - XX:+StressGCM
    + JDK-8235452: Strip mined loop verification fails with
    assert(is_OuterStripMinedLoop()) failed: invalid node class
    + JDK-8235584: UseProfiledLoopPredicate fails with
    assert(_phase-&gt;get_loop(c) == loop) failed: have to be in the
    same loop
    + JDK-8235620: Broken merge between JDK-8006406 and JDK-8003559
    + JDK-8235638: NPE in LWWindowPeer.getOnscreenGraphics()
    + JDK-8235686: Add more custom hooks in Bundles.gmk
    + JDK-8235739: Rare NPE at WComponentPeer.getGraphics()
    + JDK-8235762: JVM crash in SWPointer during C2 compilation
    + JDK-8235834: IBM-943 charset encoder needs updating
    + JDK-8235874: The ordering of Cipher Suites is not maintained
    provided through jdk.tls.client.cipherSuites and
    jdk.tls.server.cipherSuites system property.
    + JDK-8235908: omit ThreadPriorityPolicy warning when value is
    set from image
    + JDK-8235984: C2: assert(out-&gt;in(PhiNode::Region) == head ||
    out-&gt;in(PhiNode::Region) == slow_head) failed: phi must be
    either part of the slow or the fast loop
    + JDK-8236211: [Graal] compiler/graalunit/GraphTest.java is
    skipped in all testing
    + JDK-8236470: Deal with ECDSA using ecdsa-with-SHA2 plus hash
    algorithm as AlgorithmId
    + JDK-8236545: Compilation error in mach5
    java/awt/FileDialog/MacOSGoToFolderCrash.java
    + JDK-8236700: Upgrading JSZip from v3.1.5 to v3.2.2
    + JDK-8236759: ShouldNotReachHere in
    PhaseIdealLoop::verify_strip_mined_scheduling
    + JDK-8236897: Fix the copyright header for pkcs11gcm2.h
    + JDK-8236921: Add build target to produce a JDK image suitable
    for a Graal/SVM build
    + JDK-8236953: [macos] JavaFX SwingNode is not rendered on macOS
    + JDK-8236996: Incorrect Roboto font rendering on Windows with
    subpixel antialiasing
    + JDK-8237045: JVM uses excessive memory with -XX:+EnableJVMCI
  - XX:JVMCICounterSize=2147483648
    + JDK-8237055: [TESTBUG] compiler/c2/TestJumpTable.java fails
    with release VMs
    + JDK-8237086: assert(is_MachReturn()) running CTW with fix for
    JDK-8231291
    + JDK-8237192: Generate stripped/public pdbs on Windows for jdk
    images
    + JDK-8237396: JvmtiTagMap::weak_oops_do() should not trigger
    barriers
    + JDK-8237474: Default SSLEngine should create in server role
    + JDK-8237859: C2: Crash when loads float above range check
    + JDK-8237879: make 4.3 breaks build
    + JDK-8237951: CTW: C2 compilation fails with "malformed
    control flow"
    + JDK-8237962: give better error output for invalid OCSP
    response intervals in CertPathValidator checks
    + JDK-8238190: [JVMCI] Fix single implementor speculation for
    diamond shapes.
    + JDK-8238356: CodeHeap::blob_count() overestimates the number
    of blobs
    + JDK-8238452: Keytool generates wrong expiration date if
    validity is set to 2050/01/01
    + JDK-8238555: Allow Initialization of SunPKCS11 with NSS when
    there are external FIPS modules in the NSSDB
    + JDK-8238575: DragSourceEvent.getLocation() returns wrong
    value on HiDPI screens (Windows)
    + JDK-8238676: jni crashes on accessing it from process exit
    hook
    + JDK-8238721: Add failing client jtreg tests to the Problem
    List
    + JDK-8238738: AudioSystem.getMixerInfo() takes about 30 sec to
    report a gone audio device
    + JDK-8238756: C2: assert(((n) == __null || !VerifyIterativeGVN
    || !((n)-&gt;is_dead()))) failed: can not use dead node
    + JDK-8238765: PhaseCFG::schedule_pinned_nodes cannot handle
    precedence edges from unmatched CFG nodes correctly
    + JDK-8238898: Missing hash characters for header on license
    file
    + JDK-8238942: Rendering artifacts with LCD text and fractional
    metrics
    + JDK-8238985: [TESTBUG] The arrow image is blue instead of
    green
    + JDK-8239000: handle ContendedPaddingWidth in vm_version_ppc
    + JDK-8239055: Wrong implementation of VMState.hasListener
    + JDK-8239091: Reversed arguments in call to strstr in freetype
    "debug" code.
    + JDK-8239142: C2's UseUniqueSubclasses optimization is broken
    for array accesses
    + JDK-8239224: libproc_impl.c previous_thr may be used
    uninitialized warning
    + JDK-8239351: Give more meaningful InternalError messages in
    Deflater.c
    + JDK-8239365: ProcessBuilder test modifications for AIX
    execution
    + JDK-8239456: vtable stub generation: assert failure (code
    size estimate)
    + JDK-8239457: call ReleaseStringUTFChars before early returns
    in Java_sun_security_pkcs11_wrapper_PKCS11_connect
    + JDK-8239462: jdk.hotspot.agent misses some
    ReleaseStringUTFChars calls in case of early returns
    + JDK-8239557: [TESTBUG] VeryEarlyAssertTest.java validating
    "END." marker at lastline is not always true
    + JDK-8239787: AArch64: String.indexOf may incorrectly handle
    empty strings
    + JDK-8239792: Bump update version for OpenJDK: jdk-11.0.8
    + JDK-8239798: SSLSocket closes socket both socket endpoints on
    a SocketTimeoutException
    + JDK-8239819: XToolkit: Misread of screen information memory
    + JDK-8239852: java/util/concurrent tests fail with
  - XX:+VerifyGraphEdges: assert(!VerifyGraphEdges) failed:
    verification should have failed
    + JDK-8239893: Windows handle Leak when starting processes
    using ProcessBuilder
    + JDK-8239915: Zero VM crashes when handling dynamic constant
    + JDK-8239931: [win][x86] vtable stub generation: assert
    failure (code size estimate) follow-up
    + JDK-8239965: XMLEncoder/Test4625418.java fails due to "Error:
    Cp943 - can't read properly"
    + JDK-8239976: Put JDK-8239965 on the ProblemList.txt
    + JDK-8240073: Fix 'test-make' build target in 11u
    + JDK-8240197: Cannot start JVM when $JAVA_HOME includes CJK
    characters
    + JDK-8240202: A few client tests leave mouse buttons pressed
    + JDK-8240220: IdealLoopTree::dump_head predicate printing is
    broken
    + JDK-8240223: Use consistent predicate order in and with
    PhaseIdealLoop::find_predicate
    + JDK-8240227: Loop predicates should be copied to unswitched
    loops
    + JDK-8240286: [TESTBUG] Test command error in hotspot/jtreg/
    /compiler/loopopts/superword/SumRedAbsNeg_Float.java
    + JDK-8240518: Incorrect JNU_ReleaseStringPlatformChars in
    Windows Print
    + JDK-8240529: CheckUnhandledOops breaks NULL check in
    Modules::define_module
    + JDK-8240576: JVM crashes after transformation in C2
    IdealLoopTree::merge_many_backedges
    + JDK-8240603: Windows 32bit compile error after 8238676
    + JDK-8240629: argfiles parsing broken for argfiles with
    comment cross 4096 bytes chunk
    + JDK-8240711: TestJstatdPort.java failed due to
    "ExportException: Port already in use:"
    + JDK-8240786: [TESTBUG] The test java/awt/Window/
    /GetScreenLocation/GetScreenLocationTest.java fails on HiDPI
    screen
    + JDK-8240824: enhance print_full_memory_info on Linux by THP
    related information
    + JDK-8240827: Downport SSLSocketImpl.java from "8221882: Use
    fiber-friendly java.util.concurrent.locks in JSSE"
    + JDK-8240905: assert(mem == (Node*)1 || mem == mem2) failed:
    multiple Memories being matched at once?
    + JDK-8240972: macOS codesign fail on macOS 10.13.5 or older
    + JDK-8241445: Fix copyright in
    test/jdk/tools/launcher/ArgFileSyntax.java
    + JDK-8241458: [JVMCI] add mark value to expose
    CodeOffsets::Frame_Complete
    + JDK-8241464: [11u] Backport: make rehashing be a needed
    guaranteed safepoint cleanup action
    + JDK-8241556: Memory leak if -XX:CompileCommand is set
    + JDK-8241568: (fs) UserPrincipalLookupService.lookupXXX
    failure with IOE "Operation not permitted"
    + JDK-8241586: compiler/cpuflags/
    /TestAESIntrinsicsOnUnsupportedConfig.java fails on aarch64
    + JDK-8241638: launcher time metrics always report 1 on Linux
    when _JAVA_LAUNCHER_DEBUG set
    + JDK-8241660: Add virtualization information output to hs_err
    file on macOS
    + JDK-8241808: [TESTBUG] The JDK-8039467 bug appeared on macOS
    + JDK-8241888: Mirror jdk.security.allowNonCaAnchor system
    property with a security one
    + JDK-8241900: Loop unswitching may cause dependence on null
    check to be lost
    + JDK-8241948: enhance list of environment variables printed in
    hs_err file
    + JDK-8241996: on linux set full relro in the linker flags
    + JDK-8242108: Performance regression after fix for JDK-8229496
    + JDK-8242141: New System Properties to configure the TLS
    signature schemes
    + JDK-8242154: Backport parts of JDK-4947890 to OpenJDK 11u
    + JDK-8242174: [macos] The NestedModelessDialogTest test make
    the macOS unstable
    + JDK-8242239: [Graal] javax/management/generified/
    /GenericTest.java fails: FAILED: queryMBeans sets same
    + JDK-8242294: JSSE Client does not throw SSLException when an
    alert occurs during handshaking
    + JDK-8242379: [TESTBUG] compiler/loopopts/
    /TestLoopUnswitchingLostCastDependency.java fails with
    release VMs
    + JDK-8242470: Update Xerces to Version 2.12.1
    + JDK-8242498: Invalid "sun.awt.TimedWindowEvent" object leads
    to JVM crash
    + JDK-8242541: Small charset issues (ISO8859-16, x-eucJP-Open,
    x-IBM834 and x-IBM949C)
    + JDK-8242626: enhance posix print_rlimit_info
    + JDK-8243059: Build fails when --with-vendor-name contains a
    comma
    + JDK-8243539: Copyright info (Year) should be updated for fix
    of 8241638
    + JDK-8243541: (tz) Upgrade time-zone data to tzdata2020a
    + JDK-8244407: JVM crashes after transformation in C2
    IdealLoopTree::split_fall_in
    + JDK-8244520: problemlist
    java/awt/font/Rotate/RotatedFontTest.java on linux
    + JDK-8244777: ClassLoaderStats VM Op uses constant hash value
    + JDK-8244853: The static build of libextnet is missing the
    JNI_OnLoad_extnet function
    + JDK-8244951: Missing entitlements for hardened runtime
    + JDK-8245047: [PPC64] C2: ReverseBytes + Load always match to
    unordered Load (acquire semantics missing)
    + JDK-8245649: Revert 8245397 backport of 8230591
    + JDK-8246031: SSLSocket.getSession() doesn't close connection
    for timeout/ interrupts
    + JDK-8246613: Choose the default SecureRandom algo based on
    registration ordering
    + JDK-8248505: Unexpected NoSuchAlgorithmException when using
    secure random impl from BCFIPS provider
- Removed patch:
  * JDK-8228407.patch
    + integrated upstream</changelog>
  <changelog author="fstrba@suse.com" date="1604318400">- Update to upstream tag jdk-11.0.9-11 (October 2020 CPU,
  bsc#1177943)
  * New features
    + JDK-8250784: Shenandoah: A Low-Pause-Time Garbage Collector
  * Security fixes
    + JDK-8233624: Enhance JNI linkage
    + JDK-8236196: Improve string pooling
    + JDK-8236862, CVE-2020-14779: Enhance support of Proxy class
    + JDK-8237990, CVE-2020-14781: Enhanced LDAP contexts
    + JDK-8237995, CVE-2020-14782: Enhance certificate processing
    + JDK-8240124: Better VM Interning
    + JDK-8241114, CVE-2020-14792: Better range handling
    + JDK-8242680, CVE-2020-14796: Improved URI Support
    + JDK-8242685, CVE-2020-14797: Better Path Validation
    + JDK-8242695, CVE-2020-14798: Enhanced buffer support
    + JDK-8243302: Advanced class supports
    + JDK-8244136, CVE-2020-14803: Improved Buffer supports
    + JDK-8244479: Further constrain certificates
    + JDK-8244955: Additional Fix for JDK-8240124
    + JDK-8245407: Enhance zoning of times
    + JDK-8245412: Better class definitions
    + JDK-8245417: Improve certificate chain handling
    + JDK-8248574: Improve jpeg processing
    + JDK-8249927: Specify limits of jdk.serialProxyInterfaceLimit
    + JDK-8253019: Enhanced JPEG decoding
  * Other changes
    + JDK-6532025: GIF reader throws misleading exception with
    truncated images
    + JDK-6949753: [TEST BUG]: java/awt/print/PageFormat/
    /PDialogTest.java needs update by removing an infinite loop
    + JDK-8022535: [TEST BUG] javax/swing/text/html/parser/
    /Test8017492.java fails
    + JDK-8062947: Fix exception message to correctly represent
    LDAP connection failure
    + JDK-8067354: com/sun/jdi/GetLocalVariables4Test.sh failed
    + JDK-8134599: TEST_BUG: java/rmi/transport/closeServerSocket/
    /CloseServerSocket.java fails intermittently with Address
    already in use
    + JDK-8151678: com/sun/jndi/ldap/LdapTimeoutTest.java failed
    due to timeout on DeadServerNoTimeoutTest is incorrect
    + JDK-8160768: Add capability to custom resolve host/domain
    names within the default JNDI LDAP provider
    + JDK-8172404: Tools should warn if weak algorithms are used
    before restricting them
    + JDK-8193367: Annotated type variable bounds crash javac
    + JDK-8202117: com/sun/jndi/ldap/RemoveNamingListenerTest.java
    fails intermittently: Connection reset
    + JDK-8203026: java.rmi.NoSuchObjectException: no such object
    in table
    + JDK-8203281: [Windows] JComboBox change in ui when
    editor.setBorder() is called
    + JDK-8203382: Rename SystemDictionary::initialize_wk_klass to
    resolve_wk_klass
    + JDK-8203393: com/sun/jdi/JdbMethodExitTest.sh and
    JdbExprTest.sh fail due to timeout
    + JDK-8203928: [Test] Convert non-JDB scaffolding
    serviceability shell script tests to java
    + JDK-8204963: javax.swing.border.TitledBorder has a memory leak
    + JDK-8204994: SA might fail to attach to process with "Windbg
    Error: WaitForEvent failed"
    + JDK-8205534: Remove SymbolTable dependency from
    serviceability agent
    + JDK-8206309: Tier1 SA tests fail
    + JDK-8208281: java/nio/channels/
    /AsynchronousSocketChannel/Basic.java timed out
    + JDK-8209109: [TEST] rewrite com/sun/jdi shell tests to java
    version - step1
    + JDK-8209332: [TEST] test/jdk/com/sun/jdi/CatchPatternTest.sh
    is incorrect
    + JDK-8209342: Problemlist SA tests on Solaris due to Error
    attaching to process: Can't create thread_db agent!
    + JDK-8209343: Test javax/swing/border/TestTitledBorderLeak.java
    should be marked as headful
    + JDK-8209517: com/sun/jdi/BreakpointWithFullGC.java fails with
    timeout
    + JDK-8209604: [TEST] rewrite com/sun/jdi shell tests to java
    version - step2
    + JDK-8209605: com/sun/jdi/BreakpointWithFullGC.java fails with
    ZGC
    + JDK-8209608: Problem list com/sun/jdi/BreakpointWithFullGC.java
    + JDK-8210131: vmTestbase/nsk/jvmti/scenarios/allocation/AP10/
    /ap10t001/TestDescription.java failed with ObjectFree:
    GetCurrentThreadCpuTimerInfo returned unexpected error code
    + JDK-8210243: [TEST] rewrite com/sun/jdi shell tests to java
    version - step3
    + JDK-8210527: JShell: NullPointerException in
    jdk.jshell.Eval.translateExceptionStack
    + JDK-8210560: [TEST] convert com/sun/jdi redefineClass-related
    tests
    + JDK-8210725: com/sun/jdi/RedefineClearBreakpoint.java fails
    with waitForPrompt timed out after 60 seconds
    + JDK-8210748: [TESTBUG] lib.jdb.Jdb.waitForPrompt() should
    clarify which output is the pending reply after a timeout
    + JDK-8210760: [TEST] rewrite com/sun/jdi shell tests to java
    version - step4
    + JDK-8210977: jdk/jfr/event/oldobject/TestThreadLocalLeak.java
    fails to find ThreadLocalObject
    + JDK-8211292: [TEST] convert com/sun/jdi/DeferredStepTest.sh
    test
    + JDK-8211694: JShell: Redeclared variable should be reset
    + JDK-8212200: assert when shared java.lang.Object is redefined
    by JVMTI agent
    + JDK-8212629: [TEST] wrong breakpoint in
    test/jdk/com/sun/jdi/DeferredStepTest
    + JDK-8212665: com/sun/jdi/DeferredStepTest.java: jj1 (line 57)
  - unexpected. lastLine=52, minLine=52, maxLine=55
    + JDK-8212807: tools/jar/multiRelease/Basic.java times out
    + JDK-8213182: Minimal VM build failure after JDK-8212200
    (assert when shared java.lang.Object is redefined by JVMTI
    agent)
    + JDK-8213214: Set -Djava.io.tmpdir= when running tests
    + JDK-8213275: ReplaceCriticalClasses.java fails with
    jdk.internal.vm.PostVMInitHook not found
    + JDK-8213574: Deadlock in string table expansion when dumping
    lots of CDS classes
    + JDK-8213703: LambdaConversionException: Invalid receiver type
    not a subtype of implementation type interface
    + JDK-8214074: Ghash optimization using AVX instructions
    + JDK-8214491: Upgrade to JLine 3.9.0
    + JDK-8214797: TestJmapCoreMetaspace.java timed out
    + JDK-8215243: JShell tests failing intermitently with
    "Problem cleaning up the following threads:"
    + JDK-8215244: jdk/jshell/ToolBasicTest.java
    testHistoryReference failed
    + JDK-8215354: x86_32 build failures after JDK-8214074 (Ghash
    optimization using AVX instructions)
    + JDK-8215438: jshell tool: Ctrl-D causes EOF
    + JDK-8216021: RunTest.gmk might set concurrency level to 1 on
    Windows
    + JDK-8216974: HttpConnection not returned to the pool after
    204 response
    + JDK-8218948: SimpleDateFormat :: format - Zone Names are not
    reflected correctly during run time
    + JDK-8219712: code_size2 (defined in stub_routines_x86.hpp) is
    too small on new Skylake CPUs
    + JDK-8220150: macos10.14 Mojave returns anti-aliased glyphs
    instead of aliased B&amp;W glyphs
    + JDK-8221658: aarch64: add necessary predicate for ubfx
    patterns
    + JDK-8221759: Crash when completing "java.io.File.path"
    + JDK-8221918: runtime/SharedArchiveFile/serviceability/
    /ReplaceCriticalClasses.java fails: Shared archive not found
    + JDK-8222074: Enhance auto vectorization for x86
    + JDK-8222079: Don't use memset to initialize fields decode_env
    constructor in disassembler.cpp
    + JDK-8222769: [TESTBUG] TestJFRNetworkEvents should not rely
    on hostname command
    + JDK-8223688: JShell: crash on the instantiation of raw
    anonymous class
    + JDK-8223777: In posix_spawn mode, failing to exec()
    jspawnhelper does not result in an error
    + JDK-8223940: Private key not supported by chosen signature
    algorithm
    + JDK-8224184: jshell got IOException at exiting with AIX
    + JDK-8224234: compiler/codegen/TestCharVect2.java fails in
    test_mulc
    + JDK-8225037: java.net.JarURLConnection::getJarEntry() throws
    NullPointerException
    + JDK-8225625: AES Electronic Codebook (ECB) encryption and
    decryption optimization using AVX512 + VAES instructions
    + JDK-8226536: Catch OOM from deopt that fails rematerializing
    objects
    + JDK-8226575: OperatingSystemMXBean should be made container
    aware
    + JDK-8226697: Several tests which need the @key headful
    keyword are missing it.
    + JDK-8226809: Circular reference in printed stack trace is not
    correctly indented &amp; ambiguous
    + JDK-8227059: sun/security/tools/keytool/
    /DefaultSignatureAlgorithm.java timed out
    + JDK-8227269: Slow class loading when running with JDWP
    + JDK-8227595: keytool/fakegen/DefaultSignatureAlgorithm.java
    fails due to "exitValue = 6"
    + JDK-8228448: Jconsole can't connect to itself
    + JDK-8228967: Trust/Key store and SSL context utilities for
    tests
    + JDK-8229378: jdwp library loader in linker_md.c quietly
    truncates on buffer overflow
    + JDK-8229815: Upgrade Jline to 3.12.1
    + JDK-8230000: some httpclients testng tests run zero test
    + JDK-8230002: javax/xml/jaxp/unittest/transform/
    /SecureProcessingTest.java runs zero test
    + JDK-8230010: Remove jdk8037819/BasicTest1.java
    + JDK-8230094: CCE in createXMLEventWriter(Result) over an
    arbitrary XMLStreamWriter
    + JDK-8230402: Allocation of compile task fails with assert:
    "Leaking compilation tasks?"
    + JDK-8230767: FlightRecorderListener returns null recording
    + JDK-8230870: (zipfs) Add a ZIP FS test that is similar to
    test/jdk/java/util/zip/EntryCount64k.java
    + JDK-8231209: [REDO] ThreadMXBean::getThreadAllocatedBytes()
    can be quicker for self thread
    + JDK-8231586: enlarge encoding space for OopMapValue offsets
    + JDK-8231953: Wrong assumption in assertion in
    oop::register_oop
    + JDK-8231968: getCurrentThreadAllocatedBytes default
    implementation s/b getThreadAllocatedBytes
    + JDK-8232083: Minimal VM is broken after JDK-8231586
    + JDK-8232161: Align some one-way conversion in MS950 charset
    with Windows
    + JDK-8232855: jshell missing word in /help help
    + JDK-8233027: OopMapSet::all_do does oms.next() twice during
    iteration
    + JDK-8233228: Disable weak named curves by default in TLS,
    CertPath, and Signed JAR
    + JDK-8233386: Initialize NULL fields for unused decorations
    + JDK-8233452: java.math.BigDecimal.sqrt() with
    RoundingMode.FLOOR results in incorrect result
    + JDK-8233686: XML transformer uses excessive amount of memory
    + JDK-8233741: AES Countermode (AES-CTR) optimization using
    AVX512 + VAES instructions
    + JDK-8233829: javac cannot find non-ASCII module name under
    non-UTF8 environment
    + JDK-8233958: Memory retention due to HttpsURLConnection
    finalizer that serves no purpose
    + JDK-8234011: (zipfs) Memory leak in
    ZipFileSystem.releaseDeflater()
    + JDK-8234058: runtime/CompressedOops/
    /CompressedClassPointers.java fails with 'Narrow klass base:
    0x0000000000000000' missing from stdout/stderr
    + JDK-8234149: Several regression tests do not dispose Frame at
    end
    + JDK-8234347: "Turkey" meta time zone does not generate
    composed localized names
    + JDK-8234385: [TESTBUG] java/awt/EventQueue/6980209/
    /bug6980209.java fails in linux nightly
    + JDK-8234535: Cross compilation fails due to missing CFLAGS
    for the BUILD_CC
    + JDK-8234541: C1 emits an empty message when it inlines
    successfully
    + JDK-8234687: change javap reporting on unknown attributes
    + JDK-8236464: SO_LINGER option is ignored by SSLSocket in JDK
    11
    + JDK-8236548: Localized time zone name inconsistency between
    English and other locales
    + JDK-8236617: jtreg test containers/docker/
    /TestMemoryAwareness.java fails after 8226575
    + JDK-8237182: Update copyright header for shenandoah and
    epsilon files
    + JDK-8237888: security/infra/java/security/cert/
    /CertPathValidator/certification/LuxTrustCA.java fails when
    checking validity interval
    + JDK-8237977: Further update
    javax/net/ssl/compatibility/Compatibility.java
    + JDK-8238270: java.net HTTP/2 client does not decrease stream
    count when receives 204 response
    + JDK-8238284: [macos] Zero VM build fails due to an obvious
    typo
    + JDK-8238380: java.base/unix/native/libjava/childproc.c
    "multiple definition" link errors with GCC10
    + JDK-8238386: (sctp) jdk.sctp/unix/native/libsctp/SctpNet.c
    "multiple definition" link errors with GCC10
    + JDK-8238388: libj2gss/NativeFunc.o "multiple definition" link
    errors with GCC10
    + JDK-8238448: RSASSA-PSS signature verification fail when
    using certain odd key sizes
    + JDK-8238710: LingeredApp doesn't log stdout/stderr if exits
    with non-zero code
    + JDK-8239083: C1 assert(known_holder == NULL ||
    (known_holder-&gt;is_instance_klass() &amp;&amp;
    (!known_holder-&gt;is_interface() ||
    ((ciInstanceKlass*)known_holder)-&gt;has_nonstatic_concrete_methods())),
    "should be non-static concrete method");
    + JDK-8239385: KerberosTicket client name refers wrongly to
    sAMAccountName in AD
    + JDK-8240169: javadoc fails to link to non-modular api docs
    + JDK-8240295: hs_err elapsed time in seconds is not accurate
    enough
    + JDK-8240360: NativeLibraryEvent has wrong library name on
    Linux
    + JDK-8240676: Meet not symmetric failure when running lucene
    on jdk8
    + JDK-8241007: Shenandoah: remove
    ShenandoahCriticalControlThreadPriority support
    + JDK-8241065: Shenandoah: remove leftover code after
    JDK-8231086
    + JDK-8241086: Test runtime/NMT/HugeArenaTracking.java is
    failing on 32bit Windows
    + JDK-8241130: com.sun.jndi.ldap.EventSupport.removeDeadNotifier:
    java.lang.NullPointerException
    + JDK-8241138: http.nonProxyHosts=* causes
    StringIndexOutOfBoundsException in DefaultProxySelector
    + JDK-8241319: WB_GetCodeBlob doesn't have ResourceMark
    + JDK-8241478: vmTestbase/gc/gctests/Steal/steal001/steal001.java
    fails with OOME
    + JDK-8241574: Shenandoah: remove ShenandoahAssertToSpaceClosure
    + JDK-8241750: x86_32 build failure after JDK-8227269
    + JDK-8242184: CRL generation error with RSASSA-PSS
    + JDK-8242283: Can't start JVM when java home path includes
    non-ASCII character
    + JDK-8242556: Cannot load RSASSA-PSS public key with non-null
    params from byte array
    + JDK-8243029: Rewrite javax/net/ssl/compatibility/
    /Compatibility.java with a flexible interop test framework
    + JDK-8243138: Enhance BaseLdapServer to support starttls
    extended request
    + JDK-8243320: Add SSL root certificates to Oracle Root CA
    program
    + JDK-8243321: Add Entrust root CA - G4 to Oracle Root CA
    program
    + JDK-8243389: enhance os::pd_print_cpu_info on linux
    + JDK-8243453: java --describe-module failed with non-ASCII
    module name under non-UTF8 environment
    + JDK-8243470: [macos] bring back O2 opt level for unsafe.cpp
    + JDK-8243489: Thread CPU Load event may contain wrong data for
    CPU time under certain conditions
    + JDK-8243925: Toolkit#getScreenInsets() returns wrong value on
    HiDPI screens (Windows)
    + JDK-8244087: 2020-04-24 public suffix list update
    + JDK-8244151: Update MUSCLE PC/SC-Lite headers to the latest
    release 1.8.26
    + JDK-8244164: AArch64: jaotc generates incorrect code for
    compressed OOPs with non-zero heap base
    + JDK-8244196: adjust output in os_linux
    + JDK-8244225: stringop-overflow warning on strncpy call from
    compile_the_world_in
    + JDK-8244287: JFR: Methods samples have line number 0
    + JDK-8244703: "platform encoding not initialized" exceptions
    with debugger, JNI
    + JDK-8244719: CTW: C2 compilation fails with
    "assert(!VerifyHashTableKeys || _hash_lock == 0) failed:
    remove node from hash table before modifying it"
    + JDK-8244729: Shenandoah: remove resolve paths from
    SBSA::generate_shenandoah_lrb
    + JDK-8244763: Update --release 8 symbol information after JSR
    337 MR3
    + JDK-8244818: Java2D Queue Flusher crash while moving
    application window to external monitor
    + JDK-8245151: jarsigner should not raise duplicate warnings on
    verification
    + JDK-8245616: Bump update version for OpenJDK: jdk-11.0.9
    + JDK-8245714: "Bad graph detected in build_loop_late" when
    loads are pinned on loop limit check uncommon branch
    + JDK-8245801: StressRecompilation triggers assert "redundunt
    OSR recompilation detected. memory leak in CodeCache!"
    + JDK-8245832: JDK build make-static-libs should build all JDK
    libraries
    + JDK-8245880: Shenandoah: check class unloading flag early in
    concurrent code root scan
    + JDK-8245981: Upgrade to jQuery 3.5.1
    + JDK-8246027: Minimal fastdebug build broken after JDK-8245801
    + JDK-8246094: [macos] Sound Recording and playback is not
    working
    + JDK-8246153: TestEliminateArrayCopy fails with
  - XX:+StressReflectiveCode
    + JDK-8246193: Possible NPE in ENC-PA-REP search in AS-REQ
    + JDK-8246196: javax/management/MBeanServer/OldMBeanServerTest
    fails with AssertionError
    + JDK-8246203: Segmentation fault in verification due to stack
    overflow with -XX:+VerifyIterativeGVN
    + JDK-8246330: Add TLS Tests for Legacy ECDSA curves
    + JDK-8246453: TestClone crashes with "all collected exceptions
    must come from the same place"
    + JDK-8247246: Add explicit ResolvedJavaType.link and expose
    presence of default methods
    + JDK-8247350: [aarch64] assert(false) failed: wrong size of
    mach node
    + JDK-8247502: PhaseStringOpts crashes while optimising
    effectively dead code
    + JDK-8247615: Initialize the bytes left for the heap sampler
    + JDK-8247824: CTW: C2 (Shenandoah) compilation fails with SEGV
    in SBC2Support::pin_and_expand
    + JDK-8247874: Replacement in VersionProps.java.template not
    working when --with-vendor-bug-url contains '&amp;'
    + JDK-8247979: aarch64: missing side effect of killing flags
    for clearArray_reg_reg
    + JDK-8248214: Add paddings for TaskQueueSuper to reduce
    false-sharing cache contention
    + JDK-8248219: aarch64: missing memory barrier in
    fast_storefield and fast_accessfield
    + JDK-8248348: Regression caused by the update to BCEL 6.0
    + JDK-8248385: [testbug][11u] Adapt TestInitiExceptions to
    jtreg 5.1
    + JDK-8248495: [macos] zerovm is broken due to libffi headers
    location
    + JDK-8248851: CMS: Missing memory fences between free chunk
    check and klass read
    + JDK-8248987: AOT's Linker.java seems to eagerly fail-fast on
    Windows
    + JDK-8249159: Downport test rework for SSLSocketTemplate from
    8224650
    + JDK-8249215: JFrame::setVisible crashed with
  - Dfile.encoding=UTF-8 on Japanese Windows.
    + JDK-8249251: [dark_mode ubuntu 20.04] The selected menu is
    not highlighted in GTKLookAndFeel
    + JDK-8249255: Build fails if source code in cygwin home dir
    + JDK-8249277: TestVerifyIterativeGVN.java is failing with
    timeout in OpenJDK 11
    + JDK-8249278: Revert JDK-8226253 which breaks the spec of
    AccessibleState.SHOWING for JList
    + JDK-8249560: Shenandoah: Fix racy GC request handling
    + JDK-8249801: Shenandoah: Clear soft-refs on requested GC cycle
    + JDK-8249953: Shenandoah: gc/shenandoah/mxbeans tests should
    account for corner cases
    + JDK-8250582: Revert Principal Name type to NT-UNKNOWN when
    requesting TGS Kerberos tickets
    + JDK-8250609: C2 crash in IfNode::fold_compares
    + JDK-8250627: Use -XX:+/-UseContainerSupport for
    enabling/disabling Java container metrics
    + JDK-8250755: Better cleanup for
    jdk/test/javax/imageio/plugins/shared/CanWriteSequence.java
    + JDK-8250787: Provider.put no longer registering aliases in
    FIPS env
    + JDK-8250826: jhsdb does not work with coredump which comes
    from Substrate VM
    + JDK-8250827: Shenandoah: needs to reset/finish StringTable's
    dead count before/after parallel walk
    + JDK-8250844: Make sure {type,obj}ArrayOopDesc accessors check
    the bounds
    + JDK-8251117: Cannot check P11Key size in P11Cipher and
    P11AEADCipher
    + JDK-8251354: Shenandoah: Fix jdk/jfr/tool/TestPrintJSON.java
    test failure
    + JDK-8251451: Shenandoah: Remark ObjectSynchronizer roots with
    I-U
    + JDK-8251469: Better cleanup for
    test/jdk/javax/imageio/SetOutput.java
    + JDK-8251487: Shenandoah: missing detail timing tracking for
    final mark cleaning phase
    + JDK-8252120: compiler/oracle/TestCompileCommand.java
    misspells "occured"
    + JDK-8252157: JDK-8231209 11u backport breaks jmm binary
    compatibility
    + JDK-8252258: [11u] JDK-8242154 changes the default vendor
    + JDK-8252804: [test] Fix 'ReleaseDeflater.java' test after
    downport of 8234011
    + JDK-8253134: JMM_VERSION should remain at 0x20020000 (JDK 10)
    in JDK 11
    + JDK-8253283: [11u] Test build/translations/
    /VerifyTranslations.java failing after JDK-8252258
    + JDK-8253813: Backout JDK-8244287 from 11u: it causes several
    crashes
- Removed patch:
  * gcc-fno-common-fix.patch
    + not needed any more with this version
- Added patch:
  * JDK-8250861.patch
    + Fix regression "8250861: Crash in MinINode::Ideal(PhaseGVN*,
    bool)" introduced in jdk 11.0.9</changelog>
  <changelog author="fstrba@suse.com" date="1604491200">- Enable Sheandoah GC for x86_64 (jsc#ECO-3171)</changelog>
  <changelog author="fstrba@suse.com" date="1605528000">- Update to upstream tag jdk-11.0.9.1-1
  * Fix:
    + JDK-8250861: Crash in MinINode::Ideal(PhaseGVN*, bool)
- Removed patch:
  * JDK-8250861.patch
    + Integrated upstream</changelog>
  <changelog author="fstrba@suse.com" date="1611230400">- Update to upstream tag jdk-11.0.10+9 (January 2021 CPU,
  bsc#1181239)
  * Security fixes
    + JDK-8247619: Improve Direct Buffering of Characters
  * Other changes
    + JDK-6722928: Support SSPI as a native GSS-API provider
    + JDK-7185258: [macosx] Deadlock in SunToolKit.realSync()
    + JDK-8152332: [macosx] JFileChooser cannot be serialized on
    Mac OS X
    + JDK-8161684: [testconf] Add VerifyOops' testing into compiler
    tiers
    + JDK-8171279: Support X25519 and X448 in TLS
    + JDK-8173361: various crashes in
    JvmtiExport::post_compiled_method_load
    + JDK-8173658: JvmtiExport::post_class_unload() is broken for
    non-JavaThread initiators
    + JDK-8191006: hsdis disassembler plugin does not compile with
    binutils 2.29+
    + JDK-8197981: Missing return statement in
    __sync_val_compare_and_swap_8
    + JDK-8198334: java/awt/FileDialog/8003399/bug8003399.java
    fails in headless mode
    + JDK-8200151: Add 8 JNDI tests to com/sun/jndi/dns/ConfigTests/
    + JDK-8208279: Add 8 JNDI tests to com/sun/jndi/dns/EnvTests/
    + JDK-8208483: Add 5 JNDI tests to
    com/sun/jndi/dns/FactoryTests/
    + JDK-8208542: Add 4 JNDI tests to com/sun/jndi/dns/ListTests/
    + JDK-8208665: Amend cross-compilation docs with
    qemu-debootstrap recipe
    + JDK-8210088: ProblemList gc/epsilon/TestMemoryMXBeans.java
    + JDK-8210339: Add 10 JNDI tests to com/sun/jndi/dns/FedTests/
    + JDK-8211450: UndetVar::dup is not copying the kind field to
    the duplicated instance
    + JDK-8212160: JVMTI agent crashes with "assert(_value != 0LL)
    failed: resolving NULL _value"
    + JDK-8212226: SurfaceManager throws "Invalid Image variant"
    for MultiResolutionImage (Windows)
    + JDK-8213400: Support choosing group name in keytool keypair
    generation
    + JDK-8213535: Windows HiDPI html lightweight tooltips are
    truncated
    + JDK-8213698: Improve devkit creation and add support for
    linux/ppc64/ppc64le/s390x
    + JDK-8214025: assert(t-&gt;singleton()) failed: must be a
    constant when ScavengeRootsInCode &lt; 2
    + JDK-8214242: compiler/arguments/TestScavengeRootsInCode.java
    fails because of missing UnlockDiagnosticVMOptions
    + JDK-8214787: Zero builds fail with "undefined
    JavaThread::thread_state()"
    + JDK-8215583: Exclude
    runtime/handshake/HandshakeWalkSuspendExitTest.java
    + JDK-8216012: Infinite loop in RSA KeyPairGenerator
    + JDK-8216324: GetClassMethods is confused by the presence of
    default methods in super interfaces
    + JDK-8217429: WebSocket over authenticating proxy fails to
    send Upgrade headers
    + JDK-8217976: test/jdk/java/net/httpclient/websocket/
    /WebSocketProxyTest.java fails intermittently
    + JDK-8218021: Have jarsigner preserve posix permission
    attributes
    + JDK-8218287: jshell tool: input behavior unstable after
    12-ea+24 on Windows
    + JDK-8218851: JVM crash in custom classloader stress test, JDK
    12 &amp; 13
    + JDK-8220420: Cleanup c1_LinearScan
    + JDK-8222072: JVMTI GenerateEvents() sends CompiledMethodLoad
    events to wrong jvmtiEnv
    + JDK-8222286: Fix for JDK-8213419 is broken on s390
    + JDK-8222527: HttpClient doesn't send HOST header when
    tunelling HTTP/1.1 through http proxy
    + JDK-8222533: jtreg test jdk/internal/platform/cgroup/
    /TestCgroupMetrics.java fails on SLES12.3 linux ppc64le
    machine
    + JDK-8224506: [TESTBUG] TestDockerMemoryMetrics.java fails
    with exitValue = 137
    + JDK-8224555: vmTestbase/nsk/jvmti/scenarios/contention/TC02/
    /tc02t001/TestDescription.java failed
    + JDK-8224650: Add tests to support X25519 and X448 in TLS
    + JDK-8225072: Add LuxTrust certificate that is expiring in
    March 2021 to list of allowed but expired certs
    + JDK-8225329: -XX:+PrintBiasedLockingStatistics causes crash
    during initialization on Windows platforms
    + JDK-8225687: Newly added sspi.cpp in JDK-6722928 still
    contains some small errors
    + JDK-8227006: [linux] Runtime.availableProcessors execution
    time increased by factor of 100
    + JDK-8227275: Within native OOM error handling, assertions may
    hang the process
    + JDK-8227647: [Graal] Test8009761.java fails due to
    "RuntimeException: static java.lang.Object
    compiler.uncommontrap.Test8009761.m3(boolean,boolean) not
    compiled"
    + JDK-8229495: SIGILL in C2 generated OSR compilation
    + JDK-8230910: libsspi_bridge does not build on Windows 32bit
    + JDK-8232114: JVM crashed at imjpapi.dll in native code
    + JDK-8234147: Avoid looking up standard charsets in core
    libraries
    + JDK-8234393: [macos] printing ignores printer tray
    + JDK-8234863: Increase default value of MaxInlineLevel
    + JDK-8235218: Minimal VM is broken after JDK-8173361
    + JDK-8235456: Minimal VM is broken after JDK-8212160
    + JDK-8235829: graal crashes with Zombie.java test
    + JDK-8236124: Minimal VM slowdebug build failed after
    JDK-8212160
    + JDK-8236512: PKCS11 Connection closed after Cipher.doFinal
    and NoPadding
    + JDK-8236944: The legVecZ operand should be limited to
    zmm0-zmm15 registers
    + JDK-8237186: Fix typo in copyright header of
    java/io/Reader/TransferTo.java
    + JDK-8237499: JFR: Include stack trace in the ThreadStart event
    + JDK-8237512: AArch64: aarch64TestHook leaks a BufferBlob
    + JDK-8237524: AArch64: String.compareTo() may return incorrect
    result
    + JDK-8237950: C2 compilation fails with "Live Node limit
    exceeded limit" during ConvI2L::Ideal optimization
    + JDK-8238579: HttpsURLConnection drops the timeout and hangs
    forever in read
    + JDK-8239105: Add exception for expiring Digicert root
    certificates to VerifyCACerts test
    + JDK-8239477: jdk/jfr/jcmd/TestJcmdStartStopDefault.java fails
  - XX:+VerifyOops with "verify_oop: rsi: broken oop"
    + JDK-8239497: SEGV in EdgeUtils::field_name_symbol(Edge const&amp;)
    + JDK-8239886: Minimal VM build fails after JDK-8237499
    + JDK-8240633: Memory leaks in the implementations of
    FileChooserUI
    + JDK-8240690: Race condition between EDT and
    BasicDirectoryModel.FilesLoader.run0()
    + JDK-8241234: Unify monitor enter/exit runtime entries.
    + JDK-8241311: Move some charset mapping tests from closed to
    open
    + JDK-8241797: Add some tests to the problem list
    + JDK-8242029: AArch64: skip G1 array copy pre-barrier if
    marking not active
    + JDK-8242335: Additional Tests for RSASSA-PSS
    + JDK-8242480: Negative value may be returned by
    getFreeSwapSpaceSize() in the docker
    + JDK-8242614: cleanup duplicated test ldap server in some
    com/sun/jndi/ldap/ tests
    + JDK-8242846: Bring back test/jdk/tools/jlink/plugins/
    /OrderResourcesPluginTest.java
    + JDK-8243114: Implement montgomery{Multiply,Square}intrinsics
    on Windows
    + JDK-8243290: Improve diagnostic messages for class
    verification and redefinition failures
    + JDK-8243488: Add tests for set/get SendBufferSize and
    getReceiveBufferSize in DatagramSocket
    + JDK-8243549: sun/security/ssl/CipherSuite/
    /NamedGroupsWithCipherSuite.java failed with Unsupported
    signature algorithm: DSA
    + JDK-8243617: compiler/onSpinWait/TestOnSpinWaitC1.java test
    uses wrong class
    + JDK-8243619: compiler/codecache/CheckSegmentedCodeCache.java
    test misses -version
    + JDK-8244142: some hotspot/runtime tests don't check exit code
    of forked JVM
    + JDK-8244278: Excessive code cache flushes and sweeps
    + JDK-8244282: test/hotspot/jtreg/compiler/intrinsics/
    /Test8237524.java fails with --illegal-access=deny
    + JDK-8244621: [macos10.15] Garbled FX printing plus CoreText
    warnings on Catalina when building with Xcode 11
    + JDK-8244819: hsdis does not compile with binutils 2.34+
    + JDK-8245051: c1 is broken if it is compiled by gcc without
  - fno-lifetime-dse
    + JDK-8245168: jlink should not be treated as a "small" tool
    + JDK-8245400: Upgrade to LittleCMS 2.11
    + JDK-8246381: VM crashes with "Current BasicObjectLock* below
    than low_mark"
    + JDK-8246434: Threads::print_on_error assumes that the heap
    has been set up
    + JDK-8246648: issue with OperatingSystemImpl
    getFreeSwapSpaceSize in docker after 8242480
    + JDK-8247201: Print potential pointer value of readable stack
    memory in hs_err file
    + JDK-8247763: assert(outer-&gt;outcnt() == 2) failed: 'only phis'
    failure in LoopNode::verify_strip_mined()
    + JDK-8247867: Upgrade to freetype 2.10.2
    + JDK-8248190: Enable Power10 system and implement new
    byte-reverse instructions
    + JDK-8248226: TestCloneAccessStressGCM fails with
  - XX:-ReduceBulkZeroing
    + JDK-8248347: windows build broken by JDK-8243114
    + JDK-8248532: Every time I change keyboard language at my
    MacBook, Java crashes
    + JDK-8248552: C2 crashes with SIGFPE due to division by zero
    + JDK-8248596: [TESTBUG] compiler/loopopts/
    /PartialPeelingUnswitch.java times out with Graal enabled
    + JDK-8248745: Add jarsigner and keytool tests for restricted
    algorithms
    + JDK-8248791: sun/util/resources/cldr/TimeZoneNamesTest.java
    fails with -XX:-ReduceInitialCardMarks -XX:-ReduceBulkZeroing
    + JDK-8248845: AArch64: stack corruption after spilling vector
    register
    + JDK-8249176: Update GlobalSignR6CA test certificates
    + JDK-8249183: JVM crash in "AwtFrame::WmSize" method
    + JDK-8249192: MonitorInfo stores raw oops across safepoints
    + JDK-8249602: C2: assert(cnt == _outcnt) failed: no insertions
    allowed
    + JDK-8249603: C1: assert(has_error == false) failed: register
    allocation invalid
    + JDK-8249605: C2: assert(no_dead_loop) failed: dead loop
    detected
    + JDK-8249607: C2: assert(!had_error) failed: bad dominance
    + JDK-8249608: Vector register used by C2 compiled method
    corrupted at safepoint
    + JDK-8249672: Include microcode revision in features_string on
    x86
    + JDK-8249748: gtest silently ignores bad jvm arguments
    + JDK-8249821: Separate libharfbuzz from libfontmanager
    + JDK-8250598: Hyper-V is detected in spite of running on host
    OS
    + JDK-8250605: Linux x86_32 builds fail after JDK-8249821
    + JDK-8250636: iso8601_time returns incorrect offset part on
    MacOS
    + JDK-8250665: Wrong translation for the month name of May in
    ar_JO,LB,SY
    + JDK-8250772: Test com/sun/jndi/ldap/
    /NamingExceptionMessageTest.java fails intermittently with
    javax.naming.ServiceUnavailableException
    + JDK-8250825: C2 crashes with assert(field != __null) failed:
    missing field
    + JDK-8250894: Provide a configure option to build and run
    against the platform libharfbuzz
    + JDK-8250928: JFR: Improve hash algorithm for stack traces
    + JDK-8250968: Symlinks attributes not preserved when using
    jarsigner on zip files
    + JDK-8250984: Memory Docker tests fail on some Linux kernels
    w/o cgroupv1 swap limit capabilities
    + JDK-8251118: BiasedLocking::preserve_marks should not have a
    HandleMark
    + JDK-8251189: com/sun/jndi/ldap/LdapDnsProviderTest.java
    failed due to timeout
    + JDK-8251257: NMT: jcmd VM.native_memory scale=1 crashes
    target VM
    + JDK-8251365: Build failure on AIX after 8250636
    + JDK-8251397: NPE on ClassValue.ClassValueMap.cacheArray
    + JDK-8251456: [TESTBUG] compiler/vectorization/
    /TestVectorsNotSavedAtSafepoint.java failed OutOfMemoryError
    + JDK-8251458: Parse::do_lookupswitch fails with "assert(_cnt
    &gt;= 0) failed"
    + JDK-8251535: Partial peeling at unsigned test adds incorrect
    loop exit check
    + JDK-8251949: ZGC: Set explicit heap size for
    compiler/gcbarriers tests
    + JDK-8252090: JFR: StreamWriterHost::write_unbuffered() stucks
    in an infinite loop OpenJDK (build 13.0.1+9)
    + JDK-8252415: Bump update version for OpenJDK: jdk-11.0.10
    + JDK-8252470: java/awt/dnd/DisposeFrameOnDragCrash/
    /DisposeFrameOnDragTest.java fails on Windows
    + JDK-8252497: Incorrect numeric currency code for ROL
    + JDK-8252660: Shenandoah: support manageable SoftMaxHeapSize
    option
    + JDK-8252679: Two windows specific FileDIalog tests may fail
    on some Windows_Server_2016_Standard
    + JDK-8252696: Loop unswitching may cause out of bound array
    load to be executed
    + JDK-8252754: Hash code calculation of JfrStackTrace is
    inconsistent
    + JDK-8253219: Epsilon: clean up unnecessary includes
    + JDK-8253224: Shenandoah: ShenandoahStrDedupQueue destructor
    calls virtual num_queues()
    + JDK-8253226: Shenandoah: remove unimplemented
    ShenandoahStrDedupQueue::verify
    + JDK-8253269: The CheckCommonColors test should provide more
    info on failure
    + JDK-8253284: Zero OrderAccess barrier mappings are incorrect
    + JDK-8253375: OSX build fails with Xcode 12.0 (12A7209)
    + JDK-8253778: ShenandoahSafepoint::is_at_shenandoah_safepoint
    should not access VMThread state from other threads
    + JDK-8253791: Issue with useAppleColor check in CSystemColors.m
    + JDK-8254016: Test8237524 fails with -XX:-CompactStrings option
    + JDK-8254081: java/security/cert/PolicyNode/
    /GetPolicyQualifiers.java fails due to an expired certificate
    + JDK-8254144: Non-x86 Zero builds fail with return-type
    warning in os_linux_zero.cpp
    + JDK-8254166: Zero: return-type warning in
    zeroInterpreter_zero.cpp
    + JDK-8254177: (tz) Upgrade time-zone data to tzdata2020b
    + JDK-8254185: Fix Code cache sweeper heuristics for JDK 11
    + JDK-8254190: [s390] interpreter misses exception check after
    calling monitorenter
    + JDK-8254790: SIGSEGV in string_indexof_char and
    stringL_indexof_char intrinsics
    + JDK-8254854: [cgroups v1] Metric limits not properly detected
    on some join controller combinations
    + JDK-8254982: (tz) Upgrade time-zone data to tzdata2020c
    + JDK-8255050: Add pkcs11/KeyStore/ClientAuth.sh to Problem list
    + JDK-8255065: Zero: accessor_entry misses the IRIW case
    + JDK-8255226: (tz) Upgrade time-zone data to tzdata2020d
    + JDK-8255269: Unsigned overflow in g1Policy.cpp
    + JDK-8255365: Problem list failing client manual tests
    + JDK-8255457: Shenandoah: cleanup ShenandoahMarkTask
    + JDK-8255466: C2 crashes at ciObject::get_oop() const+0x0
    + JDK-8255550: x86: Assembler::cmpq(Address dst, Register src)
    encoding is incorrect
    + JDK-8255603: Memory/Performance regression after JDK-8210985
    + JDK-8255760: Shenandoah: match constants style in
    ShenandoahMarkTask fallback
    + JDK-8255781: Bump patch update version for OpenJDK:
    jdk-11.0.9.1
    + JDK-8255937: Better cleanup for
    test/jdk/javax/imageio/stream/StreamFlush.java
    + JDK-8256427: Test com/sun/jndi/dns/ConfigTests/
    /PortUnreachable.java does not work on AIX
    + JDK-8256452: Integrate missing part of JDK-8232370 to 11u
    + JDK-8256483: [TESTBUG] serviceability/jvmti/GetClassMethods/
    /libOverpassMethods.c fails to compile on gcc 4.4.x
    + JDK-8256557: libharfbuzz fails to link on gcc 4.4.x due to
  - Wl,-z,defs
    + JDK-8256618: Zero: Linux x86_32 build still fails
    + JDK-8256736: Zero: GTest tests fail with "unsuppported vm
    variant"
    + JDK-8256809: Annotation processing causes NPE during flow
    analysis
    + JDK-8257181: s390x builds are very noisy with gc-sections
    messages
    + JDK-8257242: [macOS] Java app crashes while switching input
    methods
    + JDK-8257545: SunJSSE FIPS regression in key exchange after
    JDK-8171279 11u backport
    + JDK-8257641: Shenandoah: Query is_at_shenandoah_safepoint()
    from control thread should return false
    + JDK-8257701: Shenandoah: objArrayKlass metadata is not marked
    with chunked arrays
    + JDK-8258630: Add expiry exception for QuoVadis root
    certificate
- New upstream dependency on libharfbuzz
- Regenerated patches: missing-return.patch system-pcsclite.patch</changelog>
  <changelog author="fstrba@suse.com" date="1616155200">- Added patches:
  * system-crypto-policy.patch
    + Let OpenJDK use system crypto policies unless explicitely told
    not to
  * nss-security-provider.patch
    + Add the NSS security provider with configuration in generated
    nss.cfg file
  * keytool-default-rsa.patch
    + Make keytool generate RSA keys by default, since only the
    LEGACY system crypto policy allows DSA</changelog>
  <changelog author="pujos.michael@gmail.com" date="1618488000">- moved mozilla-nss dependency to java-11-openjdk-headless package
  This is necessary to be able to do crypto with just
  java-11-openjdk-headless installed. Fixes boo#1184606</changelog>
  <changelog author="fstrba@suse.com" date="1619006400">- Update to upstream tag jdk-11.0.11+9 (April 2021, CPU)
  * Security fixes
    + JDK-8244473: Contextualize registration for JNDI
    + JDK-8244543: Enhanced handling of abstract classes
    + JDK-8249906, CVE-2021-2163, bsc#1185055: Enhance opening JARs
    + JDK-8250568, CVE-2021-2161, bsc#1185056: Less ambiguous
    processing
    + JDK-8253799: Make lists of normal filenames
    + JDK-8257001: Improve Http Client Support
  * Other changes
    + JDK-7107012: sun.jvm.hotspot.code.CompressedReadStream
    readDouble() conversion to long mishandled
    + JDK-7146776: deadlock between URLStreamHandler.getHostAddress
    and file.Handler.openconnection
    + JDK-8086003: Test fails on OSX with java.lang.RuntimeException
    'Narrow klass base: 0x0000000000000000, Narrow klass shift: 3'
    missing
    + JDK-8168869: jdeps: localized messages don't use proper line
    breaks
    + JDK-8180837: SunPKCS11-NSS tests failing with
    CKR_ATTRIBUTE_READ_ONLY and CKR_MECHANISM_PARAM_INVALID
    + JDK-8202343: Disable TLS 1.0 and 1.1
    + JDK-8205992: jhsdb cannot attach to Java processes running in
    Docker containers
    + JDK-8209193: Fix aarch64-linux compilation after -Wreorder
    changes
    + JDK-8210413: AArch64: Optimize div/rem by constant in C1
    + JDK-8210578: AArch64: Invalid encoding for fmlsvs instruction
    + JDK-8211051: jdeps usage of --dot-output doesn't provide
    valid output for modular jar
    + JDK-8211057: Gensrc step CompileProperties generates unstable
    CompilerProperties output
    + JDK-8211150: G1 Full GC not purging code root memory and
    hence causing memory leak
    + JDK-8211825: ModuleLayer.defineModulesWithXXX does not setup
    delegation when module reads automatic module
    + JDK-8212043: Add floating-point Math.min/max intrinsics
    + JDK-8212218: [TESTBUG] runtime/ErrorHandling/
    /TestHeapDumpOnOutOfMemoryErrorInMetaspace.java timed out
    + JDK-8213116: javax/swing/JComboBox/WindowsComboBoxSize/
    /WindowsComboBoxSizeTest.java fails in Windows
    + JDK-8213909: jdeps --print-module-deps should report missing
    dependences
    + JDK-8214180: Need better granularity for sleeping
    + JDK-8214223: tools/jdeps/listdeps/ListModuleDeps.java failed
    due to missing Lib2 file
    + JDK-8214230: Classes generated by SystemModulesPlugin.java
    are not reproducable
    + JDK-8214741: docs/index.html has no title or copyright
    + JDK-8215687: [Graal] unit test CheckGraalIntrinsics failed
    after 8212043
    + JDK-8217848: [Graal] vmTestbase/nsk/jvmti/ResourceExhausted/
    /resexhausted003/TestDescription.java fails
    + JDK-8218482: sun/security/krb5/auto/ReplayCachePrecise.java
    failed - no KrbException thrown
    + JDK-8218550: Add test omitted from JDK-8212043
    + JDK-8221584: SIGSEGV in os::PlatformEvent::unpark() in
    JvmtiRawMonitor::raw_exit while posting method exit event
    + JDK-8221995: AARCH64: problems with CAS instructions encoding
    + JDK-8222518: Remove unnecessary caching of Parker object in
    java.lang.Thread
    + JDK-8222785: aarch64: add necessary masking for immediate
    shift counts
    + JDK-8223186: HotSpot compile warnings from GCC 9
    + JDK-8225773: jdeps --check produces NPE if there are missing
    module dependences
    + JDK-8225805: Java Access Bridge does not close the logger
    + JDK-8226810: Failed to launch JVM because of
    NullPointerException occured on System.props
    + JDK-8229396: jdeps ignores multi-release when
    generate-module-info used on command line
    + JDK-8229474: Shenandoah: Cleanup CM::update_roots()
    + JDK-8232225: Rework the fix for JDK-8071483
    + JDK-8232905: JFR fails with assertion:
    assert(t-&gt;unflushed_size() == 0) failed: invariant
    + JDK-8233164: C2 fails with assert(phase-&gt;C-&gt;get_alias_index(t)
    == phase-&gt;C-&gt;get_alias_index(t_adr)) failed: correct memory
    chain
    + JDK-8233910: java/awt/ColorClass/AlphaColorTest.java is
    failing  intermittently in nightly lnux-x64 system
    + JDK-8233912: aarch64: minor improvements of atomic operations
    + JDK-8234508: VM_HeapWalkOperation::iterate_over_object reads
    non-strong fields with an on-strong load barrier
    + JDK-8234742: Improve handshake logging
    + JDK-8234796: Refactor Handshake::execute to take a more
    complex type than ThreadClosure
    + JDK-8235324: Dying objects are published from users of
    CollectedHeap::object_iterate
    + JDK-8235351: Lookup::unreflect should bind with the original
    caller independent of Method's accessible flag
    + JDK-8237369: Shenandoah: failed vmTestbase/nsk/jvmti/
    /AttachOnDemand/attach021/TestDescription.java test
    + JDK-8237392: Shenandoah: Remove unreliable assertion
    + JDK-8237483: AArch64 C1 OopMap inserted twice fatal error
    + JDK-8237495: Java MIDI fails with a dereferenced memory error
    when asked to send a raw 0xF7
    + JDK-8239355: (dc) Initial value of SO_SNDBUF should allow
    sending large datagrams (macOS)
    + JDK-8240353: AArch64: missing support for
  - XX:+ExtendedDTraceProbes in C1
    + JDK-8240704: CheckHandles.java failed "AssertionError: Handle
    use increased by more than 10 percent."
    + JDK-8240751: Shenandoah: fold ShenandoahTracer definition
    + JDK-8240795: [REDO] 8238384 CTW: C2 compilation fails with
    "assert(store != load-&gt;find_exact_control(load-&gt;in(0)))
    failed: dependence cycle found"
    + JDK-8241598: Upgrade JLine to 3.14.0
    + JDK-8241649: Optimize Character.toString
    + JDK-8241770: Module xxxAnnotation() methods throw NCDFE if
    module-info.class found as resource in unnamed module
    + JDK-8241911: AArch64: Fix a potential register clash issue in
    reduce_add2I
    + JDK-8242030: Wrong package declarations in jline classes after
    JDK-8241598
    + JDK-8242565: Policy initialization issues when the denyAfter
    constraint is enabled
    + JDK-8243618: compiler/rtm/cli tests can be run w/o WhiteBox
    + JDK-8243670: Unexpected test result caused by C2
    MergeMemNode::Ideal
    + JDK-8244088: [Regression] Switch of Gnome theme ends up in
    deadlocked UI
    + JDK-8244154: Update SunPKCS11 provider with PKCS11 v3.0 header
    files
    + JDK-8244340: Handshake processing thread lacks yielding
    + JDK-8244573: java.lang.ArrayIndexOutOfBoundsException thrown
    for malformed class file
    + JDK-8244683: A TSA server used by tests
    + JDK-8245005: javax/net/ssl/compatibility/BasicConnectTest.java
    failed with No enum constant
    + JDK-8245026: PsAdaptiveSizePolicy::_old_gen_policy_is_ready is
    unused
    + JDK-8245283: JFR: Can't handle constant dynamic used by Jacoco
    agent
    + JDK-8245512: CRC32 optimization using AVX512 instructions
    + JDK-8245527: LDAP Channel Binding support for Java
    GSS/Kerberos
    + JDK-8246707: (sc) SocketChannel.read/write throws
    AsynchronousCloseException on closed channel
    + JDK-8246709: sun/security/tools/jarsigner/
    /TsacertOptionTest.java compilation failed after JDK-8244683
    + JDK-8247200: assert((unsigned)fpargs &lt; 32)
    + JDK-8247766: [aarch64] guarantee(val &lt; (1U &lt;&lt; nbits))
    failed: Field too big for insn.
    + JDK-8248336: AArch64: C2: offset overflow in
    BoxLockNode::emit
    + JDK-8248865: Document JNDI/LDAP timeout properties
    + JDK-8248901: Signed immediate support in
    .../share/assembler.hpp is broken.
    + JDK-8249543: Force DirectBufferAllocTest to run with
  - ExplicitGCInvokesConcurrent
    + JDK-8249588: libwindowsaccessbridge issues on 64bit Windows
    + JDK-8249749: modify a primitive array through a stream and a
    for cycle causes jre crash
    + JDK-8249787: Make TestGCLocker more resilient with concurrent
    GCs
    + JDK-8249867: xml declaration is not followed by a newline
    + JDK-8250911: [windows] os::pd_map_memory() error detection
    broken
    + JDK-8251255: [linux] Add process-memory information to hs-err
    and VM.info
    + JDK-8251359: Shenandoah: filter null oops before calling
    enqueue/SATB barrier
    + JDK-8251925: C2: RenaissanceStressTest fails with
    assert(!had_error): bad dominance
    + JDK-8251944: Add Shenandoah test config to
    compiler/gcbarriers/UnsafeIntrinsicsTest.java
    + JDK-8251992: VM crashed running TestComplexAddrExpr.java test
    with -XX:UseAVX=X
    + JDK-8253220: Epsilon: clean up unused code/declarations
    + JDK-8253274: The CycleDMImagetest brokes the system
    + JDK-8253353: Crash in C2: guarantee(n != NULL) failed: No Node
    + JDK-8253368: TLS connection always receives close_notify
    exception
    + JDK-8253404: C2: assert(C-&gt;live_nodes() &lt;=
    C-&gt;max_node_limit()) failed: Live Node limit exceeded limit
    + JDK-8253409: Double-rounding possibility in float fma
    + JDK-8253476: TestUseContainerSupport.java fails on some Linux
    kernels w/o swap limit capabilities
    + JDK-8253524: C2: Refactor code that clones predicates during
    loop unswitching
    + JDK-8253644: C2: assert(skeleton_predicate_has_opaque(iff))
    failed: unexpected
    + JDK-8253681: closed java/awt/dnd/MouseEventAfterStartDragTest/
    /MouseEventAfterStartDragTest.html test failed
    + JDK-8253702: BigSur version number reported as 10.16, should
    be 11.nn
    + JDK-8253756: C2 CompilerThread0 crash in Node::add_req(Node*)
    + JDK-8254104: MethodCounters must exist before nmethod is
    installed
    + JDK-8254734: "dead loop detected" assert failure with patch
    from 8223051
    + JDK-8254748: Bad Copyright header format after JDK-8212218
    + JDK-8254799: runtime/ErrorHandling/
    /TestHeapDumpOnOutOfMemoryError.java fails with release VMs
    + JDK-8255058: C1: assert(is_virtual()) failed: type check
    + JDK-8255351: Add detection for Graviton 2 CPUs
    + JDK-8255368: Math.exp() gives wrong result for large values on
    x86 32-bit platforms
    + JDK-8255387: Japanese characters were printed upside down on
    AIX
    + JDK-8255401: Shenandoah: Allow oldval and newval registers to
    overlap in cmpxchg_oop()
    + JDK-8255479: [aarch64] assert(src-&gt;section_index_of(target) ==
    CodeBuffer::SECT_NONE) failed: sanity
    + JDK-8255544: Create a checked cast
    + JDK-8255559: Leak File Descriptors Because of
    ResolverLocalFilesystem#engineResolveURI()
    + JDK-8255681: print callstack in error case in
    runAWTLoopWithApp
    + JDK-8255734: VM should ignore SIGXFSZ on ppc64, s390 too
    + JDK-8255742: PrintInlining as compiler directive doesn't print
    virtual calls
    + JDK-8255845: Memory leak in imageFile.cpp
    + JDK-8255880: UI of Swing components is not redrawn after their
    internal state changed
    + JDK-8255908: ExceptionInInitializerError due to
    UncheckedIOException while initializing cgroupv1 subsystem
    + JDK-8256025: AArch64: MachCallRuntimeNode::ret_addr_offset()
    is incorrect for stub calls
    + JDK-8256056: Deoptimization stub doesn't save vector registers
    on x86
    + JDK-8256061: RegisterSaver::save_live_registers() omits upper
    halves of ZMM0-15 registers
    + JDK-8256187: [TEST_BUG] Automate bug4275046.java test
    + JDK-8256220: C1: x86_32 fails with -XX:UseSSE=1 after
    JDK-8210764 due to mishandled lir_neg
    + JDK-8256258: some missing NULL checks or asserts after
    CodeCache::find_blob_unsafe
    + JDK-8256264: Printed GlyphVector outline with low DPI has bad
    quality on Windows
    + JDK-8256290: javac/lambda/T8031967.java fails with
    StackOverflowError on x86_32
    + JDK-8256359: AArch64: runtime/ReservedStack/
    /ReservedStackTestCompiler.java fails
    + JDK-8256387: Unexpected result if patching an entire
    instruction on AArch64
    + JDK-8256421: Add 2 HARICA roots to cacerts truststore
    + JDK-8256488: [aarch64] Use ldpq/stpq instead of ld4/st4 for
    small copies in StubGenerator::copy_memory
    + JDK-8256489: Make gtest for long path names on Windows more
    resilient in the presence of virus scanners
    + JDK-8256501: libTestMainKeyWindow fails to build with Xcode
    12.2
    + JDK-8256633: Fix product build on Windows+Arm64
    + JDK-8256682: JDK-8202343 is incomplete
    + JDK-8256751: Incremental rebuild with precompiled header fails
    when touching a header file
    + JDK-8256757: Incorrect MachCallRuntimeNode::ret_addr_offset()
    for CallLeafNoFP on x86_32
    + JDK-8256806: Shenandoah: optimize shenandoah/jni/
    /TestPinnedGarbage.java test
    + JDK-8256807: C2: Not marking stores correctly as mismatched
    in string opts
    + JDK-8256810: Incremental rebuild broken on Macosx
    + JDK-8256818: SSLSocket that is never bound or connected leaks
    socket resources
    + JDK-8256888: Client manual test problem list update
    + JDK-8257083: Security infra test failures caused by
    JDK-8202343
    + JDK-8257408: Bump update version for OpenJDK: jdk-11.0.11
    + JDK-8257423: [PPC64] Support -XX:-UseInlineCaches
    + JDK-8257436: [aarch64] Regressions in ArrayCopyUnalignedDst
    .testByte/testChar for 65-78 bytes when UseSIMDForMemoryOps
    is on
    + JDK-8257513: C2: assert((constant_addr -
    _masm.code()-&gt;consts()-&gt;start()) == con.offset())
    + JDK-8257547: Handle multiple prereqs on the same line in deps
    files
    + JDK-8257561: Some code is not vectorized after 8251925 and
    8250607
    + JDK-8257565: epsilonBarrierSet.hpp should not include
    barrierSetAssembler
    + JDK-8257575: C2: "failed: only phis" assert failure in loop
    strip mining verification
    + JDK-8257594: C2 compiled checkcast of non-null object triggers
    endless deoptimization/recompilation cycle
    + JDK-8257633: Missing -mmacosx-version-min=X flag when linking
    libjvm
    + JDK-8257670: sun/security/ssl/SSLSocketImpl/SSLSocketLeak.java
    reports leaks
    + JDK-8257707: Fix incorrect format string in Http1HeaderParser
    + JDK-8257746: Regression introduced with JDK-8250984 - memory
    might be null in some machines
    + JDK-8257798: [PPC64] undefined reference to
    Klass::vtable_start_offset()
    + JDK-8257884: Re-enable sun/security/ssl/SSLSocketImpl/
    /SSLSocketLeak.java as automatic test
    + JDK-8257910: [JVMCI] Set exception_seen accordingly in the
    runtime.
    + JDK-8257997: sun/security/ssl/SSLSocketImpl/SSLSocketLeak.java
    again reports leaks after JDK-8257884
    + JDK-8257999: Parallel GC crash in gc/parallel/
    /TestDynShrinkHeap.java: new region is not in covered_region
    + JDK-8258077: Using -Xcheck:jni can lead to a double-free after
    JDK-8193234
    + JDK-8258247: Couple of issues in fix for JDK-8249906
    + JDK-8258373: Update the text handling in the JPasswordField
    + JDK-8258396: SIGILL in jdk.jfr.internal.PlatformRecorder
    .rotateDisk()
    + JDK-8258419: RSA cipher buffer cleanup
    + JDK-8258471: "search codecache" clhsdb command does not work
    + JDK-8258534: Epsilon: clean up unused includes
    + JDK-8258805: Japanese characters not entered by mouse click
    on Windows 10
    + JDK-8258833: Cancel multi-part cipher operations in SunPKCS11
    after failures
    + JDK-8258836: JNI local refs exceed capacity
    getDiagnosticCommandInfo
    + JDK-8258884: [TEST_BUG] Convert applet-based test
    open/test/jdk/javax/swing/JMenuItem/8031573/bug8031573.java
    to a regular java test
    + JDK-8259007: This test printed a blank page
    + JDK-8259048: (tz) Upgrade time-zone data to tzdata2020f
    + JDK-8259049: Uninitialized variable after JDK-8257513
    + JDK-8259231: Epsilon: improve performance under contention
    during virtual space expansion
    + JDK-8259271: gc/parallel/TestDynShrinkHeap.java still fails
    "assert(covered_region.contains(new_memregion)) failed: new
    region is not in covered_region"
    + JDK-8259312: VerifyCACerts.java fails as soneraclass2ca cert
    will expire in 90 days
    + JDK-8259319: Illegal package access when SunPKCS11 requires
    SunJCE's classes
    + JDK-8259339: AllocateUninitializedArray C2 intrinsic fails
    with void.class input
    + JDK-8259428: AlgorithmId.getEncodedParams() should return copy
    + JDK-8259446: runtime/jni/checked/
    /TestCheckedReleaseArrayElements.java fails with stderr not
    empty
    + JDK-8259451: Zero: skip serviceability/sa tests, set vm.hasSA
    to false
    + JDK-8259580: Shenandoah: uninitialized label in
    VerifyThreadGCState
    + JDK-8259619: C1: 3-arg StubAssembler::call_RT stack-use
    condition is incorrect
    + JDK-8259633: compiler/graalunit/CoreTest.java fails with NPE
    after JDK-8244543
    + JDK-8259706: C2 compilation fails with assert(vtable_index ==
    Method::invalid_vtable_index) failed: correct sentinel value
    + JDK-8259707: LDAP channel binding does not work with StartTLS
    extension
    + JDK-8259773: Incorrect encoding of AVX-512 kmovq instruction
    + JDK-8259849: Shenandoah: Rename store-val to IU-barrier
    + JDK-8259949: x86 32-bit build fails when -fcf-protection is
    passed in the compiler flags
    + JDK-8259954: gc/shenandoah/mxbeans tests fail with -Xcomp
    + JDK-8260029: aarch64: fix typo in verify_oop_array
    + JDK-8260308: Update LogCompilation junit to 4.13.1
    + JDK-8260338: Some fields in HaltNode is not cloned
    + JDK-8260349: Cannot programmatically retrieve Metaspace max
    set via JAVA_TOOL_OPTIONS
    + JDK-8260356: (tz) Upgrade time-zone data to tzdata2021a
    + JDK-8260378: [TESTBUG] DcmdMBeanTestCheckJni.java reports
    false positive
    + JDK-8260497: Shenandoah: Improve SATB flushing
    + JDK-8260502: [s390] NativeMovRegMem::verify() fails because
    it's too strict
    + JDK-8260632: Build failures after JDK-8253353
    + JDK-8260704: ParallelGC: oldgen expansion needs release-store
    for _end
    + JDK-8261022: Fix incorrect result of Math.abs() with char type
    + JDK-8261089: [TESTBUG] native library of test
    TestCheckedReleaseCriticalArray.java fails to compile with
    gcc 4.x
    + JDK-8261183: Follow on to Make lists of normal filenames
    + JDK-8261209: isStandalone property: remove dependency on
    pretty-print
    + JDK-8261231: Windows IME was disabled after DnD operation
    + JDK-8261251: Shenandoah: Use object size for full GC
    humongous compaction
    + JDK-8261310: PPC64 Zero build fails with
    'VMError::controlled_crash(int)::FunctionDescriptor
    functionDescriptor' has incomplete type and cannot be defined
    + JDK-8261334: NMT: tuning statistic shows incorrect hash
    distribution
    + JDK-8261413: Shenandoah: Disable class-unloading in I-U mode
    + JDK-8261522: [PPC64] AES intrinsics write beyond the
    destination array
    + JDK-8261534: Test sun/security/pkcs11/KeyAgreement/
    /IllegalPackageAccess.java fails on platforms where no nsslib
    artifacts are defined
    + JDK-8261585: Restore HandleArea used in
    Deoptimization::uncommon_trap
    + JDK-8261753: Test java/lang/System/OsVersionTest.java still
    failing on BigSur patch versions after JDK-8253702
    + JDK-8261829: Exclude tools/jlink/JLinkReproducibleTest.java
    in 11u
    + JDK-8261912: Code IfNode::fold_compares_helper more
    defensively
    + JDK-8261920: [AIX] jshell command throws java.io.IOError on
    non English locales
    + JDK-8262018: Wrong format in SAP copyright header of
    OsVersionTest
    + JDK-8263069: Exclude some failing tests from
    security/infra/java/security/cert/CertPathValidator</changelog>
  <changelog author="fstrba@suse.com" date="1620043200">- Remove all Jpackage provides for SLE12 in order to avoid
  installing this package as default Java on SLE12-SP5
  (bsc#1185476)</changelog>
  <changelog author="fstrba@suse.com" date="1621512000">- Modified patch:
  * nss-security-provider.patch
    + make the NSS provider first in the list</changelog>
  <changelog author="fstrba@suse.com" date="1626868800">- Update to upstream tag jdk-11.0.12+7 (July 2021, CPU)
  * Security fixes
    + JDK-8256157: Improve bytecode assembly
    + JDK-8256491: Better HTTP transport
    + JDK-8258432, CVE-2021-2341, bsc#1188564: Improve file
    transfers
    + JDK-8260453: Improve Font Bounding
    + JDK-8260960: Signs of jarsigner signing
    + JDK-8260967, CVE-2021-2369, bsc#1188565: Better jar file
    validation
    + JDK-8262380: Enhance XML processing passes
    + JDK-8262403: Enhanced data transfer
    + JDK-8262410: Enhanced rules for zones
    + JDK-8262477: Enhance String Conclusions
    + JDK-8262967: Improve Zip file support
    + JDK-8264066, CVE-2021-2388, bsc#1188566: Enhance compiler
    validation
    + JDK-8264079: Improve abstractions
    + JDK-8264460: Improve NTLM support
  * Other changes
    + JDK-6847157: java.lang.NullPointerException: HDC for
    component at sun.java2d.loops.Blit.Blit
    + JDK-7106851: Test should not use System.exit
    + JDK-8073446: TimeZone getOffset API does not  return a dst
    offset between years 2038-2137
    + JDK-8076190: Customizing the generation of a PKCS12 keystore
    + JDK-8153005: Upgrade the default PKCS12 encryption/MAC
    algorithms
    + JDK-8171303: sun/java2d/pipe/InterpolationQualityTest.java
    fails on Windows &amp; Linux
    + JDK-8177068: incomplete classpath causes NPE in Flow
    + JDK-8185734: [Windows] Structured Exception Catcher missing
    around gtest execution
    + JDK-8187450: JNI local refs exceeds capacity warning in
    NetworkInterface::getAll
    + JDK-8190763: Class cast exception on (CompoundEdit)
    UndoableEditEvent.getEdit()
    + JDK-8195841: PNGImageReader.readNullTerminatedString() doesnt
    check for non-null terminated strings with length equal to
    maxLen
    + JDK-8196100: javax/swing/text/JTextComponent/5074573/
    /bug5074573.java fails
    + JDK-8199646: JShell tests: jdk/jshell/
    /FailOverDirectExecutionControlTest.java failed with
    java.lang.UnsupportedOperationException
    + JDK-8206925: Support the certificate_authorities extension
    + JDK-8207160: ClassReader::adjustMethodParams can potentially
    return null if the args list is empty
    + JDK-8207247: AARCH64: Enable Minimal and Client VM builds
    + JDK-8207404: MulticastSocket tests failing on AIX
    + JDK-8207779: Method::is_valid_method() compares 'this' with
    NULL
    + JDK-8208061: runtime/LoadClass/TestResize.java fails with
    "Load factor too high" when running in CDS mode.
    + JDK-8209459: TestSHA512MultiBlockIntrinsics failed on AArch64
    + JDK-8210443: Migrate Locale matching tests to JDK Repo.
    + JDK-8213231: ThreadSnapshot::_threadObj can become stale
    + JDK-8213483: ARM32: runtime/ErrorHandling/
    /ShowRegistersOnAssertTest.java jtreg test fail
    + JDK-8213725: JShell NullPointerException due to class file
    with unexpected package
    + JDK-8213794: ARM32: disable TypeProfiling,
    CriticalJNINatives, Serviceablity tests for ARM32
    + JDK-8213845: ARM32: Interpreter doesn't call result handler
    after native calls
    + JDK-8214128: ARM32: wrong stack alignment on
    Deoptimization::unpack_frames
    + JDK-8214512: ARM32: Jtreg test compiler/c2/Test8062950.java
    fails on ARM
    + JDK-8214854: JDWP: Unforseen output truncation in logging
    + JDK-8214922: Add vectorization support for fmin/fmax
    + JDK-8215009: GCC 8 compilation error in libjli
    + JDK-8216184: CDS/appCDS tests failed on Windows due to long
    path to a classlist file
    + JDK-8216259: AArch64: Vectorize Adler32 intrinsics
    + JDK-8216314: SIGILL in CodeHeapState::print_names()
    + JDK-8217348: assert(thread-&gt;is_Java_thread()) failed: just
    checking
    + JDK-8217465: [REDO] - Optimize CodeHeap Analytics
    + JDK-8217561: X86: Add floating-point Math.min/max intrinsics
    + JDK-8217918: C2: -XX:+AggressiveUnboxing is broken
    + JDK-8218458: [TESTBUG] runtime/NMT/
    /CheckForProperDetailStackTrace.java fails with Expected
    stack trace missing from output
    + JDK-8219142: Remove unused JIMAGE_ResourcePath
    + JDK-8219586: CodeHeap State Analytics processes dead nmethods
    + JDK-8220074: Clean up GCC 8.3 errors in LittleCMS
    + JDK-8220407: compiler/intrinsics/math/
    /TestFpMinMaxIntrinsics.java timedout
    + JDK-8222302: [TESTBUG] test/hotspot/jtreg/compiler/intrinsics/
    /sha/cli/TestUseSHAOptionOnUnsupportedCPU.java fails on any
    other CPU
    + JDK-8222412: AARCH64: multiple instructions encoding issues
    + JDK-8223020: aarch64: expand minI_rReg and maxI_rReg patterns
    into separate instructions
    + JDK-8223444: Improve CodeHeap Free Space Management
    + JDK-8223504: Improve performance of forall loops by better
    inlining of "iterator()" methods
    + JDK-8223667: ASAN build broken
    + JDK-8225081: Remove Telia Company CA certificate expiring in
    April 2021
    + JDK-8225116: Test OwnedWindowsLeak.java intermittently fails
    + JDK-8225438: javax/net/ssl/TLSCommon/
    /TestSessionLocalPrincipal.java failed with Read timed out
    + JDK-8225756: [testbug] compiler/loopstripmining/
    /CheckLoopStripMining.java sets too short a
    SafepointTimeoutDelay
    + JDK-8226374: Restrict TLS signature schemes and named groups
    + JDK-8226627: assert(t-&gt;singleton()) failed: must be a constant
    + JDK-8226721: Missing intrinsics for Math.ceil, floor, rint
    + JDK-8227080: (fs) Files.newInputStream(...).skip(n) is slow
    + JDK-8227222: vmTestbase/jit/FloatingPoint/gen_math/Loops04/
    /Loops04.java failed XMM register should be 0-15
    + JDK-8227609: (fs) Files.newInputStream(...).skip(n) should
    allow skipping beyond file size
    + JDK-8230428: Cleanup dead CastIP node code in formssel.cpp
    + JDK-8231460: Performance issue (CodeHeap) with large free
    blocks
    + JDK-8231713: x86_32 build failures after JDK-8226721 (Missing
    intrinsics for Math.ceil, floor, rint)
    + JDK-8231841: AArch64: debug.cpp help() is missing an AArch64
    line for pns
    + JDK-8232084: HotSpot build failed with GCC 9.2.1
    + JDK-8232591: AArch64: Add missing match rules for smaddl,
    smsubl and smnegl
    + JDK-8233185: HttpServer.stop() blocks indefinitely when
    called on dispatch thread
    + JDK-8233787: Break cycle in vm_version* includes
    + JDK-8233948: AArch64: Incorrect mapping between OptoReg and
    VMReg for high 64 bits of Vector Register
    + JDK-8234355: Buffer overflow in jcmd GC.class_stats due to
    too many classes
    + JDK-8235368: Update BCEL to Version 6.4.1
    + JDK-8236859: WebSocket over authenticating proxy fails with
    NPE
    + JDK-8236992: AArch64: remove redundant load_klass in itable
    stub
    + JDK-8237743: test/langtools/jdk/jshell/
    /FailOverExecutionControlTest.java fails No
    ExecutionControlProvider with name 'nonExistent' and parameter
    keys: []
    + JDK-8237804: sun/security/mscapi tests fail with "Key pair
    not generated, alias &lt;nnnnnn&gt; already exists"
    + JDK-8238175: CTW: Class.getDeclaredMethods fails with
    assert(k-&gt;is_subclass_of(SystemDictionary::Throwable_klass()))
    failed: invalid exception class
    + JDK-8238567: SoftMainMixer.processAudioBuffers(): Wrong
    handling of stoppedMixers
    + JDK-8238812: assert(false) failed: bad AD file
    + JDK-8239312: [macos] javax/swing/JFrame/NSTexturedJFrame/
    /NSTexturedJFrame.java
    + JDK-8239386: handle ContendedPaddingWidth in
    vm_version_aarch64
    + JDK-8239536: Can't use 'java.util.List' object after
    importing 'java.awt.List'
    + JDK-8240487: Cleanup whitespace in .cc, .hh, .m, and .mm files
    + JDK-8240848: ArrayIndexOutOfBoundsException buf for
    TextCallbackHandler
    + JDK-8241082: Upgrade IANA Language Subtag Registry data to
    03-16-2020 version
    + JDK-8241087: Build failure with VS 2019 (16.5.0) due to C2039
    and C2873
    + JDK-8241101: [s390] jtreg test failure after JDK-8238696: not
    conformant features string
    + JDK-8241248: NullPointerException in
    sun.security.ssl.HKDF.extract(HKDF.java:93)
    + JDK-8241372: Several test failures due to
    javax.net.ssl.SSLException: Connection reset
    + JDK-8241475: AArch64: Add missing support for PopCountVI node
    + JDK-8241829: Cleanup the code for PrinterJob on windows
    + JDK-8241960: The SHA3 message digests impl of SUN provider
    are not thread safe after cloned
    + JDK-8242010: Upgrade IANA Language Subtag Registry to Version
    2020-04-01
    + JDK-8242429: Better implementation for sign extract
    + JDK-8242557: Add length limit for strings in PNGImageWriter
    + JDK-8242919: Paste locks up jshell
    + JDK-8243155: AArch64: Add support for SqrtVF
    + JDK-8243240: AArch64: Add support for MulVB
    + JDK-8243452: JFR: Could not create chunk in repository with
    over 200 recordings
    + JDK-8243559: Remove root certificates with 1024-bit keys
    + JDK-8243597: AArch64: Add support for integer vector abs
    + JDK-8244031: HttpClient should have more tests for HEAD
    requests
    + JDK-8244205: HTTP/2 tunnel connections through proxy may be
    reused regardless of which proxy is selected
    + JDK-8244847: Linux/PPC: runtime/CompressedOops/
    /CompressedClassPointers: smallHeapTest fails
    + JDK-8245511: G1 adaptive IHOP does not account for
    reclamation of humongous objects by young GC
    + JDK-8246274: G1 old gen allocation tracking is not in a
    separate class
    + JDK-8247354: [aarch64] PopFrame causes
    assert(oopDesc::is_oop(obj)) failed: not an oop
    + JDK-8247408: IdealGraph bit check expression canonicalization
    + JDK-8247432: Update IANA Language Subtag Registry to Version
    2020-09-29
    + JDK-8247438: JShell: When FailOverExecutionControlProvider
    fails the proximal cause is not shown
    + JDK-8247753: UIManager.getSytemLookAndFeelClassName() returns
    wrong value on Fedora 32
    + JDK-8248043: Need to eliminate excessive i2l conversions
    + JDK-8248411: [aarch64] Insufficient error handling when
    CodeBuffer is exhausted
    + JDK-8248568: compiler/c2/TestBit.java failed: test missing
    from stdout/stderr
    + JDK-8248870: AARCH64: I2L/L2I conversions can be skipped for
    masked positive values
    + JDK-8249142: java/awt/FontClass/CreateFont/DeleteFont.sh is
    unstable
    + JDK-8249189: AARCH64: more L2I conversions can be skipped
    + JDK-8249719: MethodHandle performance suffers from bad
    ResolvedMethodTable hash function
    + JDK-8249875: GCC 10 warnings -Wtype-limits with JFR code
    + JDK-8250635: MethodArityHistogram should use Compile_lock in
    favour of fancy checks
    + JDK-8250876: Fix issues with cross-compile on macos
    + JDK-8251031: Some vmTestbase/nsk/monitoring/RuntimeMXBean
    tests fail with hostnames starting from digits
    + JDK-8251525: AARCH64: Faster Math.signum(fp)
    + JDK-8252259: AArch64: Adjust default value of FLOATPRESSURE
    + JDK-8252311: AArch64: save two words in itable lookup stub
    + JDK-8252779: compiler/graalunit/HotspotTest.java failed after
    8251525
    + JDK-8252883: AccessDeniedException caused by delayed file
    deletion on Windows
    + JDK-8253167: ARM32 builds fail after JDK-8247910
    + JDK-8253572: [windows] CDS archive may fail to open with long
    file names
    + JDK-8253923: C2 doesn't always run loop opts for compilations
    that include loops
    + JDK-8253948: Memory leak in ImageFileReader
    + JDK-8254631: Better support ALPN byte wire values in SunJSSE
    + JDK-8254717: isAssignableFrom checks in
    KeyFactorySpi.engineGetKeySpec appear to be backwards
    + JDK-8255086: Update the root locale display names
    + JDK-8255625: AArch64: Implement Base64.encodeBlock
    accelerator/intrinsic
    + JDK-8255763: C2: OSR miscompilation caused by invalid memory
    instruction placement
    + JDK-8255992: JFR EventWriter does not use first string from
    StringPool with id 0
    + JDK-8256037: [TESTBUG] com/sun/jndi/dns/ConfigTests/
    /PortUnreachable.java fails due to the hard coded threshold
    is small
    + JDK-8256244: java/lang/ProcessHandle/PermissionTest.java
    fails with TestNG 7.1
    + JDK-8256287: [windows] add loop fuse to
    map_or_reserve_memory_aligned
    + JDK-8256523: Streamline Java SHA2 implementation
    + JDK-8257414: Drag n Drop target area is wrong on high DPI
    systems
    + JDK-8257569: Failure observed with
    JfrVirtualMemory::initialize
    + JDK-8257574: C2: "failed: parsing found no loops but there
    are some" assert failure
    + JDK-8257580: Bump update version for OpenJDK: jdk-11.0.12
    + JDK-8257604: JNI_ArgumentPusherVaArg leaks valist
    + JDK-8257621: JFR StringPool misses cached items across
    consecutive recordings
    + JDK-8257796: [TESTBUG]
    TestUseSHA512IntrinsicsOptionOnSupportedCPU.java fails
    on x86_32
    + JDK-8257822: C2 crashes with SIGFPE due to a division that
    floats above its zero check
    + JDK-8257828: SafeFetch may crash if invoked in non-JavaThreads
    + JDK-8257853: Remove dependencies on JNF's JNI utility
    functions in AWT and 2D code
    + JDK-8257858: [macOS]: Remove JNF dependency from
    libosxsecurity/KeystoreImpl.m
    + JDK-8257860: [macOS]: Remove JNF dependency from
    libosxkrb5/SCDynamicStoreConfig.m
    + JDK-8257988: Remove JNF dependency from
    libsaproc/MacosxDebuggerLocal.m
    + JDK-8258414: OldObjectSample events too expensive
    + JDK-8258505: [TESTBUG] TestDivZeroWithSplitIf.java fails due
    to missing UnlockDiagnosticVMOptions
    + JDK-8258753: StartTlsResponse.close() hangs due to
    synchronization issues
    + JDK-8259061: C2: assert(found) failed: memory-writing node is
    not placed in its original loop or an ancestor of it
    + JDK-8259227: C2 crashes with SIGFPE due to a division that
    floats above its zero check
    + JDK-8259232: Bad JNI lookup during printing
    + JDK-8259276: C2: Empty expression stack when reexecuting
    tableswitch/lookupswitch instructions after deoptimization
    + JDK-8259343: [macOS] Update JNI error handling in Cocoa code.
    + JDK-8259585: Accessible actions do not work on mac os x
    + JDK-8259651: [macOS] Replace JNF_COCOA_ENTER/EXIT macros
    + JDK-8259662: Don't wrap SocketExceptions into SSLExceptions
    in SSLSocketImpl
    + JDK-8259710: Inlining trace leaks memory
    + JDK-8259729: Missed JNFInstanceOf -&gt; IsInstanceOf conversion
    + JDK-8259777: Incorrect predication condition generated by ADLC
    + JDK-8259786: initialize last parameter of getpwuid_r
    + JDK-8259843: initialize dli_fname array before calling
    dll_address_to_library_name
    + JDK-8259869: [macOS] Remove desktop module dependencies on
    JNF Reference APIs
    + JDK-8259886: Improve SSL session cache performance and
    scalability
    + JDK-8259983: do not use uninitialized expand_ms value in
    G1CollectedHeap::expand_heap_after_young_collection
    + JDK-8260030: Improve stringStream buffer handling
    + JDK-8260236: better init AnnotationCollector _contended_group
    + JDK-8260255: C1: LoopInvariantCodeMotion constructor can
    leave some fields uninitialized
    + JDK-8260284: C2: assert(_base == Int) failed: Not an Int
    + JDK-8260380: Upgrade to LittleCMS 2.12
    + JDK-8260420: C2 compilation fails with assert(found_sfpt)
    failed: no node in loop that's not input to safepoint
    + JDK-8260426: awt debug_mem.c DMem_AllocateBlock might leak
    memory
    + JDK-8260432: allocateSpaceForGP in freetypeScaler.c might
    leak memory
    + JDK-8260616: Removing remaining JNF dependencies in the
    java.desktop module
    + JDK-8260653: Unreachable nodes keep speculative types alive
    + JDK-8260707: java/lang/instrument/PremainClass/
    /InheritAgent0100.java times out
    + JDK-8260925: HttpsURLConnection does not work  with other
    JSSE provider.
    + JDK-8260926: Trace resource exhausted events unconditionally
    + JDK-8261020: Wrong format parameter in
    create_emergency_chunk_path
    + JDK-8261027: AArch64: Support for LSE atomics C++ HotSpot code
    + JDK-8261167: print_process_memory_info add a close call after
    fopen
    + JDK-8261170: Upgrade to freetype 2.10.4
    + JDK-8261198: [macOS] Incorrect JNI parameters in number
    conversion in A11Y code
    + JDK-8261235: C1 compilation fails with
    assert(res-&gt;vreg_number() == index) failed: conversion check
    + JDK-8261261: The version extra fields needs to be overridable
    in jib-profiles.js
    + JDK-8261262: Kitchensink24HStress.java crashed with
    EXCEPTION_ACCESS_VIOLATION
    + JDK-8261354: SIGSEGV at MethodIteratorHost
    + JDK-8261355: No data buffering in SunPKCS11 Cipher encryption
    when the underlying mechanism has no padding
    + JDK-8261397: try catch Method failing to work when dividing
    an integer by 0
    + JDK-8261422: Adjust problematic String.format calls in
    jdk/internal/util/Preconditions.java outOfBoundsMessage
    + JDK-8261447: MethodInvocationCounters frequently run into
    overflow
    + JDK-8261481: Cannot read Kerberos settings in dynamic store
    on macOS Big Sur
    + JDK-8261505: Test test/hotspot/jtreg/gc/parallel/
    /TestDynShrinkHeap.java killed by Linux OOM Killer
    + JDK-8261601: free memory in early return in
    Java_sun_nio_ch_sctp_SctpChannelImpl_receive0
    + JDK-8261649: AArch64: Optimize LSE atomics in C++ code
    + JDK-8261730: C2 compilation fails with
    assert(store-&gt;find_edge(load) != -1) failed: missing
    precedence edge
    + JDK-8261752: Multiple GC test are missing memory requirements
    + JDK-8261791: (sctp) handleSendFailed in SctpChannelImpl.c
    potential leaks
    + JDK-8261812: C2 compilation fails with assert(!had_error)
    failed: bad dominance
    + JDK-8261914: IfNode::fold_compares_helper faces
    non-canonicalized bool when running JRuby JSON workload
    + JDK-8262093: java/util/concurrent/tck/JSR166TestCase.java
    failed "assert(false) failed: unexpected node"
    + JDK-8262110: DST starts from incorrect time in 2038
    + JDK-8262121: [11u] Redo 8244287: JFR: Methods samples have
    line number 0
    + JDK-8262163: Extend settings printout in jcmd VM.metaspace
    + JDK-8262295: C2: Out-of-Bounds Array Load from Clone Source
    + JDK-8262298: G1BarrierSetC2::step_over_gc_barrier fails with
    assert "bad barrier shape"
    + JDK-8262446: DragAndDrop hangs on Windows
    + JDK-8262461: handle wcstombsdmp return value correctly in
    unix awt_InputMethod.c
    + JDK-8262465: Very long compilation times and high memory
    consumption in C2 debug builds
    + JDK-8262726: AArch64: C1 StubAssembler::call_RT can corrupt
    stack
    + JDK-8262739: String inflation C2 intrinsic prevents insertion
    of anti-dependencies
    + JDK-8262829: Native crash in
    Win32PrintServiceLookup.getAllPrinterNames()
    + JDK-8262837: handle split_USE correctly
    + JDK-8262900: ToolBasicTest fails to access HTTP server it
    starts
    + JDK-8263260: [s390] Support latest hardware (z14 and z15)
    + JDK-8263311: Watch registry changes for remote printers
    update instead of polling
    + JDK-8263361: Incorrect arraycopy stub selected by C2 for SATB
    collectors
    + JDK-8263404: RsaPrivateKeySpec is always recognized as
    RSAPrivateCrtKeySpec in RSAKeyFactory.engineGetKeySpec
    + JDK-8263425: AArch64: two potential bugs in C1
    LIRGenerator::generate_address()
    + JDK-8263448: CTW: fatal error: meet not symmetric
    + JDK-8263504: Some OutputMachOpcodes fields are uninitialized
    + JDK-8263557: Possible NULL dereference in
    Arena::destruct_contents()
    + JDK-8263558: Possible NULL dereference in fast path arena
    free if ZapResourceArea is true
    + JDK-8263676: AArch64: one potential bug in C1
    LIRGenerator::generate_address()
    + JDK-8263729: [test] divert spurious output away from stream
    under test in ProcessBuilder Basic test
    + JDK-8263846: Bad JNI lookup getFocusOwner in accessibility
    code on Mac OS X
    + JDK-8264047: Duplicate global variable 'jvm' in libjavajpeg
    and libawt
    + JDK-8264096: slowdebug jvm crashes when StrInflatedCopy match
    rule is not supported
    + JDK-8264151: ciMethod::ensure_method_data() should return
    false is loading resulted in empty state
    + JDK-8264173: [s390] Improve Hardware Feature Detection And
    Reporting
    + JDK-8264190: Harden TLS interop tests
    + JDK-8264223: CodeHeap::verify fails extra_hops assertion in
    fastdebug test
    + JDK-8264328: Broken license in
    javax/swing/JComboBox/8072767/bug8072767.java
    + JDK-8264360: Loop strip mining verification fails with
    "should be on the backedge"
    + JDK-8264626: C1 should be able to inline excluded methods
    + JDK-8264640: CMS ParScanClosure misses a barrier
    + JDK-8264786: [macos] All Swing/AWT apps cause Allow
    Notifications prompt to appear when app is launched
    + JDK-8264821: DirectIOTest fails on a system with large block
    size
    + JDK-8264848: [macos] libjvm.dylib linker warning due to macOS
    version mismatch
    + JDK-8264923: PNGImageWriter.write_zTXt throws Exception with
    a typo
    + JDK-8264958: C2 compilation fails with assert "n is later
    than its clone"
    + JDK-8265099: Revert backport to 11u of 8236859: WebSocket
    over authenticating proxy fails with NPE
    + JDK-8265154: vinserti128 operand mix up for KNL platforms
    + JDK-8265239: Shenandoah: Shenandoah heap region count could
    be off by 1
    + JDK-8265417: Backport of JDK-8249672 breaks Solaris x86 build
    + JDK-8265421: java/lang/String/StringRepeat.java test is
    missing a memory requirement
    + JDK-8265462: Handle multiple slots in the NSS Internal Module
    from SunPKCS11's Secmod
    + JDK-8265537: x86 version string truncated after JDK-8249672
    11u backport
    + JDK-8265666: Enable AIX build platform to make external debug
    symbols
    + JDK-8265677: CMS: CardTableBarrierSet::write_ref_array_work()
    lacks storestore barrier
    + JDK-8265690: Use the latest Ubuntu base image version in
    Docker testing
    + JDK-8265718: Build failure after JDK-8258414 11u backport
    + JDK-8265750: Fatal error in safepoint.cpp after backport of
    8258414
    + JDK-8265784: [C2] Hoisting of DecodeN leaves MachTemp inputs
    behind
    + JDK-8265938: C2's conditional move optimization does not
    handle top Phi
    + JDK-8266220: keytool still prompt for store password on a
    password-less pkcs12 file if -storetype pkcs12 is specified
    + JDK-8266293: Key protection using PBEWithMD5AndDES fails with
    "java.security.InvalidAlgorithmParameterException: Salt must
    be 8 bytes long"
    + JDK-8266713: [AIX] Build failure after 11u backport of
    JDK-8247753
    + JDK-8266802: Shenandoah: Round up region size to page size
    unconditionally
    + JDK-8266892: avoid maybe-uninitialized gcc warnings on linux
    s390x
    + JDK-8266929: Unable to use algorithms from 3p providers
    + JDK-8267235: [macos_aarch64]
    InterpreterRuntime::throw_pending_exception messing up LR
    results in crash
    + JDK-8267561: Shenandoah: Reference processing not properly
    setup for outside of cycle degenerated GC
    + JDK-8267599: Revert the change to the default PKCS12
    macAlgorithm and macIterationCount props for 11u/8u/7u
    + JDK-8267641: [11u] 8227609 backport typo
    + JDK-8267721: Enable sun/security/pkcs11 tests for Amazon
    Linux 2 AArch64
    + JDK-8268678: LetsEncryptCA.java test fails as Let's Encrypt
    Authority X3 is retired</changelog>
  <changelog author="schwab@suse.de" date="1628078400">- riscv64-zero.patch: Add support for riscv64 (zero VM)</changelog>
  <changelog author="fstrba@suse.com" date="1629979200">- Added patch:
  * jdk11-glibc234.patch
    + fix build with glibc-2.34 (bsc#1189201)</changelog>
  <changelog author="fstrba@suse.com" date="1631534400">- Modified patch:
  * nss-security-provider.patch
    + revert recent changes making NSS provider the default one
    + fixes bsc#1190252</changelog>
  <changelog author="fstrba@suse.com" date="1631793600">- Added patch:
  * fips.patch
    + implement FIPS support in OpenJDK</changelog>
  <changelog author="fstrba@suse.com" date="1634817600">- Update to upstream tag jdk-11.0.13+8 (October 2021 CPU)
  * Security fixes
    + JDK-8163326, CVE-2021-35550, bsc#1191901: Update the default
    enabled cipher suites preference
    + JDK-8254967, CVE-2021-35565, bsc#1191909:
    com.sun.net.HttpsServer spins on TLS session close
    + JDK-8263314: Enhance XML Dsig modes
    + JDK-8265167, CVE-2021-35556, bsc#1191910: Richer Text Editors
    + JDK-8265574: Improve handling of sheets
    + JDK-8265580, CVE-2021-35559, bsc#1191911: Enhanced style for
    RTF kit
    + JDK-8265776: Improve Stream handling for SSL
    + JDK-8266097, CVE-2021-35561, bsc#1191912: Better hashing
    support
    + JDK-8266103: Better specified spec values
    + JDK-8266109: More Resilient Classloading
    + JDK-8266115: More Manifest Jar Loading
    + JDK-8266137, CVE-2021-35564, bsc#1191913: Improve Keystore
    integrity
    + JDK-8266689, CVE-2021-35567, bsc#1191903: More Constrained
    Delegation
    + JDK-8267086: ArrayIndexOutOfBoundsException in
    java.security.KeyFactory.generatePublic
    + JDK-8267712: Better LDAP reference processing
    + JDK-8267729, CVE-2021-35578, bsc#1191904: Improve TLS client
    handshaking
    + JDK-8267735, CVE-2021-35586, bsc#1191914: Better BMP support
    + JDK-8268193: Improve requests of certificates
    + JDK-8268199: Correct certificate requests
    + JDK-8268205: Enhance DTLS client handshake
    + JDK-8268506: More Manifest Digests
    + JDK-8269618, CVE-2021-35603, bsc#1191906: Better session
    identification
    + JDK-8269624: Enhance method selection support
    + JDK-8270398: Enhance canonicalization
    + JDK-8270404: Better canonicalization
  * Other changes
    + JDK-8024368: private methods are allocated vtable indices
    + JDK-8042902: Test java/net/Inet6Address/serialize/
    /Inet6AddressSerializationTest.java fails intermittently
    + JDK-8140466: ChaCha20 and Poly1305 TLS Cipher Suites
    + JDK-8157404: Unable to read certain PKCS12 keystores from
    SequenceInputStream
    + JDK-8158066: SourceDebugExtensionTest fails to rename file
    + JDK-8168304: Make all of DependencyContext_test available in
    product mode
    + JDK-8169246: java/net/DatagramSocket/ReportSocketClosed.java
    fails intermittently with BindException
    + JDK-8181313: SA: Remove libthread_db dependency on Linux
    + JDK-8193214: Incorrect annotations.without.processors
    warnings with JDK 9
    + JDK-8194230: jdk/internal/jrtfs/remote/
    /RemoteRuntimeImageTest.java fails with
    java.lang.NullPointerException
    + JDK-8196092: javax/swing/JComboBox/8032878/bug8032878.java
    fails
    + JDK-8199931: java/net/MulticastSocket/
    /UnreferencedMulticastSockets.java fails with "incorrect data
    received"
    + JDK-8206083: Make tools/javac/api/T6265137.java robust to JDK
    version changes
    + JDK-8206350: java/util/Locale/bcp47u/SystemPropertyTests.java
    failed on Mac 10.13 with zh_CN and zh_TW locales.
    + JDK-8207316: java/nio/channels/spi/SelectorProvider/
    /inheritedChannel/InheritedChannelTest.java failed
    + JDK-8208227: tools/jdeps/DotFileTest.java fails on Win-X64
    + JDK-8208363: test/jdk/java/lang/Package/
    /PackageFromManifest.java missing module dependencies
    declaration
    + JDK-8209380: ARM: cleanup maybe-uninitialized and reorder
    compiler warnings
    + JDK-8209768: Refactor java/util/prefs/CheckUserPrefsStorage.sh
    to plain java test
    + JDK-8209772: Refactor shell test java/util/ServiceLoader/
    /basic/basic.sh to java
    + JDK-8209773: Refactor shell test javax/naming/module/basic.sh
    to java
    + JDK-8209832: Refactor jdk/internal/reflect/Reflection/
    /GetCallerClassTest.sh to plain java test
    + JDK-8209930: Refactor java/util/zip/ZipFile/deletetempjar.sh
    to plain java test
    + JDK-8210406: Refactor java.util.PluggableLocale:i18n shell
    tests to plain java tests
    + JDK-8210407: Refactor java.util.Calendar:i18n shell tests to
    plain java tests
    + JDK-8210495: compiler crashes because of illegal signature in
    otherwise legal code
    + JDK-8210669: Some launcher tests assume a pre-JDK 9 run-time
    image layout
    + JDK-8210802: temp files left by tests in
    jdk/java/net/httpclient
    + JDK-8210819: Update the host name in CNameTest.java
    + JDK-8210908: Refactor java/util/prefs/PrefsSpi.sh to plain
    java test
    + JDK-8210934: Move sun/net/www/protocol/http/
    /GetErrorStream.java to OpenJDK
    + JDK-8210959: JShell fails and exits when statement throws an
    exception whose message contains a '%'.
    + JDK-8211055: Provide print to a file (PDF) feature even when
    printer was not connected
    + JDK-8211092: test/jdk/sun/net/www/http/HttpClient/
    /MultiThreadTest.java fails intermittently when cleaning up
    + JDK-8211296: Remove HotSpot deprecation warning suppression
    for Mac/clang
    + JDK-8211325: test/jdk/java/net/Socket/LingerTest.java fails
    with cleaning up
    + JDK-8212040: Compilation error due to wrong usage of
    NSPrintJobDispositionValue in mac10.12
    + JDK-8212695: Add explicit timeout to several HTTP Client tests
    + JDK-8212718: Refactor some annotation processor tests to
    better use collections
    + JDK-8213007: Update the link in test/jdk/sun/security/
    /provider/SecureRandom/DrbgCavp.java
    + JDK-8213137: Remove static initialization of monitor/mutex
    instances
    + JDK-8213235: java/nio/channels/SocketChannel/
    /AsyncCloseChannel.java fails with threads that didn't exit
    + JDK-8213409: Refactor sun.text.IntHashtable:i18n shell tests
    to plain java tests
    + JDK-8213576: Make test AsyncCloseChannel.java run in othervm
    + JDK-8213694: Test Timeout.java should run in othervm mode
    + JDK-8213718: [TEST] Wrong classname in vmTestbase/nsk/stress/
    /except/except002 and except003
    + JDK-8213922: fix ctw stand-alone build
    + JDK-8214195: Align stdout messages in
    test/jdk/java/math/BigInteger/PrimitiveConversionTests.java
    + JDK-8214520: [TEST_BUG] sun/security/mscapi/nonUniqueAliases/
    /NonUniqueAliases.java failed with incorrect jtreg tags order
    + JDK-8214937: sun/security/tools/jarsigner/warnings/
    /NoTimestampTest.java failed due to unexpected expiration date
    + JDK-8216532: tools/launcher/Test7029048.java fails (Solaris)
    + JDK-8217825: Verify @AfterTest is used correctly in WebSocket
    tests
    + JDK-8218145: block_if_requested is not proper inlined due to
    size
    + JDK-8219417: bump jtreg requiredVersion to b14
    + JDK-8219552: bump jtreg requiredVersion to b14 in
    test/jdk/sanity/client/
    + JDK-8219804: java/net/MulticastSocket/Promiscuous.java fails
    intermittently due to NumberFormatException
    + JDK-8220445: Support for side by side MSVC Toolset versions
    + JDK-8221988: add possibility to build with Visual Studio 2019
    + JDK-8222751: closed/test/jdk/sun/security/util/
    /DerIndefLenConverter/IndefBerPkcs12.java fail
    + JDK-8223050: JVMCI: findUniqueConcreteMethod() should not use
    Dependencies::find_unique_concrete_method() for non-virtual
    methods
    + JDK-8224853: CDS address sanitizer errors
    + JDK-8225082: Remove IdenTrust certificate that is expiring in
    September 2021
    + JDK-8225583: Examine the HttpResponse.BodySubscribers for
    null handling and multiple subscriptions
    + JDK-8225690: Multiple AttachListener threads can be created
    + JDK-8225790: Two NestedDialogs tests fail on Ubuntu
    + JDK-8226319: Add forgotten test/jdk/java/net/httpclient/
    /BodySubscribersTest.java
    + JDK-8226533: JVMCI: findUniqueConcreteMethod should handle
    statically bindable methods directly
    + JDK-8226602: Test convenience reactive primitives from
    java.net.http with RS TCK
    + JDK-8226683: Remove review suggestion from fix to 8219804
    + JDK-8227738: jvmti/DataDumpRequest/datadumpreq001 failed due
    to "exit code is 134"
    + JDK-8227766: CheckUnhandledOops is broken in MemAllocator
    + JDK-8227815: Minimal VM: set_state is not a member of
    AttachListener
    + JDK-8230674: Heap dumps should exclude dormant CDS archived
    objects of unloaded classes
    + JDK-8230808: Remove Access::equals()
    + JDK-8230841: Remove oopDesc::equals()
    + JDK-8231717: Improve performance of charset decoding when
    charset is always compactable
    + JDK-8232243: Wrong caret position in JTextPane on Windows
    with a screen resolution &gt; 100%
    + JDK-8232782: Shenandoah: streamline post-LRB CAS barrier
    (aarch64)
    + JDK-8233790: Forward output from heap dumper to jcmd/jmap
    + JDK-8233989: Create an IPv4 version of
    java/net/MulticastSocket/SetLoopbackMode.java
    + JDK-8234510: Remove file seeking requirement for writing a
    heap dump
    + JDK-8235211: serviceability/attach/
    /RemovingUnixDomainSocketTest.java fails with
    AttachNotSupportedException: Unable to open socket file
    + JDK-8235216: typo in test filename
    + JDK-8235866: bump jtreg requiredVersion to 4.2b16
    + JDK-8236111: narrow allowSmartActionArgs disabling
    + JDK-8236413: AbstractConnectTimeout should tolerate both
    NoRouteToHostException and UnresolvedAddressException
    + JDK-8236671: NullPointerException in JKS keystore
    + JDK-8238930: problem list compiler/c2/Test8004741.java
    + JDK-8238943: switch to jtreg 5.0
    + JDK-8240555: Using env of JAVA_TOOL_OPTIONS and _JAVA_OPTIONS
    breaks QuietOption.java test
    + JDK-8240983: Incorrect copyright header in Apache Santuario
    2.1.3 files
    + JDK-8241336: Some java.net tests failed with
    NoRouteToHostException on MacOS with special network
    configuration
    + JDK-8241353: NPE in ToolProvider.getSystemJavaCompiler
    + JDK-8241768: git needs .gitattributes
    + JDK-8242882: opening jar file with large manifest might throw
    NegativeArraySizeException
    + JDK-8244973: serviceability/attach/
    /RemovingUnixDomainSocketTest.java fails "stderr was not
    empty"
    + JDK-8245134: test/lib/jdk/test/lib/security/
    /KeyStoreUtils.java should allow to specify aliases
    + JDK-8246261: TCKLocalTime.java failed due to "AssertionError:
    expected [18:14:22] but found [18:14:23]"
    + JDK-8246387: switch to jtreg 5.1
    + JDK-8247421: [TESTBUG] ReturnBlobToWrongHeapTest.java failed
    allocating blob
    + JDK-8247469: getSystemCpuLoad() returns -1 on linux when some
    offline cpus are present and cpusets.effective_cpus is not
    available
    + JDK-8248352: [TEST_BUG] Test test/jdk/java/awt/font/
    /TextLayout/ArabicDiacriticTest.java can leave frame open
    + JDK-8248403: AArch64: Remove uses of kernel integer types
    + JDK-8248414: AArch64: Remove uses of long and unsigned long
    ints
    + JDK-8248657: Windows: strengthening in ThreadCritical
    regarding memory model
    + JDK-8248666: AArch64: Use THREAD_LOCAL instead of __thread
    + JDK-8248668: AArch64: Avoid MIN/MAX macros when using MSVC
    + JDK-8248671: AArch64: Remove unused variables
    + JDK-8248682: AArch64: Use ATTRIBUTE_ALIGNED helper
    + JDK-8248816: C1: Fix signature conflict in
    LIRGenerator::strength_reduce_multiply
    + JDK-8249095: tools/javac/launcher/SourceLauncherTest.java
    fails on Windows
    + JDK-8249548: backward focus traversal gets stuck in button
    group
    + JDK-8249773: Upgrade ReceiveISA.java test to be resilient to
    failure due to stray packets and interference
    + JDK-8249897: jdk/javadoc/tool/LangVers.java uses @ignore w/o
    bug-id
    + JDK-8249898: jdk/javadoc/tool/6176978/T6176978.java uses
    @ignore w/o bug-id
    + JDK-8249899: jdk/javadoc/tool/InlineTagsWithBraces.java uses
    @ignore w/o bug-id
    + JDK-8250588: Shenandoah: LRB needs to save/restore fp
    registers for runtime call
    + JDK-8250824: AArch64: follow up for JDK-8248414
    + JDK-8251166: Add automated testcases for changes done in
    JDK-8214112
    + JDK-8251252: Add automated testcase for fix done in
    JDK-8214253
    + JDK-8251254: Add automated test for fix done in JDK-8218472
    + JDK-8251361: Potential race between Logger configuration and
    GCs in HttpURLConWithProxy test
    + JDK-8251549: Update docs on building for Git
    + JDK-8251945: SIGSEGV in
    PackageEntry::purge_qualified_exports()
    + JDK-8252194: Add automated test for fix done in JDK-8218469
    + JDK-8252648: Shenandoah: name gang tasks consistently
    + JDK-8252825: Add automated test for fix done in JDK-8218479
    + JDK-8252853: AArch64: gc/shenandoah/TestVerifyJCStress.java
    fails intermittently with C1
    + JDK-8252857: AArch64: Shenandoah C1 CAS is not sequentially
    consistent
    + JDK-8253048: AArch64: When CallLeaf, no need to preserve
    callee-saved registers in caller
    + JDK-8253424: Add support for running pre-submit testing using
    GitHub Actions
    + JDK-8253631: Remove unimplemented CompileBroker methods after
    JEP-165
    + JDK-8253865: Pre-submit testing using GitHub Actions does not
    detect failures reliably
    + JDK-8253899: Make IsClassUnloadingEnabled signature match
    specification
    + JDK-8254024: Enhance native libs for AWT and Swing to work
    with GraalVM Native Image
    + JDK-8254054: Pre-submit testing using GitHub Actions should
    not use the deprecated set-env command
    + JDK-8254173: Add Zero, Minimal hotspot targets to submit
    workflow
    + JDK-8254175: Build no-pch configuration in debug mode for
    submit checks
    + JDK-8254244: Some code emitted by TemplateTable::branch is
    unused when running TieredCompilation
    + JDK-8254270: linux 32 bit build doesn't compile
    libjdwp/log_messages.c
    + JDK-8254282: Add Linux x86_32 builds to submit workflow
    + JDK-8254850: Update terminology in java.awt.GridBagLayout
    source code comments
    + JDK-8255255: Update Apache Santuario (XML Signature) to
    version 2.2.1
    + JDK-8255305: Add Linux x86_32 tier1 to submit workflow
    + JDK-8255352: Archive important test outputs in submit workflow
    + JDK-8255373: Submit workflow artifact name is always
    "test-results_.zip"
    + JDK-8255452: Doing GC during JVMTI MethodExit event posting
    breaks return oop
    + JDK-8255718: Zero: VM should know it runs in interpreter-only
    mode
    + JDK-8255790: GTKL&amp;F: Java 16 crashes on initialising GTKL&amp;F
    on Manjaro Linux
    + JDK-8255810: Zero: build fails without JVMTI
    + JDK-8255895: Submit workflow artifacts miss hs_errs/replays
    due to ZIP include mismatch
    + JDK-8256127: Add cross-compiled foreign architectures builds
    to submit workflow
    + JDK-8256215: Shenandoah: re-organize saving/restoring machine
    state in assembler code
    + JDK-8256267: Relax compiler/floatingpoint/NaNTest.java for
    x86_32 and lower -XX:+UseSSE
    + JDK-8256277: Github Action build on macOS should define OS
    and Xcode versions
    + JDK-8256354: Github Action build on Windows should define OS
    and MSVC versions
    + JDK-8256393: Github Actions build on Linux should define OS
    and GCC versions
    + JDK-8256414: add optimized build to submit workflow
    + JDK-8256747: GitHub Actions: decouple the hotspot build-only
    jobs from Linux x64 testing
    + JDK-8257056: Submit workflow should apt-get update to avoid
    package installation errors
    + JDK-8257148: Remove obsolete code in AWTView.m
    + JDK-8257497: Update keytool to create AKID from the SKID of
    the issuing certificate as specified by RFC 5280
    + JDK-8257620: Do not use objc_msgSend_stret to get macOS
    version
    + JDK-8257913: Add more known library locations to simplify
    Linux cross-compilation
    + JDK-8258703: Incorrect 512-bit vector registers restore on
    x86_32
    + JDK-8259338: Add expiry exception for identrustdstx3 alias to
    VerifyCACerts.java test
    + JDK-8259535: ECDSA SignatureValue do not always have the
    specified length
    + JDK-8259679: GitHub actions should use MSVC 14.28
    + JDK-8259924: GitHub actions fail on Linux x86_32 with "Could
    not configure libc6:i386"
    + JDK-8260460: GitHub actions still fail on Linux x86_32 with
    "Could not configure libc6:i386"
    + JDK-8260589: Crash in JfrTraceIdLoadBarrier::load(_jclass*)
    + JDK-8260923: Add more tests for SSLSocket input/output
    shutdown
    + JDK-8261072: AArch64: Fix MacroAssembler::get_thread
    convention
    + JDK-8261147: C2: Node is wrongly marked as reduction
    resulting in a wrong execution due to wrong vector instructions
    + JDK-8261238: NMT should not limit baselining by size threshold
    + JDK-8261496: Shenandoah: reconsider pacing updates memory
    ordering
    + JDK-8261652: Remove some dead comments from os_bsd_x86
    + JDK-8261846: [JVMCI] c2v_iterateFrames can get out of sync
    with the StackFrameStream
    + JDK-8262000: jdk/jfr/event/gc/detailed/
    /TestPromotionFailedEventWithParallelScavenge.java failed with
    "OutOfMemoryError: Java heap space"
    + JDK-8262017: C2: assert(n != __null) failed: Bad immediate
    dominator info.
    + JDK-8262392: Update Mesa 3-D Headers to version 21.0.3
    + JDK-8262409: sun/security/ssl/SSLSocketImpl/
    /SSLSocketImplThrowsWrongExceptions. SSL test failures caused
    by java failed with "Server reported the wrong exception"
    + JDK-8262470: Printed GlyphVector outline with low DPI has bad
    quality on Windows
    + JDK-8262862: Harden tests sun/security/x509/URICertStore/
    /ExtensionsWithLDAP.java and krb5/canonicalize/Test.java
    + JDK-8263136: C4530 was reported from VS 2019 at access bridge
    + JDK-8263227: C2: inconsistent spilling due to dead nodes in
    exception block
    + JDK-8263382: java/util/logging/ParentLoggersTest.java failed
    with "checkLoggers: getLoggerNames() returned unexpected
    loggers"
    + JDK-8263407: SPARC64 detection fails on Athena (SPARC64-X)
    + JDK-8263432: javac may report an invalid package/class clash
    on case insensitive filesystems
    + JDK-8263490: [macos] Crash occurs on JPasswordField with
    activated InputMethod
    + JDK-8263531: Remove unused buffer int
    + JDK-8263667: Avoid running GitHub actions on branches named
    pr/*
    + JDK-8263776: [JVMCI] add helper to perform Java upcalls
    + JDK-8264016: [JVMCI] add some thread local fields for use by
    JVMCI
    + JDK-8264752: SIGFPE crash with option
    FlightRecorderOptions:threadbuffersize=30M
    + JDK-8265132: C2 compilation fails with assert "missing
    precedence edge"
    + JDK-8265231: (fc) ReadDirect and WriteDirect tests fail after
    fix for JDK-8264821
    + JDK-8265335: Epsilon: Minor typo in EpsilonElasticTLABDecay
    description
    + JDK-8265756: AArch64: initialize memory allocated for locals
    according to Windows AArch64 stack page growth requirement in
    template interpreter
    + JDK-8265761: Font with missed font family name is not
    properly printed on Windows
    + JDK-8265773: incorrect jdeps message "jdk8internals" to
    describe a removed JDK internal API
    + JDK-8265836: OperatingSystemImpl.getCpuLoad() returns
    incorrect CPU load inside a container
    + JDK-8266018: Shenandoah: fix an incorrect assert
    + JDK-8266206: Build failure after JDK-8264752 with older GCCs
    + JDK-8266248: Compilation failure in
    PLATFORM_API_MacOSX_MidiUtils.c with Xcode 12.5
    + JDK-8266288: assert root method not found in
    witnessed_reabstraction_in_supers is too strong
    + JDK-8266404: Fatal error report generated with
  - XX:+CrashOnOutOfMemoryError should not contain suggestion to
    submit a bug report
    + JDK-8266480: Implicit null check optimization does not update
    control of hoisted memory operation
    + JDK-8266615: C2 incorrectly folds subtype checks involving an
    interface array
    + JDK-8266642: Improve ResolvedMethodTable hash function
    + JDK-8266749: AArch64: Backtracing broken on PAC enabled
    systems
    + JDK-8266761: AssertionError in
    sun.net.httpserver.ServerImpl.responseCompleted
    + JDK-8266813: Shenandoah: Use shorter instruction sequence for
    checking if marking in progress
    + JDK-8267042: bug in monitor locking/unlocking on ARM32 C1 due
    to uninitialized BasicObjectLock::_displaced_header
    + JDK-8267348: Rewrite gc/epsilon/TestClasses.java to use
    Metaspace with less classes
    + JDK-8267396: Avoid recording "pc" in unhandled oops detector
    for better performance
    + JDK-8267399: C2: java/text/Normalizer/ConformanceTest.java
    test failed with assertion
    + JDK-8267424: CTW: C1 fails with "State must not be null"
    + JDK-8267459: Pasting Unicode characters into JShell does not
    work.
    + JDK-8267625: AARCH64: typo in LIR_Assembler::emit_profile_type
    + JDK-8267666: Add option to jcmd GC.heap_dump to use existing
    file
    + JDK-8267695: Bump update version for OpenJDK: jdk-11.0.13
    + JDK-8267751: (test) jtreg.SkippedException has no serial
    VersionUID
    + JDK-8267773: PhaseStringOpts::int_stringSize doesn't handle
    min_jint correctly
    + JDK-8268103: JNI functions incorrectly return a double after
    JDK-8265836
    + JDK-8268127: Shenandoah: Heap size may be too small for
    region to align to large page size
    + JDK-8268261: C2: assert(n != __null) failed: Bad immediate
    dominator info.
    + JDK-8268347: C2: nested locks optimization may create
    unbalanced monitor enter/exit code
    + JDK-8268360: Missing check for infinite loop during node
    placement
    + JDK-8268362: [REDO] C2 crash when compile negative
    Arrays.copyOf length after loop
    + JDK-8268366: Incorrect calculation of has_fpu_registers in C1
    linear scan
    + JDK-8268369: SIGSEGV in PhaseCFG::implicit_null_check due to
    missing null check
    + JDK-8268417: Add test from JDK-8268360
    + JDK-8268427: Improve AlgorithmConstraints:checkAlgorithm
    performance
    + JDK-8268617: [11u REDO] - WebSocket over authenticating proxy
    fails with NPE
    + JDK-8268620: InfiniteLoopException test may fail on x86
    platforms
    + JDK-8268635: Corrupt oop in ClassLoaderData
    + JDK-8268699: Shenandoah: Add test for JDK-8268127
    + JDK-8268771: javadoc -notimestamp option does not work on
    index.html
    + JDK-8268775: Password is being converted to String in
    AccessibleJPasswordField
    + JDK-8268776: Test `ADatagramSocket.java` missing /othervm
    from @run tag
    + JDK-8268965: TCP Connection Reset when connecting simple
    socket to SSL server
    + JDK-8269304: Regression ~5% in 2005 in b27
    + JDK-8269415: [11u] Remove ea from
    DEFAULT_PROMOTED_VERSION_PRE in OpenJDK 11u
    + JDK-8269478: Shenandoah: gc/shenandoah/mxbeans tests should
    be more resilient
    + JDK-8269529: javax/swing/reliability/
    /HangDuringStaticInitialization.java fails in Windows debug
    build
    + JDK-8269594: assert(_handle_mark_nesting &gt; 1) failed: memory
    leak: allocating handle outside HandleMark
    + JDK-8269614: [s390] Interpreter checks wrong bit for slow
    path instance allocation
    + JDK-8269650: Optimize gc-locker in
    [Get|Release]StringCritical for latin string
    + JDK-8269661: JNI_GetStringCritical does not lock char array
    + JDK-8269668: [aarch64] java.library.path not including
    /usr/lib64
    + JDK-8269763: The JEditorPane is blank after JDK-8265167
    + JDK-8269795: C2: Out of bounds array load floats above its
    range check in loop peeling resulting in SEGV
    + JDK-8269847: JDK-8269594 backport breaks 11u builds
    + JDK-8269850: Most JDK releases report macOS version 12 as
    10.16 instead of 12.0
    + JDK-8269851: OperatingSystemMXBean getProcessCpuLoad reports
    incorrect process cpu usage in containers
    + JDK-8269882: stack-use-after-scope in NewObjectA
    + JDK-8269934: RunThese24H.java failed with
    EXCEPTION_ACCESS_VIOLATION in
    java_lang_Thread::get_thread_status
    + JDK-8270096: Shenandoah: Optimize gc/shenandoah/
    /TestRefprocSanity.java for interpreter mode
    + JDK-8270137: Kerberos Credential Retrieval from Cache not
    Working in Cross-Realm Setup
    + JDK-8270184: [TESTBUG] Add coverage for jvmci
    ResolvedJavaType.toJavaName() for lambdas
    + JDK-8270196: [11u] [JVMCI] JavaType.toJavaName() returns
    incorrect type name for lambdas
    + JDK-8270556: Exclude security/infra/java/security/cert/
    /CertPathValidator/certification/LetsEncryptCA
    + JDK-8270893: IndexOutOfBoundsException while reading large
    TIFF file
    + JDK-8272078: Wrong Checksums in Temurin BootJDK dependencies
    + JDK-8272124: Cgroup v1 initialization causes
    NullPointerException when cgroup path contains colon
    + JDK-8272131: PhaseMacroExpand::generate_slow_arraycopy crash
    when clone null CallProjections.fallthrough_ioproj
    + JDK-8272197: Update 11u GHA workflow with Shenandoah
    configurations
    + JDK-8272332: --with-harfbuzz=system doesn't add -lharfbuzz
    after JDK-8255790
    + JDK-8272472: StackGuardPages test doesn't build with glibc
    2.34
    + JDK-8272602: [macos] not all KEY_PRESSED events sent when
    control modifier is used
    + JDK-8272628: Problemlist gc/stress/gcbasher/
    /TestGCBasherWithCMS.java for x86_32
    + JDK-8272700: [macos] Build failure with Xcode 13.0 after
    JDK-8264848
    + JDK-8272772: Shenandoah: compiler/c2/aarch64/
    /TestVolatilesShenandoah.java fails in 11u
    + JDK-8273939: Backport of 8248414 to JDK11 breaks
    MacroAssembler::adrp
- Remove the unneeded icedtea-sound provider
- Removed patches:
  * icedtea-sound-1.0.1-jdk9.patch
  * icedtea-sound-soundproperties.patch
    + not needed since the icedtea-sound provider is removed
  * jdk11-glibc234.patch
    + integrated upstream</changelog>
  <changelog author="fstrba@suse.com" date="1635940800">- Modified patches:
  * system-crypto-policy.patch
    + rediff to changed context
  * fips.patch
    + Allow plain key import in fips mode unless
    com.suse.fips.plainKeySupport is set to false</changelog>
  <changelog author="fstrba@suse.com" date="1636113600">- Modified patch:
  * fips.patch
    + return in native code after generating java.io.IOException</changelog>
</package>
<package pkgid="81de5c622e8a451470f6e179a5bb2311c228bdd672741fe51f3efdca27e0a15b" name="java-11-openjdk-accessibility" arch="aarch64">
  <version epoch="0" ver="11.0.13.0" rel="3.68.1"/>
  <changelog author="fstrba@suse.com" date="1586952000">- The pack200 and unpack200 alternatives should be slaves of java
  and not of javac, since they are part of JRE.</changelog>
  <changelog author="fstrba@suse.com" date="1587470400">- Update to upstream tag jdk-11.0.7+10 (April 2020 CPU,
  bsc#1169511)
  * Security fixes:
    + S8223898, CVE-2020-2754: Forward references to Nashorn
    + S8223904, CVE-2020-2755: Improve Nashorn matching
    + S8224541, CVE-2020-2756: Better mapping of serial ENUMs
    + S8224549, CVE-2020-2757: Less Blocking Array Queues
    + S8225603: Enhancement for big integers
    + S8226346: Build better binary builders
    + S8227467: Better class method invocations
    + S8227542: Manifest improved jar headers
    + S8229733: TLS message handling improvements
    + S8231415, CVE-2020-2773: Better signatures in XML
    + S8231785: Improved socket permissions
    + S8232424, CVE-2020-2778: More constrained algorithms
    + S8232581, CVE-2020-2767: Improve TLS verification
    + S8233250: Better X11 rendering
    + S8233410: Better Build Scripting
    + S8234027: Better JCEKS key support
    + S8234408, CVE-2020-2781: Improve TLS session handling
    + S8234825, CVE-2020-2800: Better Headings for HTTP Servers
    + S8234841, CVE-2020-2803: Enhance buffering of byte buffers
    + S8235274, CVE-2020-2805: Enhance typing of methods
    + S8235691, CVE-2020-2816: Enhance TLS connectivity
    + S8236201, CVE-2020-2830: Better Scanner conversions
    + S8238960: linux-i586 builds are inconsistent as the newly
    built jdk is not able to reserve enough space for object heap
  * Other changes:
    + S4919790: Errors in alert ssl message does not reflect the
    actual certificate status
    + S4949105: Access Bridge lacks html tags parsing
    + S7092821: java.security.Provider.getService() is synchronized
    and became scalability bottleneck
    + S7143743: Potential memory leak with zip provider
    + S8005819: Support cross-realm MSSFU
    + S8042383: [TEST_BUG] Test javax/swing/plaf/basic/BasicMenuUI/
    /4983388/bug4983388.java fails with shortcuts on menus do not
    work
    + S8068184: Fix for JDK-8032832 caused a deadlock
    + S8145845: [AOT] NullPointerException in
    compiler/whitebox/GetCodeHeapEntriesTest.java
    + S8152988: [AOT] Update test batch definitions to include
    aot-ed java.base module mode into hs-comp testing
    + S8160926: FLAGS_COMPILER_CHECK_ARGUMENTS doesn't handle
    cross-compilation
    + S8163083: SocketListeningConnector does not allow invocations
    with port 0
    + S8163251: Hard coded loop limit prevents reading of smart
    card data greater than 8k
    + S8167276: jvmci/compilerToVM/MaterializeVirtualObjectTest.java
    fails with -XX:-EliminateAllocations
    + S8169718: nsk/jdb/locals/locals002: ERROR: Cannot find
    boolVar with expected value: false
    + S8176556:
    java/awt/dnd/ImageTransferTest/ImageTransferTest.java fails
    for JFIF
    + S8178798: Two compiler/aot/verification/vmflags tests fail by
    timeout with UseAVX=3
    + S8183107: PKCS11 regression regarding checkKeySize
    + S8185005: Improve performance of
    ThreadMXBean.getThreadInfo(long ids[], int maxDepth)
    + S8189633: Missing -Xcheck:jni checking for DeleteWeakGlobalRef
    + S8189861: Refactor CacheFind
    + S8193042: NativeLookup::lookup_critical_entry() should only
    load shared library once
    + S8193596: java/net/DatagramPacket/ReuseBuf.java failed due to
    timeout
    + S8194944: Regression automated test 'open/test/jdk/javax/
    /swing/JInternalFrame/8145896/TestJInternalFrameMaximize.java'
    fails
    + S8196467: javax/swing/JInternalFrame/Test6325652.java fails
    + S8196969: JTreg Failure: serviceability/sa/ClhsdbJstack.java
    causes NPE
    + S8198321: javax/swing/JEditorPane/5076514/bug5076514.java
    fails
    + S8198398: Test javax/swing/JColorChooser/Test6199676.java
    fails in mach5
    + S8199072: Test javax/swing/GroupLayout/6613904/
    /bug6613904.java is unstable
    + S8200432: javadoc fails with ClassCastException on {@link
    byte[]}
    + S8201349: build broken when configured with
  - -with-zlib=bundled on gcc 7.3
    + S8201355: Avoid native memory allocation in
    sun.security.mscapi.PRNG.generateSeed
    + S8201513: nsk/jvmti/IterateThroughHeap/filter-* are broken
    + S8203364: Some serviceability/sa/ tests intermittently fail
    with java.io.IOException: LingeredApp terminated with non-zero
    exit code 3
    + S8203687: javax/net/ssl/compatibility/Compatibility.java
    supports TLS 1.3
    + S8203904: javax/swing/JSplitPane/4816114/bug4816114.java: The
    divider location is wrong
    + S8203911: Test runtime/modules/getModuleJNI/GetModule fails
    with -Xcheck:jni
    + S8204525: [TESTBUG] runtime/NMT/MallocStressTest.java ran out
    of java heap
    + S8204529: gc/TestAllocateHeapAtMultiple.java fail with Agent
    7 timed out
    + S8204551: Event descriptions are truncated in logs
    + S8206963: [AOT] bug with multiple class loaders
    + S8207367: 10 vmTestbase/nsk/jdi tests timed out when running
    with jtreg
    + S8207832: serviceability/sa/ClhsdbCDSCore.java failed with
    "Couldn't find core file location"
    + S8207938: At step6,Click Add button,case failed automatically.
    + S8208157: requires.VMProps throws NPE for missing properties
    in "release" file
    + S8208379: compiler/jvmci/events/
    /JvmciNotifyInstallEventTest.java failed with "Got unexpected
    event count after 2nd install attempt: expected 9 to equal 2"
    + S8208658: Make CDS archived heap regions usable even if
    compressed oop encoding has changed
    + S8208715: Conversion of milliseconds to nanoseconds in
    UNIXProcess contains bug
    + S8209361: [AOT] Unexpected number of references for
    JVMTI_HEAP_REFERENCE_CONSTANT_POOL [111--&gt;111]: 0 (expected
    at least 1)
    + S8209385: CDS runtime classpath checking is too strict when
    only classes from the system modules are archived
    + S8209389: SIGSEGV in WalkOopAndArchiveClosure::do_oop_work.
    + S8209418: Synchronize test/jdk/sanity/client/lib/jemmy with
    code-tools/jemmy/v2
    + S8209494: Create a test for SwingSet InternalFrameDemo
    + S8209499: Create test for SwingSet EditorPaneDemo
    + S8209574: [AOT] breakpoint events are generated in different
    threads does not meet expected count
    + S8209686: cleanup arguments to PhaseIdealLoop() constructor
    + S8209789: Synchronize test/jdk/sanity/client/lib/jemmy with
    code-tools/jemmy/v2
    + S8209802: Garbage collectors should register JFR types
    themselves to avoid build errors.
    + S8209807: improve handling exception in requires.VMProps
    + S8209817: stack is executable when building with Clang on
    Linux
    + S8209824: Improve the code coverage for ThreadLocal
    + S8209826: Undefined reference to os::write after JDK-8209657
    (filemap.hpp cleanup)
    + S8209850: Allow NamedThreads to use GlobalCounter critical
    sections
    + S8209976: Improve iteration over non-JavaThreads
    + S8209993: Create a test for SwingSet3 ToolTipDemo
    + S8210024: JFR calls virtual is_Java_thread from ~Thread()
    + S8210052: Enable testing for all the available look and feels
    in SwingSet3 demo tests
    + S8210055: Enable different look and feel tests in SwingSet3
    demo tests
    + S8210057: Enable different look and feels in SwingSet3 demo
    test InternalFrameDemoTest
    + S8210058: Algorithmic Italic font leans opposite angle in
    Printing
    + S8210220: [AOT] jdwp test cases are failing with error #
    ERROR: TEST FAILED: Cought IOException while receiving event
    packet
    + S8210289: ArchivedKlassSubGraphInfoRecord is incomplete
    + S8210459: Add support for generating compile_commands.json
    + S8210476: sun/security/mscapi/PrngSlow.java fails with Still
    too slow
    + S8210512: [Testbug] vmTestbase/nsk/jdi/ObjectReference/
    /referringObjects/referringObjects002/referringObjects002.java
    fails with unexpected size of
    ClassLoaderReference.referringObjects
    + S8210523: runtime/appcds/cacheObject/DifferentHeapSizes.java
    crash
    + S8210632: Add key exchange algorithm to
    javax/net/ssl/TLSCommon/CipherSuite.java
    + S8210699: Problem list tests which times out in Xcomp mode
    + S8210793: [JVMCI] AllocateCompileIdTest.java failed to find
    DiagnosticCommand.class
    + S8210910: Create test for FileChooserDemo
    + S8210994: Create test for SwingSet3 FrameDemo
    + S8211139: Increase timeout value in all tests under
    jdk/sanity/client/SwingSet/src
    + S8211160: Handle different look and feels in
    JInternalFrameOperator
    + S8211211: vmTestbase/metaspace/stressDictionary/
    /StressDictionary.java timeout
    + S8211322: Reduce the timeout of tooltip in SwingSet2DemoTest
    + S8211443: Enable different look and feels in SwingSet3 demo
    test SplitPaneDemoTest
    + S8211703: JInternalFrame : java.lang.AssertionError: cannot
    find the internal frame
    + S8211781: re-building fails after changing Graal sources
    + S8212897: Some improvements in the EditorPaneDemotest
    + S8212903: [TestBug] Tests test/jdk/javax/swing/LookAndFeel/
    /8145547/DemandGTK2.sh and DemandGTK3.sh fail on Ubuntu 18.04
    LTS
    + S8213009: Refactoring existing SunMSCAPI classes
    + S8213010: Supporting keys created with certmgr.exe
    + S8213168: Enable different look and feel tests in SwingSet3
    demo test FileChooserDemoTest
    + S8213348: jdk.internal.vm.compiler.management service
    providers missing in module descriptor
    + S8213906: Update arm devkits with libXrandr headers
    + S8213908: AssertionError in DeferredAttr at setOverloadKind
    + S8214124: [TESTBUG] Bugs in runtime/NMT/MallocStressTest.java
    + S8214344: C2: assert(con.basic_type() != T_ILLEGAL) failed:
    elembt=byte; loadbt=void; unsigned=0
    + S8214345: infinite recursion while checking super class
    + S8214471: Enable different look and feel tests in SwingSet3
    demo test ToolTipDemoTest
    + S8214534: Setting of THIS_FILE in the build is broken
    + S8214557: Filter out VM flags which don't affect AOT code
    generation
    + S8214578: [macos] Problem with backslashes on macOS/JIS
    keyboard: Java ignores system settings
    + S8214840: runtime/NMT/MallocStressTest.java timed out
    + S8214850: Rename vm_operations.?pp files to vmOperations.?pp
    files
    + S8214904: Test8004741.java failed due to "Too few ThreadDeath
    hits; expected at least 6 but saw only 5"
    + S8215322: add @file support to jaotc
    + S8215355: Object monitor deadlock with no threads holding the
    monitor (using jemalloc 5.1)
    + S8215396: JTabbedPane preferred size calculation is wrong for
    SCROLL_TAB_LAYOUT
    + S8216180: [AOT] compiler/intrinsics/bigInteger/TestMulAdd.java
    crashed with AOT enabled
    + S8216353: Use utility APIs introduced in org/netbeans/jemmy/
    /util/LookAndFeel class in client sanity test cases
    + S8216354: Syntax error in toolchain_windows.m4
    + S8216472: (se) Stack overflow during selection operation
    leads to crash (win)
    + S8216535: tools/jimage/JImageExtractTest.java timed out
    + S8217235: Create automated test for SwingSet
    ColorChooserDemoTest
    + S8217297: Add support for multiple look and feel for SwingSet
    SliderDemoTest
    + S8217338: [Containers] Improve systemd slice memory limit
    support
    + S8217613: [AOT] TEST_OPTS_AOT_MODULES doesn't work on mac
    + S8217634: RunTest documentation and usability update
    + S8217717: ZGC: Broken oop map in C1 load barrier stub
    + S8217728: Speed up incremental rerun of "make hotspot"
    + S8218268: Javac treats Manifest Class-Path entries as Paths
    instead of URLs
    + S8218662: Allow 204 responses with Content-Length:0
    + S8218882: NET_Writev is declared, NET_WriteV is defined
    + S8218889: Improperly use of the Optional API
    + S8219205: JFR file without license header
    + S8219597: (bf) Heap buffer state changes could provoke
    unexpected exceptions
    + S8219723: javax/net/ssl/compatibility/Compatibility.java
    failed on some SNI cases
    + S8220348: [ntintel] asserts about copying unaligned array
    + S8220451: jdi/EventQueue/remove/remove004 failed due to
    "ERROR: thread2 is not alive"
    + S8220456: jdi/EventQueue/remove_l/remove_l004 failed due to
    "TIMEOUT while waiting for event"
    + S8220479: java/nio/channels/Selector/SelectWithConsumer.java
    failed at testTwoChannels()
    + S8220613: java/util/Arrays/TimSortStackSize2.java times out
    with fastdebug build
    + S8220688: [TESTBUG] runtime/NMT/MallocStressTest.java timed
    out
    + S8220786: Create new switch to redirect error reporting
    output to stdout or stderr
    + S8221270: Duplicated synchronized keywords in SSLSocketImpl
    + S8221312: test/jdk/sanity/client/SwingSet/src/
    /ColorChooserDemoTest.java failed
    + S8221851: Use of THIS_FILE in hotspot invalidates precompiled
    header on Linux/GCC
    + S8221885: Add intermittent test in the JavaSound to the
    ProblemList
    + S8222264: Windows incremental build is broken with JDK-8217728
    + S8222391: javax/net/ssl/compatibility/Compatibility.java
    should be more flexible
    + S8222448: java/lang/reflect/PublicMethods/
    /PublicMethodsTest.java times out
    + S8222519: ButtonDemoScreenshotTest fails randomly with "still
    state to be reached"
    + S8222741: jdi/EventQueue/remove/remove004 fails due to
    VMDisconnectedException
    + S8223003: SunMSCAPI keys are not cleaned up
    + S8223063: Support CNG RSA keys
    + S8223158: Docked MacBook cannot start any Java Swing
    applications
    + S8223260: NamingManager should cache InitialContextFactory
    + S8223464: Improve version string for Oracle CI builds
    + S8223558: Java does not render Myanmar script correctly
    + S8223627: jdk-13+20 bundle name contains null instead of ea
    + S8223638: Replace wildcard address with loopback or local
    host in tests - part 6
    + S8223678: Add Visual Studio Code workspace generation support
    (for native code)
    + S8223727: com/sun/jndi/ldap/privconn/RunTest.java failed due
    to hang in LdapRequest.getReplyBer
    + S8223769: Assert triggers with -XX:+StressReflectiveCode
    + S8224187: Refactor arraycopy_prologue to allow ZGC read
    barriers on arraycopy
    + S8224475: JTextPane does not show images in HTML rendering
    + S8224673: Adjust permission for delayed starting of debugging
    + S8224705: Tests that need to be problem-listed or have
    printer resources
    + S8224778: test/jdk/demo/jfc/J2Ddemo/J2DdemoTest.java cannot
    find J2Ddemo.jar
    + S8224821: java/awt/Focus/NoAutotransferToDisabledCompTest/
    /NoAutotransferToDisabledCompTest.java fails linux-x64
    + S8224830: test/jdk/java/awt/Focus/
    /ModalExcludedWindowClickTest/
    /ModalExcludedWindowClickTest.java fails on linux-x64
    + S8224851: AArch64: fix warnings and errors with Clang and GCC
    8.3
    + S8224905: java/lang/ProcessBuilder/Basic.java#id1 failed with
    stream closed
    + S8225007: java/awt/print/PrinterJob/
    /LandscapeStackOverflow.java may hang
    + S8225105: java/awt/Focus/ShowFrameCheckForegroundTest/
    /ShowFrameCheckForegroundTest.java fails in Windows 10
    + S8225117: java/math/BigInteger/SymmetricRangeTests.java fails
    with ParseException
    + S8225128: Add exception for expiring DocuSign root to
    VerifyCACerts test
    + S8225130: Add exception for expiring Comodo roots to
    VerifyCACerts test
    + S8225144: [macos] In Aqua L&amp;F backspace key does not delete
    when Shift is pressed
    + S8225180: SignedObject with invalid Key not throwing the
    InvalidKeyException in Windows
    + S8225182: JNI exception pending in DestroyXIMCallback of
    awt_InputMethod.c:1327
    + S8225199: [Graal] compiler/jvmci/compilerToVM/
    /IsMatureVsReprofileTest.java fails with
  - XX:CompileThresholdScaling=0.1
    + S8225305: ProblemList java/lang/invoke/VarHandles tests
    + S8225350: compiler/jvmci/compilerToVM/IsCompilableTest.java
    timed out
    + S8225430: Replace wildcard address with loopback or local
    host in tests - part 14
    + S8225435: Upgrade IANA Language Subtag Registry to the latest
    for JDK14
    + S8225487: giflib legal file is missing attribution for
    openbsd-reallocarray.c
    + S8225567: Wrong file headers with 8202414 fix changeset
    + S8225684: [AOT] vmTestbase/vm/oom/production/
    /AlwaysOOMProduction tests fail with AOTed java.base
    + S8225766: Curve in certificate should not affect signature
    scheme when using TLSv1.3
    + S8225797: OldObjectSample event creates unexpected amount of
    checkpoint data
    + S8226381: ProblemList java/lang/reflect/PublicMethods/
    /PublicMethodsTest.java
    + S8226406: JVM fails to detect mismatched or corrupt CDS
    archive
    + S8226608: Hide the onjcmd option from the help output
    + S8226892: ActionListeners on JRadioButtons don't get notified
    when selection is changed with arrow keys
    + S8227112: exclude compiler/intrinsics/sha/sanity tests from
    AOT runs
    + S8227324: Upgrade to freetype 2.10.1
    + S8227528: TestAbortVMOnSafepointTimeout.java failed due to
    "RuntimeException: 'Safepoint sync time longer than' missing
    from stdout/stderr"
    + S8227645: Some tests in serviceability/sa run with fixed -Xmx
    values and risk running out of memory
    + S8227646: [TESTBUG] appcds/SharedArchiveConsistency timed out
    + S8227662: freetype seeks to index at the end of the font data
    + S8228479: Correct the format of ColorChooserDemoTest
    + S8228613: java.security.Provider#getServices order is no
    longer deterministic
    + S8228969: 2019-09-28 public suffix list update
    + S8229236: CriticalJNINatives: dll handling should be done in
    native thread state
    + S8229345: Memory leak due to vtable stubs not being shared on
    SPARC
    + S8229888: (zipfs) Updating an existing zip file does not
    preserve original permissions
    + S8229994: assert(false) failed: Bad graph detected in
    get_early_ctrl_for_expensive
    + S8230004: jdk/internal/jimage/JImageOpenTest.java runs no test
    + S8230235: Rendering HTML with empty img attribute and
    documentBaseKey cause Exception
    + S8230390: Problemlist SA tests with AOT
    + S8230400: Missing constant pool entry for a method in
    stacktrace
    + S8230459: Test failed to resume JVMCI CompilerThread
    + S8230480: check malloc/calloc results in java.desktop
    + S8230597: Update GIFlib library to the 5.2.1
    + S8230611: infinite loop in
    LogOutputList::wait_until_no_readers()
    + S8230624: [TESTBUG] Problemlist JFR
    compiler/TestCodeSweeper.java
    + S8230677: Should disable Escape Analysis if JVMTI capability
    can_get_owned_monitor_info was taken
    + S8230926: [macosx] Two apostrophes are entered instead of one
    with "U.S. International - PC" layout
    + S8231025: Incorrect method tag offset for big endian platform
    + S8231081: TestMetadataRetention fails due to missing symbol id
    + S8231387: java.security.Provider.getService returns random
    result due to race condition with mutating methods in the same
    class
    + S8231430: C2: Memory stomp in max_array_length() for
    T_ILLEGAL type
    + S8231445: check ZALLOC return values in awt coding
    + S8231507: Update Apache Santuario (XML Signature) to version
    2.1.4
    + S8231584: Deadlock with ClassLoader.findLibrary and
    System.loadLibrary call
    + S8231753: use more Posix functionality in aix
    os::print_os_info
    + S8231810: javax/net/ssl/templates/
    /SSLSocketSSLEngineTemplate.java fails intermittently with
    "java.lang.Exception: Unexpected EOF"
    + S8232003: (fs) Files.write can leak file descriptor in the
    exception case
    + S8232056: GetOwnedMonitorInfoWithEATest.java fails with ZGC:
    Heap too small
    + S8232060: add some initializations using sigemptyset in
    os_aix.cpp
    + S8232154: Update Mesa 3-D Headers to version 19.2.1
    + S8232167: Visual Studio install found through
  - -with-tools-dir value is discarded
    + S8232170: FSInfo#getJarClassPath throws an exception not
    declared in its throws clause
    + S8232200: [macos 10.15] Windows in fullscreen tests jumps
    around the screen
    + S8232207: Linux os::available_memory re-reads cgroup
    configuration on every invocation
    + S8232224: [TESTBUG] problemlist JFR TestLargeRootSet.java
    + S8232370: Refactor some com.sun.jdi tests to enable IDE
    integration
    + S8232433: [macos 10.15] java/awt/Window/
    /LocationAtScreenCorner/LocationAtScreenCorner.java may fail
    + S8232571: Add missing SIGINFO signal
    + S8232692: [TESTBUG] compiler/aot/fingerprint/
    /SelfChangedCDS.java fails when cds is disabled
    + S8232713: Update BCEL version to 6.3.1 in license file
    + S8232806: Introduce a system property to disable eager lambda
    initialization
    + S8232834: RunTest sometimes fails to produce valid
    exitcode.txt
    + S8232880: Update test documentation with additional settings
    for client UI tooltip tests
    + S8232950: SUNPKCS11 Provider incorrectly check key length for
    PSS Signatures.
    + S8233018: Add a new test to verify that DatagramSocket is not
    interruptible
    + S8233019: java.lang.Class.isPrimitive() (C1) returns wrong
    result if Klass* is aligned to 32bit
    + S8233032: assert(in_bb(n)) failed: must be
    + S8233078: fix minimal VM build on Linux ppc64(le)
    + S8233328: fix minimal VM build on Linux s390x
    + S8233383: Various minor fixes
    + S8233466: aarch64: remove unnecessary load of mdo when
    profiling return and parameters type
    + S8233491: Crash in AdapterHandlerLibrary::get_adapter with
    CDS due to code cache exhaustion
    + S8233529: loopTransform.cpp:2984: Error: assert(p_f-&gt;Opcode()
    == Op_IfFalse) failed
    + S8233548: Update CUP to v0.11b
    + S8233649: Update ProblemList.txt to exclude failing headful
    tests on macos
    + S8233656: assert(d-&gt;is_CFG() &amp;&amp; n-&gt;is_CFG()) failed: must
    have CFG nodes
    + S8233657: Intermittent NPE in Component.validate()
    + S8234288: Turkey Time Zone returns incorrect time zone name
    + S8234323: NULL-check return value of SurfaceData_InitOps on
    macosx
    + S8234339: replace JLI_StrTok in java_md_solinux.c
    + S8234340: Bump update version for OpenJDK: jdk-11.0.7
    + S8234350: assert(mode == ControlAroundStripMined &amp;&amp; (use ==
    sfpt || !use-&gt;is_reachable_from_root())) failed: missed a node
    + S8234386: [macos] NPE was thrown at expanding Choice from
    maximized frame
    + S8234397: add OS uptime information to os::print_os_info
    output
    + S8234423: Modifying ArrayList.subList().subList() resets
    modCount of subList
    + S8234466: Class loading deadlock involving
    X509Factory#commitEvent()
    + S8234501: remove obsolete NET_ReadV
    + S8234525: enable link-time section-gc for linux s390x to
    remove unused code
    + S8234610: MaxVectorSize set wrongly when UseAVX=3 is
    specified after JDK-8221092
    + S8234617: C1: Incorrect result of field load due to missing
    narrowing conversion
    + S8234723: javax/net/ssl/TLS tests support TLSv1.3
    + S8234724: javax/net/ssl/templates/
    /SSLSocketSSLEngineTemplate.java supports TLSv1.3
    + S8234741: enhance os::get_core_path on macOS
    + S8234769: Duplicate attribution in freetype.md
    + S8234786: Fix for JDK-8214578 breaks OS X 10.12 compatibility
    + S8234809: set relro in linker flags when building with gcc
    + S8234824: java/nio/channels/SocketChannel/AdaptSocket.java
    fails on Windows 10
    + S8235243: handle VS2017 15.9 and VS2019 in abstract_vm_version
    + S8235288: AVX 512 instructions inadvertently used on Xeon for
    small vector width operations
    + S8235325: build failure on Linux after 8235243
    + S8235383: C1 compilation fails with
  - XX:+PrintIRDuringConstruction -XX:+Verbose
    + S8235489: handle return values of sscanf calls in hotspot
    + S8235509: Backport for JDK-8209657 Refactor filemap.hpp to
    simplify integration with Serviceability Agent.
    + S8235510: java.util.zip.CRC32 performance drop after 8200067
    + S8235563: [TESTBUG] appcds/CommandLineFlagComboNegative.java
    does not handle archive mapping failure
    + S8235637: jhsdb jmap from OpenJDK 11.0.5 doesn't work if
    prelink is enabled
    + S8235671: enhance print_rlimit_info in os_posix
    + S8235744: PIT: test/jdk/javax/swing/text/html/
    /TestJLabelWithHTMLText.java times out in linux-x64
    + S8235904: Infinite loop when rendering huge lines
    + S8235998: [c2] Memory leaks during tracing after '8224193:
    stringStream should not use Resource Area'.
    + S8236039: JSSE Client does not accept status_request
    extension in CertificateRequest messages for TLS 1.3
    + S8236140: assert(!VerifyHashTableKeys || _hash_lock == 0)
    failed: remove node from hash table before modifying it
    + S8236179: C1 register allocation error with T_ADDRESS
    + S8236488: Support for configure option
  - -with-native-debug-symbols=internal is impossible on Windows
    + S8236500: Windows ucrt.dll should be looked up in versioned
    WINSDK subdirectory
    + S8236709: struct SwitchRange in HS violates C++ One
    Definition Rule
    + S8236848: [JDK 11u] make run-test-tier1 fails after backport
    of JDK-8232834
    + S8236873: Worker has a deadlock bug
    + S8237217: Incorrect G1StringDedupEntry type used in
    StringDedupTable destructor
    + S8237368: Problem with NullPointerException in RMI
    TCPEndpoint.read
    + S8237375: SimpleThresholdPolicy misses CounterDecay timestamp
    initialization
    + S8237508: Simplify JarFile.isInitializing
    + S8237540: Missing files in backport of JDK-8210910
    + S8237541: Missing files in backport of JDK-8236528
    + S8237600: Test SunJSSEFIPSInit fails on Ubuntu
    + S8237819: s390x - remove unused pd_zero_to_words_large
    + S8237869: exclude jtreg test security/infra/java/security/
    /cert/CertPathValidator/certification/LuxTrustCA.java because
    of instabilities
    + S8237879: make 4.3 breaks build
    + S8237945: CTW: C2 compilation fails with
    assert(just_allocated_object(alloc_ctl) == ptr) failed: most
    recent allo...
    + S8238225: Issues reported after replacing symlink at
    Contents/MacOS/libjli.dylib with binary
    + S8238247: CTW runner should sweep nmethods more aggressively
    + S8238366: CTW runner closes standard output on exit
    + S8238438: SuperWord::co_locate_pack picks memory state of
    first instead of last load
    + S8238502: sunmscapi.dll causing EXCEPTION_ACCESS_VIOLATION
    + S8238534: Deep sign macOS bundles before bundle archive is
    being created
    + S8238591: CTW: Split
    applications/ctw/modules/jdk_localedata.java
    + S8238596: AVX enabled by default for Skylake even when
    unsupported
    + S8238811: C2: assert(i &gt;= req() || i == 0 || is_Region() ||
    is_Phi()) with -XX:+VerifyGraphEdges
    + S8239005: [TESTBUG] test/hotspot/jtreg/runtime/
    /StackGuardPages/TestStackGuardPages.java: exeinvoke.c: must
    initialize static state before calling do_overflow()
    + S8239466: Loss of precision in counter decay calculation in
    11u backport of JDK-8237375
    + S8239856: [ntintel] asserts about copying unaligned array
    element
    + S8240724: [test] jdk11 downport of 8224475 misses binary file
    test/jdk/javax/swing/JTextPane/arrow.png
    + S8241296: Segfault in JNIHandleBlock::oops_do()
- Removed patch:
  * DependOnVariableHelper.patch
    + fixed upstream
- Added patch:
  * JDK-8228407.patch
    + fix crashes due to shared archive file mismatch</changelog>
  <changelog author="fstrba@suse.com" date="1594900800">- Update to upstream tag jdk-11.0.8+10 (July 2020 CPU, bsc#1174157)
  * Security fixes:
    + JDK-8230613: Better ASCII conversions
    + JDK-8231800: Better listing of arrays
    + JDK-8232014: Expand DTD support
    + JDK-8233234: Better Zip Naming
    + JDK-8233239, CVE-2020-14562: Enhance TIFF support
    + JDK-8233255: Better Swing Buttons
    + JDK-8234032: Improve basic calendar services
    + JDK-8234042: Better factory production of certificates
    + JDK-8234418: Better parsing with CertificateFactory
    + JDK-8234836: Improve serialization handling
    + JDK-8236191: Enhance OID processing
    + JDK-8236867, CVE-2020-14573: Enhance Graal interface handling
    + JDK-8237117, CVE-2020-14556: Better ForkJoinPool behavior
    + JDK-8237592, CVE-2020-14577: Enhance certificate verification
    + JDK-8238002, CVE-2020-14581: Better matrix operations
    + JDK-8238013: Enhance String writing
    + JDK-8238804: Enhance key handling process
    + JDK-8238842: AIOOBE in GIFImageReader.initializeStringTable
    + JDK-8238843: Enhanced font handing
    + JDK-8238920, CVE-2020-14583: Better Buffer support
    + JDK-8238925: Enhance WAV file playback
    + JDK-8240119, CVE-2020-14593: Less Affine Transformations
    + JDK-8240482: Improved WAV file playback
    + JDK-8241379: Update JCEKS support
    + JDK-8241522: Manifest improved jar headers redux
    + JDK-8242136, CVE-2020-14621: Better XML namespace handling
  * Other changes:
    + JDK-6933331: (d3d/ogl) java.lang.IllegalStateException:
    Buffers have not been created
    + JDK-7124307: JSpinner and changing value by mouse
    + JDK-8022574: remove HaltNode code after uncommon trap calls
    + JDK-8039082: [TEST_BUG] Test
    java/awt/dnd/BadSerializationTest/BadSerializationTest.java
    fails
    + JDK-8040630: Popup menus and tooltips flicker with previous
    popup contents when first shown
    + JDK-8044365: (dc) MulticastSendReceiveTests.java failing with
    ENOMEM when joining group (OS X 10.9)
    + JDK-8048215: [TESTBUG]
    java/lang/management/ManagementFactory/ThreadMXBeanProxy.java
    Expected non-null LockInfo
    + JDK-8051349: nsk/jvmti/scenarios/sampling/SP06/sp06t003 fails
    in nightly
    + JDK-8080353: JShell: Better error message on attempting to
    add default method
    + JDK-8139876: Exclude hanging nsk/stress/stack from execution
    with deoptimization enabled
    + JDK-8146090: java/lang/ref/ReachabilityFenceTest.java fails
    with -XX:+DeoptimizeALot
    + JDK-8153430: jdk regression test MletParserLocaleTest,
    ParserInfiniteLoopTest reduce default timeout
    + JDK-8156207: Resource allocated BitMaps are often cleared
    unnecessarily
    + JDK-8159740: JShell: corralled declarations do not have
    correct source to wrapper mapping
    + JDK-8175984: ICC_Profile has un-needed, not-empty finalize
    method
    + JDK-8176359: Frame#setMaximizedbounds not working properly in
    multi screen environments
    + JDK-8183369: RFC unconformity of HttpURLConnection with proxy
    + JDK-8187078: -XX:+VerifyOops finds numerous problems when
    running JPRT
    + JDK-8189861: Refactor CacheFind
    + JDK-8191169: java/net/Authenticator/B4769350.java failed
    intermittently
    + JDK-8191930: [Graal] emits unparseable XML into compile log
    + JDK-8193879: Java debugger hangs on method invocation
    + JDK-8196019: java/awt/Window/Grab/GrabTest.java fails on
    Windows
    + JDK-8196181: sun/java2d/GdiRendering/InsetClipping.java fails
    + JDK-8198000:
    java/awt/List/EmptyListEventTest/EmptyListEventTest.java
    debug assert on Windows
    + JDK-8198001: java/awt/Menu/WrongParentAfterRemoveMenu/
    /WrongParentAfterRemoveMenu.java debug assert on Windows
    + JDK-8198339: Test javax/swing/border/Test6981576.java is
    unstable
    + JDK-8200701: jdk/jshell/ExceptionsTest.java fails on Windows,
    after JDK-8198801
    + JDK-8203264: JNI exception pending in
    PlainDatagramSocketImpl.c:740
    + JDK-8203672: JNI exception pending in PlainSocketImpl.c
    + JDK-8203673: JNI exception pending in
    DualStackPlainDatagramSocketImpl.c:398
    + JDK-8204834: Fix confusing "allocate" naming in OopStorage
    + JDK-8205399: Set node color on pinned HashMap.TreeNode
    deletion
    + JDK-8205653: test/jdk/sun/management/jmxremote/bootstrap/
    /RmiRegistrySslTest.java and RmiSslBootstrapTest.sh fail with
    handshake_failure
    + JDK-8206179: com/sun/management/OperatingSystemMXBean/
    /GetCommittedVirtualMemorySize.java fails with Committed
    virtual memory size illegal value
    + JDK-8207334: VM times out in VM_HandshakeAllThreads::doit()
    with RunThese30M
    + JDK-8208277: Code cache heap (-XX:ReservedCodeCacheSize)
    doesn't work with 1GB LargePages
    + JDK-8209113: Use WeakReference for lastFontStrike for created
    Fonts
    + JDK-8209333: Socket reset issue for TLS 1.3 socket close
    + JDK-8209439: C2 library_call can potentially ignore Math.pow
    intrinsic or use null pointer
    + JDK-8209534: [TESTBUG]runtime/appcds/cacheObject/
    /ArchivedModuleCompareTest.java fails with EnableJVMCI.
    + JDK-8210147: adjust some WSAGetLastError usages in windows
    network coding
    + JDK-8210284: "assert((av &amp; 0x00000001) == 0) failed:
    unsupported V8" on Solaris 11.4
    + JDK-8210303: VM_HandshakeAllThreads fails assert with
    "failed: blocked and not walkable"
    + JDK-8210459: Add support for generating compile_commands.json
    + JDK-8210515: [TESTBUG]CheckArchivedModuleApp.java needs to
    check if EnableJVMCI is set.
    + JDK-8210788: Javadoc for Thread.join(long, int) should
    specify that it waits forever when both arguments are zero
    + JDK-8211301: [macos] support full window content options
    + JDK-8211332: Space for stub routines (code_size2) is too
    small on new Skylake CPUs
    + JDK-8211339: NPE during SSL handshake caused by
    HostnameChecker
    + JDK-8211392: compiler/profiling/
    /spectrapredefineclass_classloaders/Launcher.java times out
    in JDK12 CI
    + JDK-8211743: [AOT] crash in ScopeDesc::decode_body() when
    JVMTI walks AOT frames
    + JDK-8212154: [TESTBUG] CheckArchivedModuleApp fails with NPE
    when JVMCI is absent
    + JDK-8212167: JShell : Stack trace of exception has wrong line
    number
    + JDK-8212933: Thread-SMR: requesting a VM operation whilst
    holding a ThreadsListHandle can cause deadlocks
    + JDK-8212986: Make Visual Studio compiler check less strict
    + JDK-8213250: CDS archive creation aborts due to metaspace
    object allocation failure
    + JDK-8213516: jck test api/javax_accessibility/AccessibleState/
    /fields.html fails intermittent
    + JDK-8213947: ARM32: failed check_simd should set
    UsePopCountInstruction to false
    + JDK-8214418: half-closed SSLEngine status may cause
    application dead loop
    + JDK-8214440: ldap over a TLS connection negotiate failed with
    "javax.net.ssl.SSLPeerUnverifiedException: hostname of the
    server does not match the hostname in the server's
    certificate"
    + JDK-8214444: Wrong strncat limits in dfa.cpp
    + JDK-8214481: freetype path does not disable TrueType hinting
    with AA+FM hints
    + JDK-8214571: -Xdoclint of array serialField gives "error:
    array type not allowed here"
    + JDK-8214856: Errors with JSZip in web console after upgrade
    to 3.1.5
    + JDK-8214862: assert(proj != __null) at compile.cpp:3251
    + JDK-8215369: Jcstress pollute /var/tmp with temporary files.
    + JDK-8215551: Missing case label in nmethod::reloc_string_for()
    + JDK-8215555: TieredCompilation C2 threads can excessively
    block handshakes
    + JDK-8215711: Missing key_share extension for (EC)DHE key
    exchange should alert missing_extension
    + JDK-8216151: [Graal] Module
    jdk.internal.vm.compiler.management has not been granted
    accessClassInPackage.org.graalvm.compiler.debug
    + JDK-8216154: C4819 warnings at HotSpot sources on Windows
    + JDK-8216541: CompiledICHolders of VM locked unloaded nmethods
    are released too late
    + JDK-8217230: assert(t == t_no_spec) failure in
    NodeHash::check_no_speculative_types()
    + JDK-8217404: --with-jvm-features doesn't work when multiple
    features are explicitly disabled
    + JDK-8217447: Develop flag TraceICs is broken
    + JDK-8217606: LdapContext#reconnect always opens a new
    connection
    + JDK-8218807: Compilation database (compile_commands.json) may
    contain obsolete items
    + JDK-8219214: Infinite Loop in CodeSection::dump()
    + JDK-8219904: ClassCastException when calling
    FlightRecorderMXBean#getRecordings()
    + JDK-8219991: New fix of the deadlock in
    sun.security.ssl.SSLSocketImpl
    + JDK-8221121: applications/microbenchmarks are encountering
    crashes in tier5
    + JDK-8221445: FastSysexMessage constructor crashes MIDI
    receiption thread
    + JDK-8221482: Initialize VMRegImpl::regName[] earlier to
    prevent assert during PrintStubCode
    + JDK-8221741: ClassCastException can happen when
    fontconfig.properties is used
    + JDK-8221823: Requested JDialog width is ignored
    + JDK-8223108: Test java/awt/EventQueue/
    /NonComponentSourcePost.java is unstable
    + JDK-8223678: Add Visual Studio Code workspace generation
    support (for native code)
    + JDK-8223935: PIT: java/awt/font/WindowsIndicFonts.java fails
    on windows10
    + JDK-8224109: Text spaced incorrectly by drawString under
    rotation with fractional metric
    + JDK-8224632: testbug: java/awt/dnd/RemoveDropTargetCrashTest/
    /RemoveDropTargetCrashTest.java fails on MacOS
    + JDK-8224793: os::die() does not honor CreateCoredumpOnCrash
    option
    + JDK-8224847: gc/stress/TestReclaimStringsLeaksMemory.java
    fails with reserved greater than expected
    + JDK-8224931: disable JAOTC invokedynamic support until
    8223533 is fixed
    + JDK-8224997: ChaCha20-Poly1305 TLS cipher suite decryption
    throws ShortBufferException
    + JDK-8225068: Remove DocuSign root certificate that is
    expiring in May 2020
    + JDK-8225069: Remove Comodo root certificate that is expiring
    in May 2020
    + JDK-8225126: Test SetBoundsPaintTest.html faild on Windows
    when desktop is scaled
    + JDK-8225325: Add tests for redefining a class' private method
    during resolution of the bootstrap specifier
    + JDK-8225622: [AOT] runtime/SharedArchiveFile/
    /TestInterpreterMethodEntries.java crashed with AOTed
    java.base
    + JDK-8225653: Provide more information when hitting SIGILL
    from HaltNode
    + JDK-8225783: Incorrect use of binary operators on booleans in
    type.cpp
    + JDK-8225789: Empty method parameter type should generate
    ClassFormatError
    + JDK-8226198: use of &amp; instead of &amp;&amp; in
    LibraryCallKit::arraycopy_restore_alloc_state
    + JDK-8226253: JAWS reports wrong number of radio buttons when
    buttons are hidden.
    + JDK-8226653: [accessibility] Can edit text cell correctly,
    but Accessibility Tool reads nothing about editor
    + JDK-8226806: [macOS 10.14] Methods of Java Robot should be
    called from appropriate thread
    + JDK-8226879: Memory leak in Type::hashcons
    + JDK-8227632: Incorrect PrintCompilation message: made not
    compilable on levels 0 1 2 3 4
    + JDK-8228407: JVM crashes with shared archive file mismatch
    + JDK-8228482: fix xlc16/xlclang comparison of distinct pointer
    types and string literal conversion warnings
    + JDK-8228757: Fail fast if the handshake type is unknown
    + JDK-8229158: make UseSwitchProfiling non-experimental or
    false by-default
    + JDK-8229421: The logic of java/net/ipv6tests/TcpTest.java is
    flawed
    + JDK-8229855: C2 fails with assert(false) failed: bad AD file
    + JDK-8230591: AArch64: Missing intrinsics for Math.ceil,
    floor, rint
    + JDK-8231118: ARM32: Math tests failures
    + JDK-8231213: Migrate SimpleDateFormatConstTest to JDK Repo
    + JDK-8231243: [TESTBUG] CustomFont.java cannot find font file
    + JDK-8231438: [macOS] Dark mode for the desktop is not
    supported
    + JDK-8231550: C2: ShouldNotReachHere() in
    verify_strip_mined_scheduling
    + JDK-8231564: setMaximizedBounds is broken with large display
    scale and multiple monitors
    + JDK-8231572: Use -lobjc instead of -fobjc-link-runtime in
    libosxsecurity
    + JDK-8231631: sun/net/ftp/FtpURLConnectionLeak.java fails
    intermittently with NPE
    + JDK-8231671: Fix copyright headers in hotspot (missing comma
    after year)
    + JDK-8231720: Some perf regressions after 8225653
    + JDK-8231779: crash
    HeapWord*ParallelScavengeHeap::failed_mem_allocate
    + JDK-8231863: Crash if classpath is read from @argument file
    and the main gets option argument
    + JDK-8232080: jlink plugins for vendor information and
    run-time options
    + JDK-8232106: [x86] C2: SIGILL due to usage of SSSE3
    instructions on processors which don't support it
    + JDK-8232134: Change to Visual Studio 2017 15.9.16 for
    building on Windows at Oracle
    + JDK-8232226: [macos 10.15] test/jdk/java/awt/color/
    /EqualityTest/EqualityTest.java may fail
    + JDK-8232357: Compare version info of Santuario to legal notice
    + JDK-8232572: Add hooks for custom output dir in Bundles.gmk
    + JDK-8232634: Problem List ICMColorDataTest.java
    + JDK-8232748: Build static versions of certain JDK libraries
    + JDK-8232846: ProcessHandle.Info command with non-English
    shows question marks
    + JDK-8232880: Update test documentation with additional
    settings for client UI tooltip tests
    + JDK-8233033: C2 produces wrong result while unswitching a
    loop due to lost control dependencies
    + JDK-8233137: runtime/ErrorHandling/VeryEarlyAssertTest.java
    fails after 8232080
    + JDK-8233197: Invert JvmtiExport::post_vm_initialized() and
    Jfr:on_vm_start() start-up order for correct option parsing
    + JDK-8233291: [TESTBUG] tools/jlink/plugins/
    /VendorInfoPluginsTest.java fails with debug or non-server VMs
    + JDK-8233364: Fix undefined behavior in
    Canonicalizer::do_ShiftOp
    + JDK-8233494: Avoid calling MallocTracker::record_malloc and
    record_free when NMT is off
    + JDK-8233573: Toolkit.getScreenInsets(GraphicsConfiguration)
    may throw ClassCastException
    + JDK-8233608: Minimal build broken after JDK-8233494
    + JDK-8233621: Mismatch in jsse.enableMFLNExtension property
    name
    + JDK-8233696: [TESTBUG]Some jtreg tests fail when CAPS_LOCK is
    ON
    + JDK-8233707: systemScale.cpp could not compile with VS2019
    + JDK-8233801: GCMEmptyIv.java test fails on Solaris 11.4
    + JDK-8233880: Support compilers with multi-digit major version
    numbers
    + JDK-8233920: MethodHandles::tryFinally generates illegal
    bytecode for long/double return type
    + JDK-8234137: The "AutoTestOnTop.java" test may run external
    applications
    + JDK-8234146: compiler/jsr292/
    /ContinuousCallSiteTargetChange.java times out on SPARC
    + JDK-8234184: [TESTBUG] java/awt/Mouse/EnterExitEvents/
    /ModalDialogEnterExitEventsTest.java fails in Windows
    + JDK-8234270: [REDO] JDK-8204128 NMT might report incorrect
    numbers for Compiler area
    + JDK-8234332: [TESTBUG] java/awt/Focus/DisposedWindow/
    /DisposeDialogNotActivateOwnerTest/
    /DisposeDialogNotActivateOwnerTest.java fails on linux-x64
    nightly
    + JDK-8234398: Replace ID2D1Factory::GetDesktopDpi with
    GetDeviceCaps
    + JDK-8234522: [macos] Crash with use of native file dialog
    + JDK-8234691: Potential double-free in ParallelSPCleanupTask
    constructor
    + JDK-8234696: tools/jlink/plugins/VendorInfoPluginsTest.java
    times out
    + JDK-8234727: sun/security/ssl/X509TrustManagerImpl tests
    support TLSv1.3
    + JDK-8234728: Some security tests should support TLSv1.3
    + JDK-8234779: Provide idiom for declaring classes noncopyable
    + JDK-8234824: java/nio/channels/SocketChannel/AdaptSocket.java
    fails on Windows 10
    + JDK-8234968: check calloc rv in libinstrument
    InvocationAdapter
    + JDK-8235153: [TESTBUG] [macos 10.15] java/awt/Graphics/
    /DrawImageBG/SystemBgColorTest.java fails
    + JDK-8235183: Remove the "HACK CODE" in comment
    + JDK-8235263: Revert TLS 1.3 change that wrapped IOExceptions
    + JDK-8235311: Tag mismatch may alert bad_record_mac
    + JDK-8235332: TestInstanceCloneAsLoadsStores.java fails with
  - XX:+StressGCM
    + JDK-8235452: Strip mined loop verification fails with
    assert(is_OuterStripMinedLoop()) failed: invalid node class
    + JDK-8235584: UseProfiledLoopPredicate fails with
    assert(_phase-&gt;get_loop(c) == loop) failed: have to be in the
    same loop
    + JDK-8235620: Broken merge between JDK-8006406 and JDK-8003559
    + JDK-8235638: NPE in LWWindowPeer.getOnscreenGraphics()
    + JDK-8235686: Add more custom hooks in Bundles.gmk
    + JDK-8235739: Rare NPE at WComponentPeer.getGraphics()
    + JDK-8235762: JVM crash in SWPointer during C2 compilation
    + JDK-8235834: IBM-943 charset encoder needs updating
    + JDK-8235874: The ordering of Cipher Suites is not maintained
    provided through jdk.tls.client.cipherSuites and
    jdk.tls.server.cipherSuites system property.
    + JDK-8235908: omit ThreadPriorityPolicy warning when value is
    set from image
    + JDK-8235984: C2: assert(out-&gt;in(PhiNode::Region) == head ||
    out-&gt;in(PhiNode::Region) == slow_head) failed: phi must be
    either part of the slow or the fast loop
    + JDK-8236211: [Graal] compiler/graalunit/GraphTest.java is
    skipped in all testing
    + JDK-8236470: Deal with ECDSA using ecdsa-with-SHA2 plus hash
    algorithm as AlgorithmId
    + JDK-8236545: Compilation error in mach5
    java/awt/FileDialog/MacOSGoToFolderCrash.java
    + JDK-8236700: Upgrading JSZip from v3.1.5 to v3.2.2
    + JDK-8236759: ShouldNotReachHere in
    PhaseIdealLoop::verify_strip_mined_scheduling
    + JDK-8236897: Fix the copyright header for pkcs11gcm2.h
    + JDK-8236921: Add build target to produce a JDK image suitable
    for a Graal/SVM build
    + JDK-8236953: [macos] JavaFX SwingNode is not rendered on macOS
    + JDK-8236996: Incorrect Roboto font rendering on Windows with
    subpixel antialiasing
    + JDK-8237045: JVM uses excessive memory with -XX:+EnableJVMCI
  - XX:JVMCICounterSize=2147483648
    + JDK-8237055: [TESTBUG] compiler/c2/TestJumpTable.java fails
    with release VMs
    + JDK-8237086: assert(is_MachReturn()) running CTW with fix for
    JDK-8231291
    + JDK-8237192: Generate stripped/public pdbs on Windows for jdk
    images
    + JDK-8237396: JvmtiTagMap::weak_oops_do() should not trigger
    barriers
    + JDK-8237474: Default SSLEngine should create in server role
    + JDK-8237859: C2: Crash when loads float above range check
    + JDK-8237879: make 4.3 breaks build
    + JDK-8237951: CTW: C2 compilation fails with "malformed
    control flow"
    + JDK-8237962: give better error output for invalid OCSP
    response intervals in CertPathValidator checks
    + JDK-8238190: [JVMCI] Fix single implementor speculation for
    diamond shapes.
    + JDK-8238356: CodeHeap::blob_count() overestimates the number
    of blobs
    + JDK-8238452: Keytool generates wrong expiration date if
    validity is set to 2050/01/01
    + JDK-8238555: Allow Initialization of SunPKCS11 with NSS when
    there are external FIPS modules in the NSSDB
    + JDK-8238575: DragSourceEvent.getLocation() returns wrong
    value on HiDPI screens (Windows)
    + JDK-8238676: jni crashes on accessing it from process exit
    hook
    + JDK-8238721: Add failing client jtreg tests to the Problem
    List
    + JDK-8238738: AudioSystem.getMixerInfo() takes about 30 sec to
    report a gone audio device
    + JDK-8238756: C2: assert(((n) == __null || !VerifyIterativeGVN
    || !((n)-&gt;is_dead()))) failed: can not use dead node
    + JDK-8238765: PhaseCFG::schedule_pinned_nodes cannot handle
    precedence edges from unmatched CFG nodes correctly
    + JDK-8238898: Missing hash characters for header on license
    file
    + JDK-8238942: Rendering artifacts with LCD text and fractional
    metrics
    + JDK-8238985: [TESTBUG] The arrow image is blue instead of
    green
    + JDK-8239000: handle ContendedPaddingWidth in vm_version_ppc
    + JDK-8239055: Wrong implementation of VMState.hasListener
    + JDK-8239091: Reversed arguments in call to strstr in freetype
    "debug" code.
    + JDK-8239142: C2's UseUniqueSubclasses optimization is broken
    for array accesses
    + JDK-8239224: libproc_impl.c previous_thr may be used
    uninitialized warning
    + JDK-8239351: Give more meaningful InternalError messages in
    Deflater.c
    + JDK-8239365: ProcessBuilder test modifications for AIX
    execution
    + JDK-8239456: vtable stub generation: assert failure (code
    size estimate)
    + JDK-8239457: call ReleaseStringUTFChars before early returns
    in Java_sun_security_pkcs11_wrapper_PKCS11_connect
    + JDK-8239462: jdk.hotspot.agent misses some
    ReleaseStringUTFChars calls in case of early returns
    + JDK-8239557: [TESTBUG] VeryEarlyAssertTest.java validating
    "END." marker at lastline is not always true
    + JDK-8239787: AArch64: String.indexOf may incorrectly handle
    empty strings
    + JDK-8239792: Bump update version for OpenJDK: jdk-11.0.8
    + JDK-8239798: SSLSocket closes socket both socket endpoints on
    a SocketTimeoutException
    + JDK-8239819: XToolkit: Misread of screen information memory
    + JDK-8239852: java/util/concurrent tests fail with
  - XX:+VerifyGraphEdges: assert(!VerifyGraphEdges) failed:
    verification should have failed
    + JDK-8239893: Windows handle Leak when starting processes
    using ProcessBuilder
    + JDK-8239915: Zero VM crashes when handling dynamic constant
    + JDK-8239931: [win][x86] vtable stub generation: assert
    failure (code size estimate) follow-up
    + JDK-8239965: XMLEncoder/Test4625418.java fails due to "Error:
    Cp943 - can't read properly"
    + JDK-8239976: Put JDK-8239965 on the ProblemList.txt
    + JDK-8240073: Fix 'test-make' build target in 11u
    + JDK-8240197: Cannot start JVM when $JAVA_HOME includes CJK
    characters
    + JDK-8240202: A few client tests leave mouse buttons pressed
    + JDK-8240220: IdealLoopTree::dump_head predicate printing is
    broken
    + JDK-8240223: Use consistent predicate order in and with
    PhaseIdealLoop::find_predicate
    + JDK-8240227: Loop predicates should be copied to unswitched
    loops
    + JDK-8240286: [TESTBUG] Test command error in hotspot/jtreg/
    /compiler/loopopts/superword/SumRedAbsNeg_Float.java
    + JDK-8240518: Incorrect JNU_ReleaseStringPlatformChars in
    Windows Print
    + JDK-8240529: CheckUnhandledOops breaks NULL check in
    Modules::define_module
    + JDK-8240576: JVM crashes after transformation in C2
    IdealLoopTree::merge_many_backedges
    + JDK-8240603: Windows 32bit compile error after 8238676
    + JDK-8240629: argfiles parsing broken for argfiles with
    comment cross 4096 bytes chunk
    + JDK-8240711: TestJstatdPort.java failed due to
    "ExportException: Port already in use:"
    + JDK-8240786: [TESTBUG] The test java/awt/Window/
    /GetScreenLocation/GetScreenLocationTest.java fails on HiDPI
    screen
    + JDK-8240824: enhance print_full_memory_info on Linux by THP
    related information
    + JDK-8240827: Downport SSLSocketImpl.java from "8221882: Use
    fiber-friendly java.util.concurrent.locks in JSSE"
    + JDK-8240905: assert(mem == (Node*)1 || mem == mem2) failed:
    multiple Memories being matched at once?
    + JDK-8240972: macOS codesign fail on macOS 10.13.5 or older
    + JDK-8241445: Fix copyright in
    test/jdk/tools/launcher/ArgFileSyntax.java
    + JDK-8241458: [JVMCI] add mark value to expose
    CodeOffsets::Frame_Complete
    + JDK-8241464: [11u] Backport: make rehashing be a needed
    guaranteed safepoint cleanup action
    + JDK-8241556: Memory leak if -XX:CompileCommand is set
    + JDK-8241568: (fs) UserPrincipalLookupService.lookupXXX
    failure with IOE "Operation not permitted"
    + JDK-8241586: compiler/cpuflags/
    /TestAESIntrinsicsOnUnsupportedConfig.java fails on aarch64
    + JDK-8241638: launcher time metrics always report 1 on Linux
    when _JAVA_LAUNCHER_DEBUG set
    + JDK-8241660: Add virtualization information output to hs_err
    file on macOS
    + JDK-8241808: [TESTBUG] The JDK-8039467 bug appeared on macOS
    + JDK-8241888: Mirror jdk.security.allowNonCaAnchor system
    property with a security one
    + JDK-8241900: Loop unswitching may cause dependence on null
    check to be lost
    + JDK-8241948: enhance list of environment variables printed in
    hs_err file
    + JDK-8241996: on linux set full relro in the linker flags
    + JDK-8242108: Performance regression after fix for JDK-8229496
    + JDK-8242141: New System Properties to configure the TLS
    signature schemes
    + JDK-8242154: Backport parts of JDK-4947890 to OpenJDK 11u
    + JDK-8242174: [macos] The NestedModelessDialogTest test make
    the macOS unstable
    + JDK-8242239: [Graal] javax/management/generified/
    /GenericTest.java fails: FAILED: queryMBeans sets same
    + JDK-8242294: JSSE Client does not throw SSLException when an
    alert occurs during handshaking
    + JDK-8242379: [TESTBUG] compiler/loopopts/
    /TestLoopUnswitchingLostCastDependency.java fails with
    release VMs
    + JDK-8242470: Update Xerces to Version 2.12.1
    + JDK-8242498: Invalid "sun.awt.TimedWindowEvent" object leads
    to JVM crash
    + JDK-8242541: Small charset issues (ISO8859-16, x-eucJP-Open,
    x-IBM834 and x-IBM949C)
    + JDK-8242626: enhance posix print_rlimit_info
    + JDK-8243059: Build fails when --with-vendor-name contains a
    comma
    + JDK-8243539: Copyright info (Year) should be updated for fix
    of 8241638
    + JDK-8243541: (tz) Upgrade time-zone data to tzdata2020a
    + JDK-8244407: JVM crashes after transformation in C2
    IdealLoopTree::split_fall_in
    + JDK-8244520: problemlist
    java/awt/font/Rotate/RotatedFontTest.java on linux
    + JDK-8244777: ClassLoaderStats VM Op uses constant hash value
    + JDK-8244853: The static build of libextnet is missing the
    JNI_OnLoad_extnet function
    + JDK-8244951: Missing entitlements for hardened runtime
    + JDK-8245047: [PPC64] C2: ReverseBytes + Load always match to
    unordered Load (acquire semantics missing)
    + JDK-8245649: Revert 8245397 backport of 8230591
    + JDK-8246031: SSLSocket.getSession() doesn't close connection
    for timeout/ interrupts
    + JDK-8246613: Choose the default SecureRandom algo based on
    registration ordering
    + JDK-8248505: Unexpected NoSuchAlgorithmException when using
    secure random impl from BCFIPS provider
- Removed patch:
  * JDK-8228407.patch
    + integrated upstream</changelog>
  <changelog author="fstrba@suse.com" date="1604318400">- Update to upstream tag jdk-11.0.9-11 (October 2020 CPU,
  bsc#1177943)
  * New features
    + JDK-8250784: Shenandoah: A Low-Pause-Time Garbage Collector
  * Security fixes
    + JDK-8233624: Enhance JNI linkage
    + JDK-8236196: Improve string pooling
    + JDK-8236862, CVE-2020-14779: Enhance support of Proxy class
    + JDK-8237990, CVE-2020-14781: Enhanced LDAP contexts
    + JDK-8237995, CVE-2020-14782: Enhance certificate processing
    + JDK-8240124: Better VM Interning
    + JDK-8241114, CVE-2020-14792: Better range handling
    + JDK-8242680, CVE-2020-14796: Improved URI Support
    + JDK-8242685, CVE-2020-14797: Better Path Validation
    + JDK-8242695, CVE-2020-14798: Enhanced buffer support
    + JDK-8243302: Advanced class supports
    + JDK-8244136, CVE-2020-14803: Improved Buffer supports
    + JDK-8244479: Further constrain certificates
    + JDK-8244955: Additional Fix for JDK-8240124
    + JDK-8245407: Enhance zoning of times
    + JDK-8245412: Better class definitions
    + JDK-8245417: Improve certificate chain handling
    + JDK-8248574: Improve jpeg processing
    + JDK-8249927: Specify limits of jdk.serialProxyInterfaceLimit
    + JDK-8253019: Enhanced JPEG decoding
  * Other changes
    + JDK-6532025: GIF reader throws misleading exception with
    truncated images
    + JDK-6949753: [TEST BUG]: java/awt/print/PageFormat/
    /PDialogTest.java needs update by removing an infinite loop
    + JDK-8022535: [TEST BUG] javax/swing/text/html/parser/
    /Test8017492.java fails
    + JDK-8062947: Fix exception message to correctly represent
    LDAP connection failure
    + JDK-8067354: com/sun/jdi/GetLocalVariables4Test.sh failed
    + JDK-8134599: TEST_BUG: java/rmi/transport/closeServerSocket/
    /CloseServerSocket.java fails intermittently with Address
    already in use
    + JDK-8151678: com/sun/jndi/ldap/LdapTimeoutTest.java failed
    due to timeout on DeadServerNoTimeoutTest is incorrect
    + JDK-8160768: Add capability to custom resolve host/domain
    names within the default JNDI LDAP provider
    + JDK-8172404: Tools should warn if weak algorithms are used
    before restricting them
    + JDK-8193367: Annotated type variable bounds crash javac
    + JDK-8202117: com/sun/jndi/ldap/RemoveNamingListenerTest.java
    fails intermittently: Connection reset
    + JDK-8203026: java.rmi.NoSuchObjectException: no such object
    in table
    + JDK-8203281: [Windows] JComboBox change in ui when
    editor.setBorder() is called
    + JDK-8203382: Rename SystemDictionary::initialize_wk_klass to
    resolve_wk_klass
    + JDK-8203393: com/sun/jdi/JdbMethodExitTest.sh and
    JdbExprTest.sh fail due to timeout
    + JDK-8203928: [Test] Convert non-JDB scaffolding
    serviceability shell script tests to java
    + JDK-8204963: javax.swing.border.TitledBorder has a memory leak
    + JDK-8204994: SA might fail to attach to process with "Windbg
    Error: WaitForEvent failed"
    + JDK-8205534: Remove SymbolTable dependency from
    serviceability agent
    + JDK-8206309: Tier1 SA tests fail
    + JDK-8208281: java/nio/channels/
    /AsynchronousSocketChannel/Basic.java timed out
    + JDK-8209109: [TEST] rewrite com/sun/jdi shell tests to java
    version - step1
    + JDK-8209332: [TEST] test/jdk/com/sun/jdi/CatchPatternTest.sh
    is incorrect
    + JDK-8209342: Problemlist SA tests on Solaris due to Error
    attaching to process: Can't create thread_db agent!
    + JDK-8209343: Test javax/swing/border/TestTitledBorderLeak.java
    should be marked as headful
    + JDK-8209517: com/sun/jdi/BreakpointWithFullGC.java fails with
    timeout
    + JDK-8209604: [TEST] rewrite com/sun/jdi shell tests to java
    version - step2
    + JDK-8209605: com/sun/jdi/BreakpointWithFullGC.java fails with
    ZGC
    + JDK-8209608: Problem list com/sun/jdi/BreakpointWithFullGC.java
    + JDK-8210131: vmTestbase/nsk/jvmti/scenarios/allocation/AP10/
    /ap10t001/TestDescription.java failed with ObjectFree:
    GetCurrentThreadCpuTimerInfo returned unexpected error code
    + JDK-8210243: [TEST] rewrite com/sun/jdi shell tests to java
    version - step3
    + JDK-8210527: JShell: NullPointerException in
    jdk.jshell.Eval.translateExceptionStack
    + JDK-8210560: [TEST] convert com/sun/jdi redefineClass-related
    tests
    + JDK-8210725: com/sun/jdi/RedefineClearBreakpoint.java fails
    with waitForPrompt timed out after 60 seconds
    + JDK-8210748: [TESTBUG] lib.jdb.Jdb.waitForPrompt() should
    clarify which output is the pending reply after a timeout
    + JDK-8210760: [TEST] rewrite com/sun/jdi shell tests to java
    version - step4
    + JDK-8210977: jdk/jfr/event/oldobject/TestThreadLocalLeak.java
    fails to find ThreadLocalObject
    + JDK-8211292: [TEST] convert com/sun/jdi/DeferredStepTest.sh
    test
    + JDK-8211694: JShell: Redeclared variable should be reset
    + JDK-8212200: assert when shared java.lang.Object is redefined
    by JVMTI agent
    + JDK-8212629: [TEST] wrong breakpoint in
    test/jdk/com/sun/jdi/DeferredStepTest
    + JDK-8212665: com/sun/jdi/DeferredStepTest.java: jj1 (line 57)
  - unexpected. lastLine=52, minLine=52, maxLine=55
    + JDK-8212807: tools/jar/multiRelease/Basic.java times out
    + JDK-8213182: Minimal VM build failure after JDK-8212200
    (assert when shared java.lang.Object is redefined by JVMTI
    agent)
    + JDK-8213214: Set -Djava.io.tmpdir= when running tests
    + JDK-8213275: ReplaceCriticalClasses.java fails with
    jdk.internal.vm.PostVMInitHook not found
    + JDK-8213574: Deadlock in string table expansion when dumping
    lots of CDS classes
    + JDK-8213703: LambdaConversionException: Invalid receiver type
    not a subtype of implementation type interface
    + JDK-8214074: Ghash optimization using AVX instructions
    + JDK-8214491: Upgrade to JLine 3.9.0
    + JDK-8214797: TestJmapCoreMetaspace.java timed out
    + JDK-8215243: JShell tests failing intermitently with
    "Problem cleaning up the following threads:"
    + JDK-8215244: jdk/jshell/ToolBasicTest.java
    testHistoryReference failed
    + JDK-8215354: x86_32 build failures after JDK-8214074 (Ghash
    optimization using AVX instructions)
    + JDK-8215438: jshell tool: Ctrl-D causes EOF
    + JDK-8216021: RunTest.gmk might set concurrency level to 1 on
    Windows
    + JDK-8216974: HttpConnection not returned to the pool after
    204 response
    + JDK-8218948: SimpleDateFormat :: format - Zone Names are not
    reflected correctly during run time
    + JDK-8219712: code_size2 (defined in stub_routines_x86.hpp) is
    too small on new Skylake CPUs
    + JDK-8220150: macos10.14 Mojave returns anti-aliased glyphs
    instead of aliased B&amp;W glyphs
    + JDK-8221658: aarch64: add necessary predicate for ubfx
    patterns
    + JDK-8221759: Crash when completing "java.io.File.path"
    + JDK-8221918: runtime/SharedArchiveFile/serviceability/
    /ReplaceCriticalClasses.java fails: Shared archive not found
    + JDK-8222074: Enhance auto vectorization for x86
    + JDK-8222079: Don't use memset to initialize fields decode_env
    constructor in disassembler.cpp
    + JDK-8222769: [TESTBUG] TestJFRNetworkEvents should not rely
    on hostname command
    + JDK-8223688: JShell: crash on the instantiation of raw
    anonymous class
    + JDK-8223777: In posix_spawn mode, failing to exec()
    jspawnhelper does not result in an error
    + JDK-8223940: Private key not supported by chosen signature
    algorithm
    + JDK-8224184: jshell got IOException at exiting with AIX
    + JDK-8224234: compiler/codegen/TestCharVect2.java fails in
    test_mulc
    + JDK-8225037: java.net.JarURLConnection::getJarEntry() throws
    NullPointerException
    + JDK-8225625: AES Electronic Codebook (ECB) encryption and
    decryption optimization using AVX512 + VAES instructions
    + JDK-8226536: Catch OOM from deopt that fails rematerializing
    objects
    + JDK-8226575: OperatingSystemMXBean should be made container
    aware
    + JDK-8226697: Several tests which need the @key headful
    keyword are missing it.
    + JDK-8226809: Circular reference in printed stack trace is not
    correctly indented &amp; ambiguous
    + JDK-8227059: sun/security/tools/keytool/
    /DefaultSignatureAlgorithm.java timed out
    + JDK-8227269: Slow class loading when running with JDWP
    + JDK-8227595: keytool/fakegen/DefaultSignatureAlgorithm.java
    fails due to "exitValue = 6"
    + JDK-8228448: Jconsole can't connect to itself
    + JDK-8228967: Trust/Key store and SSL context utilities for
    tests
    + JDK-8229378: jdwp library loader in linker_md.c quietly
    truncates on buffer overflow
    + JDK-8229815: Upgrade Jline to 3.12.1
    + JDK-8230000: some httpclients testng tests run zero test
    + JDK-8230002: javax/xml/jaxp/unittest/transform/
    /SecureProcessingTest.java runs zero test
    + JDK-8230010: Remove jdk8037819/BasicTest1.java
    + JDK-8230094: CCE in createXMLEventWriter(Result) over an
    arbitrary XMLStreamWriter
    + JDK-8230402: Allocation of compile task fails with assert:
    "Leaking compilation tasks?"
    + JDK-8230767: FlightRecorderListener returns null recording
    + JDK-8230870: (zipfs) Add a ZIP FS test that is similar to
    test/jdk/java/util/zip/EntryCount64k.java
    + JDK-8231209: [REDO] ThreadMXBean::getThreadAllocatedBytes()
    can be quicker for self thread
    + JDK-8231586: enlarge encoding space for OopMapValue offsets
    + JDK-8231953: Wrong assumption in assertion in
    oop::register_oop
    + JDK-8231968: getCurrentThreadAllocatedBytes default
    implementation s/b getThreadAllocatedBytes
    + JDK-8232083: Minimal VM is broken after JDK-8231586
    + JDK-8232161: Align some one-way conversion in MS950 charset
    with Windows
    + JDK-8232855: jshell missing word in /help help
    + JDK-8233027: OopMapSet::all_do does oms.next() twice during
    iteration
    + JDK-8233228: Disable weak named curves by default in TLS,
    CertPath, and Signed JAR
    + JDK-8233386: Initialize NULL fields for unused decorations
    + JDK-8233452: java.math.BigDecimal.sqrt() with
    RoundingMode.FLOOR results in incorrect result
    + JDK-8233686: XML transformer uses excessive amount of memory
    + JDK-8233741: AES Countermode (AES-CTR) optimization using
    AVX512 + VAES instructions
    + JDK-8233829: javac cannot find non-ASCII module name under
    non-UTF8 environment
    + JDK-8233958: Memory retention due to HttpsURLConnection
    finalizer that serves no purpose
    + JDK-8234011: (zipfs) Memory leak in
    ZipFileSystem.releaseDeflater()
    + JDK-8234058: runtime/CompressedOops/
    /CompressedClassPointers.java fails with 'Narrow klass base:
    0x0000000000000000' missing from stdout/stderr
    + JDK-8234149: Several regression tests do not dispose Frame at
    end
    + JDK-8234347: "Turkey" meta time zone does not generate
    composed localized names
    + JDK-8234385: [TESTBUG] java/awt/EventQueue/6980209/
    /bug6980209.java fails in linux nightly
    + JDK-8234535: Cross compilation fails due to missing CFLAGS
    for the BUILD_CC
    + JDK-8234541: C1 emits an empty message when it inlines
    successfully
    + JDK-8234687: change javap reporting on unknown attributes
    + JDK-8236464: SO_LINGER option is ignored by SSLSocket in JDK
    11
    + JDK-8236548: Localized time zone name inconsistency between
    English and other locales
    + JDK-8236617: jtreg test containers/docker/
    /TestMemoryAwareness.java fails after 8226575
    + JDK-8237182: Update copyright header for shenandoah and
    epsilon files
    + JDK-8237888: security/infra/java/security/cert/
    /CertPathValidator/certification/LuxTrustCA.java fails when
    checking validity interval
    + JDK-8237977: Further update
    javax/net/ssl/compatibility/Compatibility.java
    + JDK-8238270: java.net HTTP/2 client does not decrease stream
    count when receives 204 response
    + JDK-8238284: [macos] Zero VM build fails due to an obvious
    typo
    + JDK-8238380: java.base/unix/native/libjava/childproc.c
    "multiple definition" link errors with GCC10
    + JDK-8238386: (sctp) jdk.sctp/unix/native/libsctp/SctpNet.c
    "multiple definition" link errors with GCC10
    + JDK-8238388: libj2gss/NativeFunc.o "multiple definition" link
    errors with GCC10
    + JDK-8238448: RSASSA-PSS signature verification fail when
    using certain odd key sizes
    + JDK-8238710: LingeredApp doesn't log stdout/stderr if exits
    with non-zero code
    + JDK-8239083: C1 assert(known_holder == NULL ||
    (known_holder-&gt;is_instance_klass() &amp;&amp;
    (!known_holder-&gt;is_interface() ||
    ((ciInstanceKlass*)known_holder)-&gt;has_nonstatic_concrete_methods())),
    "should be non-static concrete method");
    + JDK-8239385: KerberosTicket client name refers wrongly to
    sAMAccountName in AD
    + JDK-8240169: javadoc fails to link to non-modular api docs
    + JDK-8240295: hs_err elapsed time in seconds is not accurate
    enough
    + JDK-8240360: NativeLibraryEvent has wrong library name on
    Linux
    + JDK-8240676: Meet not symmetric failure when running lucene
    on jdk8
    + JDK-8241007: Shenandoah: remove
    ShenandoahCriticalControlThreadPriority support
    + JDK-8241065: Shenandoah: remove leftover code after
    JDK-8231086
    + JDK-8241086: Test runtime/NMT/HugeArenaTracking.java is
    failing on 32bit Windows
    + JDK-8241130: com.sun.jndi.ldap.EventSupport.removeDeadNotifier:
    java.lang.NullPointerException
    + JDK-8241138: http.nonProxyHosts=* causes
    StringIndexOutOfBoundsException in DefaultProxySelector
    + JDK-8241319: WB_GetCodeBlob doesn't have ResourceMark
    + JDK-8241478: vmTestbase/gc/gctests/Steal/steal001/steal001.java
    fails with OOME
    + JDK-8241574: Shenandoah: remove ShenandoahAssertToSpaceClosure
    + JDK-8241750: x86_32 build failure after JDK-8227269
    + JDK-8242184: CRL generation error with RSASSA-PSS
    + JDK-8242283: Can't start JVM when java home path includes
    non-ASCII character
    + JDK-8242556: Cannot load RSASSA-PSS public key with non-null
    params from byte array
    + JDK-8243029: Rewrite javax/net/ssl/compatibility/
    /Compatibility.java with a flexible interop test framework
    + JDK-8243138: Enhance BaseLdapServer to support starttls
    extended request
    + JDK-8243320: Add SSL root certificates to Oracle Root CA
    program
    + JDK-8243321: Add Entrust root CA - G4 to Oracle Root CA
    program
    + JDK-8243389: enhance os::pd_print_cpu_info on linux
    + JDK-8243453: java --describe-module failed with non-ASCII
    module name under non-UTF8 environment
    + JDK-8243470: [macos] bring back O2 opt level for unsafe.cpp
    + JDK-8243489: Thread CPU Load event may contain wrong data for
    CPU time under certain conditions
    + JDK-8243925: Toolkit#getScreenInsets() returns wrong value on
    HiDPI screens (Windows)
    + JDK-8244087: 2020-04-24 public suffix list update
    + JDK-8244151: Update MUSCLE PC/SC-Lite headers to the latest
    release 1.8.26
    + JDK-8244164: AArch64: jaotc generates incorrect code for
    compressed OOPs with non-zero heap base
    + JDK-8244196: adjust output in os_linux
    + JDK-8244225: stringop-overflow warning on strncpy call from
    compile_the_world_in
    + JDK-8244287: JFR: Methods samples have line number 0
    + JDK-8244703: "platform encoding not initialized" exceptions
    with debugger, JNI
    + JDK-8244719: CTW: C2 compilation fails with
    "assert(!VerifyHashTableKeys || _hash_lock == 0) failed:
    remove node from hash table before modifying it"
    + JDK-8244729: Shenandoah: remove resolve paths from
    SBSA::generate_shenandoah_lrb
    + JDK-8244763: Update --release 8 symbol information after JSR
    337 MR3
    + JDK-8244818: Java2D Queue Flusher crash while moving
    application window to external monitor
    + JDK-8245151: jarsigner should not raise duplicate warnings on
    verification
    + JDK-8245616: Bump update version for OpenJDK: jdk-11.0.9
    + JDK-8245714: "Bad graph detected in build_loop_late" when
    loads are pinned on loop limit check uncommon branch
    + JDK-8245801: StressRecompilation triggers assert "redundunt
    OSR recompilation detected. memory leak in CodeCache!"
    + JDK-8245832: JDK build make-static-libs should build all JDK
    libraries
    + JDK-8245880: Shenandoah: check class unloading flag early in
    concurrent code root scan
    + JDK-8245981: Upgrade to jQuery 3.5.1
    + JDK-8246027: Minimal fastdebug build broken after JDK-8245801
    + JDK-8246094: [macos] Sound Recording and playback is not
    working
    + JDK-8246153: TestEliminateArrayCopy fails with
  - XX:+StressReflectiveCode
    + JDK-8246193: Possible NPE in ENC-PA-REP search in AS-REQ
    + JDK-8246196: javax/management/MBeanServer/OldMBeanServerTest
    fails with AssertionError
    + JDK-8246203: Segmentation fault in verification due to stack
    overflow with -XX:+VerifyIterativeGVN
    + JDK-8246330: Add TLS Tests for Legacy ECDSA curves
    + JDK-8246453: TestClone crashes with "all collected exceptions
    must come from the same place"
    + JDK-8247246: Add explicit ResolvedJavaType.link and expose
    presence of default methods
    + JDK-8247350: [aarch64] assert(false) failed: wrong size of
    mach node
    + JDK-8247502: PhaseStringOpts crashes while optimising
    effectively dead code
    + JDK-8247615: Initialize the bytes left for the heap sampler
    + JDK-8247824: CTW: C2 (Shenandoah) compilation fails with SEGV
    in SBC2Support::pin_and_expand
    + JDK-8247874: Replacement in VersionProps.java.template not
    working when --with-vendor-bug-url contains '&amp;'
    + JDK-8247979: aarch64: missing side effect of killing flags
    for clearArray_reg_reg
    + JDK-8248214: Add paddings for TaskQueueSuper to reduce
    false-sharing cache contention
    + JDK-8248219: aarch64: missing memory barrier in
    fast_storefield and fast_accessfield
    + JDK-8248348: Regression caused by the update to BCEL 6.0
    + JDK-8248385: [testbug][11u] Adapt TestInitiExceptions to
    jtreg 5.1
    + JDK-8248495: [macos] zerovm is broken due to libffi headers
    location
    + JDK-8248851: CMS: Missing memory fences between free chunk
    check and klass read
    + JDK-8248987: AOT's Linker.java seems to eagerly fail-fast on
    Windows
    + JDK-8249159: Downport test rework for SSLSocketTemplate from
    8224650
    + JDK-8249215: JFrame::setVisible crashed with
  - Dfile.encoding=UTF-8 on Japanese Windows.
    + JDK-8249251: [dark_mode ubuntu 20.04] The selected menu is
    not highlighted in GTKLookAndFeel
    + JDK-8249255: Build fails if source code in cygwin home dir
    + JDK-8249277: TestVerifyIterativeGVN.java is failing with
    timeout in OpenJDK 11
    + JDK-8249278: Revert JDK-8226253 which breaks the spec of
    AccessibleState.SHOWING for JList
    + JDK-8249560: Shenandoah: Fix racy GC request handling
    + JDK-8249801: Shenandoah: Clear soft-refs on requested GC cycle
    + JDK-8249953: Shenandoah: gc/shenandoah/mxbeans tests should
    account for corner cases
    + JDK-8250582: Revert Principal Name type to NT-UNKNOWN when
    requesting TGS Kerberos tickets
    + JDK-8250609: C2 crash in IfNode::fold_compares
    + JDK-8250627: Use -XX:+/-UseContainerSupport for
    enabling/disabling Java container metrics
    + JDK-8250755: Better cleanup for
    jdk/test/javax/imageio/plugins/shared/CanWriteSequence.java
    + JDK-8250787: Provider.put no longer registering aliases in
    FIPS env
    + JDK-8250826: jhsdb does not work with coredump which comes
    from Substrate VM
    + JDK-8250827: Shenandoah: needs to reset/finish StringTable's
    dead count before/after parallel walk
    + JDK-8250844: Make sure {type,obj}ArrayOopDesc accessors check
    the bounds
    + JDK-8251117: Cannot check P11Key size in P11Cipher and
    P11AEADCipher
    + JDK-8251354: Shenandoah: Fix jdk/jfr/tool/TestPrintJSON.java
    test failure
    + JDK-8251451: Shenandoah: Remark ObjectSynchronizer roots with
    I-U
    + JDK-8251469: Better cleanup for
    test/jdk/javax/imageio/SetOutput.java
    + JDK-8251487: Shenandoah: missing detail timing tracking for
    final mark cleaning phase
    + JDK-8252120: compiler/oracle/TestCompileCommand.java
    misspells "occured"
    + JDK-8252157: JDK-8231209 11u backport breaks jmm binary
    compatibility
    + JDK-8252258: [11u] JDK-8242154 changes the default vendor
    + JDK-8252804: [test] Fix 'ReleaseDeflater.java' test after
    downport of 8234011
    + JDK-8253134: JMM_VERSION should remain at 0x20020000 (JDK 10)
    in JDK 11
    + JDK-8253283: [11u] Test build/translations/
    /VerifyTranslations.java failing after JDK-8252258
    + JDK-8253813: Backout JDK-8244287 from 11u: it causes several
    crashes
- Removed patch:
  * gcc-fno-common-fix.patch
    + not needed any more with this version
- Added patch:
  * JDK-8250861.patch
    + Fix regression "8250861: Crash in MinINode::Ideal(PhaseGVN*,
    bool)" introduced in jdk 11.0.9</changelog>
  <changelog author="fstrba@suse.com" date="1604491200">- Enable Sheandoah GC for x86_64 (jsc#ECO-3171)</changelog>
  <changelog author="fstrba@suse.com" date="1605528000">- Update to upstream tag jdk-11.0.9.1-1
  * Fix:
    + JDK-8250861: Crash in MinINode::Ideal(PhaseGVN*, bool)
- Removed patch:
  * JDK-8250861.patch
    + Integrated upstream</changelog>
  <changelog author="fstrba@suse.com" date="1611230400">- Update to upstream tag jdk-11.0.10+9 (January 2021 CPU,
  bsc#1181239)
  * Security fixes
    + JDK-8247619: Improve Direct Buffering of Characters
  * Other changes
    + JDK-6722928: Support SSPI as a native GSS-API provider
    + JDK-7185258: [macosx] Deadlock in SunToolKit.realSync()
    + JDK-8152332: [macosx] JFileChooser cannot be serialized on
    Mac OS X
    + JDK-8161684: [testconf] Add VerifyOops' testing into compiler
    tiers
    + JDK-8171279: Support X25519 and X448 in TLS
    + JDK-8173361: various crashes in
    JvmtiExport::post_compiled_method_load
    + JDK-8173658: JvmtiExport::post_class_unload() is broken for
    non-JavaThread initiators
    + JDK-8191006: hsdis disassembler plugin does not compile with
    binutils 2.29+
    + JDK-8197981: Missing return statement in
    __sync_val_compare_and_swap_8
    + JDK-8198334: java/awt/FileDialog/8003399/bug8003399.java
    fails in headless mode
    + JDK-8200151: Add 8 JNDI tests to com/sun/jndi/dns/ConfigTests/
    + JDK-8208279: Add 8 JNDI tests to com/sun/jndi/dns/EnvTests/
    + JDK-8208483: Add 5 JNDI tests to
    com/sun/jndi/dns/FactoryTests/
    + JDK-8208542: Add 4 JNDI tests to com/sun/jndi/dns/ListTests/
    + JDK-8208665: Amend cross-compilation docs with
    qemu-debootstrap recipe
    + JDK-8210088: ProblemList gc/epsilon/TestMemoryMXBeans.java
    + JDK-8210339: Add 10 JNDI tests to com/sun/jndi/dns/FedTests/
    + JDK-8211450: UndetVar::dup is not copying the kind field to
    the duplicated instance
    + JDK-8212160: JVMTI agent crashes with "assert(_value != 0LL)
    failed: resolving NULL _value"
    + JDK-8212226: SurfaceManager throws "Invalid Image variant"
    for MultiResolutionImage (Windows)
    + JDK-8213400: Support choosing group name in keytool keypair
    generation
    + JDK-8213535: Windows HiDPI html lightweight tooltips are
    truncated
    + JDK-8213698: Improve devkit creation and add support for
    linux/ppc64/ppc64le/s390x
    + JDK-8214025: assert(t-&gt;singleton()) failed: must be a
    constant when ScavengeRootsInCode &lt; 2
    + JDK-8214242: compiler/arguments/TestScavengeRootsInCode.java
    fails because of missing UnlockDiagnosticVMOptions
    + JDK-8214787: Zero builds fail with "undefined
    JavaThread::thread_state()"
    + JDK-8215583: Exclude
    runtime/handshake/HandshakeWalkSuspendExitTest.java
    + JDK-8216012: Infinite loop in RSA KeyPairGenerator
    + JDK-8216324: GetClassMethods is confused by the presence of
    default methods in super interfaces
    + JDK-8217429: WebSocket over authenticating proxy fails to
    send Upgrade headers
    + JDK-8217976: test/jdk/java/net/httpclient/websocket/
    /WebSocketProxyTest.java fails intermittently
    + JDK-8218021: Have jarsigner preserve posix permission
    attributes
    + JDK-8218287: jshell tool: input behavior unstable after
    12-ea+24 on Windows
    + JDK-8218851: JVM crash in custom classloader stress test, JDK
    12 &amp; 13
    + JDK-8220420: Cleanup c1_LinearScan
    + JDK-8222072: JVMTI GenerateEvents() sends CompiledMethodLoad
    events to wrong jvmtiEnv
    + JDK-8222286: Fix for JDK-8213419 is broken on s390
    + JDK-8222527: HttpClient doesn't send HOST header when
    tunelling HTTP/1.1 through http proxy
    + JDK-8222533: jtreg test jdk/internal/platform/cgroup/
    /TestCgroupMetrics.java fails on SLES12.3 linux ppc64le
    machine
    + JDK-8224506: [TESTBUG] TestDockerMemoryMetrics.java fails
    with exitValue = 137
    + JDK-8224555: vmTestbase/nsk/jvmti/scenarios/contention/TC02/
    /tc02t001/TestDescription.java failed
    + JDK-8224650: Add tests to support X25519 and X448 in TLS
    + JDK-8225072: Add LuxTrust certificate that is expiring in
    March 2021 to list of allowed but expired certs
    + JDK-8225329: -XX:+PrintBiasedLockingStatistics causes crash
    during initialization on Windows platforms
    + JDK-8225687: Newly added sspi.cpp in JDK-6722928 still
    contains some small errors
    + JDK-8227006: [linux] Runtime.availableProcessors execution
    time increased by factor of 100
    + JDK-8227275: Within native OOM error handling, assertions may
    hang the process
    + JDK-8227647: [Graal] Test8009761.java fails due to
    "RuntimeException: static java.lang.Object
    compiler.uncommontrap.Test8009761.m3(boolean,boolean) not
    compiled"
    + JDK-8229495: SIGILL in C2 generated OSR compilation
    + JDK-8230910: libsspi_bridge does not build on Windows 32bit
    + JDK-8232114: JVM crashed at imjpapi.dll in native code
    + JDK-8234147: Avoid looking up standard charsets in core
    libraries
    + JDK-8234393: [macos] printing ignores printer tray
    + JDK-8234863: Increase default value of MaxInlineLevel
    + JDK-8235218: Minimal VM is broken after JDK-8173361
    + JDK-8235456: Minimal VM is broken after JDK-8212160
    + JDK-8235829: graal crashes with Zombie.java test
    + JDK-8236124: Minimal VM slowdebug build failed after
    JDK-8212160
    + JDK-8236512: PKCS11 Connection closed after Cipher.doFinal
    and NoPadding
    + JDK-8236944: The legVecZ operand should be limited to
    zmm0-zmm15 registers
    + JDK-8237186: Fix typo in copyright header of
    java/io/Reader/TransferTo.java
    + JDK-8237499: JFR: Include stack trace in the ThreadStart event
    + JDK-8237512: AArch64: aarch64TestHook leaks a BufferBlob
    + JDK-8237524: AArch64: String.compareTo() may return incorrect
    result
    + JDK-8237950: C2 compilation fails with "Live Node limit
    exceeded limit" during ConvI2L::Ideal optimization
    + JDK-8238579: HttpsURLConnection drops the timeout and hangs
    forever in read
    + JDK-8239105: Add exception for expiring Digicert root
    certificates to VerifyCACerts test
    + JDK-8239477: jdk/jfr/jcmd/TestJcmdStartStopDefault.java fails
  - XX:+VerifyOops with "verify_oop: rsi: broken oop"
    + JDK-8239497: SEGV in EdgeUtils::field_name_symbol(Edge const&amp;)
    + JDK-8239886: Minimal VM build fails after JDK-8237499
    + JDK-8240633: Memory leaks in the implementations of
    FileChooserUI
    + JDK-8240690: Race condition between EDT and
    BasicDirectoryModel.FilesLoader.run0()
    + JDK-8241234: Unify monitor enter/exit runtime entries.
    + JDK-8241311: Move some charset mapping tests from closed to
    open
    + JDK-8241797: Add some tests to the problem list
    + JDK-8242029: AArch64: skip G1 array copy pre-barrier if
    marking not active
    + JDK-8242335: Additional Tests for RSASSA-PSS
    + JDK-8242480: Negative value may be returned by
    getFreeSwapSpaceSize() in the docker
    + JDK-8242614: cleanup duplicated test ldap server in some
    com/sun/jndi/ldap/ tests
    + JDK-8242846: Bring back test/jdk/tools/jlink/plugins/
    /OrderResourcesPluginTest.java
    + JDK-8243114: Implement montgomery{Multiply,Square}intrinsics
    on Windows
    + JDK-8243290: Improve diagnostic messages for class
    verification and redefinition failures
    + JDK-8243488: Add tests for set/get SendBufferSize and
    getReceiveBufferSize in DatagramSocket
    + JDK-8243549: sun/security/ssl/CipherSuite/
    /NamedGroupsWithCipherSuite.java failed with Unsupported
    signature algorithm: DSA
    + JDK-8243617: compiler/onSpinWait/TestOnSpinWaitC1.java test
    uses wrong class
    + JDK-8243619: compiler/codecache/CheckSegmentedCodeCache.java
    test misses -version
    + JDK-8244142: some hotspot/runtime tests don't check exit code
    of forked JVM
    + JDK-8244278: Excessive code cache flushes and sweeps
    + JDK-8244282: test/hotspot/jtreg/compiler/intrinsics/
    /Test8237524.java fails with --illegal-access=deny
    + JDK-8244621: [macos10.15] Garbled FX printing plus CoreText
    warnings on Catalina when building with Xcode 11
    + JDK-8244819: hsdis does not compile with binutils 2.34+
    + JDK-8245051: c1 is broken if it is compiled by gcc without
  - fno-lifetime-dse
    + JDK-8245168: jlink should not be treated as a "small" tool
    + JDK-8245400: Upgrade to LittleCMS 2.11
    + JDK-8246381: VM crashes with "Current BasicObjectLock* below
    than low_mark"
    + JDK-8246434: Threads::print_on_error assumes that the heap
    has been set up
    + JDK-8246648: issue with OperatingSystemImpl
    getFreeSwapSpaceSize in docker after 8242480
    + JDK-8247201: Print potential pointer value of readable stack
    memory in hs_err file
    + JDK-8247763: assert(outer-&gt;outcnt() == 2) failed: 'only phis'
    failure in LoopNode::verify_strip_mined()
    + JDK-8247867: Upgrade to freetype 2.10.2
    + JDK-8248190: Enable Power10 system and implement new
    byte-reverse instructions
    + JDK-8248226: TestCloneAccessStressGCM fails with
  - XX:-ReduceBulkZeroing
    + JDK-8248347: windows build broken by JDK-8243114
    + JDK-8248532: Every time I change keyboard language at my
    MacBook, Java crashes
    + JDK-8248552: C2 crashes with SIGFPE due to division by zero
    + JDK-8248596: [TESTBUG] compiler/loopopts/
    /PartialPeelingUnswitch.java times out with Graal enabled
    + JDK-8248745: Add jarsigner and keytool tests for restricted
    algorithms
    + JDK-8248791: sun/util/resources/cldr/TimeZoneNamesTest.java
    fails with -XX:-ReduceInitialCardMarks -XX:-ReduceBulkZeroing
    + JDK-8248845: AArch64: stack corruption after spilling vector
    register
    + JDK-8249176: Update GlobalSignR6CA test certificates
    + JDK-8249183: JVM crash in "AwtFrame::WmSize" method
    + JDK-8249192: MonitorInfo stores raw oops across safepoints
    + JDK-8249602: C2: assert(cnt == _outcnt) failed: no insertions
    allowed
    + JDK-8249603: C1: assert(has_error == false) failed: register
    allocation invalid
    + JDK-8249605: C2: assert(no_dead_loop) failed: dead loop
    detected
    + JDK-8249607: C2: assert(!had_error) failed: bad dominance
    + JDK-8249608: Vector register used by C2 compiled method
    corrupted at safepoint
    + JDK-8249672: Include microcode revision in features_string on
    x86
    + JDK-8249748: gtest silently ignores bad jvm arguments
    + JDK-8249821: Separate libharfbuzz from libfontmanager
    + JDK-8250598: Hyper-V is detected in spite of running on host
    OS
    + JDK-8250605: Linux x86_32 builds fail after JDK-8249821
    + JDK-8250636: iso8601_time returns incorrect offset part on
    MacOS
    + JDK-8250665: Wrong translation for the month name of May in
    ar_JO,LB,SY
    + JDK-8250772: Test com/sun/jndi/ldap/
    /NamingExceptionMessageTest.java fails intermittently with
    javax.naming.ServiceUnavailableException
    + JDK-8250825: C2 crashes with assert(field != __null) failed:
    missing field
    + JDK-8250894: Provide a configure option to build and run
    against the platform libharfbuzz
    + JDK-8250928: JFR: Improve hash algorithm for stack traces
    + JDK-8250968: Symlinks attributes not preserved when using
    jarsigner on zip files
    + JDK-8250984: Memory Docker tests fail on some Linux kernels
    w/o cgroupv1 swap limit capabilities
    + JDK-8251118: BiasedLocking::preserve_marks should not have a
    HandleMark
    + JDK-8251189: com/sun/jndi/ldap/LdapDnsProviderTest.java
    failed due to timeout
    + JDK-8251257: NMT: jcmd VM.native_memory scale=1 crashes
    target VM
    + JDK-8251365: Build failure on AIX after 8250636
    + JDK-8251397: NPE on ClassValue.ClassValueMap.cacheArray
    + JDK-8251456: [TESTBUG] compiler/vectorization/
    /TestVectorsNotSavedAtSafepoint.java failed OutOfMemoryError
    + JDK-8251458: Parse::do_lookupswitch fails with "assert(_cnt
    &gt;= 0) failed"
    + JDK-8251535: Partial peeling at unsigned test adds incorrect
    loop exit check
    + JDK-8251949: ZGC: Set explicit heap size for
    compiler/gcbarriers tests
    + JDK-8252090: JFR: StreamWriterHost::write_unbuffered() stucks
    in an infinite loop OpenJDK (build 13.0.1+9)
    + JDK-8252415: Bump update version for OpenJDK: jdk-11.0.10
    + JDK-8252470: java/awt/dnd/DisposeFrameOnDragCrash/
    /DisposeFrameOnDragTest.java fails on Windows
    + JDK-8252497: Incorrect numeric currency code for ROL
    + JDK-8252660: Shenandoah: support manageable SoftMaxHeapSize
    option
    + JDK-8252679: Two windows specific FileDIalog tests may fail
    on some Windows_Server_2016_Standard
    + JDK-8252696: Loop unswitching may cause out of bound array
    load to be executed
    + JDK-8252754: Hash code calculation of JfrStackTrace is
    inconsistent
    + JDK-8253219: Epsilon: clean up unnecessary includes
    + JDK-8253224: Shenandoah: ShenandoahStrDedupQueue destructor
    calls virtual num_queues()
    + JDK-8253226: Shenandoah: remove unimplemented
    ShenandoahStrDedupQueue::verify
    + JDK-8253269: The CheckCommonColors test should provide more
    info on failure
    + JDK-8253284: Zero OrderAccess barrier mappings are incorrect
    + JDK-8253375: OSX build fails with Xcode 12.0 (12A7209)
    + JDK-8253778: ShenandoahSafepoint::is_at_shenandoah_safepoint
    should not access VMThread state from other threads
    + JDK-8253791: Issue with useAppleColor check in CSystemColors.m
    + JDK-8254016: Test8237524 fails with -XX:-CompactStrings option
    + JDK-8254081: java/security/cert/PolicyNode/
    /GetPolicyQualifiers.java fails due to an expired certificate
    + JDK-8254144: Non-x86 Zero builds fail with return-type
    warning in os_linux_zero.cpp
    + JDK-8254166: Zero: return-type warning in
    zeroInterpreter_zero.cpp
    + JDK-8254177: (tz) Upgrade time-zone data to tzdata2020b
    + JDK-8254185: Fix Code cache sweeper heuristics for JDK 11
    + JDK-8254190: [s390] interpreter misses exception check after
    calling monitorenter
    + JDK-8254790: SIGSEGV in string_indexof_char and
    stringL_indexof_char intrinsics
    + JDK-8254854: [cgroups v1] Metric limits not properly detected
    on some join controller combinations
    + JDK-8254982: (tz) Upgrade time-zone data to tzdata2020c
    + JDK-8255050: Add pkcs11/KeyStore/ClientAuth.sh to Problem list
    + JDK-8255065: Zero: accessor_entry misses the IRIW case
    + JDK-8255226: (tz) Upgrade time-zone data to tzdata2020d
    + JDK-8255269: Unsigned overflow in g1Policy.cpp
    + JDK-8255365: Problem list failing client manual tests
    + JDK-8255457: Shenandoah: cleanup ShenandoahMarkTask
    + JDK-8255466: C2 crashes at ciObject::get_oop() const+0x0
    + JDK-8255550: x86: Assembler::cmpq(Address dst, Register src)
    encoding is incorrect
    + JDK-8255603: Memory/Performance regression after JDK-8210985
    + JDK-8255760: Shenandoah: match constants style in
    ShenandoahMarkTask fallback
    + JDK-8255781: Bump patch update version for OpenJDK:
    jdk-11.0.9.1
    + JDK-8255937: Better cleanup for
    test/jdk/javax/imageio/stream/StreamFlush.java
    + JDK-8256427: Test com/sun/jndi/dns/ConfigTests/
    /PortUnreachable.java does not work on AIX
    + JDK-8256452: Integrate missing part of JDK-8232370 to 11u
    + JDK-8256483: [TESTBUG] serviceability/jvmti/GetClassMethods/
    /libOverpassMethods.c fails to compile on gcc 4.4.x
    + JDK-8256557: libharfbuzz fails to link on gcc 4.4.x due to
  - Wl,-z,defs
    + JDK-8256618: Zero: Linux x86_32 build still fails
    + JDK-8256736: Zero: GTest tests fail with "unsuppported vm
    variant"
    + JDK-8256809: Annotation processing causes NPE during flow
    analysis
    + JDK-8257181: s390x builds are very noisy with gc-sections
    messages
    + JDK-8257242: [macOS] Java app crashes while switching input
    methods
    + JDK-8257545: SunJSSE FIPS regression in key exchange after
    JDK-8171279 11u backport
    + JDK-8257641: Shenandoah: Query is_at_shenandoah_safepoint()
    from control thread should return false
    + JDK-8257701: Shenandoah: objArrayKlass metadata is not marked
    with chunked arrays
    + JDK-8258630: Add expiry exception for QuoVadis root
    certificate
- New upstream dependency on libharfbuzz
- Regenerated patches: missing-return.patch system-pcsclite.patch</changelog>
  <changelog author="fstrba@suse.com" date="1616155200">- Added patches:
  * system-crypto-policy.patch
    + Let OpenJDK use system crypto policies unless explicitely told
    not to
  * nss-security-provider.patch
    + Add the NSS security provider with configuration in generated
    nss.cfg file
  * keytool-default-rsa.patch
    + Make keytool generate RSA keys by default, since only the
    LEGACY system crypto policy allows DSA</changelog>
  <changelog author="pujos.michael@gmail.com" date="1618488000">- moved mozilla-nss dependency to java-11-openjdk-headless package
  This is necessary to be able to do crypto with just
  java-11-openjdk-headless installed. Fixes boo#1184606</changelog>
  <changelog author="fstrba@suse.com" date="1619006400">- Update to upstream tag jdk-11.0.11+9 (April 2021, CPU)
  * Security fixes
    + JDK-8244473: Contextualize registration for JNDI
    + JDK-8244543: Enhanced handling of abstract classes
    + JDK-8249906, CVE-2021-2163, bsc#1185055: Enhance opening JARs
    + JDK-8250568, CVE-2021-2161, bsc#1185056: Less ambiguous
    processing
    + JDK-8253799: Make lists of normal filenames
    + JDK-8257001: Improve Http Client Support
  * Other changes
    + JDK-7107012: sun.jvm.hotspot.code.CompressedReadStream
    readDouble() conversion to long mishandled
    + JDK-7146776: deadlock between URLStreamHandler.getHostAddress
    and file.Handler.openconnection
    + JDK-8086003: Test fails on OSX with java.lang.RuntimeException
    'Narrow klass base: 0x0000000000000000, Narrow klass shift: 3'
    missing
    + JDK-8168869: jdeps: localized messages don't use proper line
    breaks
    + JDK-8180837: SunPKCS11-NSS tests failing with
    CKR_ATTRIBUTE_READ_ONLY and CKR_MECHANISM_PARAM_INVALID
    + JDK-8202343: Disable TLS 1.0 and 1.1
    + JDK-8205992: jhsdb cannot attach to Java processes running in
    Docker containers
    + JDK-8209193: Fix aarch64-linux compilation after -Wreorder
    changes
    + JDK-8210413: AArch64: Optimize div/rem by constant in C1
    + JDK-8210578: AArch64: Invalid encoding for fmlsvs instruction
    + JDK-8211051: jdeps usage of --dot-output doesn't provide
    valid output for modular jar
    + JDK-8211057: Gensrc step CompileProperties generates unstable
    CompilerProperties output
    + JDK-8211150: G1 Full GC not purging code root memory and
    hence causing memory leak
    + JDK-8211825: ModuleLayer.defineModulesWithXXX does not setup
    delegation when module reads automatic module
    + JDK-8212043: Add floating-point Math.min/max intrinsics
    + JDK-8212218: [TESTBUG] runtime/ErrorHandling/
    /TestHeapDumpOnOutOfMemoryErrorInMetaspace.java timed out
    + JDK-8213116: javax/swing/JComboBox/WindowsComboBoxSize/
    /WindowsComboBoxSizeTest.java fails in Windows
    + JDK-8213909: jdeps --print-module-deps should report missing
    dependences
    + JDK-8214180: Need better granularity for sleeping
    + JDK-8214223: tools/jdeps/listdeps/ListModuleDeps.java failed
    due to missing Lib2 file
    + JDK-8214230: Classes generated by SystemModulesPlugin.java
    are not reproducable
    + JDK-8214741: docs/index.html has no title or copyright
    + JDK-8215687: [Graal] unit test CheckGraalIntrinsics failed
    after 8212043
    + JDK-8217848: [Graal] vmTestbase/nsk/jvmti/ResourceExhausted/
    /resexhausted003/TestDescription.java fails
    + JDK-8218482: sun/security/krb5/auto/ReplayCachePrecise.java
    failed - no KrbException thrown
    + JDK-8218550: Add test omitted from JDK-8212043
    + JDK-8221584: SIGSEGV in os::PlatformEvent::unpark() in
    JvmtiRawMonitor::raw_exit while posting method exit event
    + JDK-8221995: AARCH64: problems with CAS instructions encoding
    + JDK-8222518: Remove unnecessary caching of Parker object in
    java.lang.Thread
    + JDK-8222785: aarch64: add necessary masking for immediate
    shift counts
    + JDK-8223186: HotSpot compile warnings from GCC 9
    + JDK-8225773: jdeps --check produces NPE if there are missing
    module dependences
    + JDK-8225805: Java Access Bridge does not close the logger
    + JDK-8226810: Failed to launch JVM because of
    NullPointerException occured on System.props
    + JDK-8229396: jdeps ignores multi-release when
    generate-module-info used on command line
    + JDK-8229474: Shenandoah: Cleanup CM::update_roots()
    + JDK-8232225: Rework the fix for JDK-8071483
    + JDK-8232905: JFR fails with assertion:
    assert(t-&gt;unflushed_size() == 0) failed: invariant
    + JDK-8233164: C2 fails with assert(phase-&gt;C-&gt;get_alias_index(t)
    == phase-&gt;C-&gt;get_alias_index(t_adr)) failed: correct memory
    chain
    + JDK-8233910: java/awt/ColorClass/AlphaColorTest.java is
    failing  intermittently in nightly lnux-x64 system
    + JDK-8233912: aarch64: minor improvements of atomic operations
    + JDK-8234508: VM_HeapWalkOperation::iterate_over_object reads
    non-strong fields with an on-strong load barrier
    + JDK-8234742: Improve handshake logging
    + JDK-8234796: Refactor Handshake::execute to take a more
    complex type than ThreadClosure
    + JDK-8235324: Dying objects are published from users of
    CollectedHeap::object_iterate
    + JDK-8235351: Lookup::unreflect should bind with the original
    caller independent of Method's accessible flag
    + JDK-8237369: Shenandoah: failed vmTestbase/nsk/jvmti/
    /AttachOnDemand/attach021/TestDescription.java test
    + JDK-8237392: Shenandoah: Remove unreliable assertion
    + JDK-8237483: AArch64 C1 OopMap inserted twice fatal error
    + JDK-8237495: Java MIDI fails with a dereferenced memory error
    when asked to send a raw 0xF7
    + JDK-8239355: (dc) Initial value of SO_SNDBUF should allow
    sending large datagrams (macOS)
    + JDK-8240353: AArch64: missing support for
  - XX:+ExtendedDTraceProbes in C1
    + JDK-8240704: CheckHandles.java failed "AssertionError: Handle
    use increased by more than 10 percent."
    + JDK-8240751: Shenandoah: fold ShenandoahTracer definition
    + JDK-8240795: [REDO] 8238384 CTW: C2 compilation fails with
    "assert(store != load-&gt;find_exact_control(load-&gt;in(0)))
    failed: dependence cycle found"
    + JDK-8241598: Upgrade JLine to 3.14.0
    + JDK-8241649: Optimize Character.toString
    + JDK-8241770: Module xxxAnnotation() methods throw NCDFE if
    module-info.class found as resource in unnamed module
    + JDK-8241911: AArch64: Fix a potential register clash issue in
    reduce_add2I
    + JDK-8242030: Wrong package declarations in jline classes after
    JDK-8241598
    + JDK-8242565: Policy initialization issues when the denyAfter
    constraint is enabled
    + JDK-8243618: compiler/rtm/cli tests can be run w/o WhiteBox
    + JDK-8243670: Unexpected test result caused by C2
    MergeMemNode::Ideal
    + JDK-8244088: [Regression] Switch of Gnome theme ends up in
    deadlocked UI
    + JDK-8244154: Update SunPKCS11 provider with PKCS11 v3.0 header
    files
    + JDK-8244340: Handshake processing thread lacks yielding
    + JDK-8244573: java.lang.ArrayIndexOutOfBoundsException thrown
    for malformed class file
    + JDK-8244683: A TSA server used by tests
    + JDK-8245005: javax/net/ssl/compatibility/BasicConnectTest.java
    failed with No enum constant
    + JDK-8245026: PsAdaptiveSizePolicy::_old_gen_policy_is_ready is
    unused
    + JDK-8245283: JFR: Can't handle constant dynamic used by Jacoco
    agent
    + JDK-8245512: CRC32 optimization using AVX512 instructions
    + JDK-8245527: LDAP Channel Binding support for Java
    GSS/Kerberos
    + JDK-8246707: (sc) SocketChannel.read/write throws
    AsynchronousCloseException on closed channel
    + JDK-8246709: sun/security/tools/jarsigner/
    /TsacertOptionTest.java compilation failed after JDK-8244683
    + JDK-8247200: assert((unsigned)fpargs &lt; 32)
    + JDK-8247766: [aarch64] guarantee(val &lt; (1U &lt;&lt; nbits))
    failed: Field too big for insn.
    + JDK-8248336: AArch64: C2: offset overflow in
    BoxLockNode::emit
    + JDK-8248865: Document JNDI/LDAP timeout properties
    + JDK-8248901: Signed immediate support in
    .../share/assembler.hpp is broken.
    + JDK-8249543: Force DirectBufferAllocTest to run with
  - ExplicitGCInvokesConcurrent
    + JDK-8249588: libwindowsaccessbridge issues on 64bit Windows
    + JDK-8249749: modify a primitive array through a stream and a
    for cycle causes jre crash
    + JDK-8249787: Make TestGCLocker more resilient with concurrent
    GCs
    + JDK-8249867: xml declaration is not followed by a newline
    + JDK-8250911: [windows] os::pd_map_memory() error detection
    broken
    + JDK-8251255: [linux] Add process-memory information to hs-err
    and VM.info
    + JDK-8251359: Shenandoah: filter null oops before calling
    enqueue/SATB barrier
    + JDK-8251925: C2: RenaissanceStressTest fails with
    assert(!had_error): bad dominance
    + JDK-8251944: Add Shenandoah test config to
    compiler/gcbarriers/UnsafeIntrinsicsTest.java
    + JDK-8251992: VM crashed running TestComplexAddrExpr.java test
    with -XX:UseAVX=X
    + JDK-8253220: Epsilon: clean up unused code/declarations
    + JDK-8253274: The CycleDMImagetest brokes the system
    + JDK-8253353: Crash in C2: guarantee(n != NULL) failed: No Node
    + JDK-8253368: TLS connection always receives close_notify
    exception
    + JDK-8253404: C2: assert(C-&gt;live_nodes() &lt;=
    C-&gt;max_node_limit()) failed: Live Node limit exceeded limit
    + JDK-8253409: Double-rounding possibility in float fma
    + JDK-8253476: TestUseContainerSupport.java fails on some Linux
    kernels w/o swap limit capabilities
    + JDK-8253524: C2: Refactor code that clones predicates during
    loop unswitching
    + JDK-8253644: C2: assert(skeleton_predicate_has_opaque(iff))
    failed: unexpected
    + JDK-8253681: closed java/awt/dnd/MouseEventAfterStartDragTest/
    /MouseEventAfterStartDragTest.html test failed
    + JDK-8253702: BigSur version number reported as 10.16, should
    be 11.nn
    + JDK-8253756: C2 CompilerThread0 crash in Node::add_req(Node*)
    + JDK-8254104: MethodCounters must exist before nmethod is
    installed
    + JDK-8254734: "dead loop detected" assert failure with patch
    from 8223051
    + JDK-8254748: Bad Copyright header format after JDK-8212218
    + JDK-8254799: runtime/ErrorHandling/
    /TestHeapDumpOnOutOfMemoryError.java fails with release VMs
    + JDK-8255058: C1: assert(is_virtual()) failed: type check
    + JDK-8255351: Add detection for Graviton 2 CPUs
    + JDK-8255368: Math.exp() gives wrong result for large values on
    x86 32-bit platforms
    + JDK-8255387: Japanese characters were printed upside down on
    AIX
    + JDK-8255401: Shenandoah: Allow oldval and newval registers to
    overlap in cmpxchg_oop()
    + JDK-8255479: [aarch64] assert(src-&gt;section_index_of(target) ==
    CodeBuffer::SECT_NONE) failed: sanity
    + JDK-8255544: Create a checked cast
    + JDK-8255559: Leak File Descriptors Because of
    ResolverLocalFilesystem#engineResolveURI()
    + JDK-8255681: print callstack in error case in
    runAWTLoopWithApp
    + JDK-8255734: VM should ignore SIGXFSZ on ppc64, s390 too
    + JDK-8255742: PrintInlining as compiler directive doesn't print
    virtual calls
    + JDK-8255845: Memory leak in imageFile.cpp
    + JDK-8255880: UI of Swing components is not redrawn after their
    internal state changed
    + JDK-8255908: ExceptionInInitializerError due to
    UncheckedIOException while initializing cgroupv1 subsystem
    + JDK-8256025: AArch64: MachCallRuntimeNode::ret_addr_offset()
    is incorrect for stub calls
    + JDK-8256056: Deoptimization stub doesn't save vector registers
    on x86
    + JDK-8256061: RegisterSaver::save_live_registers() omits upper
    halves of ZMM0-15 registers
    + JDK-8256187: [TEST_BUG] Automate bug4275046.java test
    + JDK-8256220: C1: x86_32 fails with -XX:UseSSE=1 after
    JDK-8210764 due to mishandled lir_neg
    + JDK-8256258: some missing NULL checks or asserts after
    CodeCache::find_blob_unsafe
    + JDK-8256264: Printed GlyphVector outline with low DPI has bad
    quality on Windows
    + JDK-8256290: javac/lambda/T8031967.java fails with
    StackOverflowError on x86_32
    + JDK-8256359: AArch64: runtime/ReservedStack/
    /ReservedStackTestCompiler.java fails
    + JDK-8256387: Unexpected result if patching an entire
    instruction on AArch64
    + JDK-8256421: Add 2 HARICA roots to cacerts truststore
    + JDK-8256488: [aarch64] Use ldpq/stpq instead of ld4/st4 for
    small copies in StubGenerator::copy_memory
    + JDK-8256489: Make gtest for long path names on Windows more
    resilient in the presence of virus scanners
    + JDK-8256501: libTestMainKeyWindow fails to build with Xcode
    12.2
    + JDK-8256633: Fix product build on Windows+Arm64
    + JDK-8256682: JDK-8202343 is incomplete
    + JDK-8256751: Incremental rebuild with precompiled header fails
    when touching a header file
    + JDK-8256757: Incorrect MachCallRuntimeNode::ret_addr_offset()
    for CallLeafNoFP on x86_32
    + JDK-8256806: Shenandoah: optimize shenandoah/jni/
    /TestPinnedGarbage.java test
    + JDK-8256807: C2: Not marking stores correctly as mismatched
    in string opts
    + JDK-8256810: Incremental rebuild broken on Macosx
    + JDK-8256818: SSLSocket that is never bound or connected leaks
    socket resources
    + JDK-8256888: Client manual test problem list update
    + JDK-8257083: Security infra test failures caused by
    JDK-8202343
    + JDK-8257408: Bump update version for OpenJDK: jdk-11.0.11
    + JDK-8257423: [PPC64] Support -XX:-UseInlineCaches
    + JDK-8257436: [aarch64] Regressions in ArrayCopyUnalignedDst
    .testByte/testChar for 65-78 bytes when UseSIMDForMemoryOps
    is on
    + JDK-8257513: C2: assert((constant_addr -
    _masm.code()-&gt;consts()-&gt;start()) == con.offset())
    + JDK-8257547: Handle multiple prereqs on the same line in deps
    files
    + JDK-8257561: Some code is not vectorized after 8251925 and
    8250607
    + JDK-8257565: epsilonBarrierSet.hpp should not include
    barrierSetAssembler
    + JDK-8257575: C2: "failed: only phis" assert failure in loop
    strip mining verification
    + JDK-8257594: C2 compiled checkcast of non-null object triggers
    endless deoptimization/recompilation cycle
    + JDK-8257633: Missing -mmacosx-version-min=X flag when linking
    libjvm
    + JDK-8257670: sun/security/ssl/SSLSocketImpl/SSLSocketLeak.java
    reports leaks
    + JDK-8257707: Fix incorrect format string in Http1HeaderParser
    + JDK-8257746: Regression introduced with JDK-8250984 - memory
    might be null in some machines
    + JDK-8257798: [PPC64] undefined reference to
    Klass::vtable_start_offset()
    + JDK-8257884: Re-enable sun/security/ssl/SSLSocketImpl/
    /SSLSocketLeak.java as automatic test
    + JDK-8257910: [JVMCI] Set exception_seen accordingly in the
    runtime.
    + JDK-8257997: sun/security/ssl/SSLSocketImpl/SSLSocketLeak.java
    again reports leaks after JDK-8257884
    + JDK-8257999: Parallel GC crash in gc/parallel/
    /TestDynShrinkHeap.java: new region is not in covered_region
    + JDK-8258077: Using -Xcheck:jni can lead to a double-free after
    JDK-8193234
    + JDK-8258247: Couple of issues in fix for JDK-8249906
    + JDK-8258373: Update the text handling in the JPasswordField
    + JDK-8258396: SIGILL in jdk.jfr.internal.PlatformRecorder
    .rotateDisk()
    + JDK-8258419: RSA cipher buffer cleanup
    + JDK-8258471: "search codecache" clhsdb command does not work
    + JDK-8258534: Epsilon: clean up unused includes
    + JDK-8258805: Japanese characters not entered by mouse click
    on Windows 10
    + JDK-8258833: Cancel multi-part cipher operations in SunPKCS11
    after failures
    + JDK-8258836: JNI local refs exceed capacity
    getDiagnosticCommandInfo
    + JDK-8258884: [TEST_BUG] Convert applet-based test
    open/test/jdk/javax/swing/JMenuItem/8031573/bug8031573.java
    to a regular java test
    + JDK-8259007: This test printed a blank page
    + JDK-8259048: (tz) Upgrade time-zone data to tzdata2020f
    + JDK-8259049: Uninitialized variable after JDK-8257513
    + JDK-8259231: Epsilon: improve performance under contention
    during virtual space expansion
    + JDK-8259271: gc/parallel/TestDynShrinkHeap.java still fails
    "assert(covered_region.contains(new_memregion)) failed: new
    region is not in covered_region"
    + JDK-8259312: VerifyCACerts.java fails as soneraclass2ca cert
    will expire in 90 days
    + JDK-8259319: Illegal package access when SunPKCS11 requires
    SunJCE's classes
    + JDK-8259339: AllocateUninitializedArray C2 intrinsic fails
    with void.class input
    + JDK-8259428: AlgorithmId.getEncodedParams() should return copy
    + JDK-8259446: runtime/jni/checked/
    /TestCheckedReleaseArrayElements.java fails with stderr not
    empty
    + JDK-8259451: Zero: skip serviceability/sa tests, set vm.hasSA
    to false
    + JDK-8259580: Shenandoah: uninitialized label in
    VerifyThreadGCState
    + JDK-8259619: C1: 3-arg StubAssembler::call_RT stack-use
    condition is incorrect
    + JDK-8259633: compiler/graalunit/CoreTest.java fails with NPE
    after JDK-8244543
    + JDK-8259706: C2 compilation fails with assert(vtable_index ==
    Method::invalid_vtable_index) failed: correct sentinel value
    + JDK-8259707: LDAP channel binding does not work with StartTLS
    extension
    + JDK-8259773: Incorrect encoding of AVX-512 kmovq instruction
    + JDK-8259849: Shenandoah: Rename store-val to IU-barrier
    + JDK-8259949: x86 32-bit build fails when -fcf-protection is
    passed in the compiler flags
    + JDK-8259954: gc/shenandoah/mxbeans tests fail with -Xcomp
    + JDK-8260029: aarch64: fix typo in verify_oop_array
    + JDK-8260308: Update LogCompilation junit to 4.13.1
    + JDK-8260338: Some fields in HaltNode is not cloned
    + JDK-8260349: Cannot programmatically retrieve Metaspace max
    set via JAVA_TOOL_OPTIONS
    + JDK-8260356: (tz) Upgrade time-zone data to tzdata2021a
    + JDK-8260378: [TESTBUG] DcmdMBeanTestCheckJni.java reports
    false positive
    + JDK-8260497: Shenandoah: Improve SATB flushing
    + JDK-8260502: [s390] NativeMovRegMem::verify() fails because
    it's too strict
    + JDK-8260632: Build failures after JDK-8253353
    + JDK-8260704: ParallelGC: oldgen expansion needs release-store
    for _end
    + JDK-8261022: Fix incorrect result of Math.abs() with char type
    + JDK-8261089: [TESTBUG] native library of test
    TestCheckedReleaseCriticalArray.java fails to compile with
    gcc 4.x
    + JDK-8261183: Follow on to Make lists of normal filenames
    + JDK-8261209: isStandalone property: remove dependency on
    pretty-print
    + JDK-8261231: Windows IME was disabled after DnD operation
    + JDK-8261251: Shenandoah: Use object size for full GC
    humongous compaction
    + JDK-8261310: PPC64 Zero build fails with
    'VMError::controlled_crash(int)::FunctionDescriptor
    functionDescriptor' has incomplete type and cannot be defined
    + JDK-8261334: NMT: tuning statistic shows incorrect hash
    distribution
    + JDK-8261413: Shenandoah: Disable class-unloading in I-U mode
    + JDK-8261522: [PPC64] AES intrinsics write beyond the
    destination array
    + JDK-8261534: Test sun/security/pkcs11/KeyAgreement/
    /IllegalPackageAccess.java fails on platforms where no nsslib
    artifacts are defined
    + JDK-8261585: Restore HandleArea used in
    Deoptimization::uncommon_trap
    + JDK-8261753: Test java/lang/System/OsVersionTest.java still
    failing on BigSur patch versions after JDK-8253702
    + JDK-8261829: Exclude tools/jlink/JLinkReproducibleTest.java
    in 11u
    + JDK-8261912: Code IfNode::fold_compares_helper more
    defensively
    + JDK-8261920: [AIX] jshell command throws java.io.IOError on
    non English locales
    + JDK-8262018: Wrong format in SAP copyright header of
    OsVersionTest
    + JDK-8263069: Exclude some failing tests from
    security/infra/java/security/cert/CertPathValidator</changelog>
  <changelog author="fstrba@suse.com" date="1620043200">- Remove all Jpackage provides for SLE12 in order to avoid
  installing this package as default Java on SLE12-SP5
  (bsc#1185476)</changelog>
  <changelog author="fstrba@suse.com" date="1621512000">- Modified patch:
  * nss-security-provider.patch
    + make the NSS provider first in the list</changelog>
  <changelog author="fstrba@suse.com" date="1626868800">- Update to upstream tag jdk-11.0.12+7 (July 2021, CPU)
  * Security fixes
    + JDK-8256157: Improve bytecode assembly
    + JDK-8256491: Better HTTP transport
    + JDK-8258432, CVE-2021-2341, bsc#1188564: Improve file
    transfers
    + JDK-8260453: Improve Font Bounding
    + JDK-8260960: Signs of jarsigner signing
    + JDK-8260967, CVE-2021-2369, bsc#1188565: Better jar file
    validation
    + JDK-8262380: Enhance XML processing passes
    + JDK-8262403: Enhanced data transfer
    + JDK-8262410: Enhanced rules for zones
    + JDK-8262477: Enhance String Conclusions
    + JDK-8262967: Improve Zip file support
    + JDK-8264066, CVE-2021-2388, bsc#1188566: Enhance compiler
    validation
    + JDK-8264079: Improve abstractions
    + JDK-8264460: Improve NTLM support
  * Other changes
    + JDK-6847157: java.lang.NullPointerException: HDC for
    component at sun.java2d.loops.Blit.Blit
    + JDK-7106851: Test should not use System.exit
    + JDK-8073446: TimeZone getOffset API does not  return a dst
    offset between years 2038-2137
    + JDK-8076190: Customizing the generation of a PKCS12 keystore
    + JDK-8153005: Upgrade the default PKCS12 encryption/MAC
    algorithms
    + JDK-8171303: sun/java2d/pipe/InterpolationQualityTest.java
    fails on Windows &amp; Linux
    + JDK-8177068: incomplete classpath causes NPE in Flow
    + JDK-8185734: [Windows] Structured Exception Catcher missing
    around gtest execution
    + JDK-8187450: JNI local refs exceeds capacity warning in
    NetworkInterface::getAll
    + JDK-8190763: Class cast exception on (CompoundEdit)
    UndoableEditEvent.getEdit()
    + JDK-8195841: PNGImageReader.readNullTerminatedString() doesnt
    check for non-null terminated strings with length equal to
    maxLen
    + JDK-8196100: javax/swing/text/JTextComponent/5074573/
    /bug5074573.java fails
    + JDK-8199646: JShell tests: jdk/jshell/
    /FailOverDirectExecutionControlTest.java failed with
    java.lang.UnsupportedOperationException
    + JDK-8206925: Support the certificate_authorities extension
    + JDK-8207160: ClassReader::adjustMethodParams can potentially
    return null if the args list is empty
    + JDK-8207247: AARCH64: Enable Minimal and Client VM builds
    + JDK-8207404: MulticastSocket tests failing on AIX
    + JDK-8207779: Method::is_valid_method() compares 'this' with
    NULL
    + JDK-8208061: runtime/LoadClass/TestResize.java fails with
    "Load factor too high" when running in CDS mode.
    + JDK-8209459: TestSHA512MultiBlockIntrinsics failed on AArch64
    + JDK-8210443: Migrate Locale matching tests to JDK Repo.
    + JDK-8213231: ThreadSnapshot::_threadObj can become stale
    + JDK-8213483: ARM32: runtime/ErrorHandling/
    /ShowRegistersOnAssertTest.java jtreg test fail
    + JDK-8213725: JShell NullPointerException due to class file
    with unexpected package
    + JDK-8213794: ARM32: disable TypeProfiling,
    CriticalJNINatives, Serviceablity tests for ARM32
    + JDK-8213845: ARM32: Interpreter doesn't call result handler
    after native calls
    + JDK-8214128: ARM32: wrong stack alignment on
    Deoptimization::unpack_frames
    + JDK-8214512: ARM32: Jtreg test compiler/c2/Test8062950.java
    fails on ARM
    + JDK-8214854: JDWP: Unforseen output truncation in logging
    + JDK-8214922: Add vectorization support for fmin/fmax
    + JDK-8215009: GCC 8 compilation error in libjli
    + JDK-8216184: CDS/appCDS tests failed on Windows due to long
    path to a classlist file
    + JDK-8216259: AArch64: Vectorize Adler32 intrinsics
    + JDK-8216314: SIGILL in CodeHeapState::print_names()
    + JDK-8217348: assert(thread-&gt;is_Java_thread()) failed: just
    checking
    + JDK-8217465: [REDO] - Optimize CodeHeap Analytics
    + JDK-8217561: X86: Add floating-point Math.min/max intrinsics
    + JDK-8217918: C2: -XX:+AggressiveUnboxing is broken
    + JDK-8218458: [TESTBUG] runtime/NMT/
    /CheckForProperDetailStackTrace.java fails with Expected
    stack trace missing from output
    + JDK-8219142: Remove unused JIMAGE_ResourcePath
    + JDK-8219586: CodeHeap State Analytics processes dead nmethods
    + JDK-8220074: Clean up GCC 8.3 errors in LittleCMS
    + JDK-8220407: compiler/intrinsics/math/
    /TestFpMinMaxIntrinsics.java timedout
    + JDK-8222302: [TESTBUG] test/hotspot/jtreg/compiler/intrinsics/
    /sha/cli/TestUseSHAOptionOnUnsupportedCPU.java fails on any
    other CPU
    + JDK-8222412: AARCH64: multiple instructions encoding issues
    + JDK-8223020: aarch64: expand minI_rReg and maxI_rReg patterns
    into separate instructions
    + JDK-8223444: Improve CodeHeap Free Space Management
    + JDK-8223504: Improve performance of forall loops by better
    inlining of "iterator()" methods
    + JDK-8223667: ASAN build broken
    + JDK-8225081: Remove Telia Company CA certificate expiring in
    April 2021
    + JDK-8225116: Test OwnedWindowsLeak.java intermittently fails
    + JDK-8225438: javax/net/ssl/TLSCommon/
    /TestSessionLocalPrincipal.java failed with Read timed out
    + JDK-8225756: [testbug] compiler/loopstripmining/
    /CheckLoopStripMining.java sets too short a
    SafepointTimeoutDelay
    + JDK-8226374: Restrict TLS signature schemes and named groups
    + JDK-8226627: assert(t-&gt;singleton()) failed: must be a constant
    + JDK-8226721: Missing intrinsics for Math.ceil, floor, rint
    + JDK-8227080: (fs) Files.newInputStream(...).skip(n) is slow
    + JDK-8227222: vmTestbase/jit/FloatingPoint/gen_math/Loops04/
    /Loops04.java failed XMM register should be 0-15
    + JDK-8227609: (fs) Files.newInputStream(...).skip(n) should
    allow skipping beyond file size
    + JDK-8230428: Cleanup dead CastIP node code in formssel.cpp
    + JDK-8231460: Performance issue (CodeHeap) with large free
    blocks
    + JDK-8231713: x86_32 build failures after JDK-8226721 (Missing
    intrinsics for Math.ceil, floor, rint)
    + JDK-8231841: AArch64: debug.cpp help() is missing an AArch64
    line for pns
    + JDK-8232084: HotSpot build failed with GCC 9.2.1
    + JDK-8232591: AArch64: Add missing match rules for smaddl,
    smsubl and smnegl
    + JDK-8233185: HttpServer.stop() blocks indefinitely when
    called on dispatch thread
    + JDK-8233787: Break cycle in vm_version* includes
    + JDK-8233948: AArch64: Incorrect mapping between OptoReg and
    VMReg for high 64 bits of Vector Register
    + JDK-8234355: Buffer overflow in jcmd GC.class_stats due to
    too many classes
    + JDK-8235368: Update BCEL to Version 6.4.1
    + JDK-8236859: WebSocket over authenticating proxy fails with
    NPE
    + JDK-8236992: AArch64: remove redundant load_klass in itable
    stub
    + JDK-8237743: test/langtools/jdk/jshell/
    /FailOverExecutionControlTest.java fails No
    ExecutionControlProvider with name 'nonExistent' and parameter
    keys: []
    + JDK-8237804: sun/security/mscapi tests fail with "Key pair
    not generated, alias &lt;nnnnnn&gt; already exists"
    + JDK-8238175: CTW: Class.getDeclaredMethods fails with
    assert(k-&gt;is_subclass_of(SystemDictionary::Throwable_klass()))
    failed: invalid exception class
    + JDK-8238567: SoftMainMixer.processAudioBuffers(): Wrong
    handling of stoppedMixers
    + JDK-8238812: assert(false) failed: bad AD file
    + JDK-8239312: [macos] javax/swing/JFrame/NSTexturedJFrame/
    /NSTexturedJFrame.java
    + JDK-8239386: handle ContendedPaddingWidth in
    vm_version_aarch64
    + JDK-8239536: Can't use 'java.util.List' object after
    importing 'java.awt.List'
    + JDK-8240487: Cleanup whitespace in .cc, .hh, .m, and .mm files
    + JDK-8240848: ArrayIndexOutOfBoundsException buf for
    TextCallbackHandler
    + JDK-8241082: Upgrade IANA Language Subtag Registry data to
    03-16-2020 version
    + JDK-8241087: Build failure with VS 2019 (16.5.0) due to C2039
    and C2873
    + JDK-8241101: [s390] jtreg test failure after JDK-8238696: not
    conformant features string
    + JDK-8241248: NullPointerException in
    sun.security.ssl.HKDF.extract(HKDF.java:93)
    + JDK-8241372: Several test failures due to
    javax.net.ssl.SSLException: Connection reset
    + JDK-8241475: AArch64: Add missing support for PopCountVI node
    + JDK-8241829: Cleanup the code for PrinterJob on windows
    + JDK-8241960: The SHA3 message digests impl of SUN provider
    are not thread safe after cloned
    + JDK-8242010: Upgrade IANA Language Subtag Registry to Version
    2020-04-01
    + JDK-8242429: Better implementation for sign extract
    + JDK-8242557: Add length limit for strings in PNGImageWriter
    + JDK-8242919: Paste locks up jshell
    + JDK-8243155: AArch64: Add support for SqrtVF
    + JDK-8243240: AArch64: Add support for MulVB
    + JDK-8243452: JFR: Could not create chunk in repository with
    over 200 recordings
    + JDK-8243559: Remove root certificates with 1024-bit keys
    + JDK-8243597: AArch64: Add support for integer vector abs
    + JDK-8244031: HttpClient should have more tests for HEAD
    requests
    + JDK-8244205: HTTP/2 tunnel connections through proxy may be
    reused regardless of which proxy is selected
    + JDK-8244847: Linux/PPC: runtime/CompressedOops/
    /CompressedClassPointers: smallHeapTest fails
    + JDK-8245511: G1 adaptive IHOP does not account for
    reclamation of humongous objects by young GC
    + JDK-8246274: G1 old gen allocation tracking is not in a
    separate class
    + JDK-8247354: [aarch64] PopFrame causes
    assert(oopDesc::is_oop(obj)) failed: not an oop
    + JDK-8247408: IdealGraph bit check expression canonicalization
    + JDK-8247432: Update IANA Language Subtag Registry to Version
    2020-09-29
    + JDK-8247438: JShell: When FailOverExecutionControlProvider
    fails the proximal cause is not shown
    + JDK-8247753: UIManager.getSytemLookAndFeelClassName() returns
    wrong value on Fedora 32
    + JDK-8248043: Need to eliminate excessive i2l conversions
    + JDK-8248411: [aarch64] Insufficient error handling when
    CodeBuffer is exhausted
    + JDK-8248568: compiler/c2/TestBit.java failed: test missing
    from stdout/stderr
    + JDK-8248870: AARCH64: I2L/L2I conversions can be skipped for
    masked positive values
    + JDK-8249142: java/awt/FontClass/CreateFont/DeleteFont.sh is
    unstable
    + JDK-8249189: AARCH64: more L2I conversions can be skipped
    + JDK-8249719: MethodHandle performance suffers from bad
    ResolvedMethodTable hash function
    + JDK-8249875: GCC 10 warnings -Wtype-limits with JFR code
    + JDK-8250635: MethodArityHistogram should use Compile_lock in
    favour of fancy checks
    + JDK-8250876: Fix issues with cross-compile on macos
    + JDK-8251031: Some vmTestbase/nsk/monitoring/RuntimeMXBean
    tests fail with hostnames starting from digits
    + JDK-8251525: AARCH64: Faster Math.signum(fp)
    + JDK-8252259: AArch64: Adjust default value of FLOATPRESSURE
    + JDK-8252311: AArch64: save two words in itable lookup stub
    + JDK-8252779: compiler/graalunit/HotspotTest.java failed after
    8251525
    + JDK-8252883: AccessDeniedException caused by delayed file
    deletion on Windows
    + JDK-8253167: ARM32 builds fail after JDK-8247910
    + JDK-8253572: [windows] CDS archive may fail to open with long
    file names
    + JDK-8253923: C2 doesn't always run loop opts for compilations
    that include loops
    + JDK-8253948: Memory leak in ImageFileReader
    + JDK-8254631: Better support ALPN byte wire values in SunJSSE
    + JDK-8254717: isAssignableFrom checks in
    KeyFactorySpi.engineGetKeySpec appear to be backwards
    + JDK-8255086: Update the root locale display names
    + JDK-8255625: AArch64: Implement Base64.encodeBlock
    accelerator/intrinsic
    + JDK-8255763: C2: OSR miscompilation caused by invalid memory
    instruction placement
    + JDK-8255992: JFR EventWriter does not use first string from
    StringPool with id 0
    + JDK-8256037: [TESTBUG] com/sun/jndi/dns/ConfigTests/
    /PortUnreachable.java fails due to the hard coded threshold
    is small
    + JDK-8256244: java/lang/ProcessHandle/PermissionTest.java
    fails with TestNG 7.1
    + JDK-8256287: [windows] add loop fuse to
    map_or_reserve_memory_aligned
    + JDK-8256523: Streamline Java SHA2 implementation
    + JDK-8257414: Drag n Drop target area is wrong on high DPI
    systems
    + JDK-8257569: Failure observed with
    JfrVirtualMemory::initialize
    + JDK-8257574: C2: "failed: parsing found no loops but there
    are some" assert failure
    + JDK-8257580: Bump update version for OpenJDK: jdk-11.0.12
    + JDK-8257604: JNI_ArgumentPusherVaArg leaks valist
    + JDK-8257621: JFR StringPool misses cached items across
    consecutive recordings
    + JDK-8257796: [TESTBUG]
    TestUseSHA512IntrinsicsOptionOnSupportedCPU.java fails
    on x86_32
    + JDK-8257822: C2 crashes with SIGFPE due to a division that
    floats above its zero check
    + JDK-8257828: SafeFetch may crash if invoked in non-JavaThreads
    + JDK-8257853: Remove dependencies on JNF's JNI utility
    functions in AWT and 2D code
    + JDK-8257858: [macOS]: Remove JNF dependency from
    libosxsecurity/KeystoreImpl.m
    + JDK-8257860: [macOS]: Remove JNF dependency from
    libosxkrb5/SCDynamicStoreConfig.m
    + JDK-8257988: Remove JNF dependency from
    libsaproc/MacosxDebuggerLocal.m
    + JDK-8258414: OldObjectSample events too expensive
    + JDK-8258505: [TESTBUG] TestDivZeroWithSplitIf.java fails due
    to missing UnlockDiagnosticVMOptions
    + JDK-8258753: StartTlsResponse.close() hangs due to
    synchronization issues
    + JDK-8259061: C2: assert(found) failed: memory-writing node is
    not placed in its original loop or an ancestor of it
    + JDK-8259227: C2 crashes with SIGFPE due to a division that
    floats above its zero check
    + JDK-8259232: Bad JNI lookup during printing
    + JDK-8259276: C2: Empty expression stack when reexecuting
    tableswitch/lookupswitch instructions after deoptimization
    + JDK-8259343: [macOS] Update JNI error handling in Cocoa code.
    + JDK-8259585: Accessible actions do not work on mac os x
    + JDK-8259651: [macOS] Replace JNF_COCOA_ENTER/EXIT macros
    + JDK-8259662: Don't wrap SocketExceptions into SSLExceptions
    in SSLSocketImpl
    + JDK-8259710: Inlining trace leaks memory
    + JDK-8259729: Missed JNFInstanceOf -&gt; IsInstanceOf conversion
    + JDK-8259777: Incorrect predication condition generated by ADLC
    + JDK-8259786: initialize last parameter of getpwuid_r
    + JDK-8259843: initialize dli_fname array before calling
    dll_address_to_library_name
    + JDK-8259869: [macOS] Remove desktop module dependencies on
    JNF Reference APIs
    + JDK-8259886: Improve SSL session cache performance and
    scalability
    + JDK-8259983: do not use uninitialized expand_ms value in
    G1CollectedHeap::expand_heap_after_young_collection
    + JDK-8260030: Improve stringStream buffer handling
    + JDK-8260236: better init AnnotationCollector _contended_group
    + JDK-8260255: C1: LoopInvariantCodeMotion constructor can
    leave some fields uninitialized
    + JDK-8260284: C2: assert(_base == Int) failed: Not an Int
    + JDK-8260380: Upgrade to LittleCMS 2.12
    + JDK-8260420: C2 compilation fails with assert(found_sfpt)
    failed: no node in loop that's not input to safepoint
    + JDK-8260426: awt debug_mem.c DMem_AllocateBlock might leak
    memory
    + JDK-8260432: allocateSpaceForGP in freetypeScaler.c might
    leak memory
    + JDK-8260616: Removing remaining JNF dependencies in the
    java.desktop module
    + JDK-8260653: Unreachable nodes keep speculative types alive
    + JDK-8260707: java/lang/instrument/PremainClass/
    /InheritAgent0100.java times out
    + JDK-8260925: HttpsURLConnection does not work  with other
    JSSE provider.
    + JDK-8260926: Trace resource exhausted events unconditionally
    + JDK-8261020: Wrong format parameter in
    create_emergency_chunk_path
    + JDK-8261027: AArch64: Support for LSE atomics C++ HotSpot code
    + JDK-8261167: print_process_memory_info add a close call after
    fopen
    + JDK-8261170: Upgrade to freetype 2.10.4
    + JDK-8261198: [macOS] Incorrect JNI parameters in number
    conversion in A11Y code
    + JDK-8261235: C1 compilation fails with
    assert(res-&gt;vreg_number() == index) failed: conversion check
    + JDK-8261261: The version extra fields needs to be overridable
    in jib-profiles.js
    + JDK-8261262: Kitchensink24HStress.java crashed with
    EXCEPTION_ACCESS_VIOLATION
    + JDK-8261354: SIGSEGV at MethodIteratorHost
    + JDK-8261355: No data buffering in SunPKCS11 Cipher encryption
    when the underlying mechanism has no padding
    + JDK-8261397: try catch Method failing to work when dividing
    an integer by 0
    + JDK-8261422: Adjust problematic String.format calls in
    jdk/internal/util/Preconditions.java outOfBoundsMessage
    + JDK-8261447: MethodInvocationCounters frequently run into
    overflow
    + JDK-8261481: Cannot read Kerberos settings in dynamic store
    on macOS Big Sur
    + JDK-8261505: Test test/hotspot/jtreg/gc/parallel/
    /TestDynShrinkHeap.java killed by Linux OOM Killer
    + JDK-8261601: free memory in early return in
    Java_sun_nio_ch_sctp_SctpChannelImpl_receive0
    + JDK-8261649: AArch64: Optimize LSE atomics in C++ code
    + JDK-8261730: C2 compilation fails with
    assert(store-&gt;find_edge(load) != -1) failed: missing
    precedence edge
    + JDK-8261752: Multiple GC test are missing memory requirements
    + JDK-8261791: (sctp) handleSendFailed in SctpChannelImpl.c
    potential leaks
    + JDK-8261812: C2 compilation fails with assert(!had_error)
    failed: bad dominance
    + JDK-8261914: IfNode::fold_compares_helper faces
    non-canonicalized bool when running JRuby JSON workload
    + JDK-8262093: java/util/concurrent/tck/JSR166TestCase.java
    failed "assert(false) failed: unexpected node"
    + JDK-8262110: DST starts from incorrect time in 2038
    + JDK-8262121: [11u] Redo 8244287: JFR: Methods samples have
    line number 0
    + JDK-8262163: Extend settings printout in jcmd VM.metaspace
    + JDK-8262295: C2: Out-of-Bounds Array Load from Clone Source
    + JDK-8262298: G1BarrierSetC2::step_over_gc_barrier fails with
    assert "bad barrier shape"
    + JDK-8262446: DragAndDrop hangs on Windows
    + JDK-8262461: handle wcstombsdmp return value correctly in
    unix awt_InputMethod.c
    + JDK-8262465: Very long compilation times and high memory
    consumption in C2 debug builds
    + JDK-8262726: AArch64: C1 StubAssembler::call_RT can corrupt
    stack
    + JDK-8262739: String inflation C2 intrinsic prevents insertion
    of anti-dependencies
    + JDK-8262829: Native crash in
    Win32PrintServiceLookup.getAllPrinterNames()
    + JDK-8262837: handle split_USE correctly
    + JDK-8262900: ToolBasicTest fails to access HTTP server it
    starts
    + JDK-8263260: [s390] Support latest hardware (z14 and z15)
    + JDK-8263311: Watch registry changes for remote printers
    update instead of polling
    + JDK-8263361: Incorrect arraycopy stub selected by C2 for SATB
    collectors
    + JDK-8263404: RsaPrivateKeySpec is always recognized as
    RSAPrivateCrtKeySpec in RSAKeyFactory.engineGetKeySpec
    + JDK-8263425: AArch64: two potential bugs in C1
    LIRGenerator::generate_address()
    + JDK-8263448: CTW: fatal error: meet not symmetric
    + JDK-8263504: Some OutputMachOpcodes fields are uninitialized
    + JDK-8263557: Possible NULL dereference in
    Arena::destruct_contents()
    + JDK-8263558: Possible NULL dereference in fast path arena
    free if ZapResourceArea is true
    + JDK-8263676: AArch64: one potential bug in C1
    LIRGenerator::generate_address()
    + JDK-8263729: [test] divert spurious output away from stream
    under test in ProcessBuilder Basic test
    + JDK-8263846: Bad JNI lookup getFocusOwner in accessibility
    code on Mac OS X
    + JDK-8264047: Duplicate global variable 'jvm' in libjavajpeg
    and libawt
    + JDK-8264096: slowdebug jvm crashes when StrInflatedCopy match
    rule is not supported
    + JDK-8264151: ciMethod::ensure_method_data() should return
    false is loading resulted in empty state
    + JDK-8264173: [s390] Improve Hardware Feature Detection And
    Reporting
    + JDK-8264190: Harden TLS interop tests
    + JDK-8264223: CodeHeap::verify fails extra_hops assertion in
    fastdebug test
    + JDK-8264328: Broken license in
    javax/swing/JComboBox/8072767/bug8072767.java
    + JDK-8264360: Loop strip mining verification fails with
    "should be on the backedge"
    + JDK-8264626: C1 should be able to inline excluded methods
    + JDK-8264640: CMS ParScanClosure misses a barrier
    + JDK-8264786: [macos] All Swing/AWT apps cause Allow
    Notifications prompt to appear when app is launched
    + JDK-8264821: DirectIOTest fails on a system with large block
    size
    + JDK-8264848: [macos] libjvm.dylib linker warning due to macOS
    version mismatch
    + JDK-8264923: PNGImageWriter.write_zTXt throws Exception with
    a typo
    + JDK-8264958: C2 compilation fails with assert "n is later
    than its clone"
    + JDK-8265099: Revert backport to 11u of 8236859: WebSocket
    over authenticating proxy fails with NPE
    + JDK-8265154: vinserti128 operand mix up for KNL platforms
    + JDK-8265239: Shenandoah: Shenandoah heap region count could
    be off by 1
    + JDK-8265417: Backport of JDK-8249672 breaks Solaris x86 build
    + JDK-8265421: java/lang/String/StringRepeat.java test is
    missing a memory requirement
    + JDK-8265462: Handle multiple slots in the NSS Internal Module
    from SunPKCS11's Secmod
    + JDK-8265537: x86 version string truncated after JDK-8249672
    11u backport
    + JDK-8265666: Enable AIX build platform to make external debug
    symbols
    + JDK-8265677: CMS: CardTableBarrierSet::write_ref_array_work()
    lacks storestore barrier
    + JDK-8265690: Use the latest Ubuntu base image version in
    Docker testing
    + JDK-8265718: Build failure after JDK-8258414 11u backport
    + JDK-8265750: Fatal error in safepoint.cpp after backport of
    8258414
    + JDK-8265784: [C2] Hoisting of DecodeN leaves MachTemp inputs
    behind
    + JDK-8265938: C2's conditional move optimization does not
    handle top Phi
    + JDK-8266220: keytool still prompt for store password on a
    password-less pkcs12 file if -storetype pkcs12 is specified
    + JDK-8266293: Key protection using PBEWithMD5AndDES fails with
    "java.security.InvalidAlgorithmParameterException: Salt must
    be 8 bytes long"
    + JDK-8266713: [AIX] Build failure after 11u backport of
    JDK-8247753
    + JDK-8266802: Shenandoah: Round up region size to page size
    unconditionally
    + JDK-8266892: avoid maybe-uninitialized gcc warnings on linux
    s390x
    + JDK-8266929: Unable to use algorithms from 3p providers
    + JDK-8267235: [macos_aarch64]
    InterpreterRuntime::throw_pending_exception messing up LR
    results in crash
    + JDK-8267561: Shenandoah: Reference processing not properly
    setup for outside of cycle degenerated GC
    + JDK-8267599: Revert the change to the default PKCS12
    macAlgorithm and macIterationCount props for 11u/8u/7u
    + JDK-8267641: [11u] 8227609 backport typo
    + JDK-8267721: Enable sun/security/pkcs11 tests for Amazon
    Linux 2 AArch64
    + JDK-8268678: LetsEncryptCA.java test fails as Let's Encrypt
    Authority X3 is retired</changelog>
  <changelog author="schwab@suse.de" date="1628078400">- riscv64-zero.patch: Add support for riscv64 (zero VM)</changelog>
  <changelog author="fstrba@suse.com" date="1629979200">- Added patch:
  * jdk11-glibc234.patch
    + fix build with glibc-2.34 (bsc#1189201)</changelog>
  <changelog author="fstrba@suse.com" date="1631534400">- Modified patch:
  * nss-security-provider.patch
    + revert recent changes making NSS provider the default one
    + fixes bsc#1190252</changelog>
  <changelog author="fstrba@suse.com" date="1631793600">- Added patch:
  * fips.patch
    + implement FIPS support in OpenJDK</changelog>
  <changelog author="fstrba@suse.com" date="1634817600">- Update to upstream tag jdk-11.0.13+8 (October 2021 CPU)
  * Security fixes
    + JDK-8163326, CVE-2021-35550, bsc#1191901: Update the default
    enabled cipher suites preference
    + JDK-8254967, CVE-2021-35565, bsc#1191909:
    com.sun.net.HttpsServer spins on TLS session close
    + JDK-8263314: Enhance XML Dsig modes
    + JDK-8265167, CVE-2021-35556, bsc#1191910: Richer Text Editors
    + JDK-8265574: Improve handling of sheets
    + JDK-8265580, CVE-2021-35559, bsc#1191911: Enhanced style for
    RTF kit
    + JDK-8265776: Improve Stream handling for SSL
    + JDK-8266097, CVE-2021-35561, bsc#1191912: Better hashing
    support
    + JDK-8266103: Better specified spec values
    + JDK-8266109: More Resilient Classloading
    + JDK-8266115: More Manifest Jar Loading
    + JDK-8266137, CVE-2021-35564, bsc#1191913: Improve Keystore
    integrity
    + JDK-8266689, CVE-2021-35567, bsc#1191903: More Constrained
    Delegation
    + JDK-8267086: ArrayIndexOutOfBoundsException in
    java.security.KeyFactory.generatePublic
    + JDK-8267712: Better LDAP reference processing
    + JDK-8267729, CVE-2021-35578, bsc#1191904: Improve TLS client
    handshaking
    + JDK-8267735, CVE-2021-35586, bsc#1191914: Better BMP support
    + JDK-8268193: Improve requests of certificates
    + JDK-8268199: Correct certificate requests
    + JDK-8268205: Enhance DTLS client handshake
    + JDK-8268506: More Manifest Digests
    + JDK-8269618, CVE-2021-35603, bsc#1191906: Better session
    identification
    + JDK-8269624: Enhance method selection support
    + JDK-8270398: Enhance canonicalization
    + JDK-8270404: Better canonicalization
  * Other changes
    + JDK-8024368: private methods are allocated vtable indices
    + JDK-8042902: Test java/net/Inet6Address/serialize/
    /Inet6AddressSerializationTest.java fails intermittently
    + JDK-8140466: ChaCha20 and Poly1305 TLS Cipher Suites
    + JDK-8157404: Unable to read certain PKCS12 keystores from
    SequenceInputStream
    + JDK-8158066: SourceDebugExtensionTest fails to rename file
    + JDK-8168304: Make all of DependencyContext_test available in
    product mode
    + JDK-8169246: java/net/DatagramSocket/ReportSocketClosed.java
    fails intermittently with BindException
    + JDK-8181313: SA: Remove libthread_db dependency on Linux
    + JDK-8193214: Incorrect annotations.without.processors
    warnings with JDK 9
    + JDK-8194230: jdk/internal/jrtfs/remote/
    /RemoteRuntimeImageTest.java fails with
    java.lang.NullPointerException
    + JDK-8196092: javax/swing/JComboBox/8032878/bug8032878.java
    fails
    + JDK-8199931: java/net/MulticastSocket/
    /UnreferencedMulticastSockets.java fails with "incorrect data
    received"
    + JDK-8206083: Make tools/javac/api/T6265137.java robust to JDK
    version changes
    + JDK-8206350: java/util/Locale/bcp47u/SystemPropertyTests.java
    failed on Mac 10.13 with zh_CN and zh_TW locales.
    + JDK-8207316: java/nio/channels/spi/SelectorProvider/
    /inheritedChannel/InheritedChannelTest.java failed
    + JDK-8208227: tools/jdeps/DotFileTest.java fails on Win-X64
    + JDK-8208363: test/jdk/java/lang/Package/
    /PackageFromManifest.java missing module dependencies
    declaration
    + JDK-8209380: ARM: cleanup maybe-uninitialized and reorder
    compiler warnings
    + JDK-8209768: Refactor java/util/prefs/CheckUserPrefsStorage.sh
    to plain java test
    + JDK-8209772: Refactor shell test java/util/ServiceLoader/
    /basic/basic.sh to java
    + JDK-8209773: Refactor shell test javax/naming/module/basic.sh
    to java
    + JDK-8209832: Refactor jdk/internal/reflect/Reflection/
    /GetCallerClassTest.sh to plain java test
    + JDK-8209930: Refactor java/util/zip/ZipFile/deletetempjar.sh
    to plain java test
    + JDK-8210406: Refactor java.util.PluggableLocale:i18n shell
    tests to plain java tests
    + JDK-8210407: Refactor java.util.Calendar:i18n shell tests to
    plain java tests
    + JDK-8210495: compiler crashes because of illegal signature in
    otherwise legal code
    + JDK-8210669: Some launcher tests assume a pre-JDK 9 run-time
    image layout
    + JDK-8210802: temp files left by tests in
    jdk/java/net/httpclient
    + JDK-8210819: Update the host name in CNameTest.java
    + JDK-8210908: Refactor java/util/prefs/PrefsSpi.sh to plain
    java test
    + JDK-8210934: Move sun/net/www/protocol/http/
    /GetErrorStream.java to OpenJDK
    + JDK-8210959: JShell fails and exits when statement throws an
    exception whose message contains a '%'.
    + JDK-8211055: Provide print to a file (PDF) feature even when
    printer was not connected
    + JDK-8211092: test/jdk/sun/net/www/http/HttpClient/
    /MultiThreadTest.java fails intermittently when cleaning up
    + JDK-8211296: Remove HotSpot deprecation warning suppression
    for Mac/clang
    + JDK-8211325: test/jdk/java/net/Socket/LingerTest.java fails
    with cleaning up
    + JDK-8212040: Compilation error due to wrong usage of
    NSPrintJobDispositionValue in mac10.12
    + JDK-8212695: Add explicit timeout to several HTTP Client tests
    + JDK-8212718: Refactor some annotation processor tests to
    better use collections
    + JDK-8213007: Update the link in test/jdk/sun/security/
    /provider/SecureRandom/DrbgCavp.java
    + JDK-8213137: Remove static initialization of monitor/mutex
    instances
    + JDK-8213235: java/nio/channels/SocketChannel/
    /AsyncCloseChannel.java fails with threads that didn't exit
    + JDK-8213409: Refactor sun.text.IntHashtable:i18n shell tests
    to plain java tests
    + JDK-8213576: Make test AsyncCloseChannel.java run in othervm
    + JDK-8213694: Test Timeout.java should run in othervm mode
    + JDK-8213718: [TEST] Wrong classname in vmTestbase/nsk/stress/
    /except/except002 and except003
    + JDK-8213922: fix ctw stand-alone build
    + JDK-8214195: Align stdout messages in
    test/jdk/java/math/BigInteger/PrimitiveConversionTests.java
    + JDK-8214520: [TEST_BUG] sun/security/mscapi/nonUniqueAliases/
    /NonUniqueAliases.java failed with incorrect jtreg tags order
    + JDK-8214937: sun/security/tools/jarsigner/warnings/
    /NoTimestampTest.java failed due to unexpected expiration date
    + JDK-8216532: tools/launcher/Test7029048.java fails (Solaris)
    + JDK-8217825: Verify @AfterTest is used correctly in WebSocket
    tests
    + JDK-8218145: block_if_requested is not proper inlined due to
    size
    + JDK-8219417: bump jtreg requiredVersion to b14
    + JDK-8219552: bump jtreg requiredVersion to b14 in
    test/jdk/sanity/client/
    + JDK-8219804: java/net/MulticastSocket/Promiscuous.java fails
    intermittently due to NumberFormatException
    + JDK-8220445: Support for side by side MSVC Toolset versions
    + JDK-8221988: add possibility to build with Visual Studio 2019
    + JDK-8222751: closed/test/jdk/sun/security/util/
    /DerIndefLenConverter/IndefBerPkcs12.java fail
    + JDK-8223050: JVMCI: findUniqueConcreteMethod() should not use
    Dependencies::find_unique_concrete_method() for non-virtual
    methods
    + JDK-8224853: CDS address sanitizer errors
    + JDK-8225082: Remove IdenTrust certificate that is expiring in
    September 2021
    + JDK-8225583: Examine the HttpResponse.BodySubscribers for
    null handling and multiple subscriptions
    + JDK-8225690: Multiple AttachListener threads can be created
    + JDK-8225790: Two NestedDialogs tests fail on Ubuntu
    + JDK-8226319: Add forgotten test/jdk/java/net/httpclient/
    /BodySubscribersTest.java
    + JDK-8226533: JVMCI: findUniqueConcreteMethod should handle
    statically bindable methods directly
    + JDK-8226602: Test convenience reactive primitives from
    java.net.http with RS TCK
    + JDK-8226683: Remove review suggestion from fix to 8219804
    + JDK-8227738: jvmti/DataDumpRequest/datadumpreq001 failed due
    to "exit code is 134"
    + JDK-8227766: CheckUnhandledOops is broken in MemAllocator
    + JDK-8227815: Minimal VM: set_state is not a member of
    AttachListener
    + JDK-8230674: Heap dumps should exclude dormant CDS archived
    objects of unloaded classes
    + JDK-8230808: Remove Access::equals()
    + JDK-8230841: Remove oopDesc::equals()
    + JDK-8231717: Improve performance of charset decoding when
    charset is always compactable
    + JDK-8232243: Wrong caret position in JTextPane on Windows
    with a screen resolution &gt; 100%
    + JDK-8232782: Shenandoah: streamline post-LRB CAS barrier
    (aarch64)
    + JDK-8233790: Forward output from heap dumper to jcmd/jmap
    + JDK-8233989: Create an IPv4 version of
    java/net/MulticastSocket/SetLoopbackMode.java
    + JDK-8234510: Remove file seeking requirement for writing a
    heap dump
    + JDK-8235211: serviceability/attach/
    /RemovingUnixDomainSocketTest.java fails with
    AttachNotSupportedException: Unable to open socket file
    + JDK-8235216: typo in test filename
    + JDK-8235866: bump jtreg requiredVersion to 4.2b16
    + JDK-8236111: narrow allowSmartActionArgs disabling
    + JDK-8236413: AbstractConnectTimeout should tolerate both
    NoRouteToHostException and UnresolvedAddressException
    + JDK-8236671: NullPointerException in JKS keystore
    + JDK-8238930: problem list compiler/c2/Test8004741.java
    + JDK-8238943: switch to jtreg 5.0
    + JDK-8240555: Using env of JAVA_TOOL_OPTIONS and _JAVA_OPTIONS
    breaks QuietOption.java test
    + JDK-8240983: Incorrect copyright header in Apache Santuario
    2.1.3 files
    + JDK-8241336: Some java.net tests failed with
    NoRouteToHostException on MacOS with special network
    configuration
    + JDK-8241353: NPE in ToolProvider.getSystemJavaCompiler
    + JDK-8241768: git needs .gitattributes
    + JDK-8242882: opening jar file with large manifest might throw
    NegativeArraySizeException
    + JDK-8244973: serviceability/attach/
    /RemovingUnixDomainSocketTest.java fails "stderr was not
    empty"
    + JDK-8245134: test/lib/jdk/test/lib/security/
    /KeyStoreUtils.java should allow to specify aliases
    + JDK-8246261: TCKLocalTime.java failed due to "AssertionError:
    expected [18:14:22] but found [18:14:23]"
    + JDK-8246387: switch to jtreg 5.1
    + JDK-8247421: [TESTBUG] ReturnBlobToWrongHeapTest.java failed
    allocating blob
    + JDK-8247469: getSystemCpuLoad() returns -1 on linux when some
    offline cpus are present and cpusets.effective_cpus is not
    available
    + JDK-8248352: [TEST_BUG] Test test/jdk/java/awt/font/
    /TextLayout/ArabicDiacriticTest.java can leave frame open
    + JDK-8248403: AArch64: Remove uses of kernel integer types
    + JDK-8248414: AArch64: Remove uses of long and unsigned long
    ints
    + JDK-8248657: Windows: strengthening in ThreadCritical
    regarding memory model
    + JDK-8248666: AArch64: Use THREAD_LOCAL instead of __thread
    + JDK-8248668: AArch64: Avoid MIN/MAX macros when using MSVC
    + JDK-8248671: AArch64: Remove unused variables
    + JDK-8248682: AArch64: Use ATTRIBUTE_ALIGNED helper
    + JDK-8248816: C1: Fix signature conflict in
    LIRGenerator::strength_reduce_multiply
    + JDK-8249095: tools/javac/launcher/SourceLauncherTest.java
    fails on Windows
    + JDK-8249548: backward focus traversal gets stuck in button
    group
    + JDK-8249773: Upgrade ReceiveISA.java test to be resilient to
    failure due to stray packets and interference
    + JDK-8249897: jdk/javadoc/tool/LangVers.java uses @ignore w/o
    bug-id
    + JDK-8249898: jdk/javadoc/tool/6176978/T6176978.java uses
    @ignore w/o bug-id
    + JDK-8249899: jdk/javadoc/tool/InlineTagsWithBraces.java uses
    @ignore w/o bug-id
    + JDK-8250588: Shenandoah: LRB needs to save/restore fp
    registers for runtime call
    + JDK-8250824: AArch64: follow up for JDK-8248414
    + JDK-8251166: Add automated testcases for changes done in
    JDK-8214112
    + JDK-8251252: Add automated testcase for fix done in
    JDK-8214253
    + JDK-8251254: Add automated test for fix done in JDK-8218472
    + JDK-8251361: Potential race between Logger configuration and
    GCs in HttpURLConWithProxy test
    + JDK-8251549: Update docs on building for Git
    + JDK-8251945: SIGSEGV in
    PackageEntry::purge_qualified_exports()
    + JDK-8252194: Add automated test for fix done in JDK-8218469
    + JDK-8252648: Shenandoah: name gang tasks consistently
    + JDK-8252825: Add automated test for fix done in JDK-8218479
    + JDK-8252853: AArch64: gc/shenandoah/TestVerifyJCStress.java
    fails intermittently with C1
    + JDK-8252857: AArch64: Shenandoah C1 CAS is not sequentially
    consistent
    + JDK-8253048: AArch64: When CallLeaf, no need to preserve
    callee-saved registers in caller
    + JDK-8253424: Add support for running pre-submit testing using
    GitHub Actions
    + JDK-8253631: Remove unimplemented CompileBroker methods after
    JEP-165
    + JDK-8253865: Pre-submit testing using GitHub Actions does not
    detect failures reliably
    + JDK-8253899: Make IsClassUnloadingEnabled signature match
    specification
    + JDK-8254024: Enhance native libs for AWT and Swing to work
    with GraalVM Native Image
    + JDK-8254054: Pre-submit testing using GitHub Actions should
    not use the deprecated set-env command
    + JDK-8254173: Add Zero, Minimal hotspot targets to submit
    workflow
    + JDK-8254175: Build no-pch configuration in debug mode for
    submit checks
    + JDK-8254244: Some code emitted by TemplateTable::branch is
    unused when running TieredCompilation
    + JDK-8254270: linux 32 bit build doesn't compile
    libjdwp/log_messages.c
    + JDK-8254282: Add Linux x86_32 builds to submit workflow
    + JDK-8254850: Update terminology in java.awt.GridBagLayout
    source code comments
    + JDK-8255255: Update Apache Santuario (XML Signature) to
    version 2.2.1
    + JDK-8255305: Add Linux x86_32 tier1 to submit workflow
    + JDK-8255352: Archive important test outputs in submit workflow
    + JDK-8255373: Submit workflow artifact name is always
    "test-results_.zip"
    + JDK-8255452: Doing GC during JVMTI MethodExit event posting
    breaks return oop
    + JDK-8255718: Zero: VM should know it runs in interpreter-only
    mode
    + JDK-8255790: GTKL&amp;F: Java 16 crashes on initialising GTKL&amp;F
    on Manjaro Linux
    + JDK-8255810: Zero: build fails without JVMTI
    + JDK-8255895: Submit workflow artifacts miss hs_errs/replays
    due to ZIP include mismatch
    + JDK-8256127: Add cross-compiled foreign architectures builds
    to submit workflow
    + JDK-8256215: Shenandoah: re-organize saving/restoring machine
    state in assembler code
    + JDK-8256267: Relax compiler/floatingpoint/NaNTest.java for
    x86_32 and lower -XX:+UseSSE
    + JDK-8256277: Github Action build on macOS should define OS
    and Xcode versions
    + JDK-8256354: Github Action build on Windows should define OS
    and MSVC versions
    + JDK-8256393: Github Actions build on Linux should define OS
    and GCC versions
    + JDK-8256414: add optimized build to submit workflow
    + JDK-8256747: GitHub Actions: decouple the hotspot build-only
    jobs from Linux x64 testing
    + JDK-8257056: Submit workflow should apt-get update to avoid
    package installation errors
    + JDK-8257148: Remove obsolete code in AWTView.m
    + JDK-8257497: Update keytool to create AKID from the SKID of
    the issuing certificate as specified by RFC 5280
    + JDK-8257620: Do not use objc_msgSend_stret to get macOS
    version
    + JDK-8257913: Add more known library locations to simplify
    Linux cross-compilation
    + JDK-8258703: Incorrect 512-bit vector registers restore on
    x86_32
    + JDK-8259338: Add expiry exception for identrustdstx3 alias to
    VerifyCACerts.java test
    + JDK-8259535: ECDSA SignatureValue do not always have the
    specified length
    + JDK-8259679: GitHub actions should use MSVC 14.28
    + JDK-8259924: GitHub actions fail on Linux x86_32 with "Could
    not configure libc6:i386"
    + JDK-8260460: GitHub actions still fail on Linux x86_32 with
    "Could not configure libc6:i386"
    + JDK-8260589: Crash in JfrTraceIdLoadBarrier::load(_jclass*)
    + JDK-8260923: Add more tests for SSLSocket input/output
    shutdown
    + JDK-8261072: AArch64: Fix MacroAssembler::get_thread
    convention
    + JDK-8261147: C2: Node is wrongly marked as reduction
    resulting in a wrong execution due to wrong vector instructions
    + JDK-8261238: NMT should not limit baselining by size threshold
    + JDK-8261496: Shenandoah: reconsider pacing updates memory
    ordering
    + JDK-8261652: Remove some dead comments from os_bsd_x86
    + JDK-8261846: [JVMCI] c2v_iterateFrames can get out of sync
    with the StackFrameStream
    + JDK-8262000: jdk/jfr/event/gc/detailed/
    /TestPromotionFailedEventWithParallelScavenge.java failed with
    "OutOfMemoryError: Java heap space"
    + JDK-8262017: C2: assert(n != __null) failed: Bad immediate
    dominator info.
    + JDK-8262392: Update Mesa 3-D Headers to version 21.0.3
    + JDK-8262409: sun/security/ssl/SSLSocketImpl/
    /SSLSocketImplThrowsWrongExceptions. SSL test failures caused
    by java failed with "Server reported the wrong exception"
    + JDK-8262470: Printed GlyphVector outline with low DPI has bad
    quality on Windows
    + JDK-8262862: Harden tests sun/security/x509/URICertStore/
    /ExtensionsWithLDAP.java and krb5/canonicalize/Test.java
    + JDK-8263136: C4530 was reported from VS 2019 at access bridge
    + JDK-8263227: C2: inconsistent spilling due to dead nodes in
    exception block
    + JDK-8263382: java/util/logging/ParentLoggersTest.java failed
    with "checkLoggers: getLoggerNames() returned unexpected
    loggers"
    + JDK-8263407: SPARC64 detection fails on Athena (SPARC64-X)
    + JDK-8263432: javac may report an invalid package/class clash
    on case insensitive filesystems
    + JDK-8263490: [macos] Crash occurs on JPasswordField with
    activated InputMethod
    + JDK-8263531: Remove unused buffer int
    + JDK-8263667: Avoid running GitHub actions on branches named
    pr/*
    + JDK-8263776: [JVMCI] add helper to perform Java upcalls
    + JDK-8264016: [JVMCI] add some thread local fields for use by
    JVMCI
    + JDK-8264752: SIGFPE crash with option
    FlightRecorderOptions:threadbuffersize=30M
    + JDK-8265132: C2 compilation fails with assert "missing
    precedence edge"
    + JDK-8265231: (fc) ReadDirect and WriteDirect tests fail after
    fix for JDK-8264821
    + JDK-8265335: Epsilon: Minor typo in EpsilonElasticTLABDecay
    description
    + JDK-8265756: AArch64: initialize memory allocated for locals
    according to Windows AArch64 stack page growth requirement in
    template interpreter
    + JDK-8265761: Font with missed font family name is not
    properly printed on Windows
    + JDK-8265773: incorrect jdeps message "jdk8internals" to
    describe a removed JDK internal API
    + JDK-8265836: OperatingSystemImpl.getCpuLoad() returns
    incorrect CPU load inside a container
    + JDK-8266018: Shenandoah: fix an incorrect assert
    + JDK-8266206: Build failure after JDK-8264752 with older GCCs
    + JDK-8266248: Compilation failure in
    PLATFORM_API_MacOSX_MidiUtils.c with Xcode 12.5
    + JDK-8266288: assert root method not found in
    witnessed_reabstraction_in_supers is too strong
    + JDK-8266404: Fatal error report generated with
  - XX:+CrashOnOutOfMemoryError should not contain suggestion to
    submit a bug report
    + JDK-8266480: Implicit null check optimization does not update
    control of hoisted memory operation
    + JDK-8266615: C2 incorrectly folds subtype checks involving an
    interface array
    + JDK-8266642: Improve ResolvedMethodTable hash function
    + JDK-8266749: AArch64: Backtracing broken on PAC enabled
    systems
    + JDK-8266761: AssertionError in
    sun.net.httpserver.ServerImpl.responseCompleted
    + JDK-8266813: Shenandoah: Use shorter instruction sequence for
    checking if marking in progress
    + JDK-8267042: bug in monitor locking/unlocking on ARM32 C1 due
    to uninitialized BasicObjectLock::_displaced_header
    + JDK-8267348: Rewrite gc/epsilon/TestClasses.java to use
    Metaspace with less classes
    + JDK-8267396: Avoid recording "pc" in unhandled oops detector
    for better performance
    + JDK-8267399: C2: java/text/Normalizer/ConformanceTest.java
    test failed with assertion
    + JDK-8267424: CTW: C1 fails with "State must not be null"
    + JDK-8267459: Pasting Unicode characters into JShell does not
    work.
    + JDK-8267625: AARCH64: typo in LIR_Assembler::emit_profile_type
    + JDK-8267666: Add option to jcmd GC.heap_dump to use existing
    file
    + JDK-8267695: Bump update version for OpenJDK: jdk-11.0.13
    + JDK-8267751: (test) jtreg.SkippedException has no serial
    VersionUID
    + JDK-8267773: PhaseStringOpts::int_stringSize doesn't handle
    min_jint correctly
    + JDK-8268103: JNI functions incorrectly return a double after
    JDK-8265836
    + JDK-8268127: Shenandoah: Heap size may be too small for
    region to align to large page size
    + JDK-8268261: C2: assert(n != __null) failed: Bad immediate
    dominator info.
    + JDK-8268347: C2: nested locks optimization may create
    unbalanced monitor enter/exit code
    + JDK-8268360: Missing check for infinite loop during node
    placement
    + JDK-8268362: [REDO] C2 crash when compile negative
    Arrays.copyOf length after loop
    + JDK-8268366: Incorrect calculation of has_fpu_registers in C1
    linear scan
    + JDK-8268369: SIGSEGV in PhaseCFG::implicit_null_check due to
    missing null check
    + JDK-8268417: Add test from JDK-8268360
    + JDK-8268427: Improve AlgorithmConstraints:checkAlgorithm
    performance
    + JDK-8268617: [11u REDO] - WebSocket over authenticating proxy
    fails with NPE
    + JDK-8268620: InfiniteLoopException test may fail on x86
    platforms
    + JDK-8268635: Corrupt oop in ClassLoaderData
    + JDK-8268699: Shenandoah: Add test for JDK-8268127
    + JDK-8268771: javadoc -notimestamp option does not work on
    index.html
    + JDK-8268775: Password is being converted to String in
    AccessibleJPasswordField
    + JDK-8268776: Test `ADatagramSocket.java` missing /othervm
    from @run tag
    + JDK-8268965: TCP Connection Reset when connecting simple
    socket to SSL server
    + JDK-8269304: Regression ~5% in 2005 in b27
    + JDK-8269415: [11u] Remove ea from
    DEFAULT_PROMOTED_VERSION_PRE in OpenJDK 11u
    + JDK-8269478: Shenandoah: gc/shenandoah/mxbeans tests should
    be more resilient
    + JDK-8269529: javax/swing/reliability/
    /HangDuringStaticInitialization.java fails in Windows debug
    build
    + JDK-8269594: assert(_handle_mark_nesting &gt; 1) failed: memory
    leak: allocating handle outside HandleMark
    + JDK-8269614: [s390] Interpreter checks wrong bit for slow
    path instance allocation
    + JDK-8269650: Optimize gc-locker in
    [Get|Release]StringCritical for latin string
    + JDK-8269661: JNI_GetStringCritical does not lock char array
    + JDK-8269668: [aarch64] java.library.path not including
    /usr/lib64
    + JDK-8269763: The JEditorPane is blank after JDK-8265167
    + JDK-8269795: C2: Out of bounds array load floats above its
    range check in loop peeling resulting in SEGV
    + JDK-8269847: JDK-8269594 backport breaks 11u builds
    + JDK-8269850: Most JDK releases report macOS version 12 as
    10.16 instead of 12.0
    + JDK-8269851: OperatingSystemMXBean getProcessCpuLoad reports
    incorrect process cpu usage in containers
    + JDK-8269882: stack-use-after-scope in NewObjectA
    + JDK-8269934: RunThese24H.java failed with
    EXCEPTION_ACCESS_VIOLATION in
    java_lang_Thread::get_thread_status
    + JDK-8270096: Shenandoah: Optimize gc/shenandoah/
    /TestRefprocSanity.java for interpreter mode
    + JDK-8270137: Kerberos Credential Retrieval from Cache not
    Working in Cross-Realm Setup
    + JDK-8270184: [TESTBUG] Add coverage for jvmci
    ResolvedJavaType.toJavaName() for lambdas
    + JDK-8270196: [11u] [JVMCI] JavaType.toJavaName() returns
    incorrect type name for lambdas
    + JDK-8270556: Exclude security/infra/java/security/cert/
    /CertPathValidator/certification/LetsEncryptCA
    + JDK-8270893: IndexOutOfBoundsException while reading large
    TIFF file
    + JDK-8272078: Wrong Checksums in Temurin BootJDK dependencies
    + JDK-8272124: Cgroup v1 initialization causes
    NullPointerException when cgroup path contains colon
    + JDK-8272131: PhaseMacroExpand::generate_slow_arraycopy crash
    when clone null CallProjections.fallthrough_ioproj
    + JDK-8272197: Update 11u GHA workflow with Shenandoah
    configurations
    + JDK-8272332: --with-harfbuzz=system doesn't add -lharfbuzz
    after JDK-8255790
    + JDK-8272472: StackGuardPages test doesn't build with glibc
    2.34
    + JDK-8272602: [macos] not all KEY_PRESSED events sent when
    control modifier is used
    + JDK-8272628: Problemlist gc/stress/gcbasher/
    /TestGCBasherWithCMS.java for x86_32
    + JDK-8272700: [macos] Build failure with Xcode 13.0 after
    JDK-8264848
    + JDK-8272772: Shenandoah: compiler/c2/aarch64/
    /TestVolatilesShenandoah.java fails in 11u
    + JDK-8273939: Backport of 8248414 to JDK11 breaks
    MacroAssembler::adrp
- Remove the unneeded icedtea-sound provider
- Removed patches:
  * icedtea-sound-1.0.1-jdk9.patch
  * icedtea-sound-soundproperties.patch
    + not needed since the icedtea-sound provider is removed
  * jdk11-glibc234.patch
    + integrated upstream</changelog>
  <changelog author="fstrba@suse.com" date="1635940800">- Modified patches:
  * system-crypto-policy.patch
    + rediff to changed context
  * fips.patch
    + Allow plain key import in fips mode unless
    com.suse.fips.plainKeySupport is set to false</changelog>
  <changelog author="fstrba@suse.com" date="1636113600">- Modified patch:
  * fips.patch
    + return in native code after generating java.io.IOException</changelog>
</package>
<package pkgid="97f74027db46e27343e9fd55f9073e7292ce87cbb58f455aaa45c817595ef71d" name="java-11-openjdk-accessibility" arch="ppc64le">
  <version epoch="0" ver="11.0.13.0" rel="3.68.1"/>
  <changelog author="fstrba@suse.com" date="1586952000">- The pack200 and unpack200 alternatives should be slaves of java
  and not of javac, since they are part of JRE.</changelog>
  <changelog author="fstrba@suse.com" date="1587470400">- Update to upstream tag jdk-11.0.7+10 (April 2020 CPU,
  bsc#1169511)
  * Security fixes:
    + S8223898, CVE-2020-2754: Forward references to Nashorn
    + S8223904, CVE-2020-2755: Improve Nashorn matching
    + S8224541, CVE-2020-2756: Better mapping of serial ENUMs
    + S8224549, CVE-2020-2757: Less Blocking Array Queues
    + S8225603: Enhancement for big integers
    + S8226346: Build better binary builders
    + S8227467: Better class method invocations
    + S8227542: Manifest improved jar headers
    + S8229733: TLS message handling improvements
    + S8231415, CVE-2020-2773: Better signatures in XML
    + S8231785: Improved socket permissions
    + S8232424, CVE-2020-2778: More constrained algorithms
    + S8232581, CVE-2020-2767: Improve TLS verification
    + S8233250: Better X11 rendering
    + S8233410: Better Build Scripting
    + S8234027: Better JCEKS key support
    + S8234408, CVE-2020-2781: Improve TLS session handling
    + S8234825, CVE-2020-2800: Better Headings for HTTP Servers
    + S8234841, CVE-2020-2803: Enhance buffering of byte buffers
    + S8235274, CVE-2020-2805: Enhance typing of methods
    + S8235691, CVE-2020-2816: Enhance TLS connectivity
    + S8236201, CVE-2020-2830: Better Scanner conversions
    + S8238960: linux-i586 builds are inconsistent as the newly
    built jdk is not able to reserve enough space for object heap
  * Other changes:
    + S4919790: Errors in alert ssl message does not reflect the
    actual certificate status
    + S4949105: Access Bridge lacks html tags parsing
    + S7092821: java.security.Provider.getService() is synchronized
    and became scalability bottleneck
    + S7143743: Potential memory leak with zip provider
    + S8005819: Support cross-realm MSSFU
    + S8042383: [TEST_BUG] Test javax/swing/plaf/basic/BasicMenuUI/
    /4983388/bug4983388.java fails with shortcuts on menus do not
    work
    + S8068184: Fix for JDK-8032832 caused a deadlock
    + S8145845: [AOT] NullPointerException in
    compiler/whitebox/GetCodeHeapEntriesTest.java
    + S8152988: [AOT] Update test batch definitions to include
    aot-ed java.base module mode into hs-comp testing
    + S8160926: FLAGS_COMPILER_CHECK_ARGUMENTS doesn't handle
    cross-compilation
    + S8163083: SocketListeningConnector does not allow invocations
    with port 0
    + S8163251: Hard coded loop limit prevents reading of smart
    card data greater than 8k
    + S8167276: jvmci/compilerToVM/MaterializeVirtualObjectTest.java
    fails with -XX:-EliminateAllocations
    + S8169718: nsk/jdb/locals/locals002: ERROR: Cannot find
    boolVar with expected value: false
    + S8176556:
    java/awt/dnd/ImageTransferTest/ImageTransferTest.java fails
    for JFIF
    + S8178798: Two compiler/aot/verification/vmflags tests fail by
    timeout with UseAVX=3
    + S8183107: PKCS11 regression regarding checkKeySize
    + S8185005: Improve performance of
    ThreadMXBean.getThreadInfo(long ids[], int maxDepth)
    + S8189633: Missing -Xcheck:jni checking for DeleteWeakGlobalRef
    + S8189861: Refactor CacheFind
    + S8193042: NativeLookup::lookup_critical_entry() should only
    load shared library once
    + S8193596: java/net/DatagramPacket/ReuseBuf.java failed due to
    timeout
    + S8194944: Regression automated test 'open/test/jdk/javax/
    /swing/JInternalFrame/8145896/TestJInternalFrameMaximize.java'
    fails
    + S8196467: javax/swing/JInternalFrame/Test6325652.java fails
    + S8196969: JTreg Failure: serviceability/sa/ClhsdbJstack.java
    causes NPE
    + S8198321: javax/swing/JEditorPane/5076514/bug5076514.java
    fails
    + S8198398: Test javax/swing/JColorChooser/Test6199676.java
    fails in mach5
    + S8199072: Test javax/swing/GroupLayout/6613904/
    /bug6613904.java is unstable
    + S8200432: javadoc fails with ClassCastException on {@link
    byte[]}
    + S8201349: build broken when configured with
  - -with-zlib=bundled on gcc 7.3
    + S8201355: Avoid native memory allocation in
    sun.security.mscapi.PRNG.generateSeed
    + S8201513: nsk/jvmti/IterateThroughHeap/filter-* are broken
    + S8203364: Some serviceability/sa/ tests intermittently fail
    with java.io.IOException: LingeredApp terminated with non-zero
    exit code 3
    + S8203687: javax/net/ssl/compatibility/Compatibility.java
    supports TLS 1.3
    + S8203904: javax/swing/JSplitPane/4816114/bug4816114.java: The
    divider location is wrong
    + S8203911: Test runtime/modules/getModuleJNI/GetModule fails
    with -Xcheck:jni
    + S8204525: [TESTBUG] runtime/NMT/MallocStressTest.java ran out
    of java heap
    + S8204529: gc/TestAllocateHeapAtMultiple.java fail with Agent
    7 timed out
    + S8204551: Event descriptions are truncated in logs
    + S8206963: [AOT] bug with multiple class loaders
    + S8207367: 10 vmTestbase/nsk/jdi tests timed out when running
    with jtreg
    + S8207832: serviceability/sa/ClhsdbCDSCore.java failed with
    "Couldn't find core file location"
    + S8207938: At step6,Click Add button,case failed automatically.
    + S8208157: requires.VMProps throws NPE for missing properties
    in "release" file
    + S8208379: compiler/jvmci/events/
    /JvmciNotifyInstallEventTest.java failed with "Got unexpected
    event count after 2nd install attempt: expected 9 to equal 2"
    + S8208658: Make CDS archived heap regions usable even if
    compressed oop encoding has changed
    + S8208715: Conversion of milliseconds to nanoseconds in
    UNIXProcess contains bug
    + S8209361: [AOT] Unexpected number of references for
    JVMTI_HEAP_REFERENCE_CONSTANT_POOL [111--&gt;111]: 0 (expected
    at least 1)
    + S8209385: CDS runtime classpath checking is too strict when
    only classes from the system modules are archived
    + S8209389: SIGSEGV in WalkOopAndArchiveClosure::do_oop_work.
    + S8209418: Synchronize test/jdk/sanity/client/lib/jemmy with
    code-tools/jemmy/v2
    + S8209494: Create a test for SwingSet InternalFrameDemo
    + S8209499: Create test for SwingSet EditorPaneDemo
    + S8209574: [AOT] breakpoint events are generated in different
    threads does not meet expected count
    + S8209686: cleanup arguments to PhaseIdealLoop() constructor
    + S8209789: Synchronize test/jdk/sanity/client/lib/jemmy with
    code-tools/jemmy/v2
    + S8209802: Garbage collectors should register JFR types
    themselves to avoid build errors.
    + S8209807: improve handling exception in requires.VMProps
    + S8209817: stack is executable when building with Clang on
    Linux
    + S8209824: Improve the code coverage for ThreadLocal
    + S8209826: Undefined reference to os::write after JDK-8209657
    (filemap.hpp cleanup)
    + S8209850: Allow NamedThreads to use GlobalCounter critical
    sections
    + S8209976: Improve iteration over non-JavaThreads
    + S8209993: Create a test for SwingSet3 ToolTipDemo
    + S8210024: JFR calls virtual is_Java_thread from ~Thread()
    + S8210052: Enable testing for all the available look and feels
    in SwingSet3 demo tests
    + S8210055: Enable different look and feel tests in SwingSet3
    demo tests
    + S8210057: Enable different look and feels in SwingSet3 demo
    test InternalFrameDemoTest
    + S8210058: Algorithmic Italic font leans opposite angle in
    Printing
    + S8210220: [AOT] jdwp test cases are failing with error #
    ERROR: TEST FAILED: Cought IOException while receiving event
    packet
    + S8210289: ArchivedKlassSubGraphInfoRecord is incomplete
    + S8210459: Add support for generating compile_commands.json
    + S8210476: sun/security/mscapi/PrngSlow.java fails with Still
    too slow
    + S8210512: [Testbug] vmTestbase/nsk/jdi/ObjectReference/
    /referringObjects/referringObjects002/referringObjects002.java
    fails with unexpected size of
    ClassLoaderReference.referringObjects
    + S8210523: runtime/appcds/cacheObject/DifferentHeapSizes.java
    crash
    + S8210632: Add key exchange algorithm to
    javax/net/ssl/TLSCommon/CipherSuite.java
    + S8210699: Problem list tests which times out in Xcomp mode
    + S8210793: [JVMCI] AllocateCompileIdTest.java failed to find
    DiagnosticCommand.class
    + S8210910: Create test for FileChooserDemo
    + S8210994: Create test for SwingSet3 FrameDemo
    + S8211139: Increase timeout value in all tests under
    jdk/sanity/client/SwingSet/src
    + S8211160: Handle different look and feels in
    JInternalFrameOperator
    + S8211211: vmTestbase/metaspace/stressDictionary/
    /StressDictionary.java timeout
    + S8211322: Reduce the timeout of tooltip in SwingSet2DemoTest
    + S8211443: Enable different look and feels in SwingSet3 demo
    test SplitPaneDemoTest
    + S8211703: JInternalFrame : java.lang.AssertionError: cannot
    find the internal frame
    + S8211781: re-building fails after changing Graal sources
    + S8212897: Some improvements in the EditorPaneDemotest
    + S8212903: [TestBug] Tests test/jdk/javax/swing/LookAndFeel/
    /8145547/DemandGTK2.sh and DemandGTK3.sh fail on Ubuntu 18.04
    LTS
    + S8213009: Refactoring existing SunMSCAPI classes
    + S8213010: Supporting keys created with certmgr.exe
    + S8213168: Enable different look and feel tests in SwingSet3
    demo test FileChooserDemoTest
    + S8213348: jdk.internal.vm.compiler.management service
    providers missing in module descriptor
    + S8213906: Update arm devkits with libXrandr headers
    + S8213908: AssertionError in DeferredAttr at setOverloadKind
    + S8214124: [TESTBUG] Bugs in runtime/NMT/MallocStressTest.java
    + S8214344: C2: assert(con.basic_type() != T_ILLEGAL) failed:
    elembt=byte; loadbt=void; unsigned=0
    + S8214345: infinite recursion while checking super class
    + S8214471: Enable different look and feel tests in SwingSet3
    demo test ToolTipDemoTest
    + S8214534: Setting of THIS_FILE in the build is broken
    + S8214557: Filter out VM flags which don't affect AOT code
    generation
    + S8214578: [macos] Problem with backslashes on macOS/JIS
    keyboard: Java ignores system settings
    + S8214840: runtime/NMT/MallocStressTest.java timed out
    + S8214850: Rename vm_operations.?pp files to vmOperations.?pp
    files
    + S8214904: Test8004741.java failed due to "Too few ThreadDeath
    hits; expected at least 6 but saw only 5"
    + S8215322: add @file support to jaotc
    + S8215355: Object monitor deadlock with no threads holding the
    monitor (using jemalloc 5.1)
    + S8215396: JTabbedPane preferred size calculation is wrong for
    SCROLL_TAB_LAYOUT
    + S8216180: [AOT] compiler/intrinsics/bigInteger/TestMulAdd.java
    crashed with AOT enabled
    + S8216353: Use utility APIs introduced in org/netbeans/jemmy/
    /util/LookAndFeel class in client sanity test cases
    + S8216354: Syntax error in toolchain_windows.m4
    + S8216472: (se) Stack overflow during selection operation
    leads to crash (win)
    + S8216535: tools/jimage/JImageExtractTest.java timed out
    + S8217235: Create automated test for SwingSet
    ColorChooserDemoTest
    + S8217297: Add support for multiple look and feel for SwingSet
    SliderDemoTest
    + S8217338: [Containers] Improve systemd slice memory limit
    support
    + S8217613: [AOT] TEST_OPTS_AOT_MODULES doesn't work on mac
    + S8217634: RunTest documentation and usability update
    + S8217717: ZGC: Broken oop map in C1 load barrier stub
    + S8217728: Speed up incremental rerun of "make hotspot"
    + S8218268: Javac treats Manifest Class-Path entries as Paths
    instead of URLs
    + S8218662: Allow 204 responses with Content-Length:0
    + S8218882: NET_Writev is declared, NET_WriteV is defined
    + S8218889: Improperly use of the Optional API
    + S8219205: JFR file without license header
    + S8219597: (bf) Heap buffer state changes could provoke
    unexpected exceptions
    + S8219723: javax/net/ssl/compatibility/Compatibility.java
    failed on some SNI cases
    + S8220348: [ntintel] asserts about copying unaligned array
    + S8220451: jdi/EventQueue/remove/remove004 failed due to
    "ERROR: thread2 is not alive"
    + S8220456: jdi/EventQueue/remove_l/remove_l004 failed due to
    "TIMEOUT while waiting for event"
    + S8220479: java/nio/channels/Selector/SelectWithConsumer.java
    failed at testTwoChannels()
    + S8220613: java/util/Arrays/TimSortStackSize2.java times out
    with fastdebug build
    + S8220688: [TESTBUG] runtime/NMT/MallocStressTest.java timed
    out
    + S8220786: Create new switch to redirect error reporting
    output to stdout or stderr
    + S8221270: Duplicated synchronized keywords in SSLSocketImpl
    + S8221312: test/jdk/sanity/client/SwingSet/src/
    /ColorChooserDemoTest.java failed
    + S8221851: Use of THIS_FILE in hotspot invalidates precompiled
    header on Linux/GCC
    + S8221885: Add intermittent test in the JavaSound to the
    ProblemList
    + S8222264: Windows incremental build is broken with JDK-8217728
    + S8222391: javax/net/ssl/compatibility/Compatibility.java
    should be more flexible
    + S8222448: java/lang/reflect/PublicMethods/
    /PublicMethodsTest.java times out
    + S8222519: ButtonDemoScreenshotTest fails randomly with "still
    state to be reached"
    + S8222741: jdi/EventQueue/remove/remove004 fails due to
    VMDisconnectedException
    + S8223003: SunMSCAPI keys are not cleaned up
    + S8223063: Support CNG RSA keys
    + S8223158: Docked MacBook cannot start any Java Swing
    applications
    + S8223260: NamingManager should cache InitialContextFactory
    + S8223464: Improve version string for Oracle CI builds
    + S8223558: Java does not render Myanmar script correctly
    + S8223627: jdk-13+20 bundle name contains null instead of ea
    + S8223638: Replace wildcard address with loopback or local
    host in tests - part 6
    + S8223678: Add Visual Studio Code workspace generation support
    (for native code)
    + S8223727: com/sun/jndi/ldap/privconn/RunTest.java failed due
    to hang in LdapRequest.getReplyBer
    + S8223769: Assert triggers with -XX:+StressReflectiveCode
    + S8224187: Refactor arraycopy_prologue to allow ZGC read
    barriers on arraycopy
    + S8224475: JTextPane does not show images in HTML rendering
    + S8224673: Adjust permission for delayed starting of debugging
    + S8224705: Tests that need to be problem-listed or have
    printer resources
    + S8224778: test/jdk/demo/jfc/J2Ddemo/J2DdemoTest.java cannot
    find J2Ddemo.jar
    + S8224821: java/awt/Focus/NoAutotransferToDisabledCompTest/
    /NoAutotransferToDisabledCompTest.java fails linux-x64
    + S8224830: test/jdk/java/awt/Focus/
    /ModalExcludedWindowClickTest/
    /ModalExcludedWindowClickTest.java fails on linux-x64
    + S8224851: AArch64: fix warnings and errors with Clang and GCC
    8.3
    + S8224905: java/lang/ProcessBuilder/Basic.java#id1 failed with
    stream closed
    + S8225007: java/awt/print/PrinterJob/
    /LandscapeStackOverflow.java may hang
    + S8225105: java/awt/Focus/ShowFrameCheckForegroundTest/
    /ShowFrameCheckForegroundTest.java fails in Windows 10
    + S8225117: java/math/BigInteger/SymmetricRangeTests.java fails
    with ParseException
    + S8225128: Add exception for expiring DocuSign root to
    VerifyCACerts test
    + S8225130: Add exception for expiring Comodo roots to
    VerifyCACerts test
    + S8225144: [macos] In Aqua L&amp;F backspace key does not delete
    when Shift is pressed
    + S8225180: SignedObject with invalid Key not throwing the
    InvalidKeyException in Windows
    + S8225182: JNI exception pending in DestroyXIMCallback of
    awt_InputMethod.c:1327
    + S8225199: [Graal] compiler/jvmci/compilerToVM/
    /IsMatureVsReprofileTest.java fails with
  - XX:CompileThresholdScaling=0.1
    + S8225305: ProblemList java/lang/invoke/VarHandles tests
    + S8225350: compiler/jvmci/compilerToVM/IsCompilableTest.java
    timed out
    + S8225430: Replace wildcard address with loopback or local
    host in tests - part 14
    + S8225435: Upgrade IANA Language Subtag Registry to the latest
    for JDK14
    + S8225487: giflib legal file is missing attribution for
    openbsd-reallocarray.c
    + S8225567: Wrong file headers with 8202414 fix changeset
    + S8225684: [AOT] vmTestbase/vm/oom/production/
    /AlwaysOOMProduction tests fail with AOTed java.base
    + S8225766: Curve in certificate should not affect signature
    scheme when using TLSv1.3
    + S8225797: OldObjectSample event creates unexpected amount of
    checkpoint data
    + S8226381: ProblemList java/lang/reflect/PublicMethods/
    /PublicMethodsTest.java
    + S8226406: JVM fails to detect mismatched or corrupt CDS
    archive
    + S8226608: Hide the onjcmd option from the help output
    + S8226892: ActionListeners on JRadioButtons don't get notified
    when selection is changed with arrow keys
    + S8227112: exclude compiler/intrinsics/sha/sanity tests from
    AOT runs
    + S8227324: Upgrade to freetype 2.10.1
    + S8227528: TestAbortVMOnSafepointTimeout.java failed due to
    "RuntimeException: 'Safepoint sync time longer than' missing
    from stdout/stderr"
    + S8227645: Some tests in serviceability/sa run with fixed -Xmx
    values and risk running out of memory
    + S8227646: [TESTBUG] appcds/SharedArchiveConsistency timed out
    + S8227662: freetype seeks to index at the end of the font data
    + S8228479: Correct the format of ColorChooserDemoTest
    + S8228613: java.security.Provider#getServices order is no
    longer deterministic
    + S8228969: 2019-09-28 public suffix list update
    + S8229236: CriticalJNINatives: dll handling should be done in
    native thread state
    + S8229345: Memory leak due to vtable stubs not being shared on
    SPARC
    + S8229888: (zipfs) Updating an existing zip file does not
    preserve original permissions
    + S8229994: assert(false) failed: Bad graph detected in
    get_early_ctrl_for_expensive
    + S8230004: jdk/internal/jimage/JImageOpenTest.java runs no test
    + S8230235: Rendering HTML with empty img attribute and
    documentBaseKey cause Exception
    + S8230390: Problemlist SA tests with AOT
    + S8230400: Missing constant pool entry for a method in
    stacktrace
    + S8230459: Test failed to resume JVMCI CompilerThread
    + S8230480: check malloc/calloc results in java.desktop
    + S8230597: Update GIFlib library to the 5.2.1
    + S8230611: infinite loop in
    LogOutputList::wait_until_no_readers()
    + S8230624: [TESTBUG] Problemlist JFR
    compiler/TestCodeSweeper.java
    + S8230677: Should disable Escape Analysis if JVMTI capability
    can_get_owned_monitor_info was taken
    + S8230926: [macosx] Two apostrophes are entered instead of one
    with "U.S. International - PC" layout
    + S8231025: Incorrect method tag offset for big endian platform
    + S8231081: TestMetadataRetention fails due to missing symbol id
    + S8231387: java.security.Provider.getService returns random
    result due to race condition with mutating methods in the same
    class
    + S8231430: C2: Memory stomp in max_array_length() for
    T_ILLEGAL type
    + S8231445: check ZALLOC return values in awt coding
    + S8231507: Update Apache Santuario (XML Signature) to version
    2.1.4
    + S8231584: Deadlock with ClassLoader.findLibrary and
    System.loadLibrary call
    + S8231753: use more Posix functionality in aix
    os::print_os_info
    + S8231810: javax/net/ssl/templates/
    /SSLSocketSSLEngineTemplate.java fails intermittently with
    "java.lang.Exception: Unexpected EOF"
    + S8232003: (fs) Files.write can leak file descriptor in the
    exception case
    + S8232056: GetOwnedMonitorInfoWithEATest.java fails with ZGC:
    Heap too small
    + S8232060: add some initializations using sigemptyset in
    os_aix.cpp
    + S8232154: Update Mesa 3-D Headers to version 19.2.1
    + S8232167: Visual Studio install found through
  - -with-tools-dir value is discarded
    + S8232170: FSInfo#getJarClassPath throws an exception not
    declared in its throws clause
    + S8232200: [macos 10.15] Windows in fullscreen tests jumps
    around the screen
    + S8232207: Linux os::available_memory re-reads cgroup
    configuration on every invocation
    + S8232224: [TESTBUG] problemlist JFR TestLargeRootSet.java
    + S8232370: Refactor some com.sun.jdi tests to enable IDE
    integration
    + S8232433: [macos 10.15] java/awt/Window/
    /LocationAtScreenCorner/LocationAtScreenCorner.java may fail
    + S8232571: Add missing SIGINFO signal
    + S8232692: [TESTBUG] compiler/aot/fingerprint/
    /SelfChangedCDS.java fails when cds is disabled
    + S8232713: Update BCEL version to 6.3.1 in license file
    + S8232806: Introduce a system property to disable eager lambda
    initialization
    + S8232834: RunTest sometimes fails to produce valid
    exitcode.txt
    + S8232880: Update test documentation with additional settings
    for client UI tooltip tests
    + S8232950: SUNPKCS11 Provider incorrectly check key length for
    PSS Signatures.
    + S8233018: Add a new test to verify that DatagramSocket is not
    interruptible
    + S8233019: java.lang.Class.isPrimitive() (C1) returns wrong
    result if Klass* is aligned to 32bit
    + S8233032: assert(in_bb(n)) failed: must be
    + S8233078: fix minimal VM build on Linux ppc64(le)
    + S8233328: fix minimal VM build on Linux s390x
    + S8233383: Various minor fixes
    + S8233466: aarch64: remove unnecessary load of mdo when
    profiling return and parameters type
    + S8233491: Crash in AdapterHandlerLibrary::get_adapter with
    CDS due to code cache exhaustion
    + S8233529: loopTransform.cpp:2984: Error: assert(p_f-&gt;Opcode()
    == Op_IfFalse) failed
    + S8233548: Update CUP to v0.11b
    + S8233649: Update ProblemList.txt to exclude failing headful
    tests on macos
    + S8233656: assert(d-&gt;is_CFG() &amp;&amp; n-&gt;is_CFG()) failed: must
    have CFG nodes
    + S8233657: Intermittent NPE in Component.validate()
    + S8234288: Turkey Time Zone returns incorrect time zone name
    + S8234323: NULL-check return value of SurfaceData_InitOps on
    macosx
    + S8234339: replace JLI_StrTok in java_md_solinux.c
    + S8234340: Bump update version for OpenJDK: jdk-11.0.7
    + S8234350: assert(mode == ControlAroundStripMined &amp;&amp; (use ==
    sfpt || !use-&gt;is_reachable_from_root())) failed: missed a node
    + S8234386: [macos] NPE was thrown at expanding Choice from
    maximized frame
    + S8234397: add OS uptime information to os::print_os_info
    output
    + S8234423: Modifying ArrayList.subList().subList() resets
    modCount of subList
    + S8234466: Class loading deadlock involving
    X509Factory#commitEvent()
    + S8234501: remove obsolete NET_ReadV
    + S8234525: enable link-time section-gc for linux s390x to
    remove unused code
    + S8234610: MaxVectorSize set wrongly when UseAVX=3 is
    specified after JDK-8221092
    + S8234617: C1: Incorrect result of field load due to missing
    narrowing conversion
    + S8234723: javax/net/ssl/TLS tests support TLSv1.3
    + S8234724: javax/net/ssl/templates/
    /SSLSocketSSLEngineTemplate.java supports TLSv1.3
    + S8234741: enhance os::get_core_path on macOS
    + S8234769: Duplicate attribution in freetype.md
    + S8234786: Fix for JDK-8214578 breaks OS X 10.12 compatibility
    + S8234809: set relro in linker flags when building with gcc
    + S8234824: java/nio/channels/SocketChannel/AdaptSocket.java
    fails on Windows 10
    + S8235243: handle VS2017 15.9 and VS2019 in abstract_vm_version
    + S8235288: AVX 512 instructions inadvertently used on Xeon for
    small vector width operations
    + S8235325: build failure on Linux after 8235243
    + S8235383: C1 compilation fails with
  - XX:+PrintIRDuringConstruction -XX:+Verbose
    + S8235489: handle return values of sscanf calls in hotspot
    + S8235509: Backport for JDK-8209657 Refactor filemap.hpp to
    simplify integration with Serviceability Agent.
    + S8235510: java.util.zip.CRC32 performance drop after 8200067
    + S8235563: [TESTBUG] appcds/CommandLineFlagComboNegative.java
    does not handle archive mapping failure
    + S8235637: jhsdb jmap from OpenJDK 11.0.5 doesn't work if
    prelink is enabled
    + S8235671: enhance print_rlimit_info in os_posix
    + S8235744: PIT: test/jdk/javax/swing/text/html/
    /TestJLabelWithHTMLText.java times out in linux-x64
    + S8235904: Infinite loop when rendering huge lines
    + S8235998: [c2] Memory leaks during tracing after '8224193:
    stringStream should not use Resource Area'.
    + S8236039: JSSE Client does not accept status_request
    extension in CertificateRequest messages for TLS 1.3
    + S8236140: assert(!VerifyHashTableKeys || _hash_lock == 0)
    failed: remove node from hash table before modifying it
    + S8236179: C1 register allocation error with T_ADDRESS
    + S8236488: Support for configure option
  - -with-native-debug-symbols=internal is impossible on Windows
    + S8236500: Windows ucrt.dll should be looked up in versioned
    WINSDK subdirectory
    + S8236709: struct SwitchRange in HS violates C++ One
    Definition Rule
    + S8236848: [JDK 11u] make run-test-tier1 fails after backport
    of JDK-8232834
    + S8236873: Worker has a deadlock bug
    + S8237217: Incorrect G1StringDedupEntry type used in
    StringDedupTable destructor
    + S8237368: Problem with NullPointerException in RMI
    TCPEndpoint.read
    + S8237375: SimpleThresholdPolicy misses CounterDecay timestamp
    initialization
    + S8237508: Simplify JarFile.isInitializing
    + S8237540: Missing files in backport of JDK-8210910
    + S8237541: Missing files in backport of JDK-8236528
    + S8237600: Test SunJSSEFIPSInit fails on Ubuntu
    + S8237819: s390x - remove unused pd_zero_to_words_large
    + S8237869: exclude jtreg test security/infra/java/security/
    /cert/CertPathValidator/certification/LuxTrustCA.java because
    of instabilities
    + S8237879: make 4.3 breaks build
    + S8237945: CTW: C2 compilation fails with
    assert(just_allocated_object(alloc_ctl) == ptr) failed: most
    recent allo...
    + S8238225: Issues reported after replacing symlink at
    Contents/MacOS/libjli.dylib with binary
    + S8238247: CTW runner should sweep nmethods more aggressively
    + S8238366: CTW runner closes standard output on exit
    + S8238438: SuperWord::co_locate_pack picks memory state of
    first instead of last load
    + S8238502: sunmscapi.dll causing EXCEPTION_ACCESS_VIOLATION
    + S8238534: Deep sign macOS bundles before bundle archive is
    being created
    + S8238591: CTW: Split
    applications/ctw/modules/jdk_localedata.java
    + S8238596: AVX enabled by default for Skylake even when
    unsupported
    + S8238811: C2: assert(i &gt;= req() || i == 0 || is_Region() ||
    is_Phi()) with -XX:+VerifyGraphEdges
    + S8239005: [TESTBUG] test/hotspot/jtreg/runtime/
    /StackGuardPages/TestStackGuardPages.java: exeinvoke.c: must
    initialize static state before calling do_overflow()
    + S8239466: Loss of precision in counter decay calculation in
    11u backport of JDK-8237375
    + S8239856: [ntintel] asserts about copying unaligned array
    element
    + S8240724: [test] jdk11 downport of 8224475 misses binary file
    test/jdk/javax/swing/JTextPane/arrow.png
    + S8241296: Segfault in JNIHandleBlock::oops_do()
- Removed patch:
  * DependOnVariableHelper.patch
    + fixed upstream
- Added patch:
  * JDK-8228407.patch
    + fix crashes due to shared archive file mismatch</changelog>
  <changelog author="fstrba@suse.com" date="1594900800">- Update to upstream tag jdk-11.0.8+10 (July 2020 CPU, bsc#1174157)
  * Security fixes:
    + JDK-8230613: Better ASCII conversions
    + JDK-8231800: Better listing of arrays
    + JDK-8232014: Expand DTD support
    + JDK-8233234: Better Zip Naming
    + JDK-8233239, CVE-2020-14562: Enhance TIFF support
    + JDK-8233255: Better Swing Buttons
    + JDK-8234032: Improve basic calendar services
    + JDK-8234042: Better factory production of certificates
    + JDK-8234418: Better parsing with CertificateFactory
    + JDK-8234836: Improve serialization handling
    + JDK-8236191: Enhance OID processing
    + JDK-8236867, CVE-2020-14573: Enhance Graal interface handling
    + JDK-8237117, CVE-2020-14556: Better ForkJoinPool behavior
    + JDK-8237592, CVE-2020-14577: Enhance certificate verification
    + JDK-8238002, CVE-2020-14581: Better matrix operations
    + JDK-8238013: Enhance String writing
    + JDK-8238804: Enhance key handling process
    + JDK-8238842: AIOOBE in GIFImageReader.initializeStringTable
    + JDK-8238843: Enhanced font handing
    + JDK-8238920, CVE-2020-14583: Better Buffer support
    + JDK-8238925: Enhance WAV file playback
    + JDK-8240119, CVE-2020-14593: Less Affine Transformations
    + JDK-8240482: Improved WAV file playback
    + JDK-8241379: Update JCEKS support
    + JDK-8241522: Manifest improved jar headers redux
    + JDK-8242136, CVE-2020-14621: Better XML namespace handling
  * Other changes:
    + JDK-6933331: (d3d/ogl) java.lang.IllegalStateException:
    Buffers have not been created
    + JDK-7124307: JSpinner and changing value by mouse
    + JDK-8022574: remove HaltNode code after uncommon trap calls
    + JDK-8039082: [TEST_BUG] Test
    java/awt/dnd/BadSerializationTest/BadSerializationTest.java
    fails
    + JDK-8040630: Popup menus and tooltips flicker with previous
    popup contents when first shown
    + JDK-8044365: (dc) MulticastSendReceiveTests.java failing with
    ENOMEM when joining group (OS X 10.9)
    + JDK-8048215: [TESTBUG]
    java/lang/management/ManagementFactory/ThreadMXBeanProxy.java
    Expected non-null LockInfo
    + JDK-8051349: nsk/jvmti/scenarios/sampling/SP06/sp06t003 fails
    in nightly
    + JDK-8080353: JShell: Better error message on attempting to
    add default method
    + JDK-8139876: Exclude hanging nsk/stress/stack from execution
    with deoptimization enabled
    + JDK-8146090: java/lang/ref/ReachabilityFenceTest.java fails
    with -XX:+DeoptimizeALot
    + JDK-8153430: jdk regression test MletParserLocaleTest,
    ParserInfiniteLoopTest reduce default timeout
    + JDK-8156207: Resource allocated BitMaps are often cleared
    unnecessarily
    + JDK-8159740: JShell: corralled declarations do not have
    correct source to wrapper mapping
    + JDK-8175984: ICC_Profile has un-needed, not-empty finalize
    method
    + JDK-8176359: Frame#setMaximizedbounds not working properly in
    multi screen environments
    + JDK-8183369: RFC unconformity of HttpURLConnection with proxy
    + JDK-8187078: -XX:+VerifyOops finds numerous problems when
    running JPRT
    + JDK-8189861: Refactor CacheFind
    + JDK-8191169: java/net/Authenticator/B4769350.java failed
    intermittently
    + JDK-8191930: [Graal] emits unparseable XML into compile log
    + JDK-8193879: Java debugger hangs on method invocation
    + JDK-8196019: java/awt/Window/Grab/GrabTest.java fails on
    Windows
    + JDK-8196181: sun/java2d/GdiRendering/InsetClipping.java fails
    + JDK-8198000:
    java/awt/List/EmptyListEventTest/EmptyListEventTest.java
    debug assert on Windows
    + JDK-8198001: java/awt/Menu/WrongParentAfterRemoveMenu/
    /WrongParentAfterRemoveMenu.java debug assert on Windows
    + JDK-8198339: Test javax/swing/border/Test6981576.java is
    unstable
    + JDK-8200701: jdk/jshell/ExceptionsTest.java fails on Windows,
    after JDK-8198801
    + JDK-8203264: JNI exception pending in
    PlainDatagramSocketImpl.c:740
    + JDK-8203672: JNI exception pending in PlainSocketImpl.c
    + JDK-8203673: JNI exception pending in
    DualStackPlainDatagramSocketImpl.c:398
    + JDK-8204834: Fix confusing "allocate" naming in OopStorage
    + JDK-8205399: Set node color on pinned HashMap.TreeNode
    deletion
    + JDK-8205653: test/jdk/sun/management/jmxremote/bootstrap/
    /RmiRegistrySslTest.java and RmiSslBootstrapTest.sh fail with
    handshake_failure
    + JDK-8206179: com/sun/management/OperatingSystemMXBean/
    /GetCommittedVirtualMemorySize.java fails with Committed
    virtual memory size illegal value
    + JDK-8207334: VM times out in VM_HandshakeAllThreads::doit()
    with RunThese30M
    + JDK-8208277: Code cache heap (-XX:ReservedCodeCacheSize)
    doesn't work with 1GB LargePages
    + JDK-8209113: Use WeakReference for lastFontStrike for created
    Fonts
    + JDK-8209333: Socket reset issue for TLS 1.3 socket close
    + JDK-8209439: C2 library_call can potentially ignore Math.pow
    intrinsic or use null pointer
    + JDK-8209534: [TESTBUG]runtime/appcds/cacheObject/
    /ArchivedModuleCompareTest.java fails with EnableJVMCI.
    + JDK-8210147: adjust some WSAGetLastError usages in windows
    network coding
    + JDK-8210284: "assert((av &amp; 0x00000001) == 0) failed:
    unsupported V8" on Solaris 11.4
    + JDK-8210303: VM_HandshakeAllThreads fails assert with
    "failed: blocked and not walkable"
    + JDK-8210459: Add support for generating compile_commands.json
    + JDK-8210515: [TESTBUG]CheckArchivedModuleApp.java needs to
    check if EnableJVMCI is set.
    + JDK-8210788: Javadoc for Thread.join(long, int) should
    specify that it waits forever when both arguments are zero
    + JDK-8211301: [macos] support full window content options
    + JDK-8211332: Space for stub routines (code_size2) is too
    small on new Skylake CPUs
    + JDK-8211339: NPE during SSL handshake caused by
    HostnameChecker
    + JDK-8211392: compiler/profiling/
    /spectrapredefineclass_classloaders/Launcher.java times out
    in JDK12 CI
    + JDK-8211743: [AOT] crash in ScopeDesc::decode_body() when
    JVMTI walks AOT frames
    + JDK-8212154: [TESTBUG] CheckArchivedModuleApp fails with NPE
    when JVMCI is absent
    + JDK-8212167: JShell : Stack trace of exception has wrong line
    number
    + JDK-8212933: Thread-SMR: requesting a VM operation whilst
    holding a ThreadsListHandle can cause deadlocks
    + JDK-8212986: Make Visual Studio compiler check less strict
    + JDK-8213250: CDS archive creation aborts due to metaspace
    object allocation failure
    + JDK-8213516: jck test api/javax_accessibility/AccessibleState/
    /fields.html fails intermittent
    + JDK-8213947: ARM32: failed check_simd should set
    UsePopCountInstruction to false
    + JDK-8214418: half-closed SSLEngine status may cause
    application dead loop
    + JDK-8214440: ldap over a TLS connection negotiate failed with
    "javax.net.ssl.SSLPeerUnverifiedException: hostname of the
    server does not match the hostname in the server's
    certificate"
    + JDK-8214444: Wrong strncat limits in dfa.cpp
    + JDK-8214481: freetype path does not disable TrueType hinting
    with AA+FM hints
    + JDK-8214571: -Xdoclint of array serialField gives "error:
    array type not allowed here"
    + JDK-8214856: Errors with JSZip in web console after upgrade
    to 3.1.5
    + JDK-8214862: assert(proj != __null) at compile.cpp:3251
    + JDK-8215369: Jcstress pollute /var/tmp with temporary files.
    + JDK-8215551: Missing case label in nmethod::reloc_string_for()
    + JDK-8215555: TieredCompilation C2 threads can excessively
    block handshakes
    + JDK-8215711: Missing key_share extension for (EC)DHE key
    exchange should alert missing_extension
    + JDK-8216151: [Graal] Module
    jdk.internal.vm.compiler.management has not been granted
    accessClassInPackage.org.graalvm.compiler.debug
    + JDK-8216154: C4819 warnings at HotSpot sources on Windows
    + JDK-8216541: CompiledICHolders of VM locked unloaded nmethods
    are released too late
    + JDK-8217230: assert(t == t_no_spec) failure in
    NodeHash::check_no_speculative_types()
    + JDK-8217404: --with-jvm-features doesn't work when multiple
    features are explicitly disabled
    + JDK-8217447: Develop flag TraceICs is broken
    + JDK-8217606: LdapContext#reconnect always opens a new
    connection
    + JDK-8218807: Compilation database (compile_commands.json) may
    contain obsolete items
    + JDK-8219214: Infinite Loop in CodeSection::dump()
    + JDK-8219904: ClassCastException when calling
    FlightRecorderMXBean#getRecordings()
    + JDK-8219991: New fix of the deadlock in
    sun.security.ssl.SSLSocketImpl
    + JDK-8221121: applications/microbenchmarks are encountering
    crashes in tier5
    + JDK-8221445: FastSysexMessage constructor crashes MIDI
    receiption thread
    + JDK-8221482: Initialize VMRegImpl::regName[] earlier to
    prevent assert during PrintStubCode
    + JDK-8221741: ClassCastException can happen when
    fontconfig.properties is used
    + JDK-8221823: Requested JDialog width is ignored
    + JDK-8223108: Test java/awt/EventQueue/
    /NonComponentSourcePost.java is unstable
    + JDK-8223678: Add Visual Studio Code workspace generation
    support (for native code)
    + JDK-8223935: PIT: java/awt/font/WindowsIndicFonts.java fails
    on windows10
    + JDK-8224109: Text spaced incorrectly by drawString under
    rotation with fractional metric
    + JDK-8224632: testbug: java/awt/dnd/RemoveDropTargetCrashTest/
    /RemoveDropTargetCrashTest.java fails on MacOS
    + JDK-8224793: os::die() does not honor CreateCoredumpOnCrash
    option
    + JDK-8224847: gc/stress/TestReclaimStringsLeaksMemory.java
    fails with reserved greater than expected
    + JDK-8224931: disable JAOTC invokedynamic support until
    8223533 is fixed
    + JDK-8224997: ChaCha20-Poly1305 TLS cipher suite decryption
    throws ShortBufferException
    + JDK-8225068: Remove DocuSign root certificate that is
    expiring in May 2020
    + JDK-8225069: Remove Comodo root certificate that is expiring
    in May 2020
    + JDK-8225126: Test SetBoundsPaintTest.html faild on Windows
    when desktop is scaled
    + JDK-8225325: Add tests for redefining a class' private method
    during resolution of the bootstrap specifier
    + JDK-8225622: [AOT] runtime/SharedArchiveFile/
    /TestInterpreterMethodEntries.java crashed with AOTed
    java.base
    + JDK-8225653: Provide more information when hitting SIGILL
    from HaltNode
    + JDK-8225783: Incorrect use of binary operators on booleans in
    type.cpp
    + JDK-8225789: Empty method parameter type should generate
    ClassFormatError
    + JDK-8226198: use of &amp; instead of &amp;&amp; in
    LibraryCallKit::arraycopy_restore_alloc_state
    + JDK-8226253: JAWS reports wrong number of radio buttons when
    buttons are hidden.
    + JDK-8226653: [accessibility] Can edit text cell correctly,
    but Accessibility Tool reads nothing about editor
    + JDK-8226806: [macOS 10.14] Methods of Java Robot should be
    called from appropriate thread
    + JDK-8226879: Memory leak in Type::hashcons
    + JDK-8227632: Incorrect PrintCompilation message: made not
    compilable on levels 0 1 2 3 4
    + JDK-8228407: JVM crashes with shared archive file mismatch
    + JDK-8228482: fix xlc16/xlclang comparison of distinct pointer
    types and string literal conversion warnings
    + JDK-8228757: Fail fast if the handshake type is unknown
    + JDK-8229158: make UseSwitchProfiling non-experimental or
    false by-default
    + JDK-8229421: The logic of java/net/ipv6tests/TcpTest.java is
    flawed
    + JDK-8229855: C2 fails with assert(false) failed: bad AD file
    + JDK-8230591: AArch64: Missing intrinsics for Math.ceil,
    floor, rint
    + JDK-8231118: ARM32: Math tests failures
    + JDK-8231213: Migrate SimpleDateFormatConstTest to JDK Repo
    + JDK-8231243: [TESTBUG] CustomFont.java cannot find font file
    + JDK-8231438: [macOS] Dark mode for the desktop is not
    supported
    + JDK-8231550: C2: ShouldNotReachHere() in
    verify_strip_mined_scheduling
    + JDK-8231564: setMaximizedBounds is broken with large display
    scale and multiple monitors
    + JDK-8231572: Use -lobjc instead of -fobjc-link-runtime in
    libosxsecurity
    + JDK-8231631: sun/net/ftp/FtpURLConnectionLeak.java fails
    intermittently with NPE
    + JDK-8231671: Fix copyright headers in hotspot (missing comma
    after year)
    + JDK-8231720: Some perf regressions after 8225653
    + JDK-8231779: crash
    HeapWord*ParallelScavengeHeap::failed_mem_allocate
    + JDK-8231863: Crash if classpath is read from @argument file
    and the main gets option argument
    + JDK-8232080: jlink plugins for vendor information and
    run-time options
    + JDK-8232106: [x86] C2: SIGILL due to usage of SSSE3
    instructions on processors which don't support it
    + JDK-8232134: Change to Visual Studio 2017 15.9.16 for
    building on Windows at Oracle
    + JDK-8232226: [macos 10.15] test/jdk/java/awt/color/
    /EqualityTest/EqualityTest.java may fail
    + JDK-8232357: Compare version info of Santuario to legal notice
    + JDK-8232572: Add hooks for custom output dir in Bundles.gmk
    + JDK-8232634: Problem List ICMColorDataTest.java
    + JDK-8232748: Build static versions of certain JDK libraries
    + JDK-8232846: ProcessHandle.Info command with non-English
    shows question marks
    + JDK-8232880: Update test documentation with additional
    settings for client UI tooltip tests
    + JDK-8233033: C2 produces wrong result while unswitching a
    loop due to lost control dependencies
    + JDK-8233137: runtime/ErrorHandling/VeryEarlyAssertTest.java
    fails after 8232080
    + JDK-8233197: Invert JvmtiExport::post_vm_initialized() and
    Jfr:on_vm_start() start-up order for correct option parsing
    + JDK-8233291: [TESTBUG] tools/jlink/plugins/
    /VendorInfoPluginsTest.java fails with debug or non-server VMs
    + JDK-8233364: Fix undefined behavior in
    Canonicalizer::do_ShiftOp
    + JDK-8233494: Avoid calling MallocTracker::record_malloc and
    record_free when NMT is off
    + JDK-8233573: Toolkit.getScreenInsets(GraphicsConfiguration)
    may throw ClassCastException
    + JDK-8233608: Minimal build broken after JDK-8233494
    + JDK-8233621: Mismatch in jsse.enableMFLNExtension property
    name
    + JDK-8233696: [TESTBUG]Some jtreg tests fail when CAPS_LOCK is
    ON
    + JDK-8233707: systemScale.cpp could not compile with VS2019
    + JDK-8233801: GCMEmptyIv.java test fails on Solaris 11.4
    + JDK-8233880: Support compilers with multi-digit major version
    numbers
    + JDK-8233920: MethodHandles::tryFinally generates illegal
    bytecode for long/double return type
    + JDK-8234137: The "AutoTestOnTop.java" test may run external
    applications
    + JDK-8234146: compiler/jsr292/
    /ContinuousCallSiteTargetChange.java times out on SPARC
    + JDK-8234184: [TESTBUG] java/awt/Mouse/EnterExitEvents/
    /ModalDialogEnterExitEventsTest.java fails in Windows
    + JDK-8234270: [REDO] JDK-8204128 NMT might report incorrect
    numbers for Compiler area
    + JDK-8234332: [TESTBUG] java/awt/Focus/DisposedWindow/
    /DisposeDialogNotActivateOwnerTest/
    /DisposeDialogNotActivateOwnerTest.java fails on linux-x64
    nightly
    + JDK-8234398: Replace ID2D1Factory::GetDesktopDpi with
    GetDeviceCaps
    + JDK-8234522: [macos] Crash with use of native file dialog
    + JDK-8234691: Potential double-free in ParallelSPCleanupTask
    constructor
    + JDK-8234696: tools/jlink/plugins/VendorInfoPluginsTest.java
    times out
    + JDK-8234727: sun/security/ssl/X509TrustManagerImpl tests
    support TLSv1.3
    + JDK-8234728: Some security tests should support TLSv1.3
    + JDK-8234779: Provide idiom for declaring classes noncopyable
    + JDK-8234824: java/nio/channels/SocketChannel/AdaptSocket.java
    fails on Windows 10
    + JDK-8234968: check calloc rv in libinstrument
    InvocationAdapter
    + JDK-8235153: [TESTBUG] [macos 10.15] java/awt/Graphics/
    /DrawImageBG/SystemBgColorTest.java fails
    + JDK-8235183: Remove the "HACK CODE" in comment
    + JDK-8235263: Revert TLS 1.3 change that wrapped IOExceptions
    + JDK-8235311: Tag mismatch may alert bad_record_mac
    + JDK-8235332: TestInstanceCloneAsLoadsStores.java fails with
  - XX:+StressGCM
    + JDK-8235452: Strip mined loop verification fails with
    assert(is_OuterStripMinedLoop()) failed: invalid node class
    + JDK-8235584: UseProfiledLoopPredicate fails with
    assert(_phase-&gt;get_loop(c) == loop) failed: have to be in the
    same loop
    + JDK-8235620: Broken merge between JDK-8006406 and JDK-8003559
    + JDK-8235638: NPE in LWWindowPeer.getOnscreenGraphics()
    + JDK-8235686: Add more custom hooks in Bundles.gmk
    + JDK-8235739: Rare NPE at WComponentPeer.getGraphics()
    + JDK-8235762: JVM crash in SWPointer during C2 compilation
    + JDK-8235834: IBM-943 charset encoder needs updating
    + JDK-8235874: The ordering of Cipher Suites is not maintained
    provided through jdk.tls.client.cipherSuites and
    jdk.tls.server.cipherSuites system property.
    + JDK-8235908: omit ThreadPriorityPolicy warning when value is
    set from image
    + JDK-8235984: C2: assert(out-&gt;in(PhiNode::Region) == head ||
    out-&gt;in(PhiNode::Region) == slow_head) failed: phi must be
    either part of the slow or the fast loop
    + JDK-8236211: [Graal] compiler/graalunit/GraphTest.java is
    skipped in all testing
    + JDK-8236470: Deal with ECDSA using ecdsa-with-SHA2 plus hash
    algorithm as AlgorithmId
    + JDK-8236545: Compilation error in mach5
    java/awt/FileDialog/MacOSGoToFolderCrash.java
    + JDK-8236700: Upgrading JSZip from v3.1.5 to v3.2.2
    + JDK-8236759: ShouldNotReachHere in
    PhaseIdealLoop::verify_strip_mined_scheduling
    + JDK-8236897: Fix the copyright header for pkcs11gcm2.h
    + JDK-8236921: Add build target to produce a JDK image suitable
    for a Graal/SVM build
    + JDK-8236953: [macos] JavaFX SwingNode is not rendered on macOS
    + JDK-8236996: Incorrect Roboto font rendering on Windows with
    subpixel antialiasing
    + JDK-8237045: JVM uses excessive memory with -XX:+EnableJVMCI
  - XX:JVMCICounterSize=2147483648
    + JDK-8237055: [TESTBUG] compiler/c2/TestJumpTable.java fails
    with release VMs
    + JDK-8237086: assert(is_MachReturn()) running CTW with fix for
    JDK-8231291
    + JDK-8237192: Generate stripped/public pdbs on Windows for jdk
    images
    + JDK-8237396: JvmtiTagMap::weak_oops_do() should not trigger
    barriers
    + JDK-8237474: Default SSLEngine should create in server role
    + JDK-8237859: C2: Crash when loads float above range check
    + JDK-8237879: make 4.3 breaks build
    + JDK-8237951: CTW: C2 compilation fails with "malformed
    control flow"
    + JDK-8237962: give better error output for invalid OCSP
    response intervals in CertPathValidator checks
    + JDK-8238190: [JVMCI] Fix single implementor speculation for
    diamond shapes.
    + JDK-8238356: CodeHeap::blob_count() overestimates the number
    of blobs
    + JDK-8238452: Keytool generates wrong expiration date if
    validity is set to 2050/01/01
    + JDK-8238555: Allow Initialization of SunPKCS11 with NSS when
    there are external FIPS modules in the NSSDB
    + JDK-8238575: DragSourceEvent.getLocation() returns wrong
    value on HiDPI screens (Windows)
    + JDK-8238676: jni crashes on accessing it from process exit
    hook
    + JDK-8238721: Add failing client jtreg tests to the Problem
    List
    + JDK-8238738: AudioSystem.getMixerInfo() takes about 30 sec to
    report a gone audio device
    + JDK-8238756: C2: assert(((n) == __null || !VerifyIterativeGVN
    || !((n)-&gt;is_dead()))) failed: can not use dead node
    + JDK-8238765: PhaseCFG::schedule_pinned_nodes cannot handle
    precedence edges from unmatched CFG nodes correctly
    + JDK-8238898: Missing hash characters for header on license
    file
    + JDK-8238942: Rendering artifacts with LCD text and fractional
    metrics
    + JDK-8238985: [TESTBUG] The arrow image is blue instead of
    green
    + JDK-8239000: handle ContendedPaddingWidth in vm_version_ppc
    + JDK-8239055: Wrong implementation of VMState.hasListener
    + JDK-8239091: Reversed arguments in call to strstr in freetype
    "debug" code.
    + JDK-8239142: C2's UseUniqueSubclasses optimization is broken
    for array accesses
    + JDK-8239224: libproc_impl.c previous_thr may be used
    uninitialized warning
    + JDK-8239351: Give more meaningful InternalError messages in
    Deflater.c
    + JDK-8239365: ProcessBuilder test modifications for AIX
    execution
    + JDK-8239456: vtable stub generation: assert failure (code
    size estimate)
    + JDK-8239457: call ReleaseStringUTFChars before early returns
    in Java_sun_security_pkcs11_wrapper_PKCS11_connect
    + JDK-8239462: jdk.hotspot.agent misses some
    ReleaseStringUTFChars calls in case of early returns
    + JDK-8239557: [TESTBUG] VeryEarlyAssertTest.java validating
    "END." marker at lastline is not always true
    + JDK-8239787: AArch64: String.indexOf may incorrectly handle
    empty strings
    + JDK-8239792: Bump update version for OpenJDK: jdk-11.0.8
    + JDK-8239798: SSLSocket closes socket both socket endpoints on
    a SocketTimeoutException
    + JDK-8239819: XToolkit: Misread of screen information memory
    + JDK-8239852: java/util/concurrent tests fail with
  - XX:+VerifyGraphEdges: assert(!VerifyGraphEdges) failed:
    verification should have failed
    + JDK-8239893: Windows handle Leak when starting processes
    using ProcessBuilder
    + JDK-8239915: Zero VM crashes when handling dynamic constant
    + JDK-8239931: [win][x86] vtable stub generation: assert
    failure (code size estimate) follow-up
    + JDK-8239965: XMLEncoder/Test4625418.java fails due to "Error:
    Cp943 - can't read properly"
    + JDK-8239976: Put JDK-8239965 on the ProblemList.txt
    + JDK-8240073: Fix 'test-make' build target in 11u
    + JDK-8240197: Cannot start JVM when $JAVA_HOME includes CJK
    characters
    + JDK-8240202: A few client tests leave mouse buttons pressed
    + JDK-8240220: IdealLoopTree::dump_head predicate printing is
    broken
    + JDK-8240223: Use consistent predicate order in and with
    PhaseIdealLoop::find_predicate
    + JDK-8240227: Loop predicates should be copied to unswitched
    loops
    + JDK-8240286: [TESTBUG] Test command error in hotspot/jtreg/
    /compiler/loopopts/superword/SumRedAbsNeg_Float.java
    + JDK-8240518: Incorrect JNU_ReleaseStringPlatformChars in
    Windows Print
    + JDK-8240529: CheckUnhandledOops breaks NULL check in
    Modules::define_module
    + JDK-8240576: JVM crashes after transformation in C2
    IdealLoopTree::merge_many_backedges
    + JDK-8240603: Windows 32bit compile error after 8238676
    + JDK-8240629: argfiles parsing broken for argfiles with
    comment cross 4096 bytes chunk
    + JDK-8240711: TestJstatdPort.java failed due to
    "ExportException: Port already in use:"
    + JDK-8240786: [TESTBUG] The test java/awt/Window/
    /GetScreenLocation/GetScreenLocationTest.java fails on HiDPI
    screen
    + JDK-8240824: enhance print_full_memory_info on Linux by THP
    related information
    + JDK-8240827: Downport SSLSocketImpl.java from "8221882: Use
    fiber-friendly java.util.concurrent.locks in JSSE"
    + JDK-8240905: assert(mem == (Node*)1 || mem == mem2) failed:
    multiple Memories being matched at once?
    + JDK-8240972: macOS codesign fail on macOS 10.13.5 or older
    + JDK-8241445: Fix copyright in
    test/jdk/tools/launcher/ArgFileSyntax.java
    + JDK-8241458: [JVMCI] add mark value to expose
    CodeOffsets::Frame_Complete
    + JDK-8241464: [11u] Backport: make rehashing be a needed
    guaranteed safepoint cleanup action
    + JDK-8241556: Memory leak if -XX:CompileCommand is set
    + JDK-8241568: (fs) UserPrincipalLookupService.lookupXXX
    failure with IOE "Operation not permitted"
    + JDK-8241586: compiler/cpuflags/
    /TestAESIntrinsicsOnUnsupportedConfig.java fails on aarch64
    + JDK-8241638: launcher time metrics always report 1 on Linux
    when _JAVA_LAUNCHER_DEBUG set
    + JDK-8241660: Add virtualization information output to hs_err
    file on macOS
    + JDK-8241808: [TESTBUG] The JDK-8039467 bug appeared on macOS
    + JDK-8241888: Mirror jdk.security.allowNonCaAnchor system
    property with a security one
    + JDK-8241900: Loop unswitching may cause dependence on null
    check to be lost
    + JDK-8241948: enhance list of environment variables printed in
    hs_err file
    + JDK-8241996: on linux set full relro in the linker flags
    + JDK-8242108: Performance regression after fix for JDK-8229496
    + JDK-8242141: New System Properties to configure the TLS
    signature schemes
    + JDK-8242154: Backport parts of JDK-4947890 to OpenJDK 11u
    + JDK-8242174: [macos] The NestedModelessDialogTest test make
    the macOS unstable
    + JDK-8242239: [Graal] javax/management/generified/
    /GenericTest.java fails: FAILED: queryMBeans sets same
    + JDK-8242294: JSSE Client does not throw SSLException when an
    alert occurs during handshaking
    + JDK-8242379: [TESTBUG] compiler/loopopts/
    /TestLoopUnswitchingLostCastDependency.java fails with
    release VMs
    + JDK-8242470: Update Xerces to Version 2.12.1
    + JDK-8242498: Invalid "sun.awt.TimedWindowEvent" object leads
    to JVM crash
    + JDK-8242541: Small charset issues (ISO8859-16, x-eucJP-Open,
    x-IBM834 and x-IBM949C)
    + JDK-8242626: enhance posix print_rlimit_info
    + JDK-8243059: Build fails when --with-vendor-name contains a
    comma
    + JDK-8243539: Copyright info (Year) should be updated for fix
    of 8241638
    + JDK-8243541: (tz) Upgrade time-zone data to tzdata2020a
    + JDK-8244407: JVM crashes after transformation in C2
    IdealLoopTree::split_fall_in
    + JDK-8244520: problemlist
    java/awt/font/Rotate/RotatedFontTest.java on linux
    + JDK-8244777: ClassLoaderStats VM Op uses constant hash value
    + JDK-8244853: The static build of libextnet is missing the
    JNI_OnLoad_extnet function
    + JDK-8244951: Missing entitlements for hardened runtime
    + JDK-8245047: [PPC64] C2: ReverseBytes + Load always match to
    unordered Load (acquire semantics missing)
    + JDK-8245649: Revert 8245397 backport of 8230591
    + JDK-8246031: SSLSocket.getSession() doesn't close connection
    for timeout/ interrupts
    + JDK-8246613: Choose the default SecureRandom algo based on
    registration ordering
    + JDK-8248505: Unexpected NoSuchAlgorithmException when using
    secure random impl from BCFIPS provider
- Removed patch:
  * JDK-8228407.patch
    + integrated upstream</changelog>
  <changelog author="fstrba@suse.com" date="1604318400">- Update to upstream tag jdk-11.0.9-11 (October 2020 CPU,
  bsc#1177943)
  * New features
    + JDK-8250784: Shenandoah: A Low-Pause-Time Garbage Collector
  * Security fixes
    + JDK-8233624: Enhance JNI linkage
    + JDK-8236196: Improve string pooling
    + JDK-8236862, CVE-2020-14779: Enhance support of Proxy class
    + JDK-8237990, CVE-2020-14781: Enhanced LDAP contexts
    + JDK-8237995, CVE-2020-14782: Enhance certificate processing
    + JDK-8240124: Better VM Interning
    + JDK-8241114, CVE-2020-14792: Better range handling
    + JDK-8242680, CVE-2020-14796: Improved URI Support
    + JDK-8242685, CVE-2020-14797: Better Path Validation
    + JDK-8242695, CVE-2020-14798: Enhanced buffer support
    + JDK-8243302: Advanced class supports
    + JDK-8244136, CVE-2020-14803: Improved Buffer supports
    + JDK-8244479: Further constrain certificates
    + JDK-8244955: Additional Fix for JDK-8240124
    + JDK-8245407: Enhance zoning of times
    + JDK-8245412: Better class definitions
    + JDK-8245417: Improve certificate chain handling
    + JDK-8248574: Improve jpeg processing
    + JDK-8249927: Specify limits of jdk.serialProxyInterfaceLimit
    + JDK-8253019: Enhanced JPEG decoding
  * Other changes
    + JDK-6532025: GIF reader throws misleading exception with
    truncated images
    + JDK-6949753: [TEST BUG]: java/awt/print/PageFormat/
    /PDialogTest.java needs update by removing an infinite loop
    + JDK-8022535: [TEST BUG] javax/swing/text/html/parser/
    /Test8017492.java fails
    + JDK-8062947: Fix exception message to correctly represent
    LDAP connection failure
    + JDK-8067354: com/sun/jdi/GetLocalVariables4Test.sh failed
    + JDK-8134599: TEST_BUG: java/rmi/transport/closeServerSocket/
    /CloseServerSocket.java fails intermittently with Address
    already in use
    + JDK-8151678: com/sun/jndi/ldap/LdapTimeoutTest.java failed
    due to timeout on DeadServerNoTimeoutTest is incorrect
    + JDK-8160768: Add capability to custom resolve host/domain
    names within the default JNDI LDAP provider
    + JDK-8172404: Tools should warn if weak algorithms are used
    before restricting them
    + JDK-8193367: Annotated type variable bounds crash javac
    + JDK-8202117: com/sun/jndi/ldap/RemoveNamingListenerTest.java
    fails intermittently: Connection reset
    + JDK-8203026: java.rmi.NoSuchObjectException: no such object
    in table
    + JDK-8203281: [Windows] JComboBox change in ui when
    editor.setBorder() is called
    + JDK-8203382: Rename SystemDictionary::initialize_wk_klass to
    resolve_wk_klass
    + JDK-8203393: com/sun/jdi/JdbMethodExitTest.sh and
    JdbExprTest.sh fail due to timeout
    + JDK-8203928: [Test] Convert non-JDB scaffolding
    serviceability shell script tests to java
    + JDK-8204963: javax.swing.border.TitledBorder has a memory leak
    + JDK-8204994: SA might fail to attach to process with "Windbg
    Error: WaitForEvent failed"
    + JDK-8205534: Remove SymbolTable dependency from
    serviceability agent
    + JDK-8206309: Tier1 SA tests fail
    + JDK-8208281: java/nio/channels/
    /AsynchronousSocketChannel/Basic.java timed out
    + JDK-8209109: [TEST] rewrite com/sun/jdi shell tests to java
    version - step1
    + JDK-8209332: [TEST] test/jdk/com/sun/jdi/CatchPatternTest.sh
    is incorrect
    + JDK-8209342: Problemlist SA tests on Solaris due to Error
    attaching to process: Can't create thread_db agent!
    + JDK-8209343: Test javax/swing/border/TestTitledBorderLeak.java
    should be marked as headful
    + JDK-8209517: com/sun/jdi/BreakpointWithFullGC.java fails with
    timeout
    + JDK-8209604: [TEST] rewrite com/sun/jdi shell tests to java
    version - step2
    + JDK-8209605: com/sun/jdi/BreakpointWithFullGC.java fails with
    ZGC
    + JDK-8209608: Problem list com/sun/jdi/BreakpointWithFullGC.java
    + JDK-8210131: vmTestbase/nsk/jvmti/scenarios/allocation/AP10/
    /ap10t001/TestDescription.java failed with ObjectFree:
    GetCurrentThreadCpuTimerInfo returned unexpected error code
    + JDK-8210243: [TEST] rewrite com/sun/jdi shell tests to java
    version - step3
    + JDK-8210527: JShell: NullPointerException in
    jdk.jshell.Eval.translateExceptionStack
    + JDK-8210560: [TEST] convert com/sun/jdi redefineClass-related
    tests
    + JDK-8210725: com/sun/jdi/RedefineClearBreakpoint.java fails
    with waitForPrompt timed out after 60 seconds
    + JDK-8210748: [TESTBUG] lib.jdb.Jdb.waitForPrompt() should
    clarify which output is the pending reply after a timeout
    + JDK-8210760: [TEST] rewrite com/sun/jdi shell tests to java
    version - step4
    + JDK-8210977: jdk/jfr/event/oldobject/TestThreadLocalLeak.java
    fails to find ThreadLocalObject
    + JDK-8211292: [TEST] convert com/sun/jdi/DeferredStepTest.sh
    test
    + JDK-8211694: JShell: Redeclared variable should be reset
    + JDK-8212200: assert when shared java.lang.Object is redefined
    by JVMTI agent
    + JDK-8212629: [TEST] wrong breakpoint in
    test/jdk/com/sun/jdi/DeferredStepTest
    + JDK-8212665: com/sun/jdi/DeferredStepTest.java: jj1 (line 57)
  - unexpected. lastLine=52, minLine=52, maxLine=55
    + JDK-8212807: tools/jar/multiRelease/Basic.java times out
    + JDK-8213182: Minimal VM build failure after JDK-8212200
    (assert when shared java.lang.Object is redefined by JVMTI
    agent)
    + JDK-8213214: Set -Djava.io.tmpdir= when running tests
    + JDK-8213275: ReplaceCriticalClasses.java fails with
    jdk.internal.vm.PostVMInitHook not found
    + JDK-8213574: Deadlock in string table expansion when dumping
    lots of CDS classes
    + JDK-8213703: LambdaConversionException: Invalid receiver type
    not a subtype of implementation type interface
    + JDK-8214074: Ghash optimization using AVX instructions
    + JDK-8214491: Upgrade to JLine 3.9.0
    + JDK-8214797: TestJmapCoreMetaspace.java timed out
    + JDK-8215243: JShell tests failing intermitently with
    "Problem cleaning up the following threads:"
    + JDK-8215244: jdk/jshell/ToolBasicTest.java
    testHistoryReference failed
    + JDK-8215354: x86_32 build failures after JDK-8214074 (Ghash
    optimization using AVX instructions)
    + JDK-8215438: jshell tool: Ctrl-D causes EOF
    + JDK-8216021: RunTest.gmk might set concurrency level to 1 on
    Windows
    + JDK-8216974: HttpConnection not returned to the pool after
    204 response
    + JDK-8218948: SimpleDateFormat :: format - Zone Names are not
    reflected correctly during run time
    + JDK-8219712: code_size2 (defined in stub_routines_x86.hpp) is
    too small on new Skylake CPUs
    + JDK-8220150: macos10.14 Mojave returns anti-aliased glyphs
    instead of aliased B&amp;W glyphs
    + JDK-8221658: aarch64: add necessary predicate for ubfx
    patterns
    + JDK-8221759: Crash when completing "java.io.File.path"
    + JDK-8221918: runtime/SharedArchiveFile/serviceability/
    /ReplaceCriticalClasses.java fails: Shared archive not found
    + JDK-8222074: Enhance auto vectorization for x86
    + JDK-8222079: Don't use memset to initialize fields decode_env
    constructor in disassembler.cpp
    + JDK-8222769: [TESTBUG] TestJFRNetworkEvents should not rely
    on hostname command
    + JDK-8223688: JShell: crash on the instantiation of raw
    anonymous class
    + JDK-8223777: In posix_spawn mode, failing to exec()
    jspawnhelper does not result in an error
    + JDK-8223940: Private key not supported by chosen signature
    algorithm
    + JDK-8224184: jshell got IOException at exiting with AIX
    + JDK-8224234: compiler/codegen/TestCharVect2.java fails in
    test_mulc
    + JDK-8225037: java.net.JarURLConnection::getJarEntry() throws
    NullPointerException
    + JDK-8225625: AES Electronic Codebook (ECB) encryption and
    decryption optimization using AVX512 + VAES instructions
    + JDK-8226536: Catch OOM from deopt that fails rematerializing
    objects
    + JDK-8226575: OperatingSystemMXBean should be made container
    aware
    + JDK-8226697: Several tests which need the @key headful
    keyword are missing it.
    + JDK-8226809: Circular reference in printed stack trace is not
    correctly indented &amp; ambiguous
    + JDK-8227059: sun/security/tools/keytool/
    /DefaultSignatureAlgorithm.java timed out
    + JDK-8227269: Slow class loading when running with JDWP
    + JDK-8227595: keytool/fakegen/DefaultSignatureAlgorithm.java
    fails due to "exitValue = 6"
    + JDK-8228448: Jconsole can't connect to itself
    + JDK-8228967: Trust/Key store and SSL context utilities for
    tests
    + JDK-8229378: jdwp library loader in linker_md.c quietly
    truncates on buffer overflow
    + JDK-8229815: Upgrade Jline to 3.12.1
    + JDK-8230000: some httpclients testng tests run zero test
    + JDK-8230002: javax/xml/jaxp/unittest/transform/
    /SecureProcessingTest.java runs zero test
    + JDK-8230010: Remove jdk8037819/BasicTest1.java
    + JDK-8230094: CCE in createXMLEventWriter(Result) over an
    arbitrary XMLStreamWriter
    + JDK-8230402: Allocation of compile task fails with assert:
    "Leaking compilation tasks?"
    + JDK-8230767: FlightRecorderListener returns null recording
    + JDK-8230870: (zipfs) Add a ZIP FS test that is similar to
    test/jdk/java/util/zip/EntryCount64k.java
    + JDK-8231209: [REDO] ThreadMXBean::getThreadAllocatedBytes()
    can be quicker for self thread
    + JDK-8231586: enlarge encoding space for OopMapValue offsets
    + JDK-8231953: Wrong assumption in assertion in
    oop::register_oop
    + JDK-8231968: getCurrentThreadAllocatedBytes default
    implementation s/b getThreadAllocatedBytes
    + JDK-8232083: Minimal VM is broken after JDK-8231586
    + JDK-8232161: Align some one-way conversion in MS950 charset
    with Windows
    + JDK-8232855: jshell missing word in /help help
    + JDK-8233027: OopMapSet::all_do does oms.next() twice during
    iteration
    + JDK-8233228: Disable weak named curves by default in TLS,
    CertPath, and Signed JAR
    + JDK-8233386: Initialize NULL fields for unused decorations
    + JDK-8233452: java.math.BigDecimal.sqrt() with
    RoundingMode.FLOOR results in incorrect result
    + JDK-8233686: XML transformer uses excessive amount of memory
    + JDK-8233741: AES Countermode (AES-CTR) optimization using
    AVX512 + VAES instructions
    + JDK-8233829: javac cannot find non-ASCII module name under
    non-UTF8 environment
    + JDK-8233958: Memory retention due to HttpsURLConnection
    finalizer that serves no purpose
    + JDK-8234011: (zipfs) Memory leak in
    ZipFileSystem.releaseDeflater()
    + JDK-8234058: runtime/CompressedOops/
    /CompressedClassPointers.java fails with 'Narrow klass base:
    0x0000000000000000' missing from stdout/stderr
    + JDK-8234149: Several regression tests do not dispose Frame at
    end
    + JDK-8234347: "Turkey" meta time zone does not generate
    composed localized names
    + JDK-8234385: [TESTBUG] java/awt/EventQueue/6980209/
    /bug6980209.java fails in linux nightly
    + JDK-8234535: Cross compilation fails due to missing CFLAGS
    for the BUILD_CC
    + JDK-8234541: C1 emits an empty message when it inlines
    successfully
    + JDK-8234687: change javap reporting on unknown attributes
    + JDK-8236464: SO_LINGER option is ignored by SSLSocket in JDK
    11
    + JDK-8236548: Localized time zone name inconsistency between
    English and other locales
    + JDK-8236617: jtreg test containers/docker/
    /TestMemoryAwareness.java fails after 8226575
    + JDK-8237182: Update copyright header for shenandoah and
    epsilon files
    + JDK-8237888: security/infra/java/security/cert/
    /CertPathValidator/certification/LuxTrustCA.java fails when
    checking validity interval
    + JDK-8237977: Further update
    javax/net/ssl/compatibility/Compatibility.java
    + JDK-8238270: java.net HTTP/2 client does not decrease stream
    count when receives 204 response
    + JDK-8238284: [macos] Zero VM build fails due to an obvious
    typo
    + JDK-8238380: java.base/unix/native/libjava/childproc.c
    "multiple definition" link errors with GCC10
    + JDK-8238386: (sctp) jdk.sctp/unix/native/libsctp/SctpNet.c
    "multiple definition" link errors with GCC10
    + JDK-8238388: libj2gss/NativeFunc.o "multiple definition" link
    errors with GCC10
    + JDK-8238448: RSASSA-PSS signature verification fail when
    using certain odd key sizes
    + JDK-8238710: LingeredApp doesn't log stdout/stderr if exits
    with non-zero code
    + JDK-8239083: C1 assert(known_holder == NULL ||
    (known_holder-&gt;is_instance_klass() &amp;&amp;
    (!known_holder-&gt;is_interface() ||
    ((ciInstanceKlass*)known_holder)-&gt;has_nonstatic_concrete_methods())),
    "should be non-static concrete method");
    + JDK-8239385: KerberosTicket client name refers wrongly to
    sAMAccountName in AD
    + JDK-8240169: javadoc fails to link to non-modular api docs
    + JDK-8240295: hs_err elapsed time in seconds is not accurate
    enough
    + JDK-8240360: NativeLibraryEvent has wrong library name on
    Linux
    + JDK-8240676: Meet not symmetric failure when running lucene
    on jdk8
    + JDK-8241007: Shenandoah: remove
    ShenandoahCriticalControlThreadPriority support
    + JDK-8241065: Shenandoah: remove leftover code after
    JDK-8231086
    + JDK-8241086: Test runtime/NMT/HugeArenaTracking.java is
    failing on 32bit Windows
    + JDK-8241130: com.sun.jndi.ldap.EventSupport.removeDeadNotifier:
    java.lang.NullPointerException
    + JDK-8241138: http.nonProxyHosts=* causes
    StringIndexOutOfBoundsException in DefaultProxySelector
    + JDK-8241319: WB_GetCodeBlob doesn't have ResourceMark
    + JDK-8241478: vmTestbase/gc/gctests/Steal/steal001/steal001.java
    fails with OOME
    + JDK-8241574: Shenandoah: remove ShenandoahAssertToSpaceClosure
    + JDK-8241750: x86_32 build failure after JDK-8227269
    + JDK-8242184: CRL generation error with RSASSA-PSS
    + JDK-8242283: Can't start JVM when java home path includes
    non-ASCII character
    + JDK-8242556: Cannot load RSASSA-PSS public key with non-null
    params from byte array
    + JDK-8243029: Rewrite javax/net/ssl/compatibility/
    /Compatibility.java with a flexible interop test framework
    + JDK-8243138: Enhance BaseLdapServer to support starttls
    extended request
    + JDK-8243320: Add SSL root certificates to Oracle Root CA
    program
    + JDK-8243321: Add Entrust root CA - G4 to Oracle Root CA
    program
    + JDK-8243389: enhance os::pd_print_cpu_info on linux
    + JDK-8243453: java --describe-module failed with non-ASCII
    module name under non-UTF8 environment
    + JDK-8243470: [macos] bring back O2 opt level for unsafe.cpp
    + JDK-8243489: Thread CPU Load event may contain wrong data for
    CPU time under certain conditions
    + JDK-8243925: Toolkit#getScreenInsets() returns wrong value on
    HiDPI screens (Windows)
    + JDK-8244087: 2020-04-24 public suffix list update
    + JDK-8244151: Update MUSCLE PC/SC-Lite headers to the latest
    release 1.8.26
    + JDK-8244164: AArch64: jaotc generates incorrect code for
    compressed OOPs with non-zero heap base
    + JDK-8244196: adjust output in os_linux
    + JDK-8244225: stringop-overflow warning on strncpy call from
    compile_the_world_in
    + JDK-8244287: JFR: Methods samples have line number 0
    + JDK-8244703: "platform encoding not initialized" exceptions
    with debugger, JNI
    + JDK-8244719: CTW: C2 compilation fails with
    "assert(!VerifyHashTableKeys || _hash_lock == 0) failed:
    remove node from hash table before modifying it"
    + JDK-8244729: Shenandoah: remove resolve paths from
    SBSA::generate_shenandoah_lrb
    + JDK-8244763: Update --release 8 symbol information after JSR
    337 MR3
    + JDK-8244818: Java2D Queue Flusher crash while moving
    application window to external monitor
    + JDK-8245151: jarsigner should not raise duplicate warnings on
    verification
    + JDK-8245616: Bump update version for OpenJDK: jdk-11.0.9
    + JDK-8245714: "Bad graph detected in build_loop_late" when
    loads are pinned on loop limit check uncommon branch
    + JDK-8245801: StressRecompilation triggers assert "redundunt
    OSR recompilation detected. memory leak in CodeCache!"
    + JDK-8245832: JDK build make-static-libs should build all JDK
    libraries
    + JDK-8245880: Shenandoah: check class unloading flag early in
    concurrent code root scan
    + JDK-8245981: Upgrade to jQuery 3.5.1
    + JDK-8246027: Minimal fastdebug build broken after JDK-8245801
    + JDK-8246094: [macos] Sound Recording and playback is not
    working
    + JDK-8246153: TestEliminateArrayCopy fails with
  - XX:+StressReflectiveCode
    + JDK-8246193: Possible NPE in ENC-PA-REP search in AS-REQ
    + JDK-8246196: javax/management/MBeanServer/OldMBeanServerTest
    fails with AssertionError
    + JDK-8246203: Segmentation fault in verification due to stack
    overflow with -XX:+VerifyIterativeGVN
    + JDK-8246330: Add TLS Tests for Legacy ECDSA curves
    + JDK-8246453: TestClone crashes with "all collected exceptions
    must come from the same place"
    + JDK-8247246: Add explicit ResolvedJavaType.link and expose
    presence of default methods
    + JDK-8247350: [aarch64] assert(false) failed: wrong size of
    mach node
    + JDK-8247502: PhaseStringOpts crashes while optimising
    effectively dead code
    + JDK-8247615: Initialize the bytes left for the heap sampler
    + JDK-8247824: CTW: C2 (Shenandoah) compilation fails with SEGV
    in SBC2Support::pin_and_expand
    + JDK-8247874: Replacement in VersionProps.java.template not
    working when --with-vendor-bug-url contains '&amp;'
    + JDK-8247979: aarch64: missing side effect of killing flags
    for clearArray_reg_reg
    + JDK-8248214: Add paddings for TaskQueueSuper to reduce
    false-sharing cache contention
    + JDK-8248219: aarch64: missing memory barrier in
    fast_storefield and fast_accessfield
    + JDK-8248348: Regression caused by the update to BCEL 6.0
    + JDK-8248385: [testbug][11u] Adapt TestInitiExceptions to
    jtreg 5.1
    + JDK-8248495: [macos] zerovm is broken due to libffi headers
    location
    + JDK-8248851: CMS: Missing memory fences between free chunk
    check and klass read
    + JDK-8248987: AOT's Linker.java seems to eagerly fail-fast on
    Windows
    + JDK-8249159: Downport test rework for SSLSocketTemplate from
    8224650
    + JDK-8249215: JFrame::setVisible crashed with
  - Dfile.encoding=UTF-8 on Japanese Windows.
    + JDK-8249251: [dark_mode ubuntu 20.04] The selected menu is
    not highlighted in GTKLookAndFeel
    + JDK-8249255: Build fails if source code in cygwin home dir
    + JDK-8249277: TestVerifyIterativeGVN.java is failing with
    timeout in OpenJDK 11
    + JDK-8249278: Revert JDK-8226253 which breaks the spec of
    AccessibleState.SHOWING for JList
    + JDK-8249560: Shenandoah: Fix racy GC request handling
    + JDK-8249801: Shenandoah: Clear soft-refs on requested GC cycle
    + JDK-8249953: Shenandoah: gc/shenandoah/mxbeans tests should
    account for corner cases
    + JDK-8250582: Revert Principal Name type to NT-UNKNOWN when
    requesting TGS Kerberos tickets
    + JDK-8250609: C2 crash in IfNode::fold_compares
    + JDK-8250627: Use -XX:+/-UseContainerSupport for
    enabling/disabling Java container metrics
    + JDK-8250755: Better cleanup for
    jdk/test/javax/imageio/plugins/shared/CanWriteSequence.java
    + JDK-8250787: Provider.put no longer registering aliases in
    FIPS env
    + JDK-8250826: jhsdb does not work with coredump which comes
    from Substrate VM
    + JDK-8250827: Shenandoah: needs to reset/finish StringTable's
    dead count before/after parallel walk
    + JDK-8250844: Make sure {type,obj}ArrayOopDesc accessors check
    the bounds
    + JDK-8251117: Cannot check P11Key size in P11Cipher and
    P11AEADCipher
    + JDK-8251354: Shenandoah: Fix jdk/jfr/tool/TestPrintJSON.java
    test failure
    + JDK-8251451: Shenandoah: Remark ObjectSynchronizer roots with
    I-U
    + JDK-8251469: Better cleanup for
    test/jdk/javax/imageio/SetOutput.java
    + JDK-8251487: Shenandoah: missing detail timing tracking for
    final mark cleaning phase
    + JDK-8252120: compiler/oracle/TestCompileCommand.java
    misspells "occured"
    + JDK-8252157: JDK-8231209 11u backport breaks jmm binary
    compatibility
    + JDK-8252258: [11u] JDK-8242154 changes the default vendor
    + JDK-8252804: [test] Fix 'ReleaseDeflater.java' test after
    downport of 8234011
    + JDK-8253134: JMM_VERSION should remain at 0x20020000 (JDK 10)
    in JDK 11
    + JDK-8253283: [11u] Test build/translations/
    /VerifyTranslations.java failing after JDK-8252258
    + JDK-8253813: Backout JDK-8244287 from 11u: it causes several
    crashes
- Removed patch:
  * gcc-fno-common-fix.patch
    + not needed any more with this version
- Added patch:
  * JDK-8250861.patch
    + Fix regression "8250861: Crash in MinINode::Ideal(PhaseGVN*,
    bool)" introduced in jdk 11.0.9</changelog>
  <changelog author="fstrba@suse.com" date="1604491200">- Enable Sheandoah GC for x86_64 (jsc#ECO-3171)</changelog>
  <changelog author="fstrba@suse.com" date="1605528000">- Update to upstream tag jdk-11.0.9.1-1
  * Fix:
    + JDK-8250861: Crash in MinINode::Ideal(PhaseGVN*, bool)
- Removed patch:
  * JDK-8250861.patch
    + Integrated upstream</changelog>
  <changelog author="fstrba@suse.com" date="1611230400">- Update to upstream tag jdk-11.0.10+9 (January 2021 CPU,
  bsc#1181239)
  * Security fixes
    + JDK-8247619: Improve Direct Buffering of Characters
  * Other changes
    + JDK-6722928: Support SSPI as a native GSS-API provider
    + JDK-7185258: [macosx] Deadlock in SunToolKit.realSync()
    + JDK-8152332: [macosx] JFileChooser cannot be serialized on
    Mac OS X
    + JDK-8161684: [testconf] Add VerifyOops' testing into compiler
    tiers
    + JDK-8171279: Support X25519 and X448 in TLS
    + JDK-8173361: various crashes in
    JvmtiExport::post_compiled_method_load
    + JDK-8173658: JvmtiExport::post_class_unload() is broken for
    non-JavaThread initiators
    + JDK-8191006: hsdis disassembler plugin does not compile with
    binutils 2.29+
    + JDK-8197981: Missing return statement in
    __sync_val_compare_and_swap_8
    + JDK-8198334: java/awt/FileDialog/8003399/bug8003399.java
    fails in headless mode
    + JDK-8200151: Add 8 JNDI tests to com/sun/jndi/dns/ConfigTests/
    + JDK-8208279: Add 8 JNDI tests to com/sun/jndi/dns/EnvTests/
    + JDK-8208483: Add 5 JNDI tests to
    com/sun/jndi/dns/FactoryTests/
    + JDK-8208542: Add 4 JNDI tests to com/sun/jndi/dns/ListTests/
    + JDK-8208665: Amend cross-compilation docs with
    qemu-debootstrap recipe
    + JDK-8210088: ProblemList gc/epsilon/TestMemoryMXBeans.java
    + JDK-8210339: Add 10 JNDI tests to com/sun/jndi/dns/FedTests/
    + JDK-8211450: UndetVar::dup is not copying the kind field to
    the duplicated instance
    + JDK-8212160: JVMTI agent crashes with "assert(_value != 0LL)
    failed: resolving NULL _value"
    + JDK-8212226: SurfaceManager throws "Invalid Image variant"
    for MultiResolutionImage (Windows)
    + JDK-8213400: Support choosing group name in keytool keypair
    generation
    + JDK-8213535: Windows HiDPI html lightweight tooltips are
    truncated
    + JDK-8213698: Improve devkit creation and add support for
    linux/ppc64/ppc64le/s390x
    + JDK-8214025: assert(t-&gt;singleton()) failed: must be a
    constant when ScavengeRootsInCode &lt; 2
    + JDK-8214242: compiler/arguments/TestScavengeRootsInCode.java
    fails because of missing UnlockDiagnosticVMOptions
    + JDK-8214787: Zero builds fail with "undefined
    JavaThread::thread_state()"
    + JDK-8215583: Exclude
    runtime/handshake/HandshakeWalkSuspendExitTest.java
    + JDK-8216012: Infinite loop in RSA KeyPairGenerator
    + JDK-8216324: GetClassMethods is confused by the presence of
    default methods in super interfaces
    + JDK-8217429: WebSocket over authenticating proxy fails to
    send Upgrade headers
    + JDK-8217976: test/jdk/java/net/httpclient/websocket/
    /WebSocketProxyTest.java fails intermittently
    + JDK-8218021: Have jarsigner preserve posix permission
    attributes
    + JDK-8218287: jshell tool: input behavior unstable after
    12-ea+24 on Windows
    + JDK-8218851: JVM crash in custom classloader stress test, JDK
    12 &amp; 13
    + JDK-8220420: Cleanup c1_LinearScan
    + JDK-8222072: JVMTI GenerateEvents() sends CompiledMethodLoad
    events to wrong jvmtiEnv
    + JDK-8222286: Fix for JDK-8213419 is broken on s390
    + JDK-8222527: HttpClient doesn't send HOST header when
    tunelling HTTP/1.1 through http proxy
    + JDK-8222533: jtreg test jdk/internal/platform/cgroup/
    /TestCgroupMetrics.java fails on SLES12.3 linux ppc64le
    machine
    + JDK-8224506: [TESTBUG] TestDockerMemoryMetrics.java fails
    with exitValue = 137
    + JDK-8224555: vmTestbase/nsk/jvmti/scenarios/contention/TC02/
    /tc02t001/TestDescription.java failed
    + JDK-8224650: Add tests to support X25519 and X448 in TLS
    + JDK-8225072: Add LuxTrust certificate that is expiring in
    March 2021 to list of allowed but expired certs
    + JDK-8225329: -XX:+PrintBiasedLockingStatistics causes crash
    during initialization on Windows platforms
    + JDK-8225687: Newly added sspi.cpp in JDK-6722928 still
    contains some small errors
    + JDK-8227006: [linux] Runtime.availableProcessors execution
    time increased by factor of 100
    + JDK-8227275: Within native OOM error handling, assertions may
    hang the process
    + JDK-8227647: [Graal] Test8009761.java fails due to
    "RuntimeException: static java.lang.Object
    compiler.uncommontrap.Test8009761.m3(boolean,boolean) not
    compiled"
    + JDK-8229495: SIGILL in C2 generated OSR compilation
    + JDK-8230910: libsspi_bridge does not build on Windows 32bit
    + JDK-8232114: JVM crashed at imjpapi.dll in native code
    + JDK-8234147: Avoid looking up standard charsets in core
    libraries
    + JDK-8234393: [macos] printing ignores printer tray
    + JDK-8234863: Increase default value of MaxInlineLevel
    + JDK-8235218: Minimal VM is broken after JDK-8173361
    + JDK-8235456: Minimal VM is broken after JDK-8212160
    + JDK-8235829: graal crashes with Zombie.java test
    + JDK-8236124: Minimal VM slowdebug build failed after
    JDK-8212160
    + JDK-8236512: PKCS11 Connection closed after Cipher.doFinal
    and NoPadding
    + JDK-8236944: The legVecZ operand should be limited to
    zmm0-zmm15 registers
    + JDK-8237186: Fix typo in copyright header of
    java/io/Reader/TransferTo.java
    + JDK-8237499: JFR: Include stack trace in the ThreadStart event
    + JDK-8237512: AArch64: aarch64TestHook leaks a BufferBlob
    + JDK-8237524: AArch64: String.compareTo() may return incorrect
    result
    + JDK-8237950: C2 compilation fails with "Live Node limit
    exceeded limit" during ConvI2L::Ideal optimization
    + JDK-8238579: HttpsURLConnection drops the timeout and hangs
    forever in read
    + JDK-8239105: Add exception for expiring Digicert root
    certificates to VerifyCACerts test
    + JDK-8239477: jdk/jfr/jcmd/TestJcmdStartStopDefault.java fails
  - XX:+VerifyOops with "verify_oop: rsi: broken oop"
    + JDK-8239497: SEGV in EdgeUtils::field_name_symbol(Edge const&amp;)
    + JDK-8239886: Minimal VM build fails after JDK-8237499
    + JDK-8240633: Memory leaks in the implementations of
    FileChooserUI
    + JDK-8240690: Race condition between EDT and
    BasicDirectoryModel.FilesLoader.run0()
    + JDK-8241234: Unify monitor enter/exit runtime entries.
    + JDK-8241311: Move some charset mapping tests from closed to
    open
    + JDK-8241797: Add some tests to the problem list
    + JDK-8242029: AArch64: skip G1 array copy pre-barrier if
    marking not active
    + JDK-8242335: Additional Tests for RSASSA-PSS
    + JDK-8242480: Negative value may be returned by
    getFreeSwapSpaceSize() in the docker
    + JDK-8242614: cleanup duplicated test ldap server in some
    com/sun/jndi/ldap/ tests
    + JDK-8242846: Bring back test/jdk/tools/jlink/plugins/
    /OrderResourcesPluginTest.java
    + JDK-8243114: Implement montgomery{Multiply,Square}intrinsics
    on Windows
    + JDK-8243290: Improve diagnostic messages for class
    verification and redefinition failures
    + JDK-8243488: Add tests for set/get SendBufferSize and
    getReceiveBufferSize in DatagramSocket
    + JDK-8243549: sun/security/ssl/CipherSuite/
    /NamedGroupsWithCipherSuite.java failed with Unsupported
    signature algorithm: DSA
    + JDK-8243617: compiler/onSpinWait/TestOnSpinWaitC1.java test
    uses wrong class
    + JDK-8243619: compiler/codecache/CheckSegmentedCodeCache.java
    test misses -version
    + JDK-8244142: some hotspot/runtime tests don't check exit code
    of forked JVM
    + JDK-8244278: Excessive code cache flushes and sweeps
    + JDK-8244282: test/hotspot/jtreg/compiler/intrinsics/
    /Test8237524.java fails with --illegal-access=deny
    + JDK-8244621: [macos10.15] Garbled FX printing plus CoreText
    warnings on Catalina when building with Xcode 11
    + JDK-8244819: hsdis does not compile with binutils 2.34+
    + JDK-8245051: c1 is broken if it is compiled by gcc without
  - fno-lifetime-dse
    + JDK-8245168: jlink should not be treated as a "small" tool
    + JDK-8245400: Upgrade to LittleCMS 2.11
    + JDK-8246381: VM crashes with "Current BasicObjectLock* below
    than low_mark"
    + JDK-8246434: Threads::print_on_error assumes that the heap
    has been set up
    + JDK-8246648: issue with OperatingSystemImpl
    getFreeSwapSpaceSize in docker after 8242480
    + JDK-8247201: Print potential pointer value of readable stack
    memory in hs_err file
    + JDK-8247763: assert(outer-&gt;outcnt() == 2) failed: 'only phis'
    failure in LoopNode::verify_strip_mined()
    + JDK-8247867: Upgrade to freetype 2.10.2
    + JDK-8248190: Enable Power10 system and implement new
    byte-reverse instructions
    + JDK-8248226: TestCloneAccessStressGCM fails with
  - XX:-ReduceBulkZeroing
    + JDK-8248347: windows build broken by JDK-8243114
    + JDK-8248532: Every time I change keyboard language at my
    MacBook, Java crashes
    + JDK-8248552: C2 crashes with SIGFPE due to division by zero
    + JDK-8248596: [TESTBUG] compiler/loopopts/
    /PartialPeelingUnswitch.java times out with Graal enabled
    + JDK-8248745: Add jarsigner and keytool tests for restricted
    algorithms
    + JDK-8248791: sun/util/resources/cldr/TimeZoneNamesTest.java
    fails with -XX:-ReduceInitialCardMarks -XX:-ReduceBulkZeroing
    + JDK-8248845: AArch64: stack corruption after spilling vector
    register
    + JDK-8249176: Update GlobalSignR6CA test certificates
    + JDK-8249183: JVM crash in "AwtFrame::WmSize" method
    + JDK-8249192: MonitorInfo stores raw oops across safepoints
    + JDK-8249602: C2: assert(cnt == _outcnt) failed: no insertions
    allowed
    + JDK-8249603: C1: assert(has_error == false) failed: register
    allocation invalid
    + JDK-8249605: C2: assert(no_dead_loop) failed: dead loop
    detected
    + JDK-8249607: C2: assert(!had_error) failed: bad dominance
    + JDK-8249608: Vector register used by C2 compiled method
    corrupted at safepoint
    + JDK-8249672: Include microcode revision in features_string on
    x86
    + JDK-8249748: gtest silently ignores bad jvm arguments
    + JDK-8249821: Separate libharfbuzz from libfontmanager
    + JDK-8250598: Hyper-V is detected in spite of running on host
    OS
    + JDK-8250605: Linux x86_32 builds fail after JDK-8249821
    + JDK-8250636: iso8601_time returns incorrect offset part on
    MacOS
    + JDK-8250665: Wrong translation for the month name of May in
    ar_JO,LB,SY
    + JDK-8250772: Test com/sun/jndi/ldap/
    /NamingExceptionMessageTest.java fails intermittently with
    javax.naming.ServiceUnavailableException
    + JDK-8250825: C2 crashes with assert(field != __null) failed:
    missing field
    + JDK-8250894: Provide a configure option to build and run
    against the platform libharfbuzz
    + JDK-8250928: JFR: Improve hash algorithm for stack traces
    + JDK-8250968: Symlinks attributes not preserved when using
    jarsigner on zip files
    + JDK-8250984: Memory Docker tests fail on some Linux kernels
    w/o cgroupv1 swap limit capabilities
    + JDK-8251118: BiasedLocking::preserve_marks should not have a
    HandleMark
    + JDK-8251189: com/sun/jndi/ldap/LdapDnsProviderTest.java
    failed due to timeout
    + JDK-8251257: NMT: jcmd VM.native_memory scale=1 crashes
    target VM
    + JDK-8251365: Build failure on AIX after 8250636
    + JDK-8251397: NPE on ClassValue.ClassValueMap.cacheArray
    + JDK-8251456: [TESTBUG] compiler/vectorization/
    /TestVectorsNotSavedAtSafepoint.java failed OutOfMemoryError
    + JDK-8251458: Parse::do_lookupswitch fails with "assert(_cnt
    &gt;= 0) failed"
    + JDK-8251535: Partial peeling at unsigned test adds incorrect
    loop exit check
    + JDK-8251949: ZGC: Set explicit heap size for
    compiler/gcbarriers tests
    + JDK-8252090: JFR: StreamWriterHost::write_unbuffered() stucks
    in an infinite loop OpenJDK (build 13.0.1+9)
    + JDK-8252415: Bump update version for OpenJDK: jdk-11.0.10
    + JDK-8252470: java/awt/dnd/DisposeFrameOnDragCrash/
    /DisposeFrameOnDragTest.java fails on Windows
    + JDK-8252497: Incorrect numeric currency code for ROL
    + JDK-8252660: Shenandoah: support manageable SoftMaxHeapSize
    option
    + JDK-8252679: Two windows specific FileDIalog tests may fail
    on some Windows_Server_2016_Standard
    + JDK-8252696: Loop unswitching may cause out of bound array
    load to be executed
    + JDK-8252754: Hash code calculation of JfrStackTrace is
    inconsistent
    + JDK-8253219: Epsilon: clean up unnecessary includes
    + JDK-8253224: Shenandoah: ShenandoahStrDedupQueue destructor
    calls virtual num_queues()
    + JDK-8253226: Shenandoah: remove unimplemented
    ShenandoahStrDedupQueue::verify
    + JDK-8253269: The CheckCommonColors test should provide more
    info on failure
    + JDK-8253284: Zero OrderAccess barrier mappings are incorrect
    + JDK-8253375: OSX build fails with Xcode 12.0 (12A7209)
    + JDK-8253778: ShenandoahSafepoint::is_at_shenandoah_safepoint
    should not access VMThread state from other threads
    + JDK-8253791: Issue with useAppleColor check in CSystemColors.m
    + JDK-8254016: Test8237524 fails with -XX:-CompactStrings option
    + JDK-8254081: java/security/cert/PolicyNode/
    /GetPolicyQualifiers.java fails due to an expired certificate
    + JDK-8254144: Non-x86 Zero builds fail with return-type
    warning in os_linux_zero.cpp
    + JDK-8254166: Zero: return-type warning in
    zeroInterpreter_zero.cpp
    + JDK-8254177: (tz) Upgrade time-zone data to tzdata2020b
    + JDK-8254185: Fix Code cache sweeper heuristics for JDK 11
    + JDK-8254190: [s390] interpreter misses exception check after
    calling monitorenter
    + JDK-8254790: SIGSEGV in string_indexof_char and
    stringL_indexof_char intrinsics
    + JDK-8254854: [cgroups v1] Metric limits not properly detected
    on some join controller combinations
    + JDK-8254982: (tz) Upgrade time-zone data to tzdata2020c
    + JDK-8255050: Add pkcs11/KeyStore/ClientAuth.sh to Problem list
    + JDK-8255065: Zero: accessor_entry misses the IRIW case
    + JDK-8255226: (tz) Upgrade time-zone data to tzdata2020d
    + JDK-8255269: Unsigned overflow in g1Policy.cpp
    + JDK-8255365: Problem list failing client manual tests
    + JDK-8255457: Shenandoah: cleanup ShenandoahMarkTask
    + JDK-8255466: C2 crashes at ciObject::get_oop() const+0x0
    + JDK-8255550: x86: Assembler::cmpq(Address dst, Register src)
    encoding is incorrect
    + JDK-8255603: Memory/Performance regression after JDK-8210985
    + JDK-8255760: Shenandoah: match constants style in
    ShenandoahMarkTask fallback
    + JDK-8255781: Bump patch update version for OpenJDK:
    jdk-11.0.9.1
    + JDK-8255937: Better cleanup for
    test/jdk/javax/imageio/stream/StreamFlush.java
    + JDK-8256427: Test com/sun/jndi/dns/ConfigTests/
    /PortUnreachable.java does not work on AIX
    + JDK-8256452: Integrate missing part of JDK-8232370 to 11u
    + JDK-8256483: [TESTBUG] serviceability/jvmti/GetClassMethods/
    /libOverpassMethods.c fails to compile on gcc 4.4.x
    + JDK-8256557: libharfbuzz fails to link on gcc 4.4.x due to
  - Wl,-z,defs
    + JDK-8256618: Zero: Linux x86_32 build still fails
    + JDK-8256736: Zero: GTest tests fail with "unsuppported vm
    variant"
    + JDK-8256809: Annotation processing causes NPE during flow
    analysis
    + JDK-8257181: s390x builds are very noisy with gc-sections
    messages
    + JDK-8257242: [macOS] Java app crashes while switching input
    methods
    + JDK-8257545: SunJSSE FIPS regression in key exchange after
    JDK-8171279 11u backport
    + JDK-8257641: Shenandoah: Query is_at_shenandoah_safepoint()
    from control thread should return false
    + JDK-8257701: Shenandoah: objArrayKlass metadata is not marked
    with chunked arrays
    + JDK-8258630: Add expiry exception for QuoVadis root
    certificate
- New upstream dependency on libharfbuzz
- Regenerated patches: missing-return.patch system-pcsclite.patch</changelog>
  <changelog author="fstrba@suse.com" date="1616155200">- Added patches:
  * system-crypto-policy.patch
    + Let OpenJDK use system crypto policies unless explicitely told
    not to
  * nss-security-provider.patch
    + Add the NSS security provider with configuration in generated
    nss.cfg file
  * keytool-default-rsa.patch
    + Make keytool generate RSA keys by default, since only the
    LEGACY system crypto policy allows DSA</changelog>
  <changelog author="pujos.michael@gmail.com" date="1618488000">- moved mozilla-nss dependency to java-11-openjdk-headless package
  This is necessary to be able to do crypto with just
  java-11-openjdk-headless installed. Fixes boo#1184606</changelog>
  <changelog author="fstrba@suse.com" date="1619006400">- Update to upstream tag jdk-11.0.11+9 (April 2021, CPU)
  * Security fixes
    + JDK-8244473: Contextualize registration for JNDI
    + JDK-8244543: Enhanced handling of abstract classes
    + JDK-8249906, CVE-2021-2163, bsc#1185055: Enhance opening JARs
    + JDK-8250568, CVE-2021-2161, bsc#1185056: Less ambiguous
    processing
    + JDK-8253799: Make lists of normal filenames
    + JDK-8257001: Improve Http Client Support
  * Other changes
    + JDK-7107012: sun.jvm.hotspot.code.CompressedReadStream
    readDouble() conversion to long mishandled
    + JDK-7146776: deadlock between URLStreamHandler.getHostAddress
    and file.Handler.openconnection
    + JDK-8086003: Test fails on OSX with java.lang.RuntimeException
    'Narrow klass base: 0x0000000000000000, Narrow klass shift: 3'
    missing
    + JDK-8168869: jdeps: localized messages don't use proper line
    breaks
    + JDK-8180837: SunPKCS11-NSS tests failing with
    CKR_ATTRIBUTE_READ_ONLY and CKR_MECHANISM_PARAM_INVALID
    + JDK-8202343: Disable TLS 1.0 and 1.1
    + JDK-8205992: jhsdb cannot attach to Java processes running in
    Docker containers
    + JDK-8209193: Fix aarch64-linux compilation after -Wreorder
    changes
    + JDK-8210413: AArch64: Optimize div/rem by constant in C1
    + JDK-8210578: AArch64: Invalid encoding for fmlsvs instruction
    + JDK-8211051: jdeps usage of --dot-output doesn't provide
    valid output for modular jar
    + JDK-8211057: Gensrc step CompileProperties generates unstable
    CompilerProperties output
    + JDK-8211150: G1 Full GC not purging code root memory and
    hence causing memory leak
    + JDK-8211825: ModuleLayer.defineModulesWithXXX does not setup
    delegation when module reads automatic module
    + JDK-8212043: Add floating-point Math.min/max intrinsics
    + JDK-8212218: [TESTBUG] runtime/ErrorHandling/
    /TestHeapDumpOnOutOfMemoryErrorInMetaspace.java timed out
    + JDK-8213116: javax/swing/JComboBox/WindowsComboBoxSize/
    /WindowsComboBoxSizeTest.java fails in Windows
    + JDK-8213909: jdeps --print-module-deps should report missing
    dependences
    + JDK-8214180: Need better granularity for sleeping
    + JDK-8214223: tools/jdeps/listdeps/ListModuleDeps.java failed
    due to missing Lib2 file
    + JDK-8214230: Classes generated by SystemModulesPlugin.java
    are not reproducable
    + JDK-8214741: docs/index.html has no title or copyright
    + JDK-8215687: [Graal] unit test CheckGraalIntrinsics failed
    after 8212043
    + JDK-8217848: [Graal] vmTestbase/nsk/jvmti/ResourceExhausted/
    /resexhausted003/TestDescription.java fails
    + JDK-8218482: sun/security/krb5/auto/ReplayCachePrecise.java
    failed - no KrbException thrown
    + JDK-8218550: Add test omitted from JDK-8212043
    + JDK-8221584: SIGSEGV in os::PlatformEvent::unpark() in
    JvmtiRawMonitor::raw_exit while posting method exit event
    + JDK-8221995: AARCH64: problems with CAS instructions encoding
    + JDK-8222518: Remove unnecessary caching of Parker object in
    java.lang.Thread
    + JDK-8222785: aarch64: add necessary masking for immediate
    shift counts
    + JDK-8223186: HotSpot compile warnings from GCC 9
    + JDK-8225773: jdeps --check produces NPE if there are missing
    module dependences
    + JDK-8225805: Java Access Bridge does not close the logger
    + JDK-8226810: Failed to launch JVM because of
    NullPointerException occured on System.props
    + JDK-8229396: jdeps ignores multi-release when
    generate-module-info used on command line
    + JDK-8229474: Shenandoah: Cleanup CM::update_roots()
    + JDK-8232225: Rework the fix for JDK-8071483
    + JDK-8232905: JFR fails with assertion:
    assert(t-&gt;unflushed_size() == 0) failed: invariant
    + JDK-8233164: C2 fails with assert(phase-&gt;C-&gt;get_alias_index(t)
    == phase-&gt;C-&gt;get_alias_index(t_adr)) failed: correct memory
    chain
    + JDK-8233910: java/awt/ColorClass/AlphaColorTest.java is
    failing  intermittently in nightly lnux-x64 system
    + JDK-8233912: aarch64: minor improvements of atomic operations
    + JDK-8234508: VM_HeapWalkOperation::iterate_over_object reads
    non-strong fields with an on-strong load barrier
    + JDK-8234742: Improve handshake logging
    + JDK-8234796: Refactor Handshake::execute to take a more
    complex type than ThreadClosure
    + JDK-8235324: Dying objects are published from users of
    CollectedHeap::object_iterate
    + JDK-8235351: Lookup::unreflect should bind with the original
    caller independent of Method's accessible flag
    + JDK-8237369: Shenandoah: failed vmTestbase/nsk/jvmti/
    /AttachOnDemand/attach021/TestDescription.java test
    + JDK-8237392: Shenandoah: Remove unreliable assertion
    + JDK-8237483: AArch64 C1 OopMap inserted twice fatal error
    + JDK-8237495: Java MIDI fails with a dereferenced memory error
    when asked to send a raw 0xF7
    + JDK-8239355: (dc) Initial value of SO_SNDBUF should allow
    sending large datagrams (macOS)
    + JDK-8240353: AArch64: missing support for
  - XX:+ExtendedDTraceProbes in C1
    + JDK-8240704: CheckHandles.java failed "AssertionError: Handle
    use increased by more than 10 percent."
    + JDK-8240751: Shenandoah: fold ShenandoahTracer definition
    + JDK-8240795: [REDO] 8238384 CTW: C2 compilation fails with
    "assert(store != load-&gt;find_exact_control(load-&gt;in(0)))
    failed: dependence cycle found"
    + JDK-8241598: Upgrade JLine to 3.14.0
    + JDK-8241649: Optimize Character.toString
    + JDK-8241770: Module xxxAnnotation() methods throw NCDFE if
    module-info.class found as resource in unnamed module
    + JDK-8241911: AArch64: Fix a potential register clash issue in
    reduce_add2I
    + JDK-8242030: Wrong package declarations in jline classes after
    JDK-8241598
    + JDK-8242565: Policy initialization issues when the denyAfter
    constraint is enabled
    + JDK-8243618: compiler/rtm/cli tests can be run w/o WhiteBox
    + JDK-8243670: Unexpected test result caused by C2
    MergeMemNode::Ideal
    + JDK-8244088: [Regression] Switch of Gnome theme ends up in
    deadlocked UI
    + JDK-8244154: Update SunPKCS11 provider with PKCS11 v3.0 header
    files
    + JDK-8244340: Handshake processing thread lacks yielding
    + JDK-8244573: java.lang.ArrayIndexOutOfBoundsException thrown
    for malformed class file
    + JDK-8244683: A TSA server used by tests
    + JDK-8245005: javax/net/ssl/compatibility/BasicConnectTest.java
    failed with No enum constant
    + JDK-8245026: PsAdaptiveSizePolicy::_old_gen_policy_is_ready is
    unused
    + JDK-8245283: JFR: Can't handle constant dynamic used by Jacoco
    agent
    + JDK-8245512: CRC32 optimization using AVX512 instructions
    + JDK-8245527: LDAP Channel Binding support for Java
    GSS/Kerberos
    + JDK-8246707: (sc) SocketChannel.read/write throws
    AsynchronousCloseException on closed channel
    + JDK-8246709: sun/security/tools/jarsigner/
    /TsacertOptionTest.java compilation failed after JDK-8244683
    + JDK-8247200: assert((unsigned)fpargs &lt; 32)
    + JDK-8247766: [aarch64] guarantee(val &lt; (1U &lt;&lt; nbits))
    failed: Field too big for insn.
    + JDK-8248336: AArch64: C2: offset overflow in
    BoxLockNode::emit
    + JDK-8248865: Document JNDI/LDAP timeout properties
    + JDK-8248901: Signed immediate support in
    .../share/assembler.hpp is broken.
    + JDK-8249543: Force DirectBufferAllocTest to run with
  - ExplicitGCInvokesConcurrent
    + JDK-8249588: libwindowsaccessbridge issues on 64bit Windows
    + JDK-8249749: modify a primitive array through a stream and a
    for cycle causes jre crash
    + JDK-8249787: Make TestGCLocker more resilient with concurrent
    GCs
    + JDK-8249867: xml declaration is not followed by a newline
    + JDK-8250911: [windows] os::pd_map_memory() error detection
    broken
    + JDK-8251255: [linux] Add process-memory information to hs-err
    and VM.info
    + JDK-8251359: Shenandoah: filter null oops before calling
    enqueue/SATB barrier
    + JDK-8251925: C2: RenaissanceStressTest fails with
    assert(!had_error): bad dominance
    + JDK-8251944: Add Shenandoah test config to
    compiler/gcbarriers/UnsafeIntrinsicsTest.java
    + JDK-8251992: VM crashed running TestComplexAddrExpr.java test
    with -XX:UseAVX=X
    + JDK-8253220: Epsilon: clean up unused code/declarations
    + JDK-8253274: The CycleDMImagetest brokes the system
    + JDK-8253353: Crash in C2: guarantee(n != NULL) failed: No Node
    + JDK-8253368: TLS connection always receives close_notify
    exception
    + JDK-8253404: C2: assert(C-&gt;live_nodes() &lt;=
    C-&gt;max_node_limit()) failed: Live Node limit exceeded limit
    + JDK-8253409: Double-rounding possibility in float fma
    + JDK-8253476: TestUseContainerSupport.java fails on some Linux
    kernels w/o swap limit capabilities
    + JDK-8253524: C2: Refactor code that clones predicates during
    loop unswitching
    + JDK-8253644: C2: assert(skeleton_predicate_has_opaque(iff))
    failed: unexpected
    + JDK-8253681: closed java/awt/dnd/MouseEventAfterStartDragTest/
    /MouseEventAfterStartDragTest.html test failed
    + JDK-8253702: BigSur version number reported as 10.16, should
    be 11.nn
    + JDK-8253756: C2 CompilerThread0 crash in Node::add_req(Node*)
    + JDK-8254104: MethodCounters must exist before nmethod is
    installed
    + JDK-8254734: "dead loop detected" assert failure with patch
    from 8223051
    + JDK-8254748: Bad Copyright header format after JDK-8212218
    + JDK-8254799: runtime/ErrorHandling/
    /TestHeapDumpOnOutOfMemoryError.java fails with release VMs
    + JDK-8255058: C1: assert(is_virtual()) failed: type check
    + JDK-8255351: Add detection for Graviton 2 CPUs
    + JDK-8255368: Math.exp() gives wrong result for large values on
    x86 32-bit platforms
    + JDK-8255387: Japanese characters were printed upside down on
    AIX
    + JDK-8255401: Shenandoah: Allow oldval and newval registers to
    overlap in cmpxchg_oop()
    + JDK-8255479: [aarch64] assert(src-&gt;section_index_of(target) ==
    CodeBuffer::SECT_NONE) failed: sanity
    + JDK-8255544: Create a checked cast
    + JDK-8255559: Leak File Descriptors Because of
    ResolverLocalFilesystem#engineResolveURI()
    + JDK-8255681: print callstack in error case in
    runAWTLoopWithApp
    + JDK-8255734: VM should ignore SIGXFSZ on ppc64, s390 too
    + JDK-8255742: PrintInlining as compiler directive doesn't print
    virtual calls
    + JDK-8255845: Memory leak in imageFile.cpp
    + JDK-8255880: UI of Swing components is not redrawn after their
    internal state changed
    + JDK-8255908: ExceptionInInitializerError due to
    UncheckedIOException while initializing cgroupv1 subsystem
    + JDK-8256025: AArch64: MachCallRuntimeNode::ret_addr_offset()
    is incorrect for stub calls
    + JDK-8256056: Deoptimization stub doesn't save vector registers
    on x86
    + JDK-8256061: RegisterSaver::save_live_registers() omits upper
    halves of ZMM0-15 registers
    + JDK-8256187: [TEST_BUG] Automate bug4275046.java test
    + JDK-8256220: C1: x86_32 fails with -XX:UseSSE=1 after
    JDK-8210764 due to mishandled lir_neg
    + JDK-8256258: some missing NULL checks or asserts after
    CodeCache::find_blob_unsafe
    + JDK-8256264: Printed GlyphVector outline with low DPI has bad
    quality on Windows
    + JDK-8256290: javac/lambda/T8031967.java fails with
    StackOverflowError on x86_32
    + JDK-8256359: AArch64: runtime/ReservedStack/
    /ReservedStackTestCompiler.java fails
    + JDK-8256387: Unexpected result if patching an entire
    instruction on AArch64
    + JDK-8256421: Add 2 HARICA roots to cacerts truststore
    + JDK-8256488: [aarch64] Use ldpq/stpq instead of ld4/st4 for
    small copies in StubGenerator::copy_memory
    + JDK-8256489: Make gtest for long path names on Windows more
    resilient in the presence of virus scanners
    + JDK-8256501: libTestMainKeyWindow fails to build with Xcode
    12.2
    + JDK-8256633: Fix product build on Windows+Arm64
    + JDK-8256682: JDK-8202343 is incomplete
    + JDK-8256751: Incremental rebuild with precompiled header fails
    when touching a header file
    + JDK-8256757: Incorrect MachCallRuntimeNode::ret_addr_offset()
    for CallLeafNoFP on x86_32
    + JDK-8256806: Shenandoah: optimize shenandoah/jni/
    /TestPinnedGarbage.java test
    + JDK-8256807: C2: Not marking stores correctly as mismatched
    in string opts
    + JDK-8256810: Incremental rebuild broken on Macosx
    + JDK-8256818: SSLSocket that is never bound or connected leaks
    socket resources
    + JDK-8256888: Client manual test problem list update
    + JDK-8257083: Security infra test failures caused by
    JDK-8202343
    + JDK-8257408: Bump update version for OpenJDK: jdk-11.0.11
    + JDK-8257423: [PPC64] Support -XX:-UseInlineCaches
    + JDK-8257436: [aarch64] Regressions in ArrayCopyUnalignedDst
    .testByte/testChar for 65-78 bytes when UseSIMDForMemoryOps
    is on
    + JDK-8257513: C2: assert((constant_addr -
    _masm.code()-&gt;consts()-&gt;start()) == con.offset())
    + JDK-8257547: Handle multiple prereqs on the same line in deps
    files
    + JDK-8257561: Some code is not vectorized after 8251925 and
    8250607
    + JDK-8257565: epsilonBarrierSet.hpp should not include
    barrierSetAssembler
    + JDK-8257575: C2: "failed: only phis" assert failure in loop
    strip mining verification
    + JDK-8257594: C2 compiled checkcast of non-null object triggers
    endless deoptimization/recompilation cycle
    + JDK-8257633: Missing -mmacosx-version-min=X flag when linking
    libjvm
    + JDK-8257670: sun/security/ssl/SSLSocketImpl/SSLSocketLeak.java
    reports leaks
    + JDK-8257707: Fix incorrect format string in Http1HeaderParser
    + JDK-8257746: Regression introduced with JDK-8250984 - memory
    might be null in some machines
    + JDK-8257798: [PPC64] undefined reference to
    Klass::vtable_start_offset()
    + JDK-8257884: Re-enable sun/security/ssl/SSLSocketImpl/
    /SSLSocketLeak.java as automatic test
    + JDK-8257910: [JVMCI] Set exception_seen accordingly in the
    runtime.
    + JDK-8257997: sun/security/ssl/SSLSocketImpl/SSLSocketLeak.java
    again reports leaks after JDK-8257884
    + JDK-8257999: Parallel GC crash in gc/parallel/
    /TestDynShrinkHeap.java: new region is not in covered_region
    + JDK-8258077: Using -Xcheck:jni can lead to a double-free after
    JDK-8193234
    + JDK-8258247: Couple of issues in fix for JDK-8249906
    + JDK-8258373: Update the text handling in the JPasswordField
    + JDK-8258396: SIGILL in jdk.jfr.internal.PlatformRecorder
    .rotateDisk()
    + JDK-8258419: RSA cipher buffer cleanup
    + JDK-8258471: "search codecache" clhsdb command does not work
    + JDK-8258534: Epsilon: clean up unused includes
    + JDK-8258805: Japanese characters not entered by mouse click
    on Windows 10
    + JDK-8258833: Cancel multi-part cipher operations in SunPKCS11
    after failures
    + JDK-8258836: JNI local refs exceed capacity
    getDiagnosticCommandInfo
    + JDK-8258884: [TEST_BUG] Convert applet-based test
    open/test/jdk/javax/swing/JMenuItem/8031573/bug8031573.java
    to a regular java test
    + JDK-8259007: This test printed a blank page
    + JDK-8259048: (tz) Upgrade time-zone data to tzdata2020f
    + JDK-8259049: Uninitialized variable after JDK-8257513
    + JDK-8259231: Epsilon: improve performance under contention
    during virtual space expansion
    + JDK-8259271: gc/parallel/TestDynShrinkHeap.java still fails
    "assert(covered_region.contains(new_memregion)) failed: new
    region is not in covered_region"
    + JDK-8259312: VerifyCACerts.java fails as soneraclass2ca cert
    will expire in 90 days
    + JDK-8259319: Illegal package access when SunPKCS11 requires
    SunJCE's classes
    + JDK-8259339: AllocateUninitializedArray C2 intrinsic fails
    with void.class input
    + JDK-8259428: AlgorithmId.getEncodedParams() should return copy
    + JDK-8259446: runtime/jni/checked/
    /TestCheckedReleaseArrayElements.java fails with stderr not
    empty
    + JDK-8259451: Zero: skip serviceability/sa tests, set vm.hasSA
    to false
    + JDK-8259580: Shenandoah: uninitialized label in
    VerifyThreadGCState
    + JDK-8259619: C1: 3-arg StubAssembler::call_RT stack-use
    condition is incorrect
    + JDK-8259633: compiler/graalunit/CoreTest.java fails with NPE
    after JDK-8244543
    + JDK-8259706: C2 compilation fails with assert(vtable_index ==
    Method::invalid_vtable_index) failed: correct sentinel value
    + JDK-8259707: LDAP channel binding does not work with StartTLS
    extension
    + JDK-8259773: Incorrect encoding of AVX-512 kmovq instruction
    + JDK-8259849: Shenandoah: Rename store-val to IU-barrier
    + JDK-8259949: x86 32-bit build fails when -fcf-protection is
    passed in the compiler flags
    + JDK-8259954: gc/shenandoah/mxbeans tests fail with -Xcomp
    + JDK-8260029: aarch64: fix typo in verify_oop_array
    + JDK-8260308: Update LogCompilation junit to 4.13.1
    + JDK-8260338: Some fields in HaltNode is not cloned
    + JDK-8260349: Cannot programmatically retrieve Metaspace max
    set via JAVA_TOOL_OPTIONS
    + JDK-8260356: (tz) Upgrade time-zone data to tzdata2021a
    + JDK-8260378: [TESTBUG] DcmdMBeanTestCheckJni.java reports
    false positive
    + JDK-8260497: Shenandoah: Improve SATB flushing
    + JDK-8260502: [s390] NativeMovRegMem::verify() fails because
    it's too strict
    + JDK-8260632: Build failures after JDK-8253353
    + JDK-8260704: ParallelGC: oldgen expansion needs release-store
    for _end
    + JDK-8261022: Fix incorrect result of Math.abs() with char type
    + JDK-8261089: [TESTBUG] native library of test
    TestCheckedReleaseCriticalArray.java fails to compile with
    gcc 4.x
    + JDK-8261183: Follow on to Make lists of normal filenames
    + JDK-8261209: isStandalone property: remove dependency on
    pretty-print
    + JDK-8261231: Windows IME was disabled after DnD operation
    + JDK-8261251: Shenandoah: Use object size for full GC
    humongous compaction
    + JDK-8261310: PPC64 Zero build fails with
    'VMError::controlled_crash(int)::FunctionDescriptor
    functionDescriptor' has incomplete type and cannot be defined
    + JDK-8261334: NMT: tuning statistic shows incorrect hash
    distribution
    + JDK-8261413: Shenandoah: Disable class-unloading in I-U mode
    + JDK-8261522: [PPC64] AES intrinsics write beyond the
    destination array
    + JDK-8261534: Test sun/security/pkcs11/KeyAgreement/
    /IllegalPackageAccess.java fails on platforms where no nsslib
    artifacts are defined
    + JDK-8261585: Restore HandleArea used in
    Deoptimization::uncommon_trap
    + JDK-8261753: Test java/lang/System/OsVersionTest.java still
    failing on BigSur patch versions after JDK-8253702
    + JDK-8261829: Exclude tools/jlink/JLinkReproducibleTest.java
    in 11u
    + JDK-8261912: Code IfNode::fold_compares_helper more
    defensively
    + JDK-8261920: [AIX] jshell command throws java.io.IOError on
    non English locales
    + JDK-8262018: Wrong format in SAP copyright header of
    OsVersionTest
    + JDK-8263069: Exclude some failing tests from
    security/infra/java/security/cert/CertPathValidator</changelog>
  <changelog author="fstrba@suse.com" date="1620043200">- Remove all Jpackage provides for SLE12 in order to avoid
  installing this package as default Java on SLE12-SP5
  (bsc#1185476)</changelog>
  <changelog author="fstrba@suse.com" date="1621512000">- Modified patch:
  * nss-security-provider.patch
    + make the NSS provider first in the list</changelog>
  <changelog author="fstrba@suse.com" date="1626868800">- Update to upstream tag jdk-11.0.12+7 (July 2021, CPU)
  * Security fixes
    + JDK-8256157: Improve bytecode assembly
    + JDK-8256491: Better HTTP transport
    + JDK-8258432, CVE-2021-2341, bsc#1188564: Improve file
    transfers
    + JDK-8260453: Improve Font Bounding
    + JDK-8260960: Signs of jarsigner signing
    + JDK-8260967, CVE-2021-2369, bsc#1188565: Better jar file
    validation
    + JDK-8262380: Enhance XML processing passes
    + JDK-8262403: Enhanced data transfer
    + JDK-8262410: Enhanced rules for zones
    + JDK-8262477: Enhance String Conclusions
    + JDK-8262967: Improve Zip file support
    + JDK-8264066, CVE-2021-2388, bsc#1188566: Enhance compiler
    validation
    + JDK-8264079: Improve abstractions
    + JDK-8264460: Improve NTLM support
  * Other changes
    + JDK-6847157: java.lang.NullPointerException: HDC for
    component at sun.java2d.loops.Blit.Blit
    + JDK-7106851: Test should not use System.exit
    + JDK-8073446: TimeZone getOffset API does not  return a dst
    offset between years 2038-2137
    + JDK-8076190: Customizing the generation of a PKCS12 keystore
    + JDK-8153005: Upgrade the default PKCS12 encryption/MAC
    algorithms
    + JDK-8171303: sun/java2d/pipe/InterpolationQualityTest.java
    fails on Windows &amp; Linux
    + JDK-8177068: incomplete classpath causes NPE in Flow
    + JDK-8185734: [Windows] Structured Exception Catcher missing
    around gtest execution
    + JDK-8187450: JNI local refs exceeds capacity warning in
    NetworkInterface::getAll
    + JDK-8190763: Class cast exception on (CompoundEdit)
    UndoableEditEvent.getEdit()
    + JDK-8195841: PNGImageReader.readNullTerminatedString() doesnt
    check for non-null terminated strings with length equal to
    maxLen
    + JDK-8196100: javax/swing/text/JTextComponent/5074573/
    /bug5074573.java fails
    + JDK-8199646: JShell tests: jdk/jshell/
    /FailOverDirectExecutionControlTest.java failed with
    java.lang.UnsupportedOperationException
    + JDK-8206925: Support the certificate_authorities extension
    + JDK-8207160: ClassReader::adjustMethodParams can potentially
    return null if the args list is empty
    + JDK-8207247: AARCH64: Enable Minimal and Client VM builds
    + JDK-8207404: MulticastSocket tests failing on AIX
    + JDK-8207779: Method::is_valid_method() compares 'this' with
    NULL
    + JDK-8208061: runtime/LoadClass/TestResize.java fails with
    "Load factor too high" when running in CDS mode.
    + JDK-8209459: TestSHA512MultiBlockIntrinsics failed on AArch64
    + JDK-8210443: Migrate Locale matching tests to JDK Repo.
    + JDK-8213231: ThreadSnapshot::_threadObj can become stale
    + JDK-8213483: ARM32: runtime/ErrorHandling/
    /ShowRegistersOnAssertTest.java jtreg test fail
    + JDK-8213725: JShell NullPointerException due to class file
    with unexpected package
    + JDK-8213794: ARM32: disable TypeProfiling,
    CriticalJNINatives, Serviceablity tests for ARM32
    + JDK-8213845: ARM32: Interpreter doesn't call result handler
    after native calls
    + JDK-8214128: ARM32: wrong stack alignment on
    Deoptimization::unpack_frames
    + JDK-8214512: ARM32: Jtreg test compiler/c2/Test8062950.java
    fails on ARM
    + JDK-8214854: JDWP: Unforseen output truncation in logging
    + JDK-8214922: Add vectorization support for fmin/fmax
    + JDK-8215009: GCC 8 compilation error in libjli
    + JDK-8216184: CDS/appCDS tests failed on Windows due to long
    path to a classlist file
    + JDK-8216259: AArch64: Vectorize Adler32 intrinsics
    + JDK-8216314: SIGILL in CodeHeapState::print_names()
    + JDK-8217348: assert(thread-&gt;is_Java_thread()) failed: just
    checking
    + JDK-8217465: [REDO] - Optimize CodeHeap Analytics
    + JDK-8217561: X86: Add floating-point Math.min/max intrinsics
    + JDK-8217918: C2: -XX:+AggressiveUnboxing is broken
    + JDK-8218458: [TESTBUG] runtime/NMT/
    /CheckForProperDetailStackTrace.java fails with Expected
    stack trace missing from output
    + JDK-8219142: Remove unused JIMAGE_ResourcePath
    + JDK-8219586: CodeHeap State Analytics processes dead nmethods
    + JDK-8220074: Clean up GCC 8.3 errors in LittleCMS
    + JDK-8220407: compiler/intrinsics/math/
    /TestFpMinMaxIntrinsics.java timedout
    + JDK-8222302: [TESTBUG] test/hotspot/jtreg/compiler/intrinsics/
    /sha/cli/TestUseSHAOptionOnUnsupportedCPU.java fails on any
    other CPU
    + JDK-8222412: AARCH64: multiple instructions encoding issues
    + JDK-8223020: aarch64: expand minI_rReg and maxI_rReg patterns
    into separate instructions
    + JDK-8223444: Improve CodeHeap Free Space Management
    + JDK-8223504: Improve performance of forall loops by better
    inlining of "iterator()" methods
    + JDK-8223667: ASAN build broken
    + JDK-8225081: Remove Telia Company CA certificate expiring in
    April 2021
    + JDK-8225116: Test OwnedWindowsLeak.java intermittently fails
    + JDK-8225438: javax/net/ssl/TLSCommon/
    /TestSessionLocalPrincipal.java failed with Read timed out
    + JDK-8225756: [testbug] compiler/loopstripmining/
    /CheckLoopStripMining.java sets too short a
    SafepointTimeoutDelay
    + JDK-8226374: Restrict TLS signature schemes and named groups
    + JDK-8226627: assert(t-&gt;singleton()) failed: must be a constant
    + JDK-8226721: Missing intrinsics for Math.ceil, floor, rint
    + JDK-8227080: (fs) Files.newInputStream(...).skip(n) is slow
    + JDK-8227222: vmTestbase/jit/FloatingPoint/gen_math/Loops04/
    /Loops04.java failed XMM register should be 0-15
    + JDK-8227609: (fs) Files.newInputStream(...).skip(n) should
    allow skipping beyond file size
    + JDK-8230428: Cleanup dead CastIP node code in formssel.cpp
    + JDK-8231460: Performance issue (CodeHeap) with large free
    blocks
    + JDK-8231713: x86_32 build failures after JDK-8226721 (Missing
    intrinsics for Math.ceil, floor, rint)
    + JDK-8231841: AArch64: debug.cpp help() is missing an AArch64
    line for pns
    + JDK-8232084: HotSpot build failed with GCC 9.2.1
    + JDK-8232591: AArch64: Add missing match rules for smaddl,
    smsubl and smnegl
    + JDK-8233185: HttpServer.stop() blocks indefinitely when
    called on dispatch thread
    + JDK-8233787: Break cycle in vm_version* includes
    + JDK-8233948: AArch64: Incorrect mapping between OptoReg and
    VMReg for high 64 bits of Vector Register
    + JDK-8234355: Buffer overflow in jcmd GC.class_stats due to
    too many classes
    + JDK-8235368: Update BCEL to Version 6.4.1
    + JDK-8236859: WebSocket over authenticating proxy fails with
    NPE
    + JDK-8236992: AArch64: remove redundant load_klass in itable
    stub
    + JDK-8237743: test/langtools/jdk/jshell/
    /FailOverExecutionControlTest.java fails No
    ExecutionControlProvider with name 'nonExistent' and parameter
    keys: []
    + JDK-8237804: sun/security/mscapi tests fail with "Key pair
    not generated, alias &lt;nnnnnn&gt; already exists"
    + JDK-8238175: CTW: Class.getDeclaredMethods fails with
    assert(k-&gt;is_subclass_of(SystemDictionary::Throwable_klass()))
    failed: invalid exception class
    + JDK-8238567: SoftMainMixer.processAudioBuffers(): Wrong
    handling of stoppedMixers
    + JDK-8238812: assert(false) failed: bad AD file
    + JDK-8239312: [macos] javax/swing/JFrame/NSTexturedJFrame/
    /NSTexturedJFrame.java
    + JDK-8239386: handle ContendedPaddingWidth in
    vm_version_aarch64
    + JDK-8239536: Can't use 'java.util.List' object after
    importing 'java.awt.List'
    + JDK-8240487: Cleanup whitespace in .cc, .hh, .m, and .mm files
    + JDK-8240848: ArrayIndexOutOfBoundsException buf for
    TextCallbackHandler
    + JDK-8241082: Upgrade IANA Language Subtag Registry data to
    03-16-2020 version
    + JDK-8241087: Build failure with VS 2019 (16.5.0) due to C2039
    and C2873
    + JDK-8241101: [s390] jtreg test failure after JDK-8238696: not
    conformant features string
    + JDK-8241248: NullPointerException in
    sun.security.ssl.HKDF.extract(HKDF.java:93)
    + JDK-8241372: Several test failures due to
    javax.net.ssl.SSLException: Connection reset
    + JDK-8241475: AArch64: Add missing support for PopCountVI node
    + JDK-8241829: Cleanup the code for PrinterJob on windows
    + JDK-8241960: The SHA3 message digests impl of SUN provider
    are not thread safe after cloned
    + JDK-8242010: Upgrade IANA Language Subtag Registry to Version
    2020-04-01
    + JDK-8242429: Better implementation for sign extract
    + JDK-8242557: Add length limit for strings in PNGImageWriter
    + JDK-8242919: Paste locks up jshell
    + JDK-8243155: AArch64: Add support for SqrtVF
    + JDK-8243240: AArch64: Add support for MulVB
    + JDK-8243452: JFR: Could not create chunk in repository with
    over 200 recordings
    + JDK-8243559: Remove root certificates with 1024-bit keys
    + JDK-8243597: AArch64: Add support for integer vector abs
    + JDK-8244031: HttpClient should have more tests for HEAD
    requests
    + JDK-8244205: HTTP/2 tunnel connections through proxy may be
    reused regardless of which proxy is selected
    + JDK-8244847: Linux/PPC: runtime/CompressedOops/
    /CompressedClassPointers: smallHeapTest fails
    + JDK-8245511: G1 adaptive IHOP does not account for
    reclamation of humongous objects by young GC
    + JDK-8246274: G1 old gen allocation tracking is not in a
    separate class
    + JDK-8247354: [aarch64] PopFrame causes
    assert(oopDesc::is_oop(obj)) failed: not an oop
    + JDK-8247408: IdealGraph bit check expression canonicalization
    + JDK-8247432: Update IANA Language Subtag Registry to Version
    2020-09-29
    + JDK-8247438: JShell: When FailOverExecutionControlProvider
    fails the proximal cause is not shown
    + JDK-8247753: UIManager.getSytemLookAndFeelClassName() returns
    wrong value on Fedora 32
    + JDK-8248043: Need to eliminate excessive i2l conversions
    + JDK-8248411: [aarch64] Insufficient error handling when
    CodeBuffer is exhausted
    + JDK-8248568: compiler/c2/TestBit.java failed: test missing
    from stdout/stderr
    + JDK-8248870: AARCH64: I2L/L2I conversions can be skipped for
    masked positive values
    + JDK-8249142: java/awt/FontClass/CreateFont/DeleteFont.sh is
    unstable
    + JDK-8249189: AARCH64: more L2I conversions can be skipped
    + JDK-8249719: MethodHandle performance suffers from bad
    ResolvedMethodTable hash function
    + JDK-8249875: GCC 10 warnings -Wtype-limits with JFR code
    + JDK-8250635: MethodArityHistogram should use Compile_lock in
    favour of fancy checks
    + JDK-8250876: Fix issues with cross-compile on macos
    + JDK-8251031: Some vmTestbase/nsk/monitoring/RuntimeMXBean
    tests fail with hostnames starting from digits
    + JDK-8251525: AARCH64: Faster Math.signum(fp)
    + JDK-8252259: AArch64: Adjust default value of FLOATPRESSURE
    + JDK-8252311: AArch64: save two words in itable lookup stub
    + JDK-8252779: compiler/graalunit/HotspotTest.java failed after
    8251525
    + JDK-8252883: AccessDeniedException caused by delayed file
    deletion on Windows
    + JDK-8253167: ARM32 builds fail after JDK-8247910
    + JDK-8253572: [windows] CDS archive may fail to open with long
    file names
    + JDK-8253923: C2 doesn't always run loop opts for compilations
    that include loops
    + JDK-8253948: Memory leak in ImageFileReader
    + JDK-8254631: Better support ALPN byte wire values in SunJSSE
    + JDK-8254717: isAssignableFrom checks in
    KeyFactorySpi.engineGetKeySpec appear to be backwards
    + JDK-8255086: Update the root locale display names
    + JDK-8255625: AArch64: Implement Base64.encodeBlock
    accelerator/intrinsic
    + JDK-8255763: C2: OSR miscompilation caused by invalid memory
    instruction placement
    + JDK-8255992: JFR EventWriter does not use first string from
    StringPool with id 0
    + JDK-8256037: [TESTBUG] com/sun/jndi/dns/ConfigTests/
    /PortUnreachable.java fails due to the hard coded threshold
    is small
    + JDK-8256244: java/lang/ProcessHandle/PermissionTest.java
    fails with TestNG 7.1
    + JDK-8256287: [windows] add loop fuse to
    map_or_reserve_memory_aligned
    + JDK-8256523: Streamline Java SHA2 implementation
    + JDK-8257414: Drag n Drop target area is wrong on high DPI
    systems
    + JDK-8257569: Failure observed with
    JfrVirtualMemory::initialize
    + JDK-8257574: C2: "failed: parsing found no loops but there
    are some" assert failure
    + JDK-8257580: Bump update version for OpenJDK: jdk-11.0.12
    + JDK-8257604: JNI_ArgumentPusherVaArg leaks valist
    + JDK-8257621: JFR StringPool misses cached items across
    consecutive recordings
    + JDK-8257796: [TESTBUG]
    TestUseSHA512IntrinsicsOptionOnSupportedCPU.java fails
    on x86_32
    + JDK-8257822: C2 crashes with SIGFPE due to a division that
    floats above its zero check
    + JDK-8257828: SafeFetch may crash if invoked in non-JavaThreads
    + JDK-8257853: Remove dependencies on JNF's JNI utility
    functions in AWT and 2D code
    + JDK-8257858: [macOS]: Remove JNF dependency from
    libosxsecurity/KeystoreImpl.m
    + JDK-8257860: [macOS]: Remove JNF dependency from
    libosxkrb5/SCDynamicStoreConfig.m
    + JDK-8257988: Remove JNF dependency from
    libsaproc/MacosxDebuggerLocal.m
    + JDK-8258414: OldObjectSample events too expensive
    + JDK-8258505: [TESTBUG] TestDivZeroWithSplitIf.java fails due
    to missing UnlockDiagnosticVMOptions
    + JDK-8258753: StartTlsResponse.close() hangs due to
    synchronization issues
    + JDK-8259061: C2: assert(found) failed: memory-writing node is
    not placed in its original loop or an ancestor of it
    + JDK-8259227: C2 crashes with SIGFPE due to a division that
    floats above its zero check
    + JDK-8259232: Bad JNI lookup during printing
    + JDK-8259276: C2: Empty expression stack when reexecuting
    tableswitch/lookupswitch instructions after deoptimization
    + JDK-8259343: [macOS] Update JNI error handling in Cocoa code.
    + JDK-8259585: Accessible actions do not work on mac os x
    + JDK-8259651: [macOS] Replace JNF_COCOA_ENTER/EXIT macros
    + JDK-8259662: Don't wrap SocketExceptions into SSLExceptions
    in SSLSocketImpl
    + JDK-8259710: Inlining trace leaks memory
    + JDK-8259729: Missed JNFInstanceOf -&gt; IsInstanceOf conversion
    + JDK-8259777: Incorrect predication condition generated by ADLC
    + JDK-8259786: initialize last parameter of getpwuid_r
    + JDK-8259843: initialize dli_fname array before calling
    dll_address_to_library_name
    + JDK-8259869: [macOS] Remove desktop module dependencies on
    JNF Reference APIs
    + JDK-8259886: Improve SSL session cache performance and
    scalability
    + JDK-8259983: do not use uninitialized expand_ms value in
    G1CollectedHeap::expand_heap_after_young_collection
    + JDK-8260030: Improve stringStream buffer handling
    + JDK-8260236: better init AnnotationCollector _contended_group
    + JDK-8260255: C1: LoopInvariantCodeMotion constructor can
    leave some fields uninitialized
    + JDK-8260284: C2: assert(_base == Int) failed: Not an Int
    + JDK-8260380: Upgrade to LittleCMS 2.12
    + JDK-8260420: C2 compilation fails with assert(found_sfpt)
    failed: no node in loop that's not input to safepoint
    + JDK-8260426: awt debug_mem.c DMem_AllocateBlock might leak
    memory
    + JDK-8260432: allocateSpaceForGP in freetypeScaler.c might
    leak memory
    + JDK-8260616: Removing remaining JNF dependencies in the
    java.desktop module
    + JDK-8260653: Unreachable nodes keep speculative types alive
    + JDK-8260707: java/lang/instrument/PremainClass/
    /InheritAgent0100.java times out
    + JDK-8260925: HttpsURLConnection does not work  with other
    JSSE provider.
    + JDK-8260926: Trace resource exhausted events unconditionally
    + JDK-8261020: Wrong format parameter in
    create_emergency_chunk_path
    + JDK-8261027: AArch64: Support for LSE atomics C++ HotSpot code
    + JDK-8261167: print_process_memory_info add a close call after
    fopen
    + JDK-8261170: Upgrade to freetype 2.10.4
    + JDK-8261198: [macOS] Incorrect JNI parameters in number
    conversion in A11Y code
    + JDK-8261235: C1 compilation fails with
    assert(res-&gt;vreg_number() == index) failed: conversion check
    + JDK-8261261: The version extra fields needs to be overridable
    in jib-profiles.js
    + JDK-8261262: Kitchensink24HStress.java crashed with
    EXCEPTION_ACCESS_VIOLATION
    + JDK-8261354: SIGSEGV at MethodIteratorHost
    + JDK-8261355: No data buffering in SunPKCS11 Cipher encryption
    when the underlying mechanism has no padding
    + JDK-8261397: try catch Method failing to work when dividing
    an integer by 0
    + JDK-8261422: Adjust problematic String.format calls in
    jdk/internal/util/Preconditions.java outOfBoundsMessage
    + JDK-8261447: MethodInvocationCounters frequently run into
    overflow
    + JDK-8261481: Cannot read Kerberos settings in dynamic store
    on macOS Big Sur
    + JDK-8261505: Test test/hotspot/jtreg/gc/parallel/
    /TestDynShrinkHeap.java killed by Linux OOM Killer
    + JDK-8261601: free memory in early return in
    Java_sun_nio_ch_sctp_SctpChannelImpl_receive0
    + JDK-8261649: AArch64: Optimize LSE atomics in C++ code
    + JDK-8261730: C2 compilation fails with
    assert(store-&gt;find_edge(load) != -1) failed: missing
    precedence edge
    + JDK-8261752: Multiple GC test are missing memory requirements
    + JDK-8261791: (sctp) handleSendFailed in SctpChannelImpl.c
    potential leaks
    + JDK-8261812: C2 compilation fails with assert(!had_error)
    failed: bad dominance
    + JDK-8261914: IfNode::fold_compares_helper faces
    non-canonicalized bool when running JRuby JSON workload
    + JDK-8262093: java/util/concurrent/tck/JSR166TestCase.java
    failed "assert(false) failed: unexpected node"
    + JDK-8262110: DST starts from incorrect time in 2038
    + JDK-8262121: [11u] Redo 8244287: JFR: Methods samples have
    line number 0
    + JDK-8262163: Extend settings printout in jcmd VM.metaspace
    + JDK-8262295: C2: Out-of-Bounds Array Load from Clone Source
    + JDK-8262298: G1BarrierSetC2::step_over_gc_barrier fails with
    assert "bad barrier shape"
    + JDK-8262446: DragAndDrop hangs on Windows
    + JDK-8262461: handle wcstombsdmp return value correctly in
    unix awt_InputMethod.c
    + JDK-8262465: Very long compilation times and high memory
    consumption in C2 debug builds
    + JDK-8262726: AArch64: C1 StubAssembler::call_RT can corrupt
    stack
    + JDK-8262739: String inflation C2 intrinsic prevents insertion
    of anti-dependencies
    + JDK-8262829: Native crash in
    Win32PrintServiceLookup.getAllPrinterNames()
    + JDK-8262837: handle split_USE correctly
    + JDK-8262900: ToolBasicTest fails to access HTTP server it
    starts
    + JDK-8263260: [s390] Support latest hardware (z14 and z15)
    + JDK-8263311: Watch registry changes for remote printers
    update instead of polling
    + JDK-8263361: Incorrect arraycopy stub selected by C2 for SATB
    collectors
    + JDK-8263404: RsaPrivateKeySpec is always recognized as
    RSAPrivateCrtKeySpec in RSAKeyFactory.engineGetKeySpec
    + JDK-8263425: AArch64: two potential bugs in C1
    LIRGenerator::generate_address()
    + JDK-8263448: CTW: fatal error: meet not symmetric
    + JDK-8263504: Some OutputMachOpcodes fields are uninitialized
    + JDK-8263557: Possible NULL dereference in
    Arena::destruct_contents()
    + JDK-8263558: Possible NULL dereference in fast path arena
    free if ZapResourceArea is true
    + JDK-8263676: AArch64: one potential bug in C1
    LIRGenerator::generate_address()
    + JDK-8263729: [test] divert spurious output away from stream
    under test in ProcessBuilder Basic test
    + JDK-8263846: Bad JNI lookup getFocusOwner in accessibility
    code on Mac OS X
    + JDK-8264047: Duplicate global variable 'jvm' in libjavajpeg
    and libawt
    + JDK-8264096: slowdebug jvm crashes when StrInflatedCopy match
    rule is not supported
    + JDK-8264151: ciMethod::ensure_method_data() should return
    false is loading resulted in empty state
    + JDK-8264173: [s390] Improve Hardware Feature Detection And
    Reporting
    + JDK-8264190: Harden TLS interop tests
    + JDK-8264223: CodeHeap::verify fails extra_hops assertion in
    fastdebug test
    + JDK-8264328: Broken license in
    javax/swing/JComboBox/8072767/bug8072767.java
    + JDK-8264360: Loop strip mining verification fails with
    "should be on the backedge"
    + JDK-8264626: C1 should be able to inline excluded methods
    + JDK-8264640: CMS ParScanClosure misses a barrier
    + JDK-8264786: [macos] All Swing/AWT apps cause Allow
    Notifications prompt to appear when app is launched
    + JDK-8264821: DirectIOTest fails on a system with large block
    size
    + JDK-8264848: [macos] libjvm.dylib linker warning due to macOS
    version mismatch
    + JDK-8264923: PNGImageWriter.write_zTXt throws Exception with
    a typo
    + JDK-8264958: C2 compilation fails with assert "n is later
    than its clone"
    + JDK-8265099: Revert backport to 11u of 8236859: WebSocket
    over authenticating proxy fails with NPE
    + JDK-8265154: vinserti128 operand mix up for KNL platforms
    + JDK-8265239: Shenandoah: Shenandoah heap region count could
    be off by 1
    + JDK-8265417: Backport of JDK-8249672 breaks Solaris x86 build
    + JDK-8265421: java/lang/String/StringRepeat.java test is
    missing a memory requirement
    + JDK-8265462: Handle multiple slots in the NSS Internal Module
    from SunPKCS11's Secmod
    + JDK-8265537: x86 version string truncated after JDK-8249672
    11u backport
    + JDK-8265666: Enable AIX build platform to make external debug
    symbols
    + JDK-8265677: CMS: CardTableBarrierSet::write_ref_array_work()
    lacks storestore barrier
    + JDK-8265690: Use the latest Ubuntu base image version in
    Docker testing
    + JDK-8265718: Build failure after JDK-8258414 11u backport
    + JDK-8265750: Fatal error in safepoint.cpp after backport of
    8258414
    + JDK-8265784: [C2] Hoisting of DecodeN leaves MachTemp inputs
    behind
    + JDK-8265938: C2's conditional move optimization does not
    handle top Phi
    + JDK-8266220: keytool still prompt for store password on a
    password-less pkcs12 file if -storetype pkcs12 is specified
    + JDK-8266293: Key protection using PBEWithMD5AndDES fails with
    "java.security.InvalidAlgorithmParameterException: Salt must
    be 8 bytes long"
    + JDK-8266713: [AIX] Build failure after 11u backport of
    JDK-8247753
    + JDK-8266802: Shenandoah: Round up region size to page size
    unconditionally
    + JDK-8266892: avoid maybe-uninitialized gcc warnings on linux
    s390x
    + JDK-8266929: Unable to use algorithms from 3p providers
    + JDK-8267235: [macos_aarch64]
    InterpreterRuntime::throw_pending_exception messing up LR
    results in crash
    + JDK-8267561: Shenandoah: Reference processing not properly
    setup for outside of cycle degenerated GC
    + JDK-8267599: Revert the change to the default PKCS12
    macAlgorithm and macIterationCount props for 11u/8u/7u
    + JDK-8267641: [11u] 8227609 backport typo
    + JDK-8267721: Enable sun/security/pkcs11 tests for Amazon
    Linux 2 AArch64
    + JDK-8268678: LetsEncryptCA.java test fails as Let's Encrypt
    Authority X3 is retired</changelog>
  <changelog author="schwab@suse.de" date="1628078400">- riscv64-zero.patch: Add support for riscv64 (zero VM)</changelog>
  <changelog author="fstrba@suse.com" date="1629979200">- Added patch:
  * jdk11-glibc234.patch
    + fix build with glibc-2.34 (bsc#1189201)</changelog>
  <changelog author="fstrba@suse.com" date="1631534400">- Modified patch:
  * nss-security-provider.patch
    + revert recent changes making NSS provider the default one
    + fixes bsc#1190252</changelog>
  <changelog author="fstrba@suse.com" date="1631793600">- Added patch:
  * fips.patch
    + implement FIPS support in OpenJDK</changelog>
  <changelog author="fstrba@suse.com" date="1634817600">- Update to upstream tag jdk-11.0.13+8 (October 2021 CPU)
  * Security fixes
    + JDK-8163326, CVE-2021-35550, bsc#1191901: Update the default
    enabled cipher suites preference
    + JDK-8254967, CVE-2021-35565, bsc#1191909:
    com.sun.net.HttpsServer spins on TLS session close
    + JDK-8263314: Enhance XML Dsig modes
    + JDK-8265167, CVE-2021-35556, bsc#1191910: Richer Text Editors
    + JDK-8265574: Improve handling of sheets
    + JDK-8265580, CVE-2021-35559, bsc#1191911: Enhanced style for
    RTF kit
    + JDK-8265776: Improve Stream handling for SSL
    + JDK-8266097, CVE-2021-35561, bsc#1191912: Better hashing
    support
    + JDK-8266103: Better specified spec values
    + JDK-8266109: More Resilient Classloading
    + JDK-8266115: More Manifest Jar Loading
    + JDK-8266137, CVE-2021-35564, bsc#1191913: Improve Keystore
    integrity
    + JDK-8266689, CVE-2021-35567, bsc#1191903: More Constrained
    Delegation
    + JDK-8267086: ArrayIndexOutOfBoundsException in
    java.security.KeyFactory.generatePublic
    + JDK-8267712: Better LDAP reference processing
    + JDK-8267729, CVE-2021-35578, bsc#1191904: Improve TLS client
    handshaking
    + JDK-8267735, CVE-2021-35586, bsc#1191914: Better BMP support
    + JDK-8268193: Improve requests of certificates
    + JDK-8268199: Correct certificate requests
    + JDK-8268205: Enhance DTLS client handshake
    + JDK-8268506: More Manifest Digests
    + JDK-8269618, CVE-2021-35603, bsc#1191906: Better session
    identification
    + JDK-8269624: Enhance method selection support
    + JDK-8270398: Enhance canonicalization
    + JDK-8270404: Better canonicalization
  * Other changes
    + JDK-8024368: private methods are allocated vtable indices
    + JDK-8042902: Test java/net/Inet6Address/serialize/
    /Inet6AddressSerializationTest.java fails intermittently
    + JDK-8140466: ChaCha20 and Poly1305 TLS Cipher Suites
    + JDK-8157404: Unable to read certain PKCS12 keystores from
    SequenceInputStream
    + JDK-8158066: SourceDebugExtensionTest fails to rename file
    + JDK-8168304: Make all of DependencyContext_test available in
    product mode
    + JDK-8169246: java/net/DatagramSocket/ReportSocketClosed.java
    fails intermittently with BindException
    + JDK-8181313: SA: Remove libthread_db dependency on Linux
    + JDK-8193214: Incorrect annotations.without.processors
    warnings with JDK 9
    + JDK-8194230: jdk/internal/jrtfs/remote/
    /RemoteRuntimeImageTest.java fails with
    java.lang.NullPointerException
    + JDK-8196092: javax/swing/JComboBox/8032878/bug8032878.java
    fails
    + JDK-8199931: java/net/MulticastSocket/
    /UnreferencedMulticastSockets.java fails with "incorrect data
    received"
    + JDK-8206083: Make tools/javac/api/T6265137.java robust to JDK
    version changes
    + JDK-8206350: java/util/Locale/bcp47u/SystemPropertyTests.java
    failed on Mac 10.13 with zh_CN and zh_TW locales.
    + JDK-8207316: java/nio/channels/spi/SelectorProvider/
    /inheritedChannel/InheritedChannelTest.java failed
    + JDK-8208227: tools/jdeps/DotFileTest.java fails on Win-X64
    + JDK-8208363: test/jdk/java/lang/Package/
    /PackageFromManifest.java missing module dependencies
    declaration
    + JDK-8209380: ARM: cleanup maybe-uninitialized and reorder
    compiler warnings
    + JDK-8209768: Refactor java/util/prefs/CheckUserPrefsStorage.sh
    to plain java test
    + JDK-8209772: Refactor shell test java/util/ServiceLoader/
    /basic/basic.sh to java
    + JDK-8209773: Refactor shell test javax/naming/module/basic.sh
    to java
    + JDK-8209832: Refactor jdk/internal/reflect/Reflection/
    /GetCallerClassTest.sh to plain java test
    + JDK-8209930: Refactor java/util/zip/ZipFile/deletetempjar.sh
    to plain java test
    + JDK-8210406: Refactor java.util.PluggableLocale:i18n shell
    tests to plain java tests
    + JDK-8210407: Refactor java.util.Calendar:i18n shell tests to
    plain java tests
    + JDK-8210495: compiler crashes because of illegal signature in
    otherwise legal code
    + JDK-8210669: Some launcher tests assume a pre-JDK 9 run-time
    image layout
    + JDK-8210802: temp files left by tests in
    jdk/java/net/httpclient
    + JDK-8210819: Update the host name in CNameTest.java
    + JDK-8210908: Refactor java/util/prefs/PrefsSpi.sh to plain
    java test
    + JDK-8210934: Move sun/net/www/protocol/http/
    /GetErrorStream.java to OpenJDK
    + JDK-8210959: JShell fails and exits when statement throws an
    exception whose message contains a '%'.
    + JDK-8211055: Provide print to a file (PDF) feature even when
    printer was not connected
    + JDK-8211092: test/jdk/sun/net/www/http/HttpClient/
    /MultiThreadTest.java fails intermittently when cleaning up
    + JDK-8211296: Remove HotSpot deprecation warning suppression
    for Mac/clang
    + JDK-8211325: test/jdk/java/net/Socket/LingerTest.java fails
    with cleaning up
    + JDK-8212040: Compilation error due to wrong usage of
    NSPrintJobDispositionValue in mac10.12
    + JDK-8212695: Add explicit timeout to several HTTP Client tests
    + JDK-8212718: Refactor some annotation processor tests to
    better use collections
    + JDK-8213007: Update the link in test/jdk/sun/security/
    /provider/SecureRandom/DrbgCavp.java
    + JDK-8213137: Remove static initialization of monitor/mutex
    instances
    + JDK-8213235: java/nio/channels/SocketChannel/
    /AsyncCloseChannel.java fails with threads that didn't exit
    + JDK-8213409: Refactor sun.text.IntHashtable:i18n shell tests
    to plain java tests
    + JDK-8213576: Make test AsyncCloseChannel.java run in othervm
    + JDK-8213694: Test Timeout.java should run in othervm mode
    + JDK-8213718: [TEST] Wrong classname in vmTestbase/nsk/stress/
    /except/except002 and except003
    + JDK-8213922: fix ctw stand-alone build
    + JDK-8214195: Align stdout messages in
    test/jdk/java/math/BigInteger/PrimitiveConversionTests.java
    + JDK-8214520: [TEST_BUG] sun/security/mscapi/nonUniqueAliases/
    /NonUniqueAliases.java failed with incorrect jtreg tags order
    + JDK-8214937: sun/security/tools/jarsigner/warnings/
    /NoTimestampTest.java failed due to unexpected expiration date
    + JDK-8216532: tools/launcher/Test7029048.java fails (Solaris)
    + JDK-8217825: Verify @AfterTest is used correctly in WebSocket
    tests
    + JDK-8218145: block_if_requested is not proper inlined due to
    size
    + JDK-8219417: bump jtreg requiredVersion to b14
    + JDK-8219552: bump jtreg requiredVersion to b14 in
    test/jdk/sanity/client/
    + JDK-8219804: java/net/MulticastSocket/Promiscuous.java fails
    intermittently due to NumberFormatException
    + JDK-8220445: Support for side by side MSVC Toolset versions
    + JDK-8221988: add possibility to build with Visual Studio 2019
    + JDK-8222751: closed/test/jdk/sun/security/util/
    /DerIndefLenConverter/IndefBerPkcs12.java fail
    + JDK-8223050: JVMCI: findUniqueConcreteMethod() should not use
    Dependencies::find_unique_concrete_method() for non-virtual
    methods
    + JDK-8224853: CDS address sanitizer errors
    + JDK-8225082: Remove IdenTrust certificate that is expiring in
    September 2021
    + JDK-8225583: Examine the HttpResponse.BodySubscribers for
    null handling and multiple subscriptions
    + JDK-8225690: Multiple AttachListener threads can be created
    + JDK-8225790: Two NestedDialogs tests fail on Ubuntu
    + JDK-8226319: Add forgotten test/jdk/java/net/httpclient/
    /BodySubscribersTest.java
    + JDK-8226533: JVMCI: findUniqueConcreteMethod should handle
    statically bindable methods directly
    + JDK-8226602: Test convenience reactive primitives from
    java.net.http with RS TCK
    + JDK-8226683: Remove review suggestion from fix to 8219804
    + JDK-8227738: jvmti/DataDumpRequest/datadumpreq001 failed due
    to "exit code is 134"
    + JDK-8227766: CheckUnhandledOops is broken in MemAllocator
    + JDK-8227815: Minimal VM: set_state is not a member of
    AttachListener
    + JDK-8230674: Heap dumps should exclude dormant CDS archived
    objects of unloaded classes
    + JDK-8230808: Remove Access::equals()
    + JDK-8230841: Remove oopDesc::equals()
    + JDK-8231717: Improve performance of charset decoding when
    charset is always compactable
    + JDK-8232243: Wrong caret position in JTextPane on Windows
    with a screen resolution &gt; 100%
    + JDK-8232782: Shenandoah: streamline post-LRB CAS barrier
    (aarch64)
    + JDK-8233790: Forward output from heap dumper to jcmd/jmap
    + JDK-8233989: Create an IPv4 version of
    java/net/MulticastSocket/SetLoopbackMode.java
    + JDK-8234510: Remove file seeking requirement for writing a
    heap dump
    + JDK-8235211: serviceability/attach/
    /RemovingUnixDomainSocketTest.java fails with
    AttachNotSupportedException: Unable to open socket file
    + JDK-8235216: typo in test filename
    + JDK-8235866: bump jtreg requiredVersion to 4.2b16
    + JDK-8236111: narrow allowSmartActionArgs disabling
    + JDK-8236413: AbstractConnectTimeout should tolerate both
    NoRouteToHostException and UnresolvedAddressException
    + JDK-8236671: NullPointerException in JKS keystore
    + JDK-8238930: problem list compiler/c2/Test8004741.java
    + JDK-8238943: switch to jtreg 5.0
    + JDK-8240555: Using env of JAVA_TOOL_OPTIONS and _JAVA_OPTIONS
    breaks QuietOption.java test
    + JDK-8240983: Incorrect copyright header in Apache Santuario
    2.1.3 files
    + JDK-8241336: Some java.net tests failed with
    NoRouteToHostException on MacOS with special network
    configuration
    + JDK-8241353: NPE in ToolProvider.getSystemJavaCompiler
    + JDK-8241768: git needs .gitattributes
    + JDK-8242882: opening jar file with large manifest might throw
    NegativeArraySizeException
    + JDK-8244973: serviceability/attach/
    /RemovingUnixDomainSocketTest.java fails "stderr was not
    empty"
    + JDK-8245134: test/lib/jdk/test/lib/security/
    /KeyStoreUtils.java should allow to specify aliases
    + JDK-8246261: TCKLocalTime.java failed due to "AssertionError:
    expected [18:14:22] but found [18:14:23]"
    + JDK-8246387: switch to jtreg 5.1
    + JDK-8247421: [TESTBUG] ReturnBlobToWrongHeapTest.java failed
    allocating blob
    + JDK-8247469: getSystemCpuLoad() returns -1 on linux when some
    offline cpus are present and cpusets.effective_cpus is not
    available
    + JDK-8248352: [TEST_BUG] Test test/jdk/java/awt/font/
    /TextLayout/ArabicDiacriticTest.java can leave frame open
    + JDK-8248403: AArch64: Remove uses of kernel integer types
    + JDK-8248414: AArch64: Remove uses of long and unsigned long
    ints
    + JDK-8248657: Windows: strengthening in ThreadCritical
    regarding memory model
    + JDK-8248666: AArch64: Use THREAD_LOCAL instead of __thread
    + JDK-8248668: AArch64: Avoid MIN/MAX macros when using MSVC
    + JDK-8248671: AArch64: Remove unused variables
    + JDK-8248682: AArch64: Use ATTRIBUTE_ALIGNED helper
    + JDK-8248816: C1: Fix signature conflict in
    LIRGenerator::strength_reduce_multiply
    + JDK-8249095: tools/javac/launcher/SourceLauncherTest.java
    fails on Windows
    + JDK-8249548: backward focus traversal gets stuck in button
    group
    + JDK-8249773: Upgrade ReceiveISA.java test to be resilient to
    failure due to stray packets and interference
    + JDK-8249897: jdk/javadoc/tool/LangVers.java uses @ignore w/o
    bug-id
    + JDK-8249898: jdk/javadoc/tool/6176978/T6176978.java uses
    @ignore w/o bug-id
    + JDK-8249899: jdk/javadoc/tool/InlineTagsWithBraces.java uses
    @ignore w/o bug-id
    + JDK-8250588: Shenandoah: LRB needs to save/restore fp
    registers for runtime call
    + JDK-8250824: AArch64: follow up for JDK-8248414
    + JDK-8251166: Add automated testcases for changes done in
    JDK-8214112
    + JDK-8251252: Add automated testcase for fix done in
    JDK-8214253
    + JDK-8251254: Add automated test for fix done in JDK-8218472
    + JDK-8251361: Potential race between Logger configuration and
    GCs in HttpURLConWithProxy test
    + JDK-8251549: Update docs on building for Git
    + JDK-8251945: SIGSEGV in
    PackageEntry::purge_qualified_exports()
    + JDK-8252194: Add automated test for fix done in JDK-8218469
    + JDK-8252648: Shenandoah: name gang tasks consistently
    + JDK-8252825: Add automated test for fix done in JDK-8218479
    + JDK-8252853: AArch64: gc/shenandoah/TestVerifyJCStress.java
    fails intermittently with C1
    + JDK-8252857: AArch64: Shenandoah C1 CAS is not sequentially
    consistent
    + JDK-8253048: AArch64: When CallLeaf, no need to preserve
    callee-saved registers in caller
    + JDK-8253424: Add support for running pre-submit testing using
    GitHub Actions
    + JDK-8253631: Remove unimplemented CompileBroker methods after
    JEP-165
    + JDK-8253865: Pre-submit testing using GitHub Actions does not
    detect failures reliably
    + JDK-8253899: Make IsClassUnloadingEnabled signature match
    specification
    + JDK-8254024: Enhance native libs for AWT and Swing to work
    with GraalVM Native Image
    + JDK-8254054: Pre-submit testing using GitHub Actions should
    not use the deprecated set-env command
    + JDK-8254173: Add Zero, Minimal hotspot targets to submit
    workflow
    + JDK-8254175: Build no-pch configuration in debug mode for
    submit checks
    + JDK-8254244: Some code emitted by TemplateTable::branch is
    unused when running TieredCompilation
    + JDK-8254270: linux 32 bit build doesn't compile
    libjdwp/log_messages.c
    + JDK-8254282: Add Linux x86_32 builds to submit workflow
    + JDK-8254850: Update terminology in java.awt.GridBagLayout
    source code comments
    + JDK-8255255: Update Apache Santuario (XML Signature) to
    version 2.2.1
    + JDK-8255305: Add Linux x86_32 tier1 to submit workflow
    + JDK-8255352: Archive important test outputs in submit workflow
    + JDK-8255373: Submit workflow artifact name is always
    "test-results_.zip"
    + JDK-8255452: Doing GC during JVMTI MethodExit event posting
    breaks return oop
    + JDK-8255718: Zero: VM should know it runs in interpreter-only
    mode
    + JDK-8255790: GTKL&amp;F: Java 16 crashes on initialising GTKL&amp;F
    on Manjaro Linux
    + JDK-8255810: Zero: build fails without JVMTI
    + JDK-8255895: Submit workflow artifacts miss hs_errs/replays
    due to ZIP include mismatch
    + JDK-8256127: Add cross-compiled foreign architectures builds
    to submit workflow
    + JDK-8256215: Shenandoah: re-organize saving/restoring machine
    state in assembler code
    + JDK-8256267: Relax compiler/floatingpoint/NaNTest.java for
    x86_32 and lower -XX:+UseSSE
    + JDK-8256277: Github Action build on macOS should define OS
    and Xcode versions
    + JDK-8256354: Github Action build on Windows should define OS
    and MSVC versions
    + JDK-8256393: Github Actions build on Linux should define OS
    and GCC versions
    + JDK-8256414: add optimized build to submit workflow
    + JDK-8256747: GitHub Actions: decouple the hotspot build-only
    jobs from Linux x64 testing
    + JDK-8257056: Submit workflow should apt-get update to avoid
    package installation errors
    + JDK-8257148: Remove obsolete code in AWTView.m
    + JDK-8257497: Update keytool to create AKID from the SKID of
    the issuing certificate as specified by RFC 5280
    + JDK-8257620: Do not use objc_msgSend_stret to get macOS
    version
    + JDK-8257913: Add more known library locations to simplify
    Linux cross-compilation
    + JDK-8258703: Incorrect 512-bit vector registers restore on
    x86_32
    + JDK-8259338: Add expiry exception for identrustdstx3 alias to
    VerifyCACerts.java test
    + JDK-8259535: ECDSA SignatureValue do not always have the
    specified length
    + JDK-8259679: GitHub actions should use MSVC 14.28
    + JDK-8259924: GitHub actions fail on Linux x86_32 with "Could
    not configure libc6:i386"
    + JDK-8260460: GitHub actions still fail on Linux x86_32 with
    "Could not configure libc6:i386"
    + JDK-8260589: Crash in JfrTraceIdLoadBarrier::load(_jclass*)
    + JDK-8260923: Add more tests for SSLSocket input/output
    shutdown
    + JDK-8261072: AArch64: Fix MacroAssembler::get_thread
    convention
    + JDK-8261147: C2: Node is wrongly marked as reduction
    resulting in a wrong execution due to wrong vector instructions
    + JDK-8261238: NMT should not limit baselining by size threshold
    + JDK-8261496: Shenandoah: reconsider pacing updates memory
    ordering
    + JDK-8261652: Remove some dead comments from os_bsd_x86
    + JDK-8261846: [JVMCI] c2v_iterateFrames can get out of sync
    with the StackFrameStream
    + JDK-8262000: jdk/jfr/event/gc/detailed/
    /TestPromotionFailedEventWithParallelScavenge.java failed with
    "OutOfMemoryError: Java heap space"
    + JDK-8262017: C2: assert(n != __null) failed: Bad immediate
    dominator info.
    + JDK-8262392: Update Mesa 3-D Headers to version 21.0.3
    + JDK-8262409: sun/security/ssl/SSLSocketImpl/
    /SSLSocketImplThrowsWrongExceptions. SSL test failures caused
    by java failed with "Server reported the wrong exception"
    + JDK-8262470: Printed GlyphVector outline with low DPI has bad
    quality on Windows
    + JDK-8262862: Harden tests sun/security/x509/URICertStore/
    /ExtensionsWithLDAP.java and krb5/canonicalize/Test.java
    + JDK-8263136: C4530 was reported from VS 2019 at access bridge
    + JDK-8263227: C2: inconsistent spilling due to dead nodes in
    exception block
    + JDK-8263382: java/util/logging/ParentLoggersTest.java failed
    with "checkLoggers: getLoggerNames() returned unexpected
    loggers"
    + JDK-8263407: SPARC64 detection fails on Athena (SPARC64-X)
    + JDK-8263432: javac may report an invalid package/class clash
    on case insensitive filesystems
    + JDK-8263490: [macos] Crash occurs on JPasswordField with
    activated InputMethod
    + JDK-8263531: Remove unused buffer int
    + JDK-8263667: Avoid running GitHub actions on branches named
    pr/*
    + JDK-8263776: [JVMCI] add helper to perform Java upcalls
    + JDK-8264016: [JVMCI] add some thread local fields for use by
    JVMCI
    + JDK-8264752: SIGFPE crash with option
    FlightRecorderOptions:threadbuffersize=30M
    + JDK-8265132: C2 compilation fails with assert "missing
    precedence edge"
    + JDK-8265231: (fc) ReadDirect and WriteDirect tests fail after
    fix for JDK-8264821
    + JDK-8265335: Epsilon: Minor typo in EpsilonElasticTLABDecay
    description
    + JDK-8265756: AArch64: initialize memory allocated for locals
    according to Windows AArch64 stack page growth requirement in
    template interpreter
    + JDK-8265761: Font with missed font family name is not
    properly printed on Windows
    + JDK-8265773: incorrect jdeps message "jdk8internals" to
    describe a removed JDK internal API
    + JDK-8265836: OperatingSystemImpl.getCpuLoad() returns
    incorrect CPU load inside a container
    + JDK-8266018: Shenandoah: fix an incorrect assert
    + JDK-8266206: Build failure after JDK-8264752 with older GCCs
    + JDK-8266248: Compilation failure in
    PLATFORM_API_MacOSX_MidiUtils.c with Xcode 12.5
    + JDK-8266288: assert root method not found in
    witnessed_reabstraction_in_supers is too strong
    + JDK-8266404: Fatal error report generated with
  - XX:+CrashOnOutOfMemoryError should not contain suggestion to
    submit a bug report
    + JDK-8266480: Implicit null check optimization does not update
    control of hoisted memory operation
    + JDK-8266615: C2 incorrectly folds subtype checks involving an
    interface array
    + JDK-8266642: Improve ResolvedMethodTable hash function
    + JDK-8266749: AArch64: Backtracing broken on PAC enabled
    systems
    + JDK-8266761: AssertionError in
    sun.net.httpserver.ServerImpl.responseCompleted
    + JDK-8266813: Shenandoah: Use shorter instruction sequence for
    checking if marking in progress
    + JDK-8267042: bug in monitor locking/unlocking on ARM32 C1 due
    to uninitialized BasicObjectLock::_displaced_header
    + JDK-8267348: Rewrite gc/epsilon/TestClasses.java to use
    Metaspace with less classes
    + JDK-8267396: Avoid recording "pc" in unhandled oops detector
    for better performance
    + JDK-8267399: C2: java/text/Normalizer/ConformanceTest.java
    test failed with assertion
    + JDK-8267424: CTW: C1 fails with "State must not be null"
    + JDK-8267459: Pasting Unicode characters into JShell does not
    work.
    + JDK-8267625: AARCH64: typo in LIR_Assembler::emit_profile_type
    + JDK-8267666: Add option to jcmd GC.heap_dump to use existing
    file
    + JDK-8267695: Bump update version for OpenJDK: jdk-11.0.13
    + JDK-8267751: (test) jtreg.SkippedException has no serial
    VersionUID
    + JDK-8267773: PhaseStringOpts::int_stringSize doesn't handle
    min_jint correctly
    + JDK-8268103: JNI functions incorrectly return a double after
    JDK-8265836
    + JDK-8268127: Shenandoah: Heap size may be too small for
    region to align to large page size
    + JDK-8268261: C2: assert(n != __null) failed: Bad immediate
    dominator info.
    + JDK-8268347: C2: nested locks optimization may create
    unbalanced monitor enter/exit code
    + JDK-8268360: Missing check for infinite loop during node
    placement
    + JDK-8268362: [REDO] C2 crash when compile negative
    Arrays.copyOf length after loop
    + JDK-8268366: Incorrect calculation of has_fpu_registers in C1
    linear scan
    + JDK-8268369: SIGSEGV in PhaseCFG::implicit_null_check due to
    missing null check
    + JDK-8268417: Add test from JDK-8268360
    + JDK-8268427: Improve AlgorithmConstraints:checkAlgorithm
    performance
    + JDK-8268617: [11u REDO] - WebSocket over authenticating proxy
    fails with NPE
    + JDK-8268620: InfiniteLoopException test may fail on x86
    platforms
    + JDK-8268635: Corrupt oop in ClassLoaderData
    + JDK-8268699: Shenandoah: Add test for JDK-8268127
    + JDK-8268771: javadoc -notimestamp option does not work on
    index.html
    + JDK-8268775: Password is being converted to String in
    AccessibleJPasswordField
    + JDK-8268776: Test `ADatagramSocket.java` missing /othervm
    from @run tag
    + JDK-8268965: TCP Connection Reset when connecting simple
    socket to SSL server
    + JDK-8269304: Regression ~5% in 2005 in b27
    + JDK-8269415: [11u] Remove ea from
    DEFAULT_PROMOTED_VERSION_PRE in OpenJDK 11u
    + JDK-8269478: Shenandoah: gc/shenandoah/mxbeans tests should
    be more resilient
    + JDK-8269529: javax/swing/reliability/
    /HangDuringStaticInitialization.java fails in Windows debug
    build
    + JDK-8269594: assert(_handle_mark_nesting &gt; 1) failed: memory
    leak: allocating handle outside HandleMark
    + JDK-8269614: [s390] Interpreter checks wrong bit for slow
    path instance allocation
    + JDK-8269650: Optimize gc-locker in
    [Get|Release]StringCritical for latin string
    + JDK-8269661: JNI_GetStringCritical does not lock char array
    + JDK-8269668: [aarch64] java.library.path not including
    /usr/lib64
    + JDK-8269763: The JEditorPane is blank after JDK-8265167
    + JDK-8269795: C2: Out of bounds array load floats above its
    range check in loop peeling resulting in SEGV
    + JDK-8269847: JDK-8269594 backport breaks 11u builds
    + JDK-8269850: Most JDK releases report macOS version 12 as
    10.16 instead of 12.0
    + JDK-8269851: OperatingSystemMXBean getProcessCpuLoad reports
    incorrect process cpu usage in containers
    + JDK-8269882: stack-use-after-scope in NewObjectA
    + JDK-8269934: RunThese24H.java failed with
    EXCEPTION_ACCESS_VIOLATION in
    java_lang_Thread::get_thread_status
    + JDK-8270096: Shenandoah: Optimize gc/shenandoah/
    /TestRefprocSanity.java for interpreter mode
    + JDK-8270137: Kerberos Credential Retrieval from Cache not
    Working in Cross-Realm Setup
    + JDK-8270184: [TESTBUG] Add coverage for jvmci
    ResolvedJavaType.toJavaName() for lambdas
    + JDK-8270196: [11u] [JVMCI] JavaType.toJavaName() returns
    incorrect type name for lambdas
    + JDK-8270556: Exclude security/infra/java/security/cert/
    /CertPathValidator/certification/LetsEncryptCA
    + JDK-8270893: IndexOutOfBoundsException while reading large
    TIFF file
    + JDK-8272078: Wrong Checksums in Temurin BootJDK dependencies
    + JDK-8272124: Cgroup v1 initialization causes
    NullPointerException when cgroup path contains colon
    + JDK-8272131: PhaseMacroExpand::generate_slow_arraycopy crash
    when clone null CallProjections.fallthrough_ioproj
    + JDK-8272197: Update 11u GHA workflow with Shenandoah
    configurations
    + JDK-8272332: --with-harfbuzz=system doesn't add -lharfbuzz
    after JDK-8255790
    + JDK-8272472: StackGuardPages test doesn't build with glibc
    2.34
    + JDK-8272602: [macos] not all KEY_PRESSED events sent when
    control modifier is used
    + JDK-8272628: Problemlist gc/stress/gcbasher/
    /TestGCBasherWithCMS.java for x86_32
    + JDK-8272700: [macos] Build failure with Xcode 13.0 after
    JDK-8264848
    + JDK-8272772: Shenandoah: compiler/c2/aarch64/
    /TestVolatilesShenandoah.java fails in 11u
    + JDK-8273939: Backport of 8248414 to JDK11 breaks
    MacroAssembler::adrp
- Remove the unneeded icedtea-sound provider
- Removed patches:
  * icedtea-sound-1.0.1-jdk9.patch
  * icedtea-sound-soundproperties.patch
    + not needed since the icedtea-sound provider is removed
  * jdk11-glibc234.patch
    + integrated upstream</changelog>
  <changelog author="fstrba@suse.com" date="1635940800">- Modified patches:
  * system-crypto-policy.patch
    + rediff to changed context
  * fips.patch
    + Allow plain key import in fips mode unless
    com.suse.fips.plainKeySupport is set to false</changelog>
  <changelog author="fstrba@suse.com" date="1636113600">- Modified patch:
  * fips.patch
    + return in native code after generating java.io.IOException</changelog>
</package>
<package pkgid="f15e0f2a50fe0c37c9c691e5b7359240b21a3fe1729eabf943572ca64709066b" name="java-11-openjdk-accessibility" arch="s390x">
  <version epoch="0" ver="11.0.13.0" rel="3.68.1"/>
  <changelog author="fstrba@suse.com" date="1586952000">- The pack200 and unpack200 alternatives should be slaves of java
  and not of javac, since they are part of JRE.</changelog>
  <changelog author="fstrba@suse.com" date="1587470400">- Update to upstream tag jdk-11.0.7+10 (April 2020 CPU,
  bsc#1169511)
  * Security fixes:
    + S8223898, CVE-2020-2754: Forward references to Nashorn
    + S8223904, CVE-2020-2755: Improve Nashorn matching
    + S8224541, CVE-2020-2756: Better mapping of serial ENUMs
    + S8224549, CVE-2020-2757: Less Blocking Array Queues
    + S8225603: Enhancement for big integers
    + S8226346: Build better binary builders
    + S8227467: Better class method invocations
    + S8227542: Manifest improved jar headers
    + S8229733: TLS message handling improvements
    + S8231415, CVE-2020-2773: Better signatures in XML
    + S8231785: Improved socket permissions
    + S8232424, CVE-2020-2778: More constrained algorithms
    + S8232581, CVE-2020-2767: Improve TLS verification
    + S8233250: Better X11 rendering
    + S8233410: Better Build Scripting
    + S8234027: Better JCEKS key support
    + S8234408, CVE-2020-2781: Improve TLS session handling
    + S8234825, CVE-2020-2800: Better Headings for HTTP Servers
    + S8234841, CVE-2020-2803: Enhance buffering of byte buffers
    + S8235274, CVE-2020-2805: Enhance typing of methods
    + S8235691, CVE-2020-2816: Enhance TLS connectivity
    + S8236201, CVE-2020-2830: Better Scanner conversions
    + S8238960: linux-i586 builds are inconsistent as the newly
    built jdk is not able to reserve enough space for object heap
  * Other changes:
    + S4919790: Errors in alert ssl message does not reflect the
    actual certificate status
    + S4949105: Access Bridge lacks html tags parsing
    + S7092821: java.security.Provider.getService() is synchronized
    and became scalability bottleneck
    + S7143743: Potential memory leak with zip provider
    + S8005819: Support cross-realm MSSFU
    + S8042383: [TEST_BUG] Test javax/swing/plaf/basic/BasicMenuUI/
    /4983388/bug4983388.java fails with shortcuts on menus do not
    work
    + S8068184: Fix for JDK-8032832 caused a deadlock
    + S8145845: [AOT] NullPointerException in
    compiler/whitebox/GetCodeHeapEntriesTest.java
    + S8152988: [AOT] Update test batch definitions to include
    aot-ed java.base module mode into hs-comp testing
    + S8160926: FLAGS_COMPILER_CHECK_ARGUMENTS doesn't handle
    cross-compilation
    + S8163083: SocketListeningConnector does not allow invocations
    with port 0
    + S8163251: Hard coded loop limit prevents reading of smart
    card data greater than 8k
    + S8167276: jvmci/compilerToVM/MaterializeVirtualObjectTest.java
    fails with -XX:-EliminateAllocations
    + S8169718: nsk/jdb/locals/locals002: ERROR: Cannot find
    boolVar with expected value: false
    + S8176556:
    java/awt/dnd/ImageTransferTest/ImageTransferTest.java fails
    for JFIF
    + S8178798: Two compiler/aot/verification/vmflags tests fail by
    timeout with UseAVX=3
    + S8183107: PKCS11 regression regarding checkKeySize
    + S8185005: Improve performance of
    ThreadMXBean.getThreadInfo(long ids[], int maxDepth)
    + S8189633: Missing -Xcheck:jni checking for DeleteWeakGlobalRef
    + S8189861: Refactor CacheFind
    + S8193042: NativeLookup::lookup_critical_entry() should only
    load shared library once
    + S8193596: java/net/DatagramPacket/ReuseBuf.java failed due to
    timeout
    + S8194944: Regression automated test 'open/test/jdk/javax/
    /swing/JInternalFrame/8145896/TestJInternalFrameMaximize.java'
    fails
    + S8196467: javax/swing/JInternalFrame/Test6325652.java fails
    + S8196969: JTreg Failure: serviceability/sa/ClhsdbJstack.java
    causes NPE
    + S8198321: javax/swing/JEditorPane/5076514/bug5076514.java
    fails
    + S8198398: Test javax/swing/JColorChooser/Test6199676.java
    fails in mach5
    + S8199072: Test javax/swing/GroupLayout/6613904/
    /bug6613904.java is unstable
    + S8200432: javadoc fails with ClassCastException on {@link
    byte[]}
    + S8201349: build broken when configured with
  - -with-zlib=bundled on gcc 7.3
    + S8201355: Avoid native memory allocation in
    sun.security.mscapi.PRNG.generateSeed
    + S8201513: nsk/jvmti/IterateThroughHeap/filter-* are broken
    + S8203364: Some serviceability/sa/ tests intermittently fail
    with java.io.IOException: LingeredApp terminated with non-zero
    exit code 3
    + S8203687: javax/net/ssl/compatibility/Compatibility.java
    supports TLS 1.3
    + S8203904: javax/swing/JSplitPane/4816114/bug4816114.java: The
    divider location is wrong
    + S8203911: Test runtime/modules/getModuleJNI/GetModule fails
    with -Xcheck:jni
    + S8204525: [TESTBUG] runtime/NMT/MallocStressTest.java ran out
    of java heap
    + S8204529: gc/TestAllocateHeapAtMultiple.java fail with Agent
    7 timed out
    + S8204551: Event descriptions are truncated in logs
    + S8206963: [AOT] bug with multiple class loaders
    + S8207367: 10 vmTestbase/nsk/jdi tests timed out when running
    with jtreg
    + S8207832: serviceability/sa/ClhsdbCDSCore.java failed with
    "Couldn't find core file location"
    + S8207938: At step6,Click Add button,case failed automatically.
    + S8208157: requires.VMProps throws NPE for missing properties
    in "release" file
    + S8208379: compiler/jvmci/events/
    /JvmciNotifyInstallEventTest.java failed with "Got unexpected
    event count after 2nd install attempt: expected 9 to equal 2"
    + S8208658: Make CDS archived heap regions usable even if
    compressed oop encoding has changed
    + S8208715: Conversion of milliseconds to nanoseconds in
    UNIXProcess contains bug
    + S8209361: [AOT] Unexpected number of references for
    JVMTI_HEAP_REFERENCE_CONSTANT_POOL [111--&gt;111]: 0 (expected
    at least 1)
    + S8209385: CDS runtime classpath checking is too strict when
    only classes from the system modules are archived
    + S8209389: SIGSEGV in WalkOopAndArchiveClosure::do_oop_work.
    + S8209418: Synchronize test/jdk/sanity/client/lib/jemmy with
    code-tools/jemmy/v2
    + S8209494: Create a test for SwingSet InternalFrameDemo
    + S8209499: Create test for SwingSet EditorPaneDemo
    + S8209574: [AOT] breakpoint events are generated in different
    threads does not meet expected count
    + S8209686: cleanup arguments to PhaseIdealLoop() constructor
    + S8209789: Synchronize test/jdk/sanity/client/lib/jemmy with
    code-tools/jemmy/v2
    + S8209802: Garbage collectors should register JFR types
    themselves to avoid build errors.
    + S8209807: improve handling exception in requires.VMProps
    + S8209817: stack is executable when building with Clang on
    Linux
    + S8209824: Improve the code coverage for ThreadLocal
    + S8209826: Undefined reference to os::write after JDK-8209657
    (filemap.hpp cleanup)
    + S8209850: Allow NamedThreads to use GlobalCounter critical
    sections
    + S8209976: Improve iteration over non-JavaThreads
    + S8209993: Create a test for SwingSet3 ToolTipDemo
    + S8210024: JFR calls virtual is_Java_thread from ~Thread()
    + S8210052: Enable testing for all the available look and feels
    in SwingSet3 demo tests
    + S8210055: Enable different look and feel tests in SwingSet3
    demo tests
    + S8210057: Enable different look and feels in SwingSet3 demo
    test InternalFrameDemoTest
    + S8210058: Algorithmic Italic font leans opposite angle in
    Printing
    + S8210220: [AOT] jdwp test cases are failing with error #
    ERROR: TEST FAILED: Cought IOException while receiving event
    packet
    + S8210289: ArchivedKlassSubGraphInfoRecord is incomplete
    + S8210459: Add support for generating compile_commands.json
    + S8210476: sun/security/mscapi/PrngSlow.java fails with Still
    too slow
    + S8210512: [Testbug] vmTestbase/nsk/jdi/ObjectReference/
    /referringObjects/referringObjects002/referringObjects002.java
    fails with unexpected size of
    ClassLoaderReference.referringObjects
    + S8210523: runtime/appcds/cacheObject/DifferentHeapSizes.java
    crash
    + S8210632: Add key exchange algorithm to
    javax/net/ssl/TLSCommon/CipherSuite.java
    + S8210699: Problem list tests which times out in Xcomp mode
    + S8210793: [JVMCI] AllocateCompileIdTest.java failed to find
    DiagnosticCommand.class
    + S8210910: Create test for FileChooserDemo
    + S8210994: Create test for SwingSet3 FrameDemo
    + S8211139: Increase timeout value in all tests under
    jdk/sanity/client/SwingSet/src
    + S8211160: Handle different look and feels in
    JInternalFrameOperator
    + S8211211: vmTestbase/metaspace/stressDictionary/
    /StressDictionary.java timeout
    + S8211322: Reduce the timeout of tooltip in SwingSet2DemoTest
    + S8211443: Enable different look and feels in SwingSet3 demo
    test SplitPaneDemoTest
    + S8211703: JInternalFrame : java.lang.AssertionError: cannot
    find the internal frame
    + S8211781: re-building fails after changing Graal sources
    + S8212897: Some improvements in the EditorPaneDemotest
    + S8212903: [TestBug] Tests test/jdk/javax/swing/LookAndFeel/
    /8145547/DemandGTK2.sh and DemandGTK3.sh fail on Ubuntu 18.04
    LTS
    + S8213009: Refactoring existing SunMSCAPI classes
    + S8213010: Supporting keys created with certmgr.exe
    + S8213168: Enable different look and feel tests in SwingSet3
    demo test FileChooserDemoTest
    + S8213348: jdk.internal.vm.compiler.management service
    providers missing in module descriptor
    + S8213906: Update arm devkits with libXrandr headers
    + S8213908: AssertionError in DeferredAttr at setOverloadKind
    + S8214124: [TESTBUG] Bugs in runtime/NMT/MallocStressTest.java
    + S8214344: C2: assert(con.basic_type() != T_ILLEGAL) failed:
    elembt=byte; loadbt=void; unsigned=0
    + S8214345: infinite recursion while checking super class
    + S8214471: Enable different look and feel tests in SwingSet3
    demo test ToolTipDemoTest
    + S8214534: Setting of THIS_FILE in the build is broken
    + S8214557: Filter out VM flags which don't affect AOT code
    generation
    + S8214578: [macos] Problem with backslashes on macOS/JIS
    keyboard: Java ignores system settings
    + S8214840: runtime/NMT/MallocStressTest.java timed out
    + S8214850: Rename vm_operations.?pp files to vmOperations.?pp
    files
    + S8214904: Test8004741.java failed due to "Too few ThreadDeath
    hits; expected at least 6 but saw only 5"
    + S8215322: add @file support to jaotc
    + S8215355: Object monitor deadlock with no threads holding the
    monitor (using jemalloc 5.1)
    + S8215396: JTabbedPane preferred size calculation is wrong for
    SCROLL_TAB_LAYOUT
    + S8216180: [AOT] compiler/intrinsics/bigInteger/TestMulAdd.java
    crashed with AOT enabled
    + S8216353: Use utility APIs introduced in org/netbeans/jemmy/
    /util/LookAndFeel class in client sanity test cases
    + S8216354: Syntax error in toolchain_windows.m4
    + S8216472: (se) Stack overflow during selection operation
    leads to crash (win)
    + S8216535: tools/jimage/JImageExtractTest.java timed out
    + S8217235: Create automated test for SwingSet
    ColorChooserDemoTest
    + S8217297: Add support for multiple look and feel for SwingSet
    SliderDemoTest
    + S8217338: [Containers] Improve systemd slice memory limit
    support
    + S8217613: [AOT] TEST_OPTS_AOT_MODULES doesn't work on mac
    + S8217634: RunTest documentation and usability update
    + S8217717: ZGC: Broken oop map in C1 load barrier stub
    + S8217728: Speed up incremental rerun of "make hotspot"
    + S8218268: Javac treats Manifest Class-Path entries as Paths
    instead of URLs
    + S8218662: Allow 204 responses with Content-Length:0
    + S8218882: NET_Writev is declared, NET_WriteV is defined
    + S8218889: Improperly use of the Optional API
    + S8219205: JFR file without license header
    + S8219597: (bf) Heap buffer state changes could provoke
    unexpected exceptions
    + S8219723: javax/net/ssl/compatibility/Compatibility.java
    failed on some SNI cases
    + S8220348: [ntintel] asserts about copying unaligned array
    + S8220451: jdi/EventQueue/remove/remove004 failed due to
    "ERROR: thread2 is not alive"
    + S8220456: jdi/EventQueue/remove_l/remove_l004 failed due to
    "TIMEOUT while waiting for event"
    + S8220479: java/nio/channels/Selector/SelectWithConsumer.java
    failed at testTwoChannels()
    + S8220613: java/util/Arrays/TimSortStackSize2.java times out
    with fastdebug build
    + S8220688: [TESTBUG] runtime/NMT/MallocStressTest.java timed
    out
    + S8220786: Create new switch to redirect error reporting
    output to stdout or stderr
    + S8221270: Duplicated synchronized keywords in SSLSocketImpl
    + S8221312: test/jdk/sanity/client/SwingSet/src/
    /ColorChooserDemoTest.java failed
    + S8221851: Use of THIS_FILE in hotspot invalidates precompiled
    header on Linux/GCC
    + S8221885: Add intermittent test in the JavaSound to the
    ProblemList
    + S8222264: Windows incremental build is broken with JDK-8217728
    + S8222391: javax/net/ssl/compatibility/Compatibility.java
    should be more flexible
    + S8222448: java/lang/reflect/PublicMethods/
    /PublicMethodsTest.java times out
    + S8222519: ButtonDemoScreenshotTest fails randomly with "still
    state to be reached"
    + S8222741: jdi/EventQueue/remove/remove004 fails due to
    VMDisconnectedException
    + S8223003: SunMSCAPI keys are not cleaned up
    + S8223063: Support CNG RSA keys
    + S8223158: Docked MacBook cannot start any Java Swing
    applications
    + S8223260: NamingManager should cache InitialContextFactory
    + S8223464: Improve version string for Oracle CI builds
    + S8223558: Java does not render Myanmar script correctly
    + S8223627: jdk-13+20 bundle name contains null instead of ea
    + S8223638: Replace wildcard address with loopback or local
    host in tests - part 6
    + S8223678: Add Visual Studio Code workspace generation support
    (for native code)
    + S8223727: com/sun/jndi/ldap/privconn/RunTest.java failed due
    to hang in LdapRequest.getReplyBer
    + S8223769: Assert triggers with -XX:+StressReflectiveCode
    + S8224187: Refactor arraycopy_prologue to allow ZGC read
    barriers on arraycopy
    + S8224475: JTextPane does not show images in HTML rendering
    + S8224673: Adjust permission for delayed starting of debugging
    + S8224705: Tests that need to be problem-listed or have
    printer resources
    + S8224778: test/jdk/demo/jfc/J2Ddemo/J2DdemoTest.java cannot
    find J2Ddemo.jar
    + S8224821: java/awt/Focus/NoAutotransferToDisabledCompTest/
    /NoAutotransferToDisabledCompTest.java fails linux-x64
    + S8224830: test/jdk/java/awt/Focus/
    /ModalExcludedWindowClickTest/
    /ModalExcludedWindowClickTest.java fails on linux-x64
    + S8224851: AArch64: fix warnings and errors with Clang and GCC
    8.3
    + S8224905: java/lang/ProcessBuilder/Basic.java#id1 failed with
    stream closed
    + S8225007: java/awt/print/PrinterJob/
    /LandscapeStackOverflow.java may hang
    + S8225105: java/awt/Focus/ShowFrameCheckForegroundTest/
    /ShowFrameCheckForegroundTest.java fails in Windows 10
    + S8225117: java/math/BigInteger/SymmetricRangeTests.java fails
    with ParseException
    + S8225128: Add exception for expiring DocuSign root to
    VerifyCACerts test
    + S8225130: Add exception for expiring Comodo roots to
    VerifyCACerts test
    + S8225144: [macos] In Aqua L&amp;F backspace key does not delete
    when Shift is pressed
    + S8225180: SignedObject with invalid Key not throwing the
    InvalidKeyException in Windows
    + S8225182: JNI exception pending in DestroyXIMCallback of
    awt_InputMethod.c:1327
    + S8225199: [Graal] compiler/jvmci/compilerToVM/
    /IsMatureVsReprofileTest.java fails with
  - XX:CompileThresholdScaling=0.1
    + S8225305: ProblemList java/lang/invoke/VarHandles tests
    + S8225350: compiler/jvmci/compilerToVM/IsCompilableTest.java
    timed out
    + S8225430: Replace wildcard address with loopback or local
    host in tests - part 14
    + S8225435: Upgrade IANA Language Subtag Registry to the latest
    for JDK14
    + S8225487: giflib legal file is missing attribution for
    openbsd-reallocarray.c
    + S8225567: Wrong file headers with 8202414 fix changeset
    + S8225684: [AOT] vmTestbase/vm/oom/production/
    /AlwaysOOMProduction tests fail with AOTed java.base
    + S8225766: Curve in certificate should not affect signature
    scheme when using TLSv1.3
    + S8225797: OldObjectSample event creates unexpected amount of
    checkpoint data
    + S8226381: ProblemList java/lang/reflect/PublicMethods/
    /PublicMethodsTest.java
    + S8226406: JVM fails to detect mismatched or corrupt CDS
    archive
    + S8226608: Hide the onjcmd option from the help output
    + S8226892: ActionListeners on JRadioButtons don't get notified
    when selection is changed with arrow keys
    + S8227112: exclude compiler/intrinsics/sha/sanity tests from
    AOT runs
    + S8227324: Upgrade to freetype 2.10.1
    + S8227528: TestAbortVMOnSafepointTimeout.java failed due to
    "RuntimeException: 'Safepoint sync time longer than' missing
    from stdout/stderr"
    + S8227645: Some tests in serviceability/sa run with fixed -Xmx
    values and risk running out of memory
    + S8227646: [TESTBUG] appcds/SharedArchiveConsistency timed out
    + S8227662: freetype seeks to index at the end of the font data
    + S8228479: Correct the format of ColorChooserDemoTest
    + S8228613: java.security.Provider#getServices order is no
    longer deterministic
    + S8228969: 2019-09-28 public suffix list update
    + S8229236: CriticalJNINatives: dll handling should be done in
    native thread state
    + S8229345: Memory leak due to vtable stubs not being shared on
    SPARC
    + S8229888: (zipfs) Updating an existing zip file does not
    preserve original permissions
    + S8229994: assert(false) failed: Bad graph detected in
    get_early_ctrl_for_expensive
    + S8230004: jdk/internal/jimage/JImageOpenTest.java runs no test
    + S8230235: Rendering HTML with empty img attribute and
    documentBaseKey cause Exception
    + S8230390: Problemlist SA tests with AOT
    + S8230400: Missing constant pool entry for a method in
    stacktrace
    + S8230459: Test failed to resume JVMCI CompilerThread
    + S8230480: check malloc/calloc results in java.desktop
    + S8230597: Update GIFlib library to the 5.2.1
    + S8230611: infinite loop in
    LogOutputList::wait_until_no_readers()
    + S8230624: [TESTBUG] Problemlist JFR
    compiler/TestCodeSweeper.java
    + S8230677: Should disable Escape Analysis if JVMTI capability
    can_get_owned_monitor_info was taken
    + S8230926: [macosx] Two apostrophes are entered instead of one
    with "U.S. International - PC" layout
    + S8231025: Incorrect method tag offset for big endian platform
    + S8231081: TestMetadataRetention fails due to missing symbol id
    + S8231387: java.security.Provider.getService returns random
    result due to race condition with mutating methods in the same
    class
    + S8231430: C2: Memory stomp in max_array_length() for
    T_ILLEGAL type
    + S8231445: check ZALLOC return values in awt coding
    + S8231507: Update Apache Santuario (XML Signature) to version
    2.1.4
    + S8231584: Deadlock with ClassLoader.findLibrary and
    System.loadLibrary call
    + S8231753: use more Posix functionality in aix
    os::print_os_info
    + S8231810: javax/net/ssl/templates/
    /SSLSocketSSLEngineTemplate.java fails intermittently with
    "java.lang.Exception: Unexpected EOF"
    + S8232003: (fs) Files.write can leak file descriptor in the
    exception case
    + S8232056: GetOwnedMonitorInfoWithEATest.java fails with ZGC:
    Heap too small
    + S8232060: add some initializations using sigemptyset in
    os_aix.cpp
    + S8232154: Update Mesa 3-D Headers to version 19.2.1
    + S8232167: Visual Studio install found through
  - -with-tools-dir value is discarded
    + S8232170: FSInfo#getJarClassPath throws an exception not
    declared in its throws clause
    + S8232200: [macos 10.15] Windows in fullscreen tests jumps
    around the screen
    + S8232207: Linux os::available_memory re-reads cgroup
    configuration on every invocation
    + S8232224: [TESTBUG] problemlist JFR TestLargeRootSet.java
    + S8232370: Refactor some com.sun.jdi tests to enable IDE
    integration
    + S8232433: [macos 10.15] java/awt/Window/
    /LocationAtScreenCorner/LocationAtScreenCorner.java may fail
    + S8232571: Add missing SIGINFO signal
    + S8232692: [TESTBUG] compiler/aot/fingerprint/
    /SelfChangedCDS.java fails when cds is disabled
    + S8232713: Update BCEL version to 6.3.1 in license file
    + S8232806: Introduce a system property to disable eager lambda
    initialization
    + S8232834: RunTest sometimes fails to produce valid
    exitcode.txt
    + S8232880: Update test documentation with additional settings
    for client UI tooltip tests
    + S8232950: SUNPKCS11 Provider incorrectly check key length for
    PSS Signatures.
    + S8233018: Add a new test to verify that DatagramSocket is not
    interruptible
    + S8233019: java.lang.Class.isPrimitive() (C1) returns wrong
    result if Klass* is aligned to 32bit
    + S8233032: assert(in_bb(n)) failed: must be
    + S8233078: fix minimal VM build on Linux ppc64(le)
    + S8233328: fix minimal VM build on Linux s390x
    + S8233383: Various minor fixes
    + S8233466: aarch64: remove unnecessary load of mdo when
    profiling return and parameters type
    + S8233491: Crash in AdapterHandlerLibrary::get_adapter with
    CDS due to code cache exhaustion
    + S8233529: loopTransform.cpp:2984: Error: assert(p_f-&gt;Opcode()
    == Op_IfFalse) failed
    + S8233548: Update CUP to v0.11b
    + S8233649: Update ProblemList.txt to exclude failing headful
    tests on macos
    + S8233656: assert(d-&gt;is_CFG() &amp;&amp; n-&gt;is_CFG()) failed: must
    have CFG nodes
    + S8233657: Intermittent NPE in Component.validate()
    + S8234288: Turkey Time Zone returns incorrect time zone name
    + S8234323: NULL-check return value of SurfaceData_InitOps on
    macosx
    + S8234339: replace JLI_StrTok in java_md_solinux.c
    + S8234340: Bump update version for OpenJDK: jdk-11.0.7
    + S8234350: assert(mode == ControlAroundStripMined &amp;&amp; (use ==
    sfpt || !use-&gt;is_reachable_from_root())) failed: missed a node
    + S8234386: [macos] NPE was thrown at expanding Choice from
    maximized frame
    + S8234397: add OS uptime information to os::print_os_info
    output
    + S8234423: Modifying ArrayList.subList().subList() resets
    modCount of subList
    + S8234466: Class loading deadlock involving
    X509Factory#commitEvent()
    + S8234501: remove obsolete NET_ReadV
    + S8234525: enable link-time section-gc for linux s390x to
    remove unused code
    + S8234610: MaxVectorSize set wrongly when UseAVX=3 is
    specified after JDK-8221092
    + S8234617: C1: Incorrect result of field load due to missing
    narrowing conversion
    + S8234723: javax/net/ssl/TLS tests support TLSv1.3
    + S8234724: javax/net/ssl/templates/
    /SSLSocketSSLEngineTemplate.java supports TLSv1.3
    + S8234741: enhance os::get_core_path on macOS
    + S8234769: Duplicate attribution in freetype.md
    + S8234786: Fix for JDK-8214578 breaks OS X 10.12 compatibility
    + S8234809: set relro in linker flags when building with gcc
    + S8234824: java/nio/channels/SocketChannel/AdaptSocket.java
    fails on Windows 10
    + S8235243: handle VS2017 15.9 and VS2019 in abstract_vm_version
    + S8235288: AVX 512 instructions inadvertently used on Xeon for
    small vector width operations
    + S8235325: build failure on Linux after 8235243
    + S8235383: C1 compilation fails with
  - XX:+PrintIRDuringConstruction -XX:+Verbose
    + S8235489: handle return values of sscanf calls in hotspot
    + S8235509: Backport for JDK-8209657 Refactor filemap.hpp to
    simplify integration with Serviceability Agent.
    + S8235510: java.util.zip.CRC32 performance drop after 8200067
    + S8235563: [TESTBUG] appcds/CommandLineFlagComboNegative.java
    does not handle archive mapping failure
    + S8235637: jhsdb jmap from OpenJDK 11.0.5 doesn't work if
    prelink is enabled
    + S8235671: enhance print_rlimit_info in os_posix
    + S8235744: PIT: test/jdk/javax/swing/text/html/
    /TestJLabelWithHTMLText.java times out in linux-x64
    + S8235904: Infinite loop when rendering huge lines
    + S8235998: [c2] Memory leaks during tracing after '8224193:
    stringStream should not use Resource Area'.
    + S8236039: JSSE Client does not accept status_request
    extension in CertificateRequest messages for TLS 1.3
    + S8236140: assert(!VerifyHashTableKeys || _hash_lock == 0)
    failed: remove node from hash table before modifying it
    + S8236179: C1 register allocation error with T_ADDRESS
    + S8236488: Support for configure option
  - -with-native-debug-symbols=internal is impossible on Windows
    + S8236500: Windows ucrt.dll should be looked up in versioned
    WINSDK subdirectory
    + S8236709: struct SwitchRange in HS violates C++ One
    Definition Rule
    + S8236848: [JDK 11u] make run-test-tier1 fails after backport
    of JDK-8232834
    + S8236873: Worker has a deadlock bug
    + S8237217: Incorrect G1StringDedupEntry type used in
    StringDedupTable destructor
    + S8237368: Problem with NullPointerException in RMI
    TCPEndpoint.read
    + S8237375: SimpleThresholdPolicy misses CounterDecay timestamp
    initialization
    + S8237508: Simplify JarFile.isInitializing
    + S8237540: Missing files in backport of JDK-8210910
    + S8237541: Missing files in backport of JDK-8236528
    + S8237600: Test SunJSSEFIPSInit fails on Ubuntu
    + S8237819: s390x - remove unused pd_zero_to_words_large
    + S8237869: exclude jtreg test security/infra/java/security/
    /cert/CertPathValidator/certification/LuxTrustCA.java because
    of instabilities
    + S8237879: make 4.3 breaks build
    + S8237945: CTW: C2 compilation fails with
    assert(just_allocated_object(alloc_ctl) == ptr) failed: most
    recent allo...
    + S8238225: Issues reported after replacing symlink at
    Contents/MacOS/libjli.dylib with binary
    + S8238247: CTW runner should sweep nmethods more aggressively
    + S8238366: CTW runner closes standard output on exit
    + S8238438: SuperWord::co_locate_pack picks memory state of
    first instead of last load
    + S8238502: sunmscapi.dll causing EXCEPTION_ACCESS_VIOLATION
    + S8238534: Deep sign macOS bundles before bundle archive is
    being created
    + S8238591: CTW: Split
    applications/ctw/modules/jdk_localedata.java
    + S8238596: AVX enabled by default for Skylake even when
    unsupported
    + S8238811: C2: assert(i &gt;= req() || i == 0 || is_Region() ||
    is_Phi()) with -XX:+VerifyGraphEdges
    + S8239005: [TESTBUG] test/hotspot/jtreg/runtime/
    /StackGuardPages/TestStackGuardPages.java: exeinvoke.c: must
    initialize static state before calling do_overflow()
    + S8239466: Loss of precision in counter decay calculation in
    11u backport of JDK-8237375
    + S8239856: [ntintel] asserts about copying unaligned array
    element
    + S8240724: [test] jdk11 downport of 8224475 misses binary file
    test/jdk/javax/swing/JTextPane/arrow.png
    + S8241296: Segfault in JNIHandleBlock::oops_do()
- Removed patch:
  * DependOnVariableHelper.patch
    + fixed upstream
- Added patch:
  * JDK-8228407.patch
    + fix crashes due to shared archive file mismatch</changelog>
  <changelog author="fstrba@suse.com" date="1594900800">- Update to upstream tag jdk-11.0.8+10 (July 2020 CPU, bsc#1174157)
  * Security fixes:
    + JDK-8230613: Better ASCII conversions
    + JDK-8231800: Better listing of arrays
    + JDK-8232014: Expand DTD support
    + JDK-8233234: Better Zip Naming
    + JDK-8233239, CVE-2020-14562: Enhance TIFF support
    + JDK-8233255: Better Swing Buttons
    + JDK-8234032: Improve basic calendar services
    + JDK-8234042: Better factory production of certificates
    + JDK-8234418: Better parsing with CertificateFactory
    + JDK-8234836: Improve serialization handling
    + JDK-8236191: Enhance OID processing
    + JDK-8236867, CVE-2020-14573: Enhance Graal interface handling
    + JDK-8237117, CVE-2020-14556: Better ForkJoinPool behavior
    + JDK-8237592, CVE-2020-14577: Enhance certificate verification
    + JDK-8238002, CVE-2020-14581: Better matrix operations
    + JDK-8238013: Enhance String writing
    + JDK-8238804: Enhance key handling process
    + JDK-8238842: AIOOBE in GIFImageReader.initializeStringTable
    + JDK-8238843: Enhanced font handing
    + JDK-8238920, CVE-2020-14583: Better Buffer support
    + JDK-8238925: Enhance WAV file playback
    + JDK-8240119, CVE-2020-14593: Less Affine Transformations
    + JDK-8240482: Improved WAV file playback
    + JDK-8241379: Update JCEKS support
    + JDK-8241522: Manifest improved jar headers redux
    + JDK-8242136, CVE-2020-14621: Better XML namespace handling
  * Other changes:
    + JDK-6933331: (d3d/ogl) java.lang.IllegalStateException:
    Buffers have not been created
    + JDK-7124307: JSpinner and changing value by mouse
    + JDK-8022574: remove HaltNode code after uncommon trap calls
    + JDK-8039082: [TEST_BUG] Test
    java/awt/dnd/BadSerializationTest/BadSerializationTest.java
    fails
    + JDK-8040630: Popup menus and tooltips flicker with previous
    popup contents when first shown
    + JDK-8044365: (dc) MulticastSendReceiveTests.java failing with
    ENOMEM when joining group (OS X 10.9)
    + JDK-8048215: [TESTBUG]
    java/lang/management/ManagementFactory/ThreadMXBeanProxy.java
    Expected non-null LockInfo
    + JDK-8051349: nsk/jvmti/scenarios/sampling/SP06/sp06t003 fails
    in nightly
    + JDK-8080353: JShell: Better error message on attempting to
    add default method
    + JDK-8139876: Exclude hanging nsk/stress/stack from execution
    with deoptimization enabled
    + JDK-8146090: java/lang/ref/ReachabilityFenceTest.java fails
    with -XX:+DeoptimizeALot
    + JDK-8153430: jdk regression test MletParserLocaleTest,
    ParserInfiniteLoopTest reduce default timeout
    + JDK-8156207: Resource allocated BitMaps are often cleared
    unnecessarily
    + JDK-8159740: JShell: corralled declarations do not have
    correct source to wrapper mapping
    + JDK-8175984: ICC_Profile has un-needed, not-empty finalize
    method
    + JDK-8176359: Frame#setMaximizedbounds not working properly in
    multi screen environments
    + JDK-8183369: RFC unconformity of HttpURLConnection with proxy
    + JDK-8187078: -XX:+VerifyOops finds numerous problems when
    running JPRT
    + JDK-8189861: Refactor CacheFind
    + JDK-8191169: java/net/Authenticator/B4769350.java failed
    intermittently
    + JDK-8191930: [Graal] emits unparseable XML into compile log
    + JDK-8193879: Java debugger hangs on method invocation
    + JDK-8196019: java/awt/Window/Grab/GrabTest.java fails on
    Windows
    + JDK-8196181: sun/java2d/GdiRendering/InsetClipping.java fails
    + JDK-8198000:
    java/awt/List/EmptyListEventTest/EmptyListEventTest.java
    debug assert on Windows
    + JDK-8198001: java/awt/Menu/WrongParentAfterRemoveMenu/
    /WrongParentAfterRemoveMenu.java debug assert on Windows
    + JDK-8198339: Test javax/swing/border/Test6981576.java is
    unstable
    + JDK-8200701: jdk/jshell/ExceptionsTest.java fails on Windows,
    after JDK-8198801
    + JDK-8203264: JNI exception pending in
    PlainDatagramSocketImpl.c:740
    + JDK-8203672: JNI exception pending in PlainSocketImpl.c
    + JDK-8203673: JNI exception pending in
    DualStackPlainDatagramSocketImpl.c:398
    + JDK-8204834: Fix confusing "allocate" naming in OopStorage
    + JDK-8205399: Set node color on pinned HashMap.TreeNode
    deletion
    + JDK-8205653: test/jdk/sun/management/jmxremote/bootstrap/
    /RmiRegistrySslTest.java and RmiSslBootstrapTest.sh fail with
    handshake_failure
    + JDK-8206179: com/sun/management/OperatingSystemMXBean/
    /GetCommittedVirtualMemorySize.java fails with Committed
    virtual memory size illegal value
    + JDK-8207334: VM times out in VM_HandshakeAllThreads::doit()
    with RunThese30M
    + JDK-8208277: Code cache heap (-XX:ReservedCodeCacheSize)
    doesn't work with 1GB LargePages
    + JDK-8209113: Use WeakReference for lastFontStrike for created
    Fonts
    + JDK-8209333: Socket reset issue for TLS 1.3 socket close
    + JDK-8209439: C2 library_call can potentially ignore Math.pow
    intrinsic or use null pointer
    + JDK-8209534: [TESTBUG]runtime/appcds/cacheObject/
    /ArchivedModuleCompareTest.java fails with EnableJVMCI.
    + JDK-8210147: adjust some WSAGetLastError usages in windows
    network coding
    + JDK-8210284: "assert((av &amp; 0x00000001) == 0) failed:
    unsupported V8" on Solaris 11.4
    + JDK-8210303: VM_HandshakeAllThreads fails assert with
    "failed: blocked and not walkable"
    + JDK-8210459: Add support for generating compile_commands.json
    + JDK-8210515: [TESTBUG]CheckArchivedModuleApp.java needs to
    check if EnableJVMCI is set.
    + JDK-8210788: Javadoc for Thread.join(long, int) should
    specify that it waits forever when both arguments are zero
    + JDK-8211301: [macos] support full window content options
    + JDK-8211332: Space for stub routines (code_size2) is too
    small on new Skylake CPUs
    + JDK-8211339: NPE during SSL handshake caused by
    HostnameChecker
    + JDK-8211392: compiler/profiling/
    /spectrapredefineclass_classloaders/Launcher.java times out
    in JDK12 CI
    + JDK-8211743: [AOT] crash in ScopeDesc::decode_body() when
    JVMTI walks AOT frames
    + JDK-8212154: [TESTBUG] CheckArchivedModuleApp fails with NPE
    when JVMCI is absent
    + JDK-8212167: JShell : Stack trace of exception has wrong line
    number
    + JDK-8212933: Thread-SMR: requesting a VM operation whilst
    holding a ThreadsListHandle can cause deadlocks
    + JDK-8212986: Make Visual Studio compiler check less strict
    + JDK-8213250: CDS archive creation aborts due to metaspace
    object allocation failure
    + JDK-8213516: jck test api/javax_accessibility/AccessibleState/
    /fields.html fails intermittent
    + JDK-8213947: ARM32: failed check_simd should set
    UsePopCountInstruction to false
    + JDK-8214418: half-closed SSLEngine status may cause
    application dead loop
    + JDK-8214440: ldap over a TLS connection negotiate failed with
    "javax.net.ssl.SSLPeerUnverifiedException: hostname of the
    server does not match the hostname in the server's
    certificate"
    + JDK-8214444: Wrong strncat limits in dfa.cpp
    + JDK-8214481: freetype path does not disable TrueType hinting
    with AA+FM hints
    + JDK-8214571: -Xdoclint of array serialField gives "error:
    array type not allowed here"
    + JDK-8214856: Errors with JSZip in web console after upgrade
    to 3.1.5
    + JDK-8214862: assert(proj != __null) at compile.cpp:3251
    + JDK-8215369: Jcstress pollute /var/tmp with temporary files.
    + JDK-8215551: Missing case label in nmethod::reloc_string_for()
    + JDK-8215555: TieredCompilation C2 threads can excessively
    block handshakes
    + JDK-8215711: Missing key_share extension for (EC)DHE key
    exchange should alert missing_extension
    + JDK-8216151: [Graal] Module
    jdk.internal.vm.compiler.management has not been granted
    accessClassInPackage.org.graalvm.compiler.debug
    + JDK-8216154: C4819 warnings at HotSpot sources on Windows
    + JDK-8216541: CompiledICHolders of VM locked unloaded nmethods
    are released too late
    + JDK-8217230: assert(t == t_no_spec) failure in
    NodeHash::check_no_speculative_types()
    + JDK-8217404: --with-jvm-features doesn't work when multiple
    features are explicitly disabled
    + JDK-8217447: Develop flag TraceICs is broken
    + JDK-8217606: LdapContext#reconnect always opens a new
    connection
    + JDK-8218807: Compilation database (compile_commands.json) may
    contain obsolete items
    + JDK-8219214: Infinite Loop in CodeSection::dump()
    + JDK-8219904: ClassCastException when calling
    FlightRecorderMXBean#getRecordings()
    + JDK-8219991: New fix of the deadlock in
    sun.security.ssl.SSLSocketImpl
    + JDK-8221121: applications/microbenchmarks are encountering
    crashes in tier5
    + JDK-8221445: FastSysexMessage constructor crashes MIDI
    receiption thread
    + JDK-8221482: Initialize VMRegImpl::regName[] earlier to
    prevent assert during PrintStubCode
    + JDK-8221741: ClassCastException can happen when
    fontconfig.properties is used
    + JDK-8221823: Requested JDialog width is ignored
    + JDK-8223108: Test java/awt/EventQueue/
    /NonComponentSourcePost.java is unstable
    + JDK-8223678: Add Visual Studio Code workspace generation
    support (for native code)
    + JDK-8223935: PIT: java/awt/font/WindowsIndicFonts.java fails
    on windows10
    + JDK-8224109: Text spaced incorrectly by drawString under
    rotation with fractional metric
    + JDK-8224632: testbug: java/awt/dnd/RemoveDropTargetCrashTest/
    /RemoveDropTargetCrashTest.java fails on MacOS
    + JDK-8224793: os::die() does not honor CreateCoredumpOnCrash
    option
    + JDK-8224847: gc/stress/TestReclaimStringsLeaksMemory.java
    fails with reserved greater than expected
    + JDK-8224931: disable JAOTC invokedynamic support until
    8223533 is fixed
    + JDK-8224997: ChaCha20-Poly1305 TLS cipher suite decryption
    throws ShortBufferException
    + JDK-8225068: Remove DocuSign root certificate that is
    expiring in May 2020
    + JDK-8225069: Remove Comodo root certificate that is expiring
    in May 2020
    + JDK-8225126: Test SetBoundsPaintTest.html faild on Windows
    when desktop is scaled
    + JDK-8225325: Add tests for redefining a class' private method
    during resolution of the bootstrap specifier
    + JDK-8225622: [AOT] runtime/SharedArchiveFile/
    /TestInterpreterMethodEntries.java crashed with AOTed
    java.base
    + JDK-8225653: Provide more information when hitting SIGILL
    from HaltNode
    + JDK-8225783: Incorrect use of binary operators on booleans in
    type.cpp
    + JDK-8225789: Empty method parameter type should generate
    ClassFormatError
    + JDK-8226198: use of &amp; instead of &amp;&amp; in
    LibraryCallKit::arraycopy_restore_alloc_state
    + JDK-8226253: JAWS reports wrong number of radio buttons when
    buttons are hidden.
    + JDK-8226653: [accessibility] Can edit text cell correctly,
    but Accessibility Tool reads nothing about editor
    + JDK-8226806: [macOS 10.14] Methods of Java Robot should be
    called from appropriate thread
    + JDK-8226879: Memory leak in Type::hashcons
    + JDK-8227632: Incorrect PrintCompilation message: made not
    compilable on levels 0 1 2 3 4
    + JDK-8228407: JVM crashes with shared archive file mismatch
    + JDK-8228482: fix xlc16/xlclang comparison of distinct pointer
    types and string literal conversion warnings
    + JDK-8228757: Fail fast if the handshake type is unknown
    + JDK-8229158: make UseSwitchProfiling non-experimental or
    false by-default
    + JDK-8229421: The logic of java/net/ipv6tests/TcpTest.java is
    flawed
    + JDK-8229855: C2 fails with assert(false) failed: bad AD file
    + JDK-8230591: AArch64: Missing intrinsics for Math.ceil,
    floor, rint
    + JDK-8231118: ARM32: Math tests failures
    + JDK-8231213: Migrate SimpleDateFormatConstTest to JDK Repo
    + JDK-8231243: [TESTBUG] CustomFont.java cannot find font file
    + JDK-8231438: [macOS] Dark mode for the desktop is not
    supported
    + JDK-8231550: C2: ShouldNotReachHere() in
    verify_strip_mined_scheduling
    + JDK-8231564: setMaximizedBounds is broken with large display
    scale and multiple monitors
    + JDK-8231572: Use -lobjc instead of -fobjc-link-runtime in
    libosxsecurity
    + JDK-8231631: sun/net/ftp/FtpURLConnectionLeak.java fails
    intermittently with NPE
    + JDK-8231671: Fix copyright headers in hotspot (missing comma
    after year)
    + JDK-8231720: Some perf regressions after 8225653
    + JDK-8231779: crash
    HeapWord*ParallelScavengeHeap::failed_mem_allocate
    + JDK-8231863: Crash if classpath is read from @argument file
    and the main gets option argument
    + JDK-8232080: jlink plugins for vendor information and
    run-time options
    + JDK-8232106: [x86] C2: SIGILL due to usage of SSSE3
    instructions on processors which don't support it
    + JDK-8232134: Change to Visual Studio 2017 15.9.16 for
    building on Windows at Oracle
    + JDK-8232226: [macos 10.15] test/jdk/java/awt/color/
    /EqualityTest/EqualityTest.java may fail
    + JDK-8232357: Compare version info of Santuario to legal notice
    + JDK-8232572: Add hooks for custom output dir in Bundles.gmk
    + JDK-8232634: Problem List ICMColorDataTest.java
    + JDK-8232748: Build static versions of certain JDK libraries
    + JDK-8232846: ProcessHandle.Info command with non-English
    shows question marks
    + JDK-8232880: Update test documentation with additional
    settings for client UI tooltip tests
    + JDK-8233033: C2 produces wrong result while unswitching a
    loop due to lost control dependencies
    + JDK-8233137: runtime/ErrorHandling/VeryEarlyAssertTest.java
    fails after 8232080
    + JDK-8233197: Invert JvmtiExport::post_vm_initialized() and
    Jfr:on_vm_start() start-up order for correct option parsing
    + JDK-8233291: [TESTBUG] tools/jlink/plugins/
    /VendorInfoPluginsTest.java fails with debug or non-server VMs
    + JDK-8233364: Fix undefined behavior in
    Canonicalizer::do_ShiftOp
    + JDK-8233494: Avoid calling MallocTracker::record_malloc and
    record_free when NMT is off
    + JDK-8233573: Toolkit.getScreenInsets(GraphicsConfiguration)
    may throw ClassCastException
    + JDK-8233608: Minimal build broken after JDK-8233494
    + JDK-8233621: Mismatch in jsse.enableMFLNExtension property
    name
    + JDK-8233696: [TESTBUG]Some jtreg tests fail when CAPS_LOCK is
    ON
    + JDK-8233707: systemScale.cpp could not compile with VS2019
    + JDK-8233801: GCMEmptyIv.java test fails on Solaris 11.4
    + JDK-8233880: Support compilers with multi-digit major version
    numbers
    + JDK-8233920: MethodHandles::tryFinally generates illegal
    bytecode for long/double return type
    + JDK-8234137: The "AutoTestOnTop.java" test may run external
    applications
    + JDK-8234146: compiler/jsr292/
    /ContinuousCallSiteTargetChange.java times out on SPARC
    + JDK-8234184: [TESTBUG] java/awt/Mouse/EnterExitEvents/
    /ModalDialogEnterExitEventsTest.java fails in Windows
    + JDK-8234270: [REDO] JDK-8204128 NMT might report incorrect
    numbers for Compiler area
    + JDK-8234332: [TESTBUG] java/awt/Focus/DisposedWindow/
    /DisposeDialogNotActivateOwnerTest/
    /DisposeDialogNotActivateOwnerTest.java fails on linux-x64
    nightly
    + JDK-8234398: Replace ID2D1Factory::GetDesktopDpi with
    GetDeviceCaps
    + JDK-8234522: [macos] Crash with use of native file dialog
    + JDK-8234691: Potential double-free in ParallelSPCleanupTask
    constructor
    + JDK-8234696: tools/jlink/plugins/VendorInfoPluginsTest.java
    times out
    + JDK-8234727: sun/security/ssl/X509TrustManagerImpl tests
    support TLSv1.3
    + JDK-8234728: Some security tests should support TLSv1.3
    + JDK-8234779: Provide idiom for declaring classes noncopyable
    + JDK-8234824: java/nio/channels/SocketChannel/AdaptSocket.java
    fails on Windows 10
    + JDK-8234968: check calloc rv in libinstrument
    InvocationAdapter
    + JDK-8235153: [TESTBUG] [macos 10.15] java/awt/Graphics/
    /DrawImageBG/SystemBgColorTest.java fails
    + JDK-8235183: Remove the "HACK CODE" in comment
    + JDK-8235263: Revert TLS 1.3 change that wrapped IOExceptions
    + JDK-8235311: Tag mismatch may alert bad_record_mac
    + JDK-8235332: TestInstanceCloneAsLoadsStores.java fails with
  - XX:+StressGCM
    + JDK-8235452: Strip mined loop verification fails with
    assert(is_OuterStripMinedLoop()) failed: invalid node class
    + JDK-8235584: UseProfiledLoopPredicate fails with
    assert(_phase-&gt;get_loop(c) == loop) failed: have to be in the
    same loop
    + JDK-8235620: Broken merge between JDK-8006406 and JDK-8003559
    + JDK-8235638: NPE in LWWindowPeer.getOnscreenGraphics()
    + JDK-8235686: Add more custom hooks in Bundles.gmk
    + JDK-8235739: Rare NPE at WComponentPeer.getGraphics()
    + JDK-8235762: JVM crash in SWPointer during C2 compilation
    + JDK-8235834: IBM-943 charset encoder needs updating
    + JDK-8235874: The ordering of Cipher Suites is not maintained
    provided through jdk.tls.client.cipherSuites and
    jdk.tls.server.cipherSuites system property.
    + JDK-8235908: omit ThreadPriorityPolicy warning when value is
    set from image
    + JDK-8235984: C2: assert(out-&gt;in(PhiNode::Region) == head ||
    out-&gt;in(PhiNode::Region) == slow_head) failed: phi must be
    either part of the slow or the fast loop
    + JDK-8236211: [Graal] compiler/graalunit/GraphTest.java is
    skipped in all testing
    + JDK-8236470: Deal with ECDSA using ecdsa-with-SHA2 plus hash
    algorithm as AlgorithmId
    + JDK-8236545: Compilation error in mach5
    java/awt/FileDialog/MacOSGoToFolderCrash.java
    + JDK-8236700: Upgrading JSZip from v3.1.5 to v3.2.2
    + JDK-8236759: ShouldNotReachHere in
    PhaseIdealLoop::verify_strip_mined_scheduling
    + JDK-8236897: Fix the copyright header for pkcs11gcm2.h
    + JDK-8236921: Add build target to produce a JDK image suitable
    for a Graal/SVM build
    + JDK-8236953: [macos] JavaFX SwingNode is not rendered on macOS
    + JDK-8236996: Incorrect Roboto font rendering on Windows with
    subpixel antialiasing
    + JDK-8237045: JVM uses excessive memory with -XX:+EnableJVMCI
  - XX:JVMCICounterSize=2147483648
    + JDK-8237055: [TESTBUG] compiler/c2/TestJumpTable.java fails
    with release VMs
    + JDK-8237086: assert(is_MachReturn()) running CTW with fix for
    JDK-8231291
    + JDK-8237192: Generate stripped/public pdbs on Windows for jdk
    images
    + JDK-8237396: JvmtiTagMap::weak_oops_do() should not trigger
    barriers
    + JDK-8237474: Default SSLEngine should create in server role
    + JDK-8237859: C2: Crash when loads float above range check
    + JDK-8237879: make 4.3 breaks build
    + JDK-8237951: CTW: C2 compilation fails with "malformed
    control flow"
    + JDK-8237962: give better error output for invalid OCSP
    response intervals in CertPathValidator checks
    + JDK-8238190: [JVMCI] Fix single implementor speculation for
    diamond shapes.
    + JDK-8238356: CodeHeap::blob_count() overestimates the number
    of blobs
    + JDK-8238452: Keytool generates wrong expiration date if
    validity is set to 2050/01/01
    + JDK-8238555: Allow Initialization of SunPKCS11 with NSS when
    there are external FIPS modules in the NSSDB
    + JDK-8238575: DragSourceEvent.getLocation() returns wrong
    value on HiDPI screens (Windows)
    + JDK-8238676: jni crashes on accessing it from process exit
    hook
    + JDK-8238721: Add failing client jtreg tests to the Problem
    List
    + JDK-8238738: AudioSystem.getMixerInfo() takes about 30 sec to
    report a gone audio device
    + JDK-8238756: C2: assert(((n) == __null || !VerifyIterativeGVN
    || !((n)-&gt;is_dead()))) failed: can not use dead node
    + JDK-8238765: PhaseCFG::schedule_pinned_nodes cannot handle
    precedence edges from unmatched CFG nodes correctly
    + JDK-8238898: Missing hash characters for header on license
    file
    + JDK-8238942: Rendering artifacts with LCD text and fractional
    metrics
    + JDK-8238985: [TESTBUG] The arrow image is blue instead of
    green
    + JDK-8239000: handle ContendedPaddingWidth in vm_version_ppc
    + JDK-8239055: Wrong implementation of VMState.hasListener
    + JDK-8239091: Reversed arguments in call to strstr in freetype
    "debug" code.
    + JDK-8239142: C2's UseUniqueSubclasses optimization is broken
    for array accesses
    + JDK-8239224: libproc_impl.c previous_thr may be used
    uninitialized warning
    + JDK-8239351: Give more meaningful InternalError messages in
    Deflater.c
    + JDK-8239365: ProcessBuilder test modifications for AIX
    execution
    + JDK-8239456: vtable stub generation: assert failure (code
    size estimate)
    + JDK-8239457: call ReleaseStringUTFChars before early returns
    in Java_sun_security_pkcs11_wrapper_PKCS11_connect
    + JDK-8239462: jdk.hotspot.agent misses some
    ReleaseStringUTFChars calls in case of early returns
    + JDK-8239557: [TESTBUG] VeryEarlyAssertTest.java validating
    "END." marker at lastline is not always true
    + JDK-8239787: AArch64: String.indexOf may incorrectly handle
    empty strings
    + JDK-8239792: Bump update version for OpenJDK: jdk-11.0.8
    + JDK-8239798: SSLSocket closes socket both socket endpoints on
    a SocketTimeoutException
    + JDK-8239819: XToolkit: Misread of screen information memory
    + JDK-8239852: java/util/concurrent tests fail with
  - XX:+VerifyGraphEdges: assert(!VerifyGraphEdges) failed:
    verification should have failed
    + JDK-8239893: Windows handle Leak when starting processes
    using ProcessBuilder
    + JDK-8239915: Zero VM crashes when handling dynamic constant
    + JDK-8239931: [win][x86] vtable stub generation: assert
    failure (code size estimate) follow-up
    + JDK-8239965: XMLEncoder/Test4625418.java fails due to "Error:
    Cp943 - can't read properly"
    + JDK-8239976: Put JDK-8239965 on the ProblemList.txt
    + JDK-8240073: Fix 'test-make' build target in 11u
    + JDK-8240197: Cannot start JVM when $JAVA_HOME includes CJK
    characters
    + JDK-8240202: A few client tests leave mouse buttons pressed
    + JDK-8240220: IdealLoopTree::dump_head predicate printing is
    broken
    + JDK-8240223: Use consistent predicate order in and with
    PhaseIdealLoop::find_predicate
    + JDK-8240227: Loop predicates should be copied to unswitched
    loops
    + JDK-8240286: [TESTBUG] Test command error in hotspot/jtreg/
    /compiler/loopopts/superword/SumRedAbsNeg_Float.java
    + JDK-8240518: Incorrect JNU_ReleaseStringPlatformChars in
    Windows Print
    + JDK-8240529: CheckUnhandledOops breaks NULL check in
    Modules::define_module
    + JDK-8240576: JVM crashes after transformation in C2
    IdealLoopTree::merge_many_backedges
    + JDK-8240603: Windows 32bit compile error after 8238676
    + JDK-8240629: argfiles parsing broken for argfiles with
    comment cross 4096 bytes chunk
    + JDK-8240711: TestJstatdPort.java failed due to
    "ExportException: Port already in use:"
    + JDK-8240786: [TESTBUG] The test java/awt/Window/
    /GetScreenLocation/GetScreenLocationTest.java fails on HiDPI
    screen
    + JDK-8240824: enhance print_full_memory_info on Linux by THP
    related information
    + JDK-8240827: Downport SSLSocketImpl.java from "8221882: Use
    fiber-friendly java.util.concurrent.locks in JSSE"
    + JDK-8240905: assert(mem == (Node*)1 || mem == mem2) failed:
    multiple Memories being matched at once?
    + JDK-8240972: macOS codesign fail on macOS 10.13.5 or older
    + JDK-8241445: Fix copyright in
    test/jdk/tools/launcher/ArgFileSyntax.java
    + JDK-8241458: [JVMCI] add mark value to expose
    CodeOffsets::Frame_Complete
    + JDK-8241464: [11u] Backport: make rehashing be a needed
    guaranteed safepoint cleanup action
    + JDK-8241556: Memory leak if -XX:CompileCommand is set
    + JDK-8241568: (fs) UserPrincipalLookupService.lookupXXX
    failure with IOE "Operation not permitted"
    + JDK-8241586: compiler/cpuflags/
    /TestAESIntrinsicsOnUnsupportedConfig.java fails on aarch64
    + JDK-8241638: launcher time metrics always report 1 on Linux
    when _JAVA_LAUNCHER_DEBUG set
    + JDK-8241660: Add virtualization information output to hs_err
    file on macOS
    + JDK-8241808: [TESTBUG] The JDK-8039467 bug appeared on macOS
    + JDK-8241888: Mirror jdk.security.allowNonCaAnchor system
    property with a security one
    + JDK-8241900: Loop unswitching may cause dependence on null
    check to be lost
    + JDK-8241948: enhance list of environment variables printed in
    hs_err file
    + JDK-8241996: on linux set full relro in the linker flags
    + JDK-8242108: Performance regression after fix for JDK-8229496
    + JDK-8242141: New System Properties to configure the TLS
    signature schemes
    + JDK-8242154: Backport parts of JDK-4947890 to OpenJDK 11u
    + JDK-8242174: [macos] The NestedModelessDialogTest test make
    the macOS unstable
    + JDK-8242239: [Graal] javax/management/generified/
    /GenericTest.java fails: FAILED: queryMBeans sets same
    + JDK-8242294: JSSE Client does not throw SSLException when an
    alert occurs during handshaking
    + JDK-8242379: [TESTBUG] compiler/loopopts/
    /TestLoopUnswitchingLostCastDependency.java fails with
    release VMs
    + JDK-8242470: Update Xerces to Version 2.12.1
    + JDK-8242498: Invalid "sun.awt.TimedWindowEvent" object leads
    to JVM crash
    + JDK-8242541: Small charset issues (ISO8859-16, x-eucJP-Open,
    x-IBM834 and x-IBM949C)
    + JDK-8242626: enhance posix print_rlimit_info
    + JDK-8243059: Build fails when --with-vendor-name contains a
    comma
    + JDK-8243539: Copyright info (Year) should be updated for fix
    of 8241638
    + JDK-8243541: (tz) Upgrade time-zone data to tzdata2020a
    + JDK-8244407: JVM crashes after transformation in C2
    IdealLoopTree::split_fall_in
    + JDK-8244520: problemlist
    java/awt/font/Rotate/RotatedFontTest.java on linux
    + JDK-8244777: ClassLoaderStats VM Op uses constant hash value
    + JDK-8244853: The static build of libextnet is missing the
    JNI_OnLoad_extnet function
    + JDK-8244951: Missing entitlements for hardened runtime
    + JDK-8245047: [PPC64] C2: ReverseBytes + Load always match to
    unordered Load (acquire semantics missing)
    + JDK-8245649: Revert 8245397 backport of 8230591
    + JDK-8246031: SSLSocket.getSession() doesn't close connection
    for timeout/ interrupts
    + JDK-8246613: Choose the default SecureRandom algo based on
    registration ordering
    + JDK-8248505: Unexpected NoSuchAlgorithmException when using
    secure random impl from BCFIPS provider
- Removed patch:
  * JDK-8228407.patch
    + integrated upstream</changelog>
  <changelog author="fstrba@suse.com" date="1604318400">- Update to upstream tag jdk-11.0.9-11 (October 2020 CPU,
  bsc#1177943)
  * New features
    + JDK-8250784: Shenandoah: A Low-Pause-Time Garbage Collector
  * Security fixes
    + JDK-8233624: Enhance JNI linkage
    + JDK-8236196: Improve string pooling
    + JDK-8236862, CVE-2020-14779: Enhance support of Proxy class
    + JDK-8237990, CVE-2020-14781: Enhanced LDAP contexts
    + JDK-8237995, CVE-2020-14782: Enhance certificate processing
    + JDK-8240124: Better VM Interning
    + JDK-8241114, CVE-2020-14792: Better range handling
    + JDK-8242680, CVE-2020-14796: Improved URI Support
    + JDK-8242685, CVE-2020-14797: Better Path Validation
    + JDK-8242695, CVE-2020-14798: Enhanced buffer support
    + JDK-8243302: Advanced class supports
    + JDK-8244136, CVE-2020-14803: Improved Buffer supports
    + JDK-8244479: Further constrain certificates
    + JDK-8244955: Additional Fix for JDK-8240124
    + JDK-8245407: Enhance zoning of times
    + JDK-8245412: Better class definitions
    + JDK-8245417: Improve certificate chain handling
    + JDK-8248574: Improve jpeg processing
    + JDK-8249927: Specify limits of jdk.serialProxyInterfaceLimit
    + JDK-8253019: Enhanced JPEG decoding
  * Other changes
    + JDK-6532025: GIF reader throws misleading exception with
    truncated images
    + JDK-6949753: [TEST BUG]: java/awt/print/PageFormat/
    /PDialogTest.java needs update by removing an infinite loop
    + JDK-8022535: [TEST BUG] javax/swing/text/html/parser/
    /Test8017492.java fails
    + JDK-8062947: Fix exception message to correctly represent
    LDAP connection failure
    + JDK-8067354: com/sun/jdi/GetLocalVariables4Test.sh failed
    + JDK-8134599: TEST_BUG: java/rmi/transport/closeServerSocket/
    /CloseServerSocket.java fails intermittently with Address
    already in use
    + JDK-8151678: com/sun/jndi/ldap/LdapTimeoutTest.java failed
    due to timeout on DeadServerNoTimeoutTest is incorrect
    + JDK-8160768: Add capability to custom resolve host/domain
    names within the default JNDI LDAP provider
    + JDK-8172404: Tools should warn if weak algorithms are used
    before restricting them
    + JDK-8193367: Annotated type variable bounds crash javac
    + JDK-8202117: com/sun/jndi/ldap/RemoveNamingListenerTest.java
    fails intermittently: Connection reset
    + JDK-8203026: java.rmi.NoSuchObjectException: no such object
    in table
    + JDK-8203281: [Windows] JComboBox change in ui when
    editor.setBorder() is called
    + JDK-8203382: Rename SystemDictionary::initialize_wk_klass to
    resolve_wk_klass
    + JDK-8203393: com/sun/jdi/JdbMethodExitTest.sh and
    JdbExprTest.sh fail due to timeout
    + JDK-8203928: [Test] Convert non-JDB scaffolding
    serviceability shell script tests to java
    + JDK-8204963: javax.swing.border.TitledBorder has a memory leak
    + JDK-8204994: SA might fail to attach to process with "Windbg
    Error: WaitForEvent failed"
    + JDK-8205534: Remove SymbolTable dependency from
    serviceability agent
    + JDK-8206309: Tier1 SA tests fail
    + JDK-8208281: java/nio/channels/
    /AsynchronousSocketChannel/Basic.java timed out
    + JDK-8209109: [TEST] rewrite com/sun/jdi shell tests to java
    version - step1
    + JDK-8209332: [TEST] test/jdk/com/sun/jdi/CatchPatternTest.sh
    is incorrect
    + JDK-8209342: Problemlist SA tests on Solaris due to Error
    attaching to process: Can't create thread_db agent!
    + JDK-8209343: Test javax/swing/border/TestTitledBorderLeak.java
    should be marked as headful
    + JDK-8209517: com/sun/jdi/BreakpointWithFullGC.java fails with
    timeout
    + JDK-8209604: [TEST] rewrite com/sun/jdi shell tests to java
    version - step2
    + JDK-8209605: com/sun/jdi/BreakpointWithFullGC.java fails with
    ZGC
    + JDK-8209608: Problem list com/sun/jdi/BreakpointWithFullGC.java
    + JDK-8210131: vmTestbase/nsk/jvmti/scenarios/allocation/AP10/
    /ap10t001/TestDescription.java failed with ObjectFree:
    GetCurrentThreadCpuTimerInfo returned unexpected error code
    + JDK-8210243: [TEST] rewrite com/sun/jdi shell tests to java
    version - step3
    + JDK-8210527: JShell: NullPointerException in
    jdk.jshell.Eval.translateExceptionStack
    + JDK-8210560: [TEST] convert com/sun/jdi redefineClass-related
    tests
    + JDK-8210725: com/sun/jdi/RedefineClearBreakpoint.java fails
    with waitForPrompt timed out after 60 seconds
    + JDK-8210748: [TESTBUG] lib.jdb.Jdb.waitForPrompt() should
    clarify which output is the pending reply after a timeout
    + JDK-8210760: [TEST] rewrite com/sun/jdi shell tests to java
    version - step4
    + JDK-8210977: jdk/jfr/event/oldobject/TestThreadLocalLeak.java
    fails to find ThreadLocalObject
    + JDK-8211292: [TEST] convert com/sun/jdi/DeferredStepTest.sh
    test
    + JDK-8211694: JShell: Redeclared variable should be reset
    + JDK-8212200: assert when shared java.lang.Object is redefined
    by JVMTI agent
    + JDK-8212629: [TEST] wrong breakpoint in
    test/jdk/com/sun/jdi/DeferredStepTest
    + JDK-8212665: com/sun/jdi/DeferredStepTest.java: jj1 (line 57)
  - unexpected. lastLine=52, minLine=52, maxLine=55
    + JDK-8212807: tools/jar/multiRelease/Basic.java times out
    + JDK-8213182: Minimal VM build failure after JDK-8212200
    (assert when shared java.lang.Object is redefined by JVMTI
    agent)
    + JDK-8213214: Set -Djava.io.tmpdir= when running tests
    + JDK-8213275: ReplaceCriticalClasses.java fails with
    jdk.internal.vm.PostVMInitHook not found
    + JDK-8213574: Deadlock in string table expansion when dumping
    lots of CDS classes
    + JDK-8213703: LambdaConversionException: Invalid receiver type
    not a subtype of implementation type interface
    + JDK-8214074: Ghash optimization using AVX instructions
    + JDK-8214491: Upgrade to JLine 3.9.0
    + JDK-8214797: TestJmapCoreMetaspace.java timed out
    + JDK-8215243: JShell tests failing intermitently with
    "Problem cleaning up the following threads:"
    + JDK-8215244: jdk/jshell/ToolBasicTest.java
    testHistoryReference failed
    + JDK-8215354: x86_32 build failures after JDK-8214074 (Ghash
    optimization using AVX instructions)
    + JDK-8215438: jshell tool: Ctrl-D causes EOF
    + JDK-8216021: RunTest.gmk might set concurrency level to 1 on
    Windows
    + JDK-8216974: HttpConnection not returned to the pool after
    204 response
    + JDK-8218948: SimpleDateFormat :: format - Zone Names are not
    reflected correctly during run time
    + JDK-8219712: code_size2 (defined in stub_routines_x86.hpp) is
    too small on new Skylake CPUs
    + JDK-8220150: macos10.14 Mojave returns anti-aliased glyphs
    instead of aliased B&amp;W glyphs
    + JDK-8221658: aarch64: add necessary predicate for ubfx
    patterns
    + JDK-8221759: Crash when completing "java.io.File.path"
    + JDK-8221918: runtime/SharedArchiveFile/serviceability/
    /ReplaceCriticalClasses.java fails: Shared archive not found
    + JDK-8222074: Enhance auto vectorization for x86
    + JDK-8222079: Don't use memset to initialize fields decode_env
    constructor in disassembler.cpp
    + JDK-8222769: [TESTBUG] TestJFRNetworkEvents should not rely
    on hostname command
    + JDK-8223688: JShell: crash on the instantiation of raw
    anonymous class
    + JDK-8223777: In posix_spawn mode, failing to exec()
    jspawnhelper does not result in an error
    + JDK-8223940: Private key not supported by chosen signature
    algorithm
    + JDK-8224184: jshell got IOException at exiting with AIX
    + JDK-8224234: compiler/codegen/TestCharVect2.java fails in
    test_mulc
    + JDK-8225037: java.net.JarURLConnection::getJarEntry() throws
    NullPointerException
    + JDK-8225625: AES Electronic Codebook (ECB) encryption and
    decryption optimization using AVX512 + VAES instructions
    + JDK-8226536: Catch OOM from deopt that fails rematerializing
    objects
    + JDK-8226575: OperatingSystemMXBean should be made container
    aware
    + JDK-8226697: Several tests which need the @key headful
    keyword are missing it.
    + JDK-8226809: Circular reference in printed stack trace is not
    correctly indented &amp; ambiguous
    + JDK-8227059: sun/security/tools/keytool/
    /DefaultSignatureAlgorithm.java timed out
    + JDK-8227269: Slow class loading when running with JDWP
    + JDK-8227595: keytool/fakegen/DefaultSignatureAlgorithm.java
    fails due to "exitValue = 6"
    + JDK-8228448: Jconsole can't connect to itself
    + JDK-8228967: Trust/Key store and SSL context utilities for
    tests
    + JDK-8229378: jdwp library loader in linker_md.c quietly
    truncates on buffer overflow
    + JDK-8229815: Upgrade Jline to 3.12.1
    + JDK-8230000: some httpclients testng tests run zero test
    + JDK-8230002: javax/xml/jaxp/unittest/transform/
    /SecureProcessingTest.java runs zero test
    + JDK-8230010: Remove jdk8037819/BasicTest1.java
    + JDK-8230094: CCE in createXMLEventWriter(Result) over an
    arbitrary XMLStreamWriter
    + JDK-8230402: Allocation of compile task fails with assert:
    "Leaking compilation tasks?"
    + JDK-8230767: FlightRecorderListener returns null recording
    + JDK-8230870: (zipfs) Add a ZIP FS test that is similar to
    test/jdk/java/util/zip/EntryCount64k.java
    + JDK-8231209: [REDO] ThreadMXBean::getThreadAllocatedBytes()
    can be quicker for self thread
    + JDK-8231586: enlarge encoding space for OopMapValue offsets
    + JDK-8231953: Wrong assumption in assertion in
    oop::register_oop
    + JDK-8231968: getCurrentThreadAllocatedBytes default
    implementation s/b getThreadAllocatedBytes
    + JDK-8232083: Minimal VM is broken after JDK-8231586
    + JDK-8232161: Align some one-way conversion in MS950 charset
    with Windows
    + JDK-8232855: jshell missing word in /help help
    + JDK-8233027: OopMapSet::all_do does oms.next() twice during
    iteration
    + JDK-8233228: Disable weak named curves by default in TLS,
    CertPath, and Signed JAR
    + JDK-8233386: Initialize NULL fields for unused decorations
    + JDK-8233452: java.math.BigDecimal.sqrt() with
    RoundingMode.FLOOR results in incorrect result
    + JDK-8233686: XML transformer uses excessive amount of memory
    + JDK-8233741: AES Countermode (AES-CTR) optimization using
    AVX512 + VAES instructions
    + JDK-8233829: javac cannot find non-ASCII module name under
    non-UTF8 environment
    + JDK-8233958: Memory retention due to HttpsURLConnection
    finalizer that serves no purpose
    + JDK-8234011: (zipfs) Memory leak in
    ZipFileSystem.releaseDeflater()
    + JDK-8234058: runtime/CompressedOops/
    /CompressedClassPointers.java fails with 'Narrow klass base:
    0x0000000000000000' missing from stdout/stderr
    + JDK-8234149: Several regression tests do not dispose Frame at
    end
    + JDK-8234347: "Turkey" meta time zone does not generate
    composed localized names
    + JDK-8234385: [TESTBUG] java/awt/EventQueue/6980209/
    /bug6980209.java fails in linux nightly
    + JDK-8234535: Cross compilation fails due to missing CFLAGS
    for the BUILD_CC
    + JDK-8234541: C1 emits an empty message when it inlines
    successfully
    + JDK-8234687: change javap reporting on unknown attributes
    + JDK-8236464: SO_LINGER option is ignored by SSLSocket in JDK
    11
    + JDK-8236548: Localized time zone name inconsistency between
    English and other locales
    + JDK-8236617: jtreg test containers/docker/
    /TestMemoryAwareness.java fails after 8226575
    + JDK-8237182: Update copyright header for shenandoah and
    epsilon files
    + JDK-8237888: security/infra/java/security/cert/
    /CertPathValidator/certification/LuxTrustCA.java fails when
    checking validity interval
    + JDK-8237977: Further update
    javax/net/ssl/compatibility/Compatibility.java
    + JDK-8238270: java.net HTTP/2 client does not decrease stream
    count when receives 204 response
    + JDK-8238284: [macos] Zero VM build fails due to an obvious
    typo
    + JDK-8238380: java.base/unix/native/libjava/childproc.c
    "multiple definition" link errors with GCC10
    + JDK-8238386: (sctp) jdk.sctp/unix/native/libsctp/SctpNet.c
    "multiple definition" link errors with GCC10
    + JDK-8238388: libj2gss/NativeFunc.o "multiple definition" link
    errors with GCC10
    + JDK-8238448: RSASSA-PSS signature verification fail when
    using certain odd key sizes
    + JDK-8238710: LingeredApp doesn't log stdout/stderr if exits
    with non-zero code
    + JDK-8239083: C1 assert(known_holder == NULL ||
    (known_holder-&gt;is_instance_klass() &amp;&amp;
    (!known_holder-&gt;is_interface() ||
    ((ciInstanceKlass*)known_holder)-&gt;has_nonstatic_concrete_methods())),
    "should be non-static concrete method");
    + JDK-8239385: KerberosTicket client name refers wrongly to
    sAMAccountName in AD
    + JDK-8240169: javadoc fails to link to non-modular api docs
    + JDK-8240295: hs_err elapsed time in seconds is not accurate
    enough
    + JDK-8240360: NativeLibraryEvent has wrong library name on
    Linux
    + JDK-8240676: Meet not symmetric failure when running lucene
    on jdk8
    + JDK-8241007: Shenandoah: remove
    ShenandoahCriticalControlThreadPriority support
    + JDK-8241065: Shenandoah: remove leftover code after
    JDK-8231086
    + JDK-8241086: Test runtime/NMT/HugeArenaTracking.java is
    failing on 32bit Windows
    + JDK-8241130: com.sun.jndi.ldap.EventSupport.removeDeadNotifier:
    java.lang.NullPointerException
    + JDK-8241138: http.nonProxyHosts=* causes
    StringIndexOutOfBoundsException in DefaultProxySelector
    + JDK-8241319: WB_GetCodeBlob doesn't have ResourceMark
    + JDK-8241478: vmTestbase/gc/gctests/Steal/steal001/steal001.java
    fails with OOME
    + JDK-8241574: Shenandoah: remove ShenandoahAssertToSpaceClosure
    + JDK-8241750: x86_32 build failure after JDK-8227269
    + JDK-8242184: CRL generation error with RSASSA-PSS
    + JDK-8242283: Can't start JVM when java home path includes
    non-ASCII character
    + JDK-8242556: Cannot load RSASSA-PSS public key with non-null
    params from byte array
    + JDK-8243029: Rewrite javax/net/ssl/compatibility/
    /Compatibility.java with a flexible interop test framework
    + JDK-8243138: Enhance BaseLdapServer to support starttls
    extended request
    + JDK-8243320: Add SSL root certificates to Oracle Root CA
    program
    + JDK-8243321: Add Entrust root CA - G4 to Oracle Root CA
    program
    + JDK-8243389: enhance os::pd_print_cpu_info on linux
    + JDK-8243453: java --describe-module failed with non-ASCII
    module name under non-UTF8 environment
    + JDK-8243470: [macos] bring back O2 opt level for unsafe.cpp
    + JDK-8243489: Thread CPU Load event may contain wrong data for
    CPU time under certain conditions
    + JDK-8243925: Toolkit#getScreenInsets() returns wrong value on
    HiDPI screens (Windows)
    + JDK-8244087: 2020-04-24 public suffix list update
    + JDK-8244151: Update MUSCLE PC/SC-Lite headers to the latest
    release 1.8.26
    + JDK-8244164: AArch64: jaotc generates incorrect code for
    compressed OOPs with non-zero heap base
    + JDK-8244196: adjust output in os_linux
    + JDK-8244225: stringop-overflow warning on strncpy call from
    compile_the_world_in
    + JDK-8244287: JFR: Methods samples have line number 0
    + JDK-8244703: "platform encoding not initialized" exceptions
    with debugger, JNI
    + JDK-8244719: CTW: C2 compilation fails with
    "assert(!VerifyHashTableKeys || _hash_lock == 0) failed:
    remove node from hash table before modifying it"
    + JDK-8244729: Shenandoah: remove resolve paths from
    SBSA::generate_shenandoah_lrb
    + JDK-8244763: Update --release 8 symbol information after JSR
    337 MR3
    + JDK-8244818: Java2D Queue Flusher crash while moving
    application window to external monitor
    + JDK-8245151: jarsigner should not raise duplicate warnings on
    verification
    + JDK-8245616: Bump update version for OpenJDK: jdk-11.0.9
    + JDK-8245714: "Bad graph detected in build_loop_late" when
    loads are pinned on loop limit check uncommon branch
    + JDK-8245801: StressRecompilation triggers assert "redundunt
    OSR recompilation detected. memory leak in CodeCache!"
    + JDK-8245832: JDK build make-static-libs should build all JDK
    libraries
    + JDK-8245880: Shenandoah: check class unloading flag early in
    concurrent code root scan
    + JDK-8245981: Upgrade to jQuery 3.5.1
    + JDK-8246027: Minimal fastdebug build broken after JDK-8245801
    + JDK-8246094: [macos] Sound Recording and playback is not
    working
    + JDK-8246153: TestEliminateArrayCopy fails with
  - XX:+StressReflectiveCode
    + JDK-8246193: Possible NPE in ENC-PA-REP search in AS-REQ
    + JDK-8246196: javax/management/MBeanServer/OldMBeanServerTest
    fails with AssertionError
    + JDK-8246203: Segmentation fault in verification due to stack
    overflow with -XX:+VerifyIterativeGVN
    + JDK-8246330: Add TLS Tests for Legacy ECDSA curves
    + JDK-8246453: TestClone crashes with "all collected exceptions
    must come from the same place"
    + JDK-8247246: Add explicit ResolvedJavaType.link and expose
    presence of default methods
    + JDK-8247350: [aarch64] assert(false) failed: wrong size of
    mach node
    + JDK-8247502: PhaseStringOpts crashes while optimising
    effectively dead code
    + JDK-8247615: Initialize the bytes left for the heap sampler
    + JDK-8247824: CTW: C2 (Shenandoah) compilation fails with SEGV
    in SBC2Support::pin_and_expand
    + JDK-8247874: Replacement in VersionProps.java.template not
    working when --with-vendor-bug-url contains '&amp;'
    + JDK-8247979: aarch64: missing side effect of killing flags
    for clearArray_reg_reg
    + JDK-8248214: Add paddings for TaskQueueSuper to reduce
    false-sharing cache contention
    + JDK-8248219: aarch64: missing memory barrier in
    fast_storefield and fast_accessfield
    + JDK-8248348: Regression caused by the update to BCEL 6.0
    + JDK-8248385: [testbug][11u] Adapt TestInitiExceptions to
    jtreg 5.1
    + JDK-8248495: [macos] zerovm is broken due to libffi headers
    location
    + JDK-8248851: CMS: Missing memory fences between free chunk
    check and klass read
    + JDK-8248987: AOT's Linker.java seems to eagerly fail-fast on
    Windows
    + JDK-8249159: Downport test rework for SSLSocketTemplate from
    8224650
    + JDK-8249215: JFrame::setVisible crashed with
  - Dfile.encoding=UTF-8 on Japanese Windows.
    + JDK-8249251: [dark_mode ubuntu 20.04] The selected menu is
    not highlighted in GTKLookAndFeel
    + JDK-8249255: Build fails if source code in cygwin home dir
    + JDK-8249277: TestVerifyIterativeGVN.java is failing with
    timeout in OpenJDK 11
    + JDK-8249278: Revert JDK-8226253 which breaks the spec of
    AccessibleState.SHOWING for JList
    + JDK-8249560: Shenandoah: Fix racy GC request handling
    + JDK-8249801: Shenandoah: Clear soft-refs on requested GC cycle
    + JDK-8249953: Shenandoah: gc/shenandoah/mxbeans tests should
    account for corner cases
    + JDK-8250582: Revert Principal Name type to NT-UNKNOWN when
    requesting TGS Kerberos tickets
    + JDK-8250609: C2 crash in IfNode::fold_compares
    + JDK-8250627: Use -XX:+/-UseContainerSupport for
    enabling/disabling Java container metrics
    + JDK-8250755: Better cleanup for
    jdk/test/javax/imageio/plugins/shared/CanWriteSequence.java
    + JDK-8250787: Provider.put no longer registering aliases in
    FIPS env
    + JDK-8250826: jhsdb does not work with coredump which comes
    from Substrate VM
    + JDK-8250827: Shenandoah: needs to reset/finish StringTable's
    dead count before/after parallel walk
    + JDK-8250844: Make sure {type,obj}ArrayOopDesc accessors check
    the bounds
    + JDK-8251117: Cannot check P11Key size in P11Cipher and
    P11AEADCipher
    + JDK-8251354: Shenandoah: Fix jdk/jfr/tool/TestPrintJSON.java
    test failure
    + JDK-8251451: Shenandoah: Remark ObjectSynchronizer roots with
    I-U
    + JDK-8251469: Better cleanup for
    test/jdk/javax/imageio/SetOutput.java
    + JDK-8251487: Shenandoah: missing detail timing tracking for
    final mark cleaning phase
    + JDK-8252120: compiler/oracle/TestCompileCommand.java
    misspells "occured"
    + JDK-8252157: JDK-8231209 11u backport breaks jmm binary
    compatibility
    + JDK-8252258: [11u] JDK-8242154 changes the default vendor
    + JDK-8252804: [test] Fix 'ReleaseDeflater.java' test after
    downport of 8234011
    + JDK-8253134: JMM_VERSION should remain at 0x20020000 (JDK 10)
    in JDK 11
    + JDK-8253283: [11u] Test build/translations/
    /VerifyTranslations.java failing after JDK-8252258
    + JDK-8253813: Backout JDK-8244287 from 11u: it causes several
    crashes
- Removed patch:
  * gcc-fno-common-fix.patch
    + not needed any more with this version
- Added patch:
  * JDK-8250861.patch
    + Fix regression "8250861: Crash in MinINode::Ideal(PhaseGVN*,
    bool)" introduced in jdk 11.0.9</changelog>
  <changelog author="fstrba@suse.com" date="1604491200">- Enable Sheandoah GC for x86_64 (jsc#ECO-3171)</changelog>
  <changelog author="fstrba@suse.com" date="1605528000">- Update to upstream tag jdk-11.0.9.1-1
  * Fix:
    + JDK-8250861: Crash in MinINode::Ideal(PhaseGVN*, bool)
- Removed patch:
  * JDK-8250861.patch
    + Integrated upstream</changelog>
  <changelog author="fstrba@suse.com" date="1611230400">- Update to upstream tag jdk-11.0.10+9 (January 2021 CPU,
  bsc#1181239)
  * Security fixes
    + JDK-8247619: Improve Direct Buffering of Characters
  * Other changes
    + JDK-6722928: Support SSPI as a native GSS-API provider
    + JDK-7185258: [macosx] Deadlock in SunToolKit.realSync()
    + JDK-8152332: [macosx] JFileChooser cannot be serialized on
    Mac OS X
    + JDK-8161684: [testconf] Add VerifyOops' testing into compiler
    tiers
    + JDK-8171279: Support X25519 and X448 in TLS
    + JDK-8173361: various crashes in
    JvmtiExport::post_compiled_method_load
    + JDK-8173658: JvmtiExport::post_class_unload() is broken for
    non-JavaThread initiators
    + JDK-8191006: hsdis disassembler plugin does not compile with
    binutils 2.29+
    + JDK-8197981: Missing return statement in
    __sync_val_compare_and_swap_8
    + JDK-8198334: java/awt/FileDialog/8003399/bug8003399.java
    fails in headless mode
    + JDK-8200151: Add 8 JNDI tests to com/sun/jndi/dns/ConfigTests/
    + JDK-8208279: Add 8 JNDI tests to com/sun/jndi/dns/EnvTests/
    + JDK-8208483: Add 5 JNDI tests to
    com/sun/jndi/dns/FactoryTests/
    + JDK-8208542: Add 4 JNDI tests to com/sun/jndi/dns/ListTests/
    + JDK-8208665: Amend cross-compilation docs with
    qemu-debootstrap recipe
    + JDK-8210088: ProblemList gc/epsilon/TestMemoryMXBeans.java
    + JDK-8210339: Add 10 JNDI tests to com/sun/jndi/dns/FedTests/
    + JDK-8211450: UndetVar::dup is not copying the kind field to
    the duplicated instance
    + JDK-8212160: JVMTI agent crashes with "assert(_value != 0LL)
    failed: resolving NULL _value"
    + JDK-8212226: SurfaceManager throws "Invalid Image variant"
    for MultiResolutionImage (Windows)
    + JDK-8213400: Support choosing group name in keytool keypair
    generation
    + JDK-8213535: Windows HiDPI html lightweight tooltips are
    truncated
    + JDK-8213698: Improve devkit creation and add support for
    linux/ppc64/ppc64le/s390x
    + JDK-8214025: assert(t-&gt;singleton()) failed: must be a
    constant when ScavengeRootsInCode &lt; 2
    + JDK-8214242: compiler/arguments/TestScavengeRootsInCode.java
    fails because of missing UnlockDiagnosticVMOptions
    + JDK-8214787: Zero builds fail with "undefined
    JavaThread::thread_state()"
    + JDK-8215583: Exclude
    runtime/handshake/HandshakeWalkSuspendExitTest.java
    + JDK-8216012: Infinite loop in RSA KeyPairGenerator
    + JDK-8216324: GetClassMethods is confused by the presence of
    default methods in super interfaces
    + JDK-8217429: WebSocket over authenticating proxy fails to
    send Upgrade headers
    + JDK-8217976: test/jdk/java/net/httpclient/websocket/
    /WebSocketProxyTest.java fails intermittently
    + JDK-8218021: Have jarsigner preserve posix permission
    attributes
    + JDK-8218287: jshell tool: input behavior unstable after
    12-ea+24 on Windows
    + JDK-8218851: JVM crash in custom classloader stress test, JDK
    12 &amp; 13
    + JDK-8220420: Cleanup c1_LinearScan
    + JDK-8222072: JVMTI GenerateEvents() sends CompiledMethodLoad
    events to wrong jvmtiEnv
    + JDK-8222286: Fix for JDK-8213419 is broken on s390
    + JDK-8222527: HttpClient doesn't send HOST header when
    tunelling HTTP/1.1 through http proxy
    + JDK-8222533: jtreg test jdk/internal/platform/cgroup/
    /TestCgroupMetrics.java fails on SLES12.3 linux ppc64le
    machine
    + JDK-8224506: [TESTBUG] TestDockerMemoryMetrics.java fails
    with exitValue = 137
    + JDK-8224555: vmTestbase/nsk/jvmti/scenarios/contention/TC02/
    /tc02t001/TestDescription.java failed
    + JDK-8224650: Add tests to support X25519 and X448 in TLS
    + JDK-8225072: Add LuxTrust certificate that is expiring in
    March 2021 to list of allowed but expired certs
    + JDK-8225329: -XX:+PrintBiasedLockingStatistics causes crash
    during initialization on Windows platforms
    + JDK-8225687: Newly added sspi.cpp in JDK-6722928 still
    contains some small errors
    + JDK-8227006: [linux] Runtime.availableProcessors execution
    time increased by factor of 100
    + JDK-8227275: Within native OOM error handling, assertions may
    hang the process
    + JDK-8227647: [Graal] Test8009761.java fails due to
    "RuntimeException: static java.lang.Object
    compiler.uncommontrap.Test8009761.m3(boolean,boolean) not
    compiled"
    + JDK-8229495: SIGILL in C2 generated OSR compilation
    + JDK-8230910: libsspi_bridge does not build on Windows 32bit
    + JDK-8232114: JVM crashed at imjpapi.dll in native code
    + JDK-8234147: Avoid looking up standard charsets in core
    libraries
    + JDK-8234393: [macos] printing ignores printer tray
    + JDK-8234863: Increase default value of MaxInlineLevel
    + JDK-8235218: Minimal VM is broken after JDK-8173361
    + JDK-8235456: Minimal VM is broken after JDK-8212160
    + JDK-8235829: graal crashes with Zombie.java test
    + JDK-8236124: Minimal VM slowdebug build failed after
    JDK-8212160
    + JDK-8236512: PKCS11 Connection closed after Cipher.doFinal
    and NoPadding
    + JDK-8236944: The legVecZ operand should be limited to
    zmm0-zmm15 registers
    + JDK-8237186: Fix typo in copyright header of
    java/io/Reader/TransferTo.java
    + JDK-8237499: JFR: Include stack trace in the ThreadStart event
    + JDK-8237512: AArch64: aarch64TestHook leaks a BufferBlob
    + JDK-8237524: AArch64: String.compareTo() may return incorrect
    result
    + JDK-8237950: C2 compilation fails with "Live Node limit
    exceeded limit" during ConvI2L::Ideal optimization
    + JDK-8238579: HttpsURLConnection drops the timeout and hangs
    forever in read
    + JDK-8239105: Add exception for expiring Digicert root
    certificates to VerifyCACerts test
    + JDK-8239477: jdk/jfr/jcmd/TestJcmdStartStopDefault.java fails
  - XX:+VerifyOops with "verify_oop: rsi: broken oop"
    + JDK-8239497: SEGV in EdgeUtils::field_name_symbol(Edge const&amp;)
    + JDK-8239886: Minimal VM build fails after JDK-8237499
    + JDK-8240633: Memory leaks in the implementations of
    FileChooserUI
    + JDK-8240690: Race condition between EDT and
    BasicDirectoryModel.FilesLoader.run0()
    + JDK-8241234: Unify monitor enter/exit runtime entries.
    + JDK-8241311: Move some charset mapping tests from closed to
    open
    + JDK-8241797: Add some tests to the problem list
    + JDK-8242029: AArch64: skip G1 array copy pre-barrier if
    marking not active
    + JDK-8242335: Additional Tests for RSASSA-PSS
    + JDK-8242480: Negative value may be returned by
    getFreeSwapSpaceSize() in the docker
    + JDK-8242614: cleanup duplicated test ldap server in some
    com/sun/jndi/ldap/ tests
    + JDK-8242846: Bring back test/jdk/tools/jlink/plugins/
    /OrderResourcesPluginTest.java
    + JDK-8243114: Implement montgomery{Multiply,Square}intrinsics
    on Windows
    + JDK-8243290: Improve diagnostic messages for class
    verification and redefinition failures
    + JDK-8243488: Add tests for set/get SendBufferSize and
    getReceiveBufferSize in DatagramSocket
    + JDK-8243549: sun/security/ssl/CipherSuite/
    /NamedGroupsWithCipherSuite.java failed with Unsupported
    signature algorithm: DSA
    + JDK-8243617: compiler/onSpinWait/TestOnSpinWaitC1.java test
    uses wrong class
    + JDK-8243619: compiler/codecache/CheckSegmentedCodeCache.java
    test misses -version
    + JDK-8244142: some hotspot/runtime tests don't check exit code
    of forked JVM
    + JDK-8244278: Excessive code cache flushes and sweeps
    + JDK-8244282: test/hotspot/jtreg/compiler/intrinsics/
    /Test8237524.java fails with --illegal-access=deny
    + JDK-8244621: [macos10.15] Garbled FX printing plus CoreText
    warnings on Catalina when building with Xcode 11
    + JDK-8244819: hsdis does not compile with binutils 2.34+
    + JDK-8245051: c1 is broken if it is compiled by gcc without
  - fno-lifetime-dse
    + JDK-8245168: jlink should not be treated as a "small" tool
    + JDK-8245400: Upgrade to LittleCMS 2.11
    + JDK-8246381: VM crashes with "Current BasicObjectLock* below
    than low_mark"
    + JDK-8246434: Threads::print_on_error assumes that the heap
    has been set up
    + JDK-8246648: issue with OperatingSystemImpl
    getFreeSwapSpaceSize in docker after 8242480
    + JDK-8247201: Print potential pointer value of readable stack
    memory in hs_err file
    + JDK-8247763: assert(outer-&gt;outcnt() == 2) failed: 'only phis'
    failure in LoopNode::verify_strip_mined()
    + JDK-8247867: Upgrade to freetype 2.10.2
    + JDK-8248190: Enable Power10 system and implement new
    byte-reverse instructions
    + JDK-8248226: TestCloneAccessStressGCM fails with
  - XX:-ReduceBulkZeroing
    + JDK-8248347: windows build broken by JDK-8243114
    + JDK-8248532: Every time I change keyboard language at my
    MacBook, Java crashes
    + JDK-8248552: C2 crashes with SIGFPE due to division by zero
    + JDK-8248596: [TESTBUG] compiler/loopopts/
    /PartialPeelingUnswitch.java times out with Graal enabled
    + JDK-8248745: Add jarsigner and keytool tests for restricted
    algorithms
    + JDK-8248791: sun/util/resources/cldr/TimeZoneNamesTest.java
    fails with -XX:-ReduceInitialCardMarks -XX:-ReduceBulkZeroing
    + JDK-8248845: AArch64: stack corruption after spilling vector
    register
    + JDK-8249176: Update GlobalSignR6CA test certificates
    + JDK-8249183: JVM crash in "AwtFrame::WmSize" method
    + JDK-8249192: MonitorInfo stores raw oops across safepoints
    + JDK-8249602: C2: assert(cnt == _outcnt) failed: no insertions
    allowed
    + JDK-8249603: C1: assert(has_error == false) failed: register
    allocation invalid
    + JDK-8249605: C2: assert(no_dead_loop) failed: dead loop
    detected
    + JDK-8249607: C2: assert(!had_error) failed: bad dominance
    + JDK-8249608: Vector register used by C2 compiled method
    corrupted at safepoint
    + JDK-8249672: Include microcode revision in features_string on
    x86
    + JDK-8249748: gtest silently ignores bad jvm arguments
    + JDK-8249821: Separate libharfbuzz from libfontmanager
    + JDK-8250598: Hyper-V is detected in spite of running on host
    OS
    + JDK-8250605: Linux x86_32 builds fail after JDK-8249821
    + JDK-8250636: iso8601_time returns incorrect offset part on
    MacOS
    + JDK-8250665: Wrong translation for the month name of May in
    ar_JO,LB,SY
    + JDK-8250772: Test com/sun/jndi/ldap/
    /NamingExceptionMessageTest.java fails intermittently with
    javax.naming.ServiceUnavailableException
    + JDK-8250825: C2 crashes with assert(field != __null) failed:
    missing field
    + JDK-8250894: Provide a configure option to build and run
    against the platform libharfbuzz
    + JDK-8250928: JFR: Improve hash algorithm for stack traces
    + JDK-8250968: Symlinks attributes not preserved when using
    jarsigner on zip files
    + JDK-8250984: Memory Docker tests fail on some Linux kernels
    w/o cgroupv1 swap limit capabilities
    + JDK-8251118: BiasedLocking::preserve_marks should not have a
    HandleMark
    + JDK-8251189: com/sun/jndi/ldap/LdapDnsProviderTest.java
    failed due to timeout
    + JDK-8251257: NMT: jcmd VM.native_memory scale=1 crashes
    target VM
    + JDK-8251365: Build failure on AIX after 8250636
    + JDK-8251397: NPE on ClassValue.ClassValueMap.cacheArray
    + JDK-8251456: [TESTBUG] compiler/vectorization/
    /TestVectorsNotSavedAtSafepoint.java failed OutOfMemoryError
    + JDK-8251458: Parse::do_lookupswitch fails with "assert(_cnt
    &gt;= 0) failed"
    + JDK-8251535: Partial peeling at unsigned test adds incorrect
    loop exit check
    + JDK-8251949: ZGC: Set explicit heap size for
    compiler/gcbarriers tests
    + JDK-8252090: JFR: StreamWriterHost::write_unbuffered() stucks
    in an infinite loop OpenJDK (build 13.0.1+9)
    + JDK-8252415: Bump update version for OpenJDK: jdk-11.0.10
    + JDK-8252470: java/awt/dnd/DisposeFrameOnDragCrash/
    /DisposeFrameOnDragTest.java fails on Windows
    + JDK-8252497: Incorrect numeric currency code for ROL
    + JDK-8252660: Shenandoah: support manageable SoftMaxHeapSize
    option
    + JDK-8252679: Two windows specific FileDIalog tests may fail
    on some Windows_Server_2016_Standard
    + JDK-8252696: Loop unswitching may cause out of bound array
    load to be executed
    + JDK-8252754: Hash code calculation of JfrStackTrace is
    inconsistent
    + JDK-8253219: Epsilon: clean up unnecessary includes
    + JDK-8253224: Shenandoah: ShenandoahStrDedupQueue destructor
    calls virtual num_queues()
    + JDK-8253226: Shenandoah: remove unimplemented
    ShenandoahStrDedupQueue::verify
    + JDK-8253269: The CheckCommonColors test should provide more
    info on failure
    + JDK-8253284: Zero OrderAccess barrier mappings are incorrect
    + JDK-8253375: OSX build fails with Xcode 12.0 (12A7209)
    + JDK-8253778: ShenandoahSafepoint::is_at_shenandoah_safepoint
    should not access VMThread state from other threads
    + JDK-8253791: Issue with useAppleColor check in CSystemColors.m
    + JDK-8254016: Test8237524 fails with -XX:-CompactStrings option
    + JDK-8254081: java/security/cert/PolicyNode/
    /GetPolicyQualifiers.java fails due to an expired certificate
    + JDK-8254144: Non-x86 Zero builds fail with return-type
    warning in os_linux_zero.cpp
    + JDK-8254166: Zero: return-type warning in
    zeroInterpreter_zero.cpp
    + JDK-8254177: (tz) Upgrade time-zone data to tzdata2020b
    + JDK-8254185: Fix Code cache sweeper heuristics for JDK 11
    + JDK-8254190: [s390] interpreter misses exception check after
    calling monitorenter
    + JDK-8254790: SIGSEGV in string_indexof_char and
    stringL_indexof_char intrinsics
    + JDK-8254854: [cgroups v1] Metric limits not properly detected
    on some join controller combinations
    + JDK-8254982: (tz) Upgrade time-zone data to tzdata2020c
    + JDK-8255050: Add pkcs11/KeyStore/ClientAuth.sh to Problem list
    + JDK-8255065: Zero: accessor_entry misses the IRIW case
    + JDK-8255226: (tz) Upgrade time-zone data to tzdata2020d
    + JDK-8255269: Unsigned overflow in g1Policy.cpp
    + JDK-8255365: Problem list failing client manual tests
    + JDK-8255457: Shenandoah: cleanup ShenandoahMarkTask
    + JDK-8255466: C2 crashes at ciObject::get_oop() const+0x0
    + JDK-8255550: x86: Assembler::cmpq(Address dst, Register src)
    encoding is incorrect
    + JDK-8255603: Memory/Performance regression after JDK-8210985
    + JDK-8255760: Shenandoah: match constants style in
    ShenandoahMarkTask fallback
    + JDK-8255781: Bump patch update version for OpenJDK:
    jdk-11.0.9.1
    + JDK-8255937: Better cleanup for
    test/jdk/javax/imageio/stream/StreamFlush.java
    + JDK-8256427: Test com/sun/jndi/dns/ConfigTests/
    /PortUnreachable.java does not work on AIX
    + JDK-8256452: Integrate missing part of JDK-8232370 to 11u
    + JDK-8256483: [TESTBUG] serviceability/jvmti/GetClassMethods/
    /libOverpassMethods.c fails to compile on gcc 4.4.x
    + JDK-8256557: libharfbuzz fails to link on gcc 4.4.x due to
  - Wl,-z,defs
    + JDK-8256618: Zero: Linux x86_32 build still fails
    + JDK-8256736: Zero: GTest tests fail with "unsuppported vm
    variant"
    + JDK-8256809: Annotation processing causes NPE during flow
    analysis
    + JDK-8257181: s390x builds are very noisy with gc-sections
    messages
    + JDK-8257242: [macOS] Java app crashes while switching input
    methods
    + JDK-8257545: SunJSSE FIPS regression in key exchange after
    JDK-8171279 11u backport
    + JDK-8257641: Shenandoah: Query is_at_shenandoah_safepoint()
    from control thread should return false
    + JDK-8257701: Shenandoah: objArrayKlass metadata is not marked
    with chunked arrays
    + JDK-8258630: Add expiry exception for QuoVadis root
    certificate
- New upstream dependency on libharfbuzz
- Regenerated patches: missing-return.patch system-pcsclite.patch</changelog>
  <changelog author="fstrba@suse.com" date="1616155200">- Added patches:
  * system-crypto-policy.patch
    + Let OpenJDK use system crypto policies unless explicitely told
    not to
  * nss-security-provider.patch
    + Add the NSS security provider with configuration in generated
    nss.cfg file
  * keytool-default-rsa.patch
    + Make keytool generate RSA keys by default, since only the
    LEGACY system crypto policy allows DSA</changelog>
  <changelog author="pujos.michael@gmail.com" date="1618488000">- moved mozilla-nss dependency to java-11-openjdk-headless package
  This is necessary to be able to do crypto with just
  java-11-openjdk-headless installed. Fixes boo#1184606</changelog>
  <changelog author="fstrba@suse.com" date="1619006400">- Update to upstream tag jdk-11.0.11+9 (April 2021, CPU)
  * Security fixes
    + JDK-8244473: Contextualize registration for JNDI
    + JDK-8244543: Enhanced handling of abstract classes
    + JDK-8249906, CVE-2021-2163, bsc#1185055: Enhance opening JARs
    + JDK-8250568, CVE-2021-2161, bsc#1185056: Less ambiguous
    processing
    + JDK-8253799: Make lists of normal filenames
    + JDK-8257001: Improve Http Client Support
  * Other changes
    + JDK-7107012: sun.jvm.hotspot.code.CompressedReadStream
    readDouble() conversion to long mishandled
    + JDK-7146776: deadlock between URLStreamHandler.getHostAddress
    and file.Handler.openconnection
    + JDK-8086003: Test fails on OSX with java.lang.RuntimeException
    'Narrow klass base: 0x0000000000000000, Narrow klass shift: 3'
    missing
    + JDK-8168869: jdeps: localized messages don't use proper line
    breaks
    + JDK-8180837: SunPKCS11-NSS tests failing with
    CKR_ATTRIBUTE_READ_ONLY and CKR_MECHANISM_PARAM_INVALID
    + JDK-8202343: Disable TLS 1.0 and 1.1
    + JDK-8205992: jhsdb cannot attach to Java processes running in
    Docker containers
    + JDK-8209193: Fix aarch64-linux compilation after -Wreorder
    changes
    + JDK-8210413: AArch64: Optimize div/rem by constant in C1
    + JDK-8210578: AArch64: Invalid encoding for fmlsvs instruction
    + JDK-8211051: jdeps usage of --dot-output doesn't provide
    valid output for modular jar
    + JDK-8211057: Gensrc step CompileProperties generates unstable
    CompilerProperties output
    + JDK-8211150: G1 Full GC not purging code root memory and
    hence causing memory leak
    + JDK-8211825: ModuleLayer.defineModulesWithXXX does not setup
    delegation when module reads automatic module
    + JDK-8212043: Add floating-point Math.min/max intrinsics
    + JDK-8212218: [TESTBUG] runtime/ErrorHandling/
    /TestHeapDumpOnOutOfMemoryErrorInMetaspace.java timed out
    + JDK-8213116: javax/swing/JComboBox/WindowsComboBoxSize/
    /WindowsComboBoxSizeTest.java fails in Windows
    + JDK-8213909: jdeps --print-module-deps should report missing
    dependences
    + JDK-8214180: Need better granularity for sleeping
    + JDK-8214223: tools/jdeps/listdeps/ListModuleDeps.java failed
    due to missing Lib2 file
    + JDK-8214230: Classes generated by SystemModulesPlugin.java
    are not reproducable
    + JDK-8214741: docs/index.html has no title or copyright
    + JDK-8215687: [Graal] unit test CheckGraalIntrinsics failed
    after 8212043
    + JDK-8217848: [Graal] vmTestbase/nsk/jvmti/ResourceExhausted/
    /resexhausted003/TestDescription.java fails
    + JDK-8218482: sun/security/krb5/auto/ReplayCachePrecise.java
    failed - no KrbException thrown
    + JDK-8218550: Add test omitted from JDK-8212043
    + JDK-8221584: SIGSEGV in os::PlatformEvent::unpark() in
    JvmtiRawMonitor::raw_exit while posting method exit event
    + JDK-8221995: AARCH64: problems with CAS instructions encoding
    + JDK-8222518: Remove unnecessary caching of Parker object in
    java.lang.Thread
    + JDK-8222785: aarch64: add necessary masking for immediate
    shift counts
    + JDK-8223186: HotSpot compile warnings from GCC 9
    + JDK-8225773: jdeps --check produces NPE if there are missing
    module dependences
    + JDK-8225805: Java Access Bridge does not close the logger
    + JDK-8226810: Failed to launch JVM because of
    NullPointerException occured on System.props
    + JDK-8229396: jdeps ignores multi-release when
    generate-module-info used on command line
    + JDK-8229474: Shenandoah: Cleanup CM::update_roots()
    + JDK-8232225: Rework the fix for JDK-8071483
    + JDK-8232905: JFR fails with assertion:
    assert(t-&gt;unflushed_size() == 0) failed: invariant
    + JDK-8233164: C2 fails with assert(phase-&gt;C-&gt;get_alias_index(t)
    == phase-&gt;C-&gt;get_alias_index(t_adr)) failed: correct memory
    chain
    + JDK-8233910: java/awt/ColorClass/AlphaColorTest.java is
    failing  intermittently in nightly lnux-x64 system
    + JDK-8233912: aarch64: minor improvements of atomic operations
    + JDK-8234508: VM_HeapWalkOperation::iterate_over_object reads
    non-strong fields with an on-strong load barrier
    + JDK-8234742: Improve handshake logging
    + JDK-8234796: Refactor Handshake::execute to take a more
    complex type than ThreadClosure
    + JDK-8235324: Dying objects are published from users of
    CollectedHeap::object_iterate
    + JDK-8235351: Lookup::unreflect should bind with the original
    caller independent of Method's accessible flag
    + JDK-8237369: Shenandoah: failed vmTestbase/nsk/jvmti/
    /AttachOnDemand/attach021/TestDescription.java test
    + JDK-8237392: Shenandoah: Remove unreliable assertion
    + JDK-8237483: AArch64 C1 OopMap inserted twice fatal error
    + JDK-8237495: Java MIDI fails with a dereferenced memory error
    when asked to send a raw 0xF7
    + JDK-8239355: (dc) Initial value of SO_SNDBUF should allow
    sending large datagrams (macOS)
    + JDK-8240353: AArch64: missing support for
  - XX:+ExtendedDTraceProbes in C1
    + JDK-8240704: CheckHandles.java failed "AssertionError: Handle
    use increased by more than 10 percent."
    + JDK-8240751: Shenandoah: fold ShenandoahTracer definition
    + JDK-8240795: [REDO] 8238384 CTW: C2 compilation fails with
    "assert(store != load-&gt;find_exact_control(load-&gt;in(0)))
    failed: dependence cycle found"
    + JDK-8241598: Upgrade JLine to 3.14.0
    + JDK-8241649: Optimize Character.toString
    + JDK-8241770: Module xxxAnnotation() methods throw NCDFE if
    module-info.class found as resource in unnamed module
    + JDK-8241911: AArch64: Fix a potential register clash issue in
    reduce_add2I
    + JDK-8242030: Wrong package declarations in jline classes after
    JDK-8241598
    + JDK-8242565: Policy initialization issues when the denyAfter
    constraint is enabled
    + JDK-8243618: compiler/rtm/cli tests can be run w/o WhiteBox
    + JDK-8243670: Unexpected test result caused by C2
    MergeMemNode::Ideal
    + JDK-8244088: [Regression] Switch of Gnome theme ends up in
    deadlocked UI
    + JDK-8244154: Update SunPKCS11 provider with PKCS11 v3.0 header
    files
    + JDK-8244340: Handshake processing thread lacks yielding
    + JDK-8244573: java.lang.ArrayIndexOutOfBoundsException thrown
    for malformed class file
    + JDK-8244683: A TSA server used by tests
    + JDK-8245005: javax/net/ssl/compatibility/BasicConnectTest.java
    failed with No enum constant
    + JDK-8245026: PsAdaptiveSizePolicy::_old_gen_policy_is_ready is
    unused
    + JDK-8245283: JFR: Can't handle constant dynamic used by Jacoco
    agent
    + JDK-8245512: CRC32 optimization using AVX512 instructions
    + JDK-8245527: LDAP Channel Binding support for Java
    GSS/Kerberos
    + JDK-8246707: (sc) SocketChannel.read/write throws
    AsynchronousCloseException on closed channel
    + JDK-8246709: sun/security/tools/jarsigner/
    /TsacertOptionTest.java compilation failed after JDK-8244683
    + JDK-8247200: assert((unsigned)fpargs &lt; 32)
    + JDK-8247766: [aarch64] guarantee(val &lt; (1U &lt;&lt; nbits))
    failed: Field too big for insn.
    + JDK-8248336: AArch64: C2: offset overflow in
    BoxLockNode::emit
    + JDK-8248865: Document JNDI/LDAP timeout properties
    + JDK-8248901: Signed immediate support in
    .../share/assembler.hpp is broken.
    + JDK-8249543: Force DirectBufferAllocTest to run with
  - ExplicitGCInvokesConcurrent
    + JDK-8249588: libwindowsaccessbridge issues on 64bit Windows
    + JDK-8249749: modify a primitive array through a stream and a
    for cycle causes jre crash
    + JDK-8249787: Make TestGCLocker more resilient with concurrent
    GCs
    + JDK-8249867: xml declaration is not followed by a newline
    + JDK-8250911: [windows] os::pd_map_memory() error detection
    broken
    + JDK-8251255: [linux] Add process-memory information to hs-err
    and VM.info
    + JDK-8251359: Shenandoah: filter null oops before calling
    enqueue/SATB barrier
    + JDK-8251925: C2: RenaissanceStressTest fails with
    assert(!had_error): bad dominance
    + JDK-8251944: Add Shenandoah test config to
    compiler/gcbarriers/UnsafeIntrinsicsTest.java
    + JDK-8251992: VM crashed running TestComplexAddrExpr.java test
    with -XX:UseAVX=X
    + JDK-8253220: Epsilon: clean up unused code/declarations
    + JDK-8253274: The CycleDMImagetest brokes the system
    + JDK-8253353: Crash in C2: guarantee(n != NULL) failed: No Node
    + JDK-8253368: TLS connection always receives close_notify
    exception
    + JDK-8253404: C2: assert(C-&gt;live_nodes() &lt;=
    C-&gt;max_node_limit()) failed: Live Node limit exceeded limit
    + JDK-8253409: Double-rounding possibility in float fma
    + JDK-8253476: TestUseContainerSupport.java fails on some Linux
    kernels w/o swap limit capabilities
    + JDK-8253524: C2: Refactor code that clones predicates during
    loop unswitching
    + JDK-8253644: C2: assert(skeleton_predicate_has_opaque(iff))
    failed: unexpected
    + JDK-8253681: closed java/awt/dnd/MouseEventAfterStartDragTest/
    /MouseEventAfterStartDragTest.html test failed
    + JDK-8253702: BigSur version number reported as 10.16, should
    be 11.nn
    + JDK-8253756: C2 CompilerThread0 crash in Node::add_req(Node*)
    + JDK-8254104: MethodCounters must exist before nmethod is
    installed
    + JDK-8254734: "dead loop detected" assert failure with patch
    from 8223051
    + JDK-8254748: Bad Copyright header format after JDK-8212218
    + JDK-8254799: runtime/ErrorHandling/
    /TestHeapDumpOnOutOfMemoryError.java fails with release VMs
    + JDK-8255058: C1: assert(is_virtual()) failed: type check
    + JDK-8255351: Add detection for Graviton 2 CPUs
    + JDK-8255368: Math.exp() gives wrong result for large values on
    x86 32-bit platforms
    + JDK-8255387: Japanese characters were printed upside down on
    AIX
    + JDK-8255401: Shenandoah: Allow oldval and newval registers to
    overlap in cmpxchg_oop()
    + JDK-8255479: [aarch64] assert(src-&gt;section_index_of(target) ==
    CodeBuffer::SECT_NONE) failed: sanity
    + JDK-8255544: Create a checked cast
    + JDK-8255559: Leak File Descriptors Because of
    ResolverLocalFilesystem#engineResolveURI()
    + JDK-8255681: print callstack in error case in
    runAWTLoopWithApp
    + JDK-8255734: VM should ignore SIGXFSZ on ppc64, s390 too
    + JDK-8255742: PrintInlining as compiler directive doesn't print
    virtual calls
    + JDK-8255845: Memory leak in imageFile.cpp
    + JDK-8255880: UI of Swing components is not redrawn after their
    internal state changed
    + JDK-8255908: ExceptionInInitializerError due to
    UncheckedIOException while initializing cgroupv1 subsystem
    + JDK-8256025: AArch64: MachCallRuntimeNode::ret_addr_offset()
    is incorrect for stub calls
    + JDK-8256056: Deoptimization stub doesn't save vector registers
    on x86
    + JDK-8256061: RegisterSaver::save_live_registers() omits upper
    halves of ZMM0-15 registers
    + JDK-8256187: [TEST_BUG] Automate bug4275046.java test
    + JDK-8256220: C1: x86_32 fails with -XX:UseSSE=1 after
    JDK-8210764 due to mishandled lir_neg
    + JDK-8256258: some missing NULL checks or asserts after
    CodeCache::find_blob_unsafe
    + JDK-8256264: Printed GlyphVector outline with low DPI has bad
    quality on Windows
    + JDK-8256290: javac/lambda/T8031967.java fails with
    StackOverflowError on x86_32
    + JDK-8256359: AArch64: runtime/ReservedStack/
    /ReservedStackTestCompiler.java fails
    + JDK-8256387: Unexpected result if patching an entire
    instruction on AArch64
    + JDK-8256421: Add 2 HARICA roots to cacerts truststore
    + JDK-8256488: [aarch64] Use ldpq/stpq instead of ld4/st4 for
    small copies in StubGenerator::copy_memory
    + JDK-8256489: Make gtest for long path names on Windows more
    resilient in the presence of virus scanners
    + JDK-8256501: libTestMainKeyWindow fails to build with Xcode
    12.2
    + JDK-8256633: Fix product build on Windows+Arm64
    + JDK-8256682: JDK-8202343 is incomplete
    + JDK-8256751: Incremental rebuild with precompiled header fails
    when touching a header file
    + JDK-8256757: Incorrect MachCallRuntimeNode::ret_addr_offset()
    for CallLeafNoFP on x86_32
    + JDK-8256806: Shenandoah: optimize shenandoah/jni/
    /TestPinnedGarbage.java test
    + JDK-8256807: C2: Not marking stores correctly as mismatched
    in string opts
    + JDK-8256810: Incremental rebuild broken on Macosx
    + JDK-8256818: SSLSocket that is never bound or connected leaks
    socket resources
    + JDK-8256888: Client manual test problem list update
    + JDK-8257083: Security infra test failures caused by
    JDK-8202343
    + JDK-8257408: Bump update version for OpenJDK: jdk-11.0.11
    + JDK-8257423: [PPC64] Support -XX:-UseInlineCaches
    + JDK-8257436: [aarch64] Regressions in ArrayCopyUnalignedDst
    .testByte/testChar for 65-78 bytes when UseSIMDForMemoryOps
    is on
    + JDK-8257513: C2: assert((constant_addr -
    _masm.code()-&gt;consts()-&gt;start()) == con.offset())
    + JDK-8257547: Handle multiple prereqs on the same line in deps
    files
    + JDK-8257561: Some code is not vectorized after 8251925 and
    8250607
    + JDK-8257565: epsilonBarrierSet.hpp should not include
    barrierSetAssembler
    + JDK-8257575: C2: "failed: only phis" assert failure in loop
    strip mining verification
    + JDK-8257594: C2 compiled checkcast of non-null object triggers
    endless deoptimization/recompilation cycle
    + JDK-8257633: Missing -mmacosx-version-min=X flag when linking
    libjvm
    + JDK-8257670: sun/security/ssl/SSLSocketImpl/SSLSocketLeak.java
    reports leaks
    + JDK-8257707: Fix incorrect format string in Http1HeaderParser
    + JDK-8257746: Regression introduced with JDK-8250984 - memory
    might be null in some machines
    + JDK-8257798: [PPC64] undefined reference to
    Klass::vtable_start_offset()
    + JDK-8257884: Re-enable sun/security/ssl/SSLSocketImpl/
    /SSLSocketLeak.java as automatic test
    + JDK-8257910: [JVMCI] Set exception_seen accordingly in the
    runtime.
    + JDK-8257997: sun/security/ssl/SSLSocketImpl/SSLSocketLeak.java
    again reports leaks after JDK-8257884
    + JDK-8257999: Parallel GC crash in gc/parallel/
    /TestDynShrinkHeap.java: new region is not in covered_region
    + JDK-8258077: Using -Xcheck:jni can lead to a double-free after
    JDK-8193234
    + JDK-8258247: Couple of issues in fix for JDK-8249906
    + JDK-8258373: Update the text handling in the JPasswordField
    + JDK-8258396: SIGILL in jdk.jfr.internal.PlatformRecorder
    .rotateDisk()
    + JDK-8258419: RSA cipher buffer cleanup
    + JDK-8258471: "search codecache" clhsdb command does not work
    + JDK-8258534: Epsilon: clean up unused includes
    + JDK-8258805: Japanese characters not entered by mouse click
    on Windows 10
    + JDK-8258833: Cancel multi-part cipher operations in SunPKCS11
    after failures
    + JDK-8258836: JNI local refs exceed capacity
    getDiagnosticCommandInfo
    + JDK-8258884: [TEST_BUG] Convert applet-based test
    open/test/jdk/javax/swing/JMenuItem/8031573/bug8031573.java
    to a regular java test
    + JDK-8259007: This test printed a blank page
    + JDK-8259048: (tz) Upgrade time-zone data to tzdata2020f
    + JDK-8259049: Uninitialized variable after JDK-8257513
    + JDK-8259231: Epsilon: improve performance under contention
    during virtual space expansion
    + JDK-8259271: gc/parallel/TestDynShrinkHeap.java still fails
    "assert(covered_region.contains(new_memregion)) failed: new
    region is not in covered_region"
    + JDK-8259312: VerifyCACerts.java fails as soneraclass2ca cert
    will expire in 90 days
    + JDK-8259319: Illegal package access when SunPKCS11 requires
    SunJCE's classes
    + JDK-8259339: AllocateUninitializedArray C2 intrinsic fails
    with void.class input
    + JDK-8259428: AlgorithmId.getEncodedParams() should return copy
    + JDK-8259446: runtime/jni/checked/
    /TestCheckedReleaseArrayElements.java fails with stderr not
    empty
    + JDK-8259451: Zero: skip serviceability/sa tests, set vm.hasSA
    to false
    + JDK-8259580: Shenandoah: uninitialized label in
    VerifyThreadGCState
    + JDK-8259619: C1: 3-arg StubAssembler::call_RT stack-use
    condition is incorrect
    + JDK-8259633: compiler/graalunit/CoreTest.java fails with NPE
    after JDK-8244543
    + JDK-8259706: C2 compilation fails with assert(vtable_index ==
    Method::invalid_vtable_index) failed: correct sentinel value
    + JDK-8259707: LDAP channel binding does not work with StartTLS
    extension
    + JDK-8259773: Incorrect encoding of AVX-512 kmovq instruction
    + JDK-8259849: Shenandoah: Rename store-val to IU-barrier
    + JDK-8259949: x86 32-bit build fails when -fcf-protection is
    passed in the compiler flags
    + JDK-8259954: gc/shenandoah/mxbeans tests fail with -Xcomp
    + JDK-8260029: aarch64: fix typo in verify_oop_array
    + JDK-8260308: Update LogCompilation junit to 4.13.1
    + JDK-8260338: Some fields in HaltNode is not cloned
    + JDK-8260349: Cannot programmatically retrieve Metaspace max
    set via JAVA_TOOL_OPTIONS
    + JDK-8260356: (tz) Upgrade time-zone data to tzdata2021a
    + JDK-8260378: [TESTBUG] DcmdMBeanTestCheckJni.java reports
    false positive
    + JDK-8260497: Shenandoah: Improve SATB flushing
    + JDK-8260502: [s390] NativeMovRegMem::verify() fails because
    it's too strict
    + JDK-8260632: Build failures after JDK-8253353
    + JDK-8260704: ParallelGC: oldgen expansion needs release-store
    for _end
    + JDK-8261022: Fix incorrect result of Math.abs() with char type
    + JDK-8261089: [TESTBUG] native library of test
    TestCheckedReleaseCriticalArray.java fails to compile with
    gcc 4.x
    + JDK-8261183: Follow on to Make lists of normal filenames
    + JDK-8261209: isStandalone property: remove dependency on
    pretty-print
    + JDK-8261231: Windows IME was disabled after DnD operation
    + JDK-8261251: Shenandoah: Use object size for full GC
    humongous compaction
    + JDK-8261310: PPC64 Zero build fails with
    'VMError::controlled_crash(int)::FunctionDescriptor
    functionDescriptor' has incomplete type and cannot be defined
    + JDK-8261334: NMT: tuning statistic shows incorrect hash
    distribution
    + JDK-8261413: Shenandoah: Disable class-unloading in I-U mode
    + JDK-8261522: [PPC64] AES intrinsics write beyond the
    destination array
    + JDK-8261534: Test sun/security/pkcs11/KeyAgreement/
    /IllegalPackageAccess.java fails on platforms where no nsslib
    artifacts are defined
    + JDK-8261585: Restore HandleArea used in
    Deoptimization::uncommon_trap
    + JDK-8261753: Test java/lang/System/OsVersionTest.java still
    failing on BigSur patch versions after JDK-8253702
    + JDK-8261829: Exclude tools/jlink/JLinkReproducibleTest.java
    in 11u
    + JDK-8261912: Code IfNode::fold_compares_helper more
    defensively
    + JDK-8261920: [AIX] jshell command throws java.io.IOError on
    non English locales
    + JDK-8262018: Wrong format in SAP copyright header of
    OsVersionTest
    + JDK-8263069: Exclude some failing tests from
    security/infra/java/security/cert/CertPathValidator</changelog>
  <changelog author="fstrba@suse.com" date="1620043200">- Remove all Jpackage provides for SLE12 in order to avoid
  installing this package as default Java on SLE12-SP5
  (bsc#1185476)</changelog>
  <changelog author="fstrba@suse.com" date="1621512000">- Modified patch:
  * nss-security-provider.patch
    + make the NSS provider first in the list</changelog>
  <changelog author="fstrba@suse.com" date="1626868800">- Update to upstream tag jdk-11.0.12+7 (July 2021, CPU)
  * Security fixes
    + JDK-8256157: Improve bytecode assembly
    + JDK-8256491: Better HTTP transport
    + JDK-8258432, CVE-2021-2341, bsc#1188564: Improve file
    transfers
    + JDK-8260453: Improve Font Bounding
    + JDK-8260960: Signs of jarsigner signing
    + JDK-8260967, CVE-2021-2369, bsc#1188565: Better jar file
    validation
    + JDK-8262380: Enhance XML processing passes
    + JDK-8262403: Enhanced data transfer
    + JDK-8262410: Enhanced rules for zones
    + JDK-8262477: Enhance String Conclusions
    + JDK-8262967: Improve Zip file support
    + JDK-8264066, CVE-2021-2388, bsc#1188566: Enhance compiler
    validation
    + JDK-8264079: Improve abstractions
    + JDK-8264460: Improve NTLM support
  * Other changes
    + JDK-6847157: java.lang.NullPointerException: HDC for
    component at sun.java2d.loops.Blit.Blit
    + JDK-7106851: Test should not use System.exit
    + JDK-8073446: TimeZone getOffset API does not  return a dst
    offset between years 2038-2137
    + JDK-8076190: Customizing the generation of a PKCS12 keystore
    + JDK-8153005: Upgrade the default PKCS12 encryption/MAC
    algorithms
    + JDK-8171303: sun/java2d/pipe/InterpolationQualityTest.java
    fails on Windows &amp; Linux
    + JDK-8177068: incomplete classpath causes NPE in Flow
    + JDK-8185734: [Windows] Structured Exception Catcher missing
    around gtest execution
    + JDK-8187450: JNI local refs exceeds capacity warning in
    NetworkInterface::getAll
    + JDK-8190763: Class cast exception on (CompoundEdit)
    UndoableEditEvent.getEdit()
    + JDK-8195841: PNGImageReader.readNullTerminatedString() doesnt
    check for non-null terminated strings with length equal to
    maxLen
    + JDK-8196100: javax/swing/text/JTextComponent/5074573/
    /bug5074573.java fails
    + JDK-8199646: JShell tests: jdk/jshell/
    /FailOverDirectExecutionControlTest.java failed with
    java.lang.UnsupportedOperationException
    + JDK-8206925: Support the certificate_authorities extension
    + JDK-8207160: ClassReader::adjustMethodParams can potentially
    return null if the args list is empty
    + JDK-8207247: AARCH64: Enable Minimal and Client VM builds
    + JDK-8207404: MulticastSocket tests failing on AIX
    + JDK-8207779: Method::is_valid_method() compares 'this' with
    NULL
    + JDK-8208061: runtime/LoadClass/TestResize.java fails with
    "Load factor too high" when running in CDS mode.
    + JDK-8209459: TestSHA512MultiBlockIntrinsics failed on AArch64
    + JDK-8210443: Migrate Locale matching tests to JDK Repo.
    + JDK-8213231: ThreadSnapshot::_threadObj can become stale
    + JDK-8213483: ARM32: runtime/ErrorHandling/
    /ShowRegistersOnAssertTest.java jtreg test fail
    + JDK-8213725: JShell NullPointerException due to class file
    with unexpected package
    + JDK-8213794: ARM32: disable TypeProfiling,
    CriticalJNINatives, Serviceablity tests for ARM32
    + JDK-8213845: ARM32: Interpreter doesn't call result handler
    after native calls
    + JDK-8214128: ARM32: wrong stack alignment on
    Deoptimization::unpack_frames
    + JDK-8214512: ARM32: Jtreg test compiler/c2/Test8062950.java
    fails on ARM
    + JDK-8214854: JDWP: Unforseen output truncation in logging
    + JDK-8214922: Add vectorization support for fmin/fmax
    + JDK-8215009: GCC 8 compilation error in libjli
    + JDK-8216184: CDS/appCDS tests failed on Windows due to long
    path to a classlist file
    + JDK-8216259: AArch64: Vectorize Adler32 intrinsics
    + JDK-8216314: SIGILL in CodeHeapState::print_names()
    + JDK-8217348: assert(thread-&gt;is_Java_thread()) failed: just
    checking
    + JDK-8217465: [REDO] - Optimize CodeHeap Analytics
    + JDK-8217561: X86: Add floating-point Math.min/max intrinsics
    + JDK-8217918: C2: -XX:+AggressiveUnboxing is broken
    + JDK-8218458: [TESTBUG] runtime/NMT/
    /CheckForProperDetailStackTrace.java fails with Expected
    stack trace missing from output
    + JDK-8219142: Remove unused JIMAGE_ResourcePath
    + JDK-8219586: CodeHeap State Analytics processes dead nmethods
    + JDK-8220074: Clean up GCC 8.3 errors in LittleCMS
    + JDK-8220407: compiler/intrinsics/math/
    /TestFpMinMaxIntrinsics.java timedout
    + JDK-8222302: [TESTBUG] test/hotspot/jtreg/compiler/intrinsics/
    /sha/cli/TestUseSHAOptionOnUnsupportedCPU.java fails on any
    other CPU
    + JDK-8222412: AARCH64: multiple instructions encoding issues
    + JDK-8223020: aarch64: expand minI_rReg and maxI_rReg patterns
    into separate instructions
    + JDK-8223444: Improve CodeHeap Free Space Management
    + JDK-8223504: Improve performance of forall loops by better
    inlining of "iterator()" methods
    + JDK-8223667: ASAN build broken
    + JDK-8225081: Remove Telia Company CA certificate expiring in
    April 2021
    + JDK-8225116: Test OwnedWindowsLeak.java intermittently fails
    + JDK-8225438: javax/net/ssl/TLSCommon/
    /TestSessionLocalPrincipal.java failed with Read timed out
    + JDK-8225756: [testbug] compiler/loopstripmining/
    /CheckLoopStripMining.java sets too short a
    SafepointTimeoutDelay
    + JDK-8226374: Restrict TLS signature schemes and named groups
    + JDK-8226627: assert(t-&gt;singleton()) failed: must be a constant
    + JDK-8226721: Missing intrinsics for Math.ceil, floor, rint
    + JDK-8227080: (fs) Files.newInputStream(...).skip(n) is slow
    + JDK-8227222: vmTestbase/jit/FloatingPoint/gen_math/Loops04/
    /Loops04.java failed XMM register should be 0-15
    + JDK-8227609: (fs) Files.newInputStream(...).skip(n) should
    allow skipping beyond file size
    + JDK-8230428: Cleanup dead CastIP node code in formssel.cpp
    + JDK-8231460: Performance issue (CodeHeap) with large free
    blocks
    + JDK-8231713: x86_32 build failures after JDK-8226721 (Missing
    intrinsics for Math.ceil, floor, rint)
    + JDK-8231841: AArch64: debug.cpp help() is missing an AArch64
    line for pns
    + JDK-8232084: HotSpot build failed with GCC 9.2.1
    + JDK-8232591: AArch64: Add missing match rules for smaddl,
    smsubl and smnegl
    + JDK-8233185: HttpServer.stop() blocks indefinitely when
    called on dispatch thread
    + JDK-8233787: Break cycle in vm_version* includes
    + JDK-8233948: AArch64: Incorrect mapping between OptoReg and
    VMReg for high 64 bits of Vector Register
    + JDK-8234355: Buffer overflow in jcmd GC.class_stats due to
    too many classes
    + JDK-8235368: Update BCEL to Version 6.4.1
    + JDK-8236859: WebSocket over authenticating proxy fails with
    NPE
    + JDK-8236992: AArch64: remove redundant load_klass in itable
    stub
    + JDK-8237743: test/langtools/jdk/jshell/
    /FailOverExecutionControlTest.java fails No
    ExecutionControlProvider with name 'nonExistent' and parameter
    keys: []
    + JDK-8237804: sun/security/mscapi tests fail with "Key pair
    not generated, alias &lt;nnnnnn&gt; already exists"
    + JDK-8238175: CTW: Class.getDeclaredMethods fails with
    assert(k-&gt;is_subclass_of(SystemDictionary::Throwable_klass()))
    failed: invalid exception class
    + JDK-8238567: SoftMainMixer.processAudioBuffers(): Wrong
    handling of stoppedMixers
    + JDK-8238812: assert(false) failed: bad AD file
    + JDK-8239312: [macos] javax/swing/JFrame/NSTexturedJFrame/
    /NSTexturedJFrame.java
    + JDK-8239386: handle ContendedPaddingWidth in
    vm_version_aarch64
    + JDK-8239536: Can't use 'java.util.List' object after
    importing 'java.awt.List'
    + JDK-8240487: Cleanup whitespace in .cc, .hh, .m, and .mm files
    + JDK-8240848: ArrayIndexOutOfBoundsException buf for
    TextCallbackHandler
    + JDK-8241082: Upgrade IANA Language Subtag Registry data to
    03-16-2020 version
    + JDK-8241087: Build failure with VS 2019 (16.5.0) due to C2039
    and C2873
    + JDK-8241101: [s390] jtreg test failure after JDK-8238696: not
    conformant features string
    + JDK-8241248: NullPointerException in
    sun.security.ssl.HKDF.extract(HKDF.java:93)
    + JDK-8241372: Several test failures due to
    javax.net.ssl.SSLException: Connection reset
    + JDK-8241475: AArch64: Add missing support for PopCountVI node
    + JDK-8241829: Cleanup the code for PrinterJob on windows
    + JDK-8241960: The SHA3 message digests impl of SUN provider
    are not thread safe after cloned
    + JDK-8242010: Upgrade IANA Language Subtag Registry to Version
    2020-04-01
    + JDK-8242429: Better implementation for sign extract
    + JDK-8242557: Add length limit for strings in PNGImageWriter
    + JDK-8242919: Paste locks up jshell
    + JDK-8243155: AArch64: Add support for SqrtVF
    + JDK-8243240: AArch64: Add support for MulVB
    + JDK-8243452: JFR: Could not create chunk in repository with
    over 200 recordings
    + JDK-8243559: Remove root certificates with 1024-bit keys
    + JDK-8243597: AArch64: Add support for integer vector abs
    + JDK-8244031: HttpClient should have more tests for HEAD
    requests
    + JDK-8244205: HTTP/2 tunnel connections through proxy may be
    reused regardless of which proxy is selected
    + JDK-8244847: Linux/PPC: runtime/CompressedOops/
    /CompressedClassPointers: smallHeapTest fails
    + JDK-8245511: G1 adaptive IHOP does not account for
    reclamation of humongous objects by young GC
    + JDK-8246274: G1 old gen allocation tracking is not in a
    separate class
    + JDK-8247354: [aarch64] PopFrame causes
    assert(oopDesc::is_oop(obj)) failed: not an oop
    + JDK-8247408: IdealGraph bit check expression canonicalization
    + JDK-8247432: Update IANA Language Subtag Registry to Version
    2020-09-29
    + JDK-8247438: JShell: When FailOverExecutionControlProvider
    fails the proximal cause is not shown
    + JDK-8247753: UIManager.getSytemLookAndFeelClassName() returns
    wrong value on Fedora 32
    + JDK-8248043: Need to eliminate excessive i2l conversions
    + JDK-8248411: [aarch64] Insufficient error handling when
    CodeBuffer is exhausted
    + JDK-8248568: compiler/c2/TestBit.java failed: test missing
    from stdout/stderr
    + JDK-8248870: AARCH64: I2L/L2I conversions can be skipped for
    masked positive values
    + JDK-8249142: java/awt/FontClass/CreateFont/DeleteFont.sh is
    unstable
    + JDK-8249189: AARCH64: more L2I conversions can be skipped
    + JDK-8249719: MethodHandle performance suffers from bad
    ResolvedMethodTable hash function
    + JDK-8249875: GCC 10 warnings -Wtype-limits with JFR code
    + JDK-8250635: MethodArityHistogram should use Compile_lock in
    favour of fancy checks
    + JDK-8250876: Fix issues with cross-compile on macos
    + JDK-8251031: Some vmTestbase/nsk/monitoring/RuntimeMXBean
    tests fail with hostnames starting from digits
    + JDK-8251525: AARCH64: Faster Math.signum(fp)
    + JDK-8252259: AArch64: Adjust default value of FLOATPRESSURE
    + JDK-8252311: AArch64: save two words in itable lookup stub
    + JDK-8252779: compiler/graalunit/HotspotTest.java failed after
    8251525
    + JDK-8252883: AccessDeniedException caused by delayed file
    deletion on Windows
    + JDK-8253167: ARM32 builds fail after JDK-8247910
    + JDK-8253572: [windows] CDS archive may fail to open with long
    file names
    + JDK-8253923: C2 doesn't always run loop opts for compilations
    that include loops
    + JDK-8253948: Memory leak in ImageFileReader
    + JDK-8254631: Better support ALPN byte wire values in SunJSSE
    + JDK-8254717: isAssignableFrom checks in
    KeyFactorySpi.engineGetKeySpec appear to be backwards
    + JDK-8255086: Update the root locale display names
    + JDK-8255625: AArch64: Implement Base64.encodeBlock
    accelerator/intrinsic
    + JDK-8255763: C2: OSR miscompilation caused by invalid memory
    instruction placement
    + JDK-8255992: JFR EventWriter does not use first string from
    StringPool with id 0
    + JDK-8256037: [TESTBUG] com/sun/jndi/dns/ConfigTests/
    /PortUnreachable.java fails due to the hard coded threshold
    is small
    + JDK-8256244: java/lang/ProcessHandle/PermissionTest.java
    fails with TestNG 7.1
    + JDK-8256287: [windows] add loop fuse to
    map_or_reserve_memory_aligned
    + JDK-8256523: Streamline Java SHA2 implementation
    + JDK-8257414: Drag n Drop target area is wrong on high DPI
    systems
    + JDK-8257569: Failure observed with
    JfrVirtualMemory::initialize
    + JDK-8257574: C2: "failed: parsing found no loops but there
    are some" assert failure
    + JDK-8257580: Bump update version for OpenJDK: jdk-11.0.12
    + JDK-8257604: JNI_ArgumentPusherVaArg leaks valist
    + JDK-8257621: JFR StringPool misses cached items across
    consecutive recordings
    + JDK-8257796: [TESTBUG]
    TestUseSHA512IntrinsicsOptionOnSupportedCPU.java fails
    on x86_32
    + JDK-8257822: C2 crashes with SIGFPE due to a division that
    floats above its zero check
    + JDK-8257828: SafeFetch may crash if invoked in non-JavaThreads
    + JDK-8257853: Remove dependencies on JNF's JNI utility
    functions in AWT and 2D code
    + JDK-8257858: [macOS]: Remove JNF dependency from
    libosxsecurity/KeystoreImpl.m
    + JDK-8257860: [macOS]: Remove JNF dependency from
    libosxkrb5/SCDynamicStoreConfig.m
    + JDK-8257988: Remove JNF dependency from
    libsaproc/MacosxDebuggerLocal.m
    + JDK-8258414: OldObjectSample events too expensive
    + JDK-8258505: [TESTBUG] TestDivZeroWithSplitIf.java fails due
    to missing UnlockDiagnosticVMOptions
    + JDK-8258753: StartTlsResponse.close() hangs due to
    synchronization issues
    + JDK-8259061: C2: assert(found) failed: memory-writing node is
    not placed in its original loop or an ancestor of it
    + JDK-8259227: C2 crashes with SIGFPE due to a division that
    floats above its zero check
    + JDK-8259232: Bad JNI lookup during printing
    + JDK-8259276: C2: Empty expression stack when reexecuting
    tableswitch/lookupswitch instructions after deoptimization
    + JDK-8259343: [macOS] Update JNI error handling in Cocoa code.
    + JDK-8259585: Accessible actions do not work on mac os x
    + JDK-8259651: [macOS] Replace JNF_COCOA_ENTER/EXIT macros
    + JDK-8259662: Don't wrap SocketExceptions into SSLExceptions
    in SSLSocketImpl
    + JDK-8259710: Inlining trace leaks memory
    + JDK-8259729: Missed JNFInstanceOf -&gt; IsInstanceOf conversion
    + JDK-8259777: Incorrect predication condition generated by ADLC
    + JDK-8259786: initialize last parameter of getpwuid_r
    + JDK-8259843: initialize dli_fname array before calling
    dll_address_to_library_name
    + JDK-8259869: [macOS] Remove desktop module dependencies on
    JNF Reference APIs
    + JDK-8259886: Improve SSL session cache performance and
    scalability
    + JDK-8259983: do not use uninitialized expand_ms value in
    G1CollectedHeap::expand_heap_after_young_collection
    + JDK-8260030: Improve stringStream buffer handling
    + JDK-8260236: better init AnnotationCollector _contended_group
    + JDK-8260255: C1: LoopInvariantCodeMotion constructor can
    leave some fields uninitialized
    + JDK-8260284: C2: assert(_base == Int) failed: Not an Int
    + JDK-8260380: Upgrade to LittleCMS 2.12
    + JDK-8260420: C2 compilation fails with assert(found_sfpt)
    failed: no node in loop that's not input to safepoint
    + JDK-8260426: awt debug_mem.c DMem_AllocateBlock might leak
    memory
    + JDK-8260432: allocateSpaceForGP in freetypeScaler.c might
    leak memory
    + JDK-8260616: Removing remaining JNF dependencies in the
    java.desktop module
    + JDK-8260653: Unreachable nodes keep speculative types alive
    + JDK-8260707: java/lang/instrument/PremainClass/
    /InheritAgent0100.java times out
    + JDK-8260925: HttpsURLConnection does not work  with other
    JSSE provider.
    + JDK-8260926: Trace resource exhausted events unconditionally
    + JDK-8261020: Wrong format parameter in
    create_emergency_chunk_path
    + JDK-8261027: AArch64: Support for LSE atomics C++ HotSpot code
    + JDK-8261167: print_process_memory_info add a close call after
    fopen
    + JDK-8261170: Upgrade to freetype 2.10.4
    + JDK-8261198: [macOS] Incorrect JNI parameters in number
    conversion in A11Y code
    + JDK-8261235: C1 compilation fails with
    assert(res-&gt;vreg_number() == index) failed: conversion check
    + JDK-8261261: The version extra fields needs to be overridable
    in jib-profiles.js
    + JDK-8261262: Kitchensink24HStress.java crashed with
    EXCEPTION_ACCESS_VIOLATION
    + JDK-8261354: SIGSEGV at MethodIteratorHost
    + JDK-8261355: No data buffering in SunPKCS11 Cipher encryption
    when the underlying mechanism has no padding
    + JDK-8261397: try catch Method failing to work when dividing
    an integer by 0
    + JDK-8261422: Adjust problematic String.format calls in
    jdk/internal/util/Preconditions.java outOfBoundsMessage
    + JDK-8261447: MethodInvocationCounters frequently run into
    overflow
    + JDK-8261481: Cannot read Kerberos settings in dynamic store
    on macOS Big Sur
    + JDK-8261505: Test test/hotspot/jtreg/gc/parallel/
    /TestDynShrinkHeap.java killed by Linux OOM Killer
    + JDK-8261601: free memory in early return in
    Java_sun_nio_ch_sctp_SctpChannelImpl_receive0
    + JDK-8261649: AArch64: Optimize LSE atomics in C++ code
    + JDK-8261730: C2 compilation fails with
    assert(store-&gt;find_edge(load) != -1) failed: missing
    precedence edge
    + JDK-8261752: Multiple GC test are missing memory requirements
    + JDK-8261791: (sctp) handleSendFailed in SctpChannelImpl.c
    potential leaks
    + JDK-8261812: C2 compilation fails with assert(!had_error)
    failed: bad dominance
    + JDK-8261914: IfNode::fold_compares_helper faces
    non-canonicalized bool when running JRuby JSON workload
    + JDK-8262093: java/util/concurrent/tck/JSR166TestCase.java
    failed "assert(false) failed: unexpected node"
    + JDK-8262110: DST starts from incorrect time in 2038
    + JDK-8262121: [11u] Redo 8244287: JFR: Methods samples have
    line number 0
    + JDK-8262163: Extend settings printout in jcmd VM.metaspace
    + JDK-8262295: C2: Out-of-Bounds Array Load from Clone Source
    + JDK-8262298: G1BarrierSetC2::step_over_gc_barrier fails with
    assert "bad barrier shape"
    + JDK-8262446: DragAndDrop hangs on Windows
    + JDK-8262461: handle wcstombsdmp return value correctly in
    unix awt_InputMethod.c
    + JDK-8262465: Very long compilation times and high memory
    consumption in C2 debug builds
    + JDK-8262726: AArch64: C1 StubAssembler::call_RT can corrupt
    stack
    + JDK-8262739: String inflation C2 intrinsic prevents insertion
    of anti-dependencies
    + JDK-8262829: Native crash in
    Win32PrintServiceLookup.getAllPrinterNames()
    + JDK-8262837: handle split_USE correctly
    + JDK-8262900: ToolBasicTest fails to access HTTP server it
    starts
    + JDK-8263260: [s390] Support latest hardware (z14 and z15)
    + JDK-8263311: Watch registry changes for remote printers
    update instead of polling
    + JDK-8263361: Incorrect arraycopy stub selected by C2 for SATB
    collectors
    + JDK-8263404: RsaPrivateKeySpec is always recognized as
    RSAPrivateCrtKeySpec in RSAKeyFactory.engineGetKeySpec
    + JDK-8263425: AArch64: two potential bugs in C1
    LIRGenerator::generate_address()
    + JDK-8263448: CTW: fatal error: meet not symmetric
    + JDK-8263504: Some OutputMachOpcodes fields are uninitialized
    + JDK-8263557: Possible NULL dereference in
    Arena::destruct_contents()
    + JDK-8263558: Possible NULL dereference in fast path arena
    free if ZapResourceArea is true
    + JDK-8263676: AArch64: one potential bug in C1
    LIRGenerator::generate_address()
    + JDK-8263729: [test] divert spurious output away from stream
    under test in ProcessBuilder Basic test
    + JDK-8263846: Bad JNI lookup getFocusOwner in accessibility
    code on Mac OS X
    + JDK-8264047: Duplicate global variable 'jvm' in libjavajpeg
    and libawt
    + JDK-8264096: slowdebug jvm crashes when StrInflatedCopy match
    rule is not supported
    + JDK-8264151: ciMethod::ensure_method_data() should return
    false is loading resulted in empty state
    + JDK-8264173: [s390] Improve Hardware Feature Detection And
    Reporting
    + JDK-8264190: Harden TLS interop tests
    + JDK-8264223: CodeHeap::verify fails extra_hops assertion in
    fastdebug test
    + JDK-8264328: Broken license in
    javax/swing/JComboBox/8072767/bug8072767.java
    + JDK-8264360: Loop strip mining verification fails with
    "should be on the backedge"
    + JDK-8264626: C1 should be able to inline excluded methods
    + JDK-8264640: CMS ParScanClosure misses a barrier
    + JDK-8264786: [macos] All Swing/AWT apps cause Allow
    Notifications prompt to appear when app is launched
    + JDK-8264821: DirectIOTest fails on a system with large block
    size
    + JDK-8264848: [macos] libjvm.dylib linker warning due to macOS
    version mismatch
    + JDK-8264923: PNGImageWriter.write_zTXt throws Exception with
    a typo
    + JDK-8264958: C2 compilation fails with assert "n is later
    than its clone"
    + JDK-8265099: Revert backport to 11u of 8236859: WebSocket
    over authenticating proxy fails with NPE
    + JDK-8265154: vinserti128 operand mix up for KNL platforms
    + JDK-8265239: Shenandoah: Shenandoah heap region count could
    be off by 1
    + JDK-8265417: Backport of JDK-8249672 breaks Solaris x86 build
    + JDK-8265421: java/lang/String/StringRepeat.java test is
    missing a memory requirement
    + JDK-8265462: Handle multiple slots in the NSS Internal Module
    from SunPKCS11's Secmod
    + JDK-8265537: x86 version string truncated after JDK-8249672
    11u backport
    + JDK-8265666: Enable AIX build platform to make external debug
    symbols
    + JDK-8265677: CMS: CardTableBarrierSet::write_ref_array_work()
    lacks storestore barrier
    + JDK-8265690: Use the latest Ubuntu base image version in
    Docker testing
    + JDK-8265718: Build failure after JDK-8258414 11u backport
    + JDK-8265750: Fatal error in safepoint.cpp after backport of
    8258414
    + JDK-8265784: [C2] Hoisting of DecodeN leaves MachTemp inputs
    behind
    + JDK-8265938: C2's conditional move optimization does not
    handle top Phi
    + JDK-8266220: keytool still prompt for store password on a
    password-less pkcs12 file if -storetype pkcs12 is specified
    + JDK-8266293: Key protection using PBEWithMD5AndDES fails with
    "java.security.InvalidAlgorithmParameterException: Salt must
    be 8 bytes long"
    + JDK-8266713: [AIX] Build failure after 11u backport of
    JDK-8247753
    + JDK-8266802: Shenandoah: Round up region size to page size
    unconditionally
    + JDK-8266892: avoid maybe-uninitialized gcc warnings on linux
    s390x
    + JDK-8266929: Unable to use algorithms from 3p providers
    + JDK-8267235: [macos_aarch64]
    InterpreterRuntime::throw_pending_exception messing up LR
    results in crash
    + JDK-8267561: Shenandoah: Reference processing not properly
    setup for outside of cycle degenerated GC
    + JDK-8267599: Revert the change to the default PKCS12
    macAlgorithm and macIterationCount props for 11u/8u/7u
    + JDK-8267641: [11u] 8227609 backport typo
    + JDK-8267721: Enable sun/security/pkcs11 tests for Amazon
    Linux 2 AArch64
    + JDK-8268678: LetsEncryptCA.java test fails as Let's Encrypt
    Authority X3 is retired</changelog>
  <changelog author="schwab@suse.de" date="1628078400">- riscv64-zero.patch: Add support for riscv64 (zero VM)</changelog>
  <changelog author="fstrba@suse.com" date="1629979200">- Added patch:
  * jdk11-glibc234.patch
    + fix build with glibc-2.34 (bsc#1189201)</changelog>
  <changelog author="fstrba@suse.com" date="1631534400">- Modified patch:
  * nss-security-provider.patch
    + revert recent changes making NSS provider the default one
    + fixes bsc#1190252</changelog>
  <changelog author="fstrba@suse.com" date="1631793600">- Added patch:
  * fips.patch
    + implement FIPS support in OpenJDK</changelog>
  <changelog author="fstrba@suse.com" date="1634817600">- Update to upstream tag jdk-11.0.13+8 (October 2021 CPU)
  * Security fixes
    + JDK-8163326, CVE-2021-35550, bsc#1191901: Update the default
    enabled cipher suites preference
    + JDK-8254967, CVE-2021-35565, bsc#1191909:
    com.sun.net.HttpsServer spins on TLS session close
    + JDK-8263314: Enhance XML Dsig modes
    + JDK-8265167, CVE-2021-35556, bsc#1191910: Richer Text Editors
    + JDK-8265574: Improve handling of sheets
    + JDK-8265580, CVE-2021-35559, bsc#1191911: Enhanced style for
    RTF kit
    + JDK-8265776: Improve Stream handling for SSL
    + JDK-8266097, CVE-2021-35561, bsc#1191912: Better hashing
    support
    + JDK-8266103: Better specified spec values
    + JDK-8266109: More Resilient Classloading
    + JDK-8266115: More Manifest Jar Loading
    + JDK-8266137, CVE-2021-35564, bsc#1191913: Improve Keystore
    integrity
    + JDK-8266689, CVE-2021-35567, bsc#1191903: More Constrained
    Delegation
    + JDK-8267086: ArrayIndexOutOfBoundsException in
    java.security.KeyFactory.generatePublic
    + JDK-8267712: Better LDAP reference processing
    + JDK-8267729, CVE-2021-35578, bsc#1191904: Improve TLS client
    handshaking
    + JDK-8267735, CVE-2021-35586, bsc#1191914: Better BMP support
    + JDK-8268193: Improve requests of certificates
    + JDK-8268199: Correct certificate requests
    + JDK-8268205: Enhance DTLS client handshake
    + JDK-8268506: More Manifest Digests
    + JDK-8269618, CVE-2021-35603, bsc#1191906: Better session
    identification
    + JDK-8269624: Enhance method selection support
    + JDK-8270398: Enhance canonicalization
    + JDK-8270404: Better canonicalization
  * Other changes
    + JDK-8024368: private methods are allocated vtable indices
    + JDK-8042902: Test java/net/Inet6Address/serialize/
    /Inet6AddressSerializationTest.java fails intermittently
    + JDK-8140466: ChaCha20 and Poly1305 TLS Cipher Suites
    + JDK-8157404: Unable to read certain PKCS12 keystores from
    SequenceInputStream
    + JDK-8158066: SourceDebugExtensionTest fails to rename file
    + JDK-8168304: Make all of DependencyContext_test available in
    product mode
    + JDK-8169246: java/net/DatagramSocket/ReportSocketClosed.java
    fails intermittently with BindException
    + JDK-8181313: SA: Remove libthread_db dependency on Linux
    + JDK-8193214: Incorrect annotations.without.processors
    warnings with JDK 9
    + JDK-8194230: jdk/internal/jrtfs/remote/
    /RemoteRuntimeImageTest.java fails with
    java.lang.NullPointerException
    + JDK-8196092: javax/swing/JComboBox/8032878/bug8032878.java
    fails
    + JDK-8199931: java/net/MulticastSocket/
    /UnreferencedMulticastSockets.java fails with "incorrect data
    received"
    + JDK-8206083: Make tools/javac/api/T6265137.java robust to JDK
    version changes
    + JDK-8206350: java/util/Locale/bcp47u/SystemPropertyTests.java
    failed on Mac 10.13 with zh_CN and zh_TW locales.
    + JDK-8207316: java/nio/channels/spi/SelectorProvider/
    /inheritedChannel/InheritedChannelTest.java failed
    + JDK-8208227: tools/jdeps/DotFileTest.java fails on Win-X64
    + JDK-8208363: test/jdk/java/lang/Package/
    /PackageFromManifest.java missing module dependencies
    declaration
    + JDK-8209380: ARM: cleanup maybe-uninitialized and reorder
    compiler warnings
    + JDK-8209768: Refactor java/util/prefs/CheckUserPrefsStorage.sh
    to plain java test
    + JDK-8209772: Refactor shell test java/util/ServiceLoader/
    /basic/basic.sh to java
    + JDK-8209773: Refactor shell test javax/naming/module/basic.sh
    to java
    + JDK-8209832: Refactor jdk/internal/reflect/Reflection/
    /GetCallerClassTest.sh to plain java test
    + JDK-8209930: Refactor java/util/zip/ZipFile/deletetempjar.sh
    to plain java test
    + JDK-8210406: Refactor java.util.PluggableLocale:i18n shell
    tests to plain java tests
    + JDK-8210407: Refactor java.util.Calendar:i18n shell tests to
    plain java tests
    + JDK-8210495: compiler crashes because of illegal signature in
    otherwise legal code
    + JDK-8210669: Some launcher tests assume a pre-JDK 9 run-time
    image layout
    + JDK-8210802: temp files left by tests in
    jdk/java/net/httpclient
    + JDK-8210819: Update the host name in CNameTest.java
    + JDK-8210908: Refactor java/util/prefs/PrefsSpi.sh to plain
    java test
    + JDK-8210934: Move sun/net/www/protocol/http/
    /GetErrorStream.java to OpenJDK
    + JDK-8210959: JShell fails and exits when statement throws an
    exception whose message contains a '%'.
    + JDK-8211055: Provide print to a file (PDF) feature even when
    printer was not connected
    + JDK-8211092: test/jdk/sun/net/www/http/HttpClient/
    /MultiThreadTest.java fails intermittently when cleaning up
    + JDK-8211296: Remove HotSpot deprecation warning suppression
    for Mac/clang
    + JDK-8211325: test/jdk/java/net/Socket/LingerTest.java fails
    with cleaning up
    + JDK-8212040: Compilation error due to wrong usage of
    NSPrintJobDispositionValue in mac10.12
    + JDK-8212695: Add explicit timeout to several HTTP Client tests
    + JDK-8212718: Refactor some annotation processor tests to
    better use collections
    + JDK-8213007: Update the link in test/jdk/sun/security/
    /provider/SecureRandom/DrbgCavp.java
    + JDK-8213137: Remove static initialization of monitor/mutex
    instances
    + JDK-8213235: java/nio/channels/SocketChannel/
    /AsyncCloseChannel.java fails with threads that didn't exit
    + JDK-8213409: Refactor sun.text.IntHashtable:i18n shell tests
    to plain java tests
    + JDK-8213576: Make test AsyncCloseChannel.java run in othervm
    + JDK-8213694: Test Timeout.java should run in othervm mode
    + JDK-8213718: [TEST] Wrong classname in vmTestbase/nsk/stress/
    /except/except002 and except003
    + JDK-8213922: fix ctw stand-alone build
    + JDK-8214195: Align stdout messages in
    test/jdk/java/math/BigInteger/PrimitiveConversionTests.java
    + JDK-8214520: [TEST_BUG] sun/security/mscapi/nonUniqueAliases/
    /NonUniqueAliases.java failed with incorrect jtreg tags order
    + JDK-8214937: sun/security/tools/jarsigner/warnings/
    /NoTimestampTest.java failed due to unexpected expiration date
    + JDK-8216532: tools/launcher/Test7029048.java fails (Solaris)
    + JDK-8217825: Verify @AfterTest is used correctly in WebSocket
    tests
    + JDK-8218145: block_if_requested is not proper inlined due to
    size
    + JDK-8219417: bump jtreg requiredVersion to b14
    + JDK-8219552: bump jtreg requiredVersion to b14 in
    test/jdk/sanity/client/
    + JDK-8219804: java/net/MulticastSocket/Promiscuous.java fails
    intermittently due to NumberFormatException
    + JDK-8220445: Support for side by side MSVC Toolset versions
    + JDK-8221988: add possibility to build with Visual Studio 2019
    + JDK-8222751: closed/test/jdk/sun/security/util/
    /DerIndefLenConverter/IndefBerPkcs12.java fail
    + JDK-8223050: JVMCI: findUniqueConcreteMethod() should not use
    Dependencies::find_unique_concrete_method() for non-virtual
    methods
    + JDK-8224853: CDS address sanitizer errors
    + JDK-8225082: Remove IdenTrust certificate that is expiring in
    September 2021
    + JDK-8225583: Examine the HttpResponse.BodySubscribers for
    null handling and multiple subscriptions
    + JDK-8225690: Multiple AttachListener threads can be created
    + JDK-8225790: Two NestedDialogs tests fail on Ubuntu
    + JDK-8226319: Add forgotten test/jdk/java/net/httpclient/
    /BodySubscribersTest.java
    + JDK-8226533: JVMCI: findUniqueConcreteMethod should handle
    statically bindable methods directly
    + JDK-8226602: Test convenience reactive primitives from
    java.net.http with RS TCK
    + JDK-8226683: Remove review suggestion from fix to 8219804
    + JDK-8227738: jvmti/DataDumpRequest/datadumpreq001 failed due
    to "exit code is 134"
    + JDK-8227766: CheckUnhandledOops is broken in MemAllocator
    + JDK-8227815: Minimal VM: set_state is not a member of
    AttachListener
    + JDK-8230674: Heap dumps should exclude dormant CDS archived
    objects of unloaded classes
    + JDK-8230808: Remove Access::equals()
    + JDK-8230841: Remove oopDesc::equals()
    + JDK-8231717: Improve performance of charset decoding when
    charset is always compactable
    + JDK-8232243: Wrong caret position in JTextPane on Windows
    with a screen resolution &gt; 100%
    + JDK-8232782: Shenandoah: streamline post-LRB CAS barrier
    (aarch64)
    + JDK-8233790: Forward output from heap dumper to jcmd/jmap
    + JDK-8233989: Create an IPv4 version of
    java/net/MulticastSocket/SetLoopbackMode.java
    + JDK-8234510: Remove file seeking requirement for writing a
    heap dump
    + JDK-8235211: serviceability/attach/
    /RemovingUnixDomainSocketTest.java fails with
    AttachNotSupportedException: Unable to open socket file
    + JDK-8235216: typo in test filename
    + JDK-8235866: bump jtreg requiredVersion to 4.2b16
    + JDK-8236111: narrow allowSmartActionArgs disabling
    + JDK-8236413: AbstractConnectTimeout should tolerate both
    NoRouteToHostException and UnresolvedAddressException
    + JDK-8236671: NullPointerException in JKS keystore
    + JDK-8238930: problem list compiler/c2/Test8004741.java
    + JDK-8238943: switch to jtreg 5.0
    + JDK-8240555: Using env of JAVA_TOOL_OPTIONS and _JAVA_OPTIONS
    breaks QuietOption.java test
    + JDK-8240983: Incorrect copyright header in Apache Santuario
    2.1.3 files
    + JDK-8241336: Some java.net tests failed with
    NoRouteToHostException on MacOS with special network
    configuration
    + JDK-8241353: NPE in ToolProvider.getSystemJavaCompiler
    + JDK-8241768: git needs .gitattributes
    + JDK-8242882: opening jar file with large manifest might throw
    NegativeArraySizeException
    + JDK-8244973: serviceability/attach/
    /RemovingUnixDomainSocketTest.java fails "stderr was not
    empty"
    + JDK-8245134: test/lib/jdk/test/lib/security/
    /KeyStoreUtils.java should allow to specify aliases
    + JDK-8246261: TCKLocalTime.java failed due to "AssertionError:
    expected [18:14:22] but found [18:14:23]"
    + JDK-8246387: switch to jtreg 5.1
    + JDK-8247421: [TESTBUG] ReturnBlobToWrongHeapTest.java failed
    allocating blob
    + JDK-8247469: getSystemCpuLoad() returns -1 on linux when some
    offline cpus are present and cpusets.effective_cpus is not
    available
    + JDK-8248352: [TEST_BUG] Test test/jdk/java/awt/font/
    /TextLayout/ArabicDiacriticTest.java can leave frame open
    + JDK-8248403: AArch64: Remove uses of kernel integer types
    + JDK-8248414: AArch64: Remove uses of long and unsigned long
    ints
    + JDK-8248657: Windows: strengthening in ThreadCritical
    regarding memory model
    + JDK-8248666: AArch64: Use THREAD_LOCAL instead of __thread
    + JDK-8248668: AArch64: Avoid MIN/MAX macros when using MSVC
    + JDK-8248671: AArch64: Remove unused variables
    + JDK-8248682: AArch64: Use ATTRIBUTE_ALIGNED helper
    + JDK-8248816: C1: Fix signature conflict in
    LIRGenerator::strength_reduce_multiply
    + JDK-8249095: tools/javac/launcher/SourceLauncherTest.java
    fails on Windows
    + JDK-8249548: backward focus traversal gets stuck in button
    group
    + JDK-8249773: Upgrade ReceiveISA.java test to be resilient to
    failure due to stray packets and interference
    + JDK-8249897: jdk/javadoc/tool/LangVers.java uses @ignore w/o
    bug-id
    + JDK-8249898: jdk/javadoc/tool/6176978/T6176978.java uses
    @ignore w/o bug-id
    + JDK-8249899: jdk/javadoc/tool/InlineTagsWithBraces.java uses
    @ignore w/o bug-id
    + JDK-8250588: Shenandoah: LRB needs to save/restore fp
    registers for runtime call
    + JDK-8250824: AArch64: follow up for JDK-8248414
    + JDK-8251166: Add automated testcases for changes done in
    JDK-8214112
    + JDK-8251252: Add automated testcase for fix done in
    JDK-8214253
    + JDK-8251254: Add automated test for fix done in JDK-8218472
    + JDK-8251361: Potential race between Logger configuration and
    GCs in HttpURLConWithProxy test
    + JDK-8251549: Update docs on building for Git
    + JDK-8251945: SIGSEGV in
    PackageEntry::purge_qualified_exports()
    + JDK-8252194: Add automated test for fix done in JDK-8218469
    + JDK-8252648: Shenandoah: name gang tasks consistently
    + JDK-8252825: Add automated test for fix done in JDK-8218479
    + JDK-8252853: AArch64: gc/shenandoah/TestVerifyJCStress.java
    fails intermittently with C1
    + JDK-8252857: AArch64: Shenandoah C1 CAS is not sequentially
    consistent
    + JDK-8253048: AArch64: When CallLeaf, no need to preserve
    callee-saved registers in caller
    + JDK-8253424: Add support for running pre-submit testing using
    GitHub Actions
    + JDK-8253631: Remove unimplemented CompileBroker methods after
    JEP-165
    + JDK-8253865: Pre-submit testing using GitHub Actions does not
    detect failures reliably
    + JDK-8253899: Make IsClassUnloadingEnabled signature match
    specification
    + JDK-8254024: Enhance native libs for AWT and Swing to work
    with GraalVM Native Image
    + JDK-8254054: Pre-submit testing using GitHub Actions should
    not use the deprecated set-env command
    + JDK-8254173: Add Zero, Minimal hotspot targets to submit
    workflow
    + JDK-8254175: Build no-pch configuration in debug mode for
    submit checks
    + JDK-8254244: Some code emitted by TemplateTable::branch is
    unused when running TieredCompilation
    + JDK-8254270: linux 32 bit build doesn't compile
    libjdwp/log_messages.c
    + JDK-8254282: Add Linux x86_32 builds to submit workflow
    + JDK-8254850: Update terminology in java.awt.GridBagLayout
    source code comments
    + JDK-8255255: Update Apache Santuario (XML Signature) to
    version 2.2.1
    + JDK-8255305: Add Linux x86_32 tier1 to submit workflow
    + JDK-8255352: Archive important test outputs in submit workflow
    + JDK-8255373: Submit workflow artifact name is always
    "test-results_.zip"
    + JDK-8255452: Doing GC during JVMTI MethodExit event posting
    breaks return oop
    + JDK-8255718: Zero: VM should know it runs in interpreter-only
    mode
    + JDK-8255790: GTKL&amp;F: Java 16 crashes on initialising GTKL&amp;F
    on Manjaro Linux
    + JDK-8255810: Zero: build fails without JVMTI
    + JDK-8255895: Submit workflow artifacts miss hs_errs/replays
    due to ZIP include mismatch
    + JDK-8256127: Add cross-compiled foreign architectures builds
    to submit workflow
    + JDK-8256215: Shenandoah: re-organize saving/restoring machine
    state in assembler code
    + JDK-8256267: Relax compiler/floatingpoint/NaNTest.java for
    x86_32 and lower -XX:+UseSSE
    + JDK-8256277: Github Action build on macOS should define OS
    and Xcode versions
    + JDK-8256354: Github Action build on Windows should define OS
    and MSVC versions
    + JDK-8256393: Github Actions build on Linux should define OS
    and GCC versions
    + JDK-8256414: add optimized build to submit workflow
    + JDK-8256747: GitHub Actions: decouple the hotspot build-only
    jobs from Linux x64 testing
    + JDK-8257056: Submit workflow should apt-get update to avoid
    package installation errors
    + JDK-8257148: Remove obsolete code in AWTView.m
    + JDK-8257497: Update keytool to create AKID from the SKID of
    the issuing certificate as specified by RFC 5280
    + JDK-8257620: Do not use objc_msgSend_stret to get macOS
    version
    + JDK-8257913: Add more known library locations to simplify
    Linux cross-compilation
    + JDK-8258703: Incorrect 512-bit vector registers restore on
    x86_32
    + JDK-8259338: Add expiry exception for identrustdstx3 alias to
    VerifyCACerts.java test
    + JDK-8259535: ECDSA SignatureValue do not always have the
    specified length
    + JDK-8259679: GitHub actions should use MSVC 14.28
    + JDK-8259924: GitHub actions fail on Linux x86_32 with "Could
    not configure libc6:i386"
    + JDK-8260460: GitHub actions still fail on Linux x86_32 with
    "Could not configure libc6:i386"
    + JDK-8260589: Crash in JfrTraceIdLoadBarrier::load(_jclass*)
    + JDK-8260923: Add more tests for SSLSocket input/output
    shutdown
    + JDK-8261072: AArch64: Fix MacroAssembler::get_thread
    convention
    + JDK-8261147: C2: Node is wrongly marked as reduction
    resulting in a wrong execution due to wrong vector instructions
    + JDK-8261238: NMT should not limit baselining by size threshold
    + JDK-8261496: Shenandoah: reconsider pacing updates memory
    ordering
    + JDK-8261652: Remove some dead comments from os_bsd_x86
    + JDK-8261846: [JVMCI] c2v_iterateFrames can get out of sync
    with the StackFrameStream
    + JDK-8262000: jdk/jfr/event/gc/detailed/
    /TestPromotionFailedEventWithParallelScavenge.java failed with
    "OutOfMemoryError: Java heap space"
    + JDK-8262017: C2: assert(n != __null) failed: Bad immediate
    dominator info.
    + JDK-8262392: Update Mesa 3-D Headers to version 21.0.3
    + JDK-8262409: sun/security/ssl/SSLSocketImpl/
    /SSLSocketImplThrowsWrongExceptions. SSL test failures caused
    by java failed with "Server reported the wrong exception"
    + JDK-8262470: Printed GlyphVector outline with low DPI has bad
    quality on Windows
    + JDK-8262862: Harden tests sun/security/x509/URICertStore/
    /ExtensionsWithLDAP.java and krb5/canonicalize/Test.java
    + JDK-8263136: C4530 was reported from VS 2019 at access bridge
    + JDK-8263227: C2: inconsistent spilling due to dead nodes in
    exception block
    + JDK-8263382: java/util/logging/ParentLoggersTest.java failed
    with "checkLoggers: getLoggerNames() returned unexpected
    loggers"
    + JDK-8263407: SPARC64 detection fails on Athena (SPARC64-X)
    + JDK-8263432: javac may report an invalid package/class clash
    on case insensitive filesystems
    + JDK-8263490: [macos] Crash occurs on JPasswordField with
    activated InputMethod
    + JDK-8263531: Remove unused buffer int
    + JDK-8263667: Avoid running GitHub actions on branches named
    pr/*
    + JDK-8263776: [JVMCI] add helper to perform Java upcalls
    + JDK-8264016: [JVMCI] add some thread local fields for use by
    JVMCI
    + JDK-8264752: SIGFPE crash with option
    FlightRecorderOptions:threadbuffersize=30M
    + JDK-8265132: C2 compilation fails with assert "missing
    precedence edge"
    + JDK-8265231: (fc) ReadDirect and WriteDirect tests fail after
    fix for JDK-8264821
    + JDK-8265335: Epsilon: Minor typo in EpsilonElasticTLABDecay
    description
    + JDK-8265756: AArch64: initialize memory allocated for locals
    according to Windows AArch64 stack page growth requirement in
    template interpreter
    + JDK-8265761: Font with missed font family name is not
    properly printed on Windows
    + JDK-8265773: incorrect jdeps message "jdk8internals" to
    describe a removed JDK internal API
    + JDK-8265836: OperatingSystemImpl.getCpuLoad() returns
    incorrect CPU load inside a container
    + JDK-8266018: Shenandoah: fix an incorrect assert
    + JDK-8266206: Build failure after JDK-8264752 with older GCCs
    + JDK-8266248: Compilation failure in
    PLATFORM_API_MacOSX_MidiUtils.c with Xcode 12.5
    + JDK-8266288: assert root method not found in
    witnessed_reabstraction_in_supers is too strong
    + JDK-8266404: Fatal error report generated with
  - XX:+CrashOnOutOfMemoryError should not contain suggestion to
    submit a bug report
    + JDK-8266480: Implicit null check optimization does not update
    control of hoisted memory operation
    + JDK-8266615: C2 incorrectly folds subtype checks involving an
    interface array
    + JDK-8266642: Improve ResolvedMethodTable hash function
    + JDK-8266749: AArch64: Backtracing broken on PAC enabled
    systems
    + JDK-8266761: AssertionError in
    sun.net.httpserver.ServerImpl.responseCompleted
    + JDK-8266813: Shenandoah: Use shorter instruction sequence for
    checking if marking in progress
    + JDK-8267042: bug in monitor locking/unlocking on ARM32 C1 due
    to uninitialized BasicObjectLock::_displaced_header
    + JDK-8267348: Rewrite gc/epsilon/TestClasses.java to use
    Metaspace with less classes
    + JDK-8267396: Avoid recording "pc" in unhandled oops detector
    for better performance
    + JDK-8267399: C2: java/text/Normalizer/ConformanceTest.java
    test failed with assertion
    + JDK-8267424: CTW: C1 fails with "State must not be null"
    + JDK-8267459: Pasting Unicode characters into JShell does not
    work.
    + JDK-8267625: AARCH64: typo in LIR_Assembler::emit_profile_type
    + JDK-8267666: Add option to jcmd GC.heap_dump to use existing
    file
    + JDK-8267695: Bump update version for OpenJDK: jdk-11.0.13
    + JDK-8267751: (test) jtreg.SkippedException has no serial
    VersionUID
    + JDK-8267773: PhaseStringOpts::int_stringSize doesn't handle
    min_jint correctly
    + JDK-8268103: JNI functions incorrectly return a double after
    JDK-8265836
    + JDK-8268127: Shenandoah: Heap size may be too small for
    region to align to large page size
    + JDK-8268261: C2: assert(n != __null) failed: Bad immediate
    dominator info.
    + JDK-8268347: C2: nested locks optimization may create
    unbalanced monitor enter/exit code
    + JDK-8268360: Missing check for infinite loop during node
    placement
    + JDK-8268362: [REDO] C2 crash when compile negative
    Arrays.copyOf length after loop
    + JDK-8268366: Incorrect calculation of has_fpu_registers in C1
    linear scan
    + JDK-8268369: SIGSEGV in PhaseCFG::implicit_null_check due to
    missing null check
    + JDK-8268417: Add test from JDK-8268360
    + JDK-8268427: Improve AlgorithmConstraints:checkAlgorithm
    performance
    + JDK-8268617: [11u REDO] - WebSocket over authenticating proxy
    fails with NPE
    + JDK-8268620: InfiniteLoopException test may fail on x86
    platforms
    + JDK-8268635: Corrupt oop in ClassLoaderData
    + JDK-8268699: Shenandoah: Add test for JDK-8268127
    + JDK-8268771: javadoc -notimestamp option does not work on
    index.html
    + JDK-8268775: Password is being converted to String in
    AccessibleJPasswordField
    + JDK-8268776: Test `ADatagramSocket.java` missing /othervm
    from @run tag
    + JDK-8268965: TCP Connection Reset when connecting simple
    socket to SSL server
    + JDK-8269304: Regression ~5% in 2005 in b27
    + JDK-8269415: [11u] Remove ea from
    DEFAULT_PROMOTED_VERSION_PRE in OpenJDK 11u
    + JDK-8269478: Shenandoah: gc/shenandoah/mxbeans tests should
    be more resilient
    + JDK-8269529: javax/swing/reliability/
    /HangDuringStaticInitialization.java fails in Windows debug
    build
    + JDK-8269594: assert(_handle_mark_nesting &gt; 1) failed: memory
    leak: allocating handle outside HandleMark
    + JDK-8269614: [s390] Interpreter checks wrong bit for slow
    path instance allocation
    + JDK-8269650: Optimize gc-locker in
    [Get|Release]StringCritical for latin string
    + JDK-8269661: JNI_GetStringCritical does not lock char array
    + JDK-8269668: [aarch64] java.library.path not including
    /usr/lib64
    + JDK-8269763: The JEditorPane is blank after JDK-8265167
    + JDK-8269795: C2: Out of bounds array load floats above its
    range check in loop peeling resulting in SEGV
    + JDK-8269847: JDK-8269594 backport breaks 11u builds
    + JDK-8269850: Most JDK releases report macOS version 12 as
    10.16 instead of 12.0
    + JDK-8269851: OperatingSystemMXBean getProcessCpuLoad reports
    incorrect process cpu usage in containers
    + JDK-8269882: stack-use-after-scope in NewObjectA
    + JDK-8269934: RunThese24H.java failed with
    EXCEPTION_ACCESS_VIOLATION in
    java_lang_Thread::get_thread_status
    + JDK-8270096: Shenandoah: Optimize gc/shenandoah/
    /TestRefprocSanity.java for interpreter mode
    + JDK-8270137: Kerberos Credential Retrieval from Cache not
    Working in Cross-Realm Setup
    + JDK-8270184: [TESTBUG] Add coverage for jvmci
    ResolvedJavaType.toJavaName() for lambdas
    + JDK-8270196: [11u] [JVMCI] JavaType.toJavaName() returns
    incorrect type name for lambdas
    + JDK-8270556: Exclude security/infra/java/security/cert/
    /CertPathValidator/certification/LetsEncryptCA
    + JDK-8270893: IndexOutOfBoundsException while reading large
    TIFF file
    + JDK-8272078: Wrong Checksums in Temurin BootJDK dependencies
    + JDK-8272124: Cgroup v1 initialization causes
    NullPointerException when cgroup path contains colon
    + JDK-8272131: PhaseMacroExpand::generate_slow_arraycopy crash
    when clone null CallProjections.fallthrough_ioproj
    + JDK-8272197: Update 11u GHA workflow with Shenandoah
    configurations
    + JDK-8272332: --with-harfbuzz=system doesn't add -lharfbuzz
    after JDK-8255790
    + JDK-8272472: StackGuardPages test doesn't build with glibc
    2.34
    + JDK-8272602: [macos] not all KEY_PRESSED events sent when
    control modifier is used
    + JDK-8272628: Problemlist gc/stress/gcbasher/
    /TestGCBasherWithCMS.java for x86_32
    + JDK-8272700: [macos] Build failure with Xcode 13.0 after
    JDK-8264848
    + JDK-8272772: Shenandoah: compiler/c2/aarch64/
    /TestVolatilesShenandoah.java fails in 11u
    + JDK-8273939: Backport of 8248414 to JDK11 breaks
    MacroAssembler::adrp
- Remove the unneeded icedtea-sound provider
- Removed patches:
  * icedtea-sound-1.0.1-jdk9.patch
  * icedtea-sound-soundproperties.patch
    + not needed since the icedtea-sound provider is removed
  * jdk11-glibc234.patch
    + integrated upstream</changelog>
  <changelog author="fstrba@suse.com" date="1635940800">- Modified patches:
  * system-crypto-policy.patch
    + rediff to changed context
  * fips.patch
    + Allow plain key import in fips mode unless
    com.suse.fips.plainKeySupport is set to false</changelog>
  <changelog author="fstrba@suse.com" date="1636113600">- Modified patch:
  * fips.patch
    + return in native code after generating java.io.IOException</changelog>
</package>
<package pkgid="a185a9c356c7928a779438140a3260e5e1fb9f7cc2cbcc8a15727b3d6b405306" name="java-11-openjdk-accessibility" arch="x86_64">
  <version epoch="0" ver="11.0.13.0" rel="3.68.1"/>
  <changelog author="fstrba@suse.com" date="1586952000">- The pack200 and unpack200 alternatives should be slaves of java
  and not of javac, since they are part of JRE.</changelog>
  <changelog author="fstrba@suse.com" date="1587470400">- Update to upstream tag jdk-11.0.7+10 (April 2020 CPU,
  bsc#1169511)
  * Security fixes:
    + S8223898, CVE-2020-2754: Forward references to Nashorn
    + S8223904, CVE-2020-2755: Improve Nashorn matching
    + S8224541, CVE-2020-2756: Better mapping of serial ENUMs
    + S8224549, CVE-2020-2757: Less Blocking Array Queues
    + S8225603: Enhancement for big integers
    + S8226346: Build better binary builders
    + S8227467: Better class method invocations
    + S8227542: Manifest improved jar headers
    + S8229733: TLS message handling improvements
    + S8231415, CVE-2020-2773: Better signatures in XML
    + S8231785: Improved socket permissions
    + S8232424, CVE-2020-2778: More constrained algorithms
    + S8232581, CVE-2020-2767: Improve TLS verification
    + S8233250: Better X11 rendering
    + S8233410: Better Build Scripting
    + S8234027: Better JCEKS key support
    + S8234408, CVE-2020-2781: Improve TLS session handling
    + S8234825, CVE-2020-2800: Better Headings for HTTP Servers
    + S8234841, CVE-2020-2803: Enhance buffering of byte buffers
    + S8235274, CVE-2020-2805: Enhance typing of methods
    + S8235691, CVE-2020-2816: Enhance TLS connectivity
    + S8236201, CVE-2020-2830: Better Scanner conversions
    + S8238960: linux-i586 builds are inconsistent as the newly
    built jdk is not able to reserve enough space for object heap
  * Other changes:
    + S4919790: Errors in alert ssl message does not reflect the
    actual certificate status
    + S4949105: Access Bridge lacks html tags parsing
    + S7092821: java.security.Provider.getService() is synchronized
    and became scalability bottleneck
    + S7143743: Potential memory leak with zip provider
    + S8005819: Support cross-realm MSSFU
    + S8042383: [TEST_BUG] Test javax/swing/plaf/basic/BasicMenuUI/
    /4983388/bug4983388.java fails with shortcuts on menus do not
    work
    + S8068184: Fix for JDK-8032832 caused a deadlock
    + S8145845: [AOT] NullPointerException in
    compiler/whitebox/GetCodeHeapEntriesTest.java
    + S8152988: [AOT] Update test batch definitions to include
    aot-ed java.base module mode into hs-comp testing
    + S8160926: FLAGS_COMPILER_CHECK_ARGUMENTS doesn't handle
    cross-compilation
    + S8163083: SocketListeningConnector does not allow invocations
    with port 0
    + S8163251: Hard coded loop limit prevents reading of smart
    card data greater than 8k
    + S8167276: jvmci/compilerToVM/MaterializeVirtualObjectTest.java
    fails with -XX:-EliminateAllocations
    + S8169718: nsk/jdb/locals/locals002: ERROR: Cannot find
    boolVar with expected value: false
    + S8176556:
    java/awt/dnd/ImageTransferTest/ImageTransferTest.java fails
    for JFIF
    + S8178798: Two compiler/aot/verification/vmflags tests fail by
    timeout with UseAVX=3
    + S8183107: PKCS11 regression regarding checkKeySize
    + S8185005: Improve performance of
    ThreadMXBean.getThreadInfo(long ids[], int maxDepth)
    + S8189633: Missing -Xcheck:jni checking for DeleteWeakGlobalRef
    + S8189861: Refactor CacheFind
    + S8193042: NativeLookup::lookup_critical_entry() should only
    load shared library once
    + S8193596: java/net/DatagramPacket/ReuseBuf.java failed due to
    timeout
    + S8194944: Regression automated test 'open/test/jdk/javax/
    /swing/JInternalFrame/8145896/TestJInternalFrameMaximize.java'
    fails
    + S8196467: javax/swing/JInternalFrame/Test6325652.java fails
    + S8196969: JTreg Failure: serviceability/sa/ClhsdbJstack.java
    causes NPE
    + S8198321: javax/swing/JEditorPane/5076514/bug5076514.java
    fails
    + S8198398: Test javax/swing/JColorChooser/Test6199676.java
    fails in mach5
    + S8199072: Test javax/swing/GroupLayout/6613904/
    /bug6613904.java is unstable
    + S8200432: javadoc fails with ClassCastException on {@link
    byte[]}
    + S8201349: build broken when configured with
  - -with-zlib=bundled on gcc 7.3
    + S8201355: Avoid native memory allocation in
    sun.security.mscapi.PRNG.generateSeed
    + S8201513: nsk/jvmti/IterateThroughHeap/filter-* are broken
    + S8203364: Some serviceability/sa/ tests intermittently fail
    with java.io.IOException: LingeredApp terminated with non-zero
    exit code 3
    + S8203687: javax/net/ssl/compatibility/Compatibility.java
    supports TLS 1.3
    + S8203904: javax/swing/JSplitPane/4816114/bug4816114.java: The
    divider location is wrong
    + S8203911: Test runtime/modules/getModuleJNI/GetModule fails
    with -Xcheck:jni
    + S8204525: [TESTBUG] runtime/NMT/MallocStressTest.java ran out
    of java heap
    + S8204529: gc/TestAllocateHeapAtMultiple.java fail with Agent
    7 timed out
    + S8204551: Event descriptions are truncated in logs
    + S8206963: [AOT] bug with multiple class loaders
    + S8207367: 10 vmTestbase/nsk/jdi tests timed out when running
    with jtreg
    + S8207832: serviceability/sa/ClhsdbCDSCore.java failed with
    "Couldn't find core file location"
    + S8207938: At step6,Click Add button,case failed automatically.
    + S8208157: requires.VMProps throws NPE for missing properties
    in "release" file
    + S8208379: compiler/jvmci/events/
    /JvmciNotifyInstallEventTest.java failed with "Got unexpected
    event count after 2nd install attempt: expected 9 to equal 2"
    + S8208658: Make CDS archived heap regions usable even if
    compressed oop encoding has changed
    + S8208715: Conversion of milliseconds to nanoseconds in
    UNIXProcess contains bug
    + S8209361: [AOT] Unexpected number of references for
    JVMTI_HEAP_REFERENCE_CONSTANT_POOL [111--&gt;111]: 0 (expected
    at least 1)
    + S8209385: CDS runtime classpath checking is too strict when
    only classes from the system modules are archived
    + S8209389: SIGSEGV in WalkOopAndArchiveClosure::do_oop_work.
    + S8209418: Synchronize test/jdk/sanity/client/lib/jemmy with
    code-tools/jemmy/v2
    + S8209494: Create a test for SwingSet InternalFrameDemo
    + S8209499: Create test for SwingSet EditorPaneDemo
    + S8209574: [AOT] breakpoint events are generated in different
    threads does not meet expected count
    + S8209686: cleanup arguments to PhaseIdealLoop() constructor
    + S8209789: Synchronize test/jdk/sanity/client/lib/jemmy with
    code-tools/jemmy/v2
    + S8209802: Garbage collectors should register JFR types
    themselves to avoid build errors.
    + S8209807: improve handling exception in requires.VMProps
    + S8209817: stack is executable when building with Clang on
    Linux
    + S8209824: Improve the code coverage for ThreadLocal
    + S8209826: Undefined reference to os::write after JDK-8209657
    (filemap.hpp cleanup)
    + S8209850: Allow NamedThreads to use GlobalCounter critical
    sections
    + S8209976: Improve iteration over non-JavaThreads
    + S8209993: Create a test for SwingSet3 ToolTipDemo
    + S8210024: JFR calls virtual is_Java_thread from ~Thread()
    + S8210052: Enable testing for all the available look and feels
    in SwingSet3 demo tests
    + S8210055: Enable different look and feel tests in SwingSet3
    demo tests
    + S8210057: Enable different look and feels in SwingSet3 demo
    test InternalFrameDemoTest
    + S8210058: Algorithmic Italic font leans opposite angle in
    Printing
    + S8210220: [AOT] jdwp test cases are failing with error #
    ERROR: TEST FAILED: Cought IOException while receiving event
    packet
    + S8210289: ArchivedKlassSubGraphInfoRecord is incomplete
    + S8210459: Add support for generating compile_commands.json
    + S8210476: sun/security/mscapi/PrngSlow.java fails with Still
    too slow
    + S8210512: [Testbug] vmTestbase/nsk/jdi/ObjectReference/
    /referringObjects/referringObjects002/referringObjects002.java
    fails with unexpected size of
    ClassLoaderReference.referringObjects
    + S8210523: runtime/appcds/cacheObject/DifferentHeapSizes.java
    crash
    + S8210632: Add key exchange algorithm to
    javax/net/ssl/TLSCommon/CipherSuite.java
    + S8210699: Problem list tests which times out in Xcomp mode
    + S8210793: [JVMCI] AllocateCompileIdTest.java failed to find
    DiagnosticCommand.class
    + S8210910: Create test for FileChooserDemo
    + S8210994: Create test for SwingSet3 FrameDemo
    + S8211139: Increase timeout value in all tests under
    jdk/sanity/client/SwingSet/src
    + S8211160: Handle different look and feels in
    JInternalFrameOperator
    + S8211211: vmTestbase/metaspace/stressDictionary/
    /StressDictionary.java timeout
    + S8211322: Reduce the timeout of tooltip in SwingSet2DemoTest
    + S8211443: Enable different look and feels in SwingSet3 demo
    test SplitPaneDemoTest
    + S8211703: JInternalFrame : java.lang.AssertionError: cannot
    find the internal frame
    + S8211781: re-building fails after changing Graal sources
    + S8212897: Some improvements in the EditorPaneDemotest
    + S8212903: [TestBug] Tests test/jdk/javax/swing/LookAndFeel/
    /8145547/DemandGTK2.sh and DemandGTK3.sh fail on Ubuntu 18.04
    LTS
    + S8213009: Refactoring existing SunMSCAPI classes
    + S8213010: Supporting keys created with certmgr.exe
    + S8213168: Enable different look and feel tests in SwingSet3
    demo test FileChooserDemoTest
    + S8213348: jdk.internal.vm.compiler.management service
    providers missing in module descriptor
    + S8213906: Update arm devkits with libXrandr headers
    + S8213908: AssertionError in DeferredAttr at setOverloadKind
    + S8214124: [TESTBUG] Bugs in runtime/NMT/MallocStressTest.java
    + S8214344: C2: assert(con.basic_type() != T_ILLEGAL) failed:
    elembt=byte; loadbt=void; unsigned=0
    + S8214345: infinite recursion while checking super class
    + S8214471: Enable different look and feel tests in SwingSet3
    demo test ToolTipDemoTest
    + S8214534: Setting of THIS_FILE in the build is broken
    + S8214557: Filter out VM flags which don't affect AOT code
    generation
    + S8214578: [macos] Problem with backslashes on macOS/JIS
    keyboard: Java ignores system settings
    + S8214840: runtime/NMT/MallocStressTest.java timed out
    + S8214850: Rename vm_operations.?pp files to vmOperations.?pp
    files
    + S8214904: Test8004741.java failed due to "Too few ThreadDeath
    hits; expected at least 6 but saw only 5"
    + S8215322: add @file support to jaotc
    + S8215355: Object monitor deadlock with no threads holding the
    monitor (using jemalloc 5.1)
    + S8215396: JTabbedPane preferred size calculation is wrong for
    SCROLL_TAB_LAYOUT
    + S8216180: [AOT] compiler/intrinsics/bigInteger/TestMulAdd.java
    crashed with AOT enabled
    + S8216353: Use utility APIs introduced in org/netbeans/jemmy/
    /util/LookAndFeel class in client sanity test cases
    + S8216354: Syntax error in toolchain_windows.m4
    + S8216472: (se) Stack overflow during selection operation
    leads to crash (win)
    + S8216535: tools/jimage/JImageExtractTest.java timed out
    + S8217235: Create automated test for SwingSet
    ColorChooserDemoTest
    + S8217297: Add support for multiple look and feel for SwingSet
    SliderDemoTest
    + S8217338: [Containers] Improve systemd slice memory limit
    support
    + S8217613: [AOT] TEST_OPTS_AOT_MODULES doesn't work on mac
    + S8217634: RunTest documentation and usability update
    + S8217717: ZGC: Broken oop map in C1 load barrier stub
    + S8217728: Speed up incremental rerun of "make hotspot"
    + S8218268: Javac treats Manifest Class-Path entries as Paths
    instead of URLs
    + S8218662: Allow 204 responses with Content-Length:0
    + S8218882: NET_Writev is declared, NET_WriteV is defined
    + S8218889: Improperly use of the Optional API
    + S8219205: JFR file without license header
    + S8219597: (bf) Heap buffer state changes could provoke
    unexpected exceptions
    + S8219723: javax/net/ssl/compatibility/Compatibility.java
    failed on some SNI cases
    + S8220348: [ntintel] asserts about copying unaligned array
    + S8220451: jdi/EventQueue/remove/remove004 failed due to
    "ERROR: thread2 is not alive"
    + S8220456: jdi/EventQueue/remove_l/remove_l004 failed due to
    "TIMEOUT while waiting for event"
    + S8220479: java/nio/channels/Selector/SelectWithConsumer.java
    failed at testTwoChannels()
    + S8220613: java/util/Arrays/TimSortStackSize2.java times out
    with fastdebug build
    + S8220688: [TESTBUG] runtime/NMT/MallocStressTest.java timed
    out
    + S8220786: Create new switch to redirect error reporting
    output to stdout or stderr
    + S8221270: Duplicated synchronized keywords in SSLSocketImpl
    + S8221312: test/jdk/sanity/client/SwingSet/src/
    /ColorChooserDemoTest.java failed
    + S8221851: Use of THIS_FILE in hotspot invalidates precompiled
    header on Linux/GCC
    + S8221885: Add intermittent test in the JavaSound to the
    ProblemList
    + S8222264: Windows incremental build is broken with JDK-8217728
    + S8222391: javax/net/ssl/compatibility/Compatibility.java
    should be more flexible
    + S8222448: java/lang/reflect/PublicMethods/
    /PublicMethodsTest.java times out
    + S8222519: ButtonDemoScreenshotTest fails randomly with "still
    state to be reached"
    + S8222741: jdi/EventQueue/remove/remove004 fails due to
    VMDisconnectedException
    + S8223003: SunMSCAPI keys are not cleaned up
    + S8223063: Support CNG RSA keys
    + S8223158: Docked MacBook cannot start any Java Swing
    applications
    + S8223260: NamingManager should cache InitialContextFactory
    + S8223464: Improve version string for Oracle CI builds
    + S8223558: Java does not render Myanmar script correctly
    + S8223627: jdk-13+20 bundle name contains null instead of ea
    + S8223638: Replace wildcard address with loopback or local
    host in tests - part 6
    + S8223678: Add Visual Studio Code workspace generation support
    (for native code)
    + S8223727: com/sun/jndi/ldap/privconn/RunTest.java failed due
    to hang in LdapRequest.getReplyBer
    + S8223769: Assert triggers with -XX:+StressReflectiveCode
    + S8224187: Refactor arraycopy_prologue to allow ZGC read
    barriers on arraycopy
    + S8224475: JTextPane does not show images in HTML rendering
    + S8224673: Adjust permission for delayed starting of debugging
    + S8224705: Tests that need to be problem-listed or have
    printer resources
    + S8224778: test/jdk/demo/jfc/J2Ddemo/J2DdemoTest.java cannot
    find J2Ddemo.jar
    + S8224821: java/awt/Focus/NoAutotransferToDisabledCompTest/
    /NoAutotransferToDisabledCompTest.java fails linux-x64
    + S8224830: test/jdk/java/awt/Focus/
    /ModalExcludedWindowClickTest/
    /ModalExcludedWindowClickTest.java fails on linux-x64
    + S8224851: AArch64: fix warnings and errors with Clang and GCC
    8.3
    + S8224905: java/lang/ProcessBuilder/Basic.java#id1 failed with
    stream closed
    + S8225007: java/awt/print/PrinterJob/
    /LandscapeStackOverflow.java may hang
    + S8225105: java/awt/Focus/ShowFrameCheckForegroundTest/
    /ShowFrameCheckForegroundTest.java fails in Windows 10
    + S8225117: java/math/BigInteger/SymmetricRangeTests.java fails
    with ParseException
    + S8225128: Add exception for expiring DocuSign root to
    VerifyCACerts test
    + S8225130: Add exception for expiring Comodo roots to
    VerifyCACerts test
    + S8225144: [macos] In Aqua L&amp;F backspace key does not delete
    when Shift is pressed
    + S8225180: SignedObject with invalid Key not throwing the
    InvalidKeyException in Windows
    + S8225182: JNI exception pending in DestroyXIMCallback of
    awt_InputMethod.c:1327
    + S8225199: [Graal] compiler/jvmci/compilerToVM/
    /IsMatureVsReprofileTest.java fails with
  - XX:CompileThresholdScaling=0.1
    + S8225305: ProblemList java/lang/invoke/VarHandles tests
    + S8225350: compiler/jvmci/compilerToVM/IsCompilableTest.java
    timed out
    + S8225430: Replace wildcard address with loopback or local
    host in tests - part 14
    + S8225435: Upgrade IANA Language Subtag Registry to the latest
    for JDK14
    + S8225487: giflib legal file is missing attribution for
    openbsd-reallocarray.c
    + S8225567: Wrong file headers with 8202414 fix changeset
    + S8225684: [AOT] vmTestbase/vm/oom/production/
    /AlwaysOOMProduction tests fail with AOTed java.base
    + S8225766: Curve in certificate should not affect signature
    scheme when using TLSv1.3
    + S8225797: OldObjectSample event creates unexpected amount of
    checkpoint data
    + S8226381: ProblemList java/lang/reflect/PublicMethods/
    /PublicMethodsTest.java
    + S8226406: JVM fails to detect mismatched or corrupt CDS
    archive
    + S8226608: Hide the onjcmd option from the help output
    + S8226892: ActionListeners on JRadioButtons don't get notified
    when selection is changed with arrow keys
    + S8227112: exclude compiler/intrinsics/sha/sanity tests from
    AOT runs
    + S8227324: Upgrade to freetype 2.10.1
    + S8227528: TestAbortVMOnSafepointTimeout.java failed due to
    "RuntimeException: 'Safepoint sync time longer than' missing
    from stdout/stderr"
    + S8227645: Some tests in serviceability/sa run with fixed -Xmx
    values and risk running out of memory
    + S8227646: [TESTBUG] appcds/SharedArchiveConsistency timed out
    + S8227662: freetype seeks to index at the end of the font data
    + S8228479: Correct the format of ColorChooserDemoTest
    + S8228613: java.security.Provider#getServices order is no
    longer deterministic
    + S8228969: 2019-09-28 public suffix list update
    + S8229236: CriticalJNINatives: dll handling should be done in
    native thread state
    + S8229345: Memory leak due to vtable stubs not being shared on
    SPARC
    + S8229888: (zipfs) Updating an existing zip file does not
    preserve original permissions
    + S8229994: assert(false) failed: Bad graph detected in
    get_early_ctrl_for_expensive
    + S8230004: jdk/internal/jimage/JImageOpenTest.java runs no test
    + S8230235: Rendering HTML with empty img attribute and
    documentBaseKey cause Exception
    + S8230390: Problemlist SA tests with AOT
    + S8230400: Missing constant pool entry for a method in
    stacktrace
    + S8230459: Test failed to resume JVMCI CompilerThread
    + S8230480: check malloc/calloc results in java.desktop
    + S8230597: Update GIFlib library to the 5.2.1
    + S8230611: infinite loop in
    LogOutputList::wait_until_no_readers()
    + S8230624: [TESTBUG] Problemlist JFR
    compiler/TestCodeSweeper.java
    + S8230677: Should disable Escape Analysis if JVMTI capability
    can_get_owned_monitor_info was taken
    + S8230926: [macosx] Two apostrophes are entered instead of one
    with "U.S. International - PC" layout
    + S8231025: Incorrect method tag offset for big endian platform
    + S8231081: TestMetadataRetention fails due to missing symbol id
    + S8231387: java.security.Provider.getService returns random
    result due to race condition with mutating methods in the same
    class
    + S8231430: C2: Memory stomp in max_array_length() for
    T_ILLEGAL type
    + S8231445: check ZALLOC return values in awt coding
    + S8231507: Update Apache Santuario (XML Signature) to version
    2.1.4
    + S8231584: Deadlock with ClassLoader.findLibrary and
    System.loadLibrary call
    + S8231753: use more Posix functionality in aix
    os::print_os_info
    + S8231810: javax/net/ssl/templates/
    /SSLSocketSSLEngineTemplate.java fails intermittently with
    "java.lang.Exception: Unexpected EOF"
    + S8232003: (fs) Files.write can leak file descriptor in the
    exception case
    + S8232056: GetOwnedMonitorInfoWithEATest.java fails with ZGC:
    Heap too small
    + S8232060: add some initializations using sigemptyset in
    os_aix.cpp
    + S8232154: Update Mesa 3-D Headers to version 19.2.1
    + S8232167: Visual Studio install found through
  - -with-tools-dir value is discarded
    + S8232170: FSInfo#getJarClassPath throws an exception not
    declared in its throws clause
    + S8232200: [macos 10.15] Windows in fullscreen tests jumps
    around the screen
    + S8232207: Linux os::available_memory re-reads cgroup
    configuration on every invocation
    + S8232224: [TESTBUG] problemlist JFR TestLargeRootSet.java
    + S8232370: Refactor some com.sun.jdi tests to enable IDE
    integration
    + S8232433: [macos 10.15] java/awt/Window/
    /LocationAtScreenCorner/LocationAtScreenCorner.java may fail
    + S8232571: Add missing SIGINFO signal
    + S8232692: [TESTBUG] compiler/aot/fingerprint/
    /SelfChangedCDS.java fails when cds is disabled
    + S8232713: Update BCEL version to 6.3.1 in license file
    + S8232806: Introduce a system property to disable eager lambda
    initialization
    + S8232834: RunTest sometimes fails to produce valid
    exitcode.txt
    + S8232880: Update test documentation with additional settings
    for client UI tooltip tests
    + S8232950: SUNPKCS11 Provider incorrectly check key length for
    PSS Signatures.
    + S8233018: Add a new test to verify that DatagramSocket is not
    interruptible
    + S8233019: java.lang.Class.isPrimitive() (C1) returns wrong
    result if Klass* is aligned to 32bit
    + S8233032: assert(in_bb(n)) failed: must be
    + S8233078: fix minimal VM build on Linux ppc64(le)
    + S8233328: fix minimal VM build on Linux s390x
    + S8233383: Various minor fixes
    + S8233466: aarch64: remove unnecessary load of mdo when
    profiling return and parameters type
    + S8233491: Crash in AdapterHandlerLibrary::get_adapter with
    CDS due to code cache exhaustion
    + S8233529: loopTransform.cpp:2984: Error: assert(p_f-&gt;Opcode()
    == Op_IfFalse) failed
    + S8233548: Update CUP to v0.11b
    + S8233649: Update ProblemList.txt to exclude failing headful
    tests on macos
    + S8233656: assert(d-&gt;is_CFG() &amp;&amp; n-&gt;is_CFG()) failed: must
    have CFG nodes
    + S8233657: Intermittent NPE in Component.validate()
    + S8234288: Turkey Time Zone returns incorrect time zone name
    + S8234323: NULL-check return value of SurfaceData_InitOps on
    macosx
    + S8234339: replace JLI_StrTok in java_md_solinux.c
    + S8234340: Bump update version for OpenJDK: jdk-11.0.7
    + S8234350: assert(mode == ControlAroundStripMined &amp;&amp; (use ==
    sfpt || !use-&gt;is_reachable_from_root())) failed: missed a node
    + S8234386: [macos] NPE was thrown at expanding Choice from
    maximized frame
    + S8234397: add OS uptime information to os::print_os_info
    output
    + S8234423: Modifying ArrayList.subList().subList() resets
    modCount of subList
    + S8234466: Class loading deadlock involving
    X509Factory#commitEvent()
    + S8234501: remove obsolete NET_ReadV
    + S8234525: enable link-time section-gc for linux s390x to
    remove unused code
    + S8234610: MaxVectorSize set wrongly when UseAVX=3 is
    specified after JDK-8221092
    + S8234617: C1: Incorrect result of field load due to missing
    narrowing conversion
    + S8234723: javax/net/ssl/TLS tests support TLSv1.3
    + S8234724: javax/net/ssl/templates/
    /SSLSocketSSLEngineTemplate.java supports TLSv1.3
    + S8234741: enhance os::get_core_path on macOS
    + S8234769: Duplicate attribution in freetype.md
    + S8234786: Fix for JDK-8214578 breaks OS X 10.12 compatibility
    + S8234809: set relro in linker flags when building with gcc
    + S8234824: java/nio/channels/SocketChannel/AdaptSocket.java
    fails on Windows 10
    + S8235243: handle VS2017 15.9 and VS2019 in abstract_vm_version
    + S8235288: AVX 512 instructions inadvertently used on Xeon for
    small vector width operations
    + S8235325: build failure on Linux after 8235243
    + S8235383: C1 compilation fails with
  - XX:+PrintIRDuringConstruction -XX:+Verbose
    + S8235489: handle return values of sscanf calls in hotspot
    + S8235509: Backport for JDK-8209657 Refactor filemap.hpp to
    simplify integration with Serviceability Agent.
    + S8235510: java.util.zip.CRC32 performance drop after 8200067
    + S8235563: [TESTBUG] appcds/CommandLineFlagComboNegative.java
    does not handle archive mapping failure
    + S8235637: jhsdb jmap from OpenJDK 11.0.5 doesn't work if
    prelink is enabled
    + S8235671: enhance print_rlimit_info in os_posix
    + S8235744: PIT: test/jdk/javax/swing/text/html/
    /TestJLabelWithHTMLText.java times out in linux-x64
    + S8235904: Infinite loop when rendering huge lines
    + S8235998: [c2] Memory leaks during tracing after '8224193:
    stringStream should not use Resource Area'.
    + S8236039: JSSE Client does not accept status_request
    extension in CertificateRequest messages for TLS 1.3
    + S8236140: assert(!VerifyHashTableKeys || _hash_lock == 0)
    failed: remove node from hash table before modifying it
    + S8236179: C1 register allocation error with T_ADDRESS
    + S8236488: Support for configure option
  - -with-native-debug-symbols=internal is impossible on Windows
    + S8236500: Windows ucrt.dll should be looked up in versioned
    WINSDK subdirectory
    + S8236709: struct SwitchRange in HS violates C++ One
    Definition Rule
    + S8236848: [JDK 11u] make run-test-tier1 fails after backport
    of JDK-8232834
    + S8236873: Worker has a deadlock bug
    + S8237217: Incorrect G1StringDedupEntry type used in
    StringDedupTable destructor
    + S8237368: Problem with NullPointerException in RMI
    TCPEndpoint.read
    + S8237375: SimpleThresholdPolicy misses CounterDecay timestamp
    initialization
    + S8237508: Simplify JarFile.isInitializing
    + S8237540: Missing files in backport of JDK-8210910
    + S8237541: Missing files in backport of JDK-8236528
    + S8237600: Test SunJSSEFIPSInit fails on Ubuntu
    + S8237819: s390x - remove unused pd_zero_to_words_large
    + S8237869: exclude jtreg test security/infra/java/security/
    /cert/CertPathValidator/certification/LuxTrustCA.java because
    of instabilities
    + S8237879: make 4.3 breaks build
    + S8237945: CTW: C2 compilation fails with
    assert(just_allocated_object(alloc_ctl) == ptr) failed: most
    recent allo...
    + S8238225: Issues reported after replacing symlink at
    Contents/MacOS/libjli.dylib with binary
    + S8238247: CTW runner should sweep nmethods more aggressively
    + S8238366: CTW runner closes standard output on exit
    + S8238438: SuperWord::co_locate_pack picks memory state of
    first instead of last load
    + S8238502: sunmscapi.dll causing EXCEPTION_ACCESS_VIOLATION
    + S8238534: Deep sign macOS bundles before bundle archive is
    being created
    + S8238591: CTW: Split
    applications/ctw/modules/jdk_localedata.java
    + S8238596: AVX enabled by default for Skylake even when
    unsupported
    + S8238811: C2: assert(i &gt;= req() || i == 0 || is_Region() ||
    is_Phi()) with -XX:+VerifyGraphEdges
    + S8239005: [TESTBUG] test/hotspot/jtreg/runtime/
    /StackGuardPages/TestStackGuardPages.java: exeinvoke.c: must
    initialize static state before calling do_overflow()
    + S8239466: Loss of precision in counter decay calculation in
    11u backport of JDK-8237375
    + S8239856: [ntintel] asserts about copying unaligned array
    element
    + S8240724: [test] jdk11 downport of 8224475 misses binary file
    test/jdk/javax/swing/JTextPane/arrow.png
    + S8241296: Segfault in JNIHandleBlock::oops_do()
- Removed patch:
  * DependOnVariableHelper.patch
    + fixed upstream
- Added patch:
  * JDK-8228407.patch
    + fix crashes due to shared archive file mismatch</changelog>
  <changelog author="fstrba@suse.com" date="1594900800">- Update to upstream tag jdk-11.0.8+10 (July 2020 CPU, bsc#1174157)
  * Security fixes:
    + JDK-8230613: Better ASCII conversions
    + JDK-8231800: Better listing of arrays
    + JDK-8232014: Expand DTD support
    + JDK-8233234: Better Zip Naming
    + JDK-8233239, CVE-2020-14562: Enhance TIFF support
    + JDK-8233255: Better Swing Buttons
    + JDK-8234032: Improve basic calendar services
    + JDK-8234042: Better factory production of certificates
    + JDK-8234418: Better parsing with CertificateFactory
    + JDK-8234836: Improve serialization handling
    + JDK-8236191: Enhance OID processing
    + JDK-8236867, CVE-2020-14573: Enhance Graal interface handling
    + JDK-8237117, CVE-2020-14556: Better ForkJoinPool behavior
    + JDK-8237592, CVE-2020-14577: Enhance certificate verification
    + JDK-8238002, CVE-2020-14581: Better matrix operations
    + JDK-8238013: Enhance String writing
    + JDK-8238804: Enhance key handling process
    + JDK-8238842: AIOOBE in GIFImageReader.initializeStringTable
    + JDK-8238843: Enhanced font handing
    + JDK-8238920, CVE-2020-14583: Better Buffer support
    + JDK-8238925: Enhance WAV file playback
    + JDK-8240119, CVE-2020-14593: Less Affine Transformations
    + JDK-8240482: Improved WAV file playback
    + JDK-8241379: Update JCEKS support
    + JDK-8241522: Manifest improved jar headers redux
    + JDK-8242136, CVE-2020-14621: Better XML namespace handling
  * Other changes:
    + JDK-6933331: (d3d/ogl) java.lang.IllegalStateException:
    Buffers have not been created
    + JDK-7124307: JSpinner and changing value by mouse
    + JDK-8022574: remove HaltNode code after uncommon trap calls
    + JDK-8039082: [TEST_BUG] Test
    java/awt/dnd/BadSerializationTest/BadSerializationTest.java
    fails
    + JDK-8040630: Popup menus and tooltips flicker with previous
    popup contents when first shown
    + JDK-8044365: (dc) MulticastSendReceiveTests.java failing with
    ENOMEM when joining group (OS X 10.9)
    + JDK-8048215: [TESTBUG]
    java/lang/management/ManagementFactory/ThreadMXBeanProxy.java
    Expected non-null LockInfo
    + JDK-8051349: nsk/jvmti/scenarios/sampling/SP06/sp06t003 fails
    in nightly
    + JDK-8080353: JShell: Better error message on attempting to
    add default method
    + JDK-8139876: Exclude hanging nsk/stress/stack from execution
    with deoptimization enabled
    + JDK-8146090: java/lang/ref/ReachabilityFenceTest.java fails
    with -XX:+DeoptimizeALot
    + JDK-8153430: jdk regression test MletParserLocaleTest,
    ParserInfiniteLoopTest reduce default timeout
    + JDK-8156207: Resource allocated BitMaps are often cleared
    unnecessarily
    + JDK-8159740: JShell: corralled declarations do not have
    correct source to wrapper mapping
    + JDK-8175984: ICC_Profile has un-needed, not-empty finalize
    method
    + JDK-8176359: Frame#setMaximizedbounds not working properly in
    multi screen environments
    + JDK-8183369: RFC unconformity of HttpURLConnection with proxy
    + JDK-8187078: -XX:+VerifyOops finds numerous problems when
    running JPRT
    + JDK-8189861: Refactor CacheFind
    + JDK-8191169: java/net/Authenticator/B4769350.java failed
    intermittently
    + JDK-8191930: [Graal] emits unparseable XML into compile log
    + JDK-8193879: Java debugger hangs on method invocation
    + JDK-8196019: java/awt/Window/Grab/GrabTest.java fails on
    Windows
    + JDK-8196181: sun/java2d/GdiRendering/InsetClipping.java fails
    + JDK-8198000:
    java/awt/List/EmptyListEventTest/EmptyListEventTest.java
    debug assert on Windows
    + JDK-8198001: java/awt/Menu/WrongParentAfterRemoveMenu/
    /WrongParentAfterRemoveMenu.java debug assert on Windows
    + JDK-8198339: Test javax/swing/border/Test6981576.java is
    unstable
    + JDK-8200701: jdk/jshell/ExceptionsTest.java fails on Windows,
    after JDK-8198801
    + JDK-8203264: JNI exception pending in
    PlainDatagramSocketImpl.c:740
    + JDK-8203672: JNI exception pending in PlainSocketImpl.c
    + JDK-8203673: JNI exception pending in
    DualStackPlainDatagramSocketImpl.c:398
    + JDK-8204834: Fix confusing "allocate" naming in OopStorage
    + JDK-8205399: Set node color on pinned HashMap.TreeNode
    deletion
    + JDK-8205653: test/jdk/sun/management/jmxremote/bootstrap/
    /RmiRegistrySslTest.java and RmiSslBootstrapTest.sh fail with
    handshake_failure
    + JDK-8206179: com/sun/management/OperatingSystemMXBean/
    /GetCommittedVirtualMemorySize.java fails with Committed
    virtual memory size illegal value
    + JDK-8207334: VM times out in VM_HandshakeAllThreads::doit()
    with RunThese30M
    + JDK-8208277: Code cache heap (-XX:ReservedCodeCacheSize)
    doesn't work with 1GB LargePages
    + JDK-8209113: Use WeakReference for lastFontStrike for created
    Fonts
    + JDK-8209333: Socket reset issue for TLS 1.3 socket close
    + JDK-8209439: C2 library_call can potentially ignore Math.pow
    intrinsic or use null pointer
    + JDK-8209534: [TESTBUG]runtime/appcds/cacheObject/
    /ArchivedModuleCompareTest.java fails with EnableJVMCI.
    + JDK-8210147: adjust some WSAGetLastError usages in windows
    network coding
    + JDK-8210284: "assert((av &amp; 0x00000001) == 0) failed:
    unsupported V8" on Solaris 11.4
    + JDK-8210303: VM_HandshakeAllThreads fails assert with
    "failed: blocked and not walkable"
    + JDK-8210459: Add support for generating compile_commands.json
    + JDK-8210515: [TESTBUG]CheckArchivedModuleApp.java needs to
    check if EnableJVMCI is set.
    + JDK-8210788: Javadoc for Thread.join(long, int) should
    specify that it waits forever when both arguments are zero
    + JDK-8211301: [macos] support full window content options
    + JDK-8211332: Space for stub routines (code_size2) is too
    small on new Skylake CPUs
    + JDK-8211339: NPE during SSL handshake caused by
    HostnameChecker
    + JDK-8211392: compiler/profiling/
    /spectrapredefineclass_classloaders/Launcher.java times out
    in JDK12 CI
    + JDK-8211743: [AOT] crash in ScopeDesc::decode_body() when
    JVMTI walks AOT frames
    + JDK-8212154: [TESTBUG] CheckArchivedModuleApp fails with NPE
    when JVMCI is absent
    + JDK-8212167: JShell : Stack trace of exception has wrong line
    number
    + JDK-8212933: Thread-SMR: requesting a VM operation whilst
    holding a ThreadsListHandle can cause deadlocks
    + JDK-8212986: Make Visual Studio compiler check less strict
    + JDK-8213250: CDS archive creation aborts due to metaspace
    object allocation failure
    + JDK-8213516: jck test api/javax_accessibility/AccessibleState/
    /fields.html fails intermittent
    + JDK-8213947: ARM32: failed check_simd should set
    UsePopCountInstruction to false
    + JDK-8214418: half-closed SSLEngine status may cause
    application dead loop
    + JDK-8214440: ldap over a TLS connection negotiate failed with
    "javax.net.ssl.SSLPeerUnverifiedException: hostname of the
    server does not match the hostname in the server's
    certificate"
    + JDK-8214444: Wrong strncat limits in dfa.cpp
    + JDK-8214481: freetype path does not disable TrueType hinting
    with AA+FM hints
    + JDK-8214571: -Xdoclint of array serialField gives "error:
    array type not allowed here"
    + JDK-8214856: Errors with JSZip in web console after upgrade
    to 3.1.5
    + JDK-8214862: assert(proj != __null) at compile.cpp:3251
    + JDK-8215369: Jcstress pollute /var/tmp with temporary files.
    + JDK-8215551: Missing case label in nmethod::reloc_string_for()
    + JDK-8215555: TieredCompilation C2 threads can excessively
    block handshakes
    + JDK-8215711: Missing key_share extension for (EC)DHE key
    exchange should alert missing_extension
    + JDK-8216151: [Graal] Module
    jdk.internal.vm.compiler.management has not been granted
    accessClassInPackage.org.graalvm.compiler.debug
    + JDK-8216154: C4819 warnings at HotSpot sources on Windows
    + JDK-8216541: CompiledICHolders of VM locked unloaded nmethods
    are released too late
    + JDK-8217230: assert(t == t_no_spec) failure in
    NodeHash::check_no_speculative_types()
    + JDK-8217404: --with-jvm-features doesn't work when multiple
    features are explicitly disabled
    + JDK-8217447: Develop flag TraceICs is broken
    + JDK-8217606: LdapContext#reconnect always opens a new
    connection
    + JDK-8218807: Compilation database (compile_commands.json) may
    contain obsolete items
    + JDK-8219214: Infinite Loop in CodeSection::dump()
    + JDK-8219904: ClassCastException when calling
    FlightRecorderMXBean#getRecordings()
    + JDK-8219991: New fix of the deadlock in
    sun.security.ssl.SSLSocketImpl
    + JDK-8221121: applications/microbenchmarks are encountering
    crashes in tier5
    + JDK-8221445: FastSysexMessage constructor crashes MIDI
    receiption thread
    + JDK-8221482: Initialize VMRegImpl::regName[] earlier to
    prevent assert during PrintStubCode
    + JDK-8221741: ClassCastException can happen when
    fontconfig.properties is used
    + JDK-8221823: Requested JDialog width is ignored
    + JDK-8223108: Test java/awt/EventQueue/
    /NonComponentSourcePost.java is unstable
    + JDK-8223678: Add Visual Studio Code workspace generation
    support (for native code)
    + JDK-8223935: PIT: java/awt/font/WindowsIndicFonts.java fails
    on windows10
    + JDK-8224109: Text spaced incorrectly by drawString under
    rotation with fractional metric
    + JDK-8224632: testbug: java/awt/dnd/RemoveDropTargetCrashTest/
    /RemoveDropTargetCrashTest.java fails on MacOS
    + JDK-8224793: os::die() does not honor CreateCoredumpOnCrash
    option
    + JDK-8224847: gc/stress/TestReclaimStringsLeaksMemory.java
    fails with reserved greater than expected
    + JDK-8224931: disable JAOTC invokedynamic support until
    8223533 is fixed
    + JDK-8224997: ChaCha20-Poly1305 TLS cipher suite decryption
    throws ShortBufferException
    + JDK-8225068: Remove DocuSign root certificate that is
    expiring in May 2020
    + JDK-8225069: Remove Comodo root certificate that is expiring
    in May 2020
    + JDK-8225126: Test SetBoundsPaintTest.html faild on Windows
    when desktop is scaled
    + JDK-8225325: Add tests for redefining a class' private method
    during resolution of the bootstrap specifier
    + JDK-8225622: [AOT] runtime/SharedArchiveFile/
    /TestInterpreterMethodEntries.java crashed with AOTed
    java.base
    + JDK-8225653: Provide more information when hitting SIGILL
    from HaltNode
    + JDK-8225783: Incorrect use of binary operators on booleans in
    type.cpp
    + JDK-8225789: Empty method parameter type should generate
    ClassFormatError
    + JDK-8226198: use of &amp; instead of &amp;&amp; in
    LibraryCallKit::arraycopy_restore_alloc_state
    + JDK-8226253: JAWS reports wrong number of radio buttons when
    buttons are hidden.
    + JDK-8226653: [accessibility] Can edit text cell correctly,
    but Accessibility Tool reads nothing about editor
    + JDK-8226806: [macOS 10.14] Methods of Java Robot should be
    called from appropriate thread
    + JDK-8226879: Memory leak in Type::hashcons
    + JDK-8227632: Incorrect PrintCompilation message: made not
    compilable on levels 0 1 2 3 4
    + JDK-8228407: JVM crashes with shared archive file mismatch
    + JDK-8228482: fix xlc16/xlclang comparison of distinct pointer
    types and string literal conversion warnings
    + JDK-8228757: Fail fast if the handshake type is unknown
    + JDK-8229158: make UseSwitchProfiling non-experimental or
    false by-default
    + JDK-8229421: The logic of java/net/ipv6tests/TcpTest.java is
    flawed
    + JDK-8229855: C2 fails with assert(false) failed: bad AD file
    + JDK-8230591: AArch64: Missing intrinsics for Math.ceil,
    floor, rint
    + JDK-8231118: ARM32: Math tests failures
    + JDK-8231213: Migrate SimpleDateFormatConstTest to JDK Repo
    + JDK-8231243: [TESTBUG] CustomFont.java cannot find font file
    + JDK-8231438: [macOS] Dark mode for the desktop is not
    supported
    + JDK-8231550: C2: ShouldNotReachHere() in
    verify_strip_mined_scheduling
    + JDK-8231564: setMaximizedBounds is broken with large display
    scale and multiple monitors
    + JDK-8231572: Use -lobjc instead of -fobjc-link-runtime in
    libosxsecurity
    + JDK-8231631: sun/net/ftp/FtpURLConnectionLeak.java fails
    intermittently with NPE
    + JDK-8231671: Fix copyright headers in hotspot (missing comma
    after year)
    + JDK-8231720: Some perf regressions after 8225653
    + JDK-8231779: crash
    HeapWord*ParallelScavengeHeap::failed_mem_allocate
    + JDK-8231863: Crash if classpath is read from @argument file
    and the main gets option argument
    + JDK-8232080: jlink plugins for vendor information and
    run-time options
    + JDK-8232106: [x86] C2: SIGILL due to usage of SSSE3
    instructions on processors which don't support it
    + JDK-8232134: Change to Visual Studio 2017 15.9.16 for
    building on Windows at Oracle
    + JDK-8232226: [macos 10.15] test/jdk/java/awt/color/
    /EqualityTest/EqualityTest.java may fail
    + JDK-8232357: Compare version info of Santuario to legal notice
    + JDK-8232572: Add hooks for custom output dir in Bundles.gmk
    + JDK-8232634: Problem List ICMColorDataTest.java
    + JDK-8232748: Build static versions of certain JDK libraries
    + JDK-8232846: ProcessHandle.Info command with non-English
    shows question marks
    + JDK-8232880: Update test documentation with additional
    settings for client UI tooltip tests
    + JDK-8233033: C2 produces wrong result while unswitching a
    loop due to lost control dependencies
    + JDK-8233137: runtime/ErrorHandling/VeryEarlyAssertTest.java
    fails after 8232080
    + JDK-8233197: Invert JvmtiExport::post_vm_initialized() and
    Jfr:on_vm_start() start-up order for correct option parsing
    + JDK-8233291: [TESTBUG] tools/jlink/plugins/
    /VendorInfoPluginsTest.java fails with debug or non-server VMs
    + JDK-8233364: Fix undefined behavior in
    Canonicalizer::do_ShiftOp
    + JDK-8233494: Avoid calling MallocTracker::record_malloc and
    record_free when NMT is off
    + JDK-8233573: Toolkit.getScreenInsets(GraphicsConfiguration)
    may throw ClassCastException
    + JDK-8233608: Minimal build broken after JDK-8233494
    + JDK-8233621: Mismatch in jsse.enableMFLNExtension property
    name
    + JDK-8233696: [TESTBUG]Some jtreg tests fail when CAPS_LOCK is
    ON
    + JDK-8233707: systemScale.cpp could not compile with VS2019
    + JDK-8233801: GCMEmptyIv.java test fails on Solaris 11.4
    + JDK-8233880: Support compilers with multi-digit major version
    numbers
    + JDK-8233920: MethodHandles::tryFinally generates illegal
    bytecode for long/double return type
    + JDK-8234137: The "AutoTestOnTop.java" test may run external
    applications
    + JDK-8234146: compiler/jsr292/
    /ContinuousCallSiteTargetChange.java times out on SPARC
    + JDK-8234184: [TESTBUG] java/awt/Mouse/EnterExitEvents/
    /ModalDialogEnterExitEventsTest.java fails in Windows
    + JDK-8234270: [REDO] JDK-8204128 NMT might report incorrect
    numbers for Compiler area
    + JDK-8234332: [TESTBUG] java/awt/Focus/DisposedWindow/
    /DisposeDialogNotActivateOwnerTest/
    /DisposeDialogNotActivateOwnerTest.java fails on linux-x64
    nightly
    + JDK-8234398: Replace ID2D1Factory::GetDesktopDpi with
    GetDeviceCaps
    + JDK-8234522: [macos] Crash with use of native file dialog
    + JDK-8234691: Potential double-free in ParallelSPCleanupTask
    constructor
    + JDK-8234696: tools/jlink/plugins/VendorInfoPluginsTest.java
    times out
    + JDK-8234727: sun/security/ssl/X509TrustManagerImpl tests
    support TLSv1.3
    + JDK-8234728: Some security tests should support TLSv1.3
    + JDK-8234779: Provide idiom for declaring classes noncopyable
    + JDK-8234824: java/nio/channels/SocketChannel/AdaptSocket.java
    fails on Windows 10
    + JDK-8234968: check calloc rv in libinstrument
    InvocationAdapter
    + JDK-8235153: [TESTBUG] [macos 10.15] java/awt/Graphics/
    /DrawImageBG/SystemBgColorTest.java fails
    + JDK-8235183: Remove the "HACK CODE" in comment
    + JDK-8235263: Revert TLS 1.3 change that wrapped IOExceptions
    + JDK-8235311: Tag mismatch may alert bad_record_mac
    + JDK-8235332: TestInstanceCloneAsLoadsStores.java fails with
  - XX:+StressGCM
    + JDK-8235452: Strip mined loop verification fails with
    assert(is_OuterStripMinedLoop()) failed: invalid node class
    + JDK-8235584: UseProfiledLoopPredicate fails with
    assert(_phase-&gt;get_loop(c) == loop) failed: have to be in the
    same loop
    + JDK-8235620: Broken merge between JDK-8006406 and JDK-8003559
    + JDK-8235638: NPE in LWWindowPeer.getOnscreenGraphics()
    + JDK-8235686: Add more custom hooks in Bundles.gmk
    + JDK-8235739: Rare NPE at WComponentPeer.getGraphics()
    + JDK-8235762: JVM crash in SWPointer during C2 compilation
    + JDK-8235834: IBM-943 charset encoder needs updating
    + JDK-8235874: The ordering of Cipher Suites is not maintained
    provided through jdk.tls.client.cipherSuites and
    jdk.tls.server.cipherSuites system property.
    + JDK-8235908: omit ThreadPriorityPolicy warning when value is
    set from image
    + JDK-8235984: C2: assert(out-&gt;in(PhiNode::Region) == head ||
    out-&gt;in(PhiNode::Region) == slow_head) failed: phi must be
    either part of the slow or the fast loop
    + JDK-8236211: [Graal] compiler/graalunit/GraphTest.java is
    skipped in all testing
    + JDK-8236470: Deal with ECDSA using ecdsa-with-SHA2 plus hash
    algorithm as AlgorithmId
    + JDK-8236545: Compilation error in mach5
    java/awt/FileDialog/MacOSGoToFolderCrash.java
    + JDK-8236700: Upgrading JSZip from v3.1.5 to v3.2.2
    + JDK-8236759: ShouldNotReachHere in
    PhaseIdealLoop::verify_strip_mined_scheduling
    + JDK-8236897: Fix the copyright header for pkcs11gcm2.h
    + JDK-8236921: Add build target to produce a JDK image suitable
    for a Graal/SVM build
    + JDK-8236953: [macos] JavaFX SwingNode is not rendered on macOS
    + JDK-8236996: Incorrect Roboto font rendering on Windows with
    subpixel antialiasing
    + JDK-8237045: JVM uses excessive memory with -XX:+EnableJVMCI
  - XX:JVMCICounterSize=2147483648
    + JDK-8237055: [TESTBUG] compiler/c2/TestJumpTable.java fails
    with release VMs
    + JDK-8237086: assert(is_MachReturn()) running CTW with fix for
    JDK-8231291
    + JDK-8237192: Generate stripped/public pdbs on Windows for jdk
    images
    + JDK-8237396: JvmtiTagMap::weak_oops_do() should not trigger
    barriers
    + JDK-8237474: Default SSLEngine should create in server role
    + JDK-8237859: C2: Crash when loads float above range check
    + JDK-8237879: make 4.3 breaks build
    + JDK-8237951: CTW: C2 compilation fails with "malformed
    control flow"
    + JDK-8237962: give better error output for invalid OCSP
    response intervals in CertPathValidator checks
    + JDK-8238190: [JVMCI] Fix single implementor speculation for
    diamond shapes.
    + JDK-8238356: CodeHeap::blob_count() overestimates the number
    of blobs
    + JDK-8238452: Keytool generates wrong expiration date if
    validity is set to 2050/01/01
    + JDK-8238555: Allow Initialization of SunPKCS11 with NSS when
    there are external FIPS modules in the NSSDB
    + JDK-8238575: DragSourceEvent.getLocation() returns wrong
    value on HiDPI screens (Windows)
    + JDK-8238676: jni crashes on accessing it from process exit
    hook
    + JDK-8238721: Add failing client jtreg tests to the Problem
    List
    + JDK-8238738: AudioSystem.getMixerInfo() takes about 30 sec to
    report a gone audio device
    + JDK-8238756: C2: assert(((n) == __null || !VerifyIterativeGVN
    || !((n)-&gt;is_dead()))) failed: can not use dead node
    + JDK-8238765: PhaseCFG::schedule_pinned_nodes cannot handle
    precedence edges from unmatched CFG nodes correctly
    + JDK-8238898: Missing hash characters for header on license
    file
    + JDK-8238942: Rendering artifacts with LCD text and fractional
    metrics
    + JDK-8238985: [TESTBUG] The arrow image is blue instead of
    green
    + JDK-8239000: handle ContendedPaddingWidth in vm_version_ppc
    + JDK-8239055: Wrong implementation of VMState.hasListener
    + JDK-8239091: Reversed arguments in call to strstr in freetype
    "debug" code.
    + JDK-8239142: C2's UseUniqueSubclasses optimization is broken
    for array accesses
    + JDK-8239224: libproc_impl.c previous_thr may be used
    uninitialized warning
    + JDK-8239351: Give more meaningful InternalError messages in
    Deflater.c
    + JDK-8239365: ProcessBuilder test modifications for AIX
    execution
    + JDK-8239456: vtable stub generation: assert failure (code
    size estimate)
    + JDK-8239457: call ReleaseStringUTFChars before early returns
    in Java_sun_security_pkcs11_wrapper_PKCS11_connect
    + JDK-8239462: jdk.hotspot.agent misses some
    ReleaseStringUTFChars calls in case of early returns
    + JDK-8239557: [TESTBUG] VeryEarlyAssertTest.java validating
    "END." marker at lastline is not always true
    + JDK-8239787: AArch64: String.indexOf may incorrectly handle
    empty strings
    + JDK-8239792: Bump update version for OpenJDK: jdk-11.0.8
    + JDK-8239798: SSLSocket closes socket both socket endpoints on
    a SocketTimeoutException
    + JDK-8239819: XToolkit: Misread of screen information memory
    + JDK-8239852: java/util/concurrent tests fail with
  - XX:+VerifyGraphEdges: assert(!VerifyGraphEdges) failed:
    verification should have failed
    + JDK-8239893: Windows handle Leak when starting processes
    using ProcessBuilder
    + JDK-8239915: Zero VM crashes when handling dynamic constant
    + JDK-8239931: [win][x86] vtable stub generation: assert
    failure (code size estimate) follow-up
    + JDK-8239965: XMLEncoder/Test4625418.java fails due to "Error:
    Cp943 - can't read properly"
    + JDK-8239976: Put JDK-8239965 on the ProblemList.txt
    + JDK-8240073: Fix 'test-make' build target in 11u
    + JDK-8240197: Cannot start JVM when $JAVA_HOME includes CJK
    characters
    + JDK-8240202: A few client tests leave mouse buttons pressed
    + JDK-8240220: IdealLoopTree::dump_head predicate printing is
    broken
    + JDK-8240223: Use consistent predicate order in and with
    PhaseIdealLoop::find_predicate
    + JDK-8240227: Loop predicates should be copied to unswitched
    loops
    + JDK-8240286: [TESTBUG] Test command error in hotspot/jtreg/
    /compiler/loopopts/superword/SumRedAbsNeg_Float.java
    + JDK-8240518: Incorrect JNU_ReleaseStringPlatformChars in
    Windows Print
    + JDK-8240529: CheckUnhandledOops breaks NULL check in
    Modules::define_module
    + JDK-8240576: JVM crashes after transformation in C2
    IdealLoopTree::merge_many_backedges
    + JDK-8240603: Windows 32bit compile error after 8238676
    + JDK-8240629: argfiles parsing broken for argfiles with
    comment cross 4096 bytes chunk
    + JDK-8240711: TestJstatdPort.java failed due to
    "ExportException: Port already in use:"
    + JDK-8240786: [TESTBUG] The test java/awt/Window/
    /GetScreenLocation/GetScreenLocationTest.java fails on HiDPI
    screen
    + JDK-8240824: enhance print_full_memory_info on Linux by THP
    related information
    + JDK-8240827: Downport SSLSocketImpl.java from "8221882: Use
    fiber-friendly java.util.concurrent.locks in JSSE"
    + JDK-8240905: assert(mem == (Node*)1 || mem == mem2) failed:
    multiple Memories being matched at once?
    + JDK-8240972: macOS codesign fail on macOS 10.13.5 or older
    + JDK-8241445: Fix copyright in
    test/jdk/tools/launcher/ArgFileSyntax.java
    + JDK-8241458: [JVMCI] add mark value to expose
    CodeOffsets::Frame_Complete
    + JDK-8241464: [11u] Backport: make rehashing be a needed
    guaranteed safepoint cleanup action
    + JDK-8241556: Memory leak if -XX:CompileCommand is set
    + JDK-8241568: (fs) UserPrincipalLookupService.lookupXXX
    failure with IOE "Operation not permitted"
    + JDK-8241586: compiler/cpuflags/
    /TestAESIntrinsicsOnUnsupportedConfig.java fails on aarch64
    + JDK-8241638: launcher time metrics always report 1 on Linux
    when _JAVA_LAUNCHER_DEBUG set
    + JDK-8241660: Add virtualization information output to hs_err
    file on macOS
    + JDK-8241808: [TESTBUG] The JDK-8039467 bug appeared on macOS
    + JDK-8241888: Mirror jdk.security.allowNonCaAnchor system
    property with a security one
    + JDK-8241900: Loop unswitching may cause dependence on null
    check to be lost
    + JDK-8241948: enhance list of environment variables printed in
    hs_err file
    + JDK-8241996: on linux set full relro in the linker flags
    + JDK-8242108: Performance regression after fix for JDK-8229496
    + JDK-8242141: New System Properties to configure the TLS
    signature schemes
    + JDK-8242154: Backport parts of JDK-4947890 to OpenJDK 11u
    + JDK-8242174: [macos] The NestedModelessDialogTest test make
    the macOS unstable
    + JDK-8242239: [Graal] javax/management/generified/
    /GenericTest.java fails: FAILED: queryMBeans sets same
    + JDK-8242294: JSSE Client does not throw SSLException when an
    alert occurs during handshaking
    + JDK-8242379: [TESTBUG] compiler/loopopts/
    /TestLoopUnswitchingLostCastDependency.java fails with
    release VMs
    + JDK-8242470: Update Xerces to Version 2.12.1
    + JDK-8242498: Invalid "sun.awt.TimedWindowEvent" object leads
    to JVM crash
    + JDK-8242541: Small charset issues (ISO8859-16, x-eucJP-Open,
    x-IBM834 and x-IBM949C)
    + JDK-8242626: enhance posix print_rlimit_info
    + JDK-8243059: Build fails when --with-vendor-name contains a
    comma
    + JDK-8243539: Copyright info (Year) should be updated for fix
    of 8241638
    + JDK-8243541: (tz) Upgrade time-zone data to tzdata2020a
    + JDK-8244407: JVM crashes after transformation in C2
    IdealLoopTree::split_fall_in
    + JDK-8244520: problemlist
    java/awt/font/Rotate/RotatedFontTest.java on linux
    + JDK-8244777: ClassLoaderStats VM Op uses constant hash value
    + JDK-8244853: The static build of libextnet is missing the
    JNI_OnLoad_extnet function
    + JDK-8244951: Missing entitlements for hardened runtime
    + JDK-8245047: [PPC64] C2: ReverseBytes + Load always match to
    unordered Load (acquire semantics missing)
    + JDK-8245649: Revert 8245397 backport of 8230591
    + JDK-8246031: SSLSocket.getSession() doesn't close connection
    for timeout/ interrupts
    + JDK-8246613: Choose the default SecureRandom algo based on
    registration ordering
    + JDK-8248505: Unexpected NoSuchAlgorithmException when using
    secure random impl from BCFIPS provider
- Removed patch:
  * JDK-8228407.patch
    + integrated upstream</changelog>
  <changelog author="fstrba@suse.com" date="1604318400">- Update to upstream tag jdk-11.0.9-11 (October 2020 CPU,
  bsc#1177943)
  * New features
    + JDK-8250784: Shenandoah: A Low-Pause-Time Garbage Collector
  * Security fixes
    + JDK-8233624: Enhance JNI linkage
    + JDK-8236196: Improve string pooling
    + JDK-8236862, CVE-2020-14779: Enhance support of Proxy class
    + JDK-8237990, CVE-2020-14781: Enhanced LDAP contexts
    + JDK-8237995, CVE-2020-14782: Enhance certificate processing
    + JDK-8240124: Better VM Interning
    + JDK-8241114, CVE-2020-14792: Better range handling
    + JDK-8242680, CVE-2020-14796: Improved URI Support
    + JDK-8242685, CVE-2020-14797: Better Path Validation
    + JDK-8242695, CVE-2020-14798: Enhanced buffer support
    + JDK-8243302: Advanced class supports
    + JDK-8244136, CVE-2020-14803: Improved Buffer supports
    + JDK-8244479: Further constrain certificates
    + JDK-8244955: Additional Fix for JDK-8240124
    + JDK-8245407: Enhance zoning of times
    + JDK-8245412: Better class definitions
    + JDK-8245417: Improve certificate chain handling
    + JDK-8248574: Improve jpeg processing
    + JDK-8249927: Specify limits of jdk.serialProxyInterfaceLimit
    + JDK-8253019: Enhanced JPEG decoding
  * Other changes
    + JDK-6532025: GIF reader throws misleading exception with
    truncated images
    + JDK-6949753: [TEST BUG]: java/awt/print/PageFormat/
    /PDialogTest.java needs update by removing an infinite loop
    + JDK-8022535: [TEST BUG] javax/swing/text/html/parser/
    /Test8017492.java fails
    + JDK-8062947: Fix exception message to correctly represent
    LDAP connection failure
    + JDK-8067354: com/sun/jdi/GetLocalVariables4Test.sh failed
    + JDK-8134599: TEST_BUG: java/rmi/transport/closeServerSocket/
    /CloseServerSocket.java fails intermittently with Address
    already in use
    + JDK-8151678: com/sun/jndi/ldap/LdapTimeoutTest.java failed
    due to timeout on DeadServerNoTimeoutTest is incorrect
    + JDK-8160768: Add capability to custom resolve host/domain
    names within the default JNDI LDAP provider
    + JDK-8172404: Tools should warn if weak algorithms are used
    before restricting them
    + JDK-8193367: Annotated type variable bounds crash javac
    + JDK-8202117: com/sun/jndi/ldap/RemoveNamingListenerTest.java
    fails intermittently: Connection reset
    + JDK-8203026: java.rmi.NoSuchObjectException: no such object
    in table
    + JDK-8203281: [Windows] JComboBox change in ui when
    editor.setBorder() is called
    + JDK-8203382: Rename SystemDictionary::initialize_wk_klass to
    resolve_wk_klass
    + JDK-8203393: com/sun/jdi/JdbMethodExitTest.sh and
    JdbExprTest.sh fail due to timeout
    + JDK-8203928: [Test] Convert non-JDB scaffolding
    serviceability shell script tests to java
    + JDK-8204963: javax.swing.border.TitledBorder has a memory leak
    + JDK-8204994: SA might fail to attach to process with "Windbg
    Error: WaitForEvent failed"
    + JDK-8205534: Remove SymbolTable dependency from
    serviceability agent
    + JDK-8206309: Tier1 SA tests fail
    + JDK-8208281: java/nio/channels/
    /AsynchronousSocketChannel/Basic.java timed out
    + JDK-8209109: [TEST] rewrite com/sun/jdi shell tests to java
    version - step1
    + JDK-8209332: [TEST] test/jdk/com/sun/jdi/CatchPatternTest.sh
    is incorrect
    + JDK-8209342: Problemlist SA tests on Solaris due to Error
    attaching to process: Can't create thread_db agent!
    + JDK-8209343: Test javax/swing/border/TestTitledBorderLeak.java
    should be marked as headful
    + JDK-8209517: com/sun/jdi/BreakpointWithFullGC.java fails with
    timeout
    + JDK-8209604: [TEST] rewrite com/sun/jdi shell tests to java
    version - step2
    + JDK-8209605: com/sun/jdi/BreakpointWithFullGC.java fails with
    ZGC
    + JDK-8209608: Problem list com/sun/jdi/BreakpointWithFullGC.java
    + JDK-8210131: vmTestbase/nsk/jvmti/scenarios/allocation/AP10/
    /ap10t001/TestDescription.java failed with ObjectFree:
    GetCurrentThreadCpuTimerInfo returned unexpected error code
    + JDK-8210243: [TEST] rewrite com/sun/jdi shell tests to java
    version - step3
    + JDK-8210527: JShell: NullPointerException in
    jdk.jshell.Eval.translateExceptionStack
    + JDK-8210560: [TEST] convert com/sun/jdi redefineClass-related
    tests
    + JDK-8210725: com/sun/jdi/RedefineClearBreakpoint.java fails
    with waitForPrompt timed out after 60 seconds
    + JDK-8210748: [TESTBUG] lib.jdb.Jdb.waitForPrompt() should
    clarify which output is the pending reply after a timeout
    + JDK-8210760: [TEST] rewrite com/sun/jdi shell tests to java
    version - step4
    + JDK-8210977: jdk/jfr/event/oldobject/TestThreadLocalLeak.java
    fails to find ThreadLocalObject
    + JDK-8211292: [TEST] convert com/sun/jdi/DeferredStepTest.sh
    test
    + JDK-8211694: JShell: Redeclared variable should be reset
    + JDK-8212200: assert when shared java.lang.Object is redefined
    by JVMTI agent
    + JDK-8212629: [TEST] wrong breakpoint in
    test/jdk/com/sun/jdi/DeferredStepTest
    + JDK-8212665: com/sun/jdi/DeferredStepTest.java: jj1 (line 57)
  - unexpected. lastLine=52, minLine=52, maxLine=55
    + JDK-8212807: tools/jar/multiRelease/Basic.java times out
    + JDK-8213182: Minimal VM build failure after JDK-8212200
    (assert when shared java.lang.Object is redefined by JVMTI
    agent)
    + JDK-8213214: Set -Djava.io.tmpdir= when running tests
    + JDK-8213275: ReplaceCriticalClasses.java fails with
    jdk.internal.vm.PostVMInitHook not found
    + JDK-8213574: Deadlock in string table expansion when dumping
    lots of CDS classes
    + JDK-8213703: LambdaConversionException: Invalid receiver type
    not a subtype of implementation type interface
    + JDK-8214074: Ghash optimization using AVX instructions
    + JDK-8214491: Upgrade to JLine 3.9.0
    + JDK-8214797: TestJmapCoreMetaspace.java timed out
    + JDK-8215243: JShell tests failing intermitently with
    "Problem cleaning up the following threads:"
    + JDK-8215244: jdk/jshell/ToolBasicTest.java
    testHistoryReference failed
    + JDK-8215354: x86_32 build failures after JDK-8214074 (Ghash
    optimization using AVX instructions)
    + JDK-8215438: jshell tool: Ctrl-D causes EOF
    + JDK-8216021: RunTest.gmk might set concurrency level to 1 on
    Windows
    + JDK-8216974: HttpConnection not returned to the pool after
    204 response
    + JDK-8218948: SimpleDateFormat :: format - Zone Names are not
    reflected correctly during run time
    + JDK-8219712: code_size2 (defined in stub_routines_x86.hpp) is
    too small on new Skylake CPUs
    + JDK-8220150: macos10.14 Mojave returns anti-aliased glyphs
    instead of aliased B&amp;W glyphs
    + JDK-8221658: aarch64: add necessary predicate for ubfx
    patterns
    + JDK-8221759: Crash when completing "java.io.File.path"
    + JDK-8221918: runtime/SharedArchiveFile/serviceability/
    /ReplaceCriticalClasses.java fails: Shared archive not found
    + JDK-8222074: Enhance auto vectorization for x86
    + JDK-8222079: Don't use memset to initialize fields decode_env
    constructor in disassembler.cpp
    + JDK-8222769: [TESTBUG] TestJFRNetworkEvents should not rely
    on hostname command
    + JDK-8223688: JShell: crash on the instantiation of raw
    anonymous class
    + JDK-8223777: In posix_spawn mode, failing to exec()
    jspawnhelper does not result in an error
    + JDK-8223940: Private key not supported by chosen signature
    algorithm
    + JDK-8224184: jshell got IOException at exiting with AIX
    + JDK-8224234: compiler/codegen/TestCharVect2.java fails in
    test_mulc
    + JDK-8225037: java.net.JarURLConnection::getJarEntry() throws
    NullPointerException
    + JDK-8225625: AES Electronic Codebook (ECB) encryption and
    decryption optimization using AVX512 + VAES instructions
    + JDK-8226536: Catch OOM from deopt that fails rematerializing
    objects
    + JDK-8226575: OperatingSystemMXBean should be made container
    aware
    + JDK-8226697: Several tests which need the @key headful
    keyword are missing it.
    + JDK-8226809: Circular reference in printed stack trace is not
    correctly indented &amp; ambiguous
    + JDK-8227059: sun/security/tools/keytool/
    /DefaultSignatureAlgorithm.java timed out
    + JDK-8227269: Slow class loading when running with JDWP
    + JDK-8227595: keytool/fakegen/DefaultSignatureAlgorithm.java
    fails due to "exitValue = 6"
    + JDK-8228448: Jconsole can't connect to itself
    + JDK-8228967: Trust/Key store and SSL context utilities for
    tests
    + JDK-8229378: jdwp library loader in linker_md.c quietly
    truncates on buffer overflow
    + JDK-8229815: Upgrade Jline to 3.12.1
    + JDK-8230000: some httpclients testng tests run zero test
    + JDK-8230002: javax/xml/jaxp/unittest/transform/
    /SecureProcessingTest.java runs zero test
    + JDK-8230010: Remove jdk8037819/BasicTest1.java
    + JDK-8230094: CCE in createXMLEventWriter(Result) over an
    arbitrary XMLStreamWriter
    + JDK-8230402: Allocation of compile task fails with assert:
    "Leaking compilation tasks?"
    + JDK-8230767: FlightRecorderListener returns null recording
    + JDK-8230870: (zipfs) Add a ZIP FS test that is similar to
    test/jdk/java/util/zip/EntryCount64k.java
    + JDK-8231209: [REDO] ThreadMXBean::getThreadAllocatedBytes()
    can be quicker for self thread
    + JDK-8231586: enlarge encoding space for OopMapValue offsets
    + JDK-8231953: Wrong assumption in assertion in
    oop::register_oop
    + JDK-8231968: getCurrentThreadAllocatedBytes default
    implementation s/b getThreadAllocatedBytes
    + JDK-8232083: Minimal VM is broken after JDK-8231586
    + JDK-8232161: Align some one-way conversion in MS950 charset
    with Windows
    + JDK-8232855: jshell missing word in /help help
    + JDK-8233027: OopMapSet::all_do does oms.next() twice during
    iteration
    + JDK-8233228: Disable weak named curves by default in TLS,
    CertPath, and Signed JAR
    + JDK-8233386: Initialize NULL fields for unused decorations
    + JDK-8233452: java.math.BigDecimal.sqrt() with
    RoundingMode.FLOOR results in incorrect result
    + JDK-8233686: XML transformer uses excessive amount of memory
    + JDK-8233741: AES Countermode (AES-CTR) optimization using
    AVX512 + VAES instructions
    + JDK-8233829: javac cannot find non-ASCII module name under
    non-UTF8 environment
    + JDK-8233958: Memory retention due to HttpsURLConnection
    finalizer that serves no purpose
    + JDK-8234011: (zipfs) Memory leak in
    ZipFileSystem.releaseDeflater()
    + JDK-8234058: runtime/CompressedOops/
    /CompressedClassPointers.java fails with 'Narrow klass base:
    0x0000000000000000' missing from stdout/stderr
    + JDK-8234149: Several regression tests do not dispose Frame at
    end
    + JDK-8234347: "Turkey" meta time zone does not generate
    composed localized names
    + JDK-8234385: [TESTBUG] java/awt/EventQueue/6980209/
    /bug6980209.java fails in linux nightly
    + JDK-8234535: Cross compilation fails due to missing CFLAGS
    for the BUILD_CC
    + JDK-8234541: C1 emits an empty message when it inlines
    successfully
    + JDK-8234687: change javap reporting on unknown attributes
    + JDK-8236464: SO_LINGER option is ignored by SSLSocket in JDK
    11
    + JDK-8236548: Localized time zone name inconsistency between
    English and other locales
    + JDK-8236617: jtreg test containers/docker/
    /TestMemoryAwareness.java fails after 8226575
    + JDK-8237182: Update copyright header for shenandoah and
    epsilon files
    + JDK-8237888: security/infra/java/security/cert/
    /CertPathValidator/certification/LuxTrustCA.java fails when
    checking validity interval
    + JDK-8237977: Further update
    javax/net/ssl/compatibility/Compatibility.java
    + JDK-8238270: java.net HTTP/2 client does not decrease stream
    count when receives 204 response
    + JDK-8238284: [macos] Zero VM build fails due to an obvious
    typo
    + JDK-8238380: java.base/unix/native/libjava/childproc.c
    "multiple definition" link errors with GCC10
    + JDK-8238386: (sctp) jdk.sctp/unix/native/libsctp/SctpNet.c
    "multiple definition" link errors with GCC10
    + JDK-8238388: libj2gss/NativeFunc.o "multiple definition" link
    errors with GCC10
    + JDK-8238448: RSASSA-PSS signature verification fail when
    using certain odd key sizes
    + JDK-8238710: LingeredApp doesn't log stdout/stderr if exits
    with non-zero code
    + JDK-8239083: C1 assert(known_holder == NULL ||
    (known_holder-&gt;is_instance_klass() &amp;&amp;
    (!known_holder-&gt;is_interface() ||
    ((ciInstanceKlass*)known_holder)-&gt;has_nonstatic_concrete_methods())),
    "should be non-static concrete method");
    + JDK-8239385: KerberosTicket client name refers wrongly to
    sAMAccountName in AD
    + JDK-8240169: javadoc fails to link to non-modular api docs
    + JDK-8240295: hs_err elapsed time in seconds is not accurate
    enough
    + JDK-8240360: NativeLibraryEvent has wrong library name on
    Linux
    + JDK-8240676: Meet not symmetric failure when running lucene
    on jdk8
    + JDK-8241007: Shenandoah: remove
    ShenandoahCriticalControlThreadPriority support
    + JDK-8241065: Shenandoah: remove leftover code after
    JDK-8231086
    + JDK-8241086: Test runtime/NMT/HugeArenaTracking.java is
    failing on 32bit Windows
    + JDK-8241130: com.sun.jndi.ldap.EventSupport.removeDeadNotifier:
    java.lang.NullPointerException
    + JDK-8241138: http.nonProxyHosts=* causes
    StringIndexOutOfBoundsException in DefaultProxySelector
    + JDK-8241319: WB_GetCodeBlob doesn't have ResourceMark
    + JDK-8241478: vmTestbase/gc/gctests/Steal/steal001/steal001.java
    fails with OOME
    + JDK-8241574: Shenandoah: remove ShenandoahAssertToSpaceClosure
    + JDK-8241750: x86_32 build failure after JDK-8227269
    + JDK-8242184: CRL generation error with RSASSA-PSS
    + JDK-8242283: Can't start JVM when java home path includes
    non-ASCII character
    + JDK-8242556: Cannot load RSASSA-PSS public key with non-null
    params from byte array
    + JDK-8243029: Rewrite javax/net/ssl/compatibility/
    /Compatibility.java with a flexible interop test framework
    + JDK-8243138: Enhance BaseLdapServer to support starttls
    extended request
    + JDK-8243320: Add SSL root certificates to Oracle Root CA
    program
    + JDK-8243321: Add Entrust root CA - G4 to Oracle Root CA
    program
    + JDK-8243389: enhance os::pd_print_cpu_info on linux
    + JDK-8243453: java --describe-module failed with non-ASCII
    module name under non-UTF8 environment
    + JDK-8243470: [macos] bring back O2 opt level for unsafe.cpp
    + JDK-8243489: Thread CPU Load event may contain wrong data for
    CPU time under certain conditions
    + JDK-8243925: Toolkit#getScreenInsets() returns wrong value on
    HiDPI screens (Windows)
    + JDK-8244087: 2020-04-24 public suffix list update
    + JDK-8244151: Update MUSCLE PC/SC-Lite headers to the latest
    release 1.8.26
    + JDK-8244164: AArch64: jaotc generates incorrect code for
    compressed OOPs with non-zero heap base
    + JDK-8244196: adjust output in os_linux
    + JDK-8244225: stringop-overflow warning on strncpy call from
    compile_the_world_in
    + JDK-8244287: JFR: Methods samples have line number 0
    + JDK-8244703: "platform encoding not initialized" exceptions
    with debugger, JNI
    + JDK-8244719: CTW: C2 compilation fails with
    "assert(!VerifyHashTableKeys || _hash_lock == 0) failed:
    remove node from hash table before modifying it"
    + JDK-8244729: Shenandoah: remove resolve paths from
    SBSA::generate_shenandoah_lrb
    + JDK-8244763: Update --release 8 symbol information after JSR
    337 MR3
    + JDK-8244818: Java2D Queue Flusher crash while moving
    application window to external monitor
    + JDK-8245151: jarsigner should not raise duplicate warnings on
    verification
    + JDK-8245616: Bump update version for OpenJDK: jdk-11.0.9
    + JDK-8245714: "Bad graph detected in build_loop_late" when
    loads are pinned on loop limit check uncommon branch
    + JDK-8245801: StressRecompilation triggers assert "redundunt
    OSR recompilation detected. memory leak in CodeCache!"
    + JDK-8245832: JDK build make-static-libs should build all JDK
    libraries
    + JDK-8245880: Shenandoah: check class unloading flag early in
    concurrent code root scan
    + JDK-8245981: Upgrade to jQuery 3.5.1
    + JDK-8246027: Minimal fastdebug build broken after JDK-8245801
    + JDK-8246094: [macos] Sound Recording and playback is not
    working
    + JDK-8246153: TestEliminateArrayCopy fails with
  - XX:+StressReflectiveCode
    + JDK-8246193: Possible NPE in ENC-PA-REP search in AS-REQ
    + JDK-8246196: javax/management/MBeanServer/OldMBeanServerTest
    fails with AssertionError
    + JDK-8246203: Segmentation fault in verification due to stack
    overflow with -XX:+VerifyIterativeGVN
    + JDK-8246330: Add TLS Tests for Legacy ECDSA curves
    + JDK-8246453: TestClone crashes with "all collected exceptions
    must come from the same place"
    + JDK-8247246: Add explicit ResolvedJavaType.link and expose
    presence of default methods
    + JDK-8247350: [aarch64] assert(false) failed: wrong size of
    mach node
    + JDK-8247502: PhaseStringOpts crashes while optimising
    effectively dead code
    + JDK-8247615: Initialize the bytes left for the heap sampler
    + JDK-8247824: CTW: C2 (Shenandoah) compilation fails with SEGV
    in SBC2Support::pin_and_expand
    + JDK-8247874: Replacement in VersionProps.java.template not
    working when --with-vendor-bug-url contains '&amp;'
    + JDK-8247979: aarch64: missing side effect of killing flags
    for clearArray_reg_reg
    + JDK-8248214: Add paddings for TaskQueueSuper to reduce
    false-sharing cache contention
    + JDK-8248219: aarch64: missing memory barrier in
    fast_storefield and fast_accessfield
    + JDK-8248348: Regression caused by the update to BCEL 6.0
    + JDK-8248385: [testbug][11u] Adapt TestInitiExceptions to
    jtreg 5.1
    + JDK-8248495: [macos] zerovm is broken due to libffi headers
    location
    + JDK-8248851: CMS: Missing memory fences between free chunk
    check and klass read
    + JDK-8248987: AOT's Linker.java seems to eagerly fail-fast on
    Windows
    + JDK-8249159: Downport test rework for SSLSocketTemplate from
    8224650
    + JDK-8249215: JFrame::setVisible crashed with
  - Dfile.encoding=UTF-8 on Japanese Windows.
    + JDK-8249251: [dark_mode ubuntu 20.04] The selected menu is
    not highlighted in GTKLookAndFeel
    + JDK-8249255: Build fails if source code in cygwin home dir
    + JDK-8249277: TestVerifyIterativeGVN.java is failing with
    timeout in OpenJDK 11
    + JDK-8249278: Revert JDK-8226253 which breaks the spec of
    AccessibleState.SHOWING for JList
    + JDK-8249560: Shenandoah: Fix racy GC request handling
    + JDK-8249801: Shenandoah: Clear soft-refs on requested GC cycle
    + JDK-8249953: Shenandoah: gc/shenandoah/mxbeans tests should
    account for corner cases
    + JDK-8250582: Revert Principal Name type to NT-UNKNOWN when
    requesting TGS Kerberos tickets
    + JDK-8250609: C2 crash in IfNode::fold_compares
    + JDK-8250627: Use -XX:+/-UseContainerSupport for
    enabling/disabling Java container metrics
    + JDK-8250755: Better cleanup for
    jdk/test/javax/imageio/plugins/shared/CanWriteSequence.java
    + JDK-8250787: Provider.put no longer registering aliases in
    FIPS env
    + JDK-8250826: jhsdb does not work with coredump which comes
    from Substrate VM
    + JDK-8250827: Shenandoah: needs to reset/finish StringTable's
    dead count before/after parallel walk
    + JDK-8250844: Make sure {type,obj}ArrayOopDesc accessors check
    the bounds
    + JDK-8251117: Cannot check P11Key size in P11Cipher and
    P11AEADCipher
    + JDK-8251354: Shenandoah: Fix jdk/jfr/tool/TestPrintJSON.java
    test failure
    + JDK-8251451: Shenandoah: Remark ObjectSynchronizer roots with
    I-U
    + JDK-8251469: Better cleanup for
    test/jdk/javax/imageio/SetOutput.java
    + JDK-8251487: Shenandoah: missing detail timing tracking for
    final mark cleaning phase
    + JDK-8252120: compiler/oracle/TestCompileCommand.java
    misspells "occured"
    + JDK-8252157: JDK-8231209 11u backport breaks jmm binary
    compatibility
    + JDK-8252258: [11u] JDK-8242154 changes the default vendor
    + JDK-8252804: [test] Fix 'ReleaseDeflater.java' test after
    downport of 8234011
    + JDK-8253134: JMM_VERSION should remain at 0x20020000 (JDK 10)
    in JDK 11
    + JDK-8253283: [11u] Test build/translations/
    /VerifyTranslations.java failing after JDK-8252258
    + JDK-8253813: Backout JDK-8244287 from 11u: it causes several
    crashes
- Removed patch:
  * gcc-fno-common-fix.patch
    + not needed any more with this version
- Added patch:
  * JDK-8250861.patch
    + Fix regression "8250861: Crash in MinINode::Ideal(PhaseGVN*,
    bool)" introduced in jdk 11.0.9</changelog>
  <changelog author="fstrba@suse.com" date="1604491200">- Enable Sheandoah GC for x86_64 (jsc#ECO-3171)</changelog>
  <changelog author="fstrba@suse.com" date="1605528000">- Update to upstream tag jdk-11.0.9.1-1
  * Fix:
    + JDK-8250861: Crash in MinINode::Ideal(PhaseGVN*, bool)
- Removed patch:
  * JDK-8250861.patch
    + Integrated upstream</changelog>
  <changelog author="fstrba@suse.com" date="1611230400">- Update to upstream tag jdk-11.0.10+9 (January 2021 CPU,
  bsc#1181239)
  * Security fixes
    + JDK-8247619: Improve Direct Buffering of Characters
  * Other changes
    + JDK-6722928: Support SSPI as a native GSS-API provider
    + JDK-7185258: [macosx] Deadlock in SunToolKit.realSync()
    + JDK-8152332: [macosx] JFileChooser cannot be serialized on
    Mac OS X
    + JDK-8161684: [testconf] Add VerifyOops' testing into compiler
    tiers
    + JDK-8171279: Support X25519 and X448 in TLS
    + JDK-8173361: various crashes in
    JvmtiExport::post_compiled_method_load
    + JDK-8173658: JvmtiExport::post_class_unload() is broken for
    non-JavaThread initiators
    + JDK-8191006: hsdis disassembler plugin does not compile with
    binutils 2.29+
    + JDK-8197981: Missing return statement in
    __sync_val_compare_and_swap_8
    + JDK-8198334: java/awt/FileDialog/8003399/bug8003399.java
    fails in headless mode
    + JDK-8200151: Add 8 JNDI tests to com/sun/jndi/dns/ConfigTests/
    + JDK-8208279: Add 8 JNDI tests to com/sun/jndi/dns/EnvTests/
    + JDK-8208483: Add 5 JNDI tests to
    com/sun/jndi/dns/FactoryTests/
    + JDK-8208542: Add 4 JNDI tests to com/sun/jndi/dns/ListTests/
    + JDK-8208665: Amend cross-compilation docs with
    qemu-debootstrap recipe
    + JDK-8210088: ProblemList gc/epsilon/TestMemoryMXBeans.java
    + JDK-8210339: Add 10 JNDI tests to com/sun/jndi/dns/FedTests/
    + JDK-8211450: UndetVar::dup is not copying the kind field to
    the duplicated instance
    + JDK-8212160: JVMTI agent crashes with "assert(_value != 0LL)
    failed: resolving NULL _value"
    + JDK-8212226: SurfaceManager throws "Invalid Image variant"
    for MultiResolutionImage (Windows)
    + JDK-8213400: Support choosing group name in keytool keypair
    generation
    + JDK-8213535: Windows HiDPI html lightweight tooltips are
    truncated
    + JDK-8213698: Improve devkit creation and add support for
    linux/ppc64/ppc64le/s390x
    + JDK-8214025: assert(t-&gt;singleton()) failed: must be a
    constant when ScavengeRootsInCode &lt; 2
    + JDK-8214242: compiler/arguments/TestScavengeRootsInCode.java
    fails because of missing UnlockDiagnosticVMOptions
    + JDK-8214787: Zero builds fail with "undefined
    JavaThread::thread_state()"
    + JDK-8215583: Exclude
    runtime/handshake/HandshakeWalkSuspendExitTest.java
    + JDK-8216012: Infinite loop in RSA KeyPairGenerator
    + JDK-8216324: GetClassMethods is confused by the presence of
    default methods in super interfaces
    + JDK-8217429: WebSocket over authenticating proxy fails to
    send Upgrade headers
    + JDK-8217976: test/jdk/java/net/httpclient/websocket/
    /WebSocketProxyTest.java fails intermittently
    + JDK-8218021: Have jarsigner preserve posix permission
    attributes
    + JDK-8218287: jshell tool: input behavior unstable after
    12-ea+24 on Windows
    + JDK-8218851: JVM crash in custom classloader stress test, JDK
    12 &amp; 13
    + JDK-8220420: Cleanup c1_LinearScan
    + JDK-8222072: JVMTI GenerateEvents() sends CompiledMethodLoad
    events to wrong jvmtiEnv
    + JDK-8222286: Fix for JDK-8213419 is broken on s390
    + JDK-8222527: HttpClient doesn't send HOST header when
    tunelling HTTP/1.1 through http proxy
    + JDK-8222533: jtreg test jdk/internal/platform/cgroup/
    /TestCgroupMetrics.java fails on SLES12.3 linux ppc64le
    machine
    + JDK-8224506: [TESTBUG] TestDockerMemoryMetrics.java fails
    with exitValue = 137
    + JDK-8224555: vmTestbase/nsk/jvmti/scenarios/contention/TC02/
    /tc02t001/TestDescription.java failed
    + JDK-8224650: Add tests to support X25519 and X448 in TLS
    + JDK-8225072: Add LuxTrust certificate that is expiring in
    March 2021 to list of allowed but expired certs
    + JDK-8225329: -XX:+PrintBiasedLockingStatistics causes crash
    during initialization on Windows platforms
    + JDK-8225687: Newly added sspi.cpp in JDK-6722928 still
    contains some small errors
    + JDK-8227006: [linux] Runtime.availableProcessors execution
    time increased by factor of 100
    + JDK-8227275: Within native OOM error handling, assertions may
    hang the process
    + JDK-8227647: [Graal] Test8009761.java fails due to
    "RuntimeException: static java.lang.Object
    compiler.uncommontrap.Test8009761.m3(boolean,boolean) not
    compiled"
    + JDK-8229495: SIGILL in C2 generated OSR compilation
    + JDK-8230910: libsspi_bridge does not build on Windows 32bit
    + JDK-8232114: JVM crashed at imjpapi.dll in native code
    + JDK-8234147: Avoid looking up standard charsets in core
    libraries
    + JDK-8234393: [macos] printing ignores printer tray
    + JDK-8234863: Increase default value of MaxInlineLevel
    + JDK-8235218: Minimal VM is broken after JDK-8173361
    + JDK-8235456: Minimal VM is broken after JDK-8212160
    + JDK-8235829: graal crashes with Zombie.java test
    + JDK-8236124: Minimal VM slowdebug build failed after
    JDK-8212160
    + JDK-8236512: PKCS11 Connection closed after Cipher.doFinal
    and NoPadding
    + JDK-8236944: The legVecZ operand should be limited to
    zmm0-zmm15 registers
    + JDK-8237186: Fix typo in copyright header of
    java/io/Reader/TransferTo.java
    + JDK-8237499: JFR: Include stack trace in the ThreadStart event
    + JDK-8237512: AArch64: aarch64TestHook leaks a BufferBlob
    + JDK-8237524: AArch64: String.compareTo() may return incorrect
    result
    + JDK-8237950: C2 compilation fails with "Live Node limit
    exceeded limit" during ConvI2L::Ideal optimization
    + JDK-8238579: HttpsURLConnection drops the timeout and hangs
    forever in read
    + JDK-8239105: Add exception for expiring Digicert root
    certificates to VerifyCACerts test
    + JDK-8239477: jdk/jfr/jcmd/TestJcmdStartStopDefault.java fails
  - XX:+VerifyOops with "verify_oop: rsi: broken oop"
    + JDK-8239497: SEGV in EdgeUtils::field_name_symbol(Edge const&amp;)
    + JDK-8239886: Minimal VM build fails after JDK-8237499
    + JDK-8240633: Memory leaks in the implementations of
    FileChooserUI
    + JDK-8240690: Race condition between EDT and
    BasicDirectoryModel.FilesLoader.run0()
    + JDK-8241234: Unify monitor enter/exit runtime entries.
    + JDK-8241311: Move some charset mapping tests from closed to
    open
    + JDK-8241797: Add some tests to the problem list
    + JDK-8242029: AArch64: skip G1 array copy pre-barrier if
    marking not active
    + JDK-8242335: Additional Tests for RSASSA-PSS
    + JDK-8242480: Negative value may be returned by
    getFreeSwapSpaceSize() in the docker
    + JDK-8242614: cleanup duplicated test ldap server in some
    com/sun/jndi/ldap/ tests
    + JDK-8242846: Bring back test/jdk/tools/jlink/plugins/
    /OrderResourcesPluginTest.java
    + JDK-8243114: Implement montgomery{Multiply,Square}intrinsics
    on Windows
    + JDK-8243290: Improve diagnostic messages for class
    verification and redefinition failures
    + JDK-8243488: Add tests for set/get SendBufferSize and
    getReceiveBufferSize in DatagramSocket
    + JDK-8243549: sun/security/ssl/CipherSuite/
    /NamedGroupsWithCipherSuite.java failed with Unsupported
    signature algorithm: DSA
    + JDK-8243617: compiler/onSpinWait/TestOnSpinWaitC1.java test
    uses wrong class
    + JDK-8243619: compiler/codecache/CheckSegmentedCodeCache.java
    test misses -version
    + JDK-8244142: some hotspot/runtime tests don't check exit code
    of forked JVM
    + JDK-8244278: Excessive code cache flushes and sweeps
    + JDK-8244282: test/hotspot/jtreg/compiler/intrinsics/
    /Test8237524.java fails with --illegal-access=deny
    + JDK-8244621: [macos10.15] Garbled FX printing plus CoreText
    warnings on Catalina when building with Xcode 11
    + JDK-8244819: hsdis does not compile with binutils 2.34+
    + JDK-8245051: c1 is broken if it is compiled by gcc without
  - fno-lifetime-dse
    + JDK-8245168: jlink should not be treated as a "small" tool
    + JDK-8245400: Upgrade to LittleCMS 2.11
    + JDK-8246381: VM crashes with "Current BasicObjectLock* below
    than low_mark"
    + JDK-8246434: Threads::print_on_error assumes that the heap
    has been set up
    + JDK-8246648: issue with OperatingSystemImpl
    getFreeSwapSpaceSize in docker after 8242480
    + JDK-8247201: Print potential pointer value of readable stack
    memory in hs_err file
    + JDK-8247763: assert(outer-&gt;outcnt() == 2) failed: 'only phis'
    failure in LoopNode::verify_strip_mined()
    + JDK-8247867: Upgrade to freetype 2.10.2
    + JDK-8248190: Enable Power10 system and implement new
    byte-reverse instructions
    + JDK-8248226: TestCloneAccessStressGCM fails with
  - XX:-ReduceBulkZeroing
    + JDK-8248347: windows build broken by JDK-8243114
    + JDK-8248532: Every time I change keyboard language at my
    MacBook, Java crashes
    + JDK-8248552: C2 crashes with SIGFPE due to division by zero
    + JDK-8248596: [TESTBUG] compiler/loopopts/
    /PartialPeelingUnswitch.java times out with Graal enabled
    + JDK-8248745: Add jarsigner and keytool tests for restricted
    algorithms
    + JDK-8248791: sun/util/resources/cldr/TimeZoneNamesTest.java
    fails with -XX:-ReduceInitialCardMarks -XX:-ReduceBulkZeroing
    + JDK-8248845: AArch64: stack corruption after spilling vector
    register
    + JDK-8249176: Update GlobalSignR6CA test certificates
    + JDK-8249183: JVM crash in "AwtFrame::WmSize" method
    + JDK-8249192: MonitorInfo stores raw oops across safepoints
    + JDK-8249602: C2: assert(cnt == _outcnt) failed: no insertions
    allowed
    + JDK-8249603: C1: assert(has_error == false) failed: register
    allocation invalid
    + JDK-8249605: C2: assert(no_dead_loop) failed: dead loop
    detected
    + JDK-8249607: C2: assert(!had_error) failed: bad dominance
    + JDK-8249608: Vector register used by C2 compiled method
    corrupted at safepoint
    + JDK-8249672: Include microcode revision in features_string on
    x86
    + JDK-8249748: gtest silently ignores bad jvm arguments
    + JDK-8249821: Separate libharfbuzz from libfontmanager
    + JDK-8250598: Hyper-V is detected in spite of running on host
    OS
    + JDK-8250605: Linux x86_32 builds fail after JDK-8249821
    + JDK-8250636: iso8601_time returns incorrect offset part on
    MacOS
    + JDK-8250665: Wrong translation for the month name of May in
    ar_JO,LB,SY
    + JDK-8250772: Test com/sun/jndi/ldap/
    /NamingExceptionMessageTest.java fails intermittently with
    javax.naming.ServiceUnavailableException
    + JDK-8250825: C2 crashes with assert(field != __null) failed:
    missing field
    + JDK-8250894: Provide a configure option to build and run
    against the platform libharfbuzz
    + JDK-8250928: JFR: Improve hash algorithm for stack traces
    + JDK-8250968: Symlinks attributes not preserved when using
    jarsigner on zip files
    + JDK-8250984: Memory Docker tests fail on some Linux kernels
    w/o cgroupv1 swap limit capabilities
    + JDK-8251118: BiasedLocking::preserve_marks should not have a
    HandleMark
    + JDK-8251189: com/sun/jndi/ldap/LdapDnsProviderTest.java
    failed due to timeout
    + JDK-8251257: NMT: jcmd VM.native_memory scale=1 crashes
    target VM
    + JDK-8251365: Build failure on AIX after 8250636
    + JDK-8251397: NPE on ClassValue.ClassValueMap.cacheArray
    + JDK-8251456: [TESTBUG] compiler/vectorization/
    /TestVectorsNotSavedAtSafepoint.java failed OutOfMemoryError
    + JDK-8251458: Parse::do_lookupswitch fails with "assert(_cnt
    &gt;= 0) failed"
    + JDK-8251535: Partial peeling at unsigned test adds incorrect
    loop exit check
    + JDK-8251949: ZGC: Set explicit heap size for
    compiler/gcbarriers tests
    + JDK-8252090: JFR: StreamWriterHost::write_unbuffered() stucks
    in an infinite loop OpenJDK (build 13.0.1+9)
    + JDK-8252415: Bump update version for OpenJDK: jdk-11.0.10
    + JDK-8252470: java/awt/dnd/DisposeFrameOnDragCrash/
    /DisposeFrameOnDragTest.java fails on Windows
    + JDK-8252497: Incorrect numeric currency code for ROL
    + JDK-8252660: Shenandoah: support manageable SoftMaxHeapSize
    option
    + JDK-8252679: Two windows specific FileDIalog tests may fail
    on some Windows_Server_2016_Standard
    + JDK-8252696: Loop unswitching may cause out of bound array
    load to be executed
    + JDK-8252754: Hash code calculation of JfrStackTrace is
    inconsistent
    + JDK-8253219: Epsilon: clean up unnecessary includes
    + JDK-8253224: Shenandoah: ShenandoahStrDedupQueue destructor
    calls virtual num_queues()
    + JDK-8253226: Shenandoah: remove unimplemented
    ShenandoahStrDedupQueue::verify
    + JDK-8253269: The CheckCommonColors test should provide more
    info on failure
    + JDK-8253284: Zero OrderAccess barrier mappings are incorrect
    + JDK-8253375: OSX build fails with Xcode 12.0 (12A7209)
    + JDK-8253778: ShenandoahSafepoint::is_at_shenandoah_safepoint
    should not access VMThread state from other threads
    + JDK-8253791: Issue with useAppleColor check in CSystemColors.m
    + JDK-8254016: Test8237524 fails with -XX:-CompactStrings option
    + JDK-8254081: java/security/cert/PolicyNode/
    /GetPolicyQualifiers.java fails due to an expired certificate
    + JDK-8254144: Non-x86 Zero builds fail with return-type
    warning in os_linux_zero.cpp
    + JDK-8254166: Zero: return-type warning in
    zeroInterpreter_zero.cpp
    + JDK-8254177: (tz) Upgrade time-zone data to tzdata2020b
    + JDK-8254185: Fix Code cache sweeper heuristics for JDK 11
    + JDK-8254190: [s390] interpreter misses exception check after
    calling monitorenter
    + JDK-8254790: SIGSEGV in string_indexof_char and
    stringL_indexof_char intrinsics
    + JDK-8254854: [cgroups v1] Metric limits not properly detected
    on some join controller combinations
    + JDK-8254982: (tz) Upgrade time-zone data to tzdata2020c
    + JDK-8255050: Add pkcs11/KeyStore/ClientAuth.sh to Problem list
    + JDK-8255065: Zero: accessor_entry misses the IRIW case
    + JDK-8255226: (tz) Upgrade time-zone data to tzdata2020d
    + JDK-8255269: Unsigned overflow in g1Policy.cpp
    + JDK-8255365: Problem list failing client manual tests
    + JDK-8255457: Shenandoah: cleanup ShenandoahMarkTask
    + JDK-8255466: C2 crashes at ciObject::get_oop() const+0x0
    + JDK-8255550: x86: Assembler::cmpq(Address dst, Register src)
    encoding is incorrect
    + JDK-8255603: Memory/Performance regression after JDK-8210985
    + JDK-8255760: Shenandoah: match constants style in
    ShenandoahMarkTask fallback
    + JDK-8255781: Bump patch update version for OpenJDK:
    jdk-11.0.9.1
    + JDK-8255937: Better cleanup for
    test/jdk/javax/imageio/stream/StreamFlush.java
    + JDK-8256427: Test com/sun/jndi/dns/ConfigTests/
    /PortUnreachable.java does not work on AIX
    + JDK-8256452: Integrate missing part of JDK-8232370 to 11u
    + JDK-8256483: [TESTBUG] serviceability/jvmti/GetClassMethods/
    /libOverpassMethods.c fails to compile on gcc 4.4.x
    + JDK-8256557: libharfbuzz fails to link on gcc 4.4.x due to
  - Wl,-z,defs
    + JDK-8256618: Zero: Linux x86_32 build still fails
    + JDK-8256736: Zero: GTest tests fail with "unsuppported vm
    variant"
    + JDK-8256809: Annotation processing causes NPE during flow
    analysis
    + JDK-8257181: s390x builds are very noisy with gc-sections
    messages
    + JDK-8257242: [macOS] Java app crashes while switching input
    methods
    + JDK-8257545: SunJSSE FIPS regression in key exchange after
    JDK-8171279 11u backport
    + JDK-8257641: Shenandoah: Query is_at_shenandoah_safepoint()
    from control thread should return false
    + JDK-8257701: Shenandoah: objArrayKlass metadata is not marked
    with chunked arrays
    + JDK-8258630: Add expiry exception for QuoVadis root
    certificate
- New upstream dependency on libharfbuzz
- Regenerated patches: missing-return.patch system-pcsclite.patch</changelog>
  <changelog author="fstrba@suse.com" date="1616155200">- Added patches:
  * system-crypto-policy.patch
    + Let OpenJDK use system crypto policies unless explicitely told
    not to
  * nss-security-provider.patch
    + Add the NSS security provider with configuration in generated
    nss.cfg file
  * keytool-default-rsa.patch
    + Make keytool generate RSA keys by default, since only the
    LEGACY system crypto policy allows DSA</changelog>
  <changelog author="pujos.michael@gmail.com" date="1618488000">- moved mozilla-nss dependency to java-11-openjdk-headless package
  This is necessary to be able to do crypto with just
  java-11-openjdk-headless installed. Fixes boo#1184606</changelog>
  <changelog author="fstrba@suse.com" date="1619006400">- Update to upstream tag jdk-11.0.11+9 (April 2021, CPU)
  * Security fixes
    + JDK-8244473: Contextualize registration for JNDI
    + JDK-8244543: Enhanced handling of abstract classes
    + JDK-8249906, CVE-2021-2163, bsc#1185055: Enhance opening JARs
    + JDK-8250568, CVE-2021-2161, bsc#1185056: Less ambiguous
    processing
    + JDK-8253799: Make lists of normal filenames
    + JDK-8257001: Improve Http Client Support
  * Other changes
    + JDK-7107012: sun.jvm.hotspot.code.CompressedReadStream
    readDouble() conversion to long mishandled
    + JDK-7146776: deadlock between URLStreamHandler.getHostAddress
    and file.Handler.openconnection
    + JDK-8086003: Test fails on OSX with java.lang.RuntimeException
    'Narrow klass base: 0x0000000000000000, Narrow klass shift: 3'
    missing
    + JDK-8168869: jdeps: localized messages don't use proper line
    breaks
    + JDK-8180837: SunPKCS11-NSS tests failing with
    CKR_ATTRIBUTE_READ_ONLY and CKR_MECHANISM_PARAM_INVALID
    + JDK-8202343: Disable TLS 1.0 and 1.1
    + JDK-8205992: jhsdb cannot attach to Java processes running in
    Docker containers
    + JDK-8209193: Fix aarch64-linux compilation after -Wreorder
    changes
    + JDK-8210413: AArch64: Optimize div/rem by constant in C1
    + JDK-8210578: AArch64: Invalid encoding for fmlsvs instruction
    + JDK-8211051: jdeps usage of --dot-output doesn't provide
    valid output for modular jar
    + JDK-8211057: Gensrc step CompileProperties generates unstable
    CompilerProperties output
    + JDK-8211150: G1 Full GC not purging code root memory and
    hence causing memory leak
    + JDK-8211825: ModuleLayer.defineModulesWithXXX does not setup
    delegation when module reads automatic module
    + JDK-8212043: Add floating-point Math.min/max intrinsics
    + JDK-8212218: [TESTBUG] runtime/ErrorHandling/
    /TestHeapDumpOnOutOfMemoryErrorInMetaspace.java timed out
    + JDK-8213116: javax/swing/JComboBox/WindowsComboBoxSize/
    /WindowsComboBoxSizeTest.java fails in Windows
    + JDK-8213909: jdeps --print-module-deps should report missing
    dependences
    + JDK-8214180: Need better granularity for sleeping
    + JDK-8214223: tools/jdeps/listdeps/ListModuleDeps.java failed
    due to missing Lib2 file
    + JDK-8214230: Classes generated by SystemModulesPlugin.java
    are not reproducable
    + JDK-8214741: docs/index.html has no title or copyright
    + JDK-8215687: [Graal] unit test CheckGraalIntrinsics failed
    after 8212043
    + JDK-8217848: [Graal] vmTestbase/nsk/jvmti/ResourceExhausted/
    /resexhausted003/TestDescription.java fails
    + JDK-8218482: sun/security/krb5/auto/ReplayCachePrecise.java
    failed - no KrbException thrown
    + JDK-8218550: Add test omitted from JDK-8212043
    + JDK-8221584: SIGSEGV in os::PlatformEvent::unpark() in
    JvmtiRawMonitor::raw_exit while posting method exit event
    + JDK-8221995: AARCH64: problems with CAS instructions encoding
    + JDK-8222518: Remove unnecessary caching of Parker object in
    java.lang.Thread
    + JDK-8222785: aarch64: add necessary masking for immediate
    shift counts
    + JDK-8223186: HotSpot compile warnings from GCC 9
    + JDK-8225773: jdeps --check produces NPE if there are missing
    module dependences
    + JDK-8225805: Java Access Bridge does not close the logger
    + JDK-8226810: Failed to launch JVM because of
    NullPointerException occured on System.props
    + JDK-8229396: jdeps ignores multi-release when
    generate-module-info used on command line
    + JDK-8229474: Shenandoah: Cleanup CM::update_roots()
    + JDK-8232225: Rework the fix for JDK-8071483
    + JDK-8232905: JFR fails with assertion:
    assert(t-&gt;unflushed_size() == 0) failed: invariant
    + JDK-8233164: C2 fails with assert(phase-&gt;C-&gt;get_alias_index(t)
    == phase-&gt;C-&gt;get_alias_index(t_adr)) failed: correct memory
    chain
    + JDK-8233910: java/awt/ColorClass/AlphaColorTest.java is
    failing  intermittently in nightly lnux-x64 system
    + JDK-8233912: aarch64: minor improvements of atomic operations
    + JDK-8234508: VM_HeapWalkOperation::iterate_over_object reads
    non-strong fields with an on-strong load barrier
    + JDK-8234742: Improve handshake logging
    + JDK-8234796: Refactor Handshake::execute to take a more
    complex type than ThreadClosure
    + JDK-8235324: Dying objects are published from users of
    CollectedHeap::object_iterate
    + JDK-8235351: Lookup::unreflect should bind with the original
    caller independent of Method's accessible flag
    + JDK-8237369: Shenandoah: failed vmTestbase/nsk/jvmti/
    /AttachOnDemand/attach021/TestDescription.java test
    + JDK-8237392: Shenandoah: Remove unreliable assertion
    + JDK-8237483: AArch64 C1 OopMap inserted twice fatal error
    + JDK-8237495: Java MIDI fails with a dereferenced memory error
    when asked to send a raw 0xF7
    + JDK-8239355: (dc) Initial value of SO_SNDBUF should allow
    sending large datagrams (macOS)
    + JDK-8240353: AArch64: missing support for
  - XX:+ExtendedDTraceProbes in C1
    + JDK-8240704: CheckHandles.java failed "AssertionError: Handle
    use increased by more than 10 percent."
    + JDK-8240751: Shenandoah: fold ShenandoahTracer definition
    + JDK-8240795: [REDO] 8238384 CTW: C2 compilation fails with
    "assert(store != load-&gt;find_exact_control(load-&gt;in(0)))
    failed: dependence cycle found"
    + JDK-8241598: Upgrade JLine to 3.14.0
    + JDK-8241649: Optimize Character.toString
    + JDK-8241770: Module xxxAnnotation() methods throw NCDFE if
    module-info.class found as resource in unnamed module
    + JDK-8241911: AArch64: Fix a potential register clash issue in
    reduce_add2I
    + JDK-8242030: Wrong package declarations in jline classes after
    JDK-8241598
    + JDK-8242565: Policy initialization issues when the denyAfter
    constraint is enabled
    + JDK-8243618: compiler/rtm/cli tests can be run w/o WhiteBox
    + JDK-8243670: Unexpected test result caused by C2
    MergeMemNode::Ideal
    + JDK-8244088: [Regression] Switch of Gnome theme ends up in
    deadlocked UI
    + JDK-8244154: Update SunPKCS11 provider with PKCS11 v3.0 header
    files
    + JDK-8244340: Handshake processing thread lacks yielding
    + JDK-8244573: java.lang.ArrayIndexOutOfBoundsException thrown
    for malformed class file
    + JDK-8244683: A TSA server used by tests
    + JDK-8245005: javax/net/ssl/compatibility/BasicConnectTest.java
    failed with No enum constant
    + JDK-8245026: PsAdaptiveSizePolicy::_old_gen_policy_is_ready is
    unused
    + JDK-8245283: JFR: Can't handle constant dynamic used by Jacoco
    agent
    + JDK-8245512: CRC32 optimization using AVX512 instructions
    + JDK-8245527: LDAP Channel Binding support for Java
    GSS/Kerberos
    + JDK-8246707: (sc) SocketChannel.read/write throws
    AsynchronousCloseException on closed channel
    + JDK-8246709: sun/security/tools/jarsigner/
    /TsacertOptionTest.java compilation failed after JDK-8244683
    + JDK-8247200: assert((unsigned)fpargs &lt; 32)
    + JDK-8247766: [aarch64] guarantee(val &lt; (1U &lt;&lt; nbits))
    failed: Field too big for insn.
    + JDK-8248336: AArch64: C2: offset overflow in
    BoxLockNode::emit
    + JDK-8248865: Document JNDI/LDAP timeout properties
    + JDK-8248901: Signed immediate support in
    .../share/assembler.hpp is broken.
    + JDK-8249543: Force DirectBufferAllocTest to run with
  - ExplicitGCInvokesConcurrent
    + JDK-8249588: libwindowsaccessbridge issues on 64bit Windows
    + JDK-8249749: modify a primitive array through a stream and a
    for cycle causes jre crash
    + JDK-8249787: Make TestGCLocker more resilient with concurrent
    GCs
    + JDK-8249867: xml declaration is not followed by a newline
    + JDK-8250911: [windows] os::pd_map_memory() error detection
    broken
    + JDK-8251255: [linux] Add process-memory information to hs-err
    and VM.info
    + JDK-8251359: Shenandoah: filter null oops before calling
    enqueue/SATB barrier
    + JDK-8251925: C2: RenaissanceStressTest fails with
    assert(!had_error): bad dominance
    + JDK-8251944: Add Shenandoah test config to
    compiler/gcbarriers/UnsafeIntrinsicsTest.java
    + JDK-8251992: VM crashed running TestComplexAddrExpr.java test
    with -XX:UseAVX=X
    + JDK-8253220: Epsilon: clean up unused code/declarations
    + JDK-8253274: The CycleDMImagetest brokes the system
    + JDK-8253353: Crash in C2: guarantee(n != NULL) failed: No Node
    + JDK-8253368: TLS connection always receives close_notify
    exception
    + JDK-8253404: C2: assert(C-&gt;live_nodes() &lt;=
    C-&gt;max_node_limit()) failed: Live Node limit exceeded limit
    + JDK-8253409: Double-rounding possibility in float fma
    + JDK-8253476: TestUseContainerSupport.java fails on some Linux
    kernels w/o swap limit capabilities
    + JDK-8253524: C2: Refactor code that clones predicates during
    loop unswitching
    + JDK-8253644: C2: assert(skeleton_predicate_has_opaque(iff))
    failed: unexpected
    + JDK-8253681: closed java/awt/dnd/MouseEventAfterStartDragTest/
    /MouseEventAfterStartDragTest.html test failed
    + JDK-8253702: BigSur version number reported as 10.16, should
    be 11.nn
    + JDK-8253756: C2 CompilerThread0 crash in Node::add_req(Node*)
    + JDK-8254104: MethodCounters must exist before nmethod is
    installed
    + JDK-8254734: "dead loop detected" assert failure with patch
    from 8223051
    + JDK-8254748: Bad Copyright header format after JDK-8212218
    + JDK-8254799: runtime/ErrorHandling/
    /TestHeapDumpOnOutOfMemoryError.java fails with release VMs
    + JDK-8255058: C1: assert(is_virtual()) failed: type check
    + JDK-8255351: Add detection for Graviton 2 CPUs
    + JDK-8255368: Math.exp() gives wrong result for large values on
    x86 32-bit platforms
    + JDK-8255387: Japanese characters were printed upside down on
    AIX
    + JDK-8255401: Shenandoah: Allow oldval and newval registers to
    overlap in cmpxchg_oop()
    + JDK-8255479: [aarch64] assert(src-&gt;section_index_of(target) ==
    CodeBuffer::SECT_NONE) failed: sanity
    + JDK-8255544: Create a checked cast
    + JDK-8255559: Leak File Descriptors Because of
    ResolverLocalFilesystem#engineResolveURI()
    + JDK-8255681: print callstack in error case in
    runAWTLoopWithApp
    + JDK-8255734: VM should ignore SIGXFSZ on ppc64, s390 too
    + JDK-8255742: PrintInlining as compiler directive doesn't print
    virtual calls
    + JDK-8255845: Memory leak in imageFile.cpp
    + JDK-8255880: UI of Swing components is not redrawn after their
    internal state changed
    + JDK-8255908: ExceptionInInitializerError due to
    UncheckedIOException while initializing cgroupv1 subsystem
    + JDK-8256025: AArch64: MachCallRuntimeNode::ret_addr_offset()
    is incorrect for stub calls
    + JDK-8256056: Deoptimization stub doesn't save vector registers
    on x86
    + JDK-8256061: RegisterSaver::save_live_registers() omits upper
    halves of ZMM0-15 registers
    + JDK-8256187: [TEST_BUG] Automate bug4275046.java test
    + JDK-8256220: C1: x86_32 fails with -XX:UseSSE=1 after
    JDK-8210764 due to mishandled lir_neg
    + JDK-8256258: some missing NULL checks or asserts after
    CodeCache::find_blob_unsafe
    + JDK-8256264: Printed GlyphVector outline with low DPI has bad
    quality on Windows
    + JDK-8256290: javac/lambda/T8031967.java fails with
    StackOverflowError on x86_32
    + JDK-8256359: AArch64: runtime/ReservedStack/
    /ReservedStackTestCompiler.java fails
    + JDK-8256387: Unexpected result if patching an entire
    instruction on AArch64
    + JDK-8256421: Add 2 HARICA roots to cacerts truststore
    + JDK-8256488: [aarch64] Use ldpq/stpq instead of ld4/st4 for
    small copies in StubGenerator::copy_memory
    + JDK-8256489: Make gtest for long path names on Windows more
    resilient in the presence of virus scanners
    + JDK-8256501: libTestMainKeyWindow fails to build with Xcode
    12.2
    + JDK-8256633: Fix product build on Windows+Arm64
    + JDK-8256682: JDK-8202343 is incomplete
    + JDK-8256751: Incremental rebuild with precompiled header fails
    when touching a header file
    + JDK-8256757: Incorrect MachCallRuntimeNode::ret_addr_offset()
    for CallLeafNoFP on x86_32
    + JDK-8256806: Shenandoah: optimize shenandoah/jni/
    /TestPinnedGarbage.java test
    + JDK-8256807: C2: Not marking stores correctly as mismatched
    in string opts
    + JDK-8256810: Incremental rebuild broken on Macosx
    + JDK-8256818: SSLSocket that is never bound or connected leaks
    socket resources
    + JDK-8256888: Client manual test problem list update
    + JDK-8257083: Security infra test failures caused by
    JDK-8202343
    + JDK-8257408: Bump update version for OpenJDK: jdk-11.0.11
    + JDK-8257423: [PPC64] Support -XX:-UseInlineCaches
    + JDK-8257436: [aarch64] Regressions in ArrayCopyUnalignedDst
    .testByte/testChar for 65-78 bytes when UseSIMDForMemoryOps
    is on
    + JDK-8257513: C2: assert((constant_addr -
    _masm.code()-&gt;consts()-&gt;start()) == con.offset())
    + JDK-8257547: Handle multiple prereqs on the same line in deps
    files
    + JDK-8257561: Some code is not vectorized after 8251925 and
    8250607
    + JDK-8257565: epsilonBarrierSet.hpp should not include
    barrierSetAssembler
    + JDK-8257575: C2: "failed: only phis" assert failure in loop
    strip mining verification
    + JDK-8257594: C2 compiled checkcast of non-null object triggers
    endless deoptimization/recompilation cycle
    + JDK-8257633: Missing -mmacosx-version-min=X flag when linking
    libjvm
    + JDK-8257670: sun/security/ssl/SSLSocketImpl/SSLSocketLeak.java
    reports leaks
    + JDK-8257707: Fix incorrect format string in Http1HeaderParser
    + JDK-8257746: Regression introduced with JDK-8250984 - memory
    might be null in some machines
    + JDK-8257798: [PPC64] undefined reference to
    Klass::vtable_start_offset()
    + JDK-8257884: Re-enable sun/security/ssl/SSLSocketImpl/
    /SSLSocketLeak.java as automatic test
    + JDK-8257910: [JVMCI] Set exception_seen accordingly in the
    runtime.
    + JDK-8257997: sun/security/ssl/SSLSocketImpl/SSLSocketLeak.java
    again reports leaks after JDK-8257884
    + JDK-8257999: Parallel GC crash in gc/parallel/
    /TestDynShrinkHeap.java: new region is not in covered_region
    + JDK-8258077: Using -Xcheck:jni can lead to a double-free after
    JDK-8193234
    + JDK-8258247: Couple of issues in fix for JDK-8249906
    + JDK-8258373: Update the text handling in the JPasswordField
    + JDK-8258396: SIGILL in jdk.jfr.internal.PlatformRecorder
    .rotateDisk()
    + JDK-8258419: RSA cipher buffer cleanup
    + JDK-8258471: "search codecache" clhsdb command does not work
    + JDK-8258534: Epsilon: clean up unused includes
    + JDK-8258805: Japanese characters not entered by mouse click
    on Windows 10
    + JDK-8258833: Cancel multi-part cipher operations in SunPKCS11
    after failures
    + JDK-8258836: JNI local refs exceed capacity
    getDiagnosticCommandInfo
    + JDK-8258884: [TEST_BUG] Convert applet-based test
    open/test/jdk/javax/swing/JMenuItem/8031573/bug8031573.java
    to a regular java test
    + JDK-8259007: This test printed a blank page
    + JDK-8259048: (tz) Upgrade time-zone data to tzdata2020f
    + JDK-8259049: Uninitialized variable after JDK-8257513
    + JDK-8259231: Epsilon: improve performance under contention
    during virtual space expansion
    + JDK-8259271: gc/parallel/TestDynShrinkHeap.java still fails
    "assert(covered_region.contains(new_memregion)) failed: new
    region is not in covered_region"
    + JDK-8259312: VerifyCACerts.java fails as soneraclass2ca cert
    will expire in 90 days
    + JDK-8259319: Illegal package access when SunPKCS11 requires
    SunJCE's classes
    + JDK-8259339: AllocateUninitializedArray C2 intrinsic fails
    with void.class input
    + JDK-8259428: AlgorithmId.getEncodedParams() should return copy
    + JDK-8259446: runtime/jni/checked/
    /TestCheckedReleaseArrayElements.java fails with stderr not
    empty
    + JDK-8259451: Zero: skip serviceability/sa tests, set vm.hasSA
    to false
    + JDK-8259580: Shenandoah: uninitialized label in
    VerifyThreadGCState
    + JDK-8259619: C1: 3-arg StubAssembler::call_RT stack-use
    condition is incorrect
    + JDK-8259633: compiler/graalunit/CoreTest.java fails with NPE
    after JDK-8244543
    + JDK-8259706: C2 compilation fails with assert(vtable_index ==
    Method::invalid_vtable_index) failed: correct sentinel value
    + JDK-8259707: LDAP channel binding does not work with StartTLS
    extension
    + JDK-8259773: Incorrect encoding of AVX-512 kmovq instruction
    + JDK-8259849: Shenandoah: Rename store-val to IU-barrier
    + JDK-8259949: x86 32-bit build fails when -fcf-protection is
    passed in the compiler flags
    + JDK-8259954: gc/shenandoah/mxbeans tests fail with -Xcomp
    + JDK-8260029: aarch64: fix typo in verify_oop_array
    + JDK-8260308: Update LogCompilation junit to 4.13.1
    + JDK-8260338: Some fields in HaltNode is not cloned
    + JDK-8260349: Cannot programmatically retrieve Metaspace max
    set via JAVA_TOOL_OPTIONS
    + JDK-8260356: (tz) Upgrade time-zone data to tzdata2021a
    + JDK-8260378: [TESTBUG] DcmdMBeanTestCheckJni.java reports
    false positive
    + JDK-8260497: Shenandoah: Improve SATB flushing
    + JDK-8260502: [s390] NativeMovRegMem::verify() fails because
    it's too strict
    + JDK-8260632: Build failures after JDK-8253353
    + JDK-8260704: ParallelGC: oldgen expansion needs release-store
    for _end
    + JDK-8261022: Fix incorrect result of Math.abs() with char type
    + JDK-8261089: [TESTBUG] native library of test
    TestCheckedReleaseCriticalArray.java fails to compile with
    gcc 4.x
    + JDK-8261183: Follow on to Make lists of normal filenames
    + JDK-8261209: isStandalone property: remove dependency on
    pretty-print
    + JDK-8261231: Windows IME was disabled after DnD operation
    + JDK-8261251: Shenandoah: Use object size for full GC
    humongous compaction
    + JDK-8261310: PPC64 Zero build fails with
    'VMError::controlled_crash(int)::FunctionDescriptor
    functionDescriptor' has incomplete type and cannot be defined
    + JDK-8261334: NMT: tuning statistic shows incorrect hash
    distribution
    + JDK-8261413: Shenandoah: Disable class-unloading in I-U mode
    + JDK-8261522: [PPC64] AES intrinsics write beyond the
    destination array
    + JDK-8261534: Test sun/security/pkcs11/KeyAgreement/
    /IllegalPackageAccess.java fails on platforms where no nsslib
    artifacts are defined
    + JDK-8261585: Restore HandleArea used in
    Deoptimization::uncommon_trap
    + JDK-8261753: Test java/lang/System/OsVersionTest.java still
    failing on BigSur patch versions after JDK-8253702
    + JDK-8261829: Exclude tools/jlink/JLinkReproducibleTest.java
    in 11u
    + JDK-8261912: Code IfNode::fold_compares_helper more
    defensively
    + JDK-8261920: [AIX] jshell command throws java.io.IOError on
    non English locales
    + JDK-8262018: Wrong format in SAP copyright header of
    OsVersionTest
    + JDK-8263069: Exclude some failing tests from
    security/infra/java/security/cert/CertPathValidator</changelog>
  <changelog author="fstrba@suse.com" date="1620043200">- Remove all Jpackage provides for SLE12 in order to avoid
  installing this package as default Java on SLE12-SP5
  (bsc#1185476)</changelog>
  <changelog author="fstrba@suse.com" date="1621512000">- Modified patch:
  * nss-security-provider.patch
    + make the NSS provider first in the list</changelog>
  <changelog author="fstrba@suse.com" date="1626868800">- Update to upstream tag jdk-11.0.12+7 (July 2021, CPU)
  * Security fixes
    + JDK-8256157: Improve bytecode assembly
    + JDK-8256491: Better HTTP transport
    + JDK-8258432, CVE-2021-2341, bsc#1188564: Improve file
    transfers
    + JDK-8260453: Improve Font Bounding
    + JDK-8260960: Signs of jarsigner signing
    + JDK-8260967, CVE-2021-2369, bsc#1188565: Better jar file
    validation
    + JDK-8262380: Enhance XML processing passes
    + JDK-8262403: Enhanced data transfer
    + JDK-8262410: Enhanced rules for zones
    + JDK-8262477: Enhance String Conclusions
    + JDK-8262967: Improve Zip file support
    + JDK-8264066, CVE-2021-2388, bsc#1188566: Enhance compiler
    validation
    + JDK-8264079: Improve abstractions
    + JDK-8264460: Improve NTLM support
  * Other changes
    + JDK-6847157: java.lang.NullPointerException: HDC for
    component at sun.java2d.loops.Blit.Blit
    + JDK-7106851: Test should not use System.exit
    + JDK-8073446: TimeZone getOffset API does not  return a dst
    offset between years 2038-2137
    + JDK-8076190: Customizing the generation of a PKCS12 keystore
    + JDK-8153005: Upgrade the default PKCS12 encryption/MAC
    algorithms
    + JDK-8171303: sun/java2d/pipe/InterpolationQualityTest.java
    fails on Windows &amp; Linux
    + JDK-8177068: incomplete classpath causes NPE in Flow
    + JDK-8185734: [Windows] Structured Exception Catcher missing
    around gtest execution
    + JDK-8187450: JNI local refs exceeds capacity warning in
    NetworkInterface::getAll
    + JDK-8190763: Class cast exception on (CompoundEdit)
    UndoableEditEvent.getEdit()
    + JDK-8195841: PNGImageReader.readNullTerminatedString() doesnt
    check for non-null terminated strings with length equal to
    maxLen
    + JDK-8196100: javax/swing/text/JTextComponent/5074573/
    /bug5074573.java fails
    + JDK-8199646: JShell tests: jdk/jshell/
    /FailOverDirectExecutionControlTest.java failed with
    java.lang.UnsupportedOperationException
    + JDK-8206925: Support the certificate_authorities extension
    + JDK-8207160: ClassReader::adjustMethodParams can potentially
    return null if the args list is empty
    + JDK-8207247: AARCH64: Enable Minimal and Client VM builds
    + JDK-8207404: MulticastSocket tests failing on AIX
    + JDK-8207779: Method::is_valid_method() compares 'this' with
    NULL
    + JDK-8208061: runtime/LoadClass/TestResize.java fails with
    "Load factor too high" when running in CDS mode.
    + JDK-8209459: TestSHA512MultiBlockIntrinsics failed on AArch64
    + JDK-8210443: Migrate Locale matching tests to JDK Repo.
    + JDK-8213231: ThreadSnapshot::_threadObj can become stale
    + JDK-8213483: ARM32: runtime/ErrorHandling/
    /ShowRegistersOnAssertTest.java jtreg test fail
    + JDK-8213725: JShell NullPointerException due to class file
    with unexpected package
    + JDK-8213794: ARM32: disable TypeProfiling,
    CriticalJNINatives, Serviceablity tests for ARM32
    + JDK-8213845: ARM32: Interpreter doesn't call result handler
    after native calls
    + JDK-8214128: ARM32: wrong stack alignment on
    Deoptimization::unpack_frames
    + JDK-8214512: ARM32: Jtreg test compiler/c2/Test8062950.java
    fails on ARM
    + JDK-8214854: JDWP: Unforseen output truncation in logging
    + JDK-8214922: Add vectorization support for fmin/fmax
    + JDK-8215009: GCC 8 compilation error in libjli
    + JDK-8216184: CDS/appCDS tests failed on Windows due to long
    path to a classlist file
    + JDK-8216259: AArch64: Vectorize Adler32 intrinsics
    + JDK-8216314: SIGILL in CodeHeapState::print_names()
    + JDK-8217348: assert(thread-&gt;is_Java_thread()) failed: just
    checking
    + JDK-8217465: [REDO] - Optimize CodeHeap Analytics
    + JDK-8217561: X86: Add floating-point Math.min/max intrinsics
    + JDK-8217918: C2: -XX:+AggressiveUnboxing is broken
    + JDK-8218458: [TESTBUG] runtime/NMT/
    /CheckForProperDetailStackTrace.java fails with Expected
    stack trace missing from output
    + JDK-8219142: Remove unused JIMAGE_ResourcePath
    + JDK-8219586: CodeHeap State Analytics processes dead nmethods
    + JDK-8220074: Clean up GCC 8.3 errors in LittleCMS
    + JDK-8220407: compiler/intrinsics/math/
    /TestFpMinMaxIntrinsics.java timedout
    + JDK-8222302: [TESTBUG] test/hotspot/jtreg/compiler/intrinsics/
    /sha/cli/TestUseSHAOptionOnUnsupportedCPU.java fails on any
    other CPU
    + JDK-8222412: AARCH64: multiple instructions encoding issues
    + JDK-8223020: aarch64: expand minI_rReg and maxI_rReg patterns
    into separate instructions
    + JDK-8223444: Improve CodeHeap Free Space Management
    + JDK-8223504: Improve performance of forall loops by better
    inlining of "iterator()" methods
    + JDK-8223667: ASAN build broken
    + JDK-8225081: Remove Telia Company CA certificate expiring in
    April 2021
    + JDK-8225116: Test OwnedWindowsLeak.java intermittently fails
    + JDK-8225438: javax/net/ssl/TLSCommon/
    /TestSessionLocalPrincipal.java failed with Read timed out
    + JDK-8225756: [testbug] compiler/loopstripmining/
    /CheckLoopStripMining.java sets too short a
    SafepointTimeoutDelay
    + JDK-8226374: Restrict TLS signature schemes and named groups
    + JDK-8226627: assert(t-&gt;singleton()) failed: must be a constant
    + JDK-8226721: Missing intrinsics for Math.ceil, floor, rint
    + JDK-8227080: (fs) Files.newInputStream(...).skip(n) is slow
    + JDK-8227222: vmTestbase/jit/FloatingPoint/gen_math/Loops04/
    /Loops04.java failed XMM register should be 0-15
    + JDK-8227609: (fs) Files.newInputStream(...).skip(n) should
    allow skipping beyond file size
    + JDK-8230428: Cleanup dead CastIP node code in formssel.cpp
    + JDK-8231460: Performance issue (CodeHeap) with large free
    blocks
    + JDK-8231713: x86_32 build failures after JDK-8226721 (Missing
    intrinsics for Math.ceil, floor, rint)
    + JDK-8231841: AArch64: debug.cpp help() is missing an AArch64
    line for pns
    + JDK-8232084: HotSpot build failed with GCC 9.2.1
    + JDK-8232591: AArch64: Add missing match rules for smaddl,
    smsubl and smnegl
    + JDK-8233185: HttpServer.stop() blocks indefinitely when
    called on dispatch thread
    + JDK-8233787: Break cycle in vm_version* includes
    + JDK-8233948: AArch64: Incorrect mapping between OptoReg and
    VMReg for high 64 bits of Vector Register
    + JDK-8234355: Buffer overflow in jcmd GC.class_stats due to
    too many classes
    + JDK-8235368: Update BCEL to Version 6.4.1
    + JDK-8236859: WebSocket over authenticating proxy fails with
    NPE
    + JDK-8236992: AArch64: remove redundant load_klass in itable
    stub
    + JDK-8237743: test/langtools/jdk/jshell/
    /FailOverExecutionControlTest.java fails No
    ExecutionControlProvider with name 'nonExistent' and parameter
    keys: []
    + JDK-8237804: sun/security/mscapi tests fail with "Key pair
    not generated, alias &lt;nnnnnn&gt; already exists"
    + JDK-8238175: CTW: Class.getDeclaredMethods fails with
    assert(k-&gt;is_subclass_of(SystemDictionary::Throwable_klass()))
    failed: invalid exception class
    + JDK-8238567: SoftMainMixer.processAudioBuffers(): Wrong
    handling of stoppedMixers
    + JDK-8238812: assert(false) failed: bad AD file
    + JDK-8239312: [macos] javax/swing/JFrame/NSTexturedJFrame/
    /NSTexturedJFrame.java
    + JDK-8239386: handle ContendedPaddingWidth in
    vm_version_aarch64
    + JDK-8239536: Can't use 'java.util.List' object after
    importing 'java.awt.List'
    + JDK-8240487: Cleanup whitespace in .cc, .hh, .m, and .mm files
    + JDK-8240848: ArrayIndexOutOfBoundsException buf for
    TextCallbackHandler
    + JDK-8241082: Upgrade IANA Language Subtag Registry data to
    03-16-2020 version
    + JDK-8241087: Build failure with VS 2019 (16.5.0) due to C2039
    and C2873
    + JDK-8241101: [s390] jtreg test failure after JDK-8238696: not
    conformant features string
    + JDK-8241248: NullPointerException in
    sun.security.ssl.HKDF.extract(HKDF.java:93)
    + JDK-8241372: Several test failures due to
    javax.net.ssl.SSLException: Connection reset
    + JDK-8241475: AArch64: Add missing support for PopCountVI node
    + JDK-8241829: Cleanup the code for PrinterJob on windows
    + JDK-8241960: The SHA3 message digests impl of SUN provider
    are not thread safe after cloned
    + JDK-8242010: Upgrade IANA Language Subtag Registry to Version
    2020-04-01
    + JDK-8242429: Better implementation for sign extract
    + JDK-8242557: Add length limit for strings in PNGImageWriter
    + JDK-8242919: Paste locks up jshell
    + JDK-8243155: AArch64: Add support for SqrtVF
    + JDK-8243240: AArch64: Add support for MulVB
    + JDK-8243452: JFR: Could not create chunk in repository with
    over 200 recordings
    + JDK-8243559: Remove root certificates with 1024-bit keys
    + JDK-8243597: AArch64: Add support for integer vector abs
    + JDK-8244031: HttpClient should have more tests for HEAD
    requests
    + JDK-8244205: HTTP/2 tunnel connections through proxy may be
    reused regardless of which proxy is selected
    + JDK-8244847: Linux/PPC: runtime/CompressedOops/
    /CompressedClassPointers: smallHeapTest fails
    + JDK-8245511: G1 adaptive IHOP does not account for
    reclamation of humongous objects by young GC
    + JDK-8246274: G1 old gen allocation tracking is not in a
    separate class
    + JDK-8247354: [aarch64] PopFrame causes
    assert(oopDesc::is_oop(obj)) failed: not an oop
    + JDK-8247408: IdealGraph bit check expression canonicalization
    + JDK-8247432: Update IANA Language Subtag Registry to Version
    2020-09-29
    + JDK-8247438: JShell: When FailOverExecutionControlProvider
    fails the proximal cause is not shown
    + JDK-8247753: UIManager.getSytemLookAndFeelClassName() returns
    wrong value on Fedora 32
    + JDK-8248043: Need to eliminate excessive i2l conversions
    + JDK-8248411: [aarch64] Insufficient error handling when
    CodeBuffer is exhausted
    + JDK-8248568: compiler/c2/TestBit.java failed: test missing
    from stdout/stderr
    + JDK-8248870: AARCH64: I2L/L2I conversions can be skipped for
    masked positive values
    + JDK-8249142: java/awt/FontClass/CreateFont/DeleteFont.sh is
    unstable
    + JDK-8249189: AARCH64: more L2I conversions can be skipped
    + JDK-8249719: MethodHandle performance suffers from bad
    ResolvedMethodTable hash function
    + JDK-8249875: GCC 10 warnings -Wtype-limits with JFR code
    + JDK-8250635: MethodArityHistogram should use Compile_lock in
    favour of fancy checks
    + JDK-8250876: Fix issues with cross-compile on macos
    + JDK-8251031: Some vmTestbase/nsk/monitoring/RuntimeMXBean
    tests fail with hostnames starting from digits
    + JDK-8251525: AARCH64: Faster Math.signum(fp)
    + JDK-8252259: AArch64: Adjust default value of FLOATPRESSURE
    + JDK-8252311: AArch64: save two words in itable lookup stub
    + JDK-8252779: compiler/graalunit/HotspotTest.java failed after
    8251525
    + JDK-8252883: AccessDeniedException caused by delayed file
    deletion on Windows
    + JDK-8253167: ARM32 builds fail after JDK-8247910
    + JDK-8253572: [windows] CDS archive may fail to open with long
    file names
    + JDK-8253923: C2 doesn't always run loop opts for compilations
    that include loops
    + JDK-8253948: Memory leak in ImageFileReader
    + JDK-8254631: Better support ALPN byte wire values in SunJSSE
    + JDK-8254717: isAssignableFrom checks in
    KeyFactorySpi.engineGetKeySpec appear to be backwards
    + JDK-8255086: Update the root locale display names
    + JDK-8255625: AArch64: Implement Base64.encodeBlock
    accelerator/intrinsic
    + JDK-8255763: C2: OSR miscompilation caused by invalid memory
    instruction placement
    + JDK-8255992: JFR EventWriter does not use first string from
    StringPool with id 0
    + JDK-8256037: [TESTBUG] com/sun/jndi/dns/ConfigTests/
    /PortUnreachable.java fails due to the hard coded threshold
    is small
    + JDK-8256244: java/lang/ProcessHandle/PermissionTest.java
    fails with TestNG 7.1
    + JDK-8256287: [windows] add loop fuse to
    map_or_reserve_memory_aligned
    + JDK-8256523: Streamline Java SHA2 implementation
    + JDK-8257414: Drag n Drop target area is wrong on high DPI
    systems
    + JDK-8257569: Failure observed with
    JfrVirtualMemory::initialize
    + JDK-8257574: C2: "failed: parsing found no loops but there
    are some" assert failure
    + JDK-8257580: Bump update version for OpenJDK: jdk-11.0.12
    + JDK-8257604: JNI_ArgumentPusherVaArg leaks valist
    + JDK-8257621: JFR StringPool misses cached items across
    consecutive recordings
    + JDK-8257796: [TESTBUG]
    TestUseSHA512IntrinsicsOptionOnSupportedCPU.java fails
    on x86_32
    + JDK-8257822: C2 crashes with SIGFPE due to a division that
    floats above its zero check
    + JDK-8257828: SafeFetch may crash if invoked in non-JavaThreads
    + JDK-8257853: Remove dependencies on JNF's JNI utility
    functions in AWT and 2D code
    + JDK-8257858: [macOS]: Remove JNF dependency from
    libosxsecurity/KeystoreImpl.m
    + JDK-8257860: [macOS]: Remove JNF dependency from
    libosxkrb5/SCDynamicStoreConfig.m
    + JDK-8257988: Remove JNF dependency from
    libsaproc/MacosxDebuggerLocal.m
    + JDK-8258414: OldObjectSample events too expensive
    + JDK-8258505: [TESTBUG] TestDivZeroWithSplitIf.java fails due
    to missing UnlockDiagnosticVMOptions
    + JDK-8258753: StartTlsResponse.close() hangs due to
    synchronization issues
    + JDK-8259061: C2: assert(found) failed: memory-writing node is
    not placed in its original loop or an ancestor of it
    + JDK-8259227: C2 crashes with SIGFPE due to a division that
    floats above its zero check
    + JDK-8259232: Bad JNI lookup during printing
    + JDK-8259276: C2: Empty expression stack when reexecuting
    tableswitch/lookupswitch instructions after deoptimization
    + JDK-8259343: [macOS] Update JNI error handling in Cocoa code.
    + JDK-8259585: Accessible actions do not work on mac os x
    + JDK-8259651: [macOS] Replace JNF_COCOA_ENTER/EXIT macros
    + JDK-8259662: Don't wrap SocketExceptions into SSLExceptions
    in SSLSocketImpl
    + JDK-8259710: Inlining trace leaks memory
    + JDK-8259729: Missed JNFInstanceOf -&gt; IsInstanceOf conversion
    + JDK-8259777: Incorrect predication condition generated by ADLC
    + JDK-8259786: initialize last parameter of getpwuid_r
    + JDK-8259843: initialize dli_fname array before calling
    dll_address_to_library_name
    + JDK-8259869: [macOS] Remove desktop module dependencies on
    JNF Reference APIs
    + JDK-8259886: Improve SSL session cache performance and
    scalability
    + JDK-8259983: do not use uninitialized expand_ms value in
    G1CollectedHeap::expand_heap_after_young_collection
    + JDK-8260030: Improve stringStream buffer handling
    + JDK-8260236: better init AnnotationCollector _contended_group
    + JDK-8260255: C1: LoopInvariantCodeMotion constructor can
    leave some fields uninitialized
    + JDK-8260284: C2: assert(_base == Int) failed: Not an Int
    + JDK-8260380: Upgrade to LittleCMS 2.12
    + JDK-8260420: C2 compilation fails with assert(found_sfpt)
    failed: no node in loop that's not input to safepoint
    + JDK-8260426: awt debug_mem.c DMem_AllocateBlock might leak
    memory
    + JDK-8260432: allocateSpaceForGP in freetypeScaler.c might
    leak memory
    + JDK-8260616: Removing remaining JNF dependencies in the
    java.desktop module
    + JDK-8260653: Unreachable nodes keep speculative types alive
    + JDK-8260707: java/lang/instrument/PremainClass/
    /InheritAgent0100.java times out
    + JDK-8260925: HttpsURLConnection does not work  with other
    JSSE provider.
    + JDK-8260926: Trace resource exhausted events unconditionally
    + JDK-8261020: Wrong format parameter in
    create_emergency_chunk_path
    + JDK-8261027: AArch64: Support for LSE atomics C++ HotSpot code
    + JDK-8261167: print_process_memory_info add a close call after
    fopen
    + JDK-8261170: Upgrade to freetype 2.10.4
    + JDK-8261198: [macOS] Incorrect JNI parameters in number
    conversion in A11Y code
    + JDK-8261235: C1 compilation fails with
    assert(res-&gt;vreg_number() == index) failed: conversion check
    + JDK-8261261: The version extra fields needs to be overridable
    in jib-profiles.js
    + JDK-8261262: Kitchensink24HStress.java crashed with
    EXCEPTION_ACCESS_VIOLATION
    + JDK-8261354: SIGSEGV at MethodIteratorHost
    + JDK-8261355: No data buffering in SunPKCS11 Cipher encryption
    when the underlying mechanism has no padding
    + JDK-8261397: try catch Method failing to work when dividing
    an integer by 0
    + JDK-8261422: Adjust problematic String.format calls in
    jdk/internal/util/Preconditions.java outOfBoundsMessage
    + JDK-8261447: MethodInvocationCounters frequently run into
    overflow
    + JDK-8261481: Cannot read Kerberos settings in dynamic store
    on macOS Big Sur
    + JDK-8261505: Test test/hotspot/jtreg/gc/parallel/
    /TestDynShrinkHeap.java killed by Linux OOM Killer
    + JDK-8261601: free memory in early return in
    Java_sun_nio_ch_sctp_SctpChannelImpl_receive0
    + JDK-8261649: AArch64: Optimize LSE atomics in C++ code
    + JDK-8261730: C2 compilation fails with
    assert(store-&gt;find_edge(load) != -1) failed: missing
    precedence edge
    + JDK-8261752: Multiple GC test are missing memory requirements
    + JDK-8261791: (sctp) handleSendFailed in SctpChannelImpl.c
    potential leaks
    + JDK-8261812: C2 compilation fails with assert(!had_error)
    failed: bad dominance
    + JDK-8261914: IfNode::fold_compares_helper faces
    non-canonicalized bool when running JRuby JSON workload
    + JDK-8262093: java/util/concurrent/tck/JSR166TestCase.java
    failed "assert(false) failed: unexpected node"
    + JDK-8262110: DST starts from incorrect time in 2038
    + JDK-8262121: [11u] Redo 8244287: JFR: Methods samples have
    line number 0
    + JDK-8262163: Extend settings printout in jcmd VM.metaspace
    + JDK-8262295: C2: Out-of-Bounds Array Load from Clone Source
    + JDK-8262298: G1BarrierSetC2::step_over_gc_barrier fails with
    assert "bad barrier shape"
    + JDK-8262446: DragAndDrop hangs on Windows
    + JDK-8262461: handle wcstombsdmp return value correctly in
    unix awt_InputMethod.c
    + JDK-8262465: Very long compilation times and high memory
    consumption in C2 debug builds
    + JDK-8262726: AArch64: C1 StubAssembler::call_RT can corrupt
    stack
    + JDK-8262739: String inflation C2 intrinsic prevents insertion
    of anti-dependencies
    + JDK-8262829: Native crash in
    Win32PrintServiceLookup.getAllPrinterNames()
    + JDK-8262837: handle split_USE correctly
    + JDK-8262900: ToolBasicTest fails to access HTTP server it
    starts
    + JDK-8263260: [s390] Support latest hardware (z14 and z15)
    + JDK-8263311: Watch registry changes for remote printers
    update instead of polling
    + JDK-8263361: Incorrect arraycopy stub selected by C2 for SATB
    collectors
    + JDK-8263404: RsaPrivateKeySpec is always recognized as
    RSAPrivateCrtKeySpec in RSAKeyFactory.engineGetKeySpec
    + JDK-8263425: AArch64: two potential bugs in C1
    LIRGenerator::generate_address()
    + JDK-8263448: CTW: fatal error: meet not symmetric
    + JDK-8263504: Some OutputMachOpcodes fields are uninitialized
    + JDK-8263557: Possible NULL dereference in
    Arena::destruct_contents()
    + JDK-8263558: Possible NULL dereference in fast path arena
    free if ZapResourceArea is true
    + JDK-8263676: AArch64: one potential bug in C1
    LIRGenerator::generate_address()
    + JDK-8263729: [test] divert spurious output away from stream
    under test in ProcessBuilder Basic test
    + JDK-8263846: Bad JNI lookup getFocusOwner in accessibility
    code on Mac OS X
    + JDK-8264047: Duplicate global variable 'jvm' in libjavajpeg
    and libawt
    + JDK-8264096: slowdebug jvm crashes when StrInflatedCopy match
    rule is not supported
    + JDK-8264151: ciMethod::ensure_method_data() should return
    false is loading resulted in empty state
    + JDK-8264173: [s390] Improve Hardware Feature Detection And
    Reporting
    + JDK-8264190: Harden TLS interop tests
    + JDK-8264223: CodeHeap::verify fails extra_hops assertion in
    fastdebug test
    + JDK-8264328: Broken license in
    javax/swing/JComboBox/8072767/bug8072767.java
    + JDK-8264360: Loop strip mining verification fails with
    "should be on the backedge"
    + JDK-8264626: C1 should be able to inline excluded methods
    + JDK-8264640: CMS ParScanClosure misses a barrier
    + JDK-8264786: [macos] All Swing/AWT apps cause Allow
    Notifications prompt to appear when app is launched
    + JDK-8264821: DirectIOTest fails on a system with large block
    size
    + JDK-8264848: [macos] libjvm.dylib linker warning due to macOS
    version mismatch
    + JDK-8264923: PNGImageWriter.write_zTXt throws Exception with
    a typo
    + JDK-8264958: C2 compilation fails with assert "n is later
    than its clone"
    + JDK-8265099: Revert backport to 11u of 8236859: WebSocket
    over authenticating proxy fails with NPE
    + JDK-8265154: vinserti128 operand mix up for KNL platforms
    + JDK-8265239: Shenandoah: Shenandoah heap region count could
    be off by 1
    + JDK-8265417: Backport of JDK-8249672 breaks Solaris x86 build
    + JDK-8265421: java/lang/String/StringRepeat.java test is
    missing a memory requirement
    + JDK-8265462: Handle multiple slots in the NSS Internal Module
    from SunPKCS11's Secmod
    + JDK-8265537: x86 version string truncated after JDK-8249672
    11u backport
    + JDK-8265666: Enable AIX build platform to make external debug
    symbols
    + JDK-8265677: CMS: CardTableBarrierSet::write_ref_array_work()
    lacks storestore barrier
    + JDK-8265690: Use the latest Ubuntu base image version in
    Docker testing
    + JDK-8265718: Build failure after JDK-8258414 11u backport
    + JDK-8265750: Fatal error in safepoint.cpp after backport of
    8258414
    + JDK-8265784: [C2] Hoisting of DecodeN leaves MachTemp inputs
    behind
    + JDK-8265938: C2's conditional move optimization does not
    handle top Phi
    + JDK-8266220: keytool still prompt for store password on a
    password-less pkcs12 file if -storetype pkcs12 is specified
    + JDK-8266293: Key protection using PBEWithMD5AndDES fails with
    "java.security.InvalidAlgorithmParameterException: Salt must
    be 8 bytes long"
    + JDK-8266713: [AIX] Build failure after 11u backport of
    JDK-8247753
    + JDK-8266802: Shenandoah: Round up region size to page size
    unconditionally
    + JDK-8266892: avoid maybe-uninitialized gcc warnings on linux
    s390x
    + JDK-8266929: Unable to use algorithms from 3p providers
    + JDK-8267235: [macos_aarch64]
    InterpreterRuntime::throw_pending_exception messing up LR
    results in crash
    + JDK-8267561: Shenandoah: Reference processing not properly
    setup for outside of cycle degenerated GC
    + JDK-8267599: Revert the change to the default PKCS12
    macAlgorithm and macIterationCount props for 11u/8u/7u
    + JDK-8267641: [11u] 8227609 backport typo
    + JDK-8267721: Enable sun/security/pkcs11 tests for Amazon
    Linux 2 AArch64
    + JDK-8268678: LetsEncryptCA.java test fails as Let's Encrypt
    Authority X3 is retired</changelog>
  <changelog author="schwab@suse.de" date="1628078400">- riscv64-zero.patch: Add support for riscv64 (zero VM)</changelog>
  <changelog author="fstrba@suse.com" date="1629979200">- Added patch:
  * jdk11-glibc234.patch
    + fix build with glibc-2.34 (bsc#1189201)</changelog>
  <changelog author="fstrba@suse.com" date="1631534400">- Modified patch:
  * nss-security-provider.patch
    + revert recent changes making NSS provider the default one
    + fixes bsc#1190252</changelog>
  <changelog author="fstrba@suse.com" date="1631793600">- Added patch:
  * fips.patch
    + implement FIPS support in OpenJDK</changelog>
  <changelog author="fstrba@suse.com" date="1634817600">- Update to upstream tag jdk-11.0.13+8 (October 2021 CPU)
  * Security fixes
    + JDK-8163326, CVE-2021-35550, bsc#1191901: Update the default
    enabled cipher suites preference
    + JDK-8254967, CVE-2021-35565, bsc#1191909:
    com.sun.net.HttpsServer spins on TLS session close
    + JDK-8263314: Enhance XML Dsig modes
    + JDK-8265167, CVE-2021-35556, bsc#1191910: Richer Text Editors
    + JDK-8265574: Improve handling of sheets
    + JDK-8265580, CVE-2021-35559, bsc#1191911: Enhanced style for
    RTF kit
    + JDK-8265776: Improve Stream handling for SSL
    + JDK-8266097, CVE-2021-35561, bsc#1191912: Better hashing
    support
    + JDK-8266103: Better specified spec values
    + JDK-8266109: More Resilient Classloading
    + JDK-8266115: More Manifest Jar Loading
    + JDK-8266137, CVE-2021-35564, bsc#1191913: Improve Keystore
    integrity
    + JDK-8266689, CVE-2021-35567, bsc#1191903: More Constrained
    Delegation
    + JDK-8267086: ArrayIndexOutOfBoundsException in
    java.security.KeyFactory.generatePublic
    + JDK-8267712: Better LDAP reference processing
    + JDK-8267729, CVE-2021-35578, bsc#1191904: Improve TLS client
    handshaking
    + JDK-8267735, CVE-2021-35586, bsc#1191914: Better BMP support
    + JDK-8268193: Improve requests of certificates
    + JDK-8268199: Correct certificate requests
    + JDK-8268205: Enhance DTLS client handshake
    + JDK-8268506: More Manifest Digests
    + JDK-8269618, CVE-2021-35603, bsc#1191906: Better session
    identification
    + JDK-8269624: Enhance method selection support
    + JDK-8270398: Enhance canonicalization
    + JDK-8270404: Better canonicalization
  * Other changes
    + JDK-8024368: private methods are allocated vtable indices
    + JDK-8042902: Test java/net/Inet6Address/serialize/
    /Inet6AddressSerializationTest.java fails intermittently
    + JDK-8140466: ChaCha20 and Poly1305 TLS Cipher Suites
    + JDK-8157404: Unable to read certain PKCS12 keystores from
    SequenceInputStream
    + JDK-8158066: SourceDebugExtensionTest fails to rename file
    + JDK-8168304: Make all of DependencyContext_test available in
    product mode
    + JDK-8169246: java/net/DatagramSocket/ReportSocketClosed.java
    fails intermittently with BindException
    + JDK-8181313: SA: Remove libthread_db dependency on Linux
    + JDK-8193214: Incorrect annotations.without.processors
    warnings with JDK 9
    + JDK-8194230: jdk/internal/jrtfs/remote/
    /RemoteRuntimeImageTest.java fails with
    java.lang.NullPointerException
    + JDK-8196092: javax/swing/JComboBox/8032878/bug8032878.java
    fails
    + JDK-8199931: java/net/MulticastSocket/
    /UnreferencedMulticastSockets.java fails with "incorrect data
    received"
    + JDK-8206083: Make tools/javac/api/T6265137.java robust to JDK
    version changes
    + JDK-8206350: java/util/Locale/bcp47u/SystemPropertyTests.java
    failed on Mac 10.13 with zh_CN and zh_TW locales.
    + JDK-8207316: java/nio/channels/spi/SelectorProvider/
    /inheritedChannel/InheritedChannelTest.java failed
    + JDK-8208227: tools/jdeps/DotFileTest.java fails on Win-X64
    + JDK-8208363: test/jdk/java/lang/Package/
    /PackageFromManifest.java missing module dependencies
    declaration
    + JDK-8209380: ARM: cleanup maybe-uninitialized and reorder
    compiler warnings
    + JDK-8209768: Refactor java/util/prefs/CheckUserPrefsStorage.sh
    to plain java test
    + JDK-8209772: Refactor shell test java/util/ServiceLoader/
    /basic/basic.sh to java
    + JDK-8209773: Refactor shell test javax/naming/module/basic.sh
    to java
    + JDK-8209832: Refactor jdk/internal/reflect/Reflection/
    /GetCallerClassTest.sh to plain java test
    + JDK-8209930: Refactor java/util/zip/ZipFile/deletetempjar.sh
    to plain java test
    + JDK-8210406: Refactor java.util.PluggableLocale:i18n shell
    tests to plain java tests
    + JDK-8210407: Refactor java.util.Calendar:i18n shell tests to
    plain java tests
    + JDK-8210495: compiler crashes because of illegal signature in
    otherwise legal code
    + JDK-8210669: Some launcher tests assume a pre-JDK 9 run-time
    image layout
    + JDK-8210802: temp files left by tests in
    jdk/java/net/httpclient
    + JDK-8210819: Update the host name in CNameTest.java
    + JDK-8210908: Refactor java/util/prefs/PrefsSpi.sh to plain
    java test
    + JDK-8210934: Move sun/net/www/protocol/http/
    /GetErrorStream.java to OpenJDK
    + JDK-8210959: JShell fails and exits when statement throws an
    exception whose message contains a '%'.
    + JDK-8211055: Provide print to a file (PDF) feature even when
    printer was not connected
    + JDK-8211092: test/jdk/sun/net/www/http/HttpClient/
    /MultiThreadTest.java fails intermittently when cleaning up
    + JDK-8211296: Remove HotSpot deprecation warning suppression
    for Mac/clang
    + JDK-8211325: test/jdk/java/net/Socket/LingerTest.java fails
    with cleaning up
    + JDK-8212040: Compilation error due to wrong usage of
    NSPrintJobDispositionValue in mac10.12
    + JDK-8212695: Add explicit timeout to several HTTP Client tests
    + JDK-8212718: Refactor some annotation processor tests to
    better use collections
    + JDK-8213007: Update the link in test/jdk/sun/security/
    /provider/SecureRandom/DrbgCavp.java
    + JDK-8213137: Remove static initialization of monitor/mutex
    instances
    + JDK-8213235: java/nio/channels/SocketChannel/
    /AsyncCloseChannel.java fails with threads that didn't exit
    + JDK-8213409: Refactor sun.text.IntHashtable:i18n shell tests
    to plain java tests
    + JDK-8213576: Make test AsyncCloseChannel.java run in othervm
    + JDK-8213694: Test Timeout.java should run in othervm mode
    + JDK-8213718: [TEST] Wrong classname in vmTestbase/nsk/stress/
    /except/except002 and except003
    + JDK-8213922: fix ctw stand-alone build
    + JDK-8214195: Align stdout messages in
    test/jdk/java/math/BigInteger/PrimitiveConversionTests.java
    + JDK-8214520: [TEST_BUG] sun/security/mscapi/nonUniqueAliases/
    /NonUniqueAliases.java failed with incorrect jtreg tags order
    + JDK-8214937: sun/security/tools/jarsigner/warnings/
    /NoTimestampTest.java failed due to unexpected expiration date
    + JDK-8216532: tools/launcher/Test7029048.java fails (Solaris)
    + JDK-8217825: Verify @AfterTest is used correctly in WebSocket
    tests
    + JDK-8218145: block_if_requested is not proper inlined due to
    size
    + JDK-8219417: bump jtreg requiredVersion to b14
    + JDK-8219552: bump jtreg requiredVersion to b14 in
    test/jdk/sanity/client/
    + JDK-8219804: java/net/MulticastSocket/Promiscuous.java fails
    intermittently due to NumberFormatException
    + JDK-8220445: Support for side by side MSVC Toolset versions
    + JDK-8221988: add possibility to build with Visual Studio 2019
    + JDK-8222751: closed/test/jdk/sun/security/util/
    /DerIndefLenConverter/IndefBerPkcs12.java fail
    + JDK-8223050: JVMCI: findUniqueConcreteMethod() should not use
    Dependencies::find_unique_concrete_method() for non-virtual
    methods
    + JDK-8224853: CDS address sanitizer errors
    + JDK-8225082: Remove IdenTrust certificate that is expiring in
    September 2021
    + JDK-8225583: Examine the HttpResponse.BodySubscribers for
    null handling and multiple subscriptions
    + JDK-8225690: Multiple AttachListener threads can be created
    + JDK-8225790: Two NestedDialogs tests fail on Ubuntu
    + JDK-8226319: Add forgotten test/jdk/java/net/httpclient/
    /BodySubscribersTest.java
    + JDK-8226533: JVMCI: findUniqueConcreteMethod should handle
    statically bindable methods directly
    + JDK-8226602: Test convenience reactive primitives from
    java.net.http with RS TCK
    + JDK-8226683: Remove review suggestion from fix to 8219804
    + JDK-8227738: jvmti/DataDumpRequest/datadumpreq001 failed due
    to "exit code is 134"
    + JDK-8227766: CheckUnhandledOops is broken in MemAllocator
    + JDK-8227815: Minimal VM: set_state is not a member of
    AttachListener
    + JDK-8230674: Heap dumps should exclude dormant CDS archived
    objects of unloaded classes
    + JDK-8230808: Remove Access::equals()
    + JDK-8230841: Remove oopDesc::equals()
    + JDK-8231717: Improve performance of charset decoding when
    charset is always compactable
    + JDK-8232243: Wrong caret position in JTextPane on Windows
    with a screen resolution &gt; 100%
    + JDK-8232782: Shenandoah: streamline post-LRB CAS barrier
    (aarch64)
    + JDK-8233790: Forward output from heap dumper to jcmd/jmap
    + JDK-8233989: Create an IPv4 version of
    java/net/MulticastSocket/SetLoopbackMode.java
    + JDK-8234510: Remove file seeking requirement for writing a
    heap dump
    + JDK-8235211: serviceability/attach/
    /RemovingUnixDomainSocketTest.java fails with
    AttachNotSupportedException: Unable to open socket file
    + JDK-8235216: typo in test filename
    + JDK-8235866: bump jtreg requiredVersion to 4.2b16
    + JDK-8236111: narrow allowSmartActionArgs disabling
    + JDK-8236413: AbstractConnectTimeout should tolerate both
    NoRouteToHostException and UnresolvedAddressException
    + JDK-8236671: NullPointerException in JKS keystore
    + JDK-8238930: problem list compiler/c2/Test8004741.java
    + JDK-8238943: switch to jtreg 5.0
    + JDK-8240555: Using env of JAVA_TOOL_OPTIONS and _JAVA_OPTIONS
    breaks QuietOption.java test
    + JDK-8240983: Incorrect copyright header in Apache Santuario
    2.1.3 files
    + JDK-8241336: Some java.net tests failed with
    NoRouteToHostException on MacOS with special network
    configuration
    + JDK-8241353: NPE in ToolProvider.getSystemJavaCompiler
    + JDK-8241768: git needs .gitattributes
    + JDK-8242882: opening jar file with large manifest might throw
    NegativeArraySizeException
    + JDK-8244973: serviceability/attach/
    /RemovingUnixDomainSocketTest.java fails "stderr was not
    empty"
    + JDK-8245134: test/lib/jdk/test/lib/security/
    /KeyStoreUtils.java should allow to specify aliases
    + JDK-8246261: TCKLocalTime.java failed due to "AssertionError:
    expected [18:14:22] but found [18:14:23]"
    + JDK-8246387: switch to jtreg 5.1
    + JDK-8247421: [TESTBUG] ReturnBlobToWrongHeapTest.java failed
    allocating blob
    + JDK-8247469: getSystemCpuLoad() returns -1 on linux when some
    offline cpus are present and cpusets.effective_cpus is not
    available
    + JDK-8248352: [TEST_BUG] Test test/jdk/java/awt/font/
    /TextLayout/ArabicDiacriticTest.java can leave frame open
    + JDK-8248403: AArch64: Remove uses of kernel integer types
    + JDK-8248414: AArch64: Remove uses of long and unsigned long
    ints
    + JDK-8248657: Windows: strengthening in ThreadCritical
    regarding memory model
    + JDK-8248666: AArch64: Use THREAD_LOCAL instead of __thread
    + JDK-8248668: AArch64: Avoid MIN/MAX macros when using MSVC
    + JDK-8248671: AArch64: Remove unused variables
    + JDK-8248682: AArch64: Use ATTRIBUTE_ALIGNED helper
    + JDK-8248816: C1: Fix signature conflict in
    LIRGenerator::strength_reduce_multiply
    + JDK-8249095: tools/javac/launcher/SourceLauncherTest.java
    fails on Windows
    + JDK-8249548: backward focus traversal gets stuck in button
    group
    + JDK-8249773: Upgrade ReceiveISA.java test to be resilient to
    failure due to stray packets and interference
    + JDK-8249897: jdk/javadoc/tool/LangVers.java uses @ignore w/o
    bug-id
    + JDK-8249898: jdk/javadoc/tool/6176978/T6176978.java uses
    @ignore w/o bug-id
    + JDK-8249899: jdk/javadoc/tool/InlineTagsWithBraces.java uses
    @ignore w/o bug-id
    + JDK-8250588: Shenandoah: LRB needs to save/restore fp
    registers for runtime call
    + JDK-8250824: AArch64: follow up for JDK-8248414
    + JDK-8251166: Add automated testcases for changes done in
    JDK-8214112
    + JDK-8251252: Add automated testcase for fix done in
    JDK-8214253
    + JDK-8251254: Add automated test for fix done in JDK-8218472
    + JDK-8251361: Potential race between Logger configuration and
    GCs in HttpURLConWithProxy test
    + JDK-8251549: Update docs on building for Git
    + JDK-8251945: SIGSEGV in
    PackageEntry::purge_qualified_exports()
    + JDK-8252194: Add automated test for fix done in JDK-8218469
    + JDK-8252648: Shenandoah: name gang tasks consistently
    + JDK-8252825: Add automated test for fix done in JDK-8218479
    + JDK-8252853: AArch64: gc/shenandoah/TestVerifyJCStress.java
    fails intermittently with C1
    + JDK-8252857: AArch64: Shenandoah C1 CAS is not sequentially
    consistent
    + JDK-8253048: AArch64: When CallLeaf, no need to preserve
    callee-saved registers in caller
    + JDK-8253424: Add support for running pre-submit testing using
    GitHub Actions
    + JDK-8253631: Remove unimplemented CompileBroker methods after
    JEP-165
    + JDK-8253865: Pre-submit testing using GitHub Actions does not
    detect failures reliably
    + JDK-8253899: Make IsClassUnloadingEnabled signature match
    specification
    + JDK-8254024: Enhance native libs for AWT and Swing to work
    with GraalVM Native Image
    + JDK-8254054: Pre-submit testing using GitHub Actions should
    not use the deprecated set-env command
    + JDK-8254173: Add Zero, Minimal hotspot targets to submit
    workflow
    + JDK-8254175: Build no-pch configuration in debug mode for
    submit checks
    + JDK-8254244: Some code emitted by TemplateTable::branch is
    unused when running TieredCompilation
    + JDK-8254270: linux 32 bit build doesn't compile
    libjdwp/log_messages.c
    + JDK-8254282: Add Linux x86_32 builds to submit workflow
    + JDK-8254850: Update terminology in java.awt.GridBagLayout
    source code comments
    + JDK-8255255: Update Apache Santuario (XML Signature) to
    version 2.2.1
    + JDK-8255305: Add Linux x86_32 tier1 to submit workflow
    + JDK-8255352: Archive important test outputs in submit workflow
    + JDK-8255373: Submit workflow artifact name is always
    "test-results_.zip"
    + JDK-8255452: Doing GC during JVMTI MethodExit event posting
    breaks return oop
    + JDK-8255718: Zero: VM should know it runs in interpreter-only
    mode
    + JDK-8255790: GTKL&amp;F: Java 16 crashes on initialising GTKL&amp;F
    on Manjaro Linux
    + JDK-8255810: Zero: build fails without JVMTI
    + JDK-8255895: Submit workflow artifacts miss hs_errs/replays
    due to ZIP include mismatch
    + JDK-8256127: Add cross-compiled foreign architectures builds
    to submit workflow
    + JDK-8256215: Shenandoah: re-organize saving/restoring machine
    state in assembler code
    + JDK-8256267: Relax compiler/floatingpoint/NaNTest.java for
    x86_32 and lower -XX:+UseSSE
    + JDK-8256277: Github Action build on macOS should define OS
    and Xcode versions
    + JDK-8256354: Github Action build on Windows should define OS
    and MSVC versions
    + JDK-8256393: Github Actions build on Linux should define OS
    and GCC versions
    + JDK-8256414: add optimized build to submit workflow
    + JDK-8256747: GitHub Actions: decouple the hotspot build-only
    jobs from Linux x64 testing
    + JDK-8257056: Submit workflow should apt-get update to avoid
    package installation errors
    + JDK-8257148: Remove obsolete code in AWTView.m
    + JDK-8257497: Update keytool to create AKID from the SKID of
    the issuing certificate as specified by RFC 5280
    + JDK-8257620: Do not use objc_msgSend_stret to get macOS
    version
    + JDK-8257913: Add more known library locations to simplify
    Linux cross-compilation
    + JDK-8258703: Incorrect 512-bit vector registers restore on
    x86_32
    + JDK-8259338: Add expiry exception for identrustdstx3 alias to
    VerifyCACerts.java test
    + JDK-8259535: ECDSA SignatureValue do not always have the
    specified length
    + JDK-8259679: GitHub actions should use MSVC 14.28
    + JDK-8259924: GitHub actions fail on Linux x86_32 with "Could
    not configure libc6:i386"
    + JDK-8260460: GitHub actions still fail on Linux x86_32 with
    "Could not configure libc6:i386"
    + JDK-8260589: Crash in JfrTraceIdLoadBarrier::load(_jclass*)
    + JDK-8260923: Add more tests for SSLSocket input/output
    shutdown
    + JDK-8261072: AArch64: Fix MacroAssembler::get_thread
    convention
    + JDK-8261147: C2: Node is wrongly marked as reduction
    resulting in a wrong execution due to wrong vector instructions
    + JDK-8261238: NMT should not limit baselining by size threshold
    + JDK-8261496: Shenandoah: reconsider pacing updates memory
    ordering
    + JDK-8261652: Remove some dead comments from os_bsd_x86
    + JDK-8261846: [JVMCI] c2v_iterateFrames can get out of sync
    with the StackFrameStream
    + JDK-8262000: jdk/jfr/event/gc/detailed/
    /TestPromotionFailedEventWithParallelScavenge.java failed with
    "OutOfMemoryError: Java heap space"
    + JDK-8262017: C2: assert(n != __null) failed: Bad immediate
    dominator info.
    + JDK-8262392: Update Mesa 3-D Headers to version 21.0.3
    + JDK-8262409: sun/security/ssl/SSLSocketImpl/
    /SSLSocketImplThrowsWrongExceptions. SSL test failures caused
    by java failed with "Server reported the wrong exception"
    + JDK-8262470: Printed GlyphVector outline with low DPI has bad
    quality on Windows
    + JDK-8262862: Harden tests sun/security/x509/URICertStore/
    /ExtensionsWithLDAP.java and krb5/canonicalize/Test.java
    + JDK-8263136: C4530 was reported from VS 2019 at access bridge
    + JDK-8263227: C2: inconsistent spilling due to dead nodes in
    exception block
    + JDK-8263382: java/util/logging/ParentLoggersTest.java failed
    with "checkLoggers: getLoggerNames() returned unexpected
    loggers"
    + JDK-8263407: SPARC64 detection fails on Athena (SPARC64-X)
    + JDK-8263432: javac may report an invalid package/class clash
    on case insensitive filesystems
    + JDK-8263490: [macos] Crash occurs on JPasswordField with
    activated InputMethod
    + JDK-8263531: Remove unused buffer int
    + JDK-8263667: Avoid running GitHub actions on branches named
    pr/*
    + JDK-8263776: [JVMCI] add helper to perform Java upcalls
    + JDK-8264016: [JVMCI] add some thread local fields for use by
    JVMCI
    + JDK-8264752: SIGFPE crash with option
    FlightRecorderOptions:threadbuffersize=30M
    + JDK-8265132: C2 compilation fails with assert "missing
    precedence edge"
    + JDK-8265231: (fc) ReadDirect and WriteDirect tests fail after
    fix for JDK-8264821
    + JDK-8265335: Epsilon: Minor typo in EpsilonElasticTLABDecay
    description
    + JDK-8265756: AArch64: initialize memory allocated for locals
    according to Windows AArch64 stack page growth requirement in
    template interpreter
    + JDK-8265761: Font with missed font family name is not
    properly printed on Windows
    + JDK-8265773: incorrect jdeps message "jdk8internals" to
    describe a removed JDK internal API
    + JDK-8265836: OperatingSystemImpl.getCpuLoad() returns
    incorrect CPU load inside a container
    + JDK-8266018: Shenandoah: fix an incorrect assert
    + JDK-8266206: Build failure after JDK-8264752 with older GCCs
    + JDK-8266248: Compilation failure in
    PLATFORM_API_MacOSX_MidiUtils.c with Xcode 12.5
    + JDK-8266288: assert root method not found in
    witnessed_reabstraction_in_supers is too strong
    + JDK-8266404: Fatal error report generated with
  - XX:+CrashOnOutOfMemoryError should not contain suggestion to
    submit a bug report
    + JDK-8266480: Implicit null check optimization does not update
    control of hoisted memory operation
    + JDK-8266615: C2 incorrectly folds subtype checks involving an
    interface array
    + JDK-8266642: Improve ResolvedMethodTable hash function
    + JDK-8266749: AArch64: Backtracing broken on PAC enabled
    systems
    + JDK-8266761: AssertionError in
    sun.net.httpserver.ServerImpl.responseCompleted
    + JDK-8266813: Shenandoah: Use shorter instruction sequence for
    checking if marking in progress
    + JDK-8267042: bug in monitor locking/unlocking on ARM32 C1 due
    to uninitialized BasicObjectLock::_displaced_header
    + JDK-8267348: Rewrite gc/epsilon/TestClasses.java to use
    Metaspace with less classes
    + JDK-8267396: Avoid recording "pc" in unhandled oops detector
    for better performance
    + JDK-8267399: C2: java/text/Normalizer/ConformanceTest.java
    test failed with assertion
    + JDK-8267424: CTW: C1 fails with "State must not be null"
    + JDK-8267459: Pasting Unicode characters into JShell does not
    work.
    + JDK-8267625: AARCH64: typo in LIR_Assembler::emit_profile_type
    + JDK-8267666: Add option to jcmd GC.heap_dump to use existing
    file
    + JDK-8267695: Bump update version for OpenJDK: jdk-11.0.13
    + JDK-8267751: (test) jtreg.SkippedException has no serial
    VersionUID
    + JDK-8267773: PhaseStringOpts::int_stringSize doesn't handle
    min_jint correctly
    + JDK-8268103: JNI functions incorrectly return a double after
    JDK-8265836
    + JDK-8268127: Shenandoah: Heap size may be too small for
    region to align to large page size
    + JDK-8268261: C2: assert(n != __null) failed: Bad immediate
    dominator info.
    + JDK-8268347: C2: nested locks optimization may create
    unbalanced monitor enter/exit code
    + JDK-8268360: Missing check for infinite loop during node
    placement
    + JDK-8268362: [REDO] C2 crash when compile negative
    Arrays.copyOf length after loop
    + JDK-8268366: Incorrect calculation of has_fpu_registers in C1
    linear scan
    + JDK-8268369: SIGSEGV in PhaseCFG::implicit_null_check due to
    missing null check
    + JDK-8268417: Add test from JDK-8268360
    + JDK-8268427: Improve AlgorithmConstraints:checkAlgorithm
    performance
    + JDK-8268617: [11u REDO] - WebSocket over authenticating proxy
    fails with NPE
    + JDK-8268620: InfiniteLoopException test may fail on x86
    platforms
    + JDK-8268635: Corrupt oop in ClassLoaderData
    + JDK-8268699: Shenandoah: Add test for JDK-8268127
    + JDK-8268771: javadoc -notimestamp option does not work on
    index.html
    + JDK-8268775: Password is being converted to String in
    AccessibleJPasswordField
    + JDK-8268776: Test `ADatagramSocket.java` missing /othervm
    from @run tag
    + JDK-8268965: TCP Connection Reset when connecting simple
    socket to SSL server
    + JDK-8269304: Regression ~5% in 2005 in b27
    + JDK-8269415: [11u] Remove ea from
    DEFAULT_PROMOTED_VERSION_PRE in OpenJDK 11u
    + JDK-8269478: Shenandoah: gc/shenandoah/mxbeans tests should
    be more resilient
    + JDK-8269529: javax/swing/reliability/
    /HangDuringStaticInitialization.java fails in Windows debug
    build
    + JDK-8269594: assert(_handle_mark_nesting &gt; 1) failed: memory
    leak: allocating handle outside HandleMark
    + JDK-8269614: [s390] Interpreter checks wrong bit for slow
    path instance allocation
    + JDK-8269650: Optimize gc-locker in
    [Get|Release]StringCritical for latin string
    + JDK-8269661: JNI_GetStringCritical does not lock char array
    + JDK-8269668: [aarch64] java.library.path not including
    /usr/lib64
    + JDK-8269763: The JEditorPane is blank after JDK-8265167
    + JDK-8269795: C2: Out of bounds array load floats above its
    range check in loop peeling resulting in SEGV
    + JDK-8269847: JDK-8269594 backport breaks 11u builds
    + JDK-8269850: Most JDK releases report macOS version 12 as
    10.16 instead of 12.0
    + JDK-8269851: OperatingSystemMXBean getProcessCpuLoad reports
    incorrect process cpu usage in containers
    + JDK-8269882: stack-use-after-scope in NewObjectA
    + JDK-8269934: RunThese24H.java failed with
    EXCEPTION_ACCESS_VIOLATION in
    java_lang_Thread::get_thread_status
    + JDK-8270096: Shenandoah: Optimize gc/shenandoah/
    /TestRefprocSanity.java for interpreter mode
    + JDK-8270137: Kerberos Credential Retrieval from Cache not
    Working in Cross-Realm Setup
    + JDK-8270184: [TESTBUG] Add coverage for jvmci
    ResolvedJavaType.toJavaName() for lambdas
    + JDK-8270196: [11u] [JVMCI] JavaType.toJavaName() returns
    incorrect type name for lambdas
    + JDK-8270556: Exclude security/infra/java/security/cert/
    /CertPathValidator/certification/LetsEncryptCA
    + JDK-8270893: IndexOutOfBoundsException while reading large
    TIFF file
    + JDK-8272078: Wrong Checksums in Temurin BootJDK dependencies
    + JDK-8272124: Cgroup v1 initialization causes
    NullPointerException when cgroup path contains colon
    + JDK-8272131: PhaseMacroExpand::generate_slow_arraycopy crash
    when clone null CallProjections.fallthrough_ioproj
    + JDK-8272197: Update 11u GHA workflow with Shenandoah
    configurations
    + JDK-8272332: --with-harfbuzz=system doesn't add -lharfbuzz
    after JDK-8255790
    + JDK-8272472: StackGuardPages test doesn't build with glibc
    2.34
    + JDK-8272602: [macos] not all KEY_PRESSED events sent when
    control modifier is used
    + JDK-8272628: Problemlist gc/stress/gcbasher/
    /TestGCBasherWithCMS.java for x86_32
    + JDK-8272700: [macos] Build failure with Xcode 13.0 after
    JDK-8264848
    + JDK-8272772: Shenandoah: compiler/c2/aarch64/
    /TestVolatilesShenandoah.java fails in 11u
    + JDK-8273939: Backport of 8248414 to JDK11 breaks
    MacroAssembler::adrp
- Remove the unneeded icedtea-sound provider
- Removed patches:
  * icedtea-sound-1.0.1-jdk9.patch
  * icedtea-sound-soundproperties.patch
    + not needed since the icedtea-sound provider is removed
  * jdk11-glibc234.patch
    + integrated upstream</changelog>
  <changelog author="fstrba@suse.com" date="1635940800">- Modified patches:
  * system-crypto-policy.patch
    + rediff to changed context
  * fips.patch
    + Allow plain key import in fips mode unless
    com.suse.fips.plainKeySupport is set to false</changelog>
  <changelog author="fstrba@suse.com" date="1636113600">- Modified patch:
  * fips.patch
    + return in native code after generating java.io.IOException</changelog>
</package>
<package pkgid="c98e058c476c05a1a45ec748fe13bfeaec2b5a7cc2411a2e45c2d1fba04a314a" name="java-11-openjdk-demo" arch="aarch64">
  <version epoch="0" ver="11.0.13.0" rel="3.68.1"/>
  <changelog author="fstrba@suse.com" date="1586952000">- The pack200 and unpack200 alternatives should be slaves of java
  and not of javac, since they are part of JRE.</changelog>
  <changelog author="fstrba@suse.com" date="1587470400">- Update to upstream tag jdk-11.0.7+10 (April 2020 CPU,
  bsc#1169511)
  * Security fixes:
    + S8223898, CVE-2020-2754: Forward references to Nashorn
    + S8223904, CVE-2020-2755: Improve Nashorn matching
    + S8224541, CVE-2020-2756: Better mapping of serial ENUMs
    + S8224549, CVE-2020-2757: Less Blocking Array Queues
    + S8225603: Enhancement for big integers
    + S8226346: Build better binary builders
    + S8227467: Better class method invocations
    + S8227542: Manifest improved jar headers
    + S8229733: TLS message handling improvements
    + S8231415, CVE-2020-2773: Better signatures in XML
    + S8231785: Improved socket permissions
    + S8232424, CVE-2020-2778: More constrained algorithms
    + S8232581, CVE-2020-2767: Improve TLS verification
    + S8233250: Better X11 rendering
    + S8233410: Better Build Scripting
    + S8234027: Better JCEKS key support
    + S8234408, CVE-2020-2781: Improve TLS session handling
    + S8234825, CVE-2020-2800: Better Headings for HTTP Servers
    + S8234841, CVE-2020-2803: Enhance buffering of byte buffers
    + S8235274, CVE-2020-2805: Enhance typing of methods
    + S8235691, CVE-2020-2816: Enhance TLS connectivity
    + S8236201, CVE-2020-2830: Better Scanner conversions
    + S8238960: linux-i586 builds are inconsistent as the newly
    built jdk is not able to reserve enough space for object heap
  * Other changes:
    + S4919790: Errors in alert ssl message does not reflect the
    actual certificate status
    + S4949105: Access Bridge lacks html tags parsing
    + S7092821: java.security.Provider.getService() is synchronized
    and became scalability bottleneck
    + S7143743: Potential memory leak with zip provider
    + S8005819: Support cross-realm MSSFU
    + S8042383: [TEST_BUG] Test javax/swing/plaf/basic/BasicMenuUI/
    /4983388/bug4983388.java fails with shortcuts on menus do not
    work
    + S8068184: Fix for JDK-8032832 caused a deadlock
    + S8145845: [AOT] NullPointerException in
    compiler/whitebox/GetCodeHeapEntriesTest.java
    + S8152988: [AOT] Update test batch definitions to include
    aot-ed java.base module mode into hs-comp testing
    + S8160926: FLAGS_COMPILER_CHECK_ARGUMENTS doesn't handle
    cross-compilation
    + S8163083: SocketListeningConnector does not allow invocations
    with port 0
    + S8163251: Hard coded loop limit prevents reading of smart
    card data greater than 8k
    + S8167276: jvmci/compilerToVM/MaterializeVirtualObjectTest.java
    fails with -XX:-EliminateAllocations
    + S8169718: nsk/jdb/locals/locals002: ERROR: Cannot find
    boolVar with expected value: false
    + S8176556:
    java/awt/dnd/ImageTransferTest/ImageTransferTest.java fails
    for JFIF
    + S8178798: Two compiler/aot/verification/vmflags tests fail by
    timeout with UseAVX=3
    + S8183107: PKCS11 regression regarding checkKeySize
    + S8185005: Improve performance of
    ThreadMXBean.getThreadInfo(long ids[], int maxDepth)
    + S8189633: Missing -Xcheck:jni checking for DeleteWeakGlobalRef
    + S8189861: Refactor CacheFind
    + S8193042: NativeLookup::lookup_critical_entry() should only
    load shared library once
    + S8193596: java/net/DatagramPacket/ReuseBuf.java failed due to
    timeout
    + S8194944: Regression automated test 'open/test/jdk/javax/
    /swing/JInternalFrame/8145896/TestJInternalFrameMaximize.java'
    fails
    + S8196467: javax/swing/JInternalFrame/Test6325652.java fails
    + S8196969: JTreg Failure: serviceability/sa/ClhsdbJstack.java
    causes NPE
    + S8198321: javax/swing/JEditorPane/5076514/bug5076514.java
    fails
    + S8198398: Test javax/swing/JColorChooser/Test6199676.java
    fails in mach5
    + S8199072: Test javax/swing/GroupLayout/6613904/
    /bug6613904.java is unstable
    + S8200432: javadoc fails with ClassCastException on {@link
    byte[]}
    + S8201349: build broken when configured with
  - -with-zlib=bundled on gcc 7.3
    + S8201355: Avoid native memory allocation in
    sun.security.mscapi.PRNG.generateSeed
    + S8201513: nsk/jvmti/IterateThroughHeap/filter-* are broken
    + S8203364: Some serviceability/sa/ tests intermittently fail
    with java.io.IOException: LingeredApp terminated with non-zero
    exit code 3
    + S8203687: javax/net/ssl/compatibility/Compatibility.java
    supports TLS 1.3
    + S8203904: javax/swing/JSplitPane/4816114/bug4816114.java: The
    divider location is wrong
    + S8203911: Test runtime/modules/getModuleJNI/GetModule fails
    with -Xcheck:jni
    + S8204525: [TESTBUG] runtime/NMT/MallocStressTest.java ran out
    of java heap
    + S8204529: gc/TestAllocateHeapAtMultiple.java fail with Agent
    7 timed out
    + S8204551: Event descriptions are truncated in logs
    + S8206963: [AOT] bug with multiple class loaders
    + S8207367: 10 vmTestbase/nsk/jdi tests timed out when running
    with jtreg
    + S8207832: serviceability/sa/ClhsdbCDSCore.java failed with
    "Couldn't find core file location"
    + S8207938: At step6,Click Add button,case failed automatically.
    + S8208157: requires.VMProps throws NPE for missing properties
    in "release" file
    + S8208379: compiler/jvmci/events/
    /JvmciNotifyInstallEventTest.java failed with "Got unexpected
    event count after 2nd install attempt: expected 9 to equal 2"
    + S8208658: Make CDS archived heap regions usable even if
    compressed oop encoding has changed
    + S8208715: Conversion of milliseconds to nanoseconds in
    UNIXProcess contains bug
    + S8209361: [AOT] Unexpected number of references for
    JVMTI_HEAP_REFERENCE_CONSTANT_POOL [111--&gt;111]: 0 (expected
    at least 1)
    + S8209385: CDS runtime classpath checking is too strict when
    only classes from the system modules are archived
    + S8209389: SIGSEGV in WalkOopAndArchiveClosure::do_oop_work.
    + S8209418: Synchronize test/jdk/sanity/client/lib/jemmy with
    code-tools/jemmy/v2
    + S8209494: Create a test for SwingSet InternalFrameDemo
    + S8209499: Create test for SwingSet EditorPaneDemo
    + S8209574: [AOT] breakpoint events are generated in different
    threads does not meet expected count
    + S8209686: cleanup arguments to PhaseIdealLoop() constructor
    + S8209789: Synchronize test/jdk/sanity/client/lib/jemmy with
    code-tools/jemmy/v2
    + S8209802: Garbage collectors should register JFR types
    themselves to avoid build errors.
    + S8209807: improve handling exception in requires.VMProps
    + S8209817: stack is executable when building with Clang on
    Linux
    + S8209824: Improve the code coverage for ThreadLocal
    + S8209826: Undefined reference to os::write after JDK-8209657
    (filemap.hpp cleanup)
    + S8209850: Allow NamedThreads to use GlobalCounter critical
    sections
    + S8209976: Improve iteration over non-JavaThreads
    + S8209993: Create a test for SwingSet3 ToolTipDemo
    + S8210024: JFR calls virtual is_Java_thread from ~Thread()
    + S8210052: Enable testing for all the available look and feels
    in SwingSet3 demo tests
    + S8210055: Enable different look and feel tests in SwingSet3
    demo tests
    + S8210057: Enable different look and feels in SwingSet3 demo
    test InternalFrameDemoTest
    + S8210058: Algorithmic Italic font leans opposite angle in
    Printing
    + S8210220: [AOT] jdwp test cases are failing with error #
    ERROR: TEST FAILED: Cought IOException while receiving event
    packet
    + S8210289: ArchivedKlassSubGraphInfoRecord is incomplete
    + S8210459: Add support for generating compile_commands.json
    + S8210476: sun/security/mscapi/PrngSlow.java fails with Still
    too slow
    + S8210512: [Testbug] vmTestbase/nsk/jdi/ObjectReference/
    /referringObjects/referringObjects002/referringObjects002.java
    fails with unexpected size of
    ClassLoaderReference.referringObjects
    + S8210523: runtime/appcds/cacheObject/DifferentHeapSizes.java
    crash
    + S8210632: Add key exchange algorithm to
    javax/net/ssl/TLSCommon/CipherSuite.java
    + S8210699: Problem list tests which times out in Xcomp mode
    + S8210793: [JVMCI] AllocateCompileIdTest.java failed to find
    DiagnosticCommand.class
    + S8210910: Create test for FileChooserDemo
    + S8210994: Create test for SwingSet3 FrameDemo
    + S8211139: Increase timeout value in all tests under
    jdk/sanity/client/SwingSet/src
    + S8211160: Handle different look and feels in
    JInternalFrameOperator
    + S8211211: vmTestbase/metaspace/stressDictionary/
    /StressDictionary.java timeout
    + S8211322: Reduce the timeout of tooltip in SwingSet2DemoTest
    + S8211443: Enable different look and feels in SwingSet3 demo
    test SplitPaneDemoTest
    + S8211703: JInternalFrame : java.lang.AssertionError: cannot
    find the internal frame
    + S8211781: re-building fails after changing Graal sources
    + S8212897: Some improvements in the EditorPaneDemotest
    + S8212903: [TestBug] Tests test/jdk/javax/swing/LookAndFeel/
    /8145547/DemandGTK2.sh and DemandGTK3.sh fail on Ubuntu 18.04
    LTS
    + S8213009: Refactoring existing SunMSCAPI classes
    + S8213010: Supporting keys created with certmgr.exe
    + S8213168: Enable different look and feel tests in SwingSet3
    demo test FileChooserDemoTest
    + S8213348: jdk.internal.vm.compiler.management service
    providers missing in module descriptor
    + S8213906: Update arm devkits with libXrandr headers
    + S8213908: AssertionError in DeferredAttr at setOverloadKind
    + S8214124: [TESTBUG] Bugs in runtime/NMT/MallocStressTest.java
    + S8214344: C2: assert(con.basic_type() != T_ILLEGAL) failed:
    elembt=byte; loadbt=void; unsigned=0
    + S8214345: infinite recursion while checking super class
    + S8214471: Enable different look and feel tests in SwingSet3
    demo test ToolTipDemoTest
    + S8214534: Setting of THIS_FILE in the build is broken
    + S8214557: Filter out VM flags which don't affect AOT code
    generation
    + S8214578: [macos] Problem with backslashes on macOS/JIS
    keyboard: Java ignores system settings
    + S8214840: runtime/NMT/MallocStressTest.java timed out
    + S8214850: Rename vm_operations.?pp files to vmOperations.?pp
    files
    + S8214904: Test8004741.java failed due to "Too few ThreadDeath
    hits; expected at least 6 but saw only 5"
    + S8215322: add @file support to jaotc
    + S8215355: Object monitor deadlock with no threads holding the
    monitor (using jemalloc 5.1)
    + S8215396: JTabbedPane preferred size calculation is wrong for
    SCROLL_TAB_LAYOUT
    + S8216180: [AOT] compiler/intrinsics/bigInteger/TestMulAdd.java
    crashed with AOT enabled
    + S8216353: Use utility APIs introduced in org/netbeans/jemmy/
    /util/LookAndFeel class in client sanity test cases
    + S8216354: Syntax error in toolchain_windows.m4
    + S8216472: (se) Stack overflow during selection operation
    leads to crash (win)
    + S8216535: tools/jimage/JImageExtractTest.java timed out
    + S8217235: Create automated test for SwingSet
    ColorChooserDemoTest
    + S8217297: Add support for multiple look and feel for SwingSet
    SliderDemoTest
    + S8217338: [Containers] Improve systemd slice memory limit
    support
    + S8217613: [AOT] TEST_OPTS_AOT_MODULES doesn't work on mac
    + S8217634: RunTest documentation and usability update
    + S8217717: ZGC: Broken oop map in C1 load barrier stub
    + S8217728: Speed up incremental rerun of "make hotspot"
    + S8218268: Javac treats Manifest Class-Path entries as Paths
    instead of URLs
    + S8218662: Allow 204 responses with Content-Length:0
    + S8218882: NET_Writev is declared, NET_WriteV is defined
    + S8218889: Improperly use of the Optional API
    + S8219205: JFR file without license header
    + S8219597: (bf) Heap buffer state changes could provoke
    unexpected exceptions
    + S8219723: javax/net/ssl/compatibility/Compatibility.java
    failed on some SNI cases
    + S8220348: [ntintel] asserts about copying unaligned array
    + S8220451: jdi/EventQueue/remove/remove004 failed due to
    "ERROR: thread2 is not alive"
    + S8220456: jdi/EventQueue/remove_l/remove_l004 failed due to
    "TIMEOUT while waiting for event"
    + S8220479: java/nio/channels/Selector/SelectWithConsumer.java
    failed at testTwoChannels()
    + S8220613: java/util/Arrays/TimSortStackSize2.java times out
    with fastdebug build
    + S8220688: [TESTBUG] runtime/NMT/MallocStressTest.java timed
    out
    + S8220786: Create new switch to redirect error reporting
    output to stdout or stderr
    + S8221270: Duplicated synchronized keywords in SSLSocketImpl
    + S8221312: test/jdk/sanity/client/SwingSet/src/
    /ColorChooserDemoTest.java failed
    + S8221851: Use of THIS_FILE in hotspot invalidates precompiled
    header on Linux/GCC
    + S8221885: Add intermittent test in the JavaSound to the
    ProblemList
    + S8222264: Windows incremental build is broken with JDK-8217728
    + S8222391: javax/net/ssl/compatibility/Compatibility.java
    should be more flexible
    + S8222448: java/lang/reflect/PublicMethods/
    /PublicMethodsTest.java times out
    + S8222519: ButtonDemoScreenshotTest fails randomly with "still
    state to be reached"
    + S8222741: jdi/EventQueue/remove/remove004 fails due to
    VMDisconnectedException
    + S8223003: SunMSCAPI keys are not cleaned up
    + S8223063: Support CNG RSA keys
    + S8223158: Docked MacBook cannot start any Java Swing
    applications
    + S8223260: NamingManager should cache InitialContextFactory
    + S8223464: Improve version string for Oracle CI builds
    + S8223558: Java does not render Myanmar script correctly
    + S8223627: jdk-13+20 bundle name contains null instead of ea
    + S8223638: Replace wildcard address with loopback or local
    host in tests - part 6
    + S8223678: Add Visual Studio Code workspace generation support
    (for native code)
    + S8223727: com/sun/jndi/ldap/privconn/RunTest.java failed due
    to hang in LdapRequest.getReplyBer
    + S8223769: Assert triggers with -XX:+StressReflectiveCode
    + S8224187: Refactor arraycopy_prologue to allow ZGC read
    barriers on arraycopy
    + S8224475: JTextPane does not show images in HTML rendering
    + S8224673: Adjust permission for delayed starting of debugging
    + S8224705: Tests that need to be problem-listed or have
    printer resources
    + S8224778: test/jdk/demo/jfc/J2Ddemo/J2DdemoTest.java cannot
    find J2Ddemo.jar
    + S8224821: java/awt/Focus/NoAutotransferToDisabledCompTest/
    /NoAutotransferToDisabledCompTest.java fails linux-x64
    + S8224830: test/jdk/java/awt/Focus/
    /ModalExcludedWindowClickTest/
    /ModalExcludedWindowClickTest.java fails on linux-x64
    + S8224851: AArch64: fix warnings and errors with Clang and GCC
    8.3
    + S8224905: java/lang/ProcessBuilder/Basic.java#id1 failed with
    stream closed
    + S8225007: java/awt/print/PrinterJob/
    /LandscapeStackOverflow.java may hang
    + S8225105: java/awt/Focus/ShowFrameCheckForegroundTest/
    /ShowFrameCheckForegroundTest.java fails in Windows 10
    + S8225117: java/math/BigInteger/SymmetricRangeTests.java fails
    with ParseException
    + S8225128: Add exception for expiring DocuSign root to
    VerifyCACerts test
    + S8225130: Add exception for expiring Comodo roots to
    VerifyCACerts test
    + S8225144: [macos] In Aqua L&amp;F backspace key does not delete
    when Shift is pressed
    + S8225180: SignedObject with invalid Key not throwing the
    InvalidKeyException in Windows
    + S8225182: JNI exception pending in DestroyXIMCallback of
    awt_InputMethod.c:1327
    + S8225199: [Graal] compiler/jvmci/compilerToVM/
    /IsMatureVsReprofileTest.java fails with
  - XX:CompileThresholdScaling=0.1
    + S8225305: ProblemList java/lang/invoke/VarHandles tests
    + S8225350: compiler/jvmci/compilerToVM/IsCompilableTest.java
    timed out
    + S8225430: Replace wildcard address with loopback or local
    host in tests - part 14
    + S8225435: Upgrade IANA Language Subtag Registry to the latest
    for JDK14
    + S8225487: giflib legal file is missing attribution for
    openbsd-reallocarray.c
    + S8225567: Wrong file headers with 8202414 fix changeset
    + S8225684: [AOT] vmTestbase/vm/oom/production/
    /AlwaysOOMProduction tests fail with AOTed java.base
    + S8225766: Curve in certificate should not affect signature
    scheme when using TLSv1.3
    + S8225797: OldObjectSample event creates unexpected amount of
    checkpoint data
    + S8226381: ProblemList java/lang/reflect/PublicMethods/
    /PublicMethodsTest.java
    + S8226406: JVM fails to detect mismatched or corrupt CDS
    archive
    + S8226608: Hide the onjcmd option from the help output
    + S8226892: ActionListeners on JRadioButtons don't get notified
    when selection is changed with arrow keys
    + S8227112: exclude compiler/intrinsics/sha/sanity tests from
    AOT runs
    + S8227324: Upgrade to freetype 2.10.1
    + S8227528: TestAbortVMOnSafepointTimeout.java failed due to
    "RuntimeException: 'Safepoint sync time longer than' missing
    from stdout/stderr"
    + S8227645: Some tests in serviceability/sa run with fixed -Xmx
    values and risk running out of memory
    + S8227646: [TESTBUG] appcds/SharedArchiveConsistency timed out
    + S8227662: freetype seeks to index at the end of the font data
    + S8228479: Correct the format of ColorChooserDemoTest
    + S8228613: java.security.Provider#getServices order is no
    longer deterministic
    + S8228969: 2019-09-28 public suffix list update
    + S8229236: CriticalJNINatives: dll handling should be done in
    native thread state
    + S8229345: Memory leak due to vtable stubs not being shared on
    SPARC
    + S8229888: (zipfs) Updating an existing zip file does not
    preserve original permissions
    + S8229994: assert(false) failed: Bad graph detected in
    get_early_ctrl_for_expensive
    + S8230004: jdk/internal/jimage/JImageOpenTest.java runs no test
    + S8230235: Rendering HTML with empty img attribute and
    documentBaseKey cause Exception
    + S8230390: Problemlist SA tests with AOT
    + S8230400: Missing constant pool entry for a method in
    stacktrace
    + S8230459: Test failed to resume JVMCI CompilerThread
    + S8230480: check malloc/calloc results in java.desktop
    + S8230597: Update GIFlib library to the 5.2.1
    + S8230611: infinite loop in
    LogOutputList::wait_until_no_readers()
    + S8230624: [TESTBUG] Problemlist JFR
    compiler/TestCodeSweeper.java
    + S8230677: Should disable Escape Analysis if JVMTI capability
    can_get_owned_monitor_info was taken
    + S8230926: [macosx] Two apostrophes are entered instead of one
    with "U.S. International - PC" layout
    + S8231025: Incorrect method tag offset for big endian platform
    + S8231081: TestMetadataRetention fails due to missing symbol id
    + S8231387: java.security.Provider.getService returns random
    result due to race condition with mutating methods in the same
    class
    + S8231430: C2: Memory stomp in max_array_length() for
    T_ILLEGAL type
    + S8231445: check ZALLOC return values in awt coding
    + S8231507: Update Apache Santuario (XML Signature) to version
    2.1.4
    + S8231584: Deadlock with ClassLoader.findLibrary and
    System.loadLibrary call
    + S8231753: use more Posix functionality in aix
    os::print_os_info
    + S8231810: javax/net/ssl/templates/
    /SSLSocketSSLEngineTemplate.java fails intermittently with
    "java.lang.Exception: Unexpected EOF"
    + S8232003: (fs) Files.write can leak file descriptor in the
    exception case
    + S8232056: GetOwnedMonitorInfoWithEATest.java fails with ZGC:
    Heap too small
    + S8232060: add some initializations using sigemptyset in
    os_aix.cpp
    + S8232154: Update Mesa 3-D Headers to version 19.2.1
    + S8232167: Visual Studio install found through
  - -with-tools-dir value is discarded
    + S8232170: FSInfo#getJarClassPath throws an exception not
    declared in its throws clause
    + S8232200: [macos 10.15] Windows in fullscreen tests jumps
    around the screen
    + S8232207: Linux os::available_memory re-reads cgroup
    configuration on every invocation
    + S8232224: [TESTBUG] problemlist JFR TestLargeRootSet.java
    + S8232370: Refactor some com.sun.jdi tests to enable IDE
    integration
    + S8232433: [macos 10.15] java/awt/Window/
    /LocationAtScreenCorner/LocationAtScreenCorner.java may fail
    + S8232571: Add missing SIGINFO signal
    + S8232692: [TESTBUG] compiler/aot/fingerprint/
    /SelfChangedCDS.java fails when cds is disabled
    + S8232713: Update BCEL version to 6.3.1 in license file
    + S8232806: Introduce a system property to disable eager lambda
    initialization
    + S8232834: RunTest sometimes fails to produce valid
    exitcode.txt
    + S8232880: Update test documentation with additional settings
    for client UI tooltip tests
    + S8232950: SUNPKCS11 Provider incorrectly check key length for
    PSS Signatures.
    + S8233018: Add a new test to verify that DatagramSocket is not
    interruptible
    + S8233019: java.lang.Class.isPrimitive() (C1) returns wrong
    result if Klass* is aligned to 32bit
    + S8233032: assert(in_bb(n)) failed: must be
    + S8233078: fix minimal VM build on Linux ppc64(le)
    + S8233328: fix minimal VM build on Linux s390x
    + S8233383: Various minor fixes
    + S8233466: aarch64: remove unnecessary load of mdo when
    profiling return and parameters type
    + S8233491: Crash in AdapterHandlerLibrary::get_adapter with
    CDS due to code cache exhaustion
    + S8233529: loopTransform.cpp:2984: Error: assert(p_f-&gt;Opcode()
    == Op_IfFalse) failed
    + S8233548: Update CUP to v0.11b
    + S8233649: Update ProblemList.txt to exclude failing headful
    tests on macos
    + S8233656: assert(d-&gt;is_CFG() &amp;&amp; n-&gt;is_CFG()) failed: must
    have CFG nodes
    + S8233657: Intermittent NPE in Component.validate()
    + S8234288: Turkey Time Zone returns incorrect time zone name
    + S8234323: NULL-check return value of SurfaceData_InitOps on
    macosx
    + S8234339: replace JLI_StrTok in java_md_solinux.c
    + S8234340: Bump update version for OpenJDK: jdk-11.0.7
    + S8234350: assert(mode == ControlAroundStripMined &amp;&amp; (use ==
    sfpt || !use-&gt;is_reachable_from_root())) failed: missed a node
    + S8234386: [macos] NPE was thrown at expanding Choice from
    maximized frame
    + S8234397: add OS uptime information to os::print_os_info
    output
    + S8234423: Modifying ArrayList.subList().subList() resets
    modCount of subList
    + S8234466: Class loading deadlock involving
    X509Factory#commitEvent()
    + S8234501: remove obsolete NET_ReadV
    + S8234525: enable link-time section-gc for linux s390x to
    remove unused code
    + S8234610: MaxVectorSize set wrongly when UseAVX=3 is
    specified after JDK-8221092
    + S8234617: C1: Incorrect result of field load due to missing
    narrowing conversion
    + S8234723: javax/net/ssl/TLS tests support TLSv1.3
    + S8234724: javax/net/ssl/templates/
    /SSLSocketSSLEngineTemplate.java supports TLSv1.3
    + S8234741: enhance os::get_core_path on macOS
    + S8234769: Duplicate attribution in freetype.md
    + S8234786: Fix for JDK-8214578 breaks OS X 10.12 compatibility
    + S8234809: set relro in linker flags when building with gcc
    + S8234824: java/nio/channels/SocketChannel/AdaptSocket.java
    fails on Windows 10
    + S8235243: handle VS2017 15.9 and VS2019 in abstract_vm_version
    + S8235288: AVX 512 instructions inadvertently used on Xeon for
    small vector width operations
    + S8235325: build failure on Linux after 8235243
    + S8235383: C1 compilation fails with
  - XX:+PrintIRDuringConstruction -XX:+Verbose
    + S8235489: handle return values of sscanf calls in hotspot
    + S8235509: Backport for JDK-8209657 Refactor filemap.hpp to
    simplify integration with Serviceability Agent.
    + S8235510: java.util.zip.CRC32 performance drop after 8200067
    + S8235563: [TESTBUG] appcds/CommandLineFlagComboNegative.java
    does not handle archive mapping failure
    + S8235637: jhsdb jmap from OpenJDK 11.0.5 doesn't work if
    prelink is enabled
    + S8235671: enhance print_rlimit_info in os_posix
    + S8235744: PIT: test/jdk/javax/swing/text/html/
    /TestJLabelWithHTMLText.java times out in linux-x64
    + S8235904: Infinite loop when rendering huge lines
    + S8235998: [c2] Memory leaks during tracing after '8224193:
    stringStream should not use Resource Area'.
    + S8236039: JSSE Client does not accept status_request
    extension in CertificateRequest messages for TLS 1.3
    + S8236140: assert(!VerifyHashTableKeys || _hash_lock == 0)
    failed: remove node from hash table before modifying it
    + S8236179: C1 register allocation error with T_ADDRESS
    + S8236488: Support for configure option
  - -with-native-debug-symbols=internal is impossible on Windows
    + S8236500: Windows ucrt.dll should be looked up in versioned
    WINSDK subdirectory
    + S8236709: struct SwitchRange in HS violates C++ One
    Definition Rule
    + S8236848: [JDK 11u] make run-test-tier1 fails after backport
    of JDK-8232834
    + S8236873: Worker has a deadlock bug
    + S8237217: Incorrect G1StringDedupEntry type used in
    StringDedupTable destructor
    + S8237368: Problem with NullPointerException in RMI
    TCPEndpoint.read
    + S8237375: SimpleThresholdPolicy misses CounterDecay timestamp
    initialization
    + S8237508: Simplify JarFile.isInitializing
    + S8237540: Missing files in backport of JDK-8210910
    + S8237541: Missing files in backport of JDK-8236528
    + S8237600: Test SunJSSEFIPSInit fails on Ubuntu
    + S8237819: s390x - remove unused pd_zero_to_words_large
    + S8237869: exclude jtreg test security/infra/java/security/
    /cert/CertPathValidator/certification/LuxTrustCA.java because
    of instabilities
    + S8237879: make 4.3 breaks build
    + S8237945: CTW: C2 compilation fails with
    assert(just_allocated_object(alloc_ctl) == ptr) failed: most
    recent allo...
    + S8238225: Issues reported after replacing symlink at
    Contents/MacOS/libjli.dylib with binary
    + S8238247: CTW runner should sweep nmethods more aggressively
    + S8238366: CTW runner closes standard output on exit
    + S8238438: SuperWord::co_locate_pack picks memory state of
    first instead of last load
    + S8238502: sunmscapi.dll causing EXCEPTION_ACCESS_VIOLATION
    + S8238534: Deep sign macOS bundles before bundle archive is
    being created
    + S8238591: CTW: Split
    applications/ctw/modules/jdk_localedata.java
    + S8238596: AVX enabled by default for Skylake even when
    unsupported
    + S8238811: C2: assert(i &gt;= req() || i == 0 || is_Region() ||
    is_Phi()) with -XX:+VerifyGraphEdges
    + S8239005: [TESTBUG] test/hotspot/jtreg/runtime/
    /StackGuardPages/TestStackGuardPages.java: exeinvoke.c: must
    initialize static state before calling do_overflow()
    + S8239466: Loss of precision in counter decay calculation in
    11u backport of JDK-8237375
    + S8239856: [ntintel] asserts about copying unaligned array
    element
    + S8240724: [test] jdk11 downport of 8224475 misses binary file
    test/jdk/javax/swing/JTextPane/arrow.png
    + S8241296: Segfault in JNIHandleBlock::oops_do()
- Removed patch:
  * DependOnVariableHelper.patch
    + fixed upstream
- Added patch:
  * JDK-8228407.patch
    + fix crashes due to shared archive file mismatch</changelog>
  <changelog author="fstrba@suse.com" date="1594900800">- Update to upstream tag jdk-11.0.8+10 (July 2020 CPU, bsc#1174157)
  * Security fixes:
    + JDK-8230613: Better ASCII conversions
    + JDK-8231800: Better listing of arrays
    + JDK-8232014: Expand DTD support
    + JDK-8233234: Better Zip Naming
    + JDK-8233239, CVE-2020-14562: Enhance TIFF support
    + JDK-8233255: Better Swing Buttons
    + JDK-8234032: Improve basic calendar services
    + JDK-8234042: Better factory production of certificates
    + JDK-8234418: Better parsing with CertificateFactory
    + JDK-8234836: Improve serialization handling
    + JDK-8236191: Enhance OID processing
    + JDK-8236867, CVE-2020-14573: Enhance Graal interface handling
    + JDK-8237117, CVE-2020-14556: Better ForkJoinPool behavior
    + JDK-8237592, CVE-2020-14577: Enhance certificate verification
    + JDK-8238002, CVE-2020-14581: Better matrix operations
    + JDK-8238013: Enhance String writing
    + JDK-8238804: Enhance key handling process
    + JDK-8238842: AIOOBE in GIFImageReader.initializeStringTable
    + JDK-8238843: Enhanced font handing
    + JDK-8238920, CVE-2020-14583: Better Buffer support
    + JDK-8238925: Enhance WAV file playback
    + JDK-8240119, CVE-2020-14593: Less Affine Transformations
    + JDK-8240482: Improved WAV file playback
    + JDK-8241379: Update JCEKS support
    + JDK-8241522: Manifest improved jar headers redux
    + JDK-8242136, CVE-2020-14621: Better XML namespace handling
  * Other changes:
    + JDK-6933331: (d3d/ogl) java.lang.IllegalStateException:
    Buffers have not been created
    + JDK-7124307: JSpinner and changing value by mouse
    + JDK-8022574: remove HaltNode code after uncommon trap calls
    + JDK-8039082: [TEST_BUG] Test
    java/awt/dnd/BadSerializationTest/BadSerializationTest.java
    fails
    + JDK-8040630: Popup menus and tooltips flicker with previous
    popup contents when first shown
    + JDK-8044365: (dc) MulticastSendReceiveTests.java failing with
    ENOMEM when joining group (OS X 10.9)
    + JDK-8048215: [TESTBUG]
    java/lang/management/ManagementFactory/ThreadMXBeanProxy.java
    Expected non-null LockInfo
    + JDK-8051349: nsk/jvmti/scenarios/sampling/SP06/sp06t003 fails
    in nightly
    + JDK-8080353: JShell: Better error message on attempting to
    add default method
    + JDK-8139876: Exclude hanging nsk/stress/stack from execution
    with deoptimization enabled
    + JDK-8146090: java/lang/ref/ReachabilityFenceTest.java fails
    with -XX:+DeoptimizeALot
    + JDK-8153430: jdk regression test MletParserLocaleTest,
    ParserInfiniteLoopTest reduce default timeout
    + JDK-8156207: Resource allocated BitMaps are often cleared
    unnecessarily
    + JDK-8159740: JShell: corralled declarations do not have
    correct source to wrapper mapping
    + JDK-8175984: ICC_Profile has un-needed, not-empty finalize
    method
    + JDK-8176359: Frame#setMaximizedbounds not working properly in
    multi screen environments
    + JDK-8183369: RFC unconformity of HttpURLConnection with proxy
    + JDK-8187078: -XX:+VerifyOops finds numerous problems when
    running JPRT
    + JDK-8189861: Refactor CacheFind
    + JDK-8191169: java/net/Authenticator/B4769350.java failed
    intermittently
    + JDK-8191930: [Graal] emits unparseable XML into compile log
    + JDK-8193879: Java debugger hangs on method invocation
    + JDK-8196019: java/awt/Window/Grab/GrabTest.java fails on
    Windows
    + JDK-8196181: sun/java2d/GdiRendering/InsetClipping.java fails
    + JDK-8198000:
    java/awt/List/EmptyListEventTest/EmptyListEventTest.java
    debug assert on Windows
    + JDK-8198001: java/awt/Menu/WrongParentAfterRemoveMenu/
    /WrongParentAfterRemoveMenu.java debug assert on Windows
    + JDK-8198339: Test javax/swing/border/Test6981576.java is
    unstable
    + JDK-8200701: jdk/jshell/ExceptionsTest.java fails on Windows,
    after JDK-8198801
    + JDK-8203264: JNI exception pending in
    PlainDatagramSocketImpl.c:740
    + JDK-8203672: JNI exception pending in PlainSocketImpl.c
    + JDK-8203673: JNI exception pending in
    DualStackPlainDatagramSocketImpl.c:398
    + JDK-8204834: Fix confusing "allocate" naming in OopStorage
    + JDK-8205399: Set node color on pinned HashMap.TreeNode
    deletion
    + JDK-8205653: test/jdk/sun/management/jmxremote/bootstrap/
    /RmiRegistrySslTest.java and RmiSslBootstrapTest.sh fail with
    handshake_failure
    + JDK-8206179: com/sun/management/OperatingSystemMXBean/
    /GetCommittedVirtualMemorySize.java fails with Committed
    virtual memory size illegal value
    + JDK-8207334: VM times out in VM_HandshakeAllThreads::doit()
    with RunThese30M
    + JDK-8208277: Code cache heap (-XX:ReservedCodeCacheSize)
    doesn't work with 1GB LargePages
    + JDK-8209113: Use WeakReference for lastFontStrike for created
    Fonts
    + JDK-8209333: Socket reset issue for TLS 1.3 socket close
    + JDK-8209439: C2 library_call can potentially ignore Math.pow
    intrinsic or use null pointer
    + JDK-8209534: [TESTBUG]runtime/appcds/cacheObject/
    /ArchivedModuleCompareTest.java fails with EnableJVMCI.
    + JDK-8210147: adjust some WSAGetLastError usages in windows
    network coding
    + JDK-8210284: "assert((av &amp; 0x00000001) == 0) failed:
    unsupported V8" on Solaris 11.4
    + JDK-8210303: VM_HandshakeAllThreads fails assert with
    "failed: blocked and not walkable"
    + JDK-8210459: Add support for generating compile_commands.json
    + JDK-8210515: [TESTBUG]CheckArchivedModuleApp.java needs to
    check if EnableJVMCI is set.
    + JDK-8210788: Javadoc for Thread.join(long, int) should
    specify that it waits forever when both arguments are zero
    + JDK-8211301: [macos] support full window content options
    + JDK-8211332: Space for stub routines (code_size2) is too
    small on new Skylake CPUs
    + JDK-8211339: NPE during SSL handshake caused by
    HostnameChecker
    + JDK-8211392: compiler/profiling/
    /spectrapredefineclass_classloaders/Launcher.java times out
    in JDK12 CI
    + JDK-8211743: [AOT] crash in ScopeDesc::decode_body() when
    JVMTI walks AOT frames
    + JDK-8212154: [TESTBUG] CheckArchivedModuleApp fails with NPE
    when JVMCI is absent
    + JDK-8212167: JShell : Stack trace of exception has wrong line
    number
    + JDK-8212933: Thread-SMR: requesting a VM operation whilst
    holding a ThreadsListHandle can cause deadlocks
    + JDK-8212986: Make Visual Studio compiler check less strict
    + JDK-8213250: CDS archive creation aborts due to metaspace
    object allocation failure
    + JDK-8213516: jck test api/javax_accessibility/AccessibleState/
    /fields.html fails intermittent
    + JDK-8213947: ARM32: failed check_simd should set
    UsePopCountInstruction to false
    + JDK-8214418: half-closed SSLEngine status may cause
    application dead loop
    + JDK-8214440: ldap over a TLS connection negotiate failed with
    "javax.net.ssl.SSLPeerUnverifiedException: hostname of the
    server does not match the hostname in the server's
    certificate"
    + JDK-8214444: Wrong strncat limits in dfa.cpp
    + JDK-8214481: freetype path does not disable TrueType hinting
    with AA+FM hints
    + JDK-8214571: -Xdoclint of array serialField gives "error:
    array type not allowed here"
    + JDK-8214856: Errors with JSZip in web console after upgrade
    to 3.1.5
    + JDK-8214862: assert(proj != __null) at compile.cpp:3251
    + JDK-8215369: Jcstress pollute /var/tmp with temporary files.
    + JDK-8215551: Missing case label in nmethod::reloc_string_for()
    + JDK-8215555: TieredCompilation C2 threads can excessively
    block handshakes
    + JDK-8215711: Missing key_share extension for (EC)DHE key
    exchange should alert missing_extension
    + JDK-8216151: [Graal] Module
    jdk.internal.vm.compiler.management has not been granted
    accessClassInPackage.org.graalvm.compiler.debug
    + JDK-8216154: C4819 warnings at HotSpot sources on Windows
    + JDK-8216541: CompiledICHolders of VM locked unloaded nmethods
    are released too late
    + JDK-8217230: assert(t == t_no_spec) failure in
    NodeHash::check_no_speculative_types()
    + JDK-8217404: --with-jvm-features doesn't work when multiple
    features are explicitly disabled
    + JDK-8217447: Develop flag TraceICs is broken
    + JDK-8217606: LdapContext#reconnect always opens a new
    connection
    + JDK-8218807: Compilation database (compile_commands.json) may
    contain obsolete items
    + JDK-8219214: Infinite Loop in CodeSection::dump()
    + JDK-8219904: ClassCastException when calling
    FlightRecorderMXBean#getRecordings()
    + JDK-8219991: New fix of the deadlock in
    sun.security.ssl.SSLSocketImpl
    + JDK-8221121: applications/microbenchmarks are encountering
    crashes in tier5
    + JDK-8221445: FastSysexMessage constructor crashes MIDI
    receiption thread
    + JDK-8221482: Initialize VMRegImpl::regName[] earlier to
    prevent assert during PrintStubCode
    + JDK-8221741: ClassCastException can happen when
    fontconfig.properties is used
    + JDK-8221823: Requested JDialog width is ignored
    + JDK-8223108: Test java/awt/EventQueue/
    /NonComponentSourcePost.java is unstable
    + JDK-8223678: Add Visual Studio Code workspace generation
    support (for native code)
    + JDK-8223935: PIT: java/awt/font/WindowsIndicFonts.java fails
    on windows10
    + JDK-8224109: Text spaced incorrectly by drawString under
    rotation with fractional metric
    + JDK-8224632: testbug: java/awt/dnd/RemoveDropTargetCrashTest/
    /RemoveDropTargetCrashTest.java fails on MacOS
    + JDK-8224793: os::die() does not honor CreateCoredumpOnCrash
    option
    + JDK-8224847: gc/stress/TestReclaimStringsLeaksMemory.java
    fails with reserved greater than expected
    + JDK-8224931: disable JAOTC invokedynamic support until
    8223533 is fixed
    + JDK-8224997: ChaCha20-Poly1305 TLS cipher suite decryption
    throws ShortBufferException
    + JDK-8225068: Remove DocuSign root certificate that is
    expiring in May 2020
    + JDK-8225069: Remove Comodo root certificate that is expiring
    in May 2020
    + JDK-8225126: Test SetBoundsPaintTest.html faild on Windows
    when desktop is scaled
    + JDK-8225325: Add tests for redefining a class' private method
    during resolution of the bootstrap specifier
    + JDK-8225622: [AOT] runtime/SharedArchiveFile/
    /TestInterpreterMethodEntries.java crashed with AOTed
    java.base
    + JDK-8225653: Provide more information when hitting SIGILL
    from HaltNode
    + JDK-8225783: Incorrect use of binary operators on booleans in
    type.cpp
    + JDK-8225789: Empty method parameter type should generate
    ClassFormatError
    + JDK-8226198: use of &amp; instead of &amp;&amp; in
    LibraryCallKit::arraycopy_restore_alloc_state
    + JDK-8226253: JAWS reports wrong number of radio buttons when
    buttons are hidden.
    + JDK-8226653: [accessibility] Can edit text cell correctly,
    but Accessibility Tool reads nothing about editor
    + JDK-8226806: [macOS 10.14] Methods of Java Robot should be
    called from appropriate thread
    + JDK-8226879: Memory leak in Type::hashcons
    + JDK-8227632: Incorrect PrintCompilation message: made not
    compilable on levels 0 1 2 3 4
    + JDK-8228407: JVM crashes with shared archive file mismatch
    + JDK-8228482: fix xlc16/xlclang comparison of distinct pointer
    types and string literal conversion warnings
    + JDK-8228757: Fail fast if the handshake type is unknown
    + JDK-8229158: make UseSwitchProfiling non-experimental or
    false by-default
    + JDK-8229421: The logic of java/net/ipv6tests/TcpTest.java is
    flawed
    + JDK-8229855: C2 fails with assert(false) failed: bad AD file
    + JDK-8230591: AArch64: Missing intrinsics for Math.ceil,
    floor, rint
    + JDK-8231118: ARM32: Math tests failures
    + JDK-8231213: Migrate SimpleDateFormatConstTest to JDK Repo
    + JDK-8231243: [TESTBUG] CustomFont.java cannot find font file
    + JDK-8231438: [macOS] Dark mode for the desktop is not
    supported
    + JDK-8231550: C2: ShouldNotReachHere() in
    verify_strip_mined_scheduling
    + JDK-8231564: setMaximizedBounds is broken with large display
    scale and multiple monitors
    + JDK-8231572: Use -lobjc instead of -fobjc-link-runtime in
    libosxsecurity
    + JDK-8231631: sun/net/ftp/FtpURLConnectionLeak.java fails
    intermittently with NPE
    + JDK-8231671: Fix copyright headers in hotspot (missing comma
    after year)
    + JDK-8231720: Some perf regressions after 8225653
    + JDK-8231779: crash
    HeapWord*ParallelScavengeHeap::failed_mem_allocate
    + JDK-8231863: Crash if classpath is read from @argument file
    and the main gets option argument
    + JDK-8232080: jlink plugins for vendor information and
    run-time options
    + JDK-8232106: [x86] C2: SIGILL due to usage of SSSE3
    instructions on processors which don't support it
    + JDK-8232134: Change to Visual Studio 2017 15.9.16 for
    building on Windows at Oracle
    + JDK-8232226: [macos 10.15] test/jdk/java/awt/color/
    /EqualityTest/EqualityTest.java may fail
    + JDK-8232357: Compare version info of Santuario to legal notice
    + JDK-8232572: Add hooks for custom output dir in Bundles.gmk
    + JDK-8232634: Problem List ICMColorDataTest.java
    + JDK-8232748: Build static versions of certain JDK libraries
    + JDK-8232846: ProcessHandle.Info command with non-English
    shows question marks
    + JDK-8232880: Update test documentation with additional
    settings for client UI tooltip tests
    + JDK-8233033: C2 produces wrong result while unswitching a
    loop due to lost control dependencies
    + JDK-8233137: runtime/ErrorHandling/VeryEarlyAssertTest.java
    fails after 8232080
    + JDK-8233197: Invert JvmtiExport::post_vm_initialized() and
    Jfr:on_vm_start() start-up order for correct option parsing
    + JDK-8233291: [TESTBUG] tools/jlink/plugins/
    /VendorInfoPluginsTest.java fails with debug or non-server VMs
    + JDK-8233364: Fix undefined behavior in
    Canonicalizer::do_ShiftOp
    + JDK-8233494: Avoid calling MallocTracker::record_malloc and
    record_free when NMT is off
    + JDK-8233573: Toolkit.getScreenInsets(GraphicsConfiguration)
    may throw ClassCastException
    + JDK-8233608: Minimal build broken after JDK-8233494
    + JDK-8233621: Mismatch in jsse.enableMFLNExtension property
    name
    + JDK-8233696: [TESTBUG]Some jtreg tests fail when CAPS_LOCK is
    ON
    + JDK-8233707: systemScale.cpp could not compile with VS2019
    + JDK-8233801: GCMEmptyIv.java test fails on Solaris 11.4
    + JDK-8233880: Support compilers with multi-digit major version
    numbers
    + JDK-8233920: MethodHandles::tryFinally generates illegal
    bytecode for long/double return type
    + JDK-8234137: The "AutoTestOnTop.java" test may run external
    applications
    + JDK-8234146: compiler/jsr292/
    /ContinuousCallSiteTargetChange.java times out on SPARC
    + JDK-8234184: [TESTBUG] java/awt/Mouse/EnterExitEvents/
    /ModalDialogEnterExitEventsTest.java fails in Windows
    + JDK-8234270: [REDO] JDK-8204128 NMT might report incorrect
    numbers for Compiler area
    + JDK-8234332: [TESTBUG] java/awt/Focus/DisposedWindow/
    /DisposeDialogNotActivateOwnerTest/
    /DisposeDialogNotActivateOwnerTest.java fails on linux-x64
    nightly
    + JDK-8234398: Replace ID2D1Factory::GetDesktopDpi with
    GetDeviceCaps
    + JDK-8234522: [macos] Crash with use of native file dialog
    + JDK-8234691: Potential double-free in ParallelSPCleanupTask
    constructor
    + JDK-8234696: tools/jlink/plugins/VendorInfoPluginsTest.java
    times out
    + JDK-8234727: sun/security/ssl/X509TrustManagerImpl tests
    support TLSv1.3
    + JDK-8234728: Some security tests should support TLSv1.3
    + JDK-8234779: Provide idiom for declaring classes noncopyable
    + JDK-8234824: java/nio/channels/SocketChannel/AdaptSocket.java
    fails on Windows 10
    + JDK-8234968: check calloc rv in libinstrument
    InvocationAdapter
    + JDK-8235153: [TESTBUG] [macos 10.15] java/awt/Graphics/
    /DrawImageBG/SystemBgColorTest.java fails
    + JDK-8235183: Remove the "HACK CODE" in comment
    + JDK-8235263: Revert TLS 1.3 change that wrapped IOExceptions
    + JDK-8235311: Tag mismatch may alert bad_record_mac
    + JDK-8235332: TestInstanceCloneAsLoadsStores.java fails with
  - XX:+StressGCM
    + JDK-8235452: Strip mined loop verification fails with
    assert(is_OuterStripMinedLoop()) failed: invalid node class
    + JDK-8235584: UseProfiledLoopPredicate fails with
    assert(_phase-&gt;get_loop(c) == loop) failed: have to be in the
    same loop
    + JDK-8235620: Broken merge between JDK-8006406 and JDK-8003559
    + JDK-8235638: NPE in LWWindowPeer.getOnscreenGraphics()
    + JDK-8235686: Add more custom hooks in Bundles.gmk
    + JDK-8235739: Rare NPE at WComponentPeer.getGraphics()
    + JDK-8235762: JVM crash in SWPointer during C2 compilation
    + JDK-8235834: IBM-943 charset encoder needs updating
    + JDK-8235874: The ordering of Cipher Suites is not maintained
    provided through jdk.tls.client.cipherSuites and
    jdk.tls.server.cipherSuites system property.
    + JDK-8235908: omit ThreadPriorityPolicy warning when value is
    set from image
    + JDK-8235984: C2: assert(out-&gt;in(PhiNode::Region) == head ||
    out-&gt;in(PhiNode::Region) == slow_head) failed: phi must be
    either part of the slow or the fast loop
    + JDK-8236211: [Graal] compiler/graalunit/GraphTest.java is
    skipped in all testing
    + JDK-8236470: Deal with ECDSA using ecdsa-with-SHA2 plus hash
    algorithm as AlgorithmId
    + JDK-8236545: Compilation error in mach5
    java/awt/FileDialog/MacOSGoToFolderCrash.java
    + JDK-8236700: Upgrading JSZip from v3.1.5 to v3.2.2
    + JDK-8236759: ShouldNotReachHere in
    PhaseIdealLoop::verify_strip_mined_scheduling
    + JDK-8236897: Fix the copyright header for pkcs11gcm2.h
    + JDK-8236921: Add build target to produce a JDK image suitable
    for a Graal/SVM build
    + JDK-8236953: [macos] JavaFX SwingNode is not rendered on macOS
    + JDK-8236996: Incorrect Roboto font rendering on Windows with
    subpixel antialiasing
    + JDK-8237045: JVM uses excessive memory with -XX:+EnableJVMCI
  - XX:JVMCICounterSize=2147483648
    + JDK-8237055: [TESTBUG] compiler/c2/TestJumpTable.java fails
    with release VMs
    + JDK-8237086: assert(is_MachReturn()) running CTW with fix for
    JDK-8231291
    + JDK-8237192: Generate stripped/public pdbs on Windows for jdk
    images
    + JDK-8237396: JvmtiTagMap::weak_oops_do() should not trigger
    barriers
    + JDK-8237474: Default SSLEngine should create in server role
    + JDK-8237859: C2: Crash when loads float above range check
    + JDK-8237879: make 4.3 breaks build
    + JDK-8237951: CTW: C2 compilation fails with "malformed
    control flow"
    + JDK-8237962: give better error output for invalid OCSP
    response intervals in CertPathValidator checks
    + JDK-8238190: [JVMCI] Fix single implementor speculation for
    diamond shapes.
    + JDK-8238356: CodeHeap::blob_count() overestimates the number
    of blobs
    + JDK-8238452: Keytool generates wrong expiration date if
    validity is set to 2050/01/01
    + JDK-8238555: Allow Initialization of SunPKCS11 with NSS when
    there are external FIPS modules in the NSSDB
    + JDK-8238575: DragSourceEvent.getLocation() returns wrong
    value on HiDPI screens (Windows)
    + JDK-8238676: jni crashes on accessing it from process exit
    hook
    + JDK-8238721: Add failing client jtreg tests to the Problem
    List
    + JDK-8238738: AudioSystem.getMixerInfo() takes about 30 sec to
    report a gone audio device
    + JDK-8238756: C2: assert(((n) == __null || !VerifyIterativeGVN
    || !((n)-&gt;is_dead()))) failed: can not use dead node
    + JDK-8238765: PhaseCFG::schedule_pinned_nodes cannot handle
    precedence edges from unmatched CFG nodes correctly
    + JDK-8238898: Missing hash characters for header on license
    file
    + JDK-8238942: Rendering artifacts with LCD text and fractional
    metrics
    + JDK-8238985: [TESTBUG] The arrow image is blue instead of
    green
    + JDK-8239000: handle ContendedPaddingWidth in vm_version_ppc
    + JDK-8239055: Wrong implementation of VMState.hasListener
    + JDK-8239091: Reversed arguments in call to strstr in freetype
    "debug" code.
    + JDK-8239142: C2's UseUniqueSubclasses optimization is broken
    for array accesses
    + JDK-8239224: libproc_impl.c previous_thr may be used
    uninitialized warning
    + JDK-8239351: Give more meaningful InternalError messages in
    Deflater.c
    + JDK-8239365: ProcessBuilder test modifications for AIX
    execution
    + JDK-8239456: vtable stub generation: assert failure (code
    size estimate)
    + JDK-8239457: call ReleaseStringUTFChars before early returns
    in Java_sun_security_pkcs11_wrapper_PKCS11_connect
    + JDK-8239462: jdk.hotspot.agent misses some
    ReleaseStringUTFChars calls in case of early returns
    + JDK-8239557: [TESTBUG] VeryEarlyAssertTest.java validating
    "END." marker at lastline is not always true
    + JDK-8239787: AArch64: String.indexOf may incorrectly handle
    empty strings
    + JDK-8239792: Bump update version for OpenJDK: jdk-11.0.8
    + JDK-8239798: SSLSocket closes socket both socket endpoints on
    a SocketTimeoutException
    + JDK-8239819: XToolkit: Misread of screen information memory
    + JDK-8239852: java/util/concurrent tests fail with
  - XX:+VerifyGraphEdges: assert(!VerifyGraphEdges) failed:
    verification should have failed
    + JDK-8239893: Windows handle Leak when starting processes
    using ProcessBuilder
    + JDK-8239915: Zero VM crashes when handling dynamic constant
    + JDK-8239931: [win][x86] vtable stub generation: assert
    failure (code size estimate) follow-up
    + JDK-8239965: XMLEncoder/Test4625418.java fails due to "Error:
    Cp943 - can't read properly"
    + JDK-8239976: Put JDK-8239965 on the ProblemList.txt
    + JDK-8240073: Fix 'test-make' build target in 11u
    + JDK-8240197: Cannot start JVM when $JAVA_HOME includes CJK
    characters
    + JDK-8240202: A few client tests leave mouse buttons pressed
    + JDK-8240220: IdealLoopTree::dump_head predicate printing is
    broken
    + JDK-8240223: Use consistent predicate order in and with
    PhaseIdealLoop::find_predicate
    + JDK-8240227: Loop predicates should be copied to unswitched
    loops
    + JDK-8240286: [TESTBUG] Test command error in hotspot/jtreg/
    /compiler/loopopts/superword/SumRedAbsNeg_Float.java
    + JDK-8240518: Incorrect JNU_ReleaseStringPlatformChars in
    Windows Print
    + JDK-8240529: CheckUnhandledOops breaks NULL check in
    Modules::define_module
    + JDK-8240576: JVM crashes after transformation in C2
    IdealLoopTree::merge_many_backedges
    + JDK-8240603: Windows 32bit compile error after 8238676
    + JDK-8240629: argfiles parsing broken for argfiles with
    comment cross 4096 bytes chunk
    + JDK-8240711: TestJstatdPort.java failed due to
    "ExportException: Port already in use:"
    + JDK-8240786: [TESTBUG] The test java/awt/Window/
    /GetScreenLocation/GetScreenLocationTest.java fails on HiDPI
    screen
    + JDK-8240824: enhance print_full_memory_info on Linux by THP
    related information
    + JDK-8240827: Downport SSLSocketImpl.java from "8221882: Use
    fiber-friendly java.util.concurrent.locks in JSSE"
    + JDK-8240905: assert(mem == (Node*)1 || mem == mem2) failed:
    multiple Memories being matched at once?
    + JDK-8240972: macOS codesign fail on macOS 10.13.5 or older
    + JDK-8241445: Fix copyright in
    test/jdk/tools/launcher/ArgFileSyntax.java
    + JDK-8241458: [JVMCI] add mark value to expose
    CodeOffsets::Frame_Complete
    + JDK-8241464: [11u] Backport: make rehashing be a needed
    guaranteed safepoint cleanup action
    + JDK-8241556: Memory leak if -XX:CompileCommand is set
    + JDK-8241568: (fs) UserPrincipalLookupService.lookupXXX
    failure with IOE "Operation not permitted"
    + JDK-8241586: compiler/cpuflags/
    /TestAESIntrinsicsOnUnsupportedConfig.java fails on aarch64
    + JDK-8241638: launcher time metrics always report 1 on Linux
    when _JAVA_LAUNCHER_DEBUG set
    + JDK-8241660: Add virtualization information output to hs_err
    file on macOS
    + JDK-8241808: [TESTBUG] The JDK-8039467 bug appeared on macOS
    + JDK-8241888: Mirror jdk.security.allowNonCaAnchor system
    property with a security one
    + JDK-8241900: Loop unswitching may cause dependence on null
    check to be lost
    + JDK-8241948: enhance list of environment variables printed in
    hs_err file
    + JDK-8241996: on linux set full relro in the linker flags
    + JDK-8242108: Performance regression after fix for JDK-8229496
    + JDK-8242141: New System Properties to configure the TLS
    signature schemes
    + JDK-8242154: Backport parts of JDK-4947890 to OpenJDK 11u
    + JDK-8242174: [macos] The NestedModelessDialogTest test make
    the macOS unstable
    + JDK-8242239: [Graal] javax/management/generified/
    /GenericTest.java fails: FAILED: queryMBeans sets same
    + JDK-8242294: JSSE Client does not throw SSLException when an
    alert occurs during handshaking
    + JDK-8242379: [TESTBUG] compiler/loopopts/
    /TestLoopUnswitchingLostCastDependency.java fails with
    release VMs
    + JDK-8242470: Update Xerces to Version 2.12.1
    + JDK-8242498: Invalid "sun.awt.TimedWindowEvent" object leads
    to JVM crash
    + JDK-8242541: Small charset issues (ISO8859-16, x-eucJP-Open,
    x-IBM834 and x-IBM949C)
    + JDK-8242626: enhance posix print_rlimit_info
    + JDK-8243059: Build fails when --with-vendor-name contains a
    comma
    + JDK-8243539: Copyright info (Year) should be updated for fix
    of 8241638
    + JDK-8243541: (tz) Upgrade time-zone data to tzdata2020a
    + JDK-8244407: JVM crashes after transformation in C2
    IdealLoopTree::split_fall_in
    + JDK-8244520: problemlist
    java/awt/font/Rotate/RotatedFontTest.java on linux
    + JDK-8244777: ClassLoaderStats VM Op uses constant hash value
    + JDK-8244853: The static build of libextnet is missing the
    JNI_OnLoad_extnet function
    + JDK-8244951: Missing entitlements for hardened runtime
    + JDK-8245047: [PPC64] C2: ReverseBytes + Load always match to
    unordered Load (acquire semantics missing)
    + JDK-8245649: Revert 8245397 backport of 8230591
    + JDK-8246031: SSLSocket.getSession() doesn't close connection
    for timeout/ interrupts
    + JDK-8246613: Choose the default SecureRandom algo based on
    registration ordering
    + JDK-8248505: Unexpected NoSuchAlgorithmException when using
    secure random impl from BCFIPS provider
- Removed patch:
  * JDK-8228407.patch
    + integrated upstream</changelog>
  <changelog author="fstrba@suse.com" date="1604318400">- Update to upstream tag jdk-11.0.9-11 (October 2020 CPU,
  bsc#1177943)
  * New features
    + JDK-8250784: Shenandoah: A Low-Pause-Time Garbage Collector
  * Security fixes
    + JDK-8233624: Enhance JNI linkage
    + JDK-8236196: Improve string pooling
    + JDK-8236862, CVE-2020-14779: Enhance support of Proxy class
    + JDK-8237990, CVE-2020-14781: Enhanced LDAP contexts
    + JDK-8237995, CVE-2020-14782: Enhance certificate processing
    + JDK-8240124: Better VM Interning
    + JDK-8241114, CVE-2020-14792: Better range handling
    + JDK-8242680, CVE-2020-14796: Improved URI Support
    + JDK-8242685, CVE-2020-14797: Better Path Validation
    + JDK-8242695, CVE-2020-14798: Enhanced buffer support
    + JDK-8243302: Advanced class supports
    + JDK-8244136, CVE-2020-14803: Improved Buffer supports
    + JDK-8244479: Further constrain certificates
    + JDK-8244955: Additional Fix for JDK-8240124
    + JDK-8245407: Enhance zoning of times
    + JDK-8245412: Better class definitions
    + JDK-8245417: Improve certificate chain handling
    + JDK-8248574: Improve jpeg processing
    + JDK-8249927: Specify limits of jdk.serialProxyInterfaceLimit
    + JDK-8253019: Enhanced JPEG decoding
  * Other changes
    + JDK-6532025: GIF reader throws misleading exception with
    truncated images
    + JDK-6949753: [TEST BUG]: java/awt/print/PageFormat/
    /PDialogTest.java needs update by removing an infinite loop
    + JDK-8022535: [TEST BUG] javax/swing/text/html/parser/
    /Test8017492.java fails
    + JDK-8062947: Fix exception message to correctly represent
    LDAP connection failure
    + JDK-8067354: com/sun/jdi/GetLocalVariables4Test.sh failed
    + JDK-8134599: TEST_BUG: java/rmi/transport/closeServerSocket/
    /CloseServerSocket.java fails intermittently with Address
    already in use
    + JDK-8151678: com/sun/jndi/ldap/LdapTimeoutTest.java failed
    due to timeout on DeadServerNoTimeoutTest is incorrect
    + JDK-8160768: Add capability to custom resolve host/domain
    names within the default JNDI LDAP provider
    + JDK-8172404: Tools should warn if weak algorithms are used
    before restricting them
    + JDK-8193367: Annotated type variable bounds crash javac
    + JDK-8202117: com/sun/jndi/ldap/RemoveNamingListenerTest.java
    fails intermittently: Connection reset
    + JDK-8203026: java.rmi.NoSuchObjectException: no such object
    in table
    + JDK-8203281: [Windows] JComboBox change in ui when
    editor.setBorder() is called
    + JDK-8203382: Rename SystemDictionary::initialize_wk_klass to
    resolve_wk_klass
    + JDK-8203393: com/sun/jdi/JdbMethodExitTest.sh and
    JdbExprTest.sh fail due to timeout
    + JDK-8203928: [Test] Convert non-JDB scaffolding
    serviceability shell script tests to java
    + JDK-8204963: javax.swing.border.TitledBorder has a memory leak
    + JDK-8204994: SA might fail to attach to process with "Windbg
    Error: WaitForEvent failed"
    + JDK-8205534: Remove SymbolTable dependency from
    serviceability agent
    + JDK-8206309: Tier1 SA tests fail
    + JDK-8208281: java/nio/channels/
    /AsynchronousSocketChannel/Basic.java timed out
    + JDK-8209109: [TEST] rewrite com/sun/jdi shell tests to java
    version - step1
    + JDK-8209332: [TEST] test/jdk/com/sun/jdi/CatchPatternTest.sh
    is incorrect
    + JDK-8209342: Problemlist SA tests on Solaris due to Error
    attaching to process: Can't create thread_db agent!
    + JDK-8209343: Test javax/swing/border/TestTitledBorderLeak.java
    should be marked as headful
    + JDK-8209517: com/sun/jdi/BreakpointWithFullGC.java fails with
    timeout
    + JDK-8209604: [TEST] rewrite com/sun/jdi shell tests to java
    version - step2
    + JDK-8209605: com/sun/jdi/BreakpointWithFullGC.java fails with
    ZGC
    + JDK-8209608: Problem list com/sun/jdi/BreakpointWithFullGC.java
    + JDK-8210131: vmTestbase/nsk/jvmti/scenarios/allocation/AP10/
    /ap10t001/TestDescription.java failed with ObjectFree:
    GetCurrentThreadCpuTimerInfo returned unexpected error code
    + JDK-8210243: [TEST] rewrite com/sun/jdi shell tests to java
    version - step3
    + JDK-8210527: JShell: NullPointerException in
    jdk.jshell.Eval.translateExceptionStack
    + JDK-8210560: [TEST] convert com/sun/jdi redefineClass-related
    tests
    + JDK-8210725: com/sun/jdi/RedefineClearBreakpoint.java fails
    with waitForPrompt timed out after 60 seconds
    + JDK-8210748: [TESTBUG] lib.jdb.Jdb.waitForPrompt() should
    clarify which output is the pending reply after a timeout
    + JDK-8210760: [TEST] rewrite com/sun/jdi shell tests to java
    version - step4
    + JDK-8210977: jdk/jfr/event/oldobject/TestThreadLocalLeak.java
    fails to find ThreadLocalObject
    + JDK-8211292: [TEST] convert com/sun/jdi/DeferredStepTest.sh
    test
    + JDK-8211694: JShell: Redeclared variable should be reset
    + JDK-8212200: assert when shared java.lang.Object is redefined
    by JVMTI agent
    + JDK-8212629: [TEST] wrong breakpoint in
    test/jdk/com/sun/jdi/DeferredStepTest
    + JDK-8212665: com/sun/jdi/DeferredStepTest.java: jj1 (line 57)
  - unexpected. lastLine=52, minLine=52, maxLine=55
    + JDK-8212807: tools/jar/multiRelease/Basic.java times out
    + JDK-8213182: Minimal VM build failure after JDK-8212200
    (assert when shared java.lang.Object is redefined by JVMTI
    agent)
    + JDK-8213214: Set -Djava.io.tmpdir= when running tests
    + JDK-8213275: ReplaceCriticalClasses.java fails with
    jdk.internal.vm.PostVMInitHook not found
    + JDK-8213574: Deadlock in string table expansion when dumping
    lots of CDS classes
    + JDK-8213703: LambdaConversionException: Invalid receiver type
    not a subtype of implementation type interface
    + JDK-8214074: Ghash optimization using AVX instructions
    + JDK-8214491: Upgrade to JLine 3.9.0
    + JDK-8214797: TestJmapCoreMetaspace.java timed out
    + JDK-8215243: JShell tests failing intermitently with
    "Problem cleaning up the following threads:"
    + JDK-8215244: jdk/jshell/ToolBasicTest.java
    testHistoryReference failed
    + JDK-8215354: x86_32 build failures after JDK-8214074 (Ghash
    optimization using AVX instructions)
    + JDK-8215438: jshell tool: Ctrl-D causes EOF
    + JDK-8216021: RunTest.gmk might set concurrency level to 1 on
    Windows
    + JDK-8216974: HttpConnection not returned to the pool after
    204 response
    + JDK-8218948: SimpleDateFormat :: format - Zone Names are not
    reflected correctly during run time
    + JDK-8219712: code_size2 (defined in stub_routines_x86.hpp) is
    too small on new Skylake CPUs
    + JDK-8220150: macos10.14 Mojave returns anti-aliased glyphs
    instead of aliased B&amp;W glyphs
    + JDK-8221658: aarch64: add necessary predicate for ubfx
    patterns
    + JDK-8221759: Crash when completing "java.io.File.path"
    + JDK-8221918: runtime/SharedArchiveFile/serviceability/
    /ReplaceCriticalClasses.java fails: Shared archive not found
    + JDK-8222074: Enhance auto vectorization for x86
    + JDK-8222079: Don't use memset to initialize fields decode_env
    constructor in disassembler.cpp
    + JDK-8222769: [TESTBUG] TestJFRNetworkEvents should not rely
    on hostname command
    + JDK-8223688: JShell: crash on the instantiation of raw
    anonymous class
    + JDK-8223777: In posix_spawn mode, failing to exec()
    jspawnhelper does not result in an error
    + JDK-8223940: Private key not supported by chosen signature
    algorithm
    + JDK-8224184: jshell got IOException at exiting with AIX
    + JDK-8224234: compiler/codegen/TestCharVect2.java fails in
    test_mulc
    + JDK-8225037: java.net.JarURLConnection::getJarEntry() throws
    NullPointerException
    + JDK-8225625: AES Electronic Codebook (ECB) encryption and
    decryption optimization using AVX512 + VAES instructions
    + JDK-8226536: Catch OOM from deopt that fails rematerializing
    objects
    + JDK-8226575: OperatingSystemMXBean should be made container
    aware
    + JDK-8226697: Several tests which need the @key headful
    keyword are missing it.
    + JDK-8226809: Circular reference in printed stack trace is not
    correctly indented &amp; ambiguous
    + JDK-8227059: sun/security/tools/keytool/
    /DefaultSignatureAlgorithm.java timed out
    + JDK-8227269: Slow class loading when running with JDWP
    + JDK-8227595: keytool/fakegen/DefaultSignatureAlgorithm.java
    fails due to "exitValue = 6"
    + JDK-8228448: Jconsole can't connect to itself
    + JDK-8228967: Trust/Key store and SSL context utilities for
    tests
    + JDK-8229378: jdwp library loader in linker_md.c quietly
    truncates on buffer overflow
    + JDK-8229815: Upgrade Jline to 3.12.1
    + JDK-8230000: some httpclients testng tests run zero test
    + JDK-8230002: javax/xml/jaxp/unittest/transform/
    /SecureProcessingTest.java runs zero test
    + JDK-8230010: Remove jdk8037819/BasicTest1.java
    + JDK-8230094: CCE in createXMLEventWriter(Result) over an
    arbitrary XMLStreamWriter
    + JDK-8230402: Allocation of compile task fails with assert:
    "Leaking compilation tasks?"
    + JDK-8230767: FlightRecorderListener returns null recording
    + JDK-8230870: (zipfs) Add a ZIP FS test that is similar to
    test/jdk/java/util/zip/EntryCount64k.java
    + JDK-8231209: [REDO] ThreadMXBean::getThreadAllocatedBytes()
    can be quicker for self thread
    + JDK-8231586: enlarge encoding space for OopMapValue offsets
    + JDK-8231953: Wrong assumption in assertion in
    oop::register_oop
    + JDK-8231968: getCurrentThreadAllocatedBytes default
    implementation s/b getThreadAllocatedBytes
    + JDK-8232083: Minimal VM is broken after JDK-8231586
    + JDK-8232161: Align some one-way conversion in MS950 charset
    with Windows
    + JDK-8232855: jshell missing word in /help help
    + JDK-8233027: OopMapSet::all_do does oms.next() twice during
    iteration
    + JDK-8233228: Disable weak named curves by default in TLS,
    CertPath, and Signed JAR
    + JDK-8233386: Initialize NULL fields for unused decorations
    + JDK-8233452: java.math.BigDecimal.sqrt() with
    RoundingMode.FLOOR results in incorrect result
    + JDK-8233686: XML transformer uses excessive amount of memory
    + JDK-8233741: AES Countermode (AES-CTR) optimization using
    AVX512 + VAES instructions
    + JDK-8233829: javac cannot find non-ASCII module name under
    non-UTF8 environment
    + JDK-8233958: Memory retention due to HttpsURLConnection
    finalizer that serves no purpose
    + JDK-8234011: (zipfs) Memory leak in
    ZipFileSystem.releaseDeflater()
    + JDK-8234058: runtime/CompressedOops/
    /CompressedClassPointers.java fails with 'Narrow klass base:
    0x0000000000000000' missing from stdout/stderr
    + JDK-8234149: Several regression tests do not dispose Frame at
    end
    + JDK-8234347: "Turkey" meta time zone does not generate
    composed localized names
    + JDK-8234385: [TESTBUG] java/awt/EventQueue/6980209/
    /bug6980209.java fails in linux nightly
    + JDK-8234535: Cross compilation fails due to missing CFLAGS
    for the BUILD_CC
    + JDK-8234541: C1 emits an empty message when it inlines
    successfully
    + JDK-8234687: change javap reporting on unknown attributes
    + JDK-8236464: SO_LINGER option is ignored by SSLSocket in JDK
    11
    + JDK-8236548: Localized time zone name inconsistency between
    English and other locales
    + JDK-8236617: jtreg test containers/docker/
    /TestMemoryAwareness.java fails after 8226575
    + JDK-8237182: Update copyright header for shenandoah and
    epsilon files
    + JDK-8237888: security/infra/java/security/cert/
    /CertPathValidator/certification/LuxTrustCA.java fails when
    checking validity interval
    + JDK-8237977: Further update
    javax/net/ssl/compatibility/Compatibility.java
    + JDK-8238270: java.net HTTP/2 client does not decrease stream
    count when receives 204 response
    + JDK-8238284: [macos] Zero VM build fails due to an obvious
    typo
    + JDK-8238380: java.base/unix/native/libjava/childproc.c
    "multiple definition" link errors with GCC10
    + JDK-8238386: (sctp) jdk.sctp/unix/native/libsctp/SctpNet.c
    "multiple definition" link errors with GCC10
    + JDK-8238388: libj2gss/NativeFunc.o "multiple definition" link
    errors with GCC10
    + JDK-8238448: RSASSA-PSS signature verification fail when
    using certain odd key sizes
    + JDK-8238710: LingeredApp doesn't log stdout/stderr if exits
    with non-zero code
    + JDK-8239083: C1 assert(known_holder == NULL ||
    (known_holder-&gt;is_instance_klass() &amp;&amp;
    (!known_holder-&gt;is_interface() ||
    ((ciInstanceKlass*)known_holder)-&gt;has_nonstatic_concrete_methods())),
    "should be non-static concrete method");
    + JDK-8239385: KerberosTicket client name refers wrongly to
    sAMAccountName in AD
    + JDK-8240169: javadoc fails to link to non-modular api docs
    + JDK-8240295: hs_err elapsed time in seconds is not accurate
    enough
    + JDK-8240360: NativeLibraryEvent has wrong library name on
    Linux
    + JDK-8240676: Meet not symmetric failure when running lucene
    on jdk8
    + JDK-8241007: Shenandoah: remove
    ShenandoahCriticalControlThreadPriority support
    + JDK-8241065: Shenandoah: remove leftover code after
    JDK-8231086
    + JDK-8241086: Test runtime/NMT/HugeArenaTracking.java is
    failing on 32bit Windows
    + JDK-8241130: com.sun.jndi.ldap.EventSupport.removeDeadNotifier:
    java.lang.NullPointerException
    + JDK-8241138: http.nonProxyHosts=* causes
    StringIndexOutOfBoundsException in DefaultProxySelector
    + JDK-8241319: WB_GetCodeBlob doesn't have ResourceMark
    + JDK-8241478: vmTestbase/gc/gctests/Steal/steal001/steal001.java
    fails with OOME
    + JDK-8241574: Shenandoah: remove ShenandoahAssertToSpaceClosure
    + JDK-8241750: x86_32 build failure after JDK-8227269
    + JDK-8242184: CRL generation error with RSASSA-PSS
    + JDK-8242283: Can't start JVM when java home path includes
    non-ASCII character
    + JDK-8242556: Cannot load RSASSA-PSS public key with non-null
    params from byte array
    + JDK-8243029: Rewrite javax/net/ssl/compatibility/
    /Compatibility.java with a flexible interop test framework
    + JDK-8243138: Enhance BaseLdapServer to support starttls
    extended request
    + JDK-8243320: Add SSL root certificates to Oracle Root CA
    program
    + JDK-8243321: Add Entrust root CA - G4 to Oracle Root CA
    program
    + JDK-8243389: enhance os::pd_print_cpu_info on linux
    + JDK-8243453: java --describe-module failed with non-ASCII
    module name under non-UTF8 environment
    + JDK-8243470: [macos] bring back O2 opt level for unsafe.cpp
    + JDK-8243489: Thread CPU Load event may contain wrong data for
    CPU time under certain conditions
    + JDK-8243925: Toolkit#getScreenInsets() returns wrong value on
    HiDPI screens (Windows)
    + JDK-8244087: 2020-04-24 public suffix list update
    + JDK-8244151: Update MUSCLE PC/SC-Lite headers to the latest
    release 1.8.26
    + JDK-8244164: AArch64: jaotc generates incorrect code for
    compressed OOPs with non-zero heap base
    + JDK-8244196: adjust output in os_linux
    + JDK-8244225: stringop-overflow warning on strncpy call from
    compile_the_world_in
    + JDK-8244287: JFR: Methods samples have line number 0
    + JDK-8244703: "platform encoding not initialized" exceptions
    with debugger, JNI
    + JDK-8244719: CTW: C2 compilation fails with
    "assert(!VerifyHashTableKeys || _hash_lock == 0) failed:
    remove node from hash table before modifying it"
    + JDK-8244729: Shenandoah: remove resolve paths from
    SBSA::generate_shenandoah_lrb
    + JDK-8244763: Update --release 8 symbol information after JSR
    337 MR3
    + JDK-8244818: Java2D Queue Flusher crash while moving
    application window to external monitor
    + JDK-8245151: jarsigner should not raise duplicate warnings on
    verification
    + JDK-8245616: Bump update version for OpenJDK: jdk-11.0.9
    + JDK-8245714: "Bad graph detected in build_loop_late" when
    loads are pinned on loop limit check uncommon branch
    + JDK-8245801: StressRecompilation triggers assert "redundunt
    OSR recompilation detected. memory leak in CodeCache!"
    + JDK-8245832: JDK build make-static-libs should build all JDK
    libraries
    + JDK-8245880: Shenandoah: check class unloading flag early in
    concurrent code root scan
    + JDK-8245981: Upgrade to jQuery 3.5.1
    + JDK-8246027: Minimal fastdebug build broken after JDK-8245801
    + JDK-8246094: [macos] Sound Recording and playback is not
    working
    + JDK-8246153: TestEliminateArrayCopy fails with
  - XX:+StressReflectiveCode
    + JDK-8246193: Possible NPE in ENC-PA-REP search in AS-REQ
    + JDK-8246196: javax/management/MBeanServer/OldMBeanServerTest
    fails with AssertionError
    + JDK-8246203: Segmentation fault in verification due to stack
    overflow with -XX:+VerifyIterativeGVN
    + JDK-8246330: Add TLS Tests for Legacy ECDSA curves
    + JDK-8246453: TestClone crashes with "all collected exceptions
    must come from the same place"
    + JDK-8247246: Add explicit ResolvedJavaType.link and expose
    presence of default methods
    + JDK-8247350: [aarch64] assert(false) failed: wrong size of
    mach node
    + JDK-8247502: PhaseStringOpts crashes while optimising
    effectively dead code
    + JDK-8247615: Initialize the bytes left for the heap sampler
    + JDK-8247824: CTW: C2 (Shenandoah) compilation fails with SEGV
    in SBC2Support::pin_and_expand
    + JDK-8247874: Replacement in VersionProps.java.template not
    working when --with-vendor-bug-url contains '&amp;'
    + JDK-8247979: aarch64: missing side effect of killing flags
    for clearArray_reg_reg
    + JDK-8248214: Add paddings for TaskQueueSuper to reduce
    false-sharing cache contention
    + JDK-8248219: aarch64: missing memory barrier in
    fast_storefield and fast_accessfield
    + JDK-8248348: Regression caused by the update to BCEL 6.0
    + JDK-8248385: [testbug][11u] Adapt TestInitiExceptions to
    jtreg 5.1
    + JDK-8248495: [macos] zerovm is broken due to libffi headers
    location
    + JDK-8248851: CMS: Missing memory fences between free chunk
    check and klass read
    + JDK-8248987: AOT's Linker.java seems to eagerly fail-fast on
    Windows
    + JDK-8249159: Downport test rework for SSLSocketTemplate from
    8224650
    + JDK-8249215: JFrame::setVisible crashed with
  - Dfile.encoding=UTF-8 on Japanese Windows.
    + JDK-8249251: [dark_mode ubuntu 20.04] The selected menu is
    not highlighted in GTKLookAndFeel
    + JDK-8249255: Build fails if source code in cygwin home dir
    + JDK-8249277: TestVerifyIterativeGVN.java is failing with
    timeout in OpenJDK 11
    + JDK-8249278: Revert JDK-8226253 which breaks the spec of
    AccessibleState.SHOWING for JList
    + JDK-8249560: Shenandoah: Fix racy GC request handling
    + JDK-8249801: Shenandoah: Clear soft-refs on requested GC cycle
    + JDK-8249953: Shenandoah: gc/shenandoah/mxbeans tests should
    account for corner cases
    + JDK-8250582: Revert Principal Name type to NT-UNKNOWN when
    requesting TGS Kerberos tickets
    + JDK-8250609: C2 crash in IfNode::fold_compares
    + JDK-8250627: Use -XX:+/-UseContainerSupport for
    enabling/disabling Java container metrics
    + JDK-8250755: Better cleanup for
    jdk/test/javax/imageio/plugins/shared/CanWriteSequence.java
    + JDK-8250787: Provider.put no longer registering aliases in
    FIPS env
    + JDK-8250826: jhsdb does not work with coredump which comes
    from Substrate VM
    + JDK-8250827: Shenandoah: needs to reset/finish StringTable's
    dead count before/after parallel walk
    + JDK-8250844: Make sure {type,obj}ArrayOopDesc accessors check
    the bounds
    + JDK-8251117: Cannot check P11Key size in P11Cipher and
    P11AEADCipher
    + JDK-8251354: Shenandoah: Fix jdk/jfr/tool/TestPrintJSON.java
    test failure
    + JDK-8251451: Shenandoah: Remark ObjectSynchronizer roots with
    I-U
    + JDK-8251469: Better cleanup for
    test/jdk/javax/imageio/SetOutput.java
    + JDK-8251487: Shenandoah: missing detail timing tracking for
    final mark cleaning phase
    + JDK-8252120: compiler/oracle/TestCompileCommand.java
    misspells "occured"
    + JDK-8252157: JDK-8231209 11u backport breaks jmm binary
    compatibility
    + JDK-8252258: [11u] JDK-8242154 changes the default vendor
    + JDK-8252804: [test] Fix 'ReleaseDeflater.java' test after
    downport of 8234011
    + JDK-8253134: JMM_VERSION should remain at 0x20020000 (JDK 10)
    in JDK 11
    + JDK-8253283: [11u] Test build/translations/
    /VerifyTranslations.java failing after JDK-8252258
    + JDK-8253813: Backout JDK-8244287 from 11u: it causes several
    crashes
- Removed patch:
  * gcc-fno-common-fix.patch
    + not needed any more with this version
- Added patch:
  * JDK-8250861.patch
    + Fix regression "8250861: Crash in MinINode::Ideal(PhaseGVN*,
    bool)" introduced in jdk 11.0.9</changelog>
  <changelog author="fstrba@suse.com" date="1604491200">- Enable Sheandoah GC for x86_64 (jsc#ECO-3171)</changelog>
  <changelog author="fstrba@suse.com" date="1605528000">- Update to upstream tag jdk-11.0.9.1-1
  * Fix:
    + JDK-8250861: Crash in MinINode::Ideal(PhaseGVN*, bool)
- Removed patch:
  * JDK-8250861.patch
    + Integrated upstream</changelog>
  <changelog author="fstrba@suse.com" date="1611230400">- Update to upstream tag jdk-11.0.10+9 (January 2021 CPU,
  bsc#1181239)
  * Security fixes
    + JDK-8247619: Improve Direct Buffering of Characters
  * Other changes
    + JDK-6722928: Support SSPI as a native GSS-API provider
    + JDK-7185258: [macosx] Deadlock in SunToolKit.realSync()
    + JDK-8152332: [macosx] JFileChooser cannot be serialized on
    Mac OS X
    + JDK-8161684: [testconf] Add VerifyOops' testing into compiler
    tiers
    + JDK-8171279: Support X25519 and X448 in TLS
    + JDK-8173361: various crashes in
    JvmtiExport::post_compiled_method_load
    + JDK-8173658: JvmtiExport::post_class_unload() is broken for
    non-JavaThread initiators
    + JDK-8191006: hsdis disassembler plugin does not compile with
    binutils 2.29+
    + JDK-8197981: Missing return statement in
    __sync_val_compare_and_swap_8
    + JDK-8198334: java/awt/FileDialog/8003399/bug8003399.java
    fails in headless mode
    + JDK-8200151: Add 8 JNDI tests to com/sun/jndi/dns/ConfigTests/
    + JDK-8208279: Add 8 JNDI tests to com/sun/jndi/dns/EnvTests/
    + JDK-8208483: Add 5 JNDI tests to
    com/sun/jndi/dns/FactoryTests/
    + JDK-8208542: Add 4 JNDI tests to com/sun/jndi/dns/ListTests/
    + JDK-8208665: Amend cross-compilation docs with
    qemu-debootstrap recipe
    + JDK-8210088: ProblemList gc/epsilon/TestMemoryMXBeans.java
    + JDK-8210339: Add 10 JNDI tests to com/sun/jndi/dns/FedTests/
    + JDK-8211450: UndetVar::dup is not copying the kind field to
    the duplicated instance
    + JDK-8212160: JVMTI agent crashes with "assert(_value != 0LL)
    failed: resolving NULL _value"
    + JDK-8212226: SurfaceManager throws "Invalid Image variant"
    for MultiResolutionImage (Windows)
    + JDK-8213400: Support choosing group name in keytool keypair
    generation
    + JDK-8213535: Windows HiDPI html lightweight tooltips are
    truncated
    + JDK-8213698: Improve devkit creation and add support for
    linux/ppc64/ppc64le/s390x
    + JDK-8214025: assert(t-&gt;singleton()) failed: must be a
    constant when ScavengeRootsInCode &lt; 2
    + JDK-8214242: compiler/arguments/TestScavengeRootsInCode.java
    fails because of missing UnlockDiagnosticVMOptions
    + JDK-8214787: Zero builds fail with "undefined
    JavaThread::thread_state()"
    + JDK-8215583: Exclude
    runtime/handshake/HandshakeWalkSuspendExitTest.java
    + JDK-8216012: Infinite loop in RSA KeyPairGenerator
    + JDK-8216324: GetClassMethods is confused by the presence of
    default methods in super interfaces
    + JDK-8217429: WebSocket over authenticating proxy fails to
    send Upgrade headers
    + JDK-8217976: test/jdk/java/net/httpclient/websocket/
    /WebSocketProxyTest.java fails intermittently
    + JDK-8218021: Have jarsigner preserve posix permission
    attributes
    + JDK-8218287: jshell tool: input behavior unstable after
    12-ea+24 on Windows
    + JDK-8218851: JVM crash in custom classloader stress test, JDK
    12 &amp; 13
    + JDK-8220420: Cleanup c1_LinearScan
    + JDK-8222072: JVMTI GenerateEvents() sends CompiledMethodLoad
    events to wrong jvmtiEnv
    + JDK-8222286: Fix for JDK-8213419 is broken on s390
    + JDK-8222527: HttpClient doesn't send HOST header when
    tunelling HTTP/1.1 through http proxy
    + JDK-8222533: jtreg test jdk/internal/platform/cgroup/
    /TestCgroupMetrics.java fails on SLES12.3 linux ppc64le
    machine
    + JDK-8224506: [TESTBUG] TestDockerMemoryMetrics.java fails
    with exitValue = 137
    + JDK-8224555: vmTestbase/nsk/jvmti/scenarios/contention/TC02/
    /tc02t001/TestDescription.java failed
    + JDK-8224650: Add tests to support X25519 and X448 in TLS
    + JDK-8225072: Add LuxTrust certificate that is expiring in
    March 2021 to list of allowed but expired certs
    + JDK-8225329: -XX:+PrintBiasedLockingStatistics causes crash
    during initialization on Windows platforms
    + JDK-8225687: Newly added sspi.cpp in JDK-6722928 still
    contains some small errors
    + JDK-8227006: [linux] Runtime.availableProcessors execution
    time increased by factor of 100
    + JDK-8227275: Within native OOM error handling, assertions may
    hang the process
    + JDK-8227647: [Graal] Test8009761.java fails due to
    "RuntimeException: static java.lang.Object
    compiler.uncommontrap.Test8009761.m3(boolean,boolean) not
    compiled"
    + JDK-8229495: SIGILL in C2 generated OSR compilation
    + JDK-8230910: libsspi_bridge does not build on Windows 32bit
    + JDK-8232114: JVM crashed at imjpapi.dll in native code
    + JDK-8234147: Avoid looking up standard charsets in core
    libraries
    + JDK-8234393: [macos] printing ignores printer tray
    + JDK-8234863: Increase default value of MaxInlineLevel
    + JDK-8235218: Minimal VM is broken after JDK-8173361
    + JDK-8235456: Minimal VM is broken after JDK-8212160
    + JDK-8235829: graal crashes with Zombie.java test
    + JDK-8236124: Minimal VM slowdebug build failed after
    JDK-8212160
    + JDK-8236512: PKCS11 Connection closed after Cipher.doFinal
    and NoPadding
    + JDK-8236944: The legVecZ operand should be limited to
    zmm0-zmm15 registers
    + JDK-8237186: Fix typo in copyright header of
    java/io/Reader/TransferTo.java
    + JDK-8237499: JFR: Include stack trace in the ThreadStart event
    + JDK-8237512: AArch64: aarch64TestHook leaks a BufferBlob
    + JDK-8237524: AArch64: String.compareTo() may return incorrect
    result
    + JDK-8237950: C2 compilation fails with "Live Node limit
    exceeded limit" during ConvI2L::Ideal optimization
    + JDK-8238579: HttpsURLConnection drops the timeout and hangs
    forever in read
    + JDK-8239105: Add exception for expiring Digicert root
    certificates to VerifyCACerts test
    + JDK-8239477: jdk/jfr/jcmd/TestJcmdStartStopDefault.java fails
  - XX:+VerifyOops with "verify_oop: rsi: broken oop"
    + JDK-8239497: SEGV in EdgeUtils::field_name_symbol(Edge const&amp;)
    + JDK-8239886: Minimal VM build fails after JDK-8237499
    + JDK-8240633: Memory leaks in the implementations of
    FileChooserUI
    + JDK-8240690: Race condition between EDT and
    BasicDirectoryModel.FilesLoader.run0()
    + JDK-8241234: Unify monitor enter/exit runtime entries.
    + JDK-8241311: Move some charset mapping tests from closed to
    open
    + JDK-8241797: Add some tests to the problem list
    + JDK-8242029: AArch64: skip G1 array copy pre-barrier if
    marking not active
    + JDK-8242335: Additional Tests for RSASSA-PSS
    + JDK-8242480: Negative value may be returned by
    getFreeSwapSpaceSize() in the docker
    + JDK-8242614: cleanup duplicated test ldap server in some
    com/sun/jndi/ldap/ tests
    + JDK-8242846: Bring back test/jdk/tools/jlink/plugins/
    /OrderResourcesPluginTest.java
    + JDK-8243114: Implement montgomery{Multiply,Square}intrinsics
    on Windows
    + JDK-8243290: Improve diagnostic messages for class
    verification and redefinition failures
    + JDK-8243488: Add tests for set/get SendBufferSize and
    getReceiveBufferSize in DatagramSocket
    + JDK-8243549: sun/security/ssl/CipherSuite/
    /NamedGroupsWithCipherSuite.java failed with Unsupported
    signature algorithm: DSA
    + JDK-8243617: compiler/onSpinWait/TestOnSpinWaitC1.java test
    uses wrong class
    + JDK-8243619: compiler/codecache/CheckSegmentedCodeCache.java
    test misses -version
    + JDK-8244142: some hotspot/runtime tests don't check exit code
    of forked JVM
    + JDK-8244278: Excessive code cache flushes and sweeps
    + JDK-8244282: test/hotspot/jtreg/compiler/intrinsics/
    /Test8237524.java fails with --illegal-access=deny
    + JDK-8244621: [macos10.15] Garbled FX printing plus CoreText
    warnings on Catalina when building with Xcode 11
    + JDK-8244819: hsdis does not compile with binutils 2.34+
    + JDK-8245051: c1 is broken if it is compiled by gcc without
  - fno-lifetime-dse
    + JDK-8245168: jlink should not be treated as a "small" tool
    + JDK-8245400: Upgrade to LittleCMS 2.11
    + JDK-8246381: VM crashes with "Current BasicObjectLock* below
    than low_mark"
    + JDK-8246434: Threads::print_on_error assumes that the heap
    has been set up
    + JDK-8246648: issue with OperatingSystemImpl
    getFreeSwapSpaceSize in docker after 8242480
    + JDK-8247201: Print potential pointer value of readable stack
    memory in hs_err file
    + JDK-8247763: assert(outer-&gt;outcnt() == 2) failed: 'only phis'
    failure in LoopNode::verify_strip_mined()
    + JDK-8247867: Upgrade to freetype 2.10.2
    + JDK-8248190: Enable Power10 system and implement new
    byte-reverse instructions
    + JDK-8248226: TestCloneAccessStressGCM fails with
  - XX:-ReduceBulkZeroing
    + JDK-8248347: windows build broken by JDK-8243114
    + JDK-8248532: Every time I change keyboard language at my
    MacBook, Java crashes
    + JDK-8248552: C2 crashes with SIGFPE due to division by zero
    + JDK-8248596: [TESTBUG] compiler/loopopts/
    /PartialPeelingUnswitch.java times out with Graal enabled
    + JDK-8248745: Add jarsigner and keytool tests for restricted
    algorithms
    + JDK-8248791: sun/util/resources/cldr/TimeZoneNamesTest.java
    fails with -XX:-ReduceInitialCardMarks -XX:-ReduceBulkZeroing
    + JDK-8248845: AArch64: stack corruption after spilling vector
    register
    + JDK-8249176: Update GlobalSignR6CA test certificates
    + JDK-8249183: JVM crash in "AwtFrame::WmSize" method
    + JDK-8249192: MonitorInfo stores raw oops across safepoints
    + JDK-8249602: C2: assert(cnt == _outcnt) failed: no insertions
    allowed
    + JDK-8249603: C1: assert(has_error == false) failed: register
    allocation invalid
    + JDK-8249605: C2: assert(no_dead_loop) failed: dead loop
    detected
    + JDK-8249607: C2: assert(!had_error) failed: bad dominance
    + JDK-8249608: Vector register used by C2 compiled method
    corrupted at safepoint
    + JDK-8249672: Include microcode revision in features_string on
    x86
    + JDK-8249748: gtest silently ignores bad jvm arguments
    + JDK-8249821: Separate libharfbuzz from libfontmanager
    + JDK-8250598: Hyper-V is detected in spite of running on host
    OS
    + JDK-8250605: Linux x86_32 builds fail after JDK-8249821
    + JDK-8250636: iso8601_time returns incorrect offset part on
    MacOS
    + JDK-8250665: Wrong translation for the month name of May in
    ar_JO,LB,SY
    + JDK-8250772: Test com/sun/jndi/ldap/
    /NamingExceptionMessageTest.java fails intermittently with
    javax.naming.ServiceUnavailableException
    + JDK-8250825: C2 crashes with assert(field != __null) failed:
    missing field
    + JDK-8250894: Provide a configure option to build and run
    against the platform libharfbuzz
    + JDK-8250928: JFR: Improve hash algorithm for stack traces
    + JDK-8250968: Symlinks attributes not preserved when using
    jarsigner on zip files
    + JDK-8250984: Memory Docker tests fail on some Linux kernels
    w/o cgroupv1 swap limit capabilities
    + JDK-8251118: BiasedLocking::preserve_marks should not have a
    HandleMark
    + JDK-8251189: com/sun/jndi/ldap/LdapDnsProviderTest.java
    failed due to timeout
    + JDK-8251257: NMT: jcmd VM.native_memory scale=1 crashes
    target VM
    + JDK-8251365: Build failure on AIX after 8250636
    + JDK-8251397: NPE on ClassValue.ClassValueMap.cacheArray
    + JDK-8251456: [TESTBUG] compiler/vectorization/
    /TestVectorsNotSavedAtSafepoint.java failed OutOfMemoryError
    + JDK-8251458: Parse::do_lookupswitch fails with "assert(_cnt
    &gt;= 0) failed"
    + JDK-8251535: Partial peeling at unsigned test adds incorrect
    loop exit check
    + JDK-8251949: ZGC: Set explicit heap size for
    compiler/gcbarriers tests
    + JDK-8252090: JFR: StreamWriterHost::write_unbuffered() stucks
    in an infinite loop OpenJDK (build 13.0.1+9)
    + JDK-8252415: Bump update version for OpenJDK: jdk-11.0.10
    + JDK-8252470: java/awt/dnd/DisposeFrameOnDragCrash/
    /DisposeFrameOnDragTest.java fails on Windows
    + JDK-8252497: Incorrect numeric currency code for ROL
    + JDK-8252660: Shenandoah: support manageable SoftMaxHeapSize
    option
    + JDK-8252679: Two windows specific FileDIalog tests may fail
    on some Windows_Server_2016_Standard
    + JDK-8252696: Loop unswitching may cause out of bound array
    load to be executed
    + JDK-8252754: Hash code calculation of JfrStackTrace is
    inconsistent
    + JDK-8253219: Epsilon: clean up unnecessary includes
    + JDK-8253224: Shenandoah: ShenandoahStrDedupQueue destructor
    calls virtual num_queues()
    + JDK-8253226: Shenandoah: remove unimplemented
    ShenandoahStrDedupQueue::verify
    + JDK-8253269: The CheckCommonColors test should provide more
    info on failure
    + JDK-8253284: Zero OrderAccess barrier mappings are incorrect
    + JDK-8253375: OSX build fails with Xcode 12.0 (12A7209)
    + JDK-8253778: ShenandoahSafepoint::is_at_shenandoah_safepoint
    should not access VMThread state from other threads
    + JDK-8253791: Issue with useAppleColor check in CSystemColors.m
    + JDK-8254016: Test8237524 fails with -XX:-CompactStrings option
    + JDK-8254081: java/security/cert/PolicyNode/
    /GetPolicyQualifiers.java fails due to an expired certificate
    + JDK-8254144: Non-x86 Zero builds fail with return-type
    warning in os_linux_zero.cpp
    + JDK-8254166: Zero: return-type warning in
    zeroInterpreter_zero.cpp
    + JDK-8254177: (tz) Upgrade time-zone data to tzdata2020b
    + JDK-8254185: Fix Code cache sweeper heuristics for JDK 11
    + JDK-8254190: [s390] interpreter misses exception check after
    calling monitorenter
    + JDK-8254790: SIGSEGV in string_indexof_char and
    stringL_indexof_char intrinsics
    + JDK-8254854: [cgroups v1] Metric limits not properly detected
    on some join controller combinations
    + JDK-8254982: (tz) Upgrade time-zone data to tzdata2020c
    + JDK-8255050: Add pkcs11/KeyStore/ClientAuth.sh to Problem list
    + JDK-8255065: Zero: accessor_entry misses the IRIW case
    + JDK-8255226: (tz) Upgrade time-zone data to tzdata2020d
    + JDK-8255269: Unsigned overflow in g1Policy.cpp
    + JDK-8255365: Problem list failing client manual tests
    + JDK-8255457: Shenandoah: cleanup ShenandoahMarkTask
    + JDK-8255466: C2 crashes at ciObject::get_oop() const+0x0
    + JDK-8255550: x86: Assembler::cmpq(Address dst, Register src)
    encoding is incorrect
    + JDK-8255603: Memory/Performance regression after JDK-8210985
    + JDK-8255760: Shenandoah: match constants style in
    ShenandoahMarkTask fallback
    + JDK-8255781: Bump patch update version for OpenJDK:
    jdk-11.0.9.1
    + JDK-8255937: Better cleanup for
    test/jdk/javax/imageio/stream/StreamFlush.java
    + JDK-8256427: Test com/sun/jndi/dns/ConfigTests/
    /PortUnreachable.java does not work on AIX
    + JDK-8256452: Integrate missing part of JDK-8232370 to 11u
    + JDK-8256483: [TESTBUG] serviceability/jvmti/GetClassMethods/
    /libOverpassMethods.c fails to compile on gcc 4.4.x
    + JDK-8256557: libharfbuzz fails to link on gcc 4.4.x due to
  - Wl,-z,defs
    + JDK-8256618: Zero: Linux x86_32 build still fails
    + JDK-8256736: Zero: GTest tests fail with "unsuppported vm
    variant"
    + JDK-8256809: Annotation processing causes NPE during flow
    analysis
    + JDK-8257181: s390x builds are very noisy with gc-sections
    messages
    + JDK-8257242: [macOS] Java app crashes while switching input
    methods
    + JDK-8257545: SunJSSE FIPS regression in key exchange after
    JDK-8171279 11u backport
    + JDK-8257641: Shenandoah: Query is_at_shenandoah_safepoint()
    from control thread should return false
    + JDK-8257701: Shenandoah: objArrayKlass metadata is not marked
    with chunked arrays
    + JDK-8258630: Add expiry exception for QuoVadis root
    certificate
- New upstream dependency on libharfbuzz
- Regenerated patches: missing-return.patch system-pcsclite.patch</changelog>
  <changelog author="fstrba@suse.com" date="1616155200">- Added patches:
  * system-crypto-policy.patch
    + Let OpenJDK use system crypto policies unless explicitely told
    not to
  * nss-security-provider.patch
    + Add the NSS security provider with configuration in generated
    nss.cfg file
  * keytool-default-rsa.patch
    + Make keytool generate RSA keys by default, since only the
    LEGACY system crypto policy allows DSA</changelog>
  <changelog author="pujos.michael@gmail.com" date="1618488000">- moved mozilla-nss dependency to java-11-openjdk-headless package
  This is necessary to be able to do crypto with just
  java-11-openjdk-headless installed. Fixes boo#1184606</changelog>
  <changelog author="fstrba@suse.com" date="1619006400">- Update to upstream tag jdk-11.0.11+9 (April 2021, CPU)
  * Security fixes
    + JDK-8244473: Contextualize registration for JNDI
    + JDK-8244543: Enhanced handling of abstract classes
    + JDK-8249906, CVE-2021-2163, bsc#1185055: Enhance opening JARs
    + JDK-8250568, CVE-2021-2161, bsc#1185056: Less ambiguous
    processing
    + JDK-8253799: Make lists of normal filenames
    + JDK-8257001: Improve Http Client Support
  * Other changes
    + JDK-7107012: sun.jvm.hotspot.code.CompressedReadStream
    readDouble() conversion to long mishandled
    + JDK-7146776: deadlock between URLStreamHandler.getHostAddress
    and file.Handler.openconnection
    + JDK-8086003: Test fails on OSX with java.lang.RuntimeException
    'Narrow klass base: 0x0000000000000000, Narrow klass shift: 3'
    missing
    + JDK-8168869: jdeps: localized messages don't use proper line
    breaks
    + JDK-8180837: SunPKCS11-NSS tests failing with
    CKR_ATTRIBUTE_READ_ONLY and CKR_MECHANISM_PARAM_INVALID
    + JDK-8202343: Disable TLS 1.0 and 1.1
    + JDK-8205992: jhsdb cannot attach to Java processes running in
    Docker containers
    + JDK-8209193: Fix aarch64-linux compilation after -Wreorder
    changes
    + JDK-8210413: AArch64: Optimize div/rem by constant in C1
    + JDK-8210578: AArch64: Invalid encoding for fmlsvs instruction
    + JDK-8211051: jdeps usage of --dot-output doesn't provide
    valid output for modular jar
    + JDK-8211057: Gensrc step CompileProperties generates unstable
    CompilerProperties output
    + JDK-8211150: G1 Full GC not purging code root memory and
    hence causing memory leak
    + JDK-8211825: ModuleLayer.defineModulesWithXXX does not setup
    delegation when module reads automatic module
    + JDK-8212043: Add floating-point Math.min/max intrinsics
    + JDK-8212218: [TESTBUG] runtime/ErrorHandling/
    /TestHeapDumpOnOutOfMemoryErrorInMetaspace.java timed out
    + JDK-8213116: javax/swing/JComboBox/WindowsComboBoxSize/
    /WindowsComboBoxSizeTest.java fails in Windows
    + JDK-8213909: jdeps --print-module-deps should report missing
    dependences
    + JDK-8214180: Need better granularity for sleeping
    + JDK-8214223: tools/jdeps/listdeps/ListModuleDeps.java failed
    due to missing Lib2 file
    + JDK-8214230: Classes generated by SystemModulesPlugin.java
    are not reproducable
    + JDK-8214741: docs/index.html has no title or copyright
    + JDK-8215687: [Graal] unit test CheckGraalIntrinsics failed
    after 8212043
    + JDK-8217848: [Graal] vmTestbase/nsk/jvmti/ResourceExhausted/
    /resexhausted003/TestDescription.java fails
    + JDK-8218482: sun/security/krb5/auto/ReplayCachePrecise.java
    failed - no KrbException thrown
    + JDK-8218550: Add test omitted from JDK-8212043
    + JDK-8221584: SIGSEGV in os::PlatformEvent::unpark() in
    JvmtiRawMonitor::raw_exit while posting method exit event
    + JDK-8221995: AARCH64: problems with CAS instructions encoding
    + JDK-8222518: Remove unnecessary caching of Parker object in
    java.lang.Thread
    + JDK-8222785: aarch64: add necessary masking for immediate
    shift counts
    + JDK-8223186: HotSpot compile warnings from GCC 9
    + JDK-8225773: jdeps --check produces NPE if there are missing
    module dependences
    + JDK-8225805: Java Access Bridge does not close the logger
    + JDK-8226810: Failed to launch JVM because of
    NullPointerException occured on System.props
    + JDK-8229396: jdeps ignores multi-release when
    generate-module-info used on command line
    + JDK-8229474: Shenandoah: Cleanup CM::update_roots()
    + JDK-8232225: Rework the fix for JDK-8071483
    + JDK-8232905: JFR fails with assertion:
    assert(t-&gt;unflushed_size() == 0) failed: invariant
    + JDK-8233164: C2 fails with assert(phase-&gt;C-&gt;get_alias_index(t)
    == phase-&gt;C-&gt;get_alias_index(t_adr)) failed: correct memory
    chain
    + JDK-8233910: java/awt/ColorClass/AlphaColorTest.java is
    failing  intermittently in nightly lnux-x64 system
    + JDK-8233912: aarch64: minor improvements of atomic operations
    + JDK-8234508: VM_HeapWalkOperation::iterate_over_object reads
    non-strong fields with an on-strong load barrier
    + JDK-8234742: Improve handshake logging
    + JDK-8234796: Refactor Handshake::execute to take a more
    complex type than ThreadClosure
    + JDK-8235324: Dying objects are published from users of
    CollectedHeap::object_iterate
    + JDK-8235351: Lookup::unreflect should bind with the original
    caller independent of Method's accessible flag
    + JDK-8237369: Shenandoah: failed vmTestbase/nsk/jvmti/
    /AttachOnDemand/attach021/TestDescription.java test
    + JDK-8237392: Shenandoah: Remove unreliable assertion
    + JDK-8237483: AArch64 C1 OopMap inserted twice fatal error
    + JDK-8237495: Java MIDI fails with a dereferenced memory error
    when asked to send a raw 0xF7
    + JDK-8239355: (dc) Initial value of SO_SNDBUF should allow
    sending large datagrams (macOS)
    + JDK-8240353: AArch64: missing support for
  - XX:+ExtendedDTraceProbes in C1
    + JDK-8240704: CheckHandles.java failed "AssertionError: Handle
    use increased by more than 10 percent."
    + JDK-8240751: Shenandoah: fold ShenandoahTracer definition
    + JDK-8240795: [REDO] 8238384 CTW: C2 compilation fails with
    "assert(store != load-&gt;find_exact_control(load-&gt;in(0)))
    failed: dependence cycle found"
    + JDK-8241598: Upgrade JLine to 3.14.0
    + JDK-8241649: Optimize Character.toString
    + JDK-8241770: Module xxxAnnotation() methods throw NCDFE if
    module-info.class found as resource in unnamed module
    + JDK-8241911: AArch64: Fix a potential register clash issue in
    reduce_add2I
    + JDK-8242030: Wrong package declarations in jline classes after
    JDK-8241598
    + JDK-8242565: Policy initialization issues when the denyAfter
    constraint is enabled
    + JDK-8243618: compiler/rtm/cli tests can be run w/o WhiteBox
    + JDK-8243670: Unexpected test result caused by C2
    MergeMemNode::Ideal
    + JDK-8244088: [Regression] Switch of Gnome theme ends up in
    deadlocked UI
    + JDK-8244154: Update SunPKCS11 provider with PKCS11 v3.0 header
    files
    + JDK-8244340: Handshake processing thread lacks yielding
    + JDK-8244573: java.lang.ArrayIndexOutOfBoundsException thrown
    for malformed class file
    + JDK-8244683: A TSA server used by tests
    + JDK-8245005: javax/net/ssl/compatibility/BasicConnectTest.java
    failed with No enum constant
    + JDK-8245026: PsAdaptiveSizePolicy::_old_gen_policy_is_ready is
    unused
    + JDK-8245283: JFR: Can't handle constant dynamic used by Jacoco
    agent
    + JDK-8245512: CRC32 optimization using AVX512 instructions
    + JDK-8245527: LDAP Channel Binding support for Java
    GSS/Kerberos
    + JDK-8246707: (sc) SocketChannel.read/write throws
    AsynchronousCloseException on closed channel
    + JDK-8246709: sun/security/tools/jarsigner/
    /TsacertOptionTest.java compilation failed after JDK-8244683
    + JDK-8247200: assert((unsigned)fpargs &lt; 32)
    + JDK-8247766: [aarch64] guarantee(val &lt; (1U &lt;&lt; nbits))
    failed: Field too big for insn.
    + JDK-8248336: AArch64: C2: offset overflow in
    BoxLockNode::emit
    + JDK-8248865: Document JNDI/LDAP timeout properties
    + JDK-8248901: Signed immediate support in
    .../share/assembler.hpp is broken.
    + JDK-8249543: Force DirectBufferAllocTest to run with
  - ExplicitGCInvokesConcurrent
    + JDK-8249588: libwindowsaccessbridge issues on 64bit Windows
    + JDK-8249749: modify a primitive array through a stream and a
    for cycle causes jre crash
    + JDK-8249787: Make TestGCLocker more resilient with concurrent
    GCs
    + JDK-8249867: xml declaration is not followed by a newline
    + JDK-8250911: [windows] os::pd_map_memory() error detection
    broken
    + JDK-8251255: [linux] Add process-memory information to hs-err
    and VM.info
    + JDK-8251359: Shenandoah: filter null oops before calling
    enqueue/SATB barrier
    + JDK-8251925: C2: RenaissanceStressTest fails with
    assert(!had_error): bad dominance
    + JDK-8251944: Add Shenandoah test config to
    compiler/gcbarriers/UnsafeIntrinsicsTest.java
    + JDK-8251992: VM crashed running TestComplexAddrExpr.java test
    with -XX:UseAVX=X
    + JDK-8253220: Epsilon: clean up unused code/declarations
    + JDK-8253274: The CycleDMImagetest brokes the system
    + JDK-8253353: Crash in C2: guarantee(n != NULL) failed: No Node
    + JDK-8253368: TLS connection always receives close_notify
    exception
    + JDK-8253404: C2: assert(C-&gt;live_nodes() &lt;=
    C-&gt;max_node_limit()) failed: Live Node limit exceeded limit
    + JDK-8253409: Double-rounding possibility in float fma
    + JDK-8253476: TestUseContainerSupport.java fails on some Linux
    kernels w/o swap limit capabilities
    + JDK-8253524: C2: Refactor code that clones predicates during
    loop unswitching
    + JDK-8253644: C2: assert(skeleton_predicate_has_opaque(iff))
    failed: unexpected
    + JDK-8253681: closed java/awt/dnd/MouseEventAfterStartDragTest/
    /MouseEventAfterStartDragTest.html test failed
    + JDK-8253702: BigSur version number reported as 10.16, should
    be 11.nn
    + JDK-8253756: C2 CompilerThread0 crash in Node::add_req(Node*)
    + JDK-8254104: MethodCounters must exist before nmethod is
    installed
    + JDK-8254734: "dead loop detected" assert failure with patch
    from 8223051
    + JDK-8254748: Bad Copyright header format after JDK-8212218
    + JDK-8254799: runtime/ErrorHandling/
    /TestHeapDumpOnOutOfMemoryError.java fails with release VMs
    + JDK-8255058: C1: assert(is_virtual()) failed: type check
    + JDK-8255351: Add detection for Graviton 2 CPUs
    + JDK-8255368: Math.exp() gives wrong result for large values on
    x86 32-bit platforms
    + JDK-8255387: Japanese characters were printed upside down on
    AIX
    + JDK-8255401: Shenandoah: Allow oldval and newval registers to
    overlap in cmpxchg_oop()
    + JDK-8255479: [aarch64] assert(src-&gt;section_index_of(target) ==
    CodeBuffer::SECT_NONE) failed: sanity
    + JDK-8255544: Create a checked cast
    + JDK-8255559: Leak File Descriptors Because of
    ResolverLocalFilesystem#engineResolveURI()
    + JDK-8255681: print callstack in error case in
    runAWTLoopWithApp
    + JDK-8255734: VM should ignore SIGXFSZ on ppc64, s390 too
    + JDK-8255742: PrintInlining as compiler directive doesn't print
    virtual calls
    + JDK-8255845: Memory leak in imageFile.cpp
    + JDK-8255880: UI of Swing components is not redrawn after their
    internal state changed
    + JDK-8255908: ExceptionInInitializerError due to
    UncheckedIOException while initializing cgroupv1 subsystem
    + JDK-8256025: AArch64: MachCallRuntimeNode::ret_addr_offset()
    is incorrect for stub calls
    + JDK-8256056: Deoptimization stub doesn't save vector registers
    on x86
    + JDK-8256061: RegisterSaver::save_live_registers() omits upper
    halves of ZMM0-15 registers
    + JDK-8256187: [TEST_BUG] Automate bug4275046.java test
    + JDK-8256220: C1: x86_32 fails with -XX:UseSSE=1 after
    JDK-8210764 due to mishandled lir_neg
    + JDK-8256258: some missing NULL checks or asserts after
    CodeCache::find_blob_unsafe
    + JDK-8256264: Printed GlyphVector outline with low DPI has bad
    quality on Windows
    + JDK-8256290: javac/lambda/T8031967.java fails with
    StackOverflowError on x86_32
    + JDK-8256359: AArch64: runtime/ReservedStack/
    /ReservedStackTestCompiler.java fails
    + JDK-8256387: Unexpected result if patching an entire
    instruction on AArch64
    + JDK-8256421: Add 2 HARICA roots to cacerts truststore
    + JDK-8256488: [aarch64] Use ldpq/stpq instead of ld4/st4 for
    small copies in StubGenerator::copy_memory
    + JDK-8256489: Make gtest for long path names on Windows more
    resilient in the presence of virus scanners
    + JDK-8256501: libTestMainKeyWindow fails to build with Xcode
    12.2
    + JDK-8256633: Fix product build on Windows+Arm64
    + JDK-8256682: JDK-8202343 is incomplete
    + JDK-8256751: Incremental rebuild with precompiled header fails
    when touching a header file
    + JDK-8256757: Incorrect MachCallRuntimeNode::ret_addr_offset()
    for CallLeafNoFP on x86_32
    + JDK-8256806: Shenandoah: optimize shenandoah/jni/
    /TestPinnedGarbage.java test
    + JDK-8256807: C2: Not marking stores correctly as mismatched
    in string opts
    + JDK-8256810: Incremental rebuild broken on Macosx
    + JDK-8256818: SSLSocket that is never bound or connected leaks
    socket resources
    + JDK-8256888: Client manual test problem list update
    + JDK-8257083: Security infra test failures caused by
    JDK-8202343
    + JDK-8257408: Bump update version for OpenJDK: jdk-11.0.11
    + JDK-8257423: [PPC64] Support -XX:-UseInlineCaches
    + JDK-8257436: [aarch64] Regressions in ArrayCopyUnalignedDst
    .testByte/testChar for 65-78 bytes when UseSIMDForMemoryOps
    is on
    + JDK-8257513: C2: assert((constant_addr -
    _masm.code()-&gt;consts()-&gt;start()) == con.offset())
    + JDK-8257547: Handle multiple prereqs on the same line in deps
    files
    + JDK-8257561: Some code is not vectorized after 8251925 and
    8250607
    + JDK-8257565: epsilonBarrierSet.hpp should not include
    barrierSetAssembler
    + JDK-8257575: C2: "failed: only phis" assert failure in loop
    strip mining verification
    + JDK-8257594: C2 compiled checkcast of non-null object triggers
    endless deoptimization/recompilation cycle
    + JDK-8257633: Missing -mmacosx-version-min=X flag when linking
    libjvm
    + JDK-8257670: sun/security/ssl/SSLSocketImpl/SSLSocketLeak.java
    reports leaks
    + JDK-8257707: Fix incorrect format string in Http1HeaderParser
    + JDK-8257746: Regression introduced with JDK-8250984 - memory
    might be null in some machines
    + JDK-8257798: [PPC64] undefined reference to
    Klass::vtable_start_offset()
    + JDK-8257884: Re-enable sun/security/ssl/SSLSocketImpl/
    /SSLSocketLeak.java as automatic test
    + JDK-8257910: [JVMCI] Set exception_seen accordingly in the
    runtime.
    + JDK-8257997: sun/security/ssl/SSLSocketImpl/SSLSocketLeak.java
    again reports leaks after JDK-8257884
    + JDK-8257999: Parallel GC crash in gc/parallel/
    /TestDynShrinkHeap.java: new region is not in covered_region
    + JDK-8258077: Using -Xcheck:jni can lead to a double-free after
    JDK-8193234
    + JDK-8258247: Couple of issues in fix for JDK-8249906
    + JDK-8258373: Update the text handling in the JPasswordField
    + JDK-8258396: SIGILL in jdk.jfr.internal.PlatformRecorder
    .rotateDisk()
    + JDK-8258419: RSA cipher buffer cleanup
    + JDK-8258471: "search codecache" clhsdb command does not work
    + JDK-8258534: Epsilon: clean up unused includes
    + JDK-8258805: Japanese characters not entered by mouse click
    on Windows 10
    + JDK-8258833: Cancel multi-part cipher operations in SunPKCS11
    after failures
    + JDK-8258836: JNI local refs exceed capacity
    getDiagnosticCommandInfo
    + JDK-8258884: [TEST_BUG] Convert applet-based test
    open/test/jdk/javax/swing/JMenuItem/8031573/bug8031573.java
    to a regular java test
    + JDK-8259007: This test printed a blank page
    + JDK-8259048: (tz) Upgrade time-zone data to tzdata2020f
    + JDK-8259049: Uninitialized variable after JDK-8257513
    + JDK-8259231: Epsilon: improve performance under contention
    during virtual space expansion
    + JDK-8259271: gc/parallel/TestDynShrinkHeap.java still fails
    "assert(covered_region.contains(new_memregion)) failed: new
    region is not in covered_region"
    + JDK-8259312: VerifyCACerts.java fails as soneraclass2ca cert
    will expire in 90 days
    + JDK-8259319: Illegal package access when SunPKCS11 requires
    SunJCE's classes
    + JDK-8259339: AllocateUninitializedArray C2 intrinsic fails
    with void.class input
    + JDK-8259428: AlgorithmId.getEncodedParams() should return copy
    + JDK-8259446: runtime/jni/checked/
    /TestCheckedReleaseArrayElements.java fails with stderr not
    empty
    + JDK-8259451: Zero: skip serviceability/sa tests, set vm.hasSA
    to false
    + JDK-8259580: Shenandoah: uninitialized label in
    VerifyThreadGCState
    + JDK-8259619: C1: 3-arg StubAssembler::call_RT stack-use
    condition is incorrect
    + JDK-8259633: compiler/graalunit/CoreTest.java fails with NPE
    after JDK-8244543
    + JDK-8259706: C2 compilation fails with assert(vtable_index ==
    Method::invalid_vtable_index) failed: correct sentinel value
    + JDK-8259707: LDAP channel binding does not work with StartTLS
    extension
    + JDK-8259773: Incorrect encoding of AVX-512 kmovq instruction
    + JDK-8259849: Shenandoah: Rename store-val to IU-barrier
    + JDK-8259949: x86 32-bit build fails when -fcf-protection is
    passed in the compiler flags
    + JDK-8259954: gc/shenandoah/mxbeans tests fail with -Xcomp
    + JDK-8260029: aarch64: fix typo in verify_oop_array
    + JDK-8260308: Update LogCompilation junit to 4.13.1
    + JDK-8260338: Some fields in HaltNode is not cloned
    + JDK-8260349: Cannot programmatically retrieve Metaspace max
    set via JAVA_TOOL_OPTIONS
    + JDK-8260356: (tz) Upgrade time-zone data to tzdata2021a
    + JDK-8260378: [TESTBUG] DcmdMBeanTestCheckJni.java reports
    false positive
    + JDK-8260497: Shenandoah: Improve SATB flushing
    + JDK-8260502: [s390] NativeMovRegMem::verify() fails because
    it's too strict
    + JDK-8260632: Build failures after JDK-8253353
    + JDK-8260704: ParallelGC: oldgen expansion needs release-store
    for _end
    + JDK-8261022: Fix incorrect result of Math.abs() with char type
    + JDK-8261089: [TESTBUG] native library of test
    TestCheckedReleaseCriticalArray.java fails to compile with
    gcc 4.x
    + JDK-8261183: Follow on to Make lists of normal filenames
    + JDK-8261209: isStandalone property: remove dependency on
    pretty-print
    + JDK-8261231: Windows IME was disabled after DnD operation
    + JDK-8261251: Shenandoah: Use object size for full GC
    humongous compaction
    + JDK-8261310: PPC64 Zero build fails with
    'VMError::controlled_crash(int)::FunctionDescriptor
    functionDescriptor' has incomplete type and cannot be defined
    + JDK-8261334: NMT: tuning statistic shows incorrect hash
    distribution
    + JDK-8261413: Shenandoah: Disable class-unloading in I-U mode
    + JDK-8261522: [PPC64] AES intrinsics write beyond the
    destination array
    + JDK-8261534: Test sun/security/pkcs11/KeyAgreement/
    /IllegalPackageAccess.java fails on platforms where no nsslib
    artifacts are defined
    + JDK-8261585: Restore HandleArea used in
    Deoptimization::uncommon_trap
    + JDK-8261753: Test java/lang/System/OsVersionTest.java still
    failing on BigSur patch versions after JDK-8253702
    + JDK-8261829: Exclude tools/jlink/JLinkReproducibleTest.java
    in 11u
    + JDK-8261912: Code IfNode::fold_compares_helper more
    defensively
    + JDK-8261920: [AIX] jshell command throws java.io.IOError on
    non English locales
    + JDK-8262018: Wrong format in SAP copyright header of
    OsVersionTest
    + JDK-8263069: Exclude some failing tests from
    security/infra/java/security/cert/CertPathValidator</changelog>
  <changelog author="fstrba@suse.com" date="1620043200">- Remove all Jpackage provides for SLE12 in order to avoid
  installing this package as default Java on SLE12-SP5
  (bsc#1185476)</changelog>
  <changelog author="fstrba@suse.com" date="1621512000">- Modified patch:
  * nss-security-provider.patch
    + make the NSS provider first in the list</changelog>
  <changelog author="fstrba@suse.com" date="1626868800">- Update to upstream tag jdk-11.0.12+7 (July 2021, CPU)
  * Security fixes
    + JDK-8256157: Improve bytecode assembly
    + JDK-8256491: Better HTTP transport
    + JDK-8258432, CVE-2021-2341, bsc#1188564: Improve file
    transfers
    + JDK-8260453: Improve Font Bounding
    + JDK-8260960: Signs of jarsigner signing
    + JDK-8260967, CVE-2021-2369, bsc#1188565: Better jar file
    validation
    + JDK-8262380: Enhance XML processing passes
    + JDK-8262403: Enhanced data transfer
    + JDK-8262410: Enhanced rules for zones
    + JDK-8262477: Enhance String Conclusions
    + JDK-8262967: Improve Zip file support
    + JDK-8264066, CVE-2021-2388, bsc#1188566: Enhance compiler
    validation
    + JDK-8264079: Improve abstractions
    + JDK-8264460: Improve NTLM support
  * Other changes
    + JDK-6847157: java.lang.NullPointerException: HDC for
    component at sun.java2d.loops.Blit.Blit
    + JDK-7106851: Test should not use System.exit
    + JDK-8073446: TimeZone getOffset API does not  return a dst
    offset between years 2038-2137
    + JDK-8076190: Customizing the generation of a PKCS12 keystore
    + JDK-8153005: Upgrade the default PKCS12 encryption/MAC
    algorithms
    + JDK-8171303: sun/java2d/pipe/InterpolationQualityTest.java
    fails on Windows &amp; Linux
    + JDK-8177068: incomplete classpath causes NPE in Flow
    + JDK-8185734: [Windows] Structured Exception Catcher missing
    around gtest execution
    + JDK-8187450: JNI local refs exceeds capacity warning in
    NetworkInterface::getAll
    + JDK-8190763: Class cast exception on (CompoundEdit)
    UndoableEditEvent.getEdit()
    + JDK-8195841: PNGImageReader.readNullTerminatedString() doesnt
    check for non-null terminated strings with length equal to
    maxLen
    + JDK-8196100: javax/swing/text/JTextComponent/5074573/
    /bug5074573.java fails
    + JDK-8199646: JShell tests: jdk/jshell/
    /FailOverDirectExecutionControlTest.java failed with
    java.lang.UnsupportedOperationException
    + JDK-8206925: Support the certificate_authorities extension
    + JDK-8207160: ClassReader::adjustMethodParams can potentially
    return null if the args list is empty
    + JDK-8207247: AARCH64: Enable Minimal and Client VM builds
    + JDK-8207404: MulticastSocket tests failing on AIX
    + JDK-8207779: Method::is_valid_method() compares 'this' with
    NULL
    + JDK-8208061: runtime/LoadClass/TestResize.java fails with
    "Load factor too high" when running in CDS mode.
    + JDK-8209459: TestSHA512MultiBlockIntrinsics failed on AArch64
    + JDK-8210443: Migrate Locale matching tests to JDK Repo.
    + JDK-8213231: ThreadSnapshot::_threadObj can become stale
    + JDK-8213483: ARM32: runtime/ErrorHandling/
    /ShowRegistersOnAssertTest.java jtreg test fail
    + JDK-8213725: JShell NullPointerException due to class file
    with unexpected package
    + JDK-8213794: ARM32: disable TypeProfiling,
    CriticalJNINatives, Serviceablity tests for ARM32
    + JDK-8213845: ARM32: Interpreter doesn't call result handler
    after native calls
    + JDK-8214128: ARM32: wrong stack alignment on
    Deoptimization::unpack_frames
    + JDK-8214512: ARM32: Jtreg test compiler/c2/Test8062950.java
    fails on ARM
    + JDK-8214854: JDWP: Unforseen output truncation in logging
    + JDK-8214922: Add vectorization support for fmin/fmax
    + JDK-8215009: GCC 8 compilation error in libjli
    + JDK-8216184: CDS/appCDS tests failed on Windows due to long
    path to a classlist file
    + JDK-8216259: AArch64: Vectorize Adler32 intrinsics
    + JDK-8216314: SIGILL in CodeHeapState::print_names()
    + JDK-8217348: assert(thread-&gt;is_Java_thread()) failed: just
    checking
    + JDK-8217465: [REDO] - Optimize CodeHeap Analytics
    + JDK-8217561: X86: Add floating-point Math.min/max intrinsics
    + JDK-8217918: C2: -XX:+AggressiveUnboxing is broken
    + JDK-8218458: [TESTBUG] runtime/NMT/
    /CheckForProperDetailStackTrace.java fails with Expected
    stack trace missing from output
    + JDK-8219142: Remove unused JIMAGE_ResourcePath
    + JDK-8219586: CodeHeap State Analytics processes dead nmethods
    + JDK-8220074: Clean up GCC 8.3 errors in LittleCMS
    + JDK-8220407: compiler/intrinsics/math/
    /TestFpMinMaxIntrinsics.java timedout
    + JDK-8222302: [TESTBUG] test/hotspot/jtreg/compiler/intrinsics/
    /sha/cli/TestUseSHAOptionOnUnsupportedCPU.java fails on any
    other CPU
    + JDK-8222412: AARCH64: multiple instructions encoding issues
    + JDK-8223020: aarch64: expand minI_rReg and maxI_rReg patterns
    into separate instructions
    + JDK-8223444: Improve CodeHeap Free Space Management
    + JDK-8223504: Improve performance of forall loops by better
    inlining of "iterator()" methods
    + JDK-8223667: ASAN build broken
    + JDK-8225081: Remove Telia Company CA certificate expiring in
    April 2021
    + JDK-8225116: Test OwnedWindowsLeak.java intermittently fails
    + JDK-8225438: javax/net/ssl/TLSCommon/
    /TestSessionLocalPrincipal.java failed with Read timed out
    + JDK-8225756: [testbug] compiler/loopstripmining/
    /CheckLoopStripMining.java sets too short a
    SafepointTimeoutDelay
    + JDK-8226374: Restrict TLS signature schemes and named groups
    + JDK-8226627: assert(t-&gt;singleton()) failed: must be a constant
    + JDK-8226721: Missing intrinsics for Math.ceil, floor, rint
    + JDK-8227080: (fs) Files.newInputStream(...).skip(n) is slow
    + JDK-8227222: vmTestbase/jit/FloatingPoint/gen_math/Loops04/
    /Loops04.java failed XMM register should be 0-15
    + JDK-8227609: (fs) Files.newInputStream(...).skip(n) should
    allow skipping beyond file size
    + JDK-8230428: Cleanup dead CastIP node code in formssel.cpp
    + JDK-8231460: Performance issue (CodeHeap) with large free
    blocks
    + JDK-8231713: x86_32 build failures after JDK-8226721 (Missing
    intrinsics for Math.ceil, floor, rint)
    + JDK-8231841: AArch64: debug.cpp help() is missing an AArch64
    line for pns
    + JDK-8232084: HotSpot build failed with GCC 9.2.1
    + JDK-8232591: AArch64: Add missing match rules for smaddl,
    smsubl and smnegl
    + JDK-8233185: HttpServer.stop() blocks indefinitely when
    called on dispatch thread
    + JDK-8233787: Break cycle in vm_version* includes
    + JDK-8233948: AArch64: Incorrect mapping between OptoReg and
    VMReg for high 64 bits of Vector Register
    + JDK-8234355: Buffer overflow in jcmd GC.class_stats due to
    too many classes
    + JDK-8235368: Update BCEL to Version 6.4.1
    + JDK-8236859: WebSocket over authenticating proxy fails with
    NPE
    + JDK-8236992: AArch64: remove redundant load_klass in itable
    stub
    + JDK-8237743: test/langtools/jdk/jshell/
    /FailOverExecutionControlTest.java fails No
    ExecutionControlProvider with name 'nonExistent' and parameter
    keys: []
    + JDK-8237804: sun/security/mscapi tests fail with "Key pair
    not generated, alias &lt;nnnnnn&gt; already exists"
    + JDK-8238175: CTW: Class.getDeclaredMethods fails with
    assert(k-&gt;is_subclass_of(SystemDictionary::Throwable_klass()))
    failed: invalid exception class
    + JDK-8238567: SoftMainMixer.processAudioBuffers(): Wrong
    handling of stoppedMixers
    + JDK-8238812: assert(false) failed: bad AD file
    + JDK-8239312: [macos] javax/swing/JFrame/NSTexturedJFrame/
    /NSTexturedJFrame.java
    + JDK-8239386: handle ContendedPaddingWidth in
    vm_version_aarch64
    + JDK-8239536: Can't use 'java.util.List' object after
    importing 'java.awt.List'
    + JDK-8240487: Cleanup whitespace in .cc, .hh, .m, and .mm files
    + JDK-8240848: ArrayIndexOutOfBoundsException buf for
    TextCallbackHandler
    + JDK-8241082: Upgrade IANA Language Subtag Registry data to
    03-16-2020 version
    + JDK-8241087: Build failure with VS 2019 (16.5.0) due to C2039
    and C2873
    + JDK-8241101: [s390] jtreg test failure after JDK-8238696: not
    conformant features string
    + JDK-8241248: NullPointerException in
    sun.security.ssl.HKDF.extract(HKDF.java:93)
    + JDK-8241372: Several test failures due to
    javax.net.ssl.SSLException: Connection reset
    + JDK-8241475: AArch64: Add missing support for PopCountVI node
    + JDK-8241829: Cleanup the code for PrinterJob on windows
    + JDK-8241960: The SHA3 message digests impl of SUN provider
    are not thread safe after cloned
    + JDK-8242010: Upgrade IANA Language Subtag Registry to Version
    2020-04-01
    + JDK-8242429: Better implementation for sign extract
    + JDK-8242557: Add length limit for strings in PNGImageWriter
    + JDK-8242919: Paste locks up jshell
    + JDK-8243155: AArch64: Add support for SqrtVF
    + JDK-8243240: AArch64: Add support for MulVB
    + JDK-8243452: JFR: Could not create chunk in repository with
    over 200 recordings
    + JDK-8243559: Remove root certificates with 1024-bit keys
    + JDK-8243597: AArch64: Add support for integer vector abs
    + JDK-8244031: HttpClient should have more tests for HEAD
    requests
    + JDK-8244205: HTTP/2 tunnel connections through proxy may be
    reused regardless of which proxy is selected
    + JDK-8244847: Linux/PPC: runtime/CompressedOops/
    /CompressedClassPointers: smallHeapTest fails
    + JDK-8245511: G1 adaptive IHOP does not account for
    reclamation of humongous objects by young GC
    + JDK-8246274: G1 old gen allocation tracking is not in a
    separate class
    + JDK-8247354: [aarch64] PopFrame causes
    assert(oopDesc::is_oop(obj)) failed: not an oop
    + JDK-8247408: IdealGraph bit check expression canonicalization
    + JDK-8247432: Update IANA Language Subtag Registry to Version
    2020-09-29
    + JDK-8247438: JShell: When FailOverExecutionControlProvider
    fails the proximal cause is not shown
    + JDK-8247753: UIManager.getSytemLookAndFeelClassName() returns
    wrong value on Fedora 32
    + JDK-8248043: Need to eliminate excessive i2l conversions
    + JDK-8248411: [aarch64] Insufficient error handling when
    CodeBuffer is exhausted
    + JDK-8248568: compiler/c2/TestBit.java failed: test missing
    from stdout/stderr
    + JDK-8248870: AARCH64: I2L/L2I conversions can be skipped for
    masked positive values
    + JDK-8249142: java/awt/FontClass/CreateFont/DeleteFont.sh is
    unstable
    + JDK-8249189: AARCH64: more L2I conversions can be skipped
    + JDK-8249719: MethodHandle performance suffers from bad
    ResolvedMethodTable hash function
    + JDK-8249875: GCC 10 warnings -Wtype-limits with JFR code
    + JDK-8250635: MethodArityHistogram should use Compile_lock in
    favour of fancy checks
    + JDK-8250876: Fix issues with cross-compile on macos
    + JDK-8251031: Some vmTestbase/nsk/monitoring/RuntimeMXBean
    tests fail with hostnames starting from digits
    + JDK-8251525: AARCH64: Faster Math.signum(fp)
    + JDK-8252259: AArch64: Adjust default value of FLOATPRESSURE
    + JDK-8252311: AArch64: save two words in itable lookup stub
    + JDK-8252779: compiler/graalunit/HotspotTest.java failed after
    8251525
    + JDK-8252883: AccessDeniedException caused by delayed file
    deletion on Windows
    + JDK-8253167: ARM32 builds fail after JDK-8247910
    + JDK-8253572: [windows] CDS archive may fail to open with long
    file names
    + JDK-8253923: C2 doesn't always run loop opts for compilations
    that include loops
    + JDK-8253948: Memory leak in ImageFileReader
    + JDK-8254631: Better support ALPN byte wire values in SunJSSE
    + JDK-8254717: isAssignableFrom checks in
    KeyFactorySpi.engineGetKeySpec appear to be backwards
    + JDK-8255086: Update the root locale display names
    + JDK-8255625: AArch64: Implement Base64.encodeBlock
    accelerator/intrinsic
    + JDK-8255763: C2: OSR miscompilation caused by invalid memory
    instruction placement
    + JDK-8255992: JFR EventWriter does not use first string from
    StringPool with id 0
    + JDK-8256037: [TESTBUG] com/sun/jndi/dns/ConfigTests/
    /PortUnreachable.java fails due to the hard coded threshold
    is small
    + JDK-8256244: java/lang/ProcessHandle/PermissionTest.java
    fails with TestNG 7.1
    + JDK-8256287: [windows] add loop fuse to
    map_or_reserve_memory_aligned
    + JDK-8256523: Streamline Java SHA2 implementation
    + JDK-8257414: Drag n Drop target area is wrong on high DPI
    systems
    + JDK-8257569: Failure observed with
    JfrVirtualMemory::initialize
    + JDK-8257574: C2: "failed: parsing found no loops but there
    are some" assert failure
    + JDK-8257580: Bump update version for OpenJDK: jdk-11.0.12
    + JDK-8257604: JNI_ArgumentPusherVaArg leaks valist
    + JDK-8257621: JFR StringPool misses cached items across
    consecutive recordings
    + JDK-8257796: [TESTBUG]
    TestUseSHA512IntrinsicsOptionOnSupportedCPU.java fails
    on x86_32
    + JDK-8257822: C2 crashes with SIGFPE due to a division that
    floats above its zero check
    + JDK-8257828: SafeFetch may crash if invoked in non-JavaThreads
    + JDK-8257853: Remove dependencies on JNF's JNI utility
    functions in AWT and 2D code
    + JDK-8257858: [macOS]: Remove JNF dependency from
    libosxsecurity/KeystoreImpl.m
    + JDK-8257860: [macOS]: Remove JNF dependency from
    libosxkrb5/SCDynamicStoreConfig.m
    + JDK-8257988: Remove JNF dependency from
    libsaproc/MacosxDebuggerLocal.m
    + JDK-8258414: OldObjectSample events too expensive
    + JDK-8258505: [TESTBUG] TestDivZeroWithSplitIf.java fails due
    to missing UnlockDiagnosticVMOptions
    + JDK-8258753: StartTlsResponse.close() hangs due to
    synchronization issues
    + JDK-8259061: C2: assert(found) failed: memory-writing node is
    not placed in its original loop or an ancestor of it
    + JDK-8259227: C2 crashes with SIGFPE due to a division that
    floats above its zero check
    + JDK-8259232: Bad JNI lookup during printing
    + JDK-8259276: C2: Empty expression stack when reexecuting
    tableswitch/lookupswitch instructions after deoptimization
    + JDK-8259343: [macOS] Update JNI error handling in Cocoa code.
    + JDK-8259585: Accessible actions do not work on mac os x
    + JDK-8259651: [macOS] Replace JNF_COCOA_ENTER/EXIT macros
    + JDK-8259662: Don't wrap SocketExceptions into SSLExceptions
    in SSLSocketImpl
    + JDK-8259710: Inlining trace leaks memory
    + JDK-8259729: Missed JNFInstanceOf -&gt; IsInstanceOf conversion
    + JDK-8259777: Incorrect predication condition generated by ADLC
    + JDK-8259786: initialize last parameter of getpwuid_r
    + JDK-8259843: initialize dli_fname array before calling
    dll_address_to_library_name
    + JDK-8259869: [macOS] Remove desktop module dependencies on
    JNF Reference APIs
    + JDK-8259886: Improve SSL session cache performance and
    scalability
    + JDK-8259983: do not use uninitialized expand_ms value in
    G1CollectedHeap::expand_heap_after_young_collection
    + JDK-8260030: Improve stringStream buffer handling
    + JDK-8260236: better init AnnotationCollector _contended_group
    + JDK-8260255: C1: LoopInvariantCodeMotion constructor can
    leave some fields uninitialized
    + JDK-8260284: C2: assert(_base == Int) failed: Not an Int
    + JDK-8260380: Upgrade to LittleCMS 2.12
    + JDK-8260420: C2 compilation fails with assert(found_sfpt)
    failed: no node in loop that's not input to safepoint
    + JDK-8260426: awt debug_mem.c DMem_AllocateBlock might leak
    memory
    + JDK-8260432: allocateSpaceForGP in freetypeScaler.c might
    leak memory
    + JDK-8260616: Removing remaining JNF dependencies in the
    java.desktop module
    + JDK-8260653: Unreachable nodes keep speculative types alive
    + JDK-8260707: java/lang/instrument/PremainClass/
    /InheritAgent0100.java times out
    + JDK-8260925: HttpsURLConnection does not work  with other
    JSSE provider.
    + JDK-8260926: Trace resource exhausted events unconditionally
    + JDK-8261020: Wrong format parameter in
    create_emergency_chunk_path
    + JDK-8261027: AArch64: Support for LSE atomics C++ HotSpot code
    + JDK-8261167: print_process_memory_info add a close call after
    fopen
    + JDK-8261170: Upgrade to freetype 2.10.4
    + JDK-8261198: [macOS] Incorrect JNI parameters in number
    conversion in A11Y code
    + JDK-8261235: C1 compilation fails with
    assert(res-&gt;vreg_number() == index) failed: conversion check
    + JDK-8261261: The version extra fields needs to be overridable
    in jib-profiles.js
    + JDK-8261262: Kitchensink24HStress.java crashed with
    EXCEPTION_ACCESS_VIOLATION
    + JDK-8261354: SIGSEGV at MethodIteratorHost
    + JDK-8261355: No data buffering in SunPKCS11 Cipher encryption
    when the underlying mechanism has no padding
    + JDK-8261397: try catch Method failing to work when dividing
    an integer by 0
    + JDK-8261422: Adjust problematic String.format calls in
    jdk/internal/util/Preconditions.java outOfBoundsMessage
    + JDK-8261447: MethodInvocationCounters frequently run into
    overflow
    + JDK-8261481: Cannot read Kerberos settings in dynamic store
    on macOS Big Sur
    + JDK-8261505: Test test/hotspot/jtreg/gc/parallel/
    /TestDynShrinkHeap.java killed by Linux OOM Killer
    + JDK-8261601: free memory in early return in
    Java_sun_nio_ch_sctp_SctpChannelImpl_receive0
    + JDK-8261649: AArch64: Optimize LSE atomics in C++ code
    + JDK-8261730: C2 compilation fails with
    assert(store-&gt;find_edge(load) != -1) failed: missing
    precedence edge
    + JDK-8261752: Multiple GC test are missing memory requirements
    + JDK-8261791: (sctp) handleSendFailed in SctpChannelImpl.c
    potential leaks
    + JDK-8261812: C2 compilation fails with assert(!had_error)
    failed: bad dominance
    + JDK-8261914: IfNode::fold_compares_helper faces
    non-canonicalized bool when running JRuby JSON workload
    + JDK-8262093: java/util/concurrent/tck/JSR166TestCase.java
    failed "assert(false) failed: unexpected node"
    + JDK-8262110: DST starts from incorrect time in 2038
    + JDK-8262121: [11u] Redo 8244287: JFR: Methods samples have
    line number 0
    + JDK-8262163: Extend settings printout in jcmd VM.metaspace
    + JDK-8262295: C2: Out-of-Bounds Array Load from Clone Source
    + JDK-8262298: G1BarrierSetC2::step_over_gc_barrier fails with
    assert "bad barrier shape"
    + JDK-8262446: DragAndDrop hangs on Windows
    + JDK-8262461: handle wcstombsdmp return value correctly in
    unix awt_InputMethod.c
    + JDK-8262465: Very long compilation times and high memory
    consumption in C2 debug builds
    + JDK-8262726: AArch64: C1 StubAssembler::call_RT can corrupt
    stack
    + JDK-8262739: String inflation C2 intrinsic prevents insertion
    of anti-dependencies
    + JDK-8262829: Native crash in
    Win32PrintServiceLookup.getAllPrinterNames()
    + JDK-8262837: handle split_USE correctly
    + JDK-8262900: ToolBasicTest fails to access HTTP server it
    starts
    + JDK-8263260: [s390] Support latest hardware (z14 and z15)
    + JDK-8263311: Watch registry changes for remote printers
    update instead of polling
    + JDK-8263361: Incorrect arraycopy stub selected by C2 for SATB
    collectors
    + JDK-8263404: RsaPrivateKeySpec is always recognized as
    RSAPrivateCrtKeySpec in RSAKeyFactory.engineGetKeySpec
    + JDK-8263425: AArch64: two potential bugs in C1
    LIRGenerator::generate_address()
    + JDK-8263448: CTW: fatal error: meet not symmetric
    + JDK-8263504: Some OutputMachOpcodes fields are uninitialized
    + JDK-8263557: Possible NULL dereference in
    Arena::destruct_contents()
    + JDK-8263558: Possible NULL dereference in fast path arena
    free if ZapResourceArea is true
    + JDK-8263676: AArch64: one potential bug in C1
    LIRGenerator::generate_address()
    + JDK-8263729: [test] divert spurious output away from stream
    under test in ProcessBuilder Basic test
    + JDK-8263846: Bad JNI lookup getFocusOwner in accessibility
    code on Mac OS X
    + JDK-8264047: Duplicate global variable 'jvm' in libjavajpeg
    and libawt
    + JDK-8264096: slowdebug jvm crashes when StrInflatedCopy match
    rule is not supported
    + JDK-8264151: ciMethod::ensure_method_data() should return
    false is loading resulted in empty state
    + JDK-8264173: [s390] Improve Hardware Feature Detection And
    Reporting
    + JDK-8264190: Harden TLS interop tests
    + JDK-8264223: CodeHeap::verify fails extra_hops assertion in
    fastdebug test
    + JDK-8264328: Broken license in
    javax/swing/JComboBox/8072767/bug8072767.java
    + JDK-8264360: Loop strip mining verification fails with
    "should be on the backedge"
    + JDK-8264626: C1 should be able to inline excluded methods
    + JDK-8264640: CMS ParScanClosure misses a barrier
    + JDK-8264786: [macos] All Swing/AWT apps cause Allow
    Notifications prompt to appear when app is launched
    + JDK-8264821: DirectIOTest fails on a system with large block
    size
    + JDK-8264848: [macos] libjvm.dylib linker warning due to macOS
    version mismatch
    + JDK-8264923: PNGImageWriter.write_zTXt throws Exception with
    a typo
    + JDK-8264958: C2 compilation fails with assert "n is later
    than its clone"
    + JDK-8265099: Revert backport to 11u of 8236859: WebSocket
    over authenticating proxy fails with NPE
    + JDK-8265154: vinserti128 operand mix up for KNL platforms
    + JDK-8265239: Shenandoah: Shenandoah heap region count could
    be off by 1
    + JDK-8265417: Backport of JDK-8249672 breaks Solaris x86 build
    + JDK-8265421: java/lang/String/StringRepeat.java test is
    missing a memory requirement
    + JDK-8265462: Handle multiple slots in the NSS Internal Module
    from SunPKCS11's Secmod
    + JDK-8265537: x86 version string truncated after JDK-8249672
    11u backport
    + JDK-8265666: Enable AIX build platform to make external debug
    symbols
    + JDK-8265677: CMS: CardTableBarrierSet::write_ref_array_work()
    lacks storestore barrier
    + JDK-8265690: Use the latest Ubuntu base image version in
    Docker testing
    + JDK-8265718: Build failure after JDK-8258414 11u backport
    + JDK-8265750: Fatal error in safepoint.cpp after backport of
    8258414
    + JDK-8265784: [C2] Hoisting of DecodeN leaves MachTemp inputs
    behind
    + JDK-8265938: C2's conditional move optimization does not
    handle top Phi
    + JDK-8266220: keytool still prompt for store password on a
    password-less pkcs12 file if -storetype pkcs12 is specified
    + JDK-8266293: Key protection using PBEWithMD5AndDES fails with
    "java.security.InvalidAlgorithmParameterException: Salt must
    be 8 bytes long"
    + JDK-8266713: [AIX] Build failure after 11u backport of
    JDK-8247753
    + JDK-8266802: Shenandoah: Round up region size to page size
    unconditionally
    + JDK-8266892: avoid maybe-uninitialized gcc warnings on linux
    s390x
    + JDK-8266929: Unable to use algorithms from 3p providers
    + JDK-8267235: [macos_aarch64]
    InterpreterRuntime::throw_pending_exception messing up LR
    results in crash
    + JDK-8267561: Shenandoah: Reference processing not properly
    setup for outside of cycle degenerated GC
    + JDK-8267599: Revert the change to the default PKCS12
    macAlgorithm and macIterationCount props for 11u/8u/7u
    + JDK-8267641: [11u] 8227609 backport typo
    + JDK-8267721: Enable sun/security/pkcs11 tests for Amazon
    Linux 2 AArch64
    + JDK-8268678: LetsEncryptCA.java test fails as Let's Encrypt
    Authority X3 is retired</changelog>
  <changelog author="schwab@suse.de" date="1628078400">- riscv64-zero.patch: Add support for riscv64 (zero VM)</changelog>
  <changelog author="fstrba@suse.com" date="1629979200">- Added patch:
  * jdk11-glibc234.patch
    + fix build with glibc-2.34 (bsc#1189201)</changelog>
  <changelog author="fstrba@suse.com" date="1631534400">- Modified patch:
  * nss-security-provider.patch
    + revert recent changes making NSS provider the default one
    + fixes bsc#1190252</changelog>
  <changelog author="fstrba@suse.com" date="1631793600">- Added patch:
  * fips.patch
    + implement FIPS support in OpenJDK</changelog>
  <changelog author="fstrba@suse.com" date="1634817600">- Update to upstream tag jdk-11.0.13+8 (October 2021 CPU)
  * Security fixes
    + JDK-8163326, CVE-2021-35550, bsc#1191901: Update the default
    enabled cipher suites preference
    + JDK-8254967, CVE-2021-35565, bsc#1191909:
    com.sun.net.HttpsServer spins on TLS session close
    + JDK-8263314: Enhance XML Dsig modes
    + JDK-8265167, CVE-2021-35556, bsc#1191910: Richer Text Editors
    + JDK-8265574: Improve handling of sheets
    + JDK-8265580, CVE-2021-35559, bsc#1191911: Enhanced style for
    RTF kit
    + JDK-8265776: Improve Stream handling for SSL
    + JDK-8266097, CVE-2021-35561, bsc#1191912: Better hashing
    support
    + JDK-8266103: Better specified spec values
    + JDK-8266109: More Resilient Classloading
    + JDK-8266115: More Manifest Jar Loading
    + JDK-8266137, CVE-2021-35564, bsc#1191913: Improve Keystore
    integrity
    + JDK-8266689, CVE-2021-35567, bsc#1191903: More Constrained
    Delegation
    + JDK-8267086: ArrayIndexOutOfBoundsException in
    java.security.KeyFactory.generatePublic
    + JDK-8267712: Better LDAP reference processing
    + JDK-8267729, CVE-2021-35578, bsc#1191904: Improve TLS client
    handshaking
    + JDK-8267735, CVE-2021-35586, bsc#1191914: Better BMP support
    + JDK-8268193: Improve requests of certificates
    + JDK-8268199: Correct certificate requests
    + JDK-8268205: Enhance DTLS client handshake
    + JDK-8268506: More Manifest Digests
    + JDK-8269618, CVE-2021-35603, bsc#1191906: Better session
    identification
    + JDK-8269624: Enhance method selection support
    + JDK-8270398: Enhance canonicalization
    + JDK-8270404: Better canonicalization
  * Other changes
    + JDK-8024368: private methods are allocated vtable indices
    + JDK-8042902: Test java/net/Inet6Address/serialize/
    /Inet6AddressSerializationTest.java fails intermittently
    + JDK-8140466: ChaCha20 and Poly1305 TLS Cipher Suites
    + JDK-8157404: Unable to read certain PKCS12 keystores from
    SequenceInputStream
    + JDK-8158066: SourceDebugExtensionTest fails to rename file
    + JDK-8168304: Make all of DependencyContext_test available in
    product mode
    + JDK-8169246: java/net/DatagramSocket/ReportSocketClosed.java
    fails intermittently with BindException
    + JDK-8181313: SA: Remove libthread_db dependency on Linux
    + JDK-8193214: Incorrect annotations.without.processors
    warnings with JDK 9
    + JDK-8194230: jdk/internal/jrtfs/remote/
    /RemoteRuntimeImageTest.java fails with
    java.lang.NullPointerException
    + JDK-8196092: javax/swing/JComboBox/8032878/bug8032878.java
    fails
    + JDK-8199931: java/net/MulticastSocket/
    /UnreferencedMulticastSockets.java fails with "incorrect data
    received"
    + JDK-8206083: Make tools/javac/api/T6265137.java robust to JDK
    version changes
    + JDK-8206350: java/util/Locale/bcp47u/SystemPropertyTests.java
    failed on Mac 10.13 with zh_CN and zh_TW locales.
    + JDK-8207316: java/nio/channels/spi/SelectorProvider/
    /inheritedChannel/InheritedChannelTest.java failed
    + JDK-8208227: tools/jdeps/DotFileTest.java fails on Win-X64
    + JDK-8208363: test/jdk/java/lang/Package/
    /PackageFromManifest.java missing module dependencies
    declaration
    + JDK-8209380: ARM: cleanup maybe-uninitialized and reorder
    compiler warnings
    + JDK-8209768: Refactor java/util/prefs/CheckUserPrefsStorage.sh
    to plain java test
    + JDK-8209772: Refactor shell test java/util/ServiceLoader/
    /basic/basic.sh to java
    + JDK-8209773: Refactor shell test javax/naming/module/basic.sh
    to java
    + JDK-8209832: Refactor jdk/internal/reflect/Reflection/
    /GetCallerClassTest.sh to plain java test
    + JDK-8209930: Refactor java/util/zip/ZipFile/deletetempjar.sh
    to plain java test
    + JDK-8210406: Refactor java.util.PluggableLocale:i18n shell
    tests to plain java tests
    + JDK-8210407: Refactor java.util.Calendar:i18n shell tests to
    plain java tests
    + JDK-8210495: compiler crashes because of illegal signature in
    otherwise legal code
    + JDK-8210669: Some launcher tests assume a pre-JDK 9 run-time
    image layout
    + JDK-8210802: temp files left by tests in
    jdk/java/net/httpclient
    + JDK-8210819: Update the host name in CNameTest.java
    + JDK-8210908: Refactor java/util/prefs/PrefsSpi.sh to plain
    java test
    + JDK-8210934: Move sun/net/www/protocol/http/
    /GetErrorStream.java to OpenJDK
    + JDK-8210959: JShell fails and exits when statement throws an
    exception whose message contains a '%'.
    + JDK-8211055: Provide print to a file (PDF) feature even when
    printer was not connected
    + JDK-8211092: test/jdk/sun/net/www/http/HttpClient/
    /MultiThreadTest.java fails intermittently when cleaning up
    + JDK-8211296: Remove HotSpot deprecation warning suppression
    for Mac/clang
    + JDK-8211325: test/jdk/java/net/Socket/LingerTest.java fails
    with cleaning up
    + JDK-8212040: Compilation error due to wrong usage of
    NSPrintJobDispositionValue in mac10.12
    + JDK-8212695: Add explicit timeout to several HTTP Client tests
    + JDK-8212718: Refactor some annotation processor tests to
    better use collections
    + JDK-8213007: Update the link in test/jdk/sun/security/
    /provider/SecureRandom/DrbgCavp.java
    + JDK-8213137: Remove static initialization of monitor/mutex
    instances
    + JDK-8213235: java/nio/channels/SocketChannel/
    /AsyncCloseChannel.java fails with threads that didn't exit
    + JDK-8213409: Refactor sun.text.IntHashtable:i18n shell tests
    to plain java tests
    + JDK-8213576: Make test AsyncCloseChannel.java run in othervm
    + JDK-8213694: Test Timeout.java should run in othervm mode
    + JDK-8213718: [TEST] Wrong classname in vmTestbase/nsk/stress/
    /except/except002 and except003
    + JDK-8213922: fix ctw stand-alone build
    + JDK-8214195: Align stdout messages in
    test/jdk/java/math/BigInteger/PrimitiveConversionTests.java
    + JDK-8214520: [TEST_BUG] sun/security/mscapi/nonUniqueAliases/
    /NonUniqueAliases.java failed with incorrect jtreg tags order
    + JDK-8214937: sun/security/tools/jarsigner/warnings/
    /NoTimestampTest.java failed due to unexpected expiration date
    + JDK-8216532: tools/launcher/Test7029048.java fails (Solaris)
    + JDK-8217825: Verify @AfterTest is used correctly in WebSocket
    tests
    + JDK-8218145: block_if_requested is not proper inlined due to
    size
    + JDK-8219417: bump jtreg requiredVersion to b14
    + JDK-8219552: bump jtreg requiredVersion to b14 in
    test/jdk/sanity/client/
    + JDK-8219804: java/net/MulticastSocket/Promiscuous.java fails
    intermittently due to NumberFormatException
    + JDK-8220445: Support for side by side MSVC Toolset versions
    + JDK-8221988: add possibility to build with Visual Studio 2019
    + JDK-8222751: closed/test/jdk/sun/security/util/
    /DerIndefLenConverter/IndefBerPkcs12.java fail
    + JDK-8223050: JVMCI: findUniqueConcreteMethod() should not use
    Dependencies::find_unique_concrete_method() for non-virtual
    methods
    + JDK-8224853: CDS address sanitizer errors
    + JDK-8225082: Remove IdenTrust certificate that is expiring in
    September 2021
    + JDK-8225583: Examine the HttpResponse.BodySubscribers for
    null handling and multiple subscriptions
    + JDK-8225690: Multiple AttachListener threads can be created
    + JDK-8225790: Two NestedDialogs tests fail on Ubuntu
    + JDK-8226319: Add forgotten test/jdk/java/net/httpclient/
    /BodySubscribersTest.java
    + JDK-8226533: JVMCI: findUniqueConcreteMethod should handle
    statically bindable methods directly
    + JDK-8226602: Test convenience reactive primitives from
    java.net.http with RS TCK
    + JDK-8226683: Remove review suggestion from fix to 8219804
    + JDK-8227738: jvmti/DataDumpRequest/datadumpreq001 failed due
    to "exit code is 134"
    + JDK-8227766: CheckUnhandledOops is broken in MemAllocator
    + JDK-8227815: Minimal VM: set_state is not a member of
    AttachListener
    + JDK-8230674: Heap dumps should exclude dormant CDS archived
    objects of unloaded classes
    + JDK-8230808: Remove Access::equals()
    + JDK-8230841: Remove oopDesc::equals()
    + JDK-8231717: Improve performance of charset decoding when
    charset is always compactable
    + JDK-8232243: Wrong caret position in JTextPane on Windows
    with a screen resolution &gt; 100%
    + JDK-8232782: Shenandoah: streamline post-LRB CAS barrier
    (aarch64)
    + JDK-8233790: Forward output from heap dumper to jcmd/jmap
    + JDK-8233989: Create an IPv4 version of
    java/net/MulticastSocket/SetLoopbackMode.java
    + JDK-8234510: Remove file seeking requirement for writing a
    heap dump
    + JDK-8235211: serviceability/attach/
    /RemovingUnixDomainSocketTest.java fails with
    AttachNotSupportedException: Unable to open socket file
    + JDK-8235216: typo in test filename
    + JDK-8235866: bump jtreg requiredVersion to 4.2b16
    + JDK-8236111: narrow allowSmartActionArgs disabling
    + JDK-8236413: AbstractConnectTimeout should tolerate both
    NoRouteToHostException and UnresolvedAddressException
    + JDK-8236671: NullPointerException in JKS keystore
    + JDK-8238930: problem list compiler/c2/Test8004741.java
    + JDK-8238943: switch to jtreg 5.0
    + JDK-8240555: Using env of JAVA_TOOL_OPTIONS and _JAVA_OPTIONS
    breaks QuietOption.java test
    + JDK-8240983: Incorrect copyright header in Apache Santuario
    2.1.3 files
    + JDK-8241336: Some java.net tests failed with
    NoRouteToHostException on MacOS with special network
    configuration
    + JDK-8241353: NPE in ToolProvider.getSystemJavaCompiler
    + JDK-8241768: git needs .gitattributes
    + JDK-8242882: opening jar file with large manifest might throw
    NegativeArraySizeException
    + JDK-8244973: serviceability/attach/
    /RemovingUnixDomainSocketTest.java fails "stderr was not
    empty"
    + JDK-8245134: test/lib/jdk/test/lib/security/
    /KeyStoreUtils.java should allow to specify aliases
    + JDK-8246261: TCKLocalTime.java failed due to "AssertionError:
    expected [18:14:22] but found [18:14:23]"
    + JDK-8246387: switch to jtreg 5.1
    + JDK-8247421: [TESTBUG] ReturnBlobToWrongHeapTest.java failed
    allocating blob
    + JDK-8247469: getSystemCpuLoad() returns -1 on linux when some
    offline cpus are present and cpusets.effective_cpus is not
    available
    + JDK-8248352: [TEST_BUG] Test test/jdk/java/awt/font/
    /TextLayout/ArabicDiacriticTest.java can leave frame open
    + JDK-8248403: AArch64: Remove uses of kernel integer types
    + JDK-8248414: AArch64: Remove uses of long and unsigned long
    ints
    + JDK-8248657: Windows: strengthening in ThreadCritical
    regarding memory model
    + JDK-8248666: AArch64: Use THREAD_LOCAL instead of __thread
    + JDK-8248668: AArch64: Avoid MIN/MAX macros when using MSVC
    + JDK-8248671: AArch64: Remove unused variables
    + JDK-8248682: AArch64: Use ATTRIBUTE_ALIGNED helper
    + JDK-8248816: C1: Fix signature conflict in
    LIRGenerator::strength_reduce_multiply
    + JDK-8249095: tools/javac/launcher/SourceLauncherTest.java
    fails on Windows
    + JDK-8249548: backward focus traversal gets stuck in button
    group
    + JDK-8249773: Upgrade ReceiveISA.java test to be resilient to
    failure due to stray packets and interference
    + JDK-8249897: jdk/javadoc/tool/LangVers.java uses @ignore w/o
    bug-id
    + JDK-8249898: jdk/javadoc/tool/6176978/T6176978.java uses
    @ignore w/o bug-id
    + JDK-8249899: jdk/javadoc/tool/InlineTagsWithBraces.java uses
    @ignore w/o bug-id
    + JDK-8250588: Shenandoah: LRB needs to save/restore fp
    registers for runtime call
    + JDK-8250824: AArch64: follow up for JDK-8248414
    + JDK-8251166: Add automated testcases for changes done in
    JDK-8214112
    + JDK-8251252: Add automated testcase for fix done in
    JDK-8214253
    + JDK-8251254: Add automated test for fix done in JDK-8218472
    + JDK-8251361: Potential race between Logger configuration and
    GCs in HttpURLConWithProxy test
    + JDK-8251549: Update docs on building for Git
    + JDK-8251945: SIGSEGV in
    PackageEntry::purge_qualified_exports()
    + JDK-8252194: Add automated test for fix done in JDK-8218469
    + JDK-8252648: Shenandoah: name gang tasks consistently
    + JDK-8252825: Add automated test for fix done in JDK-8218479
    + JDK-8252853: AArch64: gc/shenandoah/TestVerifyJCStress.java
    fails intermittently with C1
    + JDK-8252857: AArch64: Shenandoah C1 CAS is not sequentially
    consistent
    + JDK-8253048: AArch64: When CallLeaf, no need to preserve
    callee-saved registers in caller
    + JDK-8253424: Add support for running pre-submit testing using
    GitHub Actions
    + JDK-8253631: Remove unimplemented CompileBroker methods after
    JEP-165
    + JDK-8253865: Pre-submit testing using GitHub Actions does not
    detect failures reliably
    + JDK-8253899: Make IsClassUnloadingEnabled signature match
    specification
    + JDK-8254024: Enhance native libs for AWT and Swing to work
    with GraalVM Native Image
    + JDK-8254054: Pre-submit testing using GitHub Actions should
    not use the deprecated set-env command
    + JDK-8254173: Add Zero, Minimal hotspot targets to submit
    workflow
    + JDK-8254175: Build no-pch configuration in debug mode for
    submit checks
    + JDK-8254244: Some code emitted by TemplateTable::branch is
    unused when running TieredCompilation
    + JDK-8254270: linux 32 bit build doesn't compile
    libjdwp/log_messages.c
    + JDK-8254282: Add Linux x86_32 builds to submit workflow
    + JDK-8254850: Update terminology in java.awt.GridBagLayout
    source code comments
    + JDK-8255255: Update Apache Santuario (XML Signature) to
    version 2.2.1
    + JDK-8255305: Add Linux x86_32 tier1 to submit workflow
    + JDK-8255352: Archive important test outputs in submit workflow
    + JDK-8255373: Submit workflow artifact name is always
    "test-results_.zip"
    + JDK-8255452: Doing GC during JVMTI MethodExit event posting
    breaks return oop
    + JDK-8255718: Zero: VM should know it runs in interpreter-only
    mode
    + JDK-8255790: GTKL&amp;F: Java 16 crashes on initialising GTKL&amp;F
    on Manjaro Linux
    + JDK-8255810: Zero: build fails without JVMTI
    + JDK-8255895: Submit workflow artifacts miss hs_errs/replays
    due to ZIP include mismatch
    + JDK-8256127: Add cross-compiled foreign architectures builds
    to submit workflow
    + JDK-8256215: Shenandoah: re-organize saving/restoring machine
    state in assembler code
    + JDK-8256267: Relax compiler/floatingpoint/NaNTest.java for
    x86_32 and lower -XX:+UseSSE
    + JDK-8256277: Github Action build on macOS should define OS
    and Xcode versions
    + JDK-8256354: Github Action build on Windows should define OS
    and MSVC versions
    + JDK-8256393: Github Actions build on Linux should define OS
    and GCC versions
    + JDK-8256414: add optimized build to submit workflow
    + JDK-8256747: GitHub Actions: decouple the hotspot build-only
    jobs from Linux x64 testing
    + JDK-8257056: Submit workflow should apt-get update to avoid
    package installation errors
    + JDK-8257148: Remove obsolete code in AWTView.m
    + JDK-8257497: Update keytool to create AKID from the SKID of
    the issuing certificate as specified by RFC 5280
    + JDK-8257620: Do not use objc_msgSend_stret to get macOS
    version
    + JDK-8257913: Add more known library locations to simplify
    Linux cross-compilation
    + JDK-8258703: Incorrect 512-bit vector registers restore on
    x86_32
    + JDK-8259338: Add expiry exception for identrustdstx3 alias to
    VerifyCACerts.java test
    + JDK-8259535: ECDSA SignatureValue do not always have the
    specified length
    + JDK-8259679: GitHub actions should use MSVC 14.28
    + JDK-8259924: GitHub actions fail on Linux x86_32 with "Could
    not configure libc6:i386"
    + JDK-8260460: GitHub actions still fail on Linux x86_32 with
    "Could not configure libc6:i386"
    + JDK-8260589: Crash in JfrTraceIdLoadBarrier::load(_jclass*)
    + JDK-8260923: Add more tests for SSLSocket input/output
    shutdown
    + JDK-8261072: AArch64: Fix MacroAssembler::get_thread
    convention
    + JDK-8261147: C2: Node is wrongly marked as reduction
    resulting in a wrong execution due to wrong vector instructions
    + JDK-8261238: NMT should not limit baselining by size threshold
    + JDK-8261496: Shenandoah: reconsider pacing updates memory
    ordering
    + JDK-8261652: Remove some dead comments from os_bsd_x86
    + JDK-8261846: [JVMCI] c2v_iterateFrames can get out of sync
    with the StackFrameStream
    + JDK-8262000: jdk/jfr/event/gc/detailed/
    /TestPromotionFailedEventWithParallelScavenge.java failed with
    "OutOfMemoryError: Java heap space"
    + JDK-8262017: C2: assert(n != __null) failed: Bad immediate
    dominator info.
    + JDK-8262392: Update Mesa 3-D Headers to version 21.0.3
    + JDK-8262409: sun/security/ssl/SSLSocketImpl/
    /SSLSocketImplThrowsWrongExceptions. SSL test failures caused
    by java failed with "Server reported the wrong exception"
    + JDK-8262470: Printed GlyphVector outline with low DPI has bad
    quality on Windows
    + JDK-8262862: Harden tests sun/security/x509/URICertStore/
    /ExtensionsWithLDAP.java and krb5/canonicalize/Test.java
    + JDK-8263136: C4530 was reported from VS 2019 at access bridge
    + JDK-8263227: C2: inconsistent spilling due to dead nodes in
    exception block
    + JDK-8263382: java/util/logging/ParentLoggersTest.java failed
    with "checkLoggers: getLoggerNames() returned unexpected
    loggers"
    + JDK-8263407: SPARC64 detection fails on Athena (SPARC64-X)
    + JDK-8263432: javac may report an invalid package/class clash
    on case insensitive filesystems
    + JDK-8263490: [macos] Crash occurs on JPasswordField with
    activated InputMethod
    + JDK-8263531: Remove unused buffer int
    + JDK-8263667: Avoid running GitHub actions on branches named
    pr/*
    + JDK-8263776: [JVMCI] add helper to perform Java upcalls
    + JDK-8264016: [JVMCI] add some thread local fields for use by
    JVMCI
    + JDK-8264752: SIGFPE crash with option
    FlightRecorderOptions:threadbuffersize=30M
    + JDK-8265132: C2 compilation fails with assert "missing
    precedence edge"
    + JDK-8265231: (fc) ReadDirect and WriteDirect tests fail after
    fix for JDK-8264821
    + JDK-8265335: Epsilon: Minor typo in EpsilonElasticTLABDecay
    description
    + JDK-8265756: AArch64: initialize memory allocated for locals
    according to Windows AArch64 stack page growth requirement in
    template interpreter
    + JDK-8265761: Font with missed font family name is not
    properly printed on Windows
    + JDK-8265773: incorrect jdeps message "jdk8internals" to
    describe a removed JDK internal API
    + JDK-8265836: OperatingSystemImpl.getCpuLoad() returns
    incorrect CPU load inside a container
    + JDK-8266018: Shenandoah: fix an incorrect assert
    + JDK-8266206: Build failure after JDK-8264752 with older GCCs
    + JDK-8266248: Compilation failure in
    PLATFORM_API_MacOSX_MidiUtils.c with Xcode 12.5
    + JDK-8266288: assert root method not found in
    witnessed_reabstraction_in_supers is too strong
    + JDK-8266404: Fatal error report generated with
  - XX:+CrashOnOutOfMemoryError should not contain suggestion to
    submit a bug report
    + JDK-8266480: Implicit null check optimization does not update
    control of hoisted memory operation
    + JDK-8266615: C2 incorrectly folds subtype checks involving an
    interface array
    + JDK-8266642: Improve ResolvedMethodTable hash function
    + JDK-8266749: AArch64: Backtracing broken on PAC enabled
    systems
    + JDK-8266761: AssertionError in
    sun.net.httpserver.ServerImpl.responseCompleted
    + JDK-8266813: Shenandoah: Use shorter instruction sequence for
    checking if marking in progress
    + JDK-8267042: bug in monitor locking/unlocking on ARM32 C1 due
    to uninitialized BasicObjectLock::_displaced_header
    + JDK-8267348: Rewrite gc/epsilon/TestClasses.java to use
    Metaspace with less classes
    + JDK-8267396: Avoid recording "pc" in unhandled oops detector
    for better performance
    + JDK-8267399: C2: java/text/Normalizer/ConformanceTest.java
    test failed with assertion
    + JDK-8267424: CTW: C1 fails with "State must not be null"
    + JDK-8267459: Pasting Unicode characters into JShell does not
    work.
    + JDK-8267625: AARCH64: typo in LIR_Assembler::emit_profile_type
    + JDK-8267666: Add option to jcmd GC.heap_dump to use existing
    file
    + JDK-8267695: Bump update version for OpenJDK: jdk-11.0.13
    + JDK-8267751: (test) jtreg.SkippedException has no serial
    VersionUID
    + JDK-8267773: PhaseStringOpts::int_stringSize doesn't handle
    min_jint correctly
    + JDK-8268103: JNI functions incorrectly return a double after
    JDK-8265836
    + JDK-8268127: Shenandoah: Heap size may be too small for
    region to align to large page size
    + JDK-8268261: C2: assert(n != __null) failed: Bad immediate
    dominator info.
    + JDK-8268347: C2: nested locks optimization may create
    unbalanced monitor enter/exit code
    + JDK-8268360: Missing check for infinite loop during node
    placement
    + JDK-8268362: [REDO] C2 crash when compile negative
    Arrays.copyOf length after loop
    + JDK-8268366: Incorrect calculation of has_fpu_registers in C1
    linear scan
    + JDK-8268369: SIGSEGV in PhaseCFG::implicit_null_check due to
    missing null check
    + JDK-8268417: Add test from JDK-8268360
    + JDK-8268427: Improve AlgorithmConstraints:checkAlgorithm
    performance
    + JDK-8268617: [11u REDO] - WebSocket over authenticating proxy
    fails with NPE
    + JDK-8268620: InfiniteLoopException test may fail on x86
    platforms
    + JDK-8268635: Corrupt oop in ClassLoaderData
    + JDK-8268699: Shenandoah: Add test for JDK-8268127
    + JDK-8268771: javadoc -notimestamp option does not work on
    index.html
    + JDK-8268775: Password is being converted to String in
    AccessibleJPasswordField
    + JDK-8268776: Test `ADatagramSocket.java` missing /othervm
    from @run tag
    + JDK-8268965: TCP Connection Reset when connecting simple
    socket to SSL server
    + JDK-8269304: Regression ~5% in 2005 in b27
    + JDK-8269415: [11u] Remove ea from
    DEFAULT_PROMOTED_VERSION_PRE in OpenJDK 11u
    + JDK-8269478: Shenandoah: gc/shenandoah/mxbeans tests should
    be more resilient
    + JDK-8269529: javax/swing/reliability/
    /HangDuringStaticInitialization.java fails in Windows debug
    build
    + JDK-8269594: assert(_handle_mark_nesting &gt; 1) failed: memory
    leak: allocating handle outside HandleMark
    + JDK-8269614: [s390] Interpreter checks wrong bit for slow
    path instance allocation
    + JDK-8269650: Optimize gc-locker in
    [Get|Release]StringCritical for latin string
    + JDK-8269661: JNI_GetStringCritical does not lock char array
    + JDK-8269668: [aarch64] java.library.path not including
    /usr/lib64
    + JDK-8269763: The JEditorPane is blank after JDK-8265167
    + JDK-8269795: C2: Out of bounds array load floats above its
    range check in loop peeling resulting in SEGV
    + JDK-8269847: JDK-8269594 backport breaks 11u builds
    + JDK-8269850: Most JDK releases report macOS version 12 as
    10.16 instead of 12.0
    + JDK-8269851: OperatingSystemMXBean getProcessCpuLoad reports
    incorrect process cpu usage in containers
    + JDK-8269882: stack-use-after-scope in NewObjectA
    + JDK-8269934: RunThese24H.java failed with
    EXCEPTION_ACCESS_VIOLATION in
    java_lang_Thread::get_thread_status
    + JDK-8270096: Shenandoah: Optimize gc/shenandoah/
    /TestRefprocSanity.java for interpreter mode
    + JDK-8270137: Kerberos Credential Retrieval from Cache not
    Working in Cross-Realm Setup
    + JDK-8270184: [TESTBUG] Add coverage for jvmci
    ResolvedJavaType.toJavaName() for lambdas
    + JDK-8270196: [11u] [JVMCI] JavaType.toJavaName() returns
    incorrect type name for lambdas
    + JDK-8270556: Exclude security/infra/java/security/cert/
    /CertPathValidator/certification/LetsEncryptCA
    + JDK-8270893: IndexOutOfBoundsException while reading large
    TIFF file
    + JDK-8272078: Wrong Checksums in Temurin BootJDK dependencies
    + JDK-8272124: Cgroup v1 initialization causes
    NullPointerException when cgroup path contains colon
    + JDK-8272131: PhaseMacroExpand::generate_slow_arraycopy crash
    when clone null CallProjections.fallthrough_ioproj
    + JDK-8272197: Update 11u GHA workflow with Shenandoah
    configurations
    + JDK-8272332: --with-harfbuzz=system doesn't add -lharfbuzz
    after JDK-8255790
    + JDK-8272472: StackGuardPages test doesn't build with glibc
    2.34
    + JDK-8272602: [macos] not all KEY_PRESSED events sent when
    control modifier is used
    + JDK-8272628: Problemlist gc/stress/gcbasher/
    /TestGCBasherWithCMS.java for x86_32
    + JDK-8272700: [macos] Build failure with Xcode 13.0 after
    JDK-8264848
    + JDK-8272772: Shenandoah: compiler/c2/aarch64/
    /TestVolatilesShenandoah.java fails in 11u
    + JDK-8273939: Backport of 8248414 to JDK11 breaks
    MacroAssembler::adrp
- Remove the unneeded icedtea-sound provider
- Removed patches:
  * icedtea-sound-1.0.1-jdk9.patch
  * icedtea-sound-soundproperties.patch
    + not needed since the icedtea-sound provider is removed
  * jdk11-glibc234.patch
    + integrated upstream</changelog>
  <changelog author="fstrba@suse.com" date="1635940800">- Modified patches:
  * system-crypto-policy.patch
    + rediff to changed context
  * fips.patch
    + Allow plain key import in fips mode unless
    com.suse.fips.plainKeySupport is set to false</changelog>
  <changelog author="fstrba@suse.com" date="1636113600">- Modified patch:
  * fips.patch
    + return in native code after generating java.io.IOException</changelog>
</package>
<package pkgid="b11aa5a220130ee00c41b4af1fb58921bd661bc41fa5398c6d7d81f8828a4a23" name="java-11-openjdk-demo" arch="ppc64le">
  <version epoch="0" ver="11.0.13.0" rel="3.68.1"/>
  <changelog author="fstrba@suse.com" date="1586952000">- The pack200 and unpack200 alternatives should be slaves of java
  and not of javac, since they are part of JRE.</changelog>
  <changelog author="fstrba@suse.com" date="1587470400">- Update to upstream tag jdk-11.0.7+10 (April 2020 CPU,
  bsc#1169511)
  * Security fixes:
    + S8223898, CVE-2020-2754: Forward references to Nashorn
    + S8223904, CVE-2020-2755: Improve Nashorn matching
    + S8224541, CVE-2020-2756: Better mapping of serial ENUMs
    + S8224549, CVE-2020-2757: Less Blocking Array Queues
    + S8225603: Enhancement for big integers
    + S8226346: Build better binary builders
    + S8227467: Better class method invocations
    + S8227542: Manifest improved jar headers
    + S8229733: TLS message handling improvements
    + S8231415, CVE-2020-2773: Better signatures in XML
    + S8231785: Improved socket permissions
    + S8232424, CVE-2020-2778: More constrained algorithms
    + S8232581, CVE-2020-2767: Improve TLS verification
    + S8233250: Better X11 rendering
    + S8233410: Better Build Scripting
    + S8234027: Better JCEKS key support
    + S8234408, CVE-2020-2781: Improve TLS session handling
    + S8234825, CVE-2020-2800: Better Headings for HTTP Servers
    + S8234841, CVE-2020-2803: Enhance buffering of byte buffers
    + S8235274, CVE-2020-2805: Enhance typing of methods
    + S8235691, CVE-2020-2816: Enhance TLS connectivity
    + S8236201, CVE-2020-2830: Better Scanner conversions
    + S8238960: linux-i586 builds are inconsistent as the newly
    built jdk is not able to reserve enough space for object heap
  * Other changes:
    + S4919790: Errors in alert ssl message does not reflect the
    actual certificate status
    + S4949105: Access Bridge lacks html tags parsing
    + S7092821: java.security.Provider.getService() is synchronized
    and became scalability bottleneck
    + S7143743: Potential memory leak with zip provider
    + S8005819: Support cross-realm MSSFU
    + S8042383: [TEST_BUG] Test javax/swing/plaf/basic/BasicMenuUI/
    /4983388/bug4983388.java fails with shortcuts on menus do not
    work
    + S8068184: Fix for JDK-8032832 caused a deadlock
    + S8145845: [AOT] NullPointerException in
    compiler/whitebox/GetCodeHeapEntriesTest.java
    + S8152988: [AOT] Update test batch definitions to include
    aot-ed java.base module mode into hs-comp testing
    + S8160926: FLAGS_COMPILER_CHECK_ARGUMENTS doesn't handle
    cross-compilation
    + S8163083: SocketListeningConnector does not allow invocations
    with port 0
    + S8163251: Hard coded loop limit prevents reading of smart
    card data greater than 8k
    + S8167276: jvmci/compilerToVM/MaterializeVirtualObjectTest.java
    fails with -XX:-EliminateAllocations
    + S8169718: nsk/jdb/locals/locals002: ERROR: Cannot find
    boolVar with expected value: false
    + S8176556:
    java/awt/dnd/ImageTransferTest/ImageTransferTest.java fails
    for JFIF
    + S8178798: Two compiler/aot/verification/vmflags tests fail by
    timeout with UseAVX=3
    + S8183107: PKCS11 regression regarding checkKeySize
    + S8185005: Improve performance of
    ThreadMXBean.getThreadInfo(long ids[], int maxDepth)
    + S8189633: Missing -Xcheck:jni checking for DeleteWeakGlobalRef
    + S8189861: Refactor CacheFind
    + S8193042: NativeLookup::lookup_critical_entry() should only
    load shared library once
    + S8193596: java/net/DatagramPacket/ReuseBuf.java failed due to
    timeout
    + S8194944: Regression automated test 'open/test/jdk/javax/
    /swing/JInternalFrame/8145896/TestJInternalFrameMaximize.java'
    fails
    + S8196467: javax/swing/JInternalFrame/Test6325652.java fails
    + S8196969: JTreg Failure: serviceability/sa/ClhsdbJstack.java
    causes NPE
    + S8198321: javax/swing/JEditorPane/5076514/bug5076514.java
    fails
    + S8198398: Test javax/swing/JColorChooser/Test6199676.java
    fails in mach5
    + S8199072: Test javax/swing/GroupLayout/6613904/
    /bug6613904.java is unstable
    + S8200432: javadoc fails with ClassCastException on {@link
    byte[]}
    + S8201349: build broken when configured with
  - -with-zlib=bundled on gcc 7.3
    + S8201355: Avoid native memory allocation in
    sun.security.mscapi.PRNG.generateSeed
    + S8201513: nsk/jvmti/IterateThroughHeap/filter-* are broken
    + S8203364: Some serviceability/sa/ tests intermittently fail
    with java.io.IOException: LingeredApp terminated with non-zero
    exit code 3
    + S8203687: javax/net/ssl/compatibility/Compatibility.java
    supports TLS 1.3
    + S8203904: javax/swing/JSplitPane/4816114/bug4816114.java: The
    divider location is wrong
    + S8203911: Test runtime/modules/getModuleJNI/GetModule fails
    with -Xcheck:jni
    + S8204525: [TESTBUG] runtime/NMT/MallocStressTest.java ran out
    of java heap
    + S8204529: gc/TestAllocateHeapAtMultiple.java fail with Agent
    7 timed out
    + S8204551: Event descriptions are truncated in logs
    + S8206963: [AOT] bug with multiple class loaders
    + S8207367: 10 vmTestbase/nsk/jdi tests timed out when running
    with jtreg
    + S8207832: serviceability/sa/ClhsdbCDSCore.java failed with
    "Couldn't find core file location"
    + S8207938: At step6,Click Add button,case failed automatically.
    + S8208157: requires.VMProps throws NPE for missing properties
    in "release" file
    + S8208379: compiler/jvmci/events/
    /JvmciNotifyInstallEventTest.java failed with "Got unexpected
    event count after 2nd install attempt: expected 9 to equal 2"
    + S8208658: Make CDS archived heap regions usable even if
    compressed oop encoding has changed
    + S8208715: Conversion of milliseconds to nanoseconds in
    UNIXProcess contains bug
    + S8209361: [AOT] Unexpected number of references for
    JVMTI_HEAP_REFERENCE_CONSTANT_POOL [111--&gt;111]: 0 (expected
    at least 1)
    + S8209385: CDS runtime classpath checking is too strict when
    only classes from the system modules are archived
    + S8209389: SIGSEGV in WalkOopAndArchiveClosure::do_oop_work.
    + S8209418: Synchronize test/jdk/sanity/client/lib/jemmy with
    code-tools/jemmy/v2
    + S8209494: Create a test for SwingSet InternalFrameDemo
    + S8209499: Create test for SwingSet EditorPaneDemo
    + S8209574: [AOT] breakpoint events are generated in different
    threads does not meet expected count
    + S8209686: cleanup arguments to PhaseIdealLoop() constructor
    + S8209789: Synchronize test/jdk/sanity/client/lib/jemmy with
    code-tools/jemmy/v2
    + S8209802: Garbage collectors should register JFR types
    themselves to avoid build errors.
    + S8209807: improve handling exception in requires.VMProps
    + S8209817: stack is executable when building with Clang on
    Linux
    + S8209824: Improve the code coverage for ThreadLocal
    + S8209826: Undefined reference to os::write after JDK-8209657
    (filemap.hpp cleanup)
    + S8209850: Allow NamedThreads to use GlobalCounter critical
    sections
    + S8209976: Improve iteration over non-JavaThreads
    + S8209993: Create a test for SwingSet3 ToolTipDemo
    + S8210024: JFR calls virtual is_Java_thread from ~Thread()
    + S8210052: Enable testing for all the available look and feels
    in SwingSet3 demo tests
    + S8210055: Enable different look and feel tests in SwingSet3
    demo tests
    + S8210057: Enable different look and feels in SwingSet3 demo
    test InternalFrameDemoTest
    + S8210058: Algorithmic Italic font leans opposite angle in
    Printing
    + S8210220: [AOT] jdwp test cases are failing with error #
    ERROR: TEST FAILED: Cought IOException while receiving event
    packet
    + S8210289: ArchivedKlassSubGraphInfoRecord is incomplete
    + S8210459: Add support for generating compile_commands.json
    + S8210476: sun/security/mscapi/PrngSlow.java fails with Still
    too slow
    + S8210512: [Testbug] vmTestbase/nsk/jdi/ObjectReference/
    /referringObjects/referringObjects002/referringObjects002.java
    fails with unexpected size of
    ClassLoaderReference.referringObjects
    + S8210523: runtime/appcds/cacheObject/DifferentHeapSizes.java
    crash
    + S8210632: Add key exchange algorithm to
    javax/net/ssl/TLSCommon/CipherSuite.java
    + S8210699: Problem list tests which times out in Xcomp mode
    + S8210793: [JVMCI] AllocateCompileIdTest.java failed to find
    DiagnosticCommand.class
    + S8210910: Create test for FileChooserDemo
    + S8210994: Create test for SwingSet3 FrameDemo
    + S8211139: Increase timeout value in all tests under
    jdk/sanity/client/SwingSet/src
    + S8211160: Handle different look and feels in
    JInternalFrameOperator
    + S8211211: vmTestbase/metaspace/stressDictionary/
    /StressDictionary.java timeout
    + S8211322: Reduce the timeout of tooltip in SwingSet2DemoTest
    + S8211443: Enable different look and feels in SwingSet3 demo
    test SplitPaneDemoTest
    + S8211703: JInternalFrame : java.lang.AssertionError: cannot
    find the internal frame
    + S8211781: re-building fails after changing Graal sources
    + S8212897: Some improvements in the EditorPaneDemotest
    + S8212903: [TestBug] Tests test/jdk/javax/swing/LookAndFeel/
    /8145547/DemandGTK2.sh and DemandGTK3.sh fail on Ubuntu 18.04
    LTS
    + S8213009: Refactoring existing SunMSCAPI classes
    + S8213010: Supporting keys created with certmgr.exe
    + S8213168: Enable different look and feel tests in SwingSet3
    demo test FileChooserDemoTest
    + S8213348: jdk.internal.vm.compiler.management service
    providers missing in module descriptor
    + S8213906: Update arm devkits with libXrandr headers
    + S8213908: AssertionError in DeferredAttr at setOverloadKind
    + S8214124: [TESTBUG] Bugs in runtime/NMT/MallocStressTest.java
    + S8214344: C2: assert(con.basic_type() != T_ILLEGAL) failed:
    elembt=byte; loadbt=void; unsigned=0
    + S8214345: infinite recursion while checking super class
    + S8214471: Enable different look and feel tests in SwingSet3
    demo test ToolTipDemoTest
    + S8214534: Setting of THIS_FILE in the build is broken
    + S8214557: Filter out VM flags which don't affect AOT code
    generation
    + S8214578: [macos] Problem with backslashes on macOS/JIS
    keyboard: Java ignores system settings
    + S8214840: runtime/NMT/MallocStressTest.java timed out
    + S8214850: Rename vm_operations.?pp files to vmOperations.?pp
    files
    + S8214904: Test8004741.java failed due to "Too few ThreadDeath
    hits; expected at least 6 but saw only 5"
    + S8215322: add @file support to jaotc
    + S8215355: Object monitor deadlock with no threads holding the
    monitor (using jemalloc 5.1)
    + S8215396: JTabbedPane preferred size calculation is wrong for
    SCROLL_TAB_LAYOUT
    + S8216180: [AOT] compiler/intrinsics/bigInteger/TestMulAdd.java
    crashed with AOT enabled
    + S8216353: Use utility APIs introduced in org/netbeans/jemmy/
    /util/LookAndFeel class in client sanity test cases
    + S8216354: Syntax error in toolchain_windows.m4
    + S8216472: (se) Stack overflow during selection operation
    leads to crash (win)
    + S8216535: tools/jimage/JImageExtractTest.java timed out
    + S8217235: Create automated test for SwingSet
    ColorChooserDemoTest
    + S8217297: Add support for multiple look and feel for SwingSet
    SliderDemoTest
    + S8217338: [Containers] Improve systemd slice memory limit
    support
    + S8217613: [AOT] TEST_OPTS_AOT_MODULES doesn't work on mac
    + S8217634: RunTest documentation and usability update
    + S8217717: ZGC: Broken oop map in C1 load barrier stub
    + S8217728: Speed up incremental rerun of "make hotspot"
    + S8218268: Javac treats Manifest Class-Path entries as Paths
    instead of URLs
    + S8218662: Allow 204 responses with Content-Length:0
    + S8218882: NET_Writev is declared, NET_WriteV is defined
    + S8218889: Improperly use of the Optional API
    + S8219205: JFR file without license header
    + S8219597: (bf) Heap buffer state changes could provoke
    unexpected exceptions
    + S8219723: javax/net/ssl/compatibility/Compatibility.java
    failed on some SNI cases
    + S8220348: [ntintel] asserts about copying unaligned array
    + S8220451: jdi/EventQueue/remove/remove004 failed due to
    "ERROR: thread2 is not alive"
    + S8220456: jdi/EventQueue/remove_l/remove_l004 failed due to
    "TIMEOUT while waiting for event"
    + S8220479: java/nio/channels/Selector/SelectWithConsumer.java
    failed at testTwoChannels()
    + S8220613: java/util/Arrays/TimSortStackSize2.java times out
    with fastdebug build
    + S8220688: [TESTBUG] runtime/NMT/MallocStressTest.java timed
    out
    + S8220786: Create new switch to redirect error reporting
    output to stdout or stderr
    + S8221270: Duplicated synchronized keywords in SSLSocketImpl
    + S8221312: test/jdk/sanity/client/SwingSet/src/
    /ColorChooserDemoTest.java failed
    + S8221851: Use of THIS_FILE in hotspot invalidates precompiled
    header on Linux/GCC
    + S8221885: Add intermittent test in the JavaSound to the
    ProblemList
    + S8222264: Windows incremental build is broken with JDK-8217728
    + S8222391: javax/net/ssl/compatibility/Compatibility.java
    should be more flexible
    + S8222448: java/lang/reflect/PublicMethods/
    /PublicMethodsTest.java times out
    + S8222519: ButtonDemoScreenshotTest fails randomly with "still
    state to be reached"
    + S8222741: jdi/EventQueue/remove/remove004 fails due to
    VMDisconnectedException
    + S8223003: SunMSCAPI keys are not cleaned up
    + S8223063: Support CNG RSA keys
    + S8223158: Docked MacBook cannot start any Java Swing
    applications
    + S8223260: NamingManager should cache InitialContextFactory
    + S8223464: Improve version string for Oracle CI builds
    + S8223558: Java does not render Myanmar script correctly
    + S8223627: jdk-13+20 bundle name contains null instead of ea
    + S8223638: Replace wildcard address with loopback or local
    host in tests - part 6
    + S8223678: Add Visual Studio Code workspace generation support
    (for native code)
    + S8223727: com/sun/jndi/ldap/privconn/RunTest.java failed due
    to hang in LdapRequest.getReplyBer
    + S8223769: Assert triggers with -XX:+StressReflectiveCode
    + S8224187: Refactor arraycopy_prologue to allow ZGC read
    barriers on arraycopy
    + S8224475: JTextPane does not show images in HTML rendering
    + S8224673: Adjust permission for delayed starting of debugging
    + S8224705: Tests that need to be problem-listed or have
    printer resources
    + S8224778: test/jdk/demo/jfc/J2Ddemo/J2DdemoTest.java cannot
    find J2Ddemo.jar
    + S8224821: java/awt/Focus/NoAutotransferToDisabledCompTest/
    /NoAutotransferToDisabledCompTest.java fails linux-x64
    + S8224830: test/jdk/java/awt/Focus/
    /ModalExcludedWindowClickTest/
    /ModalExcludedWindowClickTest.java fails on linux-x64
    + S8224851: AArch64: fix warnings and errors with Clang and GCC
    8.3
    + S8224905: java/lang/ProcessBuilder/Basic.java#id1 failed with
    stream closed
    + S8225007: java/awt/print/PrinterJob/
    /LandscapeStackOverflow.java may hang
    + S8225105: java/awt/Focus/ShowFrameCheckForegroundTest/
    /ShowFrameCheckForegroundTest.java fails in Windows 10
    + S8225117: java/math/BigInteger/SymmetricRangeTests.java fails
    with ParseException
    + S8225128: Add exception for expiring DocuSign root to
    VerifyCACerts test
    + S8225130: Add exception for expiring Comodo roots to
    VerifyCACerts test
    + S8225144: [macos] In Aqua L&amp;F backspace key does not delete
    when Shift is pressed
    + S8225180: SignedObject with invalid Key not throwing the
    InvalidKeyException in Windows
    + S8225182: JNI exception pending in DestroyXIMCallback of
    awt_InputMethod.c:1327
    + S8225199: [Graal] compiler/jvmci/compilerToVM/
    /IsMatureVsReprofileTest.java fails with
  - XX:CompileThresholdScaling=0.1
    + S8225305: ProblemList java/lang/invoke/VarHandles tests
    + S8225350: compiler/jvmci/compilerToVM/IsCompilableTest.java
    timed out
    + S8225430: Replace wildcard address with loopback or local
    host in tests - part 14
    + S8225435: Upgrade IANA Language Subtag Registry to the latest
    for JDK14
    + S8225487: giflib legal file is missing attribution for
    openbsd-reallocarray.c
    + S8225567: Wrong file headers with 8202414 fix changeset
    + S8225684: [AOT] vmTestbase/vm/oom/production/
    /AlwaysOOMProduction tests fail with AOTed java.base
    + S8225766: Curve in certificate should not affect signature
    scheme when using TLSv1.3
    + S8225797: OldObjectSample event creates unexpected amount of
    checkpoint data
    + S8226381: ProblemList java/lang/reflect/PublicMethods/
    /PublicMethodsTest.java
    + S8226406: JVM fails to detect mismatched or corrupt CDS
    archive
    + S8226608: Hide the onjcmd option from the help output
    + S8226892: ActionListeners on JRadioButtons don't get notified
    when selection is changed with arrow keys
    + S8227112: exclude compiler/intrinsics/sha/sanity tests from
    AOT runs
    + S8227324: Upgrade to freetype 2.10.1
    + S8227528: TestAbortVMOnSafepointTimeout.java failed due to
    "RuntimeException: 'Safepoint sync time longer than' missing
    from stdout/stderr"
    + S8227645: Some tests in serviceability/sa run with fixed -Xmx
    values and risk running out of memory
    + S8227646: [TESTBUG] appcds/SharedArchiveConsistency timed out
    + S8227662: freetype seeks to index at the end of the font data
    + S8228479: Correct the format of ColorChooserDemoTest
    + S8228613: java.security.Provider#getServices order is no
    longer deterministic
    + S8228969: 2019-09-28 public suffix list update
    + S8229236: CriticalJNINatives: dll handling should be done in
    native thread state
    + S8229345: Memory leak due to vtable stubs not being shared on
    SPARC
    + S8229888: (zipfs) Updating an existing zip file does not
    preserve original permissions
    + S8229994: assert(false) failed: Bad graph detected in
    get_early_ctrl_for_expensive
    + S8230004: jdk/internal/jimage/JImageOpenTest.java runs no test
    + S8230235: Rendering HTML with empty img attribute and
    documentBaseKey cause Exception
    + S8230390: Problemlist SA tests with AOT
    + S8230400: Missing constant pool entry for a method in
    stacktrace
    + S8230459: Test failed to resume JVMCI CompilerThread
    + S8230480: check malloc/calloc results in java.desktop
    + S8230597: Update GIFlib library to the 5.2.1
    + S8230611: infinite loop in
    LogOutputList::wait_until_no_readers()
    + S8230624: [TESTBUG] Problemlist JFR
    compiler/TestCodeSweeper.java
    + S8230677: Should disable Escape Analysis if JVMTI capability
    can_get_owned_monitor_info was taken
    + S8230926: [macosx] Two apostrophes are entered instead of one
    with "U.S. International - PC" layout
    + S8231025: Incorrect method tag offset for big endian platform
    + S8231081: TestMetadataRetention fails due to missing symbol id
    + S8231387: java.security.Provider.getService returns random
    result due to race condition with mutating methods in the same
    class
    + S8231430: C2: Memory stomp in max_array_length() for
    T_ILLEGAL type
    + S8231445: check ZALLOC return values in awt coding
    + S8231507: Update Apache Santuario (XML Signature) to version
    2.1.4
    + S8231584: Deadlock with ClassLoader.findLibrary and
    System.loadLibrary call
    + S8231753: use more Posix functionality in aix
    os::print_os_info
    + S8231810: javax/net/ssl/templates/
    /SSLSocketSSLEngineTemplate.java fails intermittently with
    "java.lang.Exception: Unexpected EOF"
    + S8232003: (fs) Files.write can leak file descriptor in the
    exception case
    + S8232056: GetOwnedMonitorInfoWithEATest.java fails with ZGC:
    Heap too small
    + S8232060: add some initializations using sigemptyset in
    os_aix.cpp
    + S8232154: Update Mesa 3-D Headers to version 19.2.1
    + S8232167: Visual Studio install found through
  - -with-tools-dir value is discarded
    + S8232170: FSInfo#getJarClassPath throws an exception not
    declared in its throws clause
    + S8232200: [macos 10.15] Windows in fullscreen tests jumps
    around the screen
    + S8232207: Linux os::available_memory re-reads cgroup
    configuration on every invocation
    + S8232224: [TESTBUG] problemlist JFR TestLargeRootSet.java
    + S8232370: Refactor some com.sun.jdi tests to enable IDE
    integration
    + S8232433: [macos 10.15] java/awt/Window/
    /LocationAtScreenCorner/LocationAtScreenCorner.java may fail
    + S8232571: Add missing SIGINFO signal
    + S8232692: [TESTBUG] compiler/aot/fingerprint/
    /SelfChangedCDS.java fails when cds is disabled
    + S8232713: Update BCEL version to 6.3.1 in license file
    + S8232806: Introduce a system property to disable eager lambda
    initialization
    + S8232834: RunTest sometimes fails to produce valid
    exitcode.txt
    + S8232880: Update test documentation with additional settings
    for client UI tooltip tests
    + S8232950: SUNPKCS11 Provider incorrectly check key length for
    PSS Signatures.
    + S8233018: Add a new test to verify that DatagramSocket is not
    interruptible
    + S8233019: java.lang.Class.isPrimitive() (C1) returns wrong
    result if Klass* is aligned to 32bit
    + S8233032: assert(in_bb(n)) failed: must be
    + S8233078: fix minimal VM build on Linux ppc64(le)
    + S8233328: fix minimal VM build on Linux s390x
    + S8233383: Various minor fixes
    + S8233466: aarch64: remove unnecessary load of mdo when
    profiling return and parameters type
    + S8233491: Crash in AdapterHandlerLibrary::get_adapter with
    CDS due to code cache exhaustion
    + S8233529: loopTransform.cpp:2984: Error: assert(p_f-&gt;Opcode()
    == Op_IfFalse) failed
    + S8233548: Update CUP to v0.11b
    + S8233649: Update ProblemList.txt to exclude failing headful
    tests on macos
    + S8233656: assert(d-&gt;is_CFG() &amp;&amp; n-&gt;is_CFG()) failed: must
    have CFG nodes
    + S8233657: Intermittent NPE in Component.validate()
    + S8234288: Turkey Time Zone returns incorrect time zone name
    + S8234323: NULL-check return value of SurfaceData_InitOps on
    macosx
    + S8234339: replace JLI_StrTok in java_md_solinux.c
    + S8234340: Bump update version for OpenJDK: jdk-11.0.7
    + S8234350: assert(mode == ControlAroundStripMined &amp;&amp; (use ==
    sfpt || !use-&gt;is_reachable_from_root())) failed: missed a node
    + S8234386: [macos] NPE was thrown at expanding Choice from
    maximized frame
    + S8234397: add OS uptime information to os::print_os_info
    output
    + S8234423: Modifying ArrayList.subList().subList() resets
    modCount of subList
    + S8234466: Class loading deadlock involving
    X509Factory#commitEvent()
    + S8234501: remove obsolete NET_ReadV
    + S8234525: enable link-time section-gc for linux s390x to
    remove unused code
    + S8234610: MaxVectorSize set wrongly when UseAVX=3 is
    specified after JDK-8221092
    + S8234617: C1: Incorrect result of field load due to missing
    narrowing conversion
    + S8234723: javax/net/ssl/TLS tests support TLSv1.3
    + S8234724: javax/net/ssl/templates/
    /SSLSocketSSLEngineTemplate.java supports TLSv1.3
    + S8234741: enhance os::get_core_path on macOS
    + S8234769: Duplicate attribution in freetype.md
    + S8234786: Fix for JDK-8214578 breaks OS X 10.12 compatibility
    + S8234809: set relro in linker flags when building with gcc
    + S8234824: java/nio/channels/SocketChannel/AdaptSocket.java
    fails on Windows 10
    + S8235243: handle VS2017 15.9 and VS2019 in abstract_vm_version
    + S8235288: AVX 512 instructions inadvertently used on Xeon for
    small vector width operations
    + S8235325: build failure on Linux after 8235243
    + S8235383: C1 compilation fails with
  - XX:+PrintIRDuringConstruction -XX:+Verbose
    + S8235489: handle return values of sscanf calls in hotspot
    + S8235509: Backport for JDK-8209657 Refactor filemap.hpp to
    simplify integration with Serviceability Agent.
    + S8235510: java.util.zip.CRC32 performance drop after 8200067
    + S8235563: [TESTBUG] appcds/CommandLineFlagComboNegative.java
    does not handle archive mapping failure
    + S8235637: jhsdb jmap from OpenJDK 11.0.5 doesn't work if
    prelink is enabled
    + S8235671: enhance print_rlimit_info in os_posix
    + S8235744: PIT: test/jdk/javax/swing/text/html/
    /TestJLabelWithHTMLText.java times out in linux-x64
    + S8235904: Infinite loop when rendering huge lines
    + S8235998: [c2] Memory leaks during tracing after '8224193:
    stringStream should not use Resource Area'.
    + S8236039: JSSE Client does not accept status_request
    extension in CertificateRequest messages for TLS 1.3
    + S8236140: assert(!VerifyHashTableKeys || _hash_lock == 0)
    failed: remove node from hash table before modifying it
    + S8236179: C1 register allocation error with T_ADDRESS
    + S8236488: Support for configure option
  - -with-native-debug-symbols=internal is impossible on Windows
    + S8236500: Windows ucrt.dll should be looked up in versioned
    WINSDK subdirectory
    + S8236709: struct SwitchRange in HS violates C++ One
    Definition Rule
    + S8236848: [JDK 11u] make run-test-tier1 fails after backport
    of JDK-8232834
    + S8236873: Worker has a deadlock bug
    + S8237217: Incorrect G1StringDedupEntry type used in
    StringDedupTable destructor
    + S8237368: Problem with NullPointerException in RMI
    TCPEndpoint.read
    + S8237375: SimpleThresholdPolicy misses CounterDecay timestamp
    initialization
    + S8237508: Simplify JarFile.isInitializing
    + S8237540: Missing files in backport of JDK-8210910
    + S8237541: Missing files in backport of JDK-8236528
    + S8237600: Test SunJSSEFIPSInit fails on Ubuntu
    + S8237819: s390x - remove unused pd_zero_to_words_large
    + S8237869: exclude jtreg test security/infra/java/security/
    /cert/CertPathValidator/certification/LuxTrustCA.java because
    of instabilities
    + S8237879: make 4.3 breaks build
    + S8237945: CTW: C2 compilation fails with
    assert(just_allocated_object(alloc_ctl) == ptr) failed: most
    recent allo...
    + S8238225: Issues reported after replacing symlink at
    Contents/MacOS/libjli.dylib with binary
    + S8238247: CTW runner should sweep nmethods more aggressively
    + S8238366: CTW runner closes standard output on exit
    + S8238438: SuperWord::co_locate_pack picks memory state of
    first instead of last load
    + S8238502: sunmscapi.dll causing EXCEPTION_ACCESS_VIOLATION
    + S8238534: Deep sign macOS bundles before bundle archive is
    being created
    + S8238591: CTW: Split
    applications/ctw/modules/jdk_localedata.java
    + S8238596: AVX enabled by default for Skylake even when
    unsupported
    + S8238811: C2: assert(i &gt;= req() || i == 0 || is_Region() ||
    is_Phi()) with -XX:+VerifyGraphEdges
    + S8239005: [TESTBUG] test/hotspot/jtreg/runtime/
    /StackGuardPages/TestStackGuardPages.java: exeinvoke.c: must
    initialize static state before calling do_overflow()
    + S8239466: Loss of precision in counter decay calculation in
    11u backport of JDK-8237375
    + S8239856: [ntintel] asserts about copying unaligned array
    element
    + S8240724: [test] jdk11 downport of 8224475 misses binary file
    test/jdk/javax/swing/JTextPane/arrow.png
    + S8241296: Segfault in JNIHandleBlock::oops_do()
- Removed patch:
  * DependOnVariableHelper.patch
    + fixed upstream
- Added patch:
  * JDK-8228407.patch
    + fix crashes due to shared archive file mismatch</changelog>
  <changelog author="fstrba@suse.com" date="1594900800">- Update to upstream tag jdk-11.0.8+10 (July 2020 CPU, bsc#1174157)
  * Security fixes:
    + JDK-8230613: Better ASCII conversions
    + JDK-8231800: Better listing of arrays
    + JDK-8232014: Expand DTD support
    + JDK-8233234: Better Zip Naming
    + JDK-8233239, CVE-2020-14562: Enhance TIFF support
    + JDK-8233255: Better Swing Buttons
    + JDK-8234032: Improve basic calendar services
    + JDK-8234042: Better factory production of certificates
    + JDK-8234418: Better parsing with CertificateFactory
    + JDK-8234836: Improve serialization handling
    + JDK-8236191: Enhance OID processing
    + JDK-8236867, CVE-2020-14573: Enhance Graal interface handling
    + JDK-8237117, CVE-2020-14556: Better ForkJoinPool behavior
    + JDK-8237592, CVE-2020-14577: Enhance certificate verification
    + JDK-8238002, CVE-2020-14581: Better matrix operations
    + JDK-8238013: Enhance String writing
    + JDK-8238804: Enhance key handling process
    + JDK-8238842: AIOOBE in GIFImageReader.initializeStringTable
    + JDK-8238843: Enhanced font handing
    + JDK-8238920, CVE-2020-14583: Better Buffer support
    + JDK-8238925: Enhance WAV file playback
    + JDK-8240119, CVE-2020-14593: Less Affine Transformations
    + JDK-8240482: Improved WAV file playback
    + JDK-8241379: Update JCEKS support
    + JDK-8241522: Manifest improved jar headers redux
    + JDK-8242136, CVE-2020-14621: Better XML namespace handling
  * Other changes:
    + JDK-6933331: (d3d/ogl) java.lang.IllegalStateException:
    Buffers have not been created
    + JDK-7124307: JSpinner and changing value by mouse
    + JDK-8022574: remove HaltNode code after uncommon trap calls
    + JDK-8039082: [TEST_BUG] Test
    java/awt/dnd/BadSerializationTest/BadSerializationTest.java
    fails
    + JDK-8040630: Popup menus and tooltips flicker with previous
    popup contents when first shown
    + JDK-8044365: (dc) MulticastSendReceiveTests.java failing with
    ENOMEM when joining group (OS X 10.9)
    + JDK-8048215: [TESTBUG]
    java/lang/management/ManagementFactory/ThreadMXBeanProxy.java
    Expected non-null LockInfo
    + JDK-8051349: nsk/jvmti/scenarios/sampling/SP06/sp06t003 fails
    in nightly
    + JDK-8080353: JShell: Better error message on attempting to
    add default method
    + JDK-8139876: Exclude hanging nsk/stress/stack from execution
    with deoptimization enabled
    + JDK-8146090: java/lang/ref/ReachabilityFenceTest.java fails
    with -XX:+DeoptimizeALot
    + JDK-8153430: jdk regression test MletParserLocaleTest,
    ParserInfiniteLoopTest reduce default timeout
    + JDK-8156207: Resource allocated BitMaps are often cleared
    unnecessarily
    + JDK-8159740: JShell: corralled declarations do not have
    correct source to wrapper mapping
    + JDK-8175984: ICC_Profile has un-needed, not-empty finalize
    method
    + JDK-8176359: Frame#setMaximizedbounds not working properly in
    multi screen environments
    + JDK-8183369: RFC unconformity of HttpURLConnection with proxy
    + JDK-8187078: -XX:+VerifyOops finds numerous problems when
    running JPRT
    + JDK-8189861: Refactor CacheFind
    + JDK-8191169: java/net/Authenticator/B4769350.java failed
    intermittently
    + JDK-8191930: [Graal] emits unparseable XML into compile log
    + JDK-8193879: Java debugger hangs on method invocation
    + JDK-8196019: java/awt/Window/Grab/GrabTest.java fails on
    Windows
    + JDK-8196181: sun/java2d/GdiRendering/InsetClipping.java fails
    + JDK-8198000:
    java/awt/List/EmptyListEventTest/EmptyListEventTest.java
    debug assert on Windows
    + JDK-8198001: java/awt/Menu/WrongParentAfterRemoveMenu/
    /WrongParentAfterRemoveMenu.java debug assert on Windows
    + JDK-8198339: Test javax/swing/border/Test6981576.java is
    unstable
    + JDK-8200701: jdk/jshell/ExceptionsTest.java fails on Windows,
    after JDK-8198801
    + JDK-8203264: JNI exception pending in
    PlainDatagramSocketImpl.c:740
    + JDK-8203672: JNI exception pending in PlainSocketImpl.c
    + JDK-8203673: JNI exception pending in
    DualStackPlainDatagramSocketImpl.c:398
    + JDK-8204834: Fix confusing "allocate" naming in OopStorage
    + JDK-8205399: Set node color on pinned HashMap.TreeNode
    deletion
    + JDK-8205653: test/jdk/sun/management/jmxremote/bootstrap/
    /RmiRegistrySslTest.java and RmiSslBootstrapTest.sh fail with
    handshake_failure
    + JDK-8206179: com/sun/management/OperatingSystemMXBean/
    /GetCommittedVirtualMemorySize.java fails with Committed
    virtual memory size illegal value
    + JDK-8207334: VM times out in VM_HandshakeAllThreads::doit()
    with RunThese30M
    + JDK-8208277: Code cache heap (-XX:ReservedCodeCacheSize)
    doesn't work with 1GB LargePages
    + JDK-8209113: Use WeakReference for lastFontStrike for created
    Fonts
    + JDK-8209333: Socket reset issue for TLS 1.3 socket close
    + JDK-8209439: C2 library_call can potentially ignore Math.pow
    intrinsic or use null pointer
    + JDK-8209534: [TESTBUG]runtime/appcds/cacheObject/
    /ArchivedModuleCompareTest.java fails with EnableJVMCI.
    + JDK-8210147: adjust some WSAGetLastError usages in windows
    network coding
    + JDK-8210284: "assert((av &amp; 0x00000001) == 0) failed:
    unsupported V8" on Solaris 11.4
    + JDK-8210303: VM_HandshakeAllThreads fails assert with
    "failed: blocked and not walkable"
    + JDK-8210459: Add support for generating compile_commands.json
    + JDK-8210515: [TESTBUG]CheckArchivedModuleApp.java needs to
    check if EnableJVMCI is set.
    + JDK-8210788: Javadoc for Thread.join(long, int) should
    specify that it waits forever when both arguments are zero
    + JDK-8211301: [macos] support full window content options
    + JDK-8211332: Space for stub routines (code_size2) is too
    small on new Skylake CPUs
    + JDK-8211339: NPE during SSL handshake caused by
    HostnameChecker
    + JDK-8211392: compiler/profiling/
    /spectrapredefineclass_classloaders/Launcher.java times out
    in JDK12 CI
    + JDK-8211743: [AOT] crash in ScopeDesc::decode_body() when
    JVMTI walks AOT frames
    + JDK-8212154: [TESTBUG] CheckArchivedModuleApp fails with NPE
    when JVMCI is absent
    + JDK-8212167: JShell : Stack trace of exception has wrong line
    number
    + JDK-8212933: Thread-SMR: requesting a VM operation whilst
    holding a ThreadsListHandle can cause deadlocks
    + JDK-8212986: Make Visual Studio compiler check less strict
    + JDK-8213250: CDS archive creation aborts due to metaspace
    object allocation failure
    + JDK-8213516: jck test api/javax_accessibility/AccessibleState/
    /fields.html fails intermittent
    + JDK-8213947: ARM32: failed check_simd should set
    UsePopCountInstruction to false
    + JDK-8214418: half-closed SSLEngine status may cause
    application dead loop
    + JDK-8214440: ldap over a TLS connection negotiate failed with
    "javax.net.ssl.SSLPeerUnverifiedException: hostname of the
    server does not match the hostname in the server's
    certificate"
    + JDK-8214444: Wrong strncat limits in dfa.cpp
    + JDK-8214481: freetype path does not disable TrueType hinting
    with AA+FM hints
    + JDK-8214571: -Xdoclint of array serialField gives "error:
    array type not allowed here"
    + JDK-8214856: Errors with JSZip in web console after upgrade
    to 3.1.5
    + JDK-8214862: assert(proj != __null) at compile.cpp:3251
    + JDK-8215369: Jcstress pollute /var/tmp with temporary files.
    + JDK-8215551: Missing case label in nmethod::reloc_string_for()
    + JDK-8215555: TieredCompilation C2 threads can excessively
    block handshakes
    + JDK-8215711: Missing key_share extension for (EC)DHE key
    exchange should alert missing_extension
    + JDK-8216151: [Graal] Module
    jdk.internal.vm.compiler.management has not been granted
    accessClassInPackage.org.graalvm.compiler.debug
    + JDK-8216154: C4819 warnings at HotSpot sources on Windows
    + JDK-8216541: CompiledICHolders of VM locked unloaded nmethods
    are released too late
    + JDK-8217230: assert(t == t_no_spec) failure in
    NodeHash::check_no_speculative_types()
    + JDK-8217404: --with-jvm-features doesn't work when multiple
    features are explicitly disabled
    + JDK-8217447: Develop flag TraceICs is broken
    + JDK-8217606: LdapContext#reconnect always opens a new
    connection
    + JDK-8218807: Compilation database (compile_commands.json) may
    contain obsolete items
    + JDK-8219214: Infinite Loop in CodeSection::dump()
    + JDK-8219904: ClassCastException when calling
    FlightRecorderMXBean#getRecordings()
    + JDK-8219991: New fix of the deadlock in
    sun.security.ssl.SSLSocketImpl
    + JDK-8221121: applications/microbenchmarks are encountering
    crashes in tier5
    + JDK-8221445: FastSysexMessage constructor crashes MIDI
    receiption thread
    + JDK-8221482: Initialize VMRegImpl::regName[] earlier to
    prevent assert during PrintStubCode
    + JDK-8221741: ClassCastException can happen when
    fontconfig.properties is used
    + JDK-8221823: Requested JDialog width is ignored
    + JDK-8223108: Test java/awt/EventQueue/
    /NonComponentSourcePost.java is unstable
    + JDK-8223678: Add Visual Studio Code workspace generation
    support (for native code)
    + JDK-8223935: PIT: java/awt/font/WindowsIndicFonts.java fails
    on windows10
    + JDK-8224109: Text spaced incorrectly by drawString under
    rotation with fractional metric
    + JDK-8224632: testbug: java/awt/dnd/RemoveDropTargetCrashTest/
    /RemoveDropTargetCrashTest.java fails on MacOS
    + JDK-8224793: os::die() does not honor CreateCoredumpOnCrash
    option
    + JDK-8224847: gc/stress/TestReclaimStringsLeaksMemory.java
    fails with reserved greater than expected
    + JDK-8224931: disable JAOTC invokedynamic support until
    8223533 is fixed
    + JDK-8224997: ChaCha20-Poly1305 TLS cipher suite decryption
    throws ShortBufferException
    + JDK-8225068: Remove DocuSign root certificate that is
    expiring in May 2020
    + JDK-8225069: Remove Comodo root certificate that is expiring
    in May 2020
    + JDK-8225126: Test SetBoundsPaintTest.html faild on Windows
    when desktop is scaled
    + JDK-8225325: Add tests for redefining a class' private method
    during resolution of the bootstrap specifier
    + JDK-8225622: [AOT] runtime/SharedArchiveFile/
    /TestInterpreterMethodEntries.java crashed with AOTed
    java.base
    + JDK-8225653: Provide more information when hitting SIGILL
    from HaltNode
    + JDK-8225783: Incorrect use of binary operators on booleans in
    type.cpp
    + JDK-8225789: Empty method parameter type should generate
    ClassFormatError
    + JDK-8226198: use of &amp; instead of &amp;&amp; in
    LibraryCallKit::arraycopy_restore_alloc_state
    + JDK-8226253: JAWS reports wrong number of radio buttons when
    buttons are hidden.
    + JDK-8226653: [accessibility] Can edit text cell correctly,
    but Accessibility Tool reads nothing about editor
    + JDK-8226806: [macOS 10.14] Methods of Java Robot should be
    called from appropriate thread
    + JDK-8226879: Memory leak in Type::hashcons
    + JDK-8227632: Incorrect PrintCompilation message: made not
    compilable on levels 0 1 2 3 4
    + JDK-8228407: JVM crashes with shared archive file mismatch
    + JDK-8228482: fix xlc16/xlclang comparison of distinct pointer
    types and string literal conversion warnings
    + JDK-8228757: Fail fast if the handshake type is unknown
    + JDK-8229158: make UseSwitchProfiling non-experimental or
    false by-default
    + JDK-8229421: The logic of java/net/ipv6tests/TcpTest.java is
    flawed
    + JDK-8229855: C2 fails with assert(false) failed: bad AD file
    + JDK-8230591: AArch64: Missing intrinsics for Math.ceil,
    floor, rint
    + JDK-8231118: ARM32: Math tests failures
    + JDK-8231213: Migrate SimpleDateFormatConstTest to JDK Repo
    + JDK-8231243: [TESTBUG] CustomFont.java cannot find font file
    + JDK-8231438: [macOS] Dark mode for the desktop is not
    supported
    + JDK-8231550: C2: ShouldNotReachHere() in
    verify_strip_mined_scheduling
    + JDK-8231564: setMaximizedBounds is broken with large display
    scale and multiple monitors
    + JDK-8231572: Use -lobjc instead of -fobjc-link-runtime in
    libosxsecurity
    + JDK-8231631: sun/net/ftp/FtpURLConnectionLeak.java fails
    intermittently with NPE
    + JDK-8231671: Fix copyright headers in hotspot (missing comma
    after year)
    + JDK-8231720: Some perf regressions after 8225653
    + JDK-8231779: crash
    HeapWord*ParallelScavengeHeap::failed_mem_allocate
    + JDK-8231863: Crash if classpath is read from @argument file
    and the main gets option argument
    + JDK-8232080: jlink plugins for vendor information and
    run-time options
    + JDK-8232106: [x86] C2: SIGILL due to usage of SSSE3
    instructions on processors which don't support it
    + JDK-8232134: Change to Visual Studio 2017 15.9.16 for
    building on Windows at Oracle
    + JDK-8232226: [macos 10.15] test/jdk/java/awt/color/
    /EqualityTest/EqualityTest.java may fail
    + JDK-8232357: Compare version info of Santuario to legal notice
    + JDK-8232572: Add hooks for custom output dir in Bundles.gmk
    + JDK-8232634: Problem List ICMColorDataTest.java
    + JDK-8232748: Build static versions of certain JDK libraries
    + JDK-8232846: ProcessHandle.Info command with non-English
    shows question marks
    + JDK-8232880: Update test documentation with additional
    settings for client UI tooltip tests
    + JDK-8233033: C2 produces wrong result while unswitching a
    loop due to lost control dependencies
    + JDK-8233137: runtime/ErrorHandling/VeryEarlyAssertTest.java
    fails after 8232080
    + JDK-8233197: Invert JvmtiExport::post_vm_initialized() and
    Jfr:on_vm_start() start-up order for correct option parsing
    + JDK-8233291: [TESTBUG] tools/jlink/plugins/
    /VendorInfoPluginsTest.java fails with debug or non-server VMs
    + JDK-8233364: Fix undefined behavior in
    Canonicalizer::do_ShiftOp
    + JDK-8233494: Avoid calling MallocTracker::record_malloc and
    record_free when NMT is off
    + JDK-8233573: Toolkit.getScreenInsets(GraphicsConfiguration)
    may throw ClassCastException
    + JDK-8233608: Minimal build broken after JDK-8233494
    + JDK-8233621: Mismatch in jsse.enableMFLNExtension property
    name
    + JDK-8233696: [TESTBUG]Some jtreg tests fail when CAPS_LOCK is
    ON
    + JDK-8233707: systemScale.cpp could not compile with VS2019
    + JDK-8233801: GCMEmptyIv.java test fails on Solaris 11.4
    + JDK-8233880: Support compilers with multi-digit major version
    numbers
    + JDK-8233920: MethodHandles::tryFinally generates illegal
    bytecode for long/double return type
    + JDK-8234137: The "AutoTestOnTop.java" test may run external
    applications
    + JDK-8234146: compiler/jsr292/
    /ContinuousCallSiteTargetChange.java times out on SPARC
    + JDK-8234184: [TESTBUG] java/awt/Mouse/EnterExitEvents/
    /ModalDialogEnterExitEventsTest.java fails in Windows
    + JDK-8234270: [REDO] JDK-8204128 NMT might report incorrect
    numbers for Compiler area
    + JDK-8234332: [TESTBUG] java/awt/Focus/DisposedWindow/
    /DisposeDialogNotActivateOwnerTest/
    /DisposeDialogNotActivateOwnerTest.java fails on linux-x64
    nightly
    + JDK-8234398: Replace ID2D1Factory::GetDesktopDpi with
    GetDeviceCaps
    + JDK-8234522: [macos] Crash with use of native file dialog
    + JDK-8234691: Potential double-free in ParallelSPCleanupTask
    constructor
    + JDK-8234696: tools/jlink/plugins/VendorInfoPluginsTest.java
    times out
    + JDK-8234727: sun/security/ssl/X509TrustManagerImpl tests
    support TLSv1.3
    + JDK-8234728: Some security tests should support TLSv1.3
    + JDK-8234779: Provide idiom for declaring classes noncopyable
    + JDK-8234824: java/nio/channels/SocketChannel/AdaptSocket.java
    fails on Windows 10
    + JDK-8234968: check calloc rv in libinstrument
    InvocationAdapter
    + JDK-8235153: [TESTBUG] [macos 10.15] java/awt/Graphics/
    /DrawImageBG/SystemBgColorTest.java fails
    + JDK-8235183: Remove the "HACK CODE" in comment
    + JDK-8235263: Revert TLS 1.3 change that wrapped IOExceptions
    + JDK-8235311: Tag mismatch may alert bad_record_mac
    + JDK-8235332: TestInstanceCloneAsLoadsStores.java fails with
  - XX:+StressGCM
    + JDK-8235452: Strip mined loop verification fails with
    assert(is_OuterStripMinedLoop()) failed: invalid node class
    + JDK-8235584: UseProfiledLoopPredicate fails with
    assert(_phase-&gt;get_loop(c) == loop) failed: have to be in the
    same loop
    + JDK-8235620: Broken merge between JDK-8006406 and JDK-8003559
    + JDK-8235638: NPE in LWWindowPeer.getOnscreenGraphics()
    + JDK-8235686: Add more custom hooks in Bundles.gmk
    + JDK-8235739: Rare NPE at WComponentPeer.getGraphics()
    + JDK-8235762: JVM crash in SWPointer during C2 compilation
    + JDK-8235834: IBM-943 charset encoder needs updating
    + JDK-8235874: The ordering of Cipher Suites is not maintained
    provided through jdk.tls.client.cipherSuites and
    jdk.tls.server.cipherSuites system property.
    + JDK-8235908: omit ThreadPriorityPolicy warning when value is
    set from image
    + JDK-8235984: C2: assert(out-&gt;in(PhiNode::Region) == head ||
    out-&gt;in(PhiNode::Region) == slow_head) failed: phi must be
    either part of the slow or the fast loop
    + JDK-8236211: [Graal] compiler/graalunit/GraphTest.java is
    skipped in all testing
    + JDK-8236470: Deal with ECDSA using ecdsa-with-SHA2 plus hash
    algorithm as AlgorithmId
    + JDK-8236545: Compilation error in mach5
    java/awt/FileDialog/MacOSGoToFolderCrash.java
    + JDK-8236700: Upgrading JSZip from v3.1.5 to v3.2.2
    + JDK-8236759: ShouldNotReachHere in
    PhaseIdealLoop::verify_strip_mined_scheduling
    + JDK-8236897: Fix the copyright header for pkcs11gcm2.h
    + JDK-8236921: Add build target to produce a JDK image suitable
    for a Graal/SVM build
    + JDK-8236953: [macos] JavaFX SwingNode is not rendered on macOS
    + JDK-8236996: Incorrect Roboto font rendering on Windows with
    subpixel antialiasing
    + JDK-8237045: JVM uses excessive memory with -XX:+EnableJVMCI
  - XX:JVMCICounterSize=2147483648
    + JDK-8237055: [TESTBUG] compiler/c2/TestJumpTable.java fails
    with release VMs
    + JDK-8237086: assert(is_MachReturn()) running CTW with fix for
    JDK-8231291
    + JDK-8237192: Generate stripped/public pdbs on Windows for jdk
    images
    + JDK-8237396: JvmtiTagMap::weak_oops_do() should not trigger
    barriers
    + JDK-8237474: Default SSLEngine should create in server role
    + JDK-8237859: C2: Crash when loads float above range check
    + JDK-8237879: make 4.3 breaks build
    + JDK-8237951: CTW: C2 compilation fails with "malformed
    control flow"
    + JDK-8237962: give better error output for invalid OCSP
    response intervals in CertPathValidator checks
    + JDK-8238190: [JVMCI] Fix single implementor speculation for
    diamond shapes.
    + JDK-8238356: CodeHeap::blob_count() overestimates the number
    of blobs
    + JDK-8238452: Keytool generates wrong expiration date if
    validity is set to 2050/01/01
    + JDK-8238555: Allow Initialization of SunPKCS11 with NSS when
    there are external FIPS modules in the NSSDB
    + JDK-8238575: DragSourceEvent.getLocation() returns wrong
    value on HiDPI screens (Windows)
    + JDK-8238676: jni crashes on accessing it from process exit
    hook
    + JDK-8238721: Add failing client jtreg tests to the Problem
    List
    + JDK-8238738: AudioSystem.getMixerInfo() takes about 30 sec to
    report a gone audio device
    + JDK-8238756: C2: assert(((n) == __null || !VerifyIterativeGVN
    || !((n)-&gt;is_dead()))) failed: can not use dead node
    + JDK-8238765: PhaseCFG::schedule_pinned_nodes cannot handle
    precedence edges from unmatched CFG nodes correctly
    + JDK-8238898: Missing hash characters for header on license
    file
    + JDK-8238942: Rendering artifacts with LCD text and fractional
    metrics
    + JDK-8238985: [TESTBUG] The arrow image is blue instead of
    green
    + JDK-8239000: handle ContendedPaddingWidth in vm_version_ppc
    + JDK-8239055: Wrong implementation of VMState.hasListener
    + JDK-8239091: Reversed arguments in call to strstr in freetype
    "debug" code.
    + JDK-8239142: C2's UseUniqueSubclasses optimization is broken
    for array accesses
    + JDK-8239224: libproc_impl.c previous_thr may be used
    uninitialized warning
    + JDK-8239351: Give more meaningful InternalError messages in
    Deflater.c
    + JDK-8239365: ProcessBuilder test modifications for AIX
    execution
    + JDK-8239456: vtable stub generation: assert failure (code
    size estimate)
    + JDK-8239457: call ReleaseStringUTFChars before early returns
    in Java_sun_security_pkcs11_wrapper_PKCS11_connect
    + JDK-8239462: jdk.hotspot.agent misses some
    ReleaseStringUTFChars calls in case of early returns
    + JDK-8239557: [TESTBUG] VeryEarlyAssertTest.java validating
    "END." marker at lastline is not always true
    + JDK-8239787: AArch64: String.indexOf may incorrectly handle
    empty strings
    + JDK-8239792: Bump update version for OpenJDK: jdk-11.0.8
    + JDK-8239798: SSLSocket closes socket both socket endpoints on
    a SocketTimeoutException
    + JDK-8239819: XToolkit: Misread of screen information memory
    + JDK-8239852: java/util/concurrent tests fail with
  - XX:+VerifyGraphEdges: assert(!VerifyGraphEdges) failed:
    verification should have failed
    + JDK-8239893: Windows handle Leak when starting processes
    using ProcessBuilder
    + JDK-8239915: Zero VM crashes when handling dynamic constant
    + JDK-8239931: [win][x86] vtable stub generation: assert
    failure (code size estimate) follow-up
    + JDK-8239965: XMLEncoder/Test4625418.java fails due to "Error:
    Cp943 - can't read properly"
    + JDK-8239976: Put JDK-8239965 on the ProblemList.txt
    + JDK-8240073: Fix 'test-make' build target in 11u
    + JDK-8240197: Cannot start JVM when $JAVA_HOME includes CJK
    characters
    + JDK-8240202: A few client tests leave mouse buttons pressed
    + JDK-8240220: IdealLoopTree::dump_head predicate printing is
    broken
    + JDK-8240223: Use consistent predicate order in and with
    PhaseIdealLoop::find_predicate
    + JDK-8240227: Loop predicates should be copied to unswitched
    loops
    + JDK-8240286: [TESTBUG] Test command error in hotspot/jtreg/
    /compiler/loopopts/superword/SumRedAbsNeg_Float.java
    + JDK-8240518: Incorrect JNU_ReleaseStringPlatformChars in
    Windows Print
    + JDK-8240529: CheckUnhandledOops breaks NULL check in
    Modules::define_module
    + JDK-8240576: JVM crashes after transformation in C2
    IdealLoopTree::merge_many_backedges
    + JDK-8240603: Windows 32bit compile error after 8238676
    + JDK-8240629: argfiles parsing broken for argfiles with
    comment cross 4096 bytes chunk
    + JDK-8240711: TestJstatdPort.java failed due to
    "ExportException: Port already in use:"
    + JDK-8240786: [TESTBUG] The test java/awt/Window/
    /GetScreenLocation/GetScreenLocationTest.java fails on HiDPI
    screen
    + JDK-8240824: enhance print_full_memory_info on Linux by THP
    related information
    + JDK-8240827: Downport SSLSocketImpl.java from "8221882: Use
    fiber-friendly java.util.concurrent.locks in JSSE"
    + JDK-8240905: assert(mem == (Node*)1 || mem == mem2) failed:
    multiple Memories being matched at once?
    + JDK-8240972: macOS codesign fail on macOS 10.13.5 or older
    + JDK-8241445: Fix copyright in
    test/jdk/tools/launcher/ArgFileSyntax.java
    + JDK-8241458: [JVMCI] add mark value to expose
    CodeOffsets::Frame_Complete
    + JDK-8241464: [11u] Backport: make rehashing be a needed
    guaranteed safepoint cleanup action
    + JDK-8241556: Memory leak if -XX:CompileCommand is set
    + JDK-8241568: (fs) UserPrincipalLookupService.lookupXXX
    failure with IOE "Operation not permitted"
    + JDK-8241586: compiler/cpuflags/
    /TestAESIntrinsicsOnUnsupportedConfig.java fails on aarch64
    + JDK-8241638: launcher time metrics always report 1 on Linux
    when _JAVA_LAUNCHER_DEBUG set
    + JDK-8241660: Add virtualization information output to hs_err
    file on macOS
    + JDK-8241808: [TESTBUG] The JDK-8039467 bug appeared on macOS
    + JDK-8241888: Mirror jdk.security.allowNonCaAnchor system
    property with a security one
    + JDK-8241900: Loop unswitching may cause dependence on null
    check to be lost
    + JDK-8241948: enhance list of environment variables printed in
    hs_err file
    + JDK-8241996: on linux set full relro in the linker flags
    + JDK-8242108: Performance regression after fix for JDK-8229496
    + JDK-8242141: New System Properties to configure the TLS
    signature schemes
    + JDK-8242154: Backport parts of JDK-4947890 to OpenJDK 11u
    + JDK-8242174: [macos] The NestedModelessDialogTest test make
    the macOS unstable
    + JDK-8242239: [Graal] javax/management/generified/
    /GenericTest.java fails: FAILED: queryMBeans sets same
    + JDK-8242294: JSSE Client does not throw SSLException when an
    alert occurs during handshaking
    + JDK-8242379: [TESTBUG] compiler/loopopts/
    /TestLoopUnswitchingLostCastDependency.java fails with
    release VMs
    + JDK-8242470: Update Xerces to Version 2.12.1
    + JDK-8242498: Invalid "sun.awt.TimedWindowEvent" object leads
    to JVM crash
    + JDK-8242541: Small charset issues (ISO8859-16, x-eucJP-Open,
    x-IBM834 and x-IBM949C)
    + JDK-8242626: enhance posix print_rlimit_info
    + JDK-8243059: Build fails when --with-vendor-name contains a
    comma
    + JDK-8243539: Copyright info (Year) should be updated for fix
    of 8241638
    + JDK-8243541: (tz) Upgrade time-zone data to tzdata2020a
    + JDK-8244407: JVM crashes after transformation in C2
    IdealLoopTree::split_fall_in
    + JDK-8244520: problemlist
    java/awt/font/Rotate/RotatedFontTest.java on linux
    + JDK-8244777: ClassLoaderStats VM Op uses constant hash value
    + JDK-8244853: The static build of libextnet is missing the
    JNI_OnLoad_extnet function
    + JDK-8244951: Missing entitlements for hardened runtime
    + JDK-8245047: [PPC64] C2: ReverseBytes + Load always match to
    unordered Load (acquire semantics missing)
    + JDK-8245649: Revert 8245397 backport of 8230591
    + JDK-8246031: SSLSocket.getSession() doesn't close connection
    for timeout/ interrupts
    + JDK-8246613: Choose the default SecureRandom algo based on
    registration ordering
    + JDK-8248505: Unexpected NoSuchAlgorithmException when using
    secure random impl from BCFIPS provider
- Removed patch:
  * JDK-8228407.patch
    + integrated upstream</changelog>
  <changelog author="fstrba@suse.com" date="1604318400">- Update to upstream tag jdk-11.0.9-11 (October 2020 CPU,
  bsc#1177943)
  * New features
    + JDK-8250784: Shenandoah: A Low-Pause-Time Garbage Collector
  * Security fixes
    + JDK-8233624: Enhance JNI linkage
    + JDK-8236196: Improve string pooling
    + JDK-8236862, CVE-2020-14779: Enhance support of Proxy class
    + JDK-8237990, CVE-2020-14781: Enhanced LDAP contexts
    + JDK-8237995, CVE-2020-14782: Enhance certificate processing
    + JDK-8240124: Better VM Interning
    + JDK-8241114, CVE-2020-14792: Better range handling
    + JDK-8242680, CVE-2020-14796: Improved URI Support
    + JDK-8242685, CVE-2020-14797: Better Path Validation
    + JDK-8242695, CVE-2020-14798: Enhanced buffer support
    + JDK-8243302: Advanced class supports
    + JDK-8244136, CVE-2020-14803: Improved Buffer supports
    + JDK-8244479: Further constrain certificates
    + JDK-8244955: Additional Fix for JDK-8240124
    + JDK-8245407: Enhance zoning of times
    + JDK-8245412: Better class definitions
    + JDK-8245417: Improve certificate chain handling
    + JDK-8248574: Improve jpeg processing
    + JDK-8249927: Specify limits of jdk.serialProxyInterfaceLimit
    + JDK-8253019: Enhanced JPEG decoding
  * Other changes
    + JDK-6532025: GIF reader throws misleading exception with
    truncated images
    + JDK-6949753: [TEST BUG]: java/awt/print/PageFormat/
    /PDialogTest.java needs update by removing an infinite loop
    + JDK-8022535: [TEST BUG] javax/swing/text/html/parser/
    /Test8017492.java fails
    + JDK-8062947: Fix exception message to correctly represent
    LDAP connection failure
    + JDK-8067354: com/sun/jdi/GetLocalVariables4Test.sh failed
    + JDK-8134599: TEST_BUG: java/rmi/transport/closeServerSocket/
    /CloseServerSocket.java fails intermittently with Address
    already in use
    + JDK-8151678: com/sun/jndi/ldap/LdapTimeoutTest.java failed
    due to timeout on DeadServerNoTimeoutTest is incorrect
    + JDK-8160768: Add capability to custom resolve host/domain
    names within the default JNDI LDAP provider
    + JDK-8172404: Tools should warn if weak algorithms are used
    before restricting them
    + JDK-8193367: Annotated type variable bounds crash javac
    + JDK-8202117: com/sun/jndi/ldap/RemoveNamingListenerTest.java
    fails intermittently: Connection reset
    + JDK-8203026: java.rmi.NoSuchObjectException: no such object
    in table
    + JDK-8203281: [Windows] JComboBox change in ui when
    editor.setBorder() is called
    + JDK-8203382: Rename SystemDictionary::initialize_wk_klass to
    resolve_wk_klass
    + JDK-8203393: com/sun/jdi/JdbMethodExitTest.sh and
    JdbExprTest.sh fail due to timeout
    + JDK-8203928: [Test] Convert non-JDB scaffolding
    serviceability shell script tests to java
    + JDK-8204963: javax.swing.border.TitledBorder has a memory leak
    + JDK-8204994: SA might fail to attach to process with "Windbg
    Error: WaitForEvent failed"
    + JDK-8205534: Remove SymbolTable dependency from
    serviceability agent
    + JDK-8206309: Tier1 SA tests fail
    + JDK-8208281: java/nio/channels/
    /AsynchronousSocketChannel/Basic.java timed out
    + JDK-8209109: [TEST] rewrite com/sun/jdi shell tests to java
    version - step1
    + JDK-8209332: [TEST] test/jdk/com/sun/jdi/CatchPatternTest.sh
    is incorrect
    + JDK-8209342: Problemlist SA tests on Solaris due to Error
    attaching to process: Can't create thread_db agent!
    + JDK-8209343: Test javax/swing/border/TestTitledBorderLeak.java
    should be marked as headful
    + JDK-8209517: com/sun/jdi/BreakpointWithFullGC.java fails with
    timeout
    + JDK-8209604: [TEST] rewrite com/sun/jdi shell tests to java
    version - step2
    + JDK-8209605: com/sun/jdi/BreakpointWithFullGC.java fails with
    ZGC
    + JDK-8209608: Problem list com/sun/jdi/BreakpointWithFullGC.java
    + JDK-8210131: vmTestbase/nsk/jvmti/scenarios/allocation/AP10/
    /ap10t001/TestDescription.java failed with ObjectFree:
    GetCurrentThreadCpuTimerInfo returned unexpected error code
    + JDK-8210243: [TEST] rewrite com/sun/jdi shell tests to java
    version - step3
    + JDK-8210527: JShell: NullPointerException in
    jdk.jshell.Eval.translateExceptionStack
    + JDK-8210560: [TEST] convert com/sun/jdi redefineClass-related
    tests
    + JDK-8210725: com/sun/jdi/RedefineClearBreakpoint.java fails
    with waitForPrompt timed out after 60 seconds
    + JDK-8210748: [TESTBUG] lib.jdb.Jdb.waitForPrompt() should
    clarify which output is the pending reply after a timeout
    + JDK-8210760: [TEST] rewrite com/sun/jdi shell tests to java
    version - step4
    + JDK-8210977: jdk/jfr/event/oldobject/TestThreadLocalLeak.java
    fails to find ThreadLocalObject
    + JDK-8211292: [TEST] convert com/sun/jdi/DeferredStepTest.sh
    test
    + JDK-8211694: JShell: Redeclared variable should be reset
    + JDK-8212200: assert when shared java.lang.Object is redefined
    by JVMTI agent
    + JDK-8212629: [TEST] wrong breakpoint in
    test/jdk/com/sun/jdi/DeferredStepTest
    + JDK-8212665: com/sun/jdi/DeferredStepTest.java: jj1 (line 57)
  - unexpected. lastLine=52, minLine=52, maxLine=55
    + JDK-8212807: tools/jar/multiRelease/Basic.java times out
    + JDK-8213182: Minimal VM build failure after JDK-8212200
    (assert when shared java.lang.Object is redefined by JVMTI
    agent)
    + JDK-8213214: Set -Djava.io.tmpdir= when running tests
    + JDK-8213275: ReplaceCriticalClasses.java fails with
    jdk.internal.vm.PostVMInitHook not found
    + JDK-8213574: Deadlock in string table expansion when dumping
    lots of CDS classes
    + JDK-8213703: LambdaConversionException: Invalid receiver type
    not a subtype of implementation type interface
    + JDK-8214074: Ghash optimization using AVX instructions
    + JDK-8214491: Upgrade to JLine 3.9.0
    + JDK-8214797: TestJmapCoreMetaspace.java timed out
    + JDK-8215243: JShell tests failing intermitently with
    "Problem cleaning up the following threads:"
    + JDK-8215244: jdk/jshell/ToolBasicTest.java
    testHistoryReference failed
    + JDK-8215354: x86_32 build failures after JDK-8214074 (Ghash
    optimization using AVX instructions)
    + JDK-8215438: jshell tool: Ctrl-D causes EOF
    + JDK-8216021: RunTest.gmk might set concurrency level to 1 on
    Windows
    + JDK-8216974: HttpConnection not returned to the pool after
    204 response
    + JDK-8218948: SimpleDateFormat :: format - Zone Names are not
    reflected correctly during run time
    + JDK-8219712: code_size2 (defined in stub_routines_x86.hpp) is
    too small on new Skylake CPUs
    + JDK-8220150: macos10.14 Mojave returns anti-aliased glyphs
    instead of aliased B&amp;W glyphs
    + JDK-8221658: aarch64: add necessary predicate for ubfx
    patterns
    + JDK-8221759: Crash when completing "java.io.File.path"
    + JDK-8221918: runtime/SharedArchiveFile/serviceability/
    /ReplaceCriticalClasses.java fails: Shared archive not found
    + JDK-8222074: Enhance auto vectorization for x86
    + JDK-8222079: Don't use memset to initialize fields decode_env
    constructor in disassembler.cpp
    + JDK-8222769: [TESTBUG] TestJFRNetworkEvents should not rely
    on hostname command
    + JDK-8223688: JShell: crash on the instantiation of raw
    anonymous class
    + JDK-8223777: In posix_spawn mode, failing to exec()
    jspawnhelper does not result in an error
    + JDK-8223940: Private key not supported by chosen signature
    algorithm
    + JDK-8224184: jshell got IOException at exiting with AIX
    + JDK-8224234: compiler/codegen/TestCharVect2.java fails in
    test_mulc
    + JDK-8225037: java.net.JarURLConnection::getJarEntry() throws
    NullPointerException
    + JDK-8225625: AES Electronic Codebook (ECB) encryption and
    decryption optimization using AVX512 + VAES instructions
    + JDK-8226536: Catch OOM from deopt that fails rematerializing
    objects
    + JDK-8226575: OperatingSystemMXBean should be made container
    aware
    + JDK-8226697: Several tests which need the @key headful
    keyword are missing it.
    + JDK-8226809: Circular reference in printed stack trace is not
    correctly indented &amp; ambiguous
    + JDK-8227059: sun/security/tools/keytool/
    /DefaultSignatureAlgorithm.java timed out
    + JDK-8227269: Slow class loading when running with JDWP
    + JDK-8227595: keytool/fakegen/DefaultSignatureAlgorithm.java
    fails due to "exitValue = 6"
    + JDK-8228448: Jconsole can't connect to itself
    + JDK-8228967: Trust/Key store and SSL context utilities for
    tests
    + JDK-8229378: jdwp library loader in linker_md.c quietly
    truncates on buffer overflow
    + JDK-8229815: Upgrade Jline to 3.12.1
    + JDK-8230000: some httpclients testng tests run zero test
    + JDK-8230002: javax/xml/jaxp/unittest/transform/
    /SecureProcessingTest.java runs zero test
    + JDK-8230010: Remove jdk8037819/BasicTest1.java
    + JDK-8230094: CCE in createXMLEventWriter(Result) over an
    arbitrary XMLStreamWriter
    + JDK-8230402: Allocation of compile task fails with assert:
    "Leaking compilation tasks?"
    + JDK-8230767: FlightRecorderListener returns null recording
    + JDK-8230870: (zipfs) Add a ZIP FS test that is similar to
    test/jdk/java/util/zip/EntryCount64k.java
    + JDK-8231209: [REDO] ThreadMXBean::getThreadAllocatedBytes()
    can be quicker for self thread
    + JDK-8231586: enlarge encoding space for OopMapValue offsets
    + JDK-8231953: Wrong assumption in assertion in
    oop::register_oop
    + JDK-8231968: getCurrentThreadAllocatedBytes default
    implementation s/b getThreadAllocatedBytes
    + JDK-8232083: Minimal VM is broken after JDK-8231586
    + JDK-8232161: Align some one-way conversion in MS950 charset
    with Windows
    + JDK-8232855: jshell missing word in /help help
    + JDK-8233027: OopMapSet::all_do does oms.next() twice during
    iteration
    + JDK-8233228: Disable weak named curves by default in TLS,
    CertPath, and Signed JAR
    + JDK-8233386: Initialize NULL fields for unused decorations
    + JDK-8233452: java.math.BigDecimal.sqrt() with
    RoundingMode.FLOOR results in incorrect result
    + JDK-8233686: XML transformer uses excessive amount of memory
    + JDK-8233741: AES Countermode (AES-CTR) optimization using
    AVX512 + VAES instructions
    + JDK-8233829: javac cannot find non-ASCII module name under
    non-UTF8 environment
    + JDK-8233958: Memory retention due to HttpsURLConnection
    finalizer that serves no purpose
    + JDK-8234011: (zipfs) Memory leak in
    ZipFileSystem.releaseDeflater()
    + JDK-8234058: runtime/CompressedOops/
    /CompressedClassPointers.java fails with 'Narrow klass base:
    0x0000000000000000' missing from stdout/stderr
    + JDK-8234149: Several regression tests do not dispose Frame at
    end
    + JDK-8234347: "Turkey" meta time zone does not generate
    composed localized names
    + JDK-8234385: [TESTBUG] java/awt/EventQueue/6980209/
    /bug6980209.java fails in linux nightly
    + JDK-8234535: Cross compilation fails due to missing CFLAGS
    for the BUILD_CC
    + JDK-8234541: C1 emits an empty message when it inlines
    successfully
    + JDK-8234687: change javap reporting on unknown attributes
    + JDK-8236464: SO_LINGER option is ignored by SSLSocket in JDK
    11
    + JDK-8236548: Localized time zone name inconsistency between
    English and other locales
    + JDK-8236617: jtreg test containers/docker/
    /TestMemoryAwareness.java fails after 8226575
    + JDK-8237182: Update copyright header for shenandoah and
    epsilon files
    + JDK-8237888: security/infra/java/security/cert/
    /CertPathValidator/certification/LuxTrustCA.java fails when
    checking validity interval
    + JDK-8237977: Further update
    javax/net/ssl/compatibility/Compatibility.java
    + JDK-8238270: java.net HTTP/2 client does not decrease stream
    count when receives 204 response
    + JDK-8238284: [macos] Zero VM build fails due to an obvious
    typo
    + JDK-8238380: java.base/unix/native/libjava/childproc.c
    "multiple definition" link errors with GCC10
    + JDK-8238386: (sctp) jdk.sctp/unix/native/libsctp/SctpNet.c
    "multiple definition" link errors with GCC10
    + JDK-8238388: libj2gss/NativeFunc.o "multiple definition" link
    errors with GCC10
    + JDK-8238448: RSASSA-PSS signature verification fail when
    using certain odd key sizes
    + JDK-8238710: LingeredApp doesn't log stdout/stderr if exits
    with non-zero code
    + JDK-8239083: C1 assert(known_holder == NULL ||
    (known_holder-&gt;is_instance_klass() &amp;&amp;
    (!known_holder-&gt;is_interface() ||
    ((ciInstanceKlass*)known_holder)-&gt;has_nonstatic_concrete_methods())),
    "should be non-static concrete method");
    + JDK-8239385: KerberosTicket client name refers wrongly to
    sAMAccountName in AD
    + JDK-8240169: javadoc fails to link to non-modular api docs
    + JDK-8240295: hs_err elapsed time in seconds is not accurate
    enough
    + JDK-8240360: NativeLibraryEvent has wrong library name on
    Linux
    + JDK-8240676: Meet not symmetric failure when running lucene
    on jdk8
    + JDK-8241007: Shenandoah: remove
    ShenandoahCriticalControlThreadPriority support
    + JDK-8241065: Shenandoah: remove leftover code after
    JDK-8231086
    + JDK-8241086: Test runtime/NMT/HugeArenaTracking.java is
    failing on 32bit Windows
    + JDK-8241130: com.sun.jndi.ldap.EventSupport.removeDeadNotifier:
    java.lang.NullPointerException
    + JDK-8241138: http.nonProxyHosts=* causes
    StringIndexOutOfBoundsException in DefaultProxySelector
    + JDK-8241319: WB_GetCodeBlob doesn't have ResourceMark
    + JDK-8241478: vmTestbase/gc/gctests/Steal/steal001/steal001.java
    fails with OOME
    + JDK-8241574: Shenandoah: remove ShenandoahAssertToSpaceClosure
    + JDK-8241750: x86_32 build failure after JDK-8227269
    + JDK-8242184: CRL generation error with RSASSA-PSS
    + JDK-8242283: Can't start JVM when java home path includes
    non-ASCII character
    + JDK-8242556: Cannot load RSASSA-PSS public key with non-null
    params from byte array
    + JDK-8243029: Rewrite javax/net/ssl/compatibility/
    /Compatibility.java with a flexible interop test framework
    + JDK-8243138: Enhance BaseLdapServer to support starttls
    extended request
    + JDK-8243320: Add SSL root certificates to Oracle Root CA
    program
    + JDK-8243321: Add Entrust root CA - G4 to Oracle Root CA
    program
    + JDK-8243389: enhance os::pd_print_cpu_info on linux
    + JDK-8243453: java --describe-module failed with non-ASCII
    module name under non-UTF8 environment
    + JDK-8243470: [macos] bring back O2 opt level for unsafe.cpp
    + JDK-8243489: Thread CPU Load event may contain wrong data for
    CPU time under certain conditions
    + JDK-8243925: Toolkit#getScreenInsets() returns wrong value on
    HiDPI screens (Windows)
    + JDK-8244087: 2020-04-24 public suffix list update
    + JDK-8244151: Update MUSCLE PC/SC-Lite headers to the latest
    release 1.8.26
    + JDK-8244164: AArch64: jaotc generates incorrect code for
    compressed OOPs with non-zero heap base
    + JDK-8244196: adjust output in os_linux
    + JDK-8244225: stringop-overflow warning on strncpy call from
    compile_the_world_in
    + JDK-8244287: JFR: Methods samples have line number 0
    + JDK-8244703: "platform encoding not initialized" exceptions
    with debugger, JNI
    + JDK-8244719: CTW: C2 compilation fails with
    "assert(!VerifyHashTableKeys || _hash_lock == 0) failed:
    remove node from hash table before modifying it"
    + JDK-8244729: Shenandoah: remove resolve paths from
    SBSA::generate_shenandoah_lrb
    + JDK-8244763: Update --release 8 symbol information after JSR
    337 MR3
    + JDK-8244818: Java2D Queue Flusher crash while moving
    application window to external monitor
    + JDK-8245151: jarsigner should not raise duplicate warnings on
    verification
    + JDK-8245616: Bump update version for OpenJDK: jdk-11.0.9
    + JDK-8245714: "Bad graph detected in build_loop_late" when
    loads are pinned on loop limit check uncommon branch
    + JDK-8245801: StressRecompilation triggers assert "redundunt
    OSR recompilation detected. memory leak in CodeCache!"
    + JDK-8245832: JDK build make-static-libs should build all JDK
    libraries
    + JDK-8245880: Shenandoah: check class unloading flag early in
    concurrent code root scan
    + JDK-8245981: Upgrade to jQuery 3.5.1
    + JDK-8246027: Minimal fastdebug build broken after JDK-8245801
    + JDK-8246094: [macos] Sound Recording and playback is not
    working
    + JDK-8246153: TestEliminateArrayCopy fails with
  - XX:+StressReflectiveCode
    + JDK-8246193: Possible NPE in ENC-PA-REP search in AS-REQ
    + JDK-8246196: javax/management/MBeanServer/OldMBeanServerTest
    fails with AssertionError
    + JDK-8246203: Segmentation fault in verification due to stack
    overflow with -XX:+VerifyIterativeGVN
    + JDK-8246330: Add TLS Tests for Legacy ECDSA curves
    + JDK-8246453: TestClone crashes with "all collected exceptions
    must come from the same place"
    + JDK-8247246: Add explicit ResolvedJavaType.link and expose
    presence of default methods
    + JDK-8247350: [aarch64] assert(false) failed: wrong size of
    mach node
    + JDK-8247502: PhaseStringOpts crashes while optimising
    effectively dead code
    + JDK-8247615: Initialize the bytes left for the heap sampler
    + JDK-8247824: CTW: C2 (Shenandoah) compilation fails with SEGV
    in SBC2Support::pin_and_expand
    + JDK-8247874: Replacement in VersionProps.java.template not
    working when --with-vendor-bug-url contains '&amp;'
    + JDK-8247979: aarch64: missing side effect of killing flags
    for clearArray_reg_reg
    + JDK-8248214: Add paddings for TaskQueueSuper to reduce
    false-sharing cache contention
    + JDK-8248219: aarch64: missing memory barrier in
    fast_storefield and fast_accessfield
    + JDK-8248348: Regression caused by the update to BCEL 6.0
    + JDK-8248385: [testbug][11u] Adapt TestInitiExceptions to
    jtreg 5.1
    + JDK-8248495: [macos] zerovm is broken due to libffi headers
    location
    + JDK-8248851: CMS: Missing memory fences between free chunk
    check and klass read
    + JDK-8248987: AOT's Linker.java seems to eagerly fail-fast on
    Windows
    + JDK-8249159: Downport test rework for SSLSocketTemplate from
    8224650
    + JDK-8249215: JFrame::setVisible crashed with
  - Dfile.encoding=UTF-8 on Japanese Windows.
    + JDK-8249251: [dark_mode ubuntu 20.04] The selected menu is
    not highlighted in GTKLookAndFeel
    + JDK-8249255: Build fails if source code in cygwin home dir
    + JDK-8249277: TestVerifyIterativeGVN.java is failing with
    timeout in OpenJDK 11
    + JDK-8249278: Revert JDK-8226253 which breaks the spec of
    AccessibleState.SHOWING for JList
    + JDK-8249560: Shenandoah: Fix racy GC request handling
    + JDK-8249801: Shenandoah: Clear soft-refs on requested GC cycle
    + JDK-8249953: Shenandoah: gc/shenandoah/mxbeans tests should
    account for corner cases
    + JDK-8250582: Revert Principal Name type to NT-UNKNOWN when
    requesting TGS Kerberos tickets
    + JDK-8250609: C2 crash in IfNode::fold_compares
    + JDK-8250627: Use -XX:+/-UseContainerSupport for
    enabling/disabling Java container metrics
    + JDK-8250755: Better cleanup for
    jdk/test/javax/imageio/plugins/shared/CanWriteSequence.java
    + JDK-8250787: Provider.put no longer registering aliases in
    FIPS env
    + JDK-8250826: jhsdb does not work with coredump which comes
    from Substrate VM
    + JDK-8250827: Shenandoah: needs to reset/finish StringTable's
    dead count before/after parallel walk
    + JDK-8250844: Make sure {type,obj}ArrayOopDesc accessors check
    the bounds
    + JDK-8251117: Cannot check P11Key size in P11Cipher and
    P11AEADCipher
    + JDK-8251354: Shenandoah: Fix jdk/jfr/tool/TestPrintJSON.java
    test failure
    + JDK-8251451: Shenandoah: Remark ObjectSynchronizer roots with
    I-U
    + JDK-8251469: Better cleanup for
    test/jdk/javax/imageio/SetOutput.java
    + JDK-8251487: Shenandoah: missing detail timing tracking for
    final mark cleaning phase
    + JDK-8252120: compiler/oracle/TestCompileCommand.java
    misspells "occured"
    + JDK-8252157: JDK-8231209 11u backport breaks jmm binary
    compatibility
    + JDK-8252258: [11u] JDK-8242154 changes the default vendor
    + JDK-8252804: [test] Fix 'ReleaseDeflater.java' test after
    downport of 8234011
    + JDK-8253134: JMM_VERSION should remain at 0x20020000 (JDK 10)
    in JDK 11
    + JDK-8253283: [11u] Test build/translations/
    /VerifyTranslations.java failing after JDK-8252258
    + JDK-8253813: Backout JDK-8244287 from 11u: it causes several
    crashes
- Removed patch:
  * gcc-fno-common-fix.patch
    + not needed any more with this version
- Added patch:
  * JDK-8250861.patch
    + Fix regression "8250861: Crash in MinINode::Ideal(PhaseGVN*,
    bool)" introduced in jdk 11.0.9</changelog>
  <changelog author="fstrba@suse.com" date="1604491200">- Enable Sheandoah GC for x86_64 (jsc#ECO-3171)</changelog>
  <changelog author="fstrba@suse.com" date="1605528000">- Update to upstream tag jdk-11.0.9.1-1
  * Fix:
    + JDK-8250861: Crash in MinINode::Ideal(PhaseGVN*, bool)
- Removed patch:
  * JDK-8250861.patch
    + Integrated upstream</changelog>
  <changelog author="fstrba@suse.com" date="1611230400">- Update to upstream tag jdk-11.0.10+9 (January 2021 CPU,
  bsc#1181239)
  * Security fixes
    + JDK-8247619: Improve Direct Buffering of Characters
  * Other changes
    + JDK-6722928: Support SSPI as a native GSS-API provider
    + JDK-7185258: [macosx] Deadlock in SunToolKit.realSync()
    + JDK-8152332: [macosx] JFileChooser cannot be serialized on
    Mac OS X
    + JDK-8161684: [testconf] Add VerifyOops' testing into compiler
    tiers
    + JDK-8171279: Support X25519 and X448 in TLS
    + JDK-8173361: various crashes in
    JvmtiExport::post_compiled_method_load
    + JDK-8173658: JvmtiExport::post_class_unload() is broken for
    non-JavaThread initiators
    + JDK-8191006: hsdis disassembler plugin does not compile with
    binutils 2.29+
    + JDK-8197981: Missing return statement in
    __sync_val_compare_and_swap_8
    + JDK-8198334: java/awt/FileDialog/8003399/bug8003399.java
    fails in headless mode
    + JDK-8200151: Add 8 JNDI tests to com/sun/jndi/dns/ConfigTests/
    + JDK-8208279: Add 8 JNDI tests to com/sun/jndi/dns/EnvTests/
    + JDK-8208483: Add 5 JNDI tests to
    com/sun/jndi/dns/FactoryTests/
    + JDK-8208542: Add 4 JNDI tests to com/sun/jndi/dns/ListTests/
    + JDK-8208665: Amend cross-compilation docs with
    qemu-debootstrap recipe
    + JDK-8210088: ProblemList gc/epsilon/TestMemoryMXBeans.java
    + JDK-8210339: Add 10 JNDI tests to com/sun/jndi/dns/FedTests/
    + JDK-8211450: UndetVar::dup is not copying the kind field to
    the duplicated instance
    + JDK-8212160: JVMTI agent crashes with "assert(_value != 0LL)
    failed: resolving NULL _value"
    + JDK-8212226: SurfaceManager throws "Invalid Image variant"
    for MultiResolutionImage (Windows)
    + JDK-8213400: Support choosing group name in keytool keypair
    generation
    + JDK-8213535: Windows HiDPI html lightweight tooltips are
    truncated
    + JDK-8213698: Improve devkit creation and add support for
    linux/ppc64/ppc64le/s390x
    + JDK-8214025: assert(t-&gt;singleton()) failed: must be a
    constant when ScavengeRootsInCode &lt; 2
    + JDK-8214242: compiler/arguments/TestScavengeRootsInCode.java
    fails because of missing UnlockDiagnosticVMOptions
    + JDK-8214787: Zero builds fail with "undefined
    JavaThread::thread_state()"
    + JDK-8215583: Exclude
    runtime/handshake/HandshakeWalkSuspendExitTest.java
    + JDK-8216012: Infinite loop in RSA KeyPairGenerator
    + JDK-8216324: GetClassMethods is confused by the presence of
    default methods in super interfaces
    + JDK-8217429: WebSocket over authenticating proxy fails to
    send Upgrade headers
    + JDK-8217976: test/jdk/java/net/httpclient/websocket/
    /WebSocketProxyTest.java fails intermittently
    + JDK-8218021: Have jarsigner preserve posix permission
    attributes
    + JDK-8218287: jshell tool: input behavior unstable after
    12-ea+24 on Windows
    + JDK-8218851: JVM crash in custom classloader stress test, JDK
    12 &amp; 13
    + JDK-8220420: Cleanup c1_LinearScan
    + JDK-8222072: JVMTI GenerateEvents() sends CompiledMethodLoad
    events to wrong jvmtiEnv
    + JDK-8222286: Fix for JDK-8213419 is broken on s390
    + JDK-8222527: HttpClient doesn't send HOST header when
    tunelling HTTP/1.1 through http proxy
    + JDK-8222533: jtreg test jdk/internal/platform/cgroup/
    /TestCgroupMetrics.java fails on SLES12.3 linux ppc64le
    machine
    + JDK-8224506: [TESTBUG] TestDockerMemoryMetrics.java fails
    with exitValue = 137
    + JDK-8224555: vmTestbase/nsk/jvmti/scenarios/contention/TC02/
    /tc02t001/TestDescription.java failed
    + JDK-8224650: Add tests to support X25519 and X448 in TLS
    + JDK-8225072: Add LuxTrust certificate that is expiring in
    March 2021 to list of allowed but expired certs
    + JDK-8225329: -XX:+PrintBiasedLockingStatistics causes crash
    during initialization on Windows platforms
    + JDK-8225687: Newly added sspi.cpp in JDK-6722928 still
    contains some small errors
    + JDK-8227006: [linux] Runtime.availableProcessors execution
    time increased by factor of 100
    + JDK-8227275: Within native OOM error handling, assertions may
    hang the process
    + JDK-8227647: [Graal] Test8009761.java fails due to
    "RuntimeException: static java.lang.Object
    compiler.uncommontrap.Test8009761.m3(boolean,boolean) not
    compiled"
    + JDK-8229495: SIGILL in C2 generated OSR compilation
    + JDK-8230910: libsspi_bridge does not build on Windows 32bit
    + JDK-8232114: JVM crashed at imjpapi.dll in native code
    + JDK-8234147: Avoid looking up standard charsets in core
    libraries
    + JDK-8234393: [macos] printing ignores printer tray
    + JDK-8234863: Increase default value of MaxInlineLevel
    + JDK-8235218: Minimal VM is broken after JDK-8173361
    + JDK-8235456: Minimal VM is broken after JDK-8212160
    + JDK-8235829: graal crashes with Zombie.java test
    + JDK-8236124: Minimal VM slowdebug build failed after
    JDK-8212160
    + JDK-8236512: PKCS11 Connection closed after Cipher.doFinal
    and NoPadding
    + JDK-8236944: The legVecZ operand should be limited to
    zmm0-zmm15 registers
    + JDK-8237186: Fix typo in copyright header of
    java/io/Reader/TransferTo.java
    + JDK-8237499: JFR: Include stack trace in the ThreadStart event
    + JDK-8237512: AArch64: aarch64TestHook leaks a BufferBlob
    + JDK-8237524: AArch64: String.compareTo() may return incorrect
    result
    + JDK-8237950: C2 compilation fails with "Live Node limit
    exceeded limit" during ConvI2L::Ideal optimization
    + JDK-8238579: HttpsURLConnection drops the timeout and hangs
    forever in read
    + JDK-8239105: Add exception for expiring Digicert root
    certificates to VerifyCACerts test
    + JDK-8239477: jdk/jfr/jcmd/TestJcmdStartStopDefault.java fails
  - XX:+VerifyOops with "verify_oop: rsi: broken oop"
    + JDK-8239497: SEGV in EdgeUtils::field_name_symbol(Edge const&amp;)
    + JDK-8239886: Minimal VM build fails after JDK-8237499
    + JDK-8240633: Memory leaks in the implementations of
    FileChooserUI
    + JDK-8240690: Race condition between EDT and
    BasicDirectoryModel.FilesLoader.run0()
    + JDK-8241234: Unify monitor enter/exit runtime entries.
    + JDK-8241311: Move some charset mapping tests from closed to
    open
    + JDK-8241797: Add some tests to the problem list
    + JDK-8242029: AArch64: skip G1 array copy pre-barrier if
    marking not active
    + JDK-8242335: Additional Tests for RSASSA-PSS
    + JDK-8242480: Negative value may be returned by
    getFreeSwapSpaceSize() in the docker
    + JDK-8242614: cleanup duplicated test ldap server in some
    com/sun/jndi/ldap/ tests
    + JDK-8242846: Bring back test/jdk/tools/jlink/plugins/
    /OrderResourcesPluginTest.java
    + JDK-8243114: Implement montgomery{Multiply,Square}intrinsics
    on Windows
    + JDK-8243290: Improve diagnostic messages for class
    verification and redefinition failures
    + JDK-8243488: Add tests for set/get SendBufferSize and
    getReceiveBufferSize in DatagramSocket
    + JDK-8243549: sun/security/ssl/CipherSuite/
    /NamedGroupsWithCipherSuite.java failed with Unsupported
    signature algorithm: DSA
    + JDK-8243617: compiler/onSpinWait/TestOnSpinWaitC1.java test
    uses wrong class
    + JDK-8243619: compiler/codecache/CheckSegmentedCodeCache.java
    test misses -version
    + JDK-8244142: some hotspot/runtime tests don't check exit code
    of forked JVM
    + JDK-8244278: Excessive code cache flushes and sweeps
    + JDK-8244282: test/hotspot/jtreg/compiler/intrinsics/
    /Test8237524.java fails with --illegal-access=deny
    + JDK-8244621: [macos10.15] Garbled FX printing plus CoreText
    warnings on Catalina when building with Xcode 11
    + JDK-8244819: hsdis does not compile with binutils 2.34+
    + JDK-8245051: c1 is broken if it is compiled by gcc without
  - fno-lifetime-dse
    + JDK-8245168: jlink should not be treated as a "small" tool
    + JDK-8245400: Upgrade to LittleCMS 2.11
    + JDK-8246381: VM crashes with "Current BasicObjectLock* below
    than low_mark"
    + JDK-8246434: Threads::print_on_error assumes that the heap
    has been set up
    + JDK-8246648: issue with OperatingSystemImpl
    getFreeSwapSpaceSize in docker after 8242480
    + JDK-8247201: Print potential pointer value of readable stack
    memory in hs_err file
    + JDK-8247763: assert(outer-&gt;outcnt() == 2) failed: 'only phis'
    failure in LoopNode::verify_strip_mined()
    + JDK-8247867: Upgrade to freetype 2.10.2
    + JDK-8248190: Enable Power10 system and implement new
    byte-reverse instructions
    + JDK-8248226: TestCloneAccessStressGCM fails with
  - XX:-ReduceBulkZeroing
    + JDK-8248347: windows build broken by JDK-8243114
    + JDK-8248532: Every time I change keyboard language at my
    MacBook, Java crashes
    + JDK-8248552: C2 crashes with SIGFPE due to division by zero
    + JDK-8248596: [TESTBUG] compiler/loopopts/
    /PartialPeelingUnswitch.java times out with Graal enabled
    + JDK-8248745: Add jarsigner and keytool tests for restricted
    algorithms
    + JDK-8248791: sun/util/resources/cldr/TimeZoneNamesTest.java
    fails with -XX:-ReduceInitialCardMarks -XX:-ReduceBulkZeroing
    + JDK-8248845: AArch64: stack corruption after spilling vector
    register
    + JDK-8249176: Update GlobalSignR6CA test certificates
    + JDK-8249183: JVM crash in "AwtFrame::WmSize" method
    + JDK-8249192: MonitorInfo stores raw oops across safepoints
    + JDK-8249602: C2: assert(cnt == _outcnt) failed: no insertions
    allowed
    + JDK-8249603: C1: assert(has_error == false) failed: register
    allocation invalid
    + JDK-8249605: C2: assert(no_dead_loop) failed: dead loop
    detected
    + JDK-8249607: C2: assert(!had_error) failed: bad dominance
    + JDK-8249608: Vector register used by C2 compiled method
    corrupted at safepoint
    + JDK-8249672: Include microcode revision in features_string on
    x86
    + JDK-8249748: gtest silently ignores bad jvm arguments
    + JDK-8249821: Separate libharfbuzz from libfontmanager
    + JDK-8250598: Hyper-V is detected in spite of running on host
    OS
    + JDK-8250605: Linux x86_32 builds fail after JDK-8249821
    + JDK-8250636: iso8601_time returns incorrect offset part on
    MacOS
    + JDK-8250665: Wrong translation for the month name of May in
    ar_JO,LB,SY
    + JDK-8250772: Test com/sun/jndi/ldap/
    /NamingExceptionMessageTest.java fails intermittently with
    javax.naming.ServiceUnavailableException
    + JDK-8250825: C2 crashes with assert(field != __null) failed:
    missing field
    + JDK-8250894: Provide a configure option to build and run
    against the platform libharfbuzz
    + JDK-8250928: JFR: Improve hash algorithm for stack traces
    + JDK-8250968: Symlinks attributes not preserved when using
    jarsigner on zip files
    + JDK-8250984: Memory Docker tests fail on some Linux kernels
    w/o cgroupv1 swap limit capabilities
    + JDK-8251118: BiasedLocking::preserve_marks should not have a
    HandleMark
    + JDK-8251189: com/sun/jndi/ldap/LdapDnsProviderTest.java
    failed due to timeout
    + JDK-8251257: NMT: jcmd VM.native_memory scale=1 crashes
    target VM
    + JDK-8251365: Build failure on AIX after 8250636
    + JDK-8251397: NPE on ClassValue.ClassValueMap.cacheArray
    + JDK-8251456: [TESTBUG] compiler/vectorization/
    /TestVectorsNotSavedAtSafepoint.java failed OutOfMemoryError
    + JDK-8251458: Parse::do_lookupswitch fails with "assert(_cnt
    &gt;= 0) failed"
    + JDK-8251535: Partial peeling at unsigned test adds incorrect
    loop exit check
    + JDK-8251949: ZGC: Set explicit heap size for
    compiler/gcbarriers tests
    + JDK-8252090: JFR: StreamWriterHost::write_unbuffered() stucks
    in an infinite loop OpenJDK (build 13.0.1+9)
    + JDK-8252415: Bump update version for OpenJDK: jdk-11.0.10
    + JDK-8252470: java/awt/dnd/DisposeFrameOnDragCrash/
    /DisposeFrameOnDragTest.java fails on Windows
    + JDK-8252497: Incorrect numeric currency code for ROL
    + JDK-8252660: Shenandoah: support manageable SoftMaxHeapSize
    option
    + JDK-8252679: Two windows specific FileDIalog tests may fail
    on some Windows_Server_2016_Standard
    + JDK-8252696: Loop unswitching may cause out of bound array
    load to be executed
    + JDK-8252754: Hash code calculation of JfrStackTrace is
    inconsistent
    + JDK-8253219: Epsilon: clean up unnecessary includes
    + JDK-8253224: Shenandoah: ShenandoahStrDedupQueue destructor
    calls virtual num_queues()
    + JDK-8253226: Shenandoah: remove unimplemented
    ShenandoahStrDedupQueue::verify
    + JDK-8253269: The CheckCommonColors test should provide more
    info on failure
    + JDK-8253284: Zero OrderAccess barrier mappings are incorrect
    + JDK-8253375: OSX build fails with Xcode 12.0 (12A7209)
    + JDK-8253778: ShenandoahSafepoint::is_at_shenandoah_safepoint
    should not access VMThread state from other threads
    + JDK-8253791: Issue with useAppleColor check in CSystemColors.m
    + JDK-8254016: Test8237524 fails with -XX:-CompactStrings option
    + JDK-8254081: java/security/cert/PolicyNode/
    /GetPolicyQualifiers.java fails due to an expired certificate
    + JDK-8254144: Non-x86 Zero builds fail with return-type
    warning in os_linux_zero.cpp
    + JDK-8254166: Zero: return-type warning in
    zeroInterpreter_zero.cpp
    + JDK-8254177: (tz) Upgrade time-zone data to tzdata2020b
    + JDK-8254185: Fix Code cache sweeper heuristics for JDK 11
    + JDK-8254190: [s390] interpreter misses exception check after
    calling monitorenter
    + JDK-8254790: SIGSEGV in string_indexof_char and
    stringL_indexof_char intrinsics
    + JDK-8254854: [cgroups v1] Metric limits not properly detected
    on some join controller combinations
    + JDK-8254982: (tz) Upgrade time-zone data to tzdata2020c
    + JDK-8255050: Add pkcs11/KeyStore/ClientAuth.sh to Problem list
    + JDK-8255065: Zero: accessor_entry misses the IRIW case
    + JDK-8255226: (tz) Upgrade time-zone data to tzdata2020d
    + JDK-8255269: Unsigned overflow in g1Policy.cpp
    + JDK-8255365: Problem list failing client manual tests
    + JDK-8255457: Shenandoah: cleanup ShenandoahMarkTask
    + JDK-8255466: C2 crashes at ciObject::get_oop() const+0x0
    + JDK-8255550: x86: Assembler::cmpq(Address dst, Register src)
    encoding is incorrect
    + JDK-8255603: Memory/Performance regression after JDK-8210985
    + JDK-8255760: Shenandoah: match constants style in
    ShenandoahMarkTask fallback
    + JDK-8255781: Bump patch update version for OpenJDK:
    jdk-11.0.9.1
    + JDK-8255937: Better cleanup for
    test/jdk/javax/imageio/stream/StreamFlush.java
    + JDK-8256427: Test com/sun/jndi/dns/ConfigTests/
    /PortUnreachable.java does not work on AIX
    + JDK-8256452: Integrate missing part of JDK-8232370 to 11u
    + JDK-8256483: [TESTBUG] serviceability/jvmti/GetClassMethods/
    /libOverpassMethods.c fails to compile on gcc 4.4.x
    + JDK-8256557: libharfbuzz fails to link on gcc 4.4.x due to
  - Wl,-z,defs
    + JDK-8256618: Zero: Linux x86_32 build still fails
    + JDK-8256736: Zero: GTest tests fail with "unsuppported vm
    variant"
    + JDK-8256809: Annotation processing causes NPE during flow
    analysis
    + JDK-8257181: s390x builds are very noisy with gc-sections
    messages
    + JDK-8257242: [macOS] Java app crashes while switching input
    methods
    + JDK-8257545: SunJSSE FIPS regression in key exchange after
    JDK-8171279 11u backport
    + JDK-8257641: Shenandoah: Query is_at_shenandoah_safepoint()
    from control thread should return false
    + JDK-8257701: Shenandoah: objArrayKlass metadata is not marked
    with chunked arrays
    + JDK-8258630: Add expiry exception for QuoVadis root
    certificate
- New upstream dependency on libharfbuzz
- Regenerated patches: missing-return.patch system-pcsclite.patch</changelog>
  <changelog author="fstrba@suse.com" date="1616155200">- Added patches:
  * system-crypto-policy.patch
    + Let OpenJDK use system crypto policies unless explicitely told
    not to
  * nss-security-provider.patch
    + Add the NSS security provider with configuration in generated
    nss.cfg file
  * keytool-default-rsa.patch
    + Make keytool generate RSA keys by default, since only the
    LEGACY system crypto policy allows DSA</changelog>
  <changelog author="pujos.michael@gmail.com" date="1618488000">- moved mozilla-nss dependency to java-11-openjdk-headless package
  This is necessary to be able to do crypto with just
  java-11-openjdk-headless installed. Fixes boo#1184606</changelog>
  <changelog author="fstrba@suse.com" date="1619006400">- Update to upstream tag jdk-11.0.11+9 (April 2021, CPU)
  * Security fixes
    + JDK-8244473: Contextualize registration for JNDI
    + JDK-8244543: Enhanced handling of abstract classes
    + JDK-8249906, CVE-2021-2163, bsc#1185055: Enhance opening JARs
    + JDK-8250568, CVE-2021-2161, bsc#1185056: Less ambiguous
    processing
    + JDK-8253799: Make lists of normal filenames
    + JDK-8257001: Improve Http Client Support
  * Other changes
    + JDK-7107012: sun.jvm.hotspot.code.CompressedReadStream
    readDouble() conversion to long mishandled
    + JDK-7146776: deadlock between URLStreamHandler.getHostAddress
    and file.Handler.openconnection
    + JDK-8086003: Test fails on OSX with java.lang.RuntimeException
    'Narrow klass base: 0x0000000000000000, Narrow klass shift: 3'
    missing
    + JDK-8168869: jdeps: localized messages don't use proper line
    breaks
    + JDK-8180837: SunPKCS11-NSS tests failing with
    CKR_ATTRIBUTE_READ_ONLY and CKR_MECHANISM_PARAM_INVALID
    + JDK-8202343: Disable TLS 1.0 and 1.1
    + JDK-8205992: jhsdb cannot attach to Java processes running in
    Docker containers
    + JDK-8209193: Fix aarch64-linux compilation after -Wreorder
    changes
    + JDK-8210413: AArch64: Optimize div/rem by constant in C1
    + JDK-8210578: AArch64: Invalid encoding for fmlsvs instruction
    + JDK-8211051: jdeps usage of --dot-output doesn't provide
    valid output for modular jar
    + JDK-8211057: Gensrc step CompileProperties generates unstable
    CompilerProperties output
    + JDK-8211150: G1 Full GC not purging code root memory and
    hence causing memory leak
    + JDK-8211825: ModuleLayer.defineModulesWithXXX does not setup
    delegation when module reads automatic module
    + JDK-8212043: Add floating-point Math.min/max intrinsics
    + JDK-8212218: [TESTBUG] runtime/ErrorHandling/
    /TestHeapDumpOnOutOfMemoryErrorInMetaspace.java timed out
    + JDK-8213116: javax/swing/JComboBox/WindowsComboBoxSize/
    /WindowsComboBoxSizeTest.java fails in Windows
    + JDK-8213909: jdeps --print-module-deps should report missing
    dependences
    + JDK-8214180: Need better granularity for sleeping
    + JDK-8214223: tools/jdeps/listdeps/ListModuleDeps.java failed
    due to missing Lib2 file
    + JDK-8214230: Classes generated by SystemModulesPlugin.java
    are not reproducable
    + JDK-8214741: docs/index.html has no title or copyright
    + JDK-8215687: [Graal] unit test CheckGraalIntrinsics failed
    after 8212043
    + JDK-8217848: [Graal] vmTestbase/nsk/jvmti/ResourceExhausted/
    /resexhausted003/TestDescription.java fails
    + JDK-8218482: sun/security/krb5/auto/ReplayCachePrecise.java
    failed - no KrbException thrown
    + JDK-8218550: Add test omitted from JDK-8212043
    + JDK-8221584: SIGSEGV in os::PlatformEvent::unpark() in
    JvmtiRawMonitor::raw_exit while posting method exit event
    + JDK-8221995: AARCH64: problems with CAS instructions encoding
    + JDK-8222518: Remove unnecessary caching of Parker object in
    java.lang.Thread
    + JDK-8222785: aarch64: add necessary masking for immediate
    shift counts
    + JDK-8223186: HotSpot compile warnings from GCC 9
    + JDK-8225773: jdeps --check produces NPE if there are missing
    module dependences
    + JDK-8225805: Java Access Bridge does not close the logger
    + JDK-8226810: Failed to launch JVM because of
    NullPointerException occured on System.props
    + JDK-8229396: jdeps ignores multi-release when
    generate-module-info used on command line
    + JDK-8229474: Shenandoah: Cleanup CM::update_roots()
    + JDK-8232225: Rework the fix for JDK-8071483
    + JDK-8232905: JFR fails with assertion:
    assert(t-&gt;unflushed_size() == 0) failed: invariant
    + JDK-8233164: C2 fails with assert(phase-&gt;C-&gt;get_alias_index(t)
    == phase-&gt;C-&gt;get_alias_index(t_adr)) failed: correct memory
    chain
    + JDK-8233910: java/awt/ColorClass/AlphaColorTest.java is
    failing  intermittently in nightly lnux-x64 system
    + JDK-8233912: aarch64: minor improvements of atomic operations
    + JDK-8234508: VM_HeapWalkOperation::iterate_over_object reads
    non-strong fields with an on-strong load barrier
    + JDK-8234742: Improve handshake logging
    + JDK-8234796: Refactor Handshake::execute to take a more
    complex type than ThreadClosure
    + JDK-8235324: Dying objects are published from users of
    CollectedHeap::object_iterate
    + JDK-8235351: Lookup::unreflect should bind with the original
    caller independent of Method's accessible flag
    + JDK-8237369: Shenandoah: failed vmTestbase/nsk/jvmti/
    /AttachOnDemand/attach021/TestDescription.java test
    + JDK-8237392: Shenandoah: Remove unreliable assertion
    + JDK-8237483: AArch64 C1 OopMap inserted twice fatal error
    + JDK-8237495: Java MIDI fails with a dereferenced memory error
    when asked to send a raw 0xF7
    + JDK-8239355: (dc) Initial value of SO_SNDBUF should allow
    sending large datagrams (macOS)
    + JDK-8240353: AArch64: missing support for
  - XX:+ExtendedDTraceProbes in C1
    + JDK-8240704: CheckHandles.java failed "AssertionError: Handle
    use increased by more than 10 percent."
    + JDK-8240751: Shenandoah: fold ShenandoahTracer definition
    + JDK-8240795: [REDO] 8238384 CTW: C2 compilation fails with
    "assert(store != load-&gt;find_exact_control(load-&gt;in(0)))
    failed: dependence cycle found"
    + JDK-8241598: Upgrade JLine to 3.14.0
    + JDK-8241649: Optimize Character.toString
    + JDK-8241770: Module xxxAnnotation() methods throw NCDFE if
    module-info.class found as resource in unnamed module
    + JDK-8241911: AArch64: Fix a potential register clash issue in
    reduce_add2I
    + JDK-8242030: Wrong package declarations in jline classes after
    JDK-8241598
    + JDK-8242565: Policy initialization issues when the denyAfter
    constraint is enabled
    + JDK-8243618: compiler/rtm/cli tests can be run w/o WhiteBox
    + JDK-8243670: Unexpected test result caused by C2
    MergeMemNode::Ideal
    + JDK-8244088: [Regression] Switch of Gnome theme ends up in
    deadlocked UI
    + JDK-8244154: Update SunPKCS11 provider with PKCS11 v3.0 header
    files
    + JDK-8244340: Handshake processing thread lacks yielding
    + JDK-8244573: java.lang.ArrayIndexOutOfBoundsException thrown
    for malformed class file
    + JDK-8244683: A TSA server used by tests
    + JDK-8245005: javax/net/ssl/compatibility/BasicConnectTest.java
    failed with No enum constant
    + JDK-8245026: PsAdaptiveSizePolicy::_old_gen_policy_is_ready is
    unused
    + JDK-8245283: JFR: Can't handle constant dynamic used by Jacoco
    agent
    + JDK-8245512: CRC32 optimization using AVX512 instructions
    + JDK-8245527: LDAP Channel Binding support for Java
    GSS/Kerberos
    + JDK-8246707: (sc) SocketChannel.read/write throws
    AsynchronousCloseException on closed channel
    + JDK-8246709: sun/security/tools/jarsigner/
    /TsacertOptionTest.java compilation failed after JDK-8244683
    + JDK-8247200: assert((unsigned)fpargs &lt; 32)
    + JDK-8247766: [aarch64] guarantee(val &lt; (1U &lt;&lt; nbits))
    failed: Field too big for insn.
    + JDK-8248336: AArch64: C2: offset overflow in
    BoxLockNode::emit
    + JDK-8248865: Document JNDI/LDAP timeout properties
    + JDK-8248901: Signed immediate support in
    .../share/assembler.hpp is broken.
    + JDK-8249543: Force DirectBufferAllocTest to run with
  - ExplicitGCInvokesConcurrent
    + JDK-8249588: libwindowsaccessbridge issues on 64bit Windows
    + JDK-8249749: modify a primitive array through a stream and a
    for cycle causes jre crash
    + JDK-8249787: Make TestGCLocker more resilient with concurrent
    GCs
    + JDK-8249867: xml declaration is not followed by a newline
    + JDK-8250911: [windows] os::pd_map_memory() error detection
    broken
    + JDK-8251255: [linux] Add process-memory information to hs-err
    and VM.info
    + JDK-8251359: Shenandoah: filter null oops before calling
    enqueue/SATB barrier
    + JDK-8251925: C2: RenaissanceStressTest fails with
    assert(!had_error): bad dominance
    + JDK-8251944: Add Shenandoah test config to
    compiler/gcbarriers/UnsafeIntrinsicsTest.java
    + JDK-8251992: VM crashed running TestComplexAddrExpr.java test
    with -XX:UseAVX=X
    + JDK-8253220: Epsilon: clean up unused code/declarations
    + JDK-8253274: The CycleDMImagetest brokes the system
    + JDK-8253353: Crash in C2: guarantee(n != NULL) failed: No Node
    + JDK-8253368: TLS connection always receives close_notify
    exception
    + JDK-8253404: C2: assert(C-&gt;live_nodes() &lt;=
    C-&gt;max_node_limit()) failed: Live Node limit exceeded limit
    + JDK-8253409: Double-rounding possibility in float fma
    + JDK-8253476: TestUseContainerSupport.java fails on some Linux
    kernels w/o swap limit capabilities
    + JDK-8253524: C2: Refactor code that clones predicates during
    loop unswitching
    + JDK-8253644: C2: assert(skeleton_predicate_has_opaque(iff))
    failed: unexpected
    + JDK-8253681: closed java/awt/dnd/MouseEventAfterStartDragTest/
    /MouseEventAfterStartDragTest.html test failed
    + JDK-8253702: BigSur version number reported as 10.16, should
    be 11.nn
    + JDK-8253756: C2 CompilerThread0 crash in Node::add_req(Node*)
    + JDK-8254104: MethodCounters must exist before nmethod is
    installed
    + JDK-8254734: "dead loop detected" assert failure with patch
    from 8223051
    + JDK-8254748: Bad Copyright header format after JDK-8212218
    + JDK-8254799: runtime/ErrorHandling/
    /TestHeapDumpOnOutOfMemoryError.java fails with release VMs
    + JDK-8255058: C1: assert(is_virtual()) failed: type check
    + JDK-8255351: Add detection for Graviton 2 CPUs
    + JDK-8255368: Math.exp() gives wrong result for large values on
    x86 32-bit platforms
    + JDK-8255387: Japanese characters were printed upside down on
    AIX
    + JDK-8255401: Shenandoah: Allow oldval and newval registers to
    overlap in cmpxchg_oop()
    + JDK-8255479: [aarch64] assert(src-&gt;section_index_of(target) ==
    CodeBuffer::SECT_NONE) failed: sanity
    + JDK-8255544: Create a checked cast
    + JDK-8255559: Leak File Descriptors Because of
    ResolverLocalFilesystem#engineResolveURI()
    + JDK-8255681: print callstack in error case in
    runAWTLoopWithApp
    + JDK-8255734: VM should ignore SIGXFSZ on ppc64, s390 too
    + JDK-8255742: PrintInlining as compiler directive doesn't print
    virtual calls
    + JDK-8255845: Memory leak in imageFile.cpp
    + JDK-8255880: UI of Swing components is not redrawn after their
    internal state changed
    + JDK-8255908: ExceptionInInitializerError due to
    UncheckedIOException while initializing cgroupv1 subsystem
    + JDK-8256025: AArch64: MachCallRuntimeNode::ret_addr_offset()
    is incorrect for stub calls
    + JDK-8256056: Deoptimization stub doesn't save vector registers
    on x86
    + JDK-8256061: RegisterSaver::save_live_registers() omits upper
    halves of ZMM0-15 registers
    + JDK-8256187: [TEST_BUG] Automate bug4275046.java test
    + JDK-8256220: C1: x86_32 fails with -XX:UseSSE=1 after
    JDK-8210764 due to mishandled lir_neg
    + JDK-8256258: some missing NULL checks or asserts after
    CodeCache::find_blob_unsafe
    + JDK-8256264: Printed GlyphVector outline with low DPI has bad
    quality on Windows
    + JDK-8256290: javac/lambda/T8031967.java fails with
    StackOverflowError on x86_32
    + JDK-8256359: AArch64: runtime/ReservedStack/
    /ReservedStackTestCompiler.java fails
    + JDK-8256387: Unexpected result if patching an entire
    instruction on AArch64
    + JDK-8256421: Add 2 HARICA roots to cacerts truststore
    + JDK-8256488: [aarch64] Use ldpq/stpq instead of ld4/st4 for
    small copies in StubGenerator::copy_memory
    + JDK-8256489: Make gtest for long path names on Windows more
    resilient in the presence of virus scanners
    + JDK-8256501: libTestMainKeyWindow fails to build with Xcode
    12.2
    + JDK-8256633: Fix product build on Windows+Arm64
    + JDK-8256682: JDK-8202343 is incomplete
    + JDK-8256751: Incremental rebuild with precompiled header fails
    when touching a header file
    + JDK-8256757: Incorrect MachCallRuntimeNode::ret_addr_offset()
    for CallLeafNoFP on x86_32
    + JDK-8256806: Shenandoah: optimize shenandoah/jni/
    /TestPinnedGarbage.java test
    + JDK-8256807: C2: Not marking stores correctly as mismatched
    in string opts
    + JDK-8256810: Incremental rebuild broken on Macosx
    + JDK-8256818: SSLSocket that is never bound or connected leaks
    socket resources
    + JDK-8256888: Client manual test problem list update
    + JDK-8257083: Security infra test failures caused by
    JDK-8202343
    + JDK-8257408: Bump update version for OpenJDK: jdk-11.0.11
    + JDK-8257423: [PPC64] Support -XX:-UseInlineCaches
    + JDK-8257436: [aarch64] Regressions in ArrayCopyUnalignedDst
    .testByte/testChar for 65-78 bytes when UseSIMDForMemoryOps
    is on
    + JDK-8257513: C2: assert((constant_addr -
    _masm.code()-&gt;consts()-&gt;start()) == con.offset())
    + JDK-8257547: Handle multiple prereqs on the same line in deps
    files
    + JDK-8257561: Some code is not vectorized after 8251925 and
    8250607
    + JDK-8257565: epsilonBarrierSet.hpp should not include
    barrierSetAssembler
    + JDK-8257575: C2: "failed: only phis" assert failure in loop
    strip mining verification
    + JDK-8257594: C2 compiled checkcast of non-null object triggers
    endless deoptimization/recompilation cycle
    + JDK-8257633: Missing -mmacosx-version-min=X flag when linking
    libjvm
    + JDK-8257670: sun/security/ssl/SSLSocketImpl/SSLSocketLeak.java
    reports leaks
    + JDK-8257707: Fix incorrect format string in Http1HeaderParser
    + JDK-8257746: Regression introduced with JDK-8250984 - memory
    might be null in some machines
    + JDK-8257798: [PPC64] undefined reference to
    Klass::vtable_start_offset()
    + JDK-8257884: Re-enable sun/security/ssl/SSLSocketImpl/
    /SSLSocketLeak.java as automatic test
    + JDK-8257910: [JVMCI] Set exception_seen accordingly in the
    runtime.
    + JDK-8257997: sun/security/ssl/SSLSocketImpl/SSLSocketLeak.java
    again reports leaks after JDK-8257884
    + JDK-8257999: Parallel GC crash in gc/parallel/
    /TestDynShrinkHeap.java: new region is not in covered_region
    + JDK-8258077: Using -Xcheck:jni can lead to a double-free after
    JDK-8193234
    + JDK-8258247: Couple of issues in fix for JDK-8249906
    + JDK-8258373: Update the text handling in the JPasswordField
    + JDK-8258396: SIGILL in jdk.jfr.internal.PlatformRecorder
    .rotateDisk()
    + JDK-8258419: RSA cipher buffer cleanup
    + JDK-8258471: "search codecache" clhsdb command does not work
    + JDK-8258534: Epsilon: clean up unused includes
    + JDK-8258805: Japanese characters not entered by mouse click
    on Windows 10
    + JDK-8258833: Cancel multi-part cipher operations in SunPKCS11
    after failures
    + JDK-8258836: JNI local refs exceed capacity
    getDiagnosticCommandInfo
    + JDK-8258884: [TEST_BUG] Convert applet-based test
    open/test/jdk/javax/swing/JMenuItem/8031573/bug8031573.java
    to a regular java test
    + JDK-8259007: This test printed a blank page
    + JDK-8259048: (tz) Upgrade time-zone data to tzdata2020f
    + JDK-8259049: Uninitialized variable after JDK-8257513
    + JDK-8259231: Epsilon: improve performance under contention
    during virtual space expansion
    + JDK-8259271: gc/parallel/TestDynShrinkHeap.java still fails
    "assert(covered_region.contains(new_memregion)) failed: new
    region is not in covered_region"
    + JDK-8259312: VerifyCACerts.java fails as soneraclass2ca cert
    will expire in 90 days
    + JDK-8259319: Illegal package access when SunPKCS11 requires
    SunJCE's classes
    + JDK-8259339: AllocateUninitializedArray C2 intrinsic fails
    with void.class input
    + JDK-8259428: AlgorithmId.getEncodedParams() should return copy
    + JDK-8259446: runtime/jni/checked/
    /TestCheckedReleaseArrayElements.java fails with stderr not
    empty
    + JDK-8259451: Zero: skip serviceability/sa tests, set vm.hasSA
    to false
    + JDK-8259580: Shenandoah: uninitialized label in
    VerifyThreadGCState
    + JDK-8259619: C1: 3-arg StubAssembler::call_RT stack-use
    condition is incorrect
    + JDK-8259633: compiler/graalunit/CoreTest.java fails with NPE
    after JDK-8244543
    + JDK-8259706: C2 compilation fails with assert(vtable_index ==
    Method::invalid_vtable_index) failed: correct sentinel value
    + JDK-8259707: LDAP channel binding does not work with StartTLS
    extension
    + JDK-8259773: Incorrect encoding of AVX-512 kmovq instruction
    + JDK-8259849: Shenandoah: Rename store-val to IU-barrier
    + JDK-8259949: x86 32-bit build fails when -fcf-protection is
    passed in the compiler flags
    + JDK-8259954: gc/shenandoah/mxbeans tests fail with -Xcomp
    + JDK-8260029: aarch64: fix typo in verify_oop_array
    + JDK-8260308: Update LogCompilation junit to 4.13.1
    + JDK-8260338: Some fields in HaltNode is not cloned
    + JDK-8260349: Cannot programmatically retrieve Metaspace max
    set via JAVA_TOOL_OPTIONS
    + JDK-8260356: (tz) Upgrade time-zone data to tzdata2021a
    + JDK-8260378: [TESTBUG] DcmdMBeanTestCheckJni.java reports
    false positive
    + JDK-8260497: Shenandoah: Improve SATB flushing
    + JDK-8260502: [s390] NativeMovRegMem::verify() fails because
    it's too strict
    + JDK-8260632: Build failures after JDK-8253353
    + JDK-8260704: ParallelGC: oldgen expansion needs release-store
    for _end
    + JDK-8261022: Fix incorrect result of Math.abs() with char type
    + JDK-8261089: [TESTBUG] native library of test
    TestCheckedReleaseCriticalArray.java fails to compile with
    gcc 4.x
    + JDK-8261183: Follow on to Make lists of normal filenames
    + JDK-8261209: isStandalone property: remove dependency on
    pretty-print
    + JDK-8261231: Windows IME was disabled after DnD operation
    + JDK-8261251: Shenandoah: Use object size for full GC
    humongous compaction
    + JDK-8261310: PPC64 Zero build fails with
    'VMError::controlled_crash(int)::FunctionDescriptor
    functionDescriptor' has incomplete type and cannot be defined
    + JDK-8261334: NMT: tuning statistic shows incorrect hash
    distribution
    + JDK-8261413: Shenandoah: Disable class-unloading in I-U mode
    + JDK-8261522: [PPC64] AES intrinsics write beyond the
    destination array
    + JDK-8261534: Test sun/security/pkcs11/KeyAgreement/
    /IllegalPackageAccess.java fails on platforms where no nsslib
    artifacts are defined
    + JDK-8261585: Restore HandleArea used in
    Deoptimization::uncommon_trap
    + JDK-8261753: Test java/lang/System/OsVersionTest.java still
    failing on BigSur patch versions after JDK-8253702
    + JDK-8261829: Exclude tools/jlink/JLinkReproducibleTest.java
    in 11u
    + JDK-8261912: Code IfNode::fold_compares_helper more
    defensively
    + JDK-8261920: [AIX] jshell command throws java.io.IOError on
    non English locales
    + JDK-8262018: Wrong format in SAP copyright header of
    OsVersionTest
    + JDK-8263069: Exclude some failing tests from
    security/infra/java/security/cert/CertPathValidator</changelog>
  <changelog author="fstrba@suse.com" date="1620043200">- Remove all Jpackage provides for SLE12 in order to avoid
  installing this package as default Java on SLE12-SP5
  (bsc#1185476)</changelog>
  <changelog author="fstrba@suse.com" date="1621512000">- Modified patch:
  * nss-security-provider.patch
    + make the NSS provider first in the list</changelog>
  <changelog author="fstrba@suse.com" date="1626868800">- Update to upstream tag jdk-11.0.12+7 (July 2021, CPU)
  * Security fixes
    + JDK-8256157: Improve bytecode assembly
    + JDK-8256491: Better HTTP transport
    + JDK-8258432, CVE-2021-2341, bsc#1188564: Improve file
    transfers
    + JDK-8260453: Improve Font Bounding
    + JDK-8260960: Signs of jarsigner signing
    + JDK-8260967, CVE-2021-2369, bsc#1188565: Better jar file
    validation
    + JDK-8262380: Enhance XML processing passes
    + JDK-8262403: Enhanced data transfer
    + JDK-8262410: Enhanced rules for zones
    + JDK-8262477: Enhance String Conclusions
    + JDK-8262967: Improve Zip file support
    + JDK-8264066, CVE-2021-2388, bsc#1188566: Enhance compiler
    validation
    + JDK-8264079: Improve abstractions
    + JDK-8264460: Improve NTLM support
  * Other changes
    + JDK-6847157: java.lang.NullPointerException: HDC for
    component at sun.java2d.loops.Blit.Blit
    + JDK-7106851: Test should not use System.exit
    + JDK-8073446: TimeZone getOffset API does not  return a dst
    offset between years 2038-2137
    + JDK-8076190: Customizing the generation of a PKCS12 keystore
    + JDK-8153005: Upgrade the default PKCS12 encryption/MAC
    algorithms
    + JDK-8171303: sun/java2d/pipe/InterpolationQualityTest.java
    fails on Windows &amp; Linux
    + JDK-8177068: incomplete classpath causes NPE in Flow
    + JDK-8185734: [Windows] Structured Exception Catcher missing
    around gtest execution
    + JDK-8187450: JNI local refs exceeds capacity warning in
    NetworkInterface::getAll
    + JDK-8190763: Class cast exception on (CompoundEdit)
    UndoableEditEvent.getEdit()
    + JDK-8195841: PNGImageReader.readNullTerminatedString() doesnt
    check for non-null terminated strings with length equal to
    maxLen
    + JDK-8196100: javax/swing/text/JTextComponent/5074573/
    /bug5074573.java fails
    + JDK-8199646: JShell tests: jdk/jshell/
    /FailOverDirectExecutionControlTest.java failed with
    java.lang.UnsupportedOperationException
    + JDK-8206925: Support the certificate_authorities extension
    + JDK-8207160: ClassReader::adjustMethodParams can potentially
    return null if the args list is empty
    + JDK-8207247: AARCH64: Enable Minimal and Client VM builds
    + JDK-8207404: MulticastSocket tests failing on AIX
    + JDK-8207779: Method::is_valid_method() compares 'this' with
    NULL
    + JDK-8208061: runtime/LoadClass/TestResize.java fails with
    "Load factor too high" when running in CDS mode.
    + JDK-8209459: TestSHA512MultiBlockIntrinsics failed on AArch64
    + JDK-8210443: Migrate Locale matching tests to JDK Repo.
    + JDK-8213231: ThreadSnapshot::_threadObj can become stale
    + JDK-8213483: ARM32: runtime/ErrorHandling/
    /ShowRegistersOnAssertTest.java jtreg test fail
    + JDK-8213725: JShell NullPointerException due to class file
    with unexpected package
    + JDK-8213794: ARM32: disable TypeProfiling,
    CriticalJNINatives, Serviceablity tests for ARM32
    + JDK-8213845: ARM32: Interpreter doesn't call result handler
    after native calls
    + JDK-8214128: ARM32: wrong stack alignment on
    Deoptimization::unpack_frames
    + JDK-8214512: ARM32: Jtreg test compiler/c2/Test8062950.java
    fails on ARM
    + JDK-8214854: JDWP: Unforseen output truncation in logging
    + JDK-8214922: Add vectorization support for fmin/fmax
    + JDK-8215009: GCC 8 compilation error in libjli
    + JDK-8216184: CDS/appCDS tests failed on Windows due to long
    path to a classlist file
    + JDK-8216259: AArch64: Vectorize Adler32 intrinsics
    + JDK-8216314: SIGILL in CodeHeapState::print_names()
    + JDK-8217348: assert(thread-&gt;is_Java_thread()) failed: just
    checking
    + JDK-8217465: [REDO] - Optimize CodeHeap Analytics
    + JDK-8217561: X86: Add floating-point Math.min/max intrinsics
    + JDK-8217918: C2: -XX:+AggressiveUnboxing is broken
    + JDK-8218458: [TESTBUG] runtime/NMT/
    /CheckForProperDetailStackTrace.java fails with Expected
    stack trace missing from output
    + JDK-8219142: Remove unused JIMAGE_ResourcePath
    + JDK-8219586: CodeHeap State Analytics processes dead nmethods
    + JDK-8220074: Clean up GCC 8.3 errors in LittleCMS
    + JDK-8220407: compiler/intrinsics/math/
    /TestFpMinMaxIntrinsics.java timedout
    + JDK-8222302: [TESTBUG] test/hotspot/jtreg/compiler/intrinsics/
    /sha/cli/TestUseSHAOptionOnUnsupportedCPU.java fails on any
    other CPU
    + JDK-8222412: AARCH64: multiple instructions encoding issues
    + JDK-8223020: aarch64: expand minI_rReg and maxI_rReg patterns
    into separate instructions
    + JDK-8223444: Improve CodeHeap Free Space Management
    + JDK-8223504: Improve performance of forall loops by better
    inlining of "iterator()" methods
    + JDK-8223667: ASAN build broken
    + JDK-8225081: Remove Telia Company CA certificate expiring in
    April 2021
    + JDK-8225116: Test OwnedWindowsLeak.java intermittently fails
    + JDK-8225438: javax/net/ssl/TLSCommon/
    /TestSessionLocalPrincipal.java failed with Read timed out
    + JDK-8225756: [testbug] compiler/loopstripmining/
    /CheckLoopStripMining.java sets too short a
    SafepointTimeoutDelay
    + JDK-8226374: Restrict TLS signature schemes and named groups
    + JDK-8226627: assert(t-&gt;singleton()) failed: must be a constant
    + JDK-8226721: Missing intrinsics for Math.ceil, floor, rint
    + JDK-8227080: (fs) Files.newInputStream(...).skip(n) is slow
    + JDK-8227222: vmTestbase/jit/FloatingPoint/gen_math/Loops04/
    /Loops04.java failed XMM register should be 0-15
    + JDK-8227609: (fs) Files.newInputStream(...).skip(n) should
    allow skipping beyond file size
    + JDK-8230428: Cleanup dead CastIP node code in formssel.cpp
    + JDK-8231460: Performance issue (CodeHeap) with large free
    blocks
    + JDK-8231713: x86_32 build failures after JDK-8226721 (Missing
    intrinsics for Math.ceil, floor, rint)
    + JDK-8231841: AArch64: debug.cpp help() is missing an AArch64
    line for pns
    + JDK-8232084: HotSpot build failed with GCC 9.2.1
    + JDK-8232591: AArch64: Add missing match rules for smaddl,
    smsubl and smnegl
    + JDK-8233185: HttpServer.stop() blocks indefinitely when
    called on dispatch thread
    + JDK-8233787: Break cycle in vm_version* includes
    + JDK-8233948: AArch64: Incorrect mapping between OptoReg and
    VMReg for high 64 bits of Vector Register
    + JDK-8234355: Buffer overflow in jcmd GC.class_stats due to
    too many classes
    + JDK-8235368: Update BCEL to Version 6.4.1
    + JDK-8236859: WebSocket over authenticating proxy fails with
    NPE
    + JDK-8236992: AArch64: remove redundant load_klass in itable
    stub
    + JDK-8237743: test/langtools/jdk/jshell/
    /FailOverExecutionControlTest.java fails No
    ExecutionControlProvider with name 'nonExistent' and parameter
    keys: []
    + JDK-8237804: sun/security/mscapi tests fail with "Key pair
    not generated, alias &lt;nnnnnn&gt; already exists"
    + JDK-8238175: CTW: Class.getDeclaredMethods fails with
    assert(k-&gt;is_subclass_of(SystemDictionary::Throwable_klass()))
    failed: invalid exception class
    + JDK-8238567: SoftMainMixer.processAudioBuffers(): Wrong
    handling of stoppedMixers
    + JDK-8238812: assert(false) failed: bad AD file
    + JDK-8239312: [macos] javax/swing/JFrame/NSTexturedJFrame/
    /NSTexturedJFrame.java
    + JDK-8239386: handle ContendedPaddingWidth in
    vm_version_aarch64
    + JDK-8239536: Can't use 'java.util.List' object after
    importing 'java.awt.List'
    + JDK-8240487: Cleanup whitespace in .cc, .hh, .m, and .mm files
    + JDK-8240848: ArrayIndexOutOfBoundsException buf for
    TextCallbackHandler
    + JDK-8241082: Upgrade IANA Language Subtag Registry data to
    03-16-2020 version
    + JDK-8241087: Build failure with VS 2019 (16.5.0) due to C2039
    and C2873
    + JDK-8241101: [s390] jtreg test failure after JDK-8238696: not
    conformant features string
    + JDK-8241248: NullPointerException in
    sun.security.ssl.HKDF.extract(HKDF.java:93)
    + JDK-8241372: Several test failures due to
    javax.net.ssl.SSLException: Connection reset
    + JDK-8241475: AArch64: Add missing support for PopCountVI node
    + JDK-8241829: Cleanup the code for PrinterJob on windows
    + JDK-8241960: The SHA3 message digests impl of SUN provider
    are not thread safe after cloned
    + JDK-8242010: Upgrade IANA Language Subtag Registry to Version
    2020-04-01
    + JDK-8242429: Better implementation for sign extract
    + JDK-8242557: Add length limit for strings in PNGImageWriter
    + JDK-8242919: Paste locks up jshell
    + JDK-8243155: AArch64: Add support for SqrtVF
    + JDK-8243240: AArch64: Add support for MulVB
    + JDK-8243452: JFR: Could not create chunk in repository with
    over 200 recordings
    + JDK-8243559: Remove root certificates with 1024-bit keys
    + JDK-8243597: AArch64: Add support for integer vector abs
    + JDK-8244031: HttpClient should have more tests for HEAD
    requests
    + JDK-8244205: HTTP/2 tunnel connections through proxy may be
    reused regardless of which proxy is selected
    + JDK-8244847: Linux/PPC: runtime/CompressedOops/
    /CompressedClassPointers: smallHeapTest fails
    + JDK-8245511: G1 adaptive IHOP does not account for
    reclamation of humongous objects by young GC
    + JDK-8246274: G1 old gen allocation tracking is not in a
    separate class
    + JDK-8247354: [aarch64] PopFrame causes
    assert(oopDesc::is_oop(obj)) failed: not an oop
    + JDK-8247408: IdealGraph bit check expression canonicalization
    + JDK-8247432: Update IANA Language Subtag Registry to Version
    2020-09-29
    + JDK-8247438: JShell: When FailOverExecutionControlProvider
    fails the proximal cause is not shown
    + JDK-8247753: UIManager.getSytemLookAndFeelClassName() returns
    wrong value on Fedora 32
    + JDK-8248043: Need to eliminate excessive i2l conversions
    + JDK-8248411: [aarch64] Insufficient error handling when
    CodeBuffer is exhausted
    + JDK-8248568: compiler/c2/TestBit.java failed: test missing
    from stdout/stderr
    + JDK-8248870: AARCH64: I2L/L2I conversions can be skipped for
    masked positive values
    + JDK-8249142: java/awt/FontClass/CreateFont/DeleteFont.sh is
    unstable
    + JDK-8249189: AARCH64: more L2I conversions can be skipped
    + JDK-8249719: MethodHandle performance suffers from bad
    ResolvedMethodTable hash function
    + JDK-8249875: GCC 10 warnings -Wtype-limits with JFR code
    + JDK-8250635: MethodArityHistogram should use Compile_lock in
    favour of fancy checks
    + JDK-8250876: Fix issues with cross-compile on macos
    + JDK-8251031: Some vmTestbase/nsk/monitoring/RuntimeMXBean
    tests fail with hostnames starting from digits
    + JDK-8251525: AARCH64: Faster Math.signum(fp)
    + JDK-8252259: AArch64: Adjust default value of FLOATPRESSURE
    + JDK-8252311: AArch64: save two words in itable lookup stub
    + JDK-8252779: compiler/graalunit/HotspotTest.java failed after
    8251525
    + JDK-8252883: AccessDeniedException caused by delayed file
    deletion on Windows
    + JDK-8253167: ARM32 builds fail after JDK-8247910
    + JDK-8253572: [windows] CDS archive may fail to open with long
    file names
    + JDK-8253923: C2 doesn't always run loop opts for compilations
    that include loops
    + JDK-8253948: Memory leak in ImageFileReader
    + JDK-8254631: Better support ALPN byte wire values in SunJSSE
    + JDK-8254717: isAssignableFrom checks in
    KeyFactorySpi.engineGetKeySpec appear to be backwards
    + JDK-8255086: Update the root locale display names
    + JDK-8255625: AArch64: Implement Base64.encodeBlock
    accelerator/intrinsic
    + JDK-8255763: C2: OSR miscompilation caused by invalid memory
    instruction placement
    + JDK-8255992: JFR EventWriter does not use first string from
    StringPool with id 0
    + JDK-8256037: [TESTBUG] com/sun/jndi/dns/ConfigTests/
    /PortUnreachable.java fails due to the hard coded threshold
    is small
    + JDK-8256244: java/lang/ProcessHandle/PermissionTest.java
    fails with TestNG 7.1
    + JDK-8256287: [windows] add loop fuse to
    map_or_reserve_memory_aligned
    + JDK-8256523: Streamline Java SHA2 implementation
    + JDK-8257414: Drag n Drop target area is wrong on high DPI
    systems
    + JDK-8257569: Failure observed with
    JfrVirtualMemory::initialize
    + JDK-8257574: C2: "failed: parsing found no loops but there
    are some" assert failure
    + JDK-8257580: Bump update version for OpenJDK: jdk-11.0.12
    + JDK-8257604: JNI_ArgumentPusherVaArg leaks valist
    + JDK-8257621: JFR StringPool misses cached items across
    consecutive recordings
    + JDK-8257796: [TESTBUG]
    TestUseSHA512IntrinsicsOptionOnSupportedCPU.java fails
    on x86_32
    + JDK-8257822: C2 crashes with SIGFPE due to a division that
    floats above its zero check
    + JDK-8257828: SafeFetch may crash if invoked in non-JavaThreads
    + JDK-8257853: Remove dependencies on JNF's JNI utility
    functions in AWT and 2D code
    + JDK-8257858: [macOS]: Remove JNF dependency from
    libosxsecurity/KeystoreImpl.m
    + JDK-8257860: [macOS]: Remove JNF dependency from
    libosxkrb5/SCDynamicStoreConfig.m
    + JDK-8257988: Remove JNF dependency from
    libsaproc/MacosxDebuggerLocal.m
    + JDK-8258414: OldObjectSample events too expensive
    + JDK-8258505: [TESTBUG] TestDivZeroWithSplitIf.java fails due
    to missing UnlockDiagnosticVMOptions
    + JDK-8258753: StartTlsResponse.close() hangs due to
    synchronization issues
    + JDK-8259061: C2: assert(found) failed: memory-writing node is
    not placed in its original loop or an ancestor of it
    + JDK-8259227: C2 crashes with SIGFPE due to a division that
    floats above its zero check
    + JDK-8259232: Bad JNI lookup during printing
    + JDK-8259276: C2: Empty expression stack when reexecuting
    tableswitch/lookupswitch instructions after deoptimization
    + JDK-8259343: [macOS] Update JNI error handling in Cocoa code.
    + JDK-8259585: Accessible actions do not work on mac os x
    + JDK-8259651: [macOS] Replace JNF_COCOA_ENTER/EXIT macros
    + JDK-8259662: Don't wrap SocketExceptions into SSLExceptions
    in SSLSocketImpl
    + JDK-8259710: Inlining trace leaks memory
    + JDK-8259729: Missed JNFInstanceOf -&gt; IsInstanceOf conversion
    + JDK-8259777: Incorrect predication condition generated by ADLC
    + JDK-8259786: initialize last parameter of getpwuid_r
    + JDK-8259843: initialize dli_fname array before calling
    dll_address_to_library_name
    + JDK-8259869: [macOS] Remove desktop module dependencies on
    JNF Reference APIs
    + JDK-8259886: Improve SSL session cache performance and
    scalability
    + JDK-8259983: do not use uninitialized expand_ms value in
    G1CollectedHeap::expand_heap_after_young_collection
    + JDK-8260030: Improve stringStream buffer handling
    + JDK-8260236: better init AnnotationCollector _contended_group
    + JDK-8260255: C1: LoopInvariantCodeMotion constructor can
    leave some fields uninitialized
    + JDK-8260284: C2: assert(_base == Int) failed: Not an Int
    + JDK-8260380: Upgrade to LittleCMS 2.12
    + JDK-8260420: C2 compilation fails with assert(found_sfpt)
    failed: no node in loop that's not input to safepoint
    + JDK-8260426: awt debug_mem.c DMem_AllocateBlock might leak
    memory
    + JDK-8260432: allocateSpaceForGP in freetypeScaler.c might
    leak memory
    + JDK-8260616: Removing remaining JNF dependencies in the
    java.desktop module
    + JDK-8260653: Unreachable nodes keep speculative types alive
    + JDK-8260707: java/lang/instrument/PremainClass/
    /InheritAgent0100.java times out
    + JDK-8260925: HttpsURLConnection does not work  with other
    JSSE provider.
    + JDK-8260926: Trace resource exhausted events unconditionally
    + JDK-8261020: Wrong format parameter in
    create_emergency_chunk_path
    + JDK-8261027: AArch64: Support for LSE atomics C++ HotSpot code
    + JDK-8261167: print_process_memory_info add a close call after
    fopen
    + JDK-8261170: Upgrade to freetype 2.10.4
    + JDK-8261198: [macOS] Incorrect JNI parameters in number
    conversion in A11Y code
    + JDK-8261235: C1 compilation fails with
    assert(res-&gt;vreg_number() == index) failed: conversion check
    + JDK-8261261: The version extra fields needs to be overridable
    in jib-profiles.js
    + JDK-8261262: Kitchensink24HStress.java crashed with
    EXCEPTION_ACCESS_VIOLATION
    + JDK-8261354: SIGSEGV at MethodIteratorHost
    + JDK-8261355: No data buffering in SunPKCS11 Cipher encryption
    when the underlying mechanism has no padding
    + JDK-8261397: try catch Method failing to work when dividing
    an integer by 0
    + JDK-8261422: Adjust problematic String.format calls in
    jdk/internal/util/Preconditions.java outOfBoundsMessage
    + JDK-8261447: MethodInvocationCounters frequently run into
    overflow
    + JDK-8261481: Cannot read Kerberos settings in dynamic store
    on macOS Big Sur
    + JDK-8261505: Test test/hotspot/jtreg/gc/parallel/
    /TestDynShrinkHeap.java killed by Linux OOM Killer
    + JDK-8261601: free memory in early return in
    Java_sun_nio_ch_sctp_SctpChannelImpl_receive0
    + JDK-8261649: AArch64: Optimize LSE atomics in C++ code
    + JDK-8261730: C2 compilation fails with
    assert(store-&gt;find_edge(load) != -1) failed: missing
    precedence edge
    + JDK-8261752: Multiple GC test are missing memory requirements
    + JDK-8261791: (sctp) handleSendFailed in SctpChannelImpl.c
    potential leaks
    + JDK-8261812: C2 compilation fails with assert(!had_error)
    failed: bad dominance
    + JDK-8261914: IfNode::fold_compares_helper faces
    non-canonicalized bool when running JRuby JSON workload
    + JDK-8262093: java/util/concurrent/tck/JSR166TestCase.java
    failed "assert(false) failed: unexpected node"
    + JDK-8262110: DST starts from incorrect time in 2038
    + JDK-8262121: [11u] Redo 8244287: JFR: Methods samples have
    line number 0
    + JDK-8262163: Extend settings printout in jcmd VM.metaspace
    + JDK-8262295: C2: Out-of-Bounds Array Load from Clone Source
    + JDK-8262298: G1BarrierSetC2::step_over_gc_barrier fails with
    assert "bad barrier shape"
    + JDK-8262446: DragAndDrop hangs on Windows
    + JDK-8262461: handle wcstombsdmp return value correctly in
    unix awt_InputMethod.c
    + JDK-8262465: Very long compilation times and high memory
    consumption in C2 debug builds
    + JDK-8262726: AArch64: C1 StubAssembler::call_RT can corrupt
    stack
    + JDK-8262739: String inflation C2 intrinsic prevents insertion
    of anti-dependencies
    + JDK-8262829: Native crash in
    Win32PrintServiceLookup.getAllPrinterNames()
    + JDK-8262837: handle split_USE correctly
    + JDK-8262900: ToolBasicTest fails to access HTTP server it
    starts
    + JDK-8263260: [s390] Support latest hardware (z14 and z15)
    + JDK-8263311: Watch registry changes for remote printers
    update instead of polling
    + JDK-8263361: Incorrect arraycopy stub selected by C2 for SATB
    collectors
    + JDK-8263404: RsaPrivateKeySpec is always recognized as
    RSAPrivateCrtKeySpec in RSAKeyFactory.engineGetKeySpec
    + JDK-8263425: AArch64: two potential bugs in C1
    LIRGenerator::generate_address()
    + JDK-8263448: CTW: fatal error: meet not symmetric
    + JDK-8263504: Some OutputMachOpcodes fields are uninitialized
    + JDK-8263557: Possible NULL dereference in
    Arena::destruct_contents()
    + JDK-8263558: Possible NULL dereference in fast path arena
    free if ZapResourceArea is true
    + JDK-8263676: AArch64: one potential bug in C1
    LIRGenerator::generate_address()
    + JDK-8263729: [test] divert spurious output away from stream
    under test in ProcessBuilder Basic test
    + JDK-8263846: Bad JNI lookup getFocusOwner in accessibility
    code on Mac OS X
    + JDK-8264047: Duplicate global variable 'jvm' in libjavajpeg
    and libawt
    + JDK-8264096: slowdebug jvm crashes when StrInflatedCopy match
    rule is not supported
    + JDK-8264151: ciMethod::ensure_method_data() should return
    false is loading resulted in empty state
    + JDK-8264173: [s390] Improve Hardware Feature Detection And
    Reporting
    + JDK-8264190: Harden TLS interop tests
    + JDK-8264223: CodeHeap::verify fails extra_hops assertion in
    fastdebug test
    + JDK-8264328: Broken license in
    javax/swing/JComboBox/8072767/bug8072767.java
    + JDK-8264360: Loop strip mining verification fails with
    "should be on the backedge"
    + JDK-8264626: C1 should be able to inline excluded methods
    + JDK-8264640: CMS ParScanClosure misses a barrier
    + JDK-8264786: [macos] All Swing/AWT apps cause Allow
    Notifications prompt to appear when app is launched
    + JDK-8264821: DirectIOTest fails on a system with large block
    size
    + JDK-8264848: [macos] libjvm.dylib linker warning due to macOS
    version mismatch
    + JDK-8264923: PNGImageWriter.write_zTXt throws Exception with
    a typo
    + JDK-8264958: C2 compilation fails with assert "n is later
    than its clone"
    + JDK-8265099: Revert backport to 11u of 8236859: WebSocket
    over authenticating proxy fails with NPE
    + JDK-8265154: vinserti128 operand mix up for KNL platforms
    + JDK-8265239: Shenandoah: Shenandoah heap region count could
    be off by 1
    + JDK-8265417: Backport of JDK-8249672 breaks Solaris x86 build
    + JDK-8265421: java/lang/String/StringRepeat.java test is
    missing a memory requirement
    + JDK-8265462: Handle multiple slots in the NSS Internal Module
    from SunPKCS11's Secmod
    + JDK-8265537: x86 version string truncated after JDK-8249672
    11u backport
    + JDK-8265666: Enable AIX build platform to make external debug
    symbols
    + JDK-8265677: CMS: CardTableBarrierSet::write_ref_array_work()
    lacks storestore barrier
    + JDK-8265690: Use the latest Ubuntu base image version in
    Docker testing
    + JDK-8265718: Build failure after JDK-8258414 11u backport
    + JDK-8265750: Fatal error in safepoint.cpp after backport of
    8258414
    + JDK-8265784: [C2] Hoisting of DecodeN leaves MachTemp inputs
    behind
    + JDK-8265938: C2's conditional move optimization does not
    handle top Phi
    + JDK-8266220: keytool still prompt for store password on a
    password-less pkcs12 file if -storetype pkcs12 is specified
    + JDK-8266293: Key protection using PBEWithMD5AndDES fails with
    "java.security.InvalidAlgorithmParameterException: Salt must
    be 8 bytes long"
    + JDK-8266713: [AIX] Build failure after 11u backport of
    JDK-8247753
    + JDK-8266802: Shenandoah: Round up region size to page size
    unconditionally
    + JDK-8266892: avoid maybe-uninitialized gcc warnings on linux
    s390x
    + JDK-8266929: Unable to use algorithms from 3p providers
    + JDK-8267235: [macos_aarch64]
    InterpreterRuntime::throw_pending_exception messing up LR
    results in crash
    + JDK-8267561: Shenandoah: Reference processing not properly
    setup for outside of cycle degenerated GC
    + JDK-8267599: Revert the change to the default PKCS12
    macAlgorithm and macIterationCount props for 11u/8u/7u
    + JDK-8267641: [11u] 8227609 backport typo
    + JDK-8267721: Enable sun/security/pkcs11 tests for Amazon
    Linux 2 AArch64
    + JDK-8268678: LetsEncryptCA.java test fails as Let's Encrypt
    Authority X3 is retired</changelog>
  <changelog author="schwab@suse.de" date="1628078400">- riscv64-zero.patch: Add support for riscv64 (zero VM)</changelog>
  <changelog author="fstrba@suse.com" date="1629979200">- Added patch:
  * jdk11-glibc234.patch
    + fix build with glibc-2.34 (bsc#1189201)</changelog>
  <changelog author="fstrba@suse.com" date="1631534400">- Modified patch:
  * nss-security-provider.patch
    + revert recent changes making NSS provider the default one
    + fixes bsc#1190252</changelog>
  <changelog author="fstrba@suse.com" date="1631793600">- Added patch:
  * fips.patch
    + implement FIPS support in OpenJDK</changelog>
  <changelog author="fstrba@suse.com" date="1634817600">- Update to upstream tag jdk-11.0.13+8 (October 2021 CPU)
  * Security fixes
    + JDK-8163326, CVE-2021-35550, bsc#1191901: Update the default
    enabled cipher suites preference
    + JDK-8254967, CVE-2021-35565, bsc#1191909:
    com.sun.net.HttpsServer spins on TLS session close
    + JDK-8263314: Enhance XML Dsig modes
    + JDK-8265167, CVE-2021-35556, bsc#1191910: Richer Text Editors
    + JDK-8265574: Improve handling of sheets
    + JDK-8265580, CVE-2021-35559, bsc#1191911: Enhanced style for
    RTF kit
    + JDK-8265776: Improve Stream handling for SSL
    + JDK-8266097, CVE-2021-35561, bsc#1191912: Better hashing
    support
    + JDK-8266103: Better specified spec values
    + JDK-8266109: More Resilient Classloading
    + JDK-8266115: More Manifest Jar Loading
    + JDK-8266137, CVE-2021-35564, bsc#1191913: Improve Keystore
    integrity
    + JDK-8266689, CVE-2021-35567, bsc#1191903: More Constrained
    Delegation
    + JDK-8267086: ArrayIndexOutOfBoundsException in
    java.security.KeyFactory.generatePublic
    + JDK-8267712: Better LDAP reference processing
    + JDK-8267729, CVE-2021-35578, bsc#1191904: Improve TLS client
    handshaking
    + JDK-8267735, CVE-2021-35586, bsc#1191914: Better BMP support
    + JDK-8268193: Improve requests of certificates
    + JDK-8268199: Correct certificate requests
    + JDK-8268205: Enhance DTLS client handshake
    + JDK-8268506: More Manifest Digests
    + JDK-8269618, CVE-2021-35603, bsc#1191906: Better session
    identification
    + JDK-8269624: Enhance method selection support
    + JDK-8270398: Enhance canonicalization
    + JDK-8270404: Better canonicalization
  * Other changes
    + JDK-8024368: private methods are allocated vtable indices
    + JDK-8042902: Test java/net/Inet6Address/serialize/
    /Inet6AddressSerializationTest.java fails intermittently
    + JDK-8140466: ChaCha20 and Poly1305 TLS Cipher Suites
    + JDK-8157404: Unable to read certain PKCS12 keystores from
    SequenceInputStream
    + JDK-8158066: SourceDebugExtensionTest fails to rename file
    + JDK-8168304: Make all of DependencyContext_test available in
    product mode
    + JDK-8169246: java/net/DatagramSocket/ReportSocketClosed.java
    fails intermittently with BindException
    + JDK-8181313: SA: Remove libthread_db dependency on Linux
    + JDK-8193214: Incorrect annotations.without.processors
    warnings with JDK 9
    + JDK-8194230: jdk/internal/jrtfs/remote/
    /RemoteRuntimeImageTest.java fails with
    java.lang.NullPointerException
    + JDK-8196092: javax/swing/JComboBox/8032878/bug8032878.java
    fails
    + JDK-8199931: java/net/MulticastSocket/
    /UnreferencedMulticastSockets.java fails with "incorrect data
    received"
    + JDK-8206083: Make tools/javac/api/T6265137.java robust to JDK
    version changes
    + JDK-8206350: java/util/Locale/bcp47u/SystemPropertyTests.java
    failed on Mac 10.13 with zh_CN and zh_TW locales.
    + JDK-8207316: java/nio/channels/spi/SelectorProvider/
    /inheritedChannel/InheritedChannelTest.java failed
    + JDK-8208227: tools/jdeps/DotFileTest.java fails on Win-X64
    + JDK-8208363: test/jdk/java/lang/Package/
    /PackageFromManifest.java missing module dependencies
    declaration
    + JDK-8209380: ARM: cleanup maybe-uninitialized and reorder
    compiler warnings
    + JDK-8209768: Refactor java/util/prefs/CheckUserPrefsStorage.sh
    to plain java test
    + JDK-8209772: Refactor shell test java/util/ServiceLoader/
    /basic/basic.sh to java
    + JDK-8209773: Refactor shell test javax/naming/module/basic.sh
    to java
    + JDK-8209832: Refactor jdk/internal/reflect/Reflection/
    /GetCallerClassTest.sh to plain java test
    + JDK-8209930: Refactor java/util/zip/ZipFile/deletetempjar.sh
    to plain java test
    + JDK-8210406: Refactor java.util.PluggableLocale:i18n shell
    tests to plain java tests
    + JDK-8210407: Refactor java.util.Calendar:i18n shell tests to
    plain java tests
    + JDK-8210495: compiler crashes because of illegal signature in
    otherwise legal code
    + JDK-8210669: Some launcher tests assume a pre-JDK 9 run-time
    image layout
    + JDK-8210802: temp files left by tests in
    jdk/java/net/httpclient
    + JDK-8210819: Update the host name in CNameTest.java
    + JDK-8210908: Refactor java/util/prefs/PrefsSpi.sh to plain
    java test
    + JDK-8210934: Move sun/net/www/protocol/http/
    /GetErrorStream.java to OpenJDK
    + JDK-8210959: JShell fails and exits when statement throws an
    exception whose message contains a '%'.
    + JDK-8211055: Provide print to a file (PDF) feature even when
    printer was not connected
    + JDK-8211092: test/jdk/sun/net/www/http/HttpClient/
    /MultiThreadTest.java fails intermittently when cleaning up
    + JDK-8211296: Remove HotSpot deprecation warning suppression
    for Mac/clang
    + JDK-8211325: test/jdk/java/net/Socket/LingerTest.java fails
    with cleaning up
    + JDK-8212040: Compilation error due to wrong usage of
    NSPrintJobDispositionValue in mac10.12
    + JDK-8212695: Add explicit timeout to several HTTP Client tests
    + JDK-8212718: Refactor some annotation processor tests to
    better use collections
    + JDK-8213007: Update the link in test/jdk/sun/security/
    /provider/SecureRandom/DrbgCavp.java
    + JDK-8213137: Remove static initialization of monitor/mutex
    instances
    + JDK-8213235: java/nio/channels/SocketChannel/
    /AsyncCloseChannel.java fails with threads that didn't exit
    + JDK-8213409: Refactor sun.text.IntHashtable:i18n shell tests
    to plain java tests
    + JDK-8213576: Make test AsyncCloseChannel.java run in othervm
    + JDK-8213694: Test Timeout.java should run in othervm mode
    + JDK-8213718: [TEST] Wrong classname in vmTestbase/nsk/stress/
    /except/except002 and except003
    + JDK-8213922: fix ctw stand-alone build
    + JDK-8214195: Align stdout messages in
    test/jdk/java/math/BigInteger/PrimitiveConversionTests.java
    + JDK-8214520: [TEST_BUG] sun/security/mscapi/nonUniqueAliases/
    /NonUniqueAliases.java failed with incorrect jtreg tags order
    + JDK-8214937: sun/security/tools/jarsigner/warnings/
    /NoTimestampTest.java failed due to unexpected expiration date
    + JDK-8216532: tools/launcher/Test7029048.java fails (Solaris)
    + JDK-8217825: Verify @AfterTest is used correctly in WebSocket
    tests
    + JDK-8218145: block_if_requested is not proper inlined due to
    size
    + JDK-8219417: bump jtreg requiredVersion to b14
    + JDK-8219552: bump jtreg requiredVersion to b14 in
    test/jdk/sanity/client/
    + JDK-8219804: java/net/MulticastSocket/Promiscuous.java fails
    intermittently due to NumberFormatException
    + JDK-8220445: Support for side by side MSVC Toolset versions
    + JDK-8221988: add possibility to build with Visual Studio 2019
    + JDK-8222751: closed/test/jdk/sun/security/util/
    /DerIndefLenConverter/IndefBerPkcs12.java fail
    + JDK-8223050: JVMCI: findUniqueConcreteMethod() should not use
    Dependencies::find_unique_concrete_method() for non-virtual
    methods
    + JDK-8224853: CDS address sanitizer errors
    + JDK-8225082: Remove IdenTrust certificate that is expiring in
    September 2021
    + JDK-8225583: Examine the HttpResponse.BodySubscribers for
    null handling and multiple subscriptions
    + JDK-8225690: Multiple AttachListener threads can be created
    + JDK-8225790: Two NestedDialogs tests fail on Ubuntu
    + JDK-8226319: Add forgotten test/jdk/java/net/httpclient/
    /BodySubscribersTest.java
    + JDK-8226533: JVMCI: findUniqueConcreteMethod should handle
    statically bindable methods directly
    + JDK-8226602: Test convenience reactive primitives from
    java.net.http with RS TCK
    + JDK-8226683: Remove review suggestion from fix to 8219804
    + JDK-8227738: jvmti/DataDumpRequest/datadumpreq001 failed due
    to "exit code is 134"
    + JDK-8227766: CheckUnhandledOops is broken in MemAllocator
    + JDK-8227815: Minimal VM: set_state is not a member of
    AttachListener
    + JDK-8230674: Heap dumps should exclude dormant CDS archived
    objects of unloaded classes
    + JDK-8230808: Remove Access::equals()
    + JDK-8230841: Remove oopDesc::equals()
    + JDK-8231717: Improve performance of charset decoding when
    charset is always compactable
    + JDK-8232243: Wrong caret position in JTextPane on Windows
    with a screen resolution &gt; 100%
    + JDK-8232782: Shenandoah: streamline post-LRB CAS barrier
    (aarch64)
    + JDK-8233790: Forward output from heap dumper to jcmd/jmap
    + JDK-8233989: Create an IPv4 version of
    java/net/MulticastSocket/SetLoopbackMode.java
    + JDK-8234510: Remove file seeking requirement for writing a
    heap dump
    + JDK-8235211: serviceability/attach/
    /RemovingUnixDomainSocketTest.java fails with
    AttachNotSupportedException: Unable to open socket file
    + JDK-8235216: typo in test filename
    + JDK-8235866: bump jtreg requiredVersion to 4.2b16
    + JDK-8236111: narrow allowSmartActionArgs disabling
    + JDK-8236413: AbstractConnectTimeout should tolerate both
    NoRouteToHostException and UnresolvedAddressException
    + JDK-8236671: NullPointerException in JKS keystore
    + JDK-8238930: problem list compiler/c2/Test8004741.java
    + JDK-8238943: switch to jtreg 5.0
    + JDK-8240555: Using env of JAVA_TOOL_OPTIONS and _JAVA_OPTIONS
    breaks QuietOption.java test
    + JDK-8240983: Incorrect copyright header in Apache Santuario
    2.1.3 files
    + JDK-8241336: Some java.net tests failed with
    NoRouteToHostException on MacOS with special network
    configuration
    + JDK-8241353: NPE in ToolProvider.getSystemJavaCompiler
    + JDK-8241768: git needs .gitattributes
    + JDK-8242882: opening jar file with large manifest might throw
    NegativeArraySizeException
    + JDK-8244973: serviceability/attach/
    /RemovingUnixDomainSocketTest.java fails "stderr was not
    empty"
    + JDK-8245134: test/lib/jdk/test/lib/security/
    /KeyStoreUtils.java should allow to specify aliases
    + JDK-8246261: TCKLocalTime.java failed due to "AssertionError:
    expected [18:14:22] but found [18:14:23]"
    + JDK-8246387: switch to jtreg 5.1
    + JDK-8247421: [TESTBUG] ReturnBlobToWrongHeapTest.java failed
    allocating blob
    + JDK-8247469: getSystemCpuLoad() returns -1 on linux when some
    offline cpus are present and cpusets.effective_cpus is not
    available
    + JDK-8248352: [TEST_BUG] Test test/jdk/java/awt/font/
    /TextLayout/ArabicDiacriticTest.java can leave frame open
    + JDK-8248403: AArch64: Remove uses of kernel integer types
    + JDK-8248414: AArch64: Remove uses of long and unsigned long
    ints
    + JDK-8248657: Windows: strengthening in ThreadCritical
    regarding memory model
    + JDK-8248666: AArch64: Use THREAD_LOCAL instead of __thread
    + JDK-8248668: AArch64: Avoid MIN/MAX macros when using MSVC
    + JDK-8248671: AArch64: Remove unused variables
    + JDK-8248682: AArch64: Use ATTRIBUTE_ALIGNED helper
    + JDK-8248816: C1: Fix signature conflict in
    LIRGenerator::strength_reduce_multiply
    + JDK-8249095: tools/javac/launcher/SourceLauncherTest.java
    fails on Windows
    + JDK-8249548: backward focus traversal gets stuck in button
    group
    + JDK-8249773: Upgrade ReceiveISA.java test to be resilient to
    failure due to stray packets and interference
    + JDK-8249897: jdk/javadoc/tool/LangVers.java uses @ignore w/o
    bug-id
    + JDK-8249898: jdk/javadoc/tool/6176978/T6176978.java uses
    @ignore w/o bug-id
    + JDK-8249899: jdk/javadoc/tool/InlineTagsWithBraces.java uses
    @ignore w/o bug-id
    + JDK-8250588: Shenandoah: LRB needs to save/restore fp
    registers for runtime call
    + JDK-8250824: AArch64: follow up for JDK-8248414
    + JDK-8251166: Add automated testcases for changes done in
    JDK-8214112
    + JDK-8251252: Add automated testcase for fix done in
    JDK-8214253
    + JDK-8251254: Add automated test for fix done in JDK-8218472
    + JDK-8251361: Potential race between Logger configuration and
    GCs in HttpURLConWithProxy test
    + JDK-8251549: Update docs on building for Git
    + JDK-8251945: SIGSEGV in
    PackageEntry::purge_qualified_exports()
    + JDK-8252194: Add automated test for fix done in JDK-8218469
    + JDK-8252648: Shenandoah: name gang tasks consistently
    + JDK-8252825: Add automated test for fix done in JDK-8218479
    + JDK-8252853: AArch64: gc/shenandoah/TestVerifyJCStress.java
    fails intermittently with C1
    + JDK-8252857: AArch64: Shenandoah C1 CAS is not sequentially
    consistent
    + JDK-8253048: AArch64: When CallLeaf, no need to preserve
    callee-saved registers in caller
    + JDK-8253424: Add support for running pre-submit testing using
    GitHub Actions
    + JDK-8253631: Remove unimplemented CompileBroker methods after
    JEP-165
    + JDK-8253865: Pre-submit testing using GitHub Actions does not
    detect failures reliably
    + JDK-8253899: Make IsClassUnloadingEnabled signature match
    specification
    + JDK-8254024: Enhance native libs for AWT and Swing to work
    with GraalVM Native Image
    + JDK-8254054: Pre-submit testing using GitHub Actions should
    not use the deprecated set-env command
    + JDK-8254173: Add Zero, Minimal hotspot targets to submit
    workflow
    + JDK-8254175: Build no-pch configuration in debug mode for
    submit checks
    + JDK-8254244: Some code emitted by TemplateTable::branch is
    unused when running TieredCompilation
    + JDK-8254270: linux 32 bit build doesn't compile
    libjdwp/log_messages.c
    + JDK-8254282: Add Linux x86_32 builds to submit workflow
    + JDK-8254850: Update terminology in java.awt.GridBagLayout
    source code comments
    + JDK-8255255: Update Apache Santuario (XML Signature) to
    version 2.2.1
    + JDK-8255305: Add Linux x86_32 tier1 to submit workflow
    + JDK-8255352: Archive important test outputs in submit workflow
    + JDK-8255373: Submit workflow artifact name is always
    "test-results_.zip"
    + JDK-8255452: Doing GC during JVMTI MethodExit event posting
    breaks return oop
    + JDK-8255718: Zero: VM should know it runs in interpreter-only
    mode
    + JDK-8255790: GTKL&amp;F: Java 16 crashes on initialising GTKL&amp;F
    on Manjaro Linux
    + JDK-8255810: Zero: build fails without JVMTI
    + JDK-8255895: Submit workflow artifacts miss hs_errs/replays
    due to ZIP include mismatch
    + JDK-8256127: Add cross-compiled foreign architectures builds
    to submit workflow
    + JDK-8256215: Shenandoah: re-organize saving/restoring machine
    state in assembler code
    + JDK-8256267: Relax compiler/floatingpoint/NaNTest.java for
    x86_32 and lower -XX:+UseSSE
    + JDK-8256277: Github Action build on macOS should define OS
    and Xcode versions
    + JDK-8256354: Github Action build on Windows should define OS
    and MSVC versions
    + JDK-8256393: Github Actions build on Linux should define OS
    and GCC versions
    + JDK-8256414: add optimized build to submit workflow
    + JDK-8256747: GitHub Actions: decouple the hotspot build-only
    jobs from Linux x64 testing
    + JDK-8257056: Submit workflow should apt-get update to avoid
    package installation errors
    + JDK-8257148: Remove obsolete code in AWTView.m
    + JDK-8257497: Update keytool to create AKID from the SKID of
    the issuing certificate as specified by RFC 5280
    + JDK-8257620: Do not use objc_msgSend_stret to get macOS
    version
    + JDK-8257913: Add more known library locations to simplify
    Linux cross-compilation
    + JDK-8258703: Incorrect 512-bit vector registers restore on
    x86_32
    + JDK-8259338: Add expiry exception for identrustdstx3 alias to
    VerifyCACerts.java test
    + JDK-8259535: ECDSA SignatureValue do not always have the
    specified length
    + JDK-8259679: GitHub actions should use MSVC 14.28
    + JDK-8259924: GitHub actions fail on Linux x86_32 with "Could
    not configure libc6:i386"
    + JDK-8260460: GitHub actions still fail on Linux x86_32 with
    "Could not configure libc6:i386"
    + JDK-8260589: Crash in JfrTraceIdLoadBarrier::load(_jclass*)
    + JDK-8260923: Add more tests for SSLSocket input/output
    shutdown
    + JDK-8261072: AArch64: Fix MacroAssembler::get_thread
    convention
    + JDK-8261147: C2: Node is wrongly marked as reduction
    resulting in a wrong execution due to wrong vector instructions
    + JDK-8261238: NMT should not limit baselining by size threshold
    + JDK-8261496: Shenandoah: reconsider pacing updates memory
    ordering
    + JDK-8261652: Remove some dead comments from os_bsd_x86
    + JDK-8261846: [JVMCI] c2v_iterateFrames can get out of sync
    with the StackFrameStream
    + JDK-8262000: jdk/jfr/event/gc/detailed/
    /TestPromotionFailedEventWithParallelScavenge.java failed with
    "OutOfMemoryError: Java heap space"
    + JDK-8262017: C2: assert(n != __null) failed: Bad immediate
    dominator info.
    + JDK-8262392: Update Mesa 3-D Headers to version 21.0.3
    + JDK-8262409: sun/security/ssl/SSLSocketImpl/
    /SSLSocketImplThrowsWrongExceptions. SSL test failures caused
    by java failed with "Server reported the wrong exception"
    + JDK-8262470: Printed GlyphVector outline with low DPI has bad
    quality on Windows
    + JDK-8262862: Harden tests sun/security/x509/URICertStore/
    /ExtensionsWithLDAP.java and krb5/canonicalize/Test.java
    + JDK-8263136: C4530 was reported from VS 2019 at access bridge
    + JDK-8263227: C2: inconsistent spilling due to dead nodes in
    exception block
    + JDK-8263382: java/util/logging/ParentLoggersTest.java failed
    with "checkLoggers: getLoggerNames() returned unexpected
    loggers"
    + JDK-8263407: SPARC64 detection fails on Athena (SPARC64-X)
    + JDK-8263432: javac may report an invalid package/class clash
    on case insensitive filesystems
    + JDK-8263490: [macos] Crash occurs on JPasswordField with
    activated InputMethod
    + JDK-8263531: Remove unused buffer int
    + JDK-8263667: Avoid running GitHub actions on branches named
    pr/*
    + JDK-8263776: [JVMCI] add helper to perform Java upcalls
    + JDK-8264016: [JVMCI] add some thread local fields for use by
    JVMCI
    + JDK-8264752: SIGFPE crash with option
    FlightRecorderOptions:threadbuffersize=30M
    + JDK-8265132: C2 compilation fails with assert "missing
    precedence edge"
    + JDK-8265231: (fc) ReadDirect and WriteDirect tests fail after
    fix for JDK-8264821
    + JDK-8265335: Epsilon: Minor typo in EpsilonElasticTLABDecay
    description
    + JDK-8265756: AArch64: initialize memory allocated for locals
    according to Windows AArch64 stack page growth requirement in
    template interpreter
    + JDK-8265761: Font with missed font family name is not
    properly printed on Windows
    + JDK-8265773: incorrect jdeps message "jdk8internals" to
    describe a removed JDK internal API
    + JDK-8265836: OperatingSystemImpl.getCpuLoad() returns
    incorrect CPU load inside a container
    + JDK-8266018: Shenandoah: fix an incorrect assert
    + JDK-8266206: Build failure after JDK-8264752 with older GCCs
    + JDK-8266248: Compilation failure in
    PLATFORM_API_MacOSX_MidiUtils.c with Xcode 12.5
    + JDK-8266288: assert root method not found in
    witnessed_reabstraction_in_supers is too strong
    + JDK-8266404: Fatal error report generated with
  - XX:+CrashOnOutOfMemoryError should not contain suggestion to
    submit a bug report
    + JDK-8266480: Implicit null check optimization does not update
    control of hoisted memory operation
    + JDK-8266615: C2 incorrectly folds subtype checks involving an
    interface array
    + JDK-8266642: Improve ResolvedMethodTable hash function
    + JDK-8266749: AArch64: Backtracing broken on PAC enabled
    systems
    + JDK-8266761: AssertionError in
    sun.net.httpserver.ServerImpl.responseCompleted
    + JDK-8266813: Shenandoah: Use shorter instruction sequence for
    checking if marking in progress
    + JDK-8267042: bug in monitor locking/unlocking on ARM32 C1 due
    to uninitialized BasicObjectLock::_displaced_header
    + JDK-8267348: Rewrite gc/epsilon/TestClasses.java to use
    Metaspace with less classes
    + JDK-8267396: Avoid recording "pc" in unhandled oops detector
    for better performance
    + JDK-8267399: C2: java/text/Normalizer/ConformanceTest.java
    test failed with assertion
    + JDK-8267424: CTW: C1 fails with "State must not be null"
    + JDK-8267459: Pasting Unicode characters into JShell does not
    work.
    + JDK-8267625: AARCH64: typo in LIR_Assembler::emit_profile_type
    + JDK-8267666: Add option to jcmd GC.heap_dump to use existing
    file
    + JDK-8267695: Bump update version for OpenJDK: jdk-11.0.13
    + JDK-8267751: (test) jtreg.SkippedException has no serial
    VersionUID
    + JDK-8267773: PhaseStringOpts::int_stringSize doesn't handle
    min_jint correctly
    + JDK-8268103: JNI functions incorrectly return a double after
    JDK-8265836
    + JDK-8268127: Shenandoah: Heap size may be too small for
    region to align to large page size
    + JDK-8268261: C2: assert(n != __null) failed: Bad immediate
    dominator info.
    + JDK-8268347: C2: nested locks optimization may create
    unbalanced monitor enter/exit code
    + JDK-8268360: Missing check for infinite loop during node
    placement
    + JDK-8268362: [REDO] C2 crash when compile negative
    Arrays.copyOf length after loop
    + JDK-8268366: Incorrect calculation of has_fpu_registers in C1
    linear scan
    + JDK-8268369: SIGSEGV in PhaseCFG::implicit_null_check due to
    missing null check
    + JDK-8268417: Add test from JDK-8268360
    + JDK-8268427: Improve AlgorithmConstraints:checkAlgorithm
    performance
    + JDK-8268617: [11u REDO] - WebSocket over authenticating proxy
    fails with NPE
    + JDK-8268620: InfiniteLoopException test may fail on x86
    platforms
    + JDK-8268635: Corrupt oop in ClassLoaderData
    + JDK-8268699: Shenandoah: Add test for JDK-8268127
    + JDK-8268771: javadoc -notimestamp option does not work on
    index.html
    + JDK-8268775: Password is being converted to String in
    AccessibleJPasswordField
    + JDK-8268776: Test `ADatagramSocket.java` missing /othervm
    from @run tag
    + JDK-8268965: TCP Connection Reset when connecting simple
    socket to SSL server
    + JDK-8269304: Regression ~5% in 2005 in b27
    + JDK-8269415: [11u] Remove ea from
    DEFAULT_PROMOTED_VERSION_PRE in OpenJDK 11u
    + JDK-8269478: Shenandoah: gc/shenandoah/mxbeans tests should
    be more resilient
    + JDK-8269529: javax/swing/reliability/
    /HangDuringStaticInitialization.java fails in Windows debug
    build
    + JDK-8269594: assert(_handle_mark_nesting &gt; 1) failed: memory
    leak: allocating handle outside HandleMark
    + JDK-8269614: [s390] Interpreter checks wrong bit for slow
    path instance allocation
    + JDK-8269650: Optimize gc-locker in
    [Get|Release]StringCritical for latin string
    + JDK-8269661: JNI_GetStringCritical does not lock char array
    + JDK-8269668: [aarch64] java.library.path not including
    /usr/lib64
    + JDK-8269763: The JEditorPane is blank after JDK-8265167
    + JDK-8269795: C2: Out of bounds array load floats above its
    range check in loop peeling resulting in SEGV
    + JDK-8269847: JDK-8269594 backport breaks 11u builds
    + JDK-8269850: Most JDK releases report macOS version 12 as
    10.16 instead of 12.0
    + JDK-8269851: OperatingSystemMXBean getProcessCpuLoad reports
    incorrect process cpu usage in containers
    + JDK-8269882: stack-use-after-scope in NewObjectA
    + JDK-8269934: RunThese24H.java failed with
    EXCEPTION_ACCESS_VIOLATION in
    java_lang_Thread::get_thread_status
    + JDK-8270096: Shenandoah: Optimize gc/shenandoah/
    /TestRefprocSanity.java for interpreter mode
    + JDK-8270137: Kerberos Credential Retrieval from Cache not
    Working in Cross-Realm Setup
    + JDK-8270184: [TESTBUG] Add coverage for jvmci
    ResolvedJavaType.toJavaName() for lambdas
    + JDK-8270196: [11u] [JVMCI] JavaType.toJavaName() returns
    incorrect type name for lambdas
    + JDK-8270556: Exclude security/infra/java/security/cert/
    /CertPathValidator/certification/LetsEncryptCA
    + JDK-8270893: IndexOutOfBoundsException while reading large
    TIFF file
    + JDK-8272078: Wrong Checksums in Temurin BootJDK dependencies
    + JDK-8272124: Cgroup v1 initialization causes
    NullPointerException when cgroup path contains colon
    + JDK-8272131: PhaseMacroExpand::generate_slow_arraycopy crash
    when clone null CallProjections.fallthrough_ioproj
    + JDK-8272197: Update 11u GHA workflow with Shenandoah
    configurations
    + JDK-8272332: --with-harfbuzz=system doesn't add -lharfbuzz
    after JDK-8255790
    + JDK-8272472: StackGuardPages test doesn't build with glibc
    2.34
    + JDK-8272602: [macos] not all KEY_PRESSED events sent when
    control modifier is used
    + JDK-8272628: Problemlist gc/stress/gcbasher/
    /TestGCBasherWithCMS.java for x86_32
    + JDK-8272700: [macos] Build failure with Xcode 13.0 after
    JDK-8264848
    + JDK-8272772: Shenandoah: compiler/c2/aarch64/
    /TestVolatilesShenandoah.java fails in 11u
    + JDK-8273939: Backport of 8248414 to JDK11 breaks
    MacroAssembler::adrp
- Remove the unneeded icedtea-sound provider
- Removed patches:
  * icedtea-sound-1.0.1-jdk9.patch
  * icedtea-sound-soundproperties.patch
    + not needed since the icedtea-sound provider is removed
  * jdk11-glibc234.patch
    + integrated upstream</changelog>
  <changelog author="fstrba@suse.com" date="1635940800">- Modified patches:
  * system-crypto-policy.patch
    + rediff to changed context
  * fips.patch
    + Allow plain key import in fips mode unless
    com.suse.fips.plainKeySupport is set to false</changelog>
  <changelog author="fstrba@suse.com" date="1636113600">- Modified patch:
  * fips.patch
    + return in native code after generating java.io.IOException</changelog>
</package>
<package pkgid="a023462b667043771a4c5800810c787ef3d9f465c792bd47a1e326aad5043e1e" name="java-11-openjdk-demo" arch="s390x">
  <version epoch="0" ver="11.0.13.0" rel="3.68.1"/>
  <changelog author="fstrba@suse.com" date="1586952000">- The pack200 and unpack200 alternatives should be slaves of java
  and not of javac, since they are part of JRE.</changelog>
  <changelog author="fstrba@suse.com" date="1587470400">- Update to upstream tag jdk-11.0.7+10 (April 2020 CPU,
  bsc#1169511)
  * Security fixes:
    + S8223898, CVE-2020-2754: Forward references to Nashorn
    + S8223904, CVE-2020-2755: Improve Nashorn matching
    + S8224541, CVE-2020-2756: Better mapping of serial ENUMs
    + S8224549, CVE-2020-2757: Less Blocking Array Queues
    + S8225603: Enhancement for big integers
    + S8226346: Build better binary builders
    + S8227467: Better class method invocations
    + S8227542: Manifest improved jar headers
    + S8229733: TLS message handling improvements
    + S8231415, CVE-2020-2773: Better signatures in XML
    + S8231785: Improved socket permissions
    + S8232424, CVE-2020-2778: More constrained algorithms
    + S8232581, CVE-2020-2767: Improve TLS verification
    + S8233250: Better X11 rendering
    + S8233410: Better Build Scripting
    + S8234027: Better JCEKS key support
    + S8234408, CVE-2020-2781: Improve TLS session handling
    + S8234825, CVE-2020-2800: Better Headings for HTTP Servers
    + S8234841, CVE-2020-2803: Enhance buffering of byte buffers
    + S8235274, CVE-2020-2805: Enhance typing of methods
    + S8235691, CVE-2020-2816: Enhance TLS connectivity
    + S8236201, CVE-2020-2830: Better Scanner conversions
    + S8238960: linux-i586 builds are inconsistent as the newly
    built jdk is not able to reserve enough space for object heap
  * Other changes:
    + S4919790: Errors in alert ssl message does not reflect the
    actual certificate status
    + S4949105: Access Bridge lacks html tags parsing
    + S7092821: java.security.Provider.getService() is synchronized
    and became scalability bottleneck
    + S7143743: Potential memory leak with zip provider
    + S8005819: Support cross-realm MSSFU
    + S8042383: [TEST_BUG] Test javax/swing/plaf/basic/BasicMenuUI/
    /4983388/bug4983388.java fails with shortcuts on menus do not
    work
    + S8068184: Fix for JDK-8032832 caused a deadlock
    + S8145845: [AOT] NullPointerException in
    compiler/whitebox/GetCodeHeapEntriesTest.java
    + S8152988: [AOT] Update test batch definitions to include
    aot-ed java.base module mode into hs-comp testing
    + S8160926: FLAGS_COMPILER_CHECK_ARGUMENTS doesn't handle
    cross-compilation
    + S8163083: SocketListeningConnector does not allow invocations
    with port 0
    + S8163251: Hard coded loop limit prevents reading of smart
    card data greater than 8k
    + S8167276: jvmci/compilerToVM/MaterializeVirtualObjectTest.java
    fails with -XX:-EliminateAllocations
    + S8169718: nsk/jdb/locals/locals002: ERROR: Cannot find
    boolVar with expected value: false
    + S8176556:
    java/awt/dnd/ImageTransferTest/ImageTransferTest.java fails
    for JFIF
    + S8178798: Two compiler/aot/verification/vmflags tests fail by
    timeout with UseAVX=3
    + S8183107: PKCS11 regression regarding checkKeySize
    + S8185005: Improve performance of
    ThreadMXBean.getThreadInfo(long ids[], int maxDepth)
    + S8189633: Missing -Xcheck:jni checking for DeleteWeakGlobalRef
    + S8189861: Refactor CacheFind
    + S8193042: NativeLookup::lookup_critical_entry() should only
    load shared library once
    + S8193596: java/net/DatagramPacket/ReuseBuf.java failed due to
    timeout
    + S8194944: Regression automated test 'open/test/jdk/javax/
    /swing/JInternalFrame/8145896/TestJInternalFrameMaximize.java'
    fails
    + S8196467: javax/swing/JInternalFrame/Test6325652.java fails
    + S8196969: JTreg Failure: serviceability/sa/ClhsdbJstack.java
    causes NPE
    + S8198321: javax/swing/JEditorPane/5076514/bug5076514.java
    fails
    + S8198398: Test javax/swing/JColorChooser/Test6199676.java
    fails in mach5
    + S8199072: Test javax/swing/GroupLayout/6613904/
    /bug6613904.java is unstable
    + S8200432: javadoc fails with ClassCastException on {@link
    byte[]}
    + S8201349: build broken when configured with
  - -with-zlib=bundled on gcc 7.3
    + S8201355: Avoid native memory allocation in
    sun.security.mscapi.PRNG.generateSeed
    + S8201513: nsk/jvmti/IterateThroughHeap/filter-* are broken
    + S8203364: Some serviceability/sa/ tests intermittently fail
    with java.io.IOException: LingeredApp terminated with non-zero
    exit code 3
    + S8203687: javax/net/ssl/compatibility/Compatibility.java
    supports TLS 1.3
    + S8203904: javax/swing/JSplitPane/4816114/bug4816114.java: The
    divider location is wrong
    + S8203911: Test runtime/modules/getModuleJNI/GetModule fails
    with -Xcheck:jni
    + S8204525: [TESTBUG] runtime/NMT/MallocStressTest.java ran out
    of java heap
    + S8204529: gc/TestAllocateHeapAtMultiple.java fail with Agent
    7 timed out
    + S8204551: Event descriptions are truncated in logs
    + S8206963: [AOT] bug with multiple class loaders
    + S8207367: 10 vmTestbase/nsk/jdi tests timed out when running
    with jtreg
    + S8207832: serviceability/sa/ClhsdbCDSCore.java failed with
    "Couldn't find core file location"
    + S8207938: At step6,Click Add button,case failed automatically.
    + S8208157: requires.VMProps throws NPE for missing properties
    in "release" file
    + S8208379: compiler/jvmci/events/
    /JvmciNotifyInstallEventTest.java failed with "Got unexpected
    event count after 2nd install attempt: expected 9 to equal 2"
    + S8208658: Make CDS archived heap regions usable even if
    compressed oop encoding has changed
    + S8208715: Conversion of milliseconds to nanoseconds in
    UNIXProcess contains bug
    + S8209361: [AOT] Unexpected number of references for
    JVMTI_HEAP_REFERENCE_CONSTANT_POOL [111--&gt;111]: 0 (expected
    at least 1)
    + S8209385: CDS runtime classpath checking is too strict when
    only classes from the system modules are archived
    + S8209389: SIGSEGV in WalkOopAndArchiveClosure::do_oop_work.
    + S8209418: Synchronize test/jdk/sanity/client/lib/jemmy with
    code-tools/jemmy/v2
    + S8209494: Create a test for SwingSet InternalFrameDemo
    + S8209499: Create test for SwingSet EditorPaneDemo
    + S8209574: [AOT] breakpoint events are generated in different
    threads does not meet expected count
    + S8209686: cleanup arguments to PhaseIdealLoop() constructor
    + S8209789: Synchronize test/jdk/sanity/client/lib/jemmy with
    code-tools/jemmy/v2
    + S8209802: Garbage collectors should register JFR types
    themselves to avoid build errors.
    + S8209807: improve handling exception in requires.VMProps
    + S8209817: stack is executable when building with Clang on
    Linux
    + S8209824: Improve the code coverage for ThreadLocal
    + S8209826: Undefined reference to os::write after JDK-8209657
    (filemap.hpp cleanup)
    + S8209850: Allow NamedThreads to use GlobalCounter critical
    sections
    + S8209976: Improve iteration over non-JavaThreads
    + S8209993: Create a test for SwingSet3 ToolTipDemo
    + S8210024: JFR calls virtual is_Java_thread from ~Thread()
    + S8210052: Enable testing for all the available look and feels
    in SwingSet3 demo tests
    + S8210055: Enable different look and feel tests in SwingSet3
    demo tests
    + S8210057: Enable different look and feels in SwingSet3 demo
    test InternalFrameDemoTest
    + S8210058: Algorithmic Italic font leans opposite angle in
    Printing
    + S8210220: [AOT] jdwp test cases are failing with error #
    ERROR: TEST FAILED: Cought IOException while receiving event
    packet
    + S8210289: ArchivedKlassSubGraphInfoRecord is incomplete
    + S8210459: Add support for generating compile_commands.json
    + S8210476: sun/security/mscapi/PrngSlow.java fails with Still
    too slow
    + S8210512: [Testbug] vmTestbase/nsk/jdi/ObjectReference/
    /referringObjects/referringObjects002/referringObjects002.java
    fails with unexpected size of
    ClassLoaderReference.referringObjects
    + S8210523: runtime/appcds/cacheObject/DifferentHeapSizes.java
    crash
    + S8210632: Add key exchange algorithm to
    javax/net/ssl/TLSCommon/CipherSuite.java
    + S8210699: Problem list tests which times out in Xcomp mode
    + S8210793: [JVMCI] AllocateCompileIdTest.java failed to find
    DiagnosticCommand.class
    + S8210910: Create test for FileChooserDemo
    + S8210994: Create test for SwingSet3 FrameDemo
    + S8211139: Increase timeout value in all tests under
    jdk/sanity/client/SwingSet/src
    + S8211160: Handle different look and feels in
    JInternalFrameOperator
    + S8211211: vmTestbase/metaspace/stressDictionary/
    /StressDictionary.java timeout
    + S8211322: Reduce the timeout of tooltip in SwingSet2DemoTest
    + S8211443: Enable different look and feels in SwingSet3 demo
    test SplitPaneDemoTest
    + S8211703: JInternalFrame : java.lang.AssertionError: cannot
    find the internal frame
    + S8211781: re-building fails after changing Graal sources
    + S8212897: Some improvements in the EditorPaneDemotest
    + S8212903: [TestBug] Tests test/jdk/javax/swing/LookAndFeel/
    /8145547/DemandGTK2.sh and DemandGTK3.sh fail on Ubuntu 18.04
    LTS
    + S8213009: Refactoring existing SunMSCAPI classes
    + S8213010: Supporting keys created with certmgr.exe
    + S8213168: Enable different look and feel tests in SwingSet3
    demo test FileChooserDemoTest
    + S8213348: jdk.internal.vm.compiler.management service
    providers missing in module descriptor
    + S8213906: Update arm devkits with libXrandr headers
    + S8213908: AssertionError in DeferredAttr at setOverloadKind
    + S8214124: [TESTBUG] Bugs in runtime/NMT/MallocStressTest.java
    + S8214344: C2: assert(con.basic_type() != T_ILLEGAL) failed:
    elembt=byte; loadbt=void; unsigned=0
    + S8214345: infinite recursion while checking super class
    + S8214471: Enable different look and feel tests in SwingSet3
    demo test ToolTipDemoTest
    + S8214534: Setting of THIS_FILE in the build is broken
    + S8214557: Filter out VM flags which don't affect AOT code
    generation
    + S8214578: [macos] Problem with backslashes on macOS/JIS
    keyboard: Java ignores system settings
    + S8214840: runtime/NMT/MallocStressTest.java timed out
    + S8214850: Rename vm_operations.?pp files to vmOperations.?pp
    files
    + S8214904: Test8004741.java failed due to "Too few ThreadDeath
    hits; expected at least 6 but saw only 5"
    + S8215322: add @file support to jaotc
    + S8215355: Object monitor deadlock with no threads holding the
    monitor (using jemalloc 5.1)
    + S8215396: JTabbedPane preferred size calculation is wrong for
    SCROLL_TAB_LAYOUT
    + S8216180: [AOT] compiler/intrinsics/bigInteger/TestMulAdd.java
    crashed with AOT enabled
    + S8216353: Use utility APIs introduced in org/netbeans/jemmy/
    /util/LookAndFeel class in client sanity test cases
    + S8216354: Syntax error in toolchain_windows.m4
    + S8216472: (se) Stack overflow during selection operation
    leads to crash (win)
    + S8216535: tools/jimage/JImageExtractTest.java timed out
    + S8217235: Create automated test for SwingSet
    ColorChooserDemoTest
    + S8217297: Add support for multiple look and feel for SwingSet
    SliderDemoTest
    + S8217338: [Containers] Improve systemd slice memory limit
    support
    + S8217613: [AOT] TEST_OPTS_AOT_MODULES doesn't work on mac
    + S8217634: RunTest documentation and usability update
    + S8217717: ZGC: Broken oop map in C1 load barrier stub
    + S8217728: Speed up incremental rerun of "make hotspot"
    + S8218268: Javac treats Manifest Class-Path entries as Paths
    instead of URLs
    + S8218662: Allow 204 responses with Content-Length:0
    + S8218882: NET_Writev is declared, NET_WriteV is defined
    + S8218889: Improperly use of the Optional API
    + S8219205: JFR file without license header
    + S8219597: (bf) Heap buffer state changes could provoke
    unexpected exceptions
    + S8219723: javax/net/ssl/compatibility/Compatibility.java
    failed on some SNI cases
    + S8220348: [ntintel] asserts about copying unaligned array
    + S8220451: jdi/EventQueue/remove/remove004 failed due to
    "ERROR: thread2 is not alive"
    + S8220456: jdi/EventQueue/remove_l/remove_l004 failed due to
    "TIMEOUT while waiting for event"
    + S8220479: java/nio/channels/Selector/SelectWithConsumer.java
    failed at testTwoChannels()
    + S8220613: java/util/Arrays/TimSortStackSize2.java times out
    with fastdebug build
    + S8220688: [TESTBUG] runtime/NMT/MallocStressTest.java timed
    out
    + S8220786: Create new switch to redirect error reporting
    output to stdout or stderr
    + S8221270: Duplicated synchronized keywords in SSLSocketImpl
    + S8221312: test/jdk/sanity/client/SwingSet/src/
    /ColorChooserDemoTest.java failed
    + S8221851: Use of THIS_FILE in hotspot invalidates precompiled
    header on Linux/GCC
    + S8221885: Add intermittent test in the JavaSound to the
    ProblemList
    + S8222264: Windows incremental build is broken with JDK-8217728
    + S8222391: javax/net/ssl/compatibility/Compatibility.java
    should be more flexible
    + S8222448: java/lang/reflect/PublicMethods/
    /PublicMethodsTest.java times out
    + S8222519: ButtonDemoScreenshotTest fails randomly with "still
    state to be reached"
    + S8222741: jdi/EventQueue/remove/remove004 fails due to
    VMDisconnectedException
    + S8223003: SunMSCAPI keys are not cleaned up
    + S8223063: Support CNG RSA keys
    + S8223158: Docked MacBook cannot start any Java Swing
    applications
    + S8223260: NamingManager should cache InitialContextFactory
    + S8223464: Improve version string for Oracle CI builds
    + S8223558: Java does not render Myanmar script correctly
    + S8223627: jdk-13+20 bundle name contains null instead of ea
    + S8223638: Replace wildcard address with loopback or local
    host in tests - part 6
    + S8223678: Add Visual Studio Code workspace generation support
    (for native code)
    + S8223727: com/sun/jndi/ldap/privconn/RunTest.java failed due
    to hang in LdapRequest.getReplyBer
    + S8223769: Assert triggers with -XX:+StressReflectiveCode
    + S8224187: Refactor arraycopy_prologue to allow ZGC read
    barriers on arraycopy
    + S8224475: JTextPane does not show images in HTML rendering
    + S8224673: Adjust permission for delayed starting of debugging
    + S8224705: Tests that need to be problem-listed or have
    printer resources
    + S8224778: test/jdk/demo/jfc/J2Ddemo/J2DdemoTest.java cannot
    find J2Ddemo.jar
    + S8224821: java/awt/Focus/NoAutotransferToDisabledCompTest/
    /NoAutotransferToDisabledCompTest.java fails linux-x64
    + S8224830: test/jdk/java/awt/Focus/
    /ModalExcludedWindowClickTest/
    /ModalExcludedWindowClickTest.java fails on linux-x64
    + S8224851: AArch64: fix warnings and errors with Clang and GCC
    8.3
    + S8224905: java/lang/ProcessBuilder/Basic.java#id1 failed with
    stream closed
    + S8225007: java/awt/print/PrinterJob/
    /LandscapeStackOverflow.java may hang
    + S8225105: java/awt/Focus/ShowFrameCheckForegroundTest/
    /ShowFrameCheckForegroundTest.java fails in Windows 10
    + S8225117: java/math/BigInteger/SymmetricRangeTests.java fails
    with ParseException
    + S8225128: Add exception for expiring DocuSign root to
    VerifyCACerts test
    + S8225130: Add exception for expiring Comodo roots to
    VerifyCACerts test
    + S8225144: [macos] In Aqua L&amp;F backspace key does not delete
    when Shift is pressed
    + S8225180: SignedObject with invalid Key not throwing the
    InvalidKeyException in Windows
    + S8225182: JNI exception pending in DestroyXIMCallback of
    awt_InputMethod.c:1327
    + S8225199: [Graal] compiler/jvmci/compilerToVM/
    /IsMatureVsReprofileTest.java fails with
  - XX:CompileThresholdScaling=0.1
    + S8225305: ProblemList java/lang/invoke/VarHandles tests
    + S8225350: compiler/jvmci/compilerToVM/IsCompilableTest.java
    timed out
    + S8225430: Replace wildcard address with loopback or local
    host in tests - part 14
    + S8225435: Upgrade IANA Language Subtag Registry to the latest
    for JDK14
    + S8225487: giflib legal file is missing attribution for
    openbsd-reallocarray.c
    + S8225567: Wrong file headers with 8202414 fix changeset
    + S8225684: [AOT] vmTestbase/vm/oom/production/
    /AlwaysOOMProduction tests fail with AOTed java.base
    + S8225766: Curve in certificate should not affect signature
    scheme when using TLSv1.3
    + S8225797: OldObjectSample event creates unexpected amount of
    checkpoint data
    + S8226381: ProblemList java/lang/reflect/PublicMethods/
    /PublicMethodsTest.java
    + S8226406: JVM fails to detect mismatched or corrupt CDS
    archive
    + S8226608: Hide the onjcmd option from the help output
    + S8226892: ActionListeners on JRadioButtons don't get notified
    when selection is changed with arrow keys
    + S8227112: exclude compiler/intrinsics/sha/sanity tests from
    AOT runs
    + S8227324: Upgrade to freetype 2.10.1
    + S8227528: TestAbortVMOnSafepointTimeout.java failed due to
    "RuntimeException: 'Safepoint sync time longer than' missing
    from stdout/stderr"
    + S8227645: Some tests in serviceability/sa run with fixed -Xmx
    values and risk running out of memory
    + S8227646: [TESTBUG] appcds/SharedArchiveConsistency timed out
    + S8227662: freetype seeks to index at the end of the font data
    + S8228479: Correct the format of ColorChooserDemoTest
    + S8228613: java.security.Provider#getServices order is no
    longer deterministic
    + S8228969: 2019-09-28 public suffix list update
    + S8229236: CriticalJNINatives: dll handling should be done in
    native thread state
    + S8229345: Memory leak due to vtable stubs not being shared on
    SPARC
    + S8229888: (zipfs) Updating an existing zip file does not
    preserve original permissions
    + S8229994: assert(false) failed: Bad graph detected in
    get_early_ctrl_for_expensive
    + S8230004: jdk/internal/jimage/JImageOpenTest.java runs no test
    + S8230235: Rendering HTML with empty img attribute and
    documentBaseKey cause Exception
    + S8230390: Problemlist SA tests with AOT
    + S8230400: Missing constant pool entry for a method in
    stacktrace
    + S8230459: Test failed to resume JVMCI CompilerThread
    + S8230480: check malloc/calloc results in java.desktop
    + S8230597: Update GIFlib library to the 5.2.1
    + S8230611: infinite loop in
    LogOutputList::wait_until_no_readers()
    + S8230624: [TESTBUG] Problemlist JFR
    compiler/TestCodeSweeper.java
    + S8230677: Should disable Escape Analysis if JVMTI capability
    can_get_owned_monitor_info was taken
    + S8230926: [macosx] Two apostrophes are entered instead of one
    with "U.S. International - PC" layout
    + S8231025: Incorrect method tag offset for big endian platform
    + S8231081: TestMetadataRetention fails due to missing symbol id
    + S8231387: java.security.Provider.getService returns random
    result due to race condition with mutating methods in the same
    class
    + S8231430: C2: Memory stomp in max_array_length() for
    T_ILLEGAL type
    + S8231445: check ZALLOC return values in awt coding
    + S8231507: Update Apache Santuario (XML Signature) to version
    2.1.4
    + S8231584: Deadlock with ClassLoader.findLibrary and
    System.loadLibrary call
    + S8231753: use more Posix functionality in aix
    os::print_os_info
    + S8231810: javax/net/ssl/templates/
    /SSLSocketSSLEngineTemplate.java fails intermittently with
    "java.lang.Exception: Unexpected EOF"
    + S8232003: (fs) Files.write can leak file descriptor in the
    exception case
    + S8232056: GetOwnedMonitorInfoWithEATest.java fails with ZGC:
    Heap too small
    + S8232060: add some initializations using sigemptyset in
    os_aix.cpp
    + S8232154: Update Mesa 3-D Headers to version 19.2.1
    + S8232167: Visual Studio install found through
  - -with-tools-dir value is discarded
    + S8232170: FSInfo#getJarClassPath throws an exception not
    declared in its throws clause
    + S8232200: [macos 10.15] Windows in fullscreen tests jumps
    around the screen
    + S8232207: Linux os::available_memory re-reads cgroup
    configuration on every invocation
    + S8232224: [TESTBUG] problemlist JFR TestLargeRootSet.java
    + S8232370: Refactor some com.sun.jdi tests to enable IDE
    integration
    + S8232433: [macos 10.15] java/awt/Window/
    /LocationAtScreenCorner/LocationAtScreenCorner.java may fail
    + S8232571: Add missing SIGINFO signal
    + S8232692: [TESTBUG] compiler/aot/fingerprint/
    /SelfChangedCDS.java fails when cds is disabled
    + S8232713: Update BCEL version to 6.3.1 in license file
    + S8232806: Introduce a system property to disable eager lambda
    initialization
    + S8232834: RunTest sometimes fails to produce valid
    exitcode.txt
    + S8232880: Update test documentation with additional settings
    for client UI tooltip tests
    + S8232950: SUNPKCS11 Provider incorrectly check key length for
    PSS Signatures.
    + S8233018: Add a new test to verify that DatagramSocket is not
    interruptible
    + S8233019: java.lang.Class.isPrimitive() (C1) returns wrong
    result if Klass* is aligned to 32bit
    + S8233032: assert(in_bb(n)) failed: must be
    + S8233078: fix minimal VM build on Linux ppc64(le)
    + S8233328: fix minimal VM build on Linux s390x
    + S8233383: Various minor fixes
    + S8233466: aarch64: remove unnecessary load of mdo when
    profiling return and parameters type
    + S8233491: Crash in AdapterHandlerLibrary::get_adapter with
    CDS due to code cache exhaustion
    + S8233529: loopTransform.cpp:2984: Error: assert(p_f-&gt;Opcode()
    == Op_IfFalse) failed
    + S8233548: Update CUP to v0.11b
    + S8233649: Update ProblemList.txt to exclude failing headful
    tests on macos
    + S8233656: assert(d-&gt;is_CFG() &amp;&amp; n-&gt;is_CFG()) failed: must
    have CFG nodes
    + S8233657: Intermittent NPE in Component.validate()
    + S8234288: Turkey Time Zone returns incorrect time zone name
    + S8234323: NULL-check return value of SurfaceData_InitOps on
    macosx
    + S8234339: replace JLI_StrTok in java_md_solinux.c
    + S8234340: Bump update version for OpenJDK: jdk-11.0.7
    + S8234350: assert(mode == ControlAroundStripMined &amp;&amp; (use ==
    sfpt || !use-&gt;is_reachable_from_root())) failed: missed a node
    + S8234386: [macos] NPE was thrown at expanding Choice from
    maximized frame
    + S8234397: add OS uptime information to os::print_os_info
    output
    + S8234423: Modifying ArrayList.subList().subList() resets
    modCount of subList
    + S8234466: Class loading deadlock involving
    X509Factory#commitEvent()
    + S8234501: remove obsolete NET_ReadV
    + S8234525: enable link-time section-gc for linux s390x to
    remove unused code
    + S8234610: MaxVectorSize set wrongly when UseAVX=3 is
    specified after JDK-8221092
    + S8234617: C1: Incorrect result of field load due to missing
    narrowing conversion
    + S8234723: javax/net/ssl/TLS tests support TLSv1.3
    + S8234724: javax/net/ssl/templates/
    /SSLSocketSSLEngineTemplate.java supports TLSv1.3
    + S8234741: enhance os::get_core_path on macOS
    + S8234769: Duplicate attribution in freetype.md
    + S8234786: Fix for JDK-8214578 breaks OS X 10.12 compatibility
    + S8234809: set relro in linker flags when building with gcc
    + S8234824: java/nio/channels/SocketChannel/AdaptSocket.java
    fails on Windows 10
    + S8235243: handle VS2017 15.9 and VS2019 in abstract_vm_version
    + S8235288: AVX 512 instructions inadvertently used on Xeon for
    small vector width operations
    + S8235325: build failure on Linux after 8235243
    + S8235383: C1 compilation fails with
  - XX:+PrintIRDuringConstruction -XX:+Verbose
    + S8235489: handle return values of sscanf calls in hotspot
    + S8235509: Backport for JDK-8209657 Refactor filemap.hpp to
    simplify integration with Serviceability Agent.
    + S8235510: java.util.zip.CRC32 performance drop after 8200067
    + S8235563: [TESTBUG] appcds/CommandLineFlagComboNegative.java
    does not handle archive mapping failure
    + S8235637: jhsdb jmap from OpenJDK 11.0.5 doesn't work if
    prelink is enabled
    + S8235671: enhance print_rlimit_info in os_posix
    + S8235744: PIT: test/jdk/javax/swing/text/html/
    /TestJLabelWithHTMLText.java times out in linux-x64
    + S8235904: Infinite loop when rendering huge lines
    + S8235998: [c2] Memory leaks during tracing after '8224193:
    stringStream should not use Resource Area'.
    + S8236039: JSSE Client does not accept status_request
    extension in CertificateRequest messages for TLS 1.3
    + S8236140: assert(!VerifyHashTableKeys || _hash_lock == 0)
    failed: remove node from hash table before modifying it
    + S8236179: C1 register allocation error with T_ADDRESS
    + S8236488: Support for configure option
  - -with-native-debug-symbols=internal is impossible on Windows
    + S8236500: Windows ucrt.dll should be looked up in versioned
    WINSDK subdirectory
    + S8236709: struct SwitchRange in HS violates C++ One
    Definition Rule
    + S8236848: [JDK 11u] make run-test-tier1 fails after backport
    of JDK-8232834
    + S8236873: Worker has a deadlock bug
    + S8237217: Incorrect G1StringDedupEntry type used in
    StringDedupTable destructor
    + S8237368: Problem with NullPointerException in RMI
    TCPEndpoint.read
    + S8237375: SimpleThresholdPolicy misses CounterDecay timestamp
    initialization
    + S8237508: Simplify JarFile.isInitializing
    + S8237540: Missing files in backport of JDK-8210910
    + S8237541: Missing files in backport of JDK-8236528
    + S8237600: Test SunJSSEFIPSInit fails on Ubuntu
    + S8237819: s390x - remove unused pd_zero_to_words_large
    + S8237869: exclude jtreg test security/infra/java/security/
    /cert/CertPathValidator/certification/LuxTrustCA.java because
    of instabilities
    + S8237879: make 4.3 breaks build
    + S8237945: CTW: C2 compilation fails with
    assert(just_allocated_object(alloc_ctl) == ptr) failed: most
    recent allo...
    + S8238225: Issues reported after replacing symlink at
    Contents/MacOS/libjli.dylib with binary
    + S8238247: CTW runner should sweep nmethods more aggressively
    + S8238366: CTW runner closes standard output on exit
    + S8238438: SuperWord::co_locate_pack picks memory state of
    first instead of last load
    + S8238502: sunmscapi.dll causing EXCEPTION_ACCESS_VIOLATION
    + S8238534: Deep sign macOS bundles before bundle archive is
    being created
    + S8238591: CTW: Split
    applications/ctw/modules/jdk_localedata.java
    + S8238596: AVX enabled by default for Skylake even when
    unsupported
    + S8238811: C2: assert(i &gt;= req() || i == 0 || is_Region() ||
    is_Phi()) with -XX:+VerifyGraphEdges
    + S8239005: [TESTBUG] test/hotspot/jtreg/runtime/
    /StackGuardPages/TestStackGuardPages.java: exeinvoke.c: must
    initialize static state before calling do_overflow()
    + S8239466: Loss of precision in counter decay calculation in
    11u backport of JDK-8237375
    + S8239856: [ntintel] asserts about copying unaligned array
    element
    + S8240724: [test] jdk11 downport of 8224475 misses binary file
    test/jdk/javax/swing/JTextPane/arrow.png
    + S8241296: Segfault in JNIHandleBlock::oops_do()
- Removed patch:
  * DependOnVariableHelper.patch
    + fixed upstream
- Added patch:
  * JDK-8228407.patch
    + fix crashes due to shared archive file mismatch</changelog>
  <changelog author="fstrba@suse.com" date="1594900800">- Update to upstream tag jdk-11.0.8+10 (July 2020 CPU, bsc#1174157)
  * Security fixes:
    + JDK-8230613: Better ASCII conversions
    + JDK-8231800: Better listing of arrays
    + JDK-8232014: Expand DTD support
    + JDK-8233234: Better Zip Naming
    + JDK-8233239, CVE-2020-14562: Enhance TIFF support
    + JDK-8233255: Better Swing Buttons
    + JDK-8234032: Improve basic calendar services
    + JDK-8234042: Better factory production of certificates
    + JDK-8234418: Better parsing with CertificateFactory
    + JDK-8234836: Improve serialization handling
    + JDK-8236191: Enhance OID processing
    + JDK-8236867, CVE-2020-14573: Enhance Graal interface handling
    + JDK-8237117, CVE-2020-14556: Better ForkJoinPool behavior
    + JDK-8237592, CVE-2020-14577: Enhance certificate verification
    + JDK-8238002, CVE-2020-14581: Better matrix operations
    + JDK-8238013: Enhance String writing
    + JDK-8238804: Enhance key handling process
    + JDK-8238842: AIOOBE in GIFImageReader.initializeStringTable
    + JDK-8238843: Enhanced font handing
    + JDK-8238920, CVE-2020-14583: Better Buffer support
    + JDK-8238925: Enhance WAV file playback
    + JDK-8240119, CVE-2020-14593: Less Affine Transformations
    + JDK-8240482: Improved WAV file playback
    + JDK-8241379: Update JCEKS support
    + JDK-8241522: Manifest improved jar headers redux
    + JDK-8242136, CVE-2020-14621: Better XML namespace handling
  * Other changes:
    + JDK-6933331: (d3d/ogl) java.lang.IllegalStateException:
    Buffers have not been created
    + JDK-7124307: JSpinner and changing value by mouse
    + JDK-8022574: remove HaltNode code after uncommon trap calls
    + JDK-8039082: [TEST_BUG] Test
    java/awt/dnd/BadSerializationTest/BadSerializationTest.java
    fails
    + JDK-8040630: Popup menus and tooltips flicker with previous
    popup contents when first shown
    + JDK-8044365: (dc) MulticastSendReceiveTests.java failing with
    ENOMEM when joining group (OS X 10.9)
    + JDK-8048215: [TESTBUG]
    java/lang/management/ManagementFactory/ThreadMXBeanProxy.java
    Expected non-null LockInfo
    + JDK-8051349: nsk/jvmti/scenarios/sampling/SP06/sp06t003 fails
    in nightly
    + JDK-8080353: JShell: Better error message on attempting to
    add default method
    + JDK-8139876: Exclude hanging nsk/stress/stack from execution
    with deoptimization enabled
    + JDK-8146090: java/lang/ref/ReachabilityFenceTest.java fails
    with -XX:+DeoptimizeALot
    + JDK-8153430: jdk regression test MletParserLocaleTest,
    ParserInfiniteLoopTest reduce default timeout
    + JDK-8156207: Resource allocated BitMaps are often cleared
    unnecessarily
    + JDK-8159740: JShell: corralled declarations do not have
    correct source to wrapper mapping
    + JDK-8175984: ICC_Profile has un-needed, not-empty finalize
    method
    + JDK-8176359: Frame#setMaximizedbounds not working properly in
    multi screen environments
    + JDK-8183369: RFC unconformity of HttpURLConnection with proxy
    + JDK-8187078: -XX:+VerifyOops finds numerous problems when
    running JPRT
    + JDK-8189861: Refactor CacheFind
    + JDK-8191169: java/net/Authenticator/B4769350.java failed
    intermittently
    + JDK-8191930: [Graal] emits unparseable XML into compile log
    + JDK-8193879: Java debugger hangs on method invocation
    + JDK-8196019: java/awt/Window/Grab/GrabTest.java fails on
    Windows
    + JDK-8196181: sun/java2d/GdiRendering/InsetClipping.java fails
    + JDK-8198000:
    java/awt/List/EmptyListEventTest/EmptyListEventTest.java
    debug assert on Windows
    + JDK-8198001: java/awt/Menu/WrongParentAfterRemoveMenu/
    /WrongParentAfterRemoveMenu.java debug assert on Windows
    + JDK-8198339: Test javax/swing/border/Test6981576.java is
    unstable
    + JDK-8200701: jdk/jshell/ExceptionsTest.java fails on Windows,
    after JDK-8198801
    + JDK-8203264: JNI exception pending in
    PlainDatagramSocketImpl.c:740
    + JDK-8203672: JNI exception pending in PlainSocketImpl.c
    + JDK-8203673: JNI exception pending in
    DualStackPlainDatagramSocketImpl.c:398
    + JDK-8204834: Fix confusing "allocate" naming in OopStorage
    + JDK-8205399: Set node color on pinned HashMap.TreeNode
    deletion
    + JDK-8205653: test/jdk/sun/management/jmxremote/bootstrap/
    /RmiRegistrySslTest.java and RmiSslBootstrapTest.sh fail with
    handshake_failure
    + JDK-8206179: com/sun/management/OperatingSystemMXBean/
    /GetCommittedVirtualMemorySize.java fails with Committed
    virtual memory size illegal value
    + JDK-8207334: VM times out in VM_HandshakeAllThreads::doit()
    with RunThese30M
    + JDK-8208277: Code cache heap (-XX:ReservedCodeCacheSize)
    doesn't work with 1GB LargePages
    + JDK-8209113: Use WeakReference for lastFontStrike for created
    Fonts
    + JDK-8209333: Socket reset issue for TLS 1.3 socket close
    + JDK-8209439: C2 library_call can potentially ignore Math.pow
    intrinsic or use null pointer
    + JDK-8209534: [TESTBUG]runtime/appcds/cacheObject/
    /ArchivedModuleCompareTest.java fails with EnableJVMCI.
    + JDK-8210147: adjust some WSAGetLastError usages in windows
    network coding
    + JDK-8210284: "assert((av &amp; 0x00000001) == 0) failed:
    unsupported V8" on Solaris 11.4
    + JDK-8210303: VM_HandshakeAllThreads fails assert with
    "failed: blocked and not walkable"
    + JDK-8210459: Add support for generating compile_commands.json
    + JDK-8210515: [TESTBUG]CheckArchivedModuleApp.java needs to
    check if EnableJVMCI is set.
    + JDK-8210788: Javadoc for Thread.join(long, int) should
    specify that it waits forever when both arguments are zero
    + JDK-8211301: [macos] support full window content options
    + JDK-8211332: Space for stub routines (code_size2) is too
    small on new Skylake CPUs
    + JDK-8211339: NPE during SSL handshake caused by
    HostnameChecker
    + JDK-8211392: compiler/profiling/
    /spectrapredefineclass_classloaders/Launcher.java times out
    in JDK12 CI
    + JDK-8211743: [AOT] crash in ScopeDesc::decode_body() when
    JVMTI walks AOT frames
    + JDK-8212154: [TESTBUG] CheckArchivedModuleApp fails with NPE
    when JVMCI is absent
    + JDK-8212167: JShell : Stack trace of exception has wrong line
    number
    + JDK-8212933: Thread-SMR: requesting a VM operation whilst
    holding a ThreadsListHandle can cause deadlocks
    + JDK-8212986: Make Visual Studio compiler check less strict
    + JDK-8213250: CDS archive creation aborts due to metaspace
    object allocation failure
    + JDK-8213516: jck test api/javax_accessibility/AccessibleState/
    /fields.html fails intermittent
    + JDK-8213947: ARM32: failed check_simd should set
    UsePopCountInstruction to false
    + JDK-8214418: half-closed SSLEngine status may cause
    application dead loop
    + JDK-8214440: ldap over a TLS connection negotiate failed with
    "javax.net.ssl.SSLPeerUnverifiedException: hostname of the
    server does not match the hostname in the server's
    certificate"
    + JDK-8214444: Wrong strncat limits in dfa.cpp
    + JDK-8214481: freetype path does not disable TrueType hinting
    with AA+FM hints
    + JDK-8214571: -Xdoclint of array serialField gives "error:
    array type not allowed here"
    + JDK-8214856: Errors with JSZip in web console after upgrade
    to 3.1.5
    + JDK-8214862: assert(proj != __null) at compile.cpp:3251
    + JDK-8215369: Jcstress pollute /var/tmp with temporary files.
    + JDK-8215551: Missing case label in nmethod::reloc_string_for()
    + JDK-8215555: TieredCompilation C2 threads can excessively
    block handshakes
    + JDK-8215711: Missing key_share extension for (EC)DHE key
    exchange should alert missing_extension
    + JDK-8216151: [Graal] Module
    jdk.internal.vm.compiler.management has not been granted
    accessClassInPackage.org.graalvm.compiler.debug
    + JDK-8216154: C4819 warnings at HotSpot sources on Windows
    + JDK-8216541: CompiledICHolders of VM locked unloaded nmethods
    are released too late
    + JDK-8217230: assert(t == t_no_spec) failure in
    NodeHash::check_no_speculative_types()
    + JDK-8217404: --with-jvm-features doesn't work when multiple
    features are explicitly disabled
    + JDK-8217447: Develop flag TraceICs is broken
    + JDK-8217606: LdapContext#reconnect always opens a new
    connection
    + JDK-8218807: Compilation database (compile_commands.json) may
    contain obsolete items
    + JDK-8219214: Infinite Loop in CodeSection::dump()
    + JDK-8219904: ClassCastException when calling
    FlightRecorderMXBean#getRecordings()
    + JDK-8219991: New fix of the deadlock in
    sun.security.ssl.SSLSocketImpl
    + JDK-8221121: applications/microbenchmarks are encountering
    crashes in tier5
    + JDK-8221445: FastSysexMessage constructor crashes MIDI
    receiption thread
    + JDK-8221482: Initialize VMRegImpl::regName[] earlier to
    prevent assert during PrintStubCode
    + JDK-8221741: ClassCastException can happen when
    fontconfig.properties is used
    + JDK-8221823: Requested JDialog width is ignored
    + JDK-8223108: Test java/awt/EventQueue/
    /NonComponentSourcePost.java is unstable
    + JDK-8223678: Add Visual Studio Code workspace generation
    support (for native code)
    + JDK-8223935: PIT: java/awt/font/WindowsIndicFonts.java fails
    on windows10
    + JDK-8224109: Text spaced incorrectly by drawString under
    rotation with fractional metric
    + JDK-8224632: testbug: java/awt/dnd/RemoveDropTargetCrashTest/
    /RemoveDropTargetCrashTest.java fails on MacOS
    + JDK-8224793: os::die() does not honor CreateCoredumpOnCrash
    option
    + JDK-8224847: gc/stress/TestReclaimStringsLeaksMemory.java
    fails with reserved greater than expected
    + JDK-8224931: disable JAOTC invokedynamic support until
    8223533 is fixed
    + JDK-8224997: ChaCha20-Poly1305 TLS cipher suite decryption
    throws ShortBufferException
    + JDK-8225068: Remove DocuSign root certificate that is
    expiring in May 2020
    + JDK-8225069: Remove Comodo root certificate that is expiring
    in May 2020
    + JDK-8225126: Test SetBoundsPaintTest.html faild on Windows
    when desktop is scaled
    + JDK-8225325: Add tests for redefining a class' private method
    during resolution of the bootstrap specifier
    + JDK-8225622: [AOT] runtime/SharedArchiveFile/
    /TestInterpreterMethodEntries.java crashed with AOTed
    java.base
    + JDK-8225653: Provide more information when hitting SIGILL
    from HaltNode
    + JDK-8225783: Incorrect use of binary operators on booleans in
    type.cpp
    + JDK-8225789: Empty method parameter type should generate
    ClassFormatError
    + JDK-8226198: use of &amp; instead of &amp;&amp; in
    LibraryCallKit::arraycopy_restore_alloc_state
    + JDK-8226253: JAWS reports wrong number of radio buttons when
    buttons are hidden.
    + JDK-8226653: [accessibility] Can edit text cell correctly,
    but Accessibility Tool reads nothing about editor
    + JDK-8226806: [macOS 10.14] Methods of Java Robot should be
    called from appropriate thread
    + JDK-8226879: Memory leak in Type::hashcons
    + JDK-8227632: Incorrect PrintCompilation message: made not
    compilable on levels 0 1 2 3 4
    + JDK-8228407: JVM crashes with shared archive file mismatch
    + JDK-8228482: fix xlc16/xlclang comparison of distinct pointer
    types and string literal conversion warnings
    + JDK-8228757: Fail fast if the handshake type is unknown
    + JDK-8229158: make UseSwitchProfiling non-experimental or
    false by-default
    + JDK-8229421: The logic of java/net/ipv6tests/TcpTest.java is
    flawed
    + JDK-8229855: C2 fails with assert(false) failed: bad AD file
    + JDK-8230591: AArch64: Missing intrinsics for Math.ceil,
    floor, rint
    + JDK-8231118: ARM32: Math tests failures
    + JDK-8231213: Migrate SimpleDateFormatConstTest to JDK Repo
    + JDK-8231243: [TESTBUG] CustomFont.java cannot find font file
    + JDK-8231438: [macOS] Dark mode for the desktop is not
    supported
    + JDK-8231550: C2: ShouldNotReachHere() in
    verify_strip_mined_scheduling
    + JDK-8231564: setMaximizedBounds is broken with large display
    scale and multiple monitors
    + JDK-8231572: Use -lobjc instead of -fobjc-link-runtime in
    libosxsecurity
    + JDK-8231631: sun/net/ftp/FtpURLConnectionLeak.java fails
    intermittently with NPE
    + JDK-8231671: Fix copyright headers in hotspot (missing comma
    after year)
    + JDK-8231720: Some perf regressions after 8225653
    + JDK-8231779: crash
    HeapWord*ParallelScavengeHeap::failed_mem_allocate
    + JDK-8231863: Crash if classpath is read from @argument file
    and the main gets option argument
    + JDK-8232080: jlink plugins for vendor information and
    run-time options
    + JDK-8232106: [x86] C2: SIGILL due to usage of SSSE3
    instructions on processors which don't support it
    + JDK-8232134: Change to Visual Studio 2017 15.9.16 for
    building on Windows at Oracle
    + JDK-8232226: [macos 10.15] test/jdk/java/awt/color/
    /EqualityTest/EqualityTest.java may fail
    + JDK-8232357: Compare version info of Santuario to legal notice
    + JDK-8232572: Add hooks for custom output dir in Bundles.gmk
    + JDK-8232634: Problem List ICMColorDataTest.java
    + JDK-8232748: Build static versions of certain JDK libraries
    + JDK-8232846: ProcessHandle.Info command with non-English
    shows question marks
    + JDK-8232880: Update test documentation with additional
    settings for client UI tooltip tests
    + JDK-8233033: C2 produces wrong result while unswitching a
    loop due to lost control dependencies
    + JDK-8233137: runtime/ErrorHandling/VeryEarlyAssertTest.java
    fails after 8232080
    + JDK-8233197: Invert JvmtiExport::post_vm_initialized() and
    Jfr:on_vm_start() start-up order for correct option parsing
    + JDK-8233291: [TESTBUG] tools/jlink/plugins/
    /VendorInfoPluginsTest.java fails with debug or non-server VMs
    + JDK-8233364: Fix undefined behavior in
    Canonicalizer::do_ShiftOp
    + JDK-8233494: Avoid calling MallocTracker::record_malloc and
    record_free when NMT is off
    + JDK-8233573: Toolkit.getScreenInsets(GraphicsConfiguration)
    may throw ClassCastException
    + JDK-8233608: Minimal build broken after JDK-8233494
    + JDK-8233621: Mismatch in jsse.enableMFLNExtension property
    name
    + JDK-8233696: [TESTBUG]Some jtreg tests fail when CAPS_LOCK is
    ON
    + JDK-8233707: systemScale.cpp could not compile with VS2019
    + JDK-8233801: GCMEmptyIv.java test fails on Solaris 11.4
    + JDK-8233880: Support compilers with multi-digit major version
    numbers
    + JDK-8233920: MethodHandles::tryFinally generates illegal
    bytecode for long/double return type
    + JDK-8234137: The "AutoTestOnTop.java" test may run external
    applications
    + JDK-8234146: compiler/jsr292/
    /ContinuousCallSiteTargetChange.java times out on SPARC
    + JDK-8234184: [TESTBUG] java/awt/Mouse/EnterExitEvents/
    /ModalDialogEnterExitEventsTest.java fails in Windows
    + JDK-8234270: [REDO] JDK-8204128 NMT might report incorrect
    numbers for Compiler area
    + JDK-8234332: [TESTBUG] java/awt/Focus/DisposedWindow/
    /DisposeDialogNotActivateOwnerTest/
    /DisposeDialogNotActivateOwnerTest.java fails on linux-x64
    nightly
    + JDK-8234398: Replace ID2D1Factory::GetDesktopDpi with
    GetDeviceCaps
    + JDK-8234522: [macos] Crash with use of native file dialog
    + JDK-8234691: Potential double-free in ParallelSPCleanupTask
    constructor
    + JDK-8234696: tools/jlink/plugins/VendorInfoPluginsTest.java
    times out
    + JDK-8234727: sun/security/ssl/X509TrustManagerImpl tests
    support TLSv1.3
    + JDK-8234728: Some security tests should support TLSv1.3
    + JDK-8234779: Provide idiom for declaring classes noncopyable
    + JDK-8234824: java/nio/channels/SocketChannel/AdaptSocket.java
    fails on Windows 10
    + JDK-8234968: check calloc rv in libinstrument
    InvocationAdapter
    + JDK-8235153: [TESTBUG] [macos 10.15] java/awt/Graphics/
    /DrawImageBG/SystemBgColorTest.java fails
    + JDK-8235183: Remove the "HACK CODE" in comment
    + JDK-8235263: Revert TLS 1.3 change that wrapped IOExceptions
    + JDK-8235311: Tag mismatch may alert bad_record_mac
    + JDK-8235332: TestInstanceCloneAsLoadsStores.java fails with
  - XX:+StressGCM
    + JDK-8235452: Strip mined loop verification fails with
    assert(is_OuterStripMinedLoop()) failed: invalid node class
    + JDK-8235584: UseProfiledLoopPredicate fails with
    assert(_phase-&gt;get_loop(c) == loop) failed: have to be in the
    same loop
    + JDK-8235620: Broken merge between JDK-8006406 and JDK-8003559
    + JDK-8235638: NPE in LWWindowPeer.getOnscreenGraphics()
    + JDK-8235686: Add more custom hooks in Bundles.gmk
    + JDK-8235739: Rare NPE at WComponentPeer.getGraphics()
    + JDK-8235762: JVM crash in SWPointer during C2 compilation
    + JDK-8235834: IBM-943 charset encoder needs updating
    + JDK-8235874: The ordering of Cipher Suites is not maintained
    provided through jdk.tls.client.cipherSuites and
    jdk.tls.server.cipherSuites system property.
    + JDK-8235908: omit ThreadPriorityPolicy warning when value is
    set from image
    + JDK-8235984: C2: assert(out-&gt;in(PhiNode::Region) == head ||
    out-&gt;in(PhiNode::Region) == slow_head) failed: phi must be
    either part of the slow or the fast loop
    + JDK-8236211: [Graal] compiler/graalunit/GraphTest.java is
    skipped in all testing
    + JDK-8236470: Deal with ECDSA using ecdsa-with-SHA2 plus hash
    algorithm as AlgorithmId
    + JDK-8236545: Compilation error in mach5
    java/awt/FileDialog/MacOSGoToFolderCrash.java
    + JDK-8236700: Upgrading JSZip from v3.1.5 to v3.2.2
    + JDK-8236759: ShouldNotReachHere in
    PhaseIdealLoop::verify_strip_mined_scheduling
    + JDK-8236897: Fix the copyright header for pkcs11gcm2.h
    + JDK-8236921: Add build target to produce a JDK image suitable
    for a Graal/SVM build
    + JDK-8236953: [macos] JavaFX SwingNode is not rendered on macOS
    + JDK-8236996: Incorrect Roboto font rendering on Windows with
    subpixel antialiasing
    + JDK-8237045: JVM uses excessive memory with -XX:+EnableJVMCI
  - XX:JVMCICounterSize=2147483648
    + JDK-8237055: [TESTBUG] compiler/c2/TestJumpTable.java fails
    with release VMs
    + JDK-8237086: assert(is_MachReturn()) running CTW with fix for
    JDK-8231291
    + JDK-8237192: Generate stripped/public pdbs on Windows for jdk
    images
    + JDK-8237396: JvmtiTagMap::weak_oops_do() should not trigger
    barriers
    + JDK-8237474: Default SSLEngine should create in server role
    + JDK-8237859: C2: Crash when loads float above range check
    + JDK-8237879: make 4.3 breaks build
    + JDK-8237951: CTW: C2 compilation fails with "malformed
    control flow"
    + JDK-8237962: give better error output for invalid OCSP
    response intervals in CertPathValidator checks
    + JDK-8238190: [JVMCI] Fix single implementor speculation for
    diamond shapes.
    + JDK-8238356: CodeHeap::blob_count() overestimates the number
    of blobs
    + JDK-8238452: Keytool generates wrong expiration date if
    validity is set to 2050/01/01
    + JDK-8238555: Allow Initialization of SunPKCS11 with NSS when
    there are external FIPS modules in the NSSDB
    + JDK-8238575: DragSourceEvent.getLocation() returns wrong
    value on HiDPI screens (Windows)
    + JDK-8238676: jni crashes on accessing it from process exit
    hook
    + JDK-8238721: Add failing client jtreg tests to the Problem
    List
    + JDK-8238738: AudioSystem.getMixerInfo() takes about 30 sec to
    report a gone audio device
    + JDK-8238756: C2: assert(((n) == __null || !VerifyIterativeGVN
    || !((n)-&gt;is_dead()))) failed: can not use dead node
    + JDK-8238765: PhaseCFG::schedule_pinned_nodes cannot handle
    precedence edges from unmatched CFG nodes correctly
    + JDK-8238898: Missing hash characters for header on license
    file
    + JDK-8238942: Rendering artifacts with LCD text and fractional
    metrics
    + JDK-8238985: [TESTBUG] The arrow image is blue instead of
    green
    + JDK-8239000: handle ContendedPaddingWidth in vm_version_ppc
    + JDK-8239055: Wrong implementation of VMState.hasListener
    + JDK-8239091: Reversed arguments in call to strstr in freetype
    "debug" code.
    + JDK-8239142: C2's UseUniqueSubclasses optimization is broken
    for array accesses
    + JDK-8239224: libproc_impl.c previous_thr may be used
    uninitialized warning
    + JDK-8239351: Give more meaningful InternalError messages in
    Deflater.c
    + JDK-8239365: ProcessBuilder test modifications for AIX
    execution
    + JDK-8239456: vtable stub generation: assert failure (code
    size estimate)
    + JDK-8239457: call ReleaseStringUTFChars before early returns
    in Java_sun_security_pkcs11_wrapper_PKCS11_connect
    + JDK-8239462: jdk.hotspot.agent misses some
    ReleaseStringUTFChars calls in case of early returns
    + JDK-8239557: [TESTBUG] VeryEarlyAssertTest.java validating
    "END." marker at lastline is not always true
    + JDK-8239787: AArch64: String.indexOf may incorrectly handle
    empty strings
    + JDK-8239792: Bump update version for OpenJDK: jdk-11.0.8
    + JDK-8239798: SSLSocket closes socket both socket endpoints on
    a SocketTimeoutException
    + JDK-8239819: XToolkit: Misread of screen information memory
    + JDK-8239852: java/util/concurrent tests fail with
  - XX:+VerifyGraphEdges: assert(!VerifyGraphEdges) failed:
    verification should have failed
    + JDK-8239893: Windows handle Leak when starting processes
    using ProcessBuilder
    + JDK-8239915: Zero VM crashes when handling dynamic constant
    + JDK-8239931: [win][x86] vtable stub generation: assert
    failure (code size estimate) follow-up
    + JDK-8239965: XMLEncoder/Test4625418.java fails due to "Error:
    Cp943 - can't read properly"
    + JDK-8239976: Put JDK-8239965 on the ProblemList.txt
    + JDK-8240073: Fix 'test-make' build target in 11u
    + JDK-8240197: Cannot start JVM when $JAVA_HOME includes CJK
    characters
    + JDK-8240202: A few client tests leave mouse buttons pressed
    + JDK-8240220: IdealLoopTree::dump_head predicate printing is
    broken
    + JDK-8240223: Use consistent predicate order in and with
    PhaseIdealLoop::find_predicate
    + JDK-8240227: Loop predicates should be copied to unswitched
    loops
    + JDK-8240286: [TESTBUG] Test command error in hotspot/jtreg/
    /compiler/loopopts/superword/SumRedAbsNeg_Float.java
    + JDK-8240518: Incorrect JNU_ReleaseStringPlatformChars in
    Windows Print
    + JDK-8240529: CheckUnhandledOops breaks NULL check in
    Modules::define_module
    + JDK-8240576: JVM crashes after transformation in C2
    IdealLoopTree::merge_many_backedges
    + JDK-8240603: Windows 32bit compile error after 8238676
    + JDK-8240629: argfiles parsing broken for argfiles with
    comment cross 4096 bytes chunk
    + JDK-8240711: TestJstatdPort.java failed due to
    "ExportException: Port already in use:"
    + JDK-8240786: [TESTBUG] The test java/awt/Window/
    /GetScreenLocation/GetScreenLocationTest.java fails on HiDPI
    screen
    + JDK-8240824: enhance print_full_memory_info on Linux by THP
    related information
    + JDK-8240827: Downport SSLSocketImpl.java from "8221882: Use
    fiber-friendly java.util.concurrent.locks in JSSE"
    + JDK-8240905: assert(mem == (Node*)1 || mem == mem2) failed:
    multiple Memories being matched at once?
    + JDK-8240972: macOS codesign fail on macOS 10.13.5 or older
    + JDK-8241445: Fix copyright in
    test/jdk/tools/launcher/ArgFileSyntax.java
    + JDK-8241458: [JVMCI] add mark value to expose
    CodeOffsets::Frame_Complete
    + JDK-8241464: [11u] Backport: make rehashing be a needed
    guaranteed safepoint cleanup action
    + JDK-8241556: Memory leak if -XX:CompileCommand is set
    + JDK-8241568: (fs) UserPrincipalLookupService.lookupXXX
    failure with IOE "Operation not permitted"
    + JDK-8241586: compiler/cpuflags/
    /TestAESIntrinsicsOnUnsupportedConfig.java fails on aarch64
    + JDK-8241638: launcher time metrics always report 1 on Linux
    when _JAVA_LAUNCHER_DEBUG set
    + JDK-8241660: Add virtualization information output to hs_err
    file on macOS
    + JDK-8241808: [TESTBUG] The JDK-8039467 bug appeared on macOS
    + JDK-8241888: Mirror jdk.security.allowNonCaAnchor system
    property with a security one
    + JDK-8241900: Loop unswitching may cause dependence on null
    check to be lost
    + JDK-8241948: enhance list of environment variables printed in
    hs_err file
    + JDK-8241996: on linux set full relro in the linker flags
    + JDK-8242108: Performance regression after fix for JDK-8229496
    + JDK-8242141: New System Properties to configure the TLS
    signature schemes
    + JDK-8242154: Backport parts of JDK-4947890 to OpenJDK 11u
    + JDK-8242174: [macos] The NestedModelessDialogTest test make
    the macOS unstable
    + JDK-8242239: [Graal] javax/management/generified/
    /GenericTest.java fails: FAILED: queryMBeans sets same
    + JDK-8242294: JSSE Client does not throw SSLException when an
    alert occurs during handshaking
    + JDK-8242379: [TESTBUG] compiler/loopopts/
    /TestLoopUnswitchingLostCastDependency.java fails with
    release VMs
    + JDK-8242470: Update Xerces to Version 2.12.1
    + JDK-8242498: Invalid "sun.awt.TimedWindowEvent" object leads
    to JVM crash
    + JDK-8242541: Small charset issues (ISO8859-16, x-eucJP-Open,
    x-IBM834 and x-IBM949C)
    + JDK-8242626: enhance posix print_rlimit_info
    + JDK-8243059: Build fails when --with-vendor-name contains a
    comma
    + JDK-8243539: Copyright info (Year) should be updated for fix
    of 8241638
    + JDK-8243541: (tz) Upgrade time-zone data to tzdata2020a
    + JDK-8244407: JVM crashes after transformation in C2
    IdealLoopTree::split_fall_in
    + JDK-8244520: problemlist
    java/awt/font/Rotate/RotatedFontTest.java on linux
    + JDK-8244777: ClassLoaderStats VM Op uses constant hash value
    + JDK-8244853: The static build of libextnet is missing the
    JNI_OnLoad_extnet function
    + JDK-8244951: Missing entitlements for hardened runtime
    + JDK-8245047: [PPC64] C2: ReverseBytes + Load always match to
    unordered Load (acquire semantics missing)
    + JDK-8245649: Revert 8245397 backport of 8230591
    + JDK-8246031: SSLSocket.getSession() doesn't close connection
    for timeout/ interrupts
    + JDK-8246613: Choose the default SecureRandom algo based on
    registration ordering
    + JDK-8248505: Unexpected NoSuchAlgorithmException when using
    secure random impl from BCFIPS provider
- Removed patch:
  * JDK-8228407.patch
    + integrated upstream</changelog>
  <changelog author="fstrba@suse.com" date="1604318400">- Update to upstream tag jdk-11.0.9-11 (October 2020 CPU,
  bsc#1177943)
  * New features
    + JDK-8250784: Shenandoah: A Low-Pause-Time Garbage Collector
  * Security fixes
    + JDK-8233624: Enhance JNI linkage
    + JDK-8236196: Improve string pooling
    + JDK-8236862, CVE-2020-14779: Enhance support of Proxy class
    + JDK-8237990, CVE-2020-14781: Enhanced LDAP contexts
    + JDK-8237995, CVE-2020-14782: Enhance certificate processing
    + JDK-8240124: Better VM Interning
    + JDK-8241114, CVE-2020-14792: Better range handling
    + JDK-8242680, CVE-2020-14796: Improved URI Support
    + JDK-8242685, CVE-2020-14797: Better Path Validation
    + JDK-8242695, CVE-2020-14798: Enhanced buffer support
    + JDK-8243302: Advanced class supports
    + JDK-8244136, CVE-2020-14803: Improved Buffer supports
    + JDK-8244479: Further constrain certificates
    + JDK-8244955: Additional Fix for JDK-8240124
    + JDK-8245407: Enhance zoning of times
    + JDK-8245412: Better class definitions
    + JDK-8245417: Improve certificate chain handling
    + JDK-8248574: Improve jpeg processing
    + JDK-8249927: Specify limits of jdk.serialProxyInterfaceLimit
    + JDK-8253019: Enhanced JPEG decoding
  * Other changes
    + JDK-6532025: GIF reader throws misleading exception with
    truncated images
    + JDK-6949753: [TEST BUG]: java/awt/print/PageFormat/
    /PDialogTest.java needs update by removing an infinite loop
    + JDK-8022535: [TEST BUG] javax/swing/text/html/parser/
    /Test8017492.java fails
    + JDK-8062947: Fix exception message to correctly represent
    LDAP connection failure
    + JDK-8067354: com/sun/jdi/GetLocalVariables4Test.sh failed
    + JDK-8134599: TEST_BUG: java/rmi/transport/closeServerSocket/
    /CloseServerSocket.java fails intermittently with Address
    already in use
    + JDK-8151678: com/sun/jndi/ldap/LdapTimeoutTest.java failed
    due to timeout on DeadServerNoTimeoutTest is incorrect
    + JDK-8160768: Add capability to custom resolve host/domain
    names within the default JNDI LDAP provider
    + JDK-8172404: Tools should warn if weak algorithms are used
    before restricting them
    + JDK-8193367: Annotated type variable bounds crash javac
    + JDK-8202117: com/sun/jndi/ldap/RemoveNamingListenerTest.java
    fails intermittently: Connection reset
    + JDK-8203026: java.rmi.NoSuchObjectException: no such object
    in table
    + JDK-8203281: [Windows] JComboBox change in ui when
    editor.setBorder() is called
    + JDK-8203382: Rename SystemDictionary::initialize_wk_klass to
    resolve_wk_klass
    + JDK-8203393: com/sun/jdi/JdbMethodExitTest.sh and
    JdbExprTest.sh fail due to timeout
    + JDK-8203928: [Test] Convert non-JDB scaffolding
    serviceability shell script tests to java
    + JDK-8204963: javax.swing.border.TitledBorder has a memory leak
    + JDK-8204994: SA might fail to attach to process with "Windbg
    Error: WaitForEvent failed"
    + JDK-8205534: Remove SymbolTable dependency from
    serviceability agent
    + JDK-8206309: Tier1 SA tests fail
    + JDK-8208281: java/nio/channels/
    /AsynchronousSocketChannel/Basic.java timed out
    + JDK-8209109: [TEST] rewrite com/sun/jdi shell tests to java
    version - step1
    + JDK-8209332: [TEST] test/jdk/com/sun/jdi/CatchPatternTest.sh
    is incorrect
    + JDK-8209342: Problemlist SA tests on Solaris due to Error
    attaching to process: Can't create thread_db agent!
    + JDK-8209343: Test javax/swing/border/TestTitledBorderLeak.java
    should be marked as headful
    + JDK-8209517: com/sun/jdi/BreakpointWithFullGC.java fails with
    timeout
    + JDK-8209604: [TEST] rewrite com/sun/jdi shell tests to java
    version - step2
    + JDK-8209605: com/sun/jdi/BreakpointWithFullGC.java fails with
    ZGC
    + JDK-8209608: Problem list com/sun/jdi/BreakpointWithFullGC.java
    + JDK-8210131: vmTestbase/nsk/jvmti/scenarios/allocation/AP10/
    /ap10t001/TestDescription.java failed with ObjectFree:
    GetCurrentThreadCpuTimerInfo returned unexpected error code
    + JDK-8210243: [TEST] rewrite com/sun/jdi shell tests to java
    version - step3
    + JDK-8210527: JShell: NullPointerException in
    jdk.jshell.Eval.translateExceptionStack
    + JDK-8210560: [TEST] convert com/sun/jdi redefineClass-related
    tests
    + JDK-8210725: com/sun/jdi/RedefineClearBreakpoint.java fails
    with waitForPrompt timed out after 60 seconds
    + JDK-8210748: [TESTBUG] lib.jdb.Jdb.waitForPrompt() should
    clarify which output is the pending reply after a timeout
    + JDK-8210760: [TEST] rewrite com/sun/jdi shell tests to java
    version - step4
    + JDK-8210977: jdk/jfr/event/oldobject/TestThreadLocalLeak.java
    fails to find ThreadLocalObject
    + JDK-8211292: [TEST] convert com/sun/jdi/DeferredStepTest.sh
    test
    + JDK-8211694: JShell: Redeclared variable should be reset
    + JDK-8212200: assert when shared java.lang.Object is redefined
    by JVMTI agent
    + JDK-8212629: [TEST] wrong breakpoint in
    test/jdk/com/sun/jdi/DeferredStepTest
    + JDK-8212665: com/sun/jdi/DeferredStepTest.java: jj1 (line 57)
  - unexpected. lastLine=52, minLine=52, maxLine=55
    + JDK-8212807: tools/jar/multiRelease/Basic.java times out
    + JDK-8213182: Minimal VM build failure after JDK-8212200
    (assert when shared java.lang.Object is redefined by JVMTI
    agent)
    + JDK-8213214: Set -Djava.io.tmpdir= when running tests
    + JDK-8213275: ReplaceCriticalClasses.java fails with
    jdk.internal.vm.PostVMInitHook not found
    + JDK-8213574: Deadlock in string table expansion when dumping
    lots of CDS classes
    + JDK-8213703: LambdaConversionException: Invalid receiver type
    not a subtype of implementation type interface
    + JDK-8214074: Ghash optimization using AVX instructions
    + JDK-8214491: Upgrade to JLine 3.9.0
    + JDK-8214797: TestJmapCoreMetaspace.java timed out
    + JDK-8215243: JShell tests failing intermitently with
    "Problem cleaning up the following threads:"
    + JDK-8215244: jdk/jshell/ToolBasicTest.java
    testHistoryReference failed
    + JDK-8215354: x86_32 build failures after JDK-8214074 (Ghash
    optimization using AVX instructions)
    + JDK-8215438: jshell tool: Ctrl-D causes EOF
    + JDK-8216021: RunTest.gmk might set concurrency level to 1 on
    Windows
    + JDK-8216974: HttpConnection not returned to the pool after
    204 response
    + JDK-8218948: SimpleDateFormat :: format - Zone Names are not
    reflected correctly during run time
    + JDK-8219712: code_size2 (defined in stub_routines_x86.hpp) is
    too small on new Skylake CPUs
    + JDK-8220150: macos10.14 Mojave returns anti-aliased glyphs
    instead of aliased B&amp;W glyphs
    + JDK-8221658: aarch64: add necessary predicate for ubfx
    patterns
    + JDK-8221759: Crash when completing "java.io.File.path"
    + JDK-8221918: runtime/SharedArchiveFile/serviceability/
    /ReplaceCriticalClasses.java fails: Shared archive not found
    + JDK-8222074: Enhance auto vectorization for x86
    + JDK-8222079: Don't use memset to initialize fields decode_env
    constructor in disassembler.cpp
    + JDK-8222769: [TESTBUG] TestJFRNetworkEvents should not rely
    on hostname command
    + JDK-8223688: JShell: crash on the instantiation of raw
    anonymous class
    + JDK-8223777: In posix_spawn mode, failing to exec()
    jspawnhelper does not result in an error
    + JDK-8223940: Private key not supported by chosen signature
    algorithm
    + JDK-8224184: jshell got IOException at exiting with AIX
    + JDK-8224234: compiler/codegen/TestCharVect2.java fails in
    test_mulc
    + JDK-8225037: java.net.JarURLConnection::getJarEntry() throws
    NullPointerException
    + JDK-8225625: AES Electronic Codebook (ECB) encryption and
    decryption optimization using AVX512 + VAES instructions
    + JDK-8226536: Catch OOM from deopt that fails rematerializing
    objects
    + JDK-8226575: OperatingSystemMXBean should be made container
    aware
    + JDK-8226697: Several tests which need the @key headful
    keyword are missing it.
    + JDK-8226809: Circular reference in printed stack trace is not
    correctly indented &amp; ambiguous
    + JDK-8227059: sun/security/tools/keytool/
    /DefaultSignatureAlgorithm.java timed out
    + JDK-8227269: Slow class loading when running with JDWP
    + JDK-8227595: keytool/fakegen/DefaultSignatureAlgorithm.java
    fails due to "exitValue = 6"
    + JDK-8228448: Jconsole can't connect to itself
    + JDK-8228967: Trust/Key store and SSL context utilities for
    tests
    + JDK-8229378: jdwp library loader in linker_md.c quietly
    truncates on buffer overflow
    + JDK-8229815: Upgrade Jline to 3.12.1
    + JDK-8230000: some httpclients testng tests run zero test
    + JDK-8230002: javax/xml/jaxp/unittest/transform/
    /SecureProcessingTest.java runs zero test
    + JDK-8230010: Remove jdk8037819/BasicTest1.java
    + JDK-8230094: CCE in createXMLEventWriter(Result) over an
    arbitrary XMLStreamWriter
    + JDK-8230402: Allocation of compile task fails with assert:
    "Leaking compilation tasks?"
    + JDK-8230767: FlightRecorderListener returns null recording
    + JDK-8230870: (zipfs) Add a ZIP FS test that is similar to
    test/jdk/java/util/zip/EntryCount64k.java
    + JDK-8231209: [REDO] ThreadMXBean::getThreadAllocatedBytes()
    can be quicker for self thread
    + JDK-8231586: enlarge encoding space for OopMapValue offsets
    + JDK-8231953: Wrong assumption in assertion in
    oop::register_oop
    + JDK-8231968: getCurrentThreadAllocatedBytes default
    implementation s/b getThreadAllocatedBytes
    + JDK-8232083: Minimal VM is broken after JDK-8231586
    + JDK-8232161: Align some one-way conversion in MS950 charset
    with Windows
    + JDK-8232855: jshell missing word in /help help
    + JDK-8233027: OopMapSet::all_do does oms.next() twice during
    iteration
    + JDK-8233228: Disable weak named curves by default in TLS,
    CertPath, and Signed JAR
    + JDK-8233386: Initialize NULL fields for unused decorations
    + JDK-8233452: java.math.BigDecimal.sqrt() with
    RoundingMode.FLOOR results in incorrect result
    + JDK-8233686: XML transformer uses excessive amount of memory
    + JDK-8233741: AES Countermode (AES-CTR) optimization using
    AVX512 + VAES instructions
    + JDK-8233829: javac cannot find non-ASCII module name under
    non-UTF8 environment
    + JDK-8233958: Memory retention due to HttpsURLConnection
    finalizer that serves no purpose
    + JDK-8234011: (zipfs) Memory leak in
    ZipFileSystem.releaseDeflater()
    + JDK-8234058: runtime/CompressedOops/
    /CompressedClassPointers.java fails with 'Narrow klass base:
    0x0000000000000000' missing from stdout/stderr
    + JDK-8234149: Several regression tests do not dispose Frame at
    end
    + JDK-8234347: "Turkey" meta time zone does not generate
    composed localized names
    + JDK-8234385: [TESTBUG] java/awt/EventQueue/6980209/
    /bug6980209.java fails in linux nightly
    + JDK-8234535: Cross compilation fails due to missing CFLAGS
    for the BUILD_CC
    + JDK-8234541: C1 emits an empty message when it inlines
    successfully
    + JDK-8234687: change javap reporting on unknown attributes
    + JDK-8236464: SO_LINGER option is ignored by SSLSocket in JDK
    11
    + JDK-8236548: Localized time zone name inconsistency between
    English and other locales
    + JDK-8236617: jtreg test containers/docker/
    /TestMemoryAwareness.java fails after 8226575
    + JDK-8237182: Update copyright header for shenandoah and
    epsilon files
    + JDK-8237888: security/infra/java/security/cert/
    /CertPathValidator/certification/LuxTrustCA.java fails when
    checking validity interval
    + JDK-8237977: Further update
    javax/net/ssl/compatibility/Compatibility.java
    + JDK-8238270: java.net HTTP/2 client does not decrease stream
    count when receives 204 response
    + JDK-8238284: [macos] Zero VM build fails due to an obvious
    typo
    + JDK-8238380: java.base/unix/native/libjava/childproc.c
    "multiple definition" link errors with GCC10
    + JDK-8238386: (sctp) jdk.sctp/unix/native/libsctp/SctpNet.c
    "multiple definition" link errors with GCC10
    + JDK-8238388: libj2gss/NativeFunc.o "multiple definition" link
    errors with GCC10
    + JDK-8238448: RSASSA-PSS signature verification fail when
    using certain odd key sizes
    + JDK-8238710: LingeredApp doesn't log stdout/stderr if exits
    with non-zero code
    + JDK-8239083: C1 assert(known_holder == NULL ||
    (known_holder-&gt;is_instance_klass() &amp;&amp;
    (!known_holder-&gt;is_interface() ||
    ((ciInstanceKlass*)known_holder)-&gt;has_nonstatic_concrete_methods())),
    "should be non-static concrete method");
    + JDK-8239385: KerberosTicket client name refers wrongly to
    sAMAccountName in AD
    + JDK-8240169: javadoc fails to link to non-modular api docs
    + JDK-8240295: hs_err elapsed time in seconds is not accurate
    enough
    + JDK-8240360: NativeLibraryEvent has wrong library name on
    Linux
    + JDK-8240676: Meet not symmetric failure when running lucene
    on jdk8
    + JDK-8241007: Shenandoah: remove
    ShenandoahCriticalControlThreadPriority support
    + JDK-8241065: Shenandoah: remove leftover code after
    JDK-8231086
    + JDK-8241086: Test runtime/NMT/HugeArenaTracking.java is
    failing on 32bit Windows
    + JDK-8241130: com.sun.jndi.ldap.EventSupport.removeDeadNotifier:
    java.lang.NullPointerException
    + JDK-8241138: http.nonProxyHosts=* causes
    StringIndexOutOfBoundsException in DefaultProxySelector
    + JDK-8241319: WB_GetCodeBlob doesn't have ResourceMark
    + JDK-8241478: vmTestbase/gc/gctests/Steal/steal001/steal001.java
    fails with OOME
    + JDK-8241574: Shenandoah: remove ShenandoahAssertToSpaceClosure
    + JDK-8241750: x86_32 build failure after JDK-8227269
    + JDK-8242184: CRL generation error with RSASSA-PSS
    + JDK-8242283: Can't start JVM when java home path includes
    non-ASCII character
    + JDK-8242556: Cannot load RSASSA-PSS public key with non-null
    params from byte array
    + JDK-8243029: Rewrite javax/net/ssl/compatibility/
    /Compatibility.java with a flexible interop test framework
    + JDK-8243138: Enhance BaseLdapServer to support starttls
    extended request
    + JDK-8243320: Add SSL root certificates to Oracle Root CA
    program
    + JDK-8243321: Add Entrust root CA - G4 to Oracle Root CA
    program
    + JDK-8243389: enhance os::pd_print_cpu_info on linux
    + JDK-8243453: java --describe-module failed with non-ASCII
    module name under non-UTF8 environment
    + JDK-8243470: [macos] bring back O2 opt level for unsafe.cpp
    + JDK-8243489: Thread CPU Load event may contain wrong data for
    CPU time under certain conditions
    + JDK-8243925: Toolkit#getScreenInsets() returns wrong value on
    HiDPI screens (Windows)
    + JDK-8244087: 2020-04-24 public suffix list update
    + JDK-8244151: Update MUSCLE PC/SC-Lite headers to the latest
    release 1.8.26
    + JDK-8244164: AArch64: jaotc generates incorrect code for
    compressed OOPs with non-zero heap base
    + JDK-8244196: adjust output in os_linux
    + JDK-8244225: stringop-overflow warning on strncpy call from
    compile_the_world_in
    + JDK-8244287: JFR: Methods samples have line number 0
    + JDK-8244703: "platform encoding not initialized" exceptions
    with debugger, JNI
    + JDK-8244719: CTW: C2 compilation fails with
    "assert(!VerifyHashTableKeys || _hash_lock == 0) failed:
    remove node from hash table before modifying it"
    + JDK-8244729: Shenandoah: remove resolve paths from
    SBSA::generate_shenandoah_lrb
    + JDK-8244763: Update --release 8 symbol information after JSR
    337 MR3
    + JDK-8244818: Java2D Queue Flusher crash while moving
    application window to external monitor
    + JDK-8245151: jarsigner should not raise duplicate warnings on
    verification
    + JDK-8245616: Bump update version for OpenJDK: jdk-11.0.9
    + JDK-8245714: "Bad graph detected in build_loop_late" when
    loads are pinned on loop limit check uncommon branch
    + JDK-8245801: StressRecompilation triggers assert "redundunt
    OSR recompilation detected. memory leak in CodeCache!"
    + JDK-8245832: JDK build make-static-libs should build all JDK
    libraries
    + JDK-8245880: Shenandoah: check class unloading flag early in
    concurrent code root scan
    + JDK-8245981: Upgrade to jQuery 3.5.1
    + JDK-8246027: Minimal fastdebug build broken after JDK-8245801
    + JDK-8246094: [macos] Sound Recording and playback is not
    working
    + JDK-8246153: TestEliminateArrayCopy fails with
  - XX:+StressReflectiveCode
    + JDK-8246193: Possible NPE in ENC-PA-REP search in AS-REQ
    + JDK-8246196: javax/management/MBeanServer/OldMBeanServerTest
    fails with AssertionError
    + JDK-8246203: Segmentation fault in verification due to stack
    overflow with -XX:+VerifyIterativeGVN
    + JDK-8246330: Add TLS Tests for Legacy ECDSA curves
    + JDK-8246453: TestClone crashes with "all collected exceptions
    must come from the same place"
    + JDK-8247246: Add explicit ResolvedJavaType.link and expose
    presence of default methods
    + JDK-8247350: [aarch64] assert(false) failed: wrong size of
    mach node
    + JDK-8247502: PhaseStringOpts crashes while optimising
    effectively dead code
    + JDK-8247615: Initialize the bytes left for the heap sampler
    + JDK-8247824: CTW: C2 (Shenandoah) compilation fails with SEGV
    in SBC2Support::pin_and_expand
    + JDK-8247874: Replacement in VersionProps.java.template not
    working when --with-vendor-bug-url contains '&amp;'
    + JDK-8247979: aarch64: missing side effect of killing flags
    for clearArray_reg_reg
    + JDK-8248214: Add paddings for TaskQueueSuper to reduce
    false-sharing cache contention
    + JDK-8248219: aarch64: missing memory barrier in
    fast_storefield and fast_accessfield
    + JDK-8248348: Regression caused by the update to BCEL 6.0
    + JDK-8248385: [testbug][11u] Adapt TestInitiExceptions to
    jtreg 5.1
    + JDK-8248495: [macos] zerovm is broken due to libffi headers
    location
    + JDK-8248851: CMS: Missing memory fences between free chunk
    check and klass read
    + JDK-8248987: AOT's Linker.java seems to eagerly fail-fast on
    Windows
    + JDK-8249159: Downport test rework for SSLSocketTemplate from
    8224650
    + JDK-8249215: JFrame::setVisible crashed with
  - Dfile.encoding=UTF-8 on Japanese Windows.
    + JDK-8249251: [dark_mode ubuntu 20.04] The selected menu is
    not highlighted in GTKLookAndFeel
    + JDK-8249255: Build fails if source code in cygwin home dir
    + JDK-8249277: TestVerifyIterativeGVN.java is failing with
    timeout in OpenJDK 11
    + JDK-8249278: Revert JDK-8226253 which breaks the spec of
    AccessibleState.SHOWING for JList
    + JDK-8249560: Shenandoah: Fix racy GC request handling
    + JDK-8249801: Shenandoah: Clear soft-refs on requested GC cycle
    + JDK-8249953: Shenandoah: gc/shenandoah/mxbeans tests should
    account for corner cases
    + JDK-8250582: Revert Principal Name type to NT-UNKNOWN when
    requesting TGS Kerberos tickets
    + JDK-8250609: C2 crash in IfNode::fold_compares
    + JDK-8250627: Use -XX:+/-UseContainerSupport for
    enabling/disabling Java container metrics
    + JDK-8250755: Better cleanup for
    jdk/test/javax/imageio/plugins/shared/CanWriteSequence.java
    + JDK-8250787: Provider.put no longer registering aliases in
    FIPS env
    + JDK-8250826: jhsdb does not work with coredump which comes
    from Substrate VM
    + JDK-8250827: Shenandoah: needs to reset/finish StringTable's
    dead count before/after parallel walk
    + JDK-8250844: Make sure {type,obj}ArrayOopDesc accessors check
    the bounds
    + JDK-8251117: Cannot check P11Key size in P11Cipher and
    P11AEADCipher
    + JDK-8251354: Shenandoah: Fix jdk/jfr/tool/TestPrintJSON.java
    test failure
    + JDK-8251451: Shenandoah: Remark ObjectSynchronizer roots with
    I-U
    + JDK-8251469: Better cleanup for
    test/jdk/javax/imageio/SetOutput.java
    + JDK-8251487: Shenandoah: missing detail timing tracking for
    final mark cleaning phase
    + JDK-8252120: compiler/oracle/TestCompileCommand.java
    misspells "occured"
    + JDK-8252157: JDK-8231209 11u backport breaks jmm binary
    compatibility
    + JDK-8252258: [11u] JDK-8242154 changes the default vendor
    + JDK-8252804: [test] Fix 'ReleaseDeflater.java' test after
    downport of 8234011
    + JDK-8253134: JMM_VERSION should remain at 0x20020000 (JDK 10)
    in JDK 11
    + JDK-8253283: [11u] Test build/translations/
    /VerifyTranslations.java failing after JDK-8252258
    + JDK-8253813: Backout JDK-8244287 from 11u: it causes several
    crashes
- Removed patch:
  * gcc-fno-common-fix.patch
    + not needed any more with this version
- Added patch:
  * JDK-8250861.patch
    + Fix regression "8250861: Crash in MinINode::Ideal(PhaseGVN*,
    bool)" introduced in jdk 11.0.9</changelog>
  <changelog author="fstrba@suse.com" date="1604491200">- Enable Sheandoah GC for x86_64 (jsc#ECO-3171)</changelog>
  <changelog author="fstrba@suse.com" date="1605528000">- Update to upstream tag jdk-11.0.9.1-1
  * Fix:
    + JDK-8250861: Crash in MinINode::Ideal(PhaseGVN*, bool)
- Removed patch:
  * JDK-8250861.patch
    + Integrated upstream</changelog>
  <changelog author="fstrba@suse.com" date="1611230400">- Update to upstream tag jdk-11.0.10+9 (January 2021 CPU,
  bsc#1181239)
  * Security fixes
    + JDK-8247619: Improve Direct Buffering of Characters
  * Other changes
    + JDK-6722928: Support SSPI as a native GSS-API provider
    + JDK-7185258: [macosx] Deadlock in SunToolKit.realSync()
    + JDK-8152332: [macosx] JFileChooser cannot be serialized on
    Mac OS X
    + JDK-8161684: [testconf] Add VerifyOops' testing into compiler
    tiers
    + JDK-8171279: Support X25519 and X448 in TLS
    + JDK-8173361: various crashes in
    JvmtiExport::post_compiled_method_load
    + JDK-8173658: JvmtiExport::post_class_unload() is broken for
    non-JavaThread initiators
    + JDK-8191006: hsdis disassembler plugin does not compile with
    binutils 2.29+
    + JDK-8197981: Missing return statement in
    __sync_val_compare_and_swap_8
    + JDK-8198334: java/awt/FileDialog/8003399/bug8003399.java
    fails in headless mode
    + JDK-8200151: Add 8 JNDI tests to com/sun/jndi/dns/ConfigTests/
    + JDK-8208279: Add 8 JNDI tests to com/sun/jndi/dns/EnvTests/
    + JDK-8208483: Add 5 JNDI tests to
    com/sun/jndi/dns/FactoryTests/
    + JDK-8208542: Add 4 JNDI tests to com/sun/jndi/dns/ListTests/
    + JDK-8208665: Amend cross-compilation docs with
    qemu-debootstrap recipe
    + JDK-8210088: ProblemList gc/epsilon/TestMemoryMXBeans.java
    + JDK-8210339: Add 10 JNDI tests to com/sun/jndi/dns/FedTests/
    + JDK-8211450: UndetVar::dup is not copying the kind field to
    the duplicated instance
    + JDK-8212160: JVMTI agent crashes with "assert(_value != 0LL)
    failed: resolving NULL _value"
    + JDK-8212226: SurfaceManager throws "Invalid Image variant"
    for MultiResolutionImage (Windows)
    + JDK-8213400: Support choosing group name in keytool keypair
    generation
    + JDK-8213535: Windows HiDPI html lightweight tooltips are
    truncated
    + JDK-8213698: Improve devkit creation and add support for
    linux/ppc64/ppc64le/s390x
    + JDK-8214025: assert(t-&gt;singleton()) failed: must be a
    constant when ScavengeRootsInCode &lt; 2
    + JDK-8214242: compiler/arguments/TestScavengeRootsInCode.java
    fails because of missing UnlockDiagnosticVMOptions
    + JDK-8214787: Zero builds fail with "undefined
    JavaThread::thread_state()"
    + JDK-8215583: Exclude
    runtime/handshake/HandshakeWalkSuspendExitTest.java
    + JDK-8216012: Infinite loop in RSA KeyPairGenerator
    + JDK-8216324: GetClassMethods is confused by the presence of
    default methods in super interfaces
    + JDK-8217429: WebSocket over authenticating proxy fails to
    send Upgrade headers
    + JDK-8217976: test/jdk/java/net/httpclient/websocket/
    /WebSocketProxyTest.java fails intermittently
    + JDK-8218021: Have jarsigner preserve posix permission
    attributes
    + JDK-8218287: jshell tool: input behavior unstable after
    12-ea+24 on Windows
    + JDK-8218851: JVM crash in custom classloader stress test, JDK
    12 &amp; 13
    + JDK-8220420: Cleanup c1_LinearScan
    + JDK-8222072: JVMTI GenerateEvents() sends CompiledMethodLoad
    events to wrong jvmtiEnv
    + JDK-8222286: Fix for JDK-8213419 is broken on s390
    + JDK-8222527: HttpClient doesn't send HOST header when
    tunelling HTTP/1.1 through http proxy
    + JDK-8222533: jtreg test jdk/internal/platform/cgroup/
    /TestCgroupMetrics.java fails on SLES12.3 linux ppc64le
    machine
    + JDK-8224506: [TESTBUG] TestDockerMemoryMetrics.java fails
    with exitValue = 137
    + JDK-8224555: vmTestbase/nsk/jvmti/scenarios/contention/TC02/
    /tc02t001/TestDescription.java failed
    + JDK-8224650: Add tests to support X25519 and X448 in TLS
    + JDK-8225072: Add LuxTrust certificate that is expiring in
    March 2021 to list of allowed but expired certs
    + JDK-8225329: -XX:+PrintBiasedLockingStatistics causes crash
    during initialization on Windows platforms
    + JDK-8225687: Newly added sspi.cpp in JDK-6722928 still
    contains some small errors
    + JDK-8227006: [linux] Runtime.availableProcessors execution
    time increased by factor of 100
    + JDK-8227275: Within native OOM error handling, assertions may
    hang the process
    + JDK-8227647: [Graal] Test8009761.java fails due to
    "RuntimeException: static java.lang.Object
    compiler.uncommontrap.Test8009761.m3(boolean,boolean) not
    compiled"
    + JDK-8229495: SIGILL in C2 generated OSR compilation
    + JDK-8230910: libsspi_bridge does not build on Windows 32bit
    + JDK-8232114: JVM crashed at imjpapi.dll in native code
    + JDK-8234147: Avoid looking up standard charsets in core
    libraries
    + JDK-8234393: [macos] printing ignores printer tray
    + JDK-8234863: Increase default value of MaxInlineLevel
    + JDK-8235218: Minimal VM is broken after JDK-8173361
    + JDK-8235456: Minimal VM is broken after JDK-8212160
    + JDK-8235829: graal crashes with Zombie.java test
    + JDK-8236124: Minimal VM slowdebug build failed after
    JDK-8212160
    + JDK-8236512: PKCS11 Connection closed after Cipher.doFinal
    and NoPadding
    + JDK-8236944: The legVecZ operand should be limited to
    zmm0-zmm15 registers
    + JDK-8237186: Fix typo in copyright header of
    java/io/Reader/TransferTo.java
    + JDK-8237499: JFR: Include stack trace in the ThreadStart event
    + JDK-8237512: AArch64: aarch64TestHook leaks a BufferBlob
    + JDK-8237524: AArch64: String.compareTo() may return incorrect
    result
    + JDK-8237950: C2 compilation fails with "Live Node limit
    exceeded limit" during ConvI2L::Ideal optimization
    + JDK-8238579: HttpsURLConnection drops the timeout and hangs
    forever in read
    + JDK-8239105: Add exception for expiring Digicert root
    certificates to VerifyCACerts test
    + JDK-8239477: jdk/jfr/jcmd/TestJcmdStartStopDefault.java fails
  - XX:+VerifyOops with "verify_oop: rsi: broken oop"
    + JDK-8239497: SEGV in EdgeUtils::field_name_symbol(Edge const&amp;)
    + JDK-8239886: Minimal VM build fails after JDK-8237499
    + JDK-8240633: Memory leaks in the implementations of
    FileChooserUI
    + JDK-8240690: Race condition between EDT and
    BasicDirectoryModel.FilesLoader.run0()
    + JDK-8241234: Unify monitor enter/exit runtime entries.
    + JDK-8241311: Move some charset mapping tests from closed to
    open
    + JDK-8241797: Add some tests to the problem list
    + JDK-8242029: AArch64: skip G1 array copy pre-barrier if
    marking not active
    + JDK-8242335: Additional Tests for RSASSA-PSS
    + JDK-8242480: Negative value may be returned by
    getFreeSwapSpaceSize() in the docker
    + JDK-8242614: cleanup duplicated test ldap server in some
    com/sun/jndi/ldap/ tests
    + JDK-8242846: Bring back test/jdk/tools/jlink/plugins/
    /OrderResourcesPluginTest.java
    + JDK-8243114: Implement montgomery{Multiply,Square}intrinsics
    on Windows
    + JDK-8243290: Improve diagnostic messages for class
    verification and redefinition failures
    + JDK-8243488: Add tests for set/get SendBufferSize and
    getReceiveBufferSize in DatagramSocket
    + JDK-8243549: sun/security/ssl/CipherSuite/
    /NamedGroupsWithCipherSuite.java failed with Unsupported
    signature algorithm: DSA
    + JDK-8243617: compiler/onSpinWait/TestOnSpinWaitC1.java test
    uses wrong class
    + JDK-8243619: compiler/codecache/CheckSegmentedCodeCache.java
    test misses -version
    + JDK-8244142: some hotspot/runtime tests don't check exit code
    of forked JVM
    + JDK-8244278: Excessive code cache flushes and sweeps
    + JDK-8244282: test/hotspot/jtreg/compiler/intrinsics/
    /Test8237524.java fails with --illegal-access=deny
    + JDK-8244621: [macos10.15] Garbled FX printing plus CoreText
    warnings on Catalina when building with Xcode 11
    + JDK-8244819: hsdis does not compile with binutils 2.34+
    + JDK-8245051: c1 is broken if it is compiled by gcc without
  - fno-lifetime-dse
    + JDK-8245168: jlink should not be treated as a "small" tool
    + JDK-8245400: Upgrade to LittleCMS 2.11
    + JDK-8246381: VM crashes with "Current BasicObjectLock* below
    than low_mark"
    + JDK-8246434: Threads::print_on_error assumes that the heap
    has been set up
    + JDK-8246648: issue with OperatingSystemImpl
    getFreeSwapSpaceSize in docker after 8242480
    + JDK-8247201: Print potential pointer value of readable stack
    memory in hs_err file
    + JDK-8247763: assert(outer-&gt;outcnt() == 2) failed: 'only phis'
    failure in LoopNode::verify_strip_mined()
    + JDK-8247867: Upgrade to freetype 2.10.2
    + JDK-8248190: Enable Power10 system and implement new
    byte-reverse instructions
    + JDK-8248226: TestCloneAccessStressGCM fails with
  - XX:-ReduceBulkZeroing
    + JDK-8248347: windows build broken by JDK-8243114
    + JDK-8248532: Every time I change keyboard language at my
    MacBook, Java crashes
    + JDK-8248552: C2 crashes with SIGFPE due to division by zero
    + JDK-8248596: [TESTBUG] compiler/loopopts/
    /PartialPeelingUnswitch.java times out with Graal enabled
    + JDK-8248745: Add jarsigner and keytool tests for restricted
    algorithms
    + JDK-8248791: sun/util/resources/cldr/TimeZoneNamesTest.java
    fails with -XX:-ReduceInitialCardMarks -XX:-ReduceBulkZeroing
    + JDK-8248845: AArch64: stack corruption after spilling vector
    register
    + JDK-8249176: Update GlobalSignR6CA test certificates
    + JDK-8249183: JVM crash in "AwtFrame::WmSize" method
    + JDK-8249192: MonitorInfo stores raw oops across safepoints
    + JDK-8249602: C2: assert(cnt == _outcnt) failed: no insertions
    allowed
    + JDK-8249603: C1: assert(has_error == false) failed: register
    allocation invalid
    + JDK-8249605: C2: assert(no_dead_loop) failed: dead loop
    detected
    + JDK-8249607: C2: assert(!had_error) failed: bad dominance
    + JDK-8249608: Vector register used by C2 compiled method
    corrupted at safepoint
    + JDK-8249672: Include microcode revision in features_string on
    x86
    + JDK-8249748: gtest silently ignores bad jvm arguments
    + JDK-8249821: Separate libharfbuzz from libfontmanager
    + JDK-8250598: Hyper-V is detected in spite of running on host
    OS
    + JDK-8250605: Linux x86_32 builds fail after JDK-8249821
    + JDK-8250636: iso8601_time returns incorrect offset part on
    MacOS
    + JDK-8250665: Wrong translation for the month name of May in
    ar_JO,LB,SY
    + JDK-8250772: Test com/sun/jndi/ldap/
    /NamingExceptionMessageTest.java fails intermittently with
    javax.naming.ServiceUnavailableException
    + JDK-8250825: C2 crashes with assert(field != __null) failed:
    missing field
    + JDK-8250894: Provide a configure option to build and run
    against the platform libharfbuzz
    + JDK-8250928: JFR: Improve hash algorithm for stack traces
    + JDK-8250968: Symlinks attributes not preserved when using
    jarsigner on zip files
    + JDK-8250984: Memory Docker tests fail on some Linux kernels
    w/o cgroupv1 swap limit capabilities
    + JDK-8251118: BiasedLocking::preserve_marks should not have a
    HandleMark
    + JDK-8251189: com/sun/jndi/ldap/LdapDnsProviderTest.java
    failed due to timeout
    + JDK-8251257: NMT: jcmd VM.native_memory scale=1 crashes
    target VM
    + JDK-8251365: Build failure on AIX after 8250636
    + JDK-8251397: NPE on ClassValue.ClassValueMap.cacheArray
    + JDK-8251456: [TESTBUG] compiler/vectorization/
    /TestVectorsNotSavedAtSafepoint.java failed OutOfMemoryError
    + JDK-8251458: Parse::do_lookupswitch fails with "assert(_cnt
    &gt;= 0) failed"
    + JDK-8251535: Partial peeling at unsigned test adds incorrect
    loop exit check
    + JDK-8251949: ZGC: Set explicit heap size for
    compiler/gcbarriers tests
    + JDK-8252090: JFR: StreamWriterHost::write_unbuffered() stucks
    in an infinite loop OpenJDK (build 13.0.1+9)
    + JDK-8252415: Bump update version for OpenJDK: jdk-11.0.10
    + JDK-8252470: java/awt/dnd/DisposeFrameOnDragCrash/
    /DisposeFrameOnDragTest.java fails on Windows
    + JDK-8252497: Incorrect numeric currency code for ROL
    + JDK-8252660: Shenandoah: support manageable SoftMaxHeapSize
    option
    + JDK-8252679: Two windows specific FileDIalog tests may fail
    on some Windows_Server_2016_Standard
    + JDK-8252696: Loop unswitching may cause out of bound array
    load to be executed
    + JDK-8252754: Hash code calculation of JfrStackTrace is
    inconsistent
    + JDK-8253219: Epsilon: clean up unnecessary includes
    + JDK-8253224: Shenandoah: ShenandoahStrDedupQueue destructor
    calls virtual num_queues()
    + JDK-8253226: Shenandoah: remove unimplemented
    ShenandoahStrDedupQueue::verify
    + JDK-8253269: The CheckCommonColors test should provide more
    info on failure
    + JDK-8253284: Zero OrderAccess barrier mappings are incorrect
    + JDK-8253375: OSX build fails with Xcode 12.0 (12A7209)
    + JDK-8253778: ShenandoahSafepoint::is_at_shenandoah_safepoint
    should not access VMThread state from other threads
    + JDK-8253791: Issue with useAppleColor check in CSystemColors.m
    + JDK-8254016: Test8237524 fails with -XX:-CompactStrings option
    + JDK-8254081: java/security/cert/PolicyNode/
    /GetPolicyQualifiers.java fails due to an expired certificate
    + JDK-8254144: Non-x86 Zero builds fail with return-type
    warning in os_linux_zero.cpp
    + JDK-8254166: Zero: return-type warning in
    zeroInterpreter_zero.cpp
    + JDK-8254177: (tz) Upgrade time-zone data to tzdata2020b
    + JDK-8254185: Fix Code cache sweeper heuristics for JDK 11
    + JDK-8254190: [s390] interpreter misses exception check after
    calling monitorenter
    + JDK-8254790: SIGSEGV in string_indexof_char and
    stringL_indexof_char intrinsics
    + JDK-8254854: [cgroups v1] Metric limits not properly detected
    on some join controller combinations
    + JDK-8254982: (tz) Upgrade time-zone data to tzdata2020c
    + JDK-8255050: Add pkcs11/KeyStore/ClientAuth.sh to Problem list
    + JDK-8255065: Zero: accessor_entry misses the IRIW case
    + JDK-8255226: (tz) Upgrade time-zone data to tzdata2020d
    + JDK-8255269: Unsigned overflow in g1Policy.cpp
    + JDK-8255365: Problem list failing client manual tests
    + JDK-8255457: Shenandoah: cleanup ShenandoahMarkTask
    + JDK-8255466: C2 crashes at ciObject::get_oop() const+0x0
    + JDK-8255550: x86: Assembler::cmpq(Address dst, Register src)
    encoding is incorrect
    + JDK-8255603: Memory/Performance regression after JDK-8210985
    + JDK-8255760: Shenandoah: match constants style in
    ShenandoahMarkTask fallback
    + JDK-8255781: Bump patch update version for OpenJDK:
    jdk-11.0.9.1
    + JDK-8255937: Better cleanup for
    test/jdk/javax/imageio/stream/StreamFlush.java
    + JDK-8256427: Test com/sun/jndi/dns/ConfigTests/
    /PortUnreachable.java does not work on AIX
    + JDK-8256452: Integrate missing part of JDK-8232370 to 11u
    + JDK-8256483: [TESTBUG] serviceability/jvmti/GetClassMethods/
    /libOverpassMethods.c fails to compile on gcc 4.4.x
    + JDK-8256557: libharfbuzz fails to link on gcc 4.4.x due to
  - Wl,-z,defs
    + JDK-8256618: Zero: Linux x86_32 build still fails
    + JDK-8256736: Zero: GTest tests fail with "unsuppported vm
    variant"
    + JDK-8256809: Annotation processing causes NPE during flow
    analysis
    + JDK-8257181: s390x builds are very noisy with gc-sections
    messages
    + JDK-8257242: [macOS] Java app crashes while switching input
    methods
    + JDK-8257545: SunJSSE FIPS regression in key exchange after
    JDK-8171279 11u backport
    + JDK-8257641: Shenandoah: Query is_at_shenandoah_safepoint()
    from control thread should return false
    + JDK-8257701: Shenandoah: objArrayKlass metadata is not marked
    with chunked arrays
    + JDK-8258630: Add expiry exception for QuoVadis root
    certificate
- New upstream dependency on libharfbuzz
- Regenerated patches: missing-return.patch system-pcsclite.patch</changelog>
  <changelog author="fstrba@suse.com" date="1616155200">- Added patches:
  * system-crypto-policy.patch
    + Let OpenJDK use system crypto policies unless explicitely told
    not to
  * nss-security-provider.patch
    + Add the NSS security provider with configuration in generated
    nss.cfg file
  * keytool-default-rsa.patch
    + Make keytool generate RSA keys by default, since only the
    LEGACY system crypto policy allows DSA</changelog>
  <changelog author="pujos.michael@gmail.com" date="1618488000">- moved mozilla-nss dependency to java-11-openjdk-headless package
  This is necessary to be able to do crypto with just
  java-11-openjdk-headless installed. Fixes boo#1184606</changelog>
  <changelog author="fstrba@suse.com" date="1619006400">- Update to upstream tag jdk-11.0.11+9 (April 2021, CPU)
  * Security fixes
    + JDK-8244473: Contextualize registration for JNDI
    + JDK-8244543: Enhanced handling of abstract classes
    + JDK-8249906, CVE-2021-2163, bsc#1185055: Enhance opening JARs
    + JDK-8250568, CVE-2021-2161, bsc#1185056: Less ambiguous
    processing
    + JDK-8253799: Make lists of normal filenames
    + JDK-8257001: Improve Http Client Support
  * Other changes
    + JDK-7107012: sun.jvm.hotspot.code.CompressedReadStream
    readDouble() conversion to long mishandled
    + JDK-7146776: deadlock between URLStreamHandler.getHostAddress
    and file.Handler.openconnection
    + JDK-8086003: Test fails on OSX with java.lang.RuntimeException
    'Narrow klass base: 0x0000000000000000, Narrow klass shift: 3'
    missing
    + JDK-8168869: jdeps: localized messages don't use proper line
    breaks
    + JDK-8180837: SunPKCS11-NSS tests failing with
    CKR_ATTRIBUTE_READ_ONLY and CKR_MECHANISM_PARAM_INVALID
    + JDK-8202343: Disable TLS 1.0 and 1.1
    + JDK-8205992: jhsdb cannot attach to Java processes running in
    Docker containers
    + JDK-8209193: Fix aarch64-linux compilation after -Wreorder
    changes
    + JDK-8210413: AArch64: Optimize div/rem by constant in C1
    + JDK-8210578: AArch64: Invalid encoding for fmlsvs instruction
    + JDK-8211051: jdeps usage of --dot-output doesn't provide
    valid output for modular jar
    + JDK-8211057: Gensrc step CompileProperties generates unstable
    CompilerProperties output
    + JDK-8211150: G1 Full GC not purging code root memory and
    hence causing memory leak
    + JDK-8211825: ModuleLayer.defineModulesWithXXX does not setup
    delegation when module reads automatic module
    + JDK-8212043: Add floating-point Math.min/max intrinsics
    + JDK-8212218: [TESTBUG] runtime/ErrorHandling/
    /TestHeapDumpOnOutOfMemoryErrorInMetaspace.java timed out
    + JDK-8213116: javax/swing/JComboBox/WindowsComboBoxSize/
    /WindowsComboBoxSizeTest.java fails in Windows
    + JDK-8213909: jdeps --print-module-deps should report missing
    dependences
    + JDK-8214180: Need better granularity for sleeping
    + JDK-8214223: tools/jdeps/listdeps/ListModuleDeps.java failed
    due to missing Lib2 file
    + JDK-8214230: Classes generated by SystemModulesPlugin.java
    are not reproducable
    + JDK-8214741: docs/index.html has no title or copyright
    + JDK-8215687: [Graal] unit test CheckGraalIntrinsics failed
    after 8212043
    + JDK-8217848: [Graal] vmTestbase/nsk/jvmti/ResourceExhausted/
    /resexhausted003/TestDescription.java fails
    + JDK-8218482: sun/security/krb5/auto/ReplayCachePrecise.java
    failed - no KrbException thrown
    + JDK-8218550: Add test omitted from JDK-8212043
    + JDK-8221584: SIGSEGV in os::PlatformEvent::unpark() in
    JvmtiRawMonitor::raw_exit while posting method exit event
    + JDK-8221995: AARCH64: problems with CAS instructions encoding
    + JDK-8222518: Remove unnecessary caching of Parker object in
    java.lang.Thread
    + JDK-8222785: aarch64: add necessary masking for immediate
    shift counts
    + JDK-8223186: HotSpot compile warnings from GCC 9
    + JDK-8225773: jdeps --check produces NPE if there are missing
    module dependences
    + JDK-8225805: Java Access Bridge does not close the logger
    + JDK-8226810: Failed to launch JVM because of
    NullPointerException occured on System.props
    + JDK-8229396: jdeps ignores multi-release when
    generate-module-info used on command line
    + JDK-8229474: Shenandoah: Cleanup CM::update_roots()
    + JDK-8232225: Rework the fix for JDK-8071483
    + JDK-8232905: JFR fails with assertion:
    assert(t-&gt;unflushed_size() == 0) failed: invariant
    + JDK-8233164: C2 fails with assert(phase-&gt;C-&gt;get_alias_index(t)
    == phase-&gt;C-&gt;get_alias_index(t_adr)) failed: correct memory
    chain
    + JDK-8233910: java/awt/ColorClass/AlphaColorTest.java is
    failing  intermittently in nightly lnux-x64 system
    + JDK-8233912: aarch64: minor improvements of atomic operations
    + JDK-8234508: VM_HeapWalkOperation::iterate_over_object reads
    non-strong fields with an on-strong load barrier
    + JDK-8234742: Improve handshake logging
    + JDK-8234796: Refactor Handshake::execute to take a more
    complex type than ThreadClosure
    + JDK-8235324: Dying objects are published from users of
    CollectedHeap::object_iterate
    + JDK-8235351: Lookup::unreflect should bind with the original
    caller independent of Method's accessible flag
    + JDK-8237369: Shenandoah: failed vmTestbase/nsk/jvmti/
    /AttachOnDemand/attach021/TestDescription.java test
    + JDK-8237392: Shenandoah: Remove unreliable assertion
    + JDK-8237483: AArch64 C1 OopMap inserted twice fatal error
    + JDK-8237495: Java MIDI fails with a dereferenced memory error
    when asked to send a raw 0xF7
    + JDK-8239355: (dc) Initial value of SO_SNDBUF should allow
    sending large datagrams (macOS)
    + JDK-8240353: AArch64: missing support for
  - XX:+ExtendedDTraceProbes in C1
    + JDK-8240704: CheckHandles.java failed "AssertionError: Handle
    use increased by more than 10 percent."
    + JDK-8240751: Shenandoah: fold ShenandoahTracer definition
    + JDK-8240795: [REDO] 8238384 CTW: C2 compilation fails with
    "assert(store != load-&gt;find_exact_control(load-&gt;in(0)))
    failed: dependence cycle found"
    + JDK-8241598: Upgrade JLine to 3.14.0
    + JDK-8241649: Optimize Character.toString
    + JDK-8241770: Module xxxAnnotation() methods throw NCDFE if
    module-info.class found as resource in unnamed module
    + JDK-8241911: AArch64: Fix a potential register clash issue in
    reduce_add2I
    + JDK-8242030: Wrong package declarations in jline classes after
    JDK-8241598
    + JDK-8242565: Policy initialization issues when the denyAfter
    constraint is enabled
    + JDK-8243618: compiler/rtm/cli tests can be run w/o WhiteBox
    + JDK-8243670: Unexpected test result caused by C2
    MergeMemNode::Ideal
    + JDK-8244088: [Regression] Switch of Gnome theme ends up in
    deadlocked UI
    + JDK-8244154: Update SunPKCS11 provider with PKCS11 v3.0 header
    files
    + JDK-8244340: Handshake processing thread lacks yielding
    + JDK-8244573: java.lang.ArrayIndexOutOfBoundsException thrown
    for malformed class file
    + JDK-8244683: A TSA server used by tests
    + JDK-8245005: javax/net/ssl/compatibility/BasicConnectTest.java
    failed with No enum constant
    + JDK-8245026: PsAdaptiveSizePolicy::_old_gen_policy_is_ready is
    unused
    + JDK-8245283: JFR: Can't handle constant dynamic used by Jacoco
    agent
    + JDK-8245512: CRC32 optimization using AVX512 instructions
    + JDK-8245527: LDAP Channel Binding support for Java
    GSS/Kerberos
    + JDK-8246707: (sc) SocketChannel.read/write throws
    AsynchronousCloseException on closed channel
    + JDK-8246709: sun/security/tools/jarsigner/
    /TsacertOptionTest.java compilation failed after JDK-8244683
    + JDK-8247200: assert((unsigned)fpargs &lt; 32)
    + JDK-8247766: [aarch64] guarantee(val &lt; (1U &lt;&lt; nbits))
    failed: Field too big for insn.
    + JDK-8248336: AArch64: C2: offset overflow in
    BoxLockNode::emit
    + JDK-8248865: Document JNDI/LDAP timeout properties
    + JDK-8248901: Signed immediate support in
    .../share/assembler.hpp is broken.
    + JDK-8249543: Force DirectBufferAllocTest to run with
  - ExplicitGCInvokesConcurrent
    + JDK-8249588: libwindowsaccessbridge issues on 64bit Windows
    + JDK-8249749: modify a primitive array through a stream and a
    for cycle causes jre crash
    + JDK-8249787: Make TestGCLocker more resilient with concurrent
    GCs
    + JDK-8249867: xml declaration is not followed by a newline
    + JDK-8250911: [windows] os::pd_map_memory() error detection
    broken
    + JDK-8251255: [linux] Add process-memory information to hs-err
    and VM.info
    + JDK-8251359: Shenandoah: filter null oops before calling
    enqueue/SATB barrier
    + JDK-8251925: C2: RenaissanceStressTest fails with
    assert(!had_error): bad dominance
    + JDK-8251944: Add Shenandoah test config to
    compiler/gcbarriers/UnsafeIntrinsicsTest.java
    + JDK-8251992: VM crashed running TestComplexAddrExpr.java test
    with -XX:UseAVX=X
    + JDK-8253220: Epsilon: clean up unused code/declarations
    + JDK-8253274: The CycleDMImagetest brokes the system
    + JDK-8253353: Crash in C2: guarantee(n != NULL) failed: No Node
    + JDK-8253368: TLS connection always receives close_notify
    exception
    + JDK-8253404: C2: assert(C-&gt;live_nodes() &lt;=
    C-&gt;max_node_limit()) failed: Live Node limit exceeded limit
    + JDK-8253409: Double-rounding possibility in float fma
    + JDK-8253476: TestUseContainerSupport.java fails on some Linux
    kernels w/o swap limit capabilities
    + JDK-8253524: C2: Refactor code that clones predicates during
    loop unswitching
    + JDK-8253644: C2: assert(skeleton_predicate_has_opaque(iff))
    failed: unexpected
    + JDK-8253681: closed java/awt/dnd/MouseEventAfterStartDragTest/
    /MouseEventAfterStartDragTest.html test failed
    + JDK-8253702: BigSur version number reported as 10.16, should
    be 11.nn
    + JDK-8253756: C2 CompilerThread0 crash in Node::add_req(Node*)
    + JDK-8254104: MethodCounters must exist before nmethod is
    installed
    + JDK-8254734: "dead loop detected" assert failure with patch
    from 8223051
    + JDK-8254748: Bad Copyright header format after JDK-8212218
    + JDK-8254799: runtime/ErrorHandling/
    /TestHeapDumpOnOutOfMemoryError.java fails with release VMs
    + JDK-8255058: C1: assert(is_virtual()) failed: type check
    + JDK-8255351: Add detection for Graviton 2 CPUs
    + JDK-8255368: Math.exp() gives wrong result for large values on
    x86 32-bit platforms
    + JDK-8255387: Japanese characters were printed upside down on
    AIX
    + JDK-8255401: Shenandoah: Allow oldval and newval registers to
    overlap in cmpxchg_oop()
    + JDK-8255479: [aarch64] assert(src-&gt;section_index_of(target) ==
    CodeBuffer::SECT_NONE) failed: sanity
    + JDK-8255544: Create a checked cast
    + JDK-8255559: Leak File Descriptors Because of
    ResolverLocalFilesystem#engineResolveURI()
    + JDK-8255681: print callstack in error case in
    runAWTLoopWithApp
    + JDK-8255734: VM should ignore SIGXFSZ on ppc64, s390 too
    + JDK-8255742: PrintInlining as compiler directive doesn't print
    virtual calls
    + JDK-8255845: Memory leak in imageFile.cpp
    + JDK-8255880: UI of Swing components is not redrawn after their
    internal state changed
    + JDK-8255908: ExceptionInInitializerError due to
    UncheckedIOException while initializing cgroupv1 subsystem
    + JDK-8256025: AArch64: MachCallRuntimeNode::ret_addr_offset()
    is incorrect for stub calls
    + JDK-8256056: Deoptimization stub doesn't save vector registers
    on x86
    + JDK-8256061: RegisterSaver::save_live_registers() omits upper
    halves of ZMM0-15 registers
    + JDK-8256187: [TEST_BUG] Automate bug4275046.java test
    + JDK-8256220: C1: x86_32 fails with -XX:UseSSE=1 after
    JDK-8210764 due to mishandled lir_neg
    + JDK-8256258: some missing NULL checks or asserts after
    CodeCache::find_blob_unsafe
    + JDK-8256264: Printed GlyphVector outline with low DPI has bad
    quality on Windows
    + JDK-8256290: javac/lambda/T8031967.java fails with
    StackOverflowError on x86_32
    + JDK-8256359: AArch64: runtime/ReservedStack/
    /ReservedStackTestCompiler.java fails
    + JDK-8256387: Unexpected result if patching an entire
    instruction on AArch64
    + JDK-8256421: Add 2 HARICA roots to cacerts truststore
    + JDK-8256488: [aarch64] Use ldpq/stpq instead of ld4/st4 for
    small copies in StubGenerator::copy_memory
    + JDK-8256489: Make gtest for long path names on Windows more
    resilient in the presence of virus scanners
    + JDK-8256501: libTestMainKeyWindow fails to build with Xcode
    12.2
    + JDK-8256633: Fix product build on Windows+Arm64
    + JDK-8256682: JDK-8202343 is incomplete
    + JDK-8256751: Incremental rebuild with precompiled header fails
    when touching a header file
    + JDK-8256757: Incorrect MachCallRuntimeNode::ret_addr_offset()
    for CallLeafNoFP on x86_32
    + JDK-8256806: Shenandoah: optimize shenandoah/jni/
    /TestPinnedGarbage.java test
    + JDK-8256807: C2: Not marking stores correctly as mismatched
    in string opts
    + JDK-8256810: Incremental rebuild broken on Macosx
    + JDK-8256818: SSLSocket that is never bound or connected leaks
    socket resources
    + JDK-8256888: Client manual test problem list update
    + JDK-8257083: Security infra test failures caused by
    JDK-8202343
    + JDK-8257408: Bump update version for OpenJDK: jdk-11.0.11
    + JDK-8257423: [PPC64] Support -XX:-UseInlineCaches
    + JDK-8257436: [aarch64] Regressions in ArrayCopyUnalignedDst
    .testByte/testChar for 65-78 bytes when UseSIMDForMemoryOps
    is on
    + JDK-8257513: C2: assert((constant_addr -
    _masm.code()-&gt;consts()-&gt;start()) == con.offset())
    + JDK-8257547: Handle multiple prereqs on the same line in deps
    files
    + JDK-8257561: Some code is not vectorized after 8251925 and
    8250607
    + JDK-8257565: epsilonBarrierSet.hpp should not include
    barrierSetAssembler
    + JDK-8257575: C2: "failed: only phis" assert failure in loop
    strip mining verification
    + JDK-8257594: C2 compiled checkcast of non-null object triggers
    endless deoptimization/recompilation cycle
    + JDK-8257633: Missing -mmacosx-version-min=X flag when linking
    libjvm
    + JDK-8257670: sun/security/ssl/SSLSocketImpl/SSLSocketLeak.java
    reports leaks
    + JDK-8257707: Fix incorrect format string in Http1HeaderParser
    + JDK-8257746: Regression introduced with JDK-8250984 - memory
    might be null in some machines
    + JDK-8257798: [PPC64] undefined reference to
    Klass::vtable_start_offset()
    + JDK-8257884: Re-enable sun/security/ssl/SSLSocketImpl/
    /SSLSocketLeak.java as automatic test
    + JDK-8257910: [JVMCI] Set exception_seen accordingly in the
    runtime.
    + JDK-8257997: sun/security/ssl/SSLSocketImpl/SSLSocketLeak.java
    again reports leaks after JDK-8257884
    + JDK-8257999: Parallel GC crash in gc/parallel/
    /TestDynShrinkHeap.java: new region is not in covered_region
    + JDK-8258077: Using -Xcheck:jni can lead to a double-free after
    JDK-8193234
    + JDK-8258247: Couple of issues in fix for JDK-8249906
    + JDK-8258373: Update the text handling in the JPasswordField
    + JDK-8258396: SIGILL in jdk.jfr.internal.PlatformRecorder
    .rotateDisk()
    + JDK-8258419: RSA cipher buffer cleanup
    + JDK-8258471: "search codecache" clhsdb command does not work
    + JDK-8258534: Epsilon: clean up unused includes
    + JDK-8258805: Japanese characters not entered by mouse click
    on Windows 10
    + JDK-8258833: Cancel multi-part cipher operations in SunPKCS11
    after failures
    + JDK-8258836: JNI local refs exceed capacity
    getDiagnosticCommandInfo
    + JDK-8258884: [TEST_BUG] Convert applet-based test
    open/test/jdk/javax/swing/JMenuItem/8031573/bug8031573.java
    to a regular java test
    + JDK-8259007: This test printed a blank page
    + JDK-8259048: (tz) Upgrade time-zone data to tzdata2020f
    + JDK-8259049: Uninitialized variable after JDK-8257513
    + JDK-8259231: Epsilon: improve performance under contention
    during virtual space expansion
    + JDK-8259271: gc/parallel/TestDynShrinkHeap.java still fails
    "assert(covered_region.contains(new_memregion)) failed: new
    region is not in covered_region"
    + JDK-8259312: VerifyCACerts.java fails as soneraclass2ca cert
    will expire in 90 days
    + JDK-8259319: Illegal package access when SunPKCS11 requires
    SunJCE's classes
    + JDK-8259339: AllocateUninitializedArray C2 intrinsic fails
    with void.class input
    + JDK-8259428: AlgorithmId.getEncodedParams() should return copy
    + JDK-8259446: runtime/jni/checked/
    /TestCheckedReleaseArrayElements.java fails with stderr not
    empty
    + JDK-8259451: Zero: skip serviceability/sa tests, set vm.hasSA
    to false
    + JDK-8259580: Shenandoah: uninitialized label in
    VerifyThreadGCState
    + JDK-8259619: C1: 3-arg StubAssembler::call_RT stack-use
    condition is incorrect
    + JDK-8259633: compiler/graalunit/CoreTest.java fails with NPE
    after JDK-8244543
    + JDK-8259706: C2 compilation fails with assert(vtable_index ==
    Method::invalid_vtable_index) failed: correct sentinel value
    + JDK-8259707: LDAP channel binding does not work with StartTLS
    extension
    + JDK-8259773: Incorrect encoding of AVX-512 kmovq instruction
    + JDK-8259849: Shenandoah: Rename store-val to IU-barrier
    + JDK-8259949: x86 32-bit build fails when -fcf-protection is
    passed in the compiler flags
    + JDK-8259954: gc/shenandoah/mxbeans tests fail with -Xcomp
    + JDK-8260029: aarch64: fix typo in verify_oop_array
    + JDK-8260308: Update LogCompilation junit to 4.13.1
    + JDK-8260338: Some fields in HaltNode is not cloned
    + JDK-8260349: Cannot programmatically retrieve Metaspace max
    set via JAVA_TOOL_OPTIONS
    + JDK-8260356: (tz) Upgrade time-zone data to tzdata2021a
    + JDK-8260378: [TESTBUG] DcmdMBeanTestCheckJni.java reports
    false positive
    + JDK-8260497: Shenandoah: Improve SATB flushing
    + JDK-8260502: [s390] NativeMovRegMem::verify() fails because
    it's too strict
    + JDK-8260632: Build failures after JDK-8253353
    + JDK-8260704: ParallelGC: oldgen expansion needs release-store
    for _end
    + JDK-8261022: Fix incorrect result of Math.abs() with char type
    + JDK-8261089: [TESTBUG] native library of test
    TestCheckedReleaseCriticalArray.java fails to compile with
    gcc 4.x
    + JDK-8261183: Follow on to Make lists of normal filenames
    + JDK-8261209: isStandalone property: remove dependency on
    pretty-print
    + JDK-8261231: Windows IME was disabled after DnD operation
    + JDK-8261251: Shenandoah: Use object size for full GC
    humongous compaction
    + JDK-8261310: PPC64 Zero build fails with
    'VMError::controlled_crash(int)::FunctionDescriptor
    functionDescriptor' has incomplete type and cannot be defined
    + JDK-8261334: NMT: tuning statistic shows incorrect hash
    distribution
    + JDK-8261413: Shenandoah: Disable class-unloading in I-U mode
    + JDK-8261522: [PPC64] AES intrinsics write beyond the
    destination array
    + JDK-8261534: Test sun/security/pkcs11/KeyAgreement/
    /IllegalPackageAccess.java fails on platforms where no nsslib
    artifacts are defined
    + JDK-8261585: Restore HandleArea used in
    Deoptimization::uncommon_trap
    + JDK-8261753: Test java/lang/System/OsVersionTest.java still
    failing on BigSur patch versions after JDK-8253702
    + JDK-8261829: Exclude tools/jlink/JLinkReproducibleTest.java
    in 11u
    + JDK-8261912: Code IfNode::fold_compares_helper more
    defensively
    + JDK-8261920: [AIX] jshell command throws java.io.IOError on
    non English locales
    + JDK-8262018: Wrong format in SAP copyright header of
    OsVersionTest
    + JDK-8263069: Exclude some failing tests from
    security/infra/java/security/cert/CertPathValidator</changelog>
  <changelog author="fstrba@suse.com" date="1620043200">- Remove all Jpackage provides for SLE12 in order to avoid
  installing this package as default Java on SLE12-SP5
  (bsc#1185476)</changelog>
  <changelog author="fstrba@suse.com" date="1621512000">- Modified patch:
  * nss-security-provider.patch
    + make the NSS provider first in the list</changelog>
  <changelog author="fstrba@suse.com" date="1626868800">- Update to upstream tag jdk-11.0.12+7 (July 2021, CPU)
  * Security fixes
    + JDK-8256157: Improve bytecode assembly
    + JDK-8256491: Better HTTP transport
    + JDK-8258432, CVE-2021-2341, bsc#1188564: Improve file
    transfers
    + JDK-8260453: Improve Font Bounding
    + JDK-8260960: Signs of jarsigner signing
    + JDK-8260967, CVE-2021-2369, bsc#1188565: Better jar file
    validation
    + JDK-8262380: Enhance XML processing passes
    + JDK-8262403: Enhanced data transfer
    + JDK-8262410: Enhanced rules for zones
    + JDK-8262477: Enhance String Conclusions
    + JDK-8262967: Improve Zip file support
    + JDK-8264066, CVE-2021-2388, bsc#1188566: Enhance compiler
    validation
    + JDK-8264079: Improve abstractions
    + JDK-8264460: Improve NTLM support
  * Other changes
    + JDK-6847157: java.lang.NullPointerException: HDC for
    component at sun.java2d.loops.Blit.Blit
    + JDK-7106851: Test should not use System.exit
    + JDK-8073446: TimeZone getOffset API does not  return a dst
    offset between years 2038-2137
    + JDK-8076190: Customizing the generation of a PKCS12 keystore
    + JDK-8153005: Upgrade the default PKCS12 encryption/MAC
    algorithms
    + JDK-8171303: sun/java2d/pipe/InterpolationQualityTest.java
    fails on Windows &amp; Linux
    + JDK-8177068: incomplete classpath causes NPE in Flow
    + JDK-8185734: [Windows] Structured Exception Catcher missing
    around gtest execution
    + JDK-8187450: JNI local refs exceeds capacity warning in
    NetworkInterface::getAll
    + JDK-8190763: Class cast exception on (CompoundEdit)
    UndoableEditEvent.getEdit()
    + JDK-8195841: PNGImageReader.readNullTerminatedString() doesnt
    check for non-null terminated strings with length equal to
    maxLen
    + JDK-8196100: javax/swing/text/JTextComponent/5074573/
    /bug5074573.java fails
    + JDK-8199646: JShell tests: jdk/jshell/
    /FailOverDirectExecutionControlTest.java failed with
    java.lang.UnsupportedOperationException
    + JDK-8206925: Support the certificate_authorities extension
    + JDK-8207160: ClassReader::adjustMethodParams can potentially
    return null if the args list is empty
    + JDK-8207247: AARCH64: Enable Minimal and Client VM builds
    + JDK-8207404: MulticastSocket tests failing on AIX
    + JDK-8207779: Method::is_valid_method() compares 'this' with
    NULL
    + JDK-8208061: runtime/LoadClass/TestResize.java fails with
    "Load factor too high" when running in CDS mode.
    + JDK-8209459: TestSHA512MultiBlockIntrinsics failed on AArch64
    + JDK-8210443: Migrate Locale matching tests to JDK Repo.
    + JDK-8213231: ThreadSnapshot::_threadObj can become stale
    + JDK-8213483: ARM32: runtime/ErrorHandling/
    /ShowRegistersOnAssertTest.java jtreg test fail
    + JDK-8213725: JShell NullPointerException due to class file
    with unexpected package
    + JDK-8213794: ARM32: disable TypeProfiling,
    CriticalJNINatives, Serviceablity tests for ARM32
    + JDK-8213845: ARM32: Interpreter doesn't call result handler
    after native calls
    + JDK-8214128: ARM32: wrong stack alignment on
    Deoptimization::unpack_frames
    + JDK-8214512: ARM32: Jtreg test compiler/c2/Test8062950.java
    fails on ARM
    + JDK-8214854: JDWP: Unforseen output truncation in logging
    + JDK-8214922: Add vectorization support for fmin/fmax
    + JDK-8215009: GCC 8 compilation error in libjli
    + JDK-8216184: CDS/appCDS tests failed on Windows due to long
    path to a classlist file
    + JDK-8216259: AArch64: Vectorize Adler32 intrinsics
    + JDK-8216314: SIGILL in CodeHeapState::print_names()
    + JDK-8217348: assert(thread-&gt;is_Java_thread()) failed: just
    checking
    + JDK-8217465: [REDO] - Optimize CodeHeap Analytics
    + JDK-8217561: X86: Add floating-point Math.min/max intrinsics
    + JDK-8217918: C2: -XX:+AggressiveUnboxing is broken
    + JDK-8218458: [TESTBUG] runtime/NMT/
    /CheckForProperDetailStackTrace.java fails with Expected
    stack trace missing from output
    + JDK-8219142: Remove unused JIMAGE_ResourcePath
    + JDK-8219586: CodeHeap State Analytics processes dead nmethods
    + JDK-8220074: Clean up GCC 8.3 errors in LittleCMS
    + JDK-8220407: compiler/intrinsics/math/
    /TestFpMinMaxIntrinsics.java timedout
    + JDK-8222302: [TESTBUG] test/hotspot/jtreg/compiler/intrinsics/
    /sha/cli/TestUseSHAOptionOnUnsupportedCPU.java fails on any
    other CPU
    + JDK-8222412: AARCH64: multiple instructions encoding issues
    + JDK-8223020: aarch64: expand minI_rReg and maxI_rReg patterns
    into separate instructions
    + JDK-8223444: Improve CodeHeap Free Space Management
    + JDK-8223504: Improve performance of forall loops by better
    inlining of "iterator()" methods
    + JDK-8223667: ASAN build broken
    + JDK-8225081: Remove Telia Company CA certificate expiring in
    April 2021
    + JDK-8225116: Test OwnedWindowsLeak.java intermittently fails
    + JDK-8225438: javax/net/ssl/TLSCommon/
    /TestSessionLocalPrincipal.java failed with Read timed out
    + JDK-8225756: [testbug] compiler/loopstripmining/
    /CheckLoopStripMining.java sets too short a
    SafepointTimeoutDelay
    + JDK-8226374: Restrict TLS signature schemes and named groups
    + JDK-8226627: assert(t-&gt;singleton()) failed: must be a constant
    + JDK-8226721: Missing intrinsics for Math.ceil, floor, rint
    + JDK-8227080: (fs) Files.newInputStream(...).skip(n) is slow
    + JDK-8227222: vmTestbase/jit/FloatingPoint/gen_math/Loops04/
    /Loops04.java failed XMM register should be 0-15
    + JDK-8227609: (fs) Files.newInputStream(...).skip(n) should
    allow skipping beyond file size
    + JDK-8230428: Cleanup dead CastIP node code in formssel.cpp
    + JDK-8231460: Performance issue (CodeHeap) with large free
    blocks
    + JDK-8231713: x86_32 build failures after JDK-8226721 (Missing
    intrinsics for Math.ceil, floor, rint)
    + JDK-8231841: AArch64: debug.cpp help() is missing an AArch64
    line for pns
    + JDK-8232084: HotSpot build failed with GCC 9.2.1
    + JDK-8232591: AArch64: Add missing match rules for smaddl,
    smsubl and smnegl
    + JDK-8233185: HttpServer.stop() blocks indefinitely when
    called on dispatch thread
    + JDK-8233787: Break cycle in vm_version* includes
    + JDK-8233948: AArch64: Incorrect mapping between OptoReg and
    VMReg for high 64 bits of Vector Register
    + JDK-8234355: Buffer overflow in jcmd GC.class_stats due to
    too many classes
    + JDK-8235368: Update BCEL to Version 6.4.1
    + JDK-8236859: WebSocket over authenticating proxy fails with
    NPE
    + JDK-8236992: AArch64: remove redundant load_klass in itable
    stub
    + JDK-8237743: test/langtools/jdk/jshell/
    /FailOverExecutionControlTest.java fails No
    ExecutionControlProvider with name 'nonExistent' and parameter
    keys: []
    + JDK-8237804: sun/security/mscapi tests fail with "Key pair
    not generated, alias &lt;nnnnnn&gt; already exists"
    + JDK-8238175: CTW: Class.getDeclaredMethods fails with
    assert(k-&gt;is_subclass_of(SystemDictionary::Throwable_klass()))
    failed: invalid exception class
    + JDK-8238567: SoftMainMixer.processAudioBuffers(): Wrong
    handling of stoppedMixers
    + JDK-8238812: assert(false) failed: bad AD file
    + JDK-8239312: [macos] javax/swing/JFrame/NSTexturedJFrame/
    /NSTexturedJFrame.java
    + JDK-8239386: handle ContendedPaddingWidth in
    vm_version_aarch64
    + JDK-8239536: Can't use 'java.util.List' object after
    importing 'java.awt.List'
    + JDK-8240487: Cleanup whitespace in .cc, .hh, .m, and .mm files
    + JDK-8240848: ArrayIndexOutOfBoundsException buf for
    TextCallbackHandler
    + JDK-8241082: Upgrade IANA Language Subtag Registry data to
    03-16-2020 version
    + JDK-8241087: Build failure with VS 2019 (16.5.0) due to C2039
    and C2873
    + JDK-8241101: [s390] jtreg test failure after JDK-8238696: not
    conformant features string
    + JDK-8241248: NullPointerException in
    sun.security.ssl.HKDF.extract(HKDF.java:93)
    + JDK-8241372: Several test failures due to
    javax.net.ssl.SSLException: Connection reset
    + JDK-8241475: AArch64: Add missing support for PopCountVI node
    + JDK-8241829: Cleanup the code for PrinterJob on windows
    + JDK-8241960: The SHA3 message digests impl of SUN provider
    are not thread safe after cloned
    + JDK-8242010: Upgrade IANA Language Subtag Registry to Version
    2020-04-01
    + JDK-8242429: Better implementation for sign extract
    + JDK-8242557: Add length limit for strings in PNGImageWriter
    + JDK-8242919: Paste locks up jshell
    + JDK-8243155: AArch64: Add support for SqrtVF
    + JDK-8243240: AArch64: Add support for MulVB
    + JDK-8243452: JFR: Could not create chunk in repository with
    over 200 recordings
    + JDK-8243559: Remove root certificates with 1024-bit keys
    + JDK-8243597: AArch64: Add support for integer vector abs
    + JDK-8244031: HttpClient should have more tests for HEAD
    requests
    + JDK-8244205: HTTP/2 tunnel connections through proxy may be
    reused regardless of which proxy is selected
    + JDK-8244847: Linux/PPC: runtime/CompressedOops/
    /CompressedClassPointers: smallHeapTest fails
    + JDK-8245511: G1 adaptive IHOP does not account for
    reclamation of humongous objects by young GC
    + JDK-8246274: G1 old gen allocation tracking is not in a
    separate class
    + JDK-8247354: [aarch64] PopFrame causes
    assert(oopDesc::is_oop(obj)) failed: not an oop
    + JDK-8247408: IdealGraph bit check expression canonicalization
    + JDK-8247432: Update IANA Language Subtag Registry to Version
    2020-09-29
    + JDK-8247438: JShell: When FailOverExecutionControlProvider
    fails the proximal cause is not shown
    + JDK-8247753: UIManager.getSytemLookAndFeelClassName() returns
    wrong value on Fedora 32
    + JDK-8248043: Need to eliminate excessive i2l conversions
    + JDK-8248411: [aarch64] Insufficient error handling when
    CodeBuffer is exhausted
    + JDK-8248568: compiler/c2/TestBit.java failed: test missing
    from stdout/stderr
    + JDK-8248870: AARCH64: I2L/L2I conversions can be skipped for
    masked positive values
    + JDK-8249142: java/awt/FontClass/CreateFont/DeleteFont.sh is
    unstable
    + JDK-8249189: AARCH64: more L2I conversions can be skipped
    + JDK-8249719: MethodHandle performance suffers from bad
    ResolvedMethodTable hash function
    + JDK-8249875: GCC 10 warnings -Wtype-limits with JFR code
    + JDK-8250635: MethodArityHistogram should use Compile_lock in
    favour of fancy checks
    + JDK-8250876: Fix issues with cross-compile on macos
    + JDK-8251031: Some vmTestbase/nsk/monitoring/RuntimeMXBean
    tests fail with hostnames starting from digits
    + JDK-8251525: AARCH64: Faster Math.signum(fp)
    + JDK-8252259: AArch64: Adjust default value of FLOATPRESSURE
    + JDK-8252311: AArch64: save two words in itable lookup stub
    + JDK-8252779: compiler/graalunit/HotspotTest.java failed after
    8251525
    + JDK-8252883: AccessDeniedException caused by delayed file
    deletion on Windows
    + JDK-8253167: ARM32 builds fail after JDK-8247910
    + JDK-8253572: [windows] CDS archive may fail to open with long
    file names
    + JDK-8253923: C2 doesn't always run loop opts for compilations
    that include loops
    + JDK-8253948: Memory leak in ImageFileReader
    + JDK-8254631: Better support ALPN byte wire values in SunJSSE
    + JDK-8254717: isAssignableFrom checks in
    KeyFactorySpi.engineGetKeySpec appear to be backwards
    + JDK-8255086: Update the root locale display names
    + JDK-8255625: AArch64: Implement Base64.encodeBlock
    accelerator/intrinsic
    + JDK-8255763: C2: OSR miscompilation caused by invalid memory
    instruction placement
    + JDK-8255992: JFR EventWriter does not use first string from
    StringPool with id 0
    + JDK-8256037: [TESTBUG] com/sun/jndi/dns/ConfigTests/
    /PortUnreachable.java fails due to the hard coded threshold
    is small
    + JDK-8256244: java/lang/ProcessHandle/PermissionTest.java
    fails with TestNG 7.1
    + JDK-8256287: [windows] add loop fuse to
    map_or_reserve_memory_aligned
    + JDK-8256523: Streamline Java SHA2 implementation
    + JDK-8257414: Drag n Drop target area is wrong on high DPI
    systems
    + JDK-8257569: Failure observed with
    JfrVirtualMemory::initialize
    + JDK-8257574: C2: "failed: parsing found no loops but there
    are some" assert failure
    + JDK-8257580: Bump update version for OpenJDK: jdk-11.0.12
    + JDK-8257604: JNI_ArgumentPusherVaArg leaks valist
    + JDK-8257621: JFR StringPool misses cached items across
    consecutive recordings
    + JDK-8257796: [TESTBUG]
    TestUseSHA512IntrinsicsOptionOnSupportedCPU.java fails
    on x86_32
    + JDK-8257822: C2 crashes with SIGFPE due to a division that
    floats above its zero check
    + JDK-8257828: SafeFetch may crash if invoked in non-JavaThreads
    + JDK-8257853: Remove dependencies on JNF's JNI utility
    functions in AWT and 2D code
    + JDK-8257858: [macOS]: Remove JNF dependency from
    libosxsecurity/KeystoreImpl.m
    + JDK-8257860: [macOS]: Remove JNF dependency from
    libosxkrb5/SCDynamicStoreConfig.m
    + JDK-8257988: Remove JNF dependency from
    libsaproc/MacosxDebuggerLocal.m
    + JDK-8258414: OldObjectSample events too expensive
    + JDK-8258505: [TESTBUG] TestDivZeroWithSplitIf.java fails due
    to missing UnlockDiagnosticVMOptions
    + JDK-8258753: StartTlsResponse.close() hangs due to
    synchronization issues
    + JDK-8259061: C2: assert(found) failed: memory-writing node is
    not placed in its original loop or an ancestor of it
    + JDK-8259227: C2 crashes with SIGFPE due to a division that
    floats above its zero check
    + JDK-8259232: Bad JNI lookup during printing
    + JDK-8259276: C2: Empty expression stack when reexecuting
    tableswitch/lookupswitch instructions after deoptimization
    + JDK-8259343: [macOS] Update JNI error handling in Cocoa code.
    + JDK-8259585: Accessible actions do not work on mac os x
    + JDK-8259651: [macOS] Replace JNF_COCOA_ENTER/EXIT macros
    + JDK-8259662: Don't wrap SocketExceptions into SSLExceptions
    in SSLSocketImpl
    + JDK-8259710: Inlining trace leaks memory
    + JDK-8259729: Missed JNFInstanceOf -&gt; IsInstanceOf conversion
    + JDK-8259777: Incorrect predication condition generated by ADLC
    + JDK-8259786: initialize last parameter of getpwuid_r
    + JDK-8259843: initialize dli_fname array before calling
    dll_address_to_library_name
    + JDK-8259869: [macOS] Remove desktop module dependencies on
    JNF Reference APIs
    + JDK-8259886: Improve SSL session cache performance and
    scalability
    + JDK-8259983: do not use uninitialized expand_ms value in
    G1CollectedHeap::expand_heap_after_young_collection
    + JDK-8260030: Improve stringStream buffer handling
    + JDK-8260236: better init AnnotationCollector _contended_group
    + JDK-8260255: C1: LoopInvariantCodeMotion constructor can
    leave some fields uninitialized
    + JDK-8260284: C2: assert(_base == Int) failed: Not an Int
    + JDK-8260380: Upgrade to LittleCMS 2.12
    + JDK-8260420: C2 compilation fails with assert(found_sfpt)
    failed: no node in loop that's not input to safepoint
    + JDK-8260426: awt debug_mem.c DMem_AllocateBlock might leak
    memory
    + JDK-8260432: allocateSpaceForGP in freetypeScaler.c might
    leak memory
    + JDK-8260616: Removing remaining JNF dependencies in the
    java.desktop module
    + JDK-8260653: Unreachable nodes keep speculative types alive
    + JDK-8260707: java/lang/instrument/PremainClass/
    /InheritAgent0100.java times out
    + JDK-8260925: HttpsURLConnection does not work  with other
    JSSE provider.
    + JDK-8260926: Trace resource exhausted events unconditionally
    + JDK-8261020: Wrong format parameter in
    create_emergency_chunk_path
    + JDK-8261027: AArch64: Support for LSE atomics C++ HotSpot code
    + JDK-8261167: print_process_memory_info add a close call after
    fopen
    + JDK-8261170: Upgrade to freetype 2.10.4
    + JDK-8261198: [macOS] Incorrect JNI parameters in number
    conversion in A11Y code
    + JDK-8261235: C1 compilation fails with
    assert(res-&gt;vreg_number() == index) failed: conversion check
    + JDK-8261261: The version extra fields needs to be overridable
    in jib-profiles.js
    + JDK-8261262: Kitchensink24HStress.java crashed with
    EXCEPTION_ACCESS_VIOLATION
    + JDK-8261354: SIGSEGV at MethodIteratorHost
    + JDK-8261355: No data buffering in SunPKCS11 Cipher encryption
    when the underlying mechanism has no padding
    + JDK-8261397: try catch Method failing to work when dividing
    an integer by 0
    + JDK-8261422: Adjust problematic String.format calls in
    jdk/internal/util/Preconditions.java outOfBoundsMessage
    + JDK-8261447: MethodInvocationCounters frequently run into
    overflow
    + JDK-8261481: Cannot read Kerberos settings in dynamic store
    on macOS Big Sur
    + JDK-8261505: Test test/hotspot/jtreg/gc/parallel/
    /TestDynShrinkHeap.java killed by Linux OOM Killer
    + JDK-8261601: free memory in early return in
    Java_sun_nio_ch_sctp_SctpChannelImpl_receive0
    + JDK-8261649: AArch64: Optimize LSE atomics in C++ code
    + JDK-8261730: C2 compilation fails with
    assert(store-&gt;find_edge(load) != -1) failed: missing
    precedence edge
    + JDK-8261752: Multiple GC test are missing memory requirements
    + JDK-8261791: (sctp) handleSendFailed in SctpChannelImpl.c
    potential leaks
    + JDK-8261812: C2 compilation fails with assert(!had_error)
    failed: bad dominance
    + JDK-8261914: IfNode::fold_compares_helper faces
    non-canonicalized bool when running JRuby JSON workload
    + JDK-8262093: java/util/concurrent/tck/JSR166TestCase.java
    failed "assert(false) failed: unexpected node"
    + JDK-8262110: DST starts from incorrect time in 2038
    + JDK-8262121: [11u] Redo 8244287: JFR: Methods samples have
    line number 0
    + JDK-8262163: Extend settings printout in jcmd VM.metaspace
    + JDK-8262295: C2: Out-of-Bounds Array Load from Clone Source
    + JDK-8262298: G1BarrierSetC2::step_over_gc_barrier fails with
    assert "bad barrier shape"
    + JDK-8262446: DragAndDrop hangs on Windows
    + JDK-8262461: handle wcstombsdmp return value correctly in
    unix awt_InputMethod.c
    + JDK-8262465: Very long compilation times and high memory
    consumption in C2 debug builds
    + JDK-8262726: AArch64: C1 StubAssembler::call_RT can corrupt
    stack
    + JDK-8262739: String inflation C2 intrinsic prevents insertion
    of anti-dependencies
    + JDK-8262829: Native crash in
    Win32PrintServiceLookup.getAllPrinterNames()
    + JDK-8262837: handle split_USE correctly
    + JDK-8262900: ToolBasicTest fails to access HTTP server it
    starts
    + JDK-8263260: [s390] Support latest hardware (z14 and z15)
    + JDK-8263311: Watch registry changes for remote printers
    update instead of polling
    + JDK-8263361: Incorrect arraycopy stub selected by C2 for SATB
    collectors
    + JDK-8263404: RsaPrivateKeySpec is always recognized as
    RSAPrivateCrtKeySpec in RSAKeyFactory.engineGetKeySpec
    + JDK-8263425: AArch64: two potential bugs in C1
    LIRGenerator::generate_address()
    + JDK-8263448: CTW: fatal error: meet not symmetric
    + JDK-8263504: Some OutputMachOpcodes fields are uninitialized
    + JDK-8263557: Possible NULL dereference in
    Arena::destruct_contents()
    + JDK-8263558: Possible NULL dereference in fast path arena
    free if ZapResourceArea is true
    + JDK-8263676: AArch64: one potential bug in C1
    LIRGenerator::generate_address()
    + JDK-8263729: [test] divert spurious output away from stream
    under test in ProcessBuilder Basic test
    + JDK-8263846: Bad JNI lookup getFocusOwner in accessibility
    code on Mac OS X
    + JDK-8264047: Duplicate global variable 'jvm' in libjavajpeg
    and libawt
    + JDK-8264096: slowdebug jvm crashes when StrInflatedCopy match
    rule is not supported
    + JDK-8264151: ciMethod::ensure_method_data() should return
    false is loading resulted in empty state
    + JDK-8264173: [s390] Improve Hardware Feature Detection And
    Reporting
    + JDK-8264190: Harden TLS interop tests
    + JDK-8264223: CodeHeap::verify fails extra_hops assertion in
    fastdebug test
    + JDK-8264328: Broken license in
    javax/swing/JComboBox/8072767/bug8072767.java
    + JDK-8264360: Loop strip mining verification fails with
    "should be on the backedge"
    + JDK-8264626: C1 should be able to inline excluded methods
    + JDK-8264640: CMS ParScanClosure misses a barrier
    + JDK-8264786: [macos] All Swing/AWT apps cause Allow
    Notifications prompt to appear when app is launched
    + JDK-8264821: DirectIOTest fails on a system with large block
    size
    + JDK-8264848: [macos] libjvm.dylib linker warning due to macOS
    version mismatch
    + JDK-8264923: PNGImageWriter.write_zTXt throws Exception with
    a typo
    + JDK-8264958: C2 compilation fails with assert "n is later
    than its clone"
    + JDK-8265099: Revert backport to 11u of 8236859: WebSocket
    over authenticating proxy fails with NPE
    + JDK-8265154: vinserti128 operand mix up for KNL platforms
    + JDK-8265239: Shenandoah: Shenandoah heap region count could
    be off by 1
    + JDK-8265417: Backport of JDK-8249672 breaks Solaris x86 build
    + JDK-8265421: java/lang/String/StringRepeat.java test is
    missing a memory requirement
    + JDK-8265462: Handle multiple slots in the NSS Internal Module
    from SunPKCS11's Secmod
    + JDK-8265537: x86 version string truncated after JDK-8249672
    11u backport
    + JDK-8265666: Enable AIX build platform to make external debug
    symbols
    + JDK-8265677: CMS: CardTableBarrierSet::write_ref_array_work()
    lacks storestore barrier
    + JDK-8265690: Use the latest Ubuntu base image version in
    Docker testing
    + JDK-8265718: Build failure after JDK-8258414 11u backport
    + JDK-8265750: Fatal error in safepoint.cpp after backport of
    8258414
    + JDK-8265784: [C2] Hoisting of DecodeN leaves MachTemp inputs
    behind
    + JDK-8265938: C2's conditional move optimization does not
    handle top Phi
    + JDK-8266220: keytool still prompt for store password on a
    password-less pkcs12 file if -storetype pkcs12 is specified
    + JDK-8266293: Key protection using PBEWithMD5AndDES fails with
    "java.security.InvalidAlgorithmParameterException: Salt must
    be 8 bytes long"
    + JDK-8266713: [AIX] Build failure after 11u backport of
    JDK-8247753
    + JDK-8266802: Shenandoah: Round up region size to page size
    unconditionally
    + JDK-8266892: avoid maybe-uninitialized gcc warnings on linux
    s390x
    + JDK-8266929: Unable to use algorithms from 3p providers
    + JDK-8267235: [macos_aarch64]
    InterpreterRuntime::throw_pending_exception messing up LR
    results in crash
    + JDK-8267561: Shenandoah: Reference processing not properly
    setup for outside of cycle degenerated GC
    + JDK-8267599: Revert the change to the default PKCS12
    macAlgorithm and macIterationCount props for 11u/8u/7u
    + JDK-8267641: [11u] 8227609 backport typo
    + JDK-8267721: Enable sun/security/pkcs11 tests for Amazon
    Linux 2 AArch64
    + JDK-8268678: LetsEncryptCA.java test fails as Let's Encrypt
    Authority X3 is retired</changelog>
  <changelog author="schwab@suse.de" date="1628078400">- riscv64-zero.patch: Add support for riscv64 (zero VM)</changelog>
  <changelog author="fstrba@suse.com" date="1629979200">- Added patch:
  * jdk11-glibc234.patch
    + fix build with glibc-2.34 (bsc#1189201)</changelog>
  <changelog author="fstrba@suse.com" date="1631534400">- Modified patch:
  * nss-security-provider.patch
    + revert recent changes making NSS provider the default one
    + fixes bsc#1190252</changelog>
  <changelog author="fstrba@suse.com" date="1631793600">- Added patch:
  * fips.patch
    + implement FIPS support in OpenJDK</changelog>
  <changelog author="fstrba@suse.com" date="1634817600">- Update to upstream tag jdk-11.0.13+8 (October 2021 CPU)
  * Security fixes
    + JDK-8163326, CVE-2021-35550, bsc#1191901: Update the default
    enabled cipher suites preference
    + JDK-8254967, CVE-2021-35565, bsc#1191909:
    com.sun.net.HttpsServer spins on TLS session close
    + JDK-8263314: Enhance XML Dsig modes
    + JDK-8265167, CVE-2021-35556, bsc#1191910: Richer Text Editors
    + JDK-8265574: Improve handling of sheets
    + JDK-8265580, CVE-2021-35559, bsc#1191911: Enhanced style for
    RTF kit
    + JDK-8265776: Improve Stream handling for SSL
    + JDK-8266097, CVE-2021-35561, bsc#1191912: Better hashing
    support
    + JDK-8266103: Better specified spec values
    + JDK-8266109: More Resilient Classloading
    + JDK-8266115: More Manifest Jar Loading
    + JDK-8266137, CVE-2021-35564, bsc#1191913: Improve Keystore
    integrity
    + JDK-8266689, CVE-2021-35567, bsc#1191903: More Constrained
    Delegation
    + JDK-8267086: ArrayIndexOutOfBoundsException in
    java.security.KeyFactory.generatePublic
    + JDK-8267712: Better LDAP reference processing
    + JDK-8267729, CVE-2021-35578, bsc#1191904: Improve TLS client
    handshaking
    + JDK-8267735, CVE-2021-35586, bsc#1191914: Better BMP support
    + JDK-8268193: Improve requests of certificates
    + JDK-8268199: Correct certificate requests
    + JDK-8268205: Enhance DTLS client handshake
    + JDK-8268506: More Manifest Digests
    + JDK-8269618, CVE-2021-35603, bsc#1191906: Better session
    identification
    + JDK-8269624: Enhance method selection support
    + JDK-8270398: Enhance canonicalization
    + JDK-8270404: Better canonicalization
  * Other changes
    + JDK-8024368: private methods are allocated vtable indices
    + JDK-8042902: Test java/net/Inet6Address/serialize/
    /Inet6AddressSerializationTest.java fails intermittently
    + JDK-8140466: ChaCha20 and Poly1305 TLS Cipher Suites
    + JDK-8157404: Unable to read certain PKCS12 keystores from
    SequenceInputStream
    + JDK-8158066: SourceDebugExtensionTest fails to rename file
    + JDK-8168304: Make all of DependencyContext_test available in
    product mode
    + JDK-8169246: java/net/DatagramSocket/ReportSocketClosed.java
    fails intermittently with BindException
    + JDK-8181313: SA: Remove libthread_db dependency on Linux
    + JDK-8193214: Incorrect annotations.without.processors
    warnings with JDK 9
    + JDK-8194230: jdk/internal/jrtfs/remote/
    /RemoteRuntimeImageTest.java fails with
    java.lang.NullPointerException
    + JDK-8196092: javax/swing/JComboBox/8032878/bug8032878.java
    fails
    + JDK-8199931: java/net/MulticastSocket/
    /UnreferencedMulticastSockets.java fails with "incorrect data
    received"
    + JDK-8206083: Make tools/javac/api/T6265137.java robust to JDK
    version changes
    + JDK-8206350: java/util/Locale/bcp47u/SystemPropertyTests.java
    failed on Mac 10.13 with zh_CN and zh_TW locales.
    + JDK-8207316: java/nio/channels/spi/SelectorProvider/
    /inheritedChannel/InheritedChannelTest.java failed
    + JDK-8208227: tools/jdeps/DotFileTest.java fails on Win-X64
    + JDK-8208363: test/jdk/java/lang/Package/
    /PackageFromManifest.java missing module dependencies
    declaration
    + JDK-8209380: ARM: cleanup maybe-uninitialized and reorder
    compiler warnings
    + JDK-8209768: Refactor java/util/prefs/CheckUserPrefsStorage.sh
    to plain java test
    + JDK-8209772: Refactor shell test java/util/ServiceLoader/
    /basic/basic.sh to java
    + JDK-8209773: Refactor shell test javax/naming/module/basic.sh
    to java
    + JDK-8209832: Refactor jdk/internal/reflect/Reflection/
    /GetCallerClassTest.sh to plain java test
    + JDK-8209930: Refactor java/util/zip/ZipFile/deletetempjar.sh
    to plain java test
    + JDK-8210406: Refactor java.util.PluggableLocale:i18n shell
    tests to plain java tests
    + JDK-8210407: Refactor java.util.Calendar:i18n shell tests to
    plain java tests
    + JDK-8210495: compiler crashes because of illegal signature in
    otherwise legal code
    + JDK-8210669: Some launcher tests assume a pre-JDK 9 run-time
    image layout
    + JDK-8210802: temp files left by tests in
    jdk/java/net/httpclient
    + JDK-8210819: Update the host name in CNameTest.java
    + JDK-8210908: Refactor java/util/prefs/PrefsSpi.sh to plain
    java test
    + JDK-8210934: Move sun/net/www/protocol/http/
    /GetErrorStream.java to OpenJDK
    + JDK-8210959: JShell fails and exits when statement throws an
    exception whose message contains a '%'.
    + JDK-8211055: Provide print to a file (PDF) feature even when
    printer was not connected
    + JDK-8211092: test/jdk/sun/net/www/http/HttpClient/
    /MultiThreadTest.java fails intermittently when cleaning up
    + JDK-8211296: Remove HotSpot deprecation warning suppression
    for Mac/clang
    + JDK-8211325: test/jdk/java/net/Socket/LingerTest.java fails
    with cleaning up
    + JDK-8212040: Compilation error due to wrong usage of
    NSPrintJobDispositionValue in mac10.12
    + JDK-8212695: Add explicit timeout to several HTTP Client tests
    + JDK-8212718: Refactor some annotation processor tests to
    better use collections
    + JDK-8213007: Update the link in test/jdk/sun/security/
    /provider/SecureRandom/DrbgCavp.java
    + JDK-8213137: Remove static initialization of monitor/mutex
    instances
    + JDK-8213235: java/nio/channels/SocketChannel/
    /AsyncCloseChannel.java fails with threads that didn't exit
    + JDK-8213409: Refactor sun.text.IntHashtable:i18n shell tests
    to plain java tests
    + JDK-8213576: Make test AsyncCloseChannel.java run in othervm
    + JDK-8213694: Test Timeout.java should run in othervm mode
    + JDK-8213718: [TEST] Wrong classname in vmTestbase/nsk/stress/
    /except/except002 and except003
    + JDK-8213922: fix ctw stand-alone build
    + JDK-8214195: Align stdout messages in
    test/jdk/java/math/BigInteger/PrimitiveConversionTests.java
    + JDK-8214520: [TEST_BUG] sun/security/mscapi/nonUniqueAliases/
    /NonUniqueAliases.java failed with incorrect jtreg tags order
    + JDK-8214937: sun/security/tools/jarsigner/warnings/
    /NoTimestampTest.java failed due to unexpected expiration date
    + JDK-8216532: tools/launcher/Test7029048.java fails (Solaris)
    + JDK-8217825: Verify @AfterTest is used correctly in WebSocket
    tests
    + JDK-8218145: block_if_requested is not proper inlined due to
    size
    + JDK-8219417: bump jtreg requiredVersion to b14
    + JDK-8219552: bump jtreg requiredVersion to b14 in
    test/jdk/sanity/client/
    + JDK-8219804: java/net/MulticastSocket/Promiscuous.java fails
    intermittently due to NumberFormatException
    + JDK-8220445: Support for side by side MSVC Toolset versions
    + JDK-8221988: add possibility to build with Visual Studio 2019
    + JDK-8222751: closed/test/jdk/sun/security/util/
    /DerIndefLenConverter/IndefBerPkcs12.java fail
    + JDK-8223050: JVMCI: findUniqueConcreteMethod() should not use
    Dependencies::find_unique_concrete_method() for non-virtual
    methods
    + JDK-8224853: CDS address sanitizer errors
    + JDK-8225082: Remove IdenTrust certificate that is expiring in
    September 2021
    + JDK-8225583: Examine the HttpResponse.BodySubscribers for
    null handling and multiple subscriptions
    + JDK-8225690: Multiple AttachListener threads can be created
    + JDK-8225790: Two NestedDialogs tests fail on Ubuntu
    + JDK-8226319: Add forgotten test/jdk/java/net/httpclient/
    /BodySubscribersTest.java
    + JDK-8226533: JVMCI: findUniqueConcreteMethod should handle
    statically bindable methods directly
    + JDK-8226602: Test convenience reactive primitives from
    java.net.http with RS TCK
    + JDK-8226683: Remove review suggestion from fix to 8219804
    + JDK-8227738: jvmti/DataDumpRequest/datadumpreq001 failed due
    to "exit code is 134"
    + JDK-8227766: CheckUnhandledOops is broken in MemAllocator
    + JDK-8227815: Minimal VM: set_state is not a member of
    AttachListener
    + JDK-8230674: Heap dumps should exclude dormant CDS archived
    objects of unloaded classes
    + JDK-8230808: Remove Access::equals()
    + JDK-8230841: Remove oopDesc::equals()
    + JDK-8231717: Improve performance of charset decoding when
    charset is always compactable
    + JDK-8232243: Wrong caret position in JTextPane on Windows
    with a screen resolution &gt; 100%
    + JDK-8232782: Shenandoah: streamline post-LRB CAS barrier
    (aarch64)
    + JDK-8233790: Forward output from heap dumper to jcmd/jmap
    + JDK-8233989: Create an IPv4 version of
    java/net/MulticastSocket/SetLoopbackMode.java
    + JDK-8234510: Remove file seeking requirement for writing a
    heap dump
    + JDK-8235211: serviceability/attach/
    /RemovingUnixDomainSocketTest.java fails with
    AttachNotSupportedException: Unable to open socket file
    + JDK-8235216: typo in test filename
    + JDK-8235866: bump jtreg requiredVersion to 4.2b16
    + JDK-8236111: narrow allowSmartActionArgs disabling
    + JDK-8236413: AbstractConnectTimeout should tolerate both
    NoRouteToHostException and UnresolvedAddressException
    + JDK-8236671: NullPointerException in JKS keystore
    + JDK-8238930: problem list compiler/c2/Test8004741.java
    + JDK-8238943: switch to jtreg 5.0
    + JDK-8240555: Using env of JAVA_TOOL_OPTIONS and _JAVA_OPTIONS
    breaks QuietOption.java test
    + JDK-8240983: Incorrect copyright header in Apache Santuario
    2.1.3 files
    + JDK-8241336: Some java.net tests failed with
    NoRouteToHostException on MacOS with special network
    configuration
    + JDK-8241353: NPE in ToolProvider.getSystemJavaCompiler
    + JDK-8241768: git needs .gitattributes
    + JDK-8242882: opening jar file with large manifest might throw
    NegativeArraySizeException
    + JDK-8244973: serviceability/attach/
    /RemovingUnixDomainSocketTest.java fails "stderr was not
    empty"
    + JDK-8245134: test/lib/jdk/test/lib/security/
    /KeyStoreUtils.java should allow to specify aliases
    + JDK-8246261: TCKLocalTime.java failed due to "AssertionError:
    expected [18:14:22] but found [18:14:23]"
    + JDK-8246387: switch to jtreg 5.1
    + JDK-8247421: [TESTBUG] ReturnBlobToWrongHeapTest.java failed
    allocating blob
    + JDK-8247469: getSystemCpuLoad() returns -1 on linux when some
    offline cpus are present and cpusets.effective_cpus is not
    available
    + JDK-8248352: [TEST_BUG] Test test/jdk/java/awt/font/
    /TextLayout/ArabicDiacriticTest.java can leave frame open
    + JDK-8248403: AArch64: Remove uses of kernel integer types
    + JDK-8248414: AArch64: Remove uses of long and unsigned long
    ints
    + JDK-8248657: Windows: strengthening in ThreadCritical
    regarding memory model
    + JDK-8248666: AArch64: Use THREAD_LOCAL instead of __thread
    + JDK-8248668: AArch64: Avoid MIN/MAX macros when using MSVC
    + JDK-8248671: AArch64: Remove unused variables
    + JDK-8248682: AArch64: Use ATTRIBUTE_ALIGNED helper
    + JDK-8248816: C1: Fix signature conflict in
    LIRGenerator::strength_reduce_multiply
    + JDK-8249095: tools/javac/launcher/SourceLauncherTest.java
    fails on Windows
    + JDK-8249548: backward focus traversal gets stuck in button
    group
    + JDK-8249773: Upgrade ReceiveISA.java test to be resilient to
    failure due to stray packets and interference
    + JDK-8249897: jdk/javadoc/tool/LangVers.java uses @ignore w/o
    bug-id
    + JDK-8249898: jdk/javadoc/tool/6176978/T6176978.java uses
    @ignore w/o bug-id
    + JDK-8249899: jdk/javadoc/tool/InlineTagsWithBraces.java uses
    @ignore w/o bug-id
    + JDK-8250588: Shenandoah: LRB needs to save/restore fp
    registers for runtime call
    + JDK-8250824: AArch64: follow up for JDK-8248414
    + JDK-8251166: Add automated testcases for changes done in
    JDK-8214112
    + JDK-8251252: Add automated testcase for fix done in
    JDK-8214253
    + JDK-8251254: Add automated test for fix done in JDK-8218472
    + JDK-8251361: Potential race between Logger configuration and
    GCs in HttpURLConWithProxy test
    + JDK-8251549: Update docs on building for Git
    + JDK-8251945: SIGSEGV in
    PackageEntry::purge_qualified_exports()
    + JDK-8252194: Add automated test for fix done in JDK-8218469
    + JDK-8252648: Shenandoah: name gang tasks consistently
    + JDK-8252825: Add automated test for fix done in JDK-8218479
    + JDK-8252853: AArch64: gc/shenandoah/TestVerifyJCStress.java
    fails intermittently with C1
    + JDK-8252857: AArch64: Shenandoah C1 CAS is not sequentially
    consistent
    + JDK-8253048: AArch64: When CallLeaf, no need to preserve
    callee-saved registers in caller
    + JDK-8253424: Add support for running pre-submit testing using
    GitHub Actions
    + JDK-8253631: Remove unimplemented CompileBroker methods after
    JEP-165
    + JDK-8253865: Pre-submit testing using GitHub Actions does not
    detect failures reliably
    + JDK-8253899: Make IsClassUnloadingEnabled signature match
    specification
    + JDK-8254024: Enhance native libs for AWT and Swing to work
    with GraalVM Native Image
    + JDK-8254054: Pre-submit testing using GitHub Actions should
    not use the deprecated set-env command
    + JDK-8254173: Add Zero, Minimal hotspot targets to submit
    workflow
    + JDK-8254175: Build no-pch configuration in debug mode for
    submit checks
    + JDK-8254244: Some code emitted by TemplateTable::branch is
    unused when running TieredCompilation
    + JDK-8254270: linux 32 bit build doesn't compile
    libjdwp/log_messages.c
    + JDK-8254282: Add Linux x86_32 builds to submit workflow
    + JDK-8254850: Update terminology in java.awt.GridBagLayout
    source code comments
    + JDK-8255255: Update Apache Santuario (XML Signature) to
    version 2.2.1
    + JDK-8255305: Add Linux x86_32 tier1 to submit workflow
    + JDK-8255352: Archive important test outputs in submit workflow
    + JDK-8255373: Submit workflow artifact name is always
    "test-results_.zip"
    + JDK-8255452: Doing GC during JVMTI MethodExit event posting
    breaks return oop
    + JDK-8255718: Zero: VM should know it runs in interpreter-only
    mode
    + JDK-8255790: GTKL&amp;F: Java 16 crashes on initialising GTKL&amp;F
    on Manjaro Linux
    + JDK-8255810: Zero: build fails without JVMTI
    + JDK-8255895: Submit workflow artifacts miss hs_errs/replays
    due to ZIP include mismatch
    + JDK-8256127: Add cross-compiled foreign architectures builds
    to submit workflow
    + JDK-8256215: Shenandoah: re-organize saving/restoring machine
    state in assembler code
    + JDK-8256267: Relax compiler/floatingpoint/NaNTest.java for
    x86_32 and lower -XX:+UseSSE
    + JDK-8256277: Github Action build on macOS should define OS
    and Xcode versions
    + JDK-8256354: Github Action build on Windows should define OS
    and MSVC versions
    + JDK-8256393: Github Actions build on Linux should define OS
    and GCC versions
    + JDK-8256414: add optimized build to submit workflow
    + JDK-8256747: GitHub Actions: decouple the hotspot build-only
    jobs from Linux x64 testing
    + JDK-8257056: Submit workflow should apt-get update to avoid
    package installation errors
    + JDK-8257148: Remove obsolete code in AWTView.m
    + JDK-8257497: Update keytool to create AKID from the SKID of
    the issuing certificate as specified by RFC 5280
    + JDK-8257620: Do not use objc_msgSend_stret to get macOS
    version
    + JDK-8257913: Add more known library locations to simplify
    Linux cross-compilation
    + JDK-8258703: Incorrect 512-bit vector registers restore on
    x86_32
    + JDK-8259338: Add expiry exception for identrustdstx3 alias to
    VerifyCACerts.java test
    + JDK-8259535: ECDSA SignatureValue do not always have the
    specified length
    + JDK-8259679: GitHub actions should use MSVC 14.28
    + JDK-8259924: GitHub actions fail on Linux x86_32 with "Could
    not configure libc6:i386"
    + JDK-8260460: GitHub actions still fail on Linux x86_32 with
    "Could not configure libc6:i386"
    + JDK-8260589: Crash in JfrTraceIdLoadBarrier::load(_jclass*)
    + JDK-8260923: Add more tests for SSLSocket input/output
    shutdown
    + JDK-8261072: AArch64: Fix MacroAssembler::get_thread
    convention
    + JDK-8261147: C2: Node is wrongly marked as reduction
    resulting in a wrong execution due to wrong vector instructions
    + JDK-8261238: NMT should not limit baselining by size threshold
    + JDK-8261496: Shenandoah: reconsider pacing updates memory
    ordering
    + JDK-8261652: Remove some dead comments from os_bsd_x86
    + JDK-8261846: [JVMCI] c2v_iterateFrames can get out of sync
    with the StackFrameStream
    + JDK-8262000: jdk/jfr/event/gc/detailed/
    /TestPromotionFailedEventWithParallelScavenge.java failed with
    "OutOfMemoryError: Java heap space"
    + JDK-8262017: C2: assert(n != __null) failed: Bad immediate
    dominator info.
    + JDK-8262392: Update Mesa 3-D Headers to version 21.0.3
    + JDK-8262409: sun/security/ssl/SSLSocketImpl/
    /SSLSocketImplThrowsWrongExceptions. SSL test failures caused
    by java failed with "Server reported the wrong exception"
    + JDK-8262470: Printed GlyphVector outline with low DPI has bad
    quality on Windows
    + JDK-8262862: Harden tests sun/security/x509/URICertStore/
    /ExtensionsWithLDAP.java and krb5/canonicalize/Test.java
    + JDK-8263136: C4530 was reported from VS 2019 at access bridge
    + JDK-8263227: C2: inconsistent spilling due to dead nodes in
    exception block
    + JDK-8263382: java/util/logging/ParentLoggersTest.java failed
    with "checkLoggers: getLoggerNames() returned unexpected
    loggers"
    + JDK-8263407: SPARC64 detection fails on Athena (SPARC64-X)
    + JDK-8263432: javac may report an invalid package/class clash
    on case insensitive filesystems
    + JDK-8263490: [macos] Crash occurs on JPasswordField with
    activated InputMethod
    + JDK-8263531: Remove unused buffer int
    + JDK-8263667: Avoid running GitHub actions on branches named
    pr/*
    + JDK-8263776: [JVMCI] add helper to perform Java upcalls
    + JDK-8264016: [JVMCI] add some thread local fields for use by
    JVMCI
    + JDK-8264752: SIGFPE crash with option
    FlightRecorderOptions:threadbuffersize=30M
    + JDK-8265132: C2 compilation fails with assert "missing
    precedence edge"
    + JDK-8265231: (fc) ReadDirect and WriteDirect tests fail after
    fix for JDK-8264821
    + JDK-8265335: Epsilon: Minor typo in EpsilonElasticTLABDecay
    description
    + JDK-8265756: AArch64: initialize memory allocated for locals
    according to Windows AArch64 stack page growth requirement in
    template interpreter
    + JDK-8265761: Font with missed font family name is not
    properly printed on Windows
    + JDK-8265773: incorrect jdeps message "jdk8internals" to
    describe a removed JDK internal API
    + JDK-8265836: OperatingSystemImpl.getCpuLoad() returns
    incorrect CPU load inside a container
    + JDK-8266018: Shenandoah: fix an incorrect assert
    + JDK-8266206: Build failure after JDK-8264752 with older GCCs
    + JDK-8266248: Compilation failure in
    PLATFORM_API_MacOSX_MidiUtils.c with Xcode 12.5
    + JDK-8266288: assert root method not found in
    witnessed_reabstraction_in_supers is too strong
    + JDK-8266404: Fatal error report generated with
  - XX:+CrashOnOutOfMemoryError should not contain suggestion to
    submit a bug report
    + JDK-8266480: Implicit null check optimization does not update
    control of hoisted memory operation
    + JDK-8266615: C2 incorrectly folds subtype checks involving an
    interface array
    + JDK-8266642: Improve ResolvedMethodTable hash function
    + JDK-8266749: AArch64: Backtracing broken on PAC enabled
    systems
    + JDK-8266761: AssertionError in
    sun.net.httpserver.ServerImpl.responseCompleted
    + JDK-8266813: Shenandoah: Use shorter instruction sequence for
    checking if marking in progress
    + JDK-8267042: bug in monitor locking/unlocking on ARM32 C1 due
    to uninitialized BasicObjectLock::_displaced_header
    + JDK-8267348: Rewrite gc/epsilon/TestClasses.java to use
    Metaspace with less classes
    + JDK-8267396: Avoid recording "pc" in unhandled oops detector
    for better performance
    + JDK-8267399: C2: java/text/Normalizer/ConformanceTest.java
    test failed with assertion
    + JDK-8267424: CTW: C1 fails with "State must not be null"
    + JDK-8267459: Pasting Unicode characters into JShell does not
    work.
    + JDK-8267625: AARCH64: typo in LIR_Assembler::emit_profile_type
    + JDK-8267666: Add option to jcmd GC.heap_dump to use existing
    file
    + JDK-8267695: Bump update version for OpenJDK: jdk-11.0.13
    + JDK-8267751: (test) jtreg.SkippedException has no serial
    VersionUID
    + JDK-8267773: PhaseStringOpts::int_stringSize doesn't handle
    min_jint correctly
    + JDK-8268103: JNI functions incorrectly return a double after
    JDK-8265836
    + JDK-8268127: Shenandoah: Heap size may be too small for
    region to align to large page size
    + JDK-8268261: C2: assert(n != __null) failed: Bad immediate
    dominator info.
    + JDK-8268347: C2: nested locks optimization may create
    unbalanced monitor enter/exit code
    + JDK-8268360: Missing check for infinite loop during node
    placement
    + JDK-8268362: [REDO] C2 crash when compile negative
    Arrays.copyOf length after loop
    + JDK-8268366: Incorrect calculation of has_fpu_registers in C1
    linear scan
    + JDK-8268369: SIGSEGV in PhaseCFG::implicit_null_check due to
    missing null check
    + JDK-8268417: Add test from JDK-8268360
    + JDK-8268427: Improve AlgorithmConstraints:checkAlgorithm
    performance
    + JDK-8268617: [11u REDO] - WebSocket over authenticating proxy
    fails with NPE
    + JDK-8268620: InfiniteLoopException test may fail on x86
    platforms
    + JDK-8268635: Corrupt oop in ClassLoaderData
    + JDK-8268699: Shenandoah: Add test for JDK-8268127
    + JDK-8268771: javadoc -notimestamp option does not work on
    index.html
    + JDK-8268775: Password is being converted to String in
    AccessibleJPasswordField
    + JDK-8268776: Test `ADatagramSocket.java` missing /othervm
    from @run tag
    + JDK-8268965: TCP Connection Reset when connecting simple
    socket to SSL server
    + JDK-8269304: Regression ~5% in 2005 in b27
    + JDK-8269415: [11u] Remove ea from
    DEFAULT_PROMOTED_VERSION_PRE in OpenJDK 11u
    + JDK-8269478: Shenandoah: gc/shenandoah/mxbeans tests should
    be more resilient
    + JDK-8269529: javax/swing/reliability/
    /HangDuringStaticInitialization.java fails in Windows debug
    build
    + JDK-8269594: assert(_handle_mark_nesting &gt; 1) failed: memory
    leak: allocating handle outside HandleMark
    + JDK-8269614: [s390] Interpreter checks wrong bit for slow
    path instance allocation
    + JDK-8269650: Optimize gc-locker in
    [Get|Release]StringCritical for latin string
    + JDK-8269661: JNI_GetStringCritical does not lock char array
    + JDK-8269668: [aarch64] java.library.path not including
    /usr/lib64
    + JDK-8269763: The JEditorPane is blank after JDK-8265167
    + JDK-8269795: C2: Out of bounds array load floats above its
    range check in loop peeling resulting in SEGV
    + JDK-8269847: JDK-8269594 backport breaks 11u builds
    + JDK-8269850: Most JDK releases report macOS version 12 as
    10.16 instead of 12.0
    + JDK-8269851: OperatingSystemMXBean getProcessCpuLoad reports
    incorrect process cpu usage in containers
    + JDK-8269882: stack-use-after-scope in NewObjectA
    + JDK-8269934: RunThese24H.java failed with
    EXCEPTION_ACCESS_VIOLATION in
    java_lang_Thread::get_thread_status
    + JDK-8270096: Shenandoah: Optimize gc/shenandoah/
    /TestRefprocSanity.java for interpreter mode
    + JDK-8270137: Kerberos Credential Retrieval from Cache not
    Working in Cross-Realm Setup
    + JDK-8270184: [TESTBUG] Add coverage for jvmci
    ResolvedJavaType.toJavaName() for lambdas
    + JDK-8270196: [11u] [JVMCI] JavaType.toJavaName() returns
    incorrect type name for lambdas
    + JDK-8270556: Exclude security/infra/java/security/cert/
    /CertPathValidator/certification/LetsEncryptCA
    + JDK-8270893: IndexOutOfBoundsException while reading large
    TIFF file
    + JDK-8272078: Wrong Checksums in Temurin BootJDK dependencies
    + JDK-8272124: Cgroup v1 initialization causes
    NullPointerException when cgroup path contains colon
    + JDK-8272131: PhaseMacroExpand::generate_slow_arraycopy crash
    when clone null CallProjections.fallthrough_ioproj
    + JDK-8272197: Update 11u GHA workflow with Shenandoah
    configurations
    + JDK-8272332: --with-harfbuzz=system doesn't add -lharfbuzz
    after JDK-8255790
    + JDK-8272472: StackGuardPages test doesn't build with glibc
    2.34
    + JDK-8272602: [macos] not all KEY_PRESSED events sent when
    control modifier is used
    + JDK-8272628: Problemlist gc/stress/gcbasher/
    /TestGCBasherWithCMS.java for x86_32
    + JDK-8272700: [macos] Build failure with Xcode 13.0 after
    JDK-8264848
    + JDK-8272772: Shenandoah: compiler/c2/aarch64/
    /TestVolatilesShenandoah.java fails in 11u
    + JDK-8273939: Backport of 8248414 to JDK11 breaks
    MacroAssembler::adrp
- Remove the unneeded icedtea-sound provider
- Removed patches:
  * icedtea-sound-1.0.1-jdk9.patch
  * icedtea-sound-soundproperties.patch
    + not needed since the icedtea-sound provider is removed
  * jdk11-glibc234.patch
    + integrated upstream</changelog>
  <changelog author="fstrba@suse.com" date="1635940800">- Modified patches:
  * system-crypto-policy.patch
    + rediff to changed context
  * fips.patch
    + Allow plain key import in fips mode unless
    com.suse.fips.plainKeySupport is set to false</changelog>
  <changelog author="fstrba@suse.com" date="1636113600">- Modified patch:
  * fips.patch
    + return in native code after generating java.io.IOException</changelog>
</package>
<package pkgid="ad8695d20a3b8411ec6ae09e14bceeb4ee7a837de5cf7171d2eeda02e79a611d" name="java-11-openjdk-demo" arch="x86_64">
  <version epoch="0" ver="11.0.13.0" rel="3.68.1"/>
  <changelog author="fstrba@suse.com" date="1586952000">- The pack200 and unpack200 alternatives should be slaves of java
  and not of javac, since they are part of JRE.</changelog>
  <changelog author="fstrba@suse.com" date="1587470400">- Update to upstream tag jdk-11.0.7+10 (April 2020 CPU,
  bsc#1169511)
  * Security fixes:
    + S8223898, CVE-2020-2754: Forward references to Nashorn
    + S8223904, CVE-2020-2755: Improve Nashorn matching
    + S8224541, CVE-2020-2756: Better mapping of serial ENUMs
    + S8224549, CVE-2020-2757: Less Blocking Array Queues
    + S8225603: Enhancement for big integers
    + S8226346: Build better binary builders
    + S8227467: Better class method invocations
    + S8227542: Manifest improved jar headers
    + S8229733: TLS message handling improvements
    + S8231415, CVE-2020-2773: Better signatures in XML
    + S8231785: Improved socket permissions
    + S8232424, CVE-2020-2778: More constrained algorithms
    + S8232581, CVE-2020-2767: Improve TLS verification
    + S8233250: Better X11 rendering
    + S8233410: Better Build Scripting
    + S8234027: Better JCEKS key support
    + S8234408, CVE-2020-2781: Improve TLS session handling
    + S8234825, CVE-2020-2800: Better Headings for HTTP Servers
    + S8234841, CVE-2020-2803: Enhance buffering of byte buffers
    + S8235274, CVE-2020-2805: Enhance typing of methods
    + S8235691, CVE-2020-2816: Enhance TLS connectivity
    + S8236201, CVE-2020-2830: Better Scanner conversions
    + S8238960: linux-i586 builds are inconsistent as the newly
    built jdk is not able to reserve enough space for object heap
  * Other changes:
    + S4919790: Errors in alert ssl message does not reflect the
    actual certificate status
    + S4949105: Access Bridge lacks html tags parsing
    + S7092821: java.security.Provider.getService() is synchronized
    and became scalability bottleneck
    + S7143743: Potential memory leak with zip provider
    + S8005819: Support cross-realm MSSFU
    + S8042383: [TEST_BUG] Test javax/swing/plaf/basic/BasicMenuUI/
    /4983388/bug4983388.java fails with shortcuts on menus do not
    work
    + S8068184: Fix for JDK-8032832 caused a deadlock
    + S8145845: [AOT] NullPointerException in
    compiler/whitebox/GetCodeHeapEntriesTest.java
    + S8152988: [AOT] Update test batch definitions to include
    aot-ed java.base module mode into hs-comp testing
    + S8160926: FLAGS_COMPILER_CHECK_ARGUMENTS doesn't handle
    cross-compilation
    + S8163083: SocketListeningConnector does not allow invocations
    with port 0
    + S8163251: Hard coded loop limit prevents reading of smart
    card data greater than 8k
    + S8167276: jvmci/compilerToVM/MaterializeVirtualObjectTest.java
    fails with -XX:-EliminateAllocations
    + S8169718: nsk/jdb/locals/locals002: ERROR: Cannot find
    boolVar with expected value: false
    + S8176556:
    java/awt/dnd/ImageTransferTest/ImageTransferTest.java fails
    for JFIF
    + S8178798: Two compiler/aot/verification/vmflags tests fail by
    timeout with UseAVX=3
    + S8183107: PKCS11 regression regarding checkKeySize
    + S8185005: Improve performance of
    ThreadMXBean.getThreadInfo(long ids[], int maxDepth)
    + S8189633: Missing -Xcheck:jni checking for DeleteWeakGlobalRef
    + S8189861: Refactor CacheFind
    + S8193042: NativeLookup::lookup_critical_entry() should only
    load shared library once
    + S8193596: java/net/DatagramPacket/ReuseBuf.java failed due to
    timeout
    + S8194944: Regression automated test 'open/test/jdk/javax/
    /swing/JInternalFrame/8145896/TestJInternalFrameMaximize.java'
    fails
    + S8196467: javax/swing/JInternalFrame/Test6325652.java fails
    + S8196969: JTreg Failure: serviceability/sa/ClhsdbJstack.java
    causes NPE
    + S8198321: javax/swing/JEditorPane/5076514/bug5076514.java
    fails
    + S8198398: Test javax/swing/JColorChooser/Test6199676.java
    fails in mach5
    + S8199072: Test javax/swing/GroupLayout/6613904/
    /bug6613904.java is unstable
    + S8200432: javadoc fails with ClassCastException on {@link
    byte[]}
    + S8201349: build broken when configured with
  - -with-zlib=bundled on gcc 7.3
    + S8201355: Avoid native memory allocation in
    sun.security.mscapi.PRNG.generateSeed
    + S8201513: nsk/jvmti/IterateThroughHeap/filter-* are broken
    + S8203364: Some serviceability/sa/ tests intermittently fail
    with java.io.IOException: LingeredApp terminated with non-zero
    exit code 3
    + S8203687: javax/net/ssl/compatibility/Compatibility.java
    supports TLS 1.3
    + S8203904: javax/swing/JSplitPane/4816114/bug4816114.java: The
    divider location is wrong
    + S8203911: Test runtime/modules/getModuleJNI/GetModule fails
    with -Xcheck:jni
    + S8204525: [TESTBUG] runtime/NMT/MallocStressTest.java ran out
    of java heap
    + S8204529: gc/TestAllocateHeapAtMultiple.java fail with Agent
    7 timed out
    + S8204551: Event descriptions are truncated in logs
    + S8206963: [AOT] bug with multiple class loaders
    + S8207367: 10 vmTestbase/nsk/jdi tests timed out when running
    with jtreg
    + S8207832: serviceability/sa/ClhsdbCDSCore.java failed with
    "Couldn't find core file location"
    + S8207938: At step6,Click Add button,case failed automatically.
    + S8208157: requires.VMProps throws NPE for missing properties
    in "release" file
    + S8208379: compiler/jvmci/events/
    /JvmciNotifyInstallEventTest.java failed with "Got unexpected
    event count after 2nd install attempt: expected 9 to equal 2"
    + S8208658: Make CDS archived heap regions usable even if
    compressed oop encoding has changed
    + S8208715: Conversion of milliseconds to nanoseconds in
    UNIXProcess contains bug
    + S8209361: [AOT] Unexpected number of references for
    JVMTI_HEAP_REFERENCE_CONSTANT_POOL [111--&gt;111]: 0 (expected
    at least 1)
    + S8209385: CDS runtime classpath checking is too strict when
    only classes from the system modules are archived
    + S8209389: SIGSEGV in WalkOopAndArchiveClosure::do_oop_work.
    + S8209418: Synchronize test/jdk/sanity/client/lib/jemmy with
    code-tools/jemmy/v2
    + S8209494: Create a test for SwingSet InternalFrameDemo
    + S8209499: Create test for SwingSet EditorPaneDemo
    + S8209574: [AOT] breakpoint events are generated in different
    threads does not meet expected count
    + S8209686: cleanup arguments to PhaseIdealLoop() constructor
    + S8209789: Synchronize test/jdk/sanity/client/lib/jemmy with
    code-tools/jemmy/v2
    + S8209802: Garbage collectors should register JFR types
    themselves to avoid build errors.
    + S8209807: improve handling exception in requires.VMProps
    + S8209817: stack is executable when building with Clang on
    Linux
    + S8209824: Improve the code coverage for ThreadLocal
    + S8209826: Undefined reference to os::write after JDK-8209657
    (filemap.hpp cleanup)
    + S8209850: Allow NamedThreads to use GlobalCounter critical
    sections
    + S8209976: Improve iteration over non-JavaThreads
    + S8209993: Create a test for SwingSet3 ToolTipDemo
    + S8210024: JFR calls virtual is_Java_thread from ~Thread()
    + S8210052: Enable testing for all the available look and feels
    in SwingSet3 demo tests
    + S8210055: Enable different look and feel tests in SwingSet3
    demo tests
    + S8210057: Enable different look and feels in SwingSet3 demo
    test InternalFrameDemoTest
    + S8210058: Algorithmic Italic font leans opposite angle in
    Printing
    + S8210220: [AOT] jdwp test cases are failing with error #
    ERROR: TEST FAILED: Cought IOException while receiving event
    packet
    + S8210289: ArchivedKlassSubGraphInfoRecord is incomplete
    + S8210459: Add support for generating compile_commands.json
    + S8210476: sun/security/mscapi/PrngSlow.java fails with Still
    too slow
    + S8210512: [Testbug] vmTestbase/nsk/jdi/ObjectReference/
    /referringObjects/referringObjects002/referringObjects002.java
    fails with unexpected size of
    ClassLoaderReference.referringObjects
    + S8210523: runtime/appcds/cacheObject/DifferentHeapSizes.java
    crash
    + S8210632: Add key exchange algorithm to
    javax/net/ssl/TLSCommon/CipherSuite.java
    + S8210699: Problem list tests which times out in Xcomp mode
    + S8210793: [JVMCI] AllocateCompileIdTest.java failed to find
    DiagnosticCommand.class
    + S8210910: Create test for FileChooserDemo
    + S8210994: Create test for SwingSet3 FrameDemo
    + S8211139: Increase timeout value in all tests under
    jdk/sanity/client/SwingSet/src
    + S8211160: Handle different look and feels in
    JInternalFrameOperator
    + S8211211: vmTestbase/metaspace/stressDictionary/
    /StressDictionary.java timeout
    + S8211322: Reduce the timeout of tooltip in SwingSet2DemoTest
    + S8211443: Enable different look and feels in SwingSet3 demo
    test SplitPaneDemoTest
    + S8211703: JInternalFrame : java.lang.AssertionError: cannot
    find the internal frame
    + S8211781: re-building fails after changing Graal sources
    + S8212897: Some improvements in the EditorPaneDemotest
    + S8212903: [TestBug] Tests test/jdk/javax/swing/LookAndFeel/
    /8145547/DemandGTK2.sh and DemandGTK3.sh fail on Ubuntu 18.04
    LTS
    + S8213009: Refactoring existing SunMSCAPI classes
    + S8213010: Supporting keys created with certmgr.exe
    + S8213168: Enable different look and feel tests in SwingSet3
    demo test FileChooserDemoTest
    + S8213348: jdk.internal.vm.compiler.management service
    providers missing in module descriptor
    + S8213906: Update arm devkits with libXrandr headers
    + S8213908: AssertionError in DeferredAttr at setOverloadKind
    + S8214124: [TESTBUG] Bugs in runtime/NMT/MallocStressTest.java
    + S8214344: C2: assert(con.basic_type() != T_ILLEGAL) failed:
    elembt=byte; loadbt=void; unsigned=0
    + S8214345: infinite recursion while checking super class
    + S8214471: Enable different look and feel tests in SwingSet3
    demo test ToolTipDemoTest
    + S8214534: Setting of THIS_FILE in the build is broken
    + S8214557: Filter out VM flags which don't affect AOT code
    generation
    + S8214578: [macos] Problem with backslashes on macOS/JIS
    keyboard: Java ignores system settings
    + S8214840: runtime/NMT/MallocStressTest.java timed out
    + S8214850: Rename vm_operations.?pp files to vmOperations.?pp
    files
    + S8214904: Test8004741.java failed due to "Too few ThreadDeath
    hits; expected at least 6 but saw only 5"
    + S8215322: add @file support to jaotc
    + S8215355: Object monitor deadlock with no threads holding the
    monitor (using jemalloc 5.1)
    + S8215396: JTabbedPane preferred size calculation is wrong for
    SCROLL_TAB_LAYOUT
    + S8216180: [AOT] compiler/intrinsics/bigInteger/TestMulAdd.java
    crashed with AOT enabled
    + S8216353: Use utility APIs introduced in org/netbeans/jemmy/
    /util/LookAndFeel class in client sanity test cases
    + S8216354: Syntax error in toolchain_windows.m4
    + S8216472: (se) Stack overflow during selection operation
    leads to crash (win)
    + S8216535: tools/jimage/JImageExtractTest.java timed out
    + S8217235: Create automated test for SwingSet
    ColorChooserDemoTest
    + S8217297: Add support for multiple look and feel for SwingSet
    SliderDemoTest
    + S8217338: [Containers] Improve systemd slice memory limit
    support
    + S8217613: [AOT] TEST_OPTS_AOT_MODULES doesn't work on mac
    + S8217634: RunTest documentation and usability update
    + S8217717: ZGC: Broken oop map in C1 load barrier stub
    + S8217728: Speed up incremental rerun of "make hotspot"
    + S8218268: Javac treats Manifest Class-Path entries as Paths
    instead of URLs
    + S8218662: Allow 204 responses with Content-Length:0
    + S8218882: NET_Writev is declared, NET_WriteV is defined
    + S8218889: Improperly use of the Optional API
    + S8219205: JFR file without license header
    + S8219597: (bf) Heap buffer state changes could provoke
    unexpected exceptions
    + S8219723: javax/net/ssl/compatibility/Compatibility.java
    failed on some SNI cases
    + S8220348: [ntintel] asserts about copying unaligned array
    + S8220451: jdi/EventQueue/remove/remove004 failed due to
    "ERROR: thread2 is not alive"
    + S8220456: jdi/EventQueue/remove_l/remove_l004 failed due to
    "TIMEOUT while waiting for event"
    + S8220479: java/nio/channels/Selector/SelectWithConsumer.java
    failed at testTwoChannels()
    + S8220613: java/util/Arrays/TimSortStackSize2.java times out
    with fastdebug build
    + S8220688: [TESTBUG] runtime/NMT/MallocStressTest.java timed
    out
    + S8220786: Create new switch to redirect error reporting
    output to stdout or stderr
    + S8221270: Duplicated synchronized keywords in SSLSocketImpl
    + S8221312: test/jdk/sanity/client/SwingSet/src/
    /ColorChooserDemoTest.java failed
    + S8221851: Use of THIS_FILE in hotspot invalidates precompiled
    header on Linux/GCC
    + S8221885: Add intermittent test in the JavaSound to the
    ProblemList
    + S8222264: Windows incremental build is broken with JDK-8217728
    + S8222391: javax/net/ssl/compatibility/Compatibility.java
    should be more flexible
    + S8222448: java/lang/reflect/PublicMethods/
    /PublicMethodsTest.java times out
    + S8222519: ButtonDemoScreenshotTest fails randomly with "still
    state to be reached"
    + S8222741: jdi/EventQueue/remove/remove004 fails due to
    VMDisconnectedException
    + S8223003: SunMSCAPI keys are not cleaned up
    + S8223063: Support CNG RSA keys
    + S8223158: Docked MacBook cannot start any Java Swing
    applications
    + S8223260: NamingManager should cache InitialContextFactory
    + S8223464: Improve version string for Oracle CI builds
    + S8223558: Java does not render Myanmar script correctly
    + S8223627: jdk-13+20 bundle name contains null instead of ea
    + S8223638: Replace wildcard address with loopback or local
    host in tests - part 6
    + S8223678: Add Visual Studio Code workspace generation support
    (for native code)
    + S8223727: com/sun/jndi/ldap/privconn/RunTest.java failed due
    to hang in LdapRequest.getReplyBer
    + S8223769: Assert triggers with -XX:+StressReflectiveCode
    + S8224187: Refactor arraycopy_prologue to allow ZGC read
    barriers on arraycopy
    + S8224475: JTextPane does not show images in HTML rendering
    + S8224673: Adjust permission for delayed starting of debugging
    + S8224705: Tests that need to be problem-listed or have
    printer resources
    + S8224778: test/jdk/demo/jfc/J2Ddemo/J2DdemoTest.java cannot
    find J2Ddemo.jar
    + S8224821: java/awt/Focus/NoAutotransferToDisabledCompTest/
    /NoAutotransferToDisabledCompTest.java fails linux-x64
    + S8224830: test/jdk/java/awt/Focus/
    /ModalExcludedWindowClickTest/
    /ModalExcludedWindowClickTest.java fails on linux-x64
    + S8224851: AArch64: fix warnings and errors with Clang and GCC
    8.3
    + S8224905: java/lang/ProcessBuilder/Basic.java#id1 failed with
    stream closed
    + S8225007: java/awt/print/PrinterJob/
    /LandscapeStackOverflow.java may hang
    + S8225105: java/awt/Focus/ShowFrameCheckForegroundTest/
    /ShowFrameCheckForegroundTest.java fails in Windows 10
    + S8225117: java/math/BigInteger/SymmetricRangeTests.java fails
    with ParseException
    + S8225128: Add exception for expiring DocuSign root to
    VerifyCACerts test
    + S8225130: Add exception for expiring Comodo roots to
    VerifyCACerts test
    + S8225144: [macos] In Aqua L&amp;F backspace key does not delete
    when Shift is pressed
    + S8225180: SignedObject with invalid Key not throwing the
    InvalidKeyException in Windows
    + S8225182: JNI exception pending in DestroyXIMCallback of
    awt_InputMethod.c:1327
    + S8225199: [Graal] compiler/jvmci/compilerToVM/
    /IsMatureVsReprofileTest.java fails with
  - XX:CompileThresholdScaling=0.1
    + S8225305: ProblemList java/lang/invoke/VarHandles tests
    + S8225350: compiler/jvmci/compilerToVM/IsCompilableTest.java
    timed out
    + S8225430: Replace wildcard address with loopback or local
    host in tests - part 14
    + S8225435: Upgrade IANA Language Subtag Registry to the latest
    for JDK14
    + S8225487: giflib legal file is missing attribution for
    openbsd-reallocarray.c
    + S8225567: Wrong file headers with 8202414 fix changeset
    + S8225684: [AOT] vmTestbase/vm/oom/production/
    /AlwaysOOMProduction tests fail with AOTed java.base
    + S8225766: Curve in certificate should not affect signature
    scheme when using TLSv1.3
    + S8225797: OldObjectSample event creates unexpected amount of
    checkpoint data
    + S8226381: ProblemList java/lang/reflect/PublicMethods/
    /PublicMethodsTest.java
    + S8226406: JVM fails to detect mismatched or corrupt CDS
    archive
    + S8226608: Hide the onjcmd option from the help output
    + S8226892: ActionListeners on JRadioButtons don't get notified
    when selection is changed with arrow keys
    + S8227112: exclude compiler/intrinsics/sha/sanity tests from
    AOT runs
    + S8227324: Upgrade to freetype 2.10.1
    + S8227528: TestAbortVMOnSafepointTimeout.java failed due to
    "RuntimeException: 'Safepoint sync time longer than' missing
    from stdout/stderr"
    + S8227645: Some tests in serviceability/sa run with fixed -Xmx
    values and risk running out of memory
    + S8227646: [TESTBUG] appcds/SharedArchiveConsistency timed out
    + S8227662: freetype seeks to index at the end of the font data
    + S8228479: Correct the format of ColorChooserDemoTest
    + S8228613: java.security.Provider#getServices order is no
    longer deterministic
    + S8228969: 2019-09-28 public suffix list update
    + S8229236: CriticalJNINatives: dll handling should be done in
    native thread state
    + S8229345: Memory leak due to vtable stubs not being shared on
    SPARC
    + S8229888: (zipfs) Updating an existing zip file does not
    preserve original permissions
    + S8229994: assert(false) failed: Bad graph detected in
    get_early_ctrl_for_expensive
    + S8230004: jdk/internal/jimage/JImageOpenTest.java runs no test
    + S8230235: Rendering HTML with empty img attribute and
    documentBaseKey cause Exception
    + S8230390: Problemlist SA tests with AOT
    + S8230400: Missing constant pool entry for a method in
    stacktrace
    + S8230459: Test failed to resume JVMCI CompilerThread
    + S8230480: check malloc/calloc results in java.desktop
    + S8230597: Update GIFlib library to the 5.2.1
    + S8230611: infinite loop in
    LogOutputList::wait_until_no_readers()
    + S8230624: [TESTBUG] Problemlist JFR
    compiler/TestCodeSweeper.java
    + S8230677: Should disable Escape Analysis if JVMTI capability
    can_get_owned_monitor_info was taken
    + S8230926: [macosx] Two apostrophes are entered instead of one
    with "U.S. International - PC" layout
    + S8231025: Incorrect method tag offset for big endian platform
    + S8231081: TestMetadataRetention fails due to missing symbol id
    + S8231387: java.security.Provider.getService returns random
    result due to race condition with mutating methods in the same
    class
    + S8231430: C2: Memory stomp in max_array_length() for
    T_ILLEGAL type
    + S8231445: check ZALLOC return values in awt coding
    + S8231507: Update Apache Santuario (XML Signature) to version
    2.1.4
    + S8231584: Deadlock with ClassLoader.findLibrary and
    System.loadLibrary call
    + S8231753: use more Posix functionality in aix
    os::print_os_info
    + S8231810: javax/net/ssl/templates/
    /SSLSocketSSLEngineTemplate.java fails intermittently with
    "java.lang.Exception: Unexpected EOF"
    + S8232003: (fs) Files.write can leak file descriptor in the
    exception case
    + S8232056: GetOwnedMonitorInfoWithEATest.java fails with ZGC:
    Heap too small
    + S8232060: add some initializations using sigemptyset in
    os_aix.cpp
    + S8232154: Update Mesa 3-D Headers to version 19.2.1
    + S8232167: Visual Studio install found through
  - -with-tools-dir value is discarded
    + S8232170: FSInfo#getJarClassPath throws an exception not
    declared in its throws clause
    + S8232200: [macos 10.15] Windows in fullscreen tests jumps
    around the screen
    + S8232207: Linux os::available_memory re-reads cgroup
    configuration on every invocation
    + S8232224: [TESTBUG] problemlist JFR TestLargeRootSet.java
    + S8232370: Refactor some com.sun.jdi tests to enable IDE
    integration
    + S8232433: [macos 10.15] java/awt/Window/
    /LocationAtScreenCorner/LocationAtScreenCorner.java may fail
    + S8232571: Add missing SIGINFO signal
    + S8232692: [TESTBUG] compiler/aot/fingerprint/
    /SelfChangedCDS.java fails when cds is disabled
    + S8232713: Update BCEL version to 6.3.1 in license file
    + S8232806: Introduce a system property to disable eager lambda
    initialization
    + S8232834: RunTest sometimes fails to produce valid
    exitcode.txt
    + S8232880: Update test documentation with additional settings
    for client UI tooltip tests
    + S8232950: SUNPKCS11 Provider incorrectly check key length for
    PSS Signatures.
    + S8233018: Add a new test to verify that DatagramSocket is not
    interruptible
    + S8233019: java.lang.Class.isPrimitive() (C1) returns wrong
    result if Klass* is aligned to 32bit
    + S8233032: assert(in_bb(n)) failed: must be
    + S8233078: fix minimal VM build on Linux ppc64(le)
    + S8233328: fix minimal VM build on Linux s390x
    + S8233383: Various minor fixes
    + S8233466: aarch64: remove unnecessary load of mdo when
    profiling return and parameters type
    + S8233491: Crash in AdapterHandlerLibrary::get_adapter with
    CDS due to code cache exhaustion
    + S8233529: loopTransform.cpp:2984: Error: assert(p_f-&gt;Opcode()
    == Op_IfFalse) failed
    + S8233548: Update CUP to v0.11b
    + S8233649: Update ProblemList.txt to exclude failing headful
    tests on macos
    + S8233656: assert(d-&gt;is_CFG() &amp;&amp; n-&gt;is_CFG()) failed: must
    have CFG nodes
    + S8233657: Intermittent NPE in Component.validate()
    + S8234288: Turkey Time Zone returns incorrect time zone name
    + S8234323: NULL-check return value of SurfaceData_InitOps on
    macosx
    + S8234339: replace JLI_StrTok in java_md_solinux.c
    + S8234340: Bump update version for OpenJDK: jdk-11.0.7
    + S8234350: assert(mode == ControlAroundStripMined &amp;&amp; (use ==
    sfpt || !use-&gt;is_reachable_from_root())) failed: missed a node
    + S8234386: [macos] NPE was thrown at expanding Choice from
    maximized frame
    + S8234397: add OS uptime information to os::print_os_info
    output
    + S8234423: Modifying ArrayList.subList().subList() resets
    modCount of subList
    + S8234466: Class loading deadlock involving
    X509Factory#commitEvent()
    + S8234501: remove obsolete NET_ReadV
    + S8234525: enable link-time section-gc for linux s390x to
    remove unused code
    + S8234610: MaxVectorSize set wrongly when UseAVX=3 is
    specified after JDK-8221092
    + S8234617: C1: Incorrect result of field load due to missing
    narrowing conversion
    + S8234723: javax/net/ssl/TLS tests support TLSv1.3
    + S8234724: javax/net/ssl/templates/
    /SSLSocketSSLEngineTemplate.java supports TLSv1.3
    + S8234741: enhance os::get_core_path on macOS
    + S8234769: Duplicate attribution in freetype.md
    + S8234786: Fix for JDK-8214578 breaks OS X 10.12 compatibility
    + S8234809: set relro in linker flags when building with gcc
    + S8234824: java/nio/channels/SocketChannel/AdaptSocket.java
    fails on Windows 10
    + S8235243: handle VS2017 15.9 and VS2019 in abstract_vm_version
    + S8235288: AVX 512 instructions inadvertently used on Xeon for
    small vector width operations
    + S8235325: build failure on Linux after 8235243
    + S8235383: C1 compilation fails with
  - XX:+PrintIRDuringConstruction -XX:+Verbose
    + S8235489: handle return values of sscanf calls in hotspot
    + S8235509: Backport for JDK-8209657 Refactor filemap.hpp to
    simplify integration with Serviceability Agent.
    + S8235510: java.util.zip.CRC32 performance drop after 8200067
    + S8235563: [TESTBUG] appcds/CommandLineFlagComboNegative.java
    does not handle archive mapping failure
    + S8235637: jhsdb jmap from OpenJDK 11.0.5 doesn't work if
    prelink is enabled
    + S8235671: enhance print_rlimit_info in os_posix
    + S8235744: PIT: test/jdk/javax/swing/text/html/
    /TestJLabelWithHTMLText.java times out in linux-x64
    + S8235904: Infinite loop when rendering huge lines
    + S8235998: [c2] Memory leaks during tracing after '8224193:
    stringStream should not use Resource Area'.
    + S8236039: JSSE Client does not accept status_request
    extension in CertificateRequest messages for TLS 1.3
    + S8236140: assert(!VerifyHashTableKeys || _hash_lock == 0)
    failed: remove node from hash table before modifying it
    + S8236179: C1 register allocation error with T_ADDRESS
    + S8236488: Support for configure option
  - -with-native-debug-symbols=internal is impossible on Windows
    + S8236500: Windows ucrt.dll should be looked up in versioned
    WINSDK subdirectory
    + S8236709: struct SwitchRange in HS violates C++ One
    Definition Rule
    + S8236848: [JDK 11u] make run-test-tier1 fails after backport
    of JDK-8232834
    + S8236873: Worker has a deadlock bug
    + S8237217: Incorrect G1StringDedupEntry type used in
    StringDedupTable destructor
    + S8237368: Problem with NullPointerException in RMI
    TCPEndpoint.read
    + S8237375: SimpleThresholdPolicy misses CounterDecay timestamp
    initialization
    + S8237508: Simplify JarFile.isInitializing
    + S8237540: Missing files in backport of JDK-8210910
    + S8237541: Missing files in backport of JDK-8236528
    + S8237600: Test SunJSSEFIPSInit fails on Ubuntu
    + S8237819: s390x - remove unused pd_zero_to_words_large
    + S8237869: exclude jtreg test security/infra/java/security/
    /cert/CertPathValidator/certification/LuxTrustCA.java because
    of instabilities
    + S8237879: make 4.3 breaks build
    + S8237945: CTW: C2 compilation fails with
    assert(just_allocated_object(alloc_ctl) == ptr) failed: most
    recent allo...
    + S8238225: Issues reported after replacing symlink at
    Contents/MacOS/libjli.dylib with binary
    + S8238247: CTW runner should sweep nmethods more aggressively
    + S8238366: CTW runner closes standard output on exit
    + S8238438: SuperWord::co_locate_pack picks memory state of
    first instead of last load
    + S8238502: sunmscapi.dll causing EXCEPTION_ACCESS_VIOLATION
    + S8238534: Deep sign macOS bundles before bundle archive is
    being created
    + S8238591: CTW: Split
    applications/ctw/modules/jdk_localedata.java
    + S8238596: AVX enabled by default for Skylake even when
    unsupported
    + S8238811: C2: assert(i &gt;= req() || i == 0 || is_Region() ||
    is_Phi()) with -XX:+VerifyGraphEdges
    + S8239005: [TESTBUG] test/hotspot/jtreg/runtime/
    /StackGuardPages/TestStackGuardPages.java: exeinvoke.c: must
    initialize static state before calling do_overflow()
    + S8239466: Loss of precision in counter decay calculation in
    11u backport of JDK-8237375
    + S8239856: [ntintel] asserts about copying unaligned array
    element
    + S8240724: [test] jdk11 downport of 8224475 misses binary file
    test/jdk/javax/swing/JTextPane/arrow.png
    + S8241296: Segfault in JNIHandleBlock::oops_do()
- Removed patch:
  * DependOnVariableHelper.patch
    + fixed upstream
- Added patch:
  * JDK-8228407.patch
    + fix crashes due to shared archive file mismatch</changelog>
  <changelog author="fstrba@suse.com" date="1594900800">- Update to upstream tag jdk-11.0.8+10 (July 2020 CPU, bsc#1174157)
  * Security fixes:
    + JDK-8230613: Better ASCII conversions
    + JDK-8231800: Better listing of arrays
    + JDK-8232014: Expand DTD support
    + JDK-8233234: Better Zip Naming
    + JDK-8233239, CVE-2020-14562: Enhance TIFF support
    + JDK-8233255: Better Swing Buttons
    + JDK-8234032: Improve basic calendar services
    + JDK-8234042: Better factory production of certificates
    + JDK-8234418: Better parsing with CertificateFactory
    + JDK-8234836: Improve serialization handling
    + JDK-8236191: Enhance OID processing
    + JDK-8236867, CVE-2020-14573: Enhance Graal interface handling
    + JDK-8237117, CVE-2020-14556: Better ForkJoinPool behavior
    + JDK-8237592, CVE-2020-14577: Enhance certificate verification
    + JDK-8238002, CVE-2020-14581: Better matrix operations
    + JDK-8238013: Enhance String writing
    + JDK-8238804: Enhance key handling process
    + JDK-8238842: AIOOBE in GIFImageReader.initializeStringTable
    + JDK-8238843: Enhanced font handing
    + JDK-8238920, CVE-2020-14583: Better Buffer support
    + JDK-8238925: Enhance WAV file playback
    + JDK-8240119, CVE-2020-14593: Less Affine Transformations
    + JDK-8240482: Improved WAV file playback
    + JDK-8241379: Update JCEKS support
    + JDK-8241522: Manifest improved jar headers redux
    + JDK-8242136, CVE-2020-14621: Better XML namespace handling
  * Other changes:
    + JDK-6933331: (d3d/ogl) java.lang.IllegalStateException:
    Buffers have not been created
    + JDK-7124307: JSpinner and changing value by mouse
    + JDK-8022574: remove HaltNode code after uncommon trap calls
    + JDK-8039082: [TEST_BUG] Test
    java/awt/dnd/BadSerializationTest/BadSerializationTest.java
    fails
    + JDK-8040630: Popup menus and tooltips flicker with previous
    popup contents when first shown
    + JDK-8044365: (dc) MulticastSendReceiveTests.java failing with
    ENOMEM when joining group (OS X 10.9)
    + JDK-8048215: [TESTBUG]
    java/lang/management/ManagementFactory/ThreadMXBeanProxy.java
    Expected non-null LockInfo
    + JDK-8051349: nsk/jvmti/scenarios/sampling/SP06/sp06t003 fails
    in nightly
    + JDK-8080353: JShell: Better error message on attempting to
    add default method
    + JDK-8139876: Exclude hanging nsk/stress/stack from execution
    with deoptimization enabled
    + JDK-8146090: java/lang/ref/ReachabilityFenceTest.java fails
    with -XX:+DeoptimizeALot
    + JDK-8153430: jdk regression test MletParserLocaleTest,
    ParserInfiniteLoopTest reduce default timeout
    + JDK-8156207: Resource allocated BitMaps are often cleared
    unnecessarily
    + JDK-8159740: JShell: corralled declarations do not have
    correct source to wrapper mapping
    + JDK-8175984: ICC_Profile has un-needed, not-empty finalize
    method
    + JDK-8176359: Frame#setMaximizedbounds not working properly in
    multi screen environments
    + JDK-8183369: RFC unconformity of HttpURLConnection with proxy
    + JDK-8187078: -XX:+VerifyOops finds numerous problems when
    running JPRT
    + JDK-8189861: Refactor CacheFind
    + JDK-8191169: java/net/Authenticator/B4769350.java failed
    intermittently
    + JDK-8191930: [Graal] emits unparseable XML into compile log
    + JDK-8193879: Java debugger hangs on method invocation
    + JDK-8196019: java/awt/Window/Grab/GrabTest.java fails on
    Windows
    + JDK-8196181: sun/java2d/GdiRendering/InsetClipping.java fails
    + JDK-8198000:
    java/awt/List/EmptyListEventTest/EmptyListEventTest.java
    debug assert on Windows
    + JDK-8198001: java/awt/Menu/WrongParentAfterRemoveMenu/
    /WrongParentAfterRemoveMenu.java debug assert on Windows
    + JDK-8198339: Test javax/swing/border/Test6981576.java is
    unstable
    + JDK-8200701: jdk/jshell/ExceptionsTest.java fails on Windows,
    after JDK-8198801
    + JDK-8203264: JNI exception pending in
    PlainDatagramSocketImpl.c:740
    + JDK-8203672: JNI exception pending in PlainSocketImpl.c
    + JDK-8203673: JNI exception pending in
    DualStackPlainDatagramSocketImpl.c:398
    + JDK-8204834: Fix confusing "allocate" naming in OopStorage
    + JDK-8205399: Set node color on pinned HashMap.TreeNode
    deletion
    + JDK-8205653: test/jdk/sun/management/jmxremote/bootstrap/
    /RmiRegistrySslTest.java and RmiSslBootstrapTest.sh fail with
    handshake_failure
    + JDK-8206179: com/sun/management/OperatingSystemMXBean/
    /GetCommittedVirtualMemorySize.java fails with Committed
    virtual memory size illegal value
    + JDK-8207334: VM times out in VM_HandshakeAllThreads::doit()
    with RunThese30M
    + JDK-8208277: Code cache heap (-XX:ReservedCodeCacheSize)
    doesn't work with 1GB LargePages
    + JDK-8209113: Use WeakReference for lastFontStrike for created
    Fonts
    + JDK-8209333: Socket reset issue for TLS 1.3 socket close
    + JDK-8209439: C2 library_call can potentially ignore Math.pow
    intrinsic or use null pointer
    + JDK-8209534: [TESTBUG]runtime/appcds/cacheObject/
    /ArchivedModuleCompareTest.java fails with EnableJVMCI.
    + JDK-8210147: adjust some WSAGetLastError usages in windows
    network coding
    + JDK-8210284: "assert((av &amp; 0x00000001) == 0) failed:
    unsupported V8" on Solaris 11.4
    + JDK-8210303: VM_HandshakeAllThreads fails assert with
    "failed: blocked and not walkable"
    + JDK-8210459: Add support for generating compile_commands.json
    + JDK-8210515: [TESTBUG]CheckArchivedModuleApp.java needs to
    check if EnableJVMCI is set.
    + JDK-8210788: Javadoc for Thread.join(long, int) should
    specify that it waits forever when both arguments are zero
    + JDK-8211301: [macos] support full window content options
    + JDK-8211332: Space for stub routines (code_size2) is too
    small on new Skylake CPUs
    + JDK-8211339: NPE during SSL handshake caused by
    HostnameChecker
    + JDK-8211392: compiler/profiling/
    /spectrapredefineclass_classloaders/Launcher.java times out
    in JDK12 CI
    + JDK-8211743: [AOT] crash in ScopeDesc::decode_body() when
    JVMTI walks AOT frames
    + JDK-8212154: [TESTBUG] CheckArchivedModuleApp fails with NPE
    when JVMCI is absent
    + JDK-8212167: JShell : Stack trace of exception has wrong line
    number
    + JDK-8212933: Thread-SMR: requesting a VM operation whilst
    holding a ThreadsListHandle can cause deadlocks
    + JDK-8212986: Make Visual Studio compiler check less strict
    + JDK-8213250: CDS archive creation aborts due to metaspace
    object allocation failure
    + JDK-8213516: jck test api/javax_accessibility/AccessibleState/
    /fields.html fails intermittent
    + JDK-8213947: ARM32: failed check_simd should set
    UsePopCountInstruction to false
    + JDK-8214418: half-closed SSLEngine status may cause
    application dead loop
    + JDK-8214440: ldap over a TLS connection negotiate failed with
    "javax.net.ssl.SSLPeerUnverifiedException: hostname of the
    server does not match the hostname in the server's
    certificate"
    + JDK-8214444: Wrong strncat limits in dfa.cpp
    + JDK-8214481: freetype path does not disable TrueType hinting
    with AA+FM hints
    + JDK-8214571: -Xdoclint of array serialField gives "error:
    array type not allowed here"
    + JDK-8214856: Errors with JSZip in web console after upgrade
    to 3.1.5
    + JDK-8214862: assert(proj != __null) at compile.cpp:3251
    + JDK-8215369: Jcstress pollute /var/tmp with temporary files.
    + JDK-8215551: Missing case label in nmethod::reloc_string_for()
    + JDK-8215555: TieredCompilation C2 threads can excessively
    block handshakes
    + JDK-8215711: Missing key_share extension for (EC)DHE key
    exchange should alert missing_extension
    + JDK-8216151: [Graal] Module
    jdk.internal.vm.compiler.management has not been granted
    accessClassInPackage.org.graalvm.compiler.debug
    + JDK-8216154: C4819 warnings at HotSpot sources on Windows
    + JDK-8216541: CompiledICHolders of VM locked unloaded nmethods
    are released too late
    + JDK-8217230: assert(t == t_no_spec) failure in
    NodeHash::check_no_speculative_types()
    + JDK-8217404: --with-jvm-features doesn't work when multiple
    features are explicitly disabled
    + JDK-8217447: Develop flag TraceICs is broken
    + JDK-8217606: LdapContext#reconnect always opens a new
    connection
    + JDK-8218807: Compilation database (compile_commands.json) may
    contain obsolete items
    + JDK-8219214: Infinite Loop in CodeSection::dump()
    + JDK-8219904: ClassCastException when calling
    FlightRecorderMXBean#getRecordings()
    + JDK-8219991: New fix of the deadlock in
    sun.security.ssl.SSLSocketImpl
    + JDK-8221121: applications/microbenchmarks are encountering
    crashes in tier5
    + JDK-8221445: FastSysexMessage constructor crashes MIDI
    receiption thread
    + JDK-8221482: Initialize VMRegImpl::regName[] earlier to
    prevent assert during PrintStubCode
    + JDK-8221741: ClassCastException can happen when
    fontconfig.properties is used
    + JDK-8221823: Requested JDialog width is ignored
    + JDK-8223108: Test java/awt/EventQueue/
    /NonComponentSourcePost.java is unstable
    + JDK-8223678: Add Visual Studio Code workspace generation
    support (for native code)
    + JDK-8223935: PIT: java/awt/font/WindowsIndicFonts.java fails
    on windows10
    + JDK-8224109: Text spaced incorrectly by drawString under
    rotation with fractional metric
    + JDK-8224632: testbug: java/awt/dnd/RemoveDropTargetCrashTest/
    /RemoveDropTargetCrashTest.java fails on MacOS
    + JDK-8224793: os::die() does not honor CreateCoredumpOnCrash
    option
    + JDK-8224847: gc/stress/TestReclaimStringsLeaksMemory.java
    fails with reserved greater than expected
    + JDK-8224931: disable JAOTC invokedynamic support until
    8223533 is fixed
    + JDK-8224997: ChaCha20-Poly1305 TLS cipher suite decryption
    throws ShortBufferException
    + JDK-8225068: Remove DocuSign root certificate that is
    expiring in May 2020
    + JDK-8225069: Remove Comodo root certificate that is expiring
    in May 2020
    + JDK-8225126: Test SetBoundsPaintTest.html faild on Windows
    when desktop is scaled
    + JDK-8225325: Add tests for redefining a class' private method
    during resolution of the bootstrap specifier
    + JDK-8225622: [AOT] runtime/SharedArchiveFile/
    /TestInterpreterMethodEntries.java crashed with AOTed
    java.base
    + JDK-8225653: Provide more information when hitting SIGILL
    from HaltNode
    + JDK-8225783: Incorrect use of binary operators on booleans in
    type.cpp
    + JDK-8225789: Empty method parameter type should generate
    ClassFormatError
    + JDK-8226198: use of &amp; instead of &amp;&amp; in
    LibraryCallKit::arraycopy_restore_alloc_state
    + JDK-8226253: JAWS reports wrong number of radio buttons when
    buttons are hidden.
    + JDK-8226653: [accessibility] Can edit text cell correctly,
    but Accessibility Tool reads nothing about editor
    + JDK-8226806: [macOS 10.14] Methods of Java Robot should be
    called from appropriate thread
    + JDK-8226879: Memory leak in Type::hashcons
    + JDK-8227632: Incorrect PrintCompilation message: made not
    compilable on levels 0 1 2 3 4
    + JDK-8228407: JVM crashes with shared archive file mismatch
    + JDK-8228482: fix xlc16/xlclang comparison of distinct pointer
    types and string literal conversion warnings
    + JDK-8228757: Fail fast if the handshake type is unknown
    + JDK-8229158: make UseSwitchProfiling non-experimental or
    false by-default
    + JDK-8229421: The logic of java/net/ipv6tests/TcpTest.java is
    flawed
    + JDK-8229855: C2 fails with assert(false) failed: bad AD file
    + JDK-8230591: AArch64: Missing intrinsics for Math.ceil,
    floor, rint
    + JDK-8231118: ARM32: Math tests failures
    + JDK-8231213: Migrate SimpleDateFormatConstTest to JDK Repo
    + JDK-8231243: [TESTBUG] CustomFont.java cannot find font file
    + JDK-8231438: [macOS] Dark mode for the desktop is not
    supported
    + JDK-8231550: C2: ShouldNotReachHere() in
    verify_strip_mined_scheduling
    + JDK-8231564: setMaximizedBounds is broken with large display
    scale and multiple monitors
    + JDK-8231572: Use -lobjc instead of -fobjc-link-runtime in
    libosxsecurity
    + JDK-8231631: sun/net/ftp/FtpURLConnectionLeak.java fails
    intermittently with NPE
    + JDK-8231671: Fix copyright headers in hotspot (missing comma
    after year)
    + JDK-8231720: Some perf regressions after 8225653
    + JDK-8231779: crash
    HeapWord*ParallelScavengeHeap::failed_mem_allocate
    + JDK-8231863: Crash if classpath is read from @argument file
    and the main gets option argument
    + JDK-8232080: jlink plugins for vendor information and
    run-time options
    + JDK-8232106: [x86] C2: SIGILL due to usage of SSSE3
    instructions on processors which don't support it
    + JDK-8232134: Change to Visual Studio 2017 15.9.16 for
    building on Windows at Oracle
    + JDK-8232226: [macos 10.15] test/jdk/java/awt/color/
    /EqualityTest/EqualityTest.java may fail
    + JDK-8232357: Compare version info of Santuario to legal notice
    + JDK-8232572: Add hooks for custom output dir in Bundles.gmk
    + JDK-8232634: Problem List ICMColorDataTest.java
    + JDK-8232748: Build static versions of certain JDK libraries
    + JDK-8232846: ProcessHandle.Info command with non-English
    shows question marks
    + JDK-8232880: Update test documentation with additional
    settings for client UI tooltip tests
    + JDK-8233033: C2 produces wrong result while unswitching a
    loop due to lost control dependencies
    + JDK-8233137: runtime/ErrorHandling/VeryEarlyAssertTest.java
    fails after 8232080
    + JDK-8233197: Invert JvmtiExport::post_vm_initialized() and
    Jfr:on_vm_start() start-up order for correct option parsing
    + JDK-8233291: [TESTBUG] tools/jlink/plugins/
    /VendorInfoPluginsTest.java fails with debug or non-server VMs
    + JDK-8233364: Fix undefined behavior in
    Canonicalizer::do_ShiftOp
    + JDK-8233494: Avoid calling MallocTracker::record_malloc and
    record_free when NMT is off
    + JDK-8233573: Toolkit.getScreenInsets(GraphicsConfiguration)
    may throw ClassCastException
    + JDK-8233608: Minimal build broken after JDK-8233494
    + JDK-8233621: Mismatch in jsse.enableMFLNExtension property
    name
    + JDK-8233696: [TESTBUG]Some jtreg tests fail when CAPS_LOCK is
    ON
    + JDK-8233707: systemScale.cpp could not compile with VS2019
    + JDK-8233801: GCMEmptyIv.java test fails on Solaris 11.4
    + JDK-8233880: Support compilers with multi-digit major version
    numbers
    + JDK-8233920: MethodHandles::tryFinally generates illegal
    bytecode for long/double return type
    + JDK-8234137: The "AutoTestOnTop.java" test may run external
    applications
    + JDK-8234146: compiler/jsr292/
    /ContinuousCallSiteTargetChange.java times out on SPARC
    + JDK-8234184: [TESTBUG] java/awt/Mouse/EnterExitEvents/
    /ModalDialogEnterExitEventsTest.java fails in Windows
    + JDK-8234270: [REDO] JDK-8204128 NMT might report incorrect
    numbers for Compiler area
    + JDK-8234332: [TESTBUG] java/awt/Focus/DisposedWindow/
    /DisposeDialogNotActivateOwnerTest/
    /DisposeDialogNotActivateOwnerTest.java fails on linux-x64
    nightly
    + JDK-8234398: Replace ID2D1Factory::GetDesktopDpi with
    GetDeviceCaps
    + JDK-8234522: [macos] Crash with use of native file dialog
    + JDK-8234691: Potential double-free in ParallelSPCleanupTask
    constructor
    + JDK-8234696: tools/jlink/plugins/VendorInfoPluginsTest.java
    times out
    + JDK-8234727: sun/security/ssl/X509TrustManagerImpl tests
    support TLSv1.3
    + JDK-8234728: Some security tests should support TLSv1.3
    + JDK-8234779: Provide idiom for declaring classes noncopyable
    + JDK-8234824: java/nio/channels/SocketChannel/AdaptSocket.java
    fails on Windows 10
    + JDK-8234968: check calloc rv in libinstrument
    InvocationAdapter
    + JDK-8235153: [TESTBUG] [macos 10.15] java/awt/Graphics/
    /DrawImageBG/SystemBgColorTest.java fails
    + JDK-8235183: Remove the "HACK CODE" in comment
    + JDK-8235263: Revert TLS 1.3 change that wrapped IOExceptions
    + JDK-8235311: Tag mismatch may alert bad_record_mac
    + JDK-8235332: TestInstanceCloneAsLoadsStores.java fails with
  - XX:+StressGCM
    + JDK-8235452: Strip mined loop verification fails with
    assert(is_OuterStripMinedLoop()) failed: invalid node class
    + JDK-8235584: UseProfiledLoopPredicate fails with
    assert(_phase-&gt;get_loop(c) == loop) failed: have to be in the
    same loop
    + JDK-8235620: Broken merge between JDK-8006406 and JDK-8003559
    + JDK-8235638: NPE in LWWindowPeer.getOnscreenGraphics()
    + JDK-8235686: Add more custom hooks in Bundles.gmk
    + JDK-8235739: Rare NPE at WComponentPeer.getGraphics()
    + JDK-8235762: JVM crash in SWPointer during C2 compilation
    + JDK-8235834: IBM-943 charset encoder needs updating
    + JDK-8235874: The ordering of Cipher Suites is not maintained
    provided through jdk.tls.client.cipherSuites and
    jdk.tls.server.cipherSuites system property.
    + JDK-8235908: omit ThreadPriorityPolicy warning when value is
    set from image
    + JDK-8235984: C2: assert(out-&gt;in(PhiNode::Region) == head ||
    out-&gt;in(PhiNode::Region) == slow_head) failed: phi must be
    either part of the slow or the fast loop
    + JDK-8236211: [Graal] compiler/graalunit/GraphTest.java is
    skipped in all testing
    + JDK-8236470: Deal with ECDSA using ecdsa-with-SHA2 plus hash
    algorithm as AlgorithmId
    + JDK-8236545: Compilation error in mach5
    java/awt/FileDialog/MacOSGoToFolderCrash.java
    + JDK-8236700: Upgrading JSZip from v3.1.5 to v3.2.2
    + JDK-8236759: ShouldNotReachHere in
    PhaseIdealLoop::verify_strip_mined_scheduling
    + JDK-8236897: Fix the copyright header for pkcs11gcm2.h
    + JDK-8236921: Add build target to produce a JDK image suitable
    for a Graal/SVM build
    + JDK-8236953: [macos] JavaFX SwingNode is not rendered on macOS
    + JDK-8236996: Incorrect Roboto font rendering on Windows with
    subpixel antialiasing
    + JDK-8237045: JVM uses excessive memory with -XX:+EnableJVMCI
  - XX:JVMCICounterSize=2147483648
    + JDK-8237055: [TESTBUG] compiler/c2/TestJumpTable.java fails
    with release VMs
    + JDK-8237086: assert(is_MachReturn()) running CTW with fix for
    JDK-8231291
    + JDK-8237192: Generate stripped/public pdbs on Windows for jdk
    images
    + JDK-8237396: JvmtiTagMap::weak_oops_do() should not trigger
    barriers
    + JDK-8237474: Default SSLEngine should create in server role
    + JDK-8237859: C2: Crash when loads float above range check
    + JDK-8237879: make 4.3 breaks build
    + JDK-8237951: CTW: C2 compilation fails with "malformed
    control flow"
    + JDK-8237962: give better error output for invalid OCSP
    response intervals in CertPathValidator checks
    + JDK-8238190: [JVMCI] Fix single implementor speculation for
    diamond shapes.
    + JDK-8238356: CodeHeap::blob_count() overestimates the number
    of blobs
    + JDK-8238452: Keytool generates wrong expiration date if
    validity is set to 2050/01/01
    + JDK-8238555: Allow Initialization of SunPKCS11 with NSS when
    there are external FIPS modules in the NSSDB
    + JDK-8238575: DragSourceEvent.getLocation() returns wrong
    value on HiDPI screens (Windows)
    + JDK-8238676: jni crashes on accessing it from process exit
    hook
    + JDK-8238721: Add failing client jtreg tests to the Problem
    List
    + JDK-8238738: AudioSystem.getMixerInfo() takes about 30 sec to
    report a gone audio device
    + JDK-8238756: C2: assert(((n) == __null || !VerifyIterativeGVN
    || !((n)-&gt;is_dead()))) failed: can not use dead node
    + JDK-8238765: PhaseCFG::schedule_pinned_nodes cannot handle
    precedence edges from unmatched CFG nodes correctly
    + JDK-8238898: Missing hash characters for header on license
    file
    + JDK-8238942: Rendering artifacts with LCD text and fractional
    metrics
    + JDK-8238985: [TESTBUG] The arrow image is blue instead of
    green
    + JDK-8239000: handle ContendedPaddingWidth in vm_version_ppc
    + JDK-8239055: Wrong implementation of VMState.hasListener
    + JDK-8239091: Reversed arguments in call to strstr in freetype
    "debug" code.
    + JDK-8239142: C2's UseUniqueSubclasses optimization is broken
    for array accesses
    + JDK-8239224: libproc_impl.c previous_thr may be used
    uninitialized warning
    + JDK-8239351: Give more meaningful InternalError messages in
    Deflater.c
    + JDK-8239365: ProcessBuilder test modifications for AIX
    execution
    + JDK-8239456: vtable stub generation: assert failure (code
    size estimate)
    + JDK-8239457: call ReleaseStringUTFChars before early returns
    in Java_sun_security_pkcs11_wrapper_PKCS11_connect
    + JDK-8239462: jdk.hotspot.agent misses some
    ReleaseStringUTFChars calls in case of early returns
    + JDK-8239557: [TESTBUG] VeryEarlyAssertTest.java validating
    "END." marker at lastline is not always true
    + JDK-8239787: AArch64: String.indexOf may incorrectly handle
    empty strings
    + JDK-8239792: Bump update version for OpenJDK: jdk-11.0.8
    + JDK-8239798: SSLSocket closes socket both socket endpoints on
    a SocketTimeoutException
    + JDK-8239819: XToolkit: Misread of screen information memory
    + JDK-8239852: java/util/concurrent tests fail with
  - XX:+VerifyGraphEdges: assert(!VerifyGraphEdges) failed:
    verification should have failed
    + JDK-8239893: Windows handle Leak when starting processes
    using ProcessBuilder
    + JDK-8239915: Zero VM crashes when handling dynamic constant
    + JDK-8239931: [win][x86] vtable stub generation: assert
    failure (code size estimate) follow-up
    + JDK-8239965: XMLEncoder/Test4625418.java fails due to "Error:
    Cp943 - can't read properly"
    + JDK-8239976: Put JDK-8239965 on the ProblemList.txt
    + JDK-8240073: Fix 'test-make' build target in 11u
    + JDK-8240197: Cannot start JVM when $JAVA_HOME includes CJK
    characters
    + JDK-8240202: A few client tests leave mouse buttons pressed
    + JDK-8240220: IdealLoopTree::dump_head predicate printing is
    broken
    + JDK-8240223: Use consistent predicate order in and with
    PhaseIdealLoop::find_predicate
    + JDK-8240227: Loop predicates should be copied to unswitched
    loops
    + JDK-8240286: [TESTBUG] Test command error in hotspot/jtreg/
    /compiler/loopopts/superword/SumRedAbsNeg_Float.java
    + JDK-8240518: Incorrect JNU_ReleaseStringPlatformChars in
    Windows Print
    + JDK-8240529: CheckUnhandledOops breaks NULL check in
    Modules::define_module
    + JDK-8240576: JVM crashes after transformation in C2
    IdealLoopTree::merge_many_backedges
    + JDK-8240603: Windows 32bit compile error after 8238676
    + JDK-8240629: argfiles parsing broken for argfiles with
    comment cross 4096 bytes chunk
    + JDK-8240711: TestJstatdPort.java failed due to
    "ExportException: Port already in use:"
    + JDK-8240786: [TESTBUG] The test java/awt/Window/
    /GetScreenLocation/GetScreenLocationTest.java fails on HiDPI
    screen
    + JDK-8240824: enhance print_full_memory_info on Linux by THP
    related information
    + JDK-8240827: Downport SSLSocketImpl.java from "8221882: Use
    fiber-friendly java.util.concurrent.locks in JSSE"
    + JDK-8240905: assert(mem == (Node*)1 || mem == mem2) failed:
    multiple Memories being matched at once?
    + JDK-8240972: macOS codesign fail on macOS 10.13.5 or older
    + JDK-8241445: Fix copyright in
    test/jdk/tools/launcher/ArgFileSyntax.java
    + JDK-8241458: [JVMCI] add mark value to expose
    CodeOffsets::Frame_Complete
    + JDK-8241464: [11u] Backport: make rehashing be a needed
    guaranteed safepoint cleanup action
    + JDK-8241556: Memory leak if -XX:CompileCommand is set
    + JDK-8241568: (fs) UserPrincipalLookupService.lookupXXX
    failure with IOE "Operation not permitted"
    + JDK-8241586: compiler/cpuflags/
    /TestAESIntrinsicsOnUnsupportedConfig.java fails on aarch64
    + JDK-8241638: launcher time metrics always report 1 on Linux
    when _JAVA_LAUNCHER_DEBUG set
    + JDK-8241660: Add virtualization information output to hs_err
    file on macOS
    + JDK-8241808: [TESTBUG] The JDK-8039467 bug appeared on macOS
    + JDK-8241888: Mirror jdk.security.allowNonCaAnchor system
    property with a security one
    + JDK-8241900: Loop unswitching may cause dependence on null
    check to be lost
    + JDK-8241948: enhance list of environment variables printed in
    hs_err file
    + JDK-8241996: on linux set full relro in the linker flags
    + JDK-8242108: Performance regression after fix for JDK-8229496
    + JDK-8242141: New System Properties to configure the TLS
    signature schemes
    + JDK-8242154: Backport parts of JDK-4947890 to OpenJDK 11u
    + JDK-8242174: [macos] The NestedModelessDialogTest test make
    the macOS unstable
    + JDK-8242239: [Graal] javax/management/generified/
    /GenericTest.java fails: FAILED: queryMBeans sets same
    + JDK-8242294: JSSE Client does not throw SSLException when an
    alert occurs during handshaking
    + JDK-8242379: [TESTBUG] compiler/loopopts/
    /TestLoopUnswitchingLostCastDependency.java fails with
    release VMs
    + JDK-8242470: Update Xerces to Version 2.12.1
    + JDK-8242498: Invalid "sun.awt.TimedWindowEvent" object leads
    to JVM crash
    + JDK-8242541: Small charset issues (ISO8859-16, x-eucJP-Open,
    x-IBM834 and x-IBM949C)
    + JDK-8242626: enhance posix print_rlimit_info
    + JDK-8243059: Build fails when --with-vendor-name contains a
    comma
    + JDK-8243539: Copyright info (Year) should be updated for fix
    of 8241638
    + JDK-8243541: (tz) Upgrade time-zone data to tzdata2020a
    + JDK-8244407: JVM crashes after transformation in C2
    IdealLoopTree::split_fall_in
    + JDK-8244520: problemlist
    java/awt/font/Rotate/RotatedFontTest.java on linux
    + JDK-8244777: ClassLoaderStats VM Op uses constant hash value
    + JDK-8244853: The static build of libextnet is missing the
    JNI_OnLoad_extnet function
    + JDK-8244951: Missing entitlements for hardened runtime
    + JDK-8245047: [PPC64] C2: ReverseBytes + Load always match to
    unordered Load (acquire semantics missing)
    + JDK-8245649: Revert 8245397 backport of 8230591
    + JDK-8246031: SSLSocket.getSession() doesn't close connection
    for timeout/ interrupts
    + JDK-8246613: Choose the default SecureRandom algo based on
    registration ordering
    + JDK-8248505: Unexpected NoSuchAlgorithmException when using
    secure random impl from BCFIPS provider
- Removed patch:
  * JDK-8228407.patch
    + integrated upstream</changelog>
  <changelog author="fstrba@suse.com" date="1604318400">- Update to upstream tag jdk-11.0.9-11 (October 2020 CPU,
  bsc#1177943)
  * New features
    + JDK-8250784: Shenandoah: A Low-Pause-Time Garbage Collector
  * Security fixes
    + JDK-8233624: Enhance JNI linkage
    + JDK-8236196: Improve string pooling
    + JDK-8236862, CVE-2020-14779: Enhance support of Proxy class
    + JDK-8237990, CVE-2020-14781: Enhanced LDAP contexts
    + JDK-8237995, CVE-2020-14782: Enhance certificate processing
    + JDK-8240124: Better VM Interning
    + JDK-8241114, CVE-2020-14792: Better range handling
    + JDK-8242680, CVE-2020-14796: Improved URI Support
    + JDK-8242685, CVE-2020-14797: Better Path Validation
    + JDK-8242695, CVE-2020-14798: Enhanced buffer support
    + JDK-8243302: Advanced class supports
    + JDK-8244136, CVE-2020-14803: Improved Buffer supports
    + JDK-8244479: Further constrain certificates
    + JDK-8244955: Additional Fix for JDK-8240124
    + JDK-8245407: Enhance zoning of times
    + JDK-8245412: Better class definitions
    + JDK-8245417: Improve certificate chain handling
    + JDK-8248574: Improve jpeg processing
    + JDK-8249927: Specify limits of jdk.serialProxyInterfaceLimit
    + JDK-8253019: Enhanced JPEG decoding
  * Other changes
    + JDK-6532025: GIF reader throws misleading exception with
    truncated images
    + JDK-6949753: [TEST BUG]: java/awt/print/PageFormat/
    /PDialogTest.java needs update by removing an infinite loop
    + JDK-8022535: [TEST BUG] javax/swing/text/html/parser/
    /Test8017492.java fails
    + JDK-8062947: Fix exception message to correctly represent
    LDAP connection failure
    + JDK-8067354: com/sun/jdi/GetLocalVariables4Test.sh failed
    + JDK-8134599: TEST_BUG: java/rmi/transport/closeServerSocket/
    /CloseServerSocket.java fails intermittently with Address
    already in use
    + JDK-8151678: com/sun/jndi/ldap/LdapTimeoutTest.java failed
    due to timeout on DeadServerNoTimeoutTest is incorrect
    + JDK-8160768: Add capability to custom resolve host/domain
    names within the default JNDI LDAP provider
    + JDK-8172404: Tools should warn if weak algorithms are used
    before restricting them
    + JDK-8193367: Annotated type variable bounds crash javac
    + JDK-8202117: com/sun/jndi/ldap/RemoveNamingListenerTest.java
    fails intermittently: Connection reset
    + JDK-8203026: java.rmi.NoSuchObjectException: no such object
    in table
    + JDK-8203281: [Windows] JComboBox change in ui when
    editor.setBorder() is called
    + JDK-8203382: Rename SystemDictionary::initialize_wk_klass to
    resolve_wk_klass
    + JDK-8203393: com/sun/jdi/JdbMethodExitTest.sh and
    JdbExprTest.sh fail due to timeout
    + JDK-8203928: [Test] Convert non-JDB scaffolding
    serviceability shell script tests to java
    + JDK-8204963: javax.swing.border.TitledBorder has a memory leak
    + JDK-8204994: SA might fail to attach to process with "Windbg
    Error: WaitForEvent failed"
    + JDK-8205534: Remove SymbolTable dependency from
    serviceability agent
    + JDK-8206309: Tier1 SA tests fail
    + JDK-8208281: java/nio/channels/
    /AsynchronousSocketChannel/Basic.java timed out
    + JDK-8209109: [TEST] rewrite com/sun/jdi shell tests to java
    version - step1
    + JDK-8209332: [TEST] test/jdk/com/sun/jdi/CatchPatternTest.sh
    is incorrect
    + JDK-8209342: Problemlist SA tests on Solaris due to Error
    attaching to process: Can't create thread_db agent!
    + JDK-8209343: Test javax/swing/border/TestTitledBorderLeak.java
    should be marked as headful
    + JDK-8209517: com/sun/jdi/BreakpointWithFullGC.java fails with
    timeout
    + JDK-8209604: [TEST] rewrite com/sun/jdi shell tests to java
    version - step2
    + JDK-8209605: com/sun/jdi/BreakpointWithFullGC.java fails with
    ZGC
    + JDK-8209608: Problem list com/sun/jdi/BreakpointWithFullGC.java
    + JDK-8210131: vmTestbase/nsk/jvmti/scenarios/allocation/AP10/
    /ap10t001/TestDescription.java failed with ObjectFree:
    GetCurrentThreadCpuTimerInfo returned unexpected error code
    + JDK-8210243: [TEST] rewrite com/sun/jdi shell tests to java
    version - step3
    + JDK-8210527: JShell: NullPointerException in
    jdk.jshell.Eval.translateExceptionStack
    + JDK-8210560: [TEST] convert com/sun/jdi redefineClass-related
    tests
    + JDK-8210725: com/sun/jdi/RedefineClearBreakpoint.java fails
    with waitForPrompt timed out after 60 seconds
    + JDK-8210748: [TESTBUG] lib.jdb.Jdb.waitForPrompt() should
    clarify which output is the pending reply after a timeout
    + JDK-8210760: [TEST] rewrite com/sun/jdi shell tests to java
    version - step4
    + JDK-8210977: jdk/jfr/event/oldobject/TestThreadLocalLeak.java
    fails to find ThreadLocalObject
    + JDK-8211292: [TEST] convert com/sun/jdi/DeferredStepTest.sh
    test
    + JDK-8211694: JShell: Redeclared variable should be reset
    + JDK-8212200: assert when shared java.lang.Object is redefined
    by JVMTI agent
    + JDK-8212629: [TEST] wrong breakpoint in
    test/jdk/com/sun/jdi/DeferredStepTest
    + JDK-8212665: com/sun/jdi/DeferredStepTest.java: jj1 (line 57)
  - unexpected. lastLine=52, minLine=52, maxLine=55
    + JDK-8212807: tools/jar/multiRelease/Basic.java times out
    + JDK-8213182: Minimal VM build failure after JDK-8212200
    (assert when shared java.lang.Object is redefined by JVMTI
    agent)
    + JDK-8213214: Set -Djava.io.tmpdir= when running tests
    + JDK-8213275: ReplaceCriticalClasses.java fails with
    jdk.internal.vm.PostVMInitHook not found
    + JDK-8213574: Deadlock in string table expansion when dumping
    lots of CDS classes
    + JDK-8213703: LambdaConversionException: Invalid receiver type
    not a subtype of implementation type interface
    + JDK-8214074: Ghash optimization using AVX instructions
    + JDK-8214491: Upgrade to JLine 3.9.0
    + JDK-8214797: TestJmapCoreMetaspace.java timed out
    + JDK-8215243: JShell tests failing intermitently with
    "Problem cleaning up the following threads:"
    + JDK-8215244: jdk/jshell/ToolBasicTest.java
    testHistoryReference failed
    + JDK-8215354: x86_32 build failures after JDK-8214074 (Ghash
    optimization using AVX instructions)
    + JDK-8215438: jshell tool: Ctrl-D causes EOF
    + JDK-8216021: RunTest.gmk might set concurrency level to 1 on
    Windows
    + JDK-8216974: HttpConnection not returned to the pool after
    204 response
    + JDK-8218948: SimpleDateFormat :: format - Zone Names are not
    reflected correctly during run time
    + JDK-8219712: code_size2 (defined in stub_routines_x86.hpp) is
    too small on new Skylake CPUs
    + JDK-8220150: macos10.14 Mojave returns anti-aliased glyphs
    instead of aliased B&amp;W glyphs
    + JDK-8221658: aarch64: add necessary predicate for ubfx
    patterns
    + JDK-8221759: Crash when completing "java.io.File.path"
    + JDK-8221918: runtime/SharedArchiveFile/serviceability/
    /ReplaceCriticalClasses.java fails: Shared archive not found
    + JDK-8222074: Enhance auto vectorization for x86
    + JDK-8222079: Don't use memset to initialize fields decode_env
    constructor in disassembler.cpp
    + JDK-8222769: [TESTBUG] TestJFRNetworkEvents should not rely
    on hostname command
    + JDK-8223688: JShell: crash on the instantiation of raw
    anonymous class
    + JDK-8223777: In posix_spawn mode, failing to exec()
    jspawnhelper does not result in an error
    + JDK-8223940: Private key not supported by chosen signature
    algorithm
    + JDK-8224184: jshell got IOException at exiting with AIX
    + JDK-8224234: compiler/codegen/TestCharVect2.java fails in
    test_mulc
    + JDK-8225037: java.net.JarURLConnection::getJarEntry() throws
    NullPointerException
    + JDK-8225625: AES Electronic Codebook (ECB) encryption and
    decryption optimization using AVX512 + VAES instructions
    + JDK-8226536: Catch OOM from deopt that fails rematerializing
    objects
    + JDK-8226575: OperatingSystemMXBean should be made container
    aware
    + JDK-8226697: Several tests which need the @key headful
    keyword are missing it.
    + JDK-8226809: Circular reference in printed stack trace is not
    correctly indented &amp; ambiguous
    + JDK-8227059: sun/security/tools/keytool/
    /DefaultSignatureAlgorithm.java timed out
    + JDK-8227269: Slow class loading when running with JDWP
    + JDK-8227595: keytool/fakegen/DefaultSignatureAlgorithm.java
    fails due to "exitValue = 6"
    + JDK-8228448: Jconsole can't connect to itself
    + JDK-8228967: Trust/Key store and SSL context utilities for
    tests
    + JDK-8229378: jdwp library loader in linker_md.c quietly
    truncates on buffer overflow
    + JDK-8229815: Upgrade Jline to 3.12.1
    + JDK-8230000: some httpclients testng tests run zero test
    + JDK-8230002: javax/xml/jaxp/unittest/transform/
    /SecureProcessingTest.java runs zero test
    + JDK-8230010: Remove jdk8037819/BasicTest1.java
    + JDK-8230094: CCE in createXMLEventWriter(Result) over an
    arbitrary XMLStreamWriter
    + JDK-8230402: Allocation of compile task fails with assert:
    "Leaking compilation tasks?"
    + JDK-8230767: FlightRecorderListener returns null recording
    + JDK-8230870: (zipfs) Add a ZIP FS test that is similar to
    test/jdk/java/util/zip/EntryCount64k.java
    + JDK-8231209: [REDO] ThreadMXBean::getThreadAllocatedBytes()
    can be quicker for self thread
    + JDK-8231586: enlarge encoding space for OopMapValue offsets
    + JDK-8231953: Wrong assumption in assertion in
    oop::register_oop
    + JDK-8231968: getCurrentThreadAllocatedBytes default
    implementation s/b getThreadAllocatedBytes
    + JDK-8232083: Minimal VM is broken after JDK-8231586
    + JDK-8232161: Align some one-way conversion in MS950 charset
    with Windows
    + JDK-8232855: jshell missing word in /help help
    + JDK-8233027: OopMapSet::all_do does oms.next() twice during
    iteration
    + JDK-8233228: Disable weak named curves by default in TLS,
    CertPath, and Signed JAR
    + JDK-8233386: Initialize NULL fields for unused decorations
    + JDK-8233452: java.math.BigDecimal.sqrt() with
    RoundingMode.FLOOR results in incorrect result
    + JDK-8233686: XML transformer uses excessive amount of memory
    + JDK-8233741: AES Countermode (AES-CTR) optimization using
    AVX512 + VAES instructions
    + JDK-8233829: javac cannot find non-ASCII module name under
    non-UTF8 environment
    + JDK-8233958: Memory retention due to HttpsURLConnection
    finalizer that serves no purpose
    + JDK-8234011: (zipfs) Memory leak in
    ZipFileSystem.releaseDeflater()
    + JDK-8234058: runtime/CompressedOops/
    /CompressedClassPointers.java fails with 'Narrow klass base:
    0x0000000000000000' missing from stdout/stderr
    + JDK-8234149: Several regression tests do not dispose Frame at
    end
    + JDK-8234347: "Turkey" meta time zone does not generate
    composed localized names
    + JDK-8234385: [TESTBUG] java/awt/EventQueue/6980209/
    /bug6980209.java fails in linux nightly
    + JDK-8234535: Cross compilation fails due to missing CFLAGS
    for the BUILD_CC
    + JDK-8234541: C1 emits an empty message when it inlines
    successfully
    + JDK-8234687: change javap reporting on unknown attributes
    + JDK-8236464: SO_LINGER option is ignored by SSLSocket in JDK
    11
    + JDK-8236548: Localized time zone name inconsistency between
    English and other locales
    + JDK-8236617: jtreg test containers/docker/
    /TestMemoryAwareness.java fails after 8226575
    + JDK-8237182: Update copyright header for shenandoah and
    epsilon files
    + JDK-8237888: security/infra/java/security/cert/
    /CertPathValidator/certification/LuxTrustCA.java fails when
    checking validity interval
    + JDK-8237977: Further update
    javax/net/ssl/compatibility/Compatibility.java
    + JDK-8238270: java.net HTTP/2 client does not decrease stream
    count when receives 204 response
    + JDK-8238284: [macos] Zero VM build fails due to an obvious
    typo
    + JDK-8238380: java.base/unix/native/libjava/childproc.c
    "multiple definition" link errors with GCC10
    + JDK-8238386: (sctp) jdk.sctp/unix/native/libsctp/SctpNet.c
    "multiple definition" link errors with GCC10
    + JDK-8238388: libj2gss/NativeFunc.o "multiple definition" link
    errors with GCC10
    + JDK-8238448: RSASSA-PSS signature verification fail when
    using certain odd key sizes
    + JDK-8238710: LingeredApp doesn't log stdout/stderr if exits
    with non-zero code
    + JDK-8239083: C1 assert(known_holder == NULL ||
    (known_holder-&gt;is_instance_klass() &amp;&amp;
    (!known_holder-&gt;is_interface() ||
    ((ciInstanceKlass*)known_holder)-&gt;has_nonstatic_concrete_methods())),
    "should be non-static concrete method");
    + JDK-8239385: KerberosTicket client name refers wrongly to
    sAMAccountName in AD
    + JDK-8240169: javadoc fails to link to non-modular api docs
    + JDK-8240295: hs_err elapsed time in seconds is not accurate
    enough
    + JDK-8240360: NativeLibraryEvent has wrong library name on
    Linux
    + JDK-8240676: Meet not symmetric failure when running lucene
    on jdk8
    + JDK-8241007: Shenandoah: remove
    ShenandoahCriticalControlThreadPriority support
    + JDK-8241065: Shenandoah: remove leftover code after
    JDK-8231086
    + JDK-8241086: Test runtime/NMT/HugeArenaTracking.java is
    failing on 32bit Windows
    + JDK-8241130: com.sun.jndi.ldap.EventSupport.removeDeadNotifier:
    java.lang.NullPointerException
    + JDK-8241138: http.nonProxyHosts=* causes
    StringIndexOutOfBoundsException in DefaultProxySelector
    + JDK-8241319: WB_GetCodeBlob doesn't have ResourceMark
    + JDK-8241478: vmTestbase/gc/gctests/Steal/steal001/steal001.java
    fails with OOME
    + JDK-8241574: Shenandoah: remove ShenandoahAssertToSpaceClosure
    + JDK-8241750: x86_32 build failure after JDK-8227269
    + JDK-8242184: CRL generation error with RSASSA-PSS
    + JDK-8242283: Can't start JVM when java home path includes
    non-ASCII character
    + JDK-8242556: Cannot load RSASSA-PSS public key with non-null
    params from byte array
    + JDK-8243029: Rewrite javax/net/ssl/compatibility/
    /Compatibility.java with a flexible interop test framework
    + JDK-8243138: Enhance BaseLdapServer to support starttls
    extended request
    + JDK-8243320: Add SSL root certificates to Oracle Root CA
    program
    + JDK-8243321: Add Entrust root CA - G4 to Oracle Root CA
    program
    + JDK-8243389: enhance os::pd_print_cpu_info on linux
    + JDK-8243453: java --describe-module failed with non-ASCII
    module name under non-UTF8 environment
    + JDK-8243470: [macos] bring back O2 opt level for unsafe.cpp
    + JDK-8243489: Thread CPU Load event may contain wrong data for
    CPU time under certain conditions
    + JDK-8243925: Toolkit#getScreenInsets() returns wrong value on
    HiDPI screens (Windows)
    + JDK-8244087: 2020-04-24 public suffix list update
    + JDK-8244151: Update MUSCLE PC/SC-Lite headers to the latest
    release 1.8.26
    + JDK-8244164: AArch64: jaotc generates incorrect code for
    compressed OOPs with non-zero heap base
    + JDK-8244196: adjust output in os_linux
    + JDK-8244225: stringop-overflow warning on strncpy call from
    compile_the_world_in
    + JDK-8244287: JFR: Methods samples have line number 0
    + JDK-8244703: "platform encoding not initialized" exceptions
    with debugger, JNI
    + JDK-8244719: CTW: C2 compilation fails with
    "assert(!VerifyHashTableKeys || _hash_lock == 0) failed:
    remove node from hash table before modifying it"
    + JDK-8244729: Shenandoah: remove resolve paths from
    SBSA::generate_shenandoah_lrb
    + JDK-8244763: Update --release 8 symbol information after JSR
    337 MR3
    + JDK-8244818: Java2D Queue Flusher crash while moving
    application window to external monitor
    + JDK-8245151: jarsigner should not raise duplicate warnings on
    verification
    + JDK-8245616: Bump update version for OpenJDK: jdk-11.0.9
    + JDK-8245714: "Bad graph detected in build_loop_late" when
    loads are pinned on loop limit check uncommon branch
    + JDK-8245801: StressRecompilation triggers assert "redundunt
    OSR recompilation detected. memory leak in CodeCache!"
    + JDK-8245832: JDK build make-static-libs should build all JDK
    libraries
    + JDK-8245880: Shenandoah: check class unloading flag early in
    concurrent code root scan
    + JDK-8245981: Upgrade to jQuery 3.5.1
    + JDK-8246027: Minimal fastdebug build broken after JDK-8245801
    + JDK-8246094: [macos] Sound Recording and playback is not
    working
    + JDK-8246153: TestEliminateArrayCopy fails with
  - XX:+StressReflectiveCode
    + JDK-8246193: Possible NPE in ENC-PA-REP search in AS-REQ
    + JDK-8246196: javax/management/MBeanServer/OldMBeanServerTest
    fails with AssertionError
    + JDK-8246203: Segmentation fault in verification due to stack
    overflow with -XX:+VerifyIterativeGVN
    + JDK-8246330: Add TLS Tests for Legacy ECDSA curves
    + JDK-8246453: TestClone crashes with "all collected exceptions
    must come from the same place"
    + JDK-8247246: Add explicit ResolvedJavaType.link and expose
    presence of default methods
    + JDK-8247350: [aarch64] assert(false) failed: wrong size of
    mach node
    + JDK-8247502: PhaseStringOpts crashes while optimising
    effectively dead code
    + JDK-8247615: Initialize the bytes left for the heap sampler
    + JDK-8247824: CTW: C2 (Shenandoah) compilation fails with SEGV
    in SBC2Support::pin_and_expand
    + JDK-8247874: Replacement in VersionProps.java.template not
    working when --with-vendor-bug-url contains '&amp;'
    + JDK-8247979: aarch64: missing side effect of killing flags
    for clearArray_reg_reg
    + JDK-8248214: Add paddings for TaskQueueSuper to reduce
    false-sharing cache contention
    + JDK-8248219: aarch64: missing memory barrier in
    fast_storefield and fast_accessfield
    + JDK-8248348: Regression caused by the update to BCEL 6.0
    + JDK-8248385: [testbug][11u] Adapt TestInitiExceptions to
    jtreg 5.1
    + JDK-8248495: [macos] zerovm is broken due to libffi headers
    location
    + JDK-8248851: CMS: Missing memory fences between free chunk
    check and klass read
    + JDK-8248987: AOT's Linker.java seems to eagerly fail-fast on
    Windows
    + JDK-8249159: Downport test rework for SSLSocketTemplate from
    8224650
    + JDK-8249215: JFrame::setVisible crashed with
  - Dfile.encoding=UTF-8 on Japanese Windows.
    + JDK-8249251: [dark_mode ubuntu 20.04] The selected menu is
    not highlighted in GTKLookAndFeel
    + JDK-8249255: Build fails if source code in cygwin home dir
    + JDK-8249277: TestVerifyIterativeGVN.java is failing with
    timeout in OpenJDK 11
    + JDK-8249278: Revert JDK-8226253 which breaks the spec of
    AccessibleState.SHOWING for JList
    + JDK-8249560: Shenandoah: Fix racy GC request handling
    + JDK-8249801: Shenandoah: Clear soft-refs on requested GC cycle
    + JDK-8249953: Shenandoah: gc/shenandoah/mxbeans tests should
    account for corner cases
    + JDK-8250582: Revert Principal Name type to NT-UNKNOWN when
    requesting TGS Kerberos tickets
    + JDK-8250609: C2 crash in IfNode::fold_compares
    + JDK-8250627: Use -XX:+/-UseContainerSupport for
    enabling/disabling Java container metrics
    + JDK-8250755: Better cleanup for
    jdk/test/javax/imageio/plugins/shared/CanWriteSequence.java
    + JDK-8250787: Provider.put no longer registering aliases in
    FIPS env
    + JDK-8250826: jhsdb does not work with coredump which comes
    from Substrate VM
    + JDK-8250827: Shenandoah: needs to reset/finish StringTable's
    dead count before/after parallel walk
    + JDK-8250844: Make sure {type,obj}ArrayOopDesc accessors check
    the bounds
    + JDK-8251117: Cannot check P11Key size in P11Cipher and
    P11AEADCipher
    + JDK-8251354: Shenandoah: Fix jdk/jfr/tool/TestPrintJSON.java
    test failure
    + JDK-8251451: Shenandoah: Remark ObjectSynchronizer roots with
    I-U
    + JDK-8251469: Better cleanup for
    test/jdk/javax/imageio/SetOutput.java
    + JDK-8251487: Shenandoah: missing detail timing tracking for
    final mark cleaning phase
    + JDK-8252120: compiler/oracle/TestCompileCommand.java
    misspells "occured"
    + JDK-8252157: JDK-8231209 11u backport breaks jmm binary
    compatibility
    + JDK-8252258: [11u] JDK-8242154 changes the default vendor
    + JDK-8252804: [test] Fix 'ReleaseDeflater.java' test after
    downport of 8234011
    + JDK-8253134: JMM_VERSION should remain at 0x20020000 (JDK 10)
    in JDK 11
    + JDK-8253283: [11u] Test build/translations/
    /VerifyTranslations.java failing after JDK-8252258
    + JDK-8253813: Backout JDK-8244287 from 11u: it causes several
    crashes
- Removed patch:
  * gcc-fno-common-fix.patch
    + not needed any more with this version
- Added patch:
  * JDK-8250861.patch
    + Fix regression "8250861: Crash in MinINode::Ideal(PhaseGVN*,
    bool)" introduced in jdk 11.0.9</changelog>
  <changelog author="fstrba@suse.com" date="1604491200">- Enable Sheandoah GC for x86_64 (jsc#ECO-3171)</changelog>
  <changelog author="fstrba@suse.com" date="1605528000">- Update to upstream tag jdk-11.0.9.1-1
  * Fix:
    + JDK-8250861: Crash in MinINode::Ideal(PhaseGVN*, bool)
- Removed patch:
  * JDK-8250861.patch
    + Integrated upstream</changelog>
  <changelog author="fstrba@suse.com" date="1611230400">- Update to upstream tag jdk-11.0.10+9 (January 2021 CPU,
  bsc#1181239)
  * Security fixes
    + JDK-8247619: Improve Direct Buffering of Characters
  * Other changes
    + JDK-6722928: Support SSPI as a native GSS-API provider
    + JDK-7185258: [macosx] Deadlock in SunToolKit.realSync()
    + JDK-8152332: [macosx] JFileChooser cannot be serialized on
    Mac OS X
    + JDK-8161684: [testconf] Add VerifyOops' testing into compiler
    tiers
    + JDK-8171279: Support X25519 and X448 in TLS
    + JDK-8173361: various crashes in
    JvmtiExport::post_compiled_method_load
    + JDK-8173658: JvmtiExport::post_class_unload() is broken for
    non-JavaThread initiators
    + JDK-8191006: hsdis disassembler plugin does not compile with
    binutils 2.29+
    + JDK-8197981: Missing return statement in
    __sync_val_compare_and_swap_8
    + JDK-8198334: java/awt/FileDialog/8003399/bug8003399.java
    fails in headless mode
    + JDK-8200151: Add 8 JNDI tests to com/sun/jndi/dns/ConfigTests/
    + JDK-8208279: Add 8 JNDI tests to com/sun/jndi/dns/EnvTests/
    + JDK-8208483: Add 5 JNDI tests to
    com/sun/jndi/dns/FactoryTests/
    + JDK-8208542: Add 4 JNDI tests to com/sun/jndi/dns/ListTests/
    + JDK-8208665: Amend cross-compilation docs with
    qemu-debootstrap recipe
    + JDK-8210088: ProblemList gc/epsilon/TestMemoryMXBeans.java
    + JDK-8210339: Add 10 JNDI tests to com/sun/jndi/dns/FedTests/
    + JDK-8211450: UndetVar::dup is not copying the kind field to
    the duplicated instance
    + JDK-8212160: JVMTI agent crashes with "assert(_value != 0LL)
    failed: resolving NULL _value"
    + JDK-8212226: SurfaceManager throws "Invalid Image variant"
    for MultiResolutionImage (Windows)
    + JDK-8213400: Support choosing group name in keytool keypair
    generation
    + JDK-8213535: Windows HiDPI html lightweight tooltips are
    truncated
    + JDK-8213698: Improve devkit creation and add support for
    linux/ppc64/ppc64le/s390x
    + JDK-8214025: assert(t-&gt;singleton()) failed: must be a
    constant when ScavengeRootsInCode &lt; 2
    + JDK-8214242: compiler/arguments/TestScavengeRootsInCode.java
    fails because of missing UnlockDiagnosticVMOptions
    + JDK-8214787: Zero builds fail with "undefined
    JavaThread::thread_state()"
    + JDK-8215583: Exclude
    runtime/handshake/HandshakeWalkSuspendExitTest.java
    + JDK-8216012: Infinite loop in RSA KeyPairGenerator
    + JDK-8216324: GetClassMethods is confused by the presence of
    default methods in super interfaces
    + JDK-8217429: WebSocket over authenticating proxy fails to
    send Upgrade headers
    + JDK-8217976: test/jdk/java/net/httpclient/websocket/
    /WebSocketProxyTest.java fails intermittently
    + JDK-8218021: Have jarsigner preserve posix permission
    attributes
    + JDK-8218287: jshell tool: input behavior unstable after
    12-ea+24 on Windows
    + JDK-8218851: JVM crash in custom classloader stress test, JDK
    12 &amp; 13
    + JDK-8220420: Cleanup c1_LinearScan
    + JDK-8222072: JVMTI GenerateEvents() sends CompiledMethodLoad
    events to wrong jvmtiEnv
    + JDK-8222286: Fix for JDK-8213419 is broken on s390
    + JDK-8222527: HttpClient doesn't send HOST header when
    tunelling HTTP/1.1 through http proxy
    + JDK-8222533: jtreg test jdk/internal/platform/cgroup/
    /TestCgroupMetrics.java fails on SLES12.3 linux ppc64le
    machine
    + JDK-8224506: [TESTBUG] TestDockerMemoryMetrics.java fails
    with exitValue = 137
    + JDK-8224555: vmTestbase/nsk/jvmti/scenarios/contention/TC02/
    /tc02t001/TestDescription.java failed
    + JDK-8224650: Add tests to support X25519 and X448 in TLS
    + JDK-8225072: Add LuxTrust certificate that is expiring in
    March 2021 to list of allowed but expired certs
    + JDK-8225329: -XX:+PrintBiasedLockingStatistics causes crash
    during initialization on Windows platforms
    + JDK-8225687: Newly added sspi.cpp in JDK-6722928 still
    contains some small errors
    + JDK-8227006: [linux] Runtime.availableProcessors execution
    time increased by factor of 100
    + JDK-8227275: Within native OOM error handling, assertions may
    hang the process
    + JDK-8227647: [Graal] Test8009761.java fails due to
    "RuntimeException: static java.lang.Object
    compiler.uncommontrap.Test8009761.m3(boolean,boolean) not
    compiled"
    + JDK-8229495: SIGILL in C2 generated OSR compilation
    + JDK-8230910: libsspi_bridge does not build on Windows 32bit
    + JDK-8232114: JVM crashed at imjpapi.dll in native code
    + JDK-8234147: Avoid looking up standard charsets in core
    libraries
    + JDK-8234393: [macos] printing ignores printer tray
    + JDK-8234863: Increase default value of MaxInlineLevel
    + JDK-8235218: Minimal VM is broken after JDK-8173361
    + JDK-8235456: Minimal VM is broken after JDK-8212160
    + JDK-8235829: graal crashes with Zombie.java test
    + JDK-8236124: Minimal VM slowdebug build failed after
    JDK-8212160
    + JDK-8236512: PKCS11 Connection closed after Cipher.doFinal
    and NoPadding
    + JDK-8236944: The legVecZ operand should be limited to
    zmm0-zmm15 registers
    + JDK-8237186: Fix typo in copyright header of
    java/io/Reader/TransferTo.java
    + JDK-8237499: JFR: Include stack trace in the ThreadStart event
    + JDK-8237512: AArch64: aarch64TestHook leaks a BufferBlob
    + JDK-8237524: AArch64: String.compareTo() may return incorrect
    result
    + JDK-8237950: C2 compilation fails with "Live Node limit
    exceeded limit" during ConvI2L::Ideal optimization
    + JDK-8238579: HttpsURLConnection drops the timeout and hangs
    forever in read
    + JDK-8239105: Add exception for expiring Digicert root
    certificates to VerifyCACerts test
    + JDK-8239477: jdk/jfr/jcmd/TestJcmdStartStopDefault.java fails
  - XX:+VerifyOops with "verify_oop: rsi: broken oop"
    + JDK-8239497: SEGV in EdgeUtils::field_name_symbol(Edge const&amp;)
    + JDK-8239886: Minimal VM build fails after JDK-8237499
    + JDK-8240633: Memory leaks in the implementations of
    FileChooserUI
    + JDK-8240690: Race condition between EDT and
    BasicDirectoryModel.FilesLoader.run0()
    + JDK-8241234: Unify monitor enter/exit runtime entries.
    + JDK-8241311: Move some charset mapping tests from closed to
    open
    + JDK-8241797: Add some tests to the problem list
    + JDK-8242029: AArch64: skip G1 array copy pre-barrier if
    marking not active
    + JDK-8242335: Additional Tests for RSASSA-PSS
    + JDK-8242480: Negative value may be returned by
    getFreeSwapSpaceSize() in the docker
    + JDK-8242614: cleanup duplicated test ldap server in some
    com/sun/jndi/ldap/ tests
    + JDK-8242846: Bring back test/jdk/tools/jlink/plugins/
    /OrderResourcesPluginTest.java
    + JDK-8243114: Implement montgomery{Multiply,Square}intrinsics
    on Windows
    + JDK-8243290: Improve diagnostic messages for class
    verification and redefinition failures
    + JDK-8243488: Add tests for set/get SendBufferSize and
    getReceiveBufferSize in DatagramSocket
    + JDK-8243549: sun/security/ssl/CipherSuite/
    /NamedGroupsWithCipherSuite.java failed with Unsupported
    signature algorithm: DSA
    + JDK-8243617: compiler/onSpinWait/TestOnSpinWaitC1.java test
    uses wrong class
    + JDK-8243619: compiler/codecache/CheckSegmentedCodeCache.java
    test misses -version
    + JDK-8244142: some hotspot/runtime tests don't check exit code
    of forked JVM
    + JDK-8244278: Excessive code cache flushes and sweeps
    + JDK-8244282: test/hotspot/jtreg/compiler/intrinsics/
    /Test8237524.java fails with --illegal-access=deny
    + JDK-8244621: [macos10.15] Garbled FX printing plus CoreText
    warnings on Catalina when building with Xcode 11
    + JDK-8244819: hsdis does not compile with binutils 2.34+
    + JDK-8245051: c1 is broken if it is compiled by gcc without
  - fno-lifetime-dse
    + JDK-8245168: jlink should not be treated as a "small" tool
    + JDK-8245400: Upgrade to LittleCMS 2.11
    + JDK-8246381: VM crashes with "Current BasicObjectLock* below
    than low_mark"
    + JDK-8246434: Threads::print_on_error assumes that the heap
    has been set up
    + JDK-8246648: issue with OperatingSystemImpl
    getFreeSwapSpaceSize in docker after 8242480
    + JDK-8247201: Print potential pointer value of readable stack
    memory in hs_err file
    + JDK-8247763: assert(outer-&gt;outcnt() == 2) failed: 'only phis'
    failure in LoopNode::verify_strip_mined()
    + JDK-8247867: Upgrade to freetype 2.10.2
    + JDK-8248190: Enable Power10 system and implement new
    byte-reverse instructions
    + JDK-8248226: TestCloneAccessStressGCM fails with
  - XX:-ReduceBulkZeroing
    + JDK-8248347: windows build broken by JDK-8243114
    + JDK-8248532: Every time I change keyboard language at my
    MacBook, Java crashes
    + JDK-8248552: C2 crashes with SIGFPE due to division by zero
    + JDK-8248596: [TESTBUG] compiler/loopopts/
    /PartialPeelingUnswitch.java times out with Graal enabled
    + JDK-8248745: Add jarsigner and keytool tests for restricted
    algorithms
    + JDK-8248791: sun/util/resources/cldr/TimeZoneNamesTest.java
    fails with -XX:-ReduceInitialCardMarks -XX:-ReduceBulkZeroing
    + JDK-8248845: AArch64: stack corruption after spilling vector
    register
    + JDK-8249176: Update GlobalSignR6CA test certificates
    + JDK-8249183: JVM crash in "AwtFrame::WmSize" method
    + JDK-8249192: MonitorInfo stores raw oops across safepoints
    + JDK-8249602: C2: assert(cnt == _outcnt) failed: no insertions
    allowed
    + JDK-8249603: C1: assert(has_error == false) failed: register
    allocation invalid
    + JDK-8249605: C2: assert(no_dead_loop) failed: dead loop
    detected
    + JDK-8249607: C2: assert(!had_error) failed: bad dominance
    + JDK-8249608: Vector register used by C2 compiled method
    corrupted at safepoint
    + JDK-8249672: Include microcode revision in features_string on
    x86
    + JDK-8249748: gtest silently ignores bad jvm arguments
    + JDK-8249821: Separate libharfbuzz from libfontmanager
    + JDK-8250598: Hyper-V is detected in spite of running on host
    OS
    + JDK-8250605: Linux x86_32 builds fail after JDK-8249821
    + JDK-8250636: iso8601_time returns incorrect offset part on
    MacOS
    + JDK-8250665: Wrong translation for the month name of May in
    ar_JO,LB,SY
    + JDK-8250772: Test com/sun/jndi/ldap/
    /NamingExceptionMessageTest.java fails intermittently with
    javax.naming.ServiceUnavailableException
    + JDK-8250825: C2 crashes with assert(field != __null) failed:
    missing field
    + JDK-8250894: Provide a configure option to build and run
    against the platform libharfbuzz
    + JDK-8250928: JFR: Improve hash algorithm for stack traces
    + JDK-8250968: Symlinks attributes not preserved when using
    jarsigner on zip files
    + JDK-8250984: Memory Docker tests fail on some Linux kernels
    w/o cgroupv1 swap limit capabilities
    + JDK-8251118: BiasedLocking::preserve_marks should not have a
    HandleMark
    + JDK-8251189: com/sun/jndi/ldap/LdapDnsProviderTest.java
    failed due to timeout
    + JDK-8251257: NMT: jcmd VM.native_memory scale=1 crashes
    target VM
    + JDK-8251365: Build failure on AIX after 8250636
    + JDK-8251397: NPE on ClassValue.ClassValueMap.cacheArray
    + JDK-8251456: [TESTBUG] compiler/vectorization/
    /TestVectorsNotSavedAtSafepoint.java failed OutOfMemoryError
    + JDK-8251458: Parse::do_lookupswitch fails with "assert(_cnt
    &gt;= 0) failed"
    + JDK-8251535: Partial peeling at unsigned test adds incorrect
    loop exit check
    + JDK-8251949: ZGC: Set explicit heap size for
    compiler/gcbarriers tests
    + JDK-8252090: JFR: StreamWriterHost::write_unbuffered() stucks
    in an infinite loop OpenJDK (build 13.0.1+9)
    + JDK-8252415: Bump update version for OpenJDK: jdk-11.0.10
    + JDK-8252470: java/awt/dnd/DisposeFrameOnDragCrash/
    /DisposeFrameOnDragTest.java fails on Windows
    + JDK-8252497: Incorrect numeric currency code for ROL
    + JDK-8252660: Shenandoah: support manageable SoftMaxHeapSize
    option
    + JDK-8252679: Two windows specific FileDIalog tests may fail
    on some Windows_Server_2016_Standard
    + JDK-8252696: Loop unswitching may cause out of bound array
    load to be executed
    + JDK-8252754: Hash code calculation of JfrStackTrace is
    inconsistent
    + JDK-8253219: Epsilon: clean up unnecessary includes
    + JDK-8253224: Shenandoah: ShenandoahStrDedupQueue destructor
    calls virtual num_queues()
    + JDK-8253226: Shenandoah: remove unimplemented
    ShenandoahStrDedupQueue::verify
    + JDK-8253269: The CheckCommonColors test should provide more
    info on failure
    + JDK-8253284: Zero OrderAccess barrier mappings are incorrect
    + JDK-8253375: OSX build fails with Xcode 12.0 (12A7209)
    + JDK-8253778: ShenandoahSafepoint::is_at_shenandoah_safepoint
    should not access VMThread state from other threads
    + JDK-8253791: Issue with useAppleColor check in CSystemColors.m
    + JDK-8254016: Test8237524 fails with -XX:-CompactStrings option
    + JDK-8254081: java/security/cert/PolicyNode/
    /GetPolicyQualifiers.java fails due to an expired certificate
    + JDK-8254144: Non-x86 Zero builds fail with return-type
    warning in os_linux_zero.cpp
    + JDK-8254166: Zero: return-type warning in
    zeroInterpreter_zero.cpp
    + JDK-8254177: (tz) Upgrade time-zone data to tzdata2020b
    + JDK-8254185: Fix Code cache sweeper heuristics for JDK 11
    + JDK-8254190: [s390] interpreter misses exception check after
    calling monitorenter
    + JDK-8254790: SIGSEGV in string_indexof_char and
    stringL_indexof_char intrinsics
    + JDK-8254854: [cgroups v1] Metric limits not properly detected
    on some join controller combinations
    + JDK-8254982: (tz) Upgrade time-zone data to tzdata2020c
    + JDK-8255050: Add pkcs11/KeyStore/ClientAuth.sh to Problem list
    + JDK-8255065: Zero: accessor_entry misses the IRIW case
    + JDK-8255226: (tz) Upgrade time-zone data to tzdata2020d
    + JDK-8255269: Unsigned overflow in g1Policy.cpp
    + JDK-8255365: Problem list failing client manual tests
    + JDK-8255457: Shenandoah: cleanup ShenandoahMarkTask
    + JDK-8255466: C2 crashes at ciObject::get_oop() const+0x0
    + JDK-8255550: x86: Assembler::cmpq(Address dst, Register src)
    encoding is incorrect
    + JDK-8255603: Memory/Performance regression after JDK-8210985
    + JDK-8255760: Shenandoah: match constants style in
    ShenandoahMarkTask fallback
    + JDK-8255781: Bump patch update version for OpenJDK:
    jdk-11.0.9.1
    + JDK-8255937: Better cleanup for
    test/jdk/javax/imageio/stream/StreamFlush.java
    + JDK-8256427: Test com/sun/jndi/dns/ConfigTests/
    /PortUnreachable.java does not work on AIX
    + JDK-8256452: Integrate missing part of JDK-8232370 to 11u
    + JDK-8256483: [TESTBUG] serviceability/jvmti/GetClassMethods/
    /libOverpassMethods.c fails to compile on gcc 4.4.x
    + JDK-8256557: libharfbuzz fails to link on gcc 4.4.x due to
  - Wl,-z,defs
    + JDK-8256618: Zero: Linux x86_32 build still fails
    + JDK-8256736: Zero: GTest tests fail with "unsuppported vm
    variant"
    + JDK-8256809: Annotation processing causes NPE during flow
    analysis
    + JDK-8257181: s390x builds are very noisy with gc-sections
    messages
    + JDK-8257242: [macOS] Java app crashes while switching input
    methods
    + JDK-8257545: SunJSSE FIPS regression in key exchange after
    JDK-8171279 11u backport
    + JDK-8257641: Shenandoah: Query is_at_shenandoah_safepoint()
    from control thread should return false
    + JDK-8257701: Shenandoah: objArrayKlass metadata is not marked
    with chunked arrays
    + JDK-8258630: Add expiry exception for QuoVadis root
    certificate
- New upstream dependency on libharfbuzz
- Regenerated patches: missing-return.patch system-pcsclite.patch</changelog>
  <changelog author="fstrba@suse.com" date="1616155200">- Added patches:
  * system-crypto-policy.patch
    + Let OpenJDK use system crypto policies unless explicitely told
    not to
  * nss-security-provider.patch
    + Add the NSS security provider with configuration in generated
    nss.cfg file
  * keytool-default-rsa.patch
    + Make keytool generate RSA keys by default, since only the
    LEGACY system crypto policy allows DSA</changelog>
  <changelog author="pujos.michael@gmail.com" date="1618488000">- moved mozilla-nss dependency to java-11-openjdk-headless package
  This is necessary to be able to do crypto with just
  java-11-openjdk-headless installed. Fixes boo#1184606</changelog>
  <changelog author="fstrba@suse.com" date="1619006400">- Update to upstream tag jdk-11.0.11+9 (April 2021, CPU)
  * Security fixes
    + JDK-8244473: Contextualize registration for JNDI
    + JDK-8244543: Enhanced handling of abstract classes
    + JDK-8249906, CVE-2021-2163, bsc#1185055: Enhance opening JARs
    + JDK-8250568, CVE-2021-2161, bsc#1185056: Less ambiguous
    processing
    + JDK-8253799: Make lists of normal filenames
    + JDK-8257001: Improve Http Client Support
  * Other changes
    + JDK-7107012: sun.jvm.hotspot.code.CompressedReadStream
    readDouble() conversion to long mishandled
    + JDK-7146776: deadlock between URLStreamHandler.getHostAddress
    and file.Handler.openconnection
    + JDK-8086003: Test fails on OSX with java.lang.RuntimeException
    'Narrow klass base: 0x0000000000000000, Narrow klass shift: 3'
    missing
    + JDK-8168869: jdeps: localized messages don't use proper line
    breaks
    + JDK-8180837: SunPKCS11-NSS tests failing with
    CKR_ATTRIBUTE_READ_ONLY and CKR_MECHANISM_PARAM_INVALID
    + JDK-8202343: Disable TLS 1.0 and 1.1
    + JDK-8205992: jhsdb cannot attach to Java processes running in
    Docker containers
    + JDK-8209193: Fix aarch64-linux compilation after -Wreorder
    changes
    + JDK-8210413: AArch64: Optimize div/rem by constant in C1
    + JDK-8210578: AArch64: Invalid encoding for fmlsvs instruction
    + JDK-8211051: jdeps usage of --dot-output doesn't provide
    valid output for modular jar
    + JDK-8211057: Gensrc step CompileProperties generates unstable
    CompilerProperties output
    + JDK-8211150: G1 Full GC not purging code root memory and
    hence causing memory leak
    + JDK-8211825: ModuleLayer.defineModulesWithXXX does not setup
    delegation when module reads automatic module
    + JDK-8212043: Add floating-point Math.min/max intrinsics
    + JDK-8212218: [TESTBUG] runtime/ErrorHandling/
    /TestHeapDumpOnOutOfMemoryErrorInMetaspace.java timed out
    + JDK-8213116: javax/swing/JComboBox/WindowsComboBoxSize/
    /WindowsComboBoxSizeTest.java fails in Windows
    + JDK-8213909: jdeps --print-module-deps should report missing
    dependences
    + JDK-8214180: Need better granularity for sleeping
    + JDK-8214223: tools/jdeps/listdeps/ListModuleDeps.java failed
    due to missing Lib2 file
    + JDK-8214230: Classes generated by SystemModulesPlugin.java
    are not reproducable
    + JDK-8214741: docs/index.html has no title or copyright
    + JDK-8215687: [Graal] unit test CheckGraalIntrinsics failed
    after 8212043
    + JDK-8217848: [Graal] vmTestbase/nsk/jvmti/ResourceExhausted/
    /resexhausted003/TestDescription.java fails
    + JDK-8218482: sun/security/krb5/auto/ReplayCachePrecise.java
    failed - no KrbException thrown
    + JDK-8218550: Add test omitted from JDK-8212043
    + JDK-8221584: SIGSEGV in os::PlatformEvent::unpark() in
    JvmtiRawMonitor::raw_exit while posting method exit event
    + JDK-8221995: AARCH64: problems with CAS instructions encoding
    + JDK-8222518: Remove unnecessary caching of Parker object in
    java.lang.Thread
    + JDK-8222785: aarch64: add necessary masking for immediate
    shift counts
    + JDK-8223186: HotSpot compile warnings from GCC 9
    + JDK-8225773: jdeps --check produces NPE if there are missing
    module dependences
    + JDK-8225805: Java Access Bridge does not close the logger
    + JDK-8226810: Failed to launch JVM because of
    NullPointerException occured on System.props
    + JDK-8229396: jdeps ignores multi-release when
    generate-module-info used on command line
    + JDK-8229474: Shenandoah: Cleanup CM::update_roots()
    + JDK-8232225: Rework the fix for JDK-8071483
    + JDK-8232905: JFR fails with assertion:
    assert(t-&gt;unflushed_size() == 0) failed: invariant
    + JDK-8233164: C2 fails with assert(phase-&gt;C-&gt;get_alias_index(t)
    == phase-&gt;C-&gt;get_alias_index(t_adr)) failed: correct memory
    chain
    + JDK-8233910: java/awt/ColorClass/AlphaColorTest.java is
    failing  intermittently in nightly lnux-x64 system
    + JDK-8233912: aarch64: minor improvements of atomic operations
    + JDK-8234508: VM_HeapWalkOperation::iterate_over_object reads
    non-strong fields with an on-strong load barrier
    + JDK-8234742: Improve handshake logging
    + JDK-8234796: Refactor Handshake::execute to take a more
    complex type than ThreadClosure
    + JDK-8235324: Dying objects are published from users of
    CollectedHeap::object_iterate
    + JDK-8235351: Lookup::unreflect should bind with the original
    caller independent of Method's accessible flag
    + JDK-8237369: Shenandoah: failed vmTestbase/nsk/jvmti/
    /AttachOnDemand/attach021/TestDescription.java test
    + JDK-8237392: Shenandoah: Remove unreliable assertion
    + JDK-8237483: AArch64 C1 OopMap inserted twice fatal error
    + JDK-8237495: Java MIDI fails with a dereferenced memory error
    when asked to send a raw 0xF7
    + JDK-8239355: (dc) Initial value of SO_SNDBUF should allow
    sending large datagrams (macOS)
    + JDK-8240353: AArch64: missing support for
  - XX:+ExtendedDTraceProbes in C1
    + JDK-8240704: CheckHandles.java failed "AssertionError: Handle
    use increased by more than 10 percent."
    + JDK-8240751: Shenandoah: fold ShenandoahTracer definition
    + JDK-8240795: [REDO] 8238384 CTW: C2 compilation fails with
    "assert(store != load-&gt;find_exact_control(load-&gt;in(0)))
    failed: dependence cycle found"
    + JDK-8241598: Upgrade JLine to 3.14.0
    + JDK-8241649: Optimize Character.toString
    + JDK-8241770: Module xxxAnnotation() methods throw NCDFE if
    module-info.class found as resource in unnamed module
    + JDK-8241911: AArch64: Fix a potential register clash issue in
    reduce_add2I
    + JDK-8242030: Wrong package declarations in jline classes after
    JDK-8241598
    + JDK-8242565: Policy initialization issues when the denyAfter
    constraint is enabled
    + JDK-8243618: compiler/rtm/cli tests can be run w/o WhiteBox
    + JDK-8243670: Unexpected test result caused by C2
    MergeMemNode::Ideal
    + JDK-8244088: [Regression] Switch of Gnome theme ends up in
    deadlocked UI
    + JDK-8244154: Update SunPKCS11 provider with PKCS11 v3.0 header
    files
    + JDK-8244340: Handshake processing thread lacks yielding
    + JDK-8244573: java.lang.ArrayIndexOutOfBoundsException thrown
    for malformed class file
    + JDK-8244683: A TSA server used by tests
    + JDK-8245005: javax/net/ssl/compatibility/BasicConnectTest.java
    failed with No enum constant
    + JDK-8245026: PsAdaptiveSizePolicy::_old_gen_policy_is_ready is
    unused
    + JDK-8245283: JFR: Can't handle constant dynamic used by Jacoco
    agent
    + JDK-8245512: CRC32 optimization using AVX512 instructions
    + JDK-8245527: LDAP Channel Binding support for Java
    GSS/Kerberos
    + JDK-8246707: (sc) SocketChannel.read/write throws
    AsynchronousCloseException on closed channel
    + JDK-8246709: sun/security/tools/jarsigner/
    /TsacertOptionTest.java compilation failed after JDK-8244683
    + JDK-8247200: assert((unsigned)fpargs &lt; 32)
    + JDK-8247766: [aarch64] guarantee(val &lt; (1U &lt;&lt; nbits))
    failed: Field too big for insn.
    + JDK-8248336: AArch64: C2: offset overflow in
    BoxLockNode::emit
    + JDK-8248865: Document JNDI/LDAP timeout properties
    + JDK-8248901: Signed immediate support in
    .../share/assembler.hpp is broken.
    + JDK-8249543: Force DirectBufferAllocTest to run with
  - ExplicitGCInvokesConcurrent
    + JDK-8249588: libwindowsaccessbridge issues on 64bit Windows
    + JDK-8249749: modify a primitive array through a stream and a
    for cycle causes jre crash
    + JDK-8249787: Make TestGCLocker more resilient with concurrent
    GCs
    + JDK-8249867: xml declaration is not followed by a newline
    + JDK-8250911: [windows] os::pd_map_memory() error detection
    broken
    + JDK-8251255: [linux] Add process-memory information to hs-err
    and VM.info
    + JDK-8251359: Shenandoah: filter null oops before calling
    enqueue/SATB barrier
    + JDK-8251925: C2: RenaissanceStressTest fails with
    assert(!had_error): bad dominance
    + JDK-8251944: Add Shenandoah test config to
    compiler/gcbarriers/UnsafeIntrinsicsTest.java
    + JDK-8251992: VM crashed running TestComplexAddrExpr.java test
    with -XX:UseAVX=X
    + JDK-8253220: Epsilon: clean up unused code/declarations
    + JDK-8253274: The CycleDMImagetest brokes the system
    + JDK-8253353: Crash in C2: guarantee(n != NULL) failed: No Node
    + JDK-8253368: TLS connection always receives close_notify
    exception
    + JDK-8253404: C2: assert(C-&gt;live_nodes() &lt;=
    C-&gt;max_node_limit()) failed: Live Node limit exceeded limit
    + JDK-8253409: Double-rounding possibility in float fma
    + JDK-8253476: TestUseContainerSupport.java fails on some Linux
    kernels w/o swap limit capabilities
    + JDK-8253524: C2: Refactor code that clones predicates during
    loop unswitching
    + JDK-8253644: C2: assert(skeleton_predicate_has_opaque(iff))
    failed: unexpected
    + JDK-8253681: closed java/awt/dnd/MouseEventAfterStartDragTest/
    /MouseEventAfterStartDragTest.html test failed
    + JDK-8253702: BigSur version number reported as 10.16, should
    be 11.nn
    + JDK-8253756: C2 CompilerThread0 crash in Node::add_req(Node*)
    + JDK-8254104: MethodCounters must exist before nmethod is
    installed
    + JDK-8254734: "dead loop detected" assert failure with patch
    from 8223051
    + JDK-8254748: Bad Copyright header format after JDK-8212218
    + JDK-8254799: runtime/ErrorHandling/
    /TestHeapDumpOnOutOfMemoryError.java fails with release VMs
    + JDK-8255058: C1: assert(is_virtual()) failed: type check
    + JDK-8255351: Add detection for Graviton 2 CPUs
    + JDK-8255368: Math.exp() gives wrong result for large values on
    x86 32-bit platforms
    + JDK-8255387: Japanese characters were printed upside down on
    AIX
    + JDK-8255401: Shenandoah: Allow oldval and newval registers to
    overlap in cmpxchg_oop()
    + JDK-8255479: [aarch64] assert(src-&gt;section_index_of(target) ==
    CodeBuffer::SECT_NONE) failed: sanity
    + JDK-8255544: Create a checked cast
    + JDK-8255559: Leak File Descriptors Because of
    ResolverLocalFilesystem#engineResolveURI()
    + JDK-8255681: print callstack in error case in
    runAWTLoopWithApp
    + JDK-8255734: VM should ignore SIGXFSZ on ppc64, s390 too
    + JDK-8255742: PrintInlining as compiler directive doesn't print
    virtual calls
    + JDK-8255845: Memory leak in imageFile.cpp
    + JDK-8255880: UI of Swing components is not redrawn after their
    internal state changed
    + JDK-8255908: ExceptionInInitializerError due to
    UncheckedIOException while initializing cgroupv1 subsystem
    + JDK-8256025: AArch64: MachCallRuntimeNode::ret_addr_offset()
    is incorrect for stub calls
    + JDK-8256056: Deoptimization stub doesn't save vector registers
    on x86
    + JDK-8256061: RegisterSaver::save_live_registers() omits upper
    halves of ZMM0-15 registers
    + JDK-8256187: [TEST_BUG] Automate bug4275046.java test
    + JDK-8256220: C1: x86_32 fails with -XX:UseSSE=1 after
    JDK-8210764 due to mishandled lir_neg
    + JDK-8256258: some missing NULL checks or asserts after
    CodeCache::find_blob_unsafe
    + JDK-8256264: Printed GlyphVector outline with low DPI has bad
    quality on Windows
    + JDK-8256290: javac/lambda/T8031967.java fails with
    StackOverflowError on x86_32
    + JDK-8256359: AArch64: runtime/ReservedStack/
    /ReservedStackTestCompiler.java fails
    + JDK-8256387: Unexpected result if patching an entire
    instruction on AArch64
    + JDK-8256421: Add 2 HARICA roots to cacerts truststore
    + JDK-8256488: [aarch64] Use ldpq/stpq instead of ld4/st4 for
    small copies in StubGenerator::copy_memory
    + JDK-8256489: Make gtest for long path names on Windows more
    resilient in the presence of virus scanners
    + JDK-8256501: libTestMainKeyWindow fails to build with Xcode
    12.2
    + JDK-8256633: Fix product build on Windows+Arm64
    + JDK-8256682: JDK-8202343 is incomplete
    + JDK-8256751: Incremental rebuild with precompiled header fails
    when touching a header file
    + JDK-8256757: Incorrect MachCallRuntimeNode::ret_addr_offset()
    for CallLeafNoFP on x86_32
    + JDK-8256806: Shenandoah: optimize shenandoah/jni/
    /TestPinnedGarbage.java test
    + JDK-8256807: C2: Not marking stores correctly as mismatched
    in string opts
    + JDK-8256810: Incremental rebuild broken on Macosx
    + JDK-8256818: SSLSocket that is never bound or connected leaks
    socket resources
    + JDK-8256888: Client manual test problem list update
    + JDK-8257083: Security infra test failures caused by
    JDK-8202343
    + JDK-8257408: Bump update version for OpenJDK: jdk-11.0.11
    + JDK-8257423: [PPC64] Support -XX:-UseInlineCaches
    + JDK-8257436: [aarch64] Regressions in ArrayCopyUnalignedDst
    .testByte/testChar for 65-78 bytes when UseSIMDForMemoryOps
    is on
    + JDK-8257513: C2: assert((constant_addr -
    _masm.code()-&gt;consts()-&gt;start()) == con.offset())
    + JDK-8257547: Handle multiple prereqs on the same line in deps
    files
    + JDK-8257561: Some code is not vectorized after 8251925 and
    8250607
    + JDK-8257565: epsilonBarrierSet.hpp should not include
    barrierSetAssembler
    + JDK-8257575: C2: "failed: only phis" assert failure in loop
    strip mining verification
    + JDK-8257594: C2 compiled checkcast of non-null object triggers
    endless deoptimization/recompilation cycle
    + JDK-8257633: Missing -mmacosx-version-min=X flag when linking
    libjvm
    + JDK-8257670: sun/security/ssl/SSLSocketImpl/SSLSocketLeak.java
    reports leaks
    + JDK-8257707: Fix incorrect format string in Http1HeaderParser
    + JDK-8257746: Regression introduced with JDK-8250984 - memory
    might be null in some machines
    + JDK-8257798: [PPC64] undefined reference to
    Klass::vtable_start_offset()
    + JDK-8257884: Re-enable sun/security/ssl/SSLSocketImpl/
    /SSLSocketLeak.java as automatic test
    + JDK-8257910: [JVMCI] Set exception_seen accordingly in the
    runtime.
    + JDK-8257997: sun/security/ssl/SSLSocketImpl/SSLSocketLeak.java
    again reports leaks after JDK-8257884
    + JDK-8257999: Parallel GC crash in gc/parallel/
    /TestDynShrinkHeap.java: new region is not in covered_region
    + JDK-8258077: Using -Xcheck:jni can lead to a double-free after
    JDK-8193234
    + JDK-8258247: Couple of issues in fix for JDK-8249906
    + JDK-8258373: Update the text handling in the JPasswordField
    + JDK-8258396: SIGILL in jdk.jfr.internal.PlatformRecorder
    .rotateDisk()
    + JDK-8258419: RSA cipher buffer cleanup
    + JDK-8258471: "search codecache" clhsdb command does not work
    + JDK-8258534: Epsilon: clean up unused includes
    + JDK-8258805: Japanese characters not entered by mouse click
    on Windows 10
    + JDK-8258833: Cancel multi-part cipher operations in SunPKCS11
    after failures
    + JDK-8258836: JNI local refs exceed capacity
    getDiagnosticCommandInfo
    + JDK-8258884: [TEST_BUG] Convert applet-based test
    open/test/jdk/javax/swing/JMenuItem/8031573/bug8031573.java
    to a regular java test
    + JDK-8259007: This test printed a blank page
    + JDK-8259048: (tz) Upgrade time-zone data to tzdata2020f
    + JDK-8259049: Uninitialized variable after JDK-8257513
    + JDK-8259231: Epsilon: improve performance under contention
    during virtual space expansion
    + JDK-8259271: gc/parallel/TestDynShrinkHeap.java still fails
    "assert(covered_region.contains(new_memregion)) failed: new
    region is not in covered_region"
    + JDK-8259312: VerifyCACerts.java fails as soneraclass2ca cert
    will expire in 90 days
    + JDK-8259319: Illegal package access when SunPKCS11 requires
    SunJCE's classes
    + JDK-8259339: AllocateUninitializedArray C2 intrinsic fails
    with void.class input
    + JDK-8259428: AlgorithmId.getEncodedParams() should return copy
    + JDK-8259446: runtime/jni/checked/
    /TestCheckedReleaseArrayElements.java fails with stderr not
    empty
    + JDK-8259451: Zero: skip serviceability/sa tests, set vm.hasSA
    to false
    + JDK-8259580: Shenandoah: uninitialized label in
    VerifyThreadGCState
    + JDK-8259619: C1: 3-arg StubAssembler::call_RT stack-use
    condition is incorrect
    + JDK-8259633: compiler/graalunit/CoreTest.java fails with NPE
    after JDK-8244543
    + JDK-8259706: C2 compilation fails with assert(vtable_index ==
    Method::invalid_vtable_index) failed: correct sentinel value
    + JDK-8259707: LDAP channel binding does not work with StartTLS
    extension
    + JDK-8259773: Incorrect encoding of AVX-512 kmovq instruction
    + JDK-8259849: Shenandoah: Rename store-val to IU-barrier
    + JDK-8259949: x86 32-bit build fails when -fcf-protection is
    passed in the compiler flags
    + JDK-8259954: gc/shenandoah/mxbeans tests fail with -Xcomp
    + JDK-8260029: aarch64: fix typo in verify_oop_array
    + JDK-8260308: Update LogCompilation junit to 4.13.1
    + JDK-8260338: Some fields in HaltNode is not cloned
    + JDK-8260349: Cannot programmatically retrieve Metaspace max
    set via JAVA_TOOL_OPTIONS
    + JDK-8260356: (tz) Upgrade time-zone data to tzdata2021a
    + JDK-8260378: [TESTBUG] DcmdMBeanTestCheckJni.java reports
    false positive
    + JDK-8260497: Shenandoah: Improve SATB flushing
    + JDK-8260502: [s390] NativeMovRegMem::verify() fails because
    it's too strict
    + JDK-8260632: Build failures after JDK-8253353
    + JDK-8260704: ParallelGC: oldgen expansion needs release-store
    for _end
    + JDK-8261022: Fix incorrect result of Math.abs() with char type
    + JDK-8261089: [TESTBUG] native library of test
    TestCheckedReleaseCriticalArray.java fails to compile with
    gcc 4.x
    + JDK-8261183: Follow on to Make lists of normal filenames
    + JDK-8261209: isStandalone property: remove dependency on
    pretty-print
    + JDK-8261231: Windows IME was disabled after DnD operation
    + JDK-8261251: Shenandoah: Use object size for full GC
    humongous compaction
    + JDK-8261310: PPC64 Zero build fails with
    'VMError::controlled_crash(int)::FunctionDescriptor
    functionDescriptor' has incomplete type and cannot be defined
    + JDK-8261334: NMT: tuning statistic shows incorrect hash
    distribution
    + JDK-8261413: Shenandoah: Disable class-unloading in I-U mode
    + JDK-8261522: [PPC64] AES intrinsics write beyond the
    destination array
    + JDK-8261534: Test sun/security/pkcs11/KeyAgreement/
    /IllegalPackageAccess.java fails on platforms where no nsslib
    artifacts are defined
    + JDK-8261585: Restore HandleArea used in
    Deoptimization::uncommon_trap
    + JDK-8261753: Test java/lang/System/OsVersionTest.java still
    failing on BigSur patch versions after JDK-8253702
    + JDK-8261829: Exclude tools/jlink/JLinkReproducibleTest.java
    in 11u
    + JDK-8261912: Code IfNode::fold_compares_helper more
    defensively
    + JDK-8261920: [AIX] jshell command throws java.io.IOError on
    non English locales
    + JDK-8262018: Wrong format in SAP copyright header of
    OsVersionTest
    + JDK-8263069: Exclude some failing tests from
    security/infra/java/security/cert/CertPathValidator</changelog>
  <changelog author="fstrba@suse.com" date="1620043200">- Remove all Jpackage provides for SLE12 in order to avoid
  installing this package as default Java on SLE12-SP5
  (bsc#1185476)</changelog>
  <changelog author="fstrba@suse.com" date="1621512000">- Modified patch:
  * nss-security-provider.patch
    + make the NSS provider first in the list</changelog>
  <changelog author="fstrba@suse.com" date="1626868800">- Update to upstream tag jdk-11.0.12+7 (July 2021, CPU)
  * Security fixes
    + JDK-8256157: Improve bytecode assembly
    + JDK-8256491: Better HTTP transport
    + JDK-8258432, CVE-2021-2341, bsc#1188564: Improve file
    transfers
    + JDK-8260453: Improve Font Bounding
    + JDK-8260960: Signs of jarsigner signing
    + JDK-8260967, CVE-2021-2369, bsc#1188565: Better jar file
    validation
    + JDK-8262380: Enhance XML processing passes
    + JDK-8262403: Enhanced data transfer
    + JDK-8262410: Enhanced rules for zones
    + JDK-8262477: Enhance String Conclusions
    + JDK-8262967: Improve Zip file support
    + JDK-8264066, CVE-2021-2388, bsc#1188566: Enhance compiler
    validation
    + JDK-8264079: Improve abstractions
    + JDK-8264460: Improve NTLM support
  * Other changes
    + JDK-6847157: java.lang.NullPointerException: HDC for
    component at sun.java2d.loops.Blit.Blit
    + JDK-7106851: Test should not use System.exit
    + JDK-8073446: TimeZone getOffset API does not  return a dst
    offset between years 2038-2137
    + JDK-8076190: Customizing the generation of a PKCS12 keystore
    + JDK-8153005: Upgrade the default PKCS12 encryption/MAC
    algorithms
    + JDK-8171303: sun/java2d/pipe/InterpolationQualityTest.java
    fails on Windows &amp; Linux
    + JDK-8177068: incomplete classpath causes NPE in Flow
    + JDK-8185734: [Windows] Structured Exception Catcher missing
    around gtest execution
    + JDK-8187450: JNI local refs exceeds capacity warning in
    NetworkInterface::getAll
    + JDK-8190763: Class cast exception on (CompoundEdit)
    UndoableEditEvent.getEdit()
    + JDK-8195841: PNGImageReader.readNullTerminatedString() doesnt
    check for non-null terminated strings with length equal to
    maxLen
    + JDK-8196100: javax/swing/text/JTextComponent/5074573/
    /bug5074573.java fails
    + JDK-8199646: JShell tests: jdk/jshell/
    /FailOverDirectExecutionControlTest.java failed with
    java.lang.UnsupportedOperationException
    + JDK-8206925: Support the certificate_authorities extension
    + JDK-8207160: ClassReader::adjustMethodParams can potentially
    return null if the args list is empty
    + JDK-8207247: AARCH64: Enable Minimal and Client VM builds
    + JDK-8207404: MulticastSocket tests failing on AIX
    + JDK-8207779: Method::is_valid_method() compares 'this' with
    NULL
    + JDK-8208061: runtime/LoadClass/TestResize.java fails with
    "Load factor too high" when running in CDS mode.
    + JDK-8209459: TestSHA512MultiBlockIntrinsics failed on AArch64
    + JDK-8210443: Migrate Locale matching tests to JDK Repo.
    + JDK-8213231: ThreadSnapshot::_threadObj can become stale
    + JDK-8213483: ARM32: runtime/ErrorHandling/
    /ShowRegistersOnAssertTest.java jtreg test fail
    + JDK-8213725: JShell NullPointerException due to class file
    with unexpected package
    + JDK-8213794: ARM32: disable TypeProfiling,
    CriticalJNINatives, Serviceablity tests for ARM32
    + JDK-8213845: ARM32: Interpreter doesn't call result handler
    after native calls
    + JDK-8214128: ARM32: wrong stack alignment on
    Deoptimization::unpack_frames
    + JDK-8214512: ARM32: Jtreg test compiler/c2/Test8062950.java
    fails on ARM
    + JDK-8214854: JDWP: Unforseen output truncation in logging
    + JDK-8214922: Add vectorization support for fmin/fmax
    + JDK-8215009: GCC 8 compilation error in libjli
    + JDK-8216184: CDS/appCDS tests failed on Windows due to long
    path to a classlist file
    + JDK-8216259: AArch64: Vectorize Adler32 intrinsics
    + JDK-8216314: SIGILL in CodeHeapState::print_names()
    + JDK-8217348: assert(thread-&gt;is_Java_thread()) failed: just
    checking
    + JDK-8217465: [REDO] - Optimize CodeHeap Analytics
    + JDK-8217561: X86: Add floating-point Math.min/max intrinsics
    + JDK-8217918: C2: -XX:+AggressiveUnboxing is broken
    + JDK-8218458: [TESTBUG] runtime/NMT/
    /CheckForProperDetailStackTrace.java fails with Expected
    stack trace missing from output
    + JDK-8219142: Remove unused JIMAGE_ResourcePath
    + JDK-8219586: CodeHeap State Analytics processes dead nmethods
    + JDK-8220074: Clean up GCC 8.3 errors in LittleCMS
    + JDK-8220407: compiler/intrinsics/math/
    /TestFpMinMaxIntrinsics.java timedout
    + JDK-8222302: [TESTBUG] test/hotspot/jtreg/compiler/intrinsics/
    /sha/cli/TestUseSHAOptionOnUnsupportedCPU.java fails on any
    other CPU
    + JDK-8222412: AARCH64: multiple instructions encoding issues
    + JDK-8223020: aarch64: expand minI_rReg and maxI_rReg patterns
    into separate instructions
    + JDK-8223444: Improve CodeHeap Free Space Management
    + JDK-8223504: Improve performance of forall loops by better
    inlining of "iterator()" methods
    + JDK-8223667: ASAN build broken
    + JDK-8225081: Remove Telia Company CA certificate expiring in
    April 2021
    + JDK-8225116: Test OwnedWindowsLeak.java intermittently fails
    + JDK-8225438: javax/net/ssl/TLSCommon/
    /TestSessionLocalPrincipal.java failed with Read timed out
    + JDK-8225756: [testbug] compiler/loopstripmining/
    /CheckLoopStripMining.java sets too short a
    SafepointTimeoutDelay
    + JDK-8226374: Restrict TLS signature schemes and named groups
    + JDK-8226627: assert(t-&gt;singleton()) failed: must be a constant
    + JDK-8226721: Missing intrinsics for Math.ceil, floor, rint
    + JDK-8227080: (fs) Files.newInputStream(...).skip(n) is slow
    + JDK-8227222: vmTestbase/jit/FloatingPoint/gen_math/Loops04/
    /Loops04.java failed XMM register should be 0-15
    + JDK-8227609: (fs) Files.newInputStream(...).skip(n) should
    allow skipping beyond file size
    + JDK-8230428: Cleanup dead CastIP node code in formssel.cpp
    + JDK-8231460: Performance issue (CodeHeap) with large free
    blocks
    + JDK-8231713: x86_32 build failures after JDK-8226721 (Missing
    intrinsics for Math.ceil, floor, rint)
    + JDK-8231841: AArch64: debug.cpp help() is missing an AArch64
    line for pns
    + JDK-8232084: HotSpot build failed with GCC 9.2.1
    + JDK-8232591: AArch64: Add missing match rules for smaddl,
    smsubl and smnegl
    + JDK-8233185: HttpServer.stop() blocks indefinitely when
    called on dispatch thread
    + JDK-8233787: Break cycle in vm_version* includes
    + JDK-8233948: AArch64: Incorrect mapping between OptoReg and
    VMReg for high 64 bits of Vector Register
    + JDK-8234355: Buffer overflow in jcmd GC.class_stats due to
    too many classes
    + JDK-8235368: Update BCEL to Version 6.4.1
    + JDK-8236859: WebSocket over authenticating proxy fails with
    NPE
    + JDK-8236992: AArch64: remove redundant load_klass in itable
    stub
    + JDK-8237743: test/langtools/jdk/jshell/
    /FailOverExecutionControlTest.java fails No
    ExecutionControlProvider with name 'nonExistent' and parameter
    keys: []
    + JDK-8237804: sun/security/mscapi tests fail with "Key pair
    not generated, alias &lt;nnnnnn&gt; already exists"
    + JDK-8238175: CTW: Class.getDeclaredMethods fails with
    assert(k-&gt;is_subclass_of(SystemDictionary::Throwable_klass()))
    failed: invalid exception class
    + JDK-8238567: SoftMainMixer.processAudioBuffers(): Wrong
    handling of stoppedMixers
    + JDK-8238812: assert(false) failed: bad AD file
    + JDK-8239312: [macos] javax/swing/JFrame/NSTexturedJFrame/
    /NSTexturedJFrame.java
    + JDK-8239386: handle ContendedPaddingWidth in
    vm_version_aarch64
    + JDK-8239536: Can't use 'java.util.List' object after
    importing 'java.awt.List'
    + JDK-8240487: Cleanup whitespace in .cc, .hh, .m, and .mm files
    + JDK-8240848: ArrayIndexOutOfBoundsException buf for
    TextCallbackHandler
    + JDK-8241082: Upgrade IANA Language Subtag Registry data to
    03-16-2020 version
    + JDK-8241087: Build failure with VS 2019 (16.5.0) due to C2039
    and C2873
    + JDK-8241101: [s390] jtreg test failure after JDK-8238696: not
    conformant features string
    + JDK-8241248: NullPointerException in
    sun.security.ssl.HKDF.extract(HKDF.java:93)
    + JDK-8241372: Several test failures due to
    javax.net.ssl.SSLException: Connection reset
    + JDK-8241475: AArch64: Add missing support for PopCountVI node
    + JDK-8241829: Cleanup the code for PrinterJob on windows
    + JDK-8241960: The SHA3 message digests impl of SUN provider
    are not thread safe after cloned
    + JDK-8242010: Upgrade IANA Language Subtag Registry to Version
    2020-04-01
    + JDK-8242429: Better implementation for sign extract
    + JDK-8242557: Add length limit for strings in PNGImageWriter
    + JDK-8242919: Paste locks up jshell
    + JDK-8243155: AArch64: Add support for SqrtVF
    + JDK-8243240: AArch64: Add support for MulVB
    + JDK-8243452: JFR: Could not create chunk in repository with
    over 200 recordings
    + JDK-8243559: Remove root certificates with 1024-bit keys
    + JDK-8243597: AArch64: Add support for integer vector abs
    + JDK-8244031: HttpClient should have more tests for HEAD
    requests
    + JDK-8244205: HTTP/2 tunnel connections through proxy may be
    reused regardless of which proxy is selected
    + JDK-8244847: Linux/PPC: runtime/CompressedOops/
    /CompressedClassPointers: smallHeapTest fails
    + JDK-8245511: G1 adaptive IHOP does not account for
    reclamation of humongous objects by young GC
    + JDK-8246274: G1 old gen allocation tracking is not in a
    separate class
    + JDK-8247354: [aarch64] PopFrame causes
    assert(oopDesc::is_oop(obj)) failed: not an oop
    + JDK-8247408: IdealGraph bit check expression canonicalization
    + JDK-8247432: Update IANA Language Subtag Registry to Version
    2020-09-29
    + JDK-8247438: JShell: When FailOverExecutionControlProvider
    fails the proximal cause is not shown
    + JDK-8247753: UIManager.getSytemLookAndFeelClassName() returns
    wrong value on Fedora 32
    + JDK-8248043: Need to eliminate excessive i2l conversions
    + JDK-8248411: [aarch64] Insufficient error handling when
    CodeBuffer is exhausted
    + JDK-8248568: compiler/c2/TestBit.java failed: test missing
    from stdout/stderr
    + JDK-8248870: AARCH64: I2L/L2I conversions can be skipped for
    masked positive values
    + JDK-8249142: java/awt/FontClass/CreateFont/DeleteFont.sh is
    unstable
    + JDK-8249189: AARCH64: more L2I conversions can be skipped
    + JDK-8249719: MethodHandle performance suffers from bad
    ResolvedMethodTable hash function
    + JDK-8249875: GCC 10 warnings -Wtype-limits with JFR code
    + JDK-8250635: MethodArityHistogram should use Compile_lock in
    favour of fancy checks
    + JDK-8250876: Fix issues with cross-compile on macos
    + JDK-8251031: Some vmTestbase/nsk/monitoring/RuntimeMXBean
    tests fail with hostnames starting from digits
    + JDK-8251525: AARCH64: Faster Math.signum(fp)
    + JDK-8252259: AArch64: Adjust default value of FLOATPRESSURE
    + JDK-8252311: AArch64: save two words in itable lookup stub
    + JDK-8252779: compiler/graalunit/HotspotTest.java failed after
    8251525
    + JDK-8252883: AccessDeniedException caused by delayed file
    deletion on Windows
    + JDK-8253167: ARM32 builds fail after JDK-8247910
    + JDK-8253572: [windows] CDS archive may fail to open with long
    file names
    + JDK-8253923: C2 doesn't always run loop opts for compilations
    that include loops
    + JDK-8253948: Memory leak in ImageFileReader
    + JDK-8254631: Better support ALPN byte wire values in SunJSSE
    + JDK-8254717: isAssignableFrom checks in
    KeyFactorySpi.engineGetKeySpec appear to be backwards
    + JDK-8255086: Update the root locale display names
    + JDK-8255625: AArch64: Implement Base64.encodeBlock
    accelerator/intrinsic
    + JDK-8255763: C2: OSR miscompilation caused by invalid memory
    instruction placement
    + JDK-8255992: JFR EventWriter does not use first string from
    StringPool with id 0
    + JDK-8256037: [TESTBUG] com/sun/jndi/dns/ConfigTests/
    /PortUnreachable.java fails due to the hard coded threshold
    is small
    + JDK-8256244: java/lang/ProcessHandle/PermissionTest.java
    fails with TestNG 7.1
    + JDK-8256287: [windows] add loop fuse to
    map_or_reserve_memory_aligned
    + JDK-8256523: Streamline Java SHA2 implementation
    + JDK-8257414: Drag n Drop target area is wrong on high DPI
    systems
    + JDK-8257569: Failure observed with
    JfrVirtualMemory::initialize
    + JDK-8257574: C2: "failed: parsing found no loops but there
    are some" assert failure
    + JDK-8257580: Bump update version for OpenJDK: jdk-11.0.12
    + JDK-8257604: JNI_ArgumentPusherVaArg leaks valist
    + JDK-8257621: JFR StringPool misses cached items across
    consecutive recordings
    + JDK-8257796: [TESTBUG]
    TestUseSHA512IntrinsicsOptionOnSupportedCPU.java fails
    on x86_32
    + JDK-8257822: C2 crashes with SIGFPE due to a division that
    floats above its zero check
    + JDK-8257828: SafeFetch may crash if invoked in non-JavaThreads
    + JDK-8257853: Remove dependencies on JNF's JNI utility
    functions in AWT and 2D code
    + JDK-8257858: [macOS]: Remove JNF dependency from
    libosxsecurity/KeystoreImpl.m
    + JDK-8257860: [macOS]: Remove JNF dependency from
    libosxkrb5/SCDynamicStoreConfig.m
    + JDK-8257988: Remove JNF dependency from
    libsaproc/MacosxDebuggerLocal.m
    + JDK-8258414: OldObjectSample events too expensive
    + JDK-8258505: [TESTBUG] TestDivZeroWithSplitIf.java fails due
    to missing UnlockDiagnosticVMOptions
    + JDK-8258753: StartTlsResponse.close() hangs due to
    synchronization issues
    + JDK-8259061: C2: assert(found) failed: memory-writing node is
    not placed in its original loop or an ancestor of it
    + JDK-8259227: C2 crashes with SIGFPE due to a division that
    floats above its zero check
    + JDK-8259232: Bad JNI lookup during printing
    + JDK-8259276: C2: Empty expression stack when reexecuting
    tableswitch/lookupswitch instructions after deoptimization
    + JDK-8259343: [macOS] Update JNI error handling in Cocoa code.
    + JDK-8259585: Accessible actions do not work on mac os x
    + JDK-8259651: [macOS] Replace JNF_COCOA_ENTER/EXIT macros
    + JDK-8259662: Don't wrap SocketExceptions into SSLExceptions
    in SSLSocketImpl
    + JDK-8259710: Inlining trace leaks memory
    + JDK-8259729: Missed JNFInstanceOf -&gt; IsInstanceOf conversion
    + JDK-8259777: Incorrect predication condition generated by ADLC
    + JDK-8259786: initialize last parameter of getpwuid_r
    + JDK-8259843: initialize dli_fname array before calling
    dll_address_to_library_name
    + JDK-8259869: [macOS] Remove desktop module dependencies on
    JNF Reference APIs
    + JDK-8259886: Improve SSL session cache performance and
    scalability
    + JDK-8259983: do not use uninitialized expand_ms value in
    G1CollectedHeap::expand_heap_after_young_collection
    + JDK-8260030: Improve stringStream buffer handling
    + JDK-8260236: better init AnnotationCollector _contended_group
    + JDK-8260255: C1: LoopInvariantCodeMotion constructor can
    leave some fields uninitialized
    + JDK-8260284: C2: assert(_base == Int) failed: Not an Int
    + JDK-8260380: Upgrade to LittleCMS 2.12
    + JDK-8260420: C2 compilation fails with assert(found_sfpt)
    failed: no node in loop that's not input to safepoint
    + JDK-8260426: awt debug_mem.c DMem_AllocateBlock might leak
    memory
    + JDK-8260432: allocateSpaceForGP in freetypeScaler.c might
    leak memory
    + JDK-8260616: Removing remaining JNF dependencies in the
    java.desktop module
    + JDK-8260653: Unreachable nodes keep speculative types alive
    + JDK-8260707: java/lang/instrument/PremainClass/
    /InheritAgent0100.java times out
    + JDK-8260925: HttpsURLConnection does not work  with other
    JSSE provider.
    + JDK-8260926: Trace resource exhausted events unconditionally
    + JDK-8261020: Wrong format parameter in
    create_emergency_chunk_path
    + JDK-8261027: AArch64: Support for LSE atomics C++ HotSpot code
    + JDK-8261167: print_process_memory_info add a close call after
    fopen
    + JDK-8261170: Upgrade to freetype 2.10.4
    + JDK-8261198: [macOS] Incorrect JNI parameters in number
    conversion in A11Y code
    + JDK-8261235: C1 compilation fails with
    assert(res-&gt;vreg_number() == index) failed: conversion check
    + JDK-8261261: The version extra fields needs to be overridable
    in jib-profiles.js
    + JDK-8261262: Kitchensink24HStress.java crashed with
    EXCEPTION_ACCESS_VIOLATION
    + JDK-8261354: SIGSEGV at MethodIteratorHost
    + JDK-8261355: No data buffering in SunPKCS11 Cipher encryption
    when the underlying mechanism has no padding
    + JDK-8261397: try catch Method failing to work when dividing
    an integer by 0
    + JDK-8261422: Adjust problematic String.format calls in
    jdk/internal/util/Preconditions.java outOfBoundsMessage
    + JDK-8261447: MethodInvocationCounters frequently run into
    overflow
    + JDK-8261481: Cannot read Kerberos settings in dynamic store
    on macOS Big Sur
    + JDK-8261505: Test test/hotspot/jtreg/gc/parallel/
    /TestDynShrinkHeap.java killed by Linux OOM Killer
    + JDK-8261601: free memory in early return in
    Java_sun_nio_ch_sctp_SctpChannelImpl_receive0
    + JDK-8261649: AArch64: Optimize LSE atomics in C++ code
    + JDK-8261730: C2 compilation fails with
    assert(store-&gt;find_edge(load) != -1) failed: missing
    precedence edge
    + JDK-8261752: Multiple GC test are missing memory requirements
    + JDK-8261791: (sctp) handleSendFailed in SctpChannelImpl.c
    potential leaks
    + JDK-8261812: C2 compilation fails with assert(!had_error)
    failed: bad dominance
    + JDK-8261914: IfNode::fold_compares_helper faces
    non-canonicalized bool when running JRuby JSON workload
    + JDK-8262093: java/util/concurrent/tck/JSR166TestCase.java
    failed "assert(false) failed: unexpected node"
    + JDK-8262110: DST starts from incorrect time in 2038
    + JDK-8262121: [11u] Redo 8244287: JFR: Methods samples have
    line number 0
    + JDK-8262163: Extend settings printout in jcmd VM.metaspace
    + JDK-8262295: C2: Out-of-Bounds Array Load from Clone Source
    + JDK-8262298: G1BarrierSetC2::step_over_gc_barrier fails with
    assert "bad barrier shape"
    + JDK-8262446: DragAndDrop hangs on Windows
    + JDK-8262461: handle wcstombsdmp return value correctly in
    unix awt_InputMethod.c
    + JDK-8262465: Very long compilation times and high memory
    consumption in C2 debug builds
    + JDK-8262726: AArch64: C1 StubAssembler::call_RT can corrupt
    stack
    + JDK-8262739: String inflation C2 intrinsic prevents insertion
    of anti-dependencies
    + JDK-8262829: Native crash in
    Win32PrintServiceLookup.getAllPrinterNames()
    + JDK-8262837: handle split_USE correctly
    + JDK-8262900: ToolBasicTest fails to access HTTP server it
    starts
    + JDK-8263260: [s390] Support latest hardware (z14 and z15)
    + JDK-8263311: Watch registry changes for remote printers
    update instead of polling
    + JDK-8263361: Incorrect arraycopy stub selected by C2 for SATB
    collectors
    + JDK-8263404: RsaPrivateKeySpec is always recognized as
    RSAPrivateCrtKeySpec in RSAKeyFactory.engineGetKeySpec
    + JDK-8263425: AArch64: two potential bugs in C1
    LIRGenerator::generate_address()
    + JDK-8263448: CTW: fatal error: meet not symmetric
    + JDK-8263504: Some OutputMachOpcodes fields are uninitialized
    + JDK-8263557: Possible NULL dereference in
    Arena::destruct_contents()
    + JDK-8263558: Possible NULL dereference in fast path arena
    free if ZapResourceArea is true
    + JDK-8263676: AArch64: one potential bug in C1
    LIRGenerator::generate_address()
    + JDK-8263729: [test] divert spurious output away from stream
    under test in ProcessBuilder Basic test
    + JDK-8263846: Bad JNI lookup getFocusOwner in accessibility
    code on Mac OS X
    + JDK-8264047: Duplicate global variable 'jvm' in libjavajpeg
    and libawt
    + JDK-8264096: slowdebug jvm crashes when StrInflatedCopy match
    rule is not supported
    + JDK-8264151: ciMethod::ensure_method_data() should return
    false is loading resulted in empty state
    + JDK-8264173: [s390] Improve Hardware Feature Detection And
    Reporting
    + JDK-8264190: Harden TLS interop tests
    + JDK-8264223: CodeHeap::verify fails extra_hops assertion in
    fastdebug test
    + JDK-8264328: Broken license in
    javax/swing/JComboBox/8072767/bug8072767.java
    + JDK-8264360: Loop strip mining verification fails with
    "should be on the backedge"
    + JDK-8264626: C1 should be able to inline excluded methods
    + JDK-8264640: CMS ParScanClosure misses a barrier
    + JDK-8264786: [macos] All Swing/AWT apps cause Allow
    Notifications prompt to appear when app is launched
    + JDK-8264821: DirectIOTest fails on a system with large block
    size
    + JDK-8264848: [macos] libjvm.dylib linker warning due to macOS
    version mismatch
    + JDK-8264923: PNGImageWriter.write_zTXt throws Exception with
    a typo
    + JDK-8264958: C2 compilation fails with assert "n is later
    than its clone"
    + JDK-8265099: Revert backport to 11u of 8236859: WebSocket
    over authenticating proxy fails with NPE
    + JDK-8265154: vinserti128 operand mix up for KNL platforms
    + JDK-8265239: Shenandoah: Shenandoah heap region count could
    be off by 1
    + JDK-8265417: Backport of JDK-8249672 breaks Solaris x86 build
    + JDK-8265421: java/lang/String/StringRepeat.java test is
    missing a memory requirement
    + JDK-8265462: Handle multiple slots in the NSS Internal Module
    from SunPKCS11's Secmod
    + JDK-8265537: x86 version string truncated after JDK-8249672
    11u backport
    + JDK-8265666: Enable AIX build platform to make external debug
    symbols
    + JDK-8265677: CMS: CardTableBarrierSet::write_ref_array_work()
    lacks storestore barrier
    + JDK-8265690: Use the latest Ubuntu base image version in
    Docker testing
    + JDK-8265718: Build failure after JDK-8258414 11u backport
    + JDK-8265750: Fatal error in safepoint.cpp after backport of
    8258414
    + JDK-8265784: [C2] Hoisting of DecodeN leaves MachTemp inputs
    behind
    + JDK-8265938: C2's conditional move optimization does not
    handle top Phi
    + JDK-8266220: keytool still prompt for store password on a
    password-less pkcs12 file if -storetype pkcs12 is specified
    + JDK-8266293: Key protection using PBEWithMD5AndDES fails with
    "java.security.InvalidAlgorithmParameterException: Salt must
    be 8 bytes long"
    + JDK-8266713: [AIX] Build failure after 11u backport of
    JDK-8247753
    + JDK-8266802: Shenandoah: Round up region size to page size
    unconditionally
    + JDK-8266892: avoid maybe-uninitialized gcc warnings on linux
    s390x
    + JDK-8266929: Unable to use algorithms from 3p providers
    + JDK-8267235: [macos_aarch64]
    InterpreterRuntime::throw_pending_exception messing up LR
    results in crash
    + JDK-8267561: Shenandoah: Reference processing not properly
    setup for outside of cycle degenerated GC
    + JDK-8267599: Revert the change to the default PKCS12
    macAlgorithm and macIterationCount props for 11u/8u/7u
    + JDK-8267641: [11u] 8227609 backport typo
    + JDK-8267721: Enable sun/security/pkcs11 tests for Amazon
    Linux 2 AArch64
    + JDK-8268678: LetsEncryptCA.java test fails as Let's Encrypt
    Authority X3 is retired</changelog>
  <changelog author="schwab@suse.de" date="1628078400">- riscv64-zero.patch: Add support for riscv64 (zero VM)</changelog>
  <changelog author="fstrba@suse.com" date="1629979200">- Added patch:
  * jdk11-glibc234.patch
    + fix build with glibc-2.34 (bsc#1189201)</changelog>
  <changelog author="fstrba@suse.com" date="1631534400">- Modified patch:
  * nss-security-provider.patch
    + revert recent changes making NSS provider the default one
    + fixes bsc#1190252</changelog>
  <changelog author="fstrba@suse.com" date="1631793600">- Added patch:
  * fips.patch
    + implement FIPS support in OpenJDK</changelog>
  <changelog author="fstrba@suse.com" date="1634817600">- Update to upstream tag jdk-11.0.13+8 (October 2021 CPU)
  * Security fixes
    + JDK-8163326, CVE-2021-35550, bsc#1191901: Update the default
    enabled cipher suites preference
    + JDK-8254967, CVE-2021-35565, bsc#1191909:
    com.sun.net.HttpsServer spins on TLS session close
    + JDK-8263314: Enhance XML Dsig modes
    + JDK-8265167, CVE-2021-35556, bsc#1191910: Richer Text Editors
    + JDK-8265574: Improve handling of sheets
    + JDK-8265580, CVE-2021-35559, bsc#1191911: Enhanced style for
    RTF kit
    + JDK-8265776: Improve Stream handling for SSL
    + JDK-8266097, CVE-2021-35561, bsc#1191912: Better hashing
    support
    + JDK-8266103: Better specified spec values
    + JDK-8266109: More Resilient Classloading
    + JDK-8266115: More Manifest Jar Loading
    + JDK-8266137, CVE-2021-35564, bsc#1191913: Improve Keystore
    integrity
    + JDK-8266689, CVE-2021-35567, bsc#1191903: More Constrained
    Delegation
    + JDK-8267086: ArrayIndexOutOfBoundsException in
    java.security.KeyFactory.generatePublic
    + JDK-8267712: Better LDAP reference processing
    + JDK-8267729, CVE-2021-35578, bsc#1191904: Improve TLS client
    handshaking
    + JDK-8267735, CVE-2021-35586, bsc#1191914: Better BMP support
    + JDK-8268193: Improve requests of certificates
    + JDK-8268199: Correct certificate requests
    + JDK-8268205: Enhance DTLS client handshake
    + JDK-8268506: More Manifest Digests
    + JDK-8269618, CVE-2021-35603, bsc#1191906: Better session
    identification
    + JDK-8269624: Enhance method selection support
    + JDK-8270398: Enhance canonicalization
    + JDK-8270404: Better canonicalization
  * Other changes
    + JDK-8024368: private methods are allocated vtable indices
    + JDK-8042902: Test java/net/Inet6Address/serialize/
    /Inet6AddressSerializationTest.java fails intermittently
    + JDK-8140466: ChaCha20 and Poly1305 TLS Cipher Suites
    + JDK-8157404: Unable to read certain PKCS12 keystores from
    SequenceInputStream
    + JDK-8158066: SourceDebugExtensionTest fails to rename file
    + JDK-8168304: Make all of DependencyContext_test available in
    product mode
    + JDK-8169246: java/net/DatagramSocket/ReportSocketClosed.java
    fails intermittently with BindException
    + JDK-8181313: SA: Remove libthread_db dependency on Linux
    + JDK-8193214: Incorrect annotations.without.processors
    warnings with JDK 9
    + JDK-8194230: jdk/internal/jrtfs/remote/
    /RemoteRuntimeImageTest.java fails with
    java.lang.NullPointerException
    + JDK-8196092: javax/swing/JComboBox/8032878/bug8032878.java
    fails
    + JDK-8199931: java/net/MulticastSocket/
    /UnreferencedMulticastSockets.java fails with "incorrect data
    received"
    + JDK-8206083: Make tools/javac/api/T6265137.java robust to JDK
    version changes
    + JDK-8206350: java/util/Locale/bcp47u/SystemPropertyTests.java
    failed on Mac 10.13 with zh_CN and zh_TW locales.
    + JDK-8207316: java/nio/channels/spi/SelectorProvider/
    /inheritedChannel/InheritedChannelTest.java failed
    + JDK-8208227: tools/jdeps/DotFileTest.java fails on Win-X64
    + JDK-8208363: test/jdk/java/lang/Package/
    /PackageFromManifest.java missing module dependencies
    declaration
    + JDK-8209380: ARM: cleanup maybe-uninitialized and reorder
    compiler warnings
    + JDK-8209768: Refactor java/util/prefs/CheckUserPrefsStorage.sh
    to plain java test
    + JDK-8209772: Refactor shell test java/util/ServiceLoader/
    /basic/basic.sh to java
    + JDK-8209773: Refactor shell test javax/naming/module/basic.sh
    to java
    + JDK-8209832: Refactor jdk/internal/reflect/Reflection/
    /GetCallerClassTest.sh to plain java test
    + JDK-8209930: Refactor java/util/zip/ZipFile/deletetempjar.sh
    to plain java test
    + JDK-8210406: Refactor java.util.PluggableLocale:i18n shell
    tests to plain java tests
    + JDK-8210407: Refactor java.util.Calendar:i18n shell tests to
    plain java tests
    + JDK-8210495: compiler crashes because of illegal signature in
    otherwise legal code
    + JDK-8210669: Some launcher tests assume a pre-JDK 9 run-time
    image layout
    + JDK-8210802: temp files left by tests in
    jdk/java/net/httpclient
    + JDK-8210819: Update the host name in CNameTest.java
    + JDK-8210908: Refactor java/util/prefs/PrefsSpi.sh to plain
    java test
    + JDK-8210934: Move sun/net/www/protocol/http/
    /GetErrorStream.java to OpenJDK
    + JDK-8210959: JShell fails and exits when statement throws an
    exception whose message contains a '%'.
    + JDK-8211055: Provide print to a file (PDF) feature even when
    printer was not connected
    + JDK-8211092: test/jdk/sun/net/www/http/HttpClient/
    /MultiThreadTest.java fails intermittently when cleaning up
    + JDK-8211296: Remove HotSpot deprecation warning suppression
    for Mac/clang
    + JDK-8211325: test/jdk/java/net/Socket/LingerTest.java fails
    with cleaning up
    + JDK-8212040: Compilation error due to wrong usage of
    NSPrintJobDispositionValue in mac10.12
    + JDK-8212695: Add explicit timeout to several HTTP Client tests
    + JDK-8212718: Refactor some annotation processor tests to
    better use collections
    + JDK-8213007: Update the link in test/jdk/sun/security/
    /provider/SecureRandom/DrbgCavp.java
    + JDK-8213137: Remove static initialization of monitor/mutex
    instances
    + JDK-8213235: java/nio/channels/SocketChannel/
    /AsyncCloseChannel.java fails with threads that didn't exit
    + JDK-8213409: Refactor sun.text.IntHashtable:i18n shell tests
    to plain java tests
    + JDK-8213576: Make test AsyncCloseChannel.java run in othervm
    + JDK-8213694: Test Timeout.java should run in othervm mode
    + JDK-8213718: [TEST] Wrong classname in vmTestbase/nsk/stress/
    /except/except002 and except003
    + JDK-8213922: fix ctw stand-alone build
    + JDK-8214195: Align stdout messages in
    test/jdk/java/math/BigInteger/PrimitiveConversionTests.java
    + JDK-8214520: [TEST_BUG] sun/security/mscapi/nonUniqueAliases/
    /NonUniqueAliases.java failed with incorrect jtreg tags order
    + JDK-8214937: sun/security/tools/jarsigner/warnings/
    /NoTimestampTest.java failed due to unexpected expiration date
    + JDK-8216532: tools/launcher/Test7029048.java fails (Solaris)
    + JDK-8217825: Verify @AfterTest is used correctly in WebSocket
    tests
    + JDK-8218145: block_if_requested is not proper inlined due to
    size
    + JDK-8219417: bump jtreg requiredVersion to b14
    + JDK-8219552: bump jtreg requiredVersion to b14 in
    test/jdk/sanity/client/
    + JDK-8219804: java/net/MulticastSocket/Promiscuous.java fails
    intermittently due to NumberFormatException
    + JDK-8220445: Support for side by side MSVC Toolset versions
    + JDK-8221988: add possibility to build with Visual Studio 2019
    + JDK-8222751: closed/test/jdk/sun/security/util/
    /DerIndefLenConverter/IndefBerPkcs12.java fail
    + JDK-8223050: JVMCI: findUniqueConcreteMethod() should not use
    Dependencies::find_unique_concrete_method() for non-virtual
    methods
    + JDK-8224853: CDS address sanitizer errors
    + JDK-8225082: Remove IdenTrust certificate that is expiring in
    September 2021
    + JDK-8225583: Examine the HttpResponse.BodySubscribers for
    null handling and multiple subscriptions
    + JDK-8225690: Multiple AttachListener threads can be created
    + JDK-8225790: Two NestedDialogs tests fail on Ubuntu
    + JDK-8226319: Add forgotten test/jdk/java/net/httpclient/
    /BodySubscribersTest.java
    + JDK-8226533: JVMCI: findUniqueConcreteMethod should handle
    statically bindable methods directly
    + JDK-8226602: Test convenience reactive primitives from
    java.net.http with RS TCK
    + JDK-8226683: Remove review suggestion from fix to 8219804
    + JDK-8227738: jvmti/DataDumpRequest/datadumpreq001 failed due
    to "exit code is 134"
    + JDK-8227766: CheckUnhandledOops is broken in MemAllocator
    + JDK-8227815: Minimal VM: set_state is not a member of
    AttachListener
    + JDK-8230674: Heap dumps should exclude dormant CDS archived
    objects of unloaded classes
    + JDK-8230808: Remove Access::equals()
    + JDK-8230841: Remove oopDesc::equals()
    + JDK-8231717: Improve performance of charset decoding when
    charset is always compactable
    + JDK-8232243: Wrong caret position in JTextPane on Windows
    with a screen resolution &gt; 100%
    + JDK-8232782: Shenandoah: streamline post-LRB CAS barrier
    (aarch64)
    + JDK-8233790: Forward output from heap dumper to jcmd/jmap
    + JDK-8233989: Create an IPv4 version of
    java/net/MulticastSocket/SetLoopbackMode.java
    + JDK-8234510: Remove file seeking requirement for writing a
    heap dump
    + JDK-8235211: serviceability/attach/
    /RemovingUnixDomainSocketTest.java fails with
    AttachNotSupportedException: Unable to open socket file
    + JDK-8235216: typo in test filename
    + JDK-8235866: bump jtreg requiredVersion to 4.2b16
    + JDK-8236111: narrow allowSmartActionArgs disabling
    + JDK-8236413: AbstractConnectTimeout should tolerate both
    NoRouteToHostException and UnresolvedAddressException
    + JDK-8236671: NullPointerException in JKS keystore
    + JDK-8238930: problem list compiler/c2/Test8004741.java
    + JDK-8238943: switch to jtreg 5.0
    + JDK-8240555: Using env of JAVA_TOOL_OPTIONS and _JAVA_OPTIONS
    breaks QuietOption.java test
    + JDK-8240983: Incorrect copyright header in Apache Santuario
    2.1.3 files
    + JDK-8241336: Some java.net tests failed with
    NoRouteToHostException on MacOS with special network
    configuration
    + JDK-8241353: NPE in ToolProvider.getSystemJavaCompiler
    + JDK-8241768: git needs .gitattributes
    + JDK-8242882: opening jar file with large manifest might throw
    NegativeArraySizeException
    + JDK-8244973: serviceability/attach/
    /RemovingUnixDomainSocketTest.java fails "stderr was not
    empty"
    + JDK-8245134: test/lib/jdk/test/lib/security/
    /KeyStoreUtils.java should allow to specify aliases
    + JDK-8246261: TCKLocalTime.java failed due to "AssertionError:
    expected [18:14:22] but found [18:14:23]"
    + JDK-8246387: switch to jtreg 5.1
    + JDK-8247421: [TESTBUG] ReturnBlobToWrongHeapTest.java failed
    allocating blob
    + JDK-8247469: getSystemCpuLoad() returns -1 on linux when some
    offline cpus are present and cpusets.effective_cpus is not
    available
    + JDK-8248352: [TEST_BUG] Test test/jdk/java/awt/font/
    /TextLayout/ArabicDiacriticTest.java can leave frame open
    + JDK-8248403: AArch64: Remove uses of kernel integer types
    + JDK-8248414: AArch64: Remove uses of long and unsigned long
    ints
    + JDK-8248657: Windows: strengthening in ThreadCritical
    regarding memory model
    + JDK-8248666: AArch64: Use THREAD_LOCAL instead of __thread
    + JDK-8248668: AArch64: Avoid MIN/MAX macros when using MSVC
    + JDK-8248671: AArch64: Remove unused variables
    + JDK-8248682: AArch64: Use ATTRIBUTE_ALIGNED helper
    + JDK-8248816: C1: Fix signature conflict in
    LIRGenerator::strength_reduce_multiply
    + JDK-8249095: tools/javac/launcher/SourceLauncherTest.java
    fails on Windows
    + JDK-8249548: backward focus traversal gets stuck in button
    group
    + JDK-8249773: Upgrade ReceiveISA.java test to be resilient to
    failure due to stray packets and interference
    + JDK-8249897: jdk/javadoc/tool/LangVers.java uses @ignore w/o
    bug-id
    + JDK-8249898: jdk/javadoc/tool/6176978/T6176978.java uses
    @ignore w/o bug-id
    + JDK-8249899: jdk/javadoc/tool/InlineTagsWithBraces.java uses
    @ignore w/o bug-id
    + JDK-8250588: Shenandoah: LRB needs to save/restore fp
    registers for runtime call
    + JDK-8250824: AArch64: follow up for JDK-8248414
    + JDK-8251166: Add automated testcases for changes done in
    JDK-8214112
    + JDK-8251252: Add automated testcase for fix done in
    JDK-8214253
    + JDK-8251254: Add automated test for fix done in JDK-8218472
    + JDK-8251361: Potential race between Logger configuration and
    GCs in HttpURLConWithProxy test
    + JDK-8251549: Update docs on building for Git
    + JDK-8251945: SIGSEGV in
    PackageEntry::purge_qualified_exports()
    + JDK-8252194: Add automated test for fix done in JDK-8218469
    + JDK-8252648: Shenandoah: name gang tasks consistently
    + JDK-8252825: Add automated test for fix done in JDK-8218479
    + JDK-8252853: AArch64: gc/shenandoah/TestVerifyJCStress.java
    fails intermittently with C1
    + JDK-8252857: AArch64: Shenandoah C1 CAS is not sequentially
    consistent
    + JDK-8253048: AArch64: When CallLeaf, no need to preserve
    callee-saved registers in caller
    + JDK-8253424: Add support for running pre-submit testing using
    GitHub Actions
    + JDK-8253631: Remove unimplemented CompileBroker methods after
    JEP-165
    + JDK-8253865: Pre-submit testing using GitHub Actions does not
    detect failures reliably
    + JDK-8253899: Make IsClassUnloadingEnabled signature match
    specification
    + JDK-8254024: Enhance native libs for AWT and Swing to work
    with GraalVM Native Image
    + JDK-8254054: Pre-submit testing using GitHub Actions should
    not use the deprecated set-env command
    + JDK-8254173: Add Zero, Minimal hotspot targets to submit
    workflow
    + JDK-8254175: Build no-pch configuration in debug mode for
    submit checks
    + JDK-8254244: Some code emitted by TemplateTable::branch is
    unused when running TieredCompilation
    + JDK-8254270: linux 32 bit build doesn't compile
    libjdwp/log_messages.c
    + JDK-8254282: Add Linux x86_32 builds to submit workflow
    + JDK-8254850: Update terminology in java.awt.GridBagLayout
    source code comments
    + JDK-8255255: Update Apache Santuario (XML Signature) to
    version 2.2.1
    + JDK-8255305: Add Linux x86_32 tier1 to submit workflow
    + JDK-8255352: Archive important test outputs in submit workflow
    + JDK-8255373: Submit workflow artifact name is always
    "test-results_.zip"
    + JDK-8255452: Doing GC during JVMTI MethodExit event posting
    breaks return oop
    + JDK-8255718: Zero: VM should know it runs in interpreter-only
    mode
    + JDK-8255790: GTKL&amp;F: Java 16 crashes on initialising GTKL&amp;F
    on Manjaro Linux
    + JDK-8255810: Zero: build fails without JVMTI
    + JDK-8255895: Submit workflow artifacts miss hs_errs/replays
    due to ZIP include mismatch
    + JDK-8256127: Add cross-compiled foreign architectures builds
    to submit workflow
    + JDK-8256215: Shenandoah: re-organize saving/restoring machine
    state in assembler code
    + JDK-8256267: Relax compiler/floatingpoint/NaNTest.java for
    x86_32 and lower -XX:+UseSSE
    + JDK-8256277: Github Action build on macOS should define OS
    and Xcode versions
    + JDK-8256354: Github Action build on Windows should define OS
    and MSVC versions
    + JDK-8256393: Github Actions build on Linux should define OS
    and GCC versions
    + JDK-8256414: add optimized build to submit workflow
    + JDK-8256747: GitHub Actions: decouple the hotspot build-only
    jobs from Linux x64 testing
    + JDK-8257056: Submit workflow should apt-get update to avoid
    package installation errors
    + JDK-8257148: Remove obsolete code in AWTView.m
    + JDK-8257497: Update keytool to create AKID from the SKID of
    the issuing certificate as specified by RFC 5280
    + JDK-8257620: Do not use objc_msgSend_stret to get macOS
    version
    + JDK-8257913: Add more known library locations to simplify
    Linux cross-compilation
    + JDK-8258703: Incorrect 512-bit vector registers restore on
    x86_32
    + JDK-8259338: Add expiry exception for identrustdstx3 alias to
    VerifyCACerts.java test
    + JDK-8259535: ECDSA SignatureValue do not always have the
    specified length
    + JDK-8259679: GitHub actions should use MSVC 14.28
    + JDK-8259924: GitHub actions fail on Linux x86_32 with "Could
    not configure libc6:i386"
    + JDK-8260460: GitHub actions still fail on Linux x86_32 with
    "Could not configure libc6:i386"
    + JDK-8260589: Crash in JfrTraceIdLoadBarrier::load(_jclass*)
    + JDK-8260923: Add more tests for SSLSocket input/output
    shutdown
    + JDK-8261072: AArch64: Fix MacroAssembler::get_thread
    convention
    + JDK-8261147: C2: Node is wrongly marked as reduction
    resulting in a wrong execution due to wrong vector instructions
    + JDK-8261238: NMT should not limit baselining by size threshold
    + JDK-8261496: Shenandoah: reconsider pacing updates memory
    ordering
    + JDK-8261652: Remove some dead comments from os_bsd_x86
    + JDK-8261846: [JVMCI] c2v_iterateFrames can get out of sync
    with the StackFrameStream
    + JDK-8262000: jdk/jfr/event/gc/detailed/
    /TestPromotionFailedEventWithParallelScavenge.java failed with
    "OutOfMemoryError: Java heap space"
    + JDK-8262017: C2: assert(n != __null) failed: Bad immediate
    dominator info.
    + JDK-8262392: Update Mesa 3-D Headers to version 21.0.3
    + JDK-8262409: sun/security/ssl/SSLSocketImpl/
    /SSLSocketImplThrowsWrongExceptions. SSL test failures caused
    by java failed with "Server reported the wrong exception"
    + JDK-8262470: Printed GlyphVector outline with low DPI has bad
    quality on Windows
    + JDK-8262862: Harden tests sun/security/x509/URICertStore/
    /ExtensionsWithLDAP.java and krb5/canonicalize/Test.java
    + JDK-8263136: C4530 was reported from VS 2019 at access bridge
    + JDK-8263227: C2: inconsistent spilling due to dead nodes in
    exception block
    + JDK-8263382: java/util/logging/ParentLoggersTest.java failed
    with "checkLoggers: getLoggerNames() returned unexpected
    loggers"
    + JDK-8263407: SPARC64 detection fails on Athena (SPARC64-X)
    + JDK-8263432: javac may report an invalid package/class clash
    on case insensitive filesystems
    + JDK-8263490: [macos] Crash occurs on JPasswordField with
    activated InputMethod
    + JDK-8263531: Remove unused buffer int
    + JDK-8263667: Avoid running GitHub actions on branches named
    pr/*
    + JDK-8263776: [JVMCI] add helper to perform Java upcalls
    + JDK-8264016: [JVMCI] add some thread local fields for use by
    JVMCI
    + JDK-8264752: SIGFPE crash with option
    FlightRecorderOptions:threadbuffersize=30M
    + JDK-8265132: C2 compilation fails with assert "missing
    precedence edge"
    + JDK-8265231: (fc) ReadDirect and WriteDirect tests fail after
    fix for JDK-8264821
    + JDK-8265335: Epsilon: Minor typo in EpsilonElasticTLABDecay
    description
    + JDK-8265756: AArch64: initialize memory allocated for locals
    according to Windows AArch64 stack page growth requirement in
    template interpreter
    + JDK-8265761: Font with missed font family name is not
    properly printed on Windows
    + JDK-8265773: incorrect jdeps message "jdk8internals" to
    describe a removed JDK internal API
    + JDK-8265836: OperatingSystemImpl.getCpuLoad() returns
    incorrect CPU load inside a container
    + JDK-8266018: Shenandoah: fix an incorrect assert
    + JDK-8266206: Build failure after JDK-8264752 with older GCCs
    + JDK-8266248: Compilation failure in
    PLATFORM_API_MacOSX_MidiUtils.c with Xcode 12.5
    + JDK-8266288: assert root method not found in
    witnessed_reabstraction_in_supers is too strong
    + JDK-8266404: Fatal error report generated with
  - XX:+CrashOnOutOfMemoryError should not contain suggestion to
    submit a bug report
    + JDK-8266480: Implicit null check optimization does not update
    control of hoisted memory operation
    + JDK-8266615: C2 incorrectly folds subtype checks involving an
    interface array
    + JDK-8266642: Improve ResolvedMethodTable hash function
    + JDK-8266749: AArch64: Backtracing broken on PAC enabled
    systems
    + JDK-8266761: AssertionError in
    sun.net.httpserver.ServerImpl.responseCompleted
    + JDK-8266813: Shenandoah: Use shorter instruction sequence for
    checking if marking in progress
    + JDK-8267042: bug in monitor locking/unlocking on ARM32 C1 due
    to uninitialized BasicObjectLock::_displaced_header
    + JDK-8267348: Rewrite gc/epsilon/TestClasses.java to use
    Metaspace with less classes
    + JDK-8267396: Avoid recording "pc" in unhandled oops detector
    for better performance
    + JDK-8267399: C2: java/text/Normalizer/ConformanceTest.java
    test failed with assertion
    + JDK-8267424: CTW: C1 fails with "State must not be null"
    + JDK-8267459: Pasting Unicode characters into JShell does not
    work.
    + JDK-8267625: AARCH64: typo in LIR_Assembler::emit_profile_type
    + JDK-8267666: Add option to jcmd GC.heap_dump to use existing
    file
    + JDK-8267695: Bump update version for OpenJDK: jdk-11.0.13
    + JDK-8267751: (test) jtreg.SkippedException has no serial
    VersionUID
    + JDK-8267773: PhaseStringOpts::int_stringSize doesn't handle
    min_jint correctly
    + JDK-8268103: JNI functions incorrectly return a double after
    JDK-8265836
    + JDK-8268127: Shenandoah: Heap size may be too small for
    region to align to large page size
    + JDK-8268261: C2: assert(n != __null) failed: Bad immediate
    dominator info.
    + JDK-8268347: C2: nested locks optimization may create
    unbalanced monitor enter/exit code
    + JDK-8268360: Missing check for infinite loop during node
    placement
    + JDK-8268362: [REDO] C2 crash when compile negative
    Arrays.copyOf length after loop
    + JDK-8268366: Incorrect calculation of has_fpu_registers in C1
    linear scan
    + JDK-8268369: SIGSEGV in PhaseCFG::implicit_null_check due to
    missing null check
    + JDK-8268417: Add test from JDK-8268360
    + JDK-8268427: Improve AlgorithmConstraints:checkAlgorithm
    performance
    + JDK-8268617: [11u REDO] - WebSocket over authenticating proxy
    fails with NPE
    + JDK-8268620: InfiniteLoopException test may fail on x86
    platforms
    + JDK-8268635: Corrupt oop in ClassLoaderData
    + JDK-8268699: Shenandoah: Add test for JDK-8268127
    + JDK-8268771: javadoc -notimestamp option does not work on
    index.html
    + JDK-8268775: Password is being converted to String in
    AccessibleJPasswordField
    + JDK-8268776: Test `ADatagramSocket.java` missing /othervm
    from @run tag
    + JDK-8268965: TCP Connection Reset when connecting simple
    socket to SSL server
    + JDK-8269304: Regression ~5% in 2005 in b27
    + JDK-8269415: [11u] Remove ea from
    DEFAULT_PROMOTED_VERSION_PRE in OpenJDK 11u
    + JDK-8269478: Shenandoah: gc/shenandoah/mxbeans tests should
    be more resilient
    + JDK-8269529: javax/swing/reliability/
    /HangDuringStaticInitialization.java fails in Windows debug
    build
    + JDK-8269594: assert(_handle_mark_nesting &gt; 1) failed: memory
    leak: allocating handle outside HandleMark
    + JDK-8269614: [s390] Interpreter checks wrong bit for slow
    path instance allocation
    + JDK-8269650: Optimize gc-locker in
    [Get|Release]StringCritical for latin string
    + JDK-8269661: JNI_GetStringCritical does not lock char array
    + JDK-8269668: [aarch64] java.library.path not including
    /usr/lib64
    + JDK-8269763: The JEditorPane is blank after JDK-8265167
    + JDK-8269795: C2: Out of bounds array load floats above its
    range check in loop peeling resulting in SEGV
    + JDK-8269847: JDK-8269594 backport breaks 11u builds
    + JDK-8269850: Most JDK releases report macOS version 12 as
    10.16 instead of 12.0
    + JDK-8269851: OperatingSystemMXBean getProcessCpuLoad reports
    incorrect process cpu usage in containers
    + JDK-8269882: stack-use-after-scope in NewObjectA
    + JDK-8269934: RunThese24H.java failed with
    EXCEPTION_ACCESS_VIOLATION in
    java_lang_Thread::get_thread_status
    + JDK-8270096: Shenandoah: Optimize gc/shenandoah/
    /TestRefprocSanity.java for interpreter mode
    + JDK-8270137: Kerberos Credential Retrieval from Cache not
    Working in Cross-Realm Setup
    + JDK-8270184: [TESTBUG] Add coverage for jvmci
    ResolvedJavaType.toJavaName() for lambdas
    + JDK-8270196: [11u] [JVMCI] JavaType.toJavaName() returns
    incorrect type name for lambdas
    + JDK-8270556: Exclude security/infra/java/security/cert/
    /CertPathValidator/certification/LetsEncryptCA
    + JDK-8270893: IndexOutOfBoundsException while reading large
    TIFF file
    + JDK-8272078: Wrong Checksums in Temurin BootJDK dependencies
    + JDK-8272124: Cgroup v1 initialization causes
    NullPointerException when cgroup path contains colon
    + JDK-8272131: PhaseMacroExpand::generate_slow_arraycopy crash
    when clone null CallProjections.fallthrough_ioproj
    + JDK-8272197: Update 11u GHA workflow with Shenandoah
    configurations
    + JDK-8272332: --with-harfbuzz=system doesn't add -lharfbuzz
    after JDK-8255790
    + JDK-8272472: StackGuardPages test doesn't build with glibc
    2.34
    + JDK-8272602: [macos] not all KEY_PRESSED events sent when
    control modifier is used
    + JDK-8272628: Problemlist gc/stress/gcbasher/
    /TestGCBasherWithCMS.java for x86_32
    + JDK-8272700: [macos] Build failure with Xcode 13.0 after
    JDK-8264848
    + JDK-8272772: Shenandoah: compiler/c2/aarch64/
    /TestVolatilesShenandoah.java fails in 11u
    + JDK-8273939: Backport of 8248414 to JDK11 breaks
    MacroAssembler::adrp
- Remove the unneeded icedtea-sound provider
- Removed patches:
  * icedtea-sound-1.0.1-jdk9.patch
  * icedtea-sound-soundproperties.patch
    + not needed since the icedtea-sound provider is removed
  * jdk11-glibc234.patch
    + integrated upstream</changelog>
  <changelog author="fstrba@suse.com" date="1635940800">- Modified patches:
  * system-crypto-policy.patch
    + rediff to changed context
  * fips.patch
    + Allow plain key import in fips mode unless
    com.suse.fips.plainKeySupport is set to false</changelog>
  <changelog author="fstrba@suse.com" date="1636113600">- Modified patch:
  * fips.patch
    + return in native code after generating java.io.IOException</changelog>
</package>
<package pkgid="e489deb4b7c89779a8b1e75204d7aeac68307dc47b9a0aa7261a53ae5bf3a7b9" name="java-11-openjdk-devel" arch="aarch64">
  <version epoch="0" ver="11.0.13.0" rel="3.68.1"/>
  <changelog author="fstrba@suse.com" date="1586952000">- The pack200 and unpack200 alternatives should be slaves of java
  and not of javac, since they are part of JRE.</changelog>
  <changelog author="fstrba@suse.com" date="1587470400">- Update to upstream tag jdk-11.0.7+10 (April 2020 CPU,
  bsc#1169511)
  * Security fixes:
    + S8223898, CVE-2020-2754: Forward references to Nashorn
    + S8223904, CVE-2020-2755: Improve Nashorn matching
    + S8224541, CVE-2020-2756: Better mapping of serial ENUMs
    + S8224549, CVE-2020-2757: Less Blocking Array Queues
    + S8225603: Enhancement for big integers
    + S8226346: Build better binary builders
    + S8227467: Better class method invocations
    + S8227542: Manifest improved jar headers
    + S8229733: TLS message handling improvements
    + S8231415, CVE-2020-2773: Better signatures in XML
    + S8231785: Improved socket permissions
    + S8232424, CVE-2020-2778: More constrained algorithms
    + S8232581, CVE-2020-2767: Improve TLS verification
    + S8233250: Better X11 rendering
    + S8233410: Better Build Scripting
    + S8234027: Better JCEKS key support
    + S8234408, CVE-2020-2781: Improve TLS session handling
    + S8234825, CVE-2020-2800: Better Headings for HTTP Servers
    + S8234841, CVE-2020-2803: Enhance buffering of byte buffers
    + S8235274, CVE-2020-2805: Enhance typing of methods
    + S8235691, CVE-2020-2816: Enhance TLS connectivity
    + S8236201, CVE-2020-2830: Better Scanner conversions
    + S8238960: linux-i586 builds are inconsistent as the newly
    built jdk is not able to reserve enough space for object heap
  * Other changes:
    + S4919790: Errors in alert ssl message does not reflect the
    actual certificate status
    + S4949105: Access Bridge lacks html tags parsing
    + S7092821: java.security.Provider.getService() is synchronized
    and became scalability bottleneck
    + S7143743: Potential memory leak with zip provider
    + S8005819: Support cross-realm MSSFU
    + S8042383: [TEST_BUG] Test javax/swing/plaf/basic/BasicMenuUI/
    /4983388/bug4983388.java fails with shortcuts on menus do not
    work
    + S8068184: Fix for JDK-8032832 caused a deadlock
    + S8145845: [AOT] NullPointerException in
    compiler/whitebox/GetCodeHeapEntriesTest.java
    + S8152988: [AOT] Update test batch definitions to include
    aot-ed java.base module mode into hs-comp testing
    + S8160926: FLAGS_COMPILER_CHECK_ARGUMENTS doesn't handle
    cross-compilation
    + S8163083: SocketListeningConnector does not allow invocations
    with port 0
    + S8163251: Hard coded loop limit prevents reading of smart
    card data greater than 8k
    + S8167276: jvmci/compilerToVM/MaterializeVirtualObjectTest.java
    fails with -XX:-EliminateAllocations
    + S8169718: nsk/jdb/locals/locals002: ERROR: Cannot find
    boolVar with expected value: false
    + S8176556:
    java/awt/dnd/ImageTransferTest/ImageTransferTest.java fails
    for JFIF
    + S8178798: Two compiler/aot/verification/vmflags tests fail by
    timeout with UseAVX=3
    + S8183107: PKCS11 regression regarding checkKeySize
    + S8185005: Improve performance of
    ThreadMXBean.getThreadInfo(long ids[], int maxDepth)
    + S8189633: Missing -Xcheck:jni checking for DeleteWeakGlobalRef
    + S8189861: Refactor CacheFind
    + S8193042: NativeLookup::lookup_critical_entry() should only
    load shared library once
    + S8193596: java/net/DatagramPacket/ReuseBuf.java failed due to
    timeout
    + S8194944: Regression automated test 'open/test/jdk/javax/
    /swing/JInternalFrame/8145896/TestJInternalFrameMaximize.java'
    fails
    + S8196467: javax/swing/JInternalFrame/Test6325652.java fails
    + S8196969: JTreg Failure: serviceability/sa/ClhsdbJstack.java
    causes NPE
    + S8198321: javax/swing/JEditorPane/5076514/bug5076514.java
    fails
    + S8198398: Test javax/swing/JColorChooser/Test6199676.java
    fails in mach5
    + S8199072: Test javax/swing/GroupLayout/6613904/
    /bug6613904.java is unstable
    + S8200432: javadoc fails with ClassCastException on {@link
    byte[]}
    + S8201349: build broken when configured with
  - -with-zlib=bundled on gcc 7.3
    + S8201355: Avoid native memory allocation in
    sun.security.mscapi.PRNG.generateSeed
    + S8201513: nsk/jvmti/IterateThroughHeap/filter-* are broken
    + S8203364: Some serviceability/sa/ tests intermittently fail
    with java.io.IOException: LingeredApp terminated with non-zero
    exit code 3
    + S8203687: javax/net/ssl/compatibility/Compatibility.java
    supports TLS 1.3
    + S8203904: javax/swing/JSplitPane/4816114/bug4816114.java: The
    divider location is wrong
    + S8203911: Test runtime/modules/getModuleJNI/GetModule fails
    with -Xcheck:jni
    + S8204525: [TESTBUG] runtime/NMT/MallocStressTest.java ran out
    of java heap
    + S8204529: gc/TestAllocateHeapAtMultiple.java fail with Agent
    7 timed out
    + S8204551: Event descriptions are truncated in logs
    + S8206963: [AOT] bug with multiple class loaders
    + S8207367: 10 vmTestbase/nsk/jdi tests timed out when running
    with jtreg
    + S8207832: serviceability/sa/ClhsdbCDSCore.java failed with
    "Couldn't find core file location"
    + S8207938: At step6,Click Add button,case failed automatically.
    + S8208157: requires.VMProps throws NPE for missing properties
    in "release" file
    + S8208379: compiler/jvmci/events/
    /JvmciNotifyInstallEventTest.java failed with "Got unexpected
    event count after 2nd install attempt: expected 9 to equal 2"
    + S8208658: Make CDS archived heap regions usable even if
    compressed oop encoding has changed
    + S8208715: Conversion of milliseconds to nanoseconds in
    UNIXProcess contains bug
    + S8209361: [AOT] Unexpected number of references for
    JVMTI_HEAP_REFERENCE_CONSTANT_POOL [111--&gt;111]: 0 (expected
    at least 1)
    + S8209385: CDS runtime classpath checking is too strict when
    only classes from the system modules are archived
    + S8209389: SIGSEGV in WalkOopAndArchiveClosure::do_oop_work.
    + S8209418: Synchronize test/jdk/sanity/client/lib/jemmy with
    code-tools/jemmy/v2
    + S8209494: Create a test for SwingSet InternalFrameDemo
    + S8209499: Create test for SwingSet EditorPaneDemo
    + S8209574: [AOT] breakpoint events are generated in different
    threads does not meet expected count
    + S8209686: cleanup arguments to PhaseIdealLoop() constructor
    + S8209789: Synchronize test/jdk/sanity/client/lib/jemmy with
    code-tools/jemmy/v2
    + S8209802: Garbage collectors should register JFR types
    themselves to avoid build errors.
    + S8209807: improve handling exception in requires.VMProps
    + S8209817: stack is executable when building with Clang on
    Linux
    + S8209824: Improve the code coverage for ThreadLocal
    + S8209826: Undefined reference to os::write after JDK-8209657
    (filemap.hpp cleanup)
    + S8209850: Allow NamedThreads to use GlobalCounter critical
    sections
    + S8209976: Improve iteration over non-JavaThreads
    + S8209993: Create a test for SwingSet3 ToolTipDemo
    + S8210024: JFR calls virtual is_Java_thread from ~Thread()
    + S8210052: Enable testing for all the available look and feels
    in SwingSet3 demo tests
    + S8210055: Enable different look and feel tests in SwingSet3
    demo tests
    + S8210057: Enable different look and feels in SwingSet3 demo
    test InternalFrameDemoTest
    + S8210058: Algorithmic Italic font leans opposite angle in
    Printing
    + S8210220: [AOT] jdwp test cases are failing with error #
    ERROR: TEST FAILED: Cought IOException while receiving event
    packet
    + S8210289: ArchivedKlassSubGraphInfoRecord is incomplete
    + S8210459: Add support for generating compile_commands.json
    + S8210476: sun/security/mscapi/PrngSlow.java fails with Still
    too slow
    + S8210512: [Testbug] vmTestbase/nsk/jdi/ObjectReference/
    /referringObjects/referringObjects002/referringObjects002.java
    fails with unexpected size of
    ClassLoaderReference.referringObjects
    + S8210523: runtime/appcds/cacheObject/DifferentHeapSizes.java
    crash
    + S8210632: Add key exchange algorithm to
    javax/net/ssl/TLSCommon/CipherSuite.java
    + S8210699: Problem list tests which times out in Xcomp mode
    + S8210793: [JVMCI] AllocateCompileIdTest.java failed to find
    DiagnosticCommand.class
    + S8210910: Create test for FileChooserDemo
    + S8210994: Create test for SwingSet3 FrameDemo
    + S8211139: Increase timeout value in all tests under
    jdk/sanity/client/SwingSet/src
    + S8211160: Handle different look and feels in
    JInternalFrameOperator
    + S8211211: vmTestbase/metaspace/stressDictionary/
    /StressDictionary.java timeout
    + S8211322: Reduce the timeout of tooltip in SwingSet2DemoTest
    + S8211443: Enable different look and feels in SwingSet3 demo
    test SplitPaneDemoTest
    + S8211703: JInternalFrame : java.lang.AssertionError: cannot
    find the internal frame
    + S8211781: re-building fails after changing Graal sources
    + S8212897: Some improvements in the EditorPaneDemotest
    + S8212903: [TestBug] Tests test/jdk/javax/swing/LookAndFeel/
    /8145547/DemandGTK2.sh and DemandGTK3.sh fail on Ubuntu 18.04
    LTS
    + S8213009: Refactoring existing SunMSCAPI classes
    + S8213010: Supporting keys created with certmgr.exe
    + S8213168: Enable different look and feel tests in SwingSet3
    demo test FileChooserDemoTest
    + S8213348: jdk.internal.vm.compiler.management service
    providers missing in module descriptor
    + S8213906: Update arm devkits with libXrandr headers
    + S8213908: AssertionError in DeferredAttr at setOverloadKind
    + S8214124: [TESTBUG] Bugs in runtime/NMT/MallocStressTest.java
    + S8214344: C2: assert(con.basic_type() != T_ILLEGAL) failed:
    elembt=byte; loadbt=void; unsigned=0
    + S8214345: infinite recursion while checking super class
    + S8214471: Enable different look and feel tests in SwingSet3
    demo test ToolTipDemoTest
    + S8214534: Setting of THIS_FILE in the build is broken
    + S8214557: Filter out VM flags which don't affect AOT code
    generation
    + S8214578: [macos] Problem with backslashes on macOS/JIS
    keyboard: Java ignores system settings
    + S8214840: runtime/NMT/MallocStressTest.java timed out
    + S8214850: Rename vm_operations.?pp files to vmOperations.?pp
    files
    + S8214904: Test8004741.java failed due to "Too few ThreadDeath
    hits; expected at least 6 but saw only 5"
    + S8215322: add @file support to jaotc
    + S8215355: Object monitor deadlock with no threads holding the
    monitor (using jemalloc 5.1)
    + S8215396: JTabbedPane preferred size calculation is wrong for
    SCROLL_TAB_LAYOUT
    + S8216180: [AOT] compiler/intrinsics/bigInteger/TestMulAdd.java
    crashed with AOT enabled
    + S8216353: Use utility APIs introduced in org/netbeans/jemmy/
    /util/LookAndFeel class in client sanity test cases
    + S8216354: Syntax error in toolchain_windows.m4
    + S8216472: (se) Stack overflow during selection operation
    leads to crash (win)
    + S8216535: tools/jimage/JImageExtractTest.java timed out
    + S8217235: Create automated test for SwingSet
    ColorChooserDemoTest
    + S8217297: Add support for multiple look and feel for SwingSet
    SliderDemoTest
    + S8217338: [Containers] Improve systemd slice memory limit
    support
    + S8217613: [AOT] TEST_OPTS_AOT_MODULES doesn't work on mac
    + S8217634: RunTest documentation and usability update
    + S8217717: ZGC: Broken oop map in C1 load barrier stub
    + S8217728: Speed up incremental rerun of "make hotspot"
    + S8218268: Javac treats Manifest Class-Path entries as Paths
    instead of URLs
    + S8218662: Allow 204 responses with Content-Length:0
    + S8218882: NET_Writev is declared, NET_WriteV is defined
    + S8218889: Improperly use of the Optional API
    + S8219205: JFR file without license header
    + S8219597: (bf) Heap buffer state changes could provoke
    unexpected exceptions
    + S8219723: javax/net/ssl/compatibility/Compatibility.java
    failed on some SNI cases
    + S8220348: [ntintel] asserts about copying unaligned array
    + S8220451: jdi/EventQueue/remove/remove004 failed due to
    "ERROR: thread2 is not alive"
    + S8220456: jdi/EventQueue/remove_l/remove_l004 failed due to
    "TIMEOUT while waiting for event"
    + S8220479: java/nio/channels/Selector/SelectWithConsumer.java
    failed at testTwoChannels()
    + S8220613: java/util/Arrays/TimSortStackSize2.java times out
    with fastdebug build
    + S8220688: [TESTBUG] runtime/NMT/MallocStressTest.java timed
    out
    + S8220786: Create new switch to redirect error reporting
    output to stdout or stderr
    + S8221270: Duplicated synchronized keywords in SSLSocketImpl
    + S8221312: test/jdk/sanity/client/SwingSet/src/
    /ColorChooserDemoTest.java failed
    + S8221851: Use of THIS_FILE in hotspot invalidates precompiled
    header on Linux/GCC
    + S8221885: Add intermittent test in the JavaSound to the
    ProblemList
    + S8222264: Windows incremental build is broken with JDK-8217728
    + S8222391: javax/net/ssl/compatibility/Compatibility.java
    should be more flexible
    + S8222448: java/lang/reflect/PublicMethods/
    /PublicMethodsTest.java times out
    + S8222519: ButtonDemoScreenshotTest fails randomly with "still
    state to be reached"
    + S8222741: jdi/EventQueue/remove/remove004 fails due to
    VMDisconnectedException
    + S8223003: SunMSCAPI keys are not cleaned up
    + S8223063: Support CNG RSA keys
    + S8223158: Docked MacBook cannot start any Java Swing
    applications
    + S8223260: NamingManager should cache InitialContextFactory
    + S8223464: Improve version string for Oracle CI builds
    + S8223558: Java does not render Myanmar script correctly
    + S8223627: jdk-13+20 bundle name contains null instead of ea
    + S8223638: Replace wildcard address with loopback or local
    host in tests - part 6
    + S8223678: Add Visual Studio Code workspace generation support
    (for native code)
    + S8223727: com/sun/jndi/ldap/privconn/RunTest.java failed due
    to hang in LdapRequest.getReplyBer
    + S8223769: Assert triggers with -XX:+StressReflectiveCode
    + S8224187: Refactor arraycopy_prologue to allow ZGC read
    barriers on arraycopy
    + S8224475: JTextPane does not show images in HTML rendering
    + S8224673: Adjust permission for delayed starting of debugging
    + S8224705: Tests that need to be problem-listed or have
    printer resources
    + S8224778: test/jdk/demo/jfc/J2Ddemo/J2DdemoTest.java cannot
    find J2Ddemo.jar
    + S8224821: java/awt/Focus/NoAutotransferToDisabledCompTest/
    /NoAutotransferToDisabledCompTest.java fails linux-x64
    + S8224830: test/jdk/java/awt/Focus/
    /ModalExcludedWindowClickTest/
    /ModalExcludedWindowClickTest.java fails on linux-x64
    + S8224851: AArch64: fix warnings and errors with Clang and GCC
    8.3
    + S8224905: java/lang/ProcessBuilder/Basic.java#id1 failed with
    stream closed
    + S8225007: java/awt/print/PrinterJob/
    /LandscapeStackOverflow.java may hang
    + S8225105: java/awt/Focus/ShowFrameCheckForegroundTest/
    /ShowFrameCheckForegroundTest.java fails in Windows 10
    + S8225117: java/math/BigInteger/SymmetricRangeTests.java fails
    with ParseException
    + S8225128: Add exception for expiring DocuSign root to
    VerifyCACerts test
    + S8225130: Add exception for expiring Comodo roots to
    VerifyCACerts test
    + S8225144: [macos] In Aqua L&amp;F backspace key does not delete
    when Shift is pressed
    + S8225180: SignedObject with invalid Key not throwing the
    InvalidKeyException in Windows
    + S8225182: JNI exception pending in DestroyXIMCallback of
    awt_InputMethod.c:1327
    + S8225199: [Graal] compiler/jvmci/compilerToVM/
    /IsMatureVsReprofileTest.java fails with
  - XX:CompileThresholdScaling=0.1
    + S8225305: ProblemList java/lang/invoke/VarHandles tests
    + S8225350: compiler/jvmci/compilerToVM/IsCompilableTest.java
    timed out
    + S8225430: Replace wildcard address with loopback or local
    host in tests - part 14
    + S8225435: Upgrade IANA Language Subtag Registry to the latest
    for JDK14
    + S8225487: giflib legal file is missing attribution for
    openbsd-reallocarray.c
    + S8225567: Wrong file headers with 8202414 fix changeset
    + S8225684: [AOT] vmTestbase/vm/oom/production/
    /AlwaysOOMProduction tests fail with AOTed java.base
    + S8225766: Curve in certificate should not affect signature
    scheme when using TLSv1.3
    + S8225797: OldObjectSample event creates unexpected amount of
    checkpoint data
    + S8226381: ProblemList java/lang/reflect/PublicMethods/
    /PublicMethodsTest.java
    + S8226406: JVM fails to detect mismatched or corrupt CDS
    archive
    + S8226608: Hide the onjcmd option from the help output
    + S8226892: ActionListeners on JRadioButtons don't get notified
    when selection is changed with arrow keys
    + S8227112: exclude compiler/intrinsics/sha/sanity tests from
    AOT runs
    + S8227324: Upgrade to freetype 2.10.1
    + S8227528: TestAbortVMOnSafepointTimeout.java failed due to
    "RuntimeException: 'Safepoint sync time longer than' missing
    from stdout/stderr"
    + S8227645: Some tests in serviceability/sa run with fixed -Xmx
    values and risk running out of memory
    + S8227646: [TESTBUG] appcds/SharedArchiveConsistency timed out
    + S8227662: freetype seeks to index at the end of the font data
    + S8228479: Correct the format of ColorChooserDemoTest
    + S8228613: java.security.Provider#getServices order is no
    longer deterministic
    + S8228969: 2019-09-28 public suffix list update
    + S8229236: CriticalJNINatives: dll handling should be done in
    native thread state
    + S8229345: Memory leak due to vtable stubs not being shared on
    SPARC
    + S8229888: (zipfs) Updating an existing zip file does not
    preserve original permissions
    + S8229994: assert(false) failed: Bad graph detected in
    get_early_ctrl_for_expensive
    + S8230004: jdk/internal/jimage/JImageOpenTest.java runs no test
    + S8230235: Rendering HTML with empty img attribute and
    documentBaseKey cause Exception
    + S8230390: Problemlist SA tests with AOT
    + S8230400: Missing constant pool entry for a method in
    stacktrace
    + S8230459: Test failed to resume JVMCI CompilerThread
    + S8230480: check malloc/calloc results in java.desktop
    + S8230597: Update GIFlib library to the 5.2.1
    + S8230611: infinite loop in
    LogOutputList::wait_until_no_readers()
    + S8230624: [TESTBUG] Problemlist JFR
    compiler/TestCodeSweeper.java
    + S8230677: Should disable Escape Analysis if JVMTI capability
    can_get_owned_monitor_info was taken
    + S8230926: [macosx] Two apostrophes are entered instead of one
    with "U.S. International - PC" layout
    + S8231025: Incorrect method tag offset for big endian platform
    + S8231081: TestMetadataRetention fails due to missing symbol id
    + S8231387: java.security.Provider.getService returns random
    result due to race condition with mutating methods in the same
    class
    + S8231430: C2: Memory stomp in max_array_length() for
    T_ILLEGAL type
    + S8231445: check ZALLOC return values in awt coding
    + S8231507: Update Apache Santuario (XML Signature) to version
    2.1.4
    + S8231584: Deadlock with ClassLoader.findLibrary and
    System.loadLibrary call
    + S8231753: use more Posix functionality in aix
    os::print_os_info
    + S8231810: javax/net/ssl/templates/
    /SSLSocketSSLEngineTemplate.java fails intermittently with
    "java.lang.Exception: Unexpected EOF"
    + S8232003: (fs) Files.write can leak file descriptor in the
    exception case
    + S8232056: GetOwnedMonitorInfoWithEATest.java fails with ZGC:
    Heap too small
    + S8232060: add some initializations using sigemptyset in
    os_aix.cpp
    + S8232154: Update Mesa 3-D Headers to version 19.2.1
    + S8232167: Visual Studio install found through
  - -with-tools-dir value is discarded
    + S8232170: FSInfo#getJarClassPath throws an exception not
    declared in its throws clause
    + S8232200: [macos 10.15] Windows in fullscreen tests jumps
    around the screen
    + S8232207: Linux os::available_memory re-reads cgroup
    configuration on every invocation
    + S8232224: [TESTBUG] problemlist JFR TestLargeRootSet.java
    + S8232370: Refactor some com.sun.jdi tests to enable IDE
    integration
    + S8232433: [macos 10.15] java/awt/Window/
    /LocationAtScreenCorner/LocationAtScreenCorner.java may fail
    + S8232571: Add missing SIGINFO signal
    + S8232692: [TESTBUG] compiler/aot/fingerprint/
    /SelfChangedCDS.java fails when cds is disabled
    + S8232713: Update BCEL version to 6.3.1 in license file
    + S8232806: Introduce a system property to disable eager lambda
    initialization
    + S8232834: RunTest sometimes fails to produce valid
    exitcode.txt
    + S8232880: Update test documentation with additional settings
    for client UI tooltip tests
    + S8232950: SUNPKCS11 Provider incorrectly check key length for
    PSS Signatures.
    + S8233018: Add a new test to verify that DatagramSocket is not
    interruptible
    + S8233019: java.lang.Class.isPrimitive() (C1) returns wrong
    result if Klass* is aligned to 32bit
    + S8233032: assert(in_bb(n)) failed: must be
    + S8233078: fix minimal VM build on Linux ppc64(le)
    + S8233328: fix minimal VM build on Linux s390x
    + S8233383: Various minor fixes
    + S8233466: aarch64: remove unnecessary load of mdo when
    profiling return and parameters type
    + S8233491: Crash in AdapterHandlerLibrary::get_adapter with
    CDS due to code cache exhaustion
    + S8233529: loopTransform.cpp:2984: Error: assert(p_f-&gt;Opcode()
    == Op_IfFalse) failed
    + S8233548: Update CUP to v0.11b
    + S8233649: Update ProblemList.txt to exclude failing headful
    tests on macos
    + S8233656: assert(d-&gt;is_CFG() &amp;&amp; n-&gt;is_CFG()) failed: must
    have CFG nodes
    + S8233657: Intermittent NPE in Component.validate()
    + S8234288: Turkey Time Zone returns incorrect time zone name
    + S8234323: NULL-check return value of SurfaceData_InitOps on
    macosx
    + S8234339: replace JLI_StrTok in java_md_solinux.c
    + S8234340: Bump update version for OpenJDK: jdk-11.0.7
    + S8234350: assert(mode == ControlAroundStripMined &amp;&amp; (use ==
    sfpt || !use-&gt;is_reachable_from_root())) failed: missed a node
    + S8234386: [macos] NPE was thrown at expanding Choice from
    maximized frame
    + S8234397: add OS uptime information to os::print_os_info
    output
    + S8234423: Modifying ArrayList.subList().subList() resets
    modCount of subList
    + S8234466: Class loading deadlock involving
    X509Factory#commitEvent()
    + S8234501: remove obsolete NET_ReadV
    + S8234525: enable link-time section-gc for linux s390x to
    remove unused code
    + S8234610: MaxVectorSize set wrongly when UseAVX=3 is
    specified after JDK-8221092
    + S8234617: C1: Incorrect result of field load due to missing
    narrowing conversion
    + S8234723: javax/net/ssl/TLS tests support TLSv1.3
    + S8234724: javax/net/ssl/templates/
    /SSLSocketSSLEngineTemplate.java supports TLSv1.3
    + S8234741: enhance os::get_core_path on macOS
    + S8234769: Duplicate attribution in freetype.md
    + S8234786: Fix for JDK-8214578 breaks OS X 10.12 compatibility
    + S8234809: set relro in linker flags when building with gcc
    + S8234824: java/nio/channels/SocketChannel/AdaptSocket.java
    fails on Windows 10
    + S8235243: handle VS2017 15.9 and VS2019 in abstract_vm_version
    + S8235288: AVX 512 instructions inadvertently used on Xeon for
    small vector width operations
    + S8235325: build failure on Linux after 8235243
    + S8235383: C1 compilation fails with
  - XX:+PrintIRDuringConstruction -XX:+Verbose
    + S8235489: handle return values of sscanf calls in hotspot
    + S8235509: Backport for JDK-8209657 Refactor filemap.hpp to
    simplify integration with Serviceability Agent.
    + S8235510: java.util.zip.CRC32 performance drop after 8200067
    + S8235563: [TESTBUG] appcds/CommandLineFlagComboNegative.java
    does not handle archive mapping failure
    + S8235637: jhsdb jmap from OpenJDK 11.0.5 doesn't work if
    prelink is enabled
    + S8235671: enhance print_rlimit_info in os_posix
    + S8235744: PIT: test/jdk/javax/swing/text/html/
    /TestJLabelWithHTMLText.java times out in linux-x64
    + S8235904: Infinite loop when rendering huge lines
    + S8235998: [c2] Memory leaks during tracing after '8224193:
    stringStream should not use Resource Area'.
    + S8236039: JSSE Client does not accept status_request
    extension in CertificateRequest messages for TLS 1.3
    + S8236140: assert(!VerifyHashTableKeys || _hash_lock == 0)
    failed: remove node from hash table before modifying it
    + S8236179: C1 register allocation error with T_ADDRESS
    + S8236488: Support for configure option
  - -with-native-debug-symbols=internal is impossible on Windows
    + S8236500: Windows ucrt.dll should be looked up in versioned
    WINSDK subdirectory
    + S8236709: struct SwitchRange in HS violates C++ One
    Definition Rule
    + S8236848: [JDK 11u] make run-test-tier1 fails after backport
    of JDK-8232834
    + S8236873: Worker has a deadlock bug
    + S8237217: Incorrect G1StringDedupEntry type used in
    StringDedupTable destructor
    + S8237368: Problem with NullPointerException in RMI
    TCPEndpoint.read
    + S8237375: SimpleThresholdPolicy misses CounterDecay timestamp
    initialization
    + S8237508: Simplify JarFile.isInitializing
    + S8237540: Missing files in backport of JDK-8210910
    + S8237541: Missing files in backport of JDK-8236528
    + S8237600: Test SunJSSEFIPSInit fails on Ubuntu
    + S8237819: s390x - remove unused pd_zero_to_words_large
    + S8237869: exclude jtreg test security/infra/java/security/
    /cert/CertPathValidator/certification/LuxTrustCA.java because
    of instabilities
    + S8237879: make 4.3 breaks build
    + S8237945: CTW: C2 compilation fails with
    assert(just_allocated_object(alloc_ctl) == ptr) failed: most
    recent allo...
    + S8238225: Issues reported after replacing symlink at
    Contents/MacOS/libjli.dylib with binary
    + S8238247: CTW runner should sweep nmethods more aggressively
    + S8238366: CTW runner closes standard output on exit
    + S8238438: SuperWord::co_locate_pack picks memory state of
    first instead of last load
    + S8238502: sunmscapi.dll causing EXCEPTION_ACCESS_VIOLATION
    + S8238534: Deep sign macOS bundles before bundle archive is
    being created
    + S8238591: CTW: Split
    applications/ctw/modules/jdk_localedata.java
    + S8238596: AVX enabled by default for Skylake even when
    unsupported
    + S8238811: C2: assert(i &gt;= req() || i == 0 || is_Region() ||
    is_Phi()) with -XX:+VerifyGraphEdges
    + S8239005: [TESTBUG] test/hotspot/jtreg/runtime/
    /StackGuardPages/TestStackGuardPages.java: exeinvoke.c: must
    initialize static state before calling do_overflow()
    + S8239466: Loss of precision in counter decay calculation in
    11u backport of JDK-8237375
    + S8239856: [ntintel] asserts about copying unaligned array
    element
    + S8240724: [test] jdk11 downport of 8224475 misses binary file
    test/jdk/javax/swing/JTextPane/arrow.png
    + S8241296: Segfault in JNIHandleBlock::oops_do()
- Removed patch:
  * DependOnVariableHelper.patch
    + fixed upstream
- Added patch:
  * JDK-8228407.patch
    + fix crashes due to shared archive file mismatch</changelog>
  <changelog author="fstrba@suse.com" date="1594900800">- Update to upstream tag jdk-11.0.8+10 (July 2020 CPU, bsc#1174157)
  * Security fixes:
    + JDK-8230613: Better ASCII conversions
    + JDK-8231800: Better listing of arrays
    + JDK-8232014: Expand DTD support
    + JDK-8233234: Better Zip Naming
    + JDK-8233239, CVE-2020-14562: Enhance TIFF support
    + JDK-8233255: Better Swing Buttons
    + JDK-8234032: Improve basic calendar services
    + JDK-8234042: Better factory production of certificates
    + JDK-8234418: Better parsing with CertificateFactory
    + JDK-8234836: Improve serialization handling
    + JDK-8236191: Enhance OID processing
    + JDK-8236867, CVE-2020-14573: Enhance Graal interface handling
    + JDK-8237117, CVE-2020-14556: Better ForkJoinPool behavior
    + JDK-8237592, CVE-2020-14577: Enhance certificate verification
    + JDK-8238002, CVE-2020-14581: Better matrix operations
    + JDK-8238013: Enhance String writing
    + JDK-8238804: Enhance key handling process
    + JDK-8238842: AIOOBE in GIFImageReader.initializeStringTable
    + JDK-8238843: Enhanced font handing
    + JDK-8238920, CVE-2020-14583: Better Buffer support
    + JDK-8238925: Enhance WAV file playback
    + JDK-8240119, CVE-2020-14593: Less Affine Transformations
    + JDK-8240482: Improved WAV file playback
    + JDK-8241379: Update JCEKS support
    + JDK-8241522: Manifest improved jar headers redux
    + JDK-8242136, CVE-2020-14621: Better XML namespace handling
  * Other changes:
    + JDK-6933331: (d3d/ogl) java.lang.IllegalStateException:
    Buffers have not been created
    + JDK-7124307: JSpinner and changing value by mouse
    + JDK-8022574: remove HaltNode code after uncommon trap calls
    + JDK-8039082: [TEST_BUG] Test
    java/awt/dnd/BadSerializationTest/BadSerializationTest.java
    fails
    + JDK-8040630: Popup menus and tooltips flicker with previous
    popup contents when first shown
    + JDK-8044365: (dc) MulticastSendReceiveTests.java failing with
    ENOMEM when joining group (OS X 10.9)
    + JDK-8048215: [TESTBUG]
    java/lang/management/ManagementFactory/ThreadMXBeanProxy.java
    Expected non-null LockInfo
    + JDK-8051349: nsk/jvmti/scenarios/sampling/SP06/sp06t003 fails
    in nightly
    + JDK-8080353: JShell: Better error message on attempting to
    add default method
    + JDK-8139876: Exclude hanging nsk/stress/stack from execution
    with deoptimization enabled
    + JDK-8146090: java/lang/ref/ReachabilityFenceTest.java fails
    with -XX:+DeoptimizeALot
    + JDK-8153430: jdk regression test MletParserLocaleTest,
    ParserInfiniteLoopTest reduce default timeout
    + JDK-8156207: Resource allocated BitMaps are often cleared
    unnecessarily
    + JDK-8159740: JShell: corralled declarations do not have
    correct source to wrapper mapping
    + JDK-8175984: ICC_Profile has un-needed, not-empty finalize
    method
    + JDK-8176359: Frame#setMaximizedbounds not working properly in
    multi screen environments
    + JDK-8183369: RFC unconformity of HttpURLConnection with proxy
    + JDK-8187078: -XX:+VerifyOops finds numerous problems when
    running JPRT
    + JDK-8189861: Refactor CacheFind
    + JDK-8191169: java/net/Authenticator/B4769350.java failed
    intermittently
    + JDK-8191930: [Graal] emits unparseable XML into compile log
    + JDK-8193879: Java debugger hangs on method invocation
    + JDK-8196019: java/awt/Window/Grab/GrabTest.java fails on
    Windows
    + JDK-8196181: sun/java2d/GdiRendering/InsetClipping.java fails
    + JDK-8198000:
    java/awt/List/EmptyListEventTest/EmptyListEventTest.java
    debug assert on Windows
    + JDK-8198001: java/awt/Menu/WrongParentAfterRemoveMenu/
    /WrongParentAfterRemoveMenu.java debug assert on Windows
    + JDK-8198339: Test javax/swing/border/Test6981576.java is
    unstable
    + JDK-8200701: jdk/jshell/ExceptionsTest.java fails on Windows,
    after JDK-8198801
    + JDK-8203264: JNI exception pending in
    PlainDatagramSocketImpl.c:740
    + JDK-8203672: JNI exception pending in PlainSocketImpl.c
    + JDK-8203673: JNI exception pending in
    DualStackPlainDatagramSocketImpl.c:398
    + JDK-8204834: Fix confusing "allocate" naming in OopStorage
    + JDK-8205399: Set node color on pinned HashMap.TreeNode
    deletion
    + JDK-8205653: test/jdk/sun/management/jmxremote/bootstrap/
    /RmiRegistrySslTest.java and RmiSslBootstrapTest.sh fail with
    handshake_failure
    + JDK-8206179: com/sun/management/OperatingSystemMXBean/
    /GetCommittedVirtualMemorySize.java fails with Committed
    virtual memory size illegal value
    + JDK-8207334: VM times out in VM_HandshakeAllThreads::doit()
    with RunThese30M
    + JDK-8208277: Code cache heap (-XX:ReservedCodeCacheSize)
    doesn't work with 1GB LargePages
    + JDK-8209113: Use WeakReference for lastFontStrike for created
    Fonts
    + JDK-8209333: Socket reset issue for TLS 1.3 socket close
    + JDK-8209439: C2 library_call can potentially ignore Math.pow
    intrinsic or use null pointer
    + JDK-8209534: [TESTBUG]runtime/appcds/cacheObject/
    /ArchivedModuleCompareTest.java fails with EnableJVMCI.
    + JDK-8210147: adjust some WSAGetLastError usages in windows
    network coding
    + JDK-8210284: "assert((av &amp; 0x00000001) == 0) failed:
    unsupported V8" on Solaris 11.4
    + JDK-8210303: VM_HandshakeAllThreads fails assert with
    "failed: blocked and not walkable"
    + JDK-8210459: Add support for generating compile_commands.json
    + JDK-8210515: [TESTBUG]CheckArchivedModuleApp.java needs to
    check if EnableJVMCI is set.
    + JDK-8210788: Javadoc for Thread.join(long, int) should
    specify that it waits forever when both arguments are zero
    + JDK-8211301: [macos] support full window content options
    + JDK-8211332: Space for stub routines (code_size2) is too
    small on new Skylake CPUs
    + JDK-8211339: NPE during SSL handshake caused by
    HostnameChecker
    + JDK-8211392: compiler/profiling/
    /spectrapredefineclass_classloaders/Launcher.java times out
    in JDK12 CI
    + JDK-8211743: [AOT] crash in ScopeDesc::decode_body() when
    JVMTI walks AOT frames
    + JDK-8212154: [TESTBUG] CheckArchivedModuleApp fails with NPE
    when JVMCI is absent
    + JDK-8212167: JShell : Stack trace of exception has wrong line
    number
    + JDK-8212933: Thread-SMR: requesting a VM operation whilst
    holding a ThreadsListHandle can cause deadlocks
    + JDK-8212986: Make Visual Studio compiler check less strict
    + JDK-8213250: CDS archive creation aborts due to metaspace
    object allocation failure
    + JDK-8213516: jck test api/javax_accessibility/AccessibleState/
    /fields.html fails intermittent
    + JDK-8213947: ARM32: failed check_simd should set
    UsePopCountInstruction to false
    + JDK-8214418: half-closed SSLEngine status may cause
    application dead loop
    + JDK-8214440: ldap over a TLS connection negotiate failed with
    "javax.net.ssl.SSLPeerUnverifiedException: hostname of the
    server does not match the hostname in the server's
    certificate"
    + JDK-8214444: Wrong strncat limits in dfa.cpp
    + JDK-8214481: freetype path does not disable TrueType hinting
    with AA+FM hints
    + JDK-8214571: -Xdoclint of array serialField gives "error:
    array type not allowed here"
    + JDK-8214856: Errors with JSZip in web console after upgrade
    to 3.1.5
    + JDK-8214862: assert(proj != __null) at compile.cpp:3251
    + JDK-8215369: Jcstress pollute /var/tmp with temporary files.
    + JDK-8215551: Missing case label in nmethod::reloc_string_for()
    + JDK-8215555: TieredCompilation C2 threads can excessively
    block handshakes
    + JDK-8215711: Missing key_share extension for (EC)DHE key
    exchange should alert missing_extension
    + JDK-8216151: [Graal] Module
    jdk.internal.vm.compiler.management has not been granted
    accessClassInPackage.org.graalvm.compiler.debug
    + JDK-8216154: C4819 warnings at HotSpot sources on Windows
    + JDK-8216541: CompiledICHolders of VM locked unloaded nmethods
    are released too late
    + JDK-8217230: assert(t == t_no_spec) failure in
    NodeHash::check_no_speculative_types()
    + JDK-8217404: --with-jvm-features doesn't work when multiple
    features are explicitly disabled
    + JDK-8217447: Develop flag TraceICs is broken
    + JDK-8217606: LdapContext#reconnect always opens a new
    connection
    + JDK-8218807: Compilation database (compile_commands.json) may
    contain obsolete items
    + JDK-8219214: Infinite Loop in CodeSection::dump()
    + JDK-8219904: ClassCastException when calling
    FlightRecorderMXBean#getRecordings()
    + JDK-8219991: New fix of the deadlock in
    sun.security.ssl.SSLSocketImpl
    + JDK-8221121: applications/microbenchmarks are encountering
    crashes in tier5
    + JDK-8221445: FastSysexMessage constructor crashes MIDI
    receiption thread
    + JDK-8221482: Initialize VMRegImpl::regName[] earlier to
    prevent assert during PrintStubCode
    + JDK-8221741: ClassCastException can happen when
    fontconfig.properties is used
    + JDK-8221823: Requested JDialog width is ignored
    + JDK-8223108: Test java/awt/EventQueue/
    /NonComponentSourcePost.java is unstable
    + JDK-8223678: Add Visual Studio Code workspace generation
    support (for native code)
    + JDK-8223935: PIT: java/awt/font/WindowsIndicFonts.java fails
    on windows10
    + JDK-8224109: Text spaced incorrectly by drawString under
    rotation with fractional metric
    + JDK-8224632: testbug: java/awt/dnd/RemoveDropTargetCrashTest/
    /RemoveDropTargetCrashTest.java fails on MacOS
    + JDK-8224793: os::die() does not honor CreateCoredumpOnCrash
    option
    + JDK-8224847: gc/stress/TestReclaimStringsLeaksMemory.java
    fails with reserved greater than expected
    + JDK-8224931: disable JAOTC invokedynamic support until
    8223533 is fixed
    + JDK-8224997: ChaCha20-Poly1305 TLS cipher suite decryption
    throws ShortBufferException
    + JDK-8225068: Remove DocuSign root certificate that is
    expiring in May 2020
    + JDK-8225069: Remove Comodo root certificate that is expiring
    in May 2020
    + JDK-8225126: Test SetBoundsPaintTest.html faild on Windows
    when desktop is scaled
    + JDK-8225325: Add tests for redefining a class' private method
    during resolution of the bootstrap specifier
    + JDK-8225622: [AOT] runtime/SharedArchiveFile/
    /TestInterpreterMethodEntries.java crashed with AOTed
    java.base
    + JDK-8225653: Provide more information when hitting SIGILL
    from HaltNode
    + JDK-8225783: Incorrect use of binary operators on booleans in
    type.cpp
    + JDK-8225789: Empty method parameter type should generate
    ClassFormatError
    + JDK-8226198: use of &amp; instead of &amp;&amp; in
    LibraryCallKit::arraycopy_restore_alloc_state
    + JDK-8226253: JAWS reports wrong number of radio buttons when
    buttons are hidden.
    + JDK-8226653: [accessibility] Can edit text cell correctly,
    but Accessibility Tool reads nothing about editor
    + JDK-8226806: [macOS 10.14] Methods of Java Robot should be
    called from appropriate thread
    + JDK-8226879: Memory leak in Type::hashcons
    + JDK-8227632: Incorrect PrintCompilation message: made not
    compilable on levels 0 1 2 3 4
    + JDK-8228407: JVM crashes with shared archive file mismatch
    + JDK-8228482: fix xlc16/xlclang comparison of distinct pointer
    types and string literal conversion warnings
    + JDK-8228757: Fail fast if the handshake type is unknown
    + JDK-8229158: make UseSwitchProfiling non-experimental or
    false by-default
    + JDK-8229421: The logic of java/net/ipv6tests/TcpTest.java is
    flawed
    + JDK-8229855: C2 fails with assert(false) failed: bad AD file
    + JDK-8230591: AArch64: Missing intrinsics for Math.ceil,
    floor, rint
    + JDK-8231118: ARM32: Math tests failures
    + JDK-8231213: Migrate SimpleDateFormatConstTest to JDK Repo
    + JDK-8231243: [TESTBUG] CustomFont.java cannot find font file
    + JDK-8231438: [macOS] Dark mode for the desktop is not
    supported
    + JDK-8231550: C2: ShouldNotReachHere() in
    verify_strip_mined_scheduling
    + JDK-8231564: setMaximizedBounds is broken with large display
    scale and multiple monitors
    + JDK-8231572: Use -lobjc instead of -fobjc-link-runtime in
    libosxsecurity
    + JDK-8231631: sun/net/ftp/FtpURLConnectionLeak.java fails
    intermittently with NPE
    + JDK-8231671: Fix copyright headers in hotspot (missing comma
    after year)
    + JDK-8231720: Some perf regressions after 8225653
    + JDK-8231779: crash
    HeapWord*ParallelScavengeHeap::failed_mem_allocate
    + JDK-8231863: Crash if classpath is read from @argument file
    and the main gets option argument
    + JDK-8232080: jlink plugins for vendor information and
    run-time options
    + JDK-8232106: [x86] C2: SIGILL due to usage of SSSE3
    instructions on processors which don't support it
    + JDK-8232134: Change to Visual Studio 2017 15.9.16 for
    building on Windows at Oracle
    + JDK-8232226: [macos 10.15] test/jdk/java/awt/color/
    /EqualityTest/EqualityTest.java may fail
    + JDK-8232357: Compare version info of Santuario to legal notice
    + JDK-8232572: Add hooks for custom output dir in Bundles.gmk
    + JDK-8232634: Problem List ICMColorDataTest.java
    + JDK-8232748: Build static versions of certain JDK libraries
    + JDK-8232846: ProcessHandle.Info command with non-English
    shows question marks
    + JDK-8232880: Update test documentation with additional
    settings for client UI tooltip tests
    + JDK-8233033: C2 produces wrong result while unswitching a
    loop due to lost control dependencies
    + JDK-8233137: runtime/ErrorHandling/VeryEarlyAssertTest.java
    fails after 8232080
    + JDK-8233197: Invert JvmtiExport::post_vm_initialized() and
    Jfr:on_vm_start() start-up order for correct option parsing
    + JDK-8233291: [TESTBUG] tools/jlink/plugins/
    /VendorInfoPluginsTest.java fails with debug or non-server VMs
    + JDK-8233364: Fix undefined behavior in
    Canonicalizer::do_ShiftOp
    + JDK-8233494: Avoid calling MallocTracker::record_malloc and
    record_free when NMT is off
    + JDK-8233573: Toolkit.getScreenInsets(GraphicsConfiguration)
    may throw ClassCastException
    + JDK-8233608: Minimal build broken after JDK-8233494
    + JDK-8233621: Mismatch in jsse.enableMFLNExtension property
    name
    + JDK-8233696: [TESTBUG]Some jtreg tests fail when CAPS_LOCK is
    ON
    + JDK-8233707: systemScale.cpp could not compile with VS2019
    + JDK-8233801: GCMEmptyIv.java test fails on Solaris 11.4
    + JDK-8233880: Support compilers with multi-digit major version
    numbers
    + JDK-8233920: MethodHandles::tryFinally generates illegal
    bytecode for long/double return type
    + JDK-8234137: The "AutoTestOnTop.java" test may run external
    applications
    + JDK-8234146: compiler/jsr292/
    /ContinuousCallSiteTargetChange.java times out on SPARC
    + JDK-8234184: [TESTBUG] java/awt/Mouse/EnterExitEvents/
    /ModalDialogEnterExitEventsTest.java fails in Windows
    + JDK-8234270: [REDO] JDK-8204128 NMT might report incorrect
    numbers for Compiler area
    + JDK-8234332: [TESTBUG] java/awt/Focus/DisposedWindow/
    /DisposeDialogNotActivateOwnerTest/
    /DisposeDialogNotActivateOwnerTest.java fails on linux-x64
    nightly
    + JDK-8234398: Replace ID2D1Factory::GetDesktopDpi with
    GetDeviceCaps
    + JDK-8234522: [macos] Crash with use of native file dialog
    + JDK-8234691: Potential double-free in ParallelSPCleanupTask
    constructor
    + JDK-8234696: tools/jlink/plugins/VendorInfoPluginsTest.java
    times out
    + JDK-8234727: sun/security/ssl/X509TrustManagerImpl tests
    support TLSv1.3
    + JDK-8234728: Some security tests should support TLSv1.3
    + JDK-8234779: Provide idiom for declaring classes noncopyable
    + JDK-8234824: java/nio/channels/SocketChannel/AdaptSocket.java
    fails on Windows 10
    + JDK-8234968: check calloc rv in libinstrument
    InvocationAdapter
    + JDK-8235153: [TESTBUG] [macos 10.15] java/awt/Graphics/
    /DrawImageBG/SystemBgColorTest.java fails
    + JDK-8235183: Remove the "HACK CODE" in comment
    + JDK-8235263: Revert TLS 1.3 change that wrapped IOExceptions
    + JDK-8235311: Tag mismatch may alert bad_record_mac
    + JDK-8235332: TestInstanceCloneAsLoadsStores.java fails with
  - XX:+StressGCM
    + JDK-8235452: Strip mined loop verification fails with
    assert(is_OuterStripMinedLoop()) failed: invalid node class
    + JDK-8235584: UseProfiledLoopPredicate fails with
    assert(_phase-&gt;get_loop(c) == loop) failed: have to be in the
    same loop
    + JDK-8235620: Broken merge between JDK-8006406 and JDK-8003559
    + JDK-8235638: NPE in LWWindowPeer.getOnscreenGraphics()
    + JDK-8235686: Add more custom hooks in Bundles.gmk
    + JDK-8235739: Rare NPE at WComponentPeer.getGraphics()
    + JDK-8235762: JVM crash in SWPointer during C2 compilation
    + JDK-8235834: IBM-943 charset encoder needs updating
    + JDK-8235874: The ordering of Cipher Suites is not maintained
    provided through jdk.tls.client.cipherSuites and
    jdk.tls.server.cipherSuites system property.
    + JDK-8235908: omit ThreadPriorityPolicy warning when value is
    set from image
    + JDK-8235984: C2: assert(out-&gt;in(PhiNode::Region) == head ||
    out-&gt;in(PhiNode::Region) == slow_head) failed: phi must be
    either part of the slow or the fast loop
    + JDK-8236211: [Graal] compiler/graalunit/GraphTest.java is
    skipped in all testing
    + JDK-8236470: Deal with ECDSA using ecdsa-with-SHA2 plus hash
    algorithm as AlgorithmId
    + JDK-8236545: Compilation error in mach5
    java/awt/FileDialog/MacOSGoToFolderCrash.java
    + JDK-8236700: Upgrading JSZip from v3.1.5 to v3.2.2
    + JDK-8236759: ShouldNotReachHere in
    PhaseIdealLoop::verify_strip_mined_scheduling
    + JDK-8236897: Fix the copyright header for pkcs11gcm2.h
    + JDK-8236921: Add build target to produce a JDK image suitable
    for a Graal/SVM build
    + JDK-8236953: [macos] JavaFX SwingNode is not rendered on macOS
    + JDK-8236996: Incorrect Roboto font rendering on Windows with
    subpixel antialiasing
    + JDK-8237045: JVM uses excessive memory with -XX:+EnableJVMCI
  - XX:JVMCICounterSize=2147483648
    + JDK-8237055: [TESTBUG] compiler/c2/TestJumpTable.java fails
    with release VMs
    + JDK-8237086: assert(is_MachReturn()) running CTW with fix for
    JDK-8231291
    + JDK-8237192: Generate stripped/public pdbs on Windows for jdk
    images
    + JDK-8237396: JvmtiTagMap::weak_oops_do() should not trigger
    barriers
    + JDK-8237474: Default SSLEngine should create in server role
    + JDK-8237859: C2: Crash when loads float above range check
    + JDK-8237879: make 4.3 breaks build
    + JDK-8237951: CTW: C2 compilation fails with "malformed
    control flow"
    + JDK-8237962: give better error output for invalid OCSP
    response intervals in CertPathValidator checks
    + JDK-8238190: [JVMCI] Fix single implementor speculation for
    diamond shapes.
    + JDK-8238356: CodeHeap::blob_count() overestimates the number
    of blobs
    + JDK-8238452: Keytool generates wrong expiration date if
    validity is set to 2050/01/01
    + JDK-8238555: Allow Initialization of SunPKCS11 with NSS when
    there are external FIPS modules in the NSSDB
    + JDK-8238575: DragSourceEvent.getLocation() returns wrong
    value on HiDPI screens (Windows)
    + JDK-8238676: jni crashes on accessing it from process exit
    hook
    + JDK-8238721: Add failing client jtreg tests to the Problem
    List
    + JDK-8238738: AudioSystem.getMixerInfo() takes about 30 sec to
    report a gone audio device
    + JDK-8238756: C2: assert(((n) == __null || !VerifyIterativeGVN
    || !((n)-&gt;is_dead()))) failed: can not use dead node
    + JDK-8238765: PhaseCFG::schedule_pinned_nodes cannot handle
    precedence edges from unmatched CFG nodes correctly
    + JDK-8238898: Missing hash characters for header on license
    file
    + JDK-8238942: Rendering artifacts with LCD text and fractional
    metrics
    + JDK-8238985: [TESTBUG] The arrow image is blue instead of
    green
    + JDK-8239000: handle ContendedPaddingWidth in vm_version_ppc
    + JDK-8239055: Wrong implementation of VMState.hasListener
    + JDK-8239091: Reversed arguments in call to strstr in freetype
    "debug" code.
    + JDK-8239142: C2's UseUniqueSubclasses optimization is broken
    for array accesses
    + JDK-8239224: libproc_impl.c previous_thr may be used
    uninitialized warning
    + JDK-8239351: Give more meaningful InternalError messages in
    Deflater.c
    + JDK-8239365: ProcessBuilder test modifications for AIX
    execution
    + JDK-8239456: vtable stub generation: assert failure (code
    size estimate)
    + JDK-8239457: call ReleaseStringUTFChars before early returns
    in Java_sun_security_pkcs11_wrapper_PKCS11_connect
    + JDK-8239462: jdk.hotspot.agent misses some
    ReleaseStringUTFChars calls in case of early returns
    + JDK-8239557: [TESTBUG] VeryEarlyAssertTest.java validating
    "END." marker at lastline is not always true
    + JDK-8239787: AArch64: String.indexOf may incorrectly handle
    empty strings
    + JDK-8239792: Bump update version for OpenJDK: jdk-11.0.8
    + JDK-8239798: SSLSocket closes socket both socket endpoints on
    a SocketTimeoutException
    + JDK-8239819: XToolkit: Misread of screen information memory
    + JDK-8239852: java/util/concurrent tests fail with
  - XX:+VerifyGraphEdges: assert(!VerifyGraphEdges) failed:
    verification should have failed
    + JDK-8239893: Windows handle Leak when starting processes
    using ProcessBuilder
    + JDK-8239915: Zero VM crashes when handling dynamic constant
    + JDK-8239931: [win][x86] vtable stub generation: assert
    failure (code size estimate) follow-up
    + JDK-8239965: XMLEncoder/Test4625418.java fails due to "Error:
    Cp943 - can't read properly"
    + JDK-8239976: Put JDK-8239965 on the ProblemList.txt
    + JDK-8240073: Fix 'test-make' build target in 11u
    + JDK-8240197: Cannot start JVM when $JAVA_HOME includes CJK
    characters
    + JDK-8240202: A few client tests leave mouse buttons pressed
    + JDK-8240220: IdealLoopTree::dump_head predicate printing is
    broken
    + JDK-8240223: Use consistent predicate order in and with
    PhaseIdealLoop::find_predicate
    + JDK-8240227: Loop predicates should be copied to unswitched
    loops
    + JDK-8240286: [TESTBUG] Test command error in hotspot/jtreg/
    /compiler/loopopts/superword/SumRedAbsNeg_Float.java
    + JDK-8240518: Incorrect JNU_ReleaseStringPlatformChars in
    Windows Print
    + JDK-8240529: CheckUnhandledOops breaks NULL check in
    Modules::define_module
    + JDK-8240576: JVM crashes after transformation in C2
    IdealLoopTree::merge_many_backedges
    + JDK-8240603: Windows 32bit compile error after 8238676
    + JDK-8240629: argfiles parsing broken for argfiles with
    comment cross 4096 bytes chunk
    + JDK-8240711: TestJstatdPort.java failed due to
    "ExportException: Port already in use:"
    + JDK-8240786: [TESTBUG] The test java/awt/Window/
    /GetScreenLocation/GetScreenLocationTest.java fails on HiDPI
    screen
    + JDK-8240824: enhance print_full_memory_info on Linux by THP
    related information
    + JDK-8240827: Downport SSLSocketImpl.java from "8221882: Use
    fiber-friendly java.util.concurrent.locks in JSSE"
    + JDK-8240905: assert(mem == (Node*)1 || mem == mem2) failed:
    multiple Memories being matched at once?
    + JDK-8240972: macOS codesign fail on macOS 10.13.5 or older
    + JDK-8241445: Fix copyright in
    test/jdk/tools/launcher/ArgFileSyntax.java
    + JDK-8241458: [JVMCI] add mark value to expose
    CodeOffsets::Frame_Complete
    + JDK-8241464: [11u] Backport: make rehashing be a needed
    guaranteed safepoint cleanup action
    + JDK-8241556: Memory leak if -XX:CompileCommand is set
    + JDK-8241568: (fs) UserPrincipalLookupService.lookupXXX
    failure with IOE "Operation not permitted"
    + JDK-8241586: compiler/cpuflags/
    /TestAESIntrinsicsOnUnsupportedConfig.java fails on aarch64
    + JDK-8241638: launcher time metrics always report 1 on Linux
    when _JAVA_LAUNCHER_DEBUG set
    + JDK-8241660: Add virtualization information output to hs_err
    file on macOS
    + JDK-8241808: [TESTBUG] The JDK-8039467 bug appeared on macOS
    + JDK-8241888: Mirror jdk.security.allowNonCaAnchor system
    property with a security one
    + JDK-8241900: Loop unswitching may cause dependence on null
    check to be lost
    + JDK-8241948: enhance list of environment variables printed in
    hs_err file
    + JDK-8241996: on linux set full relro in the linker flags
    + JDK-8242108: Performance regression after fix for JDK-8229496
    + JDK-8242141: New System Properties to configure the TLS
    signature schemes
    + JDK-8242154: Backport parts of JDK-4947890 to OpenJDK 11u
    + JDK-8242174: [macos] The NestedModelessDialogTest test make
    the macOS unstable
    + JDK-8242239: [Graal] javax/management/generified/
    /GenericTest.java fails: FAILED: queryMBeans sets same
    + JDK-8242294: JSSE Client does not throw SSLException when an
    alert occurs during handshaking
    + JDK-8242379: [TESTBUG] compiler/loopopts/
    /TestLoopUnswitchingLostCastDependency.java fails with
    release VMs
    + JDK-8242470: Update Xerces to Version 2.12.1
    + JDK-8242498: Invalid "sun.awt.TimedWindowEvent" object leads
    to JVM crash
    + JDK-8242541: Small charset issues (ISO8859-16, x-eucJP-Open,
    x-IBM834 and x-IBM949C)
    + JDK-8242626: enhance posix print_rlimit_info
    + JDK-8243059: Build fails when --with-vendor-name contains a
    comma
    + JDK-8243539: Copyright info (Year) should be updated for fix
    of 8241638
    + JDK-8243541: (tz) Upgrade time-zone data to tzdata2020a
    + JDK-8244407: JVM crashes after transformation in C2
    IdealLoopTree::split_fall_in
    + JDK-8244520: problemlist
    java/awt/font/Rotate/RotatedFontTest.java on linux
    + JDK-8244777: ClassLoaderStats VM Op uses constant hash value
    + JDK-8244853: The static build of libextnet is missing the
    JNI_OnLoad_extnet function
    + JDK-8244951: Missing entitlements for hardened runtime
    + JDK-8245047: [PPC64] C2: ReverseBytes + Load always match to
    unordered Load (acquire semantics missing)
    + JDK-8245649: Revert 8245397 backport of 8230591
    + JDK-8246031: SSLSocket.getSession() doesn't close connection
    for timeout/ interrupts
    + JDK-8246613: Choose the default SecureRandom algo based on
    registration ordering
    + JDK-8248505: Unexpected NoSuchAlgorithmException when using
    secure random impl from BCFIPS provider
- Removed patch:
  * JDK-8228407.patch
    + integrated upstream</changelog>
  <changelog author="fstrba@suse.com" date="1604318400">- Update to upstream tag jdk-11.0.9-11 (October 2020 CPU,
  bsc#1177943)
  * New features
    + JDK-8250784: Shenandoah: A Low-Pause-Time Garbage Collector
  * Security fixes
    + JDK-8233624: Enhance JNI linkage
    + JDK-8236196: Improve string pooling
    + JDK-8236862, CVE-2020-14779: Enhance support of Proxy class
    + JDK-8237990, CVE-2020-14781: Enhanced LDAP contexts
    + JDK-8237995, CVE-2020-14782: Enhance certificate processing
    + JDK-8240124: Better VM Interning
    + JDK-8241114, CVE-2020-14792: Better range handling
    + JDK-8242680, CVE-2020-14796: Improved URI Support
    + JDK-8242685, CVE-2020-14797: Better Path Validation
    + JDK-8242695, CVE-2020-14798: Enhanced buffer support
    + JDK-8243302: Advanced class supports
    + JDK-8244136, CVE-2020-14803: Improved Buffer supports
    + JDK-8244479: Further constrain certificates
    + JDK-8244955: Additional Fix for JDK-8240124
    + JDK-8245407: Enhance zoning of times
    + JDK-8245412: Better class definitions
    + JDK-8245417: Improve certificate chain handling
    + JDK-8248574: Improve jpeg processing
    + JDK-8249927: Specify limits of jdk.serialProxyInterfaceLimit
    + JDK-8253019: Enhanced JPEG decoding
  * Other changes
    + JDK-6532025: GIF reader throws misleading exception with
    truncated images
    + JDK-6949753: [TEST BUG]: java/awt/print/PageFormat/
    /PDialogTest.java needs update by removing an infinite loop
    + JDK-8022535: [TEST BUG] javax/swing/text/html/parser/
    /Test8017492.java fails
    + JDK-8062947: Fix exception message to correctly represent
    LDAP connection failure
    + JDK-8067354: com/sun/jdi/GetLocalVariables4Test.sh failed
    + JDK-8134599: TEST_BUG: java/rmi/transport/closeServerSocket/
    /CloseServerSocket.java fails intermittently with Address
    already in use
    + JDK-8151678: com/sun/jndi/ldap/LdapTimeoutTest.java failed
    due to timeout on DeadServerNoTimeoutTest is incorrect
    + JDK-8160768: Add capability to custom resolve host/domain
    names within the default JNDI LDAP provider
    + JDK-8172404: Tools should warn if weak algorithms are used
    before restricting them
    + JDK-8193367: Annotated type variable bounds crash javac
    + JDK-8202117: com/sun/jndi/ldap/RemoveNamingListenerTest.java
    fails intermittently: Connection reset
    + JDK-8203026: java.rmi.NoSuchObjectException: no such object
    in table
    + JDK-8203281: [Windows] JComboBox change in ui when
    editor.setBorder() is called
    + JDK-8203382: Rename SystemDictionary::initialize_wk_klass to
    resolve_wk_klass
    + JDK-8203393: com/sun/jdi/JdbMethodExitTest.sh and
    JdbExprTest.sh fail due to timeout
    + JDK-8203928: [Test] Convert non-JDB scaffolding
    serviceability shell script tests to java
    + JDK-8204963: javax.swing.border.TitledBorder has a memory leak
    + JDK-8204994: SA might fail to attach to process with "Windbg
    Error: WaitForEvent failed"
    + JDK-8205534: Remove SymbolTable dependency from
    serviceability agent
    + JDK-8206309: Tier1 SA tests fail
    + JDK-8208281: java/nio/channels/
    /AsynchronousSocketChannel/Basic.java timed out
    + JDK-8209109: [TEST] rewrite com/sun/jdi shell tests to java
    version - step1
    + JDK-8209332: [TEST] test/jdk/com/sun/jdi/CatchPatternTest.sh
    is incorrect
    + JDK-8209342: Problemlist SA tests on Solaris due to Error
    attaching to process: Can't create thread_db agent!
    + JDK-8209343: Test javax/swing/border/TestTitledBorderLeak.java
    should be marked as headful
    + JDK-8209517: com/sun/jdi/BreakpointWithFullGC.java fails with
    timeout
    + JDK-8209604: [TEST] rewrite com/sun/jdi shell tests to java
    version - step2
    + JDK-8209605: com/sun/jdi/BreakpointWithFullGC.java fails with
    ZGC
    + JDK-8209608: Problem list com/sun/jdi/BreakpointWithFullGC.java
    + JDK-8210131: vmTestbase/nsk/jvmti/scenarios/allocation/AP10/
    /ap10t001/TestDescription.java failed with ObjectFree:
    GetCurrentThreadCpuTimerInfo returned unexpected error code
    + JDK-8210243: [TEST] rewrite com/sun/jdi shell tests to java
    version - step3
    + JDK-8210527: JShell: NullPointerException in
    jdk.jshell.Eval.translateExceptionStack
    + JDK-8210560: [TEST] convert com/sun/jdi redefineClass-related
    tests
    + JDK-8210725: com/sun/jdi/RedefineClearBreakpoint.java fails
    with waitForPrompt timed out after 60 seconds
    + JDK-8210748: [TESTBUG] lib.jdb.Jdb.waitForPrompt() should
    clarify which output is the pending reply after a timeout
    + JDK-8210760: [TEST] rewrite com/sun/jdi shell tests to java
    version - step4
    + JDK-8210977: jdk/jfr/event/oldobject/TestThreadLocalLeak.java
    fails to find ThreadLocalObject
    + JDK-8211292: [TEST] convert com/sun/jdi/DeferredStepTest.sh
    test
    + JDK-8211694: JShell: Redeclared variable should be reset
    + JDK-8212200: assert when shared java.lang.Object is redefined
    by JVMTI agent
    + JDK-8212629: [TEST] wrong breakpoint in
    test/jdk/com/sun/jdi/DeferredStepTest
    + JDK-8212665: com/sun/jdi/DeferredStepTest.java: jj1 (line 57)
  - unexpected. lastLine=52, minLine=52, maxLine=55
    + JDK-8212807: tools/jar/multiRelease/Basic.java times out
    + JDK-8213182: Minimal VM build failure after JDK-8212200
    (assert when shared java.lang.Object is redefined by JVMTI
    agent)
    + JDK-8213214: Set -Djava.io.tmpdir= when running tests
    + JDK-8213275: ReplaceCriticalClasses.java fails with
    jdk.internal.vm.PostVMInitHook not found
    + JDK-8213574: Deadlock in string table expansion when dumping
    lots of CDS classes
    + JDK-8213703: LambdaConversionException: Invalid receiver type
    not a subtype of implementation type interface
    + JDK-8214074: Ghash optimization using AVX instructions
    + JDK-8214491: Upgrade to JLine 3.9.0
    + JDK-8214797: TestJmapCoreMetaspace.java timed out
    + JDK-8215243: JShell tests failing intermitently with
    "Problem cleaning up the following threads:"
    + JDK-8215244: jdk/jshell/ToolBasicTest.java
    testHistoryReference failed
    + JDK-8215354: x86_32 build failures after JDK-8214074 (Ghash
    optimization using AVX instructions)
    + JDK-8215438: jshell tool: Ctrl-D causes EOF
    + JDK-8216021: RunTest.gmk might set concurrency level to 1 on
    Windows
    + JDK-8216974: HttpConnection not returned to the pool after
    204 response
    + JDK-8218948: SimpleDateFormat :: format - Zone Names are not
    reflected correctly during run time
    + JDK-8219712: code_size2 (defined in stub_routines_x86.hpp) is
    too small on new Skylake CPUs
    + JDK-8220150: macos10.14 Mojave returns anti-aliased glyphs
    instead of aliased B&amp;W glyphs
    + JDK-8221658: aarch64: add necessary predicate for ubfx
    patterns
    + JDK-8221759: Crash when completing "java.io.File.path"
    + JDK-8221918: runtime/SharedArchiveFile/serviceability/
    /ReplaceCriticalClasses.java fails: Shared archive not found
    + JDK-8222074: Enhance auto vectorization for x86
    + JDK-8222079: Don't use memset to initialize fields decode_env
    constructor in disassembler.cpp
    + JDK-8222769: [TESTBUG] TestJFRNetworkEvents should not rely
    on hostname command
    + JDK-8223688: JShell: crash on the instantiation of raw
    anonymous class
    + JDK-8223777: In posix_spawn mode, failing to exec()
    jspawnhelper does not result in an error
    + JDK-8223940: Private key not supported by chosen signature
    algorithm
    + JDK-8224184: jshell got IOException at exiting with AIX
    + JDK-8224234: compiler/codegen/TestCharVect2.java fails in
    test_mulc
    + JDK-8225037: java.net.JarURLConnection::getJarEntry() throws
    NullPointerException
    + JDK-8225625: AES Electronic Codebook (ECB) encryption and
    decryption optimization using AVX512 + VAES instructions
    + JDK-8226536: Catch OOM from deopt that fails rematerializing
    objects
    + JDK-8226575: OperatingSystemMXBean should be made container
    aware
    + JDK-8226697: Several tests which need the @key headful
    keyword are missing it.
    + JDK-8226809: Circular reference in printed stack trace is not
    correctly indented &amp; ambiguous
    + JDK-8227059: sun/security/tools/keytool/
    /DefaultSignatureAlgorithm.java timed out
    + JDK-8227269: Slow class loading when running with JDWP
    + JDK-8227595: keytool/fakegen/DefaultSignatureAlgorithm.java
    fails due to "exitValue = 6"
    + JDK-8228448: Jconsole can't connect to itself
    + JDK-8228967: Trust/Key store and SSL context utilities for
    tests
    + JDK-8229378: jdwp library loader in linker_md.c quietly
    truncates on buffer overflow
    + JDK-8229815: Upgrade Jline to 3.12.1
    + JDK-8230000: some httpclients testng tests run zero test
    + JDK-8230002: javax/xml/jaxp/unittest/transform/
    /SecureProcessingTest.java runs zero test
    + JDK-8230010: Remove jdk8037819/BasicTest1.java
    + JDK-8230094: CCE in createXMLEventWriter(Result) over an
    arbitrary XMLStreamWriter
    + JDK-8230402: Allocation of compile task fails with assert:
    "Leaking compilation tasks?"
    + JDK-8230767: FlightRecorderListener returns null recording
    + JDK-8230870: (zipfs) Add a ZIP FS test that is similar to
    test/jdk/java/util/zip/EntryCount64k.java
    + JDK-8231209: [REDO] ThreadMXBean::getThreadAllocatedBytes()
    can be quicker for self thread
    + JDK-8231586: enlarge encoding space for OopMapValue offsets
    + JDK-8231953: Wrong assumption in assertion in
    oop::register_oop
    + JDK-8231968: getCurrentThreadAllocatedBytes default
    implementation s/b getThreadAllocatedBytes
    + JDK-8232083: Minimal VM is broken after JDK-8231586
    + JDK-8232161: Align some one-way conversion in MS950 charset
    with Windows
    + JDK-8232855: jshell missing word in /help help
    + JDK-8233027: OopMapSet::all_do does oms.next() twice during
    iteration
    + JDK-8233228: Disable weak named curves by default in TLS,
    CertPath, and Signed JAR
    + JDK-8233386: Initialize NULL fields for unused decorations
    + JDK-8233452: java.math.BigDecimal.sqrt() with
    RoundingMode.FLOOR results in incorrect result
    + JDK-8233686: XML transformer uses excessive amount of memory
    + JDK-8233741: AES Countermode (AES-CTR) optimization using
    AVX512 + VAES instructions
    + JDK-8233829: javac cannot find non-ASCII module name under
    non-UTF8 environment
    + JDK-8233958: Memory retention due to HttpsURLConnection
    finalizer that serves no purpose
    + JDK-8234011: (zipfs) Memory leak in
    ZipFileSystem.releaseDeflater()
    + JDK-8234058: runtime/CompressedOops/
    /CompressedClassPointers.java fails with 'Narrow klass base:
    0x0000000000000000' missing from stdout/stderr
    + JDK-8234149: Several regression tests do not dispose Frame at
    end
    + JDK-8234347: "Turkey" meta time zone does not generate
    composed localized names
    + JDK-8234385: [TESTBUG] java/awt/EventQueue/6980209/
    /bug6980209.java fails in linux nightly
    + JDK-8234535: Cross compilation fails due to missing CFLAGS
    for the BUILD_CC
    + JDK-8234541: C1 emits an empty message when it inlines
    successfully
    + JDK-8234687: change javap reporting on unknown attributes
    + JDK-8236464: SO_LINGER option is ignored by SSLSocket in JDK
    11
    + JDK-8236548: Localized time zone name inconsistency between
    English and other locales
    + JDK-8236617: jtreg test containers/docker/
    /TestMemoryAwareness.java fails after 8226575
    + JDK-8237182: Update copyright header for shenandoah and
    epsilon files
    + JDK-8237888: security/infra/java/security/cert/
    /CertPathValidator/certification/LuxTrustCA.java fails when
    checking validity interval
    + JDK-8237977: Further update
    javax/net/ssl/compatibility/Compatibility.java
    + JDK-8238270: java.net HTTP/2 client does not decrease stream
    count when receives 204 response
    + JDK-8238284: [macos] Zero VM build fails due to an obvious
    typo
    + JDK-8238380: java.base/unix/native/libjava/childproc.c
    "multiple definition" link errors with GCC10
    + JDK-8238386: (sctp) jdk.sctp/unix/native/libsctp/SctpNet.c
    "multiple definition" link errors with GCC10
    + JDK-8238388: libj2gss/NativeFunc.o "multiple definition" link
    errors with GCC10
    + JDK-8238448: RSASSA-PSS signature verification fail when
    using certain odd key sizes
    + JDK-8238710: LingeredApp doesn't log stdout/stderr if exits
    with non-zero code
    + JDK-8239083: C1 assert(known_holder == NULL ||
    (known_holder-&gt;is_instance_klass() &amp;&amp;
    (!known_holder-&gt;is_interface() ||
    ((ciInstanceKlass*)known_holder)-&gt;has_nonstatic_concrete_methods())),
    "should be non-static concrete method");
    + JDK-8239385: KerberosTicket client name refers wrongly to
    sAMAccountName in AD
    + JDK-8240169: javadoc fails to link to non-modular api docs
    + JDK-8240295: hs_err elapsed time in seconds is not accurate
    enough
    + JDK-8240360: NativeLibraryEvent has wrong library name on
    Linux
    + JDK-8240676: Meet not symmetric failure when running lucene
    on jdk8
    + JDK-8241007: Shenandoah: remove
    ShenandoahCriticalControlThreadPriority support
    + JDK-8241065: Shenandoah: remove leftover code after
    JDK-8231086
    + JDK-8241086: Test runtime/NMT/HugeArenaTracking.java is
    failing on 32bit Windows
    + JDK-8241130: com.sun.jndi.ldap.EventSupport.removeDeadNotifier:
    java.lang.NullPointerException
    + JDK-8241138: http.nonProxyHosts=* causes
    StringIndexOutOfBoundsException in DefaultProxySelector
    + JDK-8241319: WB_GetCodeBlob doesn't have ResourceMark
    + JDK-8241478: vmTestbase/gc/gctests/Steal/steal001/steal001.java
    fails with OOME
    + JDK-8241574: Shenandoah: remove ShenandoahAssertToSpaceClosure
    + JDK-8241750: x86_32 build failure after JDK-8227269
    + JDK-8242184: CRL generation error with RSASSA-PSS
    + JDK-8242283: Can't start JVM when java home path includes
    non-ASCII character
    + JDK-8242556: Cannot load RSASSA-PSS public key with non-null
    params from byte array
    + JDK-8243029: Rewrite javax/net/ssl/compatibility/
    /Compatibility.java with a flexible interop test framework
    + JDK-8243138: Enhance BaseLdapServer to support starttls
    extended request
    + JDK-8243320: Add SSL root certificates to Oracle Root CA
    program
    + JDK-8243321: Add Entrust root CA - G4 to Oracle Root CA
    program
    + JDK-8243389: enhance os::pd_print_cpu_info on linux
    + JDK-8243453: java --describe-module failed with non-ASCII
    module name under non-UTF8 environment
    + JDK-8243470: [macos] bring back O2 opt level for unsafe.cpp
    + JDK-8243489: Thread CPU Load event may contain wrong data for
    CPU time under certain conditions
    + JDK-8243925: Toolkit#getScreenInsets() returns wrong value on
    HiDPI screens (Windows)
    + JDK-8244087: 2020-04-24 public suffix list update
    + JDK-8244151: Update MUSCLE PC/SC-Lite headers to the latest
    release 1.8.26
    + JDK-8244164: AArch64: jaotc generates incorrect code for
    compressed OOPs with non-zero heap base
    + JDK-8244196: adjust output in os_linux
    + JDK-8244225: stringop-overflow warning on strncpy call from
    compile_the_world_in
    + JDK-8244287: JFR: Methods samples have line number 0
    + JDK-8244703: "platform encoding not initialized" exceptions
    with debugger, JNI
    + JDK-8244719: CTW: C2 compilation fails with
    "assert(!VerifyHashTableKeys || _hash_lock == 0) failed:
    remove node from hash table before modifying it"
    + JDK-8244729: Shenandoah: remove resolve paths from
    SBSA::generate_shenandoah_lrb
    + JDK-8244763: Update --release 8 symbol information after JSR
    337 MR3
    + JDK-8244818: Java2D Queue Flusher crash while moving
    application window to external monitor
    + JDK-8245151: jarsigner should not raise duplicate warnings on
    verification
    + JDK-8245616: Bump update version for OpenJDK: jdk-11.0.9
    + JDK-8245714: "Bad graph detected in build_loop_late" when
    loads are pinned on loop limit check uncommon branch
    + JDK-8245801: StressRecompilation triggers assert "redundunt
    OSR recompilation detected. memory leak in CodeCache!"
    + JDK-8245832: JDK build make-static-libs should build all JDK
    libraries
    + JDK-8245880: Shenandoah: check class unloading flag early in
    concurrent code root scan
    + JDK-8245981: Upgrade to jQuery 3.5.1
    + JDK-8246027: Minimal fastdebug build broken after JDK-8245801
    + JDK-8246094: [macos] Sound Recording and playback is not
    working
    + JDK-8246153: TestEliminateArrayCopy fails with
  - XX:+StressReflectiveCode
    + JDK-8246193: Possible NPE in ENC-PA-REP search in AS-REQ
    + JDK-8246196: javax/management/MBeanServer/OldMBeanServerTest
    fails with AssertionError
    + JDK-8246203: Segmentation fault in verification due to stack
    overflow with -XX:+VerifyIterativeGVN
    + JDK-8246330: Add TLS Tests for Legacy ECDSA curves
    + JDK-8246453: TestClone crashes with "all collected exceptions
    must come from the same place"
    + JDK-8247246: Add explicit ResolvedJavaType.link and expose
    presence of default methods
    + JDK-8247350: [aarch64] assert(false) failed: wrong size of
    mach node
    + JDK-8247502: PhaseStringOpts crashes while optimising
    effectively dead code
    + JDK-8247615: Initialize the bytes left for the heap sampler
    + JDK-8247824: CTW: C2 (Shenandoah) compilation fails with SEGV
    in SBC2Support::pin_and_expand
    + JDK-8247874: Replacement in VersionProps.java.template not
    working when --with-vendor-bug-url contains '&amp;'
    + JDK-8247979: aarch64: missing side effect of killing flags
    for clearArray_reg_reg
    + JDK-8248214: Add paddings for TaskQueueSuper to reduce
    false-sharing cache contention
    + JDK-8248219: aarch64: missing memory barrier in
    fast_storefield and fast_accessfield
    + JDK-8248348: Regression caused by the update to BCEL 6.0
    + JDK-8248385: [testbug][11u] Adapt TestInitiExceptions to
    jtreg 5.1
    + JDK-8248495: [macos] zerovm is broken due to libffi headers
    location
    + JDK-8248851: CMS: Missing memory fences between free chunk
    check and klass read
    + JDK-8248987: AOT's Linker.java seems to eagerly fail-fast on
    Windows
    + JDK-8249159: Downport test rework for SSLSocketTemplate from
    8224650
    + JDK-8249215: JFrame::setVisible crashed with
  - Dfile.encoding=UTF-8 on Japanese Windows.
    + JDK-8249251: [dark_mode ubuntu 20.04] The selected menu is
    not highlighted in GTKLookAndFeel
    + JDK-8249255: Build fails if source code in cygwin home dir
    + JDK-8249277: TestVerifyIterativeGVN.java is failing with
    timeout in OpenJDK 11
    + JDK-8249278: Revert JDK-8226253 which breaks the spec of
    AccessibleState.SHOWING for JList
    + JDK-8249560: Shenandoah: Fix racy GC request handling
    + JDK-8249801: Shenandoah: Clear soft-refs on requested GC cycle
    + JDK-8249953: Shenandoah: gc/shenandoah/mxbeans tests should
    account for corner cases
    + JDK-8250582: Revert Principal Name type to NT-UNKNOWN when
    requesting TGS Kerberos tickets
    + JDK-8250609: C2 crash in IfNode::fold_compares
    + JDK-8250627: Use -XX:+/-UseContainerSupport for
    enabling/disabling Java container metrics
    + JDK-8250755: Better cleanup for
    jdk/test/javax/imageio/plugins/shared/CanWriteSequence.java
    + JDK-8250787: Provider.put no longer registering aliases in
    FIPS env
    + JDK-8250826: jhsdb does not work with coredump which comes
    from Substrate VM
    + JDK-8250827: Shenandoah: needs to reset/finish StringTable's
    dead count before/after parallel walk
    + JDK-8250844: Make sure {type,obj}ArrayOopDesc accessors check
    the bounds
    + JDK-8251117: Cannot check P11Key size in P11Cipher and
    P11AEADCipher
    + JDK-8251354: Shenandoah: Fix jdk/jfr/tool/TestPrintJSON.java
    test failure
    + JDK-8251451: Shenandoah: Remark ObjectSynchronizer roots with
    I-U
    + JDK-8251469: Better cleanup for
    test/jdk/javax/imageio/SetOutput.java
    + JDK-8251487: Shenandoah: missing detail timing tracking for
    final mark cleaning phase
    + JDK-8252120: compiler/oracle/TestCompileCommand.java
    misspells "occured"
    + JDK-8252157: JDK-8231209 11u backport breaks jmm binary
    compatibility
    + JDK-8252258: [11u] JDK-8242154 changes the default vendor
    + JDK-8252804: [test] Fix 'ReleaseDeflater.java' test after
    downport of 8234011
    + JDK-8253134: JMM_VERSION should remain at 0x20020000 (JDK 10)
    in JDK 11
    + JDK-8253283: [11u] Test build/translations/
    /VerifyTranslations.java failing after JDK-8252258
    + JDK-8253813: Backout JDK-8244287 from 11u: it causes several
    crashes
- Removed patch:
  * gcc-fno-common-fix.patch
    + not needed any more with this version
- Added patch:
  * JDK-8250861.patch
    + Fix regression "8250861: Crash in MinINode::Ideal(PhaseGVN*,
    bool)" introduced in jdk 11.0.9</changelog>
  <changelog author="fstrba@suse.com" date="1604491200">- Enable Sheandoah GC for x86_64 (jsc#ECO-3171)</changelog>
  <changelog author="fstrba@suse.com" date="1605528000">- Update to upstream tag jdk-11.0.9.1-1
  * Fix:
    + JDK-8250861: Crash in MinINode::Ideal(PhaseGVN*, bool)
- Removed patch:
  * JDK-8250861.patch
    + Integrated upstream</changelog>
  <changelog author="fstrba@suse.com" date="1611230400">- Update to upstream tag jdk-11.0.10+9 (January 2021 CPU,
  bsc#1181239)
  * Security fixes
    + JDK-8247619: Improve Direct Buffering of Characters
  * Other changes
    + JDK-6722928: Support SSPI as a native GSS-API provider
    + JDK-7185258: [macosx] Deadlock in SunToolKit.realSync()
    + JDK-8152332: [macosx] JFileChooser cannot be serialized on
    Mac OS X
    + JDK-8161684: [testconf] Add VerifyOops' testing into compiler
    tiers
    + JDK-8171279: Support X25519 and X448 in TLS
    + JDK-8173361: various crashes in
    JvmtiExport::post_compiled_method_load
    + JDK-8173658: JvmtiExport::post_class_unload() is broken for
    non-JavaThread initiators
    + JDK-8191006: hsdis disassembler plugin does not compile with
    binutils 2.29+
    + JDK-8197981: Missing return statement in
    __sync_val_compare_and_swap_8
    + JDK-8198334: java/awt/FileDialog/8003399/bug8003399.java
    fails in headless mode
    + JDK-8200151: Add 8 JNDI tests to com/sun/jndi/dns/ConfigTests/
    + JDK-8208279: Add 8 JNDI tests to com/sun/jndi/dns/EnvTests/
    + JDK-8208483: Add 5 JNDI tests to
    com/sun/jndi/dns/FactoryTests/
    + JDK-8208542: Add 4 JNDI tests to com/sun/jndi/dns/ListTests/
    + JDK-8208665: Amend cross-compilation docs with
    qemu-debootstrap recipe
    + JDK-8210088: ProblemList gc/epsilon/TestMemoryMXBeans.java
    + JDK-8210339: Add 10 JNDI tests to com/sun/jndi/dns/FedTests/
    + JDK-8211450: UndetVar::dup is not copying the kind field to
    the duplicated instance
    + JDK-8212160: JVMTI agent crashes with "assert(_value != 0LL)
    failed: resolving NULL _value"
    + JDK-8212226: SurfaceManager throws "Invalid Image variant"
    for MultiResolutionImage (Windows)
    + JDK-8213400: Support choosing group name in keytool keypair
    generation
    + JDK-8213535: Windows HiDPI html lightweight tooltips are
    truncated
    + JDK-8213698: Improve devkit creation and add support for
    linux/ppc64/ppc64le/s390x
    + JDK-8214025: assert(t-&gt;singleton()) failed: must be a
    constant when ScavengeRootsInCode &lt; 2
    + JDK-8214242: compiler/arguments/TestScavengeRootsInCode.java
    fails because of missing UnlockDiagnosticVMOptions
    + JDK-8214787: Zero builds fail with "undefined
    JavaThread::thread_state()"
    + JDK-8215583: Exclude
    runtime/handshake/HandshakeWalkSuspendExitTest.java
    + JDK-8216012: Infinite loop in RSA KeyPairGenerator
    + JDK-8216324: GetClassMethods is confused by the presence of
    default methods in super interfaces
    + JDK-8217429: WebSocket over authenticating proxy fails to
    send Upgrade headers
    + JDK-8217976: test/jdk/java/net/httpclient/websocket/
    /WebSocketProxyTest.java fails intermittently
    + JDK-8218021: Have jarsigner preserve posix permission
    attributes
    + JDK-8218287: jshell tool: input behavior unstable after
    12-ea+24 on Windows
    + JDK-8218851: JVM crash in custom classloader stress test, JDK
    12 &amp; 13
    + JDK-8220420: Cleanup c1_LinearScan
    + JDK-8222072: JVMTI GenerateEvents() sends CompiledMethodLoad
    events to wrong jvmtiEnv
    + JDK-8222286: Fix for JDK-8213419 is broken on s390
    + JDK-8222527: HttpClient doesn't send HOST header when
    tunelling HTTP/1.1 through http proxy
    + JDK-8222533: jtreg test jdk/internal/platform/cgroup/
    /TestCgroupMetrics.java fails on SLES12.3 linux ppc64le
    machine
    + JDK-8224506: [TESTBUG] TestDockerMemoryMetrics.java fails
    with exitValue = 137
    + JDK-8224555: vmTestbase/nsk/jvmti/scenarios/contention/TC02/
    /tc02t001/TestDescription.java failed
    + JDK-8224650: Add tests to support X25519 and X448 in TLS
    + JDK-8225072: Add LuxTrust certificate that is expiring in
    March 2021 to list of allowed but expired certs
    + JDK-8225329: -XX:+PrintBiasedLockingStatistics causes crash
    during initialization on Windows platforms
    + JDK-8225687: Newly added sspi.cpp in JDK-6722928 still
    contains some small errors
    + JDK-8227006: [linux] Runtime.availableProcessors execution
    time increased by factor of 100
    + JDK-8227275: Within native OOM error handling, assertions may
    hang the process
    + JDK-8227647: [Graal] Test8009761.java fails due to
    "RuntimeException: static java.lang.Object
    compiler.uncommontrap.Test8009761.m3(boolean,boolean) not
    compiled"
    + JDK-8229495: SIGILL in C2 generated OSR compilation
    + JDK-8230910: libsspi_bridge does not build on Windows 32bit
    + JDK-8232114: JVM crashed at imjpapi.dll in native code
    + JDK-8234147: Avoid looking up standard charsets in core
    libraries
    + JDK-8234393: [macos] printing ignores printer tray
    + JDK-8234863: Increase default value of MaxInlineLevel
    + JDK-8235218: Minimal VM is broken after JDK-8173361
    + JDK-8235456: Minimal VM is broken after JDK-8212160
    + JDK-8235829: graal crashes with Zombie.java test
    + JDK-8236124: Minimal VM slowdebug build failed after
    JDK-8212160
    + JDK-8236512: PKCS11 Connection closed after Cipher.doFinal
    and NoPadding
    + JDK-8236944: The legVecZ operand should be limited to
    zmm0-zmm15 registers
    + JDK-8237186: Fix typo in copyright header of
    java/io/Reader/TransferTo.java
    + JDK-8237499: JFR: Include stack trace in the ThreadStart event
    + JDK-8237512: AArch64: aarch64TestHook leaks a BufferBlob
    + JDK-8237524: AArch64: String.compareTo() may return incorrect
    result
    + JDK-8237950: C2 compilation fails with "Live Node limit
    exceeded limit" during ConvI2L::Ideal optimization
    + JDK-8238579: HttpsURLConnection drops the timeout and hangs
    forever in read
    + JDK-8239105: Add exception for expiring Digicert root
    certificates to VerifyCACerts test
    + JDK-8239477: jdk/jfr/jcmd/TestJcmdStartStopDefault.java fails
  - XX:+VerifyOops with "verify_oop: rsi: broken oop"
    + JDK-8239497: SEGV in EdgeUtils::field_name_symbol(Edge const&amp;)
    + JDK-8239886: Minimal VM build fails after JDK-8237499
    + JDK-8240633: Memory leaks in the implementations of
    FileChooserUI
    + JDK-8240690: Race condition between EDT and
    BasicDirectoryModel.FilesLoader.run0()
    + JDK-8241234: Unify monitor enter/exit runtime entries.
    + JDK-8241311: Move some charset mapping tests from closed to
    open
    + JDK-8241797: Add some tests to the problem list
    + JDK-8242029: AArch64: skip G1 array copy pre-barrier if
    marking not active
    + JDK-8242335: Additional Tests for RSASSA-PSS
    + JDK-8242480: Negative value may be returned by
    getFreeSwapSpaceSize() in the docker
    + JDK-8242614: cleanup duplicated test ldap server in some
    com/sun/jndi/ldap/ tests
    + JDK-8242846: Bring back test/jdk/tools/jlink/plugins/
    /OrderResourcesPluginTest.java
    + JDK-8243114: Implement montgomery{Multiply,Square}intrinsics
    on Windows
    + JDK-8243290: Improve diagnostic messages for class
    verification and redefinition failures
    + JDK-8243488: Add tests for set/get SendBufferSize and
    getReceiveBufferSize in DatagramSocket
    + JDK-8243549: sun/security/ssl/CipherSuite/
    /NamedGroupsWithCipherSuite.java failed with Unsupported
    signature algorithm: DSA
    + JDK-8243617: compiler/onSpinWait/TestOnSpinWaitC1.java test
    uses wrong class
    + JDK-8243619: compiler/codecache/CheckSegmentedCodeCache.java
    test misses -version
    + JDK-8244142: some hotspot/runtime tests don't check exit code
    of forked JVM
    + JDK-8244278: Excessive code cache flushes and sweeps
    + JDK-8244282: test/hotspot/jtreg/compiler/intrinsics/
    /Test8237524.java fails with --illegal-access=deny
    + JDK-8244621: [macos10.15] Garbled FX printing plus CoreText
    warnings on Catalina when building with Xcode 11
    + JDK-8244819: hsdis does not compile with binutils 2.34+
    + JDK-8245051: c1 is broken if it is compiled by gcc without
  - fno-lifetime-dse
    + JDK-8245168: jlink should not be treated as a "small" tool
    + JDK-8245400: Upgrade to LittleCMS 2.11
    + JDK-8246381: VM crashes with "Current BasicObjectLock* below
    than low_mark"
    + JDK-8246434: Threads::print_on_error assumes that the heap
    has been set up
    + JDK-8246648: issue with OperatingSystemImpl
    getFreeSwapSpaceSize in docker after 8242480
    + JDK-8247201: Print potential pointer value of readable stack
    memory in hs_err file
    + JDK-8247763: assert(outer-&gt;outcnt() == 2) failed: 'only phis'
    failure in LoopNode::verify_strip_mined()
    + JDK-8247867: Upgrade to freetype 2.10.2
    + JDK-8248190: Enable Power10 system and implement new
    byte-reverse instructions
    + JDK-8248226: TestCloneAccessStressGCM fails with
  - XX:-ReduceBulkZeroing
    + JDK-8248347: windows build broken by JDK-8243114
    + JDK-8248532: Every time I change keyboard language at my
    MacBook, Java crashes
    + JDK-8248552: C2 crashes with SIGFPE due to division by zero
    + JDK-8248596: [TESTBUG] compiler/loopopts/
    /PartialPeelingUnswitch.java times out with Graal enabled
    + JDK-8248745: Add jarsigner and keytool tests for restricted
    algorithms
    + JDK-8248791: sun/util/resources/cldr/TimeZoneNamesTest.java
    fails with -XX:-ReduceInitialCardMarks -XX:-ReduceBulkZeroing
    + JDK-8248845: AArch64: stack corruption after spilling vector
    register
    + JDK-8249176: Update GlobalSignR6CA test certificates
    + JDK-8249183: JVM crash in "AwtFrame::WmSize" method
    + JDK-8249192: MonitorInfo stores raw oops across safepoints
    + JDK-8249602: C2: assert(cnt == _outcnt) failed: no insertions
    allowed
    + JDK-8249603: C1: assert(has_error == false) failed: register
    allocation invalid
    + JDK-8249605: C2: assert(no_dead_loop) failed: dead loop
    detected
    + JDK-8249607: C2: assert(!had_error) failed: bad dominance
    + JDK-8249608: Vector register used by C2 compiled method
    corrupted at safepoint
    + JDK-8249672: Include microcode revision in features_string on
    x86
    + JDK-8249748: gtest silently ignores bad jvm arguments
    + JDK-8249821: Separate libharfbuzz from libfontmanager
    + JDK-8250598: Hyper-V is detected in spite of running on host
    OS
    + JDK-8250605: Linux x86_32 builds fail after JDK-8249821
    + JDK-8250636: iso8601_time returns incorrect offset part on
    MacOS
    + JDK-8250665: Wrong translation for the month name of May in
    ar_JO,LB,SY
    + JDK-8250772: Test com/sun/jndi/ldap/
    /NamingExceptionMessageTest.java fails intermittently with
    javax.naming.ServiceUnavailableException
    + JDK-8250825: C2 crashes with assert(field != __null) failed:
    missing field
    + JDK-8250894: Provide a configure option to build and run
    against the platform libharfbuzz
    + JDK-8250928: JFR: Improve hash algorithm for stack traces
    + JDK-8250968: Symlinks attributes not preserved when using
    jarsigner on zip files
    + JDK-8250984: Memory Docker tests fail on some Linux kernels
    w/o cgroupv1 swap limit capabilities
    + JDK-8251118: BiasedLocking::preserve_marks should not have a
    HandleMark
    + JDK-8251189: com/sun/jndi/ldap/LdapDnsProviderTest.java
    failed due to timeout
    + JDK-8251257: NMT: jcmd VM.native_memory scale=1 crashes
    target VM
    + JDK-8251365: Build failure on AIX after 8250636
    + JDK-8251397: NPE on ClassValue.ClassValueMap.cacheArray
    + JDK-8251456: [TESTBUG] compiler/vectorization/
    /TestVectorsNotSavedAtSafepoint.java failed OutOfMemoryError
    + JDK-8251458: Parse::do_lookupswitch fails with "assert(_cnt
    &gt;= 0) failed"
    + JDK-8251535: Partial peeling at unsigned test adds incorrect
    loop exit check
    + JDK-8251949: ZGC: Set explicit heap size for
    compiler/gcbarriers tests
    + JDK-8252090: JFR: StreamWriterHost::write_unbuffered() stucks
    in an infinite loop OpenJDK (build 13.0.1+9)
    + JDK-8252415: Bump update version for OpenJDK: jdk-11.0.10
    + JDK-8252470: java/awt/dnd/DisposeFrameOnDragCrash/
    /DisposeFrameOnDragTest.java fails on Windows
    + JDK-8252497: Incorrect numeric currency code for ROL
    + JDK-8252660: Shenandoah: support manageable SoftMaxHeapSize
    option
    + JDK-8252679: Two windows specific FileDIalog tests may fail
    on some Windows_Server_2016_Standard
    + JDK-8252696: Loop unswitching may cause out of bound array
    load to be executed
    + JDK-8252754: Hash code calculation of JfrStackTrace is
    inconsistent
    + JDK-8253219: Epsilon: clean up unnecessary includes
    + JDK-8253224: Shenandoah: ShenandoahStrDedupQueue destructor
    calls virtual num_queues()
    + JDK-8253226: Shenandoah: remove unimplemented
    ShenandoahStrDedupQueue::verify
    + JDK-8253269: The CheckCommonColors test should provide more
    info on failure
    + JDK-8253284: Zero OrderAccess barrier mappings are incorrect
    + JDK-8253375: OSX build fails with Xcode 12.0 (12A7209)
    + JDK-8253778: ShenandoahSafepoint::is_at_shenandoah_safepoint
    should not access VMThread state from other threads
    + JDK-8253791: Issue with useAppleColor check in CSystemColors.m
    + JDK-8254016: Test8237524 fails with -XX:-CompactStrings option
    + JDK-8254081: java/security/cert/PolicyNode/
    /GetPolicyQualifiers.java fails due to an expired certificate
    + JDK-8254144: Non-x86 Zero builds fail with return-type
    warning in os_linux_zero.cpp
    + JDK-8254166: Zero: return-type warning in
    zeroInterpreter_zero.cpp
    + JDK-8254177: (tz) Upgrade time-zone data to tzdata2020b
    + JDK-8254185: Fix Code cache sweeper heuristics for JDK 11
    + JDK-8254190: [s390] interpreter misses exception check after
    calling monitorenter
    + JDK-8254790: SIGSEGV in string_indexof_char and
    stringL_indexof_char intrinsics
    + JDK-8254854: [cgroups v1] Metric limits not properly detected
    on some join controller combinations
    + JDK-8254982: (tz) Upgrade time-zone data to tzdata2020c
    + JDK-8255050: Add pkcs11/KeyStore/ClientAuth.sh to Problem list
    + JDK-8255065: Zero: accessor_entry misses the IRIW case
    + JDK-8255226: (tz) Upgrade time-zone data to tzdata2020d
    + JDK-8255269: Unsigned overflow in g1Policy.cpp
    + JDK-8255365: Problem list failing client manual tests
    + JDK-8255457: Shenandoah: cleanup ShenandoahMarkTask
    + JDK-8255466: C2 crashes at ciObject::get_oop() const+0x0
    + JDK-8255550: x86: Assembler::cmpq(Address dst, Register src)
    encoding is incorrect
    + JDK-8255603: Memory/Performance regression after JDK-8210985
    + JDK-8255760: Shenandoah: match constants style in
    ShenandoahMarkTask fallback
    + JDK-8255781: Bump patch update version for OpenJDK:
    jdk-11.0.9.1
    + JDK-8255937: Better cleanup for
    test/jdk/javax/imageio/stream/StreamFlush.java
    + JDK-8256427: Test com/sun/jndi/dns/ConfigTests/
    /PortUnreachable.java does not work on AIX
    + JDK-8256452: Integrate missing part of JDK-8232370 to 11u
    + JDK-8256483: [TESTBUG] serviceability/jvmti/GetClassMethods/
    /libOverpassMethods.c fails to compile on gcc 4.4.x
    + JDK-8256557: libharfbuzz fails to link on gcc 4.4.x due to
  - Wl,-z,defs
    + JDK-8256618: Zero: Linux x86_32 build still fails
    + JDK-8256736: Zero: GTest tests fail with "unsuppported vm
    variant"
    + JDK-8256809: Annotation processing causes NPE during flow
    analysis
    + JDK-8257181: s390x builds are very noisy with gc-sections
    messages
    + JDK-8257242: [macOS] Java app crashes while switching input
    methods
    + JDK-8257545: SunJSSE FIPS regression in key exchange after
    JDK-8171279 11u backport
    + JDK-8257641: Shenandoah: Query is_at_shenandoah_safepoint()
    from control thread should return false
    + JDK-8257701: Shenandoah: objArrayKlass metadata is not marked
    with chunked arrays
    + JDK-8258630: Add expiry exception for QuoVadis root
    certificate
- New upstream dependency on libharfbuzz
- Regenerated patches: missing-return.patch system-pcsclite.patch</changelog>
  <changelog author="fstrba@suse.com" date="1616155200">- Added patches:
  * system-crypto-policy.patch
    + Let OpenJDK use system crypto policies unless explicitely told
    not to
  * nss-security-provider.patch
    + Add the NSS security provider with configuration in generated
    nss.cfg file
  * keytool-default-rsa.patch
    + Make keytool generate RSA keys by default, since only the
    LEGACY system crypto policy allows DSA</changelog>
  <changelog author="pujos.michael@gmail.com" date="1618488000">- moved mozilla-nss dependency to java-11-openjdk-headless package
  This is necessary to be able to do crypto with just
  java-11-openjdk-headless installed. Fixes boo#1184606</changelog>
  <changelog author="fstrba@suse.com" date="1619006400">- Update to upstream tag jdk-11.0.11+9 (April 2021, CPU)
  * Security fixes
    + JDK-8244473: Contextualize registration for JNDI
    + JDK-8244543: Enhanced handling of abstract classes
    + JDK-8249906, CVE-2021-2163, bsc#1185055: Enhance opening JARs
    + JDK-8250568, CVE-2021-2161, bsc#1185056: Less ambiguous
    processing
    + JDK-8253799: Make lists of normal filenames
    + JDK-8257001: Improve Http Client Support
  * Other changes
    + JDK-7107012: sun.jvm.hotspot.code.CompressedReadStream
    readDouble() conversion to long mishandled
    + JDK-7146776: deadlock between URLStreamHandler.getHostAddress
    and file.Handler.openconnection
    + JDK-8086003: Test fails on OSX with java.lang.RuntimeException
    'Narrow klass base: 0x0000000000000000, Narrow klass shift: 3'
    missing
    + JDK-8168869: jdeps: localized messages don't use proper line
    breaks
    + JDK-8180837: SunPKCS11-NSS tests failing with
    CKR_ATTRIBUTE_READ_ONLY and CKR_MECHANISM_PARAM_INVALID
    + JDK-8202343: Disable TLS 1.0 and 1.1
    + JDK-8205992: jhsdb cannot attach to Java processes running in
    Docker containers
    + JDK-8209193: Fix aarch64-linux compilation after -Wreorder
    changes
    + JDK-8210413: AArch64: Optimize div/rem by constant in C1
    + JDK-8210578: AArch64: Invalid encoding for fmlsvs instruction
    + JDK-8211051: jdeps usage of --dot-output doesn't provide
    valid output for modular jar
    + JDK-8211057: Gensrc step CompileProperties generates unstable
    CompilerProperties output
    + JDK-8211150: G1 Full GC not purging code root memory and
    hence causing memory leak
    + JDK-8211825: ModuleLayer.defineModulesWithXXX does not setup
    delegation when module reads automatic module
    + JDK-8212043: Add floating-point Math.min/max intrinsics
    + JDK-8212218: [TESTBUG] runtime/ErrorHandling/
    /TestHeapDumpOnOutOfMemoryErrorInMetaspace.java timed out
    + JDK-8213116: javax/swing/JComboBox/WindowsComboBoxSize/
    /WindowsComboBoxSizeTest.java fails in Windows
    + JDK-8213909: jdeps --print-module-deps should report missing
    dependences
    + JDK-8214180: Need better granularity for sleeping
    + JDK-8214223: tools/jdeps/listdeps/ListModuleDeps.java failed
    due to missing Lib2 file
    + JDK-8214230: Classes generated by SystemModulesPlugin.java
    are not reproducable
    + JDK-8214741: docs/index.html has no title or copyright
    + JDK-8215687: [Graal] unit test CheckGraalIntrinsics failed
    after 8212043
    + JDK-8217848: [Graal] vmTestbase/nsk/jvmti/ResourceExhausted/
    /resexhausted003/TestDescription.java fails
    + JDK-8218482: sun/security/krb5/auto/ReplayCachePrecise.java
    failed - no KrbException thrown
    + JDK-8218550: Add test omitted from JDK-8212043
    + JDK-8221584: SIGSEGV in os::PlatformEvent::unpark() in
    JvmtiRawMonitor::raw_exit while posting method exit event
    + JDK-8221995: AARCH64: problems with CAS instructions encoding
    + JDK-8222518: Remove unnecessary caching of Parker object in
    java.lang.Thread
    + JDK-8222785: aarch64: add necessary masking for immediate
    shift counts
    + JDK-8223186: HotSpot compile warnings from GCC 9
    + JDK-8225773: jdeps --check produces NPE if there are missing
    module dependences
    + JDK-8225805: Java Access Bridge does not close the logger
    + JDK-8226810: Failed to launch JVM because of
    NullPointerException occured on System.props
    + JDK-8229396: jdeps ignores multi-release when
    generate-module-info used on command line
    + JDK-8229474: Shenandoah: Cleanup CM::update_roots()
    + JDK-8232225: Rework the fix for JDK-8071483
    + JDK-8232905: JFR fails with assertion:
    assert(t-&gt;unflushed_size() == 0) failed: invariant
    + JDK-8233164: C2 fails with assert(phase-&gt;C-&gt;get_alias_index(t)
    == phase-&gt;C-&gt;get_alias_index(t_adr)) failed: correct memory
    chain
    + JDK-8233910: java/awt/ColorClass/AlphaColorTest.java is
    failing  intermittently in nightly lnux-x64 system
    + JDK-8233912: aarch64: minor improvements of atomic operations
    + JDK-8234508: VM_HeapWalkOperation::iterate_over_object reads
    non-strong fields with an on-strong load barrier
    + JDK-8234742: Improve handshake logging
    + JDK-8234796: Refactor Handshake::execute to take a more
    complex type than ThreadClosure
    + JDK-8235324: Dying objects are published from users of
    CollectedHeap::object_iterate
    + JDK-8235351: Lookup::unreflect should bind with the original
    caller independent of Method's accessible flag
    + JDK-8237369: Shenandoah: failed vmTestbase/nsk/jvmti/
    /AttachOnDemand/attach021/TestDescription.java test
    + JDK-8237392: Shenandoah: Remove unreliable assertion
    + JDK-8237483: AArch64 C1 OopMap inserted twice fatal error
    + JDK-8237495: Java MIDI fails with a dereferenced memory error
    when asked to send a raw 0xF7
    + JDK-8239355: (dc) Initial value of SO_SNDBUF should allow
    sending large datagrams (macOS)
    + JDK-8240353: AArch64: missing support for
  - XX:+ExtendedDTraceProbes in C1
    + JDK-8240704: CheckHandles.java failed "AssertionError: Handle
    use increased by more than 10 percent."
    + JDK-8240751: Shenandoah: fold ShenandoahTracer definition
    + JDK-8240795: [REDO] 8238384 CTW: C2 compilation fails with
    "assert(store != load-&gt;find_exact_control(load-&gt;in(0)))
    failed: dependence cycle found"
    + JDK-8241598: Upgrade JLine to 3.14.0
    + JDK-8241649: Optimize Character.toString
    + JDK-8241770: Module xxxAnnotation() methods throw NCDFE if
    module-info.class found as resource in unnamed module
    + JDK-8241911: AArch64: Fix a potential register clash issue in
    reduce_add2I
    + JDK-8242030: Wrong package declarations in jline classes after
    JDK-8241598
    + JDK-8242565: Policy initialization issues when the denyAfter
    constraint is enabled
    + JDK-8243618: compiler/rtm/cli tests can be run w/o WhiteBox
    + JDK-8243670: Unexpected test result caused by C2
    MergeMemNode::Ideal
    + JDK-8244088: [Regression] Switch of Gnome theme ends up in
    deadlocked UI
    + JDK-8244154: Update SunPKCS11 provider with PKCS11 v3.0 header
    files
    + JDK-8244340: Handshake processing thread lacks yielding
    + JDK-8244573: java.lang.ArrayIndexOutOfBoundsException thrown
    for malformed class file
    + JDK-8244683: A TSA server used by tests
    + JDK-8245005: javax/net/ssl/compatibility/BasicConnectTest.java
    failed with No enum constant
    + JDK-8245026: PsAdaptiveSizePolicy::_old_gen_policy_is_ready is
    unused
    + JDK-8245283: JFR: Can't handle constant dynamic used by Jacoco
    agent
    + JDK-8245512: CRC32 optimization using AVX512 instructions
    + JDK-8245527: LDAP Channel Binding support for Java
    GSS/Kerberos
    + JDK-8246707: (sc) SocketChannel.read/write throws
    AsynchronousCloseException on closed channel
    + JDK-8246709: sun/security/tools/jarsigner/
    /TsacertOptionTest.java compilation failed after JDK-8244683
    + JDK-8247200: assert((unsigned)fpargs &lt; 32)
    + JDK-8247766: [aarch64] guarantee(val &lt; (1U &lt;&lt; nbits))
    failed: Field too big for insn.
    + JDK-8248336: AArch64: C2: offset overflow in
    BoxLockNode::emit
    + JDK-8248865: Document JNDI/LDAP timeout properties
    + JDK-8248901: Signed immediate support in
    .../share/assembler.hpp is broken.
    + JDK-8249543: Force DirectBufferAllocTest to run with
  - ExplicitGCInvokesConcurrent
    + JDK-8249588: libwindowsaccessbridge issues on 64bit Windows
    + JDK-8249749: modify a primitive array through a stream and a
    for cycle causes jre crash
    + JDK-8249787: Make TestGCLocker more resilient with concurrent
    GCs
    + JDK-8249867: xml declaration is not followed by a newline
    + JDK-8250911: [windows] os::pd_map_memory() error detection
    broken
    + JDK-8251255: [linux] Add process-memory information to hs-err
    and VM.info
    + JDK-8251359: Shenandoah: filter null oops before calling
    enqueue/SATB barrier
    + JDK-8251925: C2: RenaissanceStressTest fails with
    assert(!had_error): bad dominance
    + JDK-8251944: Add Shenandoah test config to
    compiler/gcbarriers/UnsafeIntrinsicsTest.java
    + JDK-8251992: VM crashed running TestComplexAddrExpr.java test
    with -XX:UseAVX=X
    + JDK-8253220: Epsilon: clean up unused code/declarations
    + JDK-8253274: The CycleDMImagetest brokes the system
    + JDK-8253353: Crash in C2: guarantee(n != NULL) failed: No Node
    + JDK-8253368: TLS connection always receives close_notify
    exception
    + JDK-8253404: C2: assert(C-&gt;live_nodes() &lt;=
    C-&gt;max_node_limit()) failed: Live Node limit exceeded limit
    + JDK-8253409: Double-rounding possibility in float fma
    + JDK-8253476: TestUseContainerSupport.java fails on some Linux
    kernels w/o swap limit capabilities
    + JDK-8253524: C2: Refactor code that clones predicates during
    loop unswitching
    + JDK-8253644: C2: assert(skeleton_predicate_has_opaque(iff))
    failed: unexpected
    + JDK-8253681: closed java/awt/dnd/MouseEventAfterStartDragTest/
    /MouseEventAfterStartDragTest.html test failed
    + JDK-8253702: BigSur version number reported as 10.16, should
    be 11.nn
    + JDK-8253756: C2 CompilerThread0 crash in Node::add_req(Node*)
    + JDK-8254104: MethodCounters must exist before nmethod is
    installed
    + JDK-8254734: "dead loop detected" assert failure with patch
    from 8223051
    + JDK-8254748: Bad Copyright header format after JDK-8212218
    + JDK-8254799: runtime/ErrorHandling/
    /TestHeapDumpOnOutOfMemoryError.java fails with release VMs
    + JDK-8255058: C1: assert(is_virtual()) failed: type check
    + JDK-8255351: Add detection for Graviton 2 CPUs
    + JDK-8255368: Math.exp() gives wrong result for large values on
    x86 32-bit platforms
    + JDK-8255387: Japanese characters were printed upside down on
    AIX
    + JDK-8255401: Shenandoah: Allow oldval and newval registers to
    overlap in cmpxchg_oop()
    + JDK-8255479: [aarch64] assert(src-&gt;section_index_of(target) ==
    CodeBuffer::SECT_NONE) failed: sanity
    + JDK-8255544: Create a checked cast
    + JDK-8255559: Leak File Descriptors Because of
    ResolverLocalFilesystem#engineResolveURI()
    + JDK-8255681: print callstack in error case in
    runAWTLoopWithApp
    + JDK-8255734: VM should ignore SIGXFSZ on ppc64, s390 too
    + JDK-8255742: PrintInlining as compiler directive doesn't print
    virtual calls
    + JDK-8255845: Memory leak in imageFile.cpp
    + JDK-8255880: UI of Swing components is not redrawn after their
    internal state changed
    + JDK-8255908: ExceptionInInitializerError due to
    UncheckedIOException while initializing cgroupv1 subsystem
    + JDK-8256025: AArch64: MachCallRuntimeNode::ret_addr_offset()
    is incorrect for stub calls
    + JDK-8256056: Deoptimization stub doesn't save vector registers
    on x86
    + JDK-8256061: RegisterSaver::save_live_registers() omits upper
    halves of ZMM0-15 registers
    + JDK-8256187: [TEST_BUG] Automate bug4275046.java test
    + JDK-8256220: C1: x86_32 fails with -XX:UseSSE=1 after
    JDK-8210764 due to mishandled lir_neg
    + JDK-8256258: some missing NULL checks or asserts after
    CodeCache::find_blob_unsafe
    + JDK-8256264: Printed GlyphVector outline with low DPI has bad
    quality on Windows
    + JDK-8256290: javac/lambda/T8031967.java fails with
    StackOverflowError on x86_32
    + JDK-8256359: AArch64: runtime/ReservedStack/
    /ReservedStackTestCompiler.java fails
    + JDK-8256387: Unexpected result if patching an entire
    instruction on AArch64
    + JDK-8256421: Add 2 HARICA roots to cacerts truststore
    + JDK-8256488: [aarch64] Use ldpq/stpq instead of ld4/st4 for
    small copies in StubGenerator::copy_memory
    + JDK-8256489: Make gtest for long path names on Windows more
    resilient in the presence of virus scanners
    + JDK-8256501: libTestMainKeyWindow fails to build with Xcode
    12.2
    + JDK-8256633: Fix product build on Windows+Arm64
    + JDK-8256682: JDK-8202343 is incomplete
    + JDK-8256751: Incremental rebuild with precompiled header fails
    when touching a header file
    + JDK-8256757: Incorrect MachCallRuntimeNode::ret_addr_offset()
    for CallLeafNoFP on x86_32
    + JDK-8256806: Shenandoah: optimize shenandoah/jni/
    /TestPinnedGarbage.java test
    + JDK-8256807: C2: Not marking stores correctly as mismatched
    in string opts
    + JDK-8256810: Incremental rebuild broken on Macosx
    + JDK-8256818: SSLSocket that is never bound or connected leaks
    socket resources
    + JDK-8256888: Client manual test problem list update
    + JDK-8257083: Security infra test failures caused by
    JDK-8202343
    + JDK-8257408: Bump update version for OpenJDK: jdk-11.0.11
    + JDK-8257423: [PPC64] Support -XX:-UseInlineCaches
    + JDK-8257436: [aarch64] Regressions in ArrayCopyUnalignedDst
    .testByte/testChar for 65-78 bytes when UseSIMDForMemoryOps
    is on
    + JDK-8257513: C2: assert((constant_addr -
    _masm.code()-&gt;consts()-&gt;start()) == con.offset())
    + JDK-8257547: Handle multiple prereqs on the same line in deps
    files
    + JDK-8257561: Some code is not vectorized after 8251925 and
    8250607
    + JDK-8257565: epsilonBarrierSet.hpp should not include
    barrierSetAssembler
    + JDK-8257575: C2: "failed: only phis" assert failure in loop
    strip mining verification
    + JDK-8257594: C2 compiled checkcast of non-null object triggers
    endless deoptimization/recompilation cycle
    + JDK-8257633: Missing -mmacosx-version-min=X flag when linking
    libjvm
    + JDK-8257670: sun/security/ssl/SSLSocketImpl/SSLSocketLeak.java
    reports leaks
    + JDK-8257707: Fix incorrect format string in Http1HeaderParser
    + JDK-8257746: Regression introduced with JDK-8250984 - memory
    might be null in some machines
    + JDK-8257798: [PPC64] undefined reference to
    Klass::vtable_start_offset()
    + JDK-8257884: Re-enable sun/security/ssl/SSLSocketImpl/
    /SSLSocketLeak.java as automatic test
    + JDK-8257910: [JVMCI] Set exception_seen accordingly in the
    runtime.
    + JDK-8257997: sun/security/ssl/SSLSocketImpl/SSLSocketLeak.java
    again reports leaks after JDK-8257884
    + JDK-8257999: Parallel GC crash in gc/parallel/
    /TestDynShrinkHeap.java: new region is not in covered_region
    + JDK-8258077: Using -Xcheck:jni can lead to a double-free after
    JDK-8193234
    + JDK-8258247: Couple of issues in fix for JDK-8249906
    + JDK-8258373: Update the text handling in the JPasswordField
    + JDK-8258396: SIGILL in jdk.jfr.internal.PlatformRecorder
    .rotateDisk()
    + JDK-8258419: RSA cipher buffer cleanup
    + JDK-8258471: "search codecache" clhsdb command does not work
    + JDK-8258534: Epsilon: clean up unused includes
    + JDK-8258805: Japanese characters not entered by mouse click
    on Windows 10
    + JDK-8258833: Cancel multi-part cipher operations in SunPKCS11
    after failures
    + JDK-8258836: JNI local refs exceed capacity
    getDiagnosticCommandInfo
    + JDK-8258884: [TEST_BUG] Convert applet-based test
    open/test/jdk/javax/swing/JMenuItem/8031573/bug8031573.java
    to a regular java test
    + JDK-8259007: This test printed a blank page
    + JDK-8259048: (tz) Upgrade time-zone data to tzdata2020f
    + JDK-8259049: Uninitialized variable after JDK-8257513
    + JDK-8259231: Epsilon: improve performance under contention
    during virtual space expansion
    + JDK-8259271: gc/parallel/TestDynShrinkHeap.java still fails
    "assert(covered_region.contains(new_memregion)) failed: new
    region is not in covered_region"
    + JDK-8259312: VerifyCACerts.java fails as soneraclass2ca cert
    will expire in 90 days
    + JDK-8259319: Illegal package access when SunPKCS11 requires
    SunJCE's classes
    + JDK-8259339: AllocateUninitializedArray C2 intrinsic fails
    with void.class input
    + JDK-8259428: AlgorithmId.getEncodedParams() should return copy
    + JDK-8259446: runtime/jni/checked/
    /TestCheckedReleaseArrayElements.java fails with stderr not
    empty
    + JDK-8259451: Zero: skip serviceability/sa tests, set vm.hasSA
    to false
    + JDK-8259580: Shenandoah: uninitialized label in
    VerifyThreadGCState
    + JDK-8259619: C1: 3-arg StubAssembler::call_RT stack-use
    condition is incorrect
    + JDK-8259633: compiler/graalunit/CoreTest.java fails with NPE
    after JDK-8244543
    + JDK-8259706: C2 compilation fails with assert(vtable_index ==
    Method::invalid_vtable_index) failed: correct sentinel value
    + JDK-8259707: LDAP channel binding does not work with StartTLS
    extension
    + JDK-8259773: Incorrect encoding of AVX-512 kmovq instruction
    + JDK-8259849: Shenandoah: Rename store-val to IU-barrier
    + JDK-8259949: x86 32-bit build fails when -fcf-protection is
    passed in the compiler flags
    + JDK-8259954: gc/shenandoah/mxbeans tests fail with -Xcomp
    + JDK-8260029: aarch64: fix typo in verify_oop_array
    + JDK-8260308: Update LogCompilation junit to 4.13.1
    + JDK-8260338: Some fields in HaltNode is not cloned
    + JDK-8260349: Cannot programmatically retrieve Metaspace max
    set via JAVA_TOOL_OPTIONS
    + JDK-8260356: (tz) Upgrade time-zone data to tzdata2021a
    + JDK-8260378: [TESTBUG] DcmdMBeanTestCheckJni.java reports
    false positive
    + JDK-8260497: Shenandoah: Improve SATB flushing
    + JDK-8260502: [s390] NativeMovRegMem::verify() fails because
    it's too strict
    + JDK-8260632: Build failures after JDK-8253353
    + JDK-8260704: ParallelGC: oldgen expansion needs release-store
    for _end
    + JDK-8261022: Fix incorrect result of Math.abs() with char type
    + JDK-8261089: [TESTBUG] native library of test
    TestCheckedReleaseCriticalArray.java fails to compile with
    gcc 4.x
    + JDK-8261183: Follow on to Make lists of normal filenames
    + JDK-8261209: isStandalone property: remove dependency on
    pretty-print
    + JDK-8261231: Windows IME was disabled after DnD operation
    + JDK-8261251: Shenandoah: Use object size for full GC
    humongous compaction
    + JDK-8261310: PPC64 Zero build fails with
    'VMError::controlled_crash(int)::FunctionDescriptor
    functionDescriptor' has incomplete type and cannot be defined
    + JDK-8261334: NMT: tuning statistic shows incorrect hash
    distribution
    + JDK-8261413: Shenandoah: Disable class-unloading in I-U mode
    + JDK-8261522: [PPC64] AES intrinsics write beyond the
    destination array
    + JDK-8261534: Test sun/security/pkcs11/KeyAgreement/
    /IllegalPackageAccess.java fails on platforms where no nsslib
    artifacts are defined
    + JDK-8261585: Restore HandleArea used in
    Deoptimization::uncommon_trap
    + JDK-8261753: Test java/lang/System/OsVersionTest.java still
    failing on BigSur patch versions after JDK-8253702
    + JDK-8261829: Exclude tools/jlink/JLinkReproducibleTest.java
    in 11u
    + JDK-8261912: Code IfNode::fold_compares_helper more
    defensively
    + JDK-8261920: [AIX] jshell command throws java.io.IOError on
    non English locales
    + JDK-8262018: Wrong format in SAP copyright header of
    OsVersionTest
    + JDK-8263069: Exclude some failing tests from
    security/infra/java/security/cert/CertPathValidator</changelog>
  <changelog author="fstrba@suse.com" date="1620043200">- Remove all Jpackage provides for SLE12 in order to avoid
  installing this package as default Java on SLE12-SP5
  (bsc#1185476)</changelog>
  <changelog author="fstrba@suse.com" date="1621512000">- Modified patch:
  * nss-security-provider.patch
    + make the NSS provider first in the list</changelog>
  <changelog author="fstrba@suse.com" date="1626868800">- Update to upstream tag jdk-11.0.12+7 (July 2021, CPU)
  * Security fixes
    + JDK-8256157: Improve bytecode assembly
    + JDK-8256491: Better HTTP transport
    + JDK-8258432, CVE-2021-2341, bsc#1188564: Improve file
    transfers
    + JDK-8260453: Improve Font Bounding
    + JDK-8260960: Signs of jarsigner signing
    + JDK-8260967, CVE-2021-2369, bsc#1188565: Better jar file
    validation
    + JDK-8262380: Enhance XML processing passes
    + JDK-8262403: Enhanced data transfer
    + JDK-8262410: Enhanced rules for zones
    + JDK-8262477: Enhance String Conclusions
    + JDK-8262967: Improve Zip file support
    + JDK-8264066, CVE-2021-2388, bsc#1188566: Enhance compiler
    validation
    + JDK-8264079: Improve abstractions
    + JDK-8264460: Improve NTLM support
  * Other changes
    + JDK-6847157: java.lang.NullPointerException: HDC for
    component at sun.java2d.loops.Blit.Blit
    + JDK-7106851: Test should not use System.exit
    + JDK-8073446: TimeZone getOffset API does not  return a dst
    offset between years 2038-2137
    + JDK-8076190: Customizing the generation of a PKCS12 keystore
    + JDK-8153005: Upgrade the default PKCS12 encryption/MAC
    algorithms
    + JDK-8171303: sun/java2d/pipe/InterpolationQualityTest.java
    fails on Windows &amp; Linux
    + JDK-8177068: incomplete classpath causes NPE in Flow
    + JDK-8185734: [Windows] Structured Exception Catcher missing
    around gtest execution
    + JDK-8187450: JNI local refs exceeds capacity warning in
    NetworkInterface::getAll
    + JDK-8190763: Class cast exception on (CompoundEdit)
    UndoableEditEvent.getEdit()
    + JDK-8195841: PNGImageReader.readNullTerminatedString() doesnt
    check for non-null terminated strings with length equal to
    maxLen
    + JDK-8196100: javax/swing/text/JTextComponent/5074573/
    /bug5074573.java fails
    + JDK-8199646: JShell tests: jdk/jshell/
    /FailOverDirectExecutionControlTest.java failed with
    java.lang.UnsupportedOperationException
    + JDK-8206925: Support the certificate_authorities extension
    + JDK-8207160: ClassReader::adjustMethodParams can potentially
    return null if the args list is empty
    + JDK-8207247: AARCH64: Enable Minimal and Client VM builds
    + JDK-8207404: MulticastSocket tests failing on AIX
    + JDK-8207779: Method::is_valid_method() compares 'this' with
    NULL
    + JDK-8208061: runtime/LoadClass/TestResize.java fails with
    "Load factor too high" when running in CDS mode.
    + JDK-8209459: TestSHA512MultiBlockIntrinsics failed on AArch64
    + JDK-8210443: Migrate Locale matching tests to JDK Repo.
    + JDK-8213231: ThreadSnapshot::_threadObj can become stale
    + JDK-8213483: ARM32: runtime/ErrorHandling/
    /ShowRegistersOnAssertTest.java jtreg test fail
    + JDK-8213725: JShell NullPointerException due to class file
    with unexpected package
    + JDK-8213794: ARM32: disable TypeProfiling,
    CriticalJNINatives, Serviceablity tests for ARM32
    + JDK-8213845: ARM32: Interpreter doesn't call result handler
    after native calls
    + JDK-8214128: ARM32: wrong stack alignment on
    Deoptimization::unpack_frames
    + JDK-8214512: ARM32: Jtreg test compiler/c2/Test8062950.java
    fails on ARM
    + JDK-8214854: JDWP: Unforseen output truncation in logging
    + JDK-8214922: Add vectorization support for fmin/fmax
    + JDK-8215009: GCC 8 compilation error in libjli
    + JDK-8216184: CDS/appCDS tests failed on Windows due to long
    path to a classlist file
    + JDK-8216259: AArch64: Vectorize Adler32 intrinsics
    + JDK-8216314: SIGILL in CodeHeapState::print_names()
    + JDK-8217348: assert(thread-&gt;is_Java_thread()) failed: just
    checking
    + JDK-8217465: [REDO] - Optimize CodeHeap Analytics
    + JDK-8217561: X86: Add floating-point Math.min/max intrinsics
    + JDK-8217918: C2: -XX:+AggressiveUnboxing is broken
    + JDK-8218458: [TESTBUG] runtime/NMT/
    /CheckForProperDetailStackTrace.java fails with Expected
    stack trace missing from output
    + JDK-8219142: Remove unused JIMAGE_ResourcePath
    + JDK-8219586: CodeHeap State Analytics processes dead nmethods
    + JDK-8220074: Clean up GCC 8.3 errors in LittleCMS
    + JDK-8220407: compiler/intrinsics/math/
    /TestFpMinMaxIntrinsics.java timedout
    + JDK-8222302: [TESTBUG] test/hotspot/jtreg/compiler/intrinsics/
    /sha/cli/TestUseSHAOptionOnUnsupportedCPU.java fails on any
    other CPU
    + JDK-8222412: AARCH64: multiple instructions encoding issues
    + JDK-8223020: aarch64: expand minI_rReg and maxI_rReg patterns
    into separate instructions
    + JDK-8223444: Improve CodeHeap Free Space Management
    + JDK-8223504: Improve performance of forall loops by better
    inlining of "iterator()" methods
    + JDK-8223667: ASAN build broken
    + JDK-8225081: Remove Telia Company CA certificate expiring in
    April 2021
    + JDK-8225116: Test OwnedWindowsLeak.java intermittently fails
    + JDK-8225438: javax/net/ssl/TLSCommon/
    /TestSessionLocalPrincipal.java failed with Read timed out
    + JDK-8225756: [testbug] compiler/loopstripmining/
    /CheckLoopStripMining.java sets too short a
    SafepointTimeoutDelay
    + JDK-8226374: Restrict TLS signature schemes and named groups
    + JDK-8226627: assert(t-&gt;singleton()) failed: must be a constant
    + JDK-8226721: Missing intrinsics for Math.ceil, floor, rint
    + JDK-8227080: (fs) Files.newInputStream(...).skip(n) is slow
    + JDK-8227222: vmTestbase/jit/FloatingPoint/gen_math/Loops04/
    /Loops04.java failed XMM register should be 0-15
    + JDK-8227609: (fs) Files.newInputStream(...).skip(n) should
    allow skipping beyond file size
    + JDK-8230428: Cleanup dead CastIP node code in formssel.cpp
    + JDK-8231460: Performance issue (CodeHeap) with large free
    blocks
    + JDK-8231713: x86_32 build failures after JDK-8226721 (Missing
    intrinsics for Math.ceil, floor, rint)
    + JDK-8231841: AArch64: debug.cpp help() is missing an AArch64
    line for pns
    + JDK-8232084: HotSpot build failed with GCC 9.2.1
    + JDK-8232591: AArch64: Add missing match rules for smaddl,
    smsubl and smnegl
    + JDK-8233185: HttpServer.stop() blocks indefinitely when
    called on dispatch thread
    + JDK-8233787: Break cycle in vm_version* includes
    + JDK-8233948: AArch64: Incorrect mapping between OptoReg and
    VMReg for high 64 bits of Vector Register
    + JDK-8234355: Buffer overflow in jcmd GC.class_stats due to
    too many classes
    + JDK-8235368: Update BCEL to Version 6.4.1
    + JDK-8236859: WebSocket over authenticating proxy fails with
    NPE
    + JDK-8236992: AArch64: remove redundant load_klass in itable
    stub
    + JDK-8237743: test/langtools/jdk/jshell/
    /FailOverExecutionControlTest.java fails No
    ExecutionControlProvider with name 'nonExistent' and parameter
    keys: []
    + JDK-8237804: sun/security/mscapi tests fail with "Key pair
    not generated, alias &lt;nnnnnn&gt; already exists"
    + JDK-8238175: CTW: Class.getDeclaredMethods fails with
    assert(k-&gt;is_subclass_of(SystemDictionary::Throwable_klass()))
    failed: invalid exception class
    + JDK-8238567: SoftMainMixer.processAudioBuffers(): Wrong
    handling of stoppedMixers
    + JDK-8238812: assert(false) failed: bad AD file
    + JDK-8239312: [macos] javax/swing/JFrame/NSTexturedJFrame/
    /NSTexturedJFrame.java
    + JDK-8239386: handle ContendedPaddingWidth in
    vm_version_aarch64
    + JDK-8239536: Can't use 'java.util.List' object after
    importing 'java.awt.List'
    + JDK-8240487: Cleanup whitespace in .cc, .hh, .m, and .mm files
    + JDK-8240848: ArrayIndexOutOfBoundsException buf for
    TextCallbackHandler
    + JDK-8241082: Upgrade IANA Language Subtag Registry data to
    03-16-2020 version
    + JDK-8241087: Build failure with VS 2019 (16.5.0) due to C2039
    and C2873
    + JDK-8241101: [s390] jtreg test failure after JDK-8238696: not
    conformant features string
    + JDK-8241248: NullPointerException in
    sun.security.ssl.HKDF.extract(HKDF.java:93)
    + JDK-8241372: Several test failures due to
    javax.net.ssl.SSLException: Connection reset
    + JDK-8241475: AArch64: Add missing support for PopCountVI node
    + JDK-8241829: Cleanup the code for PrinterJob on windows
    + JDK-8241960: The SHA3 message digests impl of SUN provider
    are not thread safe after cloned
    + JDK-8242010: Upgrade IANA Language Subtag Registry to Version
    2020-04-01
    + JDK-8242429: Better implementation for sign extract
    + JDK-8242557: Add length limit for strings in PNGImageWriter
    + JDK-8242919: Paste locks up jshell
    + JDK-8243155: AArch64: Add support for SqrtVF
    + JDK-8243240: AArch64: Add support for MulVB
    + JDK-8243452: JFR: Could not create chunk in repository with
    over 200 recordings
    + JDK-8243559: Remove root certificates with 1024-bit keys
    + JDK-8243597: AArch64: Add support for integer vector abs
    + JDK-8244031: HttpClient should have more tests for HEAD
    requests
    + JDK-8244205: HTTP/2 tunnel connections through proxy may be
    reused regardless of which proxy is selected
    + JDK-8244847: Linux/PPC: runtime/CompressedOops/
    /CompressedClassPointers: smallHeapTest fails
    + JDK-8245511: G1 adaptive IHOP does not account for
    reclamation of humongous objects by young GC
    + JDK-8246274: G1 old gen allocation tracking is not in a
    separate class
    + JDK-8247354: [aarch64] PopFrame causes
    assert(oopDesc::is_oop(obj)) failed: not an oop
    + JDK-8247408: IdealGraph bit check expression canonicalization
    + JDK-8247432: Update IANA Language Subtag Registry to Version
    2020-09-29
    + JDK-8247438: JShell: When FailOverExecutionControlProvider
    fails the proximal cause is not shown
    + JDK-8247753: UIManager.getSytemLookAndFeelClassName() returns
    wrong value on Fedora 32
    + JDK-8248043: Need to eliminate excessive i2l conversions
    + JDK-8248411: [aarch64] Insufficient error handling when
    CodeBuffer is exhausted
    + JDK-8248568: compiler/c2/TestBit.java failed: test missing
    from stdout/stderr
    + JDK-8248870: AARCH64: I2L/L2I conversions can be skipped for
    masked positive values
    + JDK-8249142: java/awt/FontClass/CreateFont/DeleteFont.sh is
    unstable
    + JDK-8249189: AARCH64: more L2I conversions can be skipped
    + JDK-8249719: MethodHandle performance suffers from bad
    ResolvedMethodTable hash function
    + JDK-8249875: GCC 10 warnings -Wtype-limits with JFR code
    + JDK-8250635: MethodArityHistogram should use Compile_lock in
    favour of fancy checks
    + JDK-8250876: Fix issues with cross-compile on macos
    + JDK-8251031: Some vmTestbase/nsk/monitoring/RuntimeMXBean
    tests fail with hostnames starting from digits
    + JDK-8251525: AARCH64: Faster Math.signum(fp)
    + JDK-8252259: AArch64: Adjust default value of FLOATPRESSURE
    + JDK-8252311: AArch64: save two words in itable lookup stub
    + JDK-8252779: compiler/graalunit/HotspotTest.java failed after
    8251525
    + JDK-8252883: AccessDeniedException caused by delayed file
    deletion on Windows
    + JDK-8253167: ARM32 builds fail after JDK-8247910
    + JDK-8253572: [windows] CDS archive may fail to open with long
    file names
    + JDK-8253923: C2 doesn't always run loop opts for compilations
    that include loops
    + JDK-8253948: Memory leak in ImageFileReader
    + JDK-8254631: Better support ALPN byte wire values in SunJSSE
    + JDK-8254717: isAssignableFrom checks in
    KeyFactorySpi.engineGetKeySpec appear to be backwards
    + JDK-8255086: Update the root locale display names
    + JDK-8255625: AArch64: Implement Base64.encodeBlock
    accelerator/intrinsic
    + JDK-8255763: C2: OSR miscompilation caused by invalid memory
    instruction placement
    + JDK-8255992: JFR EventWriter does not use first string from
    StringPool with id 0
    + JDK-8256037: [TESTBUG] com/sun/jndi/dns/ConfigTests/
    /PortUnreachable.java fails due to the hard coded threshold
    is small
    + JDK-8256244: java/lang/ProcessHandle/PermissionTest.java
    fails with TestNG 7.1
    + JDK-8256287: [windows] add loop fuse to
    map_or_reserve_memory_aligned
    + JDK-8256523: Streamline Java SHA2 implementation
    + JDK-8257414: Drag n Drop target area is wrong on high DPI
    systems
    + JDK-8257569: Failure observed with
    JfrVirtualMemory::initialize
    + JDK-8257574: C2: "failed: parsing found no loops but there
    are some" assert failure
    + JDK-8257580: Bump update version for OpenJDK: jdk-11.0.12
    + JDK-8257604: JNI_ArgumentPusherVaArg leaks valist
    + JDK-8257621: JFR StringPool misses cached items across
    consecutive recordings
    + JDK-8257796: [TESTBUG]
    TestUseSHA512IntrinsicsOptionOnSupportedCPU.java fails
    on x86_32
    + JDK-8257822: C2 crashes with SIGFPE due to a division that
    floats above its zero check
    + JDK-8257828: SafeFetch may crash if invoked in non-JavaThreads
    + JDK-8257853: Remove dependencies on JNF's JNI utility
    functions in AWT and 2D code
    + JDK-8257858: [macOS]: Remove JNF dependency from
    libosxsecurity/KeystoreImpl.m
    + JDK-8257860: [macOS]: Remove JNF dependency from
    libosxkrb5/SCDynamicStoreConfig.m
    + JDK-8257988: Remove JNF dependency from
    libsaproc/MacosxDebuggerLocal.m
    + JDK-8258414: OldObjectSample events too expensive
    + JDK-8258505: [TESTBUG] TestDivZeroWithSplitIf.java fails due
    to missing UnlockDiagnosticVMOptions
    + JDK-8258753: StartTlsResponse.close() hangs due to
    synchronization issues
    + JDK-8259061: C2: assert(found) failed: memory-writing node is
    not placed in its original loop or an ancestor of it
    + JDK-8259227: C2 crashes with SIGFPE due to a division that
    floats above its zero check
    + JDK-8259232: Bad JNI lookup during printing
    + JDK-8259276: C2: Empty expression stack when reexecuting
    tableswitch/lookupswitch instructions after deoptimization
    + JDK-8259343: [macOS] Update JNI error handling in Cocoa code.
    + JDK-8259585: Accessible actions do not work on mac os x
    + JDK-8259651: [macOS] Replace JNF_COCOA_ENTER/EXIT macros
    + JDK-8259662: Don't wrap SocketExceptions into SSLExceptions
    in SSLSocketImpl
    + JDK-8259710: Inlining trace leaks memory
    + JDK-8259729: Missed JNFInstanceOf -&gt; IsInstanceOf conversion
    + JDK-8259777: Incorrect predication condition generated by ADLC
    + JDK-8259786: initialize last parameter of getpwuid_r
    + JDK-8259843: initialize dli_fname array before calling
    dll_address_to_library_name
    + JDK-8259869: [macOS] Remove desktop module dependencies on
    JNF Reference APIs
    + JDK-8259886: Improve SSL session cache performance and
    scalability
    + JDK-8259983: do not use uninitialized expand_ms value in
    G1CollectedHeap::expand_heap_after_young_collection
    + JDK-8260030: Improve stringStream buffer handling
    + JDK-8260236: better init AnnotationCollector _contended_group
    + JDK-8260255: C1: LoopInvariantCodeMotion constructor can
    leave some fields uninitialized
    + JDK-8260284: C2: assert(_base == Int) failed: Not an Int
    + JDK-8260380: Upgrade to LittleCMS 2.12
    + JDK-8260420: C2 compilation fails with assert(found_sfpt)
    failed: no node in loop that's not input to safepoint
    + JDK-8260426: awt debug_mem.c DMem_AllocateBlock might leak
    memory
    + JDK-8260432: allocateSpaceForGP in freetypeScaler.c might
    leak memory
    + JDK-8260616: Removing remaining JNF dependencies in the
    java.desktop module
    + JDK-8260653: Unreachable nodes keep speculative types alive
    + JDK-8260707: java/lang/instrument/PremainClass/
    /InheritAgent0100.java times out
    + JDK-8260925: HttpsURLConnection does not work  with other
    JSSE provider.
    + JDK-8260926: Trace resource exhausted events unconditionally
    + JDK-8261020: Wrong format parameter in
    create_emergency_chunk_path
    + JDK-8261027: AArch64: Support for LSE atomics C++ HotSpot code
    + JDK-8261167: print_process_memory_info add a close call after
    fopen
    + JDK-8261170: Upgrade to freetype 2.10.4
    + JDK-8261198: [macOS] Incorrect JNI parameters in number
    conversion in A11Y code
    + JDK-8261235: C1 compilation fails with
    assert(res-&gt;vreg_number() == index) failed: conversion check
    + JDK-8261261: The version extra fields needs to be overridable
    in jib-profiles.js
    + JDK-8261262: Kitchensink24HStress.java crashed with
    EXCEPTION_ACCESS_VIOLATION
    + JDK-8261354: SIGSEGV at MethodIteratorHost
    + JDK-8261355: No data buffering in SunPKCS11 Cipher encryption
    when the underlying mechanism has no padding
    + JDK-8261397: try catch Method failing to work when dividing
    an integer by 0
    + JDK-8261422: Adjust problematic String.format calls in
    jdk/internal/util/Preconditions.java outOfBoundsMessage
    + JDK-8261447: MethodInvocationCounters frequently run into
    overflow
    + JDK-8261481: Cannot read Kerberos settings in dynamic store
    on macOS Big Sur
    + JDK-8261505: Test test/hotspot/jtreg/gc/parallel/
    /TestDynShrinkHeap.java killed by Linux OOM Killer
    + JDK-8261601: free memory in early return in
    Java_sun_nio_ch_sctp_SctpChannelImpl_receive0
    + JDK-8261649: AArch64: Optimize LSE atomics in C++ code
    + JDK-8261730: C2 compilation fails with
    assert(store-&gt;find_edge(load) != -1) failed: missing
    precedence edge
    + JDK-8261752: Multiple GC test are missing memory requirements
    + JDK-8261791: (sctp) handleSendFailed in SctpChannelImpl.c
    potential leaks
    + JDK-8261812: C2 compilation fails with assert(!had_error)
    failed: bad dominance
    + JDK-8261914: IfNode::fold_compares_helper faces
    non-canonicalized bool when running JRuby JSON workload
    + JDK-8262093: java/util/concurrent/tck/JSR166TestCase.java
    failed "assert(false) failed: unexpected node"
    + JDK-8262110: DST starts from incorrect time in 2038
    + JDK-8262121: [11u] Redo 8244287: JFR: Methods samples have
    line number 0
    + JDK-8262163: Extend settings printout in jcmd VM.metaspace
    + JDK-8262295: C2: Out-of-Bounds Array Load from Clone Source
    + JDK-8262298: G1BarrierSetC2::step_over_gc_barrier fails with
    assert "bad barrier shape"
    + JDK-8262446: DragAndDrop hangs on Windows
    + JDK-8262461: handle wcstombsdmp return value correctly in
    unix awt_InputMethod.c
    + JDK-8262465: Very long compilation times and high memory
    consumption in C2 debug builds
    + JDK-8262726: AArch64: C1 StubAssembler::call_RT can corrupt
    stack
    + JDK-8262739: String inflation C2 intrinsic prevents insertion
    of anti-dependencies
    + JDK-8262829: Native crash in
    Win32PrintServiceLookup.getAllPrinterNames()
    + JDK-8262837: handle split_USE correctly
    + JDK-8262900: ToolBasicTest fails to access HTTP server it
    starts
    + JDK-8263260: [s390] Support latest hardware (z14 and z15)
    + JDK-8263311: Watch registry changes for remote printers
    update instead of polling
    + JDK-8263361: Incorrect arraycopy stub selected by C2 for SATB
    collectors
    + JDK-8263404: RsaPrivateKeySpec is always recognized as
    RSAPrivateCrtKeySpec in RSAKeyFactory.engineGetKeySpec
    + JDK-8263425: AArch64: two potential bugs in C1
    LIRGenerator::generate_address()
    + JDK-8263448: CTW: fatal error: meet not symmetric
    + JDK-8263504: Some OutputMachOpcodes fields are uninitialized
    + JDK-8263557: Possible NULL dereference in
    Arena::destruct_contents()
    + JDK-8263558: Possible NULL dereference in fast path arena
    free if ZapResourceArea is true
    + JDK-8263676: AArch64: one potential bug in C1
    LIRGenerator::generate_address()
    + JDK-8263729: [test] divert spurious output away from stream
    under test in ProcessBuilder Basic test
    + JDK-8263846: Bad JNI lookup getFocusOwner in accessibility
    code on Mac OS X
    + JDK-8264047: Duplicate global variable 'jvm' in libjavajpeg
    and libawt
    + JDK-8264096: slowdebug jvm crashes when StrInflatedCopy match
    rule is not supported
    + JDK-8264151: ciMethod::ensure_method_data() should return
    false is loading resulted in empty state
    + JDK-8264173: [s390] Improve Hardware Feature Detection And
    Reporting
    + JDK-8264190: Harden TLS interop tests
    + JDK-8264223: CodeHeap::verify fails extra_hops assertion in
    fastdebug test
    + JDK-8264328: Broken license in
    javax/swing/JComboBox/8072767/bug8072767.java
    + JDK-8264360: Loop strip mining verification fails with
    "should be on the backedge"
    + JDK-8264626: C1 should be able to inline excluded methods
    + JDK-8264640: CMS ParScanClosure misses a barrier
    + JDK-8264786: [macos] All Swing/AWT apps cause Allow
    Notifications prompt to appear when app is launched
    + JDK-8264821: DirectIOTest fails on a system with large block
    size
    + JDK-8264848: [macos] libjvm.dylib linker warning due to macOS
    version mismatch
    + JDK-8264923: PNGImageWriter.write_zTXt throws Exception with
    a typo
    + JDK-8264958: C2 compilation fails with assert "n is later
    than its clone"
    + JDK-8265099: Revert backport to 11u of 8236859: WebSocket
    over authenticating proxy fails with NPE
    + JDK-8265154: vinserti128 operand mix up for KNL platforms
    + JDK-8265239: Shenandoah: Shenandoah heap region count could
    be off by 1
    + JDK-8265417: Backport of JDK-8249672 breaks Solaris x86 build
    + JDK-8265421: java/lang/String/StringRepeat.java test is
    missing a memory requirement
    + JDK-8265462: Handle multiple slots in the NSS Internal Module
    from SunPKCS11's Secmod
    + JDK-8265537: x86 version string truncated after JDK-8249672
    11u backport
    + JDK-8265666: Enable AIX build platform to make external debug
    symbols
    + JDK-8265677: CMS: CardTableBarrierSet::write_ref_array_work()
    lacks storestore barrier
    + JDK-8265690: Use the latest Ubuntu base image version in
    Docker testing
    + JDK-8265718: Build failure after JDK-8258414 11u backport
    + JDK-8265750: Fatal error in safepoint.cpp after backport of
    8258414
    + JDK-8265784: [C2] Hoisting of DecodeN leaves MachTemp inputs
    behind
    + JDK-8265938: C2's conditional move optimization does not
    handle top Phi
    + JDK-8266220: keytool still prompt for store password on a
    password-less pkcs12 file if -storetype pkcs12 is specified
    + JDK-8266293: Key protection using PBEWithMD5AndDES fails with
    "java.security.InvalidAlgorithmParameterException: Salt must
    be 8 bytes long"
    + JDK-8266713: [AIX] Build failure after 11u backport of
    JDK-8247753
    + JDK-8266802: Shenandoah: Round up region size to page size
    unconditionally
    + JDK-8266892: avoid maybe-uninitialized gcc warnings on linux
    s390x
    + JDK-8266929: Unable to use algorithms from 3p providers
    + JDK-8267235: [macos_aarch64]
    InterpreterRuntime::throw_pending_exception messing up LR
    results in crash
    + JDK-8267561: Shenandoah: Reference processing not properly
    setup for outside of cycle degenerated GC
    + JDK-8267599: Revert the change to the default PKCS12
    macAlgorithm and macIterationCount props for 11u/8u/7u
    + JDK-8267641: [11u] 8227609 backport typo
    + JDK-8267721: Enable sun/security/pkcs11 tests for Amazon
    Linux 2 AArch64
    + JDK-8268678: LetsEncryptCA.java test fails as Let's Encrypt
    Authority X3 is retired</changelog>
  <changelog author="schwab@suse.de" date="1628078400">- riscv64-zero.patch: Add support for riscv64 (zero VM)</changelog>
  <changelog author="fstrba@suse.com" date="1629979200">- Added patch:
  * jdk11-glibc234.patch
    + fix build with glibc-2.34 (bsc#1189201)</changelog>
  <changelog author="fstrba@suse.com" date="1631534400">- Modified patch:
  * nss-security-provider.patch
    + revert recent changes making NSS provider the default one
    + fixes bsc#1190252</changelog>
  <changelog author="fstrba@suse.com" date="1631793600">- Added patch:
  * fips.patch
    + implement FIPS support in OpenJDK</changelog>
  <changelog author="fstrba@suse.com" date="1634817600">- Update to upstream tag jdk-11.0.13+8 (October 2021 CPU)
  * Security fixes
    + JDK-8163326, CVE-2021-35550, bsc#1191901: Update the default
    enabled cipher suites preference
    + JDK-8254967, CVE-2021-35565, bsc#1191909:
    com.sun.net.HttpsServer spins on TLS session close
    + JDK-8263314: Enhance XML Dsig modes
    + JDK-8265167, CVE-2021-35556, bsc#1191910: Richer Text Editors
    + JDK-8265574: Improve handling of sheets
    + JDK-8265580, CVE-2021-35559, bsc#1191911: Enhanced style for
    RTF kit
    + JDK-8265776: Improve Stream handling for SSL
    + JDK-8266097, CVE-2021-35561, bsc#1191912: Better hashing
    support
    + JDK-8266103: Better specified spec values
    + JDK-8266109: More Resilient Classloading
    + JDK-8266115: More Manifest Jar Loading
    + JDK-8266137, CVE-2021-35564, bsc#1191913: Improve Keystore
    integrity
    + JDK-8266689, CVE-2021-35567, bsc#1191903: More Constrained
    Delegation
    + JDK-8267086: ArrayIndexOutOfBoundsException in
    java.security.KeyFactory.generatePublic
    + JDK-8267712: Better LDAP reference processing
    + JDK-8267729, CVE-2021-35578, bsc#1191904: Improve TLS client
    handshaking
    + JDK-8267735, CVE-2021-35586, bsc#1191914: Better BMP support
    + JDK-8268193: Improve requests of certificates
    + JDK-8268199: Correct certificate requests
    + JDK-8268205: Enhance DTLS client handshake
    + JDK-8268506: More Manifest Digests
    + JDK-8269618, CVE-2021-35603, bsc#1191906: Better session
    identification
    + JDK-8269624: Enhance method selection support
    + JDK-8270398: Enhance canonicalization
    + JDK-8270404: Better canonicalization
  * Other changes
    + JDK-8024368: private methods are allocated vtable indices
    + JDK-8042902: Test java/net/Inet6Address/serialize/
    /Inet6AddressSerializationTest.java fails intermittently
    + JDK-8140466: ChaCha20 and Poly1305 TLS Cipher Suites
    + JDK-8157404: Unable to read certain PKCS12 keystores from
    SequenceInputStream
    + JDK-8158066: SourceDebugExtensionTest fails to rename file
    + JDK-8168304: Make all of DependencyContext_test available in
    product mode
    + JDK-8169246: java/net/DatagramSocket/ReportSocketClosed.java
    fails intermittently with BindException
    + JDK-8181313: SA: Remove libthread_db dependency on Linux
    + JDK-8193214: Incorrect annotations.without.processors
    warnings with JDK 9
    + JDK-8194230: jdk/internal/jrtfs/remote/
    /RemoteRuntimeImageTest.java fails with
    java.lang.NullPointerException
    + JDK-8196092: javax/swing/JComboBox/8032878/bug8032878.java
    fails
    + JDK-8199931: java/net/MulticastSocket/
    /UnreferencedMulticastSockets.java fails with "incorrect data
    received"
    + JDK-8206083: Make tools/javac/api/T6265137.java robust to JDK
    version changes
    + JDK-8206350: java/util/Locale/bcp47u/SystemPropertyTests.java
    failed on Mac 10.13 with zh_CN and zh_TW locales.
    + JDK-8207316: java/nio/channels/spi/SelectorProvider/
    /inheritedChannel/InheritedChannelTest.java failed
    + JDK-8208227: tools/jdeps/DotFileTest.java fails on Win-X64
    + JDK-8208363: test/jdk/java/lang/Package/
    /PackageFromManifest.java missing module dependencies
    declaration
    + JDK-8209380: ARM: cleanup maybe-uninitialized and reorder
    compiler warnings
    + JDK-8209768: Refactor java/util/prefs/CheckUserPrefsStorage.sh
    to plain java test
    + JDK-8209772: Refactor shell test java/util/ServiceLoader/
    /basic/basic.sh to java
    + JDK-8209773: Refactor shell test javax/naming/module/basic.sh
    to java
    + JDK-8209832: Refactor jdk/internal/reflect/Reflection/
    /GetCallerClassTest.sh to plain java test
    + JDK-8209930: Refactor java/util/zip/ZipFile/deletetempjar.sh
    to plain java test
    + JDK-8210406: Refactor java.util.PluggableLocale:i18n shell
    tests to plain java tests
    + JDK-8210407: Refactor java.util.Calendar:i18n shell tests to
    plain java tests
    + JDK-8210495: compiler crashes because of illegal signature in
    otherwise legal code
    + JDK-8210669: Some launcher tests assume a pre-JDK 9 run-time
    image layout
    + JDK-8210802: temp files left by tests in
    jdk/java/net/httpclient
    + JDK-8210819: Update the host name in CNameTest.java
    + JDK-8210908: Refactor java/util/prefs/PrefsSpi.sh to plain
    java test
    + JDK-8210934: Move sun/net/www/protocol/http/
    /GetErrorStream.java to OpenJDK
    + JDK-8210959: JShell fails and exits when statement throws an
    exception whose message contains a '%'.
    + JDK-8211055: Provide print to a file (PDF) feature even when
    printer was not connected
    + JDK-8211092: test/jdk/sun/net/www/http/HttpClient/
    /MultiThreadTest.java fails intermittently when cleaning up
    + JDK-8211296: Remove HotSpot deprecation warning suppression
    for Mac/clang
    + JDK-8211325: test/jdk/java/net/Socket/LingerTest.java fails
    with cleaning up
    + JDK-8212040: Compilation error due to wrong usage of
    NSPrintJobDispositionValue in mac10.12
    + JDK-8212695: Add explicit timeout to several HTTP Client tests
    + JDK-8212718: Refactor some annotation processor tests to
    better use collections
    + JDK-8213007: Update the link in test/jdk/sun/security/
    /provider/SecureRandom/DrbgCavp.java
    + JDK-8213137: Remove static initialization of monitor/mutex
    instances
    + JDK-8213235: java/nio/channels/SocketChannel/
    /AsyncCloseChannel.java fails with threads that didn't exit
    + JDK-8213409: Refactor sun.text.IntHashtable:i18n shell tests
    to plain java tests
    + JDK-8213576: Make test AsyncCloseChannel.java run in othervm
    + JDK-8213694: Test Timeout.java should run in othervm mode
    + JDK-8213718: [TEST] Wrong classname in vmTestbase/nsk/stress/
    /except/except002 and except003
    + JDK-8213922: fix ctw stand-alone build
    + JDK-8214195: Align stdout messages in
    test/jdk/java/math/BigInteger/PrimitiveConversionTests.java
    + JDK-8214520: [TEST_BUG] sun/security/mscapi/nonUniqueAliases/
    /NonUniqueAliases.java failed with incorrect jtreg tags order
    + JDK-8214937: sun/security/tools/jarsigner/warnings/
    /NoTimestampTest.java failed due to unexpected expiration date
    + JDK-8216532: tools/launcher/Test7029048.java fails (Solaris)
    + JDK-8217825: Verify @AfterTest is used correctly in WebSocket
    tests
    + JDK-8218145: block_if_requested is not proper inlined due to
    size
    + JDK-8219417: bump jtreg requiredVersion to b14
    + JDK-8219552: bump jtreg requiredVersion to b14 in
    test/jdk/sanity/client/
    + JDK-8219804: java/net/MulticastSocket/Promiscuous.java fails
    intermittently due to NumberFormatException
    + JDK-8220445: Support for side by side MSVC Toolset versions
    + JDK-8221988: add possibility to build with Visual Studio 2019
    + JDK-8222751: closed/test/jdk/sun/security/util/
    /DerIndefLenConverter/IndefBerPkcs12.java fail
    + JDK-8223050: JVMCI: findUniqueConcreteMethod() should not use
    Dependencies::find_unique_concrete_method() for non-virtual
    methods
    + JDK-8224853: CDS address sanitizer errors
    + JDK-8225082: Remove IdenTrust certificate that is expiring in
    September 2021
    + JDK-8225583: Examine the HttpResponse.BodySubscribers for
    null handling and multiple subscriptions
    + JDK-8225690: Multiple AttachListener threads can be created
    + JDK-8225790: Two NestedDialogs tests fail on Ubuntu
    + JDK-8226319: Add forgotten test/jdk/java/net/httpclient/
    /BodySubscribersTest.java
    + JDK-8226533: JVMCI: findUniqueConcreteMethod should handle
    statically bindable methods directly
    + JDK-8226602: Test convenience reactive primitives from
    java.net.http with RS TCK
    + JDK-8226683: Remove review suggestion from fix to 8219804
    + JDK-8227738: jvmti/DataDumpRequest/datadumpreq001 failed due
    to "exit code is 134"
    + JDK-8227766: CheckUnhandledOops is broken in MemAllocator
    + JDK-8227815: Minimal VM: set_state is not a member of
    AttachListener
    + JDK-8230674: Heap dumps should exclude dormant CDS archived
    objects of unloaded classes
    + JDK-8230808: Remove Access::equals()
    + JDK-8230841: Remove oopDesc::equals()
    + JDK-8231717: Improve performance of charset decoding when
    charset is always compactable
    + JDK-8232243: Wrong caret position in JTextPane on Windows
    with a screen resolution &gt; 100%
    + JDK-8232782: Shenandoah: streamline post-LRB CAS barrier
    (aarch64)
    + JDK-8233790: Forward output from heap dumper to jcmd/jmap
    + JDK-8233989: Create an IPv4 version of
    java/net/MulticastSocket/SetLoopbackMode.java
    + JDK-8234510: Remove file seeking requirement for writing a
    heap dump
    + JDK-8235211: serviceability/attach/
    /RemovingUnixDomainSocketTest.java fails with
    AttachNotSupportedException: Unable to open socket file
    + JDK-8235216: typo in test filename
    + JDK-8235866: bump jtreg requiredVersion to 4.2b16
    + JDK-8236111: narrow allowSmartActionArgs disabling
    + JDK-8236413: AbstractConnectTimeout should tolerate both
    NoRouteToHostException and UnresolvedAddressException
    + JDK-8236671: NullPointerException in JKS keystore
    + JDK-8238930: problem list compiler/c2/Test8004741.java
    + JDK-8238943: switch to jtreg 5.0
    + JDK-8240555: Using env of JAVA_TOOL_OPTIONS and _JAVA_OPTIONS
    breaks QuietOption.java test
    + JDK-8240983: Incorrect copyright header in Apache Santuario
    2.1.3 files
    + JDK-8241336: Some java.net tests failed with
    NoRouteToHostException on MacOS with special network
    configuration
    + JDK-8241353: NPE in ToolProvider.getSystemJavaCompiler
    + JDK-8241768: git needs .gitattributes
    + JDK-8242882: opening jar file with large manifest might throw
    NegativeArraySizeException
    + JDK-8244973: serviceability/attach/
    /RemovingUnixDomainSocketTest.java fails "stderr was not
    empty"
    + JDK-8245134: test/lib/jdk/test/lib/security/
    /KeyStoreUtils.java should allow to specify aliases
    + JDK-8246261: TCKLocalTime.java failed due to "AssertionError:
    expected [18:14:22] but found [18:14:23]"
    + JDK-8246387: switch to jtreg 5.1
    + JDK-8247421: [TESTBUG] ReturnBlobToWrongHeapTest.java failed
    allocating blob
    + JDK-8247469: getSystemCpuLoad() returns -1 on linux when some
    offline cpus are present and cpusets.effective_cpus is not
    available
    + JDK-8248352: [TEST_BUG] Test test/jdk/java/awt/font/
    /TextLayout/ArabicDiacriticTest.java can leave frame open
    + JDK-8248403: AArch64: Remove uses of kernel integer types
    + JDK-8248414: AArch64: Remove uses of long and unsigned long
    ints
    + JDK-8248657: Windows: strengthening in ThreadCritical
    regarding memory model
    + JDK-8248666: AArch64: Use THREAD_LOCAL instead of __thread
    + JDK-8248668: AArch64: Avoid MIN/MAX macros when using MSVC
    + JDK-8248671: AArch64: Remove unused variables
    + JDK-8248682: AArch64: Use ATTRIBUTE_ALIGNED helper
    + JDK-8248816: C1: Fix signature conflict in
    LIRGenerator::strength_reduce_multiply
    + JDK-8249095: tools/javac/launcher/SourceLauncherTest.java
    fails on Windows
    + JDK-8249548: backward focus traversal gets stuck in button
    group
    + JDK-8249773: Upgrade ReceiveISA.java test to be resilient to
    failure due to stray packets and interference
    + JDK-8249897: jdk/javadoc/tool/LangVers.java uses @ignore w/o
    bug-id
    + JDK-8249898: jdk/javadoc/tool/6176978/T6176978.java uses
    @ignore w/o bug-id
    + JDK-8249899: jdk/javadoc/tool/InlineTagsWithBraces.java uses
    @ignore w/o bug-id
    + JDK-8250588: Shenandoah: LRB needs to save/restore fp
    registers for runtime call
    + JDK-8250824: AArch64: follow up for JDK-8248414
    + JDK-8251166: Add automated testcases for changes done in
    JDK-8214112
    + JDK-8251252: Add automated testcase for fix done in
    JDK-8214253
    + JDK-8251254: Add automated test for fix done in JDK-8218472
    + JDK-8251361: Potential race between Logger configuration and
    GCs in HttpURLConWithProxy test
    + JDK-8251549: Update docs on building for Git
    + JDK-8251945: SIGSEGV in
    PackageEntry::purge_qualified_exports()
    + JDK-8252194: Add automated test for fix done in JDK-8218469
    + JDK-8252648: Shenandoah: name gang tasks consistently
    + JDK-8252825: Add automated test for fix done in JDK-8218479
    + JDK-8252853: AArch64: gc/shenandoah/TestVerifyJCStress.java
    fails intermittently with C1
    + JDK-8252857: AArch64: Shenandoah C1 CAS is not sequentially
    consistent
    + JDK-8253048: AArch64: When CallLeaf, no need to preserve
    callee-saved registers in caller
    + JDK-8253424: Add support for running pre-submit testing using
    GitHub Actions
    + JDK-8253631: Remove unimplemented CompileBroker methods after
    JEP-165
    + JDK-8253865: Pre-submit testing using GitHub Actions does not
    detect failures reliably
    + JDK-8253899: Make IsClassUnloadingEnabled signature match
    specification
    + JDK-8254024: Enhance native libs for AWT and Swing to work
    with GraalVM Native Image
    + JDK-8254054: Pre-submit testing using GitHub Actions should
    not use the deprecated set-env command
    + JDK-8254173: Add Zero, Minimal hotspot targets to submit
    workflow
    + JDK-8254175: Build no-pch configuration in debug mode for
    submit checks
    + JDK-8254244: Some code emitted by TemplateTable::branch is
    unused when running TieredCompilation
    + JDK-8254270: linux 32 bit build doesn't compile
    libjdwp/log_messages.c
    + JDK-8254282: Add Linux x86_32 builds to submit workflow
    + JDK-8254850: Update terminology in java.awt.GridBagLayout
    source code comments
    + JDK-8255255: Update Apache Santuario (XML Signature) to
    version 2.2.1
    + JDK-8255305: Add Linux x86_32 tier1 to submit workflow
    + JDK-8255352: Archive important test outputs in submit workflow
    + JDK-8255373: Submit workflow artifact name is always
    "test-results_.zip"
    + JDK-8255452: Doing GC during JVMTI MethodExit event posting
    breaks return oop
    + JDK-8255718: Zero: VM should know it runs in interpreter-only
    mode
    + JDK-8255790: GTKL&amp;F: Java 16 crashes on initialising GTKL&amp;F
    on Manjaro Linux
    + JDK-8255810: Zero: build fails without JVMTI
    + JDK-8255895: Submit workflow artifacts miss hs_errs/replays
    due to ZIP include mismatch
    + JDK-8256127: Add cross-compiled foreign architectures builds
    to submit workflow
    + JDK-8256215: Shenandoah: re-organize saving/restoring machine
    state in assembler code
    + JDK-8256267: Relax compiler/floatingpoint/NaNTest.java for
    x86_32 and lower -XX:+UseSSE
    + JDK-8256277: Github Action build on macOS should define OS
    and Xcode versions
    + JDK-8256354: Github Action build on Windows should define OS
    and MSVC versions
    + JDK-8256393: Github Actions build on Linux should define OS
    and GCC versions
    + JDK-8256414: add optimized build to submit workflow
    + JDK-8256747: GitHub Actions: decouple the hotspot build-only
    jobs from Linux x64 testing
    + JDK-8257056: Submit workflow should apt-get update to avoid
    package installation errors
    + JDK-8257148: Remove obsolete code in AWTView.m
    + JDK-8257497: Update keytool to create AKID from the SKID of
    the issuing certificate as specified by RFC 5280
    + JDK-8257620: Do not use objc_msgSend_stret to get macOS
    version
    + JDK-8257913: Add more known library locations to simplify
    Linux cross-compilation
    + JDK-8258703: Incorrect 512-bit vector registers restore on
    x86_32
    + JDK-8259338: Add expiry exception for identrustdstx3 alias to
    VerifyCACerts.java test
    + JDK-8259535: ECDSA SignatureValue do not always have the
    specified length
    + JDK-8259679: GitHub actions should use MSVC 14.28
    + JDK-8259924: GitHub actions fail on Linux x86_32 with "Could
    not configure libc6:i386"
    + JDK-8260460: GitHub actions still fail on Linux x86_32 with
    "Could not configure libc6:i386"
    + JDK-8260589: Crash in JfrTraceIdLoadBarrier::load(_jclass*)
    + JDK-8260923: Add more tests for SSLSocket input/output
    shutdown
    + JDK-8261072: AArch64: Fix MacroAssembler::get_thread
    convention
    + JDK-8261147: C2: Node is wrongly marked as reduction
    resulting in a wrong execution due to wrong vector instructions
    + JDK-8261238: NMT should not limit baselining by size threshold
    + JDK-8261496: Shenandoah: reconsider pacing updates memory
    ordering
    + JDK-8261652: Remove some dead comments from os_bsd_x86
    + JDK-8261846: [JVMCI] c2v_iterateFrames can get out of sync
    with the StackFrameStream
    + JDK-8262000: jdk/jfr/event/gc/detailed/
    /TestPromotionFailedEventWithParallelScavenge.java failed with
    "OutOfMemoryError: Java heap space"
    + JDK-8262017: C2: assert(n != __null) failed: Bad immediate
    dominator info.
    + JDK-8262392: Update Mesa 3-D Headers to version 21.0.3
    + JDK-8262409: sun/security/ssl/SSLSocketImpl/
    /SSLSocketImplThrowsWrongExceptions. SSL test failures caused
    by java failed with "Server reported the wrong exception"
    + JDK-8262470: Printed GlyphVector outline with low DPI has bad
    quality on Windows
    + JDK-8262862: Harden tests sun/security/x509/URICertStore/
    /ExtensionsWithLDAP.java and krb5/canonicalize/Test.java
    + JDK-8263136: C4530 was reported from VS 2019 at access bridge
    + JDK-8263227: C2: inconsistent spilling due to dead nodes in
    exception block
    + JDK-8263382: java/util/logging/ParentLoggersTest.java failed
    with "checkLoggers: getLoggerNames() returned unexpected
    loggers"
    + JDK-8263407: SPARC64 detection fails on Athena (SPARC64-X)
    + JDK-8263432: javac may report an invalid package/class clash
    on case insensitive filesystems
    + JDK-8263490: [macos] Crash occurs on JPasswordField with
    activated InputMethod
    + JDK-8263531: Remove unused buffer int
    + JDK-8263667: Avoid running GitHub actions on branches named
    pr/*
    + JDK-8263776: [JVMCI] add helper to perform Java upcalls
    + JDK-8264016: [JVMCI] add some thread local fields for use by
    JVMCI
    + JDK-8264752: SIGFPE crash with option
    FlightRecorderOptions:threadbuffersize=30M
    + JDK-8265132: C2 compilation fails with assert "missing
    precedence edge"
    + JDK-8265231: (fc) ReadDirect and WriteDirect tests fail after
    fix for JDK-8264821
    + JDK-8265335: Epsilon: Minor typo in EpsilonElasticTLABDecay
    description
    + JDK-8265756: AArch64: initialize memory allocated for locals
    according to Windows AArch64 stack page growth requirement in
    template interpreter
    + JDK-8265761: Font with missed font family name is not
    properly printed on Windows
    + JDK-8265773: incorrect jdeps message "jdk8internals" to
    describe a removed JDK internal API
    + JDK-8265836: OperatingSystemImpl.getCpuLoad() returns
    incorrect CPU load inside a container
    + JDK-8266018: Shenandoah: fix an incorrect assert
    + JDK-8266206: Build failure after JDK-8264752 with older GCCs
    + JDK-8266248: Compilation failure in
    PLATFORM_API_MacOSX_MidiUtils.c with Xcode 12.5
    + JDK-8266288: assert root method not found in
    witnessed_reabstraction_in_supers is too strong
    + JDK-8266404: Fatal error report generated with
  - XX:+CrashOnOutOfMemoryError should not contain suggestion to
    submit a bug report
    + JDK-8266480: Implicit null check optimization does not update
    control of hoisted memory operation
    + JDK-8266615: C2 incorrectly folds subtype checks involving an
    interface array
    + JDK-8266642: Improve ResolvedMethodTable hash function
    + JDK-8266749: AArch64: Backtracing broken on PAC enabled
    systems
    + JDK-8266761: AssertionError in
    sun.net.httpserver.ServerImpl.responseCompleted
    + JDK-8266813: Shenandoah: Use shorter instruction sequence for
    checking if marking in progress
    + JDK-8267042: bug in monitor locking/unlocking on ARM32 C1 due
    to uninitialized BasicObjectLock::_displaced_header
    + JDK-8267348: Rewrite gc/epsilon/TestClasses.java to use
    Metaspace with less classes
    + JDK-8267396: Avoid recording "pc" in unhandled oops detector
    for better performance
    + JDK-8267399: C2: java/text/Normalizer/ConformanceTest.java
    test failed with assertion
    + JDK-8267424: CTW: C1 fails with "State must not be null"
    + JDK-8267459: Pasting Unicode characters into JShell does not
    work.
    + JDK-8267625: AARCH64: typo in LIR_Assembler::emit_profile_type
    + JDK-8267666: Add option to jcmd GC.heap_dump to use existing
    file
    + JDK-8267695: Bump update version for OpenJDK: jdk-11.0.13
    + JDK-8267751: (test) jtreg.SkippedException has no serial
    VersionUID
    + JDK-8267773: PhaseStringOpts::int_stringSize doesn't handle
    min_jint correctly
    + JDK-8268103: JNI functions incorrectly return a double after
    JDK-8265836
    + JDK-8268127: Shenandoah: Heap size may be too small for
    region to align to large page size
    + JDK-8268261: C2: assert(n != __null) failed: Bad immediate
    dominator info.
    + JDK-8268347: C2: nested locks optimization may create
    unbalanced monitor enter/exit code
    + JDK-8268360: Missing check for infinite loop during node
    placement
    + JDK-8268362: [REDO] C2 crash when compile negative
    Arrays.copyOf length after loop
    + JDK-8268366: Incorrect calculation of has_fpu_registers in C1
    linear scan
    + JDK-8268369: SIGSEGV in PhaseCFG::implicit_null_check due to
    missing null check
    + JDK-8268417: Add test from JDK-8268360
    + JDK-8268427: Improve AlgorithmConstraints:checkAlgorithm
    performance
    + JDK-8268617: [11u REDO] - WebSocket over authenticating proxy
    fails with NPE
    + JDK-8268620: InfiniteLoopException test may fail on x86
    platforms
    + JDK-8268635: Corrupt oop in ClassLoaderData
    + JDK-8268699: Shenandoah: Add test for JDK-8268127
    + JDK-8268771: javadoc -notimestamp option does not work on
    index.html
    + JDK-8268775: Password is being converted to String in
    AccessibleJPasswordField
    + JDK-8268776: Test `ADatagramSocket.java` missing /othervm
    from @run tag
    + JDK-8268965: TCP Connection Reset when connecting simple
    socket to SSL server
    + JDK-8269304: Regression ~5% in 2005 in b27
    + JDK-8269415: [11u] Remove ea from
    DEFAULT_PROMOTED_VERSION_PRE in OpenJDK 11u
    + JDK-8269478: Shenandoah: gc/shenandoah/mxbeans tests should
    be more resilient
    + JDK-8269529: javax/swing/reliability/
    /HangDuringStaticInitialization.java fails in Windows debug
    build
    + JDK-8269594: assert(_handle_mark_nesting &gt; 1) failed: memory
    leak: allocating handle outside HandleMark
    + JDK-8269614: [s390] Interpreter checks wrong bit for slow
    path instance allocation
    + JDK-8269650: Optimize gc-locker in
    [Get|Release]StringCritical for latin string
    + JDK-8269661: JNI_GetStringCritical does not lock char array
    + JDK-8269668: [aarch64] java.library.path not including
    /usr/lib64
    + JDK-8269763: The JEditorPane is blank after JDK-8265167
    + JDK-8269795: C2: Out of bounds array load floats above its
    range check in loop peeling resulting in SEGV
    + JDK-8269847: JDK-8269594 backport breaks 11u builds
    + JDK-8269850: Most JDK releases report macOS version 12 as
    10.16 instead of 12.0
    + JDK-8269851: OperatingSystemMXBean getProcessCpuLoad reports
    incorrect process cpu usage in containers
    + JDK-8269882: stack-use-after-scope in NewObjectA
    + JDK-8269934: RunThese24H.java failed with
    EXCEPTION_ACCESS_VIOLATION in
    java_lang_Thread::get_thread_status
    + JDK-8270096: Shenandoah: Optimize gc/shenandoah/
    /TestRefprocSanity.java for interpreter mode
    + JDK-8270137: Kerberos Credential Retrieval from Cache not
    Working in Cross-Realm Setup
    + JDK-8270184: [TESTBUG] Add coverage for jvmci
    ResolvedJavaType.toJavaName() for lambdas
    + JDK-8270196: [11u] [JVMCI] JavaType.toJavaName() returns
    incorrect type name for lambdas
    + JDK-8270556: Exclude security/infra/java/security/cert/
    /CertPathValidator/certification/LetsEncryptCA
    + JDK-8270893: IndexOutOfBoundsException while reading large
    TIFF file
    + JDK-8272078: Wrong Checksums in Temurin BootJDK dependencies
    + JDK-8272124: Cgroup v1 initialization causes
    NullPointerException when cgroup path contains colon
    + JDK-8272131: PhaseMacroExpand::generate_slow_arraycopy crash
    when clone null CallProjections.fallthrough_ioproj
    + JDK-8272197: Update 11u GHA workflow with Shenandoah
    configurations
    + JDK-8272332: --with-harfbuzz=system doesn't add -lharfbuzz
    after JDK-8255790
    + JDK-8272472: StackGuardPages test doesn't build with glibc
    2.34
    + JDK-8272602: [macos] not all KEY_PRESSED events sent when
    control modifier is used
    + JDK-8272628: Problemlist gc/stress/gcbasher/
    /TestGCBasherWithCMS.java for x86_32
    + JDK-8272700: [macos] Build failure with Xcode 13.0 after
    JDK-8264848
    + JDK-8272772: Shenandoah: compiler/c2/aarch64/
    /TestVolatilesShenandoah.java fails in 11u
    + JDK-8273939: Backport of 8248414 to JDK11 breaks
    MacroAssembler::adrp
- Remove the unneeded icedtea-sound provider
- Removed patches:
  * icedtea-sound-1.0.1-jdk9.patch
  * icedtea-sound-soundproperties.patch
    + not needed since the icedtea-sound provider is removed
  * jdk11-glibc234.patch
    + integrated upstream</changelog>
  <changelog author="fstrba@suse.com" date="1635940800">- Modified patches:
  * system-crypto-policy.patch
    + rediff to changed context
  * fips.patch
    + Allow plain key import in fips mode unless
    com.suse.fips.plainKeySupport is set to false</changelog>
  <changelog author="fstrba@suse.com" date="1636113600">- Modified patch:
  * fips.patch
    + return in native code after generating java.io.IOException</changelog>
</package>
<package pkgid="156d261d0292162b970a4d17660242f2d28729845c14c18a69594d5771d457bb" name="java-11-openjdk-devel" arch="ppc64le">
  <version epoch="0" ver="11.0.13.0" rel="3.68.1"/>
  <changelog author="fstrba@suse.com" date="1586952000">- The pack200 and unpack200 alternatives should be slaves of java
  and not of javac, since they are part of JRE.</changelog>
  <changelog author="fstrba@suse.com" date="1587470400">- Update to upstream tag jdk-11.0.7+10 (April 2020 CPU,
  bsc#1169511)
  * Security fixes:
    + S8223898, CVE-2020-2754: Forward references to Nashorn
    + S8223904, CVE-2020-2755: Improve Nashorn matching
    + S8224541, CVE-2020-2756: Better mapping of serial ENUMs
    + S8224549, CVE-2020-2757: Less Blocking Array Queues
    + S8225603: Enhancement for big integers
    + S8226346: Build better binary builders
    + S8227467: Better class method invocations
    + S8227542: Manifest improved jar headers
    + S8229733: TLS message handling improvements
    + S8231415, CVE-2020-2773: Better signatures in XML
    + S8231785: Improved socket permissions
    + S8232424, CVE-2020-2778: More constrained algorithms
    + S8232581, CVE-2020-2767: Improve TLS verification
    + S8233250: Better X11 rendering
    + S8233410: Better Build Scripting
    + S8234027: Better JCEKS key support
    + S8234408, CVE-2020-2781: Improve TLS session handling
    + S8234825, CVE-2020-2800: Better Headings for HTTP Servers
    + S8234841, CVE-2020-2803: Enhance buffering of byte buffers
    + S8235274, CVE-2020-2805: Enhance typing of methods
    + S8235691, CVE-2020-2816: Enhance TLS connectivity
    + S8236201, CVE-2020-2830: Better Scanner conversions
    + S8238960: linux-i586 builds are inconsistent as the newly
    built jdk is not able to reserve enough space for object heap
  * Other changes:
    + S4919790: Errors in alert ssl message does not reflect the
    actual certificate status
    + S4949105: Access Bridge lacks html tags parsing
    + S7092821: java.security.Provider.getService() is synchronized
    and became scalability bottleneck
    + S7143743: Potential memory leak with zip provider
    + S8005819: Support cross-realm MSSFU
    + S8042383: [TEST_BUG] Test javax/swing/plaf/basic/BasicMenuUI/
    /4983388/bug4983388.java fails with shortcuts on menus do not
    work
    + S8068184: Fix for JDK-8032832 caused a deadlock
    + S8145845: [AOT] NullPointerException in
    compiler/whitebox/GetCodeHeapEntriesTest.java
    + S8152988: [AOT] Update test batch definitions to include
    aot-ed java.base module mode into hs-comp testing
    + S8160926: FLAGS_COMPILER_CHECK_ARGUMENTS doesn't handle
    cross-compilation
    + S8163083: SocketListeningConnector does not allow invocations
    with port 0
    + S8163251: Hard coded loop limit prevents reading of smart
    card data greater than 8k
    + S8167276: jvmci/compilerToVM/MaterializeVirtualObjectTest.java
    fails with -XX:-EliminateAllocations
    + S8169718: nsk/jdb/locals/locals002: ERROR: Cannot find
    boolVar with expected value: false
    + S8176556:
    java/awt/dnd/ImageTransferTest/ImageTransferTest.java fails
    for JFIF
    + S8178798: Two compiler/aot/verification/vmflags tests fail by
    timeout with UseAVX=3
    + S8183107: PKCS11 regression regarding checkKeySize
    + S8185005: Improve performance of
    ThreadMXBean.getThreadInfo(long ids[], int maxDepth)
    + S8189633: Missing -Xcheck:jni checking for DeleteWeakGlobalRef
    + S8189861: Refactor CacheFind
    + S8193042: NativeLookup::lookup_critical_entry() should only
    load shared library once
    + S8193596: java/net/DatagramPacket/ReuseBuf.java failed due to
    timeout
    + S8194944: Regression automated test 'open/test/jdk/javax/
    /swing/JInternalFrame/8145896/TestJInternalFrameMaximize.java'
    fails
    + S8196467: javax/swing/JInternalFrame/Test6325652.java fails
    + S8196969: JTreg Failure: serviceability/sa/ClhsdbJstack.java
    causes NPE
    + S8198321: javax/swing/JEditorPane/5076514/bug5076514.java
    fails
    + S8198398: Test javax/swing/JColorChooser/Test6199676.java
    fails in mach5
    + S8199072: Test javax/swing/GroupLayout/6613904/
    /bug6613904.java is unstable
    + S8200432: javadoc fails with ClassCastException on {@link
    byte[]}
    + S8201349: build broken when configured with
  - -with-zlib=bundled on gcc 7.3
    + S8201355: Avoid native memory allocation in
    sun.security.mscapi.PRNG.generateSeed
    + S8201513: nsk/jvmti/IterateThroughHeap/filter-* are broken
    + S8203364: Some serviceability/sa/ tests intermittently fail
    with java.io.IOException: LingeredApp terminated with non-zero
    exit code 3
    + S8203687: javax/net/ssl/compatibility/Compatibility.java
    supports TLS 1.3
    + S8203904: javax/swing/JSplitPane/4816114/bug4816114.java: The
    divider location is wrong
    + S8203911: Test runtime/modules/getModuleJNI/GetModule fails
    with -Xcheck:jni
    + S8204525: [TESTBUG] runtime/NMT/MallocStressTest.java ran out
    of java heap
    + S8204529: gc/TestAllocateHeapAtMultiple.java fail with Agent
    7 timed out
    + S8204551: Event descriptions are truncated in logs
    + S8206963: [AOT] bug with multiple class loaders
    + S8207367: 10 vmTestbase/nsk/jdi tests timed out when running
    with jtreg
    + S8207832: serviceability/sa/ClhsdbCDSCore.java failed with
    "Couldn't find core file location"
    + S8207938: At step6,Click Add button,case failed automatically.
    + S8208157: requires.VMProps throws NPE for missing properties
    in "release" file
    + S8208379: compiler/jvmci/events/
    /JvmciNotifyInstallEventTest.java failed with "Got unexpected
    event count after 2nd install attempt: expected 9 to equal 2"
    + S8208658: Make CDS archived heap regions usable even if
    compressed oop encoding has changed
    + S8208715: Conversion of milliseconds to nanoseconds in
    UNIXProcess contains bug
    + S8209361: [AOT] Unexpected number of references for
    JVMTI_HEAP_REFERENCE_CONSTANT_POOL [111--&gt;111]: 0 (expected
    at least 1)
    + S8209385: CDS runtime classpath checking is too strict when
    only classes from the system modules are archived
    + S8209389: SIGSEGV in WalkOopAndArchiveClosure::do_oop_work.
    + S8209418: Synchronize test/jdk/sanity/client/lib/jemmy with
    code-tools/jemmy/v2
    + S8209494: Create a test for SwingSet InternalFrameDemo
    + S8209499: Create test for SwingSet EditorPaneDemo
    + S8209574: [AOT] breakpoint events are generated in different
    threads does not meet expected count
    + S8209686: cleanup arguments to PhaseIdealLoop() constructor
    + S8209789: Synchronize test/jdk/sanity/client/lib/jemmy with
    code-tools/jemmy/v2
    + S8209802: Garbage collectors should register JFR types
    themselves to avoid build errors.
    + S8209807: improve handling exception in requires.VMProps
    + S8209817: stack is executable when building with Clang on
    Linux
    + S8209824: Improve the code coverage for ThreadLocal
    + S8209826: Undefined reference to os::write after JDK-8209657
    (filemap.hpp cleanup)
    + S8209850: Allow NamedThreads to use GlobalCounter critical
    sections
    + S8209976: Improve iteration over non-JavaThreads
    + S8209993: Create a test for SwingSet3 ToolTipDemo
    + S8210024: JFR calls virtual is_Java_thread from ~Thread()
    + S8210052: Enable testing for all the available look and feels
    in SwingSet3 demo tests
    + S8210055: Enable different look and feel tests in SwingSet3
    demo tests
    + S8210057: Enable different look and feels in SwingSet3 demo
    test InternalFrameDemoTest
    + S8210058: Algorithmic Italic font leans opposite angle in
    Printing
    + S8210220: [AOT] jdwp test cases are failing with error #
    ERROR: TEST FAILED: Cought IOException while receiving event
    packet
    + S8210289: ArchivedKlassSubGraphInfoRecord is incomplete
    + S8210459: Add support for generating compile_commands.json
    + S8210476: sun/security/mscapi/PrngSlow.java fails with Still
    too slow
    + S8210512: [Testbug] vmTestbase/nsk/jdi/ObjectReference/
    /referringObjects/referringObjects002/referringObjects002.java
    fails with unexpected size of
    ClassLoaderReference.referringObjects
    + S8210523: runtime/appcds/cacheObject/DifferentHeapSizes.java
    crash
    + S8210632: Add key exchange algorithm to
    javax/net/ssl/TLSCommon/CipherSuite.java
    + S8210699: Problem list tests which times out in Xcomp mode
    + S8210793: [JVMCI] AllocateCompileIdTest.java failed to find
    DiagnosticCommand.class
    + S8210910: Create test for FileChooserDemo
    + S8210994: Create test for SwingSet3 FrameDemo
    + S8211139: Increase timeout value in all tests under
    jdk/sanity/client/SwingSet/src
    + S8211160: Handle different look and feels in
    JInternalFrameOperator
    + S8211211: vmTestbase/metaspace/stressDictionary/
    /StressDictionary.java timeout
    + S8211322: Reduce the timeout of tooltip in SwingSet2DemoTest
    + S8211443: Enable different look and feels in SwingSet3 demo
    test SplitPaneDemoTest
    + S8211703: JInternalFrame : java.lang.AssertionError: cannot
    find the internal frame
    + S8211781: re-building fails after changing Graal sources
    + S8212897: Some improvements in the EditorPaneDemotest
    + S8212903: [TestBug] Tests test/jdk/javax/swing/LookAndFeel/
    /8145547/DemandGTK2.sh and DemandGTK3.sh fail on Ubuntu 18.04
    LTS
    + S8213009: Refactoring existing SunMSCAPI classes
    + S8213010: Supporting keys created with certmgr.exe
    + S8213168: Enable different look and feel tests in SwingSet3
    demo test FileChooserDemoTest
    + S8213348: jdk.internal.vm.compiler.management service
    providers missing in module descriptor
    + S8213906: Update arm devkits with libXrandr headers
    + S8213908: AssertionError in DeferredAttr at setOverloadKind
    + S8214124: [TESTBUG] Bugs in runtime/NMT/MallocStressTest.java
    + S8214344: C2: assert(con.basic_type() != T_ILLEGAL) failed:
    elembt=byte; loadbt=void; unsigned=0
    + S8214345: infinite recursion while checking super class
    + S8214471: Enable different look and feel tests in SwingSet3
    demo test ToolTipDemoTest
    + S8214534: Setting of THIS_FILE in the build is broken
    + S8214557: Filter out VM flags which don't affect AOT code
    generation
    + S8214578: [macos] Problem with backslashes on macOS/JIS
    keyboard: Java ignores system settings
    + S8214840: runtime/NMT/MallocStressTest.java timed out
    + S8214850: Rename vm_operations.?pp files to vmOperations.?pp
    files
    + S8214904: Test8004741.java failed due to "Too few ThreadDeath
    hits; expected at least 6 but saw only 5"
    + S8215322: add @file support to jaotc
    + S8215355: Object monitor deadlock with no threads holding the
    monitor (using jemalloc 5.1)
    + S8215396: JTabbedPane preferred size calculation is wrong for
    SCROLL_TAB_LAYOUT
    + S8216180: [AOT] compiler/intrinsics/bigInteger/TestMulAdd.java
    crashed with AOT enabled
    + S8216353: Use utility APIs introduced in org/netbeans/jemmy/
    /util/LookAndFeel class in client sanity test cases
    + S8216354: Syntax error in toolchain_windows.m4
    + S8216472: (se) Stack overflow during selection operation
    leads to crash (win)
    + S8216535: tools/jimage/JImageExtractTest.java timed out
    + S8217235: Create automated test for SwingSet
    ColorChooserDemoTest
    + S8217297: Add support for multiple look and feel for SwingSet
    SliderDemoTest
    + S8217338: [Containers] Improve systemd slice memory limit
    support
    + S8217613: [AOT] TEST_OPTS_AOT_MODULES doesn't work on mac
    + S8217634: RunTest documentation and usability update
    + S8217717: ZGC: Broken oop map in C1 load barrier stub
    + S8217728: Speed up incremental rerun of "make hotspot"
    + S8218268: Javac treats Manifest Class-Path entries as Paths
    instead of URLs
    + S8218662: Allow 204 responses with Content-Length:0
    + S8218882: NET_Writev is declared, NET_WriteV is defined
    + S8218889: Improperly use of the Optional API
    + S8219205: JFR file without license header
    + S8219597: (bf) Heap buffer state changes could provoke
    unexpected exceptions
    + S8219723: javax/net/ssl/compatibility/Compatibility.java
    failed on some SNI cases
    + S8220348: [ntintel] asserts about copying unaligned array
    + S8220451: jdi/EventQueue/remove/remove004 failed due to
    "ERROR: thread2 is not alive"
    + S8220456: jdi/EventQueue/remove_l/remove_l004 failed due to
    "TIMEOUT while waiting for event"
    + S8220479: java/nio/channels/Selector/SelectWithConsumer.java
    failed at testTwoChannels()
    + S8220613: java/util/Arrays/TimSortStackSize2.java times out
    with fastdebug build
    + S8220688: [TESTBUG] runtime/NMT/MallocStressTest.java timed
    out
    + S8220786: Create new switch to redirect error reporting
    output to stdout or stderr
    + S8221270: Duplicated synchronized keywords in SSLSocketImpl
    + S8221312: test/jdk/sanity/client/SwingSet/src/
    /ColorChooserDemoTest.java failed
    + S8221851: Use of THIS_FILE in hotspot invalidates precompiled
    header on Linux/GCC
    + S8221885: Add intermittent test in the JavaSound to the
    ProblemList
    + S8222264: Windows incremental build is broken with JDK-8217728
    + S8222391: javax/net/ssl/compatibility/Compatibility.java
    should be more flexible
    + S8222448: java/lang/reflect/PublicMethods/
    /PublicMethodsTest.java times out
    + S8222519: ButtonDemoScreenshotTest fails randomly with "still
    state to be reached"
    + S8222741: jdi/EventQueue/remove/remove004 fails due to
    VMDisconnectedException
    + S8223003: SunMSCAPI keys are not cleaned up
    + S8223063: Support CNG RSA keys
    + S8223158: Docked MacBook cannot start any Java Swing
    applications
    + S8223260: NamingManager should cache InitialContextFactory
    + S8223464: Improve version string for Oracle CI builds
    + S8223558: Java does not render Myanmar script correctly
    + S8223627: jdk-13+20 bundle name contains null instead of ea
    + S8223638: Replace wildcard address with loopback or local
    host in tests - part 6
    + S8223678: Add Visual Studio Code workspace generation support
    (for native code)
    + S8223727: com/sun/jndi/ldap/privconn/RunTest.java failed due
    to hang in LdapRequest.getReplyBer
    + S8223769: Assert triggers with -XX:+StressReflectiveCode
    + S8224187: Refactor arraycopy_prologue to allow ZGC read
    barriers on arraycopy
    + S8224475: JTextPane does not show images in HTML rendering
    + S8224673: Adjust permission for delayed starting of debugging
    + S8224705: Tests that need to be problem-listed or have
    printer resources
    + S8224778: test/jdk/demo/jfc/J2Ddemo/J2DdemoTest.java cannot
    find J2Ddemo.jar
    + S8224821: java/awt/Focus/NoAutotransferToDisabledCompTest/
    /NoAutotransferToDisabledCompTest.java fails linux-x64
    + S8224830: test/jdk/java/awt/Focus/
    /ModalExcludedWindowClickTest/
    /ModalExcludedWindowClickTest.java fails on linux-x64
    + S8224851: AArch64: fix warnings and errors with Clang and GCC
    8.3
    + S8224905: java/lang/ProcessBuilder/Basic.java#id1 failed with
    stream closed
    + S8225007: java/awt/print/PrinterJob/
    /LandscapeStackOverflow.java may hang
    + S8225105: java/awt/Focus/ShowFrameCheckForegroundTest/
    /ShowFrameCheckForegroundTest.java fails in Windows 10
    + S8225117: java/math/BigInteger/SymmetricRangeTests.java fails
    with ParseException
    + S8225128: Add exception for expiring DocuSign root to
    VerifyCACerts test
    + S8225130: Add exception for expiring Comodo roots to
    VerifyCACerts test
    + S8225144: [macos] In Aqua L&amp;F backspace key does not delete
    when Shift is pressed
    + S8225180: SignedObject with invalid Key not throwing the
    InvalidKeyException in Windows
    + S8225182: JNI exception pending in DestroyXIMCallback of
    awt_InputMethod.c:1327
    + S8225199: [Graal] compiler/jvmci/compilerToVM/
    /IsMatureVsReprofileTest.java fails with
  - XX:CompileThresholdScaling=0.1
    + S8225305: ProblemList java/lang/invoke/VarHandles tests
    + S8225350: compiler/jvmci/compilerToVM/IsCompilableTest.java
    timed out
    + S8225430: Replace wildcard address with loopback or local
    host in tests - part 14
    + S8225435: Upgrade IANA Language Subtag Registry to the latest
    for JDK14
    + S8225487: giflib legal file is missing attribution for
    openbsd-reallocarray.c
    + S8225567: Wrong file headers with 8202414 fix changeset
    + S8225684: [AOT] vmTestbase/vm/oom/production/
    /AlwaysOOMProduction tests fail with AOTed java.base
    + S8225766: Curve in certificate should not affect signature
    scheme when using TLSv1.3
    + S8225797: OldObjectSample event creates unexpected amount of
    checkpoint data
    + S8226381: ProblemList java/lang/reflect/PublicMethods/
    /PublicMethodsTest.java
    + S8226406: JVM fails to detect mismatched or corrupt CDS
    archive
    + S8226608: Hide the onjcmd option from the help output
    + S8226892: ActionListeners on JRadioButtons don't get notified
    when selection is changed with arrow keys
    + S8227112: exclude compiler/intrinsics/sha/sanity tests from
    AOT runs
    + S8227324: Upgrade to freetype 2.10.1
    + S8227528: TestAbortVMOnSafepointTimeout.java failed due to
    "RuntimeException: 'Safepoint sync time longer than' missing
    from stdout/stderr"
    + S8227645: Some tests in serviceability/sa run with fixed -Xmx
    values and risk running out of memory
    + S8227646: [TESTBUG] appcds/SharedArchiveConsistency timed out
    + S8227662: freetype seeks to index at the end of the font data
    + S8228479: Correct the format of ColorChooserDemoTest
    + S8228613: java.security.Provider#getServices order is no
    longer deterministic
    + S8228969: 2019-09-28 public suffix list update
    + S8229236: CriticalJNINatives: dll handling should be done in
    native thread state
    + S8229345: Memory leak due to vtable stubs not being shared on
    SPARC
    + S8229888: (zipfs) Updating an existing zip file does not
    preserve original permissions
    + S8229994: assert(false) failed: Bad graph detected in
    get_early_ctrl_for_expensive
    + S8230004: jdk/internal/jimage/JImageOpenTest.java runs no test
    + S8230235: Rendering HTML with empty img attribute and
    documentBaseKey cause Exception
    + S8230390: Problemlist SA tests with AOT
    + S8230400: Missing constant pool entry for a method in
    stacktrace
    + S8230459: Test failed to resume JVMCI CompilerThread
    + S8230480: check malloc/calloc results in java.desktop
    + S8230597: Update GIFlib library to the 5.2.1
    + S8230611: infinite loop in
    LogOutputList::wait_until_no_readers()
    + S8230624: [TESTBUG] Problemlist JFR
    compiler/TestCodeSweeper.java
    + S8230677: Should disable Escape Analysis if JVMTI capability
    can_get_owned_monitor_info was taken
    + S8230926: [macosx] Two apostrophes are entered instead of one
    with "U.S. International - PC" layout
    + S8231025: Incorrect method tag offset for big endian platform
    + S8231081: TestMetadataRetention fails due to missing symbol id
    + S8231387: java.security.Provider.getService returns random
    result due to race condition with mutating methods in the same
    class
    + S8231430: C2: Memory stomp in max_array_length() for
    T_ILLEGAL type
    + S8231445: check ZALLOC return values in awt coding
    + S8231507: Update Apache Santuario (XML Signature) to version
    2.1.4
    + S8231584: Deadlock with ClassLoader.findLibrary and
    System.loadLibrary call
    + S8231753: use more Posix functionality in aix
    os::print_os_info
    + S8231810: javax/net/ssl/templates/
    /SSLSocketSSLEngineTemplate.java fails intermittently with
    "java.lang.Exception: Unexpected EOF"
    + S8232003: (fs) Files.write can leak file descriptor in the
    exception case
    + S8232056: GetOwnedMonitorInfoWithEATest.java fails with ZGC:
    Heap too small
    + S8232060: add some initializations using sigemptyset in
    os_aix.cpp
    + S8232154: Update Mesa 3-D Headers to version 19.2.1
    + S8232167: Visual Studio install found through
  - -with-tools-dir value is discarded
    + S8232170: FSInfo#getJarClassPath throws an exception not
    declared in its throws clause
    + S8232200: [macos 10.15] Windows in fullscreen tests jumps
    around the screen
    + S8232207: Linux os::available_memory re-reads cgroup
    configuration on every invocation
    + S8232224: [TESTBUG] problemlist JFR TestLargeRootSet.java
    + S8232370: Refactor some com.sun.jdi tests to enable IDE
    integration
    + S8232433: [macos 10.15] java/awt/Window/
    /LocationAtScreenCorner/LocationAtScreenCorner.java may fail
    + S8232571: Add missing SIGINFO signal
    + S8232692: [TESTBUG] compiler/aot/fingerprint/
    /SelfChangedCDS.java fails when cds is disabled
    + S8232713: Update BCEL version to 6.3.1 in license file
    + S8232806: Introduce a system property to disable eager lambda
    initialization
    + S8232834: RunTest sometimes fails to produce valid
    exitcode.txt
    + S8232880: Update test documentation with additional settings
    for client UI tooltip tests
    + S8232950: SUNPKCS11 Provider incorrectly check key length for
    PSS Signatures.
    + S8233018: Add a new test to verify that DatagramSocket is not
    interruptible
    + S8233019: java.lang.Class.isPrimitive() (C1) returns wrong
    result if Klass* is aligned to 32bit
    + S8233032: assert(in_bb(n)) failed: must be
    + S8233078: fix minimal VM build on Linux ppc64(le)
    + S8233328: fix minimal VM build on Linux s390x
    + S8233383: Various minor fixes
    + S8233466: aarch64: remove unnecessary load of mdo when
    profiling return and parameters type
    + S8233491: Crash in AdapterHandlerLibrary::get_adapter with
    CDS due to code cache exhaustion
    + S8233529: loopTransform.cpp:2984: Error: assert(p_f-&gt;Opcode()
    == Op_IfFalse) failed
    + S8233548: Update CUP to v0.11b
    + S8233649: Update ProblemList.txt to exclude failing headful
    tests on macos
    + S8233656: assert(d-&gt;is_CFG() &amp;&amp; n-&gt;is_CFG()) failed: must
    have CFG nodes
    + S8233657: Intermittent NPE in Component.validate()
    + S8234288: Turkey Time Zone returns incorrect time zone name
    + S8234323: NULL-check return value of SurfaceData_InitOps on
    macosx
    + S8234339: replace JLI_StrTok in java_md_solinux.c
    + S8234340: Bump update version for OpenJDK: jdk-11.0.7
    + S8234350: assert(mode == ControlAroundStripMined &amp;&amp; (use ==
    sfpt || !use-&gt;is_reachable_from_root())) failed: missed a node
    + S8234386: [macos] NPE was thrown at expanding Choice from
    maximized frame
    + S8234397: add OS uptime information to os::print_os_info
    output
    + S8234423: Modifying ArrayList.subList().subList() resets
    modCount of subList
    + S8234466: Class loading deadlock involving
    X509Factory#commitEvent()
    + S8234501: remove obsolete NET_ReadV
    + S8234525: enable link-time section-gc for linux s390x to
    remove unused code
    + S8234610: MaxVectorSize set wrongly when UseAVX=3 is
    specified after JDK-8221092
    + S8234617: C1: Incorrect result of field load due to missing
    narrowing conversion
    + S8234723: javax/net/ssl/TLS tests support TLSv1.3
    + S8234724: javax/net/ssl/templates/
    /SSLSocketSSLEngineTemplate.java supports TLSv1.3
    + S8234741: enhance os::get_core_path on macOS
    + S8234769: Duplicate attribution in freetype.md
    + S8234786: Fix for JDK-8214578 breaks OS X 10.12 compatibility
    + S8234809: set relro in linker flags when building with gcc
    + S8234824: java/nio/channels/SocketChannel/AdaptSocket.java
    fails on Windows 10
    + S8235243: handle VS2017 15.9 and VS2019 in abstract_vm_version
    + S8235288: AVX 512 instructions inadvertently used on Xeon for
    small vector width operations
    + S8235325: build failure on Linux after 8235243
    + S8235383: C1 compilation fails with
  - XX:+PrintIRDuringConstruction -XX:+Verbose
    + S8235489: handle return values of sscanf calls in hotspot
    + S8235509: Backport for JDK-8209657 Refactor filemap.hpp to
    simplify integration with Serviceability Agent.
    + S8235510: java.util.zip.CRC32 performance drop after 8200067
    + S8235563: [TESTBUG] appcds/CommandLineFlagComboNegative.java
    does not handle archive mapping failure
    + S8235637: jhsdb jmap from OpenJDK 11.0.5 doesn't work if
    prelink is enabled
    + S8235671: enhance print_rlimit_info in os_posix
    + S8235744: PIT: test/jdk/javax/swing/text/html/
    /TestJLabelWithHTMLText.java times out in linux-x64
    + S8235904: Infinite loop when rendering huge lines
    + S8235998: [c2] Memory leaks during tracing after '8224193:
    stringStream should not use Resource Area'.
    + S8236039: JSSE Client does not accept status_request
    extension in CertificateRequest messages for TLS 1.3
    + S8236140: assert(!VerifyHashTableKeys || _hash_lock == 0)
    failed: remove node from hash table before modifying it
    + S8236179: C1 register allocation error with T_ADDRESS
    + S8236488: Support for configure option
  - -with-native-debug-symbols=internal is impossible on Windows
    + S8236500: Windows ucrt.dll should be looked up in versioned
    WINSDK subdirectory
    + S8236709: struct SwitchRange in HS violates C++ One
    Definition Rule
    + S8236848: [JDK 11u] make run-test-tier1 fails after backport
    of JDK-8232834
    + S8236873: Worker has a deadlock bug
    + S8237217: Incorrect G1StringDedupEntry type used in
    StringDedupTable destructor
    + S8237368: Problem with NullPointerException in RMI
    TCPEndpoint.read
    + S8237375: SimpleThresholdPolicy misses CounterDecay timestamp
    initialization
    + S8237508: Simplify JarFile.isInitializing
    + S8237540: Missing files in backport of JDK-8210910
    + S8237541: Missing files in backport of JDK-8236528
    + S8237600: Test SunJSSEFIPSInit fails on Ubuntu
    + S8237819: s390x - remove unused pd_zero_to_words_large
    + S8237869: exclude jtreg test security/infra/java/security/
    /cert/CertPathValidator/certification/LuxTrustCA.java because
    of instabilities
    + S8237879: make 4.3 breaks build
    + S8237945: CTW: C2 compilation fails with
    assert(just_allocated_object(alloc_ctl) == ptr) failed: most
    recent allo...
    + S8238225: Issues reported after replacing symlink at
    Contents/MacOS/libjli.dylib with binary
    + S8238247: CTW runner should sweep nmethods more aggressively
    + S8238366: CTW runner closes standard output on exit
    + S8238438: SuperWord::co_locate_pack picks memory state of
    first instead of last load
    + S8238502: sunmscapi.dll causing EXCEPTION_ACCESS_VIOLATION
    + S8238534: Deep sign macOS bundles before bundle archive is
    being created
    + S8238591: CTW: Split
    applications/ctw/modules/jdk_localedata.java
    + S8238596: AVX enabled by default for Skylake even when
    unsupported
    + S8238811: C2: assert(i &gt;= req() || i == 0 || is_Region() ||
    is_Phi()) with -XX:+VerifyGraphEdges
    + S8239005: [TESTBUG] test/hotspot/jtreg/runtime/
    /StackGuardPages/TestStackGuardPages.java: exeinvoke.c: must
    initialize static state before calling do_overflow()
    + S8239466: Loss of precision in counter decay calculation in
    11u backport of JDK-8237375
    + S8239856: [ntintel] asserts about copying unaligned array
    element
    + S8240724: [test] jdk11 downport of 8224475 misses binary file
    test/jdk/javax/swing/JTextPane/arrow.png
    + S8241296: Segfault in JNIHandleBlock::oops_do()
- Removed patch:
  * DependOnVariableHelper.patch
    + fixed upstream
- Added patch:
  * JDK-8228407.patch
    + fix crashes due to shared archive file mismatch</changelog>
  <changelog author="fstrba@suse.com" date="1594900800">- Update to upstream tag jdk-11.0.8+10 (July 2020 CPU, bsc#1174157)
  * Security fixes:
    + JDK-8230613: Better ASCII conversions
    + JDK-8231800: Better listing of arrays
    + JDK-8232014: Expand DTD support
    + JDK-8233234: Better Zip Naming
    + JDK-8233239, CVE-2020-14562: Enhance TIFF support
    + JDK-8233255: Better Swing Buttons
    + JDK-8234032: Improve basic calendar services
    + JDK-8234042: Better factory production of certificates
    + JDK-8234418: Better parsing with CertificateFactory
    + JDK-8234836: Improve serialization handling
    + JDK-8236191: Enhance OID processing
    + JDK-8236867, CVE-2020-14573: Enhance Graal interface handling
    + JDK-8237117, CVE-2020-14556: Better ForkJoinPool behavior
    + JDK-8237592, CVE-2020-14577: Enhance certificate verification
    + JDK-8238002, CVE-2020-14581: Better matrix operations
    + JDK-8238013: Enhance String writing
    + JDK-8238804: Enhance key handling process
    + JDK-8238842: AIOOBE in GIFImageReader.initializeStringTable
    + JDK-8238843: Enhanced font handing
    + JDK-8238920, CVE-2020-14583: Better Buffer support
    + JDK-8238925: Enhance WAV file playback
    + JDK-8240119, CVE-2020-14593: Less Affine Transformations
    + JDK-8240482: Improved WAV file playback
    + JDK-8241379: Update JCEKS support
    + JDK-8241522: Manifest improved jar headers redux
    + JDK-8242136, CVE-2020-14621: Better XML namespace handling
  * Other changes:
    + JDK-6933331: (d3d/ogl) java.lang.IllegalStateException:
    Buffers have not been created
    + JDK-7124307: JSpinner and changing value by mouse
    + JDK-8022574: remove HaltNode code after uncommon trap calls
    + JDK-8039082: [TEST_BUG] Test
    java/awt/dnd/BadSerializationTest/BadSerializationTest.java
    fails
    + JDK-8040630: Popup menus and tooltips flicker with previous
    popup contents when first shown
    + JDK-8044365: (dc) MulticastSendReceiveTests.java failing with
    ENOMEM when joining group (OS X 10.9)
    + JDK-8048215: [TESTBUG]
    java/lang/management/ManagementFactory/ThreadMXBeanProxy.java
    Expected non-null LockInfo
    + JDK-8051349: nsk/jvmti/scenarios/sampling/SP06/sp06t003 fails
    in nightly
    + JDK-8080353: JShell: Better error message on attempting to
    add default method
    + JDK-8139876: Exclude hanging nsk/stress/stack from execution
    with deoptimization enabled
    + JDK-8146090: java/lang/ref/ReachabilityFenceTest.java fails
    with -XX:+DeoptimizeALot
    + JDK-8153430: jdk regression test MletParserLocaleTest,
    ParserInfiniteLoopTest reduce default timeout
    + JDK-8156207: Resource allocated BitMaps are often cleared
    unnecessarily
    + JDK-8159740: JShell: corralled declarations do not have
    correct source to wrapper mapping
    + JDK-8175984: ICC_Profile has un-needed, not-empty finalize
    method
    + JDK-8176359: Frame#setMaximizedbounds not working properly in
    multi screen environments
    + JDK-8183369: RFC unconformity of HttpURLConnection with proxy
    + JDK-8187078: -XX:+VerifyOops finds numerous problems when
    running JPRT
    + JDK-8189861: Refactor CacheFind
    + JDK-8191169: java/net/Authenticator/B4769350.java failed
    intermittently
    + JDK-8191930: [Graal] emits unparseable XML into compile log
    + JDK-8193879: Java debugger hangs on method invocation
    + JDK-8196019: java/awt/Window/Grab/GrabTest.java fails on
    Windows
    + JDK-8196181: sun/java2d/GdiRendering/InsetClipping.java fails
    + JDK-8198000:
    java/awt/List/EmptyListEventTest/EmptyListEventTest.java
    debug assert on Windows
    + JDK-8198001: java/awt/Menu/WrongParentAfterRemoveMenu/
    /WrongParentAfterRemoveMenu.java debug assert on Windows
    + JDK-8198339: Test javax/swing/border/Test6981576.java is
    unstable
    + JDK-8200701: jdk/jshell/ExceptionsTest.java fails on Windows,
    after JDK-8198801
    + JDK-8203264: JNI exception pending in
    PlainDatagramSocketImpl.c:740
    + JDK-8203672: JNI exception pending in PlainSocketImpl.c
    + JDK-8203673: JNI exception pending in
    DualStackPlainDatagramSocketImpl.c:398
    + JDK-8204834: Fix confusing "allocate" naming in OopStorage
    + JDK-8205399: Set node color on pinned HashMap.TreeNode
    deletion
    + JDK-8205653: test/jdk/sun/management/jmxremote/bootstrap/
    /RmiRegistrySslTest.java and RmiSslBootstrapTest.sh fail with
    handshake_failure
    + JDK-8206179: com/sun/management/OperatingSystemMXBean/
    /GetCommittedVirtualMemorySize.java fails with Committed
    virtual memory size illegal value
    + JDK-8207334: VM times out in VM_HandshakeAllThreads::doit()
    with RunThese30M
    + JDK-8208277: Code cache heap (-XX:ReservedCodeCacheSize)
    doesn't work with 1GB LargePages
    + JDK-8209113: Use WeakReference for lastFontStrike for created
    Fonts
    + JDK-8209333: Socket reset issue for TLS 1.3 socket close
    + JDK-8209439: C2 library_call can potentially ignore Math.pow
    intrinsic or use null pointer
    + JDK-8209534: [TESTBUG]runtime/appcds/cacheObject/
    /ArchivedModuleCompareTest.java fails with EnableJVMCI.
    + JDK-8210147: adjust some WSAGetLastError usages in windows
    network coding
    + JDK-8210284: "assert((av &amp; 0x00000001) == 0) failed:
    unsupported V8" on Solaris 11.4
    + JDK-8210303: VM_HandshakeAllThreads fails assert with
    "failed: blocked and not walkable"
    + JDK-8210459: Add support for generating compile_commands.json
    + JDK-8210515: [TESTBUG]CheckArchivedModuleApp.java needs to
    check if EnableJVMCI is set.
    + JDK-8210788: Javadoc for Thread.join(long, int) should
    specify that it waits forever when both arguments are zero
    + JDK-8211301: [macos] support full window content options
    + JDK-8211332: Space for stub routines (code_size2) is too
    small on new Skylake CPUs
    + JDK-8211339: NPE during SSL handshake caused by
    HostnameChecker
    + JDK-8211392: compiler/profiling/
    /spectrapredefineclass_classloaders/Launcher.java times out
    in JDK12 CI
    + JDK-8211743: [AOT] crash in ScopeDesc::decode_body() when
    JVMTI walks AOT frames
    + JDK-8212154: [TESTBUG] CheckArchivedModuleApp fails with NPE
    when JVMCI is absent
    + JDK-8212167: JShell : Stack trace of exception has wrong line
    number
    + JDK-8212933: Thread-SMR: requesting a VM operation whilst
    holding a ThreadsListHandle can cause deadlocks
    + JDK-8212986: Make Visual Studio compiler check less strict
    + JDK-8213250: CDS archive creation aborts due to metaspace
    object allocation failure
    + JDK-8213516: jck test api/javax_accessibility/AccessibleState/
    /fields.html fails intermittent
    + JDK-8213947: ARM32: failed check_simd should set
    UsePopCountInstruction to false
    + JDK-8214418: half-closed SSLEngine status may cause
    application dead loop
    + JDK-8214440: ldap over a TLS connection negotiate failed with
    "javax.net.ssl.SSLPeerUnverifiedException: hostname of the
    server does not match the hostname in the server's
    certificate"
    + JDK-8214444: Wrong strncat limits in dfa.cpp
    + JDK-8214481: freetype path does not disable TrueType hinting
    with AA+FM hints
    + JDK-8214571: -Xdoclint of array serialField gives "error:
    array type not allowed here"
    + JDK-8214856: Errors with JSZip in web console after upgrade
    to 3.1.5
    + JDK-8214862: assert(proj != __null) at compile.cpp:3251
    + JDK-8215369: Jcstress pollute /var/tmp with temporary files.
    + JDK-8215551: Missing case label in nmethod::reloc_string_for()
    + JDK-8215555: TieredCompilation C2 threads can excessively
    block handshakes
    + JDK-8215711: Missing key_share extension for (EC)DHE key
    exchange should alert missing_extension
    + JDK-8216151: [Graal] Module
    jdk.internal.vm.compiler.management has not been granted
    accessClassInPackage.org.graalvm.compiler.debug
    + JDK-8216154: C4819 warnings at HotSpot sources on Windows
    + JDK-8216541: CompiledICHolders of VM locked unloaded nmethods
    are released too late
    + JDK-8217230: assert(t == t_no_spec) failure in
    NodeHash::check_no_speculative_types()
    + JDK-8217404: --with-jvm-features doesn't work when multiple
    features are explicitly disabled
    + JDK-8217447: Develop flag TraceICs is broken
    + JDK-8217606: LdapContext#reconnect always opens a new
    connection
    + JDK-8218807: Compilation database (compile_commands.json) may
    contain obsolete items
    + JDK-8219214: Infinite Loop in CodeSection::dump()
    + JDK-8219904: ClassCastException when calling
    FlightRecorderMXBean#getRecordings()
    + JDK-8219991: New fix of the deadlock in
    sun.security.ssl.SSLSocketImpl
    + JDK-8221121: applications/microbenchmarks are encountering
    crashes in tier5
    + JDK-8221445: FastSysexMessage constructor crashes MIDI
    receiption thread
    + JDK-8221482: Initialize VMRegImpl::regName[] earlier to
    prevent assert during PrintStubCode
    + JDK-8221741: ClassCastException can happen when
    fontconfig.properties is used
    + JDK-8221823: Requested JDialog width is ignored
    + JDK-8223108: Test java/awt/EventQueue/
    /NonComponentSourcePost.java is unstable
    + JDK-8223678: Add Visual Studio Code workspace generation
    support (for native code)
    + JDK-8223935: PIT: java/awt/font/WindowsIndicFonts.java fails
    on windows10
    + JDK-8224109: Text spaced incorrectly by drawString under
    rotation with fractional metric
    + JDK-8224632: testbug: java/awt/dnd/RemoveDropTargetCrashTest/
    /RemoveDropTargetCrashTest.java fails on MacOS
    + JDK-8224793: os::die() does not honor CreateCoredumpOnCrash
    option
    + JDK-8224847: gc/stress/TestReclaimStringsLeaksMemory.java
    fails with reserved greater than expected
    + JDK-8224931: disable JAOTC invokedynamic support until
    8223533 is fixed
    + JDK-8224997: ChaCha20-Poly1305 TLS cipher suite decryption
    throws ShortBufferException
    + JDK-8225068: Remove DocuSign root certificate that is
    expiring in May 2020
    + JDK-8225069: Remove Comodo root certificate that is expiring
    in May 2020
    + JDK-8225126: Test SetBoundsPaintTest.html faild on Windows
    when desktop is scaled
    + JDK-8225325: Add tests for redefining a class' private method
    during resolution of the bootstrap specifier
    + JDK-8225622: [AOT] runtime/SharedArchiveFile/
    /TestInterpreterMethodEntries.java crashed with AOTed
    java.base
    + JDK-8225653: Provide more information when hitting SIGILL
    from HaltNode
    + JDK-8225783: Incorrect use of binary operators on booleans in
    type.cpp
    + JDK-8225789: Empty method parameter type should generate
    ClassFormatError
    + JDK-8226198: use of &amp; instead of &amp;&amp; in
    LibraryCallKit::arraycopy_restore_alloc_state
    + JDK-8226253: JAWS reports wrong number of radio buttons when
    buttons are hidden.
    + JDK-8226653: [accessibility] Can edit text cell correctly,
    but Accessibility Tool reads nothing about editor
    + JDK-8226806: [macOS 10.14] Methods of Java Robot should be
    called from appropriate thread
    + JDK-8226879: Memory leak in Type::hashcons
    + JDK-8227632: Incorrect PrintCompilation message: made not
    compilable on levels 0 1 2 3 4
    + JDK-8228407: JVM crashes with shared archive file mismatch
    + JDK-8228482: fix xlc16/xlclang comparison of distinct pointer
    types and string literal conversion warnings
    + JDK-8228757: Fail fast if the handshake type is unknown
    + JDK-8229158: make UseSwitchProfiling non-experimental or
    false by-default
    + JDK-8229421: The logic of java/net/ipv6tests/TcpTest.java is
    flawed
    + JDK-8229855: C2 fails with assert(false) failed: bad AD file
    + JDK-8230591: AArch64: Missing intrinsics for Math.ceil,
    floor, rint
    + JDK-8231118: ARM32: Math tests failures
    + JDK-8231213: Migrate SimpleDateFormatConstTest to JDK Repo
    + JDK-8231243: [TESTBUG] CustomFont.java cannot find font file
    + JDK-8231438: [macOS] Dark mode for the desktop is not
    supported
    + JDK-8231550: C2: ShouldNotReachHere() in
    verify_strip_mined_scheduling
    + JDK-8231564: setMaximizedBounds is broken with large display
    scale and multiple monitors
    + JDK-8231572: Use -lobjc instead of -fobjc-link-runtime in
    libosxsecurity
    + JDK-8231631: sun/net/ftp/FtpURLConnectionLeak.java fails
    intermittently with NPE
    + JDK-8231671: Fix copyright headers in hotspot (missing comma
    after year)
    + JDK-8231720: Some perf regressions after 8225653
    + JDK-8231779: crash
    HeapWord*ParallelScavengeHeap::failed_mem_allocate
    + JDK-8231863: Crash if classpath is read from @argument file
    and the main gets option argument
    + JDK-8232080: jlink plugins for vendor information and
    run-time options
    + JDK-8232106: [x86] C2: SIGILL due to usage of SSSE3
    instructions on processors which don't support it
    + JDK-8232134: Change to Visual Studio 2017 15.9.16 for
    building on Windows at Oracle
    + JDK-8232226: [macos 10.15] test/jdk/java/awt/color/
    /EqualityTest/EqualityTest.java may fail
    + JDK-8232357: Compare version info of Santuario to legal notice
    + JDK-8232572: Add hooks for custom output dir in Bundles.gmk
    + JDK-8232634: Problem List ICMColorDataTest.java
    + JDK-8232748: Build static versions of certain JDK libraries
    + JDK-8232846: ProcessHandle.Info command with non-English
    shows question marks
    + JDK-8232880: Update test documentation with additional
    settings for client UI tooltip tests
    + JDK-8233033: C2 produces wrong result while unswitching a
    loop due to lost control dependencies
    + JDK-8233137: runtime/ErrorHandling/VeryEarlyAssertTest.java
    fails after 8232080
    + JDK-8233197: Invert JvmtiExport::post_vm_initialized() and
    Jfr:on_vm_start() start-up order for correct option parsing
    + JDK-8233291: [TESTBUG] tools/jlink/plugins/
    /VendorInfoPluginsTest.java fails with debug or non-server VMs
    + JDK-8233364: Fix undefined behavior in
    Canonicalizer::do_ShiftOp
    + JDK-8233494: Avoid calling MallocTracker::record_malloc and
    record_free when NMT is off
    + JDK-8233573: Toolkit.getScreenInsets(GraphicsConfiguration)
    may throw ClassCastException
    + JDK-8233608: Minimal build broken after JDK-8233494
    + JDK-8233621: Mismatch in jsse.enableMFLNExtension property
    name
    + JDK-8233696: [TESTBUG]Some jtreg tests fail when CAPS_LOCK is
    ON
    + JDK-8233707: systemScale.cpp could not compile with VS2019
    + JDK-8233801: GCMEmptyIv.java test fails on Solaris 11.4
    + JDK-8233880: Support compilers with multi-digit major version
    numbers
    + JDK-8233920: MethodHandles::tryFinally generates illegal
    bytecode for long/double return type
    + JDK-8234137: The "AutoTestOnTop.java" test may run external
    applications
    + JDK-8234146: compiler/jsr292/
    /ContinuousCallSiteTargetChange.java times out on SPARC
    + JDK-8234184: [TESTBUG] java/awt/Mouse/EnterExitEvents/
    /ModalDialogEnterExitEventsTest.java fails in Windows
    + JDK-8234270: [REDO] JDK-8204128 NMT might report incorrect
    numbers for Compiler area
    + JDK-8234332: [TESTBUG] java/awt/Focus/DisposedWindow/
    /DisposeDialogNotActivateOwnerTest/
    /DisposeDialogNotActivateOwnerTest.java fails on linux-x64
    nightly
    + JDK-8234398: Replace ID2D1Factory::GetDesktopDpi with
    GetDeviceCaps
    + JDK-8234522: [macos] Crash with use of native file dialog
    + JDK-8234691: Potential double-free in ParallelSPCleanupTask
    constructor
    + JDK-8234696: tools/jlink/plugins/VendorInfoPluginsTest.java
    times out
    + JDK-8234727: sun/security/ssl/X509TrustManagerImpl tests
    support TLSv1.3
    + JDK-8234728: Some security tests should support TLSv1.3
    + JDK-8234779: Provide idiom for declaring classes noncopyable
    + JDK-8234824: java/nio/channels/SocketChannel/AdaptSocket.java
    fails on Windows 10
    + JDK-8234968: check calloc rv in libinstrument
    InvocationAdapter
    + JDK-8235153: [TESTBUG] [macos 10.15] java/awt/Graphics/
    /DrawImageBG/SystemBgColorTest.java fails
    + JDK-8235183: Remove the "HACK CODE" in comment
    + JDK-8235263: Revert TLS 1.3 change that wrapped IOExceptions
    + JDK-8235311: Tag mismatch may alert bad_record_mac
    + JDK-8235332: TestInstanceCloneAsLoadsStores.java fails with
  - XX:+StressGCM
    + JDK-8235452: Strip mined loop verification fails with
    assert(is_OuterStripMinedLoop()) failed: invalid node class
    + JDK-8235584: UseProfiledLoopPredicate fails with
    assert(_phase-&gt;get_loop(c) == loop) failed: have to be in the
    same loop
    + JDK-8235620: Broken merge between JDK-8006406 and JDK-8003559
    + JDK-8235638: NPE in LWWindowPeer.getOnscreenGraphics()
    + JDK-8235686: Add more custom hooks in Bundles.gmk
    + JDK-8235739: Rare NPE at WComponentPeer.getGraphics()
    + JDK-8235762: JVM crash in SWPointer during C2 compilation
    + JDK-8235834: IBM-943 charset encoder needs updating
    + JDK-8235874: The ordering of Cipher Suites is not maintained
    provided through jdk.tls.client.cipherSuites and
    jdk.tls.server.cipherSuites system property.
    + JDK-8235908: omit ThreadPriorityPolicy warning when value is
    set from image
    + JDK-8235984: C2: assert(out-&gt;in(PhiNode::Region) == head ||
    out-&gt;in(PhiNode::Region) == slow_head) failed: phi must be
    either part of the slow or the fast loop
    + JDK-8236211: [Graal] compiler/graalunit/GraphTest.java is
    skipped in all testing
    + JDK-8236470: Deal with ECDSA using ecdsa-with-SHA2 plus hash
    algorithm as AlgorithmId
    + JDK-8236545: Compilation error in mach5
    java/awt/FileDialog/MacOSGoToFolderCrash.java
    + JDK-8236700: Upgrading JSZip from v3.1.5 to v3.2.2
    + JDK-8236759: ShouldNotReachHere in
    PhaseIdealLoop::verify_strip_mined_scheduling
    + JDK-8236897: Fix the copyright header for pkcs11gcm2.h
    + JDK-8236921: Add build target to produce a JDK image suitable
    for a Graal/SVM build
    + JDK-8236953: [macos] JavaFX SwingNode is not rendered on macOS
    + JDK-8236996: Incorrect Roboto font rendering on Windows with
    subpixel antialiasing
    + JDK-8237045: JVM uses excessive memory with -XX:+EnableJVMCI
  - XX:JVMCICounterSize=2147483648
    + JDK-8237055: [TESTBUG] compiler/c2/TestJumpTable.java fails
    with release VMs
    + JDK-8237086: assert(is_MachReturn()) running CTW with fix for
    JDK-8231291
    + JDK-8237192: Generate stripped/public pdbs on Windows for jdk
    images
    + JDK-8237396: JvmtiTagMap::weak_oops_do() should not trigger
    barriers
    + JDK-8237474: Default SSLEngine should create in server role
    + JDK-8237859: C2: Crash when loads float above range check
    + JDK-8237879: make 4.3 breaks build
    + JDK-8237951: CTW: C2 compilation fails with "malformed
    control flow"
    + JDK-8237962: give better error output for invalid OCSP
    response intervals in CertPathValidator checks
    + JDK-8238190: [JVMCI] Fix single implementor speculation for
    diamond shapes.
    + JDK-8238356: CodeHeap::blob_count() overestimates the number
    of blobs
    + JDK-8238452: Keytool generates wrong expiration date if
    validity is set to 2050/01/01
    + JDK-8238555: Allow Initialization of SunPKCS11 with NSS when
    there are external FIPS modules in the NSSDB
    + JDK-8238575: DragSourceEvent.getLocation() returns wrong
    value on HiDPI screens (Windows)
    + JDK-8238676: jni crashes on accessing it from process exit
    hook
    + JDK-8238721: Add failing client jtreg tests to the Problem
    List
    + JDK-8238738: AudioSystem.getMixerInfo() takes about 30 sec to
    report a gone audio device
    + JDK-8238756: C2: assert(((n) == __null || !VerifyIterativeGVN
    || !((n)-&gt;is_dead()))) failed: can not use dead node
    + JDK-8238765: PhaseCFG::schedule_pinned_nodes cannot handle
    precedence edges from unmatched CFG nodes correctly
    + JDK-8238898: Missing hash characters for header on license
    file
    + JDK-8238942: Rendering artifacts with LCD text and fractional
    metrics
    + JDK-8238985: [TESTBUG] The arrow image is blue instead of
    green
    + JDK-8239000: handle ContendedPaddingWidth in vm_version_ppc
    + JDK-8239055: Wrong implementation of VMState.hasListener
    + JDK-8239091: Reversed arguments in call to strstr in freetype
    "debug" code.
    + JDK-8239142: C2's UseUniqueSubclasses optimization is broken
    for array accesses
    + JDK-8239224: libproc_impl.c previous_thr may be used
    uninitialized warning
    + JDK-8239351: Give more meaningful InternalError messages in
    Deflater.c
    + JDK-8239365: ProcessBuilder test modifications for AIX
    execution
    + JDK-8239456: vtable stub generation: assert failure (code
    size estimate)
    + JDK-8239457: call ReleaseStringUTFChars before early returns
    in Java_sun_security_pkcs11_wrapper_PKCS11_connect
    + JDK-8239462: jdk.hotspot.agent misses some
    ReleaseStringUTFChars calls in case of early returns
    + JDK-8239557: [TESTBUG] VeryEarlyAssertTest.java validating
    "END." marker at lastline is not always true
    + JDK-8239787: AArch64: String.indexOf may incorrectly handle
    empty strings
    + JDK-8239792: Bump update version for OpenJDK: jdk-11.0.8
    + JDK-8239798: SSLSocket closes socket both socket endpoints on
    a SocketTimeoutException
    + JDK-8239819: XToolkit: Misread of screen information memory
    + JDK-8239852: java/util/concurrent tests fail with
  - XX:+VerifyGraphEdges: assert(!VerifyGraphEdges) failed:
    verification should have failed
    + JDK-8239893: Windows handle Leak when starting processes
    using ProcessBuilder
    + JDK-8239915: Zero VM crashes when handling dynamic constant
    + JDK-8239931: [win][x86] vtable stub generation: assert
    failure (code size estimate) follow-up
    + JDK-8239965: XMLEncoder/Test4625418.java fails due to "Error:
    Cp943 - can't read properly"
    + JDK-8239976: Put JDK-8239965 on the ProblemList.txt
    + JDK-8240073: Fix 'test-make' build target in 11u
    + JDK-8240197: Cannot start JVM when $JAVA_HOME includes CJK
    characters
    + JDK-8240202: A few client tests leave mouse buttons pressed
    + JDK-8240220: IdealLoopTree::dump_head predicate printing is
    broken
    + JDK-8240223: Use consistent predicate order in and with
    PhaseIdealLoop::find_predicate
    + JDK-8240227: Loop predicates should be copied to unswitched
    loops
    + JDK-8240286: [TESTBUG] Test command error in hotspot/jtreg/
    /compiler/loopopts/superword/SumRedAbsNeg_Float.java
    + JDK-8240518: Incorrect JNU_ReleaseStringPlatformChars in
    Windows Print
    + JDK-8240529: CheckUnhandledOops breaks NULL check in
    Modules::define_module
    + JDK-8240576: JVM crashes after transformation in C2
    IdealLoopTree::merge_many_backedges
    + JDK-8240603: Windows 32bit compile error after 8238676
    + JDK-8240629: argfiles parsing broken for argfiles with
    comment cross 4096 bytes chunk
    + JDK-8240711: TestJstatdPort.java failed due to
    "ExportException: Port already in use:"
    + JDK-8240786: [TESTBUG] The test java/awt/Window/
    /GetScreenLocation/GetScreenLocationTest.java fails on HiDPI
    screen
    + JDK-8240824: enhance print_full_memory_info on Linux by THP
    related information
    + JDK-8240827: Downport SSLSocketImpl.java from "8221882: Use
    fiber-friendly java.util.concurrent.locks in JSSE"
    + JDK-8240905: assert(mem == (Node*)1 || mem == mem2) failed:
    multiple Memories being matched at once?
    + JDK-8240972: macOS codesign fail on macOS 10.13.5 or older
    + JDK-8241445: Fix copyright in
    test/jdk/tools/launcher/ArgFileSyntax.java
    + JDK-8241458: [JVMCI] add mark value to expose
    CodeOffsets::Frame_Complete
    + JDK-8241464: [11u] Backport: make rehashing be a needed
    guaranteed safepoint cleanup action
    + JDK-8241556: Memory leak if -XX:CompileCommand is set
    + JDK-8241568: (fs) UserPrincipalLookupService.lookupXXX
    failure with IOE "Operation not permitted"
    + JDK-8241586: compiler/cpuflags/
    /TestAESIntrinsicsOnUnsupportedConfig.java fails on aarch64
    + JDK-8241638: launcher time metrics always report 1 on Linux
    when _JAVA_LAUNCHER_DEBUG set
    + JDK-8241660: Add virtualization information output to hs_err
    file on macOS
    + JDK-8241808: [TESTBUG] The JDK-8039467 bug appeared on macOS
    + JDK-8241888: Mirror jdk.security.allowNonCaAnchor system
    property with a security one
    + JDK-8241900: Loop unswitching may cause dependence on null
    check to be lost
    + JDK-8241948: enhance list of environment variables printed in
    hs_err file
    + JDK-8241996: on linux set full relro in the linker flags
    + JDK-8242108: Performance regression after fix for JDK-8229496
    + JDK-8242141: New System Properties to configure the TLS
    signature schemes
    + JDK-8242154: Backport parts of JDK-4947890 to OpenJDK 11u
    + JDK-8242174: [macos] The NestedModelessDialogTest test make
    the macOS unstable
    + JDK-8242239: [Graal] javax/management/generified/
    /GenericTest.java fails: FAILED: queryMBeans sets same
    + JDK-8242294: JSSE Client does not throw SSLException when an
    alert occurs during handshaking
    + JDK-8242379: [TESTBUG] compiler/loopopts/
    /TestLoopUnswitchingLostCastDependency.java fails with
    release VMs
    + JDK-8242470: Update Xerces to Version 2.12.1
    + JDK-8242498: Invalid "sun.awt.TimedWindowEvent" object leads
    to JVM crash
    + JDK-8242541: Small charset issues (ISO8859-16, x-eucJP-Open,
    x-IBM834 and x-IBM949C)
    + JDK-8242626: enhance posix print_rlimit_info
    + JDK-8243059: Build fails when --with-vendor-name contains a
    comma
    + JDK-8243539: Copyright info (Year) should be updated for fix
    of 8241638
    + JDK-8243541: (tz) Upgrade time-zone data to tzdata2020a
    + JDK-8244407: JVM crashes after transformation in C2
    IdealLoopTree::split_fall_in
    + JDK-8244520: problemlist
    java/awt/font/Rotate/RotatedFontTest.java on linux
    + JDK-8244777: ClassLoaderStats VM Op uses constant hash value
    + JDK-8244853: The static build of libextnet is missing the
    JNI_OnLoad_extnet function
    + JDK-8244951: Missing entitlements for hardened runtime
    + JDK-8245047: [PPC64] C2: ReverseBytes + Load always match to
    unordered Load (acquire semantics missing)
    + JDK-8245649: Revert 8245397 backport of 8230591
    + JDK-8246031: SSLSocket.getSession() doesn't close connection
    for timeout/ interrupts
    + JDK-8246613: Choose the default SecureRandom algo based on
    registration ordering
    + JDK-8248505: Unexpected NoSuchAlgorithmException when using
    secure random impl from BCFIPS provider
- Removed patch:
  * JDK-8228407.patch
    + integrated upstream</changelog>
  <changelog author="fstrba@suse.com" date="1604318400">- Update to upstream tag jdk-11.0.9-11 (October 2020 CPU,
  bsc#1177943)
  * New features
    + JDK-8250784: Shenandoah: A Low-Pause-Time Garbage Collector
  * Security fixes
    + JDK-8233624: Enhance JNI linkage
    + JDK-8236196: Improve string pooling
    + JDK-8236862, CVE-2020-14779: Enhance support of Proxy class
    + JDK-8237990, CVE-2020-14781: Enhanced LDAP contexts
    + JDK-8237995, CVE-2020-14782: Enhance certificate processing
    + JDK-8240124: Better VM Interning
    + JDK-8241114, CVE-2020-14792: Better range handling
    + JDK-8242680, CVE-2020-14796: Improved URI Support
    + JDK-8242685, CVE-2020-14797: Better Path Validation
    + JDK-8242695, CVE-2020-14798: Enhanced buffer support
    + JDK-8243302: Advanced class supports
    + JDK-8244136, CVE-2020-14803: Improved Buffer supports
    + JDK-8244479: Further constrain certificates
    + JDK-8244955: Additional Fix for JDK-8240124
    + JDK-8245407: Enhance zoning of times
    + JDK-8245412: Better class definitions
    + JDK-8245417: Improve certificate chain handling
    + JDK-8248574: Improve jpeg processing
    + JDK-8249927: Specify limits of jdk.serialProxyInterfaceLimit
    + JDK-8253019: Enhanced JPEG decoding
  * Other changes
    + JDK-6532025: GIF reader throws misleading exception with
    truncated images
    + JDK-6949753: [TEST BUG]: java/awt/print/PageFormat/
    /PDialogTest.java needs update by removing an infinite loop
    + JDK-8022535: [TEST BUG] javax/swing/text/html/parser/
    /Test8017492.java fails
    + JDK-8062947: Fix exception message to correctly represent
    LDAP connection failure
    + JDK-8067354: com/sun/jdi/GetLocalVariables4Test.sh failed
    + JDK-8134599: TEST_BUG: java/rmi/transport/closeServerSocket/
    /CloseServerSocket.java fails intermittently with Address
    already in use
    + JDK-8151678: com/sun/jndi/ldap/LdapTimeoutTest.java failed
    due to timeout on DeadServerNoTimeoutTest is incorrect
    + JDK-8160768: Add capability to custom resolve host/domain
    names within the default JNDI LDAP provider
    + JDK-8172404: Tools should warn if weak algorithms are used
    before restricting them
    + JDK-8193367: Annotated type variable bounds crash javac
    + JDK-8202117: com/sun/jndi/ldap/RemoveNamingListenerTest.java
    fails intermittently: Connection reset
    + JDK-8203026: java.rmi.NoSuchObjectException: no such object
    in table
    + JDK-8203281: [Windows] JComboBox change in ui when
    editor.setBorder() is called
    + JDK-8203382: Rename SystemDictionary::initialize_wk_klass to
    resolve_wk_klass
    + JDK-8203393: com/sun/jdi/JdbMethodExitTest.sh and
    JdbExprTest.sh fail due to timeout
    + JDK-8203928: [Test] Convert non-JDB scaffolding
    serviceability shell script tests to java
    + JDK-8204963: javax.swing.border.TitledBorder has a memory leak
    + JDK-8204994: SA might fail to attach to process with "Windbg
    Error: WaitForEvent failed"
    + JDK-8205534: Remove SymbolTable dependency from
    serviceability agent
    + JDK-8206309: Tier1 SA tests fail
    + JDK-8208281: java/nio/channels/
    /AsynchronousSocketChannel/Basic.java timed out
    + JDK-8209109: [TEST] rewrite com/sun/jdi shell tests to java
    version - step1
    + JDK-8209332: [TEST] test/jdk/com/sun/jdi/CatchPatternTest.sh
    is incorrect
    + JDK-8209342: Problemlist SA tests on Solaris due to Error
    attaching to process: Can't create thread_db agent!
    + JDK-8209343: Test javax/swing/border/TestTitledBorderLeak.java
    should be marked as headful
    + JDK-8209517: com/sun/jdi/BreakpointWithFullGC.java fails with
    timeout
    + JDK-8209604: [TEST] rewrite com/sun/jdi shell tests to java
    version - step2
    + JDK-8209605: com/sun/jdi/BreakpointWithFullGC.java fails with
    ZGC
    + JDK-8209608: Problem list com/sun/jdi/BreakpointWithFullGC.java
    + JDK-8210131: vmTestbase/nsk/jvmti/scenarios/allocation/AP10/
    /ap10t001/TestDescription.java failed with ObjectFree:
    GetCurrentThreadCpuTimerInfo returned unexpected error code
    + JDK-8210243: [TEST] rewrite com/sun/jdi shell tests to java
    version - step3
    + JDK-8210527: JShell: NullPointerException in
    jdk.jshell.Eval.translateExceptionStack
    + JDK-8210560: [TEST] convert com/sun/jdi redefineClass-related
    tests
    + JDK-8210725: com/sun/jdi/RedefineClearBreakpoint.java fails
    with waitForPrompt timed out after 60 seconds
    + JDK-8210748: [TESTBUG] lib.jdb.Jdb.waitForPrompt() should
    clarify which output is the pending reply after a timeout
    + JDK-8210760: [TEST] rewrite com/sun/jdi shell tests to java
    version - step4
    + JDK-8210977: jdk/jfr/event/oldobject/TestThreadLocalLeak.java
    fails to find ThreadLocalObject
    + JDK-8211292: [TEST] convert com/sun/jdi/DeferredStepTest.sh
    test
    + JDK-8211694: JShell: Redeclared variable should be reset
    + JDK-8212200: assert when shared java.lang.Object is redefined
    by JVMTI agent
    + JDK-8212629: [TEST] wrong breakpoint in
    test/jdk/com/sun/jdi/DeferredStepTest
    + JDK-8212665: com/sun/jdi/DeferredStepTest.java: jj1 (line 57)
  - unexpected. lastLine=52, minLine=52, maxLine=55
    + JDK-8212807: tools/jar/multiRelease/Basic.java times out
    + JDK-8213182: Minimal VM build failure after JDK-8212200
    (assert when shared java.lang.Object is redefined by JVMTI
    agent)
    + JDK-8213214: Set -Djava.io.tmpdir= when running tests
    + JDK-8213275: ReplaceCriticalClasses.java fails with
    jdk.internal.vm.PostVMInitHook not found
    + JDK-8213574: Deadlock in string table expansion when dumping
    lots of CDS classes
    + JDK-8213703: LambdaConversionException: Invalid receiver type
    not a subtype of implementation type interface
    + JDK-8214074: Ghash optimization using AVX instructions
    + JDK-8214491: Upgrade to JLine 3.9.0
    + JDK-8214797: TestJmapCoreMetaspace.java timed out
    + JDK-8215243: JShell tests failing intermitently with
    "Problem cleaning up the following threads:"
    + JDK-8215244: jdk/jshell/ToolBasicTest.java
    testHistoryReference failed
    + JDK-8215354: x86_32 build failures after JDK-8214074 (Ghash
    optimization using AVX instructions)
    + JDK-8215438: jshell tool: Ctrl-D causes EOF
    + JDK-8216021: RunTest.gmk might set concurrency level to 1 on
    Windows
    + JDK-8216974: HttpConnection not returned to the pool after
    204 response
    + JDK-8218948: SimpleDateFormat :: format - Zone Names are not
    reflected correctly during run time
    + JDK-8219712: code_size2 (defined in stub_routines_x86.hpp) is
    too small on new Skylake CPUs
    + JDK-8220150: macos10.14 Mojave returns anti-aliased glyphs
    instead of aliased B&amp;W glyphs
    + JDK-8221658: aarch64: add necessary predicate for ubfx
    patterns
    + JDK-8221759: Crash when completing "java.io.File.path"
    + JDK-8221918: runtime/SharedArchiveFile/serviceability/
    /ReplaceCriticalClasses.java fails: Shared archive not found
    + JDK-8222074: Enhance auto vectorization for x86
    + JDK-8222079: Don't use memset to initialize fields decode_env
    constructor in disassembler.cpp
    + JDK-8222769: [TESTBUG] TestJFRNetworkEvents should not rely
    on hostname command
    + JDK-8223688: JShell: crash on the instantiation of raw
    anonymous class
    + JDK-8223777: In posix_spawn mode, failing to exec()
    jspawnhelper does not result in an error
    + JDK-8223940: Private key not supported by chosen signature
    algorithm
    + JDK-8224184: jshell got IOException at exiting with AIX
    + JDK-8224234: compiler/codegen/TestCharVect2.java fails in
    test_mulc
    + JDK-8225037: java.net.JarURLConnection::getJarEntry() throws
    NullPointerException
    + JDK-8225625: AES Electronic Codebook (ECB) encryption and
    decryption optimization using AVX512 + VAES instructions
    + JDK-8226536: Catch OOM from deopt that fails rematerializing
    objects
    + JDK-8226575: OperatingSystemMXBean should be made container
    aware
    + JDK-8226697: Several tests which need the @key headful
    keyword are missing it.
    + JDK-8226809: Circular reference in printed stack trace is not
    correctly indented &amp; ambiguous
    + JDK-8227059: sun/security/tools/keytool/
    /DefaultSignatureAlgorithm.java timed out
    + JDK-8227269: Slow class loading when running with JDWP
    + JDK-8227595: keytool/fakegen/DefaultSignatureAlgorithm.java
    fails due to "exitValue = 6"
    + JDK-8228448: Jconsole can't connect to itself
    + JDK-8228967: Trust/Key store and SSL context utilities for
    tests
    + JDK-8229378: jdwp library loader in linker_md.c quietly
    truncates on buffer overflow
    + JDK-8229815: Upgrade Jline to 3.12.1
    + JDK-8230000: some httpclients testng tests run zero test
    + JDK-8230002: javax/xml/jaxp/unittest/transform/
    /SecureProcessingTest.java runs zero test
    + JDK-8230010: Remove jdk8037819/BasicTest1.java
    + JDK-8230094: CCE in createXMLEventWriter(Result) over an
    arbitrary XMLStreamWriter
    + JDK-8230402: Allocation of compile task fails with assert:
    "Leaking compilation tasks?"
    + JDK-8230767: FlightRecorderListener returns null recording
    + JDK-8230870: (zipfs) Add a ZIP FS test that is similar to
    test/jdk/java/util/zip/EntryCount64k.java
    + JDK-8231209: [REDO] ThreadMXBean::getThreadAllocatedBytes()
    can be quicker for self thread
    + JDK-8231586: enlarge encoding space for OopMapValue offsets
    + JDK-8231953: Wrong assumption in assertion in
    oop::register_oop
    + JDK-8231968: getCurrentThreadAllocatedBytes default
    implementation s/b getThreadAllocatedBytes
    + JDK-8232083: Minimal VM is broken after JDK-8231586
    + JDK-8232161: Align some one-way conversion in MS950 charset
    with Windows
    + JDK-8232855: jshell missing word in /help help
    + JDK-8233027: OopMapSet::all_do does oms.next() twice during
    iteration
    + JDK-8233228: Disable weak named curves by default in TLS,
    CertPath, and Signed JAR
    + JDK-8233386: Initialize NULL fields for unused decorations
    + JDK-8233452: java.math.BigDecimal.sqrt() with
    RoundingMode.FLOOR results in incorrect result
    + JDK-8233686: XML transformer uses excessive amount of memory
    + JDK-8233741: AES Countermode (AES-CTR) optimization using
    AVX512 + VAES instructions
    + JDK-8233829: javac cannot find non-ASCII module name under
    non-UTF8 environment
    + JDK-8233958: Memory retention due to HttpsURLConnection
    finalizer that serves no purpose
    + JDK-8234011: (zipfs) Memory leak in
    ZipFileSystem.releaseDeflater()
    + JDK-8234058: runtime/CompressedOops/
    /CompressedClassPointers.java fails with 'Narrow klass base:
    0x0000000000000000' missing from stdout/stderr
    + JDK-8234149: Several regression tests do not dispose Frame at
    end
    + JDK-8234347: "Turkey" meta time zone does not generate
    composed localized names
    + JDK-8234385: [TESTBUG] java/awt/EventQueue/6980209/
    /bug6980209.java fails in linux nightly
    + JDK-8234535: Cross compilation fails due to missing CFLAGS
    for the BUILD_CC
    + JDK-8234541: C1 emits an empty message when it inlines
    successfully
    + JDK-8234687: change javap reporting on unknown attributes
    + JDK-8236464: SO_LINGER option is ignored by SSLSocket in JDK
    11
    + JDK-8236548: Localized time zone name inconsistency between
    English and other locales
    + JDK-8236617: jtreg test containers/docker/
    /TestMemoryAwareness.java fails after 8226575
    + JDK-8237182: Update copyright header for shenandoah and
    epsilon files
    + JDK-8237888: security/infra/java/security/cert/
    /CertPathValidator/certification/LuxTrustCA.java fails when
    checking validity interval
    + JDK-8237977: Further update
    javax/net/ssl/compatibility/Compatibility.java
    + JDK-8238270: java.net HTTP/2 client does not decrease stream
    count when receives 204 response
    + JDK-8238284: [macos] Zero VM build fails due to an obvious
    typo
    + JDK-8238380: java.base/unix/native/libjava/childproc.c
    "multiple definition" link errors with GCC10
    + JDK-8238386: (sctp) jdk.sctp/unix/native/libsctp/SctpNet.c
    "multiple definition" link errors with GCC10
    + JDK-8238388: libj2gss/NativeFunc.o "multiple definition" link
    errors with GCC10
    + JDK-8238448: RSASSA-PSS signature verification fail when
    using certain odd key sizes
    + JDK-8238710: LingeredApp doesn't log stdout/stderr if exits
    with non-zero code
    + JDK-8239083: C1 assert(known_holder == NULL ||
    (known_holder-&gt;is_instance_klass() &amp;&amp;
    (!known_holder-&gt;is_interface() ||
    ((ciInstanceKlass*)known_holder)-&gt;has_nonstatic_concrete_methods())),
    "should be non-static concrete method");
    + JDK-8239385: KerberosTicket client name refers wrongly to
    sAMAccountName in AD
    + JDK-8240169: javadoc fails to link to non-modular api docs
    + JDK-8240295: hs_err elapsed time in seconds is not accurate
    enough
    + JDK-8240360: NativeLibraryEvent has wrong library name on
    Linux
    + JDK-8240676: Meet not symmetric failure when running lucene
    on jdk8
    + JDK-8241007: Shenandoah: remove
    ShenandoahCriticalControlThreadPriority support
    + JDK-8241065: Shenandoah: remove leftover code after
    JDK-8231086
    + JDK-8241086: Test runtime/NMT/HugeArenaTracking.java is
    failing on 32bit Windows
    + JDK-8241130: com.sun.jndi.ldap.EventSupport.removeDeadNotifier:
    java.lang.NullPointerException
    + JDK-8241138: http.nonProxyHosts=* causes
    StringIndexOutOfBoundsException in DefaultProxySelector
    + JDK-8241319: WB_GetCodeBlob doesn't have ResourceMark
    + JDK-8241478: vmTestbase/gc/gctests/Steal/steal001/steal001.java
    fails with OOME
    + JDK-8241574: Shenandoah: remove ShenandoahAssertToSpaceClosure
    + JDK-8241750: x86_32 build failure after JDK-8227269
    + JDK-8242184: CRL generation error with RSASSA-PSS
    + JDK-8242283: Can't start JVM when java home path includes
    non-ASCII character
    + JDK-8242556: Cannot load RSASSA-PSS public key with non-null
    params from byte array
    + JDK-8243029: Rewrite javax/net/ssl/compatibility/
    /Compatibility.java with a flexible interop test framework
    + JDK-8243138: Enhance BaseLdapServer to support starttls
    extended request
    + JDK-8243320: Add SSL root certificates to Oracle Root CA
    program
    + JDK-8243321: Add Entrust root CA - G4 to Oracle Root CA
    program
    + JDK-8243389: enhance os::pd_print_cpu_info on linux
    + JDK-8243453: java --describe-module failed with non-ASCII
    module name under non-UTF8 environment
    + JDK-8243470: [macos] bring back O2 opt level for unsafe.cpp
    + JDK-8243489: Thread CPU Load event may contain wrong data for
    CPU time under certain conditions
    + JDK-8243925: Toolkit#getScreenInsets() returns wrong value on
    HiDPI screens (Windows)
    + JDK-8244087: 2020-04-24 public suffix list update
    + JDK-8244151: Update MUSCLE PC/SC-Lite headers to the latest
    release 1.8.26
    + JDK-8244164: AArch64: jaotc generates incorrect code for
    compressed OOPs with non-zero heap base
    + JDK-8244196: adjust output in os_linux
    + JDK-8244225: stringop-overflow warning on strncpy call from
    compile_the_world_in
    + JDK-8244287: JFR: Methods samples have line number 0
    + JDK-8244703: "platform encoding not initialized" exceptions
    with debugger, JNI
    + JDK-8244719: CTW: C2 compilation fails with
    "assert(!VerifyHashTableKeys || _hash_lock == 0) failed:
    remove node from hash table before modifying it"
    + JDK-8244729: Shenandoah: remove resolve paths from
    SBSA::generate_shenandoah_lrb
    + JDK-8244763: Update --release 8 symbol information after JSR
    337 MR3
    + JDK-8244818: Java2D Queue Flusher crash while moving
    application window to external monitor
    + JDK-8245151: jarsigner should not raise duplicate warnings on
    verification
    + JDK-8245616: Bump update version for OpenJDK: jdk-11.0.9
    + JDK-8245714: "Bad graph detected in build_loop_late" when
    loads are pinned on loop limit check uncommon branch
    + JDK-8245801: StressRecompilation triggers assert "redundunt
    OSR recompilation detected. memory leak in CodeCache!"
    + JDK-8245832: JDK build make-static-libs should build all JDK
    libraries
    + JDK-8245880: Shenandoah: check class unloading flag early in
    concurrent code root scan
    + JDK-8245981: Upgrade to jQuery 3.5.1
    + JDK-8246027: Minimal fastdebug build broken after JDK-8245801
    + JDK-8246094: [macos] Sound Recording and playback is not
    working
    + JDK-8246153: TestEliminateArrayCopy fails with
  - XX:+StressReflectiveCode
    + JDK-8246193: Possible NPE in ENC-PA-REP search in AS-REQ
    + JDK-8246196: javax/management/MBeanServer/OldMBeanServerTest
    fails with AssertionError
    + JDK-8246203: Segmentation fault in verification due to stack
    overflow with -XX:+VerifyIterativeGVN
    + JDK-8246330: Add TLS Tests for Legacy ECDSA curves
    + JDK-8246453: TestClone crashes with "all collected exceptions
    must come from the same place"
    + JDK-8247246: Add explicit ResolvedJavaType.link and expose
    presence of default methods
    + JDK-8247350: [aarch64] assert(false) failed: wrong size of
    mach node
    + JDK-8247502: PhaseStringOpts crashes while optimising
    effectively dead code
    + JDK-8247615: Initialize the bytes left for the heap sampler
    + JDK-8247824: CTW: C2 (Shenandoah) compilation fails with SEGV
    in SBC2Support::pin_and_expand
    + JDK-8247874: Replacement in VersionProps.java.template not
    working when --with-vendor-bug-url contains '&amp;'
    + JDK-8247979: aarch64: missing side effect of killing flags
    for clearArray_reg_reg
    + JDK-8248214: Add paddings for TaskQueueSuper to reduce
    false-sharing cache contention
    + JDK-8248219: aarch64: missing memory barrier in
    fast_storefield and fast_accessfield
    + JDK-8248348: Regression caused by the update to BCEL 6.0
    + JDK-8248385: [testbug][11u] Adapt TestInitiExceptions to
    jtreg 5.1
    + JDK-8248495: [macos] zerovm is broken due to libffi headers
    location
    + JDK-8248851: CMS: Missing memory fences between free chunk
    check and klass read
    + JDK-8248987: AOT's Linker.java seems to eagerly fail-fast on
    Windows
    + JDK-8249159: Downport test rework for SSLSocketTemplate from
    8224650
    + JDK-8249215: JFrame::setVisible crashed with
  - Dfile.encoding=UTF-8 on Japanese Windows.
    + JDK-8249251: [dark_mode ubuntu 20.04] The selected menu is
    not highlighted in GTKLookAndFeel
    + JDK-8249255: Build fails if source code in cygwin home dir
    + JDK-8249277: TestVerifyIterativeGVN.java is failing with
    timeout in OpenJDK 11
    + JDK-8249278: Revert JDK-8226253 which breaks the spec of
    AccessibleState.SHOWING for JList
    + JDK-8249560: Shenandoah: Fix racy GC request handling
    + JDK-8249801: Shenandoah: Clear soft-refs on requested GC cycle
    + JDK-8249953: Shenandoah: gc/shenandoah/mxbeans tests should
    account for corner cases
    + JDK-8250582: Revert Principal Name type to NT-UNKNOWN when
    requesting TGS Kerberos tickets
    + JDK-8250609: C2 crash in IfNode::fold_compares
    + JDK-8250627: Use -XX:+/-UseContainerSupport for
    enabling/disabling Java container metrics
    + JDK-8250755: Better cleanup for
    jdk/test/javax/imageio/plugins/shared/CanWriteSequence.java
    + JDK-8250787: Provider.put no longer registering aliases in
    FIPS env
    + JDK-8250826: jhsdb does not work with coredump which comes
    from Substrate VM
    + JDK-8250827: Shenandoah: needs to reset/finish StringTable's
    dead count before/after parallel walk
    + JDK-8250844: Make sure {type,obj}ArrayOopDesc accessors check
    the bounds
    + JDK-8251117: Cannot check P11Key size in P11Cipher and
    P11AEADCipher
    + JDK-8251354: Shenandoah: Fix jdk/jfr/tool/TestPrintJSON.java
    test failure
    + JDK-8251451: Shenandoah: Remark ObjectSynchronizer roots with
    I-U
    + JDK-8251469: Better cleanup for
    test/jdk/javax/imageio/SetOutput.java
    + JDK-8251487: Shenandoah: missing detail timing tracking for
    final mark cleaning phase
    + JDK-8252120: compiler/oracle/TestCompileCommand.java
    misspells "occured"
    + JDK-8252157: JDK-8231209 11u backport breaks jmm binary
    compatibility
    + JDK-8252258: [11u] JDK-8242154 changes the default vendor
    + JDK-8252804: [test] Fix 'ReleaseDeflater.java' test after
    downport of 8234011
    + JDK-8253134: JMM_VERSION should remain at 0x20020000 (JDK 10)
    in JDK 11
    + JDK-8253283: [11u] Test build/translations/
    /VerifyTranslations.java failing after JDK-8252258
    + JDK-8253813: Backout JDK-8244287 from 11u: it causes several
    crashes
- Removed patch:
  * gcc-fno-common-fix.patch
    + not needed any more with this version
- Added patch:
  * JDK-8250861.patch
    + Fix regression "8250861: Crash in MinINode::Ideal(PhaseGVN*,
    bool)" introduced in jdk 11.0.9</changelog>
  <changelog author="fstrba@suse.com" date="1604491200">- Enable Sheandoah GC for x86_64 (jsc#ECO-3171)</changelog>
  <changelog author="fstrba@suse.com" date="1605528000">- Update to upstream tag jdk-11.0.9.1-1
  * Fix:
    + JDK-8250861: Crash in MinINode::Ideal(PhaseGVN*, bool)
- Removed patch:
  * JDK-8250861.patch
    + Integrated upstream</changelog>
  <changelog author="fstrba@suse.com" date="1611230400">- Update to upstream tag jdk-11.0.10+9 (January 2021 CPU,
  bsc#1181239)
  * Security fixes
    + JDK-8247619: Improve Direct Buffering of Characters
  * Other changes
    + JDK-6722928: Support SSPI as a native GSS-API provider
    + JDK-7185258: [macosx] Deadlock in SunToolKit.realSync()
    + JDK-8152332: [macosx] JFileChooser cannot be serialized on
    Mac OS X
    + JDK-8161684: [testconf] Add VerifyOops' testing into compiler
    tiers
    + JDK-8171279: Support X25519 and X448 in TLS
    + JDK-8173361: various crashes in
    JvmtiExport::post_compiled_method_load
    + JDK-8173658: JvmtiExport::post_class_unload() is broken for
    non-JavaThread initiators
    + JDK-8191006: hsdis disassembler plugin does not compile with
    binutils 2.29+
    + JDK-8197981: Missing return statement in
    __sync_val_compare_and_swap_8
    + JDK-8198334: java/awt/FileDialog/8003399/bug8003399.java
    fails in headless mode
    + JDK-8200151: Add 8 JNDI tests to com/sun/jndi/dns/ConfigTests/
    + JDK-8208279: Add 8 JNDI tests to com/sun/jndi/dns/EnvTests/
    + JDK-8208483: Add 5 JNDI tests to
    com/sun/jndi/dns/FactoryTests/
    + JDK-8208542: Add 4 JNDI tests to com/sun/jndi/dns/ListTests/
    + JDK-8208665: Amend cross-compilation docs with
    qemu-debootstrap recipe
    + JDK-8210088: ProblemList gc/epsilon/TestMemoryMXBeans.java
    + JDK-8210339: Add 10 JNDI tests to com/sun/jndi/dns/FedTests/
    + JDK-8211450: UndetVar::dup is not copying the kind field to
    the duplicated instance
    + JDK-8212160: JVMTI agent crashes with "assert(_value != 0LL)
    failed: resolving NULL _value"
    + JDK-8212226: SurfaceManager throws "Invalid Image variant"
    for MultiResolutionImage (Windows)
    + JDK-8213400: Support choosing group name in keytool keypair
    generation
    + JDK-8213535: Windows HiDPI html lightweight tooltips are
    truncated
    + JDK-8213698: Improve devkit creation and add support for
    linux/ppc64/ppc64le/s390x
    + JDK-8214025: assert(t-&gt;singleton()) failed: must be a
    constant when ScavengeRootsInCode &lt; 2
    + JDK-8214242: compiler/arguments/TestScavengeRootsInCode.java
    fails because of missing UnlockDiagnosticVMOptions
    + JDK-8214787: Zero builds fail with "undefined
    JavaThread::thread_state()"
    + JDK-8215583: Exclude
    runtime/handshake/HandshakeWalkSuspendExitTest.java
    + JDK-8216012: Infinite loop in RSA KeyPairGenerator
    + JDK-8216324: GetClassMethods is confused by the presence of
    default methods in super interfaces
    + JDK-8217429: WebSocket over authenticating proxy fails to
    send Upgrade headers
    + JDK-8217976: test/jdk/java/net/httpclient/websocket/
    /WebSocketProxyTest.java fails intermittently
    + JDK-8218021: Have jarsigner preserve posix permission
    attributes
    + JDK-8218287: jshell tool: input behavior unstable after
    12-ea+24 on Windows
    + JDK-8218851: JVM crash in custom classloader stress test, JDK
    12 &amp; 13
    + JDK-8220420: Cleanup c1_LinearScan
    + JDK-8222072: JVMTI GenerateEvents() sends CompiledMethodLoad
    events to wrong jvmtiEnv
    + JDK-8222286: Fix for JDK-8213419 is broken on s390
    + JDK-8222527: HttpClient doesn't send HOST header when
    tunelling HTTP/1.1 through http proxy
    + JDK-8222533: jtreg test jdk/internal/platform/cgroup/
    /TestCgroupMetrics.java fails on SLES12.3 linux ppc64le
    machine
    + JDK-8224506: [TESTBUG] TestDockerMemoryMetrics.java fails
    with exitValue = 137
    + JDK-8224555: vmTestbase/nsk/jvmti/scenarios/contention/TC02/
    /tc02t001/TestDescription.java failed
    + JDK-8224650: Add tests to support X25519 and X448 in TLS
    + JDK-8225072: Add LuxTrust certificate that is expiring in
    March 2021 to list of allowed but expired certs
    + JDK-8225329: -XX:+PrintBiasedLockingStatistics causes crash
    during initialization on Windows platforms
    + JDK-8225687: Newly added sspi.cpp in JDK-6722928 still
    contains some small errors
    + JDK-8227006: [linux] Runtime.availableProcessors execution
    time increased by factor of 100
    + JDK-8227275: Within native OOM error handling, assertions may
    hang the process
    + JDK-8227647: [Graal] Test8009761.java fails due to
    "RuntimeException: static java.lang.Object
    compiler.uncommontrap.Test8009761.m3(boolean,boolean) not
    compiled"
    + JDK-8229495: SIGILL in C2 generated OSR compilation
    + JDK-8230910: libsspi_bridge does not build on Windows 32bit
    + JDK-8232114: JVM crashed at imjpapi.dll in native code
    + JDK-8234147: Avoid looking up standard charsets in core
    libraries
    + JDK-8234393: [macos] printing ignores printer tray
    + JDK-8234863: Increase default value of MaxInlineLevel
    + JDK-8235218: Minimal VM is broken after JDK-8173361
    + JDK-8235456: Minimal VM is broken after JDK-8212160
    + JDK-8235829: graal crashes with Zombie.java test
    + JDK-8236124: Minimal VM slowdebug build failed after
    JDK-8212160
    + JDK-8236512: PKCS11 Connection closed after Cipher.doFinal
    and NoPadding
    + JDK-8236944: The legVecZ operand should be limited to
    zmm0-zmm15 registers
    + JDK-8237186: Fix typo in copyright header of
    java/io/Reader/TransferTo.java
    + JDK-8237499: JFR: Include stack trace in the ThreadStart event
    + JDK-8237512: AArch64: aarch64TestHook leaks a BufferBlob
    + JDK-8237524: AArch64: String.compareTo() may return incorrect
    result
    + JDK-8237950: C2 compilation fails with "Live Node limit
    exceeded limit" during ConvI2L::Ideal optimization
    + JDK-8238579: HttpsURLConnection drops the timeout and hangs
    forever in read
    + JDK-8239105: Add exception for expiring Digicert root
    certificates to VerifyCACerts test
    + JDK-8239477: jdk/jfr/jcmd/TestJcmdStartStopDefault.java fails
  - XX:+VerifyOops with "verify_oop: rsi: broken oop"
    + JDK-8239497: SEGV in EdgeUtils::field_name_symbol(Edge const&amp;)
    + JDK-8239886: Minimal VM build fails after JDK-8237499
    + JDK-8240633: Memory leaks in the implementations of
    FileChooserUI
    + JDK-8240690: Race condition between EDT and
    BasicDirectoryModel.FilesLoader.run0()
    + JDK-8241234: Unify monitor enter/exit runtime entries.
    + JDK-8241311: Move some charset mapping tests from closed to
    open
    + JDK-8241797: Add some tests to the problem list
    + JDK-8242029: AArch64: skip G1 array copy pre-barrier if
    marking not active
    + JDK-8242335: Additional Tests for RSASSA-PSS
    + JDK-8242480: Negative value may be returned by
    getFreeSwapSpaceSize() in the docker
    + JDK-8242614: cleanup duplicated test ldap server in some
    com/sun/jndi/ldap/ tests
    + JDK-8242846: Bring back test/jdk/tools/jlink/plugins/
    /OrderResourcesPluginTest.java
    + JDK-8243114: Implement montgomery{Multiply,Square}intrinsics
    on Windows
    + JDK-8243290: Improve diagnostic messages for class
    verification and redefinition failures
    + JDK-8243488: Add tests for set/get SendBufferSize and
    getReceiveBufferSize in DatagramSocket
    + JDK-8243549: sun/security/ssl/CipherSuite/
    /NamedGroupsWithCipherSuite.java failed with Unsupported
    signature algorithm: DSA
    + JDK-8243617: compiler/onSpinWait/TestOnSpinWaitC1.java test
    uses wrong class
    + JDK-8243619: compiler/codecache/CheckSegmentedCodeCache.java
    test misses -version
    + JDK-8244142: some hotspot/runtime tests don't check exit code
    of forked JVM
    + JDK-8244278: Excessive code cache flushes and sweeps
    + JDK-8244282: test/hotspot/jtreg/compiler/intrinsics/
    /Test8237524.java fails with --illegal-access=deny
    + JDK-8244621: [macos10.15] Garbled FX printing plus CoreText
    warnings on Catalina when building with Xcode 11
    + JDK-8244819: hsdis does not compile with binutils 2.34+
    + JDK-8245051: c1 is broken if it is compiled by gcc without
  - fno-lifetime-dse
    + JDK-8245168: jlink should not be treated as a "small" tool
    + JDK-8245400: Upgrade to LittleCMS 2.11
    + JDK-8246381: VM crashes with "Current BasicObjectLock* below
    than low_mark"
    + JDK-8246434: Threads::print_on_error assumes that the heap
    has been set up
    + JDK-8246648: issue with OperatingSystemImpl
    getFreeSwapSpaceSize in docker after 8242480
    + JDK-8247201: Print potential pointer value of readable stack
    memory in hs_err file
    + JDK-8247763: assert(outer-&gt;outcnt() == 2) failed: 'only phis'
    failure in LoopNode::verify_strip_mined()
    + JDK-8247867: Upgrade to freetype 2.10.2
    + JDK-8248190: Enable Power10 system and implement new
    byte-reverse instructions
    + JDK-8248226: TestCloneAccessStressGCM fails with
  - XX:-ReduceBulkZeroing
    + JDK-8248347: windows build broken by JDK-8243114
    + JDK-8248532: Every time I change keyboard language at my
    MacBook, Java crashes
    + JDK-8248552: C2 crashes with SIGFPE due to division by zero
    + JDK-8248596: [TESTBUG] compiler/loopopts/
    /PartialPeelingUnswitch.java times out with Graal enabled
    + JDK-8248745: Add jarsigner and keytool tests for restricted
    algorithms
    + JDK-8248791: sun/util/resources/cldr/TimeZoneNamesTest.java
    fails with -XX:-ReduceInitialCardMarks -XX:-ReduceBulkZeroing
    + JDK-8248845: AArch64: stack corruption after spilling vector
    register
    + JDK-8249176: Update GlobalSignR6CA test certificates
    + JDK-8249183: JVM crash in "AwtFrame::WmSize" method
    + JDK-8249192: MonitorInfo stores raw oops across safepoints
    + JDK-8249602: C2: assert(cnt == _outcnt) failed: no insertions
    allowed
    + JDK-8249603: C1: assert(has_error == false) failed: register
    allocation invalid
    + JDK-8249605: C2: assert(no_dead_loop) failed: dead loop
    detected
    + JDK-8249607: C2: assert(!had_error) failed: bad dominance
    + JDK-8249608: Vector register used by C2 compiled method
    corrupted at safepoint
    + JDK-8249672: Include microcode revision in features_string on
    x86
    + JDK-8249748: gtest silently ignores bad jvm arguments
    + JDK-8249821: Separate libharfbuzz from libfontmanager
    + JDK-8250598: Hyper-V is detected in spite of running on host
    OS
    + JDK-8250605: Linux x86_32 builds fail after JDK-8249821
    + JDK-8250636: iso8601_time returns incorrect offset part on
    MacOS
    + JDK-8250665: Wrong translation for the month name of May in
    ar_JO,LB,SY
    + JDK-8250772: Test com/sun/jndi/ldap/
    /NamingExceptionMessageTest.java fails intermittently with
    javax.naming.ServiceUnavailableException
    + JDK-8250825: C2 crashes with assert(field != __null) failed:
    missing field
    + JDK-8250894: Provide a configure option to build and run
    against the platform libharfbuzz
    + JDK-8250928: JFR: Improve hash algorithm for stack traces
    + JDK-8250968: Symlinks attributes not preserved when using
    jarsigner on zip files
    + JDK-8250984: Memory Docker tests fail on some Linux kernels
    w/o cgroupv1 swap limit capabilities
    + JDK-8251118: BiasedLocking::preserve_marks should not have a
    HandleMark
    + JDK-8251189: com/sun/jndi/ldap/LdapDnsProviderTest.java
    failed due to timeout
    + JDK-8251257: NMT: jcmd VM.native_memory scale=1 crashes
    target VM
    + JDK-8251365: Build failure on AIX after 8250636
    + JDK-8251397: NPE on ClassValue.ClassValueMap.cacheArray
    + JDK-8251456: [TESTBUG] compiler/vectorization/
    /TestVectorsNotSavedAtSafepoint.java failed OutOfMemoryError
    + JDK-8251458: Parse::do_lookupswitch fails with "assert(_cnt
    &gt;= 0) failed"
    + JDK-8251535: Partial peeling at unsigned test adds incorrect
    loop exit check
    + JDK-8251949: ZGC: Set explicit heap size for
    compiler/gcbarriers tests
    + JDK-8252090: JFR: StreamWriterHost::write_unbuffered() stucks
    in an infinite loop OpenJDK (build 13.0.1+9)
    + JDK-8252415: Bump update version for OpenJDK: jdk-11.0.10
    + JDK-8252470: java/awt/dnd/DisposeFrameOnDragCrash/
    /DisposeFrameOnDragTest.java fails on Windows
    + JDK-8252497: Incorrect numeric currency code for ROL
    + JDK-8252660: Shenandoah: support manageable SoftMaxHeapSize
    option
    + JDK-8252679: Two windows specific FileDIalog tests may fail
    on some Windows_Server_2016_Standard
    + JDK-8252696: Loop unswitching may cause out of bound array
    load to be executed
    + JDK-8252754: Hash code calculation of JfrStackTrace is
    inconsistent
    + JDK-8253219: Epsilon: clean up unnecessary includes
    + JDK-8253224: Shenandoah: ShenandoahStrDedupQueue destructor
    calls virtual num_queues()
    + JDK-8253226: Shenandoah: remove unimplemented
    ShenandoahStrDedupQueue::verify
    + JDK-8253269: The CheckCommonColors test should provide more
    info on failure
    + JDK-8253284: Zero OrderAccess barrier mappings are incorrect
    + JDK-8253375: OSX build fails with Xcode 12.0 (12A7209)
    + JDK-8253778: ShenandoahSafepoint::is_at_shenandoah_safepoint
    should not access VMThread state from other threads
    + JDK-8253791: Issue with useAppleColor check in CSystemColors.m
    + JDK-8254016: Test8237524 fails with -XX:-CompactStrings option
    + JDK-8254081: java/security/cert/PolicyNode/
    /GetPolicyQualifiers.java fails due to an expired certificate
    + JDK-8254144: Non-x86 Zero builds fail with return-type
    warning in os_linux_zero.cpp
    + JDK-8254166: Zero: return-type warning in
    zeroInterpreter_zero.cpp
    + JDK-8254177: (tz) Upgrade time-zone data to tzdata2020b
    + JDK-8254185: Fix Code cache sweeper heuristics for JDK 11
    + JDK-8254190: [s390] interpreter misses exception check after
    calling monitorenter
    + JDK-8254790: SIGSEGV in string_indexof_char and
    stringL_indexof_char intrinsics
    + JDK-8254854: [cgroups v1] Metric limits not properly detected
    on some join controller combinations
    + JDK-8254982: (tz) Upgrade time-zone data to tzdata2020c
    + JDK-8255050: Add pkcs11/KeyStore/ClientAuth.sh to Problem list
    + JDK-8255065: Zero: accessor_entry misses the IRIW case
    + JDK-8255226: (tz) Upgrade time-zone data to tzdata2020d
    + JDK-8255269: Unsigned overflow in g1Policy.cpp
    + JDK-8255365: Problem list failing client manual tests
    + JDK-8255457: Shenandoah: cleanup ShenandoahMarkTask
    + JDK-8255466: C2 crashes at ciObject::get_oop() const+0x0
    + JDK-8255550: x86: Assembler::cmpq(Address dst, Register src)
    encoding is incorrect
    + JDK-8255603: Memory/Performance regression after JDK-8210985
    + JDK-8255760: Shenandoah: match constants style in
    ShenandoahMarkTask fallback
    + JDK-8255781: Bump patch update version for OpenJDK:
    jdk-11.0.9.1
    + JDK-8255937: Better cleanup for
    test/jdk/javax/imageio/stream/StreamFlush.java
    + JDK-8256427: Test com/sun/jndi/dns/ConfigTests/
    /PortUnreachable.java does not work on AIX
    + JDK-8256452: Integrate missing part of JDK-8232370 to 11u
    + JDK-8256483: [TESTBUG] serviceability/jvmti/GetClassMethods/
    /libOverpassMethods.c fails to compile on gcc 4.4.x
    + JDK-8256557: libharfbuzz fails to link on gcc 4.4.x due to
  - Wl,-z,defs
    + JDK-8256618: Zero: Linux x86_32 build still fails
    + JDK-8256736: Zero: GTest tests fail with "unsuppported vm
    variant"
    + JDK-8256809: Annotation processing causes NPE during flow
    analysis
    + JDK-8257181: s390x builds are very noisy with gc-sections
    messages
    + JDK-8257242: [macOS] Java app crashes while switching input
    methods
    + JDK-8257545: SunJSSE FIPS regression in key exchange after
    JDK-8171279 11u backport
    + JDK-8257641: Shenandoah: Query is_at_shenandoah_safepoint()
    from control thread should return false
    + JDK-8257701: Shenandoah: objArrayKlass metadata is not marked
    with chunked arrays
    + JDK-8258630: Add expiry exception for QuoVadis root
    certificate
- New upstream dependency on libharfbuzz
- Regenerated patches: missing-return.patch system-pcsclite.patch</changelog>
  <changelog author="fstrba@suse.com" date="1616155200">- Added patches:
  * system-crypto-policy.patch
    + Let OpenJDK use system crypto policies unless explicitely told
    not to
  * nss-security-provider.patch
    + Add the NSS security provider with configuration in generated
    nss.cfg file
  * keytool-default-rsa.patch
    + Make keytool generate RSA keys by default, since only the
    LEGACY system crypto policy allows DSA</changelog>
  <changelog author="pujos.michael@gmail.com" date="1618488000">- moved mozilla-nss dependency to java-11-openjdk-headless package
  This is necessary to be able to do crypto with just
  java-11-openjdk-headless installed. Fixes boo#1184606</changelog>
  <changelog author="fstrba@suse.com" date="1619006400">- Update to upstream tag jdk-11.0.11+9 (April 2021, CPU)
  * Security fixes
    + JDK-8244473: Contextualize registration for JNDI
    + JDK-8244543: Enhanced handling of abstract classes
    + JDK-8249906, CVE-2021-2163, bsc#1185055: Enhance opening JARs
    + JDK-8250568, CVE-2021-2161, bsc#1185056: Less ambiguous
    processing
    + JDK-8253799: Make lists of normal filenames
    + JDK-8257001: Improve Http Client Support
  * Other changes
    + JDK-7107012: sun.jvm.hotspot.code.CompressedReadStream
    readDouble() conversion to long mishandled
    + JDK-7146776: deadlock between URLStreamHandler.getHostAddress
    and file.Handler.openconnection
    + JDK-8086003: Test fails on OSX with java.lang.RuntimeException
    'Narrow klass base: 0x0000000000000000, Narrow klass shift: 3'
    missing
    + JDK-8168869: jdeps: localized messages don't use proper line
    breaks
    + JDK-8180837: SunPKCS11-NSS tests failing with
    CKR_ATTRIBUTE_READ_ONLY and CKR_MECHANISM_PARAM_INVALID
    + JDK-8202343: Disable TLS 1.0 and 1.1
    + JDK-8205992: jhsdb cannot attach to Java processes running in
    Docker containers
    + JDK-8209193: Fix aarch64-linux compilation after -Wreorder
    changes
    + JDK-8210413: AArch64: Optimize div/rem by constant in C1
    + JDK-8210578: AArch64: Invalid encoding for fmlsvs instruction
    + JDK-8211051: jdeps usage of --dot-output doesn't provide
    valid output for modular jar
    + JDK-8211057: Gensrc step CompileProperties generates unstable
    CompilerProperties output
    + JDK-8211150: G1 Full GC not purging code root memory and
    hence causing memory leak
    + JDK-8211825: ModuleLayer.defineModulesWithXXX does not setup
    delegation when module reads automatic module
    + JDK-8212043: Add floating-point Math.min/max intrinsics
    + JDK-8212218: [TESTBUG] runtime/ErrorHandling/
    /TestHeapDumpOnOutOfMemoryErrorInMetaspace.java timed out
    + JDK-8213116: javax/swing/JComboBox/WindowsComboBoxSize/
    /WindowsComboBoxSizeTest.java fails in Windows
    + JDK-8213909: jdeps --print-module-deps should report missing
    dependences
    + JDK-8214180: Need better granularity for sleeping
    + JDK-8214223: tools/jdeps/listdeps/ListModuleDeps.java failed
    due to missing Lib2 file
    + JDK-8214230: Classes generated by SystemModulesPlugin.java
    are not reproducable
    + JDK-8214741: docs/index.html has no title or copyright
    + JDK-8215687: [Graal] unit test CheckGraalIntrinsics failed
    after 8212043
    + JDK-8217848: [Graal] vmTestbase/nsk/jvmti/ResourceExhausted/
    /resexhausted003/TestDescription.java fails
    + JDK-8218482: sun/security/krb5/auto/ReplayCachePrecise.java
    failed - no KrbException thrown
    + JDK-8218550: Add test omitted from JDK-8212043
    + JDK-8221584: SIGSEGV in os::PlatformEvent::unpark() in
    JvmtiRawMonitor::raw_exit while posting method exit event
    + JDK-8221995: AARCH64: problems with CAS instructions encoding
    + JDK-8222518: Remove unnecessary caching of Parker object in
    java.lang.Thread
    + JDK-8222785: aarch64: add necessary masking for immediate
    shift counts
    + JDK-8223186: HotSpot compile warnings from GCC 9
    + JDK-8225773: jdeps --check produces NPE if there are missing
    module dependences
    + JDK-8225805: Java Access Bridge does not close the logger
    + JDK-8226810: Failed to launch JVM because of
    NullPointerException occured on System.props
    + JDK-8229396: jdeps ignores multi-release when
    generate-module-info used on command line
    + JDK-8229474: Shenandoah: Cleanup CM::update_roots()
    + JDK-8232225: Rework the fix for JDK-8071483
    + JDK-8232905: JFR fails with assertion:
    assert(t-&gt;unflushed_size() == 0) failed: invariant
    + JDK-8233164: C2 fails with assert(phase-&gt;C-&gt;get_alias_index(t)
    == phase-&gt;C-&gt;get_alias_index(t_adr)) failed: correct memory
    chain
    + JDK-8233910: java/awt/ColorClass/AlphaColorTest.java is
    failing  intermittently in nightly lnux-x64 system
    + JDK-8233912: aarch64: minor improvements of atomic operations
    + JDK-8234508: VM_HeapWalkOperation::iterate_over_object reads
    non-strong fields with an on-strong load barrier
    + JDK-8234742: Improve handshake logging
    + JDK-8234796: Refactor Handshake::execute to take a more
    complex type than ThreadClosure
    + JDK-8235324: Dying objects are published from users of
    CollectedHeap::object_iterate
    + JDK-8235351: Lookup::unreflect should bind with the original
    caller independent of Method's accessible flag
    + JDK-8237369: Shenandoah: failed vmTestbase/nsk/jvmti/
    /AttachOnDemand/attach021/TestDescription.java test
    + JDK-8237392: Shenandoah: Remove unreliable assertion
    + JDK-8237483: AArch64 C1 OopMap inserted twice fatal error
    + JDK-8237495: Java MIDI fails with a dereferenced memory error
    when asked to send a raw 0xF7
    + JDK-8239355: (dc) Initial value of SO_SNDBUF should allow
    sending large datagrams (macOS)
    + JDK-8240353: AArch64: missing support for
  - XX:+ExtendedDTraceProbes in C1
    + JDK-8240704: CheckHandles.java failed "AssertionError: Handle
    use increased by more than 10 percent."
    + JDK-8240751: Shenandoah: fold ShenandoahTracer definition
    + JDK-8240795: [REDO] 8238384 CTW: C2 compilation fails with
    "assert(store != load-&gt;find_exact_control(load-&gt;in(0)))
    failed: dependence cycle found"
    + JDK-8241598: Upgrade JLine to 3.14.0
    + JDK-8241649: Optimize Character.toString
    + JDK-8241770: Module xxxAnnotation() methods throw NCDFE if
    module-info.class found as resource in unnamed module
    + JDK-8241911: AArch64: Fix a potential register clash issue in
    reduce_add2I
    + JDK-8242030: Wrong package declarations in jline classes after
    JDK-8241598
    + JDK-8242565: Policy initialization issues when the denyAfter
    constraint is enabled
    + JDK-8243618: compiler/rtm/cli tests can be run w/o WhiteBox
    + JDK-8243670: Unexpected test result caused by C2
    MergeMemNode::Ideal
    + JDK-8244088: [Regression] Switch of Gnome theme ends up in
    deadlocked UI
    + JDK-8244154: Update SunPKCS11 provider with PKCS11 v3.0 header
    files
    + JDK-8244340: Handshake processing thread lacks yielding
    + JDK-8244573: java.lang.ArrayIndexOutOfBoundsException thrown
    for malformed class file
    + JDK-8244683: A TSA server used by tests
    + JDK-8245005: javax/net/ssl/compatibility/BasicConnectTest.java
    failed with No enum constant
    + JDK-8245026: PsAdaptiveSizePolicy::_old_gen_policy_is_ready is
    unused
    + JDK-8245283: JFR: Can't handle constant dynamic used by Jacoco
    agent
    + JDK-8245512: CRC32 optimization using AVX512 instructions
    + JDK-8245527: LDAP Channel Binding support for Java
    GSS/Kerberos
    + JDK-8246707: (sc) SocketChannel.read/write throws
    AsynchronousCloseException on closed channel
    + JDK-8246709: sun/security/tools/jarsigner/
    /TsacertOptionTest.java compilation failed after JDK-8244683
    + JDK-8247200: assert((unsigned)fpargs &lt; 32)
    + JDK-8247766: [aarch64] guarantee(val &lt; (1U &lt;&lt; nbits))
    failed: Field too big for insn.
    + JDK-8248336: AArch64: C2: offset overflow in
    BoxLockNode::emit
    + JDK-8248865: Document JNDI/LDAP timeout properties
    + JDK-8248901: Signed immediate support in
    .../share/assembler.hpp is broken.
    + JDK-8249543: Force DirectBufferAllocTest to run with
  - ExplicitGCInvokesConcurrent
    + JDK-8249588: libwindowsaccessbridge issues on 64bit Windows
    + JDK-8249749: modify a primitive array through a stream and a
    for cycle causes jre crash
    + JDK-8249787: Make TestGCLocker more resilient with concurrent
    GCs
    + JDK-8249867: xml declaration is not followed by a newline
    + JDK-8250911: [windows] os::pd_map_memory() error detection
    broken
    + JDK-8251255: [linux] Add process-memory information to hs-err
    and VM.info
    + JDK-8251359: Shenandoah: filter null oops before calling
    enqueue/SATB barrier
    + JDK-8251925: C2: RenaissanceStressTest fails with
    assert(!had_error): bad dominance
    + JDK-8251944: Add Shenandoah test config to
    compiler/gcbarriers/UnsafeIntrinsicsTest.java
    + JDK-8251992: VM crashed running TestComplexAddrExpr.java test
    with -XX:UseAVX=X
    + JDK-8253220: Epsilon: clean up unused code/declarations
    + JDK-8253274: The CycleDMImagetest brokes the system
    + JDK-8253353: Crash in C2: guarantee(n != NULL) failed: No Node
    + JDK-8253368: TLS connection always receives close_notify
    exception
    + JDK-8253404: C2: assert(C-&gt;live_nodes() &lt;=
    C-&gt;max_node_limit()) failed: Live Node limit exceeded limit
    + JDK-8253409: Double-rounding possibility in float fma
    + JDK-8253476: TestUseContainerSupport.java fails on some Linux
    kernels w/o swap limit capabilities
    + JDK-8253524: C2: Refactor code that clones predicates during
    loop unswitching
    + JDK-8253644: C2: assert(skeleton_predicate_has_opaque(iff))
    failed: unexpected
    + JDK-8253681: closed java/awt/dnd/MouseEventAfterStartDragTest/
    /MouseEventAfterStartDragTest.html test failed
    + JDK-8253702: BigSur version number reported as 10.16, should
    be 11.nn
    + JDK-8253756: C2 CompilerThread0 crash in Node::add_req(Node*)
    + JDK-8254104: MethodCounters must exist before nmethod is
    installed
    + JDK-8254734: "dead loop detected" assert failure with patch
    from 8223051
    + JDK-8254748: Bad Copyright header format after JDK-8212218
    + JDK-8254799: runtime/ErrorHandling/
    /TestHeapDumpOnOutOfMemoryError.java fails with release VMs
    + JDK-8255058: C1: assert(is_virtual()) failed: type check
    + JDK-8255351: Add detection for Graviton 2 CPUs
    + JDK-8255368: Math.exp() gives wrong result for large values on
    x86 32-bit platforms
    + JDK-8255387: Japanese characters were printed upside down on
    AIX
    + JDK-8255401: Shenandoah: Allow oldval and newval registers to
    overlap in cmpxchg_oop()
    + JDK-8255479: [aarch64] assert(src-&gt;section_index_of(target) ==
    CodeBuffer::SECT_NONE) failed: sanity
    + JDK-8255544: Create a checked cast
    + JDK-8255559: Leak File Descriptors Because of
    ResolverLocalFilesystem#engineResolveURI()
    + JDK-8255681: print callstack in error case in
    runAWTLoopWithApp
    + JDK-8255734: VM should ignore SIGXFSZ on ppc64, s390 too
    + JDK-8255742: PrintInlining as compiler directive doesn't print
    virtual calls
    + JDK-8255845: Memory leak in imageFile.cpp
    + JDK-8255880: UI of Swing components is not redrawn after their
    internal state changed
    + JDK-8255908: ExceptionInInitializerError due to
    UncheckedIOException while initializing cgroupv1 subsystem
    + JDK-8256025: AArch64: MachCallRuntimeNode::ret_addr_offset()
    is incorrect for stub calls
    + JDK-8256056: Deoptimization stub doesn't save vector registers
    on x86
    + JDK-8256061: RegisterSaver::save_live_registers() omits upper
    halves of ZMM0-15 registers
    + JDK-8256187: [TEST_BUG] Automate bug4275046.java test
    + JDK-8256220: C1: x86_32 fails with -XX:UseSSE=1 after
    JDK-8210764 due to mishandled lir_neg
    + JDK-8256258: some missing NULL checks or asserts after
    CodeCache::find_blob_unsafe
    + JDK-8256264: Printed GlyphVector outline with low DPI has bad
    quality on Windows
    + JDK-8256290: javac/lambda/T8031967.java fails with
    StackOverflowError on x86_32
    + JDK-8256359: AArch64: runtime/ReservedStack/
    /ReservedStackTestCompiler.java fails
    + JDK-8256387: Unexpected result if patching an entire
    instruction on AArch64
    + JDK-8256421: Add 2 HARICA roots to cacerts truststore
    + JDK-8256488: [aarch64] Use ldpq/stpq instead of ld4/st4 for
    small copies in StubGenerator::copy_memory
    + JDK-8256489: Make gtest for long path names on Windows more
    resilient in the presence of virus scanners
    + JDK-8256501: libTestMainKeyWindow fails to build with Xcode
    12.2
    + JDK-8256633: Fix product build on Windows+Arm64
    + JDK-8256682: JDK-8202343 is incomplete
    + JDK-8256751: Incremental rebuild with precompiled header fails
    when touching a header file
    + JDK-8256757: Incorrect MachCallRuntimeNode::ret_addr_offset()
    for CallLeafNoFP on x86_32
    + JDK-8256806: Shenandoah: optimize shenandoah/jni/
    /TestPinnedGarbage.java test
    + JDK-8256807: C2: Not marking stores correctly as mismatched
    in string opts
    + JDK-8256810: Incremental rebuild broken on Macosx
    + JDK-8256818: SSLSocket that is never bound or connected leaks
    socket resources
    + JDK-8256888: Client manual test problem list update
    + JDK-8257083: Security infra test failures caused by
    JDK-8202343
    + JDK-8257408: Bump update version for OpenJDK: jdk-11.0.11
    + JDK-8257423: [PPC64] Support -XX:-UseInlineCaches
    + JDK-8257436: [aarch64] Regressions in ArrayCopyUnalignedDst
    .testByte/testChar for 65-78 bytes when UseSIMDForMemoryOps
    is on
    + JDK-8257513: C2: assert((constant_addr -
    _masm.code()-&gt;consts()-&gt;start()) == con.offset())
    + JDK-8257547: Handle multiple prereqs on the same line in deps
    files
    + JDK-8257561: Some code is not vectorized after 8251925 and
    8250607
    + JDK-8257565: epsilonBarrierSet.hpp should not include
    barrierSetAssembler
    + JDK-8257575: C2: "failed: only phis" assert failure in loop
    strip mining verification
    + JDK-8257594: C2 compiled checkcast of non-null object triggers
    endless deoptimization/recompilation cycle
    + JDK-8257633: Missing -mmacosx-version-min=X flag when linking
    libjvm
    + JDK-8257670: sun/security/ssl/SSLSocketImpl/SSLSocketLeak.java
    reports leaks
    + JDK-8257707: Fix incorrect format string in Http1HeaderParser
    + JDK-8257746: Regression introduced with JDK-8250984 - memory
    might be null in some machines
    + JDK-8257798: [PPC64] undefined reference to
    Klass::vtable_start_offset()
    + JDK-8257884: Re-enable sun/security/ssl/SSLSocketImpl/
    /SSLSocketLeak.java as automatic test
    + JDK-8257910: [JVMCI] Set exception_seen accordingly in the
    runtime.
    + JDK-8257997: sun/security/ssl/SSLSocketImpl/SSLSocketLeak.java
    again reports leaks after JDK-8257884
    + JDK-8257999: Parallel GC crash in gc/parallel/
    /TestDynShrinkHeap.java: new region is not in covered_region
    + JDK-8258077: Using -Xcheck:jni can lead to a double-free after
    JDK-8193234
    + JDK-8258247: Couple of issues in fix for JDK-8249906
    + JDK-8258373: Update the text handling in the JPasswordField
    + JDK-8258396: SIGILL in jdk.jfr.internal.PlatformRecorder
    .rotateDisk()
    + JDK-8258419: RSA cipher buffer cleanup
    + JDK-8258471: "search codecache" clhsdb command does not work
    + JDK-8258534: Epsilon: clean up unused includes
    + JDK-8258805: Japanese characters not entered by mouse click
    on Windows 10
    + JDK-8258833: Cancel multi-part cipher operations in SunPKCS11
    after failures
    + JDK-8258836: JNI local refs exceed capacity
    getDiagnosticCommandInfo
    + JDK-8258884: [TEST_BUG] Convert applet-based test
    open/test/jdk/javax/swing/JMenuItem/8031573/bug8031573.java
    to a regular java test
    + JDK-8259007: This test printed a blank page
    + JDK-8259048: (tz) Upgrade time-zone data to tzdata2020f
    + JDK-8259049: Uninitialized variable after JDK-8257513
    + JDK-8259231: Epsilon: improve performance under contention
    during virtual space expansion
    + JDK-8259271: gc/parallel/TestDynShrinkHeap.java still fails
    "assert(covered_region.contains(new_memregion)) failed: new
    region is not in covered_region"
    + JDK-8259312: VerifyCACerts.java fails as soneraclass2ca cert
    will expire in 90 days
    + JDK-8259319: Illegal package access when SunPKCS11 requires
    SunJCE's classes
    + JDK-8259339: AllocateUninitializedArray C2 intrinsic fails
    with void.class input
    + JDK-8259428: AlgorithmId.getEncodedParams() should return copy
    + JDK-8259446: runtime/jni/checked/
    /TestCheckedReleaseArrayElements.java fails with stderr not
    empty
    + JDK-8259451: Zero: skip serviceability/sa tests, set vm.hasSA
    to false
    + JDK-8259580: Shenandoah: uninitialized label in
    VerifyThreadGCState
    + JDK-8259619: C1: 3-arg StubAssembler::call_RT stack-use
    condition is incorrect
    + JDK-8259633: compiler/graalunit/CoreTest.java fails with NPE
    after JDK-8244543
    + JDK-8259706: C2 compilation fails with assert(vtable_index ==
    Method::invalid_vtable_index) failed: correct sentinel value
    + JDK-8259707: LDAP channel binding does not work with StartTLS
    extension
    + JDK-8259773: Incorrect encoding of AVX-512 kmovq instruction
    + JDK-8259849: Shenandoah: Rename store-val to IU-barrier
    + JDK-8259949: x86 32-bit build fails when -fcf-protection is
    passed in the compiler flags
    + JDK-8259954: gc/shenandoah/mxbeans tests fail with -Xcomp
    + JDK-8260029: aarch64: fix typo in verify_oop_array
    + JDK-8260308: Update LogCompilation junit to 4.13.1
    + JDK-8260338: Some fields in HaltNode is not cloned
    + JDK-8260349: Cannot programmatically retrieve Metaspace max
    set via JAVA_TOOL_OPTIONS
    + JDK-8260356: (tz) Upgrade time-zone data to tzdata2021a
    + JDK-8260378: [TESTBUG] DcmdMBeanTestCheckJni.java reports
    false positive
    + JDK-8260497: Shenandoah: Improve SATB flushing
    + JDK-8260502: [s390] NativeMovRegMem::verify() fails because
    it's too strict
    + JDK-8260632: Build failures after JDK-8253353
    + JDK-8260704: ParallelGC: oldgen expansion needs release-store
    for _end
    + JDK-8261022: Fix incorrect result of Math.abs() with char type
    + JDK-8261089: [TESTBUG] native library of test
    TestCheckedReleaseCriticalArray.java fails to compile with
    gcc 4.x
    + JDK-8261183: Follow on to Make lists of normal filenames
    + JDK-8261209: isStandalone property: remove dependency on
    pretty-print
    + JDK-8261231: Windows IME was disabled after DnD operation
    + JDK-8261251: Shenandoah: Use object size for full GC
    humongous compaction
    + JDK-8261310: PPC64 Zero build fails with
    'VMError::controlled_crash(int)::FunctionDescriptor
    functionDescriptor' has incomplete type and cannot be defined
    + JDK-8261334: NMT: tuning statistic shows incorrect hash
    distribution
    + JDK-8261413: Shenandoah: Disable class-unloading in I-U mode
    + JDK-8261522: [PPC64] AES intrinsics write beyond the
    destination array
    + JDK-8261534: Test sun/security/pkcs11/KeyAgreement/
    /IllegalPackageAccess.java fails on platforms where no nsslib
    artifacts are defined
    + JDK-8261585: Restore HandleArea used in
    Deoptimization::uncommon_trap
    + JDK-8261753: Test java/lang/System/OsVersionTest.java still
    failing on BigSur patch versions after JDK-8253702
    + JDK-8261829: Exclude tools/jlink/JLinkReproducibleTest.java
    in 11u
    + JDK-8261912: Code IfNode::fold_compares_helper more
    defensively
    + JDK-8261920: [AIX] jshell command throws java.io.IOError on
    non English locales
    + JDK-8262018: Wrong format in SAP copyright header of
    OsVersionTest
    + JDK-8263069: Exclude some failing tests from
    security/infra/java/security/cert/CertPathValidator</changelog>
  <changelog author="fstrba@suse.com" date="1620043200">- Remove all Jpackage provides for SLE12 in order to avoid
  installing this package as default Java on SLE12-SP5
  (bsc#1185476)</changelog>
  <changelog author="fstrba@suse.com" date="1621512000">- Modified patch:
  * nss-security-provider.patch
    + make the NSS provider first in the list</changelog>
  <changelog author="fstrba@suse.com" date="1626868800">- Update to upstream tag jdk-11.0.12+7 (July 2021, CPU)
  * Security fixes
    + JDK-8256157: Improve bytecode assembly
    + JDK-8256491: Better HTTP transport
    + JDK-8258432, CVE-2021-2341, bsc#1188564: Improve file
    transfers
    + JDK-8260453: Improve Font Bounding
    + JDK-8260960: Signs of jarsigner signing
    + JDK-8260967, CVE-2021-2369, bsc#1188565: Better jar file
    validation
    + JDK-8262380: Enhance XML processing passes
    + JDK-8262403: Enhanced data transfer
    + JDK-8262410: Enhanced rules for zones
    + JDK-8262477: Enhance String Conclusions
    + JDK-8262967: Improve Zip file support
    + JDK-8264066, CVE-2021-2388, bsc#1188566: Enhance compiler
    validation
    + JDK-8264079: Improve abstractions
    + JDK-8264460: Improve NTLM support
  * Other changes
    + JDK-6847157: java.lang.NullPointerException: HDC for
    component at sun.java2d.loops.Blit.Blit
    + JDK-7106851: Test should not use System.exit
    + JDK-8073446: TimeZone getOffset API does not  return a dst
    offset between years 2038-2137
    + JDK-8076190: Customizing the generation of a PKCS12 keystore
    + JDK-8153005: Upgrade the default PKCS12 encryption/MAC
    algorithms
    + JDK-8171303: sun/java2d/pipe/InterpolationQualityTest.java
    fails on Windows &amp; Linux
    + JDK-8177068: incomplete classpath causes NPE in Flow
    + JDK-8185734: [Windows] Structured Exception Catcher missing
    around gtest execution
    + JDK-8187450: JNI local refs exceeds capacity warning in
    NetworkInterface::getAll
    + JDK-8190763: Class cast exception on (CompoundEdit)
    UndoableEditEvent.getEdit()
    + JDK-8195841: PNGImageReader.readNullTerminatedString() doesnt
    check for non-null terminated strings with length equal to
    maxLen
    + JDK-8196100: javax/swing/text/JTextComponent/5074573/
    /bug5074573.java fails
    + JDK-8199646: JShell tests: jdk/jshell/
    /FailOverDirectExecutionControlTest.java failed with
    java.lang.UnsupportedOperationException
    + JDK-8206925: Support the certificate_authorities extension
    + JDK-8207160: ClassReader::adjustMethodParams can potentially
    return null if the args list is empty
    + JDK-8207247: AARCH64: Enable Minimal and Client VM builds
    + JDK-8207404: MulticastSocket tests failing on AIX
    + JDK-8207779: Method::is_valid_method() compares 'this' with
    NULL
    + JDK-8208061: runtime/LoadClass/TestResize.java fails with
    "Load factor too high" when running in CDS mode.
    + JDK-8209459: TestSHA512MultiBlockIntrinsics failed on AArch64
    + JDK-8210443: Migrate Locale matching tests to JDK Repo.
    + JDK-8213231: ThreadSnapshot::_threadObj can become stale
    + JDK-8213483: ARM32: runtime/ErrorHandling/
    /ShowRegistersOnAssertTest.java jtreg test fail
    + JDK-8213725: JShell NullPointerException due to class file
    with unexpected package
    + JDK-8213794: ARM32: disable TypeProfiling,
    CriticalJNINatives, Serviceablity tests for ARM32
    + JDK-8213845: ARM32: Interpreter doesn't call result handler
    after native calls
    + JDK-8214128: ARM32: wrong stack alignment on
    Deoptimization::unpack_frames
    + JDK-8214512: ARM32: Jtreg test compiler/c2/Test8062950.java
    fails on ARM
    + JDK-8214854: JDWP: Unforseen output truncation in logging
    + JDK-8214922: Add vectorization support for fmin/fmax
    + JDK-8215009: GCC 8 compilation error in libjli
    + JDK-8216184: CDS/appCDS tests failed on Windows due to long
    path to a classlist file
    + JDK-8216259: AArch64: Vectorize Adler32 intrinsics
    + JDK-8216314: SIGILL in CodeHeapState::print_names()
    + JDK-8217348: assert(thread-&gt;is_Java_thread()) failed: just
    checking
    + JDK-8217465: [REDO] - Optimize CodeHeap Analytics
    + JDK-8217561: X86: Add floating-point Math.min/max intrinsics
    + JDK-8217918: C2: -XX:+AggressiveUnboxing is broken
    + JDK-8218458: [TESTBUG] runtime/NMT/
    /CheckForProperDetailStackTrace.java fails with Expected
    stack trace missing from output
    + JDK-8219142: Remove unused JIMAGE_ResourcePath
    + JDK-8219586: CodeHeap State Analytics processes dead nmethods
    + JDK-8220074: Clean up GCC 8.3 errors in LittleCMS
    + JDK-8220407: compiler/intrinsics/math/
    /TestFpMinMaxIntrinsics.java timedout
    + JDK-8222302: [TESTBUG] test/hotspot/jtreg/compiler/intrinsics/
    /sha/cli/TestUseSHAOptionOnUnsupportedCPU.java fails on any
    other CPU
    + JDK-8222412: AARCH64: multiple instructions encoding issues
    + JDK-8223020: aarch64: expand minI_rReg and maxI_rReg patterns
    into separate instructions
    + JDK-8223444: Improve CodeHeap Free Space Management
    + JDK-8223504: Improve performance of forall loops by better
    inlining of "iterator()" methods
    + JDK-8223667: ASAN build broken
    + JDK-8225081: Remove Telia Company CA certificate expiring in
    April 2021
    + JDK-8225116: Test OwnedWindowsLeak.java intermittently fails
    + JDK-8225438: javax/net/ssl/TLSCommon/
    /TestSessionLocalPrincipal.java failed with Read timed out
    + JDK-8225756: [testbug] compiler/loopstripmining/
    /CheckLoopStripMining.java sets too short a
    SafepointTimeoutDelay
    + JDK-8226374: Restrict TLS signature schemes and named groups
    + JDK-8226627: assert(t-&gt;singleton()) failed: must be a constant
    + JDK-8226721: Missing intrinsics for Math.ceil, floor, rint
    + JDK-8227080: (fs) Files.newInputStream(...).skip(n) is slow
    + JDK-8227222: vmTestbase/jit/FloatingPoint/gen_math/Loops04/
    /Loops04.java failed XMM register should be 0-15
    + JDK-8227609: (fs) Files.newInputStream(...).skip(n) should
    allow skipping beyond file size
    + JDK-8230428: Cleanup dead CastIP node code in formssel.cpp
    + JDK-8231460: Performance issue (CodeHeap) with large free
    blocks
    + JDK-8231713: x86_32 build failures after JDK-8226721 (Missing
    intrinsics for Math.ceil, floor, rint)
    + JDK-8231841: AArch64: debug.cpp help() is missing an AArch64
    line for pns
    + JDK-8232084: HotSpot build failed with GCC 9.2.1
    + JDK-8232591: AArch64: Add missing match rules for smaddl,
    smsubl and smnegl
    + JDK-8233185: HttpServer.stop() blocks indefinitely when
    called on dispatch thread
    + JDK-8233787: Break cycle in vm_version* includes
    + JDK-8233948: AArch64: Incorrect mapping between OptoReg and
    VMReg for high 64 bits of Vector Register
    + JDK-8234355: Buffer overflow in jcmd GC.class_stats due to
    too many classes
    + JDK-8235368: Update BCEL to Version 6.4.1
    + JDK-8236859: WebSocket over authenticating proxy fails with
    NPE
    + JDK-8236992: AArch64: remove redundant load_klass in itable
    stub
    + JDK-8237743: test/langtools/jdk/jshell/
    /FailOverExecutionControlTest.java fails No
    ExecutionControlProvider with name 'nonExistent' and parameter
    keys: []
    + JDK-8237804: sun/security/mscapi tests fail with "Key pair
    not generated, alias &lt;nnnnnn&gt; already exists"
    + JDK-8238175: CTW: Class.getDeclaredMethods fails with
    assert(k-&gt;is_subclass_of(SystemDictionary::Throwable_klass()))
    failed: invalid exception class
    + JDK-8238567: SoftMainMixer.processAudioBuffers(): Wrong
    handling of stoppedMixers
    + JDK-8238812: assert(false) failed: bad AD file
    + JDK-8239312: [macos] javax/swing/JFrame/NSTexturedJFrame/
    /NSTexturedJFrame.java
    + JDK-8239386: handle ContendedPaddingWidth in
    vm_version_aarch64
    + JDK-8239536: Can't use 'java.util.List' object after
    importing 'java.awt.List'
    + JDK-8240487: Cleanup whitespace in .cc, .hh, .m, and .mm files
    + JDK-8240848: ArrayIndexOutOfBoundsException buf for
    TextCallbackHandler
    + JDK-8241082: Upgrade IANA Language Subtag Registry data to
    03-16-2020 version
    + JDK-8241087: Build failure with VS 2019 (16.5.0) due to C2039
    and C2873
    + JDK-8241101: [s390] jtreg test failure after JDK-8238696: not
    conformant features string
    + JDK-8241248: NullPointerException in
    sun.security.ssl.HKDF.extract(HKDF.java:93)
    + JDK-8241372: Several test failures due to
    javax.net.ssl.SSLException: Connection reset
    + JDK-8241475: AArch64: Add missing support for PopCountVI node
    + JDK-8241829: Cleanup the code for PrinterJob on windows
    + JDK-8241960: The SHA3 message digests impl of SUN provider
    are not thread safe after cloned
    + JDK-8242010: Upgrade IANA Language Subtag Registry to Version
    2020-04-01
    + JDK-8242429: Better implementation for sign extract
    + JDK-8242557: Add length limit for strings in PNGImageWriter
    + JDK-8242919: Paste locks up jshell
    + JDK-8243155: AArch64: Add support for SqrtVF
    + JDK-8243240: AArch64: Add support for MulVB
    + JDK-8243452: JFR: Could not create chunk in repository with
    over 200 recordings
    + JDK-8243559: Remove root certificates with 1024-bit keys
    + JDK-8243597: AArch64: Add support for integer vector abs
    + JDK-8244031: HttpClient should have more tests for HEAD
    requests
    + JDK-8244205: HTTP/2 tunnel connections through proxy may be
    reused regardless of which proxy is selected
    + JDK-8244847: Linux/PPC: runtime/CompressedOops/
    /CompressedClassPointers: smallHeapTest fails
    + JDK-8245511: G1 adaptive IHOP does not account for
    reclamation of humongous objects by young GC
    + JDK-8246274: G1 old gen allocation tracking is not in a
    separate class
    + JDK-8247354: [aarch64] PopFrame causes
    assert(oopDesc::is_oop(obj)) failed: not an oop
    + JDK-8247408: IdealGraph bit check expression canonicalization
    + JDK-8247432: Update IANA Language Subtag Registry to Version
    2020-09-29
    + JDK-8247438: JShell: When FailOverExecutionControlProvider
    fails the proximal cause is not shown
    + JDK-8247753: UIManager.getSytemLookAndFeelClassName() returns
    wrong value on Fedora 32
    + JDK-8248043: Need to eliminate excessive i2l conversions
    + JDK-8248411: [aarch64] Insufficient error handling when
    CodeBuffer is exhausted
    + JDK-8248568: compiler/c2/TestBit.java failed: test missing
    from stdout/stderr
    + JDK-8248870: AARCH64: I2L/L2I conversions can be skipped for
    masked positive values
    + JDK-8249142: java/awt/FontClass/CreateFont/DeleteFont.sh is
    unstable
    + JDK-8249189: AARCH64: more L2I conversions can be skipped
    + JDK-8249719: MethodHandle performance suffers from bad
    ResolvedMethodTable hash function
    + JDK-8249875: GCC 10 warnings -Wtype-limits with JFR code
    + JDK-8250635: MethodArityHistogram should use Compile_lock in
    favour of fancy checks
    + JDK-8250876: Fix issues with cross-compile on macos
    + JDK-8251031: Some vmTestbase/nsk/monitoring/RuntimeMXBean
    tests fail with hostnames starting from digits
    + JDK-8251525: AARCH64: Faster Math.signum(fp)
    + JDK-8252259: AArch64: Adjust default value of FLOATPRESSURE
    + JDK-8252311: AArch64: save two words in itable lookup stub
    + JDK-8252779: compiler/graalunit/HotspotTest.java failed after
    8251525
    + JDK-8252883: AccessDeniedException caused by delayed file
    deletion on Windows
    + JDK-8253167: ARM32 builds fail after JDK-8247910
    + JDK-8253572: [windows] CDS archive may fail to open with long
    file names
    + JDK-8253923: C2 doesn't always run loop opts for compilations
    that include loops
    + JDK-8253948: Memory leak in ImageFileReader
    + JDK-8254631: Better support ALPN byte wire values in SunJSSE
    + JDK-8254717: isAssignableFrom checks in
    KeyFactorySpi.engineGetKeySpec appear to be backwards
    + JDK-8255086: Update the root locale display names
    + JDK-8255625: AArch64: Implement Base64.encodeBlock
    accelerator/intrinsic
    + JDK-8255763: C2: OSR miscompilation caused by invalid memory
    instruction placement
    + JDK-8255992: JFR EventWriter does not use first string from
    StringPool with id 0
    + JDK-8256037: [TESTBUG] com/sun/jndi/dns/ConfigTests/
    /PortUnreachable.java fails due to the hard coded threshold
    is small
    + JDK-8256244: java/lang/ProcessHandle/PermissionTest.java
    fails with TestNG 7.1
    + JDK-8256287: [windows] add loop fuse to
    map_or_reserve_memory_aligned
    + JDK-8256523: Streamline Java SHA2 implementation
    + JDK-8257414: Drag n Drop target area is wrong on high DPI
    systems
    + JDK-8257569: Failure observed with
    JfrVirtualMemory::initialize
    + JDK-8257574: C2: "failed: parsing found no loops but there
    are some" assert failure
    + JDK-8257580: Bump update version for OpenJDK: jdk-11.0.12
    + JDK-8257604: JNI_ArgumentPusherVaArg leaks valist
    + JDK-8257621: JFR StringPool misses cached items across
    consecutive recordings
    + JDK-8257796: [TESTBUG]
    TestUseSHA512IntrinsicsOptionOnSupportedCPU.java fails
    on x86_32
    + JDK-8257822: C2 crashes with SIGFPE due to a division that
    floats above its zero check
    + JDK-8257828: SafeFetch may crash if invoked in non-JavaThreads
    + JDK-8257853: Remove dependencies on JNF's JNI utility
    functions in AWT and 2D code
    + JDK-8257858: [macOS]: Remove JNF dependency from
    libosxsecurity/KeystoreImpl.m
    + JDK-8257860: [macOS]: Remove JNF dependency from
    libosxkrb5/SCDynamicStoreConfig.m
    + JDK-8257988: Remove JNF dependency from
    libsaproc/MacosxDebuggerLocal.m
    + JDK-8258414: OldObjectSample events too expensive
    + JDK-8258505: [TESTBUG] TestDivZeroWithSplitIf.java fails due
    to missing UnlockDiagnosticVMOptions
    + JDK-8258753: StartTlsResponse.close() hangs due to
    synchronization issues
    + JDK-8259061: C2: assert(found) failed: memory-writing node is
    not placed in its original loop or an ancestor of it
    + JDK-8259227: C2 crashes with SIGFPE due to a division that
    floats above its zero check
    + JDK-8259232: Bad JNI lookup during printing
    + JDK-8259276: C2: Empty expression stack when reexecuting
    tableswitch/lookupswitch instructions after deoptimization
    + JDK-8259343: [macOS] Update JNI error handling in Cocoa code.
    + JDK-8259585: Accessible actions do not work on mac os x
    + JDK-8259651: [macOS] Replace JNF_COCOA_ENTER/EXIT macros
    + JDK-8259662: Don't wrap SocketExceptions into SSLExceptions
    in SSLSocketImpl
    + JDK-8259710: Inlining trace leaks memory
    + JDK-8259729: Missed JNFInstanceOf -&gt; IsInstanceOf conversion
    + JDK-8259777: Incorrect predication condition generated by ADLC
    + JDK-8259786: initialize last parameter of getpwuid_r
    + JDK-8259843: initialize dli_fname array before calling
    dll_address_to_library_name
    + JDK-8259869: [macOS] Remove desktop module dependencies on
    JNF Reference APIs
    + JDK-8259886: Improve SSL session cache performance and
    scalability
    + JDK-8259983: do not use uninitialized expand_ms value in
    G1CollectedHeap::expand_heap_after_young_collection
    + JDK-8260030: Improve stringStream buffer handling
    + JDK-8260236: better init AnnotationCollector _contended_group
    + JDK-8260255: C1: LoopInvariantCodeMotion constructor can
    leave some fields uninitialized
    + JDK-8260284: C2: assert(_base == Int) failed: Not an Int
    + JDK-8260380: Upgrade to LittleCMS 2.12
    + JDK-8260420: C2 compilation fails with assert(found_sfpt)
    failed: no node in loop that's not input to safepoint
    + JDK-8260426: awt debug_mem.c DMem_AllocateBlock might leak
    memory
    + JDK-8260432: allocateSpaceForGP in freetypeScaler.c might
    leak memory
    + JDK-8260616: Removing remaining JNF dependencies in the
    java.desktop module
    + JDK-8260653: Unreachable nodes keep speculative types alive
    + JDK-8260707: java/lang/instrument/PremainClass/
    /InheritAgent0100.java times out
    + JDK-8260925: HttpsURLConnection does not work  with other
    JSSE provider.
    + JDK-8260926: Trace resource exhausted events unconditionally
    + JDK-8261020: Wrong format parameter in
    create_emergency_chunk_path
    + JDK-8261027: AArch64: Support for LSE atomics C++ HotSpot code
    + JDK-8261167: print_process_memory_info add a close call after
    fopen
    + JDK-8261170: Upgrade to freetype 2.10.4
    + JDK-8261198: [macOS] Incorrect JNI parameters in number
    conversion in A11Y code
    + JDK-8261235: C1 compilation fails with
    assert(res-&gt;vreg_number() == index) failed: conversion check
    + JDK-8261261: The version extra fields needs to be overridable
    in jib-profiles.js
    + JDK-8261262: Kitchensink24HStress.java crashed with
    EXCEPTION_ACCESS_VIOLATION
    + JDK-8261354: SIGSEGV at MethodIteratorHost
    + JDK-8261355: No data buffering in SunPKCS11 Cipher encryption
    when the underlying mechanism has no padding
    + JDK-8261397: try catch Method failing to work when dividing
    an integer by 0
    + JDK-8261422: Adjust problematic String.format calls in
    jdk/internal/util/Preconditions.java outOfBoundsMessage
    + JDK-8261447: MethodInvocationCounters frequently run into
    overflow
    + JDK-8261481: Cannot read Kerberos settings in dynamic store
    on macOS Big Sur
    + JDK-8261505: Test test/hotspot/jtreg/gc/parallel/
    /TestDynShrinkHeap.java killed by Linux OOM Killer
    + JDK-8261601: free memory in early return in
    Java_sun_nio_ch_sctp_SctpChannelImpl_receive0
    + JDK-8261649: AArch64: Optimize LSE atomics in C++ code
    + JDK-8261730: C2 compilation fails with
    assert(store-&gt;find_edge(load) != -1) failed: missing
    precedence edge
    + JDK-8261752: Multiple GC test are missing memory requirements
    + JDK-8261791: (sctp) handleSendFailed in SctpChannelImpl.c
    potential leaks
    + JDK-8261812: C2 compilation fails with assert(!had_error)
    failed: bad dominance
    + JDK-8261914: IfNode::fold_compares_helper faces
    non-canonicalized bool when running JRuby JSON workload
    + JDK-8262093: java/util/concurrent/tck/JSR166TestCase.java
    failed "assert(false) failed: unexpected node"
    + JDK-8262110: DST starts from incorrect time in 2038
    + JDK-8262121: [11u] Redo 8244287: JFR: Methods samples have
    line number 0
    + JDK-8262163: Extend settings printout in jcmd VM.metaspace
    + JDK-8262295: C2: Out-of-Bounds Array Load from Clone Source
    + JDK-8262298: G1BarrierSetC2::step_over_gc_barrier fails with
    assert "bad barrier shape"
    + JDK-8262446: DragAndDrop hangs on Windows
    + JDK-8262461: handle wcstombsdmp return value correctly in
    unix awt_InputMethod.c
    + JDK-8262465: Very long compilation times and high memory
    consumption in C2 debug builds
    + JDK-8262726: AArch64: C1 StubAssembler::call_RT can corrupt
    stack
    + JDK-8262739: String inflation C2 intrinsic prevents insertion
    of anti-dependencies
    + JDK-8262829: Native crash in
    Win32PrintServiceLookup.getAllPrinterNames()
    + JDK-8262837: handle split_USE correctly
    + JDK-8262900: ToolBasicTest fails to access HTTP server it
    starts
    + JDK-8263260: [s390] Support latest hardware (z14 and z15)
    + JDK-8263311: Watch registry changes for remote printers
    update instead of polling
    + JDK-8263361: Incorrect arraycopy stub selected by C2 for SATB
    collectors
    + JDK-8263404: RsaPrivateKeySpec is always recognized as
    RSAPrivateCrtKeySpec in RSAKeyFactory.engineGetKeySpec
    + JDK-8263425: AArch64: two potential bugs in C1
    LIRGenerator::generate_address()
    + JDK-8263448: CTW: fatal error: meet not symmetric
    + JDK-8263504: Some OutputMachOpcodes fields are uninitialized
    + JDK-8263557: Possible NULL dereference in
    Arena::destruct_contents()
    + JDK-8263558: Possible NULL dereference in fast path arena
    free if ZapResourceArea is true
    + JDK-8263676: AArch64: one potential bug in C1
    LIRGenerator::generate_address()
    + JDK-8263729: [test] divert spurious output away from stream
    under test in ProcessBuilder Basic test
    + JDK-8263846: Bad JNI lookup getFocusOwner in accessibility
    code on Mac OS X
    + JDK-8264047: Duplicate global variable 'jvm' in libjavajpeg
    and libawt
    + JDK-8264096: slowdebug jvm crashes when StrInflatedCopy match
    rule is not supported
    + JDK-8264151: ciMethod::ensure_method_data() should return
    false is loading resulted in empty state
    + JDK-8264173: [s390] Improve Hardware Feature Detection And
    Reporting
    + JDK-8264190: Harden TLS interop tests
    + JDK-8264223: CodeHeap::verify fails extra_hops assertion in
    fastdebug test
    + JDK-8264328: Broken license in
    javax/swing/JComboBox/8072767/bug8072767.java
    + JDK-8264360: Loop strip mining verification fails with
    "should be on the backedge"
    + JDK-8264626: C1 should be able to inline excluded methods
    + JDK-8264640: CMS ParScanClosure misses a barrier
    + JDK-8264786: [macos] All Swing/AWT apps cause Allow
    Notifications prompt to appear when app is launched
    + JDK-8264821: DirectIOTest fails on a system with large block
    size
    + JDK-8264848: [macos] libjvm.dylib linker warning due to macOS
    version mismatch
    + JDK-8264923: PNGImageWriter.write_zTXt throws Exception with
    a typo
    + JDK-8264958: C2 compilation fails with assert "n is later
    than its clone"
    + JDK-8265099: Revert backport to 11u of 8236859: WebSocket
    over authenticating proxy fails with NPE
    + JDK-8265154: vinserti128 operand mix up for KNL platforms
    + JDK-8265239: Shenandoah: Shenandoah heap region count could
    be off by 1
    + JDK-8265417: Backport of JDK-8249672 breaks Solaris x86 build
    + JDK-8265421: java/lang/String/StringRepeat.java test is
    missing a memory requirement
    + JDK-8265462: Handle multiple slots in the NSS Internal Module
    from SunPKCS11's Secmod
    + JDK-8265537: x86 version string truncated after JDK-8249672
    11u backport
    + JDK-8265666: Enable AIX build platform to make external debug
    symbols
    + JDK-8265677: CMS: CardTableBarrierSet::write_ref_array_work()
    lacks storestore barrier
    + JDK-8265690: Use the latest Ubuntu base image version in
    Docker testing
    + JDK-8265718: Build failure after JDK-8258414 11u backport
    + JDK-8265750: Fatal error in safepoint.cpp after backport of
    8258414
    + JDK-8265784: [C2] Hoisting of DecodeN leaves MachTemp inputs
    behind
    + JDK-8265938: C2's conditional move optimization does not
    handle top Phi
    + JDK-8266220: keytool still prompt for store password on a
    password-less pkcs12 file if -storetype pkcs12 is specified
    + JDK-8266293: Key protection using PBEWithMD5AndDES fails with
    "java.security.InvalidAlgorithmParameterException: Salt must
    be 8 bytes long"
    + JDK-8266713: [AIX] Build failure after 11u backport of
    JDK-8247753
    + JDK-8266802: Shenandoah: Round up region size to page size
    unconditionally
    + JDK-8266892: avoid maybe-uninitialized gcc warnings on linux
    s390x
    + JDK-8266929: Unable to use algorithms from 3p providers
    + JDK-8267235: [macos_aarch64]
    InterpreterRuntime::throw_pending_exception messing up LR
    results in crash
    + JDK-8267561: Shenandoah: Reference processing not properly
    setup for outside of cycle degenerated GC
    + JDK-8267599: Revert the change to the default PKCS12
    macAlgorithm and macIterationCount props for 11u/8u/7u
    + JDK-8267641: [11u] 8227609 backport typo
    + JDK-8267721: Enable sun/security/pkcs11 tests for Amazon
    Linux 2 AArch64
    + JDK-8268678: LetsEncryptCA.java test fails as Let's Encrypt
    Authority X3 is retired</changelog>
  <changelog author="schwab@suse.de" date="1628078400">- riscv64-zero.patch: Add support for riscv64 (zero VM)</changelog>
  <changelog author="fstrba@suse.com" date="1629979200">- Added patch:
  * jdk11-glibc234.patch
    + fix build with glibc-2.34 (bsc#1189201)</changelog>
  <changelog author="fstrba@suse.com" date="1631534400">- Modified patch:
  * nss-security-provider.patch
    + revert recent changes making NSS provider the default one
    + fixes bsc#1190252</changelog>
  <changelog author="fstrba@suse.com" date="1631793600">- Added patch:
  * fips.patch
    + implement FIPS support in OpenJDK</changelog>
  <changelog author="fstrba@suse.com" date="1634817600">- Update to upstream tag jdk-11.0.13+8 (October 2021 CPU)
  * Security fixes
    + JDK-8163326, CVE-2021-35550, bsc#1191901: Update the default
    enabled cipher suites preference
    + JDK-8254967, CVE-2021-35565, bsc#1191909:
    com.sun.net.HttpsServer spins on TLS session close
    + JDK-8263314: Enhance XML Dsig modes
    + JDK-8265167, CVE-2021-35556, bsc#1191910: Richer Text Editors
    + JDK-8265574: Improve handling of sheets
    + JDK-8265580, CVE-2021-35559, bsc#1191911: Enhanced style for
    RTF kit
    + JDK-8265776: Improve Stream handling for SSL
    + JDK-8266097, CVE-2021-35561, bsc#1191912: Better hashing
    support
    + JDK-8266103: Better specified spec values
    + JDK-8266109: More Resilient Classloading
    + JDK-8266115: More Manifest Jar Loading
    + JDK-8266137, CVE-2021-35564, bsc#1191913: Improve Keystore
    integrity
    + JDK-8266689, CVE-2021-35567, bsc#1191903: More Constrained
    Delegation
    + JDK-8267086: ArrayIndexOutOfBoundsException in
    java.security.KeyFactory.generatePublic
    + JDK-8267712: Better LDAP reference processing
    + JDK-8267729, CVE-2021-35578, bsc#1191904: Improve TLS client
    handshaking
    + JDK-8267735, CVE-2021-35586, bsc#1191914: Better BMP support
    + JDK-8268193: Improve requests of certificates
    + JDK-8268199: Correct certificate requests
    + JDK-8268205: Enhance DTLS client handshake
    + JDK-8268506: More Manifest Digests
    + JDK-8269618, CVE-2021-35603, bsc#1191906: Better session
    identification
    + JDK-8269624: Enhance method selection support
    + JDK-8270398: Enhance canonicalization
    + JDK-8270404: Better canonicalization
  * Other changes
    + JDK-8024368: private methods are allocated vtable indices
    + JDK-8042902: Test java/net/Inet6Address/serialize/
    /Inet6AddressSerializationTest.java fails intermittently
    + JDK-8140466: ChaCha20 and Poly1305 TLS Cipher Suites
    + JDK-8157404: Unable to read certain PKCS12 keystores from
    SequenceInputStream
    + JDK-8158066: SourceDebugExtensionTest fails to rename file
    + JDK-8168304: Make all of DependencyContext_test available in
    product mode
    + JDK-8169246: java/net/DatagramSocket/ReportSocketClosed.java
    fails intermittently with BindException
    + JDK-8181313: SA: Remove libthread_db dependency on Linux
    + JDK-8193214: Incorrect annotations.without.processors
    warnings with JDK 9
    + JDK-8194230: jdk/internal/jrtfs/remote/
    /RemoteRuntimeImageTest.java fails with
    java.lang.NullPointerException
    + JDK-8196092: javax/swing/JComboBox/8032878/bug8032878.java
    fails
    + JDK-8199931: java/net/MulticastSocket/
    /UnreferencedMulticastSockets.java fails with "incorrect data
    received"
    + JDK-8206083: Make tools/javac/api/T6265137.java robust to JDK
    version changes
    + JDK-8206350: java/util/Locale/bcp47u/SystemPropertyTests.java
    failed on Mac 10.13 with zh_CN and zh_TW locales.
    + JDK-8207316: java/nio/channels/spi/SelectorProvider/
    /inheritedChannel/InheritedChannelTest.java failed
    + JDK-8208227: tools/jdeps/DotFileTest.java fails on Win-X64
    + JDK-8208363: test/jdk/java/lang/Package/
    /PackageFromManifest.java missing module dependencies
    declaration
    + JDK-8209380: ARM: cleanup maybe-uninitialized and reorder
    compiler warnings
    + JDK-8209768: Refactor java/util/prefs/CheckUserPrefsStorage.sh
    to plain java test
    + JDK-8209772: Refactor shell test java/util/ServiceLoader/
    /basic/basic.sh to java
    + JDK-8209773: Refactor shell test javax/naming/module/basic.sh
    to java
    + JDK-8209832: Refactor jdk/internal/reflect/Reflection/
    /GetCallerClassTest.sh to plain java test
    + JDK-8209930: Refactor java/util/zip/ZipFile/deletetempjar.sh
    to plain java test
    + JDK-8210406: Refactor java.util.PluggableLocale:i18n shell
    tests to plain java tests
    + JDK-8210407: Refactor java.util.Calendar:i18n shell tests to
    plain java tests
    + JDK-8210495: compiler crashes because of illegal signature in
    otherwise legal code
    + JDK-8210669: Some launcher tests assume a pre-JDK 9 run-time
    image layout
    + JDK-8210802: temp files left by tests in
    jdk/java/net/httpclient
    + JDK-8210819: Update the host name in CNameTest.java
    + JDK-8210908: Refactor java/util/prefs/PrefsSpi.sh to plain
    java test
    + JDK-8210934: Move sun/net/www/protocol/http/
    /GetErrorStream.java to OpenJDK
    + JDK-8210959: JShell fails and exits when statement throws an
    exception whose message contains a '%'.
    + JDK-8211055: Provide print to a file (PDF) feature even when
    printer was not connected
    + JDK-8211092: test/jdk/sun/net/www/http/HttpClient/
    /MultiThreadTest.java fails intermittently when cleaning up
    + JDK-8211296: Remove HotSpot deprecation warning suppression
    for Mac/clang
    + JDK-8211325: test/jdk/java/net/Socket/LingerTest.java fails
    with cleaning up
    + JDK-8212040: Compilation error due to wrong usage of
    NSPrintJobDispositionValue in mac10.12
    + JDK-8212695: Add explicit timeout to several HTTP Client tests
    + JDK-8212718: Refactor some annotation processor tests to
    better use collections
    + JDK-8213007: Update the link in test/jdk/sun/security/
    /provider/SecureRandom/DrbgCavp.java
    + JDK-8213137: Remove static initialization of monitor/mutex
    instances
    + JDK-8213235: java/nio/channels/SocketChannel/
    /AsyncCloseChannel.java fails with threads that didn't exit
    + JDK-8213409: Refactor sun.text.IntHashtable:i18n shell tests
    to plain java tests
    + JDK-8213576: Make test AsyncCloseChannel.java run in othervm
    + JDK-8213694: Test Timeout.java should run in othervm mode
    + JDK-8213718: [TEST] Wrong classname in vmTestbase/nsk/stress/
    /except/except002 and except003
    + JDK-8213922: fix ctw stand-alone build
    + JDK-8214195: Align stdout messages in
    test/jdk/java/math/BigInteger/PrimitiveConversionTests.java
    + JDK-8214520: [TEST_BUG] sun/security/mscapi/nonUniqueAliases/
    /NonUniqueAliases.java failed with incorrect jtreg tags order
    + JDK-8214937: sun/security/tools/jarsigner/warnings/
    /NoTimestampTest.java failed due to unexpected expiration date
    + JDK-8216532: tools/launcher/Test7029048.java fails (Solaris)
    + JDK-8217825: Verify @AfterTest is used correctly in WebSocket
    tests
    + JDK-8218145: block_if_requested is not proper inlined due to
    size
    + JDK-8219417: bump jtreg requiredVersion to b14
    + JDK-8219552: bump jtreg requiredVersion to b14 in
    test/jdk/sanity/client/
    + JDK-8219804: java/net/MulticastSocket/Promiscuous.java fails
    intermittently due to NumberFormatException
    + JDK-8220445: Support for side by side MSVC Toolset versions
    + JDK-8221988: add possibility to build with Visual Studio 2019
    + JDK-8222751: closed/test/jdk/sun/security/util/
    /DerIndefLenConverter/IndefBerPkcs12.java fail
    + JDK-8223050: JVMCI: findUniqueConcreteMethod() should not use
    Dependencies::find_unique_concrete_method() for non-virtual
    methods
    + JDK-8224853: CDS address sanitizer errors
    + JDK-8225082: Remove IdenTrust certificate that is expiring in
    September 2021
    + JDK-8225583: Examine the HttpResponse.BodySubscribers for
    null handling and multiple subscriptions
    + JDK-8225690: Multiple AttachListener threads can be created
    + JDK-8225790: Two NestedDialogs tests fail on Ubuntu
    + JDK-8226319: Add forgotten test/jdk/java/net/httpclient/
    /BodySubscribersTest.java
    + JDK-8226533: JVMCI: findUniqueConcreteMethod should handle
    statically bindable methods directly
    + JDK-8226602: Test convenience reactive primitives from
    java.net.http with RS TCK
    + JDK-8226683: Remove review suggestion from fix to 8219804
    + JDK-8227738: jvmti/DataDumpRequest/datadumpreq001 failed due
    to "exit code is 134"
    + JDK-8227766: CheckUnhandledOops is broken in MemAllocator
    + JDK-8227815: Minimal VM: set_state is not a member of
    AttachListener
    + JDK-8230674: Heap dumps should exclude dormant CDS archived
    objects of unloaded classes
    + JDK-8230808: Remove Access::equals()
    + JDK-8230841: Remove oopDesc::equals()
    + JDK-8231717: Improve performance of charset decoding when
    charset is always compactable
    + JDK-8232243: Wrong caret position in JTextPane on Windows
    with a screen resolution &gt; 100%
    + JDK-8232782: Shenandoah: streamline post-LRB CAS barrier
    (aarch64)
    + JDK-8233790: Forward output from heap dumper to jcmd/jmap
    + JDK-8233989: Create an IPv4 version of
    java/net/MulticastSocket/SetLoopbackMode.java
    + JDK-8234510: Remove file seeking requirement for writing a
    heap dump
    + JDK-8235211: serviceability/attach/
    /RemovingUnixDomainSocketTest.java fails with
    AttachNotSupportedException: Unable to open socket file
    + JDK-8235216: typo in test filename
    + JDK-8235866: bump jtreg requiredVersion to 4.2b16
    + JDK-8236111: narrow allowSmartActionArgs disabling
    + JDK-8236413: AbstractConnectTimeout should tolerate both
    NoRouteToHostException and UnresolvedAddressException
    + JDK-8236671: NullPointerException in JKS keystore
    + JDK-8238930: problem list compiler/c2/Test8004741.java
    + JDK-8238943: switch to jtreg 5.0
    + JDK-8240555: Using env of JAVA_TOOL_OPTIONS and _JAVA_OPTIONS
    breaks QuietOption.java test
    + JDK-8240983: Incorrect copyright header in Apache Santuario
    2.1.3 files
    + JDK-8241336: Some java.net tests failed with
    NoRouteToHostException on MacOS with special network
    configuration
    + JDK-8241353: NPE in ToolProvider.getSystemJavaCompiler
    + JDK-8241768: git needs .gitattributes
    + JDK-8242882: opening jar file with large manifest might throw
    NegativeArraySizeException
    + JDK-8244973: serviceability/attach/
    /RemovingUnixDomainSocketTest.java fails "stderr was not
    empty"
    + JDK-8245134: test/lib/jdk/test/lib/security/
    /KeyStoreUtils.java should allow to specify aliases
    + JDK-8246261: TCKLocalTime.java failed due to "AssertionError:
    expected [18:14:22] but found [18:14:23]"
    + JDK-8246387: switch to jtreg 5.1
    + JDK-8247421: [TESTBUG] ReturnBlobToWrongHeapTest.java failed
    allocating blob
    + JDK-8247469: getSystemCpuLoad() returns -1 on linux when some
    offline cpus are present and cpusets.effective_cpus is not
    available
    + JDK-8248352: [TEST_BUG] Test test/jdk/java/awt/font/
    /TextLayout/ArabicDiacriticTest.java can leave frame open
    + JDK-8248403: AArch64: Remove uses of kernel integer types
    + JDK-8248414: AArch64: Remove uses of long and unsigned long
    ints
    + JDK-8248657: Windows: strengthening in ThreadCritical
    regarding memory model
    + JDK-8248666: AArch64: Use THREAD_LOCAL instead of __thread
    + JDK-8248668: AArch64: Avoid MIN/MAX macros when using MSVC
    + JDK-8248671: AArch64: Remove unused variables
    + JDK-8248682: AArch64: Use ATTRIBUTE_ALIGNED helper
    + JDK-8248816: C1: Fix signature conflict in
    LIRGenerator::strength_reduce_multiply
    + JDK-8249095: tools/javac/launcher/SourceLauncherTest.java
    fails on Windows
    + JDK-8249548: backward focus traversal gets stuck in button
    group
    + JDK-8249773: Upgrade ReceiveISA.java test to be resilient to
    failure due to stray packets and interference
    + JDK-8249897: jdk/javadoc/tool/LangVers.java uses @ignore w/o
    bug-id
    + JDK-8249898: jdk/javadoc/tool/6176978/T6176978.java uses
    @ignore w/o bug-id
    + JDK-8249899: jdk/javadoc/tool/InlineTagsWithBraces.java uses
    @ignore w/o bug-id
    + JDK-8250588: Shenandoah: LRB needs to save/restore fp
    registers for runtime call
    + JDK-8250824: AArch64: follow up for JDK-8248414
    + JDK-8251166: Add automated testcases for changes done in
    JDK-8214112
    + JDK-8251252: Add automated testcase for fix done in
    JDK-8214253
    + JDK-8251254: Add automated test for fix done in JDK-8218472
    + JDK-8251361: Potential race between Logger configuration and
    GCs in HttpURLConWithProxy test
    + JDK-8251549: Update docs on building for Git
    + JDK-8251945: SIGSEGV in
    PackageEntry::purge_qualified_exports()
    + JDK-8252194: Add automated test for fix done in JDK-8218469
    + JDK-8252648: Shenandoah: name gang tasks consistently
    + JDK-8252825: Add automated test for fix done in JDK-8218479
    + JDK-8252853: AArch64: gc/shenandoah/TestVerifyJCStress.java
    fails intermittently with C1
    + JDK-8252857: AArch64: Shenandoah C1 CAS is not sequentially
    consistent
    + JDK-8253048: AArch64: When CallLeaf, no need to preserve
    callee-saved registers in caller
    + JDK-8253424: Add support for running pre-submit testing using
    GitHub Actions
    + JDK-8253631: Remove unimplemented CompileBroker methods after
    JEP-165
    + JDK-8253865: Pre-submit testing using GitHub Actions does not
    detect failures reliably
    + JDK-8253899: Make IsClassUnloadingEnabled signature match
    specification
    + JDK-8254024: Enhance native libs for AWT and Swing to work
    with GraalVM Native Image
    + JDK-8254054: Pre-submit testing using GitHub Actions should
    not use the deprecated set-env command
    + JDK-8254173: Add Zero, Minimal hotspot targets to submit
    workflow
    + JDK-8254175: Build no-pch configuration in debug mode for
    submit checks
    + JDK-8254244: Some code emitted by TemplateTable::branch is
    unused when running TieredCompilation
    + JDK-8254270: linux 32 bit build doesn't compile
    libjdwp/log_messages.c
    + JDK-8254282: Add Linux x86_32 builds to submit workflow
    + JDK-8254850: Update terminology in java.awt.GridBagLayout
    source code comments
    + JDK-8255255: Update Apache Santuario (XML Signature) to
    version 2.2.1
    + JDK-8255305: Add Linux x86_32 tier1 to submit workflow
    + JDK-8255352: Archive important test outputs in submit workflow
    + JDK-8255373: Submit workflow artifact name is always
    "test-results_.zip"
    + JDK-8255452: Doing GC during JVMTI MethodExit event posting
    breaks return oop
    + JDK-8255718: Zero: VM should know it runs in interpreter-only
    mode
    + JDK-8255790: GTKL&amp;F: Java 16 crashes on initialising GTKL&amp;F
    on Manjaro Linux
    + JDK-8255810: Zero: build fails without JVMTI
    + JDK-8255895: Submit workflow artifacts miss hs_errs/replays
    due to ZIP include mismatch
    + JDK-8256127: Add cross-compiled foreign architectures builds
    to submit workflow
    + JDK-8256215: Shenandoah: re-organize saving/restoring machine
    state in assembler code
    + JDK-8256267: Relax compiler/floatingpoint/NaNTest.java for
    x86_32 and lower -XX:+UseSSE
    + JDK-8256277: Github Action build on macOS should define OS
    and Xcode versions
    + JDK-8256354: Github Action build on Windows should define OS
    and MSVC versions
    + JDK-8256393: Github Actions build on Linux should define OS
    and GCC versions
    + JDK-8256414: add optimized build to submit workflow
    + JDK-8256747: GitHub Actions: decouple the hotspot build-only
    jobs from Linux x64 testing
    + JDK-8257056: Submit workflow should apt-get update to avoid
    package installation errors
    + JDK-8257148: Remove obsolete code in AWTView.m
    + JDK-8257497: Update keytool to create AKID from the SKID of
    the issuing certificate as specified by RFC 5280
    + JDK-8257620: Do not use objc_msgSend_stret to get macOS
    version
    + JDK-8257913: Add more known library locations to simplify
    Linux cross-compilation
    + JDK-8258703: Incorrect 512-bit vector registers restore on
    x86_32
    + JDK-8259338: Add expiry exception for identrustdstx3 alias to
    VerifyCACerts.java test
    + JDK-8259535: ECDSA SignatureValue do not always have the
    specified length
    + JDK-8259679: GitHub actions should use MSVC 14.28
    + JDK-8259924: GitHub actions fail on Linux x86_32 with "Could
    not configure libc6:i386"
    + JDK-8260460: GitHub actions still fail on Linux x86_32 with
    "Could not configure libc6:i386"
    + JDK-8260589: Crash in JfrTraceIdLoadBarrier::load(_jclass*)
    + JDK-8260923: Add more tests for SSLSocket input/output
    shutdown
    + JDK-8261072: AArch64: Fix MacroAssembler::get_thread
    convention
    + JDK-8261147: C2: Node is wrongly marked as reduction
    resulting in a wrong execution due to wrong vector instructions
    + JDK-8261238: NMT should not limit baselining by size threshold
    + JDK-8261496: Shenandoah: reconsider pacing updates memory
    ordering
    + JDK-8261652: Remove some dead comments from os_bsd_x86
    + JDK-8261846: [JVMCI] c2v_iterateFrames can get out of sync
    with the StackFrameStream
    + JDK-8262000: jdk/jfr/event/gc/detailed/
    /TestPromotionFailedEventWithParallelScavenge.java failed with
    "OutOfMemoryError: Java heap space"
    + JDK-8262017: C2: assert(n != __null) failed: Bad immediate
    dominator info.
    + JDK-8262392: Update Mesa 3-D Headers to version 21.0.3
    + JDK-8262409: sun/security/ssl/SSLSocketImpl/
    /SSLSocketImplThrowsWrongExceptions. SSL test failures caused
    by java failed with "Server reported the wrong exception"
    + JDK-8262470: Printed GlyphVector outline with low DPI has bad
    quality on Windows
    + JDK-8262862: Harden tests sun/security/x509/URICertStore/
    /ExtensionsWithLDAP.java and krb5/canonicalize/Test.java
    + JDK-8263136: C4530 was reported from VS 2019 at access bridge
    + JDK-8263227: C2: inconsistent spilling due to dead nodes in
    exception block
    + JDK-8263382: java/util/logging/ParentLoggersTest.java failed
    with "checkLoggers: getLoggerNames() returned unexpected
    loggers"
    + JDK-8263407: SPARC64 detection fails on Athena (SPARC64-X)
    + JDK-8263432: javac may report an invalid package/class clash
    on case insensitive filesystems
    + JDK-8263490: [macos] Crash occurs on JPasswordField with
    activated InputMethod
    + JDK-8263531: Remove unused buffer int
    + JDK-8263667: Avoid running GitHub actions on branches named
    pr/*
    + JDK-8263776: [JVMCI] add helper to perform Java upcalls
    + JDK-8264016: [JVMCI] add some thread local fields for use by
    JVMCI
    + JDK-8264752: SIGFPE crash with option
    FlightRecorderOptions:threadbuffersize=30M
    + JDK-8265132: C2 compilation fails with assert "missing
    precedence edge"
    + JDK-8265231: (fc) ReadDirect and WriteDirect tests fail after
    fix for JDK-8264821
    + JDK-8265335: Epsilon: Minor typo in EpsilonElasticTLABDecay
    description
    + JDK-8265756: AArch64: initialize memory allocated for locals
    according to Windows AArch64 stack page growth requirement in
    template interpreter
    + JDK-8265761: Font with missed font family name is not
    properly printed on Windows
    + JDK-8265773: incorrect jdeps message "jdk8internals" to
    describe a removed JDK internal API
    + JDK-8265836: OperatingSystemImpl.getCpuLoad() returns
    incorrect CPU load inside a container
    + JDK-8266018: Shenandoah: fix an incorrect assert
    + JDK-8266206: Build failure after JDK-8264752 with older GCCs
    + JDK-8266248: Compilation failure in
    PLATFORM_API_MacOSX_MidiUtils.c with Xcode 12.5
    + JDK-8266288: assert root method not found in
    witnessed_reabstraction_in_supers is too strong
    + JDK-8266404: Fatal error report generated with
  - XX:+CrashOnOutOfMemoryError should not contain suggestion to
    submit a bug report
    + JDK-8266480: Implicit null check optimization does not update
    control of hoisted memory operation
    + JDK-8266615: C2 incorrectly folds subtype checks involving an
    interface array
    + JDK-8266642: Improve ResolvedMethodTable hash function
    + JDK-8266749: AArch64: Backtracing broken on PAC enabled
    systems
    + JDK-8266761: AssertionError in
    sun.net.httpserver.ServerImpl.responseCompleted
    + JDK-8266813: Shenandoah: Use shorter instruction sequence for
    checking if marking in progress
    + JDK-8267042: bug in monitor locking/unlocking on ARM32 C1 due
    to uninitialized BasicObjectLock::_displaced_header
    + JDK-8267348: Rewrite gc/epsilon/TestClasses.java to use
    Metaspace with less classes
    + JDK-8267396: Avoid recording "pc" in unhandled oops detector
    for better performance
    + JDK-8267399: C2: java/text/Normalizer/ConformanceTest.java
    test failed with assertion
    + JDK-8267424: CTW: C1 fails with "State must not be null"
    + JDK-8267459: Pasting Unicode characters into JShell does not
    work.
    + JDK-8267625: AARCH64: typo in LIR_Assembler::emit_profile_type
    + JDK-8267666: Add option to jcmd GC.heap_dump to use existing
    file
    + JDK-8267695: Bump update version for OpenJDK: jdk-11.0.13
    + JDK-8267751: (test) jtreg.SkippedException has no serial
    VersionUID
    + JDK-8267773: PhaseStringOpts::int_stringSize doesn't handle
    min_jint correctly
    + JDK-8268103: JNI functions incorrectly return a double after
    JDK-8265836
    + JDK-8268127: Shenandoah: Heap size may be too small for
    region to align to large page size
    + JDK-8268261: C2: assert(n != __null) failed: Bad immediate
    dominator info.
    + JDK-8268347: C2: nested locks optimization may create
    unbalanced monitor enter/exit code
    + JDK-8268360: Missing check for infinite loop during node
    placement
    + JDK-8268362: [REDO] C2 crash when compile negative
    Arrays.copyOf length after loop
    + JDK-8268366: Incorrect calculation of has_fpu_registers in C1
    linear scan
    + JDK-8268369: SIGSEGV in PhaseCFG::implicit_null_check due to
    missing null check
    + JDK-8268417: Add test from JDK-8268360
    + JDK-8268427: Improve AlgorithmConstraints:checkAlgorithm
    performance
    + JDK-8268617: [11u REDO] - WebSocket over authenticating proxy
    fails with NPE
    + JDK-8268620: InfiniteLoopException test may fail on x86
    platforms
    + JDK-8268635: Corrupt oop in ClassLoaderData
    + JDK-8268699: Shenandoah: Add test for JDK-8268127
    + JDK-8268771: javadoc -notimestamp option does not work on
    index.html
    + JDK-8268775: Password is being converted to String in
    AccessibleJPasswordField
    + JDK-8268776: Test `ADatagramSocket.java` missing /othervm
    from @run tag
    + JDK-8268965: TCP Connection Reset when connecting simple
    socket to SSL server
    + JDK-8269304: Regression ~5% in 2005 in b27
    + JDK-8269415: [11u] Remove ea from
    DEFAULT_PROMOTED_VERSION_PRE in OpenJDK 11u
    + JDK-8269478: Shenandoah: gc/shenandoah/mxbeans tests should
    be more resilient
    + JDK-8269529: javax/swing/reliability/
    /HangDuringStaticInitialization.java fails in Windows debug
    build
    + JDK-8269594: assert(_handle_mark_nesting &gt; 1) failed: memory
    leak: allocating handle outside HandleMark
    + JDK-8269614: [s390] Interpreter checks wrong bit for slow
    path instance allocation
    + JDK-8269650: Optimize gc-locker in
    [Get|Release]StringCritical for latin string
    + JDK-8269661: JNI_GetStringCritical does not lock char array
    + JDK-8269668: [aarch64] java.library.path not including
    /usr/lib64
    + JDK-8269763: The JEditorPane is blank after JDK-8265167
    + JDK-8269795: C2: Out of bounds array load floats above its
    range check in loop peeling resulting in SEGV
    + JDK-8269847: JDK-8269594 backport breaks 11u builds
    + JDK-8269850: Most JDK releases report macOS version 12 as
    10.16 instead of 12.0
    + JDK-8269851: OperatingSystemMXBean getProcessCpuLoad reports
    incorrect process cpu usage in containers
    + JDK-8269882: stack-use-after-scope in NewObjectA
    + JDK-8269934: RunThese24H.java failed with
    EXCEPTION_ACCESS_VIOLATION in
    java_lang_Thread::get_thread_status
    + JDK-8270096: Shenandoah: Optimize gc/shenandoah/
    /TestRefprocSanity.java for interpreter mode
    + JDK-8270137: Kerberos Credential Retrieval from Cache not
    Working in Cross-Realm Setup
    + JDK-8270184: [TESTBUG] Add coverage for jvmci
    ResolvedJavaType.toJavaName() for lambdas
    + JDK-8270196: [11u] [JVMCI] JavaType.toJavaName() returns
    incorrect type name for lambdas
    + JDK-8270556: Exclude security/infra/java/security/cert/
    /CertPathValidator/certification/LetsEncryptCA
    + JDK-8270893: IndexOutOfBoundsException while reading large
    TIFF file
    + JDK-8272078: Wrong Checksums in Temurin BootJDK dependencies
    + JDK-8272124: Cgroup v1 initialization causes
    NullPointerException when cgroup path contains colon
    + JDK-8272131: PhaseMacroExpand::generate_slow_arraycopy crash
    when clone null CallProjections.fallthrough_ioproj
    + JDK-8272197: Update 11u GHA workflow with Shenandoah
    configurations
    + JDK-8272332: --with-harfbuzz=system doesn't add -lharfbuzz
    after JDK-8255790
    + JDK-8272472: StackGuardPages test doesn't build with glibc
    2.34
    + JDK-8272602: [macos] not all KEY_PRESSED events sent when
    control modifier is used
    + JDK-8272628: Problemlist gc/stress/gcbasher/
    /TestGCBasherWithCMS.java for x86_32
    + JDK-8272700: [macos] Build failure with Xcode 13.0 after
    JDK-8264848
    + JDK-8272772: Shenandoah: compiler/c2/aarch64/
    /TestVolatilesShenandoah.java fails in 11u
    + JDK-8273939: Backport of 8248414 to JDK11 breaks
    MacroAssembler::adrp
- Remove the unneeded icedtea-sound provider
- Removed patches:
  * icedtea-sound-1.0.1-jdk9.patch
  * icedtea-sound-soundproperties.patch
    + not needed since the icedtea-sound provider is removed
  * jdk11-glibc234.patch
    + integrated upstream</changelog>
  <changelog author="fstrba@suse.com" date="1635940800">- Modified patches:
  * system-crypto-policy.patch
    + rediff to changed context
  * fips.patch
    + Allow plain key import in fips mode unless
    com.suse.fips.plainKeySupport is set to false</changelog>
  <changelog author="fstrba@suse.com" date="1636113600">- Modified patch:
  * fips.patch
    + return in native code after generating java.io.IOException</changelog>
</package>
<package pkgid="d1f3beb09d5b61bbc357b2ae3747d7d4158429074c626f6d33dc361eb57141cb" name="java-11-openjdk-devel" arch="s390x">
  <version epoch="0" ver="11.0.13.0" rel="3.68.1"/>
  <changelog author="fstrba@suse.com" date="1586952000">- The pack200 and unpack200 alternatives should be slaves of java
  and not of javac, since they are part of JRE.</changelog>
  <changelog author="fstrba@suse.com" date="1587470400">- Update to upstream tag jdk-11.0.7+10 (April 2020 CPU,
  bsc#1169511)
  * Security fixes:
    + S8223898, CVE-2020-2754: Forward references to Nashorn
    + S8223904, CVE-2020-2755: Improve Nashorn matching
    + S8224541, CVE-2020-2756: Better mapping of serial ENUMs
    + S8224549, CVE-2020-2757: Less Blocking Array Queues
    + S8225603: Enhancement for big integers
    + S8226346: Build better binary builders
    + S8227467: Better class method invocations
    + S8227542: Manifest improved jar headers
    + S8229733: TLS message handling improvements
    + S8231415, CVE-2020-2773: Better signatures in XML
    + S8231785: Improved socket permissions
    + S8232424, CVE-2020-2778: More constrained algorithms
    + S8232581, CVE-2020-2767: Improve TLS verification
    + S8233250: Better X11 rendering
    + S8233410: Better Build Scripting
    + S8234027: Better JCEKS key support
    + S8234408, CVE-2020-2781: Improve TLS session handling
    + S8234825, CVE-2020-2800: Better Headings for HTTP Servers
    + S8234841, CVE-2020-2803: Enhance buffering of byte buffers
    + S8235274, CVE-2020-2805: Enhance typing of methods
    + S8235691, CVE-2020-2816: Enhance TLS connectivity
    + S8236201, CVE-2020-2830: Better Scanner conversions
    + S8238960: linux-i586 builds are inconsistent as the newly
    built jdk is not able to reserve enough space for object heap
  * Other changes:
    + S4919790: Errors in alert ssl message does not reflect the
    actual certificate status
    + S4949105: Access Bridge lacks html tags parsing
    + S7092821: java.security.Provider.getService() is synchronized
    and became scalability bottleneck
    + S7143743: Potential memory leak with zip provider
    + S8005819: Support cross-realm MSSFU
    + S8042383: [TEST_BUG] Test javax/swing/plaf/basic/BasicMenuUI/
    /4983388/bug4983388.java fails with shortcuts on menus do not
    work
    + S8068184: Fix for JDK-8032832 caused a deadlock
    + S8145845: [AOT] NullPointerException in
    compiler/whitebox/GetCodeHeapEntriesTest.java
    + S8152988: [AOT] Update test batch definitions to include
    aot-ed java.base module mode into hs-comp testing
    + S8160926: FLAGS_COMPILER_CHECK_ARGUMENTS doesn't handle
    cross-compilation
    + S8163083: SocketListeningConnector does not allow invocations
    with port 0
    + S8163251: Hard coded loop limit prevents reading of smart
    card data greater than 8k
    + S8167276: jvmci/compilerToVM/MaterializeVirtualObjectTest.java
    fails with -XX:-EliminateAllocations
    + S8169718: nsk/jdb/locals/locals002: ERROR: Cannot find
    boolVar with expected value: false
    + S8176556:
    java/awt/dnd/ImageTransferTest/ImageTransferTest.java fails
    for JFIF
    + S8178798: Two compiler/aot/verification/vmflags tests fail by
    timeout with UseAVX=3
    + S8183107: PKCS11 regression regarding checkKeySize
    + S8185005: Improve performance of
    ThreadMXBean.getThreadInfo(long ids[], int maxDepth)
    + S8189633: Missing -Xcheck:jni checking for DeleteWeakGlobalRef
    + S8189861: Refactor CacheFind
    + S8193042: NativeLookup::lookup_critical_entry() should only
    load shared library once
    + S8193596: java/net/DatagramPacket/ReuseBuf.java failed due to
    timeout
    + S8194944: Regression automated test 'open/test/jdk/javax/
    /swing/JInternalFrame/8145896/TestJInternalFrameMaximize.java'
    fails
    + S8196467: javax/swing/JInternalFrame/Test6325652.java fails
    + S8196969: JTreg Failure: serviceability/sa/ClhsdbJstack.java
    causes NPE
    + S8198321: javax/swing/JEditorPane/5076514/bug5076514.java
    fails
    + S8198398: Test javax/swing/JColorChooser/Test6199676.java
    fails in mach5
    + S8199072: Test javax/swing/GroupLayout/6613904/
    /bug6613904.java is unstable
    + S8200432: javadoc fails with ClassCastException on {@link
    byte[]}
    + S8201349: build broken when configured with
  - -with-zlib=bundled on gcc 7.3
    + S8201355: Avoid native memory allocation in
    sun.security.mscapi.PRNG.generateSeed
    + S8201513: nsk/jvmti/IterateThroughHeap/filter-* are broken
    + S8203364: Some serviceability/sa/ tests intermittently fail
    with java.io.IOException: LingeredApp terminated with non-zero
    exit code 3
    + S8203687: javax/net/ssl/compatibility/Compatibility.java
    supports TLS 1.3
    + S8203904: javax/swing/JSplitPane/4816114/bug4816114.java: The
    divider location is wrong
    + S8203911: Test runtime/modules/getModuleJNI/GetModule fails
    with -Xcheck:jni
    + S8204525: [TESTBUG] runtime/NMT/MallocStressTest.java ran out
    of java heap
    + S8204529: gc/TestAllocateHeapAtMultiple.java fail with Agent
    7 timed out
    + S8204551: Event descriptions are truncated in logs
    + S8206963: [AOT] bug with multiple class loaders
    + S8207367: 10 vmTestbase/nsk/jdi tests timed out when running
    with jtreg
    + S8207832: serviceability/sa/ClhsdbCDSCore.java failed with
    "Couldn't find core file location"
    + S8207938: At step6,Click Add button,case failed automatically.
    + S8208157: requires.VMProps throws NPE for missing properties
    in "release" file
    + S8208379: compiler/jvmci/events/
    /JvmciNotifyInstallEventTest.java failed with "Got unexpected
    event count after 2nd install attempt: expected 9 to equal 2"
    + S8208658: Make CDS archived heap regions usable even if
    compressed oop encoding has changed
    + S8208715: Conversion of milliseconds to nanoseconds in
    UNIXProcess contains bug
    + S8209361: [AOT] Unexpected number of references for
    JVMTI_HEAP_REFERENCE_CONSTANT_POOL [111--&gt;111]: 0 (expected
    at least 1)
    + S8209385: CDS runtime classpath checking is too strict when
    only classes from the system modules are archived
    + S8209389: SIGSEGV in WalkOopAndArchiveClosure::do_oop_work.
    + S8209418: Synchronize test/jdk/sanity/client/lib/jemmy with
    code-tools/jemmy/v2
    + S8209494: Create a test for SwingSet InternalFrameDemo
    + S8209499: Create test for SwingSet EditorPaneDemo
    + S8209574: [AOT] breakpoint events are generated in different
    threads does not meet expected count
    + S8209686: cleanup arguments to PhaseIdealLoop() constructor
    + S8209789: Synchronize test/jdk/sanity/client/lib/jemmy with
    code-tools/jemmy/v2
    + S8209802: Garbage collectors should register JFR types
    themselves to avoid build errors.
    + S8209807: improve handling exception in requires.VMProps
    + S8209817: stack is executable when building with Clang on
    Linux
    + S8209824: Improve the code coverage for ThreadLocal
    + S8209826: Undefined reference to os::write after JDK-8209657
    (filemap.hpp cleanup)
    + S8209850: Allow NamedThreads to use GlobalCounter critical
    sections
    + S8209976: Improve iteration over non-JavaThreads
    + S8209993: Create a test for SwingSet3 ToolTipDemo
    + S8210024: JFR calls virtual is_Java_thread from ~Thread()
    + S8210052: Enable testing for all the available look and feels
    in SwingSet3 demo tests
    + S8210055: Enable different look and feel tests in SwingSet3
    demo tests
    + S8210057: Enable different look and feels in SwingSet3 demo
    test InternalFrameDemoTest
    + S8210058: Algorithmic Italic font leans opposite angle in
    Printing
    + S8210220: [AOT] jdwp test cases are failing with error #
    ERROR: TEST FAILED: Cought IOException while receiving event
    packet
    + S8210289: ArchivedKlassSubGraphInfoRecord is incomplete
    + S8210459: Add support for generating compile_commands.json
    + S8210476: sun/security/mscapi/PrngSlow.java fails with Still
    too slow
    + S8210512: [Testbug] vmTestbase/nsk/jdi/ObjectReference/
    /referringObjects/referringObjects002/referringObjects002.java
    fails with unexpected size of
    ClassLoaderReference.referringObjects
    + S8210523: runtime/appcds/cacheObject/DifferentHeapSizes.java
    crash
    + S8210632: Add key exchange algorithm to
    javax/net/ssl/TLSCommon/CipherSuite.java
    + S8210699: Problem list tests which times out in Xcomp mode
    + S8210793: [JVMCI] AllocateCompileIdTest.java failed to find
    DiagnosticCommand.class
    + S8210910: Create test for FileChooserDemo
    + S8210994: Create test for SwingSet3 FrameDemo
    + S8211139: Increase timeout value in all tests under
    jdk/sanity/client/SwingSet/src
    + S8211160: Handle different look and feels in
    JInternalFrameOperator
    + S8211211: vmTestbase/metaspace/stressDictionary/
    /StressDictionary.java timeout
    + S8211322: Reduce the timeout of tooltip in SwingSet2DemoTest
    + S8211443: Enable different look and feels in SwingSet3 demo
    test SplitPaneDemoTest
    + S8211703: JInternalFrame : java.lang.AssertionError: cannot
    find the internal frame
    + S8211781: re-building fails after changing Graal sources
    + S8212897: Some improvements in the EditorPaneDemotest
    + S8212903: [TestBug] Tests test/jdk/javax/swing/LookAndFeel/
    /8145547/DemandGTK2.sh and DemandGTK3.sh fail on Ubuntu 18.04
    LTS
    + S8213009: Refactoring existing SunMSCAPI classes
    + S8213010: Supporting keys created with certmgr.exe
    + S8213168: Enable different look and feel tests in SwingSet3
    demo test FileChooserDemoTest
    + S8213348: jdk.internal.vm.compiler.management service
    providers missing in module descriptor
    + S8213906: Update arm devkits with libXrandr headers
    + S8213908: AssertionError in DeferredAttr at setOverloadKind
    + S8214124: [TESTBUG] Bugs in runtime/NMT/MallocStressTest.java
    + S8214344: C2: assert(con.basic_type() != T_ILLEGAL) failed:
    elembt=byte; loadbt=void; unsigned=0
    + S8214345: infinite recursion while checking super class
    + S8214471: Enable different look and feel tests in SwingSet3
    demo test ToolTipDemoTest
    + S8214534: Setting of THIS_FILE in the build is broken
    + S8214557: Filter out VM flags which don't affect AOT code
    generation
    + S8214578: [macos] Problem with backslashes on macOS/JIS
    keyboard: Java ignores system settings
    + S8214840: runtime/NMT/MallocStressTest.java timed out
    + S8214850: Rename vm_operations.?pp files to vmOperations.?pp
    files
    + S8214904: Test8004741.java failed due to "Too few ThreadDeath
    hits; expected at least 6 but saw only 5"
    + S8215322: add @file support to jaotc
    + S8215355: Object monitor deadlock with no threads holding the
    monitor (using jemalloc 5.1)
    + S8215396: JTabbedPane preferred size calculation is wrong for
    SCROLL_TAB_LAYOUT
    + S8216180: [AOT] compiler/intrinsics/bigInteger/TestMulAdd.java
    crashed with AOT enabled
    + S8216353: Use utility APIs introduced in org/netbeans/jemmy/
    /util/LookAndFeel class in client sanity test cases
    + S8216354: Syntax error in toolchain_windows.m4
    + S8216472: (se) Stack overflow during selection operation
    leads to crash (win)
    + S8216535: tools/jimage/JImageExtractTest.java timed out
    + S8217235: Create automated test for SwingSet
    ColorChooserDemoTest
    + S8217297: Add support for multiple look and feel for SwingSet
    SliderDemoTest
    + S8217338: [Containers] Improve systemd slice memory limit
    support
    + S8217613: [AOT] TEST_OPTS_AOT_MODULES doesn't work on mac
    + S8217634: RunTest documentation and usability update
    + S8217717: ZGC: Broken oop map in C1 load barrier stub
    + S8217728: Speed up incremental rerun of "make hotspot"
    + S8218268: Javac treats Manifest Class-Path entries as Paths
    instead of URLs
    + S8218662: Allow 204 responses with Content-Length:0
    + S8218882: NET_Writev is declared, NET_WriteV is defined
    + S8218889: Improperly use of the Optional API
    + S8219205: JFR file without license header
    + S8219597: (bf) Heap buffer state changes could provoke
    unexpected exceptions
    + S8219723: javax/net/ssl/compatibility/Compatibility.java
    failed on some SNI cases
    + S8220348: [ntintel] asserts about copying unaligned array
    + S8220451: jdi/EventQueue/remove/remove004 failed due to
    "ERROR: thread2 is not alive"
    + S8220456: jdi/EventQueue/remove_l/remove_l004 failed due to
    "TIMEOUT while waiting for event"
    + S8220479: java/nio/channels/Selector/SelectWithConsumer.java
    failed at testTwoChannels()
    + S8220613: java/util/Arrays/TimSortStackSize2.java times out
    with fastdebug build
    + S8220688: [TESTBUG] runtime/NMT/MallocStressTest.java timed
    out
    + S8220786: Create new switch to redirect error reporting
    output to stdout or stderr
    + S8221270: Duplicated synchronized keywords in SSLSocketImpl
    + S8221312: test/jdk/sanity/client/SwingSet/src/
    /ColorChooserDemoTest.java failed
    + S8221851: Use of THIS_FILE in hotspot invalidates precompiled
    header on Linux/GCC
    + S8221885: Add intermittent test in the JavaSound to the
    ProblemList
    + S8222264: Windows incremental build is broken with JDK-8217728
    + S8222391: javax/net/ssl/compatibility/Compatibility.java
    should be more flexible
    + S8222448: java/lang/reflect/PublicMethods/
    /PublicMethodsTest.java times out
    + S8222519: ButtonDemoScreenshotTest fails randomly with "still
    state to be reached"
    + S8222741: jdi/EventQueue/remove/remove004 fails due to
    VMDisconnectedException
    + S8223003: SunMSCAPI keys are not cleaned up
    + S8223063: Support CNG RSA keys
    + S8223158: Docked MacBook cannot start any Java Swing
    applications
    + S8223260: NamingManager should cache InitialContextFactory
    + S8223464: Improve version string for Oracle CI builds
    + S8223558: Java does not render Myanmar script correctly
    + S8223627: jdk-13+20 bundle name contains null instead of ea
    + S8223638: Replace wildcard address with loopback or local
    host in tests - part 6
    + S8223678: Add Visual Studio Code workspace generation support
    (for native code)
    + S8223727: com/sun/jndi/ldap/privconn/RunTest.java failed due
    to hang in LdapRequest.getReplyBer
    + S8223769: Assert triggers with -XX:+StressReflectiveCode
    + S8224187: Refactor arraycopy_prologue to allow ZGC read
    barriers on arraycopy
    + S8224475: JTextPane does not show images in HTML rendering
    + S8224673: Adjust permission for delayed starting of debugging
    + S8224705: Tests that need to be problem-listed or have
    printer resources
    + S8224778: test/jdk/demo/jfc/J2Ddemo/J2DdemoTest.java cannot
    find J2Ddemo.jar
    + S8224821: java/awt/Focus/NoAutotransferToDisabledCompTest/
    /NoAutotransferToDisabledCompTest.java fails linux-x64
    + S8224830: test/jdk/java/awt/Focus/
    /ModalExcludedWindowClickTest/
    /ModalExcludedWindowClickTest.java fails on linux-x64
    + S8224851: AArch64: fix warnings and errors with Clang and GCC
    8.3
    + S8224905: java/lang/ProcessBuilder/Basic.java#id1 failed with
    stream closed
    + S8225007: java/awt/print/PrinterJob/
    /LandscapeStackOverflow.java may hang
    + S8225105: java/awt/Focus/ShowFrameCheckForegroundTest/
    /ShowFrameCheckForegroundTest.java fails in Windows 10
    + S8225117: java/math/BigInteger/SymmetricRangeTests.java fails
    with ParseException
    + S8225128: Add exception for expiring DocuSign root to
    VerifyCACerts test
    + S8225130: Add exception for expiring Comodo roots to
    VerifyCACerts test
    + S8225144: [macos] In Aqua L&amp;F backspace key does not delete
    when Shift is pressed
    + S8225180: SignedObject with invalid Key not throwing the
    InvalidKeyException in Windows
    + S8225182: JNI exception pending in DestroyXIMCallback of
    awt_InputMethod.c:1327
    + S8225199: [Graal] compiler/jvmci/compilerToVM/
    /IsMatureVsReprofileTest.java fails with
  - XX:CompileThresholdScaling=0.1
    + S8225305: ProblemList java/lang/invoke/VarHandles tests
    + S8225350: compiler/jvmci/compilerToVM/IsCompilableTest.java
    timed out
    + S8225430: Replace wildcard address with loopback or local
    host in tests - part 14
    + S8225435: Upgrade IANA Language Subtag Registry to the latest
    for JDK14
    + S8225487: giflib legal file is missing attribution for
    openbsd-reallocarray.c
    + S8225567: Wrong file headers with 8202414 fix changeset
    + S8225684: [AOT] vmTestbase/vm/oom/production/
    /AlwaysOOMProduction tests fail with AOTed java.base
    + S8225766: Curve in certificate should not affect signature
    scheme when using TLSv1.3
    + S8225797: OldObjectSample event creates unexpected amount of
    checkpoint data
    + S8226381: ProblemList java/lang/reflect/PublicMethods/
    /PublicMethodsTest.java
    + S8226406: JVM fails to detect mismatched or corrupt CDS
    archive
    + S8226608: Hide the onjcmd option from the help output
    + S8226892: ActionListeners on JRadioButtons don't get notified
    when selection is changed with arrow keys
    + S8227112: exclude compiler/intrinsics/sha/sanity tests from
    AOT runs
    + S8227324: Upgrade to freetype 2.10.1
    + S8227528: TestAbortVMOnSafepointTimeout.java failed due to
    "RuntimeException: 'Safepoint sync time longer than' missing
    from stdout/stderr"
    + S8227645: Some tests in serviceability/sa run with fixed -Xmx
    values and risk running out of memory
    + S8227646: [TESTBUG] appcds/SharedArchiveConsistency timed out
    + S8227662: freetype seeks to index at the end of the font data
    + S8228479: Correct the format of ColorChooserDemoTest
    + S8228613: java.security.Provider#getServices order is no
    longer deterministic
    + S8228969: 2019-09-28 public suffix list update
    + S8229236: CriticalJNINatives: dll handling should be done in
    native thread state
    + S8229345: Memory leak due to vtable stubs not being shared on
    SPARC
    + S8229888: (zipfs) Updating an existing zip file does not
    preserve original permissions
    + S8229994: assert(false) failed: Bad graph detected in
    get_early_ctrl_for_expensive
    + S8230004: jdk/internal/jimage/JImageOpenTest.java runs no test
    + S8230235: Rendering HTML with empty img attribute and
    documentBaseKey cause Exception
    + S8230390: Problemlist SA tests with AOT
    + S8230400: Missing constant pool entry for a method in
    stacktrace
    + S8230459: Test failed to resume JVMCI CompilerThread
    + S8230480: check malloc/calloc results in java.desktop
    + S8230597: Update GIFlib library to the 5.2.1
    + S8230611: infinite loop in
    LogOutputList::wait_until_no_readers()
    + S8230624: [TESTBUG] Problemlist JFR
    compiler/TestCodeSweeper.java
    + S8230677: Should disable Escape Analysis if JVMTI capability
    can_get_owned_monitor_info was taken
    + S8230926: [macosx] Two apostrophes are entered instead of one
    with "U.S. International - PC" layout
    + S8231025: Incorrect method tag offset for big endian platform
    + S8231081: TestMetadataRetention fails due to missing symbol id
    + S8231387: java.security.Provider.getService returns random
    result due to race condition with mutating methods in the same
    class
    + S8231430: C2: Memory stomp in max_array_length() for
    T_ILLEGAL type
    + S8231445: check ZALLOC return values in awt coding
    + S8231507: Update Apache Santuario (XML Signature) to version
    2.1.4
    + S8231584: Deadlock with ClassLoader.findLibrary and
    System.loadLibrary call
    + S8231753: use more Posix functionality in aix
    os::print_os_info
    + S8231810: javax/net/ssl/templates/
    /SSLSocketSSLEngineTemplate.java fails intermittently with
    "java.lang.Exception: Unexpected EOF"
    + S8232003: (fs) Files.write can leak file descriptor in the
    exception case
    + S8232056: GetOwnedMonitorInfoWithEATest.java fails with ZGC:
    Heap too small
    + S8232060: add some initializations using sigemptyset in
    os_aix.cpp
    + S8232154: Update Mesa 3-D Headers to version 19.2.1
    + S8232167: Visual Studio install found through
  - -with-tools-dir value is discarded
    + S8232170: FSInfo#getJarClassPath throws an exception not
    declared in its throws clause
    + S8232200: [macos 10.15] Windows in fullscreen tests jumps
    around the screen
    + S8232207: Linux os::available_memory re-reads cgroup
    configuration on every invocation
    + S8232224: [TESTBUG] problemlist JFR TestLargeRootSet.java
    + S8232370: Refactor some com.sun.jdi tests to enable IDE
    integration
    + S8232433: [macos 10.15] java/awt/Window/
    /LocationAtScreenCorner/LocationAtScreenCorner.java may fail
    + S8232571: Add missing SIGINFO signal
    + S8232692: [TESTBUG] compiler/aot/fingerprint/
    /SelfChangedCDS.java fails when cds is disabled
    + S8232713: Update BCEL version to 6.3.1 in license file
    + S8232806: Introduce a system property to disable eager lambda
    initialization
    + S8232834: RunTest sometimes fails to produce valid
    exitcode.txt
    + S8232880: Update test documentation with additional settings
    for client UI tooltip tests
    + S8232950: SUNPKCS11 Provider incorrectly check key length for
    PSS Signatures.
    + S8233018: Add a new test to verify that DatagramSocket is not
    interruptible
    + S8233019: java.lang.Class.isPrimitive() (C1) returns wrong
    result if Klass* is aligned to 32bit
    + S8233032: assert(in_bb(n)) failed: must be
    + S8233078: fix minimal VM build on Linux ppc64(le)
    + S8233328: fix minimal VM build on Linux s390x
    + S8233383: Various minor fixes
    + S8233466: aarch64: remove unnecessary load of mdo when
    profiling return and parameters type
    + S8233491: Crash in AdapterHandlerLibrary::get_adapter with
    CDS due to code cache exhaustion
    + S8233529: loopTransform.cpp:2984: Error: assert(p_f-&gt;Opcode()
    == Op_IfFalse) failed
    + S8233548: Update CUP to v0.11b
    + S8233649: Update ProblemList.txt to exclude failing headful
    tests on macos
    + S8233656: assert(d-&gt;is_CFG() &amp;&amp; n-&gt;is_CFG()) failed: must
    have CFG nodes
    + S8233657: Intermittent NPE in Component.validate()
    + S8234288: Turkey Time Zone returns incorrect time zone name
    + S8234323: NULL-check return value of SurfaceData_InitOps on
    macosx
    + S8234339: replace JLI_StrTok in java_md_solinux.c
    + S8234340: Bump update version for OpenJDK: jdk-11.0.7
    + S8234350: assert(mode == ControlAroundStripMined &amp;&amp; (use ==
    sfpt || !use-&gt;is_reachable_from_root())) failed: missed a node
    + S8234386: [macos] NPE was thrown at expanding Choice from
    maximized frame
    + S8234397: add OS uptime information to os::print_os_info
    output
    + S8234423: Modifying ArrayList.subList().subList() resets
    modCount of subList
    + S8234466: Class loading deadlock involving
    X509Factory#commitEvent()
    + S8234501: remove obsolete NET_ReadV
    + S8234525: enable link-time section-gc for linux s390x to
    remove unused code
    + S8234610: MaxVectorSize set wrongly when UseAVX=3 is
    specified after JDK-8221092
    + S8234617: C1: Incorrect result of field load due to missing
    narrowing conversion
    + S8234723: javax/net/ssl/TLS tests support TLSv1.3
    + S8234724: javax/net/ssl/templates/
    /SSLSocketSSLEngineTemplate.java supports TLSv1.3
    + S8234741: enhance os::get_core_path on macOS
    + S8234769: Duplicate attribution in freetype.md
    + S8234786: Fix for JDK-8214578 breaks OS X 10.12 compatibility
    + S8234809: set relro in linker flags when building with gcc
    + S8234824: java/nio/channels/SocketChannel/AdaptSocket.java
    fails on Windows 10
    + S8235243: handle VS2017 15.9 and VS2019 in abstract_vm_version
    + S8235288: AVX 512 instructions inadvertently used on Xeon for
    small vector width operations
    + S8235325: build failure on Linux after 8235243
    + S8235383: C1 compilation fails with
  - XX:+PrintIRDuringConstruction -XX:+Verbose
    + S8235489: handle return values of sscanf calls in hotspot
    + S8235509: Backport for JDK-8209657 Refactor filemap.hpp to
    simplify integration with Serviceability Agent.
    + S8235510: java.util.zip.CRC32 performance drop after 8200067
    + S8235563: [TESTBUG] appcds/CommandLineFlagComboNegative.java
    does not handle archive mapping failure
    + S8235637: jhsdb jmap from OpenJDK 11.0.5 doesn't work if
    prelink is enabled
    + S8235671: enhance print_rlimit_info in os_posix
    + S8235744: PIT: test/jdk/javax/swing/text/html/
    /TestJLabelWithHTMLText.java times out in linux-x64
    + S8235904: Infinite loop when rendering huge lines
    + S8235998: [c2] Memory leaks during tracing after '8224193:
    stringStream should not use Resource Area'.
    + S8236039: JSSE Client does not accept status_request
    extension in CertificateRequest messages for TLS 1.3
    + S8236140: assert(!VerifyHashTableKeys || _hash_lock == 0)
    failed: remove node from hash table before modifying it
    + S8236179: C1 register allocation error with T_ADDRESS
    + S8236488: Support for configure option
  - -with-native-debug-symbols=internal is impossible on Windows
    + S8236500: Windows ucrt.dll should be looked up in versioned
    WINSDK subdirectory
    + S8236709: struct SwitchRange in HS violates C++ One
    Definition Rule
    + S8236848: [JDK 11u] make run-test-tier1 fails after backport
    of JDK-8232834
    + S8236873: Worker has a deadlock bug
    + S8237217: Incorrect G1StringDedupEntry type used in
    StringDedupTable destructor
    + S8237368: Problem with NullPointerException in RMI
    TCPEndpoint.read
    + S8237375: SimpleThresholdPolicy misses CounterDecay timestamp
    initialization
    + S8237508: Simplify JarFile.isInitializing
    + S8237540: Missing files in backport of JDK-8210910
    + S8237541: Missing files in backport of JDK-8236528
    + S8237600: Test SunJSSEFIPSInit fails on Ubuntu
    + S8237819: s390x - remove unused pd_zero_to_words_large
    + S8237869: exclude jtreg test security/infra/java/security/
    /cert/CertPathValidator/certification/LuxTrustCA.java because
    of instabilities
    + S8237879: make 4.3 breaks build
    + S8237945: CTW: C2 compilation fails with
    assert(just_allocated_object(alloc_ctl) == ptr) failed: most
    recent allo...
    + S8238225: Issues reported after replacing symlink at
    Contents/MacOS/libjli.dylib with binary
    + S8238247: CTW runner should sweep nmethods more aggressively
    + S8238366: CTW runner closes standard output on exit
    + S8238438: SuperWord::co_locate_pack picks memory state of
    first instead of last load
    + S8238502: sunmscapi.dll causing EXCEPTION_ACCESS_VIOLATION
    + S8238534: Deep sign macOS bundles before bundle archive is
    being created
    + S8238591: CTW: Split
    applications/ctw/modules/jdk_localedata.java
    + S8238596: AVX enabled by default for Skylake even when
    unsupported
    + S8238811: C2: assert(i &gt;= req() || i == 0 || is_Region() ||
    is_Phi()) with -XX:+VerifyGraphEdges
    + S8239005: [TESTBUG] test/hotspot/jtreg/runtime/
    /StackGuardPages/TestStackGuardPages.java: exeinvoke.c: must
    initialize static state before calling do_overflow()
    + S8239466: Loss of precision in counter decay calculation in
    11u backport of JDK-8237375
    + S8239856: [ntintel] asserts about copying unaligned array
    element
    + S8240724: [test] jdk11 downport of 8224475 misses binary file
    test/jdk/javax/swing/JTextPane/arrow.png
    + S8241296: Segfault in JNIHandleBlock::oops_do()
- Removed patch:
  * DependOnVariableHelper.patch
    + fixed upstream
- Added patch:
  * JDK-8228407.patch
    + fix crashes due to shared archive file mismatch</changelog>
  <changelog author="fstrba@suse.com" date="1594900800">- Update to upstream tag jdk-11.0.8+10 (July 2020 CPU, bsc#1174157)
  * Security fixes:
    + JDK-8230613: Better ASCII conversions
    + JDK-8231800: Better listing of arrays
    + JDK-8232014: Expand DTD support
    + JDK-8233234: Better Zip Naming
    + JDK-8233239, CVE-2020-14562: Enhance TIFF support
    + JDK-8233255: Better Swing Buttons
    + JDK-8234032: Improve basic calendar services
    + JDK-8234042: Better factory production of certificates
    + JDK-8234418: Better parsing with CertificateFactory
    + JDK-8234836: Improve serialization handling
    + JDK-8236191: Enhance OID processing
    + JDK-8236867, CVE-2020-14573: Enhance Graal interface handling
    + JDK-8237117, CVE-2020-14556: Better ForkJoinPool behavior
    + JDK-8237592, CVE-2020-14577: Enhance certificate verification
    + JDK-8238002, CVE-2020-14581: Better matrix operations
    + JDK-8238013: Enhance String writing
    + JDK-8238804: Enhance key handling process
    + JDK-8238842: AIOOBE in GIFImageReader.initializeStringTable
    + JDK-8238843: Enhanced font handing
    + JDK-8238920, CVE-2020-14583: Better Buffer support
    + JDK-8238925: Enhance WAV file playback
    + JDK-8240119, CVE-2020-14593: Less Affine Transformations
    + JDK-8240482: Improved WAV file playback
    + JDK-8241379: Update JCEKS support
    + JDK-8241522: Manifest improved jar headers redux
    + JDK-8242136, CVE-2020-14621: Better XML namespace handling
  * Other changes:
    + JDK-6933331: (d3d/ogl) java.lang.IllegalStateException:
    Buffers have not been created
    + JDK-7124307: JSpinner and changing value by mouse
    + JDK-8022574: remove HaltNode code after uncommon trap calls
    + JDK-8039082: [TEST_BUG] Test
    java/awt/dnd/BadSerializationTest/BadSerializationTest.java
    fails
    + JDK-8040630: Popup menus and tooltips flicker with previous
    popup contents when first shown
    + JDK-8044365: (dc) MulticastSendReceiveTests.java failing with
    ENOMEM when joining group (OS X 10.9)
    + JDK-8048215: [TESTBUG]
    java/lang/management/ManagementFactory/ThreadMXBeanProxy.java
    Expected non-null LockInfo
    + JDK-8051349: nsk/jvmti/scenarios/sampling/SP06/sp06t003 fails
    in nightly
    + JDK-8080353: JShell: Better error message on attempting to
    add default method
    + JDK-8139876: Exclude hanging nsk/stress/stack from execution
    with deoptimization enabled
    + JDK-8146090: java/lang/ref/ReachabilityFenceTest.java fails
    with -XX:+DeoptimizeALot
    + JDK-8153430: jdk regression test MletParserLocaleTest,
    ParserInfiniteLoopTest reduce default timeout
    + JDK-8156207: Resource allocated BitMaps are often cleared
    unnecessarily
    + JDK-8159740: JShell: corralled declarations do not have
    correct source to wrapper mapping
    + JDK-8175984: ICC_Profile has un-needed, not-empty finalize
    method
    + JDK-8176359: Frame#setMaximizedbounds not working properly in
    multi screen environments
    + JDK-8183369: RFC unconformity of HttpURLConnection with proxy
    + JDK-8187078: -XX:+VerifyOops finds numerous problems when
    running JPRT
    + JDK-8189861: Refactor CacheFind
    + JDK-8191169: java/net/Authenticator/B4769350.java failed
    intermittently
    + JDK-8191930: [Graal] emits unparseable XML into compile log
    + JDK-8193879: Java debugger hangs on method invocation
    + JDK-8196019: java/awt/Window/Grab/GrabTest.java fails on
    Windows
    + JDK-8196181: sun/java2d/GdiRendering/InsetClipping.java fails
    + JDK-8198000:
    java/awt/List/EmptyListEventTest/EmptyListEventTest.java
    debug assert on Windows
    + JDK-8198001: java/awt/Menu/WrongParentAfterRemoveMenu/
    /WrongParentAfterRemoveMenu.java debug assert on Windows
    + JDK-8198339: Test javax/swing/border/Test6981576.java is
    unstable
    + JDK-8200701: jdk/jshell/ExceptionsTest.java fails on Windows,
    after JDK-8198801
    + JDK-8203264: JNI exception pending in
    PlainDatagramSocketImpl.c:740
    + JDK-8203672: JNI exception pending in PlainSocketImpl.c
    + JDK-8203673: JNI exception pending in
    DualStackPlainDatagramSocketImpl.c:398
    + JDK-8204834: Fix confusing "allocate" naming in OopStorage
    + JDK-8205399: Set node color on pinned HashMap.TreeNode
    deletion
    + JDK-8205653: test/jdk/sun/management/jmxremote/bootstrap/
    /RmiRegistrySslTest.java and RmiSslBootstrapTest.sh fail with
    handshake_failure
    + JDK-8206179: com/sun/management/OperatingSystemMXBean/
    /GetCommittedVirtualMemorySize.java fails with Committed
    virtual memory size illegal value
    + JDK-8207334: VM times out in VM_HandshakeAllThreads::doit()
    with RunThese30M
    + JDK-8208277: Code cache heap (-XX:ReservedCodeCacheSize)
    doesn't work with 1GB LargePages
    + JDK-8209113: Use WeakReference for lastFontStrike for created
    Fonts
    + JDK-8209333: Socket reset issue for TLS 1.3 socket close
    + JDK-8209439: C2 library_call can potentially ignore Math.pow
    intrinsic or use null pointer
    + JDK-8209534: [TESTBUG]runtime/appcds/cacheObject/
    /ArchivedModuleCompareTest.java fails with EnableJVMCI.
    + JDK-8210147: adjust some WSAGetLastError usages in windows
    network coding
    + JDK-8210284: "assert((av &amp; 0x00000001) == 0) failed:
    unsupported V8" on Solaris 11.4
    + JDK-8210303: VM_HandshakeAllThreads fails assert with
    "failed: blocked and not walkable"
    + JDK-8210459: Add support for generating compile_commands.json
    + JDK-8210515: [TESTBUG]CheckArchivedModuleApp.java needs to
    check if EnableJVMCI is set.
    + JDK-8210788: Javadoc for Thread.join(long, int) should
    specify that it waits forever when both arguments are zero
    + JDK-8211301: [macos] support full window content options
    + JDK-8211332: Space for stub routines (code_size2) is too
    small on new Skylake CPUs
    + JDK-8211339: NPE during SSL handshake caused by
    HostnameChecker
    + JDK-8211392: compiler/profiling/
    /spectrapredefineclass_classloaders/Launcher.java times out
    in JDK12 CI
    + JDK-8211743: [AOT] crash in ScopeDesc::decode_body() when
    JVMTI walks AOT frames
    + JDK-8212154: [TESTBUG] CheckArchivedModuleApp fails with NPE
    when JVMCI is absent
    + JDK-8212167: JShell : Stack trace of exception has wrong line
    number
    + JDK-8212933: Thread-SMR: requesting a VM operation whilst
    holding a ThreadsListHandle can cause deadlocks
    + JDK-8212986: Make Visual Studio compiler check less strict
    + JDK-8213250: CDS archive creation aborts due to metaspace
    object allocation failure
    + JDK-8213516: jck test api/javax_accessibility/AccessibleState/
    /fields.html fails intermittent
    + JDK-8213947: ARM32: failed check_simd should set
    UsePopCountInstruction to false
    + JDK-8214418: half-closed SSLEngine status may cause
    application dead loop
    + JDK-8214440: ldap over a TLS connection negotiate failed with
    "javax.net.ssl.SSLPeerUnverifiedException: hostname of the
    server does not match the hostname in the server's
    certificate"
    + JDK-8214444: Wrong strncat limits in dfa.cpp
    + JDK-8214481: freetype path does not disable TrueType hinting
    with AA+FM hints
    + JDK-8214571: -Xdoclint of array serialField gives "error:
    array type not allowed here"
    + JDK-8214856: Errors with JSZip in web console after upgrade
    to 3.1.5
    + JDK-8214862: assert(proj != __null) at compile.cpp:3251
    + JDK-8215369: Jcstress pollute /var/tmp with temporary files.
    + JDK-8215551: Missing case label in nmethod::reloc_string_for()
    + JDK-8215555: TieredCompilation C2 threads can excessively
    block handshakes
    + JDK-8215711: Missing key_share extension for (EC)DHE key
    exchange should alert missing_extension
    + JDK-8216151: [Graal] Module
    jdk.internal.vm.compiler.management has not been granted
    accessClassInPackage.org.graalvm.compiler.debug
    + JDK-8216154: C4819 warnings at HotSpot sources on Windows
    + JDK-8216541: CompiledICHolders of VM locked unloaded nmethods
    are released too late
    + JDK-8217230: assert(t == t_no_spec) failure in
    NodeHash::check_no_speculative_types()
    + JDK-8217404: --with-jvm-features doesn't work when multiple
    features are explicitly disabled
    + JDK-8217447: Develop flag TraceICs is broken
    + JDK-8217606: LdapContext#reconnect always opens a new
    connection
    + JDK-8218807: Compilation database (compile_commands.json) may
    contain obsolete items
    + JDK-8219214: Infinite Loop in CodeSection::dump()
    + JDK-8219904: ClassCastException when calling
    FlightRecorderMXBean#getRecordings()
    + JDK-8219991: New fix of the deadlock in
    sun.security.ssl.SSLSocketImpl
    + JDK-8221121: applications/microbenchmarks are encountering
    crashes in tier5
    + JDK-8221445: FastSysexMessage constructor crashes MIDI
    receiption thread
    + JDK-8221482: Initialize VMRegImpl::regName[] earlier to
    prevent assert during PrintStubCode
    + JDK-8221741: ClassCastException can happen when
    fontconfig.properties is used
    + JDK-8221823: Requested JDialog width is ignored
    + JDK-8223108: Test java/awt/EventQueue/
    /NonComponentSourcePost.java is unstable
    + JDK-8223678: Add Visual Studio Code workspace generation
    support (for native code)
    + JDK-8223935: PIT: java/awt/font/WindowsIndicFonts.java fails
    on windows10
    + JDK-8224109: Text spaced incorrectly by drawString under
    rotation with fractional metric
    + JDK-8224632: testbug: java/awt/dnd/RemoveDropTargetCrashTest/
    /RemoveDropTargetCrashTest.java fails on MacOS
    + JDK-8224793: os::die() does not honor CreateCoredumpOnCrash
    option
    + JDK-8224847: gc/stress/TestReclaimStringsLeaksMemory.java
    fails with reserved greater than expected
    + JDK-8224931: disable JAOTC invokedynamic support until
    8223533 is fixed
    + JDK-8224997: ChaCha20-Poly1305 TLS cipher suite decryption
    throws ShortBufferException
    + JDK-8225068: Remove DocuSign root certificate that is
    expiring in May 2020
    + JDK-8225069: Remove Comodo root certificate that is expiring
    in May 2020
    + JDK-8225126: Test SetBoundsPaintTest.html faild on Windows
    when desktop is scaled
    + JDK-8225325: Add tests for redefining a class' private method
    during resolution of the bootstrap specifier
    + JDK-8225622: [AOT] runtime/SharedArchiveFile/
    /TestInterpreterMethodEntries.java crashed with AOTed
    java.base
    + JDK-8225653: Provide more information when hitting SIGILL
    from HaltNode
    + JDK-8225783: Incorrect use of binary operators on booleans in
    type.cpp
    + JDK-8225789: Empty method parameter type should generate
    ClassFormatError
    + JDK-8226198: use of &amp; instead of &amp;&amp; in
    LibraryCallKit::arraycopy_restore_alloc_state
    + JDK-8226253: JAWS reports wrong number of radio buttons when
    buttons are hidden.
    + JDK-8226653: [accessibility] Can edit text cell correctly,
    but Accessibility Tool reads nothing about editor
    + JDK-8226806: [macOS 10.14] Methods of Java Robot should be
    called from appropriate thread
    + JDK-8226879: Memory leak in Type::hashcons
    + JDK-8227632: Incorrect PrintCompilation message: made not
    compilable on levels 0 1 2 3 4
    + JDK-8228407: JVM crashes with shared archive file mismatch
    + JDK-8228482: fix xlc16/xlclang comparison of distinct pointer
    types and string literal conversion warnings
    + JDK-8228757: Fail fast if the handshake type is unknown
    + JDK-8229158: make UseSwitchProfiling non-experimental or
    false by-default
    + JDK-8229421: The logic of java/net/ipv6tests/TcpTest.java is
    flawed
    + JDK-8229855: C2 fails with assert(false) failed: bad AD file
    + JDK-8230591: AArch64: Missing intrinsics for Math.ceil,
    floor, rint
    + JDK-8231118: ARM32: Math tests failures
    + JDK-8231213: Migrate SimpleDateFormatConstTest to JDK Repo
    + JDK-8231243: [TESTBUG] CustomFont.java cannot find font file
    + JDK-8231438: [macOS] Dark mode for the desktop is not
    supported
    + JDK-8231550: C2: ShouldNotReachHere() in
    verify_strip_mined_scheduling
    + JDK-8231564: setMaximizedBounds is broken with large display
    scale and multiple monitors
    + JDK-8231572: Use -lobjc instead of -fobjc-link-runtime in
    libosxsecurity
    + JDK-8231631: sun/net/ftp/FtpURLConnectionLeak.java fails
    intermittently with NPE
    + JDK-8231671: Fix copyright headers in hotspot (missing comma
    after year)
    + JDK-8231720: Some perf regressions after 8225653
    + JDK-8231779: crash
    HeapWord*ParallelScavengeHeap::failed_mem_allocate
    + JDK-8231863: Crash if classpath is read from @argument file
    and the main gets option argument
    + JDK-8232080: jlink plugins for vendor information and
    run-time options
    + JDK-8232106: [x86] C2: SIGILL due to usage of SSSE3
    instructions on processors which don't support it
    + JDK-8232134: Change to Visual Studio 2017 15.9.16 for
    building on Windows at Oracle
    + JDK-8232226: [macos 10.15] test/jdk/java/awt/color/
    /EqualityTest/EqualityTest.java may fail
    + JDK-8232357: Compare version info of Santuario to legal notice
    + JDK-8232572: Add hooks for custom output dir in Bundles.gmk
    + JDK-8232634: Problem List ICMColorDataTest.java
    + JDK-8232748: Build static versions of certain JDK libraries
    + JDK-8232846: ProcessHandle.Info command with non-English
    shows question marks
    + JDK-8232880: Update test documentation with additional
    settings for client UI tooltip tests
    + JDK-8233033: C2 produces wrong result while unswitching a
    loop due to lost control dependencies
    + JDK-8233137: runtime/ErrorHandling/VeryEarlyAssertTest.java
    fails after 8232080
    + JDK-8233197: Invert JvmtiExport::post_vm_initialized() and
    Jfr:on_vm_start() start-up order for correct option parsing
    + JDK-8233291: [TESTBUG] tools/jlink/plugins/
    /VendorInfoPluginsTest.java fails with debug or non-server VMs
    + JDK-8233364: Fix undefined behavior in
    Canonicalizer::do_ShiftOp
    + JDK-8233494: Avoid calling MallocTracker::record_malloc and
    record_free when NMT is off
    + JDK-8233573: Toolkit.getScreenInsets(GraphicsConfiguration)
    may throw ClassCastException
    + JDK-8233608: Minimal build broken after JDK-8233494
    + JDK-8233621: Mismatch in jsse.enableMFLNExtension property
    name
    + JDK-8233696: [TESTBUG]Some jtreg tests fail when CAPS_LOCK is
    ON
    + JDK-8233707: systemScale.cpp could not compile with VS2019
    + JDK-8233801: GCMEmptyIv.java test fails on Solaris 11.4
    + JDK-8233880: Support compilers with multi-digit major version
    numbers
    + JDK-8233920: MethodHandles::tryFinally generates illegal
    bytecode for long/double return type
    + JDK-8234137: The "AutoTestOnTop.java" test may run external
    applications
    + JDK-8234146: compiler/jsr292/
    /ContinuousCallSiteTargetChange.java times out on SPARC
    + JDK-8234184: [TESTBUG] java/awt/Mouse/EnterExitEvents/
    /ModalDialogEnterExitEventsTest.java fails in Windows
    + JDK-8234270: [REDO] JDK-8204128 NMT might report incorrect
    numbers for Compiler area
    + JDK-8234332: [TESTBUG] java/awt/Focus/DisposedWindow/
    /DisposeDialogNotActivateOwnerTest/
    /DisposeDialogNotActivateOwnerTest.java fails on linux-x64
    nightly
    + JDK-8234398: Replace ID2D1Factory::GetDesktopDpi with
    GetDeviceCaps
    + JDK-8234522: [macos] Crash with use of native file dialog
    + JDK-8234691: Potential double-free in ParallelSPCleanupTask
    constructor
    + JDK-8234696: tools/jlink/plugins/VendorInfoPluginsTest.java
    times out
    + JDK-8234727: sun/security/ssl/X509TrustManagerImpl tests
    support TLSv1.3
    + JDK-8234728: Some security tests should support TLSv1.3
    + JDK-8234779: Provide idiom for declaring classes noncopyable
    + JDK-8234824: java/nio/channels/SocketChannel/AdaptSocket.java
    fails on Windows 10
    + JDK-8234968: check calloc rv in libinstrument
    InvocationAdapter
    + JDK-8235153: [TESTBUG] [macos 10.15] java/awt/Graphics/
    /DrawImageBG/SystemBgColorTest.java fails
    + JDK-8235183: Remove the "HACK CODE" in comment
    + JDK-8235263: Revert TLS 1.3 change that wrapped IOExceptions
    + JDK-8235311: Tag mismatch may alert bad_record_mac
    + JDK-8235332: TestInstanceCloneAsLoadsStores.java fails with
  - XX:+StressGCM
    + JDK-8235452: Strip mined loop verification fails with
    assert(is_OuterStripMinedLoop()) failed: invalid node class
    + JDK-8235584: UseProfiledLoopPredicate fails with
    assert(_phase-&gt;get_loop(c) == loop) failed: have to be in the
    same loop
    + JDK-8235620: Broken merge between JDK-8006406 and JDK-8003559
    + JDK-8235638: NPE in LWWindowPeer.getOnscreenGraphics()
    + JDK-8235686: Add more custom hooks in Bundles.gmk
    + JDK-8235739: Rare NPE at WComponentPeer.getGraphics()
    + JDK-8235762: JVM crash in SWPointer during C2 compilation
    + JDK-8235834: IBM-943 charset encoder needs updating
    + JDK-8235874: The ordering of Cipher Suites is not maintained
    provided through jdk.tls.client.cipherSuites and
    jdk.tls.server.cipherSuites system property.
    + JDK-8235908: omit ThreadPriorityPolicy warning when value is
    set from image
    + JDK-8235984: C2: assert(out-&gt;in(PhiNode::Region) == head ||
    out-&gt;in(PhiNode::Region) == slow_head) failed: phi must be
    either part of the slow or the fast loop
    + JDK-8236211: [Graal] compiler/graalunit/GraphTest.java is
    skipped in all testing
    + JDK-8236470: Deal with ECDSA using ecdsa-with-SHA2 plus hash
    algorithm as AlgorithmId
    + JDK-8236545: Compilation error in mach5
    java/awt/FileDialog/MacOSGoToFolderCrash.java
    + JDK-8236700: Upgrading JSZip from v3.1.5 to v3.2.2
    + JDK-8236759: ShouldNotReachHere in
    PhaseIdealLoop::verify_strip_mined_scheduling
    + JDK-8236897: Fix the copyright header for pkcs11gcm2.h
    + JDK-8236921: Add build target to produce a JDK image suitable
    for a Graal/SVM build
    + JDK-8236953: [macos] JavaFX SwingNode is not rendered on macOS
    + JDK-8236996: Incorrect Roboto font rendering on Windows with
    subpixel antialiasing
    + JDK-8237045: JVM uses excessive memory with -XX:+EnableJVMCI
  - XX:JVMCICounterSize=2147483648
    + JDK-8237055: [TESTBUG] compiler/c2/TestJumpTable.java fails
    with release VMs
    + JDK-8237086: assert(is_MachReturn()) running CTW with fix for
    JDK-8231291
    + JDK-8237192: Generate stripped/public pdbs on Windows for jdk
    images
    + JDK-8237396: JvmtiTagMap::weak_oops_do() should not trigger
    barriers
    + JDK-8237474: Default SSLEngine should create in server role
    + JDK-8237859: C2: Crash when loads float above range check
    + JDK-8237879: make 4.3 breaks build
    + JDK-8237951: CTW: C2 compilation fails with "malformed
    control flow"
    + JDK-8237962: give better error output for invalid OCSP
    response intervals in CertPathValidator checks
    + JDK-8238190: [JVMCI] Fix single implementor speculation for
    diamond shapes.
    + JDK-8238356: CodeHeap::blob_count() overestimates the number
    of blobs
    + JDK-8238452: Keytool generates wrong expiration date if
    validity is set to 2050/01/01
    + JDK-8238555: Allow Initialization of SunPKCS11 with NSS when
    there are external FIPS modules in the NSSDB
    + JDK-8238575: DragSourceEvent.getLocation() returns wrong
    value on HiDPI screens (Windows)
    + JDK-8238676: jni crashes on accessing it from process exit
    hook
    + JDK-8238721: Add failing client jtreg tests to the Problem
    List
    + JDK-8238738: AudioSystem.getMixerInfo() takes about 30 sec to
    report a gone audio device
    + JDK-8238756: C2: assert(((n) == __null || !VerifyIterativeGVN
    || !((n)-&gt;is_dead()))) failed: can not use dead node
    + JDK-8238765: PhaseCFG::schedule_pinned_nodes cannot handle
    precedence edges from unmatched CFG nodes correctly
    + JDK-8238898: Missing hash characters for header on license
    file
    + JDK-8238942: Rendering artifacts with LCD text and fractional
    metrics
    + JDK-8238985: [TESTBUG] The arrow image is blue instead of
    green
    + JDK-8239000: handle ContendedPaddingWidth in vm_version_ppc
    + JDK-8239055: Wrong implementation of VMState.hasListener
    + JDK-8239091: Reversed arguments in call to strstr in freetype
    "debug" code.
    + JDK-8239142: C2's UseUniqueSubclasses optimization is broken
    for array accesses
    + JDK-8239224: libproc_impl.c previous_thr may be used
    uninitialized warning
    + JDK-8239351: Give more meaningful InternalError messages in
    Deflater.c
    + JDK-8239365: ProcessBuilder test modifications for AIX
    execution
    + JDK-8239456: vtable stub generation: assert failure (code
    size estimate)
    + JDK-8239457: call ReleaseStringUTFChars before early returns
    in Java_sun_security_pkcs11_wrapper_PKCS11_connect
    + JDK-8239462: jdk.hotspot.agent misses some
    ReleaseStringUTFChars calls in case of early returns
    + JDK-8239557: [TESTBUG] VeryEarlyAssertTest.java validating
    "END." marker at lastline is not always true
    + JDK-8239787: AArch64: String.indexOf may incorrectly handle
    empty strings
    + JDK-8239792: Bump update version for OpenJDK: jdk-11.0.8
    + JDK-8239798: SSLSocket closes socket both socket endpoints on
    a SocketTimeoutException
    + JDK-8239819: XToolkit: Misread of screen information memory
    + JDK-8239852: java/util/concurrent tests fail with
  - XX:+VerifyGraphEdges: assert(!VerifyGraphEdges) failed:
    verification should have failed
    + JDK-8239893: Windows handle Leak when starting processes
    using ProcessBuilder
    + JDK-8239915: Zero VM crashes when handling dynamic constant
    + JDK-8239931: [win][x86] vtable stub generation: assert
    failure (code size estimate) follow-up
    + JDK-8239965: XMLEncoder/Test4625418.java fails due to "Error:
    Cp943 - can't read properly"
    + JDK-8239976: Put JDK-8239965 on the ProblemList.txt
    + JDK-8240073: Fix 'test-make' build target in 11u
    + JDK-8240197: Cannot start JVM when $JAVA_HOME includes CJK
    characters
    + JDK-8240202: A few client tests leave mouse buttons pressed
    + JDK-8240220: IdealLoopTree::dump_head predicate printing is
    broken
    + JDK-8240223: Use consistent predicate order in and with
    PhaseIdealLoop::find_predicate
    + JDK-8240227: Loop predicates should be copied to unswitched
    loops
    + JDK-8240286: [TESTBUG] Test command error in hotspot/jtreg/
    /compiler/loopopts/superword/SumRedAbsNeg_Float.java
    + JDK-8240518: Incorrect JNU_ReleaseStringPlatformChars in
    Windows Print
    + JDK-8240529: CheckUnhandledOops breaks NULL check in
    Modules::define_module
    + JDK-8240576: JVM crashes after transformation in C2
    IdealLoopTree::merge_many_backedges
    + JDK-8240603: Windows 32bit compile error after 8238676
    + JDK-8240629: argfiles parsing broken for argfiles with
    comment cross 4096 bytes chunk
    + JDK-8240711: TestJstatdPort.java failed due to
    "ExportException: Port already in use:"
    + JDK-8240786: [TESTBUG] The test java/awt/Window/
    /GetScreenLocation/GetScreenLocationTest.java fails on HiDPI
    screen
    + JDK-8240824: enhance print_full_memory_info on Linux by THP
    related information
    + JDK-8240827: Downport SSLSocketImpl.java from "8221882: Use
    fiber-friendly java.util.concurrent.locks in JSSE"
    + JDK-8240905: assert(mem == (Node*)1 || mem == mem2) failed:
    multiple Memories being matched at once?
    + JDK-8240972: macOS codesign fail on macOS 10.13.5 or older
    + JDK-8241445: Fix copyright in
    test/jdk/tools/launcher/ArgFileSyntax.java
    + JDK-8241458: [JVMCI] add mark value to expose
    CodeOffsets::Frame_Complete
    + JDK-8241464: [11u] Backport: make rehashing be a needed
    guaranteed safepoint cleanup action
    + JDK-8241556: Memory leak if -XX:CompileCommand is set
    + JDK-8241568: (fs) UserPrincipalLookupService.lookupXXX
    failure with IOE "Operation not permitted"
    + JDK-8241586: compiler/cpuflags/
    /TestAESIntrinsicsOnUnsupportedConfig.java fails on aarch64
    + JDK-8241638: launcher time metrics always report 1 on Linux
    when _JAVA_LAUNCHER_DEBUG set
    + JDK-8241660: Add virtualization information output to hs_err
    file on macOS
    + JDK-8241808: [TESTBUG] The JDK-8039467 bug appeared on macOS
    + JDK-8241888: Mirror jdk.security.allowNonCaAnchor system
    property with a security one
    + JDK-8241900: Loop unswitching may cause dependence on null
    check to be lost
    + JDK-8241948: enhance list of environment variables printed in
    hs_err file
    + JDK-8241996: on linux set full relro in the linker flags
    + JDK-8242108: Performance regression after fix for JDK-8229496
    + JDK-8242141: New System Properties to configure the TLS
    signature schemes
    + JDK-8242154: Backport parts of JDK-4947890 to OpenJDK 11u
    + JDK-8242174: [macos] The NestedModelessDialogTest test make
    the macOS unstable
    + JDK-8242239: [Graal] javax/management/generified/
    /GenericTest.java fails: FAILED: queryMBeans sets same
    + JDK-8242294: JSSE Client does not throw SSLException when an
    alert occurs during handshaking
    + JDK-8242379: [TESTBUG] compiler/loopopts/
    /TestLoopUnswitchingLostCastDependency.java fails with
    release VMs
    + JDK-8242470: Update Xerces to Version 2.12.1
    + JDK-8242498: Invalid "sun.awt.TimedWindowEvent" object leads
    to JVM crash
    + JDK-8242541: Small charset issues (ISO8859-16, x-eucJP-Open,
    x-IBM834 and x-IBM949C)
    + JDK-8242626: enhance posix print_rlimit_info
    + JDK-8243059: Build fails when --with-vendor-name contains a
    comma
    + JDK-8243539: Copyright info (Year) should be updated for fix
    of 8241638
    + JDK-8243541: (tz) Upgrade time-zone data to tzdata2020a
    + JDK-8244407: JVM crashes after transformation in C2
    IdealLoopTree::split_fall_in
    + JDK-8244520: problemlist
    java/awt/font/Rotate/RotatedFontTest.java on linux
    + JDK-8244777: ClassLoaderStats VM Op uses constant hash value
    + JDK-8244853: The static build of libextnet is missing the
    JNI_OnLoad_extnet function
    + JDK-8244951: Missing entitlements for hardened runtime
    + JDK-8245047: [PPC64] C2: ReverseBytes + Load always match to
    unordered Load (acquire semantics missing)
    + JDK-8245649: Revert 8245397 backport of 8230591
    + JDK-8246031: SSLSocket.getSession() doesn't close connection
    for timeout/ interrupts
    + JDK-8246613: Choose the default SecureRandom algo based on
    registration ordering
    + JDK-8248505: Unexpected NoSuchAlgorithmException when using
    secure random impl from BCFIPS provider
- Removed patch:
  * JDK-8228407.patch
    + integrated upstream</changelog>
  <changelog author="fstrba@suse.com" date="1604318400">- Update to upstream tag jdk-11.0.9-11 (October 2020 CPU,
  bsc#1177943)
  * New features
    + JDK-8250784: Shenandoah: A Low-Pause-Time Garbage Collector
  * Security fixes
    + JDK-8233624: Enhance JNI linkage
    + JDK-8236196: Improve string pooling
    + JDK-8236862, CVE-2020-14779: Enhance support of Proxy class
    + JDK-8237990, CVE-2020-14781: Enhanced LDAP contexts
    + JDK-8237995, CVE-2020-14782: Enhance certificate processing
    + JDK-8240124: Better VM Interning
    + JDK-8241114, CVE-2020-14792: Better range handling
    + JDK-8242680, CVE-2020-14796: Improved URI Support
    + JDK-8242685, CVE-2020-14797: Better Path Validation
    + JDK-8242695, CVE-2020-14798: Enhanced buffer support
    + JDK-8243302: Advanced class supports
    + JDK-8244136, CVE-2020-14803: Improved Buffer supports
    + JDK-8244479: Further constrain certificates
    + JDK-8244955: Additional Fix for JDK-8240124
    + JDK-8245407: Enhance zoning of times
    + JDK-8245412: Better class definitions
    + JDK-8245417: Improve certificate chain handling
    + JDK-8248574: Improve jpeg processing
    + JDK-8249927: Specify limits of jdk.serialProxyInterfaceLimit
    + JDK-8253019: Enhanced JPEG decoding
  * Other changes
    + JDK-6532025: GIF reader throws misleading exception with
    truncated images
    + JDK-6949753: [TEST BUG]: java/awt/print/PageFormat/
    /PDialogTest.java needs update by removing an infinite loop
    + JDK-8022535: [TEST BUG] javax/swing/text/html/parser/
    /Test8017492.java fails
    + JDK-8062947: Fix exception message to correctly represent
    LDAP connection failure
    + JDK-8067354: com/sun/jdi/GetLocalVariables4Test.sh failed
    + JDK-8134599: TEST_BUG: java/rmi/transport/closeServerSocket/
    /CloseServerSocket.java fails intermittently with Address
    already in use
    + JDK-8151678: com/sun/jndi/ldap/LdapTimeoutTest.java failed
    due to timeout on DeadServerNoTimeoutTest is incorrect
    + JDK-8160768: Add capability to custom resolve host/domain
    names within the default JNDI LDAP provider
    + JDK-8172404: Tools should warn if weak algorithms are used
    before restricting them
    + JDK-8193367: Annotated type variable bounds crash javac
    + JDK-8202117: com/sun/jndi/ldap/RemoveNamingListenerTest.java
    fails intermittently: Connection reset
    + JDK-8203026: java.rmi.NoSuchObjectException: no such object
    in table
    + JDK-8203281: [Windows] JComboBox change in ui when
    editor.setBorder() is called
    + JDK-8203382: Rename SystemDictionary::initialize_wk_klass to
    resolve_wk_klass
    + JDK-8203393: com/sun/jdi/JdbMethodExitTest.sh and
    JdbExprTest.sh fail due to timeout
    + JDK-8203928: [Test] Convert non-JDB scaffolding
    serviceability shell script tests to java
    + JDK-8204963: javax.swing.border.TitledBorder has a memory leak
    + JDK-8204994: SA might fail to attach to process with "Windbg
    Error: WaitForEvent failed"
    + JDK-8205534: Remove SymbolTable dependency from
    serviceability agent
    + JDK-8206309: Tier1 SA tests fail
    + JDK-8208281: java/nio/channels/
    /AsynchronousSocketChannel/Basic.java timed out
    + JDK-8209109: [TEST] rewrite com/sun/jdi shell tests to java
    version - step1
    + JDK-8209332: [TEST] test/jdk/com/sun/jdi/CatchPatternTest.sh
    is incorrect
    + JDK-8209342: Problemlist SA tests on Solaris due to Error
    attaching to process: Can't create thread_db agent!
    + JDK-8209343: Test javax/swing/border/TestTitledBorderLeak.java
    should be marked as headful
    + JDK-8209517: com/sun/jdi/BreakpointWithFullGC.java fails with
    timeout
    + JDK-8209604: [TEST] rewrite com/sun/jdi shell tests to java
    version - step2
    + JDK-8209605: com/sun/jdi/BreakpointWithFullGC.java fails with
    ZGC
    + JDK-8209608: Problem list com/sun/jdi/BreakpointWithFullGC.java
    + JDK-8210131: vmTestbase/nsk/jvmti/scenarios/allocation/AP10/
    /ap10t001/TestDescription.java failed with ObjectFree:
    GetCurrentThreadCpuTimerInfo returned unexpected error code
    + JDK-8210243: [TEST] rewrite com/sun/jdi shell tests to java
    version - step3
    + JDK-8210527: JShell: NullPointerException in
    jdk.jshell.Eval.translateExceptionStack
    + JDK-8210560: [TEST] convert com/sun/jdi redefineClass-related
    tests
    + JDK-8210725: com/sun/jdi/RedefineClearBreakpoint.java fails
    with waitForPrompt timed out after 60 seconds
    + JDK-8210748: [TESTBUG] lib.jdb.Jdb.waitForPrompt() should
    clarify which output is the pending reply after a timeout
    + JDK-8210760: [TEST] rewrite com/sun/jdi shell tests to java
    version - step4
    + JDK-8210977: jdk/jfr/event/oldobject/TestThreadLocalLeak.java
    fails to find ThreadLocalObject
    + JDK-8211292: [TEST] convert com/sun/jdi/DeferredStepTest.sh
    test
    + JDK-8211694: JShell: Redeclared variable should be reset
    + JDK-8212200: assert when shared java.lang.Object is redefined
    by JVMTI agent
    + JDK-8212629: [TEST] wrong breakpoint in
    test/jdk/com/sun/jdi/DeferredStepTest
    + JDK-8212665: com/sun/jdi/DeferredStepTest.java: jj1 (line 57)
  - unexpected. lastLine=52, minLine=52, maxLine=55
    + JDK-8212807: tools/jar/multiRelease/Basic.java times out
    + JDK-8213182: Minimal VM build failure after JDK-8212200
    (assert when shared java.lang.Object is redefined by JVMTI
    agent)
    + JDK-8213214: Set -Djava.io.tmpdir= when running tests
    + JDK-8213275: ReplaceCriticalClasses.java fails with
    jdk.internal.vm.PostVMInitHook not found
    + JDK-8213574: Deadlock in string table expansion when dumping
    lots of CDS classes
    + JDK-8213703: LambdaConversionException: Invalid receiver type
    not a subtype of implementation type interface
    + JDK-8214074: Ghash optimization using AVX instructions
    + JDK-8214491: Upgrade to JLine 3.9.0
    + JDK-8214797: TestJmapCoreMetaspace.java timed out
    + JDK-8215243: JShell tests failing intermitently with
    "Problem cleaning up the following threads:"
    + JDK-8215244: jdk/jshell/ToolBasicTest.java
    testHistoryReference failed
    + JDK-8215354: x86_32 build failures after JDK-8214074 (Ghash
    optimization using AVX instructions)
    + JDK-8215438: jshell tool: Ctrl-D causes EOF
    + JDK-8216021: RunTest.gmk might set concurrency level to 1 on
    Windows
    + JDK-8216974: HttpConnection not returned to the pool after
    204 response
    + JDK-8218948: SimpleDateFormat :: format - Zone Names are not
    reflected correctly during run time
    + JDK-8219712: code_size2 (defined in stub_routines_x86.hpp) is
    too small on new Skylake CPUs
    + JDK-8220150: macos10.14 Mojave returns anti-aliased glyphs
    instead of aliased B&amp;W glyphs
    + JDK-8221658: aarch64: add necessary predicate for ubfx
    patterns
    + JDK-8221759: Crash when completing "java.io.File.path"
    + JDK-8221918: runtime/SharedArchiveFile/serviceability/
    /ReplaceCriticalClasses.java fails: Shared archive not found
    + JDK-8222074: Enhance auto vectorization for x86
    + JDK-8222079: Don't use memset to initialize fields decode_env
    constructor in disassembler.cpp
    + JDK-8222769: [TESTBUG] TestJFRNetworkEvents should not rely
    on hostname command
    + JDK-8223688: JShell: crash on the instantiation of raw
    anonymous class
    + JDK-8223777: In posix_spawn mode, failing to exec()
    jspawnhelper does not result in an error
    + JDK-8223940: Private key not supported by chosen signature
    algorithm
    + JDK-8224184: jshell got IOException at exiting with AIX
    + JDK-8224234: compiler/codegen/TestCharVect2.java fails in
    test_mulc
    + JDK-8225037: java.net.JarURLConnection::getJarEntry() throws
    NullPointerException
    + JDK-8225625: AES Electronic Codebook (ECB) encryption and
    decryption optimization using AVX512 + VAES instructions
    + JDK-8226536: Catch OOM from deopt that fails rematerializing
    objects
    + JDK-8226575: OperatingSystemMXBean should be made container
    aware
    + JDK-8226697: Several tests which need the @key headful
    keyword are missing it.
    + JDK-8226809: Circular reference in printed stack trace is not
    correctly indented &amp; ambiguous
    + JDK-8227059: sun/security/tools/keytool/
    /DefaultSignatureAlgorithm.java timed out
    + JDK-8227269: Slow class loading when running with JDWP
    + JDK-8227595: keytool/fakegen/DefaultSignatureAlgorithm.java
    fails due to "exitValue = 6"
    + JDK-8228448: Jconsole can't connect to itself
    + JDK-8228967: Trust/Key store and SSL context utilities for
    tests
    + JDK-8229378: jdwp library loader in linker_md.c quietly
    truncates on buffer overflow
    + JDK-8229815: Upgrade Jline to 3.12.1
    + JDK-8230000: some httpclients testng tests run zero test
    + JDK-8230002: javax/xml/jaxp/unittest/transform/
    /SecureProcessingTest.java runs zero test
    + JDK-8230010: Remove jdk8037819/BasicTest1.java
    + JDK-8230094: CCE in createXMLEventWriter(Result) over an
    arbitrary XMLStreamWriter
    + JDK-8230402: Allocation of compile task fails with assert:
    "Leaking compilation tasks?"
    + JDK-8230767: FlightRecorderListener returns null recording
    + JDK-8230870: (zipfs) Add a ZIP FS test that is similar to
    test/jdk/java/util/zip/EntryCount64k.java
    + JDK-8231209: [REDO] ThreadMXBean::getThreadAllocatedBytes()
    can be quicker for self thread
    + JDK-8231586: enlarge encoding space for OopMapValue offsets
    + JDK-8231953: Wrong assumption in assertion in
    oop::register_oop
    + JDK-8231968: getCurrentThreadAllocatedBytes default
    implementation s/b getThreadAllocatedBytes
    + JDK-8232083: Minimal VM is broken after JDK-8231586
    + JDK-8232161: Align some one-way conversion in MS950 charset
    with Windows
    + JDK-8232855: jshell missing word in /help help
    + JDK-8233027: OopMapSet::all_do does oms.next() twice during
    iteration
    + JDK-8233228: Disable weak named curves by default in TLS,
    CertPath, and Signed JAR
    + JDK-8233386: Initialize NULL fields for unused decorations
    + JDK-8233452: java.math.BigDecimal.sqrt() with
    RoundingMode.FLOOR results in incorrect result
    + JDK-8233686: XML transformer uses excessive amount of memory
    + JDK-8233741: AES Countermode (AES-CTR) optimization using
    AVX512 + VAES instructions
    + JDK-8233829: javac cannot find non-ASCII module name under
    non-UTF8 environment
    + JDK-8233958: Memory retention due to HttpsURLConnection
    finalizer that serves no purpose
    + JDK-8234011: (zipfs) Memory leak in
    ZipFileSystem.releaseDeflater()
    + JDK-8234058: runtime/CompressedOops/
    /CompressedClassPointers.java fails with 'Narrow klass base:
    0x0000000000000000' missing from stdout/stderr
    + JDK-8234149: Several regression tests do not dispose Frame at
    end
    + JDK-8234347: "Turkey" meta time zone does not generate
    composed localized names
    + JDK-8234385: [TESTBUG] java/awt/EventQueue/6980209/
    /bug6980209.java fails in linux nightly
    + JDK-8234535: Cross compilation fails due to missing CFLAGS
    for the BUILD_CC
    + JDK-8234541: C1 emits an empty message when it inlines
    successfully
    + JDK-8234687: change javap reporting on unknown attributes
    + JDK-8236464: SO_LINGER option is ignored by SSLSocket in JDK
    11
    + JDK-8236548: Localized time zone name inconsistency between
    English and other locales
    + JDK-8236617: jtreg test containers/docker/
    /TestMemoryAwareness.java fails after 8226575
    + JDK-8237182: Update copyright header for shenandoah and
    epsilon files
    + JDK-8237888: security/infra/java/security/cert/
    /CertPathValidator/certification/LuxTrustCA.java fails when
    checking validity interval
    + JDK-8237977: Further update
    javax/net/ssl/compatibility/Compatibility.java
    + JDK-8238270: java.net HTTP/2 client does not decrease stream
    count when receives 204 response
    + JDK-8238284: [macos] Zero VM build fails due to an obvious
    typo
    + JDK-8238380: java.base/unix/native/libjava/childproc.c
    "multiple definition" link errors with GCC10
    + JDK-8238386: (sctp) jdk.sctp/unix/native/libsctp/SctpNet.c
    "multiple definition" link errors with GCC10
    + JDK-8238388: libj2gss/NativeFunc.o "multiple definition" link
    errors with GCC10
    + JDK-8238448: RSASSA-PSS signature verification fail when
    using certain odd key sizes
    + JDK-8238710: LingeredApp doesn't log stdout/stderr if exits
    with non-zero code
    + JDK-8239083: C1 assert(known_holder == NULL ||
    (known_holder-&gt;is_instance_klass() &amp;&amp;
    (!known_holder-&gt;is_interface() ||
    ((ciInstanceKlass*)known_holder)-&gt;has_nonstatic_concrete_methods())),
    "should be non-static concrete method");
    + JDK-8239385: KerberosTicket client name refers wrongly to
    sAMAccountName in AD
    + JDK-8240169: javadoc fails to link to non-modular api docs
    + JDK-8240295: hs_err elapsed time in seconds is not accurate
    enough
    + JDK-8240360: NativeLibraryEvent has wrong library name on
    Linux
    + JDK-8240676: Meet not symmetric failure when running lucene
    on jdk8
    + JDK-8241007: Shenandoah: remove
    ShenandoahCriticalControlThreadPriority support
    + JDK-8241065: Shenandoah: remove leftover code after
    JDK-8231086
    + JDK-8241086: Test runtime/NMT/HugeArenaTracking.java is
    failing on 32bit Windows
    + JDK-8241130: com.sun.jndi.ldap.EventSupport.removeDeadNotifier:
    java.lang.NullPointerException
    + JDK-8241138: http.nonProxyHosts=* causes
    StringIndexOutOfBoundsException in DefaultProxySelector
    + JDK-8241319: WB_GetCodeBlob doesn't have ResourceMark
    + JDK-8241478: vmTestbase/gc/gctests/Steal/steal001/steal001.java
    fails with OOME
    + JDK-8241574: Shenandoah: remove ShenandoahAssertToSpaceClosure
    + JDK-8241750: x86_32 build failure after JDK-8227269
    + JDK-8242184: CRL generation error with RSASSA-PSS
    + JDK-8242283: Can't start JVM when java home path includes
    non-ASCII character
    + JDK-8242556: Cannot load RSASSA-PSS public key with non-null
    params from byte array
    + JDK-8243029: Rewrite javax/net/ssl/compatibility/
    /Compatibility.java with a flexible interop test framework
    + JDK-8243138: Enhance BaseLdapServer to support starttls
    extended request
    + JDK-8243320: Add SSL root certificates to Oracle Root CA
    program
    + JDK-8243321: Add Entrust root CA - G4 to Oracle Root CA
    program
    + JDK-8243389: enhance os::pd_print_cpu_info on linux
    + JDK-8243453: java --describe-module failed with non-ASCII
    module name under non-UTF8 environment
    + JDK-8243470: [macos] bring back O2 opt level for unsafe.cpp
    + JDK-8243489: Thread CPU Load event may contain wrong data for
    CPU time under certain conditions
    + JDK-8243925: Toolkit#getScreenInsets() returns wrong value on
    HiDPI screens (Windows)
    + JDK-8244087: 2020-04-24 public suffix list update
    + JDK-8244151: Update MUSCLE PC/SC-Lite headers to the latest
    release 1.8.26
    + JDK-8244164: AArch64: jaotc generates incorrect code for
    compressed OOPs with non-zero heap base
    + JDK-8244196: adjust output in os_linux
    + JDK-8244225: stringop-overflow warning on strncpy call from
    compile_the_world_in
    + JDK-8244287: JFR: Methods samples have line number 0
    + JDK-8244703: "platform encoding not initialized" exceptions
    with debugger, JNI
    + JDK-8244719: CTW: C2 compilation fails with
    "assert(!VerifyHashTableKeys || _hash_lock == 0) failed:
    remove node from hash table before modifying it"
    + JDK-8244729: Shenandoah: remove resolve paths from
    SBSA::generate_shenandoah_lrb
    + JDK-8244763: Update --release 8 symbol information after JSR
    337 MR3
    + JDK-8244818: Java2D Queue Flusher crash while moving
    application window to external monitor
    + JDK-8245151: jarsigner should not raise duplicate warnings on
    verification
    + JDK-8245616: Bump update version for OpenJDK: jdk-11.0.9
    + JDK-8245714: "Bad graph detected in build_loop_late" when
    loads are pinned on loop limit check uncommon branch
    + JDK-8245801: StressRecompilation triggers assert "redundunt
    OSR recompilation detected. memory leak in CodeCache!"
    + JDK-8245832: JDK build make-static-libs should build all JDK
    libraries
    + JDK-8245880: Shenandoah: check class unloading flag early in
    concurrent code root scan
    + JDK-8245981: Upgrade to jQuery 3.5.1
    + JDK-8246027: Minimal fastdebug build broken after JDK-8245801
    + JDK-8246094: [macos] Sound Recording and playback is not
    working
    + JDK-8246153: TestEliminateArrayCopy fails with
  - XX:+StressReflectiveCode
    + JDK-8246193: Possible NPE in ENC-PA-REP search in AS-REQ
    + JDK-8246196: javax/management/MBeanServer/OldMBeanServerTest
    fails with AssertionError
    + JDK-8246203: Segmentation fault in verification due to stack
    overflow with -XX:+VerifyIterativeGVN
    + JDK-8246330: Add TLS Tests for Legacy ECDSA curves
    + JDK-8246453: TestClone crashes with "all collected exceptions
    must come from the same place"
    + JDK-8247246: Add explicit ResolvedJavaType.link and expose
    presence of default methods
    + JDK-8247350: [aarch64] assert(false) failed: wrong size of
    mach node
    + JDK-8247502: PhaseStringOpts crashes while optimising
    effectively dead code
    + JDK-8247615: Initialize the bytes left for the heap sampler
    + JDK-8247824: CTW: C2 (Shenandoah) compilation fails with SEGV
    in SBC2Support::pin_and_expand
    + JDK-8247874: Replacement in VersionProps.java.template not
    working when --with-vendor-bug-url contains '&amp;'
    + JDK-8247979: aarch64: missing side effect of killing flags
    for clearArray_reg_reg
    + JDK-8248214: Add paddings for TaskQueueSuper to reduce
    false-sharing cache contention
    + JDK-8248219: aarch64: missing memory barrier in
    fast_storefield and fast_accessfield
    + JDK-8248348: Regression caused by the update to BCEL 6.0
    + JDK-8248385: [testbug][11u] Adapt TestInitiExceptions to
    jtreg 5.1
    + JDK-8248495: [macos] zerovm is broken due to libffi headers
    location
    + JDK-8248851: CMS: Missing memory fences between free chunk
    check and klass read
    + JDK-8248987: AOT's Linker.java seems to eagerly fail-fast on
    Windows
    + JDK-8249159: Downport test rework for SSLSocketTemplate from
    8224650
    + JDK-8249215: JFrame::setVisible crashed with
  - Dfile.encoding=UTF-8 on Japanese Windows.
    + JDK-8249251: [dark_mode ubuntu 20.04] The selected menu is
    not highlighted in GTKLookAndFeel
    + JDK-8249255: Build fails if source code in cygwin home dir
    + JDK-8249277: TestVerifyIterativeGVN.java is failing with
    timeout in OpenJDK 11
    + JDK-8249278: Revert JDK-8226253 which breaks the spec of
    AccessibleState.SHOWING for JList
    + JDK-8249560: Shenandoah: Fix racy GC request handling
    + JDK-8249801: Shenandoah: Clear soft-refs on requested GC cycle
    + JDK-8249953: Shenandoah: gc/shenandoah/mxbeans tests should
    account for corner cases
    + JDK-8250582: Revert Principal Name type to NT-UNKNOWN when
    requesting TGS Kerberos tickets
    + JDK-8250609: C2 crash in IfNode::fold_compares
    + JDK-8250627: Use -XX:+/-UseContainerSupport for
    enabling/disabling Java container metrics
    + JDK-8250755: Better cleanup for
    jdk/test/javax/imageio/plugins/shared/CanWriteSequence.java
    + JDK-8250787: Provider.put no longer registering aliases in
    FIPS env
    + JDK-8250826: jhsdb does not work with coredump which comes
    from Substrate VM
    + JDK-8250827: Shenandoah: needs to reset/finish StringTable's
    dead count before/after parallel walk
    + JDK-8250844: Make sure {type,obj}ArrayOopDesc accessors check
    the bounds
    + JDK-8251117: Cannot check P11Key size in P11Cipher and
    P11AEADCipher
    + JDK-8251354: Shenandoah: Fix jdk/jfr/tool/TestPrintJSON.java
    test failure
    + JDK-8251451: Shenandoah: Remark ObjectSynchronizer roots with
    I-U
    + JDK-8251469: Better cleanup for
    test/jdk/javax/imageio/SetOutput.java
    + JDK-8251487: Shenandoah: missing detail timing tracking for
    final mark cleaning phase
    + JDK-8252120: compiler/oracle/TestCompileCommand.java
    misspells "occured"
    + JDK-8252157: JDK-8231209 11u backport breaks jmm binary
    compatibility
    + JDK-8252258: [11u] JDK-8242154 changes the default vendor
    + JDK-8252804: [test] Fix 'ReleaseDeflater.java' test after
    downport of 8234011
    + JDK-8253134: JMM_VERSION should remain at 0x20020000 (JDK 10)
    in JDK 11
    + JDK-8253283: [11u] Test build/translations/
    /VerifyTranslations.java failing after JDK-8252258
    + JDK-8253813: Backout JDK-8244287 from 11u: it causes several
    crashes
- Removed patch:
  * gcc-fno-common-fix.patch
    + not needed any more with this version
- Added patch:
  * JDK-8250861.patch
    + Fix regression "8250861: Crash in MinINode::Ideal(PhaseGVN*,
    bool)" introduced in jdk 11.0.9</changelog>
  <changelog author="fstrba@suse.com" date="1604491200">- Enable Sheandoah GC for x86_64 (jsc#ECO-3171)</changelog>
  <changelog author="fstrba@suse.com" date="1605528000">- Update to upstream tag jdk-11.0.9.1-1
  * Fix:
    + JDK-8250861: Crash in MinINode::Ideal(PhaseGVN*, bool)
- Removed patch:
  * JDK-8250861.patch
    + Integrated upstream</changelog>
  <changelog author="fstrba@suse.com" date="1611230400">- Update to upstream tag jdk-11.0.10+9 (January 2021 CPU,
  bsc#1181239)
  * Security fixes
    + JDK-8247619: Improve Direct Buffering of Characters
  * Other changes
    + JDK-6722928: Support SSPI as a native GSS-API provider
    + JDK-7185258: [macosx] Deadlock in SunToolKit.realSync()
    + JDK-8152332: [macosx] JFileChooser cannot be serialized on
    Mac OS X
    + JDK-8161684: [testconf] Add VerifyOops' testing into compiler
    tiers
    + JDK-8171279: Support X25519 and X448 in TLS
    + JDK-8173361: various crashes in
    JvmtiExport::post_compiled_method_load
    + JDK-8173658: JvmtiExport::post_class_unload() is broken for
    non-JavaThread initiators
    + JDK-8191006: hsdis disassembler plugin does not compile with
    binutils 2.29+
    + JDK-8197981: Missing return statement in
    __sync_val_compare_and_swap_8
    + JDK-8198334: java/awt/FileDialog/8003399/bug8003399.java
    fails in headless mode
    + JDK-8200151: Add 8 JNDI tests to com/sun/jndi/dns/ConfigTests/
    + JDK-8208279: Add 8 JNDI tests to com/sun/jndi/dns/EnvTests/
    + JDK-8208483: Add 5 JNDI tests to
    com/sun/jndi/dns/FactoryTests/
    + JDK-8208542: Add 4 JNDI tests to com/sun/jndi/dns/ListTests/
    + JDK-8208665: Amend cross-compilation docs with
    qemu-debootstrap recipe
    + JDK-8210088: ProblemList gc/epsilon/TestMemoryMXBeans.java
    + JDK-8210339: Add 10 JNDI tests to com/sun/jndi/dns/FedTests/
    + JDK-8211450: UndetVar::dup is not copying the kind field to
    the duplicated instance
    + JDK-8212160: JVMTI agent crashes with "assert(_value != 0LL)
    failed: resolving NULL _value"
    + JDK-8212226: SurfaceManager throws "Invalid Image variant"
    for MultiResolutionImage (Windows)
    + JDK-8213400: Support choosing group name in keytool keypair
    generation
    + JDK-8213535: Windows HiDPI html lightweight tooltips are
    truncated
    + JDK-8213698: Improve devkit creation and add support for
    linux/ppc64/ppc64le/s390x
    + JDK-8214025: assert(t-&gt;singleton()) failed: must be a
    constant when ScavengeRootsInCode &lt; 2
    + JDK-8214242: compiler/arguments/TestScavengeRootsInCode.java
    fails because of missing UnlockDiagnosticVMOptions
    + JDK-8214787: Zero builds fail with "undefined
    JavaThread::thread_state()"
    + JDK-8215583: Exclude
    runtime/handshake/HandshakeWalkSuspendExitTest.java
    + JDK-8216012: Infinite loop in RSA KeyPairGenerator
    + JDK-8216324: GetClassMethods is confused by the presence of
    default methods in super interfaces
    + JDK-8217429: WebSocket over authenticating proxy fails to
    send Upgrade headers
    + JDK-8217976: test/jdk/java/net/httpclient/websocket/
    /WebSocketProxyTest.java fails intermittently
    + JDK-8218021: Have jarsigner preserve posix permission
    attributes
    + JDK-8218287: jshell tool: input behavior unstable after
    12-ea+24 on Windows
    + JDK-8218851: JVM crash in custom classloader stress test, JDK
    12 &amp; 13
    + JDK-8220420: Cleanup c1_LinearScan
    + JDK-8222072: JVMTI GenerateEvents() sends CompiledMethodLoad
    events to wrong jvmtiEnv
    + JDK-8222286: Fix for JDK-8213419 is broken on s390
    + JDK-8222527: HttpClient doesn't send HOST header when
    tunelling HTTP/1.1 through http proxy
    + JDK-8222533: jtreg test jdk/internal/platform/cgroup/
    /TestCgroupMetrics.java fails on SLES12.3 linux ppc64le
    machine
    + JDK-8224506: [TESTBUG] TestDockerMemoryMetrics.java fails
    with exitValue = 137
    + JDK-8224555: vmTestbase/nsk/jvmti/scenarios/contention/TC02/
    /tc02t001/TestDescription.java failed
    + JDK-8224650: Add tests to support X25519 and X448 in TLS
    + JDK-8225072: Add LuxTrust certificate that is expiring in
    March 2021 to list of allowed but expired certs
    + JDK-8225329: -XX:+PrintBiasedLockingStatistics causes crash
    during initialization on Windows platforms
    + JDK-8225687: Newly added sspi.cpp in JDK-6722928 still
    contains some small errors
    + JDK-8227006: [linux] Runtime.availableProcessors execution
    time increased by factor of 100
    + JDK-8227275: Within native OOM error handling, assertions may
    hang the process
    + JDK-8227647: [Graal] Test8009761.java fails due to
    "RuntimeException: static java.lang.Object
    compiler.uncommontrap.Test8009761.m3(boolean,boolean) not
    compiled"
    + JDK-8229495: SIGILL in C2 generated OSR compilation
    + JDK-8230910: libsspi_bridge does not build on Windows 32bit
    + JDK-8232114: JVM crashed at imjpapi.dll in native code
    + JDK-8234147: Avoid looking up standard charsets in core
    libraries
    + JDK-8234393: [macos] printing ignores printer tray
    + JDK-8234863: Increase default value of MaxInlineLevel
    + JDK-8235218: Minimal VM is broken after JDK-8173361
    + JDK-8235456: Minimal VM is broken after JDK-8212160
    + JDK-8235829: graal crashes with Zombie.java test
    + JDK-8236124: Minimal VM slowdebug build failed after
    JDK-8212160
    + JDK-8236512: PKCS11 Connection closed after Cipher.doFinal
    and NoPadding
    + JDK-8236944: The legVecZ operand should be limited to
    zmm0-zmm15 registers
    + JDK-8237186: Fix typo in copyright header of
    java/io/Reader/TransferTo.java
    + JDK-8237499: JFR: Include stack trace in the ThreadStart event
    + JDK-8237512: AArch64: aarch64TestHook leaks a BufferBlob
    + JDK-8237524: AArch64: String.compareTo() may return incorrect
    result
    + JDK-8237950: C2 compilation fails with "Live Node limit
    exceeded limit" during ConvI2L::Ideal optimization
    + JDK-8238579: HttpsURLConnection drops the timeout and hangs
    forever in read
    + JDK-8239105: Add exception for expiring Digicert root
    certificates to VerifyCACerts test
    + JDK-8239477: jdk/jfr/jcmd/TestJcmdStartStopDefault.java fails
  - XX:+VerifyOops with "verify_oop: rsi: broken oop"
    + JDK-8239497: SEGV in EdgeUtils::field_name_symbol(Edge const&amp;)
    + JDK-8239886: Minimal VM build fails after JDK-8237499
    + JDK-8240633: Memory leaks in the implementations of
    FileChooserUI
    + JDK-8240690: Race condition between EDT and
    BasicDirectoryModel.FilesLoader.run0()
    + JDK-8241234: Unify monitor enter/exit runtime entries.
    + JDK-8241311: Move some charset mapping tests from closed to
    open
    + JDK-8241797: Add some tests to the problem list
    + JDK-8242029: AArch64: skip G1 array copy pre-barrier if
    marking not active
    + JDK-8242335: Additional Tests for RSASSA-PSS
    + JDK-8242480: Negative value may be returned by
    getFreeSwapSpaceSize() in the docker
    + JDK-8242614: cleanup duplicated test ldap server in some
    com/sun/jndi/ldap/ tests
    + JDK-8242846: Bring back test/jdk/tools/jlink/plugins/
    /OrderResourcesPluginTest.java
    + JDK-8243114: Implement montgomery{Multiply,Square}intrinsics
    on Windows
    + JDK-8243290: Improve diagnostic messages for class
    verification and redefinition failures
    + JDK-8243488: Add tests for set/get SendBufferSize and
    getReceiveBufferSize in DatagramSocket
    + JDK-8243549: sun/security/ssl/CipherSuite/
    /NamedGroupsWithCipherSuite.java failed with Unsupported
    signature algorithm: DSA
    + JDK-8243617: compiler/onSpinWait/TestOnSpinWaitC1.java test
    uses wrong class
    + JDK-8243619: compiler/codecache/CheckSegmentedCodeCache.java
    test misses -version
    + JDK-8244142: some hotspot/runtime tests don't check exit code
    of forked JVM
    + JDK-8244278: Excessive code cache flushes and sweeps
    + JDK-8244282: test/hotspot/jtreg/compiler/intrinsics/
    /Test8237524.java fails with --illegal-access=deny
    + JDK-8244621: [macos10.15] Garbled FX printing plus CoreText
    warnings on Catalina when building with Xcode 11
    + JDK-8244819: hsdis does not compile with binutils 2.34+
    + JDK-8245051: c1 is broken if it is compiled by gcc without
  - fno-lifetime-dse
    + JDK-8245168: jlink should not be treated as a "small" tool
    + JDK-8245400: Upgrade to LittleCMS 2.11
    + JDK-8246381: VM crashes with "Current BasicObjectLock* below
    than low_mark"
    + JDK-8246434: Threads::print_on_error assumes that the heap
    has been set up
    + JDK-8246648: issue with OperatingSystemImpl
    getFreeSwapSpaceSize in docker after 8242480
    + JDK-8247201: Print potential pointer value of readable stack
    memory in hs_err file
    + JDK-8247763: assert(outer-&gt;outcnt() == 2) failed: 'only phis'
    failure in LoopNode::verify_strip_mined()
    + JDK-8247867: Upgrade to freetype 2.10.2
    + JDK-8248190: Enable Power10 system and implement new
    byte-reverse instructions
    + JDK-8248226: TestCloneAccessStressGCM fails with
  - XX:-ReduceBulkZeroing
    + JDK-8248347: windows build broken by JDK-8243114
    + JDK-8248532: Every time I change keyboard language at my
    MacBook, Java crashes
    + JDK-8248552: C2 crashes with SIGFPE due to division by zero
    + JDK-8248596: [TESTBUG] compiler/loopopts/
    /PartialPeelingUnswitch.java times out with Graal enabled
    + JDK-8248745: Add jarsigner and keytool tests for restricted
    algorithms
    + JDK-8248791: sun/util/resources/cldr/TimeZoneNamesTest.java
    fails with -XX:-ReduceInitialCardMarks -XX:-ReduceBulkZeroing
    + JDK-8248845: AArch64: stack corruption after spilling vector
    register
    + JDK-8249176: Update GlobalSignR6CA test certificates
    + JDK-8249183: JVM crash in "AwtFrame::WmSize" method
    + JDK-8249192: MonitorInfo stores raw oops across safepoints
    + JDK-8249602: C2: assert(cnt == _outcnt) failed: no insertions
    allowed
    + JDK-8249603: C1: assert(has_error == false) failed: register
    allocation invalid
    + JDK-8249605: C2: assert(no_dead_loop) failed: dead loop
    detected
    + JDK-8249607: C2: assert(!had_error) failed: bad dominance
    + JDK-8249608: Vector register used by C2 compiled method
    corrupted at safepoint
    + JDK-8249672: Include microcode revision in features_string on
    x86
    + JDK-8249748: gtest silently ignores bad jvm arguments
    + JDK-8249821: Separate libharfbuzz from libfontmanager
    + JDK-8250598: Hyper-V is detected in spite of running on host
    OS
    + JDK-8250605: Linux x86_32 builds fail after JDK-8249821
    + JDK-8250636: iso8601_time returns incorrect offset part on
    MacOS
    + JDK-8250665: Wrong translation for the month name of May in
    ar_JO,LB,SY
    + JDK-8250772: Test com/sun/jndi/ldap/
    /NamingExceptionMessageTest.java fails intermittently with
    javax.naming.ServiceUnavailableException
    + JDK-8250825: C2 crashes with assert(field != __null) failed:
    missing field
    + JDK-8250894: Provide a configure option to build and run
    against the platform libharfbuzz
    + JDK-8250928: JFR: Improve hash algorithm for stack traces
    + JDK-8250968: Symlinks attributes not preserved when using
    jarsigner on zip files
    + JDK-8250984: Memory Docker tests fail on some Linux kernels
    w/o cgroupv1 swap limit capabilities
    + JDK-8251118: BiasedLocking::preserve_marks should not have a
    HandleMark
    + JDK-8251189: com/sun/jndi/ldap/LdapDnsProviderTest.java
    failed due to timeout
    + JDK-8251257: NMT: jcmd VM.native_memory scale=1 crashes
    target VM
    + JDK-8251365: Build failure on AIX after 8250636
    + JDK-8251397: NPE on ClassValue.ClassValueMap.cacheArray
    + JDK-8251456: [TESTBUG] compiler/vectorization/
    /TestVectorsNotSavedAtSafepoint.java failed OutOfMemoryError
    + JDK-8251458: Parse::do_lookupswitch fails with "assert(_cnt
    &gt;= 0) failed"
    + JDK-8251535: Partial peeling at unsigned test adds incorrect
    loop exit check
    + JDK-8251949: ZGC: Set explicit heap size for
    compiler/gcbarriers tests
    + JDK-8252090: JFR: StreamWriterHost::write_unbuffered() stucks
    in an infinite loop OpenJDK (build 13.0.1+9)
    + JDK-8252415: Bump update version for OpenJDK: jdk-11.0.10
    + JDK-8252470: java/awt/dnd/DisposeFrameOnDragCrash/
    /DisposeFrameOnDragTest.java fails on Windows
    + JDK-8252497: Incorrect numeric currency code for ROL
    + JDK-8252660: Shenandoah: support manageable SoftMaxHeapSize
    option
    + JDK-8252679: Two windows specific FileDIalog tests may fail
    on some Windows_Server_2016_Standard
    + JDK-8252696: Loop unswitching may cause out of bound array
    load to be executed
    + JDK-8252754: Hash code calculation of JfrStackTrace is
    inconsistent
    + JDK-8253219: Epsilon: clean up unnecessary includes
    + JDK-8253224: Shenandoah: ShenandoahStrDedupQueue destructor
    calls virtual num_queues()
    + JDK-8253226: Shenandoah: remove unimplemented
    ShenandoahStrDedupQueue::verify
    + JDK-8253269: The CheckCommonColors test should provide more
    info on failure
    + JDK-8253284: Zero OrderAccess barrier mappings are incorrect
    + JDK-8253375: OSX build fails with Xcode 12.0 (12A7209)
    + JDK-8253778: ShenandoahSafepoint::is_at_shenandoah_safepoint
    should not access VMThread state from other threads
    + JDK-8253791: Issue with useAppleColor check in CSystemColors.m
    + JDK-8254016: Test8237524 fails with -XX:-CompactStrings option
    + JDK-8254081: java/security/cert/PolicyNode/
    /GetPolicyQualifiers.java fails due to an expired certificate
    + JDK-8254144: Non-x86 Zero builds fail with return-type
    warning in os_linux_zero.cpp
    + JDK-8254166: Zero: return-type warning in
    zeroInterpreter_zero.cpp
    + JDK-8254177: (tz) Upgrade time-zone data to tzdata2020b
    + JDK-8254185: Fix Code cache sweeper heuristics for JDK 11
    + JDK-8254190: [s390] interpreter misses exception check after
    calling monitorenter
    + JDK-8254790: SIGSEGV in string_indexof_char and
    stringL_indexof_char intrinsics
    + JDK-8254854: [cgroups v1] Metric limits not properly detected
    on some join controller combinations
    + JDK-8254982: (tz) Upgrade time-zone data to tzdata2020c
    + JDK-8255050: Add pkcs11/KeyStore/ClientAuth.sh to Problem list
    + JDK-8255065: Zero: accessor_entry misses the IRIW case
    + JDK-8255226: (tz) Upgrade time-zone data to tzdata2020d
    + JDK-8255269: Unsigned overflow in g1Policy.cpp
    + JDK-8255365: Problem list failing client manual tests
    + JDK-8255457: Shenandoah: cleanup ShenandoahMarkTask
    + JDK-8255466: C2 crashes at ciObject::get_oop() const+0x0
    + JDK-8255550: x86: Assembler::cmpq(Address dst, Register src)
    encoding is incorrect
    + JDK-8255603: Memory/Performance regression after JDK-8210985
    + JDK-8255760: Shenandoah: match constants style in
    ShenandoahMarkTask fallback
    + JDK-8255781: Bump patch update version for OpenJDK:
    jdk-11.0.9.1
    + JDK-8255937: Better cleanup for
    test/jdk/javax/imageio/stream/StreamFlush.java
    + JDK-8256427: Test com/sun/jndi/dns/ConfigTests/
    /PortUnreachable.java does not work on AIX
    + JDK-8256452: Integrate missing part of JDK-8232370 to 11u
    + JDK-8256483: [TESTBUG] serviceability/jvmti/GetClassMethods/
    /libOverpassMethods.c fails to compile on gcc 4.4.x
    + JDK-8256557: libharfbuzz fails to link on gcc 4.4.x due to
  - Wl,-z,defs
    + JDK-8256618: Zero: Linux x86_32 build still fails
    + JDK-8256736: Zero: GTest tests fail with "unsuppported vm
    variant"
    + JDK-8256809: Annotation processing causes NPE during flow
    analysis
    + JDK-8257181: s390x builds are very noisy with gc-sections
    messages
    + JDK-8257242: [macOS] Java app crashes while switching input
    methods
    + JDK-8257545: SunJSSE FIPS regression in key exchange after
    JDK-8171279 11u backport
    + JDK-8257641: Shenandoah: Query is_at_shenandoah_safepoint()
    from control thread should return false
    + JDK-8257701: Shenandoah: objArrayKlass metadata is not marked
    with chunked arrays
    + JDK-8258630: Add expiry exception for QuoVadis root
    certificate
- New upstream dependency on libharfbuzz
- Regenerated patches: missing-return.patch system-pcsclite.patch</changelog>
  <changelog author="fstrba@suse.com" date="1616155200">- Added patches:
  * system-crypto-policy.patch
    + Let OpenJDK use system crypto policies unless explicitely told
    not to
  * nss-security-provider.patch
    + Add the NSS security provider with configuration in generated
    nss.cfg file
  * keytool-default-rsa.patch
    + Make keytool generate RSA keys by default, since only the
    LEGACY system crypto policy allows DSA</changelog>
  <changelog author="pujos.michael@gmail.com" date="1618488000">- moved mozilla-nss dependency to java-11-openjdk-headless package
  This is necessary to be able to do crypto with just
  java-11-openjdk-headless installed. Fixes boo#1184606</changelog>
  <changelog author="fstrba@suse.com" date="1619006400">- Update to upstream tag jdk-11.0.11+9 (April 2021, CPU)
  * Security fixes
    + JDK-8244473: Contextualize registration for JNDI
    + JDK-8244543: Enhanced handling of abstract classes
    + JDK-8249906, CVE-2021-2163, bsc#1185055: Enhance opening JARs
    + JDK-8250568, CVE-2021-2161, bsc#1185056: Less ambiguous
    processing
    + JDK-8253799: Make lists of normal filenames
    + JDK-8257001: Improve Http Client Support
  * Other changes
    + JDK-7107012: sun.jvm.hotspot.code.CompressedReadStream
    readDouble() conversion to long mishandled
    + JDK-7146776: deadlock between URLStreamHandler.getHostAddress
    and file.Handler.openconnection
    + JDK-8086003: Test fails on OSX with java.lang.RuntimeException
    'Narrow klass base: 0x0000000000000000, Narrow klass shift: 3'
    missing
    + JDK-8168869: jdeps: localized messages don't use proper line
    breaks
    + JDK-8180837: SunPKCS11-NSS tests failing with
    CKR_ATTRIBUTE_READ_ONLY and CKR_MECHANISM_PARAM_INVALID
    + JDK-8202343: Disable TLS 1.0 and 1.1
    + JDK-8205992: jhsdb cannot attach to Java processes running in
    Docker containers
    + JDK-8209193: Fix aarch64-linux compilation after -Wreorder
    changes
    + JDK-8210413: AArch64: Optimize div/rem by constant in C1
    + JDK-8210578: AArch64: Invalid encoding for fmlsvs instruction
    + JDK-8211051: jdeps usage of --dot-output doesn't provide
    valid output for modular jar
    + JDK-8211057: Gensrc step CompileProperties generates unstable
    CompilerProperties output
    + JDK-8211150: G1 Full GC not purging code root memory and
    hence causing memory leak
    + JDK-8211825: ModuleLayer.defineModulesWithXXX does not setup
    delegation when module reads automatic module
    + JDK-8212043: Add floating-point Math.min/max intrinsics
    + JDK-8212218: [TESTBUG] runtime/ErrorHandling/
    /TestHeapDumpOnOutOfMemoryErrorInMetaspace.java timed out
    + JDK-8213116: javax/swing/JComboBox/WindowsComboBoxSize/
    /WindowsComboBoxSizeTest.java fails in Windows
    + JDK-8213909: jdeps --print-module-deps should report missing
    dependences
    + JDK-8214180: Need better granularity for sleeping
    + JDK-8214223: tools/jdeps/listdeps/ListModuleDeps.java failed
    due to missing Lib2 file
    + JDK-8214230: Classes generated by SystemModulesPlugin.java
    are not reproducable
    + JDK-8214741: docs/index.html has no title or copyright
    + JDK-8215687: [Graal] unit test CheckGraalIntrinsics failed
    after 8212043
    + JDK-8217848: [Graal] vmTestbase/nsk/jvmti/ResourceExhausted/
    /resexhausted003/TestDescription.java fails
    + JDK-8218482: sun/security/krb5/auto/ReplayCachePrecise.java
    failed - no KrbException thrown
    + JDK-8218550: Add test omitted from JDK-8212043
    + JDK-8221584: SIGSEGV in os::PlatformEvent::unpark() in
    JvmtiRawMonitor::raw_exit while posting method exit event
    + JDK-8221995: AARCH64: problems with CAS instructions encoding
    + JDK-8222518: Remove unnecessary caching of Parker object in
    java.lang.Thread
    + JDK-8222785: aarch64: add necessary masking for immediate
    shift counts
    + JDK-8223186: HotSpot compile warnings from GCC 9
    + JDK-8225773: jdeps --check produces NPE if there are missing
    module dependences
    + JDK-8225805: Java Access Bridge does not close the logger
    + JDK-8226810: Failed to launch JVM because of
    NullPointerException occured on System.props
    + JDK-8229396: jdeps ignores multi-release when
    generate-module-info used on command line
    + JDK-8229474: Shenandoah: Cleanup CM::update_roots()
    + JDK-8232225: Rework the fix for JDK-8071483
    + JDK-8232905: JFR fails with assertion:
    assert(t-&gt;unflushed_size() == 0) failed: invariant
    + JDK-8233164: C2 fails with assert(phase-&gt;C-&gt;get_alias_index(t)
    == phase-&gt;C-&gt;get_alias_index(t_adr)) failed: correct memory
    chain
    + JDK-8233910: java/awt/ColorClass/AlphaColorTest.java is
    failing  intermittently in nightly lnux-x64 system
    + JDK-8233912: aarch64: minor improvements of atomic operations
    + JDK-8234508: VM_HeapWalkOperation::iterate_over_object reads
    non-strong fields with an on-strong load barrier
    + JDK-8234742: Improve handshake logging
    + JDK-8234796: Refactor Handshake::execute to take a more
    complex type than ThreadClosure
    + JDK-8235324: Dying objects are published from users of
    CollectedHeap::object_iterate
    + JDK-8235351: Lookup::unreflect should bind with the original
    caller independent of Method's accessible flag
    + JDK-8237369: Shenandoah: failed vmTestbase/nsk/jvmti/
    /AttachOnDemand/attach021/TestDescription.java test
    + JDK-8237392: Shenandoah: Remove unreliable assertion
    + JDK-8237483: AArch64 C1 OopMap inserted twice fatal error
    + JDK-8237495: Java MIDI fails with a dereferenced memory error
    when asked to send a raw 0xF7
    + JDK-8239355: (dc) Initial value of SO_SNDBUF should allow
    sending large datagrams (macOS)
    + JDK-8240353: AArch64: missing support for
  - XX:+ExtendedDTraceProbes in C1
    + JDK-8240704: CheckHandles.java failed "AssertionError: Handle
    use increased by more than 10 percent."
    + JDK-8240751: Shenandoah: fold ShenandoahTracer definition
    + JDK-8240795: [REDO] 8238384 CTW: C2 compilation fails with
    "assert(store != load-&gt;find_exact_control(load-&gt;in(0)))
    failed: dependence cycle found"
    + JDK-8241598: Upgrade JLine to 3.14.0
    + JDK-8241649: Optimize Character.toString
    + JDK-8241770: Module xxxAnnotation() methods throw NCDFE if
    module-info.class found as resource in unnamed module
    + JDK-8241911: AArch64: Fix a potential register clash issue in
    reduce_add2I
    + JDK-8242030: Wrong package declarations in jline classes after
    JDK-8241598
    + JDK-8242565: Policy initialization issues when the denyAfter
    constraint is enabled
    + JDK-8243618: compiler/rtm/cli tests can be run w/o WhiteBox
    + JDK-8243670: Unexpected test result caused by C2
    MergeMemNode::Ideal
    + JDK-8244088: [Regression] Switch of Gnome theme ends up in
    deadlocked UI
    + JDK-8244154: Update SunPKCS11 provider with PKCS11 v3.0 header
    files
    + JDK-8244340: Handshake processing thread lacks yielding
    + JDK-8244573: java.lang.ArrayIndexOutOfBoundsException thrown
    for malformed class file
    + JDK-8244683: A TSA server used by tests
    + JDK-8245005: javax/net/ssl/compatibility/BasicConnectTest.java
    failed with No enum constant
    + JDK-8245026: PsAdaptiveSizePolicy::_old_gen_policy_is_ready is
    unused
    + JDK-8245283: JFR: Can't handle constant dynamic used by Jacoco
    agent
    + JDK-8245512: CRC32 optimization using AVX512 instructions
    + JDK-8245527: LDAP Channel Binding support for Java
    GSS/Kerberos
    + JDK-8246707: (sc) SocketChannel.read/write throws
    AsynchronousCloseException on closed channel
    + JDK-8246709: sun/security/tools/jarsigner/
    /TsacertOptionTest.java compilation failed after JDK-8244683
    + JDK-8247200: assert((unsigned)fpargs &lt; 32)
    + JDK-8247766: [aarch64] guarantee(val &lt; (1U &lt;&lt; nbits))
    failed: Field too big for insn.
    + JDK-8248336: AArch64: C2: offset overflow in
    BoxLockNode::emit
    + JDK-8248865: Document JNDI/LDAP timeout properties
    + JDK-8248901: Signed immediate support in
    .../share/assembler.hpp is broken.
    + JDK-8249543: Force DirectBufferAllocTest to run with
  - ExplicitGCInvokesConcurrent
    + JDK-8249588: libwindowsaccessbridge issues on 64bit Windows
    + JDK-8249749: modify a primitive array through a stream and a
    for cycle causes jre crash
    + JDK-8249787: Make TestGCLocker more resilient with concurrent
    GCs
    + JDK-8249867: xml declaration is not followed by a newline
    + JDK-8250911: [windows] os::pd_map_memory() error detection
    broken
    + JDK-8251255: [linux] Add process-memory information to hs-err
    and VM.info
    + JDK-8251359: Shenandoah: filter null oops before calling
    enqueue/SATB barrier
    + JDK-8251925: C2: RenaissanceStressTest fails with
    assert(!had_error): bad dominance
    + JDK-8251944: Add Shenandoah test config to
    compiler/gcbarriers/UnsafeIntrinsicsTest.java
    + JDK-8251992: VM crashed running TestComplexAddrExpr.java test
    with -XX:UseAVX=X
    + JDK-8253220: Epsilon: clean up unused code/declarations
    + JDK-8253274: The CycleDMImagetest brokes the system
    + JDK-8253353: Crash in C2: guarantee(n != NULL) failed: No Node
    + JDK-8253368: TLS connection always receives close_notify
    exception
    + JDK-8253404: C2: assert(C-&gt;live_nodes() &lt;=
    C-&gt;max_node_limit()) failed: Live Node limit exceeded limit
    + JDK-8253409: Double-rounding possibility in float fma
    + JDK-8253476: TestUseContainerSupport.java fails on some Linux
    kernels w/o swap limit capabilities
    + JDK-8253524: C2: Refactor code that clones predicates during
    loop unswitching
    + JDK-8253644: C2: assert(skeleton_predicate_has_opaque(iff))
    failed: unexpected
    + JDK-8253681: closed java/awt/dnd/MouseEventAfterStartDragTest/
    /MouseEventAfterStartDragTest.html test failed
    + JDK-8253702: BigSur version number reported as 10.16, should
    be 11.nn
    + JDK-8253756: C2 CompilerThread0 crash in Node::add_req(Node*)
    + JDK-8254104: MethodCounters must exist before nmethod is
    installed
    + JDK-8254734: "dead loop detected" assert failure with patch
    from 8223051
    + JDK-8254748: Bad Copyright header format after JDK-8212218
    + JDK-8254799: runtime/ErrorHandling/
    /TestHeapDumpOnOutOfMemoryError.java fails with release VMs
    + JDK-8255058: C1: assert(is_virtual()) failed: type check
    + JDK-8255351: Add detection for Graviton 2 CPUs
    + JDK-8255368: Math.exp() gives wrong result for large values on
    x86 32-bit platforms
    + JDK-8255387: Japanese characters were printed upside down on
    AIX
    + JDK-8255401: Shenandoah: Allow oldval and newval registers to
    overlap in cmpxchg_oop()
    + JDK-8255479: [aarch64] assert(src-&gt;section_index_of(target) ==
    CodeBuffer::SECT_NONE) failed: sanity
    + JDK-8255544: Create a checked cast
    + JDK-8255559: Leak File Descriptors Because of
    ResolverLocalFilesystem#engineResolveURI()
    + JDK-8255681: print callstack in error case in
    runAWTLoopWithApp
    + JDK-8255734: VM should ignore SIGXFSZ on ppc64, s390 too
    + JDK-8255742: PrintInlining as compiler directive doesn't print
    virtual calls
    + JDK-8255845: Memory leak in imageFile.cpp
    + JDK-8255880: UI of Swing components is not redrawn after their
    internal state changed
    + JDK-8255908: ExceptionInInitializerError due to
    UncheckedIOException while initializing cgroupv1 subsystem
    + JDK-8256025: AArch64: MachCallRuntimeNode::ret_addr_offset()
    is incorrect for stub calls
    + JDK-8256056: Deoptimization stub doesn't save vector registers
    on x86
    + JDK-8256061: RegisterSaver::save_live_registers() omits upper
    halves of ZMM0-15 registers
    + JDK-8256187: [TEST_BUG] Automate bug4275046.java test
    + JDK-8256220: C1: x86_32 fails with -XX:UseSSE=1 after
    JDK-8210764 due to mishandled lir_neg
    + JDK-8256258: some missing NULL checks or asserts after
    CodeCache::find_blob_unsafe
    + JDK-8256264: Printed GlyphVector outline with low DPI has bad
    quality on Windows
    + JDK-8256290: javac/lambda/T8031967.java fails with
    StackOverflowError on x86_32
    + JDK-8256359: AArch64: runtime/ReservedStack/
    /ReservedStackTestCompiler.java fails
    + JDK-8256387: Unexpected result if patching an entire
    instruction on AArch64
    + JDK-8256421: Add 2 HARICA roots to cacerts truststore
    + JDK-8256488: [aarch64] Use ldpq/stpq instead of ld4/st4 for
    small copies in StubGenerator::copy_memory
    + JDK-8256489: Make gtest for long path names on Windows more
    resilient in the presence of virus scanners
    + JDK-8256501: libTestMainKeyWindow fails to build with Xcode
    12.2
    + JDK-8256633: Fix product build on Windows+Arm64
    + JDK-8256682: JDK-8202343 is incomplete
    + JDK-8256751: Incremental rebuild with precompiled header fails
    when touching a header file
    + JDK-8256757: Incorrect MachCallRuntimeNode::ret_addr_offset()
    for CallLeafNoFP on x86_32
    + JDK-8256806: Shenandoah: optimize shenandoah/jni/
    /TestPinnedGarbage.java test
    + JDK-8256807: C2: Not marking stores correctly as mismatched
    in string opts
    + JDK-8256810: Incremental rebuild broken on Macosx
    + JDK-8256818: SSLSocket that is never bound or connected leaks
    socket resources
    + JDK-8256888: Client manual test problem list update
    + JDK-8257083: Security infra test failures caused by
    JDK-8202343
    + JDK-8257408: Bump update version for OpenJDK: jdk-11.0.11
    + JDK-8257423: [PPC64] Support -XX:-UseInlineCaches
    + JDK-8257436: [aarch64] Regressions in ArrayCopyUnalignedDst
    .testByte/testChar for 65-78 bytes when UseSIMDForMemoryOps
    is on
    + JDK-8257513: C2: assert((constant_addr -
    _masm.code()-&gt;consts()-&gt;start()) == con.offset())
    + JDK-8257547: Handle multiple prereqs on the same line in deps
    files
    + JDK-8257561: Some code is not vectorized after 8251925 and
    8250607
    + JDK-8257565: epsilonBarrierSet.hpp should not include
    barrierSetAssembler
    + JDK-8257575: C2: "failed: only phis" assert failure in loop
    strip mining verification
    + JDK-8257594: C2 compiled checkcast of non-null object triggers
    endless deoptimization/recompilation cycle
    + JDK-8257633: Missing -mmacosx-version-min=X flag when linking
    libjvm
    + JDK-8257670: sun/security/ssl/SSLSocketImpl/SSLSocketLeak.java
    reports leaks
    + JDK-8257707: Fix incorrect format string in Http1HeaderParser
    + JDK-8257746: Regression introduced with JDK-8250984 - memory
    might be null in some machines
    + JDK-8257798: [PPC64] undefined reference to
    Klass::vtable_start_offset()
    + JDK-8257884: Re-enable sun/security/ssl/SSLSocketImpl/
    /SSLSocketLeak.java as automatic test
    + JDK-8257910: [JVMCI] Set exception_seen accordingly in the
    runtime.
    + JDK-8257997: sun/security/ssl/SSLSocketImpl/SSLSocketLeak.java
    again reports leaks after JDK-8257884
    + JDK-8257999: Parallel GC crash in gc/parallel/
    /TestDynShrinkHeap.java: new region is not in covered_region
    + JDK-8258077: Using -Xcheck:jni can lead to a double-free after
    JDK-8193234
    + JDK-8258247: Couple of issues in fix for JDK-8249906
    + JDK-8258373: Update the text handling in the JPasswordField
    + JDK-8258396: SIGILL in jdk.jfr.internal.PlatformRecorder
    .rotateDisk()
    + JDK-8258419: RSA cipher buffer cleanup
    + JDK-8258471: "search codecache" clhsdb command does not work
    + JDK-8258534: Epsilon: clean up unused includes
    + JDK-8258805: Japanese characters not entered by mouse click
    on Windows 10
    + JDK-8258833: Cancel multi-part cipher operations in SunPKCS11
    after failures
    + JDK-8258836: JNI local refs exceed capacity
    getDiagnosticCommandInfo
    + JDK-8258884: [TEST_BUG] Convert applet-based test
    open/test/jdk/javax/swing/JMenuItem/8031573/bug8031573.java
    to a regular java test
    + JDK-8259007: This test printed a blank page
    + JDK-8259048: (tz) Upgrade time-zone data to tzdata2020f
    + JDK-8259049: Uninitialized variable after JDK-8257513
    + JDK-8259231: Epsilon: improve performance under contention
    during virtual space expansion
    + JDK-8259271: gc/parallel/TestDynShrinkHeap.java still fails
    "assert(covered_region.contains(new_memregion)) failed: new
    region is not in covered_region"
    + JDK-8259312: VerifyCACerts.java fails as soneraclass2ca cert
    will expire in 90 days
    + JDK-8259319: Illegal package access when SunPKCS11 requires
    SunJCE's classes
    + JDK-8259339: AllocateUninitializedArray C2 intrinsic fails
    with void.class input
    + JDK-8259428: AlgorithmId.getEncodedParams() should return copy
    + JDK-8259446: runtime/jni/checked/
    /TestCheckedReleaseArrayElements.java fails with stderr not
    empty
    + JDK-8259451: Zero: skip serviceability/sa tests, set vm.hasSA
    to false
    + JDK-8259580: Shenandoah: uninitialized label in
    VerifyThreadGCState
    + JDK-8259619: C1: 3-arg StubAssembler::call_RT stack-use
    condition is incorrect
    + JDK-8259633: compiler/graalunit/CoreTest.java fails with NPE
    after JDK-8244543
    + JDK-8259706: C2 compilation fails with assert(vtable_index ==
    Method::invalid_vtable_index) failed: correct sentinel value
    + JDK-8259707: LDAP channel binding does not work with StartTLS
    extension
    + JDK-8259773: Incorrect encoding of AVX-512 kmovq instruction
    + JDK-8259849: Shenandoah: Rename store-val to IU-barrier
    + JDK-8259949: x86 32-bit build fails when -fcf-protection is
    passed in the compiler flags
    + JDK-8259954: gc/shenandoah/mxbeans tests fail with -Xcomp
    + JDK-8260029: aarch64: fix typo in verify_oop_array
    + JDK-8260308: Update LogCompilation junit to 4.13.1
    + JDK-8260338: Some fields in HaltNode is not cloned
    + JDK-8260349: Cannot programmatically retrieve Metaspace max
    set via JAVA_TOOL_OPTIONS
    + JDK-8260356: (tz) Upgrade time-zone data to tzdata2021a
    + JDK-8260378: [TESTBUG] DcmdMBeanTestCheckJni.java reports
    false positive
    + JDK-8260497: Shenandoah: Improve SATB flushing
    + JDK-8260502: [s390] NativeMovRegMem::verify() fails because
    it's too strict
    + JDK-8260632: Build failures after JDK-8253353
    + JDK-8260704: ParallelGC: oldgen expansion needs release-store
    for _end
    + JDK-8261022: Fix incorrect result of Math.abs() with char type
    + JDK-8261089: [TESTBUG] native library of test
    TestCheckedReleaseCriticalArray.java fails to compile with
    gcc 4.x
    + JDK-8261183: Follow on to Make lists of normal filenames
    + JDK-8261209: isStandalone property: remove dependency on
    pretty-print
    + JDK-8261231: Windows IME was disabled after DnD operation
    + JDK-8261251: Shenandoah: Use object size for full GC
    humongous compaction
    + JDK-8261310: PPC64 Zero build fails with
    'VMError::controlled_crash(int)::FunctionDescriptor
    functionDescriptor' has incomplete type and cannot be defined
    + JDK-8261334: NMT: tuning statistic shows incorrect hash
    distribution
    + JDK-8261413: Shenandoah: Disable class-unloading in I-U mode
    + JDK-8261522: [PPC64] AES intrinsics write beyond the
    destination array
    + JDK-8261534: Test sun/security/pkcs11/KeyAgreement/
    /IllegalPackageAccess.java fails on platforms where no nsslib
    artifacts are defined
    + JDK-8261585: Restore HandleArea used in
    Deoptimization::uncommon_trap
    + JDK-8261753: Test java/lang/System/OsVersionTest.java still
    failing on BigSur patch versions after JDK-8253702
    + JDK-8261829: Exclude tools/jlink/JLinkReproducibleTest.java
    in 11u
    + JDK-8261912: Code IfNode::fold_compares_helper more
    defensively
    + JDK-8261920: [AIX] jshell command throws java.io.IOError on
    non English locales
    + JDK-8262018: Wrong format in SAP copyright header of
    OsVersionTest
    + JDK-8263069: Exclude some failing tests from
    security/infra/java/security/cert/CertPathValidator</changelog>
  <changelog author="fstrba@suse.com" date="1620043200">- Remove all Jpackage provides for SLE12 in order to avoid
  installing this package as default Java on SLE12-SP5
  (bsc#1185476)</changelog>
  <changelog author="fstrba@suse.com" date="1621512000">- Modified patch:
  * nss-security-provider.patch
    + make the NSS provider first in the list</changelog>
  <changelog author="fstrba@suse.com" date="1626868800">- Update to upstream tag jdk-11.0.12+7 (July 2021, CPU)
  * Security fixes
    + JDK-8256157: Improve bytecode assembly
    + JDK-8256491: Better HTTP transport
    + JDK-8258432, CVE-2021-2341, bsc#1188564: Improve file
    transfers
    + JDK-8260453: Improve Font Bounding
    + JDK-8260960: Signs of jarsigner signing
    + JDK-8260967, CVE-2021-2369, bsc#1188565: Better jar file
    validation
    + JDK-8262380: Enhance XML processing passes
    + JDK-8262403: Enhanced data transfer
    + JDK-8262410: Enhanced rules for zones
    + JDK-8262477: Enhance String Conclusions
    + JDK-8262967: Improve Zip file support
    + JDK-8264066, CVE-2021-2388, bsc#1188566: Enhance compiler
    validation
    + JDK-8264079: Improve abstractions
    + JDK-8264460: Improve NTLM support
  * Other changes
    + JDK-6847157: java.lang.NullPointerException: HDC for
    component at sun.java2d.loops.Blit.Blit
    + JDK-7106851: Test should not use System.exit
    + JDK-8073446: TimeZone getOffset API does not  return a dst
    offset between years 2038-2137
    + JDK-8076190: Customizing the generation of a PKCS12 keystore
    + JDK-8153005: Upgrade the default PKCS12 encryption/MAC
    algorithms
    + JDK-8171303: sun/java2d/pipe/InterpolationQualityTest.java
    fails on Windows &amp; Linux
    + JDK-8177068: incomplete classpath causes NPE in Flow
    + JDK-8185734: [Windows] Structured Exception Catcher missing
    around gtest execution
    + JDK-8187450: JNI local refs exceeds capacity warning in
    NetworkInterface::getAll
    + JDK-8190763: Class cast exception on (CompoundEdit)
    UndoableEditEvent.getEdit()
    + JDK-8195841: PNGImageReader.readNullTerminatedString() doesnt
    check for non-null terminated strings with length equal to
    maxLen
    + JDK-8196100: javax/swing/text/JTextComponent/5074573/
    /bug5074573.java fails
    + JDK-8199646: JShell tests: jdk/jshell/
    /FailOverDirectExecutionControlTest.java failed with
    java.lang.UnsupportedOperationException
    + JDK-8206925: Support the certificate_authorities extension
    + JDK-8207160: ClassReader::adjustMethodParams can potentially
    return null if the args list is empty
    + JDK-8207247: AARCH64: Enable Minimal and Client VM builds
    + JDK-8207404: MulticastSocket tests failing on AIX
    + JDK-8207779: Method::is_valid_method() compares 'this' with
    NULL
    + JDK-8208061: runtime/LoadClass/TestResize.java fails with
    "Load factor too high" when running in CDS mode.
    + JDK-8209459: TestSHA512MultiBlockIntrinsics failed on AArch64
    + JDK-8210443: Migrate Locale matching tests to JDK Repo.
    + JDK-8213231: ThreadSnapshot::_threadObj can become stale
    + JDK-8213483: ARM32: runtime/ErrorHandling/
    /ShowRegistersOnAssertTest.java jtreg test fail
    + JDK-8213725: JShell NullPointerException due to class file
    with unexpected package
    + JDK-8213794: ARM32: disable TypeProfiling,
    CriticalJNINatives, Serviceablity tests for ARM32
    + JDK-8213845: ARM32: Interpreter doesn't call result handler
    after native calls
    + JDK-8214128: ARM32: wrong stack alignment on
    Deoptimization::unpack_frames
    + JDK-8214512: ARM32: Jtreg test compiler/c2/Test8062950.java
    fails on ARM
    + JDK-8214854: JDWP: Unforseen output truncation in logging
    + JDK-8214922: Add vectorization support for fmin/fmax
    + JDK-8215009: GCC 8 compilation error in libjli
    + JDK-8216184: CDS/appCDS tests failed on Windows due to long
    path to a classlist file
    + JDK-8216259: AArch64: Vectorize Adler32 intrinsics
    + JDK-8216314: SIGILL in CodeHeapState::print_names()
    + JDK-8217348: assert(thread-&gt;is_Java_thread()) failed: just
    checking
    + JDK-8217465: [REDO] - Optimize CodeHeap Analytics
    + JDK-8217561: X86: Add floating-point Math.min/max intrinsics
    + JDK-8217918: C2: -XX:+AggressiveUnboxing is broken
    + JDK-8218458: [TESTBUG] runtime/NMT/
    /CheckForProperDetailStackTrace.java fails with Expected
    stack trace missing from output
    + JDK-8219142: Remove unused JIMAGE_ResourcePath
    + JDK-8219586: CodeHeap State Analytics processes dead nmethods
    + JDK-8220074: Clean up GCC 8.3 errors in LittleCMS
    + JDK-8220407: compiler/intrinsics/math/
    /TestFpMinMaxIntrinsics.java timedout
    + JDK-8222302: [TESTBUG] test/hotspot/jtreg/compiler/intrinsics/
    /sha/cli/TestUseSHAOptionOnUnsupportedCPU.java fails on any
    other CPU
    + JDK-8222412: AARCH64: multiple instructions encoding issues
    + JDK-8223020: aarch64: expand minI_rReg and maxI_rReg patterns
    into separate instructions
    + JDK-8223444: Improve CodeHeap Free Space Management
    + JDK-8223504: Improve performance of forall loops by better
    inlining of "iterator()" methods
    + JDK-8223667: ASAN build broken
    + JDK-8225081: Remove Telia Company CA certificate expiring in
    April 2021
    + JDK-8225116: Test OwnedWindowsLeak.java intermittently fails
    + JDK-8225438: javax/net/ssl/TLSCommon/
    /TestSessionLocalPrincipal.java failed with Read timed out
    + JDK-8225756: [testbug] compiler/loopstripmining/
    /CheckLoopStripMining.java sets too short a
    SafepointTimeoutDelay
    + JDK-8226374: Restrict TLS signature schemes and named groups
    + JDK-8226627: assert(t-&gt;singleton()) failed: must be a constant
    + JDK-8226721: Missing intrinsics for Math.ceil, floor, rint
    + JDK-8227080: (fs) Files.newInputStream(...).skip(n) is slow
    + JDK-8227222: vmTestbase/jit/FloatingPoint/gen_math/Loops04/
    /Loops04.java failed XMM register should be 0-15
    + JDK-8227609: (fs) Files.newInputStream(...).skip(n) should
    allow skipping beyond file size
    + JDK-8230428: Cleanup dead CastIP node code in formssel.cpp
    + JDK-8231460: Performance issue (CodeHeap) with large free
    blocks
    + JDK-8231713: x86_32 build failures after JDK-8226721 (Missing
    intrinsics for Math.ceil, floor, rint)
    + JDK-8231841: AArch64: debug.cpp help() is missing an AArch64
    line for pns
    + JDK-8232084: HotSpot build failed with GCC 9.2.1
    + JDK-8232591: AArch64: Add missing match rules for smaddl,
    smsubl and smnegl
    + JDK-8233185: HttpServer.stop() blocks indefinitely when
    called on dispatch thread
    + JDK-8233787: Break cycle in vm_version* includes
    + JDK-8233948: AArch64: Incorrect mapping between OptoReg and
    VMReg for high 64 bits of Vector Register
    + JDK-8234355: Buffer overflow in jcmd GC.class_stats due to
    too many classes
    + JDK-8235368: Update BCEL to Version 6.4.1
    + JDK-8236859: WebSocket over authenticating proxy fails with
    NPE
    + JDK-8236992: AArch64: remove redundant load_klass in itable
    stub
    + JDK-8237743: test/langtools/jdk/jshell/
    /FailOverExecutionControlTest.java fails No
    ExecutionControlProvider with name 'nonExistent' and parameter
    keys: []
    + JDK-8237804: sun/security/mscapi tests fail with "Key pair
    not generated, alias &lt;nnnnnn&gt; already exists"
    + JDK-8238175: CTW: Class.getDeclaredMethods fails with
    assert(k-&gt;is_subclass_of(SystemDictionary::Throwable_klass()))
    failed: invalid exception class
    + JDK-8238567: SoftMainMixer.processAudioBuffers(): Wrong
    handling of stoppedMixers
    + JDK-8238812: assert(false) failed: bad AD file
    + JDK-8239312: [macos] javax/swing/JFrame/NSTexturedJFrame/
    /NSTexturedJFrame.java
    + JDK-8239386: handle ContendedPaddingWidth in
    vm_version_aarch64
    + JDK-8239536: Can't use 'java.util.List' object after
    importing 'java.awt.List'
    + JDK-8240487: Cleanup whitespace in .cc, .hh, .m, and .mm files
    + JDK-8240848: ArrayIndexOutOfBoundsException buf for
    TextCallbackHandler
    + JDK-8241082: Upgrade IANA Language Subtag Registry data to
    03-16-2020 version
    + JDK-8241087: Build failure with VS 2019 (16.5.0) due to C2039
    and C2873
    + JDK-8241101: [s390] jtreg test failure after JDK-8238696: not
    conformant features string
    + JDK-8241248: NullPointerException in
    sun.security.ssl.HKDF.extract(HKDF.java:93)
    + JDK-8241372: Several test failures due to
    javax.net.ssl.SSLException: Connection reset
    + JDK-8241475: AArch64: Add missing support for PopCountVI node
    + JDK-8241829: Cleanup the code for PrinterJob on windows
    + JDK-8241960: The SHA3 message digests impl of SUN provider
    are not thread safe after cloned
    + JDK-8242010: Upgrade IANA Language Subtag Registry to Version
    2020-04-01
    + JDK-8242429: Better implementation for sign extract
    + JDK-8242557: Add length limit for strings in PNGImageWriter
    + JDK-8242919: Paste locks up jshell
    + JDK-8243155: AArch64: Add support for SqrtVF
    + JDK-8243240: AArch64: Add support for MulVB
    + JDK-8243452: JFR: Could not create chunk in repository with
    over 200 recordings
    + JDK-8243559: Remove root certificates with 1024-bit keys
    + JDK-8243597: AArch64: Add support for integer vector abs
    + JDK-8244031: HttpClient should have more tests for HEAD
    requests
    + JDK-8244205: HTTP/2 tunnel connections through proxy may be
    reused regardless of which proxy is selected
    + JDK-8244847: Linux/PPC: runtime/CompressedOops/
    /CompressedClassPointers: smallHeapTest fails
    + JDK-8245511: G1 adaptive IHOP does not account for
    reclamation of humongous objects by young GC
    + JDK-8246274: G1 old gen allocation tracking is not in a
    separate class
    + JDK-8247354: [aarch64] PopFrame causes
    assert(oopDesc::is_oop(obj)) failed: not an oop
    + JDK-8247408: IdealGraph bit check expression canonicalization
    + JDK-8247432: Update IANA Language Subtag Registry to Version
    2020-09-29
    + JDK-8247438: JShell: When FailOverExecutionControlProvider
    fails the proximal cause is not shown
    + JDK-8247753: UIManager.getSytemLookAndFeelClassName() returns
    wrong value on Fedora 32
    + JDK-8248043: Need to eliminate excessive i2l conversions
    + JDK-8248411: [aarch64] Insufficient error handling when
    CodeBuffer is exhausted
    + JDK-8248568: compiler/c2/TestBit.java failed: test missing
    from stdout/stderr
    + JDK-8248870: AARCH64: I2L/L2I conversions can be skipped for
    masked positive values
    + JDK-8249142: java/awt/FontClass/CreateFont/DeleteFont.sh is
    unstable
    + JDK-8249189: AARCH64: more L2I conversions can be skipped
    + JDK-8249719: MethodHandle performance suffers from bad
    ResolvedMethodTable hash function
    + JDK-8249875: GCC 10 warnings -Wtype-limits with JFR code
    + JDK-8250635: MethodArityHistogram should use Compile_lock in
    favour of fancy checks
    + JDK-8250876: Fix issues with cross-compile on macos
    + JDK-8251031: Some vmTestbase/nsk/monitoring/RuntimeMXBean
    tests fail with hostnames starting from digits
    + JDK-8251525: AARCH64: Faster Math.signum(fp)
    + JDK-8252259: AArch64: Adjust default value of FLOATPRESSURE
    + JDK-8252311: AArch64: save two words in itable lookup stub
    + JDK-8252779: compiler/graalunit/HotspotTest.java failed after
    8251525
    + JDK-8252883: AccessDeniedException caused by delayed file
    deletion on Windows
    + JDK-8253167: ARM32 builds fail after JDK-8247910
    + JDK-8253572: [windows] CDS archive may fail to open with long
    file names
    + JDK-8253923: C2 doesn't always run loop opts for compilations
    that include loops
    + JDK-8253948: Memory leak in ImageFileReader
    + JDK-8254631: Better support ALPN byte wire values in SunJSSE
    + JDK-8254717: isAssignableFrom checks in
    KeyFactorySpi.engineGetKeySpec appear to be backwards
    + JDK-8255086: Update the root locale display names
    + JDK-8255625: AArch64: Implement Base64.encodeBlock
    accelerator/intrinsic
    + JDK-8255763: C2: OSR miscompilation caused by invalid memory
    instruction placement
    + JDK-8255992: JFR EventWriter does not use first string from
    StringPool with id 0
    + JDK-8256037: [TESTBUG] com/sun/jndi/dns/ConfigTests/
    /PortUnreachable.java fails due to the hard coded threshold
    is small
    + JDK-8256244: java/lang/ProcessHandle/PermissionTest.java
    fails with TestNG 7.1
    + JDK-8256287: [windows] add loop fuse to
    map_or_reserve_memory_aligned
    + JDK-8256523: Streamline Java SHA2 implementation
    + JDK-8257414: Drag n Drop target area is wrong on high DPI
    systems
    + JDK-8257569: Failure observed with
    JfrVirtualMemory::initialize
    + JDK-8257574: C2: "failed: parsing found no loops but there
    are some" assert failure
    + JDK-8257580: Bump update version for OpenJDK: jdk-11.0.12
    + JDK-8257604: JNI_ArgumentPusherVaArg leaks valist
    + JDK-8257621: JFR StringPool misses cached items across
    consecutive recordings
    + JDK-8257796: [TESTBUG]
    TestUseSHA512IntrinsicsOptionOnSupportedCPU.java fails
    on x86_32
    + JDK-8257822: C2 crashes with SIGFPE due to a division that
    floats above its zero check
    + JDK-8257828: SafeFetch may crash if invoked in non-JavaThreads
    + JDK-8257853: Remove dependencies on JNF's JNI utility
    functions in AWT and 2D code
    + JDK-8257858: [macOS]: Remove JNF dependency from
    libosxsecurity/KeystoreImpl.m
    + JDK-8257860: [macOS]: Remove JNF dependency from
    libosxkrb5/SCDynamicStoreConfig.m
    + JDK-8257988: Remove JNF dependency from
    libsaproc/MacosxDebuggerLocal.m
    + JDK-8258414: OldObjectSample events too expensive
    + JDK-8258505: [TESTBUG] TestDivZeroWithSplitIf.java fails due
    to missing UnlockDiagnosticVMOptions
    + JDK-8258753: StartTlsResponse.close() hangs due to
    synchronization issues
    + JDK-8259061: C2: assert(found) failed: memory-writing node is
    not placed in its original loop or an ancestor of it
    + JDK-8259227: C2 crashes with SIGFPE due to a division that
    floats above its zero check
    + JDK-8259232: Bad JNI lookup during printing
    + JDK-8259276: C2: Empty expression stack when reexecuting
    tableswitch/lookupswitch instructions after deoptimization
    + JDK-8259343: [macOS] Update JNI error handling in Cocoa code.
    + JDK-8259585: Accessible actions do not work on mac os x
    + JDK-8259651: [macOS] Replace JNF_COCOA_ENTER/EXIT macros
    + JDK-8259662: Don't wrap SocketExceptions into SSLExceptions
    in SSLSocketImpl
    + JDK-8259710: Inlining trace leaks memory
    + JDK-8259729: Missed JNFInstanceOf -&gt; IsInstanceOf conversion
    + JDK-8259777: Incorrect predication condition generated by ADLC
    + JDK-8259786: initialize last parameter of getpwuid_r
    + JDK-8259843: initialize dli_fname array before calling
    dll_address_to_library_name
    + JDK-8259869: [macOS] Remove desktop module dependencies on
    JNF Reference APIs
    + JDK-8259886: Improve SSL session cache performance and
    scalability
    + JDK-8259983: do not use uninitialized expand_ms value in
    G1CollectedHeap::expand_heap_after_young_collection
    + JDK-8260030: Improve stringStream buffer handling
    + JDK-8260236: better init AnnotationCollector _contended_group
    + JDK-8260255: C1: LoopInvariantCodeMotion constructor can
    leave some fields uninitialized
    + JDK-8260284: C2: assert(_base == Int) failed: Not an Int
    + JDK-8260380: Upgrade to LittleCMS 2.12
    + JDK-8260420: C2 compilation fails with assert(found_sfpt)
    failed: no node in loop that's not input to safepoint
    + JDK-8260426: awt debug_mem.c DMem_AllocateBlock might leak
    memory
    + JDK-8260432: allocateSpaceForGP in freetypeScaler.c might
    leak memory
    + JDK-8260616: Removing remaining JNF dependencies in the
    java.desktop module
    + JDK-8260653: Unreachable nodes keep speculative types alive
    + JDK-8260707: java/lang/instrument/PremainClass/
    /InheritAgent0100.java times out
    + JDK-8260925: HttpsURLConnection does not work  with other
    JSSE provider.
    + JDK-8260926: Trace resource exhausted events unconditionally
    + JDK-8261020: Wrong format parameter in
    create_emergency_chunk_path
    + JDK-8261027: AArch64: Support for LSE atomics C++ HotSpot code
    + JDK-8261167: print_process_memory_info add a close call after
    fopen
    + JDK-8261170: Upgrade to freetype 2.10.4
    + JDK-8261198: [macOS] Incorrect JNI parameters in number
    conversion in A11Y code
    + JDK-8261235: C1 compilation fails with
    assert(res-&gt;vreg_number() == index) failed: conversion check
    + JDK-8261261: The version extra fields needs to be overridable
    in jib-profiles.js
    + JDK-8261262: Kitchensink24HStress.java crashed with
    EXCEPTION_ACCESS_VIOLATION
    + JDK-8261354: SIGSEGV at MethodIteratorHost
    + JDK-8261355: No data buffering in SunPKCS11 Cipher encryption
    when the underlying mechanism has no padding
    + JDK-8261397: try catch Method failing to work when dividing
    an integer by 0
    + JDK-8261422: Adjust problematic String.format calls in
    jdk/internal/util/Preconditions.java outOfBoundsMessage
    + JDK-8261447: MethodInvocationCounters frequently run into
    overflow
    + JDK-8261481: Cannot read Kerberos settings in dynamic store
    on macOS Big Sur
    + JDK-8261505: Test test/hotspot/jtreg/gc/parallel/
    /TestDynShrinkHeap.java killed by Linux OOM Killer
    + JDK-8261601: free memory in early return in
    Java_sun_nio_ch_sctp_SctpChannelImpl_receive0
    + JDK-8261649: AArch64: Optimize LSE atomics in C++ code
    + JDK-8261730: C2 compilation fails with
    assert(store-&gt;find_edge(load) != -1) failed: missing
    precedence edge
    + JDK-8261752: Multiple GC test are missing memory requirements
    + JDK-8261791: (sctp) handleSendFailed in SctpChannelImpl.c
    potential leaks
    + JDK-8261812: C2 compilation fails with assert(!had_error)
    failed: bad dominance
    + JDK-8261914: IfNode::fold_compares_helper faces
    non-canonicalized bool when running JRuby JSON workload
    + JDK-8262093: java/util/concurrent/tck/JSR166TestCase.java
    failed "assert(false) failed: unexpected node"
    + JDK-8262110: DST starts from incorrect time in 2038
    + JDK-8262121: [11u] Redo 8244287: JFR: Methods samples have
    line number 0
    + JDK-8262163: Extend settings printout in jcmd VM.metaspace
    + JDK-8262295: C2: Out-of-Bounds Array Load from Clone Source
    + JDK-8262298: G1BarrierSetC2::step_over_gc_barrier fails with
    assert "bad barrier shape"
    + JDK-8262446: DragAndDrop hangs on Windows
    + JDK-8262461: handle wcstombsdmp return value correctly in
    unix awt_InputMethod.c
    + JDK-8262465: Very long compilation times and high memory
    consumption in C2 debug builds
    + JDK-8262726: AArch64: C1 StubAssembler::call_RT can corrupt
    stack
    + JDK-8262739: String inflation C2 intrinsic prevents insertion
    of anti-dependencies
    + JDK-8262829: Native crash in
    Win32PrintServiceLookup.getAllPrinterNames()
    + JDK-8262837: handle split_USE correctly
    + JDK-8262900: ToolBasicTest fails to access HTTP server it
    starts
    + JDK-8263260: [s390] Support latest hardware (z14 and z15)
    + JDK-8263311: Watch registry changes for remote printers
    update instead of polling
    + JDK-8263361: Incorrect arraycopy stub selected by C2 for SATB
    collectors
    + JDK-8263404: RsaPrivateKeySpec is always recognized as
    RSAPrivateCrtKeySpec in RSAKeyFactory.engineGetKeySpec
    + JDK-8263425: AArch64: two potential bugs in C1
    LIRGenerator::generate_address()
    + JDK-8263448: CTW: fatal error: meet not symmetric
    + JDK-8263504: Some OutputMachOpcodes fields are uninitialized
    + JDK-8263557: Possible NULL dereference in
    Arena::destruct_contents()
    + JDK-8263558: Possible NULL dereference in fast path arena
    free if ZapResourceArea is true
    + JDK-8263676: AArch64: one potential bug in C1
    LIRGenerator::generate_address()
    + JDK-8263729: [test] divert spurious output away from stream
    under test in ProcessBuilder Basic test
    + JDK-8263846: Bad JNI lookup getFocusOwner in accessibility
    code on Mac OS X
    + JDK-8264047: Duplicate global variable 'jvm' in libjavajpeg
    and libawt
    + JDK-8264096: slowdebug jvm crashes when StrInflatedCopy match
    rule is not supported
    + JDK-8264151: ciMethod::ensure_method_data() should return
    false is loading resulted in empty state
    + JDK-8264173: [s390] Improve Hardware Feature Detection And
    Reporting
    + JDK-8264190: Harden TLS interop tests
    + JDK-8264223: CodeHeap::verify fails extra_hops assertion in
    fastdebug test
    + JDK-8264328: Broken license in
    javax/swing/JComboBox/8072767/bug8072767.java
    + JDK-8264360: Loop strip mining verification fails with
    "should be on the backedge"
    + JDK-8264626: C1 should be able to inline excluded methods
    + JDK-8264640: CMS ParScanClosure misses a barrier
    + JDK-8264786: [macos] All Swing/AWT apps cause Allow
    Notifications prompt to appear when app is launched
    + JDK-8264821: DirectIOTest fails on a system with large block
    size
    + JDK-8264848: [macos] libjvm.dylib linker warning due to macOS
    version mismatch
    + JDK-8264923: PNGImageWriter.write_zTXt throws Exception with
    a typo
    + JDK-8264958: C2 compilation fails with assert "n is later
    than its clone"
    + JDK-8265099: Revert backport to 11u of 8236859: WebSocket
    over authenticating proxy fails with NPE
    + JDK-8265154: vinserti128 operand mix up for KNL platforms
    + JDK-8265239: Shenandoah: Shenandoah heap region count could
    be off by 1
    + JDK-8265417: Backport of JDK-8249672 breaks Solaris x86 build
    + JDK-8265421: java/lang/String/StringRepeat.java test is
    missing a memory requirement
    + JDK-8265462: Handle multiple slots in the NSS Internal Module
    from SunPKCS11's Secmod
    + JDK-8265537: x86 version string truncated after JDK-8249672
    11u backport
    + JDK-8265666: Enable AIX build platform to make external debug
    symbols
    + JDK-8265677: CMS: CardTableBarrierSet::write_ref_array_work()
    lacks storestore barrier
    + JDK-8265690: Use the latest Ubuntu base image version in
    Docker testing
    + JDK-8265718: Build failure after JDK-8258414 11u backport
    + JDK-8265750: Fatal error in safepoint.cpp after backport of
    8258414
    + JDK-8265784: [C2] Hoisting of DecodeN leaves MachTemp inputs
    behind
    + JDK-8265938: C2's conditional move optimization does not
    handle top Phi
    + JDK-8266220: keytool still prompt for store password on a
    password-less pkcs12 file if -storetype pkcs12 is specified
    + JDK-8266293: Key protection using PBEWithMD5AndDES fails with
    "java.security.InvalidAlgorithmParameterException: Salt must
    be 8 bytes long"
    + JDK-8266713: [AIX] Build failure after 11u backport of
    JDK-8247753
    + JDK-8266802: Shenandoah: Round up region size to page size
    unconditionally
    + JDK-8266892: avoid maybe-uninitialized gcc warnings on linux
    s390x
    + JDK-8266929: Unable to use algorithms from 3p providers
    + JDK-8267235: [macos_aarch64]
    InterpreterRuntime::throw_pending_exception messing up LR
    results in crash
    + JDK-8267561: Shenandoah: Reference processing not properly
    setup for outside of cycle degenerated GC
    + JDK-8267599: Revert the change to the default PKCS12
    macAlgorithm and macIterationCount props for 11u/8u/7u
    + JDK-8267641: [11u] 8227609 backport typo
    + JDK-8267721: Enable sun/security/pkcs11 tests for Amazon
    Linux 2 AArch64
    + JDK-8268678: LetsEncryptCA.java test fails as Let's Encrypt
    Authority X3 is retired</changelog>
  <changelog author="schwab@suse.de" date="1628078400">- riscv64-zero.patch: Add support for riscv64 (zero VM)</changelog>
  <changelog author="fstrba@suse.com" date="1629979200">- Added patch:
  * jdk11-glibc234.patch
    + fix build with glibc-2.34 (bsc#1189201)</changelog>
  <changelog author="fstrba@suse.com" date="1631534400">- Modified patch:
  * nss-security-provider.patch
    + revert recent changes making NSS provider the default one
    + fixes bsc#1190252</changelog>
  <changelog author="fstrba@suse.com" date="1631793600">- Added patch:
  * fips.patch
    + implement FIPS support in OpenJDK</changelog>
  <changelog author="fstrba@suse.com" date="1634817600">- Update to upstream tag jdk-11.0.13+8 (October 2021 CPU)
  * Security fixes
    + JDK-8163326, CVE-2021-35550, bsc#1191901: Update the default
    enabled cipher suites preference
    + JDK-8254967, CVE-2021-35565, bsc#1191909:
    com.sun.net.HttpsServer spins on TLS session close
    + JDK-8263314: Enhance XML Dsig modes
    + JDK-8265167, CVE-2021-35556, bsc#1191910: Richer Text Editors
    + JDK-8265574: Improve handling of sheets
    + JDK-8265580, CVE-2021-35559, bsc#1191911: Enhanced style for
    RTF kit
    + JDK-8265776: Improve Stream handling for SSL
    + JDK-8266097, CVE-2021-35561, bsc#1191912: Better hashing
    support
    + JDK-8266103: Better specified spec values
    + JDK-8266109: More Resilient Classloading
    + JDK-8266115: More Manifest Jar Loading
    + JDK-8266137, CVE-2021-35564, bsc#1191913: Improve Keystore
    integrity
    + JDK-8266689, CVE-2021-35567, bsc#1191903: More Constrained
    Delegation
    + JDK-8267086: ArrayIndexOutOfBoundsException in
    java.security.KeyFactory.generatePublic
    + JDK-8267712: Better LDAP reference processing
    + JDK-8267729, CVE-2021-35578, bsc#1191904: Improve TLS client
    handshaking
    + JDK-8267735, CVE-2021-35586, bsc#1191914: Better BMP support
    + JDK-8268193: Improve requests of certificates
    + JDK-8268199: Correct certificate requests
    + JDK-8268205: Enhance DTLS client handshake
    + JDK-8268506: More Manifest Digests
    + JDK-8269618, CVE-2021-35603, bsc#1191906: Better session
    identification
    + JDK-8269624: Enhance method selection support
    + JDK-8270398: Enhance canonicalization
    + JDK-8270404: Better canonicalization
  * Other changes
    + JDK-8024368: private methods are allocated vtable indices
    + JDK-8042902: Test java/net/Inet6Address/serialize/
    /Inet6AddressSerializationTest.java fails intermittently
    + JDK-8140466: ChaCha20 and Poly1305 TLS Cipher Suites
    + JDK-8157404: Unable to read certain PKCS12 keystores from
    SequenceInputStream
    + JDK-8158066: SourceDebugExtensionTest fails to rename file
    + JDK-8168304: Make all of DependencyContext_test available in
    product mode
    + JDK-8169246: java/net/DatagramSocket/ReportSocketClosed.java
    fails intermittently with BindException
    + JDK-8181313: SA: Remove libthread_db dependency on Linux
    + JDK-8193214: Incorrect annotations.without.processors
    warnings with JDK 9
    + JDK-8194230: jdk/internal/jrtfs/remote/
    /RemoteRuntimeImageTest.java fails with
    java.lang.NullPointerException
    + JDK-8196092: javax/swing/JComboBox/8032878/bug8032878.java
    fails
    + JDK-8199931: java/net/MulticastSocket/
    /UnreferencedMulticastSockets.java fails with "incorrect data
    received"
    + JDK-8206083: Make tools/javac/api/T6265137.java robust to JDK
    version changes
    + JDK-8206350: java/util/Locale/bcp47u/SystemPropertyTests.java
    failed on Mac 10.13 with zh_CN and zh_TW locales.
    + JDK-8207316: java/nio/channels/spi/SelectorProvider/
    /inheritedChannel/InheritedChannelTest.java failed
    + JDK-8208227: tools/jdeps/DotFileTest.java fails on Win-X64
    + JDK-8208363: test/jdk/java/lang/Package/
    /PackageFromManifest.java missing module dependencies
    declaration
    + JDK-8209380: ARM: cleanup maybe-uninitialized and reorder
    compiler warnings
    + JDK-8209768: Refactor java/util/prefs/CheckUserPrefsStorage.sh
    to plain java test
    + JDK-8209772: Refactor shell test java/util/ServiceLoader/
    /basic/basic.sh to java
    + JDK-8209773: Refactor shell test javax/naming/module/basic.sh
    to java
    + JDK-8209832: Refactor jdk/internal/reflect/Reflection/
    /GetCallerClassTest.sh to plain java test
    + JDK-8209930: Refactor java/util/zip/ZipFile/deletetempjar.sh
    to plain java test
    + JDK-8210406: Refactor java.util.PluggableLocale:i18n shell
    tests to plain java tests
    + JDK-8210407: Refactor java.util.Calendar:i18n shell tests to
    plain java tests
    + JDK-8210495: compiler crashes because of illegal signature in
    otherwise legal code
    + JDK-8210669: Some launcher tests assume a pre-JDK 9 run-time
    image layout
    + JDK-8210802: temp files left by tests in
    jdk/java/net/httpclient
    + JDK-8210819: Update the host name in CNameTest.java
    + JDK-8210908: Refactor java/util/prefs/PrefsSpi.sh to plain
    java test
    + JDK-8210934: Move sun/net/www/protocol/http/
    /GetErrorStream.java to OpenJDK
    + JDK-8210959: JShell fails and exits when statement throws an
    exception whose message contains a '%'.
    + JDK-8211055: Provide print to a file (PDF) feature even when
    printer was not connected
    + JDK-8211092: test/jdk/sun/net/www/http/HttpClient/
    /MultiThreadTest.java fails intermittently when cleaning up
    + JDK-8211296: Remove HotSpot deprecation warning suppression
    for Mac/clang
    + JDK-8211325: test/jdk/java/net/Socket/LingerTest.java fails
    with cleaning up
    + JDK-8212040: Compilation error due to wrong usage of
    NSPrintJobDispositionValue in mac10.12
    + JDK-8212695: Add explicit timeout to several HTTP Client tests
    + JDK-8212718: Refactor some annotation processor tests to
    better use collections
    + JDK-8213007: Update the link in test/jdk/sun/security/
    /provider/SecureRandom/DrbgCavp.java
    + JDK-8213137: Remove static initialization of monitor/mutex
    instances
    + JDK-8213235: java/nio/channels/SocketChannel/
    /AsyncCloseChannel.java fails with threads that didn't exit
    + JDK-8213409: Refactor sun.text.IntHashtable:i18n shell tests
    to plain java tests
    + JDK-8213576: Make test AsyncCloseChannel.java run in othervm
    + JDK-8213694: Test Timeout.java should run in othervm mode
    + JDK-8213718: [TEST] Wrong classname in vmTestbase/nsk/stress/
    /except/except002 and except003
    + JDK-8213922: fix ctw stand-alone build
    + JDK-8214195: Align stdout messages in
    test/jdk/java/math/BigInteger/PrimitiveConversionTests.java
    + JDK-8214520: [TEST_BUG] sun/security/mscapi/nonUniqueAliases/
    /NonUniqueAliases.java failed with incorrect jtreg tags order
    + JDK-8214937: sun/security/tools/jarsigner/warnings/
    /NoTimestampTest.java failed due to unexpected expiration date
    + JDK-8216532: tools/launcher/Test7029048.java fails (Solaris)
    + JDK-8217825: Verify @AfterTest is used correctly in WebSocket
    tests
    + JDK-8218145: block_if_requested is not proper inlined due to
    size
    + JDK-8219417: bump jtreg requiredVersion to b14
    + JDK-8219552: bump jtreg requiredVersion to b14 in
    test/jdk/sanity/client/
    + JDK-8219804: java/net/MulticastSocket/Promiscuous.java fails
    intermittently due to NumberFormatException
    + JDK-8220445: Support for side by side MSVC Toolset versions
    + JDK-8221988: add possibility to build with Visual Studio 2019
    + JDK-8222751: closed/test/jdk/sun/security/util/
    /DerIndefLenConverter/IndefBerPkcs12.java fail
    + JDK-8223050: JVMCI: findUniqueConcreteMethod() should not use
    Dependencies::find_unique_concrete_method() for non-virtual
    methods
    + JDK-8224853: CDS address sanitizer errors
    + JDK-8225082: Remove IdenTrust certificate that is expiring in
    September 2021
    + JDK-8225583: Examine the HttpResponse.BodySubscribers for
    null handling and multiple subscriptions
    + JDK-8225690: Multiple AttachListener threads can be created
    + JDK-8225790: Two NestedDialogs tests fail on Ubuntu
    + JDK-8226319: Add forgotten test/jdk/java/net/httpclient/
    /BodySubscribersTest.java
    + JDK-8226533: JVMCI: findUniqueConcreteMethod should handle
    statically bindable methods directly
    + JDK-8226602: Test convenience reactive primitives from
    java.net.http with RS TCK
    + JDK-8226683: Remove review suggestion from fix to 8219804
    + JDK-8227738: jvmti/DataDumpRequest/datadumpreq001 failed due
    to "exit code is 134"
    + JDK-8227766: CheckUnhandledOops is broken in MemAllocator
    + JDK-8227815: Minimal VM: set_state is not a member of
    AttachListener
    + JDK-8230674: Heap dumps should exclude dormant CDS archived
    objects of unloaded classes
    + JDK-8230808: Remove Access::equals()
    + JDK-8230841: Remove oopDesc::equals()
    + JDK-8231717: Improve performance of charset decoding when
    charset is always compactable
    + JDK-8232243: Wrong caret position in JTextPane on Windows
    with a screen resolution &gt; 100%
    + JDK-8232782: Shenandoah: streamline post-LRB CAS barrier
    (aarch64)
    + JDK-8233790: Forward output from heap dumper to jcmd/jmap
    + JDK-8233989: Create an IPv4 version of
    java/net/MulticastSocket/SetLoopbackMode.java
    + JDK-8234510: Remove file seeking requirement for writing a
    heap dump
    + JDK-8235211: serviceability/attach/
    /RemovingUnixDomainSocketTest.java fails with
    AttachNotSupportedException: Unable to open socket file
    + JDK-8235216: typo in test filename
    + JDK-8235866: bump jtreg requiredVersion to 4.2b16
    + JDK-8236111: narrow allowSmartActionArgs disabling
    + JDK-8236413: AbstractConnectTimeout should tolerate both
    NoRouteToHostException and UnresolvedAddressException
    + JDK-8236671: NullPointerException in JKS keystore
    + JDK-8238930: problem list compiler/c2/Test8004741.java
    + JDK-8238943: switch to jtreg 5.0
    + JDK-8240555: Using env of JAVA_TOOL_OPTIONS and _JAVA_OPTIONS
    breaks QuietOption.java test
    + JDK-8240983: Incorrect copyright header in Apache Santuario
    2.1.3 files
    + JDK-8241336: Some java.net tests failed with
    NoRouteToHostException on MacOS with special network
    configuration
    + JDK-8241353: NPE in ToolProvider.getSystemJavaCompiler
    + JDK-8241768: git needs .gitattributes
    + JDK-8242882: opening jar file with large manifest might throw
    NegativeArraySizeException
    + JDK-8244973: serviceability/attach/
    /RemovingUnixDomainSocketTest.java fails "stderr was not
    empty"
    + JDK-8245134: test/lib/jdk/test/lib/security/
    /KeyStoreUtils.java should allow to specify aliases
    + JDK-8246261: TCKLocalTime.java failed due to "AssertionError:
    expected [18:14:22] but found [18:14:23]"
    + JDK-8246387: switch to jtreg 5.1
    + JDK-8247421: [TESTBUG] ReturnBlobToWrongHeapTest.java failed
    allocating blob
    + JDK-8247469: getSystemCpuLoad() returns -1 on linux when some
    offline cpus are present and cpusets.effective_cpus is not
    available
    + JDK-8248352: [TEST_BUG] Test test/jdk/java/awt/font/
    /TextLayout/ArabicDiacriticTest.java can leave frame open
    + JDK-8248403: AArch64: Remove uses of kernel integer types
    + JDK-8248414: AArch64: Remove uses of long and unsigned long
    ints
    + JDK-8248657: Windows: strengthening in ThreadCritical
    regarding memory model
    + JDK-8248666: AArch64: Use THREAD_LOCAL instead of __thread
    + JDK-8248668: AArch64: Avoid MIN/MAX macros when using MSVC
    + JDK-8248671: AArch64: Remove unused variables
    + JDK-8248682: AArch64: Use ATTRIBUTE_ALIGNED helper
    + JDK-8248816: C1: Fix signature conflict in
    LIRGenerator::strength_reduce_multiply
    + JDK-8249095: tools/javac/launcher/SourceLauncherTest.java
    fails on Windows
    + JDK-8249548: backward focus traversal gets stuck in button
    group
    + JDK-8249773: Upgrade ReceiveISA.java test to be resilient to
    failure due to stray packets and interference
    + JDK-8249897: jdk/javadoc/tool/LangVers.java uses @ignore w/o
    bug-id
    + JDK-8249898: jdk/javadoc/tool/6176978/T6176978.java uses
    @ignore w/o bug-id
    + JDK-8249899: jdk/javadoc/tool/InlineTagsWithBraces.java uses
    @ignore w/o bug-id
    + JDK-8250588: Shenandoah: LRB needs to save/restore fp
    registers for runtime call
    + JDK-8250824: AArch64: follow up for JDK-8248414
    + JDK-8251166: Add automated testcases for changes done in
    JDK-8214112
    + JDK-8251252: Add automated testcase for fix done in
    JDK-8214253
    + JDK-8251254: Add automated test for fix done in JDK-8218472
    + JDK-8251361: Potential race between Logger configuration and
    GCs in HttpURLConWithProxy test
    + JDK-8251549: Update docs on building for Git
    + JDK-8251945: SIGSEGV in
    PackageEntry::purge_qualified_exports()
    + JDK-8252194: Add automated test for fix done in JDK-8218469
    + JDK-8252648: Shenandoah: name gang tasks consistently
    + JDK-8252825: Add automated test for fix done in JDK-8218479
    + JDK-8252853: AArch64: gc/shenandoah/TestVerifyJCStress.java
    fails intermittently with C1
    + JDK-8252857: AArch64: Shenandoah C1 CAS is not sequentially
    consistent
    + JDK-8253048: AArch64: When CallLeaf, no need to preserve
    callee-saved registers in caller
    + JDK-8253424: Add support for running pre-submit testing using
    GitHub Actions
    + JDK-8253631: Remove unimplemented CompileBroker methods after
    JEP-165
    + JDK-8253865: Pre-submit testing using GitHub Actions does not
    detect failures reliably
    + JDK-8253899: Make IsClassUnloadingEnabled signature match
    specification
    + JDK-8254024: Enhance native libs for AWT and Swing to work
    with GraalVM Native Image
    + JDK-8254054: Pre-submit testing using GitHub Actions should
    not use the deprecated set-env command
    + JDK-8254173: Add Zero, Minimal hotspot targets to submit
    workflow
    + JDK-8254175: Build no-pch configuration in debug mode for
    submit checks
    + JDK-8254244: Some code emitted by TemplateTable::branch is
    unused when running TieredCompilation
    + JDK-8254270: linux 32 bit build doesn't compile
    libjdwp/log_messages.c
    + JDK-8254282: Add Linux x86_32 builds to submit workflow
    + JDK-8254850: Update terminology in java.awt.GridBagLayout
    source code comments
    + JDK-8255255: Update Apache Santuario (XML Signature) to
    version 2.2.1
    + JDK-8255305: Add Linux x86_32 tier1 to submit workflow
    + JDK-8255352: Archive important test outputs in submit workflow
    + JDK-8255373: Submit workflow artifact name is always
    "test-results_.zip"
    + JDK-8255452: Doing GC during JVMTI MethodExit event posting
    breaks return oop
    + JDK-8255718: Zero: VM should know it runs in interpreter-only
    mode
    + JDK-8255790: GTKL&amp;F: Java 16 crashes on initialising GTKL&amp;F
    on Manjaro Linux
    + JDK-8255810: Zero: build fails without JVMTI
    + JDK-8255895: Submit workflow artifacts miss hs_errs/replays
    due to ZIP include mismatch
    + JDK-8256127: Add cross-compiled foreign architectures builds
    to submit workflow
    + JDK-8256215: Shenandoah: re-organize saving/restoring machine
    state in assembler code
    + JDK-8256267: Relax compiler/floatingpoint/NaNTest.java for
    x86_32 and lower -XX:+UseSSE
    + JDK-8256277: Github Action build on macOS should define OS
    and Xcode versions
    + JDK-8256354: Github Action build on Windows should define OS
    and MSVC versions
    + JDK-8256393: Github Actions build on Linux should define OS
    and GCC versions
    + JDK-8256414: add optimized build to submit workflow
    + JDK-8256747: GitHub Actions: decouple the hotspot build-only
    jobs from Linux x64 testing
    + JDK-8257056: Submit workflow should apt-get update to avoid
    package installation errors
    + JDK-8257148: Remove obsolete code in AWTView.m
    + JDK-8257497: Update keytool to create AKID from the SKID of
    the issuing certificate as specified by RFC 5280
    + JDK-8257620: Do not use objc_msgSend_stret to get macOS
    version
    + JDK-8257913: Add more known library locations to simplify
    Linux cross-compilation
    + JDK-8258703: Incorrect 512-bit vector registers restore on
    x86_32
    + JDK-8259338: Add expiry exception for identrustdstx3 alias to
    VerifyCACerts.java test
    + JDK-8259535: ECDSA SignatureValue do not always have the
    specified length
    + JDK-8259679: GitHub actions should use MSVC 14.28
    + JDK-8259924: GitHub actions fail on Linux x86_32 with "Could
    not configure libc6:i386"
    + JDK-8260460: GitHub actions still fail on Linux x86_32 with
    "Could not configure libc6:i386"
    + JDK-8260589: Crash in JfrTraceIdLoadBarrier::load(_jclass*)
    + JDK-8260923: Add more tests for SSLSocket input/output
    shutdown
    + JDK-8261072: AArch64: Fix MacroAssembler::get_thread
    convention
    + JDK-8261147: C2: Node is wrongly marked as reduction
    resulting in a wrong execution due to wrong vector instructions
    + JDK-8261238: NMT should not limit baselining by size threshold
    + JDK-8261496: Shenandoah: reconsider pacing updates memory
    ordering
    + JDK-8261652: Remove some dead comments from os_bsd_x86
    + JDK-8261846: [JVMCI] c2v_iterateFrames can get out of sync
    with the StackFrameStream
    + JDK-8262000: jdk/jfr/event/gc/detailed/
    /TestPromotionFailedEventWithParallelScavenge.java failed with
    "OutOfMemoryError: Java heap space"
    + JDK-8262017: C2: assert(n != __null) failed: Bad immediate
    dominator info.
    + JDK-8262392: Update Mesa 3-D Headers to version 21.0.3
    + JDK-8262409: sun/security/ssl/SSLSocketImpl/
    /SSLSocketImplThrowsWrongExceptions. SSL test failures caused
    by java failed with "Server reported the wrong exception"
    + JDK-8262470: Printed GlyphVector outline with low DPI has bad
    quality on Windows
    + JDK-8262862: Harden tests sun/security/x509/URICertStore/
    /ExtensionsWithLDAP.java and krb5/canonicalize/Test.java
    + JDK-8263136: C4530 was reported from VS 2019 at access bridge
    + JDK-8263227: C2: inconsistent spilling due to dead nodes in
    exception block
    + JDK-8263382: java/util/logging/ParentLoggersTest.java failed
    with "checkLoggers: getLoggerNames() returned unexpected
    loggers"
    + JDK-8263407: SPARC64 detection fails on Athena (SPARC64-X)
    + JDK-8263432: javac may report an invalid package/class clash
    on case insensitive filesystems
    + JDK-8263490: [macos] Crash occurs on JPasswordField with
    activated InputMethod
    + JDK-8263531: Remove unused buffer int
    + JDK-8263667: Avoid running GitHub actions on branches named
    pr/*
    + JDK-8263776: [JVMCI] add helper to perform Java upcalls
    + JDK-8264016: [JVMCI] add some thread local fields for use by
    JVMCI
    + JDK-8264752: SIGFPE crash with option
    FlightRecorderOptions:threadbuffersize=30M
    + JDK-8265132: C2 compilation fails with assert "missing
    precedence edge"
    + JDK-8265231: (fc) ReadDirect and WriteDirect tests fail after
    fix for JDK-8264821
    + JDK-8265335: Epsilon: Minor typo in EpsilonElasticTLABDecay
    description
    + JDK-8265756: AArch64: initialize memory allocated for locals
    according to Windows AArch64 stack page growth requirement in
    template interpreter
    + JDK-8265761: Font with missed font family name is not
    properly printed on Windows
    + JDK-8265773: incorrect jdeps message "jdk8internals" to
    describe a removed JDK internal API
    + JDK-8265836: OperatingSystemImpl.getCpuLoad() returns
    incorrect CPU load inside a container
    + JDK-8266018: Shenandoah: fix an incorrect assert
    + JDK-8266206: Build failure after JDK-8264752 with older GCCs
    + JDK-8266248: Compilation failure in
    PLATFORM_API_MacOSX_MidiUtils.c with Xcode 12.5
    + JDK-8266288: assert root method not found in
    witnessed_reabstraction_in_supers is too strong
    + JDK-8266404: Fatal error report generated with
  - XX:+CrashOnOutOfMemoryError should not contain suggestion to
    submit a bug report
    + JDK-8266480: Implicit null check optimization does not update
    control of hoisted memory operation
    + JDK-8266615: C2 incorrectly folds subtype checks involving an
    interface array
    + JDK-8266642: Improve ResolvedMethodTable hash function
    + JDK-8266749: AArch64: Backtracing broken on PAC enabled
    systems
    + JDK-8266761: AssertionError in
    sun.net.httpserver.ServerImpl.responseCompleted
    + JDK-8266813: Shenandoah: Use shorter instruction sequence for
    checking if marking in progress
    + JDK-8267042: bug in monitor locking/unlocking on ARM32 C1 due
    to uninitialized BasicObjectLock::_displaced_header
    + JDK-8267348: Rewrite gc/epsilon/TestClasses.java to use
    Metaspace with less classes
    + JDK-8267396: Avoid recording "pc" in unhandled oops detector
    for better performance
    + JDK-8267399: C2: java/text/Normalizer/ConformanceTest.java
    test failed with assertion
    + JDK-8267424: CTW: C1 fails with "State must not be null"
    + JDK-8267459: Pasting Unicode characters into JShell does not
    work.
    + JDK-8267625: AARCH64: typo in LIR_Assembler::emit_profile_type
    + JDK-8267666: Add option to jcmd GC.heap_dump to use existing
    file
    + JDK-8267695: Bump update version for OpenJDK: jdk-11.0.13
    + JDK-8267751: (test) jtreg.SkippedException has no serial
    VersionUID
    + JDK-8267773: PhaseStringOpts::int_stringSize doesn't handle
    min_jint correctly
    + JDK-8268103: JNI functions incorrectly return a double after
    JDK-8265836
    + JDK-8268127: Shenandoah: Heap size may be too small for
    region to align to large page size
    + JDK-8268261: C2: assert(n != __null) failed: Bad immediate
    dominator info.
    + JDK-8268347: C2: nested locks optimization may create
    unbalanced monitor enter/exit code
    + JDK-8268360: Missing check for infinite loop during node
    placement
    + JDK-8268362: [REDO] C2 crash when compile negative
    Arrays.copyOf length after loop
    + JDK-8268366: Incorrect calculation of has_fpu_registers in C1
    linear scan
    + JDK-8268369: SIGSEGV in PhaseCFG::implicit_null_check due to
    missing null check
    + JDK-8268417: Add test from JDK-8268360
    + JDK-8268427: Improve AlgorithmConstraints:checkAlgorithm
    performance
    + JDK-8268617: [11u REDO] - WebSocket over authenticating proxy
    fails with NPE
    + JDK-8268620: InfiniteLoopException test may fail on x86
    platforms
    + JDK-8268635: Corrupt oop in ClassLoaderData
    + JDK-8268699: Shenandoah: Add test for JDK-8268127
    + JDK-8268771: javadoc -notimestamp option does not work on
    index.html
    + JDK-8268775: Password is being converted to String in
    AccessibleJPasswordField
    + JDK-8268776: Test `ADatagramSocket.java` missing /othervm
    from @run tag
    + JDK-8268965: TCP Connection Reset when connecting simple
    socket to SSL server
    + JDK-8269304: Regression ~5% in 2005 in b27
    + JDK-8269415: [11u] Remove ea from
    DEFAULT_PROMOTED_VERSION_PRE in OpenJDK 11u
    + JDK-8269478: Shenandoah: gc/shenandoah/mxbeans tests should
    be more resilient
    + JDK-8269529: javax/swing/reliability/
    /HangDuringStaticInitialization.java fails in Windows debug
    build
    + JDK-8269594: assert(_handle_mark_nesting &gt; 1) failed: memory
    leak: allocating handle outside HandleMark
    + JDK-8269614: [s390] Interpreter checks wrong bit for slow
    path instance allocation
    + JDK-8269650: Optimize gc-locker in
    [Get|Release]StringCritical for latin string
    + JDK-8269661: JNI_GetStringCritical does not lock char array
    + JDK-8269668: [aarch64] java.library.path not including
    /usr/lib64
    + JDK-8269763: The JEditorPane is blank after JDK-8265167
    + JDK-8269795: C2: Out of bounds array load floats above its
    range check in loop peeling resulting in SEGV
    + JDK-8269847: JDK-8269594 backport breaks 11u builds
    + JDK-8269850: Most JDK releases report macOS version 12 as
    10.16 instead of 12.0
    + JDK-8269851: OperatingSystemMXBean getProcessCpuLoad reports
    incorrect process cpu usage in containers
    + JDK-8269882: stack-use-after-scope in NewObjectA
    + JDK-8269934: RunThese24H.java failed with
    EXCEPTION_ACCESS_VIOLATION in
    java_lang_Thread::get_thread_status
    + JDK-8270096: Shenandoah: Optimize gc/shenandoah/
    /TestRefprocSanity.java for interpreter mode
    + JDK-8270137: Kerberos Credential Retrieval from Cache not
    Working in Cross-Realm Setup
    + JDK-8270184: [TESTBUG] Add coverage for jvmci
    ResolvedJavaType.toJavaName() for lambdas
    + JDK-8270196: [11u] [JVMCI] JavaType.toJavaName() returns
    incorrect type name for lambdas
    + JDK-8270556: Exclude security/infra/java/security/cert/
    /CertPathValidator/certification/LetsEncryptCA
    + JDK-8270893: IndexOutOfBoundsException while reading large
    TIFF file
    + JDK-8272078: Wrong Checksums in Temurin BootJDK dependencies
    + JDK-8272124: Cgroup v1 initialization causes
    NullPointerException when cgroup path contains colon
    + JDK-8272131: PhaseMacroExpand::generate_slow_arraycopy crash
    when clone null CallProjections.fallthrough_ioproj
    + JDK-8272197: Update 11u GHA workflow with Shenandoah
    configurations
    + JDK-8272332: --with-harfbuzz=system doesn't add -lharfbuzz
    after JDK-8255790
    + JDK-8272472: StackGuardPages test doesn't build with glibc
    2.34
    + JDK-8272602: [macos] not all KEY_PRESSED events sent when
    control modifier is used
    + JDK-8272628: Problemlist gc/stress/gcbasher/
    /TestGCBasherWithCMS.java for x86_32
    + JDK-8272700: [macos] Build failure with Xcode 13.0 after
    JDK-8264848
    + JDK-8272772: Shenandoah: compiler/c2/aarch64/
    /TestVolatilesShenandoah.java fails in 11u
    + JDK-8273939: Backport of 8248414 to JDK11 breaks
    MacroAssembler::adrp
- Remove the unneeded icedtea-sound provider
- Removed patches:
  * icedtea-sound-1.0.1-jdk9.patch
  * icedtea-sound-soundproperties.patch
    + not needed since the icedtea-sound provider is removed
  * jdk11-glibc234.patch
    + integrated upstream</changelog>
  <changelog author="fstrba@suse.com" date="1635940800">- Modified patches:
  * system-crypto-policy.patch
    + rediff to changed context
  * fips.patch
    + Allow plain key import in fips mode unless
    com.suse.fips.plainKeySupport is set to false</changelog>
  <changelog author="fstrba@suse.com" date="1636113600">- Modified patch:
  * fips.patch
    + return in native code after generating java.io.IOException</changelog>
</package>
<package pkgid="4cc81f35e8c4765af56c0efe3469b63b3346104121eb692b87fb4385dec63113" name="java-11-openjdk-devel" arch="x86_64">
  <version epoch="0" ver="11.0.13.0" rel="3.68.1"/>
  <changelog author="fstrba@suse.com" date="1586952000">- The pack200 and unpack200 alternatives should be slaves of java
  and not of javac, since they are part of JRE.</changelog>
  <changelog author="fstrba@suse.com" date="1587470400">- Update to upstream tag jdk-11.0.7+10 (April 2020 CPU,
  bsc#1169511)
  * Security fixes:
    + S8223898, CVE-2020-2754: Forward references to Nashorn
    + S8223904, CVE-2020-2755: Improve Nashorn matching
    + S8224541, CVE-2020-2756: Better mapping of serial ENUMs
    + S8224549, CVE-2020-2757: Less Blocking Array Queues
    + S8225603: Enhancement for big integers
    + S8226346: Build better binary builders
    + S8227467: Better class method invocations
    + S8227542: Manifest improved jar headers
    + S8229733: TLS message handling improvements
    + S8231415, CVE-2020-2773: Better signatures in XML
    + S8231785: Improved socket permissions
    + S8232424, CVE-2020-2778: More constrained algorithms
    + S8232581, CVE-2020-2767: Improve TLS verification
    + S8233250: Better X11 rendering
    + S8233410: Better Build Scripting
    + S8234027: Better JCEKS key support
    + S8234408, CVE-2020-2781: Improve TLS session handling
    + S8234825, CVE-2020-2800: Better Headings for HTTP Servers
    + S8234841, CVE-2020-2803: Enhance buffering of byte buffers
    + S8235274, CVE-2020-2805: Enhance typing of methods
    + S8235691, CVE-2020-2816: Enhance TLS connectivity
    + S8236201, CVE-2020-2830: Better Scanner conversions
    + S8238960: linux-i586 builds are inconsistent as the newly
    built jdk is not able to reserve enough space for object heap
  * Other changes:
    + S4919790: Errors in alert ssl message does not reflect the
    actual certificate status
    + S4949105: Access Bridge lacks html tags parsing
    + S7092821: java.security.Provider.getService() is synchronized
    and became scalability bottleneck
    + S7143743: Potential memory leak with zip provider
    + S8005819: Support cross-realm MSSFU
    + S8042383: [TEST_BUG] Test javax/swing/plaf/basic/BasicMenuUI/
    /4983388/bug4983388.java fails with shortcuts on menus do not
    work
    + S8068184: Fix for JDK-8032832 caused a deadlock
    + S8145845: [AOT] NullPointerException in
    compiler/whitebox/GetCodeHeapEntriesTest.java
    + S8152988: [AOT] Update test batch definitions to include
    aot-ed java.base module mode into hs-comp testing
    + S8160926: FLAGS_COMPILER_CHECK_ARGUMENTS doesn't handle
    cross-compilation
    + S8163083: SocketListeningConnector does not allow invocations
    with port 0
    + S8163251: Hard coded loop limit prevents reading of smart
    card data greater than 8k
    + S8167276: jvmci/compilerToVM/MaterializeVirtualObjectTest.java
    fails with -XX:-EliminateAllocations
    + S8169718: nsk/jdb/locals/locals002: ERROR: Cannot find
    boolVar with expected value: false
    + S8176556:
    java/awt/dnd/ImageTransferTest/ImageTransferTest.java fails
    for JFIF
    + S8178798: Two compiler/aot/verification/vmflags tests fail by
    timeout with UseAVX=3
    + S8183107: PKCS11 regression regarding checkKeySize
    + S8185005: Improve performance of
    ThreadMXBean.getThreadInfo(long ids[], int maxDepth)
    + S8189633: Missing -Xcheck:jni checking for DeleteWeakGlobalRef
    + S8189861: Refactor CacheFind
    + S8193042: NativeLookup::lookup_critical_entry() should only
    load shared library once
    + S8193596: java/net/DatagramPacket/ReuseBuf.java failed due to
    timeout
    + S8194944: Regression automated test 'open/test/jdk/javax/
    /swing/JInternalFrame/8145896/TestJInternalFrameMaximize.java'
    fails
    + S8196467: javax/swing/JInternalFrame/Test6325652.java fails
    + S8196969: JTreg Failure: serviceability/sa/ClhsdbJstack.java
    causes NPE
    + S8198321: javax/swing/JEditorPane/5076514/bug5076514.java
    fails
    + S8198398: Test javax/swing/JColorChooser/Test6199676.java
    fails in mach5
    + S8199072: Test javax/swing/GroupLayout/6613904/
    /bug6613904.java is unstable
    + S8200432: javadoc fails with ClassCastException on {@link
    byte[]}
    + S8201349: build broken when configured with
  - -with-zlib=bundled on gcc 7.3
    + S8201355: Avoid native memory allocation in
    sun.security.mscapi.PRNG.generateSeed
    + S8201513: nsk/jvmti/IterateThroughHeap/filter-* are broken
    + S8203364: Some serviceability/sa/ tests intermittently fail
    with java.io.IOException: LingeredApp terminated with non-zero
    exit code 3
    + S8203687: javax/net/ssl/compatibility/Compatibility.java
    supports TLS 1.3
    + S8203904: javax/swing/JSplitPane/4816114/bug4816114.java: The
    divider location is wrong
    + S8203911: Test runtime/modules/getModuleJNI/GetModule fails
    with -Xcheck:jni
    + S8204525: [TESTBUG] runtime/NMT/MallocStressTest.java ran out
    of java heap
    + S8204529: gc/TestAllocateHeapAtMultiple.java fail with Agent
    7 timed out
    + S8204551: Event descriptions are truncated in logs
    + S8206963: [AOT] bug with multiple class loaders
    + S8207367: 10 vmTestbase/nsk/jdi tests timed out when running
    with jtreg
    + S8207832: serviceability/sa/ClhsdbCDSCore.java failed with
    "Couldn't find core file location"
    + S8207938: At step6,Click Add button,case failed automatically.
    + S8208157: requires.VMProps throws NPE for missing properties
    in "release" file
    + S8208379: compiler/jvmci/events/
    /JvmciNotifyInstallEventTest.java failed with "Got unexpected
    event count after 2nd install attempt: expected 9 to equal 2"
    + S8208658: Make CDS archived heap regions usable even if
    compressed oop encoding has changed
    + S8208715: Conversion of milliseconds to nanoseconds in
    UNIXProcess contains bug
    + S8209361: [AOT] Unexpected number of references for
    JVMTI_HEAP_REFERENCE_CONSTANT_POOL [111--&gt;111]: 0 (expected
    at least 1)
    + S8209385: CDS runtime classpath checking is too strict when
    only classes from the system modules are archived
    + S8209389: SIGSEGV in WalkOopAndArchiveClosure::do_oop_work.
    + S8209418: Synchronize test/jdk/sanity/client/lib/jemmy with
    code-tools/jemmy/v2
    + S8209494: Create a test for SwingSet InternalFrameDemo
    + S8209499: Create test for SwingSet EditorPaneDemo
    + S8209574: [AOT] breakpoint events are generated in different
    threads does not meet expected count
    + S8209686: cleanup arguments to PhaseIdealLoop() constructor
    + S8209789: Synchronize test/jdk/sanity/client/lib/jemmy with
    code-tools/jemmy/v2
    + S8209802: Garbage collectors should register JFR types
    themselves to avoid build errors.
    + S8209807: improve handling exception in requires.VMProps
    + S8209817: stack is executable when building with Clang on
    Linux
    + S8209824: Improve the code coverage for ThreadLocal
    + S8209826: Undefined reference to os::write after JDK-8209657
    (filemap.hpp cleanup)
    + S8209850: Allow NamedThreads to use GlobalCounter critical
    sections
    + S8209976: Improve iteration over non-JavaThreads
    + S8209993: Create a test for SwingSet3 ToolTipDemo
    + S8210024: JFR calls virtual is_Java_thread from ~Thread()
    + S8210052: Enable testing for all the available look and feels
    in SwingSet3 demo tests
    + S8210055: Enable different look and feel tests in SwingSet3
    demo tests
    + S8210057: Enable different look and feels in SwingSet3 demo
    test InternalFrameDemoTest
    + S8210058: Algorithmic Italic font leans opposite angle in
    Printing
    + S8210220: [AOT] jdwp test cases are failing with error #
    ERROR: TEST FAILED: Cought IOException while receiving event
    packet
    + S8210289: ArchivedKlassSubGraphInfoRecord is incomplete
    + S8210459: Add support for generating compile_commands.json
    + S8210476: sun/security/mscapi/PrngSlow.java fails with Still
    too slow
    + S8210512: [Testbug] vmTestbase/nsk/jdi/ObjectReference/
    /referringObjects/referringObjects002/referringObjects002.java
    fails with unexpected size of
    ClassLoaderReference.referringObjects
    + S8210523: runtime/appcds/cacheObject/DifferentHeapSizes.java
    crash
    + S8210632: Add key exchange algorithm to
    javax/net/ssl/TLSCommon/CipherSuite.java
    + S8210699: Problem list tests which times out in Xcomp mode
    + S8210793: [JVMCI] AllocateCompileIdTest.java failed to find
    DiagnosticCommand.class
    + S8210910: Create test for FileChooserDemo
    + S8210994: Create test for SwingSet3 FrameDemo
    + S8211139: Increase timeout value in all tests under
    jdk/sanity/client/SwingSet/src
    + S8211160: Handle different look and feels in
    JInternalFrameOperator
    + S8211211: vmTestbase/metaspace/stressDictionary/
    /StressDictionary.java timeout
    + S8211322: Reduce the timeout of tooltip in SwingSet2DemoTest
    + S8211443: Enable different look and feels in SwingSet3 demo
    test SplitPaneDemoTest
    + S8211703: JInternalFrame : java.lang.AssertionError: cannot
    find the internal frame
    + S8211781: re-building fails after changing Graal sources
    + S8212897: Some improvements in the EditorPaneDemotest
    + S8212903: [TestBug] Tests test/jdk/javax/swing/LookAndFeel/
    /8145547/DemandGTK2.sh and DemandGTK3.sh fail on Ubuntu 18.04
    LTS
    + S8213009: Refactoring existing SunMSCAPI classes
    + S8213010: Supporting keys created with certmgr.exe
    + S8213168: Enable different look and feel tests in SwingSet3
    demo test FileChooserDemoTest
    + S8213348: jdk.internal.vm.compiler.management service
    providers missing in module descriptor
    + S8213906: Update arm devkits with libXrandr headers
    + S8213908: AssertionError in DeferredAttr at setOverloadKind
    + S8214124: [TESTBUG] Bugs in runtime/NMT/MallocStressTest.java
    + S8214344: C2: assert(con.basic_type() != T_ILLEGAL) failed:
    elembt=byte; loadbt=void; unsigned=0
    + S8214345: infinite recursion while checking super class
    + S8214471: Enable different look and feel tests in SwingSet3
    demo test ToolTipDemoTest
    + S8214534: Setting of THIS_FILE in the build is broken
    + S8214557: Filter out VM flags which don't affect AOT code
    generation
    + S8214578: [macos] Problem with backslashes on macOS/JIS
    keyboard: Java ignores system settings
    + S8214840: runtime/NMT/MallocStressTest.java timed out
    + S8214850: Rename vm_operations.?pp files to vmOperations.?pp
    files
    + S8214904: Test8004741.java failed due to "Too few ThreadDeath
    hits; expected at least 6 but saw only 5"
    + S8215322: add @file support to jaotc
    + S8215355: Object monitor deadlock with no threads holding the
    monitor (using jemalloc 5.1)
    + S8215396: JTabbedPane preferred size calculation is wrong for
    SCROLL_TAB_LAYOUT
    + S8216180: [AOT] compiler/intrinsics/bigInteger/TestMulAdd.java
    crashed with AOT enabled
    + S8216353: Use utility APIs introduced in org/netbeans/jemmy/
    /util/LookAndFeel class in client sanity test cases
    + S8216354: Syntax error in toolchain_windows.m4
    + S8216472: (se) Stack overflow during selection operation
    leads to crash (win)
    + S8216535: tools/jimage/JImageExtractTest.java timed out
    + S8217235: Create automated test for SwingSet
    ColorChooserDemoTest
    + S8217297: Add support for multiple look and feel for SwingSet
    SliderDemoTest
    + S8217338: [Containers] Improve systemd slice memory limit
    support
    + S8217613: [AOT] TEST_OPTS_AOT_MODULES doesn't work on mac
    + S8217634: RunTest documentation and usability update
    + S8217717: ZGC: Broken oop map in C1 load barrier stub
    + S8217728: Speed up incremental rerun of "make hotspot"
    + S8218268: Javac treats Manifest Class-Path entries as Paths
    instead of URLs
    + S8218662: Allow 204 responses with Content-Length:0
    + S8218882: NET_Writev is declared, NET_WriteV is defined
    + S8218889: Improperly use of the Optional API
    + S8219205: JFR file without license header
    + S8219597: (bf) Heap buffer state changes could provoke
    unexpected exceptions
    + S8219723: javax/net/ssl/compatibility/Compatibility.java
    failed on some SNI cases
    + S8220348: [ntintel] asserts about copying unaligned array
    + S8220451: jdi/EventQueue/remove/remove004 failed due to
    "ERROR: thread2 is not alive"
    + S8220456: jdi/EventQueue/remove_l/remove_l004 failed due to
    "TIMEOUT while waiting for event"
    + S8220479: java/nio/channels/Selector/SelectWithConsumer.java
    failed at testTwoChannels()
    + S8220613: java/util/Arrays/TimSortStackSize2.java times out
    with fastdebug build
    + S8220688: [TESTBUG] runtime/NMT/MallocStressTest.java timed
    out
    + S8220786: Create new switch to redirect error reporting
    output to stdout or stderr
    + S8221270: Duplicated synchronized keywords in SSLSocketImpl
    + S8221312: test/jdk/sanity/client/SwingSet/src/
    /ColorChooserDemoTest.java failed
    + S8221851: Use of THIS_FILE in hotspot invalidates precompiled
    header on Linux/GCC
    + S8221885: Add intermittent test in the JavaSound to the
    ProblemList
    + S8222264: Windows incremental build is broken with JDK-8217728
    + S8222391: javax/net/ssl/compatibility/Compatibility.java
    should be more flexible
    + S8222448: java/lang/reflect/PublicMethods/
    /PublicMethodsTest.java times out
    + S8222519: ButtonDemoScreenshotTest fails randomly with "still
    state to be reached"
    + S8222741: jdi/EventQueue/remove/remove004 fails due to
    VMDisconnectedException
    + S8223003: SunMSCAPI keys are not cleaned up
    + S8223063: Support CNG RSA keys
    + S8223158: Docked MacBook cannot start any Java Swing
    applications
    + S8223260: NamingManager should cache InitialContextFactory
    + S8223464: Improve version string for Oracle CI builds
    + S8223558: Java does not render Myanmar script correctly
    + S8223627: jdk-13+20 bundle name contains null instead of ea
    + S8223638: Replace wildcard address with loopback or local
    host in tests - part 6
    + S8223678: Add Visual Studio Code workspace generation support
    (for native code)
    + S8223727: com/sun/jndi/ldap/privconn/RunTest.java failed due
    to hang in LdapRequest.getReplyBer
    + S8223769: Assert triggers with -XX:+StressReflectiveCode
    + S8224187: Refactor arraycopy_prologue to allow ZGC read
    barriers on arraycopy
    + S8224475: JTextPane does not show images in HTML rendering
    + S8224673: Adjust permission for delayed starting of debugging
    + S8224705: Tests that need to be problem-listed or have
    printer resources
    + S8224778: test/jdk/demo/jfc/J2Ddemo/J2DdemoTest.java cannot
    find J2Ddemo.jar
    + S8224821: java/awt/Focus/NoAutotransferToDisabledCompTest/
    /NoAutotransferToDisabledCompTest.java fails linux-x64
    + S8224830: test/jdk/java/awt/Focus/
    /ModalExcludedWindowClickTest/
    /ModalExcludedWindowClickTest.java fails on linux-x64
    + S8224851: AArch64: fix warnings and errors with Clang and GCC
    8.3
    + S8224905: java/lang/ProcessBuilder/Basic.java#id1 failed with
    stream closed
    + S8225007: java/awt/print/PrinterJob/
    /LandscapeStackOverflow.java may hang
    + S8225105: java/awt/Focus/ShowFrameCheckForegroundTest/
    /ShowFrameCheckForegroundTest.java fails in Windows 10
    + S8225117: java/math/BigInteger/SymmetricRangeTests.java fails
    with ParseException
    + S8225128: Add exception for expiring DocuSign root to
    VerifyCACerts test
    + S8225130: Add exception for expiring Comodo roots to
    VerifyCACerts test
    + S8225144: [macos] In Aqua L&amp;F backspace key does not delete
    when Shift is pressed
    + S8225180: SignedObject with invalid Key not throwing the
    InvalidKeyException in Windows
    + S8225182: JNI exception pending in DestroyXIMCallback of
    awt_InputMethod.c:1327
    + S8225199: [Graal] compiler/jvmci/compilerToVM/
    /IsMatureVsReprofileTest.java fails with
  - XX:CompileThresholdScaling=0.1
    + S8225305: ProblemList java/lang/invoke/VarHandles tests
    + S8225350: compiler/jvmci/compilerToVM/IsCompilableTest.java
    timed out
    + S8225430: Replace wildcard address with loopback or local
    host in tests - part 14
    + S8225435: Upgrade IANA Language Subtag Registry to the latest
    for JDK14
    + S8225487: giflib legal file is missing attribution for
    openbsd-reallocarray.c
    + S8225567: Wrong file headers with 8202414 fix changeset
    + S8225684: [AOT] vmTestbase/vm/oom/production/
    /AlwaysOOMProduction tests fail with AOTed java.base
    + S8225766: Curve in certificate should not affect signature
    scheme when using TLSv1.3
    + S8225797: OldObjectSample event creates unexpected amount of
    checkpoint data
    + S8226381: ProblemList java/lang/reflect/PublicMethods/
    /PublicMethodsTest.java
    + S8226406: JVM fails to detect mismatched or corrupt CDS
    archive
    + S8226608: Hide the onjcmd option from the help output
    + S8226892: ActionListeners on JRadioButtons don't get notified
    when selection is changed with arrow keys
    + S8227112: exclude compiler/intrinsics/sha/sanity tests from
    AOT runs
    + S8227324: Upgrade to freetype 2.10.1
    + S8227528: TestAbortVMOnSafepointTimeout.java failed due to
    "RuntimeException: 'Safepoint sync time longer than' missing
    from stdout/stderr"
    + S8227645: Some tests in serviceability/sa run with fixed -Xmx
    values and risk running out of memory
    + S8227646: [TESTBUG] appcds/SharedArchiveConsistency timed out
    + S8227662: freetype seeks to index at the end of the font data
    + S8228479: Correct the format of ColorChooserDemoTest
    + S8228613: java.security.Provider#getServices order is no
    longer deterministic
    + S8228969: 2019-09-28 public suffix list update
    + S8229236: CriticalJNINatives: dll handling should be done in
    native thread state
    + S8229345: Memory leak due to vtable stubs not being shared on
    SPARC
    + S8229888: (zipfs) Updating an existing zip file does not
    preserve original permissions
    + S8229994: assert(false) failed: Bad graph detected in
    get_early_ctrl_for_expensive
    + S8230004: jdk/internal/jimage/JImageOpenTest.java runs no test
    + S8230235: Rendering HTML with empty img attribute and
    documentBaseKey cause Exception
    + S8230390: Problemlist SA tests with AOT
    + S8230400: Missing constant pool entry for a method in
    stacktrace
    + S8230459: Test failed to resume JVMCI CompilerThread
    + S8230480: check malloc/calloc results in java.desktop
    + S8230597: Update GIFlib library to the 5.2.1
    + S8230611: infinite loop in
    LogOutputList::wait_until_no_readers()
    + S8230624: [TESTBUG] Problemlist JFR
    compiler/TestCodeSweeper.java
    + S8230677: Should disable Escape Analysis if JVMTI capability
    can_get_owned_monitor_info was taken
    + S8230926: [macosx] Two apostrophes are entered instead of one
    with "U.S. International - PC" layout
    + S8231025: Incorrect method tag offset for big endian platform
    + S8231081: TestMetadataRetention fails due to missing symbol id
    + S8231387: java.security.Provider.getService returns random
    result due to race condition with mutating methods in the same
    class
    + S8231430: C2: Memory stomp in max_array_length() for
    T_ILLEGAL type
    + S8231445: check ZALLOC return values in awt coding
    + S8231507: Update Apache Santuario (XML Signature) to version
    2.1.4
    + S8231584: Deadlock with ClassLoader.findLibrary and
    System.loadLibrary call
    + S8231753: use more Posix functionality in aix
    os::print_os_info
    + S8231810: javax/net/ssl/templates/
    /SSLSocketSSLEngineTemplate.java fails intermittently with
    "java.lang.Exception: Unexpected EOF"
    + S8232003: (fs) Files.write can leak file descriptor in the
    exception case
    + S8232056: GetOwnedMonitorInfoWithEATest.java fails with ZGC:
    Heap too small
    + S8232060: add some initializations using sigemptyset in
    os_aix.cpp
    + S8232154: Update Mesa 3-D Headers to version 19.2.1
    + S8232167: Visual Studio install found through
  - -with-tools-dir value is discarded
    + S8232170: FSInfo#getJarClassPath throws an exception not
    declared in its throws clause
    + S8232200: [macos 10.15] Windows in fullscreen tests jumps
    around the screen
    + S8232207: Linux os::available_memory re-reads cgroup
    configuration on every invocation
    + S8232224: [TESTBUG] problemlist JFR TestLargeRootSet.java
    + S8232370: Refactor some com.sun.jdi tests to enable IDE
    integration
    + S8232433: [macos 10.15] java/awt/Window/
    /LocationAtScreenCorner/LocationAtScreenCorner.java may fail
    + S8232571: Add missing SIGINFO signal
    + S8232692: [TESTBUG] compiler/aot/fingerprint/
    /SelfChangedCDS.java fails when cds is disabled
    + S8232713: Update BCEL version to 6.3.1 in license file
    + S8232806: Introduce a system property to disable eager lambda
    initialization
    + S8232834: RunTest sometimes fails to produce valid
    exitcode.txt
    + S8232880: Update test documentation with additional settings
    for client UI tooltip tests
    + S8232950: SUNPKCS11 Provider incorrectly check key length for
    PSS Signatures.
    + S8233018: Add a new test to verify that DatagramSocket is not
    interruptible
    + S8233019: java.lang.Class.isPrimitive() (C1) returns wrong
    result if Klass* is aligned to 32bit
    + S8233032: assert(in_bb(n)) failed: must be
    + S8233078: fix minimal VM build on Linux ppc64(le)
    + S8233328: fix minimal VM build on Linux s390x
    + S8233383: Various minor fixes
    + S8233466: aarch64: remove unnecessary load of mdo when
    profiling return and parameters type
    + S8233491: Crash in AdapterHandlerLibrary::get_adapter with
    CDS due to code cache exhaustion
    + S8233529: loopTransform.cpp:2984: Error: assert(p_f-&gt;Opcode()
    == Op_IfFalse) failed
    + S8233548: Update CUP to v0.11b
    + S8233649: Update ProblemList.txt to exclude failing headful
    tests on macos
    + S8233656: assert(d-&gt;is_CFG() &amp;&amp; n-&gt;is_CFG()) failed: must
    have CFG nodes
    + S8233657: Intermittent NPE in Component.validate()
    + S8234288: Turkey Time Zone returns incorrect time zone name
    + S8234323: NULL-check return value of SurfaceData_InitOps on
    macosx
    + S8234339: replace JLI_StrTok in java_md_solinux.c
    + S8234340: Bump update version for OpenJDK: jdk-11.0.7
    + S8234350: assert(mode == ControlAroundStripMined &amp;&amp; (use ==
    sfpt || !use-&gt;is_reachable_from_root())) failed: missed a node
    + S8234386: [macos] NPE was thrown at expanding Choice from
    maximized frame
    + S8234397: add OS uptime information to os::print_os_info
    output
    + S8234423: Modifying ArrayList.subList().subList() resets
    modCount of subList
    + S8234466: Class loading deadlock involving
    X509Factory#commitEvent()
    + S8234501: remove obsolete NET_ReadV
    + S8234525: enable link-time section-gc for linux s390x to
    remove unused code
    + S8234610: MaxVectorSize set wrongly when UseAVX=3 is
    specified after JDK-8221092
    + S8234617: C1: Incorrect result of field load due to missing
    narrowing conversion
    + S8234723: javax/net/ssl/TLS tests support TLSv1.3
    + S8234724: javax/net/ssl/templates/
    /SSLSocketSSLEngineTemplate.java supports TLSv1.3
    + S8234741: enhance os::get_core_path on macOS
    + S8234769: Duplicate attribution in freetype.md
    + S8234786: Fix for JDK-8214578 breaks OS X 10.12 compatibility
    + S8234809: set relro in linker flags when building with gcc
    + S8234824: java/nio/channels/SocketChannel/AdaptSocket.java
    fails on Windows 10
    + S8235243: handle VS2017 15.9 and VS2019 in abstract_vm_version
    + S8235288: AVX 512 instructions inadvertently used on Xeon for
    small vector width operations
    + S8235325: build failure on Linux after 8235243
    + S8235383: C1 compilation fails with
  - XX:+PrintIRDuringConstruction -XX:+Verbose
    + S8235489: handle return values of sscanf calls in hotspot
    + S8235509: Backport for JDK-8209657 Refactor filemap.hpp to
    simplify integration with Serviceability Agent.
    + S8235510: java.util.zip.CRC32 performance drop after 8200067
    + S8235563: [TESTBUG] appcds/CommandLineFlagComboNegative.java
    does not handle archive mapping failure
    + S8235637: jhsdb jmap from OpenJDK 11.0.5 doesn't work if
    prelink is enabled
    + S8235671: enhance print_rlimit_info in os_posix
    + S8235744: PIT: test/jdk/javax/swing/text/html/
    /TestJLabelWithHTMLText.java times out in linux-x64
    + S8235904: Infinite loop when rendering huge lines
    + S8235998: [c2] Memory leaks during tracing after '8224193:
    stringStream should not use Resource Area'.
    + S8236039: JSSE Client does not accept status_request
    extension in CertificateRequest messages for TLS 1.3
    + S8236140: assert(!VerifyHashTableKeys || _hash_lock == 0)
    failed: remove node from hash table before modifying it
    + S8236179: C1 register allocation error with T_ADDRESS
    + S8236488: Support for configure option
  - -with-native-debug-symbols=internal is impossible on Windows
    + S8236500: Windows ucrt.dll should be looked up in versioned
    WINSDK subdirectory
    + S8236709: struct SwitchRange in HS violates C++ One
    Definition Rule
    + S8236848: [JDK 11u] make run-test-tier1 fails after backport
    of JDK-8232834
    + S8236873: Worker has a deadlock bug
    + S8237217: Incorrect G1StringDedupEntry type used in
    StringDedupTable destructor
    + S8237368: Problem with NullPointerException in RMI
    TCPEndpoint.read
    + S8237375: SimpleThresholdPolicy misses CounterDecay timestamp
    initialization
    + S8237508: Simplify JarFile.isInitializing
    + S8237540: Missing files in backport of JDK-8210910
    + S8237541: Missing files in backport of JDK-8236528
    + S8237600: Test SunJSSEFIPSInit fails on Ubuntu
    + S8237819: s390x - remove unused pd_zero_to_words_large
    + S8237869: exclude jtreg test security/infra/java/security/
    /cert/CertPathValidator/certification/LuxTrustCA.java because
    of instabilities
    + S8237879: make 4.3 breaks build
    + S8237945: CTW: C2 compilation fails with
    assert(just_allocated_object(alloc_ctl) == ptr) failed: most
    recent allo...
    + S8238225: Issues reported after replacing symlink at
    Contents/MacOS/libjli.dylib with binary
    + S8238247: CTW runner should sweep nmethods more aggressively
    + S8238366: CTW runner closes standard output on exit
    + S8238438: SuperWord::co_locate_pack picks memory state of
    first instead of last load
    + S8238502: sunmscapi.dll causing EXCEPTION_ACCESS_VIOLATION
    + S8238534: Deep sign macOS bundles before bundle archive is
    being created
    + S8238591: CTW: Split
    applications/ctw/modules/jdk_localedata.java
    + S8238596: AVX enabled by default for Skylake even when
    unsupported
    + S8238811: C2: assert(i &gt;= req() || i == 0 || is_Region() ||
    is_Phi()) with -XX:+VerifyGraphEdges
    + S8239005: [TESTBUG] test/hotspot/jtreg/runtime/
    /StackGuardPages/TestStackGuardPages.java: exeinvoke.c: must
    initialize static state before calling do_overflow()
    + S8239466: Loss of precision in counter decay calculation in
    11u backport of JDK-8237375
    + S8239856: [ntintel] asserts about copying unaligned array
    element
    + S8240724: [test] jdk11 downport of 8224475 misses binary file
    test/jdk/javax/swing/JTextPane/arrow.png
    + S8241296: Segfault in JNIHandleBlock::oops_do()
- Removed patch:
  * DependOnVariableHelper.patch
    + fixed upstream
- Added patch:
  * JDK-8228407.patch
    + fix crashes due to shared archive file mismatch</changelog>
  <changelog author="fstrba@suse.com" date="1594900800">- Update to upstream tag jdk-11.0.8+10 (July 2020 CPU, bsc#1174157)
  * Security fixes:
    + JDK-8230613: Better ASCII conversions
    + JDK-8231800: Better listing of arrays
    + JDK-8232014: Expand DTD support
    + JDK-8233234: Better Zip Naming
    + JDK-8233239, CVE-2020-14562: Enhance TIFF support
    + JDK-8233255: Better Swing Buttons
    + JDK-8234032: Improve basic calendar services
    + JDK-8234042: Better factory production of certificates
    + JDK-8234418: Better parsing with CertificateFactory
    + JDK-8234836: Improve serialization handling
    + JDK-8236191: Enhance OID processing
    + JDK-8236867, CVE-2020-14573: Enhance Graal interface handling
    + JDK-8237117, CVE-2020-14556: Better ForkJoinPool behavior
    + JDK-8237592, CVE-2020-14577: Enhance certificate verification
    + JDK-8238002, CVE-2020-14581: Better matrix operations
    + JDK-8238013: Enhance String writing
    + JDK-8238804: Enhance key handling process
    + JDK-8238842: AIOOBE in GIFImageReader.initializeStringTable
    + JDK-8238843: Enhanced font handing
    + JDK-8238920, CVE-2020-14583: Better Buffer support
    + JDK-8238925: Enhance WAV file playback
    + JDK-8240119, CVE-2020-14593: Less Affine Transformations
    + JDK-8240482: Improved WAV file playback
    + JDK-8241379: Update JCEKS support
    + JDK-8241522: Manifest improved jar headers redux
    + JDK-8242136, CVE-2020-14621: Better XML namespace handling
  * Other changes:
    + JDK-6933331: (d3d/ogl) java.lang.IllegalStateException:
    Buffers have not been created
    + JDK-7124307: JSpinner and changing value by mouse
    + JDK-8022574: remove HaltNode code after uncommon trap calls
    + JDK-8039082: [TEST_BUG] Test
    java/awt/dnd/BadSerializationTest/BadSerializationTest.java
    fails
    + JDK-8040630: Popup menus and tooltips flicker with previous
    popup contents when first shown
    + JDK-8044365: (dc) MulticastSendReceiveTests.java failing with
    ENOMEM when joining group (OS X 10.9)
    + JDK-8048215: [TESTBUG]
    java/lang/management/ManagementFactory/ThreadMXBeanProxy.java
    Expected non-null LockInfo
    + JDK-8051349: nsk/jvmti/scenarios/sampling/SP06/sp06t003 fails
    in nightly
    + JDK-8080353: JShell: Better error message on attempting to
    add default method
    + JDK-8139876: Exclude hanging nsk/stress/stack from execution
    with deoptimization enabled
    + JDK-8146090: java/lang/ref/ReachabilityFenceTest.java fails
    with -XX:+DeoptimizeALot
    + JDK-8153430: jdk regression test MletParserLocaleTest,
    ParserInfiniteLoopTest reduce default timeout
    + JDK-8156207: Resource allocated BitMaps are often cleared
    unnecessarily
    + JDK-8159740: JShell: corralled declarations do not have
    correct source to wrapper mapping
    + JDK-8175984: ICC_Profile has un-needed, not-empty finalize
    method
    + JDK-8176359: Frame#setMaximizedbounds not working properly in
    multi screen environments
    + JDK-8183369: RFC unconformity of HttpURLConnection with proxy
    + JDK-8187078: -XX:+VerifyOops finds numerous problems when
    running JPRT
    + JDK-8189861: Refactor CacheFind
    + JDK-8191169: java/net/Authenticator/B4769350.java failed
    intermittently
    + JDK-8191930: [Graal] emits unparseable XML into compile log
    + JDK-8193879: Java debugger hangs on method invocation
    + JDK-8196019: java/awt/Window/Grab/GrabTest.java fails on
    Windows
    + JDK-8196181: sun/java2d/GdiRendering/InsetClipping.java fails
    + JDK-8198000:
    java/awt/List/EmptyListEventTest/EmptyListEventTest.java
    debug assert on Windows
    + JDK-8198001: java/awt/Menu/WrongParentAfterRemoveMenu/
    /WrongParentAfterRemoveMenu.java debug assert on Windows
    + JDK-8198339: Test javax/swing/border/Test6981576.java is
    unstable
    + JDK-8200701: jdk/jshell/ExceptionsTest.java fails on Windows,
    after JDK-8198801
    + JDK-8203264: JNI exception pending in
    PlainDatagramSocketImpl.c:740
    + JDK-8203672: JNI exception pending in PlainSocketImpl.c
    + JDK-8203673: JNI exception pending in
    DualStackPlainDatagramSocketImpl.c:398
    + JDK-8204834: Fix confusing "allocate" naming in OopStorage
    + JDK-8205399: Set node color on pinned HashMap.TreeNode
    deletion
    + JDK-8205653: test/jdk/sun/management/jmxremote/bootstrap/
    /RmiRegistrySslTest.java and RmiSslBootstrapTest.sh fail with
    handshake_failure
    + JDK-8206179: com/sun/management/OperatingSystemMXBean/
    /GetCommittedVirtualMemorySize.java fails with Committed
    virtual memory size illegal value
    + JDK-8207334: VM times out in VM_HandshakeAllThreads::doit()
    with RunThese30M
    + JDK-8208277: Code cache heap (-XX:ReservedCodeCacheSize)
    doesn't work with 1GB LargePages
    + JDK-8209113: Use WeakReference for lastFontStrike for created
    Fonts
    + JDK-8209333: Socket reset issue for TLS 1.3 socket close
    + JDK-8209439: C2 library_call can potentially ignore Math.pow
    intrinsic or use null pointer
    + JDK-8209534: [TESTBUG]runtime/appcds/cacheObject/
    /ArchivedModuleCompareTest.java fails with EnableJVMCI.
    + JDK-8210147: adjust some WSAGetLastError usages in windows
    network coding
    + JDK-8210284: "assert((av &amp; 0x00000001) == 0) failed:
    unsupported V8" on Solaris 11.4
    + JDK-8210303: VM_HandshakeAllThreads fails assert with
    "failed: blocked and not walkable"
    + JDK-8210459: Add support for generating compile_commands.json
    + JDK-8210515: [TESTBUG]CheckArchivedModuleApp.java needs to
    check if EnableJVMCI is set.
    + JDK-8210788: Javadoc for Thread.join(long, int) should
    specify that it waits forever when both arguments are zero
    + JDK-8211301: [macos] support full window content options
    + JDK-8211332: Space for stub routines (code_size2) is too
    small on new Skylake CPUs
    + JDK-8211339: NPE during SSL handshake caused by
    HostnameChecker
    + JDK-8211392: compiler/profiling/
    /spectrapredefineclass_classloaders/Launcher.java times out
    in JDK12 CI
    + JDK-8211743: [AOT] crash in ScopeDesc::decode_body() when
    JVMTI walks AOT frames
    + JDK-8212154: [TESTBUG] CheckArchivedModuleApp fails with NPE
    when JVMCI is absent
    + JDK-8212167: JShell : Stack trace of exception has wrong line
    number
    + JDK-8212933: Thread-SMR: requesting a VM operation whilst
    holding a ThreadsListHandle can cause deadlocks
    + JDK-8212986: Make Visual Studio compiler check less strict
    + JDK-8213250: CDS archive creation aborts due to metaspace
    object allocation failure
    + JDK-8213516: jck test api/javax_accessibility/AccessibleState/
    /fields.html fails intermittent
    + JDK-8213947: ARM32: failed check_simd should set
    UsePopCountInstruction to false
    + JDK-8214418: half-closed SSLEngine status may cause
    application dead loop
    + JDK-8214440: ldap over a TLS connection negotiate failed with
    "javax.net.ssl.SSLPeerUnverifiedException: hostname of the
    server does not match the hostname in the server's
    certificate"
    + JDK-8214444: Wrong strncat limits in dfa.cpp
    + JDK-8214481: freetype path does not disable TrueType hinting
    with AA+FM hints
    + JDK-8214571: -Xdoclint of array serialField gives "error:
    array type not allowed here"
    + JDK-8214856: Errors with JSZip in web console after upgrade
    to 3.1.5
    + JDK-8214862: assert(proj != __null) at compile.cpp:3251
    + JDK-8215369: Jcstress pollute /var/tmp with temporary files.
    + JDK-8215551: Missing case label in nmethod::reloc_string_for()
    + JDK-8215555: TieredCompilation C2 threads can excessively
    block handshakes
    + JDK-8215711: Missing key_share extension for (EC)DHE key
    exchange should alert missing_extension
    + JDK-8216151: [Graal] Module
    jdk.internal.vm.compiler.management has not been granted
    accessClassInPackage.org.graalvm.compiler.debug
    + JDK-8216154: C4819 warnings at HotSpot sources on Windows
    + JDK-8216541: CompiledICHolders of VM locked unloaded nmethods
    are released too late
    + JDK-8217230: assert(t == t_no_spec) failure in
    NodeHash::check_no_speculative_types()
    + JDK-8217404: --with-jvm-features doesn't work when multiple
    features are explicitly disabled
    + JDK-8217447: Develop flag TraceICs is broken
    + JDK-8217606: LdapContext#reconnect always opens a new
    connection
    + JDK-8218807: Compilation database (compile_commands.json) may
    contain obsolete items
    + JDK-8219214: Infinite Loop in CodeSection::dump()
    + JDK-8219904: ClassCastException when calling
    FlightRecorderMXBean#getRecordings()
    + JDK-8219991: New fix of the deadlock in
    sun.security.ssl.SSLSocketImpl
    + JDK-8221121: applications/microbenchmarks are encountering
    crashes in tier5
    + JDK-8221445: FastSysexMessage constructor crashes MIDI
    receiption thread
    + JDK-8221482: Initialize VMRegImpl::regName[] earlier to
    prevent assert during PrintStubCode
    + JDK-8221741: ClassCastException can happen when
    fontconfig.properties is used
    + JDK-8221823: Requested JDialog width is ignored
    + JDK-8223108: Test java/awt/EventQueue/
    /NonComponentSourcePost.java is unstable
    + JDK-8223678: Add Visual Studio Code workspace generation
    support (for native code)
    + JDK-8223935: PIT: java/awt/font/WindowsIndicFonts.java fails
    on windows10
    + JDK-8224109: Text spaced incorrectly by drawString under
    rotation with fractional metric
    + JDK-8224632: testbug: java/awt/dnd/RemoveDropTargetCrashTest/
    /RemoveDropTargetCrashTest.java fails on MacOS
    + JDK-8224793: os::die() does not honor CreateCoredumpOnCrash
    option
    + JDK-8224847: gc/stress/TestReclaimStringsLeaksMemory.java
    fails with reserved greater than expected
    + JDK-8224931: disable JAOTC invokedynamic support until
    8223533 is fixed
    + JDK-8224997: ChaCha20-Poly1305 TLS cipher suite decryption
    throws ShortBufferException
    + JDK-8225068: Remove DocuSign root certificate that is
    expiring in May 2020
    + JDK-8225069: Remove Comodo root certificate that is expiring
    in May 2020
    + JDK-8225126: Test SetBoundsPaintTest.html faild on Windows
    when desktop is scaled
    + JDK-8225325: Add tests for redefining a class' private method
    during resolution of the bootstrap specifier
    + JDK-8225622: [AOT] runtime/SharedArchiveFile/
    /TestInterpreterMethodEntries.java crashed with AOTed
    java.base
    + JDK-8225653: Provide more information when hitting SIGILL
    from HaltNode
    + JDK-8225783: Incorrect use of binary operators on booleans in
    type.cpp
    + JDK-8225789: Empty method parameter type should generate
    ClassFormatError
    + JDK-8226198: use of &amp; instead of &amp;&amp; in
    LibraryCallKit::arraycopy_restore_alloc_state
    + JDK-8226253: JAWS reports wrong number of radio buttons when
    buttons are hidden.
    + JDK-8226653: [accessibility] Can edit text cell correctly,
    but Accessibility Tool reads nothing about editor
    + JDK-8226806: [macOS 10.14] Methods of Java Robot should be
    called from appropriate thread
    + JDK-8226879: Memory leak in Type::hashcons
    + JDK-8227632: Incorrect PrintCompilation message: made not
    compilable on levels 0 1 2 3 4
    + JDK-8228407: JVM crashes with shared archive file mismatch
    + JDK-8228482: fix xlc16/xlclang comparison of distinct pointer
    types and string literal conversion warnings
    + JDK-8228757: Fail fast if the handshake type is unknown
    + JDK-8229158: make UseSwitchProfiling non-experimental or
    false by-default
    + JDK-8229421: The logic of java/net/ipv6tests/TcpTest.java is
    flawed
    + JDK-8229855: C2 fails with assert(false) failed: bad AD file
    + JDK-8230591: AArch64: Missing intrinsics for Math.ceil,
    floor, rint
    + JDK-8231118: ARM32: Math tests failures
    + JDK-8231213: Migrate SimpleDateFormatConstTest to JDK Repo
    + JDK-8231243: [TESTBUG] CustomFont.java cannot find font file
    + JDK-8231438: [macOS] Dark mode for the desktop is not
    supported
    + JDK-8231550: C2: ShouldNotReachHere() in
    verify_strip_mined_scheduling
    + JDK-8231564: setMaximizedBounds is broken with large display
    scale and multiple monitors
    + JDK-8231572: Use -lobjc instead of -fobjc-link-runtime in
    libosxsecurity
    + JDK-8231631: sun/net/ftp/FtpURLConnectionLeak.java fails
    intermittently with NPE
    + JDK-8231671: Fix copyright headers in hotspot (missing comma
    after year)
    + JDK-8231720: Some perf regressions after 8225653
    + JDK-8231779: crash
    HeapWord*ParallelScavengeHeap::failed_mem_allocate
    + JDK-8231863: Crash if classpath is read from @argument file
    and the main gets option argument
    + JDK-8232080: jlink plugins for vendor information and
    run-time options
    + JDK-8232106: [x86] C2: SIGILL due to usage of SSSE3
    instructions on processors which don't support it
    + JDK-8232134: Change to Visual Studio 2017 15.9.16 for
    building on Windows at Oracle
    + JDK-8232226: [macos 10.15] test/jdk/java/awt/color/
    /EqualityTest/EqualityTest.java may fail
    + JDK-8232357: Compare version info of Santuario to legal notice
    + JDK-8232572: Add hooks for custom output dir in Bundles.gmk
    + JDK-8232634: Problem List ICMColorDataTest.java
    + JDK-8232748: Build static versions of certain JDK libraries
    + JDK-8232846: ProcessHandle.Info command with non-English
    shows question marks
    + JDK-8232880: Update test documentation with additional
    settings for client UI tooltip tests
    + JDK-8233033: C2 produces wrong result while unswitching a
    loop due to lost control dependencies
    + JDK-8233137: runtime/ErrorHandling/VeryEarlyAssertTest.java
    fails after 8232080
    + JDK-8233197: Invert JvmtiExport::post_vm_initialized() and
    Jfr:on_vm_start() start-up order for correct option parsing
    + JDK-8233291: [TESTBUG] tools/jlink/plugins/
    /VendorInfoPluginsTest.java fails with debug or non-server VMs
    + JDK-8233364: Fix undefined behavior in
    Canonicalizer::do_ShiftOp
    + JDK-8233494: Avoid calling MallocTracker::record_malloc and
    record_free when NMT is off
    + JDK-8233573: Toolkit.getScreenInsets(GraphicsConfiguration)
    may throw ClassCastException
    + JDK-8233608: Minimal build broken after JDK-8233494
    + JDK-8233621: Mismatch in jsse.enableMFLNExtension property
    name
    + JDK-8233696: [TESTBUG]Some jtreg tests fail when CAPS_LOCK is
    ON
    + JDK-8233707: systemScale.cpp could not compile with VS2019
    + JDK-8233801: GCMEmptyIv.java test fails on Solaris 11.4
    + JDK-8233880: Support compilers with multi-digit major version
    numbers
    + JDK-8233920: MethodHandles::tryFinally generates illegal
    bytecode for long/double return type
    + JDK-8234137: The "AutoTestOnTop.java" test may run external
    applications
    + JDK-8234146: compiler/jsr292/
    /ContinuousCallSiteTargetChange.java times out on SPARC
    + JDK-8234184: [TESTBUG] java/awt/Mouse/EnterExitEvents/
    /ModalDialogEnterExitEventsTest.java fails in Windows
    + JDK-8234270: [REDO] JDK-8204128 NMT might report incorrect
    numbers for Compiler area
    + JDK-8234332: [TESTBUG] java/awt/Focus/DisposedWindow/
    /DisposeDialogNotActivateOwnerTest/
    /DisposeDialogNotActivateOwnerTest.java fails on linux-x64
    nightly
    + JDK-8234398: Replace ID2D1Factory::GetDesktopDpi with
    GetDeviceCaps
    + JDK-8234522: [macos] Crash with use of native file dialog
    + JDK-8234691: Potential double-free in ParallelSPCleanupTask
    constructor
    + JDK-8234696: tools/jlink/plugins/VendorInfoPluginsTest.java
    times out
    + JDK-8234727: sun/security/ssl/X509TrustManagerImpl tests
    support TLSv1.3
    + JDK-8234728: Some security tests should support TLSv1.3
    + JDK-8234779: Provide idiom for declaring classes noncopyable
    + JDK-8234824: java/nio/channels/SocketChannel/AdaptSocket.java
    fails on Windows 10
    + JDK-8234968: check calloc rv in libinstrument
    InvocationAdapter
    + JDK-8235153: [TESTBUG] [macos 10.15] java/awt/Graphics/
    /DrawImageBG/SystemBgColorTest.java fails
    + JDK-8235183: Remove the "HACK CODE" in comment
    + JDK-8235263: Revert TLS 1.3 change that wrapped IOExceptions
    + JDK-8235311: Tag mismatch may alert bad_record_mac
    + JDK-8235332: TestInstanceCloneAsLoadsStores.java fails with
  - XX:+StressGCM
    + JDK-8235452: Strip mined loop verification fails with
    assert(is_OuterStripMinedLoop()) failed: invalid node class
    + JDK-8235584: UseProfiledLoopPredicate fails with
    assert(_phase-&gt;get_loop(c) == loop) failed: have to be in the
    same loop
    + JDK-8235620: Broken merge between JDK-8006406 and JDK-8003559
    + JDK-8235638: NPE in LWWindowPeer.getOnscreenGraphics()
    + JDK-8235686: Add more custom hooks in Bundles.gmk
    + JDK-8235739: Rare NPE at WComponentPeer.getGraphics()
    + JDK-8235762: JVM crash in SWPointer during C2 compilation
    + JDK-8235834: IBM-943 charset encoder needs updating
    + JDK-8235874: The ordering of Cipher Suites is not maintained
    provided through jdk.tls.client.cipherSuites and
    jdk.tls.server.cipherSuites system property.
    + JDK-8235908: omit ThreadPriorityPolicy warning when value is
    set from image
    + JDK-8235984: C2: assert(out-&gt;in(PhiNode::Region) == head ||
    out-&gt;in(PhiNode::Region) == slow_head) failed: phi must be
    either part of the slow or the fast loop
    + JDK-8236211: [Graal] compiler/graalunit/GraphTest.java is
    skipped in all testing
    + JDK-8236470: Deal with ECDSA using ecdsa-with-SHA2 plus hash
    algorithm as AlgorithmId
    + JDK-8236545: Compilation error in mach5
    java/awt/FileDialog/MacOSGoToFolderCrash.java
    + JDK-8236700: Upgrading JSZip from v3.1.5 to v3.2.2
    + JDK-8236759: ShouldNotReachHere in
    PhaseIdealLoop::verify_strip_mined_scheduling
    + JDK-8236897: Fix the copyright header for pkcs11gcm2.h
    + JDK-8236921: Add build target to produce a JDK image suitable
    for a Graal/SVM build
    + JDK-8236953: [macos] JavaFX SwingNode is not rendered on macOS
    + JDK-8236996: Incorrect Roboto font rendering on Windows with
    subpixel antialiasing
    + JDK-8237045: JVM uses excessive memory with -XX:+EnableJVMCI
  - XX:JVMCICounterSize=2147483648
    + JDK-8237055: [TESTBUG] compiler/c2/TestJumpTable.java fails
    with release VMs
    + JDK-8237086: assert(is_MachReturn()) running CTW with fix for
    JDK-8231291
    + JDK-8237192: Generate stripped/public pdbs on Windows for jdk
    images
    + JDK-8237396: JvmtiTagMap::weak_oops_do() should not trigger
    barriers
    + JDK-8237474: Default SSLEngine should create in server role
    + JDK-8237859: C2: Crash when loads float above range check
    + JDK-8237879: make 4.3 breaks build
    + JDK-8237951: CTW: C2 compilation fails with "malformed
    control flow"
    + JDK-8237962: give better error output for invalid OCSP
    response intervals in CertPathValidator checks
    + JDK-8238190: [JVMCI] Fix single implementor speculation for
    diamond shapes.
    + JDK-8238356: CodeHeap::blob_count() overestimates the number
    of blobs
    + JDK-8238452: Keytool generates wrong expiration date if
    validity is set to 2050/01/01
    + JDK-8238555: Allow Initialization of SunPKCS11 with NSS when
    there are external FIPS modules in the NSSDB
    + JDK-8238575: DragSourceEvent.getLocation() returns wrong
    value on HiDPI screens (Windows)
    + JDK-8238676: jni crashes on accessing it from process exit
    hook
    + JDK-8238721: Add failing client jtreg tests to the Problem
    List
    + JDK-8238738: AudioSystem.getMixerInfo() takes about 30 sec to
    report a gone audio device
    + JDK-8238756: C2: assert(((n) == __null || !VerifyIterativeGVN
    || !((n)-&gt;is_dead()))) failed: can not use dead node
    + JDK-8238765: PhaseCFG::schedule_pinned_nodes cannot handle
    precedence edges from unmatched CFG nodes correctly
    + JDK-8238898: Missing hash characters for header on license
    file
    + JDK-8238942: Rendering artifacts with LCD text and fractional
    metrics
    + JDK-8238985: [TESTBUG] The arrow image is blue instead of
    green
    + JDK-8239000: handle ContendedPaddingWidth in vm_version_ppc
    + JDK-8239055: Wrong implementation of VMState.hasListener
    + JDK-8239091: Reversed arguments in call to strstr in freetype
    "debug" code.
    + JDK-8239142: C2's UseUniqueSubclasses optimization is broken
    for array accesses
    + JDK-8239224: libproc_impl.c previous_thr may be used
    uninitialized warning
    + JDK-8239351: Give more meaningful InternalError messages in
    Deflater.c
    + JDK-8239365: ProcessBuilder test modifications for AIX
    execution
    + JDK-8239456: vtable stub generation: assert failure (code
    size estimate)
    + JDK-8239457: call ReleaseStringUTFChars before early returns
    in Java_sun_security_pkcs11_wrapper_PKCS11_connect
    + JDK-8239462: jdk.hotspot.agent misses some
    ReleaseStringUTFChars calls in case of early returns
    + JDK-8239557: [TESTBUG] VeryEarlyAssertTest.java validating
    "END." marker at lastline is not always true
    + JDK-8239787: AArch64: String.indexOf may incorrectly handle
    empty strings
    + JDK-8239792: Bump update version for OpenJDK: jdk-11.0.8
    + JDK-8239798: SSLSocket closes socket both socket endpoints on
    a SocketTimeoutException
    + JDK-8239819: XToolkit: Misread of screen information memory
    + JDK-8239852: java/util/concurrent tests fail with
  - XX:+VerifyGraphEdges: assert(!VerifyGraphEdges) failed:
    verification should have failed
    + JDK-8239893: Windows handle Leak when starting processes
    using ProcessBuilder
    + JDK-8239915: Zero VM crashes when handling dynamic constant
    + JDK-8239931: [win][x86] vtable stub generation: assert
    failure (code size estimate) follow-up
    + JDK-8239965: XMLEncoder/Test4625418.java fails due to "Error:
    Cp943 - can't read properly"
    + JDK-8239976: Put JDK-8239965 on the ProblemList.txt
    + JDK-8240073: Fix 'test-make' build target in 11u
    + JDK-8240197: Cannot start JVM when $JAVA_HOME includes CJK
    characters
    + JDK-8240202: A few client tests leave mouse buttons pressed
    + JDK-8240220: IdealLoopTree::dump_head predicate printing is
    broken
    + JDK-8240223: Use consistent predicate order in and with
    PhaseIdealLoop::find_predicate
    + JDK-8240227: Loop predicates should be copied to unswitched
    loops
    + JDK-8240286: [TESTBUG] Test command error in hotspot/jtreg/
    /compiler/loopopts/superword/SumRedAbsNeg_Float.java
    + JDK-8240518: Incorrect JNU_ReleaseStringPlatformChars in
    Windows Print
    + JDK-8240529: CheckUnhandledOops breaks NULL check in
    Modules::define_module
    + JDK-8240576: JVM crashes after transformation in C2
    IdealLoopTree::merge_many_backedges
    + JDK-8240603: Windows 32bit compile error after 8238676
    + JDK-8240629: argfiles parsing broken for argfiles with
    comment cross 4096 bytes chunk
    + JDK-8240711: TestJstatdPort.java failed due to
    "ExportException: Port already in use:"
    + JDK-8240786: [TESTBUG] The test java/awt/Window/
    /GetScreenLocation/GetScreenLocationTest.java fails on HiDPI
    screen
    + JDK-8240824: enhance print_full_memory_info on Linux by THP
    related information
    + JDK-8240827: Downport SSLSocketImpl.java from "8221882: Use
    fiber-friendly java.util.concurrent.locks in JSSE"
    + JDK-8240905: assert(mem == (Node*)1 || mem == mem2) failed:
    multiple Memories being matched at once?
    + JDK-8240972: macOS codesign fail on macOS 10.13.5 or older
    + JDK-8241445: Fix copyright in
    test/jdk/tools/launcher/ArgFileSyntax.java
    + JDK-8241458: [JVMCI] add mark value to expose
    CodeOffsets::Frame_Complete
    + JDK-8241464: [11u] Backport: make rehashing be a needed
    guaranteed safepoint cleanup action
    + JDK-8241556: Memory leak if -XX:CompileCommand is set
    + JDK-8241568: (fs) UserPrincipalLookupService.lookupXXX
    failure with IOE "Operation not permitted"
    + JDK-8241586: compiler/cpuflags/
    /TestAESIntrinsicsOnUnsupportedConfig.java fails on aarch64
    + JDK-8241638: launcher time metrics always report 1 on Linux
    when _JAVA_LAUNCHER_DEBUG set
    + JDK-8241660: Add virtualization information output to hs_err
    file on macOS
    + JDK-8241808: [TESTBUG] The JDK-8039467 bug appeared on macOS
    + JDK-8241888: Mirror jdk.security.allowNonCaAnchor system
    property with a security one
    + JDK-8241900: Loop unswitching may cause dependence on null
    check to be lost
    + JDK-8241948: enhance list of environment variables printed in
    hs_err file
    + JDK-8241996: on linux set full relro in the linker flags
    + JDK-8242108: Performance regression after fix for JDK-8229496
    + JDK-8242141: New System Properties to configure the TLS
    signature schemes
    + JDK-8242154: Backport parts of JDK-4947890 to OpenJDK 11u
    + JDK-8242174: [macos] The NestedModelessDialogTest test make
    the macOS unstable
    + JDK-8242239: [Graal] javax/management/generified/
    /GenericTest.java fails: FAILED: queryMBeans sets same
    + JDK-8242294: JSSE Client does not throw SSLException when an
    alert occurs during handshaking
    + JDK-8242379: [TESTBUG] compiler/loopopts/
    /TestLoopUnswitchingLostCastDependency.java fails with
    release VMs
    + JDK-8242470: Update Xerces to Version 2.12.1
    + JDK-8242498: Invalid "sun.awt.TimedWindowEvent" object leads
    to JVM crash
    + JDK-8242541: Small charset issues (ISO8859-16, x-eucJP-Open,
    x-IBM834 and x-IBM949C)
    + JDK-8242626: enhance posix print_rlimit_info
    + JDK-8243059: Build fails when --with-vendor-name contains a
    comma
    + JDK-8243539: Copyright info (Year) should be updated for fix
    of 8241638
    + JDK-8243541: (tz) Upgrade time-zone data to tzdata2020a
    + JDK-8244407: JVM crashes after transformation in C2
    IdealLoopTree::split_fall_in
    + JDK-8244520: problemlist
    java/awt/font/Rotate/RotatedFontTest.java on linux
    + JDK-8244777: ClassLoaderStats VM Op uses constant hash value
    + JDK-8244853: The static build of libextnet is missing the
    JNI_OnLoad_extnet function
    + JDK-8244951: Missing entitlements for hardened runtime
    + JDK-8245047: [PPC64] C2: ReverseBytes + Load always match to
    unordered Load (acquire semantics missing)
    + JDK-8245649: Revert 8245397 backport of 8230591
    + JDK-8246031: SSLSocket.getSession() doesn't close connection
    for timeout/ interrupts
    + JDK-8246613: Choose the default SecureRandom algo based on
    registration ordering
    + JDK-8248505: Unexpected NoSuchAlgorithmException when using
    secure random impl from BCFIPS provider
- Removed patch:
  * JDK-8228407.patch
    + integrated upstream</changelog>
  <changelog author="fstrba@suse.com" date="1604318400">- Update to upstream tag jdk-11.0.9-11 (October 2020 CPU,
  bsc#1177943)
  * New features
    + JDK-8250784: Shenandoah: A Low-Pause-Time Garbage Collector
  * Security fixes
    + JDK-8233624: Enhance JNI linkage
    + JDK-8236196: Improve string pooling
    + JDK-8236862, CVE-2020-14779: Enhance support of Proxy class
    + JDK-8237990, CVE-2020-14781: Enhanced LDAP contexts
    + JDK-8237995, CVE-2020-14782: Enhance certificate processing
    + JDK-8240124: Better VM Interning
    + JDK-8241114, CVE-2020-14792: Better range handling
    + JDK-8242680, CVE-2020-14796: Improved URI Support
    + JDK-8242685, CVE-2020-14797: Better Path Validation
    + JDK-8242695, CVE-2020-14798: Enhanced buffer support
    + JDK-8243302: Advanced class supports
    + JDK-8244136, CVE-2020-14803: Improved Buffer supports
    + JDK-8244479: Further constrain certificates
    + JDK-8244955: Additional Fix for JDK-8240124
    + JDK-8245407: Enhance zoning of times
    + JDK-8245412: Better class definitions
    + JDK-8245417: Improve certificate chain handling
    + JDK-8248574: Improve jpeg processing
    + JDK-8249927: Specify limits of jdk.serialProxyInterfaceLimit
    + JDK-8253019: Enhanced JPEG decoding
  * Other changes
    + JDK-6532025: GIF reader throws misleading exception with
    truncated images
    + JDK-6949753: [TEST BUG]: java/awt/print/PageFormat/
    /PDialogTest.java needs update by removing an infinite loop
    + JDK-8022535: [TEST BUG] javax/swing/text/html/parser/
    /Test8017492.java fails
    + JDK-8062947: Fix exception message to correctly represent
    LDAP connection failure
    + JDK-8067354: com/sun/jdi/GetLocalVariables4Test.sh failed
    + JDK-8134599: TEST_BUG: java/rmi/transport/closeServerSocket/
    /CloseServerSocket.java fails intermittently with Address
    already in use
    + JDK-8151678: com/sun/jndi/ldap/LdapTimeoutTest.java failed
    due to timeout on DeadServerNoTimeoutTest is incorrect
    + JDK-8160768: Add capability to custom resolve host/domain
    names within the default JNDI LDAP provider
    + JDK-8172404: Tools should warn if weak algorithms are used
    before restricting them
    + JDK-8193367: Annotated type variable bounds crash javac
    + JDK-8202117: com/sun/jndi/ldap/RemoveNamingListenerTest.java
    fails intermittently: Connection reset
    + JDK-8203026: java.rmi.NoSuchObjectException: no such object
    in table
    + JDK-8203281: [Windows] JComboBox change in ui when
    editor.setBorder() is called
    + JDK-8203382: Rename SystemDictionary::initialize_wk_klass to
    resolve_wk_klass
    + JDK-8203393: com/sun/jdi/JdbMethodExitTest.sh and
    JdbExprTest.sh fail due to timeout
    + JDK-8203928: [Test] Convert non-JDB scaffolding
    serviceability shell script tests to java
    + JDK-8204963: javax.swing.border.TitledBorder has a memory leak
    + JDK-8204994: SA might fail to attach to process with "Windbg
    Error: WaitForEvent failed"
    + JDK-8205534: Remove SymbolTable dependency from
    serviceability agent
    + JDK-8206309: Tier1 SA tests fail
    + JDK-8208281: java/nio/channels/
    /AsynchronousSocketChannel/Basic.java timed out
    + JDK-8209109: [TEST] rewrite com/sun/jdi shell tests to java
    version - step1
    + JDK-8209332: [TEST] test/jdk/com/sun/jdi/CatchPatternTest.sh
    is incorrect
    + JDK-8209342: Problemlist SA tests on Solaris due to Error
    attaching to process: Can't create thread_db agent!
    + JDK-8209343: Test javax/swing/border/TestTitledBorderLeak.java
    should be marked as headful
    + JDK-8209517: com/sun/jdi/BreakpointWithFullGC.java fails with
    timeout
    + JDK-8209604: [TEST] rewrite com/sun/jdi shell tests to java
    version - step2
    + JDK-8209605: com/sun/jdi/BreakpointWithFullGC.java fails with
    ZGC
    + JDK-8209608: Problem list com/sun/jdi/BreakpointWithFullGC.java
    + JDK-8210131: vmTestbase/nsk/jvmti/scenarios/allocation/AP10/
    /ap10t001/TestDescription.java failed with ObjectFree:
    GetCurrentThreadCpuTimerInfo returned unexpected error code
    + JDK-8210243: [TEST] rewrite com/sun/jdi shell tests to java
    version - step3
    + JDK-8210527: JShell: NullPointerException in
    jdk.jshell.Eval.translateExceptionStack
    + JDK-8210560: [TEST] convert com/sun/jdi redefineClass-related
    tests
    + JDK-8210725: com/sun/jdi/RedefineClearBreakpoint.java fails
    with waitForPrompt timed out after 60 seconds
    + JDK-8210748: [TESTBUG] lib.jdb.Jdb.waitForPrompt() should
    clarify which output is the pending reply after a timeout
    + JDK-8210760: [TEST] rewrite com/sun/jdi shell tests to java
    version - step4
    + JDK-8210977: jdk/jfr/event/oldobject/TestThreadLocalLeak.java
    fails to find ThreadLocalObject
    + JDK-8211292: [TEST] convert com/sun/jdi/DeferredStepTest.sh
    test
    + JDK-8211694: JShell: Redeclared variable should be reset
    + JDK-8212200: assert when shared java.lang.Object is redefined
    by JVMTI agent
    + JDK-8212629: [TEST] wrong breakpoint in
    test/jdk/com/sun/jdi/DeferredStepTest
    + JDK-8212665: com/sun/jdi/DeferredStepTest.java: jj1 (line 57)
  - unexpected. lastLine=52, minLine=52, maxLine=55
    + JDK-8212807: tools/jar/multiRelease/Basic.java times out
    + JDK-8213182: Minimal VM build failure after JDK-8212200
    (assert when shared java.lang.Object is redefined by JVMTI
    agent)
    + JDK-8213214: Set -Djava.io.tmpdir= when running tests
    + JDK-8213275: ReplaceCriticalClasses.java fails with
    jdk.internal.vm.PostVMInitHook not found
    + JDK-8213574: Deadlock in string table expansion when dumping
    lots of CDS classes
    + JDK-8213703: LambdaConversionException: Invalid receiver type
    not a subtype of implementation type interface
    + JDK-8214074: Ghash optimization using AVX instructions
    + JDK-8214491: Upgrade to JLine 3.9.0
    + JDK-8214797: TestJmapCoreMetaspace.java timed out
    + JDK-8215243: JShell tests failing intermitently with
    "Problem cleaning up the following threads:"
    + JDK-8215244: jdk/jshell/ToolBasicTest.java
    testHistoryReference failed
    + JDK-8215354: x86_32 build failures after JDK-8214074 (Ghash
    optimization using AVX instructions)
    + JDK-8215438: jshell tool: Ctrl-D causes EOF
    + JDK-8216021: RunTest.gmk might set concurrency level to 1 on
    Windows
    + JDK-8216974: HttpConnection not returned to the pool after
    204 response
    + JDK-8218948: SimpleDateFormat :: format - Zone Names are not
    reflected correctly during run time
    + JDK-8219712: code_size2 (defined in stub_routines_x86.hpp) is
    too small on new Skylake CPUs
    + JDK-8220150: macos10.14 Mojave returns anti-aliased glyphs
    instead of aliased B&amp;W glyphs
    + JDK-8221658: aarch64: add necessary predicate for ubfx
    patterns
    + JDK-8221759: Crash when completing "java.io.File.path"
    + JDK-8221918: runtime/SharedArchiveFile/serviceability/
    /ReplaceCriticalClasses.java fails: Shared archive not found
    + JDK-8222074: Enhance auto vectorization for x86
    + JDK-8222079: Don't use memset to initialize fields decode_env
    constructor in disassembler.cpp
    + JDK-8222769: [TESTBUG] TestJFRNetworkEvents should not rely
    on hostname command
    + JDK-8223688: JShell: crash on the instantiation of raw
    anonymous class
    + JDK-8223777: In posix_spawn mode, failing to exec()
    jspawnhelper does not result in an error
    + JDK-8223940: Private key not supported by chosen signature
    algorithm
    + JDK-8224184: jshell got IOException at exiting with AIX
    + JDK-8224234: compiler/codegen/TestCharVect2.java fails in
    test_mulc
    + JDK-8225037: java.net.JarURLConnection::getJarEntry() throws
    NullPointerException
    + JDK-8225625: AES Electronic Codebook (ECB) encryption and
    decryption optimization using AVX512 + VAES instructions
    + JDK-8226536: Catch OOM from deopt that fails rematerializing
    objects
    + JDK-8226575: OperatingSystemMXBean should be made container
    aware
    + JDK-8226697: Several tests which need the @key headful
    keyword are missing it.
    + JDK-8226809: Circular reference in printed stack trace is not
    correctly indented &amp; ambiguous
    + JDK-8227059: sun/security/tools/keytool/
    /DefaultSignatureAlgorithm.java timed out
    + JDK-8227269: Slow class loading when running with JDWP
    + JDK-8227595: keytool/fakegen/DefaultSignatureAlgorithm.java
    fails due to "exitValue = 6"
    + JDK-8228448: Jconsole can't connect to itself
    + JDK-8228967: Trust/Key store and SSL context utilities for
    tests
    + JDK-8229378: jdwp library loader in linker_md.c quietly
    truncates on buffer overflow
    + JDK-8229815: Upgrade Jline to 3.12.1
    + JDK-8230000: some httpclients testng tests run zero test
    + JDK-8230002: javax/xml/jaxp/unittest/transform/
    /SecureProcessingTest.java runs zero test
    + JDK-8230010: Remove jdk8037819/BasicTest1.java
    + JDK-8230094: CCE in createXMLEventWriter(Result) over an
    arbitrary XMLStreamWriter
    + JDK-8230402: Allocation of compile task fails with assert:
    "Leaking compilation tasks?"
    + JDK-8230767: FlightRecorderListener returns null recording
    + JDK-8230870: (zipfs) Add a ZIP FS test that is similar to
    test/jdk/java/util/zip/EntryCount64k.java
    + JDK-8231209: [REDO] ThreadMXBean::getThreadAllocatedBytes()
    can be quicker for self thread
    + JDK-8231586: enlarge encoding space for OopMapValue offsets
    + JDK-8231953: Wrong assumption in assertion in
    oop::register_oop
    + JDK-8231968: getCurrentThreadAllocatedBytes default
    implementation s/b getThreadAllocatedBytes
    + JDK-8232083: Minimal VM is broken after JDK-8231586
    + JDK-8232161: Align some one-way conversion in MS950 charset
    with Windows
    + JDK-8232855: jshell missing word in /help help
    + JDK-8233027: OopMapSet::all_do does oms.next() twice during
    iteration
    + JDK-8233228: Disable weak named curves by default in TLS,
    CertPath, and Signed JAR
    + JDK-8233386: Initialize NULL fields for unused decorations
    + JDK-8233452: java.math.BigDecimal.sqrt() with
    RoundingMode.FLOOR results in incorrect result
    + JDK-8233686: XML transformer uses excessive amount of memory
    + JDK-8233741: AES Countermode (AES-CTR) optimization using
    AVX512 + VAES instructions
    + JDK-8233829: javac cannot find non-ASCII module name under
    non-UTF8 environment
    + JDK-8233958: Memory retention due to HttpsURLConnection
    finalizer that serves no purpose
    + JDK-8234011: (zipfs) Memory leak in
    ZipFileSystem.releaseDeflater()
    + JDK-8234058: runtime/CompressedOops/
    /CompressedClassPointers.java fails with 'Narrow klass base:
    0x0000000000000000' missing from stdout/stderr
    + JDK-8234149: Several regression tests do not dispose Frame at
    end
    + JDK-8234347: "Turkey" meta time zone does not generate
    composed localized names
    + JDK-8234385: [TESTBUG] java/awt/EventQueue/6980209/
    /bug6980209.java fails in linux nightly
    + JDK-8234535: Cross compilation fails due to missing CFLAGS
    for the BUILD_CC
    + JDK-8234541: C1 emits an empty message when it inlines
    successfully
    + JDK-8234687: change javap reporting on unknown attributes
    + JDK-8236464: SO_LINGER option is ignored by SSLSocket in JDK
    11
    + JDK-8236548: Localized time zone name inconsistency between
    English and other locales
    + JDK-8236617: jtreg test containers/docker/
    /TestMemoryAwareness.java fails after 8226575
    + JDK-8237182: Update copyright header for shenandoah and
    epsilon files
    + JDK-8237888: security/infra/java/security/cert/
    /CertPathValidator/certification/LuxTrustCA.java fails when
    checking validity interval
    + JDK-8237977: Further update
    javax/net/ssl/compatibility/Compatibility.java
    + JDK-8238270: java.net HTTP/2 client does not decrease stream
    count when receives 204 response
    + JDK-8238284: [macos] Zero VM build fails due to an obvious
    typo
    + JDK-8238380: java.base/unix/native/libjava/childproc.c
    "multiple definition" link errors with GCC10
    + JDK-8238386: (sctp) jdk.sctp/unix/native/libsctp/SctpNet.c
    "multiple definition" link errors with GCC10
    + JDK-8238388: libj2gss/NativeFunc.o "multiple definition" link
    errors with GCC10
    + JDK-8238448: RSASSA-PSS signature verification fail when
    using certain odd key sizes
    + JDK-8238710: LingeredApp doesn't log stdout/stderr if exits
    with non-zero code
    + JDK-8239083: C1 assert(known_holder == NULL ||
    (known_holder-&gt;is_instance_klass() &amp;&amp;
    (!known_holder-&gt;is_interface() ||
    ((ciInstanceKlass*)known_holder)-&gt;has_nonstatic_concrete_methods())),
    "should be non-static concrete method");
    + JDK-8239385: KerberosTicket client name refers wrongly to
    sAMAccountName in AD
    + JDK-8240169: javadoc fails to link to non-modular api docs
    + JDK-8240295: hs_err elapsed time in seconds is not accurate
    enough
    + JDK-8240360: NativeLibraryEvent has wrong library name on
    Linux
    + JDK-8240676: Meet not symmetric failure when running lucene
    on jdk8
    + JDK-8241007: Shenandoah: remove
    ShenandoahCriticalControlThreadPriority support
    + JDK-8241065: Shenandoah: remove leftover code after
    JDK-8231086
    + JDK-8241086: Test runtime/NMT/HugeArenaTracking.java is
    failing on 32bit Windows
    + JDK-8241130: com.sun.jndi.ldap.EventSupport.removeDeadNotifier:
    java.lang.NullPointerException
    + JDK-8241138: http.nonProxyHosts=* causes
    StringIndexOutOfBoundsException in DefaultProxySelector
    + JDK-8241319: WB_GetCodeBlob doesn't have ResourceMark
    + JDK-8241478: vmTestbase/gc/gctests/Steal/steal001/steal001.java
    fails with OOME
    + JDK-8241574: Shenandoah: remove ShenandoahAssertToSpaceClosure
    + JDK-8241750: x86_32 build failure after JDK-8227269
    + JDK-8242184: CRL generation error with RSASSA-PSS
    + JDK-8242283: Can't start JVM when java home path includes
    non-ASCII character
    + JDK-8242556: Cannot load RSASSA-PSS public key with non-null
    params from byte array
    + JDK-8243029: Rewrite javax/net/ssl/compatibility/
    /Compatibility.java with a flexible interop test framework
    + JDK-8243138: Enhance BaseLdapServer to support starttls
    extended request
    + JDK-8243320: Add SSL root certificates to Oracle Root CA
    program
    + JDK-8243321: Add Entrust root CA - G4 to Oracle Root CA
    program
    + JDK-8243389: enhance os::pd_print_cpu_info on linux
    + JDK-8243453: java --describe-module failed with non-ASCII
    module name under non-UTF8 environment
    + JDK-8243470: [macos] bring back O2 opt level for unsafe.cpp
    + JDK-8243489: Thread CPU Load event may contain wrong data for
    CPU time under certain conditions
    + JDK-8243925: Toolkit#getScreenInsets() returns wrong value on
    HiDPI screens (Windows)
    + JDK-8244087: 2020-04-24 public suffix list update
    + JDK-8244151: Update MUSCLE PC/SC-Lite headers to the latest
    release 1.8.26
    + JDK-8244164: AArch64: jaotc generates incorrect code for
    compressed OOPs with non-zero heap base
    + JDK-8244196: adjust output in os_linux
    + JDK-8244225: stringop-overflow warning on strncpy call from
    compile_the_world_in
    + JDK-8244287: JFR: Methods samples have line number 0
    + JDK-8244703: "platform encoding not initialized" exceptions
    with debugger, JNI
    + JDK-8244719: CTW: C2 compilation fails with
    "assert(!VerifyHashTableKeys || _hash_lock == 0) failed:
    remove node from hash table before modifying it"
    + JDK-8244729: Shenandoah: remove resolve paths from
    SBSA::generate_shenandoah_lrb
    + JDK-8244763: Update --release 8 symbol information after JSR
    337 MR3
    + JDK-8244818: Java2D Queue Flusher crash while moving
    application window to external monitor
    + JDK-8245151: jarsigner should not raise duplicate warnings on
    verification
    + JDK-8245616: Bump update version for OpenJDK: jdk-11.0.9
    + JDK-8245714: "Bad graph detected in build_loop_late" when
    loads are pinned on loop limit check uncommon branch
    + JDK-8245801: StressRecompilation triggers assert "redundunt
    OSR recompilation detected. memory leak in CodeCache!"
    + JDK-8245832: JDK build make-static-libs should build all JDK
    libraries
    + JDK-8245880: Shenandoah: check class unloading flag early in
    concurrent code root scan
    + JDK-8245981: Upgrade to jQuery 3.5.1
    + JDK-8246027: Minimal fastdebug build broken after JDK-8245801
    + JDK-8246094: [macos] Sound Recording and playback is not
    working
    + JDK-8246153: TestEliminateArrayCopy fails with
  - XX:+StressReflectiveCode
    + JDK-8246193: Possible NPE in ENC-PA-REP search in AS-REQ
    + JDK-8246196: javax/management/MBeanServer/OldMBeanServerTest
    fails with AssertionError
    + JDK-8246203: Segmentation fault in verification due to stack
    overflow with -XX:+VerifyIterativeGVN
    + JDK-8246330: Add TLS Tests for Legacy ECDSA curves
    + JDK-8246453: TestClone crashes with "all collected exceptions
    must come from the same place"
    + JDK-8247246: Add explicit ResolvedJavaType.link and expose
    presence of default methods
    + JDK-8247350: [aarch64] assert(false) failed: wrong size of
    mach node
    + JDK-8247502: PhaseStringOpts crashes while optimising
    effectively dead code
    + JDK-8247615: Initialize the bytes left for the heap sampler
    + JDK-8247824: CTW: C2 (Shenandoah) compilation fails with SEGV
    in SBC2Support::pin_and_expand
    + JDK-8247874: Replacement in VersionProps.java.template not
    working when --with-vendor-bug-url contains '&amp;'
    + JDK-8247979: aarch64: missing side effect of killing flags
    for clearArray_reg_reg
    + JDK-8248214: Add paddings for TaskQueueSuper to reduce
    false-sharing cache contention
    + JDK-8248219: aarch64: missing memory barrier in
    fast_storefield and fast_accessfield
    + JDK-8248348: Regression caused by the update to BCEL 6.0
    + JDK-8248385: [testbug][11u] Adapt TestInitiExceptions to
    jtreg 5.1
    + JDK-8248495: [macos] zerovm is broken due to libffi headers
    location
    + JDK-8248851: CMS: Missing memory fences between free chunk
    check and klass read
    + JDK-8248987: AOT's Linker.java seems to eagerly fail-fast on
    Windows
    + JDK-8249159: Downport test rework for SSLSocketTemplate from
    8224650
    + JDK-8249215: JFrame::setVisible crashed with
  - Dfile.encoding=UTF-8 on Japanese Windows.
    + JDK-8249251: [dark_mode ubuntu 20.04] The selected menu is
    not highlighted in GTKLookAndFeel
    + JDK-8249255: Build fails if source code in cygwin home dir
    + JDK-8249277: TestVerifyIterativeGVN.java is failing with
    timeout in OpenJDK 11
    + JDK-8249278: Revert JDK-8226253 which breaks the spec of
    AccessibleState.SHOWING for JList
    + JDK-8249560: Shenandoah: Fix racy GC request handling
    + JDK-8249801: Shenandoah: Clear soft-refs on requested GC cycle
    + JDK-8249953: Shenandoah: gc/shenandoah/mxbeans tests should
    account for corner cases
    + JDK-8250582: Revert Principal Name type to NT-UNKNOWN when
    requesting TGS Kerberos tickets
    + JDK-8250609: C2 crash in IfNode::fold_compares
    + JDK-8250627: Use -XX:+/-UseContainerSupport for
    enabling/disabling Java container metrics
    + JDK-8250755: Better cleanup for
    jdk/test/javax/imageio/plugins/shared/CanWriteSequence.java
    + JDK-8250787: Provider.put no longer registering aliases in
    FIPS env
    + JDK-8250826: jhsdb does not work with coredump which comes
    from Substrate VM
    + JDK-8250827: Shenandoah: needs to reset/finish StringTable's
    dead count before/after parallel walk
    + JDK-8250844: Make sure {type,obj}ArrayOopDesc accessors check
    the bounds
    + JDK-8251117: Cannot check P11Key size in P11Cipher and
    P11AEADCipher
    + JDK-8251354: Shenandoah: Fix jdk/jfr/tool/TestPrintJSON.java
    test failure
    + JDK-8251451: Shenandoah: Remark ObjectSynchronizer roots with
    I-U
    + JDK-8251469: Better cleanup for
    test/jdk/javax/imageio/SetOutput.java
    + JDK-8251487: Shenandoah: missing detail timing tracking for
    final mark cleaning phase
    + JDK-8252120: compiler/oracle/TestCompileCommand.java
    misspells "occured"
    + JDK-8252157: JDK-8231209 11u backport breaks jmm binary
    compatibility
    + JDK-8252258: [11u] JDK-8242154 changes the default vendor
    + JDK-8252804: [test] Fix 'ReleaseDeflater.java' test after
    downport of 8234011
    + JDK-8253134: JMM_VERSION should remain at 0x20020000 (JDK 10)
    in JDK 11
    + JDK-8253283: [11u] Test build/translations/
    /VerifyTranslations.java failing after JDK-8252258
    + JDK-8253813: Backout JDK-8244287 from 11u: it causes several
    crashes
- Removed patch:
  * gcc-fno-common-fix.patch
    + not needed any more with this version
- Added patch:
  * JDK-8250861.patch
    + Fix regression "8250861: Crash in MinINode::Ideal(PhaseGVN*,
    bool)" introduced in jdk 11.0.9</changelog>
  <changelog author="fstrba@suse.com" date="1604491200">- Enable Sheandoah GC for x86_64 (jsc#ECO-3171)</changelog>
  <changelog author="fstrba@suse.com" date="1605528000">- Update to upstream tag jdk-11.0.9.1-1
  * Fix:
    + JDK-8250861: Crash in MinINode::Ideal(PhaseGVN*, bool)
- Removed patch:
  * JDK-8250861.patch
    + Integrated upstream</changelog>
  <changelog author="fstrba@suse.com" date="1611230400">- Update to upstream tag jdk-11.0.10+9 (January 2021 CPU,
  bsc#1181239)
  * Security fixes
    + JDK-8247619: Improve Direct Buffering of Characters
  * Other changes
    + JDK-6722928: Support SSPI as a native GSS-API provider
    + JDK-7185258: [macosx] Deadlock in SunToolKit.realSync()
    + JDK-8152332: [macosx] JFileChooser cannot be serialized on
    Mac OS X
    + JDK-8161684: [testconf] Add VerifyOops' testing into compiler
    tiers
    + JDK-8171279: Support X25519 and X448 in TLS
    + JDK-8173361: various crashes in
    JvmtiExport::post_compiled_method_load
    + JDK-8173658: JvmtiExport::post_class_unload() is broken for
    non-JavaThread initiators
    + JDK-8191006: hsdis disassembler plugin does not compile with
    binutils 2.29+
    + JDK-8197981: Missing return statement in
    __sync_val_compare_and_swap_8
    + JDK-8198334: java/awt/FileDialog/8003399/bug8003399.java
    fails in headless mode
    + JDK-8200151: Add 8 JNDI tests to com/sun/jndi/dns/ConfigTests/
    + JDK-8208279: Add 8 JNDI tests to com/sun/jndi/dns/EnvTests/
    + JDK-8208483: Add 5 JNDI tests to
    com/sun/jndi/dns/FactoryTests/
    + JDK-8208542: Add 4 JNDI tests to com/sun/jndi/dns/ListTests/
    + JDK-8208665: Amend cross-compilation docs with
    qemu-debootstrap recipe
    + JDK-8210088: ProblemList gc/epsilon/TestMemoryMXBeans.java
    + JDK-8210339: Add 10 JNDI tests to com/sun/jndi/dns/FedTests/
    + JDK-8211450: UndetVar::dup is not copying the kind field to
    the duplicated instance
    + JDK-8212160: JVMTI agent crashes with "assert(_value != 0LL)
    failed: resolving NULL _value"
    + JDK-8212226: SurfaceManager throws "Invalid Image variant"
    for MultiResolutionImage (Windows)
    + JDK-8213400: Support choosing group name in keytool keypair
    generation
    + JDK-8213535: Windows HiDPI html lightweight tooltips are
    truncated
    + JDK-8213698: Improve devkit creation and add support for
    linux/ppc64/ppc64le/s390x
    + JDK-8214025: assert(t-&gt;singleton()) failed: must be a
    constant when ScavengeRootsInCode &lt; 2
    + JDK-8214242: compiler/arguments/TestScavengeRootsInCode.java
    fails because of missing UnlockDiagnosticVMOptions
    + JDK-8214787: Zero builds fail with "undefined
    JavaThread::thread_state()"
    + JDK-8215583: Exclude
    runtime/handshake/HandshakeWalkSuspendExitTest.java
    + JDK-8216012: Infinite loop in RSA KeyPairGenerator
    + JDK-8216324: GetClassMethods is confused by the presence of
    default methods in super interfaces
    + JDK-8217429: WebSocket over authenticating proxy fails to
    send Upgrade headers
    + JDK-8217976: test/jdk/java/net/httpclient/websocket/
    /WebSocketProxyTest.java fails intermittently
    + JDK-8218021: Have jarsigner preserve posix permission
    attributes
    + JDK-8218287: jshell tool: input behavior unstable after
    12-ea+24 on Windows
    + JDK-8218851: JVM crash in custom classloader stress test, JDK
    12 &amp; 13
    + JDK-8220420: Cleanup c1_LinearScan
    + JDK-8222072: JVMTI GenerateEvents() sends CompiledMethodLoad
    events to wrong jvmtiEnv
    + JDK-8222286: Fix for JDK-8213419 is broken on s390
    + JDK-8222527: HttpClient doesn't send HOST header when
    tunelling HTTP/1.1 through http proxy
    + JDK-8222533: jtreg test jdk/internal/platform/cgroup/
    /TestCgroupMetrics.java fails on SLES12.3 linux ppc64le
    machine
    + JDK-8224506: [TESTBUG] TestDockerMemoryMetrics.java fails
    with exitValue = 137
    + JDK-8224555: vmTestbase/nsk/jvmti/scenarios/contention/TC02/
    /tc02t001/TestDescription.java failed
    + JDK-8224650: Add tests to support X25519 and X448 in TLS
    + JDK-8225072: Add LuxTrust certificate that is expiring in
    March 2021 to list of allowed but expired certs
    + JDK-8225329: -XX:+PrintBiasedLockingStatistics causes crash
    during initialization on Windows platforms
    + JDK-8225687: Newly added sspi.cpp in JDK-6722928 still
    contains some small errors
    + JDK-8227006: [linux] Runtime.availableProcessors execution
    time increased by factor of 100
    + JDK-8227275: Within native OOM error handling, assertions may
    hang the process
    + JDK-8227647: [Graal] Test8009761.java fails due to
    "RuntimeException: static java.lang.Object
    compiler.uncommontrap.Test8009761.m3(boolean,boolean) not
    compiled"
    + JDK-8229495: SIGILL in C2 generated OSR compilation
    + JDK-8230910: libsspi_bridge does not build on Windows 32bit
    + JDK-8232114: JVM crashed at imjpapi.dll in native code
    + JDK-8234147: Avoid looking up standard charsets in core
    libraries
    + JDK-8234393: [macos] printing ignores printer tray
    + JDK-8234863: Increase default value of MaxInlineLevel
    + JDK-8235218: Minimal VM is broken after JDK-8173361
    + JDK-8235456: Minimal VM is broken after JDK-8212160
    + JDK-8235829: graal crashes with Zombie.java test
    + JDK-8236124: Minimal VM slowdebug build failed after
    JDK-8212160
    + JDK-8236512: PKCS11 Connection closed after Cipher.doFinal
    and NoPadding
    + JDK-8236944: The legVecZ operand should be limited to
    zmm0-zmm15 registers
    + JDK-8237186: Fix typo in copyright header of
    java/io/Reader/TransferTo.java
    + JDK-8237499: JFR: Include stack trace in the ThreadStart event
    + JDK-8237512: AArch64: aarch64TestHook leaks a BufferBlob
    + JDK-8237524: AArch64: String.compareTo() may return incorrect
    result
    + JDK-8237950: C2 compilation fails with "Live Node limit
    exceeded limit" during ConvI2L::Ideal optimization
    + JDK-8238579: HttpsURLConnection drops the timeout and hangs
    forever in read
    + JDK-8239105: Add exception for expiring Digicert root
    certificates to VerifyCACerts test
    + JDK-8239477: jdk/jfr/jcmd/TestJcmdStartStopDefault.java fails
  - XX:+VerifyOops with "verify_oop: rsi: broken oop"
    + JDK-8239497: SEGV in EdgeUtils::field_name_symbol(Edge const&amp;)
    + JDK-8239886: Minimal VM build fails after JDK-8237499
    + JDK-8240633: Memory leaks in the implementations of
    FileChooserUI
    + JDK-8240690: Race condition between EDT and
    BasicDirectoryModel.FilesLoader.run0()
    + JDK-8241234: Unify monitor enter/exit runtime entries.
    + JDK-8241311: Move some charset mapping tests from closed to
    open
    + JDK-8241797: Add some tests to the problem list
    + JDK-8242029: AArch64: skip G1 array copy pre-barrier if
    marking not active
    + JDK-8242335: Additional Tests for RSASSA-PSS
    + JDK-8242480: Negative value may be returned by
    getFreeSwapSpaceSize() in the docker
    + JDK-8242614: cleanup duplicated test ldap server in some
    com/sun/jndi/ldap/ tests
    + JDK-8242846: Bring back test/jdk/tools/jlink/plugins/
    /OrderResourcesPluginTest.java
    + JDK-8243114: Implement montgomery{Multiply,Square}intrinsics
    on Windows
    + JDK-8243290: Improve diagnostic messages for class
    verification and redefinition failures
    + JDK-8243488: Add tests for set/get SendBufferSize and
    getReceiveBufferSize in DatagramSocket
    + JDK-8243549: sun/security/ssl/CipherSuite/
    /NamedGroupsWithCipherSuite.java failed with Unsupported
    signature algorithm: DSA
    + JDK-8243617: compiler/onSpinWait/TestOnSpinWaitC1.java test
    uses wrong class
    + JDK-8243619: compiler/codecache/CheckSegmentedCodeCache.java
    test misses -version
    + JDK-8244142: some hotspot/runtime tests don't check exit code
    of forked JVM
    + JDK-8244278: Excessive code cache flushes and sweeps
    + JDK-8244282: test/hotspot/jtreg/compiler/intrinsics/
    /Test8237524.java fails with --illegal-access=deny
    + JDK-8244621: [macos10.15] Garbled FX printing plus CoreText
    warnings on Catalina when building with Xcode 11
    + JDK-8244819: hsdis does not compile with binutils 2.34+
    + JDK-8245051: c1 is broken if it is compiled by gcc without
  - fno-lifetime-dse
    + JDK-8245168: jlink should not be treated as a "small" tool
    + JDK-8245400: Upgrade to LittleCMS 2.11
    + JDK-8246381: VM crashes with "Current BasicObjectLock* below
    than low_mark"
    + JDK-8246434: Threads::print_on_error assumes that the heap
    has been set up
    + JDK-8246648: issue with OperatingSystemImpl
    getFreeSwapSpaceSize in docker after 8242480
    + JDK-8247201: Print potential pointer value of readable stack
    memory in hs_err file
    + JDK-8247763: assert(outer-&gt;outcnt() == 2) failed: 'only phis'
    failure in LoopNode::verify_strip_mined()
    + JDK-8247867: Upgrade to freetype 2.10.2
    + JDK-8248190: Enable Power10 system and implement new
    byte-reverse instructions
    + JDK-8248226: TestCloneAccessStressGCM fails with
  - XX:-ReduceBulkZeroing
    + JDK-8248347: windows build broken by JDK-8243114
    + JDK-8248532: Every time I change keyboard language at my
    MacBook, Java crashes
    + JDK-8248552: C2 crashes with SIGFPE due to division by zero
    + JDK-8248596: [TESTBUG] compiler/loopopts/
    /PartialPeelingUnswitch.java times out with Graal enabled
    + JDK-8248745: Add jarsigner and keytool tests for restricted
    algorithms
    + JDK-8248791: sun/util/resources/cldr/TimeZoneNamesTest.java
    fails with -XX:-ReduceInitialCardMarks -XX:-ReduceBulkZeroing
    + JDK-8248845: AArch64: stack corruption after spilling vector
    register
    + JDK-8249176: Update GlobalSignR6CA test certificates
    + JDK-8249183: JVM crash in "AwtFrame::WmSize" method
    + JDK-8249192: MonitorInfo stores raw oops across safepoints
    + JDK-8249602: C2: assert(cnt == _outcnt) failed: no insertions
    allowed
    + JDK-8249603: C1: assert(has_error == false) failed: register
    allocation invalid
    + JDK-8249605: C2: assert(no_dead_loop) failed: dead loop
    detected
    + JDK-8249607: C2: assert(!had_error) failed: bad dominance
    + JDK-8249608: Vector register used by C2 compiled method
    corrupted at safepoint
    + JDK-8249672: Include microcode revision in features_string on
    x86
    + JDK-8249748: gtest silently ignores bad jvm arguments
    + JDK-8249821: Separate libharfbuzz from libfontmanager
    + JDK-8250598: Hyper-V is detected in spite of running on host
    OS
    + JDK-8250605: Linux x86_32 builds fail after JDK-8249821
    + JDK-8250636: iso8601_time returns incorrect offset part on
    MacOS
    + JDK-8250665: Wrong translation for the month name of May in
    ar_JO,LB,SY
    + JDK-8250772: Test com/sun/jndi/ldap/
    /NamingExceptionMessageTest.java fails intermittently with
    javax.naming.ServiceUnavailableException
    + JDK-8250825: C2 crashes with assert(field != __null) failed:
    missing field
    + JDK-8250894: Provide a configure option to build and run
    against the platform libharfbuzz
    + JDK-8250928: JFR: Improve hash algorithm for stack traces
    + JDK-8250968: Symlinks attributes not preserved when using
    jarsigner on zip files
    + JDK-8250984: Memory Docker tests fail on some Linux kernels
    w/o cgroupv1 swap limit capabilities
    + JDK-8251118: BiasedLocking::preserve_marks should not have a
    HandleMark
    + JDK-8251189: com/sun/jndi/ldap/LdapDnsProviderTest.java
    failed due to timeout
    + JDK-8251257: NMT: jcmd VM.native_memory scale=1 crashes
    target VM
    + JDK-8251365: Build failure on AIX after 8250636
    + JDK-8251397: NPE on ClassValue.ClassValueMap.cacheArray
    + JDK-8251456: [TESTBUG] compiler/vectorization/
    /TestVectorsNotSavedAtSafepoint.java failed OutOfMemoryError
    + JDK-8251458: Parse::do_lookupswitch fails with "assert(_cnt
    &gt;= 0) failed"
    + JDK-8251535: Partial peeling at unsigned test adds incorrect
    loop exit check
    + JDK-8251949: ZGC: Set explicit heap size for
    compiler/gcbarriers tests
    + JDK-8252090: JFR: StreamWriterHost::write_unbuffered() stucks
    in an infinite loop OpenJDK (build 13.0.1+9)
    + JDK-8252415: Bump update version for OpenJDK: jdk-11.0.10
    + JDK-8252470: java/awt/dnd/DisposeFrameOnDragCrash/
    /DisposeFrameOnDragTest.java fails on Windows
    + JDK-8252497: Incorrect numeric currency code for ROL
    + JDK-8252660: Shenandoah: support manageable SoftMaxHeapSize
    option
    + JDK-8252679: Two windows specific FileDIalog tests may fail
    on some Windows_Server_2016_Standard
    + JDK-8252696: Loop unswitching may cause out of bound array
    load to be executed
    + JDK-8252754: Hash code calculation of JfrStackTrace is
    inconsistent
    + JDK-8253219: Epsilon: clean up unnecessary includes
    + JDK-8253224: Shenandoah: ShenandoahStrDedupQueue destructor
    calls virtual num_queues()
    + JDK-8253226: Shenandoah: remove unimplemented
    ShenandoahStrDedupQueue::verify
    + JDK-8253269: The CheckCommonColors test should provide more
    info on failure
    + JDK-8253284: Zero OrderAccess barrier mappings are incorrect
    + JDK-8253375: OSX build fails with Xcode 12.0 (12A7209)
    + JDK-8253778: ShenandoahSafepoint::is_at_shenandoah_safepoint
    should not access VMThread state from other threads
    + JDK-8253791: Issue with useAppleColor check in CSystemColors.m
    + JDK-8254016: Test8237524 fails with -XX:-CompactStrings option
    + JDK-8254081: java/security/cert/PolicyNode/
    /GetPolicyQualifiers.java fails due to an expired certificate
    + JDK-8254144: Non-x86 Zero builds fail with return-type
    warning in os_linux_zero.cpp
    + JDK-8254166: Zero: return-type warning in
    zeroInterpreter_zero.cpp
    + JDK-8254177: (tz) Upgrade time-zone data to tzdata2020b
    + JDK-8254185: Fix Code cache sweeper heuristics for JDK 11
    + JDK-8254190: [s390] interpreter misses exception check after
    calling monitorenter
    + JDK-8254790: SIGSEGV in string_indexof_char and
    stringL_indexof_char intrinsics
    + JDK-8254854: [cgroups v1] Metric limits not properly detected
    on some join controller combinations
    + JDK-8254982: (tz) Upgrade time-zone data to tzdata2020c
    + JDK-8255050: Add pkcs11/KeyStore/ClientAuth.sh to Problem list
    + JDK-8255065: Zero: accessor_entry misses the IRIW case
    + JDK-8255226: (tz) Upgrade time-zone data to tzdata2020d
    + JDK-8255269: Unsigned overflow in g1Policy.cpp
    + JDK-8255365: Problem list failing client manual tests
    + JDK-8255457: Shenandoah: cleanup ShenandoahMarkTask
    + JDK-8255466: C2 crashes at ciObject::get_oop() const+0x0
    + JDK-8255550: x86: Assembler::cmpq(Address dst, Register src)
    encoding is incorrect
    + JDK-8255603: Memory/Performance regression after JDK-8210985
    + JDK-8255760: Shenandoah: match constants style in
    ShenandoahMarkTask fallback
    + JDK-8255781: Bump patch update version for OpenJDK:
    jdk-11.0.9.1
    + JDK-8255937: Better cleanup for
    test/jdk/javax/imageio/stream/StreamFlush.java
    + JDK-8256427: Test com/sun/jndi/dns/ConfigTests/
    /PortUnreachable.java does not work on AIX
    + JDK-8256452: Integrate missing part of JDK-8232370 to 11u
    + JDK-8256483: [TESTBUG] serviceability/jvmti/GetClassMethods/
    /libOverpassMethods.c fails to compile on gcc 4.4.x
    + JDK-8256557: libharfbuzz fails to link on gcc 4.4.x due to
  - Wl,-z,defs
    + JDK-8256618: Zero: Linux x86_32 build still fails
    + JDK-8256736: Zero: GTest tests fail with "unsuppported vm
    variant"
    + JDK-8256809: Annotation processing causes NPE during flow
    analysis
    + JDK-8257181: s390x builds are very noisy with gc-sections
    messages
    + JDK-8257242: [macOS] Java app crashes while switching input
    methods
    + JDK-8257545: SunJSSE FIPS regression in key exchange after
    JDK-8171279 11u backport
    + JDK-8257641: Shenandoah: Query is_at_shenandoah_safepoint()
    from control thread should return false
    + JDK-8257701: Shenandoah: objArrayKlass metadata is not marked
    with chunked arrays
    + JDK-8258630: Add expiry exception for QuoVadis root
    certificate
- New upstream dependency on libharfbuzz
- Regenerated patches: missing-return.patch system-pcsclite.patch</changelog>
  <changelog author="fstrba@suse.com" date="1616155200">- Added patches:
  * system-crypto-policy.patch
    + Let OpenJDK use system crypto policies unless explicitely told
    not to
  * nss-security-provider.patch
    + Add the NSS security provider with configuration in generated
    nss.cfg file
  * keytool-default-rsa.patch
    + Make keytool generate RSA keys by default, since only the
    LEGACY system crypto policy allows DSA</changelog>
  <changelog author="pujos.michael@gmail.com" date="1618488000">- moved mozilla-nss dependency to java-11-openjdk-headless package
  This is necessary to be able to do crypto with just
  java-11-openjdk-headless installed. Fixes boo#1184606</changelog>
  <changelog author="fstrba@suse.com" date="1619006400">- Update to upstream tag jdk-11.0.11+9 (April 2021, CPU)
  * Security fixes
    + JDK-8244473: Contextualize registration for JNDI
    + JDK-8244543: Enhanced handling of abstract classes
    + JDK-8249906, CVE-2021-2163, bsc#1185055: Enhance opening JARs
    + JDK-8250568, CVE-2021-2161, bsc#1185056: Less ambiguous
    processing
    + JDK-8253799: Make lists of normal filenames
    + JDK-8257001: Improve Http Client Support
  * Other changes
    + JDK-7107012: sun.jvm.hotspot.code.CompressedReadStream
    readDouble() conversion to long mishandled
    + JDK-7146776: deadlock between URLStreamHandler.getHostAddress
    and file.Handler.openconnection
    + JDK-8086003: Test fails on OSX with java.lang.RuntimeException
    'Narrow klass base: 0x0000000000000000, Narrow klass shift: 3'
    missing
    + JDK-8168869: jdeps: localized messages don't use proper line
    breaks
    + JDK-8180837: SunPKCS11-NSS tests failing with
    CKR_ATTRIBUTE_READ_ONLY and CKR_MECHANISM_PARAM_INVALID
    + JDK-8202343: Disable TLS 1.0 and 1.1
    + JDK-8205992: jhsdb cannot attach to Java processes running in
    Docker containers
    + JDK-8209193: Fix aarch64-linux compilation after -Wreorder
    changes
    + JDK-8210413: AArch64: Optimize div/rem by constant in C1
    + JDK-8210578: AArch64: Invalid encoding for fmlsvs instruction
    + JDK-8211051: jdeps usage of --dot-output doesn't provide
    valid output for modular jar
    + JDK-8211057: Gensrc step CompileProperties generates unstable
    CompilerProperties output
    + JDK-8211150: G1 Full GC not purging code root memory and
    hence causing memory leak
    + JDK-8211825: ModuleLayer.defineModulesWithXXX does not setup
    delegation when module reads automatic module
    + JDK-8212043: Add floating-point Math.min/max intrinsics
    + JDK-8212218: [TESTBUG] runtime/ErrorHandling/
    /TestHeapDumpOnOutOfMemoryErrorInMetaspace.java timed out
    + JDK-8213116: javax/swing/JComboBox/WindowsComboBoxSize/
    /WindowsComboBoxSizeTest.java fails in Windows
    + JDK-8213909: jdeps --print-module-deps should report missing
    dependences
    + JDK-8214180: Need better granularity for sleeping
    + JDK-8214223: tools/jdeps/listdeps/ListModuleDeps.java failed
    due to missing Lib2 file
    + JDK-8214230: Classes generated by SystemModulesPlugin.java
    are not reproducable
    + JDK-8214741: docs/index.html has no title or copyright
    + JDK-8215687: [Graal] unit test CheckGraalIntrinsics failed
    after 8212043
    + JDK-8217848: [Graal] vmTestbase/nsk/jvmti/ResourceExhausted/
    /resexhausted003/TestDescription.java fails
    + JDK-8218482: sun/security/krb5/auto/ReplayCachePrecise.java
    failed - no KrbException thrown
    + JDK-8218550: Add test omitted from JDK-8212043
    + JDK-8221584: SIGSEGV in os::PlatformEvent::unpark() in
    JvmtiRawMonitor::raw_exit while posting method exit event
    + JDK-8221995: AARCH64: problems with CAS instructions encoding
    + JDK-8222518: Remove unnecessary caching of Parker object in
    java.lang.Thread
    + JDK-8222785: aarch64: add necessary masking for immediate
    shift counts
    + JDK-8223186: HotSpot compile warnings from GCC 9
    + JDK-8225773: jdeps --check produces NPE if there are missing
    module dependences
    + JDK-8225805: Java Access Bridge does not close the logger
    + JDK-8226810: Failed to launch JVM because of
    NullPointerException occured on System.props
    + JDK-8229396: jdeps ignores multi-release when
    generate-module-info used on command line
    + JDK-8229474: Shenandoah: Cleanup CM::update_roots()
    + JDK-8232225: Rework the fix for JDK-8071483
    + JDK-8232905: JFR fails with assertion:
    assert(t-&gt;unflushed_size() == 0) failed: invariant
    + JDK-8233164: C2 fails with assert(phase-&gt;C-&gt;get_alias_index(t)
    == phase-&gt;C-&gt;get_alias_index(t_adr)) failed: correct memory
    chain
    + JDK-8233910: java/awt/ColorClass/AlphaColorTest.java is
    failing  intermittently in nightly lnux-x64 system
    + JDK-8233912: aarch64: minor improvements of atomic operations
    + JDK-8234508: VM_HeapWalkOperation::iterate_over_object reads
    non-strong fields with an on-strong load barrier
    + JDK-8234742: Improve handshake logging
    + JDK-8234796: Refactor Handshake::execute to take a more
    complex type than ThreadClosure
    + JDK-8235324: Dying objects are published from users of
    CollectedHeap::object_iterate
    + JDK-8235351: Lookup::unreflect should bind with the original
    caller independent of Method's accessible flag
    + JDK-8237369: Shenandoah: failed vmTestbase/nsk/jvmti/
    /AttachOnDemand/attach021/TestDescription.java test
    + JDK-8237392: Shenandoah: Remove unreliable assertion
    + JDK-8237483: AArch64 C1 OopMap inserted twice fatal error
    + JDK-8237495: Java MIDI fails with a dereferenced memory error
    when asked to send a raw 0xF7
    + JDK-8239355: (dc) Initial value of SO_SNDBUF should allow
    sending large datagrams (macOS)
    + JDK-8240353: AArch64: missing support for
  - XX:+ExtendedDTraceProbes in C1
    + JDK-8240704: CheckHandles.java failed "AssertionError: Handle
    use increased by more than 10 percent."
    + JDK-8240751: Shenandoah: fold ShenandoahTracer definition
    + JDK-8240795: [REDO] 8238384 CTW: C2 compilation fails with
    "assert(store != load-&gt;find_exact_control(load-&gt;in(0)))
    failed: dependence cycle found"
    + JDK-8241598: Upgrade JLine to 3.14.0
    + JDK-8241649: Optimize Character.toString
    + JDK-8241770: Module xxxAnnotation() methods throw NCDFE if
    module-info.class found as resource in unnamed module
    + JDK-8241911: AArch64: Fix a potential register clash issue in
    reduce_add2I
    + JDK-8242030: Wrong package declarations in jline classes after
    JDK-8241598
    + JDK-8242565: Policy initialization issues when the denyAfter
    constraint is enabled
    + JDK-8243618: compiler/rtm/cli tests can be run w/o WhiteBox
    + JDK-8243670: Unexpected test result caused by C2
    MergeMemNode::Ideal
    + JDK-8244088: [Regression] Switch of Gnome theme ends up in
    deadlocked UI
    + JDK-8244154: Update SunPKCS11 provider with PKCS11 v3.0 header
    files
    + JDK-8244340: Handshake processing thread lacks yielding
    + JDK-8244573: java.lang.ArrayIndexOutOfBoundsException thrown
    for malformed class file
    + JDK-8244683: A TSA server used by tests
    + JDK-8245005: javax/net/ssl/compatibility/BasicConnectTest.java
    failed with No enum constant
    + JDK-8245026: PsAdaptiveSizePolicy::_old_gen_policy_is_ready is
    unused
    + JDK-8245283: JFR: Can't handle constant dynamic used by Jacoco
    agent
    + JDK-8245512: CRC32 optimization using AVX512 instructions
    + JDK-8245527: LDAP Channel Binding support for Java
    GSS/Kerberos
    + JDK-8246707: (sc) SocketChannel.read/write throws
    AsynchronousCloseException on closed channel
    + JDK-8246709: sun/security/tools/jarsigner/
    /TsacertOptionTest.java compilation failed after JDK-8244683
    + JDK-8247200: assert((unsigned)fpargs &lt; 32)
    + JDK-8247766: [aarch64] guarantee(val &lt; (1U &lt;&lt; nbits))
    failed: Field too big for insn.
    + JDK-8248336: AArch64: C2: offset overflow in
    BoxLockNode::emit
    + JDK-8248865: Document JNDI/LDAP timeout properties
    + JDK-8248901: Signed immediate support in
    .../share/assembler.hpp is broken.
    + JDK-8249543: Force DirectBufferAllocTest to run with
  - ExplicitGCInvokesConcurrent
    + JDK-8249588: libwindowsaccessbridge issues on 64bit Windows
    + JDK-8249749: modify a primitive array through a stream and a
    for cycle causes jre crash
    + JDK-8249787: Make TestGCLocker more resilient with concurrent
    GCs
    + JDK-8249867: xml declaration is not followed by a newline
    + JDK-8250911: [windows] os::pd_map_memory() error detection
    broken
    + JDK-8251255: [linux] Add process-memory information to hs-err
    and VM.info
    + JDK-8251359: Shenandoah: filter null oops before calling
    enqueue/SATB barrier
    + JDK-8251925: C2: RenaissanceStressTest fails with
    assert(!had_error): bad dominance
    + JDK-8251944: Add Shenandoah test config to
    compiler/gcbarriers/UnsafeIntrinsicsTest.java
    + JDK-8251992: VM crashed running TestComplexAddrExpr.java test
    with -XX:UseAVX=X
    + JDK-8253220: Epsilon: clean up unused code/declarations
    + JDK-8253274: The CycleDMImagetest brokes the system
    + JDK-8253353: Crash in C2: guarantee(n != NULL) failed: No Node
    + JDK-8253368: TLS connection always receives close_notify
    exception
    + JDK-8253404: C2: assert(C-&gt;live_nodes() &lt;=
    C-&gt;max_node_limit()) failed: Live Node limit exceeded limit
    + JDK-8253409: Double-rounding possibility in float fma
    + JDK-8253476: TestUseContainerSupport.java fails on some Linux
    kernels w/o swap limit capabilities
    + JDK-8253524: C2: Refactor code that clones predicates during
    loop unswitching
    + JDK-8253644: C2: assert(skeleton_predicate_has_opaque(iff))
    failed: unexpected
    + JDK-8253681: closed java/awt/dnd/MouseEventAfterStartDragTest/
    /MouseEventAfterStartDragTest.html test failed
    + JDK-8253702: BigSur version number reported as 10.16, should
    be 11.nn
    + JDK-8253756: C2 CompilerThread0 crash in Node::add_req(Node*)
    + JDK-8254104: MethodCounters must exist before nmethod is
    installed
    + JDK-8254734: "dead loop detected" assert failure with patch
    from 8223051
    + JDK-8254748: Bad Copyright header format after JDK-8212218
    + JDK-8254799: runtime/ErrorHandling/
    /TestHeapDumpOnOutOfMemoryError.java fails with release VMs
    + JDK-8255058: C1: assert(is_virtual()) failed: type check
    + JDK-8255351: Add detection for Graviton 2 CPUs
    + JDK-8255368: Math.exp() gives wrong result for large values on
    x86 32-bit platforms
    + JDK-8255387: Japanese characters were printed upside down on
    AIX
    + JDK-8255401: Shenandoah: Allow oldval and newval registers to
    overlap in cmpxchg_oop()
    + JDK-8255479: [aarch64] assert(src-&gt;section_index_of(target) ==
    CodeBuffer::SECT_NONE) failed: sanity
    + JDK-8255544: Create a checked cast
    + JDK-8255559: Leak File Descriptors Because of
    ResolverLocalFilesystem#engineResolveURI()
    + JDK-8255681: print callstack in error case in
    runAWTLoopWithApp
    + JDK-8255734: VM should ignore SIGXFSZ on ppc64, s390 too
    + JDK-8255742: PrintInlining as compiler directive doesn't print
    virtual calls
    + JDK-8255845: Memory leak in imageFile.cpp
    + JDK-8255880: UI of Swing components is not redrawn after their
    internal state changed
    + JDK-8255908: ExceptionInInitializerError due to
    UncheckedIOException while initializing cgroupv1 subsystem
    + JDK-8256025: AArch64: MachCallRuntimeNode::ret_addr_offset()
    is incorrect for stub calls
    + JDK-8256056: Deoptimization stub doesn't save vector registers
    on x86
    + JDK-8256061: RegisterSaver::save_live_registers() omits upper
    halves of ZMM0-15 registers
    + JDK-8256187: [TEST_BUG] Automate bug4275046.java test
    + JDK-8256220: C1: x86_32 fails with -XX:UseSSE=1 after
    JDK-8210764 due to mishandled lir_neg
    + JDK-8256258: some missing NULL checks or asserts after
    CodeCache::find_blob_unsafe
    + JDK-8256264: Printed GlyphVector outline with low DPI has bad
    quality on Windows
    + JDK-8256290: javac/lambda/T8031967.java fails with
    StackOverflowError on x86_32
    + JDK-8256359: AArch64: runtime/ReservedStack/
    /ReservedStackTestCompiler.java fails
    + JDK-8256387: Unexpected result if patching an entire
    instruction on AArch64
    + JDK-8256421: Add 2 HARICA roots to cacerts truststore
    + JDK-8256488: [aarch64] Use ldpq/stpq instead of ld4/st4 for
    small copies in StubGenerator::copy_memory
    + JDK-8256489: Make gtest for long path names on Windows more
    resilient in the presence of virus scanners
    + JDK-8256501: libTestMainKeyWindow fails to build with Xcode
    12.2
    + JDK-8256633: Fix product build on Windows+Arm64
    + JDK-8256682: JDK-8202343 is incomplete
    + JDK-8256751: Incremental rebuild with precompiled header fails
    when touching a header file
    + JDK-8256757: Incorrect MachCallRuntimeNode::ret_addr_offset()
    for CallLeafNoFP on x86_32
    + JDK-8256806: Shenandoah: optimize shenandoah/jni/
    /TestPinnedGarbage.java test
    + JDK-8256807: C2: Not marking stores correctly as mismatched
    in string opts
    + JDK-8256810: Incremental rebuild broken on Macosx
    + JDK-8256818: SSLSocket that is never bound or connected leaks
    socket resources
    + JDK-8256888: Client manual test problem list update
    + JDK-8257083: Security infra test failures caused by
    JDK-8202343
    + JDK-8257408: Bump update version for OpenJDK: jdk-11.0.11
    + JDK-8257423: [PPC64] Support -XX:-UseInlineCaches
    + JDK-8257436: [aarch64] Regressions in ArrayCopyUnalignedDst
    .testByte/testChar for 65-78 bytes when UseSIMDForMemoryOps
    is on
    + JDK-8257513: C2: assert((constant_addr -
    _masm.code()-&gt;consts()-&gt;start()) == con.offset())
    + JDK-8257547: Handle multiple prereqs on the same line in deps
    files
    + JDK-8257561: Some code is not vectorized after 8251925 and
    8250607
    + JDK-8257565: epsilonBarrierSet.hpp should not include
    barrierSetAssembler
    + JDK-8257575: C2: "failed: only phis" assert failure in loop
    strip mining verification
    + JDK-8257594: C2 compiled checkcast of non-null object triggers
    endless deoptimization/recompilation cycle
    + JDK-8257633: Missing -mmacosx-version-min=X flag when linking
    libjvm
    + JDK-8257670: sun/security/ssl/SSLSocketImpl/SSLSocketLeak.java
    reports leaks
    + JDK-8257707: Fix incorrect format string in Http1HeaderParser
    + JDK-8257746: Regression introduced with JDK-8250984 - memory
    might be null in some machines
    + JDK-8257798: [PPC64] undefined reference to
    Klass::vtable_start_offset()
    + JDK-8257884: Re-enable sun/security/ssl/SSLSocketImpl/
    /SSLSocketLeak.java as automatic test
    + JDK-8257910: [JVMCI] Set exception_seen accordingly in the
    runtime.
    + JDK-8257997: sun/security/ssl/SSLSocketImpl/SSLSocketLeak.java
    again reports leaks after JDK-8257884
    + JDK-8257999: Parallel GC crash in gc/parallel/
    /TestDynShrinkHeap.java: new region is not in covered_region
    + JDK-8258077: Using -Xcheck:jni can lead to a double-free after
    JDK-8193234
    + JDK-8258247: Couple of issues in fix for JDK-8249906
    + JDK-8258373: Update the text handling in the JPasswordField
    + JDK-8258396: SIGILL in jdk.jfr.internal.PlatformRecorder
    .rotateDisk()
    + JDK-8258419: RSA cipher buffer cleanup
    + JDK-8258471: "search codecache" clhsdb command does not work
    + JDK-8258534: Epsilon: clean up unused includes
    + JDK-8258805: Japanese characters not entered by mouse click
    on Windows 10
    + JDK-8258833: Cancel multi-part cipher operations in SunPKCS11
    after failures
    + JDK-8258836: JNI local refs exceed capacity
    getDiagnosticCommandInfo
    + JDK-8258884: [TEST_BUG] Convert applet-based test
    open/test/jdk/javax/swing/JMenuItem/8031573/bug8031573.java
    to a regular java test
    + JDK-8259007: This test printed a blank page
    + JDK-8259048: (tz) Upgrade time-zone data to tzdata2020f
    + JDK-8259049: Uninitialized variable after JDK-8257513
    + JDK-8259231: Epsilon: improve performance under contention
    during virtual space expansion
    + JDK-8259271: gc/parallel/TestDynShrinkHeap.java still fails
    "assert(covered_region.contains(new_memregion)) failed: new
    region is not in covered_region"
    + JDK-8259312: VerifyCACerts.java fails as soneraclass2ca cert
    will expire in 90 days
    + JDK-8259319: Illegal package access when SunPKCS11 requires
    SunJCE's classes
    + JDK-8259339: AllocateUninitializedArray C2 intrinsic fails
    with void.class input
    + JDK-8259428: AlgorithmId.getEncodedParams() should return copy
    + JDK-8259446: runtime/jni/checked/
    /TestCheckedReleaseArrayElements.java fails with stderr not
    empty
    + JDK-8259451: Zero: skip serviceability/sa tests, set vm.hasSA
    to false
    + JDK-8259580: Shenandoah: uninitialized label in
    VerifyThreadGCState
    + JDK-8259619: C1: 3-arg StubAssembler::call_RT stack-use
    condition is incorrect
    + JDK-8259633: compiler/graalunit/CoreTest.java fails with NPE
    after JDK-8244543
    + JDK-8259706: C2 compilation fails with assert(vtable_index ==
    Method::invalid_vtable_index) failed: correct sentinel value
    + JDK-8259707: LDAP channel binding does not work with StartTLS
    extension
    + JDK-8259773: Incorrect encoding of AVX-512 kmovq instruction
    + JDK-8259849: Shenandoah: Rename store-val to IU-barrier
    + JDK-8259949: x86 32-bit build fails when -fcf-protection is
    passed in the compiler flags
    + JDK-8259954: gc/shenandoah/mxbeans tests fail with -Xcomp
    + JDK-8260029: aarch64: fix typo in verify_oop_array
    + JDK-8260308: Update LogCompilation junit to 4.13.1
    + JDK-8260338: Some fields in HaltNode is not cloned
    + JDK-8260349: Cannot programmatically retrieve Metaspace max
    set via JAVA_TOOL_OPTIONS
    + JDK-8260356: (tz) Upgrade time-zone data to tzdata2021a
    + JDK-8260378: [TESTBUG] DcmdMBeanTestCheckJni.java reports
    false positive
    + JDK-8260497: Shenandoah: Improve SATB flushing
    + JDK-8260502: [s390] NativeMovRegMem::verify() fails because
    it's too strict
    + JDK-8260632: Build failures after JDK-8253353
    + JDK-8260704: ParallelGC: oldgen expansion needs release-store
    for _end
    + JDK-8261022: Fix incorrect result of Math.abs() with char type
    + JDK-8261089: [TESTBUG] native library of test
    TestCheckedReleaseCriticalArray.java fails to compile with
    gcc 4.x
    + JDK-8261183: Follow on to Make lists of normal filenames
    + JDK-8261209: isStandalone property: remove dependency on
    pretty-print
    + JDK-8261231: Windows IME was disabled after DnD operation
    + JDK-8261251: Shenandoah: Use object size for full GC
    humongous compaction
    + JDK-8261310: PPC64 Zero build fails with
    'VMError::controlled_crash(int)::FunctionDescriptor
    functionDescriptor' has incomplete type and cannot be defined
    + JDK-8261334: NMT: tuning statistic shows incorrect hash
    distribution
    + JDK-8261413: Shenandoah: Disable class-unloading in I-U mode
    + JDK-8261522: [PPC64] AES intrinsics write beyond the
    destination array
    + JDK-8261534: Test sun/security/pkcs11/KeyAgreement/
    /IllegalPackageAccess.java fails on platforms where no nsslib
    artifacts are defined
    + JDK-8261585: Restore HandleArea used in
    Deoptimization::uncommon_trap
    + JDK-8261753: Test java/lang/System/OsVersionTest.java still
    failing on BigSur patch versions after JDK-8253702
    + JDK-8261829: Exclude tools/jlink/JLinkReproducibleTest.java
    in 11u
    + JDK-8261912: Code IfNode::fold_compares_helper more
    defensively
    + JDK-8261920: [AIX] jshell command throws java.io.IOError on
    non English locales
    + JDK-8262018: Wrong format in SAP copyright header of
    OsVersionTest
    + JDK-8263069: Exclude some failing tests from
    security/infra/java/security/cert/CertPathValidator</changelog>
  <changelog author="fstrba@suse.com" date="1620043200">- Remove all Jpackage provides for SLE12 in order to avoid
  installing this package as default Java on SLE12-SP5
  (bsc#1185476)</changelog>
  <changelog author="fstrba@suse.com" date="1621512000">- Modified patch:
  * nss-security-provider.patch
    + make the NSS provider first in the list</changelog>
  <changelog author="fstrba@suse.com" date="1626868800">- Update to upstream tag jdk-11.0.12+7 (July 2021, CPU)
  * Security fixes
    + JDK-8256157: Improve bytecode assembly
    + JDK-8256491: Better HTTP transport
    + JDK-8258432, CVE-2021-2341, bsc#1188564: Improve file
    transfers
    + JDK-8260453: Improve Font Bounding
    + JDK-8260960: Signs of jarsigner signing
    + JDK-8260967, CVE-2021-2369, bsc#1188565: Better jar file
    validation
    + JDK-8262380: Enhance XML processing passes
    + JDK-8262403: Enhanced data transfer
    + JDK-8262410: Enhanced rules for zones
    + JDK-8262477: Enhance String Conclusions
    + JDK-8262967: Improve Zip file support
    + JDK-8264066, CVE-2021-2388, bsc#1188566: Enhance compiler
    validation
    + JDK-8264079: Improve abstractions
    + JDK-8264460: Improve NTLM support
  * Other changes
    + JDK-6847157: java.lang.NullPointerException: HDC for
    component at sun.java2d.loops.Blit.Blit
    + JDK-7106851: Test should not use System.exit
    + JDK-8073446: TimeZone getOffset API does not  return a dst
    offset between years 2038-2137
    + JDK-8076190: Customizing the generation of a PKCS12 keystore
    + JDK-8153005: Upgrade the default PKCS12 encryption/MAC
    algorithms
    + JDK-8171303: sun/java2d/pipe/InterpolationQualityTest.java
    fails on Windows &amp; Linux
    + JDK-8177068: incomplete classpath causes NPE in Flow
    + JDK-8185734: [Windows] Structured Exception Catcher missing
    around gtest execution
    + JDK-8187450: JNI local refs exceeds capacity warning in
    NetworkInterface::getAll
    + JDK-8190763: Class cast exception on (CompoundEdit)
    UndoableEditEvent.getEdit()
    + JDK-8195841: PNGImageReader.readNullTerminatedString() doesnt
    check for non-null terminated strings with length equal to
    maxLen
    + JDK-8196100: javax/swing/text/JTextComponent/5074573/
    /bug5074573.java fails
    + JDK-8199646: JShell tests: jdk/jshell/
    /FailOverDirectExecutionControlTest.java failed with
    java.lang.UnsupportedOperationException
    + JDK-8206925: Support the certificate_authorities extension
    + JDK-8207160: ClassReader::adjustMethodParams can potentially
    return null if the args list is empty
    + JDK-8207247: AARCH64: Enable Minimal and Client VM builds
    + JDK-8207404: MulticastSocket tests failing on AIX
    + JDK-8207779: Method::is_valid_method() compares 'this' with
    NULL
    + JDK-8208061: runtime/LoadClass/TestResize.java fails with
    "Load factor too high" when running in CDS mode.
    + JDK-8209459: TestSHA512MultiBlockIntrinsics failed on AArch64
    + JDK-8210443: Migrate Locale matching tests to JDK Repo.
    + JDK-8213231: ThreadSnapshot::_threadObj can become stale
    + JDK-8213483: ARM32: runtime/ErrorHandling/
    /ShowRegistersOnAssertTest.java jtreg test fail
    + JDK-8213725: JShell NullPointerException due to class file
    with unexpected package
    + JDK-8213794: ARM32: disable TypeProfiling,
    CriticalJNINatives, Serviceablity tests for ARM32
    + JDK-8213845: ARM32: Interpreter doesn't call result handler
    after native calls
    + JDK-8214128: ARM32: wrong stack alignment on
    Deoptimization::unpack_frames
    + JDK-8214512: ARM32: Jtreg test compiler/c2/Test8062950.java
    fails on ARM
    + JDK-8214854: JDWP: Unforseen output truncation in logging
    + JDK-8214922: Add vectorization support for fmin/fmax
    + JDK-8215009: GCC 8 compilation error in libjli
    + JDK-8216184: CDS/appCDS tests failed on Windows due to long
    path to a classlist file
    + JDK-8216259: AArch64: Vectorize Adler32 intrinsics
    + JDK-8216314: SIGILL in CodeHeapState::print_names()
    + JDK-8217348: assert(thread-&gt;is_Java_thread()) failed: just
    checking
    + JDK-8217465: [REDO] - Optimize CodeHeap Analytics
    + JDK-8217561: X86: Add floating-point Math.min/max intrinsics
    + JDK-8217918: C2: -XX:+AggressiveUnboxing is broken
    + JDK-8218458: [TESTBUG] runtime/NMT/
    /CheckForProperDetailStackTrace.java fails with Expected
    stack trace missing from output
    + JDK-8219142: Remove unused JIMAGE_ResourcePath
    + JDK-8219586: CodeHeap State Analytics processes dead nmethods
    + JDK-8220074: Clean up GCC 8.3 errors in LittleCMS
    + JDK-8220407: compiler/intrinsics/math/
    /TestFpMinMaxIntrinsics.java timedout
    + JDK-8222302: [TESTBUG] test/hotspot/jtreg/compiler/intrinsics/
    /sha/cli/TestUseSHAOptionOnUnsupportedCPU.java fails on any
    other CPU
    + JDK-8222412: AARCH64: multiple instructions encoding issues
    + JDK-8223020: aarch64: expand minI_rReg and maxI_rReg patterns
    into separate instructions
    + JDK-8223444: Improve CodeHeap Free Space Management
    + JDK-8223504: Improve performance of forall loops by better
    inlining of "iterator()" methods
    + JDK-8223667: ASAN build broken
    + JDK-8225081: Remove Telia Company CA certificate expiring in
    April 2021
    + JDK-8225116: Test OwnedWindowsLeak.java intermittently fails
    + JDK-8225438: javax/net/ssl/TLSCommon/
    /TestSessionLocalPrincipal.java failed with Read timed out
    + JDK-8225756: [testbug] compiler/loopstripmining/
    /CheckLoopStripMining.java sets too short a
    SafepointTimeoutDelay
    + JDK-8226374: Restrict TLS signature schemes and named groups
    + JDK-8226627: assert(t-&gt;singleton()) failed: must be a constant
    + JDK-8226721: Missing intrinsics for Math.ceil, floor, rint
    + JDK-8227080: (fs) Files.newInputStream(...).skip(n) is slow
    + JDK-8227222: vmTestbase/jit/FloatingPoint/gen_math/Loops04/
    /Loops04.java failed XMM register should be 0-15
    + JDK-8227609: (fs) Files.newInputStream(...).skip(n) should
    allow skipping beyond file size
    + JDK-8230428: Cleanup dead CastIP node code in formssel.cpp
    + JDK-8231460: Performance issue (CodeHeap) with large free
    blocks
    + JDK-8231713: x86_32 build failures after JDK-8226721 (Missing
    intrinsics for Math.ceil, floor, rint)
    + JDK-8231841: AArch64: debug.cpp help() is missing an AArch64
    line for pns
    + JDK-8232084: HotSpot build failed with GCC 9.2.1
    + JDK-8232591: AArch64: Add missing match rules for smaddl,
    smsubl and smnegl
    + JDK-8233185: HttpServer.stop() blocks indefinitely when
    called on dispatch thread
    + JDK-8233787: Break cycle in vm_version* includes
    + JDK-8233948: AArch64: Incorrect mapping between OptoReg and
    VMReg for high 64 bits of Vector Register
    + JDK-8234355: Buffer overflow in jcmd GC.class_stats due to
    too many classes
    + JDK-8235368: Update BCEL to Version 6.4.1
    + JDK-8236859: WebSocket over authenticating proxy fails with
    NPE
    + JDK-8236992: AArch64: remove redundant load_klass in itable
    stub
    + JDK-8237743: test/langtools/jdk/jshell/
    /FailOverExecutionControlTest.java fails No
    ExecutionControlProvider with name 'nonExistent' and parameter
    keys: []
    + JDK-8237804: sun/security/mscapi tests fail with "Key pair
    not generated, alias &lt;nnnnnn&gt; already exists"
    + JDK-8238175: CTW: Class.getDeclaredMethods fails with
    assert(k-&gt;is_subclass_of(SystemDictionary::Throwable_klass()))
    failed: invalid exception class
    + JDK-8238567: SoftMainMixer.processAudioBuffers(): Wrong
    handling of stoppedMixers
    + JDK-8238812: assert(false) failed: bad AD file
    + JDK-8239312: [macos] javax/swing/JFrame/NSTexturedJFrame/
    /NSTexturedJFrame.java
    + JDK-8239386: handle ContendedPaddingWidth in
    vm_version_aarch64
    + JDK-8239536: Can't use 'java.util.List' object after
    importing 'java.awt.List'
    + JDK-8240487: Cleanup whitespace in .cc, .hh, .m, and .mm files
    + JDK-8240848: ArrayIndexOutOfBoundsException buf for
    TextCallbackHandler
    + JDK-8241082: Upgrade IANA Language Subtag Registry data to
    03-16-2020 version
    + JDK-8241087: Build failure with VS 2019 (16.5.0) due to C2039
    and C2873
    + JDK-8241101: [s390] jtreg test failure after JDK-8238696: not
    conformant features string
    + JDK-8241248: NullPointerException in
    sun.security.ssl.HKDF.extract(HKDF.java:93)
    + JDK-8241372: Several test failures due to
    javax.net.ssl.SSLException: Connection reset
    + JDK-8241475: AArch64: Add missing support for PopCountVI node
    + JDK-8241829: Cleanup the code for PrinterJob on windows
    + JDK-8241960: The SHA3 message digests impl of SUN provider
    are not thread safe after cloned
    + JDK-8242010: Upgrade IANA Language Subtag Registry to Version
    2020-04-01
    + JDK-8242429: Better implementation for sign extract
    + JDK-8242557: Add length limit for strings in PNGImageWriter
    + JDK-8242919: Paste locks up jshell
    + JDK-8243155: AArch64: Add support for SqrtVF
    + JDK-8243240: AArch64: Add support for MulVB
    + JDK-8243452: JFR: Could not create chunk in repository with
    over 200 recordings
    + JDK-8243559: Remove root certificates with 1024-bit keys
    + JDK-8243597: AArch64: Add support for integer vector abs
    + JDK-8244031: HttpClient should have more tests for HEAD
    requests
    + JDK-8244205: HTTP/2 tunnel connections through proxy may be
    reused regardless of which proxy is selected
    + JDK-8244847: Linux/PPC: runtime/CompressedOops/
    /CompressedClassPointers: smallHeapTest fails
    + JDK-8245511: G1 adaptive IHOP does not account for
    reclamation of humongous objects by young GC
    + JDK-8246274: G1 old gen allocation tracking is not in a
    separate class
    + JDK-8247354: [aarch64] PopFrame causes
    assert(oopDesc::is_oop(obj)) failed: not an oop
    + JDK-8247408: IdealGraph bit check expression canonicalization
    + JDK-8247432: Update IANA Language Subtag Registry to Version
    2020-09-29
    + JDK-8247438: JShell: When FailOverExecutionControlProvider
    fails the proximal cause is not shown
    + JDK-8247753: UIManager.getSytemLookAndFeelClassName() returns
    wrong value on Fedora 32
    + JDK-8248043: Need to eliminate excessive i2l conversions
    + JDK-8248411: [aarch64] Insufficient error handling when
    CodeBuffer is exhausted
    + JDK-8248568: compiler/c2/TestBit.java failed: test missing
    from stdout/stderr
    + JDK-8248870: AARCH64: I2L/L2I conversions can be skipped for
    masked positive values
    + JDK-8249142: java/awt/FontClass/CreateFont/DeleteFont.sh is
    unstable
    + JDK-8249189: AARCH64: more L2I conversions can be skipped
    + JDK-8249719: MethodHandle performance suffers from bad
    ResolvedMethodTable hash function
    + JDK-8249875: GCC 10 warnings -Wtype-limits with JFR code
    + JDK-8250635: MethodArityHistogram should use Compile_lock in
    favour of fancy checks
    + JDK-8250876: Fix issues with cross-compile on macos
    + JDK-8251031: Some vmTestbase/nsk/monitoring/RuntimeMXBean
    tests fail with hostnames starting from digits
    + JDK-8251525: AARCH64: Faster Math.signum(fp)
    + JDK-8252259: AArch64: Adjust default value of FLOATPRESSURE
    + JDK-8252311: AArch64: save two words in itable lookup stub
    + JDK-8252779: compiler/graalunit/HotspotTest.java failed after
    8251525
    + JDK-8252883: AccessDeniedException caused by delayed file
    deletion on Windows
    + JDK-8253167: ARM32 builds fail after JDK-8247910
    + JDK-8253572: [windows] CDS archive may fail to open with long
    file names
    + JDK-8253923: C2 doesn't always run loop opts for compilations
    that include loops
    + JDK-8253948: Memory leak in ImageFileReader
    + JDK-8254631: Better support ALPN byte wire values in SunJSSE
    + JDK-8254717: isAssignableFrom checks in
    KeyFactorySpi.engineGetKeySpec appear to be backwards
    + JDK-8255086: Update the root locale display names
    + JDK-8255625: AArch64: Implement Base64.encodeBlock
    accelerator/intrinsic
    + JDK-8255763: C2: OSR miscompilation caused by invalid memory
    instruction placement
    + JDK-8255992: JFR EventWriter does not use first string from
    StringPool with id 0
    + JDK-8256037: [TESTBUG] com/sun/jndi/dns/ConfigTests/
    /PortUnreachable.java fails due to the hard coded threshold
    is small
    + JDK-8256244: java/lang/ProcessHandle/PermissionTest.java
    fails with TestNG 7.1
    + JDK-8256287: [windows] add loop fuse to
    map_or_reserve_memory_aligned
    + JDK-8256523: Streamline Java SHA2 implementation
    + JDK-8257414: Drag n Drop target area is wrong on high DPI
    systems
    + JDK-8257569: Failure observed with
    JfrVirtualMemory::initialize
    + JDK-8257574: C2: "failed: parsing found no loops but there
    are some" assert failure
    + JDK-8257580: Bump update version for OpenJDK: jdk-11.0.12
    + JDK-8257604: JNI_ArgumentPusherVaArg leaks valist
    + JDK-8257621: JFR StringPool misses cached items across
    consecutive recordings
    + JDK-8257796: [TESTBUG]
    TestUseSHA512IntrinsicsOptionOnSupportedCPU.java fails
    on x86_32
    + JDK-8257822: C2 crashes with SIGFPE due to a division that
    floats above its zero check
    + JDK-8257828: SafeFetch may crash if invoked in non-JavaThreads
    + JDK-8257853: Remove dependencies on JNF's JNI utility
    functions in AWT and 2D code
    + JDK-8257858: [macOS]: Remove JNF dependency from
    libosxsecurity/KeystoreImpl.m
    + JDK-8257860: [macOS]: Remove JNF dependency from
    libosxkrb5/SCDynamicStoreConfig.m
    + JDK-8257988: Remove JNF dependency from
    libsaproc/MacosxDebuggerLocal.m
    + JDK-8258414: OldObjectSample events too expensive
    + JDK-8258505: [TESTBUG] TestDivZeroWithSplitIf.java fails due
    to missing UnlockDiagnosticVMOptions
    + JDK-8258753: StartTlsResponse.close() hangs due to
    synchronization issues
    + JDK-8259061: C2: assert(found) failed: memory-writing node is
    not placed in its original loop or an ancestor of it
    + JDK-8259227: C2 crashes with SIGFPE due to a division that
    floats above its zero check
    + JDK-8259232: Bad JNI lookup during printing
    + JDK-8259276: C2: Empty expression stack when reexecuting
    tableswitch/lookupswitch instructions after deoptimization
    + JDK-8259343: [macOS] Update JNI error handling in Cocoa code.
    + JDK-8259585: Accessible actions do not work on mac os x
    + JDK-8259651: [macOS] Replace JNF_COCOA_ENTER/EXIT macros
    + JDK-8259662: Don't wrap SocketExceptions into SSLExceptions
    in SSLSocketImpl
    + JDK-8259710: Inlining trace leaks memory
    + JDK-8259729: Missed JNFInstanceOf -&gt; IsInstanceOf conversion
    + JDK-8259777: Incorrect predication condition generated by ADLC
    + JDK-8259786: initialize last parameter of getpwuid_r
    + JDK-8259843: initialize dli_fname array before calling
    dll_address_to_library_name
    + JDK-8259869: [macOS] Remove desktop module dependencies on
    JNF Reference APIs
    + JDK-8259886: Improve SSL session cache performance and
    scalability
    + JDK-8259983: do not use uninitialized expand_ms value in
    G1CollectedHeap::expand_heap_after_young_collection
    + JDK-8260030: Improve stringStream buffer handling
    + JDK-8260236: better init AnnotationCollector _contended_group
    + JDK-8260255: C1: LoopInvariantCodeMotion constructor can
    leave some fields uninitialized
    + JDK-8260284: C2: assert(_base == Int) failed: Not an Int
    + JDK-8260380: Upgrade to LittleCMS 2.12
    + JDK-8260420: C2 compilation fails with assert(found_sfpt)
    failed: no node in loop that's not input to safepoint
    + JDK-8260426: awt debug_mem.c DMem_AllocateBlock might leak
    memory
    + JDK-8260432: allocateSpaceForGP in freetypeScaler.c might
    leak memory
    + JDK-8260616: Removing remaining JNF dependencies in the
    java.desktop module
    + JDK-8260653: Unreachable nodes keep speculative types alive
    + JDK-8260707: java/lang/instrument/PremainClass/
    /InheritAgent0100.java times out
    + JDK-8260925: HttpsURLConnection does not work  with other
    JSSE provider.
    + JDK-8260926: Trace resource exhausted events unconditionally
    + JDK-8261020: Wrong format parameter in
    create_emergency_chunk_path
    + JDK-8261027: AArch64: Support for LSE atomics C++ HotSpot code
    + JDK-8261167: print_process_memory_info add a close call after
    fopen
    + JDK-8261170: Upgrade to freetype 2.10.4
    + JDK-8261198: [macOS] Incorrect JNI parameters in number
    conversion in A11Y code
    + JDK-8261235: C1 compilation fails with
    assert(res-&gt;vreg_number() == index) failed: conversion check
    + JDK-8261261: The version extra fields needs to be overridable
    in jib-profiles.js
    + JDK-8261262: Kitchensink24HStress.java crashed with
    EXCEPTION_ACCESS_VIOLATION
    + JDK-8261354: SIGSEGV at MethodIteratorHost
    + JDK-8261355: No data buffering in SunPKCS11 Cipher encryption
    when the underlying mechanism has no padding
    + JDK-8261397: try catch Method failing to work when dividing
    an integer by 0
    + JDK-8261422: Adjust problematic String.format calls in
    jdk/internal/util/Preconditions.java outOfBoundsMessage
    + JDK-8261447: MethodInvocationCounters frequently run into
    overflow
    + JDK-8261481: Cannot read Kerberos settings in dynamic store
    on macOS Big Sur
    + JDK-8261505: Test test/hotspot/jtreg/gc/parallel/
    /TestDynShrinkHeap.java killed by Linux OOM Killer
    + JDK-8261601: free memory in early return in
    Java_sun_nio_ch_sctp_SctpChannelImpl_receive0
    + JDK-8261649: AArch64: Optimize LSE atomics in C++ code
    + JDK-8261730: C2 compilation fails with
    assert(store-&gt;find_edge(load) != -1) failed: missing
    precedence edge
    + JDK-8261752: Multiple GC test are missing memory requirements
    + JDK-8261791: (sctp) handleSendFailed in SctpChannelImpl.c
    potential leaks
    + JDK-8261812: C2 compilation fails with assert(!had_error)
    failed: bad dominance
    + JDK-8261914: IfNode::fold_compares_helper faces
    non-canonicalized bool when running JRuby JSON workload
    + JDK-8262093: java/util/concurrent/tck/JSR166TestCase.java
    failed "assert(false) failed: unexpected node"
    + JDK-8262110: DST starts from incorrect time in 2038
    + JDK-8262121: [11u] Redo 8244287: JFR: Methods samples have
    line number 0
    + JDK-8262163: Extend settings printout in jcmd VM.metaspace
    + JDK-8262295: C2: Out-of-Bounds Array Load from Clone Source
    + JDK-8262298: G1BarrierSetC2::step_over_gc_barrier fails with
    assert "bad barrier shape"
    + JDK-8262446: DragAndDrop hangs on Windows
    + JDK-8262461: handle wcstombsdmp return value correctly in
    unix awt_InputMethod.c
    + JDK-8262465: Very long compilation times and high memory
    consumption in C2 debug builds
    + JDK-8262726: AArch64: C1 StubAssembler::call_RT can corrupt
    stack
    + JDK-8262739: String inflation C2 intrinsic prevents insertion
    of anti-dependencies
    + JDK-8262829: Native crash in
    Win32PrintServiceLookup.getAllPrinterNames()
    + JDK-8262837: handle split_USE correctly
    + JDK-8262900: ToolBasicTest fails to access HTTP server it
    starts
    + JDK-8263260: [s390] Support latest hardware (z14 and z15)
    + JDK-8263311: Watch registry changes for remote printers
    update instead of polling
    + JDK-8263361: Incorrect arraycopy stub selected by C2 for SATB
    collectors
    + JDK-8263404: RsaPrivateKeySpec is always recognized as
    RSAPrivateCrtKeySpec in RSAKeyFactory.engineGetKeySpec
    + JDK-8263425: AArch64: two potential bugs in C1
    LIRGenerator::generate_address()
    + JDK-8263448: CTW: fatal error: meet not symmetric
    + JDK-8263504: Some OutputMachOpcodes fields are uninitialized
    + JDK-8263557: Possible NULL dereference in
    Arena::destruct_contents()
    + JDK-8263558: Possible NULL dereference in fast path arena
    free if ZapResourceArea is true
    + JDK-8263676: AArch64: one potential bug in C1
    LIRGenerator::generate_address()
    + JDK-8263729: [test] divert spurious output away from stream
    under test in ProcessBuilder Basic test
    + JDK-8263846: Bad JNI lookup getFocusOwner in accessibility
    code on Mac OS X
    + JDK-8264047: Duplicate global variable 'jvm' in libjavajpeg
    and libawt
    + JDK-8264096: slowdebug jvm crashes when StrInflatedCopy match
    rule is not supported
    + JDK-8264151: ciMethod::ensure_method_data() should return
    false is loading resulted in empty state
    + JDK-8264173: [s390] Improve Hardware Feature Detection And
    Reporting
    + JDK-8264190: Harden TLS interop tests
    + JDK-8264223: CodeHeap::verify fails extra_hops assertion in
    fastdebug test
    + JDK-8264328: Broken license in
    javax/swing/JComboBox/8072767/bug8072767.java
    + JDK-8264360: Loop strip mining verification fails with
    "should be on the backedge"
    + JDK-8264626: C1 should be able to inline excluded methods
    + JDK-8264640: CMS ParScanClosure misses a barrier
    + JDK-8264786: [macos] All Swing/AWT apps cause Allow
    Notifications prompt to appear when app is launched
    + JDK-8264821: DirectIOTest fails on a system with large block
    size
    + JDK-8264848: [macos] libjvm.dylib linker warning due to macOS
    version mismatch
    + JDK-8264923: PNGImageWriter.write_zTXt throws Exception with
    a typo
    + JDK-8264958: C2 compilation fails with assert "n is later
    than its clone"
    + JDK-8265099: Revert backport to 11u of 8236859: WebSocket
    over authenticating proxy fails with NPE
    + JDK-8265154: vinserti128 operand mix up for KNL platforms
    + JDK-8265239: Shenandoah: Shenandoah heap region count could
    be off by 1
    + JDK-8265417: Backport of JDK-8249672 breaks Solaris x86 build
    + JDK-8265421: java/lang/String/StringRepeat.java test is
    missing a memory requirement
    + JDK-8265462: Handle multiple slots in the NSS Internal Module
    from SunPKCS11's Secmod
    + JDK-8265537: x86 version string truncated after JDK-8249672
    11u backport
    + JDK-8265666: Enable AIX build platform to make external debug
    symbols
    + JDK-8265677: CMS: CardTableBarrierSet::write_ref_array_work()
    lacks storestore barrier
    + JDK-8265690: Use the latest Ubuntu base image version in
    Docker testing
    + JDK-8265718: Build failure after JDK-8258414 11u backport
    + JDK-8265750: Fatal error in safepoint.cpp after backport of
    8258414
    + JDK-8265784: [C2] Hoisting of DecodeN leaves MachTemp inputs
    behind
    + JDK-8265938: C2's conditional move optimization does not
    handle top Phi
    + JDK-8266220: keytool still prompt for store password on a
    password-less pkcs12 file if -storetype pkcs12 is specified
    + JDK-8266293: Key protection using PBEWithMD5AndDES fails with
    "java.security.InvalidAlgorithmParameterException: Salt must
    be 8 bytes long"
    + JDK-8266713: [AIX] Build failure after 11u backport of
    JDK-8247753
    + JDK-8266802: Shenandoah: Round up region size to page size
    unconditionally
    + JDK-8266892: avoid maybe-uninitialized gcc warnings on linux
    s390x
    + JDK-8266929: Unable to use algorithms from 3p providers
    + JDK-8267235: [macos_aarch64]
    InterpreterRuntime::throw_pending_exception messing up LR
    results in crash
    + JDK-8267561: Shenandoah: Reference processing not properly
    setup for outside of cycle degenerated GC
    + JDK-8267599: Revert the change to the default PKCS12
    macAlgorithm and macIterationCount props for 11u/8u/7u
    + JDK-8267641: [11u] 8227609 backport typo
    + JDK-8267721: Enable sun/security/pkcs11 tests for Amazon
    Linux 2 AArch64
    + JDK-8268678: LetsEncryptCA.java test fails as Let's Encrypt
    Authority X3 is retired</changelog>
  <changelog author="schwab@suse.de" date="1628078400">- riscv64-zero.patch: Add support for riscv64 (zero VM)</changelog>
  <changelog author="fstrba@suse.com" date="1629979200">- Added patch:
  * jdk11-glibc234.patch
    + fix build with glibc-2.34 (bsc#1189201)</changelog>
  <changelog author="fstrba@suse.com" date="1631534400">- Modified patch:
  * nss-security-provider.patch
    + revert recent changes making NSS provider the default one
    + fixes bsc#1190252</changelog>
  <changelog author="fstrba@suse.com" date="1631793600">- Added patch:
  * fips.patch
    + implement FIPS support in OpenJDK</changelog>
  <changelog author="fstrba@suse.com" date="1634817600">- Update to upstream tag jdk-11.0.13+8 (October 2021 CPU)
  * Security fixes
    + JDK-8163326, CVE-2021-35550, bsc#1191901: Update the default
    enabled cipher suites preference
    + JDK-8254967, CVE-2021-35565, bsc#1191909:
    com.sun.net.HttpsServer spins on TLS session close
    + JDK-8263314: Enhance XML Dsig modes
    + JDK-8265167, CVE-2021-35556, bsc#1191910: Richer Text Editors
    + JDK-8265574: Improve handling of sheets
    + JDK-8265580, CVE-2021-35559, bsc#1191911: Enhanced style for
    RTF kit
    + JDK-8265776: Improve Stream handling for SSL
    + JDK-8266097, CVE-2021-35561, bsc#1191912: Better hashing
    support
    + JDK-8266103: Better specified spec values
    + JDK-8266109: More Resilient Classloading
    + JDK-8266115: More Manifest Jar Loading
    + JDK-8266137, CVE-2021-35564, bsc#1191913: Improve Keystore
    integrity
    + JDK-8266689, CVE-2021-35567, bsc#1191903: More Constrained
    Delegation
    + JDK-8267086: ArrayIndexOutOfBoundsException in
    java.security.KeyFactory.generatePublic
    + JDK-8267712: Better LDAP reference processing
    + JDK-8267729, CVE-2021-35578, bsc#1191904: Improve TLS client
    handshaking
    + JDK-8267735, CVE-2021-35586, bsc#1191914: Better BMP support
    + JDK-8268193: Improve requests of certificates
    + JDK-8268199: Correct certificate requests
    + JDK-8268205: Enhance DTLS client handshake
    + JDK-8268506: More Manifest Digests
    + JDK-8269618, CVE-2021-35603, bsc#1191906: Better session
    identification
    + JDK-8269624: Enhance method selection support
    + JDK-8270398: Enhance canonicalization
    + JDK-8270404: Better canonicalization
  * Other changes
    + JDK-8024368: private methods are allocated vtable indices
    + JDK-8042902: Test java/net/Inet6Address/serialize/
    /Inet6AddressSerializationTest.java fails intermittently
    + JDK-8140466: ChaCha20 and Poly1305 TLS Cipher Suites
    + JDK-8157404: Unable to read certain PKCS12 keystores from
    SequenceInputStream
    + JDK-8158066: SourceDebugExtensionTest fails to rename file
    + JDK-8168304: Make all of DependencyContext_test available in
    product mode
    + JDK-8169246: java/net/DatagramSocket/ReportSocketClosed.java
    fails intermittently with BindException
    + JDK-8181313: SA: Remove libthread_db dependency on Linux
    + JDK-8193214: Incorrect annotations.without.processors
    warnings with JDK 9
    + JDK-8194230: jdk/internal/jrtfs/remote/
    /RemoteRuntimeImageTest.java fails with
    java.lang.NullPointerException
    + JDK-8196092: javax/swing/JComboBox/8032878/bug8032878.java
    fails
    + JDK-8199931: java/net/MulticastSocket/
    /UnreferencedMulticastSockets.java fails with "incorrect data
    received"
    + JDK-8206083: Make tools/javac/api/T6265137.java robust to JDK
    version changes
    + JDK-8206350: java/util/Locale/bcp47u/SystemPropertyTests.java
    failed on Mac 10.13 with zh_CN and zh_TW locales.
    + JDK-8207316: java/nio/channels/spi/SelectorProvider/
    /inheritedChannel/InheritedChannelTest.java failed
    + JDK-8208227: tools/jdeps/DotFileTest.java fails on Win-X64
    + JDK-8208363: test/jdk/java/lang/Package/
    /PackageFromManifest.java missing module dependencies
    declaration
    + JDK-8209380: ARM: cleanup maybe-uninitialized and reorder
    compiler warnings
    + JDK-8209768: Refactor java/util/prefs/CheckUserPrefsStorage.sh
    to plain java test
    + JDK-8209772: Refactor shell test java/util/ServiceLoader/
    /basic/basic.sh to java
    + JDK-8209773: Refactor shell test javax/naming/module/basic.sh
    to java
    + JDK-8209832: Refactor jdk/internal/reflect/Reflection/
    /GetCallerClassTest.sh to plain java test
    + JDK-8209930: Refactor java/util/zip/ZipFile/deletetempjar.sh
    to plain java test
    + JDK-8210406: Refactor java.util.PluggableLocale:i18n shell
    tests to plain java tests
    + JDK-8210407: Refactor java.util.Calendar:i18n shell tests to
    plain java tests
    + JDK-8210495: compiler crashes because of illegal signature in
    otherwise legal code
    + JDK-8210669: Some launcher tests assume a pre-JDK 9 run-time
    image layout
    + JDK-8210802: temp files left by tests in
    jdk/java/net/httpclient
    + JDK-8210819: Update the host name in CNameTest.java
    + JDK-8210908: Refactor java/util/prefs/PrefsSpi.sh to plain
    java test
    + JDK-8210934: Move sun/net/www/protocol/http/
    /GetErrorStream.java to OpenJDK
    + JDK-8210959: JShell fails and exits when statement throws an
    exception whose message contains a '%'.
    + JDK-8211055: Provide print to a file (PDF) feature even when
    printer was not connected
    + JDK-8211092: test/jdk/sun/net/www/http/HttpClient/
    /MultiThreadTest.java fails intermittently when cleaning up
    + JDK-8211296: Remove HotSpot deprecation warning suppression
    for Mac/clang
    + JDK-8211325: test/jdk/java/net/Socket/LingerTest.java fails
    with cleaning up
    + JDK-8212040: Compilation error due to wrong usage of
    NSPrintJobDispositionValue in mac10.12
    + JDK-8212695: Add explicit timeout to several HTTP Client tests
    + JDK-8212718: Refactor some annotation processor tests to
    better use collections
    + JDK-8213007: Update the link in test/jdk/sun/security/
    /provider/SecureRandom/DrbgCavp.java
    + JDK-8213137: Remove static initialization of monitor/mutex
    instances
    + JDK-8213235: java/nio/channels/SocketChannel/
    /AsyncCloseChannel.java fails with threads that didn't exit
    + JDK-8213409: Refactor sun.text.IntHashtable:i18n shell tests
    to plain java tests
    + JDK-8213576: Make test AsyncCloseChannel.java run in othervm
    + JDK-8213694: Test Timeout.java should run in othervm mode
    + JDK-8213718: [TEST] Wrong classname in vmTestbase/nsk/stress/
    /except/except002 and except003
    + JDK-8213922: fix ctw stand-alone build
    + JDK-8214195: Align stdout messages in
    test/jdk/java/math/BigInteger/PrimitiveConversionTests.java
    + JDK-8214520: [TEST_BUG] sun/security/mscapi/nonUniqueAliases/
    /NonUniqueAliases.java failed with incorrect jtreg tags order
    + JDK-8214937: sun/security/tools/jarsigner/warnings/
    /NoTimestampTest.java failed due to unexpected expiration date
    + JDK-8216532: tools/launcher/Test7029048.java fails (Solaris)
    + JDK-8217825: Verify @AfterTest is used correctly in WebSocket
    tests
    + JDK-8218145: block_if_requested is not proper inlined due to
    size
    + JDK-8219417: bump jtreg requiredVersion to b14
    + JDK-8219552: bump jtreg requiredVersion to b14 in
    test/jdk/sanity/client/
    + JDK-8219804: java/net/MulticastSocket/Promiscuous.java fails
    intermittently due to NumberFormatException
    + JDK-8220445: Support for side by side MSVC Toolset versions
    + JDK-8221988: add possibility to build with Visual Studio 2019
    + JDK-8222751: closed/test/jdk/sun/security/util/
    /DerIndefLenConverter/IndefBerPkcs12.java fail
    + JDK-8223050: JVMCI: findUniqueConcreteMethod() should not use
    Dependencies::find_unique_concrete_method() for non-virtual
    methods
    + JDK-8224853: CDS address sanitizer errors
    + JDK-8225082: Remove IdenTrust certificate that is expiring in
    September 2021
    + JDK-8225583: Examine the HttpResponse.BodySubscribers for
    null handling and multiple subscriptions
    + JDK-8225690: Multiple AttachListener threads can be created
    + JDK-8225790: Two NestedDialogs tests fail on Ubuntu
    + JDK-8226319: Add forgotten test/jdk/java/net/httpclient/
    /BodySubscribersTest.java
    + JDK-8226533: JVMCI: findUniqueConcreteMethod should handle
    statically bindable methods directly
    + JDK-8226602: Test convenience reactive primitives from
    java.net.http with RS TCK
    + JDK-8226683: Remove review suggestion from fix to 8219804
    + JDK-8227738: jvmti/DataDumpRequest/datadumpreq001 failed due
    to "exit code is 134"
    + JDK-8227766: CheckUnhandledOops is broken in MemAllocator
    + JDK-8227815: Minimal VM: set_state is not a member of
    AttachListener
    + JDK-8230674: Heap dumps should exclude dormant CDS archived
    objects of unloaded classes
    + JDK-8230808: Remove Access::equals()
    + JDK-8230841: Remove oopDesc::equals()
    + JDK-8231717: Improve performance of charset decoding when
    charset is always compactable
    + JDK-8232243: Wrong caret position in JTextPane on Windows
    with a screen resolution &gt; 100%
    + JDK-8232782: Shenandoah: streamline post-LRB CAS barrier
    (aarch64)
    + JDK-8233790: Forward output from heap dumper to jcmd/jmap
    + JDK-8233989: Create an IPv4 version of
    java/net/MulticastSocket/SetLoopbackMode.java
    + JDK-8234510: Remove file seeking requirement for writing a
    heap dump
    + JDK-8235211: serviceability/attach/
    /RemovingUnixDomainSocketTest.java fails with
    AttachNotSupportedException: Unable to open socket file
    + JDK-8235216: typo in test filename
    + JDK-8235866: bump jtreg requiredVersion to 4.2b16
    + JDK-8236111: narrow allowSmartActionArgs disabling
    + JDK-8236413: AbstractConnectTimeout should tolerate both
    NoRouteToHostException and UnresolvedAddressException
    + JDK-8236671: NullPointerException in JKS keystore
    + JDK-8238930: problem list compiler/c2/Test8004741.java
    + JDK-8238943: switch to jtreg 5.0
    + JDK-8240555: Using env of JAVA_TOOL_OPTIONS and _JAVA_OPTIONS
    breaks QuietOption.java test
    + JDK-8240983: Incorrect copyright header in Apache Santuario
    2.1.3 files
    + JDK-8241336: Some java.net tests failed with
    NoRouteToHostException on MacOS with special network
    configuration
    + JDK-8241353: NPE in ToolProvider.getSystemJavaCompiler
    + JDK-8241768: git needs .gitattributes
    + JDK-8242882: opening jar file with large manifest might throw
    NegativeArraySizeException
    + JDK-8244973: serviceability/attach/
    /RemovingUnixDomainSocketTest.java fails "stderr was not
    empty"
    + JDK-8245134: test/lib/jdk/test/lib/security/
    /KeyStoreUtils.java should allow to specify aliases
    + JDK-8246261: TCKLocalTime.java failed due to "AssertionError:
    expected [18:14:22] but found [18:14:23]"
    + JDK-8246387: switch to jtreg 5.1
    + JDK-8247421: [TESTBUG] ReturnBlobToWrongHeapTest.java failed
    allocating blob
    + JDK-8247469: getSystemCpuLoad() returns -1 on linux when some
    offline cpus are present and cpusets.effective_cpus is not
    available
    + JDK-8248352: [TEST_BUG] Test test/jdk/java/awt/font/
    /TextLayout/ArabicDiacriticTest.java can leave frame open
    + JDK-8248403: AArch64: Remove uses of kernel integer types
    + JDK-8248414: AArch64: Remove uses of long and unsigned long
    ints
    + JDK-8248657: Windows: strengthening in ThreadCritical
    regarding memory model
    + JDK-8248666: AArch64: Use THREAD_LOCAL instead of __thread
    + JDK-8248668: AArch64: Avoid MIN/MAX macros when using MSVC
    + JDK-8248671: AArch64: Remove unused variables
    + JDK-8248682: AArch64: Use ATTRIBUTE_ALIGNED helper
    + JDK-8248816: C1: Fix signature conflict in
    LIRGenerator::strength_reduce_multiply
    + JDK-8249095: tools/javac/launcher/SourceLauncherTest.java
    fails on Windows
    + JDK-8249548: backward focus traversal gets stuck in button
    group
    + JDK-8249773: Upgrade ReceiveISA.java test to be resilient to
    failure due to stray packets and interference
    + JDK-8249897: jdk/javadoc/tool/LangVers.java uses @ignore w/o
    bug-id
    + JDK-8249898: jdk/javadoc/tool/6176978/T6176978.java uses
    @ignore w/o bug-id
    + JDK-8249899: jdk/javadoc/tool/InlineTagsWithBraces.java uses
    @ignore w/o bug-id
    + JDK-8250588: Shenandoah: LRB needs to save/restore fp
    registers for runtime call
    + JDK-8250824: AArch64: follow up for JDK-8248414
    + JDK-8251166: Add automated testcases for changes done in
    JDK-8214112
    + JDK-8251252: Add automated testcase for fix done in
    JDK-8214253
    + JDK-8251254: Add automated test for fix done in JDK-8218472
    + JDK-8251361: Potential race between Logger configuration and
    GCs in HttpURLConWithProxy test
    + JDK-8251549: Update docs on building for Git
    + JDK-8251945: SIGSEGV in
    PackageEntry::purge_qualified_exports()
    + JDK-8252194: Add automated test for fix done in JDK-8218469
    + JDK-8252648: Shenandoah: name gang tasks consistently
    + JDK-8252825: Add automated test for fix done in JDK-8218479
    + JDK-8252853: AArch64: gc/shenandoah/TestVerifyJCStress.java
    fails intermittently with C1
    + JDK-8252857: AArch64: Shenandoah C1 CAS is not sequentially
    consistent
    + JDK-8253048: AArch64: When CallLeaf, no need to preserve
    callee-saved registers in caller
    + JDK-8253424: Add support for running pre-submit testing using
    GitHub Actions
    + JDK-8253631: Remove unimplemented CompileBroker methods after
    JEP-165
    + JDK-8253865: Pre-submit testing using GitHub Actions does not
    detect failures reliably
    + JDK-8253899: Make IsClassUnloadingEnabled signature match
    specification
    + JDK-8254024: Enhance native libs for AWT and Swing to work
    with GraalVM Native Image
    + JDK-8254054: Pre-submit testing using GitHub Actions should
    not use the deprecated set-env command
    + JDK-8254173: Add Zero, Minimal hotspot targets to submit
    workflow
    + JDK-8254175: Build no-pch configuration in debug mode for
    submit checks
    + JDK-8254244: Some code emitted by TemplateTable::branch is
    unused when running TieredCompilation
    + JDK-8254270: linux 32 bit build doesn't compile
    libjdwp/log_messages.c
    + JDK-8254282: Add Linux x86_32 builds to submit workflow
    + JDK-8254850: Update terminology in java.awt.GridBagLayout
    source code comments
    + JDK-8255255: Update Apache Santuario (XML Signature) to
    version 2.2.1
    + JDK-8255305: Add Linux x86_32 tier1 to submit workflow
    + JDK-8255352: Archive important test outputs in submit workflow
    + JDK-8255373: Submit workflow artifact name is always
    "test-results_.zip"
    + JDK-8255452: Doing GC during JVMTI MethodExit event posting
    breaks return oop
    + JDK-8255718: Zero: VM should know it runs in interpreter-only
    mode
    + JDK-8255790: GTKL&amp;F: Java 16 crashes on initialising GTKL&amp;F
    on Manjaro Linux
    + JDK-8255810: Zero: build fails without JVMTI
    + JDK-8255895: Submit workflow artifacts miss hs_errs/replays
    due to ZIP include mismatch
    + JDK-8256127: Add cross-compiled foreign architectures builds
    to submit workflow
    + JDK-8256215: Shenandoah: re-organize saving/restoring machine
    state in assembler code
    + JDK-8256267: Relax compiler/floatingpoint/NaNTest.java for
    x86_32 and lower -XX:+UseSSE
    + JDK-8256277: Github Action build on macOS should define OS
    and Xcode versions
    + JDK-8256354: Github Action build on Windows should define OS
    and MSVC versions
    + JDK-8256393: Github Actions build on Linux should define OS
    and GCC versions
    + JDK-8256414: add optimized build to submit workflow
    + JDK-8256747: GitHub Actions: decouple the hotspot build-only
    jobs from Linux x64 testing
    + JDK-8257056: Submit workflow should apt-get update to avoid
    package installation errors
    + JDK-8257148: Remove obsolete code in AWTView.m
    + JDK-8257497: Update keytool to create AKID from the SKID of
    the issuing certificate as specified by RFC 5280
    + JDK-8257620: Do not use objc_msgSend_stret to get macOS
    version
    + JDK-8257913: Add more known library locations to simplify
    Linux cross-compilation
    + JDK-8258703: Incorrect 512-bit vector registers restore on
    x86_32
    + JDK-8259338: Add expiry exception for identrustdstx3 alias to
    VerifyCACerts.java test
    + JDK-8259535: ECDSA SignatureValue do not always have the
    specified length
    + JDK-8259679: GitHub actions should use MSVC 14.28
    + JDK-8259924: GitHub actions fail on Linux x86_32 with "Could
    not configure libc6:i386"
    + JDK-8260460: GitHub actions still fail on Linux x86_32 with
    "Could not configure libc6:i386"
    + JDK-8260589: Crash in JfrTraceIdLoadBarrier::load(_jclass*)
    + JDK-8260923: Add more tests for SSLSocket input/output
    shutdown
    + JDK-8261072: AArch64: Fix MacroAssembler::get_thread
    convention
    + JDK-8261147: C2: Node is wrongly marked as reduction
    resulting in a wrong execution due to wrong vector instructions
    + JDK-8261238: NMT should not limit baselining by size threshold
    + JDK-8261496: Shenandoah: reconsider pacing updates memory
    ordering
    + JDK-8261652: Remove some dead comments from os_bsd_x86
    + JDK-8261846: [JVMCI] c2v_iterateFrames can get out of sync
    with the StackFrameStream
    + JDK-8262000: jdk/jfr/event/gc/detailed/
    /TestPromotionFailedEventWithParallelScavenge.java failed with
    "OutOfMemoryError: Java heap space"
    + JDK-8262017: C2: assert(n != __null) failed: Bad immediate
    dominator info.
    + JDK-8262392: Update Mesa 3-D Headers to version 21.0.3
    + JDK-8262409: sun/security/ssl/SSLSocketImpl/
    /SSLSocketImplThrowsWrongExceptions. SSL test failures caused
    by java failed with "Server reported the wrong exception"
    + JDK-8262470: Printed GlyphVector outline with low DPI has bad
    quality on Windows
    + JDK-8262862: Harden tests sun/security/x509/URICertStore/
    /ExtensionsWithLDAP.java and krb5/canonicalize/Test.java
    + JDK-8263136: C4530 was reported from VS 2019 at access bridge
    + JDK-8263227: C2: inconsistent spilling due to dead nodes in
    exception block
    + JDK-8263382: java/util/logging/ParentLoggersTest.java failed
    with "checkLoggers: getLoggerNames() returned unexpected
    loggers"
    + JDK-8263407: SPARC64 detection fails on Athena (SPARC64-X)
    + JDK-8263432: javac may report an invalid package/class clash
    on case insensitive filesystems
    + JDK-8263490: [macos] Crash occurs on JPasswordField with
    activated InputMethod
    + JDK-8263531: Remove unused buffer int
    + JDK-8263667: Avoid running GitHub actions on branches named
    pr/*
    + JDK-8263776: [JVMCI] add helper to perform Java upcalls
    + JDK-8264016: [JVMCI] add some thread local fields for use by
    JVMCI
    + JDK-8264752: SIGFPE crash with option
    FlightRecorderOptions:threadbuffersize=30M
    + JDK-8265132: C2 compilation fails with assert "missing
    precedence edge"
    + JDK-8265231: (fc) ReadDirect and WriteDirect tests fail after
    fix for JDK-8264821
    + JDK-8265335: Epsilon: Minor typo in EpsilonElasticTLABDecay
    description
    + JDK-8265756: AArch64: initialize memory allocated for locals
    according to Windows AArch64 stack page growth requirement in
    template interpreter
    + JDK-8265761: Font with missed font family name is not
    properly printed on Windows
    + JDK-8265773: incorrect jdeps message "jdk8internals" to
    describe a removed JDK internal API
    + JDK-8265836: OperatingSystemImpl.getCpuLoad() returns
    incorrect CPU load inside a container
    + JDK-8266018: Shenandoah: fix an incorrect assert
    + JDK-8266206: Build failure after JDK-8264752 with older GCCs
    + JDK-8266248: Compilation failure in
    PLATFORM_API_MacOSX_MidiUtils.c with Xcode 12.5
    + JDK-8266288: assert root method not found in
    witnessed_reabstraction_in_supers is too strong
    + JDK-8266404: Fatal error report generated with
  - XX:+CrashOnOutOfMemoryError should not contain suggestion to
    submit a bug report
    + JDK-8266480: Implicit null check optimization does not update
    control of hoisted memory operation
    + JDK-8266615: C2 incorrectly folds subtype checks involving an
    interface array
    + JDK-8266642: Improve ResolvedMethodTable hash function
    + JDK-8266749: AArch64: Backtracing broken on PAC enabled
    systems
    + JDK-8266761: AssertionError in
    sun.net.httpserver.ServerImpl.responseCompleted
    + JDK-8266813: Shenandoah: Use shorter instruction sequence for
    checking if marking in progress
    + JDK-8267042: bug in monitor locking/unlocking on ARM32 C1 due
    to uninitialized BasicObjectLock::_displaced_header
    + JDK-8267348: Rewrite gc/epsilon/TestClasses.java to use
    Metaspace with less classes
    + JDK-8267396: Avoid recording "pc" in unhandled oops detector
    for better performance
    + JDK-8267399: C2: java/text/Normalizer/ConformanceTest.java
    test failed with assertion
    + JDK-8267424: CTW: C1 fails with "State must not be null"
    + JDK-8267459: Pasting Unicode characters into JShell does not
    work.
    + JDK-8267625: AARCH64: typo in LIR_Assembler::emit_profile_type
    + JDK-8267666: Add option to jcmd GC.heap_dump to use existing
    file
    + JDK-8267695: Bump update version for OpenJDK: jdk-11.0.13
    + JDK-8267751: (test) jtreg.SkippedException has no serial
    VersionUID
    + JDK-8267773: PhaseStringOpts::int_stringSize doesn't handle
    min_jint correctly
    + JDK-8268103: JNI functions incorrectly return a double after
    JDK-8265836
    + JDK-8268127: Shenandoah: Heap size may be too small for
    region to align to large page size
    + JDK-8268261: C2: assert(n != __null) failed: Bad immediate
    dominator info.
    + JDK-8268347: C2: nested locks optimization may create
    unbalanced monitor enter/exit code
    + JDK-8268360: Missing check for infinite loop during node
    placement
    + JDK-8268362: [REDO] C2 crash when compile negative
    Arrays.copyOf length after loop
    + JDK-8268366: Incorrect calculation of has_fpu_registers in C1
    linear scan
    + JDK-8268369: SIGSEGV in PhaseCFG::implicit_null_check due to
    missing null check
    + JDK-8268417: Add test from JDK-8268360
    + JDK-8268427: Improve AlgorithmConstraints:checkAlgorithm
    performance
    + JDK-8268617: [11u REDO] - WebSocket over authenticating proxy
    fails with NPE
    + JDK-8268620: InfiniteLoopException test may fail on x86
    platforms
    + JDK-8268635: Corrupt oop in ClassLoaderData
    + JDK-8268699: Shenandoah: Add test for JDK-8268127
    + JDK-8268771: javadoc -notimestamp option does not work on
    index.html
    + JDK-8268775: Password is being converted to String in
    AccessibleJPasswordField
    + JDK-8268776: Test `ADatagramSocket.java` missing /othervm
    from @run tag
    + JDK-8268965: TCP Connection Reset when connecting simple
    socket to SSL server
    + JDK-8269304: Regression ~5% in 2005 in b27
    + JDK-8269415: [11u] Remove ea from
    DEFAULT_PROMOTED_VERSION_PRE in OpenJDK 11u
    + JDK-8269478: Shenandoah: gc/shenandoah/mxbeans tests should
    be more resilient
    + JDK-8269529: javax/swing/reliability/
    /HangDuringStaticInitialization.java fails in Windows debug
    build
    + JDK-8269594: assert(_handle_mark_nesting &gt; 1) failed: memory
    leak: allocating handle outside HandleMark
    + JDK-8269614: [s390] Interpreter checks wrong bit for slow
    path instance allocation
    + JDK-8269650: Optimize gc-locker in
    [Get|Release]StringCritical for latin string
    + JDK-8269661: JNI_GetStringCritical does not lock char array
    + JDK-8269668: [aarch64] java.library.path not including
    /usr/lib64
    + JDK-8269763: The JEditorPane is blank after JDK-8265167
    + JDK-8269795: C2: Out of bounds array load floats above its
    range check in loop peeling resulting in SEGV
    + JDK-8269847: JDK-8269594 backport breaks 11u builds
    + JDK-8269850: Most JDK releases report macOS version 12 as
    10.16 instead of 12.0
    + JDK-8269851: OperatingSystemMXBean getProcessCpuLoad reports
    incorrect process cpu usage in containers
    + JDK-8269882: stack-use-after-scope in NewObjectA
    + JDK-8269934: RunThese24H.java failed with
    EXCEPTION_ACCESS_VIOLATION in
    java_lang_Thread::get_thread_status
    + JDK-8270096: Shenandoah: Optimize gc/shenandoah/
    /TestRefprocSanity.java for interpreter mode
    + JDK-8270137: Kerberos Credential Retrieval from Cache not
    Working in Cross-Realm Setup
    + JDK-8270184: [TESTBUG] Add coverage for jvmci
    ResolvedJavaType.toJavaName() for lambdas
    + JDK-8270196: [11u] [JVMCI] JavaType.toJavaName() returns
    incorrect type name for lambdas
    + JDK-8270556: Exclude security/infra/java/security/cert/
    /CertPathValidator/certification/LetsEncryptCA
    + JDK-8270893: IndexOutOfBoundsException while reading large
    TIFF file
    + JDK-8272078: Wrong Checksums in Temurin BootJDK dependencies
    + JDK-8272124: Cgroup v1 initialization causes
    NullPointerException when cgroup path contains colon
    + JDK-8272131: PhaseMacroExpand::generate_slow_arraycopy crash
    when clone null CallProjections.fallthrough_ioproj
    + JDK-8272197: Update 11u GHA workflow with Shenandoah
    configurations
    + JDK-8272332: --with-harfbuzz=system doesn't add -lharfbuzz
    after JDK-8255790
    + JDK-8272472: StackGuardPages test doesn't build with glibc
    2.34
    + JDK-8272602: [macos] not all KEY_PRESSED events sent when
    control modifier is used
    + JDK-8272628: Problemlist gc/stress/gcbasher/
    /TestGCBasherWithCMS.java for x86_32
    + JDK-8272700: [macos] Build failure with Xcode 13.0 after
    JDK-8264848
    + JDK-8272772: Shenandoah: compiler/c2/aarch64/
    /TestVolatilesShenandoah.java fails in 11u
    + JDK-8273939: Backport of 8248414 to JDK11 breaks
    MacroAssembler::adrp
- Remove the unneeded icedtea-sound provider
- Removed patches:
  * icedtea-sound-1.0.1-jdk9.patch
  * icedtea-sound-soundproperties.patch
    + not needed since the icedtea-sound provider is removed
  * jdk11-glibc234.patch
    + integrated upstream</changelog>
  <changelog author="fstrba@suse.com" date="1635940800">- Modified patches:
  * system-crypto-policy.patch
    + rediff to changed context
  * fips.patch
    + Allow plain key import in fips mode unless
    com.suse.fips.plainKeySupport is set to false</changelog>
  <changelog author="fstrba@suse.com" date="1636113600">- Modified patch:
  * fips.patch
    + return in native code after generating java.io.IOException</changelog>
</package>
<package pkgid="0c4d901febb0fc3eb8c5472847ae128687d8c1584c41697a4b6d1a6794107c9b" name="java-11-openjdk-headless" arch="aarch64">
  <version epoch="0" ver="11.0.13.0" rel="3.68.1"/>
  <changelog author="fstrba@suse.com" date="1586952000">- The pack200 and unpack200 alternatives should be slaves of java
  and not of javac, since they are part of JRE.</changelog>
  <changelog author="fstrba@suse.com" date="1587470400">- Update to upstream tag jdk-11.0.7+10 (April 2020 CPU,
  bsc#1169511)
  * Security fixes:
    + S8223898, CVE-2020-2754: Forward references to Nashorn
    + S8223904, CVE-2020-2755: Improve Nashorn matching
    + S8224541, CVE-2020-2756: Better mapping of serial ENUMs
    + S8224549, CVE-2020-2757: Less Blocking Array Queues
    + S8225603: Enhancement for big integers
    + S8226346: Build better binary builders
    + S8227467: Better class method invocations
    + S8227542: Manifest improved jar headers
    + S8229733: TLS message handling improvements
    + S8231415, CVE-2020-2773: Better signatures in XML
    + S8231785: Improved socket permissions
    + S8232424, CVE-2020-2778: More constrained algorithms
    + S8232581, CVE-2020-2767: Improve TLS verification
    + S8233250: Better X11 rendering
    + S8233410: Better Build Scripting
    + S8234027: Better JCEKS key support
    + S8234408, CVE-2020-2781: Improve TLS session handling
    + S8234825, CVE-2020-2800: Better Headings for HTTP Servers
    + S8234841, CVE-2020-2803: Enhance buffering of byte buffers
    + S8235274, CVE-2020-2805: Enhance typing of methods
    + S8235691, CVE-2020-2816: Enhance TLS connectivity
    + S8236201, CVE-2020-2830: Better Scanner conversions
    + S8238960: linux-i586 builds are inconsistent as the newly
    built jdk is not able to reserve enough space for object heap
  * Other changes:
    + S4919790: Errors in alert ssl message does not reflect the
    actual certificate status
    + S4949105: Access Bridge lacks html tags parsing
    + S7092821: java.security.Provider.getService() is synchronized
    and became scalability bottleneck
    + S7143743: Potential memory leak with zip provider
    + S8005819: Support cross-realm MSSFU
    + S8042383: [TEST_BUG] Test javax/swing/plaf/basic/BasicMenuUI/
    /4983388/bug4983388.java fails with shortcuts on menus do not
    work
    + S8068184: Fix for JDK-8032832 caused a deadlock
    + S8145845: [AOT] NullPointerException in
    compiler/whitebox/GetCodeHeapEntriesTest.java
    + S8152988: [AOT] Update test batch definitions to include
    aot-ed java.base module mode into hs-comp testing
    + S8160926: FLAGS_COMPILER_CHECK_ARGUMENTS doesn't handle
    cross-compilation
    + S8163083: SocketListeningConnector does not allow invocations
    with port 0
    + S8163251: Hard coded loop limit prevents reading of smart
    card data greater than 8k
    + S8167276: jvmci/compilerToVM/MaterializeVirtualObjectTest.java
    fails with -XX:-EliminateAllocations
    + S8169718: nsk/jdb/locals/locals002: ERROR: Cannot find
    boolVar with expected value: false
    + S8176556:
    java/awt/dnd/ImageTransferTest/ImageTransferTest.java fails
    for JFIF
    + S8178798: Two compiler/aot/verification/vmflags tests fail by
    timeout with UseAVX=3
    + S8183107: PKCS11 regression regarding checkKeySize
    + S8185005: Improve performance of
    ThreadMXBean.getThreadInfo(long ids[], int maxDepth)
    + S8189633: Missing -Xcheck:jni checking for DeleteWeakGlobalRef
    + S8189861: Refactor CacheFind
    + S8193042: NativeLookup::lookup_critical_entry() should only
    load shared library once
    + S8193596: java/net/DatagramPacket/ReuseBuf.java failed due to
    timeout
    + S8194944: Regression automated test 'open/test/jdk/javax/
    /swing/JInternalFrame/8145896/TestJInternalFrameMaximize.java'
    fails
    + S8196467: javax/swing/JInternalFrame/Test6325652.java fails
    + S8196969: JTreg Failure: serviceability/sa/ClhsdbJstack.java
    causes NPE
    + S8198321: javax/swing/JEditorPane/5076514/bug5076514.java
    fails
    + S8198398: Test javax/swing/JColorChooser/Test6199676.java
    fails in mach5
    + S8199072: Test javax/swing/GroupLayout/6613904/
    /bug6613904.java is unstable
    + S8200432: javadoc fails with ClassCastException on {@link
    byte[]}
    + S8201349: build broken when configured with
  - -with-zlib=bundled on gcc 7.3
    + S8201355: Avoid native memory allocation in
    sun.security.mscapi.PRNG.generateSeed
    + S8201513: nsk/jvmti/IterateThroughHeap/filter-* are broken
    + S8203364: Some serviceability/sa/ tests intermittently fail
    with java.io.IOException: LingeredApp terminated with non-zero
    exit code 3
    + S8203687: javax/net/ssl/compatibility/Compatibility.java
    supports TLS 1.3
    + S8203904: javax/swing/JSplitPane/4816114/bug4816114.java: The
    divider location is wrong
    + S8203911: Test runtime/modules/getModuleJNI/GetModule fails
    with -Xcheck:jni
    + S8204525: [TESTBUG] runtime/NMT/MallocStressTest.java ran out
    of java heap
    + S8204529: gc/TestAllocateHeapAtMultiple.java fail with Agent
    7 timed out
    + S8204551: Event descriptions are truncated in logs
    + S8206963: [AOT] bug with multiple class loaders
    + S8207367: 10 vmTestbase/nsk/jdi tests timed out when running
    with jtreg
    + S8207832: serviceability/sa/ClhsdbCDSCore.java failed with
    "Couldn't find core file location"
    + S8207938: At step6,Click Add button,case failed automatically.
    + S8208157: requires.VMProps throws NPE for missing properties
    in "release" file
    + S8208379: compiler/jvmci/events/
    /JvmciNotifyInstallEventTest.java failed with "Got unexpected
    event count after 2nd install attempt: expected 9 to equal 2"
    + S8208658: Make CDS archived heap regions usable even if
    compressed oop encoding has changed
    + S8208715: Conversion of milliseconds to nanoseconds in
    UNIXProcess contains bug
    + S8209361: [AOT] Unexpected number of references for
    JVMTI_HEAP_REFERENCE_CONSTANT_POOL [111--&gt;111]: 0 (expected
    at least 1)
    + S8209385: CDS runtime classpath checking is too strict when
    only classes from the system modules are archived
    + S8209389: SIGSEGV in WalkOopAndArchiveClosure::do_oop_work.
    + S8209418: Synchronize test/jdk/sanity/client/lib/jemmy with
    code-tools/jemmy/v2
    + S8209494: Create a test for SwingSet InternalFrameDemo
    + S8209499: Create test for SwingSet EditorPaneDemo
    + S8209574: [AOT] breakpoint events are generated in different
    threads does not meet expected count
    + S8209686: cleanup arguments to PhaseIdealLoop() constructor
    + S8209789: Synchronize test/jdk/sanity/client/lib/jemmy with
    code-tools/jemmy/v2
    + S8209802: Garbage collectors should register JFR types
    themselves to avoid build errors.
    + S8209807: improve handling exception in requires.VMProps
    + S8209817: stack is executable when building with Clang on
    Linux
    + S8209824: Improve the code coverage for ThreadLocal
    + S8209826: Undefined reference to os::write after JDK-8209657
    (filemap.hpp cleanup)
    + S8209850: Allow NamedThreads to use GlobalCounter critical
    sections
    + S8209976: Improve iteration over non-JavaThreads
    + S8209993: Create a test for SwingSet3 ToolTipDemo
    + S8210024: JFR calls virtual is_Java_thread from ~Thread()
    + S8210052: Enable testing for all the available look and feels
    in SwingSet3 demo tests
    + S8210055: Enable different look and feel tests in SwingSet3
    demo tests
    + S8210057: Enable different look and feels in SwingSet3 demo
    test InternalFrameDemoTest
    + S8210058: Algorithmic Italic font leans opposite angle in
    Printing
    + S8210220: [AOT] jdwp test cases are failing with error #
    ERROR: TEST FAILED: Cought IOException while receiving event
    packet
    + S8210289: ArchivedKlassSubGraphInfoRecord is incomplete
    + S8210459: Add support for generating compile_commands.json
    + S8210476: sun/security/mscapi/PrngSlow.java fails with Still
    too slow
    + S8210512: [Testbug] vmTestbase/nsk/jdi/ObjectReference/
    /referringObjects/referringObjects002/referringObjects002.java
    fails with unexpected size of
    ClassLoaderReference.referringObjects
    + S8210523: runtime/appcds/cacheObject/DifferentHeapSizes.java
    crash
    + S8210632: Add key exchange algorithm to
    javax/net/ssl/TLSCommon/CipherSuite.java
    + S8210699: Problem list tests which times out in Xcomp mode
    + S8210793: [JVMCI] AllocateCompileIdTest.java failed to find
    DiagnosticCommand.class
    + S8210910: Create test for FileChooserDemo
    + S8210994: Create test for SwingSet3 FrameDemo
    + S8211139: Increase timeout value in all tests under
    jdk/sanity/client/SwingSet/src
    + S8211160: Handle different look and feels in
    JInternalFrameOperator
    + S8211211: vmTestbase/metaspace/stressDictionary/
    /StressDictionary.java timeout
    + S8211322: Reduce the timeout of tooltip in SwingSet2DemoTest
    + S8211443: Enable different look and feels in SwingSet3 demo
    test SplitPaneDemoTest
    + S8211703: JInternalFrame : java.lang.AssertionError: cannot
    find the internal frame
    + S8211781: re-building fails after changing Graal sources
    + S8212897: Some improvements in the EditorPaneDemotest
    + S8212903: [TestBug] Tests test/jdk/javax/swing/LookAndFeel/
    /8145547/DemandGTK2.sh and DemandGTK3.sh fail on Ubuntu 18.04
    LTS
    + S8213009: Refactoring existing SunMSCAPI classes
    + S8213010: Supporting keys created with certmgr.exe
    + S8213168: Enable different look and feel tests in SwingSet3
    demo test FileChooserDemoTest
    + S8213348: jdk.internal.vm.compiler.management service
    providers missing in module descriptor
    + S8213906: Update arm devkits with libXrandr headers
    + S8213908: AssertionError in DeferredAttr at setOverloadKind
    + S8214124: [TESTBUG] Bugs in runtime/NMT/MallocStressTest.java
    + S8214344: C2: assert(con.basic_type() != T_ILLEGAL) failed:
    elembt=byte; loadbt=void; unsigned=0
    + S8214345: infinite recursion while checking super class
    + S8214471: Enable different look and feel tests in SwingSet3
    demo test ToolTipDemoTest
    + S8214534: Setting of THIS_FILE in the build is broken
    + S8214557: Filter out VM flags which don't affect AOT code
    generation
    + S8214578: [macos] Problem with backslashes on macOS/JIS
    keyboard: Java ignores system settings
    + S8214840: runtime/NMT/MallocStressTest.java timed out
    + S8214850: Rename vm_operations.?pp files to vmOperations.?pp
    files
    + S8214904: Test8004741.java failed due to "Too few ThreadDeath
    hits; expected at least 6 but saw only 5"
    + S8215322: add @file support to jaotc
    + S8215355: Object monitor deadlock with no threads holding the
    monitor (using jemalloc 5.1)
    + S8215396: JTabbedPane preferred size calculation is wrong for
    SCROLL_TAB_LAYOUT
    + S8216180: [AOT] compiler/intrinsics/bigInteger/TestMulAdd.java
    crashed with AOT enabled
    + S8216353: Use utility APIs introduced in org/netbeans/jemmy/
    /util/LookAndFeel class in client sanity test cases
    + S8216354: Syntax error in toolchain_windows.m4
    + S8216472: (se) Stack overflow during selection operation
    leads to crash (win)
    + S8216535: tools/jimage/JImageExtractTest.java timed out
    + S8217235: Create automated test for SwingSet
    ColorChooserDemoTest
    + S8217297: Add support for multiple look and feel for SwingSet
    SliderDemoTest
    + S8217338: [Containers] Improve systemd slice memory limit
    support
    + S8217613: [AOT] TEST_OPTS_AOT_MODULES doesn't work on mac
    + S8217634: RunTest documentation and usability update
    + S8217717: ZGC: Broken oop map in C1 load barrier stub
    + S8217728: Speed up incremental rerun of "make hotspot"
    + S8218268: Javac treats Manifest Class-Path entries as Paths
    instead of URLs
    + S8218662: Allow 204 responses with Content-Length:0
    + S8218882: NET_Writev is declared, NET_WriteV is defined
    + S8218889: Improperly use of the Optional API
    + S8219205: JFR file without license header
    + S8219597: (bf) Heap buffer state changes could provoke
    unexpected exceptions
    + S8219723: javax/net/ssl/compatibility/Compatibility.java
    failed on some SNI cases
    + S8220348: [ntintel] asserts about copying unaligned array
    + S8220451: jdi/EventQueue/remove/remove004 failed due to
    "ERROR: thread2 is not alive"
    + S8220456: jdi/EventQueue/remove_l/remove_l004 failed due to
    "TIMEOUT while waiting for event"
    + S8220479: java/nio/channels/Selector/SelectWithConsumer.java
    failed at testTwoChannels()
    + S8220613: java/util/Arrays/TimSortStackSize2.java times out
    with fastdebug build
    + S8220688: [TESTBUG] runtime/NMT/MallocStressTest.java timed
    out
    + S8220786: Create new switch to redirect error reporting
    output to stdout or stderr
    + S8221270: Duplicated synchronized keywords in SSLSocketImpl
    + S8221312: test/jdk/sanity/client/SwingSet/src/
    /ColorChooserDemoTest.java failed
    + S8221851: Use of THIS_FILE in hotspot invalidates precompiled
    header on Linux/GCC
    + S8221885: Add intermittent test in the JavaSound to the
    ProblemList
    + S8222264: Windows incremental build is broken with JDK-8217728
    + S8222391: javax/net/ssl/compatibility/Compatibility.java
    should be more flexible
    + S8222448: java/lang/reflect/PublicMethods/
    /PublicMethodsTest.java times out
    + S8222519: ButtonDemoScreenshotTest fails randomly with "still
    state to be reached"
    + S8222741: jdi/EventQueue/remove/remove004 fails due to
    VMDisconnectedException
    + S8223003: SunMSCAPI keys are not cleaned up
    + S8223063: Support CNG RSA keys
    + S8223158: Docked MacBook cannot start any Java Swing
    applications
    + S8223260: NamingManager should cache InitialContextFactory
    + S8223464: Improve version string for Oracle CI builds
    + S8223558: Java does not render Myanmar script correctly
    + S8223627: jdk-13+20 bundle name contains null instead of ea
    + S8223638: Replace wildcard address with loopback or local
    host in tests - part 6
    + S8223678: Add Visual Studio Code workspace generation support
    (for native code)
    + S8223727: com/sun/jndi/ldap/privconn/RunTest.java failed due
    to hang in LdapRequest.getReplyBer
    + S8223769: Assert triggers with -XX:+StressReflectiveCode
    + S8224187: Refactor arraycopy_prologue to allow ZGC read
    barriers on arraycopy
    + S8224475: JTextPane does not show images in HTML rendering
    + S8224673: Adjust permission for delayed starting of debugging
    + S8224705: Tests that need to be problem-listed or have
    printer resources
    + S8224778: test/jdk/demo/jfc/J2Ddemo/J2DdemoTest.java cannot
    find J2Ddemo.jar
    + S8224821: java/awt/Focus/NoAutotransferToDisabledCompTest/
    /NoAutotransferToDisabledCompTest.java fails linux-x64
    + S8224830: test/jdk/java/awt/Focus/
    /ModalExcludedWindowClickTest/
    /ModalExcludedWindowClickTest.java fails on linux-x64
    + S8224851: AArch64: fix warnings and errors with Clang and GCC
    8.3
    + S8224905: java/lang/ProcessBuilder/Basic.java#id1 failed with
    stream closed
    + S8225007: java/awt/print/PrinterJob/
    /LandscapeStackOverflow.java may hang
    + S8225105: java/awt/Focus/ShowFrameCheckForegroundTest/
    /ShowFrameCheckForegroundTest.java fails in Windows 10
    + S8225117: java/math/BigInteger/SymmetricRangeTests.java fails
    with ParseException
    + S8225128: Add exception for expiring DocuSign root to
    VerifyCACerts test
    + S8225130: Add exception for expiring Comodo roots to
    VerifyCACerts test
    + S8225144: [macos] In Aqua L&amp;F backspace key does not delete
    when Shift is pressed
    + S8225180: SignedObject with invalid Key not throwing the
    InvalidKeyException in Windows
    + S8225182: JNI exception pending in DestroyXIMCallback of
    awt_InputMethod.c:1327
    + S8225199: [Graal] compiler/jvmci/compilerToVM/
    /IsMatureVsReprofileTest.java fails with
  - XX:CompileThresholdScaling=0.1
    + S8225305: ProblemList java/lang/invoke/VarHandles tests
    + S8225350: compiler/jvmci/compilerToVM/IsCompilableTest.java
    timed out
    + S8225430: Replace wildcard address with loopback or local
    host in tests - part 14
    + S8225435: Upgrade IANA Language Subtag Registry to the latest
    for JDK14
    + S8225487: giflib legal file is missing attribution for
    openbsd-reallocarray.c
    + S8225567: Wrong file headers with 8202414 fix changeset
    + S8225684: [AOT] vmTestbase/vm/oom/production/
    /AlwaysOOMProduction tests fail with AOTed java.base
    + S8225766: Curve in certificate should not affect signature
    scheme when using TLSv1.3
    + S8225797: OldObjectSample event creates unexpected amount of
    checkpoint data
    + S8226381: ProblemList java/lang/reflect/PublicMethods/
    /PublicMethodsTest.java
    + S8226406: JVM fails to detect mismatched or corrupt CDS
    archive
    + S8226608: Hide the onjcmd option from the help output
    + S8226892: ActionListeners on JRadioButtons don't get notified
    when selection is changed with arrow keys
    + S8227112: exclude compiler/intrinsics/sha/sanity tests from
    AOT runs
    + S8227324: Upgrade to freetype 2.10.1
    + S8227528: TestAbortVMOnSafepointTimeout.java failed due to
    "RuntimeException: 'Safepoint sync time longer than' missing
    from stdout/stderr"
    + S8227645: Some tests in serviceability/sa run with fixed -Xmx
    values and risk running out of memory
    + S8227646: [TESTBUG] appcds/SharedArchiveConsistency timed out
    + S8227662: freetype seeks to index at the end of the font data
    + S8228479: Correct the format of ColorChooserDemoTest
    + S8228613: java.security.Provider#getServices order is no
    longer deterministic
    + S8228969: 2019-09-28 public suffix list update
    + S8229236: CriticalJNINatives: dll handling should be done in
    native thread state
    + S8229345: Memory leak due to vtable stubs not being shared on
    SPARC
    + S8229888: (zipfs) Updating an existing zip file does not
    preserve original permissions
    + S8229994: assert(false) failed: Bad graph detected in
    get_early_ctrl_for_expensive
    + S8230004: jdk/internal/jimage/JImageOpenTest.java runs no test
    + S8230235: Rendering HTML with empty img attribute and
    documentBaseKey cause Exception
    + S8230390: Problemlist SA tests with AOT
    + S8230400: Missing constant pool entry for a method in
    stacktrace
    + S8230459: Test failed to resume JVMCI CompilerThread
    + S8230480: check malloc/calloc results in java.desktop
    + S8230597: Update GIFlib library to the 5.2.1
    + S8230611: infinite loop in
    LogOutputList::wait_until_no_readers()
    + S8230624: [TESTBUG] Problemlist JFR
    compiler/TestCodeSweeper.java
    + S8230677: Should disable Escape Analysis if JVMTI capability
    can_get_owned_monitor_info was taken
    + S8230926: [macosx] Two apostrophes are entered instead of one
    with "U.S. International - PC" layout
    + S8231025: Incorrect method tag offset for big endian platform
    + S8231081: TestMetadataRetention fails due to missing symbol id
    + S8231387: java.security.Provider.getService returns random
    result due to race condition with mutating methods in the same
    class
    + S8231430: C2: Memory stomp in max_array_length() for
    T_ILLEGAL type
    + S8231445: check ZALLOC return values in awt coding
    + S8231507: Update Apache Santuario (XML Signature) to version
    2.1.4
    + S8231584: Deadlock with ClassLoader.findLibrary and
    System.loadLibrary call
    + S8231753: use more Posix functionality in aix
    os::print_os_info
    + S8231810: javax/net/ssl/templates/
    /SSLSocketSSLEngineTemplate.java fails intermittently with
    "java.lang.Exception: Unexpected EOF"
    + S8232003: (fs) Files.write can leak file descriptor in the
    exception case
    + S8232056: GetOwnedMonitorInfoWithEATest.java fails with ZGC:
    Heap too small
    + S8232060: add some initializations using sigemptyset in
    os_aix.cpp
    + S8232154: Update Mesa 3-D Headers to version 19.2.1
    + S8232167: Visual Studio install found through
  - -with-tools-dir value is discarded
    + S8232170: FSInfo#getJarClassPath throws an exception not
    declared in its throws clause
    + S8232200: [macos 10.15] Windows in fullscreen tests jumps
    around the screen
    + S8232207: Linux os::available_memory re-reads cgroup
    configuration on every invocation
    + S8232224: [TESTBUG] problemlist JFR TestLargeRootSet.java
    + S8232370: Refactor some com.sun.jdi tests to enable IDE
    integration
    + S8232433: [macos 10.15] java/awt/Window/
    /LocationAtScreenCorner/LocationAtScreenCorner.java may fail
    + S8232571: Add missing SIGINFO signal
    + S8232692: [TESTBUG] compiler/aot/fingerprint/
    /SelfChangedCDS.java fails when cds is disabled
    + S8232713: Update BCEL version to 6.3.1 in license file
    + S8232806: Introduce a system property to disable eager lambda
    initialization
    + S8232834: RunTest sometimes fails to produce valid
    exitcode.txt
    + S8232880: Update test documentation with additional settings
    for client UI tooltip tests
    + S8232950: SUNPKCS11 Provider incorrectly check key length for
    PSS Signatures.
    + S8233018: Add a new test to verify that DatagramSocket is not
    interruptible
    + S8233019: java.lang.Class.isPrimitive() (C1) returns wrong
    result if Klass* is aligned to 32bit
    + S8233032: assert(in_bb(n)) failed: must be
    + S8233078: fix minimal VM build on Linux ppc64(le)
    + S8233328: fix minimal VM build on Linux s390x
    + S8233383: Various minor fixes
    + S8233466: aarch64: remove unnecessary load of mdo when
    profiling return and parameters type
    + S8233491: Crash in AdapterHandlerLibrary::get_adapter with
    CDS due to code cache exhaustion
    + S8233529: loopTransform.cpp:2984: Error: assert(p_f-&gt;Opcode()
    == Op_IfFalse) failed
    + S8233548: Update CUP to v0.11b
    + S8233649: Update ProblemList.txt to exclude failing headful
    tests on macos
    + S8233656: assert(d-&gt;is_CFG() &amp;&amp; n-&gt;is_CFG()) failed: must
    have CFG nodes
    + S8233657: Intermittent NPE in Component.validate()
    + S8234288: Turkey Time Zone returns incorrect time zone name
    + S8234323: NULL-check return value of SurfaceData_InitOps on
    macosx
    + S8234339: replace JLI_StrTok in java_md_solinux.c
    + S8234340: Bump update version for OpenJDK: jdk-11.0.7
    + S8234350: assert(mode == ControlAroundStripMined &amp;&amp; (use ==
    sfpt || !use-&gt;is_reachable_from_root())) failed: missed a node
    + S8234386: [macos] NPE was thrown at expanding Choice from
    maximized frame
    + S8234397: add OS uptime information to os::print_os_info
    output
    + S8234423: Modifying ArrayList.subList().subList() resets
    modCount of subList
    + S8234466: Class loading deadlock involving
    X509Factory#commitEvent()
    + S8234501: remove obsolete NET_ReadV
    + S8234525: enable link-time section-gc for linux s390x to
    remove unused code
    + S8234610: MaxVectorSize set wrongly when UseAVX=3 is
    specified after JDK-8221092
    + S8234617: C1: Incorrect result of field load due to missing
    narrowing conversion
    + S8234723: javax/net/ssl/TLS tests support TLSv1.3
    + S8234724: javax/net/ssl/templates/
    /SSLSocketSSLEngineTemplate.java supports TLSv1.3
    + S8234741: enhance os::get_core_path on macOS
    + S8234769: Duplicate attribution in freetype.md
    + S8234786: Fix for JDK-8214578 breaks OS X 10.12 compatibility
    + S8234809: set relro in linker flags when building with gcc
    + S8234824: java/nio/channels/SocketChannel/AdaptSocket.java
    fails on Windows 10
    + S8235243: handle VS2017 15.9 and VS2019 in abstract_vm_version
    + S8235288: AVX 512 instructions inadvertently used on Xeon for
    small vector width operations
    + S8235325: build failure on Linux after 8235243
    + S8235383: C1 compilation fails with
  - XX:+PrintIRDuringConstruction -XX:+Verbose
    + S8235489: handle return values of sscanf calls in hotspot
    + S8235509: Backport for JDK-8209657 Refactor filemap.hpp to
    simplify integration with Serviceability Agent.
    + S8235510: java.util.zip.CRC32 performance drop after 8200067
    + S8235563: [TESTBUG] appcds/CommandLineFlagComboNegative.java
    does not handle archive mapping failure
    + S8235637: jhsdb jmap from OpenJDK 11.0.5 doesn't work if
    prelink is enabled
    + S8235671: enhance print_rlimit_info in os_posix
    + S8235744: PIT: test/jdk/javax/swing/text/html/
    /TestJLabelWithHTMLText.java times out in linux-x64
    + S8235904: Infinite loop when rendering huge lines
    + S8235998: [c2] Memory leaks during tracing after '8224193:
    stringStream should not use Resource Area'.
    + S8236039: JSSE Client does not accept status_request
    extension in CertificateRequest messages for TLS 1.3
    + S8236140: assert(!VerifyHashTableKeys || _hash_lock == 0)
    failed: remove node from hash table before modifying it
    + S8236179: C1 register allocation error with T_ADDRESS
    + S8236488: Support for configure option
  - -with-native-debug-symbols=internal is impossible on Windows
    + S8236500: Windows ucrt.dll should be looked up in versioned
    WINSDK subdirectory
    + S8236709: struct SwitchRange in HS violates C++ One
    Definition Rule
    + S8236848: [JDK 11u] make run-test-tier1 fails after backport
    of JDK-8232834
    + S8236873: Worker has a deadlock bug
    + S8237217: Incorrect G1StringDedupEntry type used in
    StringDedupTable destructor
    + S8237368: Problem with NullPointerException in RMI
    TCPEndpoint.read
    + S8237375: SimpleThresholdPolicy misses CounterDecay timestamp
    initialization
    + S8237508: Simplify JarFile.isInitializing
    + S8237540: Missing files in backport of JDK-8210910
    + S8237541: Missing files in backport of JDK-8236528
    + S8237600: Test SunJSSEFIPSInit fails on Ubuntu
    + S8237819: s390x - remove unused pd_zero_to_words_large
    + S8237869: exclude jtreg test security/infra/java/security/
    /cert/CertPathValidator/certification/LuxTrustCA.java because
    of instabilities
    + S8237879: make 4.3 breaks build
    + S8237945: CTW: C2 compilation fails with
    assert(just_allocated_object(alloc_ctl) == ptr) failed: most
    recent allo...
    + S8238225: Issues reported after replacing symlink at
    Contents/MacOS/libjli.dylib with binary
    + S8238247: CTW runner should sweep nmethods more aggressively
    + S8238366: CTW runner closes standard output on exit
    + S8238438: SuperWord::co_locate_pack picks memory state of
    first instead of last load
    + S8238502: sunmscapi.dll causing EXCEPTION_ACCESS_VIOLATION
    + S8238534: Deep sign macOS bundles before bundle archive is
    being created
    + S8238591: CTW: Split
    applications/ctw/modules/jdk_localedata.java
    + S8238596: AVX enabled by default for Skylake even when
    unsupported
    + S8238811: C2: assert(i &gt;= req() || i == 0 || is_Region() ||
    is_Phi()) with -XX:+VerifyGraphEdges
    + S8239005: [TESTBUG] test/hotspot/jtreg/runtime/
    /StackGuardPages/TestStackGuardPages.java: exeinvoke.c: must
    initialize static state before calling do_overflow()
    + S8239466: Loss of precision in counter decay calculation in
    11u backport of JDK-8237375
    + S8239856: [ntintel] asserts about copying unaligned array
    element
    + S8240724: [test] jdk11 downport of 8224475 misses binary file
    test/jdk/javax/swing/JTextPane/arrow.png
    + S8241296: Segfault in JNIHandleBlock::oops_do()
- Removed patch:
  * DependOnVariableHelper.patch
    + fixed upstream
- Added patch:
  * JDK-8228407.patch
    + fix crashes due to shared archive file mismatch</changelog>
  <changelog author="fstrba@suse.com" date="1594900800">- Update to upstream tag jdk-11.0.8+10 (July 2020 CPU, bsc#1174157)
  * Security fixes:
    + JDK-8230613: Better ASCII conversions
    + JDK-8231800: Better listing of arrays
    + JDK-8232014: Expand DTD support
    + JDK-8233234: Better Zip Naming
    + JDK-8233239, CVE-2020-14562: Enhance TIFF support
    + JDK-8233255: Better Swing Buttons
    + JDK-8234032: Improve basic calendar services
    + JDK-8234042: Better factory production of certificates
    + JDK-8234418: Better parsing with CertificateFactory
    + JDK-8234836: Improve serialization handling
    + JDK-8236191: Enhance OID processing
    + JDK-8236867, CVE-2020-14573: Enhance Graal interface handling
    + JDK-8237117, CVE-2020-14556: Better ForkJoinPool behavior
    + JDK-8237592, CVE-2020-14577: Enhance certificate verification
    + JDK-8238002, CVE-2020-14581: Better matrix operations
    + JDK-8238013: Enhance String writing
    + JDK-8238804: Enhance key handling process
    + JDK-8238842: AIOOBE in GIFImageReader.initializeStringTable
    + JDK-8238843: Enhanced font handing
    + JDK-8238920, CVE-2020-14583: Better Buffer support
    + JDK-8238925: Enhance WAV file playback
    + JDK-8240119, CVE-2020-14593: Less Affine Transformations
    + JDK-8240482: Improved WAV file playback
    + JDK-8241379: Update JCEKS support
    + JDK-8241522: Manifest improved jar headers redux
    + JDK-8242136, CVE-2020-14621: Better XML namespace handling
  * Other changes:
    + JDK-6933331: (d3d/ogl) java.lang.IllegalStateException:
    Buffers have not been created
    + JDK-7124307: JSpinner and changing value by mouse
    + JDK-8022574: remove HaltNode code after uncommon trap calls
    + JDK-8039082: [TEST_BUG] Test
    java/awt/dnd/BadSerializationTest/BadSerializationTest.java
    fails
    + JDK-8040630: Popup menus and tooltips flicker with previous
    popup contents when first shown
    + JDK-8044365: (dc) MulticastSendReceiveTests.java failing with
    ENOMEM when joining group (OS X 10.9)
    + JDK-8048215: [TESTBUG]
    java/lang/management/ManagementFactory/ThreadMXBeanProxy.java
    Expected non-null LockInfo
    + JDK-8051349: nsk/jvmti/scenarios/sampling/SP06/sp06t003 fails
    in nightly
    + JDK-8080353: JShell: Better error message on attempting to
    add default method
    + JDK-8139876: Exclude hanging nsk/stress/stack from execution
    with deoptimization enabled
    + JDK-8146090: java/lang/ref/ReachabilityFenceTest.java fails
    with -XX:+DeoptimizeALot
    + JDK-8153430: jdk regression test MletParserLocaleTest,
    ParserInfiniteLoopTest reduce default timeout
    + JDK-8156207: Resource allocated BitMaps are often cleared
    unnecessarily
    + JDK-8159740: JShell: corralled declarations do not have
    correct source to wrapper mapping
    + JDK-8175984: ICC_Profile has un-needed, not-empty finalize
    method
    + JDK-8176359: Frame#setMaximizedbounds not working properly in
    multi screen environments
    + JDK-8183369: RFC unconformity of HttpURLConnection with proxy
    + JDK-8187078: -XX:+VerifyOops finds numerous problems when
    running JPRT
    + JDK-8189861: Refactor CacheFind
    + JDK-8191169: java/net/Authenticator/B4769350.java failed
    intermittently
    + JDK-8191930: [Graal] emits unparseable XML into compile log
    + JDK-8193879: Java debugger hangs on method invocation
    + JDK-8196019: java/awt/Window/Grab/GrabTest.java fails on
    Windows
    + JDK-8196181: sun/java2d/GdiRendering/InsetClipping.java fails
    + JDK-8198000:
    java/awt/List/EmptyListEventTest/EmptyListEventTest.java
    debug assert on Windows
    + JDK-8198001: java/awt/Menu/WrongParentAfterRemoveMenu/
    /WrongParentAfterRemoveMenu.java debug assert on Windows
    + JDK-8198339: Test javax/swing/border/Test6981576.java is
    unstable
    + JDK-8200701: jdk/jshell/ExceptionsTest.java fails on Windows,
    after JDK-8198801
    + JDK-8203264: JNI exception pending in
    PlainDatagramSocketImpl.c:740
    + JDK-8203672: JNI exception pending in PlainSocketImpl.c
    + JDK-8203673: JNI exception pending in
    DualStackPlainDatagramSocketImpl.c:398
    + JDK-8204834: Fix confusing "allocate" naming in OopStorage
    + JDK-8205399: Set node color on pinned HashMap.TreeNode
    deletion
    + JDK-8205653: test/jdk/sun/management/jmxremote/bootstrap/
    /RmiRegistrySslTest.java and RmiSslBootstrapTest.sh fail with
    handshake_failure
    + JDK-8206179: com/sun/management/OperatingSystemMXBean/
    /GetCommittedVirtualMemorySize.java fails with Committed
    virtual memory size illegal value
    + JDK-8207334: VM times out in VM_HandshakeAllThreads::doit()
    with RunThese30M
    + JDK-8208277: Code cache heap (-XX:ReservedCodeCacheSize)
    doesn't work with 1GB LargePages
    + JDK-8209113: Use WeakReference for lastFontStrike for created
    Fonts
    + JDK-8209333: Socket reset issue for TLS 1.3 socket close
    + JDK-8209439: C2 library_call can potentially ignore Math.pow
    intrinsic or use null pointer
    + JDK-8209534: [TESTBUG]runtime/appcds/cacheObject/
    /ArchivedModuleCompareTest.java fails with EnableJVMCI.
    + JDK-8210147: adjust some WSAGetLastError usages in windows
    network coding
    + JDK-8210284: "assert((av &amp; 0x00000001) == 0) failed:
    unsupported V8" on Solaris 11.4
    + JDK-8210303: VM_HandshakeAllThreads fails assert with
    "failed: blocked and not walkable"
    + JDK-8210459: Add support for generating compile_commands.json
    + JDK-8210515: [TESTBUG]CheckArchivedModuleApp.java needs to
    check if EnableJVMCI is set.
    + JDK-8210788: Javadoc for Thread.join(long, int) should
    specify that it waits forever when both arguments are zero
    + JDK-8211301: [macos] support full window content options
    + JDK-8211332: Space for stub routines (code_size2) is too
    small on new Skylake CPUs
    + JDK-8211339: NPE during SSL handshake caused by
    HostnameChecker
    + JDK-8211392: compiler/profiling/
    /spectrapredefineclass_classloaders/Launcher.java times out
    in JDK12 CI
    + JDK-8211743: [AOT] crash in ScopeDesc::decode_body() when
    JVMTI walks AOT frames
    + JDK-8212154: [TESTBUG] CheckArchivedModuleApp fails with NPE
    when JVMCI is absent
    + JDK-8212167: JShell : Stack trace of exception has wrong line
    number
    + JDK-8212933: Thread-SMR: requesting a VM operation whilst
    holding a ThreadsListHandle can cause deadlocks
    + JDK-8212986: Make Visual Studio compiler check less strict
    + JDK-8213250: CDS archive creation aborts due to metaspace
    object allocation failure
    + JDK-8213516: jck test api/javax_accessibility/AccessibleState/
    /fields.html fails intermittent
    + JDK-8213947: ARM32: failed check_simd should set
    UsePopCountInstruction to false
    + JDK-8214418: half-closed SSLEngine status may cause
    application dead loop
    + JDK-8214440: ldap over a TLS connection negotiate failed with
    "javax.net.ssl.SSLPeerUnverifiedException: hostname of the
    server does not match the hostname in the server's
    certificate"
    + JDK-8214444: Wrong strncat limits in dfa.cpp
    + JDK-8214481: freetype path does not disable TrueType hinting
    with AA+FM hints
    + JDK-8214571: -Xdoclint of array serialField gives "error:
    array type not allowed here"
    + JDK-8214856: Errors with JSZip in web console after upgrade
    to 3.1.5
    + JDK-8214862: assert(proj != __null) at compile.cpp:3251
    + JDK-8215369: Jcstress pollute /var/tmp with temporary files.
    + JDK-8215551: Missing case label in nmethod::reloc_string_for()
    + JDK-8215555: TieredCompilation C2 threads can excessively
    block handshakes
    + JDK-8215711: Missing key_share extension for (EC)DHE key
    exchange should alert missing_extension
    + JDK-8216151: [Graal] Module
    jdk.internal.vm.compiler.management has not been granted
    accessClassInPackage.org.graalvm.compiler.debug
    + JDK-8216154: C4819 warnings at HotSpot sources on Windows
    + JDK-8216541: CompiledICHolders of VM locked unloaded nmethods
    are released too late
    + JDK-8217230: assert(t == t_no_spec) failure in
    NodeHash::check_no_speculative_types()
    + JDK-8217404: --with-jvm-features doesn't work when multiple
    features are explicitly disabled
    + JDK-8217447: Develop flag TraceICs is broken
    + JDK-8217606: LdapContext#reconnect always opens a new
    connection
    + JDK-8218807: Compilation database (compile_commands.json) may
    contain obsolete items
    + JDK-8219214: Infinite Loop in CodeSection::dump()
    + JDK-8219904: ClassCastException when calling
    FlightRecorderMXBean#getRecordings()
    + JDK-8219991: New fix of the deadlock in
    sun.security.ssl.SSLSocketImpl
    + JDK-8221121: applications/microbenchmarks are encountering
    crashes in tier5
    + JDK-8221445: FastSysexMessage constructor crashes MIDI
    receiption thread
    + JDK-8221482: Initialize VMRegImpl::regName[] earlier to
    prevent assert during PrintStubCode
    + JDK-8221741: ClassCastException can happen when
    fontconfig.properties is used
    + JDK-8221823: Requested JDialog width is ignored
    + JDK-8223108: Test java/awt/EventQueue/
    /NonComponentSourcePost.java is unstable
    + JDK-8223678: Add Visual Studio Code workspace generation
    support (for native code)
    + JDK-8223935: PIT: java/awt/font/WindowsIndicFonts.java fails
    on windows10
    + JDK-8224109: Text spaced incorrectly by drawString under
    rotation with fractional metric
    + JDK-8224632: testbug: java/awt/dnd/RemoveDropTargetCrashTest/
    /RemoveDropTargetCrashTest.java fails on MacOS
    + JDK-8224793: os::die() does not honor CreateCoredumpOnCrash
    option
    + JDK-8224847: gc/stress/TestReclaimStringsLeaksMemory.java
    fails with reserved greater than expected
    + JDK-8224931: disable JAOTC invokedynamic support until
    8223533 is fixed
    + JDK-8224997: ChaCha20-Poly1305 TLS cipher suite decryption
    throws ShortBufferException
    + JDK-8225068: Remove DocuSign root certificate that is
    expiring in May 2020
    + JDK-8225069: Remove Comodo root certificate that is expiring
    in May 2020
    + JDK-8225126: Test SetBoundsPaintTest.html faild on Windows
    when desktop is scaled
    + JDK-8225325: Add tests for redefining a class' private method
    during resolution of the bootstrap specifier
    + JDK-8225622: [AOT] runtime/SharedArchiveFile/
    /TestInterpreterMethodEntries.java crashed with AOTed
    java.base
    + JDK-8225653: Provide more information when hitting SIGILL
    from HaltNode
    + JDK-8225783: Incorrect use of binary operators on booleans in
    type.cpp
    + JDK-8225789: Empty method parameter type should generate
    ClassFormatError
    + JDK-8226198: use of &amp; instead of &amp;&amp; in
    LibraryCallKit::arraycopy_restore_alloc_state
    + JDK-8226253: JAWS reports wrong number of radio buttons when
    buttons are hidden.
    + JDK-8226653: [accessibility] Can edit text cell correctly,
    but Accessibility Tool reads nothing about editor
    + JDK-8226806: [macOS 10.14] Methods of Java Robot should be
    called from appropriate thread
    + JDK-8226879: Memory leak in Type::hashcons
    + JDK-8227632: Incorrect PrintCompilation message: made not
    compilable on levels 0 1 2 3 4
    + JDK-8228407: JVM crashes with shared archive file mismatch
    + JDK-8228482: fix xlc16/xlclang comparison of distinct pointer
    types and string literal conversion warnings
    + JDK-8228757: Fail fast if the handshake type is unknown
    + JDK-8229158: make UseSwitchProfiling non-experimental or
    false by-default
    + JDK-8229421: The logic of java/net/ipv6tests/TcpTest.java is
    flawed
    + JDK-8229855: C2 fails with assert(false) failed: bad AD file
    + JDK-8230591: AArch64: Missing intrinsics for Math.ceil,
    floor, rint
    + JDK-8231118: ARM32: Math tests failures
    + JDK-8231213: Migrate SimpleDateFormatConstTest to JDK Repo
    + JDK-8231243: [TESTBUG] CustomFont.java cannot find font file
    + JDK-8231438: [macOS] Dark mode for the desktop is not
    supported
    + JDK-8231550: C2: ShouldNotReachHere() in
    verify_strip_mined_scheduling
    + JDK-8231564: setMaximizedBounds is broken with large display
    scale and multiple monitors
    + JDK-8231572: Use -lobjc instead of -fobjc-link-runtime in
    libosxsecurity
    + JDK-8231631: sun/net/ftp/FtpURLConnectionLeak.java fails
    intermittently with NPE
    + JDK-8231671: Fix copyright headers in hotspot (missing comma
    after year)
    + JDK-8231720: Some perf regressions after 8225653
    + JDK-8231779: crash
    HeapWord*ParallelScavengeHeap::failed_mem_allocate
    + JDK-8231863: Crash if classpath is read from @argument file
    and the main gets option argument
    + JDK-8232080: jlink plugins for vendor information and
    run-time options
    + JDK-8232106: [x86] C2: SIGILL due to usage of SSSE3
    instructions on processors which don't support it
    + JDK-8232134: Change to Visual Studio 2017 15.9.16 for
    building on Windows at Oracle
    + JDK-8232226: [macos 10.15] test/jdk/java/awt/color/
    /EqualityTest/EqualityTest.java may fail
    + JDK-8232357: Compare version info of Santuario to legal notice
    + JDK-8232572: Add hooks for custom output dir in Bundles.gmk
    + JDK-8232634: Problem List ICMColorDataTest.java
    + JDK-8232748: Build static versions of certain JDK libraries
    + JDK-8232846: ProcessHandle.Info command with non-English
    shows question marks
    + JDK-8232880: Update test documentation with additional
    settings for client UI tooltip tests
    + JDK-8233033: C2 produces wrong result while unswitching a
    loop due to lost control dependencies
    + JDK-8233137: runtime/ErrorHandling/VeryEarlyAssertTest.java
    fails after 8232080
    + JDK-8233197: Invert JvmtiExport::post_vm_initialized() and
    Jfr:on_vm_start() start-up order for correct option parsing
    + JDK-8233291: [TESTBUG] tools/jlink/plugins/
    /VendorInfoPluginsTest.java fails with debug or non-server VMs
    + JDK-8233364: Fix undefined behavior in
    Canonicalizer::do_ShiftOp
    + JDK-8233494: Avoid calling MallocTracker::record_malloc and
    record_free when NMT is off
    + JDK-8233573: Toolkit.getScreenInsets(GraphicsConfiguration)
    may throw ClassCastException
    + JDK-8233608: Minimal build broken after JDK-8233494
    + JDK-8233621: Mismatch in jsse.enableMFLNExtension property
    name
    + JDK-8233696: [TESTBUG]Some jtreg tests fail when CAPS_LOCK is
    ON
    + JDK-8233707: systemScale.cpp could not compile with VS2019
    + JDK-8233801: GCMEmptyIv.java test fails on Solaris 11.4
    + JDK-8233880: Support compilers with multi-digit major version
    numbers
    + JDK-8233920: MethodHandles::tryFinally generates illegal
    bytecode for long/double return type
    + JDK-8234137: The "AutoTestOnTop.java" test may run external
    applications
    + JDK-8234146: compiler/jsr292/
    /ContinuousCallSiteTargetChange.java times out on SPARC
    + JDK-8234184: [TESTBUG] java/awt/Mouse/EnterExitEvents/
    /ModalDialogEnterExitEventsTest.java fails in Windows
    + JDK-8234270: [REDO] JDK-8204128 NMT might report incorrect
    numbers for Compiler area
    + JDK-8234332: [TESTBUG] java/awt/Focus/DisposedWindow/
    /DisposeDialogNotActivateOwnerTest/
    /DisposeDialogNotActivateOwnerTest.java fails on linux-x64
    nightly
    + JDK-8234398: Replace ID2D1Factory::GetDesktopDpi with
    GetDeviceCaps
    + JDK-8234522: [macos] Crash with use of native file dialog
    + JDK-8234691: Potential double-free in ParallelSPCleanupTask
    constructor
    + JDK-8234696: tools/jlink/plugins/VendorInfoPluginsTest.java
    times out
    + JDK-8234727: sun/security/ssl/X509TrustManagerImpl tests
    support TLSv1.3
    + JDK-8234728: Some security tests should support TLSv1.3
    + JDK-8234779: Provide idiom for declaring classes noncopyable
    + JDK-8234824: java/nio/channels/SocketChannel/AdaptSocket.java
    fails on Windows 10
    + JDK-8234968: check calloc rv in libinstrument
    InvocationAdapter
    + JDK-8235153: [TESTBUG] [macos 10.15] java/awt/Graphics/
    /DrawImageBG/SystemBgColorTest.java fails
    + JDK-8235183: Remove the "HACK CODE" in comment
    + JDK-8235263: Revert TLS 1.3 change that wrapped IOExceptions
    + JDK-8235311: Tag mismatch may alert bad_record_mac
    + JDK-8235332: TestInstanceCloneAsLoadsStores.java fails with
  - XX:+StressGCM
    + JDK-8235452: Strip mined loop verification fails with
    assert(is_OuterStripMinedLoop()) failed: invalid node class
    + JDK-8235584: UseProfiledLoopPredicate fails with
    assert(_phase-&gt;get_loop(c) == loop) failed: have to be in the
    same loop
    + JDK-8235620: Broken merge between JDK-8006406 and JDK-8003559
    + JDK-8235638: NPE in LWWindowPeer.getOnscreenGraphics()
    + JDK-8235686: Add more custom hooks in Bundles.gmk
    + JDK-8235739: Rare NPE at WComponentPeer.getGraphics()
    + JDK-8235762: JVM crash in SWPointer during C2 compilation
    + JDK-8235834: IBM-943 charset encoder needs updating
    + JDK-8235874: The ordering of Cipher Suites is not maintained
    provided through jdk.tls.client.cipherSuites and
    jdk.tls.server.cipherSuites system property.
    + JDK-8235908: omit ThreadPriorityPolicy warning when value is
    set from image
    + JDK-8235984: C2: assert(out-&gt;in(PhiNode::Region) == head ||
    out-&gt;in(PhiNode::Region) == slow_head) failed: phi must be
    either part of the slow or the fast loop
    + JDK-8236211: [Graal] compiler/graalunit/GraphTest.java is
    skipped in all testing
    + JDK-8236470: Deal with ECDSA using ecdsa-with-SHA2 plus hash
    algorithm as AlgorithmId
    + JDK-8236545: Compilation error in mach5
    java/awt/FileDialog/MacOSGoToFolderCrash.java
    + JDK-8236700: Upgrading JSZip from v3.1.5 to v3.2.2
    + JDK-8236759: ShouldNotReachHere in
    PhaseIdealLoop::verify_strip_mined_scheduling
    + JDK-8236897: Fix the copyright header for pkcs11gcm2.h
    + JDK-8236921: Add build target to produce a JDK image suitable
    for a Graal/SVM build
    + JDK-8236953: [macos] JavaFX SwingNode is not rendered on macOS
    + JDK-8236996: Incorrect Roboto font rendering on Windows with
    subpixel antialiasing
    + JDK-8237045: JVM uses excessive memory with -XX:+EnableJVMCI
  - XX:JVMCICounterSize=2147483648
    + JDK-8237055: [TESTBUG] compiler/c2/TestJumpTable.java fails
    with release VMs
    + JDK-8237086: assert(is_MachReturn()) running CTW with fix for
    JDK-8231291
    + JDK-8237192: Generate stripped/public pdbs on Windows for jdk
    images
    + JDK-8237396: JvmtiTagMap::weak_oops_do() should not trigger
    barriers
    + JDK-8237474: Default SSLEngine should create in server role
    + JDK-8237859: C2: Crash when loads float above range check
    + JDK-8237879: make 4.3 breaks build
    + JDK-8237951: CTW: C2 compilation fails with "malformed
    control flow"
    + JDK-8237962: give better error output for invalid OCSP
    response intervals in CertPathValidator checks
    + JDK-8238190: [JVMCI] Fix single implementor speculation for
    diamond shapes.
    + JDK-8238356: CodeHeap::blob_count() overestimates the number
    of blobs
    + JDK-8238452: Keytool generates wrong expiration date if
    validity is set to 2050/01/01
    + JDK-8238555: Allow Initialization of SunPKCS11 with NSS when
    there are external FIPS modules in the NSSDB
    + JDK-8238575: DragSourceEvent.getLocation() returns wrong
    value on HiDPI screens (Windows)
    + JDK-8238676: jni crashes on accessing it from process exit
    hook
    + JDK-8238721: Add failing client jtreg tests to the Problem
    List
    + JDK-8238738: AudioSystem.getMixerInfo() takes about 30 sec to
    report a gone audio device
    + JDK-8238756: C2: assert(((n) == __null || !VerifyIterativeGVN
    || !((n)-&gt;is_dead()))) failed: can not use dead node
    + JDK-8238765: PhaseCFG::schedule_pinned_nodes cannot handle
    precedence edges from unmatched CFG nodes correctly
    + JDK-8238898: Missing hash characters for header on license
    file
    + JDK-8238942: Rendering artifacts with LCD text and fractional
    metrics
    + JDK-8238985: [TESTBUG] The arrow image is blue instead of
    green
    + JDK-8239000: handle ContendedPaddingWidth in vm_version_ppc
    + JDK-8239055: Wrong implementation of VMState.hasListener
    + JDK-8239091: Reversed arguments in call to strstr in freetype
    "debug" code.
    + JDK-8239142: C2's UseUniqueSubclasses optimization is broken
    for array accesses
    + JDK-8239224: libproc_impl.c previous_thr may be used
    uninitialized warning
    + JDK-8239351: Give more meaningful InternalError messages in
    Deflater.c
    + JDK-8239365: ProcessBuilder test modifications for AIX
    execution
    + JDK-8239456: vtable stub generation: assert failure (code
    size estimate)
    + JDK-8239457: call ReleaseStringUTFChars before early returns
    in Java_sun_security_pkcs11_wrapper_PKCS11_connect
    + JDK-8239462: jdk.hotspot.agent misses some
    ReleaseStringUTFChars calls in case of early returns
    + JDK-8239557: [TESTBUG] VeryEarlyAssertTest.java validating
    "END." marker at lastline is not always true
    + JDK-8239787: AArch64: String.indexOf may incorrectly handle
    empty strings
    + JDK-8239792: Bump update version for OpenJDK: jdk-11.0.8
    + JDK-8239798: SSLSocket closes socket both socket endpoints on
    a SocketTimeoutException
    + JDK-8239819: XToolkit: Misread of screen information memory
    + JDK-8239852: java/util/concurrent tests fail with
  - XX:+VerifyGraphEdges: assert(!VerifyGraphEdges) failed:
    verification should have failed
    + JDK-8239893: Windows handle Leak when starting processes
    using ProcessBuilder
    + JDK-8239915: Zero VM crashes when handling dynamic constant
    + JDK-8239931: [win][x86] vtable stub generation: assert
    failure (code size estimate) follow-up
    + JDK-8239965: XMLEncoder/Test4625418.java fails due to "Error:
    Cp943 - can't read properly"
    + JDK-8239976: Put JDK-8239965 on the ProblemList.txt
    + JDK-8240073: Fix 'test-make' build target in 11u
    + JDK-8240197: Cannot start JVM when $JAVA_HOME includes CJK
    characters
    + JDK-8240202: A few client tests leave mouse buttons pressed
    + JDK-8240220: IdealLoopTree::dump_head predicate printing is
    broken
    + JDK-8240223: Use consistent predicate order in and with
    PhaseIdealLoop::find_predicate
    + JDK-8240227: Loop predicates should be copied to unswitched
    loops
    + JDK-8240286: [TESTBUG] Test command error in hotspot/jtreg/
    /compiler/loopopts/superword/SumRedAbsNeg_Float.java
    + JDK-8240518: Incorrect JNU_ReleaseStringPlatformChars in
    Windows Print
    + JDK-8240529: CheckUnhandledOops breaks NULL check in
    Modules::define_module
    + JDK-8240576: JVM crashes after transformation in C2
    IdealLoopTree::merge_many_backedges
    + JDK-8240603: Windows 32bit compile error after 8238676
    + JDK-8240629: argfiles parsing broken for argfiles with
    comment cross 4096 bytes chunk
    + JDK-8240711: TestJstatdPort.java failed due to
    "ExportException: Port already in use:"
    + JDK-8240786: [TESTBUG] The test java/awt/Window/
    /GetScreenLocation/GetScreenLocationTest.java fails on HiDPI
    screen
    + JDK-8240824: enhance print_full_memory_info on Linux by THP
    related information
    + JDK-8240827: Downport SSLSocketImpl.java from "8221882: Use
    fiber-friendly java.util.concurrent.locks in JSSE"
    + JDK-8240905: assert(mem == (Node*)1 || mem == mem2) failed:
    multiple Memories being matched at once?
    + JDK-8240972: macOS codesign fail on macOS 10.13.5 or older
    + JDK-8241445: Fix copyright in
    test/jdk/tools/launcher/ArgFileSyntax.java
    + JDK-8241458: [JVMCI] add mark value to expose
    CodeOffsets::Frame_Complete
    + JDK-8241464: [11u] Backport: make rehashing be a needed
    guaranteed safepoint cleanup action
    + JDK-8241556: Memory leak if -XX:CompileCommand is set
    + JDK-8241568: (fs) UserPrincipalLookupService.lookupXXX
    failure with IOE "Operation not permitted"
    + JDK-8241586: compiler/cpuflags/
    /TestAESIntrinsicsOnUnsupportedConfig.java fails on aarch64
    + JDK-8241638: launcher time metrics always report 1 on Linux
    when _JAVA_LAUNCHER_DEBUG set
    + JDK-8241660: Add virtualization information output to hs_err
    file on macOS
    + JDK-8241808: [TESTBUG] The JDK-8039467 bug appeared on macOS
    + JDK-8241888: Mirror jdk.security.allowNonCaAnchor system
    property with a security one
    + JDK-8241900: Loop unswitching may cause dependence on null
    check to be lost
    + JDK-8241948: enhance list of environment variables printed in
    hs_err file
    + JDK-8241996: on linux set full relro in the linker flags
    + JDK-8242108: Performance regression after fix for JDK-8229496
    + JDK-8242141: New System Properties to configure the TLS
    signature schemes
    + JDK-8242154: Backport parts of JDK-4947890 to OpenJDK 11u
    + JDK-8242174: [macos] The NestedModelessDialogTest test make
    the macOS unstable
    + JDK-8242239: [Graal] javax/management/generified/
    /GenericTest.java fails: FAILED: queryMBeans sets same
    + JDK-8242294: JSSE Client does not throw SSLException when an
    alert occurs during handshaking
    + JDK-8242379: [TESTBUG] compiler/loopopts/
    /TestLoopUnswitchingLostCastDependency.java fails with
    release VMs
    + JDK-8242470: Update Xerces to Version 2.12.1
    + JDK-8242498: Invalid "sun.awt.TimedWindowEvent" object leads
    to JVM crash
    + JDK-8242541: Small charset issues (ISO8859-16, x-eucJP-Open,
    x-IBM834 and x-IBM949C)
    + JDK-8242626: enhance posix print_rlimit_info
    + JDK-8243059: Build fails when --with-vendor-name contains a
    comma
    + JDK-8243539: Copyright info (Year) should be updated for fix
    of 8241638
    + JDK-8243541: (tz) Upgrade time-zone data to tzdata2020a
    + JDK-8244407: JVM crashes after transformation in C2
    IdealLoopTree::split_fall_in
    + JDK-8244520: problemlist
    java/awt/font/Rotate/RotatedFontTest.java on linux
    + JDK-8244777: ClassLoaderStats VM Op uses constant hash value
    + JDK-8244853: The static build of libextnet is missing the
    JNI_OnLoad_extnet function
    + JDK-8244951: Missing entitlements for hardened runtime
    + JDK-8245047: [PPC64] C2: ReverseBytes + Load always match to
    unordered Load (acquire semantics missing)
    + JDK-8245649: Revert 8245397 backport of 8230591
    + JDK-8246031: SSLSocket.getSession() doesn't close connection
    for timeout/ interrupts
    + JDK-8246613: Choose the default SecureRandom algo based on
    registration ordering
    + JDK-8248505: Unexpected NoSuchAlgorithmException when using
    secure random impl from BCFIPS provider
- Removed patch:
  * JDK-8228407.patch
    + integrated upstream</changelog>
  <changelog author="fstrba@suse.com" date="1604318400">- Update to upstream tag jdk-11.0.9-11 (October 2020 CPU,
  bsc#1177943)
  * New features
    + JDK-8250784: Shenandoah: A Low-Pause-Time Garbage Collector
  * Security fixes
    + JDK-8233624: Enhance JNI linkage
    + JDK-8236196: Improve string pooling
    + JDK-8236862, CVE-2020-14779: Enhance support of Proxy class
    + JDK-8237990, CVE-2020-14781: Enhanced LDAP contexts
    + JDK-8237995, CVE-2020-14782: Enhance certificate processing
    + JDK-8240124: Better VM Interning
    + JDK-8241114, CVE-2020-14792: Better range handling
    + JDK-8242680, CVE-2020-14796: Improved URI Support
    + JDK-8242685, CVE-2020-14797: Better Path Validation
    + JDK-8242695, CVE-2020-14798: Enhanced buffer support
    + JDK-8243302: Advanced class supports
    + JDK-8244136, CVE-2020-14803: Improved Buffer supports
    + JDK-8244479: Further constrain certificates
    + JDK-8244955: Additional Fix for JDK-8240124
    + JDK-8245407: Enhance zoning of times
    + JDK-8245412: Better class definitions
    + JDK-8245417: Improve certificate chain handling
    + JDK-8248574: Improve jpeg processing
    + JDK-8249927: Specify limits of jdk.serialProxyInterfaceLimit
    + JDK-8253019: Enhanced JPEG decoding
  * Other changes
    + JDK-6532025: GIF reader throws misleading exception with
    truncated images
    + JDK-6949753: [TEST BUG]: java/awt/print/PageFormat/
    /PDialogTest.java needs update by removing an infinite loop
    + JDK-8022535: [TEST BUG] javax/swing/text/html/parser/
    /Test8017492.java fails
    + JDK-8062947: Fix exception message to correctly represent
    LDAP connection failure
    + JDK-8067354: com/sun/jdi/GetLocalVariables4Test.sh failed
    + JDK-8134599: TEST_BUG: java/rmi/transport/closeServerSocket/
    /CloseServerSocket.java fails intermittently with Address
    already in use
    + JDK-8151678: com/sun/jndi/ldap/LdapTimeoutTest.java failed
    due to timeout on DeadServerNoTimeoutTest is incorrect
    + JDK-8160768: Add capability to custom resolve host/domain
    names within the default JNDI LDAP provider
    + JDK-8172404: Tools should warn if weak algorithms are used
    before restricting them
    + JDK-8193367: Annotated type variable bounds crash javac
    + JDK-8202117: com/sun/jndi/ldap/RemoveNamingListenerTest.java
    fails intermittently: Connection reset
    + JDK-8203026: java.rmi.NoSuchObjectException: no such object
    in table
    + JDK-8203281: [Windows] JComboBox change in ui when
    editor.setBorder() is called
    + JDK-8203382: Rename SystemDictionary::initialize_wk_klass to
    resolve_wk_klass
    + JDK-8203393: com/sun/jdi/JdbMethodExitTest.sh and
    JdbExprTest.sh fail due to timeout
    + JDK-8203928: [Test] Convert non-JDB scaffolding
    serviceability shell script tests to java
    + JDK-8204963: javax.swing.border.TitledBorder has a memory leak
    + JDK-8204994: SA might fail to attach to process with "Windbg
    Error: WaitForEvent failed"
    + JDK-8205534: Remove SymbolTable dependency from
    serviceability agent
    + JDK-8206309: Tier1 SA tests fail
    + JDK-8208281: java/nio/channels/
    /AsynchronousSocketChannel/Basic.java timed out
    + JDK-8209109: [TEST] rewrite com/sun/jdi shell tests to java
    version - step1
    + JDK-8209332: [TEST] test/jdk/com/sun/jdi/CatchPatternTest.sh
    is incorrect
    + JDK-8209342: Problemlist SA tests on Solaris due to Error
    attaching to process: Can't create thread_db agent!
    + JDK-8209343: Test javax/swing/border/TestTitledBorderLeak.java
    should be marked as headful
    + JDK-8209517: com/sun/jdi/BreakpointWithFullGC.java fails with
    timeout
    + JDK-8209604: [TEST] rewrite com/sun/jdi shell tests to java
    version - step2
    + JDK-8209605: com/sun/jdi/BreakpointWithFullGC.java fails with
    ZGC
    + JDK-8209608: Problem list com/sun/jdi/BreakpointWithFullGC.java
    + JDK-8210131: vmTestbase/nsk/jvmti/scenarios/allocation/AP10/
    /ap10t001/TestDescription.java failed with ObjectFree:
    GetCurrentThreadCpuTimerInfo returned unexpected error code
    + JDK-8210243: [TEST] rewrite com/sun/jdi shell tests to java
    version - step3
    + JDK-8210527: JShell: NullPointerException in
    jdk.jshell.Eval.translateExceptionStack
    + JDK-8210560: [TEST] convert com/sun/jdi redefineClass-related
    tests
    + JDK-8210725: com/sun/jdi/RedefineClearBreakpoint.java fails
    with waitForPrompt timed out after 60 seconds
    + JDK-8210748: [TESTBUG] lib.jdb.Jdb.waitForPrompt() should
    clarify which output is the pending reply after a timeout
    + JDK-8210760: [TEST] rewrite com/sun/jdi shell tests to java
    version - step4
    + JDK-8210977: jdk/jfr/event/oldobject/TestThreadLocalLeak.java
    fails to find ThreadLocalObject
    + JDK-8211292: [TEST] convert com/sun/jdi/DeferredStepTest.sh
    test
    + JDK-8211694: JShell: Redeclared variable should be reset
    + JDK-8212200: assert when shared java.lang.Object is redefined
    by JVMTI agent
    + JDK-8212629: [TEST] wrong breakpoint in
    test/jdk/com/sun/jdi/DeferredStepTest
    + JDK-8212665: com/sun/jdi/DeferredStepTest.java: jj1 (line 57)
  - unexpected. lastLine=52, minLine=52, maxLine=55
    + JDK-8212807: tools/jar/multiRelease/Basic.java times out
    + JDK-8213182: Minimal VM build failure after JDK-8212200
    (assert when shared java.lang.Object is redefined by JVMTI
    agent)
    + JDK-8213214: Set -Djava.io.tmpdir= when running tests
    + JDK-8213275: ReplaceCriticalClasses.java fails with
    jdk.internal.vm.PostVMInitHook not found
    + JDK-8213574: Deadlock in string table expansion when dumping
    lots of CDS classes
    + JDK-8213703: LambdaConversionException: Invalid receiver type
    not a subtype of implementation type interface
    + JDK-8214074: Ghash optimization using AVX instructions
    + JDK-8214491: Upgrade to JLine 3.9.0
    + JDK-8214797: TestJmapCoreMetaspace.java timed out
    + JDK-8215243: JShell tests failing intermitently with
    "Problem cleaning up the following threads:"
    + JDK-8215244: jdk/jshell/ToolBasicTest.java
    testHistoryReference failed
    + JDK-8215354: x86_32 build failures after JDK-8214074 (Ghash
    optimization using AVX instructions)
    + JDK-8215438: jshell tool: Ctrl-D causes EOF
    + JDK-8216021: RunTest.gmk might set concurrency level to 1 on
    Windows
    + JDK-8216974: HttpConnection not returned to the pool after
    204 response
    + JDK-8218948: SimpleDateFormat :: format - Zone Names are not
    reflected correctly during run time
    + JDK-8219712: code_size2 (defined in stub_routines_x86.hpp) is
    too small on new Skylake CPUs
    + JDK-8220150: macos10.14 Mojave returns anti-aliased glyphs
    instead of aliased B&amp;W glyphs
    + JDK-8221658: aarch64: add necessary predicate for ubfx
    patterns
    + JDK-8221759: Crash when completing "java.io.File.path"
    + JDK-8221918: runtime/SharedArchiveFile/serviceability/
    /ReplaceCriticalClasses.java fails: Shared archive not found
    + JDK-8222074: Enhance auto vectorization for x86
    + JDK-8222079: Don't use memset to initialize fields decode_env
    constructor in disassembler.cpp
    + JDK-8222769: [TESTBUG] TestJFRNetworkEvents should not rely
    on hostname command
    + JDK-8223688: JShell: crash on the instantiation of raw
    anonymous class
    + JDK-8223777: In posix_spawn mode, failing to exec()
    jspawnhelper does not result in an error
    + JDK-8223940: Private key not supported by chosen signature
    algorithm
    + JDK-8224184: jshell got IOException at exiting with AIX
    + JDK-8224234: compiler/codegen/TestCharVect2.java fails in
    test_mulc
    + JDK-8225037: java.net.JarURLConnection::getJarEntry() throws
    NullPointerException
    + JDK-8225625: AES Electronic Codebook (ECB) encryption and
    decryption optimization using AVX512 + VAES instructions
    + JDK-8226536: Catch OOM from deopt that fails rematerializing
    objects
    + JDK-8226575: OperatingSystemMXBean should be made container
    aware
    + JDK-8226697: Several tests which need the @key headful
    keyword are missing it.
    + JDK-8226809: Circular reference in printed stack trace is not
    correctly indented &amp; ambiguous
    + JDK-8227059: sun/security/tools/keytool/
    /DefaultSignatureAlgorithm.java timed out
    + JDK-8227269: Slow class loading when running with JDWP
    + JDK-8227595: keytool/fakegen/DefaultSignatureAlgorithm.java
    fails due to "exitValue = 6"
    + JDK-8228448: Jconsole can't connect to itself
    + JDK-8228967: Trust/Key store and SSL context utilities for
    tests
    + JDK-8229378: jdwp library loader in linker_md.c quietly
    truncates on buffer overflow
    + JDK-8229815: Upgrade Jline to 3.12.1
    + JDK-8230000: some httpclients testng tests run zero test
    + JDK-8230002: javax/xml/jaxp/unittest/transform/
    /SecureProcessingTest.java runs zero test
    + JDK-8230010: Remove jdk8037819/BasicTest1.java
    + JDK-8230094: CCE in createXMLEventWriter(Result) over an
    arbitrary XMLStreamWriter
    + JDK-8230402: Allocation of compile task fails with assert:
    "Leaking compilation tasks?"
    + JDK-8230767: FlightRecorderListener returns null recording
    + JDK-8230870: (zipfs) Add a ZIP FS test that is similar to
    test/jdk/java/util/zip/EntryCount64k.java
    + JDK-8231209: [REDO] ThreadMXBean::getThreadAllocatedBytes()
    can be quicker for self thread
    + JDK-8231586: enlarge encoding space for OopMapValue offsets
    + JDK-8231953: Wrong assumption in assertion in
    oop::register_oop
    + JDK-8231968: getCurrentThreadAllocatedBytes default
    implementation s/b getThreadAllocatedBytes
    + JDK-8232083: Minimal VM is broken after JDK-8231586
    + JDK-8232161: Align some one-way conversion in MS950 charset
    with Windows
    + JDK-8232855: jshell missing word in /help help
    + JDK-8233027: OopMapSet::all_do does oms.next() twice during
    iteration
    + JDK-8233228: Disable weak named curves by default in TLS,
    CertPath, and Signed JAR
    + JDK-8233386: Initialize NULL fields for unused decorations
    + JDK-8233452: java.math.BigDecimal.sqrt() with
    RoundingMode.FLOOR results in incorrect result
    + JDK-8233686: XML transformer uses excessive amount of memory
    + JDK-8233741: AES Countermode (AES-CTR) optimization using
    AVX512 + VAES instructions
    + JDK-8233829: javac cannot find non-ASCII module name under
    non-UTF8 environment
    + JDK-8233958: Memory retention due to HttpsURLConnection
    finalizer that serves no purpose
    + JDK-8234011: (zipfs) Memory leak in
    ZipFileSystem.releaseDeflater()
    + JDK-8234058: runtime/CompressedOops/
    /CompressedClassPointers.java fails with 'Narrow klass base:
    0x0000000000000000' missing from stdout/stderr
    + JDK-8234149: Several regression tests do not dispose Frame at
    end
    + JDK-8234347: "Turkey" meta time zone does not generate
    composed localized names
    + JDK-8234385: [TESTBUG] java/awt/EventQueue/6980209/
    /bug6980209.java fails in linux nightly
    + JDK-8234535: Cross compilation fails due to missing CFLAGS
    for the BUILD_CC
    + JDK-8234541: C1 emits an empty message when it inlines
    successfully
    + JDK-8234687: change javap reporting on unknown attributes
    + JDK-8236464: SO_LINGER option is ignored by SSLSocket in JDK
    11
    + JDK-8236548: Localized time zone name inconsistency between
    English and other locales
    + JDK-8236617: jtreg test containers/docker/
    /TestMemoryAwareness.java fails after 8226575
    + JDK-8237182: Update copyright header for shenandoah and
    epsilon files
    + JDK-8237888: security/infra/java/security/cert/
    /CertPathValidator/certification/LuxTrustCA.java fails when
    checking validity interval
    + JDK-8237977: Further update
    javax/net/ssl/compatibility/Compatibility.java
    + JDK-8238270: java.net HTTP/2 client does not decrease stream
    count when receives 204 response
    + JDK-8238284: [macos] Zero VM build fails due to an obvious
    typo
    + JDK-8238380: java.base/unix/native/libjava/childproc.c
    "multiple definition" link errors with GCC10
    + JDK-8238386: (sctp) jdk.sctp/unix/native/libsctp/SctpNet.c
    "multiple definition" link errors with GCC10
    + JDK-8238388: libj2gss/NativeFunc.o "multiple definition" link
    errors with GCC10
    + JDK-8238448: RSASSA-PSS signature verification fail when
    using certain odd key sizes
    + JDK-8238710: LingeredApp doesn't log stdout/stderr if exits
    with non-zero code
    + JDK-8239083: C1 assert(known_holder == NULL ||
    (known_holder-&gt;is_instance_klass() &amp;&amp;
    (!known_holder-&gt;is_interface() ||
    ((ciInstanceKlass*)known_holder)-&gt;has_nonstatic_concrete_methods())),
    "should be non-static concrete method");
    + JDK-8239385: KerberosTicket client name refers wrongly to
    sAMAccountName in AD
    + JDK-8240169: javadoc fails to link to non-modular api docs
    + JDK-8240295: hs_err elapsed time in seconds is not accurate
    enough
    + JDK-8240360: NativeLibraryEvent has wrong library name on
    Linux
    + JDK-8240676: Meet not symmetric failure when running lucene
    on jdk8
    + JDK-8241007: Shenandoah: remove
    ShenandoahCriticalControlThreadPriority support
    + JDK-8241065: Shenandoah: remove leftover code after
    JDK-8231086
    + JDK-8241086: Test runtime/NMT/HugeArenaTracking.java is
    failing on 32bit Windows
    + JDK-8241130: com.sun.jndi.ldap.EventSupport.removeDeadNotifier:
    java.lang.NullPointerException
    + JDK-8241138: http.nonProxyHosts=* causes
    StringIndexOutOfBoundsException in DefaultProxySelector
    + JDK-8241319: WB_GetCodeBlob doesn't have ResourceMark
    + JDK-8241478: vmTestbase/gc/gctests/Steal/steal001/steal001.java
    fails with OOME
    + JDK-8241574: Shenandoah: remove ShenandoahAssertToSpaceClosure
    + JDK-8241750: x86_32 build failure after JDK-8227269
    + JDK-8242184: CRL generation error with RSASSA-PSS
    + JDK-8242283: Can't start JVM when java home path includes
    non-ASCII character
    + JDK-8242556: Cannot load RSASSA-PSS public key with non-null
    params from byte array
    + JDK-8243029: Rewrite javax/net/ssl/compatibility/
    /Compatibility.java with a flexible interop test framework
    + JDK-8243138: Enhance BaseLdapServer to support starttls
    extended request
    + JDK-8243320: Add SSL root certificates to Oracle Root CA
    program
    + JDK-8243321: Add Entrust root CA - G4 to Oracle Root CA
    program
    + JDK-8243389: enhance os::pd_print_cpu_info on linux
    + JDK-8243453: java --describe-module failed with non-ASCII
    module name under non-UTF8 environment
    + JDK-8243470: [macos] bring back O2 opt level for unsafe.cpp
    + JDK-8243489: Thread CPU Load event may contain wrong data for
    CPU time under certain conditions
    + JDK-8243925: Toolkit#getScreenInsets() returns wrong value on
    HiDPI screens (Windows)
    + JDK-8244087: 2020-04-24 public suffix list update
    + JDK-8244151: Update MUSCLE PC/SC-Lite headers to the latest
    release 1.8.26
    + JDK-8244164: AArch64: jaotc generates incorrect code for
    compressed OOPs with non-zero heap base
    + JDK-8244196: adjust output in os_linux
    + JDK-8244225: stringop-overflow warning on strncpy call from
    compile_the_world_in
    + JDK-8244287: JFR: Methods samples have line number 0
    + JDK-8244703: "platform encoding not initialized" exceptions
    with debugger, JNI
    + JDK-8244719: CTW: C2 compilation fails with
    "assert(!VerifyHashTableKeys || _hash_lock == 0) failed:
    remove node from hash table before modifying it"
    + JDK-8244729: Shenandoah: remove resolve paths from
    SBSA::generate_shenandoah_lrb
    + JDK-8244763: Update --release 8 symbol information after JSR
    337 MR3
    + JDK-8244818: Java2D Queue Flusher crash while moving
    application window to external monitor
    + JDK-8245151: jarsigner should not raise duplicate warnings on
    verification
    + JDK-8245616: Bump update version for OpenJDK: jdk-11.0.9
    + JDK-8245714: "Bad graph detected in build_loop_late" when
    loads are pinned on loop limit check uncommon branch
    + JDK-8245801: StressRecompilation triggers assert "redundunt
    OSR recompilation detected. memory leak in CodeCache!"
    + JDK-8245832: JDK build make-static-libs should build all JDK
    libraries
    + JDK-8245880: Shenandoah: check class unloading flag early in
    concurrent code root scan
    + JDK-8245981: Upgrade to jQuery 3.5.1
    + JDK-8246027: Minimal fastdebug build broken after JDK-8245801
    + JDK-8246094: [macos] Sound Recording and playback is not
    working
    + JDK-8246153: TestEliminateArrayCopy fails with
  - XX:+StressReflectiveCode
    + JDK-8246193: Possible NPE in ENC-PA-REP search in AS-REQ
    + JDK-8246196: javax/management/MBeanServer/OldMBeanServerTest
    fails with AssertionError
    + JDK-8246203: Segmentation fault in verification due to stack
    overflow with -XX:+VerifyIterativeGVN
    + JDK-8246330: Add TLS Tests for Legacy ECDSA curves
    + JDK-8246453: TestClone crashes with "all collected exceptions
    must come from the same place"
    + JDK-8247246: Add explicit ResolvedJavaType.link and expose
    presence of default methods
    + JDK-8247350: [aarch64] assert(false) failed: wrong size of
    mach node
    + JDK-8247502: PhaseStringOpts crashes while optimising
    effectively dead code
    + JDK-8247615: Initialize the bytes left for the heap sampler
    + JDK-8247824: CTW: C2 (Shenandoah) compilation fails with SEGV
    in SBC2Support::pin_and_expand
    + JDK-8247874: Replacement in VersionProps.java.template not
    working when --with-vendor-bug-url contains '&amp;'
    + JDK-8247979: aarch64: missing side effect of killing flags
    for clearArray_reg_reg
    + JDK-8248214: Add paddings for TaskQueueSuper to reduce
    false-sharing cache contention
    + JDK-8248219: aarch64: missing memory barrier in
    fast_storefield and fast_accessfield
    + JDK-8248348: Regression caused by the update to BCEL 6.0
    + JDK-8248385: [testbug][11u] Adapt TestInitiExceptions to
    jtreg 5.1
    + JDK-8248495: [macos] zerovm is broken due to libffi headers
    location
    + JDK-8248851: CMS: Missing memory fences between free chunk
    check and klass read
    + JDK-8248987: AOT's Linker.java seems to eagerly fail-fast on
    Windows
    + JDK-8249159: Downport test rework for SSLSocketTemplate from
    8224650
    + JDK-8249215: JFrame::setVisible crashed with
  - Dfile.encoding=UTF-8 on Japanese Windows.
    + JDK-8249251: [dark_mode ubuntu 20.04] The selected menu is
    not highlighted in GTKLookAndFeel
    + JDK-8249255: Build fails if source code in cygwin home dir
    + JDK-8249277: TestVerifyIterativeGVN.java is failing with
    timeout in OpenJDK 11
    + JDK-8249278: Revert JDK-8226253 which breaks the spec of
    AccessibleState.SHOWING for JList
    + JDK-8249560: Shenandoah: Fix racy GC request handling
    + JDK-8249801: Shenandoah: Clear soft-refs on requested GC cycle
    + JDK-8249953: Shenandoah: gc/shenandoah/mxbeans tests should
    account for corner cases
    + JDK-8250582: Revert Principal Name type to NT-UNKNOWN when
    requesting TGS Kerberos tickets
    + JDK-8250609: C2 crash in IfNode::fold_compares
    + JDK-8250627: Use -XX:+/-UseContainerSupport for
    enabling/disabling Java container metrics
    + JDK-8250755: Better cleanup for
    jdk/test/javax/imageio/plugins/shared/CanWriteSequence.java
    + JDK-8250787: Provider.put no longer registering aliases in
    FIPS env
    + JDK-8250826: jhsdb does not work with coredump which comes
    from Substrate VM
    + JDK-8250827: Shenandoah: needs to reset/finish StringTable's
    dead count before/after parallel walk
    + JDK-8250844: Make sure {type,obj}ArrayOopDesc accessors check
    the bounds
    + JDK-8251117: Cannot check P11Key size in P11Cipher and
    P11AEADCipher
    + JDK-8251354: Shenandoah: Fix jdk/jfr/tool/TestPrintJSON.java
    test failure
    + JDK-8251451: Shenandoah: Remark ObjectSynchronizer roots with
    I-U
    + JDK-8251469: Better cleanup for
    test/jdk/javax/imageio/SetOutput.java
    + JDK-8251487: Shenandoah: missing detail timing tracking for
    final mark cleaning phase
    + JDK-8252120: compiler/oracle/TestCompileCommand.java
    misspells "occured"
    + JDK-8252157: JDK-8231209 11u backport breaks jmm binary
    compatibility
    + JDK-8252258: [11u] JDK-8242154 changes the default vendor
    + JDK-8252804: [test] Fix 'ReleaseDeflater.java' test after
    downport of 8234011
    + JDK-8253134: JMM_VERSION should remain at 0x20020000 (JDK 10)
    in JDK 11
    + JDK-8253283: [11u] Test build/translations/
    /VerifyTranslations.java failing after JDK-8252258
    + JDK-8253813: Backout JDK-8244287 from 11u: it causes several
    crashes
- Removed patch:
  * gcc-fno-common-fix.patch
    + not needed any more with this version
- Added patch:
  * JDK-8250861.patch
    + Fix regression "8250861: Crash in MinINode::Ideal(PhaseGVN*,
    bool)" introduced in jdk 11.0.9</changelog>
  <changelog author="fstrba@suse.com" date="1604491200">- Enable Sheandoah GC for x86_64 (jsc#ECO-3171)</changelog>
  <changelog author="fstrba@suse.com" date="1605528000">- Update to upstream tag jdk-11.0.9.1-1
  * Fix:
    + JDK-8250861: Crash in MinINode::Ideal(PhaseGVN*, bool)
- Removed patch:
  * JDK-8250861.patch
    + Integrated upstream</changelog>
  <changelog author="fstrba@suse.com" date="1611230400">- Update to upstream tag jdk-11.0.10+9 (January 2021 CPU,
  bsc#1181239)
  * Security fixes
    + JDK-8247619: Improve Direct Buffering of Characters
  * Other changes
    + JDK-6722928: Support SSPI as a native GSS-API provider
    + JDK-7185258: [macosx] Deadlock in SunToolKit.realSync()
    + JDK-8152332: [macosx] JFileChooser cannot be serialized on
    Mac OS X
    + JDK-8161684: [testconf] Add VerifyOops' testing into compiler
    tiers
    + JDK-8171279: Support X25519 and X448 in TLS
    + JDK-8173361: various crashes in
    JvmtiExport::post_compiled_method_load
    + JDK-8173658: JvmtiExport::post_class_unload() is broken for
    non-JavaThread initiators
    + JDK-8191006: hsdis disassembler plugin does not compile with
    binutils 2.29+
    + JDK-8197981: Missing return statement in
    __sync_val_compare_and_swap_8
    + JDK-8198334: java/awt/FileDialog/8003399/bug8003399.java
    fails in headless mode
    + JDK-8200151: Add 8 JNDI tests to com/sun/jndi/dns/ConfigTests/
    + JDK-8208279: Add 8 JNDI tests to com/sun/jndi/dns/EnvTests/
    + JDK-8208483: Add 5 JNDI tests to
    com/sun/jndi/dns/FactoryTests/
    + JDK-8208542: Add 4 JNDI tests to com/sun/jndi/dns/ListTests/
    + JDK-8208665: Amend cross-compilation docs with
    qemu-debootstrap recipe
    + JDK-8210088: ProblemList gc/epsilon/TestMemoryMXBeans.java
    + JDK-8210339: Add 10 JNDI tests to com/sun/jndi/dns/FedTests/
    + JDK-8211450: UndetVar::dup is not copying the kind field to
    the duplicated instance
    + JDK-8212160: JVMTI agent crashes with "assert(_value != 0LL)
    failed: resolving NULL _value"
    + JDK-8212226: SurfaceManager throws "Invalid Image variant"
    for MultiResolutionImage (Windows)
    + JDK-8213400: Support choosing group name in keytool keypair
    generation
    + JDK-8213535: Windows HiDPI html lightweight tooltips are
    truncated
    + JDK-8213698: Improve devkit creation and add support for
    linux/ppc64/ppc64le/s390x
    + JDK-8214025: assert(t-&gt;singleton()) failed: must be a
    constant when ScavengeRootsInCode &lt; 2
    + JDK-8214242: compiler/arguments/TestScavengeRootsInCode.java
    fails because of missing UnlockDiagnosticVMOptions
    + JDK-8214787: Zero builds fail with "undefined
    JavaThread::thread_state()"
    + JDK-8215583: Exclude
    runtime/handshake/HandshakeWalkSuspendExitTest.java
    + JDK-8216012: Infinite loop in RSA KeyPairGenerator
    + JDK-8216324: GetClassMethods is confused by the presence of
    default methods in super interfaces
    + JDK-8217429: WebSocket over authenticating proxy fails to
    send Upgrade headers
    + JDK-8217976: test/jdk/java/net/httpclient/websocket/
    /WebSocketProxyTest.java fails intermittently
    + JDK-8218021: Have jarsigner preserve posix permission
    attributes
    + JDK-8218287: jshell tool: input behavior unstable after
    12-ea+24 on Windows
    + JDK-8218851: JVM crash in custom classloader stress test, JDK
    12 &amp; 13
    + JDK-8220420: Cleanup c1_LinearScan
    + JDK-8222072: JVMTI GenerateEvents() sends CompiledMethodLoad
    events to wrong jvmtiEnv
    + JDK-8222286: Fix for JDK-8213419 is broken on s390
    + JDK-8222527: HttpClient doesn't send HOST header when
    tunelling HTTP/1.1 through http proxy
    + JDK-8222533: jtreg test jdk/internal/platform/cgroup/
    /TestCgroupMetrics.java fails on SLES12.3 linux ppc64le
    machine
    + JDK-8224506: [TESTBUG] TestDockerMemoryMetrics.java fails
    with exitValue = 137
    + JDK-8224555: vmTestbase/nsk/jvmti/scenarios/contention/TC02/
    /tc02t001/TestDescription.java failed
    + JDK-8224650: Add tests to support X25519 and X448 in TLS
    + JDK-8225072: Add LuxTrust certificate that is expiring in
    March 2021 to list of allowed but expired certs
    + JDK-8225329: -XX:+PrintBiasedLockingStatistics causes crash
    during initialization on Windows platforms
    + JDK-8225687: Newly added sspi.cpp in JDK-6722928 still
    contains some small errors
    + JDK-8227006: [linux] Runtime.availableProcessors execution
    time increased by factor of 100
    + JDK-8227275: Within native OOM error handling, assertions may
    hang the process
    + JDK-8227647: [Graal] Test8009761.java fails due to
    "RuntimeException: static java.lang.Object
    compiler.uncommontrap.Test8009761.m3(boolean,boolean) not
    compiled"
    + JDK-8229495: SIGILL in C2 generated OSR compilation
    + JDK-8230910: libsspi_bridge does not build on Windows 32bit
    + JDK-8232114: JVM crashed at imjpapi.dll in native code
    + JDK-8234147: Avoid looking up standard charsets in core
    libraries
    + JDK-8234393: [macos] printing ignores printer tray
    + JDK-8234863: Increase default value of MaxInlineLevel
    + JDK-8235218: Minimal VM is broken after JDK-8173361
    + JDK-8235456: Minimal VM is broken after JDK-8212160
    + JDK-8235829: graal crashes with Zombie.java test
    + JDK-8236124: Minimal VM slowdebug build failed after
    JDK-8212160
    + JDK-8236512: PKCS11 Connection closed after Cipher.doFinal
    and NoPadding
    + JDK-8236944: The legVecZ operand should be limited to
    zmm0-zmm15 registers
    + JDK-8237186: Fix typo in copyright header of
    java/io/Reader/TransferTo.java
    + JDK-8237499: JFR: Include stack trace in the ThreadStart event
    + JDK-8237512: AArch64: aarch64TestHook leaks a BufferBlob
    + JDK-8237524: AArch64: String.compareTo() may return incorrect
    result
    + JDK-8237950: C2 compilation fails with "Live Node limit
    exceeded limit" during ConvI2L::Ideal optimization
    + JDK-8238579: HttpsURLConnection drops the timeout and hangs
    forever in read
    + JDK-8239105: Add exception for expiring Digicert root
    certificates to VerifyCACerts test
    + JDK-8239477: jdk/jfr/jcmd/TestJcmdStartStopDefault.java fails
  - XX:+VerifyOops with "verify_oop: rsi: broken oop"
    + JDK-8239497: SEGV in EdgeUtils::field_name_symbol(Edge const&amp;)
    + JDK-8239886: Minimal VM build fails after JDK-8237499
    + JDK-8240633: Memory leaks in the implementations of
    FileChooserUI
    + JDK-8240690: Race condition between EDT and
    BasicDirectoryModel.FilesLoader.run0()
    + JDK-8241234: Unify monitor enter/exit runtime entries.
    + JDK-8241311: Move some charset mapping tests from closed to
    open
    + JDK-8241797: Add some tests to the problem list
    + JDK-8242029: AArch64: skip G1 array copy pre-barrier if
    marking not active
    + JDK-8242335: Additional Tests for RSASSA-PSS
    + JDK-8242480: Negative value may be returned by
    getFreeSwapSpaceSize() in the docker
    + JDK-8242614: cleanup duplicated test ldap server in some
    com/sun/jndi/ldap/ tests
    + JDK-8242846: Bring back test/jdk/tools/jlink/plugins/
    /OrderResourcesPluginTest.java
    + JDK-8243114: Implement montgomery{Multiply,Square}intrinsics
    on Windows
    + JDK-8243290: Improve diagnostic messages for class
    verification and redefinition failures
    + JDK-8243488: Add tests for set/get SendBufferSize and
    getReceiveBufferSize in DatagramSocket
    + JDK-8243549: sun/security/ssl/CipherSuite/
    /NamedGroupsWithCipherSuite.java failed with Unsupported
    signature algorithm: DSA
    + JDK-8243617: compiler/onSpinWait/TestOnSpinWaitC1.java test
    uses wrong class
    + JDK-8243619: compiler/codecache/CheckSegmentedCodeCache.java
    test misses -version
    + JDK-8244142: some hotspot/runtime tests don't check exit code
    of forked JVM
    + JDK-8244278: Excessive code cache flushes and sweeps
    + JDK-8244282: test/hotspot/jtreg/compiler/intrinsics/
    /Test8237524.java fails with --illegal-access=deny
    + JDK-8244621: [macos10.15] Garbled FX printing plus CoreText
    warnings on Catalina when building with Xcode 11
    + JDK-8244819: hsdis does not compile with binutils 2.34+
    + JDK-8245051: c1 is broken if it is compiled by gcc without
  - fno-lifetime-dse
    + JDK-8245168: jlink should not be treated as a "small" tool
    + JDK-8245400: Upgrade to LittleCMS 2.11
    + JDK-8246381: VM crashes with "Current BasicObjectLock* below
    than low_mark"
    + JDK-8246434: Threads::print_on_error assumes that the heap
    has been set up
    + JDK-8246648: issue with OperatingSystemImpl
    getFreeSwapSpaceSize in docker after 8242480
    + JDK-8247201: Print potential pointer value of readable stack
    memory in hs_err file
    + JDK-8247763: assert(outer-&gt;outcnt() == 2) failed: 'only phis'
    failure in LoopNode::verify_strip_mined()
    + JDK-8247867: Upgrade to freetype 2.10.2
    + JDK-8248190: Enable Power10 system and implement new
    byte-reverse instructions
    + JDK-8248226: TestCloneAccessStressGCM fails with
  - XX:-ReduceBulkZeroing
    + JDK-8248347: windows build broken by JDK-8243114
    + JDK-8248532: Every time I change keyboard language at my
    MacBook, Java crashes
    + JDK-8248552: C2 crashes with SIGFPE due to division by zero
    + JDK-8248596: [TESTBUG] compiler/loopopts/
    /PartialPeelingUnswitch.java times out with Graal enabled
    + JDK-8248745: Add jarsigner and keytool tests for restricted
    algorithms
    + JDK-8248791: sun/util/resources/cldr/TimeZoneNamesTest.java
    fails with -XX:-ReduceInitialCardMarks -XX:-ReduceBulkZeroing
    + JDK-8248845: AArch64: stack corruption after spilling vector
    register
    + JDK-8249176: Update GlobalSignR6CA test certificates
    + JDK-8249183: JVM crash in "AwtFrame::WmSize" method
    + JDK-8249192: MonitorInfo stores raw oops across safepoints
    + JDK-8249602: C2: assert(cnt == _outcnt) failed: no insertions
    allowed
    + JDK-8249603: C1: assert(has_error == false) failed: register
    allocation invalid
    + JDK-8249605: C2: assert(no_dead_loop) failed: dead loop
    detected
    + JDK-8249607: C2: assert(!had_error) failed: bad dominance
    + JDK-8249608: Vector register used by C2 compiled method
    corrupted at safepoint
    + JDK-8249672: Include microcode revision in features_string on
    x86
    + JDK-8249748: gtest silently ignores bad jvm arguments
    + JDK-8249821: Separate libharfbuzz from libfontmanager
    + JDK-8250598: Hyper-V is detected in spite of running on host
    OS
    + JDK-8250605: Linux x86_32 builds fail after JDK-8249821
    + JDK-8250636: iso8601_time returns incorrect offset part on
    MacOS
    + JDK-8250665: Wrong translation for the month name of May in
    ar_JO,LB,SY
    + JDK-8250772: Test com/sun/jndi/ldap/
    /NamingExceptionMessageTest.java fails intermittently with
    javax.naming.ServiceUnavailableException
    + JDK-8250825: C2 crashes with assert(field != __null) failed:
    missing field
    + JDK-8250894: Provide a configure option to build and run
    against the platform libharfbuzz
    + JDK-8250928: JFR: Improve hash algorithm for stack traces
    + JDK-8250968: Symlinks attributes not preserved when using
    jarsigner on zip files
    + JDK-8250984: Memory Docker tests fail on some Linux kernels
    w/o cgroupv1 swap limit capabilities
    + JDK-8251118: BiasedLocking::preserve_marks should not have a
    HandleMark
    + JDK-8251189: com/sun/jndi/ldap/LdapDnsProviderTest.java
    failed due to timeout
    + JDK-8251257: NMT: jcmd VM.native_memory scale=1 crashes
    target VM
    + JDK-8251365: Build failure on AIX after 8250636
    + JDK-8251397: NPE on ClassValue.ClassValueMap.cacheArray
    + JDK-8251456: [TESTBUG] compiler/vectorization/
    /TestVectorsNotSavedAtSafepoint.java failed OutOfMemoryError
    + JDK-8251458: Parse::do_lookupswitch fails with "assert(_cnt
    &gt;= 0) failed"
    + JDK-8251535: Partial peeling at unsigned test adds incorrect
    loop exit check
    + JDK-8251949: ZGC: Set explicit heap size for
    compiler/gcbarriers tests
    + JDK-8252090: JFR: StreamWriterHost::write_unbuffered() stucks
    in an infinite loop OpenJDK (build 13.0.1+9)
    + JDK-8252415: Bump update version for OpenJDK: jdk-11.0.10
    + JDK-8252470: java/awt/dnd/DisposeFrameOnDragCrash/
    /DisposeFrameOnDragTest.java fails on Windows
    + JDK-8252497: Incorrect numeric currency code for ROL
    + JDK-8252660: Shenandoah: support manageable SoftMaxHeapSize
    option
    + JDK-8252679: Two windows specific FileDIalog tests may fail
    on some Windows_Server_2016_Standard
    + JDK-8252696: Loop unswitching may cause out of bound array
    load to be executed
    + JDK-8252754: Hash code calculation of JfrStackTrace is
    inconsistent
    + JDK-8253219: Epsilon: clean up unnecessary includes
    + JDK-8253224: Shenandoah: ShenandoahStrDedupQueue destructor
    calls virtual num_queues()
    + JDK-8253226: Shenandoah: remove unimplemented
    ShenandoahStrDedupQueue::verify
    + JDK-8253269: The CheckCommonColors test should provide more
    info on failure
    + JDK-8253284: Zero OrderAccess barrier mappings are incorrect
    + JDK-8253375: OSX build fails with Xcode 12.0 (12A7209)
    + JDK-8253778: ShenandoahSafepoint::is_at_shenandoah_safepoint
    should not access VMThread state from other threads
    + JDK-8253791: Issue with useAppleColor check in CSystemColors.m
    + JDK-8254016: Test8237524 fails with -XX:-CompactStrings option
    + JDK-8254081: java/security/cert/PolicyNode/
    /GetPolicyQualifiers.java fails due to an expired certificate
    + JDK-8254144: Non-x86 Zero builds fail with return-type
    warning in os_linux_zero.cpp
    + JDK-8254166: Zero: return-type warning in
    zeroInterpreter_zero.cpp
    + JDK-8254177: (tz) Upgrade time-zone data to tzdata2020b
    + JDK-8254185: Fix Code cache sweeper heuristics for JDK 11
    + JDK-8254190: [s390] interpreter misses exception check after
    calling monitorenter
    + JDK-8254790: SIGSEGV in string_indexof_char and
    stringL_indexof_char intrinsics
    + JDK-8254854: [cgroups v1] Metric limits not properly detected
    on some join controller combinations
    + JDK-8254982: (tz) Upgrade time-zone data to tzdata2020c
    + JDK-8255050: Add pkcs11/KeyStore/ClientAuth.sh to Problem list
    + JDK-8255065: Zero: accessor_entry misses the IRIW case
    + JDK-8255226: (tz) Upgrade time-zone data to tzdata2020d
    + JDK-8255269: Unsigned overflow in g1Policy.cpp
    + JDK-8255365: Problem list failing client manual tests
    + JDK-8255457: Shenandoah: cleanup ShenandoahMarkTask
    + JDK-8255466: C2 crashes at ciObject::get_oop() const+0x0
    + JDK-8255550: x86: Assembler::cmpq(Address dst, Register src)
    encoding is incorrect
    + JDK-8255603: Memory/Performance regression after JDK-8210985
    + JDK-8255760: Shenandoah: match constants style in
    ShenandoahMarkTask fallback
    + JDK-8255781: Bump patch update version for OpenJDK:
    jdk-11.0.9.1
    + JDK-8255937: Better cleanup for
    test/jdk/javax/imageio/stream/StreamFlush.java
    + JDK-8256427: Test com/sun/jndi/dns/ConfigTests/
    /PortUnreachable.java does not work on AIX
    + JDK-8256452: Integrate missing part of JDK-8232370 to 11u
    + JDK-8256483: [TESTBUG] serviceability/jvmti/GetClassMethods/
    /libOverpassMethods.c fails to compile on gcc 4.4.x
    + JDK-8256557: libharfbuzz fails to link on gcc 4.4.x due to
  - Wl,-z,defs
    + JDK-8256618: Zero: Linux x86_32 build still fails
    + JDK-8256736: Zero: GTest tests fail with "unsuppported vm
    variant"
    + JDK-8256809: Annotation processing causes NPE during flow
    analysis
    + JDK-8257181: s390x builds are very noisy with gc-sections
    messages
    + JDK-8257242: [macOS] Java app crashes while switching input
    methods
    + JDK-8257545: SunJSSE FIPS regression in key exchange after
    JDK-8171279 11u backport
    + JDK-8257641: Shenandoah: Query is_at_shenandoah_safepoint()
    from control thread should return false
    + JDK-8257701: Shenandoah: objArrayKlass metadata is not marked
    with chunked arrays
    + JDK-8258630: Add expiry exception for QuoVadis root
    certificate
- New upstream dependency on libharfbuzz
- Regenerated patches: missing-return.patch system-pcsclite.patch</changelog>
  <changelog author="fstrba@suse.com" date="1616155200">- Added patches:
  * system-crypto-policy.patch
    + Let OpenJDK use system crypto policies unless explicitely told
    not to
  * nss-security-provider.patch
    + Add the NSS security provider with configuration in generated
    nss.cfg file
  * keytool-default-rsa.patch
    + Make keytool generate RSA keys by default, since only the
    LEGACY system crypto policy allows DSA</changelog>
  <changelog author="pujos.michael@gmail.com" date="1618488000">- moved mozilla-nss dependency to java-11-openjdk-headless package
  This is necessary to be able to do crypto with just
  java-11-openjdk-headless installed. Fixes boo#1184606</changelog>
  <changelog author="fstrba@suse.com" date="1619006400">- Update to upstream tag jdk-11.0.11+9 (April 2021, CPU)
  * Security fixes
    + JDK-8244473: Contextualize registration for JNDI
    + JDK-8244543: Enhanced handling of abstract classes
    + JDK-8249906, CVE-2021-2163, bsc#1185055: Enhance opening JARs
    + JDK-8250568, CVE-2021-2161, bsc#1185056: Less ambiguous
    processing
    + JDK-8253799: Make lists of normal filenames
    + JDK-8257001: Improve Http Client Support
  * Other changes
    + JDK-7107012: sun.jvm.hotspot.code.CompressedReadStream
    readDouble() conversion to long mishandled
    + JDK-7146776: deadlock between URLStreamHandler.getHostAddress
    and file.Handler.openconnection
    + JDK-8086003: Test fails on OSX with java.lang.RuntimeException
    'Narrow klass base: 0x0000000000000000, Narrow klass shift: 3'
    missing
    + JDK-8168869: jdeps: localized messages don't use proper line
    breaks
    + JDK-8180837: SunPKCS11-NSS tests failing with
    CKR_ATTRIBUTE_READ_ONLY and CKR_MECHANISM_PARAM_INVALID
    + JDK-8202343: Disable TLS 1.0 and 1.1
    + JDK-8205992: jhsdb cannot attach to Java processes running in
    Docker containers
    + JDK-8209193: Fix aarch64-linux compilation after -Wreorder
    changes
    + JDK-8210413: AArch64: Optimize div/rem by constant in C1
    + JDK-8210578: AArch64: Invalid encoding for fmlsvs instruction
    + JDK-8211051: jdeps usage of --dot-output doesn't provide
    valid output for modular jar
    + JDK-8211057: Gensrc step CompileProperties generates unstable
    CompilerProperties output
    + JDK-8211150: G1 Full GC not purging code root memory and
    hence causing memory leak
    + JDK-8211825: ModuleLayer.defineModulesWithXXX does not setup
    delegation when module reads automatic module
    + JDK-8212043: Add floating-point Math.min/max intrinsics
    + JDK-8212218: [TESTBUG] runtime/ErrorHandling/
    /TestHeapDumpOnOutOfMemoryErrorInMetaspace.java timed out
    + JDK-8213116: javax/swing/JComboBox/WindowsComboBoxSize/
    /WindowsComboBoxSizeTest.java fails in Windows
    + JDK-8213909: jdeps --print-module-deps should report missing
    dependences
    + JDK-8214180: Need better granularity for sleeping
    + JDK-8214223: tools/jdeps/listdeps/ListModuleDeps.java failed
    due to missing Lib2 file
    + JDK-8214230: Classes generated by SystemModulesPlugin.java
    are not reproducable
    + JDK-8214741: docs/index.html has no title or copyright
    + JDK-8215687: [Graal] unit test CheckGraalIntrinsics failed
    after 8212043
    + JDK-8217848: [Graal] vmTestbase/nsk/jvmti/ResourceExhausted/
    /resexhausted003/TestDescription.java fails
    + JDK-8218482: sun/security/krb5/auto/ReplayCachePrecise.java
    failed - no KrbException thrown
    + JDK-8218550: Add test omitted from JDK-8212043
    + JDK-8221584: SIGSEGV in os::PlatformEvent::unpark() in
    JvmtiRawMonitor::raw_exit while posting method exit event
    + JDK-8221995: AARCH64: problems with CAS instructions encoding
    + JDK-8222518: Remove unnecessary caching of Parker object in
    java.lang.Thread
    + JDK-8222785: aarch64: add necessary masking for immediate
    shift counts
    + JDK-8223186: HotSpot compile warnings from GCC 9
    + JDK-8225773: jdeps --check produces NPE if there are missing
    module dependences
    + JDK-8225805: Java Access Bridge does not close the logger
    + JDK-8226810: Failed to launch JVM because of
    NullPointerException occured on System.props
    + JDK-8229396: jdeps ignores multi-release when
    generate-module-info used on command line
    + JDK-8229474: Shenandoah: Cleanup CM::update_roots()
    + JDK-8232225: Rework the fix for JDK-8071483
    + JDK-8232905: JFR fails with assertion:
    assert(t-&gt;unflushed_size() == 0) failed: invariant
    + JDK-8233164: C2 fails with assert(phase-&gt;C-&gt;get_alias_index(t)
    == phase-&gt;C-&gt;get_alias_index(t_adr)) failed: correct memory
    chain
    + JDK-8233910: java/awt/ColorClass/AlphaColorTest.java is
    failing  intermittently in nightly lnux-x64 system
    + JDK-8233912: aarch64: minor improvements of atomic operations
    + JDK-8234508: VM_HeapWalkOperation::iterate_over_object reads
    non-strong fields with an on-strong load barrier
    + JDK-8234742: Improve handshake logging
    + JDK-8234796: Refactor Handshake::execute to take a more
    complex type than ThreadClosure
    + JDK-8235324: Dying objects are published from users of
    CollectedHeap::object_iterate
    + JDK-8235351: Lookup::unreflect should bind with the original
    caller independent of Method's accessible flag
    + JDK-8237369: Shenandoah: failed vmTestbase/nsk/jvmti/
    /AttachOnDemand/attach021/TestDescription.java test
    + JDK-8237392: Shenandoah: Remove unreliable assertion
    + JDK-8237483: AArch64 C1 OopMap inserted twice fatal error
    + JDK-8237495: Java MIDI fails with a dereferenced memory error
    when asked to send a raw 0xF7
    + JDK-8239355: (dc) Initial value of SO_SNDBUF should allow
    sending large datagrams (macOS)
    + JDK-8240353: AArch64: missing support for
  - XX:+ExtendedDTraceProbes in C1
    + JDK-8240704: CheckHandles.java failed "AssertionError: Handle
    use increased by more than 10 percent."
    + JDK-8240751: Shenandoah: fold ShenandoahTracer definition
    + JDK-8240795: [REDO] 8238384 CTW: C2 compilation fails with
    "assert(store != load-&gt;find_exact_control(load-&gt;in(0)))
    failed: dependence cycle found"
    + JDK-8241598: Upgrade JLine to 3.14.0
    + JDK-8241649: Optimize Character.toString
    + JDK-8241770: Module xxxAnnotation() methods throw NCDFE if
    module-info.class found as resource in unnamed module
    + JDK-8241911: AArch64: Fix a potential register clash issue in
    reduce_add2I
    + JDK-8242030: Wrong package declarations in jline classes after
    JDK-8241598
    + JDK-8242565: Policy initialization issues when the denyAfter
    constraint is enabled
    + JDK-8243618: compiler/rtm/cli tests can be run w/o WhiteBox
    + JDK-8243670: Unexpected test result caused by C2
    MergeMemNode::Ideal
    + JDK-8244088: [Regression] Switch of Gnome theme ends up in
    deadlocked UI
    + JDK-8244154: Update SunPKCS11 provider with PKCS11 v3.0 header
    files
    + JDK-8244340: Handshake processing thread lacks yielding
    + JDK-8244573: java.lang.ArrayIndexOutOfBoundsException thrown
    for malformed class file
    + JDK-8244683: A TSA server used by tests
    + JDK-8245005: javax/net/ssl/compatibility/BasicConnectTest.java
    failed with No enum constant
    + JDK-8245026: PsAdaptiveSizePolicy::_old_gen_policy_is_ready is
    unused
    + JDK-8245283: JFR: Can't handle constant dynamic used by Jacoco
    agent
    + JDK-8245512: CRC32 optimization using AVX512 instructions
    + JDK-8245527: LDAP Channel Binding support for Java
    GSS/Kerberos
    + JDK-8246707: (sc) SocketChannel.read/write throws
    AsynchronousCloseException on closed channel
    + JDK-8246709: sun/security/tools/jarsigner/
    /TsacertOptionTest.java compilation failed after JDK-8244683
    + JDK-8247200: assert((unsigned)fpargs &lt; 32)
    + JDK-8247766: [aarch64] guarantee(val &lt; (1U &lt;&lt; nbits))
    failed: Field too big for insn.
    + JDK-8248336: AArch64: C2: offset overflow in
    BoxLockNode::emit
    + JDK-8248865: Document JNDI/LDAP timeout properties
    + JDK-8248901: Signed immediate support in
    .../share/assembler.hpp is broken.
    + JDK-8249543: Force DirectBufferAllocTest to run with
  - ExplicitGCInvokesConcurrent
    + JDK-8249588: libwindowsaccessbridge issues on 64bit Windows
    + JDK-8249749: modify a primitive array through a stream and a
    for cycle causes jre crash
    + JDK-8249787: Make TestGCLocker more resilient with concurrent
    GCs
    + JDK-8249867: xml declaration is not followed by a newline
    + JDK-8250911: [windows] os::pd_map_memory() error detection
    broken
    + JDK-8251255: [linux] Add process-memory information to hs-err
    and VM.info
    + JDK-8251359: Shenandoah: filter null oops before calling
    enqueue/SATB barrier
    + JDK-8251925: C2: RenaissanceStressTest fails with
    assert(!had_error): bad dominance
    + JDK-8251944: Add Shenandoah test config to
    compiler/gcbarriers/UnsafeIntrinsicsTest.java
    + JDK-8251992: VM crashed running TestComplexAddrExpr.java test
    with -XX:UseAVX=X
    + JDK-8253220: Epsilon: clean up unused code/declarations
    + JDK-8253274: The CycleDMImagetest brokes the system
    + JDK-8253353: Crash in C2: guarantee(n != NULL) failed: No Node
    + JDK-8253368: TLS connection always receives close_notify
    exception
    + JDK-8253404: C2: assert(C-&gt;live_nodes() &lt;=
    C-&gt;max_node_limit()) failed: Live Node limit exceeded limit
    + JDK-8253409: Double-rounding possibility in float fma
    + JDK-8253476: TestUseContainerSupport.java fails on some Linux
    kernels w/o swap limit capabilities
    + JDK-8253524: C2: Refactor code that clones predicates during
    loop unswitching
    + JDK-8253644: C2: assert(skeleton_predicate_has_opaque(iff))
    failed: unexpected
    + JDK-8253681: closed java/awt/dnd/MouseEventAfterStartDragTest/
    /MouseEventAfterStartDragTest.html test failed
    + JDK-8253702: BigSur version number reported as 10.16, should
    be 11.nn
    + JDK-8253756: C2 CompilerThread0 crash in Node::add_req(Node*)
    + JDK-8254104: MethodCounters must exist before nmethod is
    installed
    + JDK-8254734: "dead loop detected" assert failure with patch
    from 8223051
    + JDK-8254748: Bad Copyright header format after JDK-8212218
    + JDK-8254799: runtime/ErrorHandling/
    /TestHeapDumpOnOutOfMemoryError.java fails with release VMs
    + JDK-8255058: C1: assert(is_virtual()) failed: type check
    + JDK-8255351: Add detection for Graviton 2 CPUs
    + JDK-8255368: Math.exp() gives wrong result for large values on
    x86 32-bit platforms
    + JDK-8255387: Japanese characters were printed upside down on
    AIX
    + JDK-8255401: Shenandoah: Allow oldval and newval registers to
    overlap in cmpxchg_oop()
    + JDK-8255479: [aarch64] assert(src-&gt;section_index_of(target) ==
    CodeBuffer::SECT_NONE) failed: sanity
    + JDK-8255544: Create a checked cast
    + JDK-8255559: Leak File Descriptors Because of
    ResolverLocalFilesystem#engineResolveURI()
    + JDK-8255681: print callstack in error case in
    runAWTLoopWithApp
    + JDK-8255734: VM should ignore SIGXFSZ on ppc64, s390 too
    + JDK-8255742: PrintInlining as compiler directive doesn't print
    virtual calls
    + JDK-8255845: Memory leak in imageFile.cpp
    + JDK-8255880: UI of Swing components is not redrawn after their
    internal state changed
    + JDK-8255908: ExceptionInInitializerError due to
    UncheckedIOException while initializing cgroupv1 subsystem
    + JDK-8256025: AArch64: MachCallRuntimeNode::ret_addr_offset()
    is incorrect for stub calls
    + JDK-8256056: Deoptimization stub doesn't save vector registers
    on x86
    + JDK-8256061: RegisterSaver::save_live_registers() omits upper
    halves of ZMM0-15 registers
    + JDK-8256187: [TEST_BUG] Automate bug4275046.java test
    + JDK-8256220: C1: x86_32 fails with -XX:UseSSE=1 after
    JDK-8210764 due to mishandled lir_neg
    + JDK-8256258: some missing NULL checks or asserts after
    CodeCache::find_blob_unsafe
    + JDK-8256264: Printed GlyphVector outline with low DPI has bad
    quality on Windows
    + JDK-8256290: javac/lambda/T8031967.java fails with
    StackOverflowError on x86_32
    + JDK-8256359: AArch64: runtime/ReservedStack/
    /ReservedStackTestCompiler.java fails
    + JDK-8256387: Unexpected result if patching an entire
    instruction on AArch64
    + JDK-8256421: Add 2 HARICA roots to cacerts truststore
    + JDK-8256488: [aarch64] Use ldpq/stpq instead of ld4/st4 for
    small copies in StubGenerator::copy_memory
    + JDK-8256489: Make gtest for long path names on Windows more
    resilient in the presence of virus scanners
    + JDK-8256501: libTestMainKeyWindow fails to build with Xcode
    12.2
    + JDK-8256633: Fix product build on Windows+Arm64
    + JDK-8256682: JDK-8202343 is incomplete
    + JDK-8256751: Incremental rebuild with precompiled header fails
    when touching a header file
    + JDK-8256757: Incorrect MachCallRuntimeNode::ret_addr_offset()
    for CallLeafNoFP on x86_32
    + JDK-8256806: Shenandoah: optimize shenandoah/jni/
    /TestPinnedGarbage.java test
    + JDK-8256807: C2: Not marking stores correctly as mismatched
    in string opts
    + JDK-8256810: Incremental rebuild broken on Macosx
    + JDK-8256818: SSLSocket that is never bound or connected leaks
    socket resources
    + JDK-8256888: Client manual test problem list update
    + JDK-8257083: Security infra test failures caused by
    JDK-8202343
    + JDK-8257408: Bump update version for OpenJDK: jdk-11.0.11
    + JDK-8257423: [PPC64] Support -XX:-UseInlineCaches
    + JDK-8257436: [aarch64] Regressions in ArrayCopyUnalignedDst
    .testByte/testChar for 65-78 bytes when UseSIMDForMemoryOps
    is on
    + JDK-8257513: C2: assert((constant_addr -
    _masm.code()-&gt;consts()-&gt;start()) == con.offset())
    + JDK-8257547: Handle multiple prereqs on the same line in deps
    files
    + JDK-8257561: Some code is not vectorized after 8251925 and
    8250607
    + JDK-8257565: epsilonBarrierSet.hpp should not include
    barrierSetAssembler
    + JDK-8257575: C2: "failed: only phis" assert failure in loop
    strip mining verification
    + JDK-8257594: C2 compiled checkcast of non-null object triggers
    endless deoptimization/recompilation cycle
    + JDK-8257633: Missing -mmacosx-version-min=X flag when linking
    libjvm
    + JDK-8257670: sun/security/ssl/SSLSocketImpl/SSLSocketLeak.java
    reports leaks
    + JDK-8257707: Fix incorrect format string in Http1HeaderParser
    + JDK-8257746: Regression introduced with JDK-8250984 - memory
    might be null in some machines
    + JDK-8257798: [PPC64] undefined reference to
    Klass::vtable_start_offset()
    + JDK-8257884: Re-enable sun/security/ssl/SSLSocketImpl/
    /SSLSocketLeak.java as automatic test
    + JDK-8257910: [JVMCI] Set exception_seen accordingly in the
    runtime.
    + JDK-8257997: sun/security/ssl/SSLSocketImpl/SSLSocketLeak.java
    again reports leaks after JDK-8257884
    + JDK-8257999: Parallel GC crash in gc/parallel/
    /TestDynShrinkHeap.java: new region is not in covered_region
    + JDK-8258077: Using -Xcheck:jni can lead to a double-free after
    JDK-8193234
    + JDK-8258247: Couple of issues in fix for JDK-8249906
    + JDK-8258373: Update the text handling in the JPasswordField
    + JDK-8258396: SIGILL in jdk.jfr.internal.PlatformRecorder
    .rotateDisk()
    + JDK-8258419: RSA cipher buffer cleanup
    + JDK-8258471: "search codecache" clhsdb command does not work
    + JDK-8258534: Epsilon: clean up unused includes
    + JDK-8258805: Japanese characters not entered by mouse click
    on Windows 10
    + JDK-8258833: Cancel multi-part cipher operations in SunPKCS11
    after failures
    + JDK-8258836: JNI local refs exceed capacity
    getDiagnosticCommandInfo
    + JDK-8258884: [TEST_BUG] Convert applet-based test
    open/test/jdk/javax/swing/JMenuItem/8031573/bug8031573.java
    to a regular java test
    + JDK-8259007: This test printed a blank page
    + JDK-8259048: (tz) Upgrade time-zone data to tzdata2020f
    + JDK-8259049: Uninitialized variable after JDK-8257513
    + JDK-8259231: Epsilon: improve performance under contention
    during virtual space expansion
    + JDK-8259271: gc/parallel/TestDynShrinkHeap.java still fails
    "assert(covered_region.contains(new_memregion)) failed: new
    region is not in covered_region"
    + JDK-8259312: VerifyCACerts.java fails as soneraclass2ca cert
    will expire in 90 days
    + JDK-8259319: Illegal package access when SunPKCS11 requires
    SunJCE's classes
    + JDK-8259339: AllocateUninitializedArray C2 intrinsic fails
    with void.class input
    + JDK-8259428: AlgorithmId.getEncodedParams() should return copy
    + JDK-8259446: runtime/jni/checked/
    /TestCheckedReleaseArrayElements.java fails with stderr not
    empty
    + JDK-8259451: Zero: skip serviceability/sa tests, set vm.hasSA
    to false
    + JDK-8259580: Shenandoah: uninitialized label in
    VerifyThreadGCState
    + JDK-8259619: C1: 3-arg StubAssembler::call_RT stack-use
    condition is incorrect
    + JDK-8259633: compiler/graalunit/CoreTest.java fails with NPE
    after JDK-8244543
    + JDK-8259706: C2 compilation fails with assert(vtable_index ==
    Method::invalid_vtable_index) failed: correct sentinel value
    + JDK-8259707: LDAP channel binding does not work with StartTLS
    extension
    + JDK-8259773: Incorrect encoding of AVX-512 kmovq instruction
    + JDK-8259849: Shenandoah: Rename store-val to IU-barrier
    + JDK-8259949: x86 32-bit build fails when -fcf-protection is
    passed in the compiler flags
    + JDK-8259954: gc/shenandoah/mxbeans tests fail with -Xcomp
    + JDK-8260029: aarch64: fix typo in verify_oop_array
    + JDK-8260308: Update LogCompilation junit to 4.13.1
    + JDK-8260338: Some fields in HaltNode is not cloned
    + JDK-8260349: Cannot programmatically retrieve Metaspace max
    set via JAVA_TOOL_OPTIONS
    + JDK-8260356: (tz) Upgrade time-zone data to tzdata2021a
    + JDK-8260378: [TESTBUG] DcmdMBeanTestCheckJni.java reports
    false positive
    + JDK-8260497: Shenandoah: Improve SATB flushing
    + JDK-8260502: [s390] NativeMovRegMem::verify() fails because
    it's too strict
    + JDK-8260632: Build failures after JDK-8253353
    + JDK-8260704: ParallelGC: oldgen expansion needs release-store
    for _end
    + JDK-8261022: Fix incorrect result of Math.abs() with char type
    + JDK-8261089: [TESTBUG] native library of test
    TestCheckedReleaseCriticalArray.java fails to compile with
    gcc 4.x
    + JDK-8261183: Follow on to Make lists of normal filenames
    + JDK-8261209: isStandalone property: remove dependency on
    pretty-print
    + JDK-8261231: Windows IME was disabled after DnD operation
    + JDK-8261251: Shenandoah: Use object size for full GC
    humongous compaction
    + JDK-8261310: PPC64 Zero build fails with
    'VMError::controlled_crash(int)::FunctionDescriptor
    functionDescriptor' has incomplete type and cannot be defined
    + JDK-8261334: NMT: tuning statistic shows incorrect hash
    distribution
    + JDK-8261413: Shenandoah: Disable class-unloading in I-U mode
    + JDK-8261522: [PPC64] AES intrinsics write beyond the
    destination array
    + JDK-8261534: Test sun/security/pkcs11/KeyAgreement/
    /IllegalPackageAccess.java fails on platforms where no nsslib
    artifacts are defined
    + JDK-8261585: Restore HandleArea used in
    Deoptimization::uncommon_trap
    + JDK-8261753: Test java/lang/System/OsVersionTest.java still
    failing on BigSur patch versions after JDK-8253702
    + JDK-8261829: Exclude tools/jlink/JLinkReproducibleTest.java
    in 11u
    + JDK-8261912: Code IfNode::fold_compares_helper more
    defensively
    + JDK-8261920: [AIX] jshell command throws java.io.IOError on
    non English locales
    + JDK-8262018: Wrong format in SAP copyright header of
    OsVersionTest
    + JDK-8263069: Exclude some failing tests from
    security/infra/java/security/cert/CertPathValidator</changelog>
  <changelog author="fstrba@suse.com" date="1620043200">- Remove all Jpackage provides for SLE12 in order to avoid
  installing this package as default Java on SLE12-SP5
  (bsc#1185476)</changelog>
  <changelog author="fstrba@suse.com" date="1621512000">- Modified patch:
  * nss-security-provider.patch
    + make the NSS provider first in the list</changelog>
  <changelog author="fstrba@suse.com" date="1626868800">- Update to upstream tag jdk-11.0.12+7 (July 2021, CPU)
  * Security fixes
    + JDK-8256157: Improve bytecode assembly
    + JDK-8256491: Better HTTP transport
    + JDK-8258432, CVE-2021-2341, bsc#1188564: Improve file
    transfers
    + JDK-8260453: Improve Font Bounding
    + JDK-8260960: Signs of jarsigner signing
    + JDK-8260967, CVE-2021-2369, bsc#1188565: Better jar file
    validation
    + JDK-8262380: Enhance XML processing passes
    + JDK-8262403: Enhanced data transfer
    + JDK-8262410: Enhanced rules for zones
    + JDK-8262477: Enhance String Conclusions
    + JDK-8262967: Improve Zip file support
    + JDK-8264066, CVE-2021-2388, bsc#1188566: Enhance compiler
    validation
    + JDK-8264079: Improve abstractions
    + JDK-8264460: Improve NTLM support
  * Other changes
    + JDK-6847157: java.lang.NullPointerException: HDC for
    component at sun.java2d.loops.Blit.Blit
    + JDK-7106851: Test should not use System.exit
    + JDK-8073446: TimeZone getOffset API does not  return a dst
    offset between years 2038-2137
    + JDK-8076190: Customizing the generation of a PKCS12 keystore
    + JDK-8153005: Upgrade the default PKCS12 encryption/MAC
    algorithms
    + JDK-8171303: sun/java2d/pipe/InterpolationQualityTest.java
    fails on Windows &amp; Linux
    + JDK-8177068: incomplete classpath causes NPE in Flow
    + JDK-8185734: [Windows] Structured Exception Catcher missing
    around gtest execution
    + JDK-8187450: JNI local refs exceeds capacity warning in
    NetworkInterface::getAll
    + JDK-8190763: Class cast exception on (CompoundEdit)
    UndoableEditEvent.getEdit()
    + JDK-8195841: PNGImageReader.readNullTerminatedString() doesnt
    check for non-null terminated strings with length equal to
    maxLen
    + JDK-8196100: javax/swing/text/JTextComponent/5074573/
    /bug5074573.java fails
    + JDK-8199646: JShell tests: jdk/jshell/
    /FailOverDirectExecutionControlTest.java failed with
    java.lang.UnsupportedOperationException
    + JDK-8206925: Support the certificate_authorities extension
    + JDK-8207160: ClassReader::adjustMethodParams can potentially
    return null if the args list is empty
    + JDK-8207247: AARCH64: Enable Minimal and Client VM builds
    + JDK-8207404: MulticastSocket tests failing on AIX
    + JDK-8207779: Method::is_valid_method() compares 'this' with
    NULL
    + JDK-8208061: runtime/LoadClass/TestResize.java fails with
    "Load factor too high" when running in CDS mode.
    + JDK-8209459: TestSHA512MultiBlockIntrinsics failed on AArch64
    + JDK-8210443: Migrate Locale matching tests to JDK Repo.
    + JDK-8213231: ThreadSnapshot::_threadObj can become stale
    + JDK-8213483: ARM32: runtime/ErrorHandling/
    /ShowRegistersOnAssertTest.java jtreg test fail
    + JDK-8213725: JShell NullPointerException due to class file
    with unexpected package
    + JDK-8213794: ARM32: disable TypeProfiling,
    CriticalJNINatives, Serviceablity tests for ARM32
    + JDK-8213845: ARM32: Interpreter doesn't call result handler
    after native calls
    + JDK-8214128: ARM32: wrong stack alignment on
    Deoptimization::unpack_frames
    + JDK-8214512: ARM32: Jtreg test compiler/c2/Test8062950.java
    fails on ARM
    + JDK-8214854: JDWP: Unforseen output truncation in logging
    + JDK-8214922: Add vectorization support for fmin/fmax
    + JDK-8215009: GCC 8 compilation error in libjli
    + JDK-8216184: CDS/appCDS tests failed on Windows due to long
    path to a classlist file
    + JDK-8216259: AArch64: Vectorize Adler32 intrinsics
    + JDK-8216314: SIGILL in CodeHeapState::print_names()
    + JDK-8217348: assert(thread-&gt;is_Java_thread()) failed: just
    checking
    + JDK-8217465: [REDO] - Optimize CodeHeap Analytics
    + JDK-8217561: X86: Add floating-point Math.min/max intrinsics
    + JDK-8217918: C2: -XX:+AggressiveUnboxing is broken
    + JDK-8218458: [TESTBUG] runtime/NMT/
    /CheckForProperDetailStackTrace.java fails with Expected
    stack trace missing from output
    + JDK-8219142: Remove unused JIMAGE_ResourcePath
    + JDK-8219586: CodeHeap State Analytics processes dead nmethods
    + JDK-8220074: Clean up GCC 8.3 errors in LittleCMS
    + JDK-8220407: compiler/intrinsics/math/
    /TestFpMinMaxIntrinsics.java timedout
    + JDK-8222302: [TESTBUG] test/hotspot/jtreg/compiler/intrinsics/
    /sha/cli/TestUseSHAOptionOnUnsupportedCPU.java fails on any
    other CPU
    + JDK-8222412: AARCH64: multiple instructions encoding issues
    + JDK-8223020: aarch64: expand minI_rReg and maxI_rReg patterns
    into separate instructions
    + JDK-8223444: Improve CodeHeap Free Space Management
    + JDK-8223504: Improve performance of forall loops by better
    inlining of "iterator()" methods
    + JDK-8223667: ASAN build broken
    + JDK-8225081: Remove Telia Company CA certificate expiring in
    April 2021
    + JDK-8225116: Test OwnedWindowsLeak.java intermittently fails
    + JDK-8225438: javax/net/ssl/TLSCommon/
    /TestSessionLocalPrincipal.java failed with Read timed out
    + JDK-8225756: [testbug] compiler/loopstripmining/
    /CheckLoopStripMining.java sets too short a
    SafepointTimeoutDelay
    + JDK-8226374: Restrict TLS signature schemes and named groups
    + JDK-8226627: assert(t-&gt;singleton()) failed: must be a constant
    + JDK-8226721: Missing intrinsics for Math.ceil, floor, rint
    + JDK-8227080: (fs) Files.newInputStream(...).skip(n) is slow
    + JDK-8227222: vmTestbase/jit/FloatingPoint/gen_math/Loops04/
    /Loops04.java failed XMM register should be 0-15
    + JDK-8227609: (fs) Files.newInputStream(...).skip(n) should
    allow skipping beyond file size
    + JDK-8230428: Cleanup dead CastIP node code in formssel.cpp
    + JDK-8231460: Performance issue (CodeHeap) with large free
    blocks
    + JDK-8231713: x86_32 build failures after JDK-8226721 (Missing
    intrinsics for Math.ceil, floor, rint)
    + JDK-8231841: AArch64: debug.cpp help() is missing an AArch64
    line for pns
    + JDK-8232084: HotSpot build failed with GCC 9.2.1
    + JDK-8232591: AArch64: Add missing match rules for smaddl,
    smsubl and smnegl
    + JDK-8233185: HttpServer.stop() blocks indefinitely when
    called on dispatch thread
    + JDK-8233787: Break cycle in vm_version* includes
    + JDK-8233948: AArch64: Incorrect mapping between OptoReg and
    VMReg for high 64 bits of Vector Register
    + JDK-8234355: Buffer overflow in jcmd GC.class_stats due to
    too many classes
    + JDK-8235368: Update BCEL to Version 6.4.1
    + JDK-8236859: WebSocket over authenticating proxy fails with
    NPE
    + JDK-8236992: AArch64: remove redundant load_klass in itable
    stub
    + JDK-8237743: test/langtools/jdk/jshell/
    /FailOverExecutionControlTest.java fails No
    ExecutionControlProvider with name 'nonExistent' and parameter
    keys: []
    + JDK-8237804: sun/security/mscapi tests fail with "Key pair
    not generated, alias &lt;nnnnnn&gt; already exists"
    + JDK-8238175: CTW: Class.getDeclaredMethods fails with
    assert(k-&gt;is_subclass_of(SystemDictionary::Throwable_klass()))
    failed: invalid exception class
    + JDK-8238567: SoftMainMixer.processAudioBuffers(): Wrong
    handling of stoppedMixers
    + JDK-8238812: assert(false) failed: bad AD file
    + JDK-8239312: [macos] javax/swing/JFrame/NSTexturedJFrame/
    /NSTexturedJFrame.java
    + JDK-8239386: handle ContendedPaddingWidth in
    vm_version_aarch64
    + JDK-8239536: Can't use 'java.util.List' object after
    importing 'java.awt.List'
    + JDK-8240487: Cleanup whitespace in .cc, .hh, .m, and .mm files
    + JDK-8240848: ArrayIndexOutOfBoundsException buf for
    TextCallbackHandler
    + JDK-8241082: Upgrade IANA Language Subtag Registry data to
    03-16-2020 version
    + JDK-8241087: Build failure with VS 2019 (16.5.0) due to C2039
    and C2873
    + JDK-8241101: [s390] jtreg test failure after JDK-8238696: not
    conformant features string
    + JDK-8241248: NullPointerException in
    sun.security.ssl.HKDF.extract(HKDF.java:93)
    + JDK-8241372: Several test failures due to
    javax.net.ssl.SSLException: Connection reset
    + JDK-8241475: AArch64: Add missing support for PopCountVI node
    + JDK-8241829: Cleanup the code for PrinterJob on windows
    + JDK-8241960: The SHA3 message digests impl of SUN provider
    are not thread safe after cloned
    + JDK-8242010: Upgrade IANA Language Subtag Registry to Version
    2020-04-01
    + JDK-8242429: Better implementation for sign extract
    + JDK-8242557: Add length limit for strings in PNGImageWriter
    + JDK-8242919: Paste locks up jshell
    + JDK-8243155: AArch64: Add support for SqrtVF
    + JDK-8243240: AArch64: Add support for MulVB
    + JDK-8243452: JFR: Could not create chunk in repository with
    over 200 recordings
    + JDK-8243559: Remove root certificates with 1024-bit keys
    + JDK-8243597: AArch64: Add support for integer vector abs
    + JDK-8244031: HttpClient should have more tests for HEAD
    requests
    + JDK-8244205: HTTP/2 tunnel connections through proxy may be
    reused regardless of which proxy is selected
    + JDK-8244847: Linux/PPC: runtime/CompressedOops/
    /CompressedClassPointers: smallHeapTest fails
    + JDK-8245511: G1 adaptive IHOP does not account for
    reclamation of humongous objects by young GC
    + JDK-8246274: G1 old gen allocation tracking is not in a
    separate class
    + JDK-8247354: [aarch64] PopFrame causes
    assert(oopDesc::is_oop(obj)) failed: not an oop
    + JDK-8247408: IdealGraph bit check expression canonicalization
    + JDK-8247432: Update IANA Language Subtag Registry to Version
    2020-09-29
    + JDK-8247438: JShell: When FailOverExecutionControlProvider
    fails the proximal cause is not shown
    + JDK-8247753: UIManager.getSytemLookAndFeelClassName() returns
    wrong value on Fedora 32
    + JDK-8248043: Need to eliminate excessive i2l conversions
    + JDK-8248411: [aarch64] Insufficient error handling when
    CodeBuffer is exhausted
    + JDK-8248568: compiler/c2/TestBit.java failed: test missing
    from stdout/stderr
    + JDK-8248870: AARCH64: I2L/L2I conversions can be skipped for
    masked positive values
    + JDK-8249142: java/awt/FontClass/CreateFont/DeleteFont.sh is
    unstable
    + JDK-8249189: AARCH64: more L2I conversions can be skipped
    + JDK-8249719: MethodHandle performance suffers from bad
    ResolvedMethodTable hash function
    + JDK-8249875: GCC 10 warnings -Wtype-limits with JFR code
    + JDK-8250635: MethodArityHistogram should use Compile_lock in
    favour of fancy checks
    + JDK-8250876: Fix issues with cross-compile on macos
    + JDK-8251031: Some vmTestbase/nsk/monitoring/RuntimeMXBean
    tests fail with hostnames starting from digits
    + JDK-8251525: AARCH64: Faster Math.signum(fp)
    + JDK-8252259: AArch64: Adjust default value of FLOATPRESSURE
    + JDK-8252311: AArch64: save two words in itable lookup stub
    + JDK-8252779: compiler/graalunit/HotspotTest.java failed after
    8251525
    + JDK-8252883: AccessDeniedException caused by delayed file
    deletion on Windows
    + JDK-8253167: ARM32 builds fail after JDK-8247910
    + JDK-8253572: [windows] CDS archive may fail to open with long
    file names
    + JDK-8253923: C2 doesn't always run loop opts for compilations
    that include loops
    + JDK-8253948: Memory leak in ImageFileReader
    + JDK-8254631: Better support ALPN byte wire values in SunJSSE
    + JDK-8254717: isAssignableFrom checks in
    KeyFactorySpi.engineGetKeySpec appear to be backwards
    + JDK-8255086: Update the root locale display names
    + JDK-8255625: AArch64: Implement Base64.encodeBlock
    accelerator/intrinsic
    + JDK-8255763: C2: OSR miscompilation caused by invalid memory
    instruction placement
    + JDK-8255992: JFR EventWriter does not use first string from
    StringPool with id 0
    + JDK-8256037: [TESTBUG] com/sun/jndi/dns/ConfigTests/
    /PortUnreachable.java fails due to the hard coded threshold
    is small
    + JDK-8256244: java/lang/ProcessHandle/PermissionTest.java
    fails with TestNG 7.1
    + JDK-8256287: [windows] add loop fuse to
    map_or_reserve_memory_aligned
    + JDK-8256523: Streamline Java SHA2 implementation
    + JDK-8257414: Drag n Drop target area is wrong on high DPI
    systems
    + JDK-8257569: Failure observed with
    JfrVirtualMemory::initialize
    + JDK-8257574: C2: "failed: parsing found no loops but there
    are some" assert failure
    + JDK-8257580: Bump update version for OpenJDK: jdk-11.0.12
    + JDK-8257604: JNI_ArgumentPusherVaArg leaks valist
    + JDK-8257621: JFR StringPool misses cached items across
    consecutive recordings
    + JDK-8257796: [TESTBUG]
    TestUseSHA512IntrinsicsOptionOnSupportedCPU.java fails
    on x86_32
    + JDK-8257822: C2 crashes with SIGFPE due to a division that
    floats above its zero check
    + JDK-8257828: SafeFetch may crash if invoked in non-JavaThreads
    + JDK-8257853: Remove dependencies on JNF's JNI utility
    functions in AWT and 2D code
    + JDK-8257858: [macOS]: Remove JNF dependency from
    libosxsecurity/KeystoreImpl.m
    + JDK-8257860: [macOS]: Remove JNF dependency from
    libosxkrb5/SCDynamicStoreConfig.m
    + JDK-8257988: Remove JNF dependency from
    libsaproc/MacosxDebuggerLocal.m
    + JDK-8258414: OldObjectSample events too expensive
    + JDK-8258505: [TESTBUG] TestDivZeroWithSplitIf.java fails due
    to missing UnlockDiagnosticVMOptions
    + JDK-8258753: StartTlsResponse.close() hangs due to
    synchronization issues
    + JDK-8259061: C2: assert(found) failed: memory-writing node is
    not placed in its original loop or an ancestor of it
    + JDK-8259227: C2 crashes with SIGFPE due to a division that
    floats above its zero check
    + JDK-8259232: Bad JNI lookup during printing
    + JDK-8259276: C2: Empty expression stack when reexecuting
    tableswitch/lookupswitch instructions after deoptimization
    + JDK-8259343: [macOS] Update JNI error handling in Cocoa code.
    + JDK-8259585: Accessible actions do not work on mac os x
    + JDK-8259651: [macOS] Replace JNF_COCOA_ENTER/EXIT macros
    + JDK-8259662: Don't wrap SocketExceptions into SSLExceptions
    in SSLSocketImpl
    + JDK-8259710: Inlining trace leaks memory
    + JDK-8259729: Missed JNFInstanceOf -&gt; IsInstanceOf conversion
    + JDK-8259777: Incorrect predication condition generated by ADLC
    + JDK-8259786: initialize last parameter of getpwuid_r
    + JDK-8259843: initialize dli_fname array before calling
    dll_address_to_library_name
    + JDK-8259869: [macOS] Remove desktop module dependencies on
    JNF Reference APIs
    + JDK-8259886: Improve SSL session cache performance and
    scalability
    + JDK-8259983: do not use uninitialized expand_ms value in
    G1CollectedHeap::expand_heap_after_young_collection
    + JDK-8260030: Improve stringStream buffer handling
    + JDK-8260236: better init AnnotationCollector _contended_group
    + JDK-8260255: C1: LoopInvariantCodeMotion constructor can
    leave some fields uninitialized
    + JDK-8260284: C2: assert(_base == Int) failed: Not an Int
    + JDK-8260380: Upgrade to LittleCMS 2.12
    + JDK-8260420: C2 compilation fails with assert(found_sfpt)
    failed: no node in loop that's not input to safepoint
    + JDK-8260426: awt debug_mem.c DMem_AllocateBlock might leak
    memory
    + JDK-8260432: allocateSpaceForGP in freetypeScaler.c might
    leak memory
    + JDK-8260616: Removing remaining JNF dependencies in the
    java.desktop module
    + JDK-8260653: Unreachable nodes keep speculative types alive
    + JDK-8260707: java/lang/instrument/PremainClass/
    /InheritAgent0100.java times out
    + JDK-8260925: HttpsURLConnection does not work  with other
    JSSE provider.
    + JDK-8260926: Trace resource exhausted events unconditionally
    + JDK-8261020: Wrong format parameter in
    create_emergency_chunk_path
    + JDK-8261027: AArch64: Support for LSE atomics C++ HotSpot code
    + JDK-8261167: print_process_memory_info add a close call after
    fopen
    + JDK-8261170: Upgrade to freetype 2.10.4
    + JDK-8261198: [macOS] Incorrect JNI parameters in number
    conversion in A11Y code
    + JDK-8261235: C1 compilation fails with
    assert(res-&gt;vreg_number() == index) failed: conversion check
    + JDK-8261261: The version extra fields needs to be overridable
    in jib-profiles.js
    + JDK-8261262: Kitchensink24HStress.java crashed with
    EXCEPTION_ACCESS_VIOLATION
    + JDK-8261354: SIGSEGV at MethodIteratorHost
    + JDK-8261355: No data buffering in SunPKCS11 Cipher encryption
    when the underlying mechanism has no padding
    + JDK-8261397: try catch Method failing to work when dividing
    an integer by 0
    + JDK-8261422: Adjust problematic String.format calls in
    jdk/internal/util/Preconditions.java outOfBoundsMessage
    + JDK-8261447: MethodInvocationCounters frequently run into
    overflow
    + JDK-8261481: Cannot read Kerberos settings in dynamic store
    on macOS Big Sur
    + JDK-8261505: Test test/hotspot/jtreg/gc/parallel/
    /TestDynShrinkHeap.java killed by Linux OOM Killer
    + JDK-8261601: free memory in early return in
    Java_sun_nio_ch_sctp_SctpChannelImpl_receive0
    + JDK-8261649: AArch64: Optimize LSE atomics in C++ code
    + JDK-8261730: C2 compilation fails with
    assert(store-&gt;find_edge(load) != -1) failed: missing
    precedence edge
    + JDK-8261752: Multiple GC test are missing memory requirements
    + JDK-8261791: (sctp) handleSendFailed in SctpChannelImpl.c
    potential leaks
    + JDK-8261812: C2 compilation fails with assert(!had_error)
    failed: bad dominance
    + JDK-8261914: IfNode::fold_compares_helper faces
    non-canonicalized bool when running JRuby JSON workload
    + JDK-8262093: java/util/concurrent/tck/JSR166TestCase.java
    failed "assert(false) failed: unexpected node"
    + JDK-8262110: DST starts from incorrect time in 2038
    + JDK-8262121: [11u] Redo 8244287: JFR: Methods samples have
    line number 0
    + JDK-8262163: Extend settings printout in jcmd VM.metaspace
    + JDK-8262295: C2: Out-of-Bounds Array Load from Clone Source
    + JDK-8262298: G1BarrierSetC2::step_over_gc_barrier fails with
    assert "bad barrier shape"
    + JDK-8262446: DragAndDrop hangs on Windows
    + JDK-8262461: handle wcstombsdmp return value correctly in
    unix awt_InputMethod.c
    + JDK-8262465: Very long compilation times and high memory
    consumption in C2 debug builds
    + JDK-8262726: AArch64: C1 StubAssembler::call_RT can corrupt
    stack
    + JDK-8262739: String inflation C2 intrinsic prevents insertion
    of anti-dependencies
    + JDK-8262829: Native crash in
    Win32PrintServiceLookup.getAllPrinterNames()
    + JDK-8262837: handle split_USE correctly
    + JDK-8262900: ToolBasicTest fails to access HTTP server it
    starts
    + JDK-8263260: [s390] Support latest hardware (z14 and z15)
    + JDK-8263311: Watch registry changes for remote printers
    update instead of polling
    + JDK-8263361: Incorrect arraycopy stub selected by C2 for SATB
    collectors
    + JDK-8263404: RsaPrivateKeySpec is always recognized as
    RSAPrivateCrtKeySpec in RSAKeyFactory.engineGetKeySpec
    + JDK-8263425: AArch64: two potential bugs in C1
    LIRGenerator::generate_address()
    + JDK-8263448: CTW: fatal error: meet not symmetric
    + JDK-8263504: Some OutputMachOpcodes fields are uninitialized
    + JDK-8263557: Possible NULL dereference in
    Arena::destruct_contents()
    + JDK-8263558: Possible NULL dereference in fast path arena
    free if ZapResourceArea is true
    + JDK-8263676: AArch64: one potential bug in C1
    LIRGenerator::generate_address()
    + JDK-8263729: [test] divert spurious output away from stream
    under test in ProcessBuilder Basic test
    + JDK-8263846: Bad JNI lookup getFocusOwner in accessibility
    code on Mac OS X
    + JDK-8264047: Duplicate global variable 'jvm' in libjavajpeg
    and libawt
    + JDK-8264096: slowdebug jvm crashes when StrInflatedCopy match
    rule is not supported
    + JDK-8264151: ciMethod::ensure_method_data() should return
    false is loading resulted in empty state
    + JDK-8264173: [s390] Improve Hardware Feature Detection And
    Reporting
    + JDK-8264190: Harden TLS interop tests
    + JDK-8264223: CodeHeap::verify fails extra_hops assertion in
    fastdebug test
    + JDK-8264328: Broken license in
    javax/swing/JComboBox/8072767/bug8072767.java
    + JDK-8264360: Loop strip mining verification fails with
    "should be on the backedge"
    + JDK-8264626: C1 should be able to inline excluded methods
    + JDK-8264640: CMS ParScanClosure misses a barrier
    + JDK-8264786: [macos] All Swing/AWT apps cause Allow
    Notifications prompt to appear when app is launched
    + JDK-8264821: DirectIOTest fails on a system with large block
    size
    + JDK-8264848: [macos] libjvm.dylib linker warning due to macOS
    version mismatch
    + JDK-8264923: PNGImageWriter.write_zTXt throws Exception with
    a typo
    + JDK-8264958: C2 compilation fails with assert "n is later
    than its clone"
    + JDK-8265099: Revert backport to 11u of 8236859: WebSocket
    over authenticating proxy fails with NPE
    + JDK-8265154: vinserti128 operand mix up for KNL platforms
    + JDK-8265239: Shenandoah: Shenandoah heap region count could
    be off by 1
    + JDK-8265417: Backport of JDK-8249672 breaks Solaris x86 build
    + JDK-8265421: java/lang/String/StringRepeat.java test is
    missing a memory requirement
    + JDK-8265462: Handle multiple slots in the NSS Internal Module
    from SunPKCS11's Secmod
    + JDK-8265537: x86 version string truncated after JDK-8249672
    11u backport
    + JDK-8265666: Enable AIX build platform to make external debug
    symbols
    + JDK-8265677: CMS: CardTableBarrierSet::write_ref_array_work()
    lacks storestore barrier
    + JDK-8265690: Use the latest Ubuntu base image version in
    Docker testing
    + JDK-8265718: Build failure after JDK-8258414 11u backport
    + JDK-8265750: Fatal error in safepoint.cpp after backport of
    8258414
    + JDK-8265784: [C2] Hoisting of DecodeN leaves MachTemp inputs
    behind
    + JDK-8265938: C2's conditional move optimization does not
    handle top Phi
    + JDK-8266220: keytool still prompt for store password on a
    password-less pkcs12 file if -storetype pkcs12 is specified
    + JDK-8266293: Key protection using PBEWithMD5AndDES fails with
    "java.security.InvalidAlgorithmParameterException: Salt must
    be 8 bytes long"
    + JDK-8266713: [AIX] Build failure after 11u backport of
    JDK-8247753
    + JDK-8266802: Shenandoah: Round up region size to page size
    unconditionally
    + JDK-8266892: avoid maybe-uninitialized gcc warnings on linux
    s390x
    + JDK-8266929: Unable to use algorithms from 3p providers
    + JDK-8267235: [macos_aarch64]
    InterpreterRuntime::throw_pending_exception messing up LR
    results in crash
    + JDK-8267561: Shenandoah: Reference processing not properly
    setup for outside of cycle degenerated GC
    + JDK-8267599: Revert the change to the default PKCS12
    macAlgorithm and macIterationCount props for 11u/8u/7u
    + JDK-8267641: [11u] 8227609 backport typo
    + JDK-8267721: Enable sun/security/pkcs11 tests for Amazon
    Linux 2 AArch64
    + JDK-8268678: LetsEncryptCA.java test fails as Let's Encrypt
    Authority X3 is retired</changelog>
  <changelog author="schwab@suse.de" date="1628078400">- riscv64-zero.patch: Add support for riscv64 (zero VM)</changelog>
  <changelog author="fstrba@suse.com" date="1629979200">- Added patch:
  * jdk11-glibc234.patch
    + fix build with glibc-2.34 (bsc#1189201)</changelog>
  <changelog author="fstrba@suse.com" date="1631534400">- Modified patch:
  * nss-security-provider.patch
    + revert recent changes making NSS provider the default one
    + fixes bsc#1190252</changelog>
  <changelog author="fstrba@suse.com" date="1631793600">- Added patch:
  * fips.patch
    + implement FIPS support in OpenJDK</changelog>
  <changelog author="fstrba@suse.com" date="1634817600">- Update to upstream tag jdk-11.0.13+8 (October 2021 CPU)
  * Security fixes
    + JDK-8163326, CVE-2021-35550, bsc#1191901: Update the default
    enabled cipher suites preference
    + JDK-8254967, CVE-2021-35565, bsc#1191909:
    com.sun.net.HttpsServer spins on TLS session close
    + JDK-8263314: Enhance XML Dsig modes
    + JDK-8265167, CVE-2021-35556, bsc#1191910: Richer Text Editors
    + JDK-8265574: Improve handling of sheets
    + JDK-8265580, CVE-2021-35559, bsc#1191911: Enhanced style for
    RTF kit
    + JDK-8265776: Improve Stream handling for SSL
    + JDK-8266097, CVE-2021-35561, bsc#1191912: Better hashing
    support
    + JDK-8266103: Better specified spec values
    + JDK-8266109: More Resilient Classloading
    + JDK-8266115: More Manifest Jar Loading
    + JDK-8266137, CVE-2021-35564, bsc#1191913: Improve Keystore
    integrity
    + JDK-8266689, CVE-2021-35567, bsc#1191903: More Constrained
    Delegation
    + JDK-8267086: ArrayIndexOutOfBoundsException in
    java.security.KeyFactory.generatePublic
    + JDK-8267712: Better LDAP reference processing
    + JDK-8267729, CVE-2021-35578, bsc#1191904: Improve TLS client
    handshaking
    + JDK-8267735, CVE-2021-35586, bsc#1191914: Better BMP support
    + JDK-8268193: Improve requests of certificates
    + JDK-8268199: Correct certificate requests
    + JDK-8268205: Enhance DTLS client handshake
    + JDK-8268506: More Manifest Digests
    + JDK-8269618, CVE-2021-35603, bsc#1191906: Better session
    identification
    + JDK-8269624: Enhance method selection support
    + JDK-8270398: Enhance canonicalization
    + JDK-8270404: Better canonicalization
  * Other changes
    + JDK-8024368: private methods are allocated vtable indices
    + JDK-8042902: Test java/net/Inet6Address/serialize/
    /Inet6AddressSerializationTest.java fails intermittently
    + JDK-8140466: ChaCha20 and Poly1305 TLS Cipher Suites
    + JDK-8157404: Unable to read certain PKCS12 keystores from
    SequenceInputStream
    + JDK-8158066: SourceDebugExtensionTest fails to rename file
    + JDK-8168304: Make all of DependencyContext_test available in
    product mode
    + JDK-8169246: java/net/DatagramSocket/ReportSocketClosed.java
    fails intermittently with BindException
    + JDK-8181313: SA: Remove libthread_db dependency on Linux
    + JDK-8193214: Incorrect annotations.without.processors
    warnings with JDK 9
    + JDK-8194230: jdk/internal/jrtfs/remote/
    /RemoteRuntimeImageTest.java fails with
    java.lang.NullPointerException
    + JDK-8196092: javax/swing/JComboBox/8032878/bug8032878.java
    fails
    + JDK-8199931: java/net/MulticastSocket/
    /UnreferencedMulticastSockets.java fails with "incorrect data
    received"
    + JDK-8206083: Make tools/javac/api/T6265137.java robust to JDK
    version changes
    + JDK-8206350: java/util/Locale/bcp47u/SystemPropertyTests.java
    failed on Mac 10.13 with zh_CN and zh_TW locales.
    + JDK-8207316: java/nio/channels/spi/SelectorProvider/
    /inheritedChannel/InheritedChannelTest.java failed
    + JDK-8208227: tools/jdeps/DotFileTest.java fails on Win-X64
    + JDK-8208363: test/jdk/java/lang/Package/
    /PackageFromManifest.java missing module dependencies
    declaration
    + JDK-8209380: ARM: cleanup maybe-uninitialized and reorder
    compiler warnings
    + JDK-8209768: Refactor java/util/prefs/CheckUserPrefsStorage.sh
    to plain java test
    + JDK-8209772: Refactor shell test java/util/ServiceLoader/
    /basic/basic.sh to java
    + JDK-8209773: Refactor shell test javax/naming/module/basic.sh
    to java
    + JDK-8209832: Refactor jdk/internal/reflect/Reflection/
    /GetCallerClassTest.sh to plain java test
    + JDK-8209930: Refactor java/util/zip/ZipFile/deletetempjar.sh
    to plain java test
    + JDK-8210406: Refactor java.util.PluggableLocale:i18n shell
    tests to plain java tests
    + JDK-8210407: Refactor java.util.Calendar:i18n shell tests to
    plain java tests
    + JDK-8210495: compiler crashes because of illegal signature in
    otherwise legal code
    + JDK-8210669: Some launcher tests assume a pre-JDK 9 run-time
    image layout
    + JDK-8210802: temp files left by tests in
    jdk/java/net/httpclient
    + JDK-8210819: Update the host name in CNameTest.java
    + JDK-8210908: Refactor java/util/prefs/PrefsSpi.sh to plain
    java test
    + JDK-8210934: Move sun/net/www/protocol/http/
    /GetErrorStream.java to OpenJDK
    + JDK-8210959: JShell fails and exits when statement throws an
    exception whose message contains a '%'.
    + JDK-8211055: Provide print to a file (PDF) feature even when
    printer was not connected
    + JDK-8211092: test/jdk/sun/net/www/http/HttpClient/
    /MultiThreadTest.java fails intermittently when cleaning up
    + JDK-8211296: Remove HotSpot deprecation warning suppression
    for Mac/clang
    + JDK-8211325: test/jdk/java/net/Socket/LingerTest.java fails
    with cleaning up
    + JDK-8212040: Compilation error due to wrong usage of
    NSPrintJobDispositionValue in mac10.12
    + JDK-8212695: Add explicit timeout to several HTTP Client tests
    + JDK-8212718: Refactor some annotation processor tests to
    better use collections
    + JDK-8213007: Update the link in test/jdk/sun/security/
    /provider/SecureRandom/DrbgCavp.java
    + JDK-8213137: Remove static initialization of monitor/mutex
    instances
    + JDK-8213235: java/nio/channels/SocketChannel/
    /AsyncCloseChannel.java fails with threads that didn't exit
    + JDK-8213409: Refactor sun.text.IntHashtable:i18n shell tests
    to plain java tests
    + JDK-8213576: Make test AsyncCloseChannel.java run in othervm
    + JDK-8213694: Test Timeout.java should run in othervm mode
    + JDK-8213718: [TEST] Wrong classname in vmTestbase/nsk/stress/
    /except/except002 and except003
    + JDK-8213922: fix ctw stand-alone build
    + JDK-8214195: Align stdout messages in
    test/jdk/java/math/BigInteger/PrimitiveConversionTests.java
    + JDK-8214520: [TEST_BUG] sun/security/mscapi/nonUniqueAliases/
    /NonUniqueAliases.java failed with incorrect jtreg tags order
    + JDK-8214937: sun/security/tools/jarsigner/warnings/
    /NoTimestampTest.java failed due to unexpected expiration date
    + JDK-8216532: tools/launcher/Test7029048.java fails (Solaris)
    + JDK-8217825: Verify @AfterTest is used correctly in WebSocket
    tests
    + JDK-8218145: block_if_requested is not proper inlined due to
    size
    + JDK-8219417: bump jtreg requiredVersion to b14
    + JDK-8219552: bump jtreg requiredVersion to b14 in
    test/jdk/sanity/client/
    + JDK-8219804: java/net/MulticastSocket/Promiscuous.java fails
    intermittently due to NumberFormatException
    + JDK-8220445: Support for side by side MSVC Toolset versions
    + JDK-8221988: add possibility to build with Visual Studio 2019
    + JDK-8222751: closed/test/jdk/sun/security/util/
    /DerIndefLenConverter/IndefBerPkcs12.java fail
    + JDK-8223050: JVMCI: findUniqueConcreteMethod() should not use
    Dependencies::find_unique_concrete_method() for non-virtual
    methods
    + JDK-8224853: CDS address sanitizer errors
    + JDK-8225082: Remove IdenTrust certificate that is expiring in
    September 2021
    + JDK-8225583: Examine the HttpResponse.BodySubscribers for
    null handling and multiple subscriptions
    + JDK-8225690: Multiple AttachListener threads can be created
    + JDK-8225790: Two NestedDialogs tests fail on Ubuntu
    + JDK-8226319: Add forgotten test/jdk/java/net/httpclient/
    /BodySubscribersTest.java
    + JDK-8226533: JVMCI: findUniqueConcreteMethod should handle
    statically bindable methods directly
    + JDK-8226602: Test convenience reactive primitives from
    java.net.http with RS TCK
    + JDK-8226683: Remove review suggestion from fix to 8219804
    + JDK-8227738: jvmti/DataDumpRequest/datadumpreq001 failed due
    to "exit code is 134"
    + JDK-8227766: CheckUnhandledOops is broken in MemAllocator
    + JDK-8227815: Minimal VM: set_state is not a member of
    AttachListener
    + JDK-8230674: Heap dumps should exclude dormant CDS archived
    objects of unloaded classes
    + JDK-8230808: Remove Access::equals()
    + JDK-8230841: Remove oopDesc::equals()
    + JDK-8231717: Improve performance of charset decoding when
    charset is always compactable
    + JDK-8232243: Wrong caret position in JTextPane on Windows
    with a screen resolution &gt; 100%
    + JDK-8232782: Shenandoah: streamline post-LRB CAS barrier
    (aarch64)
    + JDK-8233790: Forward output from heap dumper to jcmd/jmap
    + JDK-8233989: Create an IPv4 version of
    java/net/MulticastSocket/SetLoopbackMode.java
    + JDK-8234510: Remove file seeking requirement for writing a
    heap dump
    + JDK-8235211: serviceability/attach/
    /RemovingUnixDomainSocketTest.java fails with
    AttachNotSupportedException: Unable to open socket file
    + JDK-8235216: typo in test filename
    + JDK-8235866: bump jtreg requiredVersion to 4.2b16
    + JDK-8236111: narrow allowSmartActionArgs disabling
    + JDK-8236413: AbstractConnectTimeout should tolerate both
    NoRouteToHostException and UnresolvedAddressException
    + JDK-8236671: NullPointerException in JKS keystore
    + JDK-8238930: problem list compiler/c2/Test8004741.java
    + JDK-8238943: switch to jtreg 5.0
    + JDK-8240555: Using env of JAVA_TOOL_OPTIONS and _JAVA_OPTIONS
    breaks QuietOption.java test
    + JDK-8240983: Incorrect copyright header in Apache Santuario
    2.1.3 files
    + JDK-8241336: Some java.net tests failed with
    NoRouteToHostException on MacOS with special network
    configuration
    + JDK-8241353: NPE in ToolProvider.getSystemJavaCompiler
    + JDK-8241768: git needs .gitattributes
    + JDK-8242882: opening jar file with large manifest might throw
    NegativeArraySizeException
    + JDK-8244973: serviceability/attach/
    /RemovingUnixDomainSocketTest.java fails "stderr was not
    empty"
    + JDK-8245134: test/lib/jdk/test/lib/security/
    /KeyStoreUtils.java should allow to specify aliases
    + JDK-8246261: TCKLocalTime.java failed due to "AssertionError:
    expected [18:14:22] but found [18:14:23]"
    + JDK-8246387: switch to jtreg 5.1
    + JDK-8247421: [TESTBUG] ReturnBlobToWrongHeapTest.java failed
    allocating blob
    + JDK-8247469: getSystemCpuLoad() returns -1 on linux when some
    offline cpus are present and cpusets.effective_cpus is not
    available
    + JDK-8248352: [TEST_BUG] Test test/jdk/java/awt/font/
    /TextLayout/ArabicDiacriticTest.java can leave frame open
    + JDK-8248403: AArch64: Remove uses of kernel integer types
    + JDK-8248414: AArch64: Remove uses of long and unsigned long
    ints
    + JDK-8248657: Windows: strengthening in ThreadCritical
    regarding memory model
    + JDK-8248666: AArch64: Use THREAD_LOCAL instead of __thread
    + JDK-8248668: AArch64: Avoid MIN/MAX macros when using MSVC
    + JDK-8248671: AArch64: Remove unused variables
    + JDK-8248682: AArch64: Use ATTRIBUTE_ALIGNED helper
    + JDK-8248816: C1: Fix signature conflict in
    LIRGenerator::strength_reduce_multiply
    + JDK-8249095: tools/javac/launcher/SourceLauncherTest.java
    fails on Windows
    + JDK-8249548: backward focus traversal gets stuck in button
    group
    + JDK-8249773: Upgrade ReceiveISA.java test to be resilient to
    failure due to stray packets and interference
    + JDK-8249897: jdk/javadoc/tool/LangVers.java uses @ignore w/o
    bug-id
    + JDK-8249898: jdk/javadoc/tool/6176978/T6176978.java uses
    @ignore w/o bug-id
    + JDK-8249899: jdk/javadoc/tool/InlineTagsWithBraces.java uses
    @ignore w/o bug-id
    + JDK-8250588: Shenandoah: LRB needs to save/restore fp
    registers for runtime call
    + JDK-8250824: AArch64: follow up for JDK-8248414
    + JDK-8251166: Add automated testcases for changes done in
    JDK-8214112
    + JDK-8251252: Add automated testcase for fix done in
    JDK-8214253
    + JDK-8251254: Add automated test for fix done in JDK-8218472
    + JDK-8251361: Potential race between Logger configuration and
    GCs in HttpURLConWithProxy test
    + JDK-8251549: Update docs on building for Git
    + JDK-8251945: SIGSEGV in
    PackageEntry::purge_qualified_exports()
    + JDK-8252194: Add automated test for fix done in JDK-8218469
    + JDK-8252648: Shenandoah: name gang tasks consistently
    + JDK-8252825: Add automated test for fix done in JDK-8218479
    + JDK-8252853: AArch64: gc/shenandoah/TestVerifyJCStress.java
    fails intermittently with C1
    + JDK-8252857: AArch64: Shenandoah C1 CAS is not sequentially
    consistent
    + JDK-8253048: AArch64: When CallLeaf, no need to preserve
    callee-saved registers in caller
    + JDK-8253424: Add support for running pre-submit testing using
    GitHub Actions
    + JDK-8253631: Remove unimplemented CompileBroker methods after
    JEP-165
    + JDK-8253865: Pre-submit testing using GitHub Actions does not
    detect failures reliably
    + JDK-8253899: Make IsClassUnloadingEnabled signature match
    specification
    + JDK-8254024: Enhance native libs for AWT and Swing to work
    with GraalVM Native Image
    + JDK-8254054: Pre-submit testing using GitHub Actions should
    not use the deprecated set-env command
    + JDK-8254173: Add Zero, Minimal hotspot targets to submit
    workflow
    + JDK-8254175: Build no-pch configuration in debug mode for
    submit checks
    + JDK-8254244: Some code emitted by TemplateTable::branch is
    unused when running TieredCompilation
    + JDK-8254270: linux 32 bit build doesn't compile
    libjdwp/log_messages.c
    + JDK-8254282: Add Linux x86_32 builds to submit workflow
    + JDK-8254850: Update terminology in java.awt.GridBagLayout
    source code comments
    + JDK-8255255: Update Apache Santuario (XML Signature) to
    version 2.2.1
    + JDK-8255305: Add Linux x86_32 tier1 to submit workflow
    + JDK-8255352: Archive important test outputs in submit workflow
    + JDK-8255373: Submit workflow artifact name is always
    "test-results_.zip"
    + JDK-8255452: Doing GC during JVMTI MethodExit event posting
    breaks return oop
    + JDK-8255718: Zero: VM should know it runs in interpreter-only
    mode
    + JDK-8255790: GTKL&amp;F: Java 16 crashes on initialising GTKL&amp;F
    on Manjaro Linux
    + JDK-8255810: Zero: build fails without JVMTI
    + JDK-8255895: Submit workflow artifacts miss hs_errs/replays
    due to ZIP include mismatch
    + JDK-8256127: Add cross-compiled foreign architectures builds
    to submit workflow
    + JDK-8256215: Shenandoah: re-organize saving/restoring machine
    state in assembler code
    + JDK-8256267: Relax compiler/floatingpoint/NaNTest.java for
    x86_32 and lower -XX:+UseSSE
    + JDK-8256277: Github Action build on macOS should define OS
    and Xcode versions
    + JDK-8256354: Github Action build on Windows should define OS
    and MSVC versions
    + JDK-8256393: Github Actions build on Linux should define OS
    and GCC versions
    + JDK-8256414: add optimized build to submit workflow
    + JDK-8256747: GitHub Actions: decouple the hotspot build-only
    jobs from Linux x64 testing
    + JDK-8257056: Submit workflow should apt-get update to avoid
    package installation errors
    + JDK-8257148: Remove obsolete code in AWTView.m
    + JDK-8257497: Update keytool to create AKID from the SKID of
    the issuing certificate as specified by RFC 5280
    + JDK-8257620: Do not use objc_msgSend_stret to get macOS
    version
    + JDK-8257913: Add more known library locations to simplify
    Linux cross-compilation
    + JDK-8258703: Incorrect 512-bit vector registers restore on
    x86_32
    + JDK-8259338: Add expiry exception for identrustdstx3 alias to
    VerifyCACerts.java test
    + JDK-8259535: ECDSA SignatureValue do not always have the
    specified length
    + JDK-8259679: GitHub actions should use MSVC 14.28
    + JDK-8259924: GitHub actions fail on Linux x86_32 with "Could
    not configure libc6:i386"
    + JDK-8260460: GitHub actions still fail on Linux x86_32 with
    "Could not configure libc6:i386"
    + JDK-8260589: Crash in JfrTraceIdLoadBarrier::load(_jclass*)
    + JDK-8260923: Add more tests for SSLSocket input/output
    shutdown
    + JDK-8261072: AArch64: Fix MacroAssembler::get_thread
    convention
    + JDK-8261147: C2: Node is wrongly marked as reduction
    resulting in a wrong execution due to wrong vector instructions
    + JDK-8261238: NMT should not limit baselining by size threshold
    + JDK-8261496: Shenandoah: reconsider pacing updates memory
    ordering
    + JDK-8261652: Remove some dead comments from os_bsd_x86
    + JDK-8261846: [JVMCI] c2v_iterateFrames can get out of sync
    with the StackFrameStream
    + JDK-8262000: jdk/jfr/event/gc/detailed/
    /TestPromotionFailedEventWithParallelScavenge.java failed with
    "OutOfMemoryError: Java heap space"
    + JDK-8262017: C2: assert(n != __null) failed: Bad immediate
    dominator info.
    + JDK-8262392: Update Mesa 3-D Headers to version 21.0.3
    + JDK-8262409: sun/security/ssl/SSLSocketImpl/
    /SSLSocketImplThrowsWrongExceptions. SSL test failures caused
    by java failed with "Server reported the wrong exception"
    + JDK-8262470: Printed GlyphVector outline with low DPI has bad
    quality on Windows
    + JDK-8262862: Harden tests sun/security/x509/URICertStore/
    /ExtensionsWithLDAP.java and krb5/canonicalize/Test.java
    + JDK-8263136: C4530 was reported from VS 2019 at access bridge
    + JDK-8263227: C2: inconsistent spilling due to dead nodes in
    exception block
    + JDK-8263382: java/util/logging/ParentLoggersTest.java failed
    with "checkLoggers: getLoggerNames() returned unexpected
    loggers"
    + JDK-8263407: SPARC64 detection fails on Athena (SPARC64-X)
    + JDK-8263432: javac may report an invalid package/class clash
    on case insensitive filesystems
    + JDK-8263490: [macos] Crash occurs on JPasswordField with
    activated InputMethod
    + JDK-8263531: Remove unused buffer int
    + JDK-8263667: Avoid running GitHub actions on branches named
    pr/*
    + JDK-8263776: [JVMCI] add helper to perform Java upcalls
    + JDK-8264016: [JVMCI] add some thread local fields for use by
    JVMCI
    + JDK-8264752: SIGFPE crash with option
    FlightRecorderOptions:threadbuffersize=30M
    + JDK-8265132: C2 compilation fails with assert "missing
    precedence edge"
    + JDK-8265231: (fc) ReadDirect and WriteDirect tests fail after
    fix for JDK-8264821
    + JDK-8265335: Epsilon: Minor typo in EpsilonElasticTLABDecay
    description
    + JDK-8265756: AArch64: initialize memory allocated for locals
    according to Windows AArch64 stack page growth requirement in
    template interpreter
    + JDK-8265761: Font with missed font family name is not
    properly printed on Windows
    + JDK-8265773: incorrect jdeps message "jdk8internals" to
    describe a removed JDK internal API
    + JDK-8265836: OperatingSystemImpl.getCpuLoad() returns
    incorrect CPU load inside a container
    + JDK-8266018: Shenandoah: fix an incorrect assert
    + JDK-8266206: Build failure after JDK-8264752 with older GCCs
    + JDK-8266248: Compilation failure in
    PLATFORM_API_MacOSX_MidiUtils.c with Xcode 12.5
    + JDK-8266288: assert root method not found in
    witnessed_reabstraction_in_supers is too strong
    + JDK-8266404: Fatal error report generated with
  - XX:+CrashOnOutOfMemoryError should not contain suggestion to
    submit a bug report
    + JDK-8266480: Implicit null check optimization does not update
    control of hoisted memory operation
    + JDK-8266615: C2 incorrectly folds subtype checks involving an
    interface array
    + JDK-8266642: Improve ResolvedMethodTable hash function
    + JDK-8266749: AArch64: Backtracing broken on PAC enabled
    systems
    + JDK-8266761: AssertionError in
    sun.net.httpserver.ServerImpl.responseCompleted
    + JDK-8266813: Shenandoah: Use shorter instruction sequence for
    checking if marking in progress
    + JDK-8267042: bug in monitor locking/unlocking on ARM32 C1 due
    to uninitialized BasicObjectLock::_displaced_header
    + JDK-8267348: Rewrite gc/epsilon/TestClasses.java to use
    Metaspace with less classes
    + JDK-8267396: Avoid recording "pc" in unhandled oops detector
    for better performance
    + JDK-8267399: C2: java/text/Normalizer/ConformanceTest.java
    test failed with assertion
    + JDK-8267424: CTW: C1 fails with "State must not be null"
    + JDK-8267459: Pasting Unicode characters into JShell does not
    work.
    + JDK-8267625: AARCH64: typo in LIR_Assembler::emit_profile_type
    + JDK-8267666: Add option to jcmd GC.heap_dump to use existing
    file
    + JDK-8267695: Bump update version for OpenJDK: jdk-11.0.13
    + JDK-8267751: (test) jtreg.SkippedException has no serial
    VersionUID
    + JDK-8267773: PhaseStringOpts::int_stringSize doesn't handle
    min_jint correctly
    + JDK-8268103: JNI functions incorrectly return a double after
    JDK-8265836
    + JDK-8268127: Shenandoah: Heap size may be too small for
    region to align to large page size
    + JDK-8268261: C2: assert(n != __null) failed: Bad immediate
    dominator info.
    + JDK-8268347: C2: nested locks optimization may create
    unbalanced monitor enter/exit code
    + JDK-8268360: Missing check for infinite loop during node
    placement
    + JDK-8268362: [REDO] C2 crash when compile negative
    Arrays.copyOf length after loop
    + JDK-8268366: Incorrect calculation of has_fpu_registers in C1
    linear scan
    + JDK-8268369: SIGSEGV in PhaseCFG::implicit_null_check due to
    missing null check
    + JDK-8268417: Add test from JDK-8268360
    + JDK-8268427: Improve AlgorithmConstraints:checkAlgorithm
    performance
    + JDK-8268617: [11u REDO] - WebSocket over authenticating proxy
    fails with NPE
    + JDK-8268620: InfiniteLoopException test may fail on x86
    platforms
    + JDK-8268635: Corrupt oop in ClassLoaderData
    + JDK-8268699: Shenandoah: Add test for JDK-8268127
    + JDK-8268771: javadoc -notimestamp option does not work on
    index.html
    + JDK-8268775: Password is being converted to String in
    AccessibleJPasswordField
    + JDK-8268776: Test `ADatagramSocket.java` missing /othervm
    from @run tag
    + JDK-8268965: TCP Connection Reset when connecting simple
    socket to SSL server
    + JDK-8269304: Regression ~5% in 2005 in b27
    + JDK-8269415: [11u] Remove ea from
    DEFAULT_PROMOTED_VERSION_PRE in OpenJDK 11u
    + JDK-8269478: Shenandoah: gc/shenandoah/mxbeans tests should
    be more resilient
    + JDK-8269529: javax/swing/reliability/
    /HangDuringStaticInitialization.java fails in Windows debug
    build
    + JDK-8269594: assert(_handle_mark_nesting &gt; 1) failed: memory
    leak: allocating handle outside HandleMark
    + JDK-8269614: [s390] Interpreter checks wrong bit for slow
    path instance allocation
    + JDK-8269650: Optimize gc-locker in
    [Get|Release]StringCritical for latin string
    + JDK-8269661: JNI_GetStringCritical does not lock char array
    + JDK-8269668: [aarch64] java.library.path not including
    /usr/lib64
    + JDK-8269763: The JEditorPane is blank after JDK-8265167
    + JDK-8269795: C2: Out of bounds array load floats above its
    range check in loop peeling resulting in SEGV
    + JDK-8269847: JDK-8269594 backport breaks 11u builds
    + JDK-8269850: Most JDK releases report macOS version 12 as
    10.16 instead of 12.0
    + JDK-8269851: OperatingSystemMXBean getProcessCpuLoad reports
    incorrect process cpu usage in containers
    + JDK-8269882: stack-use-after-scope in NewObjectA
    + JDK-8269934: RunThese24H.java failed with
    EXCEPTION_ACCESS_VIOLATION in
    java_lang_Thread::get_thread_status
    + JDK-8270096: Shenandoah: Optimize gc/shenandoah/
    /TestRefprocSanity.java for interpreter mode
    + JDK-8270137: Kerberos Credential Retrieval from Cache not
    Working in Cross-Realm Setup
    + JDK-8270184: [TESTBUG] Add coverage for jvmci
    ResolvedJavaType.toJavaName() for lambdas
    + JDK-8270196: [11u] [JVMCI] JavaType.toJavaName() returns
    incorrect type name for lambdas
    + JDK-8270556: Exclude security/infra/java/security/cert/
    /CertPathValidator/certification/LetsEncryptCA
    + JDK-8270893: IndexOutOfBoundsException while reading large
    TIFF file
    + JDK-8272078: Wrong Checksums in Temurin BootJDK dependencies
    + JDK-8272124: Cgroup v1 initialization causes
    NullPointerException when cgroup path contains colon
    + JDK-8272131: PhaseMacroExpand::generate_slow_arraycopy crash
    when clone null CallProjections.fallthrough_ioproj
    + JDK-8272197: Update 11u GHA workflow with Shenandoah
    configurations
    + JDK-8272332: --with-harfbuzz=system doesn't add -lharfbuzz
    after JDK-8255790
    + JDK-8272472: StackGuardPages test doesn't build with glibc
    2.34
    + JDK-8272602: [macos] not all KEY_PRESSED events sent when
    control modifier is used
    + JDK-8272628: Problemlist gc/stress/gcbasher/
    /TestGCBasherWithCMS.java for x86_32
    + JDK-8272700: [macos] Build failure with Xcode 13.0 after
    JDK-8264848
    + JDK-8272772: Shenandoah: compiler/c2/aarch64/
    /TestVolatilesShenandoah.java fails in 11u
    + JDK-8273939: Backport of 8248414 to JDK11 breaks
    MacroAssembler::adrp
- Remove the unneeded icedtea-sound provider
- Removed patches:
  * icedtea-sound-1.0.1-jdk9.patch
  * icedtea-sound-soundproperties.patch
    + not needed since the icedtea-sound provider is removed
  * jdk11-glibc234.patch
    + integrated upstream</changelog>
  <changelog author="fstrba@suse.com" date="1635940800">- Modified patches:
  * system-crypto-policy.patch
    + rediff to changed context
  * fips.patch
    + Allow plain key import in fips mode unless
    com.suse.fips.plainKeySupport is set to false</changelog>
  <changelog author="fstrba@suse.com" date="1636113600">- Modified patch:
  * fips.patch
    + return in native code after generating java.io.IOException</changelog>
</package>
<package pkgid="9d25cdf34a7395e27002b02943c42ba42a7f4d748e81c5c5754f2dd12d6b92f8" name="java-11-openjdk-headless" arch="ppc64le">
  <version epoch="0" ver="11.0.13.0" rel="3.68.1"/>
  <changelog author="fstrba@suse.com" date="1586952000">- The pack200 and unpack200 alternatives should be slaves of java
  and not of javac, since they are part of JRE.</changelog>
  <changelog author="fstrba@suse.com" date="1587470400">- Update to upstream tag jdk-11.0.7+10 (April 2020 CPU,
  bsc#1169511)
  * Security fixes:
    + S8223898, CVE-2020-2754: Forward references to Nashorn
    + S8223904, CVE-2020-2755: Improve Nashorn matching
    + S8224541, CVE-2020-2756: Better mapping of serial ENUMs
    + S8224549, CVE-2020-2757: Less Blocking Array Queues
    + S8225603: Enhancement for big integers
    + S8226346: Build better binary builders
    + S8227467: Better class method invocations
    + S8227542: Manifest improved jar headers
    + S8229733: TLS message handling improvements
    + S8231415, CVE-2020-2773: Better signatures in XML
    + S8231785: Improved socket permissions
    + S8232424, CVE-2020-2778: More constrained algorithms
    + S8232581, CVE-2020-2767: Improve TLS verification
    + S8233250: Better X11 rendering
    + S8233410: Better Build Scripting
    + S8234027: Better JCEKS key support
    + S8234408, CVE-2020-2781: Improve TLS session handling
    + S8234825, CVE-2020-2800: Better Headings for HTTP Servers
    + S8234841, CVE-2020-2803: Enhance buffering of byte buffers
    + S8235274, CVE-2020-2805: Enhance typing of methods
    + S8235691, CVE-2020-2816: Enhance TLS connectivity
    + S8236201, CVE-2020-2830: Better Scanner conversions
    + S8238960: linux-i586 builds are inconsistent as the newly
    built jdk is not able to reserve enough space for object heap
  * Other changes:
    + S4919790: Errors in alert ssl message does not reflect the
    actual certificate status
    + S4949105: Access Bridge lacks html tags parsing
    + S7092821: java.security.Provider.getService() is synchronized
    and became scalability bottleneck
    + S7143743: Potential memory leak with zip provider
    + S8005819: Support cross-realm MSSFU
    + S8042383: [TEST_BUG] Test javax/swing/plaf/basic/BasicMenuUI/
    /4983388/bug4983388.java fails with shortcuts on menus do not
    work
    + S8068184: Fix for JDK-8032832 caused a deadlock
    + S8145845: [AOT] NullPointerException in
    compiler/whitebox/GetCodeHeapEntriesTest.java
    + S8152988: [AOT] Update test batch definitions to include
    aot-ed java.base module mode into hs-comp testing
    + S8160926: FLAGS_COMPILER_CHECK_ARGUMENTS doesn't handle
    cross-compilation
    + S8163083: SocketListeningConnector does not allow invocations
    with port 0
    + S8163251: Hard coded loop limit prevents reading of smart
    card data greater than 8k
    + S8167276: jvmci/compilerToVM/MaterializeVirtualObjectTest.java
    fails with -XX:-EliminateAllocations
    + S8169718: nsk/jdb/locals/locals002: ERROR: Cannot find
    boolVar with expected value: false
    + S8176556:
    java/awt/dnd/ImageTransferTest/ImageTransferTest.java fails
    for JFIF
    + S8178798: Two compiler/aot/verification/vmflags tests fail by
    timeout with UseAVX=3
    + S8183107: PKCS11 regression regarding checkKeySize
    + S8185005: Improve performance of
    ThreadMXBean.getThreadInfo(long ids[], int maxDepth)
    + S8189633: Missing -Xcheck:jni checking for DeleteWeakGlobalRef
    + S8189861: Refactor CacheFind
    + S8193042: NativeLookup::lookup_critical_entry() should only
    load shared library once
    + S8193596: java/net/DatagramPacket/ReuseBuf.java failed due to
    timeout
    + S8194944: Regression automated test 'open/test/jdk/javax/
    /swing/JInternalFrame/8145896/TestJInternalFrameMaximize.java'
    fails
    + S8196467: javax/swing/JInternalFrame/Test6325652.java fails
    + S8196969: JTreg Failure: serviceability/sa/ClhsdbJstack.java
    causes NPE
    + S8198321: javax/swing/JEditorPane/5076514/bug5076514.java
    fails
    + S8198398: Test javax/swing/JColorChooser/Test6199676.java
    fails in mach5
    + S8199072: Test javax/swing/GroupLayout/6613904/
    /bug6613904.java is unstable
    + S8200432: javadoc fails with ClassCastException on {@link
    byte[]}
    + S8201349: build broken when configured with
  - -with-zlib=bundled on gcc 7.3
    + S8201355: Avoid native memory allocation in
    sun.security.mscapi.PRNG.generateSeed
    + S8201513: nsk/jvmti/IterateThroughHeap/filter-* are broken
    + S8203364: Some serviceability/sa/ tests intermittently fail
    with java.io.IOException: LingeredApp terminated with non-zero
    exit code 3
    + S8203687: javax/net/ssl/compatibility/Compatibility.java
    supports TLS 1.3
    + S8203904: javax/swing/JSplitPane/4816114/bug4816114.java: The
    divider location is wrong
    + S8203911: Test runtime/modules/getModuleJNI/GetModule fails
    with -Xcheck:jni
    + S8204525: [TESTBUG] runtime/NMT/MallocStressTest.java ran out
    of java heap
    + S8204529: gc/TestAllocateHeapAtMultiple.java fail with Agent
    7 timed out
    + S8204551: Event descriptions are truncated in logs
    + S8206963: [AOT] bug with multiple class loaders
    + S8207367: 10 vmTestbase/nsk/jdi tests timed out when running
    with jtreg
    + S8207832: serviceability/sa/ClhsdbCDSCore.java failed with
    "Couldn't find core file location"
    + S8207938: At step6,Click Add button,case failed automatically.
    + S8208157: requires.VMProps throws NPE for missing properties
    in "release" file
    + S8208379: compiler/jvmci/events/
    /JvmciNotifyInstallEventTest.java failed with "Got unexpected
    event count after 2nd install attempt: expected 9 to equal 2"
    + S8208658: Make CDS archived heap regions usable even if
    compressed oop encoding has changed
    + S8208715: Conversion of milliseconds to nanoseconds in
    UNIXProcess contains bug
    + S8209361: [AOT] Unexpected number of references for
    JVMTI_HEAP_REFERENCE_CONSTANT_POOL [111--&gt;111]: 0 (expected
    at least 1)
    + S8209385: CDS runtime classpath checking is too strict when
    only classes from the system modules are archived
    + S8209389: SIGSEGV in WalkOopAndArchiveClosure::do_oop_work.
    + S8209418: Synchronize test/jdk/sanity/client/lib/jemmy with
    code-tools/jemmy/v2
    + S8209494: Create a test for SwingSet InternalFrameDemo
    + S8209499: Create test for SwingSet EditorPaneDemo
    + S8209574: [AOT] breakpoint events are generated in different
    threads does not meet expected count
    + S8209686: cleanup arguments to PhaseIdealLoop() constructor
    + S8209789: Synchronize test/jdk/sanity/client/lib/jemmy with
    code-tools/jemmy/v2
    + S8209802: Garbage collectors should register JFR types
    themselves to avoid build errors.
    + S8209807: improve handling exception in requires.VMProps
    + S8209817: stack is executable when building with Clang on
    Linux
    + S8209824: Improve the code coverage for ThreadLocal
    + S8209826: Undefined reference to os::write after JDK-8209657
    (filemap.hpp cleanup)
    + S8209850: Allow NamedThreads to use GlobalCounter critical
    sections
    + S8209976: Improve iteration over non-JavaThreads
    + S8209993: Create a test for SwingSet3 ToolTipDemo
    + S8210024: JFR calls virtual is_Java_thread from ~Thread()
    + S8210052: Enable testing for all the available look and feels
    in SwingSet3 demo tests
    + S8210055: Enable different look and feel tests in SwingSet3
    demo tests
    + S8210057: Enable different look and feels in SwingSet3 demo
    test InternalFrameDemoTest
    + S8210058: Algorithmic Italic font leans opposite angle in
    Printing
    + S8210220: [AOT] jdwp test cases are failing with error #
    ERROR: TEST FAILED: Cought IOException while receiving event
    packet
    + S8210289: ArchivedKlassSubGraphInfoRecord is incomplete
    + S8210459: Add support for generating compile_commands.json
    + S8210476: sun/security/mscapi/PrngSlow.java fails with Still
    too slow
    + S8210512: [Testbug] vmTestbase/nsk/jdi/ObjectReference/
    /referringObjects/referringObjects002/referringObjects002.java
    fails with unexpected size of
    ClassLoaderReference.referringObjects
    + S8210523: runtime/appcds/cacheObject/DifferentHeapSizes.java
    crash
    + S8210632: Add key exchange algorithm to
    javax/net/ssl/TLSCommon/CipherSuite.java
    + S8210699: Problem list tests which times out in Xcomp mode
    + S8210793: [JVMCI] AllocateCompileIdTest.java failed to find
    DiagnosticCommand.class
    + S8210910: Create test for FileChooserDemo
    + S8210994: Create test for SwingSet3 FrameDemo
    + S8211139: Increase timeout value in all tests under
    jdk/sanity/client/SwingSet/src
    + S8211160: Handle different look and feels in
    JInternalFrameOperator
    + S8211211: vmTestbase/metaspace/stressDictionary/
    /StressDictionary.java timeout
    + S8211322: Reduce the timeout of tooltip in SwingSet2DemoTest
    + S8211443: Enable different look and feels in SwingSet3 demo
    test SplitPaneDemoTest
    + S8211703: JInternalFrame : java.lang.AssertionError: cannot
    find the internal frame
    + S8211781: re-building fails after changing Graal sources
    + S8212897: Some improvements in the EditorPaneDemotest
    + S8212903: [TestBug] Tests test/jdk/javax/swing/LookAndFeel/
    /8145547/DemandGTK2.sh and DemandGTK3.sh fail on Ubuntu 18.04
    LTS
    + S8213009: Refactoring existing SunMSCAPI classes
    + S8213010: Supporting keys created with certmgr.exe
    + S8213168: Enable different look and feel tests in SwingSet3
    demo test FileChooserDemoTest
    + S8213348: jdk.internal.vm.compiler.management service
    providers missing in module descriptor
    + S8213906: Update arm devkits with libXrandr headers
    + S8213908: AssertionError in DeferredAttr at setOverloadKind
    + S8214124: [TESTBUG] Bugs in runtime/NMT/MallocStressTest.java
    + S8214344: C2: assert(con.basic_type() != T_ILLEGAL) failed:
    elembt=byte; loadbt=void; unsigned=0
    + S8214345: infinite recursion while checking super class
    + S8214471: Enable different look and feel tests in SwingSet3
    demo test ToolTipDemoTest
    + S8214534: Setting of THIS_FILE in the build is broken
    + S8214557: Filter out VM flags which don't affect AOT code
    generation
    + S8214578: [macos] Problem with backslashes on macOS/JIS
    keyboard: Java ignores system settings
    + S8214840: runtime/NMT/MallocStressTest.java timed out
    + S8214850: Rename vm_operations.?pp files to vmOperations.?pp
    files
    + S8214904: Test8004741.java failed due to "Too few ThreadDeath
    hits; expected at least 6 but saw only 5"
    + S8215322: add @file support to jaotc
    + S8215355: Object monitor deadlock with no threads holding the
    monitor (using jemalloc 5.1)
    + S8215396: JTabbedPane preferred size calculation is wrong for
    SCROLL_TAB_LAYOUT
    + S8216180: [AOT] compiler/intrinsics/bigInteger/TestMulAdd.java
    crashed with AOT enabled
    + S8216353: Use utility APIs introduced in org/netbeans/jemmy/
    /util/LookAndFeel class in client sanity test cases
    + S8216354: Syntax error in toolchain_windows.m4
    + S8216472: (se) Stack overflow during selection operation
    leads to crash (win)
    + S8216535: tools/jimage/JImageExtractTest.java timed out
    + S8217235: Create automated test for SwingSet
    ColorChooserDemoTest
    + S8217297: Add support for multiple look and feel for SwingSet
    SliderDemoTest
    + S8217338: [Containers] Improve systemd slice memory limit
    support
    + S8217613: [AOT] TEST_OPTS_AOT_MODULES doesn't work on mac
    + S8217634: RunTest documentation and usability update
    + S8217717: ZGC: Broken oop map in C1 load barrier stub
    + S8217728: Speed up incremental rerun of "make hotspot"
    + S8218268: Javac treats Manifest Class-Path entries as Paths
    instead of URLs
    + S8218662: Allow 204 responses with Content-Length:0
    + S8218882: NET_Writev is declared, NET_WriteV is defined
    + S8218889: Improperly use of the Optional API
    + S8219205: JFR file without license header
    + S8219597: (bf) Heap buffer state changes could provoke
    unexpected exceptions
    + S8219723: javax/net/ssl/compatibility/Compatibility.java
    failed on some SNI cases
    + S8220348: [ntintel] asserts about copying unaligned array
    + S8220451: jdi/EventQueue/remove/remove004 failed due to
    "ERROR: thread2 is not alive"
    + S8220456: jdi/EventQueue/remove_l/remove_l004 failed due to
    "TIMEOUT while waiting for event"
    + S8220479: java/nio/channels/Selector/SelectWithConsumer.java
    failed at testTwoChannels()
    + S8220613: java/util/Arrays/TimSortStackSize2.java times out
    with fastdebug build
    + S8220688: [TESTBUG] runtime/NMT/MallocStressTest.java timed
    out
    + S8220786: Create new switch to redirect error reporting
    output to stdout or stderr
    + S8221270: Duplicated synchronized keywords in SSLSocketImpl
    + S8221312: test/jdk/sanity/client/SwingSet/src/
    /ColorChooserDemoTest.java failed
    + S8221851: Use of THIS_FILE in hotspot invalidates precompiled
    header on Linux/GCC
    + S8221885: Add intermittent test in the JavaSound to the
    ProblemList
    + S8222264: Windows incremental build is broken with JDK-8217728
    + S8222391: javax/net/ssl/compatibility/Compatibility.java
    should be more flexible
    + S8222448: java/lang/reflect/PublicMethods/
    /PublicMethodsTest.java times out
    + S8222519: ButtonDemoScreenshotTest fails randomly with "still
    state to be reached"
    + S8222741: jdi/EventQueue/remove/remove004 fails due to
    VMDisconnectedException
    + S8223003: SunMSCAPI keys are not cleaned up
    + S8223063: Support CNG RSA keys
    + S8223158: Docked MacBook cannot start any Java Swing
    applications
    + S8223260: NamingManager should cache InitialContextFactory
    + S8223464: Improve version string for Oracle CI builds
    + S8223558: Java does not render Myanmar script correctly
    + S8223627: jdk-13+20 bundle name contains null instead of ea
    + S8223638: Replace wildcard address with loopback or local
    host in tests - part 6
    + S8223678: Add Visual Studio Code workspace generation support
    (for native code)
    + S8223727: com/sun/jndi/ldap/privconn/RunTest.java failed due
    to hang in LdapRequest.getReplyBer
    + S8223769: Assert triggers with -XX:+StressReflectiveCode
    + S8224187: Refactor arraycopy_prologue to allow ZGC read
    barriers on arraycopy
    + S8224475: JTextPane does not show images in HTML rendering
    + S8224673: Adjust permission for delayed starting of debugging
    + S8224705: Tests that need to be problem-listed or have
    printer resources
    + S8224778: test/jdk/demo/jfc/J2Ddemo/J2DdemoTest.java cannot
    find J2Ddemo.jar
    + S8224821: java/awt/Focus/NoAutotransferToDisabledCompTest/
    /NoAutotransferToDisabledCompTest.java fails linux-x64
    + S8224830: test/jdk/java/awt/Focus/
    /ModalExcludedWindowClickTest/
    /ModalExcludedWindowClickTest.java fails on linux-x64
    + S8224851: AArch64: fix warnings and errors with Clang and GCC
    8.3
    + S8224905: java/lang/ProcessBuilder/Basic.java#id1 failed with
    stream closed
    + S8225007: java/awt/print/PrinterJob/
    /LandscapeStackOverflow.java may hang
    + S8225105: java/awt/Focus/ShowFrameCheckForegroundTest/
    /ShowFrameCheckForegroundTest.java fails in Windows 10
    + S8225117: java/math/BigInteger/SymmetricRangeTests.java fails
    with ParseException
    + S8225128: Add exception for expiring DocuSign root to
    VerifyCACerts test
    + S8225130: Add exception for expiring Comodo roots to
    VerifyCACerts test
    + S8225144: [macos] In Aqua L&amp;F backspace key does not delete
    when Shift is pressed
    + S8225180: SignedObject with invalid Key not throwing the
    InvalidKeyException in Windows
    + S8225182: JNI exception pending in DestroyXIMCallback of
    awt_InputMethod.c:1327
    + S8225199: [Graal] compiler/jvmci/compilerToVM/
    /IsMatureVsReprofileTest.java fails with
  - XX:CompileThresholdScaling=0.1
    + S8225305: ProblemList java/lang/invoke/VarHandles tests
    + S8225350: compiler/jvmci/compilerToVM/IsCompilableTest.java
    timed out
    + S8225430: Replace wildcard address with loopback or local
    host in tests - part 14
    + S8225435: Upgrade IANA Language Subtag Registry to the latest
    for JDK14
    + S8225487: giflib legal file is missing attribution for
    openbsd-reallocarray.c
    + S8225567: Wrong file headers with 8202414 fix changeset
    + S8225684: [AOT] vmTestbase/vm/oom/production/
    /AlwaysOOMProduction tests fail with AOTed java.base
    + S8225766: Curve in certificate should not affect signature
    scheme when using TLSv1.3
    + S8225797: OldObjectSample event creates unexpected amount of
    checkpoint data
    + S8226381: ProblemList java/lang/reflect/PublicMethods/
    /PublicMethodsTest.java
    + S8226406: JVM fails to detect mismatched or corrupt CDS
    archive
    + S8226608: Hide the onjcmd option from the help output
    + S8226892: ActionListeners on JRadioButtons don't get notified
    when selection is changed with arrow keys
    + S8227112: exclude compiler/intrinsics/sha/sanity tests from
    AOT runs
    + S8227324: Upgrade to freetype 2.10.1
    + S8227528: TestAbortVMOnSafepointTimeout.java failed due to
    "RuntimeException: 'Safepoint sync time longer than' missing
    from stdout/stderr"
    + S8227645: Some tests in serviceability/sa run with fixed -Xmx
    values and risk running out of memory
    + S8227646: [TESTBUG] appcds/SharedArchiveConsistency timed out
    + S8227662: freetype seeks to index at the end of the font data
    + S8228479: Correct the format of ColorChooserDemoTest
    + S8228613: java.security.Provider#getServices order is no
    longer deterministic
    + S8228969: 2019-09-28 public suffix list update
    + S8229236: CriticalJNINatives: dll handling should be done in
    native thread state
    + S8229345: Memory leak due to vtable stubs not being shared on
    SPARC
    + S8229888: (zipfs) Updating an existing zip file does not
    preserve original permissions
    + S8229994: assert(false) failed: Bad graph detected in
    get_early_ctrl_for_expensive
    + S8230004: jdk/internal/jimage/JImageOpenTest.java runs no test
    + S8230235: Rendering HTML with empty img attribute and
    documentBaseKey cause Exception
    + S8230390: Problemlist SA tests with AOT
    + S8230400: Missing constant pool entry for a method in
    stacktrace
    + S8230459: Test failed to resume JVMCI CompilerThread
    + S8230480: check malloc/calloc results in java.desktop
    + S8230597: Update GIFlib library to the 5.2.1
    + S8230611: infinite loop in
    LogOutputList::wait_until_no_readers()
    + S8230624: [TESTBUG] Problemlist JFR
    compiler/TestCodeSweeper.java
    + S8230677: Should disable Escape Analysis if JVMTI capability
    can_get_owned_monitor_info was taken
    + S8230926: [macosx] Two apostrophes are entered instead of one
    with "U.S. International - PC" layout
    + S8231025: Incorrect method tag offset for big endian platform
    + S8231081: TestMetadataRetention fails due to missing symbol id
    + S8231387: java.security.Provider.getService returns random
    result due to race condition with mutating methods in the same
    class
    + S8231430: C2: Memory stomp in max_array_length() for
    T_ILLEGAL type
    + S8231445: check ZALLOC return values in awt coding
    + S8231507: Update Apache Santuario (XML Signature) to version
    2.1.4
    + S8231584: Deadlock with ClassLoader.findLibrary and
    System.loadLibrary call
    + S8231753: use more Posix functionality in aix
    os::print_os_info
    + S8231810: javax/net/ssl/templates/
    /SSLSocketSSLEngineTemplate.java fails intermittently with
    "java.lang.Exception: Unexpected EOF"
    + S8232003: (fs) Files.write can leak file descriptor in the
    exception case
    + S8232056: GetOwnedMonitorInfoWithEATest.java fails with ZGC:
    Heap too small
    + S8232060: add some initializations using sigemptyset in
    os_aix.cpp
    + S8232154: Update Mesa 3-D Headers to version 19.2.1
    + S8232167: Visual Studio install found through
  - -with-tools-dir value is discarded
    + S8232170: FSInfo#getJarClassPath throws an exception not
    declared in its throws clause
    + S8232200: [macos 10.15] Windows in fullscreen tests jumps
    around the screen
    + S8232207: Linux os::available_memory re-reads cgroup
    configuration on every invocation
    + S8232224: [TESTBUG] problemlist JFR TestLargeRootSet.java
    + S8232370: Refactor some com.sun.jdi tests to enable IDE
    integration
    + S8232433: [macos 10.15] java/awt/Window/
    /LocationAtScreenCorner/LocationAtScreenCorner.java may fail
    + S8232571: Add missing SIGINFO signal
    + S8232692: [TESTBUG] compiler/aot/fingerprint/
    /SelfChangedCDS.java fails when cds is disabled
    + S8232713: Update BCEL version to 6.3.1 in license file
    + S8232806: Introduce a system property to disable eager lambda
    initialization
    + S8232834: RunTest sometimes fails to produce valid
    exitcode.txt
    + S8232880: Update test documentation with additional settings
    for client UI tooltip tests
    + S8232950: SUNPKCS11 Provider incorrectly check key length for
    PSS Signatures.
    + S8233018: Add a new test to verify that DatagramSocket is not
    interruptible
    + S8233019: java.lang.Class.isPrimitive() (C1) returns wrong
    result if Klass* is aligned to 32bit
    + S8233032: assert(in_bb(n)) failed: must be
    + S8233078: fix minimal VM build on Linux ppc64(le)
    + S8233328: fix minimal VM build on Linux s390x
    + S8233383: Various minor fixes
    + S8233466: aarch64: remove unnecessary load of mdo when
    profiling return and parameters type
    + S8233491: Crash in AdapterHandlerLibrary::get_adapter with
    CDS due to code cache exhaustion
    + S8233529: loopTransform.cpp:2984: Error: assert(p_f-&gt;Opcode()
    == Op_IfFalse) failed
    + S8233548: Update CUP to v0.11b
    + S8233649: Update ProblemList.txt to exclude failing headful
    tests on macos
    + S8233656: assert(d-&gt;is_CFG() &amp;&amp; n-&gt;is_CFG()) failed: must
    have CFG nodes
    + S8233657: Intermittent NPE in Component.validate()
    + S8234288: Turkey Time Zone returns incorrect time zone name
    + S8234323: NULL-check return value of SurfaceData_InitOps on
    macosx
    + S8234339: replace JLI_StrTok in java_md_solinux.c
    + S8234340: Bump update version for OpenJDK: jdk-11.0.7
    + S8234350: assert(mode == ControlAroundStripMined &amp;&amp; (use ==
    sfpt || !use-&gt;is_reachable_from_root())) failed: missed a node
    + S8234386: [macos] NPE was thrown at expanding Choice from
    maximized frame
    + S8234397: add OS uptime information to os::print_os_info
    output
    + S8234423: Modifying ArrayList.subList().subList() resets
    modCount of subList
    + S8234466: Class loading deadlock involving
    X509Factory#commitEvent()
    + S8234501: remove obsolete NET_ReadV
    + S8234525: enable link-time section-gc for linux s390x to
    remove unused code
    + S8234610: MaxVectorSize set wrongly when UseAVX=3 is
    specified after JDK-8221092
    + S8234617: C1: Incorrect result of field load due to missing
    narrowing conversion
    + S8234723: javax/net/ssl/TLS tests support TLSv1.3
    + S8234724: javax/net/ssl/templates/
    /SSLSocketSSLEngineTemplate.java supports TLSv1.3
    + S8234741: enhance os::get_core_path on macOS
    + S8234769: Duplicate attribution in freetype.md
    + S8234786: Fix for JDK-8214578 breaks OS X 10.12 compatibility
    + S8234809: set relro in linker flags when building with gcc
    + S8234824: java/nio/channels/SocketChannel/AdaptSocket.java
    fails on Windows 10
    + S8235243: handle VS2017 15.9 and VS2019 in abstract_vm_version
    + S8235288: AVX 512 instructions inadvertently used on Xeon for
    small vector width operations
    + S8235325: build failure on Linux after 8235243
    + S8235383: C1 compilation fails with
  - XX:+PrintIRDuringConstruction -XX:+Verbose
    + S8235489: handle return values of sscanf calls in hotspot
    + S8235509: Backport for JDK-8209657 Refactor filemap.hpp to
    simplify integration with Serviceability Agent.
    + S8235510: java.util.zip.CRC32 performance drop after 8200067
    + S8235563: [TESTBUG] appcds/CommandLineFlagComboNegative.java
    does not handle archive mapping failure
    + S8235637: jhsdb jmap from OpenJDK 11.0.5 doesn't work if
    prelink is enabled
    + S8235671: enhance print_rlimit_info in os_posix
    + S8235744: PIT: test/jdk/javax/swing/text/html/
    /TestJLabelWithHTMLText.java times out in linux-x64
    + S8235904: Infinite loop when rendering huge lines
    + S8235998: [c2] Memory leaks during tracing after '8224193:
    stringStream should not use Resource Area'.
    + S8236039: JSSE Client does not accept status_request
    extension in CertificateRequest messages for TLS 1.3
    + S8236140: assert(!VerifyHashTableKeys || _hash_lock == 0)
    failed: remove node from hash table before modifying it
    + S8236179: C1 register allocation error with T_ADDRESS
    + S8236488: Support for configure option
  - -with-native-debug-symbols=internal is impossible on Windows
    + S8236500: Windows ucrt.dll should be looked up in versioned
    WINSDK subdirectory
    + S8236709: struct SwitchRange in HS violates C++ One
    Definition Rule
    + S8236848: [JDK 11u] make run-test-tier1 fails after backport
    of JDK-8232834
    + S8236873: Worker has a deadlock bug
    + S8237217: Incorrect G1StringDedupEntry type used in
    StringDedupTable destructor
    + S8237368: Problem with NullPointerException in RMI
    TCPEndpoint.read
    + S8237375: SimpleThresholdPolicy misses CounterDecay timestamp
    initialization
    + S8237508: Simplify JarFile.isInitializing
    + S8237540: Missing files in backport of JDK-8210910
    + S8237541: Missing files in backport of JDK-8236528
    + S8237600: Test SunJSSEFIPSInit fails on Ubuntu
    + S8237819: s390x - remove unused pd_zero_to_words_large
    + S8237869: exclude jtreg test security/infra/java/security/
    /cert/CertPathValidator/certification/LuxTrustCA.java because
    of instabilities
    + S8237879: make 4.3 breaks build
    + S8237945: CTW: C2 compilation fails with
    assert(just_allocated_object(alloc_ctl) == ptr) failed: most
    recent allo...
    + S8238225: Issues reported after replacing symlink at
    Contents/MacOS/libjli.dylib with binary
    + S8238247: CTW runner should sweep nmethods more aggressively
    + S8238366: CTW runner closes standard output on exit
    + S8238438: SuperWord::co_locate_pack picks memory state of
    first instead of last load
    + S8238502: sunmscapi.dll causing EXCEPTION_ACCESS_VIOLATION
    + S8238534: Deep sign macOS bundles before bundle archive is
    being created
    + S8238591: CTW: Split
    applications/ctw/modules/jdk_localedata.java
    + S8238596: AVX enabled by default for Skylake even when
    unsupported
    + S8238811: C2: assert(i &gt;= req() || i == 0 || is_Region() ||
    is_Phi()) with -XX:+VerifyGraphEdges
    + S8239005: [TESTBUG] test/hotspot/jtreg/runtime/
    /StackGuardPages/TestStackGuardPages.java: exeinvoke.c: must
    initialize static state before calling do_overflow()
    + S8239466: Loss of precision in counter decay calculation in
    11u backport of JDK-8237375
    + S8239856: [ntintel] asserts about copying unaligned array
    element
    + S8240724: [test] jdk11 downport of 8224475 misses binary file
    test/jdk/javax/swing/JTextPane/arrow.png
    + S8241296: Segfault in JNIHandleBlock::oops_do()
- Removed patch:
  * DependOnVariableHelper.patch
    + fixed upstream
- Added patch:
  * JDK-8228407.patch
    + fix crashes due to shared archive file mismatch</changelog>
  <changelog author="fstrba@suse.com" date="1594900800">- Update to upstream tag jdk-11.0.8+10 (July 2020 CPU, bsc#1174157)
  * Security fixes:
    + JDK-8230613: Better ASCII conversions
    + JDK-8231800: Better listing of arrays
    + JDK-8232014: Expand DTD support
    + JDK-8233234: Better Zip Naming
    + JDK-8233239, CVE-2020-14562: Enhance TIFF support
    + JDK-8233255: Better Swing Buttons
    + JDK-8234032: Improve basic calendar services
    + JDK-8234042: Better factory production of certificates
    + JDK-8234418: Better parsing with CertificateFactory
    + JDK-8234836: Improve serialization handling
    + JDK-8236191: Enhance OID processing
    + JDK-8236867, CVE-2020-14573: Enhance Graal interface handling
    + JDK-8237117, CVE-2020-14556: Better ForkJoinPool behavior
    + JDK-8237592, CVE-2020-14577: Enhance certificate verification
    + JDK-8238002, CVE-2020-14581: Better matrix operations
    + JDK-8238013: Enhance String writing
    + JDK-8238804: Enhance key handling process
    + JDK-8238842: AIOOBE in GIFImageReader.initializeStringTable
    + JDK-8238843: Enhanced font handing
    + JDK-8238920, CVE-2020-14583: Better Buffer support
    + JDK-8238925: Enhance WAV file playback
    + JDK-8240119, CVE-2020-14593: Less Affine Transformations
    + JDK-8240482: Improved WAV file playback
    + JDK-8241379: Update JCEKS support
    + JDK-8241522: Manifest improved jar headers redux
    + JDK-8242136, CVE-2020-14621: Better XML namespace handling
  * Other changes:
    + JDK-6933331: (d3d/ogl) java.lang.IllegalStateException:
    Buffers have not been created
    + JDK-7124307: JSpinner and changing value by mouse
    + JDK-8022574: remove HaltNode code after uncommon trap calls
    + JDK-8039082: [TEST_BUG] Test
    java/awt/dnd/BadSerializationTest/BadSerializationTest.java
    fails
    + JDK-8040630: Popup menus and tooltips flicker with previous
    popup contents when first shown
    + JDK-8044365: (dc) MulticastSendReceiveTests.java failing with
    ENOMEM when joining group (OS X 10.9)
    + JDK-8048215: [TESTBUG]
    java/lang/management/ManagementFactory/ThreadMXBeanProxy.java
    Expected non-null LockInfo
    + JDK-8051349: nsk/jvmti/scenarios/sampling/SP06/sp06t003 fails
    in nightly
    + JDK-8080353: JShell: Better error message on attempting to
    add default method
    + JDK-8139876: Exclude hanging nsk/stress/stack from execution
    with deoptimization enabled
    + JDK-8146090: java/lang/ref/ReachabilityFenceTest.java fails
    with -XX:+DeoptimizeALot
    + JDK-8153430: jdk regression test MletParserLocaleTest,
    ParserInfiniteLoopTest reduce default timeout
    + JDK-8156207: Resource allocated BitMaps are often cleared
    unnecessarily
    + JDK-8159740: JShell: corralled declarations do not have
    correct source to wrapper mapping
    + JDK-8175984: ICC_Profile has un-needed, not-empty finalize
    method
    + JDK-8176359: Frame#setMaximizedbounds not working properly in
    multi screen environments
    + JDK-8183369: RFC unconformity of HttpURLConnection with proxy
    + JDK-8187078: -XX:+VerifyOops finds numerous problems when
    running JPRT
    + JDK-8189861: Refactor CacheFind
    + JDK-8191169: java/net/Authenticator/B4769350.java failed
    intermittently
    + JDK-8191930: [Graal] emits unparseable XML into compile log
    + JDK-8193879: Java debugger hangs on method invocation
    + JDK-8196019: java/awt/Window/Grab/GrabTest.java fails on
    Windows
    + JDK-8196181: sun/java2d/GdiRendering/InsetClipping.java fails
    + JDK-8198000:
    java/awt/List/EmptyListEventTest/EmptyListEventTest.java
    debug assert on Windows
    + JDK-8198001: java/awt/Menu/WrongParentAfterRemoveMenu/
    /WrongParentAfterRemoveMenu.java debug assert on Windows
    + JDK-8198339: Test javax/swing/border/Test6981576.java is
    unstable
    + JDK-8200701: jdk/jshell/ExceptionsTest.java fails on Windows,
    after JDK-8198801
    + JDK-8203264: JNI exception pending in
    PlainDatagramSocketImpl.c:740
    + JDK-8203672: JNI exception pending in PlainSocketImpl.c
    + JDK-8203673: JNI exception pending in
    DualStackPlainDatagramSocketImpl.c:398
    + JDK-8204834: Fix confusing "allocate" naming in OopStorage
    + JDK-8205399: Set node color on pinned HashMap.TreeNode
    deletion
    + JDK-8205653: test/jdk/sun/management/jmxremote/bootstrap/
    /RmiRegistrySslTest.java and RmiSslBootstrapTest.sh fail with
    handshake_failure
    + JDK-8206179: com/sun/management/OperatingSystemMXBean/
    /GetCommittedVirtualMemorySize.java fails with Committed
    virtual memory size illegal value
    + JDK-8207334: VM times out in VM_HandshakeAllThreads::doit()
    with RunThese30M
    + JDK-8208277: Code cache heap (-XX:ReservedCodeCacheSize)
    doesn't work with 1GB LargePages
    + JDK-8209113: Use WeakReference for lastFontStrike for created
    Fonts
    + JDK-8209333: Socket reset issue for TLS 1.3 socket close
    + JDK-8209439: C2 library_call can potentially ignore Math.pow
    intrinsic or use null pointer
    + JDK-8209534: [TESTBUG]runtime/appcds/cacheObject/
    /ArchivedModuleCompareTest.java fails with EnableJVMCI.
    + JDK-8210147: adjust some WSAGetLastError usages in windows
    network coding
    + JDK-8210284: "assert((av &amp; 0x00000001) == 0) failed:
    unsupported V8" on Solaris 11.4
    + JDK-8210303: VM_HandshakeAllThreads fails assert with
    "failed: blocked and not walkable"
    + JDK-8210459: Add support for generating compile_commands.json
    + JDK-8210515: [TESTBUG]CheckArchivedModuleApp.java needs to
    check if EnableJVMCI is set.
    + JDK-8210788: Javadoc for Thread.join(long, int) should
    specify that it waits forever when both arguments are zero
    + JDK-8211301: [macos] support full window content options
    + JDK-8211332: Space for stub routines (code_size2) is too
    small on new Skylake CPUs
    + JDK-8211339: NPE during SSL handshake caused by
    HostnameChecker
    + JDK-8211392: compiler/profiling/
    /spectrapredefineclass_classloaders/Launcher.java times out
    in JDK12 CI
    + JDK-8211743: [AOT] crash in ScopeDesc::decode_body() when
    JVMTI walks AOT frames
    + JDK-8212154: [TESTBUG] CheckArchivedModuleApp fails with NPE
    when JVMCI is absent
    + JDK-8212167: JShell : Stack trace of exception has wrong line
    number
    + JDK-8212933: Thread-SMR: requesting a VM operation whilst
    holding a ThreadsListHandle can cause deadlocks
    + JDK-8212986: Make Visual Studio compiler check less strict
    + JDK-8213250: CDS archive creation aborts due to metaspace
    object allocation failure
    + JDK-8213516: jck test api/javax_accessibility/AccessibleState/
    /fields.html fails intermittent
    + JDK-8213947: ARM32: failed check_simd should set
    UsePopCountInstruction to false
    + JDK-8214418: half-closed SSLEngine status may cause
    application dead loop
    + JDK-8214440: ldap over a TLS connection negotiate failed with
    "javax.net.ssl.SSLPeerUnverifiedException: hostname of the
    server does not match the hostname in the server's
    certificate"
    + JDK-8214444: Wrong strncat limits in dfa.cpp
    + JDK-8214481: freetype path does not disable TrueType hinting
    with AA+FM hints
    + JDK-8214571: -Xdoclint of array serialField gives "error:
    array type not allowed here"
    + JDK-8214856: Errors with JSZip in web console after upgrade
    to 3.1.5
    + JDK-8214862: assert(proj != __null) at compile.cpp:3251
    + JDK-8215369: Jcstress pollute /var/tmp with temporary files.
    + JDK-8215551: Missing case label in nmethod::reloc_string_for()
    + JDK-8215555: TieredCompilation C2 threads can excessively
    block handshakes
    + JDK-8215711: Missing key_share extension for (EC)DHE key
    exchange should alert missing_extension
    + JDK-8216151: [Graal] Module
    jdk.internal.vm.compiler.management has not been granted
    accessClassInPackage.org.graalvm.compiler.debug
    + JDK-8216154: C4819 warnings at HotSpot sources on Windows
    + JDK-8216541: CompiledICHolders of VM locked unloaded nmethods
    are released too late
    + JDK-8217230: assert(t == t_no_spec) failure in
    NodeHash::check_no_speculative_types()
    + JDK-8217404: --with-jvm-features doesn't work when multiple
    features are explicitly disabled
    + JDK-8217447: Develop flag TraceICs is broken
    + JDK-8217606: LdapContext#reconnect always opens a new
    connection
    + JDK-8218807: Compilation database (compile_commands.json) may
    contain obsolete items
    + JDK-8219214: Infinite Loop in CodeSection::dump()
    + JDK-8219904: ClassCastException when calling
    FlightRecorderMXBean#getRecordings()
    + JDK-8219991: New fix of the deadlock in
    sun.security.ssl.SSLSocketImpl
    + JDK-8221121: applications/microbenchmarks are encountering
    crashes in tier5
    + JDK-8221445: FastSysexMessage constructor crashes MIDI
    receiption thread
    + JDK-8221482: Initialize VMRegImpl::regName[] earlier to
    prevent assert during PrintStubCode
    + JDK-8221741: ClassCastException can happen when
    fontconfig.properties is used
    + JDK-8221823: Requested JDialog width is ignored
    + JDK-8223108: Test java/awt/EventQueue/
    /NonComponentSourcePost.java is unstable
    + JDK-8223678: Add Visual Studio Code workspace generation
    support (for native code)
    + JDK-8223935: PIT: java/awt/font/WindowsIndicFonts.java fails
    on windows10
    + JDK-8224109: Text spaced incorrectly by drawString under
    rotation with fractional metric
    + JDK-8224632: testbug: java/awt/dnd/RemoveDropTargetCrashTest/
    /RemoveDropTargetCrashTest.java fails on MacOS
    + JDK-8224793: os::die() does not honor CreateCoredumpOnCrash
    option
    + JDK-8224847: gc/stress/TestReclaimStringsLeaksMemory.java
    fails with reserved greater than expected
    + JDK-8224931: disable JAOTC invokedynamic support until
    8223533 is fixed
    + JDK-8224997: ChaCha20-Poly1305 TLS cipher suite decryption
    throws ShortBufferException
    + JDK-8225068: Remove DocuSign root certificate that is
    expiring in May 2020
    + JDK-8225069: Remove Comodo root certificate that is expiring
    in May 2020
    + JDK-8225126: Test SetBoundsPaintTest.html faild on Windows
    when desktop is scaled
    + JDK-8225325: Add tests for redefining a class' private method
    during resolution of the bootstrap specifier
    + JDK-8225622: [AOT] runtime/SharedArchiveFile/
    /TestInterpreterMethodEntries.java crashed with AOTed
    java.base
    + JDK-8225653: Provide more information when hitting SIGILL
    from HaltNode
    + JDK-8225783: Incorrect use of binary operators on booleans in
    type.cpp
    + JDK-8225789: Empty method parameter type should generate
    ClassFormatError
    + JDK-8226198: use of &amp; instead of &amp;&amp; in
    LibraryCallKit::arraycopy_restore_alloc_state
    + JDK-8226253: JAWS reports wrong number of radio buttons when
    buttons are hidden.
    + JDK-8226653: [accessibility] Can edit text cell correctly,
    but Accessibility Tool reads nothing about editor
    + JDK-8226806: [macOS 10.14] Methods of Java Robot should be
    called from appropriate thread
    + JDK-8226879: Memory leak in Type::hashcons
    + JDK-8227632: Incorrect PrintCompilation message: made not
    compilable on levels 0 1 2 3 4
    + JDK-8228407: JVM crashes with shared archive file mismatch
    + JDK-8228482: fix xlc16/xlclang comparison of distinct pointer
    types and string literal conversion warnings
    + JDK-8228757: Fail fast if the handshake type is unknown
    + JDK-8229158: make UseSwitchProfiling non-experimental or
    false by-default
    + JDK-8229421: The logic of java/net/ipv6tests/TcpTest.java is
    flawed
    + JDK-8229855: C2 fails with assert(false) failed: bad AD file
    + JDK-8230591: AArch64: Missing intrinsics for Math.ceil,
    floor, rint
    + JDK-8231118: ARM32: Math tests failures
    + JDK-8231213: Migrate SimpleDateFormatConstTest to JDK Repo
    + JDK-8231243: [TESTBUG] CustomFont.java cannot find font file
    + JDK-8231438: [macOS] Dark mode for the desktop is not
    supported
    + JDK-8231550: C2: ShouldNotReachHere() in
    verify_strip_mined_scheduling
    + JDK-8231564: setMaximizedBounds is broken with large display
    scale and multiple monitors
    + JDK-8231572: Use -lobjc instead of -fobjc-link-runtime in
    libosxsecurity
    + JDK-8231631: sun/net/ftp/FtpURLConnectionLeak.java fails
    intermittently with NPE
    + JDK-8231671: Fix copyright headers in hotspot (missing comma
    after year)
    + JDK-8231720: Some perf regressions after 8225653
    + JDK-8231779: crash
    HeapWord*ParallelScavengeHeap::failed_mem_allocate
    + JDK-8231863: Crash if classpath is read from @argument file
    and the main gets option argument
    + JDK-8232080: jlink plugins for vendor information and
    run-time options
    + JDK-8232106: [x86] C2: SIGILL due to usage of SSSE3
    instructions on processors which don't support it
    + JDK-8232134: Change to Visual Studio 2017 15.9.16 for
    building on Windows at Oracle
    + JDK-8232226: [macos 10.15] test/jdk/java/awt/color/
    /EqualityTest/EqualityTest.java may fail
    + JDK-8232357: Compare version info of Santuario to legal notice
    + JDK-8232572: Add hooks for custom output dir in Bundles.gmk
    + JDK-8232634: Problem List ICMColorDataTest.java
    + JDK-8232748: Build static versions of certain JDK libraries
    + JDK-8232846: ProcessHandle.Info command with non-English
    shows question marks
    + JDK-8232880: Update test documentation with additional
    settings for client UI tooltip tests
    + JDK-8233033: C2 produces wrong result while unswitching a
    loop due to lost control dependencies
    + JDK-8233137: runtime/ErrorHandling/VeryEarlyAssertTest.java
    fails after 8232080
    + JDK-8233197: Invert JvmtiExport::post_vm_initialized() and
    Jfr:on_vm_start() start-up order for correct option parsing
    + JDK-8233291: [TESTBUG] tools/jlink/plugins/
    /VendorInfoPluginsTest.java fails with debug or non-server VMs
    + JDK-8233364: Fix undefined behavior in
    Canonicalizer::do_ShiftOp
    + JDK-8233494: Avoid calling MallocTracker::record_malloc and
    record_free when NMT is off
    + JDK-8233573: Toolkit.getScreenInsets(GraphicsConfiguration)
    may throw ClassCastException
    + JDK-8233608: Minimal build broken after JDK-8233494
    + JDK-8233621: Mismatch in jsse.enableMFLNExtension property
    name
    + JDK-8233696: [TESTBUG]Some jtreg tests fail when CAPS_LOCK is
    ON
    + JDK-8233707: systemScale.cpp could not compile with VS2019
    + JDK-8233801: GCMEmptyIv.java test fails on Solaris 11.4
    + JDK-8233880: Support compilers with multi-digit major version
    numbers
    + JDK-8233920: MethodHandles::tryFinally generates illegal
    bytecode for long/double return type
    + JDK-8234137: The "AutoTestOnTop.java" test may run external
    applications
    + JDK-8234146: compiler/jsr292/
    /ContinuousCallSiteTargetChange.java times out on SPARC
    + JDK-8234184: [TESTBUG] java/awt/Mouse/EnterExitEvents/
    /ModalDialogEnterExitEventsTest.java fails in Windows
    + JDK-8234270: [REDO] JDK-8204128 NMT might report incorrect
    numbers for Compiler area
    + JDK-8234332: [TESTBUG] java/awt/Focus/DisposedWindow/
    /DisposeDialogNotActivateOwnerTest/
    /DisposeDialogNotActivateOwnerTest.java fails on linux-x64
    nightly
    + JDK-8234398: Replace ID2D1Factory::GetDesktopDpi with
    GetDeviceCaps
    + JDK-8234522: [macos] Crash with use of native file dialog
    + JDK-8234691: Potential double-free in ParallelSPCleanupTask
    constructor
    + JDK-8234696: tools/jlink/plugins/VendorInfoPluginsTest.java
    times out
    + JDK-8234727: sun/security/ssl/X509TrustManagerImpl tests
    support TLSv1.3
    + JDK-8234728: Some security tests should support TLSv1.3
    + JDK-8234779: Provide idiom for declaring classes noncopyable
    + JDK-8234824: java/nio/channels/SocketChannel/AdaptSocket.java
    fails on Windows 10
    + JDK-8234968: check calloc rv in libinstrument
    InvocationAdapter
    + JDK-8235153: [TESTBUG] [macos 10.15] java/awt/Graphics/
    /DrawImageBG/SystemBgColorTest.java fails
    + JDK-8235183: Remove the "HACK CODE" in comment
    + JDK-8235263: Revert TLS 1.3 change that wrapped IOExceptions
    + JDK-8235311: Tag mismatch may alert bad_record_mac
    + JDK-8235332: TestInstanceCloneAsLoadsStores.java fails with
  - XX:+StressGCM
    + JDK-8235452: Strip mined loop verification fails with
    assert(is_OuterStripMinedLoop()) failed: invalid node class
    + JDK-8235584: UseProfiledLoopPredicate fails with
    assert(_phase-&gt;get_loop(c) == loop) failed: have to be in the
    same loop
    + JDK-8235620: Broken merge between JDK-8006406 and JDK-8003559
    + JDK-8235638: NPE in LWWindowPeer.getOnscreenGraphics()
    + JDK-8235686: Add more custom hooks in Bundles.gmk
    + JDK-8235739: Rare NPE at WComponentPeer.getGraphics()
    + JDK-8235762: JVM crash in SWPointer during C2 compilation
    + JDK-8235834: IBM-943 charset encoder needs updating
    + JDK-8235874: The ordering of Cipher Suites is not maintained
    provided through jdk.tls.client.cipherSuites and
    jdk.tls.server.cipherSuites system property.
    + JDK-8235908: omit ThreadPriorityPolicy warning when value is
    set from image
    + JDK-8235984: C2: assert(out-&gt;in(PhiNode::Region) == head ||
    out-&gt;in(PhiNode::Region) == slow_head) failed: phi must be
    either part of the slow or the fast loop
    + JDK-8236211: [Graal] compiler/graalunit/GraphTest.java is
    skipped in all testing
    + JDK-8236470: Deal with ECDSA using ecdsa-with-SHA2 plus hash
    algorithm as AlgorithmId
    + JDK-8236545: Compilation error in mach5
    java/awt/FileDialog/MacOSGoToFolderCrash.java
    + JDK-8236700: Upgrading JSZip from v3.1.5 to v3.2.2
    + JDK-8236759: ShouldNotReachHere in
    PhaseIdealLoop::verify_strip_mined_scheduling
    + JDK-8236897: Fix the copyright header for pkcs11gcm2.h
    + JDK-8236921: Add build target to produce a JDK image suitable
    for a Graal/SVM build
    + JDK-8236953: [macos] JavaFX SwingNode is not rendered on macOS
    + JDK-8236996: Incorrect Roboto font rendering on Windows with
    subpixel antialiasing
    + JDK-8237045: JVM uses excessive memory with -XX:+EnableJVMCI
  - XX:JVMCICounterSize=2147483648
    + JDK-8237055: [TESTBUG] compiler/c2/TestJumpTable.java fails
    with release VMs
    + JDK-8237086: assert(is_MachReturn()) running CTW with fix for
    JDK-8231291
    + JDK-8237192: Generate stripped/public pdbs on Windows for jdk
    images
    + JDK-8237396: JvmtiTagMap::weak_oops_do() should not trigger
    barriers
    + JDK-8237474: Default SSLEngine should create in server role
    + JDK-8237859: C2: Crash when loads float above range check
    + JDK-8237879: make 4.3 breaks build
    + JDK-8237951: CTW: C2 compilation fails with "malformed
    control flow"
    + JDK-8237962: give better error output for invalid OCSP
    response intervals in CertPathValidator checks
    + JDK-8238190: [JVMCI] Fix single implementor speculation for
    diamond shapes.
    + JDK-8238356: CodeHeap::blob_count() overestimates the number
    of blobs
    + JDK-8238452: Keytool generates wrong expiration date if
    validity is set to 2050/01/01
    + JDK-8238555: Allow Initialization of SunPKCS11 with NSS when
    there are external FIPS modules in the NSSDB
    + JDK-8238575: DragSourceEvent.getLocation() returns wrong
    value on HiDPI screens (Windows)
    + JDK-8238676: jni crashes on accessing it from process exit
    hook
    + JDK-8238721: Add failing client jtreg tests to the Problem
    List
    + JDK-8238738: AudioSystem.getMixerInfo() takes about 30 sec to
    report a gone audio device
    + JDK-8238756: C2: assert(((n) == __null || !VerifyIterativeGVN
    || !((n)-&gt;is_dead()))) failed: can not use dead node
    + JDK-8238765: PhaseCFG::schedule_pinned_nodes cannot handle
    precedence edges from unmatched CFG nodes correctly
    + JDK-8238898: Missing hash characters for header on license
    file
    + JDK-8238942: Rendering artifacts with LCD text and fractional
    metrics
    + JDK-8238985: [TESTBUG] The arrow image is blue instead of
    green
    + JDK-8239000: handle ContendedPaddingWidth in vm_version_ppc
    + JDK-8239055: Wrong implementation of VMState.hasListener
    + JDK-8239091: Reversed arguments in call to strstr in freetype
    "debug" code.
    + JDK-8239142: C2's UseUniqueSubclasses optimization is broken
    for array accesses
    + JDK-8239224: libproc_impl.c previous_thr may be used
    uninitialized warning
    + JDK-8239351: Give more meaningful InternalError messages in
    Deflater.c
    + JDK-8239365: ProcessBuilder test modifications for AIX
    execution
    + JDK-8239456: vtable stub generation: assert failure (code
    size estimate)
    + JDK-8239457: call ReleaseStringUTFChars before early returns
    in Java_sun_security_pkcs11_wrapper_PKCS11_connect
    + JDK-8239462: jdk.hotspot.agent misses some
    ReleaseStringUTFChars calls in case of early returns
    + JDK-8239557: [TESTBUG] VeryEarlyAssertTest.java validating
    "END." marker at lastline is not always true
    + JDK-8239787: AArch64: String.indexOf may incorrectly handle
    empty strings
    + JDK-8239792: Bump update version for OpenJDK: jdk-11.0.8
    + JDK-8239798: SSLSocket closes socket both socket endpoints on
    a SocketTimeoutException
    + JDK-8239819: XToolkit: Misread of screen information memory
    + JDK-8239852: java/util/concurrent tests fail with
  - XX:+VerifyGraphEdges: assert(!VerifyGraphEdges) failed:
    verification should have failed
    + JDK-8239893: Windows handle Leak when starting processes
    using ProcessBuilder
    + JDK-8239915: Zero VM crashes when handling dynamic constant
    + JDK-8239931: [win][x86] vtable stub generation: assert
    failure (code size estimate) follow-up
    + JDK-8239965: XMLEncoder/Test4625418.java fails due to "Error:
    Cp943 - can't read properly"
    + JDK-8239976: Put JDK-8239965 on the ProblemList.txt
    + JDK-8240073: Fix 'test-make' build target in 11u
    + JDK-8240197: Cannot start JVM when $JAVA_HOME includes CJK
    characters
    + JDK-8240202: A few client tests leave mouse buttons pressed
    + JDK-8240220: IdealLoopTree::dump_head predicate printing is
    broken
    + JDK-8240223: Use consistent predicate order in and with
    PhaseIdealLoop::find_predicate
    + JDK-8240227: Loop predicates should be copied to unswitched
    loops
    + JDK-8240286: [TESTBUG] Test command error in hotspot/jtreg/
    /compiler/loopopts/superword/SumRedAbsNeg_Float.java
    + JDK-8240518: Incorrect JNU_ReleaseStringPlatformChars in
    Windows Print
    + JDK-8240529: CheckUnhandledOops breaks NULL check in
    Modules::define_module
    + JDK-8240576: JVM crashes after transformation in C2
    IdealLoopTree::merge_many_backedges
    + JDK-8240603: Windows 32bit compile error after 8238676
    + JDK-8240629: argfiles parsing broken for argfiles with
    comment cross 4096 bytes chunk
    + JDK-8240711: TestJstatdPort.java failed due to
    "ExportException: Port already in use:"
    + JDK-8240786: [TESTBUG] The test java/awt/Window/
    /GetScreenLocation/GetScreenLocationTest.java fails on HiDPI
    screen
    + JDK-8240824: enhance print_full_memory_info on Linux by THP
    related information
    + JDK-8240827: Downport SSLSocketImpl.java from "8221882: Use
    fiber-friendly java.util.concurrent.locks in JSSE"
    + JDK-8240905: assert(mem == (Node*)1 || mem == mem2) failed:
    multiple Memories being matched at once?
    + JDK-8240972: macOS codesign fail on macOS 10.13.5 or older
    + JDK-8241445: Fix copyright in
    test/jdk/tools/launcher/ArgFileSyntax.java
    + JDK-8241458: [JVMCI] add mark value to expose
    CodeOffsets::Frame_Complete
    + JDK-8241464: [11u] Backport: make rehashing be a needed
    guaranteed safepoint cleanup action
    + JDK-8241556: Memory leak if -XX:CompileCommand is set
    + JDK-8241568: (fs) UserPrincipalLookupService.lookupXXX
    failure with IOE "Operation not permitted"
    + JDK-8241586: compiler/cpuflags/
    /TestAESIntrinsicsOnUnsupportedConfig.java fails on aarch64
    + JDK-8241638: launcher time metrics always report 1 on Linux
    when _JAVA_LAUNCHER_DEBUG set
    + JDK-8241660: Add virtualization information output to hs_err
    file on macOS
    + JDK-8241808: [TESTBUG] The JDK-8039467 bug appeared on macOS
    + JDK-8241888: Mirror jdk.security.allowNonCaAnchor system
    property with a security one
    + JDK-8241900: Loop unswitching may cause dependence on null
    check to be lost
    + JDK-8241948: enhance list of environment variables printed in
    hs_err file
    + JDK-8241996: on linux set full relro in the linker flags
    + JDK-8242108: Performance regression after fix for JDK-8229496
    + JDK-8242141: New System Properties to configure the TLS
    signature schemes
    + JDK-8242154: Backport parts of JDK-4947890 to OpenJDK 11u
    + JDK-8242174: [macos] The NestedModelessDialogTest test make
    the macOS unstable
    + JDK-8242239: [Graal] javax/management/generified/
    /GenericTest.java fails: FAILED: queryMBeans sets same
    + JDK-8242294: JSSE Client does not throw SSLException when an
    alert occurs during handshaking
    + JDK-8242379: [TESTBUG] compiler/loopopts/
    /TestLoopUnswitchingLostCastDependency.java fails with
    release VMs
    + JDK-8242470: Update Xerces to Version 2.12.1
    + JDK-8242498: Invalid "sun.awt.TimedWindowEvent" object leads
    to JVM crash
    + JDK-8242541: Small charset issues (ISO8859-16, x-eucJP-Open,
    x-IBM834 and x-IBM949C)
    + JDK-8242626: enhance posix print_rlimit_info
    + JDK-8243059: Build fails when --with-vendor-name contains a
    comma
    + JDK-8243539: Copyright info (Year) should be updated for fix
    of 8241638
    + JDK-8243541: (tz) Upgrade time-zone data to tzdata2020a
    + JDK-8244407: JVM crashes after transformation in C2
    IdealLoopTree::split_fall_in
    + JDK-8244520: problemlist
    java/awt/font/Rotate/RotatedFontTest.java on linux
    + JDK-8244777: ClassLoaderStats VM Op uses constant hash value
    + JDK-8244853: The static build of libextnet is missing the
    JNI_OnLoad_extnet function
    + JDK-8244951: Missing entitlements for hardened runtime
    + JDK-8245047: [PPC64] C2: ReverseBytes + Load always match to
    unordered Load (acquire semantics missing)
    + JDK-8245649: Revert 8245397 backport of 8230591
    + JDK-8246031: SSLSocket.getSession() doesn't close connection
    for timeout/ interrupts
    + JDK-8246613: Choose the default SecureRandom algo based on
    registration ordering
    + JDK-8248505: Unexpected NoSuchAlgorithmException when using
    secure random impl from BCFIPS provider
- Removed patch:
  * JDK-8228407.patch
    + integrated upstream</changelog>
  <changelog author="fstrba@suse.com" date="1604318400">- Update to upstream tag jdk-11.0.9-11 (October 2020 CPU,
  bsc#1177943)
  * New features
    + JDK-8250784: Shenandoah: A Low-Pause-Time Garbage Collector
  * Security fixes
    + JDK-8233624: Enhance JNI linkage
    + JDK-8236196: Improve string pooling
    + JDK-8236862, CVE-2020-14779: Enhance support of Proxy class
    + JDK-8237990, CVE-2020-14781: Enhanced LDAP contexts
    + JDK-8237995, CVE-2020-14782: Enhance certificate processing
    + JDK-8240124: Better VM Interning
    + JDK-8241114, CVE-2020-14792: Better range handling
    + JDK-8242680, CVE-2020-14796: Improved URI Support
    + JDK-8242685, CVE-2020-14797: Better Path Validation
    + JDK-8242695, CVE-2020-14798: Enhanced buffer support
    + JDK-8243302: Advanced class supports
    + JDK-8244136, CVE-2020-14803: Improved Buffer supports
    + JDK-8244479: Further constrain certificates
    + JDK-8244955: Additional Fix for JDK-8240124
    + JDK-8245407: Enhance zoning of times
    + JDK-8245412: Better class definitions
    + JDK-8245417: Improve certificate chain handling
    + JDK-8248574: Improve jpeg processing
    + JDK-8249927: Specify limits of jdk.serialProxyInterfaceLimit
    + JDK-8253019: Enhanced JPEG decoding
  * Other changes
    + JDK-6532025: GIF reader throws misleading exception with
    truncated images
    + JDK-6949753: [TEST BUG]: java/awt/print/PageFormat/
    /PDialogTest.java needs update by removing an infinite loop
    + JDK-8022535: [TEST BUG] javax/swing/text/html/parser/
    /Test8017492.java fails
    + JDK-8062947: Fix exception message to correctly represent
    LDAP connection failure
    + JDK-8067354: com/sun/jdi/GetLocalVariables4Test.sh failed
    + JDK-8134599: TEST_BUG: java/rmi/transport/closeServerSocket/
    /CloseServerSocket.java fails intermittently with Address
    already in use
    + JDK-8151678: com/sun/jndi/ldap/LdapTimeoutTest.java failed
    due to timeout on DeadServerNoTimeoutTest is incorrect
    + JDK-8160768: Add capability to custom resolve host/domain
    names within the default JNDI LDAP provider
    + JDK-8172404: Tools should warn if weak algorithms are used
    before restricting them
    + JDK-8193367: Annotated type variable bounds crash javac
    + JDK-8202117: com/sun/jndi/ldap/RemoveNamingListenerTest.java
    fails intermittently: Connection reset
    + JDK-8203026: java.rmi.NoSuchObjectException: no such object
    in table
    + JDK-8203281: [Windows] JComboBox change in ui when
    editor.setBorder() is called
    + JDK-8203382: Rename SystemDictionary::initialize_wk_klass to
    resolve_wk_klass
    + JDK-8203393: com/sun/jdi/JdbMethodExitTest.sh and
    JdbExprTest.sh fail due to timeout
    + JDK-8203928: [Test] Convert non-JDB scaffolding
    serviceability shell script tests to java
    + JDK-8204963: javax.swing.border.TitledBorder has a memory leak
    + JDK-8204994: SA might fail to attach to process with "Windbg
    Error: WaitForEvent failed"
    + JDK-8205534: Remove SymbolTable dependency from
    serviceability agent
    + JDK-8206309: Tier1 SA tests fail
    + JDK-8208281: java/nio/channels/
    /AsynchronousSocketChannel/Basic.java timed out
    + JDK-8209109: [TEST] rewrite com/sun/jdi shell tests to java
    version - step1
    + JDK-8209332: [TEST] test/jdk/com/sun/jdi/CatchPatternTest.sh
    is incorrect
    + JDK-8209342: Problemlist SA tests on Solaris due to Error
    attaching to process: Can't create thread_db agent!
    + JDK-8209343: Test javax/swing/border/TestTitledBorderLeak.java
    should be marked as headful
    + JDK-8209517: com/sun/jdi/BreakpointWithFullGC.java fails with
    timeout
    + JDK-8209604: [TEST] rewrite com/sun/jdi shell tests to java
    version - step2
    + JDK-8209605: com/sun/jdi/BreakpointWithFullGC.java fails with
    ZGC
    + JDK-8209608: Problem list com/sun/jdi/BreakpointWithFullGC.java
    + JDK-8210131: vmTestbase/nsk/jvmti/scenarios/allocation/AP10/
    /ap10t001/TestDescription.java failed with ObjectFree:
    GetCurrentThreadCpuTimerInfo returned unexpected error code
    + JDK-8210243: [TEST] rewrite com/sun/jdi shell tests to java
    version - step3
    + JDK-8210527: JShell: NullPointerException in
    jdk.jshell.Eval.translateExceptionStack
    + JDK-8210560: [TEST] convert com/sun/jdi redefineClass-related
    tests
    + JDK-8210725: com/sun/jdi/RedefineClearBreakpoint.java fails
    with waitForPrompt timed out after 60 seconds
    + JDK-8210748: [TESTBUG] lib.jdb.Jdb.waitForPrompt() should
    clarify which output is the pending reply after a timeout
    + JDK-8210760: [TEST] rewrite com/sun/jdi shell tests to java
    version - step4
    + JDK-8210977: jdk/jfr/event/oldobject/TestThreadLocalLeak.java
    fails to find ThreadLocalObject
    + JDK-8211292: [TEST] convert com/sun/jdi/DeferredStepTest.sh
    test
    + JDK-8211694: JShell: Redeclared variable should be reset
    + JDK-8212200: assert when shared java.lang.Object is redefined
    by JVMTI agent
    + JDK-8212629: [TEST] wrong breakpoint in
    test/jdk/com/sun/jdi/DeferredStepTest
    + JDK-8212665: com/sun/jdi/DeferredStepTest.java: jj1 (line 57)
  - unexpected. lastLine=52, minLine=52, maxLine=55
    + JDK-8212807: tools/jar/multiRelease/Basic.java times out
    + JDK-8213182: Minimal VM build failure after JDK-8212200
    (assert when shared java.lang.Object is redefined by JVMTI
    agent)
    + JDK-8213214: Set -Djava.io.tmpdir= when running tests
    + JDK-8213275: ReplaceCriticalClasses.java fails with
    jdk.internal.vm.PostVMInitHook not found
    + JDK-8213574: Deadlock in string table expansion when dumping
    lots of CDS classes
    + JDK-8213703: LambdaConversionException: Invalid receiver type
    not a subtype of implementation type interface
    + JDK-8214074: Ghash optimization using AVX instructions
    + JDK-8214491: Upgrade to JLine 3.9.0
    + JDK-8214797: TestJmapCoreMetaspace.java timed out
    + JDK-8215243: JShell tests failing intermitently with
    "Problem cleaning up the following threads:"
    + JDK-8215244: jdk/jshell/ToolBasicTest.java
    testHistoryReference failed
    + JDK-8215354: x86_32 build failures after JDK-8214074 (Ghash
    optimization using AVX instructions)
    + JDK-8215438: jshell tool: Ctrl-D causes EOF
    + JDK-8216021: RunTest.gmk might set concurrency level to 1 on
    Windows
    + JDK-8216974: HttpConnection not returned to the pool after
    204 response
    + JDK-8218948: SimpleDateFormat :: format - Zone Names are not
    reflected correctly during run time
    + JDK-8219712: code_size2 (defined in stub_routines_x86.hpp) is
    too small on new Skylake CPUs
    + JDK-8220150: macos10.14 Mojave returns anti-aliased glyphs
    instead of aliased B&amp;W glyphs
    + JDK-8221658: aarch64: add necessary predicate for ubfx
    patterns
    + JDK-8221759: Crash when completing "java.io.File.path"
    + JDK-8221918: runtime/SharedArchiveFile/serviceability/
    /ReplaceCriticalClasses.java fails: Shared archive not found
    + JDK-8222074: Enhance auto vectorization for x86
    + JDK-8222079: Don't use memset to initialize fields decode_env
    constructor in disassembler.cpp
    + JDK-8222769: [TESTBUG] TestJFRNetworkEvents should not rely
    on hostname command
    + JDK-8223688: JShell: crash on the instantiation of raw
    anonymous class
    + JDK-8223777: In posix_spawn mode, failing to exec()
    jspawnhelper does not result in an error
    + JDK-8223940: Private key not supported by chosen signature
    algorithm
    + JDK-8224184: jshell got IOException at exiting with AIX
    + JDK-8224234: compiler/codegen/TestCharVect2.java fails in
    test_mulc
    + JDK-8225037: java.net.JarURLConnection::getJarEntry() throws
    NullPointerException
    + JDK-8225625: AES Electronic Codebook (ECB) encryption and
    decryption optimization using AVX512 + VAES instructions
    + JDK-8226536: Catch OOM from deopt that fails rematerializing
    objects
    + JDK-8226575: OperatingSystemMXBean should be made container
    aware
    + JDK-8226697: Several tests which need the @key headful
    keyword are missing it.
    + JDK-8226809: Circular reference in printed stack trace is not
    correctly indented &amp; ambiguous
    + JDK-8227059: sun/security/tools/keytool/
    /DefaultSignatureAlgorithm.java timed out
    + JDK-8227269: Slow class loading when running with JDWP
    + JDK-8227595: keytool/fakegen/DefaultSignatureAlgorithm.java
    fails due to "exitValue = 6"
    + JDK-8228448: Jconsole can't connect to itself
    + JDK-8228967: Trust/Key store and SSL context utilities for
    tests
    + JDK-8229378: jdwp library loader in linker_md.c quietly
    truncates on buffer overflow
    + JDK-8229815: Upgrade Jline to 3.12.1
    + JDK-8230000: some httpclients testng tests run zero test
    + JDK-8230002: javax/xml/jaxp/unittest/transform/
    /SecureProcessingTest.java runs zero test
    + JDK-8230010: Remove jdk8037819/BasicTest1.java
    + JDK-8230094: CCE in createXMLEventWriter(Result) over an
    arbitrary XMLStreamWriter
    + JDK-8230402: Allocation of compile task fails with assert:
    "Leaking compilation tasks?"
    + JDK-8230767: FlightRecorderListener returns null recording
    + JDK-8230870: (zipfs) Add a ZIP FS test that is similar to
    test/jdk/java/util/zip/EntryCount64k.java
    + JDK-8231209: [REDO] ThreadMXBean::getThreadAllocatedBytes()
    can be quicker for self thread
    + JDK-8231586: enlarge encoding space for OopMapValue offsets
    + JDK-8231953: Wrong assumption in assertion in
    oop::register_oop
    + JDK-8231968: getCurrentThreadAllocatedBytes default
    implementation s/b getThreadAllocatedBytes
    + JDK-8232083: Minimal VM is broken after JDK-8231586
    + JDK-8232161: Align some one-way conversion in MS950 charset
    with Windows
    + JDK-8232855: jshell missing word in /help help
    + JDK-8233027: OopMapSet::all_do does oms.next() twice during
    iteration
    + JDK-8233228: Disable weak named curves by default in TLS,
    CertPath, and Signed JAR
    + JDK-8233386: Initialize NULL fields for unused decorations
    + JDK-8233452: java.math.BigDecimal.sqrt() with
    RoundingMode.FLOOR results in incorrect result
    + JDK-8233686: XML transformer uses excessive amount of memory
    + JDK-8233741: AES Countermode (AES-CTR) optimization using
    AVX512 + VAES instructions
    + JDK-8233829: javac cannot find non-ASCII module name under
    non-UTF8 environment
    + JDK-8233958: Memory retention due to HttpsURLConnection
    finalizer that serves no purpose
    + JDK-8234011: (zipfs) Memory leak in
    ZipFileSystem.releaseDeflater()
    + JDK-8234058: runtime/CompressedOops/
    /CompressedClassPointers.java fails with 'Narrow klass base:
    0x0000000000000000' missing from stdout/stderr
    + JDK-8234149: Several regression tests do not dispose Frame at
    end
    + JDK-8234347: "Turkey" meta time zone does not generate
    composed localized names
    + JDK-8234385: [TESTBUG] java/awt/EventQueue/6980209/
    /bug6980209.java fails in linux nightly
    + JDK-8234535: Cross compilation fails due to missing CFLAGS
    for the BUILD_CC
    + JDK-8234541: C1 emits an empty message when it inlines
    successfully
    + JDK-8234687: change javap reporting on unknown attributes
    + JDK-8236464: SO_LINGER option is ignored by SSLSocket in JDK
    11
    + JDK-8236548: Localized time zone name inconsistency between
    English and other locales
    + JDK-8236617: jtreg test containers/docker/
    /TestMemoryAwareness.java fails after 8226575
    + JDK-8237182: Update copyright header for shenandoah and
    epsilon files
    + JDK-8237888: security/infra/java/security/cert/
    /CertPathValidator/certification/LuxTrustCA.java fails when
    checking validity interval
    + JDK-8237977: Further update
    javax/net/ssl/compatibility/Compatibility.java
    + JDK-8238270: java.net HTTP/2 client does not decrease stream
    count when receives 204 response
    + JDK-8238284: [macos] Zero VM build fails due to an obvious
    typo
    + JDK-8238380: java.base/unix/native/libjava/childproc.c
    "multiple definition" link errors with GCC10
    + JDK-8238386: (sctp) jdk.sctp/unix/native/libsctp/SctpNet.c
    "multiple definition" link errors with GCC10
    + JDK-8238388: libj2gss/NativeFunc.o "multiple definition" link
    errors with GCC10
    + JDK-8238448: RSASSA-PSS signature verification fail when
    using certain odd key sizes
    + JDK-8238710: LingeredApp doesn't log stdout/stderr if exits
    with non-zero code
    + JDK-8239083: C1 assert(known_holder == NULL ||
    (known_holder-&gt;is_instance_klass() &amp;&amp;
    (!known_holder-&gt;is_interface() ||
    ((ciInstanceKlass*)known_holder)-&gt;has_nonstatic_concrete_methods())),
    "should be non-static concrete method");
    + JDK-8239385: KerberosTicket client name refers wrongly to
    sAMAccountName in AD
    + JDK-8240169: javadoc fails to link to non-modular api docs
    + JDK-8240295: hs_err elapsed time in seconds is not accurate
    enough
    + JDK-8240360: NativeLibraryEvent has wrong library name on
    Linux
    + JDK-8240676: Meet not symmetric failure when running lucene
    on jdk8
    + JDK-8241007: Shenandoah: remove
    ShenandoahCriticalControlThreadPriority support
    + JDK-8241065: Shenandoah: remove leftover code after
    JDK-8231086
    + JDK-8241086: Test runtime/NMT/HugeArenaTracking.java is
    failing on 32bit Windows
    + JDK-8241130: com.sun.jndi.ldap.EventSupport.removeDeadNotifier:
    java.lang.NullPointerException
    + JDK-8241138: http.nonProxyHosts=* causes
    StringIndexOutOfBoundsException in DefaultProxySelector
    + JDK-8241319: WB_GetCodeBlob doesn't have ResourceMark
    + JDK-8241478: vmTestbase/gc/gctests/Steal/steal001/steal001.java
    fails with OOME
    + JDK-8241574: Shenandoah: remove ShenandoahAssertToSpaceClosure
    + JDK-8241750: x86_32 build failure after JDK-8227269
    + JDK-8242184: CRL generation error with RSASSA-PSS
    + JDK-8242283: Can't start JVM when java home path includes
    non-ASCII character
    + JDK-8242556: Cannot load RSASSA-PSS public key with non-null
    params from byte array
    + JDK-8243029: Rewrite javax/net/ssl/compatibility/
    /Compatibility.java with a flexible interop test framework
    + JDK-8243138: Enhance BaseLdapServer to support starttls
    extended request
    + JDK-8243320: Add SSL root certificates to Oracle Root CA
    program
    + JDK-8243321: Add Entrust root CA - G4 to Oracle Root CA
    program
    + JDK-8243389: enhance os::pd_print_cpu_info on linux
    + JDK-8243453: java --describe-module failed with non-ASCII
    module name under non-UTF8 environment
    + JDK-8243470: [macos] bring back O2 opt level for unsafe.cpp
    + JDK-8243489: Thread CPU Load event may contain wrong data for
    CPU time under certain conditions
    + JDK-8243925: Toolkit#getScreenInsets() returns wrong value on
    HiDPI screens (Windows)
    + JDK-8244087: 2020-04-24 public suffix list update
    + JDK-8244151: Update MUSCLE PC/SC-Lite headers to the latest
    release 1.8.26
    + JDK-8244164: AArch64: jaotc generates incorrect code for
    compressed OOPs with non-zero heap base
    + JDK-8244196: adjust output in os_linux
    + JDK-8244225: stringop-overflow warning on strncpy call from
    compile_the_world_in
    + JDK-8244287: JFR: Methods samples have line number 0
    + JDK-8244703: "platform encoding not initialized" exceptions
    with debugger, JNI
    + JDK-8244719: CTW: C2 compilation fails with
    "assert(!VerifyHashTableKeys || _hash_lock == 0) failed:
    remove node from hash table before modifying it"
    + JDK-8244729: Shenandoah: remove resolve paths from
    SBSA::generate_shenandoah_lrb
    + JDK-8244763: Update --release 8 symbol information after JSR
    337 MR3
    + JDK-8244818: Java2D Queue Flusher crash while moving
    application window to external monitor
    + JDK-8245151: jarsigner should not raise duplicate warnings on
    verification
    + JDK-8245616: Bump update version for OpenJDK: jdk-11.0.9
    + JDK-8245714: "Bad graph detected in build_loop_late" when
    loads are pinned on loop limit check uncommon branch
    + JDK-8245801: StressRecompilation triggers assert "redundunt
    OSR recompilation detected. memory leak in CodeCache!"
    + JDK-8245832: JDK build make-static-libs should build all JDK
    libraries
    + JDK-8245880: Shenandoah: check class unloading flag early in
    concurrent code root scan
    + JDK-8245981: Upgrade to jQuery 3.5.1
    + JDK-8246027: Minimal fastdebug build broken after JDK-8245801
    + JDK-8246094: [macos] Sound Recording and playback is not
    working
    + JDK-8246153: TestEliminateArrayCopy fails with
  - XX:+StressReflectiveCode
    + JDK-8246193: Possible NPE in ENC-PA-REP search in AS-REQ
    + JDK-8246196: javax/management/MBeanServer/OldMBeanServerTest
    fails with AssertionError
    + JDK-8246203: Segmentation fault in verification due to stack
    overflow with -XX:+VerifyIterativeGVN
    + JDK-8246330: Add TLS Tests for Legacy ECDSA curves
    + JDK-8246453: TestClone crashes with "all collected exceptions
    must come from the same place"
    + JDK-8247246: Add explicit ResolvedJavaType.link and expose
    presence of default methods
    + JDK-8247350: [aarch64] assert(false) failed: wrong size of
    mach node
    + JDK-8247502: PhaseStringOpts crashes while optimising
    effectively dead code
    + JDK-8247615: Initialize the bytes left for the heap sampler
    + JDK-8247824: CTW: C2 (Shenandoah) compilation fails with SEGV
    in SBC2Support::pin_and_expand
    + JDK-8247874: Replacement in VersionProps.java.template not
    working when --with-vendor-bug-url contains '&amp;'
    + JDK-8247979: aarch64: missing side effect of killing flags
    for clearArray_reg_reg
    + JDK-8248214: Add paddings for TaskQueueSuper to reduce
    false-sharing cache contention
    + JDK-8248219: aarch64: missing memory barrier in
    fast_storefield and fast_accessfield
    + JDK-8248348: Regression caused by the update to BCEL 6.0
    + JDK-8248385: [testbug][11u] Adapt TestInitiExceptions to
    jtreg 5.1
    + JDK-8248495: [macos] zerovm is broken due to libffi headers
    location
    + JDK-8248851: CMS: Missing memory fences between free chunk
    check and klass read
    + JDK-8248987: AOT's Linker.java seems to eagerly fail-fast on
    Windows
    + JDK-8249159: Downport test rework for SSLSocketTemplate from
    8224650
    + JDK-8249215: JFrame::setVisible crashed with
  - Dfile.encoding=UTF-8 on Japanese Windows.
    + JDK-8249251: [dark_mode ubuntu 20.04] The selected menu is
    not highlighted in GTKLookAndFeel
    + JDK-8249255: Build fails if source code in cygwin home dir
    + JDK-8249277: TestVerifyIterativeGVN.java is failing with
    timeout in OpenJDK 11
    + JDK-8249278: Revert JDK-8226253 which breaks the spec of
    AccessibleState.SHOWING for JList
    + JDK-8249560: Shenandoah: Fix racy GC request handling
    + JDK-8249801: Shenandoah: Clear soft-refs on requested GC cycle
    + JDK-8249953: Shenandoah: gc/shenandoah/mxbeans tests should
    account for corner cases
    + JDK-8250582: Revert Principal Name type to NT-UNKNOWN when
    requesting TGS Kerberos tickets
    + JDK-8250609: C2 crash in IfNode::fold_compares
    + JDK-8250627: Use -XX:+/-UseContainerSupport for
    enabling/disabling Java container metrics
    + JDK-8250755: Better cleanup for
    jdk/test/javax/imageio/plugins/shared/CanWriteSequence.java
    + JDK-8250787: Provider.put no longer registering aliases in
    FIPS env
    + JDK-8250826: jhsdb does not work with coredump which comes
    from Substrate VM
    + JDK-8250827: Shenandoah: needs to reset/finish StringTable's
    dead count before/after parallel walk
    + JDK-8250844: Make sure {type,obj}ArrayOopDesc accessors check
    the bounds
    + JDK-8251117: Cannot check P11Key size in P11Cipher and
    P11AEADCipher
    + JDK-8251354: Shenandoah: Fix jdk/jfr/tool/TestPrintJSON.java
    test failure
    + JDK-8251451: Shenandoah: Remark ObjectSynchronizer roots with
    I-U
    + JDK-8251469: Better cleanup for
    test/jdk/javax/imageio/SetOutput.java
    + JDK-8251487: Shenandoah: missing detail timing tracking for
    final mark cleaning phase
    + JDK-8252120: compiler/oracle/TestCompileCommand.java
    misspells "occured"
    + JDK-8252157: JDK-8231209 11u backport breaks jmm binary
    compatibility
    + JDK-8252258: [11u] JDK-8242154 changes the default vendor
    + JDK-8252804: [test] Fix 'ReleaseDeflater.java' test after
    downport of 8234011
    + JDK-8253134: JMM_VERSION should remain at 0x20020000 (JDK 10)
    in JDK 11
    + JDK-8253283: [11u] Test build/translations/
    /VerifyTranslations.java failing after JDK-8252258
    + JDK-8253813: Backout JDK-8244287 from 11u: it causes several
    crashes
- Removed patch:
  * gcc-fno-common-fix.patch
    + not needed any more with this version
- Added patch:
  * JDK-8250861.patch
    + Fix regression "8250861: Crash in MinINode::Ideal(PhaseGVN*,
    bool)" introduced in jdk 11.0.9</changelog>
  <changelog author="fstrba@suse.com" date="1604491200">- Enable Sheandoah GC for x86_64 (jsc#ECO-3171)</changelog>
  <changelog author="fstrba@suse.com" date="1605528000">- Update to upstream tag jdk-11.0.9.1-1
  * Fix:
    + JDK-8250861: Crash in MinINode::Ideal(PhaseGVN*, bool)
- Removed patch:
  * JDK-8250861.patch
    + Integrated upstream</changelog>
  <changelog author="fstrba@suse.com" date="1611230400">- Update to upstream tag jdk-11.0.10+9 (January 2021 CPU,
  bsc#1181239)
  * Security fixes
    + JDK-8247619: Improve Direct Buffering of Characters
  * Other changes
    + JDK-6722928: Support SSPI as a native GSS-API provider
    + JDK-7185258: [macosx] Deadlock in SunToolKit.realSync()
    + JDK-8152332: [macosx] JFileChooser cannot be serialized on
    Mac OS X
    + JDK-8161684: [testconf] Add VerifyOops' testing into compiler
    tiers
    + JDK-8171279: Support X25519 and X448 in TLS
    + JDK-8173361: various crashes in
    JvmtiExport::post_compiled_method_load
    + JDK-8173658: JvmtiExport::post_class_unload() is broken for
    non-JavaThread initiators
    + JDK-8191006: hsdis disassembler plugin does not compile with
    binutils 2.29+
    + JDK-8197981: Missing return statement in
    __sync_val_compare_and_swap_8
    + JDK-8198334: java/awt/FileDialog/8003399/bug8003399.java
    fails in headless mode
    + JDK-8200151: Add 8 JNDI tests to com/sun/jndi/dns/ConfigTests/
    + JDK-8208279: Add 8 JNDI tests to com/sun/jndi/dns/EnvTests/
    + JDK-8208483: Add 5 JNDI tests to
    com/sun/jndi/dns/FactoryTests/
    + JDK-8208542: Add 4 JNDI tests to com/sun/jndi/dns/ListTests/
    + JDK-8208665: Amend cross-compilation docs with
    qemu-debootstrap recipe
    + JDK-8210088: ProblemList gc/epsilon/TestMemoryMXBeans.java
    + JDK-8210339: Add 10 JNDI tests to com/sun/jndi/dns/FedTests/
    + JDK-8211450: UndetVar::dup is not copying the kind field to
    the duplicated instance
    + JDK-8212160: JVMTI agent crashes with "assert(_value != 0LL)
    failed: resolving NULL _value"
    + JDK-8212226: SurfaceManager throws "Invalid Image variant"
    for MultiResolutionImage (Windows)
    + JDK-8213400: Support choosing group name in keytool keypair
    generation
    + JDK-8213535: Windows HiDPI html lightweight tooltips are
    truncated
    + JDK-8213698: Improve devkit creation and add support for
    linux/ppc64/ppc64le/s390x
    + JDK-8214025: assert(t-&gt;singleton()) failed: must be a
    constant when ScavengeRootsInCode &lt; 2
    + JDK-8214242: compiler/arguments/TestScavengeRootsInCode.java
    fails because of missing UnlockDiagnosticVMOptions
    + JDK-8214787: Zero builds fail with "undefined
    JavaThread::thread_state()"
    + JDK-8215583: Exclude
    runtime/handshake/HandshakeWalkSuspendExitTest.java
    + JDK-8216012: Infinite loop in RSA KeyPairGenerator
    + JDK-8216324: GetClassMethods is confused by the presence of
    default methods in super interfaces
    + JDK-8217429: WebSocket over authenticating proxy fails to
    send Upgrade headers
    + JDK-8217976: test/jdk/java/net/httpclient/websocket/
    /WebSocketProxyTest.java fails intermittently
    + JDK-8218021: Have jarsigner preserve posix permission
    attributes
    + JDK-8218287: jshell tool: input behavior unstable after
    12-ea+24 on Windows
    + JDK-8218851: JVM crash in custom classloader stress test, JDK
    12 &amp; 13
    + JDK-8220420: Cleanup c1_LinearScan
    + JDK-8222072: JVMTI GenerateEvents() sends CompiledMethodLoad
    events to wrong jvmtiEnv
    + JDK-8222286: Fix for JDK-8213419 is broken on s390
    + JDK-8222527: HttpClient doesn't send HOST header when
    tunelling HTTP/1.1 through http proxy
    + JDK-8222533: jtreg test jdk/internal/platform/cgroup/
    /TestCgroupMetrics.java fails on SLES12.3 linux ppc64le
    machine
    + JDK-8224506: [TESTBUG] TestDockerMemoryMetrics.java fails
    with exitValue = 137
    + JDK-8224555: vmTestbase/nsk/jvmti/scenarios/contention/TC02/
    /tc02t001/TestDescription.java failed
    + JDK-8224650: Add tests to support X25519 and X448 in TLS
    + JDK-8225072: Add LuxTrust certificate that is expiring in
    March 2021 to list of allowed but expired certs
    + JDK-8225329: -XX:+PrintBiasedLockingStatistics causes crash
    during initialization on Windows platforms
    + JDK-8225687: Newly added sspi.cpp in JDK-6722928 still
    contains some small errors
    + JDK-8227006: [linux] Runtime.availableProcessors execution
    time increased by factor of 100
    + JDK-8227275: Within native OOM error handling, assertions may
    hang the process
    + JDK-8227647: [Graal] Test8009761.java fails due to
    "RuntimeException: static java.lang.Object
    compiler.uncommontrap.Test8009761.m3(boolean,boolean) not
    compiled"
    + JDK-8229495: SIGILL in C2 generated OSR compilation
    + JDK-8230910: libsspi_bridge does not build on Windows 32bit
    + JDK-8232114: JVM crashed at imjpapi.dll in native code
    + JDK-8234147: Avoid looking up standard charsets in core
    libraries
    + JDK-8234393: [macos] printing ignores printer tray
    + JDK-8234863: Increase default value of MaxInlineLevel
    + JDK-8235218: Minimal VM is broken after JDK-8173361
    + JDK-8235456: Minimal VM is broken after JDK-8212160
    + JDK-8235829: graal crashes with Zombie.java test
    + JDK-8236124: Minimal VM slowdebug build failed after
    JDK-8212160
    + JDK-8236512: PKCS11 Connection closed after Cipher.doFinal
    and NoPadding
    + JDK-8236944: The legVecZ operand should be limited to
    zmm0-zmm15 registers
    + JDK-8237186: Fix typo in copyright header of
    java/io/Reader/TransferTo.java
    + JDK-8237499: JFR: Include stack trace in the ThreadStart event
    + JDK-8237512: AArch64: aarch64TestHook leaks a BufferBlob
    + JDK-8237524: AArch64: String.compareTo() may return incorrect
    result
    + JDK-8237950: C2 compilation fails with "Live Node limit
    exceeded limit" during ConvI2L::Ideal optimization
    + JDK-8238579: HttpsURLConnection drops the timeout and hangs
    forever in read
    + JDK-8239105: Add exception for expiring Digicert root
    certificates to VerifyCACerts test
    + JDK-8239477: jdk/jfr/jcmd/TestJcmdStartStopDefault.java fails
  - XX:+VerifyOops with "verify_oop: rsi: broken oop"
    + JDK-8239497: SEGV in EdgeUtils::field_name_symbol(Edge const&amp;)
    + JDK-8239886: Minimal VM build fails after JDK-8237499
    + JDK-8240633: Memory leaks in the implementations of
    FileChooserUI
    + JDK-8240690: Race condition between EDT and
    BasicDirectoryModel.FilesLoader.run0()
    + JDK-8241234: Unify monitor enter/exit runtime entries.
    + JDK-8241311: Move some charset mapping tests from closed to
    open
    + JDK-8241797: Add some tests to the problem list
    + JDK-8242029: AArch64: skip G1 array copy pre-barrier if
    marking not active
    + JDK-8242335: Additional Tests for RSASSA-PSS
    + JDK-8242480: Negative value may be returned by
    getFreeSwapSpaceSize() in the docker
    + JDK-8242614: cleanup duplicated test ldap server in some
    com/sun/jndi/ldap/ tests
    + JDK-8242846: Bring back test/jdk/tools/jlink/plugins/
    /OrderResourcesPluginTest.java
    + JDK-8243114: Implement montgomery{Multiply,Square}intrinsics
    on Windows
    + JDK-8243290: Improve diagnostic messages for class
    verification and redefinition failures
    + JDK-8243488: Add tests for set/get SendBufferSize and
    getReceiveBufferSize in DatagramSocket
    + JDK-8243549: sun/security/ssl/CipherSuite/
    /NamedGroupsWithCipherSuite.java failed with Unsupported
    signature algorithm: DSA
    + JDK-8243617: compiler/onSpinWait/TestOnSpinWaitC1.java test
    uses wrong class
    + JDK-8243619: compiler/codecache/CheckSegmentedCodeCache.java
    test misses -version
    + JDK-8244142: some hotspot/runtime tests don't check exit code
    of forked JVM
    + JDK-8244278: Excessive code cache flushes and sweeps
    + JDK-8244282: test/hotspot/jtreg/compiler/intrinsics/
    /Test8237524.java fails with --illegal-access=deny
    + JDK-8244621: [macos10.15] Garbled FX printing plus CoreText
    warnings on Catalina when building with Xcode 11
    + JDK-8244819: hsdis does not compile with binutils 2.34+
    + JDK-8245051: c1 is broken if it is compiled by gcc without
  - fno-lifetime-dse
    + JDK-8245168: jlink should not be treated as a "small" tool
    + JDK-8245400: Upgrade to LittleCMS 2.11
    + JDK-8246381: VM crashes with "Current BasicObjectLock* below
    than low_mark"
    + JDK-8246434: Threads::print_on_error assumes that the heap
    has been set up
    + JDK-8246648: issue with OperatingSystemImpl
    getFreeSwapSpaceSize in docker after 8242480
    + JDK-8247201: Print potential pointer value of readable stack
    memory in hs_err file
    + JDK-8247763: assert(outer-&gt;outcnt() == 2) failed: 'only phis'
    failure in LoopNode::verify_strip_mined()
    + JDK-8247867: Upgrade to freetype 2.10.2
    + JDK-8248190: Enable Power10 system and implement new
    byte-reverse instructions
    + JDK-8248226: TestCloneAccessStressGCM fails with
  - XX:-ReduceBulkZeroing
    + JDK-8248347: windows build broken by JDK-8243114
    + JDK-8248532: Every time I change keyboard language at my
    MacBook, Java crashes
    + JDK-8248552: C2 crashes with SIGFPE due to division by zero
    + JDK-8248596: [TESTBUG] compiler/loopopts/
    /PartialPeelingUnswitch.java times out with Graal enabled
    + JDK-8248745: Add jarsigner and keytool tests for restricted
    algorithms
    + JDK-8248791: sun/util/resources/cldr/TimeZoneNamesTest.java
    fails with -XX:-ReduceInitialCardMarks -XX:-ReduceBulkZeroing
    + JDK-8248845: AArch64: stack corruption after spilling vector
    register
    + JDK-8249176: Update GlobalSignR6CA test certificates
    + JDK-8249183: JVM crash in "AwtFrame::WmSize" method
    + JDK-8249192: MonitorInfo stores raw oops across safepoints
    + JDK-8249602: C2: assert(cnt == _outcnt) failed: no insertions
    allowed
    + JDK-8249603: C1: assert(has_error == false) failed: register
    allocation invalid
    + JDK-8249605: C2: assert(no_dead_loop) failed: dead loop
    detected
    + JDK-8249607: C2: assert(!had_error) failed: bad dominance
    + JDK-8249608: Vector register used by C2 compiled method
    corrupted at safepoint
    + JDK-8249672: Include microcode revision in features_string on
    x86
    + JDK-8249748: gtest silently ignores bad jvm arguments
    + JDK-8249821: Separate libharfbuzz from libfontmanager
    + JDK-8250598: Hyper-V is detected in spite of running on host
    OS
    + JDK-8250605: Linux x86_32 builds fail after JDK-8249821
    + JDK-8250636: iso8601_time returns incorrect offset part on
    MacOS
    + JDK-8250665: Wrong translation for the month name of May in
    ar_JO,LB,SY
    + JDK-8250772: Test com/sun/jndi/ldap/
    /NamingExceptionMessageTest.java fails intermittently with
    javax.naming.ServiceUnavailableException
    + JDK-8250825: C2 crashes with assert(field != __null) failed:
    missing field
    + JDK-8250894: Provide a configure option to build and run
    against the platform libharfbuzz
    + JDK-8250928: JFR: Improve hash algorithm for stack traces
    + JDK-8250968: Symlinks attributes not preserved when using
    jarsigner on zip files
    + JDK-8250984: Memory Docker tests fail on some Linux kernels
    w/o cgroupv1 swap limit capabilities
    + JDK-8251118: BiasedLocking::preserve_marks should not have a
    HandleMark
    + JDK-8251189: com/sun/jndi/ldap/LdapDnsProviderTest.java
    failed due to timeout
    + JDK-8251257: NMT: jcmd VM.native_memory scale=1 crashes
    target VM
    + JDK-8251365: Build failure on AIX after 8250636
    + JDK-8251397: NPE on ClassValue.ClassValueMap.cacheArray
    + JDK-8251456: [TESTBUG] compiler/vectorization/
    /TestVectorsNotSavedAtSafepoint.java failed OutOfMemoryError
    + JDK-8251458: Parse::do_lookupswitch fails with "assert(_cnt
    &gt;= 0) failed"
    + JDK-8251535: Partial peeling at unsigned test adds incorrect
    loop exit check
    + JDK-8251949: ZGC: Set explicit heap size for
    compiler/gcbarriers tests
    + JDK-8252090: JFR: StreamWriterHost::write_unbuffered() stucks
    in an infinite loop OpenJDK (build 13.0.1+9)
    + JDK-8252415: Bump update version for OpenJDK: jdk-11.0.10
    + JDK-8252470: java/awt/dnd/DisposeFrameOnDragCrash/
    /DisposeFrameOnDragTest.java fails on Windows
    + JDK-8252497: Incorrect numeric currency code for ROL
    + JDK-8252660: Shenandoah: support manageable SoftMaxHeapSize
    option
    + JDK-8252679: Two windows specific FileDIalog tests may fail
    on some Windows_Server_2016_Standard
    + JDK-8252696: Loop unswitching may cause out of bound array
    load to be executed
    + JDK-8252754: Hash code calculation of JfrStackTrace is
    inconsistent
    + JDK-8253219: Epsilon: clean up unnecessary includes
    + JDK-8253224: Shenandoah: ShenandoahStrDedupQueue destructor
    calls virtual num_queues()
    + JDK-8253226: Shenandoah: remove unimplemented
    ShenandoahStrDedupQueue::verify
    + JDK-8253269: The CheckCommonColors test should provide more
    info on failure
    + JDK-8253284: Zero OrderAccess barrier mappings are incorrect
    + JDK-8253375: OSX build fails with Xcode 12.0 (12A7209)
    + JDK-8253778: ShenandoahSafepoint::is_at_shenandoah_safepoint
    should not access VMThread state from other threads
    + JDK-8253791: Issue with useAppleColor check in CSystemColors.m
    + JDK-8254016: Test8237524 fails with -XX:-CompactStrings option
    + JDK-8254081: java/security/cert/PolicyNode/
    /GetPolicyQualifiers.java fails due to an expired certificate
    + JDK-8254144: Non-x86 Zero builds fail with return-type
    warning in os_linux_zero.cpp
    + JDK-8254166: Zero: return-type warning in
    zeroInterpreter_zero.cpp
    + JDK-8254177: (tz) Upgrade time-zone data to tzdata2020b
    + JDK-8254185: Fix Code cache sweeper heuristics for JDK 11
    + JDK-8254190: [s390] interpreter misses exception check after
    calling monitorenter
    + JDK-8254790: SIGSEGV in string_indexof_char and
    stringL_indexof_char intrinsics
    + JDK-8254854: [cgroups v1] Metric limits not properly detected
    on some join controller combinations
    + JDK-8254982: (tz) Upgrade time-zone data to tzdata2020c
    + JDK-8255050: Add pkcs11/KeyStore/ClientAuth.sh to Problem list
    + JDK-8255065: Zero: accessor_entry misses the IRIW case
    + JDK-8255226: (tz) Upgrade time-zone data to tzdata2020d
    + JDK-8255269: Unsigned overflow in g1Policy.cpp
    + JDK-8255365: Problem list failing client manual tests
    + JDK-8255457: Shenandoah: cleanup ShenandoahMarkTask
    + JDK-8255466: C2 crashes at ciObject::get_oop() const+0x0
    + JDK-8255550: x86: Assembler::cmpq(Address dst, Register src)
    encoding is incorrect
    + JDK-8255603: Memory/Performance regression after JDK-8210985
    + JDK-8255760: Shenandoah: match constants style in
    ShenandoahMarkTask fallback
    + JDK-8255781: Bump patch update version for OpenJDK:
    jdk-11.0.9.1
    + JDK-8255937: Better cleanup for
    test/jdk/javax/imageio/stream/StreamFlush.java
    + JDK-8256427: Test com/sun/jndi/dns/ConfigTests/
    /PortUnreachable.java does not work on AIX
    + JDK-8256452: Integrate missing part of JDK-8232370 to 11u
    + JDK-8256483: [TESTBUG] serviceability/jvmti/GetClassMethods/
    /libOverpassMethods.c fails to compile on gcc 4.4.x
    + JDK-8256557: libharfbuzz fails to link on gcc 4.4.x due to
  - Wl,-z,defs
    + JDK-8256618: Zero: Linux x86_32 build still fails
    + JDK-8256736: Zero: GTest tests fail with "unsuppported vm
    variant"
    + JDK-8256809: Annotation processing causes NPE during flow
    analysis
    + JDK-8257181: s390x builds are very noisy with gc-sections
    messages
    + JDK-8257242: [macOS] Java app crashes while switching input
    methods
    + JDK-8257545: SunJSSE FIPS regression in key exchange after
    JDK-8171279 11u backport
    + JDK-8257641: Shenandoah: Query is_at_shenandoah_safepoint()
    from control thread should return false
    + JDK-8257701: Shenandoah: objArrayKlass metadata is not marked
    with chunked arrays
    + JDK-8258630: Add expiry exception for QuoVadis root
    certificate
- New upstream dependency on libharfbuzz
- Regenerated patches: missing-return.patch system-pcsclite.patch</changelog>
  <changelog author="fstrba@suse.com" date="1616155200">- Added patches:
  * system-crypto-policy.patch
    + Let OpenJDK use system crypto policies unless explicitely told
    not to
  * nss-security-provider.patch
    + Add the NSS security provider with configuration in generated
    nss.cfg file
  * keytool-default-rsa.patch
    + Make keytool generate RSA keys by default, since only the
    LEGACY system crypto policy allows DSA</changelog>
  <changelog author="pujos.michael@gmail.com" date="1618488000">- moved mozilla-nss dependency to java-11-openjdk-headless package
  This is necessary to be able to do crypto with just
  java-11-openjdk-headless installed. Fixes boo#1184606</changelog>
  <changelog author="fstrba@suse.com" date="1619006400">- Update to upstream tag jdk-11.0.11+9 (April 2021, CPU)
  * Security fixes
    + JDK-8244473: Contextualize registration for JNDI
    + JDK-8244543: Enhanced handling of abstract classes
    + JDK-8249906, CVE-2021-2163, bsc#1185055: Enhance opening JARs
    + JDK-8250568, CVE-2021-2161, bsc#1185056: Less ambiguous
    processing
    + JDK-8253799: Make lists of normal filenames
    + JDK-8257001: Improve Http Client Support
  * Other changes
    + JDK-7107012: sun.jvm.hotspot.code.CompressedReadStream
    readDouble() conversion to long mishandled
    + JDK-7146776: deadlock between URLStreamHandler.getHostAddress
    and file.Handler.openconnection
    + JDK-8086003: Test fails on OSX with java.lang.RuntimeException
    'Narrow klass base: 0x0000000000000000, Narrow klass shift: 3'
    missing
    + JDK-8168869: jdeps: localized messages don't use proper line
    breaks
    + JDK-8180837: SunPKCS11-NSS tests failing with
    CKR_ATTRIBUTE_READ_ONLY and CKR_MECHANISM_PARAM_INVALID
    + JDK-8202343: Disable TLS 1.0 and 1.1
    + JDK-8205992: jhsdb cannot attach to Java processes running in
    Docker containers
    + JDK-8209193: Fix aarch64-linux compilation after -Wreorder
    changes
    + JDK-8210413: AArch64: Optimize div/rem by constant in C1
    + JDK-8210578: AArch64: Invalid encoding for fmlsvs instruction
    + JDK-8211051: jdeps usage of --dot-output doesn't provide
    valid output for modular jar
    + JDK-8211057: Gensrc step CompileProperties generates unstable
    CompilerProperties output
    + JDK-8211150: G1 Full GC not purging code root memory and
    hence causing memory leak
    + JDK-8211825: ModuleLayer.defineModulesWithXXX does not setup
    delegation when module reads automatic module
    + JDK-8212043: Add floating-point Math.min/max intrinsics
    + JDK-8212218: [TESTBUG] runtime/ErrorHandling/
    /TestHeapDumpOnOutOfMemoryErrorInMetaspace.java timed out
    + JDK-8213116: javax/swing/JComboBox/WindowsComboBoxSize/
    /WindowsComboBoxSizeTest.java fails in Windows
    + JDK-8213909: jdeps --print-module-deps should report missing
    dependences
    + JDK-8214180: Need better granularity for sleeping
    + JDK-8214223: tools/jdeps/listdeps/ListModuleDeps.java failed
    due to missing Lib2 file
    + JDK-8214230: Classes generated by SystemModulesPlugin.java
    are not reproducable
    + JDK-8214741: docs/index.html has no title or copyright
    + JDK-8215687: [Graal] unit test CheckGraalIntrinsics failed
    after 8212043
    + JDK-8217848: [Graal] vmTestbase/nsk/jvmti/ResourceExhausted/
    /resexhausted003/TestDescription.java fails
    + JDK-8218482: sun/security/krb5/auto/ReplayCachePrecise.java
    failed - no KrbException thrown
    + JDK-8218550: Add test omitted from JDK-8212043
    + JDK-8221584: SIGSEGV in os::PlatformEvent::unpark() in
    JvmtiRawMonitor::raw_exit while posting method exit event
    + JDK-8221995: AARCH64: problems with CAS instructions encoding
    + JDK-8222518: Remove unnecessary caching of Parker object in
    java.lang.Thread
    + JDK-8222785: aarch64: add necessary masking for immediate
    shift counts
    + JDK-8223186: HotSpot compile warnings from GCC 9
    + JDK-8225773: jdeps --check produces NPE if there are missing
    module dependences
    + JDK-8225805: Java Access Bridge does not close the logger
    + JDK-8226810: Failed to launch JVM because of
    NullPointerException occured on System.props
    + JDK-8229396: jdeps ignores multi-release when
    generate-module-info used on command line
    + JDK-8229474: Shenandoah: Cleanup CM::update_roots()
    + JDK-8232225: Rework the fix for JDK-8071483
    + JDK-8232905: JFR fails with assertion:
    assert(t-&gt;unflushed_size() == 0) failed: invariant
    + JDK-8233164: C2 fails with assert(phase-&gt;C-&gt;get_alias_index(t)
    == phase-&gt;C-&gt;get_alias_index(t_adr)) failed: correct memory
    chain
    + JDK-8233910: java/awt/ColorClass/AlphaColorTest.java is
    failing  intermittently in nightly lnux-x64 system
    + JDK-8233912: aarch64: minor improvements of atomic operations
    + JDK-8234508: VM_HeapWalkOperation::iterate_over_object reads
    non-strong fields with an on-strong load barrier
    + JDK-8234742: Improve handshake logging
    + JDK-8234796: Refactor Handshake::execute to take a more
    complex type than ThreadClosure
    + JDK-8235324: Dying objects are published from users of
    CollectedHeap::object_iterate
    + JDK-8235351: Lookup::unreflect should bind with the original
    caller independent of Method's accessible flag
    + JDK-8237369: Shenandoah: failed vmTestbase/nsk/jvmti/
    /AttachOnDemand/attach021/TestDescription.java test
    + JDK-8237392: Shenandoah: Remove unreliable assertion
    + JDK-8237483: AArch64 C1 OopMap inserted twice fatal error
    + JDK-8237495: Java MIDI fails with a dereferenced memory error
    when asked to send a raw 0xF7
    + JDK-8239355: (dc) Initial value of SO_SNDBUF should allow
    sending large datagrams (macOS)
    + JDK-8240353: AArch64: missing support for
  - XX:+ExtendedDTraceProbes in C1
    + JDK-8240704: CheckHandles.java failed "AssertionError: Handle
    use increased by more than 10 percent."
    + JDK-8240751: Shenandoah: fold ShenandoahTracer definition
    + JDK-8240795: [REDO] 8238384 CTW: C2 compilation fails with
    "assert(store != load-&gt;find_exact_control(load-&gt;in(0)))
    failed: dependence cycle found"
    + JDK-8241598: Upgrade JLine to 3.14.0
    + JDK-8241649: Optimize Character.toString
    + JDK-8241770: Module xxxAnnotation() methods throw NCDFE if
    module-info.class found as resource in unnamed module
    + JDK-8241911: AArch64: Fix a potential register clash issue in
    reduce_add2I
    + JDK-8242030: Wrong package declarations in jline classes after
    JDK-8241598
    + JDK-8242565: Policy initialization issues when the denyAfter
    constraint is enabled
    + JDK-8243618: compiler/rtm/cli tests can be run w/o WhiteBox
    + JDK-8243670: Unexpected test result caused by C2
    MergeMemNode::Ideal
    + JDK-8244088: [Regression] Switch of Gnome theme ends up in
    deadlocked UI
    + JDK-8244154: Update SunPKCS11 provider with PKCS11 v3.0 header
    files
    + JDK-8244340: Handshake processing thread lacks yielding
    + JDK-8244573: java.lang.ArrayIndexOutOfBoundsException thrown
    for malformed class file
    + JDK-8244683: A TSA server used by tests
    + JDK-8245005: javax/net/ssl/compatibility/BasicConnectTest.java
    failed with No enum constant
    + JDK-8245026: PsAdaptiveSizePolicy::_old_gen_policy_is_ready is
    unused
    + JDK-8245283: JFR: Can't handle constant dynamic used by Jacoco
    agent
    + JDK-8245512: CRC32 optimization using AVX512 instructions
    + JDK-8245527: LDAP Channel Binding support for Java
    GSS/Kerberos
    + JDK-8246707: (sc) SocketChannel.read/write throws
    AsynchronousCloseException on closed channel
    + JDK-8246709: sun/security/tools/jarsigner/
    /TsacertOptionTest.java compilation failed after JDK-8244683
    + JDK-8247200: assert((unsigned)fpargs &lt; 32)
    + JDK-8247766: [aarch64] guarantee(val &lt; (1U &lt;&lt; nbits))
    failed: Field too big for insn.
    + JDK-8248336: AArch64: C2: offset overflow in
    BoxLockNode::emit
    + JDK-8248865: Document JNDI/LDAP timeout properties
    + JDK-8248901: Signed immediate support in
    .../share/assembler.hpp is broken.
    + JDK-8249543: Force DirectBufferAllocTest to run with
  - ExplicitGCInvokesConcurrent
    + JDK-8249588: libwindowsaccessbridge issues on 64bit Windows
    + JDK-8249749: modify a primitive array through a stream and a
    for cycle causes jre crash
    + JDK-8249787: Make TestGCLocker more resilient with concurrent
    GCs
    + JDK-8249867: xml declaration is not followed by a newline
    + JDK-8250911: [windows] os::pd_map_memory() error detection
    broken
    + JDK-8251255: [linux] Add process-memory information to hs-err
    and VM.info
    + JDK-8251359: Shenandoah: filter null oops before calling
    enqueue/SATB barrier
    + JDK-8251925: C2: RenaissanceStressTest fails with
    assert(!had_error): bad dominance
    + JDK-8251944: Add Shenandoah test config to
    compiler/gcbarriers/UnsafeIntrinsicsTest.java
    + JDK-8251992: VM crashed running TestComplexAddrExpr.java test
    with -XX:UseAVX=X
    + JDK-8253220: Epsilon: clean up unused code/declarations
    + JDK-8253274: The CycleDMImagetest brokes the system
    + JDK-8253353: Crash in C2: guarantee(n != NULL) failed: No Node
    + JDK-8253368: TLS connection always receives close_notify
    exception
    + JDK-8253404: C2: assert(C-&gt;live_nodes() &lt;=
    C-&gt;max_node_limit()) failed: Live Node limit exceeded limit
    + JDK-8253409: Double-rounding possibility in float fma
    + JDK-8253476: TestUseContainerSupport.java fails on some Linux
    kernels w/o swap limit capabilities
    + JDK-8253524: C2: Refactor code that clones predicates during
    loop unswitching
    + JDK-8253644: C2: assert(skeleton_predicate_has_opaque(iff))
    failed: unexpected
    + JDK-8253681: closed java/awt/dnd/MouseEventAfterStartDragTest/
    /MouseEventAfterStartDragTest.html test failed
    + JDK-8253702: BigSur version number reported as 10.16, should
    be 11.nn
    + JDK-8253756: C2 CompilerThread0 crash in Node::add_req(Node*)
    + JDK-8254104: MethodCounters must exist before nmethod is
    installed
    + JDK-8254734: "dead loop detected" assert failure with patch
    from 8223051
    + JDK-8254748: Bad Copyright header format after JDK-8212218
    + JDK-8254799: runtime/ErrorHandling/
    /TestHeapDumpOnOutOfMemoryError.java fails with release VMs
    + JDK-8255058: C1: assert(is_virtual()) failed: type check
    + JDK-8255351: Add detection for Graviton 2 CPUs
    + JDK-8255368: Math.exp() gives wrong result for large values on
    x86 32-bit platforms
    + JDK-8255387: Japanese characters were printed upside down on
    AIX
    + JDK-8255401: Shenandoah: Allow oldval and newval registers to
    overlap in cmpxchg_oop()
    + JDK-8255479: [aarch64] assert(src-&gt;section_index_of(target) ==
    CodeBuffer::SECT_NONE) failed: sanity
    + JDK-8255544: Create a checked cast
    + JDK-8255559: Leak File Descriptors Because of
    ResolverLocalFilesystem#engineResolveURI()
    + JDK-8255681: print callstack in error case in
    runAWTLoopWithApp
    + JDK-8255734: VM should ignore SIGXFSZ on ppc64, s390 too
    + JDK-8255742: PrintInlining as compiler directive doesn't print
    virtual calls
    + JDK-8255845: Memory leak in imageFile.cpp
    + JDK-8255880: UI of Swing components is not redrawn after their
    internal state changed
    + JDK-8255908: ExceptionInInitializerError due to
    UncheckedIOException while initializing cgroupv1 subsystem
    + JDK-8256025: AArch64: MachCallRuntimeNode::ret_addr_offset()
    is incorrect for stub calls
    + JDK-8256056: Deoptimization stub doesn't save vector registers
    on x86
    + JDK-8256061: RegisterSaver::save_live_registers() omits upper
    halves of ZMM0-15 registers
    + JDK-8256187: [TEST_BUG] Automate bug4275046.java test
    + JDK-8256220: C1: x86_32 fails with -XX:UseSSE=1 after
    JDK-8210764 due to mishandled lir_neg
    + JDK-8256258: some missing NULL checks or asserts after
    CodeCache::find_blob_unsafe
    + JDK-8256264: Printed GlyphVector outline with low DPI has bad
    quality on Windows
    + JDK-8256290: javac/lambda/T8031967.java fails with
    StackOverflowError on x86_32
    + JDK-8256359: AArch64: runtime/ReservedStack/
    /ReservedStackTestCompiler.java fails
    + JDK-8256387: Unexpected result if patching an entire
    instruction on AArch64
    + JDK-8256421: Add 2 HARICA roots to cacerts truststore
    + JDK-8256488: [aarch64] Use ldpq/stpq instead of ld4/st4 for
    small copies in StubGenerator::copy_memory
    + JDK-8256489: Make gtest for long path names on Windows more
    resilient in the presence of virus scanners
    + JDK-8256501: libTestMainKeyWindow fails to build with Xcode
    12.2
    + JDK-8256633: Fix product build on Windows+Arm64
    + JDK-8256682: JDK-8202343 is incomplete
    + JDK-8256751: Incremental rebuild with precompiled header fails
    when touching a header file
    + JDK-8256757: Incorrect MachCallRuntimeNode::ret_addr_offset()
    for CallLeafNoFP on x86_32
    + JDK-8256806: Shenandoah: optimize shenandoah/jni/
    /TestPinnedGarbage.java test
    + JDK-8256807: C2: Not marking stores correctly as mismatched
    in string opts
    + JDK-8256810: Incremental rebuild broken on Macosx
    + JDK-8256818: SSLSocket that is never bound or connected leaks
    socket resources
    + JDK-8256888: Client manual test problem list update
    + JDK-8257083: Security infra test failures caused by
    JDK-8202343
    + JDK-8257408: Bump update version for OpenJDK: jdk-11.0.11
    + JDK-8257423: [PPC64] Support -XX:-UseInlineCaches
    + JDK-8257436: [aarch64] Regressions in ArrayCopyUnalignedDst
    .testByte/testChar for 65-78 bytes when UseSIMDForMemoryOps
    is on
    + JDK-8257513: C2: assert((constant_addr -
    _masm.code()-&gt;consts()-&gt;start()) == con.offset())
    + JDK-8257547: Handle multiple prereqs on the same line in deps
    files
    + JDK-8257561: Some code is not vectorized after 8251925 and
    8250607
    + JDK-8257565: epsilonBarrierSet.hpp should not include
    barrierSetAssembler
    + JDK-8257575: C2: "failed: only phis" assert failure in loop
    strip mining verification
    + JDK-8257594: C2 compiled checkcast of non-null object triggers
    endless deoptimization/recompilation cycle
    + JDK-8257633: Missing -mmacosx-version-min=X flag when linking
    libjvm
    + JDK-8257670: sun/security/ssl/SSLSocketImpl/SSLSocketLeak.java
    reports leaks
    + JDK-8257707: Fix incorrect format string in Http1HeaderParser
    + JDK-8257746: Regression introduced with JDK-8250984 - memory
    might be null in some machines
    + JDK-8257798: [PPC64] undefined reference to
    Klass::vtable_start_offset()
    + JDK-8257884: Re-enable sun/security/ssl/SSLSocketImpl/
    /SSLSocketLeak.java as automatic test
    + JDK-8257910: [JVMCI] Set exception_seen accordingly in the
    runtime.
    + JDK-8257997: sun/security/ssl/SSLSocketImpl/SSLSocketLeak.java
    again reports leaks after JDK-8257884
    + JDK-8257999: Parallel GC crash in gc/parallel/
    /TestDynShrinkHeap.java: new region is not in covered_region
    + JDK-8258077: Using -Xcheck:jni can lead to a double-free after
    JDK-8193234
    + JDK-8258247: Couple of issues in fix for JDK-8249906
    + JDK-8258373: Update the text handling in the JPasswordField
    + JDK-8258396: SIGILL in jdk.jfr.internal.PlatformRecorder
    .rotateDisk()
    + JDK-8258419: RSA cipher buffer cleanup
    + JDK-8258471: "search codecache" clhsdb command does not work
    + JDK-8258534: Epsilon: clean up unused includes
    + JDK-8258805: Japanese characters not entered by mouse click
    on Windows 10
    + JDK-8258833: Cancel multi-part cipher operations in SunPKCS11
    after failures
    + JDK-8258836: JNI local refs exceed capacity
    getDiagnosticCommandInfo
    + JDK-8258884: [TEST_BUG] Convert applet-based test
    open/test/jdk/javax/swing/JMenuItem/8031573/bug8031573.java
    to a regular java test
    + JDK-8259007: This test printed a blank page
    + JDK-8259048: (tz) Upgrade time-zone data to tzdata2020f
    + JDK-8259049: Uninitialized variable after JDK-8257513
    + JDK-8259231: Epsilon: improve performance under contention
    during virtual space expansion
    + JDK-8259271: gc/parallel/TestDynShrinkHeap.java still fails
    "assert(covered_region.contains(new_memregion)) failed: new
    region is not in covered_region"
    + JDK-8259312: VerifyCACerts.java fails as soneraclass2ca cert
    will expire in 90 days
    + JDK-8259319: Illegal package access when SunPKCS11 requires
    SunJCE's classes
    + JDK-8259339: AllocateUninitializedArray C2 intrinsic fails
    with void.class input
    + JDK-8259428: AlgorithmId.getEncodedParams() should return copy
    + JDK-8259446: runtime/jni/checked/
    /TestCheckedReleaseArrayElements.java fails with stderr not
    empty
    + JDK-8259451: Zero: skip serviceability/sa tests, set vm.hasSA
    to false
    + JDK-8259580: Shenandoah: uninitialized label in
    VerifyThreadGCState
    + JDK-8259619: C1: 3-arg StubAssembler::call_RT stack-use
    condition is incorrect
    + JDK-8259633: compiler/graalunit/CoreTest.java fails with NPE
    after JDK-8244543
    + JDK-8259706: C2 compilation fails with assert(vtable_index ==
    Method::invalid_vtable_index) failed: correct sentinel value
    + JDK-8259707: LDAP channel binding does not work with StartTLS
    extension
    + JDK-8259773: Incorrect encoding of AVX-512 kmovq instruction
    + JDK-8259849: Shenandoah: Rename store-val to IU-barrier
    + JDK-8259949: x86 32-bit build fails when -fcf-protection is
    passed in the compiler flags
    + JDK-8259954: gc/shenandoah/mxbeans tests fail with -Xcomp
    + JDK-8260029: aarch64: fix typo in verify_oop_array
    + JDK-8260308: Update LogCompilation junit to 4.13.1
    + JDK-8260338: Some fields in HaltNode is not cloned
    + JDK-8260349: Cannot programmatically retrieve Metaspace max
    set via JAVA_TOOL_OPTIONS
    + JDK-8260356: (tz) Upgrade time-zone data to tzdata2021a
    + JDK-8260378: [TESTBUG] DcmdMBeanTestCheckJni.java reports
    false positive
    + JDK-8260497: Shenandoah: Improve SATB flushing
    + JDK-8260502: [s390] NativeMovRegMem::verify() fails because
    it's too strict
    + JDK-8260632: Build failures after JDK-8253353
    + JDK-8260704: ParallelGC: oldgen expansion needs release-store
    for _end
    + JDK-8261022: Fix incorrect result of Math.abs() with char type
    + JDK-8261089: [TESTBUG] native library of test
    TestCheckedReleaseCriticalArray.java fails to compile with
    gcc 4.x
    + JDK-8261183: Follow on to Make lists of normal filenames
    + JDK-8261209: isStandalone property: remove dependency on
    pretty-print
    + JDK-8261231: Windows IME was disabled after DnD operation
    + JDK-8261251: Shenandoah: Use object size for full GC
    humongous compaction
    + JDK-8261310: PPC64 Zero build fails with
    'VMError::controlled_crash(int)::FunctionDescriptor
    functionDescriptor' has incomplete type and cannot be defined
    + JDK-8261334: NMT: tuning statistic shows incorrect hash
    distribution
    + JDK-8261413: Shenandoah: Disable class-unloading in I-U mode
    + JDK-8261522: [PPC64] AES intrinsics write beyond the
    destination array
    + JDK-8261534: Test sun/security/pkcs11/KeyAgreement/
    /IllegalPackageAccess.java fails on platforms where no nsslib
    artifacts are defined
    + JDK-8261585: Restore HandleArea used in
    Deoptimization::uncommon_trap
    + JDK-8261753: Test java/lang/System/OsVersionTest.java still
    failing on BigSur patch versions after JDK-8253702
    + JDK-8261829: Exclude tools/jlink/JLinkReproducibleTest.java
    in 11u
    + JDK-8261912: Code IfNode::fold_compares_helper more
    defensively
    + JDK-8261920: [AIX] jshell command throws java.io.IOError on
    non English locales
    + JDK-8262018: Wrong format in SAP copyright header of
    OsVersionTest
    + JDK-8263069: Exclude some failing tests from
    security/infra/java/security/cert/CertPathValidator</changelog>
  <changelog author="fstrba@suse.com" date="1620043200">- Remove all Jpackage provides for SLE12 in order to avoid
  installing this package as default Java on SLE12-SP5
  (bsc#1185476)</changelog>
  <changelog author="fstrba@suse.com" date="1621512000">- Modified patch:
  * nss-security-provider.patch
    + make the NSS provider first in the list</changelog>
  <changelog author="fstrba@suse.com" date="1626868800">- Update to upstream tag jdk-11.0.12+7 (July 2021, CPU)
  * Security fixes
    + JDK-8256157: Improve bytecode assembly
    + JDK-8256491: Better HTTP transport
    + JDK-8258432, CVE-2021-2341, bsc#1188564: Improve file
    transfers
    + JDK-8260453: Improve Font Bounding
    + JDK-8260960: Signs of jarsigner signing
    + JDK-8260967, CVE-2021-2369, bsc#1188565: Better jar file
    validation
    + JDK-8262380: Enhance XML processing passes
    + JDK-8262403: Enhanced data transfer
    + JDK-8262410: Enhanced rules for zones
    + JDK-8262477: Enhance String Conclusions
    + JDK-8262967: Improve Zip file support
    + JDK-8264066, CVE-2021-2388, bsc#1188566: Enhance compiler
    validation
    + JDK-8264079: Improve abstractions
    + JDK-8264460: Improve NTLM support
  * Other changes
    + JDK-6847157: java.lang.NullPointerException: HDC for
    component at sun.java2d.loops.Blit.Blit
    + JDK-7106851: Test should not use System.exit
    + JDK-8073446: TimeZone getOffset API does not  return a dst
    offset between years 2038-2137
    + JDK-8076190: Customizing the generation of a PKCS12 keystore
    + JDK-8153005: Upgrade the default PKCS12 encryption/MAC
    algorithms
    + JDK-8171303: sun/java2d/pipe/InterpolationQualityTest.java
    fails on Windows &amp; Linux
    + JDK-8177068: incomplete classpath causes NPE in Flow
    + JDK-8185734: [Windows] Structured Exception Catcher missing
    around gtest execution
    + JDK-8187450: JNI local refs exceeds capacity warning in
    NetworkInterface::getAll
    + JDK-8190763: Class cast exception on (CompoundEdit)
    UndoableEditEvent.getEdit()
    + JDK-8195841: PNGImageReader.readNullTerminatedString() doesnt
    check for non-null terminated strings with length equal to
    maxLen
    + JDK-8196100: javax/swing/text/JTextComponent/5074573/
    /bug5074573.java fails
    + JDK-8199646: JShell tests: jdk/jshell/
    /FailOverDirectExecutionControlTest.java failed with
    java.lang.UnsupportedOperationException
    + JDK-8206925: Support the certificate_authorities extension
    + JDK-8207160: ClassReader::adjustMethodParams can potentially
    return null if the args list is empty
    + JDK-8207247: AARCH64: Enable Minimal and Client VM builds
    + JDK-8207404: MulticastSocket tests failing on AIX
    + JDK-8207779: Method::is_valid_method() compares 'this' with
    NULL
    + JDK-8208061: runtime/LoadClass/TestResize.java fails with
    "Load factor too high" when running in CDS mode.
    + JDK-8209459: TestSHA512MultiBlockIntrinsics failed on AArch64
    + JDK-8210443: Migrate Locale matching tests to JDK Repo.
    + JDK-8213231: ThreadSnapshot::_threadObj can become stale
    + JDK-8213483: ARM32: runtime/ErrorHandling/
    /ShowRegistersOnAssertTest.java jtreg test fail
    + JDK-8213725: JShell NullPointerException due to class file
    with unexpected package
    + JDK-8213794: ARM32: disable TypeProfiling,
    CriticalJNINatives, Serviceablity tests for ARM32
    + JDK-8213845: ARM32: Interpreter doesn't call result handler
    after native calls
    + JDK-8214128: ARM32: wrong stack alignment on
    Deoptimization::unpack_frames
    + JDK-8214512: ARM32: Jtreg test compiler/c2/Test8062950.java
    fails on ARM
    + JDK-8214854: JDWP: Unforseen output truncation in logging
    + JDK-8214922: Add vectorization support for fmin/fmax
    + JDK-8215009: GCC 8 compilation error in libjli
    + JDK-8216184: CDS/appCDS tests failed on Windows due to long
    path to a classlist file
    + JDK-8216259: AArch64: Vectorize Adler32 intrinsics
    + JDK-8216314: SIGILL in CodeHeapState::print_names()
    + JDK-8217348: assert(thread-&gt;is_Java_thread()) failed: just
    checking
    + JDK-8217465: [REDO] - Optimize CodeHeap Analytics
    + JDK-8217561: X86: Add floating-point Math.min/max intrinsics
    + JDK-8217918: C2: -XX:+AggressiveUnboxing is broken
    + JDK-8218458: [TESTBUG] runtime/NMT/
    /CheckForProperDetailStackTrace.java fails with Expected
    stack trace missing from output
    + JDK-8219142: Remove unused JIMAGE_ResourcePath
    + JDK-8219586: CodeHeap State Analytics processes dead nmethods
    + JDK-8220074: Clean up GCC 8.3 errors in LittleCMS
    + JDK-8220407: compiler/intrinsics/math/
    /TestFpMinMaxIntrinsics.java timedout
    + JDK-8222302: [TESTBUG] test/hotspot/jtreg/compiler/intrinsics/
    /sha/cli/TestUseSHAOptionOnUnsupportedCPU.java fails on any
    other CPU
    + JDK-8222412: AARCH64: multiple instructions encoding issues
    + JDK-8223020: aarch64: expand minI_rReg and maxI_rReg patterns
    into separate instructions
    + JDK-8223444: Improve CodeHeap Free Space Management
    + JDK-8223504: Improve performance of forall loops by better
    inlining of "iterator()" methods
    + JDK-8223667: ASAN build broken
    + JDK-8225081: Remove Telia Company CA certificate expiring in
    April 2021
    + JDK-8225116: Test OwnedWindowsLeak.java intermittently fails
    + JDK-8225438: javax/net/ssl/TLSCommon/
    /TestSessionLocalPrincipal.java failed with Read timed out
    + JDK-8225756: [testbug] compiler/loopstripmining/
    /CheckLoopStripMining.java sets too short a
    SafepointTimeoutDelay
    + JDK-8226374: Restrict TLS signature schemes and named groups
    + JDK-8226627: assert(t-&gt;singleton()) failed: must be a constant
    + JDK-8226721: Missing intrinsics for Math.ceil, floor, rint
    + JDK-8227080: (fs) Files.newInputStream(...).skip(n) is slow
    + JDK-8227222: vmTestbase/jit/FloatingPoint/gen_math/Loops04/
    /Loops04.java failed XMM register should be 0-15
    + JDK-8227609: (fs) Files.newInputStream(...).skip(n) should
    allow skipping beyond file size
    + JDK-8230428: Cleanup dead CastIP node code in formssel.cpp
    + JDK-8231460: Performance issue (CodeHeap) with large free
    blocks
    + JDK-8231713: x86_32 build failures after JDK-8226721 (Missing
    intrinsics for Math.ceil, floor, rint)
    + JDK-8231841: AArch64: debug.cpp help() is missing an AArch64
    line for pns
    + JDK-8232084: HotSpot build failed with GCC 9.2.1
    + JDK-8232591: AArch64: Add missing match rules for smaddl,
    smsubl and smnegl
    + JDK-8233185: HttpServer.stop() blocks indefinitely when
    called on dispatch thread
    + JDK-8233787: Break cycle in vm_version* includes
    + JDK-8233948: AArch64: Incorrect mapping between OptoReg and
    VMReg for high 64 bits of Vector Register
    + JDK-8234355: Buffer overflow in jcmd GC.class_stats due to
    too many classes
    + JDK-8235368: Update BCEL to Version 6.4.1
    + JDK-8236859: WebSocket over authenticating proxy fails with
    NPE
    + JDK-8236992: AArch64: remove redundant load_klass in itable
    stub
    + JDK-8237743: test/langtools/jdk/jshell/
    /FailOverExecutionControlTest.java fails No
    ExecutionControlProvider with name 'nonExistent' and parameter
    keys: []
    + JDK-8237804: sun/security/mscapi tests fail with "Key pair
    not generated, alias &lt;nnnnnn&gt; already exists"
    + JDK-8238175: CTW: Class.getDeclaredMethods fails with
    assert(k-&gt;is_subclass_of(SystemDictionary::Throwable_klass()))
    failed: invalid exception class
    + JDK-8238567: SoftMainMixer.processAudioBuffers(): Wrong
    handling of stoppedMixers
    + JDK-8238812: assert(false) failed: bad AD file
    + JDK-8239312: [macos] javax/swing/JFrame/NSTexturedJFrame/
    /NSTexturedJFrame.java
    + JDK-8239386: handle ContendedPaddingWidth in
    vm_version_aarch64
    + JDK-8239536: Can't use 'java.util.List' object after
    importing 'java.awt.List'
    + JDK-8240487: Cleanup whitespace in .cc, .hh, .m, and .mm files
    + JDK-8240848: ArrayIndexOutOfBoundsException buf for
    TextCallbackHandler
    + JDK-8241082: Upgrade IANA Language Subtag Registry data to
    03-16-2020 version
    + JDK-8241087: Build failure with VS 2019 (16.5.0) due to C2039
    and C2873
    + JDK-8241101: [s390] jtreg test failure after JDK-8238696: not
    conformant features string
    + JDK-8241248: NullPointerException in
    sun.security.ssl.HKDF.extract(HKDF.java:93)
    + JDK-8241372: Several test failures due to
    javax.net.ssl.SSLException: Connection reset
    + JDK-8241475: AArch64: Add missing support for PopCountVI node
    + JDK-8241829: Cleanup the code for PrinterJob on windows
    + JDK-8241960: The SHA3 message digests impl of SUN provider
    are not thread safe after cloned
    + JDK-8242010: Upgrade IANA Language Subtag Registry to Version
    2020-04-01
    + JDK-8242429: Better implementation for sign extract
    + JDK-8242557: Add length limit for strings in PNGImageWriter
    + JDK-8242919: Paste locks up jshell
    + JDK-8243155: AArch64: Add support for SqrtVF
    + JDK-8243240: AArch64: Add support for MulVB
    + JDK-8243452: JFR: Could not create chunk in repository with
    over 200 recordings
    + JDK-8243559: Remove root certificates with 1024-bit keys
    + JDK-8243597: AArch64: Add support for integer vector abs
    + JDK-8244031: HttpClient should have more tests for HEAD
    requests
    + JDK-8244205: HTTP/2 tunnel connections through proxy may be
    reused regardless of which proxy is selected
    + JDK-8244847: Linux/PPC: runtime/CompressedOops/
    /CompressedClassPointers: smallHeapTest fails
    + JDK-8245511: G1 adaptive IHOP does not account for
    reclamation of humongous objects by young GC
    + JDK-8246274: G1 old gen allocation tracking is not in a
    separate class
    + JDK-8247354: [aarch64] PopFrame causes
    assert(oopDesc::is_oop(obj)) failed: not an oop
    + JDK-8247408: IdealGraph bit check expression canonicalization
    + JDK-8247432: Update IANA Language Subtag Registry to Version
    2020-09-29
    + JDK-8247438: JShell: When FailOverExecutionControlProvider
    fails the proximal cause is not shown
    + JDK-8247753: UIManager.getSytemLookAndFeelClassName() returns
    wrong value on Fedora 32
    + JDK-8248043: Need to eliminate excessive i2l conversions
    + JDK-8248411: [aarch64] Insufficient error handling when
    CodeBuffer is exhausted
    + JDK-8248568: compiler/c2/TestBit.java failed: test missing
    from stdout/stderr
    + JDK-8248870: AARCH64: I2L/L2I conversions can be skipped for
    masked positive values
    + JDK-8249142: java/awt/FontClass/CreateFont/DeleteFont.sh is
    unstable
    + JDK-8249189: AARCH64: more L2I conversions can be skipped
    + JDK-8249719: MethodHandle performance suffers from bad
    ResolvedMethodTable hash function
    + JDK-8249875: GCC 10 warnings -Wtype-limits with JFR code
    + JDK-8250635: MethodArityHistogram should use Compile_lock in
    favour of fancy checks
    + JDK-8250876: Fix issues with cross-compile on macos
    + JDK-8251031: Some vmTestbase/nsk/monitoring/RuntimeMXBean
    tests fail with hostnames starting from digits
    + JDK-8251525: AARCH64: Faster Math.signum(fp)
    + JDK-8252259: AArch64: Adjust default value of FLOATPRESSURE
    + JDK-8252311: AArch64: save two words in itable lookup stub
    + JDK-8252779: compiler/graalunit/HotspotTest.java failed after
    8251525
    + JDK-8252883: AccessDeniedException caused by delayed file
    deletion on Windows
    + JDK-8253167: ARM32 builds fail after JDK-8247910
    + JDK-8253572: [windows] CDS archive may fail to open with long
    file names
    + JDK-8253923: C2 doesn't always run loop opts for compilations
    that include loops
    + JDK-8253948: Memory leak in ImageFileReader
    + JDK-8254631: Better support ALPN byte wire values in SunJSSE
    + JDK-8254717: isAssignableFrom checks in
    KeyFactorySpi.engineGetKeySpec appear to be backwards
    + JDK-8255086: Update the root locale display names
    + JDK-8255625: AArch64: Implement Base64.encodeBlock
    accelerator/intrinsic
    + JDK-8255763: C2: OSR miscompilation caused by invalid memory
    instruction placement
    + JDK-8255992: JFR EventWriter does not use first string from
    StringPool with id 0
    + JDK-8256037: [TESTBUG] com/sun/jndi/dns/ConfigTests/
    /PortUnreachable.java fails due to the hard coded threshold
    is small
    + JDK-8256244: java/lang/ProcessHandle/PermissionTest.java
    fails with TestNG 7.1
    + JDK-8256287: [windows] add loop fuse to
    map_or_reserve_memory_aligned
    + JDK-8256523: Streamline Java SHA2 implementation
    + JDK-8257414: Drag n Drop target area is wrong on high DPI
    systems
    + JDK-8257569: Failure observed with
    JfrVirtualMemory::initialize
    + JDK-8257574: C2: "failed: parsing found no loops but there
    are some" assert failure
    + JDK-8257580: Bump update version for OpenJDK: jdk-11.0.12
    + JDK-8257604: JNI_ArgumentPusherVaArg leaks valist
    + JDK-8257621: JFR StringPool misses cached items across
    consecutive recordings
    + JDK-8257796: [TESTBUG]
    TestUseSHA512IntrinsicsOptionOnSupportedCPU.java fails
    on x86_32
    + JDK-8257822: C2 crashes with SIGFPE due to a division that
    floats above its zero check
    + JDK-8257828: SafeFetch may crash if invoked in non-JavaThreads
    + JDK-8257853: Remove dependencies on JNF's JNI utility
    functions in AWT and 2D code
    + JDK-8257858: [macOS]: Remove JNF dependency from
    libosxsecurity/KeystoreImpl.m
    + JDK-8257860: [macOS]: Remove JNF dependency from
    libosxkrb5/SCDynamicStoreConfig.m
    + JDK-8257988: Remove JNF dependency from
    libsaproc/MacosxDebuggerLocal.m
    + JDK-8258414: OldObjectSample events too expensive
    + JDK-8258505: [TESTBUG] TestDivZeroWithSplitIf.java fails due
    to missing UnlockDiagnosticVMOptions
    + JDK-8258753: StartTlsResponse.close() hangs due to
    synchronization issues
    + JDK-8259061: C2: assert(found) failed: memory-writing node is
    not placed in its original loop or an ancestor of it
    + JDK-8259227: C2 crashes with SIGFPE due to a division that
    floats above its zero check
    + JDK-8259232: Bad JNI lookup during printing
    + JDK-8259276: C2: Empty expression stack when reexecuting
    tableswitch/lookupswitch instructions after deoptimization
    + JDK-8259343: [macOS] Update JNI error handling in Cocoa code.
    + JDK-8259585: Accessible actions do not work on mac os x
    + JDK-8259651: [macOS] Replace JNF_COCOA_ENTER/EXIT macros
    + JDK-8259662: Don't wrap SocketExceptions into SSLExceptions
    in SSLSocketImpl
    + JDK-8259710: Inlining trace leaks memory
    + JDK-8259729: Missed JNFInstanceOf -&gt; IsInstanceOf conversion
    + JDK-8259777: Incorrect predication condition generated by ADLC
    + JDK-8259786: initialize last parameter of getpwuid_r
    + JDK-8259843: initialize dli_fname array before calling
    dll_address_to_library_name
    + JDK-8259869: [macOS] Remove desktop module dependencies on
    JNF Reference APIs
    + JDK-8259886: Improve SSL session cache performance and
    scalability
    + JDK-8259983: do not use uninitialized expand_ms value in
    G1CollectedHeap::expand_heap_after_young_collection
    + JDK-8260030: Improve stringStream buffer handling
    + JDK-8260236: better init AnnotationCollector _contended_group
    + JDK-8260255: C1: LoopInvariantCodeMotion constructor can
    leave some fields uninitialized
    + JDK-8260284: C2: assert(_base == Int) failed: Not an Int
    + JDK-8260380: Upgrade to LittleCMS 2.12
    + JDK-8260420: C2 compilation fails with assert(found_sfpt)
    failed: no node in loop that's not input to safepoint
    + JDK-8260426: awt debug_mem.c DMem_AllocateBlock might leak
    memory
    + JDK-8260432: allocateSpaceForGP in freetypeScaler.c might
    leak memory
    + JDK-8260616: Removing remaining JNF dependencies in the
    java.desktop module
    + JDK-8260653: Unreachable nodes keep speculative types alive
    + JDK-8260707: java/lang/instrument/PremainClass/
    /InheritAgent0100.java times out
    + JDK-8260925: HttpsURLConnection does not work  with other
    JSSE provider.
    + JDK-8260926: Trace resource exhausted events unconditionally
    + JDK-8261020: Wrong format parameter in
    create_emergency_chunk_path
    + JDK-8261027: AArch64: Support for LSE atomics C++ HotSpot code
    + JDK-8261167: print_process_memory_info add a close call after
    fopen
    + JDK-8261170: Upgrade to freetype 2.10.4
    + JDK-8261198: [macOS] Incorrect JNI parameters in number
    conversion in A11Y code
    + JDK-8261235: C1 compilation fails with
    assert(res-&gt;vreg_number() == index) failed: conversion check
    + JDK-8261261: The version extra fields needs to be overridable
    in jib-profiles.js
    + JDK-8261262: Kitchensink24HStress.java crashed with
    EXCEPTION_ACCESS_VIOLATION
    + JDK-8261354: SIGSEGV at MethodIteratorHost
    + JDK-8261355: No data buffering in SunPKCS11 Cipher encryption
    when the underlying mechanism has no padding
    + JDK-8261397: try catch Method failing to work when dividing
    an integer by 0
    + JDK-8261422: Adjust problematic String.format calls in
    jdk/internal/util/Preconditions.java outOfBoundsMessage
    + JDK-8261447: MethodInvocationCounters frequently run into
    overflow
    + JDK-8261481: Cannot read Kerberos settings in dynamic store
    on macOS Big Sur
    + JDK-8261505: Test test/hotspot/jtreg/gc/parallel/
    /TestDynShrinkHeap.java killed by Linux OOM Killer
    + JDK-8261601: free memory in early return in
    Java_sun_nio_ch_sctp_SctpChannelImpl_receive0
    + JDK-8261649: AArch64: Optimize LSE atomics in C++ code
    + JDK-8261730: C2 compilation fails with
    assert(store-&gt;find_edge(load) != -1) failed: missing
    precedence edge
    + JDK-8261752: Multiple GC test are missing memory requirements
    + JDK-8261791: (sctp) handleSendFailed in SctpChannelImpl.c
    potential leaks
    + JDK-8261812: C2 compilation fails with assert(!had_error)
    failed: bad dominance
    + JDK-8261914: IfNode::fold_compares_helper faces
    non-canonicalized bool when running JRuby JSON workload
    + JDK-8262093: java/util/concurrent/tck/JSR166TestCase.java
    failed "assert(false) failed: unexpected node"
    + JDK-8262110: DST starts from incorrect time in 2038
    + JDK-8262121: [11u] Redo 8244287: JFR: Methods samples have
    line number 0
    + JDK-8262163: Extend settings printout in jcmd VM.metaspace
    + JDK-8262295: C2: Out-of-Bounds Array Load from Clone Source
    + JDK-8262298: G1BarrierSetC2::step_over_gc_barrier fails with
    assert "bad barrier shape"
    + JDK-8262446: DragAndDrop hangs on Windows
    + JDK-8262461: handle wcstombsdmp return value correctly in
    unix awt_InputMethod.c
    + JDK-8262465: Very long compilation times and high memory
    consumption in C2 debug builds
    + JDK-8262726: AArch64: C1 StubAssembler::call_RT can corrupt
    stack
    + JDK-8262739: String inflation C2 intrinsic prevents insertion
    of anti-dependencies
    + JDK-8262829: Native crash in
    Win32PrintServiceLookup.getAllPrinterNames()
    + JDK-8262837: handle split_USE correctly
    + JDK-8262900: ToolBasicTest fails to access HTTP server it
    starts
    + JDK-8263260: [s390] Support latest hardware (z14 and z15)
    + JDK-8263311: Watch registry changes for remote printers
    update instead of polling
    + JDK-8263361: Incorrect arraycopy stub selected by C2 for SATB
    collectors
    + JDK-8263404: RsaPrivateKeySpec is always recognized as
    RSAPrivateCrtKeySpec in RSAKeyFactory.engineGetKeySpec
    + JDK-8263425: AArch64: two potential bugs in C1
    LIRGenerator::generate_address()
    + JDK-8263448: CTW: fatal error: meet not symmetric
    + JDK-8263504: Some OutputMachOpcodes fields are uninitialized
    + JDK-8263557: Possible NULL dereference in
    Arena::destruct_contents()
    + JDK-8263558: Possible NULL dereference in fast path arena
    free if ZapResourceArea is true
    + JDK-8263676: AArch64: one potential bug in C1
    LIRGenerator::generate_address()
    + JDK-8263729: [test] divert spurious output away from stream
    under test in ProcessBuilder Basic test
    + JDK-8263846: Bad JNI lookup getFocusOwner in accessibility
    code on Mac OS X
    + JDK-8264047: Duplicate global variable 'jvm' in libjavajpeg
    and libawt
    + JDK-8264096: slowdebug jvm crashes when StrInflatedCopy match
    rule is not supported
    + JDK-8264151: ciMethod::ensure_method_data() should return
    false is loading resulted in empty state
    + JDK-8264173: [s390] Improve Hardware Feature Detection And
    Reporting
    + JDK-8264190: Harden TLS interop tests
    + JDK-8264223: CodeHeap::verify fails extra_hops assertion in
    fastdebug test
    + JDK-8264328: Broken license in
    javax/swing/JComboBox/8072767/bug8072767.java
    + JDK-8264360: Loop strip mining verification fails with
    "should be on the backedge"
    + JDK-8264626: C1 should be able to inline excluded methods
    + JDK-8264640: CMS ParScanClosure misses a barrier
    + JDK-8264786: [macos] All Swing/AWT apps cause Allow
    Notifications prompt to appear when app is launched
    + JDK-8264821: DirectIOTest fails on a system with large block
    size
    + JDK-8264848: [macos] libjvm.dylib linker warning due to macOS
    version mismatch
    + JDK-8264923: PNGImageWriter.write_zTXt throws Exception with
    a typo
    + JDK-8264958: C2 compilation fails with assert "n is later
    than its clone"
    + JDK-8265099: Revert backport to 11u of 8236859: WebSocket
    over authenticating proxy fails with NPE
    + JDK-8265154: vinserti128 operand mix up for KNL platforms
    + JDK-8265239: Shenandoah: Shenandoah heap region count could
    be off by 1
    + JDK-8265417: Backport of JDK-8249672 breaks Solaris x86 build
    + JDK-8265421: java/lang/String/StringRepeat.java test is
    missing a memory requirement
    + JDK-8265462: Handle multiple slots in the NSS Internal Module
    from SunPKCS11's Secmod
    + JDK-8265537: x86 version string truncated after JDK-8249672
    11u backport
    + JDK-8265666: Enable AIX build platform to make external debug
    symbols
    + JDK-8265677: CMS: CardTableBarrierSet::write_ref_array_work()
    lacks storestore barrier
    + JDK-8265690: Use the latest Ubuntu base image version in
    Docker testing
    + JDK-8265718: Build failure after JDK-8258414 11u backport
    + JDK-8265750: Fatal error in safepoint.cpp after backport of
    8258414
    + JDK-8265784: [C2] Hoisting of DecodeN leaves MachTemp inputs
    behind
    + JDK-8265938: C2's conditional move optimization does not
    handle top Phi
    + JDK-8266220: keytool still prompt for store password on a
    password-less pkcs12 file if -storetype pkcs12 is specified
    + JDK-8266293: Key protection using PBEWithMD5AndDES fails with
    "java.security.InvalidAlgorithmParameterException: Salt must
    be 8 bytes long"
    + JDK-8266713: [AIX] Build failure after 11u backport of
    JDK-8247753
    + JDK-8266802: Shenandoah: Round up region size to page size
    unconditionally
    + JDK-8266892: avoid maybe-uninitialized gcc warnings on linux
    s390x
    + JDK-8266929: Unable to use algorithms from 3p providers
    + JDK-8267235: [macos_aarch64]
    InterpreterRuntime::throw_pending_exception messing up LR
    results in crash
    + JDK-8267561: Shenandoah: Reference processing not properly
    setup for outside of cycle degenerated GC
    + JDK-8267599: Revert the change to the default PKCS12
    macAlgorithm and macIterationCount props for 11u/8u/7u
    + JDK-8267641: [11u] 8227609 backport typo
    + JDK-8267721: Enable sun/security/pkcs11 tests for Amazon
    Linux 2 AArch64
    + JDK-8268678: LetsEncryptCA.java test fails as Let's Encrypt
    Authority X3 is retired</changelog>
  <changelog author="schwab@suse.de" date="1628078400">- riscv64-zero.patch: Add support for riscv64 (zero VM)</changelog>
  <changelog author="fstrba@suse.com" date="1629979200">- Added patch:
  * jdk11-glibc234.patch
    + fix build with glibc-2.34 (bsc#1189201)</changelog>
  <changelog author="fstrba@suse.com" date="1631534400">- Modified patch:
  * nss-security-provider.patch
    + revert recent changes making NSS provider the default one
    + fixes bsc#1190252</changelog>
  <changelog author="fstrba@suse.com" date="1631793600">- Added patch:
  * fips.patch
    + implement FIPS support in OpenJDK</changelog>
  <changelog author="fstrba@suse.com" date="1634817600">- Update to upstream tag jdk-11.0.13+8 (October 2021 CPU)
  * Security fixes
    + JDK-8163326, CVE-2021-35550, bsc#1191901: Update the default
    enabled cipher suites preference
    + JDK-8254967, CVE-2021-35565, bsc#1191909:
    com.sun.net.HttpsServer spins on TLS session close
    + JDK-8263314: Enhance XML Dsig modes
    + JDK-8265167, CVE-2021-35556, bsc#1191910: Richer Text Editors
    + JDK-8265574: Improve handling of sheets
    + JDK-8265580, CVE-2021-35559, bsc#1191911: Enhanced style for
    RTF kit
    + JDK-8265776: Improve Stream handling for SSL
    + JDK-8266097, CVE-2021-35561, bsc#1191912: Better hashing
    support
    + JDK-8266103: Better specified spec values
    + JDK-8266109: More Resilient Classloading
    + JDK-8266115: More Manifest Jar Loading
    + JDK-8266137, CVE-2021-35564, bsc#1191913: Improve Keystore
    integrity
    + JDK-8266689, CVE-2021-35567, bsc#1191903: More Constrained
    Delegation
    + JDK-8267086: ArrayIndexOutOfBoundsException in
    java.security.KeyFactory.generatePublic
    + JDK-8267712: Better LDAP reference processing
    + JDK-8267729, CVE-2021-35578, bsc#1191904: Improve TLS client
    handshaking
    + JDK-8267735, CVE-2021-35586, bsc#1191914: Better BMP support
    + JDK-8268193: Improve requests of certificates
    + JDK-8268199: Correct certificate requests
    + JDK-8268205: Enhance DTLS client handshake
    + JDK-8268506: More Manifest Digests
    + JDK-8269618, CVE-2021-35603, bsc#1191906: Better session
    identification
    + JDK-8269624: Enhance method selection support
    + JDK-8270398: Enhance canonicalization
    + JDK-8270404: Better canonicalization
  * Other changes
    + JDK-8024368: private methods are allocated vtable indices
    + JDK-8042902: Test java/net/Inet6Address/serialize/
    /Inet6AddressSerializationTest.java fails intermittently
    + JDK-8140466: ChaCha20 and Poly1305 TLS Cipher Suites
    + JDK-8157404: Unable to read certain PKCS12 keystores from
    SequenceInputStream
    + JDK-8158066: SourceDebugExtensionTest fails to rename file
    + JDK-8168304: Make all of DependencyContext_test available in
    product mode
    + JDK-8169246: java/net/DatagramSocket/ReportSocketClosed.java
    fails intermittently with BindException
    + JDK-8181313: SA: Remove libthread_db dependency on Linux
    + JDK-8193214: Incorrect annotations.without.processors
    warnings with JDK 9
    + JDK-8194230: jdk/internal/jrtfs/remote/
    /RemoteRuntimeImageTest.java fails with
    java.lang.NullPointerException
    + JDK-8196092: javax/swing/JComboBox/8032878/bug8032878.java
    fails
    + JDK-8199931: java/net/MulticastSocket/
    /UnreferencedMulticastSockets.java fails with "incorrect data
    received"
    + JDK-8206083: Make tools/javac/api/T6265137.java robust to JDK
    version changes
    + JDK-8206350: java/util/Locale/bcp47u/SystemPropertyTests.java
    failed on Mac 10.13 with zh_CN and zh_TW locales.
    + JDK-8207316: java/nio/channels/spi/SelectorProvider/
    /inheritedChannel/InheritedChannelTest.java failed
    + JDK-8208227: tools/jdeps/DotFileTest.java fails on Win-X64
    + JDK-8208363: test/jdk/java/lang/Package/
    /PackageFromManifest.java missing module dependencies
    declaration
    + JDK-8209380: ARM: cleanup maybe-uninitialized and reorder
    compiler warnings
    + JDK-8209768: Refactor java/util/prefs/CheckUserPrefsStorage.sh
    to plain java test
    + JDK-8209772: Refactor shell test java/util/ServiceLoader/
    /basic/basic.sh to java
    + JDK-8209773: Refactor shell test javax/naming/module/basic.sh
    to java
    + JDK-8209832: Refactor jdk/internal/reflect/Reflection/
    /GetCallerClassTest.sh to plain java test
    + JDK-8209930: Refactor java/util/zip/ZipFile/deletetempjar.sh
    to plain java test
    + JDK-8210406: Refactor java.util.PluggableLocale:i18n shell
    tests to plain java tests
    + JDK-8210407: Refactor java.util.Calendar:i18n shell tests to
    plain java tests
    + JDK-8210495: compiler crashes because of illegal signature in
    otherwise legal code
    + JDK-8210669: Some launcher tests assume a pre-JDK 9 run-time
    image layout
    + JDK-8210802: temp files left by tests in
    jdk/java/net/httpclient
    + JDK-8210819: Update the host name in CNameTest.java
    + JDK-8210908: Refactor java/util/prefs/PrefsSpi.sh to plain
    java test
    + JDK-8210934: Move sun/net/www/protocol/http/
    /GetErrorStream.java to OpenJDK
    + JDK-8210959: JShell fails and exits when statement throws an
    exception whose message contains a '%'.
    + JDK-8211055: Provide print to a file (PDF) feature even when
    printer was not connected
    + JDK-8211092: test/jdk/sun/net/www/http/HttpClient/
    /MultiThreadTest.java fails intermittently when cleaning up
    + JDK-8211296: Remove HotSpot deprecation warning suppression
    for Mac/clang
    + JDK-8211325: test/jdk/java/net/Socket/LingerTest.java fails
    with cleaning up
    + JDK-8212040: Compilation error due to wrong usage of
    NSPrintJobDispositionValue in mac10.12
    + JDK-8212695: Add explicit timeout to several HTTP Client tests
    + JDK-8212718: Refactor some annotation processor tests to
    better use collections
    + JDK-8213007: Update the link in test/jdk/sun/security/
    /provider/SecureRandom/DrbgCavp.java
    + JDK-8213137: Remove static initialization of monitor/mutex
    instances
    + JDK-8213235: java/nio/channels/SocketChannel/
    /AsyncCloseChannel.java fails with threads that didn't exit
    + JDK-8213409: Refactor sun.text.IntHashtable:i18n shell tests
    to plain java tests
    + JDK-8213576: Make test AsyncCloseChannel.java run in othervm
    + JDK-8213694: Test Timeout.java should run in othervm mode
    + JDK-8213718: [TEST] Wrong classname in vmTestbase/nsk/stress/
    /except/except002 and except003
    + JDK-8213922: fix ctw stand-alone build
    + JDK-8214195: Align stdout messages in
    test/jdk/java/math/BigInteger/PrimitiveConversionTests.java
    + JDK-8214520: [TEST_BUG] sun/security/mscapi/nonUniqueAliases/
    /NonUniqueAliases.java failed with incorrect jtreg tags order
    + JDK-8214937: sun/security/tools/jarsigner/warnings/
    /NoTimestampTest.java failed due to unexpected expiration date
    + JDK-8216532: tools/launcher/Test7029048.java fails (Solaris)
    + JDK-8217825: Verify @AfterTest is used correctly in WebSocket
    tests
    + JDK-8218145: block_if_requested is not proper inlined due to
    size
    + JDK-8219417: bump jtreg requiredVersion to b14
    + JDK-8219552: bump jtreg requiredVersion to b14 in
    test/jdk/sanity/client/
    + JDK-8219804: java/net/MulticastSocket/Promiscuous.java fails
    intermittently due to NumberFormatException
    + JDK-8220445: Support for side by side MSVC Toolset versions
    + JDK-8221988: add possibility to build with Visual Studio 2019
    + JDK-8222751: closed/test/jdk/sun/security/util/
    /DerIndefLenConverter/IndefBerPkcs12.java fail
    + JDK-8223050: JVMCI: findUniqueConcreteMethod() should not use
    Dependencies::find_unique_concrete_method() for non-virtual
    methods
    + JDK-8224853: CDS address sanitizer errors
    + JDK-8225082: Remove IdenTrust certificate that is expiring in
    September 2021
    + JDK-8225583: Examine the HttpResponse.BodySubscribers for
    null handling and multiple subscriptions
    + JDK-8225690: Multiple AttachListener threads can be created
    + JDK-8225790: Two NestedDialogs tests fail on Ubuntu
    + JDK-8226319: Add forgotten test/jdk/java/net/httpclient/
    /BodySubscribersTest.java
    + JDK-8226533: JVMCI: findUniqueConcreteMethod should handle
    statically bindable methods directly
    + JDK-8226602: Test convenience reactive primitives from
    java.net.http with RS TCK
    + JDK-8226683: Remove review suggestion from fix to 8219804
    + JDK-8227738: jvmti/DataDumpRequest/datadumpreq001 failed due
    to "exit code is 134"
    + JDK-8227766: CheckUnhandledOops is broken in MemAllocator
    + JDK-8227815: Minimal VM: set_state is not a member of
    AttachListener
    + JDK-8230674: Heap dumps should exclude dormant CDS archived
    objects of unloaded classes
    + JDK-8230808: Remove Access::equals()
    + JDK-8230841: Remove oopDesc::equals()
    + JDK-8231717: Improve performance of charset decoding when
    charset is always compactable
    + JDK-8232243: Wrong caret position in JTextPane on Windows
    with a screen resolution &gt; 100%
    + JDK-8232782: Shenandoah: streamline post-LRB CAS barrier
    (aarch64)
    + JDK-8233790: Forward output from heap dumper to jcmd/jmap
    + JDK-8233989: Create an IPv4 version of
    java/net/MulticastSocket/SetLoopbackMode.java
    + JDK-8234510: Remove file seeking requirement for writing a
    heap dump
    + JDK-8235211: serviceability/attach/
    /RemovingUnixDomainSocketTest.java fails with
    AttachNotSupportedException: Unable to open socket file
    + JDK-8235216: typo in test filename
    + JDK-8235866: bump jtreg requiredVersion to 4.2b16
    + JDK-8236111: narrow allowSmartActionArgs disabling
    + JDK-8236413: AbstractConnectTimeout should tolerate both
    NoRouteToHostException and UnresolvedAddressException
    + JDK-8236671: NullPointerException in JKS keystore
    + JDK-8238930: problem list compiler/c2/Test8004741.java
    + JDK-8238943: switch to jtreg 5.0
    + JDK-8240555: Using env of JAVA_TOOL_OPTIONS and _JAVA_OPTIONS
    breaks QuietOption.java test
    + JDK-8240983: Incorrect copyright header in Apache Santuario
    2.1.3 files
    + JDK-8241336: Some java.net tests failed with
    NoRouteToHostException on MacOS with special network
    configuration
    + JDK-8241353: NPE in ToolProvider.getSystemJavaCompiler
    + JDK-8241768: git needs .gitattributes
    + JDK-8242882: opening jar file with large manifest might throw
    NegativeArraySizeException
    + JDK-8244973: serviceability/attach/
    /RemovingUnixDomainSocketTest.java fails "stderr was not
    empty"
    + JDK-8245134: test/lib/jdk/test/lib/security/
    /KeyStoreUtils.java should allow to specify aliases
    + JDK-8246261: TCKLocalTime.java failed due to "AssertionError:
    expected [18:14:22] but found [18:14:23]"
    + JDK-8246387: switch to jtreg 5.1
    + JDK-8247421: [TESTBUG] ReturnBlobToWrongHeapTest.java failed
    allocating blob
    + JDK-8247469: getSystemCpuLoad() returns -1 on linux when some
    offline cpus are present and cpusets.effective_cpus is not
    available
    + JDK-8248352: [TEST_BUG] Test test/jdk/java/awt/font/
    /TextLayout/ArabicDiacriticTest.java can leave frame open
    + JDK-8248403: AArch64: Remove uses of kernel integer types
    + JDK-8248414: AArch64: Remove uses of long and unsigned long
    ints
    + JDK-8248657: Windows: strengthening in ThreadCritical
    regarding memory model
    + JDK-8248666: AArch64: Use THREAD_LOCAL instead of __thread
    + JDK-8248668: AArch64: Avoid MIN/MAX macros when using MSVC
    + JDK-8248671: AArch64: Remove unused variables
    + JDK-8248682: AArch64: Use ATTRIBUTE_ALIGNED helper
    + JDK-8248816: C1: Fix signature conflict in
    LIRGenerator::strength_reduce_multiply
    + JDK-8249095: tools/javac/launcher/SourceLauncherTest.java
    fails on Windows
    + JDK-8249548: backward focus traversal gets stuck in button
    group
    + JDK-8249773: Upgrade ReceiveISA.java test to be resilient to
    failure due to stray packets and interference
    + JDK-8249897: jdk/javadoc/tool/LangVers.java uses @ignore w/o
    bug-id
    + JDK-8249898: jdk/javadoc/tool/6176978/T6176978.java uses
    @ignore w/o bug-id
    + JDK-8249899: jdk/javadoc/tool/InlineTagsWithBraces.java uses
    @ignore w/o bug-id
    + JDK-8250588: Shenandoah: LRB needs to save/restore fp
    registers for runtime call
    + JDK-8250824: AArch64: follow up for JDK-8248414
    + JDK-8251166: Add automated testcases for changes done in
    JDK-8214112
    + JDK-8251252: Add automated testcase for fix done in
    JDK-8214253
    + JDK-8251254: Add automated test for fix done in JDK-8218472
    + JDK-8251361: Potential race between Logger configuration and
    GCs in HttpURLConWithProxy test
    + JDK-8251549: Update docs on building for Git
    + JDK-8251945: SIGSEGV in
    PackageEntry::purge_qualified_exports()
    + JDK-8252194: Add automated test for fix done in JDK-8218469
    + JDK-8252648: Shenandoah: name gang tasks consistently
    + JDK-8252825: Add automated test for fix done in JDK-8218479
    + JDK-8252853: AArch64: gc/shenandoah/TestVerifyJCStress.java
    fails intermittently with C1
    + JDK-8252857: AArch64: Shenandoah C1 CAS is not sequentially
    consistent
    + JDK-8253048: AArch64: When CallLeaf, no need to preserve
    callee-saved registers in caller
    + JDK-8253424: Add support for running pre-submit testing using
    GitHub Actions
    + JDK-8253631: Remove unimplemented CompileBroker methods after
    JEP-165
    + JDK-8253865: Pre-submit testing using GitHub Actions does not
    detect failures reliably
    + JDK-8253899: Make IsClassUnloadingEnabled signature match
    specification
    + JDK-8254024: Enhance native libs for AWT and Swing to work
    with GraalVM Native Image
    + JDK-8254054: Pre-submit testing using GitHub Actions should
    not use the deprecated set-env command
    + JDK-8254173: Add Zero, Minimal hotspot targets to submit
    workflow
    + JDK-8254175: Build no-pch configuration in debug mode for
    submit checks
    + JDK-8254244: Some code emitted by TemplateTable::branch is
    unused when running TieredCompilation
    + JDK-8254270: linux 32 bit build doesn't compile
    libjdwp/log_messages.c
    + JDK-8254282: Add Linux x86_32 builds to submit workflow
    + JDK-8254850: Update terminology in java.awt.GridBagLayout
    source code comments
    + JDK-8255255: Update Apache Santuario (XML Signature) to
    version 2.2.1
    + JDK-8255305: Add Linux x86_32 tier1 to submit workflow
    + JDK-8255352: Archive important test outputs in submit workflow
    + JDK-8255373: Submit workflow artifact name is always
    "test-results_.zip"
    + JDK-8255452: Doing GC during JVMTI MethodExit event posting
    breaks return oop
    + JDK-8255718: Zero: VM should know it runs in interpreter-only
    mode
    + JDK-8255790: GTKL&amp;F: Java 16 crashes on initialising GTKL&amp;F
    on Manjaro Linux
    + JDK-8255810: Zero: build fails without JVMTI
    + JDK-8255895: Submit workflow artifacts miss hs_errs/replays
    due to ZIP include mismatch
    + JDK-8256127: Add cross-compiled foreign architectures builds
    to submit workflow
    + JDK-8256215: Shenandoah: re-organize saving/restoring machine
    state in assembler code
    + JDK-8256267: Relax compiler/floatingpoint/NaNTest.java for
    x86_32 and lower -XX:+UseSSE
    + JDK-8256277: Github Action build on macOS should define OS
    and Xcode versions
    + JDK-8256354: Github Action build on Windows should define OS
    and MSVC versions
    + JDK-8256393: Github Actions build on Linux should define OS
    and GCC versions
    + JDK-8256414: add optimized build to submit workflow
    + JDK-8256747: GitHub Actions: decouple the hotspot build-only
    jobs from Linux x64 testing
    + JDK-8257056: Submit workflow should apt-get update to avoid
    package installation errors
    + JDK-8257148: Remove obsolete code in AWTView.m
    + JDK-8257497: Update keytool to create AKID from the SKID of
    the issuing certificate as specified by RFC 5280
    + JDK-8257620: Do not use objc_msgSend_stret to get macOS
    version
    + JDK-8257913: Add more known library locations to simplify
    Linux cross-compilation
    + JDK-8258703: Incorrect 512-bit vector registers restore on
    x86_32
    + JDK-8259338: Add expiry exception for identrustdstx3 alias to
    VerifyCACerts.java test
    + JDK-8259535: ECDSA SignatureValue do not always have the
    specified length
    + JDK-8259679: GitHub actions should use MSVC 14.28
    + JDK-8259924: GitHub actions fail on Linux x86_32 with "Could
    not configure libc6:i386"
    + JDK-8260460: GitHub actions still fail on Linux x86_32 with
    "Could not configure libc6:i386"
    + JDK-8260589: Crash in JfrTraceIdLoadBarrier::load(_jclass*)
    + JDK-8260923: Add more tests for SSLSocket input/output
    shutdown
    + JDK-8261072: AArch64: Fix MacroAssembler::get_thread
    convention
    + JDK-8261147: C2: Node is wrongly marked as reduction
    resulting in a wrong execution due to wrong vector instructions
    + JDK-8261238: NMT should not limit baselining by size threshold
    + JDK-8261496: Shenandoah: reconsider pacing updates memory
    ordering
    + JDK-8261652: Remove some dead comments from os_bsd_x86
    + JDK-8261846: [JVMCI] c2v_iterateFrames can get out of sync
    with the StackFrameStream
    + JDK-8262000: jdk/jfr/event/gc/detailed/
    /TestPromotionFailedEventWithParallelScavenge.java failed with
    "OutOfMemoryError: Java heap space"
    + JDK-8262017: C2: assert(n != __null) failed: Bad immediate
    dominator info.
    + JDK-8262392: Update Mesa 3-D Headers to version 21.0.3
    + JDK-8262409: sun/security/ssl/SSLSocketImpl/
    /SSLSocketImplThrowsWrongExceptions. SSL test failures caused
    by java failed with "Server reported the wrong exception"
    + JDK-8262470: Printed GlyphVector outline with low DPI has bad
    quality on Windows
    + JDK-8262862: Harden tests sun/security/x509/URICertStore/
    /ExtensionsWithLDAP.java and krb5/canonicalize/Test.java
    + JDK-8263136: C4530 was reported from VS 2019 at access bridge
    + JDK-8263227: C2: inconsistent spilling due to dead nodes in
    exception block
    + JDK-8263382: java/util/logging/ParentLoggersTest.java failed
    with "checkLoggers: getLoggerNames() returned unexpected
    loggers"
    + JDK-8263407: SPARC64 detection fails on Athena (SPARC64-X)
    + JDK-8263432: javac may report an invalid package/class clash
    on case insensitive filesystems
    + JDK-8263490: [macos] Crash occurs on JPasswordField with
    activated InputMethod
    + JDK-8263531: Remove unused buffer int
    + JDK-8263667: Avoid running GitHub actions on branches named
    pr/*
    + JDK-8263776: [JVMCI] add helper to perform Java upcalls
    + JDK-8264016: [JVMCI] add some thread local fields for use by
    JVMCI
    + JDK-8264752: SIGFPE crash with option
    FlightRecorderOptions:threadbuffersize=30M
    + JDK-8265132: C2 compilation fails with assert "missing
    precedence edge"
    + JDK-8265231: (fc) ReadDirect and WriteDirect tests fail after
    fix for JDK-8264821
    + JDK-8265335: Epsilon: Minor typo in EpsilonElasticTLABDecay
    description
    + JDK-8265756: AArch64: initialize memory allocated for locals
    according to Windows AArch64 stack page growth requirement in
    template interpreter
    + JDK-8265761: Font with missed font family name is not
    properly printed on Windows
    + JDK-8265773: incorrect jdeps message "jdk8internals" to
    describe a removed JDK internal API
    + JDK-8265836: OperatingSystemImpl.getCpuLoad() returns
    incorrect CPU load inside a container
    + JDK-8266018: Shenandoah: fix an incorrect assert
    + JDK-8266206: Build failure after JDK-8264752 with older GCCs
    + JDK-8266248: Compilation failure in
    PLATFORM_API_MacOSX_MidiUtils.c with Xcode 12.5
    + JDK-8266288: assert root method not found in
    witnessed_reabstraction_in_supers is too strong
    + JDK-8266404: Fatal error report generated with
  - XX:+CrashOnOutOfMemoryError should not contain suggestion to
    submit a bug report
    + JDK-8266480: Implicit null check optimization does not update
    control of hoisted memory operation
    + JDK-8266615: C2 incorrectly folds subtype checks involving an
    interface array
    + JDK-8266642: Improve ResolvedMethodTable hash function
    + JDK-8266749: AArch64: Backtracing broken on PAC enabled
    systems
    + JDK-8266761: AssertionError in
    sun.net.httpserver.ServerImpl.responseCompleted
    + JDK-8266813: Shenandoah: Use shorter instruction sequence for
    checking if marking in progress
    + JDK-8267042: bug in monitor locking/unlocking on ARM32 C1 due
    to uninitialized BasicObjectLock::_displaced_header
    + JDK-8267348: Rewrite gc/epsilon/TestClasses.java to use
    Metaspace with less classes
    + JDK-8267396: Avoid recording "pc" in unhandled oops detector
    for better performance
    + JDK-8267399: C2: java/text/Normalizer/ConformanceTest.java
    test failed with assertion
    + JDK-8267424: CTW: C1 fails with "State must not be null"
    + JDK-8267459: Pasting Unicode characters into JShell does not
    work.
    + JDK-8267625: AARCH64: typo in LIR_Assembler::emit_profile_type
    + JDK-8267666: Add option to jcmd GC.heap_dump to use existing
    file
    + JDK-8267695: Bump update version for OpenJDK: jdk-11.0.13
    + JDK-8267751: (test) jtreg.SkippedException has no serial
    VersionUID
    + JDK-8267773: PhaseStringOpts::int_stringSize doesn't handle
    min_jint correctly
    + JDK-8268103: JNI functions incorrectly return a double after
    JDK-8265836
    + JDK-8268127: Shenandoah: Heap size may be too small for
    region to align to large page size
    + JDK-8268261: C2: assert(n != __null) failed: Bad immediate
    dominator info.
    + JDK-8268347: C2: nested locks optimization may create
    unbalanced monitor enter/exit code
    + JDK-8268360: Missing check for infinite loop during node
    placement
    + JDK-8268362: [REDO] C2 crash when compile negative
    Arrays.copyOf length after loop
    + JDK-8268366: Incorrect calculation of has_fpu_registers in C1
    linear scan
    + JDK-8268369: SIGSEGV in PhaseCFG::implicit_null_check due to
    missing null check
    + JDK-8268417: Add test from JDK-8268360
    + JDK-8268427: Improve AlgorithmConstraints:checkAlgorithm
    performance
    + JDK-8268617: [11u REDO] - WebSocket over authenticating proxy
    fails with NPE
    + JDK-8268620: InfiniteLoopException test may fail on x86
    platforms
    + JDK-8268635: Corrupt oop in ClassLoaderData
    + JDK-8268699: Shenandoah: Add test for JDK-8268127
    + JDK-8268771: javadoc -notimestamp option does not work on
    index.html
    + JDK-8268775: Password is being converted to String in
    AccessibleJPasswordField
    + JDK-8268776: Test `ADatagramSocket.java` missing /othervm
    from @run tag
    + JDK-8268965: TCP Connection Reset when connecting simple
    socket to SSL server
    + JDK-8269304: Regression ~5% in 2005 in b27
    + JDK-8269415: [11u] Remove ea from
    DEFAULT_PROMOTED_VERSION_PRE in OpenJDK 11u
    + JDK-8269478: Shenandoah: gc/shenandoah/mxbeans tests should
    be more resilient
    + JDK-8269529: javax/swing/reliability/
    /HangDuringStaticInitialization.java fails in Windows debug
    build
    + JDK-8269594: assert(_handle_mark_nesting &gt; 1) failed: memory
    leak: allocating handle outside HandleMark
    + JDK-8269614: [s390] Interpreter checks wrong bit for slow
    path instance allocation
    + JDK-8269650: Optimize gc-locker in
    [Get|Release]StringCritical for latin string
    + JDK-8269661: JNI_GetStringCritical does not lock char array
    + JDK-8269668: [aarch64] java.library.path not including
    /usr/lib64
    + JDK-8269763: The JEditorPane is blank after JDK-8265167
    + JDK-8269795: C2: Out of bounds array load floats above its
    range check in loop peeling resulting in SEGV
    + JDK-8269847: JDK-8269594 backport breaks 11u builds
    + JDK-8269850: Most JDK releases report macOS version 12 as
    10.16 instead of 12.0
    + JDK-8269851: OperatingSystemMXBean getProcessCpuLoad reports
    incorrect process cpu usage in containers
    + JDK-8269882: stack-use-after-scope in NewObjectA
    + JDK-8269934: RunThese24H.java failed with
    EXCEPTION_ACCESS_VIOLATION in
    java_lang_Thread::get_thread_status
    + JDK-8270096: Shenandoah: Optimize gc/shenandoah/
    /TestRefprocSanity.java for interpreter mode
    + JDK-8270137: Kerberos Credential Retrieval from Cache not
    Working in Cross-Realm Setup
    + JDK-8270184: [TESTBUG] Add coverage for jvmci
    ResolvedJavaType.toJavaName() for lambdas
    + JDK-8270196: [11u] [JVMCI] JavaType.toJavaName() returns
    incorrect type name for lambdas
    + JDK-8270556: Exclude security/infra/java/security/cert/
    /CertPathValidator/certification/LetsEncryptCA
    + JDK-8270893: IndexOutOfBoundsException while reading large
    TIFF file
    + JDK-8272078: Wrong Checksums in Temurin BootJDK dependencies
    + JDK-8272124: Cgroup v1 initialization causes
    NullPointerException when cgroup path contains colon
    + JDK-8272131: PhaseMacroExpand::generate_slow_arraycopy crash
    when clone null CallProjections.fallthrough_ioproj
    + JDK-8272197: Update 11u GHA workflow with Shenandoah
    configurations
    + JDK-8272332: --with-harfbuzz=system doesn't add -lharfbuzz
    after JDK-8255790
    + JDK-8272472: StackGuardPages test doesn't build with glibc
    2.34
    + JDK-8272602: [macos] not all KEY_PRESSED events sent when
    control modifier is used
    + JDK-8272628: Problemlist gc/stress/gcbasher/
    /TestGCBasherWithCMS.java for x86_32
    + JDK-8272700: [macos] Build failure with Xcode 13.0 after
    JDK-8264848
    + JDK-8272772: Shenandoah: compiler/c2/aarch64/
    /TestVolatilesShenandoah.java fails in 11u
    + JDK-8273939: Backport of 8248414 to JDK11 breaks
    MacroAssembler::adrp
- Remove the unneeded icedtea-sound provider
- Removed patches:
  * icedtea-sound-1.0.1-jdk9.patch
  * icedtea-sound-soundproperties.patch
    + not needed since the icedtea-sound provider is removed
  * jdk11-glibc234.patch
    + integrated upstream</changelog>
  <changelog author="fstrba@suse.com" date="1635940800">- Modified patches:
  * system-crypto-policy.patch
    + rediff to changed context
  * fips.patch
    + Allow plain key import in fips mode unless
    com.suse.fips.plainKeySupport is set to false</changelog>
  <changelog author="fstrba@suse.com" date="1636113600">- Modified patch:
  * fips.patch
    + return in native code after generating java.io.IOException</changelog>
</package>
<package pkgid="354fc3f9f2f576c76074627a64f64f1b37bd526751aa9898078760377f2ca4ea" name="java-11-openjdk-headless" arch="s390x">
  <version epoch="0" ver="11.0.13.0" rel="3.68.1"/>
  <changelog author="fstrba@suse.com" date="1586952000">- The pack200 and unpack200 alternatives should be slaves of java
  and not of javac, since they are part of JRE.</changelog>
  <changelog author="fstrba@suse.com" date="1587470400">- Update to upstream tag jdk-11.0.7+10 (April 2020 CPU,
  bsc#1169511)
  * Security fixes:
    + S8223898, CVE-2020-2754: Forward references to Nashorn
    + S8223904, CVE-2020-2755: Improve Nashorn matching
    + S8224541, CVE-2020-2756: Better mapping of serial ENUMs
    + S8224549, CVE-2020-2757: Less Blocking Array Queues
    + S8225603: Enhancement for big integers
    + S8226346: Build better binary builders
    + S8227467: Better class method invocations
    + S8227542: Manifest improved jar headers
    + S8229733: TLS message handling improvements
    + S8231415, CVE-2020-2773: Better signatures in XML
    + S8231785: Improved socket permissions
    + S8232424, CVE-2020-2778: More constrained algorithms
    + S8232581, CVE-2020-2767: Improve TLS verification
    + S8233250: Better X11 rendering
    + S8233410: Better Build Scripting
    + S8234027: Better JCEKS key support
    + S8234408, CVE-2020-2781: Improve TLS session handling
    + S8234825, CVE-2020-2800: Better Headings for HTTP Servers
    + S8234841, CVE-2020-2803: Enhance buffering of byte buffers
    + S8235274, CVE-2020-2805: Enhance typing of methods
    + S8235691, CVE-2020-2816: Enhance TLS connectivity
    + S8236201, CVE-2020-2830: Better Scanner conversions
    + S8238960: linux-i586 builds are inconsistent as the newly
    built jdk is not able to reserve enough space for object heap
  * Other changes:
    + S4919790: Errors in alert ssl message does not reflect the
    actual certificate status
    + S4949105: Access Bridge lacks html tags parsing
    + S7092821: java.security.Provider.getService() is synchronized
    and became scalability bottleneck
    + S7143743: Potential memory leak with zip provider
    + S8005819: Support cross-realm MSSFU
    + S8042383: [TEST_BUG] Test javax/swing/plaf/basic/BasicMenuUI/
    /4983388/bug4983388.java fails with shortcuts on menus do not
    work
    + S8068184: Fix for JDK-8032832 caused a deadlock
    + S8145845: [AOT] NullPointerException in
    compiler/whitebox/GetCodeHeapEntriesTest.java
    + S8152988: [AOT] Update test batch definitions to include
    aot-ed java.base module mode into hs-comp testing
    + S8160926: FLAGS_COMPILER_CHECK_ARGUMENTS doesn't handle
    cross-compilation
    + S8163083: SocketListeningConnector does not allow invocations
    with port 0
    + S8163251: Hard coded loop limit prevents reading of smart
    card data greater than 8k
    + S8167276: jvmci/compilerToVM/MaterializeVirtualObjectTest.java
    fails with -XX:-EliminateAllocations
    + S8169718: nsk/jdb/locals/locals002: ERROR: Cannot find
    boolVar with expected value: false
    + S8176556:
    java/awt/dnd/ImageTransferTest/ImageTransferTest.java fails
    for JFIF
    + S8178798: Two compiler/aot/verification/vmflags tests fail by
    timeout with UseAVX=3
    + S8183107: PKCS11 regression regarding checkKeySize
    + S8185005: Improve performance of
    ThreadMXBean.getThreadInfo(long ids[], int maxDepth)
    + S8189633: Missing -Xcheck:jni checking for DeleteWeakGlobalRef
    + S8189861: Refactor CacheFind
    + S8193042: NativeLookup::lookup_critical_entry() should only
    load shared library once
    + S8193596: java/net/DatagramPacket/ReuseBuf.java failed due to
    timeout
    + S8194944: Regression automated test 'open/test/jdk/javax/
    /swing/JInternalFrame/8145896/TestJInternalFrameMaximize.java'
    fails
    + S8196467: javax/swing/JInternalFrame/Test6325652.java fails
    + S8196969: JTreg Failure: serviceability/sa/ClhsdbJstack.java
    causes NPE
    + S8198321: javax/swing/JEditorPane/5076514/bug5076514.java
    fails
    + S8198398: Test javax/swing/JColorChooser/Test6199676.java
    fails in mach5
    + S8199072: Test javax/swing/GroupLayout/6613904/
    /bug6613904.java is unstable
    + S8200432: javadoc fails with ClassCastException on {@link
    byte[]}
    + S8201349: build broken when configured with
  - -with-zlib=bundled on gcc 7.3
    + S8201355: Avoid native memory allocation in
    sun.security.mscapi.PRNG.generateSeed
    + S8201513: nsk/jvmti/IterateThroughHeap/filter-* are broken
    + S8203364: Some serviceability/sa/ tests intermittently fail
    with java.io.IOException: LingeredApp terminated with non-zero
    exit code 3
    + S8203687: javax/net/ssl/compatibility/Compatibility.java
    supports TLS 1.3
    + S8203904: javax/swing/JSplitPane/4816114/bug4816114.java: The
    divider location is wrong
    + S8203911: Test runtime/modules/getModuleJNI/GetModule fails
    with -Xcheck:jni
    + S8204525: [TESTBUG] runtime/NMT/MallocStressTest.java ran out
    of java heap
    + S8204529: gc/TestAllocateHeapAtMultiple.java fail with Agent
    7 timed out
    + S8204551: Event descriptions are truncated in logs
    + S8206963: [AOT] bug with multiple class loaders
    + S8207367: 10 vmTestbase/nsk/jdi tests timed out when running
    with jtreg
    + S8207832: serviceability/sa/ClhsdbCDSCore.java failed with
    "Couldn't find core file location"
    + S8207938: At step6,Click Add button,case failed automatically.
    + S8208157: requires.VMProps throws NPE for missing properties
    in "release" file
    + S8208379: compiler/jvmci/events/
    /JvmciNotifyInstallEventTest.java failed with "Got unexpected
    event count after 2nd install attempt: expected 9 to equal 2"
    + S8208658: Make CDS archived heap regions usable even if
    compressed oop encoding has changed
    + S8208715: Conversion of milliseconds to nanoseconds in
    UNIXProcess contains bug
    + S8209361: [AOT] Unexpected number of references for
    JVMTI_HEAP_REFERENCE_CONSTANT_POOL [111--&gt;111]: 0 (expected
    at least 1)
    + S8209385: CDS runtime classpath checking is too strict when
    only classes from the system modules are archived
    + S8209389: SIGSEGV in WalkOopAndArchiveClosure::do_oop_work.
    + S8209418: Synchronize test/jdk/sanity/client/lib/jemmy with
    code-tools/jemmy/v2
    + S8209494: Create a test for SwingSet InternalFrameDemo
    + S8209499: Create test for SwingSet EditorPaneDemo
    + S8209574: [AOT] breakpoint events are generated in different
    threads does not meet expected count
    + S8209686: cleanup arguments to PhaseIdealLoop() constructor
    + S8209789: Synchronize test/jdk/sanity/client/lib/jemmy with
    code-tools/jemmy/v2
    + S8209802: Garbage collectors should register JFR types
    themselves to avoid build errors.
    + S8209807: improve handling exception in requires.VMProps
    + S8209817: stack is executable when building with Clang on
    Linux
    + S8209824: Improve the code coverage for ThreadLocal
    + S8209826: Undefined reference to os::write after JDK-8209657
    (filemap.hpp cleanup)
    + S8209850: Allow NamedThreads to use GlobalCounter critical
    sections
    + S8209976: Improve iteration over non-JavaThreads
    + S8209993: Create a test for SwingSet3 ToolTipDemo
    + S8210024: JFR calls virtual is_Java_thread from ~Thread()
    + S8210052: Enable testing for all the available look and feels
    in SwingSet3 demo tests
    + S8210055: Enable different look and feel tests in SwingSet3
    demo tests
    + S8210057: Enable different look and feels in SwingSet3 demo
    test InternalFrameDemoTest
    + S8210058: Algorithmic Italic font leans opposite angle in
    Printing
    + S8210220: [AOT] jdwp test cases are failing with error #
    ERROR: TEST FAILED: Cought IOException while receiving event
    packet
    + S8210289: ArchivedKlassSubGraphInfoRecord is incomplete
    + S8210459: Add support for generating compile_commands.json
    + S8210476: sun/security/mscapi/PrngSlow.java fails with Still
    too slow
    + S8210512: [Testbug] vmTestbase/nsk/jdi/ObjectReference/
    /referringObjects/referringObjects002/referringObjects002.java
    fails with unexpected size of
    ClassLoaderReference.referringObjects
    + S8210523: runtime/appcds/cacheObject/DifferentHeapSizes.java
    crash
    + S8210632: Add key exchange algorithm to
    javax/net/ssl/TLSCommon/CipherSuite.java
    + S8210699: Problem list tests which times out in Xcomp mode
    + S8210793: [JVMCI] AllocateCompileIdTest.java failed to find
    DiagnosticCommand.class
    + S8210910: Create test for FileChooserDemo
    + S8210994: Create test for SwingSet3 FrameDemo
    + S8211139: Increase timeout value in all tests under
    jdk/sanity/client/SwingSet/src
    + S8211160: Handle different look and feels in
    JInternalFrameOperator
    + S8211211: vmTestbase/metaspace/stressDictionary/
    /StressDictionary.java timeout
    + S8211322: Reduce the timeout of tooltip in SwingSet2DemoTest
    + S8211443: Enable different look and feels in SwingSet3 demo
    test SplitPaneDemoTest
    + S8211703: JInternalFrame : java.lang.AssertionError: cannot
    find the internal frame
    + S8211781: re-building fails after changing Graal sources
    + S8212897: Some improvements in the EditorPaneDemotest
    + S8212903: [TestBug] Tests test/jdk/javax/swing/LookAndFeel/
    /8145547/DemandGTK2.sh and DemandGTK3.sh fail on Ubuntu 18.04
    LTS
    + S8213009: Refactoring existing SunMSCAPI classes
    + S8213010: Supporting keys created with certmgr.exe
    + S8213168: Enable different look and feel tests in SwingSet3
    demo test FileChooserDemoTest
    + S8213348: jdk.internal.vm.compiler.management service
    providers missing in module descriptor
    + S8213906: Update arm devkits with libXrandr headers
    + S8213908: AssertionError in DeferredAttr at setOverloadKind
    + S8214124: [TESTBUG] Bugs in runtime/NMT/MallocStressTest.java
    + S8214344: C2: assert(con.basic_type() != T_ILLEGAL) failed:
    elembt=byte; loadbt=void; unsigned=0
    + S8214345: infinite recursion while checking super class
    + S8214471: Enable different look and feel tests in SwingSet3
    demo test ToolTipDemoTest
    + S8214534: Setting of THIS_FILE in the build is broken
    + S8214557: Filter out VM flags which don't affect AOT code
    generation
    + S8214578: [macos] Problem with backslashes on macOS/JIS
    keyboard: Java ignores system settings
    + S8214840: runtime/NMT/MallocStressTest.java timed out
    + S8214850: Rename vm_operations.?pp files to vmOperations.?pp
    files
    + S8214904: Test8004741.java failed due to "Too few ThreadDeath
    hits; expected at least 6 but saw only 5"
    + S8215322: add @file support to jaotc
    + S8215355: Object monitor deadlock with no threads holding the
    monitor (using jemalloc 5.1)
    + S8215396: JTabbedPane preferred size calculation is wrong for
    SCROLL_TAB_LAYOUT
    + S8216180: [AOT] compiler/intrinsics/bigInteger/TestMulAdd.java
    crashed with AOT enabled
    + S8216353: Use utility APIs introduced in org/netbeans/jemmy/
    /util/LookAndFeel class in client sanity test cases
    + S8216354: Syntax error in toolchain_windows.m4
    + S8216472: (se) Stack overflow during selection operation
    leads to crash (win)
    + S8216535: tools/jimage/JImageExtractTest.java timed out
    + S8217235: Create automated test for SwingSet
    ColorChooserDemoTest
    + S8217297: Add support for multiple look and feel for SwingSet
    SliderDemoTest
    + S8217338: [Containers] Improve systemd slice memory limit
    support
    + S8217613: [AOT] TEST_OPTS_AOT_MODULES doesn't work on mac
    + S8217634: RunTest documentation and usability update
    + S8217717: ZGC: Broken oop map in C1 load barrier stub
    + S8217728: Speed up incremental rerun of "make hotspot"
    + S8218268: Javac treats Manifest Class-Path entries as Paths
    instead of URLs
    + S8218662: Allow 204 responses with Content-Length:0
    + S8218882: NET_Writev is declared, NET_WriteV is defined
    + S8218889: Improperly use of the Optional API
    + S8219205: JFR file without license header
    + S8219597: (bf) Heap buffer state changes could provoke
    unexpected exceptions
    + S8219723: javax/net/ssl/compatibility/Compatibility.java
    failed on some SNI cases
    + S8220348: [ntintel] asserts about copying unaligned array
    + S8220451: jdi/EventQueue/remove/remove004 failed due to
    "ERROR: thread2 is not alive"
    + S8220456: jdi/EventQueue/remove_l/remove_l004 failed due to
    "TIMEOUT while waiting for event"
    + S8220479: java/nio/channels/Selector/SelectWithConsumer.java
    failed at testTwoChannels()
    + S8220613: java/util/Arrays/TimSortStackSize2.java times out
    with fastdebug build
    + S8220688: [TESTBUG] runtime/NMT/MallocStressTest.java timed
    out
    + S8220786: Create new switch to redirect error reporting
    output to stdout or stderr
    + S8221270: Duplicated synchronized keywords in SSLSocketImpl
    + S8221312: test/jdk/sanity/client/SwingSet/src/
    /ColorChooserDemoTest.java failed
    + S8221851: Use of THIS_FILE in hotspot invalidates precompiled
    header on Linux/GCC
    + S8221885: Add intermittent test in the JavaSound to the
    ProblemList
    + S8222264: Windows incremental build is broken with JDK-8217728
    + S8222391: javax/net/ssl/compatibility/Compatibility.java
    should be more flexible
    + S8222448: java/lang/reflect/PublicMethods/
    /PublicMethodsTest.java times out
    + S8222519: ButtonDemoScreenshotTest fails randomly with "still
    state to be reached"
    + S8222741: jdi/EventQueue/remove/remove004 fails due to
    VMDisconnectedException
    + S8223003: SunMSCAPI keys are not cleaned up
    + S8223063: Support CNG RSA keys
    + S8223158: Docked MacBook cannot start any Java Swing
    applications
    + S8223260: NamingManager should cache InitialContextFactory
    + S8223464: Improve version string for Oracle CI builds
    + S8223558: Java does not render Myanmar script correctly
    + S8223627: jdk-13+20 bundle name contains null instead of ea
    + S8223638: Replace wildcard address with loopback or local
    host in tests - part 6
    + S8223678: Add Visual Studio Code workspace generation support
    (for native code)
    + S8223727: com/sun/jndi/ldap/privconn/RunTest.java failed due
    to hang in LdapRequest.getReplyBer
    + S8223769: Assert triggers with -XX:+StressReflectiveCode
    + S8224187: Refactor arraycopy_prologue to allow ZGC read
    barriers on arraycopy
    + S8224475: JTextPane does not show images in HTML rendering
    + S8224673: Adjust permission for delayed starting of debugging
    + S8224705: Tests that need to be problem-listed or have
    printer resources
    + S8224778: test/jdk/demo/jfc/J2Ddemo/J2DdemoTest.java cannot
    find J2Ddemo.jar
    + S8224821: java/awt/Focus/NoAutotransferToDisabledCompTest/
    /NoAutotransferToDisabledCompTest.java fails linux-x64
    + S8224830: test/jdk/java/awt/Focus/
    /ModalExcludedWindowClickTest/
    /ModalExcludedWindowClickTest.java fails on linux-x64
    + S8224851: AArch64: fix warnings and errors with Clang and GCC
    8.3
    + S8224905: java/lang/ProcessBuilder/Basic.java#id1 failed with
    stream closed
    + S8225007: java/awt/print/PrinterJob/
    /LandscapeStackOverflow.java may hang
    + S8225105: java/awt/Focus/ShowFrameCheckForegroundTest/
    /ShowFrameCheckForegroundTest.java fails in Windows 10
    + S8225117: java/math/BigInteger/SymmetricRangeTests.java fails
    with ParseException
    + S8225128: Add exception for expiring DocuSign root to
    VerifyCACerts test
    + S8225130: Add exception for expiring Comodo roots to
    VerifyCACerts test
    + S8225144: [macos] In Aqua L&amp;F backspace key does not delete
    when Shift is pressed
    + S8225180: SignedObject with invalid Key not throwing the
    InvalidKeyException in Windows
    + S8225182: JNI exception pending in DestroyXIMCallback of
    awt_InputMethod.c:1327
    + S8225199: [Graal] compiler/jvmci/compilerToVM/
    /IsMatureVsReprofileTest.java fails with
  - XX:CompileThresholdScaling=0.1
    + S8225305: ProblemList java/lang/invoke/VarHandles tests
    + S8225350: compiler/jvmci/compilerToVM/IsCompilableTest.java
    timed out
    + S8225430: Replace wildcard address with loopback or local
    host in tests - part 14
    + S8225435: Upgrade IANA Language Subtag Registry to the latest
    for JDK14
    + S8225487: giflib legal file is missing attribution for
    openbsd-reallocarray.c
    + S8225567: Wrong file headers with 8202414 fix changeset
    + S8225684: [AOT] vmTestbase/vm/oom/production/
    /AlwaysOOMProduction tests fail with AOTed java.base
    + S8225766: Curve in certificate should not affect signature
    scheme when using TLSv1.3
    + S8225797: OldObjectSample event creates unexpected amount of
    checkpoint data
    + S8226381: ProblemList java/lang/reflect/PublicMethods/
    /PublicMethodsTest.java
    + S8226406: JVM fails to detect mismatched or corrupt CDS
    archive
    + S8226608: Hide the onjcmd option from the help output
    + S8226892: ActionListeners on JRadioButtons don't get notified
    when selection is changed with arrow keys
    + S8227112: exclude compiler/intrinsics/sha/sanity tests from
    AOT runs
    + S8227324: Upgrade to freetype 2.10.1
    + S8227528: TestAbortVMOnSafepointTimeout.java failed due to
    "RuntimeException: 'Safepoint sync time longer than' missing
    from stdout/stderr"
    + S8227645: Some tests in serviceability/sa run with fixed -Xmx
    values and risk running out of memory
    + S8227646: [TESTBUG] appcds/SharedArchiveConsistency timed out
    + S8227662: freetype seeks to index at the end of the font data
    + S8228479: Correct the format of ColorChooserDemoTest
    + S8228613: java.security.Provider#getServices order is no
    longer deterministic
    + S8228969: 2019-09-28 public suffix list update
    + S8229236: CriticalJNINatives: dll handling should be done in
    native thread state
    + S8229345: Memory leak due to vtable stubs not being shared on
    SPARC
    + S8229888: (zipfs) Updating an existing zip file does not
    preserve original permissions
    + S8229994: assert(false) failed: Bad graph detected in
    get_early_ctrl_for_expensive
    + S8230004: jdk/internal/jimage/JImageOpenTest.java runs no test
    + S8230235: Rendering HTML with empty img attribute and
    documentBaseKey cause Exception
    + S8230390: Problemlist SA tests with AOT
    + S8230400: Missing constant pool entry for a method in
    stacktrace
    + S8230459: Test failed to resume JVMCI CompilerThread
    + S8230480: check malloc/calloc results in java.desktop
    + S8230597: Update GIFlib library to the 5.2.1
    + S8230611: infinite loop in
    LogOutputList::wait_until_no_readers()
    + S8230624: [TESTBUG] Problemlist JFR
    compiler/TestCodeSweeper.java
    + S8230677: Should disable Escape Analysis if JVMTI capability
    can_get_owned_monitor_info was taken
    + S8230926: [macosx] Two apostrophes are entered instead of one
    with "U.S. International - PC" layout
    + S8231025: Incorrect method tag offset for big endian platform
    + S8231081: TestMetadataRetention fails due to missing symbol id
    + S8231387: java.security.Provider.getService returns random
    result due to race condition with mutating methods in the same
    class
    + S8231430: C2: Memory stomp in max_array_length() for
    T_ILLEGAL type
    + S8231445: check ZALLOC return values in awt coding
    + S8231507: Update Apache Santuario (XML Signature) to version
    2.1.4
    + S8231584: Deadlock with ClassLoader.findLibrary and
    System.loadLibrary call
    + S8231753: use more Posix functionality in aix
    os::print_os_info
    + S8231810: javax/net/ssl/templates/
    /SSLSocketSSLEngineTemplate.java fails intermittently with
    "java.lang.Exception: Unexpected EOF"
    + S8232003: (fs) Files.write can leak file descriptor in the
    exception case
    + S8232056: GetOwnedMonitorInfoWithEATest.java fails with ZGC:
    Heap too small
    + S8232060: add some initializations using sigemptyset in
    os_aix.cpp
    + S8232154: Update Mesa 3-D Headers to version 19.2.1
    + S8232167: Visual Studio install found through
  - -with-tools-dir value is discarded
    + S8232170: FSInfo#getJarClassPath throws an exception not
    declared in its throws clause
    + S8232200: [macos 10.15] Windows in fullscreen tests jumps
    around the screen
    + S8232207: Linux os::available_memory re-reads cgroup
    configuration on every invocation
    + S8232224: [TESTBUG] problemlist JFR TestLargeRootSet.java
    + S8232370: Refactor some com.sun.jdi tests to enable IDE
    integration
    + S8232433: [macos 10.15] java/awt/Window/
    /LocationAtScreenCorner/LocationAtScreenCorner.java may fail
    + S8232571: Add missing SIGINFO signal
    + S8232692: [TESTBUG] compiler/aot/fingerprint/
    /SelfChangedCDS.java fails when cds is disabled
    + S8232713: Update BCEL version to 6.3.1 in license file
    + S8232806: Introduce a system property to disable eager lambda
    initialization
    + S8232834: RunTest sometimes fails to produce valid
    exitcode.txt
    + S8232880: Update test documentation with additional settings
    for client UI tooltip tests
    + S8232950: SUNPKCS11 Provider incorrectly check key length for
    PSS Signatures.
    + S8233018: Add a new test to verify that DatagramSocket is not
    interruptible
    + S8233019: java.lang.Class.isPrimitive() (C1) returns wrong
    result if Klass* is aligned to 32bit
    + S8233032: assert(in_bb(n)) failed: must be
    + S8233078: fix minimal VM build on Linux ppc64(le)
    + S8233328: fix minimal VM build on Linux s390x
    + S8233383: Various minor fixes
    + S8233466: aarch64: remove unnecessary load of mdo when
    profiling return and parameters type
    + S8233491: Crash in AdapterHandlerLibrary::get_adapter with
    CDS due to code cache exhaustion
    + S8233529: loopTransform.cpp:2984: Error: assert(p_f-&gt;Opcode()
    == Op_IfFalse) failed
    + S8233548: Update CUP to v0.11b
    + S8233649: Update ProblemList.txt to exclude failing headful
    tests on macos
    + S8233656: assert(d-&gt;is_CFG() &amp;&amp; n-&gt;is_CFG()) failed: must
    have CFG nodes
    + S8233657: Intermittent NPE in Component.validate()
    + S8234288: Turkey Time Zone returns incorrect time zone name
    + S8234323: NULL-check return value of SurfaceData_InitOps on
    macosx
    + S8234339: replace JLI_StrTok in java_md_solinux.c
    + S8234340: Bump update version for OpenJDK: jdk-11.0.7
    + S8234350: assert(mode == ControlAroundStripMined &amp;&amp; (use ==
    sfpt || !use-&gt;is_reachable_from_root())) failed: missed a node
    + S8234386: [macos] NPE was thrown at expanding Choice from
    maximized frame
    + S8234397: add OS uptime information to os::print_os_info
    output
    + S8234423: Modifying ArrayList.subList().subList() resets
    modCount of subList
    + S8234466: Class loading deadlock involving
    X509Factory#commitEvent()
    + S8234501: remove obsolete NET_ReadV
    + S8234525: enable link-time section-gc for linux s390x to
    remove unused code
    + S8234610: MaxVectorSize set wrongly when UseAVX=3 is
    specified after JDK-8221092
    + S8234617: C1: Incorrect result of field load due to missing
    narrowing conversion
    + S8234723: javax/net/ssl/TLS tests support TLSv1.3
    + S8234724: javax/net/ssl/templates/
    /SSLSocketSSLEngineTemplate.java supports TLSv1.3
    + S8234741: enhance os::get_core_path on macOS
    + S8234769: Duplicate attribution in freetype.md
    + S8234786: Fix for JDK-8214578 breaks OS X 10.12 compatibility
    + S8234809: set relro in linker flags when building with gcc
    + S8234824: java/nio/channels/SocketChannel/AdaptSocket.java
    fails on Windows 10
    + S8235243: handle VS2017 15.9 and VS2019 in abstract_vm_version
    + S8235288: AVX 512 instructions inadvertently used on Xeon for
    small vector width operations
    + S8235325: build failure on Linux after 8235243
    + S8235383: C1 compilation fails with
  - XX:+PrintIRDuringConstruction -XX:+Verbose
    + S8235489: handle return values of sscanf calls in hotspot
    + S8235509: Backport for JDK-8209657 Refactor filemap.hpp to
    simplify integration with Serviceability Agent.
    + S8235510: java.util.zip.CRC32 performance drop after 8200067
    + S8235563: [TESTBUG] appcds/CommandLineFlagComboNegative.java
    does not handle archive mapping failure
    + S8235637: jhsdb jmap from OpenJDK 11.0.5 doesn't work if
    prelink is enabled
    + S8235671: enhance print_rlimit_info in os_posix
    + S8235744: PIT: test/jdk/javax/swing/text/html/
    /TestJLabelWithHTMLText.java times out in linux-x64
    + S8235904: Infinite loop when rendering huge lines
    + S8235998: [c2] Memory leaks during tracing after '8224193:
    stringStream should not use Resource Area'.
    + S8236039: JSSE Client does not accept status_request
    extension in CertificateRequest messages for TLS 1.3
    + S8236140: assert(!VerifyHashTableKeys || _hash_lock == 0)
    failed: remove node from hash table before modifying it
    + S8236179: C1 register allocation error with T_ADDRESS
    + S8236488: Support for configure option
  - -with-native-debug-symbols=internal is impossible on Windows
    + S8236500: Windows ucrt.dll should be looked up in versioned
    WINSDK subdirectory
    + S8236709: struct SwitchRange in HS violates C++ One
    Definition Rule
    + S8236848: [JDK 11u] make run-test-tier1 fails after backport
    of JDK-8232834
    + S8236873: Worker has a deadlock bug
    + S8237217: Incorrect G1StringDedupEntry type used in
    StringDedupTable destructor
    + S8237368: Problem with NullPointerException in RMI
    TCPEndpoint.read
    + S8237375: SimpleThresholdPolicy misses CounterDecay timestamp
    initialization
    + S8237508: Simplify JarFile.isInitializing
    + S8237540: Missing files in backport of JDK-8210910
    + S8237541: Missing files in backport of JDK-8236528
    + S8237600: Test SunJSSEFIPSInit fails on Ubuntu
    + S8237819: s390x - remove unused pd_zero_to_words_large
    + S8237869: exclude jtreg test security/infra/java/security/
    /cert/CertPathValidator/certification/LuxTrustCA.java because
    of instabilities
    + S8237879: make 4.3 breaks build
    + S8237945: CTW: C2 compilation fails with
    assert(just_allocated_object(alloc_ctl) == ptr) failed: most
    recent allo...
    + S8238225: Issues reported after replacing symlink at
    Contents/MacOS/libjli.dylib with binary
    + S8238247: CTW runner should sweep nmethods more aggressively
    + S8238366: CTW runner closes standard output on exit
    + S8238438: SuperWord::co_locate_pack picks memory state of
    first instead of last load
    + S8238502: sunmscapi.dll causing EXCEPTION_ACCESS_VIOLATION
    + S8238534: Deep sign macOS bundles before bundle archive is
    being created
    + S8238591: CTW: Split
    applications/ctw/modules/jdk_localedata.java
    + S8238596: AVX enabled by default for Skylake even when
    unsupported
    + S8238811: C2: assert(i &gt;= req() || i == 0 || is_Region() ||
    is_Phi()) with -XX:+VerifyGraphEdges
    + S8239005: [TESTBUG] test/hotspot/jtreg/runtime/
    /StackGuardPages/TestStackGuardPages.java: exeinvoke.c: must
    initialize static state before calling do_overflow()
    + S8239466: Loss of precision in counter decay calculation in
    11u backport of JDK-8237375
    + S8239856: [ntintel] asserts about copying unaligned array
    element
    + S8240724: [test] jdk11 downport of 8224475 misses binary file
    test/jdk/javax/swing/JTextPane/arrow.png
    + S8241296: Segfault in JNIHandleBlock::oops_do()
- Removed patch:
  * DependOnVariableHelper.patch
    + fixed upstream
- Added patch:
  * JDK-8228407.patch
    + fix crashes due to shared archive file mismatch</changelog>
  <changelog author="fstrba@suse.com" date="1594900800">- Update to upstream tag jdk-11.0.8+10 (July 2020 CPU, bsc#1174157)
  * Security fixes:
    + JDK-8230613: Better ASCII conversions
    + JDK-8231800: Better listing of arrays
    + JDK-8232014: Expand DTD support
    + JDK-8233234: Better Zip Naming
    + JDK-8233239, CVE-2020-14562: Enhance TIFF support
    + JDK-8233255: Better Swing Buttons
    + JDK-8234032: Improve basic calendar services
    + JDK-8234042: Better factory production of certificates
    + JDK-8234418: Better parsing with CertificateFactory
    + JDK-8234836: Improve serialization handling
    + JDK-8236191: Enhance OID processing
    + JDK-8236867, CVE-2020-14573: Enhance Graal interface handling
    + JDK-8237117, CVE-2020-14556: Better ForkJoinPool behavior
    + JDK-8237592, CVE-2020-14577: Enhance certificate verification
    + JDK-8238002, CVE-2020-14581: Better matrix operations
    + JDK-8238013: Enhance String writing
    + JDK-8238804: Enhance key handling process
    + JDK-8238842: AIOOBE in GIFImageReader.initializeStringTable
    + JDK-8238843: Enhanced font handing
    + JDK-8238920, CVE-2020-14583: Better Buffer support
    + JDK-8238925: Enhance WAV file playback
    + JDK-8240119, CVE-2020-14593: Less Affine Transformations
    + JDK-8240482: Improved WAV file playback
    + JDK-8241379: Update JCEKS support
    + JDK-8241522: Manifest improved jar headers redux
    + JDK-8242136, CVE-2020-14621: Better XML namespace handling
  * Other changes:
    + JDK-6933331: (d3d/ogl) java.lang.IllegalStateException:
    Buffers have not been created
    + JDK-7124307: JSpinner and changing value by mouse
    + JDK-8022574: remove HaltNode code after uncommon trap calls
    + JDK-8039082: [TEST_BUG] Test
    java/awt/dnd/BadSerializationTest/BadSerializationTest.java
    fails
    + JDK-8040630: Popup menus and tooltips flicker with previous
    popup contents when first shown
    + JDK-8044365: (dc) MulticastSendReceiveTests.java failing with
    ENOMEM when joining group (OS X 10.9)
    + JDK-8048215: [TESTBUG]
    java/lang/management/ManagementFactory/ThreadMXBeanProxy.java
    Expected non-null LockInfo
    + JDK-8051349: nsk/jvmti/scenarios/sampling/SP06/sp06t003 fails
    in nightly
    + JDK-8080353: JShell: Better error message on attempting to
    add default method
    + JDK-8139876: Exclude hanging nsk/stress/stack from execution
    with deoptimization enabled
    + JDK-8146090: java/lang/ref/ReachabilityFenceTest.java fails
    with -XX:+DeoptimizeALot
    + JDK-8153430: jdk regression test MletParserLocaleTest,
    ParserInfiniteLoopTest reduce default timeout
    + JDK-8156207: Resource allocated BitMaps are often cleared
    unnecessarily
    + JDK-8159740: JShell: corralled declarations do not have
    correct source to wrapper mapping
    + JDK-8175984: ICC_Profile has un-needed, not-empty finalize
    method
    + JDK-8176359: Frame#setMaximizedbounds not working properly in
    multi screen environments
    + JDK-8183369: RFC unconformity of HttpURLConnection with proxy
    + JDK-8187078: -XX:+VerifyOops finds numerous problems when
    running JPRT
    + JDK-8189861: Refactor CacheFind
    + JDK-8191169: java/net/Authenticator/B4769350.java failed
    intermittently
    + JDK-8191930: [Graal] emits unparseable XML into compile log
    + JDK-8193879: Java debugger hangs on method invocation
    + JDK-8196019: java/awt/Window/Grab/GrabTest.java fails on
    Windows
    + JDK-8196181: sun/java2d/GdiRendering/InsetClipping.java fails
    + JDK-8198000:
    java/awt/List/EmptyListEventTest/EmptyListEventTest.java
    debug assert on Windows
    + JDK-8198001: java/awt/Menu/WrongParentAfterRemoveMenu/
    /WrongParentAfterRemoveMenu.java debug assert on Windows
    + JDK-8198339: Test javax/swing/border/Test6981576.java is
    unstable
    + JDK-8200701: jdk/jshell/ExceptionsTest.java fails on Windows,
    after JDK-8198801
    + JDK-8203264: JNI exception pending in
    PlainDatagramSocketImpl.c:740
    + JDK-8203672: JNI exception pending in PlainSocketImpl.c
    + JDK-8203673: JNI exception pending in
    DualStackPlainDatagramSocketImpl.c:398
    + JDK-8204834: Fix confusing "allocate" naming in OopStorage
    + JDK-8205399: Set node color on pinned HashMap.TreeNode
    deletion
    + JDK-8205653: test/jdk/sun/management/jmxremote/bootstrap/
    /RmiRegistrySslTest.java and RmiSslBootstrapTest.sh fail with
    handshake_failure
    + JDK-8206179: com/sun/management/OperatingSystemMXBean/
    /GetCommittedVirtualMemorySize.java fails with Committed
    virtual memory size illegal value
    + JDK-8207334: VM times out in VM_HandshakeAllThreads::doit()
    with RunThese30M
    + JDK-8208277: Code cache heap (-XX:ReservedCodeCacheSize)
    doesn't work with 1GB LargePages
    + JDK-8209113: Use WeakReference for lastFontStrike for created
    Fonts
    + JDK-8209333: Socket reset issue for TLS 1.3 socket close
    + JDK-8209439: C2 library_call can potentially ignore Math.pow
    intrinsic or use null pointer
    + JDK-8209534: [TESTBUG]runtime/appcds/cacheObject/
    /ArchivedModuleCompareTest.java fails with EnableJVMCI.
    + JDK-8210147: adjust some WSAGetLastError usages in windows
    network coding
    + JDK-8210284: "assert((av &amp; 0x00000001) == 0) failed:
    unsupported V8" on Solaris 11.4
    + JDK-8210303: VM_HandshakeAllThreads fails assert with
    "failed: blocked and not walkable"
    + JDK-8210459: Add support for generating compile_commands.json
    + JDK-8210515: [TESTBUG]CheckArchivedModuleApp.java needs to
    check if EnableJVMCI is set.
    + JDK-8210788: Javadoc for Thread.join(long, int) should
    specify that it waits forever when both arguments are zero
    + JDK-8211301: [macos] support full window content options
    + JDK-8211332: Space for stub routines (code_size2) is too
    small on new Skylake CPUs
    + JDK-8211339: NPE during SSL handshake caused by
    HostnameChecker
    + JDK-8211392: compiler/profiling/
    /spectrapredefineclass_classloaders/Launcher.java times out
    in JDK12 CI
    + JDK-8211743: [AOT] crash in ScopeDesc::decode_body() when
    JVMTI walks AOT frames
    + JDK-8212154: [TESTBUG] CheckArchivedModuleApp fails with NPE
    when JVMCI is absent
    + JDK-8212167: JShell : Stack trace of exception has wrong line
    number
    + JDK-8212933: Thread-SMR: requesting a VM operation whilst
    holding a ThreadsListHandle can cause deadlocks
    + JDK-8212986: Make Visual Studio compiler check less strict
    + JDK-8213250: CDS archive creation aborts due to metaspace
    object allocation failure
    + JDK-8213516: jck test api/javax_accessibility/AccessibleState/
    /fields.html fails intermittent
    + JDK-8213947: ARM32: failed check_simd should set
    UsePopCountInstruction to false
    + JDK-8214418: half-closed SSLEngine status may cause
    application dead loop
    + JDK-8214440: ldap over a TLS connection negotiate failed with
    "javax.net.ssl.SSLPeerUnverifiedException: hostname of the
    server does not match the hostname in the server's
    certificate"
    + JDK-8214444: Wrong strncat limits in dfa.cpp
    + JDK-8214481: freetype path does not disable TrueType hinting
    with AA+FM hints
    + JDK-8214571: -Xdoclint of array serialField gives "error:
    array type not allowed here"
    + JDK-8214856: Errors with JSZip in web console after upgrade
    to 3.1.5
    + JDK-8214862: assert(proj != __null) at compile.cpp:3251
    + JDK-8215369: Jcstress pollute /var/tmp with temporary files.
    + JDK-8215551: Missing case label in nmethod::reloc_string_for()
    + JDK-8215555: TieredCompilation C2 threads can excessively
    block handshakes
    + JDK-8215711: Missing key_share extension for (EC)DHE key
    exchange should alert missing_extension
    + JDK-8216151: [Graal] Module
    jdk.internal.vm.compiler.management has not been granted
    accessClassInPackage.org.graalvm.compiler.debug
    + JDK-8216154: C4819 warnings at HotSpot sources on Windows
    + JDK-8216541: CompiledICHolders of VM locked unloaded nmethods
    are released too late
    + JDK-8217230: assert(t == t_no_spec) failure in
    NodeHash::check_no_speculative_types()
    + JDK-8217404: --with-jvm-features doesn't work when multiple
    features are explicitly disabled
    + JDK-8217447: Develop flag TraceICs is broken
    + JDK-8217606: LdapContext#reconnect always opens a new
    connection
    + JDK-8218807: Compilation database (compile_commands.json) may
    contain obsolete items
    + JDK-8219214: Infinite Loop in CodeSection::dump()
    + JDK-8219904: ClassCastException when calling
    FlightRecorderMXBean#getRecordings()
    + JDK-8219991: New fix of the deadlock in
    sun.security.ssl.SSLSocketImpl
    + JDK-8221121: applications/microbenchmarks are encountering
    crashes in tier5
    + JDK-8221445: FastSysexMessage constructor crashes MIDI
    receiption thread
    + JDK-8221482: Initialize VMRegImpl::regName[] earlier to
    prevent assert during PrintStubCode
    + JDK-8221741: ClassCastException can happen when
    fontconfig.properties is used
    + JDK-8221823: Requested JDialog width is ignored
    + JDK-8223108: Test java/awt/EventQueue/
    /NonComponentSourcePost.java is unstable
    + JDK-8223678: Add Visual Studio Code workspace generation
    support (for native code)
    + JDK-8223935: PIT: java/awt/font/WindowsIndicFonts.java fails
    on windows10
    + JDK-8224109: Text spaced incorrectly by drawString under
    rotation with fractional metric
    + JDK-8224632: testbug: java/awt/dnd/RemoveDropTargetCrashTest/
    /RemoveDropTargetCrashTest.java fails on MacOS
    + JDK-8224793: os::die() does not honor CreateCoredumpOnCrash
    option
    + JDK-8224847: gc/stress/TestReclaimStringsLeaksMemory.java
    fails with reserved greater than expected
    + JDK-8224931: disable JAOTC invokedynamic support until
    8223533 is fixed
    + JDK-8224997: ChaCha20-Poly1305 TLS cipher suite decryption
    throws ShortBufferException
    + JDK-8225068: Remove DocuSign root certificate that is
    expiring in May 2020
    + JDK-8225069: Remove Comodo root certificate that is expiring
    in May 2020
    + JDK-8225126: Test SetBoundsPaintTest.html faild on Windows
    when desktop is scaled
    + JDK-8225325: Add tests for redefining a class' private method
    during resolution of the bootstrap specifier
    + JDK-8225622: [AOT] runtime/SharedArchiveFile/
    /TestInterpreterMethodEntries.java crashed with AOTed
    java.base
    + JDK-8225653: Provide more information when hitting SIGILL
    from HaltNode
    + JDK-8225783: Incorrect use of binary operators on booleans in
    type.cpp
    + JDK-8225789: Empty method parameter type should generate
    ClassFormatError
    + JDK-8226198: use of &amp; instead of &amp;&amp; in
    LibraryCallKit::arraycopy_restore_alloc_state
    + JDK-8226253: JAWS reports wrong number of radio buttons when
    buttons are hidden.
    + JDK-8226653: [accessibility] Can edit text cell correctly,
    but Accessibility Tool reads nothing about editor
    + JDK-8226806: [macOS 10.14] Methods of Java Robot should be
    called from appropriate thread
    + JDK-8226879: Memory leak in Type::hashcons
    + JDK-8227632: Incorrect PrintCompilation message: made not
    compilable on levels 0 1 2 3 4
    + JDK-8228407: JVM crashes with shared archive file mismatch
    + JDK-8228482: fix xlc16/xlclang comparison of distinct pointer
    types and string literal conversion warnings
    + JDK-8228757: Fail fast if the handshake type is unknown
    + JDK-8229158: make UseSwitchProfiling non-experimental or
    false by-default
    + JDK-8229421: The logic of java/net/ipv6tests/TcpTest.java is
    flawed
    + JDK-8229855: C2 fails with assert(false) failed: bad AD file
    + JDK-8230591: AArch64: Missing intrinsics for Math.ceil,
    floor, rint
    + JDK-8231118: ARM32: Math tests failures
    + JDK-8231213: Migrate SimpleDateFormatConstTest to JDK Repo
    + JDK-8231243: [TESTBUG] CustomFont.java cannot find font file
    + JDK-8231438: [macOS] Dark mode for the desktop is not
    supported
    + JDK-8231550: C2: ShouldNotReachHere() in
    verify_strip_mined_scheduling
    + JDK-8231564: setMaximizedBounds is broken with large display
    scale and multiple monitors
    + JDK-8231572: Use -lobjc instead of -fobjc-link-runtime in
    libosxsecurity
    + JDK-8231631: sun/net/ftp/FtpURLConnectionLeak.java fails
    intermittently with NPE
    + JDK-8231671: Fix copyright headers in hotspot (missing comma
    after year)
    + JDK-8231720: Some perf regressions after 8225653
    + JDK-8231779: crash
    HeapWord*ParallelScavengeHeap::failed_mem_allocate
    + JDK-8231863: Crash if classpath is read from @argument file
    and the main gets option argument
    + JDK-8232080: jlink plugins for vendor information and
    run-time options
    + JDK-8232106: [x86] C2: SIGILL due to usage of SSSE3
    instructions on processors which don't support it
    + JDK-8232134: Change to Visual Studio 2017 15.9.16 for
    building on Windows at Oracle
    + JDK-8232226: [macos 10.15] test/jdk/java/awt/color/
    /EqualityTest/EqualityTest.java may fail
    + JDK-8232357: Compare version info of Santuario to legal notice
    + JDK-8232572: Add hooks for custom output dir in Bundles.gmk
    + JDK-8232634: Problem List ICMColorDataTest.java
    + JDK-8232748: Build static versions of certain JDK libraries
    + JDK-8232846: ProcessHandle.Info command with non-English
    shows question marks
    + JDK-8232880: Update test documentation with additional
    settings for client UI tooltip tests
    + JDK-8233033: C2 produces wrong result while unswitching a
    loop due to lost control dependencies
    + JDK-8233137: runtime/ErrorHandling/VeryEarlyAssertTest.java
    fails after 8232080
    + JDK-8233197: Invert JvmtiExport::post_vm_initialized() and
    Jfr:on_vm_start() start-up order for correct option parsing
    + JDK-8233291: [TESTBUG] tools/jlink/plugins/
    /VendorInfoPluginsTest.java fails with debug or non-server VMs
    + JDK-8233364: Fix undefined behavior in
    Canonicalizer::do_ShiftOp
    + JDK-8233494: Avoid calling MallocTracker::record_malloc and
    record_free when NMT is off
    + JDK-8233573: Toolkit.getScreenInsets(GraphicsConfiguration)
    may throw ClassCastException
    + JDK-8233608: Minimal build broken after JDK-8233494
    + JDK-8233621: Mismatch in jsse.enableMFLNExtension property
    name
    + JDK-8233696: [TESTBUG]Some jtreg tests fail when CAPS_LOCK is
    ON
    + JDK-8233707: systemScale.cpp could not compile with VS2019
    + JDK-8233801: GCMEmptyIv.java test fails on Solaris 11.4
    + JDK-8233880: Support compilers with multi-digit major version
    numbers
    + JDK-8233920: MethodHandles::tryFinally generates illegal
    bytecode for long/double return type
    + JDK-8234137: The "AutoTestOnTop.java" test may run external
    applications
    + JDK-8234146: compiler/jsr292/
    /ContinuousCallSiteTargetChange.java times out on SPARC
    + JDK-8234184: [TESTBUG] java/awt/Mouse/EnterExitEvents/
    /ModalDialogEnterExitEventsTest.java fails in Windows
    + JDK-8234270: [REDO] JDK-8204128 NMT might report incorrect
    numbers for Compiler area
    + JDK-8234332: [TESTBUG] java/awt/Focus/DisposedWindow/
    /DisposeDialogNotActivateOwnerTest/
    /DisposeDialogNotActivateOwnerTest.java fails on linux-x64
    nightly
    + JDK-8234398: Replace ID2D1Factory::GetDesktopDpi with
    GetDeviceCaps
    + JDK-8234522: [macos] Crash with use of native file dialog
    + JDK-8234691: Potential double-free in ParallelSPCleanupTask
    constructor
    + JDK-8234696: tools/jlink/plugins/VendorInfoPluginsTest.java
    times out
    + JDK-8234727: sun/security/ssl/X509TrustManagerImpl tests
    support TLSv1.3
    + JDK-8234728: Some security tests should support TLSv1.3
    + JDK-8234779: Provide idiom for declaring classes noncopyable
    + JDK-8234824: java/nio/channels/SocketChannel/AdaptSocket.java
    fails on Windows 10
    + JDK-8234968: check calloc rv in libinstrument
    InvocationAdapter
    + JDK-8235153: [TESTBUG] [macos 10.15] java/awt/Graphics/
    /DrawImageBG/SystemBgColorTest.java fails
    + JDK-8235183: Remove the "HACK CODE" in comment
    + JDK-8235263: Revert TLS 1.3 change that wrapped IOExceptions
    + JDK-8235311: Tag mismatch may alert bad_record_mac
    + JDK-8235332: TestInstanceCloneAsLoadsStores.java fails with
  - XX:+StressGCM
    + JDK-8235452: Strip mined loop verification fails with
    assert(is_OuterStripMinedLoop()) failed: invalid node class
    + JDK-8235584: UseProfiledLoopPredicate fails with
    assert(_phase-&gt;get_loop(c) == loop) failed: have to be in the
    same loop
    + JDK-8235620: Broken merge between JDK-8006406 and JDK-8003559
    + JDK-8235638: NPE in LWWindowPeer.getOnscreenGraphics()
    + JDK-8235686: Add more custom hooks in Bundles.gmk
    + JDK-8235739: Rare NPE at WComponentPeer.getGraphics()
    + JDK-8235762: JVM crash in SWPointer during C2 compilation
    + JDK-8235834: IBM-943 charset encoder needs updating
    + JDK-8235874: The ordering of Cipher Suites is not maintained
    provided through jdk.tls.client.cipherSuites and
    jdk.tls.server.cipherSuites system property.
    + JDK-8235908: omit ThreadPriorityPolicy warning when value is
    set from image
    + JDK-8235984: C2: assert(out-&gt;in(PhiNode::Region) == head ||
    out-&gt;in(PhiNode::Region) == slow_head) failed: phi must be
    either part of the slow or the fast loop
    + JDK-8236211: [Graal] compiler/graalunit/GraphTest.java is
    skipped in all testing
    + JDK-8236470: Deal with ECDSA using ecdsa-with-SHA2 plus hash
    algorithm as AlgorithmId
    + JDK-8236545: Compilation error in mach5
    java/awt/FileDialog/MacOSGoToFolderCrash.java
    + JDK-8236700: Upgrading JSZip from v3.1.5 to v3.2.2
    + JDK-8236759: ShouldNotReachHere in
    PhaseIdealLoop::verify_strip_mined_scheduling
    + JDK-8236897: Fix the copyright header for pkcs11gcm2.h
    + JDK-8236921: Add build target to produce a JDK image suitable
    for a Graal/SVM build
    + JDK-8236953: [macos] JavaFX SwingNode is not rendered on macOS
    + JDK-8236996: Incorrect Roboto font rendering on Windows with
    subpixel antialiasing
    + JDK-8237045: JVM uses excessive memory with -XX:+EnableJVMCI
  - XX:JVMCICounterSize=2147483648
    + JDK-8237055: [TESTBUG] compiler/c2/TestJumpTable.java fails
    with release VMs
    + JDK-8237086: assert(is_MachReturn()) running CTW with fix for
    JDK-8231291
    + JDK-8237192: Generate stripped/public pdbs on Windows for jdk
    images
    + JDK-8237396: JvmtiTagMap::weak_oops_do() should not trigger
    barriers
    + JDK-8237474: Default SSLEngine should create in server role
    + JDK-8237859: C2: Crash when loads float above range check
    + JDK-8237879: make 4.3 breaks build
    + JDK-8237951: CTW: C2 compilation fails with "malformed
    control flow"
    + JDK-8237962: give better error output for invalid OCSP
    response intervals in CertPathValidator checks
    + JDK-8238190: [JVMCI] Fix single implementor speculation for
    diamond shapes.
    + JDK-8238356: CodeHeap::blob_count() overestimates the number
    of blobs
    + JDK-8238452: Keytool generates wrong expiration date if
    validity is set to 2050/01/01
    + JDK-8238555: Allow Initialization of SunPKCS11 with NSS when
    there are external FIPS modules in the NSSDB
    + JDK-8238575: DragSourceEvent.getLocation() returns wrong
    value on HiDPI screens (Windows)
    + JDK-8238676: jni crashes on accessing it from process exit
    hook
    + JDK-8238721: Add failing client jtreg tests to the Problem
    List
    + JDK-8238738: AudioSystem.getMixerInfo() takes about 30 sec to
    report a gone audio device
    + JDK-8238756: C2: assert(((n) == __null || !VerifyIterativeGVN
    || !((n)-&gt;is_dead()))) failed: can not use dead node
    + JDK-8238765: PhaseCFG::schedule_pinned_nodes cannot handle
    precedence edges from unmatched CFG nodes correctly
    + JDK-8238898: Missing hash characters for header on license
    file
    + JDK-8238942: Rendering artifacts with LCD text and fractional
    metrics
    + JDK-8238985: [TESTBUG] The arrow image is blue instead of
    green
    + JDK-8239000: handle ContendedPaddingWidth in vm_version_ppc
    + JDK-8239055: Wrong implementation of VMState.hasListener
    + JDK-8239091: Reversed arguments in call to strstr in freetype
    "debug" code.
    + JDK-8239142: C2's UseUniqueSubclasses optimization is broken
    for array accesses
    + JDK-8239224: libproc_impl.c previous_thr may be used
    uninitialized warning
    + JDK-8239351: Give more meaningful InternalError messages in
    Deflater.c
    + JDK-8239365: ProcessBuilder test modifications for AIX
    execution
    + JDK-8239456: vtable stub generation: assert failure (code
    size estimate)
    + JDK-8239457: call ReleaseStringUTFChars before early returns
    in Java_sun_security_pkcs11_wrapper_PKCS11_connect
    + JDK-8239462: jdk.hotspot.agent misses some
    ReleaseStringUTFChars calls in case of early returns
    + JDK-8239557: [TESTBUG] VeryEarlyAssertTest.java validating
    "END." marker at lastline is not always true
    + JDK-8239787: AArch64: String.indexOf may incorrectly handle
    empty strings
    + JDK-8239792: Bump update version for OpenJDK: jdk-11.0.8
    + JDK-8239798: SSLSocket closes socket both socket endpoints on
    a SocketTimeoutException
    + JDK-8239819: XToolkit: Misread of screen information memory
    + JDK-8239852: java/util/concurrent tests fail with
  - XX:+VerifyGraphEdges: assert(!VerifyGraphEdges) failed:
    verification should have failed
    + JDK-8239893: Windows handle Leak when starting processes
    using ProcessBuilder
    + JDK-8239915: Zero VM crashes when handling dynamic constant
    + JDK-8239931: [win][x86] vtable stub generation: assert
    failure (code size estimate) follow-up
    + JDK-8239965: XMLEncoder/Test4625418.java fails due to "Error:
    Cp943 - can't read properly"
    + JDK-8239976: Put JDK-8239965 on the ProblemList.txt
    + JDK-8240073: Fix 'test-make' build target in 11u
    + JDK-8240197: Cannot start JVM when $JAVA_HOME includes CJK
    characters
    + JDK-8240202: A few client tests leave mouse buttons pressed
    + JDK-8240220: IdealLoopTree::dump_head predicate printing is
    broken
    + JDK-8240223: Use consistent predicate order in and with
    PhaseIdealLoop::find_predicate
    + JDK-8240227: Loop predicates should be copied to unswitched
    loops
    + JDK-8240286: [TESTBUG] Test command error in hotspot/jtreg/
    /compiler/loopopts/superword/SumRedAbsNeg_Float.java
    + JDK-8240518: Incorrect JNU_ReleaseStringPlatformChars in
    Windows Print
    + JDK-8240529: CheckUnhandledOops breaks NULL check in
    Modules::define_module
    + JDK-8240576: JVM crashes after transformation in C2
    IdealLoopTree::merge_many_backedges
    + JDK-8240603: Windows 32bit compile error after 8238676
    + JDK-8240629: argfiles parsing broken for argfiles with
    comment cross 4096 bytes chunk
    + JDK-8240711: TestJstatdPort.java failed due to
    "ExportException: Port already in use:"
    + JDK-8240786: [TESTBUG] The test java/awt/Window/
    /GetScreenLocation/GetScreenLocationTest.java fails on HiDPI
    screen
    + JDK-8240824: enhance print_full_memory_info on Linux by THP
    related information
    + JDK-8240827: Downport SSLSocketImpl.java from "8221882: Use
    fiber-friendly java.util.concurrent.locks in JSSE"
    + JDK-8240905: assert(mem == (Node*)1 || mem == mem2) failed:
    multiple Memories being matched at once?
    + JDK-8240972: macOS codesign fail on macOS 10.13.5 or older
    + JDK-8241445: Fix copyright in
    test/jdk/tools/launcher/ArgFileSyntax.java
    + JDK-8241458: [JVMCI] add mark value to expose
    CodeOffsets::Frame_Complete
    + JDK-8241464: [11u] Backport: make rehashing be a needed
    guaranteed safepoint cleanup action
    + JDK-8241556: Memory leak if -XX:CompileCommand is set
    + JDK-8241568: (fs) UserPrincipalLookupService.lookupXXX
    failure with IOE "Operation not permitted"
    + JDK-8241586: compiler/cpuflags/
    /TestAESIntrinsicsOnUnsupportedConfig.java fails on aarch64
    + JDK-8241638: launcher time metrics always report 1 on Linux
    when _JAVA_LAUNCHER_DEBUG set
    + JDK-8241660: Add virtualization information output to hs_err
    file on macOS
    + JDK-8241808: [TESTBUG] The JDK-8039467 bug appeared on macOS
    + JDK-8241888: Mirror jdk.security.allowNonCaAnchor system
    property with a security one
    + JDK-8241900: Loop unswitching may cause dependence on null
    check to be lost
    + JDK-8241948: enhance list of environment variables printed in
    hs_err file
    + JDK-8241996: on linux set full relro in the linker flags
    + JDK-8242108: Performance regression after fix for JDK-8229496
    + JDK-8242141: New System Properties to configure the TLS
    signature schemes
    + JDK-8242154: Backport parts of JDK-4947890 to OpenJDK 11u
    + JDK-8242174: [macos] The NestedModelessDialogTest test make
    the macOS unstable
    + JDK-8242239: [Graal] javax/management/generified/
    /GenericTest.java fails: FAILED: queryMBeans sets same
    + JDK-8242294: JSSE Client does not throw SSLException when an
    alert occurs during handshaking
    + JDK-8242379: [TESTBUG] compiler/loopopts/
    /TestLoopUnswitchingLostCastDependency.java fails with
    release VMs
    + JDK-8242470: Update Xerces to Version 2.12.1
    + JDK-8242498: Invalid "sun.awt.TimedWindowEvent" object leads
    to JVM crash
    + JDK-8242541: Small charset issues (ISO8859-16, x-eucJP-Open,
    x-IBM834 and x-IBM949C)
    + JDK-8242626: enhance posix print_rlimit_info
    + JDK-8243059: Build fails when --with-vendor-name contains a
    comma
    + JDK-8243539: Copyright info (Year) should be updated for fix
    of 8241638
    + JDK-8243541: (tz) Upgrade time-zone data to tzdata2020a
    + JDK-8244407: JVM crashes after transformation in C2
    IdealLoopTree::split_fall_in
    + JDK-8244520: problemlist
    java/awt/font/Rotate/RotatedFontTest.java on linux
    + JDK-8244777: ClassLoaderStats VM Op uses constant hash value
    + JDK-8244853: The static build of libextnet is missing the
    JNI_OnLoad_extnet function
    + JDK-8244951: Missing entitlements for hardened runtime
    + JDK-8245047: [PPC64] C2: ReverseBytes + Load always match to
    unordered Load (acquire semantics missing)
    + JDK-8245649: Revert 8245397 backport of 8230591
    + JDK-8246031: SSLSocket.getSession() doesn't close connection
    for timeout/ interrupts
    + JDK-8246613: Choose the default SecureRandom algo based on
    registration ordering
    + JDK-8248505: Unexpected NoSuchAlgorithmException when using
    secure random impl from BCFIPS provider
- Removed patch:
  * JDK-8228407.patch
    + integrated upstream</changelog>
  <changelog author="fstrba@suse.com" date="1604318400">- Update to upstream tag jdk-11.0.9-11 (October 2020 CPU,
  bsc#1177943)
  * New features
    + JDK-8250784: Shenandoah: A Low-Pause-Time Garbage Collector
  * Security fixes
    + JDK-8233624: Enhance JNI linkage
    + JDK-8236196: Improve string pooling
    + JDK-8236862, CVE-2020-14779: Enhance support of Proxy class
    + JDK-8237990, CVE-2020-14781: Enhanced LDAP contexts
    + JDK-8237995, CVE-2020-14782: Enhance certificate processing
    + JDK-8240124: Better VM Interning
    + JDK-8241114, CVE-2020-14792: Better range handling
    + JDK-8242680, CVE-2020-14796: Improved URI Support
    + JDK-8242685, CVE-2020-14797: Better Path Validation
    + JDK-8242695, CVE-2020-14798: Enhanced buffer support
    + JDK-8243302: Advanced class supports
    + JDK-8244136, CVE-2020-14803: Improved Buffer supports
    + JDK-8244479: Further constrain certificates
    + JDK-8244955: Additional Fix for JDK-8240124
    + JDK-8245407: Enhance zoning of times
    + JDK-8245412: Better class definitions
    + JDK-8245417: Improve certificate chain handling
    + JDK-8248574: Improve jpeg processing
    + JDK-8249927: Specify limits of jdk.serialProxyInterfaceLimit
    + JDK-8253019: Enhanced JPEG decoding
  * Other changes
    + JDK-6532025: GIF reader throws misleading exception with
    truncated images
    + JDK-6949753: [TEST BUG]: java/awt/print/PageFormat/
    /PDialogTest.java needs update by removing an infinite loop
    + JDK-8022535: [TEST BUG] javax/swing/text/html/parser/
    /Test8017492.java fails
    + JDK-8062947: Fix exception message to correctly represent
    LDAP connection failure
    + JDK-8067354: com/sun/jdi/GetLocalVariables4Test.sh failed
    + JDK-8134599: TEST_BUG: java/rmi/transport/closeServerSocket/
    /CloseServerSocket.java fails intermittently with Address
    already in use
    + JDK-8151678: com/sun/jndi/ldap/LdapTimeoutTest.java failed
    due to timeout on DeadServerNoTimeoutTest is incorrect
    + JDK-8160768: Add capability to custom resolve host/domain
    names within the default JNDI LDAP provider
    + JDK-8172404: Tools should warn if weak algorithms are used
    before restricting them
    + JDK-8193367: Annotated type variable bounds crash javac
    + JDK-8202117: com/sun/jndi/ldap/RemoveNamingListenerTest.java
    fails intermittently: Connection reset
    + JDK-8203026: java.rmi.NoSuchObjectException: no such object
    in table
    + JDK-8203281: [Windows] JComboBox change in ui when
    editor.setBorder() is called
    + JDK-8203382: Rename SystemDictionary::initialize_wk_klass to
    resolve_wk_klass
    + JDK-8203393: com/sun/jdi/JdbMethodExitTest.sh and
    JdbExprTest.sh fail due to timeout
    + JDK-8203928: [Test] Convert non-JDB scaffolding
    serviceability shell script tests to java
    + JDK-8204963: javax.swing.border.TitledBorder has a memory leak
    + JDK-8204994: SA might fail to attach to process with "Windbg
    Error: WaitForEvent failed"
    + JDK-8205534: Remove SymbolTable dependency from
    serviceability agent
    + JDK-8206309: Tier1 SA tests fail
    + JDK-8208281: java/nio/channels/
    /AsynchronousSocketChannel/Basic.java timed out
    + JDK-8209109: [TEST] rewrite com/sun/jdi shell tests to java
    version - step1
    + JDK-8209332: [TEST] test/jdk/com/sun/jdi/CatchPatternTest.sh
    is incorrect
    + JDK-8209342: Problemlist SA tests on Solaris due to Error
    attaching to process: Can't create thread_db agent!
    + JDK-8209343: Test javax/swing/border/TestTitledBorderLeak.java
    should be marked as headful
    + JDK-8209517: com/sun/jdi/BreakpointWithFullGC.java fails with
    timeout
    + JDK-8209604: [TEST] rewrite com/sun/jdi shell tests to java
    version - step2
    + JDK-8209605: com/sun/jdi/BreakpointWithFullGC.java fails with
    ZGC
    + JDK-8209608: Problem list com/sun/jdi/BreakpointWithFullGC.java
    + JDK-8210131: vmTestbase/nsk/jvmti/scenarios/allocation/AP10/
    /ap10t001/TestDescription.java failed with ObjectFree:
    GetCurrentThreadCpuTimerInfo returned unexpected error code
    + JDK-8210243: [TEST] rewrite com/sun/jdi shell tests to java
    version - step3
    + JDK-8210527: JShell: NullPointerException in
    jdk.jshell.Eval.translateExceptionStack
    + JDK-8210560: [TEST] convert com/sun/jdi redefineClass-related
    tests
    + JDK-8210725: com/sun/jdi/RedefineClearBreakpoint.java fails
    with waitForPrompt timed out after 60 seconds
    + JDK-8210748: [TESTBUG] lib.jdb.Jdb.waitForPrompt() should
    clarify which output is the pending reply after a timeout
    + JDK-8210760: [TEST] rewrite com/sun/jdi shell tests to java
    version - step4
    + JDK-8210977: jdk/jfr/event/oldobject/TestThreadLocalLeak.java
    fails to find ThreadLocalObject
    + JDK-8211292: [TEST] convert com/sun/jdi/DeferredStepTest.sh
    test
    + JDK-8211694: JShell: Redeclared variable should be reset
    + JDK-8212200: assert when shared java.lang.Object is redefined
    by JVMTI agent
    + JDK-8212629: [TEST] wrong breakpoint in
    test/jdk/com/sun/jdi/DeferredStepTest
    + JDK-8212665: com/sun/jdi/DeferredStepTest.java: jj1 (line 57)
  - unexpected. lastLine=52, minLine=52, maxLine=55
    + JDK-8212807: tools/jar/multiRelease/Basic.java times out
    + JDK-8213182: Minimal VM build failure after JDK-8212200
    (assert when shared java.lang.Object is redefined by JVMTI
    agent)
    + JDK-8213214: Set -Djava.io.tmpdir= when running tests
    + JDK-8213275: ReplaceCriticalClasses.java fails with
    jdk.internal.vm.PostVMInitHook not found
    + JDK-8213574: Deadlock in string table expansion when dumping
    lots of CDS classes
    + JDK-8213703: LambdaConversionException: Invalid receiver type
    not a subtype of implementation type interface
    + JDK-8214074: Ghash optimization using AVX instructions
    + JDK-8214491: Upgrade to JLine 3.9.0
    + JDK-8214797: TestJmapCoreMetaspace.java timed out
    + JDK-8215243: JShell tests failing intermitently with
    "Problem cleaning up the following threads:"
    + JDK-8215244: jdk/jshell/ToolBasicTest.java
    testHistoryReference failed
    + JDK-8215354: x86_32 build failures after JDK-8214074 (Ghash
    optimization using AVX instructions)
    + JDK-8215438: jshell tool: Ctrl-D causes EOF
    + JDK-8216021: RunTest.gmk might set concurrency level to 1 on
    Windows
    + JDK-8216974: HttpConnection not returned to the pool after
    204 response
    + JDK-8218948: SimpleDateFormat :: format - Zone Names are not
    reflected correctly during run time
    + JDK-8219712: code_size2 (defined in stub_routines_x86.hpp) is
    too small on new Skylake CPUs
    + JDK-8220150: macos10.14 Mojave returns anti-aliased glyphs
    instead of aliased B&amp;W glyphs
    + JDK-8221658: aarch64: add necessary predicate for ubfx
    patterns
    + JDK-8221759: Crash when completing "java.io.File.path"
    + JDK-8221918: runtime/SharedArchiveFile/serviceability/
    /ReplaceCriticalClasses.java fails: Shared archive not found
    + JDK-8222074: Enhance auto vectorization for x86
    + JDK-8222079: Don't use memset to initialize fields decode_env
    constructor in disassembler.cpp
    + JDK-8222769: [TESTBUG] TestJFRNetworkEvents should not rely
    on hostname command
    + JDK-8223688: JShell: crash on the instantiation of raw
    anonymous class
    + JDK-8223777: In posix_spawn mode, failing to exec()
    jspawnhelper does not result in an error
    + JDK-8223940: Private key not supported by chosen signature
    algorithm
    + JDK-8224184: jshell got IOException at exiting with AIX
    + JDK-8224234: compiler/codegen/TestCharVect2.java fails in
    test_mulc
    + JDK-8225037: java.net.JarURLConnection::getJarEntry() throws
    NullPointerException
    + JDK-8225625: AES Electronic Codebook (ECB) encryption and
    decryption optimization using AVX512 + VAES instructions
    + JDK-8226536: Catch OOM from deopt that fails rematerializing
    objects
    + JDK-8226575: OperatingSystemMXBean should be made container
    aware
    + JDK-8226697: Several tests which need the @key headful
    keyword are missing it.
    + JDK-8226809: Circular reference in printed stack trace is not
    correctly indented &amp; ambiguous
    + JDK-8227059: sun/security/tools/keytool/
    /DefaultSignatureAlgorithm.java timed out
    + JDK-8227269: Slow class loading when running with JDWP
    + JDK-8227595: keytool/fakegen/DefaultSignatureAlgorithm.java
    fails due to "exitValue = 6"
    + JDK-8228448: Jconsole can't connect to itself
    + JDK-8228967: Trust/Key store and SSL context utilities for
    tests
    + JDK-8229378: jdwp library loader in linker_md.c quietly
    truncates on buffer overflow
    + JDK-8229815: Upgrade Jline to 3.12.1
    + JDK-8230000: some httpclients testng tests run zero test
    + JDK-8230002: javax/xml/jaxp/unittest/transform/
    /SecureProcessingTest.java runs zero test
    + JDK-8230010: Remove jdk8037819/BasicTest1.java
    + JDK-8230094: CCE in createXMLEventWriter(Result) over an
    arbitrary XMLStreamWriter
    + JDK-8230402: Allocation of compile task fails with assert:
    "Leaking compilation tasks?"
    + JDK-8230767: FlightRecorderListener returns null recording
    + JDK-8230870: (zipfs) Add a ZIP FS test that is similar to
    test/jdk/java/util/zip/EntryCount64k.java
    + JDK-8231209: [REDO] ThreadMXBean::getThreadAllocatedBytes()
    can be quicker for self thread
    + JDK-8231586: enlarge encoding space for OopMapValue offsets
    + JDK-8231953: Wrong assumption in assertion in
    oop::register_oop
    + JDK-8231968: getCurrentThreadAllocatedBytes default
    implementation s/b getThreadAllocatedBytes
    + JDK-8232083: Minimal VM is broken after JDK-8231586
    + JDK-8232161: Align some one-way conversion in MS950 charset
    with Windows
    + JDK-8232855: jshell missing word in /help help
    + JDK-8233027: OopMapSet::all_do does oms.next() twice during
    iteration
    + JDK-8233228: Disable weak named curves by default in TLS,
    CertPath, and Signed JAR
    + JDK-8233386: Initialize NULL fields for unused decorations
    + JDK-8233452: java.math.BigDecimal.sqrt() with
    RoundingMode.FLOOR results in incorrect result
    + JDK-8233686: XML transformer uses excessive amount of memory
    + JDK-8233741: AES Countermode (AES-CTR) optimization using
    AVX512 + VAES instructions
    + JDK-8233829: javac cannot find non-ASCII module name under
    non-UTF8 environment
    + JDK-8233958: Memory retention due to HttpsURLConnection
    finalizer that serves no purpose
    + JDK-8234011: (zipfs) Memory leak in
    ZipFileSystem.releaseDeflater()
    + JDK-8234058: runtime/CompressedOops/
    /CompressedClassPointers.java fails with 'Narrow klass base:
    0x0000000000000000' missing from stdout/stderr
    + JDK-8234149: Several regression tests do not dispose Frame at
    end
    + JDK-8234347: "Turkey" meta time zone does not generate
    composed localized names
    + JDK-8234385: [TESTBUG] java/awt/EventQueue/6980209/
    /bug6980209.java fails in linux nightly
    + JDK-8234535: Cross compilation fails due to missing CFLAGS
    for the BUILD_CC
    + JDK-8234541: C1 emits an empty message when it inlines
    successfully
    + JDK-8234687: change javap reporting on unknown attributes
    + JDK-8236464: SO_LINGER option is ignored by SSLSocket in JDK
    11
    + JDK-8236548: Localized time zone name inconsistency between
    English and other locales
    + JDK-8236617: jtreg test containers/docker/
    /TestMemoryAwareness.java fails after 8226575
    + JDK-8237182: Update copyright header for shenandoah and
    epsilon files
    + JDK-8237888: security/infra/java/security/cert/
    /CertPathValidator/certification/LuxTrustCA.java fails when
    checking validity interval
    + JDK-8237977: Further update
    javax/net/ssl/compatibility/Compatibility.java
    + JDK-8238270: java.net HTTP/2 client does not decrease stream
    count when receives 204 response
    + JDK-8238284: [macos] Zero VM build fails due to an obvious
    typo
    + JDK-8238380: java.base/unix/native/libjava/childproc.c
    "multiple definition" link errors with GCC10
    + JDK-8238386: (sctp) jdk.sctp/unix/native/libsctp/SctpNet.c
    "multiple definition" link errors with GCC10
    + JDK-8238388: libj2gss/NativeFunc.o "multiple definition" link
    errors with GCC10
    + JDK-8238448: RSASSA-PSS signature verification fail when
    using certain odd key sizes
    + JDK-8238710: LingeredApp doesn't log stdout/stderr if exits
    with non-zero code
    + JDK-8239083: C1 assert(known_holder == NULL ||
    (known_holder-&gt;is_instance_klass() &amp;&amp;
    (!known_holder-&gt;is_interface() ||
    ((ciInstanceKlass*)known_holder)-&gt;has_nonstatic_concrete_methods())),
    "should be non-static concrete method");
    + JDK-8239385: KerberosTicket client name refers wrongly to
    sAMAccountName in AD
    + JDK-8240169: javadoc fails to link to non-modular api docs
    + JDK-8240295: hs_err elapsed time in seconds is not accurate
    enough
    + JDK-8240360: NativeLibraryEvent has wrong library name on
    Linux
    + JDK-8240676: Meet not symmetric failure when running lucene
    on jdk8
    + JDK-8241007: Shenandoah: remove
    ShenandoahCriticalControlThreadPriority support
    + JDK-8241065: Shenandoah: remove leftover code after
    JDK-8231086
    + JDK-8241086: Test runtime/NMT/HugeArenaTracking.java is
    failing on 32bit Windows
    + JDK-8241130: com.sun.jndi.ldap.EventSupport.removeDeadNotifier:
    java.lang.NullPointerException
    + JDK-8241138: http.nonProxyHosts=* causes
    StringIndexOutOfBoundsException in DefaultProxySelector
    + JDK-8241319: WB_GetCodeBlob doesn't have ResourceMark
    + JDK-8241478: vmTestbase/gc/gctests/Steal/steal001/steal001.java
    fails with OOME
    + JDK-8241574: Shenandoah: remove ShenandoahAssertToSpaceClosure
    + JDK-8241750: x86_32 build failure after JDK-8227269
    + JDK-8242184: CRL generation error with RSASSA-PSS
    + JDK-8242283: Can't start JVM when java home path includes
    non-ASCII character
    + JDK-8242556: Cannot load RSASSA-PSS public key with non-null
    params from byte array
    + JDK-8243029: Rewrite javax/net/ssl/compatibility/
    /Compatibility.java with a flexible interop test framework
    + JDK-8243138: Enhance BaseLdapServer to support starttls
    extended request
    + JDK-8243320: Add SSL root certificates to Oracle Root CA
    program
    + JDK-8243321: Add Entrust root CA - G4 to Oracle Root CA
    program
    + JDK-8243389: enhance os::pd_print_cpu_info on linux
    + JDK-8243453: java --describe-module failed with non-ASCII
    module name under non-UTF8 environment
    + JDK-8243470: [macos] bring back O2 opt level for unsafe.cpp
    + JDK-8243489: Thread CPU Load event may contain wrong data for
    CPU time under certain conditions
    + JDK-8243925: Toolkit#getScreenInsets() returns wrong value on
    HiDPI screens (Windows)
    + JDK-8244087: 2020-04-24 public suffix list update
    + JDK-8244151: Update MUSCLE PC/SC-Lite headers to the latest
    release 1.8.26
    + JDK-8244164: AArch64: jaotc generates incorrect code for
    compressed OOPs with non-zero heap base
    + JDK-8244196: adjust output in os_linux
    + JDK-8244225: stringop-overflow warning on strncpy call from
    compile_the_world_in
    + JDK-8244287: JFR: Methods samples have line number 0
    + JDK-8244703: "platform encoding not initialized" exceptions
    with debugger, JNI
    + JDK-8244719: CTW: C2 compilation fails with
    "assert(!VerifyHashTableKeys || _hash_lock == 0) failed:
    remove node from hash table before modifying it"
    + JDK-8244729: Shenandoah: remove resolve paths from
    SBSA::generate_shenandoah_lrb
    + JDK-8244763: Update --release 8 symbol information after JSR
    337 MR3
    + JDK-8244818: Java2D Queue Flusher crash while moving
    application window to external monitor
    + JDK-8245151: jarsigner should not raise duplicate warnings on
    verification
    + JDK-8245616: Bump update version for OpenJDK: jdk-11.0.9
    + JDK-8245714: "Bad graph detected in build_loop_late" when
    loads are pinned on loop limit check uncommon branch
    + JDK-8245801: StressRecompilation triggers assert "redundunt
    OSR recompilation detected. memory leak in CodeCache!"
    + JDK-8245832: JDK build make-static-libs should build all JDK
    libraries
    + JDK-8245880: Shenandoah: check class unloading flag early in
    concurrent code root scan
    + JDK-8245981: Upgrade to jQuery 3.5.1
    + JDK-8246027: Minimal fastdebug build broken after JDK-8245801
    + JDK-8246094: [macos] Sound Recording and playback is not
    working
    + JDK-8246153: TestEliminateArrayCopy fails with
  - XX:+StressReflectiveCode
    + JDK-8246193: Possible NPE in ENC-PA-REP search in AS-REQ
    + JDK-8246196: javax/management/MBeanServer/OldMBeanServerTest
    fails with AssertionError
    + JDK-8246203: Segmentation fault in verification due to stack
    overflow with -XX:+VerifyIterativeGVN
    + JDK-8246330: Add TLS Tests for Legacy ECDSA curves
    + JDK-8246453: TestClone crashes with "all collected exceptions
    must come from the same place"
    + JDK-8247246: Add explicit ResolvedJavaType.link and expose
    presence of default methods
    + JDK-8247350: [aarch64] assert(false) failed: wrong size of
    mach node
    + JDK-8247502: PhaseStringOpts crashes while optimising
    effectively dead code
    + JDK-8247615: Initialize the bytes left for the heap sampler
    + JDK-8247824: CTW: C2 (Shenandoah) compilation fails with SEGV
    in SBC2Support::pin_and_expand
    + JDK-8247874: Replacement in VersionProps.java.template not
    working when --with-vendor-bug-url contains '&amp;'
    + JDK-8247979: aarch64: missing side effect of killing flags
    for clearArray_reg_reg
    + JDK-8248214: Add paddings for TaskQueueSuper to reduce
    false-sharing cache contention
    + JDK-8248219: aarch64: missing memory barrier in
    fast_storefield and fast_accessfield
    + JDK-8248348: Regression caused by the update to BCEL 6.0
    + JDK-8248385: [testbug][11u] Adapt TestInitiExceptions to
    jtreg 5.1
    + JDK-8248495: [macos] zerovm is broken due to libffi headers
    location
    + JDK-8248851: CMS: Missing memory fences between free chunk
    check and klass read
    + JDK-8248987: AOT's Linker.java seems to eagerly fail-fast on
    Windows
    + JDK-8249159: Downport test rework for SSLSocketTemplate from
    8224650
    + JDK-8249215: JFrame::setVisible crashed with
  - Dfile.encoding=UTF-8 on Japanese Windows.
    + JDK-8249251: [dark_mode ubuntu 20.04] The selected menu is
    not highlighted in GTKLookAndFeel
    + JDK-8249255: Build fails if source code in cygwin home dir
    + JDK-8249277: TestVerifyIterativeGVN.java is failing with
    timeout in OpenJDK 11
    + JDK-8249278: Revert JDK-8226253 which breaks the spec of
    AccessibleState.SHOWING for JList
    + JDK-8249560: Shenandoah: Fix racy GC request handling
    + JDK-8249801: Shenandoah: Clear soft-refs on requested GC cycle
    + JDK-8249953: Shenandoah: gc/shenandoah/mxbeans tests should
    account for corner cases
    + JDK-8250582: Revert Principal Name type to NT-UNKNOWN when
    requesting TGS Kerberos tickets
    + JDK-8250609: C2 crash in IfNode::fold_compares
    + JDK-8250627: Use -XX:+/-UseContainerSupport for
    enabling/disabling Java container metrics
    + JDK-8250755: Better cleanup for
    jdk/test/javax/imageio/plugins/shared/CanWriteSequence.java
    + JDK-8250787: Provider.put no longer registering aliases in
    FIPS env
    + JDK-8250826: jhsdb does not work with coredump which comes
    from Substrate VM
    + JDK-8250827: Shenandoah: needs to reset/finish StringTable's
    dead count before/after parallel walk
    + JDK-8250844: Make sure {type,obj}ArrayOopDesc accessors check
    the bounds
    + JDK-8251117: Cannot check P11Key size in P11Cipher and
    P11AEADCipher
    + JDK-8251354: Shenandoah: Fix jdk/jfr/tool/TestPrintJSON.java
    test failure
    + JDK-8251451: Shenandoah: Remark ObjectSynchronizer roots with
    I-U
    + JDK-8251469: Better cleanup for
    test/jdk/javax/imageio/SetOutput.java
    + JDK-8251487: Shenandoah: missing detail timing tracking for
    final mark cleaning phase
    + JDK-8252120: compiler/oracle/TestCompileCommand.java
    misspells "occured"
    + JDK-8252157: JDK-8231209 11u backport breaks jmm binary
    compatibility
    + JDK-8252258: [11u] JDK-8242154 changes the default vendor
    + JDK-8252804: [test] Fix 'ReleaseDeflater.java' test after
    downport of 8234011
    + JDK-8253134: JMM_VERSION should remain at 0x20020000 (JDK 10)
    in JDK 11
    + JDK-8253283: [11u] Test build/translations/
    /VerifyTranslations.java failing after JDK-8252258
    + JDK-8253813: Backout JDK-8244287 from 11u: it causes several
    crashes
- Removed patch:
  * gcc-fno-common-fix.patch
    + not needed any more with this version
- Added patch:
  * JDK-8250861.patch
    + Fix regression "8250861: Crash in MinINode::Ideal(PhaseGVN*,
    bool)" introduced in jdk 11.0.9</changelog>
  <changelog author="fstrba@suse.com" date="1604491200">- Enable Sheandoah GC for x86_64 (jsc#ECO-3171)</changelog>
  <changelog author="fstrba@suse.com" date="1605528000">- Update to upstream tag jdk-11.0.9.1-1
  * Fix:
    + JDK-8250861: Crash in MinINode::Ideal(PhaseGVN*, bool)
- Removed patch:
  * JDK-8250861.patch
    + Integrated upstream</changelog>
  <changelog author="fstrba@suse.com" date="1611230400">- Update to upstream tag jdk-11.0.10+9 (January 2021 CPU,
  bsc#1181239)
  * Security fixes
    + JDK-8247619: Improve Direct Buffering of Characters
  * Other changes
    + JDK-6722928: Support SSPI as a native GSS-API provider
    + JDK-7185258: [macosx] Deadlock in SunToolKit.realSync()
    + JDK-8152332: [macosx] JFileChooser cannot be serialized on
    Mac OS X
    + JDK-8161684: [testconf] Add VerifyOops' testing into compiler
    tiers
    + JDK-8171279: Support X25519 and X448 in TLS
    + JDK-8173361: various crashes in
    JvmtiExport::post_compiled_method_load
    + JDK-8173658: JvmtiExport::post_class_unload() is broken for
    non-JavaThread initiators
    + JDK-8191006: hsdis disassembler plugin does not compile with
    binutils 2.29+
    + JDK-8197981: Missing return statement in
    __sync_val_compare_and_swap_8
    + JDK-8198334: java/awt/FileDialog/8003399/bug8003399.java
    fails in headless mode
    + JDK-8200151: Add 8 JNDI tests to com/sun/jndi/dns/ConfigTests/
    + JDK-8208279: Add 8 JNDI tests to com/sun/jndi/dns/EnvTests/
    + JDK-8208483: Add 5 JNDI tests to
    com/sun/jndi/dns/FactoryTests/
    + JDK-8208542: Add 4 JNDI tests to com/sun/jndi/dns/ListTests/
    + JDK-8208665: Amend cross-compilation docs with
    qemu-debootstrap recipe
    + JDK-8210088: ProblemList gc/epsilon/TestMemoryMXBeans.java
    + JDK-8210339: Add 10 JNDI tests to com/sun/jndi/dns/FedTests/
    + JDK-8211450: UndetVar::dup is not copying the kind field to
    the duplicated instance
    + JDK-8212160: JVMTI agent crashes with "assert(_value != 0LL)
    failed: resolving NULL _value"
    + JDK-8212226: SurfaceManager throws "Invalid Image variant"
    for MultiResolutionImage (Windows)
    + JDK-8213400: Support choosing group name in keytool keypair
    generation
    + JDK-8213535: Windows HiDPI html lightweight tooltips are
    truncated
    + JDK-8213698: Improve devkit creation and add support for
    linux/ppc64/ppc64le/s390x
    + JDK-8214025: assert(t-&gt;singleton()) failed: must be a
    constant when ScavengeRootsInCode &lt; 2
    + JDK-8214242: compiler/arguments/TestScavengeRootsInCode.java
    fails because of missing UnlockDiagnosticVMOptions
    + JDK-8214787: Zero builds fail with "undefined
    JavaThread::thread_state()"
    + JDK-8215583: Exclude
    runtime/handshake/HandshakeWalkSuspendExitTest.java
    + JDK-8216012: Infinite loop in RSA KeyPairGenerator
    + JDK-8216324: GetClassMethods is confused by the presence of
    default methods in super interfaces
    + JDK-8217429: WebSocket over authenticating proxy fails to
    send Upgrade headers
    + JDK-8217976: test/jdk/java/net/httpclient/websocket/
    /WebSocketProxyTest.java fails intermittently
    + JDK-8218021: Have jarsigner preserve posix permission
    attributes
    + JDK-8218287: jshell tool: input behavior unstable after
    12-ea+24 on Windows
    + JDK-8218851: JVM crash in custom classloader stress test, JDK
    12 &amp; 13
    + JDK-8220420: Cleanup c1_LinearScan
    + JDK-8222072: JVMTI GenerateEvents() sends CompiledMethodLoad
    events to wrong jvmtiEnv
    + JDK-8222286: Fix for JDK-8213419 is broken on s390
    + JDK-8222527: HttpClient doesn't send HOST header when
    tunelling HTTP/1.1 through http proxy
    + JDK-8222533: jtreg test jdk/internal/platform/cgroup/
    /TestCgroupMetrics.java fails on SLES12.3 linux ppc64le
    machine
    + JDK-8224506: [TESTBUG] TestDockerMemoryMetrics.java fails
    with exitValue = 137
    + JDK-8224555: vmTestbase/nsk/jvmti/scenarios/contention/TC02/
    /tc02t001/TestDescription.java failed
    + JDK-8224650: Add tests to support X25519 and X448 in TLS
    + JDK-8225072: Add LuxTrust certificate that is expiring in
    March 2021 to list of allowed but expired certs
    + JDK-8225329: -XX:+PrintBiasedLockingStatistics causes crash
    during initialization on Windows platforms
    + JDK-8225687: Newly added sspi.cpp in JDK-6722928 still
    contains some small errors
    + JDK-8227006: [linux] Runtime.availableProcessors execution
    time increased by factor of 100
    + JDK-8227275: Within native OOM error handling, assertions may
    hang the process
    + JDK-8227647: [Graal] Test8009761.java fails due to
    "RuntimeException: static java.lang.Object
    compiler.uncommontrap.Test8009761.m3(boolean,boolean) not
    compiled"
    + JDK-8229495: SIGILL in C2 generated OSR compilation
    + JDK-8230910: libsspi_bridge does not build on Windows 32bit
    + JDK-8232114: JVM crashed at imjpapi.dll in native code
    + JDK-8234147: Avoid looking up standard charsets in core
    libraries
    + JDK-8234393: [macos] printing ignores printer tray
    + JDK-8234863: Increase default value of MaxInlineLevel
    + JDK-8235218: Minimal VM is broken after JDK-8173361
    + JDK-8235456: Minimal VM is broken after JDK-8212160
    + JDK-8235829: graal crashes with Zombie.java test
    + JDK-8236124: Minimal VM slowdebug build failed after
    JDK-8212160
    + JDK-8236512: PKCS11 Connection closed after Cipher.doFinal
    and NoPadding
    + JDK-8236944: The legVecZ operand should be limited to
    zmm0-zmm15 registers
    + JDK-8237186: Fix typo in copyright header of
    java/io/Reader/TransferTo.java
    + JDK-8237499: JFR: Include stack trace in the ThreadStart event
    + JDK-8237512: AArch64: aarch64TestHook leaks a BufferBlob
    + JDK-8237524: AArch64: String.compareTo() may return incorrect
    result
    + JDK-8237950: C2 compilation fails with "Live Node limit
    exceeded limit" during ConvI2L::Ideal optimization
    + JDK-8238579: HttpsURLConnection drops the timeout and hangs
    forever in read
    + JDK-8239105: Add exception for expiring Digicert root
    certificates to VerifyCACerts test
    + JDK-8239477: jdk/jfr/jcmd/TestJcmdStartStopDefault.java fails
  - XX:+VerifyOops with "verify_oop: rsi: broken oop"
    + JDK-8239497: SEGV in EdgeUtils::field_name_symbol(Edge const&amp;)
    + JDK-8239886: Minimal VM build fails after JDK-8237499
    + JDK-8240633: Memory leaks in the implementations of
    FileChooserUI
    + JDK-8240690: Race condition between EDT and
    BasicDirectoryModel.FilesLoader.run0()
    + JDK-8241234: Unify monitor enter/exit runtime entries.
    + JDK-8241311: Move some charset mapping tests from closed to
    open
    + JDK-8241797: Add some tests to the problem list
    + JDK-8242029: AArch64: skip G1 array copy pre-barrier if
    marking not active
    + JDK-8242335: Additional Tests for RSASSA-PSS
    + JDK-8242480: Negative value may be returned by
    getFreeSwapSpaceSize() in the docker
    + JDK-8242614: cleanup duplicated test ldap server in some
    com/sun/jndi/ldap/ tests
    + JDK-8242846: Bring back test/jdk/tools/jlink/plugins/
    /OrderResourcesPluginTest.java
    + JDK-8243114: Implement montgomery{Multiply,Square}intrinsics
    on Windows
    + JDK-8243290: Improve diagnostic messages for class
    verification and redefinition failures
    + JDK-8243488: Add tests for set/get SendBufferSize and
    getReceiveBufferSize in DatagramSocket
    + JDK-8243549: sun/security/ssl/CipherSuite/
    /NamedGroupsWithCipherSuite.java failed with Unsupported
    signature algorithm: DSA
    + JDK-8243617: compiler/onSpinWait/TestOnSpinWaitC1.java test
    uses wrong class
    + JDK-8243619: compiler/codecache/CheckSegmentedCodeCache.java
    test misses -version
    + JDK-8244142: some hotspot/runtime tests don't check exit code
    of forked JVM
    + JDK-8244278: Excessive code cache flushes and sweeps
    + JDK-8244282: test/hotspot/jtreg/compiler/intrinsics/
    /Test8237524.java fails with --illegal-access=deny
    + JDK-8244621: [macos10.15] Garbled FX printing plus CoreText
    warnings on Catalina when building with Xcode 11
    + JDK-8244819: hsdis does not compile with binutils 2.34+
    + JDK-8245051: c1 is broken if it is compiled by gcc without
  - fno-lifetime-dse
    + JDK-8245168: jlink should not be treated as a "small" tool
    + JDK-8245400: Upgrade to LittleCMS 2.11
    + JDK-8246381: VM crashes with "Current BasicObjectLock* below
    than low_mark"
    + JDK-8246434: Threads::print_on_error assumes that the heap
    has been set up
    + JDK-8246648: issue with OperatingSystemImpl
    getFreeSwapSpaceSize in docker after 8242480
    + JDK-8247201: Print potential pointer value of readable stack
    memory in hs_err file
    + JDK-8247763: assert(outer-&gt;outcnt() == 2) failed: 'only phis'
    failure in LoopNode::verify_strip_mined()
    + JDK-8247867: Upgrade to freetype 2.10.2
    + JDK-8248190: Enable Power10 system and implement new
    byte-reverse instructions
    + JDK-8248226: TestCloneAccessStressGCM fails with
  - XX:-ReduceBulkZeroing
    + JDK-8248347: windows build broken by JDK-8243114
    + JDK-8248532: Every time I change keyboard language at my
    MacBook, Java crashes
    + JDK-8248552: C2 crashes with SIGFPE due to division by zero
    + JDK-8248596: [TESTBUG] compiler/loopopts/
    /PartialPeelingUnswitch.java times out with Graal enabled
    + JDK-8248745: Add jarsigner and keytool tests for restricted
    algorithms
    + JDK-8248791: sun/util/resources/cldr/TimeZoneNamesTest.java
    fails with -XX:-ReduceInitialCardMarks -XX:-ReduceBulkZeroing
    + JDK-8248845: AArch64: stack corruption after spilling vector
    register
    + JDK-8249176: Update GlobalSignR6CA test certificates
    + JDK-8249183: JVM crash in "AwtFrame::WmSize" method
    + JDK-8249192: MonitorInfo stores raw oops across safepoints
    + JDK-8249602: C2: assert(cnt == _outcnt) failed: no insertions
    allowed
    + JDK-8249603: C1: assert(has_error == false) failed: register
    allocation invalid
    + JDK-8249605: C2: assert(no_dead_loop) failed: dead loop
    detected
    + JDK-8249607: C2: assert(!had_error) failed: bad dominance
    + JDK-8249608: Vector register used by C2 compiled method
    corrupted at safepoint
    + JDK-8249672: Include microcode revision in features_string on
    x86
    + JDK-8249748: gtest silently ignores bad jvm arguments
    + JDK-8249821: Separate libharfbuzz from libfontmanager
    + JDK-8250598: Hyper-V is detected in spite of running on host
    OS
    + JDK-8250605: Linux x86_32 builds fail after JDK-8249821
    + JDK-8250636: iso8601_time returns incorrect offset part on
    MacOS
    + JDK-8250665: Wrong translation for the month name of May in
    ar_JO,LB,SY
    + JDK-8250772: Test com/sun/jndi/ldap/
    /NamingExceptionMessageTest.java fails intermittently with
    javax.naming.ServiceUnavailableException
    + JDK-8250825: C2 crashes with assert(field != __null) failed:
    missing field
    + JDK-8250894: Provide a configure option to build and run
    against the platform libharfbuzz
    + JDK-8250928: JFR: Improve hash algorithm for stack traces
    + JDK-8250968: Symlinks attributes not preserved when using
    jarsigner on zip files
    + JDK-8250984: Memory Docker tests fail on some Linux kernels
    w/o cgroupv1 swap limit capabilities
    + JDK-8251118: BiasedLocking::preserve_marks should not have a
    HandleMark
    + JDK-8251189: com/sun/jndi/ldap/LdapDnsProviderTest.java
    failed due to timeout
    + JDK-8251257: NMT: jcmd VM.native_memory scale=1 crashes
    target VM
    + JDK-8251365: Build failure on AIX after 8250636
    + JDK-8251397: NPE on ClassValue.ClassValueMap.cacheArray
    + JDK-8251456: [TESTBUG] compiler/vectorization/
    /TestVectorsNotSavedAtSafepoint.java failed OutOfMemoryError
    + JDK-8251458: Parse::do_lookupswitch fails with "assert(_cnt
    &gt;= 0) failed"
    + JDK-8251535: Partial peeling at unsigned test adds incorrect
    loop exit check
    + JDK-8251949: ZGC: Set explicit heap size for
    compiler/gcbarriers tests
    + JDK-8252090: JFR: StreamWriterHost::write_unbuffered() stucks
    in an infinite loop OpenJDK (build 13.0.1+9)
    + JDK-8252415: Bump update version for OpenJDK: jdk-11.0.10
    + JDK-8252470: java/awt/dnd/DisposeFrameOnDragCrash/
    /DisposeFrameOnDragTest.java fails on Windows
    + JDK-8252497: Incorrect numeric currency code for ROL
    + JDK-8252660: Shenandoah: support manageable SoftMaxHeapSize
    option
    + JDK-8252679: Two windows specific FileDIalog tests may fail
    on some Windows_Server_2016_Standard
    + JDK-8252696: Loop unswitching may cause out of bound array
    load to be executed
    + JDK-8252754: Hash code calculation of JfrStackTrace is
    inconsistent
    + JDK-8253219: Epsilon: clean up unnecessary includes
    + JDK-8253224: Shenandoah: ShenandoahStrDedupQueue destructor
    calls virtual num_queues()
    + JDK-8253226: Shenandoah: remove unimplemented
    ShenandoahStrDedupQueue::verify
    + JDK-8253269: The CheckCommonColors test should provide more
    info on failure
    + JDK-8253284: Zero OrderAccess barrier mappings are incorrect
    + JDK-8253375: OSX build fails with Xcode 12.0 (12A7209)
    + JDK-8253778: ShenandoahSafepoint::is_at_shenandoah_safepoint
    should not access VMThread state from other threads
    + JDK-8253791: Issue with useAppleColor check in CSystemColors.m
    + JDK-8254016: Test8237524 fails with -XX:-CompactStrings option
    + JDK-8254081: java/security/cert/PolicyNode/
    /GetPolicyQualifiers.java fails due to an expired certificate
    + JDK-8254144: Non-x86 Zero builds fail with return-type
    warning in os_linux_zero.cpp
    + JDK-8254166: Zero: return-type warning in
    zeroInterpreter_zero.cpp
    + JDK-8254177: (tz) Upgrade time-zone data to tzdata2020b
    + JDK-8254185: Fix Code cache sweeper heuristics for JDK 11
    + JDK-8254190: [s390] interpreter misses exception check after
    calling monitorenter
    + JDK-8254790: SIGSEGV in string_indexof_char and
    stringL_indexof_char intrinsics
    + JDK-8254854: [cgroups v1] Metric limits not properly detected
    on some join controller combinations
    + JDK-8254982: (tz) Upgrade time-zone data to tzdata2020c
    + JDK-8255050: Add pkcs11/KeyStore/ClientAuth.sh to Problem list
    + JDK-8255065: Zero: accessor_entry misses the IRIW case
    + JDK-8255226: (tz) Upgrade time-zone data to tzdata2020d
    + JDK-8255269: Unsigned overflow in g1Policy.cpp
    + JDK-8255365: Problem list failing client manual tests
    + JDK-8255457: Shenandoah: cleanup ShenandoahMarkTask
    + JDK-8255466: C2 crashes at ciObject::get_oop() const+0x0
    + JDK-8255550: x86: Assembler::cmpq(Address dst, Register src)
    encoding is incorrect
    + JDK-8255603: Memory/Performance regression after JDK-8210985
    + JDK-8255760: Shenandoah: match constants style in
    ShenandoahMarkTask fallback
    + JDK-8255781: Bump patch update version for OpenJDK:
    jdk-11.0.9.1
    + JDK-8255937: Better cleanup for
    test/jdk/javax/imageio/stream/StreamFlush.java
    + JDK-8256427: Test com/sun/jndi/dns/ConfigTests/
    /PortUnreachable.java does not work on AIX
    + JDK-8256452: Integrate missing part of JDK-8232370 to 11u
    + JDK-8256483: [TESTBUG] serviceability/jvmti/GetClassMethods/
    /libOverpassMethods.c fails to compile on gcc 4.4.x
    + JDK-8256557: libharfbuzz fails to link on gcc 4.4.x due to
  - Wl,-z,defs
    + JDK-8256618: Zero: Linux x86_32 build still fails
    + JDK-8256736: Zero: GTest tests fail with "unsuppported vm
    variant"
    + JDK-8256809: Annotation processing causes NPE during flow
    analysis
    + JDK-8257181: s390x builds are very noisy with gc-sections
    messages
    + JDK-8257242: [macOS] Java app crashes while switching input
    methods
    + JDK-8257545: SunJSSE FIPS regression in key exchange after
    JDK-8171279 11u backport
    + JDK-8257641: Shenandoah: Query is_at_shenandoah_safepoint()
    from control thread should return false
    + JDK-8257701: Shenandoah: objArrayKlass metadata is not marked
    with chunked arrays
    + JDK-8258630: Add expiry exception for QuoVadis root
    certificate
- New upstream dependency on libharfbuzz
- Regenerated patches: missing-return.patch system-pcsclite.patch</changelog>
  <changelog author="fstrba@suse.com" date="1616155200">- Added patches:
  * system-crypto-policy.patch
    + Let OpenJDK use system crypto policies unless explicitely told
    not to
  * nss-security-provider.patch
    + Add the NSS security provider with configuration in generated
    nss.cfg file
  * keytool-default-rsa.patch
    + Make keytool generate RSA keys by default, since only the
    LEGACY system crypto policy allows DSA</changelog>
  <changelog author="pujos.michael@gmail.com" date="1618488000">- moved mozilla-nss dependency to java-11-openjdk-headless package
  This is necessary to be able to do crypto with just
  java-11-openjdk-headless installed. Fixes boo#1184606</changelog>
  <changelog author="fstrba@suse.com" date="1619006400">- Update to upstream tag jdk-11.0.11+9 (April 2021, CPU)
  * Security fixes
    + JDK-8244473: Contextualize registration for JNDI
    + JDK-8244543: Enhanced handling of abstract classes
    + JDK-8249906, CVE-2021-2163, bsc#1185055: Enhance opening JARs
    + JDK-8250568, CVE-2021-2161, bsc#1185056: Less ambiguous
    processing
    + JDK-8253799: Make lists of normal filenames
    + JDK-8257001: Improve Http Client Support
  * Other changes
    + JDK-7107012: sun.jvm.hotspot.code.CompressedReadStream
    readDouble() conversion to long mishandled
    + JDK-7146776: deadlock between URLStreamHandler.getHostAddress
    and file.Handler.openconnection
    + JDK-8086003: Test fails on OSX with java.lang.RuntimeException
    'Narrow klass base: 0x0000000000000000, Narrow klass shift: 3'
    missing
    + JDK-8168869: jdeps: localized messages don't use proper line
    breaks
    + JDK-8180837: SunPKCS11-NSS tests failing with
    CKR_ATTRIBUTE_READ_ONLY and CKR_MECHANISM_PARAM_INVALID
    + JDK-8202343: Disable TLS 1.0 and 1.1
    + JDK-8205992: jhsdb cannot attach to Java processes running in
    Docker containers
    + JDK-8209193: Fix aarch64-linux compilation after -Wreorder
    changes
    + JDK-8210413: AArch64: Optimize div/rem by constant in C1
    + JDK-8210578: AArch64: Invalid encoding for fmlsvs instruction
    + JDK-8211051: jdeps usage of --dot-output doesn't provide
    valid output for modular jar
    + JDK-8211057: Gensrc step CompileProperties generates unstable
    CompilerProperties output
    + JDK-8211150: G1 Full GC not purging code root memory and
    hence causing memory leak
    + JDK-8211825: ModuleLayer.defineModulesWithXXX does not setup
    delegation when module reads automatic module
    + JDK-8212043: Add floating-point Math.min/max intrinsics
    + JDK-8212218: [TESTBUG] runtime/ErrorHandling/
    /TestHeapDumpOnOutOfMemoryErrorInMetaspace.java timed out
    + JDK-8213116: javax/swing/JComboBox/WindowsComboBoxSize/
    /WindowsComboBoxSizeTest.java fails in Windows
    + JDK-8213909: jdeps --print-module-deps should report missing
    dependences
    + JDK-8214180: Need better granularity for sleeping
    + JDK-8214223: tools/jdeps/listdeps/ListModuleDeps.java failed
    due to missing Lib2 file
    + JDK-8214230: Classes generated by SystemModulesPlugin.java
    are not reproducable
    + JDK-8214741: docs/index.html has no title or copyright
    + JDK-8215687: [Graal] unit test CheckGraalIntrinsics failed
    after 8212043
    + JDK-8217848: [Graal] vmTestbase/nsk/jvmti/ResourceExhausted/
    /resexhausted003/TestDescription.java fails
    + JDK-8218482: sun/security/krb5/auto/ReplayCachePrecise.java
    failed - no KrbException thrown
    + JDK-8218550: Add test omitted from JDK-8212043
    + JDK-8221584: SIGSEGV in os::PlatformEvent::unpark() in
    JvmtiRawMonitor::raw_exit while posting method exit event
    + JDK-8221995: AARCH64: problems with CAS instructions encoding
    + JDK-8222518: Remove unnecessary caching of Parker object in
    java.lang.Thread
    + JDK-8222785: aarch64: add necessary masking for immediate
    shift counts
    + JDK-8223186: HotSpot compile warnings from GCC 9
    + JDK-8225773: jdeps --check produces NPE if there are missing
    module dependences
    + JDK-8225805: Java Access Bridge does not close the logger
    + JDK-8226810: Failed to launch JVM because of
    NullPointerException occured on System.props
    + JDK-8229396: jdeps ignores multi-release when
    generate-module-info used on command line
    + JDK-8229474: Shenandoah: Cleanup CM::update_roots()
    + JDK-8232225: Rework the fix for JDK-8071483
    + JDK-8232905: JFR fails with assertion:
    assert(t-&gt;unflushed_size() == 0) failed: invariant
    + JDK-8233164: C2 fails with assert(phase-&gt;C-&gt;get_alias_index(t)
    == phase-&gt;C-&gt;get_alias_index(t_adr)) failed: correct memory
    chain
    + JDK-8233910: java/awt/ColorClass/AlphaColorTest.java is
    failing  intermittently in nightly lnux-x64 system
    + JDK-8233912: aarch64: minor improvements of atomic operations
    + JDK-8234508: VM_HeapWalkOperation::iterate_over_object reads
    non-strong fields with an on-strong load barrier
    + JDK-8234742: Improve handshake logging
    + JDK-8234796: Refactor Handshake::execute to take a more
    complex type than ThreadClosure
    + JDK-8235324: Dying objects are published from users of
    CollectedHeap::object_iterate
    + JDK-8235351: Lookup::unreflect should bind with the original
    caller independent of Method's accessible flag
    + JDK-8237369: Shenandoah: failed vmTestbase/nsk/jvmti/
    /AttachOnDemand/attach021/TestDescription.java test
    + JDK-8237392: Shenandoah: Remove unreliable assertion
    + JDK-8237483: AArch64 C1 OopMap inserted twice fatal error
    + JDK-8237495: Java MIDI fails with a dereferenced memory error
    when asked to send a raw 0xF7
    + JDK-8239355: (dc) Initial value of SO_SNDBUF should allow
    sending large datagrams (macOS)
    + JDK-8240353: AArch64: missing support for
  - XX:+ExtendedDTraceProbes in C1
    + JDK-8240704: CheckHandles.java failed "AssertionError: Handle
    use increased by more than 10 percent."
    + JDK-8240751: Shenandoah: fold ShenandoahTracer definition
    + JDK-8240795: [REDO] 8238384 CTW: C2 compilation fails with
    "assert(store != load-&gt;find_exact_control(load-&gt;in(0)))
    failed: dependence cycle found"
    + JDK-8241598: Upgrade JLine to 3.14.0
    + JDK-8241649: Optimize Character.toString
    + JDK-8241770: Module xxxAnnotation() methods throw NCDFE if
    module-info.class found as resource in unnamed module
    + JDK-8241911: AArch64: Fix a potential register clash issue in
    reduce_add2I
    + JDK-8242030: Wrong package declarations in jline classes after
    JDK-8241598
    + JDK-8242565: Policy initialization issues when the denyAfter
    constraint is enabled
    + JDK-8243618: compiler/rtm/cli tests can be run w/o WhiteBox
    + JDK-8243670: Unexpected test result caused by C2
    MergeMemNode::Ideal
    + JDK-8244088: [Regression] Switch of Gnome theme ends up in
    deadlocked UI
    + JDK-8244154: Update SunPKCS11 provider with PKCS11 v3.0 header
    files
    + JDK-8244340: Handshake processing thread lacks yielding
    + JDK-8244573: java.lang.ArrayIndexOutOfBoundsException thrown
    for malformed class file
    + JDK-8244683: A TSA server used by tests
    + JDK-8245005: javax/net/ssl/compatibility/BasicConnectTest.java
    failed with No enum constant
    + JDK-8245026: PsAdaptiveSizePolicy::_old_gen_policy_is_ready is
    unused
    + JDK-8245283: JFR: Can't handle constant dynamic used by Jacoco
    agent
    + JDK-8245512: CRC32 optimization using AVX512 instructions
    + JDK-8245527: LDAP Channel Binding support for Java
    GSS/Kerberos
    + JDK-8246707: (sc) SocketChannel.read/write throws
    AsynchronousCloseException on closed channel
    + JDK-8246709: sun/security/tools/jarsigner/
    /TsacertOptionTest.java compilation failed after JDK-8244683
    + JDK-8247200: assert((unsigned)fpargs &lt; 32)
    + JDK-8247766: [aarch64] guarantee(val &lt; (1U &lt;&lt; nbits))
    failed: Field too big for insn.
    + JDK-8248336: AArch64: C2: offset overflow in
    BoxLockNode::emit
    + JDK-8248865: Document JNDI/LDAP timeout properties
    + JDK-8248901: Signed immediate support in
    .../share/assembler.hpp is broken.
    + JDK-8249543: Force DirectBufferAllocTest to run with
  - ExplicitGCInvokesConcurrent
    + JDK-8249588: libwindowsaccessbridge issues on 64bit Windows
    + JDK-8249749: modify a primitive array through a stream and a
    for cycle causes jre crash
    + JDK-8249787: Make TestGCLocker more resilient with concurrent
    GCs
    + JDK-8249867: xml declaration is not followed by a newline
    + JDK-8250911: [windows] os::pd_map_memory() error detection
    broken
    + JDK-8251255: [linux] Add process-memory information to hs-err
    and VM.info
    + JDK-8251359: Shenandoah: filter null oops before calling
    enqueue/SATB barrier
    + JDK-8251925: C2: RenaissanceStressTest fails with
    assert(!had_error): bad dominance
    + JDK-8251944: Add Shenandoah test config to
    compiler/gcbarriers/UnsafeIntrinsicsTest.java
    + JDK-8251992: VM crashed running TestComplexAddrExpr.java test
    with -XX:UseAVX=X
    + JDK-8253220: Epsilon: clean up unused code/declarations
    + JDK-8253274: The CycleDMImagetest brokes the system
    + JDK-8253353: Crash in C2: guarantee(n != NULL) failed: No Node
    + JDK-8253368: TLS connection always receives close_notify
    exception
    + JDK-8253404: C2: assert(C-&gt;live_nodes() &lt;=
    C-&gt;max_node_limit()) failed: Live Node limit exceeded limit
    + JDK-8253409: Double-rounding possibility in float fma
    + JDK-8253476: TestUseContainerSupport.java fails on some Linux
    kernels w/o swap limit capabilities
    + JDK-8253524: C2: Refactor code that clones predicates during
    loop unswitching
    + JDK-8253644: C2: assert(skeleton_predicate_has_opaque(iff))
    failed: unexpected
    + JDK-8253681: closed java/awt/dnd/MouseEventAfterStartDragTest/
    /MouseEventAfterStartDragTest.html test failed
    + JDK-8253702: BigSur version number reported as 10.16, should
    be 11.nn
    + JDK-8253756: C2 CompilerThread0 crash in Node::add_req(Node*)
    + JDK-8254104: MethodCounters must exist before nmethod is
    installed
    + JDK-8254734: "dead loop detected" assert failure with patch
    from 8223051
    + JDK-8254748: Bad Copyright header format after JDK-8212218
    + JDK-8254799: runtime/ErrorHandling/
    /TestHeapDumpOnOutOfMemoryError.java fails with release VMs
    + JDK-8255058: C1: assert(is_virtual()) failed: type check
    + JDK-8255351: Add detection for Graviton 2 CPUs
    + JDK-8255368: Math.exp() gives wrong result for large values on
    x86 32-bit platforms
    + JDK-8255387: Japanese characters were printed upside down on
    AIX
    + JDK-8255401: Shenandoah: Allow oldval and newval registers to
    overlap in cmpxchg_oop()
    + JDK-8255479: [aarch64] assert(src-&gt;section_index_of(target) ==
    CodeBuffer::SECT_NONE) failed: sanity
    + JDK-8255544: Create a checked cast
    + JDK-8255559: Leak File Descriptors Because of
    ResolverLocalFilesystem#engineResolveURI()
    + JDK-8255681: print callstack in error case in
    runAWTLoopWithApp
    + JDK-8255734: VM should ignore SIGXFSZ on ppc64, s390 too
    + JDK-8255742: PrintInlining as compiler directive doesn't print
    virtual calls
    + JDK-8255845: Memory leak in imageFile.cpp
    + JDK-8255880: UI of Swing components is not redrawn after their
    internal state changed
    + JDK-8255908: ExceptionInInitializerError due to
    UncheckedIOException while initializing cgroupv1 subsystem
    + JDK-8256025: AArch64: MachCallRuntimeNode::ret_addr_offset()
    is incorrect for stub calls
    + JDK-8256056: Deoptimization stub doesn't save vector registers
    on x86
    + JDK-8256061: RegisterSaver::save_live_registers() omits upper
    halves of ZMM0-15 registers
    + JDK-8256187: [TEST_BUG] Automate bug4275046.java test
    + JDK-8256220: C1: x86_32 fails with -XX:UseSSE=1 after
    JDK-8210764 due to mishandled lir_neg
    + JDK-8256258: some missing NULL checks or asserts after
    CodeCache::find_blob_unsafe
    + JDK-8256264: Printed GlyphVector outline with low DPI has bad
    quality on Windows
    + JDK-8256290: javac/lambda/T8031967.java fails with
    StackOverflowError on x86_32
    + JDK-8256359: AArch64: runtime/ReservedStack/
    /ReservedStackTestCompiler.java fails
    + JDK-8256387: Unexpected result if patching an entire
    instruction on AArch64
    + JDK-8256421: Add 2 HARICA roots to cacerts truststore
    + JDK-8256488: [aarch64] Use ldpq/stpq instead of ld4/st4 for
    small copies in StubGenerator::copy_memory
    + JDK-8256489: Make gtest for long path names on Windows more
    resilient in the presence of virus scanners
    + JDK-8256501: libTestMainKeyWindow fails to build with Xcode
    12.2
    + JDK-8256633: Fix product build on Windows+Arm64
    + JDK-8256682: JDK-8202343 is incomplete
    + JDK-8256751: Incremental rebuild with precompiled header fails
    when touching a header file
    + JDK-8256757: Incorrect MachCallRuntimeNode::ret_addr_offset()
    for CallLeafNoFP on x86_32
    + JDK-8256806: Shenandoah: optimize shenandoah/jni/
    /TestPinnedGarbage.java test
    + JDK-8256807: C2: Not marking stores correctly as mismatched
    in string opts
    + JDK-8256810: Incremental rebuild broken on Macosx
    + JDK-8256818: SSLSocket that is never bound or connected leaks
    socket resources
    + JDK-8256888: Client manual test problem list update
    + JDK-8257083: Security infra test failures caused by
    JDK-8202343
    + JDK-8257408: Bump update version for OpenJDK: jdk-11.0.11
    + JDK-8257423: [PPC64] Support -XX:-UseInlineCaches
    + JDK-8257436: [aarch64] Regressions in ArrayCopyUnalignedDst
    .testByte/testChar for 65-78 bytes when UseSIMDForMemoryOps
    is on
    + JDK-8257513: C2: assert((constant_addr -
    _masm.code()-&gt;consts()-&gt;start()) == con.offset())
    + JDK-8257547: Handle multiple prereqs on the same line in deps
    files
    + JDK-8257561: Some code is not vectorized after 8251925 and
    8250607
    + JDK-8257565: epsilonBarrierSet.hpp should not include
    barrierSetAssembler
    + JDK-8257575: C2: "failed: only phis" assert failure in loop
    strip mining verification
    + JDK-8257594: C2 compiled checkcast of non-null object triggers
    endless deoptimization/recompilation cycle
    + JDK-8257633: Missing -mmacosx-version-min=X flag when linking
    libjvm
    + JDK-8257670: sun/security/ssl/SSLSocketImpl/SSLSocketLeak.java
    reports leaks
    + JDK-8257707: Fix incorrect format string in Http1HeaderParser
    + JDK-8257746: Regression introduced with JDK-8250984 - memory
    might be null in some machines
    + JDK-8257798: [PPC64] undefined reference to
    Klass::vtable_start_offset()
    + JDK-8257884: Re-enable sun/security/ssl/SSLSocketImpl/
    /SSLSocketLeak.java as automatic test
    + JDK-8257910: [JVMCI] Set exception_seen accordingly in the
    runtime.
    + JDK-8257997: sun/security/ssl/SSLSocketImpl/SSLSocketLeak.java
    again reports leaks after JDK-8257884
    + JDK-8257999: Parallel GC crash in gc/parallel/
    /TestDynShrinkHeap.java: new region is not in covered_region
    + JDK-8258077: Using -Xcheck:jni can lead to a double-free after
    JDK-8193234
    + JDK-8258247: Couple of issues in fix for JDK-8249906
    + JDK-8258373: Update the text handling in the JPasswordField
    + JDK-8258396: SIGILL in jdk.jfr.internal.PlatformRecorder
    .rotateDisk()
    + JDK-8258419: RSA cipher buffer cleanup
    + JDK-8258471: "search codecache" clhsdb command does not work
    + JDK-8258534: Epsilon: clean up unused includes
    + JDK-8258805: Japanese characters not entered by mouse click
    on Windows 10
    + JDK-8258833: Cancel multi-part cipher operations in SunPKCS11
    after failures
    + JDK-8258836: JNI local refs exceed capacity
    getDiagnosticCommandInfo
    + JDK-8258884: [TEST_BUG] Convert applet-based test
    open/test/jdk/javax/swing/JMenuItem/8031573/bug8031573.java
    to a regular java test
    + JDK-8259007: This test printed a blank page
    + JDK-8259048: (tz) Upgrade time-zone data to tzdata2020f
    + JDK-8259049: Uninitialized variable after JDK-8257513
    + JDK-8259231: Epsilon: improve performance under contention
    during virtual space expansion
    + JDK-8259271: gc/parallel/TestDynShrinkHeap.java still fails
    "assert(covered_region.contains(new_memregion)) failed: new
    region is not in covered_region"
    + JDK-8259312: VerifyCACerts.java fails as soneraclass2ca cert
    will expire in 90 days
    + JDK-8259319: Illegal package access when SunPKCS11 requires
    SunJCE's classes
    + JDK-8259339: AllocateUninitializedArray C2 intrinsic fails
    with void.class input
    + JDK-8259428: AlgorithmId.getEncodedParams() should return copy
    + JDK-8259446: runtime/jni/checked/
    /TestCheckedReleaseArrayElements.java fails with stderr not
    empty
    + JDK-8259451: Zero: skip serviceability/sa tests, set vm.hasSA
    to false
    + JDK-8259580: Shenandoah: uninitialized label in
    VerifyThreadGCState
    + JDK-8259619: C1: 3-arg StubAssembler::call_RT stack-use
    condition is incorrect
    + JDK-8259633: compiler/graalunit/CoreTest.java fails with NPE
    after JDK-8244543
    + JDK-8259706: C2 compilation fails with assert(vtable_index ==
    Method::invalid_vtable_index) failed: correct sentinel value
    + JDK-8259707: LDAP channel binding does not work with StartTLS
    extension
    + JDK-8259773: Incorrect encoding of AVX-512 kmovq instruction
    + JDK-8259849: Shenandoah: Rename store-val to IU-barrier
    + JDK-8259949: x86 32-bit build fails when -fcf-protection is
    passed in the compiler flags
    + JDK-8259954: gc/shenandoah/mxbeans tests fail with -Xcomp
    + JDK-8260029: aarch64: fix typo in verify_oop_array
    + JDK-8260308: Update LogCompilation junit to 4.13.1
    + JDK-8260338: Some fields in HaltNode is not cloned
    + JDK-8260349: Cannot programmatically retrieve Metaspace max
    set via JAVA_TOOL_OPTIONS
    + JDK-8260356: (tz) Upgrade time-zone data to tzdata2021a
    + JDK-8260378: [TESTBUG] DcmdMBeanTestCheckJni.java reports
    false positive
    + JDK-8260497: Shenandoah: Improve SATB flushing
    + JDK-8260502: [s390] NativeMovRegMem::verify() fails because
    it's too strict
    + JDK-8260632: Build failures after JDK-8253353
    + JDK-8260704: ParallelGC: oldgen expansion needs release-store
    for _end
    + JDK-8261022: Fix incorrect result of Math.abs() with char type
    + JDK-8261089: [TESTBUG] native library of test
    TestCheckedReleaseCriticalArray.java fails to compile with
    gcc 4.x
    + JDK-8261183: Follow on to Make lists of normal filenames
    + JDK-8261209: isStandalone property: remove dependency on
    pretty-print
    + JDK-8261231: Windows IME was disabled after DnD operation
    + JDK-8261251: Shenandoah: Use object size for full GC
    humongous compaction
    + JDK-8261310: PPC64 Zero build fails with
    'VMError::controlled_crash(int)::FunctionDescriptor
    functionDescriptor' has incomplete type and cannot be defined
    + JDK-8261334: NMT: tuning statistic shows incorrect hash
    distribution
    + JDK-8261413: Shenandoah: Disable class-unloading in I-U mode
    + JDK-8261522: [PPC64] AES intrinsics write beyond the
    destination array
    + JDK-8261534: Test sun/security/pkcs11/KeyAgreement/
    /IllegalPackageAccess.java fails on platforms where no nsslib
    artifacts are defined
    + JDK-8261585: Restore HandleArea used in
    Deoptimization::uncommon_trap
    + JDK-8261753: Test java/lang/System/OsVersionTest.java still
    failing on BigSur patch versions after JDK-8253702
    + JDK-8261829: Exclude tools/jlink/JLinkReproducibleTest.java
    in 11u
    + JDK-8261912: Code IfNode::fold_compares_helper more
    defensively
    + JDK-8261920: [AIX] jshell command throws java.io.IOError on
    non English locales
    + JDK-8262018: Wrong format in SAP copyright header of
    OsVersionTest
    + JDK-8263069: Exclude some failing tests from
    security/infra/java/security/cert/CertPathValidator</changelog>
  <changelog author="fstrba@suse.com" date="1620043200">- Remove all Jpackage provides for SLE12 in order to avoid
  installing this package as default Java on SLE12-SP5
  (bsc#1185476)</changelog>
  <changelog author="fstrba@suse.com" date="1621512000">- Modified patch:
  * nss-security-provider.patch
    + make the NSS provider first in the list</changelog>
  <changelog author="fstrba@suse.com" date="1626868800">- Update to upstream tag jdk-11.0.12+7 (July 2021, CPU)
  * Security fixes
    + JDK-8256157: Improve bytecode assembly
    + JDK-8256491: Better HTTP transport
    + JDK-8258432, CVE-2021-2341, bsc#1188564: Improve file
    transfers
    + JDK-8260453: Improve Font Bounding
    + JDK-8260960: Signs of jarsigner signing
    + JDK-8260967, CVE-2021-2369, bsc#1188565: Better jar file
    validation
    + JDK-8262380: Enhance XML processing passes
    + JDK-8262403: Enhanced data transfer
    + JDK-8262410: Enhanced rules for zones
    + JDK-8262477: Enhance String Conclusions
    + JDK-8262967: Improve Zip file support
    + JDK-8264066, CVE-2021-2388, bsc#1188566: Enhance compiler
    validation
    + JDK-8264079: Improve abstractions
    + JDK-8264460: Improve NTLM support
  * Other changes
    + JDK-6847157: java.lang.NullPointerException: HDC for
    component at sun.java2d.loops.Blit.Blit
    + JDK-7106851: Test should not use System.exit
    + JDK-8073446: TimeZone getOffset API does not  return a dst
    offset between years 2038-2137
    + JDK-8076190: Customizing the generation of a PKCS12 keystore
    + JDK-8153005: Upgrade the default PKCS12 encryption/MAC
    algorithms
    + JDK-8171303: sun/java2d/pipe/InterpolationQualityTest.java
    fails on Windows &amp; Linux
    + JDK-8177068: incomplete classpath causes NPE in Flow
    + JDK-8185734: [Windows] Structured Exception Catcher missing
    around gtest execution
    + JDK-8187450: JNI local refs exceeds capacity warning in
    NetworkInterface::getAll
    + JDK-8190763: Class cast exception on (CompoundEdit)
    UndoableEditEvent.getEdit()
    + JDK-8195841: PNGImageReader.readNullTerminatedString() doesnt
    check for non-null terminated strings with length equal to
    maxLen
    + JDK-8196100: javax/swing/text/JTextComponent/5074573/
    /bug5074573.java fails
    + JDK-8199646: JShell tests: jdk/jshell/
    /FailOverDirectExecutionControlTest.java failed with
    java.lang.UnsupportedOperationException
    + JDK-8206925: Support the certificate_authorities extension
    + JDK-8207160: ClassReader::adjustMethodParams can potentially
    return null if the args list is empty
    + JDK-8207247: AARCH64: Enable Minimal and Client VM builds
    + JDK-8207404: MulticastSocket tests failing on AIX
    + JDK-8207779: Method::is_valid_method() compares 'this' with
    NULL
    + JDK-8208061: runtime/LoadClass/TestResize.java fails with
    "Load factor too high" when running in CDS mode.
    + JDK-8209459: TestSHA512MultiBlockIntrinsics failed on AArch64
    + JDK-8210443: Migrate Locale matching tests to JDK Repo.
    + JDK-8213231: ThreadSnapshot::_threadObj can become stale
    + JDK-8213483: ARM32: runtime/ErrorHandling/
    /ShowRegistersOnAssertTest.java jtreg test fail
    + JDK-8213725: JShell NullPointerException due to class file
    with unexpected package
    + JDK-8213794: ARM32: disable TypeProfiling,
    CriticalJNINatives, Serviceablity tests for ARM32
    + JDK-8213845: ARM32: Interpreter doesn't call result handler
    after native calls
    + JDK-8214128: ARM32: wrong stack alignment on
    Deoptimization::unpack_frames
    + JDK-8214512: ARM32: Jtreg test compiler/c2/Test8062950.java
    fails on ARM
    + JDK-8214854: JDWP: Unforseen output truncation in logging
    + JDK-8214922: Add vectorization support for fmin/fmax
    + JDK-8215009: GCC 8 compilation error in libjli
    + JDK-8216184: CDS/appCDS tests failed on Windows due to long
    path to a classlist file
    + JDK-8216259: AArch64: Vectorize Adler32 intrinsics
    + JDK-8216314: SIGILL in CodeHeapState::print_names()
    + JDK-8217348: assert(thread-&gt;is_Java_thread()) failed: just
    checking
    + JDK-8217465: [REDO] - Optimize CodeHeap Analytics
    + JDK-8217561: X86: Add floating-point Math.min/max intrinsics
    + JDK-8217918: C2: -XX:+AggressiveUnboxing is broken
    + JDK-8218458: [TESTBUG] runtime/NMT/
    /CheckForProperDetailStackTrace.java fails with Expected
    stack trace missing from output
    + JDK-8219142: Remove unused JIMAGE_ResourcePath
    + JDK-8219586: CodeHeap State Analytics processes dead nmethods
    + JDK-8220074: Clean up GCC 8.3 errors in LittleCMS
    + JDK-8220407: compiler/intrinsics/math/
    /TestFpMinMaxIntrinsics.java timedout
    + JDK-8222302: [TESTBUG] test/hotspot/jtreg/compiler/intrinsics/
    /sha/cli/TestUseSHAOptionOnUnsupportedCPU.java fails on any
    other CPU
    + JDK-8222412: AARCH64: multiple instructions encoding issues
    + JDK-8223020: aarch64: expand minI_rReg and maxI_rReg patterns
    into separate instructions
    + JDK-8223444: Improve CodeHeap Free Space Management
    + JDK-8223504: Improve performance of forall loops by better
    inlining of "iterator()" methods
    + JDK-8223667: ASAN build broken
    + JDK-8225081: Remove Telia Company CA certificate expiring in
    April 2021
    + JDK-8225116: Test OwnedWindowsLeak.java intermittently fails
    + JDK-8225438: javax/net/ssl/TLSCommon/
    /TestSessionLocalPrincipal.java failed with Read timed out
    + JDK-8225756: [testbug] compiler/loopstripmining/
    /CheckLoopStripMining.java sets too short a
    SafepointTimeoutDelay
    + JDK-8226374: Restrict TLS signature schemes and named groups
    + JDK-8226627: assert(t-&gt;singleton()) failed: must be a constant
    + JDK-8226721: Missing intrinsics for Math.ceil, floor, rint
    + JDK-8227080: (fs) Files.newInputStream(...).skip(n) is slow
    + JDK-8227222: vmTestbase/jit/FloatingPoint/gen_math/Loops04/
    /Loops04.java failed XMM register should be 0-15
    + JDK-8227609: (fs) Files.newInputStream(...).skip(n) should
    allow skipping beyond file size
    + JDK-8230428: Cleanup dead CastIP node code in formssel.cpp
    + JDK-8231460: Performance issue (CodeHeap) with large free
    blocks
    + JDK-8231713: x86_32 build failures after JDK-8226721 (Missing
    intrinsics for Math.ceil, floor, rint)
    + JDK-8231841: AArch64: debug.cpp help() is missing an AArch64
    line for pns
    + JDK-8232084: HotSpot build failed with GCC 9.2.1
    + JDK-8232591: AArch64: Add missing match rules for smaddl,
    smsubl and smnegl
    + JDK-8233185: HttpServer.stop() blocks indefinitely when
    called on dispatch thread
    + JDK-8233787: Break cycle in vm_version* includes
    + JDK-8233948: AArch64: Incorrect mapping between OptoReg and
    VMReg for high 64 bits of Vector Register
    + JDK-8234355: Buffer overflow in jcmd GC.class_stats due to
    too many classes
    + JDK-8235368: Update BCEL to Version 6.4.1
    + JDK-8236859: WebSocket over authenticating proxy fails with
    NPE
    + JDK-8236992: AArch64: remove redundant load_klass in itable
    stub
    + JDK-8237743: test/langtools/jdk/jshell/
    /FailOverExecutionControlTest.java fails No
    ExecutionControlProvider with name 'nonExistent' and parameter
    keys: []
    + JDK-8237804: sun/security/mscapi tests fail with "Key pair
    not generated, alias &lt;nnnnnn&gt; already exists"
    + JDK-8238175: CTW: Class.getDeclaredMethods fails with
    assert(k-&gt;is_subclass_of(SystemDictionary::Throwable_klass()))
    failed: invalid exception class
    + JDK-8238567: SoftMainMixer.processAudioBuffers(): Wrong
    handling of stoppedMixers
    + JDK-8238812: assert(false) failed: bad AD file
    + JDK-8239312: [macos] javax/swing/JFrame/NSTexturedJFrame/
    /NSTexturedJFrame.java
    + JDK-8239386: handle ContendedPaddingWidth in
    vm_version_aarch64
    + JDK-8239536: Can't use 'java.util.List' object after
    importing 'java.awt.List'
    + JDK-8240487: Cleanup whitespace in .cc, .hh, .m, and .mm files
    + JDK-8240848: ArrayIndexOutOfBoundsException buf for
    TextCallbackHandler
    + JDK-8241082: Upgrade IANA Language Subtag Registry data to
    03-16-2020 version
    + JDK-8241087: Build failure with VS 2019 (16.5.0) due to C2039
    and C2873
    + JDK-8241101: [s390] jtreg test failure after JDK-8238696: not
    conformant features string
    + JDK-8241248: NullPointerException in
    sun.security.ssl.HKDF.extract(HKDF.java:93)
    + JDK-8241372: Several test failures due to
    javax.net.ssl.SSLException: Connection reset
    + JDK-8241475: AArch64: Add missing support for PopCountVI node
    + JDK-8241829: Cleanup the code for PrinterJob on windows
    + JDK-8241960: The SHA3 message digests impl of SUN provider
    are not thread safe after cloned
    + JDK-8242010: Upgrade IANA Language Subtag Registry to Version
    2020-04-01
    + JDK-8242429: Better implementation for sign extract
    + JDK-8242557: Add length limit for strings in PNGImageWriter
    + JDK-8242919: Paste locks up jshell
    + JDK-8243155: AArch64: Add support for SqrtVF
    + JDK-8243240: AArch64: Add support for MulVB
    + JDK-8243452: JFR: Could not create chunk in repository with
    over 200 recordings
    + JDK-8243559: Remove root certificates with 1024-bit keys
    + JDK-8243597: AArch64: Add support for integer vector abs
    + JDK-8244031: HttpClient should have more tests for HEAD
    requests
    + JDK-8244205: HTTP/2 tunnel connections through proxy may be
    reused regardless of which proxy is selected
    + JDK-8244847: Linux/PPC: runtime/CompressedOops/
    /CompressedClassPointers: smallHeapTest fails
    + JDK-8245511: G1 adaptive IHOP does not account for
    reclamation of humongous objects by young GC
    + JDK-8246274: G1 old gen allocation tracking is not in a
    separate class
    + JDK-8247354: [aarch64] PopFrame causes
    assert(oopDesc::is_oop(obj)) failed: not an oop
    + JDK-8247408: IdealGraph bit check expression canonicalization
    + JDK-8247432: Update IANA Language Subtag Registry to Version
    2020-09-29
    + JDK-8247438: JShell: When FailOverExecutionControlProvider
    fails the proximal cause is not shown
    + JDK-8247753: UIManager.getSytemLookAndFeelClassName() returns
    wrong value on Fedora 32
    + JDK-8248043: Need to eliminate excessive i2l conversions
    + JDK-8248411: [aarch64] Insufficient error handling when
    CodeBuffer is exhausted
    + JDK-8248568: compiler/c2/TestBit.java failed: test missing
    from stdout/stderr
    + JDK-8248870: AARCH64: I2L/L2I conversions can be skipped for
    masked positive values
    + JDK-8249142: java/awt/FontClass/CreateFont/DeleteFont.sh is
    unstable
    + JDK-8249189: AARCH64: more L2I conversions can be skipped
    + JDK-8249719: MethodHandle performance suffers from bad
    ResolvedMethodTable hash function
    + JDK-8249875: GCC 10 warnings -Wtype-limits with JFR code
    + JDK-8250635: MethodArityHistogram should use Compile_lock in
    favour of fancy checks
    + JDK-8250876: Fix issues with cross-compile on macos
    + JDK-8251031: Some vmTestbase/nsk/monitoring/RuntimeMXBean
    tests fail with hostnames starting from digits
    + JDK-8251525: AARCH64: Faster Math.signum(fp)
    + JDK-8252259: AArch64: Adjust default value of FLOATPRESSURE
    + JDK-8252311: AArch64: save two words in itable lookup stub
    + JDK-8252779: compiler/graalunit/HotspotTest.java failed after
    8251525
    + JDK-8252883: AccessDeniedException caused by delayed file
    deletion on Windows
    + JDK-8253167: ARM32 builds fail after JDK-8247910
    + JDK-8253572: [windows] CDS archive may fail to open with long
    file names
    + JDK-8253923: C2 doesn't always run loop opts for compilations
    that include loops
    + JDK-8253948: Memory leak in ImageFileReader
    + JDK-8254631: Better support ALPN byte wire values in SunJSSE
    + JDK-8254717: isAssignableFrom checks in
    KeyFactorySpi.engineGetKeySpec appear to be backwards
    + JDK-8255086: Update the root locale display names
    + JDK-8255625: AArch64: Implement Base64.encodeBlock
    accelerator/intrinsic
    + JDK-8255763: C2: OSR miscompilation caused by invalid memory
    instruction placement
    + JDK-8255992: JFR EventWriter does not use first string from
    StringPool with id 0
    + JDK-8256037: [TESTBUG] com/sun/jndi/dns/ConfigTests/
    /PortUnreachable.java fails due to the hard coded threshold
    is small
    + JDK-8256244: java/lang/ProcessHandle/PermissionTest.java
    fails with TestNG 7.1
    + JDK-8256287: [windows] add loop fuse to
    map_or_reserve_memory_aligned
    + JDK-8256523: Streamline Java SHA2 implementation
    + JDK-8257414: Drag n Drop target area is wrong on high DPI
    systems
    + JDK-8257569: Failure observed with
    JfrVirtualMemory::initialize
    + JDK-8257574: C2: "failed: parsing found no loops but there
    are some" assert failure
    + JDK-8257580: Bump update version for OpenJDK: jdk-11.0.12
    + JDK-8257604: JNI_ArgumentPusherVaArg leaks valist
    + JDK-8257621: JFR StringPool misses cached items across
    consecutive recordings
    + JDK-8257796: [TESTBUG]
    TestUseSHA512IntrinsicsOptionOnSupportedCPU.java fails
    on x86_32
    + JDK-8257822: C2 crashes with SIGFPE due to a division that
    floats above its zero check
    + JDK-8257828: SafeFetch may crash if invoked in non-JavaThreads
    + JDK-8257853: Remove dependencies on JNF's JNI utility
    functions in AWT and 2D code
    + JDK-8257858: [macOS]: Remove JNF dependency from
    libosxsecurity/KeystoreImpl.m
    + JDK-8257860: [macOS]: Remove JNF dependency from
    libosxkrb5/SCDynamicStoreConfig.m
    + JDK-8257988: Remove JNF dependency from
    libsaproc/MacosxDebuggerLocal.m
    + JDK-8258414: OldObjectSample events too expensive
    + JDK-8258505: [TESTBUG] TestDivZeroWithSplitIf.java fails due
    to missing UnlockDiagnosticVMOptions
    + JDK-8258753: StartTlsResponse.close() hangs due to
    synchronization issues
    + JDK-8259061: C2: assert(found) failed: memory-writing node is
    not placed in its original loop or an ancestor of it
    + JDK-8259227: C2 crashes with SIGFPE due to a division that
    floats above its zero check
    + JDK-8259232: Bad JNI lookup during printing
    + JDK-8259276: C2: Empty expression stack when reexecuting
    tableswitch/lookupswitch instructions after deoptimization
    + JDK-8259343: [macOS] Update JNI error handling in Cocoa code.
    + JDK-8259585: Accessible actions do not work on mac os x
    + JDK-8259651: [macOS] Replace JNF_COCOA_ENTER/EXIT macros
    + JDK-8259662: Don't wrap SocketExceptions into SSLExceptions
    in SSLSocketImpl
    + JDK-8259710: Inlining trace leaks memory
    + JDK-8259729: Missed JNFInstanceOf -&gt; IsInstanceOf conversion
    + JDK-8259777: Incorrect predication condition generated by ADLC
    + JDK-8259786: initialize last parameter of getpwuid_r
    + JDK-8259843: initialize dli_fname array before calling
    dll_address_to_library_name
    + JDK-8259869: [macOS] Remove desktop module dependencies on
    JNF Reference APIs
    + JDK-8259886: Improve SSL session cache performance and
    scalability
    + JDK-8259983: do not use uninitialized expand_ms value in
    G1CollectedHeap::expand_heap_after_young_collection
    + JDK-8260030: Improve stringStream buffer handling
    + JDK-8260236: better init AnnotationCollector _contended_group
    + JDK-8260255: C1: LoopInvariantCodeMotion constructor can
    leave some fields uninitialized
    + JDK-8260284: C2: assert(_base == Int) failed: Not an Int
    + JDK-8260380: Upgrade to LittleCMS 2.12
    + JDK-8260420: C2 compilation fails with assert(found_sfpt)
    failed: no node in loop that's not input to safepoint
    + JDK-8260426: awt debug_mem.c DMem_AllocateBlock might leak
    memory
    + JDK-8260432: allocateSpaceForGP in freetypeScaler.c might
    leak memory
    + JDK-8260616: Removing remaining JNF dependencies in the
    java.desktop module
    + JDK-8260653: Unreachable nodes keep speculative types alive
    + JDK-8260707: java/lang/instrument/PremainClass/
    /InheritAgent0100.java times out
    + JDK-8260925: HttpsURLConnection does not work  with other
    JSSE provider.
    + JDK-8260926: Trace resource exhausted events unconditionally
    + JDK-8261020: Wrong format parameter in
    create_emergency_chunk_path
    + JDK-8261027: AArch64: Support for LSE atomics C++ HotSpot code
    + JDK-8261167: print_process_memory_info add a close call after
    fopen
    + JDK-8261170: Upgrade to freetype 2.10.4
    + JDK-8261198: [macOS] Incorrect JNI parameters in number
    conversion in A11Y code
    + JDK-8261235: C1 compilation fails with
    assert(res-&gt;vreg_number() == index) failed: conversion check
    + JDK-8261261: The version extra fields needs to be overridable
    in jib-profiles.js
    + JDK-8261262: Kitchensink24HStress.java crashed with
    EXCEPTION_ACCESS_VIOLATION
    + JDK-8261354: SIGSEGV at MethodIteratorHost
    + JDK-8261355: No data buffering in SunPKCS11 Cipher encryption
    when the underlying mechanism has no padding
    + JDK-8261397: try catch Method failing to work when dividing
    an integer by 0
    + JDK-8261422: Adjust problematic String.format calls in
    jdk/internal/util/Preconditions.java outOfBoundsMessage
    + JDK-8261447: MethodInvocationCounters frequently run into
    overflow
    + JDK-8261481: Cannot read Kerberos settings in dynamic store
    on macOS Big Sur
    + JDK-8261505: Test test/hotspot/jtreg/gc/parallel/
    /TestDynShrinkHeap.java killed by Linux OOM Killer
    + JDK-8261601: free memory in early return in
    Java_sun_nio_ch_sctp_SctpChannelImpl_receive0
    + JDK-8261649: AArch64: Optimize LSE atomics in C++ code
    + JDK-8261730: C2 compilation fails with
    assert(store-&gt;find_edge(load) != -1) failed: missing
    precedence edge
    + JDK-8261752: Multiple GC test are missing memory requirements
    + JDK-8261791: (sctp) handleSendFailed in SctpChannelImpl.c
    potential leaks
    + JDK-8261812: C2 compilation fails with assert(!had_error)
    failed: bad dominance
    + JDK-8261914: IfNode::fold_compares_helper faces
    non-canonicalized bool when running JRuby JSON workload
    + JDK-8262093: java/util/concurrent/tck/JSR166TestCase.java
    failed "assert(false) failed: unexpected node"
    + JDK-8262110: DST starts from incorrect time in 2038
    + JDK-8262121: [11u] Redo 8244287: JFR: Methods samples have
    line number 0
    + JDK-8262163: Extend settings printout in jcmd VM.metaspace
    + JDK-8262295: C2: Out-of-Bounds Array Load from Clone Source
    + JDK-8262298: G1BarrierSetC2::step_over_gc_barrier fails with
    assert "bad barrier shape"
    + JDK-8262446: DragAndDrop hangs on Windows
    + JDK-8262461: handle wcstombsdmp return value correctly in
    unix awt_InputMethod.c
    + JDK-8262465: Very long compilation times and high memory
    consumption in C2 debug builds
    + JDK-8262726: AArch64: C1 StubAssembler::call_RT can corrupt
    stack
    + JDK-8262739: String inflation C2 intrinsic prevents insertion
    of anti-dependencies
    + JDK-8262829: Native crash in
    Win32PrintServiceLookup.getAllPrinterNames()
    + JDK-8262837: handle split_USE correctly
    + JDK-8262900: ToolBasicTest fails to access HTTP server it
    starts
    + JDK-8263260: [s390] Support latest hardware (z14 and z15)
    + JDK-8263311: Watch registry changes for remote printers
    update instead of polling
    + JDK-8263361: Incorrect arraycopy stub selected by C2 for SATB
    collectors
    + JDK-8263404: RsaPrivateKeySpec is always recognized as
    RSAPrivateCrtKeySpec in RSAKeyFactory.engineGetKeySpec
    + JDK-8263425: AArch64: two potential bugs in C1
    LIRGenerator::generate_address()
    + JDK-8263448: CTW: fatal error: meet not symmetric
    + JDK-8263504: Some OutputMachOpcodes fields are uninitialized
    + JDK-8263557: Possible NULL dereference in
    Arena::destruct_contents()
    + JDK-8263558: Possible NULL dereference in fast path arena
    free if ZapResourceArea is true
    + JDK-8263676: AArch64: one potential bug in C1
    LIRGenerator::generate_address()
    + JDK-8263729: [test] divert spurious output away from stream
    under test in ProcessBuilder Basic test
    + JDK-8263846: Bad JNI lookup getFocusOwner in accessibility
    code on Mac OS X
    + JDK-8264047: Duplicate global variable 'jvm' in libjavajpeg
    and libawt
    + JDK-8264096: slowdebug jvm crashes when StrInflatedCopy match
    rule is not supported
    + JDK-8264151: ciMethod::ensure_method_data() should return
    false is loading resulted in empty state
    + JDK-8264173: [s390] Improve Hardware Feature Detection And
    Reporting
    + JDK-8264190: Harden TLS interop tests
    + JDK-8264223: CodeHeap::verify fails extra_hops assertion in
    fastdebug test
    + JDK-8264328: Broken license in
    javax/swing/JComboBox/8072767/bug8072767.java
    + JDK-8264360: Loop strip mining verification fails with
    "should be on the backedge"
    + JDK-8264626: C1 should be able to inline excluded methods
    + JDK-8264640: CMS ParScanClosure misses a barrier
    + JDK-8264786: [macos] All Swing/AWT apps cause Allow
    Notifications prompt to appear when app is launched
    + JDK-8264821: DirectIOTest fails on a system with large block
    size
    + JDK-8264848: [macos] libjvm.dylib linker warning due to macOS
    version mismatch
    + JDK-8264923: PNGImageWriter.write_zTXt throws Exception with
    a typo
    + JDK-8264958: C2 compilation fails with assert "n is later
    than its clone"
    + JDK-8265099: Revert backport to 11u of 8236859: WebSocket
    over authenticating proxy fails with NPE
    + JDK-8265154: vinserti128 operand mix up for KNL platforms
    + JDK-8265239: Shenandoah: Shenandoah heap region count could
    be off by 1
    + JDK-8265417: Backport of JDK-8249672 breaks Solaris x86 build
    + JDK-8265421: java/lang/String/StringRepeat.java test is
    missing a memory requirement
    + JDK-8265462: Handle multiple slots in the NSS Internal Module
    from SunPKCS11's Secmod
    + JDK-8265537: x86 version string truncated after JDK-8249672
    11u backport
    + JDK-8265666: Enable AIX build platform to make external debug
    symbols
    + JDK-8265677: CMS: CardTableBarrierSet::write_ref_array_work()
    lacks storestore barrier
    + JDK-8265690: Use the latest Ubuntu base image version in
    Docker testing
    + JDK-8265718: Build failure after JDK-8258414 11u backport
    + JDK-8265750: Fatal error in safepoint.cpp after backport of
    8258414
    + JDK-8265784: [C2] Hoisting of DecodeN leaves MachTemp inputs
    behind
    + JDK-8265938: C2's conditional move optimization does not
    handle top Phi
    + JDK-8266220: keytool still prompt for store password on a
    password-less pkcs12 file if -storetype pkcs12 is specified
    + JDK-8266293: Key protection using PBEWithMD5AndDES fails with
    "java.security.InvalidAlgorithmParameterException: Salt must
    be 8 bytes long"
    + JDK-8266713: [AIX] Build failure after 11u backport of
    JDK-8247753
    + JDK-8266802: Shenandoah: Round up region size to page size
    unconditionally
    + JDK-8266892: avoid maybe-uninitialized gcc warnings on linux
    s390x
    + JDK-8266929: Unable to use algorithms from 3p providers
    + JDK-8267235: [macos_aarch64]
    InterpreterRuntime::throw_pending_exception messing up LR
    results in crash
    + JDK-8267561: Shenandoah: Reference processing not properly
    setup for outside of cycle degenerated GC
    + JDK-8267599: Revert the change to the default PKCS12
    macAlgorithm and macIterationCount props for 11u/8u/7u
    + JDK-8267641: [11u] 8227609 backport typo
    + JDK-8267721: Enable sun/security/pkcs11 tests for Amazon
    Linux 2 AArch64
    + JDK-8268678: LetsEncryptCA.java test fails as Let's Encrypt
    Authority X3 is retired</changelog>
  <changelog author="schwab@suse.de" date="1628078400">- riscv64-zero.patch: Add support for riscv64 (zero VM)</changelog>
  <changelog author="fstrba@suse.com" date="1629979200">- Added patch:
  * jdk11-glibc234.patch
    + fix build with glibc-2.34 (bsc#1189201)</changelog>
  <changelog author="fstrba@suse.com" date="1631534400">- Modified patch:
  * nss-security-provider.patch
    + revert recent changes making NSS provider the default one
    + fixes bsc#1190252</changelog>
  <changelog author="fstrba@suse.com" date="1631793600">- Added patch:
  * fips.patch
    + implement FIPS support in OpenJDK</changelog>
  <changelog author="fstrba@suse.com" date="1634817600">- Update to upstream tag jdk-11.0.13+8 (October 2021 CPU)
  * Security fixes
    + JDK-8163326, CVE-2021-35550, bsc#1191901: Update the default
    enabled cipher suites preference
    + JDK-8254967, CVE-2021-35565, bsc#1191909:
    com.sun.net.HttpsServer spins on TLS session close
    + JDK-8263314: Enhance XML Dsig modes
    + JDK-8265167, CVE-2021-35556, bsc#1191910: Richer Text Editors
    + JDK-8265574: Improve handling of sheets
    + JDK-8265580, CVE-2021-35559, bsc#1191911: Enhanced style for
    RTF kit
    + JDK-8265776: Improve Stream handling for SSL
    + JDK-8266097, CVE-2021-35561, bsc#1191912: Better hashing
    support
    + JDK-8266103: Better specified spec values
    + JDK-8266109: More Resilient Classloading
    + JDK-8266115: More Manifest Jar Loading
    + JDK-8266137, CVE-2021-35564, bsc#1191913: Improve Keystore
    integrity
    + JDK-8266689, CVE-2021-35567, bsc#1191903: More Constrained
    Delegation
    + JDK-8267086: ArrayIndexOutOfBoundsException in
    java.security.KeyFactory.generatePublic
    + JDK-8267712: Better LDAP reference processing
    + JDK-8267729, CVE-2021-35578, bsc#1191904: Improve TLS client
    handshaking
    + JDK-8267735, CVE-2021-35586, bsc#1191914: Better BMP support
    + JDK-8268193: Improve requests of certificates
    + JDK-8268199: Correct certificate requests
    + JDK-8268205: Enhance DTLS client handshake
    + JDK-8268506: More Manifest Digests
    + JDK-8269618, CVE-2021-35603, bsc#1191906: Better session
    identification
    + JDK-8269624: Enhance method selection support
    + JDK-8270398: Enhance canonicalization
    + JDK-8270404: Better canonicalization
  * Other changes
    + JDK-8024368: private methods are allocated vtable indices
    + JDK-8042902: Test java/net/Inet6Address/serialize/
    /Inet6AddressSerializationTest.java fails intermittently
    + JDK-8140466: ChaCha20 and Poly1305 TLS Cipher Suites
    + JDK-8157404: Unable to read certain PKCS12 keystores from
    SequenceInputStream
    + JDK-8158066: SourceDebugExtensionTest fails to rename file
    + JDK-8168304: Make all of DependencyContext_test available in
    product mode
    + JDK-8169246: java/net/DatagramSocket/ReportSocketClosed.java
    fails intermittently with BindException
    + JDK-8181313: SA: Remove libthread_db dependency on Linux
    + JDK-8193214: Incorrect annotations.without.processors
    warnings with JDK 9
    + JDK-8194230: jdk/internal/jrtfs/remote/
    /RemoteRuntimeImageTest.java fails with
    java.lang.NullPointerException
    + JDK-8196092: javax/swing/JComboBox/8032878/bug8032878.java
    fails
    + JDK-8199931: java/net/MulticastSocket/
    /UnreferencedMulticastSockets.java fails with "incorrect data
    received"
    + JDK-8206083: Make tools/javac/api/T6265137.java robust to JDK
    version changes
    + JDK-8206350: java/util/Locale/bcp47u/SystemPropertyTests.java
    failed on Mac 10.13 with zh_CN and zh_TW locales.
    + JDK-8207316: java/nio/channels/spi/SelectorProvider/
    /inheritedChannel/InheritedChannelTest.java failed
    + JDK-8208227: tools/jdeps/DotFileTest.java fails on Win-X64
    + JDK-8208363: test/jdk/java/lang/Package/
    /PackageFromManifest.java missing module dependencies
    declaration
    + JDK-8209380: ARM: cleanup maybe-uninitialized and reorder
    compiler warnings
    + JDK-8209768: Refactor java/util/prefs/CheckUserPrefsStorage.sh
    to plain java test
    + JDK-8209772: Refactor shell test java/util/ServiceLoader/
    /basic/basic.sh to java
    + JDK-8209773: Refactor shell test javax/naming/module/basic.sh
    to java
    + JDK-8209832: Refactor jdk/internal/reflect/Reflection/
    /GetCallerClassTest.sh to plain java test
    + JDK-8209930: Refactor java/util/zip/ZipFile/deletetempjar.sh
    to plain java test
    + JDK-8210406: Refactor java.util.PluggableLocale:i18n shell
    tests to plain java tests
    + JDK-8210407: Refactor java.util.Calendar:i18n shell tests to
    plain java tests
    + JDK-8210495: compiler crashes because of illegal signature in
    otherwise legal code
    + JDK-8210669: Some launcher tests assume a pre-JDK 9 run-time
    image layout
    + JDK-8210802: temp files left by tests in
    jdk/java/net/httpclient
    + JDK-8210819: Update the host name in CNameTest.java
    + JDK-8210908: Refactor java/util/prefs/PrefsSpi.sh to plain
    java test
    + JDK-8210934: Move sun/net/www/protocol/http/
    /GetErrorStream.java to OpenJDK
    + JDK-8210959: JShell fails and exits when statement throws an
    exception whose message contains a '%'.
    + JDK-8211055: Provide print to a file (PDF) feature even when
    printer was not connected
    + JDK-8211092: test/jdk/sun/net/www/http/HttpClient/
    /MultiThreadTest.java fails intermittently when cleaning up
    + JDK-8211296: Remove HotSpot deprecation warning suppression
    for Mac/clang
    + JDK-8211325: test/jdk/java/net/Socket/LingerTest.java fails
    with cleaning up
    + JDK-8212040: Compilation error due to wrong usage of
    NSPrintJobDispositionValue in mac10.12
    + JDK-8212695: Add explicit timeout to several HTTP Client tests
    + JDK-8212718: Refactor some annotation processor tests to
    better use collections
    + JDK-8213007: Update the link in test/jdk/sun/security/
    /provider/SecureRandom/DrbgCavp.java
    + JDK-8213137: Remove static initialization of monitor/mutex
    instances
    + JDK-8213235: java/nio/channels/SocketChannel/
    /AsyncCloseChannel.java fails with threads that didn't exit
    + JDK-8213409: Refactor sun.text.IntHashtable:i18n shell tests
    to plain java tests
    + JDK-8213576: Make test AsyncCloseChannel.java run in othervm
    + JDK-8213694: Test Timeout.java should run in othervm mode
    + JDK-8213718: [TEST] Wrong classname in vmTestbase/nsk/stress/
    /except/except002 and except003
    + JDK-8213922: fix ctw stand-alone build
    + JDK-8214195: Align stdout messages in
    test/jdk/java/math/BigInteger/PrimitiveConversionTests.java
    + JDK-8214520: [TEST_BUG] sun/security/mscapi/nonUniqueAliases/
    /NonUniqueAliases.java failed with incorrect jtreg tags order
    + JDK-8214937: sun/security/tools/jarsigner/warnings/
    /NoTimestampTest.java failed due to unexpected expiration date
    + JDK-8216532: tools/launcher/Test7029048.java fails (Solaris)
    + JDK-8217825: Verify @AfterTest is used correctly in WebSocket
    tests
    + JDK-8218145: block_if_requested is not proper inlined due to
    size
    + JDK-8219417: bump jtreg requiredVersion to b14
    + JDK-8219552: bump jtreg requiredVersion to b14 in
    test/jdk/sanity/client/
    + JDK-8219804: java/net/MulticastSocket/Promiscuous.java fails
    intermittently due to NumberFormatException
    + JDK-8220445: Support for side by side MSVC Toolset versions
    + JDK-8221988: add possibility to build with Visual Studio 2019
    + JDK-8222751: closed/test/jdk/sun/security/util/
    /DerIndefLenConverter/IndefBerPkcs12.java fail
    + JDK-8223050: JVMCI: findUniqueConcreteMethod() should not use
    Dependencies::find_unique_concrete_method() for non-virtual
    methods
    + JDK-8224853: CDS address sanitizer errors
    + JDK-8225082: Remove IdenTrust certificate that is expiring in
    September 2021
    + JDK-8225583: Examine the HttpResponse.BodySubscribers for
    null handling and multiple subscriptions
    + JDK-8225690: Multiple AttachListener threads can be created
    + JDK-8225790: Two NestedDialogs tests fail on Ubuntu
    + JDK-8226319: Add forgotten test/jdk/java/net/httpclient/
    /BodySubscribersTest.java
    + JDK-8226533: JVMCI: findUniqueConcreteMethod should handle
    statically bindable methods directly
    + JDK-8226602: Test convenience reactive primitives from
    java.net.http with RS TCK
    + JDK-8226683: Remove review suggestion from fix to 8219804
    + JDK-8227738: jvmti/DataDumpRequest/datadumpreq001 failed due
    to "exit code is 134"
    + JDK-8227766: CheckUnhandledOops is broken in MemAllocator
    + JDK-8227815: Minimal VM: set_state is not a member of
    AttachListener
    + JDK-8230674: Heap dumps should exclude dormant CDS archived
    objects of unloaded classes
    + JDK-8230808: Remove Access::equals()
    + JDK-8230841: Remove oopDesc::equals()
    + JDK-8231717: Improve performance of charset decoding when
    charset is always compactable
    + JDK-8232243: Wrong caret position in JTextPane on Windows
    with a screen resolution &gt; 100%
    + JDK-8232782: Shenandoah: streamline post-LRB CAS barrier
    (aarch64)
    + JDK-8233790: Forward output from heap dumper to jcmd/jmap
    + JDK-8233989: Create an IPv4 version of
    java/net/MulticastSocket/SetLoopbackMode.java
    + JDK-8234510: Remove file seeking requirement for writing a
    heap dump
    + JDK-8235211: serviceability/attach/
    /RemovingUnixDomainSocketTest.java fails with
    AttachNotSupportedException: Unable to open socket file
    + JDK-8235216: typo in test filename
    + JDK-8235866: bump jtreg requiredVersion to 4.2b16
    + JDK-8236111: narrow allowSmartActionArgs disabling
    + JDK-8236413: AbstractConnectTimeout should tolerate both
    NoRouteToHostException and UnresolvedAddressException
    + JDK-8236671: NullPointerException in JKS keystore
    + JDK-8238930: problem list compiler/c2/Test8004741.java
    + JDK-8238943: switch to jtreg 5.0
    + JDK-8240555: Using env of JAVA_TOOL_OPTIONS and _JAVA_OPTIONS
    breaks QuietOption.java test
    + JDK-8240983: Incorrect copyright header in Apache Santuario
    2.1.3 files
    + JDK-8241336: Some java.net tests failed with
    NoRouteToHostException on MacOS with special network
    configuration
    + JDK-8241353: NPE in ToolProvider.getSystemJavaCompiler
    + JDK-8241768: git needs .gitattributes
    + JDK-8242882: opening jar file with large manifest might throw
    NegativeArraySizeException
    + JDK-8244973: serviceability/attach/
    /RemovingUnixDomainSocketTest.java fails "stderr was not
    empty"
    + JDK-8245134: test/lib/jdk/test/lib/security/
    /KeyStoreUtils.java should allow to specify aliases
    + JDK-8246261: TCKLocalTime.java failed due to "AssertionError:
    expected [18:14:22] but found [18:14:23]"
    + JDK-8246387: switch to jtreg 5.1
    + JDK-8247421: [TESTBUG] ReturnBlobToWrongHeapTest.java failed
    allocating blob
    + JDK-8247469: getSystemCpuLoad() returns -1 on linux when some
    offline cpus are present and cpusets.effective_cpus is not
    available
    + JDK-8248352: [TEST_BUG] Test test/jdk/java/awt/font/
    /TextLayout/ArabicDiacriticTest.java can leave frame open
    + JDK-8248403: AArch64: Remove uses of kernel integer types
    + JDK-8248414: AArch64: Remove uses of long and unsigned long
    ints
    + JDK-8248657: Windows: strengthening in ThreadCritical
    regarding memory model
    + JDK-8248666: AArch64: Use THREAD_LOCAL instead of __thread
    + JDK-8248668: AArch64: Avoid MIN/MAX macros when using MSVC
    + JDK-8248671: AArch64: Remove unused variables
    + JDK-8248682: AArch64: Use ATTRIBUTE_ALIGNED helper
    + JDK-8248816: C1: Fix signature conflict in
    LIRGenerator::strength_reduce_multiply
    + JDK-8249095: tools/javac/launcher/SourceLauncherTest.java
    fails on Windows
    + JDK-8249548: backward focus traversal gets stuck in button
    group
    + JDK-8249773: Upgrade ReceiveISA.java test to be resilient to
    failure due to stray packets and interference
    + JDK-8249897: jdk/javadoc/tool/LangVers.java uses @ignore w/o
    bug-id
    + JDK-8249898: jdk/javadoc/tool/6176978/T6176978.java uses
    @ignore w/o bug-id
    + JDK-8249899: jdk/javadoc/tool/InlineTagsWithBraces.java uses
    @ignore w/o bug-id
    + JDK-8250588: Shenandoah: LRB needs to save/restore fp
    registers for runtime call
    + JDK-8250824: AArch64: follow up for JDK-8248414
    + JDK-8251166: Add automated testcases for changes done in
    JDK-8214112
    + JDK-8251252: Add automated testcase for fix done in
    JDK-8214253
    + JDK-8251254: Add automated test for fix done in JDK-8218472
    + JDK-8251361: Potential race between Logger configuration and
    GCs in HttpURLConWithProxy test
    + JDK-8251549: Update docs on building for Git
    + JDK-8251945: SIGSEGV in
    PackageEntry::purge_qualified_exports()
    + JDK-8252194: Add automated test for fix done in JDK-8218469
    + JDK-8252648: Shenandoah: name gang tasks consistently
    + JDK-8252825: Add automated test for fix done in JDK-8218479
    + JDK-8252853: AArch64: gc/shenandoah/TestVerifyJCStress.java
    fails intermittently with C1
    + JDK-8252857: AArch64: Shenandoah C1 CAS is not sequentially
    consistent
    + JDK-8253048: AArch64: When CallLeaf, no need to preserve
    callee-saved registers in caller
    + JDK-8253424: Add support for running pre-submit testing using
    GitHub Actions
    + JDK-8253631: Remove unimplemented CompileBroker methods after
    JEP-165
    + JDK-8253865: Pre-submit testing using GitHub Actions does not
    detect failures reliably
    + JDK-8253899: Make IsClassUnloadingEnabled signature match
    specification
    + JDK-8254024: Enhance native libs for AWT and Swing to work
    with GraalVM Native Image
    + JDK-8254054: Pre-submit testing using GitHub Actions should
    not use the deprecated set-env command
    + JDK-8254173: Add Zero, Minimal hotspot targets to submit
    workflow
    + JDK-8254175: Build no-pch configuration in debug mode for
    submit checks
    + JDK-8254244: Some code emitted by TemplateTable::branch is
    unused when running TieredCompilation
    + JDK-8254270: linux 32 bit build doesn't compile
    libjdwp/log_messages.c
    + JDK-8254282: Add Linux x86_32 builds to submit workflow
    + JDK-8254850: Update terminology in java.awt.GridBagLayout
    source code comments
    + JDK-8255255: Update Apache Santuario (XML Signature) to
    version 2.2.1
    + JDK-8255305: Add Linux x86_32 tier1 to submit workflow
    + JDK-8255352: Archive important test outputs in submit workflow
    + JDK-8255373: Submit workflow artifact name is always
    "test-results_.zip"
    + JDK-8255452: Doing GC during JVMTI MethodExit event posting
    breaks return oop
    + JDK-8255718: Zero: VM should know it runs in interpreter-only
    mode
    + JDK-8255790: GTKL&amp;F: Java 16 crashes on initialising GTKL&amp;F
    on Manjaro Linux
    + JDK-8255810: Zero: build fails without JVMTI
    + JDK-8255895: Submit workflow artifacts miss hs_errs/replays
    due to ZIP include mismatch
    + JDK-8256127: Add cross-compiled foreign architectures builds
    to submit workflow
    + JDK-8256215: Shenandoah: re-organize saving/restoring machine
    state in assembler code
    + JDK-8256267: Relax compiler/floatingpoint/NaNTest.java for
    x86_32 and lower -XX:+UseSSE
    + JDK-8256277: Github Action build on macOS should define OS
    and Xcode versions
    + JDK-8256354: Github Action build on Windows should define OS
    and MSVC versions
    + JDK-8256393: Github Actions build on Linux should define OS
    and GCC versions
    + JDK-8256414: add optimized build to submit workflow
    + JDK-8256747: GitHub Actions: decouple the hotspot build-only
    jobs from Linux x64 testing
    + JDK-8257056: Submit workflow should apt-get update to avoid
    package installation errors
    + JDK-8257148: Remove obsolete code in AWTView.m
    + JDK-8257497: Update keytool to create AKID from the SKID of
    the issuing certificate as specified by RFC 5280
    + JDK-8257620: Do not use objc_msgSend_stret to get macOS
    version
    + JDK-8257913: Add more known library locations to simplify
    Linux cross-compilation
    + JDK-8258703: Incorrect 512-bit vector registers restore on
    x86_32
    + JDK-8259338: Add expiry exception for identrustdstx3 alias to
    VerifyCACerts.java test
    + JDK-8259535: ECDSA SignatureValue do not always have the
    specified length
    + JDK-8259679: GitHub actions should use MSVC 14.28
    + JDK-8259924: GitHub actions fail on Linux x86_32 with "Could
    not configure libc6:i386"
    + JDK-8260460: GitHub actions still fail on Linux x86_32 with
    "Could not configure libc6:i386"
    + JDK-8260589: Crash in JfrTraceIdLoadBarrier::load(_jclass*)
    + JDK-8260923: Add more tests for SSLSocket input/output
    shutdown
    + JDK-8261072: AArch64: Fix MacroAssembler::get_thread
    convention
    + JDK-8261147: C2: Node is wrongly marked as reduction
    resulting in a wrong execution due to wrong vector instructions
    + JDK-8261238: NMT should not limit baselining by size threshold
    + JDK-8261496: Shenandoah: reconsider pacing updates memory
    ordering
    + JDK-8261652: Remove some dead comments from os_bsd_x86
    + JDK-8261846: [JVMCI] c2v_iterateFrames can get out of sync
    with the StackFrameStream
    + JDK-8262000: jdk/jfr/event/gc/detailed/
    /TestPromotionFailedEventWithParallelScavenge.java failed with
    "OutOfMemoryError: Java heap space"
    + JDK-8262017: C2: assert(n != __null) failed: Bad immediate
    dominator info.
    + JDK-8262392: Update Mesa 3-D Headers to version 21.0.3
    + JDK-8262409: sun/security/ssl/SSLSocketImpl/
    /SSLSocketImplThrowsWrongExceptions. SSL test failures caused
    by java failed with "Server reported the wrong exception"
    + JDK-8262470: Printed GlyphVector outline with low DPI has bad
    quality on Windows
    + JDK-8262862: Harden tests sun/security/x509/URICertStore/
    /ExtensionsWithLDAP.java and krb5/canonicalize/Test.java
    + JDK-8263136: C4530 was reported from VS 2019 at access bridge
    + JDK-8263227: C2: inconsistent spilling due to dead nodes in
    exception block
    + JDK-8263382: java/util/logging/ParentLoggersTest.java failed
    with "checkLoggers: getLoggerNames() returned unexpected
    loggers"
    + JDK-8263407: SPARC64 detection fails on Athena (SPARC64-X)
    + JDK-8263432: javac may report an invalid package/class clash
    on case insensitive filesystems
    + JDK-8263490: [macos] Crash occurs on JPasswordField with
    activated InputMethod
    + JDK-8263531: Remove unused buffer int
    + JDK-8263667: Avoid running GitHub actions on branches named
    pr/*
    + JDK-8263776: [JVMCI] add helper to perform Java upcalls
    + JDK-8264016: [JVMCI] add some thread local fields for use by
    JVMCI
    + JDK-8264752: SIGFPE crash with option
    FlightRecorderOptions:threadbuffersize=30M
    + JDK-8265132: C2 compilation fails with assert "missing
    precedence edge"
    + JDK-8265231: (fc) ReadDirect and WriteDirect tests fail after
    fix for JDK-8264821
    + JDK-8265335: Epsilon: Minor typo in EpsilonElasticTLABDecay
    description
    + JDK-8265756: AArch64: initialize memory allocated for locals
    according to Windows AArch64 stack page growth requirement in
    template interpreter
    + JDK-8265761: Font with missed font family name is not
    properly printed on Windows
    + JDK-8265773: incorrect jdeps message "jdk8internals" to
    describe a removed JDK internal API
    + JDK-8265836: OperatingSystemImpl.getCpuLoad() returns
    incorrect CPU load inside a container
    + JDK-8266018: Shenandoah: fix an incorrect assert
    + JDK-8266206: Build failure after JDK-8264752 with older GCCs
    + JDK-8266248: Compilation failure in
    PLATFORM_API_MacOSX_MidiUtils.c with Xcode 12.5
    + JDK-8266288: assert root method not found in
    witnessed_reabstraction_in_supers is too strong
    + JDK-8266404: Fatal error report generated with
  - XX:+CrashOnOutOfMemoryError should not contain suggestion to
    submit a bug report
    + JDK-8266480: Implicit null check optimization does not update
    control of hoisted memory operation
    + JDK-8266615: C2 incorrectly folds subtype checks involving an
    interface array
    + JDK-8266642: Improve ResolvedMethodTable hash function
    + JDK-8266749: AArch64: Backtracing broken on PAC enabled
    systems
    + JDK-8266761: AssertionError in
    sun.net.httpserver.ServerImpl.responseCompleted
    + JDK-8266813: Shenandoah: Use shorter instruction sequence for
    checking if marking in progress
    + JDK-8267042: bug in monitor locking/unlocking on ARM32 C1 due
    to uninitialized BasicObjectLock::_displaced_header
    + JDK-8267348: Rewrite gc/epsilon/TestClasses.java to use
    Metaspace with less classes
    + JDK-8267396: Avoid recording "pc" in unhandled oops detector
    for better performance
    + JDK-8267399: C2: java/text/Normalizer/ConformanceTest.java
    test failed with assertion
    + JDK-8267424: CTW: C1 fails with "State must not be null"
    + JDK-8267459: Pasting Unicode characters into JShell does not
    work.
    + JDK-8267625: AARCH64: typo in LIR_Assembler::emit_profile_type
    + JDK-8267666: Add option to jcmd GC.heap_dump to use existing
    file
    + JDK-8267695: Bump update version for OpenJDK: jdk-11.0.13
    + JDK-8267751: (test) jtreg.SkippedException has no serial
    VersionUID
    + JDK-8267773: PhaseStringOpts::int_stringSize doesn't handle
    min_jint correctly
    + JDK-8268103: JNI functions incorrectly return a double after
    JDK-8265836
    + JDK-8268127: Shenandoah: Heap size may be too small for
    region to align to large page size
    + JDK-8268261: C2: assert(n != __null) failed: Bad immediate
    dominator info.
    + JDK-8268347: C2: nested locks optimization may create
    unbalanced monitor enter/exit code
    + JDK-8268360: Missing check for infinite loop during node
    placement
    + JDK-8268362: [REDO] C2 crash when compile negative
    Arrays.copyOf length after loop
    + JDK-8268366: Incorrect calculation of has_fpu_registers in C1
    linear scan
    + JDK-8268369: SIGSEGV in PhaseCFG::implicit_null_check due to
    missing null check
    + JDK-8268417: Add test from JDK-8268360
    + JDK-8268427: Improve AlgorithmConstraints:checkAlgorithm
    performance
    + JDK-8268617: [11u REDO] - WebSocket over authenticating proxy
    fails with NPE
    + JDK-8268620: InfiniteLoopException test may fail on x86
    platforms
    + JDK-8268635: Corrupt oop in ClassLoaderData
    + JDK-8268699: Shenandoah: Add test for JDK-8268127
    + JDK-8268771: javadoc -notimestamp option does not work on
    index.html
    + JDK-8268775: Password is being converted to String in
    AccessibleJPasswordField
    + JDK-8268776: Test `ADatagramSocket.java` missing /othervm
    from @run tag
    + JDK-8268965: TCP Connection Reset when connecting simple
    socket to SSL server
    + JDK-8269304: Regression ~5% in 2005 in b27
    + JDK-8269415: [11u] Remove ea from
    DEFAULT_PROMOTED_VERSION_PRE in OpenJDK 11u
    + JDK-8269478: Shenandoah: gc/shenandoah/mxbeans tests should
    be more resilient
    + JDK-8269529: javax/swing/reliability/
    /HangDuringStaticInitialization.java fails in Windows debug
    build
    + JDK-8269594: assert(_handle_mark_nesting &gt; 1) failed: memory
    leak: allocating handle outside HandleMark
    + JDK-8269614: [s390] Interpreter checks wrong bit for slow
    path instance allocation
    + JDK-8269650: Optimize gc-locker in
    [Get|Release]StringCritical for latin string
    + JDK-8269661: JNI_GetStringCritical does not lock char array
    + JDK-8269668: [aarch64] java.library.path not including
    /usr/lib64
    + JDK-8269763: The JEditorPane is blank after JDK-8265167
    + JDK-8269795: C2: Out of bounds array load floats above its
    range check in loop peeling resulting in SEGV
    + JDK-8269847: JDK-8269594 backport breaks 11u builds
    + JDK-8269850: Most JDK releases report macOS version 12 as
    10.16 instead of 12.0
    + JDK-8269851: OperatingSystemMXBean getProcessCpuLoad reports
    incorrect process cpu usage in containers
    + JDK-8269882: stack-use-after-scope in NewObjectA
    + JDK-8269934: RunThese24H.java failed with
    EXCEPTION_ACCESS_VIOLATION in
    java_lang_Thread::get_thread_status
    + JDK-8270096: Shenandoah: Optimize gc/shenandoah/
    /TestRefprocSanity.java for interpreter mode
    + JDK-8270137: Kerberos Credential Retrieval from Cache not
    Working in Cross-Realm Setup
    + JDK-8270184: [TESTBUG] Add coverage for jvmci
    ResolvedJavaType.toJavaName() for lambdas
    + JDK-8270196: [11u] [JVMCI] JavaType.toJavaName() returns
    incorrect type name for lambdas
    + JDK-8270556: Exclude security/infra/java/security/cert/
    /CertPathValidator/certification/LetsEncryptCA
    + JDK-8270893: IndexOutOfBoundsException while reading large
    TIFF file
    + JDK-8272078: Wrong Checksums in Temurin BootJDK dependencies
    + JDK-8272124: Cgroup v1 initialization causes
    NullPointerException when cgroup path contains colon
    + JDK-8272131: PhaseMacroExpand::generate_slow_arraycopy crash
    when clone null CallProjections.fallthrough_ioproj
    + JDK-8272197: Update 11u GHA workflow with Shenandoah
    configurations
    + JDK-8272332: --with-harfbuzz=system doesn't add -lharfbuzz
    after JDK-8255790
    + JDK-8272472: StackGuardPages test doesn't build with glibc
    2.34
    + JDK-8272602: [macos] not all KEY_PRESSED events sent when
    control modifier is used
    + JDK-8272628: Problemlist gc/stress/gcbasher/
    /TestGCBasherWithCMS.java for x86_32
    + JDK-8272700: [macos] Build failure with Xcode 13.0 after
    JDK-8264848
    + JDK-8272772: Shenandoah: compiler/c2/aarch64/
    /TestVolatilesShenandoah.java fails in 11u
    + JDK-8273939: Backport of 8248414 to JDK11 breaks
    MacroAssembler::adrp
- Remove the unneeded icedtea-sound provider
- Removed patches:
  * icedtea-sound-1.0.1-jdk9.patch
  * icedtea-sound-soundproperties.patch
    + not needed since the icedtea-sound provider is removed
  * jdk11-glibc234.patch
    + integrated upstream</changelog>
  <changelog author="fstrba@suse.com" date="1635940800">- Modified patches:
  * system-crypto-policy.patch
    + rediff to changed context
  * fips.patch
    + Allow plain key import in fips mode unless
    com.suse.fips.plainKeySupport is set to false</changelog>
  <changelog author="fstrba@suse.com" date="1636113600">- Modified patch:
  * fips.patch
    + return in native code after generating java.io.IOException</changelog>
</package>
<package pkgid="770335fbfc54aefd91dc21e22f532650b578447ade268410676f5434f9be5073" name="java-11-openjdk-headless" arch="x86_64">
  <version epoch="0" ver="11.0.13.0" rel="3.68.1"/>
  <changelog author="fstrba@suse.com" date="1586952000">- The pack200 and unpack200 alternatives should be slaves of java
  and not of javac, since they are part of JRE.</changelog>
  <changelog author="fstrba@suse.com" date="1587470400">- Update to upstream tag jdk-11.0.7+10 (April 2020 CPU,
  bsc#1169511)
  * Security fixes:
    + S8223898, CVE-2020-2754: Forward references to Nashorn
    + S8223904, CVE-2020-2755: Improve Nashorn matching
    + S8224541, CVE-2020-2756: Better mapping of serial ENUMs
    + S8224549, CVE-2020-2757: Less Blocking Array Queues
    + S8225603: Enhancement for big integers
    + S8226346: Build better binary builders
    + S8227467: Better class method invocations
    + S8227542: Manifest improved jar headers
    + S8229733: TLS message handling improvements
    + S8231415, CVE-2020-2773: Better signatures in XML
    + S8231785: Improved socket permissions
    + S8232424, CVE-2020-2778: More constrained algorithms
    + S8232581, CVE-2020-2767: Improve TLS verification
    + S8233250: Better X11 rendering
    + S8233410: Better Build Scripting
    + S8234027: Better JCEKS key support
    + S8234408, CVE-2020-2781: Improve TLS session handling
    + S8234825, CVE-2020-2800: Better Headings for HTTP Servers
    + S8234841, CVE-2020-2803: Enhance buffering of byte buffers
    + S8235274, CVE-2020-2805: Enhance typing of methods
    + S8235691, CVE-2020-2816: Enhance TLS connectivity
    + S8236201, CVE-2020-2830: Better Scanner conversions
    + S8238960: linux-i586 builds are inconsistent as the newly
    built jdk is not able to reserve enough space for object heap
  * Other changes:
    + S4919790: Errors in alert ssl message does not reflect the
    actual certificate status
    + S4949105: Access Bridge lacks html tags parsing
    + S7092821: java.security.Provider.getService() is synchronized
    and became scalability bottleneck
    + S7143743: Potential memory leak with zip provider
    + S8005819: Support cross-realm MSSFU
    + S8042383: [TEST_BUG] Test javax/swing/plaf/basic/BasicMenuUI/
    /4983388/bug4983388.java fails with shortcuts on menus do not
    work
    + S8068184: Fix for JDK-8032832 caused a deadlock
    + S8145845: [AOT] NullPointerException in
    compiler/whitebox/GetCodeHeapEntriesTest.java
    + S8152988: [AOT] Update test batch definitions to include
    aot-ed java.base module mode into hs-comp testing
    + S8160926: FLAGS_COMPILER_CHECK_ARGUMENTS doesn't handle
    cross-compilation
    + S8163083: SocketListeningConnector does not allow invocations
    with port 0
    + S8163251: Hard coded loop limit prevents reading of smart
    card data greater than 8k
    + S8167276: jvmci/compilerToVM/MaterializeVirtualObjectTest.java
    fails with -XX:-EliminateAllocations
    + S8169718: nsk/jdb/locals/locals002: ERROR: Cannot find
    boolVar with expected value: false
    + S8176556:
    java/awt/dnd/ImageTransferTest/ImageTransferTest.java fails
    for JFIF
    + S8178798: Two compiler/aot/verification/vmflags tests fail by
    timeout with UseAVX=3
    + S8183107: PKCS11 regression regarding checkKeySize
    + S8185005: Improve performance of
    ThreadMXBean.getThreadInfo(long ids[], int maxDepth)
    + S8189633: Missing -Xcheck:jni checking for DeleteWeakGlobalRef
    + S8189861: Refactor CacheFind
    + S8193042: NativeLookup::lookup_critical_entry() should only
    load shared library once
    + S8193596: java/net/DatagramPacket/ReuseBuf.java failed due to
    timeout
    + S8194944: Regression automated test 'open/test/jdk/javax/
    /swing/JInternalFrame/8145896/TestJInternalFrameMaximize.java'
    fails
    + S8196467: javax/swing/JInternalFrame/Test6325652.java fails
    + S8196969: JTreg Failure: serviceability/sa/ClhsdbJstack.java
    causes NPE
    + S8198321: javax/swing/JEditorPane/5076514/bug5076514.java
    fails
    + S8198398: Test javax/swing/JColorChooser/Test6199676.java
    fails in mach5
    + S8199072: Test javax/swing/GroupLayout/6613904/
    /bug6613904.java is unstable
    + S8200432: javadoc fails with ClassCastException on {@link
    byte[]}
    + S8201349: build broken when configured with
  - -with-zlib=bundled on gcc 7.3
    + S8201355: Avoid native memory allocation in
    sun.security.mscapi.PRNG.generateSeed
    + S8201513: nsk/jvmti/IterateThroughHeap/filter-* are broken
    + S8203364: Some serviceability/sa/ tests intermittently fail
    with java.io.IOException: LingeredApp terminated with non-zero
    exit code 3
    + S8203687: javax/net/ssl/compatibility/Compatibility.java
    supports TLS 1.3
    + S8203904: javax/swing/JSplitPane/4816114/bug4816114.java: The
    divider location is wrong
    + S8203911: Test runtime/modules/getModuleJNI/GetModule fails
    with -Xcheck:jni
    + S8204525: [TESTBUG] runtime/NMT/MallocStressTest.java ran out
    of java heap
    + S8204529: gc/TestAllocateHeapAtMultiple.java fail with Agent
    7 timed out
    + S8204551: Event descriptions are truncated in logs
    + S8206963: [AOT] bug with multiple class loaders
    + S8207367: 10 vmTestbase/nsk/jdi tests timed out when running
    with jtreg
    + S8207832: serviceability/sa/ClhsdbCDSCore.java failed with
    "Couldn't find core file location"
    + S8207938: At step6,Click Add button,case failed automatically.
    + S8208157: requires.VMProps throws NPE for missing properties
    in "release" file
    + S8208379: compiler/jvmci/events/
    /JvmciNotifyInstallEventTest.java failed with "Got unexpected
    event count after 2nd install attempt: expected 9 to equal 2"
    + S8208658: Make CDS archived heap regions usable even if
    compressed oop encoding has changed
    + S8208715: Conversion of milliseconds to nanoseconds in
    UNIXProcess contains bug
    + S8209361: [AOT] Unexpected number of references for
    JVMTI_HEAP_REFERENCE_CONSTANT_POOL [111--&gt;111]: 0 (expected
    at least 1)
    + S8209385: CDS runtime classpath checking is too strict when
    only classes from the system modules are archived
    + S8209389: SIGSEGV in WalkOopAndArchiveClosure::do_oop_work.
    + S8209418: Synchronize test/jdk/sanity/client/lib/jemmy with
    code-tools/jemmy/v2
    + S8209494: Create a test for SwingSet InternalFrameDemo
    + S8209499: Create test for SwingSet EditorPaneDemo
    + S8209574: [AOT] breakpoint events are generated in different
    threads does not meet expected count
    + S8209686: cleanup arguments to PhaseIdealLoop() constructor
    + S8209789: Synchronize test/jdk/sanity/client/lib/jemmy with
    code-tools/jemmy/v2
    + S8209802: Garbage collectors should register JFR types
    themselves to avoid build errors.
    + S8209807: improve handling exception in requires.VMProps
    + S8209817: stack is executable when building with Clang on
    Linux
    + S8209824: Improve the code coverage for ThreadLocal
    + S8209826: Undefined reference to os::write after JDK-8209657
    (filemap.hpp cleanup)
    + S8209850: Allow NamedThreads to use GlobalCounter critical
    sections
    + S8209976: Improve iteration over non-JavaThreads
    + S8209993: Create a test for SwingSet3 ToolTipDemo
    + S8210024: JFR calls virtual is_Java_thread from ~Thread()
    + S8210052: Enable testing for all the available look and feels
    in SwingSet3 demo tests
    + S8210055: Enable different look and feel tests in SwingSet3
    demo tests
    + S8210057: Enable different look and feels in SwingSet3 demo
    test InternalFrameDemoTest
    + S8210058: Algorithmic Italic font leans opposite angle in
    Printing
    + S8210220: [AOT] jdwp test cases are failing with error #
    ERROR: TEST FAILED: Cought IOException while receiving event
    packet
    + S8210289: ArchivedKlassSubGraphInfoRecord is incomplete
    + S8210459: Add support for generating compile_commands.json
    + S8210476: sun/security/mscapi/PrngSlow.java fails with Still
    too slow
    + S8210512: [Testbug] vmTestbase/nsk/jdi/ObjectReference/
    /referringObjects/referringObjects002/referringObjects002.java
    fails with unexpected size of
    ClassLoaderReference.referringObjects
    + S8210523: runtime/appcds/cacheObject/DifferentHeapSizes.java
    crash
    + S8210632: Add key exchange algorithm to
    javax/net/ssl/TLSCommon/CipherSuite.java
    + S8210699: Problem list tests which times out in Xcomp mode
    + S8210793: [JVMCI] AllocateCompileIdTest.java failed to find
    DiagnosticCommand.class
    + S8210910: Create test for FileChooserDemo
    + S8210994: Create test for SwingSet3 FrameDemo
    + S8211139: Increase timeout value in all tests under
    jdk/sanity/client/SwingSet/src
    + S8211160: Handle different look and feels in
    JInternalFrameOperator
    + S8211211: vmTestbase/metaspace/stressDictionary/
    /StressDictionary.java timeout
    + S8211322: Reduce the timeout of tooltip in SwingSet2DemoTest
    + S8211443: Enable different look and feels in SwingSet3 demo
    test SplitPaneDemoTest
    + S8211703: JInternalFrame : java.lang.AssertionError: cannot
    find the internal frame
    + S8211781: re-building fails after changing Graal sources
    + S8212897: Some improvements in the EditorPaneDemotest
    + S8212903: [TestBug] Tests test/jdk/javax/swing/LookAndFeel/
    /8145547/DemandGTK2.sh and DemandGTK3.sh fail on Ubuntu 18.04
    LTS
    + S8213009: Refactoring existing SunMSCAPI classes
    + S8213010: Supporting keys created with certmgr.exe
    + S8213168: Enable different look and feel tests in SwingSet3
    demo test FileChooserDemoTest
    + S8213348: jdk.internal.vm.compiler.management service
    providers missing in module descriptor
    + S8213906: Update arm devkits with libXrandr headers
    + S8213908: AssertionError in DeferredAttr at setOverloadKind
    + S8214124: [TESTBUG] Bugs in runtime/NMT/MallocStressTest.java
    + S8214344: C2: assert(con.basic_type() != T_ILLEGAL) failed:
    elembt=byte; loadbt=void; unsigned=0
    + S8214345: infinite recursion while checking super class
    + S8214471: Enable different look and feel tests in SwingSet3
    demo test ToolTipDemoTest
    + S8214534: Setting of THIS_FILE in the build is broken
    + S8214557: Filter out VM flags which don't affect AOT code
    generation
    + S8214578: [macos] Problem with backslashes on macOS/JIS
    keyboard: Java ignores system settings
    + S8214840: runtime/NMT/MallocStressTest.java timed out
    + S8214850: Rename vm_operations.?pp files to vmOperations.?pp
    files
    + S8214904: Test8004741.java failed due to "Too few ThreadDeath
    hits; expected at least 6 but saw only 5"
    + S8215322: add @file support to jaotc
    + S8215355: Object monitor deadlock with no threads holding the
    monitor (using jemalloc 5.1)
    + S8215396: JTabbedPane preferred size calculation is wrong for
    SCROLL_TAB_LAYOUT
    + S8216180: [AOT] compiler/intrinsics/bigInteger/TestMulAdd.java
    crashed with AOT enabled
    + S8216353: Use utility APIs introduced in org/netbeans/jemmy/
    /util/LookAndFeel class in client sanity test cases
    + S8216354: Syntax error in toolchain_windows.m4
    + S8216472: (se) Stack overflow during selection operation
    leads to crash (win)
    + S8216535: tools/jimage/JImageExtractTest.java timed out
    + S8217235: Create automated test for SwingSet
    ColorChooserDemoTest
    + S8217297: Add support for multiple look and feel for SwingSet
    SliderDemoTest
    + S8217338: [Containers] Improve systemd slice memory limit
    support
    + S8217613: [AOT] TEST_OPTS_AOT_MODULES doesn't work on mac
    + S8217634: RunTest documentation and usability update
    + S8217717: ZGC: Broken oop map in C1 load barrier stub
    + S8217728: Speed up incremental rerun of "make hotspot"
    + S8218268: Javac treats Manifest Class-Path entries as Paths
    instead of URLs
    + S8218662: Allow 204 responses with Content-Length:0
    + S8218882: NET_Writev is declared, NET_WriteV is defined
    + S8218889: Improperly use of the Optional API
    + S8219205: JFR file without license header
    + S8219597: (bf) Heap buffer state changes could provoke
    unexpected exceptions
    + S8219723: javax/net/ssl/compatibility/Compatibility.java
    failed on some SNI cases
    + S8220348: [ntintel] asserts about copying unaligned array
    + S8220451: jdi/EventQueue/remove/remove004 failed due to
    "ERROR: thread2 is not alive"
    + S8220456: jdi/EventQueue/remove_l/remove_l004 failed due to
    "TIMEOUT while waiting for event"
    + S8220479: java/nio/channels/Selector/SelectWithConsumer.java
    failed at testTwoChannels()
    + S8220613: java/util/Arrays/TimSortStackSize2.java times out
    with fastdebug build
    + S8220688: [TESTBUG] runtime/NMT/MallocStressTest.java timed
    out
    + S8220786: Create new switch to redirect error reporting
    output to stdout or stderr
    + S8221270: Duplicated synchronized keywords in SSLSocketImpl
    + S8221312: test/jdk/sanity/client/SwingSet/src/
    /ColorChooserDemoTest.java failed
    + S8221851: Use of THIS_FILE in hotspot invalidates precompiled
    header on Linux/GCC
    + S8221885: Add intermittent test in the JavaSound to the
    ProblemList
    + S8222264: Windows incremental build is broken with JDK-8217728
    + S8222391: javax/net/ssl/compatibility/Compatibility.java
    should be more flexible
    + S8222448: java/lang/reflect/PublicMethods/
    /PublicMethodsTest.java times out
    + S8222519: ButtonDemoScreenshotTest fails randomly with "still
    state to be reached"
    + S8222741: jdi/EventQueue/remove/remove004 fails due to
    VMDisconnectedException
    + S8223003: SunMSCAPI keys are not cleaned up
    + S8223063: Support CNG RSA keys
    + S8223158: Docked MacBook cannot start any Java Swing
    applications
    + S8223260: NamingManager should cache InitialContextFactory
    + S8223464: Improve version string for Oracle CI builds
    + S8223558: Java does not render Myanmar script correctly
    + S8223627: jdk-13+20 bundle name contains null instead of ea
    + S8223638: Replace wildcard address with loopback or local
    host in tests - part 6
    + S8223678: Add Visual Studio Code workspace generation support
    (for native code)
    + S8223727: com/sun/jndi/ldap/privconn/RunTest.java failed due
    to hang in LdapRequest.getReplyBer
    + S8223769: Assert triggers with -XX:+StressReflectiveCode
    + S8224187: Refactor arraycopy_prologue to allow ZGC read
    barriers on arraycopy
    + S8224475: JTextPane does not show images in HTML rendering
    + S8224673: Adjust permission for delayed starting of debugging
    + S8224705: Tests that need to be problem-listed or have
    printer resources
    + S8224778: test/jdk/demo/jfc/J2Ddemo/J2DdemoTest.java cannot
    find J2Ddemo.jar
    + S8224821: java/awt/Focus/NoAutotransferToDisabledCompTest/
    /NoAutotransferToDisabledCompTest.java fails linux-x64
    + S8224830: test/jdk/java/awt/Focus/
    /ModalExcludedWindowClickTest/
    /ModalExcludedWindowClickTest.java fails on linux-x64
    + S8224851: AArch64: fix warnings and errors with Clang and GCC
    8.3
    + S8224905: java/lang/ProcessBuilder/Basic.java#id1 failed with
    stream closed
    + S8225007: java/awt/print/PrinterJob/
    /LandscapeStackOverflow.java may hang
    + S8225105: java/awt/Focus/ShowFrameCheckForegroundTest/
    /ShowFrameCheckForegroundTest.java fails in Windows 10
    + S8225117: java/math/BigInteger/SymmetricRangeTests.java fails
    with ParseException
    + S8225128: Add exception for expiring DocuSign root to
    VerifyCACerts test
    + S8225130: Add exception for expiring Comodo roots to
    VerifyCACerts test
    + S8225144: [macos] In Aqua L&amp;F backspace key does not delete
    when Shift is pressed
    + S8225180: SignedObject with invalid Key not throwing the
    InvalidKeyException in Windows
    + S8225182: JNI exception pending in DestroyXIMCallback of
    awt_InputMethod.c:1327
    + S8225199: [Graal] compiler/jvmci/compilerToVM/
    /IsMatureVsReprofileTest.java fails with
  - XX:CompileThresholdScaling=0.1
    + S8225305: ProblemList java/lang/invoke/VarHandles tests
    + S8225350: compiler/jvmci/compilerToVM/IsCompilableTest.java
    timed out
    + S8225430: Replace wildcard address with loopback or local
    host in tests - part 14
    + S8225435: Upgrade IANA Language Subtag Registry to the latest
    for JDK14
    + S8225487: giflib legal file is missing attribution for
    openbsd-reallocarray.c
    + S8225567: Wrong file headers with 8202414 fix changeset
    + S8225684: [AOT] vmTestbase/vm/oom/production/
    /AlwaysOOMProduction tests fail with AOTed java.base
    + S8225766: Curve in certificate should not affect signature
    scheme when using TLSv1.3
    + S8225797: OldObjectSample event creates unexpected amount of
    checkpoint data
    + S8226381: ProblemList java/lang/reflect/PublicMethods/
    /PublicMethodsTest.java
    + S8226406: JVM fails to detect mismatched or corrupt CDS
    archive
    + S8226608: Hide the onjcmd option from the help output
    + S8226892: ActionListeners on JRadioButtons don't get notified
    when selection is changed with arrow keys
    + S8227112: exclude compiler/intrinsics/sha/sanity tests from
    AOT runs
    + S8227324: Upgrade to freetype 2.10.1
    + S8227528: TestAbortVMOnSafepointTimeout.java failed due to
    "RuntimeException: 'Safepoint sync time longer than' missing
    from stdout/stderr"
    + S8227645: Some tests in serviceability/sa run with fixed -Xmx
    values and risk running out of memory
    + S8227646: [TESTBUG] appcds/SharedArchiveConsistency timed out
    + S8227662: freetype seeks to index at the end of the font data
    + S8228479: Correct the format of ColorChooserDemoTest
    + S8228613: java.security.Provider#getServices order is no
    longer deterministic
    + S8228969: 2019-09-28 public suffix list update
    + S8229236: CriticalJNINatives: dll handling should be done in
    native thread state
    + S8229345: Memory leak due to vtable stubs not being shared on
    SPARC
    + S8229888: (zipfs) Updating an existing zip file does not
    preserve original permissions
    + S8229994: assert(false) failed: Bad graph detected in
    get_early_ctrl_for_expensive
    + S8230004: jdk/internal/jimage/JImageOpenTest.java runs no test
    + S8230235: Rendering HTML with empty img attribute and
    documentBaseKey cause Exception
    + S8230390: Problemlist SA tests with AOT
    + S8230400: Missing constant pool entry for a method in
    stacktrace
    + S8230459: Test failed to resume JVMCI CompilerThread
    + S8230480: check malloc/calloc results in java.desktop
    + S8230597: Update GIFlib library to the 5.2.1
    + S8230611: infinite loop in
    LogOutputList::wait_until_no_readers()
    + S8230624: [TESTBUG] Problemlist JFR
    compiler/TestCodeSweeper.java
    + S8230677: Should disable Escape Analysis if JVMTI capability
    can_get_owned_monitor_info was taken
    + S8230926: [macosx] Two apostrophes are entered instead of one
    with "U.S. International - PC" layout
    + S8231025: Incorrect method tag offset for big endian platform
    + S8231081: TestMetadataRetention fails due to missing symbol id
    + S8231387: java.security.Provider.getService returns random
    result due to race condition with mutating methods in the same
    class
    + S8231430: C2: Memory stomp in max_array_length() for
    T_ILLEGAL type
    + S8231445: check ZALLOC return values in awt coding
    + S8231507: Update Apache Santuario (XML Signature) to version
    2.1.4
    + S8231584: Deadlock with ClassLoader.findLibrary and
    System.loadLibrary call
    + S8231753: use more Posix functionality in aix
    os::print_os_info
    + S8231810: javax/net/ssl/templates/
    /SSLSocketSSLEngineTemplate.java fails intermittently with
    "java.lang.Exception: Unexpected EOF"
    + S8232003: (fs) Files.write can leak file descriptor in the
    exception case
    + S8232056: GetOwnedMonitorInfoWithEATest.java fails with ZGC:
    Heap too small
    + S8232060: add some initializations using sigemptyset in
    os_aix.cpp
    + S8232154: Update Mesa 3-D Headers to version 19.2.1
    + S8232167: Visual Studio install found through
  - -with-tools-dir value is discarded
    + S8232170: FSInfo#getJarClassPath throws an exception not
    declared in its throws clause
    + S8232200: [macos 10.15] Windows in fullscreen tests jumps
    around the screen
    + S8232207: Linux os::available_memory re-reads cgroup
    configuration on every invocation
    + S8232224: [TESTBUG] problemlist JFR TestLargeRootSet.java
    + S8232370: Refactor some com.sun.jdi tests to enable IDE
    integration
    + S8232433: [macos 10.15] java/awt/Window/
    /LocationAtScreenCorner/LocationAtScreenCorner.java may fail
    + S8232571: Add missing SIGINFO signal
    + S8232692: [TESTBUG] compiler/aot/fingerprint/
    /SelfChangedCDS.java fails when cds is disabled
    + S8232713: Update BCEL version to 6.3.1 in license file
    + S8232806: Introduce a system property to disable eager lambda
    initialization
    + S8232834: RunTest sometimes fails to produce valid
    exitcode.txt
    + S8232880: Update test documentation with additional settings
    for client UI tooltip tests
    + S8232950: SUNPKCS11 Provider incorrectly check key length for
    PSS Signatures.
    + S8233018: Add a new test to verify that DatagramSocket is not
    interruptible
    + S8233019: java.lang.Class.isPrimitive() (C1) returns wrong
    result if Klass* is aligned to 32bit
    + S8233032: assert(in_bb(n)) failed: must be
    + S8233078: fix minimal VM build on Linux ppc64(le)
    + S8233328: fix minimal VM build on Linux s390x
    + S8233383: Various minor fixes
    + S8233466: aarch64: remove unnecessary load of mdo when
    profiling return and parameters type
    + S8233491: Crash in AdapterHandlerLibrary::get_adapter with
    CDS due to code cache exhaustion
    + S8233529: loopTransform.cpp:2984: Error: assert(p_f-&gt;Opcode()
    == Op_IfFalse) failed
    + S8233548: Update CUP to v0.11b
    + S8233649: Update ProblemList.txt to exclude failing headful
    tests on macos
    + S8233656: assert(d-&gt;is_CFG() &amp;&amp; n-&gt;is_CFG()) failed: must
    have CFG nodes
    + S8233657: Intermittent NPE in Component.validate()
    + S8234288: Turkey Time Zone returns incorrect time zone name
    + S8234323: NULL-check return value of SurfaceData_InitOps on
    macosx
    + S8234339: replace JLI_StrTok in java_md_solinux.c
    + S8234340: Bump update version for OpenJDK: jdk-11.0.7
    + S8234350: assert(mode == ControlAroundStripMined &amp;&amp; (use ==
    sfpt || !use-&gt;is_reachable_from_root())) failed: missed a node
    + S8234386: [macos] NPE was thrown at expanding Choice from
    maximized frame
    + S8234397: add OS uptime information to os::print_os_info
    output
    + S8234423: Modifying ArrayList.subList().subList() resets
    modCount of subList
    + S8234466: Class loading deadlock involving
    X509Factory#commitEvent()
    + S8234501: remove obsolete NET_ReadV
    + S8234525: enable link-time section-gc for linux s390x to
    remove unused code
    + S8234610: MaxVectorSize set wrongly when UseAVX=3 is
    specified after JDK-8221092
    + S8234617: C1: Incorrect result of field load due to missing
    narrowing conversion
    + S8234723: javax/net/ssl/TLS tests support TLSv1.3
    + S8234724: javax/net/ssl/templates/
    /SSLSocketSSLEngineTemplate.java supports TLSv1.3
    + S8234741: enhance os::get_core_path on macOS
    + S8234769: Duplicate attribution in freetype.md
    + S8234786: Fix for JDK-8214578 breaks OS X 10.12 compatibility
    + S8234809: set relro in linker flags when building with gcc
    + S8234824: java/nio/channels/SocketChannel/AdaptSocket.java
    fails on Windows 10
    + S8235243: handle VS2017 15.9 and VS2019 in abstract_vm_version
    + S8235288: AVX 512 instructions inadvertently used on Xeon for
    small vector width operations
    + S8235325: build failure on Linux after 8235243
    + S8235383: C1 compilation fails with
  - XX:+PrintIRDuringConstruction -XX:+Verbose
    + S8235489: handle return values of sscanf calls in hotspot
    + S8235509: Backport for JDK-8209657 Refactor filemap.hpp to
    simplify integration with Serviceability Agent.
    + S8235510: java.util.zip.CRC32 performance drop after 8200067
    + S8235563: [TESTBUG] appcds/CommandLineFlagComboNegative.java
    does not handle archive mapping failure
    + S8235637: jhsdb jmap from OpenJDK 11.0.5 doesn't work if
    prelink is enabled
    + S8235671: enhance print_rlimit_info in os_posix
    + S8235744: PIT: test/jdk/javax/swing/text/html/
    /TestJLabelWithHTMLText.java times out in linux-x64
    + S8235904: Infinite loop when rendering huge lines
    + S8235998: [c2] Memory leaks during tracing after '8224193:
    stringStream should not use Resource Area'.
    + S8236039: JSSE Client does not accept status_request
    extension in CertificateRequest messages for TLS 1.3
    + S8236140: assert(!VerifyHashTableKeys || _hash_lock == 0)
    failed: remove node from hash table before modifying it
    + S8236179: C1 register allocation error with T_ADDRESS
    + S8236488: Support for configure option
  - -with-native-debug-symbols=internal is impossible on Windows
    + S8236500: Windows ucrt.dll should be looked up in versioned
    WINSDK subdirectory
    + S8236709: struct SwitchRange in HS violates C++ One
    Definition Rule
    + S8236848: [JDK 11u] make run-test-tier1 fails after backport
    of JDK-8232834
    + S8236873: Worker has a deadlock bug
    + S8237217: Incorrect G1StringDedupEntry type used in
    StringDedupTable destructor
    + S8237368: Problem with NullPointerException in RMI
    TCPEndpoint.read
    + S8237375: SimpleThresholdPolicy misses CounterDecay timestamp
    initialization
    + S8237508: Simplify JarFile.isInitializing
    + S8237540: Missing files in backport of JDK-8210910
    + S8237541: Missing files in backport of JDK-8236528
    + S8237600: Test SunJSSEFIPSInit fails on Ubuntu
    + S8237819: s390x - remove unused pd_zero_to_words_large
    + S8237869: exclude jtreg test security/infra/java/security/
    /cert/CertPathValidator/certification/LuxTrustCA.java because
    of instabilities
    + S8237879: make 4.3 breaks build
    + S8237945: CTW: C2 compilation fails with
    assert(just_allocated_object(alloc_ctl) == ptr) failed: most
    recent allo...
    + S8238225: Issues reported after replacing symlink at
    Contents/MacOS/libjli.dylib with binary
    + S8238247: CTW runner should sweep nmethods more aggressively
    + S8238366: CTW runner closes standard output on exit
    + S8238438: SuperWord::co_locate_pack picks memory state of
    first instead of last load
    + S8238502: sunmscapi.dll causing EXCEPTION_ACCESS_VIOLATION
    + S8238534: Deep sign macOS bundles before bundle archive is
    being created
    + S8238591: CTW: Split
    applications/ctw/modules/jdk_localedata.java
    + S8238596: AVX enabled by default for Skylake even when
    unsupported
    + S8238811: C2: assert(i &gt;= req() || i == 0 || is_Region() ||
    is_Phi()) with -XX:+VerifyGraphEdges
    + S8239005: [TESTBUG] test/hotspot/jtreg/runtime/
    /StackGuardPages/TestStackGuardPages.java: exeinvoke.c: must
    initialize static state before calling do_overflow()
    + S8239466: Loss of precision in counter decay calculation in
    11u backport of JDK-8237375
    + S8239856: [ntintel] asserts about copying unaligned array
    element
    + S8240724: [test] jdk11 downport of 8224475 misses binary file
    test/jdk/javax/swing/JTextPane/arrow.png
    + S8241296: Segfault in JNIHandleBlock::oops_do()
- Removed patch:
  * DependOnVariableHelper.patch
    + fixed upstream
- Added patch:
  * JDK-8228407.patch
    + fix crashes due to shared archive file mismatch</changelog>
  <changelog author="fstrba@suse.com" date="1594900800">- Update to upstream tag jdk-11.0.8+10 (July 2020 CPU, bsc#1174157)
  * Security fixes:
    + JDK-8230613: Better ASCII conversions
    + JDK-8231800: Better listing of arrays
    + JDK-8232014: Expand DTD support
    + JDK-8233234: Better Zip Naming
    + JDK-8233239, CVE-2020-14562: Enhance TIFF support
    + JDK-8233255: Better Swing Buttons
    + JDK-8234032: Improve basic calendar services
    + JDK-8234042: Better factory production of certificates
    + JDK-8234418: Better parsing with CertificateFactory
    + JDK-8234836: Improve serialization handling
    + JDK-8236191: Enhance OID processing
    + JDK-8236867, CVE-2020-14573: Enhance Graal interface handling
    + JDK-8237117, CVE-2020-14556: Better ForkJoinPool behavior
    + JDK-8237592, CVE-2020-14577: Enhance certificate verification
    + JDK-8238002, CVE-2020-14581: Better matrix operations
    + JDK-8238013: Enhance String writing
    + JDK-8238804: Enhance key handling process
    + JDK-8238842: AIOOBE in GIFImageReader.initializeStringTable
    + JDK-8238843: Enhanced font handing
    + JDK-8238920, CVE-2020-14583: Better Buffer support
    + JDK-8238925: Enhance WAV file playback
    + JDK-8240119, CVE-2020-14593: Less Affine Transformations
    + JDK-8240482: Improved WAV file playback
    + JDK-8241379: Update JCEKS support
    + JDK-8241522: Manifest improved jar headers redux
    + JDK-8242136, CVE-2020-14621: Better XML namespace handling
  * Other changes:
    + JDK-6933331: (d3d/ogl) java.lang.IllegalStateException:
    Buffers have not been created
    + JDK-7124307: JSpinner and changing value by mouse
    + JDK-8022574: remove HaltNode code after uncommon trap calls
    + JDK-8039082: [TEST_BUG] Test
    java/awt/dnd/BadSerializationTest/BadSerializationTest.java
    fails
    + JDK-8040630: Popup menus and tooltips flicker with previous
    popup contents when first shown
    + JDK-8044365: (dc) MulticastSendReceiveTests.java failing with
    ENOMEM when joining group (OS X 10.9)
    + JDK-8048215: [TESTBUG]
    java/lang/management/ManagementFactory/ThreadMXBeanProxy.java
    Expected non-null LockInfo
    + JDK-8051349: nsk/jvmti/scenarios/sampling/SP06/sp06t003 fails
    in nightly
    + JDK-8080353: JShell: Better error message on attempting to
    add default method
    + JDK-8139876: Exclude hanging nsk/stress/stack from execution
    with deoptimization enabled
    + JDK-8146090: java/lang/ref/ReachabilityFenceTest.java fails
    with -XX:+DeoptimizeALot
    + JDK-8153430: jdk regression test MletParserLocaleTest,
    ParserInfiniteLoopTest reduce default timeout
    + JDK-8156207: Resource allocated BitMaps are often cleared
    unnecessarily
    + JDK-8159740: JShell: corralled declarations do not have
    correct source to wrapper mapping
    + JDK-8175984: ICC_Profile has un-needed, not-empty finalize
    method
    + JDK-8176359: Frame#setMaximizedbounds not working properly in
    multi screen environments
    + JDK-8183369: RFC unconformity of HttpURLConnection with proxy
    + JDK-8187078: -XX:+VerifyOops finds numerous problems when
    running JPRT
    + JDK-8189861: Refactor CacheFind
    + JDK-8191169: java/net/Authenticator/B4769350.java failed
    intermittently
    + JDK-8191930: [Graal] emits unparseable XML into compile log
    + JDK-8193879: Java debugger hangs on method invocation
    + JDK-8196019: java/awt/Window/Grab/GrabTest.java fails on
    Windows
    + JDK-8196181: sun/java2d/GdiRendering/InsetClipping.java fails
    + JDK-8198000:
    java/awt/List/EmptyListEventTest/EmptyListEventTest.java
    debug assert on Windows
    + JDK-8198001: java/awt/Menu/WrongParentAfterRemoveMenu/
    /WrongParentAfterRemoveMenu.java debug assert on Windows
    + JDK-8198339: Test javax/swing/border/Test6981576.java is
    unstable
    + JDK-8200701: jdk/jshell/ExceptionsTest.java fails on Windows,
    after JDK-8198801
    + JDK-8203264: JNI exception pending in
    PlainDatagramSocketImpl.c:740
    + JDK-8203672: JNI exception pending in PlainSocketImpl.c
    + JDK-8203673: JNI exception pending in
    DualStackPlainDatagramSocketImpl.c:398
    + JDK-8204834: Fix confusing "allocate" naming in OopStorage
    + JDK-8205399: Set node color on pinned HashMap.TreeNode
    deletion
    + JDK-8205653: test/jdk/sun/management/jmxremote/bootstrap/
    /RmiRegistrySslTest.java and RmiSslBootstrapTest.sh fail with
    handshake_failure
    + JDK-8206179: com/sun/management/OperatingSystemMXBean/
    /GetCommittedVirtualMemorySize.java fails with Committed
    virtual memory size illegal value
    + JDK-8207334: VM times out in VM_HandshakeAllThreads::doit()
    with RunThese30M
    + JDK-8208277: Code cache heap (-XX:ReservedCodeCacheSize)
    doesn't work with 1GB LargePages
    + JDK-8209113: Use WeakReference for lastFontStrike for created
    Fonts
    + JDK-8209333: Socket reset issue for TLS 1.3 socket close
    + JDK-8209439: C2 library_call can potentially ignore Math.pow
    intrinsic or use null pointer
    + JDK-8209534: [TESTBUG]runtime/appcds/cacheObject/
    /ArchivedModuleCompareTest.java fails with EnableJVMCI.
    + JDK-8210147: adjust some WSAGetLastError usages in windows
    network coding
    + JDK-8210284: "assert((av &amp; 0x00000001) == 0) failed:
    unsupported V8" on Solaris 11.4
    + JDK-8210303: VM_HandshakeAllThreads fails assert with
    "failed: blocked and not walkable"
    + JDK-8210459: Add support for generating compile_commands.json
    + JDK-8210515: [TESTBUG]CheckArchivedModuleApp.java needs to
    check if EnableJVMCI is set.
    + JDK-8210788: Javadoc for Thread.join(long, int) should
    specify that it waits forever when both arguments are zero
    + JDK-8211301: [macos] support full window content options
    + JDK-8211332: Space for stub routines (code_size2) is too
    small on new Skylake CPUs
    + JDK-8211339: NPE during SSL handshake caused by
    HostnameChecker
    + JDK-8211392: compiler/profiling/
    /spectrapredefineclass_classloaders/Launcher.java times out
    in JDK12 CI
    + JDK-8211743: [AOT] crash in ScopeDesc::decode_body() when
    JVMTI walks AOT frames
    + JDK-8212154: [TESTBUG] CheckArchivedModuleApp fails with NPE
    when JVMCI is absent
    + JDK-8212167: JShell : Stack trace of exception has wrong line
    number
    + JDK-8212933: Thread-SMR: requesting a VM operation whilst
    holding a ThreadsListHandle can cause deadlocks
    + JDK-8212986: Make Visual Studio compiler check less strict
    + JDK-8213250: CDS archive creation aborts due to metaspace
    object allocation failure
    + JDK-8213516: jck test api/javax_accessibility/AccessibleState/
    /fields.html fails intermittent
    + JDK-8213947: ARM32: failed check_simd should set
    UsePopCountInstruction to false
    + JDK-8214418: half-closed SSLEngine status may cause
    application dead loop
    + JDK-8214440: ldap over a TLS connection negotiate failed with
    "javax.net.ssl.SSLPeerUnverifiedException: hostname of the
    server does not match the hostname in the server's
    certificate"
    + JDK-8214444: Wrong strncat limits in dfa.cpp
    + JDK-8214481: freetype path does not disable TrueType hinting
    with AA+FM hints
    + JDK-8214571: -Xdoclint of array serialField gives "error:
    array type not allowed here"
    + JDK-8214856: Errors with JSZip in web console after upgrade
    to 3.1.5
    + JDK-8214862: assert(proj != __null) at compile.cpp:3251
    + JDK-8215369: Jcstress pollute /var/tmp with temporary files.
    + JDK-8215551: Missing case label in nmethod::reloc_string_for()
    + JDK-8215555: TieredCompilation C2 threads can excessively
    block handshakes
    + JDK-8215711: Missing key_share extension for (EC)DHE key
    exchange should alert missing_extension
    + JDK-8216151: [Graal] Module
    jdk.internal.vm.compiler.management has not been granted
    accessClassInPackage.org.graalvm.compiler.debug
    + JDK-8216154: C4819 warnings at HotSpot sources on Windows
    + JDK-8216541: CompiledICHolders of VM locked unloaded nmethods
    are released too late
    + JDK-8217230: assert(t == t_no_spec) failure in
    NodeHash::check_no_speculative_types()
    + JDK-8217404: --with-jvm-features doesn't work when multiple
    features are explicitly disabled
    + JDK-8217447: Develop flag TraceICs is broken
    + JDK-8217606: LdapContext#reconnect always opens a new
    connection
    + JDK-8218807: Compilation database (compile_commands.json) may
    contain obsolete items
    + JDK-8219214: Infinite Loop in CodeSection::dump()
    + JDK-8219904: ClassCastException when calling
    FlightRecorderMXBean#getRecordings()
    + JDK-8219991: New fix of the deadlock in
    sun.security.ssl.SSLSocketImpl
    + JDK-8221121: applications/microbenchmarks are encountering
    crashes in tier5
    + JDK-8221445: FastSysexMessage constructor crashes MIDI
    receiption thread
    + JDK-8221482: Initialize VMRegImpl::regName[] earlier to
    prevent assert during PrintStubCode
    + JDK-8221741: ClassCastException can happen when
    fontconfig.properties is used
    + JDK-8221823: Requested JDialog width is ignored
    + JDK-8223108: Test java/awt/EventQueue/
    /NonComponentSourcePost.java is unstable
    + JDK-8223678: Add Visual Studio Code workspace generation
    support (for native code)
    + JDK-8223935: PIT: java/awt/font/WindowsIndicFonts.java fails
    on windows10
    + JDK-8224109: Text spaced incorrectly by drawString under
    rotation with fractional metric
    + JDK-8224632: testbug: java/awt/dnd/RemoveDropTargetCrashTest/
    /RemoveDropTargetCrashTest.java fails on MacOS
    + JDK-8224793: os::die() does not honor CreateCoredumpOnCrash
    option
    + JDK-8224847: gc/stress/TestReclaimStringsLeaksMemory.java
    fails with reserved greater than expected
    + JDK-8224931: disable JAOTC invokedynamic support until
    8223533 is fixed
    + JDK-8224997: ChaCha20-Poly1305 TLS cipher suite decryption
    throws ShortBufferException
    + JDK-8225068: Remove DocuSign root certificate that is
    expiring in May 2020
    + JDK-8225069: Remove Comodo root certificate that is expiring
    in May 2020
    + JDK-8225126: Test SetBoundsPaintTest.html faild on Windows
    when desktop is scaled
    + JDK-8225325: Add tests for redefining a class' private method
    during resolution of the bootstrap specifier
    + JDK-8225622: [AOT] runtime/SharedArchiveFile/
    /TestInterpreterMethodEntries.java crashed with AOTed
    java.base
    + JDK-8225653: Provide more information when hitting SIGILL
    from HaltNode
    + JDK-8225783: Incorrect use of binary operators on booleans in
    type.cpp
    + JDK-8225789: Empty method parameter type should generate
    ClassFormatError
    + JDK-8226198: use of &amp; instead of &amp;&amp; in
    LibraryCallKit::arraycopy_restore_alloc_state
    + JDK-8226253: JAWS reports wrong number of radio buttons when
    buttons are hidden.
    + JDK-8226653: [accessibility] Can edit text cell correctly,
    but Accessibility Tool reads nothing about editor
    + JDK-8226806: [macOS 10.14] Methods of Java Robot should be
    called from appropriate thread
    + JDK-8226879: Memory leak in Type::hashcons
    + JDK-8227632: Incorrect PrintCompilation message: made not
    compilable on levels 0 1 2 3 4
    + JDK-8228407: JVM crashes with shared archive file mismatch
    + JDK-8228482: fix xlc16/xlclang comparison of distinct pointer
    types and string literal conversion warnings
    + JDK-8228757: Fail fast if the handshake type is unknown
    + JDK-8229158: make UseSwitchProfiling non-experimental or
    false by-default
    + JDK-8229421: The logic of java/net/ipv6tests/TcpTest.java is
    flawed
    + JDK-8229855: C2 fails with assert(false) failed: bad AD file
    + JDK-8230591: AArch64: Missing intrinsics for Math.ceil,
    floor, rint
    + JDK-8231118: ARM32: Math tests failures
    + JDK-8231213: Migrate SimpleDateFormatConstTest to JDK Repo
    + JDK-8231243: [TESTBUG] CustomFont.java cannot find font file
    + JDK-8231438: [macOS] Dark mode for the desktop is not
    supported
    + JDK-8231550: C2: ShouldNotReachHere() in
    verify_strip_mined_scheduling
    + JDK-8231564: setMaximizedBounds is broken with large display
    scale and multiple monitors
    + JDK-8231572: Use -lobjc instead of -fobjc-link-runtime in
    libosxsecurity
    + JDK-8231631: sun/net/ftp/FtpURLConnectionLeak.java fails
    intermittently with NPE
    + JDK-8231671: Fix copyright headers in hotspot (missing comma
    after year)
    + JDK-8231720: Some perf regressions after 8225653
    + JDK-8231779: crash
    HeapWord*ParallelScavengeHeap::failed_mem_allocate
    + JDK-8231863: Crash if classpath is read from @argument file
    and the main gets option argument
    + JDK-8232080: jlink plugins for vendor information and
    run-time options
    + JDK-8232106: [x86] C2: SIGILL due to usage of SSSE3
    instructions on processors which don't support it
    + JDK-8232134: Change to Visual Studio 2017 15.9.16 for
    building on Windows at Oracle
    + JDK-8232226: [macos 10.15] test/jdk/java/awt/color/
    /EqualityTest/EqualityTest.java may fail
    + JDK-8232357: Compare version info of Santuario to legal notice
    + JDK-8232572: Add hooks for custom output dir in Bundles.gmk
    + JDK-8232634: Problem List ICMColorDataTest.java
    + JDK-8232748: Build static versions of certain JDK libraries
    + JDK-8232846: ProcessHandle.Info command with non-English
    shows question marks
    + JDK-8232880: Update test documentation with additional
    settings for client UI tooltip tests
    + JDK-8233033: C2 produces wrong result while unswitching a
    loop due to lost control dependencies
    + JDK-8233137: runtime/ErrorHandling/VeryEarlyAssertTest.java
    fails after 8232080
    + JDK-8233197: Invert JvmtiExport::post_vm_initialized() and
    Jfr:on_vm_start() start-up order for correct option parsing
    + JDK-8233291: [TESTBUG] tools/jlink/plugins/
    /VendorInfoPluginsTest.java fails with debug or non-server VMs
    + JDK-8233364: Fix undefined behavior in
    Canonicalizer::do_ShiftOp
    + JDK-8233494: Avoid calling MallocTracker::record_malloc and
    record_free when NMT is off
    + JDK-8233573: Toolkit.getScreenInsets(GraphicsConfiguration)
    may throw ClassCastException
    + JDK-8233608: Minimal build broken after JDK-8233494
    + JDK-8233621: Mismatch in jsse.enableMFLNExtension property
    name
    + JDK-8233696: [TESTBUG]Some jtreg tests fail when CAPS_LOCK is
    ON
    + JDK-8233707: systemScale.cpp could not compile with VS2019
    + JDK-8233801: GCMEmptyIv.java test fails on Solaris 11.4
    + JDK-8233880: Support compilers with multi-digit major version
    numbers
    + JDK-8233920: MethodHandles::tryFinally generates illegal
    bytecode for long/double return type
    + JDK-8234137: The "AutoTestOnTop.java" test may run external
    applications
    + JDK-8234146: compiler/jsr292/
    /ContinuousCallSiteTargetChange.java times out on SPARC
    + JDK-8234184: [TESTBUG] java/awt/Mouse/EnterExitEvents/
    /ModalDialogEnterExitEventsTest.java fails in Windows
    + JDK-8234270: [REDO] JDK-8204128 NMT might report incorrect
    numbers for Compiler area
    + JDK-8234332: [TESTBUG] java/awt/Focus/DisposedWindow/
    /DisposeDialogNotActivateOwnerTest/
    /DisposeDialogNotActivateOwnerTest.java fails on linux-x64
    nightly
    + JDK-8234398: Replace ID2D1Factory::GetDesktopDpi with
    GetDeviceCaps
    + JDK-8234522: [macos] Crash with use of native file dialog
    + JDK-8234691: Potential double-free in ParallelSPCleanupTask
    constructor
    + JDK-8234696: tools/jlink/plugins/VendorInfoPluginsTest.java
    times out
    + JDK-8234727: sun/security/ssl/X509TrustManagerImpl tests
    support TLSv1.3
    + JDK-8234728: Some security tests should support TLSv1.3
    + JDK-8234779: Provide idiom for declaring classes noncopyable
    + JDK-8234824: java/nio/channels/SocketChannel/AdaptSocket.java
    fails on Windows 10
    + JDK-8234968: check calloc rv in libinstrument
    InvocationAdapter
    + JDK-8235153: [TESTBUG] [macos 10.15] java/awt/Graphics/
    /DrawImageBG/SystemBgColorTest.java fails
    + JDK-8235183: Remove the "HACK CODE" in comment
    + JDK-8235263: Revert TLS 1.3 change that wrapped IOExceptions
    + JDK-8235311: Tag mismatch may alert bad_record_mac
    + JDK-8235332: TestInstanceCloneAsLoadsStores.java fails with
  - XX:+StressGCM
    + JDK-8235452: Strip mined loop verification fails with
    assert(is_OuterStripMinedLoop()) failed: invalid node class
    + JDK-8235584: UseProfiledLoopPredicate fails with
    assert(_phase-&gt;get_loop(c) == loop) failed: have to be in the
    same loop
    + JDK-8235620: Broken merge between JDK-8006406 and JDK-8003559
    + JDK-8235638: NPE in LWWindowPeer.getOnscreenGraphics()
    + JDK-8235686: Add more custom hooks in Bundles.gmk
    + JDK-8235739: Rare NPE at WComponentPeer.getGraphics()
    + JDK-8235762: JVM crash in SWPointer during C2 compilation
    + JDK-8235834: IBM-943 charset encoder needs updating
    + JDK-8235874: The ordering of Cipher Suites is not maintained
    provided through jdk.tls.client.cipherSuites and
    jdk.tls.server.cipherSuites system property.
    + JDK-8235908: omit ThreadPriorityPolicy warning when value is
    set from image
    + JDK-8235984: C2: assert(out-&gt;in(PhiNode::Region) == head ||
    out-&gt;in(PhiNode::Region) == slow_head) failed: phi must be
    either part of the slow or the fast loop
    + JDK-8236211: [Graal] compiler/graalunit/GraphTest.java is
    skipped in all testing
    + JDK-8236470: Deal with ECDSA using ecdsa-with-SHA2 plus hash
    algorithm as AlgorithmId
    + JDK-8236545: Compilation error in mach5
    java/awt/FileDialog/MacOSGoToFolderCrash.java
    + JDK-8236700: Upgrading JSZip from v3.1.5 to v3.2.2
    + JDK-8236759: ShouldNotReachHere in
    PhaseIdealLoop::verify_strip_mined_scheduling
    + JDK-8236897: Fix the copyright header for pkcs11gcm2.h
    + JDK-8236921: Add build target to produce a JDK image suitable
    for a Graal/SVM build
    + JDK-8236953: [macos] JavaFX SwingNode is not rendered on macOS
    + JDK-8236996: Incorrect Roboto font rendering on Windows with
    subpixel antialiasing
    + JDK-8237045: JVM uses excessive memory with -XX:+EnableJVMCI
  - XX:JVMCICounterSize=2147483648
    + JDK-8237055: [TESTBUG] compiler/c2/TestJumpTable.java fails
    with release VMs
    + JDK-8237086: assert(is_MachReturn()) running CTW with fix for
    JDK-8231291
    + JDK-8237192: Generate stripped/public pdbs on Windows for jdk
    images
    + JDK-8237396: JvmtiTagMap::weak_oops_do() should not trigger
    barriers
    + JDK-8237474: Default SSLEngine should create in server role
    + JDK-8237859: C2: Crash when loads float above range check
    + JDK-8237879: make 4.3 breaks build
    + JDK-8237951: CTW: C2 compilation fails with "malformed
    control flow"
    + JDK-8237962: give better error output for invalid OCSP
    response intervals in CertPathValidator checks
    + JDK-8238190: [JVMCI] Fix single implementor speculation for
    diamond shapes.
    + JDK-8238356: CodeHeap::blob_count() overestimates the number
    of blobs
    + JDK-8238452: Keytool generates wrong expiration date if
    validity is set to 2050/01/01
    + JDK-8238555: Allow Initialization of SunPKCS11 with NSS when
    there are external FIPS modules in the NSSDB
    + JDK-8238575: DragSourceEvent.getLocation() returns wrong
    value on HiDPI screens (Windows)
    + JDK-8238676: jni crashes on accessing it from process exit
    hook
    + JDK-8238721: Add failing client jtreg tests to the Problem
    List
    + JDK-8238738: AudioSystem.getMixerInfo() takes about 30 sec to
    report a gone audio device
    + JDK-8238756: C2: assert(((n) == __null || !VerifyIterativeGVN
    || !((n)-&gt;is_dead()))) failed: can not use dead node
    + JDK-8238765: PhaseCFG::schedule_pinned_nodes cannot handle
    precedence edges from unmatched CFG nodes correctly
    + JDK-8238898: Missing hash characters for header on license
    file
    + JDK-8238942: Rendering artifacts with LCD text and fractional
    metrics
    + JDK-8238985: [TESTBUG] The arrow image is blue instead of
    green
    + JDK-8239000: handle ContendedPaddingWidth in vm_version_ppc
    + JDK-8239055: Wrong implementation of VMState.hasListener
    + JDK-8239091: Reversed arguments in call to strstr in freetype
    "debug" code.
    + JDK-8239142: C2's UseUniqueSubclasses optimization is broken
    for array accesses
    + JDK-8239224: libproc_impl.c previous_thr may be used
    uninitialized warning
    + JDK-8239351: Give more meaningful InternalError messages in
    Deflater.c
    + JDK-8239365: ProcessBuilder test modifications for AIX
    execution
    + JDK-8239456: vtable stub generation: assert failure (code
    size estimate)
    + JDK-8239457: call ReleaseStringUTFChars before early returns
    in Java_sun_security_pkcs11_wrapper_PKCS11_connect
    + JDK-8239462: jdk.hotspot.agent misses some
    ReleaseStringUTFChars calls in case of early returns
    + JDK-8239557: [TESTBUG] VeryEarlyAssertTest.java validating
    "END." marker at lastline is not always true
    + JDK-8239787: AArch64: String.indexOf may incorrectly handle
    empty strings
    + JDK-8239792: Bump update version for OpenJDK: jdk-11.0.8
    + JDK-8239798: SSLSocket closes socket both socket endpoints on
    a SocketTimeoutException
    + JDK-8239819: XToolkit: Misread of screen information memory
    + JDK-8239852: java/util/concurrent tests fail with
  - XX:+VerifyGraphEdges: assert(!VerifyGraphEdges) failed:
    verification should have failed
    + JDK-8239893: Windows handle Leak when starting processes
    using ProcessBuilder
    + JDK-8239915: Zero VM crashes when handling dynamic constant
    + JDK-8239931: [win][x86] vtable stub generation: assert
    failure (code size estimate) follow-up
    + JDK-8239965: XMLEncoder/Test4625418.java fails due to "Error:
    Cp943 - can't read properly"
    + JDK-8239976: Put JDK-8239965 on the ProblemList.txt
    + JDK-8240073: Fix 'test-make' build target in 11u
    + JDK-8240197: Cannot start JVM when $JAVA_HOME includes CJK
    characters
    + JDK-8240202: A few client tests leave mouse buttons pressed
    + JDK-8240220: IdealLoopTree::dump_head predicate printing is
    broken
    + JDK-8240223: Use consistent predicate order in and with
    PhaseIdealLoop::find_predicate
    + JDK-8240227: Loop predicates should be copied to unswitched
    loops
    + JDK-8240286: [TESTBUG] Test command error in hotspot/jtreg/
    /compiler/loopopts/superword/SumRedAbsNeg_Float.java
    + JDK-8240518: Incorrect JNU_ReleaseStringPlatformChars in
    Windows Print
    + JDK-8240529: CheckUnhandledOops breaks NULL check in
    Modules::define_module
    + JDK-8240576: JVM crashes after transformation in C2
    IdealLoopTree::merge_many_backedges
    + JDK-8240603: Windows 32bit compile error after 8238676
    + JDK-8240629: argfiles parsing broken for argfiles with
    comment cross 4096 bytes chunk
    + JDK-8240711: TestJstatdPort.java failed due to
    "ExportException: Port already in use:"
    + JDK-8240786: [TESTBUG] The test java/awt/Window/
    /GetScreenLocation/GetScreenLocationTest.java fails on HiDPI
    screen
    + JDK-8240824: enhance print_full_memory_info on Linux by THP
    related information
    + JDK-8240827: Downport SSLSocketImpl.java from "8221882: Use
    fiber-friendly java.util.concurrent.locks in JSSE"
    + JDK-8240905: assert(mem == (Node*)1 || mem == mem2) failed:
    multiple Memories being matched at once?
    + JDK-8240972: macOS codesign fail on macOS 10.13.5 or older
    + JDK-8241445: Fix copyright in
    test/jdk/tools/launcher/ArgFileSyntax.java
    + JDK-8241458: [JVMCI] add mark value to expose
    CodeOffsets::Frame_Complete
    + JDK-8241464: [11u] Backport: make rehashing be a needed
    guaranteed safepoint cleanup action
    + JDK-8241556: Memory leak if -XX:CompileCommand is set
    + JDK-8241568: (fs) UserPrincipalLookupService.lookupXXX
    failure with IOE "Operation not permitted"
    + JDK-8241586: compiler/cpuflags/
    /TestAESIntrinsicsOnUnsupportedConfig.java fails on aarch64
    + JDK-8241638: launcher time metrics always report 1 on Linux
    when _JAVA_LAUNCHER_DEBUG set
    + JDK-8241660: Add virtualization information output to hs_err
    file on macOS
    + JDK-8241808: [TESTBUG] The JDK-8039467 bug appeared on macOS
    + JDK-8241888: Mirror jdk.security.allowNonCaAnchor system
    property with a security one
    + JDK-8241900: Loop unswitching may cause dependence on null
    check to be lost
    + JDK-8241948: enhance list of environment variables printed in
    hs_err file
    + JDK-8241996: on linux set full relro in the linker flags
    + JDK-8242108: Performance regression after fix for JDK-8229496
    + JDK-8242141: New System Properties to configure the TLS
    signature schemes
    + JDK-8242154: Backport parts of JDK-4947890 to OpenJDK 11u
    + JDK-8242174: [macos] The NestedModelessDialogTest test make
    the macOS unstable
    + JDK-8242239: [Graal] javax/management/generified/
    /GenericTest.java fails: FAILED: queryMBeans sets same
    + JDK-8242294: JSSE Client does not throw SSLException when an
    alert occurs during handshaking
    + JDK-8242379: [TESTBUG] compiler/loopopts/
    /TestLoopUnswitchingLostCastDependency.java fails with
    release VMs
    + JDK-8242470: Update Xerces to Version 2.12.1
    + JDK-8242498: Invalid "sun.awt.TimedWindowEvent" object leads
    to JVM crash
    + JDK-8242541: Small charset issues (ISO8859-16, x-eucJP-Open,
    x-IBM834 and x-IBM949C)
    + JDK-8242626: enhance posix print_rlimit_info
    + JDK-8243059: Build fails when --with-vendor-name contains a
    comma
    + JDK-8243539: Copyright info (Year) should be updated for fix
    of 8241638
    + JDK-8243541: (tz) Upgrade time-zone data to tzdata2020a
    + JDK-8244407: JVM crashes after transformation in C2
    IdealLoopTree::split_fall_in
    + JDK-8244520: problemlist
    java/awt/font/Rotate/RotatedFontTest.java on linux
    + JDK-8244777: ClassLoaderStats VM Op uses constant hash value
    + JDK-8244853: The static build of libextnet is missing the
    JNI_OnLoad_extnet function
    + JDK-8244951: Missing entitlements for hardened runtime
    + JDK-8245047: [PPC64] C2: ReverseBytes + Load always match to
    unordered Load (acquire semantics missing)
    + JDK-8245649: Revert 8245397 backport of 8230591
    + JDK-8246031: SSLSocket.getSession() doesn't close connection
    for timeout/ interrupts
    + JDK-8246613: Choose the default SecureRandom algo based on
    registration ordering
    + JDK-8248505: Unexpected NoSuchAlgorithmException when using
    secure random impl from BCFIPS provider
- Removed patch:
  * JDK-8228407.patch
    + integrated upstream</changelog>
  <changelog author="fstrba@suse.com" date="1604318400">- Update to upstream tag jdk-11.0.9-11 (October 2020 CPU,
  bsc#1177943)
  * New features
    + JDK-8250784: Shenandoah: A Low-Pause-Time Garbage Collector
  * Security fixes
    + JDK-8233624: Enhance JNI linkage
    + JDK-8236196: Improve string pooling
    + JDK-8236862, CVE-2020-14779: Enhance support of Proxy class
    + JDK-8237990, CVE-2020-14781: Enhanced LDAP contexts
    + JDK-8237995, CVE-2020-14782: Enhance certificate processing
    + JDK-8240124: Better VM Interning
    + JDK-8241114, CVE-2020-14792: Better range handling
    + JDK-8242680, CVE-2020-14796: Improved URI Support
    + JDK-8242685, CVE-2020-14797: Better Path Validation
    + JDK-8242695, CVE-2020-14798: Enhanced buffer support
    + JDK-8243302: Advanced class supports
    + JDK-8244136, CVE-2020-14803: Improved Buffer supports
    + JDK-8244479: Further constrain certificates
    + JDK-8244955: Additional Fix for JDK-8240124
    + JDK-8245407: Enhance zoning of times
    + JDK-8245412: Better class definitions
    + JDK-8245417: Improve certificate chain handling
    + JDK-8248574: Improve jpeg processing
    + JDK-8249927: Specify limits of jdk.serialProxyInterfaceLimit
    + JDK-8253019: Enhanced JPEG decoding
  * Other changes
    + JDK-6532025: GIF reader throws misleading exception with
    truncated images
    + JDK-6949753: [TEST BUG]: java/awt/print/PageFormat/
    /PDialogTest.java needs update by removing an infinite loop
    + JDK-8022535: [TEST BUG] javax/swing/text/html/parser/
    /Test8017492.java fails
    + JDK-8062947: Fix exception message to correctly represent
    LDAP connection failure
    + JDK-8067354: com/sun/jdi/GetLocalVariables4Test.sh failed
    + JDK-8134599: TEST_BUG: java/rmi/transport/closeServerSocket/
    /CloseServerSocket.java fails intermittently with Address
    already in use
    + JDK-8151678: com/sun/jndi/ldap/LdapTimeoutTest.java failed
    due to timeout on DeadServerNoTimeoutTest is incorrect
    + JDK-8160768: Add capability to custom resolve host/domain
    names within the default JNDI LDAP provider
    + JDK-8172404: Tools should warn if weak algorithms are used
    before restricting them
    + JDK-8193367: Annotated type variable bounds crash javac
    + JDK-8202117: com/sun/jndi/ldap/RemoveNamingListenerTest.java
    fails intermittently: Connection reset
    + JDK-8203026: java.rmi.NoSuchObjectException: no such object
    in table
    + JDK-8203281: [Windows] JComboBox change in ui when
    editor.setBorder() is called
    + JDK-8203382: Rename SystemDictionary::initialize_wk_klass to
    resolve_wk_klass
    + JDK-8203393: com/sun/jdi/JdbMethodExitTest.sh and
    JdbExprTest.sh fail due to timeout
    + JDK-8203928: [Test] Convert non-JDB scaffolding
    serviceability shell script tests to java
    + JDK-8204963: javax.swing.border.TitledBorder has a memory leak
    + JDK-8204994: SA might fail to attach to process with "Windbg
    Error: WaitForEvent failed"
    + JDK-8205534: Remove SymbolTable dependency from
    serviceability agent
    + JDK-8206309: Tier1 SA tests fail
    + JDK-8208281: java/nio/channels/
    /AsynchronousSocketChannel/Basic.java timed out
    + JDK-8209109: [TEST] rewrite com/sun/jdi shell tests to java
    version - step1
    + JDK-8209332: [TEST] test/jdk/com/sun/jdi/CatchPatternTest.sh
    is incorrect
    + JDK-8209342: Problemlist SA tests on Solaris due to Error
    attaching to process: Can't create thread_db agent!
    + JDK-8209343: Test javax/swing/border/TestTitledBorderLeak.java
    should be marked as headful
    + JDK-8209517: com/sun/jdi/BreakpointWithFullGC.java fails with
    timeout
    + JDK-8209604: [TEST] rewrite com/sun/jdi shell tests to java
    version - step2
    + JDK-8209605: com/sun/jdi/BreakpointWithFullGC.java fails with
    ZGC
    + JDK-8209608: Problem list com/sun/jdi/BreakpointWithFullGC.java
    + JDK-8210131: vmTestbase/nsk/jvmti/scenarios/allocation/AP10/
    /ap10t001/TestDescription.java failed with ObjectFree:
    GetCurrentThreadCpuTimerInfo returned unexpected error code
    + JDK-8210243: [TEST] rewrite com/sun/jdi shell tests to java
    version - step3
    + JDK-8210527: JShell: NullPointerException in
    jdk.jshell.Eval.translateExceptionStack
    + JDK-8210560: [TEST] convert com/sun/jdi redefineClass-related
    tests
    + JDK-8210725: com/sun/jdi/RedefineClearBreakpoint.java fails
    with waitForPrompt timed out after 60 seconds
    + JDK-8210748: [TESTBUG] lib.jdb.Jdb.waitForPrompt() should
    clarify which output is the pending reply after a timeout
    + JDK-8210760: [TEST] rewrite com/sun/jdi shell tests to java
    version - step4
    + JDK-8210977: jdk/jfr/event/oldobject/TestThreadLocalLeak.java
    fails to find ThreadLocalObject
    + JDK-8211292: [TEST] convert com/sun/jdi/DeferredStepTest.sh
    test
    + JDK-8211694: JShell: Redeclared variable should be reset
    + JDK-8212200: assert when shared java.lang.Object is redefined
    by JVMTI agent
    + JDK-8212629: [TEST] wrong breakpoint in
    test/jdk/com/sun/jdi/DeferredStepTest
    + JDK-8212665: com/sun/jdi/DeferredStepTest.java: jj1 (line 57)
  - unexpected. lastLine=52, minLine=52, maxLine=55
    + JDK-8212807: tools/jar/multiRelease/Basic.java times out
    + JDK-8213182: Minimal VM build failure after JDK-8212200
    (assert when shared java.lang.Object is redefined by JVMTI
    agent)
    + JDK-8213214: Set -Djava.io.tmpdir= when running tests
    + JDK-8213275: ReplaceCriticalClasses.java fails with
    jdk.internal.vm.PostVMInitHook not found
    + JDK-8213574: Deadlock in string table expansion when dumping
    lots of CDS classes
    + JDK-8213703: LambdaConversionException: Invalid receiver type
    not a subtype of implementation type interface
    + JDK-8214074: Ghash optimization using AVX instructions
    + JDK-8214491: Upgrade to JLine 3.9.0
    + JDK-8214797: TestJmapCoreMetaspace.java timed out
    + JDK-8215243: JShell tests failing intermitently with
    "Problem cleaning up the following threads:"
    + JDK-8215244: jdk/jshell/ToolBasicTest.java
    testHistoryReference failed
    + JDK-8215354: x86_32 build failures after JDK-8214074 (Ghash
    optimization using AVX instructions)
    + JDK-8215438: jshell tool: Ctrl-D causes EOF
    + JDK-8216021: RunTest.gmk might set concurrency level to 1 on
    Windows
    + JDK-8216974: HttpConnection not returned to the pool after
    204 response
    + JDK-8218948: SimpleDateFormat :: format - Zone Names are not
    reflected correctly during run time
    + JDK-8219712: code_size2 (defined in stub_routines_x86.hpp) is
    too small on new Skylake CPUs
    + JDK-8220150: macos10.14 Mojave returns anti-aliased glyphs
    instead of aliased B&amp;W glyphs
    + JDK-8221658: aarch64: add necessary predicate for ubfx
    patterns
    + JDK-8221759: Crash when completing "java.io.File.path"
    + JDK-8221918: runtime/SharedArchiveFile/serviceability/
    /ReplaceCriticalClasses.java fails: Shared archive not found
    + JDK-8222074: Enhance auto vectorization for x86
    + JDK-8222079: Don't use memset to initialize fields decode_env
    constructor in disassembler.cpp
    + JDK-8222769: [TESTBUG] TestJFRNetworkEvents should not rely
    on hostname command
    + JDK-8223688: JShell: crash on the instantiation of raw
    anonymous class
    + JDK-8223777: In posix_spawn mode, failing to exec()
    jspawnhelper does not result in an error
    + JDK-8223940: Private key not supported by chosen signature
    algorithm
    + JDK-8224184: jshell got IOException at exiting with AIX
    + JDK-8224234: compiler/codegen/TestCharVect2.java fails in
    test_mulc
    + JDK-8225037: java.net.JarURLConnection::getJarEntry() throws
    NullPointerException
    + JDK-8225625: AES Electronic Codebook (ECB) encryption and
    decryption optimization using AVX512 + VAES instructions
    + JDK-8226536: Catch OOM from deopt that fails rematerializing
    objects
    + JDK-8226575: OperatingSystemMXBean should be made container
    aware
    + JDK-8226697: Several tests which need the @key headful
    keyword are missing it.
    + JDK-8226809: Circular reference in printed stack trace is not
    correctly indented &amp; ambiguous
    + JDK-8227059: sun/security/tools/keytool/
    /DefaultSignatureAlgorithm.java timed out
    + JDK-8227269: Slow class loading when running with JDWP
    + JDK-8227595: keytool/fakegen/DefaultSignatureAlgorithm.java
    fails due to "exitValue = 6"
    + JDK-8228448: Jconsole can't connect to itself
    + JDK-8228967: Trust/Key store and SSL context utilities for
    tests
    + JDK-8229378: jdwp library loader in linker_md.c quietly
    truncates on buffer overflow
    + JDK-8229815: Upgrade Jline to 3.12.1
    + JDK-8230000: some httpclients testng tests run zero test
    + JDK-8230002: javax/xml/jaxp/unittest/transform/
    /SecureProcessingTest.java runs zero test
    + JDK-8230010: Remove jdk8037819/BasicTest1.java
    + JDK-8230094: CCE in createXMLEventWriter(Result) over an
    arbitrary XMLStreamWriter
    + JDK-8230402: Allocation of compile task fails with assert:
    "Leaking compilation tasks?"
    + JDK-8230767: FlightRecorderListener returns null recording
    + JDK-8230870: (zipfs) Add a ZIP FS test that is similar to
    test/jdk/java/util/zip/EntryCount64k.java
    + JDK-8231209: [REDO] ThreadMXBean::getThreadAllocatedBytes()
    can be quicker for self thread
    + JDK-8231586: enlarge encoding space for OopMapValue offsets
    + JDK-8231953: Wrong assumption in assertion in
    oop::register_oop
    + JDK-8231968: getCurrentThreadAllocatedBytes default
    implementation s/b getThreadAllocatedBytes
    + JDK-8232083: Minimal VM is broken after JDK-8231586
    + JDK-8232161: Align some one-way conversion in MS950 charset
    with Windows
    + JDK-8232855: jshell missing word in /help help
    + JDK-8233027: OopMapSet::all_do does oms.next() twice during
    iteration
    + JDK-8233228: Disable weak named curves by default in TLS,
    CertPath, and Signed JAR
    + JDK-8233386: Initialize NULL fields for unused decorations
    + JDK-8233452: java.math.BigDecimal.sqrt() with
    RoundingMode.FLOOR results in incorrect result
    + JDK-8233686: XML transformer uses excessive amount of memory
    + JDK-8233741: AES Countermode (AES-CTR) optimization using
    AVX512 + VAES instructions
    + JDK-8233829: javac cannot find non-ASCII module name under
    non-UTF8 environment
    + JDK-8233958: Memory retention due to HttpsURLConnection
    finalizer that serves no purpose
    + JDK-8234011: (zipfs) Memory leak in
    ZipFileSystem.releaseDeflater()
    + JDK-8234058: runtime/CompressedOops/
    /CompressedClassPointers.java fails with 'Narrow klass base:
    0x0000000000000000' missing from stdout/stderr
    + JDK-8234149: Several regression tests do not dispose Frame at
    end
    + JDK-8234347: "Turkey" meta time zone does not generate
    composed localized names
    + JDK-8234385: [TESTBUG] java/awt/EventQueue/6980209/
    /bug6980209.java fails in linux nightly
    + JDK-8234535: Cross compilation fails due to missing CFLAGS
    for the BUILD_CC
    + JDK-8234541: C1 emits an empty message when it inlines
    successfully
    + JDK-8234687: change javap reporting on unknown attributes
    + JDK-8236464: SO_LINGER option is ignored by SSLSocket in JDK
    11
    + JDK-8236548: Localized time zone name inconsistency between
    English and other locales
    + JDK-8236617: jtreg test containers/docker/
    /TestMemoryAwareness.java fails after 8226575
    + JDK-8237182: Update copyright header for shenandoah and
    epsilon files
    + JDK-8237888: security/infra/java/security/cert/
    /CertPathValidator/certification/LuxTrustCA.java fails when
    checking validity interval
    + JDK-8237977: Further update
    javax/net/ssl/compatibility/Compatibility.java
    + JDK-8238270: java.net HTTP/2 client does not decrease stream
    count when receives 204 response
    + JDK-8238284: [macos] Zero VM build fails due to an obvious
    typo
    + JDK-8238380: java.base/unix/native/libjava/childproc.c
    "multiple definition" link errors with GCC10
    + JDK-8238386: (sctp) jdk.sctp/unix/native/libsctp/SctpNet.c
    "multiple definition" link errors with GCC10
    + JDK-8238388: libj2gss/NativeFunc.o "multiple definition" link
    errors with GCC10
    + JDK-8238448: RSASSA-PSS signature verification fail when
    using certain odd key sizes
    + JDK-8238710: LingeredApp doesn't log stdout/stderr if exits
    with non-zero code
    + JDK-8239083: C1 assert(known_holder == NULL ||
    (known_holder-&gt;is_instance_klass() &amp;&amp;
    (!known_holder-&gt;is_interface() ||
    ((ciInstanceKlass*)known_holder)-&gt;has_nonstatic_concrete_methods())),
    "should be non-static concrete method");
    + JDK-8239385: KerberosTicket client name refers wrongly to
    sAMAccountName in AD
    + JDK-8240169: javadoc fails to link to non-modular api docs
    + JDK-8240295: hs_err elapsed time in seconds is not accurate
    enough
    + JDK-8240360: NativeLibraryEvent has wrong library name on
    Linux
    + JDK-8240676: Meet not symmetric failure when running lucene
    on jdk8
    + JDK-8241007: Shenandoah: remove
    ShenandoahCriticalControlThreadPriority support
    + JDK-8241065: Shenandoah: remove leftover code after
    JDK-8231086
    + JDK-8241086: Test runtime/NMT/HugeArenaTracking.java is
    failing on 32bit Windows
    + JDK-8241130: com.sun.jndi.ldap.EventSupport.removeDeadNotifier:
    java.lang.NullPointerException
    + JDK-8241138: http.nonProxyHosts=* causes
    StringIndexOutOfBoundsException in DefaultProxySelector
    + JDK-8241319: WB_GetCodeBlob doesn't have ResourceMark
    + JDK-8241478: vmTestbase/gc/gctests/Steal/steal001/steal001.java
    fails with OOME
    + JDK-8241574: Shenandoah: remove ShenandoahAssertToSpaceClosure
    + JDK-8241750: x86_32 build failure after JDK-8227269
    + JDK-8242184: CRL generation error with RSASSA-PSS
    + JDK-8242283: Can't start JVM when java home path includes
    non-ASCII character
    + JDK-8242556: Cannot load RSASSA-PSS public key with non-null
    params from byte array
    + JDK-8243029: Rewrite javax/net/ssl/compatibility/
    /Compatibility.java with a flexible interop test framework
    + JDK-8243138: Enhance BaseLdapServer to support starttls
    extended request
    + JDK-8243320: Add SSL root certificates to Oracle Root CA
    program
    + JDK-8243321: Add Entrust root CA - G4 to Oracle Root CA
    program
    + JDK-8243389: enhance os::pd_print_cpu_info on linux
    + JDK-8243453: java --describe-module failed with non-ASCII
    module name under non-UTF8 environment
    + JDK-8243470: [macos] bring back O2 opt level for unsafe.cpp
    + JDK-8243489: Thread CPU Load event may contain wrong data for
    CPU time under certain conditions
    + JDK-8243925: Toolkit#getScreenInsets() returns wrong value on
    HiDPI screens (Windows)
    + JDK-8244087: 2020-04-24 public suffix list update
    + JDK-8244151: Update MUSCLE PC/SC-Lite headers to the latest
    release 1.8.26
    + JDK-8244164: AArch64: jaotc generates incorrect code for
    compressed OOPs with non-zero heap base
    + JDK-8244196: adjust output in os_linux
    + JDK-8244225: stringop-overflow warning on strncpy call from
    compile_the_world_in
    + JDK-8244287: JFR: Methods samples have line number 0
    + JDK-8244703: "platform encoding not initialized" exceptions
    with debugger, JNI
    + JDK-8244719: CTW: C2 compilation fails with
    "assert(!VerifyHashTableKeys || _hash_lock == 0) failed:
    remove node from hash table before modifying it"
    + JDK-8244729: Shenandoah: remove resolve paths from
    SBSA::generate_shenandoah_lrb
    + JDK-8244763: Update --release 8 symbol information after JSR
    337 MR3
    + JDK-8244818: Java2D Queue Flusher crash while moving
    application window to external monitor
    + JDK-8245151: jarsigner should not raise duplicate warnings on
    verification
    + JDK-8245616: Bump update version for OpenJDK: jdk-11.0.9
    + JDK-8245714: "Bad graph detected in build_loop_late" when
    loads are pinned on loop limit check uncommon branch
    + JDK-8245801: StressRecompilation triggers assert "redundunt
    OSR recompilation detected. memory leak in CodeCache!"
    + JDK-8245832: JDK build make-static-libs should build all JDK
    libraries
    + JDK-8245880: Shenandoah: check class unloading flag early in
    concurrent code root scan
    + JDK-8245981: Upgrade to jQuery 3.5.1
    + JDK-8246027: Minimal fastdebug build broken after JDK-8245801
    + JDK-8246094: [macos] Sound Recording and playback is not
    working
    + JDK-8246153: TestEliminateArrayCopy fails with
  - XX:+StressReflectiveCode
    + JDK-8246193: Possible NPE in ENC-PA-REP search in AS-REQ
    + JDK-8246196: javax/management/MBeanServer/OldMBeanServerTest
    fails with AssertionError
    + JDK-8246203: Segmentation fault in verification due to stack
    overflow with -XX:+VerifyIterativeGVN
    + JDK-8246330: Add TLS Tests for Legacy ECDSA curves
    + JDK-8246453: TestClone crashes with "all collected exceptions
    must come from the same place"
    + JDK-8247246: Add explicit ResolvedJavaType.link and expose
    presence of default methods
    + JDK-8247350: [aarch64] assert(false) failed: wrong size of
    mach node
    + JDK-8247502: PhaseStringOpts crashes while optimising
    effectively dead code
    + JDK-8247615: Initialize the bytes left for the heap sampler
    + JDK-8247824: CTW: C2 (Shenandoah) compilation fails with SEGV
    in SBC2Support::pin_and_expand
    + JDK-8247874: Replacement in VersionProps.java.template not
    working when --with-vendor-bug-url contains '&amp;'
    + JDK-8247979: aarch64: missing side effect of killing flags
    for clearArray_reg_reg
    + JDK-8248214: Add paddings for TaskQueueSuper to reduce
    false-sharing cache contention
    + JDK-8248219: aarch64: missing memory barrier in
    fast_storefield and fast_accessfield
    + JDK-8248348: Regression caused by the update to BCEL 6.0
    + JDK-8248385: [testbug][11u] Adapt TestInitiExceptions to
    jtreg 5.1
    + JDK-8248495: [macos] zerovm is broken due to libffi headers
    location
    + JDK-8248851: CMS: Missing memory fences between free chunk
    check and klass read
    + JDK-8248987: AOT's Linker.java seems to eagerly fail-fast on
    Windows
    + JDK-8249159: Downport test rework for SSLSocketTemplate from
    8224650
    + JDK-8249215: JFrame::setVisible crashed with
  - Dfile.encoding=UTF-8 on Japanese Windows.
    + JDK-8249251: [dark_mode ubuntu 20.04] The selected menu is
    not highlighted in GTKLookAndFeel
    + JDK-8249255: Build fails if source code in cygwin home dir
    + JDK-8249277: TestVerifyIterativeGVN.java is failing with
    timeout in OpenJDK 11
    + JDK-8249278: Revert JDK-8226253 which breaks the spec of
    AccessibleState.SHOWING for JList
    + JDK-8249560: Shenandoah: Fix racy GC request handling
    + JDK-8249801: Shenandoah: Clear soft-refs on requested GC cycle
    + JDK-8249953: Shenandoah: gc/shenandoah/mxbeans tests should
    account for corner cases
    + JDK-8250582: Revert Principal Name type to NT-UNKNOWN when
    requesting TGS Kerberos tickets
    + JDK-8250609: C2 crash in IfNode::fold_compares
    + JDK-8250627: Use -XX:+/-UseContainerSupport for
    enabling/disabling Java container metrics
    + JDK-8250755: Better cleanup for
    jdk/test/javax/imageio/plugins/shared/CanWriteSequence.java
    + JDK-8250787: Provider.put no longer registering aliases in
    FIPS env
    + JDK-8250826: jhsdb does not work with coredump which comes
    from Substrate VM
    + JDK-8250827: Shenandoah: needs to reset/finish StringTable's
    dead count before/after parallel walk
    + JDK-8250844: Make sure {type,obj}ArrayOopDesc accessors check
    the bounds
    + JDK-8251117: Cannot check P11Key size in P11Cipher and
    P11AEADCipher
    + JDK-8251354: Shenandoah: Fix jdk/jfr/tool/TestPrintJSON.java
    test failure
    + JDK-8251451: Shenandoah: Remark ObjectSynchronizer roots with
    I-U
    + JDK-8251469: Better cleanup for
    test/jdk/javax/imageio/SetOutput.java
    + JDK-8251487: Shenandoah: missing detail timing tracking for
    final mark cleaning phase
    + JDK-8252120: compiler/oracle/TestCompileCommand.java
    misspells "occured"
    + JDK-8252157: JDK-8231209 11u backport breaks jmm binary
    compatibility
    + JDK-8252258: [11u] JDK-8242154 changes the default vendor
    + JDK-8252804: [test] Fix 'ReleaseDeflater.java' test after
    downport of 8234011
    + JDK-8253134: JMM_VERSION should remain at 0x20020000 (JDK 10)
    in JDK 11
    + JDK-8253283: [11u] Test build/translations/
    /VerifyTranslations.java failing after JDK-8252258
    + JDK-8253813: Backout JDK-8244287 from 11u: it causes several
    crashes
- Removed patch:
  * gcc-fno-common-fix.patch
    + not needed any more with this version
- Added patch:
  * JDK-8250861.patch
    + Fix regression "8250861: Crash in MinINode::Ideal(PhaseGVN*,
    bool)" introduced in jdk 11.0.9</changelog>
  <changelog author="fstrba@suse.com" date="1604491200">- Enable Sheandoah GC for x86_64 (jsc#ECO-3171)</changelog>
  <changelog author="fstrba@suse.com" date="1605528000">- Update to upstream tag jdk-11.0.9.1-1
  * Fix:
    + JDK-8250861: Crash in MinINode::Ideal(PhaseGVN*, bool)
- Removed patch:
  * JDK-8250861.patch
    + Integrated upstream</changelog>
  <changelog author="fstrba@suse.com" date="1611230400">- Update to upstream tag jdk-11.0.10+9 (January 2021 CPU,
  bsc#1181239)
  * Security fixes
    + JDK-8247619: Improve Direct Buffering of Characters
  * Other changes
    + JDK-6722928: Support SSPI as a native GSS-API provider
    + JDK-7185258: [macosx] Deadlock in SunToolKit.realSync()
    + JDK-8152332: [macosx] JFileChooser cannot be serialized on
    Mac OS X
    + JDK-8161684: [testconf] Add VerifyOops' testing into compiler
    tiers
    + JDK-8171279: Support X25519 and X448 in TLS
    + JDK-8173361: various crashes in
    JvmtiExport::post_compiled_method_load
    + JDK-8173658: JvmtiExport::post_class_unload() is broken for
    non-JavaThread initiators
    + JDK-8191006: hsdis disassembler plugin does not compile with
    binutils 2.29+
    + JDK-8197981: Missing return statement in
    __sync_val_compare_and_swap_8
    + JDK-8198334: java/awt/FileDialog/8003399/bug8003399.java
    fails in headless mode
    + JDK-8200151: Add 8 JNDI tests to com/sun/jndi/dns/ConfigTests/
    + JDK-8208279: Add 8 JNDI tests to com/sun/jndi/dns/EnvTests/
    + JDK-8208483: Add 5 JNDI tests to
    com/sun/jndi/dns/FactoryTests/
    + JDK-8208542: Add 4 JNDI tests to com/sun/jndi/dns/ListTests/
    + JDK-8208665: Amend cross-compilation docs with
    qemu-debootstrap recipe
    + JDK-8210088: ProblemList gc/epsilon/TestMemoryMXBeans.java
    + JDK-8210339: Add 10 JNDI tests to com/sun/jndi/dns/FedTests/
    + JDK-8211450: UndetVar::dup is not copying the kind field to
    the duplicated instance
    + JDK-8212160: JVMTI agent crashes with "assert(_value != 0LL)
    failed: resolving NULL _value"
    + JDK-8212226: SurfaceManager throws "Invalid Image variant"
    for MultiResolutionImage (Windows)
    + JDK-8213400: Support choosing group name in keytool keypair
    generation
    + JDK-8213535: Windows HiDPI html lightweight tooltips are
    truncated
    + JDK-8213698: Improve devkit creation and add support for
    linux/ppc64/ppc64le/s390x
    + JDK-8214025: assert(t-&gt;singleton()) failed: must be a
    constant when ScavengeRootsInCode &lt; 2
    + JDK-8214242: compiler/arguments/TestScavengeRootsInCode.java
    fails because of missing UnlockDiagnosticVMOptions
    + JDK-8214787: Zero builds fail with "undefined
    JavaThread::thread_state()"
    + JDK-8215583: Exclude
    runtime/handshake/HandshakeWalkSuspendExitTest.java
    + JDK-8216012: Infinite loop in RSA KeyPairGenerator
    + JDK-8216324: GetClassMethods is confused by the presence of
    default methods in super interfaces
    + JDK-8217429: WebSocket over authenticating proxy fails to
    send Upgrade headers
    + JDK-8217976: test/jdk/java/net/httpclient/websocket/
    /WebSocketProxyTest.java fails intermittently
    + JDK-8218021: Have jarsigner preserve posix permission
    attributes
    + JDK-8218287: jshell tool: input behavior unstable after
    12-ea+24 on Windows
    + JDK-8218851: JVM crash in custom classloader stress test, JDK
    12 &amp; 13
    + JDK-8220420: Cleanup c1_LinearScan
    + JDK-8222072: JVMTI GenerateEvents() sends CompiledMethodLoad
    events to wrong jvmtiEnv
    + JDK-8222286: Fix for JDK-8213419 is broken on s390
    + JDK-8222527: HttpClient doesn't send HOST header when
    tunelling HTTP/1.1 through http proxy
    + JDK-8222533: jtreg test jdk/internal/platform/cgroup/
    /TestCgroupMetrics.java fails on SLES12.3 linux ppc64le
    machine
    + JDK-8224506: [TESTBUG] TestDockerMemoryMetrics.java fails
    with exitValue = 137
    + JDK-8224555: vmTestbase/nsk/jvmti/scenarios/contention/TC02/
    /tc02t001/TestDescription.java failed
    + JDK-8224650: Add tests to support X25519 and X448 in TLS
    + JDK-8225072: Add LuxTrust certificate that is expiring in
    March 2021 to list of allowed but expired certs
    + JDK-8225329: -XX:+PrintBiasedLockingStatistics causes crash
    during initialization on Windows platforms
    + JDK-8225687: Newly added sspi.cpp in JDK-6722928 still
    contains some small errors
    + JDK-8227006: [linux] Runtime.availableProcessors execution
    time increased by factor of 100
    + JDK-8227275: Within native OOM error handling, assertions may
    hang the process
    + JDK-8227647: [Graal] Test8009761.java fails due to
    "RuntimeException: static java.lang.Object
    compiler.uncommontrap.Test8009761.m3(boolean,boolean) not
    compiled"
    + JDK-8229495: SIGILL in C2 generated OSR compilation
    + JDK-8230910: libsspi_bridge does not build on Windows 32bit
    + JDK-8232114: JVM crashed at imjpapi.dll in native code
    + JDK-8234147: Avoid looking up standard charsets in core
    libraries
    + JDK-8234393: [macos] printing ignores printer tray
    + JDK-8234863: Increase default value of MaxInlineLevel
    + JDK-8235218: Minimal VM is broken after JDK-8173361
    + JDK-8235456: Minimal VM is broken after JDK-8212160
    + JDK-8235829: graal crashes with Zombie.java test
    + JDK-8236124: Minimal VM slowdebug build failed after
    JDK-8212160
    + JDK-8236512: PKCS11 Connection closed after Cipher.doFinal
    and NoPadding
    + JDK-8236944: The legVecZ operand should be limited to
    zmm0-zmm15 registers
    + JDK-8237186: Fix typo in copyright header of
    java/io/Reader/TransferTo.java
    + JDK-8237499: JFR: Include stack trace in the ThreadStart event
    + JDK-8237512: AArch64: aarch64TestHook leaks a BufferBlob
    + JDK-8237524: AArch64: String.compareTo() may return incorrect
    result
    + JDK-8237950: C2 compilation fails with "Live Node limit
    exceeded limit" during ConvI2L::Ideal optimization
    + JDK-8238579: HttpsURLConnection drops the timeout and hangs
    forever in read
    + JDK-8239105: Add exception for expiring Digicert root
    certificates to VerifyCACerts test
    + JDK-8239477: jdk/jfr/jcmd/TestJcmdStartStopDefault.java fails
  - XX:+VerifyOops with "verify_oop: rsi: broken oop"
    + JDK-8239497: SEGV in EdgeUtils::field_name_symbol(Edge const&amp;)
    + JDK-8239886: Minimal VM build fails after JDK-8237499
    + JDK-8240633: Memory leaks in the implementations of
    FileChooserUI
    + JDK-8240690: Race condition between EDT and
    BasicDirectoryModel.FilesLoader.run0()
    + JDK-8241234: Unify monitor enter/exit runtime entries.
    + JDK-8241311: Move some charset mapping tests from closed to
    open
    + JDK-8241797: Add some tests to the problem list
    + JDK-8242029: AArch64: skip G1 array copy pre-barrier if
    marking not active
    + JDK-8242335: Additional Tests for RSASSA-PSS
    + JDK-8242480: Negative value may be returned by
    getFreeSwapSpaceSize() in the docker
    + JDK-8242614: cleanup duplicated test ldap server in some
    com/sun/jndi/ldap/ tests
    + JDK-8242846: Bring back test/jdk/tools/jlink/plugins/
    /OrderResourcesPluginTest.java
    + JDK-8243114: Implement montgomery{Multiply,Square}intrinsics
    on Windows
    + JDK-8243290: Improve diagnostic messages for class
    verification and redefinition failures
    + JDK-8243488: Add tests for set/get SendBufferSize and
    getReceiveBufferSize in DatagramSocket
    + JDK-8243549: sun/security/ssl/CipherSuite/
    /NamedGroupsWithCipherSuite.java failed with Unsupported
    signature algorithm: DSA
    + JDK-8243617: compiler/onSpinWait/TestOnSpinWaitC1.java test
    uses wrong class
    + JDK-8243619: compiler/codecache/CheckSegmentedCodeCache.java
    test misses -version
    + JDK-8244142: some hotspot/runtime tests don't check exit code
    of forked JVM
    + JDK-8244278: Excessive code cache flushes and sweeps
    + JDK-8244282: test/hotspot/jtreg/compiler/intrinsics/
    /Test8237524.java fails with --illegal-access=deny
    + JDK-8244621: [macos10.15] Garbled FX printing plus CoreText
    warnings on Catalina when building with Xcode 11
    + JDK-8244819: hsdis does not compile with binutils 2.34+
    + JDK-8245051: c1 is broken if it is compiled by gcc without
  - fno-lifetime-dse
    + JDK-8245168: jlink should not be treated as a "small" tool
    + JDK-8245400: Upgrade to LittleCMS 2.11
    + JDK-8246381: VM crashes with "Current BasicObjectLock* below
    than low_mark"
    + JDK-8246434: Threads::print_on_error assumes that the heap
    has been set up
    + JDK-8246648: issue with OperatingSystemImpl
    getFreeSwapSpaceSize in docker after 8242480
    + JDK-8247201: Print potential pointer value of readable stack
    memory in hs_err file
    + JDK-8247763: assert(outer-&gt;outcnt() == 2) failed: 'only phis'
    failure in LoopNode::verify_strip_mined()
    + JDK-8247867: Upgrade to freetype 2.10.2
    + JDK-8248190: Enable Power10 system and implement new
    byte-reverse instructions
    + JDK-8248226: TestCloneAccessStressGCM fails with
  - XX:-ReduceBulkZeroing
    + JDK-8248347: windows build broken by JDK-8243114
    + JDK-8248532: Every time I change keyboard language at my
    MacBook, Java crashes
    + JDK-8248552: C2 crashes with SIGFPE due to division by zero
    + JDK-8248596: [TESTBUG] compiler/loopopts/
    /PartialPeelingUnswitch.java times out with Graal enabled
    + JDK-8248745: Add jarsigner and keytool tests for restricted
    algorithms
    + JDK-8248791: sun/util/resources/cldr/TimeZoneNamesTest.java
    fails with -XX:-ReduceInitialCardMarks -XX:-ReduceBulkZeroing
    + JDK-8248845: AArch64: stack corruption after spilling vector
    register
    + JDK-8249176: Update GlobalSignR6CA test certificates
    + JDK-8249183: JVM crash in "AwtFrame::WmSize" method
    + JDK-8249192: MonitorInfo stores raw oops across safepoints
    + JDK-8249602: C2: assert(cnt == _outcnt) failed: no insertions
    allowed
    + JDK-8249603: C1: assert(has_error == false) failed: register
    allocation invalid
    + JDK-8249605: C2: assert(no_dead_loop) failed: dead loop
    detected
    + JDK-8249607: C2: assert(!had_error) failed: bad dominance
    + JDK-8249608: Vector register used by C2 compiled method
    corrupted at safepoint
    + JDK-8249672: Include microcode revision in features_string on
    x86
    + JDK-8249748: gtest silently ignores bad jvm arguments
    + JDK-8249821: Separate libharfbuzz from libfontmanager
    + JDK-8250598: Hyper-V is detected in spite of running on host
    OS
    + JDK-8250605: Linux x86_32 builds fail after JDK-8249821
    + JDK-8250636: iso8601_time returns incorrect offset part on
    MacOS
    + JDK-8250665: Wrong translation for the month name of May in
    ar_JO,LB,SY
    + JDK-8250772: Test com/sun/jndi/ldap/
    /NamingExceptionMessageTest.java fails intermittently with
    javax.naming.ServiceUnavailableException
    + JDK-8250825: C2 crashes with assert(field != __null) failed:
    missing field
    + JDK-8250894: Provide a configure option to build and run
    against the platform libharfbuzz
    + JDK-8250928: JFR: Improve hash algorithm for stack traces
    + JDK-8250968: Symlinks attributes not preserved when using
    jarsigner on zip files
    + JDK-8250984: Memory Docker tests fail on some Linux kernels
    w/o cgroupv1 swap limit capabilities
    + JDK-8251118: BiasedLocking::preserve_marks should not have a
    HandleMark
    + JDK-8251189: com/sun/jndi/ldap/LdapDnsProviderTest.java
    failed due to timeout
    + JDK-8251257: NMT: jcmd VM.native_memory scale=1 crashes
    target VM
    + JDK-8251365: Build failure on AIX after 8250636
    + JDK-8251397: NPE on ClassValue.ClassValueMap.cacheArray
    + JDK-8251456: [TESTBUG] compiler/vectorization/
    /TestVectorsNotSavedAtSafepoint.java failed OutOfMemoryError
    + JDK-8251458: Parse::do_lookupswitch fails with "assert(_cnt
    &gt;= 0) failed"
    + JDK-8251535: Partial peeling at unsigned test adds incorrect
    loop exit check
    + JDK-8251949: ZGC: Set explicit heap size for
    compiler/gcbarriers tests
    + JDK-8252090: JFR: StreamWriterHost::write_unbuffered() stucks
    in an infinite loop OpenJDK (build 13.0.1+9)
    + JDK-8252415: Bump update version for OpenJDK: jdk-11.0.10
    + JDK-8252470: java/awt/dnd/DisposeFrameOnDragCrash/
    /DisposeFrameOnDragTest.java fails on Windows
    + JDK-8252497: Incorrect numeric currency code for ROL
    + JDK-8252660: Shenandoah: support manageable SoftMaxHeapSize
    option
    + JDK-8252679: Two windows specific FileDIalog tests may fail
    on some Windows_Server_2016_Standard
    + JDK-8252696: Loop unswitching may cause out of bound array
    load to be executed
    + JDK-8252754: Hash code calculation of JfrStackTrace is
    inconsistent
    + JDK-8253219: Epsilon: clean up unnecessary includes
    + JDK-8253224: Shenandoah: ShenandoahStrDedupQueue destructor
    calls virtual num_queues()
    + JDK-8253226: Shenandoah: remove unimplemented
    ShenandoahStrDedupQueue::verify
    + JDK-8253269: The CheckCommonColors test should provide more
    info on failure
    + JDK-8253284: Zero OrderAccess barrier mappings are incorrect
    + JDK-8253375: OSX build fails with Xcode 12.0 (12A7209)
    + JDK-8253778: ShenandoahSafepoint::is_at_shenandoah_safepoint
    should not access VMThread state from other threads
    + JDK-8253791: Issue with useAppleColor check in CSystemColors.m
    + JDK-8254016: Test8237524 fails with -XX:-CompactStrings option
    + JDK-8254081: java/security/cert/PolicyNode/
    /GetPolicyQualifiers.java fails due to an expired certificate
    + JDK-8254144: Non-x86 Zero builds fail with return-type
    warning in os_linux_zero.cpp
    + JDK-8254166: Zero: return-type warning in
    zeroInterpreter_zero.cpp
    + JDK-8254177: (tz) Upgrade time-zone data to tzdata2020b
    + JDK-8254185: Fix Code cache sweeper heuristics for JDK 11
    + JDK-8254190: [s390] interpreter misses exception check after
    calling monitorenter
    + JDK-8254790: SIGSEGV in string_indexof_char and
    stringL_indexof_char intrinsics
    + JDK-8254854: [cgroups v1] Metric limits not properly detected
    on some join controller combinations
    + JDK-8254982: (tz) Upgrade time-zone data to tzdata2020c
    + JDK-8255050: Add pkcs11/KeyStore/ClientAuth.sh to Problem list
    + JDK-8255065: Zero: accessor_entry misses the IRIW case
    + JDK-8255226: (tz) Upgrade time-zone data to tzdata2020d
    + JDK-8255269: Unsigned overflow in g1Policy.cpp
    + JDK-8255365: Problem list failing client manual tests
    + JDK-8255457: Shenandoah: cleanup ShenandoahMarkTask
    + JDK-8255466: C2 crashes at ciObject::get_oop() const+0x0
    + JDK-8255550: x86: Assembler::cmpq(Address dst, Register src)
    encoding is incorrect
    + JDK-8255603: Memory/Performance regression after JDK-8210985
    + JDK-8255760: Shenandoah: match constants style in
    ShenandoahMarkTask fallback
    + JDK-8255781: Bump patch update version for OpenJDK:
    jdk-11.0.9.1
    + JDK-8255937: Better cleanup for
    test/jdk/javax/imageio/stream/StreamFlush.java
    + JDK-8256427: Test com/sun/jndi/dns/ConfigTests/
    /PortUnreachable.java does not work on AIX
    + JDK-8256452: Integrate missing part of JDK-8232370 to 11u
    + JDK-8256483: [TESTBUG] serviceability/jvmti/GetClassMethods/
    /libOverpassMethods.c fails to compile on gcc 4.4.x
    + JDK-8256557: libharfbuzz fails to link on gcc 4.4.x due to
  - Wl,-z,defs
    + JDK-8256618: Zero: Linux x86_32 build still fails
    + JDK-8256736: Zero: GTest tests fail with "unsuppported vm
    variant"
    + JDK-8256809: Annotation processing causes NPE during flow
    analysis
    + JDK-8257181: s390x builds are very noisy with gc-sections
    messages
    + JDK-8257242: [macOS] Java app crashes while switching input
    methods
    + JDK-8257545: SunJSSE FIPS regression in key exchange after
    JDK-8171279 11u backport
    + JDK-8257641: Shenandoah: Query is_at_shenandoah_safepoint()
    from control thread should return false
    + JDK-8257701: Shenandoah: objArrayKlass metadata is not marked
    with chunked arrays
    + JDK-8258630: Add expiry exception for QuoVadis root
    certificate
- New upstream dependency on libharfbuzz
- Regenerated patches: missing-return.patch system-pcsclite.patch</changelog>
  <changelog author="fstrba@suse.com" date="1616155200">- Added patches:
  * system-crypto-policy.patch
    + Let OpenJDK use system crypto policies unless explicitely told
    not to
  * nss-security-provider.patch
    + Add the NSS security provider with configuration in generated
    nss.cfg file
  * keytool-default-rsa.patch
    + Make keytool generate RSA keys by default, since only the
    LEGACY system crypto policy allows DSA</changelog>
  <changelog author="pujos.michael@gmail.com" date="1618488000">- moved mozilla-nss dependency to java-11-openjdk-headless package
  This is necessary to be able to do crypto with just
  java-11-openjdk-headless installed. Fixes boo#1184606</changelog>
  <changelog author="fstrba@suse.com" date="1619006400">- Update to upstream tag jdk-11.0.11+9 (April 2021, CPU)
  * Security fixes
    + JDK-8244473: Contextualize registration for JNDI
    + JDK-8244543: Enhanced handling of abstract classes
    + JDK-8249906, CVE-2021-2163, bsc#1185055: Enhance opening JARs
    + JDK-8250568, CVE-2021-2161, bsc#1185056: Less ambiguous
    processing
    + JDK-8253799: Make lists of normal filenames
    + JDK-8257001: Improve Http Client Support
  * Other changes
    + JDK-7107012: sun.jvm.hotspot.code.CompressedReadStream
    readDouble() conversion to long mishandled
    + JDK-7146776: deadlock between URLStreamHandler.getHostAddress
    and file.Handler.openconnection
    + JDK-8086003: Test fails on OSX with java.lang.RuntimeException
    'Narrow klass base: 0x0000000000000000, Narrow klass shift: 3'
    missing
    + JDK-8168869: jdeps: localized messages don't use proper line
    breaks
    + JDK-8180837: SunPKCS11-NSS tests failing with
    CKR_ATTRIBUTE_READ_ONLY and CKR_MECHANISM_PARAM_INVALID
    + JDK-8202343: Disable TLS 1.0 and 1.1
    + JDK-8205992: jhsdb cannot attach to Java processes running in
    Docker containers
    + JDK-8209193: Fix aarch64-linux compilation after -Wreorder
    changes
    + JDK-8210413: AArch64: Optimize div/rem by constant in C1
    + JDK-8210578: AArch64: Invalid encoding for fmlsvs instruction
    + JDK-8211051: jdeps usage of --dot-output doesn't provide
    valid output for modular jar
    + JDK-8211057: Gensrc step CompileProperties generates unstable
    CompilerProperties output
    + JDK-8211150: G1 Full GC not purging code root memory and
    hence causing memory leak
    + JDK-8211825: ModuleLayer.defineModulesWithXXX does not setup
    delegation when module reads automatic module
    + JDK-8212043: Add floating-point Math.min/max intrinsics
    + JDK-8212218: [TESTBUG] runtime/ErrorHandling/
    /TestHeapDumpOnOutOfMemoryErrorInMetaspace.java timed out
    + JDK-8213116: javax/swing/JComboBox/WindowsComboBoxSize/
    /WindowsComboBoxSizeTest.java fails in Windows
    + JDK-8213909: jdeps --print-module-deps should report missing
    dependences
    + JDK-8214180: Need better granularity for sleeping
    + JDK-8214223: tools/jdeps/listdeps/ListModuleDeps.java failed
    due to missing Lib2 file
    + JDK-8214230: Classes generated by SystemModulesPlugin.java
    are not reproducable
    + JDK-8214741: docs/index.html has no title or copyright
    + JDK-8215687: [Graal] unit test CheckGraalIntrinsics failed
    after 8212043
    + JDK-8217848: [Graal] vmTestbase/nsk/jvmti/ResourceExhausted/
    /resexhausted003/TestDescription.java fails
    + JDK-8218482: sun/security/krb5/auto/ReplayCachePrecise.java
    failed - no KrbException thrown
    + JDK-8218550: Add test omitted from JDK-8212043
    + JDK-8221584: SIGSEGV in os::PlatformEvent::unpark() in
    JvmtiRawMonitor::raw_exit while posting method exit event
    + JDK-8221995: AARCH64: problems with CAS instructions encoding
    + JDK-8222518: Remove unnecessary caching of Parker object in
    java.lang.Thread
    + JDK-8222785: aarch64: add necessary masking for immediate
    shift counts
    + JDK-8223186: HotSpot compile warnings from GCC 9
    + JDK-8225773: jdeps --check produces NPE if there are missing
    module dependences
    + JDK-8225805: Java Access Bridge does not close the logger
    + JDK-8226810: Failed to launch JVM because of
    NullPointerException occured on System.props
    + JDK-8229396: jdeps ignores multi-release when
    generate-module-info used on command line
    + JDK-8229474: Shenandoah: Cleanup CM::update_roots()
    + JDK-8232225: Rework the fix for JDK-8071483
    + JDK-8232905: JFR fails with assertion:
    assert(t-&gt;unflushed_size() == 0) failed: invariant
    + JDK-8233164: C2 fails with assert(phase-&gt;C-&gt;get_alias_index(t)
    == phase-&gt;C-&gt;get_alias_index(t_adr)) failed: correct memory
    chain
    + JDK-8233910: java/awt/ColorClass/AlphaColorTest.java is
    failing  intermittently in nightly lnux-x64 system
    + JDK-8233912: aarch64: minor improvements of atomic operations
    + JDK-8234508: VM_HeapWalkOperation::iterate_over_object reads
    non-strong fields with an on-strong load barrier
    + JDK-8234742: Improve handshake logging
    + JDK-8234796: Refactor Handshake::execute to take a more
    complex type than ThreadClosure
    + JDK-8235324: Dying objects are published from users of
    CollectedHeap::object_iterate
    + JDK-8235351: Lookup::unreflect should bind with the original
    caller independent of Method's accessible flag
    + JDK-8237369: Shenandoah: failed vmTestbase/nsk/jvmti/
    /AttachOnDemand/attach021/TestDescription.java test
    + JDK-8237392: Shenandoah: Remove unreliable assertion
    + JDK-8237483: AArch64 C1 OopMap inserted twice fatal error
    + JDK-8237495: Java MIDI fails with a dereferenced memory error
    when asked to send a raw 0xF7
    + JDK-8239355: (dc) Initial value of SO_SNDBUF should allow
    sending large datagrams (macOS)
    + JDK-8240353: AArch64: missing support for
  - XX:+ExtendedDTraceProbes in C1
    + JDK-8240704: CheckHandles.java failed "AssertionError: Handle
    use increased by more than 10 percent."
    + JDK-8240751: Shenandoah: fold ShenandoahTracer definition
    + JDK-8240795: [REDO] 8238384 CTW: C2 compilation fails with
    "assert(store != load-&gt;find_exact_control(load-&gt;in(0)))
    failed: dependence cycle found"
    + JDK-8241598: Upgrade JLine to 3.14.0
    + JDK-8241649: Optimize Character.toString
    + JDK-8241770: Module xxxAnnotation() methods throw NCDFE if
    module-info.class found as resource in unnamed module
    + JDK-8241911: AArch64: Fix a potential register clash issue in
    reduce_add2I
    + JDK-8242030: Wrong package declarations in jline classes after
    JDK-8241598
    + JDK-8242565: Policy initialization issues when the denyAfter
    constraint is enabled
    + JDK-8243618: compiler/rtm/cli tests can be run w/o WhiteBox
    + JDK-8243670: Unexpected test result caused by C2
    MergeMemNode::Ideal
    + JDK-8244088: [Regression] Switch of Gnome theme ends up in
    deadlocked UI
    + JDK-8244154: Update SunPKCS11 provider with PKCS11 v3.0 header
    files
    + JDK-8244340: Handshake processing thread lacks yielding
    + JDK-8244573: java.lang.ArrayIndexOutOfBoundsException thrown
    for malformed class file
    + JDK-8244683: A TSA server used by tests
    + JDK-8245005: javax/net/ssl/compatibility/BasicConnectTest.java
    failed with No enum constant
    + JDK-8245026: PsAdaptiveSizePolicy::_old_gen_policy_is_ready is
    unused
    + JDK-8245283: JFR: Can't handle constant dynamic used by Jacoco
    agent
    + JDK-8245512: CRC32 optimization using AVX512 instructions
    + JDK-8245527: LDAP Channel Binding support for Java
    GSS/Kerberos
    + JDK-8246707: (sc) SocketChannel.read/write throws
    AsynchronousCloseException on closed channel
    + JDK-8246709: sun/security/tools/jarsigner/
    /TsacertOptionTest.java compilation failed after JDK-8244683
    + JDK-8247200: assert((unsigned)fpargs &lt; 32)
    + JDK-8247766: [aarch64] guarantee(val &lt; (1U &lt;&lt; nbits))
    failed: Field too big for insn.
    + JDK-8248336: AArch64: C2: offset overflow in
    BoxLockNode::emit
    + JDK-8248865: Document JNDI/LDAP timeout properties
    + JDK-8248901: Signed immediate support in
    .../share/assembler.hpp is broken.
    + JDK-8249543: Force DirectBufferAllocTest to run with
  - ExplicitGCInvokesConcurrent
    + JDK-8249588: libwindowsaccessbridge issues on 64bit Windows
    + JDK-8249749: modify a primitive array through a stream and a
    for cycle causes jre crash
    + JDK-8249787: Make TestGCLocker more resilient with concurrent
    GCs
    + JDK-8249867: xml declaration is not followed by a newline
    + JDK-8250911: [windows] os::pd_map_memory() error detection
    broken
    + JDK-8251255: [linux] Add process-memory information to hs-err
    and VM.info
    + JDK-8251359: Shenandoah: filter null oops before calling
    enqueue/SATB barrier
    + JDK-8251925: C2: RenaissanceStressTest fails with
    assert(!had_error): bad dominance
    + JDK-8251944: Add Shenandoah test config to
    compiler/gcbarriers/UnsafeIntrinsicsTest.java
    + JDK-8251992: VM crashed running TestComplexAddrExpr.java test
    with -XX:UseAVX=X
    + JDK-8253220: Epsilon: clean up unused code/declarations
    + JDK-8253274: The CycleDMImagetest brokes the system
    + JDK-8253353: Crash in C2: guarantee(n != NULL) failed: No Node
    + JDK-8253368: TLS connection always receives close_notify
    exception
    + JDK-8253404: C2: assert(C-&gt;live_nodes() &lt;=
    C-&gt;max_node_limit()) failed: Live Node limit exceeded limit
    + JDK-8253409: Double-rounding possibility in float fma
    + JDK-8253476: TestUseContainerSupport.java fails on some Linux
    kernels w/o swap limit capabilities
    + JDK-8253524: C2: Refactor code that clones predicates during
    loop unswitching
    + JDK-8253644: C2: assert(skeleton_predicate_has_opaque(iff))
    failed: unexpected
    + JDK-8253681: closed java/awt/dnd/MouseEventAfterStartDragTest/
    /MouseEventAfterStartDragTest.html test failed
    + JDK-8253702: BigSur version number reported as 10.16, should
    be 11.nn
    + JDK-8253756: C2 CompilerThread0 crash in Node::add_req(Node*)
    + JDK-8254104: MethodCounters must exist before nmethod is
    installed
    + JDK-8254734: "dead loop detected" assert failure with patch
    from 8223051
    + JDK-8254748: Bad Copyright header format after JDK-8212218
    + JDK-8254799: runtime/ErrorHandling/
    /TestHeapDumpOnOutOfMemoryError.java fails with release VMs
    + JDK-8255058: C1: assert(is_virtual()) failed: type check
    + JDK-8255351: Add detection for Graviton 2 CPUs
    + JDK-8255368: Math.exp() gives wrong result for large values on
    x86 32-bit platforms
    + JDK-8255387: Japanese characters were printed upside down on
    AIX
    + JDK-8255401: Shenandoah: Allow oldval and newval registers to
    overlap in cmpxchg_oop()
    + JDK-8255479: [aarch64] assert(src-&gt;section_index_of(target) ==
    CodeBuffer::SECT_NONE) failed: sanity
    + JDK-8255544: Create a checked cast
    + JDK-8255559: Leak File Descriptors Because of
    ResolverLocalFilesystem#engineResolveURI()
    + JDK-8255681: print callstack in error case in
    runAWTLoopWithApp
    + JDK-8255734: VM should ignore SIGXFSZ on ppc64, s390 too
    + JDK-8255742: PrintInlining as compiler directive doesn't print
    virtual calls
    + JDK-8255845: Memory leak in imageFile.cpp
    + JDK-8255880: UI of Swing components is not redrawn after their
    internal state changed
    + JDK-8255908: ExceptionInInitializerError due to
    UncheckedIOException while initializing cgroupv1 subsystem
    + JDK-8256025: AArch64: MachCallRuntimeNode::ret_addr_offset()
    is incorrect for stub calls
    + JDK-8256056: Deoptimization stub doesn't save vector registers
    on x86
    + JDK-8256061: RegisterSaver::save_live_registers() omits upper
    halves of ZMM0-15 registers
    + JDK-8256187: [TEST_BUG] Automate bug4275046.java test
    + JDK-8256220: C1: x86_32 fails with -XX:UseSSE=1 after
    JDK-8210764 due to mishandled lir_neg
    + JDK-8256258: some missing NULL checks or asserts after
    CodeCache::find_blob_unsafe
    + JDK-8256264: Printed GlyphVector outline with low DPI has bad
    quality on Windows
    + JDK-8256290: javac/lambda/T8031967.java fails with
    StackOverflowError on x86_32
    + JDK-8256359: AArch64: runtime/ReservedStack/
    /ReservedStackTestCompiler.java fails
    + JDK-8256387: Unexpected result if patching an entire
    instruction on AArch64
    + JDK-8256421: Add 2 HARICA roots to cacerts truststore
    + JDK-8256488: [aarch64] Use ldpq/stpq instead of ld4/st4 for
    small copies in StubGenerator::copy_memory
    + JDK-8256489: Make gtest for long path names on Windows more
    resilient in the presence of virus scanners
    + JDK-8256501: libTestMainKeyWindow fails to build with Xcode
    12.2
    + JDK-8256633: Fix product build on Windows+Arm64
    + JDK-8256682: JDK-8202343 is incomplete
    + JDK-8256751: Incremental rebuild with precompiled header fails
    when touching a header file
    + JDK-8256757: Incorrect MachCallRuntimeNode::ret_addr_offset()
    for CallLeafNoFP on x86_32
    + JDK-8256806: Shenandoah: optimize shenandoah/jni/
    /TestPinnedGarbage.java test
    + JDK-8256807: C2: Not marking stores correctly as mismatched
    in string opts
    + JDK-8256810: Incremental rebuild broken on Macosx
    + JDK-8256818: SSLSocket that is never bound or connected leaks
    socket resources
    + JDK-8256888: Client manual test problem list update
    + JDK-8257083: Security infra test failures caused by
    JDK-8202343
    + JDK-8257408: Bump update version for OpenJDK: jdk-11.0.11
    + JDK-8257423: [PPC64] Support -XX:-UseInlineCaches
    + JDK-8257436: [aarch64] Regressions in ArrayCopyUnalignedDst
    .testByte/testChar for 65-78 bytes when UseSIMDForMemoryOps
    is on
    + JDK-8257513: C2: assert((constant_addr -
    _masm.code()-&gt;consts()-&gt;start()) == con.offset())
    + JDK-8257547: Handle multiple prereqs on the same line in deps
    files
    + JDK-8257561: Some code is not vectorized after 8251925 and
    8250607
    + JDK-8257565: epsilonBarrierSet.hpp should not include
    barrierSetAssembler
    + JDK-8257575: C2: "failed: only phis" assert failure in loop
    strip mining verification
    + JDK-8257594: C2 compiled checkcast of non-null object triggers
    endless deoptimization/recompilation cycle
    + JDK-8257633: Missing -mmacosx-version-min=X flag when linking
    libjvm
    + JDK-8257670: sun/security/ssl/SSLSocketImpl/SSLSocketLeak.java
    reports leaks
    + JDK-8257707: Fix incorrect format string in Http1HeaderParser
    + JDK-8257746: Regression introduced with JDK-8250984 - memory
    might be null in some machines
    + JDK-8257798: [PPC64] undefined reference to
    Klass::vtable_start_offset()
    + JDK-8257884: Re-enable sun/security/ssl/SSLSocketImpl/
    /SSLSocketLeak.java as automatic test
    + JDK-8257910: [JVMCI] Set exception_seen accordingly in the
    runtime.
    + JDK-8257997: sun/security/ssl/SSLSocketImpl/SSLSocketLeak.java
    again reports leaks after JDK-8257884
    + JDK-8257999: Parallel GC crash in gc/parallel/
    /TestDynShrinkHeap.java: new region is not in covered_region
    + JDK-8258077: Using -Xcheck:jni can lead to a double-free after
    JDK-8193234
    + JDK-8258247: Couple of issues in fix for JDK-8249906
    + JDK-8258373: Update the text handling in the JPasswordField
    + JDK-8258396: SIGILL in jdk.jfr.internal.PlatformRecorder
    .rotateDisk()
    + JDK-8258419: RSA cipher buffer cleanup
    + JDK-8258471: "search codecache" clhsdb command does not work
    + JDK-8258534: Epsilon: clean up unused includes
    + JDK-8258805: Japanese characters not entered by mouse click
    on Windows 10
    + JDK-8258833: Cancel multi-part cipher operations in SunPKCS11
    after failures
    + JDK-8258836: JNI local refs exceed capacity
    getDiagnosticCommandInfo
    + JDK-8258884: [TEST_BUG] Convert applet-based test
    open/test/jdk/javax/swing/JMenuItem/8031573/bug8031573.java
    to a regular java test
    + JDK-8259007: This test printed a blank page
    + JDK-8259048: (tz) Upgrade time-zone data to tzdata2020f
    + JDK-8259049: Uninitialized variable after JDK-8257513
    + JDK-8259231: Epsilon: improve performance under contention
    during virtual space expansion
    + JDK-8259271: gc/parallel/TestDynShrinkHeap.java still fails
    "assert(covered_region.contains(new_memregion)) failed: new
    region is not in covered_region"
    + JDK-8259312: VerifyCACerts.java fails as soneraclass2ca cert
    will expire in 90 days
    + JDK-8259319: Illegal package access when SunPKCS11 requires
    SunJCE's classes
    + JDK-8259339: AllocateUninitializedArray C2 intrinsic fails
    with void.class input
    + JDK-8259428: AlgorithmId.getEncodedParams() should return copy
    + JDK-8259446: runtime/jni/checked/
    /TestCheckedReleaseArrayElements.java fails with stderr not
    empty
    + JDK-8259451: Zero: skip serviceability/sa tests, set vm.hasSA
    to false
    + JDK-8259580: Shenandoah: uninitialized label in
    VerifyThreadGCState
    + JDK-8259619: C1: 3-arg StubAssembler::call_RT stack-use
    condition is incorrect
    + JDK-8259633: compiler/graalunit/CoreTest.java fails with NPE
    after JDK-8244543
    + JDK-8259706: C2 compilation fails with assert(vtable_index ==
    Method::invalid_vtable_index) failed: correct sentinel value
    + JDK-8259707: LDAP channel binding does not work with StartTLS
    extension
    + JDK-8259773: Incorrect encoding of AVX-512 kmovq instruction
    + JDK-8259849: Shenandoah: Rename store-val to IU-barrier
    + JDK-8259949: x86 32-bit build fails when -fcf-protection is
    passed in the compiler flags
    + JDK-8259954: gc/shenandoah/mxbeans tests fail with -Xcomp
    + JDK-8260029: aarch64: fix typo in verify_oop_array
    + JDK-8260308: Update LogCompilation junit to 4.13.1
    + JDK-8260338: Some fields in HaltNode is not cloned
    + JDK-8260349: Cannot programmatically retrieve Metaspace max
    set via JAVA_TOOL_OPTIONS
    + JDK-8260356: (tz) Upgrade time-zone data to tzdata2021a
    + JDK-8260378: [TESTBUG] DcmdMBeanTestCheckJni.java reports
    false positive
    + JDK-8260497: Shenandoah: Improve SATB flushing
    + JDK-8260502: [s390] NativeMovRegMem::verify() fails because
    it's too strict
    + JDK-8260632: Build failures after JDK-8253353
    + JDK-8260704: ParallelGC: oldgen expansion needs release-store
    for _end
    + JDK-8261022: Fix incorrect result of Math.abs() with char type
    + JDK-8261089: [TESTBUG] native library of test
    TestCheckedReleaseCriticalArray.java fails to compile with
    gcc 4.x
    + JDK-8261183: Follow on to Make lists of normal filenames
    + JDK-8261209: isStandalone property: remove dependency on
    pretty-print
    + JDK-8261231: Windows IME was disabled after DnD operation
    + JDK-8261251: Shenandoah: Use object size for full GC
    humongous compaction
    + JDK-8261310: PPC64 Zero build fails with
    'VMError::controlled_crash(int)::FunctionDescriptor
    functionDescriptor' has incomplete type and cannot be defined
    + JDK-8261334: NMT: tuning statistic shows incorrect hash
    distribution
    + JDK-8261413: Shenandoah: Disable class-unloading in I-U mode
    + JDK-8261522: [PPC64] AES intrinsics write beyond the
    destination array
    + JDK-8261534: Test sun/security/pkcs11/KeyAgreement/
    /IllegalPackageAccess.java fails on platforms where no nsslib
    artifacts are defined
    + JDK-8261585: Restore HandleArea used in
    Deoptimization::uncommon_trap
    + JDK-8261753: Test java/lang/System/OsVersionTest.java still
    failing on BigSur patch versions after JDK-8253702
    + JDK-8261829: Exclude tools/jlink/JLinkReproducibleTest.java
    in 11u
    + JDK-8261912: Code IfNode::fold_compares_helper more
    defensively
    + JDK-8261920: [AIX] jshell command throws java.io.IOError on
    non English locales
    + JDK-8262018: Wrong format in SAP copyright header of
    OsVersionTest
    + JDK-8263069: Exclude some failing tests from
    security/infra/java/security/cert/CertPathValidator</changelog>
  <changelog author="fstrba@suse.com" date="1620043200">- Remove all Jpackage provides for SLE12 in order to avoid
  installing this package as default Java on SLE12-SP5
  (bsc#1185476)</changelog>
  <changelog author="fstrba@suse.com" date="1621512000">- Modified patch:
  * nss-security-provider.patch
    + make the NSS provider first in the list</changelog>
  <changelog author="fstrba@suse.com" date="1626868800">- Update to upstream tag jdk-11.0.12+7 (July 2021, CPU)
  * Security fixes
    + JDK-8256157: Improve bytecode assembly
    + JDK-8256491: Better HTTP transport
    + JDK-8258432, CVE-2021-2341, bsc#1188564: Improve file
    transfers
    + JDK-8260453: Improve Font Bounding
    + JDK-8260960: Signs of jarsigner signing
    + JDK-8260967, CVE-2021-2369, bsc#1188565: Better jar file
    validation
    + JDK-8262380: Enhance XML processing passes
    + JDK-8262403: Enhanced data transfer
    + JDK-8262410: Enhanced rules for zones
    + JDK-8262477: Enhance String Conclusions
    + JDK-8262967: Improve Zip file support
    + JDK-8264066, CVE-2021-2388, bsc#1188566: Enhance compiler
    validation
    + JDK-8264079: Improve abstractions
    + JDK-8264460: Improve NTLM support
  * Other changes
    + JDK-6847157: java.lang.NullPointerException: HDC for
    component at sun.java2d.loops.Blit.Blit
    + JDK-7106851: Test should not use System.exit
    + JDK-8073446: TimeZone getOffset API does not  return a dst
    offset between years 2038-2137
    + JDK-8076190: Customizing the generation of a PKCS12 keystore
    + JDK-8153005: Upgrade the default PKCS12 encryption/MAC
    algorithms
    + JDK-8171303: sun/java2d/pipe/InterpolationQualityTest.java
    fails on Windows &amp; Linux
    + JDK-8177068: incomplete classpath causes NPE in Flow
    + JDK-8185734: [Windows] Structured Exception Catcher missing
    around gtest execution
    + JDK-8187450: JNI local refs exceeds capacity warning in
    NetworkInterface::getAll
    + JDK-8190763: Class cast exception on (CompoundEdit)
    UndoableEditEvent.getEdit()
    + JDK-8195841: PNGImageReader.readNullTerminatedString() doesnt
    check for non-null terminated strings with length equal to
    maxLen
    + JDK-8196100: javax/swing/text/JTextComponent/5074573/
    /bug5074573.java fails
    + JDK-8199646: JShell tests: jdk/jshell/
    /FailOverDirectExecutionControlTest.java failed with
    java.lang.UnsupportedOperationException
    + JDK-8206925: Support the certificate_authorities extension
    + JDK-8207160: ClassReader::adjustMethodParams can potentially
    return null if the args list is empty
    + JDK-8207247: AARCH64: Enable Minimal and Client VM builds
    + JDK-8207404: MulticastSocket tests failing on AIX
    + JDK-8207779: Method::is_valid_method() compares 'this' with
    NULL
    + JDK-8208061: runtime/LoadClass/TestResize.java fails with
    "Load factor too high" when running in CDS mode.
    + JDK-8209459: TestSHA512MultiBlockIntrinsics failed on AArch64
    + JDK-8210443: Migrate Locale matching tests to JDK Repo.
    + JDK-8213231: ThreadSnapshot::_threadObj can become stale
    + JDK-8213483: ARM32: runtime/ErrorHandling/
    /ShowRegistersOnAssertTest.java jtreg test fail
    + JDK-8213725: JShell NullPointerException due to class file
    with unexpected package
    + JDK-8213794: ARM32: disable TypeProfiling,
    CriticalJNINatives, Serviceablity tests for ARM32
    + JDK-8213845: ARM32: Interpreter doesn't call result handler
    after native calls
    + JDK-8214128: ARM32: wrong stack alignment on
    Deoptimization::unpack_frames
    + JDK-8214512: ARM32: Jtreg test compiler/c2/Test8062950.java
    fails on ARM
    + JDK-8214854: JDWP: Unforseen output truncation in logging
    + JDK-8214922: Add vectorization support for fmin/fmax
    + JDK-8215009: GCC 8 compilation error in libjli
    + JDK-8216184: CDS/appCDS tests failed on Windows due to long
    path to a classlist file
    + JDK-8216259: AArch64: Vectorize Adler32 intrinsics
    + JDK-8216314: SIGILL in CodeHeapState::print_names()
    + JDK-8217348: assert(thread-&gt;is_Java_thread()) failed: just
    checking
    + JDK-8217465: [REDO] - Optimize CodeHeap Analytics
    + JDK-8217561: X86: Add floating-point Math.min/max intrinsics
    + JDK-8217918: C2: -XX:+AggressiveUnboxing is broken
    + JDK-8218458: [TESTBUG] runtime/NMT/
    /CheckForProperDetailStackTrace.java fails with Expected
    stack trace missing from output
    + JDK-8219142: Remove unused JIMAGE_ResourcePath
    + JDK-8219586: CodeHeap State Analytics processes dead nmethods
    + JDK-8220074: Clean up GCC 8.3 errors in LittleCMS
    + JDK-8220407: compiler/intrinsics/math/
    /TestFpMinMaxIntrinsics.java timedout
    + JDK-8222302: [TESTBUG] test/hotspot/jtreg/compiler/intrinsics/
    /sha/cli/TestUseSHAOptionOnUnsupportedCPU.java fails on any
    other CPU
    + JDK-8222412: AARCH64: multiple instructions encoding issues
    + JDK-8223020: aarch64: expand minI_rReg and maxI_rReg patterns
    into separate instructions
    + JDK-8223444: Improve CodeHeap Free Space Management
    + JDK-8223504: Improve performance of forall loops by better
    inlining of "iterator()" methods
    + JDK-8223667: ASAN build broken
    + JDK-8225081: Remove Telia Company CA certificate expiring in
    April 2021
    + JDK-8225116: Test OwnedWindowsLeak.java intermittently fails
    + JDK-8225438: javax/net/ssl/TLSCommon/
    /TestSessionLocalPrincipal.java failed with Read timed out
    + JDK-8225756: [testbug] compiler/loopstripmining/
    /CheckLoopStripMining.java sets too short a
    SafepointTimeoutDelay
    + JDK-8226374: Restrict TLS signature schemes and named groups
    + JDK-8226627: assert(t-&gt;singleton()) failed: must be a constant
    + JDK-8226721: Missing intrinsics for Math.ceil, floor, rint
    + JDK-8227080: (fs) Files.newInputStream(...).skip(n) is slow
    + JDK-8227222: vmTestbase/jit/FloatingPoint/gen_math/Loops04/
    /Loops04.java failed XMM register should be 0-15
    + JDK-8227609: (fs) Files.newInputStream(...).skip(n) should
    allow skipping beyond file size
    + JDK-8230428: Cleanup dead CastIP node code in formssel.cpp
    + JDK-8231460: Performance issue (CodeHeap) with large free
    blocks
    + JDK-8231713: x86_32 build failures after JDK-8226721 (Missing
    intrinsics for Math.ceil, floor, rint)
    + JDK-8231841: AArch64: debug.cpp help() is missing an AArch64
    line for pns
    + JDK-8232084: HotSpot build failed with GCC 9.2.1
    + JDK-8232591: AArch64: Add missing match rules for smaddl,
    smsubl and smnegl
    + JDK-8233185: HttpServer.stop() blocks indefinitely when
    called on dispatch thread
    + JDK-8233787: Break cycle in vm_version* includes
    + JDK-8233948: AArch64: Incorrect mapping between OptoReg and
    VMReg for high 64 bits of Vector Register
    + JDK-8234355: Buffer overflow in jcmd GC.class_stats due to
    too many classes
    + JDK-8235368: Update BCEL to Version 6.4.1
    + JDK-8236859: WebSocket over authenticating proxy fails with
    NPE
    + JDK-8236992: AArch64: remove redundant load_klass in itable
    stub
    + JDK-8237743: test/langtools/jdk/jshell/
    /FailOverExecutionControlTest.java fails No
    ExecutionControlProvider with name 'nonExistent' and parameter
    keys: []
    + JDK-8237804: sun/security/mscapi tests fail with "Key pair
    not generated, alias &lt;nnnnnn&gt; already exists"
    + JDK-8238175: CTW: Class.getDeclaredMethods fails with
    assert(k-&gt;is_subclass_of(SystemDictionary::Throwable_klass()))
    failed: invalid exception class
    + JDK-8238567: SoftMainMixer.processAudioBuffers(): Wrong
    handling of stoppedMixers
    + JDK-8238812: assert(false) failed: bad AD file
    + JDK-8239312: [macos] javax/swing/JFrame/NSTexturedJFrame/
    /NSTexturedJFrame.java
    + JDK-8239386: handle ContendedPaddingWidth in
    vm_version_aarch64
    + JDK-8239536: Can't use 'java.util.List' object after
    importing 'java.awt.List'
    + JDK-8240487: Cleanup whitespace in .cc, .hh, .m, and .mm files
    + JDK-8240848: ArrayIndexOutOfBoundsException buf for
    TextCallbackHandler
    + JDK-8241082: Upgrade IANA Language Subtag Registry data to
    03-16-2020 version
    + JDK-8241087: Build failure with VS 2019 (16.5.0) due to C2039
    and C2873
    + JDK-8241101: [s390] jtreg test failure after JDK-8238696: not
    conformant features string
    + JDK-8241248: NullPointerException in
    sun.security.ssl.HKDF.extract(HKDF.java:93)
    + JDK-8241372: Several test failures due to
    javax.net.ssl.SSLException: Connection reset
    + JDK-8241475: AArch64: Add missing support for PopCountVI node
    + JDK-8241829: Cleanup the code for PrinterJob on windows
    + JDK-8241960: The SHA3 message digests impl of SUN provider
    are not thread safe after cloned
    + JDK-8242010: Upgrade IANA Language Subtag Registry to Version
    2020-04-01
    + JDK-8242429: Better implementation for sign extract
    + JDK-8242557: Add length limit for strings in PNGImageWriter
    + JDK-8242919: Paste locks up jshell
    + JDK-8243155: AArch64: Add support for SqrtVF
    + JDK-8243240: AArch64: Add support for MulVB
    + JDK-8243452: JFR: Could not create chunk in repository with
    over 200 recordings
    + JDK-8243559: Remove root certificates with 1024-bit keys
    + JDK-8243597: AArch64: Add support for integer vector abs
    + JDK-8244031: HttpClient should have more tests for HEAD
    requests
    + JDK-8244205: HTTP/2 tunnel connections through proxy may be
    reused regardless of which proxy is selected
    + JDK-8244847: Linux/PPC: runtime/CompressedOops/
    /CompressedClassPointers: smallHeapTest fails
    + JDK-8245511: G1 adaptive IHOP does not account for
    reclamation of humongous objects by young GC
    + JDK-8246274: G1 old gen allocation tracking is not in a
    separate class
    + JDK-8247354: [aarch64] PopFrame causes
    assert(oopDesc::is_oop(obj)) failed: not an oop
    + JDK-8247408: IdealGraph bit check expression canonicalization
    + JDK-8247432: Update IANA Language Subtag Registry to Version
    2020-09-29
    + JDK-8247438: JShell: When FailOverExecutionControlProvider
    fails the proximal cause is not shown
    + JDK-8247753: UIManager.getSytemLookAndFeelClassName() returns
    wrong value on Fedora 32
    + JDK-8248043: Need to eliminate excessive i2l conversions
    + JDK-8248411: [aarch64] Insufficient error handling when
    CodeBuffer is exhausted
    + JDK-8248568: compiler/c2/TestBit.java failed: test missing
    from stdout/stderr
    + JDK-8248870: AARCH64: I2L/L2I conversions can be skipped for
    masked positive values
    + JDK-8249142: java/awt/FontClass/CreateFont/DeleteFont.sh is
    unstable
    + JDK-8249189: AARCH64: more L2I conversions can be skipped
    + JDK-8249719: MethodHandle performance suffers from bad
    ResolvedMethodTable hash function
    + JDK-8249875: GCC 10 warnings -Wtype-limits with JFR code
    + JDK-8250635: MethodArityHistogram should use Compile_lock in
    favour of fancy checks
    + JDK-8250876: Fix issues with cross-compile on macos
    + JDK-8251031: Some vmTestbase/nsk/monitoring/RuntimeMXBean
    tests fail with hostnames starting from digits
    + JDK-8251525: AARCH64: Faster Math.signum(fp)
    + JDK-8252259: AArch64: Adjust default value of FLOATPRESSURE
    + JDK-8252311: AArch64: save two words in itable lookup stub
    + JDK-8252779: compiler/graalunit/HotspotTest.java failed after
    8251525
    + JDK-8252883: AccessDeniedException caused by delayed file
    deletion on Windows
    + JDK-8253167: ARM32 builds fail after JDK-8247910
    + JDK-8253572: [windows] CDS archive may fail to open with long
    file names
    + JDK-8253923: C2 doesn't always run loop opts for compilations
    that include loops
    + JDK-8253948: Memory leak in ImageFileReader
    + JDK-8254631: Better support ALPN byte wire values in SunJSSE
    + JDK-8254717: isAssignableFrom checks in
    KeyFactorySpi.engineGetKeySpec appear to be backwards
    + JDK-8255086: Update the root locale display names
    + JDK-8255625: AArch64: Implement Base64.encodeBlock
    accelerator/intrinsic
    + JDK-8255763: C2: OSR miscompilation caused by invalid memory
    instruction placement
    + JDK-8255992: JFR EventWriter does not use first string from
    StringPool with id 0
    + JDK-8256037: [TESTBUG] com/sun/jndi/dns/ConfigTests/
    /PortUnreachable.java fails due to the hard coded threshold
    is small
    + JDK-8256244: java/lang/ProcessHandle/PermissionTest.java
    fails with TestNG 7.1
    + JDK-8256287: [windows] add loop fuse to
    map_or_reserve_memory_aligned
    + JDK-8256523: Streamline Java SHA2 implementation
    + JDK-8257414: Drag n Drop target area is wrong on high DPI
    systems
    + JDK-8257569: Failure observed with
    JfrVirtualMemory::initialize
    + JDK-8257574: C2: "failed: parsing found no loops but there
    are some" assert failure
    + JDK-8257580: Bump update version for OpenJDK: jdk-11.0.12
    + JDK-8257604: JNI_ArgumentPusherVaArg leaks valist
    + JDK-8257621: JFR StringPool misses cached items across
    consecutive recordings
    + JDK-8257796: [TESTBUG]
    TestUseSHA512IntrinsicsOptionOnSupportedCPU.java fails
    on x86_32
    + JDK-8257822: C2 crashes with SIGFPE due to a division that
    floats above its zero check
    + JDK-8257828: SafeFetch may crash if invoked in non-JavaThreads
    + JDK-8257853: Remove dependencies on JNF's JNI utility
    functions in AWT and 2D code
    + JDK-8257858: [macOS]: Remove JNF dependency from
    libosxsecurity/KeystoreImpl.m
    + JDK-8257860: [macOS]: Remove JNF dependency from
    libosxkrb5/SCDynamicStoreConfig.m
    + JDK-8257988: Remove JNF dependency from
    libsaproc/MacosxDebuggerLocal.m
    + JDK-8258414: OldObjectSample events too expensive
    + JDK-8258505: [TESTBUG] TestDivZeroWithSplitIf.java fails due
    to missing UnlockDiagnosticVMOptions
    + JDK-8258753: StartTlsResponse.close() hangs due to
    synchronization issues
    + JDK-8259061: C2: assert(found) failed: memory-writing node is
    not placed in its original loop or an ancestor of it
    + JDK-8259227: C2 crashes with SIGFPE due to a division that
    floats above its zero check
    + JDK-8259232: Bad JNI lookup during printing
    + JDK-8259276: C2: Empty expression stack when reexecuting
    tableswitch/lookupswitch instructions after deoptimization
    + JDK-8259343: [macOS] Update JNI error handling in Cocoa code.
    + JDK-8259585: Accessible actions do not work on mac os x
    + JDK-8259651: [macOS] Replace JNF_COCOA_ENTER/EXIT macros
    + JDK-8259662: Don't wrap SocketExceptions into SSLExceptions
    in SSLSocketImpl
    + JDK-8259710: Inlining trace leaks memory
    + JDK-8259729: Missed JNFInstanceOf -&gt; IsInstanceOf conversion
    + JDK-8259777: Incorrect predication condition generated by ADLC
    + JDK-8259786: initialize last parameter of getpwuid_r
    + JDK-8259843: initialize dli_fname array before calling
    dll_address_to_library_name
    + JDK-8259869: [macOS] Remove desktop module dependencies on
    JNF Reference APIs
    + JDK-8259886: Improve SSL session cache performance and
    scalability
    + JDK-8259983: do not use uninitialized expand_ms value in
    G1CollectedHeap::expand_heap_after_young_collection
    + JDK-8260030: Improve stringStream buffer handling
    + JDK-8260236: better init AnnotationCollector _contended_group
    + JDK-8260255: C1: LoopInvariantCodeMotion constructor can
    leave some fields uninitialized
    + JDK-8260284: C2: assert(_base == Int) failed: Not an Int
    + JDK-8260380: Upgrade to LittleCMS 2.12
    + JDK-8260420: C2 compilation fails with assert(found_sfpt)
    failed: no node in loop that's not input to safepoint
    + JDK-8260426: awt debug_mem.c DMem_AllocateBlock might leak
    memory
    + JDK-8260432: allocateSpaceForGP in freetypeScaler.c might
    leak memory
    + JDK-8260616: Removing remaining JNF dependencies in the
    java.desktop module
    + JDK-8260653: Unreachable nodes keep speculative types alive
    + JDK-8260707: java/lang/instrument/PremainClass/
    /InheritAgent0100.java times out
    + JDK-8260925: HttpsURLConnection does not work  with other
    JSSE provider.
    + JDK-8260926: Trace resource exhausted events unconditionally
    + JDK-8261020: Wrong format parameter in
    create_emergency_chunk_path
    + JDK-8261027: AArch64: Support for LSE atomics C++ HotSpot code
    + JDK-8261167: print_process_memory_info add a close call after
    fopen
    + JDK-8261170: Upgrade to freetype 2.10.4
    + JDK-8261198: [macOS] Incorrect JNI parameters in number
    conversion in A11Y code
    + JDK-8261235: C1 compilation fails with
    assert(res-&gt;vreg_number() == index) failed: conversion check
    + JDK-8261261: The version extra fields needs to be overridable
    in jib-profiles.js
    + JDK-8261262: Kitchensink24HStress.java crashed with
    EXCEPTION_ACCESS_VIOLATION
    + JDK-8261354: SIGSEGV at MethodIteratorHost
    + JDK-8261355: No data buffering in SunPKCS11 Cipher encryption
    when the underlying mechanism has no padding
    + JDK-8261397: try catch Method failing to work when dividing
    an integer by 0
    + JDK-8261422: Adjust problematic String.format calls in
    jdk/internal/util/Preconditions.java outOfBoundsMessage
    + JDK-8261447: MethodInvocationCounters frequently run into
    overflow
    + JDK-8261481: Cannot read Kerberos settings in dynamic store
    on macOS Big Sur
    + JDK-8261505: Test test/hotspot/jtreg/gc/parallel/
    /TestDynShrinkHeap.java killed by Linux OOM Killer
    + JDK-8261601: free memory in early return in
    Java_sun_nio_ch_sctp_SctpChannelImpl_receive0
    + JDK-8261649: AArch64: Optimize LSE atomics in C++ code
    + JDK-8261730: C2 compilation fails with
    assert(store-&gt;find_edge(load) != -1) failed: missing
    precedence edge
    + JDK-8261752: Multiple GC test are missing memory requirements
    + JDK-8261791: (sctp) handleSendFailed in SctpChannelImpl.c
    potential leaks
    + JDK-8261812: C2 compilation fails with assert(!had_error)
    failed: bad dominance
    + JDK-8261914: IfNode::fold_compares_helper faces
    non-canonicalized bool when running JRuby JSON workload
    + JDK-8262093: java/util/concurrent/tck/JSR166TestCase.java
    failed "assert(false) failed: unexpected node"
    + JDK-8262110: DST starts from incorrect time in 2038
    + JDK-8262121: [11u] Redo 8244287: JFR: Methods samples have
    line number 0
    + JDK-8262163: Extend settings printout in jcmd VM.metaspace
    + JDK-8262295: C2: Out-of-Bounds Array Load from Clone Source
    + JDK-8262298: G1BarrierSetC2::step_over_gc_barrier fails with
    assert "bad barrier shape"
    + JDK-8262446: DragAndDrop hangs on Windows
    + JDK-8262461: handle wcstombsdmp return value correctly in
    unix awt_InputMethod.c
    + JDK-8262465: Very long compilation times and high memory
    consumption in C2 debug builds
    + JDK-8262726: AArch64: C1 StubAssembler::call_RT can corrupt
    stack
    + JDK-8262739: String inflation C2 intrinsic prevents insertion
    of anti-dependencies
    + JDK-8262829: Native crash in
    Win32PrintServiceLookup.getAllPrinterNames()
    + JDK-8262837: handle split_USE correctly
    + JDK-8262900: ToolBasicTest fails to access HTTP server it
    starts
    + JDK-8263260: [s390] Support latest hardware (z14 and z15)
    + JDK-8263311: Watch registry changes for remote printers
    update instead of polling
    + JDK-8263361: Incorrect arraycopy stub selected by C2 for SATB
    collectors
    + JDK-8263404: RsaPrivateKeySpec is always recognized as
    RSAPrivateCrtKeySpec in RSAKeyFactory.engineGetKeySpec
    + JDK-8263425: AArch64: two potential bugs in C1
    LIRGenerator::generate_address()
    + JDK-8263448: CTW: fatal error: meet not symmetric
    + JDK-8263504: Some OutputMachOpcodes fields are uninitialized
    + JDK-8263557: Possible NULL dereference in
    Arena::destruct_contents()
    + JDK-8263558: Possible NULL dereference in fast path arena
    free if ZapResourceArea is true
    + JDK-8263676: AArch64: one potential bug in C1
    LIRGenerator::generate_address()
    + JDK-8263729: [test] divert spurious output away from stream
    under test in ProcessBuilder Basic test
    + JDK-8263846: Bad JNI lookup getFocusOwner in accessibility
    code on Mac OS X
    + JDK-8264047: Duplicate global variable 'jvm' in libjavajpeg
    and libawt
    + JDK-8264096: slowdebug jvm crashes when StrInflatedCopy match
    rule is not supported
    + JDK-8264151: ciMethod::ensure_method_data() should return
    false is loading resulted in empty state
    + JDK-8264173: [s390] Improve Hardware Feature Detection And
    Reporting
    + JDK-8264190: Harden TLS interop tests
    + JDK-8264223: CodeHeap::verify fails extra_hops assertion in
    fastdebug test
    + JDK-8264328: Broken license in
    javax/swing/JComboBox/8072767/bug8072767.java
    + JDK-8264360: Loop strip mining verification fails with
    "should be on the backedge"
    + JDK-8264626: C1 should be able to inline excluded methods
    + JDK-8264640: CMS ParScanClosure misses a barrier
    + JDK-8264786: [macos] All Swing/AWT apps cause Allow
    Notifications prompt to appear when app is launched
    + JDK-8264821: DirectIOTest fails on a system with large block
    size
    + JDK-8264848: [macos] libjvm.dylib linker warning due to macOS
    version mismatch
    + JDK-8264923: PNGImageWriter.write_zTXt throws Exception with
    a typo
    + JDK-8264958: C2 compilation fails with assert "n is later
    than its clone"
    + JDK-8265099: Revert backport to 11u of 8236859: WebSocket
    over authenticating proxy fails with NPE
    + JDK-8265154: vinserti128 operand mix up for KNL platforms
    + JDK-8265239: Shenandoah: Shenandoah heap region count could
    be off by 1
    + JDK-8265417: Backport of JDK-8249672 breaks Solaris x86 build
    + JDK-8265421: java/lang/String/StringRepeat.java test is
    missing a memory requirement
    + JDK-8265462: Handle multiple slots in the NSS Internal Module
    from SunPKCS11's Secmod
    + JDK-8265537: x86 version string truncated after JDK-8249672
    11u backport
    + JDK-8265666: Enable AIX build platform to make external debug
    symbols
    + JDK-8265677: CMS: CardTableBarrierSet::write_ref_array_work()
    lacks storestore barrier
    + JDK-8265690: Use the latest Ubuntu base image version in
    Docker testing
    + JDK-8265718: Build failure after JDK-8258414 11u backport
    + JDK-8265750: Fatal error in safepoint.cpp after backport of
    8258414
    + JDK-8265784: [C2] Hoisting of DecodeN leaves MachTemp inputs
    behind
    + JDK-8265938: C2's conditional move optimization does not
    handle top Phi
    + JDK-8266220: keytool still prompt for store password on a
    password-less pkcs12 file if -storetype pkcs12 is specified
    + JDK-8266293: Key protection using PBEWithMD5AndDES fails with
    "java.security.InvalidAlgorithmParameterException: Salt must
    be 8 bytes long"
    + JDK-8266713: [AIX] Build failure after 11u backport of
    JDK-8247753
    + JDK-8266802: Shenandoah: Round up region size to page size
    unconditionally
    + JDK-8266892: avoid maybe-uninitialized gcc warnings on linux
    s390x
    + JDK-8266929: Unable to use algorithms from 3p providers
    + JDK-8267235: [macos_aarch64]
    InterpreterRuntime::throw_pending_exception messing up LR
    results in crash
    + JDK-8267561: Shenandoah: Reference processing not properly
    setup for outside of cycle degenerated GC
    + JDK-8267599: Revert the change to the default PKCS12
    macAlgorithm and macIterationCount props for 11u/8u/7u
    + JDK-8267641: [11u] 8227609 backport typo
    + JDK-8267721: Enable sun/security/pkcs11 tests for Amazon
    Linux 2 AArch64
    + JDK-8268678: LetsEncryptCA.java test fails as Let's Encrypt
    Authority X3 is retired</changelog>
  <changelog author="schwab@suse.de" date="1628078400">- riscv64-zero.patch: Add support for riscv64 (zero VM)</changelog>
  <changelog author="fstrba@suse.com" date="1629979200">- Added patch:
  * jdk11-glibc234.patch
    + fix build with glibc-2.34 (bsc#1189201)</changelog>
  <changelog author="fstrba@suse.com" date="1631534400">- Modified patch:
  * nss-security-provider.patch
    + revert recent changes making NSS provider the default one
    + fixes bsc#1190252</changelog>
  <changelog author="fstrba@suse.com" date="1631793600">- Added patch:
  * fips.patch
    + implement FIPS support in OpenJDK</changelog>
  <changelog author="fstrba@suse.com" date="1634817600">- Update to upstream tag jdk-11.0.13+8 (October 2021 CPU)
  * Security fixes
    + JDK-8163326, CVE-2021-35550, bsc#1191901: Update the default
    enabled cipher suites preference
    + JDK-8254967, CVE-2021-35565, bsc#1191909:
    com.sun.net.HttpsServer spins on TLS session close
    + JDK-8263314: Enhance XML Dsig modes
    + JDK-8265167, CVE-2021-35556, bsc#1191910: Richer Text Editors
    + JDK-8265574: Improve handling of sheets
    + JDK-8265580, CVE-2021-35559, bsc#1191911: Enhanced style for
    RTF kit
    + JDK-8265776: Improve Stream handling for SSL
    + JDK-8266097, CVE-2021-35561, bsc#1191912: Better hashing
    support
    + JDK-8266103: Better specified spec values
    + JDK-8266109: More Resilient Classloading
    + JDK-8266115: More Manifest Jar Loading
    + JDK-8266137, CVE-2021-35564, bsc#1191913: Improve Keystore
    integrity
    + JDK-8266689, CVE-2021-35567, bsc#1191903: More Constrained
    Delegation
    + JDK-8267086: ArrayIndexOutOfBoundsException in
    java.security.KeyFactory.generatePublic
    + JDK-8267712: Better LDAP reference processing
    + JDK-8267729, CVE-2021-35578, bsc#1191904: Improve TLS client
    handshaking
    + JDK-8267735, CVE-2021-35586, bsc#1191914: Better BMP support
    + JDK-8268193: Improve requests of certificates
    + JDK-8268199: Correct certificate requests
    + JDK-8268205: Enhance DTLS client handshake
    + JDK-8268506: More Manifest Digests
    + JDK-8269618, CVE-2021-35603, bsc#1191906: Better session
    identification
    + JDK-8269624: Enhance method selection support
    + JDK-8270398: Enhance canonicalization
    + JDK-8270404: Better canonicalization
  * Other changes
    + JDK-8024368: private methods are allocated vtable indices
    + JDK-8042902: Test java/net/Inet6Address/serialize/
    /Inet6AddressSerializationTest.java fails intermittently
    + JDK-8140466: ChaCha20 and Poly1305 TLS Cipher Suites
    + JDK-8157404: Unable to read certain PKCS12 keystores from
    SequenceInputStream
    + JDK-8158066: SourceDebugExtensionTest fails to rename file
    + JDK-8168304: Make all of DependencyContext_test available in
    product mode
    + JDK-8169246: java/net/DatagramSocket/ReportSocketClosed.java
    fails intermittently with BindException
    + JDK-8181313: SA: Remove libthread_db dependency on Linux
    + JDK-8193214: Incorrect annotations.without.processors
    warnings with JDK 9
    + JDK-8194230: jdk/internal/jrtfs/remote/
    /RemoteRuntimeImageTest.java fails with
    java.lang.NullPointerException
    + JDK-8196092: javax/swing/JComboBox/8032878/bug8032878.java
    fails
    + JDK-8199931: java/net/MulticastSocket/
    /UnreferencedMulticastSockets.java fails with "incorrect data
    received"
    + JDK-8206083: Make tools/javac/api/T6265137.java robust to JDK
    version changes
    + JDK-8206350: java/util/Locale/bcp47u/SystemPropertyTests.java
    failed on Mac 10.13 with zh_CN and zh_TW locales.
    + JDK-8207316: java/nio/channels/spi/SelectorProvider/
    /inheritedChannel/InheritedChannelTest.java failed
    + JDK-8208227: tools/jdeps/DotFileTest.java fails on Win-X64
    + JDK-8208363: test/jdk/java/lang/Package/
    /PackageFromManifest.java missing module dependencies
    declaration
    + JDK-8209380: ARM: cleanup maybe-uninitialized and reorder
    compiler warnings
    + JDK-8209768: Refactor java/util/prefs/CheckUserPrefsStorage.sh
    to plain java test
    + JDK-8209772: Refactor shell test java/util/ServiceLoader/
    /basic/basic.sh to java
    + JDK-8209773: Refactor shell test javax/naming/module/basic.sh
    to java
    + JDK-8209832: Refactor jdk/internal/reflect/Reflection/
    /GetCallerClassTest.sh to plain java test
    + JDK-8209930: Refactor java/util/zip/ZipFile/deletetempjar.sh
    to plain java test
    + JDK-8210406: Refactor java.util.PluggableLocale:i18n shell
    tests to plain java tests
    + JDK-8210407: Refactor java.util.Calendar:i18n shell tests to
    plain java tests
    + JDK-8210495: compiler crashes because of illegal signature in
    otherwise legal code
    + JDK-8210669: Some launcher tests assume a pre-JDK 9 run-time
    image layout
    + JDK-8210802: temp files left by tests in
    jdk/java/net/httpclient
    + JDK-8210819: Update the host name in CNameTest.java
    + JDK-8210908: Refactor java/util/prefs/PrefsSpi.sh to plain
    java test
    + JDK-8210934: Move sun/net/www/protocol/http/
    /GetErrorStream.java to OpenJDK
    + JDK-8210959: JShell fails and exits when statement throws an
    exception whose message contains a '%'.
    + JDK-8211055: Provide print to a file (PDF) feature even when
    printer was not connected
    + JDK-8211092: test/jdk/sun/net/www/http/HttpClient/
    /MultiThreadTest.java fails intermittently when cleaning up
    + JDK-8211296: Remove HotSpot deprecation warning suppression
    for Mac/clang
    + JDK-8211325: test/jdk/java/net/Socket/LingerTest.java fails
    with cleaning up
    + JDK-8212040: Compilation error due to wrong usage of
    NSPrintJobDispositionValue in mac10.12
    + JDK-8212695: Add explicit timeout to several HTTP Client tests
    + JDK-8212718: Refactor some annotation processor tests to
    better use collections
    + JDK-8213007: Update the link in test/jdk/sun/security/
    /provider/SecureRandom/DrbgCavp.java
    + JDK-8213137: Remove static initialization of monitor/mutex
    instances
    + JDK-8213235: java/nio/channels/SocketChannel/
    /AsyncCloseChannel.java fails with threads that didn't exit
    + JDK-8213409: Refactor sun.text.IntHashtable:i18n shell tests
    to plain java tests
    + JDK-8213576: Make test AsyncCloseChannel.java run in othervm
    + JDK-8213694: Test Timeout.java should run in othervm mode
    + JDK-8213718: [TEST] Wrong classname in vmTestbase/nsk/stress/
    /except/except002 and except003
    + JDK-8213922: fix ctw stand-alone build
    + JDK-8214195: Align stdout messages in
    test/jdk/java/math/BigInteger/PrimitiveConversionTests.java
    + JDK-8214520: [TEST_BUG] sun/security/mscapi/nonUniqueAliases/
    /NonUniqueAliases.java failed with incorrect jtreg tags order
    + JDK-8214937: sun/security/tools/jarsigner/warnings/
    /NoTimestampTest.java failed due to unexpected expiration date
    + JDK-8216532: tools/launcher/Test7029048.java fails (Solaris)
    + JDK-8217825: Verify @AfterTest is used correctly in WebSocket
    tests
    + JDK-8218145: block_if_requested is not proper inlined due to
    size
    + JDK-8219417: bump jtreg requiredVersion to b14
    + JDK-8219552: bump jtreg requiredVersion to b14 in
    test/jdk/sanity/client/
    + JDK-8219804: java/net/MulticastSocket/Promiscuous.java fails
    intermittently due to NumberFormatException
    + JDK-8220445: Support for side by side MSVC Toolset versions
    + JDK-8221988: add possibility to build with Visual Studio 2019
    + JDK-8222751: closed/test/jdk/sun/security/util/
    /DerIndefLenConverter/IndefBerPkcs12.java fail
    + JDK-8223050: JVMCI: findUniqueConcreteMethod() should not use
    Dependencies::find_unique_concrete_method() for non-virtual
    methods
    + JDK-8224853: CDS address sanitizer errors
    + JDK-8225082: Remove IdenTrust certificate that is expiring in
    September 2021
    + JDK-8225583: Examine the HttpResponse.BodySubscribers for
    null handling and multiple subscriptions
    + JDK-8225690: Multiple AttachListener threads can be created
    + JDK-8225790: Two NestedDialogs tests fail on Ubuntu
    + JDK-8226319: Add forgotten test/jdk/java/net/httpclient/
    /BodySubscribersTest.java
    + JDK-8226533: JVMCI: findUniqueConcreteMethod should handle
    statically bindable methods directly
    + JDK-8226602: Test convenience reactive primitives from
    java.net.http with RS TCK
    + JDK-8226683: Remove review suggestion from fix to 8219804
    + JDK-8227738: jvmti/DataDumpRequest/datadumpreq001 failed due
    to "exit code is 134"
    + JDK-8227766: CheckUnhandledOops is broken in MemAllocator
    + JDK-8227815: Minimal VM: set_state is not a member of
    AttachListener
    + JDK-8230674: Heap dumps should exclude dormant CDS archived
    objects of unloaded classes
    + JDK-8230808: Remove Access::equals()
    + JDK-8230841: Remove oopDesc::equals()
    + JDK-8231717: Improve performance of charset decoding when
    charset is always compactable
    + JDK-8232243: Wrong caret position in JTextPane on Windows
    with a screen resolution &gt; 100%
    + JDK-8232782: Shenandoah: streamline post-LRB CAS barrier
    (aarch64)
    + JDK-8233790: Forward output from heap dumper to jcmd/jmap
    + JDK-8233989: Create an IPv4 version of
    java/net/MulticastSocket/SetLoopbackMode.java
    + JDK-8234510: Remove file seeking requirement for writing a
    heap dump
    + JDK-8235211: serviceability/attach/
    /RemovingUnixDomainSocketTest.java fails with
    AttachNotSupportedException: Unable to open socket file
    + JDK-8235216: typo in test filename
    + JDK-8235866: bump jtreg requiredVersion to 4.2b16
    + JDK-8236111: narrow allowSmartActionArgs disabling
    + JDK-8236413: AbstractConnectTimeout should tolerate both
    NoRouteToHostException and UnresolvedAddressException
    + JDK-8236671: NullPointerException in JKS keystore
    + JDK-8238930: problem list compiler/c2/Test8004741.java
    + JDK-8238943: switch to jtreg 5.0
    + JDK-8240555: Using env of JAVA_TOOL_OPTIONS and _JAVA_OPTIONS
    breaks QuietOption.java test
    + JDK-8240983: Incorrect copyright header in Apache Santuario
    2.1.3 files
    + JDK-8241336: Some java.net tests failed with
    NoRouteToHostException on MacOS with special network
    configuration
    + JDK-8241353: NPE in ToolProvider.getSystemJavaCompiler
    + JDK-8241768: git needs .gitattributes
    + JDK-8242882: opening jar file with large manifest might throw
    NegativeArraySizeException
    + JDK-8244973: serviceability/attach/
    /RemovingUnixDomainSocketTest.java fails "stderr was not
    empty"
    + JDK-8245134: test/lib/jdk/test/lib/security/
    /KeyStoreUtils.java should allow to specify aliases
    + JDK-8246261: TCKLocalTime.java failed due to "AssertionError:
    expected [18:14:22] but found [18:14:23]"
    + JDK-8246387: switch to jtreg 5.1
    + JDK-8247421: [TESTBUG] ReturnBlobToWrongHeapTest.java failed
    allocating blob
    + JDK-8247469: getSystemCpuLoad() returns -1 on linux when some
    offline cpus are present and cpusets.effective_cpus is not
    available
    + JDK-8248352: [TEST_BUG] Test test/jdk/java/awt/font/
    /TextLayout/ArabicDiacriticTest.java can leave frame open
    + JDK-8248403: AArch64: Remove uses of kernel integer types
    + JDK-8248414: AArch64: Remove uses of long and unsigned long
    ints
    + JDK-8248657: Windows: strengthening in ThreadCritical
    regarding memory model
    + JDK-8248666: AArch64: Use THREAD_LOCAL instead of __thread
    + JDK-8248668: AArch64: Avoid MIN/MAX macros when using MSVC
    + JDK-8248671: AArch64: Remove unused variables
    + JDK-8248682: AArch64: Use ATTRIBUTE_ALIGNED helper
    + JDK-8248816: C1: Fix signature conflict in
    LIRGenerator::strength_reduce_multiply
    + JDK-8249095: tools/javac/launcher/SourceLauncherTest.java
    fails on Windows
    + JDK-8249548: backward focus traversal gets stuck in button
    group
    + JDK-8249773: Upgrade ReceiveISA.java test to be resilient to
    failure due to stray packets and interference
    + JDK-8249897: jdk/javadoc/tool/LangVers.java uses @ignore w/o
    bug-id
    + JDK-8249898: jdk/javadoc/tool/6176978/T6176978.java uses
    @ignore w/o bug-id
    + JDK-8249899: jdk/javadoc/tool/InlineTagsWithBraces.java uses
    @ignore w/o bug-id
    + JDK-8250588: Shenandoah: LRB needs to save/restore fp
    registers for runtime call
    + JDK-8250824: AArch64: follow up for JDK-8248414
    + JDK-8251166: Add automated testcases for changes done in
    JDK-8214112
    + JDK-8251252: Add automated testcase for fix done in
    JDK-8214253
    + JDK-8251254: Add automated test for fix done in JDK-8218472
    + JDK-8251361: Potential race between Logger configuration and
    GCs in HttpURLConWithProxy test
    + JDK-8251549: Update docs on building for Git
    + JDK-8251945: SIGSEGV in
    PackageEntry::purge_qualified_exports()
    + JDK-8252194: Add automated test for fix done in JDK-8218469
    + JDK-8252648: Shenandoah: name gang tasks consistently
    + JDK-8252825: Add automated test for fix done in JDK-8218479
    + JDK-8252853: AArch64: gc/shenandoah/TestVerifyJCStress.java
    fails intermittently with C1
    + JDK-8252857: AArch64: Shenandoah C1 CAS is not sequentially
    consistent
    + JDK-8253048: AArch64: When CallLeaf, no need to preserve
    callee-saved registers in caller
    + JDK-8253424: Add support for running pre-submit testing using
    GitHub Actions
    + JDK-8253631: Remove unimplemented CompileBroker methods after
    JEP-165
    + JDK-8253865: Pre-submit testing using GitHub Actions does not
    detect failures reliably
    + JDK-8253899: Make IsClassUnloadingEnabled signature match
    specification
    + JDK-8254024: Enhance native libs for AWT and Swing to work
    with GraalVM Native Image
    + JDK-8254054: Pre-submit testing using GitHub Actions should
    not use the deprecated set-env command
    + JDK-8254173: Add Zero, Minimal hotspot targets to submit
    workflow
    + JDK-8254175: Build no-pch configuration in debug mode for
    submit checks
    + JDK-8254244: Some code emitted by TemplateTable::branch is
    unused when running TieredCompilation
    + JDK-8254270: linux 32 bit build doesn't compile
    libjdwp/log_messages.c
    + JDK-8254282: Add Linux x86_32 builds to submit workflow
    + JDK-8254850: Update terminology in java.awt.GridBagLayout
    source code comments
    + JDK-8255255: Update Apache Santuario (XML Signature) to
    version 2.2.1
    + JDK-8255305: Add Linux x86_32 tier1 to submit workflow
    + JDK-8255352: Archive important test outputs in submit workflow
    + JDK-8255373: Submit workflow artifact name is always
    "test-results_.zip"
    + JDK-8255452: Doing GC during JVMTI MethodExit event posting
    breaks return oop
    + JDK-8255718: Zero: VM should know it runs in interpreter-only
    mode
    + JDK-8255790: GTKL&amp;F: Java 16 crashes on initialising GTKL&amp;F
    on Manjaro Linux
    + JDK-8255810: Zero: build fails without JVMTI
    + JDK-8255895: Submit workflow artifacts miss hs_errs/replays
    due to ZIP include mismatch
    + JDK-8256127: Add cross-compiled foreign architectures builds
    to submit workflow
    + JDK-8256215: Shenandoah: re-organize saving/restoring machine
    state in assembler code
    + JDK-8256267: Relax compiler/floatingpoint/NaNTest.java for
    x86_32 and lower -XX:+UseSSE
    + JDK-8256277: Github Action build on macOS should define OS
    and Xcode versions
    + JDK-8256354: Github Action build on Windows should define OS
    and MSVC versions
    + JDK-8256393: Github Actions build on Linux should define OS
    and GCC versions
    + JDK-8256414: add optimized build to submit workflow
    + JDK-8256747: GitHub Actions: decouple the hotspot build-only
    jobs from Linux x64 testing
    + JDK-8257056: Submit workflow should apt-get update to avoid
    package installation errors
    + JDK-8257148: Remove obsolete code in AWTView.m
    + JDK-8257497: Update keytool to create AKID from the SKID of
    the issuing certificate as specified by RFC 5280
    + JDK-8257620: Do not use objc_msgSend_stret to get macOS
    version
    + JDK-8257913: Add more known library locations to simplify
    Linux cross-compilation
    + JDK-8258703: Incorrect 512-bit vector registers restore on
    x86_32
    + JDK-8259338: Add expiry exception for identrustdstx3 alias to
    VerifyCACerts.java test
    + JDK-8259535: ECDSA SignatureValue do not always have the
    specified length
    + JDK-8259679: GitHub actions should use MSVC 14.28
    + JDK-8259924: GitHub actions fail on Linux x86_32 with "Could
    not configure libc6:i386"
    + JDK-8260460: GitHub actions still fail on Linux x86_32 with
    "Could not configure libc6:i386"
    + JDK-8260589: Crash in JfrTraceIdLoadBarrier::load(_jclass*)
    + JDK-8260923: Add more tests for SSLSocket input/output
    shutdown
    + JDK-8261072: AArch64: Fix MacroAssembler::get_thread
    convention
    + JDK-8261147: C2: Node is wrongly marked as reduction
    resulting in a wrong execution due to wrong vector instructions
    + JDK-8261238: NMT should not limit baselining by size threshold
    + JDK-8261496: Shenandoah: reconsider pacing updates memory
    ordering
    + JDK-8261652: Remove some dead comments from os_bsd_x86
    + JDK-8261846: [JVMCI] c2v_iterateFrames can get out of sync
    with the StackFrameStream
    + JDK-8262000: jdk/jfr/event/gc/detailed/
    /TestPromotionFailedEventWithParallelScavenge.java failed with
    "OutOfMemoryError: Java heap space"
    + JDK-8262017: C2: assert(n != __null) failed: Bad immediate
    dominator info.
    + JDK-8262392: Update Mesa 3-D Headers to version 21.0.3
    + JDK-8262409: sun/security/ssl/SSLSocketImpl/
    /SSLSocketImplThrowsWrongExceptions. SSL test failures caused
    by java failed with "Server reported the wrong exception"
    + JDK-8262470: Printed GlyphVector outline with low DPI has bad
    quality on Windows
    + JDK-8262862: Harden tests sun/security/x509/URICertStore/
    /ExtensionsWithLDAP.java and krb5/canonicalize/Test.java
    + JDK-8263136: C4530 was reported from VS 2019 at access bridge
    + JDK-8263227: C2: inconsistent spilling due to dead nodes in
    exception block
    + JDK-8263382: java/util/logging/ParentLoggersTest.java failed
    with "checkLoggers: getLoggerNames() returned unexpected
    loggers"
    + JDK-8263407: SPARC64 detection fails on Athena (SPARC64-X)
    + JDK-8263432: javac may report an invalid package/class clash
    on case insensitive filesystems
    + JDK-8263490: [macos] Crash occurs on JPasswordField with
    activated InputMethod
    + JDK-8263531: Remove unused buffer int
    + JDK-8263667: Avoid running GitHub actions on branches named
    pr/*
    + JDK-8263776: [JVMCI] add helper to perform Java upcalls
    + JDK-8264016: [JVMCI] add some thread local fields for use by
    JVMCI
    + JDK-8264752: SIGFPE crash with option
    FlightRecorderOptions:threadbuffersize=30M
    + JDK-8265132: C2 compilation fails with assert "missing
    precedence edge"
    + JDK-8265231: (fc) ReadDirect and WriteDirect tests fail after
    fix for JDK-8264821
    + JDK-8265335: Epsilon: Minor typo in EpsilonElasticTLABDecay
    description
    + JDK-8265756: AArch64: initialize memory allocated for locals
    according to Windows AArch64 stack page growth requirement in
    template interpreter
    + JDK-8265761: Font with missed font family name is not
    properly printed on Windows
    + JDK-8265773: incorrect jdeps message "jdk8internals" to
    describe a removed JDK internal API
    + JDK-8265836: OperatingSystemImpl.getCpuLoad() returns
    incorrect CPU load inside a container
    + JDK-8266018: Shenandoah: fix an incorrect assert
    + JDK-8266206: Build failure after JDK-8264752 with older GCCs
    + JDK-8266248: Compilation failure in
    PLATFORM_API_MacOSX_MidiUtils.c with Xcode 12.5
    + JDK-8266288: assert root method not found in
    witnessed_reabstraction_in_supers is too strong
    + JDK-8266404: Fatal error report generated with
  - XX:+CrashOnOutOfMemoryError should not contain suggestion to
    submit a bug report
    + JDK-8266480: Implicit null check optimization does not update
    control of hoisted memory operation
    + JDK-8266615: C2 incorrectly folds subtype checks involving an
    interface array
    + JDK-8266642: Improve ResolvedMethodTable hash function
    + JDK-8266749: AArch64: Backtracing broken on PAC enabled
    systems
    + JDK-8266761: AssertionError in
    sun.net.httpserver.ServerImpl.responseCompleted
    + JDK-8266813: Shenandoah: Use shorter instruction sequence for
    checking if marking in progress
    + JDK-8267042: bug in monitor locking/unlocking on ARM32 C1 due
    to uninitialized BasicObjectLock::_displaced_header
    + JDK-8267348: Rewrite gc/epsilon/TestClasses.java to use
    Metaspace with less classes
    + JDK-8267396: Avoid recording "pc" in unhandled oops detector
    for better performance
    + JDK-8267399: C2: java/text/Normalizer/ConformanceTest.java
    test failed with assertion
    + JDK-8267424: CTW: C1 fails with "State must not be null"
    + JDK-8267459: Pasting Unicode characters into JShell does not
    work.
    + JDK-8267625: AARCH64: typo in LIR_Assembler::emit_profile_type
    + JDK-8267666: Add option to jcmd GC.heap_dump to use existing
    file
    + JDK-8267695: Bump update version for OpenJDK: jdk-11.0.13
    + JDK-8267751: (test) jtreg.SkippedException has no serial
    VersionUID
    + JDK-8267773: PhaseStringOpts::int_stringSize doesn't handle
    min_jint correctly
    + JDK-8268103: JNI functions incorrectly return a double after
    JDK-8265836
    + JDK-8268127: Shenandoah: Heap size may be too small for
    region to align to large page size
    + JDK-8268261: C2: assert(n != __null) failed: Bad immediate
    dominator info.
    + JDK-8268347: C2: nested locks optimization may create
    unbalanced monitor enter/exit code
    + JDK-8268360: Missing check for infinite loop during node
    placement
    + JDK-8268362: [REDO] C2 crash when compile negative
    Arrays.copyOf length after loop
    + JDK-8268366: Incorrect calculation of has_fpu_registers in C1
    linear scan
    + JDK-8268369: SIGSEGV in PhaseCFG::implicit_null_check due to
    missing null check
    + JDK-8268417: Add test from JDK-8268360
    + JDK-8268427: Improve AlgorithmConstraints:checkAlgorithm
    performance
    + JDK-8268617: [11u REDO] - WebSocket over authenticating proxy
    fails with NPE
    + JDK-8268620: InfiniteLoopException test may fail on x86
    platforms
    + JDK-8268635: Corrupt oop in ClassLoaderData
    + JDK-8268699: Shenandoah: Add test for JDK-8268127
    + JDK-8268771: javadoc -notimestamp option does not work on
    index.html
    + JDK-8268775: Password is being converted to String in
    AccessibleJPasswordField
    + JDK-8268776: Test `ADatagramSocket.java` missing /othervm
    from @run tag
    + JDK-8268965: TCP Connection Reset when connecting simple
    socket to SSL server
    + JDK-8269304: Regression ~5% in 2005 in b27
    + JDK-8269415: [11u] Remove ea from
    DEFAULT_PROMOTED_VERSION_PRE in OpenJDK 11u
    + JDK-8269478: Shenandoah: gc/shenandoah/mxbeans tests should
    be more resilient
    + JDK-8269529: javax/swing/reliability/
    /HangDuringStaticInitialization.java fails in Windows debug
    build
    + JDK-8269594: assert(_handle_mark_nesting &gt; 1) failed: memory
    leak: allocating handle outside HandleMark
    + JDK-8269614: [s390] Interpreter checks wrong bit for slow
    path instance allocation
    + JDK-8269650: Optimize gc-locker in
    [Get|Release]StringCritical for latin string
    + JDK-8269661: JNI_GetStringCritical does not lock char array
    + JDK-8269668: [aarch64] java.library.path not including
    /usr/lib64
    + JDK-8269763: The JEditorPane is blank after JDK-8265167
    + JDK-8269795: C2: Out of bounds array load floats above its
    range check in loop peeling resulting in SEGV
    + JDK-8269847: JDK-8269594 backport breaks 11u builds
    + JDK-8269850: Most JDK releases report macOS version 12 as
    10.16 instead of 12.0
    + JDK-8269851: OperatingSystemMXBean getProcessCpuLoad reports
    incorrect process cpu usage in containers
    + JDK-8269882: stack-use-after-scope in NewObjectA
    + JDK-8269934: RunThese24H.java failed with
    EXCEPTION_ACCESS_VIOLATION in
    java_lang_Thread::get_thread_status
    + JDK-8270096: Shenandoah: Optimize gc/shenandoah/
    /TestRefprocSanity.java for interpreter mode
    + JDK-8270137: Kerberos Credential Retrieval from Cache not
    Working in Cross-Realm Setup
    + JDK-8270184: [TESTBUG] Add coverage for jvmci
    ResolvedJavaType.toJavaName() for lambdas
    + JDK-8270196: [11u] [JVMCI] JavaType.toJavaName() returns
    incorrect type name for lambdas
    + JDK-8270556: Exclude security/infra/java/security/cert/
    /CertPathValidator/certification/LetsEncryptCA
    + JDK-8270893: IndexOutOfBoundsException while reading large
    TIFF file
    + JDK-8272078: Wrong Checksums in Temurin BootJDK dependencies
    + JDK-8272124: Cgroup v1 initialization causes
    NullPointerException when cgroup path contains colon
    + JDK-8272131: PhaseMacroExpand::generate_slow_arraycopy crash
    when clone null CallProjections.fallthrough_ioproj
    + JDK-8272197: Update 11u GHA workflow with Shenandoah
    configurations
    + JDK-8272332: --with-harfbuzz=system doesn't add -lharfbuzz
    after JDK-8255790
    + JDK-8272472: StackGuardPages test doesn't build with glibc
    2.34
    + JDK-8272602: [macos] not all KEY_PRESSED events sent when
    control modifier is used
    + JDK-8272628: Problemlist gc/stress/gcbasher/
    /TestGCBasherWithCMS.java for x86_32
    + JDK-8272700: [macos] Build failure with Xcode 13.0 after
    JDK-8264848
    + JDK-8272772: Shenandoah: compiler/c2/aarch64/
    /TestVolatilesShenandoah.java fails in 11u
    + JDK-8273939: Backport of 8248414 to JDK11 breaks
    MacroAssembler::adrp
- Remove the unneeded icedtea-sound provider
- Removed patches:
  * icedtea-sound-1.0.1-jdk9.patch
  * icedtea-sound-soundproperties.patch
    + not needed since the icedtea-sound provider is removed
  * jdk11-glibc234.patch
    + integrated upstream</changelog>
  <changelog author="fstrba@suse.com" date="1635940800">- Modified patches:
  * system-crypto-policy.patch
    + rediff to changed context
  * fips.patch
    + Allow plain key import in fips mode unless
    com.suse.fips.plainKeySupport is set to false</changelog>
  <changelog author="fstrba@suse.com" date="1636113600">- Modified patch:
  * fips.patch
    + return in native code after generating java.io.IOException</changelog>
</package>
<package pkgid="ef77b6813690a9af92e2227a0015085e5530e9975e9d6c7e770b4c702a4810f3" name="java-11-openjdk-javadoc" arch="noarch">
  <version epoch="0" ver="11.0.13.0" rel="3.68.1"/>
  <changelog author="fstrba@suse.com" date="1586952000">- The pack200 and unpack200 alternatives should be slaves of java
  and not of javac, since they are part of JRE.</changelog>
  <changelog author="fstrba@suse.com" date="1587470400">- Update to upstream tag jdk-11.0.7+10 (April 2020 CPU,
  bsc#1169511)
  * Security fixes:
    + S8223898, CVE-2020-2754: Forward references to Nashorn
    + S8223904, CVE-2020-2755: Improve Nashorn matching
    + S8224541, CVE-2020-2756: Better mapping of serial ENUMs
    + S8224549, CVE-2020-2757: Less Blocking Array Queues
    + S8225603: Enhancement for big integers
    + S8226346: Build better binary builders
    + S8227467: Better class method invocations
    + S8227542: Manifest improved jar headers
    + S8229733: TLS message handling improvements
    + S8231415, CVE-2020-2773: Better signatures in XML
    + S8231785: Improved socket permissions
    + S8232424, CVE-2020-2778: More constrained algorithms
    + S8232581, CVE-2020-2767: Improve TLS verification
    + S8233250: Better X11 rendering
    + S8233410: Better Build Scripting
    + S8234027: Better JCEKS key support
    + S8234408, CVE-2020-2781: Improve TLS session handling
    + S8234825, CVE-2020-2800: Better Headings for HTTP Servers
    + S8234841, CVE-2020-2803: Enhance buffering of byte buffers
    + S8235274, CVE-2020-2805: Enhance typing of methods
    + S8235691, CVE-2020-2816: Enhance TLS connectivity
    + S8236201, CVE-2020-2830: Better Scanner conversions
    + S8238960: linux-i586 builds are inconsistent as the newly
    built jdk is not able to reserve enough space for object heap
  * Other changes:
    + S4919790: Errors in alert ssl message does not reflect the
    actual certificate status
    + S4949105: Access Bridge lacks html tags parsing
    + S7092821: java.security.Provider.getService() is synchronized
    and became scalability bottleneck
    + S7143743: Potential memory leak with zip provider
    + S8005819: Support cross-realm MSSFU
    + S8042383: [TEST_BUG] Test javax/swing/plaf/basic/BasicMenuUI/
    /4983388/bug4983388.java fails with shortcuts on menus do not
    work
    + S8068184: Fix for JDK-8032832 caused a deadlock
    + S8145845: [AOT] NullPointerException in
    compiler/whitebox/GetCodeHeapEntriesTest.java
    + S8152988: [AOT] Update test batch definitions to include
    aot-ed java.base module mode into hs-comp testing
    + S8160926: FLAGS_COMPILER_CHECK_ARGUMENTS doesn't handle
    cross-compilation
    + S8163083: SocketListeningConnector does not allow invocations
    with port 0
    + S8163251: Hard coded loop limit prevents reading of smart
    card data greater than 8k
    + S8167276: jvmci/compilerToVM/MaterializeVirtualObjectTest.java
    fails with -XX:-EliminateAllocations
    + S8169718: nsk/jdb/locals/locals002: ERROR: Cannot find
    boolVar with expected value: false
    + S8176556:
    java/awt/dnd/ImageTransferTest/ImageTransferTest.java fails
    for JFIF
    + S8178798: Two compiler/aot/verification/vmflags tests fail by
    timeout with UseAVX=3
    + S8183107: PKCS11 regression regarding checkKeySize
    + S8185005: Improve performance of
    ThreadMXBean.getThreadInfo(long ids[], int maxDepth)
    + S8189633: Missing -Xcheck:jni checking for DeleteWeakGlobalRef
    + S8189861: Refactor CacheFind
    + S8193042: NativeLookup::lookup_critical_entry() should only
    load shared library once
    + S8193596: java/net/DatagramPacket/ReuseBuf.java failed due to
    timeout
    + S8194944: Regression automated test 'open/test/jdk/javax/
    /swing/JInternalFrame/8145896/TestJInternalFrameMaximize.java'
    fails
    + S8196467: javax/swing/JInternalFrame/Test6325652.java fails
    + S8196969: JTreg Failure: serviceability/sa/ClhsdbJstack.java
    causes NPE
    + S8198321: javax/swing/JEditorPane/5076514/bug5076514.java
    fails
    + S8198398: Test javax/swing/JColorChooser/Test6199676.java
    fails in mach5
    + S8199072: Test javax/swing/GroupLayout/6613904/
    /bug6613904.java is unstable
    + S8200432: javadoc fails with ClassCastException on {@link
    byte[]}
    + S8201349: build broken when configured with
  - -with-zlib=bundled on gcc 7.3
    + S8201355: Avoid native memory allocation in
    sun.security.mscapi.PRNG.generateSeed
    + S8201513: nsk/jvmti/IterateThroughHeap/filter-* are broken
    + S8203364: Some serviceability/sa/ tests intermittently fail
    with java.io.IOException: LingeredApp terminated with non-zero
    exit code 3
    + S8203687: javax/net/ssl/compatibility/Compatibility.java
    supports TLS 1.3
    + S8203904: javax/swing/JSplitPane/4816114/bug4816114.java: The
    divider location is wrong
    + S8203911: Test runtime/modules/getModuleJNI/GetModule fails
    with -Xcheck:jni
    + S8204525: [TESTBUG] runtime/NMT/MallocStressTest.java ran out
    of java heap
    + S8204529: gc/TestAllocateHeapAtMultiple.java fail with Agent
    7 timed out
    + S8204551: Event descriptions are truncated in logs
    + S8206963: [AOT] bug with multiple class loaders
    + S8207367: 10 vmTestbase/nsk/jdi tests timed out when running
    with jtreg
    + S8207832: serviceability/sa/ClhsdbCDSCore.java failed with
    "Couldn't find core file location"
    + S8207938: At step6,Click Add button,case failed automatically.
    + S8208157: requires.VMProps throws NPE for missing properties
    in "release" file
    + S8208379: compiler/jvmci/events/
    /JvmciNotifyInstallEventTest.java failed with "Got unexpected
    event count after 2nd install attempt: expected 9 to equal 2"
    + S8208658: Make CDS archived heap regions usable even if
    compressed oop encoding has changed
    + S8208715: Conversion of milliseconds to nanoseconds in
    UNIXProcess contains bug
    + S8209361: [AOT] Unexpected number of references for
    JVMTI_HEAP_REFERENCE_CONSTANT_POOL [111--&gt;111]: 0 (expected
    at least 1)
    + S8209385: CDS runtime classpath checking is too strict when
    only classes from the system modules are archived
    + S8209389: SIGSEGV in WalkOopAndArchiveClosure::do_oop_work.
    + S8209418: Synchronize test/jdk/sanity/client/lib/jemmy with
    code-tools/jemmy/v2
    + S8209494: Create a test for SwingSet InternalFrameDemo
    + S8209499: Create test for SwingSet EditorPaneDemo
    + S8209574: [AOT] breakpoint events are generated in different
    threads does not meet expected count
    + S8209686: cleanup arguments to PhaseIdealLoop() constructor
    + S8209789: Synchronize test/jdk/sanity/client/lib/jemmy with
    code-tools/jemmy/v2
    + S8209802: Garbage collectors should register JFR types
    themselves to avoid build errors.
    + S8209807: improve handling exception in requires.VMProps
    + S8209817: stack is executable when building with Clang on
    Linux
    + S8209824: Improve the code coverage for ThreadLocal
    + S8209826: Undefined reference to os::write after JDK-8209657
    (filemap.hpp cleanup)
    + S8209850: Allow NamedThreads to use GlobalCounter critical
    sections
    + S8209976: Improve iteration over non-JavaThreads
    + S8209993: Create a test for SwingSet3 ToolTipDemo
    + S8210024: JFR calls virtual is_Java_thread from ~Thread()
    + S8210052: Enable testing for all the available look and feels
    in SwingSet3 demo tests
    + S8210055: Enable different look and feel tests in SwingSet3
    demo tests
    + S8210057: Enable different look and feels in SwingSet3 demo
    test InternalFrameDemoTest
    + S8210058: Algorithmic Italic font leans opposite angle in
    Printing
    + S8210220: [AOT] jdwp test cases are failing with error #
    ERROR: TEST FAILED: Cought IOException while receiving event
    packet
    + S8210289: ArchivedKlassSubGraphInfoRecord is incomplete
    + S8210459: Add support for generating compile_commands.json
    + S8210476: sun/security/mscapi/PrngSlow.java fails with Still
    too slow
    + S8210512: [Testbug] vmTestbase/nsk/jdi/ObjectReference/
    /referringObjects/referringObjects002/referringObjects002.java
    fails with unexpected size of
    ClassLoaderReference.referringObjects
    + S8210523: runtime/appcds/cacheObject/DifferentHeapSizes.java
    crash
    + S8210632: Add key exchange algorithm to
    javax/net/ssl/TLSCommon/CipherSuite.java
    + S8210699: Problem list tests which times out in Xcomp mode
    + S8210793: [JVMCI] AllocateCompileIdTest.java failed to find
    DiagnosticCommand.class
    + S8210910: Create test for FileChooserDemo
    + S8210994: Create test for SwingSet3 FrameDemo
    + S8211139: Increase timeout value in all tests under
    jdk/sanity/client/SwingSet/src
    + S8211160: Handle different look and feels in
    JInternalFrameOperator
    + S8211211: vmTestbase/metaspace/stressDictionary/
    /StressDictionary.java timeout
    + S8211322: Reduce the timeout of tooltip in SwingSet2DemoTest
    + S8211443: Enable different look and feels in SwingSet3 demo
    test SplitPaneDemoTest
    + S8211703: JInternalFrame : java.lang.AssertionError: cannot
    find the internal frame
    + S8211781: re-building fails after changing Graal sources
    + S8212897: Some improvements in the EditorPaneDemotest
    + S8212903: [TestBug] Tests test/jdk/javax/swing/LookAndFeel/
    /8145547/DemandGTK2.sh and DemandGTK3.sh fail on Ubuntu 18.04
    LTS
    + S8213009: Refactoring existing SunMSCAPI classes
    + S8213010: Supporting keys created with certmgr.exe
    + S8213168: Enable different look and feel tests in SwingSet3
    demo test FileChooserDemoTest
    + S8213348: jdk.internal.vm.compiler.management service
    providers missing in module descriptor
    + S8213906: Update arm devkits with libXrandr headers
    + S8213908: AssertionError in DeferredAttr at setOverloadKind
    + S8214124: [TESTBUG] Bugs in runtime/NMT/MallocStressTest.java
    + S8214344: C2: assert(con.basic_type() != T_ILLEGAL) failed:
    elembt=byte; loadbt=void; unsigned=0
    + S8214345: infinite recursion while checking super class
    + S8214471: Enable different look and feel tests in SwingSet3
    demo test ToolTipDemoTest
    + S8214534: Setting of THIS_FILE in the build is broken
    + S8214557: Filter out VM flags which don't affect AOT code
    generation
    + S8214578: [macos] Problem with backslashes on macOS/JIS
    keyboard: Java ignores system settings
    + S8214840: runtime/NMT/MallocStressTest.java timed out
    + S8214850: Rename vm_operations.?pp files to vmOperations.?pp
    files
    + S8214904: Test8004741.java failed due to "Too few ThreadDeath
    hits; expected at least 6 but saw only 5"
    + S8215322: add @file support to jaotc
    + S8215355: Object monitor deadlock with no threads holding the
    monitor (using jemalloc 5.1)
    + S8215396: JTabbedPane preferred size calculation is wrong for
    SCROLL_TAB_LAYOUT
    + S8216180: [AOT] compiler/intrinsics/bigInteger/TestMulAdd.java
    crashed with AOT enabled
    + S8216353: Use utility APIs introduced in org/netbeans/jemmy/
    /util/LookAndFeel class in client sanity test cases
    + S8216354: Syntax error in toolchain_windows.m4
    + S8216472: (se) Stack overflow during selection operation
    leads to crash (win)
    + S8216535: tools/jimage/JImageExtractTest.java timed out
    + S8217235: Create automated test for SwingSet
    ColorChooserDemoTest
    + S8217297: Add support for multiple look and feel for SwingSet
    SliderDemoTest
    + S8217338: [Containers] Improve systemd slice memory limit
    support
    + S8217613: [AOT] TEST_OPTS_AOT_MODULES doesn't work on mac
    + S8217634: RunTest documentation and usability update
    + S8217717: ZGC: Broken oop map in C1 load barrier stub
    + S8217728: Speed up incremental rerun of "make hotspot"
    + S8218268: Javac treats Manifest Class-Path entries as Paths
    instead of URLs
    + S8218662: Allow 204 responses with Content-Length:0
    + S8218882: NET_Writev is declared, NET_WriteV is defined
    + S8218889: Improperly use of the Optional API
    + S8219205: JFR file without license header
    + S8219597: (bf) Heap buffer state changes could provoke
    unexpected exceptions
    + S8219723: javax/net/ssl/compatibility/Compatibility.java
    failed on some SNI cases
    + S8220348: [ntintel] asserts about copying unaligned array
    + S8220451: jdi/EventQueue/remove/remove004 failed due to
    "ERROR: thread2 is not alive"
    + S8220456: jdi/EventQueue/remove_l/remove_l004 failed due to
    "TIMEOUT while waiting for event"
    + S8220479: java/nio/channels/Selector/SelectWithConsumer.java
    failed at testTwoChannels()
    + S8220613: java/util/Arrays/TimSortStackSize2.java times out
    with fastdebug build
    + S8220688: [TESTBUG] runtime/NMT/MallocStressTest.java timed
    out
    + S8220786: Create new switch to redirect error reporting
    output to stdout or stderr
    + S8221270: Duplicated synchronized keywords in SSLSocketImpl
    + S8221312: test/jdk/sanity/client/SwingSet/src/
    /ColorChooserDemoTest.java failed
    + S8221851: Use of THIS_FILE in hotspot invalidates precompiled
    header on Linux/GCC
    + S8221885: Add intermittent test in the JavaSound to the
    ProblemList
    + S8222264: Windows incremental build is broken with JDK-8217728
    + S8222391: javax/net/ssl/compatibility/Compatibility.java
    should be more flexible
    + S8222448: java/lang/reflect/PublicMethods/
    /PublicMethodsTest.java times out
    + S8222519: ButtonDemoScreenshotTest fails randomly with "still
    state to be reached"
    + S8222741: jdi/EventQueue/remove/remove004 fails due to
    VMDisconnectedException
    + S8223003: SunMSCAPI keys are not cleaned up
    + S8223063: Support CNG RSA keys
    + S8223158: Docked MacBook cannot start any Java Swing
    applications
    + S8223260: NamingManager should cache InitialContextFactory
    + S8223464: Improve version string for Oracle CI builds
    + S8223558: Java does not render Myanmar script correctly
    + S8223627: jdk-13+20 bundle name contains null instead of ea
    + S8223638: Replace wildcard address with loopback or local
    host in tests - part 6
    + S8223678: Add Visual Studio Code workspace generation support
    (for native code)
    + S8223727: com/sun/jndi/ldap/privconn/RunTest.java failed due
    to hang in LdapRequest.getReplyBer
    + S8223769: Assert triggers with -XX:+StressReflectiveCode
    + S8224187: Refactor arraycopy_prologue to allow ZGC read
    barriers on arraycopy
    + S8224475: JTextPane does not show images in HTML rendering
    + S8224673: Adjust permission for delayed starting of debugging
    + S8224705: Tests that need to be problem-listed or have
    printer resources
    + S8224778: test/jdk/demo/jfc/J2Ddemo/J2DdemoTest.java cannot
    find J2Ddemo.jar
    + S8224821: java/awt/Focus/NoAutotransferToDisabledCompTest/
    /NoAutotransferToDisabledCompTest.java fails linux-x64
    + S8224830: test/jdk/java/awt/Focus/
    /ModalExcludedWindowClickTest/
    /ModalExcludedWindowClickTest.java fails on linux-x64
    + S8224851: AArch64: fix warnings and errors with Clang and GCC
    8.3
    + S8224905: java/lang/ProcessBuilder/Basic.java#id1 failed with
    stream closed
    + S8225007: java/awt/print/PrinterJob/
    /LandscapeStackOverflow.java may hang
    + S8225105: java/awt/Focus/ShowFrameCheckForegroundTest/
    /ShowFrameCheckForegroundTest.java fails in Windows 10
    + S8225117: java/math/BigInteger/SymmetricRangeTests.java fails
    with ParseException
    + S8225128: Add exception for expiring DocuSign root to
    VerifyCACerts test
    + S8225130: Add exception for expiring Comodo roots to
    VerifyCACerts test
    + S8225144: [macos] In Aqua L&amp;F backspace key does not delete
    when Shift is pressed
    + S8225180: SignedObject with invalid Key not throwing the
    InvalidKeyException in Windows
    + S8225182: JNI exception pending in DestroyXIMCallback of
    awt_InputMethod.c:1327
    + S8225199: [Graal] compiler/jvmci/compilerToVM/
    /IsMatureVsReprofileTest.java fails with
  - XX:CompileThresholdScaling=0.1
    + S8225305: ProblemList java/lang/invoke/VarHandles tests
    + S8225350: compiler/jvmci/compilerToVM/IsCompilableTest.java
    timed out
    + S8225430: Replace wildcard address with loopback or local
    host in tests - part 14
    + S8225435: Upgrade IANA Language Subtag Registry to the latest
    for JDK14
    + S8225487: giflib legal file is missing attribution for
    openbsd-reallocarray.c
    + S8225567: Wrong file headers with 8202414 fix changeset
    + S8225684: [AOT] vmTestbase/vm/oom/production/
    /AlwaysOOMProduction tests fail with AOTed java.base
    + S8225766: Curve in certificate should not affect signature
    scheme when using TLSv1.3
    + S8225797: OldObjectSample event creates unexpected amount of
    checkpoint data
    + S8226381: ProblemList java/lang/reflect/PublicMethods/
    /PublicMethodsTest.java
    + S8226406: JVM fails to detect mismatched or corrupt CDS
    archive
    + S8226608: Hide the onjcmd option from the help output
    + S8226892: ActionListeners on JRadioButtons don't get notified
    when selection is changed with arrow keys
    + S8227112: exclude compiler/intrinsics/sha/sanity tests from
    AOT runs
    + S8227324: Upgrade to freetype 2.10.1
    + S8227528: TestAbortVMOnSafepointTimeout.java failed due to
    "RuntimeException: 'Safepoint sync time longer than' missing
    from stdout/stderr"
    + S8227645: Some tests in serviceability/sa run with fixed -Xmx
    values and risk running out of memory
    + S8227646: [TESTBUG] appcds/SharedArchiveConsistency timed out
    + S8227662: freetype seeks to index at the end of the font data
    + S8228479: Correct the format of ColorChooserDemoTest
    + S8228613: java.security.Provider#getServices order is no
    longer deterministic
    + S8228969: 2019-09-28 public suffix list update
    + S8229236: CriticalJNINatives: dll handling should be done in
    native thread state
    + S8229345: Memory leak due to vtable stubs not being shared on
    SPARC
    + S8229888: (zipfs) Updating an existing zip file does not
    preserve original permissions
    + S8229994: assert(false) failed: Bad graph detected in
    get_early_ctrl_for_expensive
    + S8230004: jdk/internal/jimage/JImageOpenTest.java runs no test
    + S8230235: Rendering HTML with empty img attribute and
    documentBaseKey cause Exception
    + S8230390: Problemlist SA tests with AOT
    + S8230400: Missing constant pool entry for a method in
    stacktrace
    + S8230459: Test failed to resume JVMCI CompilerThread
    + S8230480: check malloc/calloc results in java.desktop
    + S8230597: Update GIFlib library to the 5.2.1
    + S8230611: infinite loop in
    LogOutputList::wait_until_no_readers()
    + S8230624: [TESTBUG] Problemlist JFR
    compiler/TestCodeSweeper.java
    + S8230677: Should disable Escape Analysis if JVMTI capability
    can_get_owned_monitor_info was taken
    + S8230926: [macosx] Two apostrophes are entered instead of one
    with "U.S. International - PC" layout
    + S8231025: Incorrect method tag offset for big endian platform
    + S8231081: TestMetadataRetention fails due to missing symbol id
    + S8231387: java.security.Provider.getService returns random
    result due to race condition with mutating methods in the same
    class
    + S8231430: C2: Memory stomp in max_array_length() for
    T_ILLEGAL type
    + S8231445: check ZALLOC return values in awt coding
    + S8231507: Update Apache Santuario (XML Signature) to version
    2.1.4
    + S8231584: Deadlock with ClassLoader.findLibrary and
    System.loadLibrary call
    + S8231753: use more Posix functionality in aix
    os::print_os_info
    + S8231810: javax/net/ssl/templates/
    /SSLSocketSSLEngineTemplate.java fails intermittently with
    "java.lang.Exception: Unexpected EOF"
    + S8232003: (fs) Files.write can leak file descriptor in the
    exception case
    + S8232056: GetOwnedMonitorInfoWithEATest.java fails with ZGC:
    Heap too small
    + S8232060: add some initializations using sigemptyset in
    os_aix.cpp
    + S8232154: Update Mesa 3-D Headers to version 19.2.1
    + S8232167: Visual Studio install found through
  - -with-tools-dir value is discarded
    + S8232170: FSInfo#getJarClassPath throws an exception not
    declared in its throws clause
    + S8232200: [macos 10.15] Windows in fullscreen tests jumps
    around the screen
    + S8232207: Linux os::available_memory re-reads cgroup
    configuration on every invocation
    + S8232224: [TESTBUG] problemlist JFR TestLargeRootSet.java
    + S8232370: Refactor some com.sun.jdi tests to enable IDE
    integration
    + S8232433: [macos 10.15] java/awt/Window/
    /LocationAtScreenCorner/LocationAtScreenCorner.java may fail
    + S8232571: Add missing SIGINFO signal
    + S8232692: [TESTBUG] compiler/aot/fingerprint/
    /SelfChangedCDS.java fails when cds is disabled
    + S8232713: Update BCEL version to 6.3.1 in license file
    + S8232806: Introduce a system property to disable eager lambda
    initialization
    + S8232834: RunTest sometimes fails to produce valid
    exitcode.txt
    + S8232880: Update test documentation with additional settings
    for client UI tooltip tests
    + S8232950: SUNPKCS11 Provider incorrectly check key length for
    PSS Signatures.
    + S8233018: Add a new test to verify that DatagramSocket is not
    interruptible
    + S8233019: java.lang.Class.isPrimitive() (C1) returns wrong
    result if Klass* is aligned to 32bit
    + S8233032: assert(in_bb(n)) failed: must be
    + S8233078: fix minimal VM build on Linux ppc64(le)
    + S8233328: fix minimal VM build on Linux s390x
    + S8233383: Various minor fixes
    + S8233466: aarch64: remove unnecessary load of mdo when
    profiling return and parameters type
    + S8233491: Crash in AdapterHandlerLibrary::get_adapter with
    CDS due to code cache exhaustion
    + S8233529: loopTransform.cpp:2984: Error: assert(p_f-&gt;Opcode()
    == Op_IfFalse) failed
    + S8233548: Update CUP to v0.11b
    + S8233649: Update ProblemList.txt to exclude failing headful
    tests on macos
    + S8233656: assert(d-&gt;is_CFG() &amp;&amp; n-&gt;is_CFG()) failed: must
    have CFG nodes
    + S8233657: Intermittent NPE in Component.validate()
    + S8234288: Turkey Time Zone returns incorrect time zone name
    + S8234323: NULL-check return value of SurfaceData_InitOps on
    macosx
    + S8234339: replace JLI_StrTok in java_md_solinux.c
    + S8234340: Bump update version for OpenJDK: jdk-11.0.7
    + S8234350: assert(mode == ControlAroundStripMined &amp;&amp; (use ==
    sfpt || !use-&gt;is_reachable_from_root())) failed: missed a node
    + S8234386: [macos] NPE was thrown at expanding Choice from
    maximized frame
    + S8234397: add OS uptime information to os::print_os_info
    output
    + S8234423: Modifying ArrayList.subList().subList() resets
    modCount of subList
    + S8234466: Class loading deadlock involving
    X509Factory#commitEvent()
    + S8234501: remove obsolete NET_ReadV
    + S8234525: enable link-time section-gc for linux s390x to
    remove unused code
    + S8234610: MaxVectorSize set wrongly when UseAVX=3 is
    specified after JDK-8221092
    + S8234617: C1: Incorrect result of field load due to missing
    narrowing conversion
    + S8234723: javax/net/ssl/TLS tests support TLSv1.3
    + S8234724: javax/net/ssl/templates/
    /SSLSocketSSLEngineTemplate.java supports TLSv1.3
    + S8234741: enhance os::get_core_path on macOS
    + S8234769: Duplicate attribution in freetype.md
    + S8234786: Fix for JDK-8214578 breaks OS X 10.12 compatibility
    + S8234809: set relro in linker flags when building with gcc
    + S8234824: java/nio/channels/SocketChannel/AdaptSocket.java
    fails on Windows 10
    + S8235243: handle VS2017 15.9 and VS2019 in abstract_vm_version
    + S8235288: AVX 512 instructions inadvertently used on Xeon for
    small vector width operations
    + S8235325: build failure on Linux after 8235243
    + S8235383: C1 compilation fails with
  - XX:+PrintIRDuringConstruction -XX:+Verbose
    + S8235489: handle return values of sscanf calls in hotspot
    + S8235509: Backport for JDK-8209657 Refactor filemap.hpp to
    simplify integration with Serviceability Agent.
    + S8235510: java.util.zip.CRC32 performance drop after 8200067
    + S8235563: [TESTBUG] appcds/CommandLineFlagComboNegative.java
    does not handle archive mapping failure
    + S8235637: jhsdb jmap from OpenJDK 11.0.5 doesn't work if
    prelink is enabled
    + S8235671: enhance print_rlimit_info in os_posix
    + S8235744: PIT: test/jdk/javax/swing/text/html/
    /TestJLabelWithHTMLText.java times out in linux-x64
    + S8235904: Infinite loop when rendering huge lines
    + S8235998: [c2] Memory leaks during tracing after '8224193:
    stringStream should not use Resource Area'.
    + S8236039: JSSE Client does not accept status_request
    extension in CertificateRequest messages for TLS 1.3
    + S8236140: assert(!VerifyHashTableKeys || _hash_lock == 0)
    failed: remove node from hash table before modifying it
    + S8236179: C1 register allocation error with T_ADDRESS
    + S8236488: Support for configure option
  - -with-native-debug-symbols=internal is impossible on Windows
    + S8236500: Windows ucrt.dll should be looked up in versioned
    WINSDK subdirectory
    + S8236709: struct SwitchRange in HS violates C++ One
    Definition Rule
    + S8236848: [JDK 11u] make run-test-tier1 fails after backport
    of JDK-8232834
    + S8236873: Worker has a deadlock bug
    + S8237217: Incorrect G1StringDedupEntry type used in
    StringDedupTable destructor
    + S8237368: Problem with NullPointerException in RMI
    TCPEndpoint.read
    + S8237375: SimpleThresholdPolicy misses CounterDecay timestamp
    initialization
    + S8237508: Simplify JarFile.isInitializing
    + S8237540: Missing files in backport of JDK-8210910
    + S8237541: Missing files in backport of JDK-8236528
    + S8237600: Test SunJSSEFIPSInit fails on Ubuntu
    + S8237819: s390x - remove unused pd_zero_to_words_large
    + S8237869: exclude jtreg test security/infra/java/security/
    /cert/CertPathValidator/certification/LuxTrustCA.java because
    of instabilities
    + S8237879: make 4.3 breaks build
    + S8237945: CTW: C2 compilation fails with
    assert(just_allocated_object(alloc_ctl) == ptr) failed: most
    recent allo...
    + S8238225: Issues reported after replacing symlink at
    Contents/MacOS/libjli.dylib with binary
    + S8238247: CTW runner should sweep nmethods more aggressively
    + S8238366: CTW runner closes standard output on exit
    + S8238438: SuperWord::co_locate_pack picks memory state of
    first instead of last load
    + S8238502: sunmscapi.dll causing EXCEPTION_ACCESS_VIOLATION
    + S8238534: Deep sign macOS bundles before bundle archive is
    being created
    + S8238591: CTW: Split
    applications/ctw/modules/jdk_localedata.java
    + S8238596: AVX enabled by default for Skylake even when
    unsupported
    + S8238811: C2: assert(i &gt;= req() || i == 0 || is_Region() ||
    is_Phi()) with -XX:+VerifyGraphEdges
    + S8239005: [TESTBUG] test/hotspot/jtreg/runtime/
    /StackGuardPages/TestStackGuardPages.java: exeinvoke.c: must
    initialize static state before calling do_overflow()
    + S8239466: Loss of precision in counter decay calculation in
    11u backport of JDK-8237375
    + S8239856: [ntintel] asserts about copying unaligned array
    element
    + S8240724: [test] jdk11 downport of 8224475 misses binary file
    test/jdk/javax/swing/JTextPane/arrow.png
    + S8241296: Segfault in JNIHandleBlock::oops_do()
- Removed patch:
  * DependOnVariableHelper.patch
    + fixed upstream
- Added patch:
  * JDK-8228407.patch
    + fix crashes due to shared archive file mismatch</changelog>
  <changelog author="fstrba@suse.com" date="1594900800">- Update to upstream tag jdk-11.0.8+10 (July 2020 CPU, bsc#1174157)
  * Security fixes:
    + JDK-8230613: Better ASCII conversions
    + JDK-8231800: Better listing of arrays
    + JDK-8232014: Expand DTD support
    + JDK-8233234: Better Zip Naming
    + JDK-8233239, CVE-2020-14562: Enhance TIFF support
    + JDK-8233255: Better Swing Buttons
    + JDK-8234032: Improve basic calendar services
    + JDK-8234042: Better factory production of certificates
    + JDK-8234418: Better parsing with CertificateFactory
    + JDK-8234836: Improve serialization handling
    + JDK-8236191: Enhance OID processing
    + JDK-8236867, CVE-2020-14573: Enhance Graal interface handling
    + JDK-8237117, CVE-2020-14556: Better ForkJoinPool behavior
    + JDK-8237592, CVE-2020-14577: Enhance certificate verification
    + JDK-8238002, CVE-2020-14581: Better matrix operations
    + JDK-8238013: Enhance String writing
    + JDK-8238804: Enhance key handling process
    + JDK-8238842: AIOOBE in GIFImageReader.initializeStringTable
    + JDK-8238843: Enhanced font handing
    + JDK-8238920, CVE-2020-14583: Better Buffer support
    + JDK-8238925: Enhance WAV file playback
    + JDK-8240119, CVE-2020-14593: Less Affine Transformations
    + JDK-8240482: Improved WAV file playback
    + JDK-8241379: Update JCEKS support
    + JDK-8241522: Manifest improved jar headers redux
    + JDK-8242136, CVE-2020-14621: Better XML namespace handling
  * Other changes:
    + JDK-6933331: (d3d/ogl) java.lang.IllegalStateException:
    Buffers have not been created
    + JDK-7124307: JSpinner and changing value by mouse
    + JDK-8022574: remove HaltNode code after uncommon trap calls
    + JDK-8039082: [TEST_BUG] Test
    java/awt/dnd/BadSerializationTest/BadSerializationTest.java
    fails
    + JDK-8040630: Popup menus and tooltips flicker with previous
    popup contents when first shown
    + JDK-8044365: (dc) MulticastSendReceiveTests.java failing with
    ENOMEM when joining group (OS X 10.9)
    + JDK-8048215: [TESTBUG]
    java/lang/management/ManagementFactory/ThreadMXBeanProxy.java
    Expected non-null LockInfo
    + JDK-8051349: nsk/jvmti/scenarios/sampling/SP06/sp06t003 fails
    in nightly
    + JDK-8080353: JShell: Better error message on attempting to
    add default method
    + JDK-8139876: Exclude hanging nsk/stress/stack from execution
    with deoptimization enabled
    + JDK-8146090: java/lang/ref/ReachabilityFenceTest.java fails
    with -XX:+DeoptimizeALot
    + JDK-8153430: jdk regression test MletParserLocaleTest,
    ParserInfiniteLoopTest reduce default timeout
    + JDK-8156207: Resource allocated BitMaps are often cleared
    unnecessarily
    + JDK-8159740: JShell: corralled declarations do not have
    correct source to wrapper mapping
    + JDK-8175984: ICC_Profile has un-needed, not-empty finalize
    method
    + JDK-8176359: Frame#setMaximizedbounds not working properly in
    multi screen environments
    + JDK-8183369: RFC unconformity of HttpURLConnection with proxy
    + JDK-8187078: -XX:+VerifyOops finds numerous problems when
    running JPRT
    + JDK-8189861: Refactor CacheFind
    + JDK-8191169: java/net/Authenticator/B4769350.java failed
    intermittently
    + JDK-8191930: [Graal] emits unparseable XML into compile log
    + JDK-8193879: Java debugger hangs on method invocation
    + JDK-8196019: java/awt/Window/Grab/GrabTest.java fails on
    Windows
    + JDK-8196181: sun/java2d/GdiRendering/InsetClipping.java fails
    + JDK-8198000:
    java/awt/List/EmptyListEventTest/EmptyListEventTest.java
    debug assert on Windows
    + JDK-8198001: java/awt/Menu/WrongParentAfterRemoveMenu/
    /WrongParentAfterRemoveMenu.java debug assert on Windows
    + JDK-8198339: Test javax/swing/border/Test6981576.java is
    unstable
    + JDK-8200701: jdk/jshell/ExceptionsTest.java fails on Windows,
    after JDK-8198801
    + JDK-8203264: JNI exception pending in
    PlainDatagramSocketImpl.c:740
    + JDK-8203672: JNI exception pending in PlainSocketImpl.c
    + JDK-8203673: JNI exception pending in
    DualStackPlainDatagramSocketImpl.c:398
    + JDK-8204834: Fix confusing "allocate" naming in OopStorage
    + JDK-8205399: Set node color on pinned HashMap.TreeNode
    deletion
    + JDK-8205653: test/jdk/sun/management/jmxremote/bootstrap/
    /RmiRegistrySslTest.java and RmiSslBootstrapTest.sh fail with
    handshake_failure
    + JDK-8206179: com/sun/management/OperatingSystemMXBean/
    /GetCommittedVirtualMemorySize.java fails with Committed
    virtual memory size illegal value
    + JDK-8207334: VM times out in VM_HandshakeAllThreads::doit()
    with RunThese30M
    + JDK-8208277: Code cache heap (-XX:ReservedCodeCacheSize)
    doesn't work with 1GB LargePages
    + JDK-8209113: Use WeakReference for lastFontStrike for created
    Fonts
    + JDK-8209333: Socket reset issue for TLS 1.3 socket close
    + JDK-8209439: C2 library_call can potentially ignore Math.pow
    intrinsic or use null pointer
    + JDK-8209534: [TESTBUG]runtime/appcds/cacheObject/
    /ArchivedModuleCompareTest.java fails with EnableJVMCI.
    + JDK-8210147: adjust some WSAGetLastError usages in windows
    network coding
    + JDK-8210284: "assert((av &amp; 0x00000001) == 0) failed:
    unsupported V8" on Solaris 11.4
    + JDK-8210303: VM_HandshakeAllThreads fails assert with
    "failed: blocked and not walkable"
    + JDK-8210459: Add support for generating compile_commands.json
    + JDK-8210515: [TESTBUG]CheckArchivedModuleApp.java needs to
    check if EnableJVMCI is set.
    + JDK-8210788: Javadoc for Thread.join(long, int) should
    specify that it waits forever when both arguments are zero
    + JDK-8211301: [macos] support full window content options
    + JDK-8211332: Space for stub routines (code_size2) is too
    small on new Skylake CPUs
    + JDK-8211339: NPE during SSL handshake caused by
    HostnameChecker
    + JDK-8211392: compiler/profiling/
    /spectrapredefineclass_classloaders/Launcher.java times out
    in JDK12 CI
    + JDK-8211743: [AOT] crash in ScopeDesc::decode_body() when
    JVMTI walks AOT frames
    + JDK-8212154: [TESTBUG] CheckArchivedModuleApp fails with NPE
    when JVMCI is absent
    + JDK-8212167: JShell : Stack trace of exception has wrong line
    number
    + JDK-8212933: Thread-SMR: requesting a VM operation whilst
    holding a ThreadsListHandle can cause deadlocks
    + JDK-8212986: Make Visual Studio compiler check less strict
    + JDK-8213250: CDS archive creation aborts due to metaspace
    object allocation failure
    + JDK-8213516: jck test api/javax_accessibility/AccessibleState/
    /fields.html fails intermittent
    + JDK-8213947: ARM32: failed check_simd should set
    UsePopCountInstruction to false
    + JDK-8214418: half-closed SSLEngine status may cause
    application dead loop
    + JDK-8214440: ldap over a TLS connection negotiate failed with
    "javax.net.ssl.SSLPeerUnverifiedException: hostname of the
    server does not match the hostname in the server's
    certificate"
    + JDK-8214444: Wrong strncat limits in dfa.cpp
    + JDK-8214481: freetype path does not disable TrueType hinting
    with AA+FM hints
    + JDK-8214571: -Xdoclint of array serialField gives "error:
    array type not allowed here"
    + JDK-8214856: Errors with JSZip in web console after upgrade
    to 3.1.5
    + JDK-8214862: assert(proj != __null) at compile.cpp:3251
    + JDK-8215369: Jcstress pollute /var/tmp with temporary files.
    + JDK-8215551: Missing case label in nmethod::reloc_string_for()
    + JDK-8215555: TieredCompilation C2 threads can excessively
    block handshakes
    + JDK-8215711: Missing key_share extension for (EC)DHE key
    exchange should alert missing_extension
    + JDK-8216151: [Graal] Module
    jdk.internal.vm.compiler.management has not been granted
    accessClassInPackage.org.graalvm.compiler.debug
    + JDK-8216154: C4819 warnings at HotSpot sources on Windows
    + JDK-8216541: CompiledICHolders of VM locked unloaded nmethods
    are released too late
    + JDK-8217230: assert(t == t_no_spec) failure in
    NodeHash::check_no_speculative_types()
    + JDK-8217404: --with-jvm-features doesn't work when multiple
    features are explicitly disabled
    + JDK-8217447: Develop flag TraceICs is broken
    + JDK-8217606: LdapContext#reconnect always opens a new
    connection
    + JDK-8218807: Compilation database (compile_commands.json) may
    contain obsolete items
    + JDK-8219214: Infinite Loop in CodeSection::dump()
    + JDK-8219904: ClassCastException when calling
    FlightRecorderMXBean#getRecordings()
    + JDK-8219991: New fix of the deadlock in
    sun.security.ssl.SSLSocketImpl
    + JDK-8221121: applications/microbenchmarks are encountering
    crashes in tier5
    + JDK-8221445: FastSysexMessage constructor crashes MIDI
    receiption thread
    + JDK-8221482: Initialize VMRegImpl::regName[] earlier to
    prevent assert during PrintStubCode
    + JDK-8221741: ClassCastException can happen when
    fontconfig.properties is used
    + JDK-8221823: Requested JDialog width is ignored
    + JDK-8223108: Test java/awt/EventQueue/
    /NonComponentSourcePost.java is unstable
    + JDK-8223678: Add Visual Studio Code workspace generation
    support (for native code)
    + JDK-8223935: PIT: java/awt/font/WindowsIndicFonts.java fails
    on windows10
    + JDK-8224109: Text spaced incorrectly by drawString under
    rotation with fractional metric
    + JDK-8224632: testbug: java/awt/dnd/RemoveDropTargetCrashTest/
    /RemoveDropTargetCrashTest.java fails on MacOS
    + JDK-8224793: os::die() does not honor CreateCoredumpOnCrash
    option
    + JDK-8224847: gc/stress/TestReclaimStringsLeaksMemory.java
    fails with reserved greater than expected
    + JDK-8224931: disable JAOTC invokedynamic support until
    8223533 is fixed
    + JDK-8224997: ChaCha20-Poly1305 TLS cipher suite decryption
    throws ShortBufferException
    + JDK-8225068: Remove DocuSign root certificate that is
    expiring in May 2020
    + JDK-8225069: Remove Comodo root certificate that is expiring
    in May 2020
    + JDK-8225126: Test SetBoundsPaintTest.html faild on Windows
    when desktop is scaled
    + JDK-8225325: Add tests for redefining a class' private method
    during resolution of the bootstrap specifier
    + JDK-8225622: [AOT] runtime/SharedArchiveFile/
    /TestInterpreterMethodEntries.java crashed with AOTed
    java.base
    + JDK-8225653: Provide more information when hitting SIGILL
    from HaltNode
    + JDK-8225783: Incorrect use of binary operators on booleans in
    type.cpp
    + JDK-8225789: Empty method parameter type should generate
    ClassFormatError
    + JDK-8226198: use of &amp; instead of &amp;&amp; in
    LibraryCallKit::arraycopy_restore_alloc_state
    + JDK-8226253: JAWS reports wrong number of radio buttons when
    buttons are hidden.
    + JDK-8226653: [accessibility] Can edit text cell correctly,
    but Accessibility Tool reads nothing about editor
    + JDK-8226806: [macOS 10.14] Methods of Java Robot should be
    called from appropriate thread
    + JDK-8226879: Memory leak in Type::hashcons
    + JDK-8227632: Incorrect PrintCompilation message: made not
    compilable on levels 0 1 2 3 4
    + JDK-8228407: JVM crashes with shared archive file mismatch
    + JDK-8228482: fix xlc16/xlclang comparison of distinct pointer
    types and string literal conversion warnings
    + JDK-8228757: Fail fast if the handshake type is unknown
    + JDK-8229158: make UseSwitchProfiling non-experimental or
    false by-default
    + JDK-8229421: The logic of java/net/ipv6tests/TcpTest.java is
    flawed
    + JDK-8229855: C2 fails with assert(false) failed: bad AD file
    + JDK-8230591: AArch64: Missing intrinsics for Math.ceil,
    floor, rint
    + JDK-8231118: ARM32: Math tests failures
    + JDK-8231213: Migrate SimpleDateFormatConstTest to JDK Repo
    + JDK-8231243: [TESTBUG] CustomFont.java cannot find font file
    + JDK-8231438: [macOS] Dark mode for the desktop is not
    supported
    + JDK-8231550: C2: ShouldNotReachHere() in
    verify_strip_mined_scheduling
    + JDK-8231564: setMaximizedBounds is broken with large display
    scale and multiple monitors
    + JDK-8231572: Use -lobjc instead of -fobjc-link-runtime in
    libosxsecurity
    + JDK-8231631: sun/net/ftp/FtpURLConnectionLeak.java fails
    intermittently with NPE
    + JDK-8231671: Fix copyright headers in hotspot (missing comma
    after year)
    + JDK-8231720: Some perf regressions after 8225653
    + JDK-8231779: crash
    HeapWord*ParallelScavengeHeap::failed_mem_allocate
    + JDK-8231863: Crash if classpath is read from @argument file
    and the main gets option argument
    + JDK-8232080: jlink plugins for vendor information and
    run-time options
    + JDK-8232106: [x86] C2: SIGILL due to usage of SSSE3
    instructions on processors which don't support it
    + JDK-8232134: Change to Visual Studio 2017 15.9.16 for
    building on Windows at Oracle
    + JDK-8232226: [macos 10.15] test/jdk/java/awt/color/
    /EqualityTest/EqualityTest.java may fail
    + JDK-8232357: Compare version info of Santuario to legal notice
    + JDK-8232572: Add hooks for custom output dir in Bundles.gmk
    + JDK-8232634: Problem List ICMColorDataTest.java
    + JDK-8232748: Build static versions of certain JDK libraries
    + JDK-8232846: ProcessHandle.Info command with non-English
    shows question marks
    + JDK-8232880: Update test documentation with additional
    settings for client UI tooltip tests
    + JDK-8233033: C2 produces wrong result while unswitching a
    loop due to lost control dependencies
    + JDK-8233137: runtime/ErrorHandling/VeryEarlyAssertTest.java
    fails after 8232080
    + JDK-8233197: Invert JvmtiExport::post_vm_initialized() and
    Jfr:on_vm_start() start-up order for correct option parsing
    + JDK-8233291: [TESTBUG] tools/jlink/plugins/
    /VendorInfoPluginsTest.java fails with debug or non-server VMs
    + JDK-8233364: Fix undefined behavior in
    Canonicalizer::do_ShiftOp
    + JDK-8233494: Avoid calling MallocTracker::record_malloc and
    record_free when NMT is off
    + JDK-8233573: Toolkit.getScreenInsets(GraphicsConfiguration)
    may throw ClassCastException
    + JDK-8233608: Minimal build broken after JDK-8233494
    + JDK-8233621: Mismatch in jsse.enableMFLNExtension property
    name
    + JDK-8233696: [TESTBUG]Some jtreg tests fail when CAPS_LOCK is
    ON
    + JDK-8233707: systemScale.cpp could not compile with VS2019
    + JDK-8233801: GCMEmptyIv.java test fails on Solaris 11.4
    + JDK-8233880: Support compilers with multi-digit major version
    numbers
    + JDK-8233920: MethodHandles::tryFinally generates illegal
    bytecode for long/double return type
    + JDK-8234137: The "AutoTestOnTop.java" test may run external
    applications
    + JDK-8234146: compiler/jsr292/
    /ContinuousCallSiteTargetChange.java times out on SPARC
    + JDK-8234184: [TESTBUG] java/awt/Mouse/EnterExitEvents/
    /ModalDialogEnterExitEventsTest.java fails in Windows
    + JDK-8234270: [REDO] JDK-8204128 NMT might report incorrect
    numbers for Compiler area
    + JDK-8234332: [TESTBUG] java/awt/Focus/DisposedWindow/
    /DisposeDialogNotActivateOwnerTest/
    /DisposeDialogNotActivateOwnerTest.java fails on linux-x64
    nightly
    + JDK-8234398: Replace ID2D1Factory::GetDesktopDpi with
    GetDeviceCaps
    + JDK-8234522: [macos] Crash with use of native file dialog
    + JDK-8234691: Potential double-free in ParallelSPCleanupTask
    constructor
    + JDK-8234696: tools/jlink/plugins/VendorInfoPluginsTest.java
    times out
    + JDK-8234727: sun/security/ssl/X509TrustManagerImpl tests
    support TLSv1.3
    + JDK-8234728: Some security tests should support TLSv1.3
    + JDK-8234779: Provide idiom for declaring classes noncopyable
    + JDK-8234824: java/nio/channels/SocketChannel/AdaptSocket.java
    fails on Windows 10
    + JDK-8234968: check calloc rv in libinstrument
    InvocationAdapter
    + JDK-8235153: [TESTBUG] [macos 10.15] java/awt/Graphics/
    /DrawImageBG/SystemBgColorTest.java fails
    + JDK-8235183: Remove the "HACK CODE" in comment
    + JDK-8235263: Revert TLS 1.3 change that wrapped IOExceptions
    + JDK-8235311: Tag mismatch may alert bad_record_mac
    + JDK-8235332: TestInstanceCloneAsLoadsStores.java fails with
  - XX:+StressGCM
    + JDK-8235452: Strip mined loop verification fails with
    assert(is_OuterStripMinedLoop()) failed: invalid node class
    + JDK-8235584: UseProfiledLoopPredicate fails with
    assert(_phase-&gt;get_loop(c) == loop) failed: have to be in the
    same loop
    + JDK-8235620: Broken merge between JDK-8006406 and JDK-8003559
    + JDK-8235638: NPE in LWWindowPeer.getOnscreenGraphics()
    + JDK-8235686: Add more custom hooks in Bundles.gmk
    + JDK-8235739: Rare NPE at WComponentPeer.getGraphics()
    + JDK-8235762: JVM crash in SWPointer during C2 compilation
    + JDK-8235834: IBM-943 charset encoder needs updating
    + JDK-8235874: The ordering of Cipher Suites is not maintained
    provided through jdk.tls.client.cipherSuites and
    jdk.tls.server.cipherSuites system property.
    + JDK-8235908: omit ThreadPriorityPolicy warning when value is
    set from image
    + JDK-8235984: C2: assert(out-&gt;in(PhiNode::Region) == head ||
    out-&gt;in(PhiNode::Region) == slow_head) failed: phi must be
    either part of the slow or the fast loop
    + JDK-8236211: [Graal] compiler/graalunit/GraphTest.java is
    skipped in all testing
    + JDK-8236470: Deal with ECDSA using ecdsa-with-SHA2 plus hash
    algorithm as AlgorithmId
    + JDK-8236545: Compilation error in mach5
    java/awt/FileDialog/MacOSGoToFolderCrash.java
    + JDK-8236700: Upgrading JSZip from v3.1.5 to v3.2.2
    + JDK-8236759: ShouldNotReachHere in
    PhaseIdealLoop::verify_strip_mined_scheduling
    + JDK-8236897: Fix the copyright header for pkcs11gcm2.h
    + JDK-8236921: Add build target to produce a JDK image suitable
    for a Graal/SVM build
    + JDK-8236953: [macos] JavaFX SwingNode is not rendered on macOS
    + JDK-8236996: Incorrect Roboto font rendering on Windows with
    subpixel antialiasing
    + JDK-8237045: JVM uses excessive memory with -XX:+EnableJVMCI
  - XX:JVMCICounterSize=2147483648
    + JDK-8237055: [TESTBUG] compiler/c2/TestJumpTable.java fails
    with release VMs
    + JDK-8237086: assert(is_MachReturn()) running CTW with fix for
    JDK-8231291
    + JDK-8237192: Generate stripped/public pdbs on Windows for jdk
    images
    + JDK-8237396: JvmtiTagMap::weak_oops_do() should not trigger
    barriers
    + JDK-8237474: Default SSLEngine should create in server role
    + JDK-8237859: C2: Crash when loads float above range check
    + JDK-8237879: make 4.3 breaks build
    + JDK-8237951: CTW: C2 compilation fails with "malformed
    control flow"
    + JDK-8237962: give better error output for invalid OCSP
    response intervals in CertPathValidator checks
    + JDK-8238190: [JVMCI] Fix single implementor speculation for
    diamond shapes.
    + JDK-8238356: CodeHeap::blob_count() overestimates the number
    of blobs
    + JDK-8238452: Keytool generates wrong expiration date if
    validity is set to 2050/01/01
    + JDK-8238555: Allow Initialization of SunPKCS11 with NSS when
    there are external FIPS modules in the NSSDB
    + JDK-8238575: DragSourceEvent.getLocation() returns wrong
    value on HiDPI screens (Windows)
    + JDK-8238676: jni crashes on accessing it from process exit
    hook
    + JDK-8238721: Add failing client jtreg tests to the Problem
    List
    + JDK-8238738: AudioSystem.getMixerInfo() takes about 30 sec to
    report a gone audio device
    + JDK-8238756: C2: assert(((n) == __null || !VerifyIterativeGVN
    || !((n)-&gt;is_dead()))) failed: can not use dead node
    + JDK-8238765: PhaseCFG::schedule_pinned_nodes cannot handle
    precedence edges from unmatched CFG nodes correctly
    + JDK-8238898: Missing hash characters for header on license
    file
    + JDK-8238942: Rendering artifacts with LCD text and fractional
    metrics
    + JDK-8238985: [TESTBUG] The arrow image is blue instead of
    green
    + JDK-8239000: handle ContendedPaddingWidth in vm_version_ppc
    + JDK-8239055: Wrong implementation of VMState.hasListener
    + JDK-8239091: Reversed arguments in call to strstr in freetype
    "debug" code.
    + JDK-8239142: C2's UseUniqueSubclasses optimization is broken
    for array accesses
    + JDK-8239224: libproc_impl.c previous_thr may be used
    uninitialized warning
    + JDK-8239351: Give more meaningful InternalError messages in
    Deflater.c
    + JDK-8239365: ProcessBuilder test modifications for AIX
    execution
    + JDK-8239456: vtable stub generation: assert failure (code
    size estimate)
    + JDK-8239457: call ReleaseStringUTFChars before early returns
    in Java_sun_security_pkcs11_wrapper_PKCS11_connect
    + JDK-8239462: jdk.hotspot.agent misses some
    ReleaseStringUTFChars calls in case of early returns
    + JDK-8239557: [TESTBUG] VeryEarlyAssertTest.java validating
    "END." marker at lastline is not always true
    + JDK-8239787: AArch64: String.indexOf may incorrectly handle
    empty strings
    + JDK-8239792: Bump update version for OpenJDK: jdk-11.0.8
    + JDK-8239798: SSLSocket closes socket both socket endpoints on
    a SocketTimeoutException
    + JDK-8239819: XToolkit: Misread of screen information memory
    + JDK-8239852: java/util/concurrent tests fail with
  - XX:+VerifyGraphEdges: assert(!VerifyGraphEdges) failed:
    verification should have failed
    + JDK-8239893: Windows handle Leak when starting processes
    using ProcessBuilder
    + JDK-8239915: Zero VM crashes when handling dynamic constant
    + JDK-8239931: [win][x86] vtable stub generation: assert
    failure (code size estimate) follow-up
    + JDK-8239965: XMLEncoder/Test4625418.java fails due to "Error:
    Cp943 - can't read properly"
    + JDK-8239976: Put JDK-8239965 on the ProblemList.txt
    + JDK-8240073: Fix 'test-make' build target in 11u
    + JDK-8240197: Cannot start JVM when $JAVA_HOME includes CJK
    characters
    + JDK-8240202: A few client tests leave mouse buttons pressed
    + JDK-8240220: IdealLoopTree::dump_head predicate printing is
    broken
    + JDK-8240223: Use consistent predicate order in and with
    PhaseIdealLoop::find_predicate
    + JDK-8240227: Loop predicates should be copied to unswitched
    loops
    + JDK-8240286: [TESTBUG] Test command error in hotspot/jtreg/
    /compiler/loopopts/superword/SumRedAbsNeg_Float.java
    + JDK-8240518: Incorrect JNU_ReleaseStringPlatformChars in
    Windows Print
    + JDK-8240529: CheckUnhandledOops breaks NULL check in
    Modules::define_module
    + JDK-8240576: JVM crashes after transformation in C2
    IdealLoopTree::merge_many_backedges
    + JDK-8240603: Windows 32bit compile error after 8238676
    + JDK-8240629: argfiles parsing broken for argfiles with
    comment cross 4096 bytes chunk
    + JDK-8240711: TestJstatdPort.java failed due to
    "ExportException: Port already in use:"
    + JDK-8240786: [TESTBUG] The test java/awt/Window/
    /GetScreenLocation/GetScreenLocationTest.java fails on HiDPI
    screen
    + JDK-8240824: enhance print_full_memory_info on Linux by THP
    related information
    + JDK-8240827: Downport SSLSocketImpl.java from "8221882: Use
    fiber-friendly java.util.concurrent.locks in JSSE"
    + JDK-8240905: assert(mem == (Node*)1 || mem == mem2) failed:
    multiple Memories being matched at once?
    + JDK-8240972: macOS codesign fail on macOS 10.13.5 or older
    + JDK-8241445: Fix copyright in
    test/jdk/tools/launcher/ArgFileSyntax.java
    + JDK-8241458: [JVMCI] add mark value to expose
    CodeOffsets::Frame_Complete
    + JDK-8241464: [11u] Backport: make rehashing be a needed
    guaranteed safepoint cleanup action
    + JDK-8241556: Memory leak if -XX:CompileCommand is set
    + JDK-8241568: (fs) UserPrincipalLookupService.lookupXXX
    failure with IOE "Operation not permitted"
    + JDK-8241586: compiler/cpuflags/
    /TestAESIntrinsicsOnUnsupportedConfig.java fails on aarch64
    + JDK-8241638: launcher time metrics always report 1 on Linux
    when _JAVA_LAUNCHER_DEBUG set
    + JDK-8241660: Add virtualization information output to hs_err
    file on macOS
    + JDK-8241808: [TESTBUG] The JDK-8039467 bug appeared on macOS
    + JDK-8241888: Mirror jdk.security.allowNonCaAnchor system
    property with a security one
    + JDK-8241900: Loop unswitching may cause dependence on null
    check to be lost
    + JDK-8241948: enhance list of environment variables printed in
    hs_err file
    + JDK-8241996: on linux set full relro in the linker flags
    + JDK-8242108: Performance regression after fix for JDK-8229496
    + JDK-8242141: New System Properties to configure the TLS
    signature schemes
    + JDK-8242154: Backport parts of JDK-4947890 to OpenJDK 11u
    + JDK-8242174: [macos] The NestedModelessDialogTest test make
    the macOS unstable
    + JDK-8242239: [Graal] javax/management/generified/
    /GenericTest.java fails: FAILED: queryMBeans sets same
    + JDK-8242294: JSSE Client does not throw SSLException when an
    alert occurs during handshaking
    + JDK-8242379: [TESTBUG] compiler/loopopts/
    /TestLoopUnswitchingLostCastDependency.java fails with
    release VMs
    + JDK-8242470: Update Xerces to Version 2.12.1
    + JDK-8242498: Invalid "sun.awt.TimedWindowEvent" object leads
    to JVM crash
    + JDK-8242541: Small charset issues (ISO8859-16, x-eucJP-Open,
    x-IBM834 and x-IBM949C)
    + JDK-8242626: enhance posix print_rlimit_info
    + JDK-8243059: Build fails when --with-vendor-name contains a
    comma
    + JDK-8243539: Copyright info (Year) should be updated for fix
    of 8241638
    + JDK-8243541: (tz) Upgrade time-zone data to tzdata2020a
    + JDK-8244407: JVM crashes after transformation in C2
    IdealLoopTree::split_fall_in
    + JDK-8244520: problemlist
    java/awt/font/Rotate/RotatedFontTest.java on linux
    + JDK-8244777: ClassLoaderStats VM Op uses constant hash value
    + JDK-8244853: The static build of libextnet is missing the
    JNI_OnLoad_extnet function
    + JDK-8244951: Missing entitlements for hardened runtime
    + JDK-8245047: [PPC64] C2: ReverseBytes + Load always match to
    unordered Load (acquire semantics missing)
    + JDK-8245649: Revert 8245397 backport of 8230591
    + JDK-8246031: SSLSocket.getSession() doesn't close connection
    for timeout/ interrupts
    + JDK-8246613: Choose the default SecureRandom algo based on
    registration ordering
    + JDK-8248505: Unexpected NoSuchAlgorithmException when using
    secure random impl from BCFIPS provider
- Removed patch:
  * JDK-8228407.patch
    + integrated upstream</changelog>
  <changelog author="fstrba@suse.com" date="1604318400">- Update to upstream tag jdk-11.0.9-11 (October 2020 CPU,
  bsc#1177943)
  * New features
    + JDK-8250784: Shenandoah: A Low-Pause-Time Garbage Collector
  * Security fixes
    + JDK-8233624: Enhance JNI linkage
    + JDK-8236196: Improve string pooling
    + JDK-8236862, CVE-2020-14779: Enhance support of Proxy class
    + JDK-8237990, CVE-2020-14781: Enhanced LDAP contexts
    + JDK-8237995, CVE-2020-14782: Enhance certificate processing
    + JDK-8240124: Better VM Interning
    + JDK-8241114, CVE-2020-14792: Better range handling
    + JDK-8242680, CVE-2020-14796: Improved URI Support
    + JDK-8242685, CVE-2020-14797: Better Path Validation
    + JDK-8242695, CVE-2020-14798: Enhanced buffer support
    + JDK-8243302: Advanced class supports
    + JDK-8244136, CVE-2020-14803: Improved Buffer supports
    + JDK-8244479: Further constrain certificates
    + JDK-8244955: Additional Fix for JDK-8240124
    + JDK-8245407: Enhance zoning of times
    + JDK-8245412: Better class definitions
    + JDK-8245417: Improve certificate chain handling
    + JDK-8248574: Improve jpeg processing
    + JDK-8249927: Specify limits of jdk.serialProxyInterfaceLimit
    + JDK-8253019: Enhanced JPEG decoding
  * Other changes
    + JDK-6532025: GIF reader throws misleading exception with
    truncated images
    + JDK-6949753: [TEST BUG]: java/awt/print/PageFormat/
    /PDialogTest.java needs update by removing an infinite loop
    + JDK-8022535: [TEST BUG] javax/swing/text/html/parser/
    /Test8017492.java fails
    + JDK-8062947: Fix exception message to correctly represent
    LDAP connection failure
    + JDK-8067354: com/sun/jdi/GetLocalVariables4Test.sh failed
    + JDK-8134599: TEST_BUG: java/rmi/transport/closeServerSocket/
    /CloseServerSocket.java fails intermittently with Address
    already in use
    + JDK-8151678: com/sun/jndi/ldap/LdapTimeoutTest.java failed
    due to timeout on DeadServerNoTimeoutTest is incorrect
    + JDK-8160768: Add capability to custom resolve host/domain
    names within the default JNDI LDAP provider
    + JDK-8172404: Tools should warn if weak algorithms are used
    before restricting them
    + JDK-8193367: Annotated type variable bounds crash javac
    + JDK-8202117: com/sun/jndi/ldap/RemoveNamingListenerTest.java
    fails intermittently: Connection reset
    + JDK-8203026: java.rmi.NoSuchObjectException: no such object
    in table
    + JDK-8203281: [Windows] JComboBox change in ui when
    editor.setBorder() is called
    + JDK-8203382: Rename SystemDictionary::initialize_wk_klass to
    resolve_wk_klass
    + JDK-8203393: com/sun/jdi/JdbMethodExitTest.sh and
    JdbExprTest.sh fail due to timeout
    + JDK-8203928: [Test] Convert non-JDB scaffolding
    serviceability shell script tests to java
    + JDK-8204963: javax.swing.border.TitledBorder has a memory leak
    + JDK-8204994: SA might fail to attach to process with "Windbg
    Error: WaitForEvent failed"
    + JDK-8205534: Remove SymbolTable dependency from
    serviceability agent
    + JDK-8206309: Tier1 SA tests fail
    + JDK-8208281: java/nio/channels/
    /AsynchronousSocketChannel/Basic.java timed out
    + JDK-8209109: [TEST] rewrite com/sun/jdi shell tests to java
    version - step1
    + JDK-8209332: [TEST] test/jdk/com/sun/jdi/CatchPatternTest.sh
    is incorrect
    + JDK-8209342: Problemlist SA tests on Solaris due to Error
    attaching to process: Can't create thread_db agent!
    + JDK-8209343: Test javax/swing/border/TestTitledBorderLeak.java
    should be marked as headful
    + JDK-8209517: com/sun/jdi/BreakpointWithFullGC.java fails with
    timeout
    + JDK-8209604: [TEST] rewrite com/sun/jdi shell tests to java
    version - step2
    + JDK-8209605: com/sun/jdi/BreakpointWithFullGC.java fails with
    ZGC
    + JDK-8209608: Problem list com/sun/jdi/BreakpointWithFullGC.java
    + JDK-8210131: vmTestbase/nsk/jvmti/scenarios/allocation/AP10/
    /ap10t001/TestDescription.java failed with ObjectFree:
    GetCurrentThreadCpuTimerInfo returned unexpected error code
    + JDK-8210243: [TEST] rewrite com/sun/jdi shell tests to java
    version - step3
    + JDK-8210527: JShell: NullPointerException in
    jdk.jshell.Eval.translateExceptionStack
    + JDK-8210560: [TEST] convert com/sun/jdi redefineClass-related
    tests
    + JDK-8210725: com/sun/jdi/RedefineClearBreakpoint.java fails
    with waitForPrompt timed out after 60 seconds
    + JDK-8210748: [TESTBUG] lib.jdb.Jdb.waitForPrompt() should
    clarify which output is the pending reply after a timeout
    + JDK-8210760: [TEST] rewrite com/sun/jdi shell tests to java
    version - step4
    + JDK-8210977: jdk/jfr/event/oldobject/TestThreadLocalLeak.java
    fails to find ThreadLocalObject
    + JDK-8211292: [TEST] convert com/sun/jdi/DeferredStepTest.sh
    test
    + JDK-8211694: JShell: Redeclared variable should be reset
    + JDK-8212200: assert when shared java.lang.Object is redefined
    by JVMTI agent
    + JDK-8212629: [TEST] wrong breakpoint in
    test/jdk/com/sun/jdi/DeferredStepTest
    + JDK-8212665: com/sun/jdi/DeferredStepTest.java: jj1 (line 57)
  - unexpected. lastLine=52, minLine=52, maxLine=55
    + JDK-8212807: tools/jar/multiRelease/Basic.java times out
    + JDK-8213182: Minimal VM build failure after JDK-8212200
    (assert when shared java.lang.Object is redefined by JVMTI
    agent)
    + JDK-8213214: Set -Djava.io.tmpdir= when running tests
    + JDK-8213275: ReplaceCriticalClasses.java fails with
    jdk.internal.vm.PostVMInitHook not found
    + JDK-8213574: Deadlock in string table expansion when dumping
    lots of CDS classes
    + JDK-8213703: LambdaConversionException: Invalid receiver type
    not a subtype of implementation type interface
    + JDK-8214074: Ghash optimization using AVX instructions
    + JDK-8214491: Upgrade to JLine 3.9.0
    + JDK-8214797: TestJmapCoreMetaspace.java timed out
    + JDK-8215243: JShell tests failing intermitently with
    "Problem cleaning up the following threads:"
    + JDK-8215244: jdk/jshell/ToolBasicTest.java
    testHistoryReference failed
    + JDK-8215354: x86_32 build failures after JDK-8214074 (Ghash
    optimization using AVX instructions)
    + JDK-8215438: jshell tool: Ctrl-D causes EOF
    + JDK-8216021: RunTest.gmk might set concurrency level to 1 on
    Windows
    + JDK-8216974: HttpConnection not returned to the pool after
    204 response
    + JDK-8218948: SimpleDateFormat :: format - Zone Names are not
    reflected correctly during run time
    + JDK-8219712: code_size2 (defined in stub_routines_x86.hpp) is
    too small on new Skylake CPUs
    + JDK-8220150: macos10.14 Mojave returns anti-aliased glyphs
    instead of aliased B&amp;W glyphs
    + JDK-8221658: aarch64: add necessary predicate for ubfx
    patterns
    + JDK-8221759: Crash when completing "java.io.File.path"
    + JDK-8221918: runtime/SharedArchiveFile/serviceability/
    /ReplaceCriticalClasses.java fails: Shared archive not found
    + JDK-8222074: Enhance auto vectorization for x86
    + JDK-8222079: Don't use memset to initialize fields decode_env
    constructor in disassembler.cpp
    + JDK-8222769: [TESTBUG] TestJFRNetworkEvents should not rely
    on hostname command
    + JDK-8223688: JShell: crash on the instantiation of raw
    anonymous class
    + JDK-8223777: In posix_spawn mode, failing to exec()
    jspawnhelper does not result in an error
    + JDK-8223940: Private key not supported by chosen signature
    algorithm
    + JDK-8224184: jshell got IOException at exiting with AIX
    + JDK-8224234: compiler/codegen/TestCharVect2.java fails in
    test_mulc
    + JDK-8225037: java.net.JarURLConnection::getJarEntry() throws
    NullPointerException
    + JDK-8225625: AES Electronic Codebook (ECB) encryption and
    decryption optimization using AVX512 + VAES instructions
    + JDK-8226536: Catch OOM from deopt that fails rematerializing
    objects
    + JDK-8226575: OperatingSystemMXBean should be made container
    aware
    + JDK-8226697: Several tests which need the @key headful
    keyword are missing it.
    + JDK-8226809: Circular reference in printed stack trace is not
    correctly indented &amp; ambiguous
    + JDK-8227059: sun/security/tools/keytool/
    /DefaultSignatureAlgorithm.java timed out
    + JDK-8227269: Slow class loading when running with JDWP
    + JDK-8227595: keytool/fakegen/DefaultSignatureAlgorithm.java
    fails due to "exitValue = 6"
    + JDK-8228448: Jconsole can't connect to itself
    + JDK-8228967: Trust/Key store and SSL context utilities for
    tests
    + JDK-8229378: jdwp library loader in linker_md.c quietly
    truncates on buffer overflow
    + JDK-8229815: Upgrade Jline to 3.12.1
    + JDK-8230000: some httpclients testng tests run zero test
    + JDK-8230002: javax/xml/jaxp/unittest/transform/
    /SecureProcessingTest.java runs zero test
    + JDK-8230010: Remove jdk8037819/BasicTest1.java
    + JDK-8230094: CCE in createXMLEventWriter(Result) over an
    arbitrary XMLStreamWriter
    + JDK-8230402: Allocation of compile task fails with assert:
    "Leaking compilation tasks?"
    + JDK-8230767: FlightRecorderListener returns null recording
    + JDK-8230870: (zipfs) Add a ZIP FS test that is similar to
    test/jdk/java/util/zip/EntryCount64k.java
    + JDK-8231209: [REDO] ThreadMXBean::getThreadAllocatedBytes()
    can be quicker for self thread
    + JDK-8231586: enlarge encoding space for OopMapValue offsets
    + JDK-8231953: Wrong assumption in assertion in
    oop::register_oop
    + JDK-8231968: getCurrentThreadAllocatedBytes default
    implementation s/b getThreadAllocatedBytes
    + JDK-8232083: Minimal VM is broken after JDK-8231586
    + JDK-8232161: Align some one-way conversion in MS950 charset
    with Windows
    + JDK-8232855: jshell missing word in /help help
    + JDK-8233027: OopMapSet::all_do does oms.next() twice during
    iteration
    + JDK-8233228: Disable weak named curves by default in TLS,
    CertPath, and Signed JAR
    + JDK-8233386: Initialize NULL fields for unused decorations
    + JDK-8233452: java.math.BigDecimal.sqrt() with
    RoundingMode.FLOOR results in incorrect result
    + JDK-8233686: XML transformer uses excessive amount of memory
    + JDK-8233741: AES Countermode (AES-CTR) optimization using
    AVX512 + VAES instructions
    + JDK-8233829: javac cannot find non-ASCII module name under
    non-UTF8 environment
    + JDK-8233958: Memory retention due to HttpsURLConnection
    finalizer that serves no purpose
    + JDK-8234011: (zipfs) Memory leak in
    ZipFileSystem.releaseDeflater()
    + JDK-8234058: runtime/CompressedOops/
    /CompressedClassPointers.java fails with 'Narrow klass base:
    0x0000000000000000' missing from stdout/stderr
    + JDK-8234149: Several regression tests do not dispose Frame at
    end
    + JDK-8234347: "Turkey" meta time zone does not generate
    composed localized names
    + JDK-8234385: [TESTBUG] java/awt/EventQueue/6980209/
    /bug6980209.java fails in linux nightly
    + JDK-8234535: Cross compilation fails due to missing CFLAGS
    for the BUILD_CC
    + JDK-8234541: C1 emits an empty message when it inlines
    successfully
    + JDK-8234687: change javap reporting on unknown attributes
    + JDK-8236464: SO_LINGER option is ignored by SSLSocket in JDK
    11
    + JDK-8236548: Localized time zone name inconsistency between
    English and other locales
    + JDK-8236617: jtreg test containers/docker/
    /TestMemoryAwareness.java fails after 8226575
    + JDK-8237182: Update copyright header for shenandoah and
    epsilon files
    + JDK-8237888: security/infra/java/security/cert/
    /CertPathValidator/certification/LuxTrustCA.java fails when
    checking validity interval
    + JDK-8237977: Further update
    javax/net/ssl/compatibility/Compatibility.java
    + JDK-8238270: java.net HTTP/2 client does not decrease stream
    count when receives 204 response
    + JDK-8238284: [macos] Zero VM build fails due to an obvious
    typo
    + JDK-8238380: java.base/unix/native/libjava/childproc.c
    "multiple definition" link errors with GCC10
    + JDK-8238386: (sctp) jdk.sctp/unix/native/libsctp/SctpNet.c
    "multiple definition" link errors with GCC10
    + JDK-8238388: libj2gss/NativeFunc.o "multiple definition" link
    errors with GCC10
    + JDK-8238448: RSASSA-PSS signature verification fail when
    using certain odd key sizes
    + JDK-8238710: LingeredApp doesn't log stdout/stderr if exits
    with non-zero code
    + JDK-8239083: C1 assert(known_holder == NULL ||
    (known_holder-&gt;is_instance_klass() &amp;&amp;
    (!known_holder-&gt;is_interface() ||
    ((ciInstanceKlass*)known_holder)-&gt;has_nonstatic_concrete_methods())),
    "should be non-static concrete method");
    + JDK-8239385: KerberosTicket client name refers wrongly to
    sAMAccountName in AD
    + JDK-8240169: javadoc fails to link to non-modular api docs
    + JDK-8240295: hs_err elapsed time in seconds is not accurate
    enough
    + JDK-8240360: NativeLibraryEvent has wrong library name on
    Linux
    + JDK-8240676: Meet not symmetric failure when running lucene
    on jdk8
    + JDK-8241007: Shenandoah: remove
    ShenandoahCriticalControlThreadPriority support
    + JDK-8241065: Shenandoah: remove leftover code after
    JDK-8231086
    + JDK-8241086: Test runtime/NMT/HugeArenaTracking.java is
    failing on 32bit Windows
    + JDK-8241130: com.sun.jndi.ldap.EventSupport.removeDeadNotifier:
    java.lang.NullPointerException
    + JDK-8241138: http.nonProxyHosts=* causes
    StringIndexOutOfBoundsException in DefaultProxySelector
    + JDK-8241319: WB_GetCodeBlob doesn't have ResourceMark
    + JDK-8241478: vmTestbase/gc/gctests/Steal/steal001/steal001.java
    fails with OOME
    + JDK-8241574: Shenandoah: remove ShenandoahAssertToSpaceClosure
    + JDK-8241750: x86_32 build failure after JDK-8227269
    + JDK-8242184: CRL generation error with RSASSA-PSS
    + JDK-8242283: Can't start JVM when java home path includes
    non-ASCII character
    + JDK-8242556: Cannot load RSASSA-PSS public key with non-null
    params from byte array
    + JDK-8243029: Rewrite javax/net/ssl/compatibility/
    /Compatibility.java with a flexible interop test framework
    + JDK-8243138: Enhance BaseLdapServer to support starttls
    extended request
    + JDK-8243320: Add SSL root certificates to Oracle Root CA
    program
    + JDK-8243321: Add Entrust root CA - G4 to Oracle Root CA
    program
    + JDK-8243389: enhance os::pd_print_cpu_info on linux
    + JDK-8243453: java --describe-module failed with non-ASCII
    module name under non-UTF8 environment
    + JDK-8243470: [macos] bring back O2 opt level for unsafe.cpp
    + JDK-8243489: Thread CPU Load event may contain wrong data for
    CPU time under certain conditions
    + JDK-8243925: Toolkit#getScreenInsets() returns wrong value on
    HiDPI screens (Windows)
    + JDK-8244087: 2020-04-24 public suffix list update
    + JDK-8244151: Update MUSCLE PC/SC-Lite headers to the latest
    release 1.8.26
    + JDK-8244164: AArch64: jaotc generates incorrect code for
    compressed OOPs with non-zero heap base
    + JDK-8244196: adjust output in os_linux
    + JDK-8244225: stringop-overflow warning on strncpy call from
    compile_the_world_in
    + JDK-8244287: JFR: Methods samples have line number 0
    + JDK-8244703: "platform encoding not initialized" exceptions
    with debugger, JNI
    + JDK-8244719: CTW: C2 compilation fails with
    "assert(!VerifyHashTableKeys || _hash_lock == 0) failed:
    remove node from hash table before modifying it"
    + JDK-8244729: Shenandoah: remove resolve paths from
    SBSA::generate_shenandoah_lrb
    + JDK-8244763: Update --release 8 symbol information after JSR
    337 MR3
    + JDK-8244818: Java2D Queue Flusher crash while moving
    application window to external monitor
    + JDK-8245151: jarsigner should not raise duplicate warnings on
    verification
    + JDK-8245616: Bump update version for OpenJDK: jdk-11.0.9
    + JDK-8245714: "Bad graph detected in build_loop_late" when
    loads are pinned on loop limit check uncommon branch
    + JDK-8245801: StressRecompilation triggers assert "redundunt
    OSR recompilation detected. memory leak in CodeCache!"
    + JDK-8245832: JDK build make-static-libs should build all JDK
    libraries
    + JDK-8245880: Shenandoah: check class unloading flag early in
    concurrent code root scan
    + JDK-8245981: Upgrade to jQuery 3.5.1
    + JDK-8246027: Minimal fastdebug build broken after JDK-8245801
    + JDK-8246094: [macos] Sound Recording and playback is not
    working
    + JDK-8246153: TestEliminateArrayCopy fails with
  - XX:+StressReflectiveCode
    + JDK-8246193: Possible NPE in ENC-PA-REP search in AS-REQ
    + JDK-8246196: javax/management/MBeanServer/OldMBeanServerTest
    fails with AssertionError
    + JDK-8246203: Segmentation fault in verification due to stack
    overflow with -XX:+VerifyIterativeGVN
    + JDK-8246330: Add TLS Tests for Legacy ECDSA curves
    + JDK-8246453: TestClone crashes with "all collected exceptions
    must come from the same place"
    + JDK-8247246: Add explicit ResolvedJavaType.link and expose
    presence of default methods
    + JDK-8247350: [aarch64] assert(false) failed: wrong size of
    mach node
    + JDK-8247502: PhaseStringOpts crashes while optimising
    effectively dead code
    + JDK-8247615: Initialize the bytes left for the heap sampler
    + JDK-8247824: CTW: C2 (Shenandoah) compilation fails with SEGV
    in SBC2Support::pin_and_expand
    + JDK-8247874: Replacement in VersionProps.java.template not
    working when --with-vendor-bug-url contains '&amp;'
    + JDK-8247979: aarch64: missing side effect of killing flags
    for clearArray_reg_reg
    + JDK-8248214: Add paddings for TaskQueueSuper to reduce
    false-sharing cache contention
    + JDK-8248219: aarch64: missing memory barrier in
    fast_storefield and fast_accessfield
    + JDK-8248348: Regression caused by the update to BCEL 6.0
    + JDK-8248385: [testbug][11u] Adapt TestInitiExceptions to
    jtreg 5.1
    + JDK-8248495: [macos] zerovm is broken due to libffi headers
    location
    + JDK-8248851: CMS: Missing memory fences between free chunk
    check and klass read
    + JDK-8248987: AOT's Linker.java seems to eagerly fail-fast on
    Windows
    + JDK-8249159: Downport test rework for SSLSocketTemplate from
    8224650
    + JDK-8249215: JFrame::setVisible crashed with
  - Dfile.encoding=UTF-8 on Japanese Windows.
    + JDK-8249251: [dark_mode ubuntu 20.04] The selected menu is
    not highlighted in GTKLookAndFeel
    + JDK-8249255: Build fails if source code in cygwin home dir
    + JDK-8249277: TestVerifyIterativeGVN.java is failing with
    timeout in OpenJDK 11
    + JDK-8249278: Revert JDK-8226253 which breaks the spec of
    AccessibleState.SHOWING for JList
    + JDK-8249560: Shenandoah: Fix racy GC request handling
    + JDK-8249801: Shenandoah: Clear soft-refs on requested GC cycle
    + JDK-8249953: Shenandoah: gc/shenandoah/mxbeans tests should
    account for corner cases
    + JDK-8250582: Revert Principal Name type to NT-UNKNOWN when
    requesting TGS Kerberos tickets
    + JDK-8250609: C2 crash in IfNode::fold_compares
    + JDK-8250627: Use -XX:+/-UseContainerSupport for
    enabling/disabling Java container metrics
    + JDK-8250755: Better cleanup for
    jdk/test/javax/imageio/plugins/shared/CanWriteSequence.java
    + JDK-8250787: Provider.put no longer registering aliases in
    FIPS env
    + JDK-8250826: jhsdb does not work with coredump which comes
    from Substrate VM
    + JDK-8250827: Shenandoah: needs to reset/finish StringTable's
    dead count before/after parallel walk
    + JDK-8250844: Make sure {type,obj}ArrayOopDesc accessors check
    the bounds
    + JDK-8251117: Cannot check P11Key size in P11Cipher and
    P11AEADCipher
    + JDK-8251354: Shenandoah: Fix jdk/jfr/tool/TestPrintJSON.java
    test failure
    + JDK-8251451: Shenandoah: Remark ObjectSynchronizer roots with
    I-U
    + JDK-8251469: Better cleanup for
    test/jdk/javax/imageio/SetOutput.java
    + JDK-8251487: Shenandoah: missing detail timing tracking for
    final mark cleaning phase
    + JDK-8252120: compiler/oracle/TestCompileCommand.java
    misspells "occured"
    + JDK-8252157: JDK-8231209 11u backport breaks jmm binary
    compatibility
    + JDK-8252258: [11u] JDK-8242154 changes the default vendor
    + JDK-8252804: [test] Fix 'ReleaseDeflater.java' test after
    downport of 8234011
    + JDK-8253134: JMM_VERSION should remain at 0x20020000 (JDK 10)
    in JDK 11
    + JDK-8253283: [11u] Test build/translations/
    /VerifyTranslations.java failing after JDK-8252258
    + JDK-8253813: Backout JDK-8244287 from 11u: it causes several
    crashes
- Removed patch:
  * gcc-fno-common-fix.patch
    + not needed any more with this version
- Added patch:
  * JDK-8250861.patch
    + Fix regression "8250861: Crash in MinINode::Ideal(PhaseGVN*,
    bool)" introduced in jdk 11.0.9</changelog>
  <changelog author="fstrba@suse.com" date="1604491200">- Enable Sheandoah GC for x86_64 (jsc#ECO-3171)</changelog>
  <changelog author="fstrba@suse.com" date="1605528000">- Update to upstream tag jdk-11.0.9.1-1
  * Fix:
    + JDK-8250861: Crash in MinINode::Ideal(PhaseGVN*, bool)
- Removed patch:
  * JDK-8250861.patch
    + Integrated upstream</changelog>
  <changelog author="fstrba@suse.com" date="1611230400">- Update to upstream tag jdk-11.0.10+9 (January 2021 CPU,
  bsc#1181239)
  * Security fixes
    + JDK-8247619: Improve Direct Buffering of Characters
  * Other changes
    + JDK-6722928: Support SSPI as a native GSS-API provider
    + JDK-7185258: [macosx] Deadlock in SunToolKit.realSync()
    + JDK-8152332: [macosx] JFileChooser cannot be serialized on
    Mac OS X
    + JDK-8161684: [testconf] Add VerifyOops' testing into compiler
    tiers
    + JDK-8171279: Support X25519 and X448 in TLS
    + JDK-8173361: various crashes in
    JvmtiExport::post_compiled_method_load
    + JDK-8173658: JvmtiExport::post_class_unload() is broken for
    non-JavaThread initiators
    + JDK-8191006: hsdis disassembler plugin does not compile with
    binutils 2.29+
    + JDK-8197981: Missing return statement in
    __sync_val_compare_and_swap_8
    + JDK-8198334: java/awt/FileDialog/8003399/bug8003399.java
    fails in headless mode
    + JDK-8200151: Add 8 JNDI tests to com/sun/jndi/dns/ConfigTests/
    + JDK-8208279: Add 8 JNDI tests to com/sun/jndi/dns/EnvTests/
    + JDK-8208483: Add 5 JNDI tests to
    com/sun/jndi/dns/FactoryTests/
    + JDK-8208542: Add 4 JNDI tests to com/sun/jndi/dns/ListTests/
    + JDK-8208665: Amend cross-compilation docs with
    qemu-debootstrap recipe
    + JDK-8210088: ProblemList gc/epsilon/TestMemoryMXBeans.java
    + JDK-8210339: Add 10 JNDI tests to com/sun/jndi/dns/FedTests/
    + JDK-8211450: UndetVar::dup is not copying the kind field to
    the duplicated instance
    + JDK-8212160: JVMTI agent crashes with "assert(_value != 0LL)
    failed: resolving NULL _value"
    + JDK-8212226: SurfaceManager throws "Invalid Image variant"
    for MultiResolutionImage (Windows)
    + JDK-8213400: Support choosing group name in keytool keypair
    generation
    + JDK-8213535: Windows HiDPI html lightweight tooltips are
    truncated
    + JDK-8213698: Improve devkit creation and add support for
    linux/ppc64/ppc64le/s390x
    + JDK-8214025: assert(t-&gt;singleton()) failed: must be a
    constant when ScavengeRootsInCode &lt; 2
    + JDK-8214242: compiler/arguments/TestScavengeRootsInCode.java
    fails because of missing UnlockDiagnosticVMOptions
    + JDK-8214787: Zero builds fail with "undefined
    JavaThread::thread_state()"
    + JDK-8215583: Exclude
    runtime/handshake/HandshakeWalkSuspendExitTest.java
    + JDK-8216012: Infinite loop in RSA KeyPairGenerator
    + JDK-8216324: GetClassMethods is confused by the presence of
    default methods in super interfaces
    + JDK-8217429: WebSocket over authenticating proxy fails to
    send Upgrade headers
    + JDK-8217976: test/jdk/java/net/httpclient/websocket/
    /WebSocketProxyTest.java fails intermittently
    + JDK-8218021: Have jarsigner preserve posix permission
    attributes
    + JDK-8218287: jshell tool: input behavior unstable after
    12-ea+24 on Windows
    + JDK-8218851: JVM crash in custom classloader stress test, JDK
    12 &amp; 13
    + JDK-8220420: Cleanup c1_LinearScan
    + JDK-8222072: JVMTI GenerateEvents() sends CompiledMethodLoad
    events to wrong jvmtiEnv
    + JDK-8222286: Fix for JDK-8213419 is broken on s390
    + JDK-8222527: HttpClient doesn't send HOST header when
    tunelling HTTP/1.1 through http proxy
    + JDK-8222533: jtreg test jdk/internal/platform/cgroup/
    /TestCgroupMetrics.java fails on SLES12.3 linux ppc64le
    machine
    + JDK-8224506: [TESTBUG] TestDockerMemoryMetrics.java fails
    with exitValue = 137
    + JDK-8224555: vmTestbase/nsk/jvmti/scenarios/contention/TC02/
    /tc02t001/TestDescription.java failed
    + JDK-8224650: Add tests to support X25519 and X448 in TLS
    + JDK-8225072: Add LuxTrust certificate that is expiring in
    March 2021 to list of allowed but expired certs
    + JDK-8225329: -XX:+PrintBiasedLockingStatistics causes crash
    during initialization on Windows platforms
    + JDK-8225687: Newly added sspi.cpp in JDK-6722928 still
    contains some small errors
    + JDK-8227006: [linux] Runtime.availableProcessors execution
    time increased by factor of 100
    + JDK-8227275: Within native OOM error handling, assertions may
    hang the process
    + JDK-8227647: [Graal] Test8009761.java fails due to
    "RuntimeException: static java.lang.Object
    compiler.uncommontrap.Test8009761.m3(boolean,boolean) not
    compiled"
    + JDK-8229495: SIGILL in C2 generated OSR compilation
    + JDK-8230910: libsspi_bridge does not build on Windows 32bit
    + JDK-8232114: JVM crashed at imjpapi.dll in native code
    + JDK-8234147: Avoid looking up standard charsets in core
    libraries
    + JDK-8234393: [macos] printing ignores printer tray
    + JDK-8234863: Increase default value of MaxInlineLevel
    + JDK-8235218: Minimal VM is broken after JDK-8173361
    + JDK-8235456: Minimal VM is broken after JDK-8212160
    + JDK-8235829: graal crashes with Zombie.java test
    + JDK-8236124: Minimal VM slowdebug build failed after
    JDK-8212160
    + JDK-8236512: PKCS11 Connection closed after Cipher.doFinal
    and NoPadding
    + JDK-8236944: The legVecZ operand should be limited to
    zmm0-zmm15 registers
    + JDK-8237186: Fix typo in copyright header of
    java/io/Reader/TransferTo.java
    + JDK-8237499: JFR: Include stack trace in the ThreadStart event
    + JDK-8237512: AArch64: aarch64TestHook leaks a BufferBlob
    + JDK-8237524: AArch64: String.compareTo() may return incorrect
    result
    + JDK-8237950: C2 compilation fails with "Live Node limit
    exceeded limit" during ConvI2L::Ideal optimization
    + JDK-8238579: HttpsURLConnection drops the timeout and hangs
    forever in read
    + JDK-8239105: Add exception for expiring Digicert root
    certificates to VerifyCACerts test
    + JDK-8239477: jdk/jfr/jcmd/TestJcmdStartStopDefault.java fails
  - XX:+VerifyOops with "verify_oop: rsi: broken oop"
    + JDK-8239497: SEGV in EdgeUtils::field_name_symbol(Edge const&amp;)
    + JDK-8239886: Minimal VM build fails after JDK-8237499
    + JDK-8240633: Memory leaks in the implementations of
    FileChooserUI
    + JDK-8240690: Race condition between EDT and
    BasicDirectoryModel.FilesLoader.run0()
    + JDK-8241234: Unify monitor enter/exit runtime entries.
    + JDK-8241311: Move some charset mapping tests from closed to
    open
    + JDK-8241797: Add some tests to the problem list
    + JDK-8242029: AArch64: skip G1 array copy pre-barrier if
    marking not active
    + JDK-8242335: Additional Tests for RSASSA-PSS
    + JDK-8242480: Negative value may be returned by
    getFreeSwapSpaceSize() in the docker
    + JDK-8242614: cleanup duplicated test ldap server in some
    com/sun/jndi/ldap/ tests
    + JDK-8242846: Bring back test/jdk/tools/jlink/plugins/
    /OrderResourcesPluginTest.java
    + JDK-8243114: Implement montgomery{Multiply,Square}intrinsics
    on Windows
    + JDK-8243290: Improve diagnostic messages for class
    verification and redefinition failures
    + JDK-8243488: Add tests for set/get SendBufferSize and
    getReceiveBufferSize in DatagramSocket
    + JDK-8243549: sun/security/ssl/CipherSuite/
    /NamedGroupsWithCipherSuite.java failed with Unsupported
    signature algorithm: DSA
    + JDK-8243617: compiler/onSpinWait/TestOnSpinWaitC1.java test
    uses wrong class
    + JDK-8243619: compiler/codecache/CheckSegmentedCodeCache.java
    test misses -version
    + JDK-8244142: some hotspot/runtime tests don't check exit code
    of forked JVM
    + JDK-8244278: Excessive code cache flushes and sweeps
    + JDK-8244282: test/hotspot/jtreg/compiler/intrinsics/
    /Test8237524.java fails with --illegal-access=deny
    + JDK-8244621: [macos10.15] Garbled FX printing plus CoreText
    warnings on Catalina when building with Xcode 11
    + JDK-8244819: hsdis does not compile with binutils 2.34+
    + JDK-8245051: c1 is broken if it is compiled by gcc without
  - fno-lifetime-dse
    + JDK-8245168: jlink should not be treated as a "small" tool
    + JDK-8245400: Upgrade to LittleCMS 2.11
    + JDK-8246381: VM crashes with "Current BasicObjectLock* below
    than low_mark"
    + JDK-8246434: Threads::print_on_error assumes that the heap
    has been set up
    + JDK-8246648: issue with OperatingSystemImpl
    getFreeSwapSpaceSize in docker after 8242480
    + JDK-8247201: Print potential pointer value of readable stack
    memory in hs_err file
    + JDK-8247763: assert(outer-&gt;outcnt() == 2) failed: 'only phis'
    failure in LoopNode::verify_strip_mined()
    + JDK-8247867: Upgrade to freetype 2.10.2
    + JDK-8248190: Enable Power10 system and implement new
    byte-reverse instructions
    + JDK-8248226: TestCloneAccessStressGCM fails with
  - XX:-ReduceBulkZeroing
    + JDK-8248347: windows build broken by JDK-8243114
    + JDK-8248532: Every time I change keyboard language at my
    MacBook, Java crashes
    + JDK-8248552: C2 crashes with SIGFPE due to division by zero
    + JDK-8248596: [TESTBUG] compiler/loopopts/
    /PartialPeelingUnswitch.java times out with Graal enabled
    + JDK-8248745: Add jarsigner and keytool tests for restricted
    algorithms
    + JDK-8248791: sun/util/resources/cldr/TimeZoneNamesTest.java
    fails with -XX:-ReduceInitialCardMarks -XX:-ReduceBulkZeroing
    + JDK-8248845: AArch64: stack corruption after spilling vector
    register
    + JDK-8249176: Update GlobalSignR6CA test certificates
    + JDK-8249183: JVM crash in "AwtFrame::WmSize" method
    + JDK-8249192: MonitorInfo stores raw oops across safepoints
    + JDK-8249602: C2: assert(cnt == _outcnt) failed: no insertions
    allowed
    + JDK-8249603: C1: assert(has_error == false) failed: register
    allocation invalid
    + JDK-8249605: C2: assert(no_dead_loop) failed: dead loop
    detected
    + JDK-8249607: C2: assert(!had_error) failed: bad dominance
    + JDK-8249608: Vector register used by C2 compiled method
    corrupted at safepoint
    + JDK-8249672: Include microcode revision in features_string on
    x86
    + JDK-8249748: gtest silently ignores bad jvm arguments
    + JDK-8249821: Separate libharfbuzz from libfontmanager
    + JDK-8250598: Hyper-V is detected in spite of running on host
    OS
    + JDK-8250605: Linux x86_32 builds fail after JDK-8249821
    + JDK-8250636: iso8601_time returns incorrect offset part on
    MacOS
    + JDK-8250665: Wrong translation for the month name of May in
    ar_JO,LB,SY
    + JDK-8250772: Test com/sun/jndi/ldap/
    /NamingExceptionMessageTest.java fails intermittently with
    javax.naming.ServiceUnavailableException
    + JDK-8250825: C2 crashes with assert(field != __null) failed:
    missing field
    + JDK-8250894: Provide a configure option to build and run
    against the platform libharfbuzz
    + JDK-8250928: JFR: Improve hash algorithm for stack traces
    + JDK-8250968: Symlinks attributes not preserved when using
    jarsigner on zip files
    + JDK-8250984: Memory Docker tests fail on some Linux kernels
    w/o cgroupv1 swap limit capabilities
    + JDK-8251118: BiasedLocking::preserve_marks should not have a
    HandleMark
    + JDK-8251189: com/sun/jndi/ldap/LdapDnsProviderTest.java
    failed due to timeout
    + JDK-8251257: NMT: jcmd VM.native_memory scale=1 crashes
    target VM
    + JDK-8251365: Build failure on AIX after 8250636
    + JDK-8251397: NPE on ClassValue.ClassValueMap.cacheArray
    + JDK-8251456: [TESTBUG] compiler/vectorization/
    /TestVectorsNotSavedAtSafepoint.java failed OutOfMemoryError
    + JDK-8251458: Parse::do_lookupswitch fails with "assert(_cnt
    &gt;= 0) failed"
    + JDK-8251535: Partial peeling at unsigned test adds incorrect
    loop exit check
    + JDK-8251949: ZGC: Set explicit heap size for
    compiler/gcbarriers tests
    + JDK-8252090: JFR: StreamWriterHost::write_unbuffered() stucks
    in an infinite loop OpenJDK (build 13.0.1+9)
    + JDK-8252415: Bump update version for OpenJDK: jdk-11.0.10
    + JDK-8252470: java/awt/dnd/DisposeFrameOnDragCrash/
    /DisposeFrameOnDragTest.java fails on Windows
    + JDK-8252497: Incorrect numeric currency code for ROL
    + JDK-8252660: Shenandoah: support manageable SoftMaxHeapSize
    option
    + JDK-8252679: Two windows specific FileDIalog tests may fail
    on some Windows_Server_2016_Standard
    + JDK-8252696: Loop unswitching may cause out of bound array
    load to be executed
    + JDK-8252754: Hash code calculation of JfrStackTrace is
    inconsistent
    + JDK-8253219: Epsilon: clean up unnecessary includes
    + JDK-8253224: Shenandoah: ShenandoahStrDedupQueue destructor
    calls virtual num_queues()
    + JDK-8253226: Shenandoah: remove unimplemented
    ShenandoahStrDedupQueue::verify
    + JDK-8253269: The CheckCommonColors test should provide more
    info on failure
    + JDK-8253284: Zero OrderAccess barrier mappings are incorrect
    + JDK-8253375: OSX build fails with Xcode 12.0 (12A7209)
    + JDK-8253778: ShenandoahSafepoint::is_at_shenandoah_safepoint
    should not access VMThread state from other threads
    + JDK-8253791: Issue with useAppleColor check in CSystemColors.m
    + JDK-8254016: Test8237524 fails with -XX:-CompactStrings option
    + JDK-8254081: java/security/cert/PolicyNode/
    /GetPolicyQualifiers.java fails due to an expired certificate
    + JDK-8254144: Non-x86 Zero builds fail with return-type
    warning in os_linux_zero.cpp
    + JDK-8254166: Zero: return-type warning in
    zeroInterpreter_zero.cpp
    + JDK-8254177: (tz) Upgrade time-zone data to tzdata2020b
    + JDK-8254185: Fix Code cache sweeper heuristics for JDK 11
    + JDK-8254190: [s390] interpreter misses exception check after
    calling monitorenter
    + JDK-8254790: SIGSEGV in string_indexof_char and
    stringL_indexof_char intrinsics
    + JDK-8254854: [cgroups v1] Metric limits not properly detected
    on some join controller combinations
    + JDK-8254982: (tz) Upgrade time-zone data to tzdata2020c
    + JDK-8255050: Add pkcs11/KeyStore/ClientAuth.sh to Problem list
    + JDK-8255065: Zero: accessor_entry misses the IRIW case
    + JDK-8255226: (tz) Upgrade time-zone data to tzdata2020d
    + JDK-8255269: Unsigned overflow in g1Policy.cpp
    + JDK-8255365: Problem list failing client manual tests
    + JDK-8255457: Shenandoah: cleanup ShenandoahMarkTask
    + JDK-8255466: C2 crashes at ciObject::get_oop() const+0x0
    + JDK-8255550: x86: Assembler::cmpq(Address dst, Register src)
    encoding is incorrect
    + JDK-8255603: Memory/Performance regression after JDK-8210985
    + JDK-8255760: Shenandoah: match constants style in
    ShenandoahMarkTask fallback
    + JDK-8255781: Bump patch update version for OpenJDK:
    jdk-11.0.9.1
    + JDK-8255937: Better cleanup for
    test/jdk/javax/imageio/stream/StreamFlush.java
    + JDK-8256427: Test com/sun/jndi/dns/ConfigTests/
    /PortUnreachable.java does not work on AIX
    + JDK-8256452: Integrate missing part of JDK-8232370 to 11u
    + JDK-8256483: [TESTBUG] serviceability/jvmti/GetClassMethods/
    /libOverpassMethods.c fails to compile on gcc 4.4.x
    + JDK-8256557: libharfbuzz fails to link on gcc 4.4.x due to
  - Wl,-z,defs
    + JDK-8256618: Zero: Linux x86_32 build still fails
    + JDK-8256736: Zero: GTest tests fail with "unsuppported vm
    variant"
    + JDK-8256809: Annotation processing causes NPE during flow
    analysis
    + JDK-8257181: s390x builds are very noisy with gc-sections
    messages
    + JDK-8257242: [macOS] Java app crashes while switching input
    methods
    + JDK-8257545: SunJSSE FIPS regression in key exchange after
    JDK-8171279 11u backport
    + JDK-8257641: Shenandoah: Query is_at_shenandoah_safepoint()
    from control thread should return false
    + JDK-8257701: Shenandoah: objArrayKlass metadata is not marked
    with chunked arrays
    + JDK-8258630: Add expiry exception for QuoVadis root
    certificate
- New upstream dependency on libharfbuzz
- Regenerated patches: missing-return.patch system-pcsclite.patch</changelog>
  <changelog author="fstrba@suse.com" date="1616155200">- Added patches:
  * system-crypto-policy.patch
    + Let OpenJDK use system crypto policies unless explicitely told
    not to
  * nss-security-provider.patch
    + Add the NSS security provider with configuration in generated
    nss.cfg file
  * keytool-default-rsa.patch
    + Make keytool generate RSA keys by default, since only the
    LEGACY system crypto policy allows DSA</changelog>
  <changelog author="pujos.michael@gmail.com" date="1618488000">- moved mozilla-nss dependency to java-11-openjdk-headless package
  This is necessary to be able to do crypto with just
  java-11-openjdk-headless installed. Fixes boo#1184606</changelog>
  <changelog author="fstrba@suse.com" date="1619006400">- Update to upstream tag jdk-11.0.11+9 (April 2021, CPU)
  * Security fixes
    + JDK-8244473: Contextualize registration for JNDI
    + JDK-8244543: Enhanced handling of abstract classes
    + JDK-8249906, CVE-2021-2163, bsc#1185055: Enhance opening JARs
    + JDK-8250568, CVE-2021-2161, bsc#1185056: Less ambiguous
    processing
    + JDK-8253799: Make lists of normal filenames
    + JDK-8257001: Improve Http Client Support
  * Other changes
    + JDK-7107012: sun.jvm.hotspot.code.CompressedReadStream
    readDouble() conversion to long mishandled
    + JDK-7146776: deadlock between URLStreamHandler.getHostAddress
    and file.Handler.openconnection
    + JDK-8086003: Test fails on OSX with java.lang.RuntimeException
    'Narrow klass base: 0x0000000000000000, Narrow klass shift: 3'
    missing
    + JDK-8168869: jdeps: localized messages don't use proper line
    breaks
    + JDK-8180837: SunPKCS11-NSS tests failing with
    CKR_ATTRIBUTE_READ_ONLY and CKR_MECHANISM_PARAM_INVALID
    + JDK-8202343: Disable TLS 1.0 and 1.1
    + JDK-8205992: jhsdb cannot attach to Java processes running in
    Docker containers
    + JDK-8209193: Fix aarch64-linux compilation after -Wreorder
    changes
    + JDK-8210413: AArch64: Optimize div/rem by constant in C1
    + JDK-8210578: AArch64: Invalid encoding for fmlsvs instruction
    + JDK-8211051: jdeps usage of --dot-output doesn't provide
    valid output for modular jar
    + JDK-8211057: Gensrc step CompileProperties generates unstable
    CompilerProperties output
    + JDK-8211150: G1 Full GC not purging code root memory and
    hence causing memory leak
    + JDK-8211825: ModuleLayer.defineModulesWithXXX does not setup
    delegation when module reads automatic module
    + JDK-8212043: Add floating-point Math.min/max intrinsics
    + JDK-8212218: [TESTBUG] runtime/ErrorHandling/
    /TestHeapDumpOnOutOfMemoryErrorInMetaspace.java timed out
    + JDK-8213116: javax/swing/JComboBox/WindowsComboBoxSize/
    /WindowsComboBoxSizeTest.java fails in Windows
    + JDK-8213909: jdeps --print-module-deps should report missing
    dependences
    + JDK-8214180: Need better granularity for sleeping
    + JDK-8214223: tools/jdeps/listdeps/ListModuleDeps.java failed
    due to missing Lib2 file
    + JDK-8214230: Classes generated by SystemModulesPlugin.java
    are not reproducable
    + JDK-8214741: docs/index.html has no title or copyright
    + JDK-8215687: [Graal] unit test CheckGraalIntrinsics failed
    after 8212043
    + JDK-8217848: [Graal] vmTestbase/nsk/jvmti/ResourceExhausted/
    /resexhausted003/TestDescription.java fails
    + JDK-8218482: sun/security/krb5/auto/ReplayCachePrecise.java
    failed - no KrbException thrown
    + JDK-8218550: Add test omitted from JDK-8212043
    + JDK-8221584: SIGSEGV in os::PlatformEvent::unpark() in
    JvmtiRawMonitor::raw_exit while posting method exit event
    + JDK-8221995: AARCH64: problems with CAS instructions encoding
    + JDK-8222518: Remove unnecessary caching of Parker object in
    java.lang.Thread
    + JDK-8222785: aarch64: add necessary masking for immediate
    shift counts
    + JDK-8223186: HotSpot compile warnings from GCC 9
    + JDK-8225773: jdeps --check produces NPE if there are missing
    module dependences
    + JDK-8225805: Java Access Bridge does not close the logger
    + JDK-8226810: Failed to launch JVM because of
    NullPointerException occured on System.props
    + JDK-8229396: jdeps ignores multi-release when
    generate-module-info used on command line
    + JDK-8229474: Shenandoah: Cleanup CM::update_roots()
    + JDK-8232225: Rework the fix for JDK-8071483
    + JDK-8232905: JFR fails with assertion:
    assert(t-&gt;unflushed_size() == 0) failed: invariant
    + JDK-8233164: C2 fails with assert(phase-&gt;C-&gt;get_alias_index(t)
    == phase-&gt;C-&gt;get_alias_index(t_adr)) failed: correct memory
    chain
    + JDK-8233910: java/awt/ColorClass/AlphaColorTest.java is
    failing  intermittently in nightly lnux-x64 system
    + JDK-8233912: aarch64: minor improvements of atomic operations
    + JDK-8234508: VM_HeapWalkOperation::iterate_over_object reads
    non-strong fields with an on-strong load barrier
    + JDK-8234742: Improve handshake logging
    + JDK-8234796: Refactor Handshake::execute to take a more
    complex type than ThreadClosure
    + JDK-8235324: Dying objects are published from users of
    CollectedHeap::object_iterate
    + JDK-8235351: Lookup::unreflect should bind with the original
    caller independent of Method's accessible flag
    + JDK-8237369: Shenandoah: failed vmTestbase/nsk/jvmti/
    /AttachOnDemand/attach021/TestDescription.java test
    + JDK-8237392: Shenandoah: Remove unreliable assertion
    + JDK-8237483: AArch64 C1 OopMap inserted twice fatal error
    + JDK-8237495: Java MIDI fails with a dereferenced memory error
    when asked to send a raw 0xF7
    + JDK-8239355: (dc) Initial value of SO_SNDBUF should allow
    sending large datagrams (macOS)
    + JDK-8240353: AArch64: missing support for
  - XX:+ExtendedDTraceProbes in C1
    + JDK-8240704: CheckHandles.java failed "AssertionError: Handle
    use increased by more than 10 percent."
    + JDK-8240751: Shenandoah: fold ShenandoahTracer definition
    + JDK-8240795: [REDO] 8238384 CTW: C2 compilation fails with
    "assert(store != load-&gt;find_exact_control(load-&gt;in(0)))
    failed: dependence cycle found"
    + JDK-8241598: Upgrade JLine to 3.14.0
    + JDK-8241649: Optimize Character.toString
    + JDK-8241770: Module xxxAnnotation() methods throw NCDFE if
    module-info.class found as resource in unnamed module
    + JDK-8241911: AArch64: Fix a potential register clash issue in
    reduce_add2I
    + JDK-8242030: Wrong package declarations in jline classes after
    JDK-8241598
    + JDK-8242565: Policy initialization issues when the denyAfter
    constraint is enabled
    + JDK-8243618: compiler/rtm/cli tests can be run w/o WhiteBox
    + JDK-8243670: Unexpected test result caused by C2
    MergeMemNode::Ideal
    + JDK-8244088: [Regression] Switch of Gnome theme ends up in
    deadlocked UI
    + JDK-8244154: Update SunPKCS11 provider with PKCS11 v3.0 header
    files
    + JDK-8244340: Handshake processing thread lacks yielding
    + JDK-8244573: java.lang.ArrayIndexOutOfBoundsException thrown
    for malformed class file
    + JDK-8244683: A TSA server used by tests
    + JDK-8245005: javax/net/ssl/compatibility/BasicConnectTest.java
    failed with No enum constant
    + JDK-8245026: PsAdaptiveSizePolicy::_old_gen_policy_is_ready is
    unused
    + JDK-8245283: JFR: Can't handle constant dynamic used by Jacoco
    agent
    + JDK-8245512: CRC32 optimization using AVX512 instructions
    + JDK-8245527: LDAP Channel Binding support for Java
    GSS/Kerberos
    + JDK-8246707: (sc) SocketChannel.read/write throws
    AsynchronousCloseException on closed channel
    + JDK-8246709: sun/security/tools/jarsigner/
    /TsacertOptionTest.java compilation failed after JDK-8244683
    + JDK-8247200: assert((unsigned)fpargs &lt; 32)
    + JDK-8247766: [aarch64] guarantee(val &lt; (1U &lt;&lt; nbits))
    failed: Field too big for insn.
    + JDK-8248336: AArch64: C2: offset overflow in
    BoxLockNode::emit
    + JDK-8248865: Document JNDI/LDAP timeout properties
    + JDK-8248901: Signed immediate support in
    .../share/assembler.hpp is broken.
    + JDK-8249543: Force DirectBufferAllocTest to run with
  - ExplicitGCInvokesConcurrent
    + JDK-8249588: libwindowsaccessbridge issues on 64bit Windows
    + JDK-8249749: modify a primitive array through a stream and a
    for cycle causes jre crash
    + JDK-8249787: Make TestGCLocker more resilient with concurrent
    GCs
    + JDK-8249867: xml declaration is not followed by a newline
    + JDK-8250911: [windows] os::pd_map_memory() error detection
    broken
    + JDK-8251255: [linux] Add process-memory information to hs-err
    and VM.info
    + JDK-8251359: Shenandoah: filter null oops before calling
    enqueue/SATB barrier
    + JDK-8251925: C2: RenaissanceStressTest fails with
    assert(!had_error): bad dominance
    + JDK-8251944: Add Shenandoah test config to
    compiler/gcbarriers/UnsafeIntrinsicsTest.java
    + JDK-8251992: VM crashed running TestComplexAddrExpr.java test
    with -XX:UseAVX=X
    + JDK-8253220: Epsilon: clean up unused code/declarations
    + JDK-8253274: The CycleDMImagetest brokes the system
    + JDK-8253353: Crash in C2: guarantee(n != NULL) failed: No Node
    + JDK-8253368: TLS connection always receives close_notify
    exception
    + JDK-8253404: C2: assert(C-&gt;live_nodes() &lt;=
    C-&gt;max_node_limit()) failed: Live Node limit exceeded limit
    + JDK-8253409: Double-rounding possibility in float fma
    + JDK-8253476: TestUseContainerSupport.java fails on some Linux
    kernels w/o swap limit capabilities
    + JDK-8253524: C2: Refactor code that clones predicates during
    loop unswitching
    + JDK-8253644: C2: assert(skeleton_predicate_has_opaque(iff))
    failed: unexpected
    + JDK-8253681: closed java/awt/dnd/MouseEventAfterStartDragTest/
    /MouseEventAfterStartDragTest.html test failed
    + JDK-8253702: BigSur version number reported as 10.16, should
    be 11.nn
    + JDK-8253756: C2 CompilerThread0 crash in Node::add_req(Node*)
    + JDK-8254104: MethodCounters must exist before nmethod is
    installed
    + JDK-8254734: "dead loop detected" assert failure with patch
    from 8223051
    + JDK-8254748: Bad Copyright header format after JDK-8212218
    + JDK-8254799: runtime/ErrorHandling/
    /TestHeapDumpOnOutOfMemoryError.java fails with release VMs
    + JDK-8255058: C1: assert(is_virtual()) failed: type check
    + JDK-8255351: Add detection for Graviton 2 CPUs
    + JDK-8255368: Math.exp() gives wrong result for large values on
    x86 32-bit platforms
    + JDK-8255387: Japanese characters were printed upside down on
    AIX
    + JDK-8255401: Shenandoah: Allow oldval and newval registers to
    overlap in cmpxchg_oop()
    + JDK-8255479: [aarch64] assert(src-&gt;section_index_of(target) ==
    CodeBuffer::SECT_NONE) failed: sanity
    + JDK-8255544: Create a checked cast
    + JDK-8255559: Leak File Descriptors Because of
    ResolverLocalFilesystem#engineResolveURI()
    + JDK-8255681: print callstack in error case in
    runAWTLoopWithApp
    + JDK-8255734: VM should ignore SIGXFSZ on ppc64, s390 too
    + JDK-8255742: PrintInlining as compiler directive doesn't print
    virtual calls
    + JDK-8255845: Memory leak in imageFile.cpp
    + JDK-8255880: UI of Swing components is not redrawn after their
    internal state changed
    + JDK-8255908: ExceptionInInitializerError due to
    UncheckedIOException while initializing cgroupv1 subsystem
    + JDK-8256025: AArch64: MachCallRuntimeNode::ret_addr_offset()
    is incorrect for stub calls
    + JDK-8256056: Deoptimization stub doesn't save vector registers
    on x86
    + JDK-8256061: RegisterSaver::save_live_registers() omits upper
    halves of ZMM0-15 registers
    + JDK-8256187: [TEST_BUG] Automate bug4275046.java test
    + JDK-8256220: C1: x86_32 fails with -XX:UseSSE=1 after
    JDK-8210764 due to mishandled lir_neg
    + JDK-8256258: some missing NULL checks or asserts after
    CodeCache::find_blob_unsafe
    + JDK-8256264: Printed GlyphVector outline with low DPI has bad
    quality on Windows
    + JDK-8256290: javac/lambda/T8031967.java fails with
    StackOverflowError on x86_32
    + JDK-8256359: AArch64: runtime/ReservedStack/
    /ReservedStackTestCompiler.java fails
    + JDK-8256387: Unexpected result if patching an entire
    instruction on AArch64
    + JDK-8256421: Add 2 HARICA roots to cacerts truststore
    + JDK-8256488: [aarch64] Use ldpq/stpq instead of ld4/st4 for
    small copies in StubGenerator::copy_memory
    + JDK-8256489: Make gtest for long path names on Windows more
    resilient in the presence of virus scanners
    + JDK-8256501: libTestMainKeyWindow fails to build with Xcode
    12.2
    + JDK-8256633: Fix product build on Windows+Arm64
    + JDK-8256682: JDK-8202343 is incomplete
    + JDK-8256751: Incremental rebuild with precompiled header fails
    when touching a header file
    + JDK-8256757: Incorrect MachCallRuntimeNode::ret_addr_offset()
    for CallLeafNoFP on x86_32
    + JDK-8256806: Shenandoah: optimize shenandoah/jni/
    /TestPinnedGarbage.java test
    + JDK-8256807: C2: Not marking stores correctly as mismatched
    in string opts
    + JDK-8256810: Incremental rebuild broken on Macosx
    + JDK-8256818: SSLSocket that is never bound or connected leaks
    socket resources
    + JDK-8256888: Client manual test problem list update
    + JDK-8257083: Security infra test failures caused by
    JDK-8202343
    + JDK-8257408: Bump update version for OpenJDK: jdk-11.0.11
    + JDK-8257423: [PPC64] Support -XX:-UseInlineCaches
    + JDK-8257436: [aarch64] Regressions in ArrayCopyUnalignedDst
    .testByte/testChar for 65-78 bytes when UseSIMDForMemoryOps
    is on
    + JDK-8257513: C2: assert((constant_addr -
    _masm.code()-&gt;consts()-&gt;start()) == con.offset())
    + JDK-8257547: Handle multiple prereqs on the same line in deps
    files
    + JDK-8257561: Some code is not vectorized after 8251925 and
    8250607
    + JDK-8257565: epsilonBarrierSet.hpp should not include
    barrierSetAssembler
    + JDK-8257575: C2: "failed: only phis" assert failure in loop
    strip mining verification
    + JDK-8257594: C2 compiled checkcast of non-null object triggers
    endless deoptimization/recompilation cycle
    + JDK-8257633: Missing -mmacosx-version-min=X flag when linking
    libjvm
    + JDK-8257670: sun/security/ssl/SSLSocketImpl/SSLSocketLeak.java
    reports leaks
    + JDK-8257707: Fix incorrect format string in Http1HeaderParser
    + JDK-8257746: Regression introduced with JDK-8250984 - memory
    might be null in some machines
    + JDK-8257798: [PPC64] undefined reference to
    Klass::vtable_start_offset()
    + JDK-8257884: Re-enable sun/security/ssl/SSLSocketImpl/
    /SSLSocketLeak.java as automatic test
    + JDK-8257910: [JVMCI] Set exception_seen accordingly in the
    runtime.
    + JDK-8257997: sun/security/ssl/SSLSocketImpl/SSLSocketLeak.java
    again reports leaks after JDK-8257884
    + JDK-8257999: Parallel GC crash in gc/parallel/
    /TestDynShrinkHeap.java: new region is not in covered_region
    + JDK-8258077: Using -Xcheck:jni can lead to a double-free after
    JDK-8193234
    + JDK-8258247: Couple of issues in fix for JDK-8249906
    + JDK-8258373: Update the text handling in the JPasswordField
    + JDK-8258396: SIGILL in jdk.jfr.internal.PlatformRecorder
    .rotateDisk()
    + JDK-8258419: RSA cipher buffer cleanup
    + JDK-8258471: "search codecache" clhsdb command does not work
    + JDK-8258534: Epsilon: clean up unused includes
    + JDK-8258805: Japanese characters not entered by mouse click
    on Windows 10
    + JDK-8258833: Cancel multi-part cipher operations in SunPKCS11
    after failures
    + JDK-8258836: JNI local refs exceed capacity
    getDiagnosticCommandInfo
    + JDK-8258884: [TEST_BUG] Convert applet-based test
    open/test/jdk/javax/swing/JMenuItem/8031573/bug8031573.java
    to a regular java test
    + JDK-8259007: This test printed a blank page
    + JDK-8259048: (tz) Upgrade time-zone data to tzdata2020f
    + JDK-8259049: Uninitialized variable after JDK-8257513
    + JDK-8259231: Epsilon: improve performance under contention
    during virtual space expansion
    + JDK-8259271: gc/parallel/TestDynShrinkHeap.java still fails
    "assert(covered_region.contains(new_memregion)) failed: new
    region is not in covered_region"
    + JDK-8259312: VerifyCACerts.java fails as soneraclass2ca cert
    will expire in 90 days
    + JDK-8259319: Illegal package access when SunPKCS11 requires
    SunJCE's classes
    + JDK-8259339: AllocateUninitializedArray C2 intrinsic fails
    with void.class input
    + JDK-8259428: AlgorithmId.getEncodedParams() should return copy
    + JDK-8259446: runtime/jni/checked/
    /TestCheckedReleaseArrayElements.java fails with stderr not
    empty
    + JDK-8259451: Zero: skip serviceability/sa tests, set vm.hasSA
    to false
    + JDK-8259580: Shenandoah: uninitialized label in
    VerifyThreadGCState
    + JDK-8259619: C1: 3-arg StubAssembler::call_RT stack-use
    condition is incorrect
    + JDK-8259633: compiler/graalunit/CoreTest.java fails with NPE
    after JDK-8244543
    + JDK-8259706: C2 compilation fails with assert(vtable_index ==
    Method::invalid_vtable_index) failed: correct sentinel value
    + JDK-8259707: LDAP channel binding does not work with StartTLS
    extension
    + JDK-8259773: Incorrect encoding of AVX-512 kmovq instruction
    + JDK-8259849: Shenandoah: Rename store-val to IU-barrier
    + JDK-8259949: x86 32-bit build fails when -fcf-protection is
    passed in the compiler flags
    + JDK-8259954: gc/shenandoah/mxbeans tests fail with -Xcomp
    + JDK-8260029: aarch64: fix typo in verify_oop_array
    + JDK-8260308: Update LogCompilation junit to 4.13.1
    + JDK-8260338: Some fields in HaltNode is not cloned
    + JDK-8260349: Cannot programmatically retrieve Metaspace max
    set via JAVA_TOOL_OPTIONS
    + JDK-8260356: (tz) Upgrade time-zone data to tzdata2021a
    + JDK-8260378: [TESTBUG] DcmdMBeanTestCheckJni.java reports
    false positive
    + JDK-8260497: Shenandoah: Improve SATB flushing
    + JDK-8260502: [s390] NativeMovRegMem::verify() fails because
    it's too strict
    + JDK-8260632: Build failures after JDK-8253353
    + JDK-8260704: ParallelGC: oldgen expansion needs release-store
    for _end
    + JDK-8261022: Fix incorrect result of Math.abs() with char type
    + JDK-8261089: [TESTBUG] native library of test
    TestCheckedReleaseCriticalArray.java fails to compile with
    gcc 4.x
    + JDK-8261183: Follow on to Make lists of normal filenames
    + JDK-8261209: isStandalone property: remove dependency on
    pretty-print
    + JDK-8261231: Windows IME was disabled after DnD operation
    + JDK-8261251: Shenandoah: Use object size for full GC
    humongous compaction
    + JDK-8261310: PPC64 Zero build fails with
    'VMError::controlled_crash(int)::FunctionDescriptor
    functionDescriptor' has incomplete type and cannot be defined
    + JDK-8261334: NMT: tuning statistic shows incorrect hash
    distribution
    + JDK-8261413: Shenandoah: Disable class-unloading in I-U mode
    + JDK-8261522: [PPC64] AES intrinsics write beyond the
    destination array
    + JDK-8261534: Test sun/security/pkcs11/KeyAgreement/
    /IllegalPackageAccess.java fails on platforms where no nsslib
    artifacts are defined
    + JDK-8261585: Restore HandleArea used in
    Deoptimization::uncommon_trap
    + JDK-8261753: Test java/lang/System/OsVersionTest.java still
    failing on BigSur patch versions after JDK-8253702
    + JDK-8261829: Exclude tools/jlink/JLinkReproducibleTest.java
    in 11u
    + JDK-8261912: Code IfNode::fold_compares_helper more
    defensively
    + JDK-8261920: [AIX] jshell command throws java.io.IOError on
    non English locales
    + JDK-8262018: Wrong format in SAP copyright header of
    OsVersionTest
    + JDK-8263069: Exclude some failing tests from
    security/infra/java/security/cert/CertPathValidator</changelog>
  <changelog author="fstrba@suse.com" date="1620043200">- Remove all Jpackage provides for SLE12 in order to avoid
  installing this package as default Java on SLE12-SP5
  (bsc#1185476)</changelog>
  <changelog author="fstrba@suse.com" date="1621512000">- Modified patch:
  * nss-security-provider.patch
    + make the NSS provider first in the list</changelog>
  <changelog author="fstrba@suse.com" date="1626868800">- Update to upstream tag jdk-11.0.12+7 (July 2021, CPU)
  * Security fixes
    + JDK-8256157: Improve bytecode assembly
    + JDK-8256491: Better HTTP transport
    + JDK-8258432, CVE-2021-2341, bsc#1188564: Improve file
    transfers
    + JDK-8260453: Improve Font Bounding
    + JDK-8260960: Signs of jarsigner signing
    + JDK-8260967, CVE-2021-2369, bsc#1188565: Better jar file
    validation
    + JDK-8262380: Enhance XML processing passes
    + JDK-8262403: Enhanced data transfer
    + JDK-8262410: Enhanced rules for zones
    + JDK-8262477: Enhance String Conclusions
    + JDK-8262967: Improve Zip file support
    + JDK-8264066, CVE-2021-2388, bsc#1188566: Enhance compiler
    validation
    + JDK-8264079: Improve abstractions
    + JDK-8264460: Improve NTLM support
  * Other changes
    + JDK-6847157: java.lang.NullPointerException: HDC for
    component at sun.java2d.loops.Blit.Blit
    + JDK-7106851: Test should not use System.exit
    + JDK-8073446: TimeZone getOffset API does not  return a dst
    offset between years 2038-2137
    + JDK-8076190: Customizing the generation of a PKCS12 keystore
    + JDK-8153005: Upgrade the default PKCS12 encryption/MAC
    algorithms
    + JDK-8171303: sun/java2d/pipe/InterpolationQualityTest.java
    fails on Windows &amp; Linux
    + JDK-8177068: incomplete classpath causes NPE in Flow
    + JDK-8185734: [Windows] Structured Exception Catcher missing
    around gtest execution
    + JDK-8187450: JNI local refs exceeds capacity warning in
    NetworkInterface::getAll
    + JDK-8190763: Class cast exception on (CompoundEdit)
    UndoableEditEvent.getEdit()
    + JDK-8195841: PNGImageReader.readNullTerminatedString() doesnt
    check for non-null terminated strings with length equal to
    maxLen
    + JDK-8196100: javax/swing/text/JTextComponent/5074573/
    /bug5074573.java fails
    + JDK-8199646: JShell tests: jdk/jshell/
    /FailOverDirectExecutionControlTest.java failed with
    java.lang.UnsupportedOperationException
    + JDK-8206925: Support the certificate_authorities extension
    + JDK-8207160: ClassReader::adjustMethodParams can potentially
    return null if the args list is empty
    + JDK-8207247: AARCH64: Enable Minimal and Client VM builds
    + JDK-8207404: MulticastSocket tests failing on AIX
    + JDK-8207779: Method::is_valid_method() compares 'this' with
    NULL
    + JDK-8208061: runtime/LoadClass/TestResize.java fails with
    "Load factor too high" when running in CDS mode.
    + JDK-8209459: TestSHA512MultiBlockIntrinsics failed on AArch64
    + JDK-8210443: Migrate Locale matching tests to JDK Repo.
    + JDK-8213231: ThreadSnapshot::_threadObj can become stale
    + JDK-8213483: ARM32: runtime/ErrorHandling/
    /ShowRegistersOnAssertTest.java jtreg test fail
    + JDK-8213725: JShell NullPointerException due to class file
    with unexpected package
    + JDK-8213794: ARM32: disable TypeProfiling,
    CriticalJNINatives, Serviceablity tests for ARM32
    + JDK-8213845: ARM32: Interpreter doesn't call result handler
    after native calls
    + JDK-8214128: ARM32: wrong stack alignment on
    Deoptimization::unpack_frames
    + JDK-8214512: ARM32: Jtreg test compiler/c2/Test8062950.java
    fails on ARM
    + JDK-8214854: JDWP: Unforseen output truncation in logging
    + JDK-8214922: Add vectorization support for fmin/fmax
    + JDK-8215009: GCC 8 compilation error in libjli
    + JDK-8216184: CDS/appCDS tests failed on Windows due to long
    path to a classlist file
    + JDK-8216259: AArch64: Vectorize Adler32 intrinsics
    + JDK-8216314: SIGILL in CodeHeapState::print_names()
    + JDK-8217348: assert(thread-&gt;is_Java_thread()) failed: just
    checking
    + JDK-8217465: [REDO] - Optimize CodeHeap Analytics
    + JDK-8217561: X86: Add floating-point Math.min/max intrinsics
    + JDK-8217918: C2: -XX:+AggressiveUnboxing is broken
    + JDK-8218458: [TESTBUG] runtime/NMT/
    /CheckForProperDetailStackTrace.java fails with Expected
    stack trace missing from output
    + JDK-8219142: Remove unused JIMAGE_ResourcePath
    + JDK-8219586: CodeHeap State Analytics processes dead nmethods
    + JDK-8220074: Clean up GCC 8.3 errors in LittleCMS
    + JDK-8220407: compiler/intrinsics/math/
    /TestFpMinMaxIntrinsics.java timedout
    + JDK-8222302: [TESTBUG] test/hotspot/jtreg/compiler/intrinsics/
    /sha/cli/TestUseSHAOptionOnUnsupportedCPU.java fails on any
    other CPU
    + JDK-8222412: AARCH64: multiple instructions encoding issues
    + JDK-8223020: aarch64: expand minI_rReg and maxI_rReg patterns
    into separate instructions
    + JDK-8223444: Improve CodeHeap Free Space Management
    + JDK-8223504: Improve performance of forall loops by better
    inlining of "iterator()" methods
    + JDK-8223667: ASAN build broken
    + JDK-8225081: Remove Telia Company CA certificate expiring in
    April 2021
    + JDK-8225116: Test OwnedWindowsLeak.java intermittently fails
    + JDK-8225438: javax/net/ssl/TLSCommon/
    /TestSessionLocalPrincipal.java failed with Read timed out
    + JDK-8225756: [testbug] compiler/loopstripmining/
    /CheckLoopStripMining.java sets too short a
    SafepointTimeoutDelay
    + JDK-8226374: Restrict TLS signature schemes and named groups
    + JDK-8226627: assert(t-&gt;singleton()) failed: must be a constant
    + JDK-8226721: Missing intrinsics for Math.ceil, floor, rint
    + JDK-8227080: (fs) Files.newInputStream(...).skip(n) is slow
    + JDK-8227222: vmTestbase/jit/FloatingPoint/gen_math/Loops04/
    /Loops04.java failed XMM register should be 0-15
    + JDK-8227609: (fs) Files.newInputStream(...).skip(n) should
    allow skipping beyond file size
    + JDK-8230428: Cleanup dead CastIP node code in formssel.cpp
    + JDK-8231460: Performance issue (CodeHeap) with large free
    blocks
    + JDK-8231713: x86_32 build failures after JDK-8226721 (Missing
    intrinsics for Math.ceil, floor, rint)
    + JDK-8231841: AArch64: debug.cpp help() is missing an AArch64
    line for pns
    + JDK-8232084: HotSpot build failed with GCC 9.2.1
    + JDK-8232591: AArch64: Add missing match rules for smaddl,
    smsubl and smnegl
    + JDK-8233185: HttpServer.stop() blocks indefinitely when
    called on dispatch thread
    + JDK-8233787: Break cycle in vm_version* includes
    + JDK-8233948: AArch64: Incorrect mapping between OptoReg and
    VMReg for high 64 bits of Vector Register
    + JDK-8234355: Buffer overflow in jcmd GC.class_stats due to
    too many classes
    + JDK-8235368: Update BCEL to Version 6.4.1
    + JDK-8236859: WebSocket over authenticating proxy fails with
    NPE
    + JDK-8236992: AArch64: remove redundant load_klass in itable
    stub
    + JDK-8237743: test/langtools/jdk/jshell/
    /FailOverExecutionControlTest.java fails No
    ExecutionControlProvider with name 'nonExistent' and parameter
    keys: []
    + JDK-8237804: sun/security/mscapi tests fail with "Key pair
    not generated, alias &lt;nnnnnn&gt; already exists"
    + JDK-8238175: CTW: Class.getDeclaredMethods fails with
    assert(k-&gt;is_subclass_of(SystemDictionary::Throwable_klass()))
    failed: invalid exception class
    + JDK-8238567: SoftMainMixer.processAudioBuffers(): Wrong
    handling of stoppedMixers
    + JDK-8238812: assert(false) failed: bad AD file
    + JDK-8239312: [macos] javax/swing/JFrame/NSTexturedJFrame/
    /NSTexturedJFrame.java
    + JDK-8239386: handle ContendedPaddingWidth in
    vm_version_aarch64
    + JDK-8239536: Can't use 'java.util.List' object after
    importing 'java.awt.List'
    + JDK-8240487: Cleanup whitespace in .cc, .hh, .m, and .mm files
    + JDK-8240848: ArrayIndexOutOfBoundsException buf for
    TextCallbackHandler
    + JDK-8241082: Upgrade IANA Language Subtag Registry data to
    03-16-2020 version
    + JDK-8241087: Build failure with VS 2019 (16.5.0) due to C2039
    and C2873
    + JDK-8241101: [s390] jtreg test failure after JDK-8238696: not
    conformant features string
    + JDK-8241248: NullPointerException in
    sun.security.ssl.HKDF.extract(HKDF.java:93)
    + JDK-8241372: Several test failures due to
    javax.net.ssl.SSLException: Connection reset
    + JDK-8241475: AArch64: Add missing support for PopCountVI node
    + JDK-8241829: Cleanup the code for PrinterJob on windows
    + JDK-8241960: The SHA3 message digests impl of SUN provider
    are not thread safe after cloned
    + JDK-8242010: Upgrade IANA Language Subtag Registry to Version
    2020-04-01
    + JDK-8242429: Better implementation for sign extract
    + JDK-8242557: Add length limit for strings in PNGImageWriter
    + JDK-8242919: Paste locks up jshell
    + JDK-8243155: AArch64: Add support for SqrtVF
    + JDK-8243240: AArch64: Add support for MulVB
    + JDK-8243452: JFR: Could not create chunk in repository with
    over 200 recordings
    + JDK-8243559: Remove root certificates with 1024-bit keys
    + JDK-8243597: AArch64: Add support for integer vector abs
    + JDK-8244031: HttpClient should have more tests for HEAD
    requests
    + JDK-8244205: HTTP/2 tunnel connections through proxy may be
    reused regardless of which proxy is selected
    + JDK-8244847: Linux/PPC: runtime/CompressedOops/
    /CompressedClassPointers: smallHeapTest fails
    + JDK-8245511: G1 adaptive IHOP does not account for
    reclamation of humongous objects by young GC
    + JDK-8246274: G1 old gen allocation tracking is not in a
    separate class
    + JDK-8247354: [aarch64] PopFrame causes
    assert(oopDesc::is_oop(obj)) failed: not an oop
    + JDK-8247408: IdealGraph bit check expression canonicalization
    + JDK-8247432: Update IANA Language Subtag Registry to Version
    2020-09-29
    + JDK-8247438: JShell: When FailOverExecutionControlProvider
    fails the proximal cause is not shown
    + JDK-8247753: UIManager.getSytemLookAndFeelClassName() returns
    wrong value on Fedora 32
    + JDK-8248043: Need to eliminate excessive i2l conversions
    + JDK-8248411: [aarch64] Insufficient error handling when
    CodeBuffer is exhausted
    + JDK-8248568: compiler/c2/TestBit.java failed: test missing
    from stdout/stderr
    + JDK-8248870: AARCH64: I2L/L2I conversions can be skipped for
    masked positive values
    + JDK-8249142: java/awt/FontClass/CreateFont/DeleteFont.sh is
    unstable
    + JDK-8249189: AARCH64: more L2I conversions can be skipped
    + JDK-8249719: MethodHandle performance suffers from bad
    ResolvedMethodTable hash function
    + JDK-8249875: GCC 10 warnings -Wtype-limits with JFR code
    + JDK-8250635: MethodArityHistogram should use Compile_lock in
    favour of fancy checks
    + JDK-8250876: Fix issues with cross-compile on macos
    + JDK-8251031: Some vmTestbase/nsk/monitoring/RuntimeMXBean
    tests fail with hostnames starting from digits
    + JDK-8251525: AARCH64: Faster Math.signum(fp)
    + JDK-8252259: AArch64: Adjust default value of FLOATPRESSURE
    + JDK-8252311: AArch64: save two words in itable lookup stub
    + JDK-8252779: compiler/graalunit/HotspotTest.java failed after
    8251525
    + JDK-8252883: AccessDeniedException caused by delayed file
    deletion on Windows
    + JDK-8253167: ARM32 builds fail after JDK-8247910
    + JDK-8253572: [windows] CDS archive may fail to open with long
    file names
    + JDK-8253923: C2 doesn't always run loop opts for compilations
    that include loops
    + JDK-8253948: Memory leak in ImageFileReader
    + JDK-8254631: Better support ALPN byte wire values in SunJSSE
    + JDK-8254717: isAssignableFrom checks in
    KeyFactorySpi.engineGetKeySpec appear to be backwards
    + JDK-8255086: Update the root locale display names
    + JDK-8255625: AArch64: Implement Base64.encodeBlock
    accelerator/intrinsic
    + JDK-8255763: C2: OSR miscompilation caused by invalid memory
    instruction placement
    + JDK-8255992: JFR EventWriter does not use first string from
    StringPool with id 0
    + JDK-8256037: [TESTBUG] com/sun/jndi/dns/ConfigTests/
    /PortUnreachable.java fails due to the hard coded threshold
    is small
    + JDK-8256244: java/lang/ProcessHandle/PermissionTest.java
    fails with TestNG 7.1
    + JDK-8256287: [windows] add loop fuse to
    map_or_reserve_memory_aligned
    + JDK-8256523: Streamline Java SHA2 implementation
    + JDK-8257414: Drag n Drop target area is wrong on high DPI
    systems
    + JDK-8257569: Failure observed with
    JfrVirtualMemory::initialize
    + JDK-8257574: C2: "failed: parsing found no loops but there
    are some" assert failure
    + JDK-8257580: Bump update version for OpenJDK: jdk-11.0.12
    + JDK-8257604: JNI_ArgumentPusherVaArg leaks valist
    + JDK-8257621: JFR StringPool misses cached items across
    consecutive recordings
    + JDK-8257796: [TESTBUG]
    TestUseSHA512IntrinsicsOptionOnSupportedCPU.java fails
    on x86_32
    + JDK-8257822: C2 crashes with SIGFPE due to a division that
    floats above its zero check
    + JDK-8257828: SafeFetch may crash if invoked in non-JavaThreads
    + JDK-8257853: Remove dependencies on JNF's JNI utility
    functions in AWT and 2D code
    + JDK-8257858: [macOS]: Remove JNF dependency from
    libosxsecurity/KeystoreImpl.m
    + JDK-8257860: [macOS]: Remove JNF dependency from
    libosxkrb5/SCDynamicStoreConfig.m
    + JDK-8257988: Remove JNF dependency from
    libsaproc/MacosxDebuggerLocal.m
    + JDK-8258414: OldObjectSample events too expensive
    + JDK-8258505: [TESTBUG] TestDivZeroWithSplitIf.java fails due
    to missing UnlockDiagnosticVMOptions
    + JDK-8258753: StartTlsResponse.close() hangs due to
    synchronization issues
    + JDK-8259061: C2: assert(found) failed: memory-writing node is
    not placed in its original loop or an ancestor of it
    + JDK-8259227: C2 crashes with SIGFPE due to a division that
    floats above its zero check
    + JDK-8259232: Bad JNI lookup during printing
    + JDK-8259276: C2: Empty expression stack when reexecuting
    tableswitch/lookupswitch instructions after deoptimization
    + JDK-8259343: [macOS] Update JNI error handling in Cocoa code.
    + JDK-8259585: Accessible actions do not work on mac os x
    + JDK-8259651: [macOS] Replace JNF_COCOA_ENTER/EXIT macros
    + JDK-8259662: Don't wrap SocketExceptions into SSLExceptions
    in SSLSocketImpl
    + JDK-8259710: Inlining trace leaks memory
    + JDK-8259729: Missed JNFInstanceOf -&gt; IsInstanceOf conversion
    + JDK-8259777: Incorrect predication condition generated by ADLC
    + JDK-8259786: initialize last parameter of getpwuid_r
    + JDK-8259843: initialize dli_fname array before calling
    dll_address_to_library_name
    + JDK-8259869: [macOS] Remove desktop module dependencies on
    JNF Reference APIs
    + JDK-8259886: Improve SSL session cache performance and
    scalability
    + JDK-8259983: do not use uninitialized expand_ms value in
    G1CollectedHeap::expand_heap_after_young_collection
    + JDK-8260030: Improve stringStream buffer handling
    + JDK-8260236: better init AnnotationCollector _contended_group
    + JDK-8260255: C1: LoopInvariantCodeMotion constructor can
    leave some fields uninitialized
    + JDK-8260284: C2: assert(_base == Int) failed: Not an Int
    + JDK-8260380: Upgrade to LittleCMS 2.12
    + JDK-8260420: C2 compilation fails with assert(found_sfpt)
    failed: no node in loop that's not input to safepoint
    + JDK-8260426: awt debug_mem.c DMem_AllocateBlock might leak
    memory
    + JDK-8260432: allocateSpaceForGP in freetypeScaler.c might
    leak memory
    + JDK-8260616: Removing remaining JNF dependencies in the
    java.desktop module
    + JDK-8260653: Unreachable nodes keep speculative types alive
    + JDK-8260707: java/lang/instrument/PremainClass/
    /InheritAgent0100.java times out
    + JDK-8260925: HttpsURLConnection does not work  with other
    JSSE provider.
    + JDK-8260926: Trace resource exhausted events unconditionally
    + JDK-8261020: Wrong format parameter in
    create_emergency_chunk_path
    + JDK-8261027: AArch64: Support for LSE atomics C++ HotSpot code
    + JDK-8261167: print_process_memory_info add a close call after
    fopen
    + JDK-8261170: Upgrade to freetype 2.10.4
    + JDK-8261198: [macOS] Incorrect JNI parameters in number
    conversion in A11Y code
    + JDK-8261235: C1 compilation fails with
    assert(res-&gt;vreg_number() == index) failed: conversion check
    + JDK-8261261: The version extra fields needs to be overridable
    in jib-profiles.js
    + JDK-8261262: Kitchensink24HStress.java crashed with
    EXCEPTION_ACCESS_VIOLATION
    + JDK-8261354: SIGSEGV at MethodIteratorHost
    + JDK-8261355: No data buffering in SunPKCS11 Cipher encryption
    when the underlying mechanism has no padding
    + JDK-8261397: try catch Method failing to work when dividing
    an integer by 0
    + JDK-8261422: Adjust problematic String.format calls in
    jdk/internal/util/Preconditions.java outOfBoundsMessage
    + JDK-8261447: MethodInvocationCounters frequently run into
    overflow
    + JDK-8261481: Cannot read Kerberos settings in dynamic store
    on macOS Big Sur
    + JDK-8261505: Test test/hotspot/jtreg/gc/parallel/
    /TestDynShrinkHeap.java killed by Linux OOM Killer
    + JDK-8261601: free memory in early return in
    Java_sun_nio_ch_sctp_SctpChannelImpl_receive0
    + JDK-8261649: AArch64: Optimize LSE atomics in C++ code
    + JDK-8261730: C2 compilation fails with
    assert(store-&gt;find_edge(load) != -1) failed: missing
    precedence edge
    + JDK-8261752: Multiple GC test are missing memory requirements
    + JDK-8261791: (sctp) handleSendFailed in SctpChannelImpl.c
    potential leaks
    + JDK-8261812: C2 compilation fails with assert(!had_error)
    failed: bad dominance
    + JDK-8261914: IfNode::fold_compares_helper faces
    non-canonicalized bool when running JRuby JSON workload
    + JDK-8262093: java/util/concurrent/tck/JSR166TestCase.java
    failed "assert(false) failed: unexpected node"
    + JDK-8262110: DST starts from incorrect time in 2038
    + JDK-8262121: [11u] Redo 8244287: JFR: Methods samples have
    line number 0
    + JDK-8262163: Extend settings printout in jcmd VM.metaspace
    + JDK-8262295: C2: Out-of-Bounds Array Load from Clone Source
    + JDK-8262298: G1BarrierSetC2::step_over_gc_barrier fails with
    assert "bad barrier shape"
    + JDK-8262446: DragAndDrop hangs on Windows
    + JDK-8262461: handle wcstombsdmp return value correctly in
    unix awt_InputMethod.c
    + JDK-8262465: Very long compilation times and high memory
    consumption in C2 debug builds
    + JDK-8262726: AArch64: C1 StubAssembler::call_RT can corrupt
    stack
    + JDK-8262739: String inflation C2 intrinsic prevents insertion
    of anti-dependencies
    + JDK-8262829: Native crash in
    Win32PrintServiceLookup.getAllPrinterNames()
    + JDK-8262837: handle split_USE correctly
    + JDK-8262900: ToolBasicTest fails to access HTTP server it
    starts
    + JDK-8263260: [s390] Support latest hardware (z14 and z15)
    + JDK-8263311: Watch registry changes for remote printers
    update instead of polling
    + JDK-8263361: Incorrect arraycopy stub selected by C2 for SATB
    collectors
    + JDK-8263404: RsaPrivateKeySpec is always recognized as
    RSAPrivateCrtKeySpec in RSAKeyFactory.engineGetKeySpec
    + JDK-8263425: AArch64: two potential bugs in C1
    LIRGenerator::generate_address()
    + JDK-8263448: CTW: fatal error: meet not symmetric
    + JDK-8263504: Some OutputMachOpcodes fields are uninitialized
    + JDK-8263557: Possible NULL dereference in
    Arena::destruct_contents()
    + JDK-8263558: Possible NULL dereference in fast path arena
    free if ZapResourceArea is true
    + JDK-8263676: AArch64: one potential bug in C1
    LIRGenerator::generate_address()
    + JDK-8263729: [test] divert spurious output away from stream
    under test in ProcessBuilder Basic test
    + JDK-8263846: Bad JNI lookup getFocusOwner in accessibility
    code on Mac OS X
    + JDK-8264047: Duplicate global variable 'jvm' in libjavajpeg
    and libawt
    + JDK-8264096: slowdebug jvm crashes when StrInflatedCopy match
    rule is not supported
    + JDK-8264151: ciMethod::ensure_method_data() should return
    false is loading resulted in empty state
    + JDK-8264173: [s390] Improve Hardware Feature Detection And
    Reporting
    + JDK-8264190: Harden TLS interop tests
    + JDK-8264223: CodeHeap::verify fails extra_hops assertion in
    fastdebug test
    + JDK-8264328: Broken license in
    javax/swing/JComboBox/8072767/bug8072767.java
    + JDK-8264360: Loop strip mining verification fails with
    "should be on the backedge"
    + JDK-8264626: C1 should be able to inline excluded methods
    + JDK-8264640: CMS ParScanClosure misses a barrier
    + JDK-8264786: [macos] All Swing/AWT apps cause Allow
    Notifications prompt to appear when app is launched
    + JDK-8264821: DirectIOTest fails on a system with large block
    size
    + JDK-8264848: [macos] libjvm.dylib linker warning due to macOS
    version mismatch
    + JDK-8264923: PNGImageWriter.write_zTXt throws Exception with
    a typo
    + JDK-8264958: C2 compilation fails with assert "n is later
    than its clone"
    + JDK-8265099: Revert backport to 11u of 8236859: WebSocket
    over authenticating proxy fails with NPE
    + JDK-8265154: vinserti128 operand mix up for KNL platforms
    + JDK-8265239: Shenandoah: Shenandoah heap region count could
    be off by 1
    + JDK-8265417: Backport of JDK-8249672 breaks Solaris x86 build
    + JDK-8265421: java/lang/String/StringRepeat.java test is
    missing a memory requirement
    + JDK-8265462: Handle multiple slots in the NSS Internal Module
    from SunPKCS11's Secmod
    + JDK-8265537: x86 version string truncated after JDK-8249672
    11u backport
    + JDK-8265666: Enable AIX build platform to make external debug
    symbols
    + JDK-8265677: CMS: CardTableBarrierSet::write_ref_array_work()
    lacks storestore barrier
    + JDK-8265690: Use the latest Ubuntu base image version in
    Docker testing
    + JDK-8265718: Build failure after JDK-8258414 11u backport
    + JDK-8265750: Fatal error in safepoint.cpp after backport of
    8258414
    + JDK-8265784: [C2] Hoisting of DecodeN leaves MachTemp inputs
    behind
    + JDK-8265938: C2's conditional move optimization does not
    handle top Phi
    + JDK-8266220: keytool still prompt for store password on a
    password-less pkcs12 file if -storetype pkcs12 is specified
    + JDK-8266293: Key protection using PBEWithMD5AndDES fails with
    "java.security.InvalidAlgorithmParameterException: Salt must
    be 8 bytes long"
    + JDK-8266713: [AIX] Build failure after 11u backport of
    JDK-8247753
    + JDK-8266802: Shenandoah: Round up region size to page size
    unconditionally
    + JDK-8266892: avoid maybe-uninitialized gcc warnings on linux
    s390x
    + JDK-8266929: Unable to use algorithms from 3p providers
    + JDK-8267235: [macos_aarch64]
    InterpreterRuntime::throw_pending_exception messing up LR
    results in crash
    + JDK-8267561: Shenandoah: Reference processing not properly
    setup for outside of cycle degenerated GC
    + JDK-8267599: Revert the change to the default PKCS12
    macAlgorithm and macIterationCount props for 11u/8u/7u
    + JDK-8267641: [11u] 8227609 backport typo
    + JDK-8267721: Enable sun/security/pkcs11 tests for Amazon
    Linux 2 AArch64
    + JDK-8268678: LetsEncryptCA.java test fails as Let's Encrypt
    Authority X3 is retired</changelog>
  <changelog author="schwab@suse.de" date="1628078400">- riscv64-zero.patch: Add support for riscv64 (zero VM)</changelog>
  <changelog author="fstrba@suse.com" date="1629979200">- Added patch:
  * jdk11-glibc234.patch
    + fix build with glibc-2.34 (bsc#1189201)</changelog>
  <changelog author="fstrba@suse.com" date="1631534400">- Modified patch:
  * nss-security-provider.patch
    + revert recent changes making NSS provider the default one
    + fixes bsc#1190252</changelog>
  <changelog author="fstrba@suse.com" date="1631793600">- Added patch:
  * fips.patch
    + implement FIPS support in OpenJDK</changelog>
  <changelog author="fstrba@suse.com" date="1634817600">- Update to upstream tag jdk-11.0.13+8 (October 2021 CPU)
  * Security fixes
    + JDK-8163326, CVE-2021-35550, bsc#1191901: Update the default
    enabled cipher suites preference
    + JDK-8254967, CVE-2021-35565, bsc#1191909:
    com.sun.net.HttpsServer spins on TLS session close
    + JDK-8263314: Enhance XML Dsig modes
    + JDK-8265167, CVE-2021-35556, bsc#1191910: Richer Text Editors
    + JDK-8265574: Improve handling of sheets
    + JDK-8265580, CVE-2021-35559, bsc#1191911: Enhanced style for
    RTF kit
    + JDK-8265776: Improve Stream handling for SSL
    + JDK-8266097, CVE-2021-35561, bsc#1191912: Better hashing
    support
    + JDK-8266103: Better specified spec values
    + JDK-8266109: More Resilient Classloading
    + JDK-8266115: More Manifest Jar Loading
    + JDK-8266137, CVE-2021-35564, bsc#1191913: Improve Keystore
    integrity
    + JDK-8266689, CVE-2021-35567, bsc#1191903: More Constrained
    Delegation
    + JDK-8267086: ArrayIndexOutOfBoundsException in
    java.security.KeyFactory.generatePublic
    + JDK-8267712: Better LDAP reference processing
    + JDK-8267729, CVE-2021-35578, bsc#1191904: Improve TLS client
    handshaking
    + JDK-8267735, CVE-2021-35586, bsc#1191914: Better BMP support
    + JDK-8268193: Improve requests of certificates
    + JDK-8268199: Correct certificate requests
    + JDK-8268205: Enhance DTLS client handshake
    + JDK-8268506: More Manifest Digests
    + JDK-8269618, CVE-2021-35603, bsc#1191906: Better session
    identification
    + JDK-8269624: Enhance method selection support
    + JDK-8270398: Enhance canonicalization
    + JDK-8270404: Better canonicalization
  * Other changes
    + JDK-8024368: private methods are allocated vtable indices
    + JDK-8042902: Test java/net/Inet6Address/serialize/
    /Inet6AddressSerializationTest.java fails intermittently
    + JDK-8140466: ChaCha20 and Poly1305 TLS Cipher Suites
    + JDK-8157404: Unable to read certain PKCS12 keystores from
    SequenceInputStream
    + JDK-8158066: SourceDebugExtensionTest fails to rename file
    + JDK-8168304: Make all of DependencyContext_test available in
    product mode
    + JDK-8169246: java/net/DatagramSocket/ReportSocketClosed.java
    fails intermittently with BindException
    + JDK-8181313: SA: Remove libthread_db dependency on Linux
    + JDK-8193214: Incorrect annotations.without.processors
    warnings with JDK 9
    + JDK-8194230: jdk/internal/jrtfs/remote/
    /RemoteRuntimeImageTest.java fails with
    java.lang.NullPointerException
    + JDK-8196092: javax/swing/JComboBox/8032878/bug8032878.java
    fails
    + JDK-8199931: java/net/MulticastSocket/
    /UnreferencedMulticastSockets.java fails with "incorrect data
    received"
    + JDK-8206083: Make tools/javac/api/T6265137.java robust to JDK
    version changes
    + JDK-8206350: java/util/Locale/bcp47u/SystemPropertyTests.java
    failed on Mac 10.13 with zh_CN and zh_TW locales.
    + JDK-8207316: java/nio/channels/spi/SelectorProvider/
    /inheritedChannel/InheritedChannelTest.java failed
    + JDK-8208227: tools/jdeps/DotFileTest.java fails on Win-X64
    + JDK-8208363: test/jdk/java/lang/Package/
    /PackageFromManifest.java missing module dependencies
    declaration
    + JDK-8209380: ARM: cleanup maybe-uninitialized and reorder
    compiler warnings
    + JDK-8209768: Refactor java/util/prefs/CheckUserPrefsStorage.sh
    to plain java test
    + JDK-8209772: Refactor shell test java/util/ServiceLoader/
    /basic/basic.sh to java
    + JDK-8209773: Refactor shell test javax/naming/module/basic.sh
    to java
    + JDK-8209832: Refactor jdk/internal/reflect/Reflection/
    /GetCallerClassTest.sh to plain java test
    + JDK-8209930: Refactor java/util/zip/ZipFile/deletetempjar.sh
    to plain java test
    + JDK-8210406: Refactor java.util.PluggableLocale:i18n shell
    tests to plain java tests
    + JDK-8210407: Refactor java.util.Calendar:i18n shell tests to
    plain java tests
    + JDK-8210495: compiler crashes because of illegal signature in
    otherwise legal code
    + JDK-8210669: Some launcher tests assume a pre-JDK 9 run-time
    image layout
    + JDK-8210802: temp files left by tests in
    jdk/java/net/httpclient
    + JDK-8210819: Update the host name in CNameTest.java
    + JDK-8210908: Refactor java/util/prefs/PrefsSpi.sh to plain
    java test
    + JDK-8210934: Move sun/net/www/protocol/http/
    /GetErrorStream.java to OpenJDK
    + JDK-8210959: JShell fails and exits when statement throws an
    exception whose message contains a '%'.
    + JDK-8211055: Provide print to a file (PDF) feature even when
    printer was not connected
    + JDK-8211092: test/jdk/sun/net/www/http/HttpClient/
    /MultiThreadTest.java fails intermittently when cleaning up
    + JDK-8211296: Remove HotSpot deprecation warning suppression
    for Mac/clang
    + JDK-8211325: test/jdk/java/net/Socket/LingerTest.java fails
    with cleaning up
    + JDK-8212040: Compilation error due to wrong usage of
    NSPrintJobDispositionValue in mac10.12
    + JDK-8212695: Add explicit timeout to several HTTP Client tests
    + JDK-8212718: Refactor some annotation processor tests to
    better use collections
    + JDK-8213007: Update the link in test/jdk/sun/security/
    /provider/SecureRandom/DrbgCavp.java
    + JDK-8213137: Remove static initialization of monitor/mutex
    instances
    + JDK-8213235: java/nio/channels/SocketChannel/
    /AsyncCloseChannel.java fails with threads that didn't exit
    + JDK-8213409: Refactor sun.text.IntHashtable:i18n shell tests
    to plain java tests
    + JDK-8213576: Make test AsyncCloseChannel.java run in othervm
    + JDK-8213694: Test Timeout.java should run in othervm mode
    + JDK-8213718: [TEST] Wrong classname in vmTestbase/nsk/stress/
    /except/except002 and except003
    + JDK-8213922: fix ctw stand-alone build
    + JDK-8214195: Align stdout messages in
    test/jdk/java/math/BigInteger/PrimitiveConversionTests.java
    + JDK-8214520: [TEST_BUG] sun/security/mscapi/nonUniqueAliases/
    /NonUniqueAliases.java failed with incorrect jtreg tags order
    + JDK-8214937: sun/security/tools/jarsigner/warnings/
    /NoTimestampTest.java failed due to unexpected expiration date
    + JDK-8216532: tools/launcher/Test7029048.java fails (Solaris)
    + JDK-8217825: Verify @AfterTest is used correctly in WebSocket
    tests
    + JDK-8218145: block_if_requested is not proper inlined due to
    size
    + JDK-8219417: bump jtreg requiredVersion to b14
    + JDK-8219552: bump jtreg requiredVersion to b14 in
    test/jdk/sanity/client/
    + JDK-8219804: java/net/MulticastSocket/Promiscuous.java fails
    intermittently due to NumberFormatException
    + JDK-8220445: Support for side by side MSVC Toolset versions
    + JDK-8221988: add possibility to build with Visual Studio 2019
    + JDK-8222751: closed/test/jdk/sun/security/util/
    /DerIndefLenConverter/IndefBerPkcs12.java fail
    + JDK-8223050: JVMCI: findUniqueConcreteMethod() should not use
    Dependencies::find_unique_concrete_method() for non-virtual
    methods
    + JDK-8224853: CDS address sanitizer errors
    + JDK-8225082: Remove IdenTrust certificate that is expiring in
    September 2021
    + JDK-8225583: Examine the HttpResponse.BodySubscribers for
    null handling and multiple subscriptions
    + JDK-8225690: Multiple AttachListener threads can be created
    + JDK-8225790: Two NestedDialogs tests fail on Ubuntu
    + JDK-8226319: Add forgotten test/jdk/java/net/httpclient/
    /BodySubscribersTest.java
    + JDK-8226533: JVMCI: findUniqueConcreteMethod should handle
    statically bindable methods directly
    + JDK-8226602: Test convenience reactive primitives from
    java.net.http with RS TCK
    + JDK-8226683: Remove review suggestion from fix to 8219804
    + JDK-8227738: jvmti/DataDumpRequest/datadumpreq001 failed due
    to "exit code is 134"
    + JDK-8227766: CheckUnhandledOops is broken in MemAllocator
    + JDK-8227815: Minimal VM: set_state is not a member of
    AttachListener
    + JDK-8230674: Heap dumps should exclude dormant CDS archived
    objects of unloaded classes
    + JDK-8230808: Remove Access::equals()
    + JDK-8230841: Remove oopDesc::equals()
    + JDK-8231717: Improve performance of charset decoding when
    charset is always compactable
    + JDK-8232243: Wrong caret position in JTextPane on Windows
    with a screen resolution &gt; 100%
    + JDK-8232782: Shenandoah: streamline post-LRB CAS barrier
    (aarch64)
    + JDK-8233790: Forward output from heap dumper to jcmd/jmap
    + JDK-8233989: Create an IPv4 version of
    java/net/MulticastSocket/SetLoopbackMode.java
    + JDK-8234510: Remove file seeking requirement for writing a
    heap dump
    + JDK-8235211: serviceability/attach/
    /RemovingUnixDomainSocketTest.java fails with
    AttachNotSupportedException: Unable to open socket file
    + JDK-8235216: typo in test filename
    + JDK-8235866: bump jtreg requiredVersion to 4.2b16
    + JDK-8236111: narrow allowSmartActionArgs disabling
    + JDK-8236413: AbstractConnectTimeout should tolerate both
    NoRouteToHostException and UnresolvedAddressException
    + JDK-8236671: NullPointerException in JKS keystore
    + JDK-8238930: problem list compiler/c2/Test8004741.java
    + JDK-8238943: switch to jtreg 5.0
    + JDK-8240555: Using env of JAVA_TOOL_OPTIONS and _JAVA_OPTIONS
    breaks QuietOption.java test
    + JDK-8240983: Incorrect copyright header in Apache Santuario
    2.1.3 files
    + JDK-8241336: Some java.net tests failed with
    NoRouteToHostException on MacOS with special network
    configuration
    + JDK-8241353: NPE in ToolProvider.getSystemJavaCompiler
    + JDK-8241768: git needs .gitattributes
    + JDK-8242882: opening jar file with large manifest might throw
    NegativeArraySizeException
    + JDK-8244973: serviceability/attach/
    /RemovingUnixDomainSocketTest.java fails "stderr was not
    empty"
    + JDK-8245134: test/lib/jdk/test/lib/security/
    /KeyStoreUtils.java should allow to specify aliases
    + JDK-8246261: TCKLocalTime.java failed due to "AssertionError:
    expected [18:14:22] but found [18:14:23]"
    + JDK-8246387: switch to jtreg 5.1
    + JDK-8247421: [TESTBUG] ReturnBlobToWrongHeapTest.java failed
    allocating blob
    + JDK-8247469: getSystemCpuLoad() returns -1 on linux when some
    offline cpus are present and cpusets.effective_cpus is not
    available
    + JDK-8248352: [TEST_BUG] Test test/jdk/java/awt/font/
    /TextLayout/ArabicDiacriticTest.java can leave frame open
    + JDK-8248403: AArch64: Remove uses of kernel integer types
    + JDK-8248414: AArch64: Remove uses of long and unsigned long
    ints
    + JDK-8248657: Windows: strengthening in ThreadCritical
    regarding memory model
    + JDK-8248666: AArch64: Use THREAD_LOCAL instead of __thread
    + JDK-8248668: AArch64: Avoid MIN/MAX macros when using MSVC
    + JDK-8248671: AArch64: Remove unused variables
    + JDK-8248682: AArch64: Use ATTRIBUTE_ALIGNED helper
    + JDK-8248816: C1: Fix signature conflict in
    LIRGenerator::strength_reduce_multiply
    + JDK-8249095: tools/javac/launcher/SourceLauncherTest.java
    fails on Windows
    + JDK-8249548: backward focus traversal gets stuck in button
    group
    + JDK-8249773: Upgrade ReceiveISA.java test to be resilient to
    failure due to stray packets and interference
    + JDK-8249897: jdk/javadoc/tool/LangVers.java uses @ignore w/o
    bug-id
    + JDK-8249898: jdk/javadoc/tool/6176978/T6176978.java uses
    @ignore w/o bug-id
    + JDK-8249899: jdk/javadoc/tool/InlineTagsWithBraces.java uses
    @ignore w/o bug-id
    + JDK-8250588: Shenandoah: LRB needs to save/restore fp
    registers for runtime call
    + JDK-8250824: AArch64: follow up for JDK-8248414
    + JDK-8251166: Add automated testcases for changes done in
    JDK-8214112
    + JDK-8251252: Add automated testcase for fix done in
    JDK-8214253
    + JDK-8251254: Add automated test for fix done in JDK-8218472
    + JDK-8251361: Potential race between Logger configuration and
    GCs in HttpURLConWithProxy test
    + JDK-8251549: Update docs on building for Git
    + JDK-8251945: SIGSEGV in
    PackageEntry::purge_qualified_exports()
    + JDK-8252194: Add automated test for fix done in JDK-8218469
    + JDK-8252648: Shenandoah: name gang tasks consistently
    + JDK-8252825: Add automated test for fix done in JDK-8218479
    + JDK-8252853: AArch64: gc/shenandoah/TestVerifyJCStress.java
    fails intermittently with C1
    + JDK-8252857: AArch64: Shenandoah C1 CAS is not sequentially
    consistent
    + JDK-8253048: AArch64: When CallLeaf, no need to preserve
    callee-saved registers in caller
    + JDK-8253424: Add support for running pre-submit testing using
    GitHub Actions
    + JDK-8253631: Remove unimplemented CompileBroker methods after
    JEP-165
    + JDK-8253865: Pre-submit testing using GitHub Actions does not
    detect failures reliably
    + JDK-8253899: Make IsClassUnloadingEnabled signature match
    specification
    + JDK-8254024: Enhance native libs for AWT and Swing to work
    with GraalVM Native Image
    + JDK-8254054: Pre-submit testing using GitHub Actions should
    not use the deprecated set-env command
    + JDK-8254173: Add Zero, Minimal hotspot targets to submit
    workflow
    + JDK-8254175: Build no-pch configuration in debug mode for
    submit checks
    + JDK-8254244: Some code emitted by TemplateTable::branch is
    unused when running TieredCompilation
    + JDK-8254270: linux 32 bit build doesn't compile
    libjdwp/log_messages.c
    + JDK-8254282: Add Linux x86_32 builds to submit workflow
    + JDK-8254850: Update terminology in java.awt.GridBagLayout
    source code comments
    + JDK-8255255: Update Apache Santuario (XML Signature) to
    version 2.2.1
    + JDK-8255305: Add Linux x86_32 tier1 to submit workflow
    + JDK-8255352: Archive important test outputs in submit workflow
    + JDK-8255373: Submit workflow artifact name is always
    "test-results_.zip"
    + JDK-8255452: Doing GC during JVMTI MethodExit event posting
    breaks return oop
    + JDK-8255718: Zero: VM should know it runs in interpreter-only
    mode
    + JDK-8255790: GTKL&amp;F: Java 16 crashes on initialising GTKL&amp;F
    on Manjaro Linux
    + JDK-8255810: Zero: build fails without JVMTI
    + JDK-8255895: Submit workflow artifacts miss hs_errs/replays
    due to ZIP include mismatch
    + JDK-8256127: Add cross-compiled foreign architectures builds
    to submit workflow
    + JDK-8256215: Shenandoah: re-organize saving/restoring machine
    state in assembler code
    + JDK-8256267: Relax compiler/floatingpoint/NaNTest.java for
    x86_32 and lower -XX:+UseSSE
    + JDK-8256277: Github Action build on macOS should define OS
    and Xcode versions
    + JDK-8256354: Github Action build on Windows should define OS
    and MSVC versions
    + JDK-8256393: Github Actions build on Linux should define OS
    and GCC versions
    + JDK-8256414: add optimized build to submit workflow
    + JDK-8256747: GitHub Actions: decouple the hotspot build-only
    jobs from Linux x64 testing
    + JDK-8257056: Submit workflow should apt-get update to avoid
    package installation errors
    + JDK-8257148: Remove obsolete code in AWTView.m
    + JDK-8257497: Update keytool to create AKID from the SKID of
    the issuing certificate as specified by RFC 5280
    + JDK-8257620: Do not use objc_msgSend_stret to get macOS
    version
    + JDK-8257913: Add more known library locations to simplify
    Linux cross-compilation
    + JDK-8258703: Incorrect 512-bit vector registers restore on
    x86_32
    + JDK-8259338: Add expiry exception for identrustdstx3 alias to
    VerifyCACerts.java test
    + JDK-8259535: ECDSA SignatureValue do not always have the
    specified length
    + JDK-8259679: GitHub actions should use MSVC 14.28
    + JDK-8259924: GitHub actions fail on Linux x86_32 with "Could
    not configure libc6:i386"
    + JDK-8260460: GitHub actions still fail on Linux x86_32 with
    "Could not configure libc6:i386"
    + JDK-8260589: Crash in JfrTraceIdLoadBarrier::load(_jclass*)
    + JDK-8260923: Add more tests for SSLSocket input/output
    shutdown
    + JDK-8261072: AArch64: Fix MacroAssembler::get_thread
    convention
    + JDK-8261147: C2: Node is wrongly marked as reduction
    resulting in a wrong execution due to wrong vector instructions
    + JDK-8261238: NMT should not limit baselining by size threshold
    + JDK-8261496: Shenandoah: reconsider pacing updates memory
    ordering
    + JDK-8261652: Remove some dead comments from os_bsd_x86
    + JDK-8261846: [JVMCI] c2v_iterateFrames can get out of sync
    with the StackFrameStream
    + JDK-8262000: jdk/jfr/event/gc/detailed/
    /TestPromotionFailedEventWithParallelScavenge.java failed with
    "OutOfMemoryError: Java heap space"
    + JDK-8262017: C2: assert(n != __null) failed: Bad immediate
    dominator info.
    + JDK-8262392: Update Mesa 3-D Headers to version 21.0.3
    + JDK-8262409: sun/security/ssl/SSLSocketImpl/
    /SSLSocketImplThrowsWrongExceptions. SSL test failures caused
    by java failed with "Server reported the wrong exception"
    + JDK-8262470: Printed GlyphVector outline with low DPI has bad
    quality on Windows
    + JDK-8262862: Harden tests sun/security/x509/URICertStore/
    /ExtensionsWithLDAP.java and krb5/canonicalize/Test.java
    + JDK-8263136: C4530 was reported from VS 2019 at access bridge
    + JDK-8263227: C2: inconsistent spilling due to dead nodes in
    exception block
    + JDK-8263382: java/util/logging/ParentLoggersTest.java failed
    with "checkLoggers: getLoggerNames() returned unexpected
    loggers"
    + JDK-8263407: SPARC64 detection fails on Athena (SPARC64-X)
    + JDK-8263432: javac may report an invalid package/class clash
    on case insensitive filesystems
    + JDK-8263490: [macos] Crash occurs on JPasswordField with
    activated InputMethod
    + JDK-8263531: Remove unused buffer int
    + JDK-8263667: Avoid running GitHub actions on branches named
    pr/*
    + JDK-8263776: [JVMCI] add helper to perform Java upcalls
    + JDK-8264016: [JVMCI] add some thread local fields for use by
    JVMCI
    + JDK-8264752: SIGFPE crash with option
    FlightRecorderOptions:threadbuffersize=30M
    + JDK-8265132: C2 compilation fails with assert "missing
    precedence edge"
    + JDK-8265231: (fc) ReadDirect and WriteDirect tests fail after
    fix for JDK-8264821
    + JDK-8265335: Epsilon: Minor typo in EpsilonElasticTLABDecay
    description
    + JDK-8265756: AArch64: initialize memory allocated for locals
    according to Windows AArch64 stack page growth requirement in
    template interpreter
    + JDK-8265761: Font with missed font family name is not
    properly printed on Windows
    + JDK-8265773: incorrect jdeps message "jdk8internals" to
    describe a removed JDK internal API
    + JDK-8265836: OperatingSystemImpl.getCpuLoad() returns
    incorrect CPU load inside a container
    + JDK-8266018: Shenandoah: fix an incorrect assert
    + JDK-8266206: Build failure after JDK-8264752 with older GCCs
    + JDK-8266248: Compilation failure in
    PLATFORM_API_MacOSX_MidiUtils.c with Xcode 12.5
    + JDK-8266288: assert root method not found in
    witnessed_reabstraction_in_supers is too strong
    + JDK-8266404: Fatal error report generated with
  - XX:+CrashOnOutOfMemoryError should not contain suggestion to
    submit a bug report
    + JDK-8266480: Implicit null check optimization does not update
    control of hoisted memory operation
    + JDK-8266615: C2 incorrectly folds subtype checks involving an
    interface array
    + JDK-8266642: Improve ResolvedMethodTable hash function
    + JDK-8266749: AArch64: Backtracing broken on PAC enabled
    systems
    + JDK-8266761: AssertionError in
    sun.net.httpserver.ServerImpl.responseCompleted
    + JDK-8266813: Shenandoah: Use shorter instruction sequence for
    checking if marking in progress
    + JDK-8267042: bug in monitor locking/unlocking on ARM32 C1 due
    to uninitialized BasicObjectLock::_displaced_header
    + JDK-8267348: Rewrite gc/epsilon/TestClasses.java to use
    Metaspace with less classes
    + JDK-8267396: Avoid recording "pc" in unhandled oops detector
    for better performance
    + JDK-8267399: C2: java/text/Normalizer/ConformanceTest.java
    test failed with assertion
    + JDK-8267424: CTW: C1 fails with "State must not be null"
    + JDK-8267459: Pasting Unicode characters into JShell does not
    work.
    + JDK-8267625: AARCH64: typo in LIR_Assembler::emit_profile_type
    + JDK-8267666: Add option to jcmd GC.heap_dump to use existing
    file
    + JDK-8267695: Bump update version for OpenJDK: jdk-11.0.13
    + JDK-8267751: (test) jtreg.SkippedException has no serial
    VersionUID
    + JDK-8267773: PhaseStringOpts::int_stringSize doesn't handle
    min_jint correctly
    + JDK-8268103: JNI functions incorrectly return a double after
    JDK-8265836
    + JDK-8268127: Shenandoah: Heap size may be too small for
    region to align to large page size
    + JDK-8268261: C2: assert(n != __null) failed: Bad immediate
    dominator info.
    + JDK-8268347: C2: nested locks optimization may create
    unbalanced monitor enter/exit code
    + JDK-8268360: Missing check for infinite loop during node
    placement
    + JDK-8268362: [REDO] C2 crash when compile negative
    Arrays.copyOf length after loop
    + JDK-8268366: Incorrect calculation of has_fpu_registers in C1
    linear scan
    + JDK-8268369: SIGSEGV in PhaseCFG::implicit_null_check due to
    missing null check
    + JDK-8268417: Add test from JDK-8268360
    + JDK-8268427: Improve AlgorithmConstraints:checkAlgorithm
    performance
    + JDK-8268617: [11u REDO] - WebSocket over authenticating proxy
    fails with NPE
    + JDK-8268620: InfiniteLoopException test may fail on x86
    platforms
    + JDK-8268635: Corrupt oop in ClassLoaderData
    + JDK-8268699: Shenandoah: Add test for JDK-8268127
    + JDK-8268771: javadoc -notimestamp option does not work on
    index.html
    + JDK-8268775: Password is being converted to String in
    AccessibleJPasswordField
    + JDK-8268776: Test `ADatagramSocket.java` missing /othervm
    from @run tag
    + JDK-8268965: TCP Connection Reset when connecting simple
    socket to SSL server
    + JDK-8269304: Regression ~5% in 2005 in b27
    + JDK-8269415: [11u] Remove ea from
    DEFAULT_PROMOTED_VERSION_PRE in OpenJDK 11u
    + JDK-8269478: Shenandoah: gc/shenandoah/mxbeans tests should
    be more resilient
    + JDK-8269529: javax/swing/reliability/
    /HangDuringStaticInitialization.java fails in Windows debug
    build
    + JDK-8269594: assert(_handle_mark_nesting &gt; 1) failed: memory
    leak: allocating handle outside HandleMark
    + JDK-8269614: [s390] Interpreter checks wrong bit for slow
    path instance allocation
    + JDK-8269650: Optimize gc-locker in
    [Get|Release]StringCritical for latin string
    + JDK-8269661: JNI_GetStringCritical does not lock char array
    + JDK-8269668: [aarch64] java.library.path not including
    /usr/lib64
    + JDK-8269763: The JEditorPane is blank after JDK-8265167
    + JDK-8269795: C2: Out of bounds array load floats above its
    range check in loop peeling resulting in SEGV
    + JDK-8269847: JDK-8269594 backport breaks 11u builds
    + JDK-8269850: Most JDK releases report macOS version 12 as
    10.16 instead of 12.0
    + JDK-8269851: OperatingSystemMXBean getProcessCpuLoad reports
    incorrect process cpu usage in containers
    + JDK-8269882: stack-use-after-scope in NewObjectA
    + JDK-8269934: RunThese24H.java failed with
    EXCEPTION_ACCESS_VIOLATION in
    java_lang_Thread::get_thread_status
    + JDK-8270096: Shenandoah: Optimize gc/shenandoah/
    /TestRefprocSanity.java for interpreter mode
    + JDK-8270137: Kerberos Credential Retrieval from Cache not
    Working in Cross-Realm Setup
    + JDK-8270184: [TESTBUG] Add coverage for jvmci
    ResolvedJavaType.toJavaName() for lambdas
    + JDK-8270196: [11u] [JVMCI] JavaType.toJavaName() returns
    incorrect type name for lambdas
    + JDK-8270556: Exclude security/infra/java/security/cert/
    /CertPathValidator/certification/LetsEncryptCA
    + JDK-8270893: IndexOutOfBoundsException while reading large
    TIFF file
    + JDK-8272078: Wrong Checksums in Temurin BootJDK dependencies
    + JDK-8272124: Cgroup v1 initialization causes
    NullPointerException when cgroup path contains colon
    + JDK-8272131: PhaseMacroExpand::generate_slow_arraycopy crash
    when clone null CallProjections.fallthrough_ioproj
    + JDK-8272197: Update 11u GHA workflow with Shenandoah
    configurations
    + JDK-8272332: --with-harfbuzz=system doesn't add -lharfbuzz
    after JDK-8255790
    + JDK-8272472: StackGuardPages test doesn't build with glibc
    2.34
    + JDK-8272602: [macos] not all KEY_PRESSED events sent when
    control modifier is used
    + JDK-8272628: Problemlist gc/stress/gcbasher/
    /TestGCBasherWithCMS.java for x86_32
    + JDK-8272700: [macos] Build failure with Xcode 13.0 after
    JDK-8264848
    + JDK-8272772: Shenandoah: compiler/c2/aarch64/
    /TestVolatilesShenandoah.java fails in 11u
    + JDK-8273939: Backport of 8248414 to JDK11 breaks
    MacroAssembler::adrp
- Remove the unneeded icedtea-sound provider
- Removed patches:
  * icedtea-sound-1.0.1-jdk9.patch
  * icedtea-sound-soundproperties.patch
    + not needed since the icedtea-sound provider is removed
  * jdk11-glibc234.patch
    + integrated upstream</changelog>
  <changelog author="fstrba@suse.com" date="1635940800">- Modified patches:
  * system-crypto-policy.patch
    + rediff to changed context
  * fips.patch
    + Allow plain key import in fips mode unless
    com.suse.fips.plainKeySupport is set to false</changelog>
  <changelog author="fstrba@suse.com" date="1636113600">- Modified patch:
  * fips.patch
    + return in native code after generating java.io.IOException</changelog>
</package>
<package pkgid="31f2ba34686b4ea93285f8bdfb6563e22546587e70b4b2fbcba9274cbc546e48" name="java-11-openjdk-jmods" arch="aarch64">
  <version epoch="0" ver="11.0.13.0" rel="3.68.1"/>
  <changelog author="fstrba@suse.com" date="1586952000">- The pack200 and unpack200 alternatives should be slaves of java
  and not of javac, since they are part of JRE.</changelog>
  <changelog author="fstrba@suse.com" date="1587470400">- Update to upstream tag jdk-11.0.7+10 (April 2020 CPU,
  bsc#1169511)
  * Security fixes:
    + S8223898, CVE-2020-2754: Forward references to Nashorn
    + S8223904, CVE-2020-2755: Improve Nashorn matching
    + S8224541, CVE-2020-2756: Better mapping of serial ENUMs
    + S8224549, CVE-2020-2757: Less Blocking Array Queues
    + S8225603: Enhancement for big integers
    + S8226346: Build better binary builders
    + S8227467: Better class method invocations
    + S8227542: Manifest improved jar headers
    + S8229733: TLS message handling improvements
    + S8231415, CVE-2020-2773: Better signatures in XML
    + S8231785: Improved socket permissions
    + S8232424, CVE-2020-2778: More constrained algorithms
    + S8232581, CVE-2020-2767: Improve TLS verification
    + S8233250: Better X11 rendering
    + S8233410: Better Build Scripting
    + S8234027: Better JCEKS key support
    + S8234408, CVE-2020-2781: Improve TLS session handling
    + S8234825, CVE-2020-2800: Better Headings for HTTP Servers
    + S8234841, CVE-2020-2803: Enhance buffering of byte buffers
    + S8235274, CVE-2020-2805: Enhance typing of methods
    + S8235691, CVE-2020-2816: Enhance TLS connectivity
    + S8236201, CVE-2020-2830: Better Scanner conversions
    + S8238960: linux-i586 builds are inconsistent as the newly
    built jdk is not able to reserve enough space for object heap
  * Other changes:
    + S4919790: Errors in alert ssl message does not reflect the
    actual certificate status
    + S4949105: Access Bridge lacks html tags parsing
    + S7092821: java.security.Provider.getService() is synchronized
    and became scalability bottleneck
    + S7143743: Potential memory leak with zip provider
    + S8005819: Support cross-realm MSSFU
    + S8042383: [TEST_BUG] Test javax/swing/plaf/basic/BasicMenuUI/
    /4983388/bug4983388.java fails with shortcuts on menus do not
    work
    + S8068184: Fix for JDK-8032832 caused a deadlock
    + S8145845: [AOT] NullPointerException in
    compiler/whitebox/GetCodeHeapEntriesTest.java
    + S8152988: [AOT] Update test batch definitions to include
    aot-ed java.base module mode into hs-comp testing
    + S8160926: FLAGS_COMPILER_CHECK_ARGUMENTS doesn't handle
    cross-compilation
    + S8163083: SocketListeningConnector does not allow invocations
    with port 0
    + S8163251: Hard coded loop limit prevents reading of smart
    card data greater than 8k
    + S8167276: jvmci/compilerToVM/MaterializeVirtualObjectTest.java
    fails with -XX:-EliminateAllocations
    + S8169718: nsk/jdb/locals/locals002: ERROR: Cannot find
    boolVar with expected value: false
    + S8176556:
    java/awt/dnd/ImageTransferTest/ImageTransferTest.java fails
    for JFIF
    + S8178798: Two compiler/aot/verification/vmflags tests fail by
    timeout with UseAVX=3
    + S8183107: PKCS11 regression regarding checkKeySize
    + S8185005: Improve performance of
    ThreadMXBean.getThreadInfo(long ids[], int maxDepth)
    + S8189633: Missing -Xcheck:jni checking for DeleteWeakGlobalRef
    + S8189861: Refactor CacheFind
    + S8193042: NativeLookup::lookup_critical_entry() should only
    load shared library once
    + S8193596: java/net/DatagramPacket/ReuseBuf.java failed due to
    timeout
    + S8194944: Regression automated test 'open/test/jdk/javax/
    /swing/JInternalFrame/8145896/TestJInternalFrameMaximize.java'
    fails
    + S8196467: javax/swing/JInternalFrame/Test6325652.java fails
    + S8196969: JTreg Failure: serviceability/sa/ClhsdbJstack.java
    causes NPE
    + S8198321: javax/swing/JEditorPane/5076514/bug5076514.java
    fails
    + S8198398: Test javax/swing/JColorChooser/Test6199676.java
    fails in mach5
    + S8199072: Test javax/swing/GroupLayout/6613904/
    /bug6613904.java is unstable
    + S8200432: javadoc fails with ClassCastException on {@link
    byte[]}
    + S8201349: build broken when configured with
  - -with-zlib=bundled on gcc 7.3
    + S8201355: Avoid native memory allocation in
    sun.security.mscapi.PRNG.generateSeed
    + S8201513: nsk/jvmti/IterateThroughHeap/filter-* are broken
    + S8203364: Some serviceability/sa/ tests intermittently fail
    with java.io.IOException: LingeredApp terminated with non-zero
    exit code 3
    + S8203687: javax/net/ssl/compatibility/Compatibility.java
    supports TLS 1.3
    + S8203904: javax/swing/JSplitPane/4816114/bug4816114.java: The
    divider location is wrong
    + S8203911: Test runtime/modules/getModuleJNI/GetModule fails
    with -Xcheck:jni
    + S8204525: [TESTBUG] runtime/NMT/MallocStressTest.java ran out
    of java heap
    + S8204529: gc/TestAllocateHeapAtMultiple.java fail with Agent
    7 timed out
    + S8204551: Event descriptions are truncated in logs
    + S8206963: [AOT] bug with multiple class loaders
    + S8207367: 10 vmTestbase/nsk/jdi tests timed out when running
    with jtreg
    + S8207832: serviceability/sa/ClhsdbCDSCore.java failed with
    "Couldn't find core file location"
    + S8207938: At step6,Click Add button,case failed automatically.
    + S8208157: requires.VMProps throws NPE for missing properties
    in "release" file
    + S8208379: compiler/jvmci/events/
    /JvmciNotifyInstallEventTest.java failed with "Got unexpected
    event count after 2nd install attempt: expected 9 to equal 2"
    + S8208658: Make CDS archived heap regions usable even if
    compressed oop encoding has changed
    + S8208715: Conversion of milliseconds to nanoseconds in
    UNIXProcess contains bug
    + S8209361: [AOT] Unexpected number of references for
    JVMTI_HEAP_REFERENCE_CONSTANT_POOL [111--&gt;111]: 0 (expected
    at least 1)
    + S8209385: CDS runtime classpath checking is too strict when
    only classes from the system modules are archived
    + S8209389: SIGSEGV in WalkOopAndArchiveClosure::do_oop_work.
    + S8209418: Synchronize test/jdk/sanity/client/lib/jemmy with
    code-tools/jemmy/v2
    + S8209494: Create a test for SwingSet InternalFrameDemo
    + S8209499: Create test for SwingSet EditorPaneDemo
    + S8209574: [AOT] breakpoint events are generated in different
    threads does not meet expected count
    + S8209686: cleanup arguments to PhaseIdealLoop() constructor
    + S8209789: Synchronize test/jdk/sanity/client/lib/jemmy with
    code-tools/jemmy/v2
    + S8209802: Garbage collectors should register JFR types
    themselves to avoid build errors.
    + S8209807: improve handling exception in requires.VMProps
    + S8209817: stack is executable when building with Clang on
    Linux
    + S8209824: Improve the code coverage for ThreadLocal
    + S8209826: Undefined reference to os::write after JDK-8209657
    (filemap.hpp cleanup)
    + S8209850: Allow NamedThreads to use GlobalCounter critical
    sections
    + S8209976: Improve iteration over non-JavaThreads
    + S8209993: Create a test for SwingSet3 ToolTipDemo
    + S8210024: JFR calls virtual is_Java_thread from ~Thread()
    + S8210052: Enable testing for all the available look and feels
    in SwingSet3 demo tests
    + S8210055: Enable different look and feel tests in SwingSet3
    demo tests
    + S8210057: Enable different look and feels in SwingSet3 demo
    test InternalFrameDemoTest
    + S8210058: Algorithmic Italic font leans opposite angle in
    Printing
    + S8210220: [AOT] jdwp test cases are failing with error #
    ERROR: TEST FAILED: Cought IOException while receiving event
    packet
    + S8210289: ArchivedKlassSubGraphInfoRecord is incomplete
    + S8210459: Add support for generating compile_commands.json
    + S8210476: sun/security/mscapi/PrngSlow.java fails with Still
    too slow
    + S8210512: [Testbug] vmTestbase/nsk/jdi/ObjectReference/
    /referringObjects/referringObjects002/referringObjects002.java
    fails with unexpected size of
    ClassLoaderReference.referringObjects
    + S8210523: runtime/appcds/cacheObject/DifferentHeapSizes.java
    crash
    + S8210632: Add key exchange algorithm to
    javax/net/ssl/TLSCommon/CipherSuite.java
    + S8210699: Problem list tests which times out in Xcomp mode
    + S8210793: [JVMCI] AllocateCompileIdTest.java failed to find
    DiagnosticCommand.class
    + S8210910: Create test for FileChooserDemo
    + S8210994: Create test for SwingSet3 FrameDemo
    + S8211139: Increase timeout value in all tests under
    jdk/sanity/client/SwingSet/src
    + S8211160: Handle different look and feels in
    JInternalFrameOperator
    + S8211211: vmTestbase/metaspace/stressDictionary/
    /StressDictionary.java timeout
    + S8211322: Reduce the timeout of tooltip in SwingSet2DemoTest
    + S8211443: Enable different look and feels in SwingSet3 demo
    test SplitPaneDemoTest
    + S8211703: JInternalFrame : java.lang.AssertionError: cannot
    find the internal frame
    + S8211781: re-building fails after changing Graal sources
    + S8212897: Some improvements in the EditorPaneDemotest
    + S8212903: [TestBug] Tests test/jdk/javax/swing/LookAndFeel/
    /8145547/DemandGTK2.sh and DemandGTK3.sh fail on Ubuntu 18.04
    LTS
    + S8213009: Refactoring existing SunMSCAPI classes
    + S8213010: Supporting keys created with certmgr.exe
    + S8213168: Enable different look and feel tests in SwingSet3
    demo test FileChooserDemoTest
    + S8213348: jdk.internal.vm.compiler.management service
    providers missing in module descriptor
    + S8213906: Update arm devkits with libXrandr headers
    + S8213908: AssertionError in DeferredAttr at setOverloadKind
    + S8214124: [TESTBUG] Bugs in runtime/NMT/MallocStressTest.java
    + S8214344: C2: assert(con.basic_type() != T_ILLEGAL) failed:
    elembt=byte; loadbt=void; unsigned=0
    + S8214345: infinite recursion while checking super class
    + S8214471: Enable different look and feel tests in SwingSet3
    demo test ToolTipDemoTest
    + S8214534: Setting of THIS_FILE in the build is broken
    + S8214557: Filter out VM flags which don't affect AOT code
    generation
    + S8214578: [macos] Problem with backslashes on macOS/JIS
    keyboard: Java ignores system settings
    + S8214840: runtime/NMT/MallocStressTest.java timed out
    + S8214850: Rename vm_operations.?pp files to vmOperations.?pp
    files
    + S8214904: Test8004741.java failed due to "Too few ThreadDeath
    hits; expected at least 6 but saw only 5"
    + S8215322: add @file support to jaotc
    + S8215355: Object monitor deadlock with no threads holding the
    monitor (using jemalloc 5.1)
    + S8215396: JTabbedPane preferred size calculation is wrong for
    SCROLL_TAB_LAYOUT
    + S8216180: [AOT] compiler/intrinsics/bigInteger/TestMulAdd.java
    crashed with AOT enabled
    + S8216353: Use utility APIs introduced in org/netbeans/jemmy/
    /util/LookAndFeel class in client sanity test cases
    + S8216354: Syntax error in toolchain_windows.m4
    + S8216472: (se) Stack overflow during selection operation
    leads to crash (win)
    + S8216535: tools/jimage/JImageExtractTest.java timed out
    + S8217235: Create automated test for SwingSet
    ColorChooserDemoTest
    + S8217297: Add support for multiple look and feel for SwingSet
    SliderDemoTest
    + S8217338: [Containers] Improve systemd slice memory limit
    support
    + S8217613: [AOT] TEST_OPTS_AOT_MODULES doesn't work on mac
    + S8217634: RunTest documentation and usability update
    + S8217717: ZGC: Broken oop map in C1 load barrier stub
    + S8217728: Speed up incremental rerun of "make hotspot"
    + S8218268: Javac treats Manifest Class-Path entries as Paths
    instead of URLs
    + S8218662: Allow 204 responses with Content-Length:0
    + S8218882: NET_Writev is declared, NET_WriteV is defined
    + S8218889: Improperly use of the Optional API
    + S8219205: JFR file without license header
    + S8219597: (bf) Heap buffer state changes could provoke
    unexpected exceptions
    + S8219723: javax/net/ssl/compatibility/Compatibility.java
    failed on some SNI cases
    + S8220348: [ntintel] asserts about copying unaligned array
    + S8220451: jdi/EventQueue/remove/remove004 failed due to
    "ERROR: thread2 is not alive"
    + S8220456: jdi/EventQueue/remove_l/remove_l004 failed due to
    "TIMEOUT while waiting for event"
    + S8220479: java/nio/channels/Selector/SelectWithConsumer.java
    failed at testTwoChannels()
    + S8220613: java/util/Arrays/TimSortStackSize2.java times out
    with fastdebug build
    + S8220688: [TESTBUG] runtime/NMT/MallocStressTest.java timed
    out
    + S8220786: Create new switch to redirect error reporting
    output to stdout or stderr
    + S8221270: Duplicated synchronized keywords in SSLSocketImpl
    + S8221312: test/jdk/sanity/client/SwingSet/src/
    /ColorChooserDemoTest.java failed
    + S8221851: Use of THIS_FILE in hotspot invalidates precompiled
    header on Linux/GCC
    + S8221885: Add intermittent test in the JavaSound to the
    ProblemList
    + S8222264: Windows incremental build is broken with JDK-8217728
    + S8222391: javax/net/ssl/compatibility/Compatibility.java
    should be more flexible
    + S8222448: java/lang/reflect/PublicMethods/
    /PublicMethodsTest.java times out
    + S8222519: ButtonDemoScreenshotTest fails randomly with "still
    state to be reached"
    + S8222741: jdi/EventQueue/remove/remove004 fails due to
    VMDisconnectedException
    + S8223003: SunMSCAPI keys are not cleaned up
    + S8223063: Support CNG RSA keys
    + S8223158: Docked MacBook cannot start any Java Swing
    applications
    + S8223260: NamingManager should cache InitialContextFactory
    + S8223464: Improve version string for Oracle CI builds
    + S8223558: Java does not render Myanmar script correctly
    + S8223627: jdk-13+20 bundle name contains null instead of ea
    + S8223638: Replace wildcard address with loopback or local
    host in tests - part 6
    + S8223678: Add Visual Studio Code workspace generation support
    (for native code)
    + S8223727: com/sun/jndi/ldap/privconn/RunTest.java failed due
    to hang in LdapRequest.getReplyBer
    + S8223769: Assert triggers with -XX:+StressReflectiveCode
    + S8224187: Refactor arraycopy_prologue to allow ZGC read
    barriers on arraycopy
    + S8224475: JTextPane does not show images in HTML rendering
    + S8224673: Adjust permission for delayed starting of debugging
    + S8224705: Tests that need to be problem-listed or have
    printer resources
    + S8224778: test/jdk/demo/jfc/J2Ddemo/J2DdemoTest.java cannot
    find J2Ddemo.jar
    + S8224821: java/awt/Focus/NoAutotransferToDisabledCompTest/
    /NoAutotransferToDisabledCompTest.java fails linux-x64
    + S8224830: test/jdk/java/awt/Focus/
    /ModalExcludedWindowClickTest/
    /ModalExcludedWindowClickTest.java fails on linux-x64
    + S8224851: AArch64: fix warnings and errors with Clang and GCC
    8.3
    + S8224905: java/lang/ProcessBuilder/Basic.java#id1 failed with
    stream closed
    + S8225007: java/awt/print/PrinterJob/
    /LandscapeStackOverflow.java may hang
    + S8225105: java/awt/Focus/ShowFrameCheckForegroundTest/
    /ShowFrameCheckForegroundTest.java fails in Windows 10
    + S8225117: java/math/BigInteger/SymmetricRangeTests.java fails
    with ParseException
    + S8225128: Add exception for expiring DocuSign root to
    VerifyCACerts test
    + S8225130: Add exception for expiring Comodo roots to
    VerifyCACerts test
    + S8225144: [macos] In Aqua L&amp;F backspace key does not delete
    when Shift is pressed
    + S8225180: SignedObject with invalid Key not throwing the
    InvalidKeyException in Windows
    + S8225182: JNI exception pending in DestroyXIMCallback of
    awt_InputMethod.c:1327
    + S8225199: [Graal] compiler/jvmci/compilerToVM/
    /IsMatureVsReprofileTest.java fails with
  - XX:CompileThresholdScaling=0.1
    + S8225305: ProblemList java/lang/invoke/VarHandles tests
    + S8225350: compiler/jvmci/compilerToVM/IsCompilableTest.java
    timed out
    + S8225430: Replace wildcard address with loopback or local
    host in tests - part 14
    + S8225435: Upgrade IANA Language Subtag Registry to the latest
    for JDK14
    + S8225487: giflib legal file is missing attribution for
    openbsd-reallocarray.c
    + S8225567: Wrong file headers with 8202414 fix changeset
    + S8225684: [AOT] vmTestbase/vm/oom/production/
    /AlwaysOOMProduction tests fail with AOTed java.base
    + S8225766: Curve in certificate should not affect signature
    scheme when using TLSv1.3
    + S8225797: OldObjectSample event creates unexpected amount of
    checkpoint data
    + S8226381: ProblemList java/lang/reflect/PublicMethods/
    /PublicMethodsTest.java
    + S8226406: JVM fails to detect mismatched or corrupt CDS
    archive
    + S8226608: Hide the onjcmd option from the help output
    + S8226892: ActionListeners on JRadioButtons don't get notified
    when selection is changed with arrow keys
    + S8227112: exclude compiler/intrinsics/sha/sanity tests from
    AOT runs
    + S8227324: Upgrade to freetype 2.10.1
    + S8227528: TestAbortVMOnSafepointTimeout.java failed due to
    "RuntimeException: 'Safepoint sync time longer than' missing
    from stdout/stderr"
    + S8227645: Some tests in serviceability/sa run with fixed -Xmx
    values and risk running out of memory
    + S8227646: [TESTBUG] appcds/SharedArchiveConsistency timed out
    + S8227662: freetype seeks to index at the end of the font data
    + S8228479: Correct the format of ColorChooserDemoTest
    + S8228613: java.security.Provider#getServices order is no
    longer deterministic
    + S8228969: 2019-09-28 public suffix list update
    + S8229236: CriticalJNINatives: dll handling should be done in
    native thread state
    + S8229345: Memory leak due to vtable stubs not being shared on
    SPARC
    + S8229888: (zipfs) Updating an existing zip file does not
    preserve original permissions
    + S8229994: assert(false) failed: Bad graph detected in
    get_early_ctrl_for_expensive
    + S8230004: jdk/internal/jimage/JImageOpenTest.java runs no test
    + S8230235: Rendering HTML with empty img attribute and
    documentBaseKey cause Exception
    + S8230390: Problemlist SA tests with AOT
    + S8230400: Missing constant pool entry for a method in
    stacktrace
    + S8230459: Test failed to resume JVMCI CompilerThread
    + S8230480: check malloc/calloc results in java.desktop
    + S8230597: Update GIFlib library to the 5.2.1
    + S8230611: infinite loop in
    LogOutputList::wait_until_no_readers()
    + S8230624: [TESTBUG] Problemlist JFR
    compiler/TestCodeSweeper.java
    + S8230677: Should disable Escape Analysis if JVMTI capability
    can_get_owned_monitor_info was taken
    + S8230926: [macosx] Two apostrophes are entered instead of one
    with "U.S. International - PC" layout
    + S8231025: Incorrect method tag offset for big endian platform
    + S8231081: TestMetadataRetention fails due to missing symbol id
    + S8231387: java.security.Provider.getService returns random
    result due to race condition with mutating methods in the same
    class
    + S8231430: C2: Memory stomp in max_array_length() for
    T_ILLEGAL type
    + S8231445: check ZALLOC return values in awt coding
    + S8231507: Update Apache Santuario (XML Signature) to version
    2.1.4
    + S8231584: Deadlock with ClassLoader.findLibrary and
    System.loadLibrary call
    + S8231753: use more Posix functionality in aix
    os::print_os_info
    + S8231810: javax/net/ssl/templates/
    /SSLSocketSSLEngineTemplate.java fails intermittently with
    "java.lang.Exception: Unexpected EOF"
    + S8232003: (fs) Files.write can leak file descriptor in the
    exception case
    + S8232056: GetOwnedMonitorInfoWithEATest.java fails with ZGC:
    Heap too small
    + S8232060: add some initializations using sigemptyset in
    os_aix.cpp
    + S8232154: Update Mesa 3-D Headers to version 19.2.1
    + S8232167: Visual Studio install found through
  - -with-tools-dir value is discarded
    + S8232170: FSInfo#getJarClassPath throws an exception not
    declared in its throws clause
    + S8232200: [macos 10.15] Windows in fullscreen tests jumps
    around the screen
    + S8232207: Linux os::available_memory re-reads cgroup
    configuration on every invocation
    + S8232224: [TESTBUG] problemlist JFR TestLargeRootSet.java
    + S8232370: Refactor some com.sun.jdi tests to enable IDE
    integration
    + S8232433: [macos 10.15] java/awt/Window/
    /LocationAtScreenCorner/LocationAtScreenCorner.java may fail
    + S8232571: Add missing SIGINFO signal
    + S8232692: [TESTBUG] compiler/aot/fingerprint/
    /SelfChangedCDS.java fails when cds is disabled
    + S8232713: Update BCEL version to 6.3.1 in license file
    + S8232806: Introduce a system property to disable eager lambda
    initialization
    + S8232834: RunTest sometimes fails to produce valid
    exitcode.txt
    + S8232880: Update test documentation with additional settings
    for client UI tooltip tests
    + S8232950: SUNPKCS11 Provider incorrectly check key length for
    PSS Signatures.
    + S8233018: Add a new test to verify that DatagramSocket is not
    interruptible
    + S8233019: java.lang.Class.isPrimitive() (C1) returns wrong
    result if Klass* is aligned to 32bit
    + S8233032: assert(in_bb(n)) failed: must be
    + S8233078: fix minimal VM build on Linux ppc64(le)
    + S8233328: fix minimal VM build on Linux s390x
    + S8233383: Various minor fixes
    + S8233466: aarch64: remove unnecessary load of mdo when
    profiling return and parameters type
    + S8233491: Crash in AdapterHandlerLibrary::get_adapter with
    CDS due to code cache exhaustion
    + S8233529: loopTransform.cpp:2984: Error: assert(p_f-&gt;Opcode()
    == Op_IfFalse) failed
    + S8233548: Update CUP to v0.11b
    + S8233649: Update ProblemList.txt to exclude failing headful
    tests on macos
    + S8233656: assert(d-&gt;is_CFG() &amp;&amp; n-&gt;is_CFG()) failed: must
    have CFG nodes
    + S8233657: Intermittent NPE in Component.validate()
    + S8234288: Turkey Time Zone returns incorrect time zone name
    + S8234323: NULL-check return value of SurfaceData_InitOps on
    macosx
    + S8234339: replace JLI_StrTok in java_md_solinux.c
    + S8234340: Bump update version for OpenJDK: jdk-11.0.7
    + S8234350: assert(mode == ControlAroundStripMined &amp;&amp; (use ==
    sfpt || !use-&gt;is_reachable_from_root())) failed: missed a node
    + S8234386: [macos] NPE was thrown at expanding Choice from
    maximized frame
    + S8234397: add OS uptime information to os::print_os_info
    output
    + S8234423: Modifying ArrayList.subList().subList() resets
    modCount of subList
    + S8234466: Class loading deadlock involving
    X509Factory#commitEvent()
    + S8234501: remove obsolete NET_ReadV
    + S8234525: enable link-time section-gc for linux s390x to
    remove unused code
    + S8234610: MaxVectorSize set wrongly when UseAVX=3 is
    specified after JDK-8221092
    + S8234617: C1: Incorrect result of field load due to missing
    narrowing conversion
    + S8234723: javax/net/ssl/TLS tests support TLSv1.3
    + S8234724: javax/net/ssl/templates/
    /SSLSocketSSLEngineTemplate.java supports TLSv1.3
    + S8234741: enhance os::get_core_path on macOS
    + S8234769: Duplicate attribution in freetype.md
    + S8234786: Fix for JDK-8214578 breaks OS X 10.12 compatibility
    + S8234809: set relro in linker flags when building with gcc
    + S8234824: java/nio/channels/SocketChannel/AdaptSocket.java
    fails on Windows 10
    + S8235243: handle VS2017 15.9 and VS2019 in abstract_vm_version
    + S8235288: AVX 512 instructions inadvertently used on Xeon for
    small vector width operations
    + S8235325: build failure on Linux after 8235243
    + S8235383: C1 compilation fails with
  - XX:+PrintIRDuringConstruction -XX:+Verbose
    + S8235489: handle return values of sscanf calls in hotspot
    + S8235509: Backport for JDK-8209657 Refactor filemap.hpp to
    simplify integration with Serviceability Agent.
    + S8235510: java.util.zip.CRC32 performance drop after 8200067
    + S8235563: [TESTBUG] appcds/CommandLineFlagComboNegative.java
    does not handle archive mapping failure
    + S8235637: jhsdb jmap from OpenJDK 11.0.5 doesn't work if
    prelink is enabled
    + S8235671: enhance print_rlimit_info in os_posix
    + S8235744: PIT: test/jdk/javax/swing/text/html/
    /TestJLabelWithHTMLText.java times out in linux-x64
    + S8235904: Infinite loop when rendering huge lines
    + S8235998: [c2] Memory leaks during tracing after '8224193:
    stringStream should not use Resource Area'.
    + S8236039: JSSE Client does not accept status_request
    extension in CertificateRequest messages for TLS 1.3
    + S8236140: assert(!VerifyHashTableKeys || _hash_lock == 0)
    failed: remove node from hash table before modifying it
    + S8236179: C1 register allocation error with T_ADDRESS
    + S8236488: Support for configure option
  - -with-native-debug-symbols=internal is impossible on Windows
    + S8236500: Windows ucrt.dll should be looked up in versioned
    WINSDK subdirectory
    + S8236709: struct SwitchRange in HS violates C++ One
    Definition Rule
    + S8236848: [JDK 11u] make run-test-tier1 fails after backport
    of JDK-8232834
    + S8236873: Worker has a deadlock bug
    + S8237217: Incorrect G1StringDedupEntry type used in
    StringDedupTable destructor
    + S8237368: Problem with NullPointerException in RMI
    TCPEndpoint.read
    + S8237375: SimpleThresholdPolicy misses CounterDecay timestamp
    initialization
    + S8237508: Simplify JarFile.isInitializing
    + S8237540: Missing files in backport of JDK-8210910
    + S8237541: Missing files in backport of JDK-8236528
    + S8237600: Test SunJSSEFIPSInit fails on Ubuntu
    + S8237819: s390x - remove unused pd_zero_to_words_large
    + S8237869: exclude jtreg test security/infra/java/security/
    /cert/CertPathValidator/certification/LuxTrustCA.java because
    of instabilities
    + S8237879: make 4.3 breaks build
    + S8237945: CTW: C2 compilation fails with
    assert(just_allocated_object(alloc_ctl) == ptr) failed: most
    recent allo...
    + S8238225: Issues reported after replacing symlink at
    Contents/MacOS/libjli.dylib with binary
    + S8238247: CTW runner should sweep nmethods more aggressively
    + S8238366: CTW runner closes standard output on exit
    + S8238438: SuperWord::co_locate_pack picks memory state of
    first instead of last load
    + S8238502: sunmscapi.dll causing EXCEPTION_ACCESS_VIOLATION
    + S8238534: Deep sign macOS bundles before bundle archive is
    being created
    + S8238591: CTW: Split
    applications/ctw/modules/jdk_localedata.java
    + S8238596: AVX enabled by default for Skylake even when
    unsupported
    + S8238811: C2: assert(i &gt;= req() || i == 0 || is_Region() ||
    is_Phi()) with -XX:+VerifyGraphEdges
    + S8239005: [TESTBUG] test/hotspot/jtreg/runtime/
    /StackGuardPages/TestStackGuardPages.java: exeinvoke.c: must
    initialize static state before calling do_overflow()
    + S8239466: Loss of precision in counter decay calculation in
    11u backport of JDK-8237375
    + S8239856: [ntintel] asserts about copying unaligned array
    element
    + S8240724: [test] jdk11 downport of 8224475 misses binary file
    test/jdk/javax/swing/JTextPane/arrow.png
    + S8241296: Segfault in JNIHandleBlock::oops_do()
- Removed patch:
  * DependOnVariableHelper.patch
    + fixed upstream
- Added patch:
  * JDK-8228407.patch
    + fix crashes due to shared archive file mismatch</changelog>
  <changelog author="fstrba@suse.com" date="1594900800">- Update to upstream tag jdk-11.0.8+10 (July 2020 CPU, bsc#1174157)
  * Security fixes:
    + JDK-8230613: Better ASCII conversions
    + JDK-8231800: Better listing of arrays
    + JDK-8232014: Expand DTD support
    + JDK-8233234: Better Zip Naming
    + JDK-8233239, CVE-2020-14562: Enhance TIFF support
    + JDK-8233255: Better Swing Buttons
    + JDK-8234032: Improve basic calendar services
    + JDK-8234042: Better factory production of certificates
    + JDK-8234418: Better parsing with CertificateFactory
    + JDK-8234836: Improve serialization handling
    + JDK-8236191: Enhance OID processing
    + JDK-8236867, CVE-2020-14573: Enhance Graal interface handling
    + JDK-8237117, CVE-2020-14556: Better ForkJoinPool behavior
    + JDK-8237592, CVE-2020-14577: Enhance certificate verification
    + JDK-8238002, CVE-2020-14581: Better matrix operations
    + JDK-8238013: Enhance String writing
    + JDK-8238804: Enhance key handling process
    + JDK-8238842: AIOOBE in GIFImageReader.initializeStringTable
    + JDK-8238843: Enhanced font handing
    + JDK-8238920, CVE-2020-14583: Better Buffer support
    + JDK-8238925: Enhance WAV file playback
    + JDK-8240119, CVE-2020-14593: Less Affine Transformations
    + JDK-8240482: Improved WAV file playback
    + JDK-8241379: Update JCEKS support
    + JDK-8241522: Manifest improved jar headers redux
    + JDK-8242136, CVE-2020-14621: Better XML namespace handling
  * Other changes:
    + JDK-6933331: (d3d/ogl) java.lang.IllegalStateException:
    Buffers have not been created
    + JDK-7124307: JSpinner and changing value by mouse
    + JDK-8022574: remove HaltNode code after uncommon trap calls
    + JDK-8039082: [TEST_BUG] Test
    java/awt/dnd/BadSerializationTest/BadSerializationTest.java
    fails
    + JDK-8040630: Popup menus and tooltips flicker with previous
    popup contents when first shown
    + JDK-8044365: (dc) MulticastSendReceiveTests.java failing with
    ENOMEM when joining group (OS X 10.9)
    + JDK-8048215: [TESTBUG]
    java/lang/management/ManagementFactory/ThreadMXBeanProxy.java
    Expected non-null LockInfo
    + JDK-8051349: nsk/jvmti/scenarios/sampling/SP06/sp06t003 fails
    in nightly
    + JDK-8080353: JShell: Better error message on attempting to
    add default method
    + JDK-8139876: Exclude hanging nsk/stress/stack from execution
    with deoptimization enabled
    + JDK-8146090: java/lang/ref/ReachabilityFenceTest.java fails
    with -XX:+DeoptimizeALot
    + JDK-8153430: jdk regression test MletParserLocaleTest,
    ParserInfiniteLoopTest reduce default timeout
    + JDK-8156207: Resource allocated BitMaps are often cleared
    unnecessarily
    + JDK-8159740: JShell: corralled declarations do not have
    correct source to wrapper mapping
    + JDK-8175984: ICC_Profile has un-needed, not-empty finalize
    method
    + JDK-8176359: Frame#setMaximizedbounds not working properly in
    multi screen environments
    + JDK-8183369: RFC unconformity of HttpURLConnection with proxy
    + JDK-8187078: -XX:+VerifyOops finds numerous problems when
    running JPRT
    + JDK-8189861: Refactor CacheFind
    + JDK-8191169: java/net/Authenticator/B4769350.java failed
    intermittently
    + JDK-8191930: [Graal] emits unparseable XML into compile log
    + JDK-8193879: Java debugger hangs on method invocation
    + JDK-8196019: java/awt/Window/Grab/GrabTest.java fails on
    Windows
    + JDK-8196181: sun/java2d/GdiRendering/InsetClipping.java fails
    + JDK-8198000:
    java/awt/List/EmptyListEventTest/EmptyListEventTest.java
    debug assert on Windows
    + JDK-8198001: java/awt/Menu/WrongParentAfterRemoveMenu/
    /WrongParentAfterRemoveMenu.java debug assert on Windows
    + JDK-8198339: Test javax/swing/border/Test6981576.java is
    unstable
    + JDK-8200701: jdk/jshell/ExceptionsTest.java fails on Windows,
    after JDK-8198801
    + JDK-8203264: JNI exception pending in
    PlainDatagramSocketImpl.c:740
    + JDK-8203672: JNI exception pending in PlainSocketImpl.c
    + JDK-8203673: JNI exception pending in
    DualStackPlainDatagramSocketImpl.c:398
    + JDK-8204834: Fix confusing "allocate" naming in OopStorage
    + JDK-8205399: Set node color on pinned HashMap.TreeNode
    deletion
    + JDK-8205653: test/jdk/sun/management/jmxremote/bootstrap/
    /RmiRegistrySslTest.java and RmiSslBootstrapTest.sh fail with
    handshake_failure
    + JDK-8206179: com/sun/management/OperatingSystemMXBean/
    /GetCommittedVirtualMemorySize.java fails with Committed
    virtual memory size illegal value
    + JDK-8207334: VM times out in VM_HandshakeAllThreads::doit()
    with RunThese30M
    + JDK-8208277: Code cache heap (-XX:ReservedCodeCacheSize)
    doesn't work with 1GB LargePages
    + JDK-8209113: Use WeakReference for lastFontStrike for created
    Fonts
    + JDK-8209333: Socket reset issue for TLS 1.3 socket close
    + JDK-8209439: C2 library_call can potentially ignore Math.pow
    intrinsic or use null pointer
    + JDK-8209534: [TESTBUG]runtime/appcds/cacheObject/
    /ArchivedModuleCompareTest.java fails with EnableJVMCI.
    + JDK-8210147: adjust some WSAGetLastError usages in windows
    network coding
    + JDK-8210284: "assert((av &amp; 0x00000001) == 0) failed:
    unsupported V8" on Solaris 11.4
    + JDK-8210303: VM_HandshakeAllThreads fails assert with
    "failed: blocked and not walkable"
    + JDK-8210459: Add support for generating compile_commands.json
    + JDK-8210515: [TESTBUG]CheckArchivedModuleApp.java needs to
    check if EnableJVMCI is set.
    + JDK-8210788: Javadoc for Thread.join(long, int) should
    specify that it waits forever when both arguments are zero
    + JDK-8211301: [macos] support full window content options
    + JDK-8211332: Space for stub routines (code_size2) is too
    small on new Skylake CPUs
    + JDK-8211339: NPE during SSL handshake caused by
    HostnameChecker
    + JDK-8211392: compiler/profiling/
    /spectrapredefineclass_classloaders/Launcher.java times out
    in JDK12 CI
    + JDK-8211743: [AOT] crash in ScopeDesc::decode_body() when
    JVMTI walks AOT frames
    + JDK-8212154: [TESTBUG] CheckArchivedModuleApp fails with NPE
    when JVMCI is absent
    + JDK-8212167: JShell : Stack trace of exception has wrong line
    number
    + JDK-8212933: Thread-SMR: requesting a VM operation whilst
    holding a ThreadsListHandle can cause deadlocks
    + JDK-8212986: Make Visual Studio compiler check less strict
    + JDK-8213250: CDS archive creation aborts due to metaspace
    object allocation failure
    + JDK-8213516: jck test api/javax_accessibility/AccessibleState/
    /fields.html fails intermittent
    + JDK-8213947: ARM32: failed check_simd should set
    UsePopCountInstruction to false
    + JDK-8214418: half-closed SSLEngine status may cause
    application dead loop
    + JDK-8214440: ldap over a TLS connection negotiate failed with
    "javax.net.ssl.SSLPeerUnverifiedException: hostname of the
    server does not match the hostname in the server's
    certificate"
    + JDK-8214444: Wrong strncat limits in dfa.cpp
    + JDK-8214481: freetype path does not disable TrueType hinting
    with AA+FM hints
    + JDK-8214571: -Xdoclint of array serialField gives "error:
    array type not allowed here"
    + JDK-8214856: Errors with JSZip in web console after upgrade
    to 3.1.5
    + JDK-8214862: assert(proj != __null) at compile.cpp:3251
    + JDK-8215369: Jcstress pollute /var/tmp with temporary files.
    + JDK-8215551: Missing case label in nmethod::reloc_string_for()
    + JDK-8215555: TieredCompilation C2 threads can excessively
    block handshakes
    + JDK-8215711: Missing key_share extension for (EC)DHE key
    exchange should alert missing_extension
    + JDK-8216151: [Graal] Module
    jdk.internal.vm.compiler.management has not been granted
    accessClassInPackage.org.graalvm.compiler.debug
    + JDK-8216154: C4819 warnings at HotSpot sources on Windows
    + JDK-8216541: CompiledICHolders of VM locked unloaded nmethods
    are released too late
    + JDK-8217230: assert(t == t_no_spec) failure in
    NodeHash::check_no_speculative_types()
    + JDK-8217404: --with-jvm-features doesn't work when multiple
    features are explicitly disabled
    + JDK-8217447: Develop flag TraceICs is broken
    + JDK-8217606: LdapContext#reconnect always opens a new
    connection
    + JDK-8218807: Compilation database (compile_commands.json) may
    contain obsolete items
    + JDK-8219214: Infinite Loop in CodeSection::dump()
    + JDK-8219904: ClassCastException when calling
    FlightRecorderMXBean#getRecordings()
    + JDK-8219991: New fix of the deadlock in
    sun.security.ssl.SSLSocketImpl
    + JDK-8221121: applications/microbenchmarks are encountering
    crashes in tier5
    + JDK-8221445: FastSysexMessage constructor crashes MIDI
    receiption thread
    + JDK-8221482: Initialize VMRegImpl::regName[] earlier to
    prevent assert during PrintStubCode
    + JDK-8221741: ClassCastException can happen when
    fontconfig.properties is used
    + JDK-8221823: Requested JDialog width is ignored
    + JDK-8223108: Test java/awt/EventQueue/
    /NonComponentSourcePost.java is unstable
    + JDK-8223678: Add Visual Studio Code workspace generation
    support (for native code)
    + JDK-8223935: PIT: java/awt/font/WindowsIndicFonts.java fails
    on windows10
    + JDK-8224109: Text spaced incorrectly by drawString under
    rotation with fractional metric
    + JDK-8224632: testbug: java/awt/dnd/RemoveDropTargetCrashTest/
    /RemoveDropTargetCrashTest.java fails on MacOS
    + JDK-8224793: os::die() does not honor CreateCoredumpOnCrash
    option
    + JDK-8224847: gc/stress/TestReclaimStringsLeaksMemory.java
    fails with reserved greater than expected
    + JDK-8224931: disable JAOTC invokedynamic support until
    8223533 is fixed
    + JDK-8224997: ChaCha20-Poly1305 TLS cipher suite decryption
    throws ShortBufferException
    + JDK-8225068: Remove DocuSign root certificate that is
    expiring in May 2020
    + JDK-8225069: Remove Comodo root certificate that is expiring
    in May 2020
    + JDK-8225126: Test SetBoundsPaintTest.html faild on Windows
    when desktop is scaled
    + JDK-8225325: Add tests for redefining a class' private method
    during resolution of the bootstrap specifier
    + JDK-8225622: [AOT] runtime/SharedArchiveFile/
    /TestInterpreterMethodEntries.java crashed with AOTed
    java.base
    + JDK-8225653: Provide more information when hitting SIGILL
    from HaltNode
    + JDK-8225783: Incorrect use of binary operators on booleans in
    type.cpp
    + JDK-8225789: Empty method parameter type should generate
    ClassFormatError
    + JDK-8226198: use of &amp; instead of &amp;&amp; in
    LibraryCallKit::arraycopy_restore_alloc_state
    + JDK-8226253: JAWS reports wrong number of radio buttons when
    buttons are hidden.
    + JDK-8226653: [accessibility] Can edit text cell correctly,
    but Accessibility Tool reads nothing about editor
    + JDK-8226806: [macOS 10.14] Methods of Java Robot should be
    called from appropriate thread
    + JDK-8226879: Memory leak in Type::hashcons
    + JDK-8227632: Incorrect PrintCompilation message: made not
    compilable on levels 0 1 2 3 4
    + JDK-8228407: JVM crashes with shared archive file mismatch
    + JDK-8228482: fix xlc16/xlclang comparison of distinct pointer
    types and string literal conversion warnings
    + JDK-8228757: Fail fast if the handshake type is unknown
    + JDK-8229158: make UseSwitchProfiling non-experimental or
    false by-default
    + JDK-8229421: The logic of java/net/ipv6tests/TcpTest.java is
    flawed
    + JDK-8229855: C2 fails with assert(false) failed: bad AD file
    + JDK-8230591: AArch64: Missing intrinsics for Math.ceil,
    floor, rint
    + JDK-8231118: ARM32: Math tests failures
    + JDK-8231213: Migrate SimpleDateFormatConstTest to JDK Repo
    + JDK-8231243: [TESTBUG] CustomFont.java cannot find font file
    + JDK-8231438: [macOS] Dark mode for the desktop is not
    supported
    + JDK-8231550: C2: ShouldNotReachHere() in
    verify_strip_mined_scheduling
    + JDK-8231564: setMaximizedBounds is broken with large display
    scale and multiple monitors
    + JDK-8231572: Use -lobjc instead of -fobjc-link-runtime in
    libosxsecurity
    + JDK-8231631: sun/net/ftp/FtpURLConnectionLeak.java fails
    intermittently with NPE
    + JDK-8231671: Fix copyright headers in hotspot (missing comma
    after year)
    + JDK-8231720: Some perf regressions after 8225653
    + JDK-8231779: crash
    HeapWord*ParallelScavengeHeap::failed_mem_allocate
    + JDK-8231863: Crash if classpath is read from @argument file
    and the main gets option argument
    + JDK-8232080: jlink plugins for vendor information and
    run-time options
    + JDK-8232106: [x86] C2: SIGILL due to usage of SSSE3
    instructions on processors which don't support it
    + JDK-8232134: Change to Visual Studio 2017 15.9.16 for
    building on Windows at Oracle
    + JDK-8232226: [macos 10.15] test/jdk/java/awt/color/
    /EqualityTest/EqualityTest.java may fail
    + JDK-8232357: Compare version info of Santuario to legal notice
    + JDK-8232572: Add hooks for custom output dir in Bundles.gmk
    + JDK-8232634: Problem List ICMColorDataTest.java
    + JDK-8232748: Build static versions of certain JDK libraries
    + JDK-8232846: ProcessHandle.Info command with non-English
    shows question marks
    + JDK-8232880: Update test documentation with additional
    settings for client UI tooltip tests
    + JDK-8233033: C2 produces wrong result while unswitching a
    loop due to lost control dependencies
    + JDK-8233137: runtime/ErrorHandling/VeryEarlyAssertTest.java
    fails after 8232080
    + JDK-8233197: Invert JvmtiExport::post_vm_initialized() and
    Jfr:on_vm_start() start-up order for correct option parsing
    + JDK-8233291: [TESTBUG] tools/jlink/plugins/
    /VendorInfoPluginsTest.java fails with debug or non-server VMs
    + JDK-8233364: Fix undefined behavior in
    Canonicalizer::do_ShiftOp
    + JDK-8233494: Avoid calling MallocTracker::record_malloc and
    record_free when NMT is off
    + JDK-8233573: Toolkit.getScreenInsets(GraphicsConfiguration)
    may throw ClassCastException
    + JDK-8233608: Minimal build broken after JDK-8233494
    + JDK-8233621: Mismatch in jsse.enableMFLNExtension property
    name
    + JDK-8233696: [TESTBUG]Some jtreg tests fail when CAPS_LOCK is
    ON
    + JDK-8233707: systemScale.cpp could not compile with VS2019
    + JDK-8233801: GCMEmptyIv.java test fails on Solaris 11.4
    + JDK-8233880: Support compilers with multi-digit major version
    numbers
    + JDK-8233920: MethodHandles::tryFinally generates illegal
    bytecode for long/double return type
    + JDK-8234137: The "AutoTestOnTop.java" test may run external
    applications
    + JDK-8234146: compiler/jsr292/
    /ContinuousCallSiteTargetChange.java times out on SPARC
    + JDK-8234184: [TESTBUG] java/awt/Mouse/EnterExitEvents/
    /ModalDialogEnterExitEventsTest.java fails in Windows
    + JDK-8234270: [REDO] JDK-8204128 NMT might report incorrect
    numbers for Compiler area
    + JDK-8234332: [TESTBUG] java/awt/Focus/DisposedWindow/
    /DisposeDialogNotActivateOwnerTest/
    /DisposeDialogNotActivateOwnerTest.java fails on linux-x64
    nightly
    + JDK-8234398: Replace ID2D1Factory::GetDesktopDpi with
    GetDeviceCaps
    + JDK-8234522: [macos] Crash with use of native file dialog
    + JDK-8234691: Potential double-free in ParallelSPCleanupTask
    constructor
    + JDK-8234696: tools/jlink/plugins/VendorInfoPluginsTest.java
    times out
    + JDK-8234727: sun/security/ssl/X509TrustManagerImpl tests
    support TLSv1.3
    + JDK-8234728: Some security tests should support TLSv1.3
    + JDK-8234779: Provide idiom for declaring classes noncopyable
    + JDK-8234824: java/nio/channels/SocketChannel/AdaptSocket.java
    fails on Windows 10
    + JDK-8234968: check calloc rv in libinstrument
    InvocationAdapter
    + JDK-8235153: [TESTBUG] [macos 10.15] java/awt/Graphics/
    /DrawImageBG/SystemBgColorTest.java fails
    + JDK-8235183: Remove the "HACK CODE" in comment
    + JDK-8235263: Revert TLS 1.3 change that wrapped IOExceptions
    + JDK-8235311: Tag mismatch may alert bad_record_mac
    + JDK-8235332: TestInstanceCloneAsLoadsStores.java fails with
  - XX:+StressGCM
    + JDK-8235452: Strip mined loop verification fails with
    assert(is_OuterStripMinedLoop()) failed: invalid node class
    + JDK-8235584: UseProfiledLoopPredicate fails with
    assert(_phase-&gt;get_loop(c) == loop) failed: have to be in the
    same loop
    + JDK-8235620: Broken merge between JDK-8006406 and JDK-8003559
    + JDK-8235638: NPE in LWWindowPeer.getOnscreenGraphics()
    + JDK-8235686: Add more custom hooks in Bundles.gmk
    + JDK-8235739: Rare NPE at WComponentPeer.getGraphics()
    + JDK-8235762: JVM crash in SWPointer during C2 compilation
    + JDK-8235834: IBM-943 charset encoder needs updating
    + JDK-8235874: The ordering of Cipher Suites is not maintained
    provided through jdk.tls.client.cipherSuites and
    jdk.tls.server.cipherSuites system property.
    + JDK-8235908: omit ThreadPriorityPolicy warning when value is
    set from image
    + JDK-8235984: C2: assert(out-&gt;in(PhiNode::Region) == head ||
    out-&gt;in(PhiNode::Region) == slow_head) failed: phi must be
    either part of the slow or the fast loop
    + JDK-8236211: [Graal] compiler/graalunit/GraphTest.java is
    skipped in all testing
    + JDK-8236470: Deal with ECDSA using ecdsa-with-SHA2 plus hash
    algorithm as AlgorithmId
    + JDK-8236545: Compilation error in mach5
    java/awt/FileDialog/MacOSGoToFolderCrash.java
    + JDK-8236700: Upgrading JSZip from v3.1.5 to v3.2.2
    + JDK-8236759: ShouldNotReachHere in
    PhaseIdealLoop::verify_strip_mined_scheduling
    + JDK-8236897: Fix the copyright header for pkcs11gcm2.h
    + JDK-8236921: Add build target to produce a JDK image suitable
    for a Graal/SVM build
    + JDK-8236953: [macos] JavaFX SwingNode is not rendered on macOS
    + JDK-8236996: Incorrect Roboto font rendering on Windows with
    subpixel antialiasing
    + JDK-8237045: JVM uses excessive memory with -XX:+EnableJVMCI
  - XX:JVMCICounterSize=2147483648
    + JDK-8237055: [TESTBUG] compiler/c2/TestJumpTable.java fails
    with release VMs
    + JDK-8237086: assert(is_MachReturn()) running CTW with fix for
    JDK-8231291
    + JDK-8237192: Generate stripped/public pdbs on Windows for jdk
    images
    + JDK-8237396: JvmtiTagMap::weak_oops_do() should not trigger
    barriers
    + JDK-8237474: Default SSLEngine should create in server role
    + JDK-8237859: C2: Crash when loads float above range check
    + JDK-8237879: make 4.3 breaks build
    + JDK-8237951: CTW: C2 compilation fails with "malformed
    control flow"
    + JDK-8237962: give better error output for invalid OCSP
    response intervals in CertPathValidator checks
    + JDK-8238190: [JVMCI] Fix single implementor speculation for
    diamond shapes.
    + JDK-8238356: CodeHeap::blob_count() overestimates the number
    of blobs
    + JDK-8238452: Keytool generates wrong expiration date if
    validity is set to 2050/01/01
    + JDK-8238555: Allow Initialization of SunPKCS11 with NSS when
    there are external FIPS modules in the NSSDB
    + JDK-8238575: DragSourceEvent.getLocation() returns wrong
    value on HiDPI screens (Windows)
    + JDK-8238676: jni crashes on accessing it from process exit
    hook
    + JDK-8238721: Add failing client jtreg tests to the Problem
    List
    + JDK-8238738: AudioSystem.getMixerInfo() takes about 30 sec to
    report a gone audio device
    + JDK-8238756: C2: assert(((n) == __null || !VerifyIterativeGVN
    || !((n)-&gt;is_dead()))) failed: can not use dead node
    + JDK-8238765: PhaseCFG::schedule_pinned_nodes cannot handle
    precedence edges from unmatched CFG nodes correctly
    + JDK-8238898: Missing hash characters for header on license
    file
    + JDK-8238942: Rendering artifacts with LCD text and fractional
    metrics
    + JDK-8238985: [TESTBUG] The arrow image is blue instead of
    green
    + JDK-8239000: handle ContendedPaddingWidth in vm_version_ppc
    + JDK-8239055: Wrong implementation of VMState.hasListener
    + JDK-8239091: Reversed arguments in call to strstr in freetype
    "debug" code.
    + JDK-8239142: C2's UseUniqueSubclasses optimization is broken
    for array accesses
    + JDK-8239224: libproc_impl.c previous_thr may be used
    uninitialized warning
    + JDK-8239351: Give more meaningful InternalError messages in
    Deflater.c
    + JDK-8239365: ProcessBuilder test modifications for AIX
    execution
    + JDK-8239456: vtable stub generation: assert failure (code
    size estimate)
    + JDK-8239457: call ReleaseStringUTFChars before early returns
    in Java_sun_security_pkcs11_wrapper_PKCS11_connect
    + JDK-8239462: jdk.hotspot.agent misses some
    ReleaseStringUTFChars calls in case of early returns
    + JDK-8239557: [TESTBUG] VeryEarlyAssertTest.java validating
    "END." marker at lastline is not always true
    + JDK-8239787: AArch64: String.indexOf may incorrectly handle
    empty strings
    + JDK-8239792: Bump update version for OpenJDK: jdk-11.0.8
    + JDK-8239798: SSLSocket closes socket both socket endpoints on
    a SocketTimeoutException
    + JDK-8239819: XToolkit: Misread of screen information memory
    + JDK-8239852: java/util/concurrent tests fail with
  - XX:+VerifyGraphEdges: assert(!VerifyGraphEdges) failed:
    verification should have failed
    + JDK-8239893: Windows handle Leak when starting processes
    using ProcessBuilder
    + JDK-8239915: Zero VM crashes when handling dynamic constant
    + JDK-8239931: [win][x86] vtable stub generation: assert
    failure (code size estimate) follow-up
    + JDK-8239965: XMLEncoder/Test4625418.java fails due to "Error:
    Cp943 - can't read properly"
    + JDK-8239976: Put JDK-8239965 on the ProblemList.txt
    + JDK-8240073: Fix 'test-make' build target in 11u
    + JDK-8240197: Cannot start JVM when $JAVA_HOME includes CJK
    characters
    + JDK-8240202: A few client tests leave mouse buttons pressed
    + JDK-8240220: IdealLoopTree::dump_head predicate printing is
    broken
    + JDK-8240223: Use consistent predicate order in and with
    PhaseIdealLoop::find_predicate
    + JDK-8240227: Loop predicates should be copied to unswitched
    loops
    + JDK-8240286: [TESTBUG] Test command error in hotspot/jtreg/
    /compiler/loopopts/superword/SumRedAbsNeg_Float.java
    + JDK-8240518: Incorrect JNU_ReleaseStringPlatformChars in
    Windows Print
    + JDK-8240529: CheckUnhandledOops breaks NULL check in
    Modules::define_module
    + JDK-8240576: JVM crashes after transformation in C2
    IdealLoopTree::merge_many_backedges
    + JDK-8240603: Windows 32bit compile error after 8238676
    + JDK-8240629: argfiles parsing broken for argfiles with
    comment cross 4096 bytes chunk
    + JDK-8240711: TestJstatdPort.java failed due to
    "ExportException: Port already in use:"
    + JDK-8240786: [TESTBUG] The test java/awt/Window/
    /GetScreenLocation/GetScreenLocationTest.java fails on HiDPI
    screen
    + JDK-8240824: enhance print_full_memory_info on Linux by THP
    related information
    + JDK-8240827: Downport SSLSocketImpl.java from "8221882: Use
    fiber-friendly java.util.concurrent.locks in JSSE"
    + JDK-8240905: assert(mem == (Node*)1 || mem == mem2) failed:
    multiple Memories being matched at once?
    + JDK-8240972: macOS codesign fail on macOS 10.13.5 or older
    + JDK-8241445: Fix copyright in
    test/jdk/tools/launcher/ArgFileSyntax.java
    + JDK-8241458: [JVMCI] add mark value to expose
    CodeOffsets::Frame_Complete
    + JDK-8241464: [11u] Backport: make rehashing be a needed
    guaranteed safepoint cleanup action
    + JDK-8241556: Memory leak if -XX:CompileCommand is set
    + JDK-8241568: (fs) UserPrincipalLookupService.lookupXXX
    failure with IOE "Operation not permitted"
    + JDK-8241586: compiler/cpuflags/
    /TestAESIntrinsicsOnUnsupportedConfig.java fails on aarch64
    + JDK-8241638: launcher time metrics always report 1 on Linux
    when _JAVA_LAUNCHER_DEBUG set
    + JDK-8241660: Add virtualization information output to hs_err
    file on macOS
    + JDK-8241808: [TESTBUG] The JDK-8039467 bug appeared on macOS
    + JDK-8241888: Mirror jdk.security.allowNonCaAnchor system
    property with a security one
    + JDK-8241900: Loop unswitching may cause dependence on null
    check to be lost
    + JDK-8241948: enhance list of environment variables printed in
    hs_err file
    + JDK-8241996: on linux set full relro in the linker flags
    + JDK-8242108: Performance regression after fix for JDK-8229496
    + JDK-8242141: New System Properties to configure the TLS
    signature schemes
    + JDK-8242154: Backport parts of JDK-4947890 to OpenJDK 11u
    + JDK-8242174: [macos] The NestedModelessDialogTest test make
    the macOS unstable
    + JDK-8242239: [Graal] javax/management/generified/
    /GenericTest.java fails: FAILED: queryMBeans sets same
    + JDK-8242294: JSSE Client does not throw SSLException when an
    alert occurs during handshaking
    + JDK-8242379: [TESTBUG] compiler/loopopts/
    /TestLoopUnswitchingLostCastDependency.java fails with
    release VMs
    + JDK-8242470: Update Xerces to Version 2.12.1
    + JDK-8242498: Invalid "sun.awt.TimedWindowEvent" object leads
    to JVM crash
    + JDK-8242541: Small charset issues (ISO8859-16, x-eucJP-Open,
    x-IBM834 and x-IBM949C)
    + JDK-8242626: enhance posix print_rlimit_info
    + JDK-8243059: Build fails when --with-vendor-name contains a
    comma
    + JDK-8243539: Copyright info (Year) should be updated for fix
    of 8241638
    + JDK-8243541: (tz) Upgrade time-zone data to tzdata2020a
    + JDK-8244407: JVM crashes after transformation in C2
    IdealLoopTree::split_fall_in
    + JDK-8244520: problemlist
    java/awt/font/Rotate/RotatedFontTest.java on linux
    + JDK-8244777: ClassLoaderStats VM Op uses constant hash value
    + JDK-8244853: The static build of libextnet is missing the
    JNI_OnLoad_extnet function
    + JDK-8244951: Missing entitlements for hardened runtime
    + JDK-8245047: [PPC64] C2: ReverseBytes + Load always match to
    unordered Load (acquire semantics missing)
    + JDK-8245649: Revert 8245397 backport of 8230591
    + JDK-8246031: SSLSocket.getSession() doesn't close connection
    for timeout/ interrupts
    + JDK-8246613: Choose the default SecureRandom algo based on
    registration ordering
    + JDK-8248505: Unexpected NoSuchAlgorithmException when using
    secure random impl from BCFIPS provider
- Removed patch:
  * JDK-8228407.patch
    + integrated upstream</changelog>
  <changelog author="fstrba@suse.com" date="1604318400">- Update to upstream tag jdk-11.0.9-11 (October 2020 CPU,
  bsc#1177943)
  * New features
    + JDK-8250784: Shenandoah: A Low-Pause-Time Garbage Collector
  * Security fixes
    + JDK-8233624: Enhance JNI linkage
    + JDK-8236196: Improve string pooling
    + JDK-8236862, CVE-2020-14779: Enhance support of Proxy class
    + JDK-8237990, CVE-2020-14781: Enhanced LDAP contexts
    + JDK-8237995, CVE-2020-14782: Enhance certificate processing
    + JDK-8240124: Better VM Interning
    + JDK-8241114, CVE-2020-14792: Better range handling
    + JDK-8242680, CVE-2020-14796: Improved URI Support
    + JDK-8242685, CVE-2020-14797: Better Path Validation
    + JDK-8242695, CVE-2020-14798: Enhanced buffer support
    + JDK-8243302: Advanced class supports
    + JDK-8244136, CVE-2020-14803: Improved Buffer supports
    + JDK-8244479: Further constrain certificates
    + JDK-8244955: Additional Fix for JDK-8240124
    + JDK-8245407: Enhance zoning of times
    + JDK-8245412: Better class definitions
    + JDK-8245417: Improve certificate chain handling
    + JDK-8248574: Improve jpeg processing
    + JDK-8249927: Specify limits of jdk.serialProxyInterfaceLimit
    + JDK-8253019: Enhanced JPEG decoding
  * Other changes
    + JDK-6532025: GIF reader throws misleading exception with
    truncated images
    + JDK-6949753: [TEST BUG]: java/awt/print/PageFormat/
    /PDialogTest.java needs update by removing an infinite loop
    + JDK-8022535: [TEST BUG] javax/swing/text/html/parser/
    /Test8017492.java fails
    + JDK-8062947: Fix exception message to correctly represent
    LDAP connection failure
    + JDK-8067354: com/sun/jdi/GetLocalVariables4Test.sh failed
    + JDK-8134599: TEST_BUG: java/rmi/transport/closeServerSocket/
    /CloseServerSocket.java fails intermittently with Address
    already in use
    + JDK-8151678: com/sun/jndi/ldap/LdapTimeoutTest.java failed
    due to timeout on DeadServerNoTimeoutTest is incorrect
    + JDK-8160768: Add capability to custom resolve host/domain
    names within the default JNDI LDAP provider
    + JDK-8172404: Tools should warn if weak algorithms are used
    before restricting them
    + JDK-8193367: Annotated type variable bounds crash javac
    + JDK-8202117: com/sun/jndi/ldap/RemoveNamingListenerTest.java
    fails intermittently: Connection reset
    + JDK-8203026: java.rmi.NoSuchObjectException: no such object
    in table
    + JDK-8203281: [Windows] JComboBox change in ui when
    editor.setBorder() is called
    + JDK-8203382: Rename SystemDictionary::initialize_wk_klass to
    resolve_wk_klass
    + JDK-8203393: com/sun/jdi/JdbMethodExitTest.sh and
    JdbExprTest.sh fail due to timeout
    + JDK-8203928: [Test] Convert non-JDB scaffolding
    serviceability shell script tests to java
    + JDK-8204963: javax.swing.border.TitledBorder has a memory leak
    + JDK-8204994: SA might fail to attach to process with "Windbg
    Error: WaitForEvent failed"
    + JDK-8205534: Remove SymbolTable dependency from
    serviceability agent
    + JDK-8206309: Tier1 SA tests fail
    + JDK-8208281: java/nio/channels/
    /AsynchronousSocketChannel/Basic.java timed out
    + JDK-8209109: [TEST] rewrite com/sun/jdi shell tests to java
    version - step1
    + JDK-8209332: [TEST] test/jdk/com/sun/jdi/CatchPatternTest.sh
    is incorrect
    + JDK-8209342: Problemlist SA tests on Solaris due to Error
    attaching to process: Can't create thread_db agent!
    + JDK-8209343: Test javax/swing/border/TestTitledBorderLeak.java
    should be marked as headful
    + JDK-8209517: com/sun/jdi/BreakpointWithFullGC.java fails with
    timeout
    + JDK-8209604: [TEST] rewrite com/sun/jdi shell tests to java
    version - step2
    + JDK-8209605: com/sun/jdi/BreakpointWithFullGC.java fails with
    ZGC
    + JDK-8209608: Problem list com/sun/jdi/BreakpointWithFullGC.java
    + JDK-8210131: vmTestbase/nsk/jvmti/scenarios/allocation/AP10/
    /ap10t001/TestDescription.java failed with ObjectFree:
    GetCurrentThreadCpuTimerInfo returned unexpected error code
    + JDK-8210243: [TEST] rewrite com/sun/jdi shell tests to java
    version - step3
    + JDK-8210527: JShell: NullPointerException in
    jdk.jshell.Eval.translateExceptionStack
    + JDK-8210560: [TEST] convert com/sun/jdi redefineClass-related
    tests
    + JDK-8210725: com/sun/jdi/RedefineClearBreakpoint.java fails
    with waitForPrompt timed out after 60 seconds
    + JDK-8210748: [TESTBUG] lib.jdb.Jdb.waitForPrompt() should
    clarify which output is the pending reply after a timeout
    + JDK-8210760: [TEST] rewrite com/sun/jdi shell tests to java
    version - step4
    + JDK-8210977: jdk/jfr/event/oldobject/TestThreadLocalLeak.java
    fails to find ThreadLocalObject
    + JDK-8211292: [TEST] convert com/sun/jdi/DeferredStepTest.sh
    test
    + JDK-8211694: JShell: Redeclared variable should be reset
    + JDK-8212200: assert when shared java.lang.Object is redefined
    by JVMTI agent
    + JDK-8212629: [TEST] wrong breakpoint in
    test/jdk/com/sun/jdi/DeferredStepTest
    + JDK-8212665: com/sun/jdi/DeferredStepTest.java: jj1 (line 57)
  - unexpected. lastLine=52, minLine=52, maxLine=55
    + JDK-8212807: tools/jar/multiRelease/Basic.java times out
    + JDK-8213182: Minimal VM build failure after JDK-8212200
    (assert when shared java.lang.Object is redefined by JVMTI
    agent)
    + JDK-8213214: Set -Djava.io.tmpdir= when running tests
    + JDK-8213275: ReplaceCriticalClasses.java fails with
    jdk.internal.vm.PostVMInitHook not found
    + JDK-8213574: Deadlock in string table expansion when dumping
    lots of CDS classes
    + JDK-8213703: LambdaConversionException: Invalid receiver type
    not a subtype of implementation type interface
    + JDK-8214074: Ghash optimization using AVX instructions
    + JDK-8214491: Upgrade to JLine 3.9.0
    + JDK-8214797: TestJmapCoreMetaspace.java timed out
    + JDK-8215243: JShell tests failing intermitently with
    "Problem cleaning up the following threads:"
    + JDK-8215244: jdk/jshell/ToolBasicTest.java
    testHistoryReference failed
    + JDK-8215354: x86_32 build failures after JDK-8214074 (Ghash
    optimization using AVX instructions)
    + JDK-8215438: jshell tool: Ctrl-D causes EOF
    + JDK-8216021: RunTest.gmk might set concurrency level to 1 on
    Windows
    + JDK-8216974: HttpConnection not returned to the pool after
    204 response
    + JDK-8218948: SimpleDateFormat :: format - Zone Names are not
    reflected correctly during run time
    + JDK-8219712: code_size2 (defined in stub_routines_x86.hpp) is
    too small on new Skylake CPUs
    + JDK-8220150: macos10.14 Mojave returns anti-aliased glyphs
    instead of aliased B&amp;W glyphs
    + JDK-8221658: aarch64: add necessary predicate for ubfx
    patterns
    + JDK-8221759: Crash when completing "java.io.File.path"
    + JDK-8221918: runtime/SharedArchiveFile/serviceability/
    /ReplaceCriticalClasses.java fails: Shared archive not found
    + JDK-8222074: Enhance auto vectorization for x86
    + JDK-8222079: Don't use memset to initialize fields decode_env
    constructor in disassembler.cpp
    + JDK-8222769: [TESTBUG] TestJFRNetworkEvents should not rely
    on hostname command
    + JDK-8223688: JShell: crash on the instantiation of raw
    anonymous class
    + JDK-8223777: In posix_spawn mode, failing to exec()
    jspawnhelper does not result in an error
    + JDK-8223940: Private key not supported by chosen signature
    algorithm
    + JDK-8224184: jshell got IOException at exiting with AIX
    + JDK-8224234: compiler/codegen/TestCharVect2.java fails in
    test_mulc
    + JDK-8225037: java.net.JarURLConnection::getJarEntry() throws
    NullPointerException
    + JDK-8225625: AES Electronic Codebook (ECB) encryption and
    decryption optimization using AVX512 + VAES instructions
    + JDK-8226536: Catch OOM from deopt that fails rematerializing
    objects
    + JDK-8226575: OperatingSystemMXBean should be made container
    aware
    + JDK-8226697: Several tests which need the @key headful
    keyword are missing it.
    + JDK-8226809: Circular reference in printed stack trace is not
    correctly indented &amp; ambiguous
    + JDK-8227059: sun/security/tools/keytool/
    /DefaultSignatureAlgorithm.java timed out
    + JDK-8227269: Slow class loading when running with JDWP
    + JDK-8227595: keytool/fakegen/DefaultSignatureAlgorithm.java
    fails due to "exitValue = 6"
    + JDK-8228448: Jconsole can't connect to itself
    + JDK-8228967: Trust/Key store and SSL context utilities for
    tests
    + JDK-8229378: jdwp library loader in linker_md.c quietly
    truncates on buffer overflow
    + JDK-8229815: Upgrade Jline to 3.12.1
    + JDK-8230000: some httpclients testng tests run zero test
    + JDK-8230002: javax/xml/jaxp/unittest/transform/
    /SecureProcessingTest.java runs zero test
    + JDK-8230010: Remove jdk8037819/BasicTest1.java
    + JDK-8230094: CCE in createXMLEventWriter(Result) over an
    arbitrary XMLStreamWriter
    + JDK-8230402: Allocation of compile task fails with assert:
    "Leaking compilation tasks?"
    + JDK-8230767: FlightRecorderListener returns null recording
    + JDK-8230870: (zipfs) Add a ZIP FS test that is similar to
    test/jdk/java/util/zip/EntryCount64k.java
    + JDK-8231209: [REDO] ThreadMXBean::getThreadAllocatedBytes()
    can be quicker for self thread
    + JDK-8231586: enlarge encoding space for OopMapValue offsets
    + JDK-8231953: Wrong assumption in assertion in
    oop::register_oop
    + JDK-8231968: getCurrentThreadAllocatedBytes default
    implementation s/b getThreadAllocatedBytes
    + JDK-8232083: Minimal VM is broken after JDK-8231586
    + JDK-8232161: Align some one-way conversion in MS950 charset
    with Windows
    + JDK-8232855: jshell missing word in /help help
    + JDK-8233027: OopMapSet::all_do does oms.next() twice during
    iteration
    + JDK-8233228: Disable weak named curves by default in TLS,
    CertPath, and Signed JAR
    + JDK-8233386: Initialize NULL fields for unused decorations
    + JDK-8233452: java.math.BigDecimal.sqrt() with
    RoundingMode.FLOOR results in incorrect result
    + JDK-8233686: XML transformer uses excessive amount of memory
    + JDK-8233741: AES Countermode (AES-CTR) optimization using
    AVX512 + VAES instructions
    + JDK-8233829: javac cannot find non-ASCII module name under
    non-UTF8 environment
    + JDK-8233958: Memory retention due to HttpsURLConnection
    finalizer that serves no purpose
    + JDK-8234011: (zipfs) Memory leak in
    ZipFileSystem.releaseDeflater()
    + JDK-8234058: runtime/CompressedOops/
    /CompressedClassPointers.java fails with 'Narrow klass base:
    0x0000000000000000' missing from stdout/stderr
    + JDK-8234149: Several regression tests do not dispose Frame at
    end
    + JDK-8234347: "Turkey" meta time zone does not generate
    composed localized names
    + JDK-8234385: [TESTBUG] java/awt/EventQueue/6980209/
    /bug6980209.java fails in linux nightly
    + JDK-8234535: Cross compilation fails due to missing CFLAGS
    for the BUILD_CC
    + JDK-8234541: C1 emits an empty message when it inlines
    successfully
    + JDK-8234687: change javap reporting on unknown attributes
    + JDK-8236464: SO_LINGER option is ignored by SSLSocket in JDK
    11
    + JDK-8236548: Localized time zone name inconsistency between
    English and other locales
    + JDK-8236617: jtreg test containers/docker/
    /TestMemoryAwareness.java fails after 8226575
    + JDK-8237182: Update copyright header for shenandoah and
    epsilon files
    + JDK-8237888: security/infra/java/security/cert/
    /CertPathValidator/certification/LuxTrustCA.java fails when
    checking validity interval
    + JDK-8237977: Further update
    javax/net/ssl/compatibility/Compatibility.java
    + JDK-8238270: java.net HTTP/2 client does not decrease stream
    count when receives 204 response
    + JDK-8238284: [macos] Zero VM build fails due to an obvious
    typo
    + JDK-8238380: java.base/unix/native/libjava/childproc.c
    "multiple definition" link errors with GCC10
    + JDK-8238386: (sctp) jdk.sctp/unix/native/libsctp/SctpNet.c
    "multiple definition" link errors with GCC10
    + JDK-8238388: libj2gss/NativeFunc.o "multiple definition" link
    errors with GCC10
    + JDK-8238448: RSASSA-PSS signature verification fail when
    using certain odd key sizes
    + JDK-8238710: LingeredApp doesn't log stdout/stderr if exits
    with non-zero code
    + JDK-8239083: C1 assert(known_holder == NULL ||
    (known_holder-&gt;is_instance_klass() &amp;&amp;
    (!known_holder-&gt;is_interface() ||
    ((ciInstanceKlass*)known_holder)-&gt;has_nonstatic_concrete_methods())),
    "should be non-static concrete method");
    + JDK-8239385: KerberosTicket client name refers wrongly to
    sAMAccountName in AD
    + JDK-8240169: javadoc fails to link to non-modular api docs
    + JDK-8240295: hs_err elapsed time in seconds is not accurate
    enough
    + JDK-8240360: NativeLibraryEvent has wrong library name on
    Linux
    + JDK-8240676: Meet not symmetric failure when running lucene
    on jdk8
    + JDK-8241007: Shenandoah: remove
    ShenandoahCriticalControlThreadPriority support
    + JDK-8241065: Shenandoah: remove leftover code after
    JDK-8231086
    + JDK-8241086: Test runtime/NMT/HugeArenaTracking.java is
    failing on 32bit Windows
    + JDK-8241130: com.sun.jndi.ldap.EventSupport.removeDeadNotifier:
    java.lang.NullPointerException
    + JDK-8241138: http.nonProxyHosts=* causes
    StringIndexOutOfBoundsException in DefaultProxySelector
    + JDK-8241319: WB_GetCodeBlob doesn't have ResourceMark
    + JDK-8241478: vmTestbase/gc/gctests/Steal/steal001/steal001.java
    fails with OOME
    + JDK-8241574: Shenandoah: remove ShenandoahAssertToSpaceClosure
    + JDK-8241750: x86_32 build failure after JDK-8227269
    + JDK-8242184: CRL generation error with RSASSA-PSS
    + JDK-8242283: Can't start JVM when java home path includes
    non-ASCII character
    + JDK-8242556: Cannot load RSASSA-PSS public key with non-null
    params from byte array
    + JDK-8243029: Rewrite javax/net/ssl/compatibility/
    /Compatibility.java with a flexible interop test framework
    + JDK-8243138: Enhance BaseLdapServer to support starttls
    extended request
    + JDK-8243320: Add SSL root certificates to Oracle Root CA
    program
    + JDK-8243321: Add Entrust root CA - G4 to Oracle Root CA
    program
    + JDK-8243389: enhance os::pd_print_cpu_info on linux
    + JDK-8243453: java --describe-module failed with non-ASCII
    module name under non-UTF8 environment
    + JDK-8243470: [macos] bring back O2 opt level for unsafe.cpp
    + JDK-8243489: Thread CPU Load event may contain wrong data for
    CPU time under certain conditions
    + JDK-8243925: Toolkit#getScreenInsets() returns wrong value on
    HiDPI screens (Windows)
    + JDK-8244087: 2020-04-24 public suffix list update
    + JDK-8244151: Update MUSCLE PC/SC-Lite headers to the latest
    release 1.8.26
    + JDK-8244164: AArch64: jaotc generates incorrect code for
    compressed OOPs with non-zero heap base
    + JDK-8244196: adjust output in os_linux
    + JDK-8244225: stringop-overflow warning on strncpy call from
    compile_the_world_in
    + JDK-8244287: JFR: Methods samples have line number 0
    + JDK-8244703: "platform encoding not initialized" exceptions
    with debugger, JNI
    + JDK-8244719: CTW: C2 compilation fails with
    "assert(!VerifyHashTableKeys || _hash_lock == 0) failed:
    remove node from hash table before modifying it"
    + JDK-8244729: Shenandoah: remove resolve paths from
    SBSA::generate_shenandoah_lrb
    + JDK-8244763: Update --release 8 symbol information after JSR
    337 MR3
    + JDK-8244818: Java2D Queue Flusher crash while moving
    application window to external monitor
    + JDK-8245151: jarsigner should not raise duplicate warnings on
    verification
    + JDK-8245616: Bump update version for OpenJDK: jdk-11.0.9
    + JDK-8245714: "Bad graph detected in build_loop_late" when
    loads are pinned on loop limit check uncommon branch
    + JDK-8245801: StressRecompilation triggers assert "redundunt
    OSR recompilation detected. memory leak in CodeCache!"
    + JDK-8245832: JDK build make-static-libs should build all JDK
    libraries
    + JDK-8245880: Shenandoah: check class unloading flag early in
    concurrent code root scan
    + JDK-8245981: Upgrade to jQuery 3.5.1
    + JDK-8246027: Minimal fastdebug build broken after JDK-8245801
    + JDK-8246094: [macos] Sound Recording and playback is not
    working
    + JDK-8246153: TestEliminateArrayCopy fails with
  - XX:+StressReflectiveCode
    + JDK-8246193: Possible NPE in ENC-PA-REP search in AS-REQ
    + JDK-8246196: javax/management/MBeanServer/OldMBeanServerTest
    fails with AssertionError
    + JDK-8246203: Segmentation fault in verification due to stack
    overflow with -XX:+VerifyIterativeGVN
    + JDK-8246330: Add TLS Tests for Legacy ECDSA curves
    + JDK-8246453: TestClone crashes with "all collected exceptions
    must come from the same place"
    + JDK-8247246: Add explicit ResolvedJavaType.link and expose
    presence of default methods
    + JDK-8247350: [aarch64] assert(false) failed: wrong size of
    mach node
    + JDK-8247502: PhaseStringOpts crashes while optimising
    effectively dead code
    + JDK-8247615: Initialize the bytes left for the heap sampler
    + JDK-8247824: CTW: C2 (Shenandoah) compilation fails with SEGV
    in SBC2Support::pin_and_expand
    + JDK-8247874: Replacement in VersionProps.java.template not
    working when --with-vendor-bug-url contains '&amp;'
    + JDK-8247979: aarch64: missing side effect of killing flags
    for clearArray_reg_reg
    + JDK-8248214: Add paddings for TaskQueueSuper to reduce
    false-sharing cache contention
    + JDK-8248219: aarch64: missing memory barrier in
    fast_storefield and fast_accessfield
    + JDK-8248348: Regression caused by the update to BCEL 6.0
    + JDK-8248385: [testbug][11u] Adapt TestInitiExceptions to
    jtreg 5.1
    + JDK-8248495: [macos] zerovm is broken due to libffi headers
    location
    + JDK-8248851: CMS: Missing memory fences between free chunk
    check and klass read
    + JDK-8248987: AOT's Linker.java seems to eagerly fail-fast on
    Windows
    + JDK-8249159: Downport test rework for SSLSocketTemplate from
    8224650
    + JDK-8249215: JFrame::setVisible crashed with
  - Dfile.encoding=UTF-8 on Japanese Windows.
    + JDK-8249251: [dark_mode ubuntu 20.04] The selected menu is
    not highlighted in GTKLookAndFeel
    + JDK-8249255: Build fails if source code in cygwin home dir
    + JDK-8249277: TestVerifyIterativeGVN.java is failing with
    timeout in OpenJDK 11
    + JDK-8249278: Revert JDK-8226253 which breaks the spec of
    AccessibleState.SHOWING for JList
    + JDK-8249560: Shenandoah: Fix racy GC request handling
    + JDK-8249801: Shenandoah: Clear soft-refs on requested GC cycle
    + JDK-8249953: Shenandoah: gc/shenandoah/mxbeans tests should
    account for corner cases
    + JDK-8250582: Revert Principal Name type to NT-UNKNOWN when
    requesting TGS Kerberos tickets
    + JDK-8250609: C2 crash in IfNode::fold_compares
    + JDK-8250627: Use -XX:+/-UseContainerSupport for
    enabling/disabling Java container metrics
    + JDK-8250755: Better cleanup for
    jdk/test/javax/imageio/plugins/shared/CanWriteSequence.java
    + JDK-8250787: Provider.put no longer registering aliases in
    FIPS env
    + JDK-8250826: jhsdb does not work with coredump which comes
    from Substrate VM
    + JDK-8250827: Shenandoah: needs to reset/finish StringTable's
    dead count before/after parallel walk
    + JDK-8250844: Make sure {type,obj}ArrayOopDesc accessors check
    the bounds
    + JDK-8251117: Cannot check P11Key size in P11Cipher and
    P11AEADCipher
    + JDK-8251354: Shenandoah: Fix jdk/jfr/tool/TestPrintJSON.java
    test failure
    + JDK-8251451: Shenandoah: Remark ObjectSynchronizer roots with
    I-U
    + JDK-8251469: Better cleanup for
    test/jdk/javax/imageio/SetOutput.java
    + JDK-8251487: Shenandoah: missing detail timing tracking for
    final mark cleaning phase
    + JDK-8252120: compiler/oracle/TestCompileCommand.java
    misspells "occured"
    + JDK-8252157: JDK-8231209 11u backport breaks jmm binary
    compatibility
    + JDK-8252258: [11u] JDK-8242154 changes the default vendor
    + JDK-8252804: [test] Fix 'ReleaseDeflater.java' test after
    downport of 8234011
    + JDK-8253134: JMM_VERSION should remain at 0x20020000 (JDK 10)
    in JDK 11
    + JDK-8253283: [11u] Test build/translations/
    /VerifyTranslations.java failing after JDK-8252258
    + JDK-8253813: Backout JDK-8244287 from 11u: it causes several
    crashes
- Removed patch:
  * gcc-fno-common-fix.patch
    + not needed any more with this version
- Added patch:
  * JDK-8250861.patch
    + Fix regression "8250861: Crash in MinINode::Ideal(PhaseGVN*,
    bool)" introduced in jdk 11.0.9</changelog>
  <changelog author="fstrba@suse.com" date="1604491200">- Enable Sheandoah GC for x86_64 (jsc#ECO-3171)</changelog>
  <changelog author="fstrba@suse.com" date="1605528000">- Update to upstream tag jdk-11.0.9.1-1
  * Fix:
    + JDK-8250861: Crash in MinINode::Ideal(PhaseGVN*, bool)
- Removed patch:
  * JDK-8250861.patch
    + Integrated upstream</changelog>
  <changelog author="fstrba@suse.com" date="1611230400">- Update to upstream tag jdk-11.0.10+9 (January 2021 CPU,
  bsc#1181239)
  * Security fixes
    + JDK-8247619: Improve Direct Buffering of Characters
  * Other changes
    + JDK-6722928: Support SSPI as a native GSS-API provider
    + JDK-7185258: [macosx] Deadlock in SunToolKit.realSync()
    + JDK-8152332: [macosx] JFileChooser cannot be serialized on
    Mac OS X
    + JDK-8161684: [testconf] Add VerifyOops' testing into compiler
    tiers
    + JDK-8171279: Support X25519 and X448 in TLS
    + JDK-8173361: various crashes in
    JvmtiExport::post_compiled_method_load
    + JDK-8173658: JvmtiExport::post_class_unload() is broken for
    non-JavaThread initiators
    + JDK-8191006: hsdis disassembler plugin does not compile with
    binutils 2.29+
    + JDK-8197981: Missing return statement in
    __sync_val_compare_and_swap_8
    + JDK-8198334: java/awt/FileDialog/8003399/bug8003399.java
    fails in headless mode
    + JDK-8200151: Add 8 JNDI tests to com/sun/jndi/dns/ConfigTests/
    + JDK-8208279: Add 8 JNDI tests to com/sun/jndi/dns/EnvTests/
    + JDK-8208483: Add 5 JNDI tests to
    com/sun/jndi/dns/FactoryTests/
    + JDK-8208542: Add 4 JNDI tests to com/sun/jndi/dns/ListTests/
    + JDK-8208665: Amend cross-compilation docs with
    qemu-debootstrap recipe
    + JDK-8210088: ProblemList gc/epsilon/TestMemoryMXBeans.java
    + JDK-8210339: Add 10 JNDI tests to com/sun/jndi/dns/FedTests/
    + JDK-8211450: UndetVar::dup is not copying the kind field to
    the duplicated instance
    + JDK-8212160: JVMTI agent crashes with "assert(_value != 0LL)
    failed: resolving NULL _value"
    + JDK-8212226: SurfaceManager throws "Invalid Image variant"
    for MultiResolutionImage (Windows)
    + JDK-8213400: Support choosing group name in keytool keypair
    generation
    + JDK-8213535: Windows HiDPI html lightweight tooltips are
    truncated
    + JDK-8213698: Improve devkit creation and add support for
    linux/ppc64/ppc64le/s390x
    + JDK-8214025: assert(t-&gt;singleton()) failed: must be a
    constant when ScavengeRootsInCode &lt; 2
    + JDK-8214242: compiler/arguments/TestScavengeRootsInCode.java
    fails because of missing UnlockDiagnosticVMOptions
    + JDK-8214787: Zero builds fail with "undefined
    JavaThread::thread_state()"
    + JDK-8215583: Exclude
    runtime/handshake/HandshakeWalkSuspendExitTest.java
    + JDK-8216012: Infinite loop in RSA KeyPairGenerator
    + JDK-8216324: GetClassMethods is confused by the presence of
    default methods in super interfaces
    + JDK-8217429: WebSocket over authenticating proxy fails to
    send Upgrade headers
    + JDK-8217976: test/jdk/java/net/httpclient/websocket/
    /WebSocketProxyTest.java fails intermittently
    + JDK-8218021: Have jarsigner preserve posix permission
    attributes
    + JDK-8218287: jshell tool: input behavior unstable after
    12-ea+24 on Windows
    + JDK-8218851: JVM crash in custom classloader stress test, JDK
    12 &amp; 13
    + JDK-8220420: Cleanup c1_LinearScan
    + JDK-8222072: JVMTI GenerateEvents() sends CompiledMethodLoad
    events to wrong jvmtiEnv
    + JDK-8222286: Fix for JDK-8213419 is broken on s390
    + JDK-8222527: HttpClient doesn't send HOST header when
    tunelling HTTP/1.1 through http proxy
    + JDK-8222533: jtreg test jdk/internal/platform/cgroup/
    /TestCgroupMetrics.java fails on SLES12.3 linux ppc64le
    machine
    + JDK-8224506: [TESTBUG] TestDockerMemoryMetrics.java fails
    with exitValue = 137
    + JDK-8224555: vmTestbase/nsk/jvmti/scenarios/contention/TC02/
    /tc02t001/TestDescription.java failed
    + JDK-8224650: Add tests to support X25519 and X448 in TLS
    + JDK-8225072: Add LuxTrust certificate that is expiring in
    March 2021 to list of allowed but expired certs
    + JDK-8225329: -XX:+PrintBiasedLockingStatistics causes crash
    during initialization on Windows platforms
    + JDK-8225687: Newly added sspi.cpp in JDK-6722928 still
    contains some small errors
    + JDK-8227006: [linux] Runtime.availableProcessors execution
    time increased by factor of 100
    + JDK-8227275: Within native OOM error handling, assertions may
    hang the process
    + JDK-8227647: [Graal] Test8009761.java fails due to
    "RuntimeException: static java.lang.Object
    compiler.uncommontrap.Test8009761.m3(boolean,boolean) not
    compiled"
    + JDK-8229495: SIGILL in C2 generated OSR compilation
    + JDK-8230910: libsspi_bridge does not build on Windows 32bit
    + JDK-8232114: JVM crashed at imjpapi.dll in native code
    + JDK-8234147: Avoid looking up standard charsets in core
    libraries
    + JDK-8234393: [macos] printing ignores printer tray
    + JDK-8234863: Increase default value of MaxInlineLevel
    + JDK-8235218: Minimal VM is broken after JDK-8173361
    + JDK-8235456: Minimal VM is broken after JDK-8212160
    + JDK-8235829: graal crashes with Zombie.java test
    + JDK-8236124: Minimal VM slowdebug build failed after
    JDK-8212160
    + JDK-8236512: PKCS11 Connection closed after Cipher.doFinal
    and NoPadding
    + JDK-8236944: The legVecZ operand should be limited to
    zmm0-zmm15 registers
    + JDK-8237186: Fix typo in copyright header of
    java/io/Reader/TransferTo.java
    + JDK-8237499: JFR: Include stack trace in the ThreadStart event
    + JDK-8237512: AArch64: aarch64TestHook leaks a BufferBlob
    + JDK-8237524: AArch64: String.compareTo() may return incorrect
    result
    + JDK-8237950: C2 compilation fails with "Live Node limit
    exceeded limit" during ConvI2L::Ideal optimization
    + JDK-8238579: HttpsURLConnection drops the timeout and hangs
    forever in read
    + JDK-8239105: Add exception for expiring Digicert root
    certificates to VerifyCACerts test
    + JDK-8239477: jdk/jfr/jcmd/TestJcmdStartStopDefault.java fails
  - XX:+VerifyOops with "verify_oop: rsi: broken oop"
    + JDK-8239497: SEGV in EdgeUtils::field_name_symbol(Edge const&amp;)
    + JDK-8239886: Minimal VM build fails after JDK-8237499
    + JDK-8240633: Memory leaks in the implementations of
    FileChooserUI
    + JDK-8240690: Race condition between EDT and
    BasicDirectoryModel.FilesLoader.run0()
    + JDK-8241234: Unify monitor enter/exit runtime entries.
    + JDK-8241311: Move some charset mapping tests from closed to
    open
    + JDK-8241797: Add some tests to the problem list
    + JDK-8242029: AArch64: skip G1 array copy pre-barrier if
    marking not active
    + JDK-8242335: Additional Tests for RSASSA-PSS
    + JDK-8242480: Negative value may be returned by
    getFreeSwapSpaceSize() in the docker
    + JDK-8242614: cleanup duplicated test ldap server in some
    com/sun/jndi/ldap/ tests
    + JDK-8242846: Bring back test/jdk/tools/jlink/plugins/
    /OrderResourcesPluginTest.java
    + JDK-8243114: Implement montgomery{Multiply,Square}intrinsics
    on Windows
    + JDK-8243290: Improve diagnostic messages for class
    verification and redefinition failures
    + JDK-8243488: Add tests for set/get SendBufferSize and
    getReceiveBufferSize in DatagramSocket
    + JDK-8243549: sun/security/ssl/CipherSuite/
    /NamedGroupsWithCipherSuite.java failed with Unsupported
    signature algorithm: DSA
    + JDK-8243617: compiler/onSpinWait/TestOnSpinWaitC1.java test
    uses wrong class
    + JDK-8243619: compiler/codecache/CheckSegmentedCodeCache.java
    test misses -version
    + JDK-8244142: some hotspot/runtime tests don't check exit code
    of forked JVM
    + JDK-8244278: Excessive code cache flushes and sweeps
    + JDK-8244282: test/hotspot/jtreg/compiler/intrinsics/
    /Test8237524.java fails with --illegal-access=deny
    + JDK-8244621: [macos10.15] Garbled FX printing plus CoreText
    warnings on Catalina when building with Xcode 11
    + JDK-8244819: hsdis does not compile with binutils 2.34+
    + JDK-8245051: c1 is broken if it is compiled by gcc without
  - fno-lifetime-dse
    + JDK-8245168: jlink should not be treated as a "small" tool
    + JDK-8245400: Upgrade to LittleCMS 2.11
    + JDK-8246381: VM crashes with "Current BasicObjectLock* below
    than low_mark"
    + JDK-8246434: Threads::print_on_error assumes that the heap
    has been set up
    + JDK-8246648: issue with OperatingSystemImpl
    getFreeSwapSpaceSize in docker after 8242480
    + JDK-8247201: Print potential pointer value of readable stack
    memory in hs_err file
    + JDK-8247763: assert(outer-&gt;outcnt() == 2) failed: 'only phis'
    failure in LoopNode::verify_strip_mined()
    + JDK-8247867: Upgrade to freetype 2.10.2
    + JDK-8248190: Enable Power10 system and implement new
    byte-reverse instructions
    + JDK-8248226: TestCloneAccessStressGCM fails with
  - XX:-ReduceBulkZeroing
    + JDK-8248347: windows build broken by JDK-8243114
    + JDK-8248532: Every time I change keyboard language at my
    MacBook, Java crashes
    + JDK-8248552: C2 crashes with SIGFPE due to division by zero
    + JDK-8248596: [TESTBUG] compiler/loopopts/
    /PartialPeelingUnswitch.java times out with Graal enabled
    + JDK-8248745: Add jarsigner and keytool tests for restricted
    algorithms
    + JDK-8248791: sun/util/resources/cldr/TimeZoneNamesTest.java
    fails with -XX:-ReduceInitialCardMarks -XX:-ReduceBulkZeroing
    + JDK-8248845: AArch64: stack corruption after spilling vector
    register
    + JDK-8249176: Update GlobalSignR6CA test certificates
    + JDK-8249183: JVM crash in "AwtFrame::WmSize" method
    + JDK-8249192: MonitorInfo stores raw oops across safepoints
    + JDK-8249602: C2: assert(cnt == _outcnt) failed: no insertions
    allowed
    + JDK-8249603: C1: assert(has_error == false) failed: register
    allocation invalid
    + JDK-8249605: C2: assert(no_dead_loop) failed: dead loop
    detected
    + JDK-8249607: C2: assert(!had_error) failed: bad dominance
    + JDK-8249608: Vector register used by C2 compiled method
    corrupted at safepoint
    + JDK-8249672: Include microcode revision in features_string on
    x86
    + JDK-8249748: gtest silently ignores bad jvm arguments
    + JDK-8249821: Separate libharfbuzz from libfontmanager
    + JDK-8250598: Hyper-V is detected in spite of running on host
    OS
    + JDK-8250605: Linux x86_32 builds fail after JDK-8249821
    + JDK-8250636: iso8601_time returns incorrect offset part on
    MacOS
    + JDK-8250665: Wrong translation for the month name of May in
    ar_JO,LB,SY
    + JDK-8250772: Test com/sun/jndi/ldap/
    /NamingExceptionMessageTest.java fails intermittently with
    javax.naming.ServiceUnavailableException
    + JDK-8250825: C2 crashes with assert(field != __null) failed:
    missing field
    + JDK-8250894: Provide a configure option to build and run
    against the platform libharfbuzz
    + JDK-8250928: JFR: Improve hash algorithm for stack traces
    + JDK-8250968: Symlinks attributes not preserved when using
    jarsigner on zip files
    + JDK-8250984: Memory Docker tests fail on some Linux kernels
    w/o cgroupv1 swap limit capabilities
    + JDK-8251118: BiasedLocking::preserve_marks should not have a
    HandleMark
    + JDK-8251189: com/sun/jndi/ldap/LdapDnsProviderTest.java
    failed due to timeout
    + JDK-8251257: NMT: jcmd VM.native_memory scale=1 crashes
    target VM
    + JDK-8251365: Build failure on AIX after 8250636
    + JDK-8251397: NPE on ClassValue.ClassValueMap.cacheArray
    + JDK-8251456: [TESTBUG] compiler/vectorization/
    /TestVectorsNotSavedAtSafepoint.java failed OutOfMemoryError
    + JDK-8251458: Parse::do_lookupswitch fails with "assert(_cnt
    &gt;= 0) failed"
    + JDK-8251535: Partial peeling at unsigned test adds incorrect
    loop exit check
    + JDK-8251949: ZGC: Set explicit heap size for
    compiler/gcbarriers tests
    + JDK-8252090: JFR: StreamWriterHost::write_unbuffered() stucks
    in an infinite loop OpenJDK (build 13.0.1+9)
    + JDK-8252415: Bump update version for OpenJDK: jdk-11.0.10
    + JDK-8252470: java/awt/dnd/DisposeFrameOnDragCrash/
    /DisposeFrameOnDragTest.java fails on Windows
    + JDK-8252497: Incorrect numeric currency code for ROL
    + JDK-8252660: Shenandoah: support manageable SoftMaxHeapSize
    option
    + JDK-8252679: Two windows specific FileDIalog tests may fail
    on some Windows_Server_2016_Standard
    + JDK-8252696: Loop unswitching may cause out of bound array
    load to be executed
    + JDK-8252754: Hash code calculation of JfrStackTrace is
    inconsistent
    + JDK-8253219: Epsilon: clean up unnecessary includes
    + JDK-8253224: Shenandoah: ShenandoahStrDedupQueue destructor
    calls virtual num_queues()
    + JDK-8253226: Shenandoah: remove unimplemented
    ShenandoahStrDedupQueue::verify
    + JDK-8253269: The CheckCommonColors test should provide more
    info on failure
    + JDK-8253284: Zero OrderAccess barrier mappings are incorrect
    + JDK-8253375: OSX build fails with Xcode 12.0 (12A7209)
    + JDK-8253778: ShenandoahSafepoint::is_at_shenandoah_safepoint
    should not access VMThread state from other threads
    + JDK-8253791: Issue with useAppleColor check in CSystemColors.m
    + JDK-8254016: Test8237524 fails with -XX:-CompactStrings option
    + JDK-8254081: java/security/cert/PolicyNode/
    /GetPolicyQualifiers.java fails due to an expired certificate
    + JDK-8254144: Non-x86 Zero builds fail with return-type
    warning in os_linux_zero.cpp
    + JDK-8254166: Zero: return-type warning in
    zeroInterpreter_zero.cpp
    + JDK-8254177: (tz) Upgrade time-zone data to tzdata2020b
    + JDK-8254185: Fix Code cache sweeper heuristics for JDK 11
    + JDK-8254190: [s390] interpreter misses exception check after
    calling monitorenter
    + JDK-8254790: SIGSEGV in string_indexof_char and
    stringL_indexof_char intrinsics
    + JDK-8254854: [cgroups v1] Metric limits not properly detected
    on some join controller combinations
    + JDK-8254982: (tz) Upgrade time-zone data to tzdata2020c
    + JDK-8255050: Add pkcs11/KeyStore/ClientAuth.sh to Problem list
    + JDK-8255065: Zero: accessor_entry misses the IRIW case
    + JDK-8255226: (tz) Upgrade time-zone data to tzdata2020d
    + JDK-8255269: Unsigned overflow in g1Policy.cpp
    + JDK-8255365: Problem list failing client manual tests
    + JDK-8255457: Shenandoah: cleanup ShenandoahMarkTask
    + JDK-8255466: C2 crashes at ciObject::get_oop() const+0x0
    + JDK-8255550: x86: Assembler::cmpq(Address dst, Register src)
    encoding is incorrect
    + JDK-8255603: Memory/Performance regression after JDK-8210985
    + JDK-8255760: Shenandoah: match constants style in
    ShenandoahMarkTask fallback
    + JDK-8255781: Bump patch update version for OpenJDK:
    jdk-11.0.9.1
    + JDK-8255937: Better cleanup for
    test/jdk/javax/imageio/stream/StreamFlush.java
    + JDK-8256427: Test com/sun/jndi/dns/ConfigTests/
    /PortUnreachable.java does not work on AIX
    + JDK-8256452: Integrate missing part of JDK-8232370 to 11u
    + JDK-8256483: [TESTBUG] serviceability/jvmti/GetClassMethods/
    /libOverpassMethods.c fails to compile on gcc 4.4.x
    + JDK-8256557: libharfbuzz fails to link on gcc 4.4.x due to
  - Wl,-z,defs
    + JDK-8256618: Zero: Linux x86_32 build still fails
    + JDK-8256736: Zero: GTest tests fail with "unsuppported vm
    variant"
    + JDK-8256809: Annotation processing causes NPE during flow
    analysis
    + JDK-8257181: s390x builds are very noisy with gc-sections
    messages
    + JDK-8257242: [macOS] Java app crashes while switching input
    methods
    + JDK-8257545: SunJSSE FIPS regression in key exchange after
    JDK-8171279 11u backport
    + JDK-8257641: Shenandoah: Query is_at_shenandoah_safepoint()
    from control thread should return false
    + JDK-8257701: Shenandoah: objArrayKlass metadata is not marked
    with chunked arrays
    + JDK-8258630: Add expiry exception for QuoVadis root
    certificate
- New upstream dependency on libharfbuzz
- Regenerated patches: missing-return.patch system-pcsclite.patch</changelog>
  <changelog author="fstrba@suse.com" date="1616155200">- Added patches:
  * system-crypto-policy.patch
    + Let OpenJDK use system crypto policies unless explicitely told
    not to
  * nss-security-provider.patch
    + Add the NSS security provider with configuration in generated
    nss.cfg file
  * keytool-default-rsa.patch
    + Make keytool generate RSA keys by default, since only the
    LEGACY system crypto policy allows DSA</changelog>
  <changelog author="pujos.michael@gmail.com" date="1618488000">- moved mozilla-nss dependency to java-11-openjdk-headless package
  This is necessary to be able to do crypto with just
  java-11-openjdk-headless installed. Fixes boo#1184606</changelog>
  <changelog author="fstrba@suse.com" date="1619006400">- Update to upstream tag jdk-11.0.11+9 (April 2021, CPU)
  * Security fixes
    + JDK-8244473: Contextualize registration for JNDI
    + JDK-8244543: Enhanced handling of abstract classes
    + JDK-8249906, CVE-2021-2163, bsc#1185055: Enhance opening JARs
    + JDK-8250568, CVE-2021-2161, bsc#1185056: Less ambiguous
    processing
    + JDK-8253799: Make lists of normal filenames
    + JDK-8257001: Improve Http Client Support
  * Other changes
    + JDK-7107012: sun.jvm.hotspot.code.CompressedReadStream
    readDouble() conversion to long mishandled
    + JDK-7146776: deadlock between URLStreamHandler.getHostAddress
    and file.Handler.openconnection
    + JDK-8086003: Test fails on OSX with java.lang.RuntimeException
    'Narrow klass base: 0x0000000000000000, Narrow klass shift: 3'
    missing
    + JDK-8168869: jdeps: localized messages don't use proper line
    breaks
    + JDK-8180837: SunPKCS11-NSS tests failing with
    CKR_ATTRIBUTE_READ_ONLY and CKR_MECHANISM_PARAM_INVALID
    + JDK-8202343: Disable TLS 1.0 and 1.1
    + JDK-8205992: jhsdb cannot attach to Java processes running in
    Docker containers
    + JDK-8209193: Fix aarch64-linux compilation after -Wreorder
    changes
    + JDK-8210413: AArch64: Optimize div/rem by constant in C1
    + JDK-8210578: AArch64: Invalid encoding for fmlsvs instruction
    + JDK-8211051: jdeps usage of --dot-output doesn't provide
    valid output for modular jar
    + JDK-8211057: Gensrc step CompileProperties generates unstable
    CompilerProperties output
    + JDK-8211150: G1 Full GC not purging code root memory and
    hence causing memory leak
    + JDK-8211825: ModuleLayer.defineModulesWithXXX does not setup
    delegation when module reads automatic module
    + JDK-8212043: Add floating-point Math.min/max intrinsics
    + JDK-8212218: [TESTBUG] runtime/ErrorHandling/
    /TestHeapDumpOnOutOfMemoryErrorInMetaspace.java timed out
    + JDK-8213116: javax/swing/JComboBox/WindowsComboBoxSize/
    /WindowsComboBoxSizeTest.java fails in Windows
    + JDK-8213909: jdeps --print-module-deps should report missing
    dependences
    + JDK-8214180: Need better granularity for sleeping
    + JDK-8214223: tools/jdeps/listdeps/ListModuleDeps.java failed
    due to missing Lib2 file
    + JDK-8214230: Classes generated by SystemModulesPlugin.java
    are not reproducable
    + JDK-8214741: docs/index.html has no title or copyright
    + JDK-8215687: [Graal] unit test CheckGraalIntrinsics failed
    after 8212043
    + JDK-8217848: [Graal] vmTestbase/nsk/jvmti/ResourceExhausted/
    /resexhausted003/TestDescription.java fails
    + JDK-8218482: sun/security/krb5/auto/ReplayCachePrecise.java
    failed - no KrbException thrown
    + JDK-8218550: Add test omitted from JDK-8212043
    + JDK-8221584: SIGSEGV in os::PlatformEvent::unpark() in
    JvmtiRawMonitor::raw_exit while posting method exit event
    + JDK-8221995: AARCH64: problems with CAS instructions encoding
    + JDK-8222518: Remove unnecessary caching of Parker object in
    java.lang.Thread
    + JDK-8222785: aarch64: add necessary masking for immediate
    shift counts
    + JDK-8223186: HotSpot compile warnings from GCC 9
    + JDK-8225773: jdeps --check produces NPE if there are missing
    module dependences
    + JDK-8225805: Java Access Bridge does not close the logger
    + JDK-8226810: Failed to launch JVM because of
    NullPointerException occured on System.props
    + JDK-8229396: jdeps ignores multi-release when
    generate-module-info used on command line
    + JDK-8229474: Shenandoah: Cleanup CM::update_roots()
    + JDK-8232225: Rework the fix for JDK-8071483
    + JDK-8232905: JFR fails with assertion:
    assert(t-&gt;unflushed_size() == 0) failed: invariant
    + JDK-8233164: C2 fails with assert(phase-&gt;C-&gt;get_alias_index(t)
    == phase-&gt;C-&gt;get_alias_index(t_adr)) failed: correct memory
    chain
    + JDK-8233910: java/awt/ColorClass/AlphaColorTest.java is
    failing  intermittently in nightly lnux-x64 system
    + JDK-8233912: aarch64: minor improvements of atomic operations
    + JDK-8234508: VM_HeapWalkOperation::iterate_over_object reads
    non-strong fields with an on-strong load barrier
    + JDK-8234742: Improve handshake logging
    + JDK-8234796: Refactor Handshake::execute to take a more
    complex type than ThreadClosure
    + JDK-8235324: Dying objects are published from users of
    CollectedHeap::object_iterate
    + JDK-8235351: Lookup::unreflect should bind with the original
    caller independent of Method's accessible flag
    + JDK-8237369: Shenandoah: failed vmTestbase/nsk/jvmti/
    /AttachOnDemand/attach021/TestDescription.java test
    + JDK-8237392: Shenandoah: Remove unreliable assertion
    + JDK-8237483: AArch64 C1 OopMap inserted twice fatal error
    + JDK-8237495: Java MIDI fails with a dereferenced memory error
    when asked to send a raw 0xF7
    + JDK-8239355: (dc) Initial value of SO_SNDBUF should allow
    sending large datagrams (macOS)
    + JDK-8240353: AArch64: missing support for
  - XX:+ExtendedDTraceProbes in C1
    + JDK-8240704: CheckHandles.java failed "AssertionError: Handle
    use increased by more than 10 percent."
    + JDK-8240751: Shenandoah: fold ShenandoahTracer definition
    + JDK-8240795: [REDO] 8238384 CTW: C2 compilation fails with
    "assert(store != load-&gt;find_exact_control(load-&gt;in(0)))
    failed: dependence cycle found"
    + JDK-8241598: Upgrade JLine to 3.14.0
    + JDK-8241649: Optimize Character.toString
    + JDK-8241770: Module xxxAnnotation() methods throw NCDFE if
    module-info.class found as resource in unnamed module
    + JDK-8241911: AArch64: Fix a potential register clash issue in
    reduce_add2I
    + JDK-8242030: Wrong package declarations in jline classes after
    JDK-8241598
    + JDK-8242565: Policy initialization issues when the denyAfter
    constraint is enabled
    + JDK-8243618: compiler/rtm/cli tests can be run w/o WhiteBox
    + JDK-8243670: Unexpected test result caused by C2
    MergeMemNode::Ideal
    + JDK-8244088: [Regression] Switch of Gnome theme ends up in
    deadlocked UI
    + JDK-8244154: Update SunPKCS11 provider with PKCS11 v3.0 header
    files
    + JDK-8244340: Handshake processing thread lacks yielding
    + JDK-8244573: java.lang.ArrayIndexOutOfBoundsException thrown
    for malformed class file
    + JDK-8244683: A TSA server used by tests
    + JDK-8245005: javax/net/ssl/compatibility/BasicConnectTest.java
    failed with No enum constant
    + JDK-8245026: PsAdaptiveSizePolicy::_old_gen_policy_is_ready is
    unused
    + JDK-8245283: JFR: Can't handle constant dynamic used by Jacoco
    agent
    + JDK-8245512: CRC32 optimization using AVX512 instructions
    + JDK-8245527: LDAP Channel Binding support for Java
    GSS/Kerberos
    + JDK-8246707: (sc) SocketChannel.read/write throws
    AsynchronousCloseException on closed channel
    + JDK-8246709: sun/security/tools/jarsigner/
    /TsacertOptionTest.java compilation failed after JDK-8244683
    + JDK-8247200: assert((unsigned)fpargs &lt; 32)
    + JDK-8247766: [aarch64] guarantee(val &lt; (1U &lt;&lt; nbits))
    failed: Field too big for insn.
    + JDK-8248336: AArch64: C2: offset overflow in
    BoxLockNode::emit
    + JDK-8248865: Document JNDI/LDAP timeout properties
    + JDK-8248901: Signed immediate support in
    .../share/assembler.hpp is broken.
    + JDK-8249543: Force DirectBufferAllocTest to run with
  - ExplicitGCInvokesConcurrent
    + JDK-8249588: libwindowsaccessbridge issues on 64bit Windows
    + JDK-8249749: modify a primitive array through a stream and a
    for cycle causes jre crash
    + JDK-8249787: Make TestGCLocker more resilient with concurrent
    GCs
    + JDK-8249867: xml declaration is not followed by a newline
    + JDK-8250911: [windows] os::pd_map_memory() error detection
    broken
    + JDK-8251255: [linux] Add process-memory information to hs-err
    and VM.info
    + JDK-8251359: Shenandoah: filter null oops before calling
    enqueue/SATB barrier
    + JDK-8251925: C2: RenaissanceStressTest fails with
    assert(!had_error): bad dominance
    + JDK-8251944: Add Shenandoah test config to
    compiler/gcbarriers/UnsafeIntrinsicsTest.java
    + JDK-8251992: VM crashed running TestComplexAddrExpr.java test
    with -XX:UseAVX=X
    + JDK-8253220: Epsilon: clean up unused code/declarations
    + JDK-8253274: The CycleDMImagetest brokes the system
    + JDK-8253353: Crash in C2: guarantee(n != NULL) failed: No Node
    + JDK-8253368: TLS connection always receives close_notify
    exception
    + JDK-8253404: C2: assert(C-&gt;live_nodes() &lt;=
    C-&gt;max_node_limit()) failed: Live Node limit exceeded limit
    + JDK-8253409: Double-rounding possibility in float fma
    + JDK-8253476: TestUseContainerSupport.java fails on some Linux
    kernels w/o swap limit capabilities
    + JDK-8253524: C2: Refactor code that clones predicates during
    loop unswitching
    + JDK-8253644: C2: assert(skeleton_predicate_has_opaque(iff))
    failed: unexpected
    + JDK-8253681: closed java/awt/dnd/MouseEventAfterStartDragTest/
    /MouseEventAfterStartDragTest.html test failed
    + JDK-8253702: BigSur version number reported as 10.16, should
    be 11.nn
    + JDK-8253756: C2 CompilerThread0 crash in Node::add_req(Node*)
    + JDK-8254104: MethodCounters must exist before nmethod is
    installed
    + JDK-8254734: "dead loop detected" assert failure with patch
    from 8223051
    + JDK-8254748: Bad Copyright header format after JDK-8212218
    + JDK-8254799: runtime/ErrorHandling/
    /TestHeapDumpOnOutOfMemoryError.java fails with release VMs
    + JDK-8255058: C1: assert(is_virtual()) failed: type check
    + JDK-8255351: Add detection for Graviton 2 CPUs
    + JDK-8255368: Math.exp() gives wrong result for large values on
    x86 32-bit platforms
    + JDK-8255387: Japanese characters were printed upside down on
    AIX
    + JDK-8255401: Shenandoah: Allow oldval and newval registers to
    overlap in cmpxchg_oop()
    + JDK-8255479: [aarch64] assert(src-&gt;section_index_of(target) ==
    CodeBuffer::SECT_NONE) failed: sanity
    + JDK-8255544: Create a checked cast
    + JDK-8255559: Leak File Descriptors Because of
    ResolverLocalFilesystem#engineResolveURI()
    + JDK-8255681: print callstack in error case in
    runAWTLoopWithApp
    + JDK-8255734: VM should ignore SIGXFSZ on ppc64, s390 too
    + JDK-8255742: PrintInlining as compiler directive doesn't print
    virtual calls
    + JDK-8255845: Memory leak in imageFile.cpp
    + JDK-8255880: UI of Swing components is not redrawn after their
    internal state changed
    + JDK-8255908: ExceptionInInitializerError due to
    UncheckedIOException while initializing cgroupv1 subsystem
    + JDK-8256025: AArch64: MachCallRuntimeNode::ret_addr_offset()
    is incorrect for stub calls
    + JDK-8256056: Deoptimization stub doesn't save vector registers
    on x86
    + JDK-8256061: RegisterSaver::save_live_registers() omits upper
    halves of ZMM0-15 registers
    + JDK-8256187: [TEST_BUG] Automate bug4275046.java test
    + JDK-8256220: C1: x86_32 fails with -XX:UseSSE=1 after
    JDK-8210764 due to mishandled lir_neg
    + JDK-8256258: some missing NULL checks or asserts after
    CodeCache::find_blob_unsafe
    + JDK-8256264: Printed GlyphVector outline with low DPI has bad
    quality on Windows
    + JDK-8256290: javac/lambda/T8031967.java fails with
    StackOverflowError on x86_32
    + JDK-8256359: AArch64: runtime/ReservedStack/
    /ReservedStackTestCompiler.java fails
    + JDK-8256387: Unexpected result if patching an entire
    instruction on AArch64
    + JDK-8256421: Add 2 HARICA roots to cacerts truststore
    + JDK-8256488: [aarch64] Use ldpq/stpq instead of ld4/st4 for
    small copies in StubGenerator::copy_memory
    + JDK-8256489: Make gtest for long path names on Windows more
    resilient in the presence of virus scanners
    + JDK-8256501: libTestMainKeyWindow fails to build with Xcode
    12.2
    + JDK-8256633: Fix product build on Windows+Arm64
    + JDK-8256682: JDK-8202343 is incomplete
    + JDK-8256751: Incremental rebuild with precompiled header fails
    when touching a header file
    + JDK-8256757: Incorrect MachCallRuntimeNode::ret_addr_offset()
    for CallLeafNoFP on x86_32
    + JDK-8256806: Shenandoah: optimize shenandoah/jni/
    /TestPinnedGarbage.java test
    + JDK-8256807: C2: Not marking stores correctly as mismatched
    in string opts
    + JDK-8256810: Incremental rebuild broken on Macosx
    + JDK-8256818: SSLSocket that is never bound or connected leaks
    socket resources
    + JDK-8256888: Client manual test problem list update
    + JDK-8257083: Security infra test failures caused by
    JDK-8202343
    + JDK-8257408: Bump update version for OpenJDK: jdk-11.0.11
    + JDK-8257423: [PPC64] Support -XX:-UseInlineCaches
    + JDK-8257436: [aarch64] Regressions in ArrayCopyUnalignedDst
    .testByte/testChar for 65-78 bytes when UseSIMDForMemoryOps
    is on
    + JDK-8257513: C2: assert((constant_addr -
    _masm.code()-&gt;consts()-&gt;start()) == con.offset())
    + JDK-8257547: Handle multiple prereqs on the same line in deps
    files
    + JDK-8257561: Some code is not vectorized after 8251925 and
    8250607
    + JDK-8257565: epsilonBarrierSet.hpp should not include
    barrierSetAssembler
    + JDK-8257575: C2: "failed: only phis" assert failure in loop
    strip mining verification
    + JDK-8257594: C2 compiled checkcast of non-null object triggers
    endless deoptimization/recompilation cycle
    + JDK-8257633: Missing -mmacosx-version-min=X flag when linking
    libjvm
    + JDK-8257670: sun/security/ssl/SSLSocketImpl/SSLSocketLeak.java
    reports leaks
    + JDK-8257707: Fix incorrect format string in Http1HeaderParser
    + JDK-8257746: Regression introduced with JDK-8250984 - memory
    might be null in some machines
    + JDK-8257798: [PPC64] undefined reference to
    Klass::vtable_start_offset()
    + JDK-8257884: Re-enable sun/security/ssl/SSLSocketImpl/
    /SSLSocketLeak.java as automatic test
    + JDK-8257910: [JVMCI] Set exception_seen accordingly in the
    runtime.
    + JDK-8257997: sun/security/ssl/SSLSocketImpl/SSLSocketLeak.java
    again reports leaks after JDK-8257884
    + JDK-8257999: Parallel GC crash in gc/parallel/
    /TestDynShrinkHeap.java: new region is not in covered_region
    + JDK-8258077: Using -Xcheck:jni can lead to a double-free after
    JDK-8193234
    + JDK-8258247: Couple of issues in fix for JDK-8249906
    + JDK-8258373: Update the text handling in the JPasswordField
    + JDK-8258396: SIGILL in jdk.jfr.internal.PlatformRecorder
    .rotateDisk()
    + JDK-8258419: RSA cipher buffer cleanup
    + JDK-8258471: "search codecache" clhsdb command does not work
    + JDK-8258534: Epsilon: clean up unused includes
    + JDK-8258805: Japanese characters not entered by mouse click
    on Windows 10
    + JDK-8258833: Cancel multi-part cipher operations in SunPKCS11
    after failures
    + JDK-8258836: JNI local refs exceed capacity
    getDiagnosticCommandInfo
    + JDK-8258884: [TEST_BUG] Convert applet-based test
    open/test/jdk/javax/swing/JMenuItem/8031573/bug8031573.java
    to a regular java test
    + JDK-8259007: This test printed a blank page
    + JDK-8259048: (tz) Upgrade time-zone data to tzdata2020f
    + JDK-8259049: Uninitialized variable after JDK-8257513
    + JDK-8259231: Epsilon: improve performance under contention
    during virtual space expansion
    + JDK-8259271: gc/parallel/TestDynShrinkHeap.java still fails
    "assert(covered_region.contains(new_memregion)) failed: new
    region is not in covered_region"
    + JDK-8259312: VerifyCACerts.java fails as soneraclass2ca cert
    will expire in 90 days
    + JDK-8259319: Illegal package access when SunPKCS11 requires
    SunJCE's classes
    + JDK-8259339: AllocateUninitializedArray C2 intrinsic fails
    with void.class input
    + JDK-8259428: AlgorithmId.getEncodedParams() should return copy
    + JDK-8259446: runtime/jni/checked/
    /TestCheckedReleaseArrayElements.java fails with stderr not
    empty
    + JDK-8259451: Zero: skip serviceability/sa tests, set vm.hasSA
    to false
    + JDK-8259580: Shenandoah: uninitialized label in
    VerifyThreadGCState
    + JDK-8259619: C1: 3-arg StubAssembler::call_RT stack-use
    condition is incorrect
    + JDK-8259633: compiler/graalunit/CoreTest.java fails with NPE
    after JDK-8244543
    + JDK-8259706: C2 compilation fails with assert(vtable_index ==
    Method::invalid_vtable_index) failed: correct sentinel value
    + JDK-8259707: LDAP channel binding does not work with StartTLS
    extension
    + JDK-8259773: Incorrect encoding of AVX-512 kmovq instruction
    + JDK-8259849: Shenandoah: Rename store-val to IU-barrier
    + JDK-8259949: x86 32-bit build fails when -fcf-protection is
    passed in the compiler flags
    + JDK-8259954: gc/shenandoah/mxbeans tests fail with -Xcomp
    + JDK-8260029: aarch64: fix typo in verify_oop_array
    + JDK-8260308: Update LogCompilation junit to 4.13.1
    + JDK-8260338: Some fields in HaltNode is not cloned
    + JDK-8260349: Cannot programmatically retrieve Metaspace max
    set via JAVA_TOOL_OPTIONS
    + JDK-8260356: (tz) Upgrade time-zone data to tzdata2021a
    + JDK-8260378: [TESTBUG] DcmdMBeanTestCheckJni.java reports
    false positive
    + JDK-8260497: Shenandoah: Improve SATB flushing
    + JDK-8260502: [s390] NativeMovRegMem::verify() fails because
    it's too strict
    + JDK-8260632: Build failures after JDK-8253353
    + JDK-8260704: ParallelGC: oldgen expansion needs release-store
    for _end
    + JDK-8261022: Fix incorrect result of Math.abs() with char type
    + JDK-8261089: [TESTBUG] native library of test
    TestCheckedReleaseCriticalArray.java fails to compile with
    gcc 4.x
    + JDK-8261183: Follow on to Make lists of normal filenames
    + JDK-8261209: isStandalone property: remove dependency on
    pretty-print
    + JDK-8261231: Windows IME was disabled after DnD operation
    + JDK-8261251: Shenandoah: Use object size for full GC
    humongous compaction
    + JDK-8261310: PPC64 Zero build fails with
    'VMError::controlled_crash(int)::FunctionDescriptor
    functionDescriptor' has incomplete type and cannot be defined
    + JDK-8261334: NMT: tuning statistic shows incorrect hash
    distribution
    + JDK-8261413: Shenandoah: Disable class-unloading in I-U mode
    + JDK-8261522: [PPC64] AES intrinsics write beyond the
    destination array
    + JDK-8261534: Test sun/security/pkcs11/KeyAgreement/
    /IllegalPackageAccess.java fails on platforms where no nsslib
    artifacts are defined
    + JDK-8261585: Restore HandleArea used in
    Deoptimization::uncommon_trap
    + JDK-8261753: Test java/lang/System/OsVersionTest.java still
    failing on BigSur patch versions after JDK-8253702
    + JDK-8261829: Exclude tools/jlink/JLinkReproducibleTest.java
    in 11u
    + JDK-8261912: Code IfNode::fold_compares_helper more
    defensively
    + JDK-8261920: [AIX] jshell command throws java.io.IOError on
    non English locales
    + JDK-8262018: Wrong format in SAP copyright header of
    OsVersionTest
    + JDK-8263069: Exclude some failing tests from
    security/infra/java/security/cert/CertPathValidator</changelog>
  <changelog author="fstrba@suse.com" date="1620043200">- Remove all Jpackage provides for SLE12 in order to avoid
  installing this package as default Java on SLE12-SP5
  (bsc#1185476)</changelog>
  <changelog author="fstrba@suse.com" date="1621512000">- Modified patch:
  * nss-security-provider.patch
    + make the NSS provider first in the list</changelog>
  <changelog author="fstrba@suse.com" date="1626868800">- Update to upstream tag jdk-11.0.12+7 (July 2021, CPU)
  * Security fixes
    + JDK-8256157: Improve bytecode assembly
    + JDK-8256491: Better HTTP transport
    + JDK-8258432, CVE-2021-2341, bsc#1188564: Improve file
    transfers
    + JDK-8260453: Improve Font Bounding
    + JDK-8260960: Signs of jarsigner signing
    + JDK-8260967, CVE-2021-2369, bsc#1188565: Better jar file
    validation
    + JDK-8262380: Enhance XML processing passes
    + JDK-8262403: Enhanced data transfer
    + JDK-8262410: Enhanced rules for zones
    + JDK-8262477: Enhance String Conclusions
    + JDK-8262967: Improve Zip file support
    + JDK-8264066, CVE-2021-2388, bsc#1188566: Enhance compiler
    validation
    + JDK-8264079: Improve abstractions
    + JDK-8264460: Improve NTLM support
  * Other changes
    + JDK-6847157: java.lang.NullPointerException: HDC for
    component at sun.java2d.loops.Blit.Blit
    + JDK-7106851: Test should not use System.exit
    + JDK-8073446: TimeZone getOffset API does not  return a dst
    offset between years 2038-2137
    + JDK-8076190: Customizing the generation of a PKCS12 keystore
    + JDK-8153005: Upgrade the default PKCS12 encryption/MAC
    algorithms
    + JDK-8171303: sun/java2d/pipe/InterpolationQualityTest.java
    fails on Windows &amp; Linux
    + JDK-8177068: incomplete classpath causes NPE in Flow
    + JDK-8185734: [Windows] Structured Exception Catcher missing
    around gtest execution
    + JDK-8187450: JNI local refs exceeds capacity warning in
    NetworkInterface::getAll
    + JDK-8190763: Class cast exception on (CompoundEdit)
    UndoableEditEvent.getEdit()
    + JDK-8195841: PNGImageReader.readNullTerminatedString() doesnt
    check for non-null terminated strings with length equal to
    maxLen
    + JDK-8196100: javax/swing/text/JTextComponent/5074573/
    /bug5074573.java fails
    + JDK-8199646: JShell tests: jdk/jshell/
    /FailOverDirectExecutionControlTest.java failed with
    java.lang.UnsupportedOperationException
    + JDK-8206925: Support the certificate_authorities extension
    + JDK-8207160: ClassReader::adjustMethodParams can potentially
    return null if the args list is empty
    + JDK-8207247: AARCH64: Enable Minimal and Client VM builds
    + JDK-8207404: MulticastSocket tests failing on AIX
    + JDK-8207779: Method::is_valid_method() compares 'this' with
    NULL
    + JDK-8208061: runtime/LoadClass/TestResize.java fails with
    "Load factor too high" when running in CDS mode.
    + JDK-8209459: TestSHA512MultiBlockIntrinsics failed on AArch64
    + JDK-8210443: Migrate Locale matching tests to JDK Repo.
    + JDK-8213231: ThreadSnapshot::_threadObj can become stale
    + JDK-8213483: ARM32: runtime/ErrorHandling/
    /ShowRegistersOnAssertTest.java jtreg test fail
    + JDK-8213725: JShell NullPointerException due to class file
    with unexpected package
    + JDK-8213794: ARM32: disable TypeProfiling,
    CriticalJNINatives, Serviceablity tests for ARM32
    + JDK-8213845: ARM32: Interpreter doesn't call result handler
    after native calls
    + JDK-8214128: ARM32: wrong stack alignment on
    Deoptimization::unpack_frames
    + JDK-8214512: ARM32: Jtreg test compiler/c2/Test8062950.java
    fails on ARM
    + JDK-8214854: JDWP: Unforseen output truncation in logging
    + JDK-8214922: Add vectorization support for fmin/fmax
    + JDK-8215009: GCC 8 compilation error in libjli
    + JDK-8216184: CDS/appCDS tests failed on Windows due to long
    path to a classlist file
    + JDK-8216259: AArch64: Vectorize Adler32 intrinsics
    + JDK-8216314: SIGILL in CodeHeapState::print_names()
    + JDK-8217348: assert(thread-&gt;is_Java_thread()) failed: just
    checking
    + JDK-8217465: [REDO] - Optimize CodeHeap Analytics
    + JDK-8217561: X86: Add floating-point Math.min/max intrinsics
    + JDK-8217918: C2: -XX:+AggressiveUnboxing is broken
    + JDK-8218458: [TESTBUG] runtime/NMT/
    /CheckForProperDetailStackTrace.java fails with Expected
    stack trace missing from output
    + JDK-8219142: Remove unused JIMAGE_ResourcePath
    + JDK-8219586: CodeHeap State Analytics processes dead nmethods
    + JDK-8220074: Clean up GCC 8.3 errors in LittleCMS
    + JDK-8220407: compiler/intrinsics/math/
    /TestFpMinMaxIntrinsics.java timedout
    + JDK-8222302: [TESTBUG] test/hotspot/jtreg/compiler/intrinsics/
    /sha/cli/TestUseSHAOptionOnUnsupportedCPU.java fails on any
    other CPU
    + JDK-8222412: AARCH64: multiple instructions encoding issues
    + JDK-8223020: aarch64: expand minI_rReg and maxI_rReg patterns
    into separate instructions
    + JDK-8223444: Improve CodeHeap Free Space Management
    + JDK-8223504: Improve performance of forall loops by better
    inlining of "iterator()" methods
    + JDK-8223667: ASAN build broken
    + JDK-8225081: Remove Telia Company CA certificate expiring in
    April 2021
    + JDK-8225116: Test OwnedWindowsLeak.java intermittently fails
    + JDK-8225438: javax/net/ssl/TLSCommon/
    /TestSessionLocalPrincipal.java failed with Read timed out
    + JDK-8225756: [testbug] compiler/loopstripmining/
    /CheckLoopStripMining.java sets too short a
    SafepointTimeoutDelay
    + JDK-8226374: Restrict TLS signature schemes and named groups
    + JDK-8226627: assert(t-&gt;singleton()) failed: must be a constant
    + JDK-8226721: Missing intrinsics for Math.ceil, floor, rint
    + JDK-8227080: (fs) Files.newInputStream(...).skip(n) is slow
    + JDK-8227222: vmTestbase/jit/FloatingPoint/gen_math/Loops04/
    /Loops04.java failed XMM register should be 0-15
    + JDK-8227609: (fs) Files.newInputStream(...).skip(n) should
    allow skipping beyond file size
    + JDK-8230428: Cleanup dead CastIP node code in formssel.cpp
    + JDK-8231460: Performance issue (CodeHeap) with large free
    blocks
    + JDK-8231713: x86_32 build failures after JDK-8226721 (Missing
    intrinsics for Math.ceil, floor, rint)
    + JDK-8231841: AArch64: debug.cpp help() is missing an AArch64
    line for pns
    + JDK-8232084: HotSpot build failed with GCC 9.2.1
    + JDK-8232591: AArch64: Add missing match rules for smaddl,
    smsubl and smnegl
    + JDK-8233185: HttpServer.stop() blocks indefinitely when
    called on dispatch thread
    + JDK-8233787: Break cycle in vm_version* includes
    + JDK-8233948: AArch64: Incorrect mapping between OptoReg and
    VMReg for high 64 bits of Vector Register
    + JDK-8234355: Buffer overflow in jcmd GC.class_stats due to
    too many classes
    + JDK-8235368: Update BCEL to Version 6.4.1
    + JDK-8236859: WebSocket over authenticating proxy fails with
    NPE
    + JDK-8236992: AArch64: remove redundant load_klass in itable
    stub
    + JDK-8237743: test/langtools/jdk/jshell/
    /FailOverExecutionControlTest.java fails No
    ExecutionControlProvider with name 'nonExistent' and parameter
    keys: []
    + JDK-8237804: sun/security/mscapi tests fail with "Key pair
    not generated, alias &lt;nnnnnn&gt; already exists"
    + JDK-8238175: CTW: Class.getDeclaredMethods fails with
    assert(k-&gt;is_subclass_of(SystemDictionary::Throwable_klass()))
    failed: invalid exception class
    + JDK-8238567: SoftMainMixer.processAudioBuffers(): Wrong
    handling of stoppedMixers
    + JDK-8238812: assert(false) failed: bad AD file
    + JDK-8239312: [macos] javax/swing/JFrame/NSTexturedJFrame/
    /NSTexturedJFrame.java
    + JDK-8239386: handle ContendedPaddingWidth in
    vm_version_aarch64
    + JDK-8239536: Can't use 'java.util.List' object after
    importing 'java.awt.List'
    + JDK-8240487: Cleanup whitespace in .cc, .hh, .m, and .mm files
    + JDK-8240848: ArrayIndexOutOfBoundsException buf for
    TextCallbackHandler
    + JDK-8241082: Upgrade IANA Language Subtag Registry data to
    03-16-2020 version
    + JDK-8241087: Build failure with VS 2019 (16.5.0) due to C2039
    and C2873
    + JDK-8241101: [s390] jtreg test failure after JDK-8238696: not
    conformant features string
    + JDK-8241248: NullPointerException in
    sun.security.ssl.HKDF.extract(HKDF.java:93)
    + JDK-8241372: Several test failures due to
    javax.net.ssl.SSLException: Connection reset
    + JDK-8241475: AArch64: Add missing support for PopCountVI node
    + JDK-8241829: Cleanup the code for PrinterJob on windows
    + JDK-8241960: The SHA3 message digests impl of SUN provider
    are not thread safe after cloned
    + JDK-8242010: Upgrade IANA Language Subtag Registry to Version
    2020-04-01
    + JDK-8242429: Better implementation for sign extract
    + JDK-8242557: Add length limit for strings in PNGImageWriter
    + JDK-8242919: Paste locks up jshell
    + JDK-8243155: AArch64: Add support for SqrtVF
    + JDK-8243240: AArch64: Add support for MulVB
    + JDK-8243452: JFR: Could not create chunk in repository with
    over 200 recordings
    + JDK-8243559: Remove root certificates with 1024-bit keys
    + JDK-8243597: AArch64: Add support for integer vector abs
    + JDK-8244031: HttpClient should have more tests for HEAD
    requests
    + JDK-8244205: HTTP/2 tunnel connections through proxy may be
    reused regardless of which proxy is selected
    + JDK-8244847: Linux/PPC: runtime/CompressedOops/
    /CompressedClassPointers: smallHeapTest fails
    + JDK-8245511: G1 adaptive IHOP does not account for
    reclamation of humongous objects by young GC
    + JDK-8246274: G1 old gen allocation tracking is not in a
    separate class
    + JDK-8247354: [aarch64] PopFrame causes
    assert(oopDesc::is_oop(obj)) failed: not an oop
    + JDK-8247408: IdealGraph bit check expression canonicalization
    + JDK-8247432: Update IANA Language Subtag Registry to Version
    2020-09-29
    + JDK-8247438: JShell: When FailOverExecutionControlProvider
    fails the proximal cause is not shown
    + JDK-8247753: UIManager.getSytemLookAndFeelClassName() returns
    wrong value on Fedora 32
    + JDK-8248043: Need to eliminate excessive i2l conversions
    + JDK-8248411: [aarch64] Insufficient error handling when
    CodeBuffer is exhausted
    + JDK-8248568: compiler/c2/TestBit.java failed: test missing
    from stdout/stderr
    + JDK-8248870: AARCH64: I2L/L2I conversions can be skipped for
    masked positive values
    + JDK-8249142: java/awt/FontClass/CreateFont/DeleteFont.sh is
    unstable
    + JDK-8249189: AARCH64: more L2I conversions can be skipped
    + JDK-8249719: MethodHandle performance suffers from bad
    ResolvedMethodTable hash function
    + JDK-8249875: GCC 10 warnings -Wtype-limits with JFR code
    + JDK-8250635: MethodArityHistogram should use Compile_lock in
    favour of fancy checks
    + JDK-8250876: Fix issues with cross-compile on macos
    + JDK-8251031: Some vmTestbase/nsk/monitoring/RuntimeMXBean
    tests fail with hostnames starting from digits
    + JDK-8251525: AARCH64: Faster Math.signum(fp)
    + JDK-8252259: AArch64: Adjust default value of FLOATPRESSURE
    + JDK-8252311: AArch64: save two words in itable lookup stub
    + JDK-8252779: compiler/graalunit/HotspotTest.java failed after
    8251525
    + JDK-8252883: AccessDeniedException caused by delayed file
    deletion on Windows
    + JDK-8253167: ARM32 builds fail after JDK-8247910
    + JDK-8253572: [windows] CDS archive may fail to open with long
    file names
    + JDK-8253923: C2 doesn't always run loop opts for compilations
    that include loops
    + JDK-8253948: Memory leak in ImageFileReader
    + JDK-8254631: Better support ALPN byte wire values in SunJSSE
    + JDK-8254717: isAssignableFrom checks in
    KeyFactorySpi.engineGetKeySpec appear to be backwards
    + JDK-8255086: Update the root locale display names
    + JDK-8255625: AArch64: Implement Base64.encodeBlock
    accelerator/intrinsic
    + JDK-8255763: C2: OSR miscompilation caused by invalid memory
    instruction placement
    + JDK-8255992: JFR EventWriter does not use first string from
    StringPool with id 0
    + JDK-8256037: [TESTBUG] com/sun/jndi/dns/ConfigTests/
    /PortUnreachable.java fails due to the hard coded threshold
    is small
    + JDK-8256244: java/lang/ProcessHandle/PermissionTest.java
    fails with TestNG 7.1
    + JDK-8256287: [windows] add loop fuse to
    map_or_reserve_memory_aligned
    + JDK-8256523: Streamline Java SHA2 implementation
    + JDK-8257414: Drag n Drop target area is wrong on high DPI
    systems
    + JDK-8257569: Failure observed with
    JfrVirtualMemory::initialize
    + JDK-8257574: C2: "failed: parsing found no loops but there
    are some" assert failure
    + JDK-8257580: Bump update version for OpenJDK: jdk-11.0.12
    + JDK-8257604: JNI_ArgumentPusherVaArg leaks valist
    + JDK-8257621: JFR StringPool misses cached items across
    consecutive recordings
    + JDK-8257796: [TESTBUG]
    TestUseSHA512IntrinsicsOptionOnSupportedCPU.java fails
    on x86_32
    + JDK-8257822: C2 crashes with SIGFPE due to a division that
    floats above its zero check
    + JDK-8257828: SafeFetch may crash if invoked in non-JavaThreads
    + JDK-8257853: Remove dependencies on JNF's JNI utility
    functions in AWT and 2D code
    + JDK-8257858: [macOS]: Remove JNF dependency from
    libosxsecurity/KeystoreImpl.m
    + JDK-8257860: [macOS]: Remove JNF dependency from
    libosxkrb5/SCDynamicStoreConfig.m
    + JDK-8257988: Remove JNF dependency from
    libsaproc/MacosxDebuggerLocal.m
    + JDK-8258414: OldObjectSample events too expensive
    + JDK-8258505: [TESTBUG] TestDivZeroWithSplitIf.java fails due
    to missing UnlockDiagnosticVMOptions
    + JDK-8258753: StartTlsResponse.close() hangs due to
    synchronization issues
    + JDK-8259061: C2: assert(found) failed: memory-writing node is
    not placed in its original loop or an ancestor of it
    + JDK-8259227: C2 crashes with SIGFPE due to a division that
    floats above its zero check
    + JDK-8259232: Bad JNI lookup during printing
    + JDK-8259276: C2: Empty expression stack when reexecuting
    tableswitch/lookupswitch instructions after deoptimization
    + JDK-8259343: [macOS] Update JNI error handling in Cocoa code.
    + JDK-8259585: Accessible actions do not work on mac os x
    + JDK-8259651: [macOS] Replace JNF_COCOA_ENTER/EXIT macros
    + JDK-8259662: Don't wrap SocketExceptions into SSLExceptions
    in SSLSocketImpl
    + JDK-8259710: Inlining trace leaks memory
    + JDK-8259729: Missed JNFInstanceOf -&gt; IsInstanceOf conversion
    + JDK-8259777: Incorrect predication condition generated by ADLC
    + JDK-8259786: initialize last parameter of getpwuid_r
    + JDK-8259843: initialize dli_fname array before calling
    dll_address_to_library_name
    + JDK-8259869: [macOS] Remove desktop module dependencies on
    JNF Reference APIs
    + JDK-8259886: Improve SSL session cache performance and
    scalability
    + JDK-8259983: do not use uninitialized expand_ms value in
    G1CollectedHeap::expand_heap_after_young_collection
    + JDK-8260030: Improve stringStream buffer handling
    + JDK-8260236: better init AnnotationCollector _contended_group
    + JDK-8260255: C1: LoopInvariantCodeMotion constructor can
    leave some fields uninitialized
    + JDK-8260284: C2: assert(_base == Int) failed: Not an Int
    + JDK-8260380: Upgrade to LittleCMS 2.12
    + JDK-8260420: C2 compilation fails with assert(found_sfpt)
    failed: no node in loop that's not input to safepoint
    + JDK-8260426: awt debug_mem.c DMem_AllocateBlock might leak
    memory
    + JDK-8260432: allocateSpaceForGP in freetypeScaler.c might
    leak memory
    + JDK-8260616: Removing remaining JNF dependencies in the
    java.desktop module
    + JDK-8260653: Unreachable nodes keep speculative types alive
    + JDK-8260707: java/lang/instrument/PremainClass/
    /InheritAgent0100.java times out
    + JDK-8260925: HttpsURLConnection does not work  with other
    JSSE provider.
    + JDK-8260926: Trace resource exhausted events unconditionally
    + JDK-8261020: Wrong format parameter in
    create_emergency_chunk_path
    + JDK-8261027: AArch64: Support for LSE atomics C++ HotSpot code
    + JDK-8261167: print_process_memory_info add a close call after
    fopen
    + JDK-8261170: Upgrade to freetype 2.10.4
    + JDK-8261198: [macOS] Incorrect JNI parameters in number
    conversion in A11Y code
    + JDK-8261235: C1 compilation fails with
    assert(res-&gt;vreg_number() == index) failed: conversion check
    + JDK-8261261: The version extra fields needs to be overridable
    in jib-profiles.js
    + JDK-8261262: Kitchensink24HStress.java crashed with
    EXCEPTION_ACCESS_VIOLATION
    + JDK-8261354: SIGSEGV at MethodIteratorHost
    + JDK-8261355: No data buffering in SunPKCS11 Cipher encryption
    when the underlying mechanism has no padding
    + JDK-8261397: try catch Method failing to work when dividing
    an integer by 0
    + JDK-8261422: Adjust problematic String.format calls in
    jdk/internal/util/Preconditions.java outOfBoundsMessage
    + JDK-8261447: MethodInvocationCounters frequently run into
    overflow
    + JDK-8261481: Cannot read Kerberos settings in dynamic store
    on macOS Big Sur
    + JDK-8261505: Test test/hotspot/jtreg/gc/parallel/
    /TestDynShrinkHeap.java killed by Linux OOM Killer
    + JDK-8261601: free memory in early return in
    Java_sun_nio_ch_sctp_SctpChannelImpl_receive0
    + JDK-8261649: AArch64: Optimize LSE atomics in C++ code
    + JDK-8261730: C2 compilation fails with
    assert(store-&gt;find_edge(load) != -1) failed: missing
    precedence edge
    + JDK-8261752: Multiple GC test are missing memory requirements
    + JDK-8261791: (sctp) handleSendFailed in SctpChannelImpl.c
    potential leaks
    + JDK-8261812: C2 compilation fails with assert(!had_error)
    failed: bad dominance
    + JDK-8261914: IfNode::fold_compares_helper faces
    non-canonicalized bool when running JRuby JSON workload
    + JDK-8262093: java/util/concurrent/tck/JSR166TestCase.java
    failed "assert(false) failed: unexpected node"
    + JDK-8262110: DST starts from incorrect time in 2038
    + JDK-8262121: [11u] Redo 8244287: JFR: Methods samples have
    line number 0
    + JDK-8262163: Extend settings printout in jcmd VM.metaspace
    + JDK-8262295: C2: Out-of-Bounds Array Load from Clone Source
    + JDK-8262298: G1BarrierSetC2::step_over_gc_barrier fails with
    assert "bad barrier shape"
    + JDK-8262446: DragAndDrop hangs on Windows
    + JDK-8262461: handle wcstombsdmp return value correctly in
    unix awt_InputMethod.c
    + JDK-8262465: Very long compilation times and high memory
    consumption in C2 debug builds
    + JDK-8262726: AArch64: C1 StubAssembler::call_RT can corrupt
    stack
    + JDK-8262739: String inflation C2 intrinsic prevents insertion
    of anti-dependencies
    + JDK-8262829: Native crash in
    Win32PrintServiceLookup.getAllPrinterNames()
    + JDK-8262837: handle split_USE correctly
    + JDK-8262900: ToolBasicTest fails to access HTTP server it
    starts
    + JDK-8263260: [s390] Support latest hardware (z14 and z15)
    + JDK-8263311: Watch registry changes for remote printers
    update instead of polling
    + JDK-8263361: Incorrect arraycopy stub selected by C2 for SATB
    collectors
    + JDK-8263404: RsaPrivateKeySpec is always recognized as
    RSAPrivateCrtKeySpec in RSAKeyFactory.engineGetKeySpec
    + JDK-8263425: AArch64: two potential bugs in C1
    LIRGenerator::generate_address()
    + JDK-8263448: CTW: fatal error: meet not symmetric
    + JDK-8263504: Some OutputMachOpcodes fields are uninitialized
    + JDK-8263557: Possible NULL dereference in
    Arena::destruct_contents()
    + JDK-8263558: Possible NULL dereference in fast path arena
    free if ZapResourceArea is true
    + JDK-8263676: AArch64: one potential bug in C1
    LIRGenerator::generate_address()
    + JDK-8263729: [test] divert spurious output away from stream
    under test in ProcessBuilder Basic test
    + JDK-8263846: Bad JNI lookup getFocusOwner in accessibility
    code on Mac OS X
    + JDK-8264047: Duplicate global variable 'jvm' in libjavajpeg
    and libawt
    + JDK-8264096: slowdebug jvm crashes when StrInflatedCopy match
    rule is not supported
    + JDK-8264151: ciMethod::ensure_method_data() should return
    false is loading resulted in empty state
    + JDK-8264173: [s390] Improve Hardware Feature Detection And
    Reporting
    + JDK-8264190: Harden TLS interop tests
    + JDK-8264223: CodeHeap::verify fails extra_hops assertion in
    fastdebug test
    + JDK-8264328: Broken license in
    javax/swing/JComboBox/8072767/bug8072767.java
    + JDK-8264360: Loop strip mining verification fails with
    "should be on the backedge"
    + JDK-8264626: C1 should be able to inline excluded methods
    + JDK-8264640: CMS ParScanClosure misses a barrier
    + JDK-8264786: [macos] All Swing/AWT apps cause Allow
    Notifications prompt to appear when app is launched
    + JDK-8264821: DirectIOTest fails on a system with large block
    size
    + JDK-8264848: [macos] libjvm.dylib linker warning due to macOS
    version mismatch
    + JDK-8264923: PNGImageWriter.write_zTXt throws Exception with
    a typo
    + JDK-8264958: C2 compilation fails with assert "n is later
    than its clone"
    + JDK-8265099: Revert backport to 11u of 8236859: WebSocket
    over authenticating proxy fails with NPE
    + JDK-8265154: vinserti128 operand mix up for KNL platforms
    + JDK-8265239: Shenandoah: Shenandoah heap region count could
    be off by 1
    + JDK-8265417: Backport of JDK-8249672 breaks Solaris x86 build
    + JDK-8265421: java/lang/String/StringRepeat.java test is
    missing a memory requirement
    + JDK-8265462: Handle multiple slots in the NSS Internal Module
    from SunPKCS11's Secmod
    + JDK-8265537: x86 version string truncated after JDK-8249672
    11u backport
    + JDK-8265666: Enable AIX build platform to make external debug
    symbols
    + JDK-8265677: CMS: CardTableBarrierSet::write_ref_array_work()
    lacks storestore barrier
    + JDK-8265690: Use the latest Ubuntu base image version in
    Docker testing
    + JDK-8265718: Build failure after JDK-8258414 11u backport
    + JDK-8265750: Fatal error in safepoint.cpp after backport of
    8258414
    + JDK-8265784: [C2] Hoisting of DecodeN leaves MachTemp inputs
    behind
    + JDK-8265938: C2's conditional move optimization does not
    handle top Phi
    + JDK-8266220: keytool still prompt for store password on a
    password-less pkcs12 file if -storetype pkcs12 is specified
    + JDK-8266293: Key protection using PBEWithMD5AndDES fails with
    "java.security.InvalidAlgorithmParameterException: Salt must
    be 8 bytes long"
    + JDK-8266713: [AIX] Build failure after 11u backport of
    JDK-8247753
    + JDK-8266802: Shenandoah: Round up region size to page size
    unconditionally
    + JDK-8266892: avoid maybe-uninitialized gcc warnings on linux
    s390x
    + JDK-8266929: Unable to use algorithms from 3p providers
    + JDK-8267235: [macos_aarch64]
    InterpreterRuntime::throw_pending_exception messing up LR
    results in crash
    + JDK-8267561: Shenandoah: Reference processing not properly
    setup for outside of cycle degenerated GC
    + JDK-8267599: Revert the change to the default PKCS12
    macAlgorithm and macIterationCount props for 11u/8u/7u
    + JDK-8267641: [11u] 8227609 backport typo
    + JDK-8267721: Enable sun/security/pkcs11 tests for Amazon
    Linux 2 AArch64
    + JDK-8268678: LetsEncryptCA.java test fails as Let's Encrypt
    Authority X3 is retired</changelog>
  <changelog author="schwab@suse.de" date="1628078400">- riscv64-zero.patch: Add support for riscv64 (zero VM)</changelog>
  <changelog author="fstrba@suse.com" date="1629979200">- Added patch:
  * jdk11-glibc234.patch
    + fix build with glibc-2.34 (bsc#1189201)</changelog>
  <changelog author="fstrba@suse.com" date="1631534400">- Modified patch:
  * nss-security-provider.patch
    + revert recent changes making NSS provider the default one
    + fixes bsc#1190252</changelog>
  <changelog author="fstrba@suse.com" date="1631793600">- Added patch:
  * fips.patch
    + implement FIPS support in OpenJDK</changelog>
  <changelog author="fstrba@suse.com" date="1634817600">- Update to upstream tag jdk-11.0.13+8 (October 2021 CPU)
  * Security fixes
    + JDK-8163326, CVE-2021-35550, bsc#1191901: Update the default
    enabled cipher suites preference
    + JDK-8254967, CVE-2021-35565, bsc#1191909:
    com.sun.net.HttpsServer spins on TLS session close
    + JDK-8263314: Enhance XML Dsig modes
    + JDK-8265167, CVE-2021-35556, bsc#1191910: Richer Text Editors
    + JDK-8265574: Improve handling of sheets
    + JDK-8265580, CVE-2021-35559, bsc#1191911: Enhanced style for
    RTF kit
    + JDK-8265776: Improve Stream handling for SSL
    + JDK-8266097, CVE-2021-35561, bsc#1191912: Better hashing
    support
    + JDK-8266103: Better specified spec values
    + JDK-8266109: More Resilient Classloading
    + JDK-8266115: More Manifest Jar Loading
    + JDK-8266137, CVE-2021-35564, bsc#1191913: Improve Keystore
    integrity
    + JDK-8266689, CVE-2021-35567, bsc#1191903: More Constrained
    Delegation
    + JDK-8267086: ArrayIndexOutOfBoundsException in
    java.security.KeyFactory.generatePublic
    + JDK-8267712: Better LDAP reference processing
    + JDK-8267729, CVE-2021-35578, bsc#1191904: Improve TLS client
    handshaking
    + JDK-8267735, CVE-2021-35586, bsc#1191914: Better BMP support
    + JDK-8268193: Improve requests of certificates
    + JDK-8268199: Correct certificate requests
    + JDK-8268205: Enhance DTLS client handshake
    + JDK-8268506: More Manifest Digests
    + JDK-8269618, CVE-2021-35603, bsc#1191906: Better session
    identification
    + JDK-8269624: Enhance method selection support
    + JDK-8270398: Enhance canonicalization
    + JDK-8270404: Better canonicalization
  * Other changes
    + JDK-8024368: private methods are allocated vtable indices
    + JDK-8042902: Test java/net/Inet6Address/serialize/
    /Inet6AddressSerializationTest.java fails intermittently
    + JDK-8140466: ChaCha20 and Poly1305 TLS Cipher Suites
    + JDK-8157404: Unable to read certain PKCS12 keystores from
    SequenceInputStream
    + JDK-8158066: SourceDebugExtensionTest fails to rename file
    + JDK-8168304: Make all of DependencyContext_test available in
    product mode
    + JDK-8169246: java/net/DatagramSocket/ReportSocketClosed.java
    fails intermittently with BindException
    + JDK-8181313: SA: Remove libthread_db dependency on Linux
    + JDK-8193214: Incorrect annotations.without.processors
    warnings with JDK 9
    + JDK-8194230: jdk/internal/jrtfs/remote/
    /RemoteRuntimeImageTest.java fails with
    java.lang.NullPointerException
    + JDK-8196092: javax/swing/JComboBox/8032878/bug8032878.java
    fails
    + JDK-8199931: java/net/MulticastSocket/
    /UnreferencedMulticastSockets.java fails with "incorrect data
    received"
    + JDK-8206083: Make tools/javac/api/T6265137.java robust to JDK
    version changes
    + JDK-8206350: java/util/Locale/bcp47u/SystemPropertyTests.java
    failed on Mac 10.13 with zh_CN and zh_TW locales.
    + JDK-8207316: java/nio/channels/spi/SelectorProvider/
    /inheritedChannel/InheritedChannelTest.java failed
    + JDK-8208227: tools/jdeps/DotFileTest.java fails on Win-X64
    + JDK-8208363: test/jdk/java/lang/Package/
    /PackageFromManifest.java missing module dependencies
    declaration
    + JDK-8209380: ARM: cleanup maybe-uninitialized and reorder
    compiler warnings
    + JDK-8209768: Refactor java/util/prefs/CheckUserPrefsStorage.sh
    to plain java test
    + JDK-8209772: Refactor shell test java/util/ServiceLoader/
    /basic/basic.sh to java
    + JDK-8209773: Refactor shell test javax/naming/module/basic.sh
    to java
    + JDK-8209832: Refactor jdk/internal/reflect/Reflection/
    /GetCallerClassTest.sh to plain java test
    + JDK-8209930: Refactor java/util/zip/ZipFile/deletetempjar.sh
    to plain java test
    + JDK-8210406: Refactor java.util.PluggableLocale:i18n shell
    tests to plain java tests
    + JDK-8210407: Refactor java.util.Calendar:i18n shell tests to
    plain java tests
    + JDK-8210495: compiler crashes because of illegal signature in
    otherwise legal code
    + JDK-8210669: Some launcher tests assume a pre-JDK 9 run-time
    image layout
    + JDK-8210802: temp files left by tests in
    jdk/java/net/httpclient
    + JDK-8210819: Update the host name in CNameTest.java
    + JDK-8210908: Refactor java/util/prefs/PrefsSpi.sh to plain
    java test
    + JDK-8210934: Move sun/net/www/protocol/http/
    /GetErrorStream.java to OpenJDK
    + JDK-8210959: JShell fails and exits when statement throws an
    exception whose message contains a '%'.
    + JDK-8211055: Provide print to a file (PDF) feature even when
    printer was not connected
    + JDK-8211092: test/jdk/sun/net/www/http/HttpClient/
    /MultiThreadTest.java fails intermittently when cleaning up
    + JDK-8211296: Remove HotSpot deprecation warning suppression
    for Mac/clang
    + JDK-8211325: test/jdk/java/net/Socket/LingerTest.java fails
    with cleaning up
    + JDK-8212040: Compilation error due to wrong usage of
    NSPrintJobDispositionValue in mac10.12
    + JDK-8212695: Add explicit timeout to several HTTP Client tests
    + JDK-8212718: Refactor some annotation processor tests to
    better use collections
    + JDK-8213007: Update the link in test/jdk/sun/security/
    /provider/SecureRandom/DrbgCavp.java
    + JDK-8213137: Remove static initialization of monitor/mutex
    instances
    + JDK-8213235: java/nio/channels/SocketChannel/
    /AsyncCloseChannel.java fails with threads that didn't exit
    + JDK-8213409: Refactor sun.text.IntHashtable:i18n shell tests
    to plain java tests
    + JDK-8213576: Make test AsyncCloseChannel.java run in othervm
    + JDK-8213694: Test Timeout.java should run in othervm mode
    + JDK-8213718: [TEST] Wrong classname in vmTestbase/nsk/stress/
    /except/except002 and except003
    + JDK-8213922: fix ctw stand-alone build
    + JDK-8214195: Align stdout messages in
    test/jdk/java/math/BigInteger/PrimitiveConversionTests.java
    + JDK-8214520: [TEST_BUG] sun/security/mscapi/nonUniqueAliases/
    /NonUniqueAliases.java failed with incorrect jtreg tags order
    + JDK-8214937: sun/security/tools/jarsigner/warnings/
    /NoTimestampTest.java failed due to unexpected expiration date
    + JDK-8216532: tools/launcher/Test7029048.java fails (Solaris)
    + JDK-8217825: Verify @AfterTest is used correctly in WebSocket
    tests
    + JDK-8218145: block_if_requested is not proper inlined due to
    size
    + JDK-8219417: bump jtreg requiredVersion to b14
    + JDK-8219552: bump jtreg requiredVersion to b14 in
    test/jdk/sanity/client/
    + JDK-8219804: java/net/MulticastSocket/Promiscuous.java fails
    intermittently due to NumberFormatException
    + JDK-8220445: Support for side by side MSVC Toolset versions
    + JDK-8221988: add possibility to build with Visual Studio 2019
    + JDK-8222751: closed/test/jdk/sun/security/util/
    /DerIndefLenConverter/IndefBerPkcs12.java fail
    + JDK-8223050: JVMCI: findUniqueConcreteMethod() should not use
    Dependencies::find_unique_concrete_method() for non-virtual
    methods
    + JDK-8224853: CDS address sanitizer errors
    + JDK-8225082: Remove IdenTrust certificate that is expiring in
    September 2021
    + JDK-8225583: Examine the HttpResponse.BodySubscribers for
    null handling and multiple subscriptions
    + JDK-8225690: Multiple AttachListener threads can be created
    + JDK-8225790: Two NestedDialogs tests fail on Ubuntu
    + JDK-8226319: Add forgotten test/jdk/java/net/httpclient/
    /BodySubscribersTest.java
    + JDK-8226533: JVMCI: findUniqueConcreteMethod should handle
    statically bindable methods directly
    + JDK-8226602: Test convenience reactive primitives from
    java.net.http with RS TCK
    + JDK-8226683: Remove review suggestion from fix to 8219804
    + JDK-8227738: jvmti/DataDumpRequest/datadumpreq001 failed due
    to "exit code is 134"
    + JDK-8227766: CheckUnhandledOops is broken in MemAllocator
    + JDK-8227815: Minimal VM: set_state is not a member of
    AttachListener
    + JDK-8230674: Heap dumps should exclude dormant CDS archived
    objects of unloaded classes
    + JDK-8230808: Remove Access::equals()
    + JDK-8230841: Remove oopDesc::equals()
    + JDK-8231717: Improve performance of charset decoding when
    charset is always compactable
    + JDK-8232243: Wrong caret position in JTextPane on Windows
    with a screen resolution &gt; 100%
    + JDK-8232782: Shenandoah: streamline post-LRB CAS barrier
    (aarch64)
    + JDK-8233790: Forward output from heap dumper to jcmd/jmap
    + JDK-8233989: Create an IPv4 version of
    java/net/MulticastSocket/SetLoopbackMode.java
    + JDK-8234510: Remove file seeking requirement for writing a
    heap dump
    + JDK-8235211: serviceability/attach/
    /RemovingUnixDomainSocketTest.java fails with
    AttachNotSupportedException: Unable to open socket file
    + JDK-8235216: typo in test filename
    + JDK-8235866: bump jtreg requiredVersion to 4.2b16
    + JDK-8236111: narrow allowSmartActionArgs disabling
    + JDK-8236413: AbstractConnectTimeout should tolerate both
    NoRouteToHostException and UnresolvedAddressException
    + JDK-8236671: NullPointerException in JKS keystore
    + JDK-8238930: problem list compiler/c2/Test8004741.java
    + JDK-8238943: switch to jtreg 5.0
    + JDK-8240555: Using env of JAVA_TOOL_OPTIONS and _JAVA_OPTIONS
    breaks QuietOption.java test
    + JDK-8240983: Incorrect copyright header in Apache Santuario
    2.1.3 files
    + JDK-8241336: Some java.net tests failed with
    NoRouteToHostException on MacOS with special network
    configuration
    + JDK-8241353: NPE in ToolProvider.getSystemJavaCompiler
    + JDK-8241768: git needs .gitattributes
    + JDK-8242882: opening jar file with large manifest might throw
    NegativeArraySizeException
    + JDK-8244973: serviceability/attach/
    /RemovingUnixDomainSocketTest.java fails "stderr was not
    empty"
    + JDK-8245134: test/lib/jdk/test/lib/security/
    /KeyStoreUtils.java should allow to specify aliases
    + JDK-8246261: TCKLocalTime.java failed due to "AssertionError:
    expected [18:14:22] but found [18:14:23]"
    + JDK-8246387: switch to jtreg 5.1
    + JDK-8247421: [TESTBUG] ReturnBlobToWrongHeapTest.java failed
    allocating blob
    + JDK-8247469: getSystemCpuLoad() returns -1 on linux when some
    offline cpus are present and cpusets.effective_cpus is not
    available
    + JDK-8248352: [TEST_BUG] Test test/jdk/java/awt/font/
    /TextLayout/ArabicDiacriticTest.java can leave frame open
    + JDK-8248403: AArch64: Remove uses of kernel integer types
    + JDK-8248414: AArch64: Remove uses of long and unsigned long
    ints
    + JDK-8248657: Windows: strengthening in ThreadCritical
    regarding memory model
    + JDK-8248666: AArch64: Use THREAD_LOCAL instead of __thread
    + JDK-8248668: AArch64: Avoid MIN/MAX macros when using MSVC
    + JDK-8248671: AArch64: Remove unused variables
    + JDK-8248682: AArch64: Use ATTRIBUTE_ALIGNED helper
    + JDK-8248816: C1: Fix signature conflict in
    LIRGenerator::strength_reduce_multiply
    + JDK-8249095: tools/javac/launcher/SourceLauncherTest.java
    fails on Windows
    + JDK-8249548: backward focus traversal gets stuck in button
    group
    + JDK-8249773: Upgrade ReceiveISA.java test to be resilient to
    failure due to stray packets and interference
    + JDK-8249897: jdk/javadoc/tool/LangVers.java uses @ignore w/o
    bug-id
    + JDK-8249898: jdk/javadoc/tool/6176978/T6176978.java uses
    @ignore w/o bug-id
    + JDK-8249899: jdk/javadoc/tool/InlineTagsWithBraces.java uses
    @ignore w/o bug-id
    + JDK-8250588: Shenandoah: LRB needs to save/restore fp
    registers for runtime call
    + JDK-8250824: AArch64: follow up for JDK-8248414
    + JDK-8251166: Add automated testcases for changes done in
    JDK-8214112
    + JDK-8251252: Add automated testcase for fix done in
    JDK-8214253
    + JDK-8251254: Add automated test for fix done in JDK-8218472
    + JDK-8251361: Potential race between Logger configuration and
    GCs in HttpURLConWithProxy test
    + JDK-8251549: Update docs on building for Git
    + JDK-8251945: SIGSEGV in
    PackageEntry::purge_qualified_exports()
    + JDK-8252194: Add automated test for fix done in JDK-8218469
    + JDK-8252648: Shenandoah: name gang tasks consistently
    + JDK-8252825: Add automated test for fix done in JDK-8218479
    + JDK-8252853: AArch64: gc/shenandoah/TestVerifyJCStress.java
    fails intermittently with C1
    + JDK-8252857: AArch64: Shenandoah C1 CAS is not sequentially
    consistent
    + JDK-8253048: AArch64: When CallLeaf, no need to preserve
    callee-saved registers in caller
    + JDK-8253424: Add support for running pre-submit testing using
    GitHub Actions
    + JDK-8253631: Remove unimplemented CompileBroker methods after
    JEP-165
    + JDK-8253865: Pre-submit testing using GitHub Actions does not
    detect failures reliably
    + JDK-8253899: Make IsClassUnloadingEnabled signature match
    specification
    + JDK-8254024: Enhance native libs for AWT and Swing to work
    with GraalVM Native Image
    + JDK-8254054: Pre-submit testing using GitHub Actions should
    not use the deprecated set-env command
    + JDK-8254173: Add Zero, Minimal hotspot targets to submit
    workflow
    + JDK-8254175: Build no-pch configuration in debug mode for
    submit checks
    + JDK-8254244: Some code emitted by TemplateTable::branch is
    unused when running TieredCompilation
    + JDK-8254270: linux 32 bit build doesn't compile
    libjdwp/log_messages.c
    + JDK-8254282: Add Linux x86_32 builds to submit workflow
    + JDK-8254850: Update terminology in java.awt.GridBagLayout
    source code comments
    + JDK-8255255: Update Apache Santuario (XML Signature) to
    version 2.2.1
    + JDK-8255305: Add Linux x86_32 tier1 to submit workflow
    + JDK-8255352: Archive important test outputs in submit workflow
    + JDK-8255373: Submit workflow artifact name is always
    "test-results_.zip"
    + JDK-8255452: Doing GC during JVMTI MethodExit event posting
    breaks return oop
    + JDK-8255718: Zero: VM should know it runs in interpreter-only
    mode
    + JDK-8255790: GTKL&amp;F: Java 16 crashes on initialising GTKL&amp;F
    on Manjaro Linux
    + JDK-8255810: Zero: build fails without JVMTI
    + JDK-8255895: Submit workflow artifacts miss hs_errs/replays
    due to ZIP include mismatch
    + JDK-8256127: Add cross-compiled foreign architectures builds
    to submit workflow
    + JDK-8256215: Shenandoah: re-organize saving/restoring machine
    state in assembler code
    + JDK-8256267: Relax compiler/floatingpoint/NaNTest.java for
    x86_32 and lower -XX:+UseSSE
    + JDK-8256277: Github Action build on macOS should define OS
    and Xcode versions
    + JDK-8256354: Github Action build on Windows should define OS
    and MSVC versions
    + JDK-8256393: Github Actions build on Linux should define OS
    and GCC versions
    + JDK-8256414: add optimized build to submit workflow
    + JDK-8256747: GitHub Actions: decouple the hotspot build-only
    jobs from Linux x64 testing
    + JDK-8257056: Submit workflow should apt-get update to avoid
    package installation errors
    + JDK-8257148: Remove obsolete code in AWTView.m
    + JDK-8257497: Update keytool to create AKID from the SKID of
    the issuing certificate as specified by RFC 5280
    + JDK-8257620: Do not use objc_msgSend_stret to get macOS
    version
    + JDK-8257913: Add more known library locations to simplify
    Linux cross-compilation
    + JDK-8258703: Incorrect 512-bit vector registers restore on
    x86_32
    + JDK-8259338: Add expiry exception for identrustdstx3 alias to
    VerifyCACerts.java test
    + JDK-8259535: ECDSA SignatureValue do not always have the
    specified length
    + JDK-8259679: GitHub actions should use MSVC 14.28
    + JDK-8259924: GitHub actions fail on Linux x86_32 with "Could
    not configure libc6:i386"
    + JDK-8260460: GitHub actions still fail on Linux x86_32 with
    "Could not configure libc6:i386"
    + JDK-8260589: Crash in JfrTraceIdLoadBarrier::load(_jclass*)
    + JDK-8260923: Add more tests for SSLSocket input/output
    shutdown
    + JDK-8261072: AArch64: Fix MacroAssembler::get_thread
    convention
    + JDK-8261147: C2: Node is wrongly marked as reduction
    resulting in a wrong execution due to wrong vector instructions
    + JDK-8261238: NMT should not limit baselining by size threshold
    + JDK-8261496: Shenandoah: reconsider pacing updates memory
    ordering
    + JDK-8261652: Remove some dead comments from os_bsd_x86
    + JDK-8261846: [JVMCI] c2v_iterateFrames can get out of sync
    with the StackFrameStream
    + JDK-8262000: jdk/jfr/event/gc/detailed/
    /TestPromotionFailedEventWithParallelScavenge.java failed with
    "OutOfMemoryError: Java heap space"
    + JDK-8262017: C2: assert(n != __null) failed: Bad immediate
    dominator info.
    + JDK-8262392: Update Mesa 3-D Headers to version 21.0.3
    + JDK-8262409: sun/security/ssl/SSLSocketImpl/
    /SSLSocketImplThrowsWrongExceptions. SSL test failures caused
    by java failed with "Server reported the wrong exception"
    + JDK-8262470: Printed GlyphVector outline with low DPI has bad
    quality on Windows
    + JDK-8262862: Harden tests sun/security/x509/URICertStore/
    /ExtensionsWithLDAP.java and krb5/canonicalize/Test.java
    + JDK-8263136: C4530 was reported from VS 2019 at access bridge
    + JDK-8263227: C2: inconsistent spilling due to dead nodes in
    exception block
    + JDK-8263382: java/util/logging/ParentLoggersTest.java failed
    with "checkLoggers: getLoggerNames() returned unexpected
    loggers"
    + JDK-8263407: SPARC64 detection fails on Athena (SPARC64-X)
    + JDK-8263432: javac may report an invalid package/class clash
    on case insensitive filesystems
    + JDK-8263490: [macos] Crash occurs on JPasswordField with
    activated InputMethod
    + JDK-8263531: Remove unused buffer int
    + JDK-8263667: Avoid running GitHub actions on branches named
    pr/*
    + JDK-8263776: [JVMCI] add helper to perform Java upcalls
    + JDK-8264016: [JVMCI] add some thread local fields for use by
    JVMCI
    + JDK-8264752: SIGFPE crash with option
    FlightRecorderOptions:threadbuffersize=30M
    + JDK-8265132: C2 compilation fails with assert "missing
    precedence edge"
    + JDK-8265231: (fc) ReadDirect and WriteDirect tests fail after
    fix for JDK-8264821
    + JDK-8265335: Epsilon: Minor typo in EpsilonElasticTLABDecay
    description
    + JDK-8265756: AArch64: initialize memory allocated for locals
    according to Windows AArch64 stack page growth requirement in
    template interpreter
    + JDK-8265761: Font with missed font family name is not
    properly printed on Windows
    + JDK-8265773: incorrect jdeps message "jdk8internals" to
    describe a removed JDK internal API
    + JDK-8265836: OperatingSystemImpl.getCpuLoad() returns
    incorrect CPU load inside a container
    + JDK-8266018: Shenandoah: fix an incorrect assert
    + JDK-8266206: Build failure after JDK-8264752 with older GCCs
    + JDK-8266248: Compilation failure in
    PLATFORM_API_MacOSX_MidiUtils.c with Xcode 12.5
    + JDK-8266288: assert root method not found in
    witnessed_reabstraction_in_supers is too strong
    + JDK-8266404: Fatal error report generated with
  - XX:+CrashOnOutOfMemoryError should not contain suggestion to
    submit a bug report
    + JDK-8266480: Implicit null check optimization does not update
    control of hoisted memory operation
    + JDK-8266615: C2 incorrectly folds subtype checks involving an
    interface array
    + JDK-8266642: Improve ResolvedMethodTable hash function
    + JDK-8266749: AArch64: Backtracing broken on PAC enabled
    systems
    + JDK-8266761: AssertionError in
    sun.net.httpserver.ServerImpl.responseCompleted
    + JDK-8266813: Shenandoah: Use shorter instruction sequence for
    checking if marking in progress
    + JDK-8267042: bug in monitor locking/unlocking on ARM32 C1 due
    to uninitialized BasicObjectLock::_displaced_header
    + JDK-8267348: Rewrite gc/epsilon/TestClasses.java to use
    Metaspace with less classes
    + JDK-8267396: Avoid recording "pc" in unhandled oops detector
    for better performance
    + JDK-8267399: C2: java/text/Normalizer/ConformanceTest.java
    test failed with assertion
    + JDK-8267424: CTW: C1 fails with "State must not be null"
    + JDK-8267459: Pasting Unicode characters into JShell does not
    work.
    + JDK-8267625: AARCH64: typo in LIR_Assembler::emit_profile_type
    + JDK-8267666: Add option to jcmd GC.heap_dump to use existing
    file
    + JDK-8267695: Bump update version for OpenJDK: jdk-11.0.13
    + JDK-8267751: (test) jtreg.SkippedException has no serial
    VersionUID
    + JDK-8267773: PhaseStringOpts::int_stringSize doesn't handle
    min_jint correctly
    + JDK-8268103: JNI functions incorrectly return a double after
    JDK-8265836
    + JDK-8268127: Shenandoah: Heap size may be too small for
    region to align to large page size
    + JDK-8268261: C2: assert(n != __null) failed: Bad immediate
    dominator info.
    + JDK-8268347: C2: nested locks optimization may create
    unbalanced monitor enter/exit code
    + JDK-8268360: Missing check for infinite loop during node
    placement
    + JDK-8268362: [REDO] C2 crash when compile negative
    Arrays.copyOf length after loop
    + JDK-8268366: Incorrect calculation of has_fpu_registers in C1
    linear scan
    + JDK-8268369: SIGSEGV in PhaseCFG::implicit_null_check due to
    missing null check
    + JDK-8268417: Add test from JDK-8268360
    + JDK-8268427: Improve AlgorithmConstraints:checkAlgorithm
    performance
    + JDK-8268617: [11u REDO] - WebSocket over authenticating proxy
    fails with NPE
    + JDK-8268620: InfiniteLoopException test may fail on x86
    platforms
    + JDK-8268635: Corrupt oop in ClassLoaderData
    + JDK-8268699: Shenandoah: Add test for JDK-8268127
    + JDK-8268771: javadoc -notimestamp option does not work on
    index.html
    + JDK-8268775: Password is being converted to String in
    AccessibleJPasswordField
    + JDK-8268776: Test `ADatagramSocket.java` missing /othervm
    from @run tag
    + JDK-8268965: TCP Connection Reset when connecting simple
    socket to SSL server
    + JDK-8269304: Regression ~5% in 2005 in b27
    + JDK-8269415: [11u] Remove ea from
    DEFAULT_PROMOTED_VERSION_PRE in OpenJDK 11u
    + JDK-8269478: Shenandoah: gc/shenandoah/mxbeans tests should
    be more resilient
    + JDK-8269529: javax/swing/reliability/
    /HangDuringStaticInitialization.java fails in Windows debug
    build
    + JDK-8269594: assert(_handle_mark_nesting &gt; 1) failed: memory
    leak: allocating handle outside HandleMark
    + JDK-8269614: [s390] Interpreter checks wrong bit for slow
    path instance allocation
    + JDK-8269650: Optimize gc-locker in
    [Get|Release]StringCritical for latin string
    + JDK-8269661: JNI_GetStringCritical does not lock char array
    + JDK-8269668: [aarch64] java.library.path not including
    /usr/lib64
    + JDK-8269763: The JEditorPane is blank after JDK-8265167
    + JDK-8269795: C2: Out of bounds array load floats above its
    range check in loop peeling resulting in SEGV
    + JDK-8269847: JDK-8269594 backport breaks 11u builds
    + JDK-8269850: Most JDK releases report macOS version 12 as
    10.16 instead of 12.0
    + JDK-8269851: OperatingSystemMXBean getProcessCpuLoad reports
    incorrect process cpu usage in containers
    + JDK-8269882: stack-use-after-scope in NewObjectA
    + JDK-8269934: RunThese24H.java failed with
    EXCEPTION_ACCESS_VIOLATION in
    java_lang_Thread::get_thread_status
    + JDK-8270096: Shenandoah: Optimize gc/shenandoah/
    /TestRefprocSanity.java for interpreter mode
    + JDK-8270137: Kerberos Credential Retrieval from Cache not
    Working in Cross-Realm Setup
    + JDK-8270184: [TESTBUG] Add coverage for jvmci
    ResolvedJavaType.toJavaName() for lambdas
    + JDK-8270196: [11u] [JVMCI] JavaType.toJavaName() returns
    incorrect type name for lambdas
    + JDK-8270556: Exclude security/infra/java/security/cert/
    /CertPathValidator/certification/LetsEncryptCA
    + JDK-8270893: IndexOutOfBoundsException while reading large
    TIFF file
    + JDK-8272078: Wrong Checksums in Temurin BootJDK dependencies
    + JDK-8272124: Cgroup v1 initialization causes
    NullPointerException when cgroup path contains colon
    + JDK-8272131: PhaseMacroExpand::generate_slow_arraycopy crash
    when clone null CallProjections.fallthrough_ioproj
    + JDK-8272197: Update 11u GHA workflow with Shenandoah
    configurations
    + JDK-8272332: --with-harfbuzz=system doesn't add -lharfbuzz
    after JDK-8255790
    + JDK-8272472: StackGuardPages test doesn't build with glibc
    2.34
    + JDK-8272602: [macos] not all KEY_PRESSED events sent when
    control modifier is used
    + JDK-8272628: Problemlist gc/stress/gcbasher/
    /TestGCBasherWithCMS.java for x86_32
    + JDK-8272700: [macos] Build failure with Xcode 13.0 after
    JDK-8264848
    + JDK-8272772: Shenandoah: compiler/c2/aarch64/
    /TestVolatilesShenandoah.java fails in 11u
    + JDK-8273939: Backport of 8248414 to JDK11 breaks
    MacroAssembler::adrp
- Remove the unneeded icedtea-sound provider
- Removed patches:
  * icedtea-sound-1.0.1-jdk9.patch
  * icedtea-sound-soundproperties.patch
    + not needed since the icedtea-sound provider is removed
  * jdk11-glibc234.patch
    + integrated upstream</changelog>
  <changelog author="fstrba@suse.com" date="1635940800">- Modified patches:
  * system-crypto-policy.patch
    + rediff to changed context
  * fips.patch
    + Allow plain key import in fips mode unless
    com.suse.fips.plainKeySupport is set to false</changelog>
  <changelog author="fstrba@suse.com" date="1636113600">- Modified patch:
  * fips.patch
    + return in native code after generating java.io.IOException</changelog>
</package>
<package pkgid="764b138b651223b25976b254c63853acd6de7518e28d67f9007c42c2d92953da" name="java-11-openjdk-jmods" arch="ppc64le">
  <version epoch="0" ver="11.0.13.0" rel="3.68.1"/>
  <changelog author="fstrba@suse.com" date="1586952000">- The pack200 and unpack200 alternatives should be slaves of java
  and not of javac, since they are part of JRE.</changelog>
  <changelog author="fstrba@suse.com" date="1587470400">- Update to upstream tag jdk-11.0.7+10 (April 2020 CPU,
  bsc#1169511)
  * Security fixes:
    + S8223898, CVE-2020-2754: Forward references to Nashorn
    + S8223904, CVE-2020-2755: Improve Nashorn matching
    + S8224541, CVE-2020-2756: Better mapping of serial ENUMs
    + S8224549, CVE-2020-2757: Less Blocking Array Queues
    + S8225603: Enhancement for big integers
    + S8226346: Build better binary builders
    + S8227467: Better class method invocations
    + S8227542: Manifest improved jar headers
    + S8229733: TLS message handling improvements
    + S8231415, CVE-2020-2773: Better signatures in XML
    + S8231785: Improved socket permissions
    + S8232424, CVE-2020-2778: More constrained algorithms
    + S8232581, CVE-2020-2767: Improve TLS verification
    + S8233250: Better X11 rendering
    + S8233410: Better Build Scripting
    + S8234027: Better JCEKS key support
    + S8234408, CVE-2020-2781: Improve TLS session handling
    + S8234825, CVE-2020-2800: Better Headings for HTTP Servers
    + S8234841, CVE-2020-2803: Enhance buffering of byte buffers
    + S8235274, CVE-2020-2805: Enhance typing of methods
    + S8235691, CVE-2020-2816: Enhance TLS connectivity
    + S8236201, CVE-2020-2830: Better Scanner conversions
    + S8238960: linux-i586 builds are inconsistent as the newly
    built jdk is not able to reserve enough space for object heap
  * Other changes:
    + S4919790: Errors in alert ssl message does not reflect the
    actual certificate status
    + S4949105: Access Bridge lacks html tags parsing
    + S7092821: java.security.Provider.getService() is synchronized
    and became scalability bottleneck
    + S7143743: Potential memory leak with zip provider
    + S8005819: Support cross-realm MSSFU
    + S8042383: [TEST_BUG] Test javax/swing/plaf/basic/BasicMenuUI/
    /4983388/bug4983388.java fails with shortcuts on menus do not
    work
    + S8068184: Fix for JDK-8032832 caused a deadlock
    + S8145845: [AOT] NullPointerException in
    compiler/whitebox/GetCodeHeapEntriesTest.java
    + S8152988: [AOT] Update test batch definitions to include
    aot-ed java.base module mode into hs-comp testing
    + S8160926: FLAGS_COMPILER_CHECK_ARGUMENTS doesn't handle
    cross-compilation
    + S8163083: SocketListeningConnector does not allow invocations
    with port 0
    + S8163251: Hard coded loop limit prevents reading of smart
    card data greater than 8k
    + S8167276: jvmci/compilerToVM/MaterializeVirtualObjectTest.java
    fails with -XX:-EliminateAllocations
    + S8169718: nsk/jdb/locals/locals002: ERROR: Cannot find
    boolVar with expected value: false
    + S8176556:
    java/awt/dnd/ImageTransferTest/ImageTransferTest.java fails
    for JFIF
    + S8178798: Two compiler/aot/verification/vmflags tests fail by
    timeout with UseAVX=3
    + S8183107: PKCS11 regression regarding checkKeySize
    + S8185005: Improve performance of
    ThreadMXBean.getThreadInfo(long ids[], int maxDepth)
    + S8189633: Missing -Xcheck:jni checking for DeleteWeakGlobalRef
    + S8189861: Refactor CacheFind
    + S8193042: NativeLookup::lookup_critical_entry() should only
    load shared library once
    + S8193596: java/net/DatagramPacket/ReuseBuf.java failed due to
    timeout
    + S8194944: Regression automated test 'open/test/jdk/javax/
    /swing/JInternalFrame/8145896/TestJInternalFrameMaximize.java'
    fails
    + S8196467: javax/swing/JInternalFrame/Test6325652.java fails
    + S8196969: JTreg Failure: serviceability/sa/ClhsdbJstack.java
    causes NPE
    + S8198321: javax/swing/JEditorPane/5076514/bug5076514.java
    fails
    + S8198398: Test javax/swing/JColorChooser/Test6199676.java
    fails in mach5
    + S8199072: Test javax/swing/GroupLayout/6613904/
    /bug6613904.java is unstable
    + S8200432: javadoc fails with ClassCastException on {@link
    byte[]}
    + S8201349: build broken when configured with
  - -with-zlib=bundled on gcc 7.3
    + S8201355: Avoid native memory allocation in
    sun.security.mscapi.PRNG.generateSeed
    + S8201513: nsk/jvmti/IterateThroughHeap/filter-* are broken
    + S8203364: Some serviceability/sa/ tests intermittently fail
    with java.io.IOException: LingeredApp terminated with non-zero
    exit code 3
    + S8203687: javax/net/ssl/compatibility/Compatibility.java
    supports TLS 1.3
    + S8203904: javax/swing/JSplitPane/4816114/bug4816114.java: The
    divider location is wrong
    + S8203911: Test runtime/modules/getModuleJNI/GetModule fails
    with -Xcheck:jni
    + S8204525: [TESTBUG] runtime/NMT/MallocStressTest.java ran out
    of java heap
    + S8204529: gc/TestAllocateHeapAtMultiple.java fail with Agent
    7 timed out
    + S8204551: Event descriptions are truncated in logs
    + S8206963: [AOT] bug with multiple class loaders
    + S8207367: 10 vmTestbase/nsk/jdi tests timed out when running
    with jtreg
    + S8207832: serviceability/sa/ClhsdbCDSCore.java failed with
    "Couldn't find core file location"
    + S8207938: At step6,Click Add button,case failed automatically.
    + S8208157: requires.VMProps throws NPE for missing properties
    in "release" file
    + S8208379: compiler/jvmci/events/
    /JvmciNotifyInstallEventTest.java failed with "Got unexpected
    event count after 2nd install attempt: expected 9 to equal 2"
    + S8208658: Make CDS archived heap regions usable even if
    compressed oop encoding has changed
    + S8208715: Conversion of milliseconds to nanoseconds in
    UNIXProcess contains bug
    + S8209361: [AOT] Unexpected number of references for
    JVMTI_HEAP_REFERENCE_CONSTANT_POOL [111--&gt;111]: 0 (expected
    at least 1)
    + S8209385: CDS runtime classpath checking is too strict when
    only classes from the system modules are archived
    + S8209389: SIGSEGV in WalkOopAndArchiveClosure::do_oop_work.
    + S8209418: Synchronize test/jdk/sanity/client/lib/jemmy with
    code-tools/jemmy/v2
    + S8209494: Create a test for SwingSet InternalFrameDemo
    + S8209499: Create test for SwingSet EditorPaneDemo
    + S8209574: [AOT] breakpoint events are generated in different
    threads does not meet expected count
    + S8209686: cleanup arguments to PhaseIdealLoop() constructor
    + S8209789: Synchronize test/jdk/sanity/client/lib/jemmy with
    code-tools/jemmy/v2
    + S8209802: Garbage collectors should register JFR types
    themselves to avoid build errors.
    + S8209807: improve handling exception in requires.VMProps
    + S8209817: stack is executable when building with Clang on
    Linux
    + S8209824: Improve the code coverage for ThreadLocal
    + S8209826: Undefined reference to os::write after JDK-8209657
    (filemap.hpp cleanup)
    + S8209850: Allow NamedThreads to use GlobalCounter critical
    sections
    + S8209976: Improve iteration over non-JavaThreads
    + S8209993: Create a test for SwingSet3 ToolTipDemo
    + S8210024: JFR calls virtual is_Java_thread from ~Thread()
    + S8210052: Enable testing for all the available look and feels
    in SwingSet3 demo tests
    + S8210055: Enable different look and feel tests in SwingSet3
    demo tests
    + S8210057: Enable different look and feels in SwingSet3 demo
    test InternalFrameDemoTest
    + S8210058: Algorithmic Italic font leans opposite angle in
    Printing
    + S8210220: [AOT] jdwp test cases are failing with error #
    ERROR: TEST FAILED: Cought IOException while receiving event
    packet
    + S8210289: ArchivedKlassSubGraphInfoRecord is incomplete
    + S8210459: Add support for generating compile_commands.json
    + S8210476: sun/security/mscapi/PrngSlow.java fails with Still
    too slow
    + S8210512: [Testbug] vmTestbase/nsk/jdi/ObjectReference/
    /referringObjects/referringObjects002/referringObjects002.java
    fails with unexpected size of
    ClassLoaderReference.referringObjects
    + S8210523: runtime/appcds/cacheObject/DifferentHeapSizes.java
    crash
    + S8210632: Add key exchange algorithm to
    javax/net/ssl/TLSCommon/CipherSuite.java
    + S8210699: Problem list tests which times out in Xcomp mode
    + S8210793: [JVMCI] AllocateCompileIdTest.java failed to find
    DiagnosticCommand.class
    + S8210910: Create test for FileChooserDemo
    + S8210994: Create test for SwingSet3 FrameDemo
    + S8211139: Increase timeout value in all tests under
    jdk/sanity/client/SwingSet/src
    + S8211160: Handle different look and feels in
    JInternalFrameOperator
    + S8211211: vmTestbase/metaspace/stressDictionary/
    /StressDictionary.java timeout
    + S8211322: Reduce the timeout of tooltip in SwingSet2DemoTest
    + S8211443: Enable different look and feels in SwingSet3 demo
    test SplitPaneDemoTest
    + S8211703: JInternalFrame : java.lang.AssertionError: cannot
    find the internal frame
    + S8211781: re-building fails after changing Graal sources
    + S8212897: Some improvements in the EditorPaneDemotest
    + S8212903: [TestBug] Tests test/jdk/javax/swing/LookAndFeel/
    /8145547/DemandGTK2.sh and DemandGTK3.sh fail on Ubuntu 18.04
    LTS
    + S8213009: Refactoring existing SunMSCAPI classes
    + S8213010: Supporting keys created with certmgr.exe
    + S8213168: Enable different look and feel tests in SwingSet3
    demo test FileChooserDemoTest
    + S8213348: jdk.internal.vm.compiler.management service
    providers missing in module descriptor
    + S8213906: Update arm devkits with libXrandr headers
    + S8213908: AssertionError in DeferredAttr at setOverloadKind
    + S8214124: [TESTBUG] Bugs in runtime/NMT/MallocStressTest.java
    + S8214344: C2: assert(con.basic_type() != T_ILLEGAL) failed:
    elembt=byte; loadbt=void; unsigned=0
    + S8214345: infinite recursion while checking super class
    + S8214471: Enable different look and feel tests in SwingSet3
    demo test ToolTipDemoTest
    + S8214534: Setting of THIS_FILE in the build is broken
    + S8214557: Filter out VM flags which don't affect AOT code
    generation
    + S8214578: [macos] Problem with backslashes on macOS/JIS
    keyboard: Java ignores system settings
    + S8214840: runtime/NMT/MallocStressTest.java timed out
    + S8214850: Rename vm_operations.?pp files to vmOperations.?pp
    files
    + S8214904: Test8004741.java failed due to "Too few ThreadDeath
    hits; expected at least 6 but saw only 5"
    + S8215322: add @file support to jaotc
    + S8215355: Object monitor deadlock with no threads holding the
    monitor (using jemalloc 5.1)
    + S8215396: JTabbedPane preferred size calculation is wrong for
    SCROLL_TAB_LAYOUT
    + S8216180: [AOT] compiler/intrinsics/bigInteger/TestMulAdd.java
    crashed with AOT enabled
    + S8216353: Use utility APIs introduced in org/netbeans/jemmy/
    /util/LookAndFeel class in client sanity test cases
    + S8216354: Syntax error in toolchain_windows.m4
    + S8216472: (se) Stack overflow during selection operation
    leads to crash (win)
    + S8216535: tools/jimage/JImageExtractTest.java timed out
    + S8217235: Create automated test for SwingSet
    ColorChooserDemoTest
    + S8217297: Add support for multiple look and feel for SwingSet
    SliderDemoTest
    + S8217338: [Containers] Improve systemd slice memory limit
    support
    + S8217613: [AOT] TEST_OPTS_AOT_MODULES doesn't work on mac
    + S8217634: RunTest documentation and usability update
    + S8217717: ZGC: Broken oop map in C1 load barrier stub
    + S8217728: Speed up incremental rerun of "make hotspot"
    + S8218268: Javac treats Manifest Class-Path entries as Paths
    instead of URLs
    + S8218662: Allow 204 responses with Content-Length:0
    + S8218882: NET_Writev is declared, NET_WriteV is defined
    + S8218889: Improperly use of the Optional API
    + S8219205: JFR file without license header
    + S8219597: (bf) Heap buffer state changes could provoke
    unexpected exceptions
    + S8219723: javax/net/ssl/compatibility/Compatibility.java
    failed on some SNI cases
    + S8220348: [ntintel] asserts about copying unaligned array
    + S8220451: jdi/EventQueue/remove/remove004 failed due to
    "ERROR: thread2 is not alive"
    + S8220456: jdi/EventQueue/remove_l/remove_l004 failed due to
    "TIMEOUT while waiting for event"
    + S8220479: java/nio/channels/Selector/SelectWithConsumer.java
    failed at testTwoChannels()
    + S8220613: java/util/Arrays/TimSortStackSize2.java times out
    with fastdebug build
    + S8220688: [TESTBUG] runtime/NMT/MallocStressTest.java timed
    out
    + S8220786: Create new switch to redirect error reporting
    output to stdout or stderr
    + S8221270: Duplicated synchronized keywords in SSLSocketImpl
    + S8221312: test/jdk/sanity/client/SwingSet/src/
    /ColorChooserDemoTest.java failed
    + S8221851: Use of THIS_FILE in hotspot invalidates precompiled
    header on Linux/GCC
    + S8221885: Add intermittent test in the JavaSound to the
    ProblemList
    + S8222264: Windows incremental build is broken with JDK-8217728
    + S8222391: javax/net/ssl/compatibility/Compatibility.java
    should be more flexible
    + S8222448: java/lang/reflect/PublicMethods/
    /PublicMethodsTest.java times out
    + S8222519: ButtonDemoScreenshotTest fails randomly with "still
    state to be reached"
    + S8222741: jdi/EventQueue/remove/remove004 fails due to
    VMDisconnectedException
    + S8223003: SunMSCAPI keys are not cleaned up
    + S8223063: Support CNG RSA keys
    + S8223158: Docked MacBook cannot start any Java Swing
    applications
    + S8223260: NamingManager should cache InitialContextFactory
    + S8223464: Improve version string for Oracle CI builds
    + S8223558: Java does not render Myanmar script correctly
    + S8223627: jdk-13+20 bundle name contains null instead of ea
    + S8223638: Replace wildcard address with loopback or local
    host in tests - part 6
    + S8223678: Add Visual Studio Code workspace generation support
    (for native code)
    + S8223727: com/sun/jndi/ldap/privconn/RunTest.java failed due
    to hang in LdapRequest.getReplyBer
    + S8223769: Assert triggers with -XX:+StressReflectiveCode
    + S8224187: Refactor arraycopy_prologue to allow ZGC read
    barriers on arraycopy
    + S8224475: JTextPane does not show images in HTML rendering
    + S8224673: Adjust permission for delayed starting of debugging
    + S8224705: Tests that need to be problem-listed or have
    printer resources
    + S8224778: test/jdk/demo/jfc/J2Ddemo/J2DdemoTest.java cannot
    find J2Ddemo.jar
    + S8224821: java/awt/Focus/NoAutotransferToDisabledCompTest/
    /NoAutotransferToDisabledCompTest.java fails linux-x64
    + S8224830: test/jdk/java/awt/Focus/
    /ModalExcludedWindowClickTest/
    /ModalExcludedWindowClickTest.java fails on linux-x64
    + S8224851: AArch64: fix warnings and errors with Clang and GCC
    8.3
    + S8224905: java/lang/ProcessBuilder/Basic.java#id1 failed with
    stream closed
    + S8225007: java/awt/print/PrinterJob/
    /LandscapeStackOverflow.java may hang
    + S8225105: java/awt/Focus/ShowFrameCheckForegroundTest/
    /ShowFrameCheckForegroundTest.java fails in Windows 10
    + S8225117: java/math/BigInteger/SymmetricRangeTests.java fails
    with ParseException
    + S8225128: Add exception for expiring DocuSign root to
    VerifyCACerts test
    + S8225130: Add exception for expiring Comodo roots to
    VerifyCACerts test
    + S8225144: [macos] In Aqua L&amp;F backspace key does not delete
    when Shift is pressed
    + S8225180: SignedObject with invalid Key not throwing the
    InvalidKeyException in Windows
    + S8225182: JNI exception pending in DestroyXIMCallback of
    awt_InputMethod.c:1327
    + S8225199: [Graal] compiler/jvmci/compilerToVM/
    /IsMatureVsReprofileTest.java fails with
  - XX:CompileThresholdScaling=0.1
    + S8225305: ProblemList java/lang/invoke/VarHandles tests
    + S8225350: compiler/jvmci/compilerToVM/IsCompilableTest.java
    timed out
    + S8225430: Replace wildcard address with loopback or local
    host in tests - part 14
    + S8225435: Upgrade IANA Language Subtag Registry to the latest
    for JDK14
    + S8225487: giflib legal file is missing attribution for
    openbsd-reallocarray.c
    + S8225567: Wrong file headers with 8202414 fix changeset
    + S8225684: [AOT] vmTestbase/vm/oom/production/
    /AlwaysOOMProduction tests fail with AOTed java.base
    + S8225766: Curve in certificate should not affect signature
    scheme when using TLSv1.3
    + S8225797: OldObjectSample event creates unexpected amount of
    checkpoint data
    + S8226381: ProblemList java/lang/reflect/PublicMethods/
    /PublicMethodsTest.java
    + S8226406: JVM fails to detect mismatched or corrupt CDS
    archive
    + S8226608: Hide the onjcmd option from the help output
    + S8226892: ActionListeners on JRadioButtons don't get notified
    when selection is changed with arrow keys
    + S8227112: exclude compiler/intrinsics/sha/sanity tests from
    AOT runs
    + S8227324: Upgrade to freetype 2.10.1
    + S8227528: TestAbortVMOnSafepointTimeout.java failed due to
    "RuntimeException: 'Safepoint sync time longer than' missing
    from stdout/stderr"
    + S8227645: Some tests in serviceability/sa run with fixed -Xmx
    values and risk running out of memory
    + S8227646: [TESTBUG] appcds/SharedArchiveConsistency timed out
    + S8227662: freetype seeks to index at the end of the font data
    + S8228479: Correct the format of ColorChooserDemoTest
    + S8228613: java.security.Provider#getServices order is no
    longer deterministic
    + S8228969: 2019-09-28 public suffix list update
    + S8229236: CriticalJNINatives: dll handling should be done in
    native thread state
    + S8229345: Memory leak due to vtable stubs not being shared on
    SPARC
    + S8229888: (zipfs) Updating an existing zip file does not
    preserve original permissions
    + S8229994: assert(false) failed: Bad graph detected in
    get_early_ctrl_for_expensive
    + S8230004: jdk/internal/jimage/JImageOpenTest.java runs no test
    + S8230235: Rendering HTML with empty img attribute and
    documentBaseKey cause Exception
    + S8230390: Problemlist SA tests with AOT
    + S8230400: Missing constant pool entry for a method in
    stacktrace
    + S8230459: Test failed to resume JVMCI CompilerThread
    + S8230480: check malloc/calloc results in java.desktop
    + S8230597: Update GIFlib library to the 5.2.1
    + S8230611: infinite loop in
    LogOutputList::wait_until_no_readers()
    + S8230624: [TESTBUG] Problemlist JFR
    compiler/TestCodeSweeper.java
    + S8230677: Should disable Escape Analysis if JVMTI capability
    can_get_owned_monitor_info was taken
    + S8230926: [macosx] Two apostrophes are entered instead of one
    with "U.S. International - PC" layout
    + S8231025: Incorrect method tag offset for big endian platform
    + S8231081: TestMetadataRetention fails due to missing symbol id
    + S8231387: java.security.Provider.getService returns random
    result due to race condition with mutating methods in the same
    class
    + S8231430: C2: Memory stomp in max_array_length() for
    T_ILLEGAL type
    + S8231445: check ZALLOC return values in awt coding
    + S8231507: Update Apache Santuario (XML Signature) to version
    2.1.4
    + S8231584: Deadlock with ClassLoader.findLibrary and
    System.loadLibrary call
    + S8231753: use more Posix functionality in aix
    os::print_os_info
    + S8231810: javax/net/ssl/templates/
    /SSLSocketSSLEngineTemplate.java fails intermittently with
    "java.lang.Exception: Unexpected EOF"
    + S8232003: (fs) Files.write can leak file descriptor in the
    exception case
    + S8232056: GetOwnedMonitorInfoWithEATest.java fails with ZGC:
    Heap too small
    + S8232060: add some initializations using sigemptyset in
    os_aix.cpp
    + S8232154: Update Mesa 3-D Headers to version 19.2.1
    + S8232167: Visual Studio install found through
  - -with-tools-dir value is discarded
    + S8232170: FSInfo#getJarClassPath throws an exception not
    declared in its throws clause
    + S8232200: [macos 10.15] Windows in fullscreen tests jumps
    around the screen
    + S8232207: Linux os::available_memory re-reads cgroup
    configuration on every invocation
    + S8232224: [TESTBUG] problemlist JFR TestLargeRootSet.java
    + S8232370: Refactor some com.sun.jdi tests to enable IDE
    integration
    + S8232433: [macos 10.15] java/awt/Window/
    /LocationAtScreenCorner/LocationAtScreenCorner.java may fail
    + S8232571: Add missing SIGINFO signal
    + S8232692: [TESTBUG] compiler/aot/fingerprint/
    /SelfChangedCDS.java fails when cds is disabled
    + S8232713: Update BCEL version to 6.3.1 in license file
    + S8232806: Introduce a system property to disable eager lambda
    initialization
    + S8232834: RunTest sometimes fails to produce valid
    exitcode.txt
    + S8232880: Update test documentation with additional settings
    for client UI tooltip tests
    + S8232950: SUNPKCS11 Provider incorrectly check key length for
    PSS Signatures.
    + S8233018: Add a new test to verify that DatagramSocket is not
    interruptible
    + S8233019: java.lang.Class.isPrimitive() (C1) returns wrong
    result if Klass* is aligned to 32bit
    + S8233032: assert(in_bb(n)) failed: must be
    + S8233078: fix minimal VM build on Linux ppc64(le)
    + S8233328: fix minimal VM build on Linux s390x
    + S8233383: Various minor fixes
    + S8233466: aarch64: remove unnecessary load of mdo when
    profiling return and parameters type
    + S8233491: Crash in AdapterHandlerLibrary::get_adapter with
    CDS due to code cache exhaustion
    + S8233529: loopTransform.cpp:2984: Error: assert(p_f-&gt;Opcode()
    == Op_IfFalse) failed
    + S8233548: Update CUP to v0.11b
    + S8233649: Update ProblemList.txt to exclude failing headful
    tests on macos
    + S8233656: assert(d-&gt;is_CFG() &amp;&amp; n-&gt;is_CFG()) failed: must
    have CFG nodes
    + S8233657: Intermittent NPE in Component.validate()
    + S8234288: Turkey Time Zone returns incorrect time zone name
    + S8234323: NULL-check return value of SurfaceData_InitOps on
    macosx
    + S8234339: replace JLI_StrTok in java_md_solinux.c
    + S8234340: Bump update version for OpenJDK: jdk-11.0.7
    + S8234350: assert(mode == ControlAroundStripMined &amp;&amp; (use ==
    sfpt || !use-&gt;is_reachable_from_root())) failed: missed a node
    + S8234386: [macos] NPE was thrown at expanding Choice from
    maximized frame
    + S8234397: add OS uptime information to os::print_os_info
    output
    + S8234423: Modifying ArrayList.subList().subList() resets
    modCount of subList
    + S8234466: Class loading deadlock involving
    X509Factory#commitEvent()
    + S8234501: remove obsolete NET_ReadV
    + S8234525: enable link-time section-gc for linux s390x to
    remove unused code
    + S8234610: MaxVectorSize set wrongly when UseAVX=3 is
    specified after JDK-8221092
    + S8234617: C1: Incorrect result of field load due to missing
    narrowing conversion
    + S8234723: javax/net/ssl/TLS tests support TLSv1.3
    + S8234724: javax/net/ssl/templates/
    /SSLSocketSSLEngineTemplate.java supports TLSv1.3
    + S8234741: enhance os::get_core_path on macOS
    + S8234769: Duplicate attribution in freetype.md
    + S8234786: Fix for JDK-8214578 breaks OS X 10.12 compatibility
    + S8234809: set relro in linker flags when building with gcc
    + S8234824: java/nio/channels/SocketChannel/AdaptSocket.java
    fails on Windows 10
    + S8235243: handle VS2017 15.9 and VS2019 in abstract_vm_version
    + S8235288: AVX 512 instructions inadvertently used on Xeon for
    small vector width operations
    + S8235325: build failure on Linux after 8235243
    + S8235383: C1 compilation fails with
  - XX:+PrintIRDuringConstruction -XX:+Verbose
    + S8235489: handle return values of sscanf calls in hotspot
    + S8235509: Backport for JDK-8209657 Refactor filemap.hpp to
    simplify integration with Serviceability Agent.
    + S8235510: java.util.zip.CRC32 performance drop after 8200067
    + S8235563: [TESTBUG] appcds/CommandLineFlagComboNegative.java
    does not handle archive mapping failure
    + S8235637: jhsdb jmap from OpenJDK 11.0.5 doesn't work if
    prelink is enabled
    + S8235671: enhance print_rlimit_info in os_posix
    + S8235744: PIT: test/jdk/javax/swing/text/html/
    /TestJLabelWithHTMLText.java times out in linux-x64
    + S8235904: Infinite loop when rendering huge lines
    + S8235998: [c2] Memory leaks during tracing after '8224193:
    stringStream should not use Resource Area'.
    + S8236039: JSSE Client does not accept status_request
    extension in CertificateRequest messages for TLS 1.3
    + S8236140: assert(!VerifyHashTableKeys || _hash_lock == 0)
    failed: remove node from hash table before modifying it
    + S8236179: C1 register allocation error with T_ADDRESS
    + S8236488: Support for configure option
  - -with-native-debug-symbols=internal is impossible on Windows
    + S8236500: Windows ucrt.dll should be looked up in versioned
    WINSDK subdirectory
    + S8236709: struct SwitchRange in HS violates C++ One
    Definition Rule
    + S8236848: [JDK 11u] make run-test-tier1 fails after backport
    of JDK-8232834
    + S8236873: Worker has a deadlock bug
    + S8237217: Incorrect G1StringDedupEntry type used in
    StringDedupTable destructor
    + S8237368: Problem with NullPointerException in RMI
    TCPEndpoint.read
    + S8237375: SimpleThresholdPolicy misses CounterDecay timestamp
    initialization
    + S8237508: Simplify JarFile.isInitializing
    + S8237540: Missing files in backport of JDK-8210910
    + S8237541: Missing files in backport of JDK-8236528
    + S8237600: Test SunJSSEFIPSInit fails on Ubuntu
    + S8237819: s390x - remove unused pd_zero_to_words_large
    + S8237869: exclude jtreg test security/infra/java/security/
    /cert/CertPathValidator/certification/LuxTrustCA.java because
    of instabilities
    + S8237879: make 4.3 breaks build
    + S8237945: CTW: C2 compilation fails with
    assert(just_allocated_object(alloc_ctl) == ptr) failed: most
    recent allo...
    + S8238225: Issues reported after replacing symlink at
    Contents/MacOS/libjli.dylib with binary
    + S8238247: CTW runner should sweep nmethods more aggressively
    + S8238366: CTW runner closes standard output on exit
    + S8238438: SuperWord::co_locate_pack picks memory state of
    first instead of last load
    + S8238502: sunmscapi.dll causing EXCEPTION_ACCESS_VIOLATION
    + S8238534: Deep sign macOS bundles before bundle archive is
    being created
    + S8238591: CTW: Split
    applications/ctw/modules/jdk_localedata.java
    + S8238596: AVX enabled by default for Skylake even when
    unsupported
    + S8238811: C2: assert(i &gt;= req() || i == 0 || is_Region() ||
    is_Phi()) with -XX:+VerifyGraphEdges
    + S8239005: [TESTBUG] test/hotspot/jtreg/runtime/
    /StackGuardPages/TestStackGuardPages.java: exeinvoke.c: must
    initialize static state before calling do_overflow()
    + S8239466: Loss of precision in counter decay calculation in
    11u backport of JDK-8237375
    + S8239856: [ntintel] asserts about copying unaligned array
    element
    + S8240724: [test] jdk11 downport of 8224475 misses binary file
    test/jdk/javax/swing/JTextPane/arrow.png
    + S8241296: Segfault in JNIHandleBlock::oops_do()
- Removed patch:
  * DependOnVariableHelper.patch
    + fixed upstream
- Added patch:
  * JDK-8228407.patch
    + fix crashes due to shared archive file mismatch</changelog>
  <changelog author="fstrba@suse.com" date="1594900800">- Update to upstream tag jdk-11.0.8+10 (July 2020 CPU, bsc#1174157)
  * Security fixes:
    + JDK-8230613: Better ASCII conversions
    + JDK-8231800: Better listing of arrays
    + JDK-8232014: Expand DTD support
    + JDK-8233234: Better Zip Naming
    + JDK-8233239, CVE-2020-14562: Enhance TIFF support
    + JDK-8233255: Better Swing Buttons
    + JDK-8234032: Improve basic calendar services
    + JDK-8234042: Better factory production of certificates
    + JDK-8234418: Better parsing with CertificateFactory
    + JDK-8234836: Improve serialization handling
    + JDK-8236191: Enhance OID processing
    + JDK-8236867, CVE-2020-14573: Enhance Graal interface handling
    + JDK-8237117, CVE-2020-14556: Better ForkJoinPool behavior
    + JDK-8237592, CVE-2020-14577: Enhance certificate verification
    + JDK-8238002, CVE-2020-14581: Better matrix operations
    + JDK-8238013: Enhance String writing
    + JDK-8238804: Enhance key handling process
    + JDK-8238842: AIOOBE in GIFImageReader.initializeStringTable
    + JDK-8238843: Enhanced font handing
    + JDK-8238920, CVE-2020-14583: Better Buffer support
    + JDK-8238925: Enhance WAV file playback
    + JDK-8240119, CVE-2020-14593: Less Affine Transformations
    + JDK-8240482: Improved WAV file playback
    + JDK-8241379: Update JCEKS support
    + JDK-8241522: Manifest improved jar headers redux
    + JDK-8242136, CVE-2020-14621: Better XML namespace handling
  * Other changes:
    + JDK-6933331: (d3d/ogl) java.lang.IllegalStateException:
    Buffers have not been created
    + JDK-7124307: JSpinner and changing value by mouse
    + JDK-8022574: remove HaltNode code after uncommon trap calls
    + JDK-8039082: [TEST_BUG] Test
    java/awt/dnd/BadSerializationTest/BadSerializationTest.java
    fails
    + JDK-8040630: Popup menus and tooltips flicker with previous
    popup contents when first shown
    + JDK-8044365: (dc) MulticastSendReceiveTests.java failing with
    ENOMEM when joining group (OS X 10.9)
    + JDK-8048215: [TESTBUG]
    java/lang/management/ManagementFactory/ThreadMXBeanProxy.java
    Expected non-null LockInfo
    + JDK-8051349: nsk/jvmti/scenarios/sampling/SP06/sp06t003 fails
    in nightly
    + JDK-8080353: JShell: Better error message on attempting to
    add default method
    + JDK-8139876: Exclude hanging nsk/stress/stack from execution
    with deoptimization enabled
    + JDK-8146090: java/lang/ref/ReachabilityFenceTest.java fails
    with -XX:+DeoptimizeALot
    + JDK-8153430: jdk regression test MletParserLocaleTest,
    ParserInfiniteLoopTest reduce default timeout
    + JDK-8156207: Resource allocated BitMaps are often cleared
    unnecessarily
    + JDK-8159740: JShell: corralled declarations do not have
    correct source to wrapper mapping
    + JDK-8175984: ICC_Profile has un-needed, not-empty finalize
    method
    + JDK-8176359: Frame#setMaximizedbounds not working properly in
    multi screen environments
    + JDK-8183369: RFC unconformity of HttpURLConnection with proxy
    + JDK-8187078: -XX:+VerifyOops finds numerous problems when
    running JPRT
    + JDK-8189861: Refactor CacheFind
    + JDK-8191169: java/net/Authenticator/B4769350.java failed
    intermittently
    + JDK-8191930: [Graal] emits unparseable XML into compile log
    + JDK-8193879: Java debugger hangs on method invocation
    + JDK-8196019: java/awt/Window/Grab/GrabTest.java fails on
    Windows
    + JDK-8196181: sun/java2d/GdiRendering/InsetClipping.java fails
    + JDK-8198000:
    java/awt/List/EmptyListEventTest/EmptyListEventTest.java
    debug assert on Windows
    + JDK-8198001: java/awt/Menu/WrongParentAfterRemoveMenu/
    /WrongParentAfterRemoveMenu.java debug assert on Windows
    + JDK-8198339: Test javax/swing/border/Test6981576.java is
    unstable
    + JDK-8200701: jdk/jshell/ExceptionsTest.java fails on Windows,
    after JDK-8198801
    + JDK-8203264: JNI exception pending in
    PlainDatagramSocketImpl.c:740
    + JDK-8203672: JNI exception pending in PlainSocketImpl.c
    + JDK-8203673: JNI exception pending in
    DualStackPlainDatagramSocketImpl.c:398
    + JDK-8204834: Fix confusing "allocate" naming in OopStorage
    + JDK-8205399: Set node color on pinned HashMap.TreeNode
    deletion
    + JDK-8205653: test/jdk/sun/management/jmxremote/bootstrap/
    /RmiRegistrySslTest.java and RmiSslBootstrapTest.sh fail with
    handshake_failure
    + JDK-8206179: com/sun/management/OperatingSystemMXBean/
    /GetCommittedVirtualMemorySize.java fails with Committed
    virtual memory size illegal value
    + JDK-8207334: VM times out in VM_HandshakeAllThreads::doit()
    with RunThese30M
    + JDK-8208277: Code cache heap (-XX:ReservedCodeCacheSize)
    doesn't work with 1GB LargePages
    + JDK-8209113: Use WeakReference for lastFontStrike for created
    Fonts
    + JDK-8209333: Socket reset issue for TLS 1.3 socket close
    + JDK-8209439: C2 library_call can potentially ignore Math.pow
    intrinsic or use null pointer
    + JDK-8209534: [TESTBUG]runtime/appcds/cacheObject/
    /ArchivedModuleCompareTest.java fails with EnableJVMCI.
    + JDK-8210147: adjust some WSAGetLastError usages in windows
    network coding
    + JDK-8210284: "assert((av &amp; 0x00000001) == 0) failed:
    unsupported V8" on Solaris 11.4
    + JDK-8210303: VM_HandshakeAllThreads fails assert with
    "failed: blocked and not walkable"
    + JDK-8210459: Add support for generating compile_commands.json
    + JDK-8210515: [TESTBUG]CheckArchivedModuleApp.java needs to
    check if EnableJVMCI is set.
    + JDK-8210788: Javadoc for Thread.join(long, int) should
    specify that it waits forever when both arguments are zero
    + JDK-8211301: [macos] support full window content options
    + JDK-8211332: Space for stub routines (code_size2) is too
    small on new Skylake CPUs
    + JDK-8211339: NPE during SSL handshake caused by
    HostnameChecker
    + JDK-8211392: compiler/profiling/
    /spectrapredefineclass_classloaders/Launcher.java times out
    in JDK12 CI
    + JDK-8211743: [AOT] crash in ScopeDesc::decode_body() when
    JVMTI walks AOT frames
    + JDK-8212154: [TESTBUG] CheckArchivedModuleApp fails with NPE
    when JVMCI is absent
    + JDK-8212167: JShell : Stack trace of exception has wrong line
    number
    + JDK-8212933: Thread-SMR: requesting a VM operation whilst
    holding a ThreadsListHandle can cause deadlocks
    + JDK-8212986: Make Visual Studio compiler check less strict
    + JDK-8213250: CDS archive creation aborts due to metaspace
    object allocation failure
    + JDK-8213516: jck test api/javax_accessibility/AccessibleState/
    /fields.html fails intermittent
    + JDK-8213947: ARM32: failed check_simd should set
    UsePopCountInstruction to false
    + JDK-8214418: half-closed SSLEngine status may cause
    application dead loop
    + JDK-8214440: ldap over a TLS connection negotiate failed with
    "javax.net.ssl.SSLPeerUnverifiedException: hostname of the
    server does not match the hostname in the server's
    certificate"
    + JDK-8214444: Wrong strncat limits in dfa.cpp
    + JDK-8214481: freetype path does not disable TrueType hinting
    with AA+FM hints
    + JDK-8214571: -Xdoclint of array serialField gives "error:
    array type not allowed here"
    + JDK-8214856: Errors with JSZip in web console after upgrade
    to 3.1.5
    + JDK-8214862: assert(proj != __null) at compile.cpp:3251
    + JDK-8215369: Jcstress pollute /var/tmp with temporary files.
    + JDK-8215551: Missing case label in nmethod::reloc_string_for()
    + JDK-8215555: TieredCompilation C2 threads can excessively
    block handshakes
    + JDK-8215711: Missing key_share extension for (EC)DHE key
    exchange should alert missing_extension
    + JDK-8216151: [Graal] Module
    jdk.internal.vm.compiler.management has not been granted
    accessClassInPackage.org.graalvm.compiler.debug
    + JDK-8216154: C4819 warnings at HotSpot sources on Windows
    + JDK-8216541: CompiledICHolders of VM locked unloaded nmethods
    are released too late
    + JDK-8217230: assert(t == t_no_spec) failure in
    NodeHash::check_no_speculative_types()
    + JDK-8217404: --with-jvm-features doesn't work when multiple
    features are explicitly disabled
    + JDK-8217447: Develop flag TraceICs is broken
    + JDK-8217606: LdapContext#reconnect always opens a new
    connection
    + JDK-8218807: Compilation database (compile_commands.json) may
    contain obsolete items
    + JDK-8219214: Infinite Loop in CodeSection::dump()
    + JDK-8219904: ClassCastException when calling
    FlightRecorderMXBean#getRecordings()
    + JDK-8219991: New fix of the deadlock in
    sun.security.ssl.SSLSocketImpl
    + JDK-8221121: applications/microbenchmarks are encountering
    crashes in tier5
    + JDK-8221445: FastSysexMessage constructor crashes MIDI
    receiption thread
    + JDK-8221482: Initialize VMRegImpl::regName[] earlier to
    prevent assert during PrintStubCode
    + JDK-8221741: ClassCastException can happen when
    fontconfig.properties is used
    + JDK-8221823: Requested JDialog width is ignored
    + JDK-8223108: Test java/awt/EventQueue/
    /NonComponentSourcePost.java is unstable
    + JDK-8223678: Add Visual Studio Code workspace generation
    support (for native code)
    + JDK-8223935: PIT: java/awt/font/WindowsIndicFonts.java fails
    on windows10
    + JDK-8224109: Text spaced incorrectly by drawString under
    rotation with fractional metric
    + JDK-8224632: testbug: java/awt/dnd/RemoveDropTargetCrashTest/
    /RemoveDropTargetCrashTest.java fails on MacOS
    + JDK-8224793: os::die() does not honor CreateCoredumpOnCrash
    option
    + JDK-8224847: gc/stress/TestReclaimStringsLeaksMemory.java
    fails with reserved greater than expected
    + JDK-8224931: disable JAOTC invokedynamic support until
    8223533 is fixed
    + JDK-8224997: ChaCha20-Poly1305 TLS cipher suite decryption
    throws ShortBufferException
    + JDK-8225068: Remove DocuSign root certificate that is
    expiring in May 2020
    + JDK-8225069: Remove Comodo root certificate that is expiring
    in May 2020
    + JDK-8225126: Test SetBoundsPaintTest.html faild on Windows
    when desktop is scaled
    + JDK-8225325: Add tests for redefining a class' private method
    during resolution of the bootstrap specifier
    + JDK-8225622: [AOT] runtime/SharedArchiveFile/
    /TestInterpreterMethodEntries.java crashed with AOTed
    java.base
    + JDK-8225653: Provide more information when hitting SIGILL
    from HaltNode
    + JDK-8225783: Incorrect use of binary operators on booleans in
    type.cpp
    + JDK-8225789: Empty method parameter type should generate
    ClassFormatError
    + JDK-8226198: use of &amp; instead of &amp;&amp; in
    LibraryCallKit::arraycopy_restore_alloc_state
    + JDK-8226253: JAWS reports wrong number of radio buttons when
    buttons are hidden.
    + JDK-8226653: [accessibility] Can edit text cell correctly,
    but Accessibility Tool reads nothing about editor
    + JDK-8226806: [macOS 10.14] Methods of Java Robot should be
    called from appropriate thread
    + JDK-8226879: Memory leak in Type::hashcons
    + JDK-8227632: Incorrect PrintCompilation message: made not
    compilable on levels 0 1 2 3 4
    + JDK-8228407: JVM crashes with shared archive file mismatch
    + JDK-8228482: fix xlc16/xlclang comparison of distinct pointer
    types and string literal conversion warnings
    + JDK-8228757: Fail fast if the handshake type is unknown
    + JDK-8229158: make UseSwitchProfiling non-experimental or
    false by-default
    + JDK-8229421: The logic of java/net/ipv6tests/TcpTest.java is
    flawed
    + JDK-8229855: C2 fails with assert(false) failed: bad AD file
    + JDK-8230591: AArch64: Missing intrinsics for Math.ceil,
    floor, rint
    + JDK-8231118: ARM32: Math tests failures
    + JDK-8231213: Migrate SimpleDateFormatConstTest to JDK Repo
    + JDK-8231243: [TESTBUG] CustomFont.java cannot find font file
    + JDK-8231438: [macOS] Dark mode for the desktop is not
    supported
    + JDK-8231550: C2: ShouldNotReachHere() in
    verify_strip_mined_scheduling
    + JDK-8231564: setMaximizedBounds is broken with large display
    scale and multiple monitors
    + JDK-8231572: Use -lobjc instead of -fobjc-link-runtime in
    libosxsecurity
    + JDK-8231631: sun/net/ftp/FtpURLConnectionLeak.java fails
    intermittently with NPE
    + JDK-8231671: Fix copyright headers in hotspot (missing comma
    after year)
    + JDK-8231720: Some perf regressions after 8225653
    + JDK-8231779: crash
    HeapWord*ParallelScavengeHeap::failed_mem_allocate
    + JDK-8231863: Crash if classpath is read from @argument file
    and the main gets option argument
    + JDK-8232080: jlink plugins for vendor information and
    run-time options
    + JDK-8232106: [x86] C2: SIGILL due to usage of SSSE3
    instructions on processors which don't support it
    + JDK-8232134: Change to Visual Studio 2017 15.9.16 for
    building on Windows at Oracle
    + JDK-8232226: [macos 10.15] test/jdk/java/awt/color/
    /EqualityTest/EqualityTest.java may fail
    + JDK-8232357: Compare version info of Santuario to legal notice
    + JDK-8232572: Add hooks for custom output dir in Bundles.gmk
    + JDK-8232634: Problem List ICMColorDataTest.java
    + JDK-8232748: Build static versions of certain JDK libraries
    + JDK-8232846: ProcessHandle.Info command with non-English
    shows question marks
    + JDK-8232880: Update test documentation with additional
    settings for client UI tooltip tests
    + JDK-8233033: C2 produces wrong result while unswitching a
    loop due to lost control dependencies
    + JDK-8233137: runtime/ErrorHandling/VeryEarlyAssertTest.java
    fails after 8232080
    + JDK-8233197: Invert JvmtiExport::post_vm_initialized() and
    Jfr:on_vm_start() start-up order for correct option parsing
    + JDK-8233291: [TESTBUG] tools/jlink/plugins/
    /VendorInfoPluginsTest.java fails with debug or non-server VMs
    + JDK-8233364: Fix undefined behavior in
    Canonicalizer::do_ShiftOp
    + JDK-8233494: Avoid calling MallocTracker::record_malloc and
    record_free when NMT is off
    + JDK-8233573: Toolkit.getScreenInsets(GraphicsConfiguration)
    may throw ClassCastException
    + JDK-8233608: Minimal build broken after JDK-8233494
    + JDK-8233621: Mismatch in jsse.enableMFLNExtension property
    name
    + JDK-8233696: [TESTBUG]Some jtreg tests fail when CAPS_LOCK is
    ON
    + JDK-8233707: systemScale.cpp could not compile with VS2019
    + JDK-8233801: GCMEmptyIv.java test fails on Solaris 11.4
    + JDK-8233880: Support compilers with multi-digit major version
    numbers
    + JDK-8233920: MethodHandles::tryFinally generates illegal
    bytecode for long/double return type
    + JDK-8234137: The "AutoTestOnTop.java" test may run external
    applications
    + JDK-8234146: compiler/jsr292/
    /ContinuousCallSiteTargetChange.java times out on SPARC
    + JDK-8234184: [TESTBUG] java/awt/Mouse/EnterExitEvents/
    /ModalDialogEnterExitEventsTest.java fails in Windows
    + JDK-8234270: [REDO] JDK-8204128 NMT might report incorrect
    numbers for Compiler area
    + JDK-8234332: [TESTBUG] java/awt/Focus/DisposedWindow/
    /DisposeDialogNotActivateOwnerTest/
    /DisposeDialogNotActivateOwnerTest.java fails on linux-x64
    nightly
    + JDK-8234398: Replace ID2D1Factory::GetDesktopDpi with
    GetDeviceCaps
    + JDK-8234522: [macos] Crash with use of native file dialog
    + JDK-8234691: Potential double-free in ParallelSPCleanupTask
    constructor
    + JDK-8234696: tools/jlink/plugins/VendorInfoPluginsTest.java
    times out
    + JDK-8234727: sun/security/ssl/X509TrustManagerImpl tests
    support TLSv1.3
    + JDK-8234728: Some security tests should support TLSv1.3
    + JDK-8234779: Provide idiom for declaring classes noncopyable
    + JDK-8234824: java/nio/channels/SocketChannel/AdaptSocket.java
    fails on Windows 10
    + JDK-8234968: check calloc rv in libinstrument
    InvocationAdapter
    + JDK-8235153: [TESTBUG] [macos 10.15] java/awt/Graphics/
    /DrawImageBG/SystemBgColorTest.java fails
    + JDK-8235183: Remove the "HACK CODE" in comment
    + JDK-8235263: Revert TLS 1.3 change that wrapped IOExceptions
    + JDK-8235311: Tag mismatch may alert bad_record_mac
    + JDK-8235332: TestInstanceCloneAsLoadsStores.java fails with
  - XX:+StressGCM
    + JDK-8235452: Strip mined loop verification fails with
    assert(is_OuterStripMinedLoop()) failed: invalid node class
    + JDK-8235584: UseProfiledLoopPredicate fails with
    assert(_phase-&gt;get_loop(c) == loop) failed: have to be in the
    same loop
    + JDK-8235620: Broken merge between JDK-8006406 and JDK-8003559
    + JDK-8235638: NPE in LWWindowPeer.getOnscreenGraphics()
    + JDK-8235686: Add more custom hooks in Bundles.gmk
    + JDK-8235739: Rare NPE at WComponentPeer.getGraphics()
    + JDK-8235762: JVM crash in SWPointer during C2 compilation
    + JDK-8235834: IBM-943 charset encoder needs updating
    + JDK-8235874: The ordering of Cipher Suites is not maintained
    provided through jdk.tls.client.cipherSuites and
    jdk.tls.server.cipherSuites system property.
    + JDK-8235908: omit ThreadPriorityPolicy warning when value is
    set from image
    + JDK-8235984: C2: assert(out-&gt;in(PhiNode::Region) == head ||
    out-&gt;in(PhiNode::Region) == slow_head) failed: phi must be
    either part of the slow or the fast loop
    + JDK-8236211: [Graal] compiler/graalunit/GraphTest.java is
    skipped in all testing
    + JDK-8236470: Deal with ECDSA using ecdsa-with-SHA2 plus hash
    algorithm as AlgorithmId
    + JDK-8236545: Compilation error in mach5
    java/awt/FileDialog/MacOSGoToFolderCrash.java
    + JDK-8236700: Upgrading JSZip from v3.1.5 to v3.2.2
    + JDK-8236759: ShouldNotReachHere in
    PhaseIdealLoop::verify_strip_mined_scheduling
    + JDK-8236897: Fix the copyright header for pkcs11gcm2.h
    + JDK-8236921: Add build target to produce a JDK image suitable
    for a Graal/SVM build
    + JDK-8236953: [macos] JavaFX SwingNode is not rendered on macOS
    + JDK-8236996: Incorrect Roboto font rendering on Windows with
    subpixel antialiasing
    + JDK-8237045: JVM uses excessive memory with -XX:+EnableJVMCI
  - XX:JVMCICounterSize=2147483648
    + JDK-8237055: [TESTBUG] compiler/c2/TestJumpTable.java fails
    with release VMs
    + JDK-8237086: assert(is_MachReturn()) running CTW with fix for
    JDK-8231291
    + JDK-8237192: Generate stripped/public pdbs on Windows for jdk
    images
    + JDK-8237396: JvmtiTagMap::weak_oops_do() should not trigger
    barriers
    + JDK-8237474: Default SSLEngine should create in server role
    + JDK-8237859: C2: Crash when loads float above range check
    + JDK-8237879: make 4.3 breaks build
    + JDK-8237951: CTW: C2 compilation fails with "malformed
    control flow"
    + JDK-8237962: give better error output for invalid OCSP
    response intervals in CertPathValidator checks
    + JDK-8238190: [JVMCI] Fix single implementor speculation for
    diamond shapes.
    + JDK-8238356: CodeHeap::blob_count() overestimates the number
    of blobs
    + JDK-8238452: Keytool generates wrong expiration date if
    validity is set to 2050/01/01
    + JDK-8238555: Allow Initialization of SunPKCS11 with NSS when
    there are external FIPS modules in the NSSDB
    + JDK-8238575: DragSourceEvent.getLocation() returns wrong
    value on HiDPI screens (Windows)
    + JDK-8238676: jni crashes on accessing it from process exit
    hook
    + JDK-8238721: Add failing client jtreg tests to the Problem
    List
    + JDK-8238738: AudioSystem.getMixerInfo() takes about 30 sec to
    report a gone audio device
    + JDK-8238756: C2: assert(((n) == __null || !VerifyIterativeGVN
    || !((n)-&gt;is_dead()))) failed: can not use dead node
    + JDK-8238765: PhaseCFG::schedule_pinned_nodes cannot handle
    precedence edges from unmatched CFG nodes correctly
    + JDK-8238898: Missing hash characters for header on license
    file
    + JDK-8238942: Rendering artifacts with LCD text and fractional
    metrics
    + JDK-8238985: [TESTBUG] The arrow image is blue instead of
    green
    + JDK-8239000: handle ContendedPaddingWidth in vm_version_ppc
    + JDK-8239055: Wrong implementation of VMState.hasListener
    + JDK-8239091: Reversed arguments in call to strstr in freetype
    "debug" code.
    + JDK-8239142: C2's UseUniqueSubclasses optimization is broken
    for array accesses
    + JDK-8239224: libproc_impl.c previous_thr may be used
    uninitialized warning
    + JDK-8239351: Give more meaningful InternalError messages in
    Deflater.c
    + JDK-8239365: ProcessBuilder test modifications for AIX
    execution
    + JDK-8239456: vtable stub generation: assert failure (code
    size estimate)
    + JDK-8239457: call ReleaseStringUTFChars before early returns
    in Java_sun_security_pkcs11_wrapper_PKCS11_connect
    + JDK-8239462: jdk.hotspot.agent misses some
    ReleaseStringUTFChars calls in case of early returns
    + JDK-8239557: [TESTBUG] VeryEarlyAssertTest.java validating
    "END." marker at lastline is not always true
    + JDK-8239787: AArch64: String.indexOf may incorrectly handle
    empty strings
    + JDK-8239792: Bump update version for OpenJDK: jdk-11.0.8
    + JDK-8239798: SSLSocket closes socket both socket endpoints on
    a SocketTimeoutException
    + JDK-8239819: XToolkit: Misread of screen information memory
    + JDK-8239852: java/util/concurrent tests fail with
  - XX:+VerifyGraphEdges: assert(!VerifyGraphEdges) failed:
    verification should have failed
    + JDK-8239893: Windows handle Leak when starting processes
    using ProcessBuilder
    + JDK-8239915: Zero VM crashes when handling dynamic constant
    + JDK-8239931: [win][x86] vtable stub generation: assert
    failure (code size estimate) follow-up
    + JDK-8239965: XMLEncoder/Test4625418.java fails due to "Error:
    Cp943 - can't read properly"
    + JDK-8239976: Put JDK-8239965 on the ProblemList.txt
    + JDK-8240073: Fix 'test-make' build target in 11u
    + JDK-8240197: Cannot start JVM when $JAVA_HOME includes CJK
    characters
    + JDK-8240202: A few client tests leave mouse buttons pressed
    + JDK-8240220: IdealLoopTree::dump_head predicate printing is
    broken
    + JDK-8240223: Use consistent predicate order in and with
    PhaseIdealLoop::find_predicate
    + JDK-8240227: Loop predicates should be copied to unswitched
    loops
    + JDK-8240286: [TESTBUG] Test command error in hotspot/jtreg/
    /compiler/loopopts/superword/SumRedAbsNeg_Float.java
    + JDK-8240518: Incorrect JNU_ReleaseStringPlatformChars in
    Windows Print
    + JDK-8240529: CheckUnhandledOops breaks NULL check in
    Modules::define_module
    + JDK-8240576: JVM crashes after transformation in C2
    IdealLoopTree::merge_many_backedges
    + JDK-8240603: Windows 32bit compile error after 8238676
    + JDK-8240629: argfiles parsing broken for argfiles with
    comment cross 4096 bytes chunk
    + JDK-8240711: TestJstatdPort.java failed due to
    "ExportException: Port already in use:"
    + JDK-8240786: [TESTBUG] The test java/awt/Window/
    /GetScreenLocation/GetScreenLocationTest.java fails on HiDPI
    screen
    + JDK-8240824: enhance print_full_memory_info on Linux by THP
    related information
    + JDK-8240827: Downport SSLSocketImpl.java from "8221882: Use
    fiber-friendly java.util.concurrent.locks in JSSE"
    + JDK-8240905: assert(mem == (Node*)1 || mem == mem2) failed:
    multiple Memories being matched at once?
    + JDK-8240972: macOS codesign fail on macOS 10.13.5 or older
    + JDK-8241445: Fix copyright in
    test/jdk/tools/launcher/ArgFileSyntax.java
    + JDK-8241458: [JVMCI] add mark value to expose
    CodeOffsets::Frame_Complete
    + JDK-8241464: [11u] Backport: make rehashing be a needed
    guaranteed safepoint cleanup action
    + JDK-8241556: Memory leak if -XX:CompileCommand is set
    + JDK-8241568: (fs) UserPrincipalLookupService.lookupXXX
    failure with IOE "Operation not permitted"
    + JDK-8241586: compiler/cpuflags/
    /TestAESIntrinsicsOnUnsupportedConfig.java fails on aarch64
    + JDK-8241638: launcher time metrics always report 1 on Linux
    when _JAVA_LAUNCHER_DEBUG set
    + JDK-8241660: Add virtualization information output to hs_err
    file on macOS
    + JDK-8241808: [TESTBUG] The JDK-8039467 bug appeared on macOS
    + JDK-8241888: Mirror jdk.security.allowNonCaAnchor system
    property with a security one
    + JDK-8241900: Loop unswitching may cause dependence on null
    check to be lost
    + JDK-8241948: enhance list of environment variables printed in
    hs_err file
    + JDK-8241996: on linux set full relro in the linker flags
    + JDK-8242108: Performance regression after fix for JDK-8229496
    + JDK-8242141: New System Properties to configure the TLS
    signature schemes
    + JDK-8242154: Backport parts of JDK-4947890 to OpenJDK 11u
    + JDK-8242174: [macos] The NestedModelessDialogTest test make
    the macOS unstable
    + JDK-8242239: [Graal] javax/management/generified/
    /GenericTest.java fails: FAILED: queryMBeans sets same
    + JDK-8242294: JSSE Client does not throw SSLException when an
    alert occurs during handshaking
    + JDK-8242379: [TESTBUG] compiler/loopopts/
    /TestLoopUnswitchingLostCastDependency.java fails with
    release VMs
    + JDK-8242470: Update Xerces to Version 2.12.1
    + JDK-8242498: Invalid "sun.awt.TimedWindowEvent" object leads
    to JVM crash
    + JDK-8242541: Small charset issues (ISO8859-16, x-eucJP-Open,
    x-IBM834 and x-IBM949C)
    + JDK-8242626: enhance posix print_rlimit_info
    + JDK-8243059: Build fails when --with-vendor-name contains a
    comma
    + JDK-8243539: Copyright info (Year) should be updated for fix
    of 8241638
    + JDK-8243541: (tz) Upgrade time-zone data to tzdata2020a
    + JDK-8244407: JVM crashes after transformation in C2
    IdealLoopTree::split_fall_in
    + JDK-8244520: problemlist
    java/awt/font/Rotate/RotatedFontTest.java on linux
    + JDK-8244777: ClassLoaderStats VM Op uses constant hash value
    + JDK-8244853: The static build of libextnet is missing the
    JNI_OnLoad_extnet function
    + JDK-8244951: Missing entitlements for hardened runtime
    + JDK-8245047: [PPC64] C2: ReverseBytes + Load always match to
    unordered Load (acquire semantics missing)
    + JDK-8245649: Revert 8245397 backport of 8230591
    + JDK-8246031: SSLSocket.getSession() doesn't close connection
    for timeout/ interrupts
    + JDK-8246613: Choose the default SecureRandom algo based on
    registration ordering
    + JDK-8248505: Unexpected NoSuchAlgorithmException when using
    secure random impl from BCFIPS provider
- Removed patch:
  * JDK-8228407.patch
    + integrated upstream</changelog>
  <changelog author="fstrba@suse.com" date="1604318400">- Update to upstream tag jdk-11.0.9-11 (October 2020 CPU,
  bsc#1177943)
  * New features
    + JDK-8250784: Shenandoah: A Low-Pause-Time Garbage Collector
  * Security fixes
    + JDK-8233624: Enhance JNI linkage
    + JDK-8236196: Improve string pooling
    + JDK-8236862, CVE-2020-14779: Enhance support of Proxy class
    + JDK-8237990, CVE-2020-14781: Enhanced LDAP contexts
    + JDK-8237995, CVE-2020-14782: Enhance certificate processing
    + JDK-8240124: Better VM Interning
    + JDK-8241114, CVE-2020-14792: Better range handling
    + JDK-8242680, CVE-2020-14796: Improved URI Support
    + JDK-8242685, CVE-2020-14797: Better Path Validation
    + JDK-8242695, CVE-2020-14798: Enhanced buffer support
    + JDK-8243302: Advanced class supports
    + JDK-8244136, CVE-2020-14803: Improved Buffer supports
    + JDK-8244479: Further constrain certificates
    + JDK-8244955: Additional Fix for JDK-8240124
    + JDK-8245407: Enhance zoning of times
    + JDK-8245412: Better class definitions
    + JDK-8245417: Improve certificate chain handling
    + JDK-8248574: Improve jpeg processing
    + JDK-8249927: Specify limits of jdk.serialProxyInterfaceLimit
    + JDK-8253019: Enhanced JPEG decoding
  * Other changes
    + JDK-6532025: GIF reader throws misleading exception with
    truncated images
    + JDK-6949753: [TEST BUG]: java/awt/print/PageFormat/
    /PDialogTest.java needs update by removing an infinite loop
    + JDK-8022535: [TEST BUG] javax/swing/text/html/parser/
    /Test8017492.java fails
    + JDK-8062947: Fix exception message to correctly represent
    LDAP connection failure
    + JDK-8067354: com/sun/jdi/GetLocalVariables4Test.sh failed
    + JDK-8134599: TEST_BUG: java/rmi/transport/closeServerSocket/
    /CloseServerSocket.java fails intermittently with Address
    already in use
    + JDK-8151678: com/sun/jndi/ldap/LdapTimeoutTest.java failed
    due to timeout on DeadServerNoTimeoutTest is incorrect
    + JDK-8160768: Add capability to custom resolve host/domain
    names within the default JNDI LDAP provider
    + JDK-8172404: Tools should warn if weak algorithms are used
    before restricting them
    + JDK-8193367: Annotated type variable bounds crash javac
    + JDK-8202117: com/sun/jndi/ldap/RemoveNamingListenerTest.java
    fails intermittently: Connection reset
    + JDK-8203026: java.rmi.NoSuchObjectException: no such object
    in table
    + JDK-8203281: [Windows] JComboBox change in ui when
    editor.setBorder() is called
    + JDK-8203382: Rename SystemDictionary::initialize_wk_klass to
    resolve_wk_klass
    + JDK-8203393: com/sun/jdi/JdbMethodExitTest.sh and
    JdbExprTest.sh fail due to timeout
    + JDK-8203928: [Test] Convert non-JDB scaffolding
    serviceability shell script tests to java
    + JDK-8204963: javax.swing.border.TitledBorder has a memory leak
    + JDK-8204994: SA might fail to attach to process with "Windbg
    Error: WaitForEvent failed"
    + JDK-8205534: Remove SymbolTable dependency from
    serviceability agent
    + JDK-8206309: Tier1 SA tests fail
    + JDK-8208281: java/nio/channels/
    /AsynchronousSocketChannel/Basic.java timed out
    + JDK-8209109: [TEST] rewrite com/sun/jdi shell tests to java
    version - step1
    + JDK-8209332: [TEST] test/jdk/com/sun/jdi/CatchPatternTest.sh
    is incorrect
    + JDK-8209342: Problemlist SA tests on Solaris due to Error
    attaching to process: Can't create thread_db agent!
    + JDK-8209343: Test javax/swing/border/TestTitledBorderLeak.java
    should be marked as headful
    + JDK-8209517: com/sun/jdi/BreakpointWithFullGC.java fails with
    timeout
    + JDK-8209604: [TEST] rewrite com/sun/jdi shell tests to java
    version - step2
    + JDK-8209605: com/sun/jdi/BreakpointWithFullGC.java fails with
    ZGC
    + JDK-8209608: Problem list com/sun/jdi/BreakpointWithFullGC.java
    + JDK-8210131: vmTestbase/nsk/jvmti/scenarios/allocation/AP10/
    /ap10t001/TestDescription.java failed with ObjectFree:
    GetCurrentThreadCpuTimerInfo returned unexpected error code
    + JDK-8210243: [TEST] rewrite com/sun/jdi shell tests to java
    version - step3
    + JDK-8210527: JShell: NullPointerException in
    jdk.jshell.Eval.translateExceptionStack
    + JDK-8210560: [TEST] convert com/sun/jdi redefineClass-related
    tests
    + JDK-8210725: com/sun/jdi/RedefineClearBreakpoint.java fails
    with waitForPrompt timed out after 60 seconds
    + JDK-8210748: [TESTBUG] lib.jdb.Jdb.waitForPrompt() should
    clarify which output is the pending reply after a timeout
    + JDK-8210760: [TEST] rewrite com/sun/jdi shell tests to java
    version - step4
    + JDK-8210977: jdk/jfr/event/oldobject/TestThreadLocalLeak.java
    fails to find ThreadLocalObject
    + JDK-8211292: [TEST] convert com/sun/jdi/DeferredStepTest.sh
    test
    + JDK-8211694: JShell: Redeclared variable should be reset
    + JDK-8212200: assert when shared java.lang.Object is redefined
    by JVMTI agent
    + JDK-8212629: [TEST] wrong breakpoint in
    test/jdk/com/sun/jdi/DeferredStepTest
    + JDK-8212665: com/sun/jdi/DeferredStepTest.java: jj1 (line 57)
  - unexpected. lastLine=52, minLine=52, maxLine=55
    + JDK-8212807: tools/jar/multiRelease/Basic.java times out
    + JDK-8213182: Minimal VM build failure after JDK-8212200
    (assert when shared java.lang.Object is redefined by JVMTI
    agent)
    + JDK-8213214: Set -Djava.io.tmpdir= when running tests
    + JDK-8213275: ReplaceCriticalClasses.java fails with
    jdk.internal.vm.PostVMInitHook not found
    + JDK-8213574: Deadlock in string table expansion when dumping
    lots of CDS classes
    + JDK-8213703: LambdaConversionException: Invalid receiver type
    not a subtype of implementation type interface
    + JDK-8214074: Ghash optimization using AVX instructions
    + JDK-8214491: Upgrade to JLine 3.9.0
    + JDK-8214797: TestJmapCoreMetaspace.java timed out
    + JDK-8215243: JShell tests failing intermitently with
    "Problem cleaning up the following threads:"
    + JDK-8215244: jdk/jshell/ToolBasicTest.java
    testHistoryReference failed
    + JDK-8215354: x86_32 build failures after JDK-8214074 (Ghash
    optimization using AVX instructions)
    + JDK-8215438: jshell tool: Ctrl-D causes EOF
    + JDK-8216021: RunTest.gmk might set concurrency level to 1 on
    Windows
    + JDK-8216974: HttpConnection not returned to the pool after
    204 response
    + JDK-8218948: SimpleDateFormat :: format - Zone Names are not
    reflected correctly during run time
    + JDK-8219712: code_size2 (defined in stub_routines_x86.hpp) is
    too small on new Skylake CPUs
    + JDK-8220150: macos10.14 Mojave returns anti-aliased glyphs
    instead of aliased B&amp;W glyphs
    + JDK-8221658: aarch64: add necessary predicate for ubfx
    patterns
    + JDK-8221759: Crash when completing "java.io.File.path"
    + JDK-8221918: runtime/SharedArchiveFile/serviceability/
    /ReplaceCriticalClasses.java fails: Shared archive not found
    + JDK-8222074: Enhance auto vectorization for x86
    + JDK-8222079: Don't use memset to initialize fields decode_env
    constructor in disassembler.cpp
    + JDK-8222769: [TESTBUG] TestJFRNetworkEvents should not rely
    on hostname command
    + JDK-8223688: JShell: crash on the instantiation of raw
    anonymous class
    + JDK-8223777: In posix_spawn mode, failing to exec()
    jspawnhelper does not result in an error
    + JDK-8223940: Private key not supported by chosen signature
    algorithm
    + JDK-8224184: jshell got IOException at exiting with AIX
    + JDK-8224234: compiler/codegen/TestCharVect2.java fails in
    test_mulc
    + JDK-8225037: java.net.JarURLConnection::getJarEntry() throws
    NullPointerException
    + JDK-8225625: AES Electronic Codebook (ECB) encryption and
    decryption optimization using AVX512 + VAES instructions
    + JDK-8226536: Catch OOM from deopt that fails rematerializing
    objects
    + JDK-8226575: OperatingSystemMXBean should be made container
    aware
    + JDK-8226697: Several tests which need the @key headful
    keyword are missing it.
    + JDK-8226809: Circular reference in printed stack trace is not
    correctly indented &amp; ambiguous
    + JDK-8227059: sun/security/tools/keytool/
    /DefaultSignatureAlgorithm.java timed out
    + JDK-8227269: Slow class loading when running with JDWP
    + JDK-8227595: keytool/fakegen/DefaultSignatureAlgorithm.java
    fails due to "exitValue = 6"
    + JDK-8228448: Jconsole can't connect to itself
    + JDK-8228967: Trust/Key store and SSL context utilities for
    tests
    + JDK-8229378: jdwp library loader in linker_md.c quietly
    truncates on buffer overflow
    + JDK-8229815: Upgrade Jline to 3.12.1
    + JDK-8230000: some httpclients testng tests run zero test
    + JDK-8230002: javax/xml/jaxp/unittest/transform/
    /SecureProcessingTest.java runs zero test
    + JDK-8230010: Remove jdk8037819/BasicTest1.java
    + JDK-8230094: CCE in createXMLEventWriter(Result) over an
    arbitrary XMLStreamWriter
    + JDK-8230402: Allocation of compile task fails with assert:
    "Leaking compilation tasks?"
    + JDK-8230767: FlightRecorderListener returns null recording
    + JDK-8230870: (zipfs) Add a ZIP FS test that is similar to
    test/jdk/java/util/zip/EntryCount64k.java
    + JDK-8231209: [REDO] ThreadMXBean::getThreadAllocatedBytes()
    can be quicker for self thread
    + JDK-8231586: enlarge encoding space for OopMapValue offsets
    + JDK-8231953: Wrong assumption in assertion in
    oop::register_oop
    + JDK-8231968: getCurrentThreadAllocatedBytes default
    implementation s/b getThreadAllocatedBytes
    + JDK-8232083: Minimal VM is broken after JDK-8231586
    + JDK-8232161: Align some one-way conversion in MS950 charset
    with Windows
    + JDK-8232855: jshell missing word in /help help
    + JDK-8233027: OopMapSet::all_do does oms.next() twice during
    iteration
    + JDK-8233228: Disable weak named curves by default in TLS,
    CertPath, and Signed JAR
    + JDK-8233386: Initialize NULL fields for unused decorations
    + JDK-8233452: java.math.BigDecimal.sqrt() with
    RoundingMode.FLOOR results in incorrect result
    + JDK-8233686: XML transformer uses excessive amount of memory
    + JDK-8233741: AES Countermode (AES-CTR) optimization using
    AVX512 + VAES instructions
    + JDK-8233829: javac cannot find non-ASCII module name under
    non-UTF8 environment
    + JDK-8233958: Memory retention due to HttpsURLConnection
    finalizer that serves no purpose
    + JDK-8234011: (zipfs) Memory leak in
    ZipFileSystem.releaseDeflater()
    + JDK-8234058: runtime/CompressedOops/
    /CompressedClassPointers.java fails with 'Narrow klass base:
    0x0000000000000000' missing from stdout/stderr
    + JDK-8234149: Several regression tests do not dispose Frame at
    end
    + JDK-8234347: "Turkey" meta time zone does not generate
    composed localized names
    + JDK-8234385: [TESTBUG] java/awt/EventQueue/6980209/
    /bug6980209.java fails in linux nightly
    + JDK-8234535: Cross compilation fails due to missing CFLAGS
    for the BUILD_CC
    + JDK-8234541: C1 emits an empty message when it inlines
    successfully
    + JDK-8234687: change javap reporting on unknown attributes
    + JDK-8236464: SO_LINGER option is ignored by SSLSocket in JDK
    11
    + JDK-8236548: Localized time zone name inconsistency between
    English and other locales
    + JDK-8236617: jtreg test containers/docker/
    /TestMemoryAwareness.java fails after 8226575
    + JDK-8237182: Update copyright header for shenandoah and
    epsilon files
    + JDK-8237888: security/infra/java/security/cert/
    /CertPathValidator/certification/LuxTrustCA.java fails when
    checking validity interval
    + JDK-8237977: Further update
    javax/net/ssl/compatibility/Compatibility.java
    + JDK-8238270: java.net HTTP/2 client does not decrease stream
    count when receives 204 response
    + JDK-8238284: [macos] Zero VM build fails due to an obvious
    typo
    + JDK-8238380: java.base/unix/native/libjava/childproc.c
    "multiple definition" link errors with GCC10
    + JDK-8238386: (sctp) jdk.sctp/unix/native/libsctp/SctpNet.c
    "multiple definition" link errors with GCC10
    + JDK-8238388: libj2gss/NativeFunc.o "multiple definition" link
    errors with GCC10
    + JDK-8238448: RSASSA-PSS signature verification fail when
    using certain odd key sizes
    + JDK-8238710: LingeredApp doesn't log stdout/stderr if exits
    with non-zero code
    + JDK-8239083: C1 assert(known_holder == NULL ||
    (known_holder-&gt;is_instance_klass() &amp;&amp;
    (!known_holder-&gt;is_interface() ||
    ((ciInstanceKlass*)known_holder)-&gt;has_nonstatic_concrete_methods())),
    "should be non-static concrete method");
    + JDK-8239385: KerberosTicket client name refers wrongly to
    sAMAccountName in AD
    + JDK-8240169: javadoc fails to link to non-modular api docs
    + JDK-8240295: hs_err elapsed time in seconds is not accurate
    enough
    + JDK-8240360: NativeLibraryEvent has wrong library name on
    Linux
    + JDK-8240676: Meet not symmetric failure when running lucene
    on jdk8
    + JDK-8241007: Shenandoah: remove
    ShenandoahCriticalControlThreadPriority support
    + JDK-8241065: Shenandoah: remove leftover code after
    JDK-8231086
    + JDK-8241086: Test runtime/NMT/HugeArenaTracking.java is
    failing on 32bit Windows
    + JDK-8241130: com.sun.jndi.ldap.EventSupport.removeDeadNotifier:
    java.lang.NullPointerException
    + JDK-8241138: http.nonProxyHosts=* causes
    StringIndexOutOfBoundsException in DefaultProxySelector
    + JDK-8241319: WB_GetCodeBlob doesn't have ResourceMark
    + JDK-8241478: vmTestbase/gc/gctests/Steal/steal001/steal001.java
    fails with OOME
    + JDK-8241574: Shenandoah: remove ShenandoahAssertToSpaceClosure
    + JDK-8241750: x86_32 build failure after JDK-8227269
    + JDK-8242184: CRL generation error with RSASSA-PSS
    + JDK-8242283: Can't start JVM when java home path includes
    non-ASCII character
    + JDK-8242556: Cannot load RSASSA-PSS public key with non-null
    params from byte array
    + JDK-8243029: Rewrite javax/net/ssl/compatibility/
    /Compatibility.java with a flexible interop test framework
    + JDK-8243138: Enhance BaseLdapServer to support starttls
    extended request
    + JDK-8243320: Add SSL root certificates to Oracle Root CA
    program
    + JDK-8243321: Add Entrust root CA - G4 to Oracle Root CA
    program
    + JDK-8243389: enhance os::pd_print_cpu_info on linux
    + JDK-8243453: java --describe-module failed with non-ASCII
    module name under non-UTF8 environment
    + JDK-8243470: [macos] bring back O2 opt level for unsafe.cpp
    + JDK-8243489: Thread CPU Load event may contain wrong data for
    CPU time under certain conditions
    + JDK-8243925: Toolkit#getScreenInsets() returns wrong value on
    HiDPI screens (Windows)
    + JDK-8244087: 2020-04-24 public suffix list update
    + JDK-8244151: Update MUSCLE PC/SC-Lite headers to the latest
    release 1.8.26
    + JDK-8244164: AArch64: jaotc generates incorrect code for
    compressed OOPs with non-zero heap base
    + JDK-8244196: adjust output in os_linux
    + JDK-8244225: stringop-overflow warning on strncpy call from
    compile_the_world_in
    + JDK-8244287: JFR: Methods samples have line number 0
    + JDK-8244703: "platform encoding not initialized" exceptions
    with debugger, JNI
    + JDK-8244719: CTW: C2 compilation fails with
    "assert(!VerifyHashTableKeys || _hash_lock == 0) failed:
    remove node from hash table before modifying it"
    + JDK-8244729: Shenandoah: remove resolve paths from
    SBSA::generate_shenandoah_lrb
    + JDK-8244763: Update --release 8 symbol information after JSR
    337 MR3
    + JDK-8244818: Java2D Queue Flusher crash while moving
    application window to external monitor
    + JDK-8245151: jarsigner should not raise duplicate warnings on
    verification
    + JDK-8245616: Bump update version for OpenJDK: jdk-11.0.9
    + JDK-8245714: "Bad graph detected in build_loop_late" when
    loads are pinned on loop limit check uncommon branch
    + JDK-8245801: StressRecompilation triggers assert "redundunt
    OSR recompilation detected. memory leak in CodeCache!"
    + JDK-8245832: JDK build make-static-libs should build all JDK
    libraries
    + JDK-8245880: Shenandoah: check class unloading flag early in
    concurrent code root scan
    + JDK-8245981: Upgrade to jQuery 3.5.1
    + JDK-8246027: Minimal fastdebug build broken after JDK-8245801
    + JDK-8246094: [macos] Sound Recording and playback is not
    working
    + JDK-8246153: TestEliminateArrayCopy fails with
  - XX:+StressReflectiveCode
    + JDK-8246193: Possible NPE in ENC-PA-REP search in AS-REQ
    + JDK-8246196: javax/management/MBeanServer/OldMBeanServerTest
    fails with AssertionError
    + JDK-8246203: Segmentation fault in verification due to stack
    overflow with -XX:+VerifyIterativeGVN
    + JDK-8246330: Add TLS Tests for Legacy ECDSA curves
    + JDK-8246453: TestClone crashes with "all collected exceptions
    must come from the same place"
    + JDK-8247246: Add explicit ResolvedJavaType.link and expose
    presence of default methods
    + JDK-8247350: [aarch64] assert(false) failed: wrong size of
    mach node
    + JDK-8247502: PhaseStringOpts crashes while optimising
    effectively dead code
    + JDK-8247615: Initialize the bytes left for the heap sampler
    + JDK-8247824: CTW: C2 (Shenandoah) compilation fails with SEGV
    in SBC2Support::pin_and_expand
    + JDK-8247874: Replacement in VersionProps.java.template not
    working when --with-vendor-bug-url contains '&amp;'
    + JDK-8247979: aarch64: missing side effect of killing flags
    for clearArray_reg_reg
    + JDK-8248214: Add paddings for TaskQueueSuper to reduce
    false-sharing cache contention
    + JDK-8248219: aarch64: missing memory barrier in
    fast_storefield and fast_accessfield
    + JDK-8248348: Regression caused by the update to BCEL 6.0
    + JDK-8248385: [testbug][11u] Adapt TestInitiExceptions to
    jtreg 5.1
    + JDK-8248495: [macos] zerovm is broken due to libffi headers
    location
    + JDK-8248851: CMS: Missing memory fences between free chunk
    check and klass read
    + JDK-8248987: AOT's Linker.java seems to eagerly fail-fast on
    Windows
    + JDK-8249159: Downport test rework for SSLSocketTemplate from
    8224650
    + JDK-8249215: JFrame::setVisible crashed with
  - Dfile.encoding=UTF-8 on Japanese Windows.
    + JDK-8249251: [dark_mode ubuntu 20.04] The selected menu is
    not highlighted in GTKLookAndFeel
    + JDK-8249255: Build fails if source code in cygwin home dir
    + JDK-8249277: TestVerifyIterativeGVN.java is failing with
    timeout in OpenJDK 11
    + JDK-8249278: Revert JDK-8226253 which breaks the spec of
    AccessibleState.SHOWING for JList
    + JDK-8249560: Shenandoah: Fix racy GC request handling
    + JDK-8249801: Shenandoah: Clear soft-refs on requested GC cycle
    + JDK-8249953: Shenandoah: gc/shenandoah/mxbeans tests should
    account for corner cases
    + JDK-8250582: Revert Principal Name type to NT-UNKNOWN when
    requesting TGS Kerberos tickets
    + JDK-8250609: C2 crash in IfNode::fold_compares
    + JDK-8250627: Use -XX:+/-UseContainerSupport for
    enabling/disabling Java container metrics
    + JDK-8250755: Better cleanup for
    jdk/test/javax/imageio/plugins/shared/CanWriteSequence.java
    + JDK-8250787: Provider.put no longer registering aliases in
    FIPS env
    + JDK-8250826: jhsdb does not work with coredump which comes
    from Substrate VM
    + JDK-8250827: Shenandoah: needs to reset/finish StringTable's
    dead count before/after parallel walk
    + JDK-8250844: Make sure {type,obj}ArrayOopDesc accessors check
    the bounds
    + JDK-8251117: Cannot check P11Key size in P11Cipher and
    P11AEADCipher
    + JDK-8251354: Shenandoah: Fix jdk/jfr/tool/TestPrintJSON.java
    test failure
    + JDK-8251451: Shenandoah: Remark ObjectSynchronizer roots with
    I-U
    + JDK-8251469: Better cleanup for
    test/jdk/javax/imageio/SetOutput.java
    + JDK-8251487: Shenandoah: missing detail timing tracking for
    final mark cleaning phase
    + JDK-8252120: compiler/oracle/TestCompileCommand.java
    misspells "occured"
    + JDK-8252157: JDK-8231209 11u backport breaks jmm binary
    compatibility
    + JDK-8252258: [11u] JDK-8242154 changes the default vendor
    + JDK-8252804: [test] Fix 'ReleaseDeflater.java' test after
    downport of 8234011
    + JDK-8253134: JMM_VERSION should remain at 0x20020000 (JDK 10)
    in JDK 11
    + JDK-8253283: [11u] Test build/translations/
    /VerifyTranslations.java failing after JDK-8252258
    + JDK-8253813: Backout JDK-8244287 from 11u: it causes several
    crashes
- Removed patch:
  * gcc-fno-common-fix.patch
    + not needed any more with this version
- Added patch:
  * JDK-8250861.patch
    + Fix regression "8250861: Crash in MinINode::Ideal(PhaseGVN*,
    bool)" introduced in jdk 11.0.9</changelog>
  <changelog author="fstrba@suse.com" date="1604491200">- Enable Sheandoah GC for x86_64 (jsc#ECO-3171)</changelog>
  <changelog author="fstrba@suse.com" date="1605528000">- Update to upstream tag jdk-11.0.9.1-1
  * Fix:
    + JDK-8250861: Crash in MinINode::Ideal(PhaseGVN*, bool)
- Removed patch:
  * JDK-8250861.patch
    + Integrated upstream</changelog>
  <changelog author="fstrba@suse.com" date="1611230400">- Update to upstream tag jdk-11.0.10+9 (January 2021 CPU,
  bsc#1181239)
  * Security fixes
    + JDK-8247619: Improve Direct Buffering of Characters
  * Other changes
    + JDK-6722928: Support SSPI as a native GSS-API provider
    + JDK-7185258: [macosx] Deadlock in SunToolKit.realSync()
    + JDK-8152332: [macosx] JFileChooser cannot be serialized on
    Mac OS X
    + JDK-8161684: [testconf] Add VerifyOops' testing into compiler
    tiers
    + JDK-8171279: Support X25519 and X448 in TLS
    + JDK-8173361: various crashes in
    JvmtiExport::post_compiled_method_load
    + JDK-8173658: JvmtiExport::post_class_unload() is broken for
    non-JavaThread initiators
    + JDK-8191006: hsdis disassembler plugin does not compile with
    binutils 2.29+
    + JDK-8197981: Missing return statement in
    __sync_val_compare_and_swap_8
    + JDK-8198334: java/awt/FileDialog/8003399/bug8003399.java
    fails in headless mode
    + JDK-8200151: Add 8 JNDI tests to com/sun/jndi/dns/ConfigTests/
    + JDK-8208279: Add 8 JNDI tests to com/sun/jndi/dns/EnvTests/
    + JDK-8208483: Add 5 JNDI tests to
    com/sun/jndi/dns/FactoryTests/
    + JDK-8208542: Add 4 JNDI tests to com/sun/jndi/dns/ListTests/
    + JDK-8208665: Amend cross-compilation docs with
    qemu-debootstrap recipe
    + JDK-8210088: ProblemList gc/epsilon/TestMemoryMXBeans.java
    + JDK-8210339: Add 10 JNDI tests to com/sun/jndi/dns/FedTests/
    + JDK-8211450: UndetVar::dup is not copying the kind field to
    the duplicated instance
    + JDK-8212160: JVMTI agent crashes with "assert(_value != 0LL)
    failed: resolving NULL _value"
    + JDK-8212226: SurfaceManager throws "Invalid Image variant"
    for MultiResolutionImage (Windows)
    + JDK-8213400: Support choosing group name in keytool keypair
    generation
    + JDK-8213535: Windows HiDPI html lightweight tooltips are
    truncated
    + JDK-8213698: Improve devkit creation and add support for
    linux/ppc64/ppc64le/s390x
    + JDK-8214025: assert(t-&gt;singleton()) failed: must be a
    constant when ScavengeRootsInCode &lt; 2
    + JDK-8214242: compiler/arguments/TestScavengeRootsInCode.java
    fails because of missing UnlockDiagnosticVMOptions
    + JDK-8214787: Zero builds fail with "undefined
    JavaThread::thread_state()"
    + JDK-8215583: Exclude
    runtime/handshake/HandshakeWalkSuspendExitTest.java
    + JDK-8216012: Infinite loop in RSA KeyPairGenerator
    + JDK-8216324: GetClassMethods is confused by the presence of
    default methods in super interfaces
    + JDK-8217429: WebSocket over authenticating proxy fails to
    send Upgrade headers
    + JDK-8217976: test/jdk/java/net/httpclient/websocket/
    /WebSocketProxyTest.java fails intermittently
    + JDK-8218021: Have jarsigner preserve posix permission
    attributes
    + JDK-8218287: jshell tool: input behavior unstable after
    12-ea+24 on Windows
    + JDK-8218851: JVM crash in custom classloader stress test, JDK
    12 &amp; 13
    + JDK-8220420: Cleanup c1_LinearScan
    + JDK-8222072: JVMTI GenerateEvents() sends CompiledMethodLoad
    events to wrong jvmtiEnv
    + JDK-8222286: Fix for JDK-8213419 is broken on s390
    + JDK-8222527: HttpClient doesn't send HOST header when
    tunelling HTTP/1.1 through http proxy
    + JDK-8222533: jtreg test jdk/internal/platform/cgroup/
    /TestCgroupMetrics.java fails on SLES12.3 linux ppc64le
    machine
    + JDK-8224506: [TESTBUG] TestDockerMemoryMetrics.java fails
    with exitValue = 137
    + JDK-8224555: vmTestbase/nsk/jvmti/scenarios/contention/TC02/
    /tc02t001/TestDescription.java failed
    + JDK-8224650: Add tests to support X25519 and X448 in TLS
    + JDK-8225072: Add LuxTrust certificate that is expiring in
    March 2021 to list of allowed but expired certs
    + JDK-8225329: -XX:+PrintBiasedLockingStatistics causes crash
    during initialization on Windows platforms
    + JDK-8225687: Newly added sspi.cpp in JDK-6722928 still
    contains some small errors
    + JDK-8227006: [linux] Runtime.availableProcessors execution
    time increased by factor of 100
    + JDK-8227275: Within native OOM error handling, assertions may
    hang the process
    + JDK-8227647: [Graal] Test8009761.java fails due to
    "RuntimeException: static java.lang.Object
    compiler.uncommontrap.Test8009761.m3(boolean,boolean) not
    compiled"
    + JDK-8229495: SIGILL in C2 generated OSR compilation
    + JDK-8230910: libsspi_bridge does not build on Windows 32bit
    + JDK-8232114: JVM crashed at imjpapi.dll in native code
    + JDK-8234147: Avoid looking up standard charsets in core
    libraries
    + JDK-8234393: [macos] printing ignores printer tray
    + JDK-8234863: Increase default value of MaxInlineLevel
    + JDK-8235218: Minimal VM is broken after JDK-8173361
    + JDK-8235456: Minimal VM is broken after JDK-8212160
    + JDK-8235829: graal crashes with Zombie.java test
    + JDK-8236124: Minimal VM slowdebug build failed after
    JDK-8212160
    + JDK-8236512: PKCS11 Connection closed after Cipher.doFinal
    and NoPadding
    + JDK-8236944: The legVecZ operand should be limited to
    zmm0-zmm15 registers
    + JDK-8237186: Fix typo in copyright header of
    java/io/Reader/TransferTo.java
    + JDK-8237499: JFR: Include stack trace in the ThreadStart event
    + JDK-8237512: AArch64: aarch64TestHook leaks a BufferBlob
    + JDK-8237524: AArch64: String.compareTo() may return incorrect
    result
    + JDK-8237950: C2 compilation fails with "Live Node limit
    exceeded limit" during ConvI2L::Ideal optimization
    + JDK-8238579: HttpsURLConnection drops the timeout and hangs
    forever in read
    + JDK-8239105: Add exception for expiring Digicert root
    certificates to VerifyCACerts test
    + JDK-8239477: jdk/jfr/jcmd/TestJcmdStartStopDefault.java fails
  - XX:+VerifyOops with "verify_oop: rsi: broken oop"
    + JDK-8239497: SEGV in EdgeUtils::field_name_symbol(Edge const&amp;)
    + JDK-8239886: Minimal VM build fails after JDK-8237499
    + JDK-8240633: Memory leaks in the implementations of
    FileChooserUI
    + JDK-8240690: Race condition between EDT and
    BasicDirectoryModel.FilesLoader.run0()
    + JDK-8241234: Unify monitor enter/exit runtime entries.
    + JDK-8241311: Move some charset mapping tests from closed to
    open
    + JDK-8241797: Add some tests to the problem list
    + JDK-8242029: AArch64: skip G1 array copy pre-barrier if
    marking not active
    + JDK-8242335: Additional Tests for RSASSA-PSS
    + JDK-8242480: Negative value may be returned by
    getFreeSwapSpaceSize() in the docker
    + JDK-8242614: cleanup duplicated test ldap server in some
    com/sun/jndi/ldap/ tests
    + JDK-8242846: Bring back test/jdk/tools/jlink/plugins/
    /OrderResourcesPluginTest.java
    + JDK-8243114: Implement montgomery{Multiply,Square}intrinsics
    on Windows
    + JDK-8243290: Improve diagnostic messages for class
    verification and redefinition failures
    + JDK-8243488: Add tests for set/get SendBufferSize and
    getReceiveBufferSize in DatagramSocket
    + JDK-8243549: sun/security/ssl/CipherSuite/
    /NamedGroupsWithCipherSuite.java failed with Unsupported
    signature algorithm: DSA
    + JDK-8243617: compiler/onSpinWait/TestOnSpinWaitC1.java test
    uses wrong class
    + JDK-8243619: compiler/codecache/CheckSegmentedCodeCache.java
    test misses -version
    + JDK-8244142: some hotspot/runtime tests don't check exit code
    of forked JVM
    + JDK-8244278: Excessive code cache flushes and sweeps
    + JDK-8244282: test/hotspot/jtreg/compiler/intrinsics/
    /Test8237524.java fails with --illegal-access=deny
    + JDK-8244621: [macos10.15] Garbled FX printing plus CoreText
    warnings on Catalina when building with Xcode 11
    + JDK-8244819: hsdis does not compile with binutils 2.34+
    + JDK-8245051: c1 is broken if it is compiled by gcc without
  - fno-lifetime-dse
    + JDK-8245168: jlink should not be treated as a "small" tool
    + JDK-8245400: Upgrade to LittleCMS 2.11
    + JDK-8246381: VM crashes with "Current BasicObjectLock* below
    than low_mark"
    + JDK-8246434: Threads::print_on_error assumes that the heap
    has been set up
    + JDK-8246648: issue with OperatingSystemImpl
    getFreeSwapSpaceSize in docker after 8242480
    + JDK-8247201: Print potential pointer value of readable stack
    memory in hs_err file
    + JDK-8247763: assert(outer-&gt;outcnt() == 2) failed: 'only phis'
    failure in LoopNode::verify_strip_mined()
    + JDK-8247867: Upgrade to freetype 2.10.2
    + JDK-8248190: Enable Power10 system and implement new
    byte-reverse instructions
    + JDK-8248226: TestCloneAccessStressGCM fails with
  - XX:-ReduceBulkZeroing
    + JDK-8248347: windows build broken by JDK-8243114
    + JDK-8248532: Every time I change keyboard language at my
    MacBook, Java crashes
    + JDK-8248552: C2 crashes with SIGFPE due to division by zero
    + JDK-8248596: [TESTBUG] compiler/loopopts/
    /PartialPeelingUnswitch.java times out with Graal enabled
    + JDK-8248745: Add jarsigner and keytool tests for restricted
    algorithms
    + JDK-8248791: sun/util/resources/cldr/TimeZoneNamesTest.java
    fails with -XX:-ReduceInitialCardMarks -XX:-ReduceBulkZeroing
    + JDK-8248845: AArch64: stack corruption after spilling vector
    register
    + JDK-8249176: Update GlobalSignR6CA test certificates
    + JDK-8249183: JVM crash in "AwtFrame::WmSize" method
    + JDK-8249192: MonitorInfo stores raw oops across safepoints
    + JDK-8249602: C2: assert(cnt == _outcnt) failed: no insertions
    allowed
    + JDK-8249603: C1: assert(has_error == false) failed: register
    allocation invalid
    + JDK-8249605: C2: assert(no_dead_loop) failed: dead loop
    detected
    + JDK-8249607: C2: assert(!had_error) failed: bad dominance
    + JDK-8249608: Vector register used by C2 compiled method
    corrupted at safepoint
    + JDK-8249672: Include microcode revision in features_string on
    x86
    + JDK-8249748: gtest silently ignores bad jvm arguments
    + JDK-8249821: Separate libharfbuzz from libfontmanager
    + JDK-8250598: Hyper-V is detected in spite of running on host
    OS
    + JDK-8250605: Linux x86_32 builds fail after JDK-8249821
    + JDK-8250636: iso8601_time returns incorrect offset part on
    MacOS
    + JDK-8250665: Wrong translation for the month name of May in
    ar_JO,LB,SY
    + JDK-8250772: Test com/sun/jndi/ldap/
    /NamingExceptionMessageTest.java fails intermittently with
    javax.naming.ServiceUnavailableException
    + JDK-8250825: C2 crashes with assert(field != __null) failed:
    missing field
    + JDK-8250894: Provide a configure option to build and run
    against the platform libharfbuzz
    + JDK-8250928: JFR: Improve hash algorithm for stack traces
    + JDK-8250968: Symlinks attributes not preserved when using
    jarsigner on zip files
    + JDK-8250984: Memory Docker tests fail on some Linux kernels
    w/o cgroupv1 swap limit capabilities
    + JDK-8251118: BiasedLocking::preserve_marks should not have a
    HandleMark
    + JDK-8251189: com/sun/jndi/ldap/LdapDnsProviderTest.java
    failed due to timeout
    + JDK-8251257: NMT: jcmd VM.native_memory scale=1 crashes
    target VM
    + JDK-8251365: Build failure on AIX after 8250636
    + JDK-8251397: NPE on ClassValue.ClassValueMap.cacheArray
    + JDK-8251456: [TESTBUG] compiler/vectorization/
    /TestVectorsNotSavedAtSafepoint.java failed OutOfMemoryError
    + JDK-8251458: Parse::do_lookupswitch fails with "assert(_cnt
    &gt;= 0) failed"
    + JDK-8251535: Partial peeling at unsigned test adds incorrect
    loop exit check
    + JDK-8251949: ZGC: Set explicit heap size for
    compiler/gcbarriers tests
    + JDK-8252090: JFR: StreamWriterHost::write_unbuffered() stucks
    in an infinite loop OpenJDK (build 13.0.1+9)
    + JDK-8252415: Bump update version for OpenJDK: jdk-11.0.10
    + JDK-8252470: java/awt/dnd/DisposeFrameOnDragCrash/
    /DisposeFrameOnDragTest.java fails on Windows
    + JDK-8252497: Incorrect numeric currency code for ROL
    + JDK-8252660: Shenandoah: support manageable SoftMaxHeapSize
    option
    + JDK-8252679: Two windows specific FileDIalog tests may fail
    on some Windows_Server_2016_Standard
    + JDK-8252696: Loop unswitching may cause out of bound array
    load to be executed
    + JDK-8252754: Hash code calculation of JfrStackTrace is
    inconsistent
    + JDK-8253219: Epsilon: clean up unnecessary includes
    + JDK-8253224: Shenandoah: ShenandoahStrDedupQueue destructor
    calls virtual num_queues()
    + JDK-8253226: Shenandoah: remove unimplemented
    ShenandoahStrDedupQueue::verify
    + JDK-8253269: The CheckCommonColors test should provide more
    info on failure
    + JDK-8253284: Zero OrderAccess barrier mappings are incorrect
    + JDK-8253375: OSX build fails with Xcode 12.0 (12A7209)
    + JDK-8253778: ShenandoahSafepoint::is_at_shenandoah_safepoint
    should not access VMThread state from other threads
    + JDK-8253791: Issue with useAppleColor check in CSystemColors.m
    + JDK-8254016: Test8237524 fails with -XX:-CompactStrings option
    + JDK-8254081: java/security/cert/PolicyNode/
    /GetPolicyQualifiers.java fails due to an expired certificate
    + JDK-8254144: Non-x86 Zero builds fail with return-type
    warning in os_linux_zero.cpp
    + JDK-8254166: Zero: return-type warning in
    zeroInterpreter_zero.cpp
    + JDK-8254177: (tz) Upgrade time-zone data to tzdata2020b
    + JDK-8254185: Fix Code cache sweeper heuristics for JDK 11
    + JDK-8254190: [s390] interpreter misses exception check after
    calling monitorenter
    + JDK-8254790: SIGSEGV in string_indexof_char and
    stringL_indexof_char intrinsics
    + JDK-8254854: [cgroups v1] Metric limits not properly detected
    on some join controller combinations
    + JDK-8254982: (tz) Upgrade time-zone data to tzdata2020c
    + JDK-8255050: Add pkcs11/KeyStore/ClientAuth.sh to Problem list
    + JDK-8255065: Zero: accessor_entry misses the IRIW case
    + JDK-8255226: (tz) Upgrade time-zone data to tzdata2020d
    + JDK-8255269: Unsigned overflow in g1Policy.cpp
    + JDK-8255365: Problem list failing client manual tests
    + JDK-8255457: Shenandoah: cleanup ShenandoahMarkTask
    + JDK-8255466: C2 crashes at ciObject::get_oop() const+0x0
    + JDK-8255550: x86: Assembler::cmpq(Address dst, Register src)
    encoding is incorrect
    + JDK-8255603: Memory/Performance regression after JDK-8210985
    + JDK-8255760: Shenandoah: match constants style in
    ShenandoahMarkTask fallback
    + JDK-8255781: Bump patch update version for OpenJDK:
    jdk-11.0.9.1
    + JDK-8255937: Better cleanup for
    test/jdk/javax/imageio/stream/StreamFlush.java
    + JDK-8256427: Test com/sun/jndi/dns/ConfigTests/
    /PortUnreachable.java does not work on AIX
    + JDK-8256452: Integrate missing part of JDK-8232370 to 11u
    + JDK-8256483: [TESTBUG] serviceability/jvmti/GetClassMethods/
    /libOverpassMethods.c fails to compile on gcc 4.4.x
    + JDK-8256557: libharfbuzz fails to link on gcc 4.4.x due to
  - Wl,-z,defs
    + JDK-8256618: Zero: Linux x86_32 build still fails
    + JDK-8256736: Zero: GTest tests fail with "unsuppported vm
    variant"
    + JDK-8256809: Annotation processing causes NPE during flow
    analysis
    + JDK-8257181: s390x builds are very noisy with gc-sections
    messages
    + JDK-8257242: [macOS] Java app crashes while switching input
    methods
    + JDK-8257545: SunJSSE FIPS regression in key exchange after
    JDK-8171279 11u backport
    + JDK-8257641: Shenandoah: Query is_at_shenandoah_safepoint()
    from control thread should return false
    + JDK-8257701: Shenandoah: objArrayKlass metadata is not marked
    with chunked arrays
    + JDK-8258630: Add expiry exception for QuoVadis root
    certificate
- New upstream dependency on libharfbuzz
- Regenerated patches: missing-return.patch system-pcsclite.patch</changelog>
  <changelog author="fstrba@suse.com" date="1616155200">- Added patches:
  * system-crypto-policy.patch
    + Let OpenJDK use system crypto policies unless explicitely told
    not to
  * nss-security-provider.patch
    + Add the NSS security provider with configuration in generated
    nss.cfg file
  * keytool-default-rsa.patch
    + Make keytool generate RSA keys by default, since only the
    LEGACY system crypto policy allows DSA</changelog>
  <changelog author="pujos.michael@gmail.com" date="1618488000">- moved mozilla-nss dependency to java-11-openjdk-headless package
  This is necessary to be able to do crypto with just
  java-11-openjdk-headless installed. Fixes boo#1184606</changelog>
  <changelog author="fstrba@suse.com" date="1619006400">- Update to upstream tag jdk-11.0.11+9 (April 2021, CPU)
  * Security fixes
    + JDK-8244473: Contextualize registration for JNDI
    + JDK-8244543: Enhanced handling of abstract classes
    + JDK-8249906, CVE-2021-2163, bsc#1185055: Enhance opening JARs
    + JDK-8250568, CVE-2021-2161, bsc#1185056: Less ambiguous
    processing
    + JDK-8253799: Make lists of normal filenames
    + JDK-8257001: Improve Http Client Support
  * Other changes
    + JDK-7107012: sun.jvm.hotspot.code.CompressedReadStream
    readDouble() conversion to long mishandled
    + JDK-7146776: deadlock between URLStreamHandler.getHostAddress
    and file.Handler.openconnection
    + JDK-8086003: Test fails on OSX with java.lang.RuntimeException
    'Narrow klass base: 0x0000000000000000, Narrow klass shift: 3'
    missing
    + JDK-8168869: jdeps: localized messages don't use proper line
    breaks
    + JDK-8180837: SunPKCS11-NSS tests failing with
    CKR_ATTRIBUTE_READ_ONLY and CKR_MECHANISM_PARAM_INVALID
    + JDK-8202343: Disable TLS 1.0 and 1.1
    + JDK-8205992: jhsdb cannot attach to Java processes running in
    Docker containers
    + JDK-8209193: Fix aarch64-linux compilation after -Wreorder
    changes
    + JDK-8210413: AArch64: Optimize div/rem by constant in C1
    + JDK-8210578: AArch64: Invalid encoding for fmlsvs instruction
    + JDK-8211051: jdeps usage of --dot-output doesn't provide
    valid output for modular jar
    + JDK-8211057: Gensrc step CompileProperties generates unstable
    CompilerProperties output
    + JDK-8211150: G1 Full GC not purging code root memory and
    hence causing memory leak
    + JDK-8211825: ModuleLayer.defineModulesWithXXX does not setup
    delegation when module reads automatic module
    + JDK-8212043: Add floating-point Math.min/max intrinsics
    + JDK-8212218: [TESTBUG] runtime/ErrorHandling/
    /TestHeapDumpOnOutOfMemoryErrorInMetaspace.java timed out
    + JDK-8213116: javax/swing/JComboBox/WindowsComboBoxSize/
    /WindowsComboBoxSizeTest.java fails in Windows
    + JDK-8213909: jdeps --print-module-deps should report missing
    dependences
    + JDK-8214180: Need better granularity for sleeping
    + JDK-8214223: tools/jdeps/listdeps/ListModuleDeps.java failed
    due to missing Lib2 file
    + JDK-8214230: Classes generated by SystemModulesPlugin.java
    are not reproducable
    + JDK-8214741: docs/index.html has no title or copyright
    + JDK-8215687: [Graal] unit test CheckGraalIntrinsics failed
    after 8212043
    + JDK-8217848: [Graal] vmTestbase/nsk/jvmti/ResourceExhausted/
    /resexhausted003/TestDescription.java fails
    + JDK-8218482: sun/security/krb5/auto/ReplayCachePrecise.java
    failed - no KrbException thrown
    + JDK-8218550: Add test omitted from JDK-8212043
    + JDK-8221584: SIGSEGV in os::PlatformEvent::unpark() in
    JvmtiRawMonitor::raw_exit while posting method exit event
    + JDK-8221995: AARCH64: problems with CAS instructions encoding
    + JDK-8222518: Remove unnecessary caching of Parker object in
    java.lang.Thread
    + JDK-8222785: aarch64: add necessary masking for immediate
    shift counts
    + JDK-8223186: HotSpot compile warnings from GCC 9
    + JDK-8225773: jdeps --check produces NPE if there are missing
    module dependences
    + JDK-8225805: Java Access Bridge does not close the logger
    + JDK-8226810: Failed to launch JVM because of
    NullPointerException occured on System.props
    + JDK-8229396: jdeps ignores multi-release when
    generate-module-info used on command line
    + JDK-8229474: Shenandoah: Cleanup CM::update_roots()
    + JDK-8232225: Rework the fix for JDK-8071483
    + JDK-8232905: JFR fails with assertion:
    assert(t-&gt;unflushed_size() == 0) failed: invariant
    + JDK-8233164: C2 fails with assert(phase-&gt;C-&gt;get_alias_index(t)
    == phase-&gt;C-&gt;get_alias_index(t_adr)) failed: correct memory
    chain
    + JDK-8233910: java/awt/ColorClass/AlphaColorTest.java is
    failing  intermittently in nightly lnux-x64 system
    + JDK-8233912: aarch64: minor improvements of atomic operations
    + JDK-8234508: VM_HeapWalkOperation::iterate_over_object reads
    non-strong fields with an on-strong load barrier
    + JDK-8234742: Improve handshake logging
    + JDK-8234796: Refactor Handshake::execute to take a more
    complex type than ThreadClosure
    + JDK-8235324: Dying objects are published from users of
    CollectedHeap::object_iterate
    + JDK-8235351: Lookup::unreflect should bind with the original
    caller independent of Method's accessible flag
    + JDK-8237369: Shenandoah: failed vmTestbase/nsk/jvmti/
    /AttachOnDemand/attach021/TestDescription.java test
    + JDK-8237392: Shenandoah: Remove unreliable assertion
    + JDK-8237483: AArch64 C1 OopMap inserted twice fatal error
    + JDK-8237495: Java MIDI fails with a dereferenced memory error
    when asked to send a raw 0xF7
    + JDK-8239355: (dc) Initial value of SO_SNDBUF should allow
    sending large datagrams (macOS)
    + JDK-8240353: AArch64: missing support for
  - XX:+ExtendedDTraceProbes in C1
    + JDK-8240704: CheckHandles.java failed "AssertionError: Handle
    use increased by more than 10 percent."
    + JDK-8240751: Shenandoah: fold ShenandoahTracer definition
    + JDK-8240795: [REDO] 8238384 CTW: C2 compilation fails with
    "assert(store != load-&gt;find_exact_control(load-&gt;in(0)))
    failed: dependence cycle found"
    + JDK-8241598: Upgrade JLine to 3.14.0
    + JDK-8241649: Optimize Character.toString
    + JDK-8241770: Module xxxAnnotation() methods throw NCDFE if
    module-info.class found as resource in unnamed module
    + JDK-8241911: AArch64: Fix a potential register clash issue in
    reduce_add2I
    + JDK-8242030: Wrong package declarations in jline classes after
    JDK-8241598
    + JDK-8242565: Policy initialization issues when the denyAfter
    constraint is enabled
    + JDK-8243618: compiler/rtm/cli tests can be run w/o WhiteBox
    + JDK-8243670: Unexpected test result caused by C2
    MergeMemNode::Ideal
    + JDK-8244088: [Regression] Switch of Gnome theme ends up in
    deadlocked UI
    + JDK-8244154: Update SunPKCS11 provider with PKCS11 v3.0 header
    files
    + JDK-8244340: Handshake processing thread lacks yielding
    + JDK-8244573: java.lang.ArrayIndexOutOfBoundsException thrown
    for malformed class file
    + JDK-8244683: A TSA server used by tests
    + JDK-8245005: javax/net/ssl/compatibility/BasicConnectTest.java
    failed with No enum constant
    + JDK-8245026: PsAdaptiveSizePolicy::_old_gen_policy_is_ready is
    unused
    + JDK-8245283: JFR: Can't handle constant dynamic used by Jacoco
    agent
    + JDK-8245512: CRC32 optimization using AVX512 instructions
    + JDK-8245527: LDAP Channel Binding support for Java
    GSS/Kerberos
    + JDK-8246707: (sc) SocketChannel.read/write throws
    AsynchronousCloseException on closed channel
    + JDK-8246709: sun/security/tools/jarsigner/
    /TsacertOptionTest.java compilation failed after JDK-8244683
    + JDK-8247200: assert((unsigned)fpargs &lt; 32)
    + JDK-8247766: [aarch64] guarantee(val &lt; (1U &lt;&lt; nbits))
    failed: Field too big for insn.
    + JDK-8248336: AArch64: C2: offset overflow in
    BoxLockNode::emit
    + JDK-8248865: Document JNDI/LDAP timeout properties
    + JDK-8248901: Signed immediate support in
    .../share/assembler.hpp is broken.
    + JDK-8249543: Force DirectBufferAllocTest to run with
  - ExplicitGCInvokesConcurrent
    + JDK-8249588: libwindowsaccessbridge issues on 64bit Windows
    + JDK-8249749: modify a primitive array through a stream and a
    for cycle causes jre crash
    + JDK-8249787: Make TestGCLocker more resilient with concurrent
    GCs
    + JDK-8249867: xml declaration is not followed by a newline
    + JDK-8250911: [windows] os::pd_map_memory() error detection
    broken
    + JDK-8251255: [linux] Add process-memory information to hs-err
    and VM.info
    + JDK-8251359: Shenandoah: filter null oops before calling
    enqueue/SATB barrier
    + JDK-8251925: C2: RenaissanceStressTest fails with
    assert(!had_error): bad dominance
    + JDK-8251944: Add Shenandoah test config to
    compiler/gcbarriers/UnsafeIntrinsicsTest.java
    + JDK-8251992: VM crashed running TestComplexAddrExpr.java test
    with -XX:UseAVX=X
    + JDK-8253220: Epsilon: clean up unused code/declarations
    + JDK-8253274: The CycleDMImagetest brokes the system
    + JDK-8253353: Crash in C2: guarantee(n != NULL) failed: No Node
    + JDK-8253368: TLS connection always receives close_notify
    exception
    + JDK-8253404: C2: assert(C-&gt;live_nodes() &lt;=
    C-&gt;max_node_limit()) failed: Live Node limit exceeded limit
    + JDK-8253409: Double-rounding possibility in float fma
    + JDK-8253476: TestUseContainerSupport.java fails on some Linux
    kernels w/o swap limit capabilities
    + JDK-8253524: C2: Refactor code that clones predicates during
    loop unswitching
    + JDK-8253644: C2: assert(skeleton_predicate_has_opaque(iff))
    failed: unexpected
    + JDK-8253681: closed java/awt/dnd/MouseEventAfterStartDragTest/
    /MouseEventAfterStartDragTest.html test failed
    + JDK-8253702: BigSur version number reported as 10.16, should
    be 11.nn
    + JDK-8253756: C2 CompilerThread0 crash in Node::add_req(Node*)
    + JDK-8254104: MethodCounters must exist before nmethod is
    installed
    + JDK-8254734: "dead loop detected" assert failure with patch
    from 8223051
    + JDK-8254748: Bad Copyright header format after JDK-8212218
    + JDK-8254799: runtime/ErrorHandling/
    /TestHeapDumpOnOutOfMemoryError.java fails with release VMs
    + JDK-8255058: C1: assert(is_virtual()) failed: type check
    + JDK-8255351: Add detection for Graviton 2 CPUs
    + JDK-8255368: Math.exp() gives wrong result for large values on
    x86 32-bit platforms
    + JDK-8255387: Japanese characters were printed upside down on
    AIX
    + JDK-8255401: Shenandoah: Allow oldval and newval registers to
    overlap in cmpxchg_oop()
    + JDK-8255479: [aarch64] assert(src-&gt;section_index_of(target) ==
    CodeBuffer::SECT_NONE) failed: sanity
    + JDK-8255544: Create a checked cast
    + JDK-8255559: Leak File Descriptors Because of
    ResolverLocalFilesystem#engineResolveURI()
    + JDK-8255681: print callstack in error case in
    runAWTLoopWithApp
    + JDK-8255734: VM should ignore SIGXFSZ on ppc64, s390 too
    + JDK-8255742: PrintInlining as compiler directive doesn't print
    virtual calls
    + JDK-8255845: Memory leak in imageFile.cpp
    + JDK-8255880: UI of Swing components is not redrawn after their
    internal state changed
    + JDK-8255908: ExceptionInInitializerError due to
    UncheckedIOException while initializing cgroupv1 subsystem
    + JDK-8256025: AArch64: MachCallRuntimeNode::ret_addr_offset()
    is incorrect for stub calls
    + JDK-8256056: Deoptimization stub doesn't save vector registers
    on x86
    + JDK-8256061: RegisterSaver::save_live_registers() omits upper
    halves of ZMM0-15 registers
    + JDK-8256187: [TEST_BUG] Automate bug4275046.java test
    + JDK-8256220: C1: x86_32 fails with -XX:UseSSE=1 after
    JDK-8210764 due to mishandled lir_neg
    + JDK-8256258: some missing NULL checks or asserts after
    CodeCache::find_blob_unsafe
    + JDK-8256264: Printed GlyphVector outline with low DPI has bad
    quality on Windows
    + JDK-8256290: javac/lambda/T8031967.java fails with
    StackOverflowError on x86_32
    + JDK-8256359: AArch64: runtime/ReservedStack/
    /ReservedStackTestCompiler.java fails
    + JDK-8256387: Unexpected result if patching an entire
    instruction on AArch64
    + JDK-8256421: Add 2 HARICA roots to cacerts truststore
    + JDK-8256488: [aarch64] Use ldpq/stpq instead of ld4/st4 for
    small copies in StubGenerator::copy_memory
    + JDK-8256489: Make gtest for long path names on Windows more
    resilient in the presence of virus scanners
    + JDK-8256501: libTestMainKeyWindow fails to build with Xcode
    12.2
    + JDK-8256633: Fix product build on Windows+Arm64
    + JDK-8256682: JDK-8202343 is incomplete
    + JDK-8256751: Incremental rebuild with precompiled header fails
    when touching a header file
    + JDK-8256757: Incorrect MachCallRuntimeNode::ret_addr_offset()
    for CallLeafNoFP on x86_32
    + JDK-8256806: Shenandoah: optimize shenandoah/jni/
    /TestPinnedGarbage.java test
    + JDK-8256807: C2: Not marking stores correctly as mismatched
    in string opts
    + JDK-8256810: Incremental rebuild broken on Macosx
    + JDK-8256818: SSLSocket that is never bound or connected leaks
    socket resources
    + JDK-8256888: Client manual test problem list update
    + JDK-8257083: Security infra test failures caused by
    JDK-8202343
    + JDK-8257408: Bump update version for OpenJDK: jdk-11.0.11
    + JDK-8257423: [PPC64] Support -XX:-UseInlineCaches
    + JDK-8257436: [aarch64] Regressions in ArrayCopyUnalignedDst
    .testByte/testChar for 65-78 bytes when UseSIMDForMemoryOps
    is on
    + JDK-8257513: C2: assert((constant_addr -
    _masm.code()-&gt;consts()-&gt;start()) == con.offset())
    + JDK-8257547: Handle multiple prereqs on the same line in deps
    files
    + JDK-8257561: Some code is not vectorized after 8251925 and
    8250607
    + JDK-8257565: epsilonBarrierSet.hpp should not include
    barrierSetAssembler
    + JDK-8257575: C2: "failed: only phis" assert failure in loop
    strip mining verification
    + JDK-8257594: C2 compiled checkcast of non-null object triggers
    endless deoptimization/recompilation cycle
    + JDK-8257633: Missing -mmacosx-version-min=X flag when linking
    libjvm
    + JDK-8257670: sun/security/ssl/SSLSocketImpl/SSLSocketLeak.java
    reports leaks
    + JDK-8257707: Fix incorrect format string in Http1HeaderParser
    + JDK-8257746: Regression introduced with JDK-8250984 - memory
    might be null in some machines
    + JDK-8257798: [PPC64] undefined reference to
    Klass::vtable_start_offset()
    + JDK-8257884: Re-enable sun/security/ssl/SSLSocketImpl/
    /SSLSocketLeak.java as automatic test
    + JDK-8257910: [JVMCI] Set exception_seen accordingly in the
    runtime.
    + JDK-8257997: sun/security/ssl/SSLSocketImpl/SSLSocketLeak.java
    again reports leaks after JDK-8257884
    + JDK-8257999: Parallel GC crash in gc/parallel/
    /TestDynShrinkHeap.java: new region is not in covered_region
    + JDK-8258077: Using -Xcheck:jni can lead to a double-free after
    JDK-8193234
    + JDK-8258247: Couple of issues in fix for JDK-8249906
    + JDK-8258373: Update the text handling in the JPasswordField
    + JDK-8258396: SIGILL in jdk.jfr.internal.PlatformRecorder
    .rotateDisk()
    + JDK-8258419: RSA cipher buffer cleanup
    + JDK-8258471: "search codecache" clhsdb command does not work
    + JDK-8258534: Epsilon: clean up unused includes
    + JDK-8258805: Japanese characters not entered by mouse click
    on Windows 10
    + JDK-8258833: Cancel multi-part cipher operations in SunPKCS11
    after failures
    + JDK-8258836: JNI local refs exceed capacity
    getDiagnosticCommandInfo
    + JDK-8258884: [TEST_BUG] Convert applet-based test
    open/test/jdk/javax/swing/JMenuItem/8031573/bug8031573.java
    to a regular java test
    + JDK-8259007: This test printed a blank page
    + JDK-8259048: (tz) Upgrade time-zone data to tzdata2020f
    + JDK-8259049: Uninitialized variable after JDK-8257513
    + JDK-8259231: Epsilon: improve performance under contention
    during virtual space expansion
    + JDK-8259271: gc/parallel/TestDynShrinkHeap.java still fails
    "assert(covered_region.contains(new_memregion)) failed: new
    region is not in covered_region"
    + JDK-8259312: VerifyCACerts.java fails as soneraclass2ca cert
    will expire in 90 days
    + JDK-8259319: Illegal package access when SunPKCS11 requires
    SunJCE's classes
    + JDK-8259339: AllocateUninitializedArray C2 intrinsic fails
    with void.class input
    + JDK-8259428: AlgorithmId.getEncodedParams() should return copy
    + JDK-8259446: runtime/jni/checked/
    /TestCheckedReleaseArrayElements.java fails with stderr not
    empty
    + JDK-8259451: Zero: skip serviceability/sa tests, set vm.hasSA
    to false
    + JDK-8259580: Shenandoah: uninitialized label in
    VerifyThreadGCState
    + JDK-8259619: C1: 3-arg StubAssembler::call_RT stack-use
    condition is incorrect
    + JDK-8259633: compiler/graalunit/CoreTest.java fails with NPE
    after JDK-8244543
    + JDK-8259706: C2 compilation fails with assert(vtable_index ==
    Method::invalid_vtable_index) failed: correct sentinel value
    + JDK-8259707: LDAP channel binding does not work with StartTLS
    extension
    + JDK-8259773: Incorrect encoding of AVX-512 kmovq instruction
    + JDK-8259849: Shenandoah: Rename store-val to IU-barrier
    + JDK-8259949: x86 32-bit build fails when -fcf-protection is
    passed in the compiler flags
    + JDK-8259954: gc/shenandoah/mxbeans tests fail with -Xcomp
    + JDK-8260029: aarch64: fix typo in verify_oop_array
    + JDK-8260308: Update LogCompilation junit to 4.13.1
    + JDK-8260338: Some fields in HaltNode is not cloned
    + JDK-8260349: Cannot programmatically retrieve Metaspace max
    set via JAVA_TOOL_OPTIONS
    + JDK-8260356: (tz) Upgrade time-zone data to tzdata2021a
    + JDK-8260378: [TESTBUG] DcmdMBeanTestCheckJni.java reports
    false positive
    + JDK-8260497: Shenandoah: Improve SATB flushing
    + JDK-8260502: [s390] NativeMovRegMem::verify() fails because
    it's too strict
    + JDK-8260632: Build failures after JDK-8253353
    + JDK-8260704: ParallelGC: oldgen expansion needs release-store
    for _end
    + JDK-8261022: Fix incorrect result of Math.abs() with char type
    + JDK-8261089: [TESTBUG] native library of test
    TestCheckedReleaseCriticalArray.java fails to compile with
    gcc 4.x
    + JDK-8261183: Follow on to Make lists of normal filenames
    + JDK-8261209: isStandalone property: remove dependency on
    pretty-print
    + JDK-8261231: Windows IME was disabled after DnD operation
    + JDK-8261251: Shenandoah: Use object size for full GC
    humongous compaction
    + JDK-8261310: PPC64 Zero build fails with
    'VMError::controlled_crash(int)::FunctionDescriptor
    functionDescriptor' has incomplete type and cannot be defined
    + JDK-8261334: NMT: tuning statistic shows incorrect hash
    distribution
    + JDK-8261413: Shenandoah: Disable class-unloading in I-U mode
    + JDK-8261522: [PPC64] AES intrinsics write beyond the
    destination array
    + JDK-8261534: Test sun/security/pkcs11/KeyAgreement/
    /IllegalPackageAccess.java fails on platforms where no nsslib
    artifacts are defined
    + JDK-8261585: Restore HandleArea used in
    Deoptimization::uncommon_trap
    + JDK-8261753: Test java/lang/System/OsVersionTest.java still
    failing on BigSur patch versions after JDK-8253702
    + JDK-8261829: Exclude tools/jlink/JLinkReproducibleTest.java
    in 11u
    + JDK-8261912: Code IfNode::fold_compares_helper more
    defensively
    + JDK-8261920: [AIX] jshell command throws java.io.IOError on
    non English locales
    + JDK-8262018: Wrong format in SAP copyright header of
    OsVersionTest
    + JDK-8263069: Exclude some failing tests from
    security/infra/java/security/cert/CertPathValidator</changelog>
  <changelog author="fstrba@suse.com" date="1620043200">- Remove all Jpackage provides for SLE12 in order to avoid
  installing this package as default Java on SLE12-SP5
  (bsc#1185476)</changelog>
  <changelog author="fstrba@suse.com" date="1621512000">- Modified patch:
  * nss-security-provider.patch
    + make the NSS provider first in the list</changelog>
  <changelog author="fstrba@suse.com" date="1626868800">- Update to upstream tag jdk-11.0.12+7 (July 2021, CPU)
  * Security fixes
    + JDK-8256157: Improve bytecode assembly
    + JDK-8256491: Better HTTP transport
    + JDK-8258432, CVE-2021-2341, bsc#1188564: Improve file
    transfers
    + JDK-8260453: Improve Font Bounding
    + JDK-8260960: Signs of jarsigner signing
    + JDK-8260967, CVE-2021-2369, bsc#1188565: Better jar file
    validation
    + JDK-8262380: Enhance XML processing passes
    + JDK-8262403: Enhanced data transfer
    + JDK-8262410: Enhanced rules for zones
    + JDK-8262477: Enhance String Conclusions
    + JDK-8262967: Improve Zip file support
    + JDK-8264066, CVE-2021-2388, bsc#1188566: Enhance compiler
    validation
    + JDK-8264079: Improve abstractions
    + JDK-8264460: Improve NTLM support
  * Other changes
    + JDK-6847157: java.lang.NullPointerException: HDC for
    component at sun.java2d.loops.Blit.Blit
    + JDK-7106851: Test should not use System.exit
    + JDK-8073446: TimeZone getOffset API does not  return a dst
    offset between years 2038-2137
    + JDK-8076190: Customizing the generation of a PKCS12 keystore
    + JDK-8153005: Upgrade the default PKCS12 encryption/MAC
    algorithms
    + JDK-8171303: sun/java2d/pipe/InterpolationQualityTest.java
    fails on Windows &amp; Linux
    + JDK-8177068: incomplete classpath causes NPE in Flow
    + JDK-8185734: [Windows] Structured Exception Catcher missing
    around gtest execution
    + JDK-8187450: JNI local refs exceeds capacity warning in
    NetworkInterface::getAll
    + JDK-8190763: Class cast exception on (CompoundEdit)
    UndoableEditEvent.getEdit()
    + JDK-8195841: PNGImageReader.readNullTerminatedString() doesnt
    check for non-null terminated strings with length equal to
    maxLen
    + JDK-8196100: javax/swing/text/JTextComponent/5074573/
    /bug5074573.java fails
    + JDK-8199646: JShell tests: jdk/jshell/
    /FailOverDirectExecutionControlTest.java failed with
    java.lang.UnsupportedOperationException
    + JDK-8206925: Support the certificate_authorities extension
    + JDK-8207160: ClassReader::adjustMethodParams can potentially
    return null if the args list is empty
    + JDK-8207247: AARCH64: Enable Minimal and Client VM builds
    + JDK-8207404: MulticastSocket tests failing on AIX
    + JDK-8207779: Method::is_valid_method() compares 'this' with
    NULL
    + JDK-8208061: runtime/LoadClass/TestResize.java fails with
    "Load factor too high" when running in CDS mode.
    + JDK-8209459: TestSHA512MultiBlockIntrinsics failed on AArch64
    + JDK-8210443: Migrate Locale matching tests to JDK Repo.
    + JDK-8213231: ThreadSnapshot::_threadObj can become stale
    + JDK-8213483: ARM32: runtime/ErrorHandling/
    /ShowRegistersOnAssertTest.java jtreg test fail
    + JDK-8213725: JShell NullPointerException due to class file
    with unexpected package
    + JDK-8213794: ARM32: disable TypeProfiling,
    CriticalJNINatives, Serviceablity tests for ARM32
    + JDK-8213845: ARM32: Interpreter doesn't call result handler
    after native calls
    + JDK-8214128: ARM32: wrong stack alignment on
    Deoptimization::unpack_frames
    + JDK-8214512: ARM32: Jtreg test compiler/c2/Test8062950.java
    fails on ARM
    + JDK-8214854: JDWP: Unforseen output truncation in logging
    + JDK-8214922: Add vectorization support for fmin/fmax
    + JDK-8215009: GCC 8 compilation error in libjli
    + JDK-8216184: CDS/appCDS tests failed on Windows due to long
    path to a classlist file
    + JDK-8216259: AArch64: Vectorize Adler32 intrinsics
    + JDK-8216314: SIGILL in CodeHeapState::print_names()
    + JDK-8217348: assert(thread-&gt;is_Java_thread()) failed: just
    checking
    + JDK-8217465: [REDO] - Optimize CodeHeap Analytics
    + JDK-8217561: X86: Add floating-point Math.min/max intrinsics
    + JDK-8217918: C2: -XX:+AggressiveUnboxing is broken
    + JDK-8218458: [TESTBUG] runtime/NMT/
    /CheckForProperDetailStackTrace.java fails with Expected
    stack trace missing from output
    + JDK-8219142: Remove unused JIMAGE_ResourcePath
    + JDK-8219586: CodeHeap State Analytics processes dead nmethods
    + JDK-8220074: Clean up GCC 8.3 errors in LittleCMS
    + JDK-8220407: compiler/intrinsics/math/
    /TestFpMinMaxIntrinsics.java timedout
    + JDK-8222302: [TESTBUG] test/hotspot/jtreg/compiler/intrinsics/
    /sha/cli/TestUseSHAOptionOnUnsupportedCPU.java fails on any
    other CPU
    + JDK-8222412: AARCH64: multiple instructions encoding issues
    + JDK-8223020: aarch64: expand minI_rReg and maxI_rReg patterns
    into separate instructions
    + JDK-8223444: Improve CodeHeap Free Space Management
    + JDK-8223504: Improve performance of forall loops by better
    inlining of "iterator()" methods
    + JDK-8223667: ASAN build broken
    + JDK-8225081: Remove Telia Company CA certificate expiring in
    April 2021
    + JDK-8225116: Test OwnedWindowsLeak.java intermittently fails
    + JDK-8225438: javax/net/ssl/TLSCommon/
    /TestSessionLocalPrincipal.java failed with Read timed out
    + JDK-8225756: [testbug] compiler/loopstripmining/
    /CheckLoopStripMining.java sets too short a
    SafepointTimeoutDelay
    + JDK-8226374: Restrict TLS signature schemes and named groups
    + JDK-8226627: assert(t-&gt;singleton()) failed: must be a constant
    + JDK-8226721: Missing intrinsics for Math.ceil, floor, rint
    + JDK-8227080: (fs) Files.newInputStream(...).skip(n) is slow
    + JDK-8227222: vmTestbase/jit/FloatingPoint/gen_math/Loops04/
    /Loops04.java failed XMM register should be 0-15
    + JDK-8227609: (fs) Files.newInputStream(...).skip(n) should
    allow skipping beyond file size
    + JDK-8230428: Cleanup dead CastIP node code in formssel.cpp
    + JDK-8231460: Performance issue (CodeHeap) with large free
    blocks
    + JDK-8231713: x86_32 build failures after JDK-8226721 (Missing
    intrinsics for Math.ceil, floor, rint)
    + JDK-8231841: AArch64: debug.cpp help() is missing an AArch64
    line for pns
    + JDK-8232084: HotSpot build failed with GCC 9.2.1
    + JDK-8232591: AArch64: Add missing match rules for smaddl,
    smsubl and smnegl
    + JDK-8233185: HttpServer.stop() blocks indefinitely when
    called on dispatch thread
    + JDK-8233787: Break cycle in vm_version* includes
    + JDK-8233948: AArch64: Incorrect mapping between OptoReg and
    VMReg for high 64 bits of Vector Register
    + JDK-8234355: Buffer overflow in jcmd GC.class_stats due to
    too many classes
    + JDK-8235368: Update BCEL to Version 6.4.1
    + JDK-8236859: WebSocket over authenticating proxy fails with
    NPE
    + JDK-8236992: AArch64: remove redundant load_klass in itable
    stub
    + JDK-8237743: test/langtools/jdk/jshell/
    /FailOverExecutionControlTest.java fails No
    ExecutionControlProvider with name 'nonExistent' and parameter
    keys: []
    + JDK-8237804: sun/security/mscapi tests fail with "Key pair
    not generated, alias &lt;nnnnnn&gt; already exists"
    + JDK-8238175: CTW: Class.getDeclaredMethods fails with
    assert(k-&gt;is_subclass_of(SystemDictionary::Throwable_klass()))
    failed: invalid exception class
    + JDK-8238567: SoftMainMixer.processAudioBuffers(): Wrong
    handling of stoppedMixers
    + JDK-8238812: assert(false) failed: bad AD file
    + JDK-8239312: [macos] javax/swing/JFrame/NSTexturedJFrame/
    /NSTexturedJFrame.java
    + JDK-8239386: handle ContendedPaddingWidth in
    vm_version_aarch64
    + JDK-8239536: Can't use 'java.util.List' object after
    importing 'java.awt.List'
    + JDK-8240487: Cleanup whitespace in .cc, .hh, .m, and .mm files
    + JDK-8240848: ArrayIndexOutOfBoundsException buf for
    TextCallbackHandler
    + JDK-8241082: Upgrade IANA Language Subtag Registry data to
    03-16-2020 version
    + JDK-8241087: Build failure with VS 2019 (16.5.0) due to C2039
    and C2873
    + JDK-8241101: [s390] jtreg test failure after JDK-8238696: not
    conformant features string
    + JDK-8241248: NullPointerException in
    sun.security.ssl.HKDF.extract(HKDF.java:93)
    + JDK-8241372: Several test failures due to
    javax.net.ssl.SSLException: Connection reset
    + JDK-8241475: AArch64: Add missing support for PopCountVI node
    + JDK-8241829: Cleanup the code for PrinterJob on windows
    + JDK-8241960: The SHA3 message digests impl of SUN provider
    are not thread safe after cloned
    + JDK-8242010: Upgrade IANA Language Subtag Registry to Version
    2020-04-01
    + JDK-8242429: Better implementation for sign extract
    + JDK-8242557: Add length limit for strings in PNGImageWriter
    + JDK-8242919: Paste locks up jshell
    + JDK-8243155: AArch64: Add support for SqrtVF
    + JDK-8243240: AArch64: Add support for MulVB
    + JDK-8243452: JFR: Could not create chunk in repository with
    over 200 recordings
    + JDK-8243559: Remove root certificates with 1024-bit keys
    + JDK-8243597: AArch64: Add support for integer vector abs
    + JDK-8244031: HttpClient should have more tests for HEAD
    requests
    + JDK-8244205: HTTP/2 tunnel connections through proxy may be
    reused regardless of which proxy is selected
    + JDK-8244847: Linux/PPC: runtime/CompressedOops/
    /CompressedClassPointers: smallHeapTest fails
    + JDK-8245511: G1 adaptive IHOP does not account for
    reclamation of humongous objects by young GC
    + JDK-8246274: G1 old gen allocation tracking is not in a
    separate class
    + JDK-8247354: [aarch64] PopFrame causes
    assert(oopDesc::is_oop(obj)) failed: not an oop
    + JDK-8247408: IdealGraph bit check expression canonicalization
    + JDK-8247432: Update IANA Language Subtag Registry to Version
    2020-09-29
    + JDK-8247438: JShell: When FailOverExecutionControlProvider
    fails the proximal cause is not shown
    + JDK-8247753: UIManager.getSytemLookAndFeelClassName() returns
    wrong value on Fedora 32
    + JDK-8248043: Need to eliminate excessive i2l conversions
    + JDK-8248411: [aarch64] Insufficient error handling when
    CodeBuffer is exhausted
    + JDK-8248568: compiler/c2/TestBit.java failed: test missing
    from stdout/stderr
    + JDK-8248870: AARCH64: I2L/L2I conversions can be skipped for
    masked positive values
    + JDK-8249142: java/awt/FontClass/CreateFont/DeleteFont.sh is
    unstable
    + JDK-8249189: AARCH64: more L2I conversions can be skipped
    + JDK-8249719: MethodHandle performance suffers from bad
    ResolvedMethodTable hash function
    + JDK-8249875: GCC 10 warnings -Wtype-limits with JFR code
    + JDK-8250635: MethodArityHistogram should use Compile_lock in
    favour of fancy checks
    + JDK-8250876: Fix issues with cross-compile on macos
    + JDK-8251031: Some vmTestbase/nsk/monitoring/RuntimeMXBean
    tests fail with hostnames starting from digits
    + JDK-8251525: AARCH64: Faster Math.signum(fp)
    + JDK-8252259: AArch64: Adjust default value of FLOATPRESSURE
    + JDK-8252311: AArch64: save two words in itable lookup stub
    + JDK-8252779: compiler/graalunit/HotspotTest.java failed after
    8251525
    + JDK-8252883: AccessDeniedException caused by delayed file
    deletion on Windows
    + JDK-8253167: ARM32 builds fail after JDK-8247910
    + JDK-8253572: [windows] CDS archive may fail to open with long
    file names
    + JDK-8253923: C2 doesn't always run loop opts for compilations
    that include loops
    + JDK-8253948: Memory leak in ImageFileReader
    + JDK-8254631: Better support ALPN byte wire values in SunJSSE
    + JDK-8254717: isAssignableFrom checks in
    KeyFactorySpi.engineGetKeySpec appear to be backwards
    + JDK-8255086: Update the root locale display names
    + JDK-8255625: AArch64: Implement Base64.encodeBlock
    accelerator/intrinsic
    + JDK-8255763: C2: OSR miscompilation caused by invalid memory
    instruction placement
    + JDK-8255992: JFR EventWriter does not use first string from
    StringPool with id 0
    + JDK-8256037: [TESTBUG] com/sun/jndi/dns/ConfigTests/
    /PortUnreachable.java fails due to the hard coded threshold
    is small
    + JDK-8256244: java/lang/ProcessHandle/PermissionTest.java
    fails with TestNG 7.1
    + JDK-8256287: [windows] add loop fuse to
    map_or_reserve_memory_aligned
    + JDK-8256523: Streamline Java SHA2 implementation
    + JDK-8257414: Drag n Drop target area is wrong on high DPI
    systems
    + JDK-8257569: Failure observed with
    JfrVirtualMemory::initialize
    + JDK-8257574: C2: "failed: parsing found no loops but there
    are some" assert failure
    + JDK-8257580: Bump update version for OpenJDK: jdk-11.0.12
    + JDK-8257604: JNI_ArgumentPusherVaArg leaks valist
    + JDK-8257621: JFR StringPool misses cached items across
    consecutive recordings
    + JDK-8257796: [TESTBUG]
    TestUseSHA512IntrinsicsOptionOnSupportedCPU.java fails
    on x86_32
    + JDK-8257822: C2 crashes with SIGFPE due to a division that
    floats above its zero check
    + JDK-8257828: SafeFetch may crash if invoked in non-JavaThreads
    + JDK-8257853: Remove dependencies on JNF's JNI utility
    functions in AWT and 2D code
    + JDK-8257858: [macOS]: Remove JNF dependency from
    libosxsecurity/KeystoreImpl.m
    + JDK-8257860: [macOS]: Remove JNF dependency from
    libosxkrb5/SCDynamicStoreConfig.m
    + JDK-8257988: Remove JNF dependency from
    libsaproc/MacosxDebuggerLocal.m
    + JDK-8258414: OldObjectSample events too expensive
    + JDK-8258505: [TESTBUG] TestDivZeroWithSplitIf.java fails due
    to missing UnlockDiagnosticVMOptions
    + JDK-8258753: StartTlsResponse.close() hangs due to
    synchronization issues
    + JDK-8259061: C2: assert(found) failed: memory-writing node is
    not placed in its original loop or an ancestor of it
    + JDK-8259227: C2 crashes with SIGFPE due to a division that
    floats above its zero check
    + JDK-8259232: Bad JNI lookup during printing
    + JDK-8259276: C2: Empty expression stack when reexecuting
    tableswitch/lookupswitch instructions after deoptimization
    + JDK-8259343: [macOS] Update JNI error handling in Cocoa code.
    + JDK-8259585: Accessible actions do not work on mac os x
    + JDK-8259651: [macOS] Replace JNF_COCOA_ENTER/EXIT macros
    + JDK-8259662: Don't wrap SocketExceptions into SSLExceptions
    in SSLSocketImpl
    + JDK-8259710: Inlining trace leaks memory
    + JDK-8259729: Missed JNFInstanceOf -&gt; IsInstanceOf conversion
    + JDK-8259777: Incorrect predication condition generated by ADLC
    + JDK-8259786: initialize last parameter of getpwuid_r
    + JDK-8259843: initialize dli_fname array before calling
    dll_address_to_library_name
    + JDK-8259869: [macOS] Remove desktop module dependencies on
    JNF Reference APIs
    + JDK-8259886: Improve SSL session cache performance and
    scalability
    + JDK-8259983: do not use uninitialized expand_ms value in
    G1CollectedHeap::expand_heap_after_young_collection
    + JDK-8260030: Improve stringStream buffer handling
    + JDK-8260236: better init AnnotationCollector _contended_group
    + JDK-8260255: C1: LoopInvariantCodeMotion constructor can
    leave some fields uninitialized
    + JDK-8260284: C2: assert(_base == Int) failed: Not an Int
    + JDK-8260380: Upgrade to LittleCMS 2.12
    + JDK-8260420: C2 compilation fails with assert(found_sfpt)
    failed: no node in loop that's not input to safepoint
    + JDK-8260426: awt debug_mem.c DMem_AllocateBlock might leak
    memory
    + JDK-8260432: allocateSpaceForGP in freetypeScaler.c might
    leak memory
    + JDK-8260616: Removing remaining JNF dependencies in the
    java.desktop module
    + JDK-8260653: Unreachable nodes keep speculative types alive
    + JDK-8260707: java/lang/instrument/PremainClass/
    /InheritAgent0100.java times out
    + JDK-8260925: HttpsURLConnection does not work  with other
    JSSE provider.
    + JDK-8260926: Trace resource exhausted events unconditionally
    + JDK-8261020: Wrong format parameter in
    create_emergency_chunk_path
    + JDK-8261027: AArch64: Support for LSE atomics C++ HotSpot code
    + JDK-8261167: print_process_memory_info add a close call after
    fopen
    + JDK-8261170: Upgrade to freetype 2.10.4
    + JDK-8261198: [macOS] Incorrect JNI parameters in number
    conversion in A11Y code
    + JDK-8261235: C1 compilation fails with
    assert(res-&gt;vreg_number() == index) failed: conversion check
    + JDK-8261261: The version extra fields needs to be overridable
    in jib-profiles.js
    + JDK-8261262: Kitchensink24HStress.java crashed with
    EXCEPTION_ACCESS_VIOLATION
    + JDK-8261354: SIGSEGV at MethodIteratorHost
    + JDK-8261355: No data buffering in SunPKCS11 Cipher encryption
    when the underlying mechanism has no padding
    + JDK-8261397: try catch Method failing to work when dividing
    an integer by 0
    + JDK-8261422: Adjust problematic String.format calls in
    jdk/internal/util/Preconditions.java outOfBoundsMessage
    + JDK-8261447: MethodInvocationCounters frequently run into
    overflow
    + JDK-8261481: Cannot read Kerberos settings in dynamic store
    on macOS Big Sur
    + JDK-8261505: Test test/hotspot/jtreg/gc/parallel/
    /TestDynShrinkHeap.java killed by Linux OOM Killer
    + JDK-8261601: free memory in early return in
    Java_sun_nio_ch_sctp_SctpChannelImpl_receive0
    + JDK-8261649: AArch64: Optimize LSE atomics in C++ code
    + JDK-8261730: C2 compilation fails with
    assert(store-&gt;find_edge(load) != -1) failed: missing
    precedence edge
    + JDK-8261752: Multiple GC test are missing memory requirements
    + JDK-8261791: (sctp) handleSendFailed in SctpChannelImpl.c
    potential leaks
    + JDK-8261812: C2 compilation fails with assert(!had_error)
    failed: bad dominance
    + JDK-8261914: IfNode::fold_compares_helper faces
    non-canonicalized bool when running JRuby JSON workload
    + JDK-8262093: java/util/concurrent/tck/JSR166TestCase.java
    failed "assert(false) failed: unexpected node"
    + JDK-8262110: DST starts from incorrect time in 2038
    + JDK-8262121: [11u] Redo 8244287: JFR: Methods samples have
    line number 0
    + JDK-8262163: Extend settings printout in jcmd VM.metaspace
    + JDK-8262295: C2: Out-of-Bounds Array Load from Clone Source
    + JDK-8262298: G1BarrierSetC2::step_over_gc_barrier fails with
    assert "bad barrier shape"
    + JDK-8262446: DragAndDrop hangs on Windows
    + JDK-8262461: handle wcstombsdmp return value correctly in
    unix awt_InputMethod.c
    + JDK-8262465: Very long compilation times and high memory
    consumption in C2 debug builds
    + JDK-8262726: AArch64: C1 StubAssembler::call_RT can corrupt
    stack
    + JDK-8262739: String inflation C2 intrinsic prevents insertion
    of anti-dependencies
    + JDK-8262829: Native crash in
    Win32PrintServiceLookup.getAllPrinterNames()
    + JDK-8262837: handle split_USE correctly
    + JDK-8262900: ToolBasicTest fails to access HTTP server it
    starts
    + JDK-8263260: [s390] Support latest hardware (z14 and z15)
    + JDK-8263311: Watch registry changes for remote printers
    update instead of polling
    + JDK-8263361: Incorrect arraycopy stub selected by C2 for SATB
    collectors
    + JDK-8263404: RsaPrivateKeySpec is always recognized as
    RSAPrivateCrtKeySpec in RSAKeyFactory.engineGetKeySpec
    + JDK-8263425: AArch64: two potential bugs in C1
    LIRGenerator::generate_address()
    + JDK-8263448: CTW: fatal error: meet not symmetric
    + JDK-8263504: Some OutputMachOpcodes fields are uninitialized
    + JDK-8263557: Possible NULL dereference in
    Arena::destruct_contents()
    + JDK-8263558: Possible NULL dereference in fast path arena
    free if ZapResourceArea is true
    + JDK-8263676: AArch64: one potential bug in C1
    LIRGenerator::generate_address()
    + JDK-8263729: [test] divert spurious output away from stream
    under test in ProcessBuilder Basic test
    + JDK-8263846: Bad JNI lookup getFocusOwner in accessibility
    code on Mac OS X
    + JDK-8264047: Duplicate global variable 'jvm' in libjavajpeg
    and libawt
    + JDK-8264096: slowdebug jvm crashes when StrInflatedCopy match
    rule is not supported
    + JDK-8264151: ciMethod::ensure_method_data() should return
    false is loading resulted in empty state
    + JDK-8264173: [s390] Improve Hardware Feature Detection And
    Reporting
    + JDK-8264190: Harden TLS interop tests
    + JDK-8264223: CodeHeap::verify fails extra_hops assertion in
    fastdebug test
    + JDK-8264328: Broken license in
    javax/swing/JComboBox/8072767/bug8072767.java
    + JDK-8264360: Loop strip mining verification fails with
    "should be on the backedge"
    + JDK-8264626: C1 should be able to inline excluded methods
    + JDK-8264640: CMS ParScanClosure misses a barrier
    + JDK-8264786: [macos] All Swing/AWT apps cause Allow
    Notifications prompt to appear when app is launched
    + JDK-8264821: DirectIOTest fails on a system with large block
    size
    + JDK-8264848: [macos] libjvm.dylib linker warning due to macOS
    version mismatch
    + JDK-8264923: PNGImageWriter.write_zTXt throws Exception with
    a typo
    + JDK-8264958: C2 compilation fails with assert "n is later
    than its clone"
    + JDK-8265099: Revert backport to 11u of 8236859: WebSocket
    over authenticating proxy fails with NPE
    + JDK-8265154: vinserti128 operand mix up for KNL platforms
    + JDK-8265239: Shenandoah: Shenandoah heap region count could
    be off by 1
    + JDK-8265417: Backport of JDK-8249672 breaks Solaris x86 build
    + JDK-8265421: java/lang/String/StringRepeat.java test is
    missing a memory requirement
    + JDK-8265462: Handle multiple slots in the NSS Internal Module
    from SunPKCS11's Secmod
    + JDK-8265537: x86 version string truncated after JDK-8249672
    11u backport
    + JDK-8265666: Enable AIX build platform to make external debug
    symbols
    + JDK-8265677: CMS: CardTableBarrierSet::write_ref_array_work()
    lacks storestore barrier
    + JDK-8265690: Use the latest Ubuntu base image version in
    Docker testing
    + JDK-8265718: Build failure after JDK-8258414 11u backport
    + JDK-8265750: Fatal error in safepoint.cpp after backport of
    8258414
    + JDK-8265784: [C2] Hoisting of DecodeN leaves MachTemp inputs
    behind
    + JDK-8265938: C2's conditional move optimization does not
    handle top Phi
    + JDK-8266220: keytool still prompt for store password on a
    password-less pkcs12 file if -storetype pkcs12 is specified
    + JDK-8266293: Key protection using PBEWithMD5AndDES fails with
    "java.security.InvalidAlgorithmParameterException: Salt must
    be 8 bytes long"
    + JDK-8266713: [AIX] Build failure after 11u backport of
    JDK-8247753
    + JDK-8266802: Shenandoah: Round up region size to page size
    unconditionally
    + JDK-8266892: avoid maybe-uninitialized gcc warnings on linux
    s390x
    + JDK-8266929: Unable to use algorithms from 3p providers
    + JDK-8267235: [macos_aarch64]
    InterpreterRuntime::throw_pending_exception messing up LR
    results in crash
    + JDK-8267561: Shenandoah: Reference processing not properly
    setup for outside of cycle degenerated GC
    + JDK-8267599: Revert the change to the default PKCS12
    macAlgorithm and macIterationCount props for 11u/8u/7u
    + JDK-8267641: [11u] 8227609 backport typo
    + JDK-8267721: Enable sun/security/pkcs11 tests for Amazon
    Linux 2 AArch64
    + JDK-8268678: LetsEncryptCA.java test fails as Let's Encrypt
    Authority X3 is retired</changelog>
  <changelog author="schwab@suse.de" date="1628078400">- riscv64-zero.patch: Add support for riscv64 (zero VM)</changelog>
  <changelog author="fstrba@suse.com" date="1629979200">- Added patch:
  * jdk11-glibc234.patch
    + fix build with glibc-2.34 (bsc#1189201)</changelog>
  <changelog author="fstrba@suse.com" date="1631534400">- Modified patch:
  * nss-security-provider.patch
    + revert recent changes making NSS provider the default one
    + fixes bsc#1190252</changelog>
  <changelog author="fstrba@suse.com" date="1631793600">- Added patch:
  * fips.patch
    + implement FIPS support in OpenJDK</changelog>
  <changelog author="fstrba@suse.com" date="1634817600">- Update to upstream tag jdk-11.0.13+8 (October 2021 CPU)
  * Security fixes
    + JDK-8163326, CVE-2021-35550, bsc#1191901: Update the default
    enabled cipher suites preference
    + JDK-8254967, CVE-2021-35565, bsc#1191909:
    com.sun.net.HttpsServer spins on TLS session close
    + JDK-8263314: Enhance XML Dsig modes
    + JDK-8265167, CVE-2021-35556, bsc#1191910: Richer Text Editors
    + JDK-8265574: Improve handling of sheets
    + JDK-8265580, CVE-2021-35559, bsc#1191911: Enhanced style for
    RTF kit
    + JDK-8265776: Improve Stream handling for SSL
    + JDK-8266097, CVE-2021-35561, bsc#1191912: Better hashing
    support
    + JDK-8266103: Better specified spec values
    + JDK-8266109: More Resilient Classloading
    + JDK-8266115: More Manifest Jar Loading
    + JDK-8266137, CVE-2021-35564, bsc#1191913: Improve Keystore
    integrity
    + JDK-8266689, CVE-2021-35567, bsc#1191903: More Constrained
    Delegation
    + JDK-8267086: ArrayIndexOutOfBoundsException in
    java.security.KeyFactory.generatePublic
    + JDK-8267712: Better LDAP reference processing
    + JDK-8267729, CVE-2021-35578, bsc#1191904: Improve TLS client
    handshaking
    + JDK-8267735, CVE-2021-35586, bsc#1191914: Better BMP support
    + JDK-8268193: Improve requests of certificates
    + JDK-8268199: Correct certificate requests
    + JDK-8268205: Enhance DTLS client handshake
    + JDK-8268506: More Manifest Digests
    + JDK-8269618, CVE-2021-35603, bsc#1191906: Better session
    identification
    + JDK-8269624: Enhance method selection support
    + JDK-8270398: Enhance canonicalization
    + JDK-8270404: Better canonicalization
  * Other changes
    + JDK-8024368: private methods are allocated vtable indices
    + JDK-8042902: Test java/net/Inet6Address/serialize/
    /Inet6AddressSerializationTest.java fails intermittently
    + JDK-8140466: ChaCha20 and Poly1305 TLS Cipher Suites
    + JDK-8157404: Unable to read certain PKCS12 keystores from
    SequenceInputStream
    + JDK-8158066: SourceDebugExtensionTest fails to rename file
    + JDK-8168304: Make all of DependencyContext_test available in
    product mode
    + JDK-8169246: java/net/DatagramSocket/ReportSocketClosed.java
    fails intermittently with BindException
    + JDK-8181313: SA: Remove libthread_db dependency on Linux
    + JDK-8193214: Incorrect annotations.without.processors
    warnings with JDK 9
    + JDK-8194230: jdk/internal/jrtfs/remote/
    /RemoteRuntimeImageTest.java fails with
    java.lang.NullPointerException
    + JDK-8196092: javax/swing/JComboBox/8032878/bug8032878.java
    fails
    + JDK-8199931: java/net/MulticastSocket/
    /UnreferencedMulticastSockets.java fails with "incorrect data
    received"
    + JDK-8206083: Make tools/javac/api/T6265137.java robust to JDK
    version changes
    + JDK-8206350: java/util/Locale/bcp47u/SystemPropertyTests.java
    failed on Mac 10.13 with zh_CN and zh_TW locales.
    + JDK-8207316: java/nio/channels/spi/SelectorProvider/
    /inheritedChannel/InheritedChannelTest.java failed
    + JDK-8208227: tools/jdeps/DotFileTest.java fails on Win-X64
    + JDK-8208363: test/jdk/java/lang/Package/
    /PackageFromManifest.java missing module dependencies
    declaration
    + JDK-8209380: ARM: cleanup maybe-uninitialized and reorder
    compiler warnings
    + JDK-8209768: Refactor java/util/prefs/CheckUserPrefsStorage.sh
    to plain java test
    + JDK-8209772: Refactor shell test java/util/ServiceLoader/
    /basic/basic.sh to java
    + JDK-8209773: Refactor shell test javax/naming/module/basic.sh
    to java
    + JDK-8209832: Refactor jdk/internal/reflect/Reflection/
    /GetCallerClassTest.sh to plain java test
    + JDK-8209930: Refactor java/util/zip/ZipFile/deletetempjar.sh
    to plain java test
    + JDK-8210406: Refactor java.util.PluggableLocale:i18n shell
    tests to plain java tests
    + JDK-8210407: Refactor java.util.Calendar:i18n shell tests to
    plain java tests
    + JDK-8210495: compiler crashes because of illegal signature in
    otherwise legal code
    + JDK-8210669: Some launcher tests assume a pre-JDK 9 run-time
    image layout
    + JDK-8210802: temp files left by tests in
    jdk/java/net/httpclient
    + JDK-8210819: Update the host name in CNameTest.java
    + JDK-8210908: Refactor java/util/prefs/PrefsSpi.sh to plain
    java test
    + JDK-8210934: Move sun/net/www/protocol/http/
    /GetErrorStream.java to OpenJDK
    + JDK-8210959: JShell fails and exits when statement throws an
    exception whose message contains a '%'.
    + JDK-8211055: Provide print to a file (PDF) feature even when
    printer was not connected
    + JDK-8211092: test/jdk/sun/net/www/http/HttpClient/
    /MultiThreadTest.java fails intermittently when cleaning up
    + JDK-8211296: Remove HotSpot deprecation warning suppression
    for Mac/clang
    + JDK-8211325: test/jdk/java/net/Socket/LingerTest.java fails
    with cleaning up
    + JDK-8212040: Compilation error due to wrong usage of
    NSPrintJobDispositionValue in mac10.12
    + JDK-8212695: Add explicit timeout to several HTTP Client tests
    + JDK-8212718: Refactor some annotation processor tests to
    better use collections
    + JDK-8213007: Update the link in test/jdk/sun/security/
    /provider/SecureRandom/DrbgCavp.java
    + JDK-8213137: Remove static initialization of monitor/mutex
    instances
    + JDK-8213235: java/nio/channels/SocketChannel/
    /AsyncCloseChannel.java fails with threads that didn't exit
    + JDK-8213409: Refactor sun.text.IntHashtable:i18n shell tests
    to plain java tests
    + JDK-8213576: Make test AsyncCloseChannel.java run in othervm
    + JDK-8213694: Test Timeout.java should run in othervm mode
    + JDK-8213718: [TEST] Wrong classname in vmTestbase/nsk/stress/
    /except/except002 and except003
    + JDK-8213922: fix ctw stand-alone build
    + JDK-8214195: Align stdout messages in
    test/jdk/java/math/BigInteger/PrimitiveConversionTests.java
    + JDK-8214520: [TEST_BUG] sun/security/mscapi/nonUniqueAliases/
    /NonUniqueAliases.java failed with incorrect jtreg tags order
    + JDK-8214937: sun/security/tools/jarsigner/warnings/
    /NoTimestampTest.java failed due to unexpected expiration date
    + JDK-8216532: tools/launcher/Test7029048.java fails (Solaris)
    + JDK-8217825: Verify @AfterTest is used correctly in WebSocket
    tests
    + JDK-8218145: block_if_requested is not proper inlined due to
    size
    + JDK-8219417: bump jtreg requiredVersion to b14
    + JDK-8219552: bump jtreg requiredVersion to b14 in
    test/jdk/sanity/client/
    + JDK-8219804: java/net/MulticastSocket/Promiscuous.java fails
    intermittently due to NumberFormatException
    + JDK-8220445: Support for side by side MSVC Toolset versions
    + JDK-8221988: add possibility to build with Visual Studio 2019
    + JDK-8222751: closed/test/jdk/sun/security/util/
    /DerIndefLenConverter/IndefBerPkcs12.java fail
    + JDK-8223050: JVMCI: findUniqueConcreteMethod() should not use
    Dependencies::find_unique_concrete_method() for non-virtual
    methods
    + JDK-8224853: CDS address sanitizer errors
    + JDK-8225082: Remove IdenTrust certificate that is expiring in
    September 2021
    + JDK-8225583: Examine the HttpResponse.BodySubscribers for
    null handling and multiple subscriptions
    + JDK-8225690: Multiple AttachListener threads can be created
    + JDK-8225790: Two NestedDialogs tests fail on Ubuntu
    + JDK-8226319: Add forgotten test/jdk/java/net/httpclient/
    /BodySubscribersTest.java
    + JDK-8226533: JVMCI: findUniqueConcreteMethod should handle
    statically bindable methods directly
    + JDK-8226602: Test convenience reactive primitives from
    java.net.http with RS TCK
    + JDK-8226683: Remove review suggestion from fix to 8219804
    + JDK-8227738: jvmti/DataDumpRequest/datadumpreq001 failed due
    to "exit code is 134"
    + JDK-8227766: CheckUnhandledOops is broken in MemAllocator
    + JDK-8227815: Minimal VM: set_state is not a member of
    AttachListener
    + JDK-8230674: Heap dumps should exclude dormant CDS archived
    objects of unloaded classes
    + JDK-8230808: Remove Access::equals()
    + JDK-8230841: Remove oopDesc::equals()
    + JDK-8231717: Improve performance of charset decoding when
    charset is always compactable
    + JDK-8232243: Wrong caret position in JTextPane on Windows
    with a screen resolution &gt; 100%
    + JDK-8232782: Shenandoah: streamline post-LRB CAS barrier
    (aarch64)
    + JDK-8233790: Forward output from heap dumper to jcmd/jmap
    + JDK-8233989: Create an IPv4 version of
    java/net/MulticastSocket/SetLoopbackMode.java
    + JDK-8234510: Remove file seeking requirement for writing a
    heap dump
    + JDK-8235211: serviceability/attach/
    /RemovingUnixDomainSocketTest.java fails with
    AttachNotSupportedException: Unable to open socket file
    + JDK-8235216: typo in test filename
    + JDK-8235866: bump jtreg requiredVersion to 4.2b16
    + JDK-8236111: narrow allowSmartActionArgs disabling
    + JDK-8236413: AbstractConnectTimeout should tolerate both
    NoRouteToHostException and UnresolvedAddressException
    + JDK-8236671: NullPointerException in JKS keystore
    + JDK-8238930: problem list compiler/c2/Test8004741.java
    + JDK-8238943: switch to jtreg 5.0
    + JDK-8240555: Using env of JAVA_TOOL_OPTIONS and _JAVA_OPTIONS
    breaks QuietOption.java test
    + JDK-8240983: Incorrect copyright header in Apache Santuario
    2.1.3 files
    + JDK-8241336: Some java.net tests failed with
    NoRouteToHostException on MacOS with special network
    configuration
    + JDK-8241353: NPE in ToolProvider.getSystemJavaCompiler
    + JDK-8241768: git needs .gitattributes
    + JDK-8242882: opening jar file with large manifest might throw
    NegativeArraySizeException
    + JDK-8244973: serviceability/attach/
    /RemovingUnixDomainSocketTest.java fails "stderr was not
    empty"
    + JDK-8245134: test/lib/jdk/test/lib/security/
    /KeyStoreUtils.java should allow to specify aliases
    + JDK-8246261: TCKLocalTime.java failed due to "AssertionError:
    expected [18:14:22] but found [18:14:23]"
    + JDK-8246387: switch to jtreg 5.1
    + JDK-8247421: [TESTBUG] ReturnBlobToWrongHeapTest.java failed
    allocating blob
    + JDK-8247469: getSystemCpuLoad() returns -1 on linux when some
    offline cpus are present and cpusets.effective_cpus is not
    available
    + JDK-8248352: [TEST_BUG] Test test/jdk/java/awt/font/
    /TextLayout/ArabicDiacriticTest.java can leave frame open
    + JDK-8248403: AArch64: Remove uses of kernel integer types
    + JDK-8248414: AArch64: Remove uses of long and unsigned long
    ints
    + JDK-8248657: Windows: strengthening in ThreadCritical
    regarding memory model
    + JDK-8248666: AArch64: Use THREAD_LOCAL instead of __thread
    + JDK-8248668: AArch64: Avoid MIN/MAX macros when using MSVC
    + JDK-8248671: AArch64: Remove unused variables
    + JDK-8248682: AArch64: Use ATTRIBUTE_ALIGNED helper
    + JDK-8248816: C1: Fix signature conflict in
    LIRGenerator::strength_reduce_multiply
    + JDK-8249095: tools/javac/launcher/SourceLauncherTest.java
    fails on Windows
    + JDK-8249548: backward focus traversal gets stuck in button
    group
    + JDK-8249773: Upgrade ReceiveISA.java test to be resilient to
    failure due to stray packets and interference
    + JDK-8249897: jdk/javadoc/tool/LangVers.java uses @ignore w/o
    bug-id
    + JDK-8249898: jdk/javadoc/tool/6176978/T6176978.java uses
    @ignore w/o bug-id
    + JDK-8249899: jdk/javadoc/tool/InlineTagsWithBraces.java uses
    @ignore w/o bug-id
    + JDK-8250588: Shenandoah: LRB needs to save/restore fp
    registers for runtime call
    + JDK-8250824: AArch64: follow up for JDK-8248414
    + JDK-8251166: Add automated testcases for changes done in
    JDK-8214112
    + JDK-8251252: Add automated testcase for fix done in
    JDK-8214253
    + JDK-8251254: Add automated test for fix done in JDK-8218472
    + JDK-8251361: Potential race between Logger configuration and
    GCs in HttpURLConWithProxy test
    + JDK-8251549: Update docs on building for Git
    + JDK-8251945: SIGSEGV in
    PackageEntry::purge_qualified_exports()
    + JDK-8252194: Add automated test for fix done in JDK-8218469
    + JDK-8252648: Shenandoah: name gang tasks consistently
    + JDK-8252825: Add automated test for fix done in JDK-8218479
    + JDK-8252853: AArch64: gc/shenandoah/TestVerifyJCStress.java
    fails intermittently with C1
    + JDK-8252857: AArch64: Shenandoah C1 CAS is not sequentially
    consistent
    + JDK-8253048: AArch64: When CallLeaf, no need to preserve
    callee-saved registers in caller
    + JDK-8253424: Add support for running pre-submit testing using
    GitHub Actions
    + JDK-8253631: Remove unimplemented CompileBroker methods after
    JEP-165
    + JDK-8253865: Pre-submit testing using GitHub Actions does not
    detect failures reliably
    + JDK-8253899: Make IsClassUnloadingEnabled signature match
    specification
    + JDK-8254024: Enhance native libs for AWT and Swing to work
    with GraalVM Native Image
    + JDK-8254054: Pre-submit testing using GitHub Actions should
    not use the deprecated set-env command
    + JDK-8254173: Add Zero, Minimal hotspot targets to submit
    workflow
    + JDK-8254175: Build no-pch configuration in debug mode for
    submit checks
    + JDK-8254244: Some code emitted by TemplateTable::branch is
    unused when running TieredCompilation
    + JDK-8254270: linux 32 bit build doesn't compile
    libjdwp/log_messages.c
    + JDK-8254282: Add Linux x86_32 builds to submit workflow
    + JDK-8254850: Update terminology in java.awt.GridBagLayout
    source code comments
    + JDK-8255255: Update Apache Santuario (XML Signature) to
    version 2.2.1
    + JDK-8255305: Add Linux x86_32 tier1 to submit workflow
    + JDK-8255352: Archive important test outputs in submit workflow
    + JDK-8255373: Submit workflow artifact name is always
    "test-results_.zip"
    + JDK-8255452: Doing GC during JVMTI MethodExit event posting
    breaks return oop
    + JDK-8255718: Zero: VM should know it runs in interpreter-only
    mode
    + JDK-8255790: GTKL&amp;F: Java 16 crashes on initialising GTKL&amp;F
    on Manjaro Linux
    + JDK-8255810: Zero: build fails without JVMTI
    + JDK-8255895: Submit workflow artifacts miss hs_errs/replays
    due to ZIP include mismatch
    + JDK-8256127: Add cross-compiled foreign architectures builds
    to submit workflow
    + JDK-8256215: Shenandoah: re-organize saving/restoring machine
    state in assembler code
    + JDK-8256267: Relax compiler/floatingpoint/NaNTest.java for
    x86_32 and lower -XX:+UseSSE
    + JDK-8256277: Github Action build on macOS should define OS
    and Xcode versions
    + JDK-8256354: Github Action build on Windows should define OS
    and MSVC versions
    + JDK-8256393: Github Actions build on Linux should define OS
    and GCC versions
    + JDK-8256414: add optimized build to submit workflow
    + JDK-8256747: GitHub Actions: decouple the hotspot build-only
    jobs from Linux x64 testing
    + JDK-8257056: Submit workflow should apt-get update to avoid
    package installation errors
    + JDK-8257148: Remove obsolete code in AWTView.m
    + JDK-8257497: Update keytool to create AKID from the SKID of
    the issuing certificate as specified by RFC 5280
    + JDK-8257620: Do not use objc_msgSend_stret to get macOS
    version
    + JDK-8257913: Add more known library locations to simplify
    Linux cross-compilation
    + JDK-8258703: Incorrect 512-bit vector registers restore on
    x86_32
    + JDK-8259338: Add expiry exception for identrustdstx3 alias to
    VerifyCACerts.java test
    + JDK-8259535: ECDSA SignatureValue do not always have the
    specified length
    + JDK-8259679: GitHub actions should use MSVC 14.28
    + JDK-8259924: GitHub actions fail on Linux x86_32 with "Could
    not configure libc6:i386"
    + JDK-8260460: GitHub actions still fail on Linux x86_32 with
    "Could not configure libc6:i386"
    + JDK-8260589: Crash in JfrTraceIdLoadBarrier::load(_jclass*)
    + JDK-8260923: Add more tests for SSLSocket input/output
    shutdown
    + JDK-8261072: AArch64: Fix MacroAssembler::get_thread
    convention
    + JDK-8261147: C2: Node is wrongly marked as reduction
    resulting in a wrong execution due to wrong vector instructions
    + JDK-8261238: NMT should not limit baselining by size threshold
    + JDK-8261496: Shenandoah: reconsider pacing updates memory
    ordering
    + JDK-8261652: Remove some dead comments from os_bsd_x86
    + JDK-8261846: [JVMCI] c2v_iterateFrames can get out of sync
    with the StackFrameStream
    + JDK-8262000: jdk/jfr/event/gc/detailed/
    /TestPromotionFailedEventWithParallelScavenge.java failed with
    "OutOfMemoryError: Java heap space"
    + JDK-8262017: C2: assert(n != __null) failed: Bad immediate
    dominator info.
    + JDK-8262392: Update Mesa 3-D Headers to version 21.0.3
    + JDK-8262409: sun/security/ssl/SSLSocketImpl/
    /SSLSocketImplThrowsWrongExceptions. SSL test failures caused
    by java failed with "Server reported the wrong exception"
    + JDK-8262470: Printed GlyphVector outline with low DPI has bad
    quality on Windows
    + JDK-8262862: Harden tests sun/security/x509/URICertStore/
    /ExtensionsWithLDAP.java and krb5/canonicalize/Test.java
    + JDK-8263136: C4530 was reported from VS 2019 at access bridge
    + JDK-8263227: C2: inconsistent spilling due to dead nodes in
    exception block
    + JDK-8263382: java/util/logging/ParentLoggersTest.java failed
    with "checkLoggers: getLoggerNames() returned unexpected
    loggers"
    + JDK-8263407: SPARC64 detection fails on Athena (SPARC64-X)
    + JDK-8263432: javac may report an invalid package/class clash
    on case insensitive filesystems
    + JDK-8263490: [macos] Crash occurs on JPasswordField with
    activated InputMethod
    + JDK-8263531: Remove unused buffer int
    + JDK-8263667: Avoid running GitHub actions on branches named
    pr/*
    + JDK-8263776: [JVMCI] add helper to perform Java upcalls
    + JDK-8264016: [JVMCI] add some thread local fields for use by
    JVMCI
    + JDK-8264752: SIGFPE crash with option
    FlightRecorderOptions:threadbuffersize=30M
    + JDK-8265132: C2 compilation fails with assert "missing
    precedence edge"
    + JDK-8265231: (fc) ReadDirect and WriteDirect tests fail after
    fix for JDK-8264821
    + JDK-8265335: Epsilon: Minor typo in EpsilonElasticTLABDecay
    description
    + JDK-8265756: AArch64: initialize memory allocated for locals
    according to Windows AArch64 stack page growth requirement in
    template interpreter
    + JDK-8265761: Font with missed font family name is not
    properly printed on Windows
    + JDK-8265773: incorrect jdeps message "jdk8internals" to
    describe a removed JDK internal API
    + JDK-8265836: OperatingSystemImpl.getCpuLoad() returns
    incorrect CPU load inside a container
    + JDK-8266018: Shenandoah: fix an incorrect assert
    + JDK-8266206: Build failure after JDK-8264752 with older GCCs
    + JDK-8266248: Compilation failure in
    PLATFORM_API_MacOSX_MidiUtils.c with Xcode 12.5
    + JDK-8266288: assert root method not found in
    witnessed_reabstraction_in_supers is too strong
    + JDK-8266404: Fatal error report generated with
  - XX:+CrashOnOutOfMemoryError should not contain suggestion to
    submit a bug report
    + JDK-8266480: Implicit null check optimization does not update
    control of hoisted memory operation
    + JDK-8266615: C2 incorrectly folds subtype checks involving an
    interface array
    + JDK-8266642: Improve ResolvedMethodTable hash function
    + JDK-8266749: AArch64: Backtracing broken on PAC enabled
    systems
    + JDK-8266761: AssertionError in
    sun.net.httpserver.ServerImpl.responseCompleted
    + JDK-8266813: Shenandoah: Use shorter instruction sequence for
    checking if marking in progress
    + JDK-8267042: bug in monitor locking/unlocking on ARM32 C1 due
    to uninitialized BasicObjectLock::_displaced_header
    + JDK-8267348: Rewrite gc/epsilon/TestClasses.java to use
    Metaspace with less classes
    + JDK-8267396: Avoid recording "pc" in unhandled oops detector
    for better performance
    + JDK-8267399: C2: java/text/Normalizer/ConformanceTest.java
    test failed with assertion
    + JDK-8267424: CTW: C1 fails with "State must not be null"
    + JDK-8267459: Pasting Unicode characters into JShell does not
    work.
    + JDK-8267625: AARCH64: typo in LIR_Assembler::emit_profile_type
    + JDK-8267666: Add option to jcmd GC.heap_dump to use existing
    file
    + JDK-8267695: Bump update version for OpenJDK: jdk-11.0.13
    + JDK-8267751: (test) jtreg.SkippedException has no serial
    VersionUID
    + JDK-8267773: PhaseStringOpts::int_stringSize doesn't handle
    min_jint correctly
    + JDK-8268103: JNI functions incorrectly return a double after
    JDK-8265836
    + JDK-8268127: Shenandoah: Heap size may be too small for
    region to align to large page size
    + JDK-8268261: C2: assert(n != __null) failed: Bad immediate
    dominator info.
    + JDK-8268347: C2: nested locks optimization may create
    unbalanced monitor enter/exit code
    + JDK-8268360: Missing check for infinite loop during node
    placement
    + JDK-8268362: [REDO] C2 crash when compile negative
    Arrays.copyOf length after loop
    + JDK-8268366: Incorrect calculation of has_fpu_registers in C1
    linear scan
    + JDK-8268369: SIGSEGV in PhaseCFG::implicit_null_check due to
    missing null check
    + JDK-8268417: Add test from JDK-8268360
    + JDK-8268427: Improve AlgorithmConstraints:checkAlgorithm
    performance
    + JDK-8268617: [11u REDO] - WebSocket over authenticating proxy
    fails with NPE
    + JDK-8268620: InfiniteLoopException test may fail on x86
    platforms
    + JDK-8268635: Corrupt oop in ClassLoaderData
    + JDK-8268699: Shenandoah: Add test for JDK-8268127
    + JDK-8268771: javadoc -notimestamp option does not work on
    index.html
    + JDK-8268775: Password is being converted to String in
    AccessibleJPasswordField
    + JDK-8268776: Test `ADatagramSocket.java` missing /othervm
    from @run tag
    + JDK-8268965: TCP Connection Reset when connecting simple
    socket to SSL server
    + JDK-8269304: Regression ~5% in 2005 in b27
    + JDK-8269415: [11u] Remove ea from
    DEFAULT_PROMOTED_VERSION_PRE in OpenJDK 11u
    + JDK-8269478: Shenandoah: gc/shenandoah/mxbeans tests should
    be more resilient
    + JDK-8269529: javax/swing/reliability/
    /HangDuringStaticInitialization.java fails in Windows debug
    build
    + JDK-8269594: assert(_handle_mark_nesting &gt; 1) failed: memory
    leak: allocating handle outside HandleMark
    + JDK-8269614: [s390] Interpreter checks wrong bit for slow
    path instance allocation
    + JDK-8269650: Optimize gc-locker in
    [Get|Release]StringCritical for latin string
    + JDK-8269661: JNI_GetStringCritical does not lock char array
    + JDK-8269668: [aarch64] java.library.path not including
    /usr/lib64
    + JDK-8269763: The JEditorPane is blank after JDK-8265167
    + JDK-8269795: C2: Out of bounds array load floats above its
    range check in loop peeling resulting in SEGV
    + JDK-8269847: JDK-8269594 backport breaks 11u builds
    + JDK-8269850: Most JDK releases report macOS version 12 as
    10.16 instead of 12.0
    + JDK-8269851: OperatingSystemMXBean getProcessCpuLoad reports
    incorrect process cpu usage in containers
    + JDK-8269882: stack-use-after-scope in NewObjectA
    + JDK-8269934: RunThese24H.java failed with
    EXCEPTION_ACCESS_VIOLATION in
    java_lang_Thread::get_thread_status
    + JDK-8270096: Shenandoah: Optimize gc/shenandoah/
    /TestRefprocSanity.java for interpreter mode
    + JDK-8270137: Kerberos Credential Retrieval from Cache not
    Working in Cross-Realm Setup
    + JDK-8270184: [TESTBUG] Add coverage for jvmci
    ResolvedJavaType.toJavaName() for lambdas
    + JDK-8270196: [11u] [JVMCI] JavaType.toJavaName() returns
    incorrect type name for lambdas
    + JDK-8270556: Exclude security/infra/java/security/cert/
    /CertPathValidator/certification/LetsEncryptCA
    + JDK-8270893: IndexOutOfBoundsException while reading large
    TIFF file
    + JDK-8272078: Wrong Checksums in Temurin BootJDK dependencies
    + JDK-8272124: Cgroup v1 initialization causes
    NullPointerException when cgroup path contains colon
    + JDK-8272131: PhaseMacroExpand::generate_slow_arraycopy crash
    when clone null CallProjections.fallthrough_ioproj
    + JDK-8272197: Update 11u GHA workflow with Shenandoah
    configurations
    + JDK-8272332: --with-harfbuzz=system doesn't add -lharfbuzz
    after JDK-8255790
    + JDK-8272472: StackGuardPages test doesn't build with glibc
    2.34
    + JDK-8272602: [macos] not all KEY_PRESSED events sent when
    control modifier is used
    + JDK-8272628: Problemlist gc/stress/gcbasher/
    /TestGCBasherWithCMS.java for x86_32
    + JDK-8272700: [macos] Build failure with Xcode 13.0 after
    JDK-8264848
    + JDK-8272772: Shenandoah: compiler/c2/aarch64/
    /TestVolatilesShenandoah.java fails in 11u
    + JDK-8273939: Backport of 8248414 to JDK11 breaks
    MacroAssembler::adrp
- Remove the unneeded icedtea-sound provider
- Removed patches:
  * icedtea-sound-1.0.1-jdk9.patch
  * icedtea-sound-soundproperties.patch
    + not needed since the icedtea-sound provider is removed
  * jdk11-glibc234.patch
    + integrated upstream</changelog>
  <changelog author="fstrba@suse.com" date="1635940800">- Modified patches:
  * system-crypto-policy.patch
    + rediff to changed context
  * fips.patch
    + Allow plain key import in fips mode unless
    com.suse.fips.plainKeySupport is set to false</changelog>
  <changelog author="fstrba@suse.com" date="1636113600">- Modified patch:
  * fips.patch
    + return in native code after generating java.io.IOException</changelog>
</package>
<package pkgid="a5ea0934cbd518201b0e3d8e00146ce747cbd5b77fcf3d15f491328a75456774" name="java-11-openjdk-jmods" arch="s390x">
  <version epoch="0" ver="11.0.13.0" rel="3.68.1"/>
  <changelog author="fstrba@suse.com" date="1586952000">- The pack200 and unpack200 alternatives should be slaves of java
  and not of javac, since they are part of JRE.</changelog>
  <changelog author="fstrba@suse.com" date="1587470400">- Update to upstream tag jdk-11.0.7+10 (April 2020 CPU,
  bsc#1169511)
  * Security fixes:
    + S8223898, CVE-2020-2754: Forward references to Nashorn
    + S8223904, CVE-2020-2755: Improve Nashorn matching
    + S8224541, CVE-2020-2756: Better mapping of serial ENUMs
    + S8224549, CVE-2020-2757: Less Blocking Array Queues
    + S8225603: Enhancement for big integers
    + S8226346: Build better binary builders
    + S8227467: Better class method invocations
    + S8227542: Manifest improved jar headers
    + S8229733: TLS message handling improvements
    + S8231415, CVE-2020-2773: Better signatures in XML
    + S8231785: Improved socket permissions
    + S8232424, CVE-2020-2778: More constrained algorithms
    + S8232581, CVE-2020-2767: Improve TLS verification
    + S8233250: Better X11 rendering
    + S8233410: Better Build Scripting
    + S8234027: Better JCEKS key support
    + S8234408, CVE-2020-2781: Improve TLS session handling
    + S8234825, CVE-2020-2800: Better Headings for HTTP Servers
    + S8234841, CVE-2020-2803: Enhance buffering of byte buffers
    + S8235274, CVE-2020-2805: Enhance typing of methods
    + S8235691, CVE-2020-2816: Enhance TLS connectivity
    + S8236201, CVE-2020-2830: Better Scanner conversions
    + S8238960: linux-i586 builds are inconsistent as the newly
    built jdk is not able to reserve enough space for object heap
  * Other changes:
    + S4919790: Errors in alert ssl message does not reflect the
    actual certificate status
    + S4949105: Access Bridge lacks html tags parsing
    + S7092821: java.security.Provider.getService() is synchronized
    and became scalability bottleneck
    + S7143743: Potential memory leak with zip provider
    + S8005819: Support cross-realm MSSFU
    + S8042383: [TEST_BUG] Test javax/swing/plaf/basic/BasicMenuUI/
    /4983388/bug4983388.java fails with shortcuts on menus do not
    work
    + S8068184: Fix for JDK-8032832 caused a deadlock
    + S8145845: [AOT] NullPointerException in
    compiler/whitebox/GetCodeHeapEntriesTest.java
    + S8152988: [AOT] Update test batch definitions to include
    aot-ed java.base module mode into hs-comp testing
    + S8160926: FLAGS_COMPILER_CHECK_ARGUMENTS doesn't handle
    cross-compilation
    + S8163083: SocketListeningConnector does not allow invocations
    with port 0
    + S8163251: Hard coded loop limit prevents reading of smart
    card data greater than 8k
    + S8167276: jvmci/compilerToVM/MaterializeVirtualObjectTest.java
    fails with -XX:-EliminateAllocations
    + S8169718: nsk/jdb/locals/locals002: ERROR: Cannot find
    boolVar with expected value: false
    + S8176556:
    java/awt/dnd/ImageTransferTest/ImageTransferTest.java fails
    for JFIF
    + S8178798: Two compiler/aot/verification/vmflags tests fail by
    timeout with UseAVX=3
    + S8183107: PKCS11 regression regarding checkKeySize
    + S8185005: Improve performance of
    ThreadMXBean.getThreadInfo(long ids[], int maxDepth)
    + S8189633: Missing -Xcheck:jni checking for DeleteWeakGlobalRef
    + S8189861: Refactor CacheFind
    + S8193042: NativeLookup::lookup_critical_entry() should only
    load shared library once
    + S8193596: java/net/DatagramPacket/ReuseBuf.java failed due to
    timeout
    + S8194944: Regression automated test 'open/test/jdk/javax/
    /swing/JInternalFrame/8145896/TestJInternalFrameMaximize.java'
    fails
    + S8196467: javax/swing/JInternalFrame/Test6325652.java fails
    + S8196969: JTreg Failure: serviceability/sa/ClhsdbJstack.java
    causes NPE
    + S8198321: javax/swing/JEditorPane/5076514/bug5076514.java
    fails
    + S8198398: Test javax/swing/JColorChooser/Test6199676.java
    fails in mach5
    + S8199072: Test javax/swing/GroupLayout/6613904/
    /bug6613904.java is unstable
    + S8200432: javadoc fails with ClassCastException on {@link
    byte[]}
    + S8201349: build broken when configured with
  - -with-zlib=bundled on gcc 7.3
    + S8201355: Avoid native memory allocation in
    sun.security.mscapi.PRNG.generateSeed
    + S8201513: nsk/jvmti/IterateThroughHeap/filter-* are broken
    + S8203364: Some serviceability/sa/ tests intermittently fail
    with java.io.IOException: LingeredApp terminated with non-zero
    exit code 3
    + S8203687: javax/net/ssl/compatibility/Compatibility.java
    supports TLS 1.3
    + S8203904: javax/swing/JSplitPane/4816114/bug4816114.java: The
    divider location is wrong
    + S8203911: Test runtime/modules/getModuleJNI/GetModule fails
    with -Xcheck:jni
    + S8204525: [TESTBUG] runtime/NMT/MallocStressTest.java ran out
    of java heap
    + S8204529: gc/TestAllocateHeapAtMultiple.java fail with Agent
    7 timed out
    + S8204551: Event descriptions are truncated in logs
    + S8206963: [AOT] bug with multiple class loaders
    + S8207367: 10 vmTestbase/nsk/jdi tests timed out when running
    with jtreg
    + S8207832: serviceability/sa/ClhsdbCDSCore.java failed with
    "Couldn't find core file location"
    + S8207938: At step6,Click Add button,case failed automatically.
    + S8208157: requires.VMProps throws NPE for missing properties
    in "release" file
    + S8208379: compiler/jvmci/events/
    /JvmciNotifyInstallEventTest.java failed with "Got unexpected
    event count after 2nd install attempt: expected 9 to equal 2"
    + S8208658: Make CDS archived heap regions usable even if
    compressed oop encoding has changed
    + S8208715: Conversion of milliseconds to nanoseconds in
    UNIXProcess contains bug
    + S8209361: [AOT] Unexpected number of references for
    JVMTI_HEAP_REFERENCE_CONSTANT_POOL [111--&gt;111]: 0 (expected
    at least 1)
    + S8209385: CDS runtime classpath checking is too strict when
    only classes from the system modules are archived
    + S8209389: SIGSEGV in WalkOopAndArchiveClosure::do_oop_work.
    + S8209418: Synchronize test/jdk/sanity/client/lib/jemmy with
    code-tools/jemmy/v2
    + S8209494: Create a test for SwingSet InternalFrameDemo
    + S8209499: Create test for SwingSet EditorPaneDemo
    + S8209574: [AOT] breakpoint events are generated in different
    threads does not meet expected count
    + S8209686: cleanup arguments to PhaseIdealLoop() constructor
    + S8209789: Synchronize test/jdk/sanity/client/lib/jemmy with
    code-tools/jemmy/v2
    + S8209802: Garbage collectors should register JFR types
    themselves to avoid build errors.
    + S8209807: improve handling exception in requires.VMProps
    + S8209817: stack is executable when building with Clang on
    Linux
    + S8209824: Improve the code coverage for ThreadLocal
    + S8209826: Undefined reference to os::write after JDK-8209657
    (filemap.hpp cleanup)
    + S8209850: Allow NamedThreads to use GlobalCounter critical
    sections
    + S8209976: Improve iteration over non-JavaThreads
    + S8209993: Create a test for SwingSet3 ToolTipDemo
    + S8210024: JFR calls virtual is_Java_thread from ~Thread()
    + S8210052: Enable testing for all the available look and feels
    in SwingSet3 demo tests
    + S8210055: Enable different look and feel tests in SwingSet3
    demo tests
    + S8210057: Enable different look and feels in SwingSet3 demo
    test InternalFrameDemoTest
    + S8210058: Algorithmic Italic font leans opposite angle in
    Printing
    + S8210220: [AOT] jdwp test cases are failing with error #
    ERROR: TEST FAILED: Cought IOException while receiving event
    packet
    + S8210289: ArchivedKlassSubGraphInfoRecord is incomplete
    + S8210459: Add support for generating compile_commands.json
    + S8210476: sun/security/mscapi/PrngSlow.java fails with Still
    too slow
    + S8210512: [Testbug] vmTestbase/nsk/jdi/ObjectReference/
    /referringObjects/referringObjects002/referringObjects002.java
    fails with unexpected size of
    ClassLoaderReference.referringObjects
    + S8210523: runtime/appcds/cacheObject/DifferentHeapSizes.java
    crash
    + S8210632: Add key exchange algorithm to
    javax/net/ssl/TLSCommon/CipherSuite.java
    + S8210699: Problem list tests which times out in Xcomp mode
    + S8210793: [JVMCI] AllocateCompileIdTest.java failed to find
    DiagnosticCommand.class
    + S8210910: Create test for FileChooserDemo
    + S8210994: Create test for SwingSet3 FrameDemo
    + S8211139: Increase timeout value in all tests under
    jdk/sanity/client/SwingSet/src
    + S8211160: Handle different look and feels in
    JInternalFrameOperator
    + S8211211: vmTestbase/metaspace/stressDictionary/
    /StressDictionary.java timeout
    + S8211322: Reduce the timeout of tooltip in SwingSet2DemoTest
    + S8211443: Enable different look and feels in SwingSet3 demo
    test SplitPaneDemoTest
    + S8211703: JInternalFrame : java.lang.AssertionError: cannot
    find the internal frame
    + S8211781: re-building fails after changing Graal sources
    + S8212897: Some improvements in the EditorPaneDemotest
    + S8212903: [TestBug] Tests test/jdk/javax/swing/LookAndFeel/
    /8145547/DemandGTK2.sh and DemandGTK3.sh fail on Ubuntu 18.04
    LTS
    + S8213009: Refactoring existing SunMSCAPI classes
    + S8213010: Supporting keys created with certmgr.exe
    + S8213168: Enable different look and feel tests in SwingSet3
    demo test FileChooserDemoTest
    + S8213348: jdk.internal.vm.compiler.management service
    providers missing in module descriptor
    + S8213906: Update arm devkits with libXrandr headers
    + S8213908: AssertionError in DeferredAttr at setOverloadKind
    + S8214124: [TESTBUG] Bugs in runtime/NMT/MallocStressTest.java
    + S8214344: C2: assert(con.basic_type() != T_ILLEGAL) failed:
    elembt=byte; loadbt=void; unsigned=0
    + S8214345: infinite recursion while checking super class
    + S8214471: Enable different look and feel tests in SwingSet3
    demo test ToolTipDemoTest
    + S8214534: Setting of THIS_FILE in the build is broken
    + S8214557: Filter out VM flags which don't affect AOT code
    generation
    + S8214578: [macos] Problem with backslashes on macOS/JIS
    keyboard: Java ignores system settings
    + S8214840: runtime/NMT/MallocStressTest.java timed out
    + S8214850: Rename vm_operations.?pp files to vmOperations.?pp
    files
    + S8214904: Test8004741.java failed due to "Too few ThreadDeath
    hits; expected at least 6 but saw only 5"
    + S8215322: add @file support to jaotc
    + S8215355: Object monitor deadlock with no threads holding the
    monitor (using jemalloc 5.1)
    + S8215396: JTabbedPane preferred size calculation is wrong for
    SCROLL_TAB_LAYOUT
    + S8216180: [AOT] compiler/intrinsics/bigInteger/TestMulAdd.java
    crashed with AOT enabled
    + S8216353: Use utility APIs introduced in org/netbeans/jemmy/
    /util/LookAndFeel class in client sanity test cases
    + S8216354: Syntax error in toolchain_windows.m4
    + S8216472: (se) Stack overflow during selection operation
    leads to crash (win)
    + S8216535: tools/jimage/JImageExtractTest.java timed out
    + S8217235: Create automated test for SwingSet
    ColorChooserDemoTest
    + S8217297: Add support for multiple look and feel for SwingSet
    SliderDemoTest
    + S8217338: [Containers] Improve systemd slice memory limit
    support
    + S8217613: [AOT] TEST_OPTS_AOT_MODULES doesn't work on mac
    + S8217634: RunTest documentation and usability update
    + S8217717: ZGC: Broken oop map in C1 load barrier stub
    + S8217728: Speed up incremental rerun of "make hotspot"
    + S8218268: Javac treats Manifest Class-Path entries as Paths
    instead of URLs
    + S8218662: Allow 204 responses with Content-Length:0
    + S8218882: NET_Writev is declared, NET_WriteV is defined
    + S8218889: Improperly use of the Optional API
    + S8219205: JFR file without license header
    + S8219597: (bf) Heap buffer state changes could provoke
    unexpected exceptions
    + S8219723: javax/net/ssl/compatibility/Compatibility.java
    failed on some SNI cases
    + S8220348: [ntintel] asserts about copying unaligned array
    + S8220451: jdi/EventQueue/remove/remove004 failed due to
    "ERROR: thread2 is not alive"
    + S8220456: jdi/EventQueue/remove_l/remove_l004 failed due to
    "TIMEOUT while waiting for event"
    + S8220479: java/nio/channels/Selector/SelectWithConsumer.java
    failed at testTwoChannels()
    + S8220613: java/util/Arrays/TimSortStackSize2.java times out
    with fastdebug build
    + S8220688: [TESTBUG] runtime/NMT/MallocStressTest.java timed
    out
    + S8220786: Create new switch to redirect error reporting
    output to stdout or stderr
    + S8221270: Duplicated synchronized keywords in SSLSocketImpl
    + S8221312: test/jdk/sanity/client/SwingSet/src/
    /ColorChooserDemoTest.java failed
    + S8221851: Use of THIS_FILE in hotspot invalidates precompiled
    header on Linux/GCC
    + S8221885: Add intermittent test in the JavaSound to the
    ProblemList
    + S8222264: Windows incremental build is broken with JDK-8217728
    + S8222391: javax/net/ssl/compatibility/Compatibility.java
    should be more flexible
    + S8222448: java/lang/reflect/PublicMethods/
    /PublicMethodsTest.java times out
    + S8222519: ButtonDemoScreenshotTest fails randomly with "still
    state to be reached"
    + S8222741: jdi/EventQueue/remove/remove004 fails due to
    VMDisconnectedException
    + S8223003: SunMSCAPI keys are not cleaned up
    + S8223063: Support CNG RSA keys
    + S8223158: Docked MacBook cannot start any Java Swing
    applications
    + S8223260: NamingManager should cache InitialContextFactory
    + S8223464: Improve version string for Oracle CI builds
    + S8223558: Java does not render Myanmar script correctly
    + S8223627: jdk-13+20 bundle name contains null instead of ea
    + S8223638: Replace wildcard address with loopback or local
    host in tests - part 6
    + S8223678: Add Visual Studio Code workspace generation support
    (for native code)
    + S8223727: com/sun/jndi/ldap/privconn/RunTest.java failed due
    to hang in LdapRequest.getReplyBer
    + S8223769: Assert triggers with -XX:+StressReflectiveCode
    + S8224187: Refactor arraycopy_prologue to allow ZGC read
    barriers on arraycopy
    + S8224475: JTextPane does not show images in HTML rendering
    + S8224673: Adjust permission for delayed starting of debugging
    + S8224705: Tests that need to be problem-listed or have
    printer resources
    + S8224778: test/jdk/demo/jfc/J2Ddemo/J2DdemoTest.java cannot
    find J2Ddemo.jar
    + S8224821: java/awt/Focus/NoAutotransferToDisabledCompTest/
    /NoAutotransferToDisabledCompTest.java fails linux-x64
    + S8224830: test/jdk/java/awt/Focus/
    /ModalExcludedWindowClickTest/
    /ModalExcludedWindowClickTest.java fails on linux-x64
    + S8224851: AArch64: fix warnings and errors with Clang and GCC
    8.3
    + S8224905: java/lang/ProcessBuilder/Basic.java#id1 failed with
    stream closed
    + S8225007: java/awt/print/PrinterJob/
    /LandscapeStackOverflow.java may hang
    + S8225105: java/awt/Focus/ShowFrameCheckForegroundTest/
    /ShowFrameCheckForegroundTest.java fails in Windows 10
    + S8225117: java/math/BigInteger/SymmetricRangeTests.java fails
    with ParseException
    + S8225128: Add exception for expiring DocuSign root to
    VerifyCACerts test
    + S8225130: Add exception for expiring Comodo roots to
    VerifyCACerts test
    + S8225144: [macos] In Aqua L&amp;F backspace key does not delete
    when Shift is pressed
    + S8225180: SignedObject with invalid Key not throwing the
    InvalidKeyException in Windows
    + S8225182: JNI exception pending in DestroyXIMCallback of
    awt_InputMethod.c:1327
    + S8225199: [Graal] compiler/jvmci/compilerToVM/
    /IsMatureVsReprofileTest.java fails with
  - XX:CompileThresholdScaling=0.1
    + S8225305: ProblemList java/lang/invoke/VarHandles tests
    + S8225350: compiler/jvmci/compilerToVM/IsCompilableTest.java
    timed out
    + S8225430: Replace wildcard address with loopback or local
    host in tests - part 14
    + S8225435: Upgrade IANA Language Subtag Registry to the latest
    for JDK14
    + S8225487: giflib legal file is missing attribution for
    openbsd-reallocarray.c
    + S8225567: Wrong file headers with 8202414 fix changeset
    + S8225684: [AOT] vmTestbase/vm/oom/production/
    /AlwaysOOMProduction tests fail with AOTed java.base
    + S8225766: Curve in certificate should not affect signature
    scheme when using TLSv1.3
    + S8225797: OldObjectSample event creates unexpected amount of
    checkpoint data
    + S8226381: ProblemList java/lang/reflect/PublicMethods/
    /PublicMethodsTest.java
    + S8226406: JVM fails to detect mismatched or corrupt CDS
    archive
    + S8226608: Hide the onjcmd option from the help output
    + S8226892: ActionListeners on JRadioButtons don't get notified
    when selection is changed with arrow keys
    + S8227112: exclude compiler/intrinsics/sha/sanity tests from
    AOT runs
    + S8227324: Upgrade to freetype 2.10.1
    + S8227528: TestAbortVMOnSafepointTimeout.java failed due to
    "RuntimeException: 'Safepoint sync time longer than' missing
    from stdout/stderr"
    + S8227645: Some tests in serviceability/sa run with fixed -Xmx
    values and risk running out of memory
    + S8227646: [TESTBUG] appcds/SharedArchiveConsistency timed out
    + S8227662: freetype seeks to index at the end of the font data
    + S8228479: Correct the format of ColorChooserDemoTest
    + S8228613: java.security.Provider#getServices order is no
    longer deterministic
    + S8228969: 2019-09-28 public suffix list update
    + S8229236: CriticalJNINatives: dll handling should be done in
    native thread state
    + S8229345: Memory leak due to vtable stubs not being shared on
    SPARC
    + S8229888: (zipfs) Updating an existing zip file does not
    preserve original permissions
    + S8229994: assert(false) failed: Bad graph detected in
    get_early_ctrl_for_expensive
    + S8230004: jdk/internal/jimage/JImageOpenTest.java runs no test
    + S8230235: Rendering HTML with empty img attribute and
    documentBaseKey cause Exception
    + S8230390: Problemlist SA tests with AOT
    + S8230400: Missing constant pool entry for a method in
    stacktrace
    + S8230459: Test failed to resume JVMCI CompilerThread
    + S8230480: check malloc/calloc results in java.desktop
    + S8230597: Update GIFlib library to the 5.2.1
    + S8230611: infinite loop in
    LogOutputList::wait_until_no_readers()
    + S8230624: [TESTBUG] Problemlist JFR
    compiler/TestCodeSweeper.java
    + S8230677: Should disable Escape Analysis if JVMTI capability
    can_get_owned_monitor_info was taken
    + S8230926: [macosx] Two apostrophes are entered instead of one
    with "U.S. International - PC" layout
    + S8231025: Incorrect method tag offset for big endian platform
    + S8231081: TestMetadataRetention fails due to missing symbol id
    + S8231387: java.security.Provider.getService returns random
    result due to race condition with mutating methods in the same
    class
    + S8231430: C2: Memory stomp in max_array_length() for
    T_ILLEGAL type
    + S8231445: check ZALLOC return values in awt coding
    + S8231507: Update Apache Santuario (XML Signature) to version
    2.1.4
    + S8231584: Deadlock with ClassLoader.findLibrary and
    System.loadLibrary call
    + S8231753: use more Posix functionality in aix
    os::print_os_info
    + S8231810: javax/net/ssl/templates/
    /SSLSocketSSLEngineTemplate.java fails intermittently with
    "java.lang.Exception: Unexpected EOF"
    + S8232003: (fs) Files.write can leak file descriptor in the
    exception case
    + S8232056: GetOwnedMonitorInfoWithEATest.java fails with ZGC:
    Heap too small
    + S8232060: add some initializations using sigemptyset in
    os_aix.cpp
    + S8232154: Update Mesa 3-D Headers to version 19.2.1
    + S8232167: Visual Studio install found through
  - -with-tools-dir value is discarded
    + S8232170: FSInfo#getJarClassPath throws an exception not
    declared in its throws clause
    + S8232200: [macos 10.15] Windows in fullscreen tests jumps
    around the screen
    + S8232207: Linux os::available_memory re-reads cgroup
    configuration on every invocation
    + S8232224: [TESTBUG] problemlist JFR TestLargeRootSet.java
    + S8232370: Refactor some com.sun.jdi tests to enable IDE
    integration
    + S8232433: [macos 10.15] java/awt/Window/
    /LocationAtScreenCorner/LocationAtScreenCorner.java may fail
    + S8232571: Add missing SIGINFO signal
    + S8232692: [TESTBUG] compiler/aot/fingerprint/
    /SelfChangedCDS.java fails when cds is disabled
    + S8232713: Update BCEL version to 6.3.1 in license file
    + S8232806: Introduce a system property to disable eager lambda
    initialization
    + S8232834: RunTest sometimes fails to produce valid
    exitcode.txt
    + S8232880: Update test documentation with additional settings
    for client UI tooltip tests
    + S8232950: SUNPKCS11 Provider incorrectly check key length for
    PSS Signatures.
    + S8233018: Add a new test to verify that DatagramSocket is not
    interruptible
    + S8233019: java.lang.Class.isPrimitive() (C1) returns wrong
    result if Klass* is aligned to 32bit
    + S8233032: assert(in_bb(n)) failed: must be
    + S8233078: fix minimal VM build on Linux ppc64(le)
    + S8233328: fix minimal VM build on Linux s390x
    + S8233383: Various minor fixes
    + S8233466: aarch64: remove unnecessary load of mdo when
    profiling return and parameters type
    + S8233491: Crash in AdapterHandlerLibrary::get_adapter with
    CDS due to code cache exhaustion
    + S8233529: loopTransform.cpp:2984: Error: assert(p_f-&gt;Opcode()
    == Op_IfFalse) failed
    + S8233548: Update CUP to v0.11b
    + S8233649: Update ProblemList.txt to exclude failing headful
    tests on macos
    + S8233656: assert(d-&gt;is_CFG() &amp;&amp; n-&gt;is_CFG()) failed: must
    have CFG nodes
    + S8233657: Intermittent NPE in Component.validate()
    + S8234288: Turkey Time Zone returns incorrect time zone name
    + S8234323: NULL-check return value of SurfaceData_InitOps on
    macosx
    + S8234339: replace JLI_StrTok in java_md_solinux.c
    + S8234340: Bump update version for OpenJDK: jdk-11.0.7
    + S8234350: assert(mode == ControlAroundStripMined &amp;&amp; (use ==
    sfpt || !use-&gt;is_reachable_from_root())) failed: missed a node
    + S8234386: [macos] NPE was thrown at expanding Choice from
    maximized frame
    + S8234397: add OS uptime information to os::print_os_info
    output
    + S8234423: Modifying ArrayList.subList().subList() resets
    modCount of subList
    + S8234466: Class loading deadlock involving
    X509Factory#commitEvent()
    + S8234501: remove obsolete NET_ReadV
    + S8234525: enable link-time section-gc for linux s390x to
    remove unused code
    + S8234610: MaxVectorSize set wrongly when UseAVX=3 is
    specified after JDK-8221092
    + S8234617: C1: Incorrect result of field load due to missing
    narrowing conversion
    + S8234723: javax/net/ssl/TLS tests support TLSv1.3
    + S8234724: javax/net/ssl/templates/
    /SSLSocketSSLEngineTemplate.java supports TLSv1.3
    + S8234741: enhance os::get_core_path on macOS
    + S8234769: Duplicate attribution in freetype.md
    + S8234786: Fix for JDK-8214578 breaks OS X 10.12 compatibility
    + S8234809: set relro in linker flags when building with gcc
    + S8234824: java/nio/channels/SocketChannel/AdaptSocket.java
    fails on Windows 10
    + S8235243: handle VS2017 15.9 and VS2019 in abstract_vm_version
    + S8235288: AVX 512 instructions inadvertently used on Xeon for
    small vector width operations
    + S8235325: build failure on Linux after 8235243
    + S8235383: C1 compilation fails with
  - XX:+PrintIRDuringConstruction -XX:+Verbose
    + S8235489: handle return values of sscanf calls in hotspot
    + S8235509: Backport for JDK-8209657 Refactor filemap.hpp to
    simplify integration with Serviceability Agent.
    + S8235510: java.util.zip.CRC32 performance drop after 8200067
    + S8235563: [TESTBUG] appcds/CommandLineFlagComboNegative.java
    does not handle archive mapping failure
    + S8235637: jhsdb jmap from OpenJDK 11.0.5 doesn't work if
    prelink is enabled
    + S8235671: enhance print_rlimit_info in os_posix
    + S8235744: PIT: test/jdk/javax/swing/text/html/
    /TestJLabelWithHTMLText.java times out in linux-x64
    + S8235904: Infinite loop when rendering huge lines
    + S8235998: [c2] Memory leaks during tracing after '8224193:
    stringStream should not use Resource Area'.
    + S8236039: JSSE Client does not accept status_request
    extension in CertificateRequest messages for TLS 1.3
    + S8236140: assert(!VerifyHashTableKeys || _hash_lock == 0)
    failed: remove node from hash table before modifying it
    + S8236179: C1 register allocation error with T_ADDRESS
    + S8236488: Support for configure option
  - -with-native-debug-symbols=internal is impossible on Windows
    + S8236500: Windows ucrt.dll should be looked up in versioned
    WINSDK subdirectory
    + S8236709: struct SwitchRange in HS violates C++ One
    Definition Rule
    + S8236848: [JDK 11u] make run-test-tier1 fails after backport
    of JDK-8232834
    + S8236873: Worker has a deadlock bug
    + S8237217: Incorrect G1StringDedupEntry type used in
    StringDedupTable destructor
    + S8237368: Problem with NullPointerException in RMI
    TCPEndpoint.read
    + S8237375: SimpleThresholdPolicy misses CounterDecay timestamp
    initialization
    + S8237508: Simplify JarFile.isInitializing
    + S8237540: Missing files in backport of JDK-8210910
    + S8237541: Missing files in backport of JDK-8236528
    + S8237600: Test SunJSSEFIPSInit fails on Ubuntu
    + S8237819: s390x - remove unused pd_zero_to_words_large
    + S8237869: exclude jtreg test security/infra/java/security/
    /cert/CertPathValidator/certification/LuxTrustCA.java because
    of instabilities
    + S8237879: make 4.3 breaks build
    + S8237945: CTW: C2 compilation fails with
    assert(just_allocated_object(alloc_ctl) == ptr) failed: most
    recent allo...
    + S8238225: Issues reported after replacing symlink at
    Contents/MacOS/libjli.dylib with binary
    + S8238247: CTW runner should sweep nmethods more aggressively
    + S8238366: CTW runner closes standard output on exit
    + S8238438: SuperWord::co_locate_pack picks memory state of
    first instead of last load
    + S8238502: sunmscapi.dll causing EXCEPTION_ACCESS_VIOLATION
    + S8238534: Deep sign macOS bundles before bundle archive is
    being created
    + S8238591: CTW: Split
    applications/ctw/modules/jdk_localedata.java
    + S8238596: AVX enabled by default for Skylake even when
    unsupported
    + S8238811: C2: assert(i &gt;= req() || i == 0 || is_Region() ||
    is_Phi()) with -XX:+VerifyGraphEdges
    + S8239005: [TESTBUG] test/hotspot/jtreg/runtime/
    /StackGuardPages/TestStackGuardPages.java: exeinvoke.c: must
    initialize static state before calling do_overflow()
    + S8239466: Loss of precision in counter decay calculation in
    11u backport of JDK-8237375
    + S8239856: [ntintel] asserts about copying unaligned array
    element
    + S8240724: [test] jdk11 downport of 8224475 misses binary file
    test/jdk/javax/swing/JTextPane/arrow.png
    + S8241296: Segfault in JNIHandleBlock::oops_do()
- Removed patch:
  * DependOnVariableHelper.patch
    + fixed upstream
- Added patch:
  * JDK-8228407.patch
    + fix crashes due to shared archive file mismatch</changelog>
  <changelog author="fstrba@suse.com" date="1594900800">- Update to upstream tag jdk-11.0.8+10 (July 2020 CPU, bsc#1174157)
  * Security fixes:
    + JDK-8230613: Better ASCII conversions
    + JDK-8231800: Better listing of arrays
    + JDK-8232014: Expand DTD support
    + JDK-8233234: Better Zip Naming
    + JDK-8233239, CVE-2020-14562: Enhance TIFF support
    + JDK-8233255: Better Swing Buttons
    + JDK-8234032: Improve basic calendar services
    + JDK-8234042: Better factory production of certificates
    + JDK-8234418: Better parsing with CertificateFactory
    + JDK-8234836: Improve serialization handling
    + JDK-8236191: Enhance OID processing
    + JDK-8236867, CVE-2020-14573: Enhance Graal interface handling
    + JDK-8237117, CVE-2020-14556: Better ForkJoinPool behavior
    + JDK-8237592, CVE-2020-14577: Enhance certificate verification
    + JDK-8238002, CVE-2020-14581: Better matrix operations
    + JDK-8238013: Enhance String writing
    + JDK-8238804: Enhance key handling process
    + JDK-8238842: AIOOBE in GIFImageReader.initializeStringTable
    + JDK-8238843: Enhanced font handing
    + JDK-8238920, CVE-2020-14583: Better Buffer support
    + JDK-8238925: Enhance WAV file playback
    + JDK-8240119, CVE-2020-14593: Less Affine Transformations
    + JDK-8240482: Improved WAV file playback
    + JDK-8241379: Update JCEKS support
    + JDK-8241522: Manifest improved jar headers redux
    + JDK-8242136, CVE-2020-14621: Better XML namespace handling
  * Other changes:
    + JDK-6933331: (d3d/ogl) java.lang.IllegalStateException:
    Buffers have not been created
    + JDK-7124307: JSpinner and changing value by mouse
    + JDK-8022574: remove HaltNode code after uncommon trap calls
    + JDK-8039082: [TEST_BUG] Test
    java/awt/dnd/BadSerializationTest/BadSerializationTest.java
    fails
    + JDK-8040630: Popup menus and tooltips flicker with previous
    popup contents when first shown
    + JDK-8044365: (dc) MulticastSendReceiveTests.java failing with
    ENOMEM when joining group (OS X 10.9)
    + JDK-8048215: [TESTBUG]
    java/lang/management/ManagementFactory/ThreadMXBeanProxy.java
    Expected non-null LockInfo
    + JDK-8051349: nsk/jvmti/scenarios/sampling/SP06/sp06t003 fails
    in nightly
    + JDK-8080353: JShell: Better error message on attempting to
    add default method
    + JDK-8139876: Exclude hanging nsk/stress/stack from execution
    with deoptimization enabled
    + JDK-8146090: java/lang/ref/ReachabilityFenceTest.java fails
    with -XX:+DeoptimizeALot
    + JDK-8153430: jdk regression test MletParserLocaleTest,
    ParserInfiniteLoopTest reduce default timeout
    + JDK-8156207: Resource allocated BitMaps are often cleared
    unnecessarily
    + JDK-8159740: JShell: corralled declarations do not have
    correct source to wrapper mapping
    + JDK-8175984: ICC_Profile has un-needed, not-empty finalize
    method
    + JDK-8176359: Frame#setMaximizedbounds not working properly in
    multi screen environments
    + JDK-8183369: RFC unconformity of HttpURLConnection with proxy
    + JDK-8187078: -XX:+VerifyOops finds numerous problems when
    running JPRT
    + JDK-8189861: Refactor CacheFind
    + JDK-8191169: java/net/Authenticator/B4769350.java failed
    intermittently
    + JDK-8191930: [Graal] emits unparseable XML into compile log
    + JDK-8193879: Java debugger hangs on method invocation
    + JDK-8196019: java/awt/Window/Grab/GrabTest.java fails on
    Windows
    + JDK-8196181: sun/java2d/GdiRendering/InsetClipping.java fails
    + JDK-8198000:
    java/awt/List/EmptyListEventTest/EmptyListEventTest.java
    debug assert on Windows
    + JDK-8198001: java/awt/Menu/WrongParentAfterRemoveMenu/
    /WrongParentAfterRemoveMenu.java debug assert on Windows
    + JDK-8198339: Test javax/swing/border/Test6981576.java is
    unstable
    + JDK-8200701: jdk/jshell/ExceptionsTest.java fails on Windows,
    after JDK-8198801
    + JDK-8203264: JNI exception pending in
    PlainDatagramSocketImpl.c:740
    + JDK-8203672: JNI exception pending in PlainSocketImpl.c
    + JDK-8203673: JNI exception pending in
    DualStackPlainDatagramSocketImpl.c:398
    + JDK-8204834: Fix confusing "allocate" naming in OopStorage
    + JDK-8205399: Set node color on pinned HashMap.TreeNode
    deletion
    + JDK-8205653: test/jdk/sun/management/jmxremote/bootstrap/
    /RmiRegistrySslTest.java and RmiSslBootstrapTest.sh fail with
    handshake_failure
    + JDK-8206179: com/sun/management/OperatingSystemMXBean/
    /GetCommittedVirtualMemorySize.java fails with Committed
    virtual memory size illegal value
    + JDK-8207334: VM times out in VM_HandshakeAllThreads::doit()
    with RunThese30M
    + JDK-8208277: Code cache heap (-XX:ReservedCodeCacheSize)
    doesn't work with 1GB LargePages
    + JDK-8209113: Use WeakReference for lastFontStrike for created
    Fonts
    + JDK-8209333: Socket reset issue for TLS 1.3 socket close
    + JDK-8209439: C2 library_call can potentially ignore Math.pow
    intrinsic or use null pointer
    + JDK-8209534: [TESTBUG]runtime/appcds/cacheObject/
    /ArchivedModuleCompareTest.java fails with EnableJVMCI.
    + JDK-8210147: adjust some WSAGetLastError usages in windows
    network coding
    + JDK-8210284: "assert((av &amp; 0x00000001) == 0) failed:
    unsupported V8" on Solaris 11.4
    + JDK-8210303: VM_HandshakeAllThreads fails assert with
    "failed: blocked and not walkable"
    + JDK-8210459: Add support for generating compile_commands.json
    + JDK-8210515: [TESTBUG]CheckArchivedModuleApp.java needs to
    check if EnableJVMCI is set.
    + JDK-8210788: Javadoc for Thread.join(long, int) should
    specify that it waits forever when both arguments are zero
    + JDK-8211301: [macos] support full window content options
    + JDK-8211332: Space for stub routines (code_size2) is too
    small on new Skylake CPUs
    + JDK-8211339: NPE during SSL handshake caused by
    HostnameChecker
    + JDK-8211392: compiler/profiling/
    /spectrapredefineclass_classloaders/Launcher.java times out
    in JDK12 CI
    + JDK-8211743: [AOT] crash in ScopeDesc::decode_body() when
    JVMTI walks AOT frames
    + JDK-8212154: [TESTBUG] CheckArchivedModuleApp fails with NPE
    when JVMCI is absent
    + JDK-8212167: JShell : Stack trace of exception has wrong line
    number
    + JDK-8212933: Thread-SMR: requesting a VM operation whilst
    holding a ThreadsListHandle can cause deadlocks
    + JDK-8212986: Make Visual Studio compiler check less strict
    + JDK-8213250: CDS archive creation aborts due to metaspace
    object allocation failure
    + JDK-8213516: jck test api/javax_accessibility/AccessibleState/
    /fields.html fails intermittent
    + JDK-8213947: ARM32: failed check_simd should set
    UsePopCountInstruction to false
    + JDK-8214418: half-closed SSLEngine status may cause
    application dead loop
    + JDK-8214440: ldap over a TLS connection negotiate failed with
    "javax.net.ssl.SSLPeerUnverifiedException: hostname of the
    server does not match the hostname in the server's
    certificate"
    + JDK-8214444: Wrong strncat limits in dfa.cpp
    + JDK-8214481: freetype path does not disable TrueType hinting
    with AA+FM hints
    + JDK-8214571: -Xdoclint of array serialField gives "error:
    array type not allowed here"
    + JDK-8214856: Errors with JSZip in web console after upgrade
    to 3.1.5
    + JDK-8214862: assert(proj != __null) at compile.cpp:3251
    + JDK-8215369: Jcstress pollute /var/tmp with temporary files.
    + JDK-8215551: Missing case label in nmethod::reloc_string_for()
    + JDK-8215555: TieredCompilation C2 threads can excessively
    block handshakes
    + JDK-8215711: Missing key_share extension for (EC)DHE key
    exchange should alert missing_extension
    + JDK-8216151: [Graal] Module
    jdk.internal.vm.compiler.management has not been granted
    accessClassInPackage.org.graalvm.compiler.debug
    + JDK-8216154: C4819 warnings at HotSpot sources on Windows
    + JDK-8216541: CompiledICHolders of VM locked unloaded nmethods
    are released too late
    + JDK-8217230: assert(t == t_no_spec) failure in
    NodeHash::check_no_speculative_types()
    + JDK-8217404: --with-jvm-features doesn't work when multiple
    features are explicitly disabled
    + JDK-8217447: Develop flag TraceICs is broken
    + JDK-8217606: LdapContext#reconnect always opens a new
    connection
    + JDK-8218807: Compilation database (compile_commands.json) may
    contain obsolete items
    + JDK-8219214: Infinite Loop in CodeSection::dump()
    + JDK-8219904: ClassCastException when calling
    FlightRecorderMXBean#getRecordings()
    + JDK-8219991: New fix of the deadlock in
    sun.security.ssl.SSLSocketImpl
    + JDK-8221121: applications/microbenchmarks are encountering
    crashes in tier5
    + JDK-8221445: FastSysexMessage constructor crashes MIDI
    receiption thread
    + JDK-8221482: Initialize VMRegImpl::regName[] earlier to
    prevent assert during PrintStubCode
    + JDK-8221741: ClassCastException can happen when
    fontconfig.properties is used
    + JDK-8221823: Requested JDialog width is ignored
    + JDK-8223108: Test java/awt/EventQueue/
    /NonComponentSourcePost.java is unstable
    + JDK-8223678: Add Visual Studio Code workspace generation
    support (for native code)
    + JDK-8223935: PIT: java/awt/font/WindowsIndicFonts.java fails
    on windows10
    + JDK-8224109: Text spaced incorrectly by drawString under
    rotation with fractional metric
    + JDK-8224632: testbug: java/awt/dnd/RemoveDropTargetCrashTest/
    /RemoveDropTargetCrashTest.java fails on MacOS
    + JDK-8224793: os::die() does not honor CreateCoredumpOnCrash
    option
    + JDK-8224847: gc/stress/TestReclaimStringsLeaksMemory.java
    fails with reserved greater than expected
    + JDK-8224931: disable JAOTC invokedynamic support until
    8223533 is fixed
    + JDK-8224997: ChaCha20-Poly1305 TLS cipher suite decryption
    throws ShortBufferException
    + JDK-8225068: Remove DocuSign root certificate that is
    expiring in May 2020
    + JDK-8225069: Remove Comodo root certificate that is expiring
    in May 2020
    + JDK-8225126: Test SetBoundsPaintTest.html faild on Windows
    when desktop is scaled
    + JDK-8225325: Add tests for redefining a class' private method
    during resolution of the bootstrap specifier
    + JDK-8225622: [AOT] runtime/SharedArchiveFile/
    /TestInterpreterMethodEntries.java crashed with AOTed
    java.base
    + JDK-8225653: Provide more information when hitting SIGILL
    from HaltNode
    + JDK-8225783: Incorrect use of binary operators on booleans in
    type.cpp
    + JDK-8225789: Empty method parameter type should generate
    ClassFormatError
    + JDK-8226198: use of &amp; instead of &amp;&amp; in
    LibraryCallKit::arraycopy_restore_alloc_state
    + JDK-8226253: JAWS reports wrong number of radio buttons when
    buttons are hidden.
    + JDK-8226653: [accessibility] Can edit text cell correctly,
    but Accessibility Tool reads nothing about editor
    + JDK-8226806: [macOS 10.14] Methods of Java Robot should be
    called from appropriate thread
    + JDK-8226879: Memory leak in Type::hashcons
    + JDK-8227632: Incorrect PrintCompilation message: made not
    compilable on levels 0 1 2 3 4
    + JDK-8228407: JVM crashes with shared archive file mismatch
    + JDK-8228482: fix xlc16/xlclang comparison of distinct pointer
    types and string literal conversion warnings
    + JDK-8228757: Fail fast if the handshake type is unknown
    + JDK-8229158: make UseSwitchProfiling non-experimental or
    false by-default
    + JDK-8229421: The logic of java/net/ipv6tests/TcpTest.java is
    flawed
    + JDK-8229855: C2 fails with assert(false) failed: bad AD file
    + JDK-8230591: AArch64: Missing intrinsics for Math.ceil,
    floor, rint
    + JDK-8231118: ARM32: Math tests failures
    + JDK-8231213: Migrate SimpleDateFormatConstTest to JDK Repo
    + JDK-8231243: [TESTBUG] CustomFont.java cannot find font file
    + JDK-8231438: [macOS] Dark mode for the desktop is not
    supported
    + JDK-8231550: C2: ShouldNotReachHere() in
    verify_strip_mined_scheduling
    + JDK-8231564: setMaximizedBounds is broken with large display
    scale and multiple monitors
    + JDK-8231572: Use -lobjc instead of -fobjc-link-runtime in
    libosxsecurity
    + JDK-8231631: sun/net/ftp/FtpURLConnectionLeak.java fails
    intermittently with NPE
    + JDK-8231671: Fix copyright headers in hotspot (missing comma
    after year)
    + JDK-8231720: Some perf regressions after 8225653
    + JDK-8231779: crash
    HeapWord*ParallelScavengeHeap::failed_mem_allocate
    + JDK-8231863: Crash if classpath is read from @argument file
    and the main gets option argument
    + JDK-8232080: jlink plugins for vendor information and
    run-time options
    + JDK-8232106: [x86] C2: SIGILL due to usage of SSSE3
    instructions on processors which don't support it
    + JDK-8232134: Change to Visual Studio 2017 15.9.16 for
    building on Windows at Oracle
    + JDK-8232226: [macos 10.15] test/jdk/java/awt/color/
    /EqualityTest/EqualityTest.java may fail
    + JDK-8232357: Compare version info of Santuario to legal notice
    + JDK-8232572: Add hooks for custom output dir in Bundles.gmk
    + JDK-8232634: Problem List ICMColorDataTest.java
    + JDK-8232748: Build static versions of certain JDK libraries
    + JDK-8232846: ProcessHandle.Info command with non-English
    shows question marks
    + JDK-8232880: Update test documentation with additional
    settings for client UI tooltip tests
    + JDK-8233033: C2 produces wrong result while unswitching a
    loop due to lost control dependencies
    + JDK-8233137: runtime/ErrorHandling/VeryEarlyAssertTest.java
    fails after 8232080
    + JDK-8233197: Invert JvmtiExport::post_vm_initialized() and
    Jfr:on_vm_start() start-up order for correct option parsing
    + JDK-8233291: [TESTBUG] tools/jlink/plugins/
    /VendorInfoPluginsTest.java fails with debug or non-server VMs
    + JDK-8233364: Fix undefined behavior in
    Canonicalizer::do_ShiftOp
    + JDK-8233494: Avoid calling MallocTracker::record_malloc and
    record_free when NMT is off
    + JDK-8233573: Toolkit.getScreenInsets(GraphicsConfiguration)
    may throw ClassCastException
    + JDK-8233608: Minimal build broken after JDK-8233494
    + JDK-8233621: Mismatch in jsse.enableMFLNExtension property
    name
    + JDK-8233696: [TESTBUG]Some jtreg tests fail when CAPS_LOCK is
    ON
    + JDK-8233707: systemScale.cpp could not compile with VS2019
    + JDK-8233801: GCMEmptyIv.java test fails on Solaris 11.4
    + JDK-8233880: Support compilers with multi-digit major version
    numbers
    + JDK-8233920: MethodHandles::tryFinally generates illegal
    bytecode for long/double return type
    + JDK-8234137: The "AutoTestOnTop.java" test may run external
    applications
    + JDK-8234146: compiler/jsr292/
    /ContinuousCallSiteTargetChange.java times out on SPARC
    + JDK-8234184: [TESTBUG] java/awt/Mouse/EnterExitEvents/
    /ModalDialogEnterExitEventsTest.java fails in Windows
    + JDK-8234270: [REDO] JDK-8204128 NMT might report incorrect
    numbers for Compiler area
    + JDK-8234332: [TESTBUG] java/awt/Focus/DisposedWindow/
    /DisposeDialogNotActivateOwnerTest/
    /DisposeDialogNotActivateOwnerTest.java fails on linux-x64
    nightly
    + JDK-8234398: Replace ID2D1Factory::GetDesktopDpi with
    GetDeviceCaps
    + JDK-8234522: [macos] Crash with use of native file dialog
    + JDK-8234691: Potential double-free in ParallelSPCleanupTask
    constructor
    + JDK-8234696: tools/jlink/plugins/VendorInfoPluginsTest.java
    times out
    + JDK-8234727: sun/security/ssl/X509TrustManagerImpl tests
    support TLSv1.3
    + JDK-8234728: Some security tests should support TLSv1.3
    + JDK-8234779: Provide idiom for declaring classes noncopyable
    + JDK-8234824: java/nio/channels/SocketChannel/AdaptSocket.java
    fails on Windows 10
    + JDK-8234968: check calloc rv in libinstrument
    InvocationAdapter
    + JDK-8235153: [TESTBUG] [macos 10.15] java/awt/Graphics/
    /DrawImageBG/SystemBgColorTest.java fails
    + JDK-8235183: Remove the "HACK CODE" in comment
    + JDK-8235263: Revert TLS 1.3 change that wrapped IOExceptions
    + JDK-8235311: Tag mismatch may alert bad_record_mac
    + JDK-8235332: TestInstanceCloneAsLoadsStores.java fails with
  - XX:+StressGCM
    + JDK-8235452: Strip mined loop verification fails with
    assert(is_OuterStripMinedLoop()) failed: invalid node class
    + JDK-8235584: UseProfiledLoopPredicate fails with
    assert(_phase-&gt;get_loop(c) == loop) failed: have to be in the
    same loop
    + JDK-8235620: Broken merge between JDK-8006406 and JDK-8003559
    + JDK-8235638: NPE in LWWindowPeer.getOnscreenGraphics()
    + JDK-8235686: Add more custom hooks in Bundles.gmk
    + JDK-8235739: Rare NPE at WComponentPeer.getGraphics()
    + JDK-8235762: JVM crash in SWPointer during C2 compilation
    + JDK-8235834: IBM-943 charset encoder needs updating
    + JDK-8235874: The ordering of Cipher Suites is not maintained
    provided through jdk.tls.client.cipherSuites and
    jdk.tls.server.cipherSuites system property.
    + JDK-8235908: omit ThreadPriorityPolicy warning when value is
    set from image
    + JDK-8235984: C2: assert(out-&gt;in(PhiNode::Region) == head ||
    out-&gt;in(PhiNode::Region) == slow_head) failed: phi must be
    either part of the slow or the fast loop
    + JDK-8236211: [Graal] compiler/graalunit/GraphTest.java is
    skipped in all testing
    + JDK-8236470: Deal with ECDSA using ecdsa-with-SHA2 plus hash
    algorithm as AlgorithmId
    + JDK-8236545: Compilation error in mach5
    java/awt/FileDialog/MacOSGoToFolderCrash.java
    + JDK-8236700: Upgrading JSZip from v3.1.5 to v3.2.2
    + JDK-8236759: ShouldNotReachHere in
    PhaseIdealLoop::verify_strip_mined_scheduling
    + JDK-8236897: Fix the copyright header for pkcs11gcm2.h
    + JDK-8236921: Add build target to produce a JDK image suitable
    for a Graal/SVM build
    + JDK-8236953: [macos] JavaFX SwingNode is not rendered on macOS
    + JDK-8236996: Incorrect Roboto font rendering on Windows with
    subpixel antialiasing
    + JDK-8237045: JVM uses excessive memory with -XX:+EnableJVMCI
  - XX:JVMCICounterSize=2147483648
    + JDK-8237055: [TESTBUG] compiler/c2/TestJumpTable.java fails
    with release VMs
    + JDK-8237086: assert(is_MachReturn()) running CTW with fix for
    JDK-8231291
    + JDK-8237192: Generate stripped/public pdbs on Windows for jdk
    images
    + JDK-8237396: JvmtiTagMap::weak_oops_do() should not trigger
    barriers
    + JDK-8237474: Default SSLEngine should create in server role
    + JDK-8237859: C2: Crash when loads float above range check
    + JDK-8237879: make 4.3 breaks build
    + JDK-8237951: CTW: C2 compilation fails with "malformed
    control flow"
    + JDK-8237962: give better error output for invalid OCSP
    response intervals in CertPathValidator checks
    + JDK-8238190: [JVMCI] Fix single implementor speculation for
    diamond shapes.
    + JDK-8238356: CodeHeap::blob_count() overestimates the number
    of blobs
    + JDK-8238452: Keytool generates wrong expiration date if
    validity is set to 2050/01/01
    + JDK-8238555: Allow Initialization of SunPKCS11 with NSS when
    there are external FIPS modules in the NSSDB
    + JDK-8238575: DragSourceEvent.getLocation() returns wrong
    value on HiDPI screens (Windows)
    + JDK-8238676: jni crashes on accessing it from process exit
    hook
    + JDK-8238721: Add failing client jtreg tests to the Problem
    List
    + JDK-8238738: AudioSystem.getMixerInfo() takes about 30 sec to
    report a gone audio device
    + JDK-8238756: C2: assert(((n) == __null || !VerifyIterativeGVN
    || !((n)-&gt;is_dead()))) failed: can not use dead node
    + JDK-8238765: PhaseCFG::schedule_pinned_nodes cannot handle
    precedence edges from unmatched CFG nodes correctly
    + JDK-8238898: Missing hash characters for header on license
    file
    + JDK-8238942: Rendering artifacts with LCD text and fractional
    metrics
    + JDK-8238985: [TESTBUG] The arrow image is blue instead of
    green
    + JDK-8239000: handle ContendedPaddingWidth in vm_version_ppc
    + JDK-8239055: Wrong implementation of VMState.hasListener
    + JDK-8239091: Reversed arguments in call to strstr in freetype
    "debug" code.
    + JDK-8239142: C2's UseUniqueSubclasses optimization is broken
    for array accesses
    + JDK-8239224: libproc_impl.c previous_thr may be used
    uninitialized warning
    + JDK-8239351: Give more meaningful InternalError messages in
    Deflater.c
    + JDK-8239365: ProcessBuilder test modifications for AIX
    execution
    + JDK-8239456: vtable stub generation: assert failure (code
    size estimate)
    + JDK-8239457: call ReleaseStringUTFChars before early returns
    in Java_sun_security_pkcs11_wrapper_PKCS11_connect
    + JDK-8239462: jdk.hotspot.agent misses some
    ReleaseStringUTFChars calls in case of early returns
    + JDK-8239557: [TESTBUG] VeryEarlyAssertTest.java validating
    "END." marker at lastline is not always true
    + JDK-8239787: AArch64: String.indexOf may incorrectly handle
    empty strings
    + JDK-8239792: Bump update version for OpenJDK: jdk-11.0.8
    + JDK-8239798: SSLSocket closes socket both socket endpoints on
    a SocketTimeoutException
    + JDK-8239819: XToolkit: Misread of screen information memory
    + JDK-8239852: java/util/concurrent tests fail with
  - XX:+VerifyGraphEdges: assert(!VerifyGraphEdges) failed:
    verification should have failed
    + JDK-8239893: Windows handle Leak when starting processes
    using ProcessBuilder
    + JDK-8239915: Zero VM crashes when handling dynamic constant
    + JDK-8239931: [win][x86] vtable stub generation: assert
    failure (code size estimate) follow-up
    + JDK-8239965: XMLEncoder/Test4625418.java fails due to "Error:
    Cp943 - can't read properly"
    + JDK-8239976: Put JDK-8239965 on the ProblemList.txt
    + JDK-8240073: Fix 'test-make' build target in 11u
    + JDK-8240197: Cannot start JVM when $JAVA_HOME includes CJK
    characters
    + JDK-8240202: A few client tests leave mouse buttons pressed
    + JDK-8240220: IdealLoopTree::dump_head predicate printing is
    broken
    + JDK-8240223: Use consistent predicate order in and with
    PhaseIdealLoop::find_predicate
    + JDK-8240227: Loop predicates should be copied to unswitched
    loops
    + JDK-8240286: [TESTBUG] Test command error in hotspot/jtreg/
    /compiler/loopopts/superword/SumRedAbsNeg_Float.java
    + JDK-8240518: Incorrect JNU_ReleaseStringPlatformChars in
    Windows Print
    + JDK-8240529: CheckUnhandledOops breaks NULL check in
    Modules::define_module
    + JDK-8240576: JVM crashes after transformation in C2
    IdealLoopTree::merge_many_backedges
    + JDK-8240603: Windows 32bit compile error after 8238676
    + JDK-8240629: argfiles parsing broken for argfiles with
    comment cross 4096 bytes chunk
    + JDK-8240711: TestJstatdPort.java failed due to
    "ExportException: Port already in use:"
    + JDK-8240786: [TESTBUG] The test java/awt/Window/
    /GetScreenLocation/GetScreenLocationTest.java fails on HiDPI
    screen
    + JDK-8240824: enhance print_full_memory_info on Linux by THP
    related information
    + JDK-8240827: Downport SSLSocketImpl.java from "8221882: Use
    fiber-friendly java.util.concurrent.locks in JSSE"
    + JDK-8240905: assert(mem == (Node*)1 || mem == mem2) failed:
    multiple Memories being matched at once?
    + JDK-8240972: macOS codesign fail on macOS 10.13.5 or older
    + JDK-8241445: Fix copyright in
    test/jdk/tools/launcher/ArgFileSyntax.java
    + JDK-8241458: [JVMCI] add mark value to expose
    CodeOffsets::Frame_Complete
    + JDK-8241464: [11u] Backport: make rehashing be a needed
    guaranteed safepoint cleanup action
    + JDK-8241556: Memory leak if -XX:CompileCommand is set
    + JDK-8241568: (fs) UserPrincipalLookupService.lookupXXX
    failure with IOE "Operation not permitted"
    + JDK-8241586: compiler/cpuflags/
    /TestAESIntrinsicsOnUnsupportedConfig.java fails on aarch64
    + JDK-8241638: launcher time metrics always report 1 on Linux
    when _JAVA_LAUNCHER_DEBUG set
    + JDK-8241660: Add virtualization information output to hs_err
    file on macOS
    + JDK-8241808: [TESTBUG] The JDK-8039467 bug appeared on macOS
    + JDK-8241888: Mirror jdk.security.allowNonCaAnchor system
    property with a security one
    + JDK-8241900: Loop unswitching may cause dependence on null
    check to be lost
    + JDK-8241948: enhance list of environment variables printed in
    hs_err file
    + JDK-8241996: on linux set full relro in the linker flags
    + JDK-8242108: Performance regression after fix for JDK-8229496
    + JDK-8242141: New System Properties to configure the TLS
    signature schemes
    + JDK-8242154: Backport parts of JDK-4947890 to OpenJDK 11u
    + JDK-8242174: [macos] The NestedModelessDialogTest test make
    the macOS unstable
    + JDK-8242239: [Graal] javax/management/generified/
    /GenericTest.java fails: FAILED: queryMBeans sets same
    + JDK-8242294: JSSE Client does not throw SSLException when an
    alert occurs during handshaking
    + JDK-8242379: [TESTBUG] compiler/loopopts/
    /TestLoopUnswitchingLostCastDependency.java fails with
    release VMs
    + JDK-8242470: Update Xerces to Version 2.12.1
    + JDK-8242498: Invalid "sun.awt.TimedWindowEvent" object leads
    to JVM crash
    + JDK-8242541: Small charset issues (ISO8859-16, x-eucJP-Open,
    x-IBM834 and x-IBM949C)
    + JDK-8242626: enhance posix print_rlimit_info
    + JDK-8243059: Build fails when --with-vendor-name contains a
    comma
    + JDK-8243539: Copyright info (Year) should be updated for fix
    of 8241638
    + JDK-8243541: (tz) Upgrade time-zone data to tzdata2020a
    + JDK-8244407: JVM crashes after transformation in C2
    IdealLoopTree::split_fall_in
    + JDK-8244520: problemlist
    java/awt/font/Rotate/RotatedFontTest.java on linux
    + JDK-8244777: ClassLoaderStats VM Op uses constant hash value
    + JDK-8244853: The static build of libextnet is missing the
    JNI_OnLoad_extnet function
    + JDK-8244951: Missing entitlements for hardened runtime
    + JDK-8245047: [PPC64] C2: ReverseBytes + Load always match to
    unordered Load (acquire semantics missing)
    + JDK-8245649: Revert 8245397 backport of 8230591
    + JDK-8246031: SSLSocket.getSession() doesn't close connection
    for timeout/ interrupts
    + JDK-8246613: Choose the default SecureRandom algo based on
    registration ordering
    + JDK-8248505: Unexpected NoSuchAlgorithmException when using
    secure random impl from BCFIPS provider
- Removed patch:
  * JDK-8228407.patch
    + integrated upstream</changelog>
  <changelog author="fstrba@suse.com" date="1604318400">- Update to upstream tag jdk-11.0.9-11 (October 2020 CPU,
  bsc#1177943)
  * New features
    + JDK-8250784: Shenandoah: A Low-Pause-Time Garbage Collector
  * Security fixes
    + JDK-8233624: Enhance JNI linkage
    + JDK-8236196: Improve string pooling
    + JDK-8236862, CVE-2020-14779: Enhance support of Proxy class
    + JDK-8237990, CVE-2020-14781: Enhanced LDAP contexts
    + JDK-8237995, CVE-2020-14782: Enhance certificate processing
    + JDK-8240124: Better VM Interning
    + JDK-8241114, CVE-2020-14792: Better range handling
    + JDK-8242680, CVE-2020-14796: Improved URI Support
    + JDK-8242685, CVE-2020-14797: Better Path Validation
    + JDK-8242695, CVE-2020-14798: Enhanced buffer support
    + JDK-8243302: Advanced class supports
    + JDK-8244136, CVE-2020-14803: Improved Buffer supports
    + JDK-8244479: Further constrain certificates
    + JDK-8244955: Additional Fix for JDK-8240124
    + JDK-8245407: Enhance zoning of times
    + JDK-8245412: Better class definitions
    + JDK-8245417: Improve certificate chain handling
    + JDK-8248574: Improve jpeg processing
    + JDK-8249927: Specify limits of jdk.serialProxyInterfaceLimit
    + JDK-8253019: Enhanced JPEG decoding
  * Other changes
    + JDK-6532025: GIF reader throws misleading exception with
    truncated images
    + JDK-6949753: [TEST BUG]: java/awt/print/PageFormat/
    /PDialogTest.java needs update by removing an infinite loop
    + JDK-8022535: [TEST BUG] javax/swing/text/html/parser/
    /Test8017492.java fails
    + JDK-8062947: Fix exception message to correctly represent
    LDAP connection failure
    + JDK-8067354: com/sun/jdi/GetLocalVariables4Test.sh failed
    + JDK-8134599: TEST_BUG: java/rmi/transport/closeServerSocket/
    /CloseServerSocket.java fails intermittently with Address
    already in use
    + JDK-8151678: com/sun/jndi/ldap/LdapTimeoutTest.java failed
    due to timeout on DeadServerNoTimeoutTest is incorrect
    + JDK-8160768: Add capability to custom resolve host/domain
    names within the default JNDI LDAP provider
    + JDK-8172404: Tools should warn if weak algorithms are used
    before restricting them
    + JDK-8193367: Annotated type variable bounds crash javac
    + JDK-8202117: com/sun/jndi/ldap/RemoveNamingListenerTest.java
    fails intermittently: Connection reset
    + JDK-8203026: java.rmi.NoSuchObjectException: no such object
    in table
    + JDK-8203281: [Windows] JComboBox change in ui when
    editor.setBorder() is called
    + JDK-8203382: Rename SystemDictionary::initialize_wk_klass to
    resolve_wk_klass
    + JDK-8203393: com/sun/jdi/JdbMethodExitTest.sh and
    JdbExprTest.sh fail due to timeout
    + JDK-8203928: [Test] Convert non-JDB scaffolding
    serviceability shell script tests to java
    + JDK-8204963: javax.swing.border.TitledBorder has a memory leak
    + JDK-8204994: SA might fail to attach to process with "Windbg
    Error: WaitForEvent failed"
    + JDK-8205534: Remove SymbolTable dependency from
    serviceability agent
    + JDK-8206309: Tier1 SA tests fail
    + JDK-8208281: java/nio/channels/
    /AsynchronousSocketChannel/Basic.java timed out
    + JDK-8209109: [TEST] rewrite com/sun/jdi shell tests to java
    version - step1
    + JDK-8209332: [TEST] test/jdk/com/sun/jdi/CatchPatternTest.sh
    is incorrect
    + JDK-8209342: Problemlist SA tests on Solaris due to Error
    attaching to process: Can't create thread_db agent!
    + JDK-8209343: Test javax/swing/border/TestTitledBorderLeak.java
    should be marked as headful
    + JDK-8209517: com/sun/jdi/BreakpointWithFullGC.java fails with
    timeout
    + JDK-8209604: [TEST] rewrite com/sun/jdi shell tests to java
    version - step2
    + JDK-8209605: com/sun/jdi/BreakpointWithFullGC.java fails with
    ZGC
    + JDK-8209608: Problem list com/sun/jdi/BreakpointWithFullGC.java
    + JDK-8210131: vmTestbase/nsk/jvmti/scenarios/allocation/AP10/
    /ap10t001/TestDescription.java failed with ObjectFree:
    GetCurrentThreadCpuTimerInfo returned unexpected error code
    + JDK-8210243: [TEST] rewrite com/sun/jdi shell tests to java
    version - step3
    + JDK-8210527: JShell: NullPointerException in
    jdk.jshell.Eval.translateExceptionStack
    + JDK-8210560: [TEST] convert com/sun/jdi redefineClass-related
    tests
    + JDK-8210725: com/sun/jdi/RedefineClearBreakpoint.java fails
    with waitForPrompt timed out after 60 seconds
    + JDK-8210748: [TESTBUG] lib.jdb.Jdb.waitForPrompt() should
    clarify which output is the pending reply after a timeout
    + JDK-8210760: [TEST] rewrite com/sun/jdi shell tests to java
    version - step4
    + JDK-8210977: jdk/jfr/event/oldobject/TestThreadLocalLeak.java
    fails to find ThreadLocalObject
    + JDK-8211292: [TEST] convert com/sun/jdi/DeferredStepTest.sh
    test
    + JDK-8211694: JShell: Redeclared variable should be reset
    + JDK-8212200: assert when shared java.lang.Object is redefined
    by JVMTI agent
    + JDK-8212629: [TEST] wrong breakpoint in
    test/jdk/com/sun/jdi/DeferredStepTest
    + JDK-8212665: com/sun/jdi/DeferredStepTest.java: jj1 (line 57)
  - unexpected. lastLine=52, minLine=52, maxLine=55
    + JDK-8212807: tools/jar/multiRelease/Basic.java times out
    + JDK-8213182: Minimal VM build failure after JDK-8212200
    (assert when shared java.lang.Object is redefined by JVMTI
    agent)
    + JDK-8213214: Set -Djava.io.tmpdir= when running tests
    + JDK-8213275: ReplaceCriticalClasses.java fails with
    jdk.internal.vm.PostVMInitHook not found
    + JDK-8213574: Deadlock in string table expansion when dumping
    lots of CDS classes
    + JDK-8213703: LambdaConversionException: Invalid receiver type
    not a subtype of implementation type interface
    + JDK-8214074: Ghash optimization using AVX instructions
    + JDK-8214491: Upgrade to JLine 3.9.0
    + JDK-8214797: TestJmapCoreMetaspace.java timed out
    + JDK-8215243: JShell tests failing intermitently with
    "Problem cleaning up the following threads:"
    + JDK-8215244: jdk/jshell/ToolBasicTest.java
    testHistoryReference failed
    + JDK-8215354: x86_32 build failures after JDK-8214074 (Ghash
    optimization using AVX instructions)
    + JDK-8215438: jshell tool: Ctrl-D causes EOF
    + JDK-8216021: RunTest.gmk might set concurrency level to 1 on
    Windows
    + JDK-8216974: HttpConnection not returned to the pool after
    204 response
    + JDK-8218948: SimpleDateFormat :: format - Zone Names are not
    reflected correctly during run time
    + JDK-8219712: code_size2 (defined in stub_routines_x86.hpp) is
    too small on new Skylake CPUs
    + JDK-8220150: macos10.14 Mojave returns anti-aliased glyphs
    instead of aliased B&amp;W glyphs
    + JDK-8221658: aarch64: add necessary predicate for ubfx
    patterns
    + JDK-8221759: Crash when completing "java.io.File.path"
    + JDK-8221918: runtime/SharedArchiveFile/serviceability/
    /ReplaceCriticalClasses.java fails: Shared archive not found
    + JDK-8222074: Enhance auto vectorization for x86
    + JDK-8222079: Don't use memset to initialize fields decode_env
    constructor in disassembler.cpp
    + JDK-8222769: [TESTBUG] TestJFRNetworkEvents should not rely
    on hostname command
    + JDK-8223688: JShell: crash on the instantiation of raw
    anonymous class
    + JDK-8223777: In posix_spawn mode, failing to exec()
    jspawnhelper does not result in an error
    + JDK-8223940: Private key not supported by chosen signature
    algorithm
    + JDK-8224184: jshell got IOException at exiting with AIX
    + JDK-8224234: compiler/codegen/TestCharVect2.java fails in
    test_mulc
    + JDK-8225037: java.net.JarURLConnection::getJarEntry() throws
    NullPointerException
    + JDK-8225625: AES Electronic Codebook (ECB) encryption and
    decryption optimization using AVX512 + VAES instructions
    + JDK-8226536: Catch OOM from deopt that fails rematerializing
    objects
    + JDK-8226575: OperatingSystemMXBean should be made container
    aware
    + JDK-8226697: Several tests which need the @key headful
    keyword are missing it.
    + JDK-8226809: Circular reference in printed stack trace is not
    correctly indented &amp; ambiguous
    + JDK-8227059: sun/security/tools/keytool/
    /DefaultSignatureAlgorithm.java timed out
    + JDK-8227269: Slow class loading when running with JDWP
    + JDK-8227595: keytool/fakegen/DefaultSignatureAlgorithm.java
    fails due to "exitValue = 6"
    + JDK-8228448: Jconsole can't connect to itself
    + JDK-8228967: Trust/Key store and SSL context utilities for
    tests
    + JDK-8229378: jdwp library loader in linker_md.c quietly
    truncates on buffer overflow
    + JDK-8229815: Upgrade Jline to 3.12.1
    + JDK-8230000: some httpclients testng tests run zero test
    + JDK-8230002: javax/xml/jaxp/unittest/transform/
    /SecureProcessingTest.java runs zero test
    + JDK-8230010: Remove jdk8037819/BasicTest1.java
    + JDK-8230094: CCE in createXMLEventWriter(Result) over an
    arbitrary XMLStreamWriter
    + JDK-8230402: Allocation of compile task fails with assert:
    "Leaking compilation tasks?"
    + JDK-8230767: FlightRecorderListener returns null recording
    + JDK-8230870: (zipfs) Add a ZIP FS test that is similar to
    test/jdk/java/util/zip/EntryCount64k.java
    + JDK-8231209: [REDO] ThreadMXBean::getThreadAllocatedBytes()
    can be quicker for self thread
    + JDK-8231586: enlarge encoding space for OopMapValue offsets
    + JDK-8231953: Wrong assumption in assertion in
    oop::register_oop
    + JDK-8231968: getCurrentThreadAllocatedBytes default
    implementation s/b getThreadAllocatedBytes
    + JDK-8232083: Minimal VM is broken after JDK-8231586
    + JDK-8232161: Align some one-way conversion in MS950 charset
    with Windows
    + JDK-8232855: jshell missing word in /help help
    + JDK-8233027: OopMapSet::all_do does oms.next() twice during
    iteration
    + JDK-8233228: Disable weak named curves by default in TLS,
    CertPath, and Signed JAR
    + JDK-8233386: Initialize NULL fields for unused decorations
    + JDK-8233452: java.math.BigDecimal.sqrt() with
    RoundingMode.FLOOR results in incorrect result
    + JDK-8233686: XML transformer uses excessive amount of memory
    + JDK-8233741: AES Countermode (AES-CTR) optimization using
    AVX512 + VAES instructions
    + JDK-8233829: javac cannot find non-ASCII module name under
    non-UTF8 environment
    + JDK-8233958: Memory retention due to HttpsURLConnection
    finalizer that serves no purpose
    + JDK-8234011: (zipfs) Memory leak in
    ZipFileSystem.releaseDeflater()
    + JDK-8234058: runtime/CompressedOops/
    /CompressedClassPointers.java fails with 'Narrow klass base:
    0x0000000000000000' missing from stdout/stderr
    + JDK-8234149: Several regression tests do not dispose Frame at
    end
    + JDK-8234347: "Turkey" meta time zone does not generate
    composed localized names
    + JDK-8234385: [TESTBUG] java/awt/EventQueue/6980209/
    /bug6980209.java fails in linux nightly
    + JDK-8234535: Cross compilation fails due to missing CFLAGS
    for the BUILD_CC
    + JDK-8234541: C1 emits an empty message when it inlines
    successfully
    + JDK-8234687: change javap reporting on unknown attributes
    + JDK-8236464: SO_LINGER option is ignored by SSLSocket in JDK
    11
    + JDK-8236548: Localized time zone name inconsistency between
    English and other locales
    + JDK-8236617: jtreg test containers/docker/
    /TestMemoryAwareness.java fails after 8226575
    + JDK-8237182: Update copyright header for shenandoah and
    epsilon files
    + JDK-8237888: security/infra/java/security/cert/
    /CertPathValidator/certification/LuxTrustCA.java fails when
    checking validity interval
    + JDK-8237977: Further update
    javax/net/ssl/compatibility/Compatibility.java
    + JDK-8238270: java.net HTTP/2 client does not decrease stream
    count when receives 204 response
    + JDK-8238284: [macos] Zero VM build fails due to an obvious
    typo
    + JDK-8238380: java.base/unix/native/libjava/childproc.c
    "multiple definition" link errors with GCC10
    + JDK-8238386: (sctp) jdk.sctp/unix/native/libsctp/SctpNet.c
    "multiple definition" link errors with GCC10
    + JDK-8238388: libj2gss/NativeFunc.o "multiple definition" link
    errors with GCC10
    + JDK-8238448: RSASSA-PSS signature verification fail when
    using certain odd key sizes
    + JDK-8238710: LingeredApp doesn't log stdout/stderr if exits
    with non-zero code
    + JDK-8239083: C1 assert(known_holder == NULL ||
    (known_holder-&gt;is_instance_klass() &amp;&amp;
    (!known_holder-&gt;is_interface() ||
    ((ciInstanceKlass*)known_holder)-&gt;has_nonstatic_concrete_methods())),
    "should be non-static concrete method");
    + JDK-8239385: KerberosTicket client name refers wrongly to
    sAMAccountName in AD
    + JDK-8240169: javadoc fails to link to non-modular api docs
    + JDK-8240295: hs_err elapsed time in seconds is not accurate
    enough
    + JDK-8240360: NativeLibraryEvent has wrong library name on
    Linux
    + JDK-8240676: Meet not symmetric failure when running lucene
    on jdk8
    + JDK-8241007: Shenandoah: remove
    ShenandoahCriticalControlThreadPriority support
    + JDK-8241065: Shenandoah: remove leftover code after
    JDK-8231086
    + JDK-8241086: Test runtime/NMT/HugeArenaTracking.java is
    failing on 32bit Windows
    + JDK-8241130: com.sun.jndi.ldap.EventSupport.removeDeadNotifier:
    java.lang.NullPointerException
    + JDK-8241138: http.nonProxyHosts=* causes
    StringIndexOutOfBoundsException in DefaultProxySelector
    + JDK-8241319: WB_GetCodeBlob doesn't have ResourceMark
    + JDK-8241478: vmTestbase/gc/gctests/Steal/steal001/steal001.java
    fails with OOME
    + JDK-8241574: Shenandoah: remove ShenandoahAssertToSpaceClosure
    + JDK-8241750: x86_32 build failure after JDK-8227269
    + JDK-8242184: CRL generation error with RSASSA-PSS
    + JDK-8242283: Can't start JVM when java home path includes
    non-ASCII character
    + JDK-8242556: Cannot load RSASSA-PSS public key with non-null
    params from byte array
    + JDK-8243029: Rewrite javax/net/ssl/compatibility/
    /Compatibility.java with a flexible interop test framework
    + JDK-8243138: Enhance BaseLdapServer to support starttls
    extended request
    + JDK-8243320: Add SSL root certificates to Oracle Root CA
    program
    + JDK-8243321: Add Entrust root CA - G4 to Oracle Root CA
    program
    + JDK-8243389: enhance os::pd_print_cpu_info on linux
    + JDK-8243453: java --describe-module failed with non-ASCII
    module name under non-UTF8 environment
    + JDK-8243470: [macos] bring back O2 opt level for unsafe.cpp
    + JDK-8243489: Thread CPU Load event may contain wrong data for
    CPU time under certain conditions
    + JDK-8243925: Toolkit#getScreenInsets() returns wrong value on
    HiDPI screens (Windows)
    + JDK-8244087: 2020-04-24 public suffix list update
    + JDK-8244151: Update MUSCLE PC/SC-Lite headers to the latest
    release 1.8.26
    + JDK-8244164: AArch64: jaotc generates incorrect code for
    compressed OOPs with non-zero heap base
    + JDK-8244196: adjust output in os_linux
    + JDK-8244225: stringop-overflow warning on strncpy call from
    compile_the_world_in
    + JDK-8244287: JFR: Methods samples have line number 0
    + JDK-8244703: "platform encoding not initialized" exceptions
    with debugger, JNI
    + JDK-8244719: CTW: C2 compilation fails with
    "assert(!VerifyHashTableKeys || _hash_lock == 0) failed:
    remove node from hash table before modifying it"
    + JDK-8244729: Shenandoah: remove resolve paths from
    SBSA::generate_shenandoah_lrb
    + JDK-8244763: Update --release 8 symbol information after JSR
    337 MR3
    + JDK-8244818: Java2D Queue Flusher crash while moving
    application window to external monitor
    + JDK-8245151: jarsigner should not raise duplicate warnings on
    verification
    + JDK-8245616: Bump update version for OpenJDK: jdk-11.0.9
    + JDK-8245714: "Bad graph detected in build_loop_late" when
    loads are pinned on loop limit check uncommon branch
    + JDK-8245801: StressRecompilation triggers assert "redundunt
    OSR recompilation detected. memory leak in CodeCache!"
    + JDK-8245832: JDK build make-static-libs should build all JDK
    libraries
    + JDK-8245880: Shenandoah: check class unloading flag early in
    concurrent code root scan
    + JDK-8245981: Upgrade to jQuery 3.5.1
    + JDK-8246027: Minimal fastdebug build broken after JDK-8245801
    + JDK-8246094: [macos] Sound Recording and playback is not
    working
    + JDK-8246153: TestEliminateArrayCopy fails with
  - XX:+StressReflectiveCode
    + JDK-8246193: Possible NPE in ENC-PA-REP search in AS-REQ
    + JDK-8246196: javax/management/MBeanServer/OldMBeanServerTest
    fails with AssertionError
    + JDK-8246203: Segmentation fault in verification due to stack
    overflow with -XX:+VerifyIterativeGVN
    + JDK-8246330: Add TLS Tests for Legacy ECDSA curves
    + JDK-8246453: TestClone crashes with "all collected exceptions
    must come from the same place"
    + JDK-8247246: Add explicit ResolvedJavaType.link and expose
    presence of default methods
    + JDK-8247350: [aarch64] assert(false) failed: wrong size of
    mach node
    + JDK-8247502: PhaseStringOpts crashes while optimising
    effectively dead code
    + JDK-8247615: Initialize the bytes left for the heap sampler
    + JDK-8247824: CTW: C2 (Shenandoah) compilation fails with SEGV
    in SBC2Support::pin_and_expand
    + JDK-8247874: Replacement in VersionProps.java.template not
    working when --with-vendor-bug-url contains '&amp;'
    + JDK-8247979: aarch64: missing side effect of killing flags
    for clearArray_reg_reg
    + JDK-8248214: Add paddings for TaskQueueSuper to reduce
    false-sharing cache contention
    + JDK-8248219: aarch64: missing memory barrier in
    fast_storefield and fast_accessfield
    + JDK-8248348: Regression caused by the update to BCEL 6.0
    + JDK-8248385: [testbug][11u] Adapt TestInitiExceptions to
    jtreg 5.1
    + JDK-8248495: [macos] zerovm is broken due to libffi headers
    location
    + JDK-8248851: CMS: Missing memory fences between free chunk
    check and klass read
    + JDK-8248987: AOT's Linker.java seems to eagerly fail-fast on
    Windows
    + JDK-8249159: Downport test rework for SSLSocketTemplate from
    8224650
    + JDK-8249215: JFrame::setVisible crashed with
  - Dfile.encoding=UTF-8 on Japanese Windows.
    + JDK-8249251: [dark_mode ubuntu 20.04] The selected menu is
    not highlighted in GTKLookAndFeel
    + JDK-8249255: Build fails if source code in cygwin home dir
    + JDK-8249277: TestVerifyIterativeGVN.java is failing with
    timeout in OpenJDK 11
    + JDK-8249278: Revert JDK-8226253 which breaks the spec of
    AccessibleState.SHOWING for JList
    + JDK-8249560: Shenandoah: Fix racy GC request handling
    + JDK-8249801: Shenandoah: Clear soft-refs on requested GC cycle
    + JDK-8249953: Shenandoah: gc/shenandoah/mxbeans tests should
    account for corner cases
    + JDK-8250582: Revert Principal Name type to NT-UNKNOWN when
    requesting TGS Kerberos tickets
    + JDK-8250609: C2 crash in IfNode::fold_compares
    + JDK-8250627: Use -XX:+/-UseContainerSupport for
    enabling/disabling Java container metrics
    + JDK-8250755: Better cleanup for
    jdk/test/javax/imageio/plugins/shared/CanWriteSequence.java
    + JDK-8250787: Provider.put no longer registering aliases in
    FIPS env
    + JDK-8250826: jhsdb does not work with coredump which comes
    from Substrate VM
    + JDK-8250827: Shenandoah: needs to reset/finish StringTable's
    dead count before/after parallel walk
    + JDK-8250844: Make sure {type,obj}ArrayOopDesc accessors check
    the bounds
    + JDK-8251117: Cannot check P11Key size in P11Cipher and
    P11AEADCipher
    + JDK-8251354: Shenandoah: Fix jdk/jfr/tool/TestPrintJSON.java
    test failure
    + JDK-8251451: Shenandoah: Remark ObjectSynchronizer roots with
    I-U
    + JDK-8251469: Better cleanup for
    test/jdk/javax/imageio/SetOutput.java
    + JDK-8251487: Shenandoah: missing detail timing tracking for
    final mark cleaning phase
    + JDK-8252120: compiler/oracle/TestCompileCommand.java
    misspells "occured"
    + JDK-8252157: JDK-8231209 11u backport breaks jmm binary
    compatibility
    + JDK-8252258: [11u] JDK-8242154 changes the default vendor
    + JDK-8252804: [test] Fix 'ReleaseDeflater.java' test after
    downport of 8234011
    + JDK-8253134: JMM_VERSION should remain at 0x20020000 (JDK 10)
    in JDK 11
    + JDK-8253283: [11u] Test build/translations/
    /VerifyTranslations.java failing after JDK-8252258
    + JDK-8253813: Backout JDK-8244287 from 11u: it causes several
    crashes
- Removed patch:
  * gcc-fno-common-fix.patch
    + not needed any more with this version
- Added patch:
  * JDK-8250861.patch
    + Fix regression "8250861: Crash in MinINode::Ideal(PhaseGVN*,
    bool)" introduced in jdk 11.0.9</changelog>
  <changelog author="fstrba@suse.com" date="1604491200">- Enable Sheandoah GC for x86_64 (jsc#ECO-3171)</changelog>
  <changelog author="fstrba@suse.com" date="1605528000">- Update to upstream tag jdk-11.0.9.1-1
  * Fix:
    + JDK-8250861: Crash in MinINode::Ideal(PhaseGVN*, bool)
- Removed patch:
  * JDK-8250861.patch
    + Integrated upstream</changelog>
  <changelog author="fstrba@suse.com" date="1611230400">- Update to upstream tag jdk-11.0.10+9 (January 2021 CPU,
  bsc#1181239)
  * Security fixes
    + JDK-8247619: Improve Direct Buffering of Characters
  * Other changes
    + JDK-6722928: Support SSPI as a native GSS-API provider
    + JDK-7185258: [macosx] Deadlock in SunToolKit.realSync()
    + JDK-8152332: [macosx] JFileChooser cannot be serialized on
    Mac OS X
    + JDK-8161684: [testconf] Add VerifyOops' testing into compiler
    tiers
    + JDK-8171279: Support X25519 and X448 in TLS
    + JDK-8173361: various crashes in
    JvmtiExport::post_compiled_method_load
    + JDK-8173658: JvmtiExport::post_class_unload() is broken for
    non-JavaThread initiators
    + JDK-8191006: hsdis disassembler plugin does not compile with
    binutils 2.29+
    + JDK-8197981: Missing return statement in
    __sync_val_compare_and_swap_8
    + JDK-8198334: java/awt/FileDialog/8003399/bug8003399.java
    fails in headless mode
    + JDK-8200151: Add 8 JNDI tests to com/sun/jndi/dns/ConfigTests/
    + JDK-8208279: Add 8 JNDI tests to com/sun/jndi/dns/EnvTests/
    + JDK-8208483: Add 5 JNDI tests to
    com/sun/jndi/dns/FactoryTests/
    + JDK-8208542: Add 4 JNDI tests to com/sun/jndi/dns/ListTests/
    + JDK-8208665: Amend cross-compilation docs with
    qemu-debootstrap recipe
    + JDK-8210088: ProblemList gc/epsilon/TestMemoryMXBeans.java
    + JDK-8210339: Add 10 JNDI tests to com/sun/jndi/dns/FedTests/
    + JDK-8211450: UndetVar::dup is not copying the kind field to
    the duplicated instance
    + JDK-8212160: JVMTI agent crashes with "assert(_value != 0LL)
    failed: resolving NULL _value"
    + JDK-8212226: SurfaceManager throws "Invalid Image variant"
    for MultiResolutionImage (Windows)
    + JDK-8213400: Support choosing group name in keytool keypair
    generation
    + JDK-8213535: Windows HiDPI html lightweight tooltips are
    truncated
    + JDK-8213698: Improve devkit creation and add support for
    linux/ppc64/ppc64le/s390x
    + JDK-8214025: assert(t-&gt;singleton()) failed: must be a
    constant when ScavengeRootsInCode &lt; 2
    + JDK-8214242: compiler/arguments/TestScavengeRootsInCode.java
    fails because of missing UnlockDiagnosticVMOptions
    + JDK-8214787: Zero builds fail with "undefined
    JavaThread::thread_state()"
    + JDK-8215583: Exclude
    runtime/handshake/HandshakeWalkSuspendExitTest.java
    + JDK-8216012: Infinite loop in RSA KeyPairGenerator
    + JDK-8216324: GetClassMethods is confused by the presence of
    default methods in super interfaces
    + JDK-8217429: WebSocket over authenticating proxy fails to
    send Upgrade headers
    + JDK-8217976: test/jdk/java/net/httpclient/websocket/
    /WebSocketProxyTest.java fails intermittently
    + JDK-8218021: Have jarsigner preserve posix permission
    attributes
    + JDK-8218287: jshell tool: input behavior unstable after
    12-ea+24 on Windows
    + JDK-8218851: JVM crash in custom classloader stress test, JDK
    12 &amp; 13
    + JDK-8220420: Cleanup c1_LinearScan
    + JDK-8222072: JVMTI GenerateEvents() sends CompiledMethodLoad
    events to wrong jvmtiEnv
    + JDK-8222286: Fix for JDK-8213419 is broken on s390
    + JDK-8222527: HttpClient doesn't send HOST header when
    tunelling HTTP/1.1 through http proxy
    + JDK-8222533: jtreg test jdk/internal/platform/cgroup/
    /TestCgroupMetrics.java fails on SLES12.3 linux ppc64le
    machine
    + JDK-8224506: [TESTBUG] TestDockerMemoryMetrics.java fails
    with exitValue = 137
    + JDK-8224555: vmTestbase/nsk/jvmti/scenarios/contention/TC02/
    /tc02t001/TestDescription.java failed
    + JDK-8224650: Add tests to support X25519 and X448 in TLS
    + JDK-8225072: Add LuxTrust certificate that is expiring in
    March 2021 to list of allowed but expired certs
    + JDK-8225329: -XX:+PrintBiasedLockingStatistics causes crash
    during initialization on Windows platforms
    + JDK-8225687: Newly added sspi.cpp in JDK-6722928 still
    contains some small errors
    + JDK-8227006: [linux] Runtime.availableProcessors execution
    time increased by factor of 100
    + JDK-8227275: Within native OOM error handling, assertions may
    hang the process
    + JDK-8227647: [Graal] Test8009761.java fails due to
    "RuntimeException: static java.lang.Object
    compiler.uncommontrap.Test8009761.m3(boolean,boolean) not
    compiled"
    + JDK-8229495: SIGILL in C2 generated OSR compilation
    + JDK-8230910: libsspi_bridge does not build on Windows 32bit
    + JDK-8232114: JVM crashed at imjpapi.dll in native code
    + JDK-8234147: Avoid looking up standard charsets in core
    libraries
    + JDK-8234393: [macos] printing ignores printer tray
    + JDK-8234863: Increase default value of MaxInlineLevel
    + JDK-8235218: Minimal VM is broken after JDK-8173361
    + JDK-8235456: Minimal VM is broken after JDK-8212160
    + JDK-8235829: graal crashes with Zombie.java test
    + JDK-8236124: Minimal VM slowdebug build failed after
    JDK-8212160
    + JDK-8236512: PKCS11 Connection closed after Cipher.doFinal
    and NoPadding
    + JDK-8236944: The legVecZ operand should be limited to
    zmm0-zmm15 registers
    + JDK-8237186: Fix typo in copyright header of
    java/io/Reader/TransferTo.java
    + JDK-8237499: JFR: Include stack trace in the ThreadStart event
    + JDK-8237512: AArch64: aarch64TestHook leaks a BufferBlob
    + JDK-8237524: AArch64: String.compareTo() may return incorrect
    result
    + JDK-8237950: C2 compilation fails with "Live Node limit
    exceeded limit" during ConvI2L::Ideal optimization
    + JDK-8238579: HttpsURLConnection drops the timeout and hangs
    forever in read
    + JDK-8239105: Add exception for expiring Digicert root
    certificates to VerifyCACerts test
    + JDK-8239477: jdk/jfr/jcmd/TestJcmdStartStopDefault.java fails
  - XX:+VerifyOops with "verify_oop: rsi: broken oop"
    + JDK-8239497: SEGV in EdgeUtils::field_name_symbol(Edge const&amp;)
    + JDK-8239886: Minimal VM build fails after JDK-8237499
    + JDK-8240633: Memory leaks in the implementations of
    FileChooserUI
    + JDK-8240690: Race condition between EDT and
    BasicDirectoryModel.FilesLoader.run0()
    + JDK-8241234: Unify monitor enter/exit runtime entries.
    + JDK-8241311: Move some charset mapping tests from closed to
    open
    + JDK-8241797: Add some tests to the problem list
    + JDK-8242029: AArch64: skip G1 array copy pre-barrier if
    marking not active
    + JDK-8242335: Additional Tests for RSASSA-PSS
    + JDK-8242480: Negative value may be returned by
    getFreeSwapSpaceSize() in the docker
    + JDK-8242614: cleanup duplicated test ldap server in some
    com/sun/jndi/ldap/ tests
    + JDK-8242846: Bring back test/jdk/tools/jlink/plugins/
    /OrderResourcesPluginTest.java
    + JDK-8243114: Implement montgomery{Multiply,Square}intrinsics
    on Windows
    + JDK-8243290: Improve diagnostic messages for class
    verification and redefinition failures
    + JDK-8243488: Add tests for set/get SendBufferSize and
    getReceiveBufferSize in DatagramSocket
    + JDK-8243549: sun/security/ssl/CipherSuite/
    /NamedGroupsWithCipherSuite.java failed with Unsupported
    signature algorithm: DSA
    + JDK-8243617: compiler/onSpinWait/TestOnSpinWaitC1.java test
    uses wrong class
    + JDK-8243619: compiler/codecache/CheckSegmentedCodeCache.java
    test misses -version
    + JDK-8244142: some hotspot/runtime tests don't check exit code
    of forked JVM
    + JDK-8244278: Excessive code cache flushes and sweeps
    + JDK-8244282: test/hotspot/jtreg/compiler/intrinsics/
    /Test8237524.java fails with --illegal-access=deny
    + JDK-8244621: [macos10.15] Garbled FX printing plus CoreText
    warnings on Catalina when building with Xcode 11
    + JDK-8244819: hsdis does not compile with binutils 2.34+
    + JDK-8245051: c1 is broken if it is compiled by gcc without
  - fno-lifetime-dse
    + JDK-8245168: jlink should not be treated as a "small" tool
    + JDK-8245400: Upgrade to LittleCMS 2.11
    + JDK-8246381: VM crashes with "Current BasicObjectLock* below
    than low_mark"
    + JDK-8246434: Threads::print_on_error assumes that the heap
    has been set up
    + JDK-8246648: issue with OperatingSystemImpl
    getFreeSwapSpaceSize in docker after 8242480
    + JDK-8247201: Print potential pointer value of readable stack
    memory in hs_err file
    + JDK-8247763: assert(outer-&gt;outcnt() == 2) failed: 'only phis'
    failure in LoopNode::verify_strip_mined()
    + JDK-8247867: Upgrade to freetype 2.10.2
    + JDK-8248190: Enable Power10 system and implement new
    byte-reverse instructions
    + JDK-8248226: TestCloneAccessStressGCM fails with
  - XX:-ReduceBulkZeroing
    + JDK-8248347: windows build broken by JDK-8243114
    + JDK-8248532: Every time I change keyboard language at my
    MacBook, Java crashes
    + JDK-8248552: C2 crashes with SIGFPE due to division by zero
    + JDK-8248596: [TESTBUG] compiler/loopopts/
    /PartialPeelingUnswitch.java times out with Graal enabled
    + JDK-8248745: Add jarsigner and keytool tests for restricted
    algorithms
    + JDK-8248791: sun/util/resources/cldr/TimeZoneNamesTest.java
    fails with -XX:-ReduceInitialCardMarks -XX:-ReduceBulkZeroing
    + JDK-8248845: AArch64: stack corruption after spilling vector
    register
    + JDK-8249176: Update GlobalSignR6CA test certificates
    + JDK-8249183: JVM crash in "AwtFrame::WmSize" method
    + JDK-8249192: MonitorInfo stores raw oops across safepoints
    + JDK-8249602: C2: assert(cnt == _outcnt) failed: no insertions
    allowed
    + JDK-8249603: C1: assert(has_error == false) failed: register
    allocation invalid
    + JDK-8249605: C2: assert(no_dead_loop) failed: dead loop
    detected
    + JDK-8249607: C2: assert(!had_error) failed: bad dominance
    + JDK-8249608: Vector register used by C2 compiled method
    corrupted at safepoint
    + JDK-8249672: Include microcode revision in features_string on
    x86
    + JDK-8249748: gtest silently ignores bad jvm arguments
    + JDK-8249821: Separate libharfbuzz from libfontmanager
    + JDK-8250598: Hyper-V is detected in spite of running on host
    OS
    + JDK-8250605: Linux x86_32 builds fail after JDK-8249821
    + JDK-8250636: iso8601_time returns incorrect offset part on
    MacOS
    + JDK-8250665: Wrong translation for the month name of May in
    ar_JO,LB,SY
    + JDK-8250772: Test com/sun/jndi/ldap/
    /NamingExceptionMessageTest.java fails intermittently with
    javax.naming.ServiceUnavailableException
    + JDK-8250825: C2 crashes with assert(field != __null) failed:
    missing field
    + JDK-8250894: Provide a configure option to build and run
    against the platform libharfbuzz
    + JDK-8250928: JFR: Improve hash algorithm for stack traces
    + JDK-8250968: Symlinks attributes not preserved when using
    jarsigner on zip files
    + JDK-8250984: Memory Docker tests fail on some Linux kernels
    w/o cgroupv1 swap limit capabilities
    + JDK-8251118: BiasedLocking::preserve_marks should not have a
    HandleMark
    + JDK-8251189: com/sun/jndi/ldap/LdapDnsProviderTest.java
    failed due to timeout
    + JDK-8251257: NMT: jcmd VM.native_memory scale=1 crashes
    target VM
    + JDK-8251365: Build failure on AIX after 8250636
    + JDK-8251397: NPE on ClassValue.ClassValueMap.cacheArray
    + JDK-8251456: [TESTBUG] compiler/vectorization/
    /TestVectorsNotSavedAtSafepoint.java failed OutOfMemoryError
    + JDK-8251458: Parse::do_lookupswitch fails with "assert(_cnt
    &gt;= 0) failed"
    + JDK-8251535: Partial peeling at unsigned test adds incorrect
    loop exit check
    + JDK-8251949: ZGC: Set explicit heap size for
    compiler/gcbarriers tests
    + JDK-8252090: JFR: StreamWriterHost::write_unbuffered() stucks
    in an infinite loop OpenJDK (build 13.0.1+9)
    + JDK-8252415: Bump update version for OpenJDK: jdk-11.0.10
    + JDK-8252470: java/awt/dnd/DisposeFrameOnDragCrash/
    /DisposeFrameOnDragTest.java fails on Windows
    + JDK-8252497: Incorrect numeric currency code for ROL
    + JDK-8252660: Shenandoah: support manageable SoftMaxHeapSize
    option
    + JDK-8252679: Two windows specific FileDIalog tests may fail
    on some Windows_Server_2016_Standard
    + JDK-8252696: Loop unswitching may cause out of bound array
    load to be executed
    + JDK-8252754: Hash code calculation of JfrStackTrace is
    inconsistent
    + JDK-8253219: Epsilon: clean up unnecessary includes
    + JDK-8253224: Shenandoah: ShenandoahStrDedupQueue destructor
    calls virtual num_queues()
    + JDK-8253226: Shenandoah: remove unimplemented
    ShenandoahStrDedupQueue::verify
    + JDK-8253269: The CheckCommonColors test should provide more
    info on failure
    + JDK-8253284: Zero OrderAccess barrier mappings are incorrect
    + JDK-8253375: OSX build fails with Xcode 12.0 (12A7209)
    + JDK-8253778: ShenandoahSafepoint::is_at_shenandoah_safepoint
    should not access VMThread state from other threads
    + JDK-8253791: Issue with useAppleColor check in CSystemColors.m
    + JDK-8254016: Test8237524 fails with -XX:-CompactStrings option
    + JDK-8254081: java/security/cert/PolicyNode/
    /GetPolicyQualifiers.java fails due to an expired certificate
    + JDK-8254144: Non-x86 Zero builds fail with return-type
    warning in os_linux_zero.cpp
    + JDK-8254166: Zero: return-type warning in
    zeroInterpreter_zero.cpp
    + JDK-8254177: (tz) Upgrade time-zone data to tzdata2020b
    + JDK-8254185: Fix Code cache sweeper heuristics for JDK 11
    + JDK-8254190: [s390] interpreter misses exception check after
    calling monitorenter
    + JDK-8254790: SIGSEGV in string_indexof_char and
    stringL_indexof_char intrinsics
    + JDK-8254854: [cgroups v1] Metric limits not properly detected
    on some join controller combinations
    + JDK-8254982: (tz) Upgrade time-zone data to tzdata2020c
    + JDK-8255050: Add pkcs11/KeyStore/ClientAuth.sh to Problem list
    + JDK-8255065: Zero: accessor_entry misses the IRIW case
    + JDK-8255226: (tz) Upgrade time-zone data to tzdata2020d
    + JDK-8255269: Unsigned overflow in g1Policy.cpp
    + JDK-8255365: Problem list failing client manual tests
    + JDK-8255457: Shenandoah: cleanup ShenandoahMarkTask
    + JDK-8255466: C2 crashes at ciObject::get_oop() const+0x0
    + JDK-8255550: x86: Assembler::cmpq(Address dst, Register src)
    encoding is incorrect
    + JDK-8255603: Memory/Performance regression after JDK-8210985
    + JDK-8255760: Shenandoah: match constants style in
    ShenandoahMarkTask fallback
    + JDK-8255781: Bump patch update version for OpenJDK:
    jdk-11.0.9.1
    + JDK-8255937: Better cleanup for
    test/jdk/javax/imageio/stream/StreamFlush.java
    + JDK-8256427: Test com/sun/jndi/dns/ConfigTests/
    /PortUnreachable.java does not work on AIX
    + JDK-8256452: Integrate missing part of JDK-8232370 to 11u
    + JDK-8256483: [TESTBUG] serviceability/jvmti/GetClassMethods/
    /libOverpassMethods.c fails to compile on gcc 4.4.x
    + JDK-8256557: libharfbuzz fails to link on gcc 4.4.x due to
  - Wl,-z,defs
    + JDK-8256618: Zero: Linux x86_32 build still fails
    + JDK-8256736: Zero: GTest tests fail with "unsuppported vm
    variant"
    + JDK-8256809: Annotation processing causes NPE during flow
    analysis
    + JDK-8257181: s390x builds are very noisy with gc-sections
    messages
    + JDK-8257242: [macOS] Java app crashes while switching input
    methods
    + JDK-8257545: SunJSSE FIPS regression in key exchange after
    JDK-8171279 11u backport
    + JDK-8257641: Shenandoah: Query is_at_shenandoah_safepoint()
    from control thread should return false
    + JDK-8257701: Shenandoah: objArrayKlass metadata is not marked
    with chunked arrays
    + JDK-8258630: Add expiry exception for QuoVadis root
    certificate
- New upstream dependency on libharfbuzz
- Regenerated patches: missing-return.patch system-pcsclite.patch</changelog>
  <changelog author="fstrba@suse.com" date="1616155200">- Added patches:
  * system-crypto-policy.patch
    + Let OpenJDK use system crypto policies unless explicitely told
    not to
  * nss-security-provider.patch
    + Add the NSS security provider with configuration in generated
    nss.cfg file
  * keytool-default-rsa.patch
    + Make keytool generate RSA keys by default, since only the
    LEGACY system crypto policy allows DSA</changelog>
  <changelog author="pujos.michael@gmail.com" date="1618488000">- moved mozilla-nss dependency to java-11-openjdk-headless package
  This is necessary to be able to do crypto with just
  java-11-openjdk-headless installed. Fixes boo#1184606</changelog>
  <changelog author="fstrba@suse.com" date="1619006400">- Update to upstream tag jdk-11.0.11+9 (April 2021, CPU)
  * Security fixes
    + JDK-8244473: Contextualize registration for JNDI
    + JDK-8244543: Enhanced handling of abstract classes
    + JDK-8249906, CVE-2021-2163, bsc#1185055: Enhance opening JARs
    + JDK-8250568, CVE-2021-2161, bsc#1185056: Less ambiguous
    processing
    + JDK-8253799: Make lists of normal filenames
    + JDK-8257001: Improve Http Client Support
  * Other changes
    + JDK-7107012: sun.jvm.hotspot.code.CompressedReadStream
    readDouble() conversion to long mishandled
    + JDK-7146776: deadlock between URLStreamHandler.getHostAddress
    and file.Handler.openconnection
    + JDK-8086003: Test fails on OSX with java.lang.RuntimeException
    'Narrow klass base: 0x0000000000000000, Narrow klass shift: 3'
    missing
    + JDK-8168869: jdeps: localized messages don't use proper line
    breaks
    + JDK-8180837: SunPKCS11-NSS tests failing with
    CKR_ATTRIBUTE_READ_ONLY and CKR_MECHANISM_PARAM_INVALID
    + JDK-8202343: Disable TLS 1.0 and 1.1
    + JDK-8205992: jhsdb cannot attach to Java processes running in
    Docker containers
    + JDK-8209193: Fix aarch64-linux compilation after -Wreorder
    changes
    + JDK-8210413: AArch64: Optimize div/rem by constant in C1
    + JDK-8210578: AArch64: Invalid encoding for fmlsvs instruction
    + JDK-8211051: jdeps usage of --dot-output doesn't provide
    valid output for modular jar
    + JDK-8211057: Gensrc step CompileProperties generates unstable
    CompilerProperties output
    + JDK-8211150: G1 Full GC not purging code root memory and
    hence causing memory leak
    + JDK-8211825: ModuleLayer.defineModulesWithXXX does not setup
    delegation when module reads automatic module
    + JDK-8212043: Add floating-point Math.min/max intrinsics
    + JDK-8212218: [TESTBUG] runtime/ErrorHandling/
    /TestHeapDumpOnOutOfMemoryErrorInMetaspace.java timed out
    + JDK-8213116: javax/swing/JComboBox/WindowsComboBoxSize/
    /WindowsComboBoxSizeTest.java fails in Windows
    + JDK-8213909: jdeps --print-module-deps should report missing
    dependences
    + JDK-8214180: Need better granularity for sleeping
    + JDK-8214223: tools/jdeps/listdeps/ListModuleDeps.java failed
    due to missing Lib2 file
    + JDK-8214230: Classes generated by SystemModulesPlugin.java
    are not reproducable
    + JDK-8214741: docs/index.html has no title or copyright
    + JDK-8215687: [Graal] unit test CheckGraalIntrinsics failed
    after 8212043
    + JDK-8217848: [Graal] vmTestbase/nsk/jvmti/ResourceExhausted/
    /resexhausted003/TestDescription.java fails
    + JDK-8218482: sun/security/krb5/auto/ReplayCachePrecise.java
    failed - no KrbException thrown
    + JDK-8218550: Add test omitted from JDK-8212043
    + JDK-8221584: SIGSEGV in os::PlatformEvent::unpark() in
    JvmtiRawMonitor::raw_exit while posting method exit event
    + JDK-8221995: AARCH64: problems with CAS instructions encoding
    + JDK-8222518: Remove unnecessary caching of Parker object in
    java.lang.Thread
    + JDK-8222785: aarch64: add necessary masking for immediate
    shift counts
    + JDK-8223186: HotSpot compile warnings from GCC 9
    + JDK-8225773: jdeps --check produces NPE if there are missing
    module dependences
    + JDK-8225805: Java Access Bridge does not close the logger
    + JDK-8226810: Failed to launch JVM because of
    NullPointerException occured on System.props
    + JDK-8229396: jdeps ignores multi-release when
    generate-module-info used on command line
    + JDK-8229474: Shenandoah: Cleanup CM::update_roots()
    + JDK-8232225: Rework the fix for JDK-8071483
    + JDK-8232905: JFR fails with assertion:
    assert(t-&gt;unflushed_size() == 0) failed: invariant
    + JDK-8233164: C2 fails with assert(phase-&gt;C-&gt;get_alias_index(t)
    == phase-&gt;C-&gt;get_alias_index(t_adr)) failed: correct memory
    chain
    + JDK-8233910: java/awt/ColorClass/AlphaColorTest.java is
    failing  intermittently in nightly lnux-x64 system
    + JDK-8233912: aarch64: minor improvements of atomic operations
    + JDK-8234508: VM_HeapWalkOperation::iterate_over_object reads
    non-strong fields with an on-strong load barrier
    + JDK-8234742: Improve handshake logging
    + JDK-8234796: Refactor Handshake::execute to take a more
    complex type than ThreadClosure
    + JDK-8235324: Dying objects are published from users of
    CollectedHeap::object_iterate
    + JDK-8235351: Lookup::unreflect should bind with the original
    caller independent of Method's accessible flag
    + JDK-8237369: Shenandoah: failed vmTestbase/nsk/jvmti/
    /AttachOnDemand/attach021/TestDescription.java test
    + JDK-8237392: Shenandoah: Remove unreliable assertion
    + JDK-8237483: AArch64 C1 OopMap inserted twice fatal error
    + JDK-8237495: Java MIDI fails with a dereferenced memory error
    when asked to send a raw 0xF7
    + JDK-8239355: (dc) Initial value of SO_SNDBUF should allow
    sending large datagrams (macOS)
    + JDK-8240353: AArch64: missing support for
  - XX:+ExtendedDTraceProbes in C1
    + JDK-8240704: CheckHandles.java failed "AssertionError: Handle
    use increased by more than 10 percent."
    + JDK-8240751: Shenandoah: fold ShenandoahTracer definition
    + JDK-8240795: [REDO] 8238384 CTW: C2 compilation fails with
    "assert(store != load-&gt;find_exact_control(load-&gt;in(0)))
    failed: dependence cycle found"
    + JDK-8241598: Upgrade JLine to 3.14.0
    + JDK-8241649: Optimize Character.toString
    + JDK-8241770: Module xxxAnnotation() methods throw NCDFE if
    module-info.class found as resource in unnamed module
    + JDK-8241911: AArch64: Fix a potential register clash issue in
    reduce_add2I
    + JDK-8242030: Wrong package declarations in jline classes after
    JDK-8241598
    + JDK-8242565: Policy initialization issues when the denyAfter
    constraint is enabled
    + JDK-8243618: compiler/rtm/cli tests can be run w/o WhiteBox
    + JDK-8243670: Unexpected test result caused by C2
    MergeMemNode::Ideal
    + JDK-8244088: [Regression] Switch of Gnome theme ends up in
    deadlocked UI
    + JDK-8244154: Update SunPKCS11 provider with PKCS11 v3.0 header
    files
    + JDK-8244340: Handshake processing thread lacks yielding
    + JDK-8244573: java.lang.ArrayIndexOutOfBoundsException thrown
    for malformed class file
    + JDK-8244683: A TSA server used by tests
    + JDK-8245005: javax/net/ssl/compatibility/BasicConnectTest.java
    failed with No enum constant
    + JDK-8245026: PsAdaptiveSizePolicy::_old_gen_policy_is_ready is
    unused
    + JDK-8245283: JFR: Can't handle constant dynamic used by Jacoco
    agent
    + JDK-8245512: CRC32 optimization using AVX512 instructions
    + JDK-8245527: LDAP Channel Binding support for Java
    GSS/Kerberos
    + JDK-8246707: (sc) SocketChannel.read/write throws
    AsynchronousCloseException on closed channel
    + JDK-8246709: sun/security/tools/jarsigner/
    /TsacertOptionTest.java compilation failed after JDK-8244683
    + JDK-8247200: assert((unsigned)fpargs &lt; 32)
    + JDK-8247766: [aarch64] guarantee(val &lt; (1U &lt;&lt; nbits))
    failed: Field too big for insn.
    + JDK-8248336: AArch64: C2: offset overflow in
    BoxLockNode::emit
    + JDK-8248865: Document JNDI/LDAP timeout properties
    + JDK-8248901: Signed immediate support in
    .../share/assembler.hpp is broken.
    + JDK-8249543: Force DirectBufferAllocTest to run with
  - ExplicitGCInvokesConcurrent
    + JDK-8249588: libwindowsaccessbridge issues on 64bit Windows
    + JDK-8249749: modify a primitive array through a stream and a
    for cycle causes jre crash
    + JDK-8249787: Make TestGCLocker more resilient with concurrent
    GCs
    + JDK-8249867: xml declaration is not followed by a newline
    + JDK-8250911: [windows] os::pd_map_memory() error detection
    broken
    + JDK-8251255: [linux] Add process-memory information to hs-err
    and VM.info
    + JDK-8251359: Shenandoah: filter null oops before calling
    enqueue/SATB barrier
    + JDK-8251925: C2: RenaissanceStressTest fails with
    assert(!had_error): bad dominance
    + JDK-8251944: Add Shenandoah test config to
    compiler/gcbarriers/UnsafeIntrinsicsTest.java
    + JDK-8251992: VM crashed running TestComplexAddrExpr.java test
    with -XX:UseAVX=X
    + JDK-8253220: Epsilon: clean up unused code/declarations
    + JDK-8253274: The CycleDMImagetest brokes the system
    + JDK-8253353: Crash in C2: guarantee(n != NULL) failed: No Node
    + JDK-8253368: TLS connection always receives close_notify
    exception
    + JDK-8253404: C2: assert(C-&gt;live_nodes() &lt;=
    C-&gt;max_node_limit()) failed: Live Node limit exceeded limit
    + JDK-8253409: Double-rounding possibility in float fma
    + JDK-8253476: TestUseContainerSupport.java fails on some Linux
    kernels w/o swap limit capabilities
    + JDK-8253524: C2: Refactor code that clones predicates during
    loop unswitching
    + JDK-8253644: C2: assert(skeleton_predicate_has_opaque(iff))
    failed: unexpected
    + JDK-8253681: closed java/awt/dnd/MouseEventAfterStartDragTest/
    /MouseEventAfterStartDragTest.html test failed
    + JDK-8253702: BigSur version number reported as 10.16, should
    be 11.nn
    + JDK-8253756: C2 CompilerThread0 crash in Node::add_req(Node*)
    + JDK-8254104: MethodCounters must exist before nmethod is
    installed
    + JDK-8254734: "dead loop detected" assert failure with patch
    from 8223051
    + JDK-8254748: Bad Copyright header format after JDK-8212218
    + JDK-8254799: runtime/ErrorHandling/
    /TestHeapDumpOnOutOfMemoryError.java fails with release VMs
    + JDK-8255058: C1: assert(is_virtual()) failed: type check
    + JDK-8255351: Add detection for Graviton 2 CPUs
    + JDK-8255368: Math.exp() gives wrong result for large values on
    x86 32-bit platforms
    + JDK-8255387: Japanese characters were printed upside down on
    AIX
    + JDK-8255401: Shenandoah: Allow oldval and newval registers to
    overlap in cmpxchg_oop()
    + JDK-8255479: [aarch64] assert(src-&gt;section_index_of(target) ==
    CodeBuffer::SECT_NONE) failed: sanity
    + JDK-8255544: Create a checked cast
    + JDK-8255559: Leak File Descriptors Because of
    ResolverLocalFilesystem#engineResolveURI()
    + JDK-8255681: print callstack in error case in
    runAWTLoopWithApp
    + JDK-8255734: VM should ignore SIGXFSZ on ppc64, s390 too
    + JDK-8255742: PrintInlining as compiler directive doesn't print
    virtual calls
    + JDK-8255845: Memory leak in imageFile.cpp
    + JDK-8255880: UI of Swing components is not redrawn after their
    internal state changed
    + JDK-8255908: ExceptionInInitializerError due to
    UncheckedIOException while initializing cgroupv1 subsystem
    + JDK-8256025: AArch64: MachCallRuntimeNode::ret_addr_offset()
    is incorrect for stub calls
    + JDK-8256056: Deoptimization stub doesn't save vector registers
    on x86
    + JDK-8256061: RegisterSaver::save_live_registers() omits upper
    halves of ZMM0-15 registers
    + JDK-8256187: [TEST_BUG] Automate bug4275046.java test
    + JDK-8256220: C1: x86_32 fails with -XX:UseSSE=1 after
    JDK-8210764 due to mishandled lir_neg
    + JDK-8256258: some missing NULL checks or asserts after
    CodeCache::find_blob_unsafe
    + JDK-8256264: Printed GlyphVector outline with low DPI has bad
    quality on Windows
    + JDK-8256290: javac/lambda/T8031967.java fails with
    StackOverflowError on x86_32
    + JDK-8256359: AArch64: runtime/ReservedStack/
    /ReservedStackTestCompiler.java fails
    + JDK-8256387: Unexpected result if patching an entire
    instruction on AArch64
    + JDK-8256421: Add 2 HARICA roots to cacerts truststore
    + JDK-8256488: [aarch64] Use ldpq/stpq instead of ld4/st4 for
    small copies in StubGenerator::copy_memory
    + JDK-8256489: Make gtest for long path names on Windows more
    resilient in the presence of virus scanners
    + JDK-8256501: libTestMainKeyWindow fails to build with Xcode
    12.2
    + JDK-8256633: Fix product build on Windows+Arm64
    + JDK-8256682: JDK-8202343 is incomplete
    + JDK-8256751: Incremental rebuild with precompiled header fails
    when touching a header file
    + JDK-8256757: Incorrect MachCallRuntimeNode::ret_addr_offset()
    for CallLeafNoFP on x86_32
    + JDK-8256806: Shenandoah: optimize shenandoah/jni/
    /TestPinnedGarbage.java test
    + JDK-8256807: C2: Not marking stores correctly as mismatched
    in string opts
    + JDK-8256810: Incremental rebuild broken on Macosx
    + JDK-8256818: SSLSocket that is never bound or connected leaks
    socket resources
    + JDK-8256888: Client manual test problem list update
    + JDK-8257083: Security infra test failures caused by
    JDK-8202343
    + JDK-8257408: Bump update version for OpenJDK: jdk-11.0.11
    + JDK-8257423: [PPC64] Support -XX:-UseInlineCaches
    + JDK-8257436: [aarch64] Regressions in ArrayCopyUnalignedDst
    .testByte/testChar for 65-78 bytes when UseSIMDForMemoryOps
    is on
    + JDK-8257513: C2: assert((constant_addr -
    _masm.code()-&gt;consts()-&gt;start()) == con.offset())
    + JDK-8257547: Handle multiple prereqs on the same line in deps
    files
    + JDK-8257561: Some code is not vectorized after 8251925 and
    8250607
    + JDK-8257565: epsilonBarrierSet.hpp should not include
    barrierSetAssembler
    + JDK-8257575: C2: "failed: only phis" assert failure in loop
    strip mining verification
    + JDK-8257594: C2 compiled checkcast of non-null object triggers
    endless deoptimization/recompilation cycle
    + JDK-8257633: Missing -mmacosx-version-min=X flag when linking
    libjvm
    + JDK-8257670: sun/security/ssl/SSLSocketImpl/SSLSocketLeak.java
    reports leaks
    + JDK-8257707: Fix incorrect format string in Http1HeaderParser
    + JDK-8257746: Regression introduced with JDK-8250984 - memory
    might be null in some machines
    + JDK-8257798: [PPC64] undefined reference to
    Klass::vtable_start_offset()
    + JDK-8257884: Re-enable sun/security/ssl/SSLSocketImpl/
    /SSLSocketLeak.java as automatic test
    + JDK-8257910: [JVMCI] Set exception_seen accordingly in the
    runtime.
    + JDK-8257997: sun/security/ssl/SSLSocketImpl/SSLSocketLeak.java
    again reports leaks after JDK-8257884
    + JDK-8257999: Parallel GC crash in gc/parallel/
    /TestDynShrinkHeap.java: new region is not in covered_region
    + JDK-8258077: Using -Xcheck:jni can lead to a double-free after
    JDK-8193234
    + JDK-8258247: Couple of issues in fix for JDK-8249906
    + JDK-8258373: Update the text handling in the JPasswordField
    + JDK-8258396: SIGILL in jdk.jfr.internal.PlatformRecorder
    .rotateDisk()
    + JDK-8258419: RSA cipher buffer cleanup
    + JDK-8258471: "search codecache" clhsdb command does not work
    + JDK-8258534: Epsilon: clean up unused includes
    + JDK-8258805: Japanese characters not entered by mouse click
    on Windows 10
    + JDK-8258833: Cancel multi-part cipher operations in SunPKCS11
    after failures
    + JDK-8258836: JNI local refs exceed capacity
    getDiagnosticCommandInfo
    + JDK-8258884: [TEST_BUG] Convert applet-based test
    open/test/jdk/javax/swing/JMenuItem/8031573/bug8031573.java
    to a regular java test
    + JDK-8259007: This test printed a blank page
    + JDK-8259048: (tz) Upgrade time-zone data to tzdata2020f
    + JDK-8259049: Uninitialized variable after JDK-8257513
    + JDK-8259231: Epsilon: improve performance under contention
    during virtual space expansion
    + JDK-8259271: gc/parallel/TestDynShrinkHeap.java still fails
    "assert(covered_region.contains(new_memregion)) failed: new
    region is not in covered_region"
    + JDK-8259312: VerifyCACerts.java fails as soneraclass2ca cert
    will expire in 90 days
    + JDK-8259319: Illegal package access when SunPKCS11 requires
    SunJCE's classes
    + JDK-8259339: AllocateUninitializedArray C2 intrinsic fails
    with void.class input
    + JDK-8259428: AlgorithmId.getEncodedParams() should return copy
    + JDK-8259446: runtime/jni/checked/
    /TestCheckedReleaseArrayElements.java fails with stderr not
    empty
    + JDK-8259451: Zero: skip serviceability/sa tests, set vm.hasSA
    to false
    + JDK-8259580: Shenandoah: uninitialized label in
    VerifyThreadGCState
    + JDK-8259619: C1: 3-arg StubAssembler::call_RT stack-use
    condition is incorrect
    + JDK-8259633: compiler/graalunit/CoreTest.java fails with NPE
    after JDK-8244543
    + JDK-8259706: C2 compilation fails with assert(vtable_index ==
    Method::invalid_vtable_index) failed: correct sentinel value
    + JDK-8259707: LDAP channel binding does not work with StartTLS
    extension
    + JDK-8259773: Incorrect encoding of AVX-512 kmovq instruction
    + JDK-8259849: Shenandoah: Rename store-val to IU-barrier
    + JDK-8259949: x86 32-bit build fails when -fcf-protection is
    passed in the compiler flags
    + JDK-8259954: gc/shenandoah/mxbeans tests fail with -Xcomp
    + JDK-8260029: aarch64: fix typo in verify_oop_array
    + JDK-8260308: Update LogCompilation junit to 4.13.1
    + JDK-8260338: Some fields in HaltNode is not cloned
    + JDK-8260349: Cannot programmatically retrieve Metaspace max
    set via JAVA_TOOL_OPTIONS
    + JDK-8260356: (tz) Upgrade time-zone data to tzdata2021a
    + JDK-8260378: [TESTBUG] DcmdMBeanTestCheckJni.java reports
    false positive
    + JDK-8260497: Shenandoah: Improve SATB flushing
    + JDK-8260502: [s390] NativeMovRegMem::verify() fails because
    it's too strict
    + JDK-8260632: Build failures after JDK-8253353
    + JDK-8260704: ParallelGC: oldgen expansion needs release-store
    for _end
    + JDK-8261022: Fix incorrect result of Math.abs() with char type
    + JDK-8261089: [TESTBUG] native library of test
    TestCheckedReleaseCriticalArray.java fails to compile with
    gcc 4.x
    + JDK-8261183: Follow on to Make lists of normal filenames
    + JDK-8261209: isStandalone property: remove dependency on
    pretty-print
    + JDK-8261231: Windows IME was disabled after DnD operation
    + JDK-8261251: Shenandoah: Use object size for full GC
    humongous compaction
    + JDK-8261310: PPC64 Zero build fails with
    'VMError::controlled_crash(int)::FunctionDescriptor
    functionDescriptor' has incomplete type and cannot be defined
    + JDK-8261334: NMT: tuning statistic shows incorrect hash
    distribution
    + JDK-8261413: Shenandoah: Disable class-unloading in I-U mode
    + JDK-8261522: [PPC64] AES intrinsics write beyond the
    destination array
    + JDK-8261534: Test sun/security/pkcs11/KeyAgreement/
    /IllegalPackageAccess.java fails on platforms where no nsslib
    artifacts are defined
    + JDK-8261585: Restore HandleArea used in
    Deoptimization::uncommon_trap
    + JDK-8261753: Test java/lang/System/OsVersionTest.java still
    failing on BigSur patch versions after JDK-8253702
    + JDK-8261829: Exclude tools/jlink/JLinkReproducibleTest.java
    in 11u
    + JDK-8261912: Code IfNode::fold_compares_helper more
    defensively
    + JDK-8261920: [AIX] jshell command throws java.io.IOError on
    non English locales
    + JDK-8262018: Wrong format in SAP copyright header of
    OsVersionTest
    + JDK-8263069: Exclude some failing tests from
    security/infra/java/security/cert/CertPathValidator</changelog>
  <changelog author="fstrba@suse.com" date="1620043200">- Remove all Jpackage provides for SLE12 in order to avoid
  installing this package as default Java on SLE12-SP5
  (bsc#1185476)</changelog>
  <changelog author="fstrba@suse.com" date="1621512000">- Modified patch:
  * nss-security-provider.patch
    + make the NSS provider first in the list</changelog>
  <changelog author="fstrba@suse.com" date="1626868800">- Update to upstream tag jdk-11.0.12+7 (July 2021, CPU)
  * Security fixes
    + JDK-8256157: Improve bytecode assembly
    + JDK-8256491: Better HTTP transport
    + JDK-8258432, CVE-2021-2341, bsc#1188564: Improve file
    transfers
    + JDK-8260453: Improve Font Bounding
    + JDK-8260960: Signs of jarsigner signing
    + JDK-8260967, CVE-2021-2369, bsc#1188565: Better jar file
    validation
    + JDK-8262380: Enhance XML processing passes
    + JDK-8262403: Enhanced data transfer
    + JDK-8262410: Enhanced rules for zones
    + JDK-8262477: Enhance String Conclusions
    + JDK-8262967: Improve Zip file support
    + JDK-8264066, CVE-2021-2388, bsc#1188566: Enhance compiler
    validation
    + JDK-8264079: Improve abstractions
    + JDK-8264460: Improve NTLM support
  * Other changes
    + JDK-6847157: java.lang.NullPointerException: HDC for
    component at sun.java2d.loops.Blit.Blit
    + JDK-7106851: Test should not use System.exit
    + JDK-8073446: TimeZone getOffset API does not  return a dst
    offset between years 2038-2137
    + JDK-8076190: Customizing the generation of a PKCS12 keystore
    + JDK-8153005: Upgrade the default PKCS12 encryption/MAC
    algorithms
    + JDK-8171303: sun/java2d/pipe/InterpolationQualityTest.java
    fails on Windows &amp; Linux
    + JDK-8177068: incomplete classpath causes NPE in Flow
    + JDK-8185734: [Windows] Structured Exception Catcher missing
    around gtest execution
    + JDK-8187450: JNI local refs exceeds capacity warning in
    NetworkInterface::getAll
    + JDK-8190763: Class cast exception on (CompoundEdit)
    UndoableEditEvent.getEdit()
    + JDK-8195841: PNGImageReader.readNullTerminatedString() doesnt
    check for non-null terminated strings with length equal to
    maxLen
    + JDK-8196100: javax/swing/text/JTextComponent/5074573/
    /bug5074573.java fails
    + JDK-8199646: JShell tests: jdk/jshell/
    /FailOverDirectExecutionControlTest.java failed with
    java.lang.UnsupportedOperationException
    + JDK-8206925: Support the certificate_authorities extension
    + JDK-8207160: ClassReader::adjustMethodParams can potentially
    return null if the args list is empty
    + JDK-8207247: AARCH64: Enable Minimal and Client VM builds
    + JDK-8207404: MulticastSocket tests failing on AIX
    + JDK-8207779: Method::is_valid_method() compares 'this' with
    NULL
    + JDK-8208061: runtime/LoadClass/TestResize.java fails with
    "Load factor too high" when running in CDS mode.
    + JDK-8209459: TestSHA512MultiBlockIntrinsics failed on AArch64
    + JDK-8210443: Migrate Locale matching tests to JDK Repo.
    + JDK-8213231: ThreadSnapshot::_threadObj can become stale
    + JDK-8213483: ARM32: runtime/ErrorHandling/
    /ShowRegistersOnAssertTest.java jtreg test fail
    + JDK-8213725: JShell NullPointerException due to class file
    with unexpected package
    + JDK-8213794: ARM32: disable TypeProfiling,
    CriticalJNINatives, Serviceablity tests for ARM32
    + JDK-8213845: ARM32: Interpreter doesn't call result handler
    after native calls
    + JDK-8214128: ARM32: wrong stack alignment on
    Deoptimization::unpack_frames
    + JDK-8214512: ARM32: Jtreg test compiler/c2/Test8062950.java
    fails on ARM
    + JDK-8214854: JDWP: Unforseen output truncation in logging
    + JDK-8214922: Add vectorization support for fmin/fmax
    + JDK-8215009: GCC 8 compilation error in libjli
    + JDK-8216184: CDS/appCDS tests failed on Windows due to long
    path to a classlist file
    + JDK-8216259: AArch64: Vectorize Adler32 intrinsics
    + JDK-8216314: SIGILL in CodeHeapState::print_names()
    + JDK-8217348: assert(thread-&gt;is_Java_thread()) failed: just
    checking
    + JDK-8217465: [REDO] - Optimize CodeHeap Analytics
    + JDK-8217561: X86: Add floating-point Math.min/max intrinsics
    + JDK-8217918: C2: -XX:+AggressiveUnboxing is broken
    + JDK-8218458: [TESTBUG] runtime/NMT/
    /CheckForProperDetailStackTrace.java fails with Expected
    stack trace missing from output
    + JDK-8219142: Remove unused JIMAGE_ResourcePath
    + JDK-8219586: CodeHeap State Analytics processes dead nmethods
    + JDK-8220074: Clean up GCC 8.3 errors in LittleCMS
    + JDK-8220407: compiler/intrinsics/math/
    /TestFpMinMaxIntrinsics.java timedout
    + JDK-8222302: [TESTBUG] test/hotspot/jtreg/compiler/intrinsics/
    /sha/cli/TestUseSHAOptionOnUnsupportedCPU.java fails on any
    other CPU
    + JDK-8222412: AARCH64: multiple instructions encoding issues
    + JDK-8223020: aarch64: expand minI_rReg and maxI_rReg patterns
    into separate instructions
    + JDK-8223444: Improve CodeHeap Free Space Management
    + JDK-8223504: Improve performance of forall loops by better
    inlining of "iterator()" methods
    + JDK-8223667: ASAN build broken
    + JDK-8225081: Remove Telia Company CA certificate expiring in
    April 2021
    + JDK-8225116: Test OwnedWindowsLeak.java intermittently fails
    + JDK-8225438: javax/net/ssl/TLSCommon/
    /TestSessionLocalPrincipal.java failed with Read timed out
    + JDK-8225756: [testbug] compiler/loopstripmining/
    /CheckLoopStripMining.java sets too short a
    SafepointTimeoutDelay
    + JDK-8226374: Restrict TLS signature schemes and named groups
    + JDK-8226627: assert(t-&gt;singleton()) failed: must be a constant
    + JDK-8226721: Missing intrinsics for Math.ceil, floor, rint
    + JDK-8227080: (fs) Files.newInputStream(...).skip(n) is slow
    + JDK-8227222: vmTestbase/jit/FloatingPoint/gen_math/Loops04/
    /Loops04.java failed XMM register should be 0-15
    + JDK-8227609: (fs) Files.newInputStream(...).skip(n) should
    allow skipping beyond file size
    + JDK-8230428: Cleanup dead CastIP node code in formssel.cpp
    + JDK-8231460: Performance issue (CodeHeap) with large free
    blocks
    + JDK-8231713: x86_32 build failures after JDK-8226721 (Missing
    intrinsics for Math.ceil, floor, rint)
    + JDK-8231841: AArch64: debug.cpp help() is missing an AArch64
    line for pns
    + JDK-8232084: HotSpot build failed with GCC 9.2.1
    + JDK-8232591: AArch64: Add missing match rules for smaddl,
    smsubl and smnegl
    + JDK-8233185: HttpServer.stop() blocks indefinitely when
    called on dispatch thread
    + JDK-8233787: Break cycle in vm_version* includes
    + JDK-8233948: AArch64: Incorrect mapping between OptoReg and
    VMReg for high 64 bits of Vector Register
    + JDK-8234355: Buffer overflow in jcmd GC.class_stats due to
    too many classes
    + JDK-8235368: Update BCEL to Version 6.4.1
    + JDK-8236859: WebSocket over authenticating proxy fails with
    NPE
    + JDK-8236992: AArch64: remove redundant load_klass in itable
    stub
    + JDK-8237743: test/langtools/jdk/jshell/
    /FailOverExecutionControlTest.java fails No
    ExecutionControlProvider with name 'nonExistent' and parameter
    keys: []
    + JDK-8237804: sun/security/mscapi tests fail with "Key pair
    not generated, alias &lt;nnnnnn&gt; already exists"
    + JDK-8238175: CTW: Class.getDeclaredMethods fails with
    assert(k-&gt;is_subclass_of(SystemDictionary::Throwable_klass()))
    failed: invalid exception class
    + JDK-8238567: SoftMainMixer.processAudioBuffers(): Wrong
    handling of stoppedMixers
    + JDK-8238812: assert(false) failed: bad AD file
    + JDK-8239312: [macos] javax/swing/JFrame/NSTexturedJFrame/
    /NSTexturedJFrame.java
    + JDK-8239386: handle ContendedPaddingWidth in
    vm_version_aarch64
    + JDK-8239536: Can't use 'java.util.List' object after
    importing 'java.awt.List'
    + JDK-8240487: Cleanup whitespace in .cc, .hh, .m, and .mm files
    + JDK-8240848: ArrayIndexOutOfBoundsException buf for
    TextCallbackHandler
    + JDK-8241082: Upgrade IANA Language Subtag Registry data to
    03-16-2020 version
    + JDK-8241087: Build failure with VS 2019 (16.5.0) due to C2039
    and C2873
    + JDK-8241101: [s390] jtreg test failure after JDK-8238696: not
    conformant features string
    + JDK-8241248: NullPointerException in
    sun.security.ssl.HKDF.extract(HKDF.java:93)
    + JDK-8241372: Several test failures due to
    javax.net.ssl.SSLException: Connection reset
    + JDK-8241475: AArch64: Add missing support for PopCountVI node
    + JDK-8241829: Cleanup the code for PrinterJob on windows
    + JDK-8241960: The SHA3 message digests impl of SUN provider
    are not thread safe after cloned
    + JDK-8242010: Upgrade IANA Language Subtag Registry to Version
    2020-04-01
    + JDK-8242429: Better implementation for sign extract
    + JDK-8242557: Add length limit for strings in PNGImageWriter
    + JDK-8242919: Paste locks up jshell
    + JDK-8243155: AArch64: Add support for SqrtVF
    + JDK-8243240: AArch64: Add support for MulVB
    + JDK-8243452: JFR: Could not create chunk in repository with
    over 200 recordings
    + JDK-8243559: Remove root certificates with 1024-bit keys
    + JDK-8243597: AArch64: Add support for integer vector abs
    + JDK-8244031: HttpClient should have more tests for HEAD
    requests
    + JDK-8244205: HTTP/2 tunnel connections through proxy may be
    reused regardless of which proxy is selected
    + JDK-8244847: Linux/PPC: runtime/CompressedOops/
    /CompressedClassPointers: smallHeapTest fails
    + JDK-8245511: G1 adaptive IHOP does not account for
    reclamation of humongous objects by young GC
    + JDK-8246274: G1 old gen allocation tracking is not in a
    separate class
    + JDK-8247354: [aarch64] PopFrame causes
    assert(oopDesc::is_oop(obj)) failed: not an oop
    + JDK-8247408: IdealGraph bit check expression canonicalization
    + JDK-8247432: Update IANA Language Subtag Registry to Version
    2020-09-29
    + JDK-8247438: JShell: When FailOverExecutionControlProvider
    fails the proximal cause is not shown
    + JDK-8247753: UIManager.getSytemLookAndFeelClassName() returns
    wrong value on Fedora 32
    + JDK-8248043: Need to eliminate excessive i2l conversions
    + JDK-8248411: [aarch64] Insufficient error handling when
    CodeBuffer is exhausted
    + JDK-8248568: compiler/c2/TestBit.java failed: test missing
    from stdout/stderr
    + JDK-8248870: AARCH64: I2L/L2I conversions can be skipped for
    masked positive values
    + JDK-8249142: java/awt/FontClass/CreateFont/DeleteFont.sh is
    unstable
    + JDK-8249189: AARCH64: more L2I conversions can be skipped
    + JDK-8249719: MethodHandle performance suffers from bad
    ResolvedMethodTable hash function
    + JDK-8249875: GCC 10 warnings -Wtype-limits with JFR code
    + JDK-8250635: MethodArityHistogram should use Compile_lock in
    favour of fancy checks
    + JDK-8250876: Fix issues with cross-compile on macos
    + JDK-8251031: Some vmTestbase/nsk/monitoring/RuntimeMXBean
    tests fail with hostnames starting from digits
    + JDK-8251525: AARCH64: Faster Math.signum(fp)
    + JDK-8252259: AArch64: Adjust default value of FLOATPRESSURE
    + JDK-8252311: AArch64: save two words in itable lookup stub
    + JDK-8252779: compiler/graalunit/HotspotTest.java failed after
    8251525
    + JDK-8252883: AccessDeniedException caused by delayed file
    deletion on Windows
    + JDK-8253167: ARM32 builds fail after JDK-8247910
    + JDK-8253572: [windows] CDS archive may fail to open with long
    file names
    + JDK-8253923: C2 doesn't always run loop opts for compilations
    that include loops
    + JDK-8253948: Memory leak in ImageFileReader
    + JDK-8254631: Better support ALPN byte wire values in SunJSSE
    + JDK-8254717: isAssignableFrom checks in
    KeyFactorySpi.engineGetKeySpec appear to be backwards
    + JDK-8255086: Update the root locale display names
    + JDK-8255625: AArch64: Implement Base64.encodeBlock
    accelerator/intrinsic
    + JDK-8255763: C2: OSR miscompilation caused by invalid memory
    instruction placement
    + JDK-8255992: JFR EventWriter does not use first string from
    StringPool with id 0
    + JDK-8256037: [TESTBUG] com/sun/jndi/dns/ConfigTests/
    /PortUnreachable.java fails due to the hard coded threshold
    is small
    + JDK-8256244: java/lang/ProcessHandle/PermissionTest.java
    fails with TestNG 7.1
    + JDK-8256287: [windows] add loop fuse to
    map_or_reserve_memory_aligned
    + JDK-8256523: Streamline Java SHA2 implementation
    + JDK-8257414: Drag n Drop target area is wrong on high DPI
    systems
    + JDK-8257569: Failure observed with
    JfrVirtualMemory::initialize
    + JDK-8257574: C2: "failed: parsing found no loops but there
    are some" assert failure
    + JDK-8257580: Bump update version for OpenJDK: jdk-11.0.12
    + JDK-8257604: JNI_ArgumentPusherVaArg leaks valist
    + JDK-8257621: JFR StringPool misses cached items across
    consecutive recordings
    + JDK-8257796: [TESTBUG]
    TestUseSHA512IntrinsicsOptionOnSupportedCPU.java fails
    on x86_32
    + JDK-8257822: C2 crashes with SIGFPE due to a division that
    floats above its zero check
    + JDK-8257828: SafeFetch may crash if invoked in non-JavaThreads
    + JDK-8257853: Remove dependencies on JNF's JNI utility
    functions in AWT and 2D code
    + JDK-8257858: [macOS]: Remove JNF dependency from
    libosxsecurity/KeystoreImpl.m
    + JDK-8257860: [macOS]: Remove JNF dependency from
    libosxkrb5/SCDynamicStoreConfig.m
    + JDK-8257988: Remove JNF dependency from
    libsaproc/MacosxDebuggerLocal.m
    + JDK-8258414: OldObjectSample events too expensive
    + JDK-8258505: [TESTBUG] TestDivZeroWithSplitIf.java fails due
    to missing UnlockDiagnosticVMOptions
    + JDK-8258753: StartTlsResponse.close() hangs due to
    synchronization issues
    + JDK-8259061: C2: assert(found) failed: memory-writing node is
    not placed in its original loop or an ancestor of it
    + JDK-8259227: C2 crashes with SIGFPE due to a division that
    floats above its zero check
    + JDK-8259232: Bad JNI lookup during printing
    + JDK-8259276: C2: Empty expression stack when reexecuting
    tableswitch/lookupswitch instructions after deoptimization
    + JDK-8259343: [macOS] Update JNI error handling in Cocoa code.
    + JDK-8259585: Accessible actions do not work on mac os x
    + JDK-8259651: [macOS] Replace JNF_COCOA_ENTER/EXIT macros
    + JDK-8259662: Don't wrap SocketExceptions into SSLExceptions
    in SSLSocketImpl
    + JDK-8259710: Inlining trace leaks memory
    + JDK-8259729: Missed JNFInstanceOf -&gt; IsInstanceOf conversion
    + JDK-8259777: Incorrect predication condition generated by ADLC
    + JDK-8259786: initialize last parameter of getpwuid_r
    + JDK-8259843: initialize dli_fname array before calling
    dll_address_to_library_name
    + JDK-8259869: [macOS] Remove desktop module dependencies on
    JNF Reference APIs
    + JDK-8259886: Improve SSL session cache performance and
    scalability
    + JDK-8259983: do not use uninitialized expand_ms value in
    G1CollectedHeap::expand_heap_after_young_collection
    + JDK-8260030: Improve stringStream buffer handling
    + JDK-8260236: better init AnnotationCollector _contended_group
    + JDK-8260255: C1: LoopInvariantCodeMotion constructor can
    leave some fields uninitialized
    + JDK-8260284: C2: assert(_base == Int) failed: Not an Int
    + JDK-8260380: Upgrade to LittleCMS 2.12
    + JDK-8260420: C2 compilation fails with assert(found_sfpt)
    failed: no node in loop that's not input to safepoint
    + JDK-8260426: awt debug_mem.c DMem_AllocateBlock might leak
    memory
    + JDK-8260432: allocateSpaceForGP in freetypeScaler.c might
    leak memory
    + JDK-8260616: Removing remaining JNF dependencies in the
    java.desktop module
    + JDK-8260653: Unreachable nodes keep speculative types alive
    + JDK-8260707: java/lang/instrument/PremainClass/
    /InheritAgent0100.java times out
    + JDK-8260925: HttpsURLConnection does not work  with other
    JSSE provider.
    + JDK-8260926: Trace resource exhausted events unconditionally
    + JDK-8261020: Wrong format parameter in
    create_emergency_chunk_path
    + JDK-8261027: AArch64: Support for LSE atomics C++ HotSpot code
    + JDK-8261167: print_process_memory_info add a close call after
    fopen
    + JDK-8261170: Upgrade to freetype 2.10.4
    + JDK-8261198: [macOS] Incorrect JNI parameters in number
    conversion in A11Y code
    + JDK-8261235: C1 compilation fails with
    assert(res-&gt;vreg_number() == index) failed: conversion check
    + JDK-8261261: The version extra fields needs to be overridable
    in jib-profiles.js
    + JDK-8261262: Kitchensink24HStress.java crashed with
    EXCEPTION_ACCESS_VIOLATION
    + JDK-8261354: SIGSEGV at MethodIteratorHost
    + JDK-8261355: No data buffering in SunPKCS11 Cipher encryption
    when the underlying mechanism has no padding
    + JDK-8261397: try catch Method failing to work when dividing
    an integer by 0
    + JDK-8261422: Adjust problematic String.format calls in
    jdk/internal/util/Preconditions.java outOfBoundsMessage
    + JDK-8261447: MethodInvocationCounters frequently run into
    overflow
    + JDK-8261481: Cannot read Kerberos settings in dynamic store
    on macOS Big Sur
    + JDK-8261505: Test test/hotspot/jtreg/gc/parallel/
    /TestDynShrinkHeap.java killed by Linux OOM Killer
    + JDK-8261601: free memory in early return in
    Java_sun_nio_ch_sctp_SctpChannelImpl_receive0
    + JDK-8261649: AArch64: Optimize LSE atomics in C++ code
    + JDK-8261730: C2 compilation fails with
    assert(store-&gt;find_edge(load) != -1) failed: missing
    precedence edge
    + JDK-8261752: Multiple GC test are missing memory requirements
    + JDK-8261791: (sctp) handleSendFailed in SctpChannelImpl.c
    potential leaks
    + JDK-8261812: C2 compilation fails with assert(!had_error)
    failed: bad dominance
    + JDK-8261914: IfNode::fold_compares_helper faces
    non-canonicalized bool when running JRuby JSON workload
    + JDK-8262093: java/util/concurrent/tck/JSR166TestCase.java
    failed "assert(false) failed: unexpected node"
    + JDK-8262110: DST starts from incorrect time in 2038
    + JDK-8262121: [11u] Redo 8244287: JFR: Methods samples have
    line number 0
    + JDK-8262163: Extend settings printout in jcmd VM.metaspace
    + JDK-8262295: C2: Out-of-Bounds Array Load from Clone Source
    + JDK-8262298: G1BarrierSetC2::step_over_gc_barrier fails with
    assert "bad barrier shape"
    + JDK-8262446: DragAndDrop hangs on Windows
    + JDK-8262461: handle wcstombsdmp return value correctly in
    unix awt_InputMethod.c
    + JDK-8262465: Very long compilation times and high memory
    consumption in C2 debug builds
    + JDK-8262726: AArch64: C1 StubAssembler::call_RT can corrupt
    stack
    + JDK-8262739: String inflation C2 intrinsic prevents insertion
    of anti-dependencies
    + JDK-8262829: Native crash in
    Win32PrintServiceLookup.getAllPrinterNames()
    + JDK-8262837: handle split_USE correctly
    + JDK-8262900: ToolBasicTest fails to access HTTP server it
    starts
    + JDK-8263260: [s390] Support latest hardware (z14 and z15)
    + JDK-8263311: Watch registry changes for remote printers
    update instead of polling
    + JDK-8263361: Incorrect arraycopy stub selected by C2 for SATB
    collectors
    + JDK-8263404: RsaPrivateKeySpec is always recognized as
    RSAPrivateCrtKeySpec in RSAKeyFactory.engineGetKeySpec
    + JDK-8263425: AArch64: two potential bugs in C1
    LIRGenerator::generate_address()
    + JDK-8263448: CTW: fatal error: meet not symmetric
    + JDK-8263504: Some OutputMachOpcodes fields are uninitialized
    + JDK-8263557: Possible NULL dereference in
    Arena::destruct_contents()
    + JDK-8263558: Possible NULL dereference in fast path arena
    free if ZapResourceArea is true
    + JDK-8263676: AArch64: one potential bug in C1
    LIRGenerator::generate_address()
    + JDK-8263729: [test] divert spurious output away from stream
    under test in ProcessBuilder Basic test
    + JDK-8263846: Bad JNI lookup getFocusOwner in accessibility
    code on Mac OS X
    + JDK-8264047: Duplicate global variable 'jvm' in libjavajpeg
    and libawt
    + JDK-8264096: slowdebug jvm crashes when StrInflatedCopy match
    rule is not supported
    + JDK-8264151: ciMethod::ensure_method_data() should return
    false is loading resulted in empty state
    + JDK-8264173: [s390] Improve Hardware Feature Detection And
    Reporting
    + JDK-8264190: Harden TLS interop tests
    + JDK-8264223: CodeHeap::verify fails extra_hops assertion in
    fastdebug test
    + JDK-8264328: Broken license in
    javax/swing/JComboBox/8072767/bug8072767.java
    + JDK-8264360: Loop strip mining verification fails with
    "should be on the backedge"
    + JDK-8264626: C1 should be able to inline excluded methods
    + JDK-8264640: CMS ParScanClosure misses a barrier
    + JDK-8264786: [macos] All Swing/AWT apps cause Allow
    Notifications prompt to appear when app is launched
    + JDK-8264821: DirectIOTest fails on a system with large block
    size
    + JDK-8264848: [macos] libjvm.dylib linker warning due to macOS
    version mismatch
    + JDK-8264923: PNGImageWriter.write_zTXt throws Exception with
    a typo
    + JDK-8264958: C2 compilation fails with assert "n is later
    than its clone"
    + JDK-8265099: Revert backport to 11u of 8236859: WebSocket
    over authenticating proxy fails with NPE
    + JDK-8265154: vinserti128 operand mix up for KNL platforms
    + JDK-8265239: Shenandoah: Shenandoah heap region count could
    be off by 1
    + JDK-8265417: Backport of JDK-8249672 breaks Solaris x86 build
    + JDK-8265421: java/lang/String/StringRepeat.java test is
    missing a memory requirement
    + JDK-8265462: Handle multiple slots in the NSS Internal Module
    from SunPKCS11's Secmod
    + JDK-8265537: x86 version string truncated after JDK-8249672
    11u backport
    + JDK-8265666: Enable AIX build platform to make external debug
    symbols
    + JDK-8265677: CMS: CardTableBarrierSet::write_ref_array_work()
    lacks storestore barrier
    + JDK-8265690: Use the latest Ubuntu base image version in
    Docker testing
    + JDK-8265718: Build failure after JDK-8258414 11u backport
    + JDK-8265750: Fatal error in safepoint.cpp after backport of
    8258414
    + JDK-8265784: [C2] Hoisting of DecodeN leaves MachTemp inputs
    behind
    + JDK-8265938: C2's conditional move optimization does not
    handle top Phi
    + JDK-8266220: keytool still prompt for store password on a
    password-less pkcs12 file if -storetype pkcs12 is specified
    + JDK-8266293: Key protection using PBEWithMD5AndDES fails with
    "java.security.InvalidAlgorithmParameterException: Salt must
    be 8 bytes long"
    + JDK-8266713: [AIX] Build failure after 11u backport of
    JDK-8247753
    + JDK-8266802: Shenandoah: Round up region size to page size
    unconditionally
    + JDK-8266892: avoid maybe-uninitialized gcc warnings on linux
    s390x
    + JDK-8266929: Unable to use algorithms from 3p providers
    + JDK-8267235: [macos_aarch64]
    InterpreterRuntime::throw_pending_exception messing up LR
    results in crash
    + JDK-8267561: Shenandoah: Reference processing not properly
    setup for outside of cycle degenerated GC
    + JDK-8267599: Revert the change to the default PKCS12
    macAlgorithm and macIterationCount props for 11u/8u/7u
    + JDK-8267641: [11u] 8227609 backport typo
    + JDK-8267721: Enable sun/security/pkcs11 tests for Amazon
    Linux 2 AArch64
    + JDK-8268678: LetsEncryptCA.java test fails as Let's Encrypt
    Authority X3 is retired</changelog>
  <changelog author="schwab@suse.de" date="1628078400">- riscv64-zero.patch: Add support for riscv64 (zero VM)</changelog>
  <changelog author="fstrba@suse.com" date="1629979200">- Added patch:
  * jdk11-glibc234.patch
    + fix build with glibc-2.34 (bsc#1189201)</changelog>
  <changelog author="fstrba@suse.com" date="1631534400">- Modified patch:
  * nss-security-provider.patch
    + revert recent changes making NSS provider the default one
    + fixes bsc#1190252</changelog>
  <changelog author="fstrba@suse.com" date="1631793600">- Added patch:
  * fips.patch
    + implement FIPS support in OpenJDK</changelog>
  <changelog author="fstrba@suse.com" date="1634817600">- Update to upstream tag jdk-11.0.13+8 (October 2021 CPU)
  * Security fixes
    + JDK-8163326, CVE-2021-35550, bsc#1191901: Update the default
    enabled cipher suites preference
    + JDK-8254967, CVE-2021-35565, bsc#1191909:
    com.sun.net.HttpsServer spins on TLS session close
    + JDK-8263314: Enhance XML Dsig modes
    + JDK-8265167, CVE-2021-35556, bsc#1191910: Richer Text Editors
    + JDK-8265574: Improve handling of sheets
    + JDK-8265580, CVE-2021-35559, bsc#1191911: Enhanced style for
    RTF kit
    + JDK-8265776: Improve Stream handling for SSL
    + JDK-8266097, CVE-2021-35561, bsc#1191912: Better hashing
    support
    + JDK-8266103: Better specified spec values
    + JDK-8266109: More Resilient Classloading
    + JDK-8266115: More Manifest Jar Loading
    + JDK-8266137, CVE-2021-35564, bsc#1191913: Improve Keystore
    integrity
    + JDK-8266689, CVE-2021-35567, bsc#1191903: More Constrained
    Delegation
    + JDK-8267086: ArrayIndexOutOfBoundsException in
    java.security.KeyFactory.generatePublic
    + JDK-8267712: Better LDAP reference processing
    + JDK-8267729, CVE-2021-35578, bsc#1191904: Improve TLS client
    handshaking
    + JDK-8267735, CVE-2021-35586, bsc#1191914: Better BMP support
    + JDK-8268193: Improve requests of certificates
    + JDK-8268199: Correct certificate requests
    + JDK-8268205: Enhance DTLS client handshake
    + JDK-8268506: More Manifest Digests
    + JDK-8269618, CVE-2021-35603, bsc#1191906: Better session
    identification
    + JDK-8269624: Enhance method selection support
    + JDK-8270398: Enhance canonicalization
    + JDK-8270404: Better canonicalization
  * Other changes
    + JDK-8024368: private methods are allocated vtable indices
    + JDK-8042902: Test java/net/Inet6Address/serialize/
    /Inet6AddressSerializationTest.java fails intermittently
    + JDK-8140466: ChaCha20 and Poly1305 TLS Cipher Suites
    + JDK-8157404: Unable to read certain PKCS12 keystores from
    SequenceInputStream
    + JDK-8158066: SourceDebugExtensionTest fails to rename file
    + JDK-8168304: Make all of DependencyContext_test available in
    product mode
    + JDK-8169246: java/net/DatagramSocket/ReportSocketClosed.java
    fails intermittently with BindException
    + JDK-8181313: SA: Remove libthread_db dependency on Linux
    + JDK-8193214: Incorrect annotations.without.processors
    warnings with JDK 9
    + JDK-8194230: jdk/internal/jrtfs/remote/
    /RemoteRuntimeImageTest.java fails with
    java.lang.NullPointerException
    + JDK-8196092: javax/swing/JComboBox/8032878/bug8032878.java
    fails
    + JDK-8199931: java/net/MulticastSocket/
    /UnreferencedMulticastSockets.java fails with "incorrect data
    received"
    + JDK-8206083: Make tools/javac/api/T6265137.java robust to JDK
    version changes
    + JDK-8206350: java/util/Locale/bcp47u/SystemPropertyTests.java
    failed on Mac 10.13 with zh_CN and zh_TW locales.
    + JDK-8207316: java/nio/channels/spi/SelectorProvider/
    /inheritedChannel/InheritedChannelTest.java failed
    + JDK-8208227: tools/jdeps/DotFileTest.java fails on Win-X64
    + JDK-8208363: test/jdk/java/lang/Package/
    /PackageFromManifest.java missing module dependencies
    declaration
    + JDK-8209380: ARM: cleanup maybe-uninitialized and reorder
    compiler warnings
    + JDK-8209768: Refactor java/util/prefs/CheckUserPrefsStorage.sh
    to plain java test
    + JDK-8209772: Refactor shell test java/util/ServiceLoader/
    /basic/basic.sh to java
    + JDK-8209773: Refactor shell test javax/naming/module/basic.sh
    to java
    + JDK-8209832: Refactor jdk/internal/reflect/Reflection/
    /GetCallerClassTest.sh to plain java test
    + JDK-8209930: Refactor java/util/zip/ZipFile/deletetempjar.sh
    to plain java test
    + JDK-8210406: Refactor java.util.PluggableLocale:i18n shell
    tests to plain java tests
    + JDK-8210407: Refactor java.util.Calendar:i18n shell tests to
    plain java tests
    + JDK-8210495: compiler crashes because of illegal signature in
    otherwise legal code
    + JDK-8210669: Some launcher tests assume a pre-JDK 9 run-time
    image layout
    + JDK-8210802: temp files left by tests in
    jdk/java/net/httpclient
    + JDK-8210819: Update the host name in CNameTest.java
    + JDK-8210908: Refactor java/util/prefs/PrefsSpi.sh to plain
    java test
    + JDK-8210934: Move sun/net/www/protocol/http/
    /GetErrorStream.java to OpenJDK
    + JDK-8210959: JShell fails and exits when statement throws an
    exception whose message contains a '%'.
    + JDK-8211055: Provide print to a file (PDF) feature even when
    printer was not connected
    + JDK-8211092: test/jdk/sun/net/www/http/HttpClient/
    /MultiThreadTest.java fails intermittently when cleaning up
    + JDK-8211296: Remove HotSpot deprecation warning suppression
    for Mac/clang
    + JDK-8211325: test/jdk/java/net/Socket/LingerTest.java fails
    with cleaning up
    + JDK-8212040: Compilation error due to wrong usage of
    NSPrintJobDispositionValue in mac10.12
    + JDK-8212695: Add explicit timeout to several HTTP Client tests
    + JDK-8212718: Refactor some annotation processor tests to
    better use collections
    + JDK-8213007: Update the link in test/jdk/sun/security/
    /provider/SecureRandom/DrbgCavp.java
    + JDK-8213137: Remove static initialization of monitor/mutex
    instances
    + JDK-8213235: java/nio/channels/SocketChannel/
    /AsyncCloseChannel.java fails with threads that didn't exit
    + JDK-8213409: Refactor sun.text.IntHashtable:i18n shell tests
    to plain java tests
    + JDK-8213576: Make test AsyncCloseChannel.java run in othervm
    + JDK-8213694: Test Timeout.java should run in othervm mode
    + JDK-8213718: [TEST] Wrong classname in vmTestbase/nsk/stress/
    /except/except002 and except003
    + JDK-8213922: fix ctw stand-alone build
    + JDK-8214195: Align stdout messages in
    test/jdk/java/math/BigInteger/PrimitiveConversionTests.java
    + JDK-8214520: [TEST_BUG] sun/security/mscapi/nonUniqueAliases/
    /NonUniqueAliases.java failed with incorrect jtreg tags order
    + JDK-8214937: sun/security/tools/jarsigner/warnings/
    /NoTimestampTest.java failed due to unexpected expiration date
    + JDK-8216532: tools/launcher/Test7029048.java fails (Solaris)
    + JDK-8217825: Verify @AfterTest is used correctly in WebSocket
    tests
    + JDK-8218145: block_if_requested is not proper inlined due to
    size
    + JDK-8219417: bump jtreg requiredVersion to b14
    + JDK-8219552: bump jtreg requiredVersion to b14 in
    test/jdk/sanity/client/
    + JDK-8219804: java/net/MulticastSocket/Promiscuous.java fails
    intermittently due to NumberFormatException
    + JDK-8220445: Support for side by side MSVC Toolset versions
    + JDK-8221988: add possibility to build with Visual Studio 2019
    + JDK-8222751: closed/test/jdk/sun/security/util/
    /DerIndefLenConverter/IndefBerPkcs12.java fail
    + JDK-8223050: JVMCI: findUniqueConcreteMethod() should not use
    Dependencies::find_unique_concrete_method() for non-virtual
    methods
    + JDK-8224853: CDS address sanitizer errors
    + JDK-8225082: Remove IdenTrust certificate that is expiring in
    September 2021
    + JDK-8225583: Examine the HttpResponse.BodySubscribers for
    null handling and multiple subscriptions
    + JDK-8225690: Multiple AttachListener threads can be created
    + JDK-8225790: Two NestedDialogs tests fail on Ubuntu
    + JDK-8226319: Add forgotten test/jdk/java/net/httpclient/
    /BodySubscribersTest.java
    + JDK-8226533: JVMCI: findUniqueConcreteMethod should handle
    statically bindable methods directly
    + JDK-8226602: Test convenience reactive primitives from
    java.net.http with RS TCK
    + JDK-8226683: Remove review suggestion from fix to 8219804
    + JDK-8227738: jvmti/DataDumpRequest/datadumpreq001 failed due
    to "exit code is 134"
    + JDK-8227766: CheckUnhandledOops is broken in MemAllocator
    + JDK-8227815: Minimal VM: set_state is not a member of
    AttachListener
    + JDK-8230674: Heap dumps should exclude dormant CDS archived
    objects of unloaded classes
    + JDK-8230808: Remove Access::equals()
    + JDK-8230841: Remove oopDesc::equals()
    + JDK-8231717: Improve performance of charset decoding when
    charset is always compactable
    + JDK-8232243: Wrong caret position in JTextPane on Windows
    with a screen resolution &gt; 100%
    + JDK-8232782: Shenandoah: streamline post-LRB CAS barrier
    (aarch64)
    + JDK-8233790: Forward output from heap dumper to jcmd/jmap
    + JDK-8233989: Create an IPv4 version of
    java/net/MulticastSocket/SetLoopbackMode.java
    + JDK-8234510: Remove file seeking requirement for writing a
    heap dump
    + JDK-8235211: serviceability/attach/
    /RemovingUnixDomainSocketTest.java fails with
    AttachNotSupportedException: Unable to open socket file
    + JDK-8235216: typo in test filename
    + JDK-8235866: bump jtreg requiredVersion to 4.2b16
    + JDK-8236111: narrow allowSmartActionArgs disabling
    + JDK-8236413: AbstractConnectTimeout should tolerate both
    NoRouteToHostException and UnresolvedAddressException
    + JDK-8236671: NullPointerException in JKS keystore
    + JDK-8238930: problem list compiler/c2/Test8004741.java
    + JDK-8238943: switch to jtreg 5.0
    + JDK-8240555: Using env of JAVA_TOOL_OPTIONS and _JAVA_OPTIONS
    breaks QuietOption.java test
    + JDK-8240983: Incorrect copyright header in Apache Santuario
    2.1.3 files
    + JDK-8241336: Some java.net tests failed with
    NoRouteToHostException on MacOS with special network
    configuration
    + JDK-8241353: NPE in ToolProvider.getSystemJavaCompiler
    + JDK-8241768: git needs .gitattributes
    + JDK-8242882: opening jar file with large manifest might throw
    NegativeArraySizeException
    + JDK-8244973: serviceability/attach/
    /RemovingUnixDomainSocketTest.java fails "stderr was not
    empty"
    + JDK-8245134: test/lib/jdk/test/lib/security/
    /KeyStoreUtils.java should allow to specify aliases
    + JDK-8246261: TCKLocalTime.java failed due to "AssertionError:
    expected [18:14:22] but found [18:14:23]"
    + JDK-8246387: switch to jtreg 5.1
    + JDK-8247421: [TESTBUG] ReturnBlobToWrongHeapTest.java failed
    allocating blob
    + JDK-8247469: getSystemCpuLoad() returns -1 on linux when some
    offline cpus are present and cpusets.effective_cpus is not
    available
    + JDK-8248352: [TEST_BUG] Test test/jdk/java/awt/font/
    /TextLayout/ArabicDiacriticTest.java can leave frame open
    + JDK-8248403: AArch64: Remove uses of kernel integer types
    + JDK-8248414: AArch64: Remove uses of long and unsigned long
    ints
    + JDK-8248657: Windows: strengthening in ThreadCritical
    regarding memory model
    + JDK-8248666: AArch64: Use THREAD_LOCAL instead of __thread
    + JDK-8248668: AArch64: Avoid MIN/MAX macros when using MSVC
    + JDK-8248671: AArch64: Remove unused variables
    + JDK-8248682: AArch64: Use ATTRIBUTE_ALIGNED helper
    + JDK-8248816: C1: Fix signature conflict in
    LIRGenerator::strength_reduce_multiply
    + JDK-8249095: tools/javac/launcher/SourceLauncherTest.java
    fails on Windows
    + JDK-8249548: backward focus traversal gets stuck in button
    group
    + JDK-8249773: Upgrade ReceiveISA.java test to be resilient to
    failure due to stray packets and interference
    + JDK-8249897: jdk/javadoc/tool/LangVers.java uses @ignore w/o
    bug-id
    + JDK-8249898: jdk/javadoc/tool/6176978/T6176978.java uses
    @ignore w/o bug-id
    + JDK-8249899: jdk/javadoc/tool/InlineTagsWithBraces.java uses
    @ignore w/o bug-id
    + JDK-8250588: Shenandoah: LRB needs to save/restore fp
    registers for runtime call
    + JDK-8250824: AArch64: follow up for JDK-8248414
    + JDK-8251166: Add automated testcases for changes done in
    JDK-8214112
    + JDK-8251252: Add automated testcase for fix done in
    JDK-8214253
    + JDK-8251254: Add automated test for fix done in JDK-8218472
    + JDK-8251361: Potential race between Logger configuration and
    GCs in HttpURLConWithProxy test
    + JDK-8251549: Update docs on building for Git
    + JDK-8251945: SIGSEGV in
    PackageEntry::purge_qualified_exports()
    + JDK-8252194: Add automated test for fix done in JDK-8218469
    + JDK-8252648: Shenandoah: name gang tasks consistently
    + JDK-8252825: Add automated test for fix done in JDK-8218479
    + JDK-8252853: AArch64: gc/shenandoah/TestVerifyJCStress.java
    fails intermittently with C1
    + JDK-8252857: AArch64: Shenandoah C1 CAS is not sequentially
    consistent
    + JDK-8253048: AArch64: When CallLeaf, no need to preserve
    callee-saved registers in caller
    + JDK-8253424: Add support for running pre-submit testing using
    GitHub Actions
    + JDK-8253631: Remove unimplemented CompileBroker methods after
    JEP-165
    + JDK-8253865: Pre-submit testing using GitHub Actions does not
    detect failures reliably
    + JDK-8253899: Make IsClassUnloadingEnabled signature match
    specification
    + JDK-8254024: Enhance native libs for AWT and Swing to work
    with GraalVM Native Image
    + JDK-8254054: Pre-submit testing using GitHub Actions should
    not use the deprecated set-env command
    + JDK-8254173: Add Zero, Minimal hotspot targets to submit
    workflow
    + JDK-8254175: Build no-pch configuration in debug mode for
    submit checks
    + JDK-8254244: Some code emitted by TemplateTable::branch is
    unused when running TieredCompilation
    + JDK-8254270: linux 32 bit build doesn't compile
    libjdwp/log_messages.c
    + JDK-8254282: Add Linux x86_32 builds to submit workflow
    + JDK-8254850: Update terminology in java.awt.GridBagLayout
    source code comments
    + JDK-8255255: Update Apache Santuario (XML Signature) to
    version 2.2.1
    + JDK-8255305: Add Linux x86_32 tier1 to submit workflow
    + JDK-8255352: Archive important test outputs in submit workflow
    + JDK-8255373: Submit workflow artifact name is always
    "test-results_.zip"
    + JDK-8255452: Doing GC during JVMTI MethodExit event posting
    breaks return oop
    + JDK-8255718: Zero: VM should know it runs in interpreter-only
    mode
    + JDK-8255790: GTKL&amp;F: Java 16 crashes on initialising GTKL&amp;F
    on Manjaro Linux
    + JDK-8255810: Zero: build fails without JVMTI
    + JDK-8255895: Submit workflow artifacts miss hs_errs/replays
    due to ZIP include mismatch
    + JDK-8256127: Add cross-compiled foreign architectures builds
    to submit workflow
    + JDK-8256215: Shenandoah: re-organize saving/restoring machine
    state in assembler code
    + JDK-8256267: Relax compiler/floatingpoint/NaNTest.java for
    x86_32 and lower -XX:+UseSSE
    + JDK-8256277: Github Action build on macOS should define OS
    and Xcode versions
    + JDK-8256354: Github Action build on Windows should define OS
    and MSVC versions
    + JDK-8256393: Github Actions build on Linux should define OS
    and GCC versions
    + JDK-8256414: add optimized build to submit workflow
    + JDK-8256747: GitHub Actions: decouple the hotspot build-only
    jobs from Linux x64 testing
    + JDK-8257056: Submit workflow should apt-get update to avoid
    package installation errors
    + JDK-8257148: Remove obsolete code in AWTView.m
    + JDK-8257497: Update keytool to create AKID from the SKID of
    the issuing certificate as specified by RFC 5280
    + JDK-8257620: Do not use objc_msgSend_stret to get macOS
    version
    + JDK-8257913: Add more known library locations to simplify
    Linux cross-compilation
    + JDK-8258703: Incorrect 512-bit vector registers restore on
    x86_32
    + JDK-8259338: Add expiry exception for identrustdstx3 alias to
    VerifyCACerts.java test
    + JDK-8259535: ECDSA SignatureValue do not always have the
    specified length
    + JDK-8259679: GitHub actions should use MSVC 14.28
    + JDK-8259924: GitHub actions fail on Linux x86_32 with "Could
    not configure libc6:i386"
    + JDK-8260460: GitHub actions still fail on Linux x86_32 with
    "Could not configure libc6:i386"
    + JDK-8260589: Crash in JfrTraceIdLoadBarrier::load(_jclass*)
    + JDK-8260923: Add more tests for SSLSocket input/output
    shutdown
    + JDK-8261072: AArch64: Fix MacroAssembler::get_thread
    convention
    + JDK-8261147: C2: Node is wrongly marked as reduction
    resulting in a wrong execution due to wrong vector instructions
    + JDK-8261238: NMT should not limit baselining by size threshold
    + JDK-8261496: Shenandoah: reconsider pacing updates memory
    ordering
    + JDK-8261652: Remove some dead comments from os_bsd_x86
    + JDK-8261846: [JVMCI] c2v_iterateFrames can get out of sync
    with the StackFrameStream
    + JDK-8262000: jdk/jfr/event/gc/detailed/
    /TestPromotionFailedEventWithParallelScavenge.java failed with
    "OutOfMemoryError: Java heap space"
    + JDK-8262017: C2: assert(n != __null) failed: Bad immediate
    dominator info.
    + JDK-8262392: Update Mesa 3-D Headers to version 21.0.3
    + JDK-8262409: sun/security/ssl/SSLSocketImpl/
    /SSLSocketImplThrowsWrongExceptions. SSL test failures caused
    by java failed with "Server reported the wrong exception"
    + JDK-8262470: Printed GlyphVector outline with low DPI has bad
    quality on Windows
    + JDK-8262862: Harden tests sun/security/x509/URICertStore/
    /ExtensionsWithLDAP.java and krb5/canonicalize/Test.java
    + JDK-8263136: C4530 was reported from VS 2019 at access bridge
    + JDK-8263227: C2: inconsistent spilling due to dead nodes in
    exception block
    + JDK-8263382: java/util/logging/ParentLoggersTest.java failed
    with "checkLoggers: getLoggerNames() returned unexpected
    loggers"
    + JDK-8263407: SPARC64 detection fails on Athena (SPARC64-X)
    + JDK-8263432: javac may report an invalid package/class clash
    on case insensitive filesystems
    + JDK-8263490: [macos] Crash occurs on JPasswordField with
    activated InputMethod
    + JDK-8263531: Remove unused buffer int
    + JDK-8263667: Avoid running GitHub actions on branches named
    pr/*
    + JDK-8263776: [JVMCI] add helper to perform Java upcalls
    + JDK-8264016: [JVMCI] add some thread local fields for use by
    JVMCI
    + JDK-8264752: SIGFPE crash with option
    FlightRecorderOptions:threadbuffersize=30M
    + JDK-8265132: C2 compilation fails with assert "missing
    precedence edge"
    + JDK-8265231: (fc) ReadDirect and WriteDirect tests fail after
    fix for JDK-8264821
    + JDK-8265335: Epsilon: Minor typo in EpsilonElasticTLABDecay
    description
    + JDK-8265756: AArch64: initialize memory allocated for locals
    according to Windows AArch64 stack page growth requirement in
    template interpreter
    + JDK-8265761: Font with missed font family name is not
    properly printed on Windows
    + JDK-8265773: incorrect jdeps message "jdk8internals" to
    describe a removed JDK internal API
    + JDK-8265836: OperatingSystemImpl.getCpuLoad() returns
    incorrect CPU load inside a container
    + JDK-8266018: Shenandoah: fix an incorrect assert
    + JDK-8266206: Build failure after JDK-8264752 with older GCCs
    + JDK-8266248: Compilation failure in
    PLATFORM_API_MacOSX_MidiUtils.c with Xcode 12.5
    + JDK-8266288: assert root method not found in
    witnessed_reabstraction_in_supers is too strong
    + JDK-8266404: Fatal error report generated with
  - XX:+CrashOnOutOfMemoryError should not contain suggestion to
    submit a bug report
    + JDK-8266480: Implicit null check optimization does not update
    control of hoisted memory operation
    + JDK-8266615: C2 incorrectly folds subtype checks involving an
    interface array
    + JDK-8266642: Improve ResolvedMethodTable hash function
    + JDK-8266749: AArch64: Backtracing broken on PAC enabled
    systems
    + JDK-8266761: AssertionError in
    sun.net.httpserver.ServerImpl.responseCompleted
    + JDK-8266813: Shenandoah: Use shorter instruction sequence for
    checking if marking in progress
    + JDK-8267042: bug in monitor locking/unlocking on ARM32 C1 due
    to uninitialized BasicObjectLock::_displaced_header
    + JDK-8267348: Rewrite gc/epsilon/TestClasses.java to use
    Metaspace with less classes
    + JDK-8267396: Avoid recording "pc" in unhandled oops detector
    for better performance
    + JDK-8267399: C2: java/text/Normalizer/ConformanceTest.java
    test failed with assertion
    + JDK-8267424: CTW: C1 fails with "State must not be null"
    + JDK-8267459: Pasting Unicode characters into JShell does not
    work.
    + JDK-8267625: AARCH64: typo in LIR_Assembler::emit_profile_type
    + JDK-8267666: Add option to jcmd GC.heap_dump to use existing
    file
    + JDK-8267695: Bump update version for OpenJDK: jdk-11.0.13
    + JDK-8267751: (test) jtreg.SkippedException has no serial
    VersionUID
    + JDK-8267773: PhaseStringOpts::int_stringSize doesn't handle
    min_jint correctly
    + JDK-8268103: JNI functions incorrectly return a double after
    JDK-8265836
    + JDK-8268127: Shenandoah: Heap size may be too small for
    region to align to large page size
    + JDK-8268261: C2: assert(n != __null) failed: Bad immediate
    dominator info.
    + JDK-8268347: C2: nested locks optimization may create
    unbalanced monitor enter/exit code
    + JDK-8268360: Missing check for infinite loop during node
    placement
    + JDK-8268362: [REDO] C2 crash when compile negative
    Arrays.copyOf length after loop
    + JDK-8268366: Incorrect calculation of has_fpu_registers in C1
    linear scan
    + JDK-8268369: SIGSEGV in PhaseCFG::implicit_null_check due to
    missing null check
    + JDK-8268417: Add test from JDK-8268360
    + JDK-8268427: Improve AlgorithmConstraints:checkAlgorithm
    performance
    + JDK-8268617: [11u REDO] - WebSocket over authenticating proxy
    fails with NPE
    + JDK-8268620: InfiniteLoopException test may fail on x86
    platforms
    + JDK-8268635: Corrupt oop in ClassLoaderData
    + JDK-8268699: Shenandoah: Add test for JDK-8268127
    + JDK-8268771: javadoc -notimestamp option does not work on
    index.html
    + JDK-8268775: Password is being converted to String in
    AccessibleJPasswordField
    + JDK-8268776: Test `ADatagramSocket.java` missing /othervm
    from @run tag
    + JDK-8268965: TCP Connection Reset when connecting simple
    socket to SSL server
    + JDK-8269304: Regression ~5% in 2005 in b27
    + JDK-8269415: [11u] Remove ea from
    DEFAULT_PROMOTED_VERSION_PRE in OpenJDK 11u
    + JDK-8269478: Shenandoah: gc/shenandoah/mxbeans tests should
    be more resilient
    + JDK-8269529: javax/swing/reliability/
    /HangDuringStaticInitialization.java fails in Windows debug
    build
    + JDK-8269594: assert(_handle_mark_nesting &gt; 1) failed: memory
    leak: allocating handle outside HandleMark
    + JDK-8269614: [s390] Interpreter checks wrong bit for slow
    path instance allocation
    + JDK-8269650: Optimize gc-locker in
    [Get|Release]StringCritical for latin string
    + JDK-8269661: JNI_GetStringCritical does not lock char array
    + JDK-8269668: [aarch64] java.library.path not including
    /usr/lib64
    + JDK-8269763: The JEditorPane is blank after JDK-8265167
    + JDK-8269795: C2: Out of bounds array load floats above its
    range check in loop peeling resulting in SEGV
    + JDK-8269847: JDK-8269594 backport breaks 11u builds
    + JDK-8269850: Most JDK releases report macOS version 12 as
    10.16 instead of 12.0
    + JDK-8269851: OperatingSystemMXBean getProcessCpuLoad reports
    incorrect process cpu usage in containers
    + JDK-8269882: stack-use-after-scope in NewObjectA
    + JDK-8269934: RunThese24H.java failed with
    EXCEPTION_ACCESS_VIOLATION in
    java_lang_Thread::get_thread_status
    + JDK-8270096: Shenandoah: Optimize gc/shenandoah/
    /TestRefprocSanity.java for interpreter mode
    + JDK-8270137: Kerberos Credential Retrieval from Cache not
    Working in Cross-Realm Setup
    + JDK-8270184: [TESTBUG] Add coverage for jvmci
    ResolvedJavaType.toJavaName() for lambdas
    + JDK-8270196: [11u] [JVMCI] JavaType.toJavaName() returns
    incorrect type name for lambdas
    + JDK-8270556: Exclude security/infra/java/security/cert/
    /CertPathValidator/certification/LetsEncryptCA
    + JDK-8270893: IndexOutOfBoundsException while reading large
    TIFF file
    + JDK-8272078: Wrong Checksums in Temurin BootJDK dependencies
    + JDK-8272124: Cgroup v1 initialization causes
    NullPointerException when cgroup path contains colon
    + JDK-8272131: PhaseMacroExpand::generate_slow_arraycopy crash
    when clone null CallProjections.fallthrough_ioproj
    + JDK-8272197: Update 11u GHA workflow with Shenandoah
    configurations
    + JDK-8272332: --with-harfbuzz=system doesn't add -lharfbuzz
    after JDK-8255790
    + JDK-8272472: StackGuardPages test doesn't build with glibc
    2.34
    + JDK-8272602: [macos] not all KEY_PRESSED events sent when
    control modifier is used
    + JDK-8272628: Problemlist gc/stress/gcbasher/
    /TestGCBasherWithCMS.java for x86_32
    + JDK-8272700: [macos] Build failure with Xcode 13.0 after
    JDK-8264848
    + JDK-8272772: Shenandoah: compiler/c2/aarch64/
    /TestVolatilesShenandoah.java fails in 11u
    + JDK-8273939: Backport of 8248414 to JDK11 breaks
    MacroAssembler::adrp
- Remove the unneeded icedtea-sound provider
- Removed patches:
  * icedtea-sound-1.0.1-jdk9.patch
  * icedtea-sound-soundproperties.patch
    + not needed since the icedtea-sound provider is removed
  * jdk11-glibc234.patch
    + integrated upstream</changelog>
  <changelog author="fstrba@suse.com" date="1635940800">- Modified patches:
  * system-crypto-policy.patch
    + rediff to changed context
  * fips.patch
    + Allow plain key import in fips mode unless
    com.suse.fips.plainKeySupport is set to false</changelog>
  <changelog author="fstrba@suse.com" date="1636113600">- Modified patch:
  * fips.patch
    + return in native code after generating java.io.IOException</changelog>
</package>
<package pkgid="04d63dbdb7e1dd371287dc828fc7994987b5e61b90507df9aa5350a5f24dfc1a" name="java-11-openjdk-jmods" arch="x86_64">
  <version epoch="0" ver="11.0.13.0" rel="3.68.1"/>
  <changelog author="fstrba@suse.com" date="1586952000">- The pack200 and unpack200 alternatives should be slaves of java
  and not of javac, since they are part of JRE.</changelog>
  <changelog author="fstrba@suse.com" date="1587470400">- Update to upstream tag jdk-11.0.7+10 (April 2020 CPU,
  bsc#1169511)
  * Security fixes:
    + S8223898, CVE-2020-2754: Forward references to Nashorn
    + S8223904, CVE-2020-2755: Improve Nashorn matching
    + S8224541, CVE-2020-2756: Better mapping of serial ENUMs
    + S8224549, CVE-2020-2757: Less Blocking Array Queues
    + S8225603: Enhancement for big integers
    + S8226346: Build better binary builders
    + S8227467: Better class method invocations
    + S8227542: Manifest improved jar headers
    + S8229733: TLS message handling improvements
    + S8231415, CVE-2020-2773: Better signatures in XML
    + S8231785: Improved socket permissions
    + S8232424, CVE-2020-2778: More constrained algorithms
    + S8232581, CVE-2020-2767: Improve TLS verification
    + S8233250: Better X11 rendering
    + S8233410: Better Build Scripting
    + S8234027: Better JCEKS key support
    + S8234408, CVE-2020-2781: Improve TLS session handling
    + S8234825, CVE-2020-2800: Better Headings for HTTP Servers
    + S8234841, CVE-2020-2803: Enhance buffering of byte buffers
    + S8235274, CVE-2020-2805: Enhance typing of methods
    + S8235691, CVE-2020-2816: Enhance TLS connectivity
    + S8236201, CVE-2020-2830: Better Scanner conversions
    + S8238960: linux-i586 builds are inconsistent as the newly
    built jdk is not able to reserve enough space for object heap
  * Other changes:
    + S4919790: Errors in alert ssl message does not reflect the
    actual certificate status
    + S4949105: Access Bridge lacks html tags parsing
    + S7092821: java.security.Provider.getService() is synchronized
    and became scalability bottleneck
    + S7143743: Potential memory leak with zip provider
    + S8005819: Support cross-realm MSSFU
    + S8042383: [TEST_BUG] Test javax/swing/plaf/basic/BasicMenuUI/
    /4983388/bug4983388.java fails with shortcuts on menus do not
    work
    + S8068184: Fix for JDK-8032832 caused a deadlock
    + S8145845: [AOT] NullPointerException in
    compiler/whitebox/GetCodeHeapEntriesTest.java
    + S8152988: [AOT] Update test batch definitions to include
    aot-ed java.base module mode into hs-comp testing
    + S8160926: FLAGS_COMPILER_CHECK_ARGUMENTS doesn't handle
    cross-compilation
    + S8163083: SocketListeningConnector does not allow invocations
    with port 0
    + S8163251: Hard coded loop limit prevents reading of smart
    card data greater than 8k
    + S8167276: jvmci/compilerToVM/MaterializeVirtualObjectTest.java
    fails with -XX:-EliminateAllocations
    + S8169718: nsk/jdb/locals/locals002: ERROR: Cannot find
    boolVar with expected value: false
    + S8176556:
    java/awt/dnd/ImageTransferTest/ImageTransferTest.java fails
    for JFIF
    + S8178798: Two compiler/aot/verification/vmflags tests fail by
    timeout with UseAVX=3
    + S8183107: PKCS11 regression regarding checkKeySize
    + S8185005: Improve performance of
    ThreadMXBean.getThreadInfo(long ids[], int maxDepth)
    + S8189633: Missing -Xcheck:jni checking for DeleteWeakGlobalRef
    + S8189861: Refactor CacheFind
    + S8193042: NativeLookup::lookup_critical_entry() should only
    load shared library once
    + S8193596: java/net/DatagramPacket/ReuseBuf.java failed due to
    timeout
    + S8194944: Regression automated test 'open/test/jdk/javax/
    /swing/JInternalFrame/8145896/TestJInternalFrameMaximize.java'
    fails
    + S8196467: javax/swing/JInternalFrame/Test6325652.java fails
    + S8196969: JTreg Failure: serviceability/sa/ClhsdbJstack.java
    causes NPE
    + S8198321: javax/swing/JEditorPane/5076514/bug5076514.java
    fails
    + S8198398: Test javax/swing/JColorChooser/Test6199676.java
    fails in mach5
    + S8199072: Test javax/swing/GroupLayout/6613904/
    /bug6613904.java is unstable
    + S8200432: javadoc fails with ClassCastException on {@link
    byte[]}
    + S8201349: build broken when configured with
  - -with-zlib=bundled on gcc 7.3
    + S8201355: Avoid native memory allocation in
    sun.security.mscapi.PRNG.generateSeed
    + S8201513: nsk/jvmti/IterateThroughHeap/filter-* are broken
    + S8203364: Some serviceability/sa/ tests intermittently fail
    with java.io.IOException: LingeredApp terminated with non-zero
    exit code 3
    + S8203687: javax/net/ssl/compatibility/Compatibility.java
    supports TLS 1.3
    + S8203904: javax/swing/JSplitPane/4816114/bug4816114.java: The
    divider location is wrong
    + S8203911: Test runtime/modules/getModuleJNI/GetModule fails
    with -Xcheck:jni
    + S8204525: [TESTBUG] runtime/NMT/MallocStressTest.java ran out
    of java heap
    + S8204529: gc/TestAllocateHeapAtMultiple.java fail with Agent
    7 timed out
    + S8204551: Event descriptions are truncated in logs
    + S8206963: [AOT] bug with multiple class loaders
    + S8207367: 10 vmTestbase/nsk/jdi tests timed out when running
    with jtreg
    + S8207832: serviceability/sa/ClhsdbCDSCore.java failed with
    "Couldn't find core file location"
    + S8207938: At step6,Click Add button,case failed automatically.
    + S8208157: requires.VMProps throws NPE for missing properties
    in "release" file
    + S8208379: compiler/jvmci/events/
    /JvmciNotifyInstallEventTest.java failed with "Got unexpected
    event count after 2nd install attempt: expected 9 to equal 2"
    + S8208658: Make CDS archived heap regions usable even if
    compressed oop encoding has changed
    + S8208715: Conversion of milliseconds to nanoseconds in
    UNIXProcess contains bug
    + S8209361: [AOT] Unexpected number of references for
    JVMTI_HEAP_REFERENCE_CONSTANT_POOL [111--&gt;111]: 0 (expected
    at least 1)
    + S8209385: CDS runtime classpath checking is too strict when
    only classes from the system modules are archived
    + S8209389: SIGSEGV in WalkOopAndArchiveClosure::do_oop_work.
    + S8209418: Synchronize test/jdk/sanity/client/lib/jemmy with
    code-tools/jemmy/v2
    + S8209494: Create a test for SwingSet InternalFrameDemo
    + S8209499: Create test for SwingSet EditorPaneDemo
    + S8209574: [AOT] breakpoint events are generated in different
    threads does not meet expected count
    + S8209686: cleanup arguments to PhaseIdealLoop() constructor
    + S8209789: Synchronize test/jdk/sanity/client/lib/jemmy with
    code-tools/jemmy/v2
    + S8209802: Garbage collectors should register JFR types
    themselves to avoid build errors.
    + S8209807: improve handling exception in requires.VMProps
    + S8209817: stack is executable when building with Clang on
    Linux
    + S8209824: Improve the code coverage for ThreadLocal
    + S8209826: Undefined reference to os::write after JDK-8209657
    (filemap.hpp cleanup)
    + S8209850: Allow NamedThreads to use GlobalCounter critical
    sections
    + S8209976: Improve iteration over non-JavaThreads
    + S8209993: Create a test for SwingSet3 ToolTipDemo
    + S8210024: JFR calls virtual is_Java_thread from ~Thread()
    + S8210052: Enable testing for all the available look and feels
    in SwingSet3 demo tests
    + S8210055: Enable different look and feel tests in SwingSet3
    demo tests
    + S8210057: Enable different look and feels in SwingSet3 demo
    test InternalFrameDemoTest
    + S8210058: Algorithmic Italic font leans opposite angle in
    Printing
    + S8210220: [AOT] jdwp test cases are failing with error #
    ERROR: TEST FAILED: Cought IOException while receiving event
    packet
    + S8210289: ArchivedKlassSubGraphInfoRecord is incomplete
    + S8210459: Add support for generating compile_commands.json
    + S8210476: sun/security/mscapi/PrngSlow.java fails with Still
    too slow
    + S8210512: [Testbug] vmTestbase/nsk/jdi/ObjectReference/
    /referringObjects/referringObjects002/referringObjects002.java
    fails with unexpected size of
    ClassLoaderReference.referringObjects
    + S8210523: runtime/appcds/cacheObject/DifferentHeapSizes.java
    crash
    + S8210632: Add key exchange algorithm to
    javax/net/ssl/TLSCommon/CipherSuite.java
    + S8210699: Problem list tests which times out in Xcomp mode
    + S8210793: [JVMCI] AllocateCompileIdTest.java failed to find
    DiagnosticCommand.class
    + S8210910: Create test for FileChooserDemo
    + S8210994: Create test for SwingSet3 FrameDemo
    + S8211139: Increase timeout value in all tests under
    jdk/sanity/client/SwingSet/src
    + S8211160: Handle different look and feels in
    JInternalFrameOperator
    + S8211211: vmTestbase/metaspace/stressDictionary/
    /StressDictionary.java timeout
    + S8211322: Reduce the timeout of tooltip in SwingSet2DemoTest
    + S8211443: Enable different look and feels in SwingSet3 demo
    test SplitPaneDemoTest
    + S8211703: JInternalFrame : java.lang.AssertionError: cannot
    find the internal frame
    + S8211781: re-building fails after changing Graal sources
    + S8212897: Some improvements in the EditorPaneDemotest
    + S8212903: [TestBug] Tests test/jdk/javax/swing/LookAndFeel/
    /8145547/DemandGTK2.sh and DemandGTK3.sh fail on Ubuntu 18.04
    LTS
    + S8213009: Refactoring existing SunMSCAPI classes
    + S8213010: Supporting keys created with certmgr.exe
    + S8213168: Enable different look and feel tests in SwingSet3
    demo test FileChooserDemoTest
    + S8213348: jdk.internal.vm.compiler.management service
    providers missing in module descriptor
    + S8213906: Update arm devkits with libXrandr headers
    + S8213908: AssertionError in DeferredAttr at setOverloadKind
    + S8214124: [TESTBUG] Bugs in runtime/NMT/MallocStressTest.java
    + S8214344: C2: assert(con.basic_type() != T_ILLEGAL) failed:
    elembt=byte; loadbt=void; unsigned=0
    + S8214345: infinite recursion while checking super class
    + S8214471: Enable different look and feel tests in SwingSet3
    demo test ToolTipDemoTest
    + S8214534: Setting of THIS_FILE in the build is broken
    + S8214557: Filter out VM flags which don't affect AOT code
    generation
    + S8214578: [macos] Problem with backslashes on macOS/JIS
    keyboard: Java ignores system settings
    + S8214840: runtime/NMT/MallocStressTest.java timed out
    + S8214850: Rename vm_operations.?pp files to vmOperations.?pp
    files
    + S8214904: Test8004741.java failed due to "Too few ThreadDeath
    hits; expected at least 6 but saw only 5"
    + S8215322: add @file support to jaotc
    + S8215355: Object monitor deadlock with no threads holding the
    monitor (using jemalloc 5.1)
    + S8215396: JTabbedPane preferred size calculation is wrong for
    SCROLL_TAB_LAYOUT
    + S8216180: [AOT] compiler/intrinsics/bigInteger/TestMulAdd.java
    crashed with AOT enabled
    + S8216353: Use utility APIs introduced in org/netbeans/jemmy/
    /util/LookAndFeel class in client sanity test cases
    + S8216354: Syntax error in toolchain_windows.m4
    + S8216472: (se) Stack overflow during selection operation
    leads to crash (win)
    + S8216535: tools/jimage/JImageExtractTest.java timed out
    + S8217235: Create automated test for SwingSet
    ColorChooserDemoTest
    + S8217297: Add support for multiple look and feel for SwingSet
    SliderDemoTest
    + S8217338: [Containers] Improve systemd slice memory limit
    support
    + S8217613: [AOT] TEST_OPTS_AOT_MODULES doesn't work on mac
    + S8217634: RunTest documentation and usability update
    + S8217717: ZGC: Broken oop map in C1 load barrier stub
    + S8217728: Speed up incremental rerun of "make hotspot"
    + S8218268: Javac treats Manifest Class-Path entries as Paths
    instead of URLs
    + S8218662: Allow 204 responses with Content-Length:0
    + S8218882: NET_Writev is declared, NET_WriteV is defined
    + S8218889: Improperly use of the Optional API
    + S8219205: JFR file without license header
    + S8219597: (bf) Heap buffer state changes could provoke
    unexpected exceptions
    + S8219723: javax/net/ssl/compatibility/Compatibility.java
    failed on some SNI cases
    + S8220348: [ntintel] asserts about copying unaligned array
    + S8220451: jdi/EventQueue/remove/remove004 failed due to
    "ERROR: thread2 is not alive"
    + S8220456: jdi/EventQueue/remove_l/remove_l004 failed due to
    "TIMEOUT while waiting for event"
    + S8220479: java/nio/channels/Selector/SelectWithConsumer.java
    failed at testTwoChannels()
    + S8220613: java/util/Arrays/TimSortStackSize2.java times out
    with fastdebug build
    + S8220688: [TESTBUG] runtime/NMT/MallocStressTest.java timed
    out
    + S8220786: Create new switch to redirect error reporting
    output to stdout or stderr
    + S8221270: Duplicated synchronized keywords in SSLSocketImpl
    + S8221312: test/jdk/sanity/client/SwingSet/src/
    /ColorChooserDemoTest.java failed
    + S8221851: Use of THIS_FILE in hotspot invalidates precompiled
    header on Linux/GCC
    + S8221885: Add intermittent test in the JavaSound to the
    ProblemList
    + S8222264: Windows incremental build is broken with JDK-8217728
    + S8222391: javax/net/ssl/compatibility/Compatibility.java
    should be more flexible
    + S8222448: java/lang/reflect/PublicMethods/
    /PublicMethodsTest.java times out
    + S8222519: ButtonDemoScreenshotTest fails randomly with "still
    state to be reached"
    + S8222741: jdi/EventQueue/remove/remove004 fails due to
    VMDisconnectedException
    + S8223003: SunMSCAPI keys are not cleaned up
    + S8223063: Support CNG RSA keys
    + S8223158: Docked MacBook cannot start any Java Swing
    applications
    + S8223260: NamingManager should cache InitialContextFactory
    + S8223464: Improve version string for Oracle CI builds
    + S8223558: Java does not render Myanmar script correctly
    + S8223627: jdk-13+20 bundle name contains null instead of ea
    + S8223638: Replace wildcard address with loopback or local
    host in tests - part 6
    + S8223678: Add Visual Studio Code workspace generation support
    (for native code)
    + S8223727: com/sun/jndi/ldap/privconn/RunTest.java failed due
    to hang in LdapRequest.getReplyBer
    + S8223769: Assert triggers with -XX:+StressReflectiveCode
    + S8224187: Refactor arraycopy_prologue to allow ZGC read
    barriers on arraycopy
    + S8224475: JTextPane does not show images in HTML rendering
    + S8224673: Adjust permission for delayed starting of debugging
    + S8224705: Tests that need to be problem-listed or have
    printer resources
    + S8224778: test/jdk/demo/jfc/J2Ddemo/J2DdemoTest.java cannot
    find J2Ddemo.jar
    + S8224821: java/awt/Focus/NoAutotransferToDisabledCompTest/
    /NoAutotransferToDisabledCompTest.java fails linux-x64
    + S8224830: test/jdk/java/awt/Focus/
    /ModalExcludedWindowClickTest/
    /ModalExcludedWindowClickTest.java fails on linux-x64
    + S8224851: AArch64: fix warnings and errors with Clang and GCC
    8.3
    + S8224905: java/lang/ProcessBuilder/Basic.java#id1 failed with
    stream closed
    + S8225007: java/awt/print/PrinterJob/
    /LandscapeStackOverflow.java may hang
    + S8225105: java/awt/Focus/ShowFrameCheckForegroundTest/
    /ShowFrameCheckForegroundTest.java fails in Windows 10
    + S8225117: java/math/BigInteger/SymmetricRangeTests.java fails
    with ParseException
    + S8225128: Add exception for expiring DocuSign root to
    VerifyCACerts test
    + S8225130: Add exception for expiring Comodo roots to
    VerifyCACerts test
    + S8225144: [macos] In Aqua L&amp;F backspace key does not delete
    when Shift is pressed
    + S8225180: SignedObject with invalid Key not throwing the
    InvalidKeyException in Windows
    + S8225182: JNI exception pending in DestroyXIMCallback of
    awt_InputMethod.c:1327
    + S8225199: [Graal] compiler/jvmci/compilerToVM/
    /IsMatureVsReprofileTest.java fails with
  - XX:CompileThresholdScaling=0.1
    + S8225305: ProblemList java/lang/invoke/VarHandles tests
    + S8225350: compiler/jvmci/compilerToVM/IsCompilableTest.java
    timed out
    + S8225430: Replace wildcard address with loopback or local
    host in tests - part 14
    + S8225435: Upgrade IANA Language Subtag Registry to the latest
    for JDK14
    + S8225487: giflib legal file is missing attribution for
    openbsd-reallocarray.c
    + S8225567: Wrong file headers with 8202414 fix changeset
    + S8225684: [AOT] vmTestbase/vm/oom/production/
    /AlwaysOOMProduction tests fail with AOTed java.base
    + S8225766: Curve in certificate should not affect signature
    scheme when using TLSv1.3
    + S8225797: OldObjectSample event creates unexpected amount of
    checkpoint data
    + S8226381: ProblemList java/lang/reflect/PublicMethods/
    /PublicMethodsTest.java
    + S8226406: JVM fails to detect mismatched or corrupt CDS
    archive
    + S8226608: Hide the onjcmd option from the help output
    + S8226892: ActionListeners on JRadioButtons don't get notified
    when selection is changed with arrow keys
    + S8227112: exclude compiler/intrinsics/sha/sanity tests from
    AOT runs
    + S8227324: Upgrade to freetype 2.10.1
    + S8227528: TestAbortVMOnSafepointTimeout.java failed due to
    "RuntimeException: 'Safepoint sync time longer than' missing
    from stdout/stderr"
    + S8227645: Some tests in serviceability/sa run with fixed -Xmx
    values and risk running out of memory
    + S8227646: [TESTBUG] appcds/SharedArchiveConsistency timed out
    + S8227662: freetype seeks to index at the end of the font data
    + S8228479: Correct the format of ColorChooserDemoTest
    + S8228613: java.security.Provider#getServices order is no
    longer deterministic
    + S8228969: 2019-09-28 public suffix list update
    + S8229236: CriticalJNINatives: dll handling should be done in
    native thread state
    + S8229345: Memory leak due to vtable stubs not being shared on
    SPARC
    + S8229888: (zipfs) Updating an existing zip file does not
    preserve original permissions
    + S8229994: assert(false) failed: Bad graph detected in
    get_early_ctrl_for_expensive
    + S8230004: jdk/internal/jimage/JImageOpenTest.java runs no test
    + S8230235: Rendering HTML with empty img attribute and
    documentBaseKey cause Exception
    + S8230390: Problemlist SA tests with AOT
    + S8230400: Missing constant pool entry for a method in
    stacktrace
    + S8230459: Test failed to resume JVMCI CompilerThread
    + S8230480: check malloc/calloc results in java.desktop
    + S8230597: Update GIFlib library to the 5.2.1
    + S8230611: infinite loop in
    LogOutputList::wait_until_no_readers()
    + S8230624: [TESTBUG] Problemlist JFR
    compiler/TestCodeSweeper.java
    + S8230677: Should disable Escape Analysis if JVMTI capability
    can_get_owned_monitor_info was taken
    + S8230926: [macosx] Two apostrophes are entered instead of one
    with "U.S. International - PC" layout
    + S8231025: Incorrect method tag offset for big endian platform
    + S8231081: TestMetadataRetention fails due to missing symbol id
    + S8231387: java.security.Provider.getService returns random
    result due to race condition with mutating methods in the same
    class
    + S8231430: C2: Memory stomp in max_array_length() for
    T_ILLEGAL type
    + S8231445: check ZALLOC return values in awt coding
    + S8231507: Update Apache Santuario (XML Signature) to version
    2.1.4
    + S8231584: Deadlock with ClassLoader.findLibrary and
    System.loadLibrary call
    + S8231753: use more Posix functionality in aix
    os::print_os_info
    + S8231810: javax/net/ssl/templates/
    /SSLSocketSSLEngineTemplate.java fails intermittently with
    "java.lang.Exception: Unexpected EOF"
    + S8232003: (fs) Files.write can leak file descriptor in the
    exception case
    + S8232056: GetOwnedMonitorInfoWithEATest.java fails with ZGC:
    Heap too small
    + S8232060: add some initializations using sigemptyset in
    os_aix.cpp
    + S8232154: Update Mesa 3-D Headers to version 19.2.1
    + S8232167: Visual Studio install found through
  - -with-tools-dir value is discarded
    + S8232170: FSInfo#getJarClassPath throws an exception not
    declared in its throws clause
    + S8232200: [macos 10.15] Windows in fullscreen tests jumps
    around the screen
    + S8232207: Linux os::available_memory re-reads cgroup
    configuration on every invocation
    + S8232224: [TESTBUG] problemlist JFR TestLargeRootSet.java
    + S8232370: Refactor some com.sun.jdi tests to enable IDE
    integration
    + S8232433: [macos 10.15] java/awt/Window/
    /LocationAtScreenCorner/LocationAtScreenCorner.java may fail
    + S8232571: Add missing SIGINFO signal
    + S8232692: [TESTBUG] compiler/aot/fingerprint/
    /SelfChangedCDS.java fails when cds is disabled
    + S8232713: Update BCEL version to 6.3.1 in license file
    + S8232806: Introduce a system property to disable eager lambda
    initialization
    + S8232834: RunTest sometimes fails to produce valid
    exitcode.txt
    + S8232880: Update test documentation with additional settings
    for client UI tooltip tests
    + S8232950: SUNPKCS11 Provider incorrectly check key length for
    PSS Signatures.
    + S8233018: Add a new test to verify that DatagramSocket is not
    interruptible
    + S8233019: java.lang.Class.isPrimitive() (C1) returns wrong
    result if Klass* is aligned to 32bit
    + S8233032: assert(in_bb(n)) failed: must be
    + S8233078: fix minimal VM build on Linux ppc64(le)
    + S8233328: fix minimal VM build on Linux s390x
    + S8233383: Various minor fixes
    + S8233466: aarch64: remove unnecessary load of mdo when
    profiling return and parameters type
    + S8233491: Crash in AdapterHandlerLibrary::get_adapter with
    CDS due to code cache exhaustion
    + S8233529: loopTransform.cpp:2984: Error: assert(p_f-&gt;Opcode()
    == Op_IfFalse) failed
    + S8233548: Update CUP to v0.11b
    + S8233649: Update ProblemList.txt to exclude failing headful
    tests on macos
    + S8233656: assert(d-&gt;is_CFG() &amp;&amp; n-&gt;is_CFG()) failed: must
    have CFG nodes
    + S8233657: Intermittent NPE in Component.validate()
    + S8234288: Turkey Time Zone returns incorrect time zone name
    + S8234323: NULL-check return value of SurfaceData_InitOps on
    macosx
    + S8234339: replace JLI_StrTok in java_md_solinux.c
    + S8234340: Bump update version for OpenJDK: jdk-11.0.7
    + S8234350: assert(mode == ControlAroundStripMined &amp;&amp; (use ==
    sfpt || !use-&gt;is_reachable_from_root())) failed: missed a node
    + S8234386: [macos] NPE was thrown at expanding Choice from
    maximized frame
    + S8234397: add OS uptime information to os::print_os_info
    output
    + S8234423: Modifying ArrayList.subList().subList() resets
    modCount of subList
    + S8234466: Class loading deadlock involving
    X509Factory#commitEvent()
    + S8234501: remove obsolete NET_ReadV
    + S8234525: enable link-time section-gc for linux s390x to
    remove unused code
    + S8234610: MaxVectorSize set wrongly when UseAVX=3 is
    specified after JDK-8221092
    + S8234617: C1: Incorrect result of field load due to missing
    narrowing conversion
    + S8234723: javax/net/ssl/TLS tests support TLSv1.3
    + S8234724: javax/net/ssl/templates/
    /SSLSocketSSLEngineTemplate.java supports TLSv1.3
    + S8234741: enhance os::get_core_path on macOS
    + S8234769: Duplicate attribution in freetype.md
    + S8234786: Fix for JDK-8214578 breaks OS X 10.12 compatibility
    + S8234809: set relro in linker flags when building with gcc
    + S8234824: java/nio/channels/SocketChannel/AdaptSocket.java
    fails on Windows 10
    + S8235243: handle VS2017 15.9 and VS2019 in abstract_vm_version
    + S8235288: AVX 512 instructions inadvertently used on Xeon for
    small vector width operations
    + S8235325: build failure on Linux after 8235243
    + S8235383: C1 compilation fails with
  - XX:+PrintIRDuringConstruction -XX:+Verbose
    + S8235489: handle return values of sscanf calls in hotspot
    + S8235509: Backport for JDK-8209657 Refactor filemap.hpp to
    simplify integration with Serviceability Agent.
    + S8235510: java.util.zip.CRC32 performance drop after 8200067
    + S8235563: [TESTBUG] appcds/CommandLineFlagComboNegative.java
    does not handle archive mapping failure
    + S8235637: jhsdb jmap from OpenJDK 11.0.5 doesn't work if
    prelink is enabled
    + S8235671: enhance print_rlimit_info in os_posix
    + S8235744: PIT: test/jdk/javax/swing/text/html/
    /TestJLabelWithHTMLText.java times out in linux-x64
    + S8235904: Infinite loop when rendering huge lines
    + S8235998: [c2] Memory leaks during tracing after '8224193:
    stringStream should not use Resource Area'.
    + S8236039: JSSE Client does not accept status_request
    extension in CertificateRequest messages for TLS 1.3
    + S8236140: assert(!VerifyHashTableKeys || _hash_lock == 0)
    failed: remove node from hash table before modifying it
    + S8236179: C1 register allocation error with T_ADDRESS
    + S8236488: Support for configure option
  - -with-native-debug-symbols=internal is impossible on Windows
    + S8236500: Windows ucrt.dll should be looked up in versioned
    WINSDK subdirectory
    + S8236709: struct SwitchRange in HS violates C++ One
    Definition Rule
    + S8236848: [JDK 11u] make run-test-tier1 fails after backport
    of JDK-8232834
    + S8236873: Worker has a deadlock bug
    + S8237217: Incorrect G1StringDedupEntry type used in
    StringDedupTable destructor
    + S8237368: Problem with NullPointerException in RMI
    TCPEndpoint.read
    + S8237375: SimpleThresholdPolicy misses CounterDecay timestamp
    initialization
    + S8237508: Simplify JarFile.isInitializing
    + S8237540: Missing files in backport of JDK-8210910
    + S8237541: Missing files in backport of JDK-8236528
    + S8237600: Test SunJSSEFIPSInit fails on Ubuntu
    + S8237819: s390x - remove unused pd_zero_to_words_large
    + S8237869: exclude jtreg test security/infra/java/security/
    /cert/CertPathValidator/certification/LuxTrustCA.java because
    of instabilities
    + S8237879: make 4.3 breaks build
    + S8237945: CTW: C2 compilation fails with
    assert(just_allocated_object(alloc_ctl) == ptr) failed: most
    recent allo...
    + S8238225: Issues reported after replacing symlink at
    Contents/MacOS/libjli.dylib with binary
    + S8238247: CTW runner should sweep nmethods more aggressively
    + S8238366: CTW runner closes standard output on exit
    + S8238438: SuperWord::co_locate_pack picks memory state of
    first instead of last load
    + S8238502: sunmscapi.dll causing EXCEPTION_ACCESS_VIOLATION
    + S8238534: Deep sign macOS bundles before bundle archive is
    being created
    + S8238591: CTW: Split
    applications/ctw/modules/jdk_localedata.java
    + S8238596: AVX enabled by default for Skylake even when
    unsupported
    + S8238811: C2: assert(i &gt;= req() || i == 0 || is_Region() ||
    is_Phi()) with -XX:+VerifyGraphEdges
    + S8239005: [TESTBUG] test/hotspot/jtreg/runtime/
    /StackGuardPages/TestStackGuardPages.java: exeinvoke.c: must
    initialize static state before calling do_overflow()
    + S8239466: Loss of precision in counter decay calculation in
    11u backport of JDK-8237375
    + S8239856: [ntintel] asserts about copying unaligned array
    element
    + S8240724: [test] jdk11 downport of 8224475 misses binary file
    test/jdk/javax/swing/JTextPane/arrow.png
    + S8241296: Segfault in JNIHandleBlock::oops_do()
- Removed patch:
  * DependOnVariableHelper.patch
    + fixed upstream
- Added patch:
  * JDK-8228407.patch
    + fix crashes due to shared archive file mismatch</changelog>
  <changelog author="fstrba@suse.com" date="1594900800">- Update to upstream tag jdk-11.0.8+10 (July 2020 CPU, bsc#1174157)
  * Security fixes:
    + JDK-8230613: Better ASCII conversions
    + JDK-8231800: Better listing of arrays
    + JDK-8232014: Expand DTD support
    + JDK-8233234: Better Zip Naming
    + JDK-8233239, CVE-2020-14562: Enhance TIFF support
    + JDK-8233255: Better Swing Buttons
    + JDK-8234032: Improve basic calendar services
    + JDK-8234042: Better factory production of certificates
    + JDK-8234418: Better parsing with CertificateFactory
    + JDK-8234836: Improve serialization handling
    + JDK-8236191: Enhance OID processing
    + JDK-8236867, CVE-2020-14573: Enhance Graal interface handling
    + JDK-8237117, CVE-2020-14556: Better ForkJoinPool behavior
    + JDK-8237592, CVE-2020-14577: Enhance certificate verification
    + JDK-8238002, CVE-2020-14581: Better matrix operations
    + JDK-8238013: Enhance String writing
    + JDK-8238804: Enhance key handling process
    + JDK-8238842: AIOOBE in GIFImageReader.initializeStringTable
    + JDK-8238843: Enhanced font handing
    + JDK-8238920, CVE-2020-14583: Better Buffer support
    + JDK-8238925: Enhance WAV file playback
    + JDK-8240119, CVE-2020-14593: Less Affine Transformations
    + JDK-8240482: Improved WAV file playback
    + JDK-8241379: Update JCEKS support
    + JDK-8241522: Manifest improved jar headers redux
    + JDK-8242136, CVE-2020-14621: Better XML namespace handling
  * Other changes:
    + JDK-6933331: (d3d/ogl) java.lang.IllegalStateException:
    Buffers have not been created
    + JDK-7124307: JSpinner and changing value by mouse
    + JDK-8022574: remove HaltNode code after uncommon trap calls
    + JDK-8039082: [TEST_BUG] Test
    java/awt/dnd/BadSerializationTest/BadSerializationTest.java
    fails
    + JDK-8040630: Popup menus and tooltips flicker with previous
    popup contents when first shown
    + JDK-8044365: (dc) MulticastSendReceiveTests.java failing with
    ENOMEM when joining group (OS X 10.9)
    + JDK-8048215: [TESTBUG]
    java/lang/management/ManagementFactory/ThreadMXBeanProxy.java
    Expected non-null LockInfo
    + JDK-8051349: nsk/jvmti/scenarios/sampling/SP06/sp06t003 fails
    in nightly
    + JDK-8080353: JShell: Better error message on attempting to
    add default method
    + JDK-8139876: Exclude hanging nsk/stress/stack from execution
    with deoptimization enabled
    + JDK-8146090: java/lang/ref/ReachabilityFenceTest.java fails
    with -XX:+DeoptimizeALot
    + JDK-8153430: jdk regression test MletParserLocaleTest,
    ParserInfiniteLoopTest reduce default timeout
    + JDK-8156207: Resource allocated BitMaps are often cleared
    unnecessarily
    + JDK-8159740: JShell: corralled declarations do not have
    correct source to wrapper mapping
    + JDK-8175984: ICC_Profile has un-needed, not-empty finalize
    method
    + JDK-8176359: Frame#setMaximizedbounds not working properly in
    multi screen environments
    + JDK-8183369: RFC unconformity of HttpURLConnection with proxy
    + JDK-8187078: -XX:+VerifyOops finds numerous problems when
    running JPRT
    + JDK-8189861: Refactor CacheFind
    + JDK-8191169: java/net/Authenticator/B4769350.java failed
    intermittently
    + JDK-8191930: [Graal] emits unparseable XML into compile log
    + JDK-8193879: Java debugger hangs on method invocation
    + JDK-8196019: java/awt/Window/Grab/GrabTest.java fails on
    Windows
    + JDK-8196181: sun/java2d/GdiRendering/InsetClipping.java fails
    + JDK-8198000:
    java/awt/List/EmptyListEventTest/EmptyListEventTest.java
    debug assert on Windows
    + JDK-8198001: java/awt/Menu/WrongParentAfterRemoveMenu/
    /WrongParentAfterRemoveMenu.java debug assert on Windows
    + JDK-8198339: Test javax/swing/border/Test6981576.java is
    unstable
    + JDK-8200701: jdk/jshell/ExceptionsTest.java fails on Windows,
    after JDK-8198801
    + JDK-8203264: JNI exception pending in
    PlainDatagramSocketImpl.c:740
    + JDK-8203672: JNI exception pending in PlainSocketImpl.c
    + JDK-8203673: JNI exception pending in
    DualStackPlainDatagramSocketImpl.c:398
    + JDK-8204834: Fix confusing "allocate" naming in OopStorage
    + JDK-8205399: Set node color on pinned HashMap.TreeNode
    deletion
    + JDK-8205653: test/jdk/sun/management/jmxremote/bootstrap/
    /RmiRegistrySslTest.java and RmiSslBootstrapTest.sh fail with
    handshake_failure
    + JDK-8206179: com/sun/management/OperatingSystemMXBean/
    /GetCommittedVirtualMemorySize.java fails with Committed
    virtual memory size illegal value
    + JDK-8207334: VM times out in VM_HandshakeAllThreads::doit()
    with RunThese30M
    + JDK-8208277: Code cache heap (-XX:ReservedCodeCacheSize)
    doesn't work with 1GB LargePages
    + JDK-8209113: Use WeakReference for lastFontStrike for created
    Fonts
    + JDK-8209333: Socket reset issue for TLS 1.3 socket close
    + JDK-8209439: C2 library_call can potentially ignore Math.pow
    intrinsic or use null pointer
    + JDK-8209534: [TESTBUG]runtime/appcds/cacheObject/
    /ArchivedModuleCompareTest.java fails with EnableJVMCI.
    + JDK-8210147: adjust some WSAGetLastError usages in windows
    network coding
    + JDK-8210284: "assert((av &amp; 0x00000001) == 0) failed:
    unsupported V8" on Solaris 11.4
    + JDK-8210303: VM_HandshakeAllThreads fails assert with
    "failed: blocked and not walkable"
    + JDK-8210459: Add support for generating compile_commands.json
    + JDK-8210515: [TESTBUG]CheckArchivedModuleApp.java needs to
    check if EnableJVMCI is set.
    + JDK-8210788: Javadoc for Thread.join(long, int) should
    specify that it waits forever when both arguments are zero
    + JDK-8211301: [macos] support full window content options
    + JDK-8211332: Space for stub routines (code_size2) is too
    small on new Skylake CPUs
    + JDK-8211339: NPE during SSL handshake caused by
    HostnameChecker
    + JDK-8211392: compiler/profiling/
    /spectrapredefineclass_classloaders/Launcher.java times out
    in JDK12 CI
    + JDK-8211743: [AOT] crash in ScopeDesc::decode_body() when
    JVMTI walks AOT frames
    + JDK-8212154: [TESTBUG] CheckArchivedModuleApp fails with NPE
    when JVMCI is absent
    + JDK-8212167: JShell : Stack trace of exception has wrong line
    number
    + JDK-8212933: Thread-SMR: requesting a VM operation whilst
    holding a ThreadsListHandle can cause deadlocks
    + JDK-8212986: Make Visual Studio compiler check less strict
    + JDK-8213250: CDS archive creation aborts due to metaspace
    object allocation failure
    + JDK-8213516: jck test api/javax_accessibility/AccessibleState/
    /fields.html fails intermittent
    + JDK-8213947: ARM32: failed check_simd should set
    UsePopCountInstruction to false
    + JDK-8214418: half-closed SSLEngine status may cause
    application dead loop
    + JDK-8214440: ldap over a TLS connection negotiate failed with
    "javax.net.ssl.SSLPeerUnverifiedException: hostname of the
    server does not match the hostname in the server's
    certificate"
    + JDK-8214444: Wrong strncat limits in dfa.cpp
    + JDK-8214481: freetype path does not disable TrueType hinting
    with AA+FM hints
    + JDK-8214571: -Xdoclint of array serialField gives "error:
    array type not allowed here"
    + JDK-8214856: Errors with JSZip in web console after upgrade
    to 3.1.5
    + JDK-8214862: assert(proj != __null) at compile.cpp:3251
    + JDK-8215369: Jcstress pollute /var/tmp with temporary files.
    + JDK-8215551: Missing case label in nmethod::reloc_string_for()
    + JDK-8215555: TieredCompilation C2 threads can excessively
    block handshakes
    + JDK-8215711: Missing key_share extension for (EC)DHE key
    exchange should alert missing_extension
    + JDK-8216151: [Graal] Module
    jdk.internal.vm.compiler.management has not been granted
    accessClassInPackage.org.graalvm.compiler.debug
    + JDK-8216154: C4819 warnings at HotSpot sources on Windows
    + JDK-8216541: CompiledICHolders of VM locked unloaded nmethods
    are released too late
    + JDK-8217230: assert(t == t_no_spec) failure in
    NodeHash::check_no_speculative_types()
    + JDK-8217404: --with-jvm-features doesn't work when multiple
    features are explicitly disabled
    + JDK-8217447: Develop flag TraceICs is broken
    + JDK-8217606: LdapContext#reconnect always opens a new
    connection
    + JDK-8218807: Compilation database (compile_commands.json) may
    contain obsolete items
    + JDK-8219214: Infinite Loop in CodeSection::dump()
    + JDK-8219904: ClassCastException when calling
    FlightRecorderMXBean#getRecordings()
    + JDK-8219991: New fix of the deadlock in
    sun.security.ssl.SSLSocketImpl
    + JDK-8221121: applications/microbenchmarks are encountering
    crashes in tier5
    + JDK-8221445: FastSysexMessage constructor crashes MIDI
    receiption thread
    + JDK-8221482: Initialize VMRegImpl::regName[] earlier to
    prevent assert during PrintStubCode
    + JDK-8221741: ClassCastException can happen when
    fontconfig.properties is used
    + JDK-8221823: Requested JDialog width is ignored
    + JDK-8223108: Test java/awt/EventQueue/
    /NonComponentSourcePost.java is unstable
    + JDK-8223678: Add Visual Studio Code workspace generation
    support (for native code)
    + JDK-8223935: PIT: java/awt/font/WindowsIndicFonts.java fails
    on windows10
    + JDK-8224109: Text spaced incorrectly by drawString under
    rotation with fractional metric
    + JDK-8224632: testbug: java/awt/dnd/RemoveDropTargetCrashTest/
    /RemoveDropTargetCrashTest.java fails on MacOS
    + JDK-8224793: os::die() does not honor CreateCoredumpOnCrash
    option
    + JDK-8224847: gc/stress/TestReclaimStringsLeaksMemory.java
    fails with reserved greater than expected
    + JDK-8224931: disable JAOTC invokedynamic support until
    8223533 is fixed
    + JDK-8224997: ChaCha20-Poly1305 TLS cipher suite decryption
    throws ShortBufferException
    + JDK-8225068: Remove DocuSign root certificate that is
    expiring in May 2020
    + JDK-8225069: Remove Comodo root certificate that is expiring
    in May 2020
    + JDK-8225126: Test SetBoundsPaintTest.html faild on Windows
    when desktop is scaled
    + JDK-8225325: Add tests for redefining a class' private method
    during resolution of the bootstrap specifier
    + JDK-8225622: [AOT] runtime/SharedArchiveFile/
    /TestInterpreterMethodEntries.java crashed with AOTed
    java.base
    + JDK-8225653: Provide more information when hitting SIGILL
    from HaltNode
    + JDK-8225783: Incorrect use of binary operators on booleans in
    type.cpp
    + JDK-8225789: Empty method parameter type should generate
    ClassFormatError
    + JDK-8226198: use of &amp; instead of &amp;&amp; in
    LibraryCallKit::arraycopy_restore_alloc_state
    + JDK-8226253: JAWS reports wrong number of radio buttons when
    buttons are hidden.
    + JDK-8226653: [accessibility] Can edit text cell correctly,
    but Accessibility Tool reads nothing about editor
    + JDK-8226806: [macOS 10.14] Methods of Java Robot should be
    called from appropriate thread
    + JDK-8226879: Memory leak in Type::hashcons
    + JDK-8227632: Incorrect PrintCompilation message: made not
    compilable on levels 0 1 2 3 4
    + JDK-8228407: JVM crashes with shared archive file mismatch
    + JDK-8228482: fix xlc16/xlclang comparison of distinct pointer
    types and string literal conversion warnings
    + JDK-8228757: Fail fast if the handshake type is unknown
    + JDK-8229158: make UseSwitchProfiling non-experimental or
    false by-default
    + JDK-8229421: The logic of java/net/ipv6tests/TcpTest.java is
    flawed
    + JDK-8229855: C2 fails with assert(false) failed: bad AD file
    + JDK-8230591: AArch64: Missing intrinsics for Math.ceil,
    floor, rint
    + JDK-8231118: ARM32: Math tests failures
    + JDK-8231213: Migrate SimpleDateFormatConstTest to JDK Repo
    + JDK-8231243: [TESTBUG] CustomFont.java cannot find font file
    + JDK-8231438: [macOS] Dark mode for the desktop is not
    supported
    + JDK-8231550: C2: ShouldNotReachHere() in
    verify_strip_mined_scheduling
    + JDK-8231564: setMaximizedBounds is broken with large display
    scale and multiple monitors
    + JDK-8231572: Use -lobjc instead of -fobjc-link-runtime in
    libosxsecurity
    + JDK-8231631: sun/net/ftp/FtpURLConnectionLeak.java fails
    intermittently with NPE
    + JDK-8231671: Fix copyright headers in hotspot (missing comma
    after year)
    + JDK-8231720: Some perf regressions after 8225653
    + JDK-8231779: crash
    HeapWord*ParallelScavengeHeap::failed_mem_allocate
    + JDK-8231863: Crash if classpath is read from @argument file
    and the main gets option argument
    + JDK-8232080: jlink plugins for vendor information and
    run-time options
    + JDK-8232106: [x86] C2: SIGILL due to usage of SSSE3
    instructions on processors which don't support it
    + JDK-8232134: Change to Visual Studio 2017 15.9.16 for
    building on Windows at Oracle
    + JDK-8232226: [macos 10.15] test/jdk/java/awt/color/
    /EqualityTest/EqualityTest.java may fail
    + JDK-8232357: Compare version info of Santuario to legal notice
    + JDK-8232572: Add hooks for custom output dir in Bundles.gmk
    + JDK-8232634: Problem List ICMColorDataTest.java
    + JDK-8232748: Build static versions of certain JDK libraries
    + JDK-8232846: ProcessHandle.Info command with non-English
    shows question marks
    + JDK-8232880: Update test documentation with additional
    settings for client UI tooltip tests
    + JDK-8233033: C2 produces wrong result while unswitching a
    loop due to lost control dependencies
    + JDK-8233137: runtime/ErrorHandling/VeryEarlyAssertTest.java
    fails after 8232080
    + JDK-8233197: Invert JvmtiExport::post_vm_initialized() and
    Jfr:on_vm_start() start-up order for correct option parsing
    + JDK-8233291: [TESTBUG] tools/jlink/plugins/
    /VendorInfoPluginsTest.java fails with debug or non-server VMs
    + JDK-8233364: Fix undefined behavior in
    Canonicalizer::do_ShiftOp
    + JDK-8233494: Avoid calling MallocTracker::record_malloc and
    record_free when NMT is off
    + JDK-8233573: Toolkit.getScreenInsets(GraphicsConfiguration)
    may throw ClassCastException
    + JDK-8233608: Minimal build broken after JDK-8233494
    + JDK-8233621: Mismatch in jsse.enableMFLNExtension property
    name
    + JDK-8233696: [TESTBUG]Some jtreg tests fail when CAPS_LOCK is
    ON
    + JDK-8233707: systemScale.cpp could not compile with VS2019
    + JDK-8233801: GCMEmptyIv.java test fails on Solaris 11.4
    + JDK-8233880: Support compilers with multi-digit major version
    numbers
    + JDK-8233920: MethodHandles::tryFinally generates illegal
    bytecode for long/double return type
    + JDK-8234137: The "AutoTestOnTop.java" test may run external
    applications
    + JDK-8234146: compiler/jsr292/
    /ContinuousCallSiteTargetChange.java times out on SPARC
    + JDK-8234184: [TESTBUG] java/awt/Mouse/EnterExitEvents/
    /ModalDialogEnterExitEventsTest.java fails in Windows
    + JDK-8234270: [REDO] JDK-8204128 NMT might report incorrect
    numbers for Compiler area
    + JDK-8234332: [TESTBUG] java/awt/Focus/DisposedWindow/
    /DisposeDialogNotActivateOwnerTest/
    /DisposeDialogNotActivateOwnerTest.java fails on linux-x64
    nightly
    + JDK-8234398: Replace ID2D1Factory::GetDesktopDpi with
    GetDeviceCaps
    + JDK-8234522: [macos] Crash with use of native file dialog
    + JDK-8234691: Potential double-free in ParallelSPCleanupTask
    constructor
    + JDK-8234696: tools/jlink/plugins/VendorInfoPluginsTest.java
    times out
    + JDK-8234727: sun/security/ssl/X509TrustManagerImpl tests
    support TLSv1.3
    + JDK-8234728: Some security tests should support TLSv1.3
    + JDK-8234779: Provide idiom for declaring classes noncopyable
    + JDK-8234824: java/nio/channels/SocketChannel/AdaptSocket.java
    fails on Windows 10
    + JDK-8234968: check calloc rv in libinstrument
    InvocationAdapter
    + JDK-8235153: [TESTBUG] [macos 10.15] java/awt/Graphics/
    /DrawImageBG/SystemBgColorTest.java fails
    + JDK-8235183: Remove the "HACK CODE" in comment
    + JDK-8235263: Revert TLS 1.3 change that wrapped IOExceptions
    + JDK-8235311: Tag mismatch may alert bad_record_mac
    + JDK-8235332: TestInstanceCloneAsLoadsStores.java fails with
  - XX:+StressGCM
    + JDK-8235452: Strip mined loop verification fails with
    assert(is_OuterStripMinedLoop()) failed: invalid node class
    + JDK-8235584: UseProfiledLoopPredicate fails with
    assert(_phase-&gt;get_loop(c) == loop) failed: have to be in the
    same loop
    + JDK-8235620: Broken merge between JDK-8006406 and JDK-8003559
    + JDK-8235638: NPE in LWWindowPeer.getOnscreenGraphics()
    + JDK-8235686: Add more custom hooks in Bundles.gmk
    + JDK-8235739: Rare NPE at WComponentPeer.getGraphics()
    + JDK-8235762: JVM crash in SWPointer during C2 compilation
    + JDK-8235834: IBM-943 charset encoder needs updating
    + JDK-8235874: The ordering of Cipher Suites is not maintained
    provided through jdk.tls.client.cipherSuites and
    jdk.tls.server.cipherSuites system property.
    + JDK-8235908: omit ThreadPriorityPolicy warning when value is
    set from image
    + JDK-8235984: C2: assert(out-&gt;in(PhiNode::Region) == head ||
    out-&gt;in(PhiNode::Region) == slow_head) failed: phi must be
    either part of the slow or the fast loop
    + JDK-8236211: [Graal] compiler/graalunit/GraphTest.java is
    skipped in all testing
    + JDK-8236470: Deal with ECDSA using ecdsa-with-SHA2 plus hash
    algorithm as AlgorithmId
    + JDK-8236545: Compilation error in mach5
    java/awt/FileDialog/MacOSGoToFolderCrash.java
    + JDK-8236700: Upgrading JSZip from v3.1.5 to v3.2.2
    + JDK-8236759: ShouldNotReachHere in
    PhaseIdealLoop::verify_strip_mined_scheduling
    + JDK-8236897: Fix the copyright header for pkcs11gcm2.h
    + JDK-8236921: Add build target to produce a JDK image suitable
    for a Graal/SVM build
    + JDK-8236953: [macos] JavaFX SwingNode is not rendered on macOS
    + JDK-8236996: Incorrect Roboto font rendering on Windows with
    subpixel antialiasing
    + JDK-8237045: JVM uses excessive memory with -XX:+EnableJVMCI
  - XX:JVMCICounterSize=2147483648
    + JDK-8237055: [TESTBUG] compiler/c2/TestJumpTable.java fails
    with release VMs
    + JDK-8237086: assert(is_MachReturn()) running CTW with fix for
    JDK-8231291
    + JDK-8237192: Generate stripped/public pdbs on Windows for jdk
    images
    + JDK-8237396: JvmtiTagMap::weak_oops_do() should not trigger
    barriers
    + JDK-8237474: Default SSLEngine should create in server role
    + JDK-8237859: C2: Crash when loads float above range check
    + JDK-8237879: make 4.3 breaks build
    + JDK-8237951: CTW: C2 compilation fails with "malformed
    control flow"
    + JDK-8237962: give better error output for invalid OCSP
    response intervals in CertPathValidator checks
    + JDK-8238190: [JVMCI] Fix single implementor speculation for
    diamond shapes.
    + JDK-8238356: CodeHeap::blob_count() overestimates the number
    of blobs
    + JDK-8238452: Keytool generates wrong expiration date if
    validity is set to 2050/01/01
    + JDK-8238555: Allow Initialization of SunPKCS11 with NSS when
    there are external FIPS modules in the NSSDB
    + JDK-8238575: DragSourceEvent.getLocation() returns wrong
    value on HiDPI screens (Windows)
    + JDK-8238676: jni crashes on accessing it from process exit
    hook
    + JDK-8238721: Add failing client jtreg tests to the Problem
    List
    + JDK-8238738: AudioSystem.getMixerInfo() takes about 30 sec to
    report a gone audio device
    + JDK-8238756: C2: assert(((n) == __null || !VerifyIterativeGVN
    || !((n)-&gt;is_dead()))) failed: can not use dead node
    + JDK-8238765: PhaseCFG::schedule_pinned_nodes cannot handle
    precedence edges from unmatched CFG nodes correctly
    + JDK-8238898: Missing hash characters for header on license
    file
    + JDK-8238942: Rendering artifacts with LCD text and fractional
    metrics
    + JDK-8238985: [TESTBUG] The arrow image is blue instead of
    green
    + JDK-8239000: handle ContendedPaddingWidth in vm_version_ppc
    + JDK-8239055: Wrong implementation of VMState.hasListener
    + JDK-8239091: Reversed arguments in call to strstr in freetype
    "debug" code.
    + JDK-8239142: C2's UseUniqueSubclasses optimization is broken
    for array accesses
    + JDK-8239224: libproc_impl.c previous_thr may be used
    uninitialized warning
    + JDK-8239351: Give more meaningful InternalError messages in
    Deflater.c
    + JDK-8239365: ProcessBuilder test modifications for AIX
    execution
    + JDK-8239456: vtable stub generation: assert failure (code
    size estimate)
    + JDK-8239457: call ReleaseStringUTFChars before early returns
    in Java_sun_security_pkcs11_wrapper_PKCS11_connect
    + JDK-8239462: jdk.hotspot.agent misses some
    ReleaseStringUTFChars calls in case of early returns
    + JDK-8239557: [TESTBUG] VeryEarlyAssertTest.java validating
    "END." marker at lastline is not always true
    + JDK-8239787: AArch64: String.indexOf may incorrectly handle
    empty strings
    + JDK-8239792: Bump update version for OpenJDK: jdk-11.0.8
    + JDK-8239798: SSLSocket closes socket both socket endpoints on
    a SocketTimeoutException
    + JDK-8239819: XToolkit: Misread of screen information memory
    + JDK-8239852: java/util/concurrent tests fail with
  - XX:+VerifyGraphEdges: assert(!VerifyGraphEdges) failed:
    verification should have failed
    + JDK-8239893: Windows handle Leak when starting processes
    using ProcessBuilder
    + JDK-8239915: Zero VM crashes when handling dynamic constant
    + JDK-8239931: [win][x86] vtable stub generation: assert
    failure (code size estimate) follow-up
    + JDK-8239965: XMLEncoder/Test4625418.java fails due to "Error:
    Cp943 - can't read properly"
    + JDK-8239976: Put JDK-8239965 on the ProblemList.txt
    + JDK-8240073: Fix 'test-make' build target in 11u
    + JDK-8240197: Cannot start JVM when $JAVA_HOME includes CJK
    characters
    + JDK-8240202: A few client tests leave mouse buttons pressed
    + JDK-8240220: IdealLoopTree::dump_head predicate printing is
    broken
    + JDK-8240223: Use consistent predicate order in and with
    PhaseIdealLoop::find_predicate
    + JDK-8240227: Loop predicates should be copied to unswitched
    loops
    + JDK-8240286: [TESTBUG] Test command error in hotspot/jtreg/
    /compiler/loopopts/superword/SumRedAbsNeg_Float.java
    + JDK-8240518: Incorrect JNU_ReleaseStringPlatformChars in
    Windows Print
    + JDK-8240529: CheckUnhandledOops breaks NULL check in
    Modules::define_module
    + JDK-8240576: JVM crashes after transformation in C2
    IdealLoopTree::merge_many_backedges
    + JDK-8240603: Windows 32bit compile error after 8238676
    + JDK-8240629: argfiles parsing broken for argfiles with
    comment cross 4096 bytes chunk
    + JDK-8240711: TestJstatdPort.java failed due to
    "ExportException: Port already in use:"
    + JDK-8240786: [TESTBUG] The test java/awt/Window/
    /GetScreenLocation/GetScreenLocationTest.java fails on HiDPI
    screen
    + JDK-8240824: enhance print_full_memory_info on Linux by THP
    related information
    + JDK-8240827: Downport SSLSocketImpl.java from "8221882: Use
    fiber-friendly java.util.concurrent.locks in JSSE"
    + JDK-8240905: assert(mem == (Node*)1 || mem == mem2) failed:
    multiple Memories being matched at once?
    + JDK-8240972: macOS codesign fail on macOS 10.13.5 or older
    + JDK-8241445: Fix copyright in
    test/jdk/tools/launcher/ArgFileSyntax.java
    + JDK-8241458: [JVMCI] add mark value to expose
    CodeOffsets::Frame_Complete
    + JDK-8241464: [11u] Backport: make rehashing be a needed
    guaranteed safepoint cleanup action
    + JDK-8241556: Memory leak if -XX:CompileCommand is set
    + JDK-8241568: (fs) UserPrincipalLookupService.lookupXXX
    failure with IOE "Operation not permitted"
    + JDK-8241586: compiler/cpuflags/
    /TestAESIntrinsicsOnUnsupportedConfig.java fails on aarch64
    + JDK-8241638: launcher time metrics always report 1 on Linux
    when _JAVA_LAUNCHER_DEBUG set
    + JDK-8241660: Add virtualization information output to hs_err
    file on macOS
    + JDK-8241808: [TESTBUG] The JDK-8039467 bug appeared on macOS
    + JDK-8241888: Mirror jdk.security.allowNonCaAnchor system
    property with a security one
    + JDK-8241900: Loop unswitching may cause dependence on null
    check to be lost
    + JDK-8241948: enhance list of environment variables printed in
    hs_err file
    + JDK-8241996: on linux set full relro in the linker flags
    + JDK-8242108: Performance regression after fix for JDK-8229496
    + JDK-8242141: New System Properties to configure the TLS
    signature schemes
    + JDK-8242154: Backport parts of JDK-4947890 to OpenJDK 11u
    + JDK-8242174: [macos] The NestedModelessDialogTest test make
    the macOS unstable
    + JDK-8242239: [Graal] javax/management/generified/
    /GenericTest.java fails: FAILED: queryMBeans sets same
    + JDK-8242294: JSSE Client does not throw SSLException when an
    alert occurs during handshaking
    + JDK-8242379: [TESTBUG] compiler/loopopts/
    /TestLoopUnswitchingLostCastDependency.java fails with
    release VMs
    + JDK-8242470: Update Xerces to Version 2.12.1
    + JDK-8242498: Invalid "sun.awt.TimedWindowEvent" object leads
    to JVM crash
    + JDK-8242541: Small charset issues (ISO8859-16, x-eucJP-Open,
    x-IBM834 and x-IBM949C)
    + JDK-8242626: enhance posix print_rlimit_info
    + JDK-8243059: Build fails when --with-vendor-name contains a
    comma
    + JDK-8243539: Copyright info (Year) should be updated for fix
    of 8241638
    + JDK-8243541: (tz) Upgrade time-zone data to tzdata2020a
    + JDK-8244407: JVM crashes after transformation in C2
    IdealLoopTree::split_fall_in
    + JDK-8244520: problemlist
    java/awt/font/Rotate/RotatedFontTest.java on linux
    + JDK-8244777: ClassLoaderStats VM Op uses constant hash value
    + JDK-8244853: The static build of libextnet is missing the
    JNI_OnLoad_extnet function
    + JDK-8244951: Missing entitlements for hardened runtime
    + JDK-8245047: [PPC64] C2: ReverseBytes + Load always match to
    unordered Load (acquire semantics missing)
    + JDK-8245649: Revert 8245397 backport of 8230591
    + JDK-8246031: SSLSocket.getSession() doesn't close connection
    for timeout/ interrupts
    + JDK-8246613: Choose the default SecureRandom algo based on
    registration ordering
    + JDK-8248505: Unexpected NoSuchAlgorithmException when using
    secure random impl from BCFIPS provider
- Removed patch:
  * JDK-8228407.patch
    + integrated upstream</changelog>
  <changelog author="fstrba@suse.com" date="1604318400">- Update to upstream tag jdk-11.0.9-11 (October 2020 CPU,
  bsc#1177943)
  * New features
    + JDK-8250784: Shenandoah: A Low-Pause-Time Garbage Collector
  * Security fixes
    + JDK-8233624: Enhance JNI linkage
    + JDK-8236196: Improve string pooling
    + JDK-8236862, CVE-2020-14779: Enhance support of Proxy class
    + JDK-8237990, CVE-2020-14781: Enhanced LDAP contexts
    + JDK-8237995, CVE-2020-14782: Enhance certificate processing
    + JDK-8240124: Better VM Interning
    + JDK-8241114, CVE-2020-14792: Better range handling
    + JDK-8242680, CVE-2020-14796: Improved URI Support
    + JDK-8242685, CVE-2020-14797: Better Path Validation
    + JDK-8242695, CVE-2020-14798: Enhanced buffer support
    + JDK-8243302: Advanced class supports
    + JDK-8244136, CVE-2020-14803: Improved Buffer supports
    + JDK-8244479: Further constrain certificates
    + JDK-8244955: Additional Fix for JDK-8240124
    + JDK-8245407: Enhance zoning of times
    + JDK-8245412: Better class definitions
    + JDK-8245417: Improve certificate chain handling
    + JDK-8248574: Improve jpeg processing
    + JDK-8249927: Specify limits of jdk.serialProxyInterfaceLimit
    + JDK-8253019: Enhanced JPEG decoding
  * Other changes
    + JDK-6532025: GIF reader throws misleading exception with
    truncated images
    + JDK-6949753: [TEST BUG]: java/awt/print/PageFormat/
    /PDialogTest.java needs update by removing an infinite loop
    + JDK-8022535: [TEST BUG] javax/swing/text/html/parser/
    /Test8017492.java fails
    + JDK-8062947: Fix exception message to correctly represent
    LDAP connection failure
    + JDK-8067354: com/sun/jdi/GetLocalVariables4Test.sh failed
    + JDK-8134599: TEST_BUG: java/rmi/transport/closeServerSocket/
    /CloseServerSocket.java fails intermittently with Address
    already in use
    + JDK-8151678: com/sun/jndi/ldap/LdapTimeoutTest.java failed
    due to timeout on DeadServerNoTimeoutTest is incorrect
    + JDK-8160768: Add capability to custom resolve host/domain
    names within the default JNDI LDAP provider
    + JDK-8172404: Tools should warn if weak algorithms are used
    before restricting them
    + JDK-8193367: Annotated type variable bounds crash javac
    + JDK-8202117: com/sun/jndi/ldap/RemoveNamingListenerTest.java
    fails intermittently: Connection reset
    + JDK-8203026: java.rmi.NoSuchObjectException: no such object
    in table
    + JDK-8203281: [Windows] JComboBox change in ui when
    editor.setBorder() is called
    + JDK-8203382: Rename SystemDictionary::initialize_wk_klass to
    resolve_wk_klass
    + JDK-8203393: com/sun/jdi/JdbMethodExitTest.sh and
    JdbExprTest.sh fail due to timeout
    + JDK-8203928: [Test] Convert non-JDB scaffolding
    serviceability shell script tests to java
    + JDK-8204963: javax.swing.border.TitledBorder has a memory leak
    + JDK-8204994: SA might fail to attach to process with "Windbg
    Error: WaitForEvent failed"
    + JDK-8205534: Remove SymbolTable dependency from
    serviceability agent
    + JDK-8206309: Tier1 SA tests fail
    + JDK-8208281: java/nio/channels/
    /AsynchronousSocketChannel/Basic.java timed out
    + JDK-8209109: [TEST] rewrite com/sun/jdi shell tests to java
    version - step1
    + JDK-8209332: [TEST] test/jdk/com/sun/jdi/CatchPatternTest.sh
    is incorrect
    + JDK-8209342: Problemlist SA tests on Solaris due to Error
    attaching to process: Can't create thread_db agent!
    + JDK-8209343: Test javax/swing/border/TestTitledBorderLeak.java
    should be marked as headful
    + JDK-8209517: com/sun/jdi/BreakpointWithFullGC.java fails with
    timeout
    + JDK-8209604: [TEST] rewrite com/sun/jdi shell tests to java
    version - step2
    + JDK-8209605: com/sun/jdi/BreakpointWithFullGC.java fails with
    ZGC
    + JDK-8209608: Problem list com/sun/jdi/BreakpointWithFullGC.java
    + JDK-8210131: vmTestbase/nsk/jvmti/scenarios/allocation/AP10/
    /ap10t001/TestDescription.java failed with ObjectFree:
    GetCurrentThreadCpuTimerInfo returned unexpected error code
    + JDK-8210243: [TEST] rewrite com/sun/jdi shell tests to java
    version - step3
    + JDK-8210527: JShell: NullPointerException in
    jdk.jshell.Eval.translateExceptionStack
    + JDK-8210560: [TEST] convert com/sun/jdi redefineClass-related
    tests
    + JDK-8210725: com/sun/jdi/RedefineClearBreakpoint.java fails
    with waitForPrompt timed out after 60 seconds
    + JDK-8210748: [TESTBUG] lib.jdb.Jdb.waitForPrompt() should
    clarify which output is the pending reply after a timeout
    + JDK-8210760: [TEST] rewrite com/sun/jdi shell tests to java
    version - step4
    + JDK-8210977: jdk/jfr/event/oldobject/TestThreadLocalLeak.java
    fails to find ThreadLocalObject
    + JDK-8211292: [TEST] convert com/sun/jdi/DeferredStepTest.sh
    test
    + JDK-8211694: JShell: Redeclared variable should be reset
    + JDK-8212200: assert when shared java.lang.Object is redefined
    by JVMTI agent
    + JDK-8212629: [TEST] wrong breakpoint in
    test/jdk/com/sun/jdi/DeferredStepTest
    + JDK-8212665: com/sun/jdi/DeferredStepTest.java: jj1 (line 57)
  - unexpected. lastLine=52, minLine=52, maxLine=55
    + JDK-8212807: tools/jar/multiRelease/Basic.java times out
    + JDK-8213182: Minimal VM build failure after JDK-8212200
    (assert when shared java.lang.Object is redefined by JVMTI
    agent)
    + JDK-8213214: Set -Djava.io.tmpdir= when running tests
    + JDK-8213275: ReplaceCriticalClasses.java fails with
    jdk.internal.vm.PostVMInitHook not found
    + JDK-8213574: Deadlock in string table expansion when dumping
    lots of CDS classes
    + JDK-8213703: LambdaConversionException: Invalid receiver type
    not a subtype of implementation type interface
    + JDK-8214074: Ghash optimization using AVX instructions
    + JDK-8214491: Upgrade to JLine 3.9.0
    + JDK-8214797: TestJmapCoreMetaspace.java timed out
    + JDK-8215243: JShell tests failing intermitently with
    "Problem cleaning up the following threads:"
    + JDK-8215244: jdk/jshell/ToolBasicTest.java
    testHistoryReference failed
    + JDK-8215354: x86_32 build failures after JDK-8214074 (Ghash
    optimization using AVX instructions)
    + JDK-8215438: jshell tool: Ctrl-D causes EOF
    + JDK-8216021: RunTest.gmk might set concurrency level to 1 on
    Windows
    + JDK-8216974: HttpConnection not returned to the pool after
    204 response
    + JDK-8218948: SimpleDateFormat :: format - Zone Names are not
    reflected correctly during run time
    + JDK-8219712: code_size2 (defined in stub_routines_x86.hpp) is
    too small on new Skylake CPUs
    + JDK-8220150: macos10.14 Mojave returns anti-aliased glyphs
    instead of aliased B&amp;W glyphs
    + JDK-8221658: aarch64: add necessary predicate for ubfx
    patterns
    + JDK-8221759: Crash when completing "java.io.File.path"
    + JDK-8221918: runtime/SharedArchiveFile/serviceability/
    /ReplaceCriticalClasses.java fails: Shared archive not found
    + JDK-8222074: Enhance auto vectorization for x86
    + JDK-8222079: Don't use memset to initialize fields decode_env
    constructor in disassembler.cpp
    + JDK-8222769: [TESTBUG] TestJFRNetworkEvents should not rely
    on hostname command
    + JDK-8223688: JShell: crash on the instantiation of raw
    anonymous class
    + JDK-8223777: In posix_spawn mode, failing to exec()
    jspawnhelper does not result in an error
    + JDK-8223940: Private key not supported by chosen signature
    algorithm
    + JDK-8224184: jshell got IOException at exiting with AIX
    + JDK-8224234: compiler/codegen/TestCharVect2.java fails in
    test_mulc
    + JDK-8225037: java.net.JarURLConnection::getJarEntry() throws
    NullPointerException
    + JDK-8225625: AES Electronic Codebook (ECB) encryption and
    decryption optimization using AVX512 + VAES instructions
    + JDK-8226536: Catch OOM from deopt that fails rematerializing
    objects
    + JDK-8226575: OperatingSystemMXBean should be made container
    aware
    + JDK-8226697: Several tests which need the @key headful
    keyword are missing it.
    + JDK-8226809: Circular reference in printed stack trace is not
    correctly indented &amp; ambiguous
    + JDK-8227059: sun/security/tools/keytool/
    /DefaultSignatureAlgorithm.java timed out
    + JDK-8227269: Slow class loading when running with JDWP
    + JDK-8227595: keytool/fakegen/DefaultSignatureAlgorithm.java
    fails due to "exitValue = 6"
    + JDK-8228448: Jconsole can't connect to itself
    + JDK-8228967: Trust/Key store and SSL context utilities for
    tests
    + JDK-8229378: jdwp library loader in linker_md.c quietly
    truncates on buffer overflow
    + JDK-8229815: Upgrade Jline to 3.12.1
    + JDK-8230000: some httpclients testng tests run zero test
    + JDK-8230002: javax/xml/jaxp/unittest/transform/
    /SecureProcessingTest.java runs zero test
    + JDK-8230010: Remove jdk8037819/BasicTest1.java
    + JDK-8230094: CCE in createXMLEventWriter(Result) over an
    arbitrary XMLStreamWriter
    + JDK-8230402: Allocation of compile task fails with assert:
    "Leaking compilation tasks?"
    + JDK-8230767: FlightRecorderListener returns null recording
    + JDK-8230870: (zipfs) Add a ZIP FS test that is similar to
    test/jdk/java/util/zip/EntryCount64k.java
    + JDK-8231209: [REDO] ThreadMXBean::getThreadAllocatedBytes()
    can be quicker for self thread
    + JDK-8231586: enlarge encoding space for OopMapValue offsets
    + JDK-8231953: Wrong assumption in assertion in
    oop::register_oop
    + JDK-8231968: getCurrentThreadAllocatedBytes default
    implementation s/b getThreadAllocatedBytes
    + JDK-8232083: Minimal VM is broken after JDK-8231586
    + JDK-8232161: Align some one-way conversion in MS950 charset
    with Windows
    + JDK-8232855: jshell missing word in /help help
    + JDK-8233027: OopMapSet::all_do does oms.next() twice during
    iteration
    + JDK-8233228: Disable weak named curves by default in TLS,
    CertPath, and Signed JAR
    + JDK-8233386: Initialize NULL fields for unused decorations
    + JDK-8233452: java.math.BigDecimal.sqrt() with
    RoundingMode.FLOOR results in incorrect result
    + JDK-8233686: XML transformer uses excessive amount of memory
    + JDK-8233741: AES Countermode (AES-CTR) optimization using
    AVX512 + VAES instructions
    + JDK-8233829: javac cannot find non-ASCII module name under
    non-UTF8 environment
    + JDK-8233958: Memory retention due to HttpsURLConnection
    finalizer that serves no purpose
    + JDK-8234011: (zipfs) Memory leak in
    ZipFileSystem.releaseDeflater()
    + JDK-8234058: runtime/CompressedOops/
    /CompressedClassPointers.java fails with 'Narrow klass base:
    0x0000000000000000' missing from stdout/stderr
    + JDK-8234149: Several regression tests do not dispose Frame at
    end
    + JDK-8234347: "Turkey" meta time zone does not generate
    composed localized names
    + JDK-8234385: [TESTBUG] java/awt/EventQueue/6980209/
    /bug6980209.java fails in linux nightly
    + JDK-8234535: Cross compilation fails due to missing CFLAGS
    for the BUILD_CC
    + JDK-8234541: C1 emits an empty message when it inlines
    successfully
    + JDK-8234687: change javap reporting on unknown attributes
    + JDK-8236464: SO_LINGER option is ignored by SSLSocket in JDK
    11
    + JDK-8236548: Localized time zone name inconsistency between
    English and other locales
    + JDK-8236617: jtreg test containers/docker/
    /TestMemoryAwareness.java fails after 8226575
    + JDK-8237182: Update copyright header for shenandoah and
    epsilon files
    + JDK-8237888: security/infra/java/security/cert/
    /CertPathValidator/certification/LuxTrustCA.java fails when
    checking validity interval
    + JDK-8237977: Further update
    javax/net/ssl/compatibility/Compatibility.java
    + JDK-8238270: java.net HTTP/2 client does not decrease stream
    count when receives 204 response
    + JDK-8238284: [macos] Zero VM build fails due to an obvious
    typo
    + JDK-8238380: java.base/unix/native/libjava/childproc.c
    "multiple definition" link errors with GCC10
    + JDK-8238386: (sctp) jdk.sctp/unix/native/libsctp/SctpNet.c
    "multiple definition" link errors with GCC10
    + JDK-8238388: libj2gss/NativeFunc.o "multiple definition" link
    errors with GCC10
    + JDK-8238448: RSASSA-PSS signature verification fail when
    using certain odd key sizes
    + JDK-8238710: LingeredApp doesn't log stdout/stderr if exits
    with non-zero code
    + JDK-8239083: C1 assert(known_holder == NULL ||
    (known_holder-&gt;is_instance_klass() &amp;&amp;
    (!known_holder-&gt;is_interface() ||
    ((ciInstanceKlass*)known_holder)-&gt;has_nonstatic_concrete_methods())),
    "should be non-static concrete method");
    + JDK-8239385: KerberosTicket client name refers wrongly to
    sAMAccountName in AD
    + JDK-8240169: javadoc fails to link to non-modular api docs
    + JDK-8240295: hs_err elapsed time in seconds is not accurate
    enough
    + JDK-8240360: NativeLibraryEvent has wrong library name on
    Linux
    + JDK-8240676: Meet not symmetric failure when running lucene
    on jdk8
    + JDK-8241007: Shenandoah: remove
    ShenandoahCriticalControlThreadPriority support
    + JDK-8241065: Shenandoah: remove leftover code after
    JDK-8231086
    + JDK-8241086: Test runtime/NMT/HugeArenaTracking.java is
    failing on 32bit Windows
    + JDK-8241130: com.sun.jndi.ldap.EventSupport.removeDeadNotifier:
    java.lang.NullPointerException
    + JDK-8241138: http.nonProxyHosts=* causes
    StringIndexOutOfBoundsException in DefaultProxySelector
    + JDK-8241319: WB_GetCodeBlob doesn't have ResourceMark
    + JDK-8241478: vmTestbase/gc/gctests/Steal/steal001/steal001.java
    fails with OOME
    + JDK-8241574: Shenandoah: remove ShenandoahAssertToSpaceClosure
    + JDK-8241750: x86_32 build failure after JDK-8227269
    + JDK-8242184: CRL generation error with RSASSA-PSS
    + JDK-8242283: Can't start JVM when java home path includes
    non-ASCII character
    + JDK-8242556: Cannot load RSASSA-PSS public key with non-null
    params from byte array
    + JDK-8243029: Rewrite javax/net/ssl/compatibility/
    /Compatibility.java with a flexible interop test framework
    + JDK-8243138: Enhance BaseLdapServer to support starttls
    extended request
    + JDK-8243320: Add SSL root certificates to Oracle Root CA
    program
    + JDK-8243321: Add Entrust root CA - G4 to Oracle Root CA
    program
    + JDK-8243389: enhance os::pd_print_cpu_info on linux
    + JDK-8243453: java --describe-module failed with non-ASCII
    module name under non-UTF8 environment
    + JDK-8243470: [macos] bring back O2 opt level for unsafe.cpp
    + JDK-8243489: Thread CPU Load event may contain wrong data for
    CPU time under certain conditions
    + JDK-8243925: Toolkit#getScreenInsets() returns wrong value on
    HiDPI screens (Windows)
    + JDK-8244087: 2020-04-24 public suffix list update
    + JDK-8244151: Update MUSCLE PC/SC-Lite headers to the latest
    release 1.8.26
    + JDK-8244164: AArch64: jaotc generates incorrect code for
    compressed OOPs with non-zero heap base
    + JDK-8244196: adjust output in os_linux
    + JDK-8244225: stringop-overflow warning on strncpy call from
    compile_the_world_in
    + JDK-8244287: JFR: Methods samples have line number 0
    + JDK-8244703: "platform encoding not initialized" exceptions
    with debugger, JNI
    + JDK-8244719: CTW: C2 compilation fails with
    "assert(!VerifyHashTableKeys || _hash_lock == 0) failed:
    remove node from hash table before modifying it"
    + JDK-8244729: Shenandoah: remove resolve paths from
    SBSA::generate_shenandoah_lrb
    + JDK-8244763: Update --release 8 symbol information after JSR
    337 MR3
    + JDK-8244818: Java2D Queue Flusher crash while moving
    application window to external monitor
    + JDK-8245151: jarsigner should not raise duplicate warnings on
    verification
    + JDK-8245616: Bump update version for OpenJDK: jdk-11.0.9
    + JDK-8245714: "Bad graph detected in build_loop_late" when
    loads are pinned on loop limit check uncommon branch
    + JDK-8245801: StressRecompilation triggers assert "redundunt
    OSR recompilation detected. memory leak in CodeCache!"
    + JDK-8245832: JDK build make-static-libs should build all JDK
    libraries
    + JDK-8245880: Shenandoah: check class unloading flag early in
    concurrent code root scan
    + JDK-8245981: Upgrade to jQuery 3.5.1
    + JDK-8246027: Minimal fastdebug build broken after JDK-8245801
    + JDK-8246094: [macos] Sound Recording and playback is not
    working
    + JDK-8246153: TestEliminateArrayCopy fails with
  - XX:+StressReflectiveCode
    + JDK-8246193: Possible NPE in ENC-PA-REP search in AS-REQ
    + JDK-8246196: javax/management/MBeanServer/OldMBeanServerTest
    fails with AssertionError
    + JDK-8246203: Segmentation fault in verification due to stack
    overflow with -XX:+VerifyIterativeGVN
    + JDK-8246330: Add TLS Tests for Legacy ECDSA curves
    + JDK-8246453: TestClone crashes with "all collected exceptions
    must come from the same place"
    + JDK-8247246: Add explicit ResolvedJavaType.link and expose
    presence of default methods
    + JDK-8247350: [aarch64] assert(false) failed: wrong size of
    mach node
    + JDK-8247502: PhaseStringOpts crashes while optimising
    effectively dead code
    + JDK-8247615: Initialize the bytes left for the heap sampler
    + JDK-8247824: CTW: C2 (Shenandoah) compilation fails with SEGV
    in SBC2Support::pin_and_expand
    + JDK-8247874: Replacement in VersionProps.java.template not
    working when --with-vendor-bug-url contains '&amp;'
    + JDK-8247979: aarch64: missing side effect of killing flags
    for clearArray_reg_reg
    + JDK-8248214: Add paddings for TaskQueueSuper to reduce
    false-sharing cache contention
    + JDK-8248219: aarch64: missing memory barrier in
    fast_storefield and fast_accessfield
    + JDK-8248348: Regression caused by the update to BCEL 6.0
    + JDK-8248385: [testbug][11u] Adapt TestInitiExceptions to
    jtreg 5.1
    + JDK-8248495: [macos] zerovm is broken due to libffi headers
    location
    + JDK-8248851: CMS: Missing memory fences between free chunk
    check and klass read
    + JDK-8248987: AOT's Linker.java seems to eagerly fail-fast on
    Windows
    + JDK-8249159: Downport test rework for SSLSocketTemplate from
    8224650
    + JDK-8249215: JFrame::setVisible crashed with
  - Dfile.encoding=UTF-8 on Japanese Windows.
    + JDK-8249251: [dark_mode ubuntu 20.04] The selected menu is
    not highlighted in GTKLookAndFeel
    + JDK-8249255: Build fails if source code in cygwin home dir
    + JDK-8249277: TestVerifyIterativeGVN.java is failing with
    timeout in OpenJDK 11
    + JDK-8249278: Revert JDK-8226253 which breaks the spec of
    AccessibleState.SHOWING for JList
    + JDK-8249560: Shenandoah: Fix racy GC request handling
    + JDK-8249801: Shenandoah: Clear soft-refs on requested GC cycle
    + JDK-8249953: Shenandoah: gc/shenandoah/mxbeans tests should
    account for corner cases
    + JDK-8250582: Revert Principal Name type to NT-UNKNOWN when
    requesting TGS Kerberos tickets
    + JDK-8250609: C2 crash in IfNode::fold_compares
    + JDK-8250627: Use -XX:+/-UseContainerSupport for
    enabling/disabling Java container metrics
    + JDK-8250755: Better cleanup for
    jdk/test/javax/imageio/plugins/shared/CanWriteSequence.java
    + JDK-8250787: Provider.put no longer registering aliases in
    FIPS env
    + JDK-8250826: jhsdb does not work with coredump which comes
    from Substrate VM
    + JDK-8250827: Shenandoah: needs to reset/finish StringTable's
    dead count before/after parallel walk
    + JDK-8250844: Make sure {type,obj}ArrayOopDesc accessors check
    the bounds
    + JDK-8251117: Cannot check P11Key size in P11Cipher and
    P11AEADCipher
    + JDK-8251354: Shenandoah: Fix jdk/jfr/tool/TestPrintJSON.java
    test failure
    + JDK-8251451: Shenandoah: Remark ObjectSynchronizer roots with
    I-U
    + JDK-8251469: Better cleanup for
    test/jdk/javax/imageio/SetOutput.java
    + JDK-8251487: Shenandoah: missing detail timing tracking for
    final mark cleaning phase
    + JDK-8252120: compiler/oracle/TestCompileCommand.java
    misspells "occured"
    + JDK-8252157: JDK-8231209 11u backport breaks jmm binary
    compatibility
    + JDK-8252258: [11u] JDK-8242154 changes the default vendor
    + JDK-8252804: [test] Fix 'ReleaseDeflater.java' test after
    downport of 8234011
    + JDK-8253134: JMM_VERSION should remain at 0x20020000 (JDK 10)
    in JDK 11
    + JDK-8253283: [11u] Test build/translations/
    /VerifyTranslations.java failing after JDK-8252258
    + JDK-8253813: Backout JDK-8244287 from 11u: it causes several
    crashes
- Removed patch:
  * gcc-fno-common-fix.patch
    + not needed any more with this version
- Added patch:
  * JDK-8250861.patch
    + Fix regression "8250861: Crash in MinINode::Ideal(PhaseGVN*,
    bool)" introduced in jdk 11.0.9</changelog>
  <changelog author="fstrba@suse.com" date="1604491200">- Enable Sheandoah GC for x86_64 (jsc#ECO-3171)</changelog>
  <changelog author="fstrba@suse.com" date="1605528000">- Update to upstream tag jdk-11.0.9.1-1
  * Fix:
    + JDK-8250861: Crash in MinINode::Ideal(PhaseGVN*, bool)
- Removed patch:
  * JDK-8250861.patch
    + Integrated upstream</changelog>
  <changelog author="fstrba@suse.com" date="1611230400">- Update to upstream tag jdk-11.0.10+9 (January 2021 CPU,
  bsc#1181239)
  * Security fixes
    + JDK-8247619: Improve Direct Buffering of Characters
  * Other changes
    + JDK-6722928: Support SSPI as a native GSS-API provider
    + JDK-7185258: [macosx] Deadlock in SunToolKit.realSync()
    + JDK-8152332: [macosx] JFileChooser cannot be serialized on
    Mac OS X
    + JDK-8161684: [testconf] Add VerifyOops' testing into compiler
    tiers
    + JDK-8171279: Support X25519 and X448 in TLS
    + JDK-8173361: various crashes in
    JvmtiExport::post_compiled_method_load
    + JDK-8173658: JvmtiExport::post_class_unload() is broken for
    non-JavaThread initiators
    + JDK-8191006: hsdis disassembler plugin does not compile with
    binutils 2.29+
    + JDK-8197981: Missing return statement in
    __sync_val_compare_and_swap_8
    + JDK-8198334: java/awt/FileDialog/8003399/bug8003399.java
    fails in headless mode
    + JDK-8200151: Add 8 JNDI tests to com/sun/jndi/dns/ConfigTests/
    + JDK-8208279: Add 8 JNDI tests to com/sun/jndi/dns/EnvTests/
    + JDK-8208483: Add 5 JNDI tests to
    com/sun/jndi/dns/FactoryTests/
    + JDK-8208542: Add 4 JNDI tests to com/sun/jndi/dns/ListTests/
    + JDK-8208665: Amend cross-compilation docs with
    qemu-debootstrap recipe
    + JDK-8210088: ProblemList gc/epsilon/TestMemoryMXBeans.java
    + JDK-8210339: Add 10 JNDI tests to com/sun/jndi/dns/FedTests/
    + JDK-8211450: UndetVar::dup is not copying the kind field to
    the duplicated instance
    + JDK-8212160: JVMTI agent crashes with "assert(_value != 0LL)
    failed: resolving NULL _value"
    + JDK-8212226: SurfaceManager throws "Invalid Image variant"
    for MultiResolutionImage (Windows)
    + JDK-8213400: Support choosing group name in keytool keypair
    generation
    + JDK-8213535: Windows HiDPI html lightweight tooltips are
    truncated
    + JDK-8213698: Improve devkit creation and add support for
    linux/ppc64/ppc64le/s390x
    + JDK-8214025: assert(t-&gt;singleton()) failed: must be a
    constant when ScavengeRootsInCode &lt; 2
    + JDK-8214242: compiler/arguments/TestScavengeRootsInCode.java
    fails because of missing UnlockDiagnosticVMOptions
    + JDK-8214787: Zero builds fail with "undefined
    JavaThread::thread_state()"
    + JDK-8215583: Exclude
    runtime/handshake/HandshakeWalkSuspendExitTest.java
    + JDK-8216012: Infinite loop in RSA KeyPairGenerator
    + JDK-8216324: GetClassMethods is confused by the presence of
    default methods in super interfaces
    + JDK-8217429: WebSocket over authenticating proxy fails to
    send Upgrade headers
    + JDK-8217976: test/jdk/java/net/httpclient/websocket/
    /WebSocketProxyTest.java fails intermittently
    + JDK-8218021: Have jarsigner preserve posix permission
    attributes
    + JDK-8218287: jshell tool: input behavior unstable after
    12-ea+24 on Windows
    + JDK-8218851: JVM crash in custom classloader stress test, JDK
    12 &amp; 13
    + JDK-8220420: Cleanup c1_LinearScan
    + JDK-8222072: JVMTI GenerateEvents() sends CompiledMethodLoad
    events to wrong jvmtiEnv
    + JDK-8222286: Fix for JDK-8213419 is broken on s390
    + JDK-8222527: HttpClient doesn't send HOST header when
    tunelling HTTP/1.1 through http proxy
    + JDK-8222533: jtreg test jdk/internal/platform/cgroup/
    /TestCgroupMetrics.java fails on SLES12.3 linux ppc64le
    machine
    + JDK-8224506: [TESTBUG] TestDockerMemoryMetrics.java fails
    with exitValue = 137
    + JDK-8224555: vmTestbase/nsk/jvmti/scenarios/contention/TC02/
    /tc02t001/TestDescription.java failed
    + JDK-8224650: Add tests to support X25519 and X448 in TLS
    + JDK-8225072: Add LuxTrust certificate that is expiring in
    March 2021 to list of allowed but expired certs
    + JDK-8225329: -XX:+PrintBiasedLockingStatistics causes crash
    during initialization on Windows platforms
    + JDK-8225687: Newly added sspi.cpp in JDK-6722928 still
    contains some small errors
    + JDK-8227006: [linux] Runtime.availableProcessors execution
    time increased by factor of 100
    + JDK-8227275: Within native OOM error handling, assertions may
    hang the process
    + JDK-8227647: [Graal] Test8009761.java fails due to
    "RuntimeException: static java.lang.Object
    compiler.uncommontrap.Test8009761.m3(boolean,boolean) not
    compiled"
    + JDK-8229495: SIGILL in C2 generated OSR compilation
    + JDK-8230910: libsspi_bridge does not build on Windows 32bit
    + JDK-8232114: JVM crashed at imjpapi.dll in native code
    + JDK-8234147: Avoid looking up standard charsets in core
    libraries
    + JDK-8234393: [macos] printing ignores printer tray
    + JDK-8234863: Increase default value of MaxInlineLevel
    + JDK-8235218: Minimal VM is broken after JDK-8173361
    + JDK-8235456: Minimal VM is broken after JDK-8212160
    + JDK-8235829: graal crashes with Zombie.java test
    + JDK-8236124: Minimal VM slowdebug build failed after
    JDK-8212160
    + JDK-8236512: PKCS11 Connection closed after Cipher.doFinal
    and NoPadding
    + JDK-8236944: The legVecZ operand should be limited to
    zmm0-zmm15 registers
    + JDK-8237186: Fix typo in copyright header of
    java/io/Reader/TransferTo.java
    + JDK-8237499: JFR: Include stack trace in the ThreadStart event
    + JDK-8237512: AArch64: aarch64TestHook leaks a BufferBlob
    + JDK-8237524: AArch64: String.compareTo() may return incorrect
    result
    + JDK-8237950: C2 compilation fails with "Live Node limit
    exceeded limit" during ConvI2L::Ideal optimization
    + JDK-8238579: HttpsURLConnection drops the timeout and hangs
    forever in read
    + JDK-8239105: Add exception for expiring Digicert root
    certificates to VerifyCACerts test
    + JDK-8239477: jdk/jfr/jcmd/TestJcmdStartStopDefault.java fails
  - XX:+VerifyOops with "verify_oop: rsi: broken oop"
    + JDK-8239497: SEGV in EdgeUtils::field_name_symbol(Edge const&amp;)
    + JDK-8239886: Minimal VM build fails after JDK-8237499
    + JDK-8240633: Memory leaks in the implementations of
    FileChooserUI
    + JDK-8240690: Race condition between EDT and
    BasicDirectoryModel.FilesLoader.run0()
    + JDK-8241234: Unify monitor enter/exit runtime entries.
    + JDK-8241311: Move some charset mapping tests from closed to
    open
    + JDK-8241797: Add some tests to the problem list
    + JDK-8242029: AArch64: skip G1 array copy pre-barrier if
    marking not active
    + JDK-8242335: Additional Tests for RSASSA-PSS
    + JDK-8242480: Negative value may be returned by
    getFreeSwapSpaceSize() in the docker
    + JDK-8242614: cleanup duplicated test ldap server in some
    com/sun/jndi/ldap/ tests
    + JDK-8242846: Bring back test/jdk/tools/jlink/plugins/
    /OrderResourcesPluginTest.java
    + JDK-8243114: Implement montgomery{Multiply,Square}intrinsics
    on Windows
    + JDK-8243290: Improve diagnostic messages for class
    verification and redefinition failures
    + JDK-8243488: Add tests for set/get SendBufferSize and
    getReceiveBufferSize in DatagramSocket
    + JDK-8243549: sun/security/ssl/CipherSuite/
    /NamedGroupsWithCipherSuite.java failed with Unsupported
    signature algorithm: DSA
    + JDK-8243617: compiler/onSpinWait/TestOnSpinWaitC1.java test
    uses wrong class
    + JDK-8243619: compiler/codecache/CheckSegmentedCodeCache.java
    test misses -version
    + JDK-8244142: some hotspot/runtime tests don't check exit code
    of forked JVM
    + JDK-8244278: Excessive code cache flushes and sweeps
    + JDK-8244282: test/hotspot/jtreg/compiler/intrinsics/
    /Test8237524.java fails with --illegal-access=deny
    + JDK-8244621: [macos10.15] Garbled FX printing plus CoreText
    warnings on Catalina when building with Xcode 11
    + JDK-8244819: hsdis does not compile with binutils 2.34+
    + JDK-8245051: c1 is broken if it is compiled by gcc without
  - fno-lifetime-dse
    + JDK-8245168: jlink should not be treated as a "small" tool
    + JDK-8245400: Upgrade to LittleCMS 2.11
    + JDK-8246381: VM crashes with "Current BasicObjectLock* below
    than low_mark"
    + JDK-8246434: Threads::print_on_error assumes that the heap
    has been set up
    + JDK-8246648: issue with OperatingSystemImpl
    getFreeSwapSpaceSize in docker after 8242480
    + JDK-8247201: Print potential pointer value of readable stack
    memory in hs_err file
    + JDK-8247763: assert(outer-&gt;outcnt() == 2) failed: 'only phis'
    failure in LoopNode::verify_strip_mined()
    + JDK-8247867: Upgrade to freetype 2.10.2
    + JDK-8248190: Enable Power10 system and implement new
    byte-reverse instructions
    + JDK-8248226: TestCloneAccessStressGCM fails with
  - XX:-ReduceBulkZeroing
    + JDK-8248347: windows build broken by JDK-8243114
    + JDK-8248532: Every time I change keyboard language at my
    MacBook, Java crashes
    + JDK-8248552: C2 crashes with SIGFPE due to division by zero
    + JDK-8248596: [TESTBUG] compiler/loopopts/
    /PartialPeelingUnswitch.java times out with Graal enabled
    + JDK-8248745: Add jarsigner and keytool tests for restricted
    algorithms
    + JDK-8248791: sun/util/resources/cldr/TimeZoneNamesTest.java
    fails with -XX:-ReduceInitialCardMarks -XX:-ReduceBulkZeroing
    + JDK-8248845: AArch64: stack corruption after spilling vector
    register
    + JDK-8249176: Update GlobalSignR6CA test certificates
    + JDK-8249183: JVM crash in "AwtFrame::WmSize" method
    + JDK-8249192: MonitorInfo stores raw oops across safepoints
    + JDK-8249602: C2: assert(cnt == _outcnt) failed: no insertions
    allowed
    + JDK-8249603: C1: assert(has_error == false) failed: register
    allocation invalid
    + JDK-8249605: C2: assert(no_dead_loop) failed: dead loop
    detected
    + JDK-8249607: C2: assert(!had_error) failed: bad dominance
    + JDK-8249608: Vector register used by C2 compiled method
    corrupted at safepoint
    + JDK-8249672: Include microcode revision in features_string on
    x86
    + JDK-8249748: gtest silently ignores bad jvm arguments
    + JDK-8249821: Separate libharfbuzz from libfontmanager
    + JDK-8250598: Hyper-V is detected in spite of running on host
    OS
    + JDK-8250605: Linux x86_32 builds fail after JDK-8249821
    + JDK-8250636: iso8601_time returns incorrect offset part on
    MacOS
    + JDK-8250665: Wrong translation for the month name of May in
    ar_JO,LB,SY
    + JDK-8250772: Test com/sun/jndi/ldap/
    /NamingExceptionMessageTest.java fails intermittently with
    javax.naming.ServiceUnavailableException
    + JDK-8250825: C2 crashes with assert(field != __null) failed:
    missing field
    + JDK-8250894: Provide a configure option to build and run
    against the platform libharfbuzz
    + JDK-8250928: JFR: Improve hash algorithm for stack traces
    + JDK-8250968: Symlinks attributes not preserved when using
    jarsigner on zip files
    + JDK-8250984: Memory Docker tests fail on some Linux kernels
    w/o cgroupv1 swap limit capabilities
    + JDK-8251118: BiasedLocking::preserve_marks should not have a
    HandleMark
    + JDK-8251189: com/sun/jndi/ldap/LdapDnsProviderTest.java
    failed due to timeout
    + JDK-8251257: NMT: jcmd VM.native_memory scale=1 crashes
    target VM
    + JDK-8251365: Build failure on AIX after 8250636
    + JDK-8251397: NPE on ClassValue.ClassValueMap.cacheArray
    + JDK-8251456: [TESTBUG] compiler/vectorization/
    /TestVectorsNotSavedAtSafepoint.java failed OutOfMemoryError
    + JDK-8251458: Parse::do_lookupswitch fails with "assert(_cnt
    &gt;= 0) failed"
    + JDK-8251535: Partial peeling at unsigned test adds incorrect
    loop exit check
    + JDK-8251949: ZGC: Set explicit heap size for
    compiler/gcbarriers tests
    + JDK-8252090: JFR: StreamWriterHost::write_unbuffered() stucks
    in an infinite loop OpenJDK (build 13.0.1+9)
    + JDK-8252415: Bump update version for OpenJDK: jdk-11.0.10
    + JDK-8252470: java/awt/dnd/DisposeFrameOnDragCrash/
    /DisposeFrameOnDragTest.java fails on Windows
    + JDK-8252497: Incorrect numeric currency code for ROL
    + JDK-8252660: Shenandoah: support manageable SoftMaxHeapSize
    option
    + JDK-8252679: Two windows specific FileDIalog tests may fail
    on some Windows_Server_2016_Standard
    + JDK-8252696: Loop unswitching may cause out of bound array
    load to be executed
    + JDK-8252754: Hash code calculation of JfrStackTrace is
    inconsistent
    + JDK-8253219: Epsilon: clean up unnecessary includes
    + JDK-8253224: Shenandoah: ShenandoahStrDedupQueue destructor
    calls virtual num_queues()
    + JDK-8253226: Shenandoah: remove unimplemented
    ShenandoahStrDedupQueue::verify
    + JDK-8253269: The CheckCommonColors test should provide more
    info on failure
    + JDK-8253284: Zero OrderAccess barrier mappings are incorrect
    + JDK-8253375: OSX build fails with Xcode 12.0 (12A7209)
    + JDK-8253778: ShenandoahSafepoint::is_at_shenandoah_safepoint
    should not access VMThread state from other threads
    + JDK-8253791: Issue with useAppleColor check in CSystemColors.m
    + JDK-8254016: Test8237524 fails with -XX:-CompactStrings option
    + JDK-8254081: java/security/cert/PolicyNode/
    /GetPolicyQualifiers.java fails due to an expired certificate
    + JDK-8254144: Non-x86 Zero builds fail with return-type
    warning in os_linux_zero.cpp
    + JDK-8254166: Zero: return-type warning in
    zeroInterpreter_zero.cpp
    + JDK-8254177: (tz) Upgrade time-zone data to tzdata2020b
    + JDK-8254185: Fix Code cache sweeper heuristics for JDK 11
    + JDK-8254190: [s390] interpreter misses exception check after
    calling monitorenter
    + JDK-8254790: SIGSEGV in string_indexof_char and
    stringL_indexof_char intrinsics
    + JDK-8254854: [cgroups v1] Metric limits not properly detected
    on some join controller combinations
    + JDK-8254982: (tz) Upgrade time-zone data to tzdata2020c
    + JDK-8255050: Add pkcs11/KeyStore/ClientAuth.sh to Problem list
    + JDK-8255065: Zero: accessor_entry misses the IRIW case
    + JDK-8255226: (tz) Upgrade time-zone data to tzdata2020d
    + JDK-8255269: Unsigned overflow in g1Policy.cpp
    + JDK-8255365: Problem list failing client manual tests
    + JDK-8255457: Shenandoah: cleanup ShenandoahMarkTask
    + JDK-8255466: C2 crashes at ciObject::get_oop() const+0x0
    + JDK-8255550: x86: Assembler::cmpq(Address dst, Register src)
    encoding is incorrect
    + JDK-8255603: Memory/Performance regression after JDK-8210985
    + JDK-8255760: Shenandoah: match constants style in
    ShenandoahMarkTask fallback
    + JDK-8255781: Bump patch update version for OpenJDK:
    jdk-11.0.9.1
    + JDK-8255937: Better cleanup for
    test/jdk/javax/imageio/stream/StreamFlush.java
    + JDK-8256427: Test com/sun/jndi/dns/ConfigTests/
    /PortUnreachable.java does not work on AIX
    + JDK-8256452: Integrate missing part of JDK-8232370 to 11u
    + JDK-8256483: [TESTBUG] serviceability/jvmti/GetClassMethods/
    /libOverpassMethods.c fails to compile on gcc 4.4.x
    + JDK-8256557: libharfbuzz fails to link on gcc 4.4.x due to
  - Wl,-z,defs
    + JDK-8256618: Zero: Linux x86_32 build still fails
    + JDK-8256736: Zero: GTest tests fail with "unsuppported vm
    variant"
    + JDK-8256809: Annotation processing causes NPE during flow
    analysis
    + JDK-8257181: s390x builds are very noisy with gc-sections
    messages
    + JDK-8257242: [macOS] Java app crashes while switching input
    methods
    + JDK-8257545: SunJSSE FIPS regression in key exchange after
    JDK-8171279 11u backport
    + JDK-8257641: Shenandoah: Query is_at_shenandoah_safepoint()
    from control thread should return false
    + JDK-8257701: Shenandoah: objArrayKlass metadata is not marked
    with chunked arrays
    + JDK-8258630: Add expiry exception for QuoVadis root
    certificate
- New upstream dependency on libharfbuzz
- Regenerated patches: missing-return.patch system-pcsclite.patch</changelog>
  <changelog author="fstrba@suse.com" date="1616155200">- Added patches:
  * system-crypto-policy.patch
    + Let OpenJDK use system crypto policies unless explicitely told
    not to
  * nss-security-provider.patch
    + Add the NSS security provider with configuration in generated
    nss.cfg file
  * keytool-default-rsa.patch
    + Make keytool generate RSA keys by default, since only the
    LEGACY system crypto policy allows DSA</changelog>
  <changelog author="pujos.michael@gmail.com" date="1618488000">- moved mozilla-nss dependency to java-11-openjdk-headless package
  This is necessary to be able to do crypto with just
  java-11-openjdk-headless installed. Fixes boo#1184606</changelog>
  <changelog author="fstrba@suse.com" date="1619006400">- Update to upstream tag jdk-11.0.11+9 (April 2021, CPU)
  * Security fixes
    + JDK-8244473: Contextualize registration for JNDI
    + JDK-8244543: Enhanced handling of abstract classes
    + JDK-8249906, CVE-2021-2163, bsc#1185055: Enhance opening JARs
    + JDK-8250568, CVE-2021-2161, bsc#1185056: Less ambiguous
    processing
    + JDK-8253799: Make lists of normal filenames
    + JDK-8257001: Improve Http Client Support
  * Other changes
    + JDK-7107012: sun.jvm.hotspot.code.CompressedReadStream
    readDouble() conversion to long mishandled
    + JDK-7146776: deadlock between URLStreamHandler.getHostAddress
    and file.Handler.openconnection
    + JDK-8086003: Test fails on OSX with java.lang.RuntimeException
    'Narrow klass base: 0x0000000000000000, Narrow klass shift: 3'
    missing
    + JDK-8168869: jdeps: localized messages don't use proper line
    breaks
    + JDK-8180837: SunPKCS11-NSS tests failing with
    CKR_ATTRIBUTE_READ_ONLY and CKR_MECHANISM_PARAM_INVALID
    + JDK-8202343: Disable TLS 1.0 and 1.1
    + JDK-8205992: jhsdb cannot attach to Java processes running in
    Docker containers
    + JDK-8209193: Fix aarch64-linux compilation after -Wreorder
    changes
    + JDK-8210413: AArch64: Optimize div/rem by constant in C1
    + JDK-8210578: AArch64: Invalid encoding for fmlsvs instruction
    + JDK-8211051: jdeps usage of --dot-output doesn't provide
    valid output for modular jar
    + JDK-8211057: Gensrc step CompileProperties generates unstable
    CompilerProperties output
    + JDK-8211150: G1 Full GC not purging code root memory and
    hence causing memory leak
    + JDK-8211825: ModuleLayer.defineModulesWithXXX does not setup
    delegation when module reads automatic module
    + JDK-8212043: Add floating-point Math.min/max intrinsics
    + JDK-8212218: [TESTBUG] runtime/ErrorHandling/
    /TestHeapDumpOnOutOfMemoryErrorInMetaspace.java timed out
    + JDK-8213116: javax/swing/JComboBox/WindowsComboBoxSize/
    /WindowsComboBoxSizeTest.java fails in Windows
    + JDK-8213909: jdeps --print-module-deps should report missing
    dependences
    + JDK-8214180: Need better granularity for sleeping
    + JDK-8214223: tools/jdeps/listdeps/ListModuleDeps.java failed
    due to missing Lib2 file
    + JDK-8214230: Classes generated by SystemModulesPlugin.java
    are not reproducable
    + JDK-8214741: docs/index.html has no title or copyright
    + JDK-8215687: [Graal] unit test CheckGraalIntrinsics failed
    after 8212043
    + JDK-8217848: [Graal] vmTestbase/nsk/jvmti/ResourceExhausted/
    /resexhausted003/TestDescription.java fails
    + JDK-8218482: sun/security/krb5/auto/ReplayCachePrecise.java
    failed - no KrbException thrown
    + JDK-8218550: Add test omitted from JDK-8212043
    + JDK-8221584: SIGSEGV in os::PlatformEvent::unpark() in
    JvmtiRawMonitor::raw_exit while posting method exit event
    + JDK-8221995: AARCH64: problems with CAS instructions encoding
    + JDK-8222518: Remove unnecessary caching of Parker object in
    java.lang.Thread
    + JDK-8222785: aarch64: add necessary masking for immediate
    shift counts
    + JDK-8223186: HotSpot compile warnings from GCC 9
    + JDK-8225773: jdeps --check produces NPE if there are missing
    module dependences
    + JDK-8225805: Java Access Bridge does not close the logger
    + JDK-8226810: Failed to launch JVM because of
    NullPointerException occured on System.props
    + JDK-8229396: jdeps ignores multi-release when
    generate-module-info used on command line
    + JDK-8229474: Shenandoah: Cleanup CM::update_roots()
    + JDK-8232225: Rework the fix for JDK-8071483
    + JDK-8232905: JFR fails with assertion:
    assert(t-&gt;unflushed_size() == 0) failed: invariant
    + JDK-8233164: C2 fails with assert(phase-&gt;C-&gt;get_alias_index(t)
    == phase-&gt;C-&gt;get_alias_index(t_adr)) failed: correct memory
    chain
    + JDK-8233910: java/awt/ColorClass/AlphaColorTest.java is
    failing  intermittently in nightly lnux-x64 system
    + JDK-8233912: aarch64: minor improvements of atomic operations
    + JDK-8234508: VM_HeapWalkOperation::iterate_over_object reads
    non-strong fields with an on-strong load barrier
    + JDK-8234742: Improve handshake logging
    + JDK-8234796: Refactor Handshake::execute to take a more
    complex type than ThreadClosure
    + JDK-8235324: Dying objects are published from users of
    CollectedHeap::object_iterate
    + JDK-8235351: Lookup::unreflect should bind with the original
    caller independent of Method's accessible flag
    + JDK-8237369: Shenandoah: failed vmTestbase/nsk/jvmti/
    /AttachOnDemand/attach021/TestDescription.java test
    + JDK-8237392: Shenandoah: Remove unreliable assertion
    + JDK-8237483: AArch64 C1 OopMap inserted twice fatal error
    + JDK-8237495: Java MIDI fails with a dereferenced memory error
    when asked to send a raw 0xF7
    + JDK-8239355: (dc) Initial value of SO_SNDBUF should allow
    sending large datagrams (macOS)
    + JDK-8240353: AArch64: missing support for
  - XX:+ExtendedDTraceProbes in C1
    + JDK-8240704: CheckHandles.java failed "AssertionError: Handle
    use increased by more than 10 percent."
    + JDK-8240751: Shenandoah: fold ShenandoahTracer definition
    + JDK-8240795: [REDO] 8238384 CTW: C2 compilation fails with
    "assert(store != load-&gt;find_exact_control(load-&gt;in(0)))
    failed: dependence cycle found"
    + JDK-8241598: Upgrade JLine to 3.14.0
    + JDK-8241649: Optimize Character.toString
    + JDK-8241770: Module xxxAnnotation() methods throw NCDFE if
    module-info.class found as resource in unnamed module
    + JDK-8241911: AArch64: Fix a potential register clash issue in
    reduce_add2I
    + JDK-8242030: Wrong package declarations in jline classes after
    JDK-8241598
    + JDK-8242565: Policy initialization issues when the denyAfter
    constraint is enabled
    + JDK-8243618: compiler/rtm/cli tests can be run w/o WhiteBox
    + JDK-8243670: Unexpected test result caused by C2
    MergeMemNode::Ideal
    + JDK-8244088: [Regression] Switch of Gnome theme ends up in
    deadlocked UI
    + JDK-8244154: Update SunPKCS11 provider with PKCS11 v3.0 header
    files
    + JDK-8244340: Handshake processing thread lacks yielding
    + JDK-8244573: java.lang.ArrayIndexOutOfBoundsException thrown
    for malformed class file
    + JDK-8244683: A TSA server used by tests
    + JDK-8245005: javax/net/ssl/compatibility/BasicConnectTest.java
    failed with No enum constant
    + JDK-8245026: PsAdaptiveSizePolicy::_old_gen_policy_is_ready is
    unused
    + JDK-8245283: JFR: Can't handle constant dynamic used by Jacoco
    agent
    + JDK-8245512: CRC32 optimization using AVX512 instructions
    + JDK-8245527: LDAP Channel Binding support for Java
    GSS/Kerberos
    + JDK-8246707: (sc) SocketChannel.read/write throws
    AsynchronousCloseException on closed channel
    + JDK-8246709: sun/security/tools/jarsigner/
    /TsacertOptionTest.java compilation failed after JDK-8244683
    + JDK-8247200: assert((unsigned)fpargs &lt; 32)
    + JDK-8247766: [aarch64] guarantee(val &lt; (1U &lt;&lt; nbits))
    failed: Field too big for insn.
    + JDK-8248336: AArch64: C2: offset overflow in
    BoxLockNode::emit
    + JDK-8248865: Document JNDI/LDAP timeout properties
    + JDK-8248901: Signed immediate support in
    .../share/assembler.hpp is broken.
    + JDK-8249543: Force DirectBufferAllocTest to run with
  - ExplicitGCInvokesConcurrent
    + JDK-8249588: libwindowsaccessbridge issues on 64bit Windows
    + JDK-8249749: modify a primitive array through a stream and a
    for cycle causes jre crash
    + JDK-8249787: Make TestGCLocker more resilient with concurrent
    GCs
    + JDK-8249867: xml declaration is not followed by a newline
    + JDK-8250911: [windows] os::pd_map_memory() error detection
    broken
    + JDK-8251255: [linux] Add process-memory information to hs-err
    and VM.info
    + JDK-8251359: Shenandoah: filter null oops before calling
    enqueue/SATB barrier
    + JDK-8251925: C2: RenaissanceStressTest fails with
    assert(!had_error): bad dominance
    + JDK-8251944: Add Shenandoah test config to
    compiler/gcbarriers/UnsafeIntrinsicsTest.java
    + JDK-8251992: VM crashed running TestComplexAddrExpr.java test
    with -XX:UseAVX=X
    + JDK-8253220: Epsilon: clean up unused code/declarations
    + JDK-8253274: The CycleDMImagetest brokes the system
    + JDK-8253353: Crash in C2: guarantee(n != NULL) failed: No Node
    + JDK-8253368: TLS connection always receives close_notify
    exception
    + JDK-8253404: C2: assert(C-&gt;live_nodes() &lt;=
    C-&gt;max_node_limit()) failed: Live Node limit exceeded limit
    + JDK-8253409: Double-rounding possibility in float fma
    + JDK-8253476: TestUseContainerSupport.java fails on some Linux
    kernels w/o swap limit capabilities
    + JDK-8253524: C2: Refactor code that clones predicates during
    loop unswitching
    + JDK-8253644: C2: assert(skeleton_predicate_has_opaque(iff))
    failed: unexpected
    + JDK-8253681: closed java/awt/dnd/MouseEventAfterStartDragTest/
    /MouseEventAfterStartDragTest.html test failed
    + JDK-8253702: BigSur version number reported as 10.16, should
    be 11.nn
    + JDK-8253756: C2 CompilerThread0 crash in Node::add_req(Node*)
    + JDK-8254104: MethodCounters must exist before nmethod is
    installed
    + JDK-8254734: "dead loop detected" assert failure with patch
    from 8223051
    + JDK-8254748: Bad Copyright header format after JDK-8212218
    + JDK-8254799: runtime/ErrorHandling/
    /TestHeapDumpOnOutOfMemoryError.java fails with release VMs
    + JDK-8255058: C1: assert(is_virtual()) failed: type check
    + JDK-8255351: Add detection for Graviton 2 CPUs
    + JDK-8255368: Math.exp() gives wrong result for large values on
    x86 32-bit platforms
    + JDK-8255387: Japanese characters were printed upside down on
    AIX
    + JDK-8255401: Shenandoah: Allow oldval and newval registers to
    overlap in cmpxchg_oop()
    + JDK-8255479: [aarch64] assert(src-&gt;section_index_of(target) ==
    CodeBuffer::SECT_NONE) failed: sanity
    + JDK-8255544: Create a checked cast
    + JDK-8255559: Leak File Descriptors Because of
    ResolverLocalFilesystem#engineResolveURI()
    + JDK-8255681: print callstack in error case in
    runAWTLoopWithApp
    + JDK-8255734: VM should ignore SIGXFSZ on ppc64, s390 too
    + JDK-8255742: PrintInlining as compiler directive doesn't print
    virtual calls
    + JDK-8255845: Memory leak in imageFile.cpp
    + JDK-8255880: UI of Swing components is not redrawn after their
    internal state changed
    + JDK-8255908: ExceptionInInitializerError due to
    UncheckedIOException while initializing cgroupv1 subsystem
    + JDK-8256025: AArch64: MachCallRuntimeNode::ret_addr_offset()
    is incorrect for stub calls
    + JDK-8256056: Deoptimization stub doesn't save vector registers
    on x86
    + JDK-8256061: RegisterSaver::save_live_registers() omits upper
    halves of ZMM0-15 registers
    + JDK-8256187: [TEST_BUG] Automate bug4275046.java test
    + JDK-8256220: C1: x86_32 fails with -XX:UseSSE=1 after
    JDK-8210764 due to mishandled lir_neg
    + JDK-8256258: some missing NULL checks or asserts after
    CodeCache::find_blob_unsafe
    + JDK-8256264: Printed GlyphVector outline with low DPI has bad
    quality on Windows
    + JDK-8256290: javac/lambda/T8031967.java fails with
    StackOverflowError on x86_32
    + JDK-8256359: AArch64: runtime/ReservedStack/
    /ReservedStackTestCompiler.java fails
    + JDK-8256387: Unexpected result if patching an entire
    instruction on AArch64
    + JDK-8256421: Add 2 HARICA roots to cacerts truststore
    + JDK-8256488: [aarch64] Use ldpq/stpq instead of ld4/st4 for
    small copies in StubGenerator::copy_memory
    + JDK-8256489: Make gtest for long path names on Windows more
    resilient in the presence of virus scanners
    + JDK-8256501: libTestMainKeyWindow fails to build with Xcode
    12.2
    + JDK-8256633: Fix product build on Windows+Arm64
    + JDK-8256682: JDK-8202343 is incomplete
    + JDK-8256751: Incremental rebuild with precompiled header fails
    when touching a header file
    + JDK-8256757: Incorrect MachCallRuntimeNode::ret_addr_offset()
    for CallLeafNoFP on x86_32
    + JDK-8256806: Shenandoah: optimize shenandoah/jni/
    /TestPinnedGarbage.java test
    + JDK-8256807: C2: Not marking stores correctly as mismatched
    in string opts
    + JDK-8256810: Incremental rebuild broken on Macosx
    + JDK-8256818: SSLSocket that is never bound or connected leaks
    socket resources
    + JDK-8256888: Client manual test problem list update
    + JDK-8257083: Security infra test failures caused by
    JDK-8202343
    + JDK-8257408: Bump update version for OpenJDK: jdk-11.0.11
    + JDK-8257423: [PPC64] Support -XX:-UseInlineCaches
    + JDK-8257436: [aarch64] Regressions in ArrayCopyUnalignedDst
    .testByte/testChar for 65-78 bytes when UseSIMDForMemoryOps
    is on
    + JDK-8257513: C2: assert((constant_addr -
    _masm.code()-&gt;consts()-&gt;start()) == con.offset())
    + JDK-8257547: Handle multiple prereqs on the same line in deps
    files
    + JDK-8257561: Some code is not vectorized after 8251925 and
    8250607
    + JDK-8257565: epsilonBarrierSet.hpp should not include
    barrierSetAssembler
    + JDK-8257575: C2: "failed: only phis" assert failure in loop
    strip mining verification
    + JDK-8257594: C2 compiled checkcast of non-null object triggers
    endless deoptimization/recompilation cycle
    + JDK-8257633: Missing -mmacosx-version-min=X flag when linking
    libjvm
    + JDK-8257670: sun/security/ssl/SSLSocketImpl/SSLSocketLeak.java
    reports leaks
    + JDK-8257707: Fix incorrect format string in Http1HeaderParser
    + JDK-8257746: Regression introduced with JDK-8250984 - memory
    might be null in some machines
    + JDK-8257798: [PPC64] undefined reference to
    Klass::vtable_start_offset()
    + JDK-8257884: Re-enable sun/security/ssl/SSLSocketImpl/
    /SSLSocketLeak.java as automatic test
    + JDK-8257910: [JVMCI] Set exception_seen accordingly in the
    runtime.
    + JDK-8257997: sun/security/ssl/SSLSocketImpl/SSLSocketLeak.java
    again reports leaks after JDK-8257884
    + JDK-8257999: Parallel GC crash in gc/parallel/
    /TestDynShrinkHeap.java: new region is not in covered_region
    + JDK-8258077: Using -Xcheck:jni can lead to a double-free after
    JDK-8193234
    + JDK-8258247: Couple of issues in fix for JDK-8249906
    + JDK-8258373: Update the text handling in the JPasswordField
    + JDK-8258396: SIGILL in jdk.jfr.internal.PlatformRecorder
    .rotateDisk()
    + JDK-8258419: RSA cipher buffer cleanup
    + JDK-8258471: "search codecache" clhsdb command does not work
    + JDK-8258534: Epsilon: clean up unused includes
    + JDK-8258805: Japanese characters not entered by mouse click
    on Windows 10
    + JDK-8258833: Cancel multi-part cipher operations in SunPKCS11
    after failures
    + JDK-8258836: JNI local refs exceed capacity
    getDiagnosticCommandInfo
    + JDK-8258884: [TEST_BUG] Convert applet-based test
    open/test/jdk/javax/swing/JMenuItem/8031573/bug8031573.java
    to a regular java test
    + JDK-8259007: This test printed a blank page
    + JDK-8259048: (tz) Upgrade time-zone data to tzdata2020f
    + JDK-8259049: Uninitialized variable after JDK-8257513
    + JDK-8259231: Epsilon: improve performance under contention
    during virtual space expansion
    + JDK-8259271: gc/parallel/TestDynShrinkHeap.java still fails
    "assert(covered_region.contains(new_memregion)) failed: new
    region is not in covered_region"
    + JDK-8259312: VerifyCACerts.java fails as soneraclass2ca cert
    will expire in 90 days
    + JDK-8259319: Illegal package access when SunPKCS11 requires
    SunJCE's classes
    + JDK-8259339: AllocateUninitializedArray C2 intrinsic fails
    with void.class input
    + JDK-8259428: AlgorithmId.getEncodedParams() should return copy
    + JDK-8259446: runtime/jni/checked/
    /TestCheckedReleaseArrayElements.java fails with stderr not
    empty
    + JDK-8259451: Zero: skip serviceability/sa tests, set vm.hasSA
    to false
    + JDK-8259580: Shenandoah: uninitialized label in
    VerifyThreadGCState
    + JDK-8259619: C1: 3-arg StubAssembler::call_RT stack-use
    condition is incorrect
    + JDK-8259633: compiler/graalunit/CoreTest.java fails with NPE
    after JDK-8244543
    + JDK-8259706: C2 compilation fails with assert(vtable_index ==
    Method::invalid_vtable_index) failed: correct sentinel value
    + JDK-8259707: LDAP channel binding does not work with StartTLS
    extension
    + JDK-8259773: Incorrect encoding of AVX-512 kmovq instruction
    + JDK-8259849: Shenandoah: Rename store-val to IU-barrier
    + JDK-8259949: x86 32-bit build fails when -fcf-protection is
    passed in the compiler flags
    + JDK-8259954: gc/shenandoah/mxbeans tests fail with -Xcomp
    + JDK-8260029: aarch64: fix typo in verify_oop_array
    + JDK-8260308: Update LogCompilation junit to 4.13.1
    + JDK-8260338: Some fields in HaltNode is not cloned
    + JDK-8260349: Cannot programmatically retrieve Metaspace max
    set via JAVA_TOOL_OPTIONS
    + JDK-8260356: (tz) Upgrade time-zone data to tzdata2021a
    + JDK-8260378: [TESTBUG] DcmdMBeanTestCheckJni.java reports
    false positive
    + JDK-8260497: Shenandoah: Improve SATB flushing
    + JDK-8260502: [s390] NativeMovRegMem::verify() fails because
    it's too strict
    + JDK-8260632: Build failures after JDK-8253353
    + JDK-8260704: ParallelGC: oldgen expansion needs release-store
    for _end
    + JDK-8261022: Fix incorrect result of Math.abs() with char type
    + JDK-8261089: [TESTBUG] native library of test
    TestCheckedReleaseCriticalArray.java fails to compile with
    gcc 4.x
    + JDK-8261183: Follow on to Make lists of normal filenames
    + JDK-8261209: isStandalone property: remove dependency on
    pretty-print
    + JDK-8261231: Windows IME was disabled after DnD operation
    + JDK-8261251: Shenandoah: Use object size for full GC
    humongous compaction
    + JDK-8261310: PPC64 Zero build fails with
    'VMError::controlled_crash(int)::FunctionDescriptor
    functionDescriptor' has incomplete type and cannot be defined
    + JDK-8261334: NMT: tuning statistic shows incorrect hash
    distribution
    + JDK-8261413: Shenandoah: Disable class-unloading in I-U mode
    + JDK-8261522: [PPC64] AES intrinsics write beyond the
    destination array
    + JDK-8261534: Test sun/security/pkcs11/KeyAgreement/
    /IllegalPackageAccess.java fails on platforms where no nsslib
    artifacts are defined
    + JDK-8261585: Restore HandleArea used in
    Deoptimization::uncommon_trap
    + JDK-8261753: Test java/lang/System/OsVersionTest.java still
    failing on BigSur patch versions after JDK-8253702
    + JDK-8261829: Exclude tools/jlink/JLinkReproducibleTest.java
    in 11u
    + JDK-8261912: Code IfNode::fold_compares_helper more
    defensively
    + JDK-8261920: [AIX] jshell command throws java.io.IOError on
    non English locales
    + JDK-8262018: Wrong format in SAP copyright header of
    OsVersionTest
    + JDK-8263069: Exclude some failing tests from
    security/infra/java/security/cert/CertPathValidator</changelog>
  <changelog author="fstrba@suse.com" date="1620043200">- Remove all Jpackage provides for SLE12 in order to avoid
  installing this package as default Java on SLE12-SP5
  (bsc#1185476)</changelog>
  <changelog author="fstrba@suse.com" date="1621512000">- Modified patch:
  * nss-security-provider.patch
    + make the NSS provider first in the list</changelog>
  <changelog author="fstrba@suse.com" date="1626868800">- Update to upstream tag jdk-11.0.12+7 (July 2021, CPU)
  * Security fixes
    + JDK-8256157: Improve bytecode assembly
    + JDK-8256491: Better HTTP transport
    + JDK-8258432, CVE-2021-2341, bsc#1188564: Improve file
    transfers
    + JDK-8260453: Improve Font Bounding
    + JDK-8260960: Signs of jarsigner signing
    + JDK-8260967, CVE-2021-2369, bsc#1188565: Better jar file
    validation
    + JDK-8262380: Enhance XML processing passes
    + JDK-8262403: Enhanced data transfer
    + JDK-8262410: Enhanced rules for zones
    + JDK-8262477: Enhance String Conclusions
    + JDK-8262967: Improve Zip file support
    + JDK-8264066, CVE-2021-2388, bsc#1188566: Enhance compiler
    validation
    + JDK-8264079: Improve abstractions
    + JDK-8264460: Improve NTLM support
  * Other changes
    + JDK-6847157: java.lang.NullPointerException: HDC for
    component at sun.java2d.loops.Blit.Blit
    + JDK-7106851: Test should not use System.exit
    + JDK-8073446: TimeZone getOffset API does not  return a dst
    offset between years 2038-2137
    + JDK-8076190: Customizing the generation of a PKCS12 keystore
    + JDK-8153005: Upgrade the default PKCS12 encryption/MAC
    algorithms
    + JDK-8171303: sun/java2d/pipe/InterpolationQualityTest.java
    fails on Windows &amp; Linux
    + JDK-8177068: incomplete classpath causes NPE in Flow
    + JDK-8185734: [Windows] Structured Exception Catcher missing
    around gtest execution
    + JDK-8187450: JNI local refs exceeds capacity warning in
    NetworkInterface::getAll
    + JDK-8190763: Class cast exception on (CompoundEdit)
    UndoableEditEvent.getEdit()
    + JDK-8195841: PNGImageReader.readNullTerminatedString() doesnt
    check for non-null terminated strings with length equal to
    maxLen
    + JDK-8196100: javax/swing/text/JTextComponent/5074573/
    /bug5074573.java fails
    + JDK-8199646: JShell tests: jdk/jshell/
    /FailOverDirectExecutionControlTest.java failed with
    java.lang.UnsupportedOperationException
    + JDK-8206925: Support the certificate_authorities extension
    + JDK-8207160: ClassReader::adjustMethodParams can potentially
    return null if the args list is empty
    + JDK-8207247: AARCH64: Enable Minimal and Client VM builds
    + JDK-8207404: MulticastSocket tests failing on AIX
    + JDK-8207779: Method::is_valid_method() compares 'this' with
    NULL
    + JDK-8208061: runtime/LoadClass/TestResize.java fails with
    "Load factor too high" when running in CDS mode.
    + JDK-8209459: TestSHA512MultiBlockIntrinsics failed on AArch64
    + JDK-8210443: Migrate Locale matching tests to JDK Repo.
    + JDK-8213231: ThreadSnapshot::_threadObj can become stale
    + JDK-8213483: ARM32: runtime/ErrorHandling/
    /ShowRegistersOnAssertTest.java jtreg test fail
    + JDK-8213725: JShell NullPointerException due to class file
    with unexpected package
    + JDK-8213794: ARM32: disable TypeProfiling,
    CriticalJNINatives, Serviceablity tests for ARM32
    + JDK-8213845: ARM32: Interpreter doesn't call result handler
    after native calls
    + JDK-8214128: ARM32: wrong stack alignment on
    Deoptimization::unpack_frames
    + JDK-8214512: ARM32: Jtreg test compiler/c2/Test8062950.java
    fails on ARM
    + JDK-8214854: JDWP: Unforseen output truncation in logging
    + JDK-8214922: Add vectorization support for fmin/fmax
    + JDK-8215009: GCC 8 compilation error in libjli
    + JDK-8216184: CDS/appCDS tests failed on Windows due to long
    path to a classlist file
    + JDK-8216259: AArch64: Vectorize Adler32 intrinsics
    + JDK-8216314: SIGILL in CodeHeapState::print_names()
    + JDK-8217348: assert(thread-&gt;is_Java_thread()) failed: just
    checking
    + JDK-8217465: [REDO] - Optimize CodeHeap Analytics
    + JDK-8217561: X86: Add floating-point Math.min/max intrinsics
    + JDK-8217918: C2: -XX:+AggressiveUnboxing is broken
    + JDK-8218458: [TESTBUG] runtime/NMT/
    /CheckForProperDetailStackTrace.java fails with Expected
    stack trace missing from output
    + JDK-8219142: Remove unused JIMAGE_ResourcePath
    + JDK-8219586: CodeHeap State Analytics processes dead nmethods
    + JDK-8220074: Clean up GCC 8.3 errors in LittleCMS
    + JDK-8220407: compiler/intrinsics/math/
    /TestFpMinMaxIntrinsics.java timedout
    + JDK-8222302: [TESTBUG] test/hotspot/jtreg/compiler/intrinsics/
    /sha/cli/TestUseSHAOptionOnUnsupportedCPU.java fails on any
    other CPU
    + JDK-8222412: AARCH64: multiple instructions encoding issues
    + JDK-8223020: aarch64: expand minI_rReg and maxI_rReg patterns
    into separate instructions
    + JDK-8223444: Improve CodeHeap Free Space Management
    + JDK-8223504: Improve performance of forall loops by better
    inlining of "iterator()" methods
    + JDK-8223667: ASAN build broken
    + JDK-8225081: Remove Telia Company CA certificate expiring in
    April 2021
    + JDK-8225116: Test OwnedWindowsLeak.java intermittently fails
    + JDK-8225438: javax/net/ssl/TLSCommon/
    /TestSessionLocalPrincipal.java failed with Read timed out
    + JDK-8225756: [testbug] compiler/loopstripmining/
    /CheckLoopStripMining.java sets too short a
    SafepointTimeoutDelay
    + JDK-8226374: Restrict TLS signature schemes and named groups
    + JDK-8226627: assert(t-&gt;singleton()) failed: must be a constant
    + JDK-8226721: Missing intrinsics for Math.ceil, floor, rint
    + JDK-8227080: (fs) Files.newInputStream(...).skip(n) is slow
    + JDK-8227222: vmTestbase/jit/FloatingPoint/gen_math/Loops04/
    /Loops04.java failed XMM register should be 0-15
    + JDK-8227609: (fs) Files.newInputStream(...).skip(n) should
    allow skipping beyond file size
    + JDK-8230428: Cleanup dead CastIP node code in formssel.cpp
    + JDK-8231460: Performance issue (CodeHeap) with large free
    blocks
    + JDK-8231713: x86_32 build failures after JDK-8226721 (Missing
    intrinsics for Math.ceil, floor, rint)
    + JDK-8231841: AArch64: debug.cpp help() is missing an AArch64
    line for pns
    + JDK-8232084: HotSpot build failed with GCC 9.2.1
    + JDK-8232591: AArch64: Add missing match rules for smaddl,
    smsubl and smnegl
    + JDK-8233185: HttpServer.stop() blocks indefinitely when
    called on dispatch thread
    + JDK-8233787: Break cycle in vm_version* includes
    + JDK-8233948: AArch64: Incorrect mapping between OptoReg and
    VMReg for high 64 bits of Vector Register
    + JDK-8234355: Buffer overflow in jcmd GC.class_stats due to
    too many classes
    + JDK-8235368: Update BCEL to Version 6.4.1
    + JDK-8236859: WebSocket over authenticating proxy fails with
    NPE
    + JDK-8236992: AArch64: remove redundant load_klass in itable
    stub
    + JDK-8237743: test/langtools/jdk/jshell/
    /FailOverExecutionControlTest.java fails No
    ExecutionControlProvider with name 'nonExistent' and parameter
    keys: []
    + JDK-8237804: sun/security/mscapi tests fail with "Key pair
    not generated, alias &lt;nnnnnn&gt; already exists"
    + JDK-8238175: CTW: Class.getDeclaredMethods fails with
    assert(k-&gt;is_subclass_of(SystemDictionary::Throwable_klass()))
    failed: invalid exception class
    + JDK-8238567: SoftMainMixer.processAudioBuffers(): Wrong
    handling of stoppedMixers
    + JDK-8238812: assert(false) failed: bad AD file
    + JDK-8239312: [macos] javax/swing/JFrame/NSTexturedJFrame/
    /NSTexturedJFrame.java
    + JDK-8239386: handle ContendedPaddingWidth in
    vm_version_aarch64
    + JDK-8239536: Can't use 'java.util.List' object after
    importing 'java.awt.List'
    + JDK-8240487: Cleanup whitespace in .cc, .hh, .m, and .mm files
    + JDK-8240848: ArrayIndexOutOfBoundsException buf for
    TextCallbackHandler
    + JDK-8241082: Upgrade IANA Language Subtag Registry data to
    03-16-2020 version
    + JDK-8241087: Build failure with VS 2019 (16.5.0) due to C2039
    and C2873
    + JDK-8241101: [s390] jtreg test failure after JDK-8238696: not
    conformant features string
    + JDK-8241248: NullPointerException in
    sun.security.ssl.HKDF.extract(HKDF.java:93)
    + JDK-8241372: Several test failures due to
    javax.net.ssl.SSLException: Connection reset
    + JDK-8241475: AArch64: Add missing support for PopCountVI node
    + JDK-8241829: Cleanup the code for PrinterJob on windows
    + JDK-8241960: The SHA3 message digests impl of SUN provider
    are not thread safe after cloned
    + JDK-8242010: Upgrade IANA Language Subtag Registry to Version
    2020-04-01
    + JDK-8242429: Better implementation for sign extract
    + JDK-8242557: Add length limit for strings in PNGImageWriter
    + JDK-8242919: Paste locks up jshell
    + JDK-8243155: AArch64: Add support for SqrtVF
    + JDK-8243240: AArch64: Add support for MulVB
    + JDK-8243452: JFR: Could not create chunk in repository with
    over 200 recordings
    + JDK-8243559: Remove root certificates with 1024-bit keys
    + JDK-8243597: AArch64: Add support for integer vector abs
    + JDK-8244031: HttpClient should have more tests for HEAD
    requests
    + JDK-8244205: HTTP/2 tunnel connections through proxy may be
    reused regardless of which proxy is selected
    + JDK-8244847: Linux/PPC: runtime/CompressedOops/
    /CompressedClassPointers: smallHeapTest fails
    + JDK-8245511: G1 adaptive IHOP does not account for
    reclamation of humongous objects by young GC
    + JDK-8246274: G1 old gen allocation tracking is not in a
    separate class
    + JDK-8247354: [aarch64] PopFrame causes
    assert(oopDesc::is_oop(obj)) failed: not an oop
    + JDK-8247408: IdealGraph bit check expression canonicalization
    + JDK-8247432: Update IANA Language Subtag Registry to Version
    2020-09-29
    + JDK-8247438: JShell: When FailOverExecutionControlProvider
    fails the proximal cause is not shown
    + JDK-8247753: UIManager.getSytemLookAndFeelClassName() returns
    wrong value on Fedora 32
    + JDK-8248043: Need to eliminate excessive i2l conversions
    + JDK-8248411: [aarch64] Insufficient error handling when
    CodeBuffer is exhausted
    + JDK-8248568: compiler/c2/TestBit.java failed: test missing
    from stdout/stderr
    + JDK-8248870: AARCH64: I2L/L2I conversions can be skipped for
    masked positive values
    + JDK-8249142: java/awt/FontClass/CreateFont/DeleteFont.sh is
    unstable
    + JDK-8249189: AARCH64: more L2I conversions can be skipped
    + JDK-8249719: MethodHandle performance suffers from bad
    ResolvedMethodTable hash function
    + JDK-8249875: GCC 10 warnings -Wtype-limits with JFR code
    + JDK-8250635: MethodArityHistogram should use Compile_lock in
    favour of fancy checks
    + JDK-8250876: Fix issues with cross-compile on macos
    + JDK-8251031: Some vmTestbase/nsk/monitoring/RuntimeMXBean
    tests fail with hostnames starting from digits
    + JDK-8251525: AARCH64: Faster Math.signum(fp)
    + JDK-8252259: AArch64: Adjust default value of FLOATPRESSURE
    + JDK-8252311: AArch64: save two words in itable lookup stub
    + JDK-8252779: compiler/graalunit/HotspotTest.java failed after
    8251525
    + JDK-8252883: AccessDeniedException caused by delayed file
    deletion on Windows
    + JDK-8253167: ARM32 builds fail after JDK-8247910
    + JDK-8253572: [windows] CDS archive may fail to open with long
    file names
    + JDK-8253923: C2 doesn't always run loop opts for compilations
    that include loops
    + JDK-8253948: Memory leak in ImageFileReader
    + JDK-8254631: Better support ALPN byte wire values in SunJSSE
    + JDK-8254717: isAssignableFrom checks in
    KeyFactorySpi.engineGetKeySpec appear to be backwards
    + JDK-8255086: Update the root locale display names
    + JDK-8255625: AArch64: Implement Base64.encodeBlock
    accelerator/intrinsic
    + JDK-8255763: C2: OSR miscompilation caused by invalid memory
    instruction placement
    + JDK-8255992: JFR EventWriter does not use first string from
    StringPool with id 0
    + JDK-8256037: [TESTBUG] com/sun/jndi/dns/ConfigTests/
    /PortUnreachable.java fails due to the hard coded threshold
    is small
    + JDK-8256244: java/lang/ProcessHandle/PermissionTest.java
    fails with TestNG 7.1
    + JDK-8256287: [windows] add loop fuse to
    map_or_reserve_memory_aligned
    + JDK-8256523: Streamline Java SHA2 implementation
    + JDK-8257414: Drag n Drop target area is wrong on high DPI
    systems
    + JDK-8257569: Failure observed with
    JfrVirtualMemory::initialize
    + JDK-8257574: C2: "failed: parsing found no loops but there
    are some" assert failure
    + JDK-8257580: Bump update version for OpenJDK: jdk-11.0.12
    + JDK-8257604: JNI_ArgumentPusherVaArg leaks valist
    + JDK-8257621: JFR StringPool misses cached items across
    consecutive recordings
    + JDK-8257796: [TESTBUG]
    TestUseSHA512IntrinsicsOptionOnSupportedCPU.java fails
    on x86_32
    + JDK-8257822: C2 crashes with SIGFPE due to a division that
    floats above its zero check
    + JDK-8257828: SafeFetch may crash if invoked in non-JavaThreads
    + JDK-8257853: Remove dependencies on JNF's JNI utility
    functions in AWT and 2D code
    + JDK-8257858: [macOS]: Remove JNF dependency from
    libosxsecurity/KeystoreImpl.m
    + JDK-8257860: [macOS]: Remove JNF dependency from
    libosxkrb5/SCDynamicStoreConfig.m
    + JDK-8257988: Remove JNF dependency from
    libsaproc/MacosxDebuggerLocal.m
    + JDK-8258414: OldObjectSample events too expensive
    + JDK-8258505: [TESTBUG] TestDivZeroWithSplitIf.java fails due
    to missing UnlockDiagnosticVMOptions
    + JDK-8258753: StartTlsResponse.close() hangs due to
    synchronization issues
    + JDK-8259061: C2: assert(found) failed: memory-writing node is
    not placed in its original loop or an ancestor of it
    + JDK-8259227: C2 crashes with SIGFPE due to a division that
    floats above its zero check
    + JDK-8259232: Bad JNI lookup during printing
    + JDK-8259276: C2: Empty expression stack when reexecuting
    tableswitch/lookupswitch instructions after deoptimization
    + JDK-8259343: [macOS] Update JNI error handling in Cocoa code.
    + JDK-8259585: Accessible actions do not work on mac os x
    + JDK-8259651: [macOS] Replace JNF_COCOA_ENTER/EXIT macros
    + JDK-8259662: Don't wrap SocketExceptions into SSLExceptions
    in SSLSocketImpl
    + JDK-8259710: Inlining trace leaks memory
    + JDK-8259729: Missed JNFInstanceOf -&gt; IsInstanceOf conversion
    + JDK-8259777: Incorrect predication condition generated by ADLC
    + JDK-8259786: initialize last parameter of getpwuid_r
    + JDK-8259843: initialize dli_fname array before calling
    dll_address_to_library_name
    + JDK-8259869: [macOS] Remove desktop module dependencies on
    JNF Reference APIs
    + JDK-8259886: Improve SSL session cache performance and
    scalability
    + JDK-8259983: do not use uninitialized expand_ms value in
    G1CollectedHeap::expand_heap_after_young_collection
    + JDK-8260030: Improve stringStream buffer handling
    + JDK-8260236: better init AnnotationCollector _contended_group
    + JDK-8260255: C1: LoopInvariantCodeMotion constructor can
    leave some fields uninitialized
    + JDK-8260284: C2: assert(_base == Int) failed: Not an Int
    + JDK-8260380: Upgrade to LittleCMS 2.12
    + JDK-8260420: C2 compilation fails with assert(found_sfpt)
    failed: no node in loop that's not input to safepoint
    + JDK-8260426: awt debug_mem.c DMem_AllocateBlock might leak
    memory
    + JDK-8260432: allocateSpaceForGP in freetypeScaler.c might
    leak memory
    + JDK-8260616: Removing remaining JNF dependencies in the
    java.desktop module
    + JDK-8260653: Unreachable nodes keep speculative types alive
    + JDK-8260707: java/lang/instrument/PremainClass/
    /InheritAgent0100.java times out
    + JDK-8260925: HttpsURLConnection does not work  with other
    JSSE provider.
    + JDK-8260926: Trace resource exhausted events unconditionally
    + JDK-8261020: Wrong format parameter in
    create_emergency_chunk_path
    + JDK-8261027: AArch64: Support for LSE atomics C++ HotSpot code
    + JDK-8261167: print_process_memory_info add a close call after
    fopen
    + JDK-8261170: Upgrade to freetype 2.10.4
    + JDK-8261198: [macOS] Incorrect JNI parameters in number
    conversion in A11Y code
    + JDK-8261235: C1 compilation fails with
    assert(res-&gt;vreg_number() == index) failed: conversion check
    + JDK-8261261: The version extra fields needs to be overridable
    in jib-profiles.js
    + JDK-8261262: Kitchensink24HStress.java crashed with
    EXCEPTION_ACCESS_VIOLATION
    + JDK-8261354: SIGSEGV at MethodIteratorHost
    + JDK-8261355: No data buffering in SunPKCS11 Cipher encryption
    when the underlying mechanism has no padding
    + JDK-8261397: try catch Method failing to work when dividing
    an integer by 0
    + JDK-8261422: Adjust problematic String.format calls in
    jdk/internal/util/Preconditions.java outOfBoundsMessage
    + JDK-8261447: MethodInvocationCounters frequently run into
    overflow
    + JDK-8261481: Cannot read Kerberos settings in dynamic store
    on macOS Big Sur
    + JDK-8261505: Test test/hotspot/jtreg/gc/parallel/
    /TestDynShrinkHeap.java killed by Linux OOM Killer
    + JDK-8261601: free memory in early return in
    Java_sun_nio_ch_sctp_SctpChannelImpl_receive0
    + JDK-8261649: AArch64: Optimize LSE atomics in C++ code
    + JDK-8261730: C2 compilation fails with
    assert(store-&gt;find_edge(load) != -1) failed: missing
    precedence edge
    + JDK-8261752: Multiple GC test are missing memory requirements
    + JDK-8261791: (sctp) handleSendFailed in SctpChannelImpl.c
    potential leaks
    + JDK-8261812: C2 compilation fails with assert(!had_error)
    failed: bad dominance
    + JDK-8261914: IfNode::fold_compares_helper faces
    non-canonicalized bool when running JRuby JSON workload
    + JDK-8262093: java/util/concurrent/tck/JSR166TestCase.java
    failed "assert(false) failed: unexpected node"
    + JDK-8262110: DST starts from incorrect time in 2038
    + JDK-8262121: [11u] Redo 8244287: JFR: Methods samples have
    line number 0
    + JDK-8262163: Extend settings printout in jcmd VM.metaspace
    + JDK-8262295: C2: Out-of-Bounds Array Load from Clone Source
    + JDK-8262298: G1BarrierSetC2::step_over_gc_barrier fails with
    assert "bad barrier shape"
    + JDK-8262446: DragAndDrop hangs on Windows
    + JDK-8262461: handle wcstombsdmp return value correctly in
    unix awt_InputMethod.c
    + JDK-8262465: Very long compilation times and high memory
    consumption in C2 debug builds
    + JDK-8262726: AArch64: C1 StubAssembler::call_RT can corrupt
    stack
    + JDK-8262739: String inflation C2 intrinsic prevents insertion
    of anti-dependencies
    + JDK-8262829: Native crash in
    Win32PrintServiceLookup.getAllPrinterNames()
    + JDK-8262837: handle split_USE correctly
    + JDK-8262900: ToolBasicTest fails to access HTTP server it
    starts
    + JDK-8263260: [s390] Support latest hardware (z14 and z15)
    + JDK-8263311: Watch registry changes for remote printers
    update instead of polling
    + JDK-8263361: Incorrect arraycopy stub selected by C2 for SATB
    collectors
    + JDK-8263404: RsaPrivateKeySpec is always recognized as
    RSAPrivateCrtKeySpec in RSAKeyFactory.engineGetKeySpec
    + JDK-8263425: AArch64: two potential bugs in C1
    LIRGenerator::generate_address()
    + JDK-8263448: CTW: fatal error: meet not symmetric
    + JDK-8263504: Some OutputMachOpcodes fields are uninitialized
    + JDK-8263557: Possible NULL dereference in
    Arena::destruct_contents()
    + JDK-8263558: Possible NULL dereference in fast path arena
    free if ZapResourceArea is true
    + JDK-8263676: AArch64: one potential bug in C1
    LIRGenerator::generate_address()
    + JDK-8263729: [test] divert spurious output away from stream
    under test in ProcessBuilder Basic test
    + JDK-8263846: Bad JNI lookup getFocusOwner in accessibility
    code on Mac OS X
    + JDK-8264047: Duplicate global variable 'jvm' in libjavajpeg
    and libawt
    + JDK-8264096: slowdebug jvm crashes when StrInflatedCopy match
    rule is not supported
    + JDK-8264151: ciMethod::ensure_method_data() should return
    false is loading resulted in empty state
    + JDK-8264173: [s390] Improve Hardware Feature Detection And
    Reporting
    + JDK-8264190: Harden TLS interop tests
    + JDK-8264223: CodeHeap::verify fails extra_hops assertion in
    fastdebug test
    + JDK-8264328: Broken license in
    javax/swing/JComboBox/8072767/bug8072767.java
    + JDK-8264360: Loop strip mining verification fails with
    "should be on the backedge"
    + JDK-8264626: C1 should be able to inline excluded methods
    + JDK-8264640: CMS ParScanClosure misses a barrier
    + JDK-8264786: [macos] All Swing/AWT apps cause Allow
    Notifications prompt to appear when app is launched
    + JDK-8264821: DirectIOTest fails on a system with large block
    size
    + JDK-8264848: [macos] libjvm.dylib linker warning due to macOS
    version mismatch
    + JDK-8264923: PNGImageWriter.write_zTXt throws Exception with
    a typo
    + JDK-8264958: C2 compilation fails with assert "n is later
    than its clone"
    + JDK-8265099: Revert backport to 11u of 8236859: WebSocket
    over authenticating proxy fails with NPE
    + JDK-8265154: vinserti128 operand mix up for KNL platforms
    + JDK-8265239: Shenandoah: Shenandoah heap region count could
    be off by 1
    + JDK-8265417: Backport of JDK-8249672 breaks Solaris x86 build
    + JDK-8265421: java/lang/String/StringRepeat.java test is
    missing a memory requirement
    + JDK-8265462: Handle multiple slots in the NSS Internal Module
    from SunPKCS11's Secmod
    + JDK-8265537: x86 version string truncated after JDK-8249672
    11u backport
    + JDK-8265666: Enable AIX build platform to make external debug
    symbols
    + JDK-8265677: CMS: CardTableBarrierSet::write_ref_array_work()
    lacks storestore barrier
    + JDK-8265690: Use the latest Ubuntu base image version in
    Docker testing
    + JDK-8265718: Build failure after JDK-8258414 11u backport
    + JDK-8265750: Fatal error in safepoint.cpp after backport of
    8258414
    + JDK-8265784: [C2] Hoisting of DecodeN leaves MachTemp inputs
    behind
    + JDK-8265938: C2's conditional move optimization does not
    handle top Phi
    + JDK-8266220: keytool still prompt for store password on a
    password-less pkcs12 file if -storetype pkcs12 is specified
    + JDK-8266293: Key protection using PBEWithMD5AndDES fails with
    "java.security.InvalidAlgorithmParameterException: Salt must
    be 8 bytes long"
    + JDK-8266713: [AIX] Build failure after 11u backport of
    JDK-8247753
    + JDK-8266802: Shenandoah: Round up region size to page size
    unconditionally
    + JDK-8266892: avoid maybe-uninitialized gcc warnings on linux
    s390x
    + JDK-8266929: Unable to use algorithms from 3p providers
    + JDK-8267235: [macos_aarch64]
    InterpreterRuntime::throw_pending_exception messing up LR
    results in crash
    + JDK-8267561: Shenandoah: Reference processing not properly
    setup for outside of cycle degenerated GC
    + JDK-8267599: Revert the change to the default PKCS12
    macAlgorithm and macIterationCount props for 11u/8u/7u
    + JDK-8267641: [11u] 8227609 backport typo
    + JDK-8267721: Enable sun/security/pkcs11 tests for Amazon
    Linux 2 AArch64
    + JDK-8268678: LetsEncryptCA.java test fails as Let's Encrypt
    Authority X3 is retired</changelog>
  <changelog author="schwab@suse.de" date="1628078400">- riscv64-zero.patch: Add support for riscv64 (zero VM)</changelog>
  <changelog author="fstrba@suse.com" date="1629979200">- Added patch:
  * jdk11-glibc234.patch
    + fix build with glibc-2.34 (bsc#1189201)</changelog>
  <changelog author="fstrba@suse.com" date="1631534400">- Modified patch:
  * nss-security-provider.patch
    + revert recent changes making NSS provider the default one
    + fixes bsc#1190252</changelog>
  <changelog author="fstrba@suse.com" date="1631793600">- Added patch:
  * fips.patch
    + implement FIPS support in OpenJDK</changelog>
  <changelog author="fstrba@suse.com" date="1634817600">- Update to upstream tag jdk-11.0.13+8 (October 2021 CPU)
  * Security fixes
    + JDK-8163326, CVE-2021-35550, bsc#1191901: Update the default
    enabled cipher suites preference
    + JDK-8254967, CVE-2021-35565, bsc#1191909:
    com.sun.net.HttpsServer spins on TLS session close
    + JDK-8263314: Enhance XML Dsig modes
    + JDK-8265167, CVE-2021-35556, bsc#1191910: Richer Text Editors
    + JDK-8265574: Improve handling of sheets
    + JDK-8265580, CVE-2021-35559, bsc#1191911: Enhanced style for
    RTF kit
    + JDK-8265776: Improve Stream handling for SSL
    + JDK-8266097, CVE-2021-35561, bsc#1191912: Better hashing
    support
    + JDK-8266103: Better specified spec values
    + JDK-8266109: More Resilient Classloading
    + JDK-8266115: More Manifest Jar Loading
    + JDK-8266137, CVE-2021-35564, bsc#1191913: Improve Keystore
    integrity
    + JDK-8266689, CVE-2021-35567, bsc#1191903: More Constrained
    Delegation
    + JDK-8267086: ArrayIndexOutOfBoundsException in
    java.security.KeyFactory.generatePublic
    + JDK-8267712: Better LDAP reference processing
    + JDK-8267729, CVE-2021-35578, bsc#1191904: Improve TLS client
    handshaking
    + JDK-8267735, CVE-2021-35586, bsc#1191914: Better BMP support
    + JDK-8268193: Improve requests of certificates
    + JDK-8268199: Correct certificate requests
    + JDK-8268205: Enhance DTLS client handshake
    + JDK-8268506: More Manifest Digests
    + JDK-8269618, CVE-2021-35603, bsc#1191906: Better session
    identification
    + JDK-8269624: Enhance method selection support
    + JDK-8270398: Enhance canonicalization
    + JDK-8270404: Better canonicalization
  * Other changes
    + JDK-8024368: private methods are allocated vtable indices
    + JDK-8042902: Test java/net/Inet6Address/serialize/
    /Inet6AddressSerializationTest.java fails intermittently
    + JDK-8140466: ChaCha20 and Poly1305 TLS Cipher Suites
    + JDK-8157404: Unable to read certain PKCS12 keystores from
    SequenceInputStream
    + JDK-8158066: SourceDebugExtensionTest fails to rename file
    + JDK-8168304: Make all of DependencyContext_test available in
    product mode
    + JDK-8169246: java/net/DatagramSocket/ReportSocketClosed.java
    fails intermittently with BindException
    + JDK-8181313: SA: Remove libthread_db dependency on Linux
    + JDK-8193214: Incorrect annotations.without.processors
    warnings with JDK 9
    + JDK-8194230: jdk/internal/jrtfs/remote/
    /RemoteRuntimeImageTest.java fails with
    java.lang.NullPointerException
    + JDK-8196092: javax/swing/JComboBox/8032878/bug8032878.java
    fails
    + JDK-8199931: java/net/MulticastSocket/
    /UnreferencedMulticastSockets.java fails with "incorrect data
    received"
    + JDK-8206083: Make tools/javac/api/T6265137.java robust to JDK
    version changes
    + JDK-8206350: java/util/Locale/bcp47u/SystemPropertyTests.java
    failed on Mac 10.13 with zh_CN and zh_TW locales.
    + JDK-8207316: java/nio/channels/spi/SelectorProvider/
    /inheritedChannel/InheritedChannelTest.java failed
    + JDK-8208227: tools/jdeps/DotFileTest.java fails on Win-X64
    + JDK-8208363: test/jdk/java/lang/Package/
    /PackageFromManifest.java missing module dependencies
    declaration
    + JDK-8209380: ARM: cleanup maybe-uninitialized and reorder
    compiler warnings
    + JDK-8209768: Refactor java/util/prefs/CheckUserPrefsStorage.sh
    to plain java test
    + JDK-8209772: Refactor shell test java/util/ServiceLoader/
    /basic/basic.sh to java
    + JDK-8209773: Refactor shell test javax/naming/module/basic.sh
    to java
    + JDK-8209832: Refactor jdk/internal/reflect/Reflection/
    /GetCallerClassTest.sh to plain java test
    + JDK-8209930: Refactor java/util/zip/ZipFile/deletetempjar.sh
    to plain java test
    + JDK-8210406: Refactor java.util.PluggableLocale:i18n shell
    tests to plain java tests
    + JDK-8210407: Refactor java.util.Calendar:i18n shell tests to
    plain java tests
    + JDK-8210495: compiler crashes because of illegal signature in
    otherwise legal code
    + JDK-8210669: Some launcher tests assume a pre-JDK 9 run-time
    image layout
    + JDK-8210802: temp files left by tests in
    jdk/java/net/httpclient
    + JDK-8210819: Update the host name in CNameTest.java
    + JDK-8210908: Refactor java/util/prefs/PrefsSpi.sh to plain
    java test
    + JDK-8210934: Move sun/net/www/protocol/http/
    /GetErrorStream.java to OpenJDK
    + JDK-8210959: JShell fails and exits when statement throws an
    exception whose message contains a '%'.
    + JDK-8211055: Provide print to a file (PDF) feature even when
    printer was not connected
    + JDK-8211092: test/jdk/sun/net/www/http/HttpClient/
    /MultiThreadTest.java fails intermittently when cleaning up
    + JDK-8211296: Remove HotSpot deprecation warning suppression
    for Mac/clang
    + JDK-8211325: test/jdk/java/net/Socket/LingerTest.java fails
    with cleaning up
    + JDK-8212040: Compilation error due to wrong usage of
    NSPrintJobDispositionValue in mac10.12
    + JDK-8212695: Add explicit timeout to several HTTP Client tests
    + JDK-8212718: Refactor some annotation processor tests to
    better use collections
    + JDK-8213007: Update the link in test/jdk/sun/security/
    /provider/SecureRandom/DrbgCavp.java
    + JDK-8213137: Remove static initialization of monitor/mutex
    instances
    + JDK-8213235: java/nio/channels/SocketChannel/
    /AsyncCloseChannel.java fails with threads that didn't exit
    + JDK-8213409: Refactor sun.text.IntHashtable:i18n shell tests
    to plain java tests
    + JDK-8213576: Make test AsyncCloseChannel.java run in othervm
    + JDK-8213694: Test Timeout.java should run in othervm mode
    + JDK-8213718: [TEST] Wrong classname in vmTestbase/nsk/stress/
    /except/except002 and except003
    + JDK-8213922: fix ctw stand-alone build
    + JDK-8214195: Align stdout messages in
    test/jdk/java/math/BigInteger/PrimitiveConversionTests.java
    + JDK-8214520: [TEST_BUG] sun/security/mscapi/nonUniqueAliases/
    /NonUniqueAliases.java failed with incorrect jtreg tags order
    + JDK-8214937: sun/security/tools/jarsigner/warnings/
    /NoTimestampTest.java failed due to unexpected expiration date
    + JDK-8216532: tools/launcher/Test7029048.java fails (Solaris)
    + JDK-8217825: Verify @AfterTest is used correctly in WebSocket
    tests
    + JDK-8218145: block_if_requested is not proper inlined due to
    size
    + JDK-8219417: bump jtreg requiredVersion to b14
    + JDK-8219552: bump jtreg requiredVersion to b14 in
    test/jdk/sanity/client/
    + JDK-8219804: java/net/MulticastSocket/Promiscuous.java fails
    intermittently due to NumberFormatException
    + JDK-8220445: Support for side by side MSVC Toolset versions
    + JDK-8221988: add possibility to build with Visual Studio 2019
    + JDK-8222751: closed/test/jdk/sun/security/util/
    /DerIndefLenConverter/IndefBerPkcs12.java fail
    + JDK-8223050: JVMCI: findUniqueConcreteMethod() should not use
    Dependencies::find_unique_concrete_method() for non-virtual
    methods
    + JDK-8224853: CDS address sanitizer errors
    + JDK-8225082: Remove IdenTrust certificate that is expiring in
    September 2021
    + JDK-8225583: Examine the HttpResponse.BodySubscribers for
    null handling and multiple subscriptions
    + JDK-8225690: Multiple AttachListener threads can be created
    + JDK-8225790: Two NestedDialogs tests fail on Ubuntu
    + JDK-8226319: Add forgotten test/jdk/java/net/httpclient/
    /BodySubscribersTest.java
    + JDK-8226533: JVMCI: findUniqueConcreteMethod should handle
    statically bindable methods directly
    + JDK-8226602: Test convenience reactive primitives from
    java.net.http with RS TCK
    + JDK-8226683: Remove review suggestion from fix to 8219804
    + JDK-8227738: jvmti/DataDumpRequest/datadumpreq001 failed due
    to "exit code is 134"
    + JDK-8227766: CheckUnhandledOops is broken in MemAllocator
    + JDK-8227815: Minimal VM: set_state is not a member of
    AttachListener
    + JDK-8230674: Heap dumps should exclude dormant CDS archived
    objects of unloaded classes
    + JDK-8230808: Remove Access::equals()
    + JDK-8230841: Remove oopDesc::equals()
    + JDK-8231717: Improve performance of charset decoding when
    charset is always compactable
    + JDK-8232243: Wrong caret position in JTextPane on Windows
    with a screen resolution &gt; 100%
    + JDK-8232782: Shenandoah: streamline post-LRB CAS barrier
    (aarch64)
    + JDK-8233790: Forward output from heap dumper to jcmd/jmap
    + JDK-8233989: Create an IPv4 version of
    java/net/MulticastSocket/SetLoopbackMode.java
    + JDK-8234510: Remove file seeking requirement for writing a
    heap dump
    + JDK-8235211: serviceability/attach/
    /RemovingUnixDomainSocketTest.java fails with
    AttachNotSupportedException: Unable to open socket file
    + JDK-8235216: typo in test filename
    + JDK-8235866: bump jtreg requiredVersion to 4.2b16
    + JDK-8236111: narrow allowSmartActionArgs disabling
    + JDK-8236413: AbstractConnectTimeout should tolerate both
    NoRouteToHostException and UnresolvedAddressException
    + JDK-8236671: NullPointerException in JKS keystore
    + JDK-8238930: problem list compiler/c2/Test8004741.java
    + JDK-8238943: switch to jtreg 5.0
    + JDK-8240555: Using env of JAVA_TOOL_OPTIONS and _JAVA_OPTIONS
    breaks QuietOption.java test
    + JDK-8240983: Incorrect copyright header in Apache Santuario
    2.1.3 files
    + JDK-8241336: Some java.net tests failed with
    NoRouteToHostException on MacOS with special network
    configuration
    + JDK-8241353: NPE in ToolProvider.getSystemJavaCompiler
    + JDK-8241768: git needs .gitattributes
    + JDK-8242882: opening jar file with large manifest might throw
    NegativeArraySizeException
    + JDK-8244973: serviceability/attach/
    /RemovingUnixDomainSocketTest.java fails "stderr was not
    empty"
    + JDK-8245134: test/lib/jdk/test/lib/security/
    /KeyStoreUtils.java should allow to specify aliases
    + JDK-8246261: TCKLocalTime.java failed due to "AssertionError:
    expected [18:14:22] but found [18:14:23]"
    + JDK-8246387: switch to jtreg 5.1
    + JDK-8247421: [TESTBUG] ReturnBlobToWrongHeapTest.java failed
    allocating blob
    + JDK-8247469: getSystemCpuLoad() returns -1 on linux when some
    offline cpus are present and cpusets.effective_cpus is not
    available
    + JDK-8248352: [TEST_BUG] Test test/jdk/java/awt/font/
    /TextLayout/ArabicDiacriticTest.java can leave frame open
    + JDK-8248403: AArch64: Remove uses of kernel integer types
    + JDK-8248414: AArch64: Remove uses of long and unsigned long
    ints
    + JDK-8248657: Windows: strengthening in ThreadCritical
    regarding memory model
    + JDK-8248666: AArch64: Use THREAD_LOCAL instead of __thread
    + JDK-8248668: AArch64: Avoid MIN/MAX macros when using MSVC
    + JDK-8248671: AArch64: Remove unused variables
    + JDK-8248682: AArch64: Use ATTRIBUTE_ALIGNED helper
    + JDK-8248816: C1: Fix signature conflict in
    LIRGenerator::strength_reduce_multiply
    + JDK-8249095: tools/javac/launcher/SourceLauncherTest.java
    fails on Windows
    + JDK-8249548: backward focus traversal gets stuck in button
    group
    + JDK-8249773: Upgrade ReceiveISA.java test to be resilient to
    failure due to stray packets and interference
    + JDK-8249897: jdk/javadoc/tool/LangVers.java uses @ignore w/o
    bug-id
    + JDK-8249898: jdk/javadoc/tool/6176978/T6176978.java uses
    @ignore w/o bug-id
    + JDK-8249899: jdk/javadoc/tool/InlineTagsWithBraces.java uses
    @ignore w/o bug-id
    + JDK-8250588: Shenandoah: LRB needs to save/restore fp
    registers for runtime call
    + JDK-8250824: AArch64: follow up for JDK-8248414
    + JDK-8251166: Add automated testcases for changes done in
    JDK-8214112
    + JDK-8251252: Add automated testcase for fix done in
    JDK-8214253
    + JDK-8251254: Add automated test for fix done in JDK-8218472
    + JDK-8251361: Potential race between Logger configuration and
    GCs in HttpURLConWithProxy test
    + JDK-8251549: Update docs on building for Git
    + JDK-8251945: SIGSEGV in
    PackageEntry::purge_qualified_exports()
    + JDK-8252194: Add automated test for fix done in JDK-8218469
    + JDK-8252648: Shenandoah: name gang tasks consistently
    + JDK-8252825: Add automated test for fix done in JDK-8218479
    + JDK-8252853: AArch64: gc/shenandoah/TestVerifyJCStress.java
    fails intermittently with C1
    + JDK-8252857: AArch64: Shenandoah C1 CAS is not sequentially
    consistent
    + JDK-8253048: AArch64: When CallLeaf, no need to preserve
    callee-saved registers in caller
    + JDK-8253424: Add support for running pre-submit testing using
    GitHub Actions
    + JDK-8253631: Remove unimplemented CompileBroker methods after
    JEP-165
    + JDK-8253865: Pre-submit testing using GitHub Actions does not
    detect failures reliably
    + JDK-8253899: Make IsClassUnloadingEnabled signature match
    specification
    + JDK-8254024: Enhance native libs for AWT and Swing to work
    with GraalVM Native Image
    + JDK-8254054: Pre-submit testing using GitHub Actions should
    not use the deprecated set-env command
    + JDK-8254173: Add Zero, Minimal hotspot targets to submit
    workflow
    + JDK-8254175: Build no-pch configuration in debug mode for
    submit checks
    + JDK-8254244: Some code emitted by TemplateTable::branch is
    unused when running TieredCompilation
    + JDK-8254270: linux 32 bit build doesn't compile
    libjdwp/log_messages.c
    + JDK-8254282: Add Linux x86_32 builds to submit workflow
    + JDK-8254850: Update terminology in java.awt.GridBagLayout
    source code comments
    + JDK-8255255: Update Apache Santuario (XML Signature) to
    version 2.2.1
    + JDK-8255305: Add Linux x86_32 tier1 to submit workflow
    + JDK-8255352: Archive important test outputs in submit workflow
    + JDK-8255373: Submit workflow artifact name is always
    "test-results_.zip"
    + JDK-8255452: Doing GC during JVMTI MethodExit event posting
    breaks return oop
    + JDK-8255718: Zero: VM should know it runs in interpreter-only
    mode
    + JDK-8255790: GTKL&amp;F: Java 16 crashes on initialising GTKL&amp;F
    on Manjaro Linux
    + JDK-8255810: Zero: build fails without JVMTI
    + JDK-8255895: Submit workflow artifacts miss hs_errs/replays
    due to ZIP include mismatch
    + JDK-8256127: Add cross-compiled foreign architectures builds
    to submit workflow
    + JDK-8256215: Shenandoah: re-organize saving/restoring machine
    state in assembler code
    + JDK-8256267: Relax compiler/floatingpoint/NaNTest.java for
    x86_32 and lower -XX:+UseSSE
    + JDK-8256277: Github Action build on macOS should define OS
    and Xcode versions
    + JDK-8256354: Github Action build on Windows should define OS
    and MSVC versions
    + JDK-8256393: Github Actions build on Linux should define OS
    and GCC versions
    + JDK-8256414: add optimized build to submit workflow
    + JDK-8256747: GitHub Actions: decouple the hotspot build-only
    jobs from Linux x64 testing
    + JDK-8257056: Submit workflow should apt-get update to avoid
    package installation errors
    + JDK-8257148: Remove obsolete code in AWTView.m
    + JDK-8257497: Update keytool to create AKID from the SKID of
    the issuing certificate as specified by RFC 5280
    + JDK-8257620: Do not use objc_msgSend_stret to get macOS
    version
    + JDK-8257913: Add more known library locations to simplify
    Linux cross-compilation
    + JDK-8258703: Incorrect 512-bit vector registers restore on
    x86_32
    + JDK-8259338: Add expiry exception for identrustdstx3 alias to
    VerifyCACerts.java test
    + JDK-8259535: ECDSA SignatureValue do not always have the
    specified length
    + JDK-8259679: GitHub actions should use MSVC 14.28
    + JDK-8259924: GitHub actions fail on Linux x86_32 with "Could
    not configure libc6:i386"
    + JDK-8260460: GitHub actions still fail on Linux x86_32 with
    "Could not configure libc6:i386"
    + JDK-8260589: Crash in JfrTraceIdLoadBarrier::load(_jclass*)
    + JDK-8260923: Add more tests for SSLSocket input/output
    shutdown
    + JDK-8261072: AArch64: Fix MacroAssembler::get_thread
    convention
    + JDK-8261147: C2: Node is wrongly marked as reduction
    resulting in a wrong execution due to wrong vector instructions
    + JDK-8261238: NMT should not limit baselining by size threshold
    + JDK-8261496: Shenandoah: reconsider pacing updates memory
    ordering
    + JDK-8261652: Remove some dead comments from os_bsd_x86
    + JDK-8261846: [JVMCI] c2v_iterateFrames can get out of sync
    with the StackFrameStream
    + JDK-8262000: jdk/jfr/event/gc/detailed/
    /TestPromotionFailedEventWithParallelScavenge.java failed with
    "OutOfMemoryError: Java heap space"
    + JDK-8262017: C2: assert(n != __null) failed: Bad immediate
    dominator info.
    + JDK-8262392: Update Mesa 3-D Headers to version 21.0.3
    + JDK-8262409: sun/security/ssl/SSLSocketImpl/
    /SSLSocketImplThrowsWrongExceptions. SSL test failures caused
    by java failed with "Server reported the wrong exception"
    + JDK-8262470: Printed GlyphVector outline with low DPI has bad
    quality on Windows
    + JDK-8262862: Harden tests sun/security/x509/URICertStore/
    /ExtensionsWithLDAP.java and krb5/canonicalize/Test.java
    + JDK-8263136: C4530 was reported from VS 2019 at access bridge
    + JDK-8263227: C2: inconsistent spilling due to dead nodes in
    exception block
    + JDK-8263382: java/util/logging/ParentLoggersTest.java failed
    with "checkLoggers: getLoggerNames() returned unexpected
    loggers"
    + JDK-8263407: SPARC64 detection fails on Athena (SPARC64-X)
    + JDK-8263432: javac may report an invalid package/class clash
    on case insensitive filesystems
    + JDK-8263490: [macos] Crash occurs on JPasswordField with
    activated InputMethod
    + JDK-8263531: Remove unused buffer int
    + JDK-8263667: Avoid running GitHub actions on branches named
    pr/*
    + JDK-8263776: [JVMCI] add helper to perform Java upcalls
    + JDK-8264016: [JVMCI] add some thread local fields for use by
    JVMCI
    + JDK-8264752: SIGFPE crash with option
    FlightRecorderOptions:threadbuffersize=30M
    + JDK-8265132: C2 compilation fails with assert "missing
    precedence edge"
    + JDK-8265231: (fc) ReadDirect and WriteDirect tests fail after
    fix for JDK-8264821
    + JDK-8265335: Epsilon: Minor typo in EpsilonElasticTLABDecay
    description
    + JDK-8265756: AArch64: initialize memory allocated for locals
    according to Windows AArch64 stack page growth requirement in
    template interpreter
    + JDK-8265761: Font with missed font family name is not
    properly printed on Windows
    + JDK-8265773: incorrect jdeps message "jdk8internals" to
    describe a removed JDK internal API
    + JDK-8265836: OperatingSystemImpl.getCpuLoad() returns
    incorrect CPU load inside a container
    + JDK-8266018: Shenandoah: fix an incorrect assert
    + JDK-8266206: Build failure after JDK-8264752 with older GCCs
    + JDK-8266248: Compilation failure in
    PLATFORM_API_MacOSX_MidiUtils.c with Xcode 12.5
    + JDK-8266288: assert root method not found in
    witnessed_reabstraction_in_supers is too strong
    + JDK-8266404: Fatal error report generated with
  - XX:+CrashOnOutOfMemoryError should not contain suggestion to
    submit a bug report
    + JDK-8266480: Implicit null check optimization does not update
    control of hoisted memory operation
    + JDK-8266615: C2 incorrectly folds subtype checks involving an
    interface array
    + JDK-8266642: Improve ResolvedMethodTable hash function
    + JDK-8266749: AArch64: Backtracing broken on PAC enabled
    systems
    + JDK-8266761: AssertionError in
    sun.net.httpserver.ServerImpl.responseCompleted
    + JDK-8266813: Shenandoah: Use shorter instruction sequence for
    checking if marking in progress
    + JDK-8267042: bug in monitor locking/unlocking on ARM32 C1 due
    to uninitialized BasicObjectLock::_displaced_header
    + JDK-8267348: Rewrite gc/epsilon/TestClasses.java to use
    Metaspace with less classes
    + JDK-8267396: Avoid recording "pc" in unhandled oops detector
    for better performance
    + JDK-8267399: C2: java/text/Normalizer/ConformanceTest.java
    test failed with assertion
    + JDK-8267424: CTW: C1 fails with "State must not be null"
    + JDK-8267459: Pasting Unicode characters into JShell does not
    work.
    + JDK-8267625: AARCH64: typo in LIR_Assembler::emit_profile_type
    + JDK-8267666: Add option to jcmd GC.heap_dump to use existing
    file
    + JDK-8267695: Bump update version for OpenJDK: jdk-11.0.13
    + JDK-8267751: (test) jtreg.SkippedException has no serial
    VersionUID
    + JDK-8267773: PhaseStringOpts::int_stringSize doesn't handle
    min_jint correctly
    + JDK-8268103: JNI functions incorrectly return a double after
    JDK-8265836
    + JDK-8268127: Shenandoah: Heap size may be too small for
    region to align to large page size
    + JDK-8268261: C2: assert(n != __null) failed: Bad immediate
    dominator info.
    + JDK-8268347: C2: nested locks optimization may create
    unbalanced monitor enter/exit code
    + JDK-8268360: Missing check for infinite loop during node
    placement
    + JDK-8268362: [REDO] C2 crash when compile negative
    Arrays.copyOf length after loop
    + JDK-8268366: Incorrect calculation of has_fpu_registers in C1
    linear scan
    + JDK-8268369: SIGSEGV in PhaseCFG::implicit_null_check due to
    missing null check
    + JDK-8268417: Add test from JDK-8268360
    + JDK-8268427: Improve AlgorithmConstraints:checkAlgorithm
    performance
    + JDK-8268617: [11u REDO] - WebSocket over authenticating proxy
    fails with NPE
    + JDK-8268620: InfiniteLoopException test may fail on x86
    platforms
    + JDK-8268635: Corrupt oop in ClassLoaderData
    + JDK-8268699: Shenandoah: Add test for JDK-8268127
    + JDK-8268771: javadoc -notimestamp option does not work on
    index.html
    + JDK-8268775: Password is being converted to String in
    AccessibleJPasswordField
    + JDK-8268776: Test `ADatagramSocket.java` missing /othervm
    from @run tag
    + JDK-8268965: TCP Connection Reset when connecting simple
    socket to SSL server
    + JDK-8269304: Regression ~5% in 2005 in b27
    + JDK-8269415: [11u] Remove ea from
    DEFAULT_PROMOTED_VERSION_PRE in OpenJDK 11u
    + JDK-8269478: Shenandoah: gc/shenandoah/mxbeans tests should
    be more resilient
    + JDK-8269529: javax/swing/reliability/
    /HangDuringStaticInitialization.java fails in Windows debug
    build
    + JDK-8269594: assert(_handle_mark_nesting &gt; 1) failed: memory
    leak: allocating handle outside HandleMark
    + JDK-8269614: [s390] Interpreter checks wrong bit for slow
    path instance allocation
    + JDK-8269650: Optimize gc-locker in
    [Get|Release]StringCritical for latin string
    + JDK-8269661: JNI_GetStringCritical does not lock char array
    + JDK-8269668: [aarch64] java.library.path not including
    /usr/lib64
    + JDK-8269763: The JEditorPane is blank after JDK-8265167
    + JDK-8269795: C2: Out of bounds array load floats above its
    range check in loop peeling resulting in SEGV
    + JDK-8269847: JDK-8269594 backport breaks 11u builds
    + JDK-8269850: Most JDK releases report macOS version 12 as
    10.16 instead of 12.0
    + JDK-8269851: OperatingSystemMXBean getProcessCpuLoad reports
    incorrect process cpu usage in containers
    + JDK-8269882: stack-use-after-scope in NewObjectA
    + JDK-8269934: RunThese24H.java failed with
    EXCEPTION_ACCESS_VIOLATION in
    java_lang_Thread::get_thread_status
    + JDK-8270096: Shenandoah: Optimize gc/shenandoah/
    /TestRefprocSanity.java for interpreter mode
    + JDK-8270137: Kerberos Credential Retrieval from Cache not
    Working in Cross-Realm Setup
    + JDK-8270184: [TESTBUG] Add coverage for jvmci
    ResolvedJavaType.toJavaName() for lambdas
    + JDK-8270196: [11u] [JVMCI] JavaType.toJavaName() returns
    incorrect type name for lambdas
    + JDK-8270556: Exclude security/infra/java/security/cert/
    /CertPathValidator/certification/LetsEncryptCA
    + JDK-8270893: IndexOutOfBoundsException while reading large
    TIFF file
    + JDK-8272078: Wrong Checksums in Temurin BootJDK dependencies
    + JDK-8272124: Cgroup v1 initialization causes
    NullPointerException when cgroup path contains colon
    + JDK-8272131: PhaseMacroExpand::generate_slow_arraycopy crash
    when clone null CallProjections.fallthrough_ioproj
    + JDK-8272197: Update 11u GHA workflow with Shenandoah
    configurations
    + JDK-8272332: --with-harfbuzz=system doesn't add -lharfbuzz
    after JDK-8255790
    + JDK-8272472: StackGuardPages test doesn't build with glibc
    2.34
    + JDK-8272602: [macos] not all KEY_PRESSED events sent when
    control modifier is used
    + JDK-8272628: Problemlist gc/stress/gcbasher/
    /TestGCBasherWithCMS.java for x86_32
    + JDK-8272700: [macos] Build failure with Xcode 13.0 after
    JDK-8264848
    + JDK-8272772: Shenandoah: compiler/c2/aarch64/
    /TestVolatilesShenandoah.java fails in 11u
    + JDK-8273939: Backport of 8248414 to JDK11 breaks
    MacroAssembler::adrp
- Remove the unneeded icedtea-sound provider
- Removed patches:
  * icedtea-sound-1.0.1-jdk9.patch
  * icedtea-sound-soundproperties.patch
    + not needed since the icedtea-sound provider is removed
  * jdk11-glibc234.patch
    + integrated upstream</changelog>
  <changelog author="fstrba@suse.com" date="1635940800">- Modified patches:
  * system-crypto-policy.patch
    + rediff to changed context
  * fips.patch
    + Allow plain key import in fips mode unless
    com.suse.fips.plainKeySupport is set to false</changelog>
  <changelog author="fstrba@suse.com" date="1636113600">- Modified patch:
  * fips.patch
    + return in native code after generating java.io.IOException</changelog>
</package>
<package pkgid="1dcdb99cad74fa461ab553465b21a15cc5a3244e0fcea7ef0d8bbf6c38a47101" name="java-11-openjdk-src" arch="aarch64">
  <version epoch="0" ver="11.0.13.0" rel="3.68.1"/>
  <changelog author="fstrba@suse.com" date="1586952000">- The pack200 and unpack200 alternatives should be slaves of java
  and not of javac, since they are part of JRE.</changelog>
  <changelog author="fstrba@suse.com" date="1587470400">- Update to upstream tag jdk-11.0.7+10 (April 2020 CPU,
  bsc#1169511)
  * Security fixes:
    + S8223898, CVE-2020-2754: Forward references to Nashorn
    + S8223904, CVE-2020-2755: Improve Nashorn matching
    + S8224541, CVE-2020-2756: Better mapping of serial ENUMs
    + S8224549, CVE-2020-2757: Less Blocking Array Queues
    + S8225603: Enhancement for big integers
    + S8226346: Build better binary builders
    + S8227467: Better class method invocations
    + S8227542: Manifest improved jar headers
    + S8229733: TLS message handling improvements
    + S8231415, CVE-2020-2773: Better signatures in XML
    + S8231785: Improved socket permissions
    + S8232424, CVE-2020-2778: More constrained algorithms
    + S8232581, CVE-2020-2767: Improve TLS verification
    + S8233250: Better X11 rendering
    + S8233410: Better Build Scripting
    + S8234027: Better JCEKS key support
    + S8234408, CVE-2020-2781: Improve TLS session handling
    + S8234825, CVE-2020-2800: Better Headings for HTTP Servers
    + S8234841, CVE-2020-2803: Enhance buffering of byte buffers
    + S8235274, CVE-2020-2805: Enhance typing of methods
    + S8235691, CVE-2020-2816: Enhance TLS connectivity
    + S8236201, CVE-2020-2830: Better Scanner conversions
    + S8238960: linux-i586 builds are inconsistent as the newly
    built jdk is not able to reserve enough space for object heap
  * Other changes:
    + S4919790: Errors in alert ssl message does not reflect the
    actual certificate status
    + S4949105: Access Bridge lacks html tags parsing
    + S7092821: java.security.Provider.getService() is synchronized
    and became scalability bottleneck
    + S7143743: Potential memory leak with zip provider
    + S8005819: Support cross-realm MSSFU
    + S8042383: [TEST_BUG] Test javax/swing/plaf/basic/BasicMenuUI/
    /4983388/bug4983388.java fails with shortcuts on menus do not
    work
    + S8068184: Fix for JDK-8032832 caused a deadlock
    + S8145845: [AOT] NullPointerException in
    compiler/whitebox/GetCodeHeapEntriesTest.java
    + S8152988: [AOT] Update test batch definitions to include
    aot-ed java.base module mode into hs-comp testing
    + S8160926: FLAGS_COMPILER_CHECK_ARGUMENTS doesn't handle
    cross-compilation
    + S8163083: SocketListeningConnector does not allow invocations
    with port 0
    + S8163251: Hard coded loop limit prevents reading of smart
    card data greater than 8k
    + S8167276: jvmci/compilerToVM/MaterializeVirtualObjectTest.java
    fails with -XX:-EliminateAllocations
    + S8169718: nsk/jdb/locals/locals002: ERROR: Cannot find
    boolVar with expected value: false
    + S8176556:
    java/awt/dnd/ImageTransferTest/ImageTransferTest.java fails
    for JFIF
    + S8178798: Two compiler/aot/verification/vmflags tests fail by
    timeout with UseAVX=3
    + S8183107: PKCS11 regression regarding checkKeySize
    + S8185005: Improve performance of
    ThreadMXBean.getThreadInfo(long ids[], int maxDepth)
    + S8189633: Missing -Xcheck:jni checking for DeleteWeakGlobalRef
    + S8189861: Refactor CacheFind
    + S8193042: NativeLookup::lookup_critical_entry() should only
    load shared library once
    + S8193596: java/net/DatagramPacket/ReuseBuf.java failed due to
    timeout
    + S8194944: Regression automated test 'open/test/jdk/javax/
    /swing/JInternalFrame/8145896/TestJInternalFrameMaximize.java'
    fails
    + S8196467: javax/swing/JInternalFrame/Test6325652.java fails
    + S8196969: JTreg Failure: serviceability/sa/ClhsdbJstack.java
    causes NPE
    + S8198321: javax/swing/JEditorPane/5076514/bug5076514.java
    fails
    + S8198398: Test javax/swing/JColorChooser/Test6199676.java
    fails in mach5
    + S8199072: Test javax/swing/GroupLayout/6613904/
    /bug6613904.java is unstable
    + S8200432: javadoc fails with ClassCastException on {@link
    byte[]}
    + S8201349: build broken when configured with
  - -with-zlib=bundled on gcc 7.3
    + S8201355: Avoid native memory allocation in
    sun.security.mscapi.PRNG.generateSeed
    + S8201513: nsk/jvmti/IterateThroughHeap/filter-* are broken
    + S8203364: Some serviceability/sa/ tests intermittently fail
    with java.io.IOException: LingeredApp terminated with non-zero
    exit code 3
    + S8203687: javax/net/ssl/compatibility/Compatibility.java
    supports TLS 1.3
    + S8203904: javax/swing/JSplitPane/4816114/bug4816114.java: The
    divider location is wrong
    + S8203911: Test runtime/modules/getModuleJNI/GetModule fails
    with -Xcheck:jni
    + S8204525: [TESTBUG] runtime/NMT/MallocStressTest.java ran out
    of java heap
    + S8204529: gc/TestAllocateHeapAtMultiple.java fail with Agent
    7 timed out
    + S8204551: Event descriptions are truncated in logs
    + S8206963: [AOT] bug with multiple class loaders
    + S8207367: 10 vmTestbase/nsk/jdi tests timed out when running
    with jtreg
    + S8207832: serviceability/sa/ClhsdbCDSCore.java failed with
    "Couldn't find core file location"
    + S8207938: At step6,Click Add button,case failed automatically.
    + S8208157: requires.VMProps throws NPE for missing properties
    in "release" file
    + S8208379: compiler/jvmci/events/
    /JvmciNotifyInstallEventTest.java failed with "Got unexpected
    event count after 2nd install attempt: expected 9 to equal 2"
    + S8208658: Make CDS archived heap regions usable even if
    compressed oop encoding has changed
    + S8208715: Conversion of milliseconds to nanoseconds in
    UNIXProcess contains bug
    + S8209361: [AOT] Unexpected number of references for
    JVMTI_HEAP_REFERENCE_CONSTANT_POOL [111--&gt;111]: 0 (expected
    at least 1)
    + S8209385: CDS runtime classpath checking is too strict when
    only classes from the system modules are archived
    + S8209389: SIGSEGV in WalkOopAndArchiveClosure::do_oop_work.
    + S8209418: Synchronize test/jdk/sanity/client/lib/jemmy with
    code-tools/jemmy/v2
    + S8209494: Create a test for SwingSet InternalFrameDemo
    + S8209499: Create test for SwingSet EditorPaneDemo
    + S8209574: [AOT] breakpoint events are generated in different
    threads does not meet expected count
    + S8209686: cleanup arguments to PhaseIdealLoop() constructor
    + S8209789: Synchronize test/jdk/sanity/client/lib/jemmy with
    code-tools/jemmy/v2
    + S8209802: Garbage collectors should register JFR types
    themselves to avoid build errors.
    + S8209807: improve handling exception in requires.VMProps
    + S8209817: stack is executable when building with Clang on
    Linux
    + S8209824: Improve the code coverage for ThreadLocal
    + S8209826: Undefined reference to os::write after JDK-8209657
    (filemap.hpp cleanup)
    + S8209850: Allow NamedThreads to use GlobalCounter critical
    sections
    + S8209976: Improve iteration over non-JavaThreads
    + S8209993: Create a test for SwingSet3 ToolTipDemo
    + S8210024: JFR calls virtual is_Java_thread from ~Thread()
    + S8210052: Enable testing for all the available look and feels
    in SwingSet3 demo tests
    + S8210055: Enable different look and feel tests in SwingSet3
    demo tests
    + S8210057: Enable different look and feels in SwingSet3 demo
    test InternalFrameDemoTest
    + S8210058: Algorithmic Italic font leans opposite angle in
    Printing
    + S8210220: [AOT] jdwp test cases are failing with error #
    ERROR: TEST FAILED: Cought IOException while receiving event
    packet
    + S8210289: ArchivedKlassSubGraphInfoRecord is incomplete
    + S8210459: Add support for generating compile_commands.json
    + S8210476: sun/security/mscapi/PrngSlow.java fails with Still
    too slow
    + S8210512: [Testbug] vmTestbase/nsk/jdi/ObjectReference/
    /referringObjects/referringObjects002/referringObjects002.java
    fails with unexpected size of
    ClassLoaderReference.referringObjects
    + S8210523: runtime/appcds/cacheObject/DifferentHeapSizes.java
    crash
    + S8210632: Add key exchange algorithm to
    javax/net/ssl/TLSCommon/CipherSuite.java
    + S8210699: Problem list tests which times out in Xcomp mode
    + S8210793: [JVMCI] AllocateCompileIdTest.java failed to find
    DiagnosticCommand.class
    + S8210910: Create test for FileChooserDemo
    + S8210994: Create test for SwingSet3 FrameDemo
    + S8211139: Increase timeout value in all tests under
    jdk/sanity/client/SwingSet/src
    + S8211160: Handle different look and feels in
    JInternalFrameOperator
    + S8211211: vmTestbase/metaspace/stressDictionary/
    /StressDictionary.java timeout
    + S8211322: Reduce the timeout of tooltip in SwingSet2DemoTest
    + S8211443: Enable different look and feels in SwingSet3 demo
    test SplitPaneDemoTest
    + S8211703: JInternalFrame : java.lang.AssertionError: cannot
    find the internal frame
    + S8211781: re-building fails after changing Graal sources
    + S8212897: Some improvements in the EditorPaneDemotest
    + S8212903: [TestBug] Tests test/jdk/javax/swing/LookAndFeel/
    /8145547/DemandGTK2.sh and DemandGTK3.sh fail on Ubuntu 18.04
    LTS
    + S8213009: Refactoring existing SunMSCAPI classes
    + S8213010: Supporting keys created with certmgr.exe
    + S8213168: Enable different look and feel tests in SwingSet3
    demo test FileChooserDemoTest
    + S8213348: jdk.internal.vm.compiler.management service
    providers missing in module descriptor
    + S8213906: Update arm devkits with libXrandr headers
    + S8213908: AssertionError in DeferredAttr at setOverloadKind
    + S8214124: [TESTBUG] Bugs in runtime/NMT/MallocStressTest.java
    + S8214344: C2: assert(con.basic_type() != T_ILLEGAL) failed:
    elembt=byte; loadbt=void; unsigned=0
    + S8214345: infinite recursion while checking super class
    + S8214471: Enable different look and feel tests in SwingSet3
    demo test ToolTipDemoTest
    + S8214534: Setting of THIS_FILE in the build is broken
    + S8214557: Filter out VM flags which don't affect AOT code
    generation
    + S8214578: [macos] Problem with backslashes on macOS/JIS
    keyboard: Java ignores system settings
    + S8214840: runtime/NMT/MallocStressTest.java timed out
    + S8214850: Rename vm_operations.?pp files to vmOperations.?pp
    files
    + S8214904: Test8004741.java failed due to "Too few ThreadDeath
    hits; expected at least 6 but saw only 5"
    + S8215322: add @file support to jaotc
    + S8215355: Object monitor deadlock with no threads holding the
    monitor (using jemalloc 5.1)
    + S8215396: JTabbedPane preferred size calculation is wrong for
    SCROLL_TAB_LAYOUT
    + S8216180: [AOT] compiler/intrinsics/bigInteger/TestMulAdd.java
    crashed with AOT enabled
    + S8216353: Use utility APIs introduced in org/netbeans/jemmy/
    /util/LookAndFeel class in client sanity test cases
    + S8216354: Syntax error in toolchain_windows.m4
    + S8216472: (se) Stack overflow during selection operation
    leads to crash (win)
    + S8216535: tools/jimage/JImageExtractTest.java timed out
    + S8217235: Create automated test for SwingSet
    ColorChooserDemoTest
    + S8217297: Add support for multiple look and feel for SwingSet
    SliderDemoTest
    + S8217338: [Containers] Improve systemd slice memory limit
    support
    + S8217613: [AOT] TEST_OPTS_AOT_MODULES doesn't work on mac
    + S8217634: RunTest documentation and usability update
    + S8217717: ZGC: Broken oop map in C1 load barrier stub
    + S8217728: Speed up incremental rerun of "make hotspot"
    + S8218268: Javac treats Manifest Class-Path entries as Paths
    instead of URLs
    + S8218662: Allow 204 responses with Content-Length:0
    + S8218882: NET_Writev is declared, NET_WriteV is defined
    + S8218889: Improperly use of the Optional API
    + S8219205: JFR file without license header
    + S8219597: (bf) Heap buffer state changes could provoke
    unexpected exceptions
    + S8219723: javax/net/ssl/compatibility/Compatibility.java
    failed on some SNI cases
    + S8220348: [ntintel] asserts about copying unaligned array
    + S8220451: jdi/EventQueue/remove/remove004 failed due to
    "ERROR: thread2 is not alive"
    + S8220456: jdi/EventQueue/remove_l/remove_l004 failed due to
    "TIMEOUT while waiting for event"
    + S8220479: java/nio/channels/Selector/SelectWithConsumer.java
    failed at testTwoChannels()
    + S8220613: java/util/Arrays/TimSortStackSize2.java times out
    with fastdebug build
    + S8220688: [TESTBUG] runtime/NMT/MallocStressTest.java timed
    out
    + S8220786: Create new switch to redirect error reporting
    output to stdout or stderr
    + S8221270: Duplicated synchronized keywords in SSLSocketImpl
    + S8221312: test/jdk/sanity/client/SwingSet/src/
    /ColorChooserDemoTest.java failed
    + S8221851: Use of THIS_FILE in hotspot invalidates precompiled
    header on Linux/GCC
    + S8221885: Add intermittent test in the JavaSound to the
    ProblemList
    + S8222264: Windows incremental build is broken with JDK-8217728
    + S8222391: javax/net/ssl/compatibility/Compatibility.java
    should be more flexible
    + S8222448: java/lang/reflect/PublicMethods/
    /PublicMethodsTest.java times out
    + S8222519: ButtonDemoScreenshotTest fails randomly with "still
    state to be reached"
    + S8222741: jdi/EventQueue/remove/remove004 fails due to
    VMDisconnectedException
    + S8223003: SunMSCAPI keys are not cleaned up
    + S8223063: Support CNG RSA keys
    + S8223158: Docked MacBook cannot start any Java Swing
    applications
    + S8223260: NamingManager should cache InitialContextFactory
    + S8223464: Improve version string for Oracle CI builds
    + S8223558: Java does not render Myanmar script correctly
    + S8223627: jdk-13+20 bundle name contains null instead of ea
    + S8223638: Replace wildcard address with loopback or local
    host in tests - part 6
    + S8223678: Add Visual Studio Code workspace generation support
    (for native code)
    + S8223727: com/sun/jndi/ldap/privconn/RunTest.java failed due
    to hang in LdapRequest.getReplyBer
    + S8223769: Assert triggers with -XX:+StressReflectiveCode
    + S8224187: Refactor arraycopy_prologue to allow ZGC read
    barriers on arraycopy
    + S8224475: JTextPane does not show images in HTML rendering
    + S8224673: Adjust permission for delayed starting of debugging
    + S8224705: Tests that need to be problem-listed or have
    printer resources
    + S8224778: test/jdk/demo/jfc/J2Ddemo/J2DdemoTest.java cannot
    find J2Ddemo.jar
    + S8224821: java/awt/Focus/NoAutotransferToDisabledCompTest/
    /NoAutotransferToDisabledCompTest.java fails linux-x64
    + S8224830: test/jdk/java/awt/Focus/
    /ModalExcludedWindowClickTest/
    /ModalExcludedWindowClickTest.java fails on linux-x64
    + S8224851: AArch64: fix warnings and errors with Clang and GCC
    8.3
    + S8224905: java/lang/ProcessBuilder/Basic.java#id1 failed with
    stream closed
    + S8225007: java/awt/print/PrinterJob/
    /LandscapeStackOverflow.java may hang
    + S8225105: java/awt/Focus/ShowFrameCheckForegroundTest/
    /ShowFrameCheckForegroundTest.java fails in Windows 10
    + S8225117: java/math/BigInteger/SymmetricRangeTests.java fails
    with ParseException
    + S8225128: Add exception for expiring DocuSign root to
    VerifyCACerts test
    + S8225130: Add exception for expiring Comodo roots to
    VerifyCACerts test
    + S8225144: [macos] In Aqua L&amp;F backspace key does not delete
    when Shift is pressed
    + S8225180: SignedObject with invalid Key not throwing the
    InvalidKeyException in Windows
    + S8225182: JNI exception pending in DestroyXIMCallback of
    awt_InputMethod.c:1327
    + S8225199: [Graal] compiler/jvmci/compilerToVM/
    /IsMatureVsReprofileTest.java fails with
  - XX:CompileThresholdScaling=0.1
    + S8225305: ProblemList java/lang/invoke/VarHandles tests
    + S8225350: compiler/jvmci/compilerToVM/IsCompilableTest.java
    timed out
    + S8225430: Replace wildcard address with loopback or local
    host in tests - part 14
    + S8225435: Upgrade IANA Language Subtag Registry to the latest
    for JDK14
    + S8225487: giflib legal file is missing attribution for
    openbsd-reallocarray.c
    + S8225567: Wrong file headers with 8202414 fix changeset
    + S8225684: [AOT] vmTestbase/vm/oom/production/
    /AlwaysOOMProduction tests fail with AOTed java.base
    + S8225766: Curve in certificate should not affect signature
    scheme when using TLSv1.3
    + S8225797: OldObjectSample event creates unexpected amount of
    checkpoint data
    + S8226381: ProblemList java/lang/reflect/PublicMethods/
    /PublicMethodsTest.java
    + S8226406: JVM fails to detect mismatched or corrupt CDS
    archive
    + S8226608: Hide the onjcmd option from the help output
    + S8226892: ActionListeners on JRadioButtons don't get notified
    when selection is changed with arrow keys
    + S8227112: exclude compiler/intrinsics/sha/sanity tests from
    AOT runs
    + S8227324: Upgrade to freetype 2.10.1
    + S8227528: TestAbortVMOnSafepointTimeout.java failed due to
    "RuntimeException: 'Safepoint sync time longer than' missing
    from stdout/stderr"
    + S8227645: Some tests in serviceability/sa run with fixed -Xmx
    values and risk running out of memory
    + S8227646: [TESTBUG] appcds/SharedArchiveConsistency timed out
    + S8227662: freetype seeks to index at the end of the font data
    + S8228479: Correct the format of ColorChooserDemoTest
    + S8228613: java.security.Provider#getServices order is no
    longer deterministic
    + S8228969: 2019-09-28 public suffix list update
    + S8229236: CriticalJNINatives: dll handling should be done in
    native thread state
    + S8229345: Memory leak due to vtable stubs not being shared on
    SPARC
    + S8229888: (zipfs) Updating an existing zip file does not
    preserve original permissions
    + S8229994: assert(false) failed: Bad graph detected in
    get_early_ctrl_for_expensive
    + S8230004: jdk/internal/jimage/JImageOpenTest.java runs no test
    + S8230235: Rendering HTML with empty img attribute and
    documentBaseKey cause Exception
    + S8230390: Problemlist SA tests with AOT
    + S8230400: Missing constant pool entry for a method in
    stacktrace
    + S8230459: Test failed to resume JVMCI CompilerThread
    + S8230480: check malloc/calloc results in java.desktop
    + S8230597: Update GIFlib library to the 5.2.1
    + S8230611: infinite loop in
    LogOutputList::wait_until_no_readers()
    + S8230624: [TESTBUG] Problemlist JFR
    compiler/TestCodeSweeper.java
    + S8230677: Should disable Escape Analysis if JVMTI capability
    can_get_owned_monitor_info was taken
    + S8230926: [macosx] Two apostrophes are entered instead of one
    with "U.S. International - PC" layout
    + S8231025: Incorrect method tag offset for big endian platform
    + S8231081: TestMetadataRetention fails due to missing symbol id
    + S8231387: java.security.Provider.getService returns random
    result due to race condition with mutating methods in the same
    class
    + S8231430: C2: Memory stomp in max_array_length() for
    T_ILLEGAL type
    + S8231445: check ZALLOC return values in awt coding
    + S8231507: Update Apache Santuario (XML Signature) to version
    2.1.4
    + S8231584: Deadlock with ClassLoader.findLibrary and
    System.loadLibrary call
    + S8231753: use more Posix functionality in aix
    os::print_os_info
    + S8231810: javax/net/ssl/templates/
    /SSLSocketSSLEngineTemplate.java fails intermittently with
    "java.lang.Exception: Unexpected EOF"
    + S8232003: (fs) Files.write can leak file descriptor in the
    exception case
    + S8232056: GetOwnedMonitorInfoWithEATest.java fails with ZGC:
    Heap too small
    + S8232060: add some initializations using sigemptyset in
    os_aix.cpp
    + S8232154: Update Mesa 3-D Headers to version 19.2.1
    + S8232167: Visual Studio install found through
  - -with-tools-dir value is discarded
    + S8232170: FSInfo#getJarClassPath throws an exception not
    declared in its throws clause
    + S8232200: [macos 10.15] Windows in fullscreen tests jumps
    around the screen
    + S8232207: Linux os::available_memory re-reads cgroup
    configuration on every invocation
    + S8232224: [TESTBUG] problemlist JFR TestLargeRootSet.java
    + S8232370: Refactor some com.sun.jdi tests to enable IDE
    integration
    + S8232433: [macos 10.15] java/awt/Window/
    /LocationAtScreenCorner/LocationAtScreenCorner.java may fail
    + S8232571: Add missing SIGINFO signal
    + S8232692: [TESTBUG] compiler/aot/fingerprint/
    /SelfChangedCDS.java fails when cds is disabled
    + S8232713: Update BCEL version to 6.3.1 in license file
    + S8232806: Introduce a system property to disable eager lambda
    initialization
    + S8232834: RunTest sometimes fails to produce valid
    exitcode.txt
    + S8232880: Update test documentation with additional settings
    for client UI tooltip tests
    + S8232950: SUNPKCS11 Provider incorrectly check key length for
    PSS Signatures.
    + S8233018: Add a new test to verify that DatagramSocket is not
    interruptible
    + S8233019: java.lang.Class.isPrimitive() (C1) returns wrong
    result if Klass* is aligned to 32bit
    + S8233032: assert(in_bb(n)) failed: must be
    + S8233078: fix minimal VM build on Linux ppc64(le)
    + S8233328: fix minimal VM build on Linux s390x
    + S8233383: Various minor fixes
    + S8233466: aarch64: remove unnecessary load of mdo when
    profiling return and parameters type
    + S8233491: Crash in AdapterHandlerLibrary::get_adapter with
    CDS due to code cache exhaustion
    + S8233529: loopTransform.cpp:2984: Error: assert(p_f-&gt;Opcode()
    == Op_IfFalse) failed
    + S8233548: Update CUP to v0.11b
    + S8233649: Update ProblemList.txt to exclude failing headful
    tests on macos
    + S8233656: assert(d-&gt;is_CFG() &amp;&amp; n-&gt;is_CFG()) failed: must
    have CFG nodes
    + S8233657: Intermittent NPE in Component.validate()
    + S8234288: Turkey Time Zone returns incorrect time zone name
    + S8234323: NULL-check return value of SurfaceData_InitOps on
    macosx
    + S8234339: replace JLI_StrTok in java_md_solinux.c
    + S8234340: Bump update version for OpenJDK: jdk-11.0.7
    + S8234350: assert(mode == ControlAroundStripMined &amp;&amp; (use ==
    sfpt || !use-&gt;is_reachable_from_root())) failed: missed a node
    + S8234386: [macos] NPE was thrown at expanding Choice from
    maximized frame
    + S8234397: add OS uptime information to os::print_os_info
    output
    + S8234423: Modifying ArrayList.subList().subList() resets
    modCount of subList
    + S8234466: Class loading deadlock involving
    X509Factory#commitEvent()
    + S8234501: remove obsolete NET_ReadV
    + S8234525: enable link-time section-gc for linux s390x to
    remove unused code
    + S8234610: MaxVectorSize set wrongly when UseAVX=3 is
    specified after JDK-8221092
    + S8234617: C1: Incorrect result of field load due to missing
    narrowing conversion
    + S8234723: javax/net/ssl/TLS tests support TLSv1.3
    + S8234724: javax/net/ssl/templates/
    /SSLSocketSSLEngineTemplate.java supports TLSv1.3
    + S8234741: enhance os::get_core_path on macOS
    + S8234769: Duplicate attribution in freetype.md
    + S8234786: Fix for JDK-8214578 breaks OS X 10.12 compatibility
    + S8234809: set relro in linker flags when building with gcc
    + S8234824: java/nio/channels/SocketChannel/AdaptSocket.java
    fails on Windows 10
    + S8235243: handle VS2017 15.9 and VS2019 in abstract_vm_version
    + S8235288: AVX 512 instructions inadvertently used on Xeon for
    small vector width operations
    + S8235325: build failure on Linux after 8235243
    + S8235383: C1 compilation fails with
  - XX:+PrintIRDuringConstruction -XX:+Verbose
    + S8235489: handle return values of sscanf calls in hotspot
    + S8235509: Backport for JDK-8209657 Refactor filemap.hpp to
    simplify integration with Serviceability Agent.
    + S8235510: java.util.zip.CRC32 performance drop after 8200067
    + S8235563: [TESTBUG] appcds/CommandLineFlagComboNegative.java
    does not handle archive mapping failure
    + S8235637: jhsdb jmap from OpenJDK 11.0.5 doesn't work if
    prelink is enabled
    + S8235671: enhance print_rlimit_info in os_posix
    + S8235744: PIT: test/jdk/javax/swing/text/html/
    /TestJLabelWithHTMLText.java times out in linux-x64
    + S8235904: Infinite loop when rendering huge lines
    + S8235998: [c2] Memory leaks during tracing after '8224193:
    stringStream should not use Resource Area'.
    + S8236039: JSSE Client does not accept status_request
    extension in CertificateRequest messages for TLS 1.3
    + S8236140: assert(!VerifyHashTableKeys || _hash_lock == 0)
    failed: remove node from hash table before modifying it
    + S8236179: C1 register allocation error with T_ADDRESS
    + S8236488: Support for configure option
  - -with-native-debug-symbols=internal is impossible on Windows
    + S8236500: Windows ucrt.dll should be looked up in versioned
    WINSDK subdirectory
    + S8236709: struct SwitchRange in HS violates C++ One
    Definition Rule
    + S8236848: [JDK 11u] make run-test-tier1 fails after backport
    of JDK-8232834
    + S8236873: Worker has a deadlock bug
    + S8237217: Incorrect G1StringDedupEntry type used in
    StringDedupTable destructor
    + S8237368: Problem with NullPointerException in RMI
    TCPEndpoint.read
    + S8237375: SimpleThresholdPolicy misses CounterDecay timestamp
    initialization
    + S8237508: Simplify JarFile.isInitializing
    + S8237540: Missing files in backport of JDK-8210910
    + S8237541: Missing files in backport of JDK-8236528
    + S8237600: Test SunJSSEFIPSInit fails on Ubuntu
    + S8237819: s390x - remove unused pd_zero_to_words_large
    + S8237869: exclude jtreg test security/infra/java/security/
    /cert/CertPathValidator/certification/LuxTrustCA.java because
    of instabilities
    + S8237879: make 4.3 breaks build
    + S8237945: CTW: C2 compilation fails with
    assert(just_allocated_object(alloc_ctl) == ptr) failed: most
    recent allo...
    + S8238225: Issues reported after replacing symlink at
    Contents/MacOS/libjli.dylib with binary
    + S8238247: CTW runner should sweep nmethods more aggressively
    + S8238366: CTW runner closes standard output on exit
    + S8238438: SuperWord::co_locate_pack picks memory state of
    first instead of last load
    + S8238502: sunmscapi.dll causing EXCEPTION_ACCESS_VIOLATION
    + S8238534: Deep sign macOS bundles before bundle archive is
    being created
    + S8238591: CTW: Split
    applications/ctw/modules/jdk_localedata.java
    + S8238596: AVX enabled by default for Skylake even when
    unsupported
    + S8238811: C2: assert(i &gt;= req() || i == 0 || is_Region() ||
    is_Phi()) with -XX:+VerifyGraphEdges
    + S8239005: [TESTBUG] test/hotspot/jtreg/runtime/
    /StackGuardPages/TestStackGuardPages.java: exeinvoke.c: must
    initialize static state before calling do_overflow()
    + S8239466: Loss of precision in counter decay calculation in
    11u backport of JDK-8237375
    + S8239856: [ntintel] asserts about copying unaligned array
    element
    + S8240724: [test] jdk11 downport of 8224475 misses binary file
    test/jdk/javax/swing/JTextPane/arrow.png
    + S8241296: Segfault in JNIHandleBlock::oops_do()
- Removed patch:
  * DependOnVariableHelper.patch
    + fixed upstream
- Added patch:
  * JDK-8228407.patch
    + fix crashes due to shared archive file mismatch</changelog>
  <changelog author="fstrba@suse.com" date="1594900800">- Update to upstream tag jdk-11.0.8+10 (July 2020 CPU, bsc#1174157)
  * Security fixes:
    + JDK-8230613: Better ASCII conversions
    + JDK-8231800: Better listing of arrays
    + JDK-8232014: Expand DTD support
    + JDK-8233234: Better Zip Naming
    + JDK-8233239, CVE-2020-14562: Enhance TIFF support
    + JDK-8233255: Better Swing Buttons
    + JDK-8234032: Improve basic calendar services
    + JDK-8234042: Better factory production of certificates
    + JDK-8234418: Better parsing with CertificateFactory
    + JDK-8234836: Improve serialization handling
    + JDK-8236191: Enhance OID processing
    + JDK-8236867, CVE-2020-14573: Enhance Graal interface handling
    + JDK-8237117, CVE-2020-14556: Better ForkJoinPool behavior
    + JDK-8237592, CVE-2020-14577: Enhance certificate verification
    + JDK-8238002, CVE-2020-14581: Better matrix operations
    + JDK-8238013: Enhance String writing
    + JDK-8238804: Enhance key handling process
    + JDK-8238842: AIOOBE in GIFImageReader.initializeStringTable
    + JDK-8238843: Enhanced font handing
    + JDK-8238920, CVE-2020-14583: Better Buffer support
    + JDK-8238925: Enhance WAV file playback
    + JDK-8240119, CVE-2020-14593: Less Affine Transformations
    + JDK-8240482: Improved WAV file playback
    + JDK-8241379: Update JCEKS support
    + JDK-8241522: Manifest improved jar headers redux
    + JDK-8242136, CVE-2020-14621: Better XML namespace handling
  * Other changes:
    + JDK-6933331: (d3d/ogl) java.lang.IllegalStateException:
    Buffers have not been created
    + JDK-7124307: JSpinner and changing value by mouse
    + JDK-8022574: remove HaltNode code after uncommon trap calls
    + JDK-8039082: [TEST_BUG] Test
    java/awt/dnd/BadSerializationTest/BadSerializationTest.java
    fails
    + JDK-8040630: Popup menus and tooltips flicker with previous
    popup contents when first shown
    + JDK-8044365: (dc) MulticastSendReceiveTests.java failing with
    ENOMEM when joining group (OS X 10.9)
    + JDK-8048215: [TESTBUG]
    java/lang/management/ManagementFactory/ThreadMXBeanProxy.java
    Expected non-null LockInfo
    + JDK-8051349: nsk/jvmti/scenarios/sampling/SP06/sp06t003 fails
    in nightly
    + JDK-8080353: JShell: Better error message on attempting to
    add default method
    + JDK-8139876: Exclude hanging nsk/stress/stack from execution
    with deoptimization enabled
    + JDK-8146090: java/lang/ref/ReachabilityFenceTest.java fails
    with -XX:+DeoptimizeALot
    + JDK-8153430: jdk regression test MletParserLocaleTest,
    ParserInfiniteLoopTest reduce default timeout
    + JDK-8156207: Resource allocated BitMaps are often cleared
    unnecessarily
    + JDK-8159740: JShell: corralled declarations do not have
    correct source to wrapper mapping
    + JDK-8175984: ICC_Profile has un-needed, not-empty finalize
    method
    + JDK-8176359: Frame#setMaximizedbounds not working properly in
    multi screen environments
    + JDK-8183369: RFC unconformity of HttpURLConnection with proxy
    + JDK-8187078: -XX:+VerifyOops finds numerous problems when
    running JPRT
    + JDK-8189861: Refactor CacheFind
    + JDK-8191169: java/net/Authenticator/B4769350.java failed
    intermittently
    + JDK-8191930: [Graal] emits unparseable XML into compile log
    + JDK-8193879: Java debugger hangs on method invocation
    + JDK-8196019: java/awt/Window/Grab/GrabTest.java fails on
    Windows
    + JDK-8196181: sun/java2d/GdiRendering/InsetClipping.java fails
    + JDK-8198000:
    java/awt/List/EmptyListEventTest/EmptyListEventTest.java
    debug assert on Windows
    + JDK-8198001: java/awt/Menu/WrongParentAfterRemoveMenu/
    /WrongParentAfterRemoveMenu.java debug assert on Windows
    + JDK-8198339: Test javax/swing/border/Test6981576.java is
    unstable
    + JDK-8200701: jdk/jshell/ExceptionsTest.java fails on Windows,
    after JDK-8198801
    + JDK-8203264: JNI exception pending in
    PlainDatagramSocketImpl.c:740
    + JDK-8203672: JNI exception pending in PlainSocketImpl.c
    + JDK-8203673: JNI exception pending in
    DualStackPlainDatagramSocketImpl.c:398
    + JDK-8204834: Fix confusing "allocate" naming in OopStorage
    + JDK-8205399: Set node color on pinned HashMap.TreeNode
    deletion
    + JDK-8205653: test/jdk/sun/management/jmxremote/bootstrap/
    /RmiRegistrySslTest.java and RmiSslBootstrapTest.sh fail with
    handshake_failure
    + JDK-8206179: com/sun/management/OperatingSystemMXBean/
    /GetCommittedVirtualMemorySize.java fails with Committed
    virtual memory size illegal value
    + JDK-8207334: VM times out in VM_HandshakeAllThreads::doit()
    with RunThese30M
    + JDK-8208277: Code cache heap (-XX:ReservedCodeCacheSize)
    doesn't work with 1GB LargePages
    + JDK-8209113: Use WeakReference for lastFontStrike for created
    Fonts
    + JDK-8209333: Socket reset issue for TLS 1.3 socket close
    + JDK-8209439: C2 library_call can potentially ignore Math.pow
    intrinsic or use null pointer
    + JDK-8209534: [TESTBUG]runtime/appcds/cacheObject/
    /ArchivedModuleCompareTest.java fails with EnableJVMCI.
    + JDK-8210147: adjust some WSAGetLastError usages in windows
    network coding
    + JDK-8210284: "assert((av &amp; 0x00000001) == 0) failed:
    unsupported V8" on Solaris 11.4
    + JDK-8210303: VM_HandshakeAllThreads fails assert with
    "failed: blocked and not walkable"
    + JDK-8210459: Add support for generating compile_commands.json
    + JDK-8210515: [TESTBUG]CheckArchivedModuleApp.java needs to
    check if EnableJVMCI is set.
    + JDK-8210788: Javadoc for Thread.join(long, int) should
    specify that it waits forever when both arguments are zero
    + JDK-8211301: [macos] support full window content options
    + JDK-8211332: Space for stub routines (code_size2) is too
    small on new Skylake CPUs
    + JDK-8211339: NPE during SSL handshake caused by
    HostnameChecker
    + JDK-8211392: compiler/profiling/
    /spectrapredefineclass_classloaders/Launcher.java times out
    in JDK12 CI
    + JDK-8211743: [AOT] crash in ScopeDesc::decode_body() when
    JVMTI walks AOT frames
    + JDK-8212154: [TESTBUG] CheckArchivedModuleApp fails with NPE
    when JVMCI is absent
    + JDK-8212167: JShell : Stack trace of exception has wrong line
    number
    + JDK-8212933: Thread-SMR: requesting a VM operation whilst
    holding a ThreadsListHandle can cause deadlocks
    + JDK-8212986: Make Visual Studio compiler check less strict
    + JDK-8213250: CDS archive creation aborts due to metaspace
    object allocation failure
    + JDK-8213516: jck test api/javax_accessibility/AccessibleState/
    /fields.html fails intermittent
    + JDK-8213947: ARM32: failed check_simd should set
    UsePopCountInstruction to false
    + JDK-8214418: half-closed SSLEngine status may cause
    application dead loop
    + JDK-8214440: ldap over a TLS connection negotiate failed with
    "javax.net.ssl.SSLPeerUnverifiedException: hostname of the
    server does not match the hostname in the server's
    certificate"
    + JDK-8214444: Wrong strncat limits in dfa.cpp
    + JDK-8214481: freetype path does not disable TrueType hinting
    with AA+FM hints
    + JDK-8214571: -Xdoclint of array serialField gives "error:
    array type not allowed here"
    + JDK-8214856: Errors with JSZip in web console after upgrade
    to 3.1.5
    + JDK-8214862: assert(proj != __null) at compile.cpp:3251
    + JDK-8215369: Jcstress pollute /var/tmp with temporary files.
    + JDK-8215551: Missing case label in nmethod::reloc_string_for()
    + JDK-8215555: TieredCompilation C2 threads can excessively
    block handshakes
    + JDK-8215711: Missing key_share extension for (EC)DHE key
    exchange should alert missing_extension
    + JDK-8216151: [Graal] Module
    jdk.internal.vm.compiler.management has not been granted
    accessClassInPackage.org.graalvm.compiler.debug
    + JDK-8216154: C4819 warnings at HotSpot sources on Windows
    + JDK-8216541: CompiledICHolders of VM locked unloaded nmethods
    are released too late
    + JDK-8217230: assert(t == t_no_spec) failure in
    NodeHash::check_no_speculative_types()
    + JDK-8217404: --with-jvm-features doesn't work when multiple
    features are explicitly disabled
    + JDK-8217447: Develop flag TraceICs is broken
    + JDK-8217606: LdapContext#reconnect always opens a new
    connection
    + JDK-8218807: Compilation database (compile_commands.json) may
    contain obsolete items
    + JDK-8219214: Infinite Loop in CodeSection::dump()
    + JDK-8219904: ClassCastException when calling
    FlightRecorderMXBean#getRecordings()
    + JDK-8219991: New fix of the deadlock in
    sun.security.ssl.SSLSocketImpl
    + JDK-8221121: applications/microbenchmarks are encountering
    crashes in tier5
    + JDK-8221445: FastSysexMessage constructor crashes MIDI
    receiption thread
    + JDK-8221482: Initialize VMRegImpl::regName[] earlier to
    prevent assert during PrintStubCode
    + JDK-8221741: ClassCastException can happen when
    fontconfig.properties is used
    + JDK-8221823: Requested JDialog width is ignored
    + JDK-8223108: Test java/awt/EventQueue/
    /NonComponentSourcePost.java is unstable
    + JDK-8223678: Add Visual Studio Code workspace generation
    support (for native code)
    + JDK-8223935: PIT: java/awt/font/WindowsIndicFonts.java fails
    on windows10
    + JDK-8224109: Text spaced incorrectly by drawString under
    rotation with fractional metric
    + JDK-8224632: testbug: java/awt/dnd/RemoveDropTargetCrashTest/
    /RemoveDropTargetCrashTest.java fails on MacOS
    + JDK-8224793: os::die() does not honor CreateCoredumpOnCrash
    option
    + JDK-8224847: gc/stress/TestReclaimStringsLeaksMemory.java
    fails with reserved greater than expected
    + JDK-8224931: disable JAOTC invokedynamic support until
    8223533 is fixed
    + JDK-8224997: ChaCha20-Poly1305 TLS cipher suite decryption
    throws ShortBufferException
    + JDK-8225068: Remove DocuSign root certificate that is
    expiring in May 2020
    + JDK-8225069: Remove Comodo root certificate that is expiring
    in May 2020
    + JDK-8225126: Test SetBoundsPaintTest.html faild on Windows
    when desktop is scaled
    + JDK-8225325: Add tests for redefining a class' private method
    during resolution of the bootstrap specifier
    + JDK-8225622: [AOT] runtime/SharedArchiveFile/
    /TestInterpreterMethodEntries.java crashed with AOTed
    java.base
    + JDK-8225653: Provide more information when hitting SIGILL
    from HaltNode
    + JDK-8225783: Incorrect use of binary operators on booleans in
    type.cpp
    + JDK-8225789: Empty method parameter type should generate
    ClassFormatError
    + JDK-8226198: use of &amp; instead of &amp;&amp; in
    LibraryCallKit::arraycopy_restore_alloc_state
    + JDK-8226253: JAWS reports wrong number of radio buttons when
    buttons are hidden.
    + JDK-8226653: [accessibility] Can edit text cell correctly,
    but Accessibility Tool reads nothing about editor
    + JDK-8226806: [macOS 10.14] Methods of Java Robot should be
    called from appropriate thread
    + JDK-8226879: Memory leak in Type::hashcons
    + JDK-8227632: Incorrect PrintCompilation message: made not
    compilable on levels 0 1 2 3 4
    + JDK-8228407: JVM crashes with shared archive file mismatch
    + JDK-8228482: fix xlc16/xlclang comparison of distinct pointer
    types and string literal conversion warnings
    + JDK-8228757: Fail fast if the handshake type is unknown
    + JDK-8229158: make UseSwitchProfiling non-experimental or
    false by-default
    + JDK-8229421: The logic of java/net/ipv6tests/TcpTest.java is
    flawed
    + JDK-8229855: C2 fails with assert(false) failed: bad AD file
    + JDK-8230591: AArch64: Missing intrinsics for Math.ceil,
    floor, rint
    + JDK-8231118: ARM32: Math tests failures
    + JDK-8231213: Migrate SimpleDateFormatConstTest to JDK Repo
    + JDK-8231243: [TESTBUG] CustomFont.java cannot find font file
    + JDK-8231438: [macOS] Dark mode for the desktop is not
    supported
    + JDK-8231550: C2: ShouldNotReachHere() in
    verify_strip_mined_scheduling
    + JDK-8231564: setMaximizedBounds is broken with large display
    scale and multiple monitors
    + JDK-8231572: Use -lobjc instead of -fobjc-link-runtime in
    libosxsecurity
    + JDK-8231631: sun/net/ftp/FtpURLConnectionLeak.java fails
    intermittently with NPE
    + JDK-8231671: Fix copyright headers in hotspot (missing comma
    after year)
    + JDK-8231720: Some perf regressions after 8225653
    + JDK-8231779: crash
    HeapWord*ParallelScavengeHeap::failed_mem_allocate
    + JDK-8231863: Crash if classpath is read from @argument file
    and the main gets option argument
    + JDK-8232080: jlink plugins for vendor information and
    run-time options
    + JDK-8232106: [x86] C2: SIGILL due to usage of SSSE3
    instructions on processors which don't support it
    + JDK-8232134: Change to Visual Studio 2017 15.9.16 for
    building on Windows at Oracle
    + JDK-8232226: [macos 10.15] test/jdk/java/awt/color/
    /EqualityTest/EqualityTest.java may fail
    + JDK-8232357: Compare version info of Santuario to legal notice
    + JDK-8232572: Add hooks for custom output dir in Bundles.gmk
    + JDK-8232634: Problem List ICMColorDataTest.java
    + JDK-8232748: Build static versions of certain JDK libraries
    + JDK-8232846: ProcessHandle.Info command with non-English
    shows question marks
    + JDK-8232880: Update test documentation with additional
    settings for client UI tooltip tests
    + JDK-8233033: C2 produces wrong result while unswitching a
    loop due to lost control dependencies
    + JDK-8233137: runtime/ErrorHandling/VeryEarlyAssertTest.java
    fails after 8232080
    + JDK-8233197: Invert JvmtiExport::post_vm_initialized() and
    Jfr:on_vm_start() start-up order for correct option parsing
    + JDK-8233291: [TESTBUG] tools/jlink/plugins/
    /VendorInfoPluginsTest.java fails with debug or non-server VMs
    + JDK-8233364: Fix undefined behavior in
    Canonicalizer::do_ShiftOp
    + JDK-8233494: Avoid calling MallocTracker::record_malloc and
    record_free when NMT is off
    + JDK-8233573: Toolkit.getScreenInsets(GraphicsConfiguration)
    may throw ClassCastException
    + JDK-8233608: Minimal build broken after JDK-8233494
    + JDK-8233621: Mismatch in jsse.enableMFLNExtension property
    name
    + JDK-8233696: [TESTBUG]Some jtreg tests fail when CAPS_LOCK is
    ON
    + JDK-8233707: systemScale.cpp could not compile with VS2019
    + JDK-8233801: GCMEmptyIv.java test fails on Solaris 11.4
    + JDK-8233880: Support compilers with multi-digit major version
    numbers
    + JDK-8233920: MethodHandles::tryFinally generates illegal
    bytecode for long/double return type
    + JDK-8234137: The "AutoTestOnTop.java" test may run external
    applications
    + JDK-8234146: compiler/jsr292/
    /ContinuousCallSiteTargetChange.java times out on SPARC
    + JDK-8234184: [TESTBUG] java/awt/Mouse/EnterExitEvents/
    /ModalDialogEnterExitEventsTest.java fails in Windows
    + JDK-8234270: [REDO] JDK-8204128 NMT might report incorrect
    numbers for Compiler area
    + JDK-8234332: [TESTBUG] java/awt/Focus/DisposedWindow/
    /DisposeDialogNotActivateOwnerTest/
    /DisposeDialogNotActivateOwnerTest.java fails on linux-x64
    nightly
    + JDK-8234398: Replace ID2D1Factory::GetDesktopDpi with
    GetDeviceCaps
    + JDK-8234522: [macos] Crash with use of native file dialog
    + JDK-8234691: Potential double-free in ParallelSPCleanupTask
    constructor
    + JDK-8234696: tools/jlink/plugins/VendorInfoPluginsTest.java
    times out
    + JDK-8234727: sun/security/ssl/X509TrustManagerImpl tests
    support TLSv1.3
    + JDK-8234728: Some security tests should support TLSv1.3
    + JDK-8234779: Provide idiom for declaring classes noncopyable
    + JDK-8234824: java/nio/channels/SocketChannel/AdaptSocket.java
    fails on Windows 10
    + JDK-8234968: check calloc rv in libinstrument
    InvocationAdapter
    + JDK-8235153: [TESTBUG] [macos 10.15] java/awt/Graphics/
    /DrawImageBG/SystemBgColorTest.java fails
    + JDK-8235183: Remove the "HACK CODE" in comment
    + JDK-8235263: Revert TLS 1.3 change that wrapped IOExceptions
    + JDK-8235311: Tag mismatch may alert bad_record_mac
    + JDK-8235332: TestInstanceCloneAsLoadsStores.java fails with
  - XX:+StressGCM
    + JDK-8235452: Strip mined loop verification fails with
    assert(is_OuterStripMinedLoop()) failed: invalid node class
    + JDK-8235584: UseProfiledLoopPredicate fails with
    assert(_phase-&gt;get_loop(c) == loop) failed: have to be in the
    same loop
    + JDK-8235620: Broken merge between JDK-8006406 and JDK-8003559
    + JDK-8235638: NPE in LWWindowPeer.getOnscreenGraphics()
    + JDK-8235686: Add more custom hooks in Bundles.gmk
    + JDK-8235739: Rare NPE at WComponentPeer.getGraphics()
    + JDK-8235762: JVM crash in SWPointer during C2 compilation
    + JDK-8235834: IBM-943 charset encoder needs updating
    + JDK-8235874: The ordering of Cipher Suites is not maintained
    provided through jdk.tls.client.cipherSuites and
    jdk.tls.server.cipherSuites system property.
    + JDK-8235908: omit ThreadPriorityPolicy warning when value is
    set from image
    + JDK-8235984: C2: assert(out-&gt;in(PhiNode::Region) == head ||
    out-&gt;in(PhiNode::Region) == slow_head) failed: phi must be
    either part of the slow or the fast loop
    + JDK-8236211: [Graal] compiler/graalunit/GraphTest.java is
    skipped in all testing
    + JDK-8236470: Deal with ECDSA using ecdsa-with-SHA2 plus hash
    algorithm as AlgorithmId
    + JDK-8236545: Compilation error in mach5
    java/awt/FileDialog/MacOSGoToFolderCrash.java
    + JDK-8236700: Upgrading JSZip from v3.1.5 to v3.2.2
    + JDK-8236759: ShouldNotReachHere in
    PhaseIdealLoop::verify_strip_mined_scheduling
    + JDK-8236897: Fix the copyright header for pkcs11gcm2.h
    + JDK-8236921: Add build target to produce a JDK image suitable
    for a Graal/SVM build
    + JDK-8236953: [macos] JavaFX SwingNode is not rendered on macOS
    + JDK-8236996: Incorrect Roboto font rendering on Windows with
    subpixel antialiasing
    + JDK-8237045: JVM uses excessive memory with -XX:+EnableJVMCI
  - XX:JVMCICounterSize=2147483648
    + JDK-8237055: [TESTBUG] compiler/c2/TestJumpTable.java fails
    with release VMs
    + JDK-8237086: assert(is_MachReturn()) running CTW with fix for
    JDK-8231291
    + JDK-8237192: Generate stripped/public pdbs on Windows for jdk
    images
    + JDK-8237396: JvmtiTagMap::weak_oops_do() should not trigger
    barriers
    + JDK-8237474: Default SSLEngine should create in server role
    + JDK-8237859: C2: Crash when loads float above range check
    + JDK-8237879: make 4.3 breaks build
    + JDK-8237951: CTW: C2 compilation fails with "malformed
    control flow"
    + JDK-8237962: give better error output for invalid OCSP
    response intervals in CertPathValidator checks
    + JDK-8238190: [JVMCI] Fix single implementor speculation for
    diamond shapes.
    + JDK-8238356: CodeHeap::blob_count() overestimates the number
    of blobs
    + JDK-8238452: Keytool generates wrong expiration date if
    validity is set to 2050/01/01
    + JDK-8238555: Allow Initialization of SunPKCS11 with NSS when
    there are external FIPS modules in the NSSDB
    + JDK-8238575: DragSourceEvent.getLocation() returns wrong
    value on HiDPI screens (Windows)
    + JDK-8238676: jni crashes on accessing it from process exit
    hook
    + JDK-8238721: Add failing client jtreg tests to the Problem
    List
    + JDK-8238738: AudioSystem.getMixerInfo() takes about 30 sec to
    report a gone audio device
    + JDK-8238756: C2: assert(((n) == __null || !VerifyIterativeGVN
    || !((n)-&gt;is_dead()))) failed: can not use dead node
    + JDK-8238765: PhaseCFG::schedule_pinned_nodes cannot handle
    precedence edges from unmatched CFG nodes correctly
    + JDK-8238898: Missing hash characters for header on license
    file
    + JDK-8238942: Rendering artifacts with LCD text and fractional
    metrics
    + JDK-8238985: [TESTBUG] The arrow image is blue instead of
    green
    + JDK-8239000: handle ContendedPaddingWidth in vm_version_ppc
    + JDK-8239055: Wrong implementation of VMState.hasListener
    + JDK-8239091: Reversed arguments in call to strstr in freetype
    "debug" code.
    + JDK-8239142: C2's UseUniqueSubclasses optimization is broken
    for array accesses
    + JDK-8239224: libproc_impl.c previous_thr may be used
    uninitialized warning
    + JDK-8239351: Give more meaningful InternalError messages in
    Deflater.c
    + JDK-8239365: ProcessBuilder test modifications for AIX
    execution
    + JDK-8239456: vtable stub generation: assert failure (code
    size estimate)
    + JDK-8239457: call ReleaseStringUTFChars before early returns
    in Java_sun_security_pkcs11_wrapper_PKCS11_connect
    + JDK-8239462: jdk.hotspot.agent misses some
    ReleaseStringUTFChars calls in case of early returns
    + JDK-8239557: [TESTBUG] VeryEarlyAssertTest.java validating
    "END." marker at lastline is not always true
    + JDK-8239787: AArch64: String.indexOf may incorrectly handle
    empty strings
    + JDK-8239792: Bump update version for OpenJDK: jdk-11.0.8
    + JDK-8239798: SSLSocket closes socket both socket endpoints on
    a SocketTimeoutException
    + JDK-8239819: XToolkit: Misread of screen information memory
    + JDK-8239852: java/util/concurrent tests fail with
  - XX:+VerifyGraphEdges: assert(!VerifyGraphEdges) failed:
    verification should have failed
    + JDK-8239893: Windows handle Leak when starting processes
    using ProcessBuilder
    + JDK-8239915: Zero VM crashes when handling dynamic constant
    + JDK-8239931: [win][x86] vtable stub generation: assert
    failure (code size estimate) follow-up
    + JDK-8239965: XMLEncoder/Test4625418.java fails due to "Error:
    Cp943 - can't read properly"
    + JDK-8239976: Put JDK-8239965 on the ProblemList.txt
    + JDK-8240073: Fix 'test-make' build target in 11u
    + JDK-8240197: Cannot start JVM when $JAVA_HOME includes CJK
    characters
    + JDK-8240202: A few client tests leave mouse buttons pressed
    + JDK-8240220: IdealLoopTree::dump_head predicate printing is
    broken
    + JDK-8240223: Use consistent predicate order in and with
    PhaseIdealLoop::find_predicate
    + JDK-8240227: Loop predicates should be copied to unswitched
    loops
    + JDK-8240286: [TESTBUG] Test command error in hotspot/jtreg/
    /compiler/loopopts/superword/SumRedAbsNeg_Float.java
    + JDK-8240518: Incorrect JNU_ReleaseStringPlatformChars in
    Windows Print
    + JDK-8240529: CheckUnhandledOops breaks NULL check in
    Modules::define_module
    + JDK-8240576: JVM crashes after transformation in C2
    IdealLoopTree::merge_many_backedges
    + JDK-8240603: Windows 32bit compile error after 8238676
    + JDK-8240629: argfiles parsing broken for argfiles with
    comment cross 4096 bytes chunk
    + JDK-8240711: TestJstatdPort.java failed due to
    "ExportException: Port already in use:"
    + JDK-8240786: [TESTBUG] The test java/awt/Window/
    /GetScreenLocation/GetScreenLocationTest.java fails on HiDPI
    screen
    + JDK-8240824: enhance print_full_memory_info on Linux by THP
    related information
    + JDK-8240827: Downport SSLSocketImpl.java from "8221882: Use
    fiber-friendly java.util.concurrent.locks in JSSE"
    + JDK-8240905: assert(mem == (Node*)1 || mem == mem2) failed:
    multiple Memories being matched at once?
    + JDK-8240972: macOS codesign fail on macOS 10.13.5 or older
    + JDK-8241445: Fix copyright in
    test/jdk/tools/launcher/ArgFileSyntax.java
    + JDK-8241458: [JVMCI] add mark value to expose
    CodeOffsets::Frame_Complete
    + JDK-8241464: [11u] Backport: make rehashing be a needed
    guaranteed safepoint cleanup action
    + JDK-8241556: Memory leak if -XX:CompileCommand is set
    + JDK-8241568: (fs) UserPrincipalLookupService.lookupXXX
    failure with IOE "Operation not permitted"
    + JDK-8241586: compiler/cpuflags/
    /TestAESIntrinsicsOnUnsupportedConfig.java fails on aarch64
    + JDK-8241638: launcher time metrics always report 1 on Linux
    when _JAVA_LAUNCHER_DEBUG set
    + JDK-8241660: Add virtualization information output to hs_err
    file on macOS
    + JDK-8241808: [TESTBUG] The JDK-8039467 bug appeared on macOS
    + JDK-8241888: Mirror jdk.security.allowNonCaAnchor system
    property with a security one
    + JDK-8241900: Loop unswitching may cause dependence on null
    check to be lost
    + JDK-8241948: enhance list of environment variables printed in
    hs_err file
    + JDK-8241996: on linux set full relro in the linker flags
    + JDK-8242108: Performance regression after fix for JDK-8229496
    + JDK-8242141: New System Properties to configure the TLS
    signature schemes
    + JDK-8242154: Backport parts of JDK-4947890 to OpenJDK 11u
    + JDK-8242174: [macos] The NestedModelessDialogTest test make
    the macOS unstable
    + JDK-8242239: [Graal] javax/management/generified/
    /GenericTest.java fails: FAILED: queryMBeans sets same
    + JDK-8242294: JSSE Client does not throw SSLException when an
    alert occurs during handshaking
    + JDK-8242379: [TESTBUG] compiler/loopopts/
    /TestLoopUnswitchingLostCastDependency.java fails with
    release VMs
    + JDK-8242470: Update Xerces to Version 2.12.1
    + JDK-8242498: Invalid "sun.awt.TimedWindowEvent" object leads
    to JVM crash
    + JDK-8242541: Small charset issues (ISO8859-16, x-eucJP-Open,
    x-IBM834 and x-IBM949C)
    + JDK-8242626: enhance posix print_rlimit_info
    + JDK-8243059: Build fails when --with-vendor-name contains a
    comma
    + JDK-8243539: Copyright info (Year) should be updated for fix
    of 8241638
    + JDK-8243541: (tz) Upgrade time-zone data to tzdata2020a
    + JDK-8244407: JVM crashes after transformation in C2
    IdealLoopTree::split_fall_in
    + JDK-8244520: problemlist
    java/awt/font/Rotate/RotatedFontTest.java on linux
    + JDK-8244777: ClassLoaderStats VM Op uses constant hash value
    + JDK-8244853: The static build of libextnet is missing the
    JNI_OnLoad_extnet function
    + JDK-8244951: Missing entitlements for hardened runtime
    + JDK-8245047: [PPC64] C2: ReverseBytes + Load always match to
    unordered Load (acquire semantics missing)
    + JDK-8245649: Revert 8245397 backport of 8230591
    + JDK-8246031: SSLSocket.getSession() doesn't close connection
    for timeout/ interrupts
    + JDK-8246613: Choose the default SecureRandom algo based on
    registration ordering
    + JDK-8248505: Unexpected NoSuchAlgorithmException when using
    secure random impl from BCFIPS provider
- Removed patch:
  * JDK-8228407.patch
    + integrated upstream</changelog>
  <changelog author="fstrba@suse.com" date="1604318400">- Update to upstream tag jdk-11.0.9-11 (October 2020 CPU,
  bsc#1177943)
  * New features
    + JDK-8250784: Shenandoah: A Low-Pause-Time Garbage Collector
  * Security fixes
    + JDK-8233624: Enhance JNI linkage
    + JDK-8236196: Improve string pooling
    + JDK-8236862, CVE-2020-14779: Enhance support of Proxy class
    + JDK-8237990, CVE-2020-14781: Enhanced LDAP contexts
    + JDK-8237995, CVE-2020-14782: Enhance certificate processing
    + JDK-8240124: Better VM Interning
    + JDK-8241114, CVE-2020-14792: Better range handling
    + JDK-8242680, CVE-2020-14796: Improved URI Support
    + JDK-8242685, CVE-2020-14797: Better Path Validation
    + JDK-8242695, CVE-2020-14798: Enhanced buffer support
    + JDK-8243302: Advanced class supports
    + JDK-8244136, CVE-2020-14803: Improved Buffer supports
    + JDK-8244479: Further constrain certificates
    + JDK-8244955: Additional Fix for JDK-8240124
    + JDK-8245407: Enhance zoning of times
    + JDK-8245412: Better class definitions
    + JDK-8245417: Improve certificate chain handling
    + JDK-8248574: Improve jpeg processing
    + JDK-8249927: Specify limits of jdk.serialProxyInterfaceLimit
    + JDK-8253019: Enhanced JPEG decoding
  * Other changes
    + JDK-6532025: GIF reader throws misleading exception with
    truncated images
    + JDK-6949753: [TEST BUG]: java/awt/print/PageFormat/
    /PDialogTest.java needs update by removing an infinite loop
    + JDK-8022535: [TEST BUG] javax/swing/text/html/parser/
    /Test8017492.java fails
    + JDK-8062947: Fix exception message to correctly represent
    LDAP connection failure
    + JDK-8067354: com/sun/jdi/GetLocalVariables4Test.sh failed
    + JDK-8134599: TEST_BUG: java/rmi/transport/closeServerSocket/
    /CloseServerSocket.java fails intermittently with Address
    already in use
    + JDK-8151678: com/sun/jndi/ldap/LdapTimeoutTest.java failed
    due to timeout on DeadServerNoTimeoutTest is incorrect
    + JDK-8160768: Add capability to custom resolve host/domain
    names within the default JNDI LDAP provider
    + JDK-8172404: Tools should warn if weak algorithms are used
    before restricting them
    + JDK-8193367: Annotated type variable bounds crash javac
    + JDK-8202117: com/sun/jndi/ldap/RemoveNamingListenerTest.java
    fails intermittently: Connection reset
    + JDK-8203026: java.rmi.NoSuchObjectException: no such object
    in table
    + JDK-8203281: [Windows] JComboBox change in ui when
    editor.setBorder() is called
    + JDK-8203382: Rename SystemDictionary::initialize_wk_klass to
    resolve_wk_klass
    + JDK-8203393: com/sun/jdi/JdbMethodExitTest.sh and
    JdbExprTest.sh fail due to timeout
    + JDK-8203928: [Test] Convert non-JDB scaffolding
    serviceability shell script tests to java
    + JDK-8204963: javax.swing.border.TitledBorder has a memory leak
    + JDK-8204994: SA might fail to attach to process with "Windbg
    Error: WaitForEvent failed"
    + JDK-8205534: Remove SymbolTable dependency from
    serviceability agent
    + JDK-8206309: Tier1 SA tests fail
    + JDK-8208281: java/nio/channels/
    /AsynchronousSocketChannel/Basic.java timed out
    + JDK-8209109: [TEST] rewrite com/sun/jdi shell tests to java
    version - step1
    + JDK-8209332: [TEST] test/jdk/com/sun/jdi/CatchPatternTest.sh
    is incorrect
    + JDK-8209342: Problemlist SA tests on Solaris due to Error
    attaching to process: Can't create thread_db agent!
    + JDK-8209343: Test javax/swing/border/TestTitledBorderLeak.java
    should be marked as headful
    + JDK-8209517: com/sun/jdi/BreakpointWithFullGC.java fails with
    timeout
    + JDK-8209604: [TEST] rewrite com/sun/jdi shell tests to java
    version - step2
    + JDK-8209605: com/sun/jdi/BreakpointWithFullGC.java fails with
    ZGC
    + JDK-8209608: Problem list com/sun/jdi/BreakpointWithFullGC.java
    + JDK-8210131: vmTestbase/nsk/jvmti/scenarios/allocation/AP10/
    /ap10t001/TestDescription.java failed with ObjectFree:
    GetCurrentThreadCpuTimerInfo returned unexpected error code
    + JDK-8210243: [TEST] rewrite com/sun/jdi shell tests to java
    version - step3
    + JDK-8210527: JShell: NullPointerException in
    jdk.jshell.Eval.translateExceptionStack
    + JDK-8210560: [TEST] convert com/sun/jdi redefineClass-related
    tests
    + JDK-8210725: com/sun/jdi/RedefineClearBreakpoint.java fails
    with waitForPrompt timed out after 60 seconds
    + JDK-8210748: [TESTBUG] lib.jdb.Jdb.waitForPrompt() should
    clarify which output is the pending reply after a timeout
    + JDK-8210760: [TEST] rewrite com/sun/jdi shell tests to java
    version - step4
    + JDK-8210977: jdk/jfr/event/oldobject/TestThreadLocalLeak.java
    fails to find ThreadLocalObject
    + JDK-8211292: [TEST] convert com/sun/jdi/DeferredStepTest.sh
    test
    + JDK-8211694: JShell: Redeclared variable should be reset
    + JDK-8212200: assert when shared java.lang.Object is redefined
    by JVMTI agent
    + JDK-8212629: [TEST] wrong breakpoint in
    test/jdk/com/sun/jdi/DeferredStepTest
    + JDK-8212665: com/sun/jdi/DeferredStepTest.java: jj1 (line 57)
  - unexpected. lastLine=52, minLine=52, maxLine=55
    + JDK-8212807: tools/jar/multiRelease/Basic.java times out
    + JDK-8213182: Minimal VM build failure after JDK-8212200
    (assert when shared java.lang.Object is redefined by JVMTI
    agent)
    + JDK-8213214: Set -Djava.io.tmpdir= when running tests
    + JDK-8213275: ReplaceCriticalClasses.java fails with
    jdk.internal.vm.PostVMInitHook not found
    + JDK-8213574: Deadlock in string table expansion when dumping
    lots of CDS classes
    + JDK-8213703: LambdaConversionException: Invalid receiver type
    not a subtype of implementation type interface
    + JDK-8214074: Ghash optimization using AVX instructions
    + JDK-8214491: Upgrade to JLine 3.9.0
    + JDK-8214797: TestJmapCoreMetaspace.java timed out
    + JDK-8215243: JShell tests failing intermitently with
    "Problem cleaning up the following threads:"
    + JDK-8215244: jdk/jshell/ToolBasicTest.java
    testHistoryReference failed
    + JDK-8215354: x86_32 build failures after JDK-8214074 (Ghash
    optimization using AVX instructions)
    + JDK-8215438: jshell tool: Ctrl-D causes EOF
    + JDK-8216021: RunTest.gmk might set concurrency level to 1 on
    Windows
    + JDK-8216974: HttpConnection not returned to the pool after
    204 response
    + JDK-8218948: SimpleDateFormat :: format - Zone Names are not
    reflected correctly during run time
    + JDK-8219712: code_size2 (defined in stub_routines_x86.hpp) is
    too small on new Skylake CPUs
    + JDK-8220150: macos10.14 Mojave returns anti-aliased glyphs
    instead of aliased B&amp;W glyphs
    + JDK-8221658: aarch64: add necessary predicate for ubfx
    patterns
    + JDK-8221759: Crash when completing "java.io.File.path"
    + JDK-8221918: runtime/SharedArchiveFile/serviceability/
    /ReplaceCriticalClasses.java fails: Shared archive not found
    + JDK-8222074: Enhance auto vectorization for x86
    + JDK-8222079: Don't use memset to initialize fields decode_env
    constructor in disassembler.cpp
    + JDK-8222769: [TESTBUG] TestJFRNetworkEvents should not rely
    on hostname command
    + JDK-8223688: JShell: crash on the instantiation of raw
    anonymous class
    + JDK-8223777: In posix_spawn mode, failing to exec()
    jspawnhelper does not result in an error
    + JDK-8223940: Private key not supported by chosen signature
    algorithm
    + JDK-8224184: jshell got IOException at exiting with AIX
    + JDK-8224234: compiler/codegen/TestCharVect2.java fails in
    test_mulc
    + JDK-8225037: java.net.JarURLConnection::getJarEntry() throws
    NullPointerException
    + JDK-8225625: AES Electronic Codebook (ECB) encryption and
    decryption optimization using AVX512 + VAES instructions
    + JDK-8226536: Catch OOM from deopt that fails rematerializing
    objects
    + JDK-8226575: OperatingSystemMXBean should be made container
    aware
    + JDK-8226697: Several tests which need the @key headful
    keyword are missing it.
    + JDK-8226809: Circular reference in printed stack trace is not
    correctly indented &amp; ambiguous
    + JDK-8227059: sun/security/tools/keytool/
    /DefaultSignatureAlgorithm.java timed out
    + JDK-8227269: Slow class loading when running with JDWP
    + JDK-8227595: keytool/fakegen/DefaultSignatureAlgorithm.java
    fails due to "exitValue = 6"
    + JDK-8228448: Jconsole can't connect to itself
    + JDK-8228967: Trust/Key store and SSL context utilities for
    tests
    + JDK-8229378: jdwp library loader in linker_md.c quietly
    truncates on buffer overflow
    + JDK-8229815: Upgrade Jline to 3.12.1
    + JDK-8230000: some httpclients testng tests run zero test
    + JDK-8230002: javax/xml/jaxp/unittest/transform/
    /SecureProcessingTest.java runs zero test
    + JDK-8230010: Remove jdk8037819/BasicTest1.java
    + JDK-8230094: CCE in createXMLEventWriter(Result) over an
    arbitrary XMLStreamWriter
    + JDK-8230402: Allocation of compile task fails with assert:
    "Leaking compilation tasks?"
    + JDK-8230767: FlightRecorderListener returns null recording
    + JDK-8230870: (zipfs) Add a ZIP FS test that is similar to
    test/jdk/java/util/zip/EntryCount64k.java
    + JDK-8231209: [REDO] ThreadMXBean::getThreadAllocatedBytes()
    can be quicker for self thread
    + JDK-8231586: enlarge encoding space for OopMapValue offsets
    + JDK-8231953: Wrong assumption in assertion in
    oop::register_oop
    + JDK-8231968: getCurrentThreadAllocatedBytes default
    implementation s/b getThreadAllocatedBytes
    + JDK-8232083: Minimal VM is broken after JDK-8231586
    + JDK-8232161: Align some one-way conversion in MS950 charset
    with Windows
    + JDK-8232855: jshell missing word in /help help
    + JDK-8233027: OopMapSet::all_do does oms.next() twice during
    iteration
    + JDK-8233228: Disable weak named curves by default in TLS,
    CertPath, and Signed JAR
    + JDK-8233386: Initialize NULL fields for unused decorations
    + JDK-8233452: java.math.BigDecimal.sqrt() with
    RoundingMode.FLOOR results in incorrect result
    + JDK-8233686: XML transformer uses excessive amount of memory
    + JDK-8233741: AES Countermode (AES-CTR) optimization using
    AVX512 + VAES instructions
    + JDK-8233829: javac cannot find non-ASCII module name under
    non-UTF8 environment
    + JDK-8233958: Memory retention due to HttpsURLConnection
    finalizer that serves no purpose
    + JDK-8234011: (zipfs) Memory leak in
    ZipFileSystem.releaseDeflater()
    + JDK-8234058: runtime/CompressedOops/
    /CompressedClassPointers.java fails with 'Narrow klass base:
    0x0000000000000000' missing from stdout/stderr
    + JDK-8234149: Several regression tests do not dispose Frame at
    end
    + JDK-8234347: "Turkey" meta time zone does not generate
    composed localized names
    + JDK-8234385: [TESTBUG] java/awt/EventQueue/6980209/
    /bug6980209.java fails in linux nightly
    + JDK-8234535: Cross compilation fails due to missing CFLAGS
    for the BUILD_CC
    + JDK-8234541: C1 emits an empty message when it inlines
    successfully
    + JDK-8234687: change javap reporting on unknown attributes
    + JDK-8236464: SO_LINGER option is ignored by SSLSocket in JDK
    11
    + JDK-8236548: Localized time zone name inconsistency between
    English and other locales
    + JDK-8236617: jtreg test containers/docker/
    /TestMemoryAwareness.java fails after 8226575
    + JDK-8237182: Update copyright header for shenandoah and
    epsilon files
    + JDK-8237888: security/infra/java/security/cert/
    /CertPathValidator/certification/LuxTrustCA.java fails when
    checking validity interval
    + JDK-8237977: Further update
    javax/net/ssl/compatibility/Compatibility.java
    + JDK-8238270: java.net HTTP/2 client does not decrease stream
    count when receives 204 response
    + JDK-8238284: [macos] Zero VM build fails due to an obvious
    typo
    + JDK-8238380: java.base/unix/native/libjava/childproc.c
    "multiple definition" link errors with GCC10
    + JDK-8238386: (sctp) jdk.sctp/unix/native/libsctp/SctpNet.c
    "multiple definition" link errors with GCC10
    + JDK-8238388: libj2gss/NativeFunc.o "multiple definition" link
    errors with GCC10
    + JDK-8238448: RSASSA-PSS signature verification fail when
    using certain odd key sizes
    + JDK-8238710: LingeredApp doesn't log stdout/stderr if exits
    with non-zero code
    + JDK-8239083: C1 assert(known_holder == NULL ||
    (known_holder-&gt;is_instance_klass() &amp;&amp;
    (!known_holder-&gt;is_interface() ||
    ((ciInstanceKlass*)known_holder)-&gt;has_nonstatic_concrete_methods())),
    "should be non-static concrete method");
    + JDK-8239385: KerberosTicket client name refers wrongly to
    sAMAccountName in AD
    + JDK-8240169: javadoc fails to link to non-modular api docs
    + JDK-8240295: hs_err elapsed time in seconds is not accurate
    enough
    + JDK-8240360: NativeLibraryEvent has wrong library name on
    Linux
    + JDK-8240676: Meet not symmetric failure when running lucene
    on jdk8
    + JDK-8241007: Shenandoah: remove
    ShenandoahCriticalControlThreadPriority support
    + JDK-8241065: Shenandoah: remove leftover code after
    JDK-8231086
    + JDK-8241086: Test runtime/NMT/HugeArenaTracking.java is
    failing on 32bit Windows
    + JDK-8241130: com.sun.jndi.ldap.EventSupport.removeDeadNotifier:
    java.lang.NullPointerException
    + JDK-8241138: http.nonProxyHosts=* causes
    StringIndexOutOfBoundsException in DefaultProxySelector
    + JDK-8241319: WB_GetCodeBlob doesn't have ResourceMark
    + JDK-8241478: vmTestbase/gc/gctests/Steal/steal001/steal001.java
    fails with OOME
    + JDK-8241574: Shenandoah: remove ShenandoahAssertToSpaceClosure
    + JDK-8241750: x86_32 build failure after JDK-8227269
    + JDK-8242184: CRL generation error with RSASSA-PSS
    + JDK-8242283: Can't start JVM when java home path includes
    non-ASCII character
    + JDK-8242556: Cannot load RSASSA-PSS public key with non-null
    params from byte array
    + JDK-8243029: Rewrite javax/net/ssl/compatibility/
    /Compatibility.java with a flexible interop test framework
    + JDK-8243138: Enhance BaseLdapServer to support starttls
    extended request
    + JDK-8243320: Add SSL root certificates to Oracle Root CA
    program
    + JDK-8243321: Add Entrust root CA - G4 to Oracle Root CA
    program
    + JDK-8243389: enhance os::pd_print_cpu_info on linux
    + JDK-8243453: java --describe-module failed with non-ASCII
    module name under non-UTF8 environment
    + JDK-8243470: [macos] bring back O2 opt level for unsafe.cpp
    + JDK-8243489: Thread CPU Load event may contain wrong data for
    CPU time under certain conditions
    + JDK-8243925: Toolkit#getScreenInsets() returns wrong value on
    HiDPI screens (Windows)
    + JDK-8244087: 2020-04-24 public suffix list update
    + JDK-8244151: Update MUSCLE PC/SC-Lite headers to the latest
    release 1.8.26
    + JDK-8244164: AArch64: jaotc generates incorrect code for
    compressed OOPs with non-zero heap base
    + JDK-8244196: adjust output in os_linux
    + JDK-8244225: stringop-overflow warning on strncpy call from
    compile_the_world_in
    + JDK-8244287: JFR: Methods samples have line number 0
    + JDK-8244703: "platform encoding not initialized" exceptions
    with debugger, JNI
    + JDK-8244719: CTW: C2 compilation fails with
    "assert(!VerifyHashTableKeys || _hash_lock == 0) failed:
    remove node from hash table before modifying it"
    + JDK-8244729: Shenandoah: remove resolve paths from
    SBSA::generate_shenandoah_lrb
    + JDK-8244763: Update --release 8 symbol information after JSR
    337 MR3
    + JDK-8244818: Java2D Queue Flusher crash while moving
    application window to external monitor
    + JDK-8245151: jarsigner should not raise duplicate warnings on
    verification
    + JDK-8245616: Bump update version for OpenJDK: jdk-11.0.9
    + JDK-8245714: "Bad graph detected in build_loop_late" when
    loads are pinned on loop limit check uncommon branch
    + JDK-8245801: StressRecompilation triggers assert "redundunt
    OSR recompilation detected. memory leak in CodeCache!"
    + JDK-8245832: JDK build make-static-libs should build all JDK
    libraries
    + JDK-8245880: Shenandoah: check class unloading flag early in
    concurrent code root scan
    + JDK-8245981: Upgrade to jQuery 3.5.1
    + JDK-8246027: Minimal fastdebug build broken after JDK-8245801
    + JDK-8246094: [macos] Sound Recording and playback is not
    working
    + JDK-8246153: TestEliminateArrayCopy fails with
  - XX:+StressReflectiveCode
    + JDK-8246193: Possible NPE in ENC-PA-REP search in AS-REQ
    + JDK-8246196: javax/management/MBeanServer/OldMBeanServerTest
    fails with AssertionError
    + JDK-8246203: Segmentation fault in verification due to stack
    overflow with -XX:+VerifyIterativeGVN
    + JDK-8246330: Add TLS Tests for Legacy ECDSA curves
    + JDK-8246453: TestClone crashes with "all collected exceptions
    must come from the same place"
    + JDK-8247246: Add explicit ResolvedJavaType.link and expose
    presence of default methods
    + JDK-8247350: [aarch64] assert(false) failed: wrong size of
    mach node
    + JDK-8247502: PhaseStringOpts crashes while optimising
    effectively dead code
    + JDK-8247615: Initialize the bytes left for the heap sampler
    + JDK-8247824: CTW: C2 (Shenandoah) compilation fails with SEGV
    in SBC2Support::pin_and_expand
    + JDK-8247874: Replacement in VersionProps.java.template not
    working when --with-vendor-bug-url contains '&amp;'
    + JDK-8247979: aarch64: missing side effect of killing flags
    for clearArray_reg_reg
    + JDK-8248214: Add paddings for TaskQueueSuper to reduce
    false-sharing cache contention
    + JDK-8248219: aarch64: missing memory barrier in
    fast_storefield and fast_accessfield
    + JDK-8248348: Regression caused by the update to BCEL 6.0
    + JDK-8248385: [testbug][11u] Adapt TestInitiExceptions to
    jtreg 5.1
    + JDK-8248495: [macos] zerovm is broken due to libffi headers
    location
    + JDK-8248851: CMS: Missing memory fences between free chunk
    check and klass read
    + JDK-8248987: AOT's Linker.java seems to eagerly fail-fast on
    Windows
    + JDK-8249159: Downport test rework for SSLSocketTemplate from
    8224650
    + JDK-8249215: JFrame::setVisible crashed with
  - Dfile.encoding=UTF-8 on Japanese Windows.
    + JDK-8249251: [dark_mode ubuntu 20.04] The selected menu is
    not highlighted in GTKLookAndFeel
    + JDK-8249255: Build fails if source code in cygwin home dir
    + JDK-8249277: TestVerifyIterativeGVN.java is failing with
    timeout in OpenJDK 11
    + JDK-8249278: Revert JDK-8226253 which breaks the spec of
    AccessibleState.SHOWING for JList
    + JDK-8249560: Shenandoah: Fix racy GC request handling
    + JDK-8249801: Shenandoah: Clear soft-refs on requested GC cycle
    + JDK-8249953: Shenandoah: gc/shenandoah/mxbeans tests should
    account for corner cases
    + JDK-8250582: Revert Principal Name type to NT-UNKNOWN when
    requesting TGS Kerberos tickets
    + JDK-8250609: C2 crash in IfNode::fold_compares
    + JDK-8250627: Use -XX:+/-UseContainerSupport for
    enabling/disabling Java container metrics
    + JDK-8250755: Better cleanup for
    jdk/test/javax/imageio/plugins/shared/CanWriteSequence.java
    + JDK-8250787: Provider.put no longer registering aliases in
    FIPS env
    + JDK-8250826: jhsdb does not work with coredump which comes
    from Substrate VM
    + JDK-8250827: Shenandoah: needs to reset/finish StringTable's
    dead count before/after parallel walk
    + JDK-8250844: Make sure {type,obj}ArrayOopDesc accessors check
    the bounds
    + JDK-8251117: Cannot check P11Key size in P11Cipher and
    P11AEADCipher
    + JDK-8251354: Shenandoah: Fix jdk/jfr/tool/TestPrintJSON.java
    test failure
    + JDK-8251451: Shenandoah: Remark ObjectSynchronizer roots with
    I-U
    + JDK-8251469: Better cleanup for
    test/jdk/javax/imageio/SetOutput.java
    + JDK-8251487: Shenandoah: missing detail timing tracking for
    final mark cleaning phase
    + JDK-8252120: compiler/oracle/TestCompileCommand.java
    misspells "occured"
    + JDK-8252157: JDK-8231209 11u backport breaks jmm binary
    compatibility
    + JDK-8252258: [11u] JDK-8242154 changes the default vendor
    + JDK-8252804: [test] Fix 'ReleaseDeflater.java' test after
    downport of 8234011
    + JDK-8253134: JMM_VERSION should remain at 0x20020000 (JDK 10)
    in JDK 11
    + JDK-8253283: [11u] Test build/translations/
    /VerifyTranslations.java failing after JDK-8252258
    + JDK-8253813: Backout JDK-8244287 from 11u: it causes several
    crashes
- Removed patch:
  * gcc-fno-common-fix.patch
    + not needed any more with this version
- Added patch:
  * JDK-8250861.patch
    + Fix regression "8250861: Crash in MinINode::Ideal(PhaseGVN*,
    bool)" introduced in jdk 11.0.9</changelog>
  <changelog author="fstrba@suse.com" date="1604491200">- Enable Sheandoah GC for x86_64 (jsc#ECO-3171)</changelog>
  <changelog author="fstrba@suse.com" date="1605528000">- Update to upstream tag jdk-11.0.9.1-1
  * Fix:
    + JDK-8250861: Crash in MinINode::Ideal(PhaseGVN*, bool)
- Removed patch:
  * JDK-8250861.patch
    + Integrated upstream</changelog>
  <changelog author="fstrba@suse.com" date="1611230400">- Update to upstream tag jdk-11.0.10+9 (January 2021 CPU,
  bsc#1181239)
  * Security fixes
    + JDK-8247619: Improve Direct Buffering of Characters
  * Other changes
    + JDK-6722928: Support SSPI as a native GSS-API provider
    + JDK-7185258: [macosx] Deadlock in SunToolKit.realSync()
    + JDK-8152332: [macosx] JFileChooser cannot be serialized on
    Mac OS X
    + JDK-8161684: [testconf] Add VerifyOops' testing into compiler
    tiers
    + JDK-8171279: Support X25519 and X448 in TLS
    + JDK-8173361: various crashes in
    JvmtiExport::post_compiled_method_load
    + JDK-8173658: JvmtiExport::post_class_unload() is broken for
    non-JavaThread initiators
    + JDK-8191006: hsdis disassembler plugin does not compile with
    binutils 2.29+
    + JDK-8197981: Missing return statement in
    __sync_val_compare_and_swap_8
    + JDK-8198334: java/awt/FileDialog/8003399/bug8003399.java
    fails in headless mode
    + JDK-8200151: Add 8 JNDI tests to com/sun/jndi/dns/ConfigTests/
    + JDK-8208279: Add 8 JNDI tests to com/sun/jndi/dns/EnvTests/
    + JDK-8208483: Add 5 JNDI tests to
    com/sun/jndi/dns/FactoryTests/
    + JDK-8208542: Add 4 JNDI tests to com/sun/jndi/dns/ListTests/
    + JDK-8208665: Amend cross-compilation docs with
    qemu-debootstrap recipe
    + JDK-8210088: ProblemList gc/epsilon/TestMemoryMXBeans.java
    + JDK-8210339: Add 10 JNDI tests to com/sun/jndi/dns/FedTests/
    + JDK-8211450: UndetVar::dup is not copying the kind field to
    the duplicated instance
    + JDK-8212160: JVMTI agent crashes with "assert(_value != 0LL)
    failed: resolving NULL _value"
    + JDK-8212226: SurfaceManager throws "Invalid Image variant"
    for MultiResolutionImage (Windows)
    + JDK-8213400: Support choosing group name in keytool keypair
    generation
    + JDK-8213535: Windows HiDPI html lightweight tooltips are
    truncated
    + JDK-8213698: Improve devkit creation and add support for
    linux/ppc64/ppc64le/s390x
    + JDK-8214025: assert(t-&gt;singleton()) failed: must be a
    constant when ScavengeRootsInCode &lt; 2
    + JDK-8214242: compiler/arguments/TestScavengeRootsInCode.java
    fails because of missing UnlockDiagnosticVMOptions
    + JDK-8214787: Zero builds fail with "undefined
    JavaThread::thread_state()"
    + JDK-8215583: Exclude
    runtime/handshake/HandshakeWalkSuspendExitTest.java
    + JDK-8216012: Infinite loop in RSA KeyPairGenerator
    + JDK-8216324: GetClassMethods is confused by the presence of
    default methods in super interfaces
    + JDK-8217429: WebSocket over authenticating proxy fails to
    send Upgrade headers
    + JDK-8217976: test/jdk/java/net/httpclient/websocket/
    /WebSocketProxyTest.java fails intermittently
    + JDK-8218021: Have jarsigner preserve posix permission
    attributes
    + JDK-8218287: jshell tool: input behavior unstable after
    12-ea+24 on Windows
    + JDK-8218851: JVM crash in custom classloader stress test, JDK
    12 &amp; 13
    + JDK-8220420: Cleanup c1_LinearScan
    + JDK-8222072: JVMTI GenerateEvents() sends CompiledMethodLoad
    events to wrong jvmtiEnv
    + JDK-8222286: Fix for JDK-8213419 is broken on s390
    + JDK-8222527: HttpClient doesn't send HOST header when
    tunelling HTTP/1.1 through http proxy
    + JDK-8222533: jtreg test jdk/internal/platform/cgroup/
    /TestCgroupMetrics.java fails on SLES12.3 linux ppc64le
    machine
    + JDK-8224506: [TESTBUG] TestDockerMemoryMetrics.java fails
    with exitValue = 137
    + JDK-8224555: vmTestbase/nsk/jvmti/scenarios/contention/TC02/
    /tc02t001/TestDescription.java failed
    + JDK-8224650: Add tests to support X25519 and X448 in TLS
    + JDK-8225072: Add LuxTrust certificate that is expiring in
    March 2021 to list of allowed but expired certs
    + JDK-8225329: -XX:+PrintBiasedLockingStatistics causes crash
    during initialization on Windows platforms
    + JDK-8225687: Newly added sspi.cpp in JDK-6722928 still
    contains some small errors
    + JDK-8227006: [linux] Runtime.availableProcessors execution
    time increased by factor of 100
    + JDK-8227275: Within native OOM error handling, assertions may
    hang the process
    + JDK-8227647: [Graal] Test8009761.java fails due to
    "RuntimeException: static java.lang.Object
    compiler.uncommontrap.Test8009761.m3(boolean,boolean) not
    compiled"
    + JDK-8229495: SIGILL in C2 generated OSR compilation
    + JDK-8230910: libsspi_bridge does not build on Windows 32bit
    + JDK-8232114: JVM crashed at imjpapi.dll in native code
    + JDK-8234147: Avoid looking up standard charsets in core
    libraries
    + JDK-8234393: [macos] printing ignores printer tray
    + JDK-8234863: Increase default value of MaxInlineLevel
    + JDK-8235218: Minimal VM is broken after JDK-8173361
    + JDK-8235456: Minimal VM is broken after JDK-8212160
    + JDK-8235829: graal crashes with Zombie.java test
    + JDK-8236124: Minimal VM slowdebug build failed after
    JDK-8212160
    + JDK-8236512: PKCS11 Connection closed after Cipher.doFinal
    and NoPadding
    + JDK-8236944: The legVecZ operand should be limited to
    zmm0-zmm15 registers
    + JDK-8237186: Fix typo in copyright header of
    java/io/Reader/TransferTo.java
    + JDK-8237499: JFR: Include stack trace in the ThreadStart event
    + JDK-8237512: AArch64: aarch64TestHook leaks a BufferBlob
    + JDK-8237524: AArch64: String.compareTo() may return incorrect
    result
    + JDK-8237950: C2 compilation fails with "Live Node limit
    exceeded limit" during ConvI2L::Ideal optimization
    + JDK-8238579: HttpsURLConnection drops the timeout and hangs
    forever in read
    + JDK-8239105: Add exception for expiring Digicert root
    certificates to VerifyCACerts test
    + JDK-8239477: jdk/jfr/jcmd/TestJcmdStartStopDefault.java fails
  - XX:+VerifyOops with "verify_oop: rsi: broken oop"
    + JDK-8239497: SEGV in EdgeUtils::field_name_symbol(Edge const&amp;)
    + JDK-8239886: Minimal VM build fails after JDK-8237499
    + JDK-8240633: Memory leaks in the implementations of
    FileChooserUI
    + JDK-8240690: Race condition between EDT and
    BasicDirectoryModel.FilesLoader.run0()
    + JDK-8241234: Unify monitor enter/exit runtime entries.
    + JDK-8241311: Move some charset mapping tests from closed to
    open
    + JDK-8241797: Add some tests to the problem list
    + JDK-8242029: AArch64: skip G1 array copy pre-barrier if
    marking not active
    + JDK-8242335: Additional Tests for RSASSA-PSS
    + JDK-8242480: Negative value may be returned by
    getFreeSwapSpaceSize() in the docker
    + JDK-8242614: cleanup duplicated test ldap server in some
    com/sun/jndi/ldap/ tests
    + JDK-8242846: Bring back test/jdk/tools/jlink/plugins/
    /OrderResourcesPluginTest.java
    + JDK-8243114: Implement montgomery{Multiply,Square}intrinsics
    on Windows
    + JDK-8243290: Improve diagnostic messages for class
    verification and redefinition failures
    + JDK-8243488: Add tests for set/get SendBufferSize and
    getReceiveBufferSize in DatagramSocket
    + JDK-8243549: sun/security/ssl/CipherSuite/
    /NamedGroupsWithCipherSuite.java failed with Unsupported
    signature algorithm: DSA
    + JDK-8243617: compiler/onSpinWait/TestOnSpinWaitC1.java test
    uses wrong class
    + JDK-8243619: compiler/codecache/CheckSegmentedCodeCache.java
    test misses -version
    + JDK-8244142: some hotspot/runtime tests don't check exit code
    of forked JVM
    + JDK-8244278: Excessive code cache flushes and sweeps
    + JDK-8244282: test/hotspot/jtreg/compiler/intrinsics/
    /Test8237524.java fails with --illegal-access=deny
    + JDK-8244621: [macos10.15] Garbled FX printing plus CoreText
    warnings on Catalina when building with Xcode 11
    + JDK-8244819: hsdis does not compile with binutils 2.34+
    + JDK-8245051: c1 is broken if it is compiled by gcc without
  - fno-lifetime-dse
    + JDK-8245168: jlink should not be treated as a "small" tool
    + JDK-8245400: Upgrade to LittleCMS 2.11
    + JDK-8246381: VM crashes with "Current BasicObjectLock* below
    than low_mark"
    + JDK-8246434: Threads::print_on_error assumes that the heap
    has been set up
    + JDK-8246648: issue with OperatingSystemImpl
    getFreeSwapSpaceSize in docker after 8242480
    + JDK-8247201: Print potential pointer value of readable stack
    memory in hs_err file
    + JDK-8247763: assert(outer-&gt;outcnt() == 2) failed: 'only phis'
    failure in LoopNode::verify_strip_mined()
    + JDK-8247867: Upgrade to freetype 2.10.2
    + JDK-8248190: Enable Power10 system and implement new
    byte-reverse instructions
    + JDK-8248226: TestCloneAccessStressGCM fails with
  - XX:-ReduceBulkZeroing
    + JDK-8248347: windows build broken by JDK-8243114
    + JDK-8248532: Every time I change keyboard language at my
    MacBook, Java crashes
    + JDK-8248552: C2 crashes with SIGFPE due to division by zero
    + JDK-8248596: [TESTBUG] compiler/loopopts/
    /PartialPeelingUnswitch.java times out with Graal enabled
    + JDK-8248745: Add jarsigner and keytool tests for restricted
    algorithms
    + JDK-8248791: sun/util/resources/cldr/TimeZoneNamesTest.java
    fails with -XX:-ReduceInitialCardMarks -XX:-ReduceBulkZeroing
    + JDK-8248845: AArch64: stack corruption after spilling vector
    register
    + JDK-8249176: Update GlobalSignR6CA test certificates
    + JDK-8249183: JVM crash in "AwtFrame::WmSize" method
    + JDK-8249192: MonitorInfo stores raw oops across safepoints
    + JDK-8249602: C2: assert(cnt == _outcnt) failed: no insertions
    allowed
    + JDK-8249603: C1: assert(has_error == false) failed: register
    allocation invalid
    + JDK-8249605: C2: assert(no_dead_loop) failed: dead loop
    detected
    + JDK-8249607: C2: assert(!had_error) failed: bad dominance
    + JDK-8249608: Vector register used by C2 compiled method
    corrupted at safepoint
    + JDK-8249672: Include microcode revision in features_string on
    x86
    + JDK-8249748: gtest silently ignores bad jvm arguments
    + JDK-8249821: Separate libharfbuzz from libfontmanager
    + JDK-8250598: Hyper-V is detected in spite of running on host
    OS
    + JDK-8250605: Linux x86_32 builds fail after JDK-8249821
    + JDK-8250636: iso8601_time returns incorrect offset part on
    MacOS
    + JDK-8250665: Wrong translation for the month name of May in
    ar_JO,LB,SY
    + JDK-8250772: Test com/sun/jndi/ldap/
    /NamingExceptionMessageTest.java fails intermittently with
    javax.naming.ServiceUnavailableException
    + JDK-8250825: C2 crashes with assert(field != __null) failed:
    missing field
    + JDK-8250894: Provide a configure option to build and run
    against the platform libharfbuzz
    + JDK-8250928: JFR: Improve hash algorithm for stack traces
    + JDK-8250968: Symlinks attributes not preserved when using
    jarsigner on zip files
    + JDK-8250984: Memory Docker tests fail on some Linux kernels
    w/o cgroupv1 swap limit capabilities
    + JDK-8251118: BiasedLocking::preserve_marks should not have a
    HandleMark
    + JDK-8251189: com/sun/jndi/ldap/LdapDnsProviderTest.java
    failed due to timeout
    + JDK-8251257: NMT: jcmd VM.native_memory scale=1 crashes
    target VM
    + JDK-8251365: Build failure on AIX after 8250636
    + JDK-8251397: NPE on ClassValue.ClassValueMap.cacheArray
    + JDK-8251456: [TESTBUG] compiler/vectorization/
    /TestVectorsNotSavedAtSafepoint.java failed OutOfMemoryError
    + JDK-8251458: Parse::do_lookupswitch fails with "assert(_cnt
    &gt;= 0) failed"
    + JDK-8251535: Partial peeling at unsigned test adds incorrect
    loop exit check
    + JDK-8251949: ZGC: Set explicit heap size for
    compiler/gcbarriers tests
    + JDK-8252090: JFR: StreamWriterHost::write_unbuffered() stucks
    in an infinite loop OpenJDK (build 13.0.1+9)
    + JDK-8252415: Bump update version for OpenJDK: jdk-11.0.10
    + JDK-8252470: java/awt/dnd/DisposeFrameOnDragCrash/
    /DisposeFrameOnDragTest.java fails on Windows
    + JDK-8252497: Incorrect numeric currency code for ROL
    + JDK-8252660: Shenandoah: support manageable SoftMaxHeapSize
    option
    + JDK-8252679: Two windows specific FileDIalog tests may fail
    on some Windows_Server_2016_Standard
    + JDK-8252696: Loop unswitching may cause out of bound array
    load to be executed
    + JDK-8252754: Hash code calculation of JfrStackTrace is
    inconsistent
    + JDK-8253219: Epsilon: clean up unnecessary includes
    + JDK-8253224: Shenandoah: ShenandoahStrDedupQueue destructor
    calls virtual num_queues()
    + JDK-8253226: Shenandoah: remove unimplemented
    ShenandoahStrDedupQueue::verify
    + JDK-8253269: The CheckCommonColors test should provide more
    info on failure
    + JDK-8253284: Zero OrderAccess barrier mappings are incorrect
    + JDK-8253375: OSX build fails with Xcode 12.0 (12A7209)
    + JDK-8253778: ShenandoahSafepoint::is_at_shenandoah_safepoint
    should not access VMThread state from other threads
    + JDK-8253791: Issue with useAppleColor check in CSystemColors.m
    + JDK-8254016: Test8237524 fails with -XX:-CompactStrings option
    + JDK-8254081: java/security/cert/PolicyNode/
    /GetPolicyQualifiers.java fails due to an expired certificate
    + JDK-8254144: Non-x86 Zero builds fail with return-type
    warning in os_linux_zero.cpp
    + JDK-8254166: Zero: return-type warning in
    zeroInterpreter_zero.cpp
    + JDK-8254177: (tz) Upgrade time-zone data to tzdata2020b
    + JDK-8254185: Fix Code cache sweeper heuristics for JDK 11
    + JDK-8254190: [s390] interpreter misses exception check after
    calling monitorenter
    + JDK-8254790: SIGSEGV in string_indexof_char and
    stringL_indexof_char intrinsics
    + JDK-8254854: [cgroups v1] Metric limits not properly detected
    on some join controller combinations
    + JDK-8254982: (tz) Upgrade time-zone data to tzdata2020c
    + JDK-8255050: Add pkcs11/KeyStore/ClientAuth.sh to Problem list
    + JDK-8255065: Zero: accessor_entry misses the IRIW case
    + JDK-8255226: (tz) Upgrade time-zone data to tzdata2020d
    + JDK-8255269: Unsigned overflow in g1Policy.cpp
    + JDK-8255365: Problem list failing client manual tests
    + JDK-8255457: Shenandoah: cleanup ShenandoahMarkTask
    + JDK-8255466: C2 crashes at ciObject::get_oop() const+0x0
    + JDK-8255550: x86: Assembler::cmpq(Address dst, Register src)
    encoding is incorrect
    + JDK-8255603: Memory/Performance regression after JDK-8210985
    + JDK-8255760: Shenandoah: match constants style in
    ShenandoahMarkTask fallback
    + JDK-8255781: Bump patch update version for OpenJDK:
    jdk-11.0.9.1
    + JDK-8255937: Better cleanup for
    test/jdk/javax/imageio/stream/StreamFlush.java
    + JDK-8256427: Test com/sun/jndi/dns/ConfigTests/
    /PortUnreachable.java does not work on AIX
    + JDK-8256452: Integrate missing part of JDK-8232370 to 11u
    + JDK-8256483: [TESTBUG] serviceability/jvmti/GetClassMethods/
    /libOverpassMethods.c fails to compile on gcc 4.4.x
    + JDK-8256557: libharfbuzz fails to link on gcc 4.4.x due to
  - Wl,-z,defs
    + JDK-8256618: Zero: Linux x86_32 build still fails
    + JDK-8256736: Zero: GTest tests fail with "unsuppported vm
    variant"
    + JDK-8256809: Annotation processing causes NPE during flow
    analysis
    + JDK-8257181: s390x builds are very noisy with gc-sections
    messages
    + JDK-8257242: [macOS] Java app crashes while switching input
    methods
    + JDK-8257545: SunJSSE FIPS regression in key exchange after
    JDK-8171279 11u backport
    + JDK-8257641: Shenandoah: Query is_at_shenandoah_safepoint()
    from control thread should return false
    + JDK-8257701: Shenandoah: objArrayKlass metadata is not marked
    with chunked arrays
    + JDK-8258630: Add expiry exception for QuoVadis root
    certificate
- New upstream dependency on libharfbuzz
- Regenerated patches: missing-return.patch system-pcsclite.patch</changelog>
  <changelog author="fstrba@suse.com" date="1616155200">- Added patches:
  * system-crypto-policy.patch
    + Let OpenJDK use system crypto policies unless explicitely told
    not to
  * nss-security-provider.patch
    + Add the NSS security provider with configuration in generated
    nss.cfg file
  * keytool-default-rsa.patch
    + Make keytool generate RSA keys by default, since only the
    LEGACY system crypto policy allows DSA</changelog>
  <changelog author="pujos.michael@gmail.com" date="1618488000">- moved mozilla-nss dependency to java-11-openjdk-headless package
  This is necessary to be able to do crypto with just
  java-11-openjdk-headless installed. Fixes boo#1184606</changelog>
  <changelog author="fstrba@suse.com" date="1619006400">- Update to upstream tag jdk-11.0.11+9 (April 2021, CPU)
  * Security fixes
    + JDK-8244473: Contextualize registration for JNDI
    + JDK-8244543: Enhanced handling of abstract classes
    + JDK-8249906, CVE-2021-2163, bsc#1185055: Enhance opening JARs
    + JDK-8250568, CVE-2021-2161, bsc#1185056: Less ambiguous
    processing
    + JDK-8253799: Make lists of normal filenames
    + JDK-8257001: Improve Http Client Support
  * Other changes
    + JDK-7107012: sun.jvm.hotspot.code.CompressedReadStream
    readDouble() conversion to long mishandled
    + JDK-7146776: deadlock between URLStreamHandler.getHostAddress
    and file.Handler.openconnection
    + JDK-8086003: Test fails on OSX with java.lang.RuntimeException
    'Narrow klass base: 0x0000000000000000, Narrow klass shift: 3'
    missing
    + JDK-8168869: jdeps: localized messages don't use proper line
    breaks
    + JDK-8180837: SunPKCS11-NSS tests failing with
    CKR_ATTRIBUTE_READ_ONLY and CKR_MECHANISM_PARAM_INVALID
    + JDK-8202343: Disable TLS 1.0 and 1.1
    + JDK-8205992: jhsdb cannot attach to Java processes running in
    Docker containers
    + JDK-8209193: Fix aarch64-linux compilation after -Wreorder
    changes
    + JDK-8210413: AArch64: Optimize div/rem by constant in C1
    + JDK-8210578: AArch64: Invalid encoding for fmlsvs instruction
    + JDK-8211051: jdeps usage of --dot-output doesn't provide
    valid output for modular jar
    + JDK-8211057: Gensrc step CompileProperties generates unstable
    CompilerProperties output
    + JDK-8211150: G1 Full GC not purging code root memory and
    hence causing memory leak
    + JDK-8211825: ModuleLayer.defineModulesWithXXX does not setup
    delegation when module reads automatic module
    + JDK-8212043: Add floating-point Math.min/max intrinsics
    + JDK-8212218: [TESTBUG] runtime/ErrorHandling/
    /TestHeapDumpOnOutOfMemoryErrorInMetaspace.java timed out
    + JDK-8213116: javax/swing/JComboBox/WindowsComboBoxSize/
    /WindowsComboBoxSizeTest.java fails in Windows
    + JDK-8213909: jdeps --print-module-deps should report missing
    dependences
    + JDK-8214180: Need better granularity for sleeping
    + JDK-8214223: tools/jdeps/listdeps/ListModuleDeps.java failed
    due to missing Lib2 file
    + JDK-8214230: Classes generated by SystemModulesPlugin.java
    are not reproducable
    + JDK-8214741: docs/index.html has no title or copyright
    + JDK-8215687: [Graal] unit test CheckGraalIntrinsics failed
    after 8212043
    + JDK-8217848: [Graal] vmTestbase/nsk/jvmti/ResourceExhausted/
    /resexhausted003/TestDescription.java fails
    + JDK-8218482: sun/security/krb5/auto/ReplayCachePrecise.java
    failed - no KrbException thrown
    + JDK-8218550: Add test omitted from JDK-8212043
    + JDK-8221584: SIGSEGV in os::PlatformEvent::unpark() in
    JvmtiRawMonitor::raw_exit while posting method exit event
    + JDK-8221995: AARCH64: problems with CAS instructions encoding
    + JDK-8222518: Remove unnecessary caching of Parker object in
    java.lang.Thread
    + JDK-8222785: aarch64: add necessary masking for immediate
    shift counts
    + JDK-8223186: HotSpot compile warnings from GCC 9
    + JDK-8225773: jdeps --check produces NPE if there are missing
    module dependences
    + JDK-8225805: Java Access Bridge does not close the logger
    + JDK-8226810: Failed to launch JVM because of
    NullPointerException occured on System.props
    + JDK-8229396: jdeps ignores multi-release when
    generate-module-info used on command line
    + JDK-8229474: Shenandoah: Cleanup CM::update_roots()
    + JDK-8232225: Rework the fix for JDK-8071483
    + JDK-8232905: JFR fails with assertion:
    assert(t-&gt;unflushed_size() == 0) failed: invariant
    + JDK-8233164: C2 fails with assert(phase-&gt;C-&gt;get_alias_index(t)
    == phase-&gt;C-&gt;get_alias_index(t_adr)) failed: correct memory
    chain
    + JDK-8233910: java/awt/ColorClass/AlphaColorTest.java is
    failing  intermittently in nightly lnux-x64 system
    + JDK-8233912: aarch64: minor improvements of atomic operations
    + JDK-8234508: VM_HeapWalkOperation::iterate_over_object reads
    non-strong fields with an on-strong load barrier
    + JDK-8234742: Improve handshake logging
    + JDK-8234796: Refactor Handshake::execute to take a more
    complex type than ThreadClosure
    + JDK-8235324: Dying objects are published from users of
    CollectedHeap::object_iterate
    + JDK-8235351: Lookup::unreflect should bind with the original
    caller independent of Method's accessible flag
    + JDK-8237369: Shenandoah: failed vmTestbase/nsk/jvmti/
    /AttachOnDemand/attach021/TestDescription.java test
    + JDK-8237392: Shenandoah: Remove unreliable assertion
    + JDK-8237483: AArch64 C1 OopMap inserted twice fatal error
    + JDK-8237495: Java MIDI fails with a dereferenced memory error
    when asked to send a raw 0xF7
    + JDK-8239355: (dc) Initial value of SO_SNDBUF should allow
    sending large datagrams (macOS)
    + JDK-8240353: AArch64: missing support for
  - XX:+ExtendedDTraceProbes in C1
    + JDK-8240704: CheckHandles.java failed "AssertionError: Handle
    use increased by more than 10 percent."
    + JDK-8240751: Shenandoah: fold ShenandoahTracer definition
    + JDK-8240795: [REDO] 8238384 CTW: C2 compilation fails with
    "assert(store != load-&gt;find_exact_control(load-&gt;in(0)))
    failed: dependence cycle found"
    + JDK-8241598: Upgrade JLine to 3.14.0
    + JDK-8241649: Optimize Character.toString
    + JDK-8241770: Module xxxAnnotation() methods throw NCDFE if
    module-info.class found as resource in unnamed module
    + JDK-8241911: AArch64: Fix a potential register clash issue in
    reduce_add2I
    + JDK-8242030: Wrong package declarations in jline classes after
    JDK-8241598
    + JDK-8242565: Policy initialization issues when the denyAfter
    constraint is enabled
    + JDK-8243618: compiler/rtm/cli tests can be run w/o WhiteBox
    + JDK-8243670: Unexpected test result caused by C2
    MergeMemNode::Ideal
    + JDK-8244088: [Regression] Switch of Gnome theme ends up in
    deadlocked UI
    + JDK-8244154: Update SunPKCS11 provider with PKCS11 v3.0 header
    files
    + JDK-8244340: Handshake processing thread lacks yielding
    + JDK-8244573: java.lang.ArrayIndexOutOfBoundsException thrown
    for malformed class file
    + JDK-8244683: A TSA server used by tests
    + JDK-8245005: javax/net/ssl/compatibility/BasicConnectTest.java
    failed with No enum constant
    + JDK-8245026: PsAdaptiveSizePolicy::_old_gen_policy_is_ready is
    unused
    + JDK-8245283: JFR: Can't handle constant dynamic used by Jacoco
    agent
    + JDK-8245512: CRC32 optimization using AVX512 instructions
    + JDK-8245527: LDAP Channel Binding support for Java
    GSS/Kerberos
    + JDK-8246707: (sc) SocketChannel.read/write throws
    AsynchronousCloseException on closed channel
    + JDK-8246709: sun/security/tools/jarsigner/
    /TsacertOptionTest.java compilation failed after JDK-8244683
    + JDK-8247200: assert((unsigned)fpargs &lt; 32)
    + JDK-8247766: [aarch64] guarantee(val &lt; (1U &lt;&lt; nbits))
    failed: Field too big for insn.
    + JDK-8248336: AArch64: C2: offset overflow in
    BoxLockNode::emit
    + JDK-8248865: Document JNDI/LDAP timeout properties
    + JDK-8248901: Signed immediate support in
    .../share/assembler.hpp is broken.
    + JDK-8249543: Force DirectBufferAllocTest to run with
  - ExplicitGCInvokesConcurrent
    + JDK-8249588: libwindowsaccessbridge issues on 64bit Windows
    + JDK-8249749: modify a primitive array through a stream and a
    for cycle causes jre crash
    + JDK-8249787: Make TestGCLocker more resilient with concurrent
    GCs
    + JDK-8249867: xml declaration is not followed by a newline
    + JDK-8250911: [windows] os::pd_map_memory() error detection
    broken
    + JDK-8251255: [linux] Add process-memory information to hs-err
    and VM.info
    + JDK-8251359: Shenandoah: filter null oops before calling
    enqueue/SATB barrier
    + JDK-8251925: C2: RenaissanceStressTest fails with
    assert(!had_error): bad dominance
    + JDK-8251944: Add Shenandoah test config to
    compiler/gcbarriers/UnsafeIntrinsicsTest.java
    + JDK-8251992: VM crashed running TestComplexAddrExpr.java test
    with -XX:UseAVX=X
    + JDK-8253220: Epsilon: clean up unused code/declarations
    + JDK-8253274: The CycleDMImagetest brokes the system
    + JDK-8253353: Crash in C2: guarantee(n != NULL) failed: No Node
    + JDK-8253368: TLS connection always receives close_notify
    exception
    + JDK-8253404: C2: assert(C-&gt;live_nodes() &lt;=
    C-&gt;max_node_limit()) failed: Live Node limit exceeded limit
    + JDK-8253409: Double-rounding possibility in float fma
    + JDK-8253476: TestUseContainerSupport.java fails on some Linux
    kernels w/o swap limit capabilities
    + JDK-8253524: C2: Refactor code that clones predicates during
    loop unswitching
    + JDK-8253644: C2: assert(skeleton_predicate_has_opaque(iff))
    failed: unexpected
    + JDK-8253681: closed java/awt/dnd/MouseEventAfterStartDragTest/
    /MouseEventAfterStartDragTest.html test failed
    + JDK-8253702: BigSur version number reported as 10.16, should
    be 11.nn
    + JDK-8253756: C2 CompilerThread0 crash in Node::add_req(Node*)
    + JDK-8254104: MethodCounters must exist before nmethod is
    installed
    + JDK-8254734: "dead loop detected" assert failure with patch
    from 8223051
    + JDK-8254748: Bad Copyright header format after JDK-8212218
    + JDK-8254799: runtime/ErrorHandling/
    /TestHeapDumpOnOutOfMemoryError.java fails with release VMs
    + JDK-8255058: C1: assert(is_virtual()) failed: type check
    + JDK-8255351: Add detection for Graviton 2 CPUs
    + JDK-8255368: Math.exp() gives wrong result for large values on
    x86 32-bit platforms
    + JDK-8255387: Japanese characters were printed upside down on
    AIX
    + JDK-8255401: Shenandoah: Allow oldval and newval registers to
    overlap in cmpxchg_oop()
    + JDK-8255479: [aarch64] assert(src-&gt;section_index_of(target) ==
    CodeBuffer::SECT_NONE) failed: sanity
    + JDK-8255544: Create a checked cast
    + JDK-8255559: Leak File Descriptors Because of
    ResolverLocalFilesystem#engineResolveURI()
    + JDK-8255681: print callstack in error case in
    runAWTLoopWithApp
    + JDK-8255734: VM should ignore SIGXFSZ on ppc64, s390 too
    + JDK-8255742: PrintInlining as compiler directive doesn't print
    virtual calls
    + JDK-8255845: Memory leak in imageFile.cpp
    + JDK-8255880: UI of Swing components is not redrawn after their
    internal state changed
    + JDK-8255908: ExceptionInInitializerError due to
    UncheckedIOException while initializing cgroupv1 subsystem
    + JDK-8256025: AArch64: MachCallRuntimeNode::ret_addr_offset()
    is incorrect for stub calls
    + JDK-8256056: Deoptimization stub doesn't save vector registers
    on x86
    + JDK-8256061: RegisterSaver::save_live_registers() omits upper
    halves of ZMM0-15 registers
    + JDK-8256187: [TEST_BUG] Automate bug4275046.java test
    + JDK-8256220: C1: x86_32 fails with -XX:UseSSE=1 after
    JDK-8210764 due to mishandled lir_neg
    + JDK-8256258: some missing NULL checks or asserts after
    CodeCache::find_blob_unsafe
    + JDK-8256264: Printed GlyphVector outline with low DPI has bad
    quality on Windows
    + JDK-8256290: javac/lambda/T8031967.java fails with
    StackOverflowError on x86_32
    + JDK-8256359: AArch64: runtime/ReservedStack/
    /ReservedStackTestCompiler.java fails
    + JDK-8256387: Unexpected result if patching an entire
    instruction on AArch64
    + JDK-8256421: Add 2 HARICA roots to cacerts truststore
    + JDK-8256488: [aarch64] Use ldpq/stpq instead of ld4/st4 for
    small copies in StubGenerator::copy_memory
    + JDK-8256489: Make gtest for long path names on Windows more
    resilient in the presence of virus scanners
    + JDK-8256501: libTestMainKeyWindow fails to build with Xcode
    12.2
    + JDK-8256633: Fix product build on Windows+Arm64
    + JDK-8256682: JDK-8202343 is incomplete
    + JDK-8256751: Incremental rebuild with precompiled header fails
    when touching a header file
    + JDK-8256757: Incorrect MachCallRuntimeNode::ret_addr_offset()
    for CallLeafNoFP on x86_32
    + JDK-8256806: Shenandoah: optimize shenandoah/jni/
    /TestPinnedGarbage.java test
    + JDK-8256807: C2: Not marking stores correctly as mismatched
    in string opts
    + JDK-8256810: Incremental rebuild broken on Macosx
    + JDK-8256818: SSLSocket that is never bound or connected leaks
    socket resources
    + JDK-8256888: Client manual test problem list update
    + JDK-8257083: Security infra test failures caused by
    JDK-8202343
    + JDK-8257408: Bump update version for OpenJDK: jdk-11.0.11
    + JDK-8257423: [PPC64] Support -XX:-UseInlineCaches
    + JDK-8257436: [aarch64] Regressions in ArrayCopyUnalignedDst
    .testByte/testChar for 65-78 bytes when UseSIMDForMemoryOps
    is on
    + JDK-8257513: C2: assert((constant_addr -
    _masm.code()-&gt;consts()-&gt;start()) == con.offset())
    + JDK-8257547: Handle multiple prereqs on the same line in deps
    files
    + JDK-8257561: Some code is not vectorized after 8251925 and
    8250607
    + JDK-8257565: epsilonBarrierSet.hpp should not include
    barrierSetAssembler
    + JDK-8257575: C2: "failed: only phis" assert failure in loop
    strip mining verification
    + JDK-8257594: C2 compiled checkcast of non-null object triggers
    endless deoptimization/recompilation cycle
    + JDK-8257633: Missing -mmacosx-version-min=X flag when linking
    libjvm
    + JDK-8257670: sun/security/ssl/SSLSocketImpl/SSLSocketLeak.java
    reports leaks
    + JDK-8257707: Fix incorrect format string in Http1HeaderParser
    + JDK-8257746: Regression introduced with JDK-8250984 - memory
    might be null in some machines
    + JDK-8257798: [PPC64] undefined reference to
    Klass::vtable_start_offset()
    + JDK-8257884: Re-enable sun/security/ssl/SSLSocketImpl/
    /SSLSocketLeak.java as automatic test
    + JDK-8257910: [JVMCI] Set exception_seen accordingly in the
    runtime.
    + JDK-8257997: sun/security/ssl/SSLSocketImpl/SSLSocketLeak.java
    again reports leaks after JDK-8257884
    + JDK-8257999: Parallel GC crash in gc/parallel/
    /TestDynShrinkHeap.java: new region is not in covered_region
    + JDK-8258077: Using -Xcheck:jni can lead to a double-free after
    JDK-8193234
    + JDK-8258247: Couple of issues in fix for JDK-8249906
    + JDK-8258373: Update the text handling in the JPasswordField
    + JDK-8258396: SIGILL in jdk.jfr.internal.PlatformRecorder
    .rotateDisk()
    + JDK-8258419: RSA cipher buffer cleanup
    + JDK-8258471: "search codecache" clhsdb command does not work
    + JDK-8258534: Epsilon: clean up unused includes
    + JDK-8258805: Japanese characters not entered by mouse click
    on Windows 10
    + JDK-8258833: Cancel multi-part cipher operations in SunPKCS11
    after failures
    + JDK-8258836: JNI local refs exceed capacity
    getDiagnosticCommandInfo
    + JDK-8258884: [TEST_BUG] Convert applet-based test
    open/test/jdk/javax/swing/JMenuItem/8031573/bug8031573.java
    to a regular java test
    + JDK-8259007: This test printed a blank page
    + JDK-8259048: (tz) Upgrade time-zone data to tzdata2020f
    + JDK-8259049: Uninitialized variable after JDK-8257513
    + JDK-8259231: Epsilon: improve performance under contention
    during virtual space expansion
    + JDK-8259271: gc/parallel/TestDynShrinkHeap.java still fails
    "assert(covered_region.contains(new_memregion)) failed: new
    region is not in covered_region"
    + JDK-8259312: VerifyCACerts.java fails as soneraclass2ca cert
    will expire in 90 days
    + JDK-8259319: Illegal package access when SunPKCS11 requires
    SunJCE's classes
    + JDK-8259339: AllocateUninitializedArray C2 intrinsic fails
    with void.class input
    + JDK-8259428: AlgorithmId.getEncodedParams() should return copy
    + JDK-8259446: runtime/jni/checked/
    /TestCheckedReleaseArrayElements.java fails with stderr not
    empty
    + JDK-8259451: Zero: skip serviceability/sa tests, set vm.hasSA
    to false
    + JDK-8259580: Shenandoah: uninitialized label in
    VerifyThreadGCState
    + JDK-8259619: C1: 3-arg StubAssembler::call_RT stack-use
    condition is incorrect
    + JDK-8259633: compiler/graalunit/CoreTest.java fails with NPE
    after JDK-8244543
    + JDK-8259706: C2 compilation fails with assert(vtable_index ==
    Method::invalid_vtable_index) failed: correct sentinel value
    + JDK-8259707: LDAP channel binding does not work with StartTLS
    extension
    + JDK-8259773: Incorrect encoding of AVX-512 kmovq instruction
    + JDK-8259849: Shenandoah: Rename store-val to IU-barrier
    + JDK-8259949: x86 32-bit build fails when -fcf-protection is
    passed in the compiler flags
    + JDK-8259954: gc/shenandoah/mxbeans tests fail with -Xcomp
    + JDK-8260029: aarch64: fix typo in verify_oop_array
    + JDK-8260308: Update LogCompilation junit to 4.13.1
    + JDK-8260338: Some fields in HaltNode is not cloned
    + JDK-8260349: Cannot programmatically retrieve Metaspace max
    set via JAVA_TOOL_OPTIONS
    + JDK-8260356: (tz) Upgrade time-zone data to tzdata2021a
    + JDK-8260378: [TESTBUG] DcmdMBeanTestCheckJni.java reports
    false positive
    + JDK-8260497: Shenandoah: Improve SATB flushing
    + JDK-8260502: [s390] NativeMovRegMem::verify() fails because
    it's too strict
    + JDK-8260632: Build failures after JDK-8253353
    + JDK-8260704: ParallelGC: oldgen expansion needs release-store
    for _end
    + JDK-8261022: Fix incorrect result of Math.abs() with char type
    + JDK-8261089: [TESTBUG] native library of test
    TestCheckedReleaseCriticalArray.java fails to compile with
    gcc 4.x
    + JDK-8261183: Follow on to Make lists of normal filenames
    + JDK-8261209: isStandalone property: remove dependency on
    pretty-print
    + JDK-8261231: Windows IME was disabled after DnD operation
    + JDK-8261251: Shenandoah: Use object size for full GC
    humongous compaction
    + JDK-8261310: PPC64 Zero build fails with
    'VMError::controlled_crash(int)::FunctionDescriptor
    functionDescriptor' has incomplete type and cannot be defined
    + JDK-8261334: NMT: tuning statistic shows incorrect hash
    distribution
    + JDK-8261413: Shenandoah: Disable class-unloading in I-U mode
    + JDK-8261522: [PPC64] AES intrinsics write beyond the
    destination array
    + JDK-8261534: Test sun/security/pkcs11/KeyAgreement/
    /IllegalPackageAccess.java fails on platforms where no nsslib
    artifacts are defined
    + JDK-8261585: Restore HandleArea used in
    Deoptimization::uncommon_trap
    + JDK-8261753: Test java/lang/System/OsVersionTest.java still
    failing on BigSur patch versions after JDK-8253702
    + JDK-8261829: Exclude tools/jlink/JLinkReproducibleTest.java
    in 11u
    + JDK-8261912: Code IfNode::fold_compares_helper more
    defensively
    + JDK-8261920: [AIX] jshell command throws java.io.IOError on
    non English locales
    + JDK-8262018: Wrong format in SAP copyright header of
    OsVersionTest
    + JDK-8263069: Exclude some failing tests from
    security/infra/java/security/cert/CertPathValidator</changelog>
  <changelog author="fstrba@suse.com" date="1620043200">- Remove all Jpackage provides for SLE12 in order to avoid
  installing this package as default Java on SLE12-SP5
  (bsc#1185476)</changelog>
  <changelog author="fstrba@suse.com" date="1621512000">- Modified patch:
  * nss-security-provider.patch
    + make the NSS provider first in the list</changelog>
  <changelog author="fstrba@suse.com" date="1626868800">- Update to upstream tag jdk-11.0.12+7 (July 2021, CPU)
  * Security fixes
    + JDK-8256157: Improve bytecode assembly
    + JDK-8256491: Better HTTP transport
    + JDK-8258432, CVE-2021-2341, bsc#1188564: Improve file
    transfers
    + JDK-8260453: Improve Font Bounding
    + JDK-8260960: Signs of jarsigner signing
    + JDK-8260967, CVE-2021-2369, bsc#1188565: Better jar file
    validation
    + JDK-8262380: Enhance XML processing passes
    + JDK-8262403: Enhanced data transfer
    + JDK-8262410: Enhanced rules for zones
    + JDK-8262477: Enhance String Conclusions
    + JDK-8262967: Improve Zip file support
    + JDK-8264066, CVE-2021-2388, bsc#1188566: Enhance compiler
    validation
    + JDK-8264079: Improve abstractions
    + JDK-8264460: Improve NTLM support
  * Other changes
    + JDK-6847157: java.lang.NullPointerException: HDC for
    component at sun.java2d.loops.Blit.Blit
    + JDK-7106851: Test should not use System.exit
    + JDK-8073446: TimeZone getOffset API does not  return a dst
    offset between years 2038-2137
    + JDK-8076190: Customizing the generation of a PKCS12 keystore
    + JDK-8153005: Upgrade the default PKCS12 encryption/MAC
    algorithms
    + JDK-8171303: sun/java2d/pipe/InterpolationQualityTest.java
    fails on Windows &amp; Linux
    + JDK-8177068: incomplete classpath causes NPE in Flow
    + JDK-8185734: [Windows] Structured Exception Catcher missing
    around gtest execution
    + JDK-8187450: JNI local refs exceeds capacity warning in
    NetworkInterface::getAll
    + JDK-8190763: Class cast exception on (CompoundEdit)
    UndoableEditEvent.getEdit()
    + JDK-8195841: PNGImageReader.readNullTerminatedString() doesnt
    check for non-null terminated strings with length equal to
    maxLen
    + JDK-8196100: javax/swing/text/JTextComponent/5074573/
    /bug5074573.java fails
    + JDK-8199646: JShell tests: jdk/jshell/
    /FailOverDirectExecutionControlTest.java failed with
    java.lang.UnsupportedOperationException
    + JDK-8206925: Support the certificate_authorities extension
    + JDK-8207160: ClassReader::adjustMethodParams can potentially
    return null if the args list is empty
    + JDK-8207247: AARCH64: Enable Minimal and Client VM builds
    + JDK-8207404: MulticastSocket tests failing on AIX
    + JDK-8207779: Method::is_valid_method() compares 'this' with
    NULL
    + JDK-8208061: runtime/LoadClass/TestResize.java fails with
    "Load factor too high" when running in CDS mode.
    + JDK-8209459: TestSHA512MultiBlockIntrinsics failed on AArch64
    + JDK-8210443: Migrate Locale matching tests to JDK Repo.
    + JDK-8213231: ThreadSnapshot::_threadObj can become stale
    + JDK-8213483: ARM32: runtime/ErrorHandling/
    /ShowRegistersOnAssertTest.java jtreg test fail
    + JDK-8213725: JShell NullPointerException due to class file
    with unexpected package
    + JDK-8213794: ARM32: disable TypeProfiling,
    CriticalJNINatives, Serviceablity tests for ARM32
    + JDK-8213845: ARM32: Interpreter doesn't call result handler
    after native calls
    + JDK-8214128: ARM32: wrong stack alignment on
    Deoptimization::unpack_frames
    + JDK-8214512: ARM32: Jtreg test compiler/c2/Test8062950.java
    fails on ARM
    + JDK-8214854: JDWP: Unforseen output truncation in logging
    + JDK-8214922: Add vectorization support for fmin/fmax
    + JDK-8215009: GCC 8 compilation error in libjli
    + JDK-8216184: CDS/appCDS tests failed on Windows due to long
    path to a classlist file
    + JDK-8216259: AArch64: Vectorize Adler32 intrinsics
    + JDK-8216314: SIGILL in CodeHeapState::print_names()
    + JDK-8217348: assert(thread-&gt;is_Java_thread()) failed: just
    checking
    + JDK-8217465: [REDO] - Optimize CodeHeap Analytics
    + JDK-8217561: X86: Add floating-point Math.min/max intrinsics
    + JDK-8217918: C2: -XX:+AggressiveUnboxing is broken
    + JDK-8218458: [TESTBUG] runtime/NMT/
    /CheckForProperDetailStackTrace.java fails with Expected
    stack trace missing from output
    + JDK-8219142: Remove unused JIMAGE_ResourcePath
    + JDK-8219586: CodeHeap State Analytics processes dead nmethods
    + JDK-8220074: Clean up GCC 8.3 errors in LittleCMS
    + JDK-8220407: compiler/intrinsics/math/
    /TestFpMinMaxIntrinsics.java timedout
    + JDK-8222302: [TESTBUG] test/hotspot/jtreg/compiler/intrinsics/
    /sha/cli/TestUseSHAOptionOnUnsupportedCPU.java fails on any
    other CPU
    + JDK-8222412: AARCH64: multiple instructions encoding issues
    + JDK-8223020: aarch64: expand minI_rReg and maxI_rReg patterns
    into separate instructions
    + JDK-8223444: Improve CodeHeap Free Space Management
    + JDK-8223504: Improve performance of forall loops by better
    inlining of "iterator()" methods
    + JDK-8223667: ASAN build broken
    + JDK-8225081: Remove Telia Company CA certificate expiring in
    April 2021
    + JDK-8225116: Test OwnedWindowsLeak.java intermittently fails
    + JDK-8225438: javax/net/ssl/TLSCommon/
    /TestSessionLocalPrincipal.java failed with Read timed out
    + JDK-8225756: [testbug] compiler/loopstripmining/
    /CheckLoopStripMining.java sets too short a
    SafepointTimeoutDelay
    + JDK-8226374: Restrict TLS signature schemes and named groups
    + JDK-8226627: assert(t-&gt;singleton()) failed: must be a constant
    + JDK-8226721: Missing intrinsics for Math.ceil, floor, rint
    + JDK-8227080: (fs) Files.newInputStream(...).skip(n) is slow
    + JDK-8227222: vmTestbase/jit/FloatingPoint/gen_math/Loops04/
    /Loops04.java failed XMM register should be 0-15
    + JDK-8227609: (fs) Files.newInputStream(...).skip(n) should
    allow skipping beyond file size
    + JDK-8230428: Cleanup dead CastIP node code in formssel.cpp
    + JDK-8231460: Performance issue (CodeHeap) with large free
    blocks
    + JDK-8231713: x86_32 build failures after JDK-8226721 (Missing
    intrinsics for Math.ceil, floor, rint)
    + JDK-8231841: AArch64: debug.cpp help() is missing an AArch64
    line for pns
    + JDK-8232084: HotSpot build failed with GCC 9.2.1
    + JDK-8232591: AArch64: Add missing match rules for smaddl,
    smsubl and smnegl
    + JDK-8233185: HttpServer.stop() blocks indefinitely when
    called on dispatch thread
    + JDK-8233787: Break cycle in vm_version* includes
    + JDK-8233948: AArch64: Incorrect mapping between OptoReg and
    VMReg for high 64 bits of Vector Register
    + JDK-8234355: Buffer overflow in jcmd GC.class_stats due to
    too many classes
    + JDK-8235368: Update BCEL to Version 6.4.1
    + JDK-8236859: WebSocket over authenticating proxy fails with
    NPE
    + JDK-8236992: AArch64: remove redundant load_klass in itable
    stub
    + JDK-8237743: test/langtools/jdk/jshell/
    /FailOverExecutionControlTest.java fails No
    ExecutionControlProvider with name 'nonExistent' and parameter
    keys: []
    + JDK-8237804: sun/security/mscapi tests fail with "Key pair
    not generated, alias &lt;nnnnnn&gt; already exists"
    + JDK-8238175: CTW: Class.getDeclaredMethods fails with
    assert(k-&gt;is_subclass_of(SystemDictionary::Throwable_klass()))
    failed: invalid exception class
    + JDK-8238567: SoftMainMixer.processAudioBuffers(): Wrong
    handling of stoppedMixers
    + JDK-8238812: assert(false) failed: bad AD file
    + JDK-8239312: [macos] javax/swing/JFrame/NSTexturedJFrame/
    /NSTexturedJFrame.java
    + JDK-8239386: handle ContendedPaddingWidth in
    vm_version_aarch64
    + JDK-8239536: Can't use 'java.util.List' object after
    importing 'java.awt.List'
    + JDK-8240487: Cleanup whitespace in .cc, .hh, .m, and .mm files
    + JDK-8240848: ArrayIndexOutOfBoundsException buf for
    TextCallbackHandler
    + JDK-8241082: Upgrade IANA Language Subtag Registry data to
    03-16-2020 version
    + JDK-8241087: Build failure with VS 2019 (16.5.0) due to C2039
    and C2873
    + JDK-8241101: [s390] jtreg test failure after JDK-8238696: not
    conformant features string
    + JDK-8241248: NullPointerException in
    sun.security.ssl.HKDF.extract(HKDF.java:93)
    + JDK-8241372: Several test failures due to
    javax.net.ssl.SSLException: Connection reset
    + JDK-8241475: AArch64: Add missing support for PopCountVI node
    + JDK-8241829: Cleanup the code for PrinterJob on windows
    + JDK-8241960: The SHA3 message digests impl of SUN provider
    are not thread safe after cloned
    + JDK-8242010: Upgrade IANA Language Subtag Registry to Version
    2020-04-01
    + JDK-8242429: Better implementation for sign extract
    + JDK-8242557: Add length limit for strings in PNGImageWriter
    + JDK-8242919: Paste locks up jshell
    + JDK-8243155: AArch64: Add support for SqrtVF
    + JDK-8243240: AArch64: Add support for MulVB
    + JDK-8243452: JFR: Could not create chunk in repository with
    over 200 recordings
    + JDK-8243559: Remove root certificates with 1024-bit keys
    + JDK-8243597: AArch64: Add support for integer vector abs
    + JDK-8244031: HttpClient should have more tests for HEAD
    requests
    + JDK-8244205: HTTP/2 tunnel connections through proxy may be
    reused regardless of which proxy is selected
    + JDK-8244847: Linux/PPC: runtime/CompressedOops/
    /CompressedClassPointers: smallHeapTest fails
    + JDK-8245511: G1 adaptive IHOP does not account for
    reclamation of humongous objects by young GC
    + JDK-8246274: G1 old gen allocation tracking is not in a
    separate class
    + JDK-8247354: [aarch64] PopFrame causes
    assert(oopDesc::is_oop(obj)) failed: not an oop
    + JDK-8247408: IdealGraph bit check expression canonicalization
    + JDK-8247432: Update IANA Language Subtag Registry to Version
    2020-09-29
    + JDK-8247438: JShell: When FailOverExecutionControlProvider
    fails the proximal cause is not shown
    + JDK-8247753: UIManager.getSytemLookAndFeelClassName() returns
    wrong value on Fedora 32
    + JDK-8248043: Need to eliminate excessive i2l conversions
    + JDK-8248411: [aarch64] Insufficient error handling when
    CodeBuffer is exhausted
    + JDK-8248568: compiler/c2/TestBit.java failed: test missing
    from stdout/stderr
    + JDK-8248870: AARCH64: I2L/L2I conversions can be skipped for
    masked positive values
    + JDK-8249142: java/awt/FontClass/CreateFont/DeleteFont.sh is
    unstable
    + JDK-8249189: AARCH64: more L2I conversions can be skipped
    + JDK-8249719: MethodHandle performance suffers from bad
    ResolvedMethodTable hash function
    + JDK-8249875: GCC 10 warnings -Wtype-limits with JFR code
    + JDK-8250635: MethodArityHistogram should use Compile_lock in
    favour of fancy checks
    + JDK-8250876: Fix issues with cross-compile on macos
    + JDK-8251031: Some vmTestbase/nsk/monitoring/RuntimeMXBean
    tests fail with hostnames starting from digits
    + JDK-8251525: AARCH64: Faster Math.signum(fp)
    + JDK-8252259: AArch64: Adjust default value of FLOATPRESSURE
    + JDK-8252311: AArch64: save two words in itable lookup stub
    + JDK-8252779: compiler/graalunit/HotspotTest.java failed after
    8251525
    + JDK-8252883: AccessDeniedException caused by delayed file
    deletion on Windows
    + JDK-8253167: ARM32 builds fail after JDK-8247910
    + JDK-8253572: [windows] CDS archive may fail to open with long
    file names
    + JDK-8253923: C2 doesn't always run loop opts for compilations
    that include loops
    + JDK-8253948: Memory leak in ImageFileReader
    + JDK-8254631: Better support ALPN byte wire values in SunJSSE
    + JDK-8254717: isAssignableFrom checks in
    KeyFactorySpi.engineGetKeySpec appear to be backwards
    + JDK-8255086: Update the root locale display names
    + JDK-8255625: AArch64: Implement Base64.encodeBlock
    accelerator/intrinsic
    + JDK-8255763: C2: OSR miscompilation caused by invalid memory
    instruction placement
    + JDK-8255992: JFR EventWriter does not use first string from
    StringPool with id 0
    + JDK-8256037: [TESTBUG] com/sun/jndi/dns/ConfigTests/
    /PortUnreachable.java fails due to the hard coded threshold
    is small
    + JDK-8256244: java/lang/ProcessHandle/PermissionTest.java
    fails with TestNG 7.1
    + JDK-8256287: [windows] add loop fuse to
    map_or_reserve_memory_aligned
    + JDK-8256523: Streamline Java SHA2 implementation
    + JDK-8257414: Drag n Drop target area is wrong on high DPI
    systems
    + JDK-8257569: Failure observed with
    JfrVirtualMemory::initialize
    + JDK-8257574: C2: "failed: parsing found no loops but there
    are some" assert failure
    + JDK-8257580: Bump update version for OpenJDK: jdk-11.0.12
    + JDK-8257604: JNI_ArgumentPusherVaArg leaks valist
    + JDK-8257621: JFR StringPool misses cached items across
    consecutive recordings
    + JDK-8257796: [TESTBUG]
    TestUseSHA512IntrinsicsOptionOnSupportedCPU.java fails
    on x86_32
    + JDK-8257822: C2 crashes with SIGFPE due to a division that
    floats above its zero check
    + JDK-8257828: SafeFetch may crash if invoked in non-JavaThreads
    + JDK-8257853: Remove dependencies on JNF's JNI utility
    functions in AWT and 2D code
    + JDK-8257858: [macOS]: Remove JNF dependency from
    libosxsecurity/KeystoreImpl.m
    + JDK-8257860: [macOS]: Remove JNF dependency from
    libosxkrb5/SCDynamicStoreConfig.m
    + JDK-8257988: Remove JNF dependency from
    libsaproc/MacosxDebuggerLocal.m
    + JDK-8258414: OldObjectSample events too expensive
    + JDK-8258505: [TESTBUG] TestDivZeroWithSplitIf.java fails due
    to missing UnlockDiagnosticVMOptions
    + JDK-8258753: StartTlsResponse.close() hangs due to
    synchronization issues
    + JDK-8259061: C2: assert(found) failed: memory-writing node is
    not placed in its original loop or an ancestor of it
    + JDK-8259227: C2 crashes with SIGFPE due to a division that
    floats above its zero check
    + JDK-8259232: Bad JNI lookup during printing
    + JDK-8259276: C2: Empty expression stack when reexecuting
    tableswitch/lookupswitch instructions after deoptimization
    + JDK-8259343: [macOS] Update JNI error handling in Cocoa code.
    + JDK-8259585: Accessible actions do not work on mac os x
    + JDK-8259651: [macOS] Replace JNF_COCOA_ENTER/EXIT macros
    + JDK-8259662: Don't wrap SocketExceptions into SSLExceptions
    in SSLSocketImpl
    + JDK-8259710: Inlining trace leaks memory
    + JDK-8259729: Missed JNFInstanceOf -&gt; IsInstanceOf conversion
    + JDK-8259777: Incorrect predication condition generated by ADLC
    + JDK-8259786: initialize last parameter of getpwuid_r
    + JDK-8259843: initialize dli_fname array before calling
    dll_address_to_library_name
    + JDK-8259869: [macOS] Remove desktop module dependencies on
    JNF Reference APIs
    + JDK-8259886: Improve SSL session cache performance and
    scalability
    + JDK-8259983: do not use uninitialized expand_ms value in
    G1CollectedHeap::expand_heap_after_young_collection
    + JDK-8260030: Improve stringStream buffer handling
    + JDK-8260236: better init AnnotationCollector _contended_group
    + JDK-8260255: C1: LoopInvariantCodeMotion constructor can
    leave some fields uninitialized
    + JDK-8260284: C2: assert(_base == Int) failed: Not an Int
    + JDK-8260380: Upgrade to LittleCMS 2.12
    + JDK-8260420: C2 compilation fails with assert(found_sfpt)
    failed: no node in loop that's not input to safepoint
    + JDK-8260426: awt debug_mem.c DMem_AllocateBlock might leak
    memory
    + JDK-8260432: allocateSpaceForGP in freetypeScaler.c might
    leak memory
    + JDK-8260616: Removing remaining JNF dependencies in the
    java.desktop module
    + JDK-8260653: Unreachable nodes keep speculative types alive
    + JDK-8260707: java/lang/instrument/PremainClass/
    /InheritAgent0100.java times out
    + JDK-8260925: HttpsURLConnection does not work  with other
    JSSE provider.
    + JDK-8260926: Trace resource exhausted events unconditionally
    + JDK-8261020: Wrong format parameter in
    create_emergency_chunk_path
    + JDK-8261027: AArch64: Support for LSE atomics C++ HotSpot code
    + JDK-8261167: print_process_memory_info add a close call after
    fopen
    + JDK-8261170: Upgrade to freetype 2.10.4
    + JDK-8261198: [macOS] Incorrect JNI parameters in number
    conversion in A11Y code
    + JDK-8261235: C1 compilation fails with
    assert(res-&gt;vreg_number() == index) failed: conversion check
    + JDK-8261261: The version extra fields needs to be overridable
    in jib-profiles.js
    + JDK-8261262: Kitchensink24HStress.java crashed with
    EXCEPTION_ACCESS_VIOLATION
    + JDK-8261354: SIGSEGV at MethodIteratorHost
    + JDK-8261355: No data buffering in SunPKCS11 Cipher encryption
    when the underlying mechanism has no padding
    + JDK-8261397: try catch Method failing to work when dividing
    an integer by 0
    + JDK-8261422: Adjust problematic String.format calls in
    jdk/internal/util/Preconditions.java outOfBoundsMessage
    + JDK-8261447: MethodInvocationCounters frequently run into
    overflow
    + JDK-8261481: Cannot read Kerberos settings in dynamic store
    on macOS Big Sur
    + JDK-8261505: Test test/hotspot/jtreg/gc/parallel/
    /TestDynShrinkHeap.java killed by Linux OOM Killer
    + JDK-8261601: free memory in early return in
    Java_sun_nio_ch_sctp_SctpChannelImpl_receive0
    + JDK-8261649: AArch64: Optimize LSE atomics in C++ code
    + JDK-8261730: C2 compilation fails with
    assert(store-&gt;find_edge(load) != -1) failed: missing
    precedence edge
    + JDK-8261752: Multiple GC test are missing memory requirements
    + JDK-8261791: (sctp) handleSendFailed in SctpChannelImpl.c
    potential leaks
    + JDK-8261812: C2 compilation fails with assert(!had_error)
    failed: bad dominance
    + JDK-8261914: IfNode::fold_compares_helper faces
    non-canonicalized bool when running JRuby JSON workload
    + JDK-8262093: java/util/concurrent/tck/JSR166TestCase.java
    failed "assert(false) failed: unexpected node"
    + JDK-8262110: DST starts from incorrect time in 2038
    + JDK-8262121: [11u] Redo 8244287: JFR: Methods samples have
    line number 0
    + JDK-8262163: Extend settings printout in jcmd VM.metaspace
    + JDK-8262295: C2: Out-of-Bounds Array Load from Clone Source
    + JDK-8262298: G1BarrierSetC2::step_over_gc_barrier fails with
    assert "bad barrier shape"
    + JDK-8262446: DragAndDrop hangs on Windows
    + JDK-8262461: handle wcstombsdmp return value correctly in
    unix awt_InputMethod.c
    + JDK-8262465: Very long compilation times and high memory
    consumption in C2 debug builds
    + JDK-8262726: AArch64: C1 StubAssembler::call_RT can corrupt
    stack
    + JDK-8262739: String inflation C2 intrinsic prevents insertion
    of anti-dependencies
    + JDK-8262829: Native crash in
    Win32PrintServiceLookup.getAllPrinterNames()
    + JDK-8262837: handle split_USE correctly
    + JDK-8262900: ToolBasicTest fails to access HTTP server it
    starts
    + JDK-8263260: [s390] Support latest hardware (z14 and z15)
    + JDK-8263311: Watch registry changes for remote printers
    update instead of polling
    + JDK-8263361: Incorrect arraycopy stub selected by C2 for SATB
    collectors
    + JDK-8263404: RsaPrivateKeySpec is always recognized as
    RSAPrivateCrtKeySpec in RSAKeyFactory.engineGetKeySpec
    + JDK-8263425: AArch64: two potential bugs in C1
    LIRGenerator::generate_address()
    + JDK-8263448: CTW: fatal error: meet not symmetric
    + JDK-8263504: Some OutputMachOpcodes fields are uninitialized
    + JDK-8263557: Possible NULL dereference in
    Arena::destruct_contents()
    + JDK-8263558: Possible NULL dereference in fast path arena
    free if ZapResourceArea is true
    + JDK-8263676: AArch64: one potential bug in C1
    LIRGenerator::generate_address()
    + JDK-8263729: [test] divert spurious output away from stream
    under test in ProcessBuilder Basic test
    + JDK-8263846: Bad JNI lookup getFocusOwner in accessibility
    code on Mac OS X
    + JDK-8264047: Duplicate global variable 'jvm' in libjavajpeg
    and libawt
    + JDK-8264096: slowdebug jvm crashes when StrInflatedCopy match
    rule is not supported
    + JDK-8264151: ciMethod::ensure_method_data() should return
    false is loading resulted in empty state
    + JDK-8264173: [s390] Improve Hardware Feature Detection And
    Reporting
    + JDK-8264190: Harden TLS interop tests
    + JDK-8264223: CodeHeap::verify fails extra_hops assertion in
    fastdebug test
    + JDK-8264328: Broken license in
    javax/swing/JComboBox/8072767/bug8072767.java
    + JDK-8264360: Loop strip mining verification fails with
    "should be on the backedge"
    + JDK-8264626: C1 should be able to inline excluded methods
    + JDK-8264640: CMS ParScanClosure misses a barrier
    + JDK-8264786: [macos] All Swing/AWT apps cause Allow
    Notifications prompt to appear when app is launched
    + JDK-8264821: DirectIOTest fails on a system with large block
    size
    + JDK-8264848: [macos] libjvm.dylib linker warning due to macOS
    version mismatch
    + JDK-8264923: PNGImageWriter.write_zTXt throws Exception with
    a typo
    + JDK-8264958: C2 compilation fails with assert "n is later
    than its clone"
    + JDK-8265099: Revert backport to 11u of 8236859: WebSocket
    over authenticating proxy fails with NPE
    + JDK-8265154: vinserti128 operand mix up for KNL platforms
    + JDK-8265239: Shenandoah: Shenandoah heap region count could
    be off by 1
    + JDK-8265417: Backport of JDK-8249672 breaks Solaris x86 build
    + JDK-8265421: java/lang/String/StringRepeat.java test is
    missing a memory requirement
    + JDK-8265462: Handle multiple slots in the NSS Internal Module
    from SunPKCS11's Secmod
    + JDK-8265537: x86 version string truncated after JDK-8249672
    11u backport
    + JDK-8265666: Enable AIX build platform to make external debug
    symbols
    + JDK-8265677: CMS: CardTableBarrierSet::write_ref_array_work()
    lacks storestore barrier
    + JDK-8265690: Use the latest Ubuntu base image version in
    Docker testing
    + JDK-8265718: Build failure after JDK-8258414 11u backport
    + JDK-8265750: Fatal error in safepoint.cpp after backport of
    8258414
    + JDK-8265784: [C2] Hoisting of DecodeN leaves MachTemp inputs
    behind
    + JDK-8265938: C2's conditional move optimization does not
    handle top Phi
    + JDK-8266220: keytool still prompt for store password on a
    password-less pkcs12 file if -storetype pkcs12 is specified
    + JDK-8266293: Key protection using PBEWithMD5AndDES fails with
    "java.security.InvalidAlgorithmParameterException: Salt must
    be 8 bytes long"
    + JDK-8266713: [AIX] Build failure after 11u backport of
    JDK-8247753
    + JDK-8266802: Shenandoah: Round up region size to page size
    unconditionally
    + JDK-8266892: avoid maybe-uninitialized gcc warnings on linux
    s390x
    + JDK-8266929: Unable to use algorithms from 3p providers
    + JDK-8267235: [macos_aarch64]
    InterpreterRuntime::throw_pending_exception messing up LR
    results in crash
    + JDK-8267561: Shenandoah: Reference processing not properly
    setup for outside of cycle degenerated GC
    + JDK-8267599: Revert the change to the default PKCS12
    macAlgorithm and macIterationCount props for 11u/8u/7u
    + JDK-8267641: [11u] 8227609 backport typo
    + JDK-8267721: Enable sun/security/pkcs11 tests for Amazon
    Linux 2 AArch64
    + JDK-8268678: LetsEncryptCA.java test fails as Let's Encrypt
    Authority X3 is retired</changelog>
  <changelog author="schwab@suse.de" date="1628078400">- riscv64-zero.patch: Add support for riscv64 (zero VM)</changelog>
  <changelog author="fstrba@suse.com" date="1629979200">- Added patch:
  * jdk11-glibc234.patch
    + fix build with glibc-2.34 (bsc#1189201)</changelog>
  <changelog author="fstrba@suse.com" date="1631534400">- Modified patch:
  * nss-security-provider.patch
    + revert recent changes making NSS provider the default one
    + fixes bsc#1190252</changelog>
  <changelog author="fstrba@suse.com" date="1631793600">- Added patch:
  * fips.patch
    + implement FIPS support in OpenJDK</changelog>
  <changelog author="fstrba@suse.com" date="1634817600">- Update to upstream tag jdk-11.0.13+8 (October 2021 CPU)
  * Security fixes
    + JDK-8163326, CVE-2021-35550, bsc#1191901: Update the default
    enabled cipher suites preference
    + JDK-8254967, CVE-2021-35565, bsc#1191909:
    com.sun.net.HttpsServer spins on TLS session close
    + JDK-8263314: Enhance XML Dsig modes
    + JDK-8265167, CVE-2021-35556, bsc#1191910: Richer Text Editors
    + JDK-8265574: Improve handling of sheets
    + JDK-8265580, CVE-2021-35559, bsc#1191911: Enhanced style for
    RTF kit
    + JDK-8265776: Improve Stream handling for SSL
    + JDK-8266097, CVE-2021-35561, bsc#1191912: Better hashing
    support
    + JDK-8266103: Better specified spec values
    + JDK-8266109: More Resilient Classloading
    + JDK-8266115: More Manifest Jar Loading
    + JDK-8266137, CVE-2021-35564, bsc#1191913: Improve Keystore
    integrity
    + JDK-8266689, CVE-2021-35567, bsc#1191903: More Constrained
    Delegation
    + JDK-8267086: ArrayIndexOutOfBoundsException in
    java.security.KeyFactory.generatePublic
    + JDK-8267712: Better LDAP reference processing
    + JDK-8267729, CVE-2021-35578, bsc#1191904: Improve TLS client
    handshaking
    + JDK-8267735, CVE-2021-35586, bsc#1191914: Better BMP support
    + JDK-8268193: Improve requests of certificates
    + JDK-8268199: Correct certificate requests
    + JDK-8268205: Enhance DTLS client handshake
    + JDK-8268506: More Manifest Digests
    + JDK-8269618, CVE-2021-35603, bsc#1191906: Better session
    identification
    + JDK-8269624: Enhance method selection support
    + JDK-8270398: Enhance canonicalization
    + JDK-8270404: Better canonicalization
  * Other changes
    + JDK-8024368: private methods are allocated vtable indices
    + JDK-8042902: Test java/net/Inet6Address/serialize/
    /Inet6AddressSerializationTest.java fails intermittently
    + JDK-8140466: ChaCha20 and Poly1305 TLS Cipher Suites
    + JDK-8157404: Unable to read certain PKCS12 keystores from
    SequenceInputStream
    + JDK-8158066: SourceDebugExtensionTest fails to rename file
    + JDK-8168304: Make all of DependencyContext_test available in
    product mode
    + JDK-8169246: java/net/DatagramSocket/ReportSocketClosed.java
    fails intermittently with BindException
    + JDK-8181313: SA: Remove libthread_db dependency on Linux
    + JDK-8193214: Incorrect annotations.without.processors
    warnings with JDK 9
    + JDK-8194230: jdk/internal/jrtfs/remote/
    /RemoteRuntimeImageTest.java fails with
    java.lang.NullPointerException
    + JDK-8196092: javax/swing/JComboBox/8032878/bug8032878.java
    fails
    + JDK-8199931: java/net/MulticastSocket/
    /UnreferencedMulticastSockets.java fails with "incorrect data
    received"
    + JDK-8206083: Make tools/javac/api/T6265137.java robust to JDK
    version changes
    + JDK-8206350: java/util/Locale/bcp47u/SystemPropertyTests.java
    failed on Mac 10.13 with zh_CN and zh_TW locales.
    + JDK-8207316: java/nio/channels/spi/SelectorProvider/
    /inheritedChannel/InheritedChannelTest.java failed
    + JDK-8208227: tools/jdeps/DotFileTest.java fails on Win-X64
    + JDK-8208363: test/jdk/java/lang/Package/
    /PackageFromManifest.java missing module dependencies
    declaration
    + JDK-8209380: ARM: cleanup maybe-uninitialized and reorder
    compiler warnings
    + JDK-8209768: Refactor java/util/prefs/CheckUserPrefsStorage.sh
    to plain java test
    + JDK-8209772: Refactor shell test java/util/ServiceLoader/
    /basic/basic.sh to java
    + JDK-8209773: Refactor shell test javax/naming/module/basic.sh
    to java
    + JDK-8209832: Refactor jdk/internal/reflect/Reflection/
    /GetCallerClassTest.sh to plain java test
    + JDK-8209930: Refactor java/util/zip/ZipFile/deletetempjar.sh
    to plain java test
    + JDK-8210406: Refactor java.util.PluggableLocale:i18n shell
    tests to plain java tests
    + JDK-8210407: Refactor java.util.Calendar:i18n shell tests to
    plain java tests
    + JDK-8210495: compiler crashes because of illegal signature in
    otherwise legal code
    + JDK-8210669: Some launcher tests assume a pre-JDK 9 run-time
    image layout
    + JDK-8210802: temp files left by tests in
    jdk/java/net/httpclient
    + JDK-8210819: Update the host name in CNameTest.java
    + JDK-8210908: Refactor java/util/prefs/PrefsSpi.sh to plain
    java test
    + JDK-8210934: Move sun/net/www/protocol/http/
    /GetErrorStream.java to OpenJDK
    + JDK-8210959: JShell fails and exits when statement throws an
    exception whose message contains a '%'.
    + JDK-8211055: Provide print to a file (PDF) feature even when
    printer was not connected
    + JDK-8211092: test/jdk/sun/net/www/http/HttpClient/
    /MultiThreadTest.java fails intermittently when cleaning up
    + JDK-8211296: Remove HotSpot deprecation warning suppression
    for Mac/clang
    + JDK-8211325: test/jdk/java/net/Socket/LingerTest.java fails
    with cleaning up
    + JDK-8212040: Compilation error due to wrong usage of
    NSPrintJobDispositionValue in mac10.12
    + JDK-8212695: Add explicit timeout to several HTTP Client tests
    + JDK-8212718: Refactor some annotation processor tests to
    better use collections
    + JDK-8213007: Update the link in test/jdk/sun/security/
    /provider/SecureRandom/DrbgCavp.java
    + JDK-8213137: Remove static initialization of monitor/mutex
    instances
    + JDK-8213235: java/nio/channels/SocketChannel/
    /AsyncCloseChannel.java fails with threads that didn't exit
    + JDK-8213409: Refactor sun.text.IntHashtable:i18n shell tests
    to plain java tests
    + JDK-8213576: Make test AsyncCloseChannel.java run in othervm
    + JDK-8213694: Test Timeout.java should run in othervm mode
    + JDK-8213718: [TEST] Wrong classname in vmTestbase/nsk/stress/
    /except/except002 and except003
    + JDK-8213922: fix ctw stand-alone build
    + JDK-8214195: Align stdout messages in
    test/jdk/java/math/BigInteger/PrimitiveConversionTests.java
    + JDK-8214520: [TEST_BUG] sun/security/mscapi/nonUniqueAliases/
    /NonUniqueAliases.java failed with incorrect jtreg tags order
    + JDK-8214937: sun/security/tools/jarsigner/warnings/
    /NoTimestampTest.java failed due to unexpected expiration date
    + JDK-8216532: tools/launcher/Test7029048.java fails (Solaris)
    + JDK-8217825: Verify @AfterTest is used correctly in WebSocket
    tests
    + JDK-8218145: block_if_requested is not proper inlined due to
    size
    + JDK-8219417: bump jtreg requiredVersion to b14
    + JDK-8219552: bump jtreg requiredVersion to b14 in
    test/jdk/sanity/client/
    + JDK-8219804: java/net/MulticastSocket/Promiscuous.java fails
    intermittently due to NumberFormatException
    + JDK-8220445: Support for side by side MSVC Toolset versions
    + JDK-8221988: add possibility to build with Visual Studio 2019
    + JDK-8222751: closed/test/jdk/sun/security/util/
    /DerIndefLenConverter/IndefBerPkcs12.java fail
    + JDK-8223050: JVMCI: findUniqueConcreteMethod() should not use
    Dependencies::find_unique_concrete_method() for non-virtual
    methods
    + JDK-8224853: CDS address sanitizer errors
    + JDK-8225082: Remove IdenTrust certificate that is expiring in
    September 2021
    + JDK-8225583: Examine the HttpResponse.BodySubscribers for
    null handling and multiple subscriptions
    + JDK-8225690: Multiple AttachListener threads can be created
    + JDK-8225790: Two NestedDialogs tests fail on Ubuntu
    + JDK-8226319: Add forgotten test/jdk/java/net/httpclient/
    /BodySubscribersTest.java
    + JDK-8226533: JVMCI: findUniqueConcreteMethod should handle
    statically bindable methods directly
    + JDK-8226602: Test convenience reactive primitives from
    java.net.http with RS TCK
    + JDK-8226683: Remove review suggestion from fix to 8219804
    + JDK-8227738: jvmti/DataDumpRequest/datadumpreq001 failed due
    to "exit code is 134"
    + JDK-8227766: CheckUnhandledOops is broken in MemAllocator
    + JDK-8227815: Minimal VM: set_state is not a member of
    AttachListener
    + JDK-8230674: Heap dumps should exclude dormant CDS archived
    objects of unloaded classes
    + JDK-8230808: Remove Access::equals()
    + JDK-8230841: Remove oopDesc::equals()
    + JDK-8231717: Improve performance of charset decoding when
    charset is always compactable
    + JDK-8232243: Wrong caret position in JTextPane on Windows
    with a screen resolution &gt; 100%
    + JDK-8232782: Shenandoah: streamline post-LRB CAS barrier
    (aarch64)
    + JDK-8233790: Forward output from heap dumper to jcmd/jmap
    + JDK-8233989: Create an IPv4 version of
    java/net/MulticastSocket/SetLoopbackMode.java
    + JDK-8234510: Remove file seeking requirement for writing a
    heap dump
    + JDK-8235211: serviceability/attach/
    /RemovingUnixDomainSocketTest.java fails with
    AttachNotSupportedException: Unable to open socket file
    + JDK-8235216: typo in test filename
    + JDK-8235866: bump jtreg requiredVersion to 4.2b16
    + JDK-8236111: narrow allowSmartActionArgs disabling
    + JDK-8236413: AbstractConnectTimeout should tolerate both
    NoRouteToHostException and UnresolvedAddressException
    + JDK-8236671: NullPointerException in JKS keystore
    + JDK-8238930: problem list compiler/c2/Test8004741.java
    + JDK-8238943: switch to jtreg 5.0
    + JDK-8240555: Using env of JAVA_TOOL_OPTIONS and _JAVA_OPTIONS
    breaks QuietOption.java test
    + JDK-8240983: Incorrect copyright header in Apache Santuario
    2.1.3 files
    + JDK-8241336: Some java.net tests failed with
    NoRouteToHostException on MacOS with special network
    configuration
    + JDK-8241353: NPE in ToolProvider.getSystemJavaCompiler
    + JDK-8241768: git needs .gitattributes
    + JDK-8242882: opening jar file with large manifest might throw
    NegativeArraySizeException
    + JDK-8244973: serviceability/attach/
    /RemovingUnixDomainSocketTest.java fails "stderr was not
    empty"
    + JDK-8245134: test/lib/jdk/test/lib/security/
    /KeyStoreUtils.java should allow to specify aliases
    + JDK-8246261: TCKLocalTime.java failed due to "AssertionError:
    expected [18:14:22] but found [18:14:23]"
    + JDK-8246387: switch to jtreg 5.1
    + JDK-8247421: [TESTBUG] ReturnBlobToWrongHeapTest.java failed
    allocating blob
    + JDK-8247469: getSystemCpuLoad() returns -1 on linux when some
    offline cpus are present and cpusets.effective_cpus is not
    available
    + JDK-8248352: [TEST_BUG] Test test/jdk/java/awt/font/
    /TextLayout/ArabicDiacriticTest.java can leave frame open
    + JDK-8248403: AArch64: Remove uses of kernel integer types
    + JDK-8248414: AArch64: Remove uses of long and unsigned long
    ints
    + JDK-8248657: Windows: strengthening in ThreadCritical
    regarding memory model
    + JDK-8248666: AArch64: Use THREAD_LOCAL instead of __thread
    + JDK-8248668: AArch64: Avoid MIN/MAX macros when using MSVC
    + JDK-8248671: AArch64: Remove unused variables
    + JDK-8248682: AArch64: Use ATTRIBUTE_ALIGNED helper
    + JDK-8248816: C1: Fix signature conflict in
    LIRGenerator::strength_reduce_multiply
    + JDK-8249095: tools/javac/launcher/SourceLauncherTest.java
    fails on Windows
    + JDK-8249548: backward focus traversal gets stuck in button
    group
    + JDK-8249773: Upgrade ReceiveISA.java test to be resilient to
    failure due to stray packets and interference
    + JDK-8249897: jdk/javadoc/tool/LangVers.java uses @ignore w/o
    bug-id
    + JDK-8249898: jdk/javadoc/tool/6176978/T6176978.java uses
    @ignore w/o bug-id
    + JDK-8249899: jdk/javadoc/tool/InlineTagsWithBraces.java uses
    @ignore w/o bug-id
    + JDK-8250588: Shenandoah: LRB needs to save/restore fp
    registers for runtime call
    + JDK-8250824: AArch64: follow up for JDK-8248414
    + JDK-8251166: Add automated testcases for changes done in
    JDK-8214112
    + JDK-8251252: Add automated testcase for fix done in
    JDK-8214253
    + JDK-8251254: Add automated test for fix done in JDK-8218472
    + JDK-8251361: Potential race between Logger configuration and
    GCs in HttpURLConWithProxy test
    + JDK-8251549: Update docs on building for Git
    + JDK-8251945: SIGSEGV in
    PackageEntry::purge_qualified_exports()
    + JDK-8252194: Add automated test for fix done in JDK-8218469
    + JDK-8252648: Shenandoah: name gang tasks consistently
    + JDK-8252825: Add automated test for fix done in JDK-8218479
    + JDK-8252853: AArch64: gc/shenandoah/TestVerifyJCStress.java
    fails intermittently with C1
    + JDK-8252857: AArch64: Shenandoah C1 CAS is not sequentially
    consistent
    + JDK-8253048: AArch64: When CallLeaf, no need to preserve
    callee-saved registers in caller
    + JDK-8253424: Add support for running pre-submit testing using
    GitHub Actions
    + JDK-8253631: Remove unimplemented CompileBroker methods after
    JEP-165
    + JDK-8253865: Pre-submit testing using GitHub Actions does not
    detect failures reliably
    + JDK-8253899: Make IsClassUnloadingEnabled signature match
    specification
    + JDK-8254024: Enhance native libs for AWT and Swing to work
    with GraalVM Native Image
    + JDK-8254054: Pre-submit testing using GitHub Actions should
    not use the deprecated set-env command
    + JDK-8254173: Add Zero, Minimal hotspot targets to submit
    workflow
    + JDK-8254175: Build no-pch configuration in debug mode for
    submit checks
    + JDK-8254244: Some code emitted by TemplateTable::branch is
    unused when running TieredCompilation
    + JDK-8254270: linux 32 bit build doesn't compile
    libjdwp/log_messages.c
    + JDK-8254282: Add Linux x86_32 builds to submit workflow
    + JDK-8254850: Update terminology in java.awt.GridBagLayout
    source code comments
    + JDK-8255255: Update Apache Santuario (XML Signature) to
    version 2.2.1
    + JDK-8255305: Add Linux x86_32 tier1 to submit workflow
    + JDK-8255352: Archive important test outputs in submit workflow
    + JDK-8255373: Submit workflow artifact name is always
    "test-results_.zip"
    + JDK-8255452: Doing GC during JVMTI MethodExit event posting
    breaks return oop
    + JDK-8255718: Zero: VM should know it runs in interpreter-only
    mode
    + JDK-8255790: GTKL&amp;F: Java 16 crashes on initialising GTKL&amp;F
    on Manjaro Linux
    + JDK-8255810: Zero: build fails without JVMTI
    + JDK-8255895: Submit workflow artifacts miss hs_errs/replays
    due to ZIP include mismatch
    + JDK-8256127: Add cross-compiled foreign architectures builds
    to submit workflow
    + JDK-8256215: Shenandoah: re-organize saving/restoring machine
    state in assembler code
    + JDK-8256267: Relax compiler/floatingpoint/NaNTest.java for
    x86_32 and lower -XX:+UseSSE
    + JDK-8256277: Github Action build on macOS should define OS
    and Xcode versions
    + JDK-8256354: Github Action build on Windows should define OS
    and MSVC versions
    + JDK-8256393: Github Actions build on Linux should define OS
    and GCC versions
    + JDK-8256414: add optimized build to submit workflow
    + JDK-8256747: GitHub Actions: decouple the hotspot build-only
    jobs from Linux x64 testing
    + JDK-8257056: Submit workflow should apt-get update to avoid
    package installation errors
    + JDK-8257148: Remove obsolete code in AWTView.m
    + JDK-8257497: Update keytool to create AKID from the SKID of
    the issuing certificate as specified by RFC 5280
    + JDK-8257620: Do not use objc_msgSend_stret to get macOS
    version
    + JDK-8257913: Add more known library locations to simplify
    Linux cross-compilation
    + JDK-8258703: Incorrect 512-bit vector registers restore on
    x86_32
    + JDK-8259338: Add expiry exception for identrustdstx3 alias to
    VerifyCACerts.java test
    + JDK-8259535: ECDSA SignatureValue do not always have the
    specified length
    + JDK-8259679: GitHub actions should use MSVC 14.28
    + JDK-8259924: GitHub actions fail on Linux x86_32 with "Could
    not configure libc6:i386"
    + JDK-8260460: GitHub actions still fail on Linux x86_32 with
    "Could not configure libc6:i386"
    + JDK-8260589: Crash in JfrTraceIdLoadBarrier::load(_jclass*)
    + JDK-8260923: Add more tests for SSLSocket input/output
    shutdown
    + JDK-8261072: AArch64: Fix MacroAssembler::get_thread
    convention
    + JDK-8261147: C2: Node is wrongly marked as reduction
    resulting in a wrong execution due to wrong vector instructions
    + JDK-8261238: NMT should not limit baselining by size threshold
    + JDK-8261496: Shenandoah: reconsider pacing updates memory
    ordering
    + JDK-8261652: Remove some dead comments from os_bsd_x86
    + JDK-8261846: [JVMCI] c2v_iterateFrames can get out of sync
    with the StackFrameStream
    + JDK-8262000: jdk/jfr/event/gc/detailed/
    /TestPromotionFailedEventWithParallelScavenge.java failed with
    "OutOfMemoryError: Java heap space"
    + JDK-8262017: C2: assert(n != __null) failed: Bad immediate
    dominator info.
    + JDK-8262392: Update Mesa 3-D Headers to version 21.0.3
    + JDK-8262409: sun/security/ssl/SSLSocketImpl/
    /SSLSocketImplThrowsWrongExceptions. SSL test failures caused
    by java failed with "Server reported the wrong exception"
    + JDK-8262470: Printed GlyphVector outline with low DPI has bad
    quality on Windows
    + JDK-8262862: Harden tests sun/security/x509/URICertStore/
    /ExtensionsWithLDAP.java and krb5/canonicalize/Test.java
    + JDK-8263136: C4530 was reported from VS 2019 at access bridge
    + JDK-8263227: C2: inconsistent spilling due to dead nodes in
    exception block
    + JDK-8263382: java/util/logging/ParentLoggersTest.java failed
    with "checkLoggers: getLoggerNames() returned unexpected
    loggers"
    + JDK-8263407: SPARC64 detection fails on Athena (SPARC64-X)
    + JDK-8263432: javac may report an invalid package/class clash
    on case insensitive filesystems
    + JDK-8263490: [macos] Crash occurs on JPasswordField with
    activated InputMethod
    + JDK-8263531: Remove unused buffer int
    + JDK-8263667: Avoid running GitHub actions on branches named
    pr/*
    + JDK-8263776: [JVMCI] add helper to perform Java upcalls
    + JDK-8264016: [JVMCI] add some thread local fields for use by
    JVMCI
    + JDK-8264752: SIGFPE crash with option
    FlightRecorderOptions:threadbuffersize=30M
    + JDK-8265132: C2 compilation fails with assert "missing
    precedence edge"
    + JDK-8265231: (fc) ReadDirect and WriteDirect tests fail after
    fix for JDK-8264821
    + JDK-8265335: Epsilon: Minor typo in EpsilonElasticTLABDecay
    description
    + JDK-8265756: AArch64: initialize memory allocated for locals
    according to Windows AArch64 stack page growth requirement in
    template interpreter
    + JDK-8265761: Font with missed font family name is not
    properly printed on Windows
    + JDK-8265773: incorrect jdeps message "jdk8internals" to
    describe a removed JDK internal API
    + JDK-8265836: OperatingSystemImpl.getCpuLoad() returns
    incorrect CPU load inside a container
    + JDK-8266018: Shenandoah: fix an incorrect assert
    + JDK-8266206: Build failure after JDK-8264752 with older GCCs
    + JDK-8266248: Compilation failure in
    PLATFORM_API_MacOSX_MidiUtils.c with Xcode 12.5
    + JDK-8266288: assert root method not found in
    witnessed_reabstraction_in_supers is too strong
    + JDK-8266404: Fatal error report generated with
  - XX:+CrashOnOutOfMemoryError should not contain suggestion to
    submit a bug report
    + JDK-8266480: Implicit null check optimization does not update
    control of hoisted memory operation
    + JDK-8266615: C2 incorrectly folds subtype checks involving an
    interface array
    + JDK-8266642: Improve ResolvedMethodTable hash function
    + JDK-8266749: AArch64: Backtracing broken on PAC enabled
    systems
    + JDK-8266761: AssertionError in
    sun.net.httpserver.ServerImpl.responseCompleted
    + JDK-8266813: Shenandoah: Use shorter instruction sequence for
    checking if marking in progress
    + JDK-8267042: bug in monitor locking/unlocking on ARM32 C1 due
    to uninitialized BasicObjectLock::_displaced_header
    + JDK-8267348: Rewrite gc/epsilon/TestClasses.java to use
    Metaspace with less classes
    + JDK-8267396: Avoid recording "pc" in unhandled oops detector
    for better performance
    + JDK-8267399: C2: java/text/Normalizer/ConformanceTest.java
    test failed with assertion
    + JDK-8267424: CTW: C1 fails with "State must not be null"
    + JDK-8267459: Pasting Unicode characters into JShell does not
    work.
    + JDK-8267625: AARCH64: typo in LIR_Assembler::emit_profile_type
    + JDK-8267666: Add option to jcmd GC.heap_dump to use existing
    file
    + JDK-8267695: Bump update version for OpenJDK: jdk-11.0.13
    + JDK-8267751: (test) jtreg.SkippedException has no serial
    VersionUID
    + JDK-8267773: PhaseStringOpts::int_stringSize doesn't handle
    min_jint correctly
    + JDK-8268103: JNI functions incorrectly return a double after
    JDK-8265836
    + JDK-8268127: Shenandoah: Heap size may be too small for
    region to align to large page size
    + JDK-8268261: C2: assert(n != __null) failed: Bad immediate
    dominator info.
    + JDK-8268347: C2: nested locks optimization may create
    unbalanced monitor enter/exit code
    + JDK-8268360: Missing check for infinite loop during node
    placement
    + JDK-8268362: [REDO] C2 crash when compile negative
    Arrays.copyOf length after loop
    + JDK-8268366: Incorrect calculation of has_fpu_registers in C1
    linear scan
    + JDK-8268369: SIGSEGV in PhaseCFG::implicit_null_check due to
    missing null check
    + JDK-8268417: Add test from JDK-8268360
    + JDK-8268427: Improve AlgorithmConstraints:checkAlgorithm
    performance
    + JDK-8268617: [11u REDO] - WebSocket over authenticating proxy
    fails with NPE
    + JDK-8268620: InfiniteLoopException test may fail on x86
    platforms
    + JDK-8268635: Corrupt oop in ClassLoaderData
    + JDK-8268699: Shenandoah: Add test for JDK-8268127
    + JDK-8268771: javadoc -notimestamp option does not work on
    index.html
    + JDK-8268775: Password is being converted to String in
    AccessibleJPasswordField
    + JDK-8268776: Test `ADatagramSocket.java` missing /othervm
    from @run tag
    + JDK-8268965: TCP Connection Reset when connecting simple
    socket to SSL server
    + JDK-8269304: Regression ~5% in 2005 in b27
    + JDK-8269415: [11u] Remove ea from
    DEFAULT_PROMOTED_VERSION_PRE in OpenJDK 11u
    + JDK-8269478: Shenandoah: gc/shenandoah/mxbeans tests should
    be more resilient
    + JDK-8269529: javax/swing/reliability/
    /HangDuringStaticInitialization.java fails in Windows debug
    build
    + JDK-8269594: assert(_handle_mark_nesting &gt; 1) failed: memory
    leak: allocating handle outside HandleMark
    + JDK-8269614: [s390] Interpreter checks wrong bit for slow
    path instance allocation
    + JDK-8269650: Optimize gc-locker in
    [Get|Release]StringCritical for latin string
    + JDK-8269661: JNI_GetStringCritical does not lock char array
    + JDK-8269668: [aarch64] java.library.path not including
    /usr/lib64
    + JDK-8269763: The JEditorPane is blank after JDK-8265167
    + JDK-8269795: C2: Out of bounds array load floats above its
    range check in loop peeling resulting in SEGV
    + JDK-8269847: JDK-8269594 backport breaks 11u builds
    + JDK-8269850: Most JDK releases report macOS version 12 as
    10.16 instead of 12.0
    + JDK-8269851: OperatingSystemMXBean getProcessCpuLoad reports
    incorrect process cpu usage in containers
    + JDK-8269882: stack-use-after-scope in NewObjectA
    + JDK-8269934: RunThese24H.java failed with
    EXCEPTION_ACCESS_VIOLATION in
    java_lang_Thread::get_thread_status
    + JDK-8270096: Shenandoah: Optimize gc/shenandoah/
    /TestRefprocSanity.java for interpreter mode
    + JDK-8270137: Kerberos Credential Retrieval from Cache not
    Working in Cross-Realm Setup
    + JDK-8270184: [TESTBUG] Add coverage for jvmci
    ResolvedJavaType.toJavaName() for lambdas
    + JDK-8270196: [11u] [JVMCI] JavaType.toJavaName() returns
    incorrect type name for lambdas
    + JDK-8270556: Exclude security/infra/java/security/cert/
    /CertPathValidator/certification/LetsEncryptCA
    + JDK-8270893: IndexOutOfBoundsException while reading large
    TIFF file
    + JDK-8272078: Wrong Checksums in Temurin BootJDK dependencies
    + JDK-8272124: Cgroup v1 initialization causes
    NullPointerException when cgroup path contains colon
    + JDK-8272131: PhaseMacroExpand::generate_slow_arraycopy crash
    when clone null CallProjections.fallthrough_ioproj
    + JDK-8272197: Update 11u GHA workflow with Shenandoah
    configurations
    + JDK-8272332: --with-harfbuzz=system doesn't add -lharfbuzz
    after JDK-8255790
    + JDK-8272472: StackGuardPages test doesn't build with glibc
    2.34
    + JDK-8272602: [macos] not all KEY_PRESSED events sent when
    control modifier is used
    + JDK-8272628: Problemlist gc/stress/gcbasher/
    /TestGCBasherWithCMS.java for x86_32
    + JDK-8272700: [macos] Build failure with Xcode 13.0 after
    JDK-8264848
    + JDK-8272772: Shenandoah: compiler/c2/aarch64/
    /TestVolatilesShenandoah.java fails in 11u
    + JDK-8273939: Backport of 8248414 to JDK11 breaks
    MacroAssembler::adrp
- Remove the unneeded icedtea-sound provider
- Removed patches:
  * icedtea-sound-1.0.1-jdk9.patch
  * icedtea-sound-soundproperties.patch
    + not needed since the icedtea-sound provider is removed
  * jdk11-glibc234.patch
    + integrated upstream</changelog>
  <changelog author="fstrba@suse.com" date="1635940800">- Modified patches:
  * system-crypto-policy.patch
    + rediff to changed context
  * fips.patch
    + Allow plain key import in fips mode unless
    com.suse.fips.plainKeySupport is set to false</changelog>
  <changelog author="fstrba@suse.com" date="1636113600">- Modified patch:
  * fips.patch
    + return in native code after generating java.io.IOException</changelog>
</package>
<package pkgid="cc649cd576fcb2c94933848394640ec0795d749205e9066136016032f31fa571" name="java-11-openjdk-src" arch="ppc64le">
  <version epoch="0" ver="11.0.13.0" rel="3.68.1"/>
  <changelog author="fstrba@suse.com" date="1586952000">- The pack200 and unpack200 alternatives should be slaves of java
  and not of javac, since they are part of JRE.</changelog>
  <changelog author="fstrba@suse.com" date="1587470400">- Update to upstream tag jdk-11.0.7+10 (April 2020 CPU,
  bsc#1169511)
  * Security fixes:
    + S8223898, CVE-2020-2754: Forward references to Nashorn
    + S8223904, CVE-2020-2755: Improve Nashorn matching
    + S8224541, CVE-2020-2756: Better mapping of serial ENUMs
    + S8224549, CVE-2020-2757: Less Blocking Array Queues
    + S8225603: Enhancement for big integers
    + S8226346: Build better binary builders
    + S8227467: Better class method invocations
    + S8227542: Manifest improved jar headers
    + S8229733: TLS message handling improvements
    + S8231415, CVE-2020-2773: Better signatures in XML
    + S8231785: Improved socket permissions
    + S8232424, CVE-2020-2778: More constrained algorithms
    + S8232581, CVE-2020-2767: Improve TLS verification
    + S8233250: Better X11 rendering
    + S8233410: Better Build Scripting
    + S8234027: Better JCEKS key support
    + S8234408, CVE-2020-2781: Improve TLS session handling
    + S8234825, CVE-2020-2800: Better Headings for HTTP Servers
    + S8234841, CVE-2020-2803: Enhance buffering of byte buffers
    + S8235274, CVE-2020-2805: Enhance typing of methods
    + S8235691, CVE-2020-2816: Enhance TLS connectivity
    + S8236201, CVE-2020-2830: Better Scanner conversions
    + S8238960: linux-i586 builds are inconsistent as the newly
    built jdk is not able to reserve enough space for object heap
  * Other changes:
    + S4919790: Errors in alert ssl message does not reflect the
    actual certificate status
    + S4949105: Access Bridge lacks html tags parsing
    + S7092821: java.security.Provider.getService() is synchronized
    and became scalability bottleneck
    + S7143743: Potential memory leak with zip provider
    + S8005819: Support cross-realm MSSFU
    + S8042383: [TEST_BUG] Test javax/swing/plaf/basic/BasicMenuUI/
    /4983388/bug4983388.java fails with shortcuts on menus do not
    work
    + S8068184: Fix for JDK-8032832 caused a deadlock
    + S8145845: [AOT] NullPointerException in
    compiler/whitebox/GetCodeHeapEntriesTest.java
    + S8152988: [AOT] Update test batch definitions to include
    aot-ed java.base module mode into hs-comp testing
    + S8160926: FLAGS_COMPILER_CHECK_ARGUMENTS doesn't handle
    cross-compilation
    + S8163083: SocketListeningConnector does not allow invocations
    with port 0
    + S8163251: Hard coded loop limit prevents reading of smart
    card data greater than 8k
    + S8167276: jvmci/compilerToVM/MaterializeVirtualObjectTest.java
    fails with -XX:-EliminateAllocations
    + S8169718: nsk/jdb/locals/locals002: ERROR: Cannot find
    boolVar with expected value: false
    + S8176556:
    java/awt/dnd/ImageTransferTest/ImageTransferTest.java fails
    for JFIF
    + S8178798: Two compiler/aot/verification/vmflags tests fail by
    timeout with UseAVX=3
    + S8183107: PKCS11 regression regarding checkKeySize
    + S8185005: Improve performance of
    ThreadMXBean.getThreadInfo(long ids[], int maxDepth)
    + S8189633: Missing -Xcheck:jni checking for DeleteWeakGlobalRef
    + S8189861: Refactor CacheFind
    + S8193042: NativeLookup::lookup_critical_entry() should only
    load shared library once
    + S8193596: java/net/DatagramPacket/ReuseBuf.java failed due to
    timeout
    + S8194944: Regression automated test 'open/test/jdk/javax/
    /swing/JInternalFrame/8145896/TestJInternalFrameMaximize.java'
    fails
    + S8196467: javax/swing/JInternalFrame/Test6325652.java fails
    + S8196969: JTreg Failure: serviceability/sa/ClhsdbJstack.java
    causes NPE
    + S8198321: javax/swing/JEditorPane/5076514/bug5076514.java
    fails
    + S8198398: Test javax/swing/JColorChooser/Test6199676.java
    fails in mach5
    + S8199072: Test javax/swing/GroupLayout/6613904/
    /bug6613904.java is unstable
    + S8200432: javadoc fails with ClassCastException on {@link
    byte[]}
    + S8201349: build broken when configured with
  - -with-zlib=bundled on gcc 7.3
    + S8201355: Avoid native memory allocation in
    sun.security.mscapi.PRNG.generateSeed
    + S8201513: nsk/jvmti/IterateThroughHeap/filter-* are broken
    + S8203364: Some serviceability/sa/ tests intermittently fail
    with java.io.IOException: LingeredApp terminated with non-zero
    exit code 3
    + S8203687: javax/net/ssl/compatibility/Compatibility.java
    supports TLS 1.3
    + S8203904: javax/swing/JSplitPane/4816114/bug4816114.java: The
    divider location is wrong
    + S8203911: Test runtime/modules/getModuleJNI/GetModule fails
    with -Xcheck:jni
    + S8204525: [TESTBUG] runtime/NMT/MallocStressTest.java ran out
    of java heap
    + S8204529: gc/TestAllocateHeapAtMultiple.java fail with Agent
    7 timed out
    + S8204551: Event descriptions are truncated in logs
    + S8206963: [AOT] bug with multiple class loaders
    + S8207367: 10 vmTestbase/nsk/jdi tests timed out when running
    with jtreg
    + S8207832: serviceability/sa/ClhsdbCDSCore.java failed with
    "Couldn't find core file location"
    + S8207938: At step6,Click Add button,case failed automatically.
    + S8208157: requires.VMProps throws NPE for missing properties
    in "release" file
    + S8208379: compiler/jvmci/events/
    /JvmciNotifyInstallEventTest.java failed with "Got unexpected
    event count after 2nd install attempt: expected 9 to equal 2"
    + S8208658: Make CDS archived heap regions usable even if
    compressed oop encoding has changed
    + S8208715: Conversion of milliseconds to nanoseconds in
    UNIXProcess contains bug
    + S8209361: [AOT] Unexpected number of references for
    JVMTI_HEAP_REFERENCE_CONSTANT_POOL [111--&gt;111]: 0 (expected
    at least 1)
    + S8209385: CDS runtime classpath checking is too strict when
    only classes from the system modules are archived
    + S8209389: SIGSEGV in WalkOopAndArchiveClosure::do_oop_work.
    + S8209418: Synchronize test/jdk/sanity/client/lib/jemmy with
    code-tools/jemmy/v2
    + S8209494: Create a test for SwingSet InternalFrameDemo
    + S8209499: Create test for SwingSet EditorPaneDemo
    + S8209574: [AOT] breakpoint events are generated in different
    threads does not meet expected count
    + S8209686: cleanup arguments to PhaseIdealLoop() constructor
    + S8209789: Synchronize test/jdk/sanity/client/lib/jemmy with
    code-tools/jemmy/v2
    + S8209802: Garbage collectors should register JFR types
    themselves to avoid build errors.
    + S8209807: improve handling exception in requires.VMProps
    + S8209817: stack is executable when building with Clang on
    Linux
    + S8209824: Improve the code coverage for ThreadLocal
    + S8209826: Undefined reference to os::write after JDK-8209657
    (filemap.hpp cleanup)
    + S8209850: Allow NamedThreads to use GlobalCounter critical
    sections
    + S8209976: Improve iteration over non-JavaThreads
    + S8209993: Create a test for SwingSet3 ToolTipDemo
    + S8210024: JFR calls virtual is_Java_thread from ~Thread()
    + S8210052: Enable testing for all the available look and feels
    in SwingSet3 demo tests
    + S8210055: Enable different look and feel tests in SwingSet3
    demo tests
    + S8210057: Enable different look and feels in SwingSet3 demo
    test InternalFrameDemoTest
    + S8210058: Algorithmic Italic font leans opposite angle in
    Printing
    + S8210220: [AOT] jdwp test cases are failing with error #
    ERROR: TEST FAILED: Cought IOException while receiving event
    packet
    + S8210289: ArchivedKlassSubGraphInfoRecord is incomplete
    + S8210459: Add support for generating compile_commands.json
    + S8210476: sun/security/mscapi/PrngSlow.java fails with Still
    too slow
    + S8210512: [Testbug] vmTestbase/nsk/jdi/ObjectReference/
    /referringObjects/referringObjects002/referringObjects002.java
    fails with unexpected size of
    ClassLoaderReference.referringObjects
    + S8210523: runtime/appcds/cacheObject/DifferentHeapSizes.java
    crash
    + S8210632: Add key exchange algorithm to
    javax/net/ssl/TLSCommon/CipherSuite.java
    + S8210699: Problem list tests which times out in Xcomp mode
    + S8210793: [JVMCI] AllocateCompileIdTest.java failed to find
    DiagnosticCommand.class
    + S8210910: Create test for FileChooserDemo
    + S8210994: Create test for SwingSet3 FrameDemo
    + S8211139: Increase timeout value in all tests under
    jdk/sanity/client/SwingSet/src
    + S8211160: Handle different look and feels in
    JInternalFrameOperator
    + S8211211: vmTestbase/metaspace/stressDictionary/
    /StressDictionary.java timeout
    + S8211322: Reduce the timeout of tooltip in SwingSet2DemoTest
    + S8211443: Enable different look and feels in SwingSet3 demo
    test SplitPaneDemoTest
    + S8211703: JInternalFrame : java.lang.AssertionError: cannot
    find the internal frame
    + S8211781: re-building fails after changing Graal sources
    + S8212897: Some improvements in the EditorPaneDemotest
    + S8212903: [TestBug] Tests test/jdk/javax/swing/LookAndFeel/
    /8145547/DemandGTK2.sh and DemandGTK3.sh fail on Ubuntu 18.04
    LTS
    + S8213009: Refactoring existing SunMSCAPI classes
    + S8213010: Supporting keys created with certmgr.exe
    + S8213168: Enable different look and feel tests in SwingSet3
    demo test FileChooserDemoTest
    + S8213348: jdk.internal.vm.compiler.management service
    providers missing in module descriptor
    + S8213906: Update arm devkits with libXrandr headers
    + S8213908: AssertionError in DeferredAttr at setOverloadKind
    + S8214124: [TESTBUG] Bugs in runtime/NMT/MallocStressTest.java
    + S8214344: C2: assert(con.basic_type() != T_ILLEGAL) failed:
    elembt=byte; loadbt=void; unsigned=0
    + S8214345: infinite recursion while checking super class
    + S8214471: Enable different look and feel tests in SwingSet3
    demo test ToolTipDemoTest
    + S8214534: Setting of THIS_FILE in the build is broken
    + S8214557: Filter out VM flags which don't affect AOT code
    generation
    + S8214578: [macos] Problem with backslashes on macOS/JIS
    keyboard: Java ignores system settings
    + S8214840: runtime/NMT/MallocStressTest.java timed out
    + S8214850: Rename vm_operations.?pp files to vmOperations.?pp
    files
    + S8214904: Test8004741.java failed due to "Too few ThreadDeath
    hits; expected at least 6 but saw only 5"
    + S8215322: add @file support to jaotc
    + S8215355: Object monitor deadlock with no threads holding the
    monitor (using jemalloc 5.1)
    + S8215396: JTabbedPane preferred size calculation is wrong for
    SCROLL_TAB_LAYOUT
    + S8216180: [AOT] compiler/intrinsics/bigInteger/TestMulAdd.java
    crashed with AOT enabled
    + S8216353: Use utility APIs introduced in org/netbeans/jemmy/
    /util/LookAndFeel class in client sanity test cases
    + S8216354: Syntax error in toolchain_windows.m4
    + S8216472: (se) Stack overflow during selection operation
    leads to crash (win)
    + S8216535: tools/jimage/JImageExtractTest.java timed out
    + S8217235: Create automated test for SwingSet
    ColorChooserDemoTest
    + S8217297: Add support for multiple look and feel for SwingSet
    SliderDemoTest
    + S8217338: [Containers] Improve systemd slice memory limit
    support
    + S8217613: [AOT] TEST_OPTS_AOT_MODULES doesn't work on mac
    + S8217634: RunTest documentation and usability update
    + S8217717: ZGC: Broken oop map in C1 load barrier stub
    + S8217728: Speed up incremental rerun of "make hotspot"
    + S8218268: Javac treats Manifest Class-Path entries as Paths
    instead of URLs
    + S8218662: Allow 204 responses with Content-Length:0
    + S8218882: NET_Writev is declared, NET_WriteV is defined
    + S8218889: Improperly use of the Optional API
    + S8219205: JFR file without license header
    + S8219597: (bf) Heap buffer state changes could provoke
    unexpected exceptions
    + S8219723: javax/net/ssl/compatibility/Compatibility.java
    failed on some SNI cases
    + S8220348: [ntintel] asserts about copying unaligned array
    + S8220451: jdi/EventQueue/remove/remove004 failed due to
    "ERROR: thread2 is not alive"
    + S8220456: jdi/EventQueue/remove_l/remove_l004 failed due to
    "TIMEOUT while waiting for event"
    + S8220479: java/nio/channels/Selector/SelectWithConsumer.java
    failed at testTwoChannels()
    + S8220613: java/util/Arrays/TimSortStackSize2.java times out
    with fastdebug build
    + S8220688: [TESTBUG] runtime/NMT/MallocStressTest.java timed
    out
    + S8220786: Create new switch to redirect error reporting
    output to stdout or stderr
    + S8221270: Duplicated synchronized keywords in SSLSocketImpl
    + S8221312: test/jdk/sanity/client/SwingSet/src/
    /ColorChooserDemoTest.java failed
    + S8221851: Use of THIS_FILE in hotspot invalidates precompiled
    header on Linux/GCC
    + S8221885: Add intermittent test in the JavaSound to the
    ProblemList
    + S8222264: Windows incremental build is broken with JDK-8217728
    + S8222391: javax/net/ssl/compatibility/Compatibility.java
    should be more flexible
    + S8222448: java/lang/reflect/PublicMethods/
    /PublicMethodsTest.java times out
    + S8222519: ButtonDemoScreenshotTest fails randomly with "still
    state to be reached"
    + S8222741: jdi/EventQueue/remove/remove004 fails due to
    VMDisconnectedException
    + S8223003: SunMSCAPI keys are not cleaned up
    + S8223063: Support CNG RSA keys
    + S8223158: Docked MacBook cannot start any Java Swing
    applications
    + S8223260: NamingManager should cache InitialContextFactory
    + S8223464: Improve version string for Oracle CI builds
    + S8223558: Java does not render Myanmar script correctly
    + S8223627: jdk-13+20 bundle name contains null instead of ea
    + S8223638: Replace wildcard address with loopback or local
    host in tests - part 6
    + S8223678: Add Visual Studio Code workspace generation support
    (for native code)
    + S8223727: com/sun/jndi/ldap/privconn/RunTest.java failed due
    to hang in LdapRequest.getReplyBer
    + S8223769: Assert triggers with -XX:+StressReflectiveCode
    + S8224187: Refactor arraycopy_prologue to allow ZGC read
    barriers on arraycopy
    + S8224475: JTextPane does not show images in HTML rendering
    + S8224673: Adjust permission for delayed starting of debugging
    + S8224705: Tests that need to be problem-listed or have
    printer resources
    + S8224778: test/jdk/demo/jfc/J2Ddemo/J2DdemoTest.java cannot
    find J2Ddemo.jar
    + S8224821: java/awt/Focus/NoAutotransferToDisabledCompTest/
    /NoAutotransferToDisabledCompTest.java fails linux-x64
    + S8224830: test/jdk/java/awt/Focus/
    /ModalExcludedWindowClickTest/
    /ModalExcludedWindowClickTest.java fails on linux-x64
    + S8224851: AArch64: fix warnings and errors with Clang and GCC
    8.3
    + S8224905: java/lang/ProcessBuilder/Basic.java#id1 failed with
    stream closed
    + S8225007: java/awt/print/PrinterJob/
    /LandscapeStackOverflow.java may hang
    + S8225105: java/awt/Focus/ShowFrameCheckForegroundTest/
    /ShowFrameCheckForegroundTest.java fails in Windows 10
    + S8225117: java/math/BigInteger/SymmetricRangeTests.java fails
    with ParseException
    + S8225128: Add exception for expiring DocuSign root to
    VerifyCACerts test
    + S8225130: Add exception for expiring Comodo roots to
    VerifyCACerts test
    + S8225144: [macos] In Aqua L&amp;F backspace key does not delete
    when Shift is pressed
    + S8225180: SignedObject with invalid Key not throwing the
    InvalidKeyException in Windows
    + S8225182: JNI exception pending in DestroyXIMCallback of
    awt_InputMethod.c:1327
    + S8225199: [Graal] compiler/jvmci/compilerToVM/
    /IsMatureVsReprofileTest.java fails with
  - XX:CompileThresholdScaling=0.1
    + S8225305: ProblemList java/lang/invoke/VarHandles tests
    + S8225350: compiler/jvmci/compilerToVM/IsCompilableTest.java
    timed out
    + S8225430: Replace wildcard address with loopback or local
    host in tests - part 14
    + S8225435: Upgrade IANA Language Subtag Registry to the latest
    for JDK14
    + S8225487: giflib legal file is missing attribution for
    openbsd-reallocarray.c
    + S8225567: Wrong file headers with 8202414 fix changeset
    + S8225684: [AOT] vmTestbase/vm/oom/production/
    /AlwaysOOMProduction tests fail with AOTed java.base
    + S8225766: Curve in certificate should not affect signature
    scheme when using TLSv1.3
    + S8225797: OldObjectSample event creates unexpected amount of
    checkpoint data
    + S8226381: ProblemList java/lang/reflect/PublicMethods/
    /PublicMethodsTest.java
    + S8226406: JVM fails to detect mismatched or corrupt CDS
    archive
    + S8226608: Hide the onjcmd option from the help output
    + S8226892: ActionListeners on JRadioButtons don't get notified
    when selection is changed with arrow keys
    + S8227112: exclude compiler/intrinsics/sha/sanity tests from
    AOT runs
    + S8227324: Upgrade to freetype 2.10.1
    + S8227528: TestAbortVMOnSafepointTimeout.java failed due to
    "RuntimeException: 'Safepoint sync time longer than' missing
    from stdout/stderr"
    + S8227645: Some tests in serviceability/sa run with fixed -Xmx
    values and risk running out of memory
    + S8227646: [TESTBUG] appcds/SharedArchiveConsistency timed out
    + S8227662: freetype seeks to index at the end of the font data
    + S8228479: Correct the format of ColorChooserDemoTest
    + S8228613: java.security.Provider#getServices order is no
    longer deterministic
    + S8228969: 2019-09-28 public suffix list update
    + S8229236: CriticalJNINatives: dll handling should be done in
    native thread state
    + S8229345: Memory leak due to vtable stubs not being shared on
    SPARC
    + S8229888: (zipfs) Updating an existing zip file does not
    preserve original permissions
    + S8229994: assert(false) failed: Bad graph detected in
    get_early_ctrl_for_expensive
    + S8230004: jdk/internal/jimage/JImageOpenTest.java runs no test
    + S8230235: Rendering HTML with empty img attribute and
    documentBaseKey cause Exception
    + S8230390: Problemlist SA tests with AOT
    + S8230400: Missing constant pool entry for a method in
    stacktrace
    + S8230459: Test failed to resume JVMCI CompilerThread
    + S8230480: check malloc/calloc results in java.desktop
    + S8230597: Update GIFlib library to the 5.2.1
    + S8230611: infinite loop in
    LogOutputList::wait_until_no_readers()
    + S8230624: [TESTBUG] Problemlist JFR
    compiler/TestCodeSweeper.java
    + S8230677: Should disable Escape Analysis if JVMTI capability
    can_get_owned_monitor_info was taken
    + S8230926: [macosx] Two apostrophes are entered instead of one
    with "U.S. International - PC" layout
    + S8231025: Incorrect method tag offset for big endian platform
    + S8231081: TestMetadataRetention fails due to missing symbol id
    + S8231387: java.security.Provider.getService returns random
    result due to race condition with mutating methods in the same
    class
    + S8231430: C2: Memory stomp in max_array_length() for
    T_ILLEGAL type
    + S8231445: check ZALLOC return values in awt coding
    + S8231507: Update Apache Santuario (XML Signature) to version
    2.1.4
    + S8231584: Deadlock with ClassLoader.findLibrary and
    System.loadLibrary call
    + S8231753: use more Posix functionality in aix
    os::print_os_info
    + S8231810: javax/net/ssl/templates/
    /SSLSocketSSLEngineTemplate.java fails intermittently with
    "java.lang.Exception: Unexpected EOF"
    + S8232003: (fs) Files.write can leak file descriptor in the
    exception case
    + S8232056: GetOwnedMonitorInfoWithEATest.java fails with ZGC:
    Heap too small
    + S8232060: add some initializations using sigemptyset in
    os_aix.cpp
    + S8232154: Update Mesa 3-D Headers to version 19.2.1
    + S8232167: Visual Studio install found through
  - -with-tools-dir value is discarded
    + S8232170: FSInfo#getJarClassPath throws an exception not
    declared in its throws clause
    + S8232200: [macos 10.15] Windows in fullscreen tests jumps
    around the screen
    + S8232207: Linux os::available_memory re-reads cgroup
    configuration on every invocation
    + S8232224: [TESTBUG] problemlist JFR TestLargeRootSet.java
    + S8232370: Refactor some com.sun.jdi tests to enable IDE
    integration
    + S8232433: [macos 10.15] java/awt/Window/
    /LocationAtScreenCorner/LocationAtScreenCorner.java may fail
    + S8232571: Add missing SIGINFO signal
    + S8232692: [TESTBUG] compiler/aot/fingerprint/
    /SelfChangedCDS.java fails when cds is disabled
    + S8232713: Update BCEL version to 6.3.1 in license file
    + S8232806: Introduce a system property to disable eager lambda
    initialization
    + S8232834: RunTest sometimes fails to produce valid
    exitcode.txt
    + S8232880: Update test documentation with additional settings
    for client UI tooltip tests
    + S8232950: SUNPKCS11 Provider incorrectly check key length for
    PSS Signatures.
    + S8233018: Add a new test to verify that DatagramSocket is not
    interruptible
    + S8233019: java.lang.Class.isPrimitive() (C1) returns wrong
    result if Klass* is aligned to 32bit
    + S8233032: assert(in_bb(n)) failed: must be
    + S8233078: fix minimal VM build on Linux ppc64(le)
    + S8233328: fix minimal VM build on Linux s390x
    + S8233383: Various minor fixes
    + S8233466: aarch64: remove unnecessary load of mdo when
    profiling return and parameters type
    + S8233491: Crash in AdapterHandlerLibrary::get_adapter with
    CDS due to code cache exhaustion
    + S8233529: loopTransform.cpp:2984: Error: assert(p_f-&gt;Opcode()
    == Op_IfFalse) failed
    + S8233548: Update CUP to v0.11b
    + S8233649: Update ProblemList.txt to exclude failing headful
    tests on macos
    + S8233656: assert(d-&gt;is_CFG() &amp;&amp; n-&gt;is_CFG()) failed: must
    have CFG nodes
    + S8233657: Intermittent NPE in Component.validate()
    + S8234288: Turkey Time Zone returns incorrect time zone name
    + S8234323: NULL-check return value of SurfaceData_InitOps on
    macosx
    + S8234339: replace JLI_StrTok in java_md_solinux.c
    + S8234340: Bump update version for OpenJDK: jdk-11.0.7
    + S8234350: assert(mode == ControlAroundStripMined &amp;&amp; (use ==
    sfpt || !use-&gt;is_reachable_from_root())) failed: missed a node
    + S8234386: [macos] NPE was thrown at expanding Choice from
    maximized frame
    + S8234397: add OS uptime information to os::print_os_info
    output
    + S8234423: Modifying ArrayList.subList().subList() resets
    modCount of subList
    + S8234466: Class loading deadlock involving
    X509Factory#commitEvent()
    + S8234501: remove obsolete NET_ReadV
    + S8234525: enable link-time section-gc for linux s390x to
    remove unused code
    + S8234610: MaxVectorSize set wrongly when UseAVX=3 is
    specified after JDK-8221092
    + S8234617: C1: Incorrect result of field load due to missing
    narrowing conversion
    + S8234723: javax/net/ssl/TLS tests support TLSv1.3
    + S8234724: javax/net/ssl/templates/
    /SSLSocketSSLEngineTemplate.java supports TLSv1.3
    + S8234741: enhance os::get_core_path on macOS
    + S8234769: Duplicate attribution in freetype.md
    + S8234786: Fix for JDK-8214578 breaks OS X 10.12 compatibility
    + S8234809: set relro in linker flags when building with gcc
    + S8234824: java/nio/channels/SocketChannel/AdaptSocket.java
    fails on Windows 10
    + S8235243: handle VS2017 15.9 and VS2019 in abstract_vm_version
    + S8235288: AVX 512 instructions inadvertently used on Xeon for
    small vector width operations
    + S8235325: build failure on Linux after 8235243
    + S8235383: C1 compilation fails with
  - XX:+PrintIRDuringConstruction -XX:+Verbose
    + S8235489: handle return values of sscanf calls in hotspot
    + S8235509: Backport for JDK-8209657 Refactor filemap.hpp to
    simplify integration with Serviceability Agent.
    + S8235510: java.util.zip.CRC32 performance drop after 8200067
    + S8235563: [TESTBUG] appcds/CommandLineFlagComboNegative.java
    does not handle archive mapping failure
    + S8235637: jhsdb jmap from OpenJDK 11.0.5 doesn't work if
    prelink is enabled
    + S8235671: enhance print_rlimit_info in os_posix
    + S8235744: PIT: test/jdk/javax/swing/text/html/
    /TestJLabelWithHTMLText.java times out in linux-x64
    + S8235904: Infinite loop when rendering huge lines
    + S8235998: [c2] Memory leaks during tracing after '8224193:
    stringStream should not use Resource Area'.
    + S8236039: JSSE Client does not accept status_request
    extension in CertificateRequest messages for TLS 1.3
    + S8236140: assert(!VerifyHashTableKeys || _hash_lock == 0)
    failed: remove node from hash table before modifying it
    + S8236179: C1 register allocation error with T_ADDRESS
    + S8236488: Support for configure option
  - -with-native-debug-symbols=internal is impossible on Windows
    + S8236500: Windows ucrt.dll should be looked up in versioned
    WINSDK subdirectory
    + S8236709: struct SwitchRange in HS violates C++ One
    Definition Rule
    + S8236848: [JDK 11u] make run-test-tier1 fails after backport
    of JDK-8232834
    + S8236873: Worker has a deadlock bug
    + S8237217: Incorrect G1StringDedupEntry type used in
    StringDedupTable destructor
    + S8237368: Problem with NullPointerException in RMI
    TCPEndpoint.read
    + S8237375: SimpleThresholdPolicy misses CounterDecay timestamp
    initialization
    + S8237508: Simplify JarFile.isInitializing
    + S8237540: Missing files in backport of JDK-8210910
    + S8237541: Missing files in backport of JDK-8236528
    + S8237600: Test SunJSSEFIPSInit fails on Ubuntu
    + S8237819: s390x - remove unused pd_zero_to_words_large
    + S8237869: exclude jtreg test security/infra/java/security/
    /cert/CertPathValidator/certification/LuxTrustCA.java because
    of instabilities
    + S8237879: make 4.3 breaks build
    + S8237945: CTW: C2 compilation fails with
    assert(just_allocated_object(alloc_ctl) == ptr) failed: most
    recent allo...
    + S8238225: Issues reported after replacing symlink at
    Contents/MacOS/libjli.dylib with binary
    + S8238247: CTW runner should sweep nmethods more aggressively
    + S8238366: CTW runner closes standard output on exit
    + S8238438: SuperWord::co_locate_pack picks memory state of
    first instead of last load
    + S8238502: sunmscapi.dll causing EXCEPTION_ACCESS_VIOLATION
    + S8238534: Deep sign macOS bundles before bundle archive is
    being created
    + S8238591: CTW: Split
    applications/ctw/modules/jdk_localedata.java
    + S8238596: AVX enabled by default for Skylake even when
    unsupported
    + S8238811: C2: assert(i &gt;= req() || i == 0 || is_Region() ||
    is_Phi()) with -XX:+VerifyGraphEdges
    + S8239005: [TESTBUG] test/hotspot/jtreg/runtime/
    /StackGuardPages/TestStackGuardPages.java: exeinvoke.c: must
    initialize static state before calling do_overflow()
    + S8239466: Loss of precision in counter decay calculation in
    11u backport of JDK-8237375
    + S8239856: [ntintel] asserts about copying unaligned array
    element
    + S8240724: [test] jdk11 downport of 8224475 misses binary file
    test/jdk/javax/swing/JTextPane/arrow.png
    + S8241296: Segfault in JNIHandleBlock::oops_do()
- Removed patch:
  * DependOnVariableHelper.patch
    + fixed upstream
- Added patch:
  * JDK-8228407.patch
    + fix crashes due to shared archive file mismatch</changelog>
  <changelog author="fstrba@suse.com" date="1594900800">- Update to upstream tag jdk-11.0.8+10 (July 2020 CPU, bsc#1174157)
  * Security fixes:
    + JDK-8230613: Better ASCII conversions
    + JDK-8231800: Better listing of arrays
    + JDK-8232014: Expand DTD support
    + JDK-8233234: Better Zip Naming
    + JDK-8233239, CVE-2020-14562: Enhance TIFF support
    + JDK-8233255: Better Swing Buttons
    + JDK-8234032: Improve basic calendar services
    + JDK-8234042: Better factory production of certificates
    + JDK-8234418: Better parsing with CertificateFactory
    + JDK-8234836: Improve serialization handling
    + JDK-8236191: Enhance OID processing
    + JDK-8236867, CVE-2020-14573: Enhance Graal interface handling
    + JDK-8237117, CVE-2020-14556: Better ForkJoinPool behavior
    + JDK-8237592, CVE-2020-14577: Enhance certificate verification
    + JDK-8238002, CVE-2020-14581: Better matrix operations
    + JDK-8238013: Enhance String writing
    + JDK-8238804: Enhance key handling process
    + JDK-8238842: AIOOBE in GIFImageReader.initializeStringTable
    + JDK-8238843: Enhanced font handing
    + JDK-8238920, CVE-2020-14583: Better Buffer support
    + JDK-8238925: Enhance WAV file playback
    + JDK-8240119, CVE-2020-14593: Less Affine Transformations
    + JDK-8240482: Improved WAV file playback
    + JDK-8241379: Update JCEKS support
    + JDK-8241522: Manifest improved jar headers redux
    + JDK-8242136, CVE-2020-14621: Better XML namespace handling
  * Other changes:
    + JDK-6933331: (d3d/ogl) java.lang.IllegalStateException:
    Buffers have not been created
    + JDK-7124307: JSpinner and changing value by mouse
    + JDK-8022574: remove HaltNode code after uncommon trap calls
    + JDK-8039082: [TEST_BUG] Test
    java/awt/dnd/BadSerializationTest/BadSerializationTest.java
    fails
    + JDK-8040630: Popup menus and tooltips flicker with previous
    popup contents when first shown
    + JDK-8044365: (dc) MulticastSendReceiveTests.java failing with
    ENOMEM when joining group (OS X 10.9)
    + JDK-8048215: [TESTBUG]
    java/lang/management/ManagementFactory/ThreadMXBeanProxy.java
    Expected non-null LockInfo
    + JDK-8051349: nsk/jvmti/scenarios/sampling/SP06/sp06t003 fails
    in nightly
    + JDK-8080353: JShell: Better error message on attempting to
    add default method
    + JDK-8139876: Exclude hanging nsk/stress/stack from execution
    with deoptimization enabled
    + JDK-8146090: java/lang/ref/ReachabilityFenceTest.java fails
    with -XX:+DeoptimizeALot
    + JDK-8153430: jdk regression test MletParserLocaleTest,
    ParserInfiniteLoopTest reduce default timeout
    + JDK-8156207: Resource allocated BitMaps are often cleared
    unnecessarily
    + JDK-8159740: JShell: corralled declarations do not have
    correct source to wrapper mapping
    + JDK-8175984: ICC_Profile has un-needed, not-empty finalize
    method
    + JDK-8176359: Frame#setMaximizedbounds not working properly in
    multi screen environments
    + JDK-8183369: RFC unconformity of HttpURLConnection with proxy
    + JDK-8187078: -XX:+VerifyOops finds numerous problems when
    running JPRT
    + JDK-8189861: Refactor CacheFind
    + JDK-8191169: java/net/Authenticator/B4769350.java failed
    intermittently
    + JDK-8191930: [Graal] emits unparseable XML into compile log
    + JDK-8193879: Java debugger hangs on method invocation
    + JDK-8196019: java/awt/Window/Grab/GrabTest.java fails on
    Windows
    + JDK-8196181: sun/java2d/GdiRendering/InsetClipping.java fails
    + JDK-8198000:
    java/awt/List/EmptyListEventTest/EmptyListEventTest.java
    debug assert on Windows
    + JDK-8198001: java/awt/Menu/WrongParentAfterRemoveMenu/
    /WrongParentAfterRemoveMenu.java debug assert on Windows
    + JDK-8198339: Test javax/swing/border/Test6981576.java is
    unstable
    + JDK-8200701: jdk/jshell/ExceptionsTest.java fails on Windows,
    after JDK-8198801
    + JDK-8203264: JNI exception pending in
    PlainDatagramSocketImpl.c:740
    + JDK-8203672: JNI exception pending in PlainSocketImpl.c
    + JDK-8203673: JNI exception pending in
    DualStackPlainDatagramSocketImpl.c:398
    + JDK-8204834: Fix confusing "allocate" naming in OopStorage
    + JDK-8205399: Set node color on pinned HashMap.TreeNode
    deletion
    + JDK-8205653: test/jdk/sun/management/jmxremote/bootstrap/
    /RmiRegistrySslTest.java and RmiSslBootstrapTest.sh fail with
    handshake_failure
    + JDK-8206179: com/sun/management/OperatingSystemMXBean/
    /GetCommittedVirtualMemorySize.java fails with Committed
    virtual memory size illegal value
    + JDK-8207334: VM times out in VM_HandshakeAllThreads::doit()
    with RunThese30M
    + JDK-8208277: Code cache heap (-XX:ReservedCodeCacheSize)
    doesn't work with 1GB LargePages
    + JDK-8209113: Use WeakReference for lastFontStrike for created
    Fonts
    + JDK-8209333: Socket reset issue for TLS 1.3 socket close
    + JDK-8209439: C2 library_call can potentially ignore Math.pow
    intrinsic or use null pointer
    + JDK-8209534: [TESTBUG]runtime/appcds/cacheObject/
    /ArchivedModuleCompareTest.java fails with EnableJVMCI.
    + JDK-8210147: adjust some WSAGetLastError usages in windows
    network coding
    + JDK-8210284: "assert((av &amp; 0x00000001) == 0) failed:
    unsupported V8" on Solaris 11.4
    + JDK-8210303: VM_HandshakeAllThreads fails assert with
    "failed: blocked and not walkable"
    + JDK-8210459: Add support for generating compile_commands.json
    + JDK-8210515: [TESTBUG]CheckArchivedModuleApp.java needs to
    check if EnableJVMCI is set.
    + JDK-8210788: Javadoc for Thread.join(long, int) should
    specify that it waits forever when both arguments are zero
    + JDK-8211301: [macos] support full window content options
    + JDK-8211332: Space for stub routines (code_size2) is too
    small on new Skylake CPUs
    + JDK-8211339: NPE during SSL handshake caused by
    HostnameChecker
    + JDK-8211392: compiler/profiling/
    /spectrapredefineclass_classloaders/Launcher.java times out
    in JDK12 CI
    + JDK-8211743: [AOT] crash in ScopeDesc::decode_body() when
    JVMTI walks AOT frames
    + JDK-8212154: [TESTBUG] CheckArchivedModuleApp fails with NPE
    when JVMCI is absent
    + JDK-8212167: JShell : Stack trace of exception has wrong line
    number
    + JDK-8212933: Thread-SMR: requesting a VM operation whilst
    holding a ThreadsListHandle can cause deadlocks
    + JDK-8212986: Make Visual Studio compiler check less strict
    + JDK-8213250: CDS archive creation aborts due to metaspace
    object allocation failure
    + JDK-8213516: jck test api/javax_accessibility/AccessibleState/
    /fields.html fails intermittent
    + JDK-8213947: ARM32: failed check_simd should set
    UsePopCountInstruction to false
    + JDK-8214418: half-closed SSLEngine status may cause
    application dead loop
    + JDK-8214440: ldap over a TLS connection negotiate failed with
    "javax.net.ssl.SSLPeerUnverifiedException: hostname of the
    server does not match the hostname in the server's
    certificate"
    + JDK-8214444: Wrong strncat limits in dfa.cpp
    + JDK-8214481: freetype path does not disable TrueType hinting
    with AA+FM hints
    + JDK-8214571: -Xdoclint of array serialField gives "error:
    array type not allowed here"
    + JDK-8214856: Errors with JSZip in web console after upgrade
    to 3.1.5
    + JDK-8214862: assert(proj != __null) at compile.cpp:3251
    + JDK-8215369: Jcstress pollute /var/tmp with temporary files.
    + JDK-8215551: Missing case label in nmethod::reloc_string_for()
    + JDK-8215555: TieredCompilation C2 threads can excessively
    block handshakes
    + JDK-8215711: Missing key_share extension for (EC)DHE key
    exchange should alert missing_extension
    + JDK-8216151: [Graal] Module
    jdk.internal.vm.compiler.management has not been granted
    accessClassInPackage.org.graalvm.compiler.debug
    + JDK-8216154: C4819 warnings at HotSpot sources on Windows
    + JDK-8216541: CompiledICHolders of VM locked unloaded nmethods
    are released too late
    + JDK-8217230: assert(t == t_no_spec) failure in
    NodeHash::check_no_speculative_types()
    + JDK-8217404: --with-jvm-features doesn't work when multiple
    features are explicitly disabled
    + JDK-8217447: Develop flag TraceICs is broken
    + JDK-8217606: LdapContext#reconnect always opens a new
    connection
    + JDK-8218807: Compilation database (compile_commands.json) may
    contain obsolete items
    + JDK-8219214: Infinite Loop in CodeSection::dump()
    + JDK-8219904: ClassCastException when calling
    FlightRecorderMXBean#getRecordings()
    + JDK-8219991: New fix of the deadlock in
    sun.security.ssl.SSLSocketImpl
    + JDK-8221121: applications/microbenchmarks are encountering
    crashes in tier5
    + JDK-8221445: FastSysexMessage constructor crashes MIDI
    receiption thread
    + JDK-8221482: Initialize VMRegImpl::regName[] earlier to
    prevent assert during PrintStubCode
    + JDK-8221741: ClassCastException can happen when
    fontconfig.properties is used
    + JDK-8221823: Requested JDialog width is ignored
    + JDK-8223108: Test java/awt/EventQueue/
    /NonComponentSourcePost.java is unstable
    + JDK-8223678: Add Visual Studio Code workspace generation
    support (for native code)
    + JDK-8223935: PIT: java/awt/font/WindowsIndicFonts.java fails
    on windows10
    + JDK-8224109: Text spaced incorrectly by drawString under
    rotation with fractional metric
    + JDK-8224632: testbug: java/awt/dnd/RemoveDropTargetCrashTest/
    /RemoveDropTargetCrashTest.java fails on MacOS
    + JDK-8224793: os::die() does not honor CreateCoredumpOnCrash
    option
    + JDK-8224847: gc/stress/TestReclaimStringsLeaksMemory.java
    fails with reserved greater than expected
    + JDK-8224931: disable JAOTC invokedynamic support until
    8223533 is fixed
    + JDK-8224997: ChaCha20-Poly1305 TLS cipher suite decryption
    throws ShortBufferException
    + JDK-8225068: Remove DocuSign root certificate that is
    expiring in May 2020
    + JDK-8225069: Remove Comodo root certificate that is expiring
    in May 2020
    + JDK-8225126: Test SetBoundsPaintTest.html faild on Windows
    when desktop is scaled
    + JDK-8225325: Add tests for redefining a class' private method
    during resolution of the bootstrap specifier
    + JDK-8225622: [AOT] runtime/SharedArchiveFile/
    /TestInterpreterMethodEntries.java crashed with AOTed
    java.base
    + JDK-8225653: Provide more information when hitting SIGILL
    from HaltNode
    + JDK-8225783: Incorrect use of binary operators on booleans in
    type.cpp
    + JDK-8225789: Empty method parameter type should generate
    ClassFormatError
    + JDK-8226198: use of &amp; instead of &amp;&amp; in
    LibraryCallKit::arraycopy_restore_alloc_state
    + JDK-8226253: JAWS reports wrong number of radio buttons when
    buttons are hidden.
    + JDK-8226653: [accessibility] Can edit text cell correctly,
    but Accessibility Tool reads nothing about editor
    + JDK-8226806: [macOS 10.14] Methods of Java Robot should be
    called from appropriate thread
    + JDK-8226879: Memory leak in Type::hashcons
    + JDK-8227632: Incorrect PrintCompilation message: made not
    compilable on levels 0 1 2 3 4
    + JDK-8228407: JVM crashes with shared archive file mismatch
    + JDK-8228482: fix xlc16/xlclang comparison of distinct pointer
    types and string literal conversion warnings
    + JDK-8228757: Fail fast if the handshake type is unknown
    + JDK-8229158: make UseSwitchProfiling non-experimental or
    false by-default
    + JDK-8229421: The logic of java/net/ipv6tests/TcpTest.java is
    flawed
    + JDK-8229855: C2 fails with assert(false) failed: bad AD file
    + JDK-8230591: AArch64: Missing intrinsics for Math.ceil,
    floor, rint
    + JDK-8231118: ARM32: Math tests failures
    + JDK-8231213: Migrate SimpleDateFormatConstTest to JDK Repo
    + JDK-8231243: [TESTBUG] CustomFont.java cannot find font file
    + JDK-8231438: [macOS] Dark mode for the desktop is not
    supported
    + JDK-8231550: C2: ShouldNotReachHere() in
    verify_strip_mined_scheduling
    + JDK-8231564: setMaximizedBounds is broken with large display
    scale and multiple monitors
    + JDK-8231572: Use -lobjc instead of -fobjc-link-runtime in
    libosxsecurity
    + JDK-8231631: sun/net/ftp/FtpURLConnectionLeak.java fails
    intermittently with NPE
    + JDK-8231671: Fix copyright headers in hotspot (missing comma
    after year)
    + JDK-8231720: Some perf regressions after 8225653
    + JDK-8231779: crash
    HeapWord*ParallelScavengeHeap::failed_mem_allocate
    + JDK-8231863: Crash if classpath is read from @argument file
    and the main gets option argument
    + JDK-8232080: jlink plugins for vendor information and
    run-time options
    + JDK-8232106: [x86] C2: SIGILL due to usage of SSSE3
    instructions on processors which don't support it
    + JDK-8232134: Change to Visual Studio 2017 15.9.16 for
    building on Windows at Oracle
    + JDK-8232226: [macos 10.15] test/jdk/java/awt/color/
    /EqualityTest/EqualityTest.java may fail
    + JDK-8232357: Compare version info of Santuario to legal notice
    + JDK-8232572: Add hooks for custom output dir in Bundles.gmk
    + JDK-8232634: Problem List ICMColorDataTest.java
    + JDK-8232748: Build static versions of certain JDK libraries
    + JDK-8232846: ProcessHandle.Info command with non-English
    shows question marks
    + JDK-8232880: Update test documentation with additional
    settings for client UI tooltip tests
    + JDK-8233033: C2 produces wrong result while unswitching a
    loop due to lost control dependencies
    + JDK-8233137: runtime/ErrorHandling/VeryEarlyAssertTest.java
    fails after 8232080
    + JDK-8233197: Invert JvmtiExport::post_vm_initialized() and
    Jfr:on_vm_start() start-up order for correct option parsing
    + JDK-8233291: [TESTBUG] tools/jlink/plugins/
    /VendorInfoPluginsTest.java fails with debug or non-server VMs
    + JDK-8233364: Fix undefined behavior in
    Canonicalizer::do_ShiftOp
    + JDK-8233494: Avoid calling MallocTracker::record_malloc and
    record_free when NMT is off
    + JDK-8233573: Toolkit.getScreenInsets(GraphicsConfiguration)
    may throw ClassCastException
    + JDK-8233608: Minimal build broken after JDK-8233494
    + JDK-8233621: Mismatch in jsse.enableMFLNExtension property
    name
    + JDK-8233696: [TESTBUG]Some jtreg tests fail when CAPS_LOCK is
    ON
    + JDK-8233707: systemScale.cpp could not compile with VS2019
    + JDK-8233801: GCMEmptyIv.java test fails on Solaris 11.4
    + JDK-8233880: Support compilers with multi-digit major version
    numbers
    + JDK-8233920: MethodHandles::tryFinally generates illegal
    bytecode for long/double return type
    + JDK-8234137: The "AutoTestOnTop.java" test may run external
    applications
    + JDK-8234146: compiler/jsr292/
    /ContinuousCallSiteTargetChange.java times out on SPARC
    + JDK-8234184: [TESTBUG] java/awt/Mouse/EnterExitEvents/
    /ModalDialogEnterExitEventsTest.java fails in Windows
    + JDK-8234270: [REDO] JDK-8204128 NMT might report incorrect
    numbers for Compiler area
    + JDK-8234332: [TESTBUG] java/awt/Focus/DisposedWindow/
    /DisposeDialogNotActivateOwnerTest/
    /DisposeDialogNotActivateOwnerTest.java fails on linux-x64
    nightly
    + JDK-8234398: Replace ID2D1Factory::GetDesktopDpi with
    GetDeviceCaps
    + JDK-8234522: [macos] Crash with use of native file dialog
    + JDK-8234691: Potential double-free in ParallelSPCleanupTask
    constructor
    + JDK-8234696: tools/jlink/plugins/VendorInfoPluginsTest.java
    times out
    + JDK-8234727: sun/security/ssl/X509TrustManagerImpl tests
    support TLSv1.3
    + JDK-8234728: Some security tests should support TLSv1.3
    + JDK-8234779: Provide idiom for declaring classes noncopyable
    + JDK-8234824: java/nio/channels/SocketChannel/AdaptSocket.java
    fails on Windows 10
    + JDK-8234968: check calloc rv in libinstrument
    InvocationAdapter
    + JDK-8235153: [TESTBUG] [macos 10.15] java/awt/Graphics/
    /DrawImageBG/SystemBgColorTest.java fails
    + JDK-8235183: Remove the "HACK CODE" in comment
    + JDK-8235263: Revert TLS 1.3 change that wrapped IOExceptions
    + JDK-8235311: Tag mismatch may alert bad_record_mac
    + JDK-8235332: TestInstanceCloneAsLoadsStores.java fails with
  - XX:+StressGCM
    + JDK-8235452: Strip mined loop verification fails with
    assert(is_OuterStripMinedLoop()) failed: invalid node class
    + JDK-8235584: UseProfiledLoopPredicate fails with
    assert(_phase-&gt;get_loop(c) == loop) failed: have to be in the
    same loop
    + JDK-8235620: Broken merge between JDK-8006406 and JDK-8003559
    + JDK-8235638: NPE in LWWindowPeer.getOnscreenGraphics()
    + JDK-8235686: Add more custom hooks in Bundles.gmk
    + JDK-8235739: Rare NPE at WComponentPeer.getGraphics()
    + JDK-8235762: JVM crash in SWPointer during C2 compilation
    + JDK-8235834: IBM-943 charset encoder needs updating
    + JDK-8235874: The ordering of Cipher Suites is not maintained
    provided through jdk.tls.client.cipherSuites and
    jdk.tls.server.cipherSuites system property.
    + JDK-8235908: omit ThreadPriorityPolicy warning when value is
    set from image
    + JDK-8235984: C2: assert(out-&gt;in(PhiNode::Region) == head ||
    out-&gt;in(PhiNode::Region) == slow_head) failed: phi must be
    either part of the slow or the fast loop
    + JDK-8236211: [Graal] compiler/graalunit/GraphTest.java is
    skipped in all testing
    + JDK-8236470: Deal with ECDSA using ecdsa-with-SHA2 plus hash
    algorithm as AlgorithmId
    + JDK-8236545: Compilation error in mach5
    java/awt/FileDialog/MacOSGoToFolderCrash.java
    + JDK-8236700: Upgrading JSZip from v3.1.5 to v3.2.2
    + JDK-8236759: ShouldNotReachHere in
    PhaseIdealLoop::verify_strip_mined_scheduling
    + JDK-8236897: Fix the copyright header for pkcs11gcm2.h
    + JDK-8236921: Add build target to produce a JDK image suitable
    for a Graal/SVM build
    + JDK-8236953: [macos] JavaFX SwingNode is not rendered on macOS
    + JDK-8236996: Incorrect Roboto font rendering on Windows with
    subpixel antialiasing
    + JDK-8237045: JVM uses excessive memory with -XX:+EnableJVMCI
  - XX:JVMCICounterSize=2147483648
    + JDK-8237055: [TESTBUG] compiler/c2/TestJumpTable.java fails
    with release VMs
    + JDK-8237086: assert(is_MachReturn()) running CTW with fix for
    JDK-8231291
    + JDK-8237192: Generate stripped/public pdbs on Windows for jdk
    images
    + JDK-8237396: JvmtiTagMap::weak_oops_do() should not trigger
    barriers
    + JDK-8237474: Default SSLEngine should create in server role
    + JDK-8237859: C2: Crash when loads float above range check
    + JDK-8237879: make 4.3 breaks build
    + JDK-8237951: CTW: C2 compilation fails with "malformed
    control flow"
    + JDK-8237962: give better error output for invalid OCSP
    response intervals in CertPathValidator checks
    + JDK-8238190: [JVMCI] Fix single implementor speculation for
    diamond shapes.
    + JDK-8238356: CodeHeap::blob_count() overestimates the number
    of blobs
    + JDK-8238452: Keytool generates wrong expiration date if
    validity is set to 2050/01/01
    + JDK-8238555: Allow Initialization of SunPKCS11 with NSS when
    there are external FIPS modules in the NSSDB
    + JDK-8238575: DragSourceEvent.getLocation() returns wrong
    value on HiDPI screens (Windows)
    + JDK-8238676: jni crashes on accessing it from process exit
    hook
    + JDK-8238721: Add failing client jtreg tests to the Problem
    List
    + JDK-8238738: AudioSystem.getMixerInfo() takes about 30 sec to
    report a gone audio device
    + JDK-8238756: C2: assert(((n) == __null || !VerifyIterativeGVN
    || !((n)-&gt;is_dead()))) failed: can not use dead node
    + JDK-8238765: PhaseCFG::schedule_pinned_nodes cannot handle
    precedence edges from unmatched CFG nodes correctly
    + JDK-8238898: Missing hash characters for header on license
    file
    + JDK-8238942: Rendering artifacts with LCD text and fractional
    metrics
    + JDK-8238985: [TESTBUG] The arrow image is blue instead of
    green
    + JDK-8239000: handle ContendedPaddingWidth in vm_version_ppc
    + JDK-8239055: Wrong implementation of VMState.hasListener
    + JDK-8239091: Reversed arguments in call to strstr in freetype
    "debug" code.
    + JDK-8239142: C2's UseUniqueSubclasses optimization is broken
    for array accesses
    + JDK-8239224: libproc_impl.c previous_thr may be used
    uninitialized warning
    + JDK-8239351: Give more meaningful InternalError messages in
    Deflater.c
    + JDK-8239365: ProcessBuilder test modifications for AIX
    execution
    + JDK-8239456: vtable stub generation: assert failure (code
    size estimate)
    + JDK-8239457: call ReleaseStringUTFChars before early returns
    in Java_sun_security_pkcs11_wrapper_PKCS11_connect
    + JDK-8239462: jdk.hotspot.agent misses some
    ReleaseStringUTFChars calls in case of early returns
    + JDK-8239557: [TESTBUG] VeryEarlyAssertTest.java validating
    "END." marker at lastline is not always true
    + JDK-8239787: AArch64: String.indexOf may incorrectly handle
    empty strings
    + JDK-8239792: Bump update version for OpenJDK: jdk-11.0.8
    + JDK-8239798: SSLSocket closes socket both socket endpoints on
    a SocketTimeoutException
    + JDK-8239819: XToolkit: Misread of screen information memory
    + JDK-8239852: java/util/concurrent tests fail with
  - XX:+VerifyGraphEdges: assert(!VerifyGraphEdges) failed:
    verification should have failed
    + JDK-8239893: Windows handle Leak when starting processes
    using ProcessBuilder
    + JDK-8239915: Zero VM crashes when handling dynamic constant
    + JDK-8239931: [win][x86] vtable stub generation: assert
    failure (code size estimate) follow-up
    + JDK-8239965: XMLEncoder/Test4625418.java fails due to "Error:
    Cp943 - can't read properly"
    + JDK-8239976: Put JDK-8239965 on the ProblemList.txt
    + JDK-8240073: Fix 'test-make' build target in 11u
    + JDK-8240197: Cannot start JVM when $JAVA_HOME includes CJK
    characters
    + JDK-8240202: A few client tests leave mouse buttons pressed
    + JDK-8240220: IdealLoopTree::dump_head predicate printing is
    broken
    + JDK-8240223: Use consistent predicate order in and with
    PhaseIdealLoop::find_predicate
    + JDK-8240227: Loop predicates should be copied to unswitched
    loops
    + JDK-8240286: [TESTBUG] Test command error in hotspot/jtreg/
    /compiler/loopopts/superword/SumRedAbsNeg_Float.java
    + JDK-8240518: Incorrect JNU_ReleaseStringPlatformChars in
    Windows Print
    + JDK-8240529: CheckUnhandledOops breaks NULL check in
    Modules::define_module
    + JDK-8240576: JVM crashes after transformation in C2
    IdealLoopTree::merge_many_backedges
    + JDK-8240603: Windows 32bit compile error after 8238676
    + JDK-8240629: argfiles parsing broken for argfiles with
    comment cross 4096 bytes chunk
    + JDK-8240711: TestJstatdPort.java failed due to
    "ExportException: Port already in use:"
    + JDK-8240786: [TESTBUG] The test java/awt/Window/
    /GetScreenLocation/GetScreenLocationTest.java fails on HiDPI
    screen
    + JDK-8240824: enhance print_full_memory_info on Linux by THP
    related information
    + JDK-8240827: Downport SSLSocketImpl.java from "8221882: Use
    fiber-friendly java.util.concurrent.locks in JSSE"
    + JDK-8240905: assert(mem == (Node*)1 || mem == mem2) failed:
    multiple Memories being matched at once?
    + JDK-8240972: macOS codesign fail on macOS 10.13.5 or older
    + JDK-8241445: Fix copyright in
    test/jdk/tools/launcher/ArgFileSyntax.java
    + JDK-8241458: [JVMCI] add mark value to expose
    CodeOffsets::Frame_Complete
    + JDK-8241464: [11u] Backport: make rehashing be a needed
    guaranteed safepoint cleanup action
    + JDK-8241556: Memory leak if -XX:CompileCommand is set
    + JDK-8241568: (fs) UserPrincipalLookupService.lookupXXX
    failure with IOE "Operation not permitted"
    + JDK-8241586: compiler/cpuflags/
    /TestAESIntrinsicsOnUnsupportedConfig.java fails on aarch64
    + JDK-8241638: launcher time metrics always report 1 on Linux
    when _JAVA_LAUNCHER_DEBUG set
    + JDK-8241660: Add virtualization information output to hs_err
    file on macOS
    + JDK-8241808: [TESTBUG] The JDK-8039467 bug appeared on macOS
    + JDK-8241888: Mirror jdk.security.allowNonCaAnchor system
    property with a security one
    + JDK-8241900: Loop unswitching may cause dependence on null
    check to be lost
    + JDK-8241948: enhance list of environment variables printed in
    hs_err file
    + JDK-8241996: on linux set full relro in the linker flags
    + JDK-8242108: Performance regression after fix for JDK-8229496
    + JDK-8242141: New System Properties to configure the TLS
    signature schemes
    + JDK-8242154: Backport parts of JDK-4947890 to OpenJDK 11u
    + JDK-8242174: [macos] The NestedModelessDialogTest test make
    the macOS unstable
    + JDK-8242239: [Graal] javax/management/generified/
    /GenericTest.java fails: FAILED: queryMBeans sets same
    + JDK-8242294: JSSE Client does not throw SSLException when an
    alert occurs during handshaking
    + JDK-8242379: [TESTBUG] compiler/loopopts/
    /TestLoopUnswitchingLostCastDependency.java fails with
    release VMs
    + JDK-8242470: Update Xerces to Version 2.12.1
    + JDK-8242498: Invalid "sun.awt.TimedWindowEvent" object leads
    to JVM crash
    + JDK-8242541: Small charset issues (ISO8859-16, x-eucJP-Open,
    x-IBM834 and x-IBM949C)
    + JDK-8242626: enhance posix print_rlimit_info
    + JDK-8243059: Build fails when --with-vendor-name contains a
    comma
    + JDK-8243539: Copyright info (Year) should be updated for fix
    of 8241638
    + JDK-8243541: (tz) Upgrade time-zone data to tzdata2020a
    + JDK-8244407: JVM crashes after transformation in C2
    IdealLoopTree::split_fall_in
    + JDK-8244520: problemlist
    java/awt/font/Rotate/RotatedFontTest.java on linux
    + JDK-8244777: ClassLoaderStats VM Op uses constant hash value
    + JDK-8244853: The static build of libextnet is missing the
    JNI_OnLoad_extnet function
    + JDK-8244951: Missing entitlements for hardened runtime
    + JDK-8245047: [PPC64] C2: ReverseBytes + Load always match to
    unordered Load (acquire semantics missing)
    + JDK-8245649: Revert 8245397 backport of 8230591
    + JDK-8246031: SSLSocket.getSession() doesn't close connection
    for timeout/ interrupts
    + JDK-8246613: Choose the default SecureRandom algo based on
    registration ordering
    + JDK-8248505: Unexpected NoSuchAlgorithmException when using
    secure random impl from BCFIPS provider
- Removed patch:
  * JDK-8228407.patch
    + integrated upstream</changelog>
  <changelog author="fstrba@suse.com" date="1604318400">- Update to upstream tag jdk-11.0.9-11 (October 2020 CPU,
  bsc#1177943)
  * New features
    + JDK-8250784: Shenandoah: A Low-Pause-Time Garbage Collector
  * Security fixes
    + JDK-8233624: Enhance JNI linkage
    + JDK-8236196: Improve string pooling
    + JDK-8236862, CVE-2020-14779: Enhance support of Proxy class
    + JDK-8237990, CVE-2020-14781: Enhanced LDAP contexts
    + JDK-8237995, CVE-2020-14782: Enhance certificate processing
    + JDK-8240124: Better VM Interning
    + JDK-8241114, CVE-2020-14792: Better range handling
    + JDK-8242680, CVE-2020-14796: Improved URI Support
    + JDK-8242685, CVE-2020-14797: Better Path Validation
    + JDK-8242695, CVE-2020-14798: Enhanced buffer support
    + JDK-8243302: Advanced class supports
    + JDK-8244136, CVE-2020-14803: Improved Buffer supports
    + JDK-8244479: Further constrain certificates
    + JDK-8244955: Additional Fix for JDK-8240124
    + JDK-8245407: Enhance zoning of times
    + JDK-8245412: Better class definitions
    + JDK-8245417: Improve certificate chain handling
    + JDK-8248574: Improve jpeg processing
    + JDK-8249927: Specify limits of jdk.serialProxyInterfaceLimit
    + JDK-8253019: Enhanced JPEG decoding
  * Other changes
    + JDK-6532025: GIF reader throws misleading exception with
    truncated images
    + JDK-6949753: [TEST BUG]: java/awt/print/PageFormat/
    /PDialogTest.java needs update by removing an infinite loop
    + JDK-8022535: [TEST BUG] javax/swing/text/html/parser/
    /Test8017492.java fails
    + JDK-8062947: Fix exception message to correctly represent
    LDAP connection failure
    + JDK-8067354: com/sun/jdi/GetLocalVariables4Test.sh failed
    + JDK-8134599: TEST_BUG: java/rmi/transport/closeServerSocket/
    /CloseServerSocket.java fails intermittently with Address
    already in use
    + JDK-8151678: com/sun/jndi/ldap/LdapTimeoutTest.java failed
    due to timeout on DeadServerNoTimeoutTest is incorrect
    + JDK-8160768: Add capability to custom resolve host/domain
    names within the default JNDI LDAP provider
    + JDK-8172404: Tools should warn if weak algorithms are used
    before restricting them
    + JDK-8193367: Annotated type variable bounds crash javac
    + JDK-8202117: com/sun/jndi/ldap/RemoveNamingListenerTest.java
    fails intermittently: Connection reset
    + JDK-8203026: java.rmi.NoSuchObjectException: no such object
    in table
    + JDK-8203281: [Windows] JComboBox change in ui when
    editor.setBorder() is called
    + JDK-8203382: Rename SystemDictionary::initialize_wk_klass to
    resolve_wk_klass
    + JDK-8203393: com/sun/jdi/JdbMethodExitTest.sh and
    JdbExprTest.sh fail due to timeout
    + JDK-8203928: [Test] Convert non-JDB scaffolding
    serviceability shell script tests to java
    + JDK-8204963: javax.swing.border.TitledBorder has a memory leak
    + JDK-8204994: SA might fail to attach to process with "Windbg
    Error: WaitForEvent failed"
    + JDK-8205534: Remove SymbolTable dependency from
    serviceability agent
    + JDK-8206309: Tier1 SA tests fail
    + JDK-8208281: java/nio/channels/
    /AsynchronousSocketChannel/Basic.java timed out
    + JDK-8209109: [TEST] rewrite com/sun/jdi shell tests to java
    version - step1
    + JDK-8209332: [TEST] test/jdk/com/sun/jdi/CatchPatternTest.sh
    is incorrect
    + JDK-8209342: Problemlist SA tests on Solaris due to Error
    attaching to process: Can't create thread_db agent!
    + JDK-8209343: Test javax/swing/border/TestTitledBorderLeak.java
    should be marked as headful
    + JDK-8209517: com/sun/jdi/BreakpointWithFullGC.java fails with
    timeout
    + JDK-8209604: [TEST] rewrite com/sun/jdi shell tests to java
    version - step2
    + JDK-8209605: com/sun/jdi/BreakpointWithFullGC.java fails with
    ZGC
    + JDK-8209608: Problem list com/sun/jdi/BreakpointWithFullGC.java
    + JDK-8210131: vmTestbase/nsk/jvmti/scenarios/allocation/AP10/
    /ap10t001/TestDescription.java failed with ObjectFree:
    GetCurrentThreadCpuTimerInfo returned unexpected error code
    + JDK-8210243: [TEST] rewrite com/sun/jdi shell tests to java
    version - step3
    + JDK-8210527: JShell: NullPointerException in
    jdk.jshell.Eval.translateExceptionStack
    + JDK-8210560: [TEST] convert com/sun/jdi redefineClass-related
    tests
    + JDK-8210725: com/sun/jdi/RedefineClearBreakpoint.java fails
    with waitForPrompt timed out after 60 seconds
    + JDK-8210748: [TESTBUG] lib.jdb.Jdb.waitForPrompt() should
    clarify which output is the pending reply after a timeout
    + JDK-8210760: [TEST] rewrite com/sun/jdi shell tests to java
    version - step4
    + JDK-8210977: jdk/jfr/event/oldobject/TestThreadLocalLeak.java
    fails to find ThreadLocalObject
    + JDK-8211292: [TEST] convert com/sun/jdi/DeferredStepTest.sh
    test
    + JDK-8211694: JShell: Redeclared variable should be reset
    + JDK-8212200: assert when shared java.lang.Object is redefined
    by JVMTI agent
    + JDK-8212629: [TEST] wrong breakpoint in
    test/jdk/com/sun/jdi/DeferredStepTest
    + JDK-8212665: com/sun/jdi/DeferredStepTest.java: jj1 (line 57)
  - unexpected. lastLine=52, minLine=52, maxLine=55
    + JDK-8212807: tools/jar/multiRelease/Basic.java times out
    + JDK-8213182: Minimal VM build failure after JDK-8212200
    (assert when shared java.lang.Object is redefined by JVMTI
    agent)
    + JDK-8213214: Set -Djava.io.tmpdir= when running tests
    + JDK-8213275: ReplaceCriticalClasses.java fails with
    jdk.internal.vm.PostVMInitHook not found
    + JDK-8213574: Deadlock in string table expansion when dumping
    lots of CDS classes
    + JDK-8213703: LambdaConversionException: Invalid receiver type
    not a subtype of implementation type interface
    + JDK-8214074: Ghash optimization using AVX instructions
    + JDK-8214491: Upgrade to JLine 3.9.0
    + JDK-8214797: TestJmapCoreMetaspace.java timed out
    + JDK-8215243: JShell tests failing intermitently with
    "Problem cleaning up the following threads:"
    + JDK-8215244: jdk/jshell/ToolBasicTest.java
    testHistoryReference failed
    + JDK-8215354: x86_32 build failures after JDK-8214074 (Ghash
    optimization using AVX instructions)
    + JDK-8215438: jshell tool: Ctrl-D causes EOF
    + JDK-8216021: RunTest.gmk might set concurrency level to 1 on
    Windows
    + JDK-8216974: HttpConnection not returned to the pool after
    204 response
    + JDK-8218948: SimpleDateFormat :: format - Zone Names are not
    reflected correctly during run time
    + JDK-8219712: code_size2 (defined in stub_routines_x86.hpp) is
    too small on new Skylake CPUs
    + JDK-8220150: macos10.14 Mojave returns anti-aliased glyphs
    instead of aliased B&amp;W glyphs
    + JDK-8221658: aarch64: add necessary predicate for ubfx
    patterns
    + JDK-8221759: Crash when completing "java.io.File.path"
    + JDK-8221918: runtime/SharedArchiveFile/serviceability/
    /ReplaceCriticalClasses.java fails: Shared archive not found
    + JDK-8222074: Enhance auto vectorization for x86
    + JDK-8222079: Don't use memset to initialize fields decode_env
    constructor in disassembler.cpp
    + JDK-8222769: [TESTBUG] TestJFRNetworkEvents should not rely
    on hostname command
    + JDK-8223688: JShell: crash on the instantiation of raw
    anonymous class
    + JDK-8223777: In posix_spawn mode, failing to exec()
    jspawnhelper does not result in an error
    + JDK-8223940: Private key not supported by chosen signature
    algorithm
    + JDK-8224184: jshell got IOException at exiting with AIX
    + JDK-8224234: compiler/codegen/TestCharVect2.java fails in
    test_mulc
    + JDK-8225037: java.net.JarURLConnection::getJarEntry() throws
    NullPointerException
    + JDK-8225625: AES Electronic Codebook (ECB) encryption and
    decryption optimization using AVX512 + VAES instructions
    + JDK-8226536: Catch OOM from deopt that fails rematerializing
    objects
    + JDK-8226575: OperatingSystemMXBean should be made container
    aware
    + JDK-8226697: Several tests which need the @key headful
    keyword are missing it.
    + JDK-8226809: Circular reference in printed stack trace is not
    correctly indented &amp; ambiguous
    + JDK-8227059: sun/security/tools/keytool/
    /DefaultSignatureAlgorithm.java timed out
    + JDK-8227269: Slow class loading when running with JDWP
    + JDK-8227595: keytool/fakegen/DefaultSignatureAlgorithm.java
    fails due to "exitValue = 6"
    + JDK-8228448: Jconsole can't connect to itself
    + JDK-8228967: Trust/Key store and SSL context utilities for
    tests
    + JDK-8229378: jdwp library loader in linker_md.c quietly
    truncates on buffer overflow
    + JDK-8229815: Upgrade Jline to 3.12.1
    + JDK-8230000: some httpclients testng tests run zero test
    + JDK-8230002: javax/xml/jaxp/unittest/transform/
    /SecureProcessingTest.java runs zero test
    + JDK-8230010: Remove jdk8037819/BasicTest1.java
    + JDK-8230094: CCE in createXMLEventWriter(Result) over an
    arbitrary XMLStreamWriter
    + JDK-8230402: Allocation of compile task fails with assert:
    "Leaking compilation tasks?"
    + JDK-8230767: FlightRecorderListener returns null recording
    + JDK-8230870: (zipfs) Add a ZIP FS test that is similar to
    test/jdk/java/util/zip/EntryCount64k.java
    + JDK-8231209: [REDO] ThreadMXBean::getThreadAllocatedBytes()
    can be quicker for self thread
    + JDK-8231586: enlarge encoding space for OopMapValue offsets
    + JDK-8231953: Wrong assumption in assertion in
    oop::register_oop
    + JDK-8231968: getCurrentThreadAllocatedBytes default
    implementation s/b getThreadAllocatedBytes
    + JDK-8232083: Minimal VM is broken after JDK-8231586
    + JDK-8232161: Align some one-way conversion in MS950 charset
    with Windows
    + JDK-8232855: jshell missing word in /help help
    + JDK-8233027: OopMapSet::all_do does oms.next() twice during
    iteration
    + JDK-8233228: Disable weak named curves by default in TLS,
    CertPath, and Signed JAR
    + JDK-8233386: Initialize NULL fields for unused decorations
    + JDK-8233452: java.math.BigDecimal.sqrt() with
    RoundingMode.FLOOR results in incorrect result
    + JDK-8233686: XML transformer uses excessive amount of memory
    + JDK-8233741: AES Countermode (AES-CTR) optimization using
    AVX512 + VAES instructions
    + JDK-8233829: javac cannot find non-ASCII module name under
    non-UTF8 environment
    + JDK-8233958: Memory retention due to HttpsURLConnection
    finalizer that serves no purpose
    + JDK-8234011: (zipfs) Memory leak in
    ZipFileSystem.releaseDeflater()
    + JDK-8234058: runtime/CompressedOops/
    /CompressedClassPointers.java fails with 'Narrow klass base:
    0x0000000000000000' missing from stdout/stderr
    + JDK-8234149: Several regression tests do not dispose Frame at
    end
    + JDK-8234347: "Turkey" meta time zone does not generate
    composed localized names
    + JDK-8234385: [TESTBUG] java/awt/EventQueue/6980209/
    /bug6980209.java fails in linux nightly
    + JDK-8234535: Cross compilation fails due to missing CFLAGS
    for the BUILD_CC
    + JDK-8234541: C1 emits an empty message when it inlines
    successfully
    + JDK-8234687: change javap reporting on unknown attributes
    + JDK-8236464: SO_LINGER option is ignored by SSLSocket in JDK
    11
    + JDK-8236548: Localized time zone name inconsistency between
    English and other locales
    + JDK-8236617: jtreg test containers/docker/
    /TestMemoryAwareness.java fails after 8226575
    + JDK-8237182: Update copyright header for shenandoah and
    epsilon files
    + JDK-8237888: security/infra/java/security/cert/
    /CertPathValidator/certification/LuxTrustCA.java fails when
    checking validity interval
    + JDK-8237977: Further update
    javax/net/ssl/compatibility/Compatibility.java
    + JDK-8238270: java.net HTTP/2 client does not decrease stream
    count when receives 204 response
    + JDK-8238284: [macos] Zero VM build fails due to an obvious
    typo
    + JDK-8238380: java.base/unix/native/libjava/childproc.c
    "multiple definition" link errors with GCC10
    + JDK-8238386: (sctp) jdk.sctp/unix/native/libsctp/SctpNet.c
    "multiple definition" link errors with GCC10
    + JDK-8238388: libj2gss/NativeFunc.o "multiple definition" link
    errors with GCC10
    + JDK-8238448: RSASSA-PSS signature verification fail when
    using certain odd key sizes
    + JDK-8238710: LingeredApp doesn't log stdout/stderr if exits
    with non-zero code
    + JDK-8239083: C1 assert(known_holder == NULL ||
    (known_holder-&gt;is_instance_klass() &amp;&amp;
    (!known_holder-&gt;is_interface() ||
    ((ciInstanceKlass*)known_holder)-&gt;has_nonstatic_concrete_methods())),
    "should be non-static concrete method");
    + JDK-8239385: KerberosTicket client name refers wrongly to
    sAMAccountName in AD
    + JDK-8240169: javadoc fails to link to non-modular api docs
    + JDK-8240295: hs_err elapsed time in seconds is not accurate
    enough
    + JDK-8240360: NativeLibraryEvent has wrong library name on
    Linux
    + JDK-8240676: Meet not symmetric failure when running lucene
    on jdk8
    + JDK-8241007: Shenandoah: remove
    ShenandoahCriticalControlThreadPriority support
    + JDK-8241065: Shenandoah: remove leftover code after
    JDK-8231086
    + JDK-8241086: Test runtime/NMT/HugeArenaTracking.java is
    failing on 32bit Windows
    + JDK-8241130: com.sun.jndi.ldap.EventSupport.removeDeadNotifier:
    java.lang.NullPointerException
    + JDK-8241138: http.nonProxyHosts=* causes
    StringIndexOutOfBoundsException in DefaultProxySelector
    + JDK-8241319: WB_GetCodeBlob doesn't have ResourceMark
    + JDK-8241478: vmTestbase/gc/gctests/Steal/steal001/steal001.java
    fails with OOME
    + JDK-8241574: Shenandoah: remove ShenandoahAssertToSpaceClosure
    + JDK-8241750: x86_32 build failure after JDK-8227269
    + JDK-8242184: CRL generation error with RSASSA-PSS
    + JDK-8242283: Can't start JVM when java home path includes
    non-ASCII character
    + JDK-8242556: Cannot load RSASSA-PSS public key with non-null
    params from byte array
    + JDK-8243029: Rewrite javax/net/ssl/compatibility/
    /Compatibility.java with a flexible interop test framework
    + JDK-8243138: Enhance BaseLdapServer to support starttls
    extended request
    + JDK-8243320: Add SSL root certificates to Oracle Root CA
    program
    + JDK-8243321: Add Entrust root CA - G4 to Oracle Root CA
    program
    + JDK-8243389: enhance os::pd_print_cpu_info on linux
    + JDK-8243453: java --describe-module failed with non-ASCII
    module name under non-UTF8 environment
    + JDK-8243470: [macos] bring back O2 opt level for unsafe.cpp
    + JDK-8243489: Thread CPU Load event may contain wrong data for
    CPU time under certain conditions
    + JDK-8243925: Toolkit#getScreenInsets() returns wrong value on
    HiDPI screens (Windows)
    + JDK-8244087: 2020-04-24 public suffix list update
    + JDK-8244151: Update MUSCLE PC/SC-Lite headers to the latest
    release 1.8.26
    + JDK-8244164: AArch64: jaotc generates incorrect code for
    compressed OOPs with non-zero heap base
    + JDK-8244196: adjust output in os_linux
    + JDK-8244225: stringop-overflow warning on strncpy call from
    compile_the_world_in
    + JDK-8244287: JFR: Methods samples have line number 0
    + JDK-8244703: "platform encoding not initialized" exceptions
    with debugger, JNI
    + JDK-8244719: CTW: C2 compilation fails with
    "assert(!VerifyHashTableKeys || _hash_lock == 0) failed:
    remove node from hash table before modifying it"
    + JDK-8244729: Shenandoah: remove resolve paths from
    SBSA::generate_shenandoah_lrb
    + JDK-8244763: Update --release 8 symbol information after JSR
    337 MR3
    + JDK-8244818: Java2D Queue Flusher crash while moving
    application window to external monitor
    + JDK-8245151: jarsigner should not raise duplicate warnings on
    verification
    + JDK-8245616: Bump update version for OpenJDK: jdk-11.0.9
    + JDK-8245714: "Bad graph detected in build_loop_late" when
    loads are pinned on loop limit check uncommon branch
    + JDK-8245801: StressRecompilation triggers assert "redundunt
    OSR recompilation detected. memory leak in CodeCache!"
    + JDK-8245832: JDK build make-static-libs should build all JDK
    libraries
    + JDK-8245880: Shenandoah: check class unloading flag early in
    concurrent code root scan
    + JDK-8245981: Upgrade to jQuery 3.5.1
    + JDK-8246027: Minimal fastdebug build broken after JDK-8245801
    + JDK-8246094: [macos] Sound Recording and playback is not
    working
    + JDK-8246153: TestEliminateArrayCopy fails with
  - XX:+StressReflectiveCode
    + JDK-8246193: Possible NPE in ENC-PA-REP search in AS-REQ
    + JDK-8246196: javax/management/MBeanServer/OldMBeanServerTest
    fails with AssertionError
    + JDK-8246203: Segmentation fault in verification due to stack
    overflow with -XX:+VerifyIterativeGVN
    + JDK-8246330: Add TLS Tests for Legacy ECDSA curves
    + JDK-8246453: TestClone crashes with "all collected exceptions
    must come from the same place"
    + JDK-8247246: Add explicit ResolvedJavaType.link and expose
    presence of default methods
    + JDK-8247350: [aarch64] assert(false) failed: wrong size of
    mach node
    + JDK-8247502: PhaseStringOpts crashes while optimising
    effectively dead code
    + JDK-8247615: Initialize the bytes left for the heap sampler
    + JDK-8247824: CTW: C2 (Shenandoah) compilation fails with SEGV
    in SBC2Support::pin_and_expand
    + JDK-8247874: Replacement in VersionProps.java.template not
    working when --with-vendor-bug-url contains '&amp;'
    + JDK-8247979: aarch64: missing side effect of killing flags
    for clearArray_reg_reg
    + JDK-8248214: Add paddings for TaskQueueSuper to reduce
    false-sharing cache contention
    + JDK-8248219: aarch64: missing memory barrier in
    fast_storefield and fast_accessfield
    + JDK-8248348: Regression caused by the update to BCEL 6.0
    + JDK-8248385: [testbug][11u] Adapt TestInitiExceptions to
    jtreg 5.1
    + JDK-8248495: [macos] zerovm is broken due to libffi headers
    location
    + JDK-8248851: CMS: Missing memory fences between free chunk
    check and klass read
    + JDK-8248987: AOT's Linker.java seems to eagerly fail-fast on
    Windows
    + JDK-8249159: Downport test rework for SSLSocketTemplate from
    8224650
    + JDK-8249215: JFrame::setVisible crashed with
  - Dfile.encoding=UTF-8 on Japanese Windows.
    + JDK-8249251: [dark_mode ubuntu 20.04] The selected menu is
    not highlighted in GTKLookAndFeel
    + JDK-8249255: Build fails if source code in cygwin home dir
    + JDK-8249277: TestVerifyIterativeGVN.java is failing with
    timeout in OpenJDK 11
    + JDK-8249278: Revert JDK-8226253 which breaks the spec of
    AccessibleState.SHOWING for JList
    + JDK-8249560: Shenandoah: Fix racy GC request handling
    + JDK-8249801: Shenandoah: Clear soft-refs on requested GC cycle
    + JDK-8249953: Shenandoah: gc/shenandoah/mxbeans tests should
    account for corner cases
    + JDK-8250582: Revert Principal Name type to NT-UNKNOWN when
    requesting TGS Kerberos tickets
    + JDK-8250609: C2 crash in IfNode::fold_compares
    + JDK-8250627: Use -XX:+/-UseContainerSupport for
    enabling/disabling Java container metrics
    + JDK-8250755: Better cleanup for
    jdk/test/javax/imageio/plugins/shared/CanWriteSequence.java
    + JDK-8250787: Provider.put no longer registering aliases in
    FIPS env
    + JDK-8250826: jhsdb does not work with coredump which comes
    from Substrate VM
    + JDK-8250827: Shenandoah: needs to reset/finish StringTable's
    dead count before/after parallel walk
    + JDK-8250844: Make sure {type,obj}ArrayOopDesc accessors check
    the bounds
    + JDK-8251117: Cannot check P11Key size in P11Cipher and
    P11AEADCipher
    + JDK-8251354: Shenandoah: Fix jdk/jfr/tool/TestPrintJSON.java
    test failure
    + JDK-8251451: Shenandoah: Remark ObjectSynchronizer roots with
    I-U
    + JDK-8251469: Better cleanup for
    test/jdk/javax/imageio/SetOutput.java
    + JDK-8251487: Shenandoah: missing detail timing tracking for
    final mark cleaning phase
    + JDK-8252120: compiler/oracle/TestCompileCommand.java
    misspells "occured"
    + JDK-8252157: JDK-8231209 11u backport breaks jmm binary
    compatibility
    + JDK-8252258: [11u] JDK-8242154 changes the default vendor
    + JDK-8252804: [test] Fix 'ReleaseDeflater.java' test after
    downport of 8234011
    + JDK-8253134: JMM_VERSION should remain at 0x20020000 (JDK 10)
    in JDK 11
    + JDK-8253283: [11u] Test build/translations/
    /VerifyTranslations.java failing after JDK-8252258
    + JDK-8253813: Backout JDK-8244287 from 11u: it causes several
    crashes
- Removed patch:
  * gcc-fno-common-fix.patch
    + not needed any more with this version
- Added patch:
  * JDK-8250861.patch
    + Fix regression "8250861: Crash in MinINode::Ideal(PhaseGVN*,
    bool)" introduced in jdk 11.0.9</changelog>
  <changelog author="fstrba@suse.com" date="1604491200">- Enable Sheandoah GC for x86_64 (jsc#ECO-3171)</changelog>
  <changelog author="fstrba@suse.com" date="1605528000">- Update to upstream tag jdk-11.0.9.1-1
  * Fix:
    + JDK-8250861: Crash in MinINode::Ideal(PhaseGVN*, bool)
- Removed patch:
  * JDK-8250861.patch
    + Integrated upstream</changelog>
  <changelog author="fstrba@suse.com" date="1611230400">- Update to upstream tag jdk-11.0.10+9 (January 2021 CPU,
  bsc#1181239)
  * Security fixes
    + JDK-8247619: Improve Direct Buffering of Characters
  * Other changes
    + JDK-6722928: Support SSPI as a native GSS-API provider
    + JDK-7185258: [macosx] Deadlock in SunToolKit.realSync()
    + JDK-8152332: [macosx] JFileChooser cannot be serialized on
    Mac OS X
    + JDK-8161684: [testconf] Add VerifyOops' testing into compiler
    tiers
    + JDK-8171279: Support X25519 and X448 in TLS
    + JDK-8173361: various crashes in
    JvmtiExport::post_compiled_method_load
    + JDK-8173658: JvmtiExport::post_class_unload() is broken for
    non-JavaThread initiators
    + JDK-8191006: hsdis disassembler plugin does not compile with
    binutils 2.29+
    + JDK-8197981: Missing return statement in
    __sync_val_compare_and_swap_8
    + JDK-8198334: java/awt/FileDialog/8003399/bug8003399.java
    fails in headless mode
    + JDK-8200151: Add 8 JNDI tests to com/sun/jndi/dns/ConfigTests/
    + JDK-8208279: Add 8 JNDI tests to com/sun/jndi/dns/EnvTests/
    + JDK-8208483: Add 5 JNDI tests to
    com/sun/jndi/dns/FactoryTests/
    + JDK-8208542: Add 4 JNDI tests to com/sun/jndi/dns/ListTests/
    + JDK-8208665: Amend cross-compilation docs with
    qemu-debootstrap recipe
    + JDK-8210088: ProblemList gc/epsilon/TestMemoryMXBeans.java
    + JDK-8210339: Add 10 JNDI tests to com/sun/jndi/dns/FedTests/
    + JDK-8211450: UndetVar::dup is not copying the kind field to
    the duplicated instance
    + JDK-8212160: JVMTI agent crashes with "assert(_value != 0LL)
    failed: resolving NULL _value"
    + JDK-8212226: SurfaceManager throws "Invalid Image variant"
    for MultiResolutionImage (Windows)
    + JDK-8213400: Support choosing group name in keytool keypair
    generation
    + JDK-8213535: Windows HiDPI html lightweight tooltips are
    truncated
    + JDK-8213698: Improve devkit creation and add support for
    linux/ppc64/ppc64le/s390x
    + JDK-8214025: assert(t-&gt;singleton()) failed: must be a
    constant when ScavengeRootsInCode &lt; 2
    + JDK-8214242: compiler/arguments/TestScavengeRootsInCode.java
    fails because of missing UnlockDiagnosticVMOptions
    + JDK-8214787: Zero builds fail with "undefined
    JavaThread::thread_state()"
    + JDK-8215583: Exclude
    runtime/handshake/HandshakeWalkSuspendExitTest.java
    + JDK-8216012: Infinite loop in RSA KeyPairGenerator
    + JDK-8216324: GetClassMethods is confused by the presence of
    default methods in super interfaces
    + JDK-8217429: WebSocket over authenticating proxy fails to
    send Upgrade headers
    + JDK-8217976: test/jdk/java/net/httpclient/websocket/
    /WebSocketProxyTest.java fails intermittently
    + JDK-8218021: Have jarsigner preserve posix permission
    attributes
    + JDK-8218287: jshell tool: input behavior unstable after
    12-ea+24 on Windows
    + JDK-8218851: JVM crash in custom classloader stress test, JDK
    12 &amp; 13
    + JDK-8220420: Cleanup c1_LinearScan
    + JDK-8222072: JVMTI GenerateEvents() sends CompiledMethodLoad
    events to wrong jvmtiEnv
    + JDK-8222286: Fix for JDK-8213419 is broken on s390
    + JDK-8222527: HttpClient doesn't send HOST header when
    tunelling HTTP/1.1 through http proxy
    + JDK-8222533: jtreg test jdk/internal/platform/cgroup/
    /TestCgroupMetrics.java fails on SLES12.3 linux ppc64le
    machine
    + JDK-8224506: [TESTBUG] TestDockerMemoryMetrics.java fails
    with exitValue = 137
    + JDK-8224555: vmTestbase/nsk/jvmti/scenarios/contention/TC02/
    /tc02t001/TestDescription.java failed
    + JDK-8224650: Add tests to support X25519 and X448 in TLS
    + JDK-8225072: Add LuxTrust certificate that is expiring in
    March 2021 to list of allowed but expired certs
    + JDK-8225329: -XX:+PrintBiasedLockingStatistics causes crash
    during initialization on Windows platforms
    + JDK-8225687: Newly added sspi.cpp in JDK-6722928 still
    contains some small errors
    + JDK-8227006: [linux] Runtime.availableProcessors execution
    time increased by factor of 100
    + JDK-8227275: Within native OOM error handling, assertions may
    hang the process
    + JDK-8227647: [Graal] Test8009761.java fails due to
    "RuntimeException: static java.lang.Object
    compiler.uncommontrap.Test8009761.m3(boolean,boolean) not
    compiled"
    + JDK-8229495: SIGILL in C2 generated OSR compilation
    + JDK-8230910: libsspi_bridge does not build on Windows 32bit
    + JDK-8232114: JVM crashed at imjpapi.dll in native code
    + JDK-8234147: Avoid looking up standard charsets in core
    libraries
    + JDK-8234393: [macos] printing ignores printer tray
    + JDK-8234863: Increase default value of MaxInlineLevel
    + JDK-8235218: Minimal VM is broken after JDK-8173361
    + JDK-8235456: Minimal VM is broken after JDK-8212160
    + JDK-8235829: graal crashes with Zombie.java test
    + JDK-8236124: Minimal VM slowdebug build failed after
    JDK-8212160
    + JDK-8236512: PKCS11 Connection closed after Cipher.doFinal
    and NoPadding
    + JDK-8236944: The legVecZ operand should be limited to
    zmm0-zmm15 registers
    + JDK-8237186: Fix typo in copyright header of
    java/io/Reader/TransferTo.java
    + JDK-8237499: JFR: Include stack trace in the ThreadStart event
    + JDK-8237512: AArch64: aarch64TestHook leaks a BufferBlob
    + JDK-8237524: AArch64: String.compareTo() may return incorrect
    result
    + JDK-8237950: C2 compilation fails with "Live Node limit
    exceeded limit" during ConvI2L::Ideal optimization
    + JDK-8238579: HttpsURLConnection drops the timeout and hangs
    forever in read
    + JDK-8239105: Add exception for expiring Digicert root
    certificates to VerifyCACerts test
    + JDK-8239477: jdk/jfr/jcmd/TestJcmdStartStopDefault.java fails
  - XX:+VerifyOops with "verify_oop: rsi: broken oop"
    + JDK-8239497: SEGV in EdgeUtils::field_name_symbol(Edge const&amp;)
    + JDK-8239886: Minimal VM build fails after JDK-8237499
    + JDK-8240633: Memory leaks in the implementations of
    FileChooserUI
    + JDK-8240690: Race condition between EDT and
    BasicDirectoryModel.FilesLoader.run0()
    + JDK-8241234: Unify monitor enter/exit runtime entries.
    + JDK-8241311: Move some charset mapping tests from closed to
    open
    + JDK-8241797: Add some tests to the problem list
    + JDK-8242029: AArch64: skip G1 array copy pre-barrier if
    marking not active
    + JDK-8242335: Additional Tests for RSASSA-PSS
    + JDK-8242480: Negative value may be returned by
    getFreeSwapSpaceSize() in the docker
    + JDK-8242614: cleanup duplicated test ldap server in some
    com/sun/jndi/ldap/ tests
    + JDK-8242846: Bring back test/jdk/tools/jlink/plugins/
    /OrderResourcesPluginTest.java
    + JDK-8243114: Implement montgomery{Multiply,Square}intrinsics
    on Windows
    + JDK-8243290: Improve diagnostic messages for class
    verification and redefinition failures
    + JDK-8243488: Add tests for set/get SendBufferSize and
    getReceiveBufferSize in DatagramSocket
    + JDK-8243549: sun/security/ssl/CipherSuite/
    /NamedGroupsWithCipherSuite.java failed with Unsupported
    signature algorithm: DSA
    + JDK-8243617: compiler/onSpinWait/TestOnSpinWaitC1.java test
    uses wrong class
    + JDK-8243619: compiler/codecache/CheckSegmentedCodeCache.java
    test misses -version
    + JDK-8244142: some hotspot/runtime tests don't check exit code
    of forked JVM
    + JDK-8244278: Excessive code cache flushes and sweeps
    + JDK-8244282: test/hotspot/jtreg/compiler/intrinsics/
    /Test8237524.java fails with --illegal-access=deny
    + JDK-8244621: [macos10.15] Garbled FX printing plus CoreText
    warnings on Catalina when building with Xcode 11
    + JDK-8244819: hsdis does not compile with binutils 2.34+
    + JDK-8245051: c1 is broken if it is compiled by gcc without
  - fno-lifetime-dse
    + JDK-8245168: jlink should not be treated as a "small" tool
    + JDK-8245400: Upgrade to LittleCMS 2.11
    + JDK-8246381: VM crashes with "Current BasicObjectLock* below
    than low_mark"
    + JDK-8246434: Threads::print_on_error assumes that the heap
    has been set up
    + JDK-8246648: issue with OperatingSystemImpl
    getFreeSwapSpaceSize in docker after 8242480
    + JDK-8247201: Print potential pointer value of readable stack
    memory in hs_err file
    + JDK-8247763: assert(outer-&gt;outcnt() == 2) failed: 'only phis'
    failure in LoopNode::verify_strip_mined()
    + JDK-8247867: Upgrade to freetype 2.10.2
    + JDK-8248190: Enable Power10 system and implement new
    byte-reverse instructions
    + JDK-8248226: TestCloneAccessStressGCM fails with
  - XX:-ReduceBulkZeroing
    + JDK-8248347: windows build broken by JDK-8243114
    + JDK-8248532: Every time I change keyboard language at my
    MacBook, Java crashes
    + JDK-8248552: C2 crashes with SIGFPE due to division by zero
    + JDK-8248596: [TESTBUG] compiler/loopopts/
    /PartialPeelingUnswitch.java times out with Graal enabled
    + JDK-8248745: Add jarsigner and keytool tests for restricted
    algorithms
    + JDK-8248791: sun/util/resources/cldr/TimeZoneNamesTest.java
    fails with -XX:-ReduceInitialCardMarks -XX:-ReduceBulkZeroing
    + JDK-8248845: AArch64: stack corruption after spilling vector
    register
    + JDK-8249176: Update GlobalSignR6CA test certificates
    + JDK-8249183: JVM crash in "AwtFrame::WmSize" method
    + JDK-8249192: MonitorInfo stores raw oops across safepoints
    + JDK-8249602: C2: assert(cnt == _outcnt) failed: no insertions
    allowed
    + JDK-8249603: C1: assert(has_error == false) failed: register
    allocation invalid
    + JDK-8249605: C2: assert(no_dead_loop) failed: dead loop
    detected
    + JDK-8249607: C2: assert(!had_error) failed: bad dominance
    + JDK-8249608: Vector register used by C2 compiled method
    corrupted at safepoint
    + JDK-8249672: Include microcode revision in features_string on
    x86
    + JDK-8249748: gtest silently ignores bad jvm arguments
    + JDK-8249821: Separate libharfbuzz from libfontmanager
    + JDK-8250598: Hyper-V is detected in spite of running on host
    OS
    + JDK-8250605: Linux x86_32 builds fail after JDK-8249821
    + JDK-8250636: iso8601_time returns incorrect offset part on
    MacOS
    + JDK-8250665: Wrong translation for the month name of May in
    ar_JO,LB,SY
    + JDK-8250772: Test com/sun/jndi/ldap/
    /NamingExceptionMessageTest.java fails intermittently with
    javax.naming.ServiceUnavailableException
    + JDK-8250825: C2 crashes with assert(field != __null) failed:
    missing field
    + JDK-8250894: Provide a configure option to build and run
    against the platform libharfbuzz
    + JDK-8250928: JFR: Improve hash algorithm for stack traces
    + JDK-8250968: Symlinks attributes not preserved when using
    jarsigner on zip files
    + JDK-8250984: Memory Docker tests fail on some Linux kernels
    w/o cgroupv1 swap limit capabilities
    + JDK-8251118: BiasedLocking::preserve_marks should not have a
    HandleMark
    + JDK-8251189: com/sun/jndi/ldap/LdapDnsProviderTest.java
    failed due to timeout
    + JDK-8251257: NMT: jcmd VM.native_memory scale=1 crashes
    target VM
    + JDK-8251365: Build failure on AIX after 8250636
    + JDK-8251397: NPE on ClassValue.ClassValueMap.cacheArray
    + JDK-8251456: [TESTBUG] compiler/vectorization/
    /TestVectorsNotSavedAtSafepoint.java failed OutOfMemoryError
    + JDK-8251458: Parse::do_lookupswitch fails with "assert(_cnt
    &gt;= 0) failed"
    + JDK-8251535: Partial peeling at unsigned test adds incorrect
    loop exit check
    + JDK-8251949: ZGC: Set explicit heap size for
    compiler/gcbarriers tests
    + JDK-8252090: JFR: StreamWriterHost::write_unbuffered() stucks
    in an infinite loop OpenJDK (build 13.0.1+9)
    + JDK-8252415: Bump update version for OpenJDK: jdk-11.0.10
    + JDK-8252470: java/awt/dnd/DisposeFrameOnDragCrash/
    /DisposeFrameOnDragTest.java fails on Windows
    + JDK-8252497: Incorrect numeric currency code for ROL
    + JDK-8252660: Shenandoah: support manageable SoftMaxHeapSize
    option
    + JDK-8252679: Two windows specific FileDIalog tests may fail
    on some Windows_Server_2016_Standard
    + JDK-8252696: Loop unswitching may cause out of bound array
    load to be executed
    + JDK-8252754: Hash code calculation of JfrStackTrace is
    inconsistent
    + JDK-8253219: Epsilon: clean up unnecessary includes
    + JDK-8253224: Shenandoah: ShenandoahStrDedupQueue destructor
    calls virtual num_queues()
    + JDK-8253226: Shenandoah: remove unimplemented
    ShenandoahStrDedupQueue::verify
    + JDK-8253269: The CheckCommonColors test should provide more
    info on failure
    + JDK-8253284: Zero OrderAccess barrier mappings are incorrect
    + JDK-8253375: OSX build fails with Xcode 12.0 (12A7209)
    + JDK-8253778: ShenandoahSafepoint::is_at_shenandoah_safepoint
    should not access VMThread state from other threads
    + JDK-8253791: Issue with useAppleColor check in CSystemColors.m
    + JDK-8254016: Test8237524 fails with -XX:-CompactStrings option
    + JDK-8254081: java/security/cert/PolicyNode/
    /GetPolicyQualifiers.java fails due to an expired certificate
    + JDK-8254144: Non-x86 Zero builds fail with return-type
    warning in os_linux_zero.cpp
    + JDK-8254166: Zero: return-type warning in
    zeroInterpreter_zero.cpp
    + JDK-8254177: (tz) Upgrade time-zone data to tzdata2020b
    + JDK-8254185: Fix Code cache sweeper heuristics for JDK 11
    + JDK-8254190: [s390] interpreter misses exception check after
    calling monitorenter
    + JDK-8254790: SIGSEGV in string_indexof_char and
    stringL_indexof_char intrinsics
    + JDK-8254854: [cgroups v1] Metric limits not properly detected
    on some join controller combinations
    + JDK-8254982: (tz) Upgrade time-zone data to tzdata2020c
    + JDK-8255050: Add pkcs11/KeyStore/ClientAuth.sh to Problem list
    + JDK-8255065: Zero: accessor_entry misses the IRIW case
    + JDK-8255226: (tz) Upgrade time-zone data to tzdata2020d
    + JDK-8255269: Unsigned overflow in g1Policy.cpp
    + JDK-8255365: Problem list failing client manual tests
    + JDK-8255457: Shenandoah: cleanup ShenandoahMarkTask
    + JDK-8255466: C2 crashes at ciObject::get_oop() const+0x0
    + JDK-8255550: x86: Assembler::cmpq(Address dst, Register src)
    encoding is incorrect
    + JDK-8255603: Memory/Performance regression after JDK-8210985
    + JDK-8255760: Shenandoah: match constants style in
    ShenandoahMarkTask fallback
    + JDK-8255781: Bump patch update version for OpenJDK:
    jdk-11.0.9.1
    + JDK-8255937: Better cleanup for
    test/jdk/javax/imageio/stream/StreamFlush.java
    + JDK-8256427: Test com/sun/jndi/dns/ConfigTests/
    /PortUnreachable.java does not work on AIX
    + JDK-8256452: Integrate missing part of JDK-8232370 to 11u
    + JDK-8256483: [TESTBUG] serviceability/jvmti/GetClassMethods/
    /libOverpassMethods.c fails to compile on gcc 4.4.x
    + JDK-8256557: libharfbuzz fails to link on gcc 4.4.x due to
  - Wl,-z,defs
    + JDK-8256618: Zero: Linux x86_32 build still fails
    + JDK-8256736: Zero: GTest tests fail with "unsuppported vm
    variant"
    + JDK-8256809: Annotation processing causes NPE during flow
    analysis
    + JDK-8257181: s390x builds are very noisy with gc-sections
    messages
    + JDK-8257242: [macOS] Java app crashes while switching input
    methods
    + JDK-8257545: SunJSSE FIPS regression in key exchange after
    JDK-8171279 11u backport
    + JDK-8257641: Shenandoah: Query is_at_shenandoah_safepoint()
    from control thread should return false
    + JDK-8257701: Shenandoah: objArrayKlass metadata is not marked
    with chunked arrays
    + JDK-8258630: Add expiry exception for QuoVadis root
    certificate
- New upstream dependency on libharfbuzz
- Regenerated patches: missing-return.patch system-pcsclite.patch</changelog>
  <changelog author="fstrba@suse.com" date="1616155200">- Added patches:
  * system-crypto-policy.patch
    + Let OpenJDK use system crypto policies unless explicitely told
    not to
  * nss-security-provider.patch
    + Add the NSS security provider with configuration in generated
    nss.cfg file
  * keytool-default-rsa.patch
    + Make keytool generate RSA keys by default, since only the
    LEGACY system crypto policy allows DSA</changelog>
  <changelog author="pujos.michael@gmail.com" date="1618488000">- moved mozilla-nss dependency to java-11-openjdk-headless package
  This is necessary to be able to do crypto with just
  java-11-openjdk-headless installed. Fixes boo#1184606</changelog>
  <changelog author="fstrba@suse.com" date="1619006400">- Update to upstream tag jdk-11.0.11+9 (April 2021, CPU)
  * Security fixes
    + JDK-8244473: Contextualize registration for JNDI
    + JDK-8244543: Enhanced handling of abstract classes
    + JDK-8249906, CVE-2021-2163, bsc#1185055: Enhance opening JARs
    + JDK-8250568, CVE-2021-2161, bsc#1185056: Less ambiguous
    processing
    + JDK-8253799: Make lists of normal filenames
    + JDK-8257001: Improve Http Client Support
  * Other changes
    + JDK-7107012: sun.jvm.hotspot.code.CompressedReadStream
    readDouble() conversion to long mishandled
    + JDK-7146776: deadlock between URLStreamHandler.getHostAddress
    and file.Handler.openconnection
    + JDK-8086003: Test fails on OSX with java.lang.RuntimeException
    'Narrow klass base: 0x0000000000000000, Narrow klass shift: 3'
    missing
    + JDK-8168869: jdeps: localized messages don't use proper line
    breaks
    + JDK-8180837: SunPKCS11-NSS tests failing with
    CKR_ATTRIBUTE_READ_ONLY and CKR_MECHANISM_PARAM_INVALID
    + JDK-8202343: Disable TLS 1.0 and 1.1
    + JDK-8205992: jhsdb cannot attach to Java processes running in
    Docker containers
    + JDK-8209193: Fix aarch64-linux compilation after -Wreorder
    changes
    + JDK-8210413: AArch64: Optimize div/rem by constant in C1
    + JDK-8210578: AArch64: Invalid encoding for fmlsvs instruction
    + JDK-8211051: jdeps usage of --dot-output doesn't provide
    valid output for modular jar
    + JDK-8211057: Gensrc step CompileProperties generates unstable
    CompilerProperties output
    + JDK-8211150: G1 Full GC not purging code root memory and
    hence causing memory leak
    + JDK-8211825: ModuleLayer.defineModulesWithXXX does not setup
    delegation when module reads automatic module
    + JDK-8212043: Add floating-point Math.min/max intrinsics
    + JDK-8212218: [TESTBUG] runtime/ErrorHandling/
    /TestHeapDumpOnOutOfMemoryErrorInMetaspace.java timed out
    + JDK-8213116: javax/swing/JComboBox/WindowsComboBoxSize/
    /WindowsComboBoxSizeTest.java fails in Windows
    + JDK-8213909: jdeps --print-module-deps should report missing
    dependences
    + JDK-8214180: Need better granularity for sleeping
    + JDK-8214223: tools/jdeps/listdeps/ListModuleDeps.java failed
    due to missing Lib2 file
    + JDK-8214230: Classes generated by SystemModulesPlugin.java
    are not reproducable
    + JDK-8214741: docs/index.html has no title or copyright
    + JDK-8215687: [Graal] unit test CheckGraalIntrinsics failed
    after 8212043
    + JDK-8217848: [Graal] vmTestbase/nsk/jvmti/ResourceExhausted/
    /resexhausted003/TestDescription.java fails
    + JDK-8218482: sun/security/krb5/auto/ReplayCachePrecise.java
    failed - no KrbException thrown
    + JDK-8218550: Add test omitted from JDK-8212043
    + JDK-8221584: SIGSEGV in os::PlatformEvent::unpark() in
    JvmtiRawMonitor::raw_exit while posting method exit event
    + JDK-8221995: AARCH64: problems with CAS instructions encoding
    + JDK-8222518: Remove unnecessary caching of Parker object in
    java.lang.Thread
    + JDK-8222785: aarch64: add necessary masking for immediate
    shift counts
    + JDK-8223186: HotSpot compile warnings from GCC 9
    + JDK-8225773: jdeps --check produces NPE if there are missing
    module dependences
    + JDK-8225805: Java Access Bridge does not close the logger
    + JDK-8226810: Failed to launch JVM because of
    NullPointerException occured on System.props
    + JDK-8229396: jdeps ignores multi-release when
    generate-module-info used on command line
    + JDK-8229474: Shenandoah: Cleanup CM::update_roots()
    + JDK-8232225: Rework the fix for JDK-8071483
    + JDK-8232905: JFR fails with assertion:
    assert(t-&gt;unflushed_size() == 0) failed: invariant
    + JDK-8233164: C2 fails with assert(phase-&gt;C-&gt;get_alias_index(t)
    == phase-&gt;C-&gt;get_alias_index(t_adr)) failed: correct memory
    chain
    + JDK-8233910: java/awt/ColorClass/AlphaColorTest.java is
    failing  intermittently in nightly lnux-x64 system
    + JDK-8233912: aarch64: minor improvements of atomic operations
    + JDK-8234508: VM_HeapWalkOperation::iterate_over_object reads
    non-strong fields with an on-strong load barrier
    + JDK-8234742: Improve handshake logging
    + JDK-8234796: Refactor Handshake::execute to take a more
    complex type than ThreadClosure
    + JDK-8235324: Dying objects are published from users of
    CollectedHeap::object_iterate
    + JDK-8235351: Lookup::unreflect should bind with the original
    caller independent of Method's accessible flag
    + JDK-8237369: Shenandoah: failed vmTestbase/nsk/jvmti/
    /AttachOnDemand/attach021/TestDescription.java test
    + JDK-8237392: Shenandoah: Remove unreliable assertion
    + JDK-8237483: AArch64 C1 OopMap inserted twice fatal error
    + JDK-8237495: Java MIDI fails with a dereferenced memory error
    when asked to send a raw 0xF7
    + JDK-8239355: (dc) Initial value of SO_SNDBUF should allow
    sending large datagrams (macOS)
    + JDK-8240353: AArch64: missing support for
  - XX:+ExtendedDTraceProbes in C1
    + JDK-8240704: CheckHandles.java failed "AssertionError: Handle
    use increased by more than 10 percent."
    + JDK-8240751: Shenandoah: fold ShenandoahTracer definition
    + JDK-8240795: [REDO] 8238384 CTW: C2 compilation fails with
    "assert(store != load-&gt;find_exact_control(load-&gt;in(0)))
    failed: dependence cycle found"
    + JDK-8241598: Upgrade JLine to 3.14.0
    + JDK-8241649: Optimize Character.toString
    + JDK-8241770: Module xxxAnnotation() methods throw NCDFE if
    module-info.class found as resource in unnamed module
    + JDK-8241911: AArch64: Fix a potential register clash issue in
    reduce_add2I
    + JDK-8242030: Wrong package declarations in jline classes after
    JDK-8241598
    + JDK-8242565: Policy initialization issues when the denyAfter
    constraint is enabled
    + JDK-8243618: compiler/rtm/cli tests can be run w/o WhiteBox
    + JDK-8243670: Unexpected test result caused by C2
    MergeMemNode::Ideal
    + JDK-8244088: [Regression] Switch of Gnome theme ends up in
    deadlocked UI
    + JDK-8244154: Update SunPKCS11 provider with PKCS11 v3.0 header
    files
    + JDK-8244340: Handshake processing thread lacks yielding
    + JDK-8244573: java.lang.ArrayIndexOutOfBoundsException thrown
    for malformed class file
    + JDK-8244683: A TSA server used by tests
    + JDK-8245005: javax/net/ssl/compatibility/BasicConnectTest.java
    failed with No enum constant
    + JDK-8245026: PsAdaptiveSizePolicy::_old_gen_policy_is_ready is
    unused
    + JDK-8245283: JFR: Can't handle constant dynamic used by Jacoco
    agent
    + JDK-8245512: CRC32 optimization using AVX512 instructions
    + JDK-8245527: LDAP Channel Binding support for Java
    GSS/Kerberos
    + JDK-8246707: (sc) SocketChannel.read/write throws
    AsynchronousCloseException on closed channel
    + JDK-8246709: sun/security/tools/jarsigner/
    /TsacertOptionTest.java compilation failed after JDK-8244683
    + JDK-8247200: assert((unsigned)fpargs &lt; 32)
    + JDK-8247766: [aarch64] guarantee(val &lt; (1U &lt;&lt; nbits))
    failed: Field too big for insn.
    + JDK-8248336: AArch64: C2: offset overflow in
    BoxLockNode::emit
    + JDK-8248865: Document JNDI/LDAP timeout properties
    + JDK-8248901: Signed immediate support in
    .../share/assembler.hpp is broken.
    + JDK-8249543: Force DirectBufferAllocTest to run with
  - ExplicitGCInvokesConcurrent
    + JDK-8249588: libwindowsaccessbridge issues on 64bit Windows
    + JDK-8249749: modify a primitive array through a stream and a
    for cycle causes jre crash
    + JDK-8249787: Make TestGCLocker more resilient with concurrent
    GCs
    + JDK-8249867: xml declaration is not followed by a newline
    + JDK-8250911: [windows] os::pd_map_memory() error detection
    broken
    + JDK-8251255: [linux] Add process-memory information to hs-err
    and VM.info
    + JDK-8251359: Shenandoah: filter null oops before calling
    enqueue/SATB barrier
    + JDK-8251925: C2: RenaissanceStressTest fails with
    assert(!had_error): bad dominance
    + JDK-8251944: Add Shenandoah test config to
    compiler/gcbarriers/UnsafeIntrinsicsTest.java
    + JDK-8251992: VM crashed running TestComplexAddrExpr.java test
    with -XX:UseAVX=X
    + JDK-8253220: Epsilon: clean up unused code/declarations
    + JDK-8253274: The CycleDMImagetest brokes the system
    + JDK-8253353: Crash in C2: guarantee(n != NULL) failed: No Node
    + JDK-8253368: TLS connection always receives close_notify
    exception
    + JDK-8253404: C2: assert(C-&gt;live_nodes() &lt;=
    C-&gt;max_node_limit()) failed: Live Node limit exceeded limit
    + JDK-8253409: Double-rounding possibility in float fma
    + JDK-8253476: TestUseContainerSupport.java fails on some Linux
    kernels w/o swap limit capabilities
    + JDK-8253524: C2: Refactor code that clones predicates during
    loop unswitching
    + JDK-8253644: C2: assert(skeleton_predicate_has_opaque(iff))
    failed: unexpected
    + JDK-8253681: closed java/awt/dnd/MouseEventAfterStartDragTest/
    /MouseEventAfterStartDragTest.html test failed
    + JDK-8253702: BigSur version number reported as 10.16, should
    be 11.nn
    + JDK-8253756: C2 CompilerThread0 crash in Node::add_req(Node*)
    + JDK-8254104: MethodCounters must exist before nmethod is
    installed
    + JDK-8254734: "dead loop detected" assert failure with patch
    from 8223051
    + JDK-8254748: Bad Copyright header format after JDK-8212218
    + JDK-8254799: runtime/ErrorHandling/
    /TestHeapDumpOnOutOfMemoryError.java fails with release VMs
    + JDK-8255058: C1: assert(is_virtual()) failed: type check
    + JDK-8255351: Add detection for Graviton 2 CPUs
    + JDK-8255368: Math.exp() gives wrong result for large values on
    x86 32-bit platforms
    + JDK-8255387: Japanese characters were printed upside down on
    AIX
    + JDK-8255401: Shenandoah: Allow oldval and newval registers to
    overlap in cmpxchg_oop()
    + JDK-8255479: [aarch64] assert(src-&gt;section_index_of(target) ==
    CodeBuffer::SECT_NONE) failed: sanity
    + JDK-8255544: Create a checked cast
    + JDK-8255559: Leak File Descriptors Because of
    ResolverLocalFilesystem#engineResolveURI()
    + JDK-8255681: print callstack in error case in
    runAWTLoopWithApp
    + JDK-8255734: VM should ignore SIGXFSZ on ppc64, s390 too
    + JDK-8255742: PrintInlining as compiler directive doesn't print
    virtual calls
    + JDK-8255845: Memory leak in imageFile.cpp
    + JDK-8255880: UI of Swing components is not redrawn after their
    internal state changed
    + JDK-8255908: ExceptionInInitializerError due to
    UncheckedIOException while initializing cgroupv1 subsystem
    + JDK-8256025: AArch64: MachCallRuntimeNode::ret_addr_offset()
    is incorrect for stub calls
    + JDK-8256056: Deoptimization stub doesn't save vector registers
    on x86
    + JDK-8256061: RegisterSaver::save_live_registers() omits upper
    halves of ZMM0-15 registers
    + JDK-8256187: [TEST_BUG] Automate bug4275046.java test
    + JDK-8256220: C1: x86_32 fails with -XX:UseSSE=1 after
    JDK-8210764 due to mishandled lir_neg
    + JDK-8256258: some missing NULL checks or asserts after
    CodeCache::find_blob_unsafe
    + JDK-8256264: Printed GlyphVector outline with low DPI has bad
    quality on Windows
    + JDK-8256290: javac/lambda/T8031967.java fails with
    StackOverflowError on x86_32
    + JDK-8256359: AArch64: runtime/ReservedStack/
    /ReservedStackTestCompiler.java fails
    + JDK-8256387: Unexpected result if patching an entire
    instruction on AArch64
    + JDK-8256421: Add 2 HARICA roots to cacerts truststore
    + JDK-8256488: [aarch64] Use ldpq/stpq instead of ld4/st4 for
    small copies in StubGenerator::copy_memory
    + JDK-8256489: Make gtest for long path names on Windows more
    resilient in the presence of virus scanners
    + JDK-8256501: libTestMainKeyWindow fails to build with Xcode
    12.2
    + JDK-8256633: Fix product build on Windows+Arm64
    + JDK-8256682: JDK-8202343 is incomplete
    + JDK-8256751: Incremental rebuild with precompiled header fails
    when touching a header file
    + JDK-8256757: Incorrect MachCallRuntimeNode::ret_addr_offset()
    for CallLeafNoFP on x86_32
    + JDK-8256806: Shenandoah: optimize shenandoah/jni/
    /TestPinnedGarbage.java test
    + JDK-8256807: C2: Not marking stores correctly as mismatched
    in string opts
    + JDK-8256810: Incremental rebuild broken on Macosx
    + JDK-8256818: SSLSocket that is never bound or connected leaks
    socket resources
    + JDK-8256888: Client manual test problem list update
    + JDK-8257083: Security infra test failures caused by
    JDK-8202343
    + JDK-8257408: Bump update version for OpenJDK: jdk-11.0.11
    + JDK-8257423: [PPC64] Support -XX:-UseInlineCaches
    + JDK-8257436: [aarch64] Regressions in ArrayCopyUnalignedDst
    .testByte/testChar for 65-78 bytes when UseSIMDForMemoryOps
    is on
    + JDK-8257513: C2: assert((constant_addr -
    _masm.code()-&gt;consts()-&gt;start()) == con.offset())
    + JDK-8257547: Handle multiple prereqs on the same line in deps
    files
    + JDK-8257561: Some code is not vectorized after 8251925 and
    8250607
    + JDK-8257565: epsilonBarrierSet.hpp should not include
    barrierSetAssembler
    + JDK-8257575: C2: "failed: only phis" assert failure in loop
    strip mining verification
    + JDK-8257594: C2 compiled checkcast of non-null object triggers
    endless deoptimization/recompilation cycle
    + JDK-8257633: Missing -mmacosx-version-min=X flag when linking
    libjvm
    + JDK-8257670: sun/security/ssl/SSLSocketImpl/SSLSocketLeak.java
    reports leaks
    + JDK-8257707: Fix incorrect format string in Http1HeaderParser
    + JDK-8257746: Regression introduced with JDK-8250984 - memory
    might be null in some machines
    + JDK-8257798: [PPC64] undefined reference to
    Klass::vtable_start_offset()
    + JDK-8257884: Re-enable sun/security/ssl/SSLSocketImpl/
    /SSLSocketLeak.java as automatic test
    + JDK-8257910: [JVMCI] Set exception_seen accordingly in the
    runtime.
    + JDK-8257997: sun/security/ssl/SSLSocketImpl/SSLSocketLeak.java
    again reports leaks after JDK-8257884
    + JDK-8257999: Parallel GC crash in gc/parallel/
    /TestDynShrinkHeap.java: new region is not in covered_region
    + JDK-8258077: Using -Xcheck:jni can lead to a double-free after
    JDK-8193234
    + JDK-8258247: Couple of issues in fix for JDK-8249906
    + JDK-8258373: Update the text handling in the JPasswordField
    + JDK-8258396: SIGILL in jdk.jfr.internal.PlatformRecorder
    .rotateDisk()
    + JDK-8258419: RSA cipher buffer cleanup
    + JDK-8258471: "search codecache" clhsdb command does not work
    + JDK-8258534: Epsilon: clean up unused includes
    + JDK-8258805: Japanese characters not entered by mouse click
    on Windows 10
    + JDK-8258833: Cancel multi-part cipher operations in SunPKCS11
    after failures
    + JDK-8258836: JNI local refs exceed capacity
    getDiagnosticCommandInfo
    + JDK-8258884: [TEST_BUG] Convert applet-based test
    open/test/jdk/javax/swing/JMenuItem/8031573/bug8031573.java
    to a regular java test
    + JDK-8259007: This test printed a blank page
    + JDK-8259048: (tz) Upgrade time-zone data to tzdata2020f
    + JDK-8259049: Uninitialized variable after JDK-8257513
    + JDK-8259231: Epsilon: improve performance under contention
    during virtual space expansion
    + JDK-8259271: gc/parallel/TestDynShrinkHeap.java still fails
    "assert(covered_region.contains(new_memregion)) failed: new
    region is not in covered_region"
    + JDK-8259312: VerifyCACerts.java fails as soneraclass2ca cert
    will expire in 90 days
    + JDK-8259319: Illegal package access when SunPKCS11 requires
    SunJCE's classes
    + JDK-8259339: AllocateUninitializedArray C2 intrinsic fails
    with void.class input
    + JDK-8259428: AlgorithmId.getEncodedParams() should return copy
    + JDK-8259446: runtime/jni/checked/
    /TestCheckedReleaseArrayElements.java fails with stderr not
    empty
    + JDK-8259451: Zero: skip serviceability/sa tests, set vm.hasSA
    to false
    + JDK-8259580: Shenandoah: uninitialized label in
    VerifyThreadGCState
    + JDK-8259619: C1: 3-arg StubAssembler::call_RT stack-use
    condition is incorrect
    + JDK-8259633: compiler/graalunit/CoreTest.java fails with NPE
    after JDK-8244543
    + JDK-8259706: C2 compilation fails with assert(vtable_index ==
    Method::invalid_vtable_index) failed: correct sentinel value
    + JDK-8259707: LDAP channel binding does not work with StartTLS
    extension
    + JDK-8259773: Incorrect encoding of AVX-512 kmovq instruction
    + JDK-8259849: Shenandoah: Rename store-val to IU-barrier
    + JDK-8259949: x86 32-bit build fails when -fcf-protection is
    passed in the compiler flags
    + JDK-8259954: gc/shenandoah/mxbeans tests fail with -Xcomp
    + JDK-8260029: aarch64: fix typo in verify_oop_array
    + JDK-8260308: Update LogCompilation junit to 4.13.1
    + JDK-8260338: Some fields in HaltNode is not cloned
    + JDK-8260349: Cannot programmatically retrieve Metaspace max
    set via JAVA_TOOL_OPTIONS
    + JDK-8260356: (tz) Upgrade time-zone data to tzdata2021a
    + JDK-8260378: [TESTBUG] DcmdMBeanTestCheckJni.java reports
    false positive
    + JDK-8260497: Shenandoah: Improve SATB flushing
    + JDK-8260502: [s390] NativeMovRegMem::verify() fails because
    it's too strict
    + JDK-8260632: Build failures after JDK-8253353
    + JDK-8260704: ParallelGC: oldgen expansion needs release-store
    for _end
    + JDK-8261022: Fix incorrect result of Math.abs() with char type
    + JDK-8261089: [TESTBUG] native library of test
    TestCheckedReleaseCriticalArray.java fails to compile with
    gcc 4.x
    + JDK-8261183: Follow on to Make lists of normal filenames
    + JDK-8261209: isStandalone property: remove dependency on
    pretty-print
    + JDK-8261231: Windows IME was disabled after DnD operation
    + JDK-8261251: Shenandoah: Use object size for full GC
    humongous compaction
    + JDK-8261310: PPC64 Zero build fails with
    'VMError::controlled_crash(int)::FunctionDescriptor
    functionDescriptor' has incomplete type and cannot be defined
    + JDK-8261334: NMT: tuning statistic shows incorrect hash
    distribution
    + JDK-8261413: Shenandoah: Disable class-unloading in I-U mode
    + JDK-8261522: [PPC64] AES intrinsics write beyond the
    destination array
    + JDK-8261534: Test sun/security/pkcs11/KeyAgreement/
    /IllegalPackageAccess.java fails on platforms where no nsslib
    artifacts are defined
    + JDK-8261585: Restore HandleArea used in
    Deoptimization::uncommon_trap
    + JDK-8261753: Test java/lang/System/OsVersionTest.java still
    failing on BigSur patch versions after JDK-8253702
    + JDK-8261829: Exclude tools/jlink/JLinkReproducibleTest.java
    in 11u
    + JDK-8261912: Code IfNode::fold_compares_helper more
    defensively
    + JDK-8261920: [AIX] jshell command throws java.io.IOError on
    non English locales
    + JDK-8262018: Wrong format in SAP copyright header of
    OsVersionTest
    + JDK-8263069: Exclude some failing tests from
    security/infra/java/security/cert/CertPathValidator</changelog>
  <changelog author="fstrba@suse.com" date="1620043200">- Remove all Jpackage provides for SLE12 in order to avoid
  installing this package as default Java on SLE12-SP5
  (bsc#1185476)</changelog>
  <changelog author="fstrba@suse.com" date="1621512000">- Modified patch:
  * nss-security-provider.patch
    + make the NSS provider first in the list</changelog>
  <changelog author="fstrba@suse.com" date="1626868800">- Update to upstream tag jdk-11.0.12+7 (July 2021, CPU)
  * Security fixes
    + JDK-8256157: Improve bytecode assembly
    + JDK-8256491: Better HTTP transport
    + JDK-8258432, CVE-2021-2341, bsc#1188564: Improve file
    transfers
    + JDK-8260453: Improve Font Bounding
    + JDK-8260960: Signs of jarsigner signing
    + JDK-8260967, CVE-2021-2369, bsc#1188565: Better jar file
    validation
    + JDK-8262380: Enhance XML processing passes
    + JDK-8262403: Enhanced data transfer
    + JDK-8262410: Enhanced rules for zones
    + JDK-8262477: Enhance String Conclusions
    + JDK-8262967: Improve Zip file support
    + JDK-8264066, CVE-2021-2388, bsc#1188566: Enhance compiler
    validation
    + JDK-8264079: Improve abstractions
    + JDK-8264460: Improve NTLM support
  * Other changes
    + JDK-6847157: java.lang.NullPointerException: HDC for
    component at sun.java2d.loops.Blit.Blit
    + JDK-7106851: Test should not use System.exit
    + JDK-8073446: TimeZone getOffset API does not  return a dst
    offset between years 2038-2137
    + JDK-8076190: Customizing the generation of a PKCS12 keystore
    + JDK-8153005: Upgrade the default PKCS12 encryption/MAC
    algorithms
    + JDK-8171303: sun/java2d/pipe/InterpolationQualityTest.java
    fails on Windows &amp; Linux
    + JDK-8177068: incomplete classpath causes NPE in Flow
    + JDK-8185734: [Windows] Structured Exception Catcher missing
    around gtest execution
    + JDK-8187450: JNI local refs exceeds capacity warning in
    NetworkInterface::getAll
    + JDK-8190763: Class cast exception on (CompoundEdit)
    UndoableEditEvent.getEdit()
    + JDK-8195841: PNGImageReader.readNullTerminatedString() doesnt
    check for non-null terminated strings with length equal to
    maxLen
    + JDK-8196100: javax/swing/text/JTextComponent/5074573/
    /bug5074573.java fails
    + JDK-8199646: JShell tests: jdk/jshell/
    /FailOverDirectExecutionControlTest.java failed with
    java.lang.UnsupportedOperationException
    + JDK-8206925: Support the certificate_authorities extension
    + JDK-8207160: ClassReader::adjustMethodParams can potentially
    return null if the args list is empty
    + JDK-8207247: AARCH64: Enable Minimal and Client VM builds
    + JDK-8207404: MulticastSocket tests failing on AIX
    + JDK-8207779: Method::is_valid_method() compares 'this' with
    NULL
    + JDK-8208061: runtime/LoadClass/TestResize.java fails with
    "Load factor too high" when running in CDS mode.
    + JDK-8209459: TestSHA512MultiBlockIntrinsics failed on AArch64
    + JDK-8210443: Migrate Locale matching tests to JDK Repo.
    + JDK-8213231: ThreadSnapshot::_threadObj can become stale
    + JDK-8213483: ARM32: runtime/ErrorHandling/
    /ShowRegistersOnAssertTest.java jtreg test fail
    + JDK-8213725: JShell NullPointerException due to class file
    with unexpected package
    + JDK-8213794: ARM32: disable TypeProfiling,
    CriticalJNINatives, Serviceablity tests for ARM32
    + JDK-8213845: ARM32: Interpreter doesn't call result handler
    after native calls
    + JDK-8214128: ARM32: wrong stack alignment on
    Deoptimization::unpack_frames
    + JDK-8214512: ARM32: Jtreg test compiler/c2/Test8062950.java
    fails on ARM
    + JDK-8214854: JDWP: Unforseen output truncation in logging
    + JDK-8214922: Add vectorization support for fmin/fmax
    + JDK-8215009: GCC 8 compilation error in libjli
    + JDK-8216184: CDS/appCDS tests failed on Windows due to long
    path to a classlist file
    + JDK-8216259: AArch64: Vectorize Adler32 intrinsics
    + JDK-8216314: SIGILL in CodeHeapState::print_names()
    + JDK-8217348: assert(thread-&gt;is_Java_thread()) failed: just
    checking
    + JDK-8217465: [REDO] - Optimize CodeHeap Analytics
    + JDK-8217561: X86: Add floating-point Math.min/max intrinsics
    + JDK-8217918: C2: -XX:+AggressiveUnboxing is broken
    + JDK-8218458: [TESTBUG] runtime/NMT/
    /CheckForProperDetailStackTrace.java fails with Expected
    stack trace missing from output
    + JDK-8219142: Remove unused JIMAGE_ResourcePath
    + JDK-8219586: CodeHeap State Analytics processes dead nmethods
    + JDK-8220074: Clean up GCC 8.3 errors in LittleCMS
    + JDK-8220407: compiler/intrinsics/math/
    /TestFpMinMaxIntrinsics.java timedout
    + JDK-8222302: [TESTBUG] test/hotspot/jtreg/compiler/intrinsics/
    /sha/cli/TestUseSHAOptionOnUnsupportedCPU.java fails on any
    other CPU
    + JDK-8222412: AARCH64: multiple instructions encoding issues
    + JDK-8223020: aarch64: expand minI_rReg and maxI_rReg patterns
    into separate instructions
    + JDK-8223444: Improve CodeHeap Free Space Management
    + JDK-8223504: Improve performance of forall loops by better
    inlining of "iterator()" methods
    + JDK-8223667: ASAN build broken
    + JDK-8225081: Remove Telia Company CA certificate expiring in
    April 2021
    + JDK-8225116: Test OwnedWindowsLeak.java intermittently fails
    + JDK-8225438: javax/net/ssl/TLSCommon/
    /TestSessionLocalPrincipal.java failed with Read timed out
    + JDK-8225756: [testbug] compiler/loopstripmining/
    /CheckLoopStripMining.java sets too short a
    SafepointTimeoutDelay
    + JDK-8226374: Restrict TLS signature schemes and named groups
    + JDK-8226627: assert(t-&gt;singleton()) failed: must be a constant
    + JDK-8226721: Missing intrinsics for Math.ceil, floor, rint
    + JDK-8227080: (fs) Files.newInputStream(...).skip(n) is slow
    + JDK-8227222: vmTestbase/jit/FloatingPoint/gen_math/Loops04/
    /Loops04.java failed XMM register should be 0-15
    + JDK-8227609: (fs) Files.newInputStream(...).skip(n) should
    allow skipping beyond file size
    + JDK-8230428: Cleanup dead CastIP node code in formssel.cpp
    + JDK-8231460: Performance issue (CodeHeap) with large free
    blocks
    + JDK-8231713: x86_32 build failures after JDK-8226721 (Missing
    intrinsics for Math.ceil, floor, rint)
    + JDK-8231841: AArch64: debug.cpp help() is missing an AArch64
    line for pns
    + JDK-8232084: HotSpot build failed with GCC 9.2.1
    + JDK-8232591: AArch64: Add missing match rules for smaddl,
    smsubl and smnegl
    + JDK-8233185: HttpServer.stop() blocks indefinitely when
    called on dispatch thread
    + JDK-8233787: Break cycle in vm_version* includes
    + JDK-8233948: AArch64: Incorrect mapping between OptoReg and
    VMReg for high 64 bits of Vector Register
    + JDK-8234355: Buffer overflow in jcmd GC.class_stats due to
    too many classes
    + JDK-8235368: Update BCEL to Version 6.4.1
    + JDK-8236859: WebSocket over authenticating proxy fails with
    NPE
    + JDK-8236992: AArch64: remove redundant load_klass in itable
    stub
    + JDK-8237743: test/langtools/jdk/jshell/
    /FailOverExecutionControlTest.java fails No
    ExecutionControlProvider with name 'nonExistent' and parameter
    keys: []
    + JDK-8237804: sun/security/mscapi tests fail with "Key pair
    not generated, alias &lt;nnnnnn&gt; already exists"
    + JDK-8238175: CTW: Class.getDeclaredMethods fails with
    assert(k-&gt;is_subclass_of(SystemDictionary::Throwable_klass()))
    failed: invalid exception class
    + JDK-8238567: SoftMainMixer.processAudioBuffers(): Wrong
    handling of stoppedMixers
    + JDK-8238812: assert(false) failed: bad AD file
    + JDK-8239312: [macos] javax/swing/JFrame/NSTexturedJFrame/
    /NSTexturedJFrame.java
    + JDK-8239386: handle ContendedPaddingWidth in
    vm_version_aarch64
    + JDK-8239536: Can't use 'java.util.List' object after
    importing 'java.awt.List'
    + JDK-8240487: Cleanup whitespace in .cc, .hh, .m, and .mm files
    + JDK-8240848: ArrayIndexOutOfBoundsException buf for
    TextCallbackHandler
    + JDK-8241082: Upgrade IANA Language Subtag Registry data to
    03-16-2020 version
    + JDK-8241087: Build failure with VS 2019 (16.5.0) due to C2039
    and C2873
    + JDK-8241101: [s390] jtreg test failure after JDK-8238696: not
    conformant features string
    + JDK-8241248: NullPointerException in
    sun.security.ssl.HKDF.extract(HKDF.java:93)
    + JDK-8241372: Several test failures due to
    javax.net.ssl.SSLException: Connection reset
    + JDK-8241475: AArch64: Add missing support for PopCountVI node
    + JDK-8241829: Cleanup the code for PrinterJob on windows
    + JDK-8241960: The SHA3 message digests impl of SUN provider
    are not thread safe after cloned
    + JDK-8242010: Upgrade IANA Language Subtag Registry to Version
    2020-04-01
    + JDK-8242429: Better implementation for sign extract
    + JDK-8242557: Add length limit for strings in PNGImageWriter
    + JDK-8242919: Paste locks up jshell
    + JDK-8243155: AArch64: Add support for SqrtVF
    + JDK-8243240: AArch64: Add support for MulVB
    + JDK-8243452: JFR: Could not create chunk in repository with
    over 200 recordings
    + JDK-8243559: Remove root certificates with 1024-bit keys
    + JDK-8243597: AArch64: Add support for integer vector abs
    + JDK-8244031: HttpClient should have more tests for HEAD
    requests
    + JDK-8244205: HTTP/2 tunnel connections through proxy may be
    reused regardless of which proxy is selected
    + JDK-8244847: Linux/PPC: runtime/CompressedOops/
    /CompressedClassPointers: smallHeapTest fails
    + JDK-8245511: G1 adaptive IHOP does not account for
    reclamation of humongous objects by young GC
    + JDK-8246274: G1 old gen allocation tracking is not in a
    separate class
    + JDK-8247354: [aarch64] PopFrame causes
    assert(oopDesc::is_oop(obj)) failed: not an oop
    + JDK-8247408: IdealGraph bit check expression canonicalization
    + JDK-8247432: Update IANA Language Subtag Registry to Version
    2020-09-29
    + JDK-8247438: JShell: When FailOverExecutionControlProvider
    fails the proximal cause is not shown
    + JDK-8247753: UIManager.getSytemLookAndFeelClassName() returns
    wrong value on Fedora 32
    + JDK-8248043: Need to eliminate excessive i2l conversions
    + JDK-8248411: [aarch64] Insufficient error handling when
    CodeBuffer is exhausted
    + JDK-8248568: compiler/c2/TestBit.java failed: test missing
    from stdout/stderr
    + JDK-8248870: AARCH64: I2L/L2I conversions can be skipped for
    masked positive values
    + JDK-8249142: java/awt/FontClass/CreateFont/DeleteFont.sh is
    unstable
    + JDK-8249189: AARCH64: more L2I conversions can be skipped
    + JDK-8249719: MethodHandle performance suffers from bad
    ResolvedMethodTable hash function
    + JDK-8249875: GCC 10 warnings -Wtype-limits with JFR code
    + JDK-8250635: MethodArityHistogram should use Compile_lock in
    favour of fancy checks
    + JDK-8250876: Fix issues with cross-compile on macos
    + JDK-8251031: Some vmTestbase/nsk/monitoring/RuntimeMXBean
    tests fail with hostnames starting from digits
    + JDK-8251525: AARCH64: Faster Math.signum(fp)
    + JDK-8252259: AArch64: Adjust default value of FLOATPRESSURE
    + JDK-8252311: AArch64: save two words in itable lookup stub
    + JDK-8252779: compiler/graalunit/HotspotTest.java failed after
    8251525
    + JDK-8252883: AccessDeniedException caused by delayed file
    deletion on Windows
    + JDK-8253167: ARM32 builds fail after JDK-8247910
    + JDK-8253572: [windows] CDS archive may fail to open with long
    file names
    + JDK-8253923: C2 doesn't always run loop opts for compilations
    that include loops
    + JDK-8253948: Memory leak in ImageFileReader
    + JDK-8254631: Better support ALPN byte wire values in SunJSSE
    + JDK-8254717: isAssignableFrom checks in
    KeyFactorySpi.engineGetKeySpec appear to be backwards
    + JDK-8255086: Update the root locale display names
    + JDK-8255625: AArch64: Implement Base64.encodeBlock
    accelerator/intrinsic
    + JDK-8255763: C2: OSR miscompilation caused by invalid memory
    instruction placement
    + JDK-8255992: JFR EventWriter does not use first string from
    StringPool with id 0
    + JDK-8256037: [TESTBUG] com/sun/jndi/dns/ConfigTests/
    /PortUnreachable.java fails due to the hard coded threshold
    is small
    + JDK-8256244: java/lang/ProcessHandle/PermissionTest.java
    fails with TestNG 7.1
    + JDK-8256287: [windows] add loop fuse to
    map_or_reserve_memory_aligned
    + JDK-8256523: Streamline Java SHA2 implementation
    + JDK-8257414: Drag n Drop target area is wrong on high DPI
    systems
    + JDK-8257569: Failure observed with
    JfrVirtualMemory::initialize
    + JDK-8257574: C2: "failed: parsing found no loops but there
    are some" assert failure
    + JDK-8257580: Bump update version for OpenJDK: jdk-11.0.12
    + JDK-8257604: JNI_ArgumentPusherVaArg leaks valist
    + JDK-8257621: JFR StringPool misses cached items across
    consecutive recordings
    + JDK-8257796: [TESTBUG]
    TestUseSHA512IntrinsicsOptionOnSupportedCPU.java fails
    on x86_32
    + JDK-8257822: C2 crashes with SIGFPE due to a division that
    floats above its zero check
    + JDK-8257828: SafeFetch may crash if invoked in non-JavaThreads
    + JDK-8257853: Remove dependencies on JNF's JNI utility
    functions in AWT and 2D code
    + JDK-8257858: [macOS]: Remove JNF dependency from
    libosxsecurity/KeystoreImpl.m
    + JDK-8257860: [macOS]: Remove JNF dependency from
    libosxkrb5/SCDynamicStoreConfig.m
    + JDK-8257988: Remove JNF dependency from
    libsaproc/MacosxDebuggerLocal.m
    + JDK-8258414: OldObjectSample events too expensive
    + JDK-8258505: [TESTBUG] TestDivZeroWithSplitIf.java fails due
    to missing UnlockDiagnosticVMOptions
    + JDK-8258753: StartTlsResponse.close() hangs due to
    synchronization issues
    + JDK-8259061: C2: assert(found) failed: memory-writing node is
    not placed in its original loop or an ancestor of it
    + JDK-8259227: C2 crashes with SIGFPE due to a division that
    floats above its zero check
    + JDK-8259232: Bad JNI lookup during printing
    + JDK-8259276: C2: Empty expression stack when reexecuting
    tableswitch/lookupswitch instructions after deoptimization
    + JDK-8259343: [macOS] Update JNI error handling in Cocoa code.
    + JDK-8259585: Accessible actions do not work on mac os x
    + JDK-8259651: [macOS] Replace JNF_COCOA_ENTER/EXIT macros
    + JDK-8259662: Don't wrap SocketExceptions into SSLExceptions
    in SSLSocketImpl
    + JDK-8259710: Inlining trace leaks memory
    + JDK-8259729: Missed JNFInstanceOf -&gt; IsInstanceOf conversion
    + JDK-8259777: Incorrect predication condition generated by ADLC
    + JDK-8259786: initialize last parameter of getpwuid_r
    + JDK-8259843: initialize dli_fname array before calling
    dll_address_to_library_name
    + JDK-8259869: [macOS] Remove desktop module dependencies on
    JNF Reference APIs
    + JDK-8259886: Improve SSL session cache performance and
    scalability
    + JDK-8259983: do not use uninitialized expand_ms value in
    G1CollectedHeap::expand_heap_after_young_collection
    + JDK-8260030: Improve stringStream buffer handling
    + JDK-8260236: better init AnnotationCollector _contended_group
    + JDK-8260255: C1: LoopInvariantCodeMotion constructor can
    leave some fields uninitialized
    + JDK-8260284: C2: assert(_base == Int) failed: Not an Int
    + JDK-8260380: Upgrade to LittleCMS 2.12
    + JDK-8260420: C2 compilation fails with assert(found_sfpt)
    failed: no node in loop that's not input to safepoint
    + JDK-8260426: awt debug_mem.c DMem_AllocateBlock might leak
    memory
    + JDK-8260432: allocateSpaceForGP in freetypeScaler.c might
    leak memory
    + JDK-8260616: Removing remaining JNF dependencies in the
    java.desktop module
    + JDK-8260653: Unreachable nodes keep speculative types alive
    + JDK-8260707: java/lang/instrument/PremainClass/
    /InheritAgent0100.java times out
    + JDK-8260925: HttpsURLConnection does not work  with other
    JSSE provider.
    + JDK-8260926: Trace resource exhausted events unconditionally
    + JDK-8261020: Wrong format parameter in
    create_emergency_chunk_path
    + JDK-8261027: AArch64: Support for LSE atomics C++ HotSpot code
    + JDK-8261167: print_process_memory_info add a close call after
    fopen
    + JDK-8261170: Upgrade to freetype 2.10.4
    + JDK-8261198: [macOS] Incorrect JNI parameters in number
    conversion in A11Y code
    + JDK-8261235: C1 compilation fails with
    assert(res-&gt;vreg_number() == index) failed: conversion check
    + JDK-8261261: The version extra fields needs to be overridable
    in jib-profiles.js
    + JDK-8261262: Kitchensink24HStress.java crashed with
    EXCEPTION_ACCESS_VIOLATION
    + JDK-8261354: SIGSEGV at MethodIteratorHost
    + JDK-8261355: No data buffering in SunPKCS11 Cipher encryption
    when the underlying mechanism has no padding
    + JDK-8261397: try catch Method failing to work when dividing
    an integer by 0
    + JDK-8261422: Adjust problematic String.format calls in
    jdk/internal/util/Preconditions.java outOfBoundsMessage
    + JDK-8261447: MethodInvocationCounters frequently run into
    overflow
    + JDK-8261481: Cannot read Kerberos settings in dynamic store
    on macOS Big Sur
    + JDK-8261505: Test test/hotspot/jtreg/gc/parallel/
    /TestDynShrinkHeap.java killed by Linux OOM Killer
    + JDK-8261601: free memory in early return in
    Java_sun_nio_ch_sctp_SctpChannelImpl_receive0
    + JDK-8261649: AArch64: Optimize LSE atomics in C++ code
    + JDK-8261730: C2 compilation fails with
    assert(store-&gt;find_edge(load) != -1) failed: missing
    precedence edge
    + JDK-8261752: Multiple GC test are missing memory requirements
    + JDK-8261791: (sctp) handleSendFailed in SctpChannelImpl.c
    potential leaks
    + JDK-8261812: C2 compilation fails with assert(!had_error)
    failed: bad dominance
    + JDK-8261914: IfNode::fold_compares_helper faces
    non-canonicalized bool when running JRuby JSON workload
    + JDK-8262093: java/util/concurrent/tck/JSR166TestCase.java
    failed "assert(false) failed: unexpected node"
    + JDK-8262110: DST starts from incorrect time in 2038
    + JDK-8262121: [11u] Redo 8244287: JFR: Methods samples have
    line number 0
    + JDK-8262163: Extend settings printout in jcmd VM.metaspace
    + JDK-8262295: C2: Out-of-Bounds Array Load from Clone Source
    + JDK-8262298: G1BarrierSetC2::step_over_gc_barrier fails with
    assert "bad barrier shape"
    + JDK-8262446: DragAndDrop hangs on Windows
    + JDK-8262461: handle wcstombsdmp return value correctly in
    unix awt_InputMethod.c
    + JDK-8262465: Very long compilation times and high memory
    consumption in C2 debug builds
    + JDK-8262726: AArch64: C1 StubAssembler::call_RT can corrupt
    stack
    + JDK-8262739: String inflation C2 intrinsic prevents insertion
    of anti-dependencies
    + JDK-8262829: Native crash in
    Win32PrintServiceLookup.getAllPrinterNames()
    + JDK-8262837: handle split_USE correctly
    + JDK-8262900: ToolBasicTest fails to access HTTP server it
    starts
    + JDK-8263260: [s390] Support latest hardware (z14 and z15)
    + JDK-8263311: Watch registry changes for remote printers
    update instead of polling
    + JDK-8263361: Incorrect arraycopy stub selected by C2 for SATB
    collectors
    + JDK-8263404: RsaPrivateKeySpec is always recognized as
    RSAPrivateCrtKeySpec in RSAKeyFactory.engineGetKeySpec
    + JDK-8263425: AArch64: two potential bugs in C1
    LIRGenerator::generate_address()
    + JDK-8263448: CTW: fatal error: meet not symmetric
    + JDK-8263504: Some OutputMachOpcodes fields are uninitialized
    + JDK-8263557: Possible NULL dereference in
    Arena::destruct_contents()
    + JDK-8263558: Possible NULL dereference in fast path arena
    free if ZapResourceArea is true
    + JDK-8263676: AArch64: one potential bug in C1
    LIRGenerator::generate_address()
    + JDK-8263729: [test] divert spurious output away from stream
    under test in ProcessBuilder Basic test
    + JDK-8263846: Bad JNI lookup getFocusOwner in accessibility
    code on Mac OS X
    + JDK-8264047: Duplicate global variable 'jvm' in libjavajpeg
    and libawt
    + JDK-8264096: slowdebug jvm crashes when StrInflatedCopy match
    rule is not supported
    + JDK-8264151: ciMethod::ensure_method_data() should return
    false is loading resulted in empty state
    + JDK-8264173: [s390] Improve Hardware Feature Detection And
    Reporting
    + JDK-8264190: Harden TLS interop tests
    + JDK-8264223: CodeHeap::verify fails extra_hops assertion in
    fastdebug test
    + JDK-8264328: Broken license in
    javax/swing/JComboBox/8072767/bug8072767.java
    + JDK-8264360: Loop strip mining verification fails with
    "should be on the backedge"
    + JDK-8264626: C1 should be able to inline excluded methods
    + JDK-8264640: CMS ParScanClosure misses a barrier
    + JDK-8264786: [macos] All Swing/AWT apps cause Allow
    Notifications prompt to appear when app is launched
    + JDK-8264821: DirectIOTest fails on a system with large block
    size
    + JDK-8264848: [macos] libjvm.dylib linker warning due to macOS
    version mismatch
    + JDK-8264923: PNGImageWriter.write_zTXt throws Exception with
    a typo
    + JDK-8264958: C2 compilation fails with assert "n is later
    than its clone"
    + JDK-8265099: Revert backport to 11u of 8236859: WebSocket
    over authenticating proxy fails with NPE
    + JDK-8265154: vinserti128 operand mix up for KNL platforms
    + JDK-8265239: Shenandoah: Shenandoah heap region count could
    be off by 1
    + JDK-8265417: Backport of JDK-8249672 breaks Solaris x86 build
    + JDK-8265421: java/lang/String/StringRepeat.java test is
    missing a memory requirement
    + JDK-8265462: Handle multiple slots in the NSS Internal Module
    from SunPKCS11's Secmod
    + JDK-8265537: x86 version string truncated after JDK-8249672
    11u backport
    + JDK-8265666: Enable AIX build platform to make external debug
    symbols
    + JDK-8265677: CMS: CardTableBarrierSet::write_ref_array_work()
    lacks storestore barrier
    + JDK-8265690: Use the latest Ubuntu base image version in
    Docker testing
    + JDK-8265718: Build failure after JDK-8258414 11u backport
    + JDK-8265750: Fatal error in safepoint.cpp after backport of
    8258414
    + JDK-8265784: [C2] Hoisting of DecodeN leaves MachTemp inputs
    behind
    + JDK-8265938: C2's conditional move optimization does not
    handle top Phi
    + JDK-8266220: keytool still prompt for store password on a
    password-less pkcs12 file if -storetype pkcs12 is specified
    + JDK-8266293: Key protection using PBEWithMD5AndDES fails with
    "java.security.InvalidAlgorithmParameterException: Salt must
    be 8 bytes long"
    + JDK-8266713: [AIX] Build failure after 11u backport of
    JDK-8247753
    + JDK-8266802: Shenandoah: Round up region size to page size
    unconditionally
    + JDK-8266892: avoid maybe-uninitialized gcc warnings on linux
    s390x
    + JDK-8266929: Unable to use algorithms from 3p providers
    + JDK-8267235: [macos_aarch64]
    InterpreterRuntime::throw_pending_exception messing up LR
    results in crash
    + JDK-8267561: Shenandoah: Reference processing not properly
    setup for outside of cycle degenerated GC
    + JDK-8267599: Revert the change to the default PKCS12
    macAlgorithm and macIterationCount props for 11u/8u/7u
    + JDK-8267641: [11u] 8227609 backport typo
    + JDK-8267721: Enable sun/security/pkcs11 tests for Amazon
    Linux 2 AArch64
    + JDK-8268678: LetsEncryptCA.java test fails as Let's Encrypt
    Authority X3 is retired</changelog>
  <changelog author="schwab@suse.de" date="1628078400">- riscv64-zero.patch: Add support for riscv64 (zero VM)</changelog>
  <changelog author="fstrba@suse.com" date="1629979200">- Added patch:
  * jdk11-glibc234.patch
    + fix build with glibc-2.34 (bsc#1189201)</changelog>
  <changelog author="fstrba@suse.com" date="1631534400">- Modified patch:
  * nss-security-provider.patch
    + revert recent changes making NSS provider the default one
    + fixes bsc#1190252</changelog>
  <changelog author="fstrba@suse.com" date="1631793600">- Added patch:
  * fips.patch
    + implement FIPS support in OpenJDK</changelog>
  <changelog author="fstrba@suse.com" date="1634817600">- Update to upstream tag jdk-11.0.13+8 (October 2021 CPU)
  * Security fixes
    + JDK-8163326, CVE-2021-35550, bsc#1191901: Update the default
    enabled cipher suites preference
    + JDK-8254967, CVE-2021-35565, bsc#1191909:
    com.sun.net.HttpsServer spins on TLS session close
    + JDK-8263314: Enhance XML Dsig modes
    + JDK-8265167, CVE-2021-35556, bsc#1191910: Richer Text Editors
    + JDK-8265574: Improve handling of sheets
    + JDK-8265580, CVE-2021-35559, bsc#1191911: Enhanced style for
    RTF kit
    + JDK-8265776: Improve Stream handling for SSL
    + JDK-8266097, CVE-2021-35561, bsc#1191912: Better hashing
    support
    + JDK-8266103: Better specified spec values
    + JDK-8266109: More Resilient Classloading
    + JDK-8266115: More Manifest Jar Loading
    + JDK-8266137, CVE-2021-35564, bsc#1191913: Improve Keystore
    integrity
    + JDK-8266689, CVE-2021-35567, bsc#1191903: More Constrained
    Delegation
    + JDK-8267086: ArrayIndexOutOfBoundsException in
    java.security.KeyFactory.generatePublic
    + JDK-8267712: Better LDAP reference processing
    + JDK-8267729, CVE-2021-35578, bsc#1191904: Improve TLS client
    handshaking
    + JDK-8267735, CVE-2021-35586, bsc#1191914: Better BMP support
    + JDK-8268193: Improve requests of certificates
    + JDK-8268199: Correct certificate requests
    + JDK-8268205: Enhance DTLS client handshake
    + JDK-8268506: More Manifest Digests
    + JDK-8269618, CVE-2021-35603, bsc#1191906: Better session
    identification
    + JDK-8269624: Enhance method selection support
    + JDK-8270398: Enhance canonicalization
    + JDK-8270404: Better canonicalization
  * Other changes
    + JDK-8024368: private methods are allocated vtable indices
    + JDK-8042902: Test java/net/Inet6Address/serialize/
    /Inet6AddressSerializationTest.java fails intermittently
    + JDK-8140466: ChaCha20 and Poly1305 TLS Cipher Suites
    + JDK-8157404: Unable to read certain PKCS12 keystores from
    SequenceInputStream
    + JDK-8158066: SourceDebugExtensionTest fails to rename file
    + JDK-8168304: Make all of DependencyContext_test available in
    product mode
    + JDK-8169246: java/net/DatagramSocket/ReportSocketClosed.java
    fails intermittently with BindException
    + JDK-8181313: SA: Remove libthread_db dependency on Linux
    + JDK-8193214: Incorrect annotations.without.processors
    warnings with JDK 9
    + JDK-8194230: jdk/internal/jrtfs/remote/
    /RemoteRuntimeImageTest.java fails with
    java.lang.NullPointerException
    + JDK-8196092: javax/swing/JComboBox/8032878/bug8032878.java
    fails
    + JDK-8199931: java/net/MulticastSocket/
    /UnreferencedMulticastSockets.java fails with "incorrect data
    received"
    + JDK-8206083: Make tools/javac/api/T6265137.java robust to JDK
    version changes
    + JDK-8206350: java/util/Locale/bcp47u/SystemPropertyTests.java
    failed on Mac 10.13 with zh_CN and zh_TW locales.
    + JDK-8207316: java/nio/channels/spi/SelectorProvider/
    /inheritedChannel/InheritedChannelTest.java failed
    + JDK-8208227: tools/jdeps/DotFileTest.java fails on Win-X64
    + JDK-8208363: test/jdk/java/lang/Package/
    /PackageFromManifest.java missing module dependencies
    declaration
    + JDK-8209380: ARM: cleanup maybe-uninitialized and reorder
    compiler warnings
    + JDK-8209768: Refactor java/util/prefs/CheckUserPrefsStorage.sh
    to plain java test
    + JDK-8209772: Refactor shell test java/util/ServiceLoader/
    /basic/basic.sh to java
    + JDK-8209773: Refactor shell test javax/naming/module/basic.sh
    to java
    + JDK-8209832: Refactor jdk/internal/reflect/Reflection/
    /GetCallerClassTest.sh to plain java test
    + JDK-8209930: Refactor java/util/zip/ZipFile/deletetempjar.sh
    to plain java test
    + JDK-8210406: Refactor java.util.PluggableLocale:i18n shell
    tests to plain java tests
    + JDK-8210407: Refactor java.util.Calendar:i18n shell tests to
    plain java tests
    + JDK-8210495: compiler crashes because of illegal signature in
    otherwise legal code
    + JDK-8210669: Some launcher tests assume a pre-JDK 9 run-time
    image layout
    + JDK-8210802: temp files left by tests in
    jdk/java/net/httpclient
    + JDK-8210819: Update the host name in CNameTest.java
    + JDK-8210908: Refactor java/util/prefs/PrefsSpi.sh to plain
    java test
    + JDK-8210934: Move sun/net/www/protocol/http/
    /GetErrorStream.java to OpenJDK
    + JDK-8210959: JShell fails and exits when statement throws an
    exception whose message contains a '%'.
    + JDK-8211055: Provide print to a file (PDF) feature even when
    printer was not connected
    + JDK-8211092: test/jdk/sun/net/www/http/HttpClient/
    /MultiThreadTest.java fails intermittently when cleaning up
    + JDK-8211296: Remove HotSpot deprecation warning suppression
    for Mac/clang
    + JDK-8211325: test/jdk/java/net/Socket/LingerTest.java fails
    with cleaning up
    + JDK-8212040: Compilation error due to wrong usage of
    NSPrintJobDispositionValue in mac10.12
    + JDK-8212695: Add explicit timeout to several HTTP Client tests
    + JDK-8212718: Refactor some annotation processor tests to
    better use collections
    + JDK-8213007: Update the link in test/jdk/sun/security/
    /provider/SecureRandom/DrbgCavp.java
    + JDK-8213137: Remove static initialization of monitor/mutex
    instances
    + JDK-8213235: java/nio/channels/SocketChannel/
    /AsyncCloseChannel.java fails with threads that didn't exit
    + JDK-8213409: Refactor sun.text.IntHashtable:i18n shell tests
    to plain java tests
    + JDK-8213576: Make test AsyncCloseChannel.java run in othervm
    + JDK-8213694: Test Timeout.java should run in othervm mode
    + JDK-8213718: [TEST] Wrong classname in vmTestbase/nsk/stress/
    /except/except002 and except003
    + JDK-8213922: fix ctw stand-alone build
    + JDK-8214195: Align stdout messages in
    test/jdk/java/math/BigInteger/PrimitiveConversionTests.java
    + JDK-8214520: [TEST_BUG] sun/security/mscapi/nonUniqueAliases/
    /NonUniqueAliases.java failed with incorrect jtreg tags order
    + JDK-8214937: sun/security/tools/jarsigner/warnings/
    /NoTimestampTest.java failed due to unexpected expiration date
    + JDK-8216532: tools/launcher/Test7029048.java fails (Solaris)
    + JDK-8217825: Verify @AfterTest is used correctly in WebSocket
    tests
    + JDK-8218145: block_if_requested is not proper inlined due to
    size
    + JDK-8219417: bump jtreg requiredVersion to b14
    + JDK-8219552: bump jtreg requiredVersion to b14 in
    test/jdk/sanity/client/
    + JDK-8219804: java/net/MulticastSocket/Promiscuous.java fails
    intermittently due to NumberFormatException
    + JDK-8220445: Support for side by side MSVC Toolset versions
    + JDK-8221988: add possibility to build with Visual Studio 2019
    + JDK-8222751: closed/test/jdk/sun/security/util/
    /DerIndefLenConverter/IndefBerPkcs12.java fail
    + JDK-8223050: JVMCI: findUniqueConcreteMethod() should not use
    Dependencies::find_unique_concrete_method() for non-virtual
    methods
    + JDK-8224853: CDS address sanitizer errors
    + JDK-8225082: Remove IdenTrust certificate that is expiring in
    September 2021
    + JDK-8225583: Examine the HttpResponse.BodySubscribers for
    null handling and multiple subscriptions
    + JDK-8225690: Multiple AttachListener threads can be created
    + JDK-8225790: Two NestedDialogs tests fail on Ubuntu
    + JDK-8226319: Add forgotten test/jdk/java/net/httpclient/
    /BodySubscribersTest.java
    + JDK-8226533: JVMCI: findUniqueConcreteMethod should handle
    statically bindable methods directly
    + JDK-8226602: Test convenience reactive primitives from
    java.net.http with RS TCK
    + JDK-8226683: Remove review suggestion from fix to 8219804
    + JDK-8227738: jvmti/DataDumpRequest/datadumpreq001 failed due
    to "exit code is 134"
    + JDK-8227766: CheckUnhandledOops is broken in MemAllocator
    + JDK-8227815: Minimal VM: set_state is not a member of
    AttachListener
    + JDK-8230674: Heap dumps should exclude dormant CDS archived
    objects of unloaded classes
    + JDK-8230808: Remove Access::equals()
    + JDK-8230841: Remove oopDesc::equals()
    + JDK-8231717: Improve performance of charset decoding when
    charset is always compactable
    + JDK-8232243: Wrong caret position in JTextPane on Windows
    with a screen resolution &gt; 100%
    + JDK-8232782: Shenandoah: streamline post-LRB CAS barrier
    (aarch64)
    + JDK-8233790: Forward output from heap dumper to jcmd/jmap
    + JDK-8233989: Create an IPv4 version of
    java/net/MulticastSocket/SetLoopbackMode.java
    + JDK-8234510: Remove file seeking requirement for writing a
    heap dump
    + JDK-8235211: serviceability/attach/
    /RemovingUnixDomainSocketTest.java fails with
    AttachNotSupportedException: Unable to open socket file
    + JDK-8235216: typo in test filename
    + JDK-8235866: bump jtreg requiredVersion to 4.2b16
    + JDK-8236111: narrow allowSmartActionArgs disabling
    + JDK-8236413: AbstractConnectTimeout should tolerate both
    NoRouteToHostException and UnresolvedAddressException
    + JDK-8236671: NullPointerException in JKS keystore
    + JDK-8238930: problem list compiler/c2/Test8004741.java
    + JDK-8238943: switch to jtreg 5.0
    + JDK-8240555: Using env of JAVA_TOOL_OPTIONS and _JAVA_OPTIONS
    breaks QuietOption.java test
    + JDK-8240983: Incorrect copyright header in Apache Santuario
    2.1.3 files
    + JDK-8241336: Some java.net tests failed with
    NoRouteToHostException on MacOS with special network
    configuration
    + JDK-8241353: NPE in ToolProvider.getSystemJavaCompiler
    + JDK-8241768: git needs .gitattributes
    + JDK-8242882: opening jar file with large manifest might throw
    NegativeArraySizeException
    + JDK-8244973: serviceability/attach/
    /RemovingUnixDomainSocketTest.java fails "stderr was not
    empty"
    + JDK-8245134: test/lib/jdk/test/lib/security/
    /KeyStoreUtils.java should allow to specify aliases
    + JDK-8246261: TCKLocalTime.java failed due to "AssertionError:
    expected [18:14:22] but found [18:14:23]"
    + JDK-8246387: switch to jtreg 5.1
    + JDK-8247421: [TESTBUG] ReturnBlobToWrongHeapTest.java failed
    allocating blob
    + JDK-8247469: getSystemCpuLoad() returns -1 on linux when some
    offline cpus are present and cpusets.effective_cpus is not
    available
    + JDK-8248352: [TEST_BUG] Test test/jdk/java/awt/font/
    /TextLayout/ArabicDiacriticTest.java can leave frame open
    + JDK-8248403: AArch64: Remove uses of kernel integer types
    + JDK-8248414: AArch64: Remove uses of long and unsigned long
    ints
    + JDK-8248657: Windows: strengthening in ThreadCritical
    regarding memory model
    + JDK-8248666: AArch64: Use THREAD_LOCAL instead of __thread
    + JDK-8248668: AArch64: Avoid MIN/MAX macros when using MSVC
    + JDK-8248671: AArch64: Remove unused variables
    + JDK-8248682: AArch64: Use ATTRIBUTE_ALIGNED helper
    + JDK-8248816: C1: Fix signature conflict in
    LIRGenerator::strength_reduce_multiply
    + JDK-8249095: tools/javac/launcher/SourceLauncherTest.java
    fails on Windows
    + JDK-8249548: backward focus traversal gets stuck in button
    group
    + JDK-8249773: Upgrade ReceiveISA.java test to be resilient to
    failure due to stray packets and interference
    + JDK-8249897: jdk/javadoc/tool/LangVers.java uses @ignore w/o
    bug-id
    + JDK-8249898: jdk/javadoc/tool/6176978/T6176978.java uses
    @ignore w/o bug-id
    + JDK-8249899: jdk/javadoc/tool/InlineTagsWithBraces.java uses
    @ignore w/o bug-id
    + JDK-8250588: Shenandoah: LRB needs to save/restore fp
    registers for runtime call
    + JDK-8250824: AArch64: follow up for JDK-8248414
    + JDK-8251166: Add automated testcases for changes done in
    JDK-8214112
    + JDK-8251252: Add automated testcase for fix done in
    JDK-8214253
    + JDK-8251254: Add automated test for fix done in JDK-8218472
    + JDK-8251361: Potential race between Logger configuration and
    GCs in HttpURLConWithProxy test
    + JDK-8251549: Update docs on building for Git
    + JDK-8251945: SIGSEGV in
    PackageEntry::purge_qualified_exports()
    + JDK-8252194: Add automated test for fix done in JDK-8218469
    + JDK-8252648: Shenandoah: name gang tasks consistently
    + JDK-8252825: Add automated test for fix done in JDK-8218479
    + JDK-8252853: AArch64: gc/shenandoah/TestVerifyJCStress.java
    fails intermittently with C1
    + JDK-8252857: AArch64: Shenandoah C1 CAS is not sequentially
    consistent
    + JDK-8253048: AArch64: When CallLeaf, no need to preserve
    callee-saved registers in caller
    + JDK-8253424: Add support for running pre-submit testing using
    GitHub Actions
    + JDK-8253631: Remove unimplemented CompileBroker methods after
    JEP-165
    + JDK-8253865: Pre-submit testing using GitHub Actions does not
    detect failures reliably
    + JDK-8253899: Make IsClassUnloadingEnabled signature match
    specification
    + JDK-8254024: Enhance native libs for AWT and Swing to work
    with GraalVM Native Image
    + JDK-8254054: Pre-submit testing using GitHub Actions should
    not use the deprecated set-env command
    + JDK-8254173: Add Zero, Minimal hotspot targets to submit
    workflow
    + JDK-8254175: Build no-pch configuration in debug mode for
    submit checks
    + JDK-8254244: Some code emitted by TemplateTable::branch is
    unused when running TieredCompilation
    + JDK-8254270: linux 32 bit build doesn't compile
    libjdwp/log_messages.c
    + JDK-8254282: Add Linux x86_32 builds to submit workflow
    + JDK-8254850: Update terminology in java.awt.GridBagLayout
    source code comments
    + JDK-8255255: Update Apache Santuario (XML Signature) to
    version 2.2.1
    + JDK-8255305: Add Linux x86_32 tier1 to submit workflow
    + JDK-8255352: Archive important test outputs in submit workflow
    + JDK-8255373: Submit workflow artifact name is always
    "test-results_.zip"
    + JDK-8255452: Doing GC during JVMTI MethodExit event posting
    breaks return oop
    + JDK-8255718: Zero: VM should know it runs in interpreter-only
    mode
    + JDK-8255790: GTKL&amp;F: Java 16 crashes on initialising GTKL&amp;F
    on Manjaro Linux
    + JDK-8255810: Zero: build fails without JVMTI
    + JDK-8255895: Submit workflow artifacts miss hs_errs/replays
    due to ZIP include mismatch
    + JDK-8256127: Add cross-compiled foreign architectures builds
    to submit workflow
    + JDK-8256215: Shenandoah: re-organize saving/restoring machine
    state in assembler code
    + JDK-8256267: Relax compiler/floatingpoint/NaNTest.java for
    x86_32 and lower -XX:+UseSSE
    + JDK-8256277: Github Action build on macOS should define OS
    and Xcode versions
    + JDK-8256354: Github Action build on Windows should define OS
    and MSVC versions
    + JDK-8256393: Github Actions build on Linux should define OS
    and GCC versions
    + JDK-8256414: add optimized build to submit workflow
    + JDK-8256747: GitHub Actions: decouple the hotspot build-only
    jobs from Linux x64 testing
    + JDK-8257056: Submit workflow should apt-get update to avoid
    package installation errors
    + JDK-8257148: Remove obsolete code in AWTView.m
    + JDK-8257497: Update keytool to create AKID from the SKID of
    the issuing certificate as specified by RFC 5280
    + JDK-8257620: Do not use objc_msgSend_stret to get macOS
    version
    + JDK-8257913: Add more known library locations to simplify
    Linux cross-compilation
    + JDK-8258703: Incorrect 512-bit vector registers restore on
    x86_32
    + JDK-8259338: Add expiry exception for identrustdstx3 alias to
    VerifyCACerts.java test
    + JDK-8259535: ECDSA SignatureValue do not always have the
    specified length
    + JDK-8259679: GitHub actions should use MSVC 14.28
    + JDK-8259924: GitHub actions fail on Linux x86_32 with "Could
    not configure libc6:i386"
    + JDK-8260460: GitHub actions still fail on Linux x86_32 with
    "Could not configure libc6:i386"
    + JDK-8260589: Crash in JfrTraceIdLoadBarrier::load(_jclass*)
    + JDK-8260923: Add more tests for SSLSocket input/output
    shutdown
    + JDK-8261072: AArch64: Fix MacroAssembler::get_thread
    convention
    + JDK-8261147: C2: Node is wrongly marked as reduction
    resulting in a wrong execution due to wrong vector instructions
    + JDK-8261238: NMT should not limit baselining by size threshold
    + JDK-8261496: Shenandoah: reconsider pacing updates memory
    ordering
    + JDK-8261652: Remove some dead comments from os_bsd_x86
    + JDK-8261846: [JVMCI] c2v_iterateFrames can get out of sync
    with the StackFrameStream
    + JDK-8262000: jdk/jfr/event/gc/detailed/
    /TestPromotionFailedEventWithParallelScavenge.java failed with
    "OutOfMemoryError: Java heap space"
    + JDK-8262017: C2: assert(n != __null) failed: Bad immediate
    dominator info.
    + JDK-8262392: Update Mesa 3-D Headers to version 21.0.3
    + JDK-8262409: sun/security/ssl/SSLSocketImpl/
    /SSLSocketImplThrowsWrongExceptions. SSL test failures caused
    by java failed with "Server reported the wrong exception"
    + JDK-8262470: Printed GlyphVector outline with low DPI has bad
    quality on Windows
    + JDK-8262862: Harden tests sun/security/x509/URICertStore/
    /ExtensionsWithLDAP.java and krb5/canonicalize/Test.java
    + JDK-8263136: C4530 was reported from VS 2019 at access bridge
    + JDK-8263227: C2: inconsistent spilling due to dead nodes in
    exception block
    + JDK-8263382: java/util/logging/ParentLoggersTest.java failed
    with "checkLoggers: getLoggerNames() returned unexpected
    loggers"
    + JDK-8263407: SPARC64 detection fails on Athena (SPARC64-X)
    + JDK-8263432: javac may report an invalid package/class clash
    on case insensitive filesystems
    + JDK-8263490: [macos] Crash occurs on JPasswordField with
    activated InputMethod
    + JDK-8263531: Remove unused buffer int
    + JDK-8263667: Avoid running GitHub actions on branches named
    pr/*
    + JDK-8263776: [JVMCI] add helper to perform Java upcalls
    + JDK-8264016: [JVMCI] add some thread local fields for use by
    JVMCI
    + JDK-8264752: SIGFPE crash with option
    FlightRecorderOptions:threadbuffersize=30M
    + JDK-8265132: C2 compilation fails with assert "missing
    precedence edge"
    + JDK-8265231: (fc) ReadDirect and WriteDirect tests fail after
    fix for JDK-8264821
    + JDK-8265335: Epsilon: Minor typo in EpsilonElasticTLABDecay
    description
    + JDK-8265756: AArch64: initialize memory allocated for locals
    according to Windows AArch64 stack page growth requirement in
    template interpreter
    + JDK-8265761: Font with missed font family name is not
    properly printed on Windows
    + JDK-8265773: incorrect jdeps message "jdk8internals" to
    describe a removed JDK internal API
    + JDK-8265836: OperatingSystemImpl.getCpuLoad() returns
    incorrect CPU load inside a container
    + JDK-8266018: Shenandoah: fix an incorrect assert
    + JDK-8266206: Build failure after JDK-8264752 with older GCCs
    + JDK-8266248: Compilation failure in
    PLATFORM_API_MacOSX_MidiUtils.c with Xcode 12.5
    + JDK-8266288: assert root method not found in
    witnessed_reabstraction_in_supers is too strong
    + JDK-8266404: Fatal error report generated with
  - XX:+CrashOnOutOfMemoryError should not contain suggestion to
    submit a bug report
    + JDK-8266480: Implicit null check optimization does not update
    control of hoisted memory operation
    + JDK-8266615: C2 incorrectly folds subtype checks involving an
    interface array
    + JDK-8266642: Improve ResolvedMethodTable hash function
    + JDK-8266749: AArch64: Backtracing broken on PAC enabled
    systems
    + JDK-8266761: AssertionError in
    sun.net.httpserver.ServerImpl.responseCompleted
    + JDK-8266813: Shenandoah: Use shorter instruction sequence for
    checking if marking in progress
    + JDK-8267042: bug in monitor locking/unlocking on ARM32 C1 due
    to uninitialized BasicObjectLock::_displaced_header
    + JDK-8267348: Rewrite gc/epsilon/TestClasses.java to use
    Metaspace with less classes
    + JDK-8267396: Avoid recording "pc" in unhandled oops detector
    for better performance
    + JDK-8267399: C2: java/text/Normalizer/ConformanceTest.java
    test failed with assertion
    + JDK-8267424: CTW: C1 fails with "State must not be null"
    + JDK-8267459: Pasting Unicode characters into JShell does not
    work.
    + JDK-8267625: AARCH64: typo in LIR_Assembler::emit_profile_type
    + JDK-8267666: Add option to jcmd GC.heap_dump to use existing
    file
    + JDK-8267695: Bump update version for OpenJDK: jdk-11.0.13
    + JDK-8267751: (test) jtreg.SkippedException has no serial
    VersionUID
    + JDK-8267773: PhaseStringOpts::int_stringSize doesn't handle
    min_jint correctly
    + JDK-8268103: JNI functions incorrectly return a double after
    JDK-8265836
    + JDK-8268127: Shenandoah: Heap size may be too small for
    region to align to large page size
    + JDK-8268261: C2: assert(n != __null) failed: Bad immediate
    dominator info.
    + JDK-8268347: C2: nested locks optimization may create
    unbalanced monitor enter/exit code
    + JDK-8268360: Missing check for infinite loop during node
    placement
    + JDK-8268362: [REDO] C2 crash when compile negative
    Arrays.copyOf length after loop
    + JDK-8268366: Incorrect calculation of has_fpu_registers in C1
    linear scan
    + JDK-8268369: SIGSEGV in PhaseCFG::implicit_null_check due to
    missing null check
    + JDK-8268417: Add test from JDK-8268360
    + JDK-8268427: Improve AlgorithmConstraints:checkAlgorithm
    performance
    + JDK-8268617: [11u REDO] - WebSocket over authenticating proxy
    fails with NPE
    + JDK-8268620: InfiniteLoopException test may fail on x86
    platforms
    + JDK-8268635: Corrupt oop in ClassLoaderData
    + JDK-8268699: Shenandoah: Add test for JDK-8268127
    + JDK-8268771: javadoc -notimestamp option does not work on
    index.html
    + JDK-8268775: Password is being converted to String in
    AccessibleJPasswordField
    + JDK-8268776: Test `ADatagramSocket.java` missing /othervm
    from @run tag
    + JDK-8268965: TCP Connection Reset when connecting simple
    socket to SSL server
    + JDK-8269304: Regression ~5% in 2005 in b27
    + JDK-8269415: [11u] Remove ea from
    DEFAULT_PROMOTED_VERSION_PRE in OpenJDK 11u
    + JDK-8269478: Shenandoah: gc/shenandoah/mxbeans tests should
    be more resilient
    + JDK-8269529: javax/swing/reliability/
    /HangDuringStaticInitialization.java fails in Windows debug
    build
    + JDK-8269594: assert(_handle_mark_nesting &gt; 1) failed: memory
    leak: allocating handle outside HandleMark
    + JDK-8269614: [s390] Interpreter checks wrong bit for slow
    path instance allocation
    + JDK-8269650: Optimize gc-locker in
    [Get|Release]StringCritical for latin string
    + JDK-8269661: JNI_GetStringCritical does not lock char array
    + JDK-8269668: [aarch64] java.library.path not including
    /usr/lib64
    + JDK-8269763: The JEditorPane is blank after JDK-8265167
    + JDK-8269795: C2: Out of bounds array load floats above its
    range check in loop peeling resulting in SEGV
    + JDK-8269847: JDK-8269594 backport breaks 11u builds
    + JDK-8269850: Most JDK releases report macOS version 12 as
    10.16 instead of 12.0
    + JDK-8269851: OperatingSystemMXBean getProcessCpuLoad reports
    incorrect process cpu usage in containers
    + JDK-8269882: stack-use-after-scope in NewObjectA
    + JDK-8269934: RunThese24H.java failed with
    EXCEPTION_ACCESS_VIOLATION in
    java_lang_Thread::get_thread_status
    + JDK-8270096: Shenandoah: Optimize gc/shenandoah/
    /TestRefprocSanity.java for interpreter mode
    + JDK-8270137: Kerberos Credential Retrieval from Cache not
    Working in Cross-Realm Setup
    + JDK-8270184: [TESTBUG] Add coverage for jvmci
    ResolvedJavaType.toJavaName() for lambdas
    + JDK-8270196: [11u] [JVMCI] JavaType.toJavaName() returns
    incorrect type name for lambdas
    + JDK-8270556: Exclude security/infra/java/security/cert/
    /CertPathValidator/certification/LetsEncryptCA
    + JDK-8270893: IndexOutOfBoundsException while reading large
    TIFF file
    + JDK-8272078: Wrong Checksums in Temurin BootJDK dependencies
    + JDK-8272124: Cgroup v1 initialization causes
    NullPointerException when cgroup path contains colon
    + JDK-8272131: PhaseMacroExpand::generate_slow_arraycopy crash
    when clone null CallProjections.fallthrough_ioproj
    + JDK-8272197: Update 11u GHA workflow with Shenandoah
    configurations
    + JDK-8272332: --with-harfbuzz=system doesn't add -lharfbuzz
    after JDK-8255790
    + JDK-8272472: StackGuardPages test doesn't build with glibc
    2.34
    + JDK-8272602: [macos] not all KEY_PRESSED events sent when
    control modifier is used
    + JDK-8272628: Problemlist gc/stress/gcbasher/
    /TestGCBasherWithCMS.java for x86_32
    + JDK-8272700: [macos] Build failure with Xcode 13.0 after
    JDK-8264848
    + JDK-8272772: Shenandoah: compiler/c2/aarch64/
    /TestVolatilesShenandoah.java fails in 11u
    + JDK-8273939: Backport of 8248414 to JDK11 breaks
    MacroAssembler::adrp
- Remove the unneeded icedtea-sound provider
- Removed patches:
  * icedtea-sound-1.0.1-jdk9.patch
  * icedtea-sound-soundproperties.patch
    + not needed since the icedtea-sound provider is removed
  * jdk11-glibc234.patch
    + integrated upstream</changelog>
  <changelog author="fstrba@suse.com" date="1635940800">- Modified patches:
  * system-crypto-policy.patch
    + rediff to changed context
  * fips.patch
    + Allow plain key import in fips mode unless
    com.suse.fips.plainKeySupport is set to false</changelog>
  <changelog author="fstrba@suse.com" date="1636113600">- Modified patch:
  * fips.patch
    + return in native code after generating java.io.IOException</changelog>
</package>
<package pkgid="721927549ddfd1edc5b663fe2333540708746d4d3b3f2c2a24d8cb7775de9ba7" name="java-11-openjdk-src" arch="s390x">
  <version epoch="0" ver="11.0.13.0" rel="3.68.1"/>
  <changelog author="fstrba@suse.com" date="1586952000">- The pack200 and unpack200 alternatives should be slaves of java
  and not of javac, since they are part of JRE.</changelog>
  <changelog author="fstrba@suse.com" date="1587470400">- Update to upstream tag jdk-11.0.7+10 (April 2020 CPU,
  bsc#1169511)
  * Security fixes:
    + S8223898, CVE-2020-2754: Forward references to Nashorn
    + S8223904, CVE-2020-2755: Improve Nashorn matching
    + S8224541, CVE-2020-2756: Better mapping of serial ENUMs
    + S8224549, CVE-2020-2757: Less Blocking Array Queues
    + S8225603: Enhancement for big integers
    + S8226346: Build better binary builders
    + S8227467: Better class method invocations
    + S8227542: Manifest improved jar headers
    + S8229733: TLS message handling improvements
    + S8231415, CVE-2020-2773: Better signatures in XML
    + S8231785: Improved socket permissions
    + S8232424, CVE-2020-2778: More constrained algorithms
    + S8232581, CVE-2020-2767: Improve TLS verification
    + S8233250: Better X11 rendering
    + S8233410: Better Build Scripting
    + S8234027: Better JCEKS key support
    + S8234408, CVE-2020-2781: Improve TLS session handling
    + S8234825, CVE-2020-2800: Better Headings for HTTP Servers
    + S8234841, CVE-2020-2803: Enhance buffering of byte buffers
    + S8235274, CVE-2020-2805: Enhance typing of methods
    + S8235691, CVE-2020-2816: Enhance TLS connectivity
    + S8236201, CVE-2020-2830: Better Scanner conversions
    + S8238960: linux-i586 builds are inconsistent as the newly
    built jdk is not able to reserve enough space for object heap
  * Other changes:
    + S4919790: Errors in alert ssl message does not reflect the
    actual certificate status
    + S4949105: Access Bridge lacks html tags parsing
    + S7092821: java.security.Provider.getService() is synchronized
    and became scalability bottleneck
    + S7143743: Potential memory leak with zip provider
    + S8005819: Support cross-realm MSSFU
    + S8042383: [TEST_BUG] Test javax/swing/plaf/basic/BasicMenuUI/
    /4983388/bug4983388.java fails with shortcuts on menus do not
    work
    + S8068184: Fix for JDK-8032832 caused a deadlock
    + S8145845: [AOT] NullPointerException in
    compiler/whitebox/GetCodeHeapEntriesTest.java
    + S8152988: [AOT] Update test batch definitions to include
    aot-ed java.base module mode into hs-comp testing
    + S8160926: FLAGS_COMPILER_CHECK_ARGUMENTS doesn't handle
    cross-compilation
    + S8163083: SocketListeningConnector does not allow invocations
    with port 0
    + S8163251: Hard coded loop limit prevents reading of smart
    card data greater than 8k
    + S8167276: jvmci/compilerToVM/MaterializeVirtualObjectTest.java
    fails with -XX:-EliminateAllocations
    + S8169718: nsk/jdb/locals/locals002: ERROR: Cannot find
    boolVar with expected value: false
    + S8176556:
    java/awt/dnd/ImageTransferTest/ImageTransferTest.java fails
    for JFIF
    + S8178798: Two compiler/aot/verification/vmflags tests fail by
    timeout with UseAVX=3
    + S8183107: PKCS11 regression regarding checkKeySize
    + S8185005: Improve performance of
    ThreadMXBean.getThreadInfo(long ids[], int maxDepth)
    + S8189633: Missing -Xcheck:jni checking for DeleteWeakGlobalRef
    + S8189861: Refactor CacheFind
    + S8193042: NativeLookup::lookup_critical_entry() should only
    load shared library once
    + S8193596: java/net/DatagramPacket/ReuseBuf.java failed due to
    timeout
    + S8194944: Regression automated test 'open/test/jdk/javax/
    /swing/JInternalFrame/8145896/TestJInternalFrameMaximize.java'
    fails
    + S8196467: javax/swing/JInternalFrame/Test6325652.java fails
    + S8196969: JTreg Failure: serviceability/sa/ClhsdbJstack.java
    causes NPE
    + S8198321: javax/swing/JEditorPane/5076514/bug5076514.java
    fails
    + S8198398: Test javax/swing/JColorChooser/Test6199676.java
    fails in mach5
    + S8199072: Test javax/swing/GroupLayout/6613904/
    /bug6613904.java is unstable
    + S8200432: javadoc fails with ClassCastException on {@link
    byte[]}
    + S8201349: build broken when configured with
  - -with-zlib=bundled on gcc 7.3
    + S8201355: Avoid native memory allocation in
    sun.security.mscapi.PRNG.generateSeed
    + S8201513: nsk/jvmti/IterateThroughHeap/filter-* are broken
    + S8203364: Some serviceability/sa/ tests intermittently fail
    with java.io.IOException: LingeredApp terminated with non-zero
    exit code 3
    + S8203687: javax/net/ssl/compatibility/Compatibility.java
    supports TLS 1.3
    + S8203904: javax/swing/JSplitPane/4816114/bug4816114.java: The
    divider location is wrong
    + S8203911: Test runtime/modules/getModuleJNI/GetModule fails
    with -Xcheck:jni
    + S8204525: [TESTBUG] runtime/NMT/MallocStressTest.java ran out
    of java heap
    + S8204529: gc/TestAllocateHeapAtMultiple.java fail with Agent
    7 timed out
    + S8204551: Event descriptions are truncated in logs
    + S8206963: [AOT] bug with multiple class loaders
    + S8207367: 10 vmTestbase/nsk/jdi tests timed out when running
    with jtreg
    + S8207832: serviceability/sa/ClhsdbCDSCore.java failed with
    "Couldn't find core file location"
    + S8207938: At step6,Click Add button,case failed automatically.
    + S8208157: requires.VMProps throws NPE for missing properties
    in "release" file
    + S8208379: compiler/jvmci/events/
    /JvmciNotifyInstallEventTest.java failed with "Got unexpected
    event count after 2nd install attempt: expected 9 to equal 2"
    + S8208658: Make CDS archived heap regions usable even if
    compressed oop encoding has changed
    + S8208715: Conversion of milliseconds to nanoseconds in
    UNIXProcess contains bug
    + S8209361: [AOT] Unexpected number of references for
    JVMTI_HEAP_REFERENCE_CONSTANT_POOL [111--&gt;111]: 0 (expected
    at least 1)
    + S8209385: CDS runtime classpath checking is too strict when
    only classes from the system modules are archived
    + S8209389: SIGSEGV in WalkOopAndArchiveClosure::do_oop_work.
    + S8209418: Synchronize test/jdk/sanity/client/lib/jemmy with
    code-tools/jemmy/v2
    + S8209494: Create a test for SwingSet InternalFrameDemo
    + S8209499: Create test for SwingSet EditorPaneDemo
    + S8209574: [AOT] breakpoint events are generated in different
    threads does not meet expected count
    + S8209686: cleanup arguments to PhaseIdealLoop() constructor
    + S8209789: Synchronize test/jdk/sanity/client/lib/jemmy with
    code-tools/jemmy/v2
    + S8209802: Garbage collectors should register JFR types
    themselves to avoid build errors.
    + S8209807: improve handling exception in requires.VMProps
    + S8209817: stack is executable when building with Clang on
    Linux
    + S8209824: Improve the code coverage for ThreadLocal
    + S8209826: Undefined reference to os::write after JDK-8209657
    (filemap.hpp cleanup)
    + S8209850: Allow NamedThreads to use GlobalCounter critical
    sections
    + S8209976: Improve iteration over non-JavaThreads
    + S8209993: Create a test for SwingSet3 ToolTipDemo
    + S8210024: JFR calls virtual is_Java_thread from ~Thread()
    + S8210052: Enable testing for all the available look and feels
    in SwingSet3 demo tests
    + S8210055: Enable different look and feel tests in SwingSet3
    demo tests
    + S8210057: Enable different look and feels in SwingSet3 demo
    test InternalFrameDemoTest
    + S8210058: Algorithmic Italic font leans opposite angle in
    Printing
    + S8210220: [AOT] jdwp test cases are failing with error #
    ERROR: TEST FAILED: Cought IOException while receiving event
    packet
    + S8210289: ArchivedKlassSubGraphInfoRecord is incomplete
    + S8210459: Add support for generating compile_commands.json
    + S8210476: sun/security/mscapi/PrngSlow.java fails with Still
    too slow
    + S8210512: [Testbug] vmTestbase/nsk/jdi/ObjectReference/
    /referringObjects/referringObjects002/referringObjects002.java
    fails with unexpected size of
    ClassLoaderReference.referringObjects
    + S8210523: runtime/appcds/cacheObject/DifferentHeapSizes.java
    crash
    + S8210632: Add key exchange algorithm to
    javax/net/ssl/TLSCommon/CipherSuite.java
    + S8210699: Problem list tests which times out in Xcomp mode
    + S8210793: [JVMCI] AllocateCompileIdTest.java failed to find
    DiagnosticCommand.class
    + S8210910: Create test for FileChooserDemo
    + S8210994: Create test for SwingSet3 FrameDemo
    + S8211139: Increase timeout value in all tests under
    jdk/sanity/client/SwingSet/src
    + S8211160: Handle different look and feels in
    JInternalFrameOperator
    + S8211211: vmTestbase/metaspace/stressDictionary/
    /StressDictionary.java timeout
    + S8211322: Reduce the timeout of tooltip in SwingSet2DemoTest
    + S8211443: Enable different look and feels in SwingSet3 demo
    test SplitPaneDemoTest
    + S8211703: JInternalFrame : java.lang.AssertionError: cannot
    find the internal frame
    + S8211781: re-building fails after changing Graal sources
    + S8212897: Some improvements in the EditorPaneDemotest
    + S8212903: [TestBug] Tests test/jdk/javax/swing/LookAndFeel/
    /8145547/DemandGTK2.sh and DemandGTK3.sh fail on Ubuntu 18.04
    LTS
    + S8213009: Refactoring existing SunMSCAPI classes
    + S8213010: Supporting keys created with certmgr.exe
    + S8213168: Enable different look and feel tests in SwingSet3
    demo test FileChooserDemoTest
    + S8213348: jdk.internal.vm.compiler.management service
    providers missing in module descriptor
    + S8213906: Update arm devkits with libXrandr headers
    + S8213908: AssertionError in DeferredAttr at setOverloadKind
    + S8214124: [TESTBUG] Bugs in runtime/NMT/MallocStressTest.java
    + S8214344: C2: assert(con.basic_type() != T_ILLEGAL) failed:
    elembt=byte; loadbt=void; unsigned=0
    + S8214345: infinite recursion while checking super class
    + S8214471: Enable different look and feel tests in SwingSet3
    demo test ToolTipDemoTest
    + S8214534: Setting of THIS_FILE in the build is broken
    + S8214557: Filter out VM flags which don't affect AOT code
    generation
    + S8214578: [macos] Problem with backslashes on macOS/JIS
    keyboard: Java ignores system settings
    + S8214840: runtime/NMT/MallocStressTest.java timed out
    + S8214850: Rename vm_operations.?pp files to vmOperations.?pp
    files
    + S8214904: Test8004741.java failed due to "Too few ThreadDeath
    hits; expected at least 6 but saw only 5"
    + S8215322: add @file support to jaotc
    + S8215355: Object monitor deadlock with no threads holding the
    monitor (using jemalloc 5.1)
    + S8215396: JTabbedPane preferred size calculation is wrong for
    SCROLL_TAB_LAYOUT
    + S8216180: [AOT] compiler/intrinsics/bigInteger/TestMulAdd.java
    crashed with AOT enabled
    + S8216353: Use utility APIs introduced in org/netbeans/jemmy/
    /util/LookAndFeel class in client sanity test cases
    + S8216354: Syntax error in toolchain_windows.m4
    + S8216472: (se) Stack overflow during selection operation
    leads to crash (win)
    + S8216535: tools/jimage/JImageExtractTest.java timed out
    + S8217235: Create automated test for SwingSet
    ColorChooserDemoTest
    + S8217297: Add support for multiple look and feel for SwingSet
    SliderDemoTest
    + S8217338: [Containers] Improve systemd slice memory limit
    support
    + S8217613: [AOT] TEST_OPTS_AOT_MODULES doesn't work on mac
    + S8217634: RunTest documentation and usability update
    + S8217717: ZGC: Broken oop map in C1 load barrier stub
    + S8217728: Speed up incremental rerun of "make hotspot"
    + S8218268: Javac treats Manifest Class-Path entries as Paths
    instead of URLs
    + S8218662: Allow 204 responses with Content-Length:0
    + S8218882: NET_Writev is declared, NET_WriteV is defined
    + S8218889: Improperly use of the Optional API
    + S8219205: JFR file without license header
    + S8219597: (bf) Heap buffer state changes could provoke
    unexpected exceptions
    + S8219723: javax/net/ssl/compatibility/Compatibility.java
    failed on some SNI cases
    + S8220348: [ntintel] asserts about copying unaligned array
    + S8220451: jdi/EventQueue/remove/remove004 failed due to
    "ERROR: thread2 is not alive"
    + S8220456: jdi/EventQueue/remove_l/remove_l004 failed due to
    "TIMEOUT while waiting for event"
    + S8220479: java/nio/channels/Selector/SelectWithConsumer.java
    failed at testTwoChannels()
    + S8220613: java/util/Arrays/TimSortStackSize2.java times out
    with fastdebug build
    + S8220688: [TESTBUG] runtime/NMT/MallocStressTest.java timed
    out
    + S8220786: Create new switch to redirect error reporting
    output to stdout or stderr
    + S8221270: Duplicated synchronized keywords in SSLSocketImpl
    + S8221312: test/jdk/sanity/client/SwingSet/src/
    /ColorChooserDemoTest.java failed
    + S8221851: Use of THIS_FILE in hotspot invalidates precompiled
    header on Linux/GCC
    + S8221885: Add intermittent test in the JavaSound to the
    ProblemList
    + S8222264: Windows incremental build is broken with JDK-8217728
    + S8222391: javax/net/ssl/compatibility/Compatibility.java
    should be more flexible
    + S8222448: java/lang/reflect/PublicMethods/
    /PublicMethodsTest.java times out
    + S8222519: ButtonDemoScreenshotTest fails randomly with "still
    state to be reached"
    + S8222741: jdi/EventQueue/remove/remove004 fails due to
    VMDisconnectedException
    + S8223003: SunMSCAPI keys are not cleaned up
    + S8223063: Support CNG RSA keys
    + S8223158: Docked MacBook cannot start any Java Swing
    applications
    + S8223260: NamingManager should cache InitialContextFactory
    + S8223464: Improve version string for Oracle CI builds
    + S8223558: Java does not render Myanmar script correctly
    + S8223627: jdk-13+20 bundle name contains null instead of ea
    + S8223638: Replace wildcard address with loopback or local
    host in tests - part 6
    + S8223678: Add Visual Studio Code workspace generation support
    (for native code)
    + S8223727: com/sun/jndi/ldap/privconn/RunTest.java failed due
    to hang in LdapRequest.getReplyBer
    + S8223769: Assert triggers with -XX:+StressReflectiveCode
    + S8224187: Refactor arraycopy_prologue to allow ZGC read
    barriers on arraycopy
    + S8224475: JTextPane does not show images in HTML rendering
    + S8224673: Adjust permission for delayed starting of debugging
    + S8224705: Tests that need to be problem-listed or have
    printer resources
    + S8224778: test/jdk/demo/jfc/J2Ddemo/J2DdemoTest.java cannot
    find J2Ddemo.jar
    + S8224821: java/awt/Focus/NoAutotransferToDisabledCompTest/
    /NoAutotransferToDisabledCompTest.java fails linux-x64
    + S8224830: test/jdk/java/awt/Focus/
    /ModalExcludedWindowClickTest/
    /ModalExcludedWindowClickTest.java fails on linux-x64
    + S8224851: AArch64: fix warnings and errors with Clang and GCC
    8.3
    + S8224905: java/lang/ProcessBuilder/Basic.java#id1 failed with
    stream closed
    + S8225007: java/awt/print/PrinterJob/
    /LandscapeStackOverflow.java may hang
    + S8225105: java/awt/Focus/ShowFrameCheckForegroundTest/
    /ShowFrameCheckForegroundTest.java fails in Windows 10
    + S8225117: java/math/BigInteger/SymmetricRangeTests.java fails
    with ParseException
    + S8225128: Add exception for expiring DocuSign root to
    VerifyCACerts test
    + S8225130: Add exception for expiring Comodo roots to
    VerifyCACerts test
    + S8225144: [macos] In Aqua L&amp;F backspace key does not delete
    when Shift is pressed
    + S8225180: SignedObject with invalid Key not throwing the
    InvalidKeyException in Windows
    + S8225182: JNI exception pending in DestroyXIMCallback of
    awt_InputMethod.c:1327
    + S8225199: [Graal] compiler/jvmci/compilerToVM/
    /IsMatureVsReprofileTest.java fails with
  - XX:CompileThresholdScaling=0.1
    + S8225305: ProblemList java/lang/invoke/VarHandles tests
    + S8225350: compiler/jvmci/compilerToVM/IsCompilableTest.java
    timed out
    + S8225430: Replace wildcard address with loopback or local
    host in tests - part 14
    + S8225435: Upgrade IANA Language Subtag Registry to the latest
    for JDK14
    + S8225487: giflib legal file is missing attribution for
    openbsd-reallocarray.c
    + S8225567: Wrong file headers with 8202414 fix changeset
    + S8225684: [AOT] vmTestbase/vm/oom/production/
    /AlwaysOOMProduction tests fail with AOTed java.base
    + S8225766: Curve in certificate should not affect signature
    scheme when using TLSv1.3
    + S8225797: OldObjectSample event creates unexpected amount of
    checkpoint data
    + S8226381: ProblemList java/lang/reflect/PublicMethods/
    /PublicMethodsTest.java
    + S8226406: JVM fails to detect mismatched or corrupt CDS
    archive
    + S8226608: Hide the onjcmd option from the help output
    + S8226892: ActionListeners on JRadioButtons don't get notified
    when selection is changed with arrow keys
    + S8227112: exclude compiler/intrinsics/sha/sanity tests from
    AOT runs
    + S8227324: Upgrade to freetype 2.10.1
    + S8227528: TestAbortVMOnSafepointTimeout.java failed due to
    "RuntimeException: 'Safepoint sync time longer than' missing
    from stdout/stderr"
    + S8227645: Some tests in serviceability/sa run with fixed -Xmx
    values and risk running out of memory
    + S8227646: [TESTBUG] appcds/SharedArchiveConsistency timed out
    + S8227662: freetype seeks to index at the end of the font data
    + S8228479: Correct the format of ColorChooserDemoTest
    + S8228613: java.security.Provider#getServices order is no
    longer deterministic
    + S8228969: 2019-09-28 public suffix list update
    + S8229236: CriticalJNINatives: dll handling should be done in
    native thread state
    + S8229345: Memory leak due to vtable stubs not being shared on
    SPARC
    + S8229888: (zipfs) Updating an existing zip file does not
    preserve original permissions
    + S8229994: assert(false) failed: Bad graph detected in
    get_early_ctrl_for_expensive
    + S8230004: jdk/internal/jimage/JImageOpenTest.java runs no test
    + S8230235: Rendering HTML with empty img attribute and
    documentBaseKey cause Exception
    + S8230390: Problemlist SA tests with AOT
    + S8230400: Missing constant pool entry for a method in
    stacktrace
    + S8230459: Test failed to resume JVMCI CompilerThread
    + S8230480: check malloc/calloc results in java.desktop
    + S8230597: Update GIFlib library to the 5.2.1
    + S8230611: infinite loop in
    LogOutputList::wait_until_no_readers()
    + S8230624: [TESTBUG] Problemlist JFR
    compiler/TestCodeSweeper.java
    + S8230677: Should disable Escape Analysis if JVMTI capability
    can_get_owned_monitor_info was taken
    + S8230926: [macosx] Two apostrophes are entered instead of one
    with "U.S. International - PC" layout
    + S8231025: Incorrect method tag offset for big endian platform
    + S8231081: TestMetadataRetention fails due to missing symbol id
    + S8231387: java.security.Provider.getService returns random
    result due to race condition with mutating methods in the same
    class
    + S8231430: C2: Memory stomp in max_array_length() for
    T_ILLEGAL type
    + S8231445: check ZALLOC return values in awt coding
    + S8231507: Update Apache Santuario (XML Signature) to version
    2.1.4
    + S8231584: Deadlock with ClassLoader.findLibrary and
    System.loadLibrary call
    + S8231753: use more Posix functionality in aix
    os::print_os_info
    + S8231810: javax/net/ssl/templates/
    /SSLSocketSSLEngineTemplate.java fails intermittently with
    "java.lang.Exception: Unexpected EOF"
    + S8232003: (fs) Files.write can leak file descriptor in the
    exception case
    + S8232056: GetOwnedMonitorInfoWithEATest.java fails with ZGC:
    Heap too small
    + S8232060: add some initializations using sigemptyset in
    os_aix.cpp
    + S8232154: Update Mesa 3-D Headers to version 19.2.1
    + S8232167: Visual Studio install found through
  - -with-tools-dir value is discarded
    + S8232170: FSInfo#getJarClassPath throws an exception not
    declared in its throws clause
    + S8232200: [macos 10.15] Windows in fullscreen tests jumps
    around the screen
    + S8232207: Linux os::available_memory re-reads cgroup
    configuration on every invocation
    + S8232224: [TESTBUG] problemlist JFR TestLargeRootSet.java
    + S8232370: Refactor some com.sun.jdi tests to enable IDE
    integration
    + S8232433: [macos 10.15] java/awt/Window/
    /LocationAtScreenCorner/LocationAtScreenCorner.java may fail
    + S8232571: Add missing SIGINFO signal
    + S8232692: [TESTBUG] compiler/aot/fingerprint/
    /SelfChangedCDS.java fails when cds is disabled
    + S8232713: Update BCEL version to 6.3.1 in license file
    + S8232806: Introduce a system property to disable eager lambda
    initialization
    + S8232834: RunTest sometimes fails to produce valid
    exitcode.txt
    + S8232880: Update test documentation with additional settings
    for client UI tooltip tests
    + S8232950: SUNPKCS11 Provider incorrectly check key length for
    PSS Signatures.
    + S8233018: Add a new test to verify that DatagramSocket is not
    interruptible
    + S8233019: java.lang.Class.isPrimitive() (C1) returns wrong
    result if Klass* is aligned to 32bit
    + S8233032: assert(in_bb(n)) failed: must be
    + S8233078: fix minimal VM build on Linux ppc64(le)
    + S8233328: fix minimal VM build on Linux s390x
    + S8233383: Various minor fixes
    + S8233466: aarch64: remove unnecessary load of mdo when
    profiling return and parameters type
    + S8233491: Crash in AdapterHandlerLibrary::get_adapter with
    CDS due to code cache exhaustion
    + S8233529: loopTransform.cpp:2984: Error: assert(p_f-&gt;Opcode()
    == Op_IfFalse) failed
    + S8233548: Update CUP to v0.11b
    + S8233649: Update ProblemList.txt to exclude failing headful
    tests on macos
    + S8233656: assert(d-&gt;is_CFG() &amp;&amp; n-&gt;is_CFG()) failed: must
    have CFG nodes
    + S8233657: Intermittent NPE in Component.validate()
    + S8234288: Turkey Time Zone returns incorrect time zone name
    + S8234323: NULL-check return value of SurfaceData_InitOps on
    macosx
    + S8234339: replace JLI_StrTok in java_md_solinux.c
    + S8234340: Bump update version for OpenJDK: jdk-11.0.7
    + S8234350: assert(mode == ControlAroundStripMined &amp;&amp; (use ==
    sfpt || !use-&gt;is_reachable_from_root())) failed: missed a node
    + S8234386: [macos] NPE was thrown at expanding Choice from
    maximized frame
    + S8234397: add OS uptime information to os::print_os_info
    output
    + S8234423: Modifying ArrayList.subList().subList() resets
    modCount of subList
    + S8234466: Class loading deadlock involving
    X509Factory#commitEvent()
    + S8234501: remove obsolete NET_ReadV
    + S8234525: enable link-time section-gc for linux s390x to
    remove unused code
    + S8234610: MaxVectorSize set wrongly when UseAVX=3 is
    specified after JDK-8221092
    + S8234617: C1: Incorrect result of field load due to missing
    narrowing conversion
    + S8234723: javax/net/ssl/TLS tests support TLSv1.3
    + S8234724: javax/net/ssl/templates/
    /SSLSocketSSLEngineTemplate.java supports TLSv1.3
    + S8234741: enhance os::get_core_path on macOS
    + S8234769: Duplicate attribution in freetype.md
    + S8234786: Fix for JDK-8214578 breaks OS X 10.12 compatibility
    + S8234809: set relro in linker flags when building with gcc
    + S8234824: java/nio/channels/SocketChannel/AdaptSocket.java
    fails on Windows 10
    + S8235243: handle VS2017 15.9 and VS2019 in abstract_vm_version
    + S8235288: AVX 512 instructions inadvertently used on Xeon for
    small vector width operations
    + S8235325: build failure on Linux after 8235243
    + S8235383: C1 compilation fails with
  - XX:+PrintIRDuringConstruction -XX:+Verbose
    + S8235489: handle return values of sscanf calls in hotspot
    + S8235509: Backport for JDK-8209657 Refactor filemap.hpp to
    simplify integration with Serviceability Agent.
    + S8235510: java.util.zip.CRC32 performance drop after 8200067
    + S8235563: [TESTBUG] appcds/CommandLineFlagComboNegative.java
    does not handle archive mapping failure
    + S8235637: jhsdb jmap from OpenJDK 11.0.5 doesn't work if
    prelink is enabled
    + S8235671: enhance print_rlimit_info in os_posix
    + S8235744: PIT: test/jdk/javax/swing/text/html/
    /TestJLabelWithHTMLText.java times out in linux-x64
    + S8235904: Infinite loop when rendering huge lines
    + S8235998: [c2] Memory leaks during tracing after '8224193:
    stringStream should not use Resource Area'.
    + S8236039: JSSE Client does not accept status_request
    extension in CertificateRequest messages for TLS 1.3
    + S8236140: assert(!VerifyHashTableKeys || _hash_lock == 0)
    failed: remove node from hash table before modifying it
    + S8236179: C1 register allocation error with T_ADDRESS
    + S8236488: Support for configure option
  - -with-native-debug-symbols=internal is impossible on Windows
    + S8236500: Windows ucrt.dll should be looked up in versioned
    WINSDK subdirectory
    + S8236709: struct SwitchRange in HS violates C++ One
    Definition Rule
    + S8236848: [JDK 11u] make run-test-tier1 fails after backport
    of JDK-8232834
    + S8236873: Worker has a deadlock bug
    + S8237217: Incorrect G1StringDedupEntry type used in
    StringDedupTable destructor
    + S8237368: Problem with NullPointerException in RMI
    TCPEndpoint.read
    + S8237375: SimpleThresholdPolicy misses CounterDecay timestamp
    initialization
    + S8237508: Simplify JarFile.isInitializing
    + S8237540: Missing files in backport of JDK-8210910
    + S8237541: Missing files in backport of JDK-8236528
    + S8237600: Test SunJSSEFIPSInit fails on Ubuntu
    + S8237819: s390x - remove unused pd_zero_to_words_large
    + S8237869: exclude jtreg test security/infra/java/security/
    /cert/CertPathValidator/certification/LuxTrustCA.java because
    of instabilities
    + S8237879: make 4.3 breaks build
    + S8237945: CTW: C2 compilation fails with
    assert(just_allocated_object(alloc_ctl) == ptr) failed: most
    recent allo...
    + S8238225: Issues reported after replacing symlink at
    Contents/MacOS/libjli.dylib with binary
    + S8238247: CTW runner should sweep nmethods more aggressively
    + S8238366: CTW runner closes standard output on exit
    + S8238438: SuperWord::co_locate_pack picks memory state of
    first instead of last load
    + S8238502: sunmscapi.dll causing EXCEPTION_ACCESS_VIOLATION
    + S8238534: Deep sign macOS bundles before bundle archive is
    being created
    + S8238591: CTW: Split
    applications/ctw/modules/jdk_localedata.java
    + S8238596: AVX enabled by default for Skylake even when
    unsupported
    + S8238811: C2: assert(i &gt;= req() || i == 0 || is_Region() ||
    is_Phi()) with -XX:+VerifyGraphEdges
    + S8239005: [TESTBUG] test/hotspot/jtreg/runtime/
    /StackGuardPages/TestStackGuardPages.java: exeinvoke.c: must
    initialize static state before calling do_overflow()
    + S8239466: Loss of precision in counter decay calculation in
    11u backport of JDK-8237375
    + S8239856: [ntintel] asserts about copying unaligned array
    element
    + S8240724: [test] jdk11 downport of 8224475 misses binary file
    test/jdk/javax/swing/JTextPane/arrow.png
    + S8241296: Segfault in JNIHandleBlock::oops_do()
- Removed patch:
  * DependOnVariableHelper.patch
    + fixed upstream
- Added patch:
  * JDK-8228407.patch
    + fix crashes due to shared archive file mismatch</changelog>
  <changelog author="fstrba@suse.com" date="1594900800">- Update to upstream tag jdk-11.0.8+10 (July 2020 CPU, bsc#1174157)
  * Security fixes:
    + JDK-8230613: Better ASCII conversions
    + JDK-8231800: Better listing of arrays
    + JDK-8232014: Expand DTD support
    + JDK-8233234: Better Zip Naming
    + JDK-8233239, CVE-2020-14562: Enhance TIFF support
    + JDK-8233255: Better Swing Buttons
    + JDK-8234032: Improve basic calendar services
    + JDK-8234042: Better factory production of certificates
    + JDK-8234418: Better parsing with CertificateFactory
    + JDK-8234836: Improve serialization handling
    + JDK-8236191: Enhance OID processing
    + JDK-8236867, CVE-2020-14573: Enhance Graal interface handling
    + JDK-8237117, CVE-2020-14556: Better ForkJoinPool behavior
    + JDK-8237592, CVE-2020-14577: Enhance certificate verification
    + JDK-8238002, CVE-2020-14581: Better matrix operations
    + JDK-8238013: Enhance String writing
    + JDK-8238804: Enhance key handling process
    + JDK-8238842: AIOOBE in GIFImageReader.initializeStringTable
    + JDK-8238843: Enhanced font handing
    + JDK-8238920, CVE-2020-14583: Better Buffer support
    + JDK-8238925: Enhance WAV file playback
    + JDK-8240119, CVE-2020-14593: Less Affine Transformations
    + JDK-8240482: Improved WAV file playback
    + JDK-8241379: Update JCEKS support
    + JDK-8241522: Manifest improved jar headers redux
    + JDK-8242136, CVE-2020-14621: Better XML namespace handling
  * Other changes:
    + JDK-6933331: (d3d/ogl) java.lang.IllegalStateException:
    Buffers have not been created
    + JDK-7124307: JSpinner and changing value by mouse
    + JDK-8022574: remove HaltNode code after uncommon trap calls
    + JDK-8039082: [TEST_BUG] Test
    java/awt/dnd/BadSerializationTest/BadSerializationTest.java
    fails
    + JDK-8040630: Popup menus and tooltips flicker with previous
    popup contents when first shown
    + JDK-8044365: (dc) MulticastSendReceiveTests.java failing with
    ENOMEM when joining group (OS X 10.9)
    + JDK-8048215: [TESTBUG]
    java/lang/management/ManagementFactory/ThreadMXBeanProxy.java
    Expected non-null LockInfo
    + JDK-8051349: nsk/jvmti/scenarios/sampling/SP06/sp06t003 fails
    in nightly
    + JDK-8080353: JShell: Better error message on attempting to
    add default method
    + JDK-8139876: Exclude hanging nsk/stress/stack from execution
    with deoptimization enabled
    + JDK-8146090: java/lang/ref/ReachabilityFenceTest.java fails
    with -XX:+DeoptimizeALot
    + JDK-8153430: jdk regression test MletParserLocaleTest,
    ParserInfiniteLoopTest reduce default timeout
    + JDK-8156207: Resource allocated BitMaps are often cleared
    unnecessarily
    + JDK-8159740: JShell: corralled declarations do not have
    correct source to wrapper mapping
    + JDK-8175984: ICC_Profile has un-needed, not-empty finalize
    method
    + JDK-8176359: Frame#setMaximizedbounds not working properly in
    multi screen environments
    + JDK-8183369: RFC unconformity of HttpURLConnection with proxy
    + JDK-8187078: -XX:+VerifyOops finds numerous problems when
    running JPRT
    + JDK-8189861: Refactor CacheFind
    + JDK-8191169: java/net/Authenticator/B4769350.java failed
    intermittently
    + JDK-8191930: [Graal] emits unparseable XML into compile log
    + JDK-8193879: Java debugger hangs on method invocation
    + JDK-8196019: java/awt/Window/Grab/GrabTest.java fails on
    Windows
    + JDK-8196181: sun/java2d/GdiRendering/InsetClipping.java fails
    + JDK-8198000:
    java/awt/List/EmptyListEventTest/EmptyListEventTest.java
    debug assert on Windows
    + JDK-8198001: java/awt/Menu/WrongParentAfterRemoveMenu/
    /WrongParentAfterRemoveMenu.java debug assert on Windows
    + JDK-8198339: Test javax/swing/border/Test6981576.java is
    unstable
    + JDK-8200701: jdk/jshell/ExceptionsTest.java fails on Windows,
    after JDK-8198801
    + JDK-8203264: JNI exception pending in
    PlainDatagramSocketImpl.c:740
    + JDK-8203672: JNI exception pending in PlainSocketImpl.c
    + JDK-8203673: JNI exception pending in
    DualStackPlainDatagramSocketImpl.c:398
    + JDK-8204834: Fix confusing "allocate" naming in OopStorage
    + JDK-8205399: Set node color on pinned HashMap.TreeNode
    deletion
    + JDK-8205653: test/jdk/sun/management/jmxremote/bootstrap/
    /RmiRegistrySslTest.java and RmiSslBootstrapTest.sh fail with
    handshake_failure
    + JDK-8206179: com/sun/management/OperatingSystemMXBean/
    /GetCommittedVirtualMemorySize.java fails with Committed
    virtual memory size illegal value
    + JDK-8207334: VM times out in VM_HandshakeAllThreads::doit()
    with RunThese30M
    + JDK-8208277: Code cache heap (-XX:ReservedCodeCacheSize)
    doesn't work with 1GB LargePages
    + JDK-8209113: Use WeakReference for lastFontStrike for created
    Fonts
    + JDK-8209333: Socket reset issue for TLS 1.3 socket close
    + JDK-8209439: C2 library_call can potentially ignore Math.pow
    intrinsic or use null pointer
    + JDK-8209534: [TESTBUG]runtime/appcds/cacheObject/
    /ArchivedModuleCompareTest.java fails with EnableJVMCI.
    + JDK-8210147: adjust some WSAGetLastError usages in windows
    network coding
    + JDK-8210284: "assert((av &amp; 0x00000001) == 0) failed:
    unsupported V8" on Solaris 11.4
    + JDK-8210303: VM_HandshakeAllThreads fails assert with
    "failed: blocked and not walkable"
    + JDK-8210459: Add support for generating compile_commands.json
    + JDK-8210515: [TESTBUG]CheckArchivedModuleApp.java needs to
    check if EnableJVMCI is set.
    + JDK-8210788: Javadoc for Thread.join(long, int) should
    specify that it waits forever when both arguments are zero
    + JDK-8211301: [macos] support full window content options
    + JDK-8211332: Space for stub routines (code_size2) is too
    small on new Skylake CPUs
    + JDK-8211339: NPE during SSL handshake caused by
    HostnameChecker
    + JDK-8211392: compiler/profiling/
    /spectrapredefineclass_classloaders/Launcher.java times out
    in JDK12 CI
    + JDK-8211743: [AOT] crash in ScopeDesc::decode_body() when
    JVMTI walks AOT frames
    + JDK-8212154: [TESTBUG] CheckArchivedModuleApp fails with NPE
    when JVMCI is absent
    + JDK-8212167: JShell : Stack trace of exception has wrong line
    number
    + JDK-8212933: Thread-SMR: requesting a VM operation whilst
    holding a ThreadsListHandle can cause deadlocks
    + JDK-8212986: Make Visual Studio compiler check less strict
    + JDK-8213250: CDS archive creation aborts due to metaspace
    object allocation failure
    + JDK-8213516: jck test api/javax_accessibility/AccessibleState/
    /fields.html fails intermittent
    + JDK-8213947: ARM32: failed check_simd should set
    UsePopCountInstruction to false
    + JDK-8214418: half-closed SSLEngine status may cause
    application dead loop
    + JDK-8214440: ldap over a TLS connection negotiate failed with
    "javax.net.ssl.SSLPeerUnverifiedException: hostname of the
    server does not match the hostname in the server's
    certificate"
    + JDK-8214444: Wrong strncat limits in dfa.cpp
    + JDK-8214481: freetype path does not disable TrueType hinting
    with AA+FM hints
    + JDK-8214571: -Xdoclint of array serialField gives "error:
    array type not allowed here"
    + JDK-8214856: Errors with JSZip in web console after upgrade
    to 3.1.5
    + JDK-8214862: assert(proj != __null) at compile.cpp:3251
    + JDK-8215369: Jcstress pollute /var/tmp with temporary files.
    + JDK-8215551: Missing case label in nmethod::reloc_string_for()
    + JDK-8215555: TieredCompilation C2 threads can excessively
    block handshakes
    + JDK-8215711: Missing key_share extension for (EC)DHE key
    exchange should alert missing_extension
    + JDK-8216151: [Graal] Module
    jdk.internal.vm.compiler.management has not been granted
    accessClassInPackage.org.graalvm.compiler.debug
    + JDK-8216154: C4819 warnings at HotSpot sources on Windows
    + JDK-8216541: CompiledICHolders of VM locked unloaded nmethods
    are released too late
    + JDK-8217230: assert(t == t_no_spec) failure in
    NodeHash::check_no_speculative_types()
    + JDK-8217404: --with-jvm-features doesn't work when multiple
    features are explicitly disabled
    + JDK-8217447: Develop flag TraceICs is broken
    + JDK-8217606: LdapContext#reconnect always opens a new
    connection
    + JDK-8218807: Compilation database (compile_commands.json) may
    contain obsolete items
    + JDK-8219214: Infinite Loop in CodeSection::dump()
    + JDK-8219904: ClassCastException when calling
    FlightRecorderMXBean#getRecordings()
    + JDK-8219991: New fix of the deadlock in
    sun.security.ssl.SSLSocketImpl
    + JDK-8221121: applications/microbenchmarks are encountering
    crashes in tier5
    + JDK-8221445: FastSysexMessage constructor crashes MIDI
    receiption thread
    + JDK-8221482: Initialize VMRegImpl::regName[] earlier to
    prevent assert during PrintStubCode
    + JDK-8221741: ClassCastException can happen when
    fontconfig.properties is used
    + JDK-8221823: Requested JDialog width is ignored
    + JDK-8223108: Test java/awt/EventQueue/
    /NonComponentSourcePost.java is unstable
    + JDK-8223678: Add Visual Studio Code workspace generation
    support (for native code)
    + JDK-8223935: PIT: java/awt/font/WindowsIndicFonts.java fails
    on windows10
    + JDK-8224109: Text spaced incorrectly by drawString under
    rotation with fractional metric
    + JDK-8224632: testbug: java/awt/dnd/RemoveDropTargetCrashTest/
    /RemoveDropTargetCrashTest.java fails on MacOS
    + JDK-8224793: os::die() does not honor CreateCoredumpOnCrash
    option
    + JDK-8224847: gc/stress/TestReclaimStringsLeaksMemory.java
    fails with reserved greater than expected
    + JDK-8224931: disable JAOTC invokedynamic support until
    8223533 is fixed
    + JDK-8224997: ChaCha20-Poly1305 TLS cipher suite decryption
    throws ShortBufferException
    + JDK-8225068: Remove DocuSign root certificate that is
    expiring in May 2020
    + JDK-8225069: Remove Comodo root certificate that is expiring
    in May 2020
    + JDK-8225126: Test SetBoundsPaintTest.html faild on Windows
    when desktop is scaled
    + JDK-8225325: Add tests for redefining a class' private method
    during resolution of the bootstrap specifier
    + JDK-8225622: [AOT] runtime/SharedArchiveFile/
    /TestInterpreterMethodEntries.java crashed with AOTed
    java.base
    + JDK-8225653: Provide more information when hitting SIGILL
    from HaltNode
    + JDK-8225783: Incorrect use of binary operators on booleans in
    type.cpp
    + JDK-8225789: Empty method parameter type should generate
    ClassFormatError
    + JDK-8226198: use of &amp; instead of &amp;&amp; in
    LibraryCallKit::arraycopy_restore_alloc_state
    + JDK-8226253: JAWS reports wrong number of radio buttons when
    buttons are hidden.
    + JDK-8226653: [accessibility] Can edit text cell correctly,
    but Accessibility Tool reads nothing about editor
    + JDK-8226806: [macOS 10.14] Methods of Java Robot should be
    called from appropriate thread
    + JDK-8226879: Memory leak in Type::hashcons
    + JDK-8227632: Incorrect PrintCompilation message: made not
    compilable on levels 0 1 2 3 4
    + JDK-8228407: JVM crashes with shared archive file mismatch
    + JDK-8228482: fix xlc16/xlclang comparison of distinct pointer
    types and string literal conversion warnings
    + JDK-8228757: Fail fast if the handshake type is unknown
    + JDK-8229158: make UseSwitchProfiling non-experimental or
    false by-default
    + JDK-8229421: The logic of java/net/ipv6tests/TcpTest.java is
    flawed
    + JDK-8229855: C2 fails with assert(false) failed: bad AD file
    + JDK-8230591: AArch64: Missing intrinsics for Math.ceil,
    floor, rint
    + JDK-8231118: ARM32: Math tests failures
    + JDK-8231213: Migrate SimpleDateFormatConstTest to JDK Repo
    + JDK-8231243: [TESTBUG] CustomFont.java cannot find font file
    + JDK-8231438: [macOS] Dark mode for the desktop is not
    supported
    + JDK-8231550: C2: ShouldNotReachHere() in
    verify_strip_mined_scheduling
    + JDK-8231564: setMaximizedBounds is broken with large display
    scale and multiple monitors
    + JDK-8231572: Use -lobjc instead of -fobjc-link-runtime in
    libosxsecurity
    + JDK-8231631: sun/net/ftp/FtpURLConnectionLeak.java fails
    intermittently with NPE
    + JDK-8231671: Fix copyright headers in hotspot (missing comma
    after year)
    + JDK-8231720: Some perf regressions after 8225653
    + JDK-8231779: crash
    HeapWord*ParallelScavengeHeap::failed_mem_allocate
    + JDK-8231863: Crash if classpath is read from @argument file
    and the main gets option argument
    + JDK-8232080: jlink plugins for vendor information and
    run-time options
    + JDK-8232106: [x86] C2: SIGILL due to usage of SSSE3
    instructions on processors which don't support it
    + JDK-8232134: Change to Visual Studio 2017 15.9.16 for
    building on Windows at Oracle
    + JDK-8232226: [macos 10.15] test/jdk/java/awt/color/
    /EqualityTest/EqualityTest.java may fail
    + JDK-8232357: Compare version info of Santuario to legal notice
    + JDK-8232572: Add hooks for custom output dir in Bundles.gmk
    + JDK-8232634: Problem List ICMColorDataTest.java
    + JDK-8232748: Build static versions of certain JDK libraries
    + JDK-8232846: ProcessHandle.Info command with non-English
    shows question marks
    + JDK-8232880: Update test documentation with additional
    settings for client UI tooltip tests
    + JDK-8233033: C2 produces wrong result while unswitching a
    loop due to lost control dependencies
    + JDK-8233137: runtime/ErrorHandling/VeryEarlyAssertTest.java
    fails after 8232080
    + JDK-8233197: Invert JvmtiExport::post_vm_initialized() and
    Jfr:on_vm_start() start-up order for correct option parsing
    + JDK-8233291: [TESTBUG] tools/jlink/plugins/
    /VendorInfoPluginsTest.java fails with debug or non-server VMs
    + JDK-8233364: Fix undefined behavior in
    Canonicalizer::do_ShiftOp
    + JDK-8233494: Avoid calling MallocTracker::record_malloc and
    record_free when NMT is off
    + JDK-8233573: Toolkit.getScreenInsets(GraphicsConfiguration)
    may throw ClassCastException
    + JDK-8233608: Minimal build broken after JDK-8233494
    + JDK-8233621: Mismatch in jsse.enableMFLNExtension property
    name
    + JDK-8233696: [TESTBUG]Some jtreg tests fail when CAPS_LOCK is
    ON
    + JDK-8233707: systemScale.cpp could not compile with VS2019
    + JDK-8233801: GCMEmptyIv.java test fails on Solaris 11.4
    + JDK-8233880: Support compilers with multi-digit major version
    numbers
    + JDK-8233920: MethodHandles::tryFinally generates illegal
    bytecode for long/double return type
    + JDK-8234137: The "AutoTestOnTop.java" test may run external
    applications
    + JDK-8234146: compiler/jsr292/
    /ContinuousCallSiteTargetChange.java times out on SPARC
    + JDK-8234184: [TESTBUG] java/awt/Mouse/EnterExitEvents/
    /ModalDialogEnterExitEventsTest.java fails in Windows
    + JDK-8234270: [REDO] JDK-8204128 NMT might report incorrect
    numbers for Compiler area
    + JDK-8234332: [TESTBUG] java/awt/Focus/DisposedWindow/
    /DisposeDialogNotActivateOwnerTest/
    /DisposeDialogNotActivateOwnerTest.java fails on linux-x64
    nightly
    + JDK-8234398: Replace ID2D1Factory::GetDesktopDpi with
    GetDeviceCaps
    + JDK-8234522: [macos] Crash with use of native file dialog
    + JDK-8234691: Potential double-free in ParallelSPCleanupTask
    constructor
    + JDK-8234696: tools/jlink/plugins/VendorInfoPluginsTest.java
    times out
    + JDK-8234727: sun/security/ssl/X509TrustManagerImpl tests
    support TLSv1.3
    + JDK-8234728: Some security tests should support TLSv1.3
    + JDK-8234779: Provide idiom for declaring classes noncopyable
    + JDK-8234824: java/nio/channels/SocketChannel/AdaptSocket.java
    fails on Windows 10
    + JDK-8234968: check calloc rv in libinstrument
    InvocationAdapter
    + JDK-8235153: [TESTBUG] [macos 10.15] java/awt/Graphics/
    /DrawImageBG/SystemBgColorTest.java fails
    + JDK-8235183: Remove the "HACK CODE" in comment
    + JDK-8235263: Revert TLS 1.3 change that wrapped IOExceptions
    + JDK-8235311: Tag mismatch may alert bad_record_mac
    + JDK-8235332: TestInstanceCloneAsLoadsStores.java fails with
  - XX:+StressGCM
    + JDK-8235452: Strip mined loop verification fails with
    assert(is_OuterStripMinedLoop()) failed: invalid node class
    + JDK-8235584: UseProfiledLoopPredicate fails with
    assert(_phase-&gt;get_loop(c) == loop) failed: have to be in the
    same loop
    + JDK-8235620: Broken merge between JDK-8006406 and JDK-8003559
    + JDK-8235638: NPE in LWWindowPeer.getOnscreenGraphics()
    + JDK-8235686: Add more custom hooks in Bundles.gmk
    + JDK-8235739: Rare NPE at WComponentPeer.getGraphics()
    + JDK-8235762: JVM crash in SWPointer during C2 compilation
    + JDK-8235834: IBM-943 charset encoder needs updating
    + JDK-8235874: The ordering of Cipher Suites is not maintained
    provided through jdk.tls.client.cipherSuites and
    jdk.tls.server.cipherSuites system property.
    + JDK-8235908: omit ThreadPriorityPolicy warning when value is
    set from image
    + JDK-8235984: C2: assert(out-&gt;in(PhiNode::Region) == head ||
    out-&gt;in(PhiNode::Region) == slow_head) failed: phi must be
    either part of the slow or the fast loop
    + JDK-8236211: [Graal] compiler/graalunit/GraphTest.java is
    skipped in all testing
    + JDK-8236470: Deal with ECDSA using ecdsa-with-SHA2 plus hash
    algorithm as AlgorithmId
    + JDK-8236545: Compilation error in mach5
    java/awt/FileDialog/MacOSGoToFolderCrash.java
    + JDK-8236700: Upgrading JSZip from v3.1.5 to v3.2.2
    + JDK-8236759: ShouldNotReachHere in
    PhaseIdealLoop::verify_strip_mined_scheduling
    + JDK-8236897: Fix the copyright header for pkcs11gcm2.h
    + JDK-8236921: Add build target to produce a JDK image suitable
    for a Graal/SVM build
    + JDK-8236953: [macos] JavaFX SwingNode is not rendered on macOS
    + JDK-8236996: Incorrect Roboto font rendering on Windows with
    subpixel antialiasing
    + JDK-8237045: JVM uses excessive memory with -XX:+EnableJVMCI
  - XX:JVMCICounterSize=2147483648
    + JDK-8237055: [TESTBUG] compiler/c2/TestJumpTable.java fails
    with release VMs
    + JDK-8237086: assert(is_MachReturn()) running CTW with fix for
    JDK-8231291
    + JDK-8237192: Generate stripped/public pdbs on Windows for jdk
    images
    + JDK-8237396: JvmtiTagMap::weak_oops_do() should not trigger
    barriers
    + JDK-8237474: Default SSLEngine should create in server role
    + JDK-8237859: C2: Crash when loads float above range check
    + JDK-8237879: make 4.3 breaks build
    + JDK-8237951: CTW: C2 compilation fails with "malformed
    control flow"
    + JDK-8237962: give better error output for invalid OCSP
    response intervals in CertPathValidator checks
    + JDK-8238190: [JVMCI] Fix single implementor speculation for
    diamond shapes.
    + JDK-8238356: CodeHeap::blob_count() overestimates the number
    of blobs
    + JDK-8238452: Keytool generates wrong expiration date if
    validity is set to 2050/01/01
    + JDK-8238555: Allow Initialization of SunPKCS11 with NSS when
    there are external FIPS modules in the NSSDB
    + JDK-8238575: DragSourceEvent.getLocation() returns wrong
    value on HiDPI screens (Windows)
    + JDK-8238676: jni crashes on accessing it from process exit
    hook
    + JDK-8238721: Add failing client jtreg tests to the Problem
    List
    + JDK-8238738: AudioSystem.getMixerInfo() takes about 30 sec to
    report a gone audio device
    + JDK-8238756: C2: assert(((n) == __null || !VerifyIterativeGVN
    || !((n)-&gt;is_dead()))) failed: can not use dead node
    + JDK-8238765: PhaseCFG::schedule_pinned_nodes cannot handle
    precedence edges from unmatched CFG nodes correctly
    + JDK-8238898: Missing hash characters for header on license
    file
    + JDK-8238942: Rendering artifacts with LCD text and fractional
    metrics
    + JDK-8238985: [TESTBUG] The arrow image is blue instead of
    green
    + JDK-8239000: handle ContendedPaddingWidth in vm_version_ppc
    + JDK-8239055: Wrong implementation of VMState.hasListener
    + JDK-8239091: Reversed arguments in call to strstr in freetype
    "debug" code.
    + JDK-8239142: C2's UseUniqueSubclasses optimization is broken
    for array accesses
    + JDK-8239224: libproc_impl.c previous_thr may be used
    uninitialized warning
    + JDK-8239351: Give more meaningful InternalError messages in
    Deflater.c
    + JDK-8239365: ProcessBuilder test modifications for AIX
    execution
    + JDK-8239456: vtable stub generation: assert failure (code
    size estimate)
    + JDK-8239457: call ReleaseStringUTFChars before early returns
    in Java_sun_security_pkcs11_wrapper_PKCS11_connect
    + JDK-8239462: jdk.hotspot.agent misses some
    ReleaseStringUTFChars calls in case of early returns
    + JDK-8239557: [TESTBUG] VeryEarlyAssertTest.java validating
    "END." marker at lastline is not always true
    + JDK-8239787: AArch64: String.indexOf may incorrectly handle
    empty strings
    + JDK-8239792: Bump update version for OpenJDK: jdk-11.0.8
    + JDK-8239798: SSLSocket closes socket both socket endpoints on
    a SocketTimeoutException
    + JDK-8239819: XToolkit: Misread of screen information memory
    + JDK-8239852: java/util/concurrent tests fail with
  - XX:+VerifyGraphEdges: assert(!VerifyGraphEdges) failed:
    verification should have failed
    + JDK-8239893: Windows handle Leak when starting processes
    using ProcessBuilder
    + JDK-8239915: Zero VM crashes when handling dynamic constant
    + JDK-8239931: [win][x86] vtable stub generation: assert
    failure (code size estimate) follow-up
    + JDK-8239965: XMLEncoder/Test4625418.java fails due to "Error:
    Cp943 - can't read properly"
    + JDK-8239976: Put JDK-8239965 on the ProblemList.txt
    + JDK-8240073: Fix 'test-make' build target in 11u
    + JDK-8240197: Cannot start JVM when $JAVA_HOME includes CJK
    characters
    + JDK-8240202: A few client tests leave mouse buttons pressed
    + JDK-8240220: IdealLoopTree::dump_head predicate printing is
    broken
    + JDK-8240223: Use consistent predicate order in and with
    PhaseIdealLoop::find_predicate
    + JDK-8240227: Loop predicates should be copied to unswitched
    loops
    + JDK-8240286: [TESTBUG] Test command error in hotspot/jtreg/
    /compiler/loopopts/superword/SumRedAbsNeg_Float.java
    + JDK-8240518: Incorrect JNU_ReleaseStringPlatformChars in
    Windows Print
    + JDK-8240529: CheckUnhandledOops breaks NULL check in
    Modules::define_module
    + JDK-8240576: JVM crashes after transformation in C2
    IdealLoopTree::merge_many_backedges
    + JDK-8240603: Windows 32bit compile error after 8238676
    + JDK-8240629: argfiles parsing broken for argfiles with
    comment cross 4096 bytes chunk
    + JDK-8240711: TestJstatdPort.java failed due to
    "ExportException: Port already in use:"
    + JDK-8240786: [TESTBUG] The test java/awt/Window/
    /GetScreenLocation/GetScreenLocationTest.java fails on HiDPI
    screen
    + JDK-8240824: enhance print_full_memory_info on Linux by THP
    related information
    + JDK-8240827: Downport SSLSocketImpl.java from "8221882: Use
    fiber-friendly java.util.concurrent.locks in JSSE"
    + JDK-8240905: assert(mem == (Node*)1 || mem == mem2) failed:
    multiple Memories being matched at once?
    + JDK-8240972: macOS codesign fail on macOS 10.13.5 or older
    + JDK-8241445: Fix copyright in
    test/jdk/tools/launcher/ArgFileSyntax.java
    + JDK-8241458: [JVMCI] add mark value to expose
    CodeOffsets::Frame_Complete
    + JDK-8241464: [11u] Backport: make rehashing be a needed
    guaranteed safepoint cleanup action
    + JDK-8241556: Memory leak if -XX:CompileCommand is set
    + JDK-8241568: (fs) UserPrincipalLookupService.lookupXXX
    failure with IOE "Operation not permitted"
    + JDK-8241586: compiler/cpuflags/
    /TestAESIntrinsicsOnUnsupportedConfig.java fails on aarch64
    + JDK-8241638: launcher time metrics always report 1 on Linux
    when _JAVA_LAUNCHER_DEBUG set
    + JDK-8241660: Add virtualization information output to hs_err
    file on macOS
    + JDK-8241808: [TESTBUG] The JDK-8039467 bug appeared on macOS
    + JDK-8241888: Mirror jdk.security.allowNonCaAnchor system
    property with a security one
    + JDK-8241900: Loop unswitching may cause dependence on null
    check to be lost
    + JDK-8241948: enhance list of environment variables printed in
    hs_err file
    + JDK-8241996: on linux set full relro in the linker flags
    + JDK-8242108: Performance regression after fix for JDK-8229496
    + JDK-8242141: New System Properties to configure the TLS
    signature schemes
    + JDK-8242154: Backport parts of JDK-4947890 to OpenJDK 11u
    + JDK-8242174: [macos] The NestedModelessDialogTest test make
    the macOS unstable
    + JDK-8242239: [Graal] javax/management/generified/
    /GenericTest.java fails: FAILED: queryMBeans sets same
    + JDK-8242294: JSSE Client does not throw SSLException when an
    alert occurs during handshaking
    + JDK-8242379: [TESTBUG] compiler/loopopts/
    /TestLoopUnswitchingLostCastDependency.java fails with
    release VMs
    + JDK-8242470: Update Xerces to Version 2.12.1
    + JDK-8242498: Invalid "sun.awt.TimedWindowEvent" object leads
    to JVM crash
    + JDK-8242541: Small charset issues (ISO8859-16, x-eucJP-Open,
    x-IBM834 and x-IBM949C)
    + JDK-8242626: enhance posix print_rlimit_info
    + JDK-8243059: Build fails when --with-vendor-name contains a
    comma
    + JDK-8243539: Copyright info (Year) should be updated for fix
    of 8241638
    + JDK-8243541: (tz) Upgrade time-zone data to tzdata2020a
    + JDK-8244407: JVM crashes after transformation in C2
    IdealLoopTree::split_fall_in
    + JDK-8244520: problemlist
    java/awt/font/Rotate/RotatedFontTest.java on linux
    + JDK-8244777: ClassLoaderStats VM Op uses constant hash value
    + JDK-8244853: The static build of libextnet is missing the
    JNI_OnLoad_extnet function
    + JDK-8244951: Missing entitlements for hardened runtime
    + JDK-8245047: [PPC64] C2: ReverseBytes + Load always match to
    unordered Load (acquire semantics missing)
    + JDK-8245649: Revert 8245397 backport of 8230591
    + JDK-8246031: SSLSocket.getSession() doesn't close connection
    for timeout/ interrupts
    + JDK-8246613: Choose the default SecureRandom algo based on
    registration ordering
    + JDK-8248505: Unexpected NoSuchAlgorithmException when using
    secure random impl from BCFIPS provider
- Removed patch:
  * JDK-8228407.patch
    + integrated upstream</changelog>
  <changelog author="fstrba@suse.com" date="1604318400">- Update to upstream tag jdk-11.0.9-11 (October 2020 CPU,
  bsc#1177943)
  * New features
    + JDK-8250784: Shenandoah: A Low-Pause-Time Garbage Collector
  * Security fixes
    + JDK-8233624: Enhance JNI linkage
    + JDK-8236196: Improve string pooling
    + JDK-8236862, CVE-2020-14779: Enhance support of Proxy class
    + JDK-8237990, CVE-2020-14781: Enhanced LDAP contexts
    + JDK-8237995, CVE-2020-14782: Enhance certificate processing
    + JDK-8240124: Better VM Interning
    + JDK-8241114, CVE-2020-14792: Better range handling
    + JDK-8242680, CVE-2020-14796: Improved URI Support
    + JDK-8242685, CVE-2020-14797: Better Path Validation
    + JDK-8242695, CVE-2020-14798: Enhanced buffer support
    + JDK-8243302: Advanced class supports
    + JDK-8244136, CVE-2020-14803: Improved Buffer supports
    + JDK-8244479: Further constrain certificates
    + JDK-8244955: Additional Fix for JDK-8240124
    + JDK-8245407: Enhance zoning of times
    + JDK-8245412: Better class definitions
    + JDK-8245417: Improve certificate chain handling
    + JDK-8248574: Improve jpeg processing
    + JDK-8249927: Specify limits of jdk.serialProxyInterfaceLimit
    + JDK-8253019: Enhanced JPEG decoding
  * Other changes
    + JDK-6532025: GIF reader throws misleading exception with
    truncated images
    + JDK-6949753: [TEST BUG]: java/awt/print/PageFormat/
    /PDialogTest.java needs update by removing an infinite loop
    + JDK-8022535: [TEST BUG] javax/swing/text/html/parser/
    /Test8017492.java fails
    + JDK-8062947: Fix exception message to correctly represent
    LDAP connection failure
    + JDK-8067354: com/sun/jdi/GetLocalVariables4Test.sh failed
    + JDK-8134599: TEST_BUG: java/rmi/transport/closeServerSocket/
    /CloseServerSocket.java fails intermittently with Address
    already in use
    + JDK-8151678: com/sun/jndi/ldap/LdapTimeoutTest.java failed
    due to timeout on DeadServerNoTimeoutTest is incorrect
    + JDK-8160768: Add capability to custom resolve host/domain
    names within the default JNDI LDAP provider
    + JDK-8172404: Tools should warn if weak algorithms are used
    before restricting them
    + JDK-8193367: Annotated type variable bounds crash javac
    + JDK-8202117: com/sun/jndi/ldap/RemoveNamingListenerTest.java
    fails intermittently: Connection reset
    + JDK-8203026: java.rmi.NoSuchObjectException: no such object
    in table
    + JDK-8203281: [Windows] JComboBox change in ui when
    editor.setBorder() is called
    + JDK-8203382: Rename SystemDictionary::initialize_wk_klass to
    resolve_wk_klass
    + JDK-8203393: com/sun/jdi/JdbMethodExitTest.sh and
    JdbExprTest.sh fail due to timeout
    + JDK-8203928: [Test] Convert non-JDB scaffolding
    serviceability shell script tests to java
    + JDK-8204963: javax.swing.border.TitledBorder has a memory leak
    + JDK-8204994: SA might fail to attach to process with "Windbg
    Error: WaitForEvent failed"
    + JDK-8205534: Remove SymbolTable dependency from
    serviceability agent
    + JDK-8206309: Tier1 SA tests fail
    + JDK-8208281: java/nio/channels/
    /AsynchronousSocketChannel/Basic.java timed out
    + JDK-8209109: [TEST] rewrite com/sun/jdi shell tests to java
    version - step1
    + JDK-8209332: [TEST] test/jdk/com/sun/jdi/CatchPatternTest.sh
    is incorrect
    + JDK-8209342: Problemlist SA tests on Solaris due to Error
    attaching to process: Can't create thread_db agent!
    + JDK-8209343: Test javax/swing/border/TestTitledBorderLeak.java
    should be marked as headful
    + JDK-8209517: com/sun/jdi/BreakpointWithFullGC.java fails with
    timeout
    + JDK-8209604: [TEST] rewrite com/sun/jdi shell tests to java
    version - step2
    + JDK-8209605: com/sun/jdi/BreakpointWithFullGC.java fails with
    ZGC
    + JDK-8209608: Problem list com/sun/jdi/BreakpointWithFullGC.java
    + JDK-8210131: vmTestbase/nsk/jvmti/scenarios/allocation/AP10/
    /ap10t001/TestDescription.java failed with ObjectFree:
    GetCurrentThreadCpuTimerInfo returned unexpected error code
    + JDK-8210243: [TEST] rewrite com/sun/jdi shell tests to java
    version - step3
    + JDK-8210527: JShell: NullPointerException in
    jdk.jshell.Eval.translateExceptionStack
    + JDK-8210560: [TEST] convert com/sun/jdi redefineClass-related
    tests
    + JDK-8210725: com/sun/jdi/RedefineClearBreakpoint.java fails
    with waitForPrompt timed out after 60 seconds
    + JDK-8210748: [TESTBUG] lib.jdb.Jdb.waitForPrompt() should
    clarify which output is the pending reply after a timeout
    + JDK-8210760: [TEST] rewrite com/sun/jdi shell tests to java
    version - step4
    + JDK-8210977: jdk/jfr/event/oldobject/TestThreadLocalLeak.java
    fails to find ThreadLocalObject
    + JDK-8211292: [TEST] convert com/sun/jdi/DeferredStepTest.sh
    test
    + JDK-8211694: JShell: Redeclared variable should be reset
    + JDK-8212200: assert when shared java.lang.Object is redefined
    by JVMTI agent
    + JDK-8212629: [TEST] wrong breakpoint in
    test/jdk/com/sun/jdi/DeferredStepTest
    + JDK-8212665: com/sun/jdi/DeferredStepTest.java: jj1 (line 57)
  - unexpected. lastLine=52, minLine=52, maxLine=55
    + JDK-8212807: tools/jar/multiRelease/Basic.java times out
    + JDK-8213182: Minimal VM build failure after JDK-8212200
    (assert when shared java.lang.Object is redefined by JVMTI
    agent)
    + JDK-8213214: Set -Djava.io.tmpdir= when running tests
    + JDK-8213275: ReplaceCriticalClasses.java fails with
    jdk.internal.vm.PostVMInitHook not found
    + JDK-8213574: Deadlock in string table expansion when dumping
    lots of CDS classes
    + JDK-8213703: LambdaConversionException: Invalid receiver type
    not a subtype of implementation type interface
    + JDK-8214074: Ghash optimization using AVX instructions
    + JDK-8214491: Upgrade to JLine 3.9.0
    + JDK-8214797: TestJmapCoreMetaspace.java timed out
    + JDK-8215243: JShell tests failing intermitently with
    "Problem cleaning up the following threads:"
    + JDK-8215244: jdk/jshell/ToolBasicTest.java
    testHistoryReference failed
    + JDK-8215354: x86_32 build failures after JDK-8214074 (Ghash
    optimization using AVX instructions)
    + JDK-8215438: jshell tool: Ctrl-D causes EOF
    + JDK-8216021: RunTest.gmk might set concurrency level to 1 on
    Windows
    + JDK-8216974: HttpConnection not returned to the pool after
    204 response
    + JDK-8218948: SimpleDateFormat :: format - Zone Names are not
    reflected correctly during run time
    + JDK-8219712: code_size2 (defined in stub_routines_x86.hpp) is
    too small on new Skylake CPUs
    + JDK-8220150: macos10.14 Mojave returns anti-aliased glyphs
    instead of aliased B&amp;W glyphs
    + JDK-8221658: aarch64: add necessary predicate for ubfx
    patterns
    + JDK-8221759: Crash when completing "java.io.File.path"
    + JDK-8221918: runtime/SharedArchiveFile/serviceability/
    /ReplaceCriticalClasses.java fails: Shared archive not found
    + JDK-8222074: Enhance auto vectorization for x86
    + JDK-8222079: Don't use memset to initialize fields decode_env
    constructor in disassembler.cpp
    + JDK-8222769: [TESTBUG] TestJFRNetworkEvents should not rely
    on hostname command
    + JDK-8223688: JShell: crash on the instantiation of raw
    anonymous class
    + JDK-8223777: In posix_spawn mode, failing to exec()
    jspawnhelper does not result in an error
    + JDK-8223940: Private key not supported by chosen signature
    algorithm
    + JDK-8224184: jshell got IOException at exiting with AIX
    + JDK-8224234: compiler/codegen/TestCharVect2.java fails in
    test_mulc
    + JDK-8225037: java.net.JarURLConnection::getJarEntry() throws
    NullPointerException
    + JDK-8225625: AES Electronic Codebook (ECB) encryption and
    decryption optimization using AVX512 + VAES instructions
    + JDK-8226536: Catch OOM from deopt that fails rematerializing
    objects
    + JDK-8226575: OperatingSystemMXBean should be made container
    aware
    + JDK-8226697: Several tests which need the @key headful
    keyword are missing it.
    + JDK-8226809: Circular reference in printed stack trace is not
    correctly indented &amp; ambiguous
    + JDK-8227059: sun/security/tools/keytool/
    /DefaultSignatureAlgorithm.java timed out
    + JDK-8227269: Slow class loading when running with JDWP
    + JDK-8227595: keytool/fakegen/DefaultSignatureAlgorithm.java
    fails due to "exitValue = 6"
    + JDK-8228448: Jconsole can't connect to itself
    + JDK-8228967: Trust/Key store and SSL context utilities for
    tests
    + JDK-8229378: jdwp library loader in linker_md.c quietly
    truncates on buffer overflow
    + JDK-8229815: Upgrade Jline to 3.12.1
    + JDK-8230000: some httpclients testng tests run zero test
    + JDK-8230002: javax/xml/jaxp/unittest/transform/
    /SecureProcessingTest.java runs zero test
    + JDK-8230010: Remove jdk8037819/BasicTest1.java
    + JDK-8230094: CCE in createXMLEventWriter(Result) over an
    arbitrary XMLStreamWriter
    + JDK-8230402: Allocation of compile task fails with assert:
    "Leaking compilation tasks?"
    + JDK-8230767: FlightRecorderListener returns null recording
    + JDK-8230870: (zipfs) Add a ZIP FS test that is similar to
    test/jdk/java/util/zip/EntryCount64k.java
    + JDK-8231209: [REDO] ThreadMXBean::getThreadAllocatedBytes()
    can be quicker for self thread
    + JDK-8231586: enlarge encoding space for OopMapValue offsets
    + JDK-8231953: Wrong assumption in assertion in
    oop::register_oop
    + JDK-8231968: getCurrentThreadAllocatedBytes default
    implementation s/b getThreadAllocatedBytes
    + JDK-8232083: Minimal VM is broken after JDK-8231586
    + JDK-8232161: Align some one-way conversion in MS950 charset
    with Windows
    + JDK-8232855: jshell missing word in /help help
    + JDK-8233027: OopMapSet::all_do does oms.next() twice during
    iteration
    + JDK-8233228: Disable weak named curves by default in TLS,
    CertPath, and Signed JAR
    + JDK-8233386: Initialize NULL fields for unused decorations
    + JDK-8233452: java.math.BigDecimal.sqrt() with
    RoundingMode.FLOOR results in incorrect result
    + JDK-8233686: XML transformer uses excessive amount of memory
    + JDK-8233741: AES Countermode (AES-CTR) optimization using
    AVX512 + VAES instructions
    + JDK-8233829: javac cannot find non-ASCII module name under
    non-UTF8 environment
    + JDK-8233958: Memory retention due to HttpsURLConnection
    finalizer that serves no purpose
    + JDK-8234011: (zipfs) Memory leak in
    ZipFileSystem.releaseDeflater()
    + JDK-8234058: runtime/CompressedOops/
    /CompressedClassPointers.java fails with 'Narrow klass base:
    0x0000000000000000' missing from stdout/stderr
    + JDK-8234149: Several regression tests do not dispose Frame at
    end
    + JDK-8234347: "Turkey" meta time zone does not generate
    composed localized names
    + JDK-8234385: [TESTBUG] java/awt/EventQueue/6980209/
    /bug6980209.java fails in linux nightly
    + JDK-8234535: Cross compilation fails due to missing CFLAGS
    for the BUILD_CC
    + JDK-8234541: C1 emits an empty message when it inlines
    successfully
    + JDK-8234687: change javap reporting on unknown attributes
    + JDK-8236464: SO_LINGER option is ignored by SSLSocket in JDK
    11
    + JDK-8236548: Localized time zone name inconsistency between
    English and other locales
    + JDK-8236617: jtreg test containers/docker/
    /TestMemoryAwareness.java fails after 8226575
    + JDK-8237182: Update copyright header for shenandoah and
    epsilon files
    + JDK-8237888: security/infra/java/security/cert/
    /CertPathValidator/certification/LuxTrustCA.java fails when
    checking validity interval
    + JDK-8237977: Further update
    javax/net/ssl/compatibility/Compatibility.java
    + JDK-8238270: java.net HTTP/2 client does not decrease stream
    count when receives 204 response
    + JDK-8238284: [macos] Zero VM build fails due to an obvious
    typo
    + JDK-8238380: java.base/unix/native/libjava/childproc.c
    "multiple definition" link errors with GCC10
    + JDK-8238386: (sctp) jdk.sctp/unix/native/libsctp/SctpNet.c
    "multiple definition" link errors with GCC10
    + JDK-8238388: libj2gss/NativeFunc.o "multiple definition" link
    errors with GCC10
    + JDK-8238448: RSASSA-PSS signature verification fail when
    using certain odd key sizes
    + JDK-8238710: LingeredApp doesn't log stdout/stderr if exits
    with non-zero code
    + JDK-8239083: C1 assert(known_holder == NULL ||
    (known_holder-&gt;is_instance_klass() &amp;&amp;
    (!known_holder-&gt;is_interface() ||
    ((ciInstanceKlass*)known_holder)-&gt;has_nonstatic_concrete_methods())),
    "should be non-static concrete method");
    + JDK-8239385: KerberosTicket client name refers wrongly to
    sAMAccountName in AD
    + JDK-8240169: javadoc fails to link to non-modular api docs
    + JDK-8240295: hs_err elapsed time in seconds is not accurate
    enough
    + JDK-8240360: NativeLibraryEvent has wrong library name on
    Linux
    + JDK-8240676: Meet not symmetric failure when running lucene
    on jdk8
    + JDK-8241007: Shenandoah: remove
    ShenandoahCriticalControlThreadPriority support
    + JDK-8241065: Shenandoah: remove leftover code after
    JDK-8231086
    + JDK-8241086: Test runtime/NMT/HugeArenaTracking.java is
    failing on 32bit Windows
    + JDK-8241130: com.sun.jndi.ldap.EventSupport.removeDeadNotifier:
    java.lang.NullPointerException
    + JDK-8241138: http.nonProxyHosts=* causes
    StringIndexOutOfBoundsException in DefaultProxySelector
    + JDK-8241319: WB_GetCodeBlob doesn't have ResourceMark
    + JDK-8241478: vmTestbase/gc/gctests/Steal/steal001/steal001.java
    fails with OOME
    + JDK-8241574: Shenandoah: remove ShenandoahAssertToSpaceClosure
    + JDK-8241750: x86_32 build failure after JDK-8227269
    + JDK-8242184: CRL generation error with RSASSA-PSS
    + JDK-8242283: Can't start JVM when java home path includes
    non-ASCII character
    + JDK-8242556: Cannot load RSASSA-PSS public key with non-null
    params from byte array
    + JDK-8243029: Rewrite javax/net/ssl/compatibility/
    /Compatibility.java with a flexible interop test framework
    + JDK-8243138: Enhance BaseLdapServer to support starttls
    extended request
    + JDK-8243320: Add SSL root certificates to Oracle Root CA
    program
    + JDK-8243321: Add Entrust root CA - G4 to Oracle Root CA
    program
    + JDK-8243389: enhance os::pd_print_cpu_info on linux
    + JDK-8243453: java --describe-module failed with non-ASCII
    module name under non-UTF8 environment
    + JDK-8243470: [macos] bring back O2 opt level for unsafe.cpp
    + JDK-8243489: Thread CPU Load event may contain wrong data for
    CPU time under certain conditions
    + JDK-8243925: Toolkit#getScreenInsets() returns wrong value on
    HiDPI screens (Windows)
    + JDK-8244087: 2020-04-24 public suffix list update
    + JDK-8244151: Update MUSCLE PC/SC-Lite headers to the latest
    release 1.8.26
    + JDK-8244164: AArch64: jaotc generates incorrect code for
    compressed OOPs with non-zero heap base
    + JDK-8244196: adjust output in os_linux
    + JDK-8244225: stringop-overflow warning on strncpy call from
    compile_the_world_in
    + JDK-8244287: JFR: Methods samples have line number 0
    + JDK-8244703: "platform encoding not initialized" exceptions
    with debugger, JNI
    + JDK-8244719: CTW: C2 compilation fails with
    "assert(!VerifyHashTableKeys || _hash_lock == 0) failed:
    remove node from hash table before modifying it"
    + JDK-8244729: Shenandoah: remove resolve paths from
    SBSA::generate_shenandoah_lrb
    + JDK-8244763: Update --release 8 symbol information after JSR
    337 MR3
    + JDK-8244818: Java2D Queue Flusher crash while moving
    application window to external monitor
    + JDK-8245151: jarsigner should not raise duplicate warnings on
    verification
    + JDK-8245616: Bump update version for OpenJDK: jdk-11.0.9
    + JDK-8245714: "Bad graph detected in build_loop_late" when
    loads are pinned on loop limit check uncommon branch
    + JDK-8245801: StressRecompilation triggers assert "redundunt
    OSR recompilation detected. memory leak in CodeCache!"
    + JDK-8245832: JDK build make-static-libs should build all JDK
    libraries
    + JDK-8245880: Shenandoah: check class unloading flag early in
    concurrent code root scan
    + JDK-8245981: Upgrade to jQuery 3.5.1
    + JDK-8246027: Minimal fastdebug build broken after JDK-8245801
    + JDK-8246094: [macos] Sound Recording and playback is not
    working
    + JDK-8246153: TestEliminateArrayCopy fails with
  - XX:+StressReflectiveCode
    + JDK-8246193: Possible NPE in ENC-PA-REP search in AS-REQ
    + JDK-8246196: javax/management/MBeanServer/OldMBeanServerTest
    fails with AssertionError
    + JDK-8246203: Segmentation fault in verification due to stack
    overflow with -XX:+VerifyIterativeGVN
    + JDK-8246330: Add TLS Tests for Legacy ECDSA curves
    + JDK-8246453: TestClone crashes with "all collected exceptions
    must come from the same place"
    + JDK-8247246: Add explicit ResolvedJavaType.link and expose
    presence of default methods
    + JDK-8247350: [aarch64] assert(false) failed: wrong size of
    mach node
    + JDK-8247502: PhaseStringOpts crashes while optimising
    effectively dead code
    + JDK-8247615: Initialize the bytes left for the heap sampler
    + JDK-8247824: CTW: C2 (Shenandoah) compilation fails with SEGV
    in SBC2Support::pin_and_expand
    + JDK-8247874: Replacement in VersionProps.java.template not
    working when --with-vendor-bug-url contains '&amp;'
    + JDK-8247979: aarch64: missing side effect of killing flags
    for clearArray_reg_reg
    + JDK-8248214: Add paddings for TaskQueueSuper to reduce
    false-sharing cache contention
    + JDK-8248219: aarch64: missing memory barrier in
    fast_storefield and fast_accessfield
    + JDK-8248348: Regression caused by the update to BCEL 6.0
    + JDK-8248385: [testbug][11u] Adapt TestInitiExceptions to
    jtreg 5.1
    + JDK-8248495: [macos] zerovm is broken due to libffi headers
    location
    + JDK-8248851: CMS: Missing memory fences between free chunk
    check and klass read
    + JDK-8248987: AOT's Linker.java seems to eagerly fail-fast on
    Windows
    + JDK-8249159: Downport test rework for SSLSocketTemplate from
    8224650
    + JDK-8249215: JFrame::setVisible crashed with
  - Dfile.encoding=UTF-8 on Japanese Windows.
    + JDK-8249251: [dark_mode ubuntu 20.04] The selected menu is
    not highlighted in GTKLookAndFeel
    + JDK-8249255: Build fails if source code in cygwin home dir
    + JDK-8249277: TestVerifyIterativeGVN.java is failing with
    timeout in OpenJDK 11
    + JDK-8249278: Revert JDK-8226253 which breaks the spec of
    AccessibleState.SHOWING for JList
    + JDK-8249560: Shenandoah: Fix racy GC request handling
    + JDK-8249801: Shenandoah: Clear soft-refs on requested GC cycle
    + JDK-8249953: Shenandoah: gc/shenandoah/mxbeans tests should
    account for corner cases
    + JDK-8250582: Revert Principal Name type to NT-UNKNOWN when
    requesting TGS Kerberos tickets
    + JDK-8250609: C2 crash in IfNode::fold_compares
    + JDK-8250627: Use -XX:+/-UseContainerSupport for
    enabling/disabling Java container metrics
    + JDK-8250755: Better cleanup for
    jdk/test/javax/imageio/plugins/shared/CanWriteSequence.java
    + JDK-8250787: Provider.put no longer registering aliases in
    FIPS env
    + JDK-8250826: jhsdb does not work with coredump which comes
    from Substrate VM
    + JDK-8250827: Shenandoah: needs to reset/finish StringTable's
    dead count before/after parallel walk
    + JDK-8250844: Make sure {type,obj}ArrayOopDesc accessors check
    the bounds
    + JDK-8251117: Cannot check P11Key size in P11Cipher and
    P11AEADCipher
    + JDK-8251354: Shenandoah: Fix jdk/jfr/tool/TestPrintJSON.java
    test failure
    + JDK-8251451: Shenandoah: Remark ObjectSynchronizer roots with
    I-U
    + JDK-8251469: Better cleanup for
    test/jdk/javax/imageio/SetOutput.java
    + JDK-8251487: Shenandoah: missing detail timing tracking for
    final mark cleaning phase
    + JDK-8252120: compiler/oracle/TestCompileCommand.java
    misspells "occured"
    + JDK-8252157: JDK-8231209 11u backport breaks jmm binary
    compatibility
    + JDK-8252258: [11u] JDK-8242154 changes the default vendor
    + JDK-8252804: [test] Fix 'ReleaseDeflater.java' test after
    downport of 8234011
    + JDK-8253134: JMM_VERSION should remain at 0x20020000 (JDK 10)
    in JDK 11
    + JDK-8253283: [11u] Test build/translations/
    /VerifyTranslations.java failing after JDK-8252258
    + JDK-8253813: Backout JDK-8244287 from 11u: it causes several
    crashes
- Removed patch:
  * gcc-fno-common-fix.patch
    + not needed any more with this version
- Added patch:
  * JDK-8250861.patch
    + Fix regression "8250861: Crash in MinINode::Ideal(PhaseGVN*,
    bool)" introduced in jdk 11.0.9</changelog>
  <changelog author="fstrba@suse.com" date="1604491200">- Enable Sheandoah GC for x86_64 (jsc#ECO-3171)</changelog>
  <changelog author="fstrba@suse.com" date="1605528000">- Update to upstream tag jdk-11.0.9.1-1
  * Fix:
    + JDK-8250861: Crash in MinINode::Ideal(PhaseGVN*, bool)
- Removed patch:
  * JDK-8250861.patch
    + Integrated upstream</changelog>
  <changelog author="fstrba@suse.com" date="1611230400">- Update to upstream tag jdk-11.0.10+9 (January 2021 CPU,
  bsc#1181239)
  * Security fixes
    + JDK-8247619: Improve Direct Buffering of Characters
  * Other changes
    + JDK-6722928: Support SSPI as a native GSS-API provider
    + JDK-7185258: [macosx] Deadlock in SunToolKit.realSync()
    + JDK-8152332: [macosx] JFileChooser cannot be serialized on
    Mac OS X
    + JDK-8161684: [testconf] Add VerifyOops' testing into compiler
    tiers
    + JDK-8171279: Support X25519 and X448 in TLS
    + JDK-8173361: various crashes in
    JvmtiExport::post_compiled_method_load
    + JDK-8173658: JvmtiExport::post_class_unload() is broken for
    non-JavaThread initiators
    + JDK-8191006: hsdis disassembler plugin does not compile with
    binutils 2.29+
    + JDK-8197981: Missing return statement in
    __sync_val_compare_and_swap_8
    + JDK-8198334: java/awt/FileDialog/8003399/bug8003399.java
    fails in headless mode
    + JDK-8200151: Add 8 JNDI tests to com/sun/jndi/dns/ConfigTests/
    + JDK-8208279: Add 8 JNDI tests to com/sun/jndi/dns/EnvTests/
    + JDK-8208483: Add 5 JNDI tests to
    com/sun/jndi/dns/FactoryTests/
    + JDK-8208542: Add 4 JNDI tests to com/sun/jndi/dns/ListTests/
    + JDK-8208665: Amend cross-compilation docs with
    qemu-debootstrap recipe
    + JDK-8210088: ProblemList gc/epsilon/TestMemoryMXBeans.java
    + JDK-8210339: Add 10 JNDI tests to com/sun/jndi/dns/FedTests/
    + JDK-8211450: UndetVar::dup is not copying the kind field to
    the duplicated instance
    + JDK-8212160: JVMTI agent crashes with "assert(_value != 0LL)
    failed: resolving NULL _value"
    + JDK-8212226: SurfaceManager throws "Invalid Image variant"
    for MultiResolutionImage (Windows)
    + JDK-8213400: Support choosing group name in keytool keypair
    generation
    + JDK-8213535: Windows HiDPI html lightweight tooltips are
    truncated
    + JDK-8213698: Improve devkit creation and add support for
    linux/ppc64/ppc64le/s390x
    + JDK-8214025: assert(t-&gt;singleton()) failed: must be a
    constant when ScavengeRootsInCode &lt; 2
    + JDK-8214242: compiler/arguments/TestScavengeRootsInCode.java
    fails because of missing UnlockDiagnosticVMOptions
    + JDK-8214787: Zero builds fail with "undefined
    JavaThread::thread_state()"
    + JDK-8215583: Exclude
    runtime/handshake/HandshakeWalkSuspendExitTest.java
    + JDK-8216012: Infinite loop in RSA KeyPairGenerator
    + JDK-8216324: GetClassMethods is confused by the presence of
    default methods in super interfaces
    + JDK-8217429: WebSocket over authenticating proxy fails to
    send Upgrade headers
    + JDK-8217976: test/jdk/java/net/httpclient/websocket/
    /WebSocketProxyTest.java fails intermittently
    + JDK-8218021: Have jarsigner preserve posix permission
    attributes
    + JDK-8218287: jshell tool: input behavior unstable after
    12-ea+24 on Windows
    + JDK-8218851: JVM crash in custom classloader stress test, JDK
    12 &amp; 13
    + JDK-8220420: Cleanup c1_LinearScan
    + JDK-8222072: JVMTI GenerateEvents() sends CompiledMethodLoad
    events to wrong jvmtiEnv
    + JDK-8222286: Fix for JDK-8213419 is broken on s390
    + JDK-8222527: HttpClient doesn't send HOST header when
    tunelling HTTP/1.1 through http proxy
    + JDK-8222533: jtreg test jdk/internal/platform/cgroup/
    /TestCgroupMetrics.java fails on SLES12.3 linux ppc64le
    machine
    + JDK-8224506: [TESTBUG] TestDockerMemoryMetrics.java fails
    with exitValue = 137
    + JDK-8224555: vmTestbase/nsk/jvmti/scenarios/contention/TC02/
    /tc02t001/TestDescription.java failed
    + JDK-8224650: Add tests to support X25519 and X448 in TLS
    + JDK-8225072: Add LuxTrust certificate that is expiring in
    March 2021 to list of allowed but expired certs
    + JDK-8225329: -XX:+PrintBiasedLockingStatistics causes crash
    during initialization on Windows platforms
    + JDK-8225687: Newly added sspi.cpp in JDK-6722928 still
    contains some small errors
    + JDK-8227006: [linux] Runtime.availableProcessors execution
    time increased by factor of 100
    + JDK-8227275: Within native OOM error handling, assertions may
    hang the process
    + JDK-8227647: [Graal] Test8009761.java fails due to
    "RuntimeException: static java.lang.Object
    compiler.uncommontrap.Test8009761.m3(boolean,boolean) not
    compiled"
    + JDK-8229495: SIGILL in C2 generated OSR compilation
    + JDK-8230910: libsspi_bridge does not build on Windows 32bit
    + JDK-8232114: JVM crashed at imjpapi.dll in native code
    + JDK-8234147: Avoid looking up standard charsets in core
    libraries
    + JDK-8234393: [macos] printing ignores printer tray
    + JDK-8234863: Increase default value of MaxInlineLevel
    + JDK-8235218: Minimal VM is broken after JDK-8173361
    + JDK-8235456: Minimal VM is broken after JDK-8212160
    + JDK-8235829: graal crashes with Zombie.java test
    + JDK-8236124: Minimal VM slowdebug build failed after
    JDK-8212160
    + JDK-8236512: PKCS11 Connection closed after Cipher.doFinal
    and NoPadding
    + JDK-8236944: The legVecZ operand should be limited to
    zmm0-zmm15 registers
    + JDK-8237186: Fix typo in copyright header of
    java/io/Reader/TransferTo.java
    + JDK-8237499: JFR: Include stack trace in the ThreadStart event
    + JDK-8237512: AArch64: aarch64TestHook leaks a BufferBlob
    + JDK-8237524: AArch64: String.compareTo() may return incorrect
    result
    + JDK-8237950: C2 compilation fails with "Live Node limit
    exceeded limit" during ConvI2L::Ideal optimization
    + JDK-8238579: HttpsURLConnection drops the timeout and hangs
    forever in read
    + JDK-8239105: Add exception for expiring Digicert root
    certificates to VerifyCACerts test
    + JDK-8239477: jdk/jfr/jcmd/TestJcmdStartStopDefault.java fails
  - XX:+VerifyOops with "verify_oop: rsi: broken oop"
    + JDK-8239497: SEGV in EdgeUtils::field_name_symbol(Edge const&amp;)
    + JDK-8239886: Minimal VM build fails after JDK-8237499
    + JDK-8240633: Memory leaks in the implementations of
    FileChooserUI
    + JDK-8240690: Race condition between EDT and
    BasicDirectoryModel.FilesLoader.run0()
    + JDK-8241234: Unify monitor enter/exit runtime entries.
    + JDK-8241311: Move some charset mapping tests from closed to
    open
    + JDK-8241797: Add some tests to the problem list
    + JDK-8242029: AArch64: skip G1 array copy pre-barrier if
    marking not active
    + JDK-8242335: Additional Tests for RSASSA-PSS
    + JDK-8242480: Negative value may be returned by
    getFreeSwapSpaceSize() in the docker
    + JDK-8242614: cleanup duplicated test ldap server in some
    com/sun/jndi/ldap/ tests
    + JDK-8242846: Bring back test/jdk/tools/jlink/plugins/
    /OrderResourcesPluginTest.java
    + JDK-8243114: Implement montgomery{Multiply,Square}intrinsics
    on Windows
    + JDK-8243290: Improve diagnostic messages for class
    verification and redefinition failures
    + JDK-8243488: Add tests for set/get SendBufferSize and
    getReceiveBufferSize in DatagramSocket
    + JDK-8243549: sun/security/ssl/CipherSuite/
    /NamedGroupsWithCipherSuite.java failed with Unsupported
    signature algorithm: DSA
    + JDK-8243617: compiler/onSpinWait/TestOnSpinWaitC1.java test
    uses wrong class
    + JDK-8243619: compiler/codecache/CheckSegmentedCodeCache.java
    test misses -version
    + JDK-8244142: some hotspot/runtime tests don't check exit code
    of forked JVM
    + JDK-8244278: Excessive code cache flushes and sweeps
    + JDK-8244282: test/hotspot/jtreg/compiler/intrinsics/
    /Test8237524.java fails with --illegal-access=deny
    + JDK-8244621: [macos10.15] Garbled FX printing plus CoreText
    warnings on Catalina when building with Xcode 11
    + JDK-8244819: hsdis does not compile with binutils 2.34+
    + JDK-8245051: c1 is broken if it is compiled by gcc without
  - fno-lifetime-dse
    + JDK-8245168: jlink should not be treated as a "small" tool
    + JDK-8245400: Upgrade to LittleCMS 2.11
    + JDK-8246381: VM crashes with "Current BasicObjectLock* below
    than low_mark"
    + JDK-8246434: Threads::print_on_error assumes that the heap
    has been set up
    + JDK-8246648: issue with OperatingSystemImpl
    getFreeSwapSpaceSize in docker after 8242480
    + JDK-8247201: Print potential pointer value of readable stack
    memory in hs_err file
    + JDK-8247763: assert(outer-&gt;outcnt() == 2) failed: 'only phis'
    failure in LoopNode::verify_strip_mined()
    + JDK-8247867: Upgrade to freetype 2.10.2
    + JDK-8248190: Enable Power10 system and implement new
    byte-reverse instructions
    + JDK-8248226: TestCloneAccessStressGCM fails with
  - XX:-ReduceBulkZeroing
    + JDK-8248347: windows build broken by JDK-8243114
    + JDK-8248532: Every time I change keyboard language at my
    MacBook, Java crashes
    + JDK-8248552: C2 crashes with SIGFPE due to division by zero
    + JDK-8248596: [TESTBUG] compiler/loopopts/
    /PartialPeelingUnswitch.java times out with Graal enabled
    + JDK-8248745: Add jarsigner and keytool tests for restricted
    algorithms
    + JDK-8248791: sun/util/resources/cldr/TimeZoneNamesTest.java
    fails with -XX:-ReduceInitialCardMarks -XX:-ReduceBulkZeroing
    + JDK-8248845: AArch64: stack corruption after spilling vector
    register
    + JDK-8249176: Update GlobalSignR6CA test certificates
    + JDK-8249183: JVM crash in "AwtFrame::WmSize" method
    + JDK-8249192: MonitorInfo stores raw oops across safepoints
    + JDK-8249602: C2: assert(cnt == _outcnt) failed: no insertions
    allowed
    + JDK-8249603: C1: assert(has_error == false) failed: register
    allocation invalid
    + JDK-8249605: C2: assert(no_dead_loop) failed: dead loop
    detected
    + JDK-8249607: C2: assert(!had_error) failed: bad dominance
    + JDK-8249608: Vector register used by C2 compiled method
    corrupted at safepoint
    + JDK-8249672: Include microcode revision in features_string on
    x86
    + JDK-8249748: gtest silently ignores bad jvm arguments
    + JDK-8249821: Separate libharfbuzz from libfontmanager
    + JDK-8250598: Hyper-V is detected in spite of running on host
    OS
    + JDK-8250605: Linux x86_32 builds fail after JDK-8249821
    + JDK-8250636: iso8601_time returns incorrect offset part on
    MacOS
    + JDK-8250665: Wrong translation for the month name of May in
    ar_JO,LB,SY
    + JDK-8250772: Test com/sun/jndi/ldap/
    /NamingExceptionMessageTest.java fails intermittently with
    javax.naming.ServiceUnavailableException
    + JDK-8250825: C2 crashes with assert(field != __null) failed:
    missing field
    + JDK-8250894: Provide a configure option to build and run
    against the platform libharfbuzz
    + JDK-8250928: JFR: Improve hash algorithm for stack traces
    + JDK-8250968: Symlinks attributes not preserved when using
    jarsigner on zip files
    + JDK-8250984: Memory Docker tests fail on some Linux kernels
    w/o cgroupv1 swap limit capabilities
    + JDK-8251118: BiasedLocking::preserve_marks should not have a
    HandleMark
    + JDK-8251189: com/sun/jndi/ldap/LdapDnsProviderTest.java
    failed due to timeout
    + JDK-8251257: NMT: jcmd VM.native_memory scale=1 crashes
    target VM
    + JDK-8251365: Build failure on AIX after 8250636
    + JDK-8251397: NPE on ClassValue.ClassValueMap.cacheArray
    + JDK-8251456: [TESTBUG] compiler/vectorization/
    /TestVectorsNotSavedAtSafepoint.java failed OutOfMemoryError
    + JDK-8251458: Parse::do_lookupswitch fails with "assert(_cnt
    &gt;= 0) failed"
    + JDK-8251535: Partial peeling at unsigned test adds incorrect
    loop exit check
    + JDK-8251949: ZGC: Set explicit heap size for
    compiler/gcbarriers tests
    + JDK-8252090: JFR: StreamWriterHost::write_unbuffered() stucks
    in an infinite loop OpenJDK (build 13.0.1+9)
    + JDK-8252415: Bump update version for OpenJDK: jdk-11.0.10
    + JDK-8252470: java/awt/dnd/DisposeFrameOnDragCrash/
    /DisposeFrameOnDragTest.java fails on Windows
    + JDK-8252497: Incorrect numeric currency code for ROL
    + JDK-8252660: Shenandoah: support manageable SoftMaxHeapSize
    option
    + JDK-8252679: Two windows specific FileDIalog tests may fail
    on some Windows_Server_2016_Standard
    + JDK-8252696: Loop unswitching may cause out of bound array
    load to be executed
    + JDK-8252754: Hash code calculation of JfrStackTrace is
    inconsistent
    + JDK-8253219: Epsilon: clean up unnecessary includes
    + JDK-8253224: Shenandoah: ShenandoahStrDedupQueue destructor
    calls virtual num_queues()
    + JDK-8253226: Shenandoah: remove unimplemented
    ShenandoahStrDedupQueue::verify
    + JDK-8253269: The CheckCommonColors test should provide more
    info on failure
    + JDK-8253284: Zero OrderAccess barrier mappings are incorrect
    + JDK-8253375: OSX build fails with Xcode 12.0 (12A7209)
    + JDK-8253778: ShenandoahSafepoint::is_at_shenandoah_safepoint
    should not access VMThread state from other threads
    + JDK-8253791: Issue with useAppleColor check in CSystemColors.m
    + JDK-8254016: Test8237524 fails with -XX:-CompactStrings option
    + JDK-8254081: java/security/cert/PolicyNode/
    /GetPolicyQualifiers.java fails due to an expired certificate
    + JDK-8254144: Non-x86 Zero builds fail with return-type
    warning in os_linux_zero.cpp
    + JDK-8254166: Zero: return-type warning in
    zeroInterpreter_zero.cpp
    + JDK-8254177: (tz) Upgrade time-zone data to tzdata2020b
    + JDK-8254185: Fix Code cache sweeper heuristics for JDK 11
    + JDK-8254190: [s390] interpreter misses exception check after
    calling monitorenter
    + JDK-8254790: SIGSEGV in string_indexof_char and
    stringL_indexof_char intrinsics
    + JDK-8254854: [cgroups v1] Metric limits not properly detected
    on some join controller combinations
    + JDK-8254982: (tz) Upgrade time-zone data to tzdata2020c
    + JDK-8255050: Add pkcs11/KeyStore/ClientAuth.sh to Problem list
    + JDK-8255065: Zero: accessor_entry misses the IRIW case
    + JDK-8255226: (tz) Upgrade time-zone data to tzdata2020d
    + JDK-8255269: Unsigned overflow in g1Policy.cpp
    + JDK-8255365: Problem list failing client manual tests
    + JDK-8255457: Shenandoah: cleanup ShenandoahMarkTask
    + JDK-8255466: C2 crashes at ciObject::get_oop() const+0x0
    + JDK-8255550: x86: Assembler::cmpq(Address dst, Register src)
    encoding is incorrect
    + JDK-8255603: Memory/Performance regression after JDK-8210985
    + JDK-8255760: Shenandoah: match constants style in
    ShenandoahMarkTask fallback
    + JDK-8255781: Bump patch update version for OpenJDK:
    jdk-11.0.9.1
    + JDK-8255937: Better cleanup for
    test/jdk/javax/imageio/stream/StreamFlush.java
    + JDK-8256427: Test com/sun/jndi/dns/ConfigTests/
    /PortUnreachable.java does not work on AIX
    + JDK-8256452: Integrate missing part of JDK-8232370 to 11u
    + JDK-8256483: [TESTBUG] serviceability/jvmti/GetClassMethods/
    /libOverpassMethods.c fails to compile on gcc 4.4.x
    + JDK-8256557: libharfbuzz fails to link on gcc 4.4.x due to
  - Wl,-z,defs
    + JDK-8256618: Zero: Linux x86_32 build still fails
    + JDK-8256736: Zero: GTest tests fail with "unsuppported vm
    variant"
    + JDK-8256809: Annotation processing causes NPE during flow
    analysis
    + JDK-8257181: s390x builds are very noisy with gc-sections
    messages
    + JDK-8257242: [macOS] Java app crashes while switching input
    methods
    + JDK-8257545: SunJSSE FIPS regression in key exchange after
    JDK-8171279 11u backport
    + JDK-8257641: Shenandoah: Query is_at_shenandoah_safepoint()
    from control thread should return false
    + JDK-8257701: Shenandoah: objArrayKlass metadata is not marked
    with chunked arrays
    + JDK-8258630: Add expiry exception for QuoVadis root
    certificate
- New upstream dependency on libharfbuzz
- Regenerated patches: missing-return.patch system-pcsclite.patch</changelog>
  <changelog author="fstrba@suse.com" date="1616155200">- Added patches:
  * system-crypto-policy.patch
    + Let OpenJDK use system crypto policies unless explicitely told
    not to
  * nss-security-provider.patch
    + Add the NSS security provider with configuration in generated
    nss.cfg file
  * keytool-default-rsa.patch
    + Make keytool generate RSA keys by default, since only the
    LEGACY system crypto policy allows DSA</changelog>
  <changelog author="pujos.michael@gmail.com" date="1618488000">- moved mozilla-nss dependency to java-11-openjdk-headless package
  This is necessary to be able to do crypto with just
  java-11-openjdk-headless installed. Fixes boo#1184606</changelog>
  <changelog author="fstrba@suse.com" date="1619006400">- Update to upstream tag jdk-11.0.11+9 (April 2021, CPU)
  * Security fixes
    + JDK-8244473: Contextualize registration for JNDI
    + JDK-8244543: Enhanced handling of abstract classes
    + JDK-8249906, CVE-2021-2163, bsc#1185055: Enhance opening JARs
    + JDK-8250568, CVE-2021-2161, bsc#1185056: Less ambiguous
    processing
    + JDK-8253799: Make lists of normal filenames
    + JDK-8257001: Improve Http Client Support
  * Other changes
    + JDK-7107012: sun.jvm.hotspot.code.CompressedReadStream
    readDouble() conversion to long mishandled
    + JDK-7146776: deadlock between URLStreamHandler.getHostAddress
    and file.Handler.openconnection
    + JDK-8086003: Test fails on OSX with java.lang.RuntimeException
    'Narrow klass base: 0x0000000000000000, Narrow klass shift: 3'
    missing
    + JDK-8168869: jdeps: localized messages don't use proper line
    breaks
    + JDK-8180837: SunPKCS11-NSS tests failing with
    CKR_ATTRIBUTE_READ_ONLY and CKR_MECHANISM_PARAM_INVALID
    + JDK-8202343: Disable TLS 1.0 and 1.1
    + JDK-8205992: jhsdb cannot attach to Java processes running in
    Docker containers
    + JDK-8209193: Fix aarch64-linux compilation after -Wreorder
    changes
    + JDK-8210413: AArch64: Optimize div/rem by constant in C1
    + JDK-8210578: AArch64: Invalid encoding for fmlsvs instruction
    + JDK-8211051: jdeps usage of --dot-output doesn't provide
    valid output for modular jar
    + JDK-8211057: Gensrc step CompileProperties generates unstable
    CompilerProperties output
    + JDK-8211150: G1 Full GC not purging code root memory and
    hence causing memory leak
    + JDK-8211825: ModuleLayer.defineModulesWithXXX does not setup
    delegation when module reads automatic module
    + JDK-8212043: Add floating-point Math.min/max intrinsics
    + JDK-8212218: [TESTBUG] runtime/ErrorHandling/
    /TestHeapDumpOnOutOfMemoryErrorInMetaspace.java timed out
    + JDK-8213116: javax/swing/JComboBox/WindowsComboBoxSize/
    /WindowsComboBoxSizeTest.java fails in Windows
    + JDK-8213909: jdeps --print-module-deps should report missing
    dependences
    + JDK-8214180: Need better granularity for sleeping
    + JDK-8214223: tools/jdeps/listdeps/ListModuleDeps.java failed
    due to missing Lib2 file
    + JDK-8214230: Classes generated by SystemModulesPlugin.java
    are not reproducable
    + JDK-8214741: docs/index.html has no title or copyright
    + JDK-8215687: [Graal] unit test CheckGraalIntrinsics failed
    after 8212043
    + JDK-8217848: [Graal] vmTestbase/nsk/jvmti/ResourceExhausted/
    /resexhausted003/TestDescription.java fails
    + JDK-8218482: sun/security/krb5/auto/ReplayCachePrecise.java
    failed - no KrbException thrown
    + JDK-8218550: Add test omitted from JDK-8212043
    + JDK-8221584: SIGSEGV in os::PlatformEvent::unpark() in
    JvmtiRawMonitor::raw_exit while posting method exit event
    + JDK-8221995: AARCH64: problems with CAS instructions encoding
    + JDK-8222518: Remove unnecessary caching of Parker object in
    java.lang.Thread
    + JDK-8222785: aarch64: add necessary masking for immediate
    shift counts
    + JDK-8223186: HotSpot compile warnings from GCC 9
    + JDK-8225773: jdeps --check produces NPE if there are missing
    module dependences
    + JDK-8225805: Java Access Bridge does not close the logger
    + JDK-8226810: Failed to launch JVM because of
    NullPointerException occured on System.props
    + JDK-8229396: jdeps ignores multi-release when
    generate-module-info used on command line
    + JDK-8229474: Shenandoah: Cleanup CM::update_roots()
    + JDK-8232225: Rework the fix for JDK-8071483
    + JDK-8232905: JFR fails with assertion:
    assert(t-&gt;unflushed_size() == 0) failed: invariant
    + JDK-8233164: C2 fails with assert(phase-&gt;C-&gt;get_alias_index(t)
    == phase-&gt;C-&gt;get_alias_index(t_adr)) failed: correct memory
    chain
    + JDK-8233910: java/awt/ColorClass/AlphaColorTest.java is
    failing  intermittently in nightly lnux-x64 system
    + JDK-8233912: aarch64: minor improvements of atomic operations
    + JDK-8234508: VM_HeapWalkOperation::iterate_over_object reads
    non-strong fields with an on-strong load barrier
    + JDK-8234742: Improve handshake logging
    + JDK-8234796: Refactor Handshake::execute to take a more
    complex type than ThreadClosure
    + JDK-8235324: Dying objects are published from users of
    CollectedHeap::object_iterate
    + JDK-8235351: Lookup::unreflect should bind with the original
    caller independent of Method's accessible flag
    + JDK-8237369: Shenandoah: failed vmTestbase/nsk/jvmti/
    /AttachOnDemand/attach021/TestDescription.java test
    + JDK-8237392: Shenandoah: Remove unreliable assertion
    + JDK-8237483: AArch64 C1 OopMap inserted twice fatal error
    + JDK-8237495: Java MIDI fails with a dereferenced memory error
    when asked to send a raw 0xF7
    + JDK-8239355: (dc) Initial value of SO_SNDBUF should allow
    sending large datagrams (macOS)
    + JDK-8240353: AArch64: missing support for
  - XX:+ExtendedDTraceProbes in C1
    + JDK-8240704: CheckHandles.java failed "AssertionError: Handle
    use increased by more than 10 percent."
    + JDK-8240751: Shenandoah: fold ShenandoahTracer definition
    + JDK-8240795: [REDO] 8238384 CTW: C2 compilation fails with
    "assert(store != load-&gt;find_exact_control(load-&gt;in(0)))
    failed: dependence cycle found"
    + JDK-8241598: Upgrade JLine to 3.14.0
    + JDK-8241649: Optimize Character.toString
    + JDK-8241770: Module xxxAnnotation() methods throw NCDFE if
    module-info.class found as resource in unnamed module
    + JDK-8241911: AArch64: Fix a potential register clash issue in
    reduce_add2I
    + JDK-8242030: Wrong package declarations in jline classes after
    JDK-8241598
    + JDK-8242565: Policy initialization issues when the denyAfter
    constraint is enabled
    + JDK-8243618: compiler/rtm/cli tests can be run w/o WhiteBox
    + JDK-8243670: Unexpected test result caused by C2
    MergeMemNode::Ideal
    + JDK-8244088: [Regression] Switch of Gnome theme ends up in
    deadlocked UI
    + JDK-8244154: Update SunPKCS11 provider with PKCS11 v3.0 header
    files
    + JDK-8244340: Handshake processing thread lacks yielding
    + JDK-8244573: java.lang.ArrayIndexOutOfBoundsException thrown
    for malformed class file
    + JDK-8244683: A TSA server used by tests
    + JDK-8245005: javax/net/ssl/compatibility/BasicConnectTest.java
    failed with No enum constant
    + JDK-8245026: PsAdaptiveSizePolicy::_old_gen_policy_is_ready is
    unused
    + JDK-8245283: JFR: Can't handle constant dynamic used by Jacoco
    agent
    + JDK-8245512: CRC32 optimization using AVX512 instructions
    + JDK-8245527: LDAP Channel Binding support for Java
    GSS/Kerberos
    + JDK-8246707: (sc) SocketChannel.read/write throws
    AsynchronousCloseException on closed channel
    + JDK-8246709: sun/security/tools/jarsigner/
    /TsacertOptionTest.java compilation failed after JDK-8244683
    + JDK-8247200: assert((unsigned)fpargs &lt; 32)
    + JDK-8247766: [aarch64] guarantee(val &lt; (1U &lt;&lt; nbits))
    failed: Field too big for insn.
    + JDK-8248336: AArch64: C2: offset overflow in
    BoxLockNode::emit
    + JDK-8248865: Document JNDI/LDAP timeout properties
    + JDK-8248901: Signed immediate support in
    .../share/assembler.hpp is broken.
    + JDK-8249543: Force DirectBufferAllocTest to run with
  - ExplicitGCInvokesConcurrent
    + JDK-8249588: libwindowsaccessbridge issues on 64bit Windows
    + JDK-8249749: modify a primitive array through a stream and a
    for cycle causes jre crash
    + JDK-8249787: Make TestGCLocker more resilient with concurrent
    GCs
    + JDK-8249867: xml declaration is not followed by a newline
    + JDK-8250911: [windows] os::pd_map_memory() error detection
    broken
    + JDK-8251255: [linux] Add process-memory information to hs-err
    and VM.info
    + JDK-8251359: Shenandoah: filter null oops before calling
    enqueue/SATB barrier
    + JDK-8251925: C2: RenaissanceStressTest fails with
    assert(!had_error): bad dominance
    + JDK-8251944: Add Shenandoah test config to
    compiler/gcbarriers/UnsafeIntrinsicsTest.java
    + JDK-8251992: VM crashed running TestComplexAddrExpr.java test
    with -XX:UseAVX=X
    + JDK-8253220: Epsilon: clean up unused code/declarations
    + JDK-8253274: The CycleDMImagetest brokes the system
    + JDK-8253353: Crash in C2: guarantee(n != NULL) failed: No Node
    + JDK-8253368: TLS connection always receives close_notify
    exception
    + JDK-8253404: C2: assert(C-&gt;live_nodes() &lt;=
    C-&gt;max_node_limit()) failed: Live Node limit exceeded limit
    + JDK-8253409: Double-rounding possibility in float fma
    + JDK-8253476: TestUseContainerSupport.java fails on some Linux
    kernels w/o swap limit capabilities
    + JDK-8253524: C2: Refactor code that clones predicates during
    loop unswitching
    + JDK-8253644: C2: assert(skeleton_predicate_has_opaque(iff))
    failed: unexpected
    + JDK-8253681: closed java/awt/dnd/MouseEventAfterStartDragTest/
    /MouseEventAfterStartDragTest.html test failed
    + JDK-8253702: BigSur version number reported as 10.16, should
    be 11.nn
    + JDK-8253756: C2 CompilerThread0 crash in Node::add_req(Node*)
    + JDK-8254104: MethodCounters must exist before nmethod is
    installed
    + JDK-8254734: "dead loop detected" assert failure with patch
    from 8223051
    + JDK-8254748: Bad Copyright header format after JDK-8212218
    + JDK-8254799: runtime/ErrorHandling/
    /TestHeapDumpOnOutOfMemoryError.java fails with release VMs
    + JDK-8255058: C1: assert(is_virtual()) failed: type check
    + JDK-8255351: Add detection for Graviton 2 CPUs
    + JDK-8255368: Math.exp() gives wrong result for large values on
    x86 32-bit platforms
    + JDK-8255387: Japanese characters were printed upside down on
    AIX
    + JDK-8255401: Shenandoah: Allow oldval and newval registers to
    overlap in cmpxchg_oop()
    + JDK-8255479: [aarch64] assert(src-&gt;section_index_of(target) ==
    CodeBuffer::SECT_NONE) failed: sanity
    + JDK-8255544: Create a checked cast
    + JDK-8255559: Leak File Descriptors Because of
    ResolverLocalFilesystem#engineResolveURI()
    + JDK-8255681: print callstack in error case in
    runAWTLoopWithApp
    + JDK-8255734: VM should ignore SIGXFSZ on ppc64, s390 too
    + JDK-8255742: PrintInlining as compiler directive doesn't print
    virtual calls
    + JDK-8255845: Memory leak in imageFile.cpp
    + JDK-8255880: UI of Swing components is not redrawn after their
    internal state changed
    + JDK-8255908: ExceptionInInitializerError due to
    UncheckedIOException while initializing cgroupv1 subsystem
    + JDK-8256025: AArch64: MachCallRuntimeNode::ret_addr_offset()
    is incorrect for stub calls
    + JDK-8256056: Deoptimization stub doesn't save vector registers
    on x86
    + JDK-8256061: RegisterSaver::save_live_registers() omits upper
    halves of ZMM0-15 registers
    + JDK-8256187: [TEST_BUG] Automate bug4275046.java test
    + JDK-8256220: C1: x86_32 fails with -XX:UseSSE=1 after
    JDK-8210764 due to mishandled lir_neg
    + JDK-8256258: some missing NULL checks or asserts after
    CodeCache::find_blob_unsafe
    + JDK-8256264: Printed GlyphVector outline with low DPI has bad
    quality on Windows
    + JDK-8256290: javac/lambda/T8031967.java fails with
    StackOverflowError on x86_32
    + JDK-8256359: AArch64: runtime/ReservedStack/
    /ReservedStackTestCompiler.java fails
    + JDK-8256387: Unexpected result if patching an entire
    instruction on AArch64
    + JDK-8256421: Add 2 HARICA roots to cacerts truststore
    + JDK-8256488: [aarch64] Use ldpq/stpq instead of ld4/st4 for
    small copies in StubGenerator::copy_memory
    + JDK-8256489: Make gtest for long path names on Windows more
    resilient in the presence of virus scanners
    + JDK-8256501: libTestMainKeyWindow fails to build with Xcode
    12.2
    + JDK-8256633: Fix product build on Windows+Arm64
    + JDK-8256682: JDK-8202343 is incomplete
    + JDK-8256751: Incremental rebuild with precompiled header fails
    when touching a header file
    + JDK-8256757: Incorrect MachCallRuntimeNode::ret_addr_offset()
    for CallLeafNoFP on x86_32
    + JDK-8256806: Shenandoah: optimize shenandoah/jni/
    /TestPinnedGarbage.java test
    + JDK-8256807: C2: Not marking stores correctly as mismatched
    in string opts
    + JDK-8256810: Incremental rebuild broken on Macosx
    + JDK-8256818: SSLSocket that is never bound or connected leaks
    socket resources
    + JDK-8256888: Client manual test problem list update
    + JDK-8257083: Security infra test failures caused by
    JDK-8202343
    + JDK-8257408: Bump update version for OpenJDK: jdk-11.0.11
    + JDK-8257423: [PPC64] Support -XX:-UseInlineCaches
    + JDK-8257436: [aarch64] Regressions in ArrayCopyUnalignedDst
    .testByte/testChar for 65-78 bytes when UseSIMDForMemoryOps
    is on
    + JDK-8257513: C2: assert((constant_addr -
    _masm.code()-&gt;consts()-&gt;start()) == con.offset())
    + JDK-8257547: Handle multiple prereqs on the same line in deps
    files
    + JDK-8257561: Some code is not vectorized after 8251925 and
    8250607
    + JDK-8257565: epsilonBarrierSet.hpp should not include
    barrierSetAssembler
    + JDK-8257575: C2: "failed: only phis" assert failure in loop
    strip mining verification
    + JDK-8257594: C2 compiled checkcast of non-null object triggers
    endless deoptimization/recompilation cycle
    + JDK-8257633: Missing -mmacosx-version-min=X flag when linking
    libjvm
    + JDK-8257670: sun/security/ssl/SSLSocketImpl/SSLSocketLeak.java
    reports leaks
    + JDK-8257707: Fix incorrect format string in Http1HeaderParser
    + JDK-8257746: Regression introduced with JDK-8250984 - memory
    might be null in some machines
    + JDK-8257798: [PPC64] undefined reference to
    Klass::vtable_start_offset()
    + JDK-8257884: Re-enable sun/security/ssl/SSLSocketImpl/
    /SSLSocketLeak.java as automatic test
    + JDK-8257910: [JVMCI] Set exception_seen accordingly in the
    runtime.
    + JDK-8257997: sun/security/ssl/SSLSocketImpl/SSLSocketLeak.java
    again reports leaks after JDK-8257884
    + JDK-8257999: Parallel GC crash in gc/parallel/
    /TestDynShrinkHeap.java: new region is not in covered_region
    + JDK-8258077: Using -Xcheck:jni can lead to a double-free after
    JDK-8193234
    + JDK-8258247: Couple of issues in fix for JDK-8249906
    + JDK-8258373: Update the text handling in the JPasswordField
    + JDK-8258396: SIGILL in jdk.jfr.internal.PlatformRecorder
    .rotateDisk()
    + JDK-8258419: RSA cipher buffer cleanup
    + JDK-8258471: "search codecache" clhsdb command does not work
    + JDK-8258534: Epsilon: clean up unused includes
    + JDK-8258805: Japanese characters not entered by mouse click
    on Windows 10
    + JDK-8258833: Cancel multi-part cipher operations in SunPKCS11
    after failures
    + JDK-8258836: JNI local refs exceed capacity
    getDiagnosticCommandInfo
    + JDK-8258884: [TEST_BUG] Convert applet-based test
    open/test/jdk/javax/swing/JMenuItem/8031573/bug8031573.java
    to a regular java test
    + JDK-8259007: This test printed a blank page
    + JDK-8259048: (tz) Upgrade time-zone data to tzdata2020f
    + JDK-8259049: Uninitialized variable after JDK-8257513
    + JDK-8259231: Epsilon: improve performance under contention
    during virtual space expansion
    + JDK-8259271: gc/parallel/TestDynShrinkHeap.java still fails
    "assert(covered_region.contains(new_memregion)) failed: new
    region is not in covered_region"
    + JDK-8259312: VerifyCACerts.java fails as soneraclass2ca cert
    will expire in 90 days
    + JDK-8259319: Illegal package access when SunPKCS11 requires
    SunJCE's classes
    + JDK-8259339: AllocateUninitializedArray C2 intrinsic fails
    with void.class input
    + JDK-8259428: AlgorithmId.getEncodedParams() should return copy
    + JDK-8259446: runtime/jni/checked/
    /TestCheckedReleaseArrayElements.java fails with stderr not
    empty
    + JDK-8259451: Zero: skip serviceability/sa tests, set vm.hasSA
    to false
    + JDK-8259580: Shenandoah: uninitialized label in
    VerifyThreadGCState
    + JDK-8259619: C1: 3-arg StubAssembler::call_RT stack-use
    condition is incorrect
    + JDK-8259633: compiler/graalunit/CoreTest.java fails with NPE
    after JDK-8244543
    + JDK-8259706: C2 compilation fails with assert(vtable_index ==
    Method::invalid_vtable_index) failed: correct sentinel value
    + JDK-8259707: LDAP channel binding does not work with StartTLS
    extension
    + JDK-8259773: Incorrect encoding of AVX-512 kmovq instruction
    + JDK-8259849: Shenandoah: Rename store-val to IU-barrier
    + JDK-8259949: x86 32-bit build fails when -fcf-protection is
    passed in the compiler flags
    + JDK-8259954: gc/shenandoah/mxbeans tests fail with -Xcomp
    + JDK-8260029: aarch64: fix typo in verify_oop_array
    + JDK-8260308: Update LogCompilation junit to 4.13.1
    + JDK-8260338: Some fields in HaltNode is not cloned
    + JDK-8260349: Cannot programmatically retrieve Metaspace max
    set via JAVA_TOOL_OPTIONS
    + JDK-8260356: (tz) Upgrade time-zone data to tzdata2021a
    + JDK-8260378: [TESTBUG] DcmdMBeanTestCheckJni.java reports
    false positive
    + JDK-8260497: Shenandoah: Improve SATB flushing
    + JDK-8260502: [s390] NativeMovRegMem::verify() fails because
    it's too strict
    + JDK-8260632: Build failures after JDK-8253353
    + JDK-8260704: ParallelGC: oldgen expansion needs release-store
    for _end
    + JDK-8261022: Fix incorrect result of Math.abs() with char type
    + JDK-8261089: [TESTBUG] native library of test
    TestCheckedReleaseCriticalArray.java fails to compile with
    gcc 4.x
    + JDK-8261183: Follow on to Make lists of normal filenames
    + JDK-8261209: isStandalone property: remove dependency on
    pretty-print
    + JDK-8261231: Windows IME was disabled after DnD operation
    + JDK-8261251: Shenandoah: Use object size for full GC
    humongous compaction
    + JDK-8261310: PPC64 Zero build fails with
    'VMError::controlled_crash(int)::FunctionDescriptor
    functionDescriptor' has incomplete type and cannot be defined
    + JDK-8261334: NMT: tuning statistic shows incorrect hash
    distribution
    + JDK-8261413: Shenandoah: Disable class-unloading in I-U mode
    + JDK-8261522: [PPC64] AES intrinsics write beyond the
    destination array
    + JDK-8261534: Test sun/security/pkcs11/KeyAgreement/
    /IllegalPackageAccess.java fails on platforms where no nsslib
    artifacts are defined
    + JDK-8261585: Restore HandleArea used in
    Deoptimization::uncommon_trap
    + JDK-8261753: Test java/lang/System/OsVersionTest.java still
    failing on BigSur patch versions after JDK-8253702
    + JDK-8261829: Exclude tools/jlink/JLinkReproducibleTest.java
    in 11u
    + JDK-8261912: Code IfNode::fold_compares_helper more
    defensively
    + JDK-8261920: [AIX] jshell command throws java.io.IOError on
    non English locales
    + JDK-8262018: Wrong format in SAP copyright header of
    OsVersionTest
    + JDK-8263069: Exclude some failing tests from
    security/infra/java/security/cert/CertPathValidator</changelog>
  <changelog author="fstrba@suse.com" date="1620043200">- Remove all Jpackage provides for SLE12 in order to avoid
  installing this package as default Java on SLE12-SP5
  (bsc#1185476)</changelog>
  <changelog author="fstrba@suse.com" date="1621512000">- Modified patch:
  * nss-security-provider.patch
    + make the NSS provider first in the list</changelog>
  <changelog author="fstrba@suse.com" date="1626868800">- Update to upstream tag jdk-11.0.12+7 (July 2021, CPU)
  * Security fixes
    + JDK-8256157: Improve bytecode assembly
    + JDK-8256491: Better HTTP transport
    + JDK-8258432, CVE-2021-2341, bsc#1188564: Improve file
    transfers
    + JDK-8260453: Improve Font Bounding
    + JDK-8260960: Signs of jarsigner signing
    + JDK-8260967, CVE-2021-2369, bsc#1188565: Better jar file
    validation
    + JDK-8262380: Enhance XML processing passes
    + JDK-8262403: Enhanced data transfer
    + JDK-8262410: Enhanced rules for zones
    + JDK-8262477: Enhance String Conclusions
    + JDK-8262967: Improve Zip file support
    + JDK-8264066, CVE-2021-2388, bsc#1188566: Enhance compiler
    validation
    + JDK-8264079: Improve abstractions
    + JDK-8264460: Improve NTLM support
  * Other changes
    + JDK-6847157: java.lang.NullPointerException: HDC for
    component at sun.java2d.loops.Blit.Blit
    + JDK-7106851: Test should not use System.exit
    + JDK-8073446: TimeZone getOffset API does not  return a dst
    offset between years 2038-2137
    + JDK-8076190: Customizing the generation of a PKCS12 keystore
    + JDK-8153005: Upgrade the default PKCS12 encryption/MAC
    algorithms
    + JDK-8171303: sun/java2d/pipe/InterpolationQualityTest.java
    fails on Windows &amp; Linux
    + JDK-8177068: incomplete classpath causes NPE in Flow
    + JDK-8185734: [Windows] Structured Exception Catcher missing
    around gtest execution
    + JDK-8187450: JNI local refs exceeds capacity warning in
    NetworkInterface::getAll
    + JDK-8190763: Class cast exception on (CompoundEdit)
    UndoableEditEvent.getEdit()
    + JDK-8195841: PNGImageReader.readNullTerminatedString() doesnt
    check for non-null terminated strings with length equal to
    maxLen
    + JDK-8196100: javax/swing/text/JTextComponent/5074573/
    /bug5074573.java fails
    + JDK-8199646: JShell tests: jdk/jshell/
    /FailOverDirectExecutionControlTest.java failed with
    java.lang.UnsupportedOperationException
    + JDK-8206925: Support the certificate_authorities extension
    + JDK-8207160: ClassReader::adjustMethodParams can potentially
    return null if the args list is empty
    + JDK-8207247: AARCH64: Enable Minimal and Client VM builds
    + JDK-8207404: MulticastSocket tests failing on AIX
    + JDK-8207779: Method::is_valid_method() compares 'this' with
    NULL
    + JDK-8208061: runtime/LoadClass/TestResize.java fails with
    "Load factor too high" when running in CDS mode.
    + JDK-8209459: TestSHA512MultiBlockIntrinsics failed on AArch64
    + JDK-8210443: Migrate Locale matching tests to JDK Repo.
    + JDK-8213231: ThreadSnapshot::_threadObj can become stale
    + JDK-8213483: ARM32: runtime/ErrorHandling/
    /ShowRegistersOnAssertTest.java jtreg test fail
    + JDK-8213725: JShell NullPointerException due to class file
    with unexpected package
    + JDK-8213794: ARM32: disable TypeProfiling,
    CriticalJNINatives, Serviceablity tests for ARM32
    + JDK-8213845: ARM32: Interpreter doesn't call result handler
    after native calls
    + JDK-8214128: ARM32: wrong stack alignment on
    Deoptimization::unpack_frames
    + JDK-8214512: ARM32: Jtreg test compiler/c2/Test8062950.java
    fails on ARM
    + JDK-8214854: JDWP: Unforseen output truncation in logging
    + JDK-8214922: Add vectorization support for fmin/fmax
    + JDK-8215009: GCC 8 compilation error in libjli
    + JDK-8216184: CDS/appCDS tests failed on Windows due to long
    path to a classlist file
    + JDK-8216259: AArch64: Vectorize Adler32 intrinsics
    + JDK-8216314: SIGILL in CodeHeapState::print_names()
    + JDK-8217348: assert(thread-&gt;is_Java_thread()) failed: just
    checking
    + JDK-8217465: [REDO] - Optimize CodeHeap Analytics
    + JDK-8217561: X86: Add floating-point Math.min/max intrinsics
    + JDK-8217918: C2: -XX:+AggressiveUnboxing is broken
    + JDK-8218458: [TESTBUG] runtime/NMT/
    /CheckForProperDetailStackTrace.java fails with Expected
    stack trace missing from output
    + JDK-8219142: Remove unused JIMAGE_ResourcePath
    + JDK-8219586: CodeHeap State Analytics processes dead nmethods
    + JDK-8220074: Clean up GCC 8.3 errors in LittleCMS
    + JDK-8220407: compiler/intrinsics/math/
    /TestFpMinMaxIntrinsics.java timedout
    + JDK-8222302: [TESTBUG] test/hotspot/jtreg/compiler/intrinsics/
    /sha/cli/TestUseSHAOptionOnUnsupportedCPU.java fails on any
    other CPU
    + JDK-8222412: AARCH64: multiple instructions encoding issues
    + JDK-8223020: aarch64: expand minI_rReg and maxI_rReg patterns
    into separate instructions
    + JDK-8223444: Improve CodeHeap Free Space Management
    + JDK-8223504: Improve performance of forall loops by better
    inlining of "iterator()" methods
    + JDK-8223667: ASAN build broken
    + JDK-8225081: Remove Telia Company CA certificate expiring in
    April 2021
    + JDK-8225116: Test OwnedWindowsLeak.java intermittently fails
    + JDK-8225438: javax/net/ssl/TLSCommon/
    /TestSessionLocalPrincipal.java failed with Read timed out
    + JDK-8225756: [testbug] compiler/loopstripmining/
    /CheckLoopStripMining.java sets too short a
    SafepointTimeoutDelay
    + JDK-8226374: Restrict TLS signature schemes and named groups
    + JDK-8226627: assert(t-&gt;singleton()) failed: must be a constant
    + JDK-8226721: Missing intrinsics for Math.ceil, floor, rint
    + JDK-8227080: (fs) Files.newInputStream(...).skip(n) is slow
    + JDK-8227222: vmTestbase/jit/FloatingPoint/gen_math/Loops04/
    /Loops04.java failed XMM register should be 0-15
    + JDK-8227609: (fs) Files.newInputStream(...).skip(n) should
    allow skipping beyond file size
    + JDK-8230428: Cleanup dead CastIP node code in formssel.cpp
    + JDK-8231460: Performance issue (CodeHeap) with large free
    blocks
    + JDK-8231713: x86_32 build failures after JDK-8226721 (Missing
    intrinsics for Math.ceil, floor, rint)
    + JDK-8231841: AArch64: debug.cpp help() is missing an AArch64
    line for pns
    + JDK-8232084: HotSpot build failed with GCC 9.2.1
    + JDK-8232591: AArch64: Add missing match rules for smaddl,
    smsubl and smnegl
    + JDK-8233185: HttpServer.stop() blocks indefinitely when
    called on dispatch thread
    + JDK-8233787: Break cycle in vm_version* includes
    + JDK-8233948: AArch64: Incorrect mapping between OptoReg and
    VMReg for high 64 bits of Vector Register
    + JDK-8234355: Buffer overflow in jcmd GC.class_stats due to
    too many classes
    + JDK-8235368: Update BCEL to Version 6.4.1
    + JDK-8236859: WebSocket over authenticating proxy fails with
    NPE
    + JDK-8236992: AArch64: remove redundant load_klass in itable
    stub
    + JDK-8237743: test/langtools/jdk/jshell/
    /FailOverExecutionControlTest.java fails No
    ExecutionControlProvider with name 'nonExistent' and parameter
    keys: []
    + JDK-8237804: sun/security/mscapi tests fail with "Key pair
    not generated, alias &lt;nnnnnn&gt; already exists"
    + JDK-8238175: CTW: Class.getDeclaredMethods fails with
    assert(k-&gt;is_subclass_of(SystemDictionary::Throwable_klass()))
    failed: invalid exception class
    + JDK-8238567: SoftMainMixer.processAudioBuffers(): Wrong
    handling of stoppedMixers
    + JDK-8238812: assert(false) failed: bad AD file
    + JDK-8239312: [macos] javax/swing/JFrame/NSTexturedJFrame/
    /NSTexturedJFrame.java
    + JDK-8239386: handle ContendedPaddingWidth in
    vm_version_aarch64
    + JDK-8239536: Can't use 'java.util.List' object after
    importing 'java.awt.List'
    + JDK-8240487: Cleanup whitespace in .cc, .hh, .m, and .mm files
    + JDK-8240848: ArrayIndexOutOfBoundsException buf for
    TextCallbackHandler
    + JDK-8241082: Upgrade IANA Language Subtag Registry data to
    03-16-2020 version
    + JDK-8241087: Build failure with VS 2019 (16.5.0) due to C2039
    and C2873
    + JDK-8241101: [s390] jtreg test failure after JDK-8238696: not
    conformant features string
    + JDK-8241248: NullPointerException in
    sun.security.ssl.HKDF.extract(HKDF.java:93)
    + JDK-8241372: Several test failures due to
    javax.net.ssl.SSLException: Connection reset
    + JDK-8241475: AArch64: Add missing support for PopCountVI node
    + JDK-8241829: Cleanup the code for PrinterJob on windows
    + JDK-8241960: The SHA3 message digests impl of SUN provider
    are not thread safe after cloned
    + JDK-8242010: Upgrade IANA Language Subtag Registry to Version
    2020-04-01
    + JDK-8242429: Better implementation for sign extract
    + JDK-8242557: Add length limit for strings in PNGImageWriter
    + JDK-8242919: Paste locks up jshell
    + JDK-8243155: AArch64: Add support for SqrtVF
    + JDK-8243240: AArch64: Add support for MulVB
    + JDK-8243452: JFR: Could not create chunk in repository with
    over 200 recordings
    + JDK-8243559: Remove root certificates with 1024-bit keys
    + JDK-8243597: AArch64: Add support for integer vector abs
    + JDK-8244031: HttpClient should have more tests for HEAD
    requests
    + JDK-8244205: HTTP/2 tunnel connections through proxy may be
    reused regardless of which proxy is selected
    + JDK-8244847: Linux/PPC: runtime/CompressedOops/
    /CompressedClassPointers: smallHeapTest fails
    + JDK-8245511: G1 adaptive IHOP does not account for
    reclamation of humongous objects by young GC
    + JDK-8246274: G1 old gen allocation tracking is not in a
    separate class
    + JDK-8247354: [aarch64] PopFrame causes
    assert(oopDesc::is_oop(obj)) failed: not an oop
    + JDK-8247408: IdealGraph bit check expression canonicalization
    + JDK-8247432: Update IANA Language Subtag Registry to Version
    2020-09-29
    + JDK-8247438: JShell: When FailOverExecutionControlProvider
    fails the proximal cause is not shown
    + JDK-8247753: UIManager.getSytemLookAndFeelClassName() returns
    wrong value on Fedora 32
    + JDK-8248043: Need to eliminate excessive i2l conversions
    + JDK-8248411: [aarch64] Insufficient error handling when
    CodeBuffer is exhausted
    + JDK-8248568: compiler/c2/TestBit.java failed: test missing
    from stdout/stderr
    + JDK-8248870: AARCH64: I2L/L2I conversions can be skipped for
    masked positive values
    + JDK-8249142: java/awt/FontClass/CreateFont/DeleteFont.sh is
    unstable
    + JDK-8249189: AARCH64: more L2I conversions can be skipped
    + JDK-8249719: MethodHandle performance suffers from bad
    ResolvedMethodTable hash function
    + JDK-8249875: GCC 10 warnings -Wtype-limits with JFR code
    + JDK-8250635: MethodArityHistogram should use Compile_lock in
    favour of fancy checks
    + JDK-8250876: Fix issues with cross-compile on macos
    + JDK-8251031: Some vmTestbase/nsk/monitoring/RuntimeMXBean
    tests fail with hostnames starting from digits
    + JDK-8251525: AARCH64: Faster Math.signum(fp)
    + JDK-8252259: AArch64: Adjust default value of FLOATPRESSURE
    + JDK-8252311: AArch64: save two words in itable lookup stub
    + JDK-8252779: compiler/graalunit/HotspotTest.java failed after
    8251525
    + JDK-8252883: AccessDeniedException caused by delayed file
    deletion on Windows
    + JDK-8253167: ARM32 builds fail after JDK-8247910
    + JDK-8253572: [windows] CDS archive may fail to open with long
    file names
    + JDK-8253923: C2 doesn't always run loop opts for compilations
    that include loops
    + JDK-8253948: Memory leak in ImageFileReader
    + JDK-8254631: Better support ALPN byte wire values in SunJSSE
    + JDK-8254717: isAssignableFrom checks in
    KeyFactorySpi.engineGetKeySpec appear to be backwards
    + JDK-8255086: Update the root locale display names
    + JDK-8255625: AArch64: Implement Base64.encodeBlock
    accelerator/intrinsic
    + JDK-8255763: C2: OSR miscompilation caused by invalid memory
    instruction placement
    + JDK-8255992: JFR EventWriter does not use first string from
    StringPool with id 0
    + JDK-8256037: [TESTBUG] com/sun/jndi/dns/ConfigTests/
    /PortUnreachable.java fails due to the hard coded threshold
    is small
    + JDK-8256244: java/lang/ProcessHandle/PermissionTest.java
    fails with TestNG 7.1
    + JDK-8256287: [windows] add loop fuse to
    map_or_reserve_memory_aligned
    + JDK-8256523: Streamline Java SHA2 implementation
    + JDK-8257414: Drag n Drop target area is wrong on high DPI
    systems
    + JDK-8257569: Failure observed with
    JfrVirtualMemory::initialize
    + JDK-8257574: C2: "failed: parsing found no loops but there
    are some" assert failure
    + JDK-8257580: Bump update version for OpenJDK: jdk-11.0.12
    + JDK-8257604: JNI_ArgumentPusherVaArg leaks valist
    + JDK-8257621: JFR StringPool misses cached items across
    consecutive recordings
    + JDK-8257796: [TESTBUG]
    TestUseSHA512IntrinsicsOptionOnSupportedCPU.java fails
    on x86_32
    + JDK-8257822: C2 crashes with SIGFPE due to a division that
    floats above its zero check
    + JDK-8257828: SafeFetch may crash if invoked in non-JavaThreads
    + JDK-8257853: Remove dependencies on JNF's JNI utility
    functions in AWT and 2D code
    + JDK-8257858: [macOS]: Remove JNF dependency from
    libosxsecurity/KeystoreImpl.m
    + JDK-8257860: [macOS]: Remove JNF dependency from
    libosxkrb5/SCDynamicStoreConfig.m
    + JDK-8257988: Remove JNF dependency from
    libsaproc/MacosxDebuggerLocal.m
    + JDK-8258414: OldObjectSample events too expensive
    + JDK-8258505: [TESTBUG] TestDivZeroWithSplitIf.java fails due
    to missing UnlockDiagnosticVMOptions
    + JDK-8258753: StartTlsResponse.close() hangs due to
    synchronization issues
    + JDK-8259061: C2: assert(found) failed: memory-writing node is
    not placed in its original loop or an ancestor of it
    + JDK-8259227: C2 crashes with SIGFPE due to a division that
    floats above its zero check
    + JDK-8259232: Bad JNI lookup during printing
    + JDK-8259276: C2: Empty expression stack when reexecuting
    tableswitch/lookupswitch instructions after deoptimization
    + JDK-8259343: [macOS] Update JNI error handling in Cocoa code.
    + JDK-8259585: Accessible actions do not work on mac os x
    + JDK-8259651: [macOS] Replace JNF_COCOA_ENTER/EXIT macros
    + JDK-8259662: Don't wrap SocketExceptions into SSLExceptions
    in SSLSocketImpl
    + JDK-8259710: Inlining trace leaks memory
    + JDK-8259729: Missed JNFInstanceOf -&gt; IsInstanceOf conversion
    + JDK-8259777: Incorrect predication condition generated by ADLC
    + JDK-8259786: initialize last parameter of getpwuid_r
    + JDK-8259843: initialize dli_fname array before calling
    dll_address_to_library_name
    + JDK-8259869: [macOS] Remove desktop module dependencies on
    JNF Reference APIs
    + JDK-8259886: Improve SSL session cache performance and
    scalability
    + JDK-8259983: do not use uninitialized expand_ms value in
    G1CollectedHeap::expand_heap_after_young_collection
    + JDK-8260030: Improve stringStream buffer handling
    + JDK-8260236: better init AnnotationCollector _contended_group
    + JDK-8260255: C1: LoopInvariantCodeMotion constructor can
    leave some fields uninitialized
    + JDK-8260284: C2: assert(_base == Int) failed: Not an Int
    + JDK-8260380: Upgrade to LittleCMS 2.12
    + JDK-8260420: C2 compilation fails with assert(found_sfpt)
    failed: no node in loop that's not input to safepoint
    + JDK-8260426: awt debug_mem.c DMem_AllocateBlock might leak
    memory
    + JDK-8260432: allocateSpaceForGP in freetypeScaler.c might
    leak memory
    + JDK-8260616: Removing remaining JNF dependencies in the
    java.desktop module
    + JDK-8260653: Unreachable nodes keep speculative types alive
    + JDK-8260707: java/lang/instrument/PremainClass/
    /InheritAgent0100.java times out
    + JDK-8260925: HttpsURLConnection does not work  with other
    JSSE provider.
    + JDK-8260926: Trace resource exhausted events unconditionally
    + JDK-8261020: Wrong format parameter in
    create_emergency_chunk_path
    + JDK-8261027: AArch64: Support for LSE atomics C++ HotSpot code
    + JDK-8261167: print_process_memory_info add a close call after
    fopen
    + JDK-8261170: Upgrade to freetype 2.10.4
    + JDK-8261198: [macOS] Incorrect JNI parameters in number
    conversion in A11Y code
    + JDK-8261235: C1 compilation fails with
    assert(res-&gt;vreg_number() == index) failed: conversion check
    + JDK-8261261: The version extra fields needs to be overridable
    in jib-profiles.js
    + JDK-8261262: Kitchensink24HStress.java crashed with
    EXCEPTION_ACCESS_VIOLATION
    + JDK-8261354: SIGSEGV at MethodIteratorHost
    + JDK-8261355: No data buffering in SunPKCS11 Cipher encryption
    when the underlying mechanism has no padding
    + JDK-8261397: try catch Method failing to work when dividing
    an integer by 0
    + JDK-8261422: Adjust problematic String.format calls in
    jdk/internal/util/Preconditions.java outOfBoundsMessage
    + JDK-8261447: MethodInvocationCounters frequently run into
    overflow
    + JDK-8261481: Cannot read Kerberos settings in dynamic store
    on macOS Big Sur
    + JDK-8261505: Test test/hotspot/jtreg/gc/parallel/
    /TestDynShrinkHeap.java killed by Linux OOM Killer
    + JDK-8261601: free memory in early return in
    Java_sun_nio_ch_sctp_SctpChannelImpl_receive0
    + JDK-8261649: AArch64: Optimize LSE atomics in C++ code
    + JDK-8261730: C2 compilation fails with
    assert(store-&gt;find_edge(load) != -1) failed: missing
    precedence edge
    + JDK-8261752: Multiple GC test are missing memory requirements
    + JDK-8261791: (sctp) handleSendFailed in SctpChannelImpl.c
    potential leaks
    + JDK-8261812: C2 compilation fails with assert(!had_error)
    failed: bad dominance
    + JDK-8261914: IfNode::fold_compares_helper faces
    non-canonicalized bool when running JRuby JSON workload
    + JDK-8262093: java/util/concurrent/tck/JSR166TestCase.java
    failed "assert(false) failed: unexpected node"
    + JDK-8262110: DST starts from incorrect time in 2038
    + JDK-8262121: [11u] Redo 8244287: JFR: Methods samples have
    line number 0
    + JDK-8262163: Extend settings printout in jcmd VM.metaspace
    + JDK-8262295: C2: Out-of-Bounds Array Load from Clone Source
    + JDK-8262298: G1BarrierSetC2::step_over_gc_barrier fails with
    assert "bad barrier shape"
    + JDK-8262446: DragAndDrop hangs on Windows
    + JDK-8262461: handle wcstombsdmp return value correctly in
    unix awt_InputMethod.c
    + JDK-8262465: Very long compilation times and high memory
    consumption in C2 debug builds
    + JDK-8262726: AArch64: C1 StubAssembler::call_RT can corrupt
    stack
    + JDK-8262739: String inflation C2 intrinsic prevents insertion
    of anti-dependencies
    + JDK-8262829: Native crash in
    Win32PrintServiceLookup.getAllPrinterNames()
    + JDK-8262837: handle split_USE correctly
    + JDK-8262900: ToolBasicTest fails to access HTTP server it
    starts
    + JDK-8263260: [s390] Support latest hardware (z14 and z15)
    + JDK-8263311: Watch registry changes for remote printers
    update instead of polling
    + JDK-8263361: Incorrect arraycopy stub selected by C2 for SATB
    collectors
    + JDK-8263404: RsaPrivateKeySpec is always recognized as
    RSAPrivateCrtKeySpec in RSAKeyFactory.engineGetKeySpec
    + JDK-8263425: AArch64: two potential bugs in C1
    LIRGenerator::generate_address()
    + JDK-8263448: CTW: fatal error: meet not symmetric
    + JDK-8263504: Some OutputMachOpcodes fields are uninitialized
    + JDK-8263557: Possible NULL dereference in
    Arena::destruct_contents()
    + JDK-8263558: Possible NULL dereference in fast path arena
    free if ZapResourceArea is true
    + JDK-8263676: AArch64: one potential bug in C1
    LIRGenerator::generate_address()
    + JDK-8263729: [test] divert spurious output away from stream
    under test in ProcessBuilder Basic test
    + JDK-8263846: Bad JNI lookup getFocusOwner in accessibility
    code on Mac OS X
    + JDK-8264047: Duplicate global variable 'jvm' in libjavajpeg
    and libawt
    + JDK-8264096: slowdebug jvm crashes when StrInflatedCopy match
    rule is not supported
    + JDK-8264151: ciMethod::ensure_method_data() should return
    false is loading resulted in empty state
    + JDK-8264173: [s390] Improve Hardware Feature Detection And
    Reporting
    + JDK-8264190: Harden TLS interop tests
    + JDK-8264223: CodeHeap::verify fails extra_hops assertion in
    fastdebug test
    + JDK-8264328: Broken license in
    javax/swing/JComboBox/8072767/bug8072767.java
    + JDK-8264360: Loop strip mining verification fails with
    "should be on the backedge"
    + JDK-8264626: C1 should be able to inline excluded methods
    + JDK-8264640: CMS ParScanClosure misses a barrier
    + JDK-8264786: [macos] All Swing/AWT apps cause Allow
    Notifications prompt to appear when app is launched
    + JDK-8264821: DirectIOTest fails on a system with large block
    size
    + JDK-8264848: [macos] libjvm.dylib linker warning due to macOS
    version mismatch
    + JDK-8264923: PNGImageWriter.write_zTXt throws Exception with
    a typo
    + JDK-8264958: C2 compilation fails with assert "n is later
    than its clone"
    + JDK-8265099: Revert backport to 11u of 8236859: WebSocket
    over authenticating proxy fails with NPE
    + JDK-8265154: vinserti128 operand mix up for KNL platforms
    + JDK-8265239: Shenandoah: Shenandoah heap region count could
    be off by 1
    + JDK-8265417: Backport of JDK-8249672 breaks Solaris x86 build
    + JDK-8265421: java/lang/String/StringRepeat.java test is
    missing a memory requirement
    + JDK-8265462: Handle multiple slots in the NSS Internal Module
    from SunPKCS11's Secmod
    + JDK-8265537: x86 version string truncated after JDK-8249672
    11u backport
    + JDK-8265666: Enable AIX build platform to make external debug
    symbols
    + JDK-8265677: CMS: CardTableBarrierSet::write_ref_array_work()
    lacks storestore barrier
    + JDK-8265690: Use the latest Ubuntu base image version in
    Docker testing
    + JDK-8265718: Build failure after JDK-8258414 11u backport
    + JDK-8265750: Fatal error in safepoint.cpp after backport of
    8258414
    + JDK-8265784: [C2] Hoisting of DecodeN leaves MachTemp inputs
    behind
    + JDK-8265938: C2's conditional move optimization does not
    handle top Phi
    + JDK-8266220: keytool still prompt for store password on a
    password-less pkcs12 file if -storetype pkcs12 is specified
    + JDK-8266293: Key protection using PBEWithMD5AndDES fails with
    "java.security.InvalidAlgorithmParameterException: Salt must
    be 8 bytes long"
    + JDK-8266713: [AIX] Build failure after 11u backport of
    JDK-8247753
    + JDK-8266802: Shenandoah: Round up region size to page size
    unconditionally
    + JDK-8266892: avoid maybe-uninitialized gcc warnings on linux
    s390x
    + JDK-8266929: Unable to use algorithms from 3p providers
    + JDK-8267235: [macos_aarch64]
    InterpreterRuntime::throw_pending_exception messing up LR
    results in crash
    + JDK-8267561: Shenandoah: Reference processing not properly
    setup for outside of cycle degenerated GC
    + JDK-8267599: Revert the change to the default PKCS12
    macAlgorithm and macIterationCount props for 11u/8u/7u
    + JDK-8267641: [11u] 8227609 backport typo
    + JDK-8267721: Enable sun/security/pkcs11 tests for Amazon
    Linux 2 AArch64
    + JDK-8268678: LetsEncryptCA.java test fails as Let's Encrypt
    Authority X3 is retired</changelog>
  <changelog author="schwab@suse.de" date="1628078400">- riscv64-zero.patch: Add support for riscv64 (zero VM)</changelog>
  <changelog author="fstrba@suse.com" date="1629979200">- Added patch:
  * jdk11-glibc234.patch
    + fix build with glibc-2.34 (bsc#1189201)</changelog>
  <changelog author="fstrba@suse.com" date="1631534400">- Modified patch:
  * nss-security-provider.patch
    + revert recent changes making NSS provider the default one
    + fixes bsc#1190252</changelog>
  <changelog author="fstrba@suse.com" date="1631793600">- Added patch:
  * fips.patch
    + implement FIPS support in OpenJDK</changelog>
  <changelog author="fstrba@suse.com" date="1634817600">- Update to upstream tag jdk-11.0.13+8 (October 2021 CPU)
  * Security fixes
    + JDK-8163326, CVE-2021-35550, bsc#1191901: Update the default
    enabled cipher suites preference
    + JDK-8254967, CVE-2021-35565, bsc#1191909:
    com.sun.net.HttpsServer spins on TLS session close
    + JDK-8263314: Enhance XML Dsig modes
    + JDK-8265167, CVE-2021-35556, bsc#1191910: Richer Text Editors
    + JDK-8265574: Improve handling of sheets
    + JDK-8265580, CVE-2021-35559, bsc#1191911: Enhanced style for
    RTF kit
    + JDK-8265776: Improve Stream handling for SSL
    + JDK-8266097, CVE-2021-35561, bsc#1191912: Better hashing
    support
    + JDK-8266103: Better specified spec values
    + JDK-8266109: More Resilient Classloading
    + JDK-8266115: More Manifest Jar Loading
    + JDK-8266137, CVE-2021-35564, bsc#1191913: Improve Keystore
    integrity
    + JDK-8266689, CVE-2021-35567, bsc#1191903: More Constrained
    Delegation
    + JDK-8267086: ArrayIndexOutOfBoundsException in
    java.security.KeyFactory.generatePublic
    + JDK-8267712: Better LDAP reference processing
    + JDK-8267729, CVE-2021-35578, bsc#1191904: Improve TLS client
    handshaking
    + JDK-8267735, CVE-2021-35586, bsc#1191914: Better BMP support
    + JDK-8268193: Improve requests of certificates
    + JDK-8268199: Correct certificate requests
    + JDK-8268205: Enhance DTLS client handshake
    + JDK-8268506: More Manifest Digests
    + JDK-8269618, CVE-2021-35603, bsc#1191906: Better session
    identification
    + JDK-8269624: Enhance method selection support
    + JDK-8270398: Enhance canonicalization
    + JDK-8270404: Better canonicalization
  * Other changes
    + JDK-8024368: private methods are allocated vtable indices
    + JDK-8042902: Test java/net/Inet6Address/serialize/
    /Inet6AddressSerializationTest.java fails intermittently
    + JDK-8140466: ChaCha20 and Poly1305 TLS Cipher Suites
    + JDK-8157404: Unable to read certain PKCS12 keystores from
    SequenceInputStream
    + JDK-8158066: SourceDebugExtensionTest fails to rename file
    + JDK-8168304: Make all of DependencyContext_test available in
    product mode
    + JDK-8169246: java/net/DatagramSocket/ReportSocketClosed.java
    fails intermittently with BindException
    + JDK-8181313: SA: Remove libthread_db dependency on Linux
    + JDK-8193214: Incorrect annotations.without.processors
    warnings with JDK 9
    + JDK-8194230: jdk/internal/jrtfs/remote/
    /RemoteRuntimeImageTest.java fails with
    java.lang.NullPointerException
    + JDK-8196092: javax/swing/JComboBox/8032878/bug8032878.java
    fails
    + JDK-8199931: java/net/MulticastSocket/
    /UnreferencedMulticastSockets.java fails with "incorrect data
    received"
    + JDK-8206083: Make tools/javac/api/T6265137.java robust to JDK
    version changes
    + JDK-8206350: java/util/Locale/bcp47u/SystemPropertyTests.java
    failed on Mac 10.13 with zh_CN and zh_TW locales.
    + JDK-8207316: java/nio/channels/spi/SelectorProvider/
    /inheritedChannel/InheritedChannelTest.java failed
    + JDK-8208227: tools/jdeps/DotFileTest.java fails on Win-X64
    + JDK-8208363: test/jdk/java/lang/Package/
    /PackageFromManifest.java missing module dependencies
    declaration
    + JDK-8209380: ARM: cleanup maybe-uninitialized and reorder
    compiler warnings
    + JDK-8209768: Refactor java/util/prefs/CheckUserPrefsStorage.sh
    to plain java test
    + JDK-8209772: Refactor shell test java/util/ServiceLoader/
    /basic/basic.sh to java
    + JDK-8209773: Refactor shell test javax/naming/module/basic.sh
    to java
    + JDK-8209832: Refactor jdk/internal/reflect/Reflection/
    /GetCallerClassTest.sh to plain java test
    + JDK-8209930: Refactor java/util/zip/ZipFile/deletetempjar.sh
    to plain java test
    + JDK-8210406: Refactor java.util.PluggableLocale:i18n shell
    tests to plain java tests
    + JDK-8210407: Refactor java.util.Calendar:i18n shell tests to
    plain java tests
    + JDK-8210495: compiler crashes because of illegal signature in
    otherwise legal code
    + JDK-8210669: Some launcher tests assume a pre-JDK 9 run-time
    image layout
    + JDK-8210802: temp files left by tests in
    jdk/java/net/httpclient
    + JDK-8210819: Update the host name in CNameTest.java
    + JDK-8210908: Refactor java/util/prefs/PrefsSpi.sh to plain
    java test
    + JDK-8210934: Move sun/net/www/protocol/http/
    /GetErrorStream.java to OpenJDK
    + JDK-8210959: JShell fails and exits when statement throws an
    exception whose message contains a '%'.
    + JDK-8211055: Provide print to a file (PDF) feature even when
    printer was not connected
    + JDK-8211092: test/jdk/sun/net/www/http/HttpClient/
    /MultiThreadTest.java fails intermittently when cleaning up
    + JDK-8211296: Remove HotSpot deprecation warning suppression
    for Mac/clang
    + JDK-8211325: test/jdk/java/net/Socket/LingerTest.java fails
    with cleaning up
    + JDK-8212040: Compilation error due to wrong usage of
    NSPrintJobDispositionValue in mac10.12
    + JDK-8212695: Add explicit timeout to several HTTP Client tests
    + JDK-8212718: Refactor some annotation processor tests to
    better use collections
    + JDK-8213007: Update the link in test/jdk/sun/security/
    /provider/SecureRandom/DrbgCavp.java
    + JDK-8213137: Remove static initialization of monitor/mutex
    instances
    + JDK-8213235: java/nio/channels/SocketChannel/
    /AsyncCloseChannel.java fails with threads that didn't exit
    + JDK-8213409: Refactor sun.text.IntHashtable:i18n shell tests
    to plain java tests
    + JDK-8213576: Make test AsyncCloseChannel.java run in othervm
    + JDK-8213694: Test Timeout.java should run in othervm mode
    + JDK-8213718: [TEST] Wrong classname in vmTestbase/nsk/stress/
    /except/except002 and except003
    + JDK-8213922: fix ctw stand-alone build
    + JDK-8214195: Align stdout messages in
    test/jdk/java/math/BigInteger/PrimitiveConversionTests.java
    + JDK-8214520: [TEST_BUG] sun/security/mscapi/nonUniqueAliases/
    /NonUniqueAliases.java failed with incorrect jtreg tags order
    + JDK-8214937: sun/security/tools/jarsigner/warnings/
    /NoTimestampTest.java failed due to unexpected expiration date
    + JDK-8216532: tools/launcher/Test7029048.java fails (Solaris)
    + JDK-8217825: Verify @AfterTest is used correctly in WebSocket
    tests
    + JDK-8218145: block_if_requested is not proper inlined due to
    size
    + JDK-8219417: bump jtreg requiredVersion to b14
    + JDK-8219552: bump jtreg requiredVersion to b14 in
    test/jdk/sanity/client/
    + JDK-8219804: java/net/MulticastSocket/Promiscuous.java fails
    intermittently due to NumberFormatException
    + JDK-8220445: Support for side by side MSVC Toolset versions
    + JDK-8221988: add possibility to build with Visual Studio 2019
    + JDK-8222751: closed/test/jdk/sun/security/util/
    /DerIndefLenConverter/IndefBerPkcs12.java fail
    + JDK-8223050: JVMCI: findUniqueConcreteMethod() should not use
    Dependencies::find_unique_concrete_method() for non-virtual
    methods
    + JDK-8224853: CDS address sanitizer errors
    + JDK-8225082: Remove IdenTrust certificate that is expiring in
    September 2021
    + JDK-8225583: Examine the HttpResponse.BodySubscribers for
    null handling and multiple subscriptions
    + JDK-8225690: Multiple AttachListener threads can be created
    + JDK-8225790: Two NestedDialogs tests fail on Ubuntu
    + JDK-8226319: Add forgotten test/jdk/java/net/httpclient/
    /BodySubscribersTest.java
    + JDK-8226533: JVMCI: findUniqueConcreteMethod should handle
    statically bindable methods directly
    + JDK-8226602: Test convenience reactive primitives from
    java.net.http with RS TCK
    + JDK-8226683: Remove review suggestion from fix to 8219804
    + JDK-8227738: jvmti/DataDumpRequest/datadumpreq001 failed due
    to "exit code is 134"
    + JDK-8227766: CheckUnhandledOops is broken in MemAllocator
    + JDK-8227815: Minimal VM: set_state is not a member of
    AttachListener
    + JDK-8230674: Heap dumps should exclude dormant CDS archived
    objects of unloaded classes
    + JDK-8230808: Remove Access::equals()
    + JDK-8230841: Remove oopDesc::equals()
    + JDK-8231717: Improve performance of charset decoding when
    charset is always compactable
    + JDK-8232243: Wrong caret position in JTextPane on Windows
    with a screen resolution &gt; 100%
    + JDK-8232782: Shenandoah: streamline post-LRB CAS barrier
    (aarch64)
    + JDK-8233790: Forward output from heap dumper to jcmd/jmap
    + JDK-8233989: Create an IPv4 version of
    java/net/MulticastSocket/SetLoopbackMode.java
    + JDK-8234510: Remove file seeking requirement for writing a
    heap dump
    + JDK-8235211: serviceability/attach/
    /RemovingUnixDomainSocketTest.java fails with
    AttachNotSupportedException: Unable to open socket file
    + JDK-8235216: typo in test filename
    + JDK-8235866: bump jtreg requiredVersion to 4.2b16
    + JDK-8236111: narrow allowSmartActionArgs disabling
    + JDK-8236413: AbstractConnectTimeout should tolerate both
    NoRouteToHostException and UnresolvedAddressException
    + JDK-8236671: NullPointerException in JKS keystore
    + JDK-8238930: problem list compiler/c2/Test8004741.java
    + JDK-8238943: switch to jtreg 5.0
    + JDK-8240555: Using env of JAVA_TOOL_OPTIONS and _JAVA_OPTIONS
    breaks QuietOption.java test
    + JDK-8240983: Incorrect copyright header in Apache Santuario
    2.1.3 files
    + JDK-8241336: Some java.net tests failed with
    NoRouteToHostException on MacOS with special network
    configuration
    + JDK-8241353: NPE in ToolProvider.getSystemJavaCompiler
    + JDK-8241768: git needs .gitattributes
    + JDK-8242882: opening jar file with large manifest might throw
    NegativeArraySizeException
    + JDK-8244973: serviceability/attach/
    /RemovingUnixDomainSocketTest.java fails "stderr was not
    empty"
    + JDK-8245134: test/lib/jdk/test/lib/security/
    /KeyStoreUtils.java should allow to specify aliases
    + JDK-8246261: TCKLocalTime.java failed due to "AssertionError:
    expected [18:14:22] but found [18:14:23]"
    + JDK-8246387: switch to jtreg 5.1
    + JDK-8247421: [TESTBUG] ReturnBlobToWrongHeapTest.java failed
    allocating blob
    + JDK-8247469: getSystemCpuLoad() returns -1 on linux when some
    offline cpus are present and cpusets.effective_cpus is not
    available
    + JDK-8248352: [TEST_BUG] Test test/jdk/java/awt/font/
    /TextLayout/ArabicDiacriticTest.java can leave frame open
    + JDK-8248403: AArch64: Remove uses of kernel integer types
    + JDK-8248414: AArch64: Remove uses of long and unsigned long
    ints
    + JDK-8248657: Windows: strengthening in ThreadCritical
    regarding memory model
    + JDK-8248666: AArch64: Use THREAD_LOCAL instead of __thread
    + JDK-8248668: AArch64: Avoid MIN/MAX macros when using MSVC
    + JDK-8248671: AArch64: Remove unused variables
    + JDK-8248682: AArch64: Use ATTRIBUTE_ALIGNED helper
    + JDK-8248816: C1: Fix signature conflict in
    LIRGenerator::strength_reduce_multiply
    + JDK-8249095: tools/javac/launcher/SourceLauncherTest.java
    fails on Windows
    + JDK-8249548: backward focus traversal gets stuck in button
    group
    + JDK-8249773: Upgrade ReceiveISA.java test to be resilient to
    failure due to stray packets and interference
    + JDK-8249897: jdk/javadoc/tool/LangVers.java uses @ignore w/o
    bug-id
    + JDK-8249898: jdk/javadoc/tool/6176978/T6176978.java uses
    @ignore w/o bug-id
    + JDK-8249899: jdk/javadoc/tool/InlineTagsWithBraces.java uses
    @ignore w/o bug-id
    + JDK-8250588: Shenandoah: LRB needs to save/restore fp
    registers for runtime call
    + JDK-8250824: AArch64: follow up for JDK-8248414
    + JDK-8251166: Add automated testcases for changes done in
    JDK-8214112
    + JDK-8251252: Add automated testcase for fix done in
    JDK-8214253
    + JDK-8251254: Add automated test for fix done in JDK-8218472
    + JDK-8251361: Potential race between Logger configuration and
    GCs in HttpURLConWithProxy test
    + JDK-8251549: Update docs on building for Git
    + JDK-8251945: SIGSEGV in
    PackageEntry::purge_qualified_exports()
    + JDK-8252194: Add automated test for fix done in JDK-8218469
    + JDK-8252648: Shenandoah: name gang tasks consistently
    + JDK-8252825: Add automated test for fix done in JDK-8218479
    + JDK-8252853: AArch64: gc/shenandoah/TestVerifyJCStress.java
    fails intermittently with C1
    + JDK-8252857: AArch64: Shenandoah C1 CAS is not sequentially
    consistent
    + JDK-8253048: AArch64: When CallLeaf, no need to preserve
    callee-saved registers in caller
    + JDK-8253424: Add support for running pre-submit testing using
    GitHub Actions
    + JDK-8253631: Remove unimplemented CompileBroker methods after
    JEP-165
    + JDK-8253865: Pre-submit testing using GitHub Actions does not
    detect failures reliably
    + JDK-8253899: Make IsClassUnloadingEnabled signature match
    specification
    + JDK-8254024: Enhance native libs for AWT and Swing to work
    with GraalVM Native Image
    + JDK-8254054: Pre-submit testing using GitHub Actions should
    not use the deprecated set-env command
    + JDK-8254173: Add Zero, Minimal hotspot targets to submit
    workflow
    + JDK-8254175: Build no-pch configuration in debug mode for
    submit checks
    + JDK-8254244: Some code emitted by TemplateTable::branch is
    unused when running TieredCompilation
    + JDK-8254270: linux 32 bit build doesn't compile
    libjdwp/log_messages.c
    + JDK-8254282: Add Linux x86_32 builds to submit workflow
    + JDK-8254850: Update terminology in java.awt.GridBagLayout
    source code comments
    + JDK-8255255: Update Apache Santuario (XML Signature) to
    version 2.2.1
    + JDK-8255305: Add Linux x86_32 tier1 to submit workflow
    + JDK-8255352: Archive important test outputs in submit workflow
    + JDK-8255373: Submit workflow artifact name is always
    "test-results_.zip"
    + JDK-8255452: Doing GC during JVMTI MethodExit event posting
    breaks return oop
    + JDK-8255718: Zero: VM should know it runs in interpreter-only
    mode
    + JDK-8255790: GTKL&amp;F: Java 16 crashes on initialising GTKL&amp;F
    on Manjaro Linux
    + JDK-8255810: Zero: build fails without JVMTI
    + JDK-8255895: Submit workflow artifacts miss hs_errs/replays
    due to ZIP include mismatch
    + JDK-8256127: Add cross-compiled foreign architectures builds
    to submit workflow
    + JDK-8256215: Shenandoah: re-organize saving/restoring machine
    state in assembler code
    + JDK-8256267: Relax compiler/floatingpoint/NaNTest.java for
    x86_32 and lower -XX:+UseSSE
    + JDK-8256277: Github Action build on macOS should define OS
    and Xcode versions
    + JDK-8256354: Github Action build on Windows should define OS
    and MSVC versions
    + JDK-8256393: Github Actions build on Linux should define OS
    and GCC versions
    + JDK-8256414: add optimized build to submit workflow
    + JDK-8256747: GitHub Actions: decouple the hotspot build-only
    jobs from Linux x64 testing
    + JDK-8257056: Submit workflow should apt-get update to avoid
    package installation errors
    + JDK-8257148: Remove obsolete code in AWTView.m
    + JDK-8257497: Update keytool to create AKID from the SKID of
    the issuing certificate as specified by RFC 5280
    + JDK-8257620: Do not use objc_msgSend_stret to get macOS
    version
    + JDK-8257913: Add more known library locations to simplify
    Linux cross-compilation
    + JDK-8258703: Incorrect 512-bit vector registers restore on
    x86_32
    + JDK-8259338: Add expiry exception for identrustdstx3 alias to
    VerifyCACerts.java test
    + JDK-8259535: ECDSA SignatureValue do not always have the
    specified length
    + JDK-8259679: GitHub actions should use MSVC 14.28
    + JDK-8259924: GitHub actions fail on Linux x86_32 with "Could
    not configure libc6:i386"
    + JDK-8260460: GitHub actions still fail on Linux x86_32 with
    "Could not configure libc6:i386"
    + JDK-8260589: Crash in JfrTraceIdLoadBarrier::load(_jclass*)
    + JDK-8260923: Add more tests for SSLSocket input/output
    shutdown
    + JDK-8261072: AArch64: Fix MacroAssembler::get_thread
    convention
    + JDK-8261147: C2: Node is wrongly marked as reduction
    resulting in a wrong execution due to wrong vector instructions
    + JDK-8261238: NMT should not limit baselining by size threshold
    + JDK-8261496: Shenandoah: reconsider pacing updates memory
    ordering
    + JDK-8261652: Remove some dead comments from os_bsd_x86
    + JDK-8261846: [JVMCI] c2v_iterateFrames can get out of sync
    with the StackFrameStream
    + JDK-8262000: jdk/jfr/event/gc/detailed/
    /TestPromotionFailedEventWithParallelScavenge.java failed with
    "OutOfMemoryError: Java heap space"
    + JDK-8262017: C2: assert(n != __null) failed: Bad immediate
    dominator info.
    + JDK-8262392: Update Mesa 3-D Headers to version 21.0.3
    + JDK-8262409: sun/security/ssl/SSLSocketImpl/
    /SSLSocketImplThrowsWrongExceptions. SSL test failures caused
    by java failed with "Server reported the wrong exception"
    + JDK-8262470: Printed GlyphVector outline with low DPI has bad
    quality on Windows
    + JDK-8262862: Harden tests sun/security/x509/URICertStore/
    /ExtensionsWithLDAP.java and krb5/canonicalize/Test.java
    + JDK-8263136: C4530 was reported from VS 2019 at access bridge
    + JDK-8263227: C2: inconsistent spilling due to dead nodes in
    exception block
    + JDK-8263382: java/util/logging/ParentLoggersTest.java failed
    with "checkLoggers: getLoggerNames() returned unexpected
    loggers"
    + JDK-8263407: SPARC64 detection fails on Athena (SPARC64-X)
    + JDK-8263432: javac may report an invalid package/class clash
    on case insensitive filesystems
    + JDK-8263490: [macos] Crash occurs on JPasswordField with
    activated InputMethod
    + JDK-8263531: Remove unused buffer int
    + JDK-8263667: Avoid running GitHub actions on branches named
    pr/*
    + JDK-8263776: [JVMCI] add helper to perform Java upcalls
    + JDK-8264016: [JVMCI] add some thread local fields for use by
    JVMCI
    + JDK-8264752: SIGFPE crash with option
    FlightRecorderOptions:threadbuffersize=30M
    + JDK-8265132: C2 compilation fails with assert "missing
    precedence edge"
    + JDK-8265231: (fc) ReadDirect and WriteDirect tests fail after
    fix for JDK-8264821
    + JDK-8265335: Epsilon: Minor typo in EpsilonElasticTLABDecay
    description
    + JDK-8265756: AArch64: initialize memory allocated for locals
    according to Windows AArch64 stack page growth requirement in
    template interpreter
    + JDK-8265761: Font with missed font family name is not
    properly printed on Windows
    + JDK-8265773: incorrect jdeps message "jdk8internals" to
    describe a removed JDK internal API
    + JDK-8265836: OperatingSystemImpl.getCpuLoad() returns
    incorrect CPU load inside a container
    + JDK-8266018: Shenandoah: fix an incorrect assert
    + JDK-8266206: Build failure after JDK-8264752 with older GCCs
    + JDK-8266248: Compilation failure in
    PLATFORM_API_MacOSX_MidiUtils.c with Xcode 12.5
    + JDK-8266288: assert root method not found in
    witnessed_reabstraction_in_supers is too strong
    + JDK-8266404: Fatal error report generated with
  - XX:+CrashOnOutOfMemoryError should not contain suggestion to
    submit a bug report
    + JDK-8266480: Implicit null check optimization does not update
    control of hoisted memory operation
    + JDK-8266615: C2 incorrectly folds subtype checks involving an
    interface array
    + JDK-8266642: Improve ResolvedMethodTable hash function
    + JDK-8266749: AArch64: Backtracing broken on PAC enabled
    systems
    + JDK-8266761: AssertionError in
    sun.net.httpserver.ServerImpl.responseCompleted
    + JDK-8266813: Shenandoah: Use shorter instruction sequence for
    checking if marking in progress
    + JDK-8267042: bug in monitor locking/unlocking on ARM32 C1 due
    to uninitialized BasicObjectLock::_displaced_header
    + JDK-8267348: Rewrite gc/epsilon/TestClasses.java to use
    Metaspace with less classes
    + JDK-8267396: Avoid recording "pc" in unhandled oops detector
    for better performance
    + JDK-8267399: C2: java/text/Normalizer/ConformanceTest.java
    test failed with assertion
    + JDK-8267424: CTW: C1 fails with "State must not be null"
    + JDK-8267459: Pasting Unicode characters into JShell does not
    work.
    + JDK-8267625: AARCH64: typo in LIR_Assembler::emit_profile_type
    + JDK-8267666: Add option to jcmd GC.heap_dump to use existing
    file
    + JDK-8267695: Bump update version for OpenJDK: jdk-11.0.13
    + JDK-8267751: (test) jtreg.SkippedException has no serial
    VersionUID
    + JDK-8267773: PhaseStringOpts::int_stringSize doesn't handle
    min_jint correctly
    + JDK-8268103: JNI functions incorrectly return a double after
    JDK-8265836
    + JDK-8268127: Shenandoah: Heap size may be too small for
    region to align to large page size
    + JDK-8268261: C2: assert(n != __null) failed: Bad immediate
    dominator info.
    + JDK-8268347: C2: nested locks optimization may create
    unbalanced monitor enter/exit code
    + JDK-8268360: Missing check for infinite loop during node
    placement
    + JDK-8268362: [REDO] C2 crash when compile negative
    Arrays.copyOf length after loop
    + JDK-8268366: Incorrect calculation of has_fpu_registers in C1
    linear scan
    + JDK-8268369: SIGSEGV in PhaseCFG::implicit_null_check due to
    missing null check
    + JDK-8268417: Add test from JDK-8268360
    + JDK-8268427: Improve AlgorithmConstraints:checkAlgorithm
    performance
    + JDK-8268617: [11u REDO] - WebSocket over authenticating proxy
    fails with NPE
    + JDK-8268620: InfiniteLoopException test may fail on x86
    platforms
    + JDK-8268635: Corrupt oop in ClassLoaderData
    + JDK-8268699: Shenandoah: Add test for JDK-8268127
    + JDK-8268771: javadoc -notimestamp option does not work on
    index.html
    + JDK-8268775: Password is being converted to String in
    AccessibleJPasswordField
    + JDK-8268776: Test `ADatagramSocket.java` missing /othervm
    from @run tag
    + JDK-8268965: TCP Connection Reset when connecting simple
    socket to SSL server
    + JDK-8269304: Regression ~5% in 2005 in b27
    + JDK-8269415: [11u] Remove ea from
    DEFAULT_PROMOTED_VERSION_PRE in OpenJDK 11u
    + JDK-8269478: Shenandoah: gc/shenandoah/mxbeans tests should
    be more resilient
    + JDK-8269529: javax/swing/reliability/
    /HangDuringStaticInitialization.java fails in Windows debug
    build
    + JDK-8269594: assert(_handle_mark_nesting &gt; 1) failed: memory
    leak: allocating handle outside HandleMark
    + JDK-8269614: [s390] Interpreter checks wrong bit for slow
    path instance allocation
    + JDK-8269650: Optimize gc-locker in
    [Get|Release]StringCritical for latin string
    + JDK-8269661: JNI_GetStringCritical does not lock char array
    + JDK-8269668: [aarch64] java.library.path not including
    /usr/lib64
    + JDK-8269763: The JEditorPane is blank after JDK-8265167
    + JDK-8269795: C2: Out of bounds array load floats above its
    range check in loop peeling resulting in SEGV
    + JDK-8269847: JDK-8269594 backport breaks 11u builds
    + JDK-8269850: Most JDK releases report macOS version 12 as
    10.16 instead of 12.0
    + JDK-8269851: OperatingSystemMXBean getProcessCpuLoad reports
    incorrect process cpu usage in containers
    + JDK-8269882: stack-use-after-scope in NewObjectA
    + JDK-8269934: RunThese24H.java failed with
    EXCEPTION_ACCESS_VIOLATION in
    java_lang_Thread::get_thread_status
    + JDK-8270096: Shenandoah: Optimize gc/shenandoah/
    /TestRefprocSanity.java for interpreter mode
    + JDK-8270137: Kerberos Credential Retrieval from Cache not
    Working in Cross-Realm Setup
    + JDK-8270184: [TESTBUG] Add coverage for jvmci
    ResolvedJavaType.toJavaName() for lambdas
    + JDK-8270196: [11u] [JVMCI] JavaType.toJavaName() returns
    incorrect type name for lambdas
    + JDK-8270556: Exclude security/infra/java/security/cert/
    /CertPathValidator/certification/LetsEncryptCA
    + JDK-8270893: IndexOutOfBoundsException while reading large
    TIFF file
    + JDK-8272078: Wrong Checksums in Temurin BootJDK dependencies
    + JDK-8272124: Cgroup v1 initialization causes
    NullPointerException when cgroup path contains colon
    + JDK-8272131: PhaseMacroExpand::generate_slow_arraycopy crash
    when clone null CallProjections.fallthrough_ioproj
    + JDK-8272197: Update 11u GHA workflow with Shenandoah
    configurations
    + JDK-8272332: --with-harfbuzz=system doesn't add -lharfbuzz
    after JDK-8255790
    + JDK-8272472: StackGuardPages test doesn't build with glibc
    2.34
    + JDK-8272602: [macos] not all KEY_PRESSED events sent when
    control modifier is used
    + JDK-8272628: Problemlist gc/stress/gcbasher/
    /TestGCBasherWithCMS.java for x86_32
    + JDK-8272700: [macos] Build failure with Xcode 13.0 after
    JDK-8264848
    + JDK-8272772: Shenandoah: compiler/c2/aarch64/
    /TestVolatilesShenandoah.java fails in 11u
    + JDK-8273939: Backport of 8248414 to JDK11 breaks
    MacroAssembler::adrp
- Remove the unneeded icedtea-sound provider
- Removed patches:
  * icedtea-sound-1.0.1-jdk9.patch
  * icedtea-sound-soundproperties.patch
    + not needed since the icedtea-sound provider is removed
  * jdk11-glibc234.patch
    + integrated upstream</changelog>
  <changelog author="fstrba@suse.com" date="1635940800">- Modified patches:
  * system-crypto-policy.patch
    + rediff to changed context
  * fips.patch
    + Allow plain key import in fips mode unless
    com.suse.fips.plainKeySupport is set to false</changelog>
  <changelog author="fstrba@suse.com" date="1636113600">- Modified patch:
  * fips.patch
    + return in native code after generating java.io.IOException</changelog>
</package>
<package pkgid="9f856775e073b8a4b652fa1f17d672f85ca51ec5fa421960a11fb001ce43bb14" name="java-11-openjdk-src" arch="x86_64">
  <version epoch="0" ver="11.0.13.0" rel="3.68.1"/>
  <changelog author="fstrba@suse.com" date="1586952000">- The pack200 and unpack200 alternatives should be slaves of java
  and not of javac, since they are part of JRE.</changelog>
  <changelog author="fstrba@suse.com" date="1587470400">- Update to upstream tag jdk-11.0.7+10 (April 2020 CPU,
  bsc#1169511)
  * Security fixes:
    + S8223898, CVE-2020-2754: Forward references to Nashorn
    + S8223904, CVE-2020-2755: Improve Nashorn matching
    + S8224541, CVE-2020-2756: Better mapping of serial ENUMs
    + S8224549, CVE-2020-2757: Less Blocking Array Queues
    + S8225603: Enhancement for big integers
    + S8226346: Build better binary builders
    + S8227467: Better class method invocations
    + S8227542: Manifest improved jar headers
    + S8229733: TLS message handling improvements
    + S8231415, CVE-2020-2773: Better signatures in XML
    + S8231785: Improved socket permissions
    + S8232424, CVE-2020-2778: More constrained algorithms
    + S8232581, CVE-2020-2767: Improve TLS verification
    + S8233250: Better X11 rendering
    + S8233410: Better Build Scripting
    + S8234027: Better JCEKS key support
    + S8234408, CVE-2020-2781: Improve TLS session handling
    + S8234825, CVE-2020-2800: Better Headings for HTTP Servers
    + S8234841, CVE-2020-2803: Enhance buffering of byte buffers
    + S8235274, CVE-2020-2805: Enhance typing of methods
    + S8235691, CVE-2020-2816: Enhance TLS connectivity
    + S8236201, CVE-2020-2830: Better Scanner conversions
    + S8238960: linux-i586 builds are inconsistent as the newly
    built jdk is not able to reserve enough space for object heap
  * Other changes:
    + S4919790: Errors in alert ssl message does not reflect the
    actual certificate status
    + S4949105: Access Bridge lacks html tags parsing
    + S7092821: java.security.Provider.getService() is synchronized
    and became scalability bottleneck
    + S7143743: Potential memory leak with zip provider
    + S8005819: Support cross-realm MSSFU
    + S8042383: [TEST_BUG] Test javax/swing/plaf/basic/BasicMenuUI/
    /4983388/bug4983388.java fails with shortcuts on menus do not
    work
    + S8068184: Fix for JDK-8032832 caused a deadlock
    + S8145845: [AOT] NullPointerException in
    compiler/whitebox/GetCodeHeapEntriesTest.java
    + S8152988: [AOT] Update test batch definitions to include
    aot-ed java.base module mode into hs-comp testing
    + S8160926: FLAGS_COMPILER_CHECK_ARGUMENTS doesn't handle
    cross-compilation
    + S8163083: SocketListeningConnector does not allow invocations
    with port 0
    + S8163251: Hard coded loop limit prevents reading of smart
    card data greater than 8k
    + S8167276: jvmci/compilerToVM/MaterializeVirtualObjectTest.java
    fails with -XX:-EliminateAllocations
    + S8169718: nsk/jdb/locals/locals002: ERROR: Cannot find
    boolVar with expected value: false
    + S8176556:
    java/awt/dnd/ImageTransferTest/ImageTransferTest.java fails
    for JFIF
    + S8178798: Two compiler/aot/verification/vmflags tests fail by
    timeout with UseAVX=3
    + S8183107: PKCS11 regression regarding checkKeySize
    + S8185005: Improve performance of
    ThreadMXBean.getThreadInfo(long ids[], int maxDepth)
    + S8189633: Missing -Xcheck:jni checking for DeleteWeakGlobalRef
    + S8189861: Refactor CacheFind
    + S8193042: NativeLookup::lookup_critical_entry() should only
    load shared library once
    + S8193596: java/net/DatagramPacket/ReuseBuf.java failed due to
    timeout
    + S8194944: Regression automated test 'open/test/jdk/javax/
    /swing/JInternalFrame/8145896/TestJInternalFrameMaximize.java'
    fails
    + S8196467: javax/swing/JInternalFrame/Test6325652.java fails
    + S8196969: JTreg Failure: serviceability/sa/ClhsdbJstack.java
    causes NPE
    + S8198321: javax/swing/JEditorPane/5076514/bug5076514.java
    fails
    + S8198398: Test javax/swing/JColorChooser/Test6199676.java
    fails in mach5
    + S8199072: Test javax/swing/GroupLayout/6613904/
    /bug6613904.java is unstable
    + S8200432: javadoc fails with ClassCastException on {@link
    byte[]}
    + S8201349: build broken when configured with
  - -with-zlib=bundled on gcc 7.3
    + S8201355: Avoid native memory allocation in
    sun.security.mscapi.PRNG.generateSeed
    + S8201513: nsk/jvmti/IterateThroughHeap/filter-* are broken
    + S8203364: Some serviceability/sa/ tests intermittently fail
    with java.io.IOException: LingeredApp terminated with non-zero
    exit code 3
    + S8203687: javax/net/ssl/compatibility/Compatibility.java
    supports TLS 1.3
    + S8203904: javax/swing/JSplitPane/4816114/bug4816114.java: The
    divider location is wrong
    + S8203911: Test runtime/modules/getModuleJNI/GetModule fails
    with -Xcheck:jni
    + S8204525: [TESTBUG] runtime/NMT/MallocStressTest.java ran out
    of java heap
    + S8204529: gc/TestAllocateHeapAtMultiple.java fail with Agent
    7 timed out
    + S8204551: Event descriptions are truncated in logs
    + S8206963: [AOT] bug with multiple class loaders
    + S8207367: 10 vmTestbase/nsk/jdi tests timed out when running
    with jtreg
    + S8207832: serviceability/sa/ClhsdbCDSCore.java failed with
    "Couldn't find core file location"
    + S8207938: At step6,Click Add button,case failed automatically.
    + S8208157: requires.VMProps throws NPE for missing properties
    in "release" file
    + S8208379: compiler/jvmci/events/
    /JvmciNotifyInstallEventTest.java failed with "Got unexpected
    event count after 2nd install attempt: expected 9 to equal 2"
    + S8208658: Make CDS archived heap regions usable even if
    compressed oop encoding has changed
    + S8208715: Conversion of milliseconds to nanoseconds in
    UNIXProcess contains bug
    + S8209361: [AOT] Unexpected number of references for
    JVMTI_HEAP_REFERENCE_CONSTANT_POOL [111--&gt;111]: 0 (expected
    at least 1)
    + S8209385: CDS runtime classpath checking is too strict when
    only classes from the system modules are archived
    + S8209389: SIGSEGV in WalkOopAndArchiveClosure::do_oop_work.
    + S8209418: Synchronize test/jdk/sanity/client/lib/jemmy with
    code-tools/jemmy/v2
    + S8209494: Create a test for SwingSet InternalFrameDemo
    + S8209499: Create test for SwingSet EditorPaneDemo
    + S8209574: [AOT] breakpoint events are generated in different
    threads does not meet expected count
    + S8209686: cleanup arguments to PhaseIdealLoop() constructor
    + S8209789: Synchronize test/jdk/sanity/client/lib/jemmy with
    code-tools/jemmy/v2
    + S8209802: Garbage collectors should register JFR types
    themselves to avoid build errors.
    + S8209807: improve handling exception in requires.VMProps
    + S8209817: stack is executable when building with Clang on
    Linux
    + S8209824: Improve the code coverage for ThreadLocal
    + S8209826: Undefined reference to os::write after JDK-8209657
    (filemap.hpp cleanup)
    + S8209850: Allow NamedThreads to use GlobalCounter critical
    sections
    + S8209976: Improve iteration over non-JavaThreads
    + S8209993: Create a test for SwingSet3 ToolTipDemo
    + S8210024: JFR calls virtual is_Java_thread from ~Thread()
    + S8210052: Enable testing for all the available look and feels
    in SwingSet3 demo tests
    + S8210055: Enable different look and feel tests in SwingSet3
    demo tests
    + S8210057: Enable different look and feels in SwingSet3 demo
    test InternalFrameDemoTest
    + S8210058: Algorithmic Italic font leans opposite angle in
    Printing
    + S8210220: [AOT] jdwp test cases are failing with error #
    ERROR: TEST FAILED: Cought IOException while receiving event
    packet
    + S8210289: ArchivedKlassSubGraphInfoRecord is incomplete
    + S8210459: Add support for generating compile_commands.json
    + S8210476: sun/security/mscapi/PrngSlow.java fails with Still
    too slow
    + S8210512: [Testbug] vmTestbase/nsk/jdi/ObjectReference/
    /referringObjects/referringObjects002/referringObjects002.java
    fails with unexpected size of
    ClassLoaderReference.referringObjects
    + S8210523: runtime/appcds/cacheObject/DifferentHeapSizes.java
    crash
    + S8210632: Add key exchange algorithm to
    javax/net/ssl/TLSCommon/CipherSuite.java
    + S8210699: Problem list tests which times out in Xcomp mode
    + S8210793: [JVMCI] AllocateCompileIdTest.java failed to find
    DiagnosticCommand.class
    + S8210910: Create test for FileChooserDemo
    + S8210994: Create test for SwingSet3 FrameDemo
    + S8211139: Increase timeout value in all tests under
    jdk/sanity/client/SwingSet/src
    + S8211160: Handle different look and feels in
    JInternalFrameOperator
    + S8211211: vmTestbase/metaspace/stressDictionary/
    /StressDictionary.java timeout
    + S8211322: Reduce the timeout of tooltip in SwingSet2DemoTest
    + S8211443: Enable different look and feels in SwingSet3 demo
    test SplitPaneDemoTest
    + S8211703: JInternalFrame : java.lang.AssertionError: cannot
    find the internal frame
    + S8211781: re-building fails after changing Graal sources
    + S8212897: Some improvements in the EditorPaneDemotest
    + S8212903: [TestBug] Tests test/jdk/javax/swing/LookAndFeel/
    /8145547/DemandGTK2.sh and DemandGTK3.sh fail on Ubuntu 18.04
    LTS
    + S8213009: Refactoring existing SunMSCAPI classes
    + S8213010: Supporting keys created with certmgr.exe
    + S8213168: Enable different look and feel tests in SwingSet3
    demo test FileChooserDemoTest
    + S8213348: jdk.internal.vm.compiler.management service
    providers missing in module descriptor
    + S8213906: Update arm devkits with libXrandr headers
    + S8213908: AssertionError in DeferredAttr at setOverloadKind
    + S8214124: [TESTBUG] Bugs in runtime/NMT/MallocStressTest.java
    + S8214344: C2: assert(con.basic_type() != T_ILLEGAL) failed:
    elembt=byte; loadbt=void; unsigned=0
    + S8214345: infinite recursion while checking super class
    + S8214471: Enable different look and feel tests in SwingSet3
    demo test ToolTipDemoTest
    + S8214534: Setting of THIS_FILE in the build is broken
    + S8214557: Filter out VM flags which don't affect AOT code
    generation
    + S8214578: [macos] Problem with backslashes on macOS/JIS
    keyboard: Java ignores system settings
    + S8214840: runtime/NMT/MallocStressTest.java timed out
    + S8214850: Rename vm_operations.?pp files to vmOperations.?pp
    files
    + S8214904: Test8004741.java failed due to "Too few ThreadDeath
    hits; expected at least 6 but saw only 5"
    + S8215322: add @file support to jaotc
    + S8215355: Object monitor deadlock with no threads holding the
    monitor (using jemalloc 5.1)
    + S8215396: JTabbedPane preferred size calculation is wrong for
    SCROLL_TAB_LAYOUT
    + S8216180: [AOT] compiler/intrinsics/bigInteger/TestMulAdd.java
    crashed with AOT enabled
    + S8216353: Use utility APIs introduced in org/netbeans/jemmy/
    /util/LookAndFeel class in client sanity test cases
    + S8216354: Syntax error in toolchain_windows.m4
    + S8216472: (se) Stack overflow during selection operation
    leads to crash (win)
    + S8216535: tools/jimage/JImageExtractTest.java timed out
    + S8217235: Create automated test for SwingSet
    ColorChooserDemoTest
    + S8217297: Add support for multiple look and feel for SwingSet
    SliderDemoTest
    + S8217338: [Containers] Improve systemd slice memory limit
    support
    + S8217613: [AOT] TEST_OPTS_AOT_MODULES doesn't work on mac
    + S8217634: RunTest documentation and usability update
    + S8217717: ZGC: Broken oop map in C1 load barrier stub
    + S8217728: Speed up incremental rerun of "make hotspot"
    + S8218268: Javac treats Manifest Class-Path entries as Paths
    instead of URLs
    + S8218662: Allow 204 responses with Content-Length:0
    + S8218882: NET_Writev is declared, NET_WriteV is defined
    + S8218889: Improperly use of the Optional API
    + S8219205: JFR file without license header
    + S8219597: (bf) Heap buffer state changes could provoke
    unexpected exceptions
    + S8219723: javax/net/ssl/compatibility/Compatibility.java
    failed on some SNI cases
    + S8220348: [ntintel] asserts about copying unaligned array
    + S8220451: jdi/EventQueue/remove/remove004 failed due to
    "ERROR: thread2 is not alive"
    + S8220456: jdi/EventQueue/remove_l/remove_l004 failed due to
    "TIMEOUT while waiting for event"
    + S8220479: java/nio/channels/Selector/SelectWithConsumer.java
    failed at testTwoChannels()
    + S8220613: java/util/Arrays/TimSortStackSize2.java times out
    with fastdebug build
    + S8220688: [TESTBUG] runtime/NMT/MallocStressTest.java timed
    out
    + S8220786: Create new switch to redirect error reporting
    output to stdout or stderr
    + S8221270: Duplicated synchronized keywords in SSLSocketImpl
    + S8221312: test/jdk/sanity/client/SwingSet/src/
    /ColorChooserDemoTest.java failed
    + S8221851: Use of THIS_FILE in hotspot invalidates precompiled
    header on Linux/GCC
    + S8221885: Add intermittent test in the JavaSound to the
    ProblemList
    + S8222264: Windows incremental build is broken with JDK-8217728
    + S8222391: javax/net/ssl/compatibility/Compatibility.java
    should be more flexible
    + S8222448: java/lang/reflect/PublicMethods/
    /PublicMethodsTest.java times out
    + S8222519: ButtonDemoScreenshotTest fails randomly with "still
    state to be reached"
    + S8222741: jdi/EventQueue/remove/remove004 fails due to
    VMDisconnectedException
    + S8223003: SunMSCAPI keys are not cleaned up
    + S8223063: Support CNG RSA keys
    + S8223158: Docked MacBook cannot start any Java Swing
    applications
    + S8223260: NamingManager should cache InitialContextFactory
    + S8223464: Improve version string for Oracle CI builds
    + S8223558: Java does not render Myanmar script correctly
    + S8223627: jdk-13+20 bundle name contains null instead of ea
    + S8223638: Replace wildcard address with loopback or local
    host in tests - part 6
    + S8223678: Add Visual Studio Code workspace generation support
    (for native code)
    + S8223727: com/sun/jndi/ldap/privconn/RunTest.java failed due
    to hang in LdapRequest.getReplyBer
    + S8223769: Assert triggers with -XX:+StressReflectiveCode
    + S8224187: Refactor arraycopy_prologue to allow ZGC read
    barriers on arraycopy
    + S8224475: JTextPane does not show images in HTML rendering
    + S8224673: Adjust permission for delayed starting of debugging
    + S8224705: Tests that need to be problem-listed or have
    printer resources
    + S8224778: test/jdk/demo/jfc/J2Ddemo/J2DdemoTest.java cannot
    find J2Ddemo.jar
    + S8224821: java/awt/Focus/NoAutotransferToDisabledCompTest/
    /NoAutotransferToDisabledCompTest.java fails linux-x64
    + S8224830: test/jdk/java/awt/Focus/
    /ModalExcludedWindowClickTest/
    /ModalExcludedWindowClickTest.java fails on linux-x64
    + S8224851: AArch64: fix warnings and errors with Clang and GCC
    8.3
    + S8224905: java/lang/ProcessBuilder/Basic.java#id1 failed with
    stream closed
    + S8225007: java/awt/print/PrinterJob/
    /LandscapeStackOverflow.java may hang
    + S8225105: java/awt/Focus/ShowFrameCheckForegroundTest/
    /ShowFrameCheckForegroundTest.java fails in Windows 10
    + S8225117: java/math/BigInteger/SymmetricRangeTests.java fails
    with ParseException
    + S8225128: Add exception for expiring DocuSign root to
    VerifyCACerts test
    + S8225130: Add exception for expiring Comodo roots to
    VerifyCACerts test
    + S8225144: [macos] In Aqua L&amp;F backspace key does not delete
    when Shift is pressed
    + S8225180: SignedObject with invalid Key not throwing the
    InvalidKeyException in Windows
    + S8225182: JNI exception pending in DestroyXIMCallback of
    awt_InputMethod.c:1327
    + S8225199: [Graal] compiler/jvmci/compilerToVM/
    /IsMatureVsReprofileTest.java fails with
  - XX:CompileThresholdScaling=0.1
    + S8225305: ProblemList java/lang/invoke/VarHandles tests
    + S8225350: compiler/jvmci/compilerToVM/IsCompilableTest.java
    timed out
    + S8225430: Replace wildcard address with loopback or local
    host in tests - part 14
    + S8225435: Upgrade IANA Language Subtag Registry to the latest
    for JDK14
    + S8225487: giflib legal file is missing attribution for
    openbsd-reallocarray.c
    + S8225567: Wrong file headers with 8202414 fix changeset
    + S8225684: [AOT] vmTestbase/vm/oom/production/
    /AlwaysOOMProduction tests fail with AOTed java.base
    + S8225766: Curve in certificate should not affect signature
    scheme when using TLSv1.3
    + S8225797: OldObjectSample event creates unexpected amount of
    checkpoint data
    + S8226381: ProblemList java/lang/reflect/PublicMethods/
    /PublicMethodsTest.java
    + S8226406: JVM fails to detect mismatched or corrupt CDS
    archive
    + S8226608: Hide the onjcmd option from the help output
    + S8226892: ActionListeners on JRadioButtons don't get notified
    when selection is changed with arrow keys
    + S8227112: exclude compiler/intrinsics/sha/sanity tests from
    AOT runs
    + S8227324: Upgrade to freetype 2.10.1
    + S8227528: TestAbortVMOnSafepointTimeout.java failed due to
    "RuntimeException: 'Safepoint sync time longer than' missing
    from stdout/stderr"
    + S8227645: Some tests in serviceability/sa run with fixed -Xmx
    values and risk running out of memory
    + S8227646: [TESTBUG] appcds/SharedArchiveConsistency timed out
    + S8227662: freetype seeks to index at the end of the font data
    + S8228479: Correct the format of ColorChooserDemoTest
    + S8228613: java.security.Provider#getServices order is no
    longer deterministic
    + S8228969: 2019-09-28 public suffix list update
    + S8229236: CriticalJNINatives: dll handling should be done in
    native thread state
    + S8229345: Memory leak due to vtable stubs not being shared on
    SPARC
    + S8229888: (zipfs) Updating an existing zip file does not
    preserve original permissions
    + S8229994: assert(false) failed: Bad graph detected in
    get_early_ctrl_for_expensive
    + S8230004: jdk/internal/jimage/JImageOpenTest.java runs no test
    + S8230235: Rendering HTML with empty img attribute and
    documentBaseKey cause Exception
    + S8230390: Problemlist SA tests with AOT
    + S8230400: Missing constant pool entry for a method in
    stacktrace
    + S8230459: Test failed to resume JVMCI CompilerThread
    + S8230480: check malloc/calloc results in java.desktop
    + S8230597: Update GIFlib library to the 5.2.1
    + S8230611: infinite loop in
    LogOutputList::wait_until_no_readers()
    + S8230624: [TESTBUG] Problemlist JFR
    compiler/TestCodeSweeper.java
    + S8230677: Should disable Escape Analysis if JVMTI capability
    can_get_owned_monitor_info was taken
    + S8230926: [macosx] Two apostrophes are entered instead of one
    with "U.S. International - PC" layout
    + S8231025: Incorrect method tag offset for big endian platform
    + S8231081: TestMetadataRetention fails due to missing symbol id
    + S8231387: java.security.Provider.getService returns random
    result due to race condition with mutating methods in the same
    class
    + S8231430: C2: Memory stomp in max_array_length() for
    T_ILLEGAL type
    + S8231445: check ZALLOC return values in awt coding
    + S8231507: Update Apache Santuario (XML Signature) to version
    2.1.4
    + S8231584: Deadlock with ClassLoader.findLibrary and
    System.loadLibrary call
    + S8231753: use more Posix functionality in aix
    os::print_os_info
    + S8231810: javax/net/ssl/templates/
    /SSLSocketSSLEngineTemplate.java fails intermittently with
    "java.lang.Exception: Unexpected EOF"
    + S8232003: (fs) Files.write can leak file descriptor in the
    exception case
    + S8232056: GetOwnedMonitorInfoWithEATest.java fails with ZGC:
    Heap too small
    + S8232060: add some initializations using sigemptyset in
    os_aix.cpp
    + S8232154: Update Mesa 3-D Headers to version 19.2.1
    + S8232167: Visual Studio install found through
  - -with-tools-dir value is discarded
    + S8232170: FSInfo#getJarClassPath throws an exception not
    declared in its throws clause
    + S8232200: [macos 10.15] Windows in fullscreen tests jumps
    around the screen
    + S8232207: Linux os::available_memory re-reads cgroup
    configuration on every invocation
    + S8232224: [TESTBUG] problemlist JFR TestLargeRootSet.java
    + S8232370: Refactor some com.sun.jdi tests to enable IDE
    integration
    + S8232433: [macos 10.15] java/awt/Window/
    /LocationAtScreenCorner/LocationAtScreenCorner.java may fail
    + S8232571: Add missing SIGINFO signal
    + S8232692: [TESTBUG] compiler/aot/fingerprint/
    /SelfChangedCDS.java fails when cds is disabled
    + S8232713: Update BCEL version to 6.3.1 in license file
    + S8232806: Introduce a system property to disable eager lambda
    initialization
    + S8232834: RunTest sometimes fails to produce valid
    exitcode.txt
    + S8232880: Update test documentation with additional settings
    for client UI tooltip tests
    + S8232950: SUNPKCS11 Provider incorrectly check key length for
    PSS Signatures.
    + S8233018: Add a new test to verify that DatagramSocket is not
    interruptible
    + S8233019: java.lang.Class.isPrimitive() (C1) returns wrong
    result if Klass* is aligned to 32bit
    + S8233032: assert(in_bb(n)) failed: must be
    + S8233078: fix minimal VM build on Linux ppc64(le)
    + S8233328: fix minimal VM build on Linux s390x
    + S8233383: Various minor fixes
    + S8233466: aarch64: remove unnecessary load of mdo when
    profiling return and parameters type
    + S8233491: Crash in AdapterHandlerLibrary::get_adapter with
    CDS due to code cache exhaustion
    + S8233529: loopTransform.cpp:2984: Error: assert(p_f-&gt;Opcode()
    == Op_IfFalse) failed
    + S8233548: Update CUP to v0.11b
    + S8233649: Update ProblemList.txt to exclude failing headful
    tests on macos
    + S8233656: assert(d-&gt;is_CFG() &amp;&amp; n-&gt;is_CFG()) failed: must
    have CFG nodes
    + S8233657: Intermittent NPE in Component.validate()
    + S8234288: Turkey Time Zone returns incorrect time zone name
    + S8234323: NULL-check return value of SurfaceData_InitOps on
    macosx
    + S8234339: replace JLI_StrTok in java_md_solinux.c
    + S8234340: Bump update version for OpenJDK: jdk-11.0.7
    + S8234350: assert(mode == ControlAroundStripMined &amp;&amp; (use ==
    sfpt || !use-&gt;is_reachable_from_root())) failed: missed a node
    + S8234386: [macos] NPE was thrown at expanding Choice from
    maximized frame
    + S8234397: add OS uptime information to os::print_os_info
    output
    + S8234423: Modifying ArrayList.subList().subList() resets
    modCount of subList
    + S8234466: Class loading deadlock involving
    X509Factory#commitEvent()
    + S8234501: remove obsolete NET_ReadV
    + S8234525: enable link-time section-gc for linux s390x to
    remove unused code
    + S8234610: MaxVectorSize set wrongly when UseAVX=3 is
    specified after JDK-8221092
    + S8234617: C1: Incorrect result of field load due to missing
    narrowing conversion
    + S8234723: javax/net/ssl/TLS tests support TLSv1.3
    + S8234724: javax/net/ssl/templates/
    /SSLSocketSSLEngineTemplate.java supports TLSv1.3
    + S8234741: enhance os::get_core_path on macOS
    + S8234769: Duplicate attribution in freetype.md
    + S8234786: Fix for JDK-8214578 breaks OS X 10.12 compatibility
    + S8234809: set relro in linker flags when building with gcc
    + S8234824: java/nio/channels/SocketChannel/AdaptSocket.java
    fails on Windows 10
    + S8235243: handle VS2017 15.9 and VS2019 in abstract_vm_version
    + S8235288: AVX 512 instructions inadvertently used on Xeon for
    small vector width operations
    + S8235325: build failure on Linux after 8235243
    + S8235383: C1 compilation fails with
  - XX:+PrintIRDuringConstruction -XX:+Verbose
    + S8235489: handle return values of sscanf calls in hotspot
    + S8235509: Backport for JDK-8209657 Refactor filemap.hpp to
    simplify integration with Serviceability Agent.
    + S8235510: java.util.zip.CRC32 performance drop after 8200067
    + S8235563: [TESTBUG] appcds/CommandLineFlagComboNegative.java
    does not handle archive mapping failure
    + S8235637: jhsdb jmap from OpenJDK 11.0.5 doesn't work if
    prelink is enabled
    + S8235671: enhance print_rlimit_info in os_posix
    + S8235744: PIT: test/jdk/javax/swing/text/html/
    /TestJLabelWithHTMLText.java times out in linux-x64
    + S8235904: Infinite loop when rendering huge lines
    + S8235998: [c2] Memory leaks during tracing after '8224193:
    stringStream should not use Resource Area'.
    + S8236039: JSSE Client does not accept status_request
    extension in CertificateRequest messages for TLS 1.3
    + S8236140: assert(!VerifyHashTableKeys || _hash_lock == 0)
    failed: remove node from hash table before modifying it
    + S8236179: C1 register allocation error with T_ADDRESS
    + S8236488: Support for configure option
  - -with-native-debug-symbols=internal is impossible on Windows
    + S8236500: Windows ucrt.dll should be looked up in versioned
    WINSDK subdirectory
    + S8236709: struct SwitchRange in HS violates C++ One
    Definition Rule
    + S8236848: [JDK 11u] make run-test-tier1 fails after backport
    of JDK-8232834
    + S8236873: Worker has a deadlock bug
    + S8237217: Incorrect G1StringDedupEntry type used in
    StringDedupTable destructor
    + S8237368: Problem with NullPointerException in RMI
    TCPEndpoint.read
    + S8237375: SimpleThresholdPolicy misses CounterDecay timestamp
    initialization
    + S8237508: Simplify JarFile.isInitializing
    + S8237540: Missing files in backport of JDK-8210910
    + S8237541: Missing files in backport of JDK-8236528
    + S8237600: Test SunJSSEFIPSInit fails on Ubuntu
    + S8237819: s390x - remove unused pd_zero_to_words_large
    + S8237869: exclude jtreg test security/infra/java/security/
    /cert/CertPathValidator/certification/LuxTrustCA.java because
    of instabilities
    + S8237879: make 4.3 breaks build
    + S8237945: CTW: C2 compilation fails with
    assert(just_allocated_object(alloc_ctl) == ptr) failed: most
    recent allo...
    + S8238225: Issues reported after replacing symlink at
    Contents/MacOS/libjli.dylib with binary
    + S8238247: CTW runner should sweep nmethods more aggressively
    + S8238366: CTW runner closes standard output on exit
    + S8238438: SuperWord::co_locate_pack picks memory state of
    first instead of last load
    + S8238502: sunmscapi.dll causing EXCEPTION_ACCESS_VIOLATION
    + S8238534: Deep sign macOS bundles before bundle archive is
    being created
    + S8238591: CTW: Split
    applications/ctw/modules/jdk_localedata.java
    + S8238596: AVX enabled by default for Skylake even when
    unsupported
    + S8238811: C2: assert(i &gt;= req() || i == 0 || is_Region() ||
    is_Phi()) with -XX:+VerifyGraphEdges
    + S8239005: [TESTBUG] test/hotspot/jtreg/runtime/
    /StackGuardPages/TestStackGuardPages.java: exeinvoke.c: must
    initialize static state before calling do_overflow()
    + S8239466: Loss of precision in counter decay calculation in
    11u backport of JDK-8237375
    + S8239856: [ntintel] asserts about copying unaligned array
    element
    + S8240724: [test] jdk11 downport of 8224475 misses binary file
    test/jdk/javax/swing/JTextPane/arrow.png
    + S8241296: Segfault in JNIHandleBlock::oops_do()
- Removed patch:
  * DependOnVariableHelper.patch
    + fixed upstream
- Added patch:
  * JDK-8228407.patch
    + fix crashes due to shared archive file mismatch</changelog>
  <changelog author="fstrba@suse.com" date="1594900800">- Update to upstream tag jdk-11.0.8+10 (July 2020 CPU, bsc#1174157)
  * Security fixes:
    + JDK-8230613: Better ASCII conversions
    + JDK-8231800: Better listing of arrays
    + JDK-8232014: Expand DTD support
    + JDK-8233234: Better Zip Naming
    + JDK-8233239, CVE-2020-14562: Enhance TIFF support
    + JDK-8233255: Better Swing Buttons
    + JDK-8234032: Improve basic calendar services
    + JDK-8234042: Better factory production of certificates
    + JDK-8234418: Better parsing with CertificateFactory
    + JDK-8234836: Improve serialization handling
    + JDK-8236191: Enhance OID processing
    + JDK-8236867, CVE-2020-14573: Enhance Graal interface handling
    + JDK-8237117, CVE-2020-14556: Better ForkJoinPool behavior
    + JDK-8237592, CVE-2020-14577: Enhance certificate verification
    + JDK-8238002, CVE-2020-14581: Better matrix operations
    + JDK-8238013: Enhance String writing
    + JDK-8238804: Enhance key handling process
    + JDK-8238842: AIOOBE in GIFImageReader.initializeStringTable
    + JDK-8238843: Enhanced font handing
    + JDK-8238920, CVE-2020-14583: Better Buffer support
    + JDK-8238925: Enhance WAV file playback
    + JDK-8240119, CVE-2020-14593: Less Affine Transformations
    + JDK-8240482: Improved WAV file playback
    + JDK-8241379: Update JCEKS support
    + JDK-8241522: Manifest improved jar headers redux
    + JDK-8242136, CVE-2020-14621: Better XML namespace handling
  * Other changes:
    + JDK-6933331: (d3d/ogl) java.lang.IllegalStateException:
    Buffers have not been created
    + JDK-7124307: JSpinner and changing value by mouse
    + JDK-8022574: remove HaltNode code after uncommon trap calls
    + JDK-8039082: [TEST_BUG] Test
    java/awt/dnd/BadSerializationTest/BadSerializationTest.java
    fails
    + JDK-8040630: Popup menus and tooltips flicker with previous
    popup contents when first shown
    + JDK-8044365: (dc) MulticastSendReceiveTests.java failing with
    ENOMEM when joining group (OS X 10.9)
    + JDK-8048215: [TESTBUG]
    java/lang/management/ManagementFactory/ThreadMXBeanProxy.java
    Expected non-null LockInfo
    + JDK-8051349: nsk/jvmti/scenarios/sampling/SP06/sp06t003 fails
    in nightly
    + JDK-8080353: JShell: Better error message on attempting to
    add default method
    + JDK-8139876: Exclude hanging nsk/stress/stack from execution
    with deoptimization enabled
    + JDK-8146090: java/lang/ref/ReachabilityFenceTest.java fails
    with -XX:+DeoptimizeALot
    + JDK-8153430: jdk regression test MletParserLocaleTest,
    ParserInfiniteLoopTest reduce default timeout
    + JDK-8156207: Resource allocated BitMaps are often cleared
    unnecessarily
    + JDK-8159740: JShell: corralled declarations do not have
    correct source to wrapper mapping
    + JDK-8175984: ICC_Profile has un-needed, not-empty finalize
    method
    + JDK-8176359: Frame#setMaximizedbounds not working properly in
    multi screen environments
    + JDK-8183369: RFC unconformity of HttpURLConnection with proxy
    + JDK-8187078: -XX:+VerifyOops finds numerous problems when
    running JPRT
    + JDK-8189861: Refactor CacheFind
    + JDK-8191169: java/net/Authenticator/B4769350.java failed
    intermittently
    + JDK-8191930: [Graal] emits unparseable XML into compile log
    + JDK-8193879: Java debugger hangs on method invocation
    + JDK-8196019: java/awt/Window/Grab/GrabTest.java fails on
    Windows
    + JDK-8196181: sun/java2d/GdiRendering/InsetClipping.java fails
    + JDK-8198000:
    java/awt/List/EmptyListEventTest/EmptyListEventTest.java
    debug assert on Windows
    + JDK-8198001: java/awt/Menu/WrongParentAfterRemoveMenu/
    /WrongParentAfterRemoveMenu.java debug assert on Windows
    + JDK-8198339: Test javax/swing/border/Test6981576.java is
    unstable
    + JDK-8200701: jdk/jshell/ExceptionsTest.java fails on Windows,
    after JDK-8198801
    + JDK-8203264: JNI exception pending in
    PlainDatagramSocketImpl.c:740
    + JDK-8203672: JNI exception pending in PlainSocketImpl.c
    + JDK-8203673: JNI exception pending in
    DualStackPlainDatagramSocketImpl.c:398
    + JDK-8204834: Fix confusing "allocate" naming in OopStorage
    + JDK-8205399: Set node color on pinned HashMap.TreeNode
    deletion
    + JDK-8205653: test/jdk/sun/management/jmxremote/bootstrap/
    /RmiRegistrySslTest.java and RmiSslBootstrapTest.sh fail with
    handshake_failure
    + JDK-8206179: com/sun/management/OperatingSystemMXBean/
    /GetCommittedVirtualMemorySize.java fails with Committed
    virtual memory size illegal value
    + JDK-8207334: VM times out in VM_HandshakeAllThreads::doit()
    with RunThese30M
    + JDK-8208277: Code cache heap (-XX:ReservedCodeCacheSize)
    doesn't work with 1GB LargePages
    + JDK-8209113: Use WeakReference for lastFontStrike for created
    Fonts
    + JDK-8209333: Socket reset issue for TLS 1.3 socket close
    + JDK-8209439: C2 library_call can potentially ignore Math.pow
    intrinsic or use null pointer
    + JDK-8209534: [TESTBUG]runtime/appcds/cacheObject/
    /ArchivedModuleCompareTest.java fails with EnableJVMCI.
    + JDK-8210147: adjust some WSAGetLastError usages in windows
    network coding
    + JDK-8210284: "assert((av &amp; 0x00000001) == 0) failed:
    unsupported V8" on Solaris 11.4
    + JDK-8210303: VM_HandshakeAllThreads fails assert with
    "failed: blocked and not walkable"
    + JDK-8210459: Add support for generating compile_commands.json
    + JDK-8210515: [TESTBUG]CheckArchivedModuleApp.java needs to
    check if EnableJVMCI is set.
    + JDK-8210788: Javadoc for Thread.join(long, int) should
    specify that it waits forever when both arguments are zero
    + JDK-8211301: [macos] support full window content options
    + JDK-8211332: Space for stub routines (code_size2) is too
    small on new Skylake CPUs
    + JDK-8211339: NPE during SSL handshake caused by
    HostnameChecker
    + JDK-8211392: compiler/profiling/
    /spectrapredefineclass_classloaders/Launcher.java times out
    in JDK12 CI
    + JDK-8211743: [AOT] crash in ScopeDesc::decode_body() when
    JVMTI walks AOT frames
    + JDK-8212154: [TESTBUG] CheckArchivedModuleApp fails with NPE
    when JVMCI is absent
    + JDK-8212167: JShell : Stack trace of exception has wrong line
    number
    + JDK-8212933: Thread-SMR: requesting a VM operation whilst
    holding a ThreadsListHandle can cause deadlocks
    + JDK-8212986: Make Visual Studio compiler check less strict
    + JDK-8213250: CDS archive creation aborts due to metaspace
    object allocation failure
    + JDK-8213516: jck test api/javax_accessibility/AccessibleState/
    /fields.html fails intermittent
    + JDK-8213947: ARM32: failed check_simd should set
    UsePopCountInstruction to false
    + JDK-8214418: half-closed SSLEngine status may cause
    application dead loop
    + JDK-8214440: ldap over a TLS connection negotiate failed with
    "javax.net.ssl.SSLPeerUnverifiedException: hostname of the
    server does not match the hostname in the server's
    certificate"
    + JDK-8214444: Wrong strncat limits in dfa.cpp
    + JDK-8214481: freetype path does not disable TrueType hinting
    with AA+FM hints
    + JDK-8214571: -Xdoclint of array serialField gives "error:
    array type not allowed here"
    + JDK-8214856: Errors with JSZip in web console after upgrade
    to 3.1.5
    + JDK-8214862: assert(proj != __null) at compile.cpp:3251
    + JDK-8215369: Jcstress pollute /var/tmp with temporary files.
    + JDK-8215551: Missing case label in nmethod::reloc_string_for()
    + JDK-8215555: TieredCompilation C2 threads can excessively
    block handshakes
    + JDK-8215711: Missing key_share extension for (EC)DHE key
    exchange should alert missing_extension
    + JDK-8216151: [Graal] Module
    jdk.internal.vm.compiler.management has not been granted
    accessClassInPackage.org.graalvm.compiler.debug
    + JDK-8216154: C4819 warnings at HotSpot sources on Windows
    + JDK-8216541: CompiledICHolders of VM locked unloaded nmethods
    are released too late
    + JDK-8217230: assert(t == t_no_spec) failure in
    NodeHash::check_no_speculative_types()
    + JDK-8217404: --with-jvm-features doesn't work when multiple
    features are explicitly disabled
    + JDK-8217447: Develop flag TraceICs is broken
    + JDK-8217606: LdapContext#reconnect always opens a new
    connection
    + JDK-8218807: Compilation database (compile_commands.json) may
    contain obsolete items
    + JDK-8219214: Infinite Loop in CodeSection::dump()
    + JDK-8219904: ClassCastException when calling
    FlightRecorderMXBean#getRecordings()
    + JDK-8219991: New fix of the deadlock in
    sun.security.ssl.SSLSocketImpl
    + JDK-8221121: applications/microbenchmarks are encountering
    crashes in tier5
    + JDK-8221445: FastSysexMessage constructor crashes MIDI
    receiption thread
    + JDK-8221482: Initialize VMRegImpl::regName[] earlier to
    prevent assert during PrintStubCode
    + JDK-8221741: ClassCastException can happen when
    fontconfig.properties is used
    + JDK-8221823: Requested JDialog width is ignored
    + JDK-8223108: Test java/awt/EventQueue/
    /NonComponentSourcePost.java is unstable
    + JDK-8223678: Add Visual Studio Code workspace generation
    support (for native code)
    + JDK-8223935: PIT: java/awt/font/WindowsIndicFonts.java fails
    on windows10
    + JDK-8224109: Text spaced incorrectly by drawString under
    rotation with fractional metric
    + JDK-8224632: testbug: java/awt/dnd/RemoveDropTargetCrashTest/
    /RemoveDropTargetCrashTest.java fails on MacOS
    + JDK-8224793: os::die() does not honor CreateCoredumpOnCrash
    option
    + JDK-8224847: gc/stress/TestReclaimStringsLeaksMemory.java
    fails with reserved greater than expected
    + JDK-8224931: disable JAOTC invokedynamic support until
    8223533 is fixed
    + JDK-8224997: ChaCha20-Poly1305 TLS cipher suite decryption
    throws ShortBufferException
    + JDK-8225068: Remove DocuSign root certificate that is
    expiring in May 2020
    + JDK-8225069: Remove Comodo root certificate that is expiring
    in May 2020
    + JDK-8225126: Test SetBoundsPaintTest.html faild on Windows
    when desktop is scaled
    + JDK-8225325: Add tests for redefining a class' private method
    during resolution of the bootstrap specifier
    + JDK-8225622: [AOT] runtime/SharedArchiveFile/
    /TestInterpreterMethodEntries.java crashed with AOTed
    java.base
    + JDK-8225653: Provide more information when hitting SIGILL
    from HaltNode
    + JDK-8225783: Incorrect use of binary operators on booleans in
    type.cpp
    + JDK-8225789: Empty method parameter type should generate
    ClassFormatError
    + JDK-8226198: use of &amp; instead of &amp;&amp; in
    LibraryCallKit::arraycopy_restore_alloc_state
    + JDK-8226253: JAWS reports wrong number of radio buttons when
    buttons are hidden.
    + JDK-8226653: [accessibility] Can edit text cell correctly,
    but Accessibility Tool reads nothing about editor
    + JDK-8226806: [macOS 10.14] Methods of Java Robot should be
    called from appropriate thread
    + JDK-8226879: Memory leak in Type::hashcons
    + JDK-8227632: Incorrect PrintCompilation message: made not
    compilable on levels 0 1 2 3 4
    + JDK-8228407: JVM crashes with shared archive file mismatch
    + JDK-8228482: fix xlc16/xlclang comparison of distinct pointer
    types and string literal conversion warnings
    + JDK-8228757: Fail fast if the handshake type is unknown
    + JDK-8229158: make UseSwitchProfiling non-experimental or
    false by-default
    + JDK-8229421: The logic of java/net/ipv6tests/TcpTest.java is
    flawed
    + JDK-8229855: C2 fails with assert(false) failed: bad AD file
    + JDK-8230591: AArch64: Missing intrinsics for Math.ceil,
    floor, rint
    + JDK-8231118: ARM32: Math tests failures
    + JDK-8231213: Migrate SimpleDateFormatConstTest to JDK Repo
    + JDK-8231243: [TESTBUG] CustomFont.java cannot find font file
    + JDK-8231438: [macOS] Dark mode for the desktop is not
    supported
    + JDK-8231550: C2: ShouldNotReachHere() in
    verify_strip_mined_scheduling
    + JDK-8231564: setMaximizedBounds is broken with large display
    scale and multiple monitors
    + JDK-8231572: Use -lobjc instead of -fobjc-link-runtime in
    libosxsecurity
    + JDK-8231631: sun/net/ftp/FtpURLConnectionLeak.java fails
    intermittently with NPE
    + JDK-8231671: Fix copyright headers in hotspot (missing comma
    after year)
    + JDK-8231720: Some perf regressions after 8225653
    + JDK-8231779: crash
    HeapWord*ParallelScavengeHeap::failed_mem_allocate
    + JDK-8231863: Crash if classpath is read from @argument file
    and the main gets option argument
    + JDK-8232080: jlink plugins for vendor information and
    run-time options
    + JDK-8232106: [x86] C2: SIGILL due to usage of SSSE3
    instructions on processors which don't support it
    + JDK-8232134: Change to Visual Studio 2017 15.9.16 for
    building on Windows at Oracle
    + JDK-8232226: [macos 10.15] test/jdk/java/awt/color/
    /EqualityTest/EqualityTest.java may fail
    + JDK-8232357: Compare version info of Santuario to legal notice
    + JDK-8232572: Add hooks for custom output dir in Bundles.gmk
    + JDK-8232634: Problem List ICMColorDataTest.java
    + JDK-8232748: Build static versions of certain JDK libraries
    + JDK-8232846: ProcessHandle.Info command with non-English
    shows question marks
    + JDK-8232880: Update test documentation with additional
    settings for client UI tooltip tests
    + JDK-8233033: C2 produces wrong result while unswitching a
    loop due to lost control dependencies
    + JDK-8233137: runtime/ErrorHandling/VeryEarlyAssertTest.java
    fails after 8232080
    + JDK-8233197: Invert JvmtiExport::post_vm_initialized() and
    Jfr:on_vm_start() start-up order for correct option parsing
    + JDK-8233291: [TESTBUG] tools/jlink/plugins/
    /VendorInfoPluginsTest.java fails with debug or non-server VMs
    + JDK-8233364: Fix undefined behavior in
    Canonicalizer::do_ShiftOp
    + JDK-8233494: Avoid calling MallocTracker::record_malloc and
    record_free when NMT is off
    + JDK-8233573: Toolkit.getScreenInsets(GraphicsConfiguration)
    may throw ClassCastException
    + JDK-8233608: Minimal build broken after JDK-8233494
    + JDK-8233621: Mismatch in jsse.enableMFLNExtension property
    name
    + JDK-8233696: [TESTBUG]Some jtreg tests fail when CAPS_LOCK is
    ON
    + JDK-8233707: systemScale.cpp could not compile with VS2019
    + JDK-8233801: GCMEmptyIv.java test fails on Solaris 11.4
    + JDK-8233880: Support compilers with multi-digit major version
    numbers
    + JDK-8233920: MethodHandles::tryFinally generates illegal
    bytecode for long/double return type
    + JDK-8234137: The "AutoTestOnTop.java" test may run external
    applications
    + JDK-8234146: compiler/jsr292/
    /ContinuousCallSiteTargetChange.java times out on SPARC
    + JDK-8234184: [TESTBUG] java/awt/Mouse/EnterExitEvents/
    /ModalDialogEnterExitEventsTest.java fails in Windows
    + JDK-8234270: [REDO] JDK-8204128 NMT might report incorrect
    numbers for Compiler area
    + JDK-8234332: [TESTBUG] java/awt/Focus/DisposedWindow/
    /DisposeDialogNotActivateOwnerTest/
    /DisposeDialogNotActivateOwnerTest.java fails on linux-x64
    nightly
    + JDK-8234398: Replace ID2D1Factory::GetDesktopDpi with
    GetDeviceCaps
    + JDK-8234522: [macos] Crash with use of native file dialog
    + JDK-8234691: Potential double-free in ParallelSPCleanupTask
    constructor
    + JDK-8234696: tools/jlink/plugins/VendorInfoPluginsTest.java
    times out
    + JDK-8234727: sun/security/ssl/X509TrustManagerImpl tests
    support TLSv1.3
    + JDK-8234728: Some security tests should support TLSv1.3
    + JDK-8234779: Provide idiom for declaring classes noncopyable
    + JDK-8234824: java/nio/channels/SocketChannel/AdaptSocket.java
    fails on Windows 10
    + JDK-8234968: check calloc rv in libinstrument
    InvocationAdapter
    + JDK-8235153: [TESTBUG] [macos 10.15] java/awt/Graphics/
    /DrawImageBG/SystemBgColorTest.java fails
    + JDK-8235183: Remove the "HACK CODE" in comment
    + JDK-8235263: Revert TLS 1.3 change that wrapped IOExceptions
    + JDK-8235311: Tag mismatch may alert bad_record_mac
    + JDK-8235332: TestInstanceCloneAsLoadsStores.java fails with
  - XX:+StressGCM
    + JDK-8235452: Strip mined loop verification fails with
    assert(is_OuterStripMinedLoop()) failed: invalid node class
    + JDK-8235584: UseProfiledLoopPredicate fails with
    assert(_phase-&gt;get_loop(c) == loop) failed: have to be in the
    same loop
    + JDK-8235620: Broken merge between JDK-8006406 and JDK-8003559
    + JDK-8235638: NPE in LWWindowPeer.getOnscreenGraphics()
    + JDK-8235686: Add more custom hooks in Bundles.gmk
    + JDK-8235739: Rare NPE at WComponentPeer.getGraphics()
    + JDK-8235762: JVM crash in SWPointer during C2 compilation
    + JDK-8235834: IBM-943 charset encoder needs updating
    + JDK-8235874: The ordering of Cipher Suites is not maintained
    provided through jdk.tls.client.cipherSuites and
    jdk.tls.server.cipherSuites system property.
    + JDK-8235908: omit ThreadPriorityPolicy warning when value is
    set from image
    + JDK-8235984: C2: assert(out-&gt;in(PhiNode::Region) == head ||
    out-&gt;in(PhiNode::Region) == slow_head) failed: phi must be
    either part of the slow or the fast loop
    + JDK-8236211: [Graal] compiler/graalunit/GraphTest.java is
    skipped in all testing
    + JDK-8236470: Deal with ECDSA using ecdsa-with-SHA2 plus hash
    algorithm as AlgorithmId
    + JDK-8236545: Compilation error in mach5
    java/awt/FileDialog/MacOSGoToFolderCrash.java
    + JDK-8236700: Upgrading JSZip from v3.1.5 to v3.2.2
    + JDK-8236759: ShouldNotReachHere in
    PhaseIdealLoop::verify_strip_mined_scheduling
    + JDK-8236897: Fix the copyright header for pkcs11gcm2.h
    + JDK-8236921: Add build target to produce a JDK image suitable
    for a Graal/SVM build
    + JDK-8236953: [macos] JavaFX SwingNode is not rendered on macOS
    + JDK-8236996: Incorrect Roboto font rendering on Windows with
    subpixel antialiasing
    + JDK-8237045: JVM uses excessive memory with -XX:+EnableJVMCI
  - XX:JVMCICounterSize=2147483648
    + JDK-8237055: [TESTBUG] compiler/c2/TestJumpTable.java fails
    with release VMs
    + JDK-8237086: assert(is_MachReturn()) running CTW with fix for
    JDK-8231291
    + JDK-8237192: Generate stripped/public pdbs on Windows for jdk
    images
    + JDK-8237396: JvmtiTagMap::weak_oops_do() should not trigger
    barriers
    + JDK-8237474: Default SSLEngine should create in server role
    + JDK-8237859: C2: Crash when loads float above range check
    + JDK-8237879: make 4.3 breaks build
    + JDK-8237951: CTW: C2 compilation fails with "malformed
    control flow"
    + JDK-8237962: give better error output for invalid OCSP
    response intervals in CertPathValidator checks
    + JDK-8238190: [JVMCI] Fix single implementor speculation for
    diamond shapes.
    + JDK-8238356: CodeHeap::blob_count() overestimates the number
    of blobs
    + JDK-8238452: Keytool generates wrong expiration date if
    validity is set to 2050/01/01
    + JDK-8238555: Allow Initialization of SunPKCS11 with NSS when
    there are external FIPS modules in the NSSDB
    + JDK-8238575: DragSourceEvent.getLocation() returns wrong
    value on HiDPI screens (Windows)
    + JDK-8238676: jni crashes on accessing it from process exit
    hook
    + JDK-8238721: Add failing client jtreg tests to the Problem
    List
    + JDK-8238738: AudioSystem.getMixerInfo() takes about 30 sec to
    report a gone audio device
    + JDK-8238756: C2: assert(((n) == __null || !VerifyIterativeGVN
    || !((n)-&gt;is_dead()))) failed: can not use dead node
    + JDK-8238765: PhaseCFG::schedule_pinned_nodes cannot handle
    precedence edges from unmatched CFG nodes correctly
    + JDK-8238898: Missing hash characters for header on license
    file
    + JDK-8238942: Rendering artifacts with LCD text and fractional
    metrics
    + JDK-8238985: [TESTBUG] The arrow image is blue instead of
    green
    + JDK-8239000: handle ContendedPaddingWidth in vm_version_ppc
    + JDK-8239055: Wrong implementation of VMState.hasListener
    + JDK-8239091: Reversed arguments in call to strstr in freetype
    "debug" code.
    + JDK-8239142: C2's UseUniqueSubclasses optimization is broken
    for array accesses
    + JDK-8239224: libproc_impl.c previous_thr may be used
    uninitialized warning
    + JDK-8239351: Give more meaningful InternalError messages in
    Deflater.c
    + JDK-8239365: ProcessBuilder test modifications for AIX
    execution
    + JDK-8239456: vtable stub generation: assert failure (code
    size estimate)
    + JDK-8239457: call ReleaseStringUTFChars before early returns
    in Java_sun_security_pkcs11_wrapper_PKCS11_connect
    + JDK-8239462: jdk.hotspot.agent misses some
    ReleaseStringUTFChars calls in case of early returns
    + JDK-8239557: [TESTBUG] VeryEarlyAssertTest.java validating
    "END." marker at lastline is not always true
    + JDK-8239787: AArch64: String.indexOf may incorrectly handle
    empty strings
    + JDK-8239792: Bump update version for OpenJDK: jdk-11.0.8
    + JDK-8239798: SSLSocket closes socket both socket endpoints on
    a SocketTimeoutException
    + JDK-8239819: XToolkit: Misread of screen information memory
    + JDK-8239852: java/util/concurrent tests fail with
  - XX:+VerifyGraphEdges: assert(!VerifyGraphEdges) failed:
    verification should have failed
    + JDK-8239893: Windows handle Leak when starting processes
    using ProcessBuilder
    + JDK-8239915: Zero VM crashes when handling dynamic constant
    + JDK-8239931: [win][x86] vtable stub generation: assert
    failure (code size estimate) follow-up
    + JDK-8239965: XMLEncoder/Test4625418.java fails due to "Error:
    Cp943 - can't read properly"
    + JDK-8239976: Put JDK-8239965 on the ProblemList.txt
    + JDK-8240073: Fix 'test-make' build target in 11u
    + JDK-8240197: Cannot start JVM when $JAVA_HOME includes CJK
    characters
    + JDK-8240202: A few client tests leave mouse buttons pressed
    + JDK-8240220: IdealLoopTree::dump_head predicate printing is
    broken
    + JDK-8240223: Use consistent predicate order in and with
    PhaseIdealLoop::find_predicate
    + JDK-8240227: Loop predicates should be copied to unswitched
    loops
    + JDK-8240286: [TESTBUG] Test command error in hotspot/jtreg/
    /compiler/loopopts/superword/SumRedAbsNeg_Float.java
    + JDK-8240518: Incorrect JNU_ReleaseStringPlatformChars in
    Windows Print
    + JDK-8240529: CheckUnhandledOops breaks NULL check in
    Modules::define_module
    + JDK-8240576: JVM crashes after transformation in C2
    IdealLoopTree::merge_many_backedges
    + JDK-8240603: Windows 32bit compile error after 8238676
    + JDK-8240629: argfiles parsing broken for argfiles with
    comment cross 4096 bytes chunk
    + JDK-8240711: TestJstatdPort.java failed due to
    "ExportException: Port already in use:"
    + JDK-8240786: [TESTBUG] The test java/awt/Window/
    /GetScreenLocation/GetScreenLocationTest.java fails on HiDPI
    screen
    + JDK-8240824: enhance print_full_memory_info on Linux by THP
    related information
    + JDK-8240827: Downport SSLSocketImpl.java from "8221882: Use
    fiber-friendly java.util.concurrent.locks in JSSE"
    + JDK-8240905: assert(mem == (Node*)1 || mem == mem2) failed:
    multiple Memories being matched at once?
    + JDK-8240972: macOS codesign fail on macOS 10.13.5 or older
    + JDK-8241445: Fix copyright in
    test/jdk/tools/launcher/ArgFileSyntax.java
    + JDK-8241458: [JVMCI] add mark value to expose
    CodeOffsets::Frame_Complete
    + JDK-8241464: [11u] Backport: make rehashing be a needed
    guaranteed safepoint cleanup action
    + JDK-8241556: Memory leak if -XX:CompileCommand is set
    + JDK-8241568: (fs) UserPrincipalLookupService.lookupXXX
    failure with IOE "Operation not permitted"
    + JDK-8241586: compiler/cpuflags/
    /TestAESIntrinsicsOnUnsupportedConfig.java fails on aarch64
    + JDK-8241638: launcher time metrics always report 1 on Linux
    when _JAVA_LAUNCHER_DEBUG set
    + JDK-8241660: Add virtualization information output to hs_err
    file on macOS
    + JDK-8241808: [TESTBUG] The JDK-8039467 bug appeared on macOS
    + JDK-8241888: Mirror jdk.security.allowNonCaAnchor system
    property with a security one
    + JDK-8241900: Loop unswitching may cause dependence on null
    check to be lost
    + JDK-8241948: enhance list of environment variables printed in
    hs_err file
    + JDK-8241996: on linux set full relro in the linker flags
    + JDK-8242108: Performance regression after fix for JDK-8229496
    + JDK-8242141: New System Properties to configure the TLS
    signature schemes
    + JDK-8242154: Backport parts of JDK-4947890 to OpenJDK 11u
    + JDK-8242174: [macos] The NestedModelessDialogTest test make
    the macOS unstable
    + JDK-8242239: [Graal] javax/management/generified/
    /GenericTest.java fails: FAILED: queryMBeans sets same
    + JDK-8242294: JSSE Client does not throw SSLException when an
    alert occurs during handshaking
    + JDK-8242379: [TESTBUG] compiler/loopopts/
    /TestLoopUnswitchingLostCastDependency.java fails with
    release VMs
    + JDK-8242470: Update Xerces to Version 2.12.1
    + JDK-8242498: Invalid "sun.awt.TimedWindowEvent" object leads
    to JVM crash
    + JDK-8242541: Small charset issues (ISO8859-16, x-eucJP-Open,
    x-IBM834 and x-IBM949C)
    + JDK-8242626: enhance posix print_rlimit_info
    + JDK-8243059: Build fails when --with-vendor-name contains a
    comma
    + JDK-8243539: Copyright info (Year) should be updated for fix
    of 8241638
    + JDK-8243541: (tz) Upgrade time-zone data to tzdata2020a
    + JDK-8244407: JVM crashes after transformation in C2
    IdealLoopTree::split_fall_in
    + JDK-8244520: problemlist
    java/awt/font/Rotate/RotatedFontTest.java on linux
    + JDK-8244777: ClassLoaderStats VM Op uses constant hash value
    + JDK-8244853: The static build of libextnet is missing the
    JNI_OnLoad_extnet function
    + JDK-8244951: Missing entitlements for hardened runtime
    + JDK-8245047: [PPC64] C2: ReverseBytes + Load always match to
    unordered Load (acquire semantics missing)
    + JDK-8245649: Revert 8245397 backport of 8230591
    + JDK-8246031: SSLSocket.getSession() doesn't close connection
    for timeout/ interrupts
    + JDK-8246613: Choose the default SecureRandom algo based on
    registration ordering
    + JDK-8248505: Unexpected NoSuchAlgorithmException when using
    secure random impl from BCFIPS provider
- Removed patch:
  * JDK-8228407.patch
    + integrated upstream</changelog>
  <changelog author="fstrba@suse.com" date="1604318400">- Update to upstream tag jdk-11.0.9-11 (October 2020 CPU,
  bsc#1177943)
  * New features
    + JDK-8250784: Shenandoah: A Low-Pause-Time Garbage Collector
  * Security fixes
    + JDK-8233624: Enhance JNI linkage
    + JDK-8236196: Improve string pooling
    + JDK-8236862, CVE-2020-14779: Enhance support of Proxy class
    + JDK-8237990, CVE-2020-14781: Enhanced LDAP contexts
    + JDK-8237995, CVE-2020-14782: Enhance certificate processing
    + JDK-8240124: Better VM Interning
    + JDK-8241114, CVE-2020-14792: Better range handling
    + JDK-8242680, CVE-2020-14796: Improved URI Support
    + JDK-8242685, CVE-2020-14797: Better Path Validation
    + JDK-8242695, CVE-2020-14798: Enhanced buffer support
    + JDK-8243302: Advanced class supports
    + JDK-8244136, CVE-2020-14803: Improved Buffer supports
    + JDK-8244479: Further constrain certificates
    + JDK-8244955: Additional Fix for JDK-8240124
    + JDK-8245407: Enhance zoning of times
    + JDK-8245412: Better class definitions
    + JDK-8245417: Improve certificate chain handling
    + JDK-8248574: Improve jpeg processing
    + JDK-8249927: Specify limits of jdk.serialProxyInterfaceLimit
    + JDK-8253019: Enhanced JPEG decoding
  * Other changes
    + JDK-6532025: GIF reader throws misleading exception with
    truncated images
    + JDK-6949753: [TEST BUG]: java/awt/print/PageFormat/
    /PDialogTest.java needs update by removing an infinite loop
    + JDK-8022535: [TEST BUG] javax/swing/text/html/parser/
    /Test8017492.java fails
    + JDK-8062947: Fix exception message to correctly represent
    LDAP connection failure
    + JDK-8067354: com/sun/jdi/GetLocalVariables4Test.sh failed
    + JDK-8134599: TEST_BUG: java/rmi/transport/closeServerSocket/
    /CloseServerSocket.java fails intermittently with Address
    already in use
    + JDK-8151678: com/sun/jndi/ldap/LdapTimeoutTest.java failed
    due to timeout on DeadServerNoTimeoutTest is incorrect
    + JDK-8160768: Add capability to custom resolve host/domain
    names within the default JNDI LDAP provider
    + JDK-8172404: Tools should warn if weak algorithms are used
    before restricting them
    + JDK-8193367: Annotated type variable bounds crash javac
    + JDK-8202117: com/sun/jndi/ldap/RemoveNamingListenerTest.java
    fails intermittently: Connection reset
    + JDK-8203026: java.rmi.NoSuchObjectException: no such object
    in table
    + JDK-8203281: [Windows] JComboBox change in ui when
    editor.setBorder() is called
    + JDK-8203382: Rename SystemDictionary::initialize_wk_klass to
    resolve_wk_klass
    + JDK-8203393: com/sun/jdi/JdbMethodExitTest.sh and
    JdbExprTest.sh fail due to timeout
    + JDK-8203928: [Test] Convert non-JDB scaffolding
    serviceability shell script tests to java
    + JDK-8204963: javax.swing.border.TitledBorder has a memory leak
    + JDK-8204994: SA might fail to attach to process with "Windbg
    Error: WaitForEvent failed"
    + JDK-8205534: Remove SymbolTable dependency from
    serviceability agent
    + JDK-8206309: Tier1 SA tests fail
    + JDK-8208281: java/nio/channels/
    /AsynchronousSocketChannel/Basic.java timed out
    + JDK-8209109: [TEST] rewrite com/sun/jdi shell tests to java
    version - step1
    + JDK-8209332: [TEST] test/jdk/com/sun/jdi/CatchPatternTest.sh
    is incorrect
    + JDK-8209342: Problemlist SA tests on Solaris due to Error
    attaching to process: Can't create thread_db agent!
    + JDK-8209343: Test javax/swing/border/TestTitledBorderLeak.java
    should be marked as headful
    + JDK-8209517: com/sun/jdi/BreakpointWithFullGC.java fails with
    timeout
    + JDK-8209604: [TEST] rewrite com/sun/jdi shell tests to java
    version - step2
    + JDK-8209605: com/sun/jdi/BreakpointWithFullGC.java fails with
    ZGC
    + JDK-8209608: Problem list com/sun/jdi/BreakpointWithFullGC.java
    + JDK-8210131: vmTestbase/nsk/jvmti/scenarios/allocation/AP10/
    /ap10t001/TestDescription.java failed with ObjectFree:
    GetCurrentThreadCpuTimerInfo returned unexpected error code
    + JDK-8210243: [TEST] rewrite com/sun/jdi shell tests to java
    version - step3
    + JDK-8210527: JShell: NullPointerException in
    jdk.jshell.Eval.translateExceptionStack
    + JDK-8210560: [TEST] convert com/sun/jdi redefineClass-related
    tests
    + JDK-8210725: com/sun/jdi/RedefineClearBreakpoint.java fails
    with waitForPrompt timed out after 60 seconds
    + JDK-8210748: [TESTBUG] lib.jdb.Jdb.waitForPrompt() should
    clarify which output is the pending reply after a timeout
    + JDK-8210760: [TEST] rewrite com/sun/jdi shell tests to java
    version - step4
    + JDK-8210977: jdk/jfr/event/oldobject/TestThreadLocalLeak.java
    fails to find ThreadLocalObject
    + JDK-8211292: [TEST] convert com/sun/jdi/DeferredStepTest.sh
    test
    + JDK-8211694: JShell: Redeclared variable should be reset
    + JDK-8212200: assert when shared java.lang.Object is redefined
    by JVMTI agent
    + JDK-8212629: [TEST] wrong breakpoint in
    test/jdk/com/sun/jdi/DeferredStepTest
    + JDK-8212665: com/sun/jdi/DeferredStepTest.java: jj1 (line 57)
  - unexpected. lastLine=52, minLine=52, maxLine=55
    + JDK-8212807: tools/jar/multiRelease/Basic.java times out
    + JDK-8213182: Minimal VM build failure after JDK-8212200
    (assert when shared java.lang.Object is redefined by JVMTI
    agent)
    + JDK-8213214: Set -Djava.io.tmpdir= when running tests
    + JDK-8213275: ReplaceCriticalClasses.java fails with
    jdk.internal.vm.PostVMInitHook not found
    + JDK-8213574: Deadlock in string table expansion when dumping
    lots of CDS classes
    + JDK-8213703: LambdaConversionException: Invalid receiver type
    not a subtype of implementation type interface
    + JDK-8214074: Ghash optimization using AVX instructions
    + JDK-8214491: Upgrade to JLine 3.9.0
    + JDK-8214797: TestJmapCoreMetaspace.java timed out
    + JDK-8215243: JShell tests failing intermitently with
    "Problem cleaning up the following threads:"
    + JDK-8215244: jdk/jshell/ToolBasicTest.java
    testHistoryReference failed
    + JDK-8215354: x86_32 build failures after JDK-8214074 (Ghash
    optimization using AVX instructions)
    + JDK-8215438: jshell tool: Ctrl-D causes EOF
    + JDK-8216021: RunTest.gmk might set concurrency level to 1 on
    Windows
    + JDK-8216974: HttpConnection not returned to the pool after
    204 response
    + JDK-8218948: SimpleDateFormat :: format - Zone Names are not
    reflected correctly during run time
    + JDK-8219712: code_size2 (defined in stub_routines_x86.hpp) is
    too small on new Skylake CPUs
    + JDK-8220150: macos10.14 Mojave returns anti-aliased glyphs
    instead of aliased B&amp;W glyphs
    + JDK-8221658: aarch64: add necessary predicate for ubfx
    patterns
    + JDK-8221759: Crash when completing "java.io.File.path"
    + JDK-8221918: runtime/SharedArchiveFile/serviceability/
    /ReplaceCriticalClasses.java fails: Shared archive not found
    + JDK-8222074: Enhance auto vectorization for x86
    + JDK-8222079: Don't use memset to initialize fields decode_env
    constructor in disassembler.cpp
    + JDK-8222769: [TESTBUG] TestJFRNetworkEvents should not rely
    on hostname command
    + JDK-8223688: JShell: crash on the instantiation of raw
    anonymous class
    + JDK-8223777: In posix_spawn mode, failing to exec()
    jspawnhelper does not result in an error
    + JDK-8223940: Private key not supported by chosen signature
    algorithm
    + JDK-8224184: jshell got IOException at exiting with AIX
    + JDK-8224234: compiler/codegen/TestCharVect2.java fails in
    test_mulc
    + JDK-8225037: java.net.JarURLConnection::getJarEntry() throws
    NullPointerException
    + JDK-8225625: AES Electronic Codebook (ECB) encryption and
    decryption optimization using AVX512 + VAES instructions
    + JDK-8226536: Catch OOM from deopt that fails rematerializing
    objects
    + JDK-8226575: OperatingSystemMXBean should be made container
    aware
    + JDK-8226697: Several tests which need the @key headful
    keyword are missing it.
    + JDK-8226809: Circular reference in printed stack trace is not
    correctly indented &amp; ambiguous
    + JDK-8227059: sun/security/tools/keytool/
    /DefaultSignatureAlgorithm.java timed out
    + JDK-8227269: Slow class loading when running with JDWP
    + JDK-8227595: keytool/fakegen/DefaultSignatureAlgorithm.java
    fails due to "exitValue = 6"
    + JDK-8228448: Jconsole can't connect to itself
    + JDK-8228967: Trust/Key store and SSL context utilities for
    tests
    + JDK-8229378: jdwp library loader in linker_md.c quietly
    truncates on buffer overflow
    + JDK-8229815: Upgrade Jline to 3.12.1
    + JDK-8230000: some httpclients testng tests run zero test
    + JDK-8230002: javax/xml/jaxp/unittest/transform/
    /SecureProcessingTest.java runs zero test
    + JDK-8230010: Remove jdk8037819/BasicTest1.java
    + JDK-8230094: CCE in createXMLEventWriter(Result) over an
    arbitrary XMLStreamWriter
    + JDK-8230402: Allocation of compile task fails with assert:
    "Leaking compilation tasks?"
    + JDK-8230767: FlightRecorderListener returns null recording
    + JDK-8230870: (zipfs) Add a ZIP FS test that is similar to
    test/jdk/java/util/zip/EntryCount64k.java
    + JDK-8231209: [REDO] ThreadMXBean::getThreadAllocatedBytes()
    can be quicker for self thread
    + JDK-8231586: enlarge encoding space for OopMapValue offsets
    + JDK-8231953: Wrong assumption in assertion in
    oop::register_oop
    + JDK-8231968: getCurrentThreadAllocatedBytes default
    implementation s/b getThreadAllocatedBytes
    + JDK-8232083: Minimal VM is broken after JDK-8231586
    + JDK-8232161: Align some one-way conversion in MS950 charset
    with Windows
    + JDK-8232855: jshell missing word in /help help
    + JDK-8233027: OopMapSet::all_do does oms.next() twice during
    iteration
    + JDK-8233228: Disable weak named curves by default in TLS,
    CertPath, and Signed JAR
    + JDK-8233386: Initialize NULL fields for unused decorations
    + JDK-8233452: java.math.BigDecimal.sqrt() with
    RoundingMode.FLOOR results in incorrect result
    + JDK-8233686: XML transformer uses excessive amount of memory
    + JDK-8233741: AES Countermode (AES-CTR) optimization using
    AVX512 + VAES instructions
    + JDK-8233829: javac cannot find non-ASCII module name under
    non-UTF8 environment
    + JDK-8233958: Memory retention due to HttpsURLConnection
    finalizer that serves no purpose
    + JDK-8234011: (zipfs) Memory leak in
    ZipFileSystem.releaseDeflater()
    + JDK-8234058: runtime/CompressedOops/
    /CompressedClassPointers.java fails with 'Narrow klass base:
    0x0000000000000000' missing from stdout/stderr
    + JDK-8234149: Several regression tests do not dispose Frame at
    end
    + JDK-8234347: "Turkey" meta time zone does not generate
    composed localized names
    + JDK-8234385: [TESTBUG] java/awt/EventQueue/6980209/
    /bug6980209.java fails in linux nightly
    + JDK-8234535: Cross compilation fails due to missing CFLAGS
    for the BUILD_CC
    + JDK-8234541: C1 emits an empty message when it inlines
    successfully
    + JDK-8234687: change javap reporting on unknown attributes
    + JDK-8236464: SO_LINGER option is ignored by SSLSocket in JDK
    11
    + JDK-8236548: Localized time zone name inconsistency between
    English and other locales
    + JDK-8236617: jtreg test containers/docker/
    /TestMemoryAwareness.java fails after 8226575
    + JDK-8237182: Update copyright header for shenandoah and
    epsilon files
    + JDK-8237888: security/infra/java/security/cert/
    /CertPathValidator/certification/LuxTrustCA.java fails when
    checking validity interval
    + JDK-8237977: Further update
    javax/net/ssl/compatibility/Compatibility.java
    + JDK-8238270: java.net HTTP/2 client does not decrease stream
    count when receives 204 response
    + JDK-8238284: [macos] Zero VM build fails due to an obvious
    typo
    + JDK-8238380: java.base/unix/native/libjava/childproc.c
    "multiple definition" link errors with GCC10
    + JDK-8238386: (sctp) jdk.sctp/unix/native/libsctp/SctpNet.c
    "multiple definition" link errors with GCC10
    + JDK-8238388: libj2gss/NativeFunc.o "multiple definition" link
    errors with GCC10
    + JDK-8238448: RSASSA-PSS signature verification fail when
    using certain odd key sizes
    + JDK-8238710: LingeredApp doesn't log stdout/stderr if exits
    with non-zero code
    + JDK-8239083: C1 assert(known_holder == NULL ||
    (known_holder-&gt;is_instance_klass() &amp;&amp;
    (!known_holder-&gt;is_interface() ||
    ((ciInstanceKlass*)known_holder)-&gt;has_nonstatic_concrete_methods())),
    "should be non-static concrete method");
    + JDK-8239385: KerberosTicket client name refers wrongly to
    sAMAccountName in AD
    + JDK-8240169: javadoc fails to link to non-modular api docs
    + JDK-8240295: hs_err elapsed time in seconds is not accurate
    enough
    + JDK-8240360: NativeLibraryEvent has wrong library name on
    Linux
    + JDK-8240676: Meet not symmetric failure when running lucene
    on jdk8
    + JDK-8241007: Shenandoah: remove
    ShenandoahCriticalControlThreadPriority support
    + JDK-8241065: Shenandoah: remove leftover code after
    JDK-8231086
    + JDK-8241086: Test runtime/NMT/HugeArenaTracking.java is
    failing on 32bit Windows
    + JDK-8241130: com.sun.jndi.ldap.EventSupport.removeDeadNotifier:
    java.lang.NullPointerException
    + JDK-8241138: http.nonProxyHosts=* causes
    StringIndexOutOfBoundsException in DefaultProxySelector
    + JDK-8241319: WB_GetCodeBlob doesn't have ResourceMark
    + JDK-8241478: vmTestbase/gc/gctests/Steal/steal001/steal001.java
    fails with OOME
    + JDK-8241574: Shenandoah: remove ShenandoahAssertToSpaceClosure
    + JDK-8241750: x86_32 build failure after JDK-8227269
    + JDK-8242184: CRL generation error with RSASSA-PSS
    + JDK-8242283: Can't start JVM when java home path includes
    non-ASCII character
    + JDK-8242556: Cannot load RSASSA-PSS public key with non-null
    params from byte array
    + JDK-8243029: Rewrite javax/net/ssl/compatibility/
    /Compatibility.java with a flexible interop test framework
    + JDK-8243138: Enhance BaseLdapServer to support starttls
    extended request
    + JDK-8243320: Add SSL root certificates to Oracle Root CA
    program
    + JDK-8243321: Add Entrust root CA - G4 to Oracle Root CA
    program
    + JDK-8243389: enhance os::pd_print_cpu_info on linux
    + JDK-8243453: java --describe-module failed with non-ASCII
    module name under non-UTF8 environment
    + JDK-8243470: [macos] bring back O2 opt level for unsafe.cpp
    + JDK-8243489: Thread CPU Load event may contain wrong data for
    CPU time under certain conditions
    + JDK-8243925: Toolkit#getScreenInsets() returns wrong value on
    HiDPI screens (Windows)
    + JDK-8244087: 2020-04-24 public suffix list update
    + JDK-8244151: Update MUSCLE PC/SC-Lite headers to the latest
    release 1.8.26
    + JDK-8244164: AArch64: jaotc generates incorrect code for
    compressed OOPs with non-zero heap base
    + JDK-8244196: adjust output in os_linux
    + JDK-8244225: stringop-overflow warning on strncpy call from
    compile_the_world_in
    + JDK-8244287: JFR: Methods samples have line number 0
    + JDK-8244703: "platform encoding not initialized" exceptions
    with debugger, JNI
    + JDK-8244719: CTW: C2 compilation fails with
    "assert(!VerifyHashTableKeys || _hash_lock == 0) failed:
    remove node from hash table before modifying it"
    + JDK-8244729: Shenandoah: remove resolve paths from
    SBSA::generate_shenandoah_lrb
    + JDK-8244763: Update --release 8 symbol information after JSR
    337 MR3
    + JDK-8244818: Java2D Queue Flusher crash while moving
    application window to external monitor
    + JDK-8245151: jarsigner should not raise duplicate warnings on
    verification
    + JDK-8245616: Bump update version for OpenJDK: jdk-11.0.9
    + JDK-8245714: "Bad graph detected in build_loop_late" when
    loads are pinned on loop limit check uncommon branch
    + JDK-8245801: StressRecompilation triggers assert "redundunt
    OSR recompilation detected. memory leak in CodeCache!"
    + JDK-8245832: JDK build make-static-libs should build all JDK
    libraries
    + JDK-8245880: Shenandoah: check class unloading flag early in
    concurrent code root scan
    + JDK-8245981: Upgrade to jQuery 3.5.1
    + JDK-8246027: Minimal fastdebug build broken after JDK-8245801
    + JDK-8246094: [macos] Sound Recording and playback is not
    working
    + JDK-8246153: TestEliminateArrayCopy fails with
  - XX:+StressReflectiveCode
    + JDK-8246193: Possible NPE in ENC-PA-REP search in AS-REQ
    + JDK-8246196: javax/management/MBeanServer/OldMBeanServerTest
    fails with AssertionError
    + JDK-8246203: Segmentation fault in verification due to stack
    overflow with -XX:+VerifyIterativeGVN
    + JDK-8246330: Add TLS Tests for Legacy ECDSA curves
    + JDK-8246453: TestClone crashes with "all collected exceptions
    must come from the same place"
    + JDK-8247246: Add explicit ResolvedJavaType.link and expose
    presence of default methods
    + JDK-8247350: [aarch64] assert(false) failed: wrong size of
    mach node
    + JDK-8247502: PhaseStringOpts crashes while optimising
    effectively dead code
    + JDK-8247615: Initialize the bytes left for the heap sampler
    + JDK-8247824: CTW: C2 (Shenandoah) compilation fails with SEGV
    in SBC2Support::pin_and_expand
    + JDK-8247874: Replacement in VersionProps.java.template not
    working when --with-vendor-bug-url contains '&amp;'
    + JDK-8247979: aarch64: missing side effect of killing flags
    for clearArray_reg_reg
    + JDK-8248214: Add paddings for TaskQueueSuper to reduce
    false-sharing cache contention
    + JDK-8248219: aarch64: missing memory barrier in
    fast_storefield and fast_accessfield
    + JDK-8248348: Regression caused by the update to BCEL 6.0
    + JDK-8248385: [testbug][11u] Adapt TestInitiExceptions to
    jtreg 5.1
    + JDK-8248495: [macos] zerovm is broken due to libffi headers
    location
    + JDK-8248851: CMS: Missing memory fences between free chunk
    check and klass read
    + JDK-8248987: AOT's Linker.java seems to eagerly fail-fast on
    Windows
    + JDK-8249159: Downport test rework for SSLSocketTemplate from
    8224650
    + JDK-8249215: JFrame::setVisible crashed with
  - Dfile.encoding=UTF-8 on Japanese Windows.
    + JDK-8249251: [dark_mode ubuntu 20.04] The selected menu is
    not highlighted in GTKLookAndFeel
    + JDK-8249255: Build fails if source code in cygwin home dir
    + JDK-8249277: TestVerifyIterativeGVN.java is failing with
    timeout in OpenJDK 11
    + JDK-8249278: Revert JDK-8226253 which breaks the spec of
    AccessibleState.SHOWING for JList
    + JDK-8249560: Shenandoah: Fix racy GC request handling
    + JDK-8249801: Shenandoah: Clear soft-refs on requested GC cycle
    + JDK-8249953: Shenandoah: gc/shenandoah/mxbeans tests should
    account for corner cases
    + JDK-8250582: Revert Principal Name type to NT-UNKNOWN when
    requesting TGS Kerberos tickets
    + JDK-8250609: C2 crash in IfNode::fold_compares
    + JDK-8250627: Use -XX:+/-UseContainerSupport for
    enabling/disabling Java container metrics
    + JDK-8250755: Better cleanup for
    jdk/test/javax/imageio/plugins/shared/CanWriteSequence.java
    + JDK-8250787: Provider.put no longer registering aliases in
    FIPS env
    + JDK-8250826: jhsdb does not work with coredump which comes
    from Substrate VM
    + JDK-8250827: Shenandoah: needs to reset/finish StringTable's
    dead count before/after parallel walk
    + JDK-8250844: Make sure {type,obj}ArrayOopDesc accessors check
    the bounds
    + JDK-8251117: Cannot check P11Key size in P11Cipher and
    P11AEADCipher
    + JDK-8251354: Shenandoah: Fix jdk/jfr/tool/TestPrintJSON.java
    test failure
    + JDK-8251451: Shenandoah: Remark ObjectSynchronizer roots with
    I-U
    + JDK-8251469: Better cleanup for
    test/jdk/javax/imageio/SetOutput.java
    + JDK-8251487: Shenandoah: missing detail timing tracking for
    final mark cleaning phase
    + JDK-8252120: compiler/oracle/TestCompileCommand.java
    misspells "occured"
    + JDK-8252157: JDK-8231209 11u backport breaks jmm binary
    compatibility
    + JDK-8252258: [11u] JDK-8242154 changes the default vendor
    + JDK-8252804: [test] Fix 'ReleaseDeflater.java' test after
    downport of 8234011
    + JDK-8253134: JMM_VERSION should remain at 0x20020000 (JDK 10)
    in JDK 11
    + JDK-8253283: [11u] Test build/translations/
    /VerifyTranslations.java failing after JDK-8252258
    + JDK-8253813: Backout JDK-8244287 from 11u: it causes several
    crashes
- Removed patch:
  * gcc-fno-common-fix.patch
    + not needed any more with this version
- Added patch:
  * JDK-8250861.patch
    + Fix regression "8250861: Crash in MinINode::Ideal(PhaseGVN*,
    bool)" introduced in jdk 11.0.9</changelog>
  <changelog author="fstrba@suse.com" date="1604491200">- Enable Sheandoah GC for x86_64 (jsc#ECO-3171)</changelog>
  <changelog author="fstrba@suse.com" date="1605528000">- Update to upstream tag jdk-11.0.9.1-1
  * Fix:
    + JDK-8250861: Crash in MinINode::Ideal(PhaseGVN*, bool)
- Removed patch:
  * JDK-8250861.patch
    + Integrated upstream</changelog>
  <changelog author="fstrba@suse.com" date="1611230400">- Update to upstream tag jdk-11.0.10+9 (January 2021 CPU,
  bsc#1181239)
  * Security fixes
    + JDK-8247619: Improve Direct Buffering of Characters
  * Other changes
    + JDK-6722928: Support SSPI as a native GSS-API provider
    + JDK-7185258: [macosx] Deadlock in SunToolKit.realSync()
    + JDK-8152332: [macosx] JFileChooser cannot be serialized on
    Mac OS X
    + JDK-8161684: [testconf] Add VerifyOops' testing into compiler
    tiers
    + JDK-8171279: Support X25519 and X448 in TLS
    + JDK-8173361: various crashes in
    JvmtiExport::post_compiled_method_load
    + JDK-8173658: JvmtiExport::post_class_unload() is broken for
    non-JavaThread initiators
    + JDK-8191006: hsdis disassembler plugin does not compile with
    binutils 2.29+
    + JDK-8197981: Missing return statement in
    __sync_val_compare_and_swap_8
    + JDK-8198334: java/awt/FileDialog/8003399/bug8003399.java
    fails in headless mode
    + JDK-8200151: Add 8 JNDI tests to com/sun/jndi/dns/ConfigTests/
    + JDK-8208279: Add 8 JNDI tests to com/sun/jndi/dns/EnvTests/
    + JDK-8208483: Add 5 JNDI tests to
    com/sun/jndi/dns/FactoryTests/
    + JDK-8208542: Add 4 JNDI tests to com/sun/jndi/dns/ListTests/
    + JDK-8208665: Amend cross-compilation docs with
    qemu-debootstrap recipe
    + JDK-8210088: ProblemList gc/epsilon/TestMemoryMXBeans.java
    + JDK-8210339: Add 10 JNDI tests to com/sun/jndi/dns/FedTests/
    + JDK-8211450: UndetVar::dup is not copying the kind field to
    the duplicated instance
    + JDK-8212160: JVMTI agent crashes with "assert(_value != 0LL)
    failed: resolving NULL _value"
    + JDK-8212226: SurfaceManager throws "Invalid Image variant"
    for MultiResolutionImage (Windows)
    + JDK-8213400: Support choosing group name in keytool keypair
    generation
    + JDK-8213535: Windows HiDPI html lightweight tooltips are
    truncated
    + JDK-8213698: Improve devkit creation and add support for
    linux/ppc64/ppc64le/s390x
    + JDK-8214025: assert(t-&gt;singleton()) failed: must be a
    constant when ScavengeRootsInCode &lt; 2
    + JDK-8214242: compiler/arguments/TestScavengeRootsInCode.java
    fails because of missing UnlockDiagnosticVMOptions
    + JDK-8214787: Zero builds fail with "undefined
    JavaThread::thread_state()"
    + JDK-8215583: Exclude
    runtime/handshake/HandshakeWalkSuspendExitTest.java
    + JDK-8216012: Infinite loop in RSA KeyPairGenerator
    + JDK-8216324: GetClassMethods is confused by the presence of
    default methods in super interfaces
    + JDK-8217429: WebSocket over authenticating proxy fails to
    send Upgrade headers
    + JDK-8217976: test/jdk/java/net/httpclient/websocket/
    /WebSocketProxyTest.java fails intermittently
    + JDK-8218021: Have jarsigner preserve posix permission
    attributes
    + JDK-8218287: jshell tool: input behavior unstable after
    12-ea+24 on Windows
    + JDK-8218851: JVM crash in custom classloader stress test, JDK
    12 &amp; 13
    + JDK-8220420: Cleanup c1_LinearScan
    + JDK-8222072: JVMTI GenerateEvents() sends CompiledMethodLoad
    events to wrong jvmtiEnv
    + JDK-8222286: Fix for JDK-8213419 is broken on s390
    + JDK-8222527: HttpClient doesn't send HOST header when
    tunelling HTTP/1.1 through http proxy
    + JDK-8222533: jtreg test jdk/internal/platform/cgroup/
    /TestCgroupMetrics.java fails on SLES12.3 linux ppc64le
    machine
    + JDK-8224506: [TESTBUG] TestDockerMemoryMetrics.java fails
    with exitValue = 137
    + JDK-8224555: vmTestbase/nsk/jvmti/scenarios/contention/TC02/
    /tc02t001/TestDescription.java failed
    + JDK-8224650: Add tests to support X25519 and X448 in TLS
    + JDK-8225072: Add LuxTrust certificate that is expiring in
    March 2021 to list of allowed but expired certs
    + JDK-8225329: -XX:+PrintBiasedLockingStatistics causes crash
    during initialization on Windows platforms
    + JDK-8225687: Newly added sspi.cpp in JDK-6722928 still
    contains some small errors
    + JDK-8227006: [linux] Runtime.availableProcessors execution
    time increased by factor of 100
    + JDK-8227275: Within native OOM error handling, assertions may
    hang the process
    + JDK-8227647: [Graal] Test8009761.java fails due to
    "RuntimeException: static java.lang.Object
    compiler.uncommontrap.Test8009761.m3(boolean,boolean) not
    compiled"
    + JDK-8229495: SIGILL in C2 generated OSR compilation
    + JDK-8230910: libsspi_bridge does not build on Windows 32bit
    + JDK-8232114: JVM crashed at imjpapi.dll in native code
    + JDK-8234147: Avoid looking up standard charsets in core
    libraries
    + JDK-8234393: [macos] printing ignores printer tray
    + JDK-8234863: Increase default value of MaxInlineLevel
    + JDK-8235218: Minimal VM is broken after JDK-8173361
    + JDK-8235456: Minimal VM is broken after JDK-8212160
    + JDK-8235829: graal crashes with Zombie.java test
    + JDK-8236124: Minimal VM slowdebug build failed after
    JDK-8212160
    + JDK-8236512: PKCS11 Connection closed after Cipher.doFinal
    and NoPadding
    + JDK-8236944: The legVecZ operand should be limited to
    zmm0-zmm15 registers
    + JDK-8237186: Fix typo in copyright header of
    java/io/Reader/TransferTo.java
    + JDK-8237499: JFR: Include stack trace in the ThreadStart event
    + JDK-8237512: AArch64: aarch64TestHook leaks a BufferBlob
    + JDK-8237524: AArch64: String.compareTo() may return incorrect
    result
    + JDK-8237950: C2 compilation fails with "Live Node limit
    exceeded limit" during ConvI2L::Ideal optimization
    + JDK-8238579: HttpsURLConnection drops the timeout and hangs
    forever in read
    + JDK-8239105: Add exception for expiring Digicert root
    certificates to VerifyCACerts test
    + JDK-8239477: jdk/jfr/jcmd/TestJcmdStartStopDefault.java fails
  - XX:+VerifyOops with "verify_oop: rsi: broken oop"
    + JDK-8239497: SEGV in EdgeUtils::field_name_symbol(Edge const&amp;)
    + JDK-8239886: Minimal VM build fails after JDK-8237499
    + JDK-8240633: Memory leaks in the implementations of
    FileChooserUI
    + JDK-8240690: Race condition between EDT and
    BasicDirectoryModel.FilesLoader.run0()
    + JDK-8241234: Unify monitor enter/exit runtime entries.
    + JDK-8241311: Move some charset mapping tests from closed to
    open
    + JDK-8241797: Add some tests to the problem list
    + JDK-8242029: AArch64: skip G1 array copy pre-barrier if
    marking not active
    + JDK-8242335: Additional Tests for RSASSA-PSS
    + JDK-8242480: Negative value may be returned by
    getFreeSwapSpaceSize() in the docker
    + JDK-8242614: cleanup duplicated test ldap server in some
    com/sun/jndi/ldap/ tests
    + JDK-8242846: Bring back test/jdk/tools/jlink/plugins/
    /OrderResourcesPluginTest.java
    + JDK-8243114: Implement montgomery{Multiply,Square}intrinsics
    on Windows
    + JDK-8243290: Improve diagnostic messages for class
    verification and redefinition failures
    + JDK-8243488: Add tests for set/get SendBufferSize and
    getReceiveBufferSize in DatagramSocket
    + JDK-8243549: sun/security/ssl/CipherSuite/
    /NamedGroupsWithCipherSuite.java failed with Unsupported
    signature algorithm: DSA
    + JDK-8243617: compiler/onSpinWait/TestOnSpinWaitC1.java test
    uses wrong class
    + JDK-8243619: compiler/codecache/CheckSegmentedCodeCache.java
    test misses -version
    + JDK-8244142: some hotspot/runtime tests don't check exit code
    of forked JVM
    + JDK-8244278: Excessive code cache flushes and sweeps
    + JDK-8244282: test/hotspot/jtreg/compiler/intrinsics/
    /Test8237524.java fails with --illegal-access=deny
    + JDK-8244621: [macos10.15] Garbled FX printing plus CoreText
    warnings on Catalina when building with Xcode 11
    + JDK-8244819: hsdis does not compile with binutils 2.34+
    + JDK-8245051: c1 is broken if it is compiled by gcc without
  - fno-lifetime-dse
    + JDK-8245168: jlink should not be treated as a "small" tool
    + JDK-8245400: Upgrade to LittleCMS 2.11
    + JDK-8246381: VM crashes with "Current BasicObjectLock* below
    than low_mark"
    + JDK-8246434: Threads::print_on_error assumes that the heap
    has been set up
    + JDK-8246648: issue with OperatingSystemImpl
    getFreeSwapSpaceSize in docker after 8242480
    + JDK-8247201: Print potential pointer value of readable stack
    memory in hs_err file
    + JDK-8247763: assert(outer-&gt;outcnt() == 2) failed: 'only phis'
    failure in LoopNode::verify_strip_mined()
    + JDK-8247867: Upgrade to freetype 2.10.2
    + JDK-8248190: Enable Power10 system and implement new
    byte-reverse instructions
    + JDK-8248226: TestCloneAccessStressGCM fails with
  - XX:-ReduceBulkZeroing
    + JDK-8248347: windows build broken by JDK-8243114
    + JDK-8248532: Every time I change keyboard language at my
    MacBook, Java crashes
    + JDK-8248552: C2 crashes with SIGFPE due to division by zero
    + JDK-8248596: [TESTBUG] compiler/loopopts/
    /PartialPeelingUnswitch.java times out with Graal enabled
    + JDK-8248745: Add jarsigner and keytool tests for restricted
    algorithms
    + JDK-8248791: sun/util/resources/cldr/TimeZoneNamesTest.java
    fails with -XX:-ReduceInitialCardMarks -XX:-ReduceBulkZeroing
    + JDK-8248845: AArch64: stack corruption after spilling vector
    register
    + JDK-8249176: Update GlobalSignR6CA test certificates
    + JDK-8249183: JVM crash in "AwtFrame::WmSize" method
    + JDK-8249192: MonitorInfo stores raw oops across safepoints
    + JDK-8249602: C2: assert(cnt == _outcnt) failed: no insertions
    allowed
    + JDK-8249603: C1: assert(has_error == false) failed: register
    allocation invalid
    + JDK-8249605: C2: assert(no_dead_loop) failed: dead loop
    detected
    + JDK-8249607: C2: assert(!had_error) failed: bad dominance
    + JDK-8249608: Vector register used by C2 compiled method
    corrupted at safepoint
    + JDK-8249672: Include microcode revision in features_string on
    x86
    + JDK-8249748: gtest silently ignores bad jvm arguments
    + JDK-8249821: Separate libharfbuzz from libfontmanager
    + JDK-8250598: Hyper-V is detected in spite of running on host
    OS
    + JDK-8250605: Linux x86_32 builds fail after JDK-8249821
    + JDK-8250636: iso8601_time returns incorrect offset part on
    MacOS
    + JDK-8250665: Wrong translation for the month name of May in
    ar_JO,LB,SY
    + JDK-8250772: Test com/sun/jndi/ldap/
    /NamingExceptionMessageTest.java fails intermittently with
    javax.naming.ServiceUnavailableException
    + JDK-8250825: C2 crashes with assert(field != __null) failed:
    missing field
    + JDK-8250894: Provide a configure option to build and run
    against the platform libharfbuzz
    + JDK-8250928: JFR: Improve hash algorithm for stack traces
    + JDK-8250968: Symlinks attributes not preserved when using
    jarsigner on zip files
    + JDK-8250984: Memory Docker tests fail on some Linux kernels
    w/o cgroupv1 swap limit capabilities
    + JDK-8251118: BiasedLocking::preserve_marks should not have a
    HandleMark
    + JDK-8251189: com/sun/jndi/ldap/LdapDnsProviderTest.java
    failed due to timeout
    + JDK-8251257: NMT: jcmd VM.native_memory scale=1 crashes
    target VM
    + JDK-8251365: Build failure on AIX after 8250636
    + JDK-8251397: NPE on ClassValue.ClassValueMap.cacheArray
    + JDK-8251456: [TESTBUG] compiler/vectorization/
    /TestVectorsNotSavedAtSafepoint.java failed OutOfMemoryError
    + JDK-8251458: Parse::do_lookupswitch fails with "assert(_cnt
    &gt;= 0) failed"
    + JDK-8251535: Partial peeling at unsigned test adds incorrect
    loop exit check
    + JDK-8251949: ZGC: Set explicit heap size for
    compiler/gcbarriers tests
    + JDK-8252090: JFR: StreamWriterHost::write_unbuffered() stucks
    in an infinite loop OpenJDK (build 13.0.1+9)
    + JDK-8252415: Bump update version for OpenJDK: jdk-11.0.10
    + JDK-8252470: java/awt/dnd/DisposeFrameOnDragCrash/
    /DisposeFrameOnDragTest.java fails on Windows
    + JDK-8252497: Incorrect numeric currency code for ROL
    + JDK-8252660: Shenandoah: support manageable SoftMaxHeapSize
    option
    + JDK-8252679: Two windows specific FileDIalog tests may fail
    on some Windows_Server_2016_Standard
    + JDK-8252696: Loop unswitching may cause out of bound array
    load to be executed
    + JDK-8252754: Hash code calculation of JfrStackTrace is
    inconsistent
    + JDK-8253219: Epsilon: clean up unnecessary includes
    + JDK-8253224: Shenandoah: ShenandoahStrDedupQueue destructor
    calls virtual num_queues()
    + JDK-8253226: Shenandoah: remove unimplemented
    ShenandoahStrDedupQueue::verify
    + JDK-8253269: The CheckCommonColors test should provide more
    info on failure
    + JDK-8253284: Zero OrderAccess barrier mappings are incorrect
    + JDK-8253375: OSX build fails with Xcode 12.0 (12A7209)
    + JDK-8253778: ShenandoahSafepoint::is_at_shenandoah_safepoint
    should not access VMThread state from other threads
    + JDK-8253791: Issue with useAppleColor check in CSystemColors.m
    + JDK-8254016: Test8237524 fails with -XX:-CompactStrings option
    + JDK-8254081: java/security/cert/PolicyNode/
    /GetPolicyQualifiers.java fails due to an expired certificate
    + JDK-8254144: Non-x86 Zero builds fail with return-type
    warning in os_linux_zero.cpp
    + JDK-8254166: Zero: return-type warning in
    zeroInterpreter_zero.cpp
    + JDK-8254177: (tz) Upgrade time-zone data to tzdata2020b
    + JDK-8254185: Fix Code cache sweeper heuristics for JDK 11
    + JDK-8254190: [s390] interpreter misses exception check after
    calling monitorenter
    + JDK-8254790: SIGSEGV in string_indexof_char and
    stringL_indexof_char intrinsics
    + JDK-8254854: [cgroups v1] Metric limits not properly detected
    on some join controller combinations
    + JDK-8254982: (tz) Upgrade time-zone data to tzdata2020c
    + JDK-8255050: Add pkcs11/KeyStore/ClientAuth.sh to Problem list
    + JDK-8255065: Zero: accessor_entry misses the IRIW case
    + JDK-8255226: (tz) Upgrade time-zone data to tzdata2020d
    + JDK-8255269: Unsigned overflow in g1Policy.cpp
    + JDK-8255365: Problem list failing client manual tests
    + JDK-8255457: Shenandoah: cleanup ShenandoahMarkTask
    + JDK-8255466: C2 crashes at ciObject::get_oop() const+0x0
    + JDK-8255550: x86: Assembler::cmpq(Address dst, Register src)
    encoding is incorrect
    + JDK-8255603: Memory/Performance regression after JDK-8210985
    + JDK-8255760: Shenandoah: match constants style in
    ShenandoahMarkTask fallback
    + JDK-8255781: Bump patch update version for OpenJDK:
    jdk-11.0.9.1
    + JDK-8255937: Better cleanup for
    test/jdk/javax/imageio/stream/StreamFlush.java
    + JDK-8256427: Test com/sun/jndi/dns/ConfigTests/
    /PortUnreachable.java does not work on AIX
    + JDK-8256452: Integrate missing part of JDK-8232370 to 11u
    + JDK-8256483: [TESTBUG] serviceability/jvmti/GetClassMethods/
    /libOverpassMethods.c fails to compile on gcc 4.4.x
    + JDK-8256557: libharfbuzz fails to link on gcc 4.4.x due to
  - Wl,-z,defs
    + JDK-8256618: Zero: Linux x86_32 build still fails
    + JDK-8256736: Zero: GTest tests fail with "unsuppported vm
    variant"
    + JDK-8256809: Annotation processing causes NPE during flow
    analysis
    + JDK-8257181: s390x builds are very noisy with gc-sections
    messages
    + JDK-8257242: [macOS] Java app crashes while switching input
    methods
    + JDK-8257545: SunJSSE FIPS regression in key exchange after
    JDK-8171279 11u backport
    + JDK-8257641: Shenandoah: Query is_at_shenandoah_safepoint()
    from control thread should return false
    + JDK-8257701: Shenandoah: objArrayKlass metadata is not marked
    with chunked arrays
    + JDK-8258630: Add expiry exception for QuoVadis root
    certificate
- New upstream dependency on libharfbuzz
- Regenerated patches: missing-return.patch system-pcsclite.patch</changelog>
  <changelog author="fstrba@suse.com" date="1616155200">- Added patches:
  * system-crypto-policy.patch
    + Let OpenJDK use system crypto policies unless explicitely told
    not to
  * nss-security-provider.patch
    + Add the NSS security provider with configuration in generated
    nss.cfg file
  * keytool-default-rsa.patch
    + Make keytool generate RSA keys by default, since only the
    LEGACY system crypto policy allows DSA</changelog>
  <changelog author="pujos.michael@gmail.com" date="1618488000">- moved mozilla-nss dependency to java-11-openjdk-headless package
  This is necessary to be able to do crypto with just
  java-11-openjdk-headless installed. Fixes boo#1184606</changelog>
  <changelog author="fstrba@suse.com" date="1619006400">- Update to upstream tag jdk-11.0.11+9 (April 2021, CPU)
  * Security fixes
    + JDK-8244473: Contextualize registration for JNDI
    + JDK-8244543: Enhanced handling of abstract classes
    + JDK-8249906, CVE-2021-2163, bsc#1185055: Enhance opening JARs
    + JDK-8250568, CVE-2021-2161, bsc#1185056: Less ambiguous
    processing
    + JDK-8253799: Make lists of normal filenames
    + JDK-8257001: Improve Http Client Support
  * Other changes
    + JDK-7107012: sun.jvm.hotspot.code.CompressedReadStream
    readDouble() conversion to long mishandled
    + JDK-7146776: deadlock between URLStreamHandler.getHostAddress
    and file.Handler.openconnection
    + JDK-8086003: Test fails on OSX with java.lang.RuntimeException
    'Narrow klass base: 0x0000000000000000, Narrow klass shift: 3'
    missing
    + JDK-8168869: jdeps: localized messages don't use proper line
    breaks
    + JDK-8180837: SunPKCS11-NSS tests failing with
    CKR_ATTRIBUTE_READ_ONLY and CKR_MECHANISM_PARAM_INVALID
    + JDK-8202343: Disable TLS 1.0 and 1.1
    + JDK-8205992: jhsdb cannot attach to Java processes running in
    Docker containers
    + JDK-8209193: Fix aarch64-linux compilation after -Wreorder
    changes
    + JDK-8210413: AArch64: Optimize div/rem by constant in C1
    + JDK-8210578: AArch64: Invalid encoding for fmlsvs instruction
    + JDK-8211051: jdeps usage of --dot-output doesn't provide
    valid output for modular jar
    + JDK-8211057: Gensrc step CompileProperties generates unstable
    CompilerProperties output
    + JDK-8211150: G1 Full GC not purging code root memory and
    hence causing memory leak
    + JDK-8211825: ModuleLayer.defineModulesWithXXX does not setup
    delegation when module reads automatic module
    + JDK-8212043: Add floating-point Math.min/max intrinsics
    + JDK-8212218: [TESTBUG] runtime/ErrorHandling/
    /TestHeapDumpOnOutOfMemoryErrorInMetaspace.java timed out
    + JDK-8213116: javax/swing/JComboBox/WindowsComboBoxSize/
    /WindowsComboBoxSizeTest.java fails in Windows
    + JDK-8213909: jdeps --print-module-deps should report missing
    dependences
    + JDK-8214180: Need better granularity for sleeping
    + JDK-8214223: tools/jdeps/listdeps/ListModuleDeps.java failed
    due to missing Lib2 file
    + JDK-8214230: Classes generated by SystemModulesPlugin.java
    are not reproducable
    + JDK-8214741: docs/index.html has no title or copyright
    + JDK-8215687: [Graal] unit test CheckGraalIntrinsics failed
    after 8212043
    + JDK-8217848: [Graal] vmTestbase/nsk/jvmti/ResourceExhausted/
    /resexhausted003/TestDescription.java fails
    + JDK-8218482: sun/security/krb5/auto/ReplayCachePrecise.java
    failed - no KrbException thrown
    + JDK-8218550: Add test omitted from JDK-8212043
    + JDK-8221584: SIGSEGV in os::PlatformEvent::unpark() in
    JvmtiRawMonitor::raw_exit while posting method exit event
    + JDK-8221995: AARCH64: problems with CAS instructions encoding
    + JDK-8222518: Remove unnecessary caching of Parker object in
    java.lang.Thread
    + JDK-8222785: aarch64: add necessary masking for immediate
    shift counts
    + JDK-8223186: HotSpot compile warnings from GCC 9
    + JDK-8225773: jdeps --check produces NPE if there are missing
    module dependences
    + JDK-8225805: Java Access Bridge does not close the logger
    + JDK-8226810: Failed to launch JVM because of
    NullPointerException occured on System.props
    + JDK-8229396: jdeps ignores multi-release when
    generate-module-info used on command line
    + JDK-8229474: Shenandoah: Cleanup CM::update_roots()
    + JDK-8232225: Rework the fix for JDK-8071483
    + JDK-8232905: JFR fails with assertion:
    assert(t-&gt;unflushed_size() == 0) failed: invariant
    + JDK-8233164: C2 fails with assert(phase-&gt;C-&gt;get_alias_index(t)
    == phase-&gt;C-&gt;get_alias_index(t_adr)) failed: correct memory
    chain
    + JDK-8233910: java/awt/ColorClass/AlphaColorTest.java is
    failing  intermittently in nightly lnux-x64 system
    + JDK-8233912: aarch64: minor improvements of atomic operations
    + JDK-8234508: VM_HeapWalkOperation::iterate_over_object reads
    non-strong fields with an on-strong load barrier
    + JDK-8234742: Improve handshake logging
    + JDK-8234796: Refactor Handshake::execute to take a more
    complex type than ThreadClosure
    + JDK-8235324: Dying objects are published from users of
    CollectedHeap::object_iterate
    + JDK-8235351: Lookup::unreflect should bind with the original
    caller independent of Method's accessible flag
    + JDK-8237369: Shenandoah: failed vmTestbase/nsk/jvmti/
    /AttachOnDemand/attach021/TestDescription.java test
    + JDK-8237392: Shenandoah: Remove unreliable assertion
    + JDK-8237483: AArch64 C1 OopMap inserted twice fatal error
    + JDK-8237495: Java MIDI fails with a dereferenced memory error
    when asked to send a raw 0xF7
    + JDK-8239355: (dc) Initial value of SO_SNDBUF should allow
    sending large datagrams (macOS)
    + JDK-8240353: AArch64: missing support for
  - XX:+ExtendedDTraceProbes in C1
    + JDK-8240704: CheckHandles.java failed "AssertionError: Handle
    use increased by more than 10 percent."
    + JDK-8240751: Shenandoah: fold ShenandoahTracer definition
    + JDK-8240795: [REDO] 8238384 CTW: C2 compilation fails with
    "assert(store != load-&gt;find_exact_control(load-&gt;in(0)))
    failed: dependence cycle found"
    + JDK-8241598: Upgrade JLine to 3.14.0
    + JDK-8241649: Optimize Character.toString
    + JDK-8241770: Module xxxAnnotation() methods throw NCDFE if
    module-info.class found as resource in unnamed module
    + JDK-8241911: AArch64: Fix a potential register clash issue in
    reduce_add2I
    + JDK-8242030: Wrong package declarations in jline classes after
    JDK-8241598
    + JDK-8242565: Policy initialization issues when the denyAfter
    constraint is enabled
    + JDK-8243618: compiler/rtm/cli tests can be run w/o WhiteBox
    + JDK-8243670: Unexpected test result caused by C2
    MergeMemNode::Ideal
    + JDK-8244088: [Regression] Switch of Gnome theme ends up in
    deadlocked UI
    + JDK-8244154: Update SunPKCS11 provider with PKCS11 v3.0 header
    files
    + JDK-8244340: Handshake processing thread lacks yielding
    + JDK-8244573: java.lang.ArrayIndexOutOfBoundsException thrown
    for malformed class file
    + JDK-8244683: A TSA server used by tests
    + JDK-8245005: javax/net/ssl/compatibility/BasicConnectTest.java
    failed with No enum constant
    + JDK-8245026: PsAdaptiveSizePolicy::_old_gen_policy_is_ready is
    unused
    + JDK-8245283: JFR: Can't handle constant dynamic used by Jacoco
    agent
    + JDK-8245512: CRC32 optimization using AVX512 instructions
    + JDK-8245527: LDAP Channel Binding support for Java
    GSS/Kerberos
    + JDK-8246707: (sc) SocketChannel.read/write throws
    AsynchronousCloseException on closed channel
    + JDK-8246709: sun/security/tools/jarsigner/
    /TsacertOptionTest.java compilation failed after JDK-8244683
    + JDK-8247200: assert((unsigned)fpargs &lt; 32)
    + JDK-8247766: [aarch64] guarantee(val &lt; (1U &lt;&lt; nbits))
    failed: Field too big for insn.
    + JDK-8248336: AArch64: C2: offset overflow in
    BoxLockNode::emit
    + JDK-8248865: Document JNDI/LDAP timeout properties
    + JDK-8248901: Signed immediate support in
    .../share/assembler.hpp is broken.
    + JDK-8249543: Force DirectBufferAllocTest to run with
  - ExplicitGCInvokesConcurrent
    + JDK-8249588: libwindowsaccessbridge issues on 64bit Windows
    + JDK-8249749: modify a primitive array through a stream and a
    for cycle causes jre crash
    + JDK-8249787: Make TestGCLocker more resilient with concurrent
    GCs
    + JDK-8249867: xml declaration is not followed by a newline
    + JDK-8250911: [windows] os::pd_map_memory() error detection
    broken
    + JDK-8251255: [linux] Add process-memory information to hs-err
    and VM.info
    + JDK-8251359: Shenandoah: filter null oops before calling
    enqueue/SATB barrier
    + JDK-8251925: C2: RenaissanceStressTest fails with
    assert(!had_error): bad dominance
    + JDK-8251944: Add Shenandoah test config to
    compiler/gcbarriers/UnsafeIntrinsicsTest.java
    + JDK-8251992: VM crashed running TestComplexAddrExpr.java test
    with -XX:UseAVX=X
    + JDK-8253220: Epsilon: clean up unused code/declarations
    + JDK-8253274: The CycleDMImagetest brokes the system
    + JDK-8253353: Crash in C2: guarantee(n != NULL) failed: No Node
    + JDK-8253368: TLS connection always receives close_notify
    exception
    + JDK-8253404: C2: assert(C-&gt;live_nodes() &lt;=
    C-&gt;max_node_limit()) failed: Live Node limit exceeded limit
    + JDK-8253409: Double-rounding possibility in float fma
    + JDK-8253476: TestUseContainerSupport.java fails on some Linux
    kernels w/o swap limit capabilities
    + JDK-8253524: C2: Refactor code that clones predicates during
    loop unswitching
    + JDK-8253644: C2: assert(skeleton_predicate_has_opaque(iff))
    failed: unexpected
    + JDK-8253681: closed java/awt/dnd/MouseEventAfterStartDragTest/
    /MouseEventAfterStartDragTest.html test failed
    + JDK-8253702: BigSur version number reported as 10.16, should
    be 11.nn
    + JDK-8253756: C2 CompilerThread0 crash in Node::add_req(Node*)
    + JDK-8254104: MethodCounters must exist before nmethod is
    installed
    + JDK-8254734: "dead loop detected" assert failure with patch
    from 8223051
    + JDK-8254748: Bad Copyright header format after JDK-8212218
    + JDK-8254799: runtime/ErrorHandling/
    /TestHeapDumpOnOutOfMemoryError.java fails with release VMs
    + JDK-8255058: C1: assert(is_virtual()) failed: type check
    + JDK-8255351: Add detection for Graviton 2 CPUs
    + JDK-8255368: Math.exp() gives wrong result for large values on
    x86 32-bit platforms
    + JDK-8255387: Japanese characters were printed upside down on
    AIX
    + JDK-8255401: Shenandoah: Allow oldval and newval registers to
    overlap in cmpxchg_oop()
    + JDK-8255479: [aarch64] assert(src-&gt;section_index_of(target) ==
    CodeBuffer::SECT_NONE) failed: sanity
    + JDK-8255544: Create a checked cast
    + JDK-8255559: Leak File Descriptors Because of
    ResolverLocalFilesystem#engineResolveURI()
    + JDK-8255681: print callstack in error case in
    runAWTLoopWithApp
    + JDK-8255734: VM should ignore SIGXFSZ on ppc64, s390 too
    + JDK-8255742: PrintInlining as compiler directive doesn't print
    virtual calls
    + JDK-8255845: Memory leak in imageFile.cpp
    + JDK-8255880: UI of Swing components is not redrawn after their
    internal state changed
    + JDK-8255908: ExceptionInInitializerError due to
    UncheckedIOException while initializing cgroupv1 subsystem
    + JDK-8256025: AArch64: MachCallRuntimeNode::ret_addr_offset()
    is incorrect for stub calls
    + JDK-8256056: Deoptimization stub doesn't save vector registers
    on x86
    + JDK-8256061: RegisterSaver::save_live_registers() omits upper
    halves of ZMM0-15 registers
    + JDK-8256187: [TEST_BUG] Automate bug4275046.java test
    + JDK-8256220: C1: x86_32 fails with -XX:UseSSE=1 after
    JDK-8210764 due to mishandled lir_neg
    + JDK-8256258: some missing NULL checks or asserts after
    CodeCache::find_blob_unsafe
    + JDK-8256264: Printed GlyphVector outline with low DPI has bad
    quality on Windows
    + JDK-8256290: javac/lambda/T8031967.java fails with
    StackOverflowError on x86_32
    + JDK-8256359: AArch64: runtime/ReservedStack/
    /ReservedStackTestCompiler.java fails
    + JDK-8256387: Unexpected result if patching an entire
    instruction on AArch64
    + JDK-8256421: Add 2 HARICA roots to cacerts truststore
    + JDK-8256488: [aarch64] Use ldpq/stpq instead of ld4/st4 for
    small copies in StubGenerator::copy_memory
    + JDK-8256489: Make gtest for long path names on Windows more
    resilient in the presence of virus scanners
    + JDK-8256501: libTestMainKeyWindow fails to build with Xcode
    12.2
    + JDK-8256633: Fix product build on Windows+Arm64
    + JDK-8256682: JDK-8202343 is incomplete
    + JDK-8256751: Incremental rebuild with precompiled header fails
    when touching a header file
    + JDK-8256757: Incorrect MachCallRuntimeNode::ret_addr_offset()
    for CallLeafNoFP on x86_32
    + JDK-8256806: Shenandoah: optimize shenandoah/jni/
    /TestPinnedGarbage.java test
    + JDK-8256807: C2: Not marking stores correctly as mismatched
    in string opts
    + JDK-8256810: Incremental rebuild broken on Macosx
    + JDK-8256818: SSLSocket that is never bound or connected leaks
    socket resources
    + JDK-8256888: Client manual test problem list update
    + JDK-8257083: Security infra test failures caused by
    JDK-8202343
    + JDK-8257408: Bump update version for OpenJDK: jdk-11.0.11
    + JDK-8257423: [PPC64] Support -XX:-UseInlineCaches
    + JDK-8257436: [aarch64] Regressions in ArrayCopyUnalignedDst
    .testByte/testChar for 65-78 bytes when UseSIMDForMemoryOps
    is on
    + JDK-8257513: C2: assert((constant_addr -
    _masm.code()-&gt;consts()-&gt;start()) == con.offset())
    + JDK-8257547: Handle multiple prereqs on the same line in deps
    files
    + JDK-8257561: Some code is not vectorized after 8251925 and
    8250607
    + JDK-8257565: epsilonBarrierSet.hpp should not include
    barrierSetAssembler
    + JDK-8257575: C2: "failed: only phis" assert failure in loop
    strip mining verification
    + JDK-8257594: C2 compiled checkcast of non-null object triggers
    endless deoptimization/recompilation cycle
    + JDK-8257633: Missing -mmacosx-version-min=X flag when linking
    libjvm
    + JDK-8257670: sun/security/ssl/SSLSocketImpl/SSLSocketLeak.java
    reports leaks
    + JDK-8257707: Fix incorrect format string in Http1HeaderParser
    + JDK-8257746: Regression introduced with JDK-8250984 - memory
    might be null in some machines
    + JDK-8257798: [PPC64] undefined reference to
    Klass::vtable_start_offset()
    + JDK-8257884: Re-enable sun/security/ssl/SSLSocketImpl/
    /SSLSocketLeak.java as automatic test
    + JDK-8257910: [JVMCI] Set exception_seen accordingly in the
    runtime.
    + JDK-8257997: sun/security/ssl/SSLSocketImpl/SSLSocketLeak.java
    again reports leaks after JDK-8257884
    + JDK-8257999: Parallel GC crash in gc/parallel/
    /TestDynShrinkHeap.java: new region is not in covered_region
    + JDK-8258077: Using -Xcheck:jni can lead to a double-free after
    JDK-8193234
    + JDK-8258247: Couple of issues in fix for JDK-8249906
    + JDK-8258373: Update the text handling in the JPasswordField
    + JDK-8258396: SIGILL in jdk.jfr.internal.PlatformRecorder
    .rotateDisk()
    + JDK-8258419: RSA cipher buffer cleanup
    + JDK-8258471: "search codecache" clhsdb command does not work
    + JDK-8258534: Epsilon: clean up unused includes
    + JDK-8258805: Japanese characters not entered by mouse click
    on Windows 10
    + JDK-8258833: Cancel multi-part cipher operations in SunPKCS11
    after failures
    + JDK-8258836: JNI local refs exceed capacity
    getDiagnosticCommandInfo
    + JDK-8258884: [TEST_BUG] Convert applet-based test
    open/test/jdk/javax/swing/JMenuItem/8031573/bug8031573.java
    to a regular java test
    + JDK-8259007: This test printed a blank page
    + JDK-8259048: (tz) Upgrade time-zone data to tzdata2020f
    + JDK-8259049: Uninitialized variable after JDK-8257513
    + JDK-8259231: Epsilon: improve performance under contention
    during virtual space expansion
    + JDK-8259271: gc/parallel/TestDynShrinkHeap.java still fails
    "assert(covered_region.contains(new_memregion)) failed: new
    region is not in covered_region"
    + JDK-8259312: VerifyCACerts.java fails as soneraclass2ca cert
    will expire in 90 days
    + JDK-8259319: Illegal package access when SunPKCS11 requires
    SunJCE's classes
    + JDK-8259339: AllocateUninitializedArray C2 intrinsic fails
    with void.class input
    + JDK-8259428: AlgorithmId.getEncodedParams() should return copy
    + JDK-8259446: runtime/jni/checked/
    /TestCheckedReleaseArrayElements.java fails with stderr not
    empty
    + JDK-8259451: Zero: skip serviceability/sa tests, set vm.hasSA
    to false
    + JDK-8259580: Shenandoah: uninitialized label in
    VerifyThreadGCState
    + JDK-8259619: C1: 3-arg StubAssembler::call_RT stack-use
    condition is incorrect
    + JDK-8259633: compiler/graalunit/CoreTest.java fails with NPE
    after JDK-8244543
    + JDK-8259706: C2 compilation fails with assert(vtable_index ==
    Method::invalid_vtable_index) failed: correct sentinel value
    + JDK-8259707: LDAP channel binding does not work with StartTLS
    extension
    + JDK-8259773: Incorrect encoding of AVX-512 kmovq instruction
    + JDK-8259849: Shenandoah: Rename store-val to IU-barrier
    + JDK-8259949: x86 32-bit build fails when -fcf-protection is
    passed in the compiler flags
    + JDK-8259954: gc/shenandoah/mxbeans tests fail with -Xcomp
    + JDK-8260029: aarch64: fix typo in verify_oop_array
    + JDK-8260308: Update LogCompilation junit to 4.13.1
    + JDK-8260338: Some fields in HaltNode is not cloned
    + JDK-8260349: Cannot programmatically retrieve Metaspace max
    set via JAVA_TOOL_OPTIONS
    + JDK-8260356: (tz) Upgrade time-zone data to tzdata2021a
    + JDK-8260378: [TESTBUG] DcmdMBeanTestCheckJni.java reports
    false positive
    + JDK-8260497: Shenandoah: Improve SATB flushing
    + JDK-8260502: [s390] NativeMovRegMem::verify() fails because
    it's too strict
    + JDK-8260632: Build failures after JDK-8253353
    + JDK-8260704: ParallelGC: oldgen expansion needs release-store
    for _end
    + JDK-8261022: Fix incorrect result of Math.abs() with char type
    + JDK-8261089: [TESTBUG] native library of test
    TestCheckedReleaseCriticalArray.java fails to compile with
    gcc 4.x
    + JDK-8261183: Follow on to Make lists of normal filenames
    + JDK-8261209: isStandalone property: remove dependency on
    pretty-print
    + JDK-8261231: Windows IME was disabled after DnD operation
    + JDK-8261251: Shenandoah: Use object size for full GC
    humongous compaction
    + JDK-8261310: PPC64 Zero build fails with
    'VMError::controlled_crash(int)::FunctionDescriptor
    functionDescriptor' has incomplete type and cannot be defined
    + JDK-8261334: NMT: tuning statistic shows incorrect hash
    distribution
    + JDK-8261413: Shenandoah: Disable class-unloading in I-U mode
    + JDK-8261522: [PPC64] AES intrinsics write beyond the
    destination array
    + JDK-8261534: Test sun/security/pkcs11/KeyAgreement/
    /IllegalPackageAccess.java fails on platforms where no nsslib
    artifacts are defined
    + JDK-8261585: Restore HandleArea used in
    Deoptimization::uncommon_trap
    + JDK-8261753: Test java/lang/System/OsVersionTest.java still
    failing on BigSur patch versions after JDK-8253702
    + JDK-8261829: Exclude tools/jlink/JLinkReproducibleTest.java
    in 11u
    + JDK-8261912: Code IfNode::fold_compares_helper more
    defensively
    + JDK-8261920: [AIX] jshell command throws java.io.IOError on
    non English locales
    + JDK-8262018: Wrong format in SAP copyright header of
    OsVersionTest
    + JDK-8263069: Exclude some failing tests from
    security/infra/java/security/cert/CertPathValidator</changelog>
  <changelog author="fstrba@suse.com" date="1620043200">- Remove all Jpackage provides for SLE12 in order to avoid
  installing this package as default Java on SLE12-SP5
  (bsc#1185476)</changelog>
  <changelog author="fstrba@suse.com" date="1621512000">- Modified patch:
  * nss-security-provider.patch
    + make the NSS provider first in the list</changelog>
  <changelog author="fstrba@suse.com" date="1626868800">- Update to upstream tag jdk-11.0.12+7 (July 2021, CPU)
  * Security fixes
    + JDK-8256157: Improve bytecode assembly
    + JDK-8256491: Better HTTP transport
    + JDK-8258432, CVE-2021-2341, bsc#1188564: Improve file
    transfers
    + JDK-8260453: Improve Font Bounding
    + JDK-8260960: Signs of jarsigner signing
    + JDK-8260967, CVE-2021-2369, bsc#1188565: Better jar file
    validation
    + JDK-8262380: Enhance XML processing passes
    + JDK-8262403: Enhanced data transfer
    + JDK-8262410: Enhanced rules for zones
    + JDK-8262477: Enhance String Conclusions
    + JDK-8262967: Improve Zip file support
    + JDK-8264066, CVE-2021-2388, bsc#1188566: Enhance compiler
    validation
    + JDK-8264079: Improve abstractions
    + JDK-8264460: Improve NTLM support
  * Other changes
    + JDK-6847157: java.lang.NullPointerException: HDC for
    component at sun.java2d.loops.Blit.Blit
    + JDK-7106851: Test should not use System.exit
    + JDK-8073446: TimeZone getOffset API does not  return a dst
    offset between years 2038-2137
    + JDK-8076190: Customizing the generation of a PKCS12 keystore
    + JDK-8153005: Upgrade the default PKCS12 encryption/MAC
    algorithms
    + JDK-8171303: sun/java2d/pipe/InterpolationQualityTest.java
    fails on Windows &amp; Linux
    + JDK-8177068: incomplete classpath causes NPE in Flow
    + JDK-8185734: [Windows] Structured Exception Catcher missing
    around gtest execution
    + JDK-8187450: JNI local refs exceeds capacity warning in
    NetworkInterface::getAll
    + JDK-8190763: Class cast exception on (CompoundEdit)
    UndoableEditEvent.getEdit()
    + JDK-8195841: PNGImageReader.readNullTerminatedString() doesnt
    check for non-null terminated strings with length equal to
    maxLen
    + JDK-8196100: javax/swing/text/JTextComponent/5074573/
    /bug5074573.java fails
    + JDK-8199646: JShell tests: jdk/jshell/
    /FailOverDirectExecutionControlTest.java failed with
    java.lang.UnsupportedOperationException
    + JDK-8206925: Support the certificate_authorities extension
    + JDK-8207160: ClassReader::adjustMethodParams can potentially
    return null if the args list is empty
    + JDK-8207247: AARCH64: Enable Minimal and Client VM builds
    + JDK-8207404: MulticastSocket tests failing on AIX
    + JDK-8207779: Method::is_valid_method() compares 'this' with
    NULL
    + JDK-8208061: runtime/LoadClass/TestResize.java fails with
    "Load factor too high" when running in CDS mode.
    + JDK-8209459: TestSHA512MultiBlockIntrinsics failed on AArch64
    + JDK-8210443: Migrate Locale matching tests to JDK Repo.
    + JDK-8213231: ThreadSnapshot::_threadObj can become stale
    + JDK-8213483: ARM32: runtime/ErrorHandling/
    /ShowRegistersOnAssertTest.java jtreg test fail
    + JDK-8213725: JShell NullPointerException due to class file
    with unexpected package
    + JDK-8213794: ARM32: disable TypeProfiling,
    CriticalJNINatives, Serviceablity tests for ARM32
    + JDK-8213845: ARM32: Interpreter doesn't call result handler
    after native calls
    + JDK-8214128: ARM32: wrong stack alignment on
    Deoptimization::unpack_frames
    + JDK-8214512: ARM32: Jtreg test compiler/c2/Test8062950.java
    fails on ARM
    + JDK-8214854: JDWP: Unforseen output truncation in logging
    + JDK-8214922: Add vectorization support for fmin/fmax
    + JDK-8215009: GCC 8 compilation error in libjli
    + JDK-8216184: CDS/appCDS tests failed on Windows due to long
    path to a classlist file
    + JDK-8216259: AArch64: Vectorize Adler32 intrinsics
    + JDK-8216314: SIGILL in CodeHeapState::print_names()
    + JDK-8217348: assert(thread-&gt;is_Java_thread()) failed: just
    checking
    + JDK-8217465: [REDO] - Optimize CodeHeap Analytics
    + JDK-8217561: X86: Add floating-point Math.min/max intrinsics
    + JDK-8217918: C2: -XX:+AggressiveUnboxing is broken
    + JDK-8218458: [TESTBUG] runtime/NMT/
    /CheckForProperDetailStackTrace.java fails with Expected
    stack trace missing from output
    + JDK-8219142: Remove unused JIMAGE_ResourcePath
    + JDK-8219586: CodeHeap State Analytics processes dead nmethods
    + JDK-8220074: Clean up GCC 8.3 errors in LittleCMS
    + JDK-8220407: compiler/intrinsics/math/
    /TestFpMinMaxIntrinsics.java timedout
    + JDK-8222302: [TESTBUG] test/hotspot/jtreg/compiler/intrinsics/
    /sha/cli/TestUseSHAOptionOnUnsupportedCPU.java fails on any
    other CPU
    + JDK-8222412: AARCH64: multiple instructions encoding issues
    + JDK-8223020: aarch64: expand minI_rReg and maxI_rReg patterns
    into separate instructions
    + JDK-8223444: Improve CodeHeap Free Space Management
    + JDK-8223504: Improve performance of forall loops by better
    inlining of "iterator()" methods
    + JDK-8223667: ASAN build broken
    + JDK-8225081: Remove Telia Company CA certificate expiring in
    April 2021
    + JDK-8225116: Test OwnedWindowsLeak.java intermittently fails
    + JDK-8225438: javax/net/ssl/TLSCommon/
    /TestSessionLocalPrincipal.java failed with Read timed out
    + JDK-8225756: [testbug] compiler/loopstripmining/
    /CheckLoopStripMining.java sets too short a
    SafepointTimeoutDelay
    + JDK-8226374: Restrict TLS signature schemes and named groups
    + JDK-8226627: assert(t-&gt;singleton()) failed: must be a constant
    + JDK-8226721: Missing intrinsics for Math.ceil, floor, rint
    + JDK-8227080: (fs) Files.newInputStream(...).skip(n) is slow
    + JDK-8227222: vmTestbase/jit/FloatingPoint/gen_math/Loops04/
    /Loops04.java failed XMM register should be 0-15
    + JDK-8227609: (fs) Files.newInputStream(...).skip(n) should
    allow skipping beyond file size
    + JDK-8230428: Cleanup dead CastIP node code in formssel.cpp
    + JDK-8231460: Performance issue (CodeHeap) with large free
    blocks
    + JDK-8231713: x86_32 build failures after JDK-8226721 (Missing
    intrinsics for Math.ceil, floor, rint)
    + JDK-8231841: AArch64: debug.cpp help() is missing an AArch64
    line for pns
    + JDK-8232084: HotSpot build failed with GCC 9.2.1
    + JDK-8232591: AArch64: Add missing match rules for smaddl,
    smsubl and smnegl
    + JDK-8233185: HttpServer.stop() blocks indefinitely when
    called on dispatch thread
    + JDK-8233787: Break cycle in vm_version* includes
    + JDK-8233948: AArch64: Incorrect mapping between OptoReg and
    VMReg for high 64 bits of Vector Register
    + JDK-8234355: Buffer overflow in jcmd GC.class_stats due to
    too many classes
    + JDK-8235368: Update BCEL to Version 6.4.1
    + JDK-8236859: WebSocket over authenticating proxy fails with
    NPE
    + JDK-8236992: AArch64: remove redundant load_klass in itable
    stub
    + JDK-8237743: test/langtools/jdk/jshell/
    /FailOverExecutionControlTest.java fails No
    ExecutionControlProvider with name 'nonExistent' and parameter
    keys: []
    + JDK-8237804: sun/security/mscapi tests fail with "Key pair
    not generated, alias &lt;nnnnnn&gt; already exists"
    + JDK-8238175: CTW: Class.getDeclaredMethods fails with
    assert(k-&gt;is_subclass_of(SystemDictionary::Throwable_klass()))
    failed: invalid exception class
    + JDK-8238567: SoftMainMixer.processAudioBuffers(): Wrong
    handling of stoppedMixers
    + JDK-8238812: assert(false) failed: bad AD file
    + JDK-8239312: [macos] javax/swing/JFrame/NSTexturedJFrame/
    /NSTexturedJFrame.java
    + JDK-8239386: handle ContendedPaddingWidth in
    vm_version_aarch64
    + JDK-8239536: Can't use 'java.util.List' object after
    importing 'java.awt.List'
    + JDK-8240487: Cleanup whitespace in .cc, .hh, .m, and .mm files
    + JDK-8240848: ArrayIndexOutOfBoundsException buf for
    TextCallbackHandler
    + JDK-8241082: Upgrade IANA Language Subtag Registry data to
    03-16-2020 version
    + JDK-8241087: Build failure with VS 2019 (16.5.0) due to C2039
    and C2873
    + JDK-8241101: [s390] jtreg test failure after JDK-8238696: not
    conformant features string
    + JDK-8241248: NullPointerException in
    sun.security.ssl.HKDF.extract(HKDF.java:93)
    + JDK-8241372: Several test failures due to
    javax.net.ssl.SSLException: Connection reset
    + JDK-8241475: AArch64: Add missing support for PopCountVI node
    + JDK-8241829: Cleanup the code for PrinterJob on windows
    + JDK-8241960: The SHA3 message digests impl of SUN provider
    are not thread safe after cloned
    + JDK-8242010: Upgrade IANA Language Subtag Registry to Version
    2020-04-01
    + JDK-8242429: Better implementation for sign extract
    + JDK-8242557: Add length limit for strings in PNGImageWriter
    + JDK-8242919: Paste locks up jshell
    + JDK-8243155: AArch64: Add support for SqrtVF
    + JDK-8243240: AArch64: Add support for MulVB
    + JDK-8243452: JFR: Could not create chunk in repository with
    over 200 recordings
    + JDK-8243559: Remove root certificates with 1024-bit keys
    + JDK-8243597: AArch64: Add support for integer vector abs
    + JDK-8244031: HttpClient should have more tests for HEAD
    requests
    + JDK-8244205: HTTP/2 tunnel connections through proxy may be
    reused regardless of which proxy is selected
    + JDK-8244847: Linux/PPC: runtime/CompressedOops/
    /CompressedClassPointers: smallHeapTest fails
    + JDK-8245511: G1 adaptive IHOP does not account for
    reclamation of humongous objects by young GC
    + JDK-8246274: G1 old gen allocation tracking is not in a
    separate class
    + JDK-8247354: [aarch64] PopFrame causes
    assert(oopDesc::is_oop(obj)) failed: not an oop
    + JDK-8247408: IdealGraph bit check expression canonicalization
    + JDK-8247432: Update IANA Language Subtag Registry to Version
    2020-09-29
    + JDK-8247438: JShell: When FailOverExecutionControlProvider
    fails the proximal cause is not shown
    + JDK-8247753: UIManager.getSytemLookAndFeelClassName() returns
    wrong value on Fedora 32
    + JDK-8248043: Need to eliminate excessive i2l conversions
    + JDK-8248411: [aarch64] Insufficient error handling when
    CodeBuffer is exhausted
    + JDK-8248568: compiler/c2/TestBit.java failed: test missing
    from stdout/stderr
    + JDK-8248870: AARCH64: I2L/L2I conversions can be skipped for
    masked positive values
    + JDK-8249142: java/awt/FontClass/CreateFont/DeleteFont.sh is
    unstable
    + JDK-8249189: AARCH64: more L2I conversions can be skipped
    + JDK-8249719: MethodHandle performance suffers from bad
    ResolvedMethodTable hash function
    + JDK-8249875: GCC 10 warnings -Wtype-limits with JFR code
    + JDK-8250635: MethodArityHistogram should use Compile_lock in
    favour of fancy checks
    + JDK-8250876: Fix issues with cross-compile on macos
    + JDK-8251031: Some vmTestbase/nsk/monitoring/RuntimeMXBean
    tests fail with hostnames starting from digits
    + JDK-8251525: AARCH64: Faster Math.signum(fp)
    + JDK-8252259: AArch64: Adjust default value of FLOATPRESSURE
    + JDK-8252311: AArch64: save two words in itable lookup stub
    + JDK-8252779: compiler/graalunit/HotspotTest.java failed after
    8251525
    + JDK-8252883: AccessDeniedException caused by delayed file
    deletion on Windows
    + JDK-8253167: ARM32 builds fail after JDK-8247910
    + JDK-8253572: [windows] CDS archive may fail to open with long
    file names
    + JDK-8253923: C2 doesn't always run loop opts for compilations
    that include loops
    + JDK-8253948: Memory leak in ImageFileReader
    + JDK-8254631: Better support ALPN byte wire values in SunJSSE
    + JDK-8254717: isAssignableFrom checks in
    KeyFactorySpi.engineGetKeySpec appear to be backwards
    + JDK-8255086: Update the root locale display names
    + JDK-8255625: AArch64: Implement Base64.encodeBlock
    accelerator/intrinsic
    + JDK-8255763: C2: OSR miscompilation caused by invalid memory
    instruction placement
    + JDK-8255992: JFR EventWriter does not use first string from
    StringPool with id 0
    + JDK-8256037: [TESTBUG] com/sun/jndi/dns/ConfigTests/
    /PortUnreachable.java fails due to the hard coded threshold
    is small
    + JDK-8256244: java/lang/ProcessHandle/PermissionTest.java
    fails with TestNG 7.1
    + JDK-8256287: [windows] add loop fuse to
    map_or_reserve_memory_aligned
    + JDK-8256523: Streamline Java SHA2 implementation
    + JDK-8257414: Drag n Drop target area is wrong on high DPI
    systems
    + JDK-8257569: Failure observed with
    JfrVirtualMemory::initialize
    + JDK-8257574: C2: "failed: parsing found no loops but there
    are some" assert failure
    + JDK-8257580: Bump update version for OpenJDK: jdk-11.0.12
    + JDK-8257604: JNI_ArgumentPusherVaArg leaks valist
    + JDK-8257621: JFR StringPool misses cached items across
    consecutive recordings
    + JDK-8257796: [TESTBUG]
    TestUseSHA512IntrinsicsOptionOnSupportedCPU.java fails
    on x86_32
    + JDK-8257822: C2 crashes with SIGFPE due to a division that
    floats above its zero check
    + JDK-8257828: SafeFetch may crash if invoked in non-JavaThreads
    + JDK-8257853: Remove dependencies on JNF's JNI utility
    functions in AWT and 2D code
    + JDK-8257858: [macOS]: Remove JNF dependency from
    libosxsecurity/KeystoreImpl.m
    + JDK-8257860: [macOS]: Remove JNF dependency from
    libosxkrb5/SCDynamicStoreConfig.m
    + JDK-8257988: Remove JNF dependency from
    libsaproc/MacosxDebuggerLocal.m
    + JDK-8258414: OldObjectSample events too expensive
    + JDK-8258505: [TESTBUG] TestDivZeroWithSplitIf.java fails due
    to missing UnlockDiagnosticVMOptions
    + JDK-8258753: StartTlsResponse.close() hangs due to
    synchronization issues
    + JDK-8259061: C2: assert(found) failed: memory-writing node is
    not placed in its original loop or an ancestor of it
    + JDK-8259227: C2 crashes with SIGFPE due to a division that
    floats above its zero check
    + JDK-8259232: Bad JNI lookup during printing
    + JDK-8259276: C2: Empty expression stack when reexecuting
    tableswitch/lookupswitch instructions after deoptimization
    + JDK-8259343: [macOS] Update JNI error handling in Cocoa code.
    + JDK-8259585: Accessible actions do not work on mac os x
    + JDK-8259651: [macOS] Replace JNF_COCOA_ENTER/EXIT macros
    + JDK-8259662: Don't wrap SocketExceptions into SSLExceptions
    in SSLSocketImpl
    + JDK-8259710: Inlining trace leaks memory
    + JDK-8259729: Missed JNFInstanceOf -&gt; IsInstanceOf conversion
    + JDK-8259777: Incorrect predication condition generated by ADLC
    + JDK-8259786: initialize last parameter of getpwuid_r
    + JDK-8259843: initialize dli_fname array before calling
    dll_address_to_library_name
    + JDK-8259869: [macOS] Remove desktop module dependencies on
    JNF Reference APIs
    + JDK-8259886: Improve SSL session cache performance and
    scalability
    + JDK-8259983: do not use uninitialized expand_ms value in
    G1CollectedHeap::expand_heap_after_young_collection
    + JDK-8260030: Improve stringStream buffer handling
    + JDK-8260236: better init AnnotationCollector _contended_group
    + JDK-8260255: C1: LoopInvariantCodeMotion constructor can
    leave some fields uninitialized
    + JDK-8260284: C2: assert(_base == Int) failed: Not an Int
    + JDK-8260380: Upgrade to LittleCMS 2.12
    + JDK-8260420: C2 compilation fails with assert(found_sfpt)
    failed: no node in loop that's not input to safepoint
    + JDK-8260426: awt debug_mem.c DMem_AllocateBlock might leak
    memory
    + JDK-8260432: allocateSpaceForGP in freetypeScaler.c might
    leak memory
    + JDK-8260616: Removing remaining JNF dependencies in the
    java.desktop module
    + JDK-8260653: Unreachable nodes keep speculative types alive
    + JDK-8260707: java/lang/instrument/PremainClass/
    /InheritAgent0100.java times out
    + JDK-8260925: HttpsURLConnection does not work  with other
    JSSE provider.
    + JDK-8260926: Trace resource exhausted events unconditionally
    + JDK-8261020: Wrong format parameter in
    create_emergency_chunk_path
    + JDK-8261027: AArch64: Support for LSE atomics C++ HotSpot code
    + JDK-8261167: print_process_memory_info add a close call after
    fopen
    + JDK-8261170: Upgrade to freetype 2.10.4
    + JDK-8261198: [macOS] Incorrect JNI parameters in number
    conversion in A11Y code
    + JDK-8261235: C1 compilation fails with
    assert(res-&gt;vreg_number() == index) failed: conversion check
    + JDK-8261261: The version extra fields needs to be overridable
    in jib-profiles.js
    + JDK-8261262: Kitchensink24HStress.java crashed with
    EXCEPTION_ACCESS_VIOLATION
    + JDK-8261354: SIGSEGV at MethodIteratorHost
    + JDK-8261355: No data buffering in SunPKCS11 Cipher encryption
    when the underlying mechanism has no padding
    + JDK-8261397: try catch Method failing to work when dividing
    an integer by 0
    + JDK-8261422: Adjust problematic String.format calls in
    jdk/internal/util/Preconditions.java outOfBoundsMessage
    + JDK-8261447: MethodInvocationCounters frequently run into
    overflow
    + JDK-8261481: Cannot read Kerberos settings in dynamic store
    on macOS Big Sur
    + JDK-8261505: Test test/hotspot/jtreg/gc/parallel/
    /TestDynShrinkHeap.java killed by Linux OOM Killer
    + JDK-8261601: free memory in early return in
    Java_sun_nio_ch_sctp_SctpChannelImpl_receive0
    + JDK-8261649: AArch64: Optimize LSE atomics in C++ code
    + JDK-8261730: C2 compilation fails with
    assert(store-&gt;find_edge(load) != -1) failed: missing
    precedence edge
    + JDK-8261752: Multiple GC test are missing memory requirements
    + JDK-8261791: (sctp) handleSendFailed in SctpChannelImpl.c
    potential leaks
    + JDK-8261812: C2 compilation fails with assert(!had_error)
    failed: bad dominance
    + JDK-8261914: IfNode::fold_compares_helper faces
    non-canonicalized bool when running JRuby JSON workload
    + JDK-8262093: java/util/concurrent/tck/JSR166TestCase.java
    failed "assert(false) failed: unexpected node"
    + JDK-8262110: DST starts from incorrect time in 2038
    + JDK-8262121: [11u] Redo 8244287: JFR: Methods samples have
    line number 0
    + JDK-8262163: Extend settings printout in jcmd VM.metaspace
    + JDK-8262295: C2: Out-of-Bounds Array Load from Clone Source
    + JDK-8262298: G1BarrierSetC2::step_over_gc_barrier fails with
    assert "bad barrier shape"
    + JDK-8262446: DragAndDrop hangs on Windows
    + JDK-8262461: handle wcstombsdmp return value correctly in
    unix awt_InputMethod.c
    + JDK-8262465: Very long compilation times and high memory
    consumption in C2 debug builds
    + JDK-8262726: AArch64: C1 StubAssembler::call_RT can corrupt
    stack
    + JDK-8262739: String inflation C2 intrinsic prevents insertion
    of anti-dependencies
    + JDK-8262829: Native crash in
    Win32PrintServiceLookup.getAllPrinterNames()
    + JDK-8262837: handle split_USE correctly
    + JDK-8262900: ToolBasicTest fails to access HTTP server it
    starts
    + JDK-8263260: [s390] Support latest hardware (z14 and z15)
    + JDK-8263311: Watch registry changes for remote printers
    update instead of polling
    + JDK-8263361: Incorrect arraycopy stub selected by C2 for SATB
    collectors
    + JDK-8263404: RsaPrivateKeySpec is always recognized as
    RSAPrivateCrtKeySpec in RSAKeyFactory.engineGetKeySpec
    + JDK-8263425: AArch64: two potential bugs in C1
    LIRGenerator::generate_address()
    + JDK-8263448: CTW: fatal error: meet not symmetric
    + JDK-8263504: Some OutputMachOpcodes fields are uninitialized
    + JDK-8263557: Possible NULL dereference in
    Arena::destruct_contents()
    + JDK-8263558: Possible NULL dereference in fast path arena
    free if ZapResourceArea is true
    + JDK-8263676: AArch64: one potential bug in C1
    LIRGenerator::generate_address()
    + JDK-8263729: [test] divert spurious output away from stream
    under test in ProcessBuilder Basic test
    + JDK-8263846: Bad JNI lookup getFocusOwner in accessibility
    code on Mac OS X
    + JDK-8264047: Duplicate global variable 'jvm' in libjavajpeg
    and libawt
    + JDK-8264096: slowdebug jvm crashes when StrInflatedCopy match
    rule is not supported
    + JDK-8264151: ciMethod::ensure_method_data() should return
    false is loading resulted in empty state
    + JDK-8264173: [s390] Improve Hardware Feature Detection And
    Reporting
    + JDK-8264190: Harden TLS interop tests
    + JDK-8264223: CodeHeap::verify fails extra_hops assertion in
    fastdebug test
    + JDK-8264328: Broken license in
    javax/swing/JComboBox/8072767/bug8072767.java
    + JDK-8264360: Loop strip mining verification fails with
    "should be on the backedge"
    + JDK-8264626: C1 should be able to inline excluded methods
    + JDK-8264640: CMS ParScanClosure misses a barrier
    + JDK-8264786: [macos] All Swing/AWT apps cause Allow
    Notifications prompt to appear when app is launched
    + JDK-8264821: DirectIOTest fails on a system with large block
    size
    + JDK-8264848: [macos] libjvm.dylib linker warning due to macOS
    version mismatch
    + JDK-8264923: PNGImageWriter.write_zTXt throws Exception with
    a typo
    + JDK-8264958: C2 compilation fails with assert "n is later
    than its clone"
    + JDK-8265099: Revert backport to 11u of 8236859: WebSocket
    over authenticating proxy fails with NPE
    + JDK-8265154: vinserti128 operand mix up for KNL platforms
    + JDK-8265239: Shenandoah: Shenandoah heap region count could
    be off by 1
    + JDK-8265417: Backport of JDK-8249672 breaks Solaris x86 build
    + JDK-8265421: java/lang/String/StringRepeat.java test is
    missing a memory requirement
    + JDK-8265462: Handle multiple slots in the NSS Internal Module
    from SunPKCS11's Secmod
    + JDK-8265537: x86 version string truncated after JDK-8249672
    11u backport
    + JDK-8265666: Enable AIX build platform to make external debug
    symbols
    + JDK-8265677: CMS: CardTableBarrierSet::write_ref_array_work()
    lacks storestore barrier
    + JDK-8265690: Use the latest Ubuntu base image version in
    Docker testing
    + JDK-8265718: Build failure after JDK-8258414 11u backport
    + JDK-8265750: Fatal error in safepoint.cpp after backport of
    8258414
    + JDK-8265784: [C2] Hoisting of DecodeN leaves MachTemp inputs
    behind
    + JDK-8265938: C2's conditional move optimization does not
    handle top Phi
    + JDK-8266220: keytool still prompt for store password on a
    password-less pkcs12 file if -storetype pkcs12 is specified
    + JDK-8266293: Key protection using PBEWithMD5AndDES fails with
    "java.security.InvalidAlgorithmParameterException: Salt must
    be 8 bytes long"
    + JDK-8266713: [AIX] Build failure after 11u backport of
    JDK-8247753
    + JDK-8266802: Shenandoah: Round up region size to page size
    unconditionally
    + JDK-8266892: avoid maybe-uninitialized gcc warnings on linux
    s390x
    + JDK-8266929: Unable to use algorithms from 3p providers
    + JDK-8267235: [macos_aarch64]
    InterpreterRuntime::throw_pending_exception messing up LR
    results in crash
    + JDK-8267561: Shenandoah: Reference processing not properly
    setup for outside of cycle degenerated GC
    + JDK-8267599: Revert the change to the default PKCS12
    macAlgorithm and macIterationCount props for 11u/8u/7u
    + JDK-8267641: [11u] 8227609 backport typo
    + JDK-8267721: Enable sun/security/pkcs11 tests for Amazon
    Linux 2 AArch64
    + JDK-8268678: LetsEncryptCA.java test fails as Let's Encrypt
    Authority X3 is retired</changelog>
  <changelog author="schwab@suse.de" date="1628078400">- riscv64-zero.patch: Add support for riscv64 (zero VM)</changelog>
  <changelog author="fstrba@suse.com" date="1629979200">- Added patch:
  * jdk11-glibc234.patch
    + fix build with glibc-2.34 (bsc#1189201)</changelog>
  <changelog author="fstrba@suse.com" date="1631534400">- Modified patch:
  * nss-security-provider.patch
    + revert recent changes making NSS provider the default one
    + fixes bsc#1190252</changelog>
  <changelog author="fstrba@suse.com" date="1631793600">- Added patch:
  * fips.patch
    + implement FIPS support in OpenJDK</changelog>
  <changelog author="fstrba@suse.com" date="1634817600">- Update to upstream tag jdk-11.0.13+8 (October 2021 CPU)
  * Security fixes
    + JDK-8163326, CVE-2021-35550, bsc#1191901: Update the default
    enabled cipher suites preference
    + JDK-8254967, CVE-2021-35565, bsc#1191909:
    com.sun.net.HttpsServer spins on TLS session close
    + JDK-8263314: Enhance XML Dsig modes
    + JDK-8265167, CVE-2021-35556, bsc#1191910: Richer Text Editors
    + JDK-8265574: Improve handling of sheets
    + JDK-8265580, CVE-2021-35559, bsc#1191911: Enhanced style for
    RTF kit
    + JDK-8265776: Improve Stream handling for SSL
    + JDK-8266097, CVE-2021-35561, bsc#1191912: Better hashing
    support
    + JDK-8266103: Better specified spec values
    + JDK-8266109: More Resilient Classloading
    + JDK-8266115: More Manifest Jar Loading
    + JDK-8266137, CVE-2021-35564, bsc#1191913: Improve Keystore
    integrity
    + JDK-8266689, CVE-2021-35567, bsc#1191903: More Constrained
    Delegation
    + JDK-8267086: ArrayIndexOutOfBoundsException in
    java.security.KeyFactory.generatePublic
    + JDK-8267712: Better LDAP reference processing
    + JDK-8267729, CVE-2021-35578, bsc#1191904: Improve TLS client
    handshaking
    + JDK-8267735, CVE-2021-35586, bsc#1191914: Better BMP support
    + JDK-8268193: Improve requests of certificates
    + JDK-8268199: Correct certificate requests
    + JDK-8268205: Enhance DTLS client handshake
    + JDK-8268506: More Manifest Digests
    + JDK-8269618, CVE-2021-35603, bsc#1191906: Better session
    identification
    + JDK-8269624: Enhance method selection support
    + JDK-8270398: Enhance canonicalization
    + JDK-8270404: Better canonicalization
  * Other changes
    + JDK-8024368: private methods are allocated vtable indices
    + JDK-8042902: Test java/net/Inet6Address/serialize/
    /Inet6AddressSerializationTest.java fails intermittently
    + JDK-8140466: ChaCha20 and Poly1305 TLS Cipher Suites
    + JDK-8157404: Unable to read certain PKCS12 keystores from
    SequenceInputStream
    + JDK-8158066: SourceDebugExtensionTest fails to rename file
    + JDK-8168304: Make all of DependencyContext_test available in
    product mode
    + JDK-8169246: java/net/DatagramSocket/ReportSocketClosed.java
    fails intermittently with BindException
    + JDK-8181313: SA: Remove libthread_db dependency on Linux
    + JDK-8193214: Incorrect annotations.without.processors
    warnings with JDK 9
    + JDK-8194230: jdk/internal/jrtfs/remote/
    /RemoteRuntimeImageTest.java fails with
    java.lang.NullPointerException
    + JDK-8196092: javax/swing/JComboBox/8032878/bug8032878.java
    fails
    + JDK-8199931: java/net/MulticastSocket/
    /UnreferencedMulticastSockets.java fails with "incorrect data
    received"
    + JDK-8206083: Make tools/javac/api/T6265137.java robust to JDK
    version changes
    + JDK-8206350: java/util/Locale/bcp47u/SystemPropertyTests.java
    failed on Mac 10.13 with zh_CN and zh_TW locales.
    + JDK-8207316: java/nio/channels/spi/SelectorProvider/
    /inheritedChannel/InheritedChannelTest.java failed
    + JDK-8208227: tools/jdeps/DotFileTest.java fails on Win-X64
    + JDK-8208363: test/jdk/java/lang/Package/
    /PackageFromManifest.java missing module dependencies
    declaration
    + JDK-8209380: ARM: cleanup maybe-uninitialized and reorder
    compiler warnings
    + JDK-8209768: Refactor java/util/prefs/CheckUserPrefsStorage.sh
    to plain java test
    + JDK-8209772: Refactor shell test java/util/ServiceLoader/
    /basic/basic.sh to java
    + JDK-8209773: Refactor shell test javax/naming/module/basic.sh
    to java
    + JDK-8209832: Refactor jdk/internal/reflect/Reflection/
    /GetCallerClassTest.sh to plain java test
    + JDK-8209930: Refactor java/util/zip/ZipFile/deletetempjar.sh
    to plain java test
    + JDK-8210406: Refactor java.util.PluggableLocale:i18n shell
    tests to plain java tests
    + JDK-8210407: Refactor java.util.Calendar:i18n shell tests to
    plain java tests
    + JDK-8210495: compiler crashes because of illegal signature in
    otherwise legal code
    + JDK-8210669: Some launcher tests assume a pre-JDK 9 run-time
    image layout
    + JDK-8210802: temp files left by tests in
    jdk/java/net/httpclient
    + JDK-8210819: Update the host name in CNameTest.java
    + JDK-8210908: Refactor java/util/prefs/PrefsSpi.sh to plain
    java test
    + JDK-8210934: Move sun/net/www/protocol/http/
    /GetErrorStream.java to OpenJDK
    + JDK-8210959: JShell fails and exits when statement throws an
    exception whose message contains a '%'.
    + JDK-8211055: Provide print to a file (PDF) feature even when
    printer was not connected
    + JDK-8211092: test/jdk/sun/net/www/http/HttpClient/
    /MultiThreadTest.java fails intermittently when cleaning up
    + JDK-8211296: Remove HotSpot deprecation warning suppression
    for Mac/clang
    + JDK-8211325: test/jdk/java/net/Socket/LingerTest.java fails
    with cleaning up
    + JDK-8212040: Compilation error due to wrong usage of
    NSPrintJobDispositionValue in mac10.12
    + JDK-8212695: Add explicit timeout to several HTTP Client tests
    + JDK-8212718: Refactor some annotation processor tests to
    better use collections
    + JDK-8213007: Update the link in test/jdk/sun/security/
    /provider/SecureRandom/DrbgCavp.java
    + JDK-8213137: Remove static initialization of monitor/mutex
    instances
    + JDK-8213235: java/nio/channels/SocketChannel/
    /AsyncCloseChannel.java fails with threads that didn't exit
    + JDK-8213409: Refactor sun.text.IntHashtable:i18n shell tests
    to plain java tests
    + JDK-8213576: Make test AsyncCloseChannel.java run in othervm
    + JDK-8213694: Test Timeout.java should run in othervm mode
    + JDK-8213718: [TEST] Wrong classname in vmTestbase/nsk/stress/
    /except/except002 and except003
    + JDK-8213922: fix ctw stand-alone build
    + JDK-8214195: Align stdout messages in
    test/jdk/java/math/BigInteger/PrimitiveConversionTests.java
    + JDK-8214520: [TEST_BUG] sun/security/mscapi/nonUniqueAliases/
    /NonUniqueAliases.java failed with incorrect jtreg tags order
    + JDK-8214937: sun/security/tools/jarsigner/warnings/
    /NoTimestampTest.java failed due to unexpected expiration date
    + JDK-8216532: tools/launcher/Test7029048.java fails (Solaris)
    + JDK-8217825: Verify @AfterTest is used correctly in WebSocket
    tests
    + JDK-8218145: block_if_requested is not proper inlined due to
    size
    + JDK-8219417: bump jtreg requiredVersion to b14
    + JDK-8219552: bump jtreg requiredVersion to b14 in
    test/jdk/sanity/client/
    + JDK-8219804: java/net/MulticastSocket/Promiscuous.java fails
    intermittently due to NumberFormatException
    + JDK-8220445: Support for side by side MSVC Toolset versions
    + JDK-8221988: add possibility to build with Visual Studio 2019
    + JDK-8222751: closed/test/jdk/sun/security/util/
    /DerIndefLenConverter/IndefBerPkcs12.java fail
    + JDK-8223050: JVMCI: findUniqueConcreteMethod() should not use
    Dependencies::find_unique_concrete_method() for non-virtual
    methods
    + JDK-8224853: CDS address sanitizer errors
    + JDK-8225082: Remove IdenTrust certificate that is expiring in
    September 2021
    + JDK-8225583: Examine the HttpResponse.BodySubscribers for
    null handling and multiple subscriptions
    + JDK-8225690: Multiple AttachListener threads can be created
    + JDK-8225790: Two NestedDialogs tests fail on Ubuntu
    + JDK-8226319: Add forgotten test/jdk/java/net/httpclient/
    /BodySubscribersTest.java
    + JDK-8226533: JVMCI: findUniqueConcreteMethod should handle
    statically bindable methods directly
    + JDK-8226602: Test convenience reactive primitives from
    java.net.http with RS TCK
    + JDK-8226683: Remove review suggestion from fix to 8219804
    + JDK-8227738: jvmti/DataDumpRequest/datadumpreq001 failed due
    to "exit code is 134"
    + JDK-8227766: CheckUnhandledOops is broken in MemAllocator
    + JDK-8227815: Minimal VM: set_state is not a member of
    AttachListener
    + JDK-8230674: Heap dumps should exclude dormant CDS archived
    objects of unloaded classes
    + JDK-8230808: Remove Access::equals()
    + JDK-8230841: Remove oopDesc::equals()
    + JDK-8231717: Improve performance of charset decoding when
    charset is always compactable
    + JDK-8232243: Wrong caret position in JTextPane on Windows
    with a screen resolution &gt; 100%
    + JDK-8232782: Shenandoah: streamline post-LRB CAS barrier
    (aarch64)
    + JDK-8233790: Forward output from heap dumper to jcmd/jmap
    + JDK-8233989: Create an IPv4 version of
    java/net/MulticastSocket/SetLoopbackMode.java
    + JDK-8234510: Remove file seeking requirement for writing a
    heap dump
    + JDK-8235211: serviceability/attach/
    /RemovingUnixDomainSocketTest.java fails with
    AttachNotSupportedException: Unable to open socket file
    + JDK-8235216: typo in test filename
    + JDK-8235866: bump jtreg requiredVersion to 4.2b16
    + JDK-8236111: narrow allowSmartActionArgs disabling
    + JDK-8236413: AbstractConnectTimeout should tolerate both
    NoRouteToHostException and UnresolvedAddressException
    + JDK-8236671: NullPointerException in JKS keystore
    + JDK-8238930: problem list compiler/c2/Test8004741.java
    + JDK-8238943: switch to jtreg 5.0
    + JDK-8240555: Using env of JAVA_TOOL_OPTIONS and _JAVA_OPTIONS
    breaks QuietOption.java test
    + JDK-8240983: Incorrect copyright header in Apache Santuario
    2.1.3 files
    + JDK-8241336: Some java.net tests failed with
    NoRouteToHostException on MacOS with special network
    configuration
    + JDK-8241353: NPE in ToolProvider.getSystemJavaCompiler
    + JDK-8241768: git needs .gitattributes
    + JDK-8242882: opening jar file with large manifest might throw
    NegativeArraySizeException
    + JDK-8244973: serviceability/attach/
    /RemovingUnixDomainSocketTest.java fails "stderr was not
    empty"
    + JDK-8245134: test/lib/jdk/test/lib/security/
    /KeyStoreUtils.java should allow to specify aliases
    + JDK-8246261: TCKLocalTime.java failed due to "AssertionError:
    expected [18:14:22] but found [18:14:23]"
    + JDK-8246387: switch to jtreg 5.1
    + JDK-8247421: [TESTBUG] ReturnBlobToWrongHeapTest.java failed
    allocating blob
    + JDK-8247469: getSystemCpuLoad() returns -1 on linux when some
    offline cpus are present and cpusets.effective_cpus is not
    available
    + JDK-8248352: [TEST_BUG] Test test/jdk/java/awt/font/
    /TextLayout/ArabicDiacriticTest.java can leave frame open
    + JDK-8248403: AArch64: Remove uses of kernel integer types
    + JDK-8248414: AArch64: Remove uses of long and unsigned long
    ints
    + JDK-8248657: Windows: strengthening in ThreadCritical
    regarding memory model
    + JDK-8248666: AArch64: Use THREAD_LOCAL instead of __thread
    + JDK-8248668: AArch64: Avoid MIN/MAX macros when using MSVC
    + JDK-8248671: AArch64: Remove unused variables
    + JDK-8248682: AArch64: Use ATTRIBUTE_ALIGNED helper
    + JDK-8248816: C1: Fix signature conflict in
    LIRGenerator::strength_reduce_multiply
    + JDK-8249095: tools/javac/launcher/SourceLauncherTest.java
    fails on Windows
    + JDK-8249548: backward focus traversal gets stuck in button
    group
    + JDK-8249773: Upgrade ReceiveISA.java test to be resilient to
    failure due to stray packets and interference
    + JDK-8249897: jdk/javadoc/tool/LangVers.java uses @ignore w/o
    bug-id
    + JDK-8249898: jdk/javadoc/tool/6176978/T6176978.java uses
    @ignore w/o bug-id
    + JDK-8249899: jdk/javadoc/tool/InlineTagsWithBraces.java uses
    @ignore w/o bug-id
    + JDK-8250588: Shenandoah: LRB needs to save/restore fp
    registers for runtime call
    + JDK-8250824: AArch64: follow up for JDK-8248414
    + JDK-8251166: Add automated testcases for changes done in
    JDK-8214112
    + JDK-8251252: Add automated testcase for fix done in
    JDK-8214253
    + JDK-8251254: Add automated test for fix done in JDK-8218472
    + JDK-8251361: Potential race between Logger configuration and
    GCs in HttpURLConWithProxy test
    + JDK-8251549: Update docs on building for Git
    + JDK-8251945: SIGSEGV in
    PackageEntry::purge_qualified_exports()
    + JDK-8252194: Add automated test for fix done in JDK-8218469
    + JDK-8252648: Shenandoah: name gang tasks consistently
    + JDK-8252825: Add automated test for fix done in JDK-8218479
    + JDK-8252853: AArch64: gc/shenandoah/TestVerifyJCStress.java
    fails intermittently with C1
    + JDK-8252857: AArch64: Shenandoah C1 CAS is not sequentially
    consistent
    + JDK-8253048: AArch64: When CallLeaf, no need to preserve
    callee-saved registers in caller
    + JDK-8253424: Add support for running pre-submit testing using
    GitHub Actions
    + JDK-8253631: Remove unimplemented CompileBroker methods after
    JEP-165
    + JDK-8253865: Pre-submit testing using GitHub Actions does not
    detect failures reliably
    + JDK-8253899: Make IsClassUnloadingEnabled signature match
    specification
    + JDK-8254024: Enhance native libs for AWT and Swing to work
    with GraalVM Native Image
    + JDK-8254054: Pre-submit testing using GitHub Actions should
    not use the deprecated set-env command
    + JDK-8254173: Add Zero, Minimal hotspot targets to submit
    workflow
    + JDK-8254175: Build no-pch configuration in debug mode for
    submit checks
    + JDK-8254244: Some code emitted by TemplateTable::branch is
    unused when running TieredCompilation
    + JDK-8254270: linux 32 bit build doesn't compile
    libjdwp/log_messages.c
    + JDK-8254282: Add Linux x86_32 builds to submit workflow
    + JDK-8254850: Update terminology in java.awt.GridBagLayout
    source code comments
    + JDK-8255255: Update Apache Santuario (XML Signature) to
    version 2.2.1
    + JDK-8255305: Add Linux x86_32 tier1 to submit workflow
    + JDK-8255352: Archive important test outputs in submit workflow
    + JDK-8255373: Submit workflow artifact name is always
    "test-results_.zip"
    + JDK-8255452: Doing GC during JVMTI MethodExit event posting
    breaks return oop
    + JDK-8255718: Zero: VM should know it runs in interpreter-only
    mode
    + JDK-8255790: GTKL&amp;F: Java 16 crashes on initialising GTKL&amp;F
    on Manjaro Linux
    + JDK-8255810: Zero: build fails without JVMTI
    + JDK-8255895: Submit workflow artifacts miss hs_errs/replays
    due to ZIP include mismatch
    + JDK-8256127: Add cross-compiled foreign architectures builds
    to submit workflow
    + JDK-8256215: Shenandoah: re-organize saving/restoring machine
    state in assembler code
    + JDK-8256267: Relax compiler/floatingpoint/NaNTest.java for
    x86_32 and lower -XX:+UseSSE
    + JDK-8256277: Github Action build on macOS should define OS
    and Xcode versions
    + JDK-8256354: Github Action build on Windows should define OS
    and MSVC versions
    + JDK-8256393: Github Actions build on Linux should define OS
    and GCC versions
    + JDK-8256414: add optimized build to submit workflow
    + JDK-8256747: GitHub Actions: decouple the hotspot build-only
    jobs from Linux x64 testing
    + JDK-8257056: Submit workflow should apt-get update to avoid
    package installation errors
    + JDK-8257148: Remove obsolete code in AWTView.m
    + JDK-8257497: Update keytool to create AKID from the SKID of
    the issuing certificate as specified by RFC 5280
    + JDK-8257620: Do not use objc_msgSend_stret to get macOS
    version
    + JDK-8257913: Add more known library locations to simplify
    Linux cross-compilation
    + JDK-8258703: Incorrect 512-bit vector registers restore on
    x86_32
    + JDK-8259338: Add expiry exception for identrustdstx3 alias to
    VerifyCACerts.java test
    + JDK-8259535: ECDSA SignatureValue do not always have the
    specified length
    + JDK-8259679: GitHub actions should use MSVC 14.28
    + JDK-8259924: GitHub actions fail on Linux x86_32 with "Could
    not configure libc6:i386"
    + JDK-8260460: GitHub actions still fail on Linux x86_32 with
    "Could not configure libc6:i386"
    + JDK-8260589: Crash in JfrTraceIdLoadBarrier::load(_jclass*)
    + JDK-8260923: Add more tests for SSLSocket input/output
    shutdown
    + JDK-8261072: AArch64: Fix MacroAssembler::get_thread
    convention
    + JDK-8261147: C2: Node is wrongly marked as reduction
    resulting in a wrong execution due to wrong vector instructions
    + JDK-8261238: NMT should not limit baselining by size threshold
    + JDK-8261496: Shenandoah: reconsider pacing updates memory
    ordering
    + JDK-8261652: Remove some dead comments from os_bsd_x86
    + JDK-8261846: [JVMCI] c2v_iterateFrames can get out of sync
    with the StackFrameStream
    + JDK-8262000: jdk/jfr/event/gc/detailed/
    /TestPromotionFailedEventWithParallelScavenge.java failed with
    "OutOfMemoryError: Java heap space"
    + JDK-8262017: C2: assert(n != __null) failed: Bad immediate
    dominator info.
    + JDK-8262392: Update Mesa 3-D Headers to version 21.0.3
    + JDK-8262409: sun/security/ssl/SSLSocketImpl/
    /SSLSocketImplThrowsWrongExceptions. SSL test failures caused
    by java failed with "Server reported the wrong exception"
    + JDK-8262470: Printed GlyphVector outline with low DPI has bad
    quality on Windows
    + JDK-8262862: Harden tests sun/security/x509/URICertStore/
    /ExtensionsWithLDAP.java and krb5/canonicalize/Test.java
    + JDK-8263136: C4530 was reported from VS 2019 at access bridge
    + JDK-8263227: C2: inconsistent spilling due to dead nodes in
    exception block
    + JDK-8263382: java/util/logging/ParentLoggersTest.java failed
    with "checkLoggers: getLoggerNames() returned unexpected
    loggers"
    + JDK-8263407: SPARC64 detection fails on Athena (SPARC64-X)
    + JDK-8263432: javac may report an invalid package/class clash
    on case insensitive filesystems
    + JDK-8263490: [macos] Crash occurs on JPasswordField with
    activated InputMethod
    + JDK-8263531: Remove unused buffer int
    + JDK-8263667: Avoid running GitHub actions on branches named
    pr/*
    + JDK-8263776: [JVMCI] add helper to perform Java upcalls
    + JDK-8264016: [JVMCI] add some thread local fields for use by
    JVMCI
    + JDK-8264752: SIGFPE crash with option
    FlightRecorderOptions:threadbuffersize=30M
    + JDK-8265132: C2 compilation fails with assert "missing
    precedence edge"
    + JDK-8265231: (fc) ReadDirect and WriteDirect tests fail after
    fix for JDK-8264821
    + JDK-8265335: Epsilon: Minor typo in EpsilonElasticTLABDecay
    description
    + JDK-8265756: AArch64: initialize memory allocated for locals
    according to Windows AArch64 stack page growth requirement in
    template interpreter
    + JDK-8265761: Font with missed font family name is not
    properly printed on Windows
    + JDK-8265773: incorrect jdeps message "jdk8internals" to
    describe a removed JDK internal API
    + JDK-8265836: OperatingSystemImpl.getCpuLoad() returns
    incorrect CPU load inside a container
    + JDK-8266018: Shenandoah: fix an incorrect assert
    + JDK-8266206: Build failure after JDK-8264752 with older GCCs
    + JDK-8266248: Compilation failure in
    PLATFORM_API_MacOSX_MidiUtils.c with Xcode 12.5
    + JDK-8266288: assert root method not found in
    witnessed_reabstraction_in_supers is too strong
    + JDK-8266404: Fatal error report generated with
  - XX:+CrashOnOutOfMemoryError should not contain suggestion to
    submit a bug report
    + JDK-8266480: Implicit null check optimization does not update
    control of hoisted memory operation
    + JDK-8266615: C2 incorrectly folds subtype checks involving an
    interface array
    + JDK-8266642: Improve ResolvedMethodTable hash function
    + JDK-8266749: AArch64: Backtracing broken on PAC enabled
    systems
    + JDK-8266761: AssertionError in
    sun.net.httpserver.ServerImpl.responseCompleted
    + JDK-8266813: Shenandoah: Use shorter instruction sequence for
    checking if marking in progress
    + JDK-8267042: bug in monitor locking/unlocking on ARM32 C1 due
    to uninitialized BasicObjectLock::_displaced_header
    + JDK-8267348: Rewrite gc/epsilon/TestClasses.java to use
    Metaspace with less classes
    + JDK-8267396: Avoid recording "pc" in unhandled oops detector
    for better performance
    + JDK-8267399: C2: java/text/Normalizer/ConformanceTest.java
    test failed with assertion
    + JDK-8267424: CTW: C1 fails with "State must not be null"
    + JDK-8267459: Pasting Unicode characters into JShell does not
    work.
    + JDK-8267625: AARCH64: typo in LIR_Assembler::emit_profile_type
    + JDK-8267666: Add option to jcmd GC.heap_dump to use existing
    file
    + JDK-8267695: Bump update version for OpenJDK: jdk-11.0.13
    + JDK-8267751: (test) jtreg.SkippedException has no serial
    VersionUID
    + JDK-8267773: PhaseStringOpts::int_stringSize doesn't handle
    min_jint correctly
    + JDK-8268103: JNI functions incorrectly return a double after
    JDK-8265836
    + JDK-8268127: Shenandoah: Heap size may be too small for
    region to align to large page size
    + JDK-8268261: C2: assert(n != __null) failed: Bad immediate
    dominator info.
    + JDK-8268347: C2: nested locks optimization may create
    unbalanced monitor enter/exit code
    + JDK-8268360: Missing check for infinite loop during node
    placement
    + JDK-8268362: [REDO] C2 crash when compile negative
    Arrays.copyOf length after loop
    + JDK-8268366: Incorrect calculation of has_fpu_registers in C1
    linear scan
    + JDK-8268369: SIGSEGV in PhaseCFG::implicit_null_check due to
    missing null check
    + JDK-8268417: Add test from JDK-8268360
    + JDK-8268427: Improve AlgorithmConstraints:checkAlgorithm
    performance
    + JDK-8268617: [11u REDO] - WebSocket over authenticating proxy
    fails with NPE
    + JDK-8268620: InfiniteLoopException test may fail on x86
    platforms
    + JDK-8268635: Corrupt oop in ClassLoaderData
    + JDK-8268699: Shenandoah: Add test for JDK-8268127
    + JDK-8268771: javadoc -notimestamp option does not work on
    index.html
    + JDK-8268775: Password is being converted to String in
    AccessibleJPasswordField
    + JDK-8268776: Test `ADatagramSocket.java` missing /othervm
    from @run tag
    + JDK-8268965: TCP Connection Reset when connecting simple
    socket to SSL server
    + JDK-8269304: Regression ~5% in 2005 in b27
    + JDK-8269415: [11u] Remove ea from
    DEFAULT_PROMOTED_VERSION_PRE in OpenJDK 11u
    + JDK-8269478: Shenandoah: gc/shenandoah/mxbeans tests should
    be more resilient
    + JDK-8269529: javax/swing/reliability/
    /HangDuringStaticInitialization.java fails in Windows debug
    build
    + JDK-8269594: assert(_handle_mark_nesting &gt; 1) failed: memory
    leak: allocating handle outside HandleMark
    + JDK-8269614: [s390] Interpreter checks wrong bit for slow
    path instance allocation
    + JDK-8269650: Optimize gc-locker in
    [Get|Release]StringCritical for latin string
    + JDK-8269661: JNI_GetStringCritical does not lock char array
    + JDK-8269668: [aarch64] java.library.path not including
    /usr/lib64
    + JDK-8269763: The JEditorPane is blank after JDK-8265167
    + JDK-8269795: C2: Out of bounds array load floats above its
    range check in loop peeling resulting in SEGV
    + JDK-8269847: JDK-8269594 backport breaks 11u builds
    + JDK-8269850: Most JDK releases report macOS version 12 as
    10.16 instead of 12.0
    + JDK-8269851: OperatingSystemMXBean getProcessCpuLoad reports
    incorrect process cpu usage in containers
    + JDK-8269882: stack-use-after-scope in NewObjectA
    + JDK-8269934: RunThese24H.java failed with
    EXCEPTION_ACCESS_VIOLATION in
    java_lang_Thread::get_thread_status
    + JDK-8270096: Shenandoah: Optimize gc/shenandoah/
    /TestRefprocSanity.java for interpreter mode
    + JDK-8270137: Kerberos Credential Retrieval from Cache not
    Working in Cross-Realm Setup
    + JDK-8270184: [TESTBUG] Add coverage for jvmci
    ResolvedJavaType.toJavaName() for lambdas
    + JDK-8270196: [11u] [JVMCI] JavaType.toJavaName() returns
    incorrect type name for lambdas
    + JDK-8270556: Exclude security/infra/java/security/cert/
    /CertPathValidator/certification/LetsEncryptCA
    + JDK-8270893: IndexOutOfBoundsException while reading large
    TIFF file
    + JDK-8272078: Wrong Checksums in Temurin BootJDK dependencies
    + JDK-8272124: Cgroup v1 initialization causes
    NullPointerException when cgroup path contains colon
    + JDK-8272131: PhaseMacroExpand::generate_slow_arraycopy crash
    when clone null CallProjections.fallthrough_ioproj
    + JDK-8272197: Update 11u GHA workflow with Shenandoah
    configurations
    + JDK-8272332: --with-harfbuzz=system doesn't add -lharfbuzz
    after JDK-8255790
    + JDK-8272472: StackGuardPages test doesn't build with glibc
    2.34
    + JDK-8272602: [macos] not all KEY_PRESSED events sent when
    control modifier is used
    + JDK-8272628: Problemlist gc/stress/gcbasher/
    /TestGCBasherWithCMS.java for x86_32
    + JDK-8272700: [macos] Build failure with Xcode 13.0 after
    JDK-8264848
    + JDK-8272772: Shenandoah: compiler/c2/aarch64/
    /TestVolatilesShenandoah.java fails in 11u
    + JDK-8273939: Backport of 8248414 to JDK11 breaks
    MacroAssembler::adrp
- Remove the unneeded icedtea-sound provider
- Removed patches:
  * icedtea-sound-1.0.1-jdk9.patch
  * icedtea-sound-soundproperties.patch
    + not needed since the icedtea-sound provider is removed
  * jdk11-glibc234.patch
    + integrated upstream</changelog>
  <changelog author="fstrba@suse.com" date="1635940800">- Modified patches:
  * system-crypto-policy.patch
    + rediff to changed context
  * fips.patch
    + Allow plain key import in fips mode unless
    com.suse.fips.plainKeySupport is set to false</changelog>
  <changelog author="fstrba@suse.com" date="1636113600">- Modified patch:
  * fips.patch
    + return in native code after generating java.io.IOException</changelog>
</package>
<package pkgid="b283a735d19050167e48b14125dd043dc8cfaaf6f54e9ac6812456f3c74c4378" name="json-c" arch="src">
  <version epoch="0" ver="0.13" rel="3.3.1"/>
  <changelog author="chris@computersalat.de" date="1288872000">- initial pkg 0.9</changelog>
  <changelog author="coolo@novell.com" date="1314619200">- add baselibs.conf for pulseaudio to use
- use original sources</changelog>
  <changelog author="coolo@suse.com" date="1321185600">- add libtool as explicit buildrequire to avoid implicit dependency from prjconf</changelog>
  <changelog author="jengelh@medozas.de" date="1321185601">- Remove redundant/unwanted tags/section (cf. specfile guidelines)</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1335096000">- Fix LFS support in x86.
- Do not build with -Werror
- Remove "la" files
- tune up autotools scripts as well ensure config.h is included
  everywhere</changelog>
  <changelog author="bruno@ioda-net.ch" date="1362657600">- Update to 0.10 version :
  * Add a json_object_to_json_string_ext() function to allow output
  to be formatted in a more human readable form.
  * Add json_object_object_get_ex(), a NULL-safe get object method,
  to be able to distinguish between a key not present and the value
  being NULL.
  * Add an alternative iterator implementation, see json_object_iterator.h
  * Make json_object_iter public to enable external use of the
    json_object_object_foreachC macro.
  * Add a printbuf_memset() function to provide an effecient way to set and
    append things like whitespace indentation.
  * Adjust json_object_is_type and json_object_get_type so they return
    json_type_null for NULL objects and handle NULL passed to
    json_objct_object_get().
  * Rename boolean type to json_bool.
  * Fix various compile issues for Visual Studio and MinGW.
  * Allow json_tokener_parse_ex() to be re-used to parse multiple object.
    Also, fix some parsing issues with capitalized hexadecimal numbers and
    number in E notation.
  * Add json_tokener_get_error() and json_tokener_error_desc() to better
    encapsulate the process of retrieving errors while parsing.
  * Various improvements to the documentation of many functions.
  * Add new json_object_array_sort() function.
  * Fix a bug in json_object_get_int(), which would incorrectly return 0
    when called on a string type object.
    Eric Haszlakiewicz
  * Add a json_type_to_name() function.
    Eric Haszlakiewicz
  * Add a json_tokener_parse_verbose() function.
    Jehiah Czebotar
  * Improve support for null bytes within JSON strings.
    Jehiah Czebotar
  * Fix file descriptor leak if memory allocation fails in json_util
    Zachary Blair, zack_blair at hotmail dot com
  * Add int64 support. Two new functions json_object_net_int64 and
    json_object_get_int64. Binary compatibility preserved.
    Eric Haszlakiewicz, EHASZLA at transunion com
    Rui Miguel Silva Seabra, rms at 1407 dot org
  * Fix subtle bug in linkhash where lookup could hang after all slots
    were filled then successively freed.
    Spotted by Jean-Marc Naud, j dash m at newtraxtech dot com
  * Make json_object_from_file take const char *filename
    Spotted by Vikram Raj V, vsagar at attinteractive dot com
  * Add handling of surrogate pairs (json_tokener.c, test4.c, Makefile.am)
    Brent Miller, bdmiller at yahoo dash inc dot com
  * Correction to comment describing printbuf_memappend in printbuf.h
    Brent Miller, bdmiller at yahoo dash inc dot com
- Packaging :
  * upgrade upstream location https://gitub.com/json-c/json-c/wiki
  * cleanup old patches included now upstream
  . json-c-0.9-linkhash.patch
  . json-c-0.9-json_tokener.patch
  . json-c-0.9-json_object_from_file.patch
  . json-c-0.9-base.patch
  * Redone lfs patch against new 0.10 release
  * Removed empty NEWS file</changelog>
  <changelog author="coolo@suse.com" date="1362916800">- add json-c-fix-headers.patch from master branch to fix compilation
  of apps using the lib</changelog>
  <changelog author="fstrba@suse.com" date="1389009600">- Upgrade to 0.11 version:
  - SONAME change.
  - Fix provides and obsoletes accordingly
  - symlink the .pc file to the oldname for software that needs it
- Remove json-c-fix-headers.patch integrated upstream</changelog>
  <changelog author="jengelh@inai.de" date="1391515200">- Update metadata (description, RPM groups), and remove .la file
  in %install, not %check.</changelog>
  <changelog author="idonmez@suse.com" date="1396872000">- Add json-c-hash-dos-and-overflow-random-seed-4e.patch to fix
  CVE-2013-6370 and CVE-2013-6371 (bnc#870147)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1411214400">- json-c 0.12
  Fixes for security issues contained in this release have been
  previously patched into this package, but listed for completeness:
  * Address security issues:
  * CVE-2013-6371: hash collision denial of service
  * CVE-2013-6370: buffer overflow if size_t is larger than int
- Further changes:
  * Avoid potential overflow in json_object_get_double
  * Eliminate the mc_abort() function and MC_ABORT macro.
  * Make the json_tokener_errors array local.  It has been deprecated for
    a while, and json_tokener_error_desc() should be used instead.
  * change the floating point output format to %.17g so values with
    more than 6 digits show up in the output.
  * Remove the old libjson.so name compatibility support.  The library is
    only created as libjson-c.so now and headers are only installed
    into the ${prefix}/json-c directory.
  * When supported by the linker, add the -Bsymbolic-functions flag.
  * Make strict mode more strict:
  * number must not start with 0
  * no single-quote strings
  * no comments
  * trailing char not allowed
  * only allow lowercase literals
  * Added a json_object_new_double_s() convenience function to allow
    an exact string representation of a double to be specified when
    creating the object and use it in json_tokener_parse_ex() so
    a re-serialized object more exactly matches the input.
  * Add support NaN and Infinity
- packaging changes:
  * json-c-hash-dos-and-overflow-random-seed-4e.patch is upstream
  * Move from json-c-lfs.patch which removed warning errors and
    autoconf call to json-c-0.12-unused_variable_size.patch from
    upstream which fixes the warning
  * except for SLE 11 where autoreconf call is required
  * add licence file to main package</changelog>
  <changelog author="rpm@fthiessen.de" date="1468843200">- Update to upstream release 0.12.1
- Removed upstream fixed json-c-0.12-unused_variable_size.patch
- Added fix-set-but-not-used.patch</changelog>
  <changelog author="mliska@suse.cz" date="1490270400">- Added gcc7-fix.patch</changelog>
  <changelog author="avindra@opensuse.org" date="1514462400">- json-c 0.13
  + Deprecated and removed features:
  * Internal use of bits.h has been eliminated.
  * lh_abort() is deprecated
  + Behavior changes:
  * Tighten the number parsing algorithm to raise errors instead
    of truncating the results.  For example 12.3.4 or 2015-01-15,
    which now return null.
  * Use size_t for array length and size. Platforms where
    sizeof(size_t) != sizeof(int) may not be backwards compatible
  * Check for failue when allocating memory, returning NULL and
    errno=ENOMEM.
  * Change json_object_object_add() return type from void to int,
    and will return -1 on failures, instead of exiting. (Note:
    this is not an ABI change)
  + New features:
  * Aiming to follow RFC 7159 now.
  * Support for JSON pointer, RFC 6901 (see json_pointer.h)
  * Add a couple of additional option to json_object_to_json_string_ext:
  JSON_C_TO_STRING_PRETTY_TAB
  JSON_C_TO_STRING_NOSLASHESCAPE
  * json_object_object_add_ex() - better perf when certain
    constraints are known to be true
  * Serialization format of doubles now configurable
  * New functions
  - json_object_equal() - utility function for comparing
    json_objects
  - json_object_deep_copy() - a way to copy entire object
    trees
  - json_object_set_&lt;type&gt;() - modify the value of
    existing json_object's without the need to recreate them.
  Also add a json_object_int_inc function to adjust an int's'
  value.
  - json_util_get_last_err() - retrieve the string describing
    the cause of errors, instead of printing to stderr.
  - perllike hash function for strings
  * json_global_set_string_hash()
  * json_c_visit() - a way to iterate over a tree of json-c
    objects.
  + Notable bug fixes and other improvements:
  * Make reference increment and decrement atomic to allow
    passing json objects between threads.
  * Fix json_object_object_foreach to avoid uninitialized
    variable warnings.
  * Improve performance by removing unneeded data items from
    hashtable code and reducing duplicate hash computation.
  * Performance: store small strings inside json_object
  * Performance: of json_object_to_json_string by removing
    variadic printf
  * Fix parsing of "-Infinity", and avoid needlessly copying the
    input when doing so.
  * Fix stack buffer overflow in json_object_double_to_json_string_format()
  * Fix various potential null ptr deref and int32 overflows
  * Fix a long-standing bug in array_list_put_idx() where it
    would attempt to free previously free'd entries due to not
    checking the current array length.
  * use uselocale() instead of setlocale() in json_tokener to
    behave better in threaded environments.
  * Fix out of bounds read when handling unicode surrogate pairs.
  * Ensure doubles that happen to be a whole number are emitted
    with ".0"
  * Visual Studio: use a snprintf/vsnprintf wrapper that ensures
    the string is terminated.
  * Fix double to int cast overflow in json_object_get_int64.
  * Clamp double to int32 when narrowing in json_object_get_int.
  * Use strtoll() to parse ints - instead of sscanf
  * usual code linting
  + Build changes:
  * Add Appveyor and Travis build support
  * Support for MacOS and Windows through CMake
  * Silent build by default
  * Link against libm when needed
  * Add support for building with AddressSanitizer
  * Add support for building with Clang
  * Add a --enable-threading configure option, and only use the
    (slower) __sync_add_and_fetch()/__sync_sub_and_fetch()
    function when it is specified.
- cleanup with spec-cleaner
- remove fix-set-but-not-used.patch
  + fixed: https://github.com/json-c/json-c/issues/240
- remove gcc7-fix.patch
  + fixed in 014924ba899f659917bb64392bbff7d3c803afc2</changelog>
  <changelog author="ncutler@suse.com" date="1642161600">- Add patch bsc1171479.patch
  + fix integer overflow and out-of-bounds write (CVE-2020-12762, bsc#1171479)</changelog>
</package>
<package pkgid="545c6ecf3294c609c1845b28d7e80add83244ce748f7fac890281717fa9c4d31" name="kernel-debug" arch="src">
  <version epoch="0" ver="4.12.14" rel="197.105.1"/>
  <changelog author="jack@suse.cz" date="1643112000">- fget: clarify and improve __fget_files() implementation
  (bsc#1193727).
- commit 3ce5a50</changelog>
  <changelog author="ohering@suse.de" date="1643198400">- net, xdp: Introduce xdp_prepare_buff utility routine
  (bsc#1193506).
- net, xdp: Introduce xdp_init_buff utility routine (bsc#1193506).
- commit 69356ad</changelog>
  <changelog author="ohering@suse.de" date="1643198401">- hv_netvsc: Set needed_headroom according to VF (bsc#1193506).
- commit e6c57eb</changelog>
  <changelog author="ohering@suse.de" date="1643198402">- net: mana: Use kcalloc() instead of kzalloc() (bsc#1193506).
- commit 2e3aed9</changelog>
  <changelog author="ohering@suse.de" date="1643198403">- net: mana: Allow setting the number of queues while the NIC
  is down (bsc#1193506).
- commit ed46d20</changelog>
  <changelog author="ohering@suse.de" date="1643198404">- net: mana: Fix the netdev_err()'s vPort argument in
  mana_init_port() (bsc#1193506).
- commit 4301039</changelog>
  <changelog author="ohering@suse.de" date="1643198405">- net: mana: Improve the HWC error handling (bsc#1193506).
- commit be607da</changelog>
  <changelog author="ohering@suse.de" date="1643198406">- net: mana: Support hibernation and kexec (bsc#1193506).
- commit c664fb6</changelog>
  <changelog author="ohering@suse.de" date="1643198407">- net: mana: Fix spelling mistake "calledd" -&gt; "called"
  (bsc#1193506).
- commit 781000a</changelog>
  <changelog author="ohering@suse.de" date="1643198408">- net: mana: Add XDP support (bsc#1193506).
- commit c395dbf</changelog>
  <changelog author="ohering@suse.de" date="1643198409">- net: mana: Add RX fencing (bsc#1193506).
- commit 4af8516</changelog>
  <changelog author="oneukum@suse.com" date="1643198410">- usb: gadget: configfs: Fix use-after-free issue with udc_name
  (bsc#1193861 CVE-2021-39648).
- commit 9ec119b</changelog>
  <changelog author="oneukum@suse.com" date="1643284800">- scsi: ufs: Correct the LUN used in eh_device_reset_handler()
  callback (bsc#1193864 CVE-2021-39657).
- commit 39c5f8e</changelog>
  <changelog author="tonyj@suse.de" date="1643284801">- bpf: Verifer, adjust_scalar_min_max_vals to always call
  update_reg_bounds() (bsc#1194227).
- commit c098fc7</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1643284802">- Update
  patches.suse/IPv6-reply-ICMP-error-if-the-first-fragment-don-t-in.patch
  (bsc#1191241 bsc#1195166).
- Update
  patches.suse/net-ipv6-discard-next-hop-mtu-less-than-minimum-link.patch
  (bsc#1191241 bsc#1195166).
- commit 1d741e6</changelog>
  <changelog author="jbohac@suse.cz" date="1643371200">- xfrm: fix MTU regression (bsc#1185377, bsc#1194048).
- Delete
  patches.suse/xfrm-xfrm_state_mtu-should-return-at-least-1280-for-.patch.
  which caused a regression (bsc#1194048).
- Replace with an alternative fix for bsc#1185377
- commit 3800186</changelog>
  <changelog author="jbohac@suse.cz" date="1643371201">- phonet: refcount leak in pep_sock_accep (bsc#1193867,
  CVE-2021-45095).
- commit 413134f</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1643630400">- net: tipc: validate domain record count on input (bsc#1195254).
- commit eaeeffc</changelog>
  <changelog author="tiwai@suse.de" date="1643630401">- Bluetooth: fix the erroneous flush_work() order (git-fixes).
- commit 9b1f0b0</changelog>
  <changelog author="tiwai@suse.de" date="1643630402">- Update patch reference for BT fix (CVE-2021-3564 bsc#1186207)
- commit ea7857c</changelog>
</package>
<package pkgid="980a18e4697865723abf56d07973d99c986bfe8c0ce2780791b05ca6adfdbabc" name="kernel-debug-base" arch="ppc64le">
  <version epoch="0" ver="4.12.14" rel="197.105.1"/>
  <changelog author="jack@suse.cz" date="1643112000">- fget: clarify and improve __fget_files() implementation
  (bsc#1193727).
- commit 3ce5a50</changelog>
  <changelog author="ohering@suse.de" date="1643198400">- net, xdp: Introduce xdp_prepare_buff utility routine
  (bsc#1193506).
- net, xdp: Introduce xdp_init_buff utility routine (bsc#1193506).
- commit 69356ad</changelog>
  <changelog author="ohering@suse.de" date="1643198401">- hv_netvsc: Set needed_headroom according to VF (bsc#1193506).
- commit e6c57eb</changelog>
  <changelog author="ohering@suse.de" date="1643198402">- net: mana: Use kcalloc() instead of kzalloc() (bsc#1193506).
- commit 2e3aed9</changelog>
  <changelog author="ohering@suse.de" date="1643198403">- net: mana: Allow setting the number of queues while the NIC
  is down (bsc#1193506).
- commit ed46d20</changelog>
  <changelog author="ohering@suse.de" date="1643198404">- net: mana: Fix the netdev_err()'s vPort argument in
  mana_init_port() (bsc#1193506).
- commit 4301039</changelog>
  <changelog author="ohering@suse.de" date="1643198405">- net: mana: Improve the HWC error handling (bsc#1193506).
- commit be607da</changelog>
  <changelog author="ohering@suse.de" date="1643198406">- net: mana: Support hibernation and kexec (bsc#1193506).
- commit c664fb6</changelog>
  <changelog author="ohering@suse.de" date="1643198407">- net: mana: Fix spelling mistake "calledd" -&gt; "called"
  (bsc#1193506).
- commit 781000a</changelog>
  <changelog author="ohering@suse.de" date="1643198408">- net: mana: Add XDP support (bsc#1193506).
- commit c395dbf</changelog>
  <changelog author="ohering@suse.de" date="1643198409">- net: mana: Add RX fencing (bsc#1193506).
- commit 4af8516</changelog>
  <changelog author="oneukum@suse.com" date="1643198410">- usb: gadget: configfs: Fix use-after-free issue with udc_name
  (bsc#1193861 CVE-2021-39648).
- commit 9ec119b</changelog>
  <changelog author="oneukum@suse.com" date="1643284800">- scsi: ufs: Correct the LUN used in eh_device_reset_handler()
  callback (bsc#1193864 CVE-2021-39657).
- commit 39c5f8e</changelog>
  <changelog author="tonyj@suse.de" date="1643284801">- bpf: Verifer, adjust_scalar_min_max_vals to always call
  update_reg_bounds() (bsc#1194227).
- commit c098fc7</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1643284802">- Update
  patches.suse/IPv6-reply-ICMP-error-if-the-first-fragment-don-t-in.patch
  (bsc#1191241 bsc#1195166).
- Update
  patches.suse/net-ipv6-discard-next-hop-mtu-less-than-minimum-link.patch
  (bsc#1191241 bsc#1195166).
- commit 1d741e6</changelog>
  <changelog author="jbohac@suse.cz" date="1643371200">- xfrm: fix MTU regression (bsc#1185377, bsc#1194048).
- Delete
  patches.suse/xfrm-xfrm_state_mtu-should-return-at-least-1280-for-.patch.
  which caused a regression (bsc#1194048).
- Replace with an alternative fix for bsc#1185377
- commit 3800186</changelog>
  <changelog author="jbohac@suse.cz" date="1643371201">- phonet: refcount leak in pep_sock_accep (bsc#1193867,
  CVE-2021-45095).
- commit 413134f</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1643630400">- net: tipc: validate domain record count on input (bsc#1195254).
- commit eaeeffc</changelog>
  <changelog author="tiwai@suse.de" date="1643630401">- Bluetooth: fix the erroneous flush_work() order (git-fixes).
- commit 9b1f0b0</changelog>
  <changelog author="tiwai@suse.de" date="1643630402">- Update patch reference for BT fix (CVE-2021-3564 bsc#1186207)
- commit ea7857c</changelog>
</package>
<package pkgid="9aad483e01f3a9b6671d9f94f7c4988bb9e45877efc3c7ec7880f1ecd4a0fd61" name="kernel-debug-base" arch="x86_64">
  <version epoch="0" ver="4.12.14" rel="197.105.1"/>
  <changelog author="jack@suse.cz" date="1643112000">- fget: clarify and improve __fget_files() implementation
  (bsc#1193727).
- commit 3ce5a50</changelog>
  <changelog author="ohering@suse.de" date="1643198400">- net, xdp: Introduce xdp_prepare_buff utility routine
  (bsc#1193506).
- net, xdp: Introduce xdp_init_buff utility routine (bsc#1193506).
- commit 69356ad</changelog>
  <changelog author="ohering@suse.de" date="1643198401">- hv_netvsc: Set needed_headroom according to VF (bsc#1193506).
- commit e6c57eb</changelog>
  <changelog author="ohering@suse.de" date="1643198402">- net: mana: Use kcalloc() instead of kzalloc() (bsc#1193506).
- commit 2e3aed9</changelog>
  <changelog author="ohering@suse.de" date="1643198403">- net: mana: Allow setting the number of queues while the NIC
  is down (bsc#1193506).
- commit ed46d20</changelog>
  <changelog author="ohering@suse.de" date="1643198404">- net: mana: Fix the netdev_err()'s vPort argument in
  mana_init_port() (bsc#1193506).
- commit 4301039</changelog>
  <changelog author="ohering@suse.de" date="1643198405">- net: mana: Improve the HWC error handling (bsc#1193506).
- commit be607da</changelog>
  <changelog author="ohering@suse.de" date="1643198406">- net: mana: Support hibernation and kexec (bsc#1193506).
- commit c664fb6</changelog>
  <changelog author="ohering@suse.de" date="1643198407">- net: mana: Fix spelling mistake "calledd" -&gt; "called"
  (bsc#1193506).
- commit 781000a</changelog>
  <changelog author="ohering@suse.de" date="1643198408">- net: mana: Add XDP support (bsc#1193506).
- commit c395dbf</changelog>
  <changelog author="ohering@suse.de" date="1643198409">- net: mana: Add RX fencing (bsc#1193506).
- commit 4af8516</changelog>
  <changelog author="oneukum@suse.com" date="1643198410">- usb: gadget: configfs: Fix use-after-free issue with udc_name
  (bsc#1193861 CVE-2021-39648).
- commit 9ec119b</changelog>
  <changelog author="oneukum@suse.com" date="1643284800">- scsi: ufs: Correct the LUN used in eh_device_reset_handler()
  callback (bsc#1193864 CVE-2021-39657).
- commit 39c5f8e</changelog>
  <changelog author="tonyj@suse.de" date="1643284801">- bpf: Verifer, adjust_scalar_min_max_vals to always call
  update_reg_bounds() (bsc#1194227).
- commit c098fc7</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1643284802">- Update
  patches.suse/IPv6-reply-ICMP-error-if-the-first-fragment-don-t-in.patch
  (bsc#1191241 bsc#1195166).
- Update
  patches.suse/net-ipv6-discard-next-hop-mtu-less-than-minimum-link.patch
  (bsc#1191241 bsc#1195166).
- commit 1d741e6</changelog>
  <changelog author="jbohac@suse.cz" date="1643371200">- xfrm: fix MTU regression (bsc#1185377, bsc#1194048).
- Delete
  patches.suse/xfrm-xfrm_state_mtu-should-return-at-least-1280-for-.patch.
  which caused a regression (bsc#1194048).
- Replace with an alternative fix for bsc#1185377
- commit 3800186</changelog>
  <changelog author="jbohac@suse.cz" date="1643371201">- phonet: refcount leak in pep_sock_accep (bsc#1193867,
  CVE-2021-45095).
- commit 413134f</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1643630400">- net: tipc: validate domain record count on input (bsc#1195254).
- commit eaeeffc</changelog>
  <changelog author="tiwai@suse.de" date="1643630401">- Bluetooth: fix the erroneous flush_work() order (git-fixes).
- commit 9b1f0b0</changelog>
  <changelog author="tiwai@suse.de" date="1643630402">- Update patch reference for BT fix (CVE-2021-3564 bsc#1186207)
- commit ea7857c</changelog>
</package>
<package pkgid="2c8323cb91ac195d6b2164aff03a79767c9fe049c8fe3cfbda47533b8551d27f" name="kernel-default" arch="src">
  <version epoch="0" ver="4.12.14" rel="197.105.1"/>
  <changelog author="jack@suse.cz" date="1643112000">- fget: clarify and improve __fget_files() implementation
  (bsc#1193727).
- commit 3ce5a50</changelog>
  <changelog author="ohering@suse.de" date="1643198400">- net, xdp: Introduce xdp_prepare_buff utility routine
  (bsc#1193506).
- net, xdp: Introduce xdp_init_buff utility routine (bsc#1193506).
- commit 69356ad</changelog>
  <changelog author="ohering@suse.de" date="1643198401">- hv_netvsc: Set needed_headroom according to VF (bsc#1193506).
- commit e6c57eb</changelog>
  <changelog author="ohering@suse.de" date="1643198402">- net: mana: Use kcalloc() instead of kzalloc() (bsc#1193506).
- commit 2e3aed9</changelog>
  <changelog author="ohering@suse.de" date="1643198403">- net: mana: Allow setting the number of queues while the NIC
  is down (bsc#1193506).
- commit ed46d20</changelog>
  <changelog author="ohering@suse.de" date="1643198404">- net: mana: Fix the netdev_err()'s vPort argument in
  mana_init_port() (bsc#1193506).
- commit 4301039</changelog>
  <changelog author="ohering@suse.de" date="1643198405">- net: mana: Improve the HWC error handling (bsc#1193506).
- commit be607da</changelog>
  <changelog author="ohering@suse.de" date="1643198406">- net: mana: Support hibernation and kexec (bsc#1193506).
- commit c664fb6</changelog>
  <changelog author="ohering@suse.de" date="1643198407">- net: mana: Fix spelling mistake "calledd" -&gt; "called"
  (bsc#1193506).
- commit 781000a</changelog>
  <changelog author="ohering@suse.de" date="1643198408">- net: mana: Add XDP support (bsc#1193506).
- commit c395dbf</changelog>
  <changelog author="ohering@suse.de" date="1643198409">- net: mana: Add RX fencing (bsc#1193506).
- commit 4af8516</changelog>
  <changelog author="oneukum@suse.com" date="1643198410">- usb: gadget: configfs: Fix use-after-free issue with udc_name
  (bsc#1193861 CVE-2021-39648).
- commit 9ec119b</changelog>
  <changelog author="oneukum@suse.com" date="1643284800">- scsi: ufs: Correct the LUN used in eh_device_reset_handler()
  callback (bsc#1193864 CVE-2021-39657).
- commit 39c5f8e</changelog>
  <changelog author="tonyj@suse.de" date="1643284801">- bpf: Verifer, adjust_scalar_min_max_vals to always call
  update_reg_bounds() (bsc#1194227).
- commit c098fc7</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1643284802">- Update
  patches.suse/IPv6-reply-ICMP-error-if-the-first-fragment-don-t-in.patch
  (bsc#1191241 bsc#1195166).
- Update
  patches.suse/net-ipv6-discard-next-hop-mtu-less-than-minimum-link.patch
  (bsc#1191241 bsc#1195166).
- commit 1d741e6</changelog>
  <changelog author="jbohac@suse.cz" date="1643371200">- xfrm: fix MTU regression (bsc#1185377, bsc#1194048).
- Delete
  patches.suse/xfrm-xfrm_state_mtu-should-return-at-least-1280-for-.patch.
  which caused a regression (bsc#1194048).
- Replace with an alternative fix for bsc#1185377
- commit 3800186</changelog>
  <changelog author="jbohac@suse.cz" date="1643371201">- phonet: refcount leak in pep_sock_accep (bsc#1193867,
  CVE-2021-45095).
- commit 413134f</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1643630400">- net: tipc: validate domain record count on input (bsc#1195254).
- commit eaeeffc</changelog>
  <changelog author="tiwai@suse.de" date="1643630401">- Bluetooth: fix the erroneous flush_work() order (git-fixes).
- commit 9b1f0b0</changelog>
  <changelog author="tiwai@suse.de" date="1643630402">- Update patch reference for BT fix (CVE-2021-3564 bsc#1186207)
- commit ea7857c</changelog>
</package>
<package pkgid="3cc08af276915e88ccec6ac667ddc85c9b8d9e92c19226f2b44a6e6ab7a9d77e" name="kernel-default-man" arch="s390x">
  <version epoch="0" ver="4.12.14" rel="197.105.1"/>
  <changelog author="jack@suse.cz" date="1643112000">- fget: clarify and improve __fget_files() implementation
  (bsc#1193727).
- commit 3ce5a50</changelog>
  <changelog author="ohering@suse.de" date="1643198400">- net, xdp: Introduce xdp_prepare_buff utility routine
  (bsc#1193506).
- net, xdp: Introduce xdp_init_buff utility routine (bsc#1193506).
- commit 69356ad</changelog>
  <changelog author="ohering@suse.de" date="1643198401">- hv_netvsc: Set needed_headroom according to VF (bsc#1193506).
- commit e6c57eb</changelog>
  <changelog author="ohering@suse.de" date="1643198402">- net: mana: Use kcalloc() instead of kzalloc() (bsc#1193506).
- commit 2e3aed9</changelog>
  <changelog author="ohering@suse.de" date="1643198403">- net: mana: Allow setting the number of queues while the NIC
  is down (bsc#1193506).
- commit ed46d20</changelog>
  <changelog author="ohering@suse.de" date="1643198404">- net: mana: Fix the netdev_err()'s vPort argument in
  mana_init_port() (bsc#1193506).
- commit 4301039</changelog>
  <changelog author="ohering@suse.de" date="1643198405">- net: mana: Improve the HWC error handling (bsc#1193506).
- commit be607da</changelog>
  <changelog author="ohering@suse.de" date="1643198406">- net: mana: Support hibernation and kexec (bsc#1193506).
- commit c664fb6</changelog>
  <changelog author="ohering@suse.de" date="1643198407">- net: mana: Fix spelling mistake "calledd" -&gt; "called"
  (bsc#1193506).
- commit 781000a</changelog>
  <changelog author="ohering@suse.de" date="1643198408">- net: mana: Add XDP support (bsc#1193506).
- commit c395dbf</changelog>
  <changelog author="ohering@suse.de" date="1643198409">- net: mana: Add RX fencing (bsc#1193506).
- commit 4af8516</changelog>
  <changelog author="oneukum@suse.com" date="1643198410">- usb: gadget: configfs: Fix use-after-free issue with udc_name
  (bsc#1193861 CVE-2021-39648).
- commit 9ec119b</changelog>
  <changelog author="oneukum@suse.com" date="1643284800">- scsi: ufs: Correct the LUN used in eh_device_reset_handler()
  callback (bsc#1193864 CVE-2021-39657).
- commit 39c5f8e</changelog>
  <changelog author="tonyj@suse.de" date="1643284801">- bpf: Verifer, adjust_scalar_min_max_vals to always call
  update_reg_bounds() (bsc#1194227).
- commit c098fc7</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1643284802">- Update
  patches.suse/IPv6-reply-ICMP-error-if-the-first-fragment-don-t-in.patch
  (bsc#1191241 bsc#1195166).
- Update
  patches.suse/net-ipv6-discard-next-hop-mtu-less-than-minimum-link.patch
  (bsc#1191241 bsc#1195166).
- commit 1d741e6</changelog>
  <changelog author="jbohac@suse.cz" date="1643371200">- xfrm: fix MTU regression (bsc#1185377, bsc#1194048).
- Delete
  patches.suse/xfrm-xfrm_state_mtu-should-return-at-least-1280-for-.patch.
  which caused a regression (bsc#1194048).
- Replace with an alternative fix for bsc#1185377
- commit 3800186</changelog>
  <changelog author="jbohac@suse.cz" date="1643371201">- phonet: refcount leak in pep_sock_accep (bsc#1193867,
  CVE-2021-45095).
- commit 413134f</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1643630400">- net: tipc: validate domain record count on input (bsc#1195254).
- commit eaeeffc</changelog>
  <changelog author="tiwai@suse.de" date="1643630401">- Bluetooth: fix the erroneous flush_work() order (git-fixes).
- commit 9b1f0b0</changelog>
  <changelog author="tiwai@suse.de" date="1643630402">- Update patch reference for BT fix (CVE-2021-3564 bsc#1186207)
- commit ea7857c</changelog>
</package>
<package pkgid="15d4bb04a62dfa8d632c5fbbf447b00fda5cc9873891f24d3a24add7b5d7c3f1" name="kernel-kvmsmall" arch="src">
  <version epoch="0" ver="4.12.14" rel="197.105.1"/>
  <changelog author="jack@suse.cz" date="1643112000">- fget: clarify and improve __fget_files() implementation
  (bsc#1193727).
- commit 3ce5a50</changelog>
  <changelog author="ohering@suse.de" date="1643198400">- net, xdp: Introduce xdp_prepare_buff utility routine
  (bsc#1193506).
- net, xdp: Introduce xdp_init_buff utility routine (bsc#1193506).
- commit 69356ad</changelog>
  <changelog author="ohering@suse.de" date="1643198401">- hv_netvsc: Set needed_headroom according to VF (bsc#1193506).
- commit e6c57eb</changelog>
  <changelog author="ohering@suse.de" date="1643198402">- net: mana: Use kcalloc() instead of kzalloc() (bsc#1193506).
- commit 2e3aed9</changelog>
  <changelog author="ohering@suse.de" date="1643198403">- net: mana: Allow setting the number of queues while the NIC
  is down (bsc#1193506).
- commit ed46d20</changelog>
  <changelog author="ohering@suse.de" date="1643198404">- net: mana: Fix the netdev_err()'s vPort argument in
  mana_init_port() (bsc#1193506).
- commit 4301039</changelog>
  <changelog author="ohering@suse.de" date="1643198405">- net: mana: Improve the HWC error handling (bsc#1193506).
- commit be607da</changelog>
  <changelog author="ohering@suse.de" date="1643198406">- net: mana: Support hibernation and kexec (bsc#1193506).
- commit c664fb6</changelog>
  <changelog author="ohering@suse.de" date="1643198407">- net: mana: Fix spelling mistake "calledd" -&gt; "called"
  (bsc#1193506).
- commit 781000a</changelog>
  <changelog author="ohering@suse.de" date="1643198408">- net: mana: Add XDP support (bsc#1193506).
- commit c395dbf</changelog>
  <changelog author="ohering@suse.de" date="1643198409">- net: mana: Add RX fencing (bsc#1193506).
- commit 4af8516</changelog>
  <changelog author="oneukum@suse.com" date="1643198410">- usb: gadget: configfs: Fix use-after-free issue with udc_name
  (bsc#1193861 CVE-2021-39648).
- commit 9ec119b</changelog>
  <changelog author="oneukum@suse.com" date="1643284800">- scsi: ufs: Correct the LUN used in eh_device_reset_handler()
  callback (bsc#1193864 CVE-2021-39657).
- commit 39c5f8e</changelog>
  <changelog author="tonyj@suse.de" date="1643284801">- bpf: Verifer, adjust_scalar_min_max_vals to always call
  update_reg_bounds() (bsc#1194227).
- commit c098fc7</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1643284802">- Update
  patches.suse/IPv6-reply-ICMP-error-if-the-first-fragment-don-t-in.patch
  (bsc#1191241 bsc#1195166).
- Update
  patches.suse/net-ipv6-discard-next-hop-mtu-less-than-minimum-link.patch
  (bsc#1191241 bsc#1195166).
- commit 1d741e6</changelog>
  <changelog author="jbohac@suse.cz" date="1643371200">- xfrm: fix MTU regression (bsc#1185377, bsc#1194048).
- Delete
  patches.suse/xfrm-xfrm_state_mtu-should-return-at-least-1280-for-.patch.
  which caused a regression (bsc#1194048).
- Replace with an alternative fix for bsc#1185377
- commit 3800186</changelog>
  <changelog author="jbohac@suse.cz" date="1643371201">- phonet: refcount leak in pep_sock_accep (bsc#1193867,
  CVE-2021-45095).
- commit 413134f</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1643630400">- net: tipc: validate domain record count on input (bsc#1195254).
- commit eaeeffc</changelog>
  <changelog author="tiwai@suse.de" date="1643630401">- Bluetooth: fix the erroneous flush_work() order (git-fixes).
- commit 9b1f0b0</changelog>
  <changelog author="tiwai@suse.de" date="1643630402">- Update patch reference for BT fix (CVE-2021-3564 bsc#1186207)
- commit ea7857c</changelog>
</package>
<package pkgid="7bf5fce0e55b268aeed869e746297d48b03f2db57e530f8c5dfa1cb1b62e4611" name="kernel-kvmsmall-base" arch="x86_64">
  <version epoch="0" ver="4.12.14" rel="197.105.1"/>
  <changelog author="jack@suse.cz" date="1643112000">- fget: clarify and improve __fget_files() implementation
  (bsc#1193727).
- commit 3ce5a50</changelog>
  <changelog author="ohering@suse.de" date="1643198400">- net, xdp: Introduce xdp_prepare_buff utility routine
  (bsc#1193506).
- net, xdp: Introduce xdp_init_buff utility routine (bsc#1193506).
- commit 69356ad</changelog>
  <changelog author="ohering@suse.de" date="1643198401">- hv_netvsc: Set needed_headroom according to VF (bsc#1193506).
- commit e6c57eb</changelog>
  <changelog author="ohering@suse.de" date="1643198402">- net: mana: Use kcalloc() instead of kzalloc() (bsc#1193506).
- commit 2e3aed9</changelog>
  <changelog author="ohering@suse.de" date="1643198403">- net: mana: Allow setting the number of queues while the NIC
  is down (bsc#1193506).
- commit ed46d20</changelog>
  <changelog author="ohering@suse.de" date="1643198404">- net: mana: Fix the netdev_err()'s vPort argument in
  mana_init_port() (bsc#1193506).
- commit 4301039</changelog>
  <changelog author="ohering@suse.de" date="1643198405">- net: mana: Improve the HWC error handling (bsc#1193506).
- commit be607da</changelog>
  <changelog author="ohering@suse.de" date="1643198406">- net: mana: Support hibernation and kexec (bsc#1193506).
- commit c664fb6</changelog>
  <changelog author="ohering@suse.de" date="1643198407">- net: mana: Fix spelling mistake "calledd" -&gt; "called"
  (bsc#1193506).
- commit 781000a</changelog>
  <changelog author="ohering@suse.de" date="1643198408">- net: mana: Add XDP support (bsc#1193506).
- commit c395dbf</changelog>
  <changelog author="ohering@suse.de" date="1643198409">- net: mana: Add RX fencing (bsc#1193506).
- commit 4af8516</changelog>
  <changelog author="oneukum@suse.com" date="1643198410">- usb: gadget: configfs: Fix use-after-free issue with udc_name
  (bsc#1193861 CVE-2021-39648).
- commit 9ec119b</changelog>
  <changelog author="oneukum@suse.com" date="1643284800">- scsi: ufs: Correct the LUN used in eh_device_reset_handler()
  callback (bsc#1193864 CVE-2021-39657).
- commit 39c5f8e</changelog>
  <changelog author="tonyj@suse.de" date="1643284801">- bpf: Verifer, adjust_scalar_min_max_vals to always call
  update_reg_bounds() (bsc#1194227).
- commit c098fc7</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1643284802">- Update
  patches.suse/IPv6-reply-ICMP-error-if-the-first-fragment-don-t-in.patch
  (bsc#1191241 bsc#1195166).
- Update
  patches.suse/net-ipv6-discard-next-hop-mtu-less-than-minimum-link.patch
  (bsc#1191241 bsc#1195166).
- commit 1d741e6</changelog>
  <changelog author="jbohac@suse.cz" date="1643371200">- xfrm: fix MTU regression (bsc#1185377, bsc#1194048).
- Delete
  patches.suse/xfrm-xfrm_state_mtu-should-return-at-least-1280-for-.patch.
  which caused a regression (bsc#1194048).
- Replace with an alternative fix for bsc#1185377
- commit 3800186</changelog>
  <changelog author="jbohac@suse.cz" date="1643371201">- phonet: refcount leak in pep_sock_accep (bsc#1193867,
  CVE-2021-45095).
- commit 413134f</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1643630400">- net: tipc: validate domain record count on input (bsc#1195254).
- commit eaeeffc</changelog>
  <changelog author="tiwai@suse.de" date="1643630401">- Bluetooth: fix the erroneous flush_work() order (git-fixes).
- commit 9b1f0b0</changelog>
  <changelog author="tiwai@suse.de" date="1643630402">- Update patch reference for BT fix (CVE-2021-3564 bsc#1186207)
- commit ea7857c</changelog>
</package>
<package pkgid="e80e23d7098d7224b0a6441fded05758f2caa43c58f8a1f9f070d3b603f31282" name="kernel-preempt" arch="src">
  <version epoch="0" ver="5.3.18" rel="150300.59.43.1"/>
  <changelog author="tiwai@suse.de" date="1642593600">- Add cherry-picked IDs for qemu fw_cfg patches
- commit 8f947ad</changelog>
  <changelog author="msuchanek@suse.de" date="1642593601">- powerpc/pseries/cpuhp: delete add/remove_by_count code
  (bsc#1065729).
- powerpc/pseries/cpuhp: cache node corrections (bsc#1065729).
- commit 9c04898</changelog>
  <changelog author="tiwai@suse.de" date="1642593602">- dmaengine: at_xdmac: Fix at_xdmac_lld struct definition
  (git-fixes).
- dmaengine: at_xdmac: Fix lld view setting (git-fixes).
- dmaengine: at_xdmac: Fix concurrency over xfers_list
  (git-fixes).
- dmaengine: at_xdmac: Print debug message after realeasing the
  lock (git-fixes).
- dmaengine: at_xdmac: Don't start transactions at tx_submit level
  (git-fixes).
- Documentation: dmaengine: Correctly describe dmatest with
  channel unset (git-fixes).
- rpmsg: core: Clean up resources on announce_create failure
  (git-fixes).
- ACPI: APD: Check for NULL pointer after calling devm_ioremap()
  (git-fixes).
- Input: ti_am335x_tsc - fix STEPCONFIG setup for Z2 (git-fixes).
- Input: ti_am335x_tsc - set ADCREFM for X configuration
  (git-fixes).
- i3c: master: dw: check return of dw_i3c_master_get_free_pos()
  (git-fixes).
- i3c: fix incorrect address slot lookup on 64-bit (git-fixes).
- commit 3d8614c</changelog>
  <changelog author="msuchanek@suse.de" date="1642593603">- powerpc/prom_init: Fix improper check of prom_getprop()
  (bsc#1065729).
- commit 954fa51</changelog>
  <changelog author="msuchanek@suse.de" date="1642593604">- powerpc/perf: Fix PMU callbacks to clear pending PMI before
  resetting an overflown PMC (bsc#1156395).
- commit 8bdce1e</changelog>
  <changelog author="mbenes@suse.cz" date="1642593605">- livepatch: Avoid CPU hogging with cond_resched (bsc#1071995).
- commit 27c7aa0</changelog>
  <changelog author="msuchanek@suse.de" date="1642593606">- blacklist.conf: Add 79ca6f74dae0 tpm: fix Atmel TPM crash caused by too frequent queries
  Breaks kABI, there is no report of this problem affecting users, likely
  broken old TPM firmware.
- commit 4ea9f96</changelog>
  <changelog author="msuchanek@suse.de" date="1642593607">- Update patches.suse/tpm-fix-potential-NULL-pointer-access-in-tpm_del_cha.patch
  (git-fixes bsc#1193660 ltc#195634).
- commit 11ac3f6</changelog>
  <changelog author="lhenriques@suse.de" date="1642680000">- fuse: Pass correct lend value to filemap_write_and_wait_range()
  (bsc#1194953).
- commit d2355ea</changelog>
  <changelog author="msuchanek@suse.de" date="1642680001">- blacklist.conf: Add a2308836880b powerpc: Fix arch_stack_walk() to have
  running function as first entry
  The stacktrace interface in this kernel version does not provide the
  parameters used to implement the fix.
- commit ee041a3</changelog>
  <changelog author="msuchanek@suse.de" date="1642680002">- powerpc/64s: fix program check interrupt emergency stack path
  (bsc#1156395).
- commit a3c26ed</changelog>
  <changelog author="msuchanek@suse.de" date="1642680003">- powerpc/traps: do not enable irqs in _exception (bsc#1065729).
- powerpc: add interrupt_cond_local_irq_enable helper
  (bsc#1065729).
- commit 65f660c</changelog>
  <changelog author="msuchanek@suse.de" date="1642680004">- powerpc/pseries/mobility: ignore ibm, platform-facilities
  updates (bsc#1065729).
- commit b253330</changelog>
  <changelog author="rgoldwyn@suse.com" date="1642680005">- vfs: check fd has read access in kernel_read_file_from_fd() (bsc#1194888).
- commit 4717473</changelog>
  <changelog author="vkarasulli@suse.de" date="1642680006">- moxart: fix potential use-after-free on remove path
  (bsc#1194516).
- commit 3fae095</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1642766400">- sctp: account stream padding length for reconf chunk
  (bsc#1194985 CVE-2022-0322).
- commit a6cab40</changelog>
  <changelog author="ddiss@suse.de" date="1642766401">- vfs: fs_context: fix up param length parsing in
  legacy_parse_param (CVE-2022-0185 bsc#1194517).
- Rename and retag following upstream merge from:
  patches.suse/vfs-Out-of-bounds-write-of-heap-buffer-in-fs_context-c.patch
  to patches.suse/vfs-fs_context-fix-up-param-length-parsing-in-legacy.patch
- commit 33860f2</changelog>
  <changelog author="mkubecek@suse.cz" date="1642766402">- series.conf: cleanup
- move to "mainline soon" section:
  - patches.suse/0001-mmc-moxart_remove-Fix-UAF.patch
- commit 07d55c3</changelog>
  <changelog author="mkubecek@suse.cz" date="1642766403">- series.conf: refresh
- update upstream references and resort:
  - patches.suse/powerpc-fadump-Fix-inaccurate-CPU-state-info-in-vmco.patch
  - patches.suse/powerpc-handle-kdump-appropriately-with-crash_kexec_.patch
  - patches.suse/powerpc-watchdog-Avoid-holding-wd_smp_lock-over-prin.patch
  - patches.suse/powerpc-watchdog-Fix-missed-watchdog-reset-due-to-me.patch
  - patches.suse/powerpc-watchdog-Fix-wd_smp_last_reset_tb-reporting.patch
  - patches.suse/powerpc-watchdog-read-TB-close-to-where-it-is-used.patch
  - patches.suse/powerpc-watchdog-tighten-non-atomic-read-modify-writ.patch
- commit 72b7db7</changelog>
  <changelog author="osalvador@suse.de" date="1642939200">- Rename colliding patches before the next cve/linux-5.3 -&gt; SLE15-SP3 merge
- commit 84178b8</changelog>
</package>
<package pkgid="bdb243dce7a49061c6c94e546f321d0cf62df622caa638c9f1febf981eaf4162" name="kernel-preempt" arch="x86_64">
  <version epoch="0" ver="5.3.18" rel="150300.59.43.1"/>
  <changelog author="tiwai@suse.de" date="1642593600">- Add cherry-picked IDs for qemu fw_cfg patches
- commit 8f947ad</changelog>
  <changelog author="msuchanek@suse.de" date="1642593601">- powerpc/pseries/cpuhp: delete add/remove_by_count code
  (bsc#1065729).
- powerpc/pseries/cpuhp: cache node corrections (bsc#1065729).
- commit 9c04898</changelog>
  <changelog author="tiwai@suse.de" date="1642593602">- dmaengine: at_xdmac: Fix at_xdmac_lld struct definition
  (git-fixes).
- dmaengine: at_xdmac: Fix lld view setting (git-fixes).
- dmaengine: at_xdmac: Fix concurrency over xfers_list
  (git-fixes).
- dmaengine: at_xdmac: Print debug message after realeasing the
  lock (git-fixes).
- dmaengine: at_xdmac: Don't start transactions at tx_submit level
  (git-fixes).
- Documentation: dmaengine: Correctly describe dmatest with
  channel unset (git-fixes).
- rpmsg: core: Clean up resources on announce_create failure
  (git-fixes).
- ACPI: APD: Check for NULL pointer after calling devm_ioremap()
  (git-fixes).
- Input: ti_am335x_tsc - fix STEPCONFIG setup for Z2 (git-fixes).
- Input: ti_am335x_tsc - set ADCREFM for X configuration
  (git-fixes).
- i3c: master: dw: check return of dw_i3c_master_get_free_pos()
  (git-fixes).
- i3c: fix incorrect address slot lookup on 64-bit (git-fixes).
- commit 3d8614c</changelog>
  <changelog author="msuchanek@suse.de" date="1642593603">- powerpc/prom_init: Fix improper check of prom_getprop()
  (bsc#1065729).
- commit 954fa51</changelog>
  <changelog author="msuchanek@suse.de" date="1642593604">- powerpc/perf: Fix PMU callbacks to clear pending PMI before
  resetting an overflown PMC (bsc#1156395).
- commit 8bdce1e</changelog>
  <changelog author="mbenes@suse.cz" date="1642593605">- livepatch: Avoid CPU hogging with cond_resched (bsc#1071995).
- commit 27c7aa0</changelog>
  <changelog author="msuchanek@suse.de" date="1642593606">- blacklist.conf: Add 79ca6f74dae0 tpm: fix Atmel TPM crash caused by too frequent queries
  Breaks kABI, there is no report of this problem affecting users, likely
  broken old TPM firmware.
- commit 4ea9f96</changelog>
  <changelog author="msuchanek@suse.de" date="1642593607">- Update patches.suse/tpm-fix-potential-NULL-pointer-access-in-tpm_del_cha.patch
  (git-fixes bsc#1193660 ltc#195634).
- commit 11ac3f6</changelog>
  <changelog author="lhenriques@suse.de" date="1642680000">- fuse: Pass correct lend value to filemap_write_and_wait_range()
  (bsc#1194953).
- commit d2355ea</changelog>
  <changelog author="msuchanek@suse.de" date="1642680001">- blacklist.conf: Add a2308836880b powerpc: Fix arch_stack_walk() to have
  running function as first entry
  The stacktrace interface in this kernel version does not provide the
  parameters used to implement the fix.
- commit ee041a3</changelog>
  <changelog author="msuchanek@suse.de" date="1642680002">- powerpc/64s: fix program check interrupt emergency stack path
  (bsc#1156395).
- commit a3c26ed</changelog>
  <changelog author="msuchanek@suse.de" date="1642680003">- powerpc/traps: do not enable irqs in _exception (bsc#1065729).
- powerpc: add interrupt_cond_local_irq_enable helper
  (bsc#1065729).
- commit 65f660c</changelog>
  <changelog author="msuchanek@suse.de" date="1642680004">- powerpc/pseries/mobility: ignore ibm, platform-facilities
  updates (bsc#1065729).
- commit b253330</changelog>
  <changelog author="rgoldwyn@suse.com" date="1642680005">- vfs: check fd has read access in kernel_read_file_from_fd() (bsc#1194888).
- commit 4717473</changelog>
  <changelog author="vkarasulli@suse.de" date="1642680006">- moxart: fix potential use-after-free on remove path
  (bsc#1194516).
- commit 3fae095</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1642766400">- sctp: account stream padding length for reconf chunk
  (bsc#1194985 CVE-2022-0322).
- commit a6cab40</changelog>
  <changelog author="ddiss@suse.de" date="1642766401">- vfs: fs_context: fix up param length parsing in
  legacy_parse_param (CVE-2022-0185 bsc#1194517).
- Rename and retag following upstream merge from:
  patches.suse/vfs-Out-of-bounds-write-of-heap-buffer-in-fs_context-c.patch
  to patches.suse/vfs-fs_context-fix-up-param-length-parsing-in-legacy.patch
- commit 33860f2</changelog>
  <changelog author="mkubecek@suse.cz" date="1642766402">- series.conf: cleanup
- move to "mainline soon" section:
  - patches.suse/0001-mmc-moxart_remove-Fix-UAF.patch
- commit 07d55c3</changelog>
  <changelog author="mkubecek@suse.cz" date="1642766403">- series.conf: refresh
- update upstream references and resort:
  - patches.suse/powerpc-fadump-Fix-inaccurate-CPU-state-info-in-vmco.patch
  - patches.suse/powerpc-handle-kdump-appropriately-with-crash_kexec_.patch
  - patches.suse/powerpc-watchdog-Avoid-holding-wd_smp_lock-over-prin.patch
  - patches.suse/powerpc-watchdog-Fix-missed-watchdog-reset-due-to-me.patch
  - patches.suse/powerpc-watchdog-Fix-wd_smp_last_reset_tb-reporting.patch
  - patches.suse/powerpc-watchdog-read-TB-close-to-where-it-is-used.patch
  - patches.suse/powerpc-watchdog-tighten-non-atomic-read-modify-writ.patch
- commit 72b7db7</changelog>
  <changelog author="osalvador@suse.de" date="1642939200">- Rename colliding patches before the next cve/linux-5.3 -&gt; SLE15-SP3 merge
- commit 84178b8</changelog>
</package>
<package pkgid="a7e5f5abdbd75cb972a498455d60c728e87105284a5cebb108467b4d80da4279" name="kernel-preempt" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="150300.59.49.1"/>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235200">- IB/mlx5: Add missing error code (git-fixes)
- commit 06919f0</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235201">- RDMA/cxgb4: Fix adapter LE hash errors while destroying ipv6 listening server (git-fixes)
- commit 0f86491</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235202">- RDMA/addr: Be strict with gid size (git-fixes)
- commit 0b96850</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235203">- IB/isert: Fix a use after free in isert_connect_request (git-fixes)
- commit fa7abfc</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235204">- RDMA/core: Fix corrupted SL on passive side (git-fixes)
- commit d86d9cb</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235205">- IB/hfi1: Use kzalloc() for mmu_rb_handler allocation (git-fixes)
- commit 05c0e16</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235206">- IB/hfi1: Fix error return code in parse_platform_config() (git-fixes)
- commit 270bb46</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235207">- RDMA/bnxt_re: Fix error return code in bnxt_qplib_cq_process_terminal() (git-fixes)
- commit 76267d4</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235208">- RDMA/core: Unify RoCE check and re-factor code (git-fixes)
- commit e5e3d6f</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235209">- RDMA/cxgb4: add missing qpid increment (git-fixes)
- commit 591cdce</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235210">- RDMA/i40iw: Fix error unwinding when i40iw_hmc_sd_one fails (git-fixes)
- commit 2db1c84</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235211">- RDMA/siw: Fix a use after free in siw_alloc_mr (git-fixes)
- commit a7eff62</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235212">- RDMA/bnxt_re: Fix a double free in bnxt_qplib_alloc_res (git-fixes)
- commit 8c226d5</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235213">- RDMA/siw: Properly check send and receive CQ pointers (git-fixes)
- commit d84b45b</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235214">- RDMA/rxe: Clear all QP fields if creation failed (git-fixes)
- commit 07c8b4d</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235215">- RDMA/mlx5: Recover from fatal event in dual port mode (git-fixes)
- commit 875e0ed</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235216">- RDMA/core: Don't access cm_id after its destruction (git-fixes)
- commit 4a117e6</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235217">- RDMA/mlx5: Fix query DCT via DEVX (git-fixes)
- commit 4b56cb2</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235218">- RDMA/uverbs: Fix a NULL vs IS_ERR() bug (git-fixes)
- commit 82ce09e</changelog>
  <changelog author="msuchanek@suse.de" date="1644235219">- powerpc/perf: Fix power_pmu_disable to call
  clear_pmi_irq_pending only if PMI is pending (bsc#1156395).
- commit a08ca77</changelog>
</package>
<package pkgid="be496eb91bfeb9e5352fa83aacbff9fe769ae7b5a2e7873cc8dabc170e398c27" name="kernel-preempt" arch="src">
  <version epoch="0" ver="5.3.18" rel="150300.59.49.1"/>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235200">- IB/mlx5: Add missing error code (git-fixes)
- commit 06919f0</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235201">- RDMA/cxgb4: Fix adapter LE hash errors while destroying ipv6 listening server (git-fixes)
- commit 0f86491</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235202">- RDMA/addr: Be strict with gid size (git-fixes)
- commit 0b96850</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235203">- IB/isert: Fix a use after free in isert_connect_request (git-fixes)
- commit fa7abfc</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235204">- RDMA/core: Fix corrupted SL on passive side (git-fixes)
- commit d86d9cb</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235205">- IB/hfi1: Use kzalloc() for mmu_rb_handler allocation (git-fixes)
- commit 05c0e16</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235206">- IB/hfi1: Fix error return code in parse_platform_config() (git-fixes)
- commit 270bb46</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235207">- RDMA/bnxt_re: Fix error return code in bnxt_qplib_cq_process_terminal() (git-fixes)
- commit 76267d4</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235208">- RDMA/core: Unify RoCE check and re-factor code (git-fixes)
- commit e5e3d6f</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235209">- RDMA/cxgb4: add missing qpid increment (git-fixes)
- commit 591cdce</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235210">- RDMA/i40iw: Fix error unwinding when i40iw_hmc_sd_one fails (git-fixes)
- commit 2db1c84</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235211">- RDMA/siw: Fix a use after free in siw_alloc_mr (git-fixes)
- commit a7eff62</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235212">- RDMA/bnxt_re: Fix a double free in bnxt_qplib_alloc_res (git-fixes)
- commit 8c226d5</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235213">- RDMA/siw: Properly check send and receive CQ pointers (git-fixes)
- commit d84b45b</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235214">- RDMA/rxe: Clear all QP fields if creation failed (git-fixes)
- commit 07c8b4d</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235215">- RDMA/mlx5: Recover from fatal event in dual port mode (git-fixes)
- commit 875e0ed</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235216">- RDMA/core: Don't access cm_id after its destruction (git-fixes)
- commit 4a117e6</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235217">- RDMA/mlx5: Fix query DCT via DEVX (git-fixes)
- commit 4b56cb2</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235218">- RDMA/uverbs: Fix a NULL vs IS_ERR() bug (git-fixes)
- commit 82ce09e</changelog>
  <changelog author="msuchanek@suse.de" date="1644235219">- powerpc/perf: Fix power_pmu_disable to call
  clear_pmi_irq_pending only if PMI is pending (bsc#1156395).
- commit a08ca77</changelog>
</package>
<package pkgid="e0060bc7bb050c6d85d12681fff56926479d7a7b8d26d613d90a1fcd0c84fc12" name="kernel-preempt" arch="x86_64">
  <version epoch="0" ver="5.3.18" rel="150300.59.49.1"/>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235200">- IB/mlx5: Add missing error code (git-fixes)
- commit 06919f0</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235201">- RDMA/cxgb4: Fix adapter LE hash errors while destroying ipv6 listening server (git-fixes)
- commit 0f86491</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235202">- RDMA/addr: Be strict with gid size (git-fixes)
- commit 0b96850</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235203">- IB/isert: Fix a use after free in isert_connect_request (git-fixes)
- commit fa7abfc</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235204">- RDMA/core: Fix corrupted SL on passive side (git-fixes)
- commit d86d9cb</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235205">- IB/hfi1: Use kzalloc() for mmu_rb_handler allocation (git-fixes)
- commit 05c0e16</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235206">- IB/hfi1: Fix error return code in parse_platform_config() (git-fixes)
- commit 270bb46</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235207">- RDMA/bnxt_re: Fix error return code in bnxt_qplib_cq_process_terminal() (git-fixes)
- commit 76267d4</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235208">- RDMA/core: Unify RoCE check and re-factor code (git-fixes)
- commit e5e3d6f</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235209">- RDMA/cxgb4: add missing qpid increment (git-fixes)
- commit 591cdce</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235210">- RDMA/i40iw: Fix error unwinding when i40iw_hmc_sd_one fails (git-fixes)
- commit 2db1c84</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235211">- RDMA/siw: Fix a use after free in siw_alloc_mr (git-fixes)
- commit a7eff62</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235212">- RDMA/bnxt_re: Fix a double free in bnxt_qplib_alloc_res (git-fixes)
- commit 8c226d5</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235213">- RDMA/siw: Properly check send and receive CQ pointers (git-fixes)
- commit d84b45b</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235214">- RDMA/rxe: Clear all QP fields if creation failed (git-fixes)
- commit 07c8b4d</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235215">- RDMA/mlx5: Recover from fatal event in dual port mode (git-fixes)
- commit 875e0ed</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235216">- RDMA/core: Don't access cm_id after its destruction (git-fixes)
- commit 4a117e6</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235217">- RDMA/mlx5: Fix query DCT via DEVX (git-fixes)
- commit 4b56cb2</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235218">- RDMA/uverbs: Fix a NULL vs IS_ERR() bug (git-fixes)
- commit 82ce09e</changelog>
  <changelog author="msuchanek@suse.de" date="1644235219">- powerpc/perf: Fix power_pmu_disable to call
  clear_pmi_irq_pending only if PMI is pending (bsc#1156395).
- commit a08ca77</changelog>
</package>
<package pkgid="b4ff2840e4b220f80329acdaff8732e08c17dd1d1c47411a3293114864916f1c" name="kernel-preempt-devel" arch="x86_64">
  <version epoch="0" ver="5.3.18" rel="150300.59.43.1"/>
  <changelog author="tiwai@suse.de" date="1642593600">- Add cherry-picked IDs for qemu fw_cfg patches
- commit 8f947ad</changelog>
  <changelog author="msuchanek@suse.de" date="1642593601">- powerpc/pseries/cpuhp: delete add/remove_by_count code
  (bsc#1065729).
- powerpc/pseries/cpuhp: cache node corrections (bsc#1065729).
- commit 9c04898</changelog>
  <changelog author="tiwai@suse.de" date="1642593602">- dmaengine: at_xdmac: Fix at_xdmac_lld struct definition
  (git-fixes).
- dmaengine: at_xdmac: Fix lld view setting (git-fixes).
- dmaengine: at_xdmac: Fix concurrency over xfers_list
  (git-fixes).
- dmaengine: at_xdmac: Print debug message after realeasing the
  lock (git-fixes).
- dmaengine: at_xdmac: Don't start transactions at tx_submit level
  (git-fixes).
- Documentation: dmaengine: Correctly describe dmatest with
  channel unset (git-fixes).
- rpmsg: core: Clean up resources on announce_create failure
  (git-fixes).
- ACPI: APD: Check for NULL pointer after calling devm_ioremap()
  (git-fixes).
- Input: ti_am335x_tsc - fix STEPCONFIG setup for Z2 (git-fixes).
- Input: ti_am335x_tsc - set ADCREFM for X configuration
  (git-fixes).
- i3c: master: dw: check return of dw_i3c_master_get_free_pos()
  (git-fixes).
- i3c: fix incorrect address slot lookup on 64-bit (git-fixes).
- commit 3d8614c</changelog>
  <changelog author="msuchanek@suse.de" date="1642593603">- powerpc/prom_init: Fix improper check of prom_getprop()
  (bsc#1065729).
- commit 954fa51</changelog>
  <changelog author="msuchanek@suse.de" date="1642593604">- powerpc/perf: Fix PMU callbacks to clear pending PMI before
  resetting an overflown PMC (bsc#1156395).
- commit 8bdce1e</changelog>
  <changelog author="mbenes@suse.cz" date="1642593605">- livepatch: Avoid CPU hogging with cond_resched (bsc#1071995).
- commit 27c7aa0</changelog>
  <changelog author="msuchanek@suse.de" date="1642593606">- blacklist.conf: Add 79ca6f74dae0 tpm: fix Atmel TPM crash caused by too frequent queries
  Breaks kABI, there is no report of this problem affecting users, likely
  broken old TPM firmware.
- commit 4ea9f96</changelog>
  <changelog author="msuchanek@suse.de" date="1642593607">- Update patches.suse/tpm-fix-potential-NULL-pointer-access-in-tpm_del_cha.patch
  (git-fixes bsc#1193660 ltc#195634).
- commit 11ac3f6</changelog>
  <changelog author="lhenriques@suse.de" date="1642680000">- fuse: Pass correct lend value to filemap_write_and_wait_range()
  (bsc#1194953).
- commit d2355ea</changelog>
  <changelog author="msuchanek@suse.de" date="1642680001">- blacklist.conf: Add a2308836880b powerpc: Fix arch_stack_walk() to have
  running function as first entry
  The stacktrace interface in this kernel version does not provide the
  parameters used to implement the fix.
- commit ee041a3</changelog>
  <changelog author="msuchanek@suse.de" date="1642680002">- powerpc/64s: fix program check interrupt emergency stack path
  (bsc#1156395).
- commit a3c26ed</changelog>
  <changelog author="msuchanek@suse.de" date="1642680003">- powerpc/traps: do not enable irqs in _exception (bsc#1065729).
- powerpc: add interrupt_cond_local_irq_enable helper
  (bsc#1065729).
- commit 65f660c</changelog>
  <changelog author="msuchanek@suse.de" date="1642680004">- powerpc/pseries/mobility: ignore ibm, platform-facilities
  updates (bsc#1065729).
- commit b253330</changelog>
  <changelog author="rgoldwyn@suse.com" date="1642680005">- vfs: check fd has read access in kernel_read_file_from_fd() (bsc#1194888).
- commit 4717473</changelog>
  <changelog author="vkarasulli@suse.de" date="1642680006">- moxart: fix potential use-after-free on remove path
  (bsc#1194516).
- commit 3fae095</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1642766400">- sctp: account stream padding length for reconf chunk
  (bsc#1194985 CVE-2022-0322).
- commit a6cab40</changelog>
  <changelog author="ddiss@suse.de" date="1642766401">- vfs: fs_context: fix up param length parsing in
  legacy_parse_param (CVE-2022-0185 bsc#1194517).
- Rename and retag following upstream merge from:
  patches.suse/vfs-Out-of-bounds-write-of-heap-buffer-in-fs_context-c.patch
  to patches.suse/vfs-fs_context-fix-up-param-length-parsing-in-legacy.patch
- commit 33860f2</changelog>
  <changelog author="mkubecek@suse.cz" date="1642766402">- series.conf: cleanup
- move to "mainline soon" section:
  - patches.suse/0001-mmc-moxart_remove-Fix-UAF.patch
- commit 07d55c3</changelog>
  <changelog author="mkubecek@suse.cz" date="1642766403">- series.conf: refresh
- update upstream references and resort:
  - patches.suse/powerpc-fadump-Fix-inaccurate-CPU-state-info-in-vmco.patch
  - patches.suse/powerpc-handle-kdump-appropriately-with-crash_kexec_.patch
  - patches.suse/powerpc-watchdog-Avoid-holding-wd_smp_lock-over-prin.patch
  - patches.suse/powerpc-watchdog-Fix-missed-watchdog-reset-due-to-me.patch
  - patches.suse/powerpc-watchdog-Fix-wd_smp_last_reset_tb-reporting.patch
  - patches.suse/powerpc-watchdog-read-TB-close-to-where-it-is-used.patch
  - patches.suse/powerpc-watchdog-tighten-non-atomic-read-modify-writ.patch
- commit 72b7db7</changelog>
  <changelog author="osalvador@suse.de" date="1642939200">- Rename colliding patches before the next cve/linux-5.3 -&gt; SLE15-SP3 merge
- commit 84178b8</changelog>
</package>
<package pkgid="525eabc60435fd01c9ec605b9c66c55937602d245602102d50b6a2552abe91e5" name="kernel-preempt-devel" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="150300.59.49.1"/>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235200">- IB/mlx5: Add missing error code (git-fixes)
- commit 06919f0</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235201">- RDMA/cxgb4: Fix adapter LE hash errors while destroying ipv6 listening server (git-fixes)
- commit 0f86491</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235202">- RDMA/addr: Be strict with gid size (git-fixes)
- commit 0b96850</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235203">- IB/isert: Fix a use after free in isert_connect_request (git-fixes)
- commit fa7abfc</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235204">- RDMA/core: Fix corrupted SL on passive side (git-fixes)
- commit d86d9cb</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235205">- IB/hfi1: Use kzalloc() for mmu_rb_handler allocation (git-fixes)
- commit 05c0e16</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235206">- IB/hfi1: Fix error return code in parse_platform_config() (git-fixes)
- commit 270bb46</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235207">- RDMA/bnxt_re: Fix error return code in bnxt_qplib_cq_process_terminal() (git-fixes)
- commit 76267d4</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235208">- RDMA/core: Unify RoCE check and re-factor code (git-fixes)
- commit e5e3d6f</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235209">- RDMA/cxgb4: add missing qpid increment (git-fixes)
- commit 591cdce</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235210">- RDMA/i40iw: Fix error unwinding when i40iw_hmc_sd_one fails (git-fixes)
- commit 2db1c84</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235211">- RDMA/siw: Fix a use after free in siw_alloc_mr (git-fixes)
- commit a7eff62</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235212">- RDMA/bnxt_re: Fix a double free in bnxt_qplib_alloc_res (git-fixes)
- commit 8c226d5</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235213">- RDMA/siw: Properly check send and receive CQ pointers (git-fixes)
- commit d84b45b</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235214">- RDMA/rxe: Clear all QP fields if creation failed (git-fixes)
- commit 07c8b4d</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235215">- RDMA/mlx5: Recover from fatal event in dual port mode (git-fixes)
- commit 875e0ed</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235216">- RDMA/core: Don't access cm_id after its destruction (git-fixes)
- commit 4a117e6</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235217">- RDMA/mlx5: Fix query DCT via DEVX (git-fixes)
- commit 4b56cb2</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235218">- RDMA/uverbs: Fix a NULL vs IS_ERR() bug (git-fixes)
- commit 82ce09e</changelog>
  <changelog author="msuchanek@suse.de" date="1644235219">- powerpc/perf: Fix power_pmu_disable to call
  clear_pmi_irq_pending only if PMI is pending (bsc#1156395).
- commit a08ca77</changelog>
</package>
<package pkgid="41fa7231bf3bcabc685625745eeac60f169242982fbc3718528f380116c422f4" name="kernel-preempt-devel" arch="x86_64">
  <version epoch="0" ver="5.3.18" rel="150300.59.49.1"/>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235200">- IB/mlx5: Add missing error code (git-fixes)
- commit 06919f0</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235201">- RDMA/cxgb4: Fix adapter LE hash errors while destroying ipv6 listening server (git-fixes)
- commit 0f86491</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235202">- RDMA/addr: Be strict with gid size (git-fixes)
- commit 0b96850</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235203">- IB/isert: Fix a use after free in isert_connect_request (git-fixes)
- commit fa7abfc</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235204">- RDMA/core: Fix corrupted SL on passive side (git-fixes)
- commit d86d9cb</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235205">- IB/hfi1: Use kzalloc() for mmu_rb_handler allocation (git-fixes)
- commit 05c0e16</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235206">- IB/hfi1: Fix error return code in parse_platform_config() (git-fixes)
- commit 270bb46</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235207">- RDMA/bnxt_re: Fix error return code in bnxt_qplib_cq_process_terminal() (git-fixes)
- commit 76267d4</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235208">- RDMA/core: Unify RoCE check and re-factor code (git-fixes)
- commit e5e3d6f</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235209">- RDMA/cxgb4: add missing qpid increment (git-fixes)
- commit 591cdce</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235210">- RDMA/i40iw: Fix error unwinding when i40iw_hmc_sd_one fails (git-fixes)
- commit 2db1c84</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235211">- RDMA/siw: Fix a use after free in siw_alloc_mr (git-fixes)
- commit a7eff62</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235212">- RDMA/bnxt_re: Fix a double free in bnxt_qplib_alloc_res (git-fixes)
- commit 8c226d5</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235213">- RDMA/siw: Properly check send and receive CQ pointers (git-fixes)
- commit d84b45b</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235214">- RDMA/rxe: Clear all QP fields if creation failed (git-fixes)
- commit 07c8b4d</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235215">- RDMA/mlx5: Recover from fatal event in dual port mode (git-fixes)
- commit 875e0ed</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235216">- RDMA/core: Don't access cm_id after its destruction (git-fixes)
- commit 4a117e6</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235217">- RDMA/mlx5: Fix query DCT via DEVX (git-fixes)
- commit 4b56cb2</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235218">- RDMA/uverbs: Fix a NULL vs IS_ERR() bug (git-fixes)
- commit 82ce09e</changelog>
  <changelog author="msuchanek@suse.de" date="1644235219">- powerpc/perf: Fix power_pmu_disable to call
  clear_pmi_irq_pending only if PMI is pending (bsc#1156395).
- commit a08ca77</changelog>
</package>
<package pkgid="a62bf33f1235c3b0a2f553769800088bb430a2577bb649e3694707d427b53ff7" name="kernel-preempt-extra" arch="x86_64">
  <version epoch="0" ver="5.3.18" rel="150300.59.43.1"/>
  <changelog author="tiwai@suse.de" date="1642593600">- Add cherry-picked IDs for qemu fw_cfg patches
- commit 8f947ad</changelog>
  <changelog author="msuchanek@suse.de" date="1642593601">- powerpc/pseries/cpuhp: delete add/remove_by_count code
  (bsc#1065729).
- powerpc/pseries/cpuhp: cache node corrections (bsc#1065729).
- commit 9c04898</changelog>
  <changelog author="tiwai@suse.de" date="1642593602">- dmaengine: at_xdmac: Fix at_xdmac_lld struct definition
  (git-fixes).
- dmaengine: at_xdmac: Fix lld view setting (git-fixes).
- dmaengine: at_xdmac: Fix concurrency over xfers_list
  (git-fixes).
- dmaengine: at_xdmac: Print debug message after realeasing the
  lock (git-fixes).
- dmaengine: at_xdmac: Don't start transactions at tx_submit level
  (git-fixes).
- Documentation: dmaengine: Correctly describe dmatest with
  channel unset (git-fixes).
- rpmsg: core: Clean up resources on announce_create failure
  (git-fixes).
- ACPI: APD: Check for NULL pointer after calling devm_ioremap()
  (git-fixes).
- Input: ti_am335x_tsc - fix STEPCONFIG setup for Z2 (git-fixes).
- Input: ti_am335x_tsc - set ADCREFM for X configuration
  (git-fixes).
- i3c: master: dw: check return of dw_i3c_master_get_free_pos()
  (git-fixes).
- i3c: fix incorrect address slot lookup on 64-bit (git-fixes).
- commit 3d8614c</changelog>
  <changelog author="msuchanek@suse.de" date="1642593603">- powerpc/prom_init: Fix improper check of prom_getprop()
  (bsc#1065729).
- commit 954fa51</changelog>
  <changelog author="msuchanek@suse.de" date="1642593604">- powerpc/perf: Fix PMU callbacks to clear pending PMI before
  resetting an overflown PMC (bsc#1156395).
- commit 8bdce1e</changelog>
  <changelog author="mbenes@suse.cz" date="1642593605">- livepatch: Avoid CPU hogging with cond_resched (bsc#1071995).
- commit 27c7aa0</changelog>
  <changelog author="msuchanek@suse.de" date="1642593606">- blacklist.conf: Add 79ca6f74dae0 tpm: fix Atmel TPM crash caused by too frequent queries
  Breaks kABI, there is no report of this problem affecting users, likely
  broken old TPM firmware.
- commit 4ea9f96</changelog>
  <changelog author="msuchanek@suse.de" date="1642593607">- Update patches.suse/tpm-fix-potential-NULL-pointer-access-in-tpm_del_cha.patch
  (git-fixes bsc#1193660 ltc#195634).
- commit 11ac3f6</changelog>
  <changelog author="lhenriques@suse.de" date="1642680000">- fuse: Pass correct lend value to filemap_write_and_wait_range()
  (bsc#1194953).
- commit d2355ea</changelog>
  <changelog author="msuchanek@suse.de" date="1642680001">- blacklist.conf: Add a2308836880b powerpc: Fix arch_stack_walk() to have
  running function as first entry
  The stacktrace interface in this kernel version does not provide the
  parameters used to implement the fix.
- commit ee041a3</changelog>
  <changelog author="msuchanek@suse.de" date="1642680002">- powerpc/64s: fix program check interrupt emergency stack path
  (bsc#1156395).
- commit a3c26ed</changelog>
  <changelog author="msuchanek@suse.de" date="1642680003">- powerpc/traps: do not enable irqs in _exception (bsc#1065729).
- powerpc: add interrupt_cond_local_irq_enable helper
  (bsc#1065729).
- commit 65f660c</changelog>
  <changelog author="msuchanek@suse.de" date="1642680004">- powerpc/pseries/mobility: ignore ibm, platform-facilities
  updates (bsc#1065729).
- commit b253330</changelog>
  <changelog author="rgoldwyn@suse.com" date="1642680005">- vfs: check fd has read access in kernel_read_file_from_fd() (bsc#1194888).
- commit 4717473</changelog>
  <changelog author="vkarasulli@suse.de" date="1642680006">- moxart: fix potential use-after-free on remove path
  (bsc#1194516).
- commit 3fae095</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1642766400">- sctp: account stream padding length for reconf chunk
  (bsc#1194985 CVE-2022-0322).
- commit a6cab40</changelog>
  <changelog author="ddiss@suse.de" date="1642766401">- vfs: fs_context: fix up param length parsing in
  legacy_parse_param (CVE-2022-0185 bsc#1194517).
- Rename and retag following upstream merge from:
  patches.suse/vfs-Out-of-bounds-write-of-heap-buffer-in-fs_context-c.patch
  to patches.suse/vfs-fs_context-fix-up-param-length-parsing-in-legacy.patch
- commit 33860f2</changelog>
  <changelog author="mkubecek@suse.cz" date="1642766402">- series.conf: cleanup
- move to "mainline soon" section:
  - patches.suse/0001-mmc-moxart_remove-Fix-UAF.patch
- commit 07d55c3</changelog>
  <changelog author="mkubecek@suse.cz" date="1642766403">- series.conf: refresh
- update upstream references and resort:
  - patches.suse/powerpc-fadump-Fix-inaccurate-CPU-state-info-in-vmco.patch
  - patches.suse/powerpc-handle-kdump-appropriately-with-crash_kexec_.patch
  - patches.suse/powerpc-watchdog-Avoid-holding-wd_smp_lock-over-prin.patch
  - patches.suse/powerpc-watchdog-Fix-missed-watchdog-reset-due-to-me.patch
  - patches.suse/powerpc-watchdog-Fix-wd_smp_last_reset_tb-reporting.patch
  - patches.suse/powerpc-watchdog-read-TB-close-to-where-it-is-used.patch
  - patches.suse/powerpc-watchdog-tighten-non-atomic-read-modify-writ.patch
- commit 72b7db7</changelog>
  <changelog author="osalvador@suse.de" date="1642939200">- Rename colliding patches before the next cve/linux-5.3 -&gt; SLE15-SP3 merge
- commit 84178b8</changelog>
</package>
<package pkgid="d585921146f5d7737f8df08a9bfc37e541863f6017f2179530a5ece9859831f6" name="kernel-preempt-extra" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="150300.59.49.1"/>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235200">- IB/mlx5: Add missing error code (git-fixes)
- commit 06919f0</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235201">- RDMA/cxgb4: Fix adapter LE hash errors while destroying ipv6 listening server (git-fixes)
- commit 0f86491</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235202">- RDMA/addr: Be strict with gid size (git-fixes)
- commit 0b96850</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235203">- IB/isert: Fix a use after free in isert_connect_request (git-fixes)
- commit fa7abfc</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235204">- RDMA/core: Fix corrupted SL on passive side (git-fixes)
- commit d86d9cb</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235205">- IB/hfi1: Use kzalloc() for mmu_rb_handler allocation (git-fixes)
- commit 05c0e16</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235206">- IB/hfi1: Fix error return code in parse_platform_config() (git-fixes)
- commit 270bb46</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235207">- RDMA/bnxt_re: Fix error return code in bnxt_qplib_cq_process_terminal() (git-fixes)
- commit 76267d4</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235208">- RDMA/core: Unify RoCE check and re-factor code (git-fixes)
- commit e5e3d6f</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235209">- RDMA/cxgb4: add missing qpid increment (git-fixes)
- commit 591cdce</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235210">- RDMA/i40iw: Fix error unwinding when i40iw_hmc_sd_one fails (git-fixes)
- commit 2db1c84</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235211">- RDMA/siw: Fix a use after free in siw_alloc_mr (git-fixes)
- commit a7eff62</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235212">- RDMA/bnxt_re: Fix a double free in bnxt_qplib_alloc_res (git-fixes)
- commit 8c226d5</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235213">- RDMA/siw: Properly check send and receive CQ pointers (git-fixes)
- commit d84b45b</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235214">- RDMA/rxe: Clear all QP fields if creation failed (git-fixes)
- commit 07c8b4d</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235215">- RDMA/mlx5: Recover from fatal event in dual port mode (git-fixes)
- commit 875e0ed</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235216">- RDMA/core: Don't access cm_id after its destruction (git-fixes)
- commit 4a117e6</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235217">- RDMA/mlx5: Fix query DCT via DEVX (git-fixes)
- commit 4b56cb2</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235218">- RDMA/uverbs: Fix a NULL vs IS_ERR() bug (git-fixes)
- commit 82ce09e</changelog>
  <changelog author="msuchanek@suse.de" date="1644235219">- powerpc/perf: Fix power_pmu_disable to call
  clear_pmi_irq_pending only if PMI is pending (bsc#1156395).
- commit a08ca77</changelog>
</package>
<package pkgid="301df9c3d8a2fa1c2e756448990dbd99bc84926eb814122dc29fe5988a40a4f9" name="kernel-preempt-extra" arch="x86_64">
  <version epoch="0" ver="5.3.18" rel="150300.59.49.1"/>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235200">- IB/mlx5: Add missing error code (git-fixes)
- commit 06919f0</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235201">- RDMA/cxgb4: Fix adapter LE hash errors while destroying ipv6 listening server (git-fixes)
- commit 0f86491</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235202">- RDMA/addr: Be strict with gid size (git-fixes)
- commit 0b96850</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235203">- IB/isert: Fix a use after free in isert_connect_request (git-fixes)
- commit fa7abfc</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235204">- RDMA/core: Fix corrupted SL on passive side (git-fixes)
- commit d86d9cb</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235205">- IB/hfi1: Use kzalloc() for mmu_rb_handler allocation (git-fixes)
- commit 05c0e16</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235206">- IB/hfi1: Fix error return code in parse_platform_config() (git-fixes)
- commit 270bb46</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235207">- RDMA/bnxt_re: Fix error return code in bnxt_qplib_cq_process_terminal() (git-fixes)
- commit 76267d4</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235208">- RDMA/core: Unify RoCE check and re-factor code (git-fixes)
- commit e5e3d6f</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235209">- RDMA/cxgb4: add missing qpid increment (git-fixes)
- commit 591cdce</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235210">- RDMA/i40iw: Fix error unwinding when i40iw_hmc_sd_one fails (git-fixes)
- commit 2db1c84</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235211">- RDMA/siw: Fix a use after free in siw_alloc_mr (git-fixes)
- commit a7eff62</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235212">- RDMA/bnxt_re: Fix a double free in bnxt_qplib_alloc_res (git-fixes)
- commit 8c226d5</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235213">- RDMA/siw: Properly check send and receive CQ pointers (git-fixes)
- commit d84b45b</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235214">- RDMA/rxe: Clear all QP fields if creation failed (git-fixes)
- commit 07c8b4d</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235215">- RDMA/mlx5: Recover from fatal event in dual port mode (git-fixes)
- commit 875e0ed</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235216">- RDMA/core: Don't access cm_id after its destruction (git-fixes)
- commit 4a117e6</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235217">- RDMA/mlx5: Fix query DCT via DEVX (git-fixes)
- commit 4b56cb2</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235218">- RDMA/uverbs: Fix a NULL vs IS_ERR() bug (git-fixes)
- commit 82ce09e</changelog>
  <changelog author="msuchanek@suse.de" date="1644235219">- powerpc/perf: Fix power_pmu_disable to call
  clear_pmi_irq_pending only if PMI is pending (bsc#1156395).
- commit a08ca77</changelog>
</package>
<package pkgid="fb4cf260afbe9d88f8e9cb0d9f78c48f7c8ec83ca9be816f86f9dc751ca4beb0" name="kernel-preempt-livepatch-devel" arch="x86_64">
  <version epoch="0" ver="5.3.18" rel="150300.59.43.1"/>
  <changelog author="tiwai@suse.de" date="1642593600">- Add cherry-picked IDs for qemu fw_cfg patches
- commit 8f947ad</changelog>
  <changelog author="msuchanek@suse.de" date="1642593601">- powerpc/pseries/cpuhp: delete add/remove_by_count code
  (bsc#1065729).
- powerpc/pseries/cpuhp: cache node corrections (bsc#1065729).
- commit 9c04898</changelog>
  <changelog author="tiwai@suse.de" date="1642593602">- dmaengine: at_xdmac: Fix at_xdmac_lld struct definition
  (git-fixes).
- dmaengine: at_xdmac: Fix lld view setting (git-fixes).
- dmaengine: at_xdmac: Fix concurrency over xfers_list
  (git-fixes).
- dmaengine: at_xdmac: Print debug message after realeasing the
  lock (git-fixes).
- dmaengine: at_xdmac: Don't start transactions at tx_submit level
  (git-fixes).
- Documentation: dmaengine: Correctly describe dmatest with
  channel unset (git-fixes).
- rpmsg: core: Clean up resources on announce_create failure
  (git-fixes).
- ACPI: APD: Check for NULL pointer after calling devm_ioremap()
  (git-fixes).
- Input: ti_am335x_tsc - fix STEPCONFIG setup for Z2 (git-fixes).
- Input: ti_am335x_tsc - set ADCREFM for X configuration
  (git-fixes).
- i3c: master: dw: check return of dw_i3c_master_get_free_pos()
  (git-fixes).
- i3c: fix incorrect address slot lookup on 64-bit (git-fixes).
- commit 3d8614c</changelog>
  <changelog author="msuchanek@suse.de" date="1642593603">- powerpc/prom_init: Fix improper check of prom_getprop()
  (bsc#1065729).
- commit 954fa51</changelog>
  <changelog author="msuchanek@suse.de" date="1642593604">- powerpc/perf: Fix PMU callbacks to clear pending PMI before
  resetting an overflown PMC (bsc#1156395).
- commit 8bdce1e</changelog>
  <changelog author="mbenes@suse.cz" date="1642593605">- livepatch: Avoid CPU hogging with cond_resched (bsc#1071995).
- commit 27c7aa0</changelog>
  <changelog author="msuchanek@suse.de" date="1642593606">- blacklist.conf: Add 79ca6f74dae0 tpm: fix Atmel TPM crash caused by too frequent queries
  Breaks kABI, there is no report of this problem affecting users, likely
  broken old TPM firmware.
- commit 4ea9f96</changelog>
  <changelog author="msuchanek@suse.de" date="1642593607">- Update patches.suse/tpm-fix-potential-NULL-pointer-access-in-tpm_del_cha.patch
  (git-fixes bsc#1193660 ltc#195634).
- commit 11ac3f6</changelog>
  <changelog author="lhenriques@suse.de" date="1642680000">- fuse: Pass correct lend value to filemap_write_and_wait_range()
  (bsc#1194953).
- commit d2355ea</changelog>
  <changelog author="msuchanek@suse.de" date="1642680001">- blacklist.conf: Add a2308836880b powerpc: Fix arch_stack_walk() to have
  running function as first entry
  The stacktrace interface in this kernel version does not provide the
  parameters used to implement the fix.
- commit ee041a3</changelog>
  <changelog author="msuchanek@suse.de" date="1642680002">- powerpc/64s: fix program check interrupt emergency stack path
  (bsc#1156395).
- commit a3c26ed</changelog>
  <changelog author="msuchanek@suse.de" date="1642680003">- powerpc/traps: do not enable irqs in _exception (bsc#1065729).
- powerpc: add interrupt_cond_local_irq_enable helper
  (bsc#1065729).
- commit 65f660c</changelog>
  <changelog author="msuchanek@suse.de" date="1642680004">- powerpc/pseries/mobility: ignore ibm, platform-facilities
  updates (bsc#1065729).
- commit b253330</changelog>
  <changelog author="rgoldwyn@suse.com" date="1642680005">- vfs: check fd has read access in kernel_read_file_from_fd() (bsc#1194888).
- commit 4717473</changelog>
  <changelog author="vkarasulli@suse.de" date="1642680006">- moxart: fix potential use-after-free on remove path
  (bsc#1194516).
- commit 3fae095</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1642766400">- sctp: account stream padding length for reconf chunk
  (bsc#1194985 CVE-2022-0322).
- commit a6cab40</changelog>
  <changelog author="ddiss@suse.de" date="1642766401">- vfs: fs_context: fix up param length parsing in
  legacy_parse_param (CVE-2022-0185 bsc#1194517).
- Rename and retag following upstream merge from:
  patches.suse/vfs-Out-of-bounds-write-of-heap-buffer-in-fs_context-c.patch
  to patches.suse/vfs-fs_context-fix-up-param-length-parsing-in-legacy.patch
- commit 33860f2</changelog>
  <changelog author="mkubecek@suse.cz" date="1642766402">- series.conf: cleanup
- move to "mainline soon" section:
  - patches.suse/0001-mmc-moxart_remove-Fix-UAF.patch
- commit 07d55c3</changelog>
  <changelog author="mkubecek@suse.cz" date="1642766403">- series.conf: refresh
- update upstream references and resort:
  - patches.suse/powerpc-fadump-Fix-inaccurate-CPU-state-info-in-vmco.patch
  - patches.suse/powerpc-handle-kdump-appropriately-with-crash_kexec_.patch
  - patches.suse/powerpc-watchdog-Avoid-holding-wd_smp_lock-over-prin.patch
  - patches.suse/powerpc-watchdog-Fix-missed-watchdog-reset-due-to-me.patch
  - patches.suse/powerpc-watchdog-Fix-wd_smp_last_reset_tb-reporting.patch
  - patches.suse/powerpc-watchdog-read-TB-close-to-where-it-is-used.patch
  - patches.suse/powerpc-watchdog-tighten-non-atomic-read-modify-writ.patch
- commit 72b7db7</changelog>
  <changelog author="osalvador@suse.de" date="1642939200">- Rename colliding patches before the next cve/linux-5.3 -&gt; SLE15-SP3 merge
- commit 84178b8</changelog>
</package>
<package pkgid="79ceddcf8719f231845b677b7e7e8491f0c2dd7110c2cec4f7bca80359df363e" name="kernel-preempt-livepatch-devel" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="150300.59.49.1"/>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235200">- IB/mlx5: Add missing error code (git-fixes)
- commit 06919f0</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235201">- RDMA/cxgb4: Fix adapter LE hash errors while destroying ipv6 listening server (git-fixes)
- commit 0f86491</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235202">- RDMA/addr: Be strict with gid size (git-fixes)
- commit 0b96850</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235203">- IB/isert: Fix a use after free in isert_connect_request (git-fixes)
- commit fa7abfc</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235204">- RDMA/core: Fix corrupted SL on passive side (git-fixes)
- commit d86d9cb</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235205">- IB/hfi1: Use kzalloc() for mmu_rb_handler allocation (git-fixes)
- commit 05c0e16</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235206">- IB/hfi1: Fix error return code in parse_platform_config() (git-fixes)
- commit 270bb46</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235207">- RDMA/bnxt_re: Fix error return code in bnxt_qplib_cq_process_terminal() (git-fixes)
- commit 76267d4</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235208">- RDMA/core: Unify RoCE check and re-factor code (git-fixes)
- commit e5e3d6f</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235209">- RDMA/cxgb4: add missing qpid increment (git-fixes)
- commit 591cdce</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235210">- RDMA/i40iw: Fix error unwinding when i40iw_hmc_sd_one fails (git-fixes)
- commit 2db1c84</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235211">- RDMA/siw: Fix a use after free in siw_alloc_mr (git-fixes)
- commit a7eff62</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235212">- RDMA/bnxt_re: Fix a double free in bnxt_qplib_alloc_res (git-fixes)
- commit 8c226d5</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235213">- RDMA/siw: Properly check send and receive CQ pointers (git-fixes)
- commit d84b45b</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235214">- RDMA/rxe: Clear all QP fields if creation failed (git-fixes)
- commit 07c8b4d</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235215">- RDMA/mlx5: Recover from fatal event in dual port mode (git-fixes)
- commit 875e0ed</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235216">- RDMA/core: Don't access cm_id after its destruction (git-fixes)
- commit 4a117e6</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235217">- RDMA/mlx5: Fix query DCT via DEVX (git-fixes)
- commit 4b56cb2</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235218">- RDMA/uverbs: Fix a NULL vs IS_ERR() bug (git-fixes)
- commit 82ce09e</changelog>
  <changelog author="msuchanek@suse.de" date="1644235219">- powerpc/perf: Fix power_pmu_disable to call
  clear_pmi_irq_pending only if PMI is pending (bsc#1156395).
- commit a08ca77</changelog>
</package>
<package pkgid="aa82bbf47480cdf6229b8838f670915a39ef8e897b0e091f83b4c53928bf9598" name="kernel-preempt-livepatch-devel" arch="x86_64">
  <version epoch="0" ver="5.3.18" rel="150300.59.49.1"/>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235200">- IB/mlx5: Add missing error code (git-fixes)
- commit 06919f0</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235201">- RDMA/cxgb4: Fix adapter LE hash errors while destroying ipv6 listening server (git-fixes)
- commit 0f86491</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235202">- RDMA/addr: Be strict with gid size (git-fixes)
- commit 0b96850</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235203">- IB/isert: Fix a use after free in isert_connect_request (git-fixes)
- commit fa7abfc</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235204">- RDMA/core: Fix corrupted SL on passive side (git-fixes)
- commit d86d9cb</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235205">- IB/hfi1: Use kzalloc() for mmu_rb_handler allocation (git-fixes)
- commit 05c0e16</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235206">- IB/hfi1: Fix error return code in parse_platform_config() (git-fixes)
- commit 270bb46</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235207">- RDMA/bnxt_re: Fix error return code in bnxt_qplib_cq_process_terminal() (git-fixes)
- commit 76267d4</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235208">- RDMA/core: Unify RoCE check and re-factor code (git-fixes)
- commit e5e3d6f</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235209">- RDMA/cxgb4: add missing qpid increment (git-fixes)
- commit 591cdce</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235210">- RDMA/i40iw: Fix error unwinding when i40iw_hmc_sd_one fails (git-fixes)
- commit 2db1c84</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235211">- RDMA/siw: Fix a use after free in siw_alloc_mr (git-fixes)
- commit a7eff62</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235212">- RDMA/bnxt_re: Fix a double free in bnxt_qplib_alloc_res (git-fixes)
- commit 8c226d5</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235213">- RDMA/siw: Properly check send and receive CQ pointers (git-fixes)
- commit d84b45b</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235214">- RDMA/rxe: Clear all QP fields if creation failed (git-fixes)
- commit 07c8b4d</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235215">- RDMA/mlx5: Recover from fatal event in dual port mode (git-fixes)
- commit 875e0ed</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235216">- RDMA/core: Don't access cm_id after its destruction (git-fixes)
- commit 4a117e6</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235217">- RDMA/mlx5: Fix query DCT via DEVX (git-fixes)
- commit 4b56cb2</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235218">- RDMA/uverbs: Fix a NULL vs IS_ERR() bug (git-fixes)
- commit 82ce09e</changelog>
  <changelog author="msuchanek@suse.de" date="1644235219">- powerpc/perf: Fix power_pmu_disable to call
  clear_pmi_irq_pending only if PMI is pending (bsc#1156395).
- commit a08ca77</changelog>
</package>
<package pkgid="17c274dcfd023bc0d1a06b0af7c8a8aaf29d14c5bed168ffba92d0563967f8b9" name="kernel-preempt-optional" arch="x86_64">
  <version epoch="0" ver="5.3.18" rel="150300.59.43.1"/>
  <changelog author="tiwai@suse.de" date="1642593600">- Add cherry-picked IDs for qemu fw_cfg patches
- commit 8f947ad</changelog>
  <changelog author="msuchanek@suse.de" date="1642593601">- powerpc/pseries/cpuhp: delete add/remove_by_count code
  (bsc#1065729).
- powerpc/pseries/cpuhp: cache node corrections (bsc#1065729).
- commit 9c04898</changelog>
  <changelog author="tiwai@suse.de" date="1642593602">- dmaengine: at_xdmac: Fix at_xdmac_lld struct definition
  (git-fixes).
- dmaengine: at_xdmac: Fix lld view setting (git-fixes).
- dmaengine: at_xdmac: Fix concurrency over xfers_list
  (git-fixes).
- dmaengine: at_xdmac: Print debug message after realeasing the
  lock (git-fixes).
- dmaengine: at_xdmac: Don't start transactions at tx_submit level
  (git-fixes).
- Documentation: dmaengine: Correctly describe dmatest with
  channel unset (git-fixes).
- rpmsg: core: Clean up resources on announce_create failure
  (git-fixes).
- ACPI: APD: Check for NULL pointer after calling devm_ioremap()
  (git-fixes).
- Input: ti_am335x_tsc - fix STEPCONFIG setup for Z2 (git-fixes).
- Input: ti_am335x_tsc - set ADCREFM for X configuration
  (git-fixes).
- i3c: master: dw: check return of dw_i3c_master_get_free_pos()
  (git-fixes).
- i3c: fix incorrect address slot lookup on 64-bit (git-fixes).
- commit 3d8614c</changelog>
  <changelog author="msuchanek@suse.de" date="1642593603">- powerpc/prom_init: Fix improper check of prom_getprop()
  (bsc#1065729).
- commit 954fa51</changelog>
  <changelog author="msuchanek@suse.de" date="1642593604">- powerpc/perf: Fix PMU callbacks to clear pending PMI before
  resetting an overflown PMC (bsc#1156395).
- commit 8bdce1e</changelog>
  <changelog author="mbenes@suse.cz" date="1642593605">- livepatch: Avoid CPU hogging with cond_resched (bsc#1071995).
- commit 27c7aa0</changelog>
  <changelog author="msuchanek@suse.de" date="1642593606">- blacklist.conf: Add 79ca6f74dae0 tpm: fix Atmel TPM crash caused by too frequent queries
  Breaks kABI, there is no report of this problem affecting users, likely
  broken old TPM firmware.
- commit 4ea9f96</changelog>
  <changelog author="msuchanek@suse.de" date="1642593607">- Update patches.suse/tpm-fix-potential-NULL-pointer-access-in-tpm_del_cha.patch
  (git-fixes bsc#1193660 ltc#195634).
- commit 11ac3f6</changelog>
  <changelog author="lhenriques@suse.de" date="1642680000">- fuse: Pass correct lend value to filemap_write_and_wait_range()
  (bsc#1194953).
- commit d2355ea</changelog>
  <changelog author="msuchanek@suse.de" date="1642680001">- blacklist.conf: Add a2308836880b powerpc: Fix arch_stack_walk() to have
  running function as first entry
  The stacktrace interface in this kernel version does not provide the
  parameters used to implement the fix.
- commit ee041a3</changelog>
  <changelog author="msuchanek@suse.de" date="1642680002">- powerpc/64s: fix program check interrupt emergency stack path
  (bsc#1156395).
- commit a3c26ed</changelog>
  <changelog author="msuchanek@suse.de" date="1642680003">- powerpc/traps: do not enable irqs in _exception (bsc#1065729).
- powerpc: add interrupt_cond_local_irq_enable helper
  (bsc#1065729).
- commit 65f660c</changelog>
  <changelog author="msuchanek@suse.de" date="1642680004">- powerpc/pseries/mobility: ignore ibm, platform-facilities
  updates (bsc#1065729).
- commit b253330</changelog>
  <changelog author="rgoldwyn@suse.com" date="1642680005">- vfs: check fd has read access in kernel_read_file_from_fd() (bsc#1194888).
- commit 4717473</changelog>
  <changelog author="vkarasulli@suse.de" date="1642680006">- moxart: fix potential use-after-free on remove path
  (bsc#1194516).
- commit 3fae095</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1642766400">- sctp: account stream padding length for reconf chunk
  (bsc#1194985 CVE-2022-0322).
- commit a6cab40</changelog>
  <changelog author="ddiss@suse.de" date="1642766401">- vfs: fs_context: fix up param length parsing in
  legacy_parse_param (CVE-2022-0185 bsc#1194517).
- Rename and retag following upstream merge from:
  patches.suse/vfs-Out-of-bounds-write-of-heap-buffer-in-fs_context-c.patch
  to patches.suse/vfs-fs_context-fix-up-param-length-parsing-in-legacy.patch
- commit 33860f2</changelog>
  <changelog author="mkubecek@suse.cz" date="1642766402">- series.conf: cleanup
- move to "mainline soon" section:
  - patches.suse/0001-mmc-moxart_remove-Fix-UAF.patch
- commit 07d55c3</changelog>
  <changelog author="mkubecek@suse.cz" date="1642766403">- series.conf: refresh
- update upstream references and resort:
  - patches.suse/powerpc-fadump-Fix-inaccurate-CPU-state-info-in-vmco.patch
  - patches.suse/powerpc-handle-kdump-appropriately-with-crash_kexec_.patch
  - patches.suse/powerpc-watchdog-Avoid-holding-wd_smp_lock-over-prin.patch
  - patches.suse/powerpc-watchdog-Fix-missed-watchdog-reset-due-to-me.patch
  - patches.suse/powerpc-watchdog-Fix-wd_smp_last_reset_tb-reporting.patch
  - patches.suse/powerpc-watchdog-read-TB-close-to-where-it-is-used.patch
  - patches.suse/powerpc-watchdog-tighten-non-atomic-read-modify-writ.patch
- commit 72b7db7</changelog>
  <changelog author="osalvador@suse.de" date="1642939200">- Rename colliding patches before the next cve/linux-5.3 -&gt; SLE15-SP3 merge
- commit 84178b8</changelog>
</package>
<package pkgid="f1f29d98cec00eef26d21dd0bf94e4e2f1c9a9a3caf64e0f68eb8c1251bff0e7" name="kernel-preempt-optional" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="150300.59.49.1"/>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235200">- IB/mlx5: Add missing error code (git-fixes)
- commit 06919f0</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235201">- RDMA/cxgb4: Fix adapter LE hash errors while destroying ipv6 listening server (git-fixes)
- commit 0f86491</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235202">- RDMA/addr: Be strict with gid size (git-fixes)
- commit 0b96850</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235203">- IB/isert: Fix a use after free in isert_connect_request (git-fixes)
- commit fa7abfc</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235204">- RDMA/core: Fix corrupted SL on passive side (git-fixes)
- commit d86d9cb</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235205">- IB/hfi1: Use kzalloc() for mmu_rb_handler allocation (git-fixes)
- commit 05c0e16</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235206">- IB/hfi1: Fix error return code in parse_platform_config() (git-fixes)
- commit 270bb46</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235207">- RDMA/bnxt_re: Fix error return code in bnxt_qplib_cq_process_terminal() (git-fixes)
- commit 76267d4</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235208">- RDMA/core: Unify RoCE check and re-factor code (git-fixes)
- commit e5e3d6f</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235209">- RDMA/cxgb4: add missing qpid increment (git-fixes)
- commit 591cdce</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235210">- RDMA/i40iw: Fix error unwinding when i40iw_hmc_sd_one fails (git-fixes)
- commit 2db1c84</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235211">- RDMA/siw: Fix a use after free in siw_alloc_mr (git-fixes)
- commit a7eff62</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235212">- RDMA/bnxt_re: Fix a double free in bnxt_qplib_alloc_res (git-fixes)
- commit 8c226d5</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235213">- RDMA/siw: Properly check send and receive CQ pointers (git-fixes)
- commit d84b45b</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235214">- RDMA/rxe: Clear all QP fields if creation failed (git-fixes)
- commit 07c8b4d</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235215">- RDMA/mlx5: Recover from fatal event in dual port mode (git-fixes)
- commit 875e0ed</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235216">- RDMA/core: Don't access cm_id after its destruction (git-fixes)
- commit 4a117e6</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235217">- RDMA/mlx5: Fix query DCT via DEVX (git-fixes)
- commit 4b56cb2</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235218">- RDMA/uverbs: Fix a NULL vs IS_ERR() bug (git-fixes)
- commit 82ce09e</changelog>
  <changelog author="msuchanek@suse.de" date="1644235219">- powerpc/perf: Fix power_pmu_disable to call
  clear_pmi_irq_pending only if PMI is pending (bsc#1156395).
- commit a08ca77</changelog>
</package>
<package pkgid="0cc0a2403beaa2e70f05d6de3621a55235dbf64fe88e527f6a41de2dbd0bbc96" name="kernel-preempt-optional" arch="x86_64">
  <version epoch="0" ver="5.3.18" rel="150300.59.49.1"/>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235200">- IB/mlx5: Add missing error code (git-fixes)
- commit 06919f0</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235201">- RDMA/cxgb4: Fix adapter LE hash errors while destroying ipv6 listening server (git-fixes)
- commit 0f86491</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235202">- RDMA/addr: Be strict with gid size (git-fixes)
- commit 0b96850</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235203">- IB/isert: Fix a use after free in isert_connect_request (git-fixes)
- commit fa7abfc</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235204">- RDMA/core: Fix corrupted SL on passive side (git-fixes)
- commit d86d9cb</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235205">- IB/hfi1: Use kzalloc() for mmu_rb_handler allocation (git-fixes)
- commit 05c0e16</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235206">- IB/hfi1: Fix error return code in parse_platform_config() (git-fixes)
- commit 270bb46</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235207">- RDMA/bnxt_re: Fix error return code in bnxt_qplib_cq_process_terminal() (git-fixes)
- commit 76267d4</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235208">- RDMA/core: Unify RoCE check and re-factor code (git-fixes)
- commit e5e3d6f</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235209">- RDMA/cxgb4: add missing qpid increment (git-fixes)
- commit 591cdce</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235210">- RDMA/i40iw: Fix error unwinding when i40iw_hmc_sd_one fails (git-fixes)
- commit 2db1c84</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235211">- RDMA/siw: Fix a use after free in siw_alloc_mr (git-fixes)
- commit a7eff62</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235212">- RDMA/bnxt_re: Fix a double free in bnxt_qplib_alloc_res (git-fixes)
- commit 8c226d5</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235213">- RDMA/siw: Properly check send and receive CQ pointers (git-fixes)
- commit d84b45b</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235214">- RDMA/rxe: Clear all QP fields if creation failed (git-fixes)
- commit 07c8b4d</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235215">- RDMA/mlx5: Recover from fatal event in dual port mode (git-fixes)
- commit 875e0ed</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235216">- RDMA/core: Don't access cm_id after its destruction (git-fixes)
- commit 4a117e6</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235217">- RDMA/mlx5: Fix query DCT via DEVX (git-fixes)
- commit 4b56cb2</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235218">- RDMA/uverbs: Fix a NULL vs IS_ERR() bug (git-fixes)
- commit 82ce09e</changelog>
  <changelog author="msuchanek@suse.de" date="1644235219">- powerpc/perf: Fix power_pmu_disable to call
  clear_pmi_irq_pending only if PMI is pending (bsc#1156395).
- commit a08ca77</changelog>
</package>
<package pkgid="6965c64822400dd54a2d44d03ded1734f560718fc3b083738e6dfdc53d50220d" name="kernel-vanilla" arch="aarch64">
  <version epoch="0" ver="4.12.14" rel="197.105.1"/>
  <changelog author="jack@suse.cz" date="1643112000">- fget: clarify and improve __fget_files() implementation
  (bsc#1193727).
- commit 3ce5a50</changelog>
  <changelog author="ohering@suse.de" date="1643198400">- net, xdp: Introduce xdp_prepare_buff utility routine
  (bsc#1193506).
- net, xdp: Introduce xdp_init_buff utility routine (bsc#1193506).
- commit 69356ad</changelog>
  <changelog author="ohering@suse.de" date="1643198401">- hv_netvsc: Set needed_headroom according to VF (bsc#1193506).
- commit e6c57eb</changelog>
  <changelog author="ohering@suse.de" date="1643198402">- net: mana: Use kcalloc() instead of kzalloc() (bsc#1193506).
- commit 2e3aed9</changelog>
  <changelog author="ohering@suse.de" date="1643198403">- net: mana: Allow setting the number of queues while the NIC
  is down (bsc#1193506).
- commit ed46d20</changelog>
  <changelog author="ohering@suse.de" date="1643198404">- net: mana: Fix the netdev_err()'s vPort argument in
  mana_init_port() (bsc#1193506).
- commit 4301039</changelog>
  <changelog author="ohering@suse.de" date="1643198405">- net: mana: Improve the HWC error handling (bsc#1193506).
- commit be607da</changelog>
  <changelog author="ohering@suse.de" date="1643198406">- net: mana: Support hibernation and kexec (bsc#1193506).
- commit c664fb6</changelog>
  <changelog author="ohering@suse.de" date="1643198407">- net: mana: Fix spelling mistake "calledd" -&gt; "called"
  (bsc#1193506).
- commit 781000a</changelog>
  <changelog author="ohering@suse.de" date="1643198408">- net: mana: Add XDP support (bsc#1193506).
- commit c395dbf</changelog>
  <changelog author="ohering@suse.de" date="1643198409">- net: mana: Add RX fencing (bsc#1193506).
- commit 4af8516</changelog>
  <changelog author="oneukum@suse.com" date="1643198410">- usb: gadget: configfs: Fix use-after-free issue with udc_name
  (bsc#1193861 CVE-2021-39648).
- commit 9ec119b</changelog>
  <changelog author="oneukum@suse.com" date="1643284800">- scsi: ufs: Correct the LUN used in eh_device_reset_handler()
  callback (bsc#1193864 CVE-2021-39657).
- commit 39c5f8e</changelog>
  <changelog author="tonyj@suse.de" date="1643284801">- bpf: Verifer, adjust_scalar_min_max_vals to always call
  update_reg_bounds() (bsc#1194227).
- commit c098fc7</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1643284802">- Update
  patches.suse/IPv6-reply-ICMP-error-if-the-first-fragment-don-t-in.patch
  (bsc#1191241 bsc#1195166).
- Update
  patches.suse/net-ipv6-discard-next-hop-mtu-less-than-minimum-link.patch
  (bsc#1191241 bsc#1195166).
- commit 1d741e6</changelog>
  <changelog author="jbohac@suse.cz" date="1643371200">- xfrm: fix MTU regression (bsc#1185377, bsc#1194048).
- Delete
  patches.suse/xfrm-xfrm_state_mtu-should-return-at-least-1280-for-.patch.
  which caused a regression (bsc#1194048).
- Replace with an alternative fix for bsc#1185377
- commit 3800186</changelog>
  <changelog author="jbohac@suse.cz" date="1643371201">- phonet: refcount leak in pep_sock_accep (bsc#1193867,
  CVE-2021-45095).
- commit 413134f</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1643630400">- net: tipc: validate domain record count on input (bsc#1195254).
- commit eaeeffc</changelog>
  <changelog author="tiwai@suse.de" date="1643630401">- Bluetooth: fix the erroneous flush_work() order (git-fixes).
- commit 9b1f0b0</changelog>
  <changelog author="tiwai@suse.de" date="1643630402">- Update patch reference for BT fix (CVE-2021-3564 bsc#1186207)
- commit ea7857c</changelog>
</package>
<package pkgid="155e2629ba3c992ea2888f609b01677282535ef4e8babc92518c2bef74bceb22" name="kernel-vanilla" arch="src">
  <version epoch="0" ver="4.12.14" rel="197.105.1"/>
  <changelog author="jack@suse.cz" date="1643112000">- fget: clarify and improve __fget_files() implementation
  (bsc#1193727).
- commit 3ce5a50</changelog>
  <changelog author="ohering@suse.de" date="1643198400">- net, xdp: Introduce xdp_prepare_buff utility routine
  (bsc#1193506).
- net, xdp: Introduce xdp_init_buff utility routine (bsc#1193506).
- commit 69356ad</changelog>
  <changelog author="ohering@suse.de" date="1643198401">- hv_netvsc: Set needed_headroom according to VF (bsc#1193506).
- commit e6c57eb</changelog>
  <changelog author="ohering@suse.de" date="1643198402">- net: mana: Use kcalloc() instead of kzalloc() (bsc#1193506).
- commit 2e3aed9</changelog>
  <changelog author="ohering@suse.de" date="1643198403">- net: mana: Allow setting the number of queues while the NIC
  is down (bsc#1193506).
- commit ed46d20</changelog>
  <changelog author="ohering@suse.de" date="1643198404">- net: mana: Fix the netdev_err()'s vPort argument in
  mana_init_port() (bsc#1193506).
- commit 4301039</changelog>
  <changelog author="ohering@suse.de" date="1643198405">- net: mana: Improve the HWC error handling (bsc#1193506).
- commit be607da</changelog>
  <changelog author="ohering@suse.de" date="1643198406">- net: mana: Support hibernation and kexec (bsc#1193506).
- commit c664fb6</changelog>
  <changelog author="ohering@suse.de" date="1643198407">- net: mana: Fix spelling mistake "calledd" -&gt; "called"
  (bsc#1193506).
- commit 781000a</changelog>
  <changelog author="ohering@suse.de" date="1643198408">- net: mana: Add XDP support (bsc#1193506).
- commit c395dbf</changelog>
  <changelog author="ohering@suse.de" date="1643198409">- net: mana: Add RX fencing (bsc#1193506).
- commit 4af8516</changelog>
  <changelog author="oneukum@suse.com" date="1643198410">- usb: gadget: configfs: Fix use-after-free issue with udc_name
  (bsc#1193861 CVE-2021-39648).
- commit 9ec119b</changelog>
  <changelog author="oneukum@suse.com" date="1643284800">- scsi: ufs: Correct the LUN used in eh_device_reset_handler()
  callback (bsc#1193864 CVE-2021-39657).
- commit 39c5f8e</changelog>
  <changelog author="tonyj@suse.de" date="1643284801">- bpf: Verifer, adjust_scalar_min_max_vals to always call
  update_reg_bounds() (bsc#1194227).
- commit c098fc7</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1643284802">- Update
  patches.suse/IPv6-reply-ICMP-error-if-the-first-fragment-don-t-in.patch
  (bsc#1191241 bsc#1195166).
- Update
  patches.suse/net-ipv6-discard-next-hop-mtu-less-than-minimum-link.patch
  (bsc#1191241 bsc#1195166).
- commit 1d741e6</changelog>
  <changelog author="jbohac@suse.cz" date="1643371200">- xfrm: fix MTU regression (bsc#1185377, bsc#1194048).
- Delete
  patches.suse/xfrm-xfrm_state_mtu-should-return-at-least-1280-for-.patch.
  which caused a regression (bsc#1194048).
- Replace with an alternative fix for bsc#1185377
- commit 3800186</changelog>
  <changelog author="jbohac@suse.cz" date="1643371201">- phonet: refcount leak in pep_sock_accep (bsc#1193867,
  CVE-2021-45095).
- commit 413134f</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1643630400">- net: tipc: validate domain record count on input (bsc#1195254).
- commit eaeeffc</changelog>
  <changelog author="tiwai@suse.de" date="1643630401">- Bluetooth: fix the erroneous flush_work() order (git-fixes).
- commit 9b1f0b0</changelog>
  <changelog author="tiwai@suse.de" date="1643630402">- Update patch reference for BT fix (CVE-2021-3564 bsc#1186207)
- commit ea7857c</changelog>
</package>
<package pkgid="e39ed600f2953628d6daf2c79c1ad39529347c287c7c38ad221b39deb2c21524" name="kernel-vanilla" arch="ppc64le">
  <version epoch="0" ver="4.12.14" rel="197.105.1"/>
  <changelog author="jack@suse.cz" date="1643112000">- fget: clarify and improve __fget_files() implementation
  (bsc#1193727).
- commit 3ce5a50</changelog>
  <changelog author="ohering@suse.de" date="1643198400">- net, xdp: Introduce xdp_prepare_buff utility routine
  (bsc#1193506).
- net, xdp: Introduce xdp_init_buff utility routine (bsc#1193506).
- commit 69356ad</changelog>
  <changelog author="ohering@suse.de" date="1643198401">- hv_netvsc: Set needed_headroom according to VF (bsc#1193506).
- commit e6c57eb</changelog>
  <changelog author="ohering@suse.de" date="1643198402">- net: mana: Use kcalloc() instead of kzalloc() (bsc#1193506).
- commit 2e3aed9</changelog>
  <changelog author="ohering@suse.de" date="1643198403">- net: mana: Allow setting the number of queues while the NIC
  is down (bsc#1193506).
- commit ed46d20</changelog>
  <changelog author="ohering@suse.de" date="1643198404">- net: mana: Fix the netdev_err()'s vPort argument in
  mana_init_port() (bsc#1193506).
- commit 4301039</changelog>
  <changelog author="ohering@suse.de" date="1643198405">- net: mana: Improve the HWC error handling (bsc#1193506).
- commit be607da</changelog>
  <changelog author="ohering@suse.de" date="1643198406">- net: mana: Support hibernation and kexec (bsc#1193506).
- commit c664fb6</changelog>
  <changelog author="ohering@suse.de" date="1643198407">- net: mana: Fix spelling mistake "calledd" -&gt; "called"
  (bsc#1193506).
- commit 781000a</changelog>
  <changelog author="ohering@suse.de" date="1643198408">- net: mana: Add XDP support (bsc#1193506).
- commit c395dbf</changelog>
  <changelog author="ohering@suse.de" date="1643198409">- net: mana: Add RX fencing (bsc#1193506).
- commit 4af8516</changelog>
  <changelog author="oneukum@suse.com" date="1643198410">- usb: gadget: configfs: Fix use-after-free issue with udc_name
  (bsc#1193861 CVE-2021-39648).
- commit 9ec119b</changelog>
  <changelog author="oneukum@suse.com" date="1643284800">- scsi: ufs: Correct the LUN used in eh_device_reset_handler()
  callback (bsc#1193864 CVE-2021-39657).
- commit 39c5f8e</changelog>
  <changelog author="tonyj@suse.de" date="1643284801">- bpf: Verifer, adjust_scalar_min_max_vals to always call
  update_reg_bounds() (bsc#1194227).
- commit c098fc7</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1643284802">- Update
  patches.suse/IPv6-reply-ICMP-error-if-the-first-fragment-don-t-in.patch
  (bsc#1191241 bsc#1195166).
- Update
  patches.suse/net-ipv6-discard-next-hop-mtu-less-than-minimum-link.patch
  (bsc#1191241 bsc#1195166).
- commit 1d741e6</changelog>
  <changelog author="jbohac@suse.cz" date="1643371200">- xfrm: fix MTU regression (bsc#1185377, bsc#1194048).
- Delete
  patches.suse/xfrm-xfrm_state_mtu-should-return-at-least-1280-for-.patch.
  which caused a regression (bsc#1194048).
- Replace with an alternative fix for bsc#1185377
- commit 3800186</changelog>
  <changelog author="jbohac@suse.cz" date="1643371201">- phonet: refcount leak in pep_sock_accep (bsc#1193867,
  CVE-2021-45095).
- commit 413134f</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1643630400">- net: tipc: validate domain record count on input (bsc#1195254).
- commit eaeeffc</changelog>
  <changelog author="tiwai@suse.de" date="1643630401">- Bluetooth: fix the erroneous flush_work() order (git-fixes).
- commit 9b1f0b0</changelog>
  <changelog author="tiwai@suse.de" date="1643630402">- Update patch reference for BT fix (CVE-2021-3564 bsc#1186207)
- commit ea7857c</changelog>
</package>
<package pkgid="b5bbae05ec9dd77b8eb426e1a51c088d27be05b28af7d7241d82925f13ddfb02" name="kernel-vanilla" arch="s390x">
  <version epoch="0" ver="4.12.14" rel="197.105.1"/>
  <changelog author="jack@suse.cz" date="1643112000">- fget: clarify and improve __fget_files() implementation
  (bsc#1193727).
- commit 3ce5a50</changelog>
  <changelog author="ohering@suse.de" date="1643198400">- net, xdp: Introduce xdp_prepare_buff utility routine
  (bsc#1193506).
- net, xdp: Introduce xdp_init_buff utility routine (bsc#1193506).
- commit 69356ad</changelog>
  <changelog author="ohering@suse.de" date="1643198401">- hv_netvsc: Set needed_headroom according to VF (bsc#1193506).
- commit e6c57eb</changelog>
  <changelog author="ohering@suse.de" date="1643198402">- net: mana: Use kcalloc() instead of kzalloc() (bsc#1193506).
- commit 2e3aed9</changelog>
  <changelog author="ohering@suse.de" date="1643198403">- net: mana: Allow setting the number of queues while the NIC
  is down (bsc#1193506).
- commit ed46d20</changelog>
  <changelog author="ohering@suse.de" date="1643198404">- net: mana: Fix the netdev_err()'s vPort argument in
  mana_init_port() (bsc#1193506).
- commit 4301039</changelog>
  <changelog author="ohering@suse.de" date="1643198405">- net: mana: Improve the HWC error handling (bsc#1193506).
- commit be607da</changelog>
  <changelog author="ohering@suse.de" date="1643198406">- net: mana: Support hibernation and kexec (bsc#1193506).
- commit c664fb6</changelog>
  <changelog author="ohering@suse.de" date="1643198407">- net: mana: Fix spelling mistake "calledd" -&gt; "called"
  (bsc#1193506).
- commit 781000a</changelog>
  <changelog author="ohering@suse.de" date="1643198408">- net: mana: Add XDP support (bsc#1193506).
- commit c395dbf</changelog>
  <changelog author="ohering@suse.de" date="1643198409">- net: mana: Add RX fencing (bsc#1193506).
- commit 4af8516</changelog>
  <changelog author="oneukum@suse.com" date="1643198410">- usb: gadget: configfs: Fix use-after-free issue with udc_name
  (bsc#1193861 CVE-2021-39648).
- commit 9ec119b</changelog>
  <changelog author="oneukum@suse.com" date="1643284800">- scsi: ufs: Correct the LUN used in eh_device_reset_handler()
  callback (bsc#1193864 CVE-2021-39657).
- commit 39c5f8e</changelog>
  <changelog author="tonyj@suse.de" date="1643284801">- bpf: Verifer, adjust_scalar_min_max_vals to always call
  update_reg_bounds() (bsc#1194227).
- commit c098fc7</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1643284802">- Update
  patches.suse/IPv6-reply-ICMP-error-if-the-first-fragment-don-t-in.patch
  (bsc#1191241 bsc#1195166).
- Update
  patches.suse/net-ipv6-discard-next-hop-mtu-less-than-minimum-link.patch
  (bsc#1191241 bsc#1195166).
- commit 1d741e6</changelog>
  <changelog author="jbohac@suse.cz" date="1643371200">- xfrm: fix MTU regression (bsc#1185377, bsc#1194048).
- Delete
  patches.suse/xfrm-xfrm_state_mtu-should-return-at-least-1280-for-.patch.
  which caused a regression (bsc#1194048).
- Replace with an alternative fix for bsc#1185377
- commit 3800186</changelog>
  <changelog author="jbohac@suse.cz" date="1643371201">- phonet: refcount leak in pep_sock_accep (bsc#1193867,
  CVE-2021-45095).
- commit 413134f</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1643630400">- net: tipc: validate domain record count on input (bsc#1195254).
- commit eaeeffc</changelog>
  <changelog author="tiwai@suse.de" date="1643630401">- Bluetooth: fix the erroneous flush_work() order (git-fixes).
- commit 9b1f0b0</changelog>
  <changelog author="tiwai@suse.de" date="1643630402">- Update patch reference for BT fix (CVE-2021-3564 bsc#1186207)
- commit ea7857c</changelog>
</package>
<package pkgid="c621930d14e15e6802cd3a467cf09311752d6eb41ecd1a4357d286d332e38366" name="kernel-vanilla" arch="x86_64">
  <version epoch="0" ver="4.12.14" rel="197.105.1"/>
  <changelog author="jack@suse.cz" date="1643112000">- fget: clarify and improve __fget_files() implementation
  (bsc#1193727).
- commit 3ce5a50</changelog>
  <changelog author="ohering@suse.de" date="1643198400">- net, xdp: Introduce xdp_prepare_buff utility routine
  (bsc#1193506).
- net, xdp: Introduce xdp_init_buff utility routine (bsc#1193506).
- commit 69356ad</changelog>
  <changelog author="ohering@suse.de" date="1643198401">- hv_netvsc: Set needed_headroom according to VF (bsc#1193506).
- commit e6c57eb</changelog>
  <changelog author="ohering@suse.de" date="1643198402">- net: mana: Use kcalloc() instead of kzalloc() (bsc#1193506).
- commit 2e3aed9</changelog>
  <changelog author="ohering@suse.de" date="1643198403">- net: mana: Allow setting the number of queues while the NIC
  is down (bsc#1193506).
- commit ed46d20</changelog>
  <changelog author="ohering@suse.de" date="1643198404">- net: mana: Fix the netdev_err()'s vPort argument in
  mana_init_port() (bsc#1193506).
- commit 4301039</changelog>
  <changelog author="ohering@suse.de" date="1643198405">- net: mana: Improve the HWC error handling (bsc#1193506).
- commit be607da</changelog>
  <changelog author="ohering@suse.de" date="1643198406">- net: mana: Support hibernation and kexec (bsc#1193506).
- commit c664fb6</changelog>
  <changelog author="ohering@suse.de" date="1643198407">- net: mana: Fix spelling mistake "calledd" -&gt; "called"
  (bsc#1193506).
- commit 781000a</changelog>
  <changelog author="ohering@suse.de" date="1643198408">- net: mana: Add XDP support (bsc#1193506).
- commit c395dbf</changelog>
  <changelog author="ohering@suse.de" date="1643198409">- net: mana: Add RX fencing (bsc#1193506).
- commit 4af8516</changelog>
  <changelog author="oneukum@suse.com" date="1643198410">- usb: gadget: configfs: Fix use-after-free issue with udc_name
  (bsc#1193861 CVE-2021-39648).
- commit 9ec119b</changelog>
  <changelog author="oneukum@suse.com" date="1643284800">- scsi: ufs: Correct the LUN used in eh_device_reset_handler()
  callback (bsc#1193864 CVE-2021-39657).
- commit 39c5f8e</changelog>
  <changelog author="tonyj@suse.de" date="1643284801">- bpf: Verifer, adjust_scalar_min_max_vals to always call
  update_reg_bounds() (bsc#1194227).
- commit c098fc7</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1643284802">- Update
  patches.suse/IPv6-reply-ICMP-error-if-the-first-fragment-don-t-in.patch
  (bsc#1191241 bsc#1195166).
- Update
  patches.suse/net-ipv6-discard-next-hop-mtu-less-than-minimum-link.patch
  (bsc#1191241 bsc#1195166).
- commit 1d741e6</changelog>
  <changelog author="jbohac@suse.cz" date="1643371200">- xfrm: fix MTU regression (bsc#1185377, bsc#1194048).
- Delete
  patches.suse/xfrm-xfrm_state_mtu-should-return-at-least-1280-for-.patch.
  which caused a regression (bsc#1194048).
- Replace with an alternative fix for bsc#1185377
- commit 3800186</changelog>
  <changelog author="jbohac@suse.cz" date="1643371201">- phonet: refcount leak in pep_sock_accep (bsc#1193867,
  CVE-2021-45095).
- commit 413134f</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1643630400">- net: tipc: validate domain record count on input (bsc#1195254).
- commit eaeeffc</changelog>
  <changelog author="tiwai@suse.de" date="1643630401">- Bluetooth: fix the erroneous flush_work() order (git-fixes).
- commit 9b1f0b0</changelog>
  <changelog author="tiwai@suse.de" date="1643630402">- Update patch reference for BT fix (CVE-2021-3564 bsc#1186207)
- commit ea7857c</changelog>
</package>
<package pkgid="8b556313a9684befd0564f4e815408e826b4877f1452f109fc40729e74268bee" name="kernel-vanilla-base" arch="aarch64">
  <version epoch="0" ver="4.12.14" rel="197.105.1"/>
  <changelog author="jack@suse.cz" date="1643112000">- fget: clarify and improve __fget_files() implementation
  (bsc#1193727).
- commit 3ce5a50</changelog>
  <changelog author="ohering@suse.de" date="1643198400">- net, xdp: Introduce xdp_prepare_buff utility routine
  (bsc#1193506).
- net, xdp: Introduce xdp_init_buff utility routine (bsc#1193506).
- commit 69356ad</changelog>
  <changelog author="ohering@suse.de" date="1643198401">- hv_netvsc: Set needed_headroom according to VF (bsc#1193506).
- commit e6c57eb</changelog>
  <changelog author="ohering@suse.de" date="1643198402">- net: mana: Use kcalloc() instead of kzalloc() (bsc#1193506).
- commit 2e3aed9</changelog>
  <changelog author="ohering@suse.de" date="1643198403">- net: mana: Allow setting the number of queues while the NIC
  is down (bsc#1193506).
- commit ed46d20</changelog>
  <changelog author="ohering@suse.de" date="1643198404">- net: mana: Fix the netdev_err()'s vPort argument in
  mana_init_port() (bsc#1193506).
- commit 4301039</changelog>
  <changelog author="ohering@suse.de" date="1643198405">- net: mana: Improve the HWC error handling (bsc#1193506).
- commit be607da</changelog>
  <changelog author="ohering@suse.de" date="1643198406">- net: mana: Support hibernation and kexec (bsc#1193506).
- commit c664fb6</changelog>
  <changelog author="ohering@suse.de" date="1643198407">- net: mana: Fix spelling mistake "calledd" -&gt; "called"
  (bsc#1193506).
- commit 781000a</changelog>
  <changelog author="ohering@suse.de" date="1643198408">- net: mana: Add XDP support (bsc#1193506).
- commit c395dbf</changelog>
  <changelog author="ohering@suse.de" date="1643198409">- net: mana: Add RX fencing (bsc#1193506).
- commit 4af8516</changelog>
  <changelog author="oneukum@suse.com" date="1643198410">- usb: gadget: configfs: Fix use-after-free issue with udc_name
  (bsc#1193861 CVE-2021-39648).
- commit 9ec119b</changelog>
  <changelog author="oneukum@suse.com" date="1643284800">- scsi: ufs: Correct the LUN used in eh_device_reset_handler()
  callback (bsc#1193864 CVE-2021-39657).
- commit 39c5f8e</changelog>
  <changelog author="tonyj@suse.de" date="1643284801">- bpf: Verifer, adjust_scalar_min_max_vals to always call
  update_reg_bounds() (bsc#1194227).
- commit c098fc7</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1643284802">- Update
  patches.suse/IPv6-reply-ICMP-error-if-the-first-fragment-don-t-in.patch
  (bsc#1191241 bsc#1195166).
- Update
  patches.suse/net-ipv6-discard-next-hop-mtu-less-than-minimum-link.patch
  (bsc#1191241 bsc#1195166).
- commit 1d741e6</changelog>
  <changelog author="jbohac@suse.cz" date="1643371200">- xfrm: fix MTU regression (bsc#1185377, bsc#1194048).
- Delete
  patches.suse/xfrm-xfrm_state_mtu-should-return-at-least-1280-for-.patch.
  which caused a regression (bsc#1194048).
- Replace with an alternative fix for bsc#1185377
- commit 3800186</changelog>
  <changelog author="jbohac@suse.cz" date="1643371201">- phonet: refcount leak in pep_sock_accep (bsc#1193867,
  CVE-2021-45095).
- commit 413134f</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1643630400">- net: tipc: validate domain record count on input (bsc#1195254).
- commit eaeeffc</changelog>
  <changelog author="tiwai@suse.de" date="1643630401">- Bluetooth: fix the erroneous flush_work() order (git-fixes).
- commit 9b1f0b0</changelog>
  <changelog author="tiwai@suse.de" date="1643630402">- Update patch reference for BT fix (CVE-2021-3564 bsc#1186207)
- commit ea7857c</changelog>
</package>
<package pkgid="cc069f923871a067ed303bacf9838dd59d472ac5788e1f41269dec222ae01284" name="kernel-vanilla-base" arch="ppc64le">
  <version epoch="0" ver="4.12.14" rel="197.105.1"/>
  <changelog author="jack@suse.cz" date="1643112000">- fget: clarify and improve __fget_files() implementation
  (bsc#1193727).
- commit 3ce5a50</changelog>
  <changelog author="ohering@suse.de" date="1643198400">- net, xdp: Introduce xdp_prepare_buff utility routine
  (bsc#1193506).
- net, xdp: Introduce xdp_init_buff utility routine (bsc#1193506).
- commit 69356ad</changelog>
  <changelog author="ohering@suse.de" date="1643198401">- hv_netvsc: Set needed_headroom according to VF (bsc#1193506).
- commit e6c57eb</changelog>
  <changelog author="ohering@suse.de" date="1643198402">- net: mana: Use kcalloc() instead of kzalloc() (bsc#1193506).
- commit 2e3aed9</changelog>
  <changelog author="ohering@suse.de" date="1643198403">- net: mana: Allow setting the number of queues while the NIC
  is down (bsc#1193506).
- commit ed46d20</changelog>
  <changelog author="ohering@suse.de" date="1643198404">- net: mana: Fix the netdev_err()'s vPort argument in
  mana_init_port() (bsc#1193506).
- commit 4301039</changelog>
  <changelog author="ohering@suse.de" date="1643198405">- net: mana: Improve the HWC error handling (bsc#1193506).
- commit be607da</changelog>
  <changelog author="ohering@suse.de" date="1643198406">- net: mana: Support hibernation and kexec (bsc#1193506).
- commit c664fb6</changelog>
  <changelog author="ohering@suse.de" date="1643198407">- net: mana: Fix spelling mistake "calledd" -&gt; "called"
  (bsc#1193506).
- commit 781000a</changelog>
  <changelog author="ohering@suse.de" date="1643198408">- net: mana: Add XDP support (bsc#1193506).
- commit c395dbf</changelog>
  <changelog author="ohering@suse.de" date="1643198409">- net: mana: Add RX fencing (bsc#1193506).
- commit 4af8516</changelog>
  <changelog author="oneukum@suse.com" date="1643198410">- usb: gadget: configfs: Fix use-after-free issue with udc_name
  (bsc#1193861 CVE-2021-39648).
- commit 9ec119b</changelog>
  <changelog author="oneukum@suse.com" date="1643284800">- scsi: ufs: Correct the LUN used in eh_device_reset_handler()
  callback (bsc#1193864 CVE-2021-39657).
- commit 39c5f8e</changelog>
  <changelog author="tonyj@suse.de" date="1643284801">- bpf: Verifer, adjust_scalar_min_max_vals to always call
  update_reg_bounds() (bsc#1194227).
- commit c098fc7</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1643284802">- Update
  patches.suse/IPv6-reply-ICMP-error-if-the-first-fragment-don-t-in.patch
  (bsc#1191241 bsc#1195166).
- Update
  patches.suse/net-ipv6-discard-next-hop-mtu-less-than-minimum-link.patch
  (bsc#1191241 bsc#1195166).
- commit 1d741e6</changelog>
  <changelog author="jbohac@suse.cz" date="1643371200">- xfrm: fix MTU regression (bsc#1185377, bsc#1194048).
- Delete
  patches.suse/xfrm-xfrm_state_mtu-should-return-at-least-1280-for-.patch.
  which caused a regression (bsc#1194048).
- Replace with an alternative fix for bsc#1185377
- commit 3800186</changelog>
  <changelog author="jbohac@suse.cz" date="1643371201">- phonet: refcount leak in pep_sock_accep (bsc#1193867,
  CVE-2021-45095).
- commit 413134f</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1643630400">- net: tipc: validate domain record count on input (bsc#1195254).
- commit eaeeffc</changelog>
  <changelog author="tiwai@suse.de" date="1643630401">- Bluetooth: fix the erroneous flush_work() order (git-fixes).
- commit 9b1f0b0</changelog>
  <changelog author="tiwai@suse.de" date="1643630402">- Update patch reference for BT fix (CVE-2021-3564 bsc#1186207)
- commit ea7857c</changelog>
</package>
<package pkgid="9b383d337e76b41ddc9bc4bd0ab0dfe1585547a82acdd665572c361cc730f9b6" name="kernel-vanilla-base" arch="s390x">
  <version epoch="0" ver="4.12.14" rel="197.105.1"/>
  <changelog author="jack@suse.cz" date="1643112000">- fget: clarify and improve __fget_files() implementation
  (bsc#1193727).
- commit 3ce5a50</changelog>
  <changelog author="ohering@suse.de" date="1643198400">- net, xdp: Introduce xdp_prepare_buff utility routine
  (bsc#1193506).
- net, xdp: Introduce xdp_init_buff utility routine (bsc#1193506).
- commit 69356ad</changelog>
  <changelog author="ohering@suse.de" date="1643198401">- hv_netvsc: Set needed_headroom according to VF (bsc#1193506).
- commit e6c57eb</changelog>
  <changelog author="ohering@suse.de" date="1643198402">- net: mana: Use kcalloc() instead of kzalloc() (bsc#1193506).
- commit 2e3aed9</changelog>
  <changelog author="ohering@suse.de" date="1643198403">- net: mana: Allow setting the number of queues while the NIC
  is down (bsc#1193506).
- commit ed46d20</changelog>
  <changelog author="ohering@suse.de" date="1643198404">- net: mana: Fix the netdev_err()'s vPort argument in
  mana_init_port() (bsc#1193506).
- commit 4301039</changelog>
  <changelog author="ohering@suse.de" date="1643198405">- net: mana: Improve the HWC error handling (bsc#1193506).
- commit be607da</changelog>
  <changelog author="ohering@suse.de" date="1643198406">- net: mana: Support hibernation and kexec (bsc#1193506).
- commit c664fb6</changelog>
  <changelog author="ohering@suse.de" date="1643198407">- net: mana: Fix spelling mistake "calledd" -&gt; "called"
  (bsc#1193506).
- commit 781000a</changelog>
  <changelog author="ohering@suse.de" date="1643198408">- net: mana: Add XDP support (bsc#1193506).
- commit c395dbf</changelog>
  <changelog author="ohering@suse.de" date="1643198409">- net: mana: Add RX fencing (bsc#1193506).
- commit 4af8516</changelog>
  <changelog author="oneukum@suse.com" date="1643198410">- usb: gadget: configfs: Fix use-after-free issue with udc_name
  (bsc#1193861 CVE-2021-39648).
- commit 9ec119b</changelog>
  <changelog author="oneukum@suse.com" date="1643284800">- scsi: ufs: Correct the LUN used in eh_device_reset_handler()
  callback (bsc#1193864 CVE-2021-39657).
- commit 39c5f8e</changelog>
  <changelog author="tonyj@suse.de" date="1643284801">- bpf: Verifer, adjust_scalar_min_max_vals to always call
  update_reg_bounds() (bsc#1194227).
- commit c098fc7</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1643284802">- Update
  patches.suse/IPv6-reply-ICMP-error-if-the-first-fragment-don-t-in.patch
  (bsc#1191241 bsc#1195166).
- Update
  patches.suse/net-ipv6-discard-next-hop-mtu-less-than-minimum-link.patch
  (bsc#1191241 bsc#1195166).
- commit 1d741e6</changelog>
  <changelog author="jbohac@suse.cz" date="1643371200">- xfrm: fix MTU regression (bsc#1185377, bsc#1194048).
- Delete
  patches.suse/xfrm-xfrm_state_mtu-should-return-at-least-1280-for-.patch.
  which caused a regression (bsc#1194048).
- Replace with an alternative fix for bsc#1185377
- commit 3800186</changelog>
  <changelog author="jbohac@suse.cz" date="1643371201">- phonet: refcount leak in pep_sock_accep (bsc#1193867,
  CVE-2021-45095).
- commit 413134f</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1643630400">- net: tipc: validate domain record count on input (bsc#1195254).
- commit eaeeffc</changelog>
  <changelog author="tiwai@suse.de" date="1643630401">- Bluetooth: fix the erroneous flush_work() order (git-fixes).
- commit 9b1f0b0</changelog>
  <changelog author="tiwai@suse.de" date="1643630402">- Update patch reference for BT fix (CVE-2021-3564 bsc#1186207)
- commit ea7857c</changelog>
</package>
<package pkgid="8940089b0a609c15da68b3d490d5490ddb280d47a172cc705c2e426b1860695d" name="kernel-vanilla-base" arch="x86_64">
  <version epoch="0" ver="4.12.14" rel="197.105.1"/>
  <changelog author="jack@suse.cz" date="1643112000">- fget: clarify and improve __fget_files() implementation
  (bsc#1193727).
- commit 3ce5a50</changelog>
  <changelog author="ohering@suse.de" date="1643198400">- net, xdp: Introduce xdp_prepare_buff utility routine
  (bsc#1193506).
- net, xdp: Introduce xdp_init_buff utility routine (bsc#1193506).
- commit 69356ad</changelog>
  <changelog author="ohering@suse.de" date="1643198401">- hv_netvsc: Set needed_headroom according to VF (bsc#1193506).
- commit e6c57eb</changelog>
  <changelog author="ohering@suse.de" date="1643198402">- net: mana: Use kcalloc() instead of kzalloc() (bsc#1193506).
- commit 2e3aed9</changelog>
  <changelog author="ohering@suse.de" date="1643198403">- net: mana: Allow setting the number of queues while the NIC
  is down (bsc#1193506).
- commit ed46d20</changelog>
  <changelog author="ohering@suse.de" date="1643198404">- net: mana: Fix the netdev_err()'s vPort argument in
  mana_init_port() (bsc#1193506).
- commit 4301039</changelog>
  <changelog author="ohering@suse.de" date="1643198405">- net: mana: Improve the HWC error handling (bsc#1193506).
- commit be607da</changelog>
  <changelog author="ohering@suse.de" date="1643198406">- net: mana: Support hibernation and kexec (bsc#1193506).
- commit c664fb6</changelog>
  <changelog author="ohering@suse.de" date="1643198407">- net: mana: Fix spelling mistake "calledd" -&gt; "called"
  (bsc#1193506).
- commit 781000a</changelog>
  <changelog author="ohering@suse.de" date="1643198408">- net: mana: Add XDP support (bsc#1193506).
- commit c395dbf</changelog>
  <changelog author="ohering@suse.de" date="1643198409">- net: mana: Add RX fencing (bsc#1193506).
- commit 4af8516</changelog>
  <changelog author="oneukum@suse.com" date="1643198410">- usb: gadget: configfs: Fix use-after-free issue with udc_name
  (bsc#1193861 CVE-2021-39648).
- commit 9ec119b</changelog>
  <changelog author="oneukum@suse.com" date="1643284800">- scsi: ufs: Correct the LUN used in eh_device_reset_handler()
  callback (bsc#1193864 CVE-2021-39657).
- commit 39c5f8e</changelog>
  <changelog author="tonyj@suse.de" date="1643284801">- bpf: Verifer, adjust_scalar_min_max_vals to always call
  update_reg_bounds() (bsc#1194227).
- commit c098fc7</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1643284802">- Update
  patches.suse/IPv6-reply-ICMP-error-if-the-first-fragment-don-t-in.patch
  (bsc#1191241 bsc#1195166).
- Update
  patches.suse/net-ipv6-discard-next-hop-mtu-less-than-minimum-link.patch
  (bsc#1191241 bsc#1195166).
- commit 1d741e6</changelog>
  <changelog author="jbohac@suse.cz" date="1643371200">- xfrm: fix MTU regression (bsc#1185377, bsc#1194048).
- Delete
  patches.suse/xfrm-xfrm_state_mtu-should-return-at-least-1280-for-.patch.
  which caused a regression (bsc#1194048).
- Replace with an alternative fix for bsc#1185377
- commit 3800186</changelog>
  <changelog author="jbohac@suse.cz" date="1643371201">- phonet: refcount leak in pep_sock_accep (bsc#1193867,
  CVE-2021-45095).
- commit 413134f</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1643630400">- net: tipc: validate domain record count on input (bsc#1195254).
- commit eaeeffc</changelog>
  <changelog author="tiwai@suse.de" date="1643630401">- Bluetooth: fix the erroneous flush_work() order (git-fixes).
- commit 9b1f0b0</changelog>
  <changelog author="tiwai@suse.de" date="1643630402">- Update patch reference for BT fix (CVE-2021-3564 bsc#1186207)
- commit ea7857c</changelog>
</package>
<package pkgid="993639da6116c1185248dcc1e3bd07e1d8b1ea84af65d8b41f07de246cea8c9a" name="kernel-vanilla-devel" arch="aarch64">
  <version epoch="0" ver="4.12.14" rel="197.105.1"/>
  <changelog author="jack@suse.cz" date="1643112000">- fget: clarify and improve __fget_files() implementation
  (bsc#1193727).
- commit 3ce5a50</changelog>
  <changelog author="ohering@suse.de" date="1643198400">- net, xdp: Introduce xdp_prepare_buff utility routine
  (bsc#1193506).
- net, xdp: Introduce xdp_init_buff utility routine (bsc#1193506).
- commit 69356ad</changelog>
  <changelog author="ohering@suse.de" date="1643198401">- hv_netvsc: Set needed_headroom according to VF (bsc#1193506).
- commit e6c57eb</changelog>
  <changelog author="ohering@suse.de" date="1643198402">- net: mana: Use kcalloc() instead of kzalloc() (bsc#1193506).
- commit 2e3aed9</changelog>
  <changelog author="ohering@suse.de" date="1643198403">- net: mana: Allow setting the number of queues while the NIC
  is down (bsc#1193506).
- commit ed46d20</changelog>
  <changelog author="ohering@suse.de" date="1643198404">- net: mana: Fix the netdev_err()'s vPort argument in
  mana_init_port() (bsc#1193506).
- commit 4301039</changelog>
  <changelog author="ohering@suse.de" date="1643198405">- net: mana: Improve the HWC error handling (bsc#1193506).
- commit be607da</changelog>
  <changelog author="ohering@suse.de" date="1643198406">- net: mana: Support hibernation and kexec (bsc#1193506).
- commit c664fb6</changelog>
  <changelog author="ohering@suse.de" date="1643198407">- net: mana: Fix spelling mistake "calledd" -&gt; "called"
  (bsc#1193506).
- commit 781000a</changelog>
  <changelog author="ohering@suse.de" date="1643198408">- net: mana: Add XDP support (bsc#1193506).
- commit c395dbf</changelog>
  <changelog author="ohering@suse.de" date="1643198409">- net: mana: Add RX fencing (bsc#1193506).
- commit 4af8516</changelog>
  <changelog author="oneukum@suse.com" date="1643198410">- usb: gadget: configfs: Fix use-after-free issue with udc_name
  (bsc#1193861 CVE-2021-39648).
- commit 9ec119b</changelog>
  <changelog author="oneukum@suse.com" date="1643284800">- scsi: ufs: Correct the LUN used in eh_device_reset_handler()
  callback (bsc#1193864 CVE-2021-39657).
- commit 39c5f8e</changelog>
  <changelog author="tonyj@suse.de" date="1643284801">- bpf: Verifer, adjust_scalar_min_max_vals to always call
  update_reg_bounds() (bsc#1194227).
- commit c098fc7</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1643284802">- Update
  patches.suse/IPv6-reply-ICMP-error-if-the-first-fragment-don-t-in.patch
  (bsc#1191241 bsc#1195166).
- Update
  patches.suse/net-ipv6-discard-next-hop-mtu-less-than-minimum-link.patch
  (bsc#1191241 bsc#1195166).
- commit 1d741e6</changelog>
  <changelog author="jbohac@suse.cz" date="1643371200">- xfrm: fix MTU regression (bsc#1185377, bsc#1194048).
- Delete
  patches.suse/xfrm-xfrm_state_mtu-should-return-at-least-1280-for-.patch.
  which caused a regression (bsc#1194048).
- Replace with an alternative fix for bsc#1185377
- commit 3800186</changelog>
  <changelog author="jbohac@suse.cz" date="1643371201">- phonet: refcount leak in pep_sock_accep (bsc#1193867,
  CVE-2021-45095).
- commit 413134f</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1643630400">- net: tipc: validate domain record count on input (bsc#1195254).
- commit eaeeffc</changelog>
  <changelog author="tiwai@suse.de" date="1643630401">- Bluetooth: fix the erroneous flush_work() order (git-fixes).
- commit 9b1f0b0</changelog>
  <changelog author="tiwai@suse.de" date="1643630402">- Update patch reference for BT fix (CVE-2021-3564 bsc#1186207)
- commit ea7857c</changelog>
</package>
<package pkgid="7df9f2f986b68be169a879e9f85047ff7a6122b693599259b246d044aafe4ccb" name="kernel-vanilla-devel" arch="ppc64le">
  <version epoch="0" ver="4.12.14" rel="197.105.1"/>
  <changelog author="jack@suse.cz" date="1643112000">- fget: clarify and improve __fget_files() implementation
  (bsc#1193727).
- commit 3ce5a50</changelog>
  <changelog author="ohering@suse.de" date="1643198400">- net, xdp: Introduce xdp_prepare_buff utility routine
  (bsc#1193506).
- net, xdp: Introduce xdp_init_buff utility routine (bsc#1193506).
- commit 69356ad</changelog>
  <changelog author="ohering@suse.de" date="1643198401">- hv_netvsc: Set needed_headroom according to VF (bsc#1193506).
- commit e6c57eb</changelog>
  <changelog author="ohering@suse.de" date="1643198402">- net: mana: Use kcalloc() instead of kzalloc() (bsc#1193506).
- commit 2e3aed9</changelog>
  <changelog author="ohering@suse.de" date="1643198403">- net: mana: Allow setting the number of queues while the NIC
  is down (bsc#1193506).
- commit ed46d20</changelog>
  <changelog author="ohering@suse.de" date="1643198404">- net: mana: Fix the netdev_err()'s vPort argument in
  mana_init_port() (bsc#1193506).
- commit 4301039</changelog>
  <changelog author="ohering@suse.de" date="1643198405">- net: mana: Improve the HWC error handling (bsc#1193506).
- commit be607da</changelog>
  <changelog author="ohering@suse.de" date="1643198406">- net: mana: Support hibernation and kexec (bsc#1193506).
- commit c664fb6</changelog>
  <changelog author="ohering@suse.de" date="1643198407">- net: mana: Fix spelling mistake "calledd" -&gt; "called"
  (bsc#1193506).
- commit 781000a</changelog>
  <changelog author="ohering@suse.de" date="1643198408">- net: mana: Add XDP support (bsc#1193506).
- commit c395dbf</changelog>
  <changelog author="ohering@suse.de" date="1643198409">- net: mana: Add RX fencing (bsc#1193506).
- commit 4af8516</changelog>
  <changelog author="oneukum@suse.com" date="1643198410">- usb: gadget: configfs: Fix use-after-free issue with udc_name
  (bsc#1193861 CVE-2021-39648).
- commit 9ec119b</changelog>
  <changelog author="oneukum@suse.com" date="1643284800">- scsi: ufs: Correct the LUN used in eh_device_reset_handler()
  callback (bsc#1193864 CVE-2021-39657).
- commit 39c5f8e</changelog>
  <changelog author="tonyj@suse.de" date="1643284801">- bpf: Verifer, adjust_scalar_min_max_vals to always call
  update_reg_bounds() (bsc#1194227).
- commit c098fc7</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1643284802">- Update
  patches.suse/IPv6-reply-ICMP-error-if-the-first-fragment-don-t-in.patch
  (bsc#1191241 bsc#1195166).
- Update
  patches.suse/net-ipv6-discard-next-hop-mtu-less-than-minimum-link.patch
  (bsc#1191241 bsc#1195166).
- commit 1d741e6</changelog>
  <changelog author="jbohac@suse.cz" date="1643371200">- xfrm: fix MTU regression (bsc#1185377, bsc#1194048).
- Delete
  patches.suse/xfrm-xfrm_state_mtu-should-return-at-least-1280-for-.patch.
  which caused a regression (bsc#1194048).
- Replace with an alternative fix for bsc#1185377
- commit 3800186</changelog>
  <changelog author="jbohac@suse.cz" date="1643371201">- phonet: refcount leak in pep_sock_accep (bsc#1193867,
  CVE-2021-45095).
- commit 413134f</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1643630400">- net: tipc: validate domain record count on input (bsc#1195254).
- commit eaeeffc</changelog>
  <changelog author="tiwai@suse.de" date="1643630401">- Bluetooth: fix the erroneous flush_work() order (git-fixes).
- commit 9b1f0b0</changelog>
  <changelog author="tiwai@suse.de" date="1643630402">- Update patch reference for BT fix (CVE-2021-3564 bsc#1186207)
- commit ea7857c</changelog>
</package>
<package pkgid="0ade494e6ac7fa5c03c0a24a8221d1707336ce930e466ad18d9d6cebc7c0a388" name="kernel-vanilla-devel" arch="s390x">
  <version epoch="0" ver="4.12.14" rel="197.105.1"/>
  <changelog author="jack@suse.cz" date="1643112000">- fget: clarify and improve __fget_files() implementation
  (bsc#1193727).
- commit 3ce5a50</changelog>
  <changelog author="ohering@suse.de" date="1643198400">- net, xdp: Introduce xdp_prepare_buff utility routine
  (bsc#1193506).
- net, xdp: Introduce xdp_init_buff utility routine (bsc#1193506).
- commit 69356ad</changelog>
  <changelog author="ohering@suse.de" date="1643198401">- hv_netvsc: Set needed_headroom according to VF (bsc#1193506).
- commit e6c57eb</changelog>
  <changelog author="ohering@suse.de" date="1643198402">- net: mana: Use kcalloc() instead of kzalloc() (bsc#1193506).
- commit 2e3aed9</changelog>
  <changelog author="ohering@suse.de" date="1643198403">- net: mana: Allow setting the number of queues while the NIC
  is down (bsc#1193506).
- commit ed46d20</changelog>
  <changelog author="ohering@suse.de" date="1643198404">- net: mana: Fix the netdev_err()'s vPort argument in
  mana_init_port() (bsc#1193506).
- commit 4301039</changelog>
  <changelog author="ohering@suse.de" date="1643198405">- net: mana: Improve the HWC error handling (bsc#1193506).
- commit be607da</changelog>
  <changelog author="ohering@suse.de" date="1643198406">- net: mana: Support hibernation and kexec (bsc#1193506).
- commit c664fb6</changelog>
  <changelog author="ohering@suse.de" date="1643198407">- net: mana: Fix spelling mistake "calledd" -&gt; "called"
  (bsc#1193506).
- commit 781000a</changelog>
  <changelog author="ohering@suse.de" date="1643198408">- net: mana: Add XDP support (bsc#1193506).
- commit c395dbf</changelog>
  <changelog author="ohering@suse.de" date="1643198409">- net: mana: Add RX fencing (bsc#1193506).
- commit 4af8516</changelog>
  <changelog author="oneukum@suse.com" date="1643198410">- usb: gadget: configfs: Fix use-after-free issue with udc_name
  (bsc#1193861 CVE-2021-39648).
- commit 9ec119b</changelog>
  <changelog author="oneukum@suse.com" date="1643284800">- scsi: ufs: Correct the LUN used in eh_device_reset_handler()
  callback (bsc#1193864 CVE-2021-39657).
- commit 39c5f8e</changelog>
  <changelog author="tonyj@suse.de" date="1643284801">- bpf: Verifer, adjust_scalar_min_max_vals to always call
  update_reg_bounds() (bsc#1194227).
- commit c098fc7</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1643284802">- Update
  patches.suse/IPv6-reply-ICMP-error-if-the-first-fragment-don-t-in.patch
  (bsc#1191241 bsc#1195166).
- Update
  patches.suse/net-ipv6-discard-next-hop-mtu-less-than-minimum-link.patch
  (bsc#1191241 bsc#1195166).
- commit 1d741e6</changelog>
  <changelog author="jbohac@suse.cz" date="1643371200">- xfrm: fix MTU regression (bsc#1185377, bsc#1194048).
- Delete
  patches.suse/xfrm-xfrm_state_mtu-should-return-at-least-1280-for-.patch.
  which caused a regression (bsc#1194048).
- Replace with an alternative fix for bsc#1185377
- commit 3800186</changelog>
  <changelog author="jbohac@suse.cz" date="1643371201">- phonet: refcount leak in pep_sock_accep (bsc#1193867,
  CVE-2021-45095).
- commit 413134f</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1643630400">- net: tipc: validate domain record count on input (bsc#1195254).
- commit eaeeffc</changelog>
  <changelog author="tiwai@suse.de" date="1643630401">- Bluetooth: fix the erroneous flush_work() order (git-fixes).
- commit 9b1f0b0</changelog>
  <changelog author="tiwai@suse.de" date="1643630402">- Update patch reference for BT fix (CVE-2021-3564 bsc#1186207)
- commit ea7857c</changelog>
</package>
<package pkgid="e18eec161affcb852efb633b7f55182c3212222a0aff3280c2aa08ea55724f21" name="kernel-vanilla-devel" arch="x86_64">
  <version epoch="0" ver="4.12.14" rel="197.105.1"/>
  <changelog author="jack@suse.cz" date="1643112000">- fget: clarify and improve __fget_files() implementation
  (bsc#1193727).
- commit 3ce5a50</changelog>
  <changelog author="ohering@suse.de" date="1643198400">- net, xdp: Introduce xdp_prepare_buff utility routine
  (bsc#1193506).
- net, xdp: Introduce xdp_init_buff utility routine (bsc#1193506).
- commit 69356ad</changelog>
  <changelog author="ohering@suse.de" date="1643198401">- hv_netvsc: Set needed_headroom according to VF (bsc#1193506).
- commit e6c57eb</changelog>
  <changelog author="ohering@suse.de" date="1643198402">- net: mana: Use kcalloc() instead of kzalloc() (bsc#1193506).
- commit 2e3aed9</changelog>
  <changelog author="ohering@suse.de" date="1643198403">- net: mana: Allow setting the number of queues while the NIC
  is down (bsc#1193506).
- commit ed46d20</changelog>
  <changelog author="ohering@suse.de" date="1643198404">- net: mana: Fix the netdev_err()'s vPort argument in
  mana_init_port() (bsc#1193506).
- commit 4301039</changelog>
  <changelog author="ohering@suse.de" date="1643198405">- net: mana: Improve the HWC error handling (bsc#1193506).
- commit be607da</changelog>
  <changelog author="ohering@suse.de" date="1643198406">- net: mana: Support hibernation and kexec (bsc#1193506).
- commit c664fb6</changelog>
  <changelog author="ohering@suse.de" date="1643198407">- net: mana: Fix spelling mistake "calledd" -&gt; "called"
  (bsc#1193506).
- commit 781000a</changelog>
  <changelog author="ohering@suse.de" date="1643198408">- net: mana: Add XDP support (bsc#1193506).
- commit c395dbf</changelog>
  <changelog author="ohering@suse.de" date="1643198409">- net: mana: Add RX fencing (bsc#1193506).
- commit 4af8516</changelog>
  <changelog author="oneukum@suse.com" date="1643198410">- usb: gadget: configfs: Fix use-after-free issue with udc_name
  (bsc#1193861 CVE-2021-39648).
- commit 9ec119b</changelog>
  <changelog author="oneukum@suse.com" date="1643284800">- scsi: ufs: Correct the LUN used in eh_device_reset_handler()
  callback (bsc#1193864 CVE-2021-39657).
- commit 39c5f8e</changelog>
  <changelog author="tonyj@suse.de" date="1643284801">- bpf: Verifer, adjust_scalar_min_max_vals to always call
  update_reg_bounds() (bsc#1194227).
- commit c098fc7</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1643284802">- Update
  patches.suse/IPv6-reply-ICMP-error-if-the-first-fragment-don-t-in.patch
  (bsc#1191241 bsc#1195166).
- Update
  patches.suse/net-ipv6-discard-next-hop-mtu-less-than-minimum-link.patch
  (bsc#1191241 bsc#1195166).
- commit 1d741e6</changelog>
  <changelog author="jbohac@suse.cz" date="1643371200">- xfrm: fix MTU regression (bsc#1185377, bsc#1194048).
- Delete
  patches.suse/xfrm-xfrm_state_mtu-should-return-at-least-1280-for-.patch.
  which caused a regression (bsc#1194048).
- Replace with an alternative fix for bsc#1185377
- commit 3800186</changelog>
  <changelog author="jbohac@suse.cz" date="1643371201">- phonet: refcount leak in pep_sock_accep (bsc#1193867,
  CVE-2021-45095).
- commit 413134f</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1643630400">- net: tipc: validate domain record count on input (bsc#1195254).
- commit eaeeffc</changelog>
  <changelog author="tiwai@suse.de" date="1643630401">- Bluetooth: fix the erroneous flush_work() order (git-fixes).
- commit 9b1f0b0</changelog>
  <changelog author="tiwai@suse.de" date="1643630402">- Update patch reference for BT fix (CVE-2021-3564 bsc#1186207)
- commit ea7857c</changelog>
</package>
<package pkgid="56743c47dcc1c651f6c4f2bbc03d5ab080510ea6294062d264c1611e5b82d607" name="kernel-vanilla-livepatch-devel" arch="aarch64">
  <version epoch="0" ver="4.12.14" rel="197.105.1"/>
  <changelog author="jack@suse.cz" date="1643112000">- fget: clarify and improve __fget_files() implementation
  (bsc#1193727).
- commit 3ce5a50</changelog>
  <changelog author="ohering@suse.de" date="1643198400">- net, xdp: Introduce xdp_prepare_buff utility routine
  (bsc#1193506).
- net, xdp: Introduce xdp_init_buff utility routine (bsc#1193506).
- commit 69356ad</changelog>
  <changelog author="ohering@suse.de" date="1643198401">- hv_netvsc: Set needed_headroom according to VF (bsc#1193506).
- commit e6c57eb</changelog>
  <changelog author="ohering@suse.de" date="1643198402">- net: mana: Use kcalloc() instead of kzalloc() (bsc#1193506).
- commit 2e3aed9</changelog>
  <changelog author="ohering@suse.de" date="1643198403">- net: mana: Allow setting the number of queues while the NIC
  is down (bsc#1193506).
- commit ed46d20</changelog>
  <changelog author="ohering@suse.de" date="1643198404">- net: mana: Fix the netdev_err()'s vPort argument in
  mana_init_port() (bsc#1193506).
- commit 4301039</changelog>
  <changelog author="ohering@suse.de" date="1643198405">- net: mana: Improve the HWC error handling (bsc#1193506).
- commit be607da</changelog>
  <changelog author="ohering@suse.de" date="1643198406">- net: mana: Support hibernation and kexec (bsc#1193506).
- commit c664fb6</changelog>
  <changelog author="ohering@suse.de" date="1643198407">- net: mana: Fix spelling mistake "calledd" -&gt; "called"
  (bsc#1193506).
- commit 781000a</changelog>
  <changelog author="ohering@suse.de" date="1643198408">- net: mana: Add XDP support (bsc#1193506).
- commit c395dbf</changelog>
  <changelog author="ohering@suse.de" date="1643198409">- net: mana: Add RX fencing (bsc#1193506).
- commit 4af8516</changelog>
  <changelog author="oneukum@suse.com" date="1643198410">- usb: gadget: configfs: Fix use-after-free issue with udc_name
  (bsc#1193861 CVE-2021-39648).
- commit 9ec119b</changelog>
  <changelog author="oneukum@suse.com" date="1643284800">- scsi: ufs: Correct the LUN used in eh_device_reset_handler()
  callback (bsc#1193864 CVE-2021-39657).
- commit 39c5f8e</changelog>
  <changelog author="tonyj@suse.de" date="1643284801">- bpf: Verifer, adjust_scalar_min_max_vals to always call
  update_reg_bounds() (bsc#1194227).
- commit c098fc7</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1643284802">- Update
  patches.suse/IPv6-reply-ICMP-error-if-the-first-fragment-don-t-in.patch
  (bsc#1191241 bsc#1195166).
- Update
  patches.suse/net-ipv6-discard-next-hop-mtu-less-than-minimum-link.patch
  (bsc#1191241 bsc#1195166).
- commit 1d741e6</changelog>
  <changelog author="jbohac@suse.cz" date="1643371200">- xfrm: fix MTU regression (bsc#1185377, bsc#1194048).
- Delete
  patches.suse/xfrm-xfrm_state_mtu-should-return-at-least-1280-for-.patch.
  which caused a regression (bsc#1194048).
- Replace with an alternative fix for bsc#1185377
- commit 3800186</changelog>
  <changelog author="jbohac@suse.cz" date="1643371201">- phonet: refcount leak in pep_sock_accep (bsc#1193867,
  CVE-2021-45095).
- commit 413134f</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1643630400">- net: tipc: validate domain record count on input (bsc#1195254).
- commit eaeeffc</changelog>
  <changelog author="tiwai@suse.de" date="1643630401">- Bluetooth: fix the erroneous flush_work() order (git-fixes).
- commit 9b1f0b0</changelog>
  <changelog author="tiwai@suse.de" date="1643630402">- Update patch reference for BT fix (CVE-2021-3564 bsc#1186207)
- commit ea7857c</changelog>
</package>
<package pkgid="40df36df740ed989894d17962ac1463010153a331dd9b0e776e84132f33b0678" name="kernel-vanilla-livepatch-devel" arch="ppc64le">
  <version epoch="0" ver="4.12.14" rel="197.105.1"/>
  <changelog author="jack@suse.cz" date="1643112000">- fget: clarify and improve __fget_files() implementation
  (bsc#1193727).
- commit 3ce5a50</changelog>
  <changelog author="ohering@suse.de" date="1643198400">- net, xdp: Introduce xdp_prepare_buff utility routine
  (bsc#1193506).
- net, xdp: Introduce xdp_init_buff utility routine (bsc#1193506).
- commit 69356ad</changelog>
  <changelog author="ohering@suse.de" date="1643198401">- hv_netvsc: Set needed_headroom according to VF (bsc#1193506).
- commit e6c57eb</changelog>
  <changelog author="ohering@suse.de" date="1643198402">- net: mana: Use kcalloc() instead of kzalloc() (bsc#1193506).
- commit 2e3aed9</changelog>
  <changelog author="ohering@suse.de" date="1643198403">- net: mana: Allow setting the number of queues while the NIC
  is down (bsc#1193506).
- commit ed46d20</changelog>
  <changelog author="ohering@suse.de" date="1643198404">- net: mana: Fix the netdev_err()'s vPort argument in
  mana_init_port() (bsc#1193506).
- commit 4301039</changelog>
  <changelog author="ohering@suse.de" date="1643198405">- net: mana: Improve the HWC error handling (bsc#1193506).
- commit be607da</changelog>
  <changelog author="ohering@suse.de" date="1643198406">- net: mana: Support hibernation and kexec (bsc#1193506).
- commit c664fb6</changelog>
  <changelog author="ohering@suse.de" date="1643198407">- net: mana: Fix spelling mistake "calledd" -&gt; "called"
  (bsc#1193506).
- commit 781000a</changelog>
  <changelog author="ohering@suse.de" date="1643198408">- net: mana: Add XDP support (bsc#1193506).
- commit c395dbf</changelog>
  <changelog author="ohering@suse.de" date="1643198409">- net: mana: Add RX fencing (bsc#1193506).
- commit 4af8516</changelog>
  <changelog author="oneukum@suse.com" date="1643198410">- usb: gadget: configfs: Fix use-after-free issue with udc_name
  (bsc#1193861 CVE-2021-39648).
- commit 9ec119b</changelog>
  <changelog author="oneukum@suse.com" date="1643284800">- scsi: ufs: Correct the LUN used in eh_device_reset_handler()
  callback (bsc#1193864 CVE-2021-39657).
- commit 39c5f8e</changelog>
  <changelog author="tonyj@suse.de" date="1643284801">- bpf: Verifer, adjust_scalar_min_max_vals to always call
  update_reg_bounds() (bsc#1194227).
- commit c098fc7</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1643284802">- Update
  patches.suse/IPv6-reply-ICMP-error-if-the-first-fragment-don-t-in.patch
  (bsc#1191241 bsc#1195166).
- Update
  patches.suse/net-ipv6-discard-next-hop-mtu-less-than-minimum-link.patch
  (bsc#1191241 bsc#1195166).
- commit 1d741e6</changelog>
  <changelog author="jbohac@suse.cz" date="1643371200">- xfrm: fix MTU regression (bsc#1185377, bsc#1194048).
- Delete
  patches.suse/xfrm-xfrm_state_mtu-should-return-at-least-1280-for-.patch.
  which caused a regression (bsc#1194048).
- Replace with an alternative fix for bsc#1185377
- commit 3800186</changelog>
  <changelog author="jbohac@suse.cz" date="1643371201">- phonet: refcount leak in pep_sock_accep (bsc#1193867,
  CVE-2021-45095).
- commit 413134f</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1643630400">- net: tipc: validate domain record count on input (bsc#1195254).
- commit eaeeffc</changelog>
  <changelog author="tiwai@suse.de" date="1643630401">- Bluetooth: fix the erroneous flush_work() order (git-fixes).
- commit 9b1f0b0</changelog>
  <changelog author="tiwai@suse.de" date="1643630402">- Update patch reference for BT fix (CVE-2021-3564 bsc#1186207)
- commit ea7857c</changelog>
</package>
<package pkgid="dfe294de862ee4082a51e880a66995783df732c05435ecee5490be0a7c14ba31" name="kernel-vanilla-livepatch-devel" arch="s390x">
  <version epoch="0" ver="4.12.14" rel="197.105.1"/>
  <changelog author="jack@suse.cz" date="1643112000">- fget: clarify and improve __fget_files() implementation
  (bsc#1193727).
- commit 3ce5a50</changelog>
  <changelog author="ohering@suse.de" date="1643198400">- net, xdp: Introduce xdp_prepare_buff utility routine
  (bsc#1193506).
- net, xdp: Introduce xdp_init_buff utility routine (bsc#1193506).
- commit 69356ad</changelog>
  <changelog author="ohering@suse.de" date="1643198401">- hv_netvsc: Set needed_headroom according to VF (bsc#1193506).
- commit e6c57eb</changelog>
  <changelog author="ohering@suse.de" date="1643198402">- net: mana: Use kcalloc() instead of kzalloc() (bsc#1193506).
- commit 2e3aed9</changelog>
  <changelog author="ohering@suse.de" date="1643198403">- net: mana: Allow setting the number of queues while the NIC
  is down (bsc#1193506).
- commit ed46d20</changelog>
  <changelog author="ohering@suse.de" date="1643198404">- net: mana: Fix the netdev_err()'s vPort argument in
  mana_init_port() (bsc#1193506).
- commit 4301039</changelog>
  <changelog author="ohering@suse.de" date="1643198405">- net: mana: Improve the HWC error handling (bsc#1193506).
- commit be607da</changelog>
  <changelog author="ohering@suse.de" date="1643198406">- net: mana: Support hibernation and kexec (bsc#1193506).
- commit c664fb6</changelog>
  <changelog author="ohering@suse.de" date="1643198407">- net: mana: Fix spelling mistake "calledd" -&gt; "called"
  (bsc#1193506).
- commit 781000a</changelog>
  <changelog author="ohering@suse.de" date="1643198408">- net: mana: Add XDP support (bsc#1193506).
- commit c395dbf</changelog>
  <changelog author="ohering@suse.de" date="1643198409">- net: mana: Add RX fencing (bsc#1193506).
- commit 4af8516</changelog>
  <changelog author="oneukum@suse.com" date="1643198410">- usb: gadget: configfs: Fix use-after-free issue with udc_name
  (bsc#1193861 CVE-2021-39648).
- commit 9ec119b</changelog>
  <changelog author="oneukum@suse.com" date="1643284800">- scsi: ufs: Correct the LUN used in eh_device_reset_handler()
  callback (bsc#1193864 CVE-2021-39657).
- commit 39c5f8e</changelog>
  <changelog author="tonyj@suse.de" date="1643284801">- bpf: Verifer, adjust_scalar_min_max_vals to always call
  update_reg_bounds() (bsc#1194227).
- commit c098fc7</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1643284802">- Update
  patches.suse/IPv6-reply-ICMP-error-if-the-first-fragment-don-t-in.patch
  (bsc#1191241 bsc#1195166).
- Update
  patches.suse/net-ipv6-discard-next-hop-mtu-less-than-minimum-link.patch
  (bsc#1191241 bsc#1195166).
- commit 1d741e6</changelog>
  <changelog author="jbohac@suse.cz" date="1643371200">- xfrm: fix MTU regression (bsc#1185377, bsc#1194048).
- Delete
  patches.suse/xfrm-xfrm_state_mtu-should-return-at-least-1280-for-.patch.
  which caused a regression (bsc#1194048).
- Replace with an alternative fix for bsc#1185377
- commit 3800186</changelog>
  <changelog author="jbohac@suse.cz" date="1643371201">- phonet: refcount leak in pep_sock_accep (bsc#1193867,
  CVE-2021-45095).
- commit 413134f</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1643630400">- net: tipc: validate domain record count on input (bsc#1195254).
- commit eaeeffc</changelog>
  <changelog author="tiwai@suse.de" date="1643630401">- Bluetooth: fix the erroneous flush_work() order (git-fixes).
- commit 9b1f0b0</changelog>
  <changelog author="tiwai@suse.de" date="1643630402">- Update patch reference for BT fix (CVE-2021-3564 bsc#1186207)
- commit ea7857c</changelog>
</package>
<package pkgid="946a0f135340daa449cf6cd333ec1b2d960c12f71ce3c0049d5ac54abb15d38d" name="kernel-vanilla-livepatch-devel" arch="x86_64">
  <version epoch="0" ver="4.12.14" rel="197.105.1"/>
  <changelog author="jack@suse.cz" date="1643112000">- fget: clarify and improve __fget_files() implementation
  (bsc#1193727).
- commit 3ce5a50</changelog>
  <changelog author="ohering@suse.de" date="1643198400">- net, xdp: Introduce xdp_prepare_buff utility routine
  (bsc#1193506).
- net, xdp: Introduce xdp_init_buff utility routine (bsc#1193506).
- commit 69356ad</changelog>
  <changelog author="ohering@suse.de" date="1643198401">- hv_netvsc: Set needed_headroom according to VF (bsc#1193506).
- commit e6c57eb</changelog>
  <changelog author="ohering@suse.de" date="1643198402">- net: mana: Use kcalloc() instead of kzalloc() (bsc#1193506).
- commit 2e3aed9</changelog>
  <changelog author="ohering@suse.de" date="1643198403">- net: mana: Allow setting the number of queues while the NIC
  is down (bsc#1193506).
- commit ed46d20</changelog>
  <changelog author="ohering@suse.de" date="1643198404">- net: mana: Fix the netdev_err()'s vPort argument in
  mana_init_port() (bsc#1193506).
- commit 4301039</changelog>
  <changelog author="ohering@suse.de" date="1643198405">- net: mana: Improve the HWC error handling (bsc#1193506).
- commit be607da</changelog>
  <changelog author="ohering@suse.de" date="1643198406">- net: mana: Support hibernation and kexec (bsc#1193506).
- commit c664fb6</changelog>
  <changelog author="ohering@suse.de" date="1643198407">- net: mana: Fix spelling mistake "calledd" -&gt; "called"
  (bsc#1193506).
- commit 781000a</changelog>
  <changelog author="ohering@suse.de" date="1643198408">- net: mana: Add XDP support (bsc#1193506).
- commit c395dbf</changelog>
  <changelog author="ohering@suse.de" date="1643198409">- net: mana: Add RX fencing (bsc#1193506).
- commit 4af8516</changelog>
  <changelog author="oneukum@suse.com" date="1643198410">- usb: gadget: configfs: Fix use-after-free issue with udc_name
  (bsc#1193861 CVE-2021-39648).
- commit 9ec119b</changelog>
  <changelog author="oneukum@suse.com" date="1643284800">- scsi: ufs: Correct the LUN used in eh_device_reset_handler()
  callback (bsc#1193864 CVE-2021-39657).
- commit 39c5f8e</changelog>
  <changelog author="tonyj@suse.de" date="1643284801">- bpf: Verifer, adjust_scalar_min_max_vals to always call
  update_reg_bounds() (bsc#1194227).
- commit c098fc7</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1643284802">- Update
  patches.suse/IPv6-reply-ICMP-error-if-the-first-fragment-don-t-in.patch
  (bsc#1191241 bsc#1195166).
- Update
  patches.suse/net-ipv6-discard-next-hop-mtu-less-than-minimum-link.patch
  (bsc#1191241 bsc#1195166).
- commit 1d741e6</changelog>
  <changelog author="jbohac@suse.cz" date="1643371200">- xfrm: fix MTU regression (bsc#1185377, bsc#1194048).
- Delete
  patches.suse/xfrm-xfrm_state_mtu-should-return-at-least-1280-for-.patch.
  which caused a regression (bsc#1194048).
- Replace with an alternative fix for bsc#1185377
- commit 3800186</changelog>
  <changelog author="jbohac@suse.cz" date="1643371201">- phonet: refcount leak in pep_sock_accep (bsc#1193867,
  CVE-2021-45095).
- commit 413134f</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1643630400">- net: tipc: validate domain record count on input (bsc#1195254).
- commit eaeeffc</changelog>
  <changelog author="tiwai@suse.de" date="1643630401">- Bluetooth: fix the erroneous flush_work() order (git-fixes).
- commit 9b1f0b0</changelog>
  <changelog author="tiwai@suse.de" date="1643630402">- Update patch reference for BT fix (CVE-2021-3564 bsc#1186207)
- commit ea7857c</changelog>
</package>
<package pkgid="314ca3e73021d81839a0a8bcd3e01a8350ec57c809f13c0b5d5cb3eb687b5dd9" name="kernel-zfcpdump" arch="src">
  <version epoch="0" ver="4.12.14" rel="197.105.1"/>
  <changelog author="jack@suse.cz" date="1643112000">- fget: clarify and improve __fget_files() implementation
  (bsc#1193727).
- commit 3ce5a50</changelog>
  <changelog author="ohering@suse.de" date="1643198400">- net, xdp: Introduce xdp_prepare_buff utility routine
  (bsc#1193506).
- net, xdp: Introduce xdp_init_buff utility routine (bsc#1193506).
- commit 69356ad</changelog>
  <changelog author="ohering@suse.de" date="1643198401">- hv_netvsc: Set needed_headroom according to VF (bsc#1193506).
- commit e6c57eb</changelog>
  <changelog author="ohering@suse.de" date="1643198402">- net: mana: Use kcalloc() instead of kzalloc() (bsc#1193506).
- commit 2e3aed9</changelog>
  <changelog author="ohering@suse.de" date="1643198403">- net: mana: Allow setting the number of queues while the NIC
  is down (bsc#1193506).
- commit ed46d20</changelog>
  <changelog author="ohering@suse.de" date="1643198404">- net: mana: Fix the netdev_err()'s vPort argument in
  mana_init_port() (bsc#1193506).
- commit 4301039</changelog>
  <changelog author="ohering@suse.de" date="1643198405">- net: mana: Improve the HWC error handling (bsc#1193506).
- commit be607da</changelog>
  <changelog author="ohering@suse.de" date="1643198406">- net: mana: Support hibernation and kexec (bsc#1193506).
- commit c664fb6</changelog>
  <changelog author="ohering@suse.de" date="1643198407">- net: mana: Fix spelling mistake "calledd" -&gt; "called"
  (bsc#1193506).
- commit 781000a</changelog>
  <changelog author="ohering@suse.de" date="1643198408">- net: mana: Add XDP support (bsc#1193506).
- commit c395dbf</changelog>
  <changelog author="ohering@suse.de" date="1643198409">- net: mana: Add RX fencing (bsc#1193506).
- commit 4af8516</changelog>
  <changelog author="oneukum@suse.com" date="1643198410">- usb: gadget: configfs: Fix use-after-free issue with udc_name
  (bsc#1193861 CVE-2021-39648).
- commit 9ec119b</changelog>
  <changelog author="oneukum@suse.com" date="1643284800">- scsi: ufs: Correct the LUN used in eh_device_reset_handler()
  callback (bsc#1193864 CVE-2021-39657).
- commit 39c5f8e</changelog>
  <changelog author="tonyj@suse.de" date="1643284801">- bpf: Verifer, adjust_scalar_min_max_vals to always call
  update_reg_bounds() (bsc#1194227).
- commit c098fc7</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1643284802">- Update
  patches.suse/IPv6-reply-ICMP-error-if-the-first-fragment-don-t-in.patch
  (bsc#1191241 bsc#1195166).
- Update
  patches.suse/net-ipv6-discard-next-hop-mtu-less-than-minimum-link.patch
  (bsc#1191241 bsc#1195166).
- commit 1d741e6</changelog>
  <changelog author="jbohac@suse.cz" date="1643371200">- xfrm: fix MTU regression (bsc#1185377, bsc#1194048).
- Delete
  patches.suse/xfrm-xfrm_state_mtu-should-return-at-least-1280-for-.patch.
  which caused a regression (bsc#1194048).
- Replace with an alternative fix for bsc#1185377
- commit 3800186</changelog>
  <changelog author="jbohac@suse.cz" date="1643371201">- phonet: refcount leak in pep_sock_accep (bsc#1193867,
  CVE-2021-45095).
- commit 413134f</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1643630400">- net: tipc: validate domain record count on input (bsc#1195254).
- commit eaeeffc</changelog>
  <changelog author="tiwai@suse.de" date="1643630401">- Bluetooth: fix the erroneous flush_work() order (git-fixes).
- commit 9b1f0b0</changelog>
  <changelog author="tiwai@suse.de" date="1643630402">- Update patch reference for BT fix (CVE-2021-3564 bsc#1186207)
- commit ea7857c</changelog>
</package>
<package pkgid="7e824b3eb9e978c6d8c5f74aa64c78a1660a640f6ef4e2ffb6a453ebce99ca99" name="kernel-zfcpdump-man" arch="s390x">
  <version epoch="0" ver="4.12.14" rel="197.105.1"/>
  <changelog author="jack@suse.cz" date="1643112000">- fget: clarify and improve __fget_files() implementation
  (bsc#1193727).
- commit 3ce5a50</changelog>
  <changelog author="ohering@suse.de" date="1643198400">- net, xdp: Introduce xdp_prepare_buff utility routine
  (bsc#1193506).
- net, xdp: Introduce xdp_init_buff utility routine (bsc#1193506).
- commit 69356ad</changelog>
  <changelog author="ohering@suse.de" date="1643198401">- hv_netvsc: Set needed_headroom according to VF (bsc#1193506).
- commit e6c57eb</changelog>
  <changelog author="ohering@suse.de" date="1643198402">- net: mana: Use kcalloc() instead of kzalloc() (bsc#1193506).
- commit 2e3aed9</changelog>
  <changelog author="ohering@suse.de" date="1643198403">- net: mana: Allow setting the number of queues while the NIC
  is down (bsc#1193506).
- commit ed46d20</changelog>
  <changelog author="ohering@suse.de" date="1643198404">- net: mana: Fix the netdev_err()'s vPort argument in
  mana_init_port() (bsc#1193506).
- commit 4301039</changelog>
  <changelog author="ohering@suse.de" date="1643198405">- net: mana: Improve the HWC error handling (bsc#1193506).
- commit be607da</changelog>
  <changelog author="ohering@suse.de" date="1643198406">- net: mana: Support hibernation and kexec (bsc#1193506).
- commit c664fb6</changelog>
  <changelog author="ohering@suse.de" date="1643198407">- net: mana: Fix spelling mistake "calledd" -&gt; "called"
  (bsc#1193506).
- commit 781000a</changelog>
  <changelog author="ohering@suse.de" date="1643198408">- net: mana: Add XDP support (bsc#1193506).
- commit c395dbf</changelog>
  <changelog author="ohering@suse.de" date="1643198409">- net: mana: Add RX fencing (bsc#1193506).
- commit 4af8516</changelog>
  <changelog author="oneukum@suse.com" date="1643198410">- usb: gadget: configfs: Fix use-after-free issue with udc_name
  (bsc#1193861 CVE-2021-39648).
- commit 9ec119b</changelog>
  <changelog author="oneukum@suse.com" date="1643284800">- scsi: ufs: Correct the LUN used in eh_device_reset_handler()
  callback (bsc#1193864 CVE-2021-39657).
- commit 39c5f8e</changelog>
  <changelog author="tonyj@suse.de" date="1643284801">- bpf: Verifer, adjust_scalar_min_max_vals to always call
  update_reg_bounds() (bsc#1194227).
- commit c098fc7</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1643284802">- Update
  patches.suse/IPv6-reply-ICMP-error-if-the-first-fragment-don-t-in.patch
  (bsc#1191241 bsc#1195166).
- Update
  patches.suse/net-ipv6-discard-next-hop-mtu-less-than-minimum-link.patch
  (bsc#1191241 bsc#1195166).
- commit 1d741e6</changelog>
  <changelog author="jbohac@suse.cz" date="1643371200">- xfrm: fix MTU regression (bsc#1185377, bsc#1194048).
- Delete
  patches.suse/xfrm-xfrm_state_mtu-should-return-at-least-1280-for-.patch.
  which caused a regression (bsc#1194048).
- Replace with an alternative fix for bsc#1185377
- commit 3800186</changelog>
  <changelog author="jbohac@suse.cz" date="1643371201">- phonet: refcount leak in pep_sock_accep (bsc#1193867,
  CVE-2021-45095).
- commit 413134f</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1643630400">- net: tipc: validate domain record count on input (bsc#1195254).
- commit eaeeffc</changelog>
  <changelog author="tiwai@suse.de" date="1643630401">- Bluetooth: fix the erroneous flush_work() order (git-fixes).
- commit 9b1f0b0</changelog>
  <changelog author="tiwai@suse.de" date="1643630402">- Update patch reference for BT fix (CVE-2021-3564 bsc#1186207)
- commit ea7857c</changelog>
</package>
<package pkgid="5e7be68825d0ed9934f6d14b6647d4e0f1f473a6a43795318837c28382d93625" name="kselftests-kmp-preempt" arch="x86_64">
  <version epoch="0" ver="5.3.18" rel="150300.59.43.1"/>
  <changelog author="tiwai@suse.de" date="1642593600">- Add cherry-picked IDs for qemu fw_cfg patches
- commit 8f947ad</changelog>
  <changelog author="msuchanek@suse.de" date="1642593601">- powerpc/pseries/cpuhp: delete add/remove_by_count code
  (bsc#1065729).
- powerpc/pseries/cpuhp: cache node corrections (bsc#1065729).
- commit 9c04898</changelog>
  <changelog author="tiwai@suse.de" date="1642593602">- dmaengine: at_xdmac: Fix at_xdmac_lld struct definition
  (git-fixes).
- dmaengine: at_xdmac: Fix lld view setting (git-fixes).
- dmaengine: at_xdmac: Fix concurrency over xfers_list
  (git-fixes).
- dmaengine: at_xdmac: Print debug message after realeasing the
  lock (git-fixes).
- dmaengine: at_xdmac: Don't start transactions at tx_submit level
  (git-fixes).
- Documentation: dmaengine: Correctly describe dmatest with
  channel unset (git-fixes).
- rpmsg: core: Clean up resources on announce_create failure
  (git-fixes).
- ACPI: APD: Check for NULL pointer after calling devm_ioremap()
  (git-fixes).
- Input: ti_am335x_tsc - fix STEPCONFIG setup for Z2 (git-fixes).
- Input: ti_am335x_tsc - set ADCREFM for X configuration
  (git-fixes).
- i3c: master: dw: check return of dw_i3c_master_get_free_pos()
  (git-fixes).
- i3c: fix incorrect address slot lookup on 64-bit (git-fixes).
- commit 3d8614c</changelog>
  <changelog author="msuchanek@suse.de" date="1642593603">- powerpc/prom_init: Fix improper check of prom_getprop()
  (bsc#1065729).
- commit 954fa51</changelog>
  <changelog author="msuchanek@suse.de" date="1642593604">- powerpc/perf: Fix PMU callbacks to clear pending PMI before
  resetting an overflown PMC (bsc#1156395).
- commit 8bdce1e</changelog>
  <changelog author="mbenes@suse.cz" date="1642593605">- livepatch: Avoid CPU hogging with cond_resched (bsc#1071995).
- commit 27c7aa0</changelog>
  <changelog author="msuchanek@suse.de" date="1642593606">- blacklist.conf: Add 79ca6f74dae0 tpm: fix Atmel TPM crash caused by too frequent queries
  Breaks kABI, there is no report of this problem affecting users, likely
  broken old TPM firmware.
- commit 4ea9f96</changelog>
  <changelog author="msuchanek@suse.de" date="1642593607">- Update patches.suse/tpm-fix-potential-NULL-pointer-access-in-tpm_del_cha.patch
  (git-fixes bsc#1193660 ltc#195634).
- commit 11ac3f6</changelog>
  <changelog author="lhenriques@suse.de" date="1642680000">- fuse: Pass correct lend value to filemap_write_and_wait_range()
  (bsc#1194953).
- commit d2355ea</changelog>
  <changelog author="msuchanek@suse.de" date="1642680001">- blacklist.conf: Add a2308836880b powerpc: Fix arch_stack_walk() to have
  running function as first entry
  The stacktrace interface in this kernel version does not provide the
  parameters used to implement the fix.
- commit ee041a3</changelog>
  <changelog author="msuchanek@suse.de" date="1642680002">- powerpc/64s: fix program check interrupt emergency stack path
  (bsc#1156395).
- commit a3c26ed</changelog>
  <changelog author="msuchanek@suse.de" date="1642680003">- powerpc/traps: do not enable irqs in _exception (bsc#1065729).
- powerpc: add interrupt_cond_local_irq_enable helper
  (bsc#1065729).
- commit 65f660c</changelog>
  <changelog author="msuchanek@suse.de" date="1642680004">- powerpc/pseries/mobility: ignore ibm, platform-facilities
  updates (bsc#1065729).
- commit b253330</changelog>
  <changelog author="rgoldwyn@suse.com" date="1642680005">- vfs: check fd has read access in kernel_read_file_from_fd() (bsc#1194888).
- commit 4717473</changelog>
  <changelog author="vkarasulli@suse.de" date="1642680006">- moxart: fix potential use-after-free on remove path
  (bsc#1194516).
- commit 3fae095</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1642766400">- sctp: account stream padding length for reconf chunk
  (bsc#1194985 CVE-2022-0322).
- commit a6cab40</changelog>
  <changelog author="ddiss@suse.de" date="1642766401">- vfs: fs_context: fix up param length parsing in
  legacy_parse_param (CVE-2022-0185 bsc#1194517).
- Rename and retag following upstream merge from:
  patches.suse/vfs-Out-of-bounds-write-of-heap-buffer-in-fs_context-c.patch
  to patches.suse/vfs-fs_context-fix-up-param-length-parsing-in-legacy.patch
- commit 33860f2</changelog>
  <changelog author="mkubecek@suse.cz" date="1642766402">- series.conf: cleanup
- move to "mainline soon" section:
  - patches.suse/0001-mmc-moxart_remove-Fix-UAF.patch
- commit 07d55c3</changelog>
  <changelog author="mkubecek@suse.cz" date="1642766403">- series.conf: refresh
- update upstream references and resort:
  - patches.suse/powerpc-fadump-Fix-inaccurate-CPU-state-info-in-vmco.patch
  - patches.suse/powerpc-handle-kdump-appropriately-with-crash_kexec_.patch
  - patches.suse/powerpc-watchdog-Avoid-holding-wd_smp_lock-over-prin.patch
  - patches.suse/powerpc-watchdog-Fix-missed-watchdog-reset-due-to-me.patch
  - patches.suse/powerpc-watchdog-Fix-wd_smp_last_reset_tb-reporting.patch
  - patches.suse/powerpc-watchdog-read-TB-close-to-where-it-is-used.patch
  - patches.suse/powerpc-watchdog-tighten-non-atomic-read-modify-writ.patch
- commit 72b7db7</changelog>
  <changelog author="osalvador@suse.de" date="1642939200">- Rename colliding patches before the next cve/linux-5.3 -&gt; SLE15-SP3 merge
- commit 84178b8</changelog>
</package>
<package pkgid="d3f08a46bc6a19ea84be75e0b63c46ae1a44944bc10b12af4cde1441f83aabdb" name="kselftests-kmp-preempt" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="150300.59.49.1"/>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235200">- IB/mlx5: Add missing error code (git-fixes)
- commit 06919f0</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235201">- RDMA/cxgb4: Fix adapter LE hash errors while destroying ipv6 listening server (git-fixes)
- commit 0f86491</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235202">- RDMA/addr: Be strict with gid size (git-fixes)
- commit 0b96850</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235203">- IB/isert: Fix a use after free in isert_connect_request (git-fixes)
- commit fa7abfc</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235204">- RDMA/core: Fix corrupted SL on passive side (git-fixes)
- commit d86d9cb</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235205">- IB/hfi1: Use kzalloc() for mmu_rb_handler allocation (git-fixes)
- commit 05c0e16</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235206">- IB/hfi1: Fix error return code in parse_platform_config() (git-fixes)
- commit 270bb46</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235207">- RDMA/bnxt_re: Fix error return code in bnxt_qplib_cq_process_terminal() (git-fixes)
- commit 76267d4</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235208">- RDMA/core: Unify RoCE check and re-factor code (git-fixes)
- commit e5e3d6f</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235209">- RDMA/cxgb4: add missing qpid increment (git-fixes)
- commit 591cdce</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235210">- RDMA/i40iw: Fix error unwinding when i40iw_hmc_sd_one fails (git-fixes)
- commit 2db1c84</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235211">- RDMA/siw: Fix a use after free in siw_alloc_mr (git-fixes)
- commit a7eff62</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235212">- RDMA/bnxt_re: Fix a double free in bnxt_qplib_alloc_res (git-fixes)
- commit 8c226d5</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235213">- RDMA/siw: Properly check send and receive CQ pointers (git-fixes)
- commit d84b45b</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235214">- RDMA/rxe: Clear all QP fields if creation failed (git-fixes)
- commit 07c8b4d</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235215">- RDMA/mlx5: Recover from fatal event in dual port mode (git-fixes)
- commit 875e0ed</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235216">- RDMA/core: Don't access cm_id after its destruction (git-fixes)
- commit 4a117e6</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235217">- RDMA/mlx5: Fix query DCT via DEVX (git-fixes)
- commit 4b56cb2</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235218">- RDMA/uverbs: Fix a NULL vs IS_ERR() bug (git-fixes)
- commit 82ce09e</changelog>
  <changelog author="msuchanek@suse.de" date="1644235219">- powerpc/perf: Fix power_pmu_disable to call
  clear_pmi_irq_pending only if PMI is pending (bsc#1156395).
- commit a08ca77</changelog>
</package>
<package pkgid="8a102d9a5b068861ae6b9f09167410c03ed7bb0b5d31c9b8abbdbdff8e251bd8" name="kselftests-kmp-preempt" arch="x86_64">
  <version epoch="0" ver="5.3.18" rel="150300.59.49.1"/>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235200">- IB/mlx5: Add missing error code (git-fixes)
- commit 06919f0</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235201">- RDMA/cxgb4: Fix adapter LE hash errors while destroying ipv6 listening server (git-fixes)
- commit 0f86491</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235202">- RDMA/addr: Be strict with gid size (git-fixes)
- commit 0b96850</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235203">- IB/isert: Fix a use after free in isert_connect_request (git-fixes)
- commit fa7abfc</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235204">- RDMA/core: Fix corrupted SL on passive side (git-fixes)
- commit d86d9cb</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235205">- IB/hfi1: Use kzalloc() for mmu_rb_handler allocation (git-fixes)
- commit 05c0e16</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235206">- IB/hfi1: Fix error return code in parse_platform_config() (git-fixes)
- commit 270bb46</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235207">- RDMA/bnxt_re: Fix error return code in bnxt_qplib_cq_process_terminal() (git-fixes)
- commit 76267d4</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235208">- RDMA/core: Unify RoCE check and re-factor code (git-fixes)
- commit e5e3d6f</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235209">- RDMA/cxgb4: add missing qpid increment (git-fixes)
- commit 591cdce</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235210">- RDMA/i40iw: Fix error unwinding when i40iw_hmc_sd_one fails (git-fixes)
- commit 2db1c84</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235211">- RDMA/siw: Fix a use after free in siw_alloc_mr (git-fixes)
- commit a7eff62</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235212">- RDMA/bnxt_re: Fix a double free in bnxt_qplib_alloc_res (git-fixes)
- commit 8c226d5</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235213">- RDMA/siw: Properly check send and receive CQ pointers (git-fixes)
- commit d84b45b</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235214">- RDMA/rxe: Clear all QP fields if creation failed (git-fixes)
- commit 07c8b4d</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235215">- RDMA/mlx5: Recover from fatal event in dual port mode (git-fixes)
- commit 875e0ed</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235216">- RDMA/core: Don't access cm_id after its destruction (git-fixes)
- commit 4a117e6</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235217">- RDMA/mlx5: Fix query DCT via DEVX (git-fixes)
- commit 4b56cb2</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235218">- RDMA/uverbs: Fix a NULL vs IS_ERR() bug (git-fixes)
- commit 82ce09e</changelog>
  <changelog author="msuchanek@suse.de" date="1644235219">- powerpc/perf: Fix power_pmu_disable to call
  clear_pmi_irq_pending only if PMI is pending (bsc#1156395).
- commit a08ca77</changelog>
</package>
<package pkgid="6925612700d9f98818b317a46ab7424fb42c4fe738a3c9373d8dd9f06baacb3d" name="libIlmImf-2_2-23" arch="aarch64">
  <version epoch="0" ver="2.2.1" rel="3.41.1"/>
  <changelog author="tchvatal@suse.com" date="1499860800">- Cleanup a bit with spec-cleaner</changelog>
  <changelog author="avindra@opensuse.org" date="1516017600">- Update to 2.2.1
  * Fix reported OpenEXR security vulnerabilities: CVE-2017-9110,
    CVE-2017-9111, CVE-2017-9112, CVE-2017-9113, CVE-2017-9114,
    CVE-2017-9115 and CVE-2017-9116
- pgajdos@suse.com: but really seem to fix only:
  CVE-2017-9110 [bsc#1040107], CVE-2017-9114 [bsc#1040114],
  CVE-2017-9116 [bsc#1040116], CVE-2017-12596 [bsc#1052522]; for
  the rest of issues see [bsc#1040109], [bsc#1040112],
  [bsc#1040113], [bsc#1040114], [bsc#1040115], and [bsc#1061305]</changelog>
  <changelog author="pgajdos@suse.com" date="1541505600">- asan_build: build ASAN included
- debug_build: build more suitable for debugging</changelog>
  <changelog author="pgajdos@suse.com" date="1541592000">- security update
  * CVE-2018-18444 [bsc#1113455]
    + openexr-CVE-2018-18444.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1560513600">- security update
- added patches
  CVE-2017-9111 [bsc#1040109], CVE-2017-9113 [bsc#1040113], CVE-2017-9115 [bsc#1040115]
  + openexr-CVE-2017-9111,9113,9115.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1563192000">- security update
- added patches
  CVE-2017-14988 [bsc#1061305]
  + openexr-CVE-2017-14988.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1568980800">- on behalf of Martin Pluskal:
- Enable tests on architectures with enough memory - boo#1146648
  * disable imffuzztest as it takes to much resources</changelog>
  <changelog author="pgajdos@suse.com" date="1568980801">- testsuite only for x86_64 [bsc#1146648]</changelog>
  <changelog author="pgajdos@suse.com" date="1587556800">- security update
- added patches
  fix CVE-2020-11762 [bsc#1169549], out-of-bounds read and write in DwaCompressor:uncompress in ImfDwaCompressor.cpp when handling the UNKNOWN compression case
  fix CVE-2020-11758 [bsc#1169573], out-of-bounds read in ImfOptimizedPixelReading.h.
  fix CVE-2020-11764 [bsc#1169574], out-of-bounds write in copyIntoFrameBuffer in ImfMisc.cpp
  fix CVE-2020-11765 [bsc#1169575], off-by-one error in use of the ImfXdr.h read function by DwaCompressor:Classifier:Classifier
  fix CVE-2020-11763 [bsc#1169576], out-of-bounds read and write, as demonstrated by ImfTileOffsets.cpp
  fix CVE-2020-11761 [bsc#1169578], out-of-bounds read during Huffman uncompression, as demonstrated by FastHufDecoder:refill in ImfFastHuf.cpp
  fix CVE-2020-11760 [bsc#1169580], out-of-bounds read during RLE uncompression in rleUncompress in ImfRle.cpp
  + openexr-CVE-2020-11762,11758,11764,11765,11763,11761,11760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1593604800">- security update
- added patches
  fix CVE-2020-15304 [bsc#1173466], NULL pointer dereference in TiledInputFile:TiledInputFile()
  + openexr-CVE-2020-15304.patch
  fix CVE-2020-15305 [bsc#1173467], use-after-free in DeepScanLineInputFile:DeepScanLineInputFile()
  + openexr-CVE-2020-15305.patch
  fix CVE-2020-15306 [bsc#1173469], invalid chunkCount attributes could cause a heap buffer overflow in getChunkOffsetTableSize()
  + openexr-CVE-2020-15306.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1608120000">- security update
- added patches
  fix CVE-2020-16587, CVE-2020-16588, CVE-2020-16589 [bsc#1179879], multiple memory safety issues
  + openexr-CVE-2020-16587.patch
  + openexr-CVE-2020-16588.patch
  + openexr-CVE-2020-16589.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1617192000">- security update
- added patches
  fix CVE-2021-3474 [bsc#1184174], Undefined-shift in Imf_2_5::FastHufDecoder::FastHufDecoder
  + openexr-CVE-2021-3474.patch
  fix CVE-2021-3475 [bsc#1184173], Integer-overflow in Imf_2_5::calculateNumTiles
  + openexr-CVE-2021-3475.patch
  fix CVE-2021-3476 [bsc#1184172], Undefined-shift in Imf_2_5::unpack14
  + openexr-CVE-2021-3476.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1617883200">- security update
- modified patches
  % openexr-CVE-2021-3474.patch (splitted into openexr-CVE-2021-20296.patch)
- added patches
  fix CVE-2021-20296 [bsc#1184355], Segv on unknown address in Imf_2_5:hufUncompress - Null Pointer dereference
  + openexr-CVE-2021-20296.patch
  fix CVE-2021-3477 [bsc#1184353], Heap-buffer-overflow in Imf_2_5::DeepTiledInputFile::readPixelSampleCounts
  + openexr-CVE-2021-3477.patch
  fix CVE-2021-3479 [bsc#1184354], Out-of-memory caused by allocation of a very large buffer
  + openexr-CVE-2021-3479.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1619524800">- security update
- added patches
  fix CVE-2021-23215 [bsc#1185216], Integer-overflow in Imf_2_5:DwaCompressor:initializeBuffers
  fix CVE-2021-26260 [bsc#1185217], Integer-overflow in Imf_2_5:DwaCompressor:initializeBuffers
  + openexr-CVE-2021-23215,26260.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623758400">- security update
- added patches
  fix CVE-2021-3598 [bsc#1187310], Heap buffer overflow in Imf_3_1:CharPtrIO:readChars
  + openexr-CVE-2021-3598.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623844800">- security update
- added patches
  fix CVE-2021-3605 [bsc#1187395], Heap buffer overflow in the rleUncompress function
  + openexr-CVE-2021-3605.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1627992000">- security update
- modified patches
  % openexr-CVE-2021-3476.patch (refreshed)
- added patches
  fix CVE-2021-20298 [bsc#1188460], Out-of-memory in B44Compressor
  + openexr-CVE-2021-20298.patch
  fix CVE-2021-20299 [bsc#1188459], Null-dereference READ in Imf_2_5:Header:operator
  + openexr-CVE-2021-20299.patch
  fix CVE-2021-20300 [bsc#1188458], Integer-overflow in Imf_2_5:hufUncompress
  + openexr-CVE-2021-20300.patch
  fix CVE-2021-20302 [bsc#1188462], Floating-point-exception in Imf_2_5:precalculateTileInfot
  + openexr-CVE-2021-20302.patch
  fix CVE-2021-20303 [bsc#1188457], Heap-buffer-overflow in Imf_2_5::copyIntoFrameBuffer
  + openexr-CVE-2021-20303.patch
  fix CVE-2021-20304 [bsc#1188461], Undefined-shift in Imf_2_5:hufDecode
  + openexr-CVE-2021-20304.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1636459200">- security update
- added patches
  fix CVE-2021-3933 [bsc#1192498], Integer-overflow in Imf_3_1:bytesPerDeepLineTable
  + openexr-CVE-2021-3933.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1636632000">- security update
- added patches
  fix CVE-2021-3941 [bsc#1192556], Divide-by-zero in Imf_3_1:RGBtoXYZ
  + openexr-CVE-2021-3941.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1641384000">- security update
- added patches
  fix CVE-2021-45942 [bsc#1194333], heap-based buffer overflow in Imf_3_1:LineCompositeTask:execute
  + openexr-CVE-2021-45942.patch</changelog>
</package>
<package pkgid="a7b5a97108a5a4524b7b865982fef150f618982a93ad9225f2419052b7631383" name="libIlmImf-2_2-23" arch="ppc64le">
  <version epoch="0" ver="2.2.1" rel="3.41.1"/>
  <changelog author="tchvatal@suse.com" date="1499860800">- Cleanup a bit with spec-cleaner</changelog>
  <changelog author="avindra@opensuse.org" date="1516017600">- Update to 2.2.1
  * Fix reported OpenEXR security vulnerabilities: CVE-2017-9110,
    CVE-2017-9111, CVE-2017-9112, CVE-2017-9113, CVE-2017-9114,
    CVE-2017-9115 and CVE-2017-9116
- pgajdos@suse.com: but really seem to fix only:
  CVE-2017-9110 [bsc#1040107], CVE-2017-9114 [bsc#1040114],
  CVE-2017-9116 [bsc#1040116], CVE-2017-12596 [bsc#1052522]; for
  the rest of issues see [bsc#1040109], [bsc#1040112],
  [bsc#1040113], [bsc#1040114], [bsc#1040115], and [bsc#1061305]</changelog>
  <changelog author="pgajdos@suse.com" date="1541505600">- asan_build: build ASAN included
- debug_build: build more suitable for debugging</changelog>
  <changelog author="pgajdos@suse.com" date="1541592000">- security update
  * CVE-2018-18444 [bsc#1113455]
    + openexr-CVE-2018-18444.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1560513600">- security update
- added patches
  CVE-2017-9111 [bsc#1040109], CVE-2017-9113 [bsc#1040113], CVE-2017-9115 [bsc#1040115]
  + openexr-CVE-2017-9111,9113,9115.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1563192000">- security update
- added patches
  CVE-2017-14988 [bsc#1061305]
  + openexr-CVE-2017-14988.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1568980800">- on behalf of Martin Pluskal:
- Enable tests on architectures with enough memory - boo#1146648
  * disable imffuzztest as it takes to much resources</changelog>
  <changelog author="pgajdos@suse.com" date="1568980801">- testsuite only for x86_64 [bsc#1146648]</changelog>
  <changelog author="pgajdos@suse.com" date="1587556800">- security update
- added patches
  fix CVE-2020-11762 [bsc#1169549], out-of-bounds read and write in DwaCompressor:uncompress in ImfDwaCompressor.cpp when handling the UNKNOWN compression case
  fix CVE-2020-11758 [bsc#1169573], out-of-bounds read in ImfOptimizedPixelReading.h.
  fix CVE-2020-11764 [bsc#1169574], out-of-bounds write in copyIntoFrameBuffer in ImfMisc.cpp
  fix CVE-2020-11765 [bsc#1169575], off-by-one error in use of the ImfXdr.h read function by DwaCompressor:Classifier:Classifier
  fix CVE-2020-11763 [bsc#1169576], out-of-bounds read and write, as demonstrated by ImfTileOffsets.cpp
  fix CVE-2020-11761 [bsc#1169578], out-of-bounds read during Huffman uncompression, as demonstrated by FastHufDecoder:refill in ImfFastHuf.cpp
  fix CVE-2020-11760 [bsc#1169580], out-of-bounds read during RLE uncompression in rleUncompress in ImfRle.cpp
  + openexr-CVE-2020-11762,11758,11764,11765,11763,11761,11760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1593604800">- security update
- added patches
  fix CVE-2020-15304 [bsc#1173466], NULL pointer dereference in TiledInputFile:TiledInputFile()
  + openexr-CVE-2020-15304.patch
  fix CVE-2020-15305 [bsc#1173467], use-after-free in DeepScanLineInputFile:DeepScanLineInputFile()
  + openexr-CVE-2020-15305.patch
  fix CVE-2020-15306 [bsc#1173469], invalid chunkCount attributes could cause a heap buffer overflow in getChunkOffsetTableSize()
  + openexr-CVE-2020-15306.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1608120000">- security update
- added patches
  fix CVE-2020-16587, CVE-2020-16588, CVE-2020-16589 [bsc#1179879], multiple memory safety issues
  + openexr-CVE-2020-16587.patch
  + openexr-CVE-2020-16588.patch
  + openexr-CVE-2020-16589.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1617192000">- security update
- added patches
  fix CVE-2021-3474 [bsc#1184174], Undefined-shift in Imf_2_5::FastHufDecoder::FastHufDecoder
  + openexr-CVE-2021-3474.patch
  fix CVE-2021-3475 [bsc#1184173], Integer-overflow in Imf_2_5::calculateNumTiles
  + openexr-CVE-2021-3475.patch
  fix CVE-2021-3476 [bsc#1184172], Undefined-shift in Imf_2_5::unpack14
  + openexr-CVE-2021-3476.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1617883200">- security update
- modified patches
  % openexr-CVE-2021-3474.patch (splitted into openexr-CVE-2021-20296.patch)
- added patches
  fix CVE-2021-20296 [bsc#1184355], Segv on unknown address in Imf_2_5:hufUncompress - Null Pointer dereference
  + openexr-CVE-2021-20296.patch
  fix CVE-2021-3477 [bsc#1184353], Heap-buffer-overflow in Imf_2_5::DeepTiledInputFile::readPixelSampleCounts
  + openexr-CVE-2021-3477.patch
  fix CVE-2021-3479 [bsc#1184354], Out-of-memory caused by allocation of a very large buffer
  + openexr-CVE-2021-3479.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1619524800">- security update
- added patches
  fix CVE-2021-23215 [bsc#1185216], Integer-overflow in Imf_2_5:DwaCompressor:initializeBuffers
  fix CVE-2021-26260 [bsc#1185217], Integer-overflow in Imf_2_5:DwaCompressor:initializeBuffers
  + openexr-CVE-2021-23215,26260.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623758400">- security update
- added patches
  fix CVE-2021-3598 [bsc#1187310], Heap buffer overflow in Imf_3_1:CharPtrIO:readChars
  + openexr-CVE-2021-3598.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623844800">- security update
- added patches
  fix CVE-2021-3605 [bsc#1187395], Heap buffer overflow in the rleUncompress function
  + openexr-CVE-2021-3605.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1627992000">- security update
- modified patches
  % openexr-CVE-2021-3476.patch (refreshed)
- added patches
  fix CVE-2021-20298 [bsc#1188460], Out-of-memory in B44Compressor
  + openexr-CVE-2021-20298.patch
  fix CVE-2021-20299 [bsc#1188459], Null-dereference READ in Imf_2_5:Header:operator
  + openexr-CVE-2021-20299.patch
  fix CVE-2021-20300 [bsc#1188458], Integer-overflow in Imf_2_5:hufUncompress
  + openexr-CVE-2021-20300.patch
  fix CVE-2021-20302 [bsc#1188462], Floating-point-exception in Imf_2_5:precalculateTileInfot
  + openexr-CVE-2021-20302.patch
  fix CVE-2021-20303 [bsc#1188457], Heap-buffer-overflow in Imf_2_5::copyIntoFrameBuffer
  + openexr-CVE-2021-20303.patch
  fix CVE-2021-20304 [bsc#1188461], Undefined-shift in Imf_2_5:hufDecode
  + openexr-CVE-2021-20304.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1636459200">- security update
- added patches
  fix CVE-2021-3933 [bsc#1192498], Integer-overflow in Imf_3_1:bytesPerDeepLineTable
  + openexr-CVE-2021-3933.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1636632000">- security update
- added patches
  fix CVE-2021-3941 [bsc#1192556], Divide-by-zero in Imf_3_1:RGBtoXYZ
  + openexr-CVE-2021-3941.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1641384000">- security update
- added patches
  fix CVE-2021-45942 [bsc#1194333], heap-based buffer overflow in Imf_3_1:LineCompositeTask:execute
  + openexr-CVE-2021-45942.patch</changelog>
</package>
<package pkgid="41d933d2f4f2f566e6194c088312fecb42dcd6d2b57eb33c6e5514175a65e6f1" name="libIlmImf-2_2-23" arch="s390x">
  <version epoch="0" ver="2.2.1" rel="3.41.1"/>
  <changelog author="tchvatal@suse.com" date="1499860800">- Cleanup a bit with spec-cleaner</changelog>
  <changelog author="avindra@opensuse.org" date="1516017600">- Update to 2.2.1
  * Fix reported OpenEXR security vulnerabilities: CVE-2017-9110,
    CVE-2017-9111, CVE-2017-9112, CVE-2017-9113, CVE-2017-9114,
    CVE-2017-9115 and CVE-2017-9116
- pgajdos@suse.com: but really seem to fix only:
  CVE-2017-9110 [bsc#1040107], CVE-2017-9114 [bsc#1040114],
  CVE-2017-9116 [bsc#1040116], CVE-2017-12596 [bsc#1052522]; for
  the rest of issues see [bsc#1040109], [bsc#1040112],
  [bsc#1040113], [bsc#1040114], [bsc#1040115], and [bsc#1061305]</changelog>
  <changelog author="pgajdos@suse.com" date="1541505600">- asan_build: build ASAN included
- debug_build: build more suitable for debugging</changelog>
  <changelog author="pgajdos@suse.com" date="1541592000">- security update
  * CVE-2018-18444 [bsc#1113455]
    + openexr-CVE-2018-18444.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1560513600">- security update
- added patches
  CVE-2017-9111 [bsc#1040109], CVE-2017-9113 [bsc#1040113], CVE-2017-9115 [bsc#1040115]
  + openexr-CVE-2017-9111,9113,9115.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1563192000">- security update
- added patches
  CVE-2017-14988 [bsc#1061305]
  + openexr-CVE-2017-14988.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1568980800">- on behalf of Martin Pluskal:
- Enable tests on architectures with enough memory - boo#1146648
  * disable imffuzztest as it takes to much resources</changelog>
  <changelog author="pgajdos@suse.com" date="1568980801">- testsuite only for x86_64 [bsc#1146648]</changelog>
  <changelog author="pgajdos@suse.com" date="1587556800">- security update
- added patches
  fix CVE-2020-11762 [bsc#1169549], out-of-bounds read and write in DwaCompressor:uncompress in ImfDwaCompressor.cpp when handling the UNKNOWN compression case
  fix CVE-2020-11758 [bsc#1169573], out-of-bounds read in ImfOptimizedPixelReading.h.
  fix CVE-2020-11764 [bsc#1169574], out-of-bounds write in copyIntoFrameBuffer in ImfMisc.cpp
  fix CVE-2020-11765 [bsc#1169575], off-by-one error in use of the ImfXdr.h read function by DwaCompressor:Classifier:Classifier
  fix CVE-2020-11763 [bsc#1169576], out-of-bounds read and write, as demonstrated by ImfTileOffsets.cpp
  fix CVE-2020-11761 [bsc#1169578], out-of-bounds read during Huffman uncompression, as demonstrated by FastHufDecoder:refill in ImfFastHuf.cpp
  fix CVE-2020-11760 [bsc#1169580], out-of-bounds read during RLE uncompression in rleUncompress in ImfRle.cpp
  + openexr-CVE-2020-11762,11758,11764,11765,11763,11761,11760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1593604800">- security update
- added patches
  fix CVE-2020-15304 [bsc#1173466], NULL pointer dereference in TiledInputFile:TiledInputFile()
  + openexr-CVE-2020-15304.patch
  fix CVE-2020-15305 [bsc#1173467], use-after-free in DeepScanLineInputFile:DeepScanLineInputFile()
  + openexr-CVE-2020-15305.patch
  fix CVE-2020-15306 [bsc#1173469], invalid chunkCount attributes could cause a heap buffer overflow in getChunkOffsetTableSize()
  + openexr-CVE-2020-15306.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1608120000">- security update
- added patches
  fix CVE-2020-16587, CVE-2020-16588, CVE-2020-16589 [bsc#1179879], multiple memory safety issues
  + openexr-CVE-2020-16587.patch
  + openexr-CVE-2020-16588.patch
  + openexr-CVE-2020-16589.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1617192000">- security update
- added patches
  fix CVE-2021-3474 [bsc#1184174], Undefined-shift in Imf_2_5::FastHufDecoder::FastHufDecoder
  + openexr-CVE-2021-3474.patch
  fix CVE-2021-3475 [bsc#1184173], Integer-overflow in Imf_2_5::calculateNumTiles
  + openexr-CVE-2021-3475.patch
  fix CVE-2021-3476 [bsc#1184172], Undefined-shift in Imf_2_5::unpack14
  + openexr-CVE-2021-3476.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1617883200">- security update
- modified patches
  % openexr-CVE-2021-3474.patch (splitted into openexr-CVE-2021-20296.patch)
- added patches
  fix CVE-2021-20296 [bsc#1184355], Segv on unknown address in Imf_2_5:hufUncompress - Null Pointer dereference
  + openexr-CVE-2021-20296.patch
  fix CVE-2021-3477 [bsc#1184353], Heap-buffer-overflow in Imf_2_5::DeepTiledInputFile::readPixelSampleCounts
  + openexr-CVE-2021-3477.patch
  fix CVE-2021-3479 [bsc#1184354], Out-of-memory caused by allocation of a very large buffer
  + openexr-CVE-2021-3479.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1619524800">- security update
- added patches
  fix CVE-2021-23215 [bsc#1185216], Integer-overflow in Imf_2_5:DwaCompressor:initializeBuffers
  fix CVE-2021-26260 [bsc#1185217], Integer-overflow in Imf_2_5:DwaCompressor:initializeBuffers
  + openexr-CVE-2021-23215,26260.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623758400">- security update
- added patches
  fix CVE-2021-3598 [bsc#1187310], Heap buffer overflow in Imf_3_1:CharPtrIO:readChars
  + openexr-CVE-2021-3598.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623844800">- security update
- added patches
  fix CVE-2021-3605 [bsc#1187395], Heap buffer overflow in the rleUncompress function
  + openexr-CVE-2021-3605.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1627992000">- security update
- modified patches
  % openexr-CVE-2021-3476.patch (refreshed)
- added patches
  fix CVE-2021-20298 [bsc#1188460], Out-of-memory in B44Compressor
  + openexr-CVE-2021-20298.patch
  fix CVE-2021-20299 [bsc#1188459], Null-dereference READ in Imf_2_5:Header:operator
  + openexr-CVE-2021-20299.patch
  fix CVE-2021-20300 [bsc#1188458], Integer-overflow in Imf_2_5:hufUncompress
  + openexr-CVE-2021-20300.patch
  fix CVE-2021-20302 [bsc#1188462], Floating-point-exception in Imf_2_5:precalculateTileInfot
  + openexr-CVE-2021-20302.patch
  fix CVE-2021-20303 [bsc#1188457], Heap-buffer-overflow in Imf_2_5::copyIntoFrameBuffer
  + openexr-CVE-2021-20303.patch
  fix CVE-2021-20304 [bsc#1188461], Undefined-shift in Imf_2_5:hufDecode
  + openexr-CVE-2021-20304.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1636459200">- security update
- added patches
  fix CVE-2021-3933 [bsc#1192498], Integer-overflow in Imf_3_1:bytesPerDeepLineTable
  + openexr-CVE-2021-3933.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1636632000">- security update
- added patches
  fix CVE-2021-3941 [bsc#1192556], Divide-by-zero in Imf_3_1:RGBtoXYZ
  + openexr-CVE-2021-3941.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1641384000">- security update
- added patches
  fix CVE-2021-45942 [bsc#1194333], heap-based buffer overflow in Imf_3_1:LineCompositeTask:execute
  + openexr-CVE-2021-45942.patch</changelog>
</package>
<package pkgid="152cc46eb49b9621bb808dd790972c04d38a78adb589f846fb9e60501a3aa507" name="libIlmImf-2_2-23" arch="x86_64">
  <version epoch="0" ver="2.2.1" rel="3.41.1"/>
  <changelog author="tchvatal@suse.com" date="1499860800">- Cleanup a bit with spec-cleaner</changelog>
  <changelog author="avindra@opensuse.org" date="1516017600">- Update to 2.2.1
  * Fix reported OpenEXR security vulnerabilities: CVE-2017-9110,
    CVE-2017-9111, CVE-2017-9112, CVE-2017-9113, CVE-2017-9114,
    CVE-2017-9115 and CVE-2017-9116
- pgajdos@suse.com: but really seem to fix only:
  CVE-2017-9110 [bsc#1040107], CVE-2017-9114 [bsc#1040114],
  CVE-2017-9116 [bsc#1040116], CVE-2017-12596 [bsc#1052522]; for
  the rest of issues see [bsc#1040109], [bsc#1040112],
  [bsc#1040113], [bsc#1040114], [bsc#1040115], and [bsc#1061305]</changelog>
  <changelog author="pgajdos@suse.com" date="1541505600">- asan_build: build ASAN included
- debug_build: build more suitable for debugging</changelog>
  <changelog author="pgajdos@suse.com" date="1541592000">- security update
  * CVE-2018-18444 [bsc#1113455]
    + openexr-CVE-2018-18444.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1560513600">- security update
- added patches
  CVE-2017-9111 [bsc#1040109], CVE-2017-9113 [bsc#1040113], CVE-2017-9115 [bsc#1040115]
  + openexr-CVE-2017-9111,9113,9115.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1563192000">- security update
- added patches
  CVE-2017-14988 [bsc#1061305]
  + openexr-CVE-2017-14988.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1568980800">- on behalf of Martin Pluskal:
- Enable tests on architectures with enough memory - boo#1146648
  * disable imffuzztest as it takes to much resources</changelog>
  <changelog author="pgajdos@suse.com" date="1568980801">- testsuite only for x86_64 [bsc#1146648]</changelog>
  <changelog author="pgajdos@suse.com" date="1587556800">- security update
- added patches
  fix CVE-2020-11762 [bsc#1169549], out-of-bounds read and write in DwaCompressor:uncompress in ImfDwaCompressor.cpp when handling the UNKNOWN compression case
  fix CVE-2020-11758 [bsc#1169573], out-of-bounds read in ImfOptimizedPixelReading.h.
  fix CVE-2020-11764 [bsc#1169574], out-of-bounds write in copyIntoFrameBuffer in ImfMisc.cpp
  fix CVE-2020-11765 [bsc#1169575], off-by-one error in use of the ImfXdr.h read function by DwaCompressor:Classifier:Classifier
  fix CVE-2020-11763 [bsc#1169576], out-of-bounds read and write, as demonstrated by ImfTileOffsets.cpp
  fix CVE-2020-11761 [bsc#1169578], out-of-bounds read during Huffman uncompression, as demonstrated by FastHufDecoder:refill in ImfFastHuf.cpp
  fix CVE-2020-11760 [bsc#1169580], out-of-bounds read during RLE uncompression in rleUncompress in ImfRle.cpp
  + openexr-CVE-2020-11762,11758,11764,11765,11763,11761,11760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1593604800">- security update
- added patches
  fix CVE-2020-15304 [bsc#1173466], NULL pointer dereference in TiledInputFile:TiledInputFile()
  + openexr-CVE-2020-15304.patch
  fix CVE-2020-15305 [bsc#1173467], use-after-free in DeepScanLineInputFile:DeepScanLineInputFile()
  + openexr-CVE-2020-15305.patch
  fix CVE-2020-15306 [bsc#1173469], invalid chunkCount attributes could cause a heap buffer overflow in getChunkOffsetTableSize()
  + openexr-CVE-2020-15306.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1608120000">- security update
- added patches
  fix CVE-2020-16587, CVE-2020-16588, CVE-2020-16589 [bsc#1179879], multiple memory safety issues
  + openexr-CVE-2020-16587.patch
  + openexr-CVE-2020-16588.patch
  + openexr-CVE-2020-16589.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1617192000">- security update
- added patches
  fix CVE-2021-3474 [bsc#1184174], Undefined-shift in Imf_2_5::FastHufDecoder::FastHufDecoder
  + openexr-CVE-2021-3474.patch
  fix CVE-2021-3475 [bsc#1184173], Integer-overflow in Imf_2_5::calculateNumTiles
  + openexr-CVE-2021-3475.patch
  fix CVE-2021-3476 [bsc#1184172], Undefined-shift in Imf_2_5::unpack14
  + openexr-CVE-2021-3476.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1617883200">- security update
- modified patches
  % openexr-CVE-2021-3474.patch (splitted into openexr-CVE-2021-20296.patch)
- added patches
  fix CVE-2021-20296 [bsc#1184355], Segv on unknown address in Imf_2_5:hufUncompress - Null Pointer dereference
  + openexr-CVE-2021-20296.patch
  fix CVE-2021-3477 [bsc#1184353], Heap-buffer-overflow in Imf_2_5::DeepTiledInputFile::readPixelSampleCounts
  + openexr-CVE-2021-3477.patch
  fix CVE-2021-3479 [bsc#1184354], Out-of-memory caused by allocation of a very large buffer
  + openexr-CVE-2021-3479.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1619524800">- security update
- added patches
  fix CVE-2021-23215 [bsc#1185216], Integer-overflow in Imf_2_5:DwaCompressor:initializeBuffers
  fix CVE-2021-26260 [bsc#1185217], Integer-overflow in Imf_2_5:DwaCompressor:initializeBuffers
  + openexr-CVE-2021-23215,26260.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623758400">- security update
- added patches
  fix CVE-2021-3598 [bsc#1187310], Heap buffer overflow in Imf_3_1:CharPtrIO:readChars
  + openexr-CVE-2021-3598.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623844800">- security update
- added patches
  fix CVE-2021-3605 [bsc#1187395], Heap buffer overflow in the rleUncompress function
  + openexr-CVE-2021-3605.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1627992000">- security update
- modified patches
  % openexr-CVE-2021-3476.patch (refreshed)
- added patches
  fix CVE-2021-20298 [bsc#1188460], Out-of-memory in B44Compressor
  + openexr-CVE-2021-20298.patch
  fix CVE-2021-20299 [bsc#1188459], Null-dereference READ in Imf_2_5:Header:operator
  + openexr-CVE-2021-20299.patch
  fix CVE-2021-20300 [bsc#1188458], Integer-overflow in Imf_2_5:hufUncompress
  + openexr-CVE-2021-20300.patch
  fix CVE-2021-20302 [bsc#1188462], Floating-point-exception in Imf_2_5:precalculateTileInfot
  + openexr-CVE-2021-20302.patch
  fix CVE-2021-20303 [bsc#1188457], Heap-buffer-overflow in Imf_2_5::copyIntoFrameBuffer
  + openexr-CVE-2021-20303.patch
  fix CVE-2021-20304 [bsc#1188461], Undefined-shift in Imf_2_5:hufDecode
  + openexr-CVE-2021-20304.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1636459200">- security update
- added patches
  fix CVE-2021-3933 [bsc#1192498], Integer-overflow in Imf_3_1:bytesPerDeepLineTable
  + openexr-CVE-2021-3933.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1636632000">- security update
- added patches
  fix CVE-2021-3941 [bsc#1192556], Divide-by-zero in Imf_3_1:RGBtoXYZ
  + openexr-CVE-2021-3941.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1641384000">- security update
- added patches
  fix CVE-2021-45942 [bsc#1194333], heap-based buffer overflow in Imf_3_1:LineCompositeTask:execute
  + openexr-CVE-2021-45942.patch</changelog>
</package>
<package pkgid="e4acbe6e12035a8597f85547362e3f6de97185857b99ef9fb7c699c5447a069f" name="libIlmImf-2_2-23-32bit" arch="x86_64">
  <version epoch="0" ver="2.2.1" rel="3.41.1"/>
  <changelog author="tchvatal@suse.com" date="1499860800">- Cleanup a bit with spec-cleaner</changelog>
  <changelog author="avindra@opensuse.org" date="1516017600">- Update to 2.2.1
  * Fix reported OpenEXR security vulnerabilities: CVE-2017-9110,
    CVE-2017-9111, CVE-2017-9112, CVE-2017-9113, CVE-2017-9114,
    CVE-2017-9115 and CVE-2017-9116
- pgajdos@suse.com: but really seem to fix only:
  CVE-2017-9110 [bsc#1040107], CVE-2017-9114 [bsc#1040114],
  CVE-2017-9116 [bsc#1040116], CVE-2017-12596 [bsc#1052522]; for
  the rest of issues see [bsc#1040109], [bsc#1040112],
  [bsc#1040113], [bsc#1040114], [bsc#1040115], and [bsc#1061305]</changelog>
  <changelog author="pgajdos@suse.com" date="1541505600">- asan_build: build ASAN included
- debug_build: build more suitable for debugging</changelog>
  <changelog author="pgajdos@suse.com" date="1541592000">- security update
  * CVE-2018-18444 [bsc#1113455]
    + openexr-CVE-2018-18444.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1560513600">- security update
- added patches
  CVE-2017-9111 [bsc#1040109], CVE-2017-9113 [bsc#1040113], CVE-2017-9115 [bsc#1040115]
  + openexr-CVE-2017-9111,9113,9115.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1563192000">- security update
- added patches
  CVE-2017-14988 [bsc#1061305]
  + openexr-CVE-2017-14988.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1568980800">- on behalf of Martin Pluskal:
- Enable tests on architectures with enough memory - boo#1146648
  * disable imffuzztest as it takes to much resources</changelog>
  <changelog author="pgajdos@suse.com" date="1568980801">- testsuite only for x86_64 [bsc#1146648]</changelog>
  <changelog author="pgajdos@suse.com" date="1587556800">- security update
- added patches
  fix CVE-2020-11762 [bsc#1169549], out-of-bounds read and write in DwaCompressor:uncompress in ImfDwaCompressor.cpp when handling the UNKNOWN compression case
  fix CVE-2020-11758 [bsc#1169573], out-of-bounds read in ImfOptimizedPixelReading.h.
  fix CVE-2020-11764 [bsc#1169574], out-of-bounds write in copyIntoFrameBuffer in ImfMisc.cpp
  fix CVE-2020-11765 [bsc#1169575], off-by-one error in use of the ImfXdr.h read function by DwaCompressor:Classifier:Classifier
  fix CVE-2020-11763 [bsc#1169576], out-of-bounds read and write, as demonstrated by ImfTileOffsets.cpp
  fix CVE-2020-11761 [bsc#1169578], out-of-bounds read during Huffman uncompression, as demonstrated by FastHufDecoder:refill in ImfFastHuf.cpp
  fix CVE-2020-11760 [bsc#1169580], out-of-bounds read during RLE uncompression in rleUncompress in ImfRle.cpp
  + openexr-CVE-2020-11762,11758,11764,11765,11763,11761,11760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1593604800">- security update
- added patches
  fix CVE-2020-15304 [bsc#1173466], NULL pointer dereference in TiledInputFile:TiledInputFile()
  + openexr-CVE-2020-15304.patch
  fix CVE-2020-15305 [bsc#1173467], use-after-free in DeepScanLineInputFile:DeepScanLineInputFile()
  + openexr-CVE-2020-15305.patch
  fix CVE-2020-15306 [bsc#1173469], invalid chunkCount attributes could cause a heap buffer overflow in getChunkOffsetTableSize()
  + openexr-CVE-2020-15306.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1608120000">- security update
- added patches
  fix CVE-2020-16587, CVE-2020-16588, CVE-2020-16589 [bsc#1179879], multiple memory safety issues
  + openexr-CVE-2020-16587.patch
  + openexr-CVE-2020-16588.patch
  + openexr-CVE-2020-16589.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1617192000">- security update
- added patches
  fix CVE-2021-3474 [bsc#1184174], Undefined-shift in Imf_2_5::FastHufDecoder::FastHufDecoder
  + openexr-CVE-2021-3474.patch
  fix CVE-2021-3475 [bsc#1184173], Integer-overflow in Imf_2_5::calculateNumTiles
  + openexr-CVE-2021-3475.patch
  fix CVE-2021-3476 [bsc#1184172], Undefined-shift in Imf_2_5::unpack14
  + openexr-CVE-2021-3476.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1617883200">- security update
- modified patches
  % openexr-CVE-2021-3474.patch (splitted into openexr-CVE-2021-20296.patch)
- added patches
  fix CVE-2021-20296 [bsc#1184355], Segv on unknown address in Imf_2_5:hufUncompress - Null Pointer dereference
  + openexr-CVE-2021-20296.patch
  fix CVE-2021-3477 [bsc#1184353], Heap-buffer-overflow in Imf_2_5::DeepTiledInputFile::readPixelSampleCounts
  + openexr-CVE-2021-3477.patch
  fix CVE-2021-3479 [bsc#1184354], Out-of-memory caused by allocation of a very large buffer
  + openexr-CVE-2021-3479.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1619524800">- security update
- added patches
  fix CVE-2021-23215 [bsc#1185216], Integer-overflow in Imf_2_5:DwaCompressor:initializeBuffers
  fix CVE-2021-26260 [bsc#1185217], Integer-overflow in Imf_2_5:DwaCompressor:initializeBuffers
  + openexr-CVE-2021-23215,26260.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623758400">- security update
- added patches
  fix CVE-2021-3598 [bsc#1187310], Heap buffer overflow in Imf_3_1:CharPtrIO:readChars
  + openexr-CVE-2021-3598.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623844800">- security update
- added patches
  fix CVE-2021-3605 [bsc#1187395], Heap buffer overflow in the rleUncompress function
  + openexr-CVE-2021-3605.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1627992000">- security update
- modified patches
  % openexr-CVE-2021-3476.patch (refreshed)
- added patches
  fix CVE-2021-20298 [bsc#1188460], Out-of-memory in B44Compressor
  + openexr-CVE-2021-20298.patch
  fix CVE-2021-20299 [bsc#1188459], Null-dereference READ in Imf_2_5:Header:operator
  + openexr-CVE-2021-20299.patch
  fix CVE-2021-20300 [bsc#1188458], Integer-overflow in Imf_2_5:hufUncompress
  + openexr-CVE-2021-20300.patch
  fix CVE-2021-20302 [bsc#1188462], Floating-point-exception in Imf_2_5:precalculateTileInfot
  + openexr-CVE-2021-20302.patch
  fix CVE-2021-20303 [bsc#1188457], Heap-buffer-overflow in Imf_2_5::copyIntoFrameBuffer
  + openexr-CVE-2021-20303.patch
  fix CVE-2021-20304 [bsc#1188461], Undefined-shift in Imf_2_5:hufDecode
  + openexr-CVE-2021-20304.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1636459200">- security update
- added patches
  fix CVE-2021-3933 [bsc#1192498], Integer-overflow in Imf_3_1:bytesPerDeepLineTable
  + openexr-CVE-2021-3933.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1636632000">- security update
- added patches
  fix CVE-2021-3941 [bsc#1192556], Divide-by-zero in Imf_3_1:RGBtoXYZ
  + openexr-CVE-2021-3941.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1641384000">- security update
- added patches
  fix CVE-2021-45942 [bsc#1194333], heap-based buffer overflow in Imf_3_1:LineCompositeTask:execute
  + openexr-CVE-2021-45942.patch</changelog>
</package>
<package pkgid="ee8ad42ed418ca37b9febf01fa7f91587f402ddf2897fcc83d39c6548ca06982" name="libIlmImfUtil-2_2-23" arch="aarch64">
  <version epoch="0" ver="2.2.1" rel="3.41.1"/>
  <changelog author="tchvatal@suse.com" date="1499860800">- Cleanup a bit with spec-cleaner</changelog>
  <changelog author="avindra@opensuse.org" date="1516017600">- Update to 2.2.1
  * Fix reported OpenEXR security vulnerabilities: CVE-2017-9110,
    CVE-2017-9111, CVE-2017-9112, CVE-2017-9113, CVE-2017-9114,
    CVE-2017-9115 and CVE-2017-9116
- pgajdos@suse.com: but really seem to fix only:
  CVE-2017-9110 [bsc#1040107], CVE-2017-9114 [bsc#1040114],
  CVE-2017-9116 [bsc#1040116], CVE-2017-12596 [bsc#1052522]; for
  the rest of issues see [bsc#1040109], [bsc#1040112],
  [bsc#1040113], [bsc#1040114], [bsc#1040115], and [bsc#1061305]</changelog>
  <changelog author="pgajdos@suse.com" date="1541505600">- asan_build: build ASAN included
- debug_build: build more suitable for debugging</changelog>
  <changelog author="pgajdos@suse.com" date="1541592000">- security update
  * CVE-2018-18444 [bsc#1113455]
    + openexr-CVE-2018-18444.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1560513600">- security update
- added patches
  CVE-2017-9111 [bsc#1040109], CVE-2017-9113 [bsc#1040113], CVE-2017-9115 [bsc#1040115]
  + openexr-CVE-2017-9111,9113,9115.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1563192000">- security update
- added patches
  CVE-2017-14988 [bsc#1061305]
  + openexr-CVE-2017-14988.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1568980800">- on behalf of Martin Pluskal:
- Enable tests on architectures with enough memory - boo#1146648
  * disable imffuzztest as it takes to much resources</changelog>
  <changelog author="pgajdos@suse.com" date="1568980801">- testsuite only for x86_64 [bsc#1146648]</changelog>
  <changelog author="pgajdos@suse.com" date="1587556800">- security update
- added patches
  fix CVE-2020-11762 [bsc#1169549], out-of-bounds read and write in DwaCompressor:uncompress in ImfDwaCompressor.cpp when handling the UNKNOWN compression case
  fix CVE-2020-11758 [bsc#1169573], out-of-bounds read in ImfOptimizedPixelReading.h.
  fix CVE-2020-11764 [bsc#1169574], out-of-bounds write in copyIntoFrameBuffer in ImfMisc.cpp
  fix CVE-2020-11765 [bsc#1169575], off-by-one error in use of the ImfXdr.h read function by DwaCompressor:Classifier:Classifier
  fix CVE-2020-11763 [bsc#1169576], out-of-bounds read and write, as demonstrated by ImfTileOffsets.cpp
  fix CVE-2020-11761 [bsc#1169578], out-of-bounds read during Huffman uncompression, as demonstrated by FastHufDecoder:refill in ImfFastHuf.cpp
  fix CVE-2020-11760 [bsc#1169580], out-of-bounds read during RLE uncompression in rleUncompress in ImfRle.cpp
  + openexr-CVE-2020-11762,11758,11764,11765,11763,11761,11760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1593604800">- security update
- added patches
  fix CVE-2020-15304 [bsc#1173466], NULL pointer dereference in TiledInputFile:TiledInputFile()
  + openexr-CVE-2020-15304.patch
  fix CVE-2020-15305 [bsc#1173467], use-after-free in DeepScanLineInputFile:DeepScanLineInputFile()
  + openexr-CVE-2020-15305.patch
  fix CVE-2020-15306 [bsc#1173469], invalid chunkCount attributes could cause a heap buffer overflow in getChunkOffsetTableSize()
  + openexr-CVE-2020-15306.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1608120000">- security update
- added patches
  fix CVE-2020-16587, CVE-2020-16588, CVE-2020-16589 [bsc#1179879], multiple memory safety issues
  + openexr-CVE-2020-16587.patch
  + openexr-CVE-2020-16588.patch
  + openexr-CVE-2020-16589.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1617192000">- security update
- added patches
  fix CVE-2021-3474 [bsc#1184174], Undefined-shift in Imf_2_5::FastHufDecoder::FastHufDecoder
  + openexr-CVE-2021-3474.patch
  fix CVE-2021-3475 [bsc#1184173], Integer-overflow in Imf_2_5::calculateNumTiles
  + openexr-CVE-2021-3475.patch
  fix CVE-2021-3476 [bsc#1184172], Undefined-shift in Imf_2_5::unpack14
  + openexr-CVE-2021-3476.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1617883200">- security update
- modified patches
  % openexr-CVE-2021-3474.patch (splitted into openexr-CVE-2021-20296.patch)
- added patches
  fix CVE-2021-20296 [bsc#1184355], Segv on unknown address in Imf_2_5:hufUncompress - Null Pointer dereference
  + openexr-CVE-2021-20296.patch
  fix CVE-2021-3477 [bsc#1184353], Heap-buffer-overflow in Imf_2_5::DeepTiledInputFile::readPixelSampleCounts
  + openexr-CVE-2021-3477.patch
  fix CVE-2021-3479 [bsc#1184354], Out-of-memory caused by allocation of a very large buffer
  + openexr-CVE-2021-3479.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1619524800">- security update
- added patches
  fix CVE-2021-23215 [bsc#1185216], Integer-overflow in Imf_2_5:DwaCompressor:initializeBuffers
  fix CVE-2021-26260 [bsc#1185217], Integer-overflow in Imf_2_5:DwaCompressor:initializeBuffers
  + openexr-CVE-2021-23215,26260.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623758400">- security update
- added patches
  fix CVE-2021-3598 [bsc#1187310], Heap buffer overflow in Imf_3_1:CharPtrIO:readChars
  + openexr-CVE-2021-3598.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623844800">- security update
- added patches
  fix CVE-2021-3605 [bsc#1187395], Heap buffer overflow in the rleUncompress function
  + openexr-CVE-2021-3605.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1627992000">- security update
- modified patches
  % openexr-CVE-2021-3476.patch (refreshed)
- added patches
  fix CVE-2021-20298 [bsc#1188460], Out-of-memory in B44Compressor
  + openexr-CVE-2021-20298.patch
  fix CVE-2021-20299 [bsc#1188459], Null-dereference READ in Imf_2_5:Header:operator
  + openexr-CVE-2021-20299.patch
  fix CVE-2021-20300 [bsc#1188458], Integer-overflow in Imf_2_5:hufUncompress
  + openexr-CVE-2021-20300.patch
  fix CVE-2021-20302 [bsc#1188462], Floating-point-exception in Imf_2_5:precalculateTileInfot
  + openexr-CVE-2021-20302.patch
  fix CVE-2021-20303 [bsc#1188457], Heap-buffer-overflow in Imf_2_5::copyIntoFrameBuffer
  + openexr-CVE-2021-20303.patch
  fix CVE-2021-20304 [bsc#1188461], Undefined-shift in Imf_2_5:hufDecode
  + openexr-CVE-2021-20304.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1636459200">- security update
- added patches
  fix CVE-2021-3933 [bsc#1192498], Integer-overflow in Imf_3_1:bytesPerDeepLineTable
  + openexr-CVE-2021-3933.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1636632000">- security update
- added patches
  fix CVE-2021-3941 [bsc#1192556], Divide-by-zero in Imf_3_1:RGBtoXYZ
  + openexr-CVE-2021-3941.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1641384000">- security update
- added patches
  fix CVE-2021-45942 [bsc#1194333], heap-based buffer overflow in Imf_3_1:LineCompositeTask:execute
  + openexr-CVE-2021-45942.patch</changelog>
</package>
<package pkgid="5041cc371a981a3b93308b2bbd871e7eb8d4fdaa203f666f86e685e08bf393de" name="libIlmImfUtil-2_2-23" arch="ppc64le">
  <version epoch="0" ver="2.2.1" rel="3.41.1"/>
  <changelog author="tchvatal@suse.com" date="1499860800">- Cleanup a bit with spec-cleaner</changelog>
  <changelog author="avindra@opensuse.org" date="1516017600">- Update to 2.2.1
  * Fix reported OpenEXR security vulnerabilities: CVE-2017-9110,
    CVE-2017-9111, CVE-2017-9112, CVE-2017-9113, CVE-2017-9114,
    CVE-2017-9115 and CVE-2017-9116
- pgajdos@suse.com: but really seem to fix only:
  CVE-2017-9110 [bsc#1040107], CVE-2017-9114 [bsc#1040114],
  CVE-2017-9116 [bsc#1040116], CVE-2017-12596 [bsc#1052522]; for
  the rest of issues see [bsc#1040109], [bsc#1040112],
  [bsc#1040113], [bsc#1040114], [bsc#1040115], and [bsc#1061305]</changelog>
  <changelog author="pgajdos@suse.com" date="1541505600">- asan_build: build ASAN included
- debug_build: build more suitable for debugging</changelog>
  <changelog author="pgajdos@suse.com" date="1541592000">- security update
  * CVE-2018-18444 [bsc#1113455]
    + openexr-CVE-2018-18444.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1560513600">- security update
- added patches
  CVE-2017-9111 [bsc#1040109], CVE-2017-9113 [bsc#1040113], CVE-2017-9115 [bsc#1040115]
  + openexr-CVE-2017-9111,9113,9115.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1563192000">- security update
- added patches
  CVE-2017-14988 [bsc#1061305]
  + openexr-CVE-2017-14988.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1568980800">- on behalf of Martin Pluskal:
- Enable tests on architectures with enough memory - boo#1146648
  * disable imffuzztest as it takes to much resources</changelog>
  <changelog author="pgajdos@suse.com" date="1568980801">- testsuite only for x86_64 [bsc#1146648]</changelog>
  <changelog author="pgajdos@suse.com" date="1587556800">- security update
- added patches
  fix CVE-2020-11762 [bsc#1169549], out-of-bounds read and write in DwaCompressor:uncompress in ImfDwaCompressor.cpp when handling the UNKNOWN compression case
  fix CVE-2020-11758 [bsc#1169573], out-of-bounds read in ImfOptimizedPixelReading.h.
  fix CVE-2020-11764 [bsc#1169574], out-of-bounds write in copyIntoFrameBuffer in ImfMisc.cpp
  fix CVE-2020-11765 [bsc#1169575], off-by-one error in use of the ImfXdr.h read function by DwaCompressor:Classifier:Classifier
  fix CVE-2020-11763 [bsc#1169576], out-of-bounds read and write, as demonstrated by ImfTileOffsets.cpp
  fix CVE-2020-11761 [bsc#1169578], out-of-bounds read during Huffman uncompression, as demonstrated by FastHufDecoder:refill in ImfFastHuf.cpp
  fix CVE-2020-11760 [bsc#1169580], out-of-bounds read during RLE uncompression in rleUncompress in ImfRle.cpp
  + openexr-CVE-2020-11762,11758,11764,11765,11763,11761,11760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1593604800">- security update
- added patches
  fix CVE-2020-15304 [bsc#1173466], NULL pointer dereference in TiledInputFile:TiledInputFile()
  + openexr-CVE-2020-15304.patch
  fix CVE-2020-15305 [bsc#1173467], use-after-free in DeepScanLineInputFile:DeepScanLineInputFile()
  + openexr-CVE-2020-15305.patch
  fix CVE-2020-15306 [bsc#1173469], invalid chunkCount attributes could cause a heap buffer overflow in getChunkOffsetTableSize()
  + openexr-CVE-2020-15306.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1608120000">- security update
- added patches
  fix CVE-2020-16587, CVE-2020-16588, CVE-2020-16589 [bsc#1179879], multiple memory safety issues
  + openexr-CVE-2020-16587.patch
  + openexr-CVE-2020-16588.patch
  + openexr-CVE-2020-16589.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1617192000">- security update
- added patches
  fix CVE-2021-3474 [bsc#1184174], Undefined-shift in Imf_2_5::FastHufDecoder::FastHufDecoder
  + openexr-CVE-2021-3474.patch
  fix CVE-2021-3475 [bsc#1184173], Integer-overflow in Imf_2_5::calculateNumTiles
  + openexr-CVE-2021-3475.patch
  fix CVE-2021-3476 [bsc#1184172], Undefined-shift in Imf_2_5::unpack14
  + openexr-CVE-2021-3476.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1617883200">- security update
- modified patches
  % openexr-CVE-2021-3474.patch (splitted into openexr-CVE-2021-20296.patch)
- added patches
  fix CVE-2021-20296 [bsc#1184355], Segv on unknown address in Imf_2_5:hufUncompress - Null Pointer dereference
  + openexr-CVE-2021-20296.patch
  fix CVE-2021-3477 [bsc#1184353], Heap-buffer-overflow in Imf_2_5::DeepTiledInputFile::readPixelSampleCounts
  + openexr-CVE-2021-3477.patch
  fix CVE-2021-3479 [bsc#1184354], Out-of-memory caused by allocation of a very large buffer
  + openexr-CVE-2021-3479.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1619524800">- security update
- added patches
  fix CVE-2021-23215 [bsc#1185216], Integer-overflow in Imf_2_5:DwaCompressor:initializeBuffers
  fix CVE-2021-26260 [bsc#1185217], Integer-overflow in Imf_2_5:DwaCompressor:initializeBuffers
  + openexr-CVE-2021-23215,26260.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623758400">- security update
- added patches
  fix CVE-2021-3598 [bsc#1187310], Heap buffer overflow in Imf_3_1:CharPtrIO:readChars
  + openexr-CVE-2021-3598.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623844800">- security update
- added patches
  fix CVE-2021-3605 [bsc#1187395], Heap buffer overflow in the rleUncompress function
  + openexr-CVE-2021-3605.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1627992000">- security update
- modified patches
  % openexr-CVE-2021-3476.patch (refreshed)
- added patches
  fix CVE-2021-20298 [bsc#1188460], Out-of-memory in B44Compressor
  + openexr-CVE-2021-20298.patch
  fix CVE-2021-20299 [bsc#1188459], Null-dereference READ in Imf_2_5:Header:operator
  + openexr-CVE-2021-20299.patch
  fix CVE-2021-20300 [bsc#1188458], Integer-overflow in Imf_2_5:hufUncompress
  + openexr-CVE-2021-20300.patch
  fix CVE-2021-20302 [bsc#1188462], Floating-point-exception in Imf_2_5:precalculateTileInfot
  + openexr-CVE-2021-20302.patch
  fix CVE-2021-20303 [bsc#1188457], Heap-buffer-overflow in Imf_2_5::copyIntoFrameBuffer
  + openexr-CVE-2021-20303.patch
  fix CVE-2021-20304 [bsc#1188461], Undefined-shift in Imf_2_5:hufDecode
  + openexr-CVE-2021-20304.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1636459200">- security update
- added patches
  fix CVE-2021-3933 [bsc#1192498], Integer-overflow in Imf_3_1:bytesPerDeepLineTable
  + openexr-CVE-2021-3933.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1636632000">- security update
- added patches
  fix CVE-2021-3941 [bsc#1192556], Divide-by-zero in Imf_3_1:RGBtoXYZ
  + openexr-CVE-2021-3941.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1641384000">- security update
- added patches
  fix CVE-2021-45942 [bsc#1194333], heap-based buffer overflow in Imf_3_1:LineCompositeTask:execute
  + openexr-CVE-2021-45942.patch</changelog>
</package>
<package pkgid="b521b02b71f47c6fe05115dffc899f645c67828c0050546103b9fd59daf05a83" name="libIlmImfUtil-2_2-23" arch="s390x">
  <version epoch="0" ver="2.2.1" rel="3.41.1"/>
  <changelog author="tchvatal@suse.com" date="1499860800">- Cleanup a bit with spec-cleaner</changelog>
  <changelog author="avindra@opensuse.org" date="1516017600">- Update to 2.2.1
  * Fix reported OpenEXR security vulnerabilities: CVE-2017-9110,
    CVE-2017-9111, CVE-2017-9112, CVE-2017-9113, CVE-2017-9114,
    CVE-2017-9115 and CVE-2017-9116
- pgajdos@suse.com: but really seem to fix only:
  CVE-2017-9110 [bsc#1040107], CVE-2017-9114 [bsc#1040114],
  CVE-2017-9116 [bsc#1040116], CVE-2017-12596 [bsc#1052522]; for
  the rest of issues see [bsc#1040109], [bsc#1040112],
  [bsc#1040113], [bsc#1040114], [bsc#1040115], and [bsc#1061305]</changelog>
  <changelog author="pgajdos@suse.com" date="1541505600">- asan_build: build ASAN included
- debug_build: build more suitable for debugging</changelog>
  <changelog author="pgajdos@suse.com" date="1541592000">- security update
  * CVE-2018-18444 [bsc#1113455]
    + openexr-CVE-2018-18444.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1560513600">- security update
- added patches
  CVE-2017-9111 [bsc#1040109], CVE-2017-9113 [bsc#1040113], CVE-2017-9115 [bsc#1040115]
  + openexr-CVE-2017-9111,9113,9115.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1563192000">- security update
- added patches
  CVE-2017-14988 [bsc#1061305]
  + openexr-CVE-2017-14988.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1568980800">- on behalf of Martin Pluskal:
- Enable tests on architectures with enough memory - boo#1146648
  * disable imffuzztest as it takes to much resources</changelog>
  <changelog author="pgajdos@suse.com" date="1568980801">- testsuite only for x86_64 [bsc#1146648]</changelog>
  <changelog author="pgajdos@suse.com" date="1587556800">- security update
- added patches
  fix CVE-2020-11762 [bsc#1169549], out-of-bounds read and write in DwaCompressor:uncompress in ImfDwaCompressor.cpp when handling the UNKNOWN compression case
  fix CVE-2020-11758 [bsc#1169573], out-of-bounds read in ImfOptimizedPixelReading.h.
  fix CVE-2020-11764 [bsc#1169574], out-of-bounds write in copyIntoFrameBuffer in ImfMisc.cpp
  fix CVE-2020-11765 [bsc#1169575], off-by-one error in use of the ImfXdr.h read function by DwaCompressor:Classifier:Classifier
  fix CVE-2020-11763 [bsc#1169576], out-of-bounds read and write, as demonstrated by ImfTileOffsets.cpp
  fix CVE-2020-11761 [bsc#1169578], out-of-bounds read during Huffman uncompression, as demonstrated by FastHufDecoder:refill in ImfFastHuf.cpp
  fix CVE-2020-11760 [bsc#1169580], out-of-bounds read during RLE uncompression in rleUncompress in ImfRle.cpp
  + openexr-CVE-2020-11762,11758,11764,11765,11763,11761,11760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1593604800">- security update
- added patches
  fix CVE-2020-15304 [bsc#1173466], NULL pointer dereference in TiledInputFile:TiledInputFile()
  + openexr-CVE-2020-15304.patch
  fix CVE-2020-15305 [bsc#1173467], use-after-free in DeepScanLineInputFile:DeepScanLineInputFile()
  + openexr-CVE-2020-15305.patch
  fix CVE-2020-15306 [bsc#1173469], invalid chunkCount attributes could cause a heap buffer overflow in getChunkOffsetTableSize()
  + openexr-CVE-2020-15306.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1608120000">- security update
- added patches
  fix CVE-2020-16587, CVE-2020-16588, CVE-2020-16589 [bsc#1179879], multiple memory safety issues
  + openexr-CVE-2020-16587.patch
  + openexr-CVE-2020-16588.patch
  + openexr-CVE-2020-16589.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1617192000">- security update
- added patches
  fix CVE-2021-3474 [bsc#1184174], Undefined-shift in Imf_2_5::FastHufDecoder::FastHufDecoder
  + openexr-CVE-2021-3474.patch
  fix CVE-2021-3475 [bsc#1184173], Integer-overflow in Imf_2_5::calculateNumTiles
  + openexr-CVE-2021-3475.patch
  fix CVE-2021-3476 [bsc#1184172], Undefined-shift in Imf_2_5::unpack14
  + openexr-CVE-2021-3476.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1617883200">- security update
- modified patches
  % openexr-CVE-2021-3474.patch (splitted into openexr-CVE-2021-20296.patch)
- added patches
  fix CVE-2021-20296 [bsc#1184355], Segv on unknown address in Imf_2_5:hufUncompress - Null Pointer dereference
  + openexr-CVE-2021-20296.patch
  fix CVE-2021-3477 [bsc#1184353], Heap-buffer-overflow in Imf_2_5::DeepTiledInputFile::readPixelSampleCounts
  + openexr-CVE-2021-3477.patch
  fix CVE-2021-3479 [bsc#1184354], Out-of-memory caused by allocation of a very large buffer
  + openexr-CVE-2021-3479.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1619524800">- security update
- added patches
  fix CVE-2021-23215 [bsc#1185216], Integer-overflow in Imf_2_5:DwaCompressor:initializeBuffers
  fix CVE-2021-26260 [bsc#1185217], Integer-overflow in Imf_2_5:DwaCompressor:initializeBuffers
  + openexr-CVE-2021-23215,26260.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623758400">- security update
- added patches
  fix CVE-2021-3598 [bsc#1187310], Heap buffer overflow in Imf_3_1:CharPtrIO:readChars
  + openexr-CVE-2021-3598.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623844800">- security update
- added patches
  fix CVE-2021-3605 [bsc#1187395], Heap buffer overflow in the rleUncompress function
  + openexr-CVE-2021-3605.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1627992000">- security update
- modified patches
  % openexr-CVE-2021-3476.patch (refreshed)
- added patches
  fix CVE-2021-20298 [bsc#1188460], Out-of-memory in B44Compressor
  + openexr-CVE-2021-20298.patch
  fix CVE-2021-20299 [bsc#1188459], Null-dereference READ in Imf_2_5:Header:operator
  + openexr-CVE-2021-20299.patch
  fix CVE-2021-20300 [bsc#1188458], Integer-overflow in Imf_2_5:hufUncompress
  + openexr-CVE-2021-20300.patch
  fix CVE-2021-20302 [bsc#1188462], Floating-point-exception in Imf_2_5:precalculateTileInfot
  + openexr-CVE-2021-20302.patch
  fix CVE-2021-20303 [bsc#1188457], Heap-buffer-overflow in Imf_2_5::copyIntoFrameBuffer
  + openexr-CVE-2021-20303.patch
  fix CVE-2021-20304 [bsc#1188461], Undefined-shift in Imf_2_5:hufDecode
  + openexr-CVE-2021-20304.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1636459200">- security update
- added patches
  fix CVE-2021-3933 [bsc#1192498], Integer-overflow in Imf_3_1:bytesPerDeepLineTable
  + openexr-CVE-2021-3933.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1636632000">- security update
- added patches
  fix CVE-2021-3941 [bsc#1192556], Divide-by-zero in Imf_3_1:RGBtoXYZ
  + openexr-CVE-2021-3941.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1641384000">- security update
- added patches
  fix CVE-2021-45942 [bsc#1194333], heap-based buffer overflow in Imf_3_1:LineCompositeTask:execute
  + openexr-CVE-2021-45942.patch</changelog>
</package>
<package pkgid="f8c17fe380142d541e6816a79677818508691f225e57d227544a1e401b45ae60" name="libIlmImfUtil-2_2-23" arch="x86_64">
  <version epoch="0" ver="2.2.1" rel="3.41.1"/>
  <changelog author="tchvatal@suse.com" date="1499860800">- Cleanup a bit with spec-cleaner</changelog>
  <changelog author="avindra@opensuse.org" date="1516017600">- Update to 2.2.1
  * Fix reported OpenEXR security vulnerabilities: CVE-2017-9110,
    CVE-2017-9111, CVE-2017-9112, CVE-2017-9113, CVE-2017-9114,
    CVE-2017-9115 and CVE-2017-9116
- pgajdos@suse.com: but really seem to fix only:
  CVE-2017-9110 [bsc#1040107], CVE-2017-9114 [bsc#1040114],
  CVE-2017-9116 [bsc#1040116], CVE-2017-12596 [bsc#1052522]; for
  the rest of issues see [bsc#1040109], [bsc#1040112],
  [bsc#1040113], [bsc#1040114], [bsc#1040115], and [bsc#1061305]</changelog>
  <changelog author="pgajdos@suse.com" date="1541505600">- asan_build: build ASAN included
- debug_build: build more suitable for debugging</changelog>
  <changelog author="pgajdos@suse.com" date="1541592000">- security update
  * CVE-2018-18444 [bsc#1113455]
    + openexr-CVE-2018-18444.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1560513600">- security update
- added patches
  CVE-2017-9111 [bsc#1040109], CVE-2017-9113 [bsc#1040113], CVE-2017-9115 [bsc#1040115]
  + openexr-CVE-2017-9111,9113,9115.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1563192000">- security update
- added patches
  CVE-2017-14988 [bsc#1061305]
  + openexr-CVE-2017-14988.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1568980800">- on behalf of Martin Pluskal:
- Enable tests on architectures with enough memory - boo#1146648
  * disable imffuzztest as it takes to much resources</changelog>
  <changelog author="pgajdos@suse.com" date="1568980801">- testsuite only for x86_64 [bsc#1146648]</changelog>
  <changelog author="pgajdos@suse.com" date="1587556800">- security update
- added patches
  fix CVE-2020-11762 [bsc#1169549], out-of-bounds read and write in DwaCompressor:uncompress in ImfDwaCompressor.cpp when handling the UNKNOWN compression case
  fix CVE-2020-11758 [bsc#1169573], out-of-bounds read in ImfOptimizedPixelReading.h.
  fix CVE-2020-11764 [bsc#1169574], out-of-bounds write in copyIntoFrameBuffer in ImfMisc.cpp
  fix CVE-2020-11765 [bsc#1169575], off-by-one error in use of the ImfXdr.h read function by DwaCompressor:Classifier:Classifier
  fix CVE-2020-11763 [bsc#1169576], out-of-bounds read and write, as demonstrated by ImfTileOffsets.cpp
  fix CVE-2020-11761 [bsc#1169578], out-of-bounds read during Huffman uncompression, as demonstrated by FastHufDecoder:refill in ImfFastHuf.cpp
  fix CVE-2020-11760 [bsc#1169580], out-of-bounds read during RLE uncompression in rleUncompress in ImfRle.cpp
  + openexr-CVE-2020-11762,11758,11764,11765,11763,11761,11760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1593604800">- security update
- added patches
  fix CVE-2020-15304 [bsc#1173466], NULL pointer dereference in TiledInputFile:TiledInputFile()
  + openexr-CVE-2020-15304.patch
  fix CVE-2020-15305 [bsc#1173467], use-after-free in DeepScanLineInputFile:DeepScanLineInputFile()
  + openexr-CVE-2020-15305.patch
  fix CVE-2020-15306 [bsc#1173469], invalid chunkCount attributes could cause a heap buffer overflow in getChunkOffsetTableSize()
  + openexr-CVE-2020-15306.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1608120000">- security update
- added patches
  fix CVE-2020-16587, CVE-2020-16588, CVE-2020-16589 [bsc#1179879], multiple memory safety issues
  + openexr-CVE-2020-16587.patch
  + openexr-CVE-2020-16588.patch
  + openexr-CVE-2020-16589.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1617192000">- security update
- added patches
  fix CVE-2021-3474 [bsc#1184174], Undefined-shift in Imf_2_5::FastHufDecoder::FastHufDecoder
  + openexr-CVE-2021-3474.patch
  fix CVE-2021-3475 [bsc#1184173], Integer-overflow in Imf_2_5::calculateNumTiles
  + openexr-CVE-2021-3475.patch
  fix CVE-2021-3476 [bsc#1184172], Undefined-shift in Imf_2_5::unpack14
  + openexr-CVE-2021-3476.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1617883200">- security update
- modified patches
  % openexr-CVE-2021-3474.patch (splitted into openexr-CVE-2021-20296.patch)
- added patches
  fix CVE-2021-20296 [bsc#1184355], Segv on unknown address in Imf_2_5:hufUncompress - Null Pointer dereference
  + openexr-CVE-2021-20296.patch
  fix CVE-2021-3477 [bsc#1184353], Heap-buffer-overflow in Imf_2_5::DeepTiledInputFile::readPixelSampleCounts
  + openexr-CVE-2021-3477.patch
  fix CVE-2021-3479 [bsc#1184354], Out-of-memory caused by allocation of a very large buffer
  + openexr-CVE-2021-3479.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1619524800">- security update
- added patches
  fix CVE-2021-23215 [bsc#1185216], Integer-overflow in Imf_2_5:DwaCompressor:initializeBuffers
  fix CVE-2021-26260 [bsc#1185217], Integer-overflow in Imf_2_5:DwaCompressor:initializeBuffers
  + openexr-CVE-2021-23215,26260.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623758400">- security update
- added patches
  fix CVE-2021-3598 [bsc#1187310], Heap buffer overflow in Imf_3_1:CharPtrIO:readChars
  + openexr-CVE-2021-3598.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623844800">- security update
- added patches
  fix CVE-2021-3605 [bsc#1187395], Heap buffer overflow in the rleUncompress function
  + openexr-CVE-2021-3605.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1627992000">- security update
- modified patches
  % openexr-CVE-2021-3476.patch (refreshed)
- added patches
  fix CVE-2021-20298 [bsc#1188460], Out-of-memory in B44Compressor
  + openexr-CVE-2021-20298.patch
  fix CVE-2021-20299 [bsc#1188459], Null-dereference READ in Imf_2_5:Header:operator
  + openexr-CVE-2021-20299.patch
  fix CVE-2021-20300 [bsc#1188458], Integer-overflow in Imf_2_5:hufUncompress
  + openexr-CVE-2021-20300.patch
  fix CVE-2021-20302 [bsc#1188462], Floating-point-exception in Imf_2_5:precalculateTileInfot
  + openexr-CVE-2021-20302.patch
  fix CVE-2021-20303 [bsc#1188457], Heap-buffer-overflow in Imf_2_5::copyIntoFrameBuffer
  + openexr-CVE-2021-20303.patch
  fix CVE-2021-20304 [bsc#1188461], Undefined-shift in Imf_2_5:hufDecode
  + openexr-CVE-2021-20304.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1636459200">- security update
- added patches
  fix CVE-2021-3933 [bsc#1192498], Integer-overflow in Imf_3_1:bytesPerDeepLineTable
  + openexr-CVE-2021-3933.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1636632000">- security update
- added patches
  fix CVE-2021-3941 [bsc#1192556], Divide-by-zero in Imf_3_1:RGBtoXYZ
  + openexr-CVE-2021-3941.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1641384000">- security update
- added patches
  fix CVE-2021-45942 [bsc#1194333], heap-based buffer overflow in Imf_3_1:LineCompositeTask:execute
  + openexr-CVE-2021-45942.patch</changelog>
</package>
<package pkgid="3fa046ee8424ce99238b9f9b7b753c478e048cd7c1184f833f8b3baf3ea0a59f" name="libIlmImfUtil-2_2-23-32bit" arch="x86_64">
  <version epoch="0" ver="2.2.1" rel="3.41.1"/>
  <changelog author="tchvatal@suse.com" date="1499860800">- Cleanup a bit with spec-cleaner</changelog>
  <changelog author="avindra@opensuse.org" date="1516017600">- Update to 2.2.1
  * Fix reported OpenEXR security vulnerabilities: CVE-2017-9110,
    CVE-2017-9111, CVE-2017-9112, CVE-2017-9113, CVE-2017-9114,
    CVE-2017-9115 and CVE-2017-9116
- pgajdos@suse.com: but really seem to fix only:
  CVE-2017-9110 [bsc#1040107], CVE-2017-9114 [bsc#1040114],
  CVE-2017-9116 [bsc#1040116], CVE-2017-12596 [bsc#1052522]; for
  the rest of issues see [bsc#1040109], [bsc#1040112],
  [bsc#1040113], [bsc#1040114], [bsc#1040115], and [bsc#1061305]</changelog>
  <changelog author="pgajdos@suse.com" date="1541505600">- asan_build: build ASAN included
- debug_build: build more suitable for debugging</changelog>
  <changelog author="pgajdos@suse.com" date="1541592000">- security update
  * CVE-2018-18444 [bsc#1113455]
    + openexr-CVE-2018-18444.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1560513600">- security update
- added patches
  CVE-2017-9111 [bsc#1040109], CVE-2017-9113 [bsc#1040113], CVE-2017-9115 [bsc#1040115]
  + openexr-CVE-2017-9111,9113,9115.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1563192000">- security update
- added patches
  CVE-2017-14988 [bsc#1061305]
  + openexr-CVE-2017-14988.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1568980800">- on behalf of Martin Pluskal:
- Enable tests on architectures with enough memory - boo#1146648
  * disable imffuzztest as it takes to much resources</changelog>
  <changelog author="pgajdos@suse.com" date="1568980801">- testsuite only for x86_64 [bsc#1146648]</changelog>
  <changelog author="pgajdos@suse.com" date="1587556800">- security update
- added patches
  fix CVE-2020-11762 [bsc#1169549], out-of-bounds read and write in DwaCompressor:uncompress in ImfDwaCompressor.cpp when handling the UNKNOWN compression case
  fix CVE-2020-11758 [bsc#1169573], out-of-bounds read in ImfOptimizedPixelReading.h.
  fix CVE-2020-11764 [bsc#1169574], out-of-bounds write in copyIntoFrameBuffer in ImfMisc.cpp
  fix CVE-2020-11765 [bsc#1169575], off-by-one error in use of the ImfXdr.h read function by DwaCompressor:Classifier:Classifier
  fix CVE-2020-11763 [bsc#1169576], out-of-bounds read and write, as demonstrated by ImfTileOffsets.cpp
  fix CVE-2020-11761 [bsc#1169578], out-of-bounds read during Huffman uncompression, as demonstrated by FastHufDecoder:refill in ImfFastHuf.cpp
  fix CVE-2020-11760 [bsc#1169580], out-of-bounds read during RLE uncompression in rleUncompress in ImfRle.cpp
  + openexr-CVE-2020-11762,11758,11764,11765,11763,11761,11760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1593604800">- security update
- added patches
  fix CVE-2020-15304 [bsc#1173466], NULL pointer dereference in TiledInputFile:TiledInputFile()
  + openexr-CVE-2020-15304.patch
  fix CVE-2020-15305 [bsc#1173467], use-after-free in DeepScanLineInputFile:DeepScanLineInputFile()
  + openexr-CVE-2020-15305.patch
  fix CVE-2020-15306 [bsc#1173469], invalid chunkCount attributes could cause a heap buffer overflow in getChunkOffsetTableSize()
  + openexr-CVE-2020-15306.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1608120000">- security update
- added patches
  fix CVE-2020-16587, CVE-2020-16588, CVE-2020-16589 [bsc#1179879], multiple memory safety issues
  + openexr-CVE-2020-16587.patch
  + openexr-CVE-2020-16588.patch
  + openexr-CVE-2020-16589.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1617192000">- security update
- added patches
  fix CVE-2021-3474 [bsc#1184174], Undefined-shift in Imf_2_5::FastHufDecoder::FastHufDecoder
  + openexr-CVE-2021-3474.patch
  fix CVE-2021-3475 [bsc#1184173], Integer-overflow in Imf_2_5::calculateNumTiles
  + openexr-CVE-2021-3475.patch
  fix CVE-2021-3476 [bsc#1184172], Undefined-shift in Imf_2_5::unpack14
  + openexr-CVE-2021-3476.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1617883200">- security update
- modified patches
  % openexr-CVE-2021-3474.patch (splitted into openexr-CVE-2021-20296.patch)
- added patches
  fix CVE-2021-20296 [bsc#1184355], Segv on unknown address in Imf_2_5:hufUncompress - Null Pointer dereference
  + openexr-CVE-2021-20296.patch
  fix CVE-2021-3477 [bsc#1184353], Heap-buffer-overflow in Imf_2_5::DeepTiledInputFile::readPixelSampleCounts
  + openexr-CVE-2021-3477.patch
  fix CVE-2021-3479 [bsc#1184354], Out-of-memory caused by allocation of a very large buffer
  + openexr-CVE-2021-3479.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1619524800">- security update
- added patches
  fix CVE-2021-23215 [bsc#1185216], Integer-overflow in Imf_2_5:DwaCompressor:initializeBuffers
  fix CVE-2021-26260 [bsc#1185217], Integer-overflow in Imf_2_5:DwaCompressor:initializeBuffers
  + openexr-CVE-2021-23215,26260.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623758400">- security update
- added patches
  fix CVE-2021-3598 [bsc#1187310], Heap buffer overflow in Imf_3_1:CharPtrIO:readChars
  + openexr-CVE-2021-3598.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623844800">- security update
- added patches
  fix CVE-2021-3605 [bsc#1187395], Heap buffer overflow in the rleUncompress function
  + openexr-CVE-2021-3605.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1627992000">- security update
- modified patches
  % openexr-CVE-2021-3476.patch (refreshed)
- added patches
  fix CVE-2021-20298 [bsc#1188460], Out-of-memory in B44Compressor
  + openexr-CVE-2021-20298.patch
  fix CVE-2021-20299 [bsc#1188459], Null-dereference READ in Imf_2_5:Header:operator
  + openexr-CVE-2021-20299.patch
  fix CVE-2021-20300 [bsc#1188458], Integer-overflow in Imf_2_5:hufUncompress
  + openexr-CVE-2021-20300.patch
  fix CVE-2021-20302 [bsc#1188462], Floating-point-exception in Imf_2_5:precalculateTileInfot
  + openexr-CVE-2021-20302.patch
  fix CVE-2021-20303 [bsc#1188457], Heap-buffer-overflow in Imf_2_5::copyIntoFrameBuffer
  + openexr-CVE-2021-20303.patch
  fix CVE-2021-20304 [bsc#1188461], Undefined-shift in Imf_2_5:hufDecode
  + openexr-CVE-2021-20304.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1636459200">- security update
- added patches
  fix CVE-2021-3933 [bsc#1192498], Integer-overflow in Imf_3_1:bytesPerDeepLineTable
  + openexr-CVE-2021-3933.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1636632000">- security update
- added patches
  fix CVE-2021-3941 [bsc#1192556], Divide-by-zero in Imf_3_1:RGBtoXYZ
  + openexr-CVE-2021-3941.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1641384000">- security update
- added patches
  fix CVE-2021-45942 [bsc#1194333], heap-based buffer overflow in Imf_3_1:LineCompositeTask:execute
  + openexr-CVE-2021-45942.patch</changelog>
</package>
<package pkgid="2e93793f9eae0e6c75066441ba39f4f6a063855203df86e6f72cc2182a88e5c8" name="libMagick++-7_Q16HDRI4-32bit" arch="x86_64">
  <version epoch="0" ver="7.0.7.34" rel="10.21.1"/>
  <changelog author="pgajdos@suse.com" date="1559217600">- security update
- added patches
  CVE-2019-11598 [bsc#1136732]
  + ImageMagick-CVE-2019-11598.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1560859200">- security update
- disable indirect reads [bsc#1138425]
  (https://imagemagick.org/script/security-policy.php)
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1560945600">- security update
- added patches
  CVE-2019-11597 [bsc#1138464]
  + ImageMagick-CVE-2019-11597.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1563883200">- security update
- added patches
  CVE-2019-13301 [bsc#1140554] (core)
  + ImageMagick-CVE-2019-13301.patch
  CVE-2019-13309 [bsc#1140520] (wand)
  + ImageMagick-CVE-2019-13309.patch
  CVE-2019-13310 [bsc#1140501] (wand)
  + ImageMagick-CVE-2019-13310.patch
  CVE-2019-13311 [bsc#1140513] (wand)
  + ImageMagick-CVE-2019-13311.patch
  CVE-2019-13303 [bsc#1140549] (core)
  + ImageMagick-CVE-2019-13303.patch
  CVE-2019-13296 [bsc#1140665] (wand)
  + ImageMagick-CVE-2019-13296.patch
  CVE-2019-13299 [bsc#1140668] (core)
  + ImageMagick-CVE-2019-13299.patch
  CVE-2019-13454 [bsc#1141171] (core)
  + ImageMagick-CVE-2019-13454.patch
  CVE-2019-13295 [bsc#1140664], CVE-2019-13297 [bsc#1140666] (core)
  + ImageMagick-CVE-2019-13295,13297.patch
  CVE-2019-12979 [bsc#1139886] (core)
  + ImageMagick-CVE-2019-12979.patch
  CVE-2019-13391 [bsc#1140673], CVE-2019-13308 [bsc#1140534], CVE-2019-13302 [bsc#1140552] (core, gif.c)
  + ImageMagick-CVE-2019-13391,13308,13302.patch
  CVE-2019-13298 [bsc#1140667] (core)
  + ImageMagick-CVE-2019-13298.patch
  CVE-2019-13300 [bsc#1140669] (core)
  + ImageMagick-CVE-2019-13300.patch
  CVE-2019-13307 [bsc#1140538] (core)
  + ImageMagick-CVE-2019-13307.patch
  CVE-2019-12977 [bsc#1139884] (jp2.c)
  + ImageMagick-CVE-2019-12977.patch
  CVE-2019-12975 [bsc#1140106] (dpx.c)
  + ImageMagick-CVE-2019-12975.patch
  CVE-2019-13135 [bsc#1140103] (cut.c)
  + ImageMagick-CVE-2019-13135.patch
  CVE-2019-12978 [bsc#1139885] (pango.c)
  + ImageMagick-CVE-2019-12978.patch
  CVE-2019-12974 [bsc#1140111] (pango.c)
  + ImageMagick-CVE-2019-12974.patch
  CVE-2019-13304 [bsc#1140547], CVE-2019-13305 [bsc#1140545], CVE-2019-13306 [bsc#1140543] (pnm.c)
  + ImageMagick-CVE-2019-13304,13305,13306.patch
  CVE-2019-13133 [bsc#1140100], CVE-2019-13134 [bsc#1140102] (bmp.c,viff.c)
  + ImageMagick-CVE-2019-13133,13134.patch
  CVE-2019-13137 [bsc#1140105] (ps.c)
  + ImageMagick-CVE-2019-13137.patch
  CVE-2019-13136 [bsc#1140104] (tiff.c)
  + ImageMagick-CVE-2019-13136.patch
  CVE-2019-12976 [bsc#1140110] (pcl.c)
  + ImageMagick-CVE-2019-12976.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1567684800">- security update
- added patches
  CVE-2019-15139 [bsc#1146213]
  + ImageMagick-CVE-2019-15139.patch
  CVE-2019-15140 [bsc#1146212]
  + ImageMagick-CVE-2019-15140.patch
  CVE-2019-15141 [bsc#1146211]
  + ImageMagick-CVE-2019-15141.patch
  CVE-2019-14980 [bsc#1146068]
  + ImageMagick-CVE-2019-14980.patch
  CVE-2019-14981 [bsc#1146065]
  + ImageMagick-CVE-2019-14981.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1570536000">- security update
- added patches
  CVE-2019-16713 [bsc#1151786]
  + ImageMagick-CVE-2019-16713.patch
  CVE-2019-16711 [bsc#1151784]
  + ImageMagick-CVE-2019-16711.patch
  CVE-2019-16712 [bsc#1151785]
  + ImageMagick-CVE-2019-16712.patch
  CVE-2019-16710 [bsc#1151783]
  + ImageMagick-CVE-2019-16710.patch
  CVE-2019-16708 [bsc#1151781], CVE-2019-16709 [bsc#1151782]
  + ImageMagick-CVE-2019-16708,16709.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578052800">- security update
- added patches
  CVE-2019-19948 [bsc#1159861]
  + ImageMagick-CVE-2019-19948.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha() in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
</package>
<package pkgid="c11cbad0abb5b70501e745c9ccecefd4551b2d90278a6563333242f128d0f84f" name="libMagick++-7_Q16HDRI4" arch="aarch64">
  <version epoch="0" ver="7.0.7.34" rel="10.21.1"/>
  <changelog author="pgajdos@suse.com" date="1559217600">- security update
- added patches
  CVE-2019-11598 [bsc#1136732]
  + ImageMagick-CVE-2019-11598.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1560859200">- security update
- disable indirect reads [bsc#1138425]
  (https://imagemagick.org/script/security-policy.php)
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1560945600">- security update
- added patches
  CVE-2019-11597 [bsc#1138464]
  + ImageMagick-CVE-2019-11597.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1563883200">- security update
- added patches
  CVE-2019-13301 [bsc#1140554] (core)
  + ImageMagick-CVE-2019-13301.patch
  CVE-2019-13309 [bsc#1140520] (wand)
  + ImageMagick-CVE-2019-13309.patch
  CVE-2019-13310 [bsc#1140501] (wand)
  + ImageMagick-CVE-2019-13310.patch
  CVE-2019-13311 [bsc#1140513] (wand)
  + ImageMagick-CVE-2019-13311.patch
  CVE-2019-13303 [bsc#1140549] (core)
  + ImageMagick-CVE-2019-13303.patch
  CVE-2019-13296 [bsc#1140665] (wand)
  + ImageMagick-CVE-2019-13296.patch
  CVE-2019-13299 [bsc#1140668] (core)
  + ImageMagick-CVE-2019-13299.patch
  CVE-2019-13454 [bsc#1141171] (core)
  + ImageMagick-CVE-2019-13454.patch
  CVE-2019-13295 [bsc#1140664], CVE-2019-13297 [bsc#1140666] (core)
  + ImageMagick-CVE-2019-13295,13297.patch
  CVE-2019-12979 [bsc#1139886] (core)
  + ImageMagick-CVE-2019-12979.patch
  CVE-2019-13391 [bsc#1140673], CVE-2019-13308 [bsc#1140534], CVE-2019-13302 [bsc#1140552] (core, gif.c)
  + ImageMagick-CVE-2019-13391,13308,13302.patch
  CVE-2019-13298 [bsc#1140667] (core)
  + ImageMagick-CVE-2019-13298.patch
  CVE-2019-13300 [bsc#1140669] (core)
  + ImageMagick-CVE-2019-13300.patch
  CVE-2019-13307 [bsc#1140538] (core)
  + ImageMagick-CVE-2019-13307.patch
  CVE-2019-12977 [bsc#1139884] (jp2.c)
  + ImageMagick-CVE-2019-12977.patch
  CVE-2019-12975 [bsc#1140106] (dpx.c)
  + ImageMagick-CVE-2019-12975.patch
  CVE-2019-13135 [bsc#1140103] (cut.c)
  + ImageMagick-CVE-2019-13135.patch
  CVE-2019-12978 [bsc#1139885] (pango.c)
  + ImageMagick-CVE-2019-12978.patch
  CVE-2019-12974 [bsc#1140111] (pango.c)
  + ImageMagick-CVE-2019-12974.patch
  CVE-2019-13304 [bsc#1140547], CVE-2019-13305 [bsc#1140545], CVE-2019-13306 [bsc#1140543] (pnm.c)
  + ImageMagick-CVE-2019-13304,13305,13306.patch
  CVE-2019-13133 [bsc#1140100], CVE-2019-13134 [bsc#1140102] (bmp.c,viff.c)
  + ImageMagick-CVE-2019-13133,13134.patch
  CVE-2019-13137 [bsc#1140105] (ps.c)
  + ImageMagick-CVE-2019-13137.patch
  CVE-2019-13136 [bsc#1140104] (tiff.c)
  + ImageMagick-CVE-2019-13136.patch
  CVE-2019-12976 [bsc#1140110] (pcl.c)
  + ImageMagick-CVE-2019-12976.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1567684800">- security update
- added patches
  CVE-2019-15139 [bsc#1146213]
  + ImageMagick-CVE-2019-15139.patch
  CVE-2019-15140 [bsc#1146212]
  + ImageMagick-CVE-2019-15140.patch
  CVE-2019-15141 [bsc#1146211]
  + ImageMagick-CVE-2019-15141.patch
  CVE-2019-14980 [bsc#1146068]
  + ImageMagick-CVE-2019-14980.patch
  CVE-2019-14981 [bsc#1146065]
  + ImageMagick-CVE-2019-14981.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1570536000">- security update
- added patches
  CVE-2019-16713 [bsc#1151786]
  + ImageMagick-CVE-2019-16713.patch
  CVE-2019-16711 [bsc#1151784]
  + ImageMagick-CVE-2019-16711.patch
  CVE-2019-16712 [bsc#1151785]
  + ImageMagick-CVE-2019-16712.patch
  CVE-2019-16710 [bsc#1151783]
  + ImageMagick-CVE-2019-16710.patch
  CVE-2019-16708 [bsc#1151781], CVE-2019-16709 [bsc#1151782]
  + ImageMagick-CVE-2019-16708,16709.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578052800">- security update
- added patches
  CVE-2019-19948 [bsc#1159861]
  + ImageMagick-CVE-2019-19948.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha() in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
</package>
<package pkgid="4435ba136edb2e0a915a878558ad13042998a51adca55e3bb924058d3e18adb8" name="libMagick++-7_Q16HDRI4" arch="ppc64le">
  <version epoch="0" ver="7.0.7.34" rel="10.21.1"/>
  <changelog author="pgajdos@suse.com" date="1559217600">- security update
- added patches
  CVE-2019-11598 [bsc#1136732]
  + ImageMagick-CVE-2019-11598.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1560859200">- security update
- disable indirect reads [bsc#1138425]
  (https://imagemagick.org/script/security-policy.php)
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1560945600">- security update
- added patches
  CVE-2019-11597 [bsc#1138464]
  + ImageMagick-CVE-2019-11597.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1563883200">- security update
- added patches
  CVE-2019-13301 [bsc#1140554] (core)
  + ImageMagick-CVE-2019-13301.patch
  CVE-2019-13309 [bsc#1140520] (wand)
  + ImageMagick-CVE-2019-13309.patch
  CVE-2019-13310 [bsc#1140501] (wand)
  + ImageMagick-CVE-2019-13310.patch
  CVE-2019-13311 [bsc#1140513] (wand)
  + ImageMagick-CVE-2019-13311.patch
  CVE-2019-13303 [bsc#1140549] (core)
  + ImageMagick-CVE-2019-13303.patch
  CVE-2019-13296 [bsc#1140665] (wand)
  + ImageMagick-CVE-2019-13296.patch
  CVE-2019-13299 [bsc#1140668] (core)
  + ImageMagick-CVE-2019-13299.patch
  CVE-2019-13454 [bsc#1141171] (core)
  + ImageMagick-CVE-2019-13454.patch
  CVE-2019-13295 [bsc#1140664], CVE-2019-13297 [bsc#1140666] (core)
  + ImageMagick-CVE-2019-13295,13297.patch
  CVE-2019-12979 [bsc#1139886] (core)
  + ImageMagick-CVE-2019-12979.patch
  CVE-2019-13391 [bsc#1140673], CVE-2019-13308 [bsc#1140534], CVE-2019-13302 [bsc#1140552] (core, gif.c)
  + ImageMagick-CVE-2019-13391,13308,13302.patch
  CVE-2019-13298 [bsc#1140667] (core)
  + ImageMagick-CVE-2019-13298.patch
  CVE-2019-13300 [bsc#1140669] (core)
  + ImageMagick-CVE-2019-13300.patch
  CVE-2019-13307 [bsc#1140538] (core)
  + ImageMagick-CVE-2019-13307.patch
  CVE-2019-12977 [bsc#1139884] (jp2.c)
  + ImageMagick-CVE-2019-12977.patch
  CVE-2019-12975 [bsc#1140106] (dpx.c)
  + ImageMagick-CVE-2019-12975.patch
  CVE-2019-13135 [bsc#1140103] (cut.c)
  + ImageMagick-CVE-2019-13135.patch
  CVE-2019-12978 [bsc#1139885] (pango.c)
  + ImageMagick-CVE-2019-12978.patch
  CVE-2019-12974 [bsc#1140111] (pango.c)
  + ImageMagick-CVE-2019-12974.patch
  CVE-2019-13304 [bsc#1140547], CVE-2019-13305 [bsc#1140545], CVE-2019-13306 [bsc#1140543] (pnm.c)
  + ImageMagick-CVE-2019-13304,13305,13306.patch
  CVE-2019-13133 [bsc#1140100], CVE-2019-13134 [bsc#1140102] (bmp.c,viff.c)
  + ImageMagick-CVE-2019-13133,13134.patch
  CVE-2019-13137 [bsc#1140105] (ps.c)
  + ImageMagick-CVE-2019-13137.patch
  CVE-2019-13136 [bsc#1140104] (tiff.c)
  + ImageMagick-CVE-2019-13136.patch
  CVE-2019-12976 [bsc#1140110] (pcl.c)
  + ImageMagick-CVE-2019-12976.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1567684800">- security update
- added patches
  CVE-2019-15139 [bsc#1146213]
  + ImageMagick-CVE-2019-15139.patch
  CVE-2019-15140 [bsc#1146212]
  + ImageMagick-CVE-2019-15140.patch
  CVE-2019-15141 [bsc#1146211]
  + ImageMagick-CVE-2019-15141.patch
  CVE-2019-14980 [bsc#1146068]
  + ImageMagick-CVE-2019-14980.patch
  CVE-2019-14981 [bsc#1146065]
  + ImageMagick-CVE-2019-14981.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1570536000">- security update
- added patches
  CVE-2019-16713 [bsc#1151786]
  + ImageMagick-CVE-2019-16713.patch
  CVE-2019-16711 [bsc#1151784]
  + ImageMagick-CVE-2019-16711.patch
  CVE-2019-16712 [bsc#1151785]
  + ImageMagick-CVE-2019-16712.patch
  CVE-2019-16710 [bsc#1151783]
  + ImageMagick-CVE-2019-16710.patch
  CVE-2019-16708 [bsc#1151781], CVE-2019-16709 [bsc#1151782]
  + ImageMagick-CVE-2019-16708,16709.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578052800">- security update
- added patches
  CVE-2019-19948 [bsc#1159861]
  + ImageMagick-CVE-2019-19948.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha() in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
</package>
<package pkgid="8059b1dcc56a9d67fb2d2f88e58304ed1527a27f4cd3f111a79d950838e53418" name="libMagick++-7_Q16HDRI4" arch="s390x">
  <version epoch="0" ver="7.0.7.34" rel="10.21.1"/>
  <changelog author="pgajdos@suse.com" date="1559217600">- security update
- added patches
  CVE-2019-11598 [bsc#1136732]
  + ImageMagick-CVE-2019-11598.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1560859200">- security update
- disable indirect reads [bsc#1138425]
  (https://imagemagick.org/script/security-policy.php)
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1560945600">- security update
- added patches
  CVE-2019-11597 [bsc#1138464]
  + ImageMagick-CVE-2019-11597.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1563883200">- security update
- added patches
  CVE-2019-13301 [bsc#1140554] (core)
  + ImageMagick-CVE-2019-13301.patch
  CVE-2019-13309 [bsc#1140520] (wand)
  + ImageMagick-CVE-2019-13309.patch
  CVE-2019-13310 [bsc#1140501] (wand)
  + ImageMagick-CVE-2019-13310.patch
  CVE-2019-13311 [bsc#1140513] (wand)
  + ImageMagick-CVE-2019-13311.patch
  CVE-2019-13303 [bsc#1140549] (core)
  + ImageMagick-CVE-2019-13303.patch
  CVE-2019-13296 [bsc#1140665] (wand)
  + ImageMagick-CVE-2019-13296.patch
  CVE-2019-13299 [bsc#1140668] (core)
  + ImageMagick-CVE-2019-13299.patch
  CVE-2019-13454 [bsc#1141171] (core)
  + ImageMagick-CVE-2019-13454.patch
  CVE-2019-13295 [bsc#1140664], CVE-2019-13297 [bsc#1140666] (core)
  + ImageMagick-CVE-2019-13295,13297.patch
  CVE-2019-12979 [bsc#1139886] (core)
  + ImageMagick-CVE-2019-12979.patch
  CVE-2019-13391 [bsc#1140673], CVE-2019-13308 [bsc#1140534], CVE-2019-13302 [bsc#1140552] (core, gif.c)
  + ImageMagick-CVE-2019-13391,13308,13302.patch
  CVE-2019-13298 [bsc#1140667] (core)
  + ImageMagick-CVE-2019-13298.patch
  CVE-2019-13300 [bsc#1140669] (core)
  + ImageMagick-CVE-2019-13300.patch
  CVE-2019-13307 [bsc#1140538] (core)
  + ImageMagick-CVE-2019-13307.patch
  CVE-2019-12977 [bsc#1139884] (jp2.c)
  + ImageMagick-CVE-2019-12977.patch
  CVE-2019-12975 [bsc#1140106] (dpx.c)
  + ImageMagick-CVE-2019-12975.patch
  CVE-2019-13135 [bsc#1140103] (cut.c)
  + ImageMagick-CVE-2019-13135.patch
  CVE-2019-12978 [bsc#1139885] (pango.c)
  + ImageMagick-CVE-2019-12978.patch
  CVE-2019-12974 [bsc#1140111] (pango.c)
  + ImageMagick-CVE-2019-12974.patch
  CVE-2019-13304 [bsc#1140547], CVE-2019-13305 [bsc#1140545], CVE-2019-13306 [bsc#1140543] (pnm.c)
  + ImageMagick-CVE-2019-13304,13305,13306.patch
  CVE-2019-13133 [bsc#1140100], CVE-2019-13134 [bsc#1140102] (bmp.c,viff.c)
  + ImageMagick-CVE-2019-13133,13134.patch
  CVE-2019-13137 [bsc#1140105] (ps.c)
  + ImageMagick-CVE-2019-13137.patch
  CVE-2019-13136 [bsc#1140104] (tiff.c)
  + ImageMagick-CVE-2019-13136.patch
  CVE-2019-12976 [bsc#1140110] (pcl.c)
  + ImageMagick-CVE-2019-12976.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1567684800">- security update
- added patches
  CVE-2019-15139 [bsc#1146213]
  + ImageMagick-CVE-2019-15139.patch
  CVE-2019-15140 [bsc#1146212]
  + ImageMagick-CVE-2019-15140.patch
  CVE-2019-15141 [bsc#1146211]
  + ImageMagick-CVE-2019-15141.patch
  CVE-2019-14980 [bsc#1146068]
  + ImageMagick-CVE-2019-14980.patch
  CVE-2019-14981 [bsc#1146065]
  + ImageMagick-CVE-2019-14981.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1570536000">- security update
- added patches
  CVE-2019-16713 [bsc#1151786]
  + ImageMagick-CVE-2019-16713.patch
  CVE-2019-16711 [bsc#1151784]
  + ImageMagick-CVE-2019-16711.patch
  CVE-2019-16712 [bsc#1151785]
  + ImageMagick-CVE-2019-16712.patch
  CVE-2019-16710 [bsc#1151783]
  + ImageMagick-CVE-2019-16710.patch
  CVE-2019-16708 [bsc#1151781], CVE-2019-16709 [bsc#1151782]
  + ImageMagick-CVE-2019-16708,16709.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578052800">- security update
- added patches
  CVE-2019-19948 [bsc#1159861]
  + ImageMagick-CVE-2019-19948.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha() in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
</package>
<package pkgid="a53cbba3b178bc72fe61c384dfbb5fb372fdfff98f4d03027c028d35c7220e70" name="libMagick++-7_Q16HDRI4" arch="x86_64">
  <version epoch="0" ver="7.0.7.34" rel="10.21.1"/>
  <changelog author="pgajdos@suse.com" date="1559217600">- security update
- added patches
  CVE-2019-11598 [bsc#1136732]
  + ImageMagick-CVE-2019-11598.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1560859200">- security update
- disable indirect reads [bsc#1138425]
  (https://imagemagick.org/script/security-policy.php)
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1560945600">- security update
- added patches
  CVE-2019-11597 [bsc#1138464]
  + ImageMagick-CVE-2019-11597.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1563883200">- security update
- added patches
  CVE-2019-13301 [bsc#1140554] (core)
  + ImageMagick-CVE-2019-13301.patch
  CVE-2019-13309 [bsc#1140520] (wand)
  + ImageMagick-CVE-2019-13309.patch
  CVE-2019-13310 [bsc#1140501] (wand)
  + ImageMagick-CVE-2019-13310.patch
  CVE-2019-13311 [bsc#1140513] (wand)
  + ImageMagick-CVE-2019-13311.patch
  CVE-2019-13303 [bsc#1140549] (core)
  + ImageMagick-CVE-2019-13303.patch
  CVE-2019-13296 [bsc#1140665] (wand)
  + ImageMagick-CVE-2019-13296.patch
  CVE-2019-13299 [bsc#1140668] (core)
  + ImageMagick-CVE-2019-13299.patch
  CVE-2019-13454 [bsc#1141171] (core)
  + ImageMagick-CVE-2019-13454.patch
  CVE-2019-13295 [bsc#1140664], CVE-2019-13297 [bsc#1140666] (core)
  + ImageMagick-CVE-2019-13295,13297.patch
  CVE-2019-12979 [bsc#1139886] (core)
  + ImageMagick-CVE-2019-12979.patch
  CVE-2019-13391 [bsc#1140673], CVE-2019-13308 [bsc#1140534], CVE-2019-13302 [bsc#1140552] (core, gif.c)
  + ImageMagick-CVE-2019-13391,13308,13302.patch
  CVE-2019-13298 [bsc#1140667] (core)
  + ImageMagick-CVE-2019-13298.patch
  CVE-2019-13300 [bsc#1140669] (core)
  + ImageMagick-CVE-2019-13300.patch
  CVE-2019-13307 [bsc#1140538] (core)
  + ImageMagick-CVE-2019-13307.patch
  CVE-2019-12977 [bsc#1139884] (jp2.c)
  + ImageMagick-CVE-2019-12977.patch
  CVE-2019-12975 [bsc#1140106] (dpx.c)
  + ImageMagick-CVE-2019-12975.patch
  CVE-2019-13135 [bsc#1140103] (cut.c)
  + ImageMagick-CVE-2019-13135.patch
  CVE-2019-12978 [bsc#1139885] (pango.c)
  + ImageMagick-CVE-2019-12978.patch
  CVE-2019-12974 [bsc#1140111] (pango.c)
  + ImageMagick-CVE-2019-12974.patch
  CVE-2019-13304 [bsc#1140547], CVE-2019-13305 [bsc#1140545], CVE-2019-13306 [bsc#1140543] (pnm.c)
  + ImageMagick-CVE-2019-13304,13305,13306.patch
  CVE-2019-13133 [bsc#1140100], CVE-2019-13134 [bsc#1140102] (bmp.c,viff.c)
  + ImageMagick-CVE-2019-13133,13134.patch
  CVE-2019-13137 [bsc#1140105] (ps.c)
  + ImageMagick-CVE-2019-13137.patch
  CVE-2019-13136 [bsc#1140104] (tiff.c)
  + ImageMagick-CVE-2019-13136.patch
  CVE-2019-12976 [bsc#1140110] (pcl.c)
  + ImageMagick-CVE-2019-12976.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1567684800">- security update
- added patches
  CVE-2019-15139 [bsc#1146213]
  + ImageMagick-CVE-2019-15139.patch
  CVE-2019-15140 [bsc#1146212]
  + ImageMagick-CVE-2019-15140.patch
  CVE-2019-15141 [bsc#1146211]
  + ImageMagick-CVE-2019-15141.patch
  CVE-2019-14980 [bsc#1146068]
  + ImageMagick-CVE-2019-14980.patch
  CVE-2019-14981 [bsc#1146065]
  + ImageMagick-CVE-2019-14981.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1570536000">- security update
- added patches
  CVE-2019-16713 [bsc#1151786]
  + ImageMagick-CVE-2019-16713.patch
  CVE-2019-16711 [bsc#1151784]
  + ImageMagick-CVE-2019-16711.patch
  CVE-2019-16712 [bsc#1151785]
  + ImageMagick-CVE-2019-16712.patch
  CVE-2019-16710 [bsc#1151783]
  + ImageMagick-CVE-2019-16710.patch
  CVE-2019-16708 [bsc#1151781], CVE-2019-16709 [bsc#1151782]
  + ImageMagick-CVE-2019-16708,16709.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578052800">- security update
- added patches
  CVE-2019-19948 [bsc#1159861]
  + ImageMagick-CVE-2019-19948.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha() in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
</package>
<package pkgid="277d4106b2fa4407a58ec6db29622b4e8e6450eba0887ebe351c85e3ff1cc77f" name="libMagickCore-7_Q16HDRI6-32bit" arch="x86_64">
  <version epoch="0" ver="7.0.7.34" rel="10.21.1"/>
  <changelog author="pgajdos@suse.com" date="1559217600">- security update
- added patches
  CVE-2019-11598 [bsc#1136732]
  + ImageMagick-CVE-2019-11598.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1560859200">- security update
- disable indirect reads [bsc#1138425]
  (https://imagemagick.org/script/security-policy.php)
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1560945600">- security update
- added patches
  CVE-2019-11597 [bsc#1138464]
  + ImageMagick-CVE-2019-11597.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1563883200">- security update
- added patches
  CVE-2019-13301 [bsc#1140554] (core)
  + ImageMagick-CVE-2019-13301.patch
  CVE-2019-13309 [bsc#1140520] (wand)
  + ImageMagick-CVE-2019-13309.patch
  CVE-2019-13310 [bsc#1140501] (wand)
  + ImageMagick-CVE-2019-13310.patch
  CVE-2019-13311 [bsc#1140513] (wand)
  + ImageMagick-CVE-2019-13311.patch
  CVE-2019-13303 [bsc#1140549] (core)
  + ImageMagick-CVE-2019-13303.patch
  CVE-2019-13296 [bsc#1140665] (wand)
  + ImageMagick-CVE-2019-13296.patch
  CVE-2019-13299 [bsc#1140668] (core)
  + ImageMagick-CVE-2019-13299.patch
  CVE-2019-13454 [bsc#1141171] (core)
  + ImageMagick-CVE-2019-13454.patch
  CVE-2019-13295 [bsc#1140664], CVE-2019-13297 [bsc#1140666] (core)
  + ImageMagick-CVE-2019-13295,13297.patch
  CVE-2019-12979 [bsc#1139886] (core)
  + ImageMagick-CVE-2019-12979.patch
  CVE-2019-13391 [bsc#1140673], CVE-2019-13308 [bsc#1140534], CVE-2019-13302 [bsc#1140552] (core, gif.c)
  + ImageMagick-CVE-2019-13391,13308,13302.patch
  CVE-2019-13298 [bsc#1140667] (core)
  + ImageMagick-CVE-2019-13298.patch
  CVE-2019-13300 [bsc#1140669] (core)
  + ImageMagick-CVE-2019-13300.patch
  CVE-2019-13307 [bsc#1140538] (core)
  + ImageMagick-CVE-2019-13307.patch
  CVE-2019-12977 [bsc#1139884] (jp2.c)
  + ImageMagick-CVE-2019-12977.patch
  CVE-2019-12975 [bsc#1140106] (dpx.c)
  + ImageMagick-CVE-2019-12975.patch
  CVE-2019-13135 [bsc#1140103] (cut.c)
  + ImageMagick-CVE-2019-13135.patch
  CVE-2019-12978 [bsc#1139885] (pango.c)
  + ImageMagick-CVE-2019-12978.patch
  CVE-2019-12974 [bsc#1140111] (pango.c)
  + ImageMagick-CVE-2019-12974.patch
  CVE-2019-13304 [bsc#1140547], CVE-2019-13305 [bsc#1140545], CVE-2019-13306 [bsc#1140543] (pnm.c)
  + ImageMagick-CVE-2019-13304,13305,13306.patch
  CVE-2019-13133 [bsc#1140100], CVE-2019-13134 [bsc#1140102] (bmp.c,viff.c)
  + ImageMagick-CVE-2019-13133,13134.patch
  CVE-2019-13137 [bsc#1140105] (ps.c)
  + ImageMagick-CVE-2019-13137.patch
  CVE-2019-13136 [bsc#1140104] (tiff.c)
  + ImageMagick-CVE-2019-13136.patch
  CVE-2019-12976 [bsc#1140110] (pcl.c)
  + ImageMagick-CVE-2019-12976.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1567684800">- security update
- added patches
  CVE-2019-15139 [bsc#1146213]
  + ImageMagick-CVE-2019-15139.patch
  CVE-2019-15140 [bsc#1146212]
  + ImageMagick-CVE-2019-15140.patch
  CVE-2019-15141 [bsc#1146211]
  + ImageMagick-CVE-2019-15141.patch
  CVE-2019-14980 [bsc#1146068]
  + ImageMagick-CVE-2019-14980.patch
  CVE-2019-14981 [bsc#1146065]
  + ImageMagick-CVE-2019-14981.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1570536000">- security update
- added patches
  CVE-2019-16713 [bsc#1151786]
  + ImageMagick-CVE-2019-16713.patch
  CVE-2019-16711 [bsc#1151784]
  + ImageMagick-CVE-2019-16711.patch
  CVE-2019-16712 [bsc#1151785]
  + ImageMagick-CVE-2019-16712.patch
  CVE-2019-16710 [bsc#1151783]
  + ImageMagick-CVE-2019-16710.patch
  CVE-2019-16708 [bsc#1151781], CVE-2019-16709 [bsc#1151782]
  + ImageMagick-CVE-2019-16708,16709.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578052800">- security update
- added patches
  CVE-2019-19948 [bsc#1159861]
  + ImageMagick-CVE-2019-19948.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha() in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
</package>
<package pkgid="76ae667226f13aa943efa42b13b78efa1b4b4b3a8449b0a83b1743fb1c0e7bdc" name="libMagickCore-7_Q16HDRI6" arch="aarch64">
  <version epoch="0" ver="7.0.7.34" rel="10.21.1"/>
  <changelog author="pgajdos@suse.com" date="1559217600">- security update
- added patches
  CVE-2019-11598 [bsc#1136732]
  + ImageMagick-CVE-2019-11598.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1560859200">- security update
- disable indirect reads [bsc#1138425]
  (https://imagemagick.org/script/security-policy.php)
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1560945600">- security update
- added patches
  CVE-2019-11597 [bsc#1138464]
  + ImageMagick-CVE-2019-11597.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1563883200">- security update
- added patches
  CVE-2019-13301 [bsc#1140554] (core)
  + ImageMagick-CVE-2019-13301.patch
  CVE-2019-13309 [bsc#1140520] (wand)
  + ImageMagick-CVE-2019-13309.patch
  CVE-2019-13310 [bsc#1140501] (wand)
  + ImageMagick-CVE-2019-13310.patch
  CVE-2019-13311 [bsc#1140513] (wand)
  + ImageMagick-CVE-2019-13311.patch
  CVE-2019-13303 [bsc#1140549] (core)
  + ImageMagick-CVE-2019-13303.patch
  CVE-2019-13296 [bsc#1140665] (wand)
  + ImageMagick-CVE-2019-13296.patch
  CVE-2019-13299 [bsc#1140668] (core)
  + ImageMagick-CVE-2019-13299.patch
  CVE-2019-13454 [bsc#1141171] (core)
  + ImageMagick-CVE-2019-13454.patch
  CVE-2019-13295 [bsc#1140664], CVE-2019-13297 [bsc#1140666] (core)
  + ImageMagick-CVE-2019-13295,13297.patch
  CVE-2019-12979 [bsc#1139886] (core)
  + ImageMagick-CVE-2019-12979.patch
  CVE-2019-13391 [bsc#1140673], CVE-2019-13308 [bsc#1140534], CVE-2019-13302 [bsc#1140552] (core, gif.c)
  + ImageMagick-CVE-2019-13391,13308,13302.patch
  CVE-2019-13298 [bsc#1140667] (core)
  + ImageMagick-CVE-2019-13298.patch
  CVE-2019-13300 [bsc#1140669] (core)
  + ImageMagick-CVE-2019-13300.patch
  CVE-2019-13307 [bsc#1140538] (core)
  + ImageMagick-CVE-2019-13307.patch
  CVE-2019-12977 [bsc#1139884] (jp2.c)
  + ImageMagick-CVE-2019-12977.patch
  CVE-2019-12975 [bsc#1140106] (dpx.c)
  + ImageMagick-CVE-2019-12975.patch
  CVE-2019-13135 [bsc#1140103] (cut.c)
  + ImageMagick-CVE-2019-13135.patch
  CVE-2019-12978 [bsc#1139885] (pango.c)
  + ImageMagick-CVE-2019-12978.patch
  CVE-2019-12974 [bsc#1140111] (pango.c)
  + ImageMagick-CVE-2019-12974.patch
  CVE-2019-13304 [bsc#1140547], CVE-2019-13305 [bsc#1140545], CVE-2019-13306 [bsc#1140543] (pnm.c)
  + ImageMagick-CVE-2019-13304,13305,13306.patch
  CVE-2019-13133 [bsc#1140100], CVE-2019-13134 [bsc#1140102] (bmp.c,viff.c)
  + ImageMagick-CVE-2019-13133,13134.patch
  CVE-2019-13137 [bsc#1140105] (ps.c)
  + ImageMagick-CVE-2019-13137.patch
  CVE-2019-13136 [bsc#1140104] (tiff.c)
  + ImageMagick-CVE-2019-13136.patch
  CVE-2019-12976 [bsc#1140110] (pcl.c)
  + ImageMagick-CVE-2019-12976.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1567684800">- security update
- added patches
  CVE-2019-15139 [bsc#1146213]
  + ImageMagick-CVE-2019-15139.patch
  CVE-2019-15140 [bsc#1146212]
  + ImageMagick-CVE-2019-15140.patch
  CVE-2019-15141 [bsc#1146211]
  + ImageMagick-CVE-2019-15141.patch
  CVE-2019-14980 [bsc#1146068]
  + ImageMagick-CVE-2019-14980.patch
  CVE-2019-14981 [bsc#1146065]
  + ImageMagick-CVE-2019-14981.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1570536000">- security update
- added patches
  CVE-2019-16713 [bsc#1151786]
  + ImageMagick-CVE-2019-16713.patch
  CVE-2019-16711 [bsc#1151784]
  + ImageMagick-CVE-2019-16711.patch
  CVE-2019-16712 [bsc#1151785]
  + ImageMagick-CVE-2019-16712.patch
  CVE-2019-16710 [bsc#1151783]
  + ImageMagick-CVE-2019-16710.patch
  CVE-2019-16708 [bsc#1151781], CVE-2019-16709 [bsc#1151782]
  + ImageMagick-CVE-2019-16708,16709.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578052800">- security update
- added patches
  CVE-2019-19948 [bsc#1159861]
  + ImageMagick-CVE-2019-19948.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha() in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
</package>
<package pkgid="9387a4fcac756cb601878e6f834a6589126fcb221c91d2ad0c09e111a1a68c6f" name="libMagickCore-7_Q16HDRI6" arch="ppc64le">
  <version epoch="0" ver="7.0.7.34" rel="10.21.1"/>
  <changelog author="pgajdos@suse.com" date="1559217600">- security update
- added patches
  CVE-2019-11598 [bsc#1136732]
  + ImageMagick-CVE-2019-11598.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1560859200">- security update
- disable indirect reads [bsc#1138425]
  (https://imagemagick.org/script/security-policy.php)
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1560945600">- security update
- added patches
  CVE-2019-11597 [bsc#1138464]
  + ImageMagick-CVE-2019-11597.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1563883200">- security update
- added patches
  CVE-2019-13301 [bsc#1140554] (core)
  + ImageMagick-CVE-2019-13301.patch
  CVE-2019-13309 [bsc#1140520] (wand)
  + ImageMagick-CVE-2019-13309.patch
  CVE-2019-13310 [bsc#1140501] (wand)
  + ImageMagick-CVE-2019-13310.patch
  CVE-2019-13311 [bsc#1140513] (wand)
  + ImageMagick-CVE-2019-13311.patch
  CVE-2019-13303 [bsc#1140549] (core)
  + ImageMagick-CVE-2019-13303.patch
  CVE-2019-13296 [bsc#1140665] (wand)
  + ImageMagick-CVE-2019-13296.patch
  CVE-2019-13299 [bsc#1140668] (core)
  + ImageMagick-CVE-2019-13299.patch
  CVE-2019-13454 [bsc#1141171] (core)
  + ImageMagick-CVE-2019-13454.patch
  CVE-2019-13295 [bsc#1140664], CVE-2019-13297 [bsc#1140666] (core)
  + ImageMagick-CVE-2019-13295,13297.patch
  CVE-2019-12979 [bsc#1139886] (core)
  + ImageMagick-CVE-2019-12979.patch
  CVE-2019-13391 [bsc#1140673], CVE-2019-13308 [bsc#1140534], CVE-2019-13302 [bsc#1140552] (core, gif.c)
  + ImageMagick-CVE-2019-13391,13308,13302.patch
  CVE-2019-13298 [bsc#1140667] (core)
  + ImageMagick-CVE-2019-13298.patch
  CVE-2019-13300 [bsc#1140669] (core)
  + ImageMagick-CVE-2019-13300.patch
  CVE-2019-13307 [bsc#1140538] (core)
  + ImageMagick-CVE-2019-13307.patch
  CVE-2019-12977 [bsc#1139884] (jp2.c)
  + ImageMagick-CVE-2019-12977.patch
  CVE-2019-12975 [bsc#1140106] (dpx.c)
  + ImageMagick-CVE-2019-12975.patch
  CVE-2019-13135 [bsc#1140103] (cut.c)
  + ImageMagick-CVE-2019-13135.patch
  CVE-2019-12978 [bsc#1139885] (pango.c)
  + ImageMagick-CVE-2019-12978.patch
  CVE-2019-12974 [bsc#1140111] (pango.c)
  + ImageMagick-CVE-2019-12974.patch
  CVE-2019-13304 [bsc#1140547], CVE-2019-13305 [bsc#1140545], CVE-2019-13306 [bsc#1140543] (pnm.c)
  + ImageMagick-CVE-2019-13304,13305,13306.patch
  CVE-2019-13133 [bsc#1140100], CVE-2019-13134 [bsc#1140102] (bmp.c,viff.c)
  + ImageMagick-CVE-2019-13133,13134.patch
  CVE-2019-13137 [bsc#1140105] (ps.c)
  + ImageMagick-CVE-2019-13137.patch
  CVE-2019-13136 [bsc#1140104] (tiff.c)
  + ImageMagick-CVE-2019-13136.patch
  CVE-2019-12976 [bsc#1140110] (pcl.c)
  + ImageMagick-CVE-2019-12976.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1567684800">- security update
- added patches
  CVE-2019-15139 [bsc#1146213]
  + ImageMagick-CVE-2019-15139.patch
  CVE-2019-15140 [bsc#1146212]
  + ImageMagick-CVE-2019-15140.patch
  CVE-2019-15141 [bsc#1146211]
  + ImageMagick-CVE-2019-15141.patch
  CVE-2019-14980 [bsc#1146068]
  + ImageMagick-CVE-2019-14980.patch
  CVE-2019-14981 [bsc#1146065]
  + ImageMagick-CVE-2019-14981.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1570536000">- security update
- added patches
  CVE-2019-16713 [bsc#1151786]
  + ImageMagick-CVE-2019-16713.patch
  CVE-2019-16711 [bsc#1151784]
  + ImageMagick-CVE-2019-16711.patch
  CVE-2019-16712 [bsc#1151785]
  + ImageMagick-CVE-2019-16712.patch
  CVE-2019-16710 [bsc#1151783]
  + ImageMagick-CVE-2019-16710.patch
  CVE-2019-16708 [bsc#1151781], CVE-2019-16709 [bsc#1151782]
  + ImageMagick-CVE-2019-16708,16709.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578052800">- security update
- added patches
  CVE-2019-19948 [bsc#1159861]
  + ImageMagick-CVE-2019-19948.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha() in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
</package>
<package pkgid="430620b57801ca1e294fbe496c1a35439547d3377f02ae2368cfadbf7fc1ee50" name="libMagickCore-7_Q16HDRI6" arch="s390x">
  <version epoch="0" ver="7.0.7.34" rel="10.21.1"/>
  <changelog author="pgajdos@suse.com" date="1559217600">- security update
- added patches
  CVE-2019-11598 [bsc#1136732]
  + ImageMagick-CVE-2019-11598.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1560859200">- security update
- disable indirect reads [bsc#1138425]
  (https://imagemagick.org/script/security-policy.php)
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1560945600">- security update
- added patches
  CVE-2019-11597 [bsc#1138464]
  + ImageMagick-CVE-2019-11597.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1563883200">- security update
- added patches
  CVE-2019-13301 [bsc#1140554] (core)
  + ImageMagick-CVE-2019-13301.patch
  CVE-2019-13309 [bsc#1140520] (wand)
  + ImageMagick-CVE-2019-13309.patch
  CVE-2019-13310 [bsc#1140501] (wand)
  + ImageMagick-CVE-2019-13310.patch
  CVE-2019-13311 [bsc#1140513] (wand)
  + ImageMagick-CVE-2019-13311.patch
  CVE-2019-13303 [bsc#1140549] (core)
  + ImageMagick-CVE-2019-13303.patch
  CVE-2019-13296 [bsc#1140665] (wand)
  + ImageMagick-CVE-2019-13296.patch
  CVE-2019-13299 [bsc#1140668] (core)
  + ImageMagick-CVE-2019-13299.patch
  CVE-2019-13454 [bsc#1141171] (core)
  + ImageMagick-CVE-2019-13454.patch
  CVE-2019-13295 [bsc#1140664], CVE-2019-13297 [bsc#1140666] (core)
  + ImageMagick-CVE-2019-13295,13297.patch
  CVE-2019-12979 [bsc#1139886] (core)
  + ImageMagick-CVE-2019-12979.patch
  CVE-2019-13391 [bsc#1140673], CVE-2019-13308 [bsc#1140534], CVE-2019-13302 [bsc#1140552] (core, gif.c)
  + ImageMagick-CVE-2019-13391,13308,13302.patch
  CVE-2019-13298 [bsc#1140667] (core)
  + ImageMagick-CVE-2019-13298.patch
  CVE-2019-13300 [bsc#1140669] (core)
  + ImageMagick-CVE-2019-13300.patch
  CVE-2019-13307 [bsc#1140538] (core)
  + ImageMagick-CVE-2019-13307.patch
  CVE-2019-12977 [bsc#1139884] (jp2.c)
  + ImageMagick-CVE-2019-12977.patch
  CVE-2019-12975 [bsc#1140106] (dpx.c)
  + ImageMagick-CVE-2019-12975.patch
  CVE-2019-13135 [bsc#1140103] (cut.c)
  + ImageMagick-CVE-2019-13135.patch
  CVE-2019-12978 [bsc#1139885] (pango.c)
  + ImageMagick-CVE-2019-12978.patch
  CVE-2019-12974 [bsc#1140111] (pango.c)
  + ImageMagick-CVE-2019-12974.patch
  CVE-2019-13304 [bsc#1140547], CVE-2019-13305 [bsc#1140545], CVE-2019-13306 [bsc#1140543] (pnm.c)
  + ImageMagick-CVE-2019-13304,13305,13306.patch
  CVE-2019-13133 [bsc#1140100], CVE-2019-13134 [bsc#1140102] (bmp.c,viff.c)
  + ImageMagick-CVE-2019-13133,13134.patch
  CVE-2019-13137 [bsc#1140105] (ps.c)
  + ImageMagick-CVE-2019-13137.patch
  CVE-2019-13136 [bsc#1140104] (tiff.c)
  + ImageMagick-CVE-2019-13136.patch
  CVE-2019-12976 [bsc#1140110] (pcl.c)
  + ImageMagick-CVE-2019-12976.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1567684800">- security update
- added patches
  CVE-2019-15139 [bsc#1146213]
  + ImageMagick-CVE-2019-15139.patch
  CVE-2019-15140 [bsc#1146212]
  + ImageMagick-CVE-2019-15140.patch
  CVE-2019-15141 [bsc#1146211]
  + ImageMagick-CVE-2019-15141.patch
  CVE-2019-14980 [bsc#1146068]
  + ImageMagick-CVE-2019-14980.patch
  CVE-2019-14981 [bsc#1146065]
  + ImageMagick-CVE-2019-14981.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1570536000">- security update
- added patches
  CVE-2019-16713 [bsc#1151786]
  + ImageMagick-CVE-2019-16713.patch
  CVE-2019-16711 [bsc#1151784]
  + ImageMagick-CVE-2019-16711.patch
  CVE-2019-16712 [bsc#1151785]
  + ImageMagick-CVE-2019-16712.patch
  CVE-2019-16710 [bsc#1151783]
  + ImageMagick-CVE-2019-16710.patch
  CVE-2019-16708 [bsc#1151781], CVE-2019-16709 [bsc#1151782]
  + ImageMagick-CVE-2019-16708,16709.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578052800">- security update
- added patches
  CVE-2019-19948 [bsc#1159861]
  + ImageMagick-CVE-2019-19948.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha() in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
</package>
<package pkgid="ba2b2026c4a5087aecafbbfdb88801c44755db5ee85bb77f14d45eee742962d2" name="libMagickCore-7_Q16HDRI6" arch="x86_64">
  <version epoch="0" ver="7.0.7.34" rel="10.21.1"/>
  <changelog author="pgajdos@suse.com" date="1559217600">- security update
- added patches
  CVE-2019-11598 [bsc#1136732]
  + ImageMagick-CVE-2019-11598.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1560859200">- security update
- disable indirect reads [bsc#1138425]
  (https://imagemagick.org/script/security-policy.php)
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1560945600">- security update
- added patches
  CVE-2019-11597 [bsc#1138464]
  + ImageMagick-CVE-2019-11597.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1563883200">- security update
- added patches
  CVE-2019-13301 [bsc#1140554] (core)
  + ImageMagick-CVE-2019-13301.patch
  CVE-2019-13309 [bsc#1140520] (wand)
  + ImageMagick-CVE-2019-13309.patch
  CVE-2019-13310 [bsc#1140501] (wand)
  + ImageMagick-CVE-2019-13310.patch
  CVE-2019-13311 [bsc#1140513] (wand)
  + ImageMagick-CVE-2019-13311.patch
  CVE-2019-13303 [bsc#1140549] (core)
  + ImageMagick-CVE-2019-13303.patch
  CVE-2019-13296 [bsc#1140665] (wand)
  + ImageMagick-CVE-2019-13296.patch
  CVE-2019-13299 [bsc#1140668] (core)
  + ImageMagick-CVE-2019-13299.patch
  CVE-2019-13454 [bsc#1141171] (core)
  + ImageMagick-CVE-2019-13454.patch
  CVE-2019-13295 [bsc#1140664], CVE-2019-13297 [bsc#1140666] (core)
  + ImageMagick-CVE-2019-13295,13297.patch
  CVE-2019-12979 [bsc#1139886] (core)
  + ImageMagick-CVE-2019-12979.patch
  CVE-2019-13391 [bsc#1140673], CVE-2019-13308 [bsc#1140534], CVE-2019-13302 [bsc#1140552] (core, gif.c)
  + ImageMagick-CVE-2019-13391,13308,13302.patch
  CVE-2019-13298 [bsc#1140667] (core)
  + ImageMagick-CVE-2019-13298.patch
  CVE-2019-13300 [bsc#1140669] (core)
  + ImageMagick-CVE-2019-13300.patch
  CVE-2019-13307 [bsc#1140538] (core)
  + ImageMagick-CVE-2019-13307.patch
  CVE-2019-12977 [bsc#1139884] (jp2.c)
  + ImageMagick-CVE-2019-12977.patch
  CVE-2019-12975 [bsc#1140106] (dpx.c)
  + ImageMagick-CVE-2019-12975.patch
  CVE-2019-13135 [bsc#1140103] (cut.c)
  + ImageMagick-CVE-2019-13135.patch
  CVE-2019-12978 [bsc#1139885] (pango.c)
  + ImageMagick-CVE-2019-12978.patch
  CVE-2019-12974 [bsc#1140111] (pango.c)
  + ImageMagick-CVE-2019-12974.patch
  CVE-2019-13304 [bsc#1140547], CVE-2019-13305 [bsc#1140545], CVE-2019-13306 [bsc#1140543] (pnm.c)
  + ImageMagick-CVE-2019-13304,13305,13306.patch
  CVE-2019-13133 [bsc#1140100], CVE-2019-13134 [bsc#1140102] (bmp.c,viff.c)
  + ImageMagick-CVE-2019-13133,13134.patch
  CVE-2019-13137 [bsc#1140105] (ps.c)
  + ImageMagick-CVE-2019-13137.patch
  CVE-2019-13136 [bsc#1140104] (tiff.c)
  + ImageMagick-CVE-2019-13136.patch
  CVE-2019-12976 [bsc#1140110] (pcl.c)
  + ImageMagick-CVE-2019-12976.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1567684800">- security update
- added patches
  CVE-2019-15139 [bsc#1146213]
  + ImageMagick-CVE-2019-15139.patch
  CVE-2019-15140 [bsc#1146212]
  + ImageMagick-CVE-2019-15140.patch
  CVE-2019-15141 [bsc#1146211]
  + ImageMagick-CVE-2019-15141.patch
  CVE-2019-14980 [bsc#1146068]
  + ImageMagick-CVE-2019-14980.patch
  CVE-2019-14981 [bsc#1146065]
  + ImageMagick-CVE-2019-14981.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1570536000">- security update
- added patches
  CVE-2019-16713 [bsc#1151786]
  + ImageMagick-CVE-2019-16713.patch
  CVE-2019-16711 [bsc#1151784]
  + ImageMagick-CVE-2019-16711.patch
  CVE-2019-16712 [bsc#1151785]
  + ImageMagick-CVE-2019-16712.patch
  CVE-2019-16710 [bsc#1151783]
  + ImageMagick-CVE-2019-16710.patch
  CVE-2019-16708 [bsc#1151781], CVE-2019-16709 [bsc#1151782]
  + ImageMagick-CVE-2019-16708,16709.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578052800">- security update
- added patches
  CVE-2019-19948 [bsc#1159861]
  + ImageMagick-CVE-2019-19948.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha() in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
</package>
<package pkgid="bcfa07332b0f57225fa2d13fb4566dc80abebbd412c6d67ec10521ac26de9f17" name="libMagickWand-7_Q16HDRI6-32bit" arch="x86_64">
  <version epoch="0" ver="7.0.7.34" rel="10.21.1"/>
  <changelog author="pgajdos@suse.com" date="1559217600">- security update
- added patches
  CVE-2019-11598 [bsc#1136732]
  + ImageMagick-CVE-2019-11598.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1560859200">- security update
- disable indirect reads [bsc#1138425]
  (https://imagemagick.org/script/security-policy.php)
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1560945600">- security update
- added patches
  CVE-2019-11597 [bsc#1138464]
  + ImageMagick-CVE-2019-11597.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1563883200">- security update
- added patches
  CVE-2019-13301 [bsc#1140554] (core)
  + ImageMagick-CVE-2019-13301.patch
  CVE-2019-13309 [bsc#1140520] (wand)
  + ImageMagick-CVE-2019-13309.patch
  CVE-2019-13310 [bsc#1140501] (wand)
  + ImageMagick-CVE-2019-13310.patch
  CVE-2019-13311 [bsc#1140513] (wand)
  + ImageMagick-CVE-2019-13311.patch
  CVE-2019-13303 [bsc#1140549] (core)
  + ImageMagick-CVE-2019-13303.patch
  CVE-2019-13296 [bsc#1140665] (wand)
  + ImageMagick-CVE-2019-13296.patch
  CVE-2019-13299 [bsc#1140668] (core)
  + ImageMagick-CVE-2019-13299.patch
  CVE-2019-13454 [bsc#1141171] (core)
  + ImageMagick-CVE-2019-13454.patch
  CVE-2019-13295 [bsc#1140664], CVE-2019-13297 [bsc#1140666] (core)
  + ImageMagick-CVE-2019-13295,13297.patch
  CVE-2019-12979 [bsc#1139886] (core)
  + ImageMagick-CVE-2019-12979.patch
  CVE-2019-13391 [bsc#1140673], CVE-2019-13308 [bsc#1140534], CVE-2019-13302 [bsc#1140552] (core, gif.c)
  + ImageMagick-CVE-2019-13391,13308,13302.patch
  CVE-2019-13298 [bsc#1140667] (core)
  + ImageMagick-CVE-2019-13298.patch
  CVE-2019-13300 [bsc#1140669] (core)
  + ImageMagick-CVE-2019-13300.patch
  CVE-2019-13307 [bsc#1140538] (core)
  + ImageMagick-CVE-2019-13307.patch
  CVE-2019-12977 [bsc#1139884] (jp2.c)
  + ImageMagick-CVE-2019-12977.patch
  CVE-2019-12975 [bsc#1140106] (dpx.c)
  + ImageMagick-CVE-2019-12975.patch
  CVE-2019-13135 [bsc#1140103] (cut.c)
  + ImageMagick-CVE-2019-13135.patch
  CVE-2019-12978 [bsc#1139885] (pango.c)
  + ImageMagick-CVE-2019-12978.patch
  CVE-2019-12974 [bsc#1140111] (pango.c)
  + ImageMagick-CVE-2019-12974.patch
  CVE-2019-13304 [bsc#1140547], CVE-2019-13305 [bsc#1140545], CVE-2019-13306 [bsc#1140543] (pnm.c)
  + ImageMagick-CVE-2019-13304,13305,13306.patch
  CVE-2019-13133 [bsc#1140100], CVE-2019-13134 [bsc#1140102] (bmp.c,viff.c)
  + ImageMagick-CVE-2019-13133,13134.patch
  CVE-2019-13137 [bsc#1140105] (ps.c)
  + ImageMagick-CVE-2019-13137.patch
  CVE-2019-13136 [bsc#1140104] (tiff.c)
  + ImageMagick-CVE-2019-13136.patch
  CVE-2019-12976 [bsc#1140110] (pcl.c)
  + ImageMagick-CVE-2019-12976.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1567684800">- security update
- added patches
  CVE-2019-15139 [bsc#1146213]
  + ImageMagick-CVE-2019-15139.patch
  CVE-2019-15140 [bsc#1146212]
  + ImageMagick-CVE-2019-15140.patch
  CVE-2019-15141 [bsc#1146211]
  + ImageMagick-CVE-2019-15141.patch
  CVE-2019-14980 [bsc#1146068]
  + ImageMagick-CVE-2019-14980.patch
  CVE-2019-14981 [bsc#1146065]
  + ImageMagick-CVE-2019-14981.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1570536000">- security update
- added patches
  CVE-2019-16713 [bsc#1151786]
  + ImageMagick-CVE-2019-16713.patch
  CVE-2019-16711 [bsc#1151784]
  + ImageMagick-CVE-2019-16711.patch
  CVE-2019-16712 [bsc#1151785]
  + ImageMagick-CVE-2019-16712.patch
  CVE-2019-16710 [bsc#1151783]
  + ImageMagick-CVE-2019-16710.patch
  CVE-2019-16708 [bsc#1151781], CVE-2019-16709 [bsc#1151782]
  + ImageMagick-CVE-2019-16708,16709.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578052800">- security update
- added patches
  CVE-2019-19948 [bsc#1159861]
  + ImageMagick-CVE-2019-19948.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha() in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
</package>
<package pkgid="e22f4244148c964ec01044825e6ffbcd19a69cc9d3ceea13c967a9cb5e1918a8" name="libMagickWand-7_Q16HDRI6" arch="aarch64">
  <version epoch="0" ver="7.0.7.34" rel="10.21.1"/>
  <changelog author="pgajdos@suse.com" date="1559217600">- security update
- added patches
  CVE-2019-11598 [bsc#1136732]
  + ImageMagick-CVE-2019-11598.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1560859200">- security update
- disable indirect reads [bsc#1138425]
  (https://imagemagick.org/script/security-policy.php)
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1560945600">- security update
- added patches
  CVE-2019-11597 [bsc#1138464]
  + ImageMagick-CVE-2019-11597.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1563883200">- security update
- added patches
  CVE-2019-13301 [bsc#1140554] (core)
  + ImageMagick-CVE-2019-13301.patch
  CVE-2019-13309 [bsc#1140520] (wand)
  + ImageMagick-CVE-2019-13309.patch
  CVE-2019-13310 [bsc#1140501] (wand)
  + ImageMagick-CVE-2019-13310.patch
  CVE-2019-13311 [bsc#1140513] (wand)
  + ImageMagick-CVE-2019-13311.patch
  CVE-2019-13303 [bsc#1140549] (core)
  + ImageMagick-CVE-2019-13303.patch
  CVE-2019-13296 [bsc#1140665] (wand)
  + ImageMagick-CVE-2019-13296.patch
  CVE-2019-13299 [bsc#1140668] (core)
  + ImageMagick-CVE-2019-13299.patch
  CVE-2019-13454 [bsc#1141171] (core)
  + ImageMagick-CVE-2019-13454.patch
  CVE-2019-13295 [bsc#1140664], CVE-2019-13297 [bsc#1140666] (core)
  + ImageMagick-CVE-2019-13295,13297.patch
  CVE-2019-12979 [bsc#1139886] (core)
  + ImageMagick-CVE-2019-12979.patch
  CVE-2019-13391 [bsc#1140673], CVE-2019-13308 [bsc#1140534], CVE-2019-13302 [bsc#1140552] (core, gif.c)
  + ImageMagick-CVE-2019-13391,13308,13302.patch
  CVE-2019-13298 [bsc#1140667] (core)
  + ImageMagick-CVE-2019-13298.patch
  CVE-2019-13300 [bsc#1140669] (core)
  + ImageMagick-CVE-2019-13300.patch
  CVE-2019-13307 [bsc#1140538] (core)
  + ImageMagick-CVE-2019-13307.patch
  CVE-2019-12977 [bsc#1139884] (jp2.c)
  + ImageMagick-CVE-2019-12977.patch
  CVE-2019-12975 [bsc#1140106] (dpx.c)
  + ImageMagick-CVE-2019-12975.patch
  CVE-2019-13135 [bsc#1140103] (cut.c)
  + ImageMagick-CVE-2019-13135.patch
  CVE-2019-12978 [bsc#1139885] (pango.c)
  + ImageMagick-CVE-2019-12978.patch
  CVE-2019-12974 [bsc#1140111] (pango.c)
  + ImageMagick-CVE-2019-12974.patch
  CVE-2019-13304 [bsc#1140547], CVE-2019-13305 [bsc#1140545], CVE-2019-13306 [bsc#1140543] (pnm.c)
  + ImageMagick-CVE-2019-13304,13305,13306.patch
  CVE-2019-13133 [bsc#1140100], CVE-2019-13134 [bsc#1140102] (bmp.c,viff.c)
  + ImageMagick-CVE-2019-13133,13134.patch
  CVE-2019-13137 [bsc#1140105] (ps.c)
  + ImageMagick-CVE-2019-13137.patch
  CVE-2019-13136 [bsc#1140104] (tiff.c)
  + ImageMagick-CVE-2019-13136.patch
  CVE-2019-12976 [bsc#1140110] (pcl.c)
  + ImageMagick-CVE-2019-12976.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1567684800">- security update
- added patches
  CVE-2019-15139 [bsc#1146213]
  + ImageMagick-CVE-2019-15139.patch
  CVE-2019-15140 [bsc#1146212]
  + ImageMagick-CVE-2019-15140.patch
  CVE-2019-15141 [bsc#1146211]
  + ImageMagick-CVE-2019-15141.patch
  CVE-2019-14980 [bsc#1146068]
  + ImageMagick-CVE-2019-14980.patch
  CVE-2019-14981 [bsc#1146065]
  + ImageMagick-CVE-2019-14981.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1570536000">- security update
- added patches
  CVE-2019-16713 [bsc#1151786]
  + ImageMagick-CVE-2019-16713.patch
  CVE-2019-16711 [bsc#1151784]
  + ImageMagick-CVE-2019-16711.patch
  CVE-2019-16712 [bsc#1151785]
  + ImageMagick-CVE-2019-16712.patch
  CVE-2019-16710 [bsc#1151783]
  + ImageMagick-CVE-2019-16710.patch
  CVE-2019-16708 [bsc#1151781], CVE-2019-16709 [bsc#1151782]
  + ImageMagick-CVE-2019-16708,16709.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578052800">- security update
- added patches
  CVE-2019-19948 [bsc#1159861]
  + ImageMagick-CVE-2019-19948.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha() in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
</package>
<package pkgid="92c064b86292cda1bc562c31bd3fdff1be601b92b87dea1a27e03f25f1775708" name="libMagickWand-7_Q16HDRI6" arch="ppc64le">
  <version epoch="0" ver="7.0.7.34" rel="10.21.1"/>
  <changelog author="pgajdos@suse.com" date="1559217600">- security update
- added patches
  CVE-2019-11598 [bsc#1136732]
  + ImageMagick-CVE-2019-11598.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1560859200">- security update
- disable indirect reads [bsc#1138425]
  (https://imagemagick.org/script/security-policy.php)
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1560945600">- security update
- added patches
  CVE-2019-11597 [bsc#1138464]
  + ImageMagick-CVE-2019-11597.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1563883200">- security update
- added patches
  CVE-2019-13301 [bsc#1140554] (core)
  + ImageMagick-CVE-2019-13301.patch
  CVE-2019-13309 [bsc#1140520] (wand)
  + ImageMagick-CVE-2019-13309.patch
  CVE-2019-13310 [bsc#1140501] (wand)
  + ImageMagick-CVE-2019-13310.patch
  CVE-2019-13311 [bsc#1140513] (wand)
  + ImageMagick-CVE-2019-13311.patch
  CVE-2019-13303 [bsc#1140549] (core)
  + ImageMagick-CVE-2019-13303.patch
  CVE-2019-13296 [bsc#1140665] (wand)
  + ImageMagick-CVE-2019-13296.patch
  CVE-2019-13299 [bsc#1140668] (core)
  + ImageMagick-CVE-2019-13299.patch
  CVE-2019-13454 [bsc#1141171] (core)
  + ImageMagick-CVE-2019-13454.patch
  CVE-2019-13295 [bsc#1140664], CVE-2019-13297 [bsc#1140666] (core)
  + ImageMagick-CVE-2019-13295,13297.patch
  CVE-2019-12979 [bsc#1139886] (core)
  + ImageMagick-CVE-2019-12979.patch
  CVE-2019-13391 [bsc#1140673], CVE-2019-13308 [bsc#1140534], CVE-2019-13302 [bsc#1140552] (core, gif.c)
  + ImageMagick-CVE-2019-13391,13308,13302.patch
  CVE-2019-13298 [bsc#1140667] (core)
  + ImageMagick-CVE-2019-13298.patch
  CVE-2019-13300 [bsc#1140669] (core)
  + ImageMagick-CVE-2019-13300.patch
  CVE-2019-13307 [bsc#1140538] (core)
  + ImageMagick-CVE-2019-13307.patch
  CVE-2019-12977 [bsc#1139884] (jp2.c)
  + ImageMagick-CVE-2019-12977.patch
  CVE-2019-12975 [bsc#1140106] (dpx.c)
  + ImageMagick-CVE-2019-12975.patch
  CVE-2019-13135 [bsc#1140103] (cut.c)
  + ImageMagick-CVE-2019-13135.patch
  CVE-2019-12978 [bsc#1139885] (pango.c)
  + ImageMagick-CVE-2019-12978.patch
  CVE-2019-12974 [bsc#1140111] (pango.c)
  + ImageMagick-CVE-2019-12974.patch
  CVE-2019-13304 [bsc#1140547], CVE-2019-13305 [bsc#1140545], CVE-2019-13306 [bsc#1140543] (pnm.c)
  + ImageMagick-CVE-2019-13304,13305,13306.patch
  CVE-2019-13133 [bsc#1140100], CVE-2019-13134 [bsc#1140102] (bmp.c,viff.c)
  + ImageMagick-CVE-2019-13133,13134.patch
  CVE-2019-13137 [bsc#1140105] (ps.c)
  + ImageMagick-CVE-2019-13137.patch
  CVE-2019-13136 [bsc#1140104] (tiff.c)
  + ImageMagick-CVE-2019-13136.patch
  CVE-2019-12976 [bsc#1140110] (pcl.c)
  + ImageMagick-CVE-2019-12976.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1567684800">- security update
- added patches
  CVE-2019-15139 [bsc#1146213]
  + ImageMagick-CVE-2019-15139.patch
  CVE-2019-15140 [bsc#1146212]
  + ImageMagick-CVE-2019-15140.patch
  CVE-2019-15141 [bsc#1146211]
  + ImageMagick-CVE-2019-15141.patch
  CVE-2019-14980 [bsc#1146068]
  + ImageMagick-CVE-2019-14980.patch
  CVE-2019-14981 [bsc#1146065]
  + ImageMagick-CVE-2019-14981.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1570536000">- security update
- added patches
  CVE-2019-16713 [bsc#1151786]
  + ImageMagick-CVE-2019-16713.patch
  CVE-2019-16711 [bsc#1151784]
  + ImageMagick-CVE-2019-16711.patch
  CVE-2019-16712 [bsc#1151785]
  + ImageMagick-CVE-2019-16712.patch
  CVE-2019-16710 [bsc#1151783]
  + ImageMagick-CVE-2019-16710.patch
  CVE-2019-16708 [bsc#1151781], CVE-2019-16709 [bsc#1151782]
  + ImageMagick-CVE-2019-16708,16709.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578052800">- security update
- added patches
  CVE-2019-19948 [bsc#1159861]
  + ImageMagick-CVE-2019-19948.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha() in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
</package>
<package pkgid="bb12dda5c29fbfc1b0a1fcd770ce8a998e7354c41da36db3b65f7c9843cc830a" name="libMagickWand-7_Q16HDRI6" arch="s390x">
  <version epoch="0" ver="7.0.7.34" rel="10.21.1"/>
  <changelog author="pgajdos@suse.com" date="1559217600">- security update
- added patches
  CVE-2019-11598 [bsc#1136732]
  + ImageMagick-CVE-2019-11598.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1560859200">- security update
- disable indirect reads [bsc#1138425]
  (https://imagemagick.org/script/security-policy.php)
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1560945600">- security update
- added patches
  CVE-2019-11597 [bsc#1138464]
  + ImageMagick-CVE-2019-11597.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1563883200">- security update
- added patches
  CVE-2019-13301 [bsc#1140554] (core)
  + ImageMagick-CVE-2019-13301.patch
  CVE-2019-13309 [bsc#1140520] (wand)
  + ImageMagick-CVE-2019-13309.patch
  CVE-2019-13310 [bsc#1140501] (wand)
  + ImageMagick-CVE-2019-13310.patch
  CVE-2019-13311 [bsc#1140513] (wand)
  + ImageMagick-CVE-2019-13311.patch
  CVE-2019-13303 [bsc#1140549] (core)
  + ImageMagick-CVE-2019-13303.patch
  CVE-2019-13296 [bsc#1140665] (wand)
  + ImageMagick-CVE-2019-13296.patch
  CVE-2019-13299 [bsc#1140668] (core)
  + ImageMagick-CVE-2019-13299.patch
  CVE-2019-13454 [bsc#1141171] (core)
  + ImageMagick-CVE-2019-13454.patch
  CVE-2019-13295 [bsc#1140664], CVE-2019-13297 [bsc#1140666] (core)
  + ImageMagick-CVE-2019-13295,13297.patch
  CVE-2019-12979 [bsc#1139886] (core)
  + ImageMagick-CVE-2019-12979.patch
  CVE-2019-13391 [bsc#1140673], CVE-2019-13308 [bsc#1140534], CVE-2019-13302 [bsc#1140552] (core, gif.c)
  + ImageMagick-CVE-2019-13391,13308,13302.patch
  CVE-2019-13298 [bsc#1140667] (core)
  + ImageMagick-CVE-2019-13298.patch
  CVE-2019-13300 [bsc#1140669] (core)
  + ImageMagick-CVE-2019-13300.patch
  CVE-2019-13307 [bsc#1140538] (core)
  + ImageMagick-CVE-2019-13307.patch
  CVE-2019-12977 [bsc#1139884] (jp2.c)
  + ImageMagick-CVE-2019-12977.patch
  CVE-2019-12975 [bsc#1140106] (dpx.c)
  + ImageMagick-CVE-2019-12975.patch
  CVE-2019-13135 [bsc#1140103] (cut.c)
  + ImageMagick-CVE-2019-13135.patch
  CVE-2019-12978 [bsc#1139885] (pango.c)
  + ImageMagick-CVE-2019-12978.patch
  CVE-2019-12974 [bsc#1140111] (pango.c)
  + ImageMagick-CVE-2019-12974.patch
  CVE-2019-13304 [bsc#1140547], CVE-2019-13305 [bsc#1140545], CVE-2019-13306 [bsc#1140543] (pnm.c)
  + ImageMagick-CVE-2019-13304,13305,13306.patch
  CVE-2019-13133 [bsc#1140100], CVE-2019-13134 [bsc#1140102] (bmp.c,viff.c)
  + ImageMagick-CVE-2019-13133,13134.patch
  CVE-2019-13137 [bsc#1140105] (ps.c)
  + ImageMagick-CVE-2019-13137.patch
  CVE-2019-13136 [bsc#1140104] (tiff.c)
  + ImageMagick-CVE-2019-13136.patch
  CVE-2019-12976 [bsc#1140110] (pcl.c)
  + ImageMagick-CVE-2019-12976.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1567684800">- security update
- added patches
  CVE-2019-15139 [bsc#1146213]
  + ImageMagick-CVE-2019-15139.patch
  CVE-2019-15140 [bsc#1146212]
  + ImageMagick-CVE-2019-15140.patch
  CVE-2019-15141 [bsc#1146211]
  + ImageMagick-CVE-2019-15141.patch
  CVE-2019-14980 [bsc#1146068]
  + ImageMagick-CVE-2019-14980.patch
  CVE-2019-14981 [bsc#1146065]
  + ImageMagick-CVE-2019-14981.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1570536000">- security update
- added patches
  CVE-2019-16713 [bsc#1151786]
  + ImageMagick-CVE-2019-16713.patch
  CVE-2019-16711 [bsc#1151784]
  + ImageMagick-CVE-2019-16711.patch
  CVE-2019-16712 [bsc#1151785]
  + ImageMagick-CVE-2019-16712.patch
  CVE-2019-16710 [bsc#1151783]
  + ImageMagick-CVE-2019-16710.patch
  CVE-2019-16708 [bsc#1151781], CVE-2019-16709 [bsc#1151782]
  + ImageMagick-CVE-2019-16708,16709.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578052800">- security update
- added patches
  CVE-2019-19948 [bsc#1159861]
  + ImageMagick-CVE-2019-19948.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha() in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
</package>
<package pkgid="372900fa12872b0194955af8b06d8b20aad7601f31f4a5eb209487bf37d58592" name="libMagickWand-7_Q16HDRI6" arch="x86_64">
  <version epoch="0" ver="7.0.7.34" rel="10.21.1"/>
  <changelog author="pgajdos@suse.com" date="1559217600">- security update
- added patches
  CVE-2019-11598 [bsc#1136732]
  + ImageMagick-CVE-2019-11598.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1560859200">- security update
- disable indirect reads [bsc#1138425]
  (https://imagemagick.org/script/security-policy.php)
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1560945600">- security update
- added patches
  CVE-2019-11597 [bsc#1138464]
  + ImageMagick-CVE-2019-11597.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1563883200">- security update
- added patches
  CVE-2019-13301 [bsc#1140554] (core)
  + ImageMagick-CVE-2019-13301.patch
  CVE-2019-13309 [bsc#1140520] (wand)
  + ImageMagick-CVE-2019-13309.patch
  CVE-2019-13310 [bsc#1140501] (wand)
  + ImageMagick-CVE-2019-13310.patch
  CVE-2019-13311 [bsc#1140513] (wand)
  + ImageMagick-CVE-2019-13311.patch
  CVE-2019-13303 [bsc#1140549] (core)
  + ImageMagick-CVE-2019-13303.patch
  CVE-2019-13296 [bsc#1140665] (wand)
  + ImageMagick-CVE-2019-13296.patch
  CVE-2019-13299 [bsc#1140668] (core)
  + ImageMagick-CVE-2019-13299.patch
  CVE-2019-13454 [bsc#1141171] (core)
  + ImageMagick-CVE-2019-13454.patch
  CVE-2019-13295 [bsc#1140664], CVE-2019-13297 [bsc#1140666] (core)
  + ImageMagick-CVE-2019-13295,13297.patch
  CVE-2019-12979 [bsc#1139886] (core)
  + ImageMagick-CVE-2019-12979.patch
  CVE-2019-13391 [bsc#1140673], CVE-2019-13308 [bsc#1140534], CVE-2019-13302 [bsc#1140552] (core, gif.c)
  + ImageMagick-CVE-2019-13391,13308,13302.patch
  CVE-2019-13298 [bsc#1140667] (core)
  + ImageMagick-CVE-2019-13298.patch
  CVE-2019-13300 [bsc#1140669] (core)
  + ImageMagick-CVE-2019-13300.patch
  CVE-2019-13307 [bsc#1140538] (core)
  + ImageMagick-CVE-2019-13307.patch
  CVE-2019-12977 [bsc#1139884] (jp2.c)
  + ImageMagick-CVE-2019-12977.patch
  CVE-2019-12975 [bsc#1140106] (dpx.c)
  + ImageMagick-CVE-2019-12975.patch
  CVE-2019-13135 [bsc#1140103] (cut.c)
  + ImageMagick-CVE-2019-13135.patch
  CVE-2019-12978 [bsc#1139885] (pango.c)
  + ImageMagick-CVE-2019-12978.patch
  CVE-2019-12974 [bsc#1140111] (pango.c)
  + ImageMagick-CVE-2019-12974.patch
  CVE-2019-13304 [bsc#1140547], CVE-2019-13305 [bsc#1140545], CVE-2019-13306 [bsc#1140543] (pnm.c)
  + ImageMagick-CVE-2019-13304,13305,13306.patch
  CVE-2019-13133 [bsc#1140100], CVE-2019-13134 [bsc#1140102] (bmp.c,viff.c)
  + ImageMagick-CVE-2019-13133,13134.patch
  CVE-2019-13137 [bsc#1140105] (ps.c)
  + ImageMagick-CVE-2019-13137.patch
  CVE-2019-13136 [bsc#1140104] (tiff.c)
  + ImageMagick-CVE-2019-13136.patch
  CVE-2019-12976 [bsc#1140110] (pcl.c)
  + ImageMagick-CVE-2019-12976.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1567684800">- security update
- added patches
  CVE-2019-15139 [bsc#1146213]
  + ImageMagick-CVE-2019-15139.patch
  CVE-2019-15140 [bsc#1146212]
  + ImageMagick-CVE-2019-15140.patch
  CVE-2019-15141 [bsc#1146211]
  + ImageMagick-CVE-2019-15141.patch
  CVE-2019-14980 [bsc#1146068]
  + ImageMagick-CVE-2019-14980.patch
  CVE-2019-14981 [bsc#1146065]
  + ImageMagick-CVE-2019-14981.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1570536000">- security update
- added patches
  CVE-2019-16713 [bsc#1151786]
  + ImageMagick-CVE-2019-16713.patch
  CVE-2019-16711 [bsc#1151784]
  + ImageMagick-CVE-2019-16711.patch
  CVE-2019-16712 [bsc#1151785]
  + ImageMagick-CVE-2019-16712.patch
  CVE-2019-16710 [bsc#1151783]
  + ImageMagick-CVE-2019-16710.patch
  CVE-2019-16708 [bsc#1151781], CVE-2019-16709 [bsc#1151782]
  + ImageMagick-CVE-2019-16708,16709.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578052800">- security update
- added patches
  CVE-2019-19948 [bsc#1159861]
  + ImageMagick-CVE-2019-19948.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1578484800">- security update
- added patches
  CVE-2019-19949 [bsc#1160369]
  + ImageMagick-CVE-2019-19949.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1580299200">- added patches
  bsc#1161194, https://github.com/ImageMagick/ImageMagick/issues/1428
  + ImageMagick-convert-tiff-resize-png.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1598875200">- fix bsc#1106272
- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603713600">- security update
- added patches
  fix CVE-2020-27560 [bsc#1178067], division by zero in OptimizeLayerFrames function in MagickCore/layer.c
  + ImageMagick-CVE-2020-27560.patch
  fix https://github.com/ImageMagick/ImageMagick/commit/029fb3425ecf82e8b30c060e38a135d1d3e76bb3
  + ImageMagick-set-correct-colorspace.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606219200">- security update
- added patches
  fix CVE-2020-19667 [bsc#1179103], Stack buffer overflow in XPM coder could result in a crash
  + ImageMagick-CVE-2020-19667.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607342400">- security update
- added patches
  fix CVE-2020-27772 [bsc#1179347], outside the range of representable values of type 'unsigned int' at coders/bmp.c
  + ImageMagick-CVE-2020-27772.patch
  fix CVE-2020-27763 [bsc#1179312], division by zero at MagickCore/resize.c
  + ImageMagick-CVE-2020-27763.patch
  fix CVE-2020-27759 [bsc#1179313], outside the range of representable values of type 'int' at MagickCore/quantize.c
  fix CVE-2020-27769 [bsc#1179321], outside the range of representable values of type 'float' at MagickCore/quantize.c
  fix CVE-2020-27754 [bsc#1179336], outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c
  + ImageMagick-CVE-2020-27759,27769,27754.patch
  fix CVE-2020-27771 [bsc#1179327], outside the range of representable values of type 'unsigned char' at coders/pdf.c
  + ImageMagick-CVE-2020-27771.patch
  fix CVE-2020-27764 [bsc#1179317], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27764.patch
  fix CVE-2020-27761 [bsc#1179315], outside the range of representable values of type 'unsigned long' at coders/palm.c
  + ImageMagick-CVE-2020-27761.patch
  fix CVE-2020-25676 [bsc#1179244], outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c
  + ImageMagick-CVE-2020-25676.patch
  fix CVE-2020-25665 [bsc#1179208], heap-based buffer overflow in WritePALMImage
  + ImageMagick-CVE-2020-25665.patch
  fix CVE-2020-27766 [bsc#1179361], outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27776 [bsc#1179362], ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
  fix CVE-2020-27774 [bsc#1179333], integer overflow at MagickCore/statistic.c
  + ImageMagick-CVE-2020-27774,27766,27776.patch
  fix CVE-2020-27750 [bsc#1179260], division by zero in MagickCore/colorspace-private.h
  + ImageMagick-CVE-2020-27750.patch
  fix CVE-2020-27760 [bsc#1179281], division by zero at MagickCore/enhance.c
  + ImageMagick-CVE-2020-27760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607515200">- security update
- added patches
  fix CVE-2020-27753 [bsc#1179397], memory leaks in AcquireMagickMemory function
  + ImageMagick-CVE-2020-27753.patch
  fix CVE-2020-27770 [bsc#1179343], unsigned offset overflowed at MagickCore/string.c
  + ImageMagick-CVE-2020-27770.patch
  fix CVE-2020-25675 [bsc#1179240], outside the range of representable values of type 'long' and integer overflow
  + ImageMagick-CVE-2020-25675.patch
  fix CVE-2020-27756 [bsc#1179221], division by zero at MagickCore/geometry.c
  + ImageMagick-CVE-2020-27756.patch
  fix CVE-2020-27773 [bsc#1179285], division by zero at MagickCore/gem-private.h
  + ImageMagick-CVE-2020-27773.patch
  fix CVE-2020-27762 [bsc#1179278], outside the range of representable values of type 'unsigned char'
  + ImageMagick-CVE-2020-27762.patch
  fix CVE-2020-27755 [bsc#1179345], memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c
  + ImageMagick-CVE-2020-27755.patch
  fix CVE-2020-27765 [bsc#1179311], division by zero at MagickCore/segment.c
  + ImageMagick-CVE-2020-27765.patch
  fix CVE-2020-27758 [bsc#1179276], outside the range of representable values of type 'unsigned long long'
  + ImageMagick-CVE-2020-27758.patch
  fix CVE-2020-27775 [bsc#1179338], outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h
  + ImageMagick-CVE-2020-27775.patch
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  + ImageMagick-CVE-2020-27752.patch
  fix CVE-2020-25664 [bsc#1179202], heap-based buffer overflow in PopShortPixel
  + ImageMagick-CVE-2020-25664.patch
  fix CVE-2020-25674 [bsc#1179223], heap-based buffer overflow in WriteOnePNGImage
  + ImageMagick-CVE-2020-25674.patch
  fix CVE-2020-25666 [bsc#1179212], outside the range of representable values of type 'int' and signed integer overflow
  + ImageMagick-CVE-2020-25666.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607688000">- security update
- added patches
  fix IM upstream issue #1184
  + ImageMagick-silent-disturbing-warnings.patch
  fix CVE-2020-27767 [bsc#1179322], outside the range of representable values of type 'float' at MagickCore/quantum.h
  fix CVE-2020-27768 [bsc#1179339], outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
  fix CVE-2020-27751 [bsc#1179269], integer overflow in MagickCore/quantum-export.c
  fix CVE-2020-27752 [bsc#1179346], heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h
  fix CVE-2020-27757 [bsc#1179268], outside the range of representable values of type 'unsigned long long' at
  + ImageMagick-CVE-2020-27767,27768,27751,27752,27757.patch
  fix CVE-2020-29599 [bsc#1179753], shell command injection in -authenticate
  + ImageMagick-CVE-2020-29599.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1607947200">- run perl tests verbosely</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- security update
- added patches
  fix CVE-2021-20241 [bsc#1182335], Division by zero in WriteJP2Image() in coders/jp2.c
  + ImageMagick-CVE-2021-20241.patch
  fix CVE-2021-20243 [bsc#1182336], Division by zero in GetResizeFilterWeight in MagickCore/resize.c
  + ImageMagick-CVE-2021-20243.patch
  fix CVE-2021-20244 [bsc#1182325], Division by zero in ImplodeImage in MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20244.patch
  fix CVE-2021-20246 [bsc#1182337], Division by zero in ScaleResampleFilter in MagickCore/resample.c
  + ImageMagick-CVE-2021-20246.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1618488000">- security update
- added patches
  fix CVE-2021-20309 [bsc#1184624], Division by zero in WaveImage() of MagickCore/visual-effects.c
  + ImageMagick-CVE-2021-20309.patch
  fix CVE-2021-20311 [bsc#1184626], Division by zero in sRGBTransformImage() in MagickCore/colorspace.c
  + ImageMagick-CVE-2021-20311.patch
  fix CVE-2021-20312 [bsc#1184627], Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c
  + ImageMagick-CVE-2021-20312.patch
  fix CVE-2021-20313 [bsc#1184628], Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c
  + ImageMagick-CVE-2021-20313.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- security update
- added patches
  fix CVE-2021-20176 [bsc#1181836], processing crafted file leads to division by zero
  + ImageMagick-CVE-2021-20176.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha() in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
</package>
<package pkgid="6c3dad499a2c92c99c2f5a2c575b3e528d0d8d89e05bbd54baecb8f7b1b9a65d" name="libSDL2-2_0-0" arch="aarch64">
  <version epoch="0" ver="2.0.8" rel="11.3.1"/>
  <changelog author="guillaume@opensuse.org" date="1506945600">- Enable KMS/DRM video driver</changelog>
  <changelog author="jengelh@inai.de" date="1506945601">- Add dbus.diff</changelog>
  <changelog author="wbauer@tmo.at" date="1508155200">- Disable SSE3 (and also SSE2 on ix86) to prevent crashes on older
  CPUs that don't support these instructions</changelog>
  <changelog author="sreeves@suse.com" date="1508414400">- Add SDL-bnc1062784-check-overflow-xcf-props.patch. CVE-2017-2888</changelog>
  <changelog author="adam@mizerski.pl" date="1509192000">- update to 2.0.7
  * Added audio stream conversion functions.
  * Added functions to query and set the SDL memory allocation
    functions.
  * Added locking functions for multi-threaded access to
    the joystick and game controller APIs.
  * Some functions are now thread-safe.
- removed patches, merged upstream
  * dbus.diff
  * SDL2-ppc64-declaration-after-statement.patch
  * SDL-bnc1062784-check-overflow-xcf-props.patch</changelog>
  <changelog author="jengelh@inai.de" date="1515585600">- Add sdl2-symvers.patch.</changelog>
  <changelog author="jengelh@inai.de" date="1520510400">- Update to new upstream release 2.0.8
  * Added SDL_fmod() and SDL_log10().
  * Each of the SDL math functions now has the corresponding
    float version.
  * Added SDL_SetYUVConversionMode() and
    SDL_GetYUVConversionMode() to control the formula used when
    converting to and from YUV colorspace. The options are JPEG,
    BT.601, and BT.709.
  * Added the hint SDL_HINT_VIDEO_X11_NET_WM_BYPASS_COMPOSITOR to
    control whether the X server should skip the compositor for
    the SDL application. This defaults to "1".
  * Added the hint SDL_HINT_VIDEO_DOUBLE_BUFFER to control
    whether the Raspberry Pi and KMSDRM video drivers should use
    double or triple buffering (the default).</changelog>
  <changelog author="ytz1995@hotmail.com" date="1521288000">- Build with Wayland support</changelog>
  <changelog author="qzheng@suse.com" date="1551268800">- Add CVE-2019-7577.patch to fix a buffer over-read issue
  (CVE-2019-7577, boo#1124800).</changelog>
  <changelog author="qzheng@suse.com" date="1551355200">- Add CVE-2019-7637.patch to fix a heap-base buffer overflow
  issue (CVE-2019-7637, boo#1124825).</changelog>
  <changelog author="qzheng@suse.com" date="1551355201">- Add CVE-2019-7575.patch to fix a heap-based buffer overflow
  issue (CVE-2019-7575, boo#1124802).</changelog>
  <changelog author="qzheng@suse.com" date="1553083200">- Add CVE-2019-7574.patch to fix a heap-based buffer over-read
  issue (CVE-2019-7574, boo#1124803).</changelog>
  <changelog author="qzheng@suse.com" date="1553083201">- Add CVE-2019-7572.patch to fix a buffer over-read issue
  (CVE-2019-7572, boo#1124806).</changelog>
  <changelog author="qzheng@suse.com" date="1553083202">- Add CVE-2019-7578.patch to fix a heap-based buffer over-read
  issue (CVE-2019-7578, boo#1125099, CVE-2019-7576, boo#1124799
  CVE-2019-7573, boo#1124805).</changelog>
  <changelog author="qzheng@suse.com" date="1553083203">- Add CVE-2019-7635.patch to fix a heap-based buffer over-read
  issue (CVE-2019-7635, boo#1124827).</changelog>
  <changelog author="qzheng@suse.com" date="1553083204">- Add CVE-2019-7636.patch to fix a heap-based buffer over-read
  issue (CVE-2019-7636, boo#1124826, CVE-2019-7638, boo#1124824).</changelog>
  <changelog author="qzheng@suse.com" date="1558612800">- Remove CVE-2019-7637.patch, the modification of function
  SDL_CalculatePitch is only suit for SDL not SDL2.</changelog>
  <changelog author="mgorse@suse.com" date="1566820800">- Add CVE-2019-13616.patch: fix heap buffer overflow when reading
  a crafted bmp file (boo#1141844 CVE-2019-13616).
- Add CVE-2019-13626.patch: add safeguards to the wav parser to
  prevent crashes (boo#1142031 CVE-2019-13626).
- Drop CVE-2019-7572.patch, CVE-2019-7574.patch,
  CVE-2019-7575.patch, CVE-2019-7577.patch, and
  CVE-2019-7578.patch: these are handled by the new code added in
  CVE-2019-13626.patch.</changelog>
  <changelog author="sndirsch@suse.com" date="1578225600">-  sdl2-khronos.patch
  * fixes build on i586 (boo#1158176)</changelog>
  <changelog author="mgorse@suse.com" date="1641902400">- Add sdl2-surface-pitch-overflow.patch: fix overflow in surface
  pitch calculation (boo#1181201 boo#1181202 CVE-2020-14410
  CVE-2020-14409).</changelog>
</package>
<package pkgid="7b78a22917809ddad8dfb238c39f1b663cb27c2533de6b3037f84d8405771cb7" name="libSDL2-2_0-0" arch="ppc64le">
  <version epoch="0" ver="2.0.8" rel="11.3.1"/>
  <changelog author="guillaume@opensuse.org" date="1506945600">- Enable KMS/DRM video driver</changelog>
  <changelog author="jengelh@inai.de" date="1506945601">- Add dbus.diff</changelog>
  <changelog author="wbauer@tmo.at" date="1508155200">- Disable SSE3 (and also SSE2 on ix86) to prevent crashes on older
  CPUs that don't support these instructions</changelog>
  <changelog author="sreeves@suse.com" date="1508414400">- Add SDL-bnc1062784-check-overflow-xcf-props.patch. CVE-2017-2888</changelog>
  <changelog author="adam@mizerski.pl" date="1509192000">- update to 2.0.7
  * Added audio stream conversion functions.
  * Added functions to query and set the SDL memory allocation
    functions.
  * Added locking functions for multi-threaded access to
    the joystick and game controller APIs.
  * Some functions are now thread-safe.
- removed patches, merged upstream
  * dbus.diff
  * SDL2-ppc64-declaration-after-statement.patch
  * SDL-bnc1062784-check-overflow-xcf-props.patch</changelog>
  <changelog author="jengelh@inai.de" date="1515585600">- Add sdl2-symvers.patch.</changelog>
  <changelog author="jengelh@inai.de" date="1520510400">- Update to new upstream release 2.0.8
  * Added SDL_fmod() and SDL_log10().
  * Each of the SDL math functions now has the corresponding
    float version.
  * Added SDL_SetYUVConversionMode() and
    SDL_GetYUVConversionMode() to control the formula used when
    converting to and from YUV colorspace. The options are JPEG,
    BT.601, and BT.709.
  * Added the hint SDL_HINT_VIDEO_X11_NET_WM_BYPASS_COMPOSITOR to
    control whether the X server should skip the compositor for
    the SDL application. This defaults to "1".
  * Added the hint SDL_HINT_VIDEO_DOUBLE_BUFFER to control
    whether the Raspberry Pi and KMSDRM video drivers should use
    double or triple buffering (the default).</changelog>
  <changelog author="ytz1995@hotmail.com" date="1521288000">- Build with Wayland support</changelog>
  <changelog author="qzheng@suse.com" date="1551268800">- Add CVE-2019-7577.patch to fix a buffer over-read issue
  (CVE-2019-7577, boo#1124800).</changelog>
  <changelog author="qzheng@suse.com" date="1551355200">- Add CVE-2019-7637.patch to fix a heap-base buffer overflow
  issue (CVE-2019-7637, boo#1124825).</changelog>
  <changelog author="qzheng@suse.com" date="1551355201">- Add CVE-2019-7575.patch to fix a heap-based buffer overflow
  issue (CVE-2019-7575, boo#1124802).</changelog>
  <changelog author="qzheng@suse.com" date="1553083200">- Add CVE-2019-7574.patch to fix a heap-based buffer over-read
  issue (CVE-2019-7574, boo#1124803).</changelog>
  <changelog author="qzheng@suse.com" date="1553083201">- Add CVE-2019-7572.patch to fix a buffer over-read issue
  (CVE-2019-7572, boo#1124806).</changelog>
  <changelog author="qzheng@suse.com" date="1553083202">- Add CVE-2019-7578.patch to fix a heap-based buffer over-read
  issue (CVE-2019-7578, boo#1125099, CVE-2019-7576, boo#1124799
  CVE-2019-7573, boo#1124805).</changelog>
  <changelog author="qzheng@suse.com" date="1553083203">- Add CVE-2019-7635.patch to fix a heap-based buffer over-read
  issue (CVE-2019-7635, boo#1124827).</changelog>
  <changelog author="qzheng@suse.com" date="1553083204">- Add CVE-2019-7636.patch to fix a heap-based buffer over-read
  issue (CVE-2019-7636, boo#1124826, CVE-2019-7638, boo#1124824).</changelog>
  <changelog author="qzheng@suse.com" date="1558612800">- Remove CVE-2019-7637.patch, the modification of function
  SDL_CalculatePitch is only suit for SDL not SDL2.</changelog>
  <changelog author="mgorse@suse.com" date="1566820800">- Add CVE-2019-13616.patch: fix heap buffer overflow when reading
  a crafted bmp file (boo#1141844 CVE-2019-13616).
- Add CVE-2019-13626.patch: add safeguards to the wav parser to
  prevent crashes (boo#1142031 CVE-2019-13626).
- Drop CVE-2019-7572.patch, CVE-2019-7574.patch,
  CVE-2019-7575.patch, CVE-2019-7577.patch, and
  CVE-2019-7578.patch: these are handled by the new code added in
  CVE-2019-13626.patch.</changelog>
  <changelog author="sndirsch@suse.com" date="1578225600">-  sdl2-khronos.patch
  * fixes build on i586 (boo#1158176)</changelog>
  <changelog author="mgorse@suse.com" date="1641902400">- Add sdl2-surface-pitch-overflow.patch: fix overflow in surface
  pitch calculation (boo#1181201 boo#1181202 CVE-2020-14410
  CVE-2020-14409).</changelog>
</package>
<package pkgid="84642edda9ec9ea224baeed52d7ee960c8bdba4f99c79e964c0402d8dd6b73f1" name="libSDL2-2_0-0" arch="s390x">
  <version epoch="0" ver="2.0.8" rel="11.3.1"/>
  <changelog author="guillaume@opensuse.org" date="1506945600">- Enable KMS/DRM video driver</changelog>
  <changelog author="jengelh@inai.de" date="1506945601">- Add dbus.diff</changelog>
  <changelog author="wbauer@tmo.at" date="1508155200">- Disable SSE3 (and also SSE2 on ix86) to prevent crashes on older
  CPUs that don't support these instructions</changelog>
  <changelog author="sreeves@suse.com" date="1508414400">- Add SDL-bnc1062784-check-overflow-xcf-props.patch. CVE-2017-2888</changelog>
  <changelog author="adam@mizerski.pl" date="1509192000">- update to 2.0.7
  * Added audio stream conversion functions.
  * Added functions to query and set the SDL memory allocation
    functions.
  * Added locking functions for multi-threaded access to
    the joystick and game controller APIs.
  * Some functions are now thread-safe.
- removed patches, merged upstream
  * dbus.diff
  * SDL2-ppc64-declaration-after-statement.patch
  * SDL-bnc1062784-check-overflow-xcf-props.patch</changelog>
  <changelog author="jengelh@inai.de" date="1515585600">- Add sdl2-symvers.patch.</changelog>
  <changelog author="jengelh@inai.de" date="1520510400">- Update to new upstream release 2.0.8
  * Added SDL_fmod() and SDL_log10().
  * Each of the SDL math functions now has the corresponding
    float version.
  * Added SDL_SetYUVConversionMode() and
    SDL_GetYUVConversionMode() to control the formula used when
    converting to and from YUV colorspace. The options are JPEG,
    BT.601, and BT.709.
  * Added the hint SDL_HINT_VIDEO_X11_NET_WM_BYPASS_COMPOSITOR to
    control whether the X server should skip the compositor for
    the SDL application. This defaults to "1".
  * Added the hint SDL_HINT_VIDEO_DOUBLE_BUFFER to control
    whether the Raspberry Pi and KMSDRM video drivers should use
    double or triple buffering (the default).</changelog>
  <changelog author="ytz1995@hotmail.com" date="1521288000">- Build with Wayland support</changelog>
  <changelog author="qzheng@suse.com" date="1551268800">- Add CVE-2019-7577.patch to fix a buffer over-read issue
  (CVE-2019-7577, boo#1124800).</changelog>
  <changelog author="qzheng@suse.com" date="1551355200">- Add CVE-2019-7637.patch to fix a heap-base buffer overflow
  issue (CVE-2019-7637, boo#1124825).</changelog>
  <changelog author="qzheng@suse.com" date="1551355201">- Add CVE-2019-7575.patch to fix a heap-based buffer overflow
  issue (CVE-2019-7575, boo#1124802).</changelog>
  <changelog author="qzheng@suse.com" date="1553083200">- Add CVE-2019-7574.patch to fix a heap-based buffer over-read
  issue (CVE-2019-7574, boo#1124803).</changelog>
  <changelog author="qzheng@suse.com" date="1553083201">- Add CVE-2019-7572.patch to fix a buffer over-read issue
  (CVE-2019-7572, boo#1124806).</changelog>
  <changelog author="qzheng@suse.com" date="1553083202">- Add CVE-2019-7578.patch to fix a heap-based buffer over-read
  issue (CVE-2019-7578, boo#1125099, CVE-2019-7576, boo#1124799
  CVE-2019-7573, boo#1124805).</changelog>
  <changelog author="qzheng@suse.com" date="1553083203">- Add CVE-2019-7635.patch to fix a heap-based buffer over-read
  issue (CVE-2019-7635, boo#1124827).</changelog>
  <changelog author="qzheng@suse.com" date="1553083204">- Add CVE-2019-7636.patch to fix a heap-based buffer over-read
  issue (CVE-2019-7636, boo#1124826, CVE-2019-7638, boo#1124824).</changelog>
  <changelog author="qzheng@suse.com" date="1558612800">- Remove CVE-2019-7637.patch, the modification of function
  SDL_CalculatePitch is only suit for SDL not SDL2.</changelog>
  <changelog author="mgorse@suse.com" date="1566820800">- Add CVE-2019-13616.patch: fix heap buffer overflow when reading
  a crafted bmp file (boo#1141844 CVE-2019-13616).
- Add CVE-2019-13626.patch: add safeguards to the wav parser to
  prevent crashes (boo#1142031 CVE-2019-13626).
- Drop CVE-2019-7572.patch, CVE-2019-7574.patch,
  CVE-2019-7575.patch, CVE-2019-7577.patch, and
  CVE-2019-7578.patch: these are handled by the new code added in
  CVE-2019-13626.patch.</changelog>
  <changelog author="sndirsch@suse.com" date="1578225600">-  sdl2-khronos.patch
  * fixes build on i586 (boo#1158176)</changelog>
  <changelog author="mgorse@suse.com" date="1641902400">- Add sdl2-surface-pitch-overflow.patch: fix overflow in surface
  pitch calculation (boo#1181201 boo#1181202 CVE-2020-14410
  CVE-2020-14409).</changelog>
</package>
<package pkgid="4834bcbae23839f1e47653858707c72c5c130b5cc7dbf9334c091796a468bc4d" name="libSDL2-2_0-0" arch="x86_64">
  <version epoch="0" ver="2.0.8" rel="11.3.1"/>
  <changelog author="guillaume@opensuse.org" date="1506945600">- Enable KMS/DRM video driver</changelog>
  <changelog author="jengelh@inai.de" date="1506945601">- Add dbus.diff</changelog>
  <changelog author="wbauer@tmo.at" date="1508155200">- Disable SSE3 (and also SSE2 on ix86) to prevent crashes on older
  CPUs that don't support these instructions</changelog>
  <changelog author="sreeves@suse.com" date="1508414400">- Add SDL-bnc1062784-check-overflow-xcf-props.patch. CVE-2017-2888</changelog>
  <changelog author="adam@mizerski.pl" date="1509192000">- update to 2.0.7
  * Added audio stream conversion functions.
  * Added functions to query and set the SDL memory allocation
    functions.
  * Added locking functions for multi-threaded access to
    the joystick and game controller APIs.
  * Some functions are now thread-safe.
- removed patches, merged upstream
  * dbus.diff
  * SDL2-ppc64-declaration-after-statement.patch
  * SDL-bnc1062784-check-overflow-xcf-props.patch</changelog>
  <changelog author="jengelh@inai.de" date="1515585600">- Add sdl2-symvers.patch.</changelog>
  <changelog author="jengelh@inai.de" date="1520510400">- Update to new upstream release 2.0.8
  * Added SDL_fmod() and SDL_log10().
  * Each of the SDL math functions now has the corresponding
    float version.
  * Added SDL_SetYUVConversionMode() and
    SDL_GetYUVConversionMode() to control the formula used when
    converting to and from YUV colorspace. The options are JPEG,
    BT.601, and BT.709.
  * Added the hint SDL_HINT_VIDEO_X11_NET_WM_BYPASS_COMPOSITOR to
    control whether the X server should skip the compositor for
    the SDL application. This defaults to "1".
  * Added the hint SDL_HINT_VIDEO_DOUBLE_BUFFER to control
    whether the Raspberry Pi and KMSDRM video drivers should use
    double or triple buffering (the default).</changelog>
  <changelog author="ytz1995@hotmail.com" date="1521288000">- Build with Wayland support</changelog>
  <changelog author="qzheng@suse.com" date="1551268800">- Add CVE-2019-7577.patch to fix a buffer over-read issue
  (CVE-2019-7577, boo#1124800).</changelog>
  <changelog author="qzheng@suse.com" date="1551355200">- Add CVE-2019-7637.patch to fix a heap-base buffer overflow
  issue (CVE-2019-7637, boo#1124825).</changelog>
  <changelog author="qzheng@suse.com" date="1551355201">- Add CVE-2019-7575.patch to fix a heap-based buffer overflow
  issue (CVE-2019-7575, boo#1124802).</changelog>
  <changelog author="qzheng@suse.com" date="1553083200">- Add CVE-2019-7574.patch to fix a heap-based buffer over-read
  issue (CVE-2019-7574, boo#1124803).</changelog>
  <changelog author="qzheng@suse.com" date="1553083201">- Add CVE-2019-7572.patch to fix a buffer over-read issue
  (CVE-2019-7572, boo#1124806).</changelog>
  <changelog author="qzheng@suse.com" date="1553083202">- Add CVE-2019-7578.patch to fix a heap-based buffer over-read
  issue (CVE-2019-7578, boo#1125099, CVE-2019-7576, boo#1124799
  CVE-2019-7573, boo#1124805).</changelog>
  <changelog author="qzheng@suse.com" date="1553083203">- Add CVE-2019-7635.patch to fix a heap-based buffer over-read
  issue (CVE-2019-7635, boo#1124827).</changelog>
  <changelog author="qzheng@suse.com" date="1553083204">- Add CVE-2019-7636.patch to fix a heap-based buffer over-read
  issue (CVE-2019-7636, boo#1124826, CVE-2019-7638, boo#1124824).</changelog>
  <changelog author="qzheng@suse.com" date="1558612800">- Remove CVE-2019-7637.patch, the modification of function
  SDL_CalculatePitch is only suit for SDL not SDL2.</changelog>
  <changelog author="mgorse@suse.com" date="1566820800">- Add CVE-2019-13616.patch: fix heap buffer overflow when reading
  a crafted bmp file (boo#1141844 CVE-2019-13616).
- Add CVE-2019-13626.patch: add safeguards to the wav parser to
  prevent crashes (boo#1142031 CVE-2019-13626).
- Drop CVE-2019-7572.patch, CVE-2019-7574.patch,
  CVE-2019-7575.patch, CVE-2019-7577.patch, and
  CVE-2019-7578.patch: these are handled by the new code added in
  CVE-2019-13626.patch.</changelog>
  <changelog author="sndirsch@suse.com" date="1578225600">-  sdl2-khronos.patch
  * fixes build on i586 (boo#1158176)</changelog>
  <changelog author="mgorse@suse.com" date="1641902400">- Add sdl2-surface-pitch-overflow.patch: fix overflow in surface
  pitch calculation (boo#1181201 boo#1181202 CVE-2020-14410
  CVE-2020-14409).</changelog>
</package>
<package pkgid="f5a93cfc96e96e63f8441276d84a76f307076e892e8d4d41d4a965d818cf1cec" name="libSDL2-2_0-0-32bit" arch="x86_64">
  <version epoch="0" ver="2.0.8" rel="11.3.1"/>
  <changelog author="guillaume@opensuse.org" date="1506945600">- Enable KMS/DRM video driver</changelog>
  <changelog author="jengelh@inai.de" date="1506945601">- Add dbus.diff</changelog>
  <changelog author="wbauer@tmo.at" date="1508155200">- Disable SSE3 (and also SSE2 on ix86) to prevent crashes on older
  CPUs that don't support these instructions</changelog>
  <changelog author="sreeves@suse.com" date="1508414400">- Add SDL-bnc1062784-check-overflow-xcf-props.patch. CVE-2017-2888</changelog>
  <changelog author="adam@mizerski.pl" date="1509192000">- update to 2.0.7
  * Added audio stream conversion functions.
  * Added functions to query and set the SDL memory allocation
    functions.
  * Added locking functions for multi-threaded access to
    the joystick and game controller APIs.
  * Some functions are now thread-safe.
- removed patches, merged upstream
  * dbus.diff
  * SDL2-ppc64-declaration-after-statement.patch
  * SDL-bnc1062784-check-overflow-xcf-props.patch</changelog>
  <changelog author="jengelh@inai.de" date="1515585600">- Add sdl2-symvers.patch.</changelog>
  <changelog author="jengelh@inai.de" date="1520510400">- Update to new upstream release 2.0.8
  * Added SDL_fmod() and SDL_log10().
  * Each of the SDL math functions now has the corresponding
    float version.
  * Added SDL_SetYUVConversionMode() and
    SDL_GetYUVConversionMode() to control the formula used when
    converting to and from YUV colorspace. The options are JPEG,
    BT.601, and BT.709.
  * Added the hint SDL_HINT_VIDEO_X11_NET_WM_BYPASS_COMPOSITOR to
    control whether the X server should skip the compositor for
    the SDL application. This defaults to "1".
  * Added the hint SDL_HINT_VIDEO_DOUBLE_BUFFER to control
    whether the Raspberry Pi and KMSDRM video drivers should use
    double or triple buffering (the default).</changelog>
  <changelog author="ytz1995@hotmail.com" date="1521288000">- Build with Wayland support</changelog>
  <changelog author="qzheng@suse.com" date="1551268800">- Add CVE-2019-7577.patch to fix a buffer over-read issue
  (CVE-2019-7577, boo#1124800).</changelog>
  <changelog author="qzheng@suse.com" date="1551355200">- Add CVE-2019-7637.patch to fix a heap-base buffer overflow
  issue (CVE-2019-7637, boo#1124825).</changelog>
  <changelog author="qzheng@suse.com" date="1551355201">- Add CVE-2019-7575.patch to fix a heap-based buffer overflow
  issue (CVE-2019-7575, boo#1124802).</changelog>
  <changelog author="qzheng@suse.com" date="1553083200">- Add CVE-2019-7574.patch to fix a heap-based buffer over-read
  issue (CVE-2019-7574, boo#1124803).</changelog>
  <changelog author="qzheng@suse.com" date="1553083201">- Add CVE-2019-7572.patch to fix a buffer over-read issue
  (CVE-2019-7572, boo#1124806).</changelog>
  <changelog author="qzheng@suse.com" date="1553083202">- Add CVE-2019-7578.patch to fix a heap-based buffer over-read
  issue (CVE-2019-7578, boo#1125099, CVE-2019-7576, boo#1124799
  CVE-2019-7573, boo#1124805).</changelog>
  <changelog author="qzheng@suse.com" date="1553083203">- Add CVE-2019-7635.patch to fix a heap-based buffer over-read
  issue (CVE-2019-7635, boo#1124827).</changelog>
  <changelog author="qzheng@suse.com" date="1553083204">- Add CVE-2019-7636.patch to fix a heap-based buffer over-read
  issue (CVE-2019-7636, boo#1124826, CVE-2019-7638, boo#1124824).</changelog>
  <changelog author="qzheng@suse.com" date="1558612800">- Remove CVE-2019-7637.patch, the modification of function
  SDL_CalculatePitch is only suit for SDL not SDL2.</changelog>
  <changelog author="mgorse@suse.com" date="1566820800">- Add CVE-2019-13616.patch: fix heap buffer overflow when reading
  a crafted bmp file (boo#1141844 CVE-2019-13616).
- Add CVE-2019-13626.patch: add safeguards to the wav parser to
  prevent crashes (boo#1142031 CVE-2019-13626).
- Drop CVE-2019-7572.patch, CVE-2019-7574.patch,
  CVE-2019-7575.patch, CVE-2019-7577.patch, and
  CVE-2019-7578.patch: these are handled by the new code added in
  CVE-2019-13626.patch.</changelog>
  <changelog author="sndirsch@suse.com" date="1578225600">-  sdl2-khronos.patch
  * fixes build on i586 (boo#1158176)</changelog>
  <changelog author="mgorse@suse.com" date="1641902400">- Add sdl2-surface-pitch-overflow.patch: fix overflow in surface
  pitch calculation (boo#1181201 boo#1181202 CVE-2020-14410
  CVE-2020-14409).</changelog>
</package>
<package pkgid="830112432bc333d08080ad8100b31032f6c76569cdb613a3438458a6021c3c48" name="libSDL2-devel" arch="aarch64">
  <version epoch="0" ver="2.0.8" rel="11.3.1"/>
  <changelog author="guillaume@opensuse.org" date="1506945600">- Enable KMS/DRM video driver</changelog>
  <changelog author="jengelh@inai.de" date="1506945601">- Add dbus.diff</changelog>
  <changelog author="wbauer@tmo.at" date="1508155200">- Disable SSE3 (and also SSE2 on ix86) to prevent crashes on older
  CPUs that don't support these instructions</changelog>
  <changelog author="sreeves@suse.com" date="1508414400">- Add SDL-bnc1062784-check-overflow-xcf-props.patch. CVE-2017-2888</changelog>
  <changelog author="adam@mizerski.pl" date="1509192000">- update to 2.0.7
  * Added audio stream conversion functions.
  * Added functions to query and set the SDL memory allocation
    functions.
  * Added locking functions for multi-threaded access to
    the joystick and game controller APIs.
  * Some functions are now thread-safe.
- removed patches, merged upstream
  * dbus.diff
  * SDL2-ppc64-declaration-after-statement.patch
  * SDL-bnc1062784-check-overflow-xcf-props.patch</changelog>
  <changelog author="jengelh@inai.de" date="1515585600">- Add sdl2-symvers.patch.</changelog>
  <changelog author="jengelh@inai.de" date="1520510400">- Update to new upstream release 2.0.8
  * Added SDL_fmod() and SDL_log10().
  * Each of the SDL math functions now has the corresponding
    float version.
  * Added SDL_SetYUVConversionMode() and
    SDL_GetYUVConversionMode() to control the formula used when
    converting to and from YUV colorspace. The options are JPEG,
    BT.601, and BT.709.
  * Added the hint SDL_HINT_VIDEO_X11_NET_WM_BYPASS_COMPOSITOR to
    control whether the X server should skip the compositor for
    the SDL application. This defaults to "1".
  * Added the hint SDL_HINT_VIDEO_DOUBLE_BUFFER to control
    whether the Raspberry Pi and KMSDRM video drivers should use
    double or triple buffering (the default).</changelog>
  <changelog author="ytz1995@hotmail.com" date="1521288000">- Build with Wayland support</changelog>
  <changelog author="qzheng@suse.com" date="1551268800">- Add CVE-2019-7577.patch to fix a buffer over-read issue
  (CVE-2019-7577, boo#1124800).</changelog>
  <changelog author="qzheng@suse.com" date="1551355200">- Add CVE-2019-7637.patch to fix a heap-base buffer overflow
  issue (CVE-2019-7637, boo#1124825).</changelog>
  <changelog author="qzheng@suse.com" date="1551355201">- Add CVE-2019-7575.patch to fix a heap-based buffer overflow
  issue (CVE-2019-7575, boo#1124802).</changelog>
  <changelog author="qzheng@suse.com" date="1553083200">- Add CVE-2019-7574.patch to fix a heap-based buffer over-read
  issue (CVE-2019-7574, boo#1124803).</changelog>
  <changelog author="qzheng@suse.com" date="1553083201">- Add CVE-2019-7572.patch to fix a buffer over-read issue
  (CVE-2019-7572, boo#1124806).</changelog>
  <changelog author="qzheng@suse.com" date="1553083202">- Add CVE-2019-7578.patch to fix a heap-based buffer over-read
  issue (CVE-2019-7578, boo#1125099, CVE-2019-7576, boo#1124799
  CVE-2019-7573, boo#1124805).</changelog>
  <changelog author="qzheng@suse.com" date="1553083203">- Add CVE-2019-7635.patch to fix a heap-based buffer over-read
  issue (CVE-2019-7635, boo#1124827).</changelog>
  <changelog author="qzheng@suse.com" date="1553083204">- Add CVE-2019-7636.patch to fix a heap-based buffer over-read
  issue (CVE-2019-7636, boo#1124826, CVE-2019-7638, boo#1124824).</changelog>
  <changelog author="qzheng@suse.com" date="1558612800">- Remove CVE-2019-7637.patch, the modification of function
  SDL_CalculatePitch is only suit for SDL not SDL2.</changelog>
  <changelog author="mgorse@suse.com" date="1566820800">- Add CVE-2019-13616.patch: fix heap buffer overflow when reading
  a crafted bmp file (boo#1141844 CVE-2019-13616).
- Add CVE-2019-13626.patch: add safeguards to the wav parser to
  prevent crashes (boo#1142031 CVE-2019-13626).
- Drop CVE-2019-7572.patch, CVE-2019-7574.patch,
  CVE-2019-7575.patch, CVE-2019-7577.patch, and
  CVE-2019-7578.patch: these are handled by the new code added in
  CVE-2019-13626.patch.</changelog>
  <changelog author="sndirsch@suse.com" date="1578225600">-  sdl2-khronos.patch
  * fixes build on i586 (boo#1158176)</changelog>
  <changelog author="mgorse@suse.com" date="1641902400">- Add sdl2-surface-pitch-overflow.patch: fix overflow in surface
  pitch calculation (boo#1181201 boo#1181202 CVE-2020-14410
  CVE-2020-14409).</changelog>
</package>
<package pkgid="0fb0953a7139a0dc090a818244d7d92a3fa68d380a18813b286f514b7ddc304f" name="libSDL2-devel" arch="ppc64le">
  <version epoch="0" ver="2.0.8" rel="11.3.1"/>
  <changelog author="guillaume@opensuse.org" date="1506945600">- Enable KMS/DRM video driver</changelog>
  <changelog author="jengelh@inai.de" date="1506945601">- Add dbus.diff</changelog>
  <changelog author="wbauer@tmo.at" date="1508155200">- Disable SSE3 (and also SSE2 on ix86) to prevent crashes on older
  CPUs that don't support these instructions</changelog>
  <changelog author="sreeves@suse.com" date="1508414400">- Add SDL-bnc1062784-check-overflow-xcf-props.patch. CVE-2017-2888</changelog>
  <changelog author="adam@mizerski.pl" date="1509192000">- update to 2.0.7
  * Added audio stream conversion functions.
  * Added functions to query and set the SDL memory allocation
    functions.
  * Added locking functions for multi-threaded access to
    the joystick and game controller APIs.
  * Some functions are now thread-safe.
- removed patches, merged upstream
  * dbus.diff
  * SDL2-ppc64-declaration-after-statement.patch
  * SDL-bnc1062784-check-overflow-xcf-props.patch</changelog>
  <changelog author="jengelh@inai.de" date="1515585600">- Add sdl2-symvers.patch.</changelog>
  <changelog author="jengelh@inai.de" date="1520510400">- Update to new upstream release 2.0.8
  * Added SDL_fmod() and SDL_log10().
  * Each of the SDL math functions now has the corresponding
    float version.
  * Added SDL_SetYUVConversionMode() and
    SDL_GetYUVConversionMode() to control the formula used when
    converting to and from YUV colorspace. The options are JPEG,
    BT.601, and BT.709.
  * Added the hint SDL_HINT_VIDEO_X11_NET_WM_BYPASS_COMPOSITOR to
    control whether the X server should skip the compositor for
    the SDL application. This defaults to "1".
  * Added the hint SDL_HINT_VIDEO_DOUBLE_BUFFER to control
    whether the Raspberry Pi and KMSDRM video drivers should use
    double or triple buffering (the default).</changelog>
  <changelog author="ytz1995@hotmail.com" date="1521288000">- Build with Wayland support</changelog>
  <changelog author="qzheng@suse.com" date="1551268800">- Add CVE-2019-7577.patch to fix a buffer over-read issue
  (CVE-2019-7577, boo#1124800).</changelog>
  <changelog author="qzheng@suse.com" date="1551355200">- Add CVE-2019-7637.patch to fix a heap-base buffer overflow
  issue (CVE-2019-7637, boo#1124825).</changelog>
  <changelog author="qzheng@suse.com" date="1551355201">- Add CVE-2019-7575.patch to fix a heap-based buffer overflow
  issue (CVE-2019-7575, boo#1124802).</changelog>
  <changelog author="qzheng@suse.com" date="1553083200">- Add CVE-2019-7574.patch to fix a heap-based buffer over-read
  issue (CVE-2019-7574, boo#1124803).</changelog>
  <changelog author="qzheng@suse.com" date="1553083201">- Add CVE-2019-7572.patch to fix a buffer over-read issue
  (CVE-2019-7572, boo#1124806).</changelog>
  <changelog author="qzheng@suse.com" date="1553083202">- Add CVE-2019-7578.patch to fix a heap-based buffer over-read
  issue (CVE-2019-7578, boo#1125099, CVE-2019-7576, boo#1124799
  CVE-2019-7573, boo#1124805).</changelog>
  <changelog author="qzheng@suse.com" date="1553083203">- Add CVE-2019-7635.patch to fix a heap-based buffer over-read
  issue (CVE-2019-7635, boo#1124827).</changelog>
  <changelog author="qzheng@suse.com" date="1553083204">- Add CVE-2019-7636.patch to fix a heap-based buffer over-read
  issue (CVE-2019-7636, boo#1124826, CVE-2019-7638, boo#1124824).</changelog>
  <changelog author="qzheng@suse.com" date="1558612800">- Remove CVE-2019-7637.patch, the modification of function
  SDL_CalculatePitch is only suit for SDL not SDL2.</changelog>
  <changelog author="mgorse@suse.com" date="1566820800">- Add CVE-2019-13616.patch: fix heap buffer overflow when reading
  a crafted bmp file (boo#1141844 CVE-2019-13616).
- Add CVE-2019-13626.patch: add safeguards to the wav parser to
  prevent crashes (boo#1142031 CVE-2019-13626).
- Drop CVE-2019-7572.patch, CVE-2019-7574.patch,
  CVE-2019-7575.patch, CVE-2019-7577.patch, and
  CVE-2019-7578.patch: these are handled by the new code added in
  CVE-2019-13626.patch.</changelog>
  <changelog author="sndirsch@suse.com" date="1578225600">-  sdl2-khronos.patch
  * fixes build on i586 (boo#1158176)</changelog>
  <changelog author="mgorse@suse.com" date="1641902400">- Add sdl2-surface-pitch-overflow.patch: fix overflow in surface
  pitch calculation (boo#1181201 boo#1181202 CVE-2020-14410
  CVE-2020-14409).</changelog>
</package>
<package pkgid="ab08dcabf6bac01410cbe30d0fbff2c915772d5c78df622122ce3881602d41df" name="libSDL2-devel" arch="s390x">
  <version epoch="0" ver="2.0.8" rel="11.3.1"/>
  <changelog author="guillaume@opensuse.org" date="1506945600">- Enable KMS/DRM video driver</changelog>
  <changelog author="jengelh@inai.de" date="1506945601">- Add dbus.diff</changelog>
  <changelog author="wbauer@tmo.at" date="1508155200">- Disable SSE3 (and also SSE2 on ix86) to prevent crashes on older
  CPUs that don't support these instructions</changelog>
  <changelog author="sreeves@suse.com" date="1508414400">- Add SDL-bnc1062784-check-overflow-xcf-props.patch. CVE-2017-2888</changelog>
  <changelog author="adam@mizerski.pl" date="1509192000">- update to 2.0.7
  * Added audio stream conversion functions.
  * Added functions to query and set the SDL memory allocation
    functions.
  * Added locking functions for multi-threaded access to
    the joystick and game controller APIs.
  * Some functions are now thread-safe.
- removed patches, merged upstream
  * dbus.diff
  * SDL2-ppc64-declaration-after-statement.patch
  * SDL-bnc1062784-check-overflow-xcf-props.patch</changelog>
  <changelog author="jengelh@inai.de" date="1515585600">- Add sdl2-symvers.patch.</changelog>
  <changelog author="jengelh@inai.de" date="1520510400">- Update to new upstream release 2.0.8
  * Added SDL_fmod() and SDL_log10().
  * Each of the SDL math functions now has the corresponding
    float version.
  * Added SDL_SetYUVConversionMode() and
    SDL_GetYUVConversionMode() to control the formula used when
    converting to and from YUV colorspace. The options are JPEG,
    BT.601, and BT.709.
  * Added the hint SDL_HINT_VIDEO_X11_NET_WM_BYPASS_COMPOSITOR to
    control whether the X server should skip the compositor for
    the SDL application. This defaults to "1".
  * Added the hint SDL_HINT_VIDEO_DOUBLE_BUFFER to control
    whether the Raspberry Pi and KMSDRM video drivers should use
    double or triple buffering (the default).</changelog>
  <changelog author="ytz1995@hotmail.com" date="1521288000">- Build with Wayland support</changelog>
  <changelog author="qzheng@suse.com" date="1551268800">- Add CVE-2019-7577.patch to fix a buffer over-read issue
  (CVE-2019-7577, boo#1124800).</changelog>
  <changelog author="qzheng@suse.com" date="1551355200">- Add CVE-2019-7637.patch to fix a heap-base buffer overflow
  issue (CVE-2019-7637, boo#1124825).</changelog>
  <changelog author="qzheng@suse.com" date="1551355201">- Add CVE-2019-7575.patch to fix a heap-based buffer overflow
  issue (CVE-2019-7575, boo#1124802).</changelog>
  <changelog author="qzheng@suse.com" date="1553083200">- Add CVE-2019-7574.patch to fix a heap-based buffer over-read
  issue (CVE-2019-7574, boo#1124803).</changelog>
  <changelog author="qzheng@suse.com" date="1553083201">- Add CVE-2019-7572.patch to fix a buffer over-read issue
  (CVE-2019-7572, boo#1124806).</changelog>
  <changelog author="qzheng@suse.com" date="1553083202">- Add CVE-2019-7578.patch to fix a heap-based buffer over-read
  issue (CVE-2019-7578, boo#1125099, CVE-2019-7576, boo#1124799
  CVE-2019-7573, boo#1124805).</changelog>
  <changelog author="qzheng@suse.com" date="1553083203">- Add CVE-2019-7635.patch to fix a heap-based buffer over-read
  issue (CVE-2019-7635, boo#1124827).</changelog>
  <changelog author="qzheng@suse.com" date="1553083204">- Add CVE-2019-7636.patch to fix a heap-based buffer over-read
  issue (CVE-2019-7636, boo#1124826, CVE-2019-7638, boo#1124824).</changelog>
  <changelog author="qzheng@suse.com" date="1558612800">- Remove CVE-2019-7637.patch, the modification of function
  SDL_CalculatePitch is only suit for SDL not SDL2.</changelog>
  <changelog author="mgorse@suse.com" date="1566820800">- Add CVE-2019-13616.patch: fix heap buffer overflow when reading
  a crafted bmp file (boo#1141844 CVE-2019-13616).
- Add CVE-2019-13626.patch: add safeguards to the wav parser to
  prevent crashes (boo#1142031 CVE-2019-13626).
- Drop CVE-2019-7572.patch, CVE-2019-7574.patch,
  CVE-2019-7575.patch, CVE-2019-7577.patch, and
  CVE-2019-7578.patch: these are handled by the new code added in
  CVE-2019-13626.patch.</changelog>
  <changelog author="sndirsch@suse.com" date="1578225600">-  sdl2-khronos.patch
  * fixes build on i586 (boo#1158176)</changelog>
  <changelog author="mgorse@suse.com" date="1641902400">- Add sdl2-surface-pitch-overflow.patch: fix overflow in surface
  pitch calculation (boo#1181201 boo#1181202 CVE-2020-14410
  CVE-2020-14409).</changelog>
</package>
<package pkgid="55a2a5129f8f338459c75bca861ff4be7c7d69b04cb2f4fdfe3af0ffe6f7ddca" name="libSDL2-devel" arch="x86_64">
  <version epoch="0" ver="2.0.8" rel="11.3.1"/>
  <changelog author="guillaume@opensuse.org" date="1506945600">- Enable KMS/DRM video driver</changelog>
  <changelog author="jengelh@inai.de" date="1506945601">- Add dbus.diff</changelog>
  <changelog author="wbauer@tmo.at" date="1508155200">- Disable SSE3 (and also SSE2 on ix86) to prevent crashes on older
  CPUs that don't support these instructions</changelog>
  <changelog author="sreeves@suse.com" date="1508414400">- Add SDL-bnc1062784-check-overflow-xcf-props.patch. CVE-2017-2888</changelog>
  <changelog author="adam@mizerski.pl" date="1509192000">- update to 2.0.7
  * Added audio stream conversion functions.
  * Added functions to query and set the SDL memory allocation
    functions.
  * Added locking functions for multi-threaded access to
    the joystick and game controller APIs.
  * Some functions are now thread-safe.
- removed patches, merged upstream
  * dbus.diff
  * SDL2-ppc64-declaration-after-statement.patch
  * SDL-bnc1062784-check-overflow-xcf-props.patch</changelog>
  <changelog author="jengelh@inai.de" date="1515585600">- Add sdl2-symvers.patch.</changelog>
  <changelog author="jengelh@inai.de" date="1520510400">- Update to new upstream release 2.0.8
  * Added SDL_fmod() and SDL_log10().
  * Each of the SDL math functions now has the corresponding
    float version.
  * Added SDL_SetYUVConversionMode() and
    SDL_GetYUVConversionMode() to control the formula used when
    converting to and from YUV colorspace. The options are JPEG,
    BT.601, and BT.709.
  * Added the hint SDL_HINT_VIDEO_X11_NET_WM_BYPASS_COMPOSITOR to
    control whether the X server should skip the compositor for
    the SDL application. This defaults to "1".
  * Added the hint SDL_HINT_VIDEO_DOUBLE_BUFFER to control
    whether the Raspberry Pi and KMSDRM video drivers should use
    double or triple buffering (the default).</changelog>
  <changelog author="ytz1995@hotmail.com" date="1521288000">- Build with Wayland support</changelog>
  <changelog author="qzheng@suse.com" date="1551268800">- Add CVE-2019-7577.patch to fix a buffer over-read issue
  (CVE-2019-7577, boo#1124800).</changelog>
  <changelog author="qzheng@suse.com" date="1551355200">- Add CVE-2019-7637.patch to fix a heap-base buffer overflow
  issue (CVE-2019-7637, boo#1124825).</changelog>
  <changelog author="qzheng@suse.com" date="1551355201">- Add CVE-2019-7575.patch to fix a heap-based buffer overflow
  issue (CVE-2019-7575, boo#1124802).</changelog>
  <changelog author="qzheng@suse.com" date="1553083200">- Add CVE-2019-7574.patch to fix a heap-based buffer over-read
  issue (CVE-2019-7574, boo#1124803).</changelog>
  <changelog author="qzheng@suse.com" date="1553083201">- Add CVE-2019-7572.patch to fix a buffer over-read issue
  (CVE-2019-7572, boo#1124806).</changelog>
  <changelog author="qzheng@suse.com" date="1553083202">- Add CVE-2019-7578.patch to fix a heap-based buffer over-read
  issue (CVE-2019-7578, boo#1125099, CVE-2019-7576, boo#1124799
  CVE-2019-7573, boo#1124805).</changelog>
  <changelog author="qzheng@suse.com" date="1553083203">- Add CVE-2019-7635.patch to fix a heap-based buffer over-read
  issue (CVE-2019-7635, boo#1124827).</changelog>
  <changelog author="qzheng@suse.com" date="1553083204">- Add CVE-2019-7636.patch to fix a heap-based buffer over-read
  issue (CVE-2019-7636, boo#1124826, CVE-2019-7638, boo#1124824).</changelog>
  <changelog author="qzheng@suse.com" date="1558612800">- Remove CVE-2019-7637.patch, the modification of function
  SDL_CalculatePitch is only suit for SDL not SDL2.</changelog>
  <changelog author="mgorse@suse.com" date="1566820800">- Add CVE-2019-13616.patch: fix heap buffer overflow when reading
  a crafted bmp file (boo#1141844 CVE-2019-13616).
- Add CVE-2019-13626.patch: add safeguards to the wav parser to
  prevent crashes (boo#1142031 CVE-2019-13626).
- Drop CVE-2019-7572.patch, CVE-2019-7574.patch,
  CVE-2019-7575.patch, CVE-2019-7577.patch, and
  CVE-2019-7578.patch: these are handled by the new code added in
  CVE-2019-13626.patch.</changelog>
  <changelog author="sndirsch@suse.com" date="1578225600">-  sdl2-khronos.patch
  * fixes build on i586 (boo#1158176)</changelog>
  <changelog author="mgorse@suse.com" date="1641902400">- Add sdl2-surface-pitch-overflow.patch: fix overflow in surface
  pitch calculation (boo#1181201 boo#1181202 CVE-2020-14410
  CVE-2020-14409).</changelog>
</package>
<package pkgid="f252f916d0084618408c5c9334acfffb37fba1438996b9110b802fb83b496e0c" name="libSDL2-devel-32bit" arch="x86_64">
  <version epoch="0" ver="2.0.8" rel="11.3.1"/>
  <changelog author="guillaume@opensuse.org" date="1506945600">- Enable KMS/DRM video driver</changelog>
  <changelog author="jengelh@inai.de" date="1506945601">- Add dbus.diff</changelog>
  <changelog author="wbauer@tmo.at" date="1508155200">- Disable SSE3 (and also SSE2 on ix86) to prevent crashes on older
  CPUs that don't support these instructions</changelog>
  <changelog author="sreeves@suse.com" date="1508414400">- Add SDL-bnc1062784-check-overflow-xcf-props.patch. CVE-2017-2888</changelog>
  <changelog author="adam@mizerski.pl" date="1509192000">- update to 2.0.7
  * Added audio stream conversion functions.
  * Added functions to query and set the SDL memory allocation
    functions.
  * Added locking functions for multi-threaded access to
    the joystick and game controller APIs.
  * Some functions are now thread-safe.
- removed patches, merged upstream
  * dbus.diff
  * SDL2-ppc64-declaration-after-statement.patch
  * SDL-bnc1062784-check-overflow-xcf-props.patch</changelog>
  <changelog author="jengelh@inai.de" date="1515585600">- Add sdl2-symvers.patch.</changelog>
  <changelog author="jengelh@inai.de" date="1520510400">- Update to new upstream release 2.0.8
  * Added SDL_fmod() and SDL_log10().
  * Each of the SDL math functions now has the corresponding
    float version.
  * Added SDL_SetYUVConversionMode() and
    SDL_GetYUVConversionMode() to control the formula used when
    converting to and from YUV colorspace. The options are JPEG,
    BT.601, and BT.709.
  * Added the hint SDL_HINT_VIDEO_X11_NET_WM_BYPASS_COMPOSITOR to
    control whether the X server should skip the compositor for
    the SDL application. This defaults to "1".
  * Added the hint SDL_HINT_VIDEO_DOUBLE_BUFFER to control
    whether the Raspberry Pi and KMSDRM video drivers should use
    double or triple buffering (the default).</changelog>
  <changelog author="ytz1995@hotmail.com" date="1521288000">- Build with Wayland support</changelog>
  <changelog author="qzheng@suse.com" date="1551268800">- Add CVE-2019-7577.patch to fix a buffer over-read issue
  (CVE-2019-7577, boo#1124800).</changelog>
  <changelog author="qzheng@suse.com" date="1551355200">- Add CVE-2019-7637.patch to fix a heap-base buffer overflow
  issue (CVE-2019-7637, boo#1124825).</changelog>
  <changelog author="qzheng@suse.com" date="1551355201">- Add CVE-2019-7575.patch to fix a heap-based buffer overflow
  issue (CVE-2019-7575, boo#1124802).</changelog>
  <changelog author="qzheng@suse.com" date="1553083200">- Add CVE-2019-7574.patch to fix a heap-based buffer over-read
  issue (CVE-2019-7574, boo#1124803).</changelog>
  <changelog author="qzheng@suse.com" date="1553083201">- Add CVE-2019-7572.patch to fix a buffer over-read issue
  (CVE-2019-7572, boo#1124806).</changelog>
  <changelog author="qzheng@suse.com" date="1553083202">- Add CVE-2019-7578.patch to fix a heap-based buffer over-read
  issue (CVE-2019-7578, boo#1125099, CVE-2019-7576, boo#1124799
  CVE-2019-7573, boo#1124805).</changelog>
  <changelog author="qzheng@suse.com" date="1553083203">- Add CVE-2019-7635.patch to fix a heap-based buffer over-read
  issue (CVE-2019-7635, boo#1124827).</changelog>
  <changelog author="qzheng@suse.com" date="1553083204">- Add CVE-2019-7636.patch to fix a heap-based buffer over-read
  issue (CVE-2019-7636, boo#1124826, CVE-2019-7638, boo#1124824).</changelog>
  <changelog author="qzheng@suse.com" date="1558612800">- Remove CVE-2019-7637.patch, the modification of function
  SDL_CalculatePitch is only suit for SDL not SDL2.</changelog>
  <changelog author="mgorse@suse.com" date="1566820800">- Add CVE-2019-13616.patch: fix heap buffer overflow when reading
  a crafted bmp file (boo#1141844 CVE-2019-13616).
- Add CVE-2019-13626.patch: add safeguards to the wav parser to
  prevent crashes (boo#1142031 CVE-2019-13626).
- Drop CVE-2019-7572.patch, CVE-2019-7574.patch,
  CVE-2019-7575.patch, CVE-2019-7577.patch, and
  CVE-2019-7578.patch: these are handled by the new code added in
  CVE-2019-13626.patch.</changelog>
  <changelog author="sndirsch@suse.com" date="1578225600">-  sdl2-khronos.patch
  * fixes build on i586 (boo#1158176)</changelog>
  <changelog author="mgorse@suse.com" date="1641902400">- Add sdl2-surface-pitch-overflow.patch: fix overflow in surface
  pitch calculation (boo#1181201 boo#1181202 CVE-2020-14410
  CVE-2020-14409).</changelog>
</package>
<package pkgid="04f2769995416b4c7607695be218398b574f28ce81dae61cbf4c91f536d816cd" name="libZXing1" arch="aarch64">
  <version epoch="0" ver="1.2.0" rel="9.7.1"/>
  <changelog author="lbeltrame@kde.org" date="1558094400">- Initial package for openSUSE
- Add upstream patch to add proper installability and library
  versioning:
  * fix-library-installation-and-versioning.patch</changelog>
  <changelog author="lbeltrame@kde.org" date="1558526400">- Fixup URL and Source</changelog>
  <changelog author="jengelh@inai.de" date="1558612800">- Trim metadata redundancies from description.</changelog>
  <changelog author="mliska@suse.cz" date="1575547200">- Add add-missing-includes-of-stdexcept-header.patch
  in order to fix boo#1158377.</changelog>
  <changelog author="christophe@krop.fr" date="1597579200">- Update to 1.1.0
  * Add Python binding
  * Bug fixes from upstream XZing project
  * Many performance improvements for 1D readers
  * More meta-data exported when reading specific format
  * Minor bug fixes and improvements for corner cases
  * Improve DataMatrix encoder
  * Add interface to simplify basic usage
  * WASM API to support pixels array as input
  * Few minor bug fixes
  * A new and (hopefully) 'future proof' single ReadBarcode entry point
    into the decoding functionality.
  * The LuminanceSource based API is now deprecated but still compiles.
  * A new BarcodeFormats flag type to specify the set of barcodes to look for.
  * Deprecated unrelyable Result::resultPoints in favor of well defined
    Result::position.
  * Deprecated Result::metadata() -&gt; ORIENTATION in favor
    of Result::orientation.
  * New Binarizer enum in DecodeHints to specify the binarizer for
    the ReadBarcode API.
  * New DecodeHints::isPure property to speed up detection for
    'pure' input use-cases.
  * New 'unified' CMake structure to build (most) of the project from
    the top-level project.
  * New ZXingReader and ZXingWriter example code also meant for distributing.
  * New simplified and consistent Python API (breaking change)
  * ReedSolomon error detection code 2x speedup.
  * Enable basic MaxiCode support.
  * Fix coutry-code metatdata decoding for UPC/EAN codes.
  * Slightly improved QRCode detection for rotated symbols.
  * Faster PDF417 decoder.
  * Lots of minor code readability and general cleanup improvements.
- Drop patches:
  * add-missing-includes-of-stdexcept-header.patch
  * fix-library-installation-and-versioning.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1599220800">- Add fix for pkg-config file so the version and library are set properly
  in the resulting .pc file:
  * fix-pkg-config-file.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1603454400">- Add baselibs.conf</changelog>
  <changelog author="sflees@suse.de" date="1610712000">- Use %cmake_build instead of %make_jobs
- Shouldn't need -DBUILD_SHARED_LIBRARY=ON</changelog>
  <changelog author="christophe@krop.fr" date="1612872000">- Update to 1.1.1. No changelog available.
- Drop fix-pkg-config-file.patch. Merged upstream
- Add 0001-Fix-build-with-GCC-11.patch to fix GCC 11 build
  issues (boo#1181915)</changelog>
  <changelog author="rpm@fthiessen.de" date="1622289600">- Update to 1.2.0
  * new BarcodeFormat names, old ones are deprecated
  * new ZXingQtCamReader demo app based on QtMultimedia and QtQuick
  * new QRCode reader, faster and better support for rotated symbols
  * added Structured Append support for DataMatrix, Aztec and MaxiCode
  * added DMRE support for DataMatrix
  * switch to the reimplemented 1D detectors, about 5x faster
  * a lot faster and more capable isPure detection for all 2D codes
  * 20% faster ReedSolomon error correcting
  * PDF417 is faster and supports flipped symbols
  * reduced false positive rate for UPC/EAN barcodes and improved
    Add-On symbol handling
  * proper ECI handling in all 2D barcodes
  * much improved python wrapper
  * deprecate the use of ResultMetadata
- Add cmake-check-system-first.patch
- Drop upstream merged 0001-Fix-build-with-GCC-11.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635940800">- Use the updated cmake3-full package instead of cmake on SLE12
- Do not build examples on SLE12
- Only build blackbox tests on TW</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636113600">- Do not build examples to avoid a cycle with QT5Multimedia</changelog>
  <changelog author="danilo.spinella@suse.com" date="1642593600">- Update stb_image/stb_image_write to include the fixes for
  the following CVEs:
  CVE-2021-28021, bsc#1191743
  CVE-2021-42715, bsc#1191942
  CVE-2021-42716, bsc#1191944
  * 269.patch</changelog>
</package>
<package pkgid="f814db231ecb80a9d408b1301900ce1bc7dd765a1e3f4cb361ac0cad3b11f001" name="libZXing1" arch="ppc64le">
  <version epoch="0" ver="1.2.0" rel="9.7.1"/>
  <changelog author="lbeltrame@kde.org" date="1558094400">- Initial package for openSUSE
- Add upstream patch to add proper installability and library
  versioning:
  * fix-library-installation-and-versioning.patch</changelog>
  <changelog author="lbeltrame@kde.org" date="1558526400">- Fixup URL and Source</changelog>
  <changelog author="jengelh@inai.de" date="1558612800">- Trim metadata redundancies from description.</changelog>
  <changelog author="mliska@suse.cz" date="1575547200">- Add add-missing-includes-of-stdexcept-header.patch
  in order to fix boo#1158377.</changelog>
  <changelog author="christophe@krop.fr" date="1597579200">- Update to 1.1.0
  * Add Python binding
  * Bug fixes from upstream XZing project
  * Many performance improvements for 1D readers
  * More meta-data exported when reading specific format
  * Minor bug fixes and improvements for corner cases
  * Improve DataMatrix encoder
  * Add interface to simplify basic usage
  * WASM API to support pixels array as input
  * Few minor bug fixes
  * A new and (hopefully) 'future proof' single ReadBarcode entry point
    into the decoding functionality.
  * The LuminanceSource based API is now deprecated but still compiles.
  * A new BarcodeFormats flag type to specify the set of barcodes to look for.
  * Deprecated unrelyable Result::resultPoints in favor of well defined
    Result::position.
  * Deprecated Result::metadata() -&gt; ORIENTATION in favor
    of Result::orientation.
  * New Binarizer enum in DecodeHints to specify the binarizer for
    the ReadBarcode API.
  * New DecodeHints::isPure property to speed up detection for
    'pure' input use-cases.
  * New 'unified' CMake structure to build (most) of the project from
    the top-level project.
  * New ZXingReader and ZXingWriter example code also meant for distributing.
  * New simplified and consistent Python API (breaking change)
  * ReedSolomon error detection code 2x speedup.
  * Enable basic MaxiCode support.
  * Fix coutry-code metatdata decoding for UPC/EAN codes.
  * Slightly improved QRCode detection for rotated symbols.
  * Faster PDF417 decoder.
  * Lots of minor code readability and general cleanup improvements.
- Drop patches:
  * add-missing-includes-of-stdexcept-header.patch
  * fix-library-installation-and-versioning.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1599220800">- Add fix for pkg-config file so the version and library are set properly
  in the resulting .pc file:
  * fix-pkg-config-file.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1603454400">- Add baselibs.conf</changelog>
  <changelog author="sflees@suse.de" date="1610712000">- Use %cmake_build instead of %make_jobs
- Shouldn't need -DBUILD_SHARED_LIBRARY=ON</changelog>
  <changelog author="christophe@krop.fr" date="1612872000">- Update to 1.1.1. No changelog available.
- Drop fix-pkg-config-file.patch. Merged upstream
- Add 0001-Fix-build-with-GCC-11.patch to fix GCC 11 build
  issues (boo#1181915)</changelog>
  <changelog author="rpm@fthiessen.de" date="1622289600">- Update to 1.2.0
  * new BarcodeFormat names, old ones are deprecated
  * new ZXingQtCamReader demo app based on QtMultimedia and QtQuick
  * new QRCode reader, faster and better support for rotated symbols
  * added Structured Append support for DataMatrix, Aztec and MaxiCode
  * added DMRE support for DataMatrix
  * switch to the reimplemented 1D detectors, about 5x faster
  * a lot faster and more capable isPure detection for all 2D codes
  * 20% faster ReedSolomon error correcting
  * PDF417 is faster and supports flipped symbols
  * reduced false positive rate for UPC/EAN barcodes and improved
    Add-On symbol handling
  * proper ECI handling in all 2D barcodes
  * much improved python wrapper
  * deprecate the use of ResultMetadata
- Add cmake-check-system-first.patch
- Drop upstream merged 0001-Fix-build-with-GCC-11.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635940800">- Use the updated cmake3-full package instead of cmake on SLE12
- Do not build examples on SLE12
- Only build blackbox tests on TW</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636113600">- Do not build examples to avoid a cycle with QT5Multimedia</changelog>
  <changelog author="danilo.spinella@suse.com" date="1642593600">- Update stb_image/stb_image_write to include the fixes for
  the following CVEs:
  CVE-2021-28021, bsc#1191743
  CVE-2021-42715, bsc#1191942
  CVE-2021-42716, bsc#1191944
  * 269.patch</changelog>
</package>
<package pkgid="8f5700709fac590db3cab9668708aaac6ecf0e98f191e6ef80f91253b9fcf34c" name="libZXing1" arch="s390x">
  <version epoch="0" ver="1.2.0" rel="9.7.1"/>
  <changelog author="lbeltrame@kde.org" date="1558094400">- Initial package for openSUSE
- Add upstream patch to add proper installability and library
  versioning:
  * fix-library-installation-and-versioning.patch</changelog>
  <changelog author="lbeltrame@kde.org" date="1558526400">- Fixup URL and Source</changelog>
  <changelog author="jengelh@inai.de" date="1558612800">- Trim metadata redundancies from description.</changelog>
  <changelog author="mliska@suse.cz" date="1575547200">- Add add-missing-includes-of-stdexcept-header.patch
  in order to fix boo#1158377.</changelog>
  <changelog author="christophe@krop.fr" date="1597579200">- Update to 1.1.0
  * Add Python binding
  * Bug fixes from upstream XZing project
  * Many performance improvements for 1D readers
  * More meta-data exported when reading specific format
  * Minor bug fixes and improvements for corner cases
  * Improve DataMatrix encoder
  * Add interface to simplify basic usage
  * WASM API to support pixels array as input
  * Few minor bug fixes
  * A new and (hopefully) 'future proof' single ReadBarcode entry point
    into the decoding functionality.
  * The LuminanceSource based API is now deprecated but still compiles.
  * A new BarcodeFormats flag type to specify the set of barcodes to look for.
  * Deprecated unrelyable Result::resultPoints in favor of well defined
    Result::position.
  * Deprecated Result::metadata() -&gt; ORIENTATION in favor
    of Result::orientation.
  * New Binarizer enum in DecodeHints to specify the binarizer for
    the ReadBarcode API.
  * New DecodeHints::isPure property to speed up detection for
    'pure' input use-cases.
  * New 'unified' CMake structure to build (most) of the project from
    the top-level project.
  * New ZXingReader and ZXingWriter example code also meant for distributing.
  * New simplified and consistent Python API (breaking change)
  * ReedSolomon error detection code 2x speedup.
  * Enable basic MaxiCode support.
  * Fix coutry-code metatdata decoding for UPC/EAN codes.
  * Slightly improved QRCode detection for rotated symbols.
  * Faster PDF417 decoder.
  * Lots of minor code readability and general cleanup improvements.
- Drop patches:
  * add-missing-includes-of-stdexcept-header.patch
  * fix-library-installation-and-versioning.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1599220800">- Add fix for pkg-config file so the version and library are set properly
  in the resulting .pc file:
  * fix-pkg-config-file.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1603454400">- Add baselibs.conf</changelog>
  <changelog author="sflees@suse.de" date="1610712000">- Use %cmake_build instead of %make_jobs
- Shouldn't need -DBUILD_SHARED_LIBRARY=ON</changelog>
  <changelog author="christophe@krop.fr" date="1612872000">- Update to 1.1.1. No changelog available.
- Drop fix-pkg-config-file.patch. Merged upstream
- Add 0001-Fix-build-with-GCC-11.patch to fix GCC 11 build
  issues (boo#1181915)</changelog>
  <changelog author="rpm@fthiessen.de" date="1622289600">- Update to 1.2.0
  * new BarcodeFormat names, old ones are deprecated
  * new ZXingQtCamReader demo app based on QtMultimedia and QtQuick
  * new QRCode reader, faster and better support for rotated symbols
  * added Structured Append support for DataMatrix, Aztec and MaxiCode
  * added DMRE support for DataMatrix
  * switch to the reimplemented 1D detectors, about 5x faster
  * a lot faster and more capable isPure detection for all 2D codes
  * 20% faster ReedSolomon error correcting
  * PDF417 is faster and supports flipped symbols
  * reduced false positive rate for UPC/EAN barcodes and improved
    Add-On symbol handling
  * proper ECI handling in all 2D barcodes
  * much improved python wrapper
  * deprecate the use of ResultMetadata
- Add cmake-check-system-first.patch
- Drop upstream merged 0001-Fix-build-with-GCC-11.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635940800">- Use the updated cmake3-full package instead of cmake on SLE12
- Do not build examples on SLE12
- Only build blackbox tests on TW</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636113600">- Do not build examples to avoid a cycle with QT5Multimedia</changelog>
  <changelog author="danilo.spinella@suse.com" date="1642593600">- Update stb_image/stb_image_write to include the fixes for
  the following CVEs:
  CVE-2021-28021, bsc#1191743
  CVE-2021-42715, bsc#1191942
  CVE-2021-42716, bsc#1191944
  * 269.patch</changelog>
</package>
<package pkgid="4fd12e28a4b0efeb53a9634dda912fbcef4ba98ba4ad548e28131ddcc73fd7ce" name="libZXing1" arch="x86_64">
  <version epoch="0" ver="1.2.0" rel="9.7.1"/>
  <changelog author="lbeltrame@kde.org" date="1558094400">- Initial package for openSUSE
- Add upstream patch to add proper installability and library
  versioning:
  * fix-library-installation-and-versioning.patch</changelog>
  <changelog author="lbeltrame@kde.org" date="1558526400">- Fixup URL and Source</changelog>
  <changelog author="jengelh@inai.de" date="1558612800">- Trim metadata redundancies from description.</changelog>
  <changelog author="mliska@suse.cz" date="1575547200">- Add add-missing-includes-of-stdexcept-header.patch
  in order to fix boo#1158377.</changelog>
  <changelog author="christophe@krop.fr" date="1597579200">- Update to 1.1.0
  * Add Python binding
  * Bug fixes from upstream XZing project
  * Many performance improvements for 1D readers
  * More meta-data exported when reading specific format
  * Minor bug fixes and improvements for corner cases
  * Improve DataMatrix encoder
  * Add interface to simplify basic usage
  * WASM API to support pixels array as input
  * Few minor bug fixes
  * A new and (hopefully) 'future proof' single ReadBarcode entry point
    into the decoding functionality.
  * The LuminanceSource based API is now deprecated but still compiles.
  * A new BarcodeFormats flag type to specify the set of barcodes to look for.
  * Deprecated unrelyable Result::resultPoints in favor of well defined
    Result::position.
  * Deprecated Result::metadata() -&gt; ORIENTATION in favor
    of Result::orientation.
  * New Binarizer enum in DecodeHints to specify the binarizer for
    the ReadBarcode API.
  * New DecodeHints::isPure property to speed up detection for
    'pure' input use-cases.
  * New 'unified' CMake structure to build (most) of the project from
    the top-level project.
  * New ZXingReader and ZXingWriter example code also meant for distributing.
  * New simplified and consistent Python API (breaking change)
  * ReedSolomon error detection code 2x speedup.
  * Enable basic MaxiCode support.
  * Fix coutry-code metatdata decoding for UPC/EAN codes.
  * Slightly improved QRCode detection for rotated symbols.
  * Faster PDF417 decoder.
  * Lots of minor code readability and general cleanup improvements.
- Drop patches:
  * add-missing-includes-of-stdexcept-header.patch
  * fix-library-installation-and-versioning.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1599220800">- Add fix for pkg-config file so the version and library are set properly
  in the resulting .pc file:
  * fix-pkg-config-file.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1603454400">- Add baselibs.conf</changelog>
  <changelog author="sflees@suse.de" date="1610712000">- Use %cmake_build instead of %make_jobs
- Shouldn't need -DBUILD_SHARED_LIBRARY=ON</changelog>
  <changelog author="christophe@krop.fr" date="1612872000">- Update to 1.1.1. No changelog available.
- Drop fix-pkg-config-file.patch. Merged upstream
- Add 0001-Fix-build-with-GCC-11.patch to fix GCC 11 build
  issues (boo#1181915)</changelog>
  <changelog author="rpm@fthiessen.de" date="1622289600">- Update to 1.2.0
  * new BarcodeFormat names, old ones are deprecated
  * new ZXingQtCamReader demo app based on QtMultimedia and QtQuick
  * new QRCode reader, faster and better support for rotated symbols
  * added Structured Append support for DataMatrix, Aztec and MaxiCode
  * added DMRE support for DataMatrix
  * switch to the reimplemented 1D detectors, about 5x faster
  * a lot faster and more capable isPure detection for all 2D codes
  * 20% faster ReedSolomon error correcting
  * PDF417 is faster and supports flipped symbols
  * reduced false positive rate for UPC/EAN barcodes and improved
    Add-On symbol handling
  * proper ECI handling in all 2D barcodes
  * much improved python wrapper
  * deprecate the use of ResultMetadata
- Add cmake-check-system-first.patch
- Drop upstream merged 0001-Fix-build-with-GCC-11.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635940800">- Use the updated cmake3-full package instead of cmake on SLE12
- Do not build examples on SLE12
- Only build blackbox tests on TW</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636113600">- Do not build examples to avoid a cycle with QT5Multimedia</changelog>
  <changelog author="danilo.spinella@suse.com" date="1642593600">- Update stb_image/stb_image_write to include the fixes for
  the following CVEs:
  CVE-2021-28021, bsc#1191743
  CVE-2021-42715, bsc#1191942
  CVE-2021-42716, bsc#1191944
  * 269.patch</changelog>
</package>
<package pkgid="15a9deafd2be366630fb1c7e45927f881ec7678c7350c0c7788748cefb585598" name="libZXing1-32bit" arch="x86_64">
  <version epoch="0" ver="1.2.0" rel="9.7.1"/>
  <changelog author="lbeltrame@kde.org" date="1558094400">- Initial package for openSUSE
- Add upstream patch to add proper installability and library
  versioning:
  * fix-library-installation-and-versioning.patch</changelog>
  <changelog author="lbeltrame@kde.org" date="1558526400">- Fixup URL and Source</changelog>
  <changelog author="jengelh@inai.de" date="1558612800">- Trim metadata redundancies from description.</changelog>
  <changelog author="mliska@suse.cz" date="1575547200">- Add add-missing-includes-of-stdexcept-header.patch
  in order to fix boo#1158377.</changelog>
  <changelog author="christophe@krop.fr" date="1597579200">- Update to 1.1.0
  * Add Python binding
  * Bug fixes from upstream XZing project
  * Many performance improvements for 1D readers
  * More meta-data exported when reading specific format
  * Minor bug fixes and improvements for corner cases
  * Improve DataMatrix encoder
  * Add interface to simplify basic usage
  * WASM API to support pixels array as input
  * Few minor bug fixes
  * A new and (hopefully) 'future proof' single ReadBarcode entry point
    into the decoding functionality.
  * The LuminanceSource based API is now deprecated but still compiles.
  * A new BarcodeFormats flag type to specify the set of barcodes to look for.
  * Deprecated unrelyable Result::resultPoints in favor of well defined
    Result::position.
  * Deprecated Result::metadata() -&gt; ORIENTATION in favor
    of Result::orientation.
  * New Binarizer enum in DecodeHints to specify the binarizer for
    the ReadBarcode API.
  * New DecodeHints::isPure property to speed up detection for
    'pure' input use-cases.
  * New 'unified' CMake structure to build (most) of the project from
    the top-level project.
  * New ZXingReader and ZXingWriter example code also meant for distributing.
  * New simplified and consistent Python API (breaking change)
  * ReedSolomon error detection code 2x speedup.
  * Enable basic MaxiCode support.
  * Fix coutry-code metatdata decoding for UPC/EAN codes.
  * Slightly improved QRCode detection for rotated symbols.
  * Faster PDF417 decoder.
  * Lots of minor code readability and general cleanup improvements.
- Drop patches:
  * add-missing-includes-of-stdexcept-header.patch
  * fix-library-installation-and-versioning.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1599220800">- Add fix for pkg-config file so the version and library are set properly
  in the resulting .pc file:
  * fix-pkg-config-file.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1603454400">- Add baselibs.conf</changelog>
  <changelog author="sflees@suse.de" date="1610712000">- Use %cmake_build instead of %make_jobs
- Shouldn't need -DBUILD_SHARED_LIBRARY=ON</changelog>
  <changelog author="christophe@krop.fr" date="1612872000">- Update to 1.1.1. No changelog available.
- Drop fix-pkg-config-file.patch. Merged upstream
- Add 0001-Fix-build-with-GCC-11.patch to fix GCC 11 build
  issues (boo#1181915)</changelog>
  <changelog author="rpm@fthiessen.de" date="1622289600">- Update to 1.2.0
  * new BarcodeFormat names, old ones are deprecated
  * new ZXingQtCamReader demo app based on QtMultimedia and QtQuick
  * new QRCode reader, faster and better support for rotated symbols
  * added Structured Append support for DataMatrix, Aztec and MaxiCode
  * added DMRE support for DataMatrix
  * switch to the reimplemented 1D detectors, about 5x faster
  * a lot faster and more capable isPure detection for all 2D codes
  * 20% faster ReedSolomon error correcting
  * PDF417 is faster and supports flipped symbols
  * reduced false positive rate for UPC/EAN barcodes and improved
    Add-On symbol handling
  * proper ECI handling in all 2D barcodes
  * much improved python wrapper
  * deprecate the use of ResultMetadata
- Add cmake-check-system-first.patch
- Drop upstream merged 0001-Fix-build-with-GCC-11.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635940800">- Use the updated cmake3-full package instead of cmake on SLE12
- Do not build examples on SLE12
- Only build blackbox tests on TW</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636113600">- Do not build examples to avoid a cycle with QT5Multimedia</changelog>
  <changelog author="danilo.spinella@suse.com" date="1642593600">- Update stb_image/stb_image_write to include the fixes for
  the following CVEs:
  CVE-2021-28021, bsc#1191743
  CVE-2021-42715, bsc#1191942
  CVE-2021-42716, bsc#1191944
  * 269.patch</changelog>
</package>
<package pkgid="694f549ee2894e558e2786beee988885bc85ee5f7a4c15a96c6634574012139e" name="libboost_mpi_python-py2_7-1_66_0" arch="aarch64">
  <version epoch="0" ver="1.66.0" rel="12.3.1"/>
  <changelog author="adam.majer@suse.de" date="1478606400">- Revert upstream change that set default python version and
  ignored user configuration.
  python-2059618.patch (boo#1006584)</changelog>
  <changelog author="adam.majer@suse.de" date="1483531200">- update to version 1.63.0
  * updated libraries: atomic, container, context, fiber,
    fusion, geometry, hash, interprocess, intrusive, lexical cast,
    log, metaparse, move, optional, phoenix, python, test,
    typeindex, units, unordered
  * see http://www.boost.org/users/history/version_1_63_0.html
    for complete list of changes
- refresh patches
  * boost-1.55.0-python-test-PyImport_AppendInittab.patch
  * boost-strict_aliasing.patch, and enable -fno-strict-aliasing
    for python module
- baselibs.conf:
  * add libboost_locale
  * rename python to include new soname
- remove python-2059618.patch, not needed
- make build condition --without buil_mpi work
- allow building without python3 bindings, for SLE11SP4
- remove versioned build dependency on libicu-devel, apparently
  not needed.
- split out the boost-devel package into individudal compiled
  libraries and their -devel subpackages and libboost_headers-devel
  package for header-only libraries.
- remove all the -mt.so symlinks, probably not needed anymore.
- ship MPI python bindings for both Python 2.7 and 3.x
  * add python_mpi.patch to allow proper compiled library loading
- dynamic_linking.patch: first attempt to remove static library
  generation during build process.</changelog>
  <changelog author="adam.majer@suse.de" date="1484481600">- remove non-existent dependency in the boost mpi python package</changelog>
  <changelog author="adam.majer@suse.de" date="1484654400">- test_lowcase.patch: downcase Boost::Test usage of uppercase
  variables. VERSION was clashing with GNU Autotools define
  resulting in compilation errors of various packages.
- recombine headers from various devel subpackages under the
  libboost_headers-devel package. Not all usage of headers that
  have compiled parts pull in their associated compiled symbols.
- general cleanup of the spec file from old, commented stuffs</changelog>
  <changelog author="adam.majer@suse.de" date="1485345600">- Fix dependency typos.</changelog>
  <changelog author="adam.majer@suse.de" date="1486123200">- baselibs.conf: (re)add python 2.7 and 3.x libraries</changelog>
  <changelog author="jmatejek@suse.com" date="1486728000">- update python macros</changelog>
  <changelog author="adam.majer@suse.de" date="1492689600">- New upstream version 1.64.0
  + process - new library providing cross platform methods to
  - create child processes
  - setup stream for child processes
  - sync and async communication streams with children
  - sync and async wait
  - process termination
  + geometry library had some breaking changes,
  - ublas_transformer is renamed to matrix_transformer
  - explicit modifier is added to constructors of rtree
    index::dynamic_* parameters
  - strategy::area::huiller replaced by strategy::area::spherical
  + context library updates
  - deprecated API:execution-context
  - fixed bad assembly for fcontext on ppc64/sysv/elf
  + Updated libraries: any, atomic, config, container, context,
    conversion, core, coroutine2, fiber, hash, interprocess,
    intrusive, lexicalcast, math, multi-index containers,
    multiprecision, predef, program options, regex, smart pointers,
    test ,typeindex, typetraits, unordered, variant
  + for details, see
    http://www.boost.org/users/history/version_1_64_0.html
- Build PyNumpy module
  + add build requires on python-numpy
- test_lowcase.patch: upstreamed
- refreshed patches: boost-strict_aliasing.patch, gcc_path.patch,
  python_mpi.patch
- mpi_upstream.patch: pending upstream fixes to OpenMPI build
- python_library_name.patch: we are building python versions in
  different stagings so drop library renames.
- python_numpy_retfunc.patch: rpmlint fixes</changelog>
  <changelog author="adam.majer@suse.de" date="1494244800">- make python-numpy optional build dependency
- fix building of mpi python3 plugin</changelog>
  <changelog author="adam.majer@suse.de" date="1494331200">- 1d862615.patch: Fix regression caused by refactoring of
  serialization code (bnc#1038083)</changelog>
  <changelog author="adam.majer@suse.de" date="1505908800">- New upstream version 1.65.1
  + config, fiber - Return a continuation from functions executed
    by resume_with.
  + stacktrace - Change preprocessor file extensions to work with
    the installation system.
- Changes in version 1.65.0
  + stacktrace - new library providing call sequence in human
    readable format.
  + polycollection - new library providing fast containers of
    polymorphic objects, from Joaquín M López Muñoz.
  + For full list of changes, see
    http://www.boost.org/users/history/version_1_65_1.html
- 1d862615.patch: upstreamed and removed
- gcc_path.patch: obsolete, tr1 module is removed
- mpi_upstream.patch: upstreamed and removed
- boost-1.57.0-python-abi_letters.patch: refreshed
- python_library_name.patch: refreshed and reverted upstream
  changes to mpi/build/Jamfile as we are building python2 and
  python3 versions of MPI separately.
- baselibs.conf
  + add libboost_stracktrace
  + update to version 1.65.1</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1507550400">- Setup MPI environment prior to building boost.
- Switch to OpenMPI2 as OpenMPI1 is becoming deprecated.</changelog>
  <changelog author="adam.majer@suse.de" date="1507636800">- Use multibuild setup - build no-dependency libraries in the
  base package and build the rest of the compiled libraries in
  the main variant. This should speed up bootstrapping.
- boost-devel not built by default anymore.
- libboost_headers-devel now provides boost-devel for legacy
  dependencies. If you need compiled boost libraries depend on
  the current compiled devel subpackage.
- run %fdupes only on the header files and documentation
- drop build dependencies on gcc-fortran, chrpath.</changelog>
  <changelog author="jmatejek@suse.com" date="1508846400">- build Python 2 conditionally</changelog>
  <changelog author="adam.majer@suse.de" date="1511956800">- re-enable Python 2 by default. It's still conditional, but
  remains enabled by default. This can be disabled in project
  config.</changelog>
  <changelog author="adam.majer@suse.de" date="1513598400">- Update to version 1.66.0
  + Beast: new portable HTTP, WebSocket and network operations
    using Boost.Asio. Header-only library.
  + Callable Traits: new library and successor to
    Boost.FunctionTypes. Header-only library.
  + Mp11: new metaprogramming library
  + Asio:
  * implemented interface changes to reflect the Networking TS
    (N4656)
  * functions and classes that have been superseded by
    Networking TS functionality have been deprecated.
  * added support for customized handler tracking
  * removed previously deprecated functions
  + Atomic: improved compatibility with GCC 7. 128-bit operations
    on x86_64 no longer require linking with compiled library.
  + DateTime: Fixed an integral overflow that could cause incorrect
    results when adding or subtracting many years from a date.
  + Format: New format specifiers added and volatile arguments
    can not be safely used with operator%
  + Fusion:
  * fix compile error with std::array
  * remove circular preprocessor include
  + PolyCollection: backported to GCC 4.8 and 4.9 with some
    limitations
  + Uuid: added RTF-4122 namespaces in boost::uuids::ns
  + for complete changelog, see
    http://www.boost.org/users/history/version_1_66_0.html
- refreshed patches: boost-rpmoptflags-only.patch</changelog>
  <changelog author="adam.majer@suse.de" date="1516363200">- Multibuild requires versioned Name: tag and doesn't seem to do
  this automatically. (bnc#1076640)</changelog>
  <changelog author="kukuk@suse.de" date="1522843200">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="adam.majer@suse.de" date="1584619200">- libreoffice_compat_backports.patch: add a backport of
  Boost.Optional::has_value() for LibreOffice</changelog>
  <changelog author="adam.majer@suse.de" date="1641816000">- variant.patch: backport fix allowing perfect forwarding in
  apply_visitor. Also fix wrong usage of boost::move (bsc#1194522)</changelog>
</package>
<package pkgid="cd9b36be81b8aa916681e58a6401dbd9c83ddadfa8d7b7e037b5251eef357738" name="libboost_mpi_python-py2_7-1_66_0" arch="ppc64le">
  <version epoch="0" ver="1.66.0" rel="12.3.1"/>
  <changelog author="adam.majer@suse.de" date="1478606400">- Revert upstream change that set default python version and
  ignored user configuration.
  python-2059618.patch (boo#1006584)</changelog>
  <changelog author="adam.majer@suse.de" date="1483531200">- update to version 1.63.0
  * updated libraries: atomic, container, context, fiber,
    fusion, geometry, hash, interprocess, intrusive, lexical cast,
    log, metaparse, move, optional, phoenix, python, test,
    typeindex, units, unordered
  * see http://www.boost.org/users/history/version_1_63_0.html
    for complete list of changes
- refresh patches
  * boost-1.55.0-python-test-PyImport_AppendInittab.patch
  * boost-strict_aliasing.patch, and enable -fno-strict-aliasing
    for python module
- baselibs.conf:
  * add libboost_locale
  * rename python to include new soname
- remove python-2059618.patch, not needed
- make build condition --without buil_mpi work
- allow building without python3 bindings, for SLE11SP4
- remove versioned build dependency on libicu-devel, apparently
  not needed.
- split out the boost-devel package into individudal compiled
  libraries and their -devel subpackages and libboost_headers-devel
  package for header-only libraries.
- remove all the -mt.so symlinks, probably not needed anymore.
- ship MPI python bindings for both Python 2.7 and 3.x
  * add python_mpi.patch to allow proper compiled library loading
- dynamic_linking.patch: first attempt to remove static library
  generation during build process.</changelog>
  <changelog author="adam.majer@suse.de" date="1484481600">- remove non-existent dependency in the boost mpi python package</changelog>
  <changelog author="adam.majer@suse.de" date="1484654400">- test_lowcase.patch: downcase Boost::Test usage of uppercase
  variables. VERSION was clashing with GNU Autotools define
  resulting in compilation errors of various packages.
- recombine headers from various devel subpackages under the
  libboost_headers-devel package. Not all usage of headers that
  have compiled parts pull in their associated compiled symbols.
- general cleanup of the spec file from old, commented stuffs</changelog>
  <changelog author="adam.majer@suse.de" date="1485345600">- Fix dependency typos.</changelog>
  <changelog author="adam.majer@suse.de" date="1486123200">- baselibs.conf: (re)add python 2.7 and 3.x libraries</changelog>
  <changelog author="jmatejek@suse.com" date="1486728000">- update python macros</changelog>
  <changelog author="adam.majer@suse.de" date="1492689600">- New upstream version 1.64.0
  + process - new library providing cross platform methods to
  - create child processes
  - setup stream for child processes
  - sync and async communication streams with children
  - sync and async wait
  - process termination
  + geometry library had some breaking changes,
  - ublas_transformer is renamed to matrix_transformer
  - explicit modifier is added to constructors of rtree
    index::dynamic_* parameters
  - strategy::area::huiller replaced by strategy::area::spherical
  + context library updates
  - deprecated API:execution-context
  - fixed bad assembly for fcontext on ppc64/sysv/elf
  + Updated libraries: any, atomic, config, container, context,
    conversion, core, coroutine2, fiber, hash, interprocess,
    intrusive, lexicalcast, math, multi-index containers,
    multiprecision, predef, program options, regex, smart pointers,
    test ,typeindex, typetraits, unordered, variant
  + for details, see
    http://www.boost.org/users/history/version_1_64_0.html
- Build PyNumpy module
  + add build requires on python-numpy
- test_lowcase.patch: upstreamed
- refreshed patches: boost-strict_aliasing.patch, gcc_path.patch,
  python_mpi.patch
- mpi_upstream.patch: pending upstream fixes to OpenMPI build
- python_library_name.patch: we are building python versions in
  different stagings so drop library renames.
- python_numpy_retfunc.patch: rpmlint fixes</changelog>
  <changelog author="adam.majer@suse.de" date="1494244800">- make python-numpy optional build dependency
- fix building of mpi python3 plugin</changelog>
  <changelog author="adam.majer@suse.de" date="1494331200">- 1d862615.patch: Fix regression caused by refactoring of
  serialization code (bnc#1038083)</changelog>
  <changelog author="adam.majer@suse.de" date="1505908800">- New upstream version 1.65.1
  + config, fiber - Return a continuation from functions executed
    by resume_with.
  + stacktrace - Change preprocessor file extensions to work with
    the installation system.
- Changes in version 1.65.0
  + stacktrace - new library providing call sequence in human
    readable format.
  + polycollection - new library providing fast containers of
    polymorphic objects, from Joaquín M López Muñoz.
  + For full list of changes, see
    http://www.boost.org/users/history/version_1_65_1.html
- 1d862615.patch: upstreamed and removed
- gcc_path.patch: obsolete, tr1 module is removed
- mpi_upstream.patch: upstreamed and removed
- boost-1.57.0-python-abi_letters.patch: refreshed
- python_library_name.patch: refreshed and reverted upstream
  changes to mpi/build/Jamfile as we are building python2 and
  python3 versions of MPI separately.
- baselibs.conf
  + add libboost_stracktrace
  + update to version 1.65.1</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1507550400">- Setup MPI environment prior to building boost.
- Switch to OpenMPI2 as OpenMPI1 is becoming deprecated.</changelog>
  <changelog author="adam.majer@suse.de" date="1507636800">- Use multibuild setup - build no-dependency libraries in the
  base package and build the rest of the compiled libraries in
  the main variant. This should speed up bootstrapping.
- boost-devel not built by default anymore.
- libboost_headers-devel now provides boost-devel for legacy
  dependencies. If you need compiled boost libraries depend on
  the current compiled devel subpackage.
- run %fdupes only on the header files and documentation
- drop build dependencies on gcc-fortran, chrpath.</changelog>
  <changelog author="jmatejek@suse.com" date="1508846400">- build Python 2 conditionally</changelog>
  <changelog author="adam.majer@suse.de" date="1511956800">- re-enable Python 2 by default. It's still conditional, but
  remains enabled by default. This can be disabled in project
  config.</changelog>
  <changelog author="adam.majer@suse.de" date="1513598400">- Update to version 1.66.0
  + Beast: new portable HTTP, WebSocket and network operations
    using Boost.Asio. Header-only library.
  + Callable Traits: new library and successor to
    Boost.FunctionTypes. Header-only library.
  + Mp11: new metaprogramming library
  + Asio:
  * implemented interface changes to reflect the Networking TS
    (N4656)
  * functions and classes that have been superseded by
    Networking TS functionality have been deprecated.
  * added support for customized handler tracking
  * removed previously deprecated functions
  + Atomic: improved compatibility with GCC 7. 128-bit operations
    on x86_64 no longer require linking with compiled library.
  + DateTime: Fixed an integral overflow that could cause incorrect
    results when adding or subtracting many years from a date.
  + Format: New format specifiers added and volatile arguments
    can not be safely used with operator%
  + Fusion:
  * fix compile error with std::array
  * remove circular preprocessor include
  + PolyCollection: backported to GCC 4.8 and 4.9 with some
    limitations
  + Uuid: added RTF-4122 namespaces in boost::uuids::ns
  + for complete changelog, see
    http://www.boost.org/users/history/version_1_66_0.html
- refreshed patches: boost-rpmoptflags-only.patch</changelog>
  <changelog author="adam.majer@suse.de" date="1516363200">- Multibuild requires versioned Name: tag and doesn't seem to do
  this automatically. (bnc#1076640)</changelog>
  <changelog author="kukuk@suse.de" date="1522843200">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="adam.majer@suse.de" date="1584619200">- libreoffice_compat_backports.patch: add a backport of
  Boost.Optional::has_value() for LibreOffice</changelog>
  <changelog author="adam.majer@suse.de" date="1641816000">- variant.patch: backport fix allowing perfect forwarding in
  apply_visitor. Also fix wrong usage of boost::move (bsc#1194522)</changelog>
</package>
<package pkgid="5947d5c4c8f234e6d39a9b97a9bc85e9a7d1bca4f9549231c49cf13384b9cf27" name="libboost_mpi_python-py2_7-1_66_0" arch="s390x">
  <version epoch="0" ver="1.66.0" rel="12.3.1"/>
  <changelog author="adam.majer@suse.de" date="1478606400">- Revert upstream change that set default python version and
  ignored user configuration.
  python-2059618.patch (boo#1006584)</changelog>
  <changelog author="adam.majer@suse.de" date="1483531200">- update to version 1.63.0
  * updated libraries: atomic, container, context, fiber,
    fusion, geometry, hash, interprocess, intrusive, lexical cast,
    log, metaparse, move, optional, phoenix, python, test,
    typeindex, units, unordered
  * see http://www.boost.org/users/history/version_1_63_0.html
    for complete list of changes
- refresh patches
  * boost-1.55.0-python-test-PyImport_AppendInittab.patch
  * boost-strict_aliasing.patch, and enable -fno-strict-aliasing
    for python module
- baselibs.conf:
  * add libboost_locale
  * rename python to include new soname
- remove python-2059618.patch, not needed
- make build condition --without buil_mpi work
- allow building without python3 bindings, for SLE11SP4
- remove versioned build dependency on libicu-devel, apparently
  not needed.
- split out the boost-devel package into individudal compiled
  libraries and their -devel subpackages and libboost_headers-devel
  package for header-only libraries.
- remove all the -mt.so symlinks, probably not needed anymore.
- ship MPI python bindings for both Python 2.7 and 3.x
  * add python_mpi.patch to allow proper compiled library loading
- dynamic_linking.patch: first attempt to remove static library
  generation during build process.</changelog>
  <changelog author="adam.majer@suse.de" date="1484481600">- remove non-existent dependency in the boost mpi python package</changelog>
  <changelog author="adam.majer@suse.de" date="1484654400">- test_lowcase.patch: downcase Boost::Test usage of uppercase
  variables. VERSION was clashing with GNU Autotools define
  resulting in compilation errors of various packages.
- recombine headers from various devel subpackages under the
  libboost_headers-devel package. Not all usage of headers that
  have compiled parts pull in their associated compiled symbols.
- general cleanup of the spec file from old, commented stuffs</changelog>
  <changelog author="adam.majer@suse.de" date="1485345600">- Fix dependency typos.</changelog>
  <changelog author="adam.majer@suse.de" date="1486123200">- baselibs.conf: (re)add python 2.7 and 3.x libraries</changelog>
  <changelog author="jmatejek@suse.com" date="1486728000">- update python macros</changelog>
  <changelog author="adam.majer@suse.de" date="1492689600">- New upstream version 1.64.0
  + process - new library providing cross platform methods to
  - create child processes
  - setup stream for child processes
  - sync and async communication streams with children
  - sync and async wait
  - process termination
  + geometry library had some breaking changes,
  - ublas_transformer is renamed to matrix_transformer
  - explicit modifier is added to constructors of rtree
    index::dynamic_* parameters
  - strategy::area::huiller replaced by strategy::area::spherical
  + context library updates
  - deprecated API:execution-context
  - fixed bad assembly for fcontext on ppc64/sysv/elf
  + Updated libraries: any, atomic, config, container, context,
    conversion, core, coroutine2, fiber, hash, interprocess,
    intrusive, lexicalcast, math, multi-index containers,
    multiprecision, predef, program options, regex, smart pointers,
    test ,typeindex, typetraits, unordered, variant
  + for details, see
    http://www.boost.org/users/history/version_1_64_0.html
- Build PyNumpy module
  + add build requires on python-numpy
- test_lowcase.patch: upstreamed
- refreshed patches: boost-strict_aliasing.patch, gcc_path.patch,
  python_mpi.patch
- mpi_upstream.patch: pending upstream fixes to OpenMPI build
- python_library_name.patch: we are building python versions in
  different stagings so drop library renames.
- python_numpy_retfunc.patch: rpmlint fixes</changelog>
  <changelog author="adam.majer@suse.de" date="1494244800">- make python-numpy optional build dependency
- fix building of mpi python3 plugin</changelog>
  <changelog author="adam.majer@suse.de" date="1494331200">- 1d862615.patch: Fix regression caused by refactoring of
  serialization code (bnc#1038083)</changelog>
  <changelog author="adam.majer@suse.de" date="1505908800">- New upstream version 1.65.1
  + config, fiber - Return a continuation from functions executed
    by resume_with.
  + stacktrace - Change preprocessor file extensions to work with
    the installation system.
- Changes in version 1.65.0
  + stacktrace - new library providing call sequence in human
    readable format.
  + polycollection - new library providing fast containers of
    polymorphic objects, from Joaquín M López Muñoz.
  + For full list of changes, see
    http://www.boost.org/users/history/version_1_65_1.html
- 1d862615.patch: upstreamed and removed
- gcc_path.patch: obsolete, tr1 module is removed
- mpi_upstream.patch: upstreamed and removed
- boost-1.57.0-python-abi_letters.patch: refreshed
- python_library_name.patch: refreshed and reverted upstream
  changes to mpi/build/Jamfile as we are building python2 and
  python3 versions of MPI separately.
- baselibs.conf
  + add libboost_stracktrace
  + update to version 1.65.1</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1507550400">- Setup MPI environment prior to building boost.
- Switch to OpenMPI2 as OpenMPI1 is becoming deprecated.</changelog>
  <changelog author="adam.majer@suse.de" date="1507636800">- Use multibuild setup - build no-dependency libraries in the
  base package and build the rest of the compiled libraries in
  the main variant. This should speed up bootstrapping.
- boost-devel not built by default anymore.
- libboost_headers-devel now provides boost-devel for legacy
  dependencies. If you need compiled boost libraries depend on
  the current compiled devel subpackage.
- run %fdupes only on the header files and documentation
- drop build dependencies on gcc-fortran, chrpath.</changelog>
  <changelog author="jmatejek@suse.com" date="1508846400">- build Python 2 conditionally</changelog>
  <changelog author="adam.majer@suse.de" date="1511956800">- re-enable Python 2 by default. It's still conditional, but
  remains enabled by default. This can be disabled in project
  config.</changelog>
  <changelog author="adam.majer@suse.de" date="1513598400">- Update to version 1.66.0
  + Beast: new portable HTTP, WebSocket and network operations
    using Boost.Asio. Header-only library.
  + Callable Traits: new library and successor to
    Boost.FunctionTypes. Header-only library.
  + Mp11: new metaprogramming library
  + Asio:
  * implemented interface changes to reflect the Networking TS
    (N4656)
  * functions and classes that have been superseded by
    Networking TS functionality have been deprecated.
  * added support for customized handler tracking
  * removed previously deprecated functions
  + Atomic: improved compatibility with GCC 7. 128-bit operations
    on x86_64 no longer require linking with compiled library.
  + DateTime: Fixed an integral overflow that could cause incorrect
    results when adding or subtracting many years from a date.
  + Format: New format specifiers added and volatile arguments
    can not be safely used with operator%
  + Fusion:
  * fix compile error with std::array
  * remove circular preprocessor include
  + PolyCollection: backported to GCC 4.8 and 4.9 with some
    limitations
  + Uuid: added RTF-4122 namespaces in boost::uuids::ns
  + for complete changelog, see
    http://www.boost.org/users/history/version_1_66_0.html
- refreshed patches: boost-rpmoptflags-only.patch</changelog>
  <changelog author="adam.majer@suse.de" date="1516363200">- Multibuild requires versioned Name: tag and doesn't seem to do
  this automatically. (bnc#1076640)</changelog>
  <changelog author="kukuk@suse.de" date="1522843200">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="adam.majer@suse.de" date="1584619200">- libreoffice_compat_backports.patch: add a backport of
  Boost.Optional::has_value() for LibreOffice</changelog>
  <changelog author="adam.majer@suse.de" date="1641816000">- variant.patch: backport fix allowing perfect forwarding in
  apply_visitor. Also fix wrong usage of boost::move (bsc#1194522)</changelog>
</package>
<package pkgid="40e16a2833bb8d54d2a6879661a04f2990707e44574a58fb4c847710cf6bb2ae" name="libboost_mpi_python-py2_7-1_66_0" arch="x86_64">
  <version epoch="0" ver="1.66.0" rel="12.3.1"/>
  <changelog author="adam.majer@suse.de" date="1478606400">- Revert upstream change that set default python version and
  ignored user configuration.
  python-2059618.patch (boo#1006584)</changelog>
  <changelog author="adam.majer@suse.de" date="1483531200">- update to version 1.63.0
  * updated libraries: atomic, container, context, fiber,
    fusion, geometry, hash, interprocess, intrusive, lexical cast,
    log, metaparse, move, optional, phoenix, python, test,
    typeindex, units, unordered
  * see http://www.boost.org/users/history/version_1_63_0.html
    for complete list of changes
- refresh patches
  * boost-1.55.0-python-test-PyImport_AppendInittab.patch
  * boost-strict_aliasing.patch, and enable -fno-strict-aliasing
    for python module
- baselibs.conf:
  * add libboost_locale
  * rename python to include new soname
- remove python-2059618.patch, not needed
- make build condition --without buil_mpi work
- allow building without python3 bindings, for SLE11SP4
- remove versioned build dependency on libicu-devel, apparently
  not needed.
- split out the boost-devel package into individudal compiled
  libraries and their -devel subpackages and libboost_headers-devel
  package for header-only libraries.
- remove all the -mt.so symlinks, probably not needed anymore.
- ship MPI python bindings for both Python 2.7 and 3.x
  * add python_mpi.patch to allow proper compiled library loading
- dynamic_linking.patch: first attempt to remove static library
  generation during build process.</changelog>
  <changelog author="adam.majer@suse.de" date="1484481600">- remove non-existent dependency in the boost mpi python package</changelog>
  <changelog author="adam.majer@suse.de" date="1484654400">- test_lowcase.patch: downcase Boost::Test usage of uppercase
  variables. VERSION was clashing with GNU Autotools define
  resulting in compilation errors of various packages.
- recombine headers from various devel subpackages under the
  libboost_headers-devel package. Not all usage of headers that
  have compiled parts pull in their associated compiled symbols.
- general cleanup of the spec file from old, commented stuffs</changelog>
  <changelog author="adam.majer@suse.de" date="1485345600">- Fix dependency typos.</changelog>
  <changelog author="adam.majer@suse.de" date="1486123200">- baselibs.conf: (re)add python 2.7 and 3.x libraries</changelog>
  <changelog author="jmatejek@suse.com" date="1486728000">- update python macros</changelog>
  <changelog author="adam.majer@suse.de" date="1492689600">- New upstream version 1.64.0
  + process - new library providing cross platform methods to
  - create child processes
  - setup stream for child processes
  - sync and async communication streams with children
  - sync and async wait
  - process termination
  + geometry library had some breaking changes,
  - ublas_transformer is renamed to matrix_transformer
  - explicit modifier is added to constructors of rtree
    index::dynamic_* parameters
  - strategy::area::huiller replaced by strategy::area::spherical
  + context library updates
  - deprecated API:execution-context
  - fixed bad assembly for fcontext on ppc64/sysv/elf
  + Updated libraries: any, atomic, config, container, context,
    conversion, core, coroutine2, fiber, hash, interprocess,
    intrusive, lexicalcast, math, multi-index containers,
    multiprecision, predef, program options, regex, smart pointers,
    test ,typeindex, typetraits, unordered, variant
  + for details, see
    http://www.boost.org/users/history/version_1_64_0.html
- Build PyNumpy module
  + add build requires on python-numpy
- test_lowcase.patch: upstreamed
- refreshed patches: boost-strict_aliasing.patch, gcc_path.patch,
  python_mpi.patch
- mpi_upstream.patch: pending upstream fixes to OpenMPI build
- python_library_name.patch: we are building python versions in
  different stagings so drop library renames.
- python_numpy_retfunc.patch: rpmlint fixes</changelog>
  <changelog author="adam.majer@suse.de" date="1494244800">- make python-numpy optional build dependency
- fix building of mpi python3 plugin</changelog>
  <changelog author="adam.majer@suse.de" date="1494331200">- 1d862615.patch: Fix regression caused by refactoring of
  serialization code (bnc#1038083)</changelog>
  <changelog author="adam.majer@suse.de" date="1505908800">- New upstream version 1.65.1
  + config, fiber - Return a continuation from functions executed
    by resume_with.
  + stacktrace - Change preprocessor file extensions to work with
    the installation system.
- Changes in version 1.65.0
  + stacktrace - new library providing call sequence in human
    readable format.
  + polycollection - new library providing fast containers of
    polymorphic objects, from Joaquín M López Muñoz.
  + For full list of changes, see
    http://www.boost.org/users/history/version_1_65_1.html
- 1d862615.patch: upstreamed and removed
- gcc_path.patch: obsolete, tr1 module is removed
- mpi_upstream.patch: upstreamed and removed
- boost-1.57.0-python-abi_letters.patch: refreshed
- python_library_name.patch: refreshed and reverted upstream
  changes to mpi/build/Jamfile as we are building python2 and
  python3 versions of MPI separately.
- baselibs.conf
  + add libboost_stracktrace
  + update to version 1.65.1</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1507550400">- Setup MPI environment prior to building boost.
- Switch to OpenMPI2 as OpenMPI1 is becoming deprecated.</changelog>
  <changelog author="adam.majer@suse.de" date="1507636800">- Use multibuild setup - build no-dependency libraries in the
  base package and build the rest of the compiled libraries in
  the main variant. This should speed up bootstrapping.
- boost-devel not built by default anymore.
- libboost_headers-devel now provides boost-devel for legacy
  dependencies. If you need compiled boost libraries depend on
  the current compiled devel subpackage.
- run %fdupes only on the header files and documentation
- drop build dependencies on gcc-fortran, chrpath.</changelog>
  <changelog author="jmatejek@suse.com" date="1508846400">- build Python 2 conditionally</changelog>
  <changelog author="adam.majer@suse.de" date="1511956800">- re-enable Python 2 by default. It's still conditional, but
  remains enabled by default. This can be disabled in project
  config.</changelog>
  <changelog author="adam.majer@suse.de" date="1513598400">- Update to version 1.66.0
  + Beast: new portable HTTP, WebSocket and network operations
    using Boost.Asio. Header-only library.
  + Callable Traits: new library and successor to
    Boost.FunctionTypes. Header-only library.
  + Mp11: new metaprogramming library
  + Asio:
  * implemented interface changes to reflect the Networking TS
    (N4656)
  * functions and classes that have been superseded by
    Networking TS functionality have been deprecated.
  * added support for customized handler tracking
  * removed previously deprecated functions
  + Atomic: improved compatibility with GCC 7. 128-bit operations
    on x86_64 no longer require linking with compiled library.
  + DateTime: Fixed an integral overflow that could cause incorrect
    results when adding or subtracting many years from a date.
  + Format: New format specifiers added and volatile arguments
    can not be safely used with operator%
  + Fusion:
  * fix compile error with std::array
  * remove circular preprocessor include
  + PolyCollection: backported to GCC 4.8 and 4.9 with some
    limitations
  + Uuid: added RTF-4122 namespaces in boost::uuids::ns
  + for complete changelog, see
    http://www.boost.org/users/history/version_1_66_0.html
- refreshed patches: boost-rpmoptflags-only.patch</changelog>
  <changelog author="adam.majer@suse.de" date="1516363200">- Multibuild requires versioned Name: tag and doesn't seem to do
  this automatically. (bnc#1076640)</changelog>
  <changelog author="kukuk@suse.de" date="1522843200">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="adam.majer@suse.de" date="1584619200">- libreoffice_compat_backports.patch: add a backport of
  Boost.Optional::has_value() for LibreOffice</changelog>
  <changelog author="adam.majer@suse.de" date="1641816000">- variant.patch: backport fix allowing perfect forwarding in
  apply_visitor. Also fix wrong usage of boost::move (bsc#1194522)</changelog>
</package>
<package pkgid="c4a557b9dd5a15de11b9c7befbbee458d9672302ebcbaff911ae3abdbff054c9" name="libboost_mpi_python-py2_7-1_66_0-devel" arch="aarch64">
  <version epoch="0" ver="1.66.0" rel="12.3.1"/>
  <changelog author="adam.majer@suse.de" date="1478606400">- Revert upstream change that set default python version and
  ignored user configuration.
  python-2059618.patch (boo#1006584)</changelog>
  <changelog author="adam.majer@suse.de" date="1483531200">- update to version 1.63.0
  * updated libraries: atomic, container, context, fiber,
    fusion, geometry, hash, interprocess, intrusive, lexical cast,
    log, metaparse, move, optional, phoenix, python, test,
    typeindex, units, unordered
  * see http://www.boost.org/users/history/version_1_63_0.html
    for complete list of changes
- refresh patches
  * boost-1.55.0-python-test-PyImport_AppendInittab.patch
  * boost-strict_aliasing.patch, and enable -fno-strict-aliasing
    for python module
- baselibs.conf:
  * add libboost_locale
  * rename python to include new soname
- remove python-2059618.patch, not needed
- make build condition --without buil_mpi work
- allow building without python3 bindings, for SLE11SP4
- remove versioned build dependency on libicu-devel, apparently
  not needed.
- split out the boost-devel package into individudal compiled
  libraries and their -devel subpackages and libboost_headers-devel
  package for header-only libraries.
- remove all the -mt.so symlinks, probably not needed anymore.
- ship MPI python bindings for both Python 2.7 and 3.x
  * add python_mpi.patch to allow proper compiled library loading
- dynamic_linking.patch: first attempt to remove static library
  generation during build process.</changelog>
  <changelog author="adam.majer@suse.de" date="1484481600">- remove non-existent dependency in the boost mpi python package</changelog>
  <changelog author="adam.majer@suse.de" date="1484654400">- test_lowcase.patch: downcase Boost::Test usage of uppercase
  variables. VERSION was clashing with GNU Autotools define
  resulting in compilation errors of various packages.
- recombine headers from various devel subpackages under the
  libboost_headers-devel package. Not all usage of headers that
  have compiled parts pull in their associated compiled symbols.
- general cleanup of the spec file from old, commented stuffs</changelog>
  <changelog author="adam.majer@suse.de" date="1485345600">- Fix dependency typos.</changelog>
  <changelog author="adam.majer@suse.de" date="1486123200">- baselibs.conf: (re)add python 2.7 and 3.x libraries</changelog>
  <changelog author="jmatejek@suse.com" date="1486728000">- update python macros</changelog>
  <changelog author="adam.majer@suse.de" date="1492689600">- New upstream version 1.64.0
  + process - new library providing cross platform methods to
  - create child processes
  - setup stream for child processes
  - sync and async communication streams with children
  - sync and async wait
  - process termination
  + geometry library had some breaking changes,
  - ublas_transformer is renamed to matrix_transformer
  - explicit modifier is added to constructors of rtree
    index::dynamic_* parameters
  - strategy::area::huiller replaced by strategy::area::spherical
  + context library updates
  - deprecated API:execution-context
  - fixed bad assembly for fcontext on ppc64/sysv/elf
  + Updated libraries: any, atomic, config, container, context,
    conversion, core, coroutine2, fiber, hash, interprocess,
    intrusive, lexicalcast, math, multi-index containers,
    multiprecision, predef, program options, regex, smart pointers,
    test ,typeindex, typetraits, unordered, variant
  + for details, see
    http://www.boost.org/users/history/version_1_64_0.html
- Build PyNumpy module
  + add build requires on python-numpy
- test_lowcase.patch: upstreamed
- refreshed patches: boost-strict_aliasing.patch, gcc_path.patch,
  python_mpi.patch
- mpi_upstream.patch: pending upstream fixes to OpenMPI build
- python_library_name.patch: we are building python versions in
  different stagings so drop library renames.
- python_numpy_retfunc.patch: rpmlint fixes</changelog>
  <changelog author="adam.majer@suse.de" date="1494244800">- make python-numpy optional build dependency
- fix building of mpi python3 plugin</changelog>
  <changelog author="adam.majer@suse.de" date="1494331200">- 1d862615.patch: Fix regression caused by refactoring of
  serialization code (bnc#1038083)</changelog>
  <changelog author="adam.majer@suse.de" date="1505908800">- New upstream version 1.65.1
  + config, fiber - Return a continuation from functions executed
    by resume_with.
  + stacktrace - Change preprocessor file extensions to work with
    the installation system.
- Changes in version 1.65.0
  + stacktrace - new library providing call sequence in human
    readable format.
  + polycollection - new library providing fast containers of
    polymorphic objects, from Joaquín M López Muñoz.
  + For full list of changes, see
    http://www.boost.org/users/history/version_1_65_1.html
- 1d862615.patch: upstreamed and removed
- gcc_path.patch: obsolete, tr1 module is removed
- mpi_upstream.patch: upstreamed and removed
- boost-1.57.0-python-abi_letters.patch: refreshed
- python_library_name.patch: refreshed and reverted upstream
  changes to mpi/build/Jamfile as we are building python2 and
  python3 versions of MPI separately.
- baselibs.conf
  + add libboost_stracktrace
  + update to version 1.65.1</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1507550400">- Setup MPI environment prior to building boost.
- Switch to OpenMPI2 as OpenMPI1 is becoming deprecated.</changelog>
  <changelog author="adam.majer@suse.de" date="1507636800">- Use multibuild setup - build no-dependency libraries in the
  base package and build the rest of the compiled libraries in
  the main variant. This should speed up bootstrapping.
- boost-devel not built by default anymore.
- libboost_headers-devel now provides boost-devel for legacy
  dependencies. If you need compiled boost libraries depend on
  the current compiled devel subpackage.
- run %fdupes only on the header files and documentation
- drop build dependencies on gcc-fortran, chrpath.</changelog>
  <changelog author="jmatejek@suse.com" date="1508846400">- build Python 2 conditionally</changelog>
  <changelog author="adam.majer@suse.de" date="1511956800">- re-enable Python 2 by default. It's still conditional, but
  remains enabled by default. This can be disabled in project
  config.</changelog>
  <changelog author="adam.majer@suse.de" date="1513598400">- Update to version 1.66.0
  + Beast: new portable HTTP, WebSocket and network operations
    using Boost.Asio. Header-only library.
  + Callable Traits: new library and successor to
    Boost.FunctionTypes. Header-only library.
  + Mp11: new metaprogramming library
  + Asio:
  * implemented interface changes to reflect the Networking TS
    (N4656)
  * functions and classes that have been superseded by
    Networking TS functionality have been deprecated.
  * added support for customized handler tracking
  * removed previously deprecated functions
  + Atomic: improved compatibility with GCC 7. 128-bit operations
    on x86_64 no longer require linking with compiled library.
  + DateTime: Fixed an integral overflow that could cause incorrect
    results when adding or subtracting many years from a date.
  + Format: New format specifiers added and volatile arguments
    can not be safely used with operator%
  + Fusion:
  * fix compile error with std::array
  * remove circular preprocessor include
  + PolyCollection: backported to GCC 4.8 and 4.9 with some
    limitations
  + Uuid: added RTF-4122 namespaces in boost::uuids::ns
  + for complete changelog, see
    http://www.boost.org/users/history/version_1_66_0.html
- refreshed patches: boost-rpmoptflags-only.patch</changelog>
  <changelog author="adam.majer@suse.de" date="1516363200">- Multibuild requires versioned Name: tag and doesn't seem to do
  this automatically. (bnc#1076640)</changelog>
  <changelog author="kukuk@suse.de" date="1522843200">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="adam.majer@suse.de" date="1584619200">- libreoffice_compat_backports.patch: add a backport of
  Boost.Optional::has_value() for LibreOffice</changelog>
  <changelog author="adam.majer@suse.de" date="1641816000">- variant.patch: backport fix allowing perfect forwarding in
  apply_visitor. Also fix wrong usage of boost::move (bsc#1194522)</changelog>
</package>
<package pkgid="9e38d9da4c1f0305161a48d466a12677e64311f57b58cd63ed050430140d735e" name="libboost_mpi_python-py2_7-1_66_0-devel" arch="ppc64le">
  <version epoch="0" ver="1.66.0" rel="12.3.1"/>
  <changelog author="adam.majer@suse.de" date="1478606400">- Revert upstream change that set default python version and
  ignored user configuration.
  python-2059618.patch (boo#1006584)</changelog>
  <changelog author="adam.majer@suse.de" date="1483531200">- update to version 1.63.0
  * updated libraries: atomic, container, context, fiber,
    fusion, geometry, hash, interprocess, intrusive, lexical cast,
    log, metaparse, move, optional, phoenix, python, test,
    typeindex, units, unordered
  * see http://www.boost.org/users/history/version_1_63_0.html
    for complete list of changes
- refresh patches
  * boost-1.55.0-python-test-PyImport_AppendInittab.patch
  * boost-strict_aliasing.patch, and enable -fno-strict-aliasing
    for python module
- baselibs.conf:
  * add libboost_locale
  * rename python to include new soname
- remove python-2059618.patch, not needed
- make build condition --without buil_mpi work
- allow building without python3 bindings, for SLE11SP4
- remove versioned build dependency on libicu-devel, apparently
  not needed.
- split out the boost-devel package into individudal compiled
  libraries and their -devel subpackages and libboost_headers-devel
  package for header-only libraries.
- remove all the -mt.so symlinks, probably not needed anymore.
- ship MPI python bindings for both Python 2.7 and 3.x
  * add python_mpi.patch to allow proper compiled library loading
- dynamic_linking.patch: first attempt to remove static library
  generation during build process.</changelog>
  <changelog author="adam.majer@suse.de" date="1484481600">- remove non-existent dependency in the boost mpi python package</changelog>
  <changelog author="adam.majer@suse.de" date="1484654400">- test_lowcase.patch: downcase Boost::Test usage of uppercase
  variables. VERSION was clashing with GNU Autotools define
  resulting in compilation errors of various packages.
- recombine headers from various devel subpackages under the
  libboost_headers-devel package. Not all usage of headers that
  have compiled parts pull in their associated compiled symbols.
- general cleanup of the spec file from old, commented stuffs</changelog>
  <changelog author="adam.majer@suse.de" date="1485345600">- Fix dependency typos.</changelog>
  <changelog author="adam.majer@suse.de" date="1486123200">- baselibs.conf: (re)add python 2.7 and 3.x libraries</changelog>
  <changelog author="jmatejek@suse.com" date="1486728000">- update python macros</changelog>
  <changelog author="adam.majer@suse.de" date="1492689600">- New upstream version 1.64.0
  + process - new library providing cross platform methods to
  - create child processes
  - setup stream for child processes
  - sync and async communication streams with children
  - sync and async wait
  - process termination
  + geometry library had some breaking changes,
  - ublas_transformer is renamed to matrix_transformer
  - explicit modifier is added to constructors of rtree
    index::dynamic_* parameters
  - strategy::area::huiller replaced by strategy::area::spherical
  + context library updates
  - deprecated API:execution-context
  - fixed bad assembly for fcontext on ppc64/sysv/elf
  + Updated libraries: any, atomic, config, container, context,
    conversion, core, coroutine2, fiber, hash, interprocess,
    intrusive, lexicalcast, math, multi-index containers,
    multiprecision, predef, program options, regex, smart pointers,
    test ,typeindex, typetraits, unordered, variant
  + for details, see
    http://www.boost.org/users/history/version_1_64_0.html
- Build PyNumpy module
  + add build requires on python-numpy
- test_lowcase.patch: upstreamed
- refreshed patches: boost-strict_aliasing.patch, gcc_path.patch,
  python_mpi.patch
- mpi_upstream.patch: pending upstream fixes to OpenMPI build
- python_library_name.patch: we are building python versions in
  different stagings so drop library renames.
- python_numpy_retfunc.patch: rpmlint fixes</changelog>
  <changelog author="adam.majer@suse.de" date="1494244800">- make python-numpy optional build dependency
- fix building of mpi python3 plugin</changelog>
  <changelog author="adam.majer@suse.de" date="1494331200">- 1d862615.patch: Fix regression caused by refactoring of
  serialization code (bnc#1038083)</changelog>
  <changelog author="adam.majer@suse.de" date="1505908800">- New upstream version 1.65.1
  + config, fiber - Return a continuation from functions executed
    by resume_with.
  + stacktrace - Change preprocessor file extensions to work with
    the installation system.
- Changes in version 1.65.0
  + stacktrace - new library providing call sequence in human
    readable format.
  + polycollection - new library providing fast containers of
    polymorphic objects, from Joaquín M López Muñoz.
  + For full list of changes, see
    http://www.boost.org/users/history/version_1_65_1.html
- 1d862615.patch: upstreamed and removed
- gcc_path.patch: obsolete, tr1 module is removed
- mpi_upstream.patch: upstreamed and removed
- boost-1.57.0-python-abi_letters.patch: refreshed
- python_library_name.patch: refreshed and reverted upstream
  changes to mpi/build/Jamfile as we are building python2 and
  python3 versions of MPI separately.
- baselibs.conf
  + add libboost_stracktrace
  + update to version 1.65.1</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1507550400">- Setup MPI environment prior to building boost.
- Switch to OpenMPI2 as OpenMPI1 is becoming deprecated.</changelog>
  <changelog author="adam.majer@suse.de" date="1507636800">- Use multibuild setup - build no-dependency libraries in the
  base package and build the rest of the compiled libraries in
  the main variant. This should speed up bootstrapping.
- boost-devel not built by default anymore.
- libboost_headers-devel now provides boost-devel for legacy
  dependencies. If you need compiled boost libraries depend on
  the current compiled devel subpackage.
- run %fdupes only on the header files and documentation
- drop build dependencies on gcc-fortran, chrpath.</changelog>
  <changelog author="jmatejek@suse.com" date="1508846400">- build Python 2 conditionally</changelog>
  <changelog author="adam.majer@suse.de" date="1511956800">- re-enable Python 2 by default. It's still conditional, but
  remains enabled by default. This can be disabled in project
  config.</changelog>
  <changelog author="adam.majer@suse.de" date="1513598400">- Update to version 1.66.0
  + Beast: new portable HTTP, WebSocket and network operations
    using Boost.Asio. Header-only library.
  + Callable Traits: new library and successor to
    Boost.FunctionTypes. Header-only library.
  + Mp11: new metaprogramming library
  + Asio:
  * implemented interface changes to reflect the Networking TS
    (N4656)
  * functions and classes that have been superseded by
    Networking TS functionality have been deprecated.
  * added support for customized handler tracking
  * removed previously deprecated functions
  + Atomic: improved compatibility with GCC 7. 128-bit operations
    on x86_64 no longer require linking with compiled library.
  + DateTime: Fixed an integral overflow that could cause incorrect
    results when adding or subtracting many years from a date.
  + Format: New format specifiers added and volatile arguments
    can not be safely used with operator%
  + Fusion:
  * fix compile error with std::array
  * remove circular preprocessor include
  + PolyCollection: backported to GCC 4.8 and 4.9 with some
    limitations
  + Uuid: added RTF-4122 namespaces in boost::uuids::ns
  + for complete changelog, see
    http://www.boost.org/users/history/version_1_66_0.html
- refreshed patches: boost-rpmoptflags-only.patch</changelog>
  <changelog author="adam.majer@suse.de" date="1516363200">- Multibuild requires versioned Name: tag and doesn't seem to do
  this automatically. (bnc#1076640)</changelog>
  <changelog author="kukuk@suse.de" date="1522843200">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="adam.majer@suse.de" date="1584619200">- libreoffice_compat_backports.patch: add a backport of
  Boost.Optional::has_value() for LibreOffice</changelog>
  <changelog author="adam.majer@suse.de" date="1641816000">- variant.patch: backport fix allowing perfect forwarding in
  apply_visitor. Also fix wrong usage of boost::move (bsc#1194522)</changelog>
</package>
<package pkgid="56977ced4d280ccb352ecabb1c4be91fda5d53c7e454478c89c1f4f1576021cb" name="libboost_mpi_python-py2_7-1_66_0-devel" arch="s390x">
  <version epoch="0" ver="1.66.0" rel="12.3.1"/>
  <changelog author="adam.majer@suse.de" date="1478606400">- Revert upstream change that set default python version and
  ignored user configuration.
  python-2059618.patch (boo#1006584)</changelog>
  <changelog author="adam.majer@suse.de" date="1483531200">- update to version 1.63.0
  * updated libraries: atomic, container, context, fiber,
    fusion, geometry, hash, interprocess, intrusive, lexical cast,
    log, metaparse, move, optional, phoenix, python, test,
    typeindex, units, unordered
  * see http://www.boost.org/users/history/version_1_63_0.html
    for complete list of changes
- refresh patches
  * boost-1.55.0-python-test-PyImport_AppendInittab.patch
  * boost-strict_aliasing.patch, and enable -fno-strict-aliasing
    for python module
- baselibs.conf:
  * add libboost_locale
  * rename python to include new soname
- remove python-2059618.patch, not needed
- make build condition --without buil_mpi work
- allow building without python3 bindings, for SLE11SP4
- remove versioned build dependency on libicu-devel, apparently
  not needed.
- split out the boost-devel package into individudal compiled
  libraries and their -devel subpackages and libboost_headers-devel
  package for header-only libraries.
- remove all the -mt.so symlinks, probably not needed anymore.
- ship MPI python bindings for both Python 2.7 and 3.x
  * add python_mpi.patch to allow proper compiled library loading
- dynamic_linking.patch: first attempt to remove static library
  generation during build process.</changelog>
  <changelog author="adam.majer@suse.de" date="1484481600">- remove non-existent dependency in the boost mpi python package</changelog>
  <changelog author="adam.majer@suse.de" date="1484654400">- test_lowcase.patch: downcase Boost::Test usage of uppercase
  variables. VERSION was clashing with GNU Autotools define
  resulting in compilation errors of various packages.
- recombine headers from various devel subpackages under the
  libboost_headers-devel package. Not all usage of headers that
  have compiled parts pull in their associated compiled symbols.
- general cleanup of the spec file from old, commented stuffs</changelog>
  <changelog author="adam.majer@suse.de" date="1485345600">- Fix dependency typos.</changelog>
  <changelog author="adam.majer@suse.de" date="1486123200">- baselibs.conf: (re)add python 2.7 and 3.x libraries</changelog>
  <changelog author="jmatejek@suse.com" date="1486728000">- update python macros</changelog>
  <changelog author="adam.majer@suse.de" date="1492689600">- New upstream version 1.64.0
  + process - new library providing cross platform methods to
  - create child processes
  - setup stream for child processes
  - sync and async communication streams with children
  - sync and async wait
  - process termination
  + geometry library had some breaking changes,
  - ublas_transformer is renamed to matrix_transformer
  - explicit modifier is added to constructors of rtree
    index::dynamic_* parameters
  - strategy::area::huiller replaced by strategy::area::spherical
  + context library updates
  - deprecated API:execution-context
  - fixed bad assembly for fcontext on ppc64/sysv/elf
  + Updated libraries: any, atomic, config, container, context,
    conversion, core, coroutine2, fiber, hash, interprocess,
    intrusive, lexicalcast, math, multi-index containers,
    multiprecision, predef, program options, regex, smart pointers,
    test ,typeindex, typetraits, unordered, variant
  + for details, see
    http://www.boost.org/users/history/version_1_64_0.html
- Build PyNumpy module
  + add build requires on python-numpy
- test_lowcase.patch: upstreamed
- refreshed patches: boost-strict_aliasing.patch, gcc_path.patch,
  python_mpi.patch
- mpi_upstream.patch: pending upstream fixes to OpenMPI build
- python_library_name.patch: we are building python versions in
  different stagings so drop library renames.
- python_numpy_retfunc.patch: rpmlint fixes</changelog>
  <changelog author="adam.majer@suse.de" date="1494244800">- make python-numpy optional build dependency
- fix building of mpi python3 plugin</changelog>
  <changelog author="adam.majer@suse.de" date="1494331200">- 1d862615.patch: Fix regression caused by refactoring of
  serialization code (bnc#1038083)</changelog>
  <changelog author="adam.majer@suse.de" date="1505908800">- New upstream version 1.65.1
  + config, fiber - Return a continuation from functions executed
    by resume_with.
  + stacktrace - Change preprocessor file extensions to work with
    the installation system.
- Changes in version 1.65.0
  + stacktrace - new library providing call sequence in human
    readable format.
  + polycollection - new library providing fast containers of
    polymorphic objects, from Joaquín M López Muñoz.
  + For full list of changes, see
    http://www.boost.org/users/history/version_1_65_1.html
- 1d862615.patch: upstreamed and removed
- gcc_path.patch: obsolete, tr1 module is removed
- mpi_upstream.patch: upstreamed and removed
- boost-1.57.0-python-abi_letters.patch: refreshed
- python_library_name.patch: refreshed and reverted upstream
  changes to mpi/build/Jamfile as we are building python2 and
  python3 versions of MPI separately.
- baselibs.conf
  + add libboost_stracktrace
  + update to version 1.65.1</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1507550400">- Setup MPI environment prior to building boost.
- Switch to OpenMPI2 as OpenMPI1 is becoming deprecated.</changelog>
  <changelog author="adam.majer@suse.de" date="1507636800">- Use multibuild setup - build no-dependency libraries in the
  base package and build the rest of the compiled libraries in
  the main variant. This should speed up bootstrapping.
- boost-devel not built by default anymore.
- libboost_headers-devel now provides boost-devel for legacy
  dependencies. If you need compiled boost libraries depend on
  the current compiled devel subpackage.
- run %fdupes only on the header files and documentation
- drop build dependencies on gcc-fortran, chrpath.</changelog>
  <changelog author="jmatejek@suse.com" date="1508846400">- build Python 2 conditionally</changelog>
  <changelog author="adam.majer@suse.de" date="1511956800">- re-enable Python 2 by default. It's still conditional, but
  remains enabled by default. This can be disabled in project
  config.</changelog>
  <changelog author="adam.majer@suse.de" date="1513598400">- Update to version 1.66.0
  + Beast: new portable HTTP, WebSocket and network operations
    using Boost.Asio. Header-only library.
  + Callable Traits: new library and successor to
    Boost.FunctionTypes. Header-only library.
  + Mp11: new metaprogramming library
  + Asio:
  * implemented interface changes to reflect the Networking TS
    (N4656)
  * functions and classes that have been superseded by
    Networking TS functionality have been deprecated.
  * added support for customized handler tracking
  * removed previously deprecated functions
  + Atomic: improved compatibility with GCC 7. 128-bit operations
    on x86_64 no longer require linking with compiled library.
  + DateTime: Fixed an integral overflow that could cause incorrect
    results when adding or subtracting many years from a date.
  + Format: New format specifiers added and volatile arguments
    can not be safely used with operator%
  + Fusion:
  * fix compile error with std::array
  * remove circular preprocessor include
  + PolyCollection: backported to GCC 4.8 and 4.9 with some
    limitations
  + Uuid: added RTF-4122 namespaces in boost::uuids::ns
  + for complete changelog, see
    http://www.boost.org/users/history/version_1_66_0.html
- refreshed patches: boost-rpmoptflags-only.patch</changelog>
  <changelog author="adam.majer@suse.de" date="1516363200">- Multibuild requires versioned Name: tag and doesn't seem to do
  this automatically. (bnc#1076640)</changelog>
  <changelog author="kukuk@suse.de" date="1522843200">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="adam.majer@suse.de" date="1584619200">- libreoffice_compat_backports.patch: add a backport of
  Boost.Optional::has_value() for LibreOffice</changelog>
  <changelog author="adam.majer@suse.de" date="1641816000">- variant.patch: backport fix allowing perfect forwarding in
  apply_visitor. Also fix wrong usage of boost::move (bsc#1194522)</changelog>
</package>
<package pkgid="feafa48ada4da2c5a623e1be5a4fbd19a156304246e2791c02b6d929d04dfffd" name="libboost_mpi_python-py2_7-1_66_0-devel" arch="x86_64">
  <version epoch="0" ver="1.66.0" rel="12.3.1"/>
  <changelog author="adam.majer@suse.de" date="1478606400">- Revert upstream change that set default python version and
  ignored user configuration.
  python-2059618.patch (boo#1006584)</changelog>
  <changelog author="adam.majer@suse.de" date="1483531200">- update to version 1.63.0
  * updated libraries: atomic, container, context, fiber,
    fusion, geometry, hash, interprocess, intrusive, lexical cast,
    log, metaparse, move, optional, phoenix, python, test,
    typeindex, units, unordered
  * see http://www.boost.org/users/history/version_1_63_0.html
    for complete list of changes
- refresh patches
  * boost-1.55.0-python-test-PyImport_AppendInittab.patch
  * boost-strict_aliasing.patch, and enable -fno-strict-aliasing
    for python module
- baselibs.conf:
  * add libboost_locale
  * rename python to include new soname
- remove python-2059618.patch, not needed
- make build condition --without buil_mpi work
- allow building without python3 bindings, for SLE11SP4
- remove versioned build dependency on libicu-devel, apparently
  not needed.
- split out the boost-devel package into individudal compiled
  libraries and their -devel subpackages and libboost_headers-devel
  package for header-only libraries.
- remove all the -mt.so symlinks, probably not needed anymore.
- ship MPI python bindings for both Python 2.7 and 3.x
  * add python_mpi.patch to allow proper compiled library loading
- dynamic_linking.patch: first attempt to remove static library
  generation during build process.</changelog>
  <changelog author="adam.majer@suse.de" date="1484481600">- remove non-existent dependency in the boost mpi python package</changelog>
  <changelog author="adam.majer@suse.de" date="1484654400">- test_lowcase.patch: downcase Boost::Test usage of uppercase
  variables. VERSION was clashing with GNU Autotools define
  resulting in compilation errors of various packages.
- recombine headers from various devel subpackages under the
  libboost_headers-devel package. Not all usage of headers that
  have compiled parts pull in their associated compiled symbols.
- general cleanup of the spec file from old, commented stuffs</changelog>
  <changelog author="adam.majer@suse.de" date="1485345600">- Fix dependency typos.</changelog>
  <changelog author="adam.majer@suse.de" date="1486123200">- baselibs.conf: (re)add python 2.7 and 3.x libraries</changelog>
  <changelog author="jmatejek@suse.com" date="1486728000">- update python macros</changelog>
  <changelog author="adam.majer@suse.de" date="1492689600">- New upstream version 1.64.0
  + process - new library providing cross platform methods to
  - create child processes
  - setup stream for child processes
  - sync and async communication streams with children
  - sync and async wait
  - process termination
  + geometry library had some breaking changes,
  - ublas_transformer is renamed to matrix_transformer
  - explicit modifier is added to constructors of rtree
    index::dynamic_* parameters
  - strategy::area::huiller replaced by strategy::area::spherical
  + context library updates
  - deprecated API:execution-context
  - fixed bad assembly for fcontext on ppc64/sysv/elf
  + Updated libraries: any, atomic, config, container, context,
    conversion, core, coroutine2, fiber, hash, interprocess,
    intrusive, lexicalcast, math, multi-index containers,
    multiprecision, predef, program options, regex, smart pointers,
    test ,typeindex, typetraits, unordered, variant
  + for details, see
    http://www.boost.org/users/history/version_1_64_0.html
- Build PyNumpy module
  + add build requires on python-numpy
- test_lowcase.patch: upstreamed
- refreshed patches: boost-strict_aliasing.patch, gcc_path.patch,
  python_mpi.patch
- mpi_upstream.patch: pending upstream fixes to OpenMPI build
- python_library_name.patch: we are building python versions in
  different stagings so drop library renames.
- python_numpy_retfunc.patch: rpmlint fixes</changelog>
  <changelog author="adam.majer@suse.de" date="1494244800">- make python-numpy optional build dependency
- fix building of mpi python3 plugin</changelog>
  <changelog author="adam.majer@suse.de" date="1494331200">- 1d862615.patch: Fix regression caused by refactoring of
  serialization code (bnc#1038083)</changelog>
  <changelog author="adam.majer@suse.de" date="1505908800">- New upstream version 1.65.1
  + config, fiber - Return a continuation from functions executed
    by resume_with.
  + stacktrace - Change preprocessor file extensions to work with
    the installation system.
- Changes in version 1.65.0
  + stacktrace - new library providing call sequence in human
    readable format.
  + polycollection - new library providing fast containers of
    polymorphic objects, from Joaquín M López Muñoz.
  + For full list of changes, see
    http://www.boost.org/users/history/version_1_65_1.html
- 1d862615.patch: upstreamed and removed
- gcc_path.patch: obsolete, tr1 module is removed
- mpi_upstream.patch: upstreamed and removed
- boost-1.57.0-python-abi_letters.patch: refreshed
- python_library_name.patch: refreshed and reverted upstream
  changes to mpi/build/Jamfile as we are building python2 and
  python3 versions of MPI separately.
- baselibs.conf
  + add libboost_stracktrace
  + update to version 1.65.1</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1507550400">- Setup MPI environment prior to building boost.
- Switch to OpenMPI2 as OpenMPI1 is becoming deprecated.</changelog>
  <changelog author="adam.majer@suse.de" date="1507636800">- Use multibuild setup - build no-dependency libraries in the
  base package and build the rest of the compiled libraries in
  the main variant. This should speed up bootstrapping.
- boost-devel not built by default anymore.
- libboost_headers-devel now provides boost-devel for legacy
  dependencies. If you need compiled boost libraries depend on
  the current compiled devel subpackage.
- run %fdupes only on the header files and documentation
- drop build dependencies on gcc-fortran, chrpath.</changelog>
  <changelog author="jmatejek@suse.com" date="1508846400">- build Python 2 conditionally</changelog>
  <changelog author="adam.majer@suse.de" date="1511956800">- re-enable Python 2 by default. It's still conditional, but
  remains enabled by default. This can be disabled in project
  config.</changelog>
  <changelog author="adam.majer@suse.de" date="1513598400">- Update to version 1.66.0
  + Beast: new portable HTTP, WebSocket and network operations
    using Boost.Asio. Header-only library.
  + Callable Traits: new library and successor to
    Boost.FunctionTypes. Header-only library.
  + Mp11: new metaprogramming library
  + Asio:
  * implemented interface changes to reflect the Networking TS
    (N4656)
  * functions and classes that have been superseded by
    Networking TS functionality have been deprecated.
  * added support for customized handler tracking
  * removed previously deprecated functions
  + Atomic: improved compatibility with GCC 7. 128-bit operations
    on x86_64 no longer require linking with compiled library.
  + DateTime: Fixed an integral overflow that could cause incorrect
    results when adding or subtracting many years from a date.
  + Format: New format specifiers added and volatile arguments
    can not be safely used with operator%
  + Fusion:
  * fix compile error with std::array
  * remove circular preprocessor include
  + PolyCollection: backported to GCC 4.8 and 4.9 with some
    limitations
  + Uuid: added RTF-4122 namespaces in boost::uuids::ns
  + for complete changelog, see
    http://www.boost.org/users/history/version_1_66_0.html
- refreshed patches: boost-rpmoptflags-only.patch</changelog>
  <changelog author="adam.majer@suse.de" date="1516363200">- Multibuild requires versioned Name: tag and doesn't seem to do
  this automatically. (bnc#1076640)</changelog>
  <changelog author="kukuk@suse.de" date="1522843200">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="adam.majer@suse.de" date="1584619200">- libreoffice_compat_backports.patch: add a backport of
  Boost.Optional::has_value() for LibreOffice</changelog>
  <changelog author="adam.majer@suse.de" date="1641816000">- variant.patch: backport fix allowing perfect forwarding in
  apply_visitor. Also fix wrong usage of boost::move (bsc#1194522)</changelog>
</package>
<package pkgid="60a34298311f033f4d831480b6eb2e53ee41a5f30e7d299d91c211b9ad3985da" name="libboost_numpy-py2_7-1_66_0" arch="aarch64">
  <version epoch="0" ver="1.66.0" rel="12.3.1"/>
  <changelog author="adam.majer@suse.de" date="1478606400">- Revert upstream change that set default python version and
  ignored user configuration.
  python-2059618.patch (boo#1006584)</changelog>
  <changelog author="adam.majer@suse.de" date="1483531200">- update to version 1.63.0
  * updated libraries: atomic, container, context, fiber,
    fusion, geometry, hash, interprocess, intrusive, lexical cast,
    log, metaparse, move, optional, phoenix, python, test,
    typeindex, units, unordered
  * see http://www.boost.org/users/history/version_1_63_0.html
    for complete list of changes
- refresh patches
  * boost-1.55.0-python-test-PyImport_AppendInittab.patch
  * boost-strict_aliasing.patch, and enable -fno-strict-aliasing
    for python module
- baselibs.conf:
  * add libboost_locale
  * rename python to include new soname
- remove python-2059618.patch, not needed
- make build condition --without buil_mpi work
- allow building without python3 bindings, for SLE11SP4
- remove versioned build dependency on libicu-devel, apparently
  not needed.
- split out the boost-devel package into individudal compiled
  libraries and their -devel subpackages and libboost_headers-devel
  package for header-only libraries.
- remove all the -mt.so symlinks, probably not needed anymore.
- ship MPI python bindings for both Python 2.7 and 3.x
  * add python_mpi.patch to allow proper compiled library loading
- dynamic_linking.patch: first attempt to remove static library
  generation during build process.</changelog>
  <changelog author="adam.majer@suse.de" date="1484481600">- remove non-existent dependency in the boost mpi python package</changelog>
  <changelog author="adam.majer@suse.de" date="1484654400">- test_lowcase.patch: downcase Boost::Test usage of uppercase
  variables. VERSION was clashing with GNU Autotools define
  resulting in compilation errors of various packages.
- recombine headers from various devel subpackages under the
  libboost_headers-devel package. Not all usage of headers that
  have compiled parts pull in their associated compiled symbols.
- general cleanup of the spec file from old, commented stuffs</changelog>
  <changelog author="adam.majer@suse.de" date="1485345600">- Fix dependency typos.</changelog>
  <changelog author="adam.majer@suse.de" date="1486123200">- baselibs.conf: (re)add python 2.7 and 3.x libraries</changelog>
  <changelog author="jmatejek@suse.com" date="1486728000">- update python macros</changelog>
  <changelog author="adam.majer@suse.de" date="1492689600">- New upstream version 1.64.0
  + process - new library providing cross platform methods to
  - create child processes
  - setup stream for child processes
  - sync and async communication streams with children
  - sync and async wait
  - process termination
  + geometry library had some breaking changes,
  - ublas_transformer is renamed to matrix_transformer
  - explicit modifier is added to constructors of rtree
    index::dynamic_* parameters
  - strategy::area::huiller replaced by strategy::area::spherical
  + context library updates
  - deprecated API:execution-context
  - fixed bad assembly for fcontext on ppc64/sysv/elf
  + Updated libraries: any, atomic, config, container, context,
    conversion, core, coroutine2, fiber, hash, interprocess,
    intrusive, lexicalcast, math, multi-index containers,
    multiprecision, predef, program options, regex, smart pointers,
    test ,typeindex, typetraits, unordered, variant
  + for details, see
    http://www.boost.org/users/history/version_1_64_0.html
- Build PyNumpy module
  + add build requires on python-numpy
- test_lowcase.patch: upstreamed
- refreshed patches: boost-strict_aliasing.patch, gcc_path.patch,
  python_mpi.patch
- mpi_upstream.patch: pending upstream fixes to OpenMPI build
- python_library_name.patch: we are building python versions in
  different stagings so drop library renames.
- python_numpy_retfunc.patch: rpmlint fixes</changelog>
  <changelog author="adam.majer@suse.de" date="1494244800">- make python-numpy optional build dependency
- fix building of mpi python3 plugin</changelog>
  <changelog author="adam.majer@suse.de" date="1494331200">- 1d862615.patch: Fix regression caused by refactoring of
  serialization code (bnc#1038083)</changelog>
  <changelog author="adam.majer@suse.de" date="1505908800">- New upstream version 1.65.1
  + config, fiber - Return a continuation from functions executed
    by resume_with.
  + stacktrace - Change preprocessor file extensions to work with
    the installation system.
- Changes in version 1.65.0
  + stacktrace - new library providing call sequence in human
    readable format.
  + polycollection - new library providing fast containers of
    polymorphic objects, from Joaquín M López Muñoz.
  + For full list of changes, see
    http://www.boost.org/users/history/version_1_65_1.html
- 1d862615.patch: upstreamed and removed
- gcc_path.patch: obsolete, tr1 module is removed
- mpi_upstream.patch: upstreamed and removed
- boost-1.57.0-python-abi_letters.patch: refreshed
- python_library_name.patch: refreshed and reverted upstream
  changes to mpi/build/Jamfile as we are building python2 and
  python3 versions of MPI separately.
- baselibs.conf
  + add libboost_stracktrace
  + update to version 1.65.1</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1507550400">- Setup MPI environment prior to building boost.
- Switch to OpenMPI2 as OpenMPI1 is becoming deprecated.</changelog>
  <changelog author="adam.majer@suse.de" date="1507636800">- Use multibuild setup - build no-dependency libraries in the
  base package and build the rest of the compiled libraries in
  the main variant. This should speed up bootstrapping.
- boost-devel not built by default anymore.
- libboost_headers-devel now provides boost-devel for legacy
  dependencies. If you need compiled boost libraries depend on
  the current compiled devel subpackage.
- run %fdupes only on the header files and documentation
- drop build dependencies on gcc-fortran, chrpath.</changelog>
  <changelog author="jmatejek@suse.com" date="1508846400">- build Python 2 conditionally</changelog>
  <changelog author="adam.majer@suse.de" date="1511956800">- re-enable Python 2 by default. It's still conditional, but
  remains enabled by default. This can be disabled in project
  config.</changelog>
  <changelog author="adam.majer@suse.de" date="1513598400">- Update to version 1.66.0
  + Beast: new portable HTTP, WebSocket and network operations
    using Boost.Asio. Header-only library.
  + Callable Traits: new library and successor to
    Boost.FunctionTypes. Header-only library.
  + Mp11: new metaprogramming library
  + Asio:
  * implemented interface changes to reflect the Networking TS
    (N4656)
  * functions and classes that have been superseded by
    Networking TS functionality have been deprecated.
  * added support for customized handler tracking
  * removed previously deprecated functions
  + Atomic: improved compatibility with GCC 7. 128-bit operations
    on x86_64 no longer require linking with compiled library.
  + DateTime: Fixed an integral overflow that could cause incorrect
    results when adding or subtracting many years from a date.
  + Format: New format specifiers added and volatile arguments
    can not be safely used with operator%
  + Fusion:
  * fix compile error with std::array
  * remove circular preprocessor include
  + PolyCollection: backported to GCC 4.8 and 4.9 with some
    limitations
  + Uuid: added RTF-4122 namespaces in boost::uuids::ns
  + for complete changelog, see
    http://www.boost.org/users/history/version_1_66_0.html
- refreshed patches: boost-rpmoptflags-only.patch</changelog>
  <changelog author="adam.majer@suse.de" date="1516363200">- Multibuild requires versioned Name: tag and doesn't seem to do
  this automatically. (bnc#1076640)</changelog>
  <changelog author="kukuk@suse.de" date="1522843200">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="adam.majer@suse.de" date="1584619200">- libreoffice_compat_backports.patch: add a backport of
  Boost.Optional::has_value() for LibreOffice</changelog>
  <changelog author="adam.majer@suse.de" date="1641816000">- variant.patch: backport fix allowing perfect forwarding in
  apply_visitor. Also fix wrong usage of boost::move (bsc#1194522)</changelog>
</package>
<package pkgid="5b8d6d78452c534db8b242de26d44b27aec2a7ccfdf50302719a74c9adc9c394" name="libboost_numpy-py2_7-1_66_0" arch="ppc64le">
  <version epoch="0" ver="1.66.0" rel="12.3.1"/>
  <changelog author="adam.majer@suse.de" date="1478606400">- Revert upstream change that set default python version and
  ignored user configuration.
  python-2059618.patch (boo#1006584)</changelog>
  <changelog author="adam.majer@suse.de" date="1483531200">- update to version 1.63.0
  * updated libraries: atomic, container, context, fiber,
    fusion, geometry, hash, interprocess, intrusive, lexical cast,
    log, metaparse, move, optional, phoenix, python, test,
    typeindex, units, unordered
  * see http://www.boost.org/users/history/version_1_63_0.html
    for complete list of changes
- refresh patches
  * boost-1.55.0-python-test-PyImport_AppendInittab.patch
  * boost-strict_aliasing.patch, and enable -fno-strict-aliasing
    for python module
- baselibs.conf:
  * add libboost_locale
  * rename python to include new soname
- remove python-2059618.patch, not needed
- make build condition --without buil_mpi work
- allow building without python3 bindings, for SLE11SP4
- remove versioned build dependency on libicu-devel, apparently
  not needed.
- split out the boost-devel package into individudal compiled
  libraries and their -devel subpackages and libboost_headers-devel
  package for header-only libraries.
- remove all the -mt.so symlinks, probably not needed anymore.
- ship MPI python bindings for both Python 2.7 and 3.x
  * add python_mpi.patch to allow proper compiled library loading
- dynamic_linking.patch: first attempt to remove static library
  generation during build process.</changelog>
  <changelog author="adam.majer@suse.de" date="1484481600">- remove non-existent dependency in the boost mpi python package</changelog>
  <changelog author="adam.majer@suse.de" date="1484654400">- test_lowcase.patch: downcase Boost::Test usage of uppercase
  variables. VERSION was clashing with GNU Autotools define
  resulting in compilation errors of various packages.
- recombine headers from various devel subpackages under the
  libboost_headers-devel package. Not all usage of headers that
  have compiled parts pull in their associated compiled symbols.
- general cleanup of the spec file from old, commented stuffs</changelog>
  <changelog author="adam.majer@suse.de" date="1485345600">- Fix dependency typos.</changelog>
  <changelog author="adam.majer@suse.de" date="1486123200">- baselibs.conf: (re)add python 2.7 and 3.x libraries</changelog>
  <changelog author="jmatejek@suse.com" date="1486728000">- update python macros</changelog>
  <changelog author="adam.majer@suse.de" date="1492689600">- New upstream version 1.64.0
  + process - new library providing cross platform methods to
  - create child processes
  - setup stream for child processes
  - sync and async communication streams with children
  - sync and async wait
  - process termination
  + geometry library had some breaking changes,
  - ublas_transformer is renamed to matrix_transformer
  - explicit modifier is added to constructors of rtree
    index::dynamic_* parameters
  - strategy::area::huiller replaced by strategy::area::spherical
  + context library updates
  - deprecated API:execution-context
  - fixed bad assembly for fcontext on ppc64/sysv/elf
  + Updated libraries: any, atomic, config, container, context,
    conversion, core, coroutine2, fiber, hash, interprocess,
    intrusive, lexicalcast, math, multi-index containers,
    multiprecision, predef, program options, regex, smart pointers,
    test ,typeindex, typetraits, unordered, variant
  + for details, see
    http://www.boost.org/users/history/version_1_64_0.html
- Build PyNumpy module
  + add build requires on python-numpy
- test_lowcase.patch: upstreamed
- refreshed patches: boost-strict_aliasing.patch, gcc_path.patch,
  python_mpi.patch
- mpi_upstream.patch: pending upstream fixes to OpenMPI build
- python_library_name.patch: we are building python versions in
  different stagings so drop library renames.
- python_numpy_retfunc.patch: rpmlint fixes</changelog>
  <changelog author="adam.majer@suse.de" date="1494244800">- make python-numpy optional build dependency
- fix building of mpi python3 plugin</changelog>
  <changelog author="adam.majer@suse.de" date="1494331200">- 1d862615.patch: Fix regression caused by refactoring of
  serialization code (bnc#1038083)</changelog>
  <changelog author="adam.majer@suse.de" date="1505908800">- New upstream version 1.65.1
  + config, fiber - Return a continuation from functions executed
    by resume_with.
  + stacktrace - Change preprocessor file extensions to work with
    the installation system.
- Changes in version 1.65.0
  + stacktrace - new library providing call sequence in human
    readable format.
  + polycollection - new library providing fast containers of
    polymorphic objects, from Joaquín M López Muñoz.
  + For full list of changes, see
    http://www.boost.org/users/history/version_1_65_1.html
- 1d862615.patch: upstreamed and removed
- gcc_path.patch: obsolete, tr1 module is removed
- mpi_upstream.patch: upstreamed and removed
- boost-1.57.0-python-abi_letters.patch: refreshed
- python_library_name.patch: refreshed and reverted upstream
  changes to mpi/build/Jamfile as we are building python2 and
  python3 versions of MPI separately.
- baselibs.conf
  + add libboost_stracktrace
  + update to version 1.65.1</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1507550400">- Setup MPI environment prior to building boost.
- Switch to OpenMPI2 as OpenMPI1 is becoming deprecated.</changelog>
  <changelog author="adam.majer@suse.de" date="1507636800">- Use multibuild setup - build no-dependency libraries in the
  base package and build the rest of the compiled libraries in
  the main variant. This should speed up bootstrapping.
- boost-devel not built by default anymore.
- libboost_headers-devel now provides boost-devel for legacy
  dependencies. If you need compiled boost libraries depend on
  the current compiled devel subpackage.
- run %fdupes only on the header files and documentation
- drop build dependencies on gcc-fortran, chrpath.</changelog>
  <changelog author="jmatejek@suse.com" date="1508846400">- build Python 2 conditionally</changelog>
  <changelog author="adam.majer@suse.de" date="1511956800">- re-enable Python 2 by default. It's still conditional, but
  remains enabled by default. This can be disabled in project
  config.</changelog>
  <changelog author="adam.majer@suse.de" date="1513598400">- Update to version 1.66.0
  + Beast: new portable HTTP, WebSocket and network operations
    using Boost.Asio. Header-only library.
  + Callable Traits: new library and successor to
    Boost.FunctionTypes. Header-only library.
  + Mp11: new metaprogramming library
  + Asio:
  * implemented interface changes to reflect the Networking TS
    (N4656)
  * functions and classes that have been superseded by
    Networking TS functionality have been deprecated.
  * added support for customized handler tracking
  * removed previously deprecated functions
  + Atomic: improved compatibility with GCC 7. 128-bit operations
    on x86_64 no longer require linking with compiled library.
  + DateTime: Fixed an integral overflow that could cause incorrect
    results when adding or subtracting many years from a date.
  + Format: New format specifiers added and volatile arguments
    can not be safely used with operator%
  + Fusion:
  * fix compile error with std::array
  * remove circular preprocessor include
  + PolyCollection: backported to GCC 4.8 and 4.9 with some
    limitations
  + Uuid: added RTF-4122 namespaces in boost::uuids::ns
  + for complete changelog, see
    http://www.boost.org/users/history/version_1_66_0.html
- refreshed patches: boost-rpmoptflags-only.patch</changelog>
  <changelog author="adam.majer@suse.de" date="1516363200">- Multibuild requires versioned Name: tag and doesn't seem to do
  this automatically. (bnc#1076640)</changelog>
  <changelog author="kukuk@suse.de" date="1522843200">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="adam.majer@suse.de" date="1584619200">- libreoffice_compat_backports.patch: add a backport of
  Boost.Optional::has_value() for LibreOffice</changelog>
  <changelog author="adam.majer@suse.de" date="1641816000">- variant.patch: backport fix allowing perfect forwarding in
  apply_visitor. Also fix wrong usage of boost::move (bsc#1194522)</changelog>
</package>
<package pkgid="9991999471200bec09c97a8d1f27759da39234358fdcd5b91a28a4e5013d5c0a" name="libboost_numpy-py2_7-1_66_0" arch="s390x">
  <version epoch="0" ver="1.66.0" rel="12.3.1"/>
  <changelog author="adam.majer@suse.de" date="1478606400">- Revert upstream change that set default python version and
  ignored user configuration.
  python-2059618.patch (boo#1006584)</changelog>
  <changelog author="adam.majer@suse.de" date="1483531200">- update to version 1.63.0
  * updated libraries: atomic, container, context, fiber,
    fusion, geometry, hash, interprocess, intrusive, lexical cast,
    log, metaparse, move, optional, phoenix, python, test,
    typeindex, units, unordered
  * see http://www.boost.org/users/history/version_1_63_0.html
    for complete list of changes
- refresh patches
  * boost-1.55.0-python-test-PyImport_AppendInittab.patch
  * boost-strict_aliasing.patch, and enable -fno-strict-aliasing
    for python module
- baselibs.conf:
  * add libboost_locale
  * rename python to include new soname
- remove python-2059618.patch, not needed
- make build condition --without buil_mpi work
- allow building without python3 bindings, for SLE11SP4
- remove versioned build dependency on libicu-devel, apparently
  not needed.
- split out the boost-devel package into individudal compiled
  libraries and their -devel subpackages and libboost_headers-devel
  package for header-only libraries.
- remove all the -mt.so symlinks, probably not needed anymore.
- ship MPI python bindings for both Python 2.7 and 3.x
  * add python_mpi.patch to allow proper compiled library loading
- dynamic_linking.patch: first attempt to remove static library
  generation during build process.</changelog>
  <changelog author="adam.majer@suse.de" date="1484481600">- remove non-existent dependency in the boost mpi python package</changelog>
  <changelog author="adam.majer@suse.de" date="1484654400">- test_lowcase.patch: downcase Boost::Test usage of uppercase
  variables. VERSION was clashing with GNU Autotools define
  resulting in compilation errors of various packages.
- recombine headers from various devel subpackages under the
  libboost_headers-devel package. Not all usage of headers that
  have compiled parts pull in their associated compiled symbols.
- general cleanup of the spec file from old, commented stuffs</changelog>
  <changelog author="adam.majer@suse.de" date="1485345600">- Fix dependency typos.</changelog>
  <changelog author="adam.majer@suse.de" date="1486123200">- baselibs.conf: (re)add python 2.7 and 3.x libraries</changelog>
  <changelog author="jmatejek@suse.com" date="1486728000">- update python macros</changelog>
  <changelog author="adam.majer@suse.de" date="1492689600">- New upstream version 1.64.0
  + process - new library providing cross platform methods to
  - create child processes
  - setup stream for child processes
  - sync and async communication streams with children
  - sync and async wait
  - process termination
  + geometry library had some breaking changes,
  - ublas_transformer is renamed to matrix_transformer
  - explicit modifier is added to constructors of rtree
    index::dynamic_* parameters
  - strategy::area::huiller replaced by strategy::area::spherical
  + context library updates
  - deprecated API:execution-context
  - fixed bad assembly for fcontext on ppc64/sysv/elf
  + Updated libraries: any, atomic, config, container, context,
    conversion, core, coroutine2, fiber, hash, interprocess,
    intrusive, lexicalcast, math, multi-index containers,
    multiprecision, predef, program options, regex, smart pointers,
    test ,typeindex, typetraits, unordered, variant
  + for details, see
    http://www.boost.org/users/history/version_1_64_0.html
- Build PyNumpy module
  + add build requires on python-numpy
- test_lowcase.patch: upstreamed
- refreshed patches: boost-strict_aliasing.patch, gcc_path.patch,
  python_mpi.patch
- mpi_upstream.patch: pending upstream fixes to OpenMPI build
- python_library_name.patch: we are building python versions in
  different stagings so drop library renames.
- python_numpy_retfunc.patch: rpmlint fixes</changelog>
  <changelog author="adam.majer@suse.de" date="1494244800">- make python-numpy optional build dependency
- fix building of mpi python3 plugin</changelog>
  <changelog author="adam.majer@suse.de" date="1494331200">- 1d862615.patch: Fix regression caused by refactoring of
  serialization code (bnc#1038083)</changelog>
  <changelog author="adam.majer@suse.de" date="1505908800">- New upstream version 1.65.1
  + config, fiber - Return a continuation from functions executed
    by resume_with.
  + stacktrace - Change preprocessor file extensions to work with
    the installation system.
- Changes in version 1.65.0
  + stacktrace - new library providing call sequence in human
    readable format.
  + polycollection - new library providing fast containers of
    polymorphic objects, from Joaquín M López Muñoz.
  + For full list of changes, see
    http://www.boost.org/users/history/version_1_65_1.html
- 1d862615.patch: upstreamed and removed
- gcc_path.patch: obsolete, tr1 module is removed
- mpi_upstream.patch: upstreamed and removed
- boost-1.57.0-python-abi_letters.patch: refreshed
- python_library_name.patch: refreshed and reverted upstream
  changes to mpi/build/Jamfile as we are building python2 and
  python3 versions of MPI separately.
- baselibs.conf
  + add libboost_stracktrace
  + update to version 1.65.1</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1507550400">- Setup MPI environment prior to building boost.
- Switch to OpenMPI2 as OpenMPI1 is becoming deprecated.</changelog>
  <changelog author="adam.majer@suse.de" date="1507636800">- Use multibuild setup - build no-dependency libraries in the
  base package and build the rest of the compiled libraries in
  the main variant. This should speed up bootstrapping.
- boost-devel not built by default anymore.
- libboost_headers-devel now provides boost-devel for legacy
  dependencies. If you need compiled boost libraries depend on
  the current compiled devel subpackage.
- run %fdupes only on the header files and documentation
- drop build dependencies on gcc-fortran, chrpath.</changelog>
  <changelog author="jmatejek@suse.com" date="1508846400">- build Python 2 conditionally</changelog>
  <changelog author="adam.majer@suse.de" date="1511956800">- re-enable Python 2 by default. It's still conditional, but
  remains enabled by default. This can be disabled in project
  config.</changelog>
  <changelog author="adam.majer@suse.de" date="1513598400">- Update to version 1.66.0
  + Beast: new portable HTTP, WebSocket and network operations
    using Boost.Asio. Header-only library.
  + Callable Traits: new library and successor to
    Boost.FunctionTypes. Header-only library.
  + Mp11: new metaprogramming library
  + Asio:
  * implemented interface changes to reflect the Networking TS
    (N4656)
  * functions and classes that have been superseded by
    Networking TS functionality have been deprecated.
  * added support for customized handler tracking
  * removed previously deprecated functions
  + Atomic: improved compatibility with GCC 7. 128-bit operations
    on x86_64 no longer require linking with compiled library.
  + DateTime: Fixed an integral overflow that could cause incorrect
    results when adding or subtracting many years from a date.
  + Format: New format specifiers added and volatile arguments
    can not be safely used with operator%
  + Fusion:
  * fix compile error with std::array
  * remove circular preprocessor include
  + PolyCollection: backported to GCC 4.8 and 4.9 with some
    limitations
  + Uuid: added RTF-4122 namespaces in boost::uuids::ns
  + for complete changelog, see
    http://www.boost.org/users/history/version_1_66_0.html
- refreshed patches: boost-rpmoptflags-only.patch</changelog>
  <changelog author="adam.majer@suse.de" date="1516363200">- Multibuild requires versioned Name: tag and doesn't seem to do
  this automatically. (bnc#1076640)</changelog>
  <changelog author="kukuk@suse.de" date="1522843200">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="adam.majer@suse.de" date="1584619200">- libreoffice_compat_backports.patch: add a backport of
  Boost.Optional::has_value() for LibreOffice</changelog>
  <changelog author="adam.majer@suse.de" date="1641816000">- variant.patch: backport fix allowing perfect forwarding in
  apply_visitor. Also fix wrong usage of boost::move (bsc#1194522)</changelog>
</package>
<package pkgid="6a8ebaf6362190f4daf8a2e9393689727ed02952c3acad0c7045a7b25c159bf4" name="libboost_numpy-py2_7-1_66_0" arch="x86_64">
  <version epoch="0" ver="1.66.0" rel="12.3.1"/>
  <changelog author="adam.majer@suse.de" date="1478606400">- Revert upstream change that set default python version and
  ignored user configuration.
  python-2059618.patch (boo#1006584)</changelog>
  <changelog author="adam.majer@suse.de" date="1483531200">- update to version 1.63.0
  * updated libraries: atomic, container, context, fiber,
    fusion, geometry, hash, interprocess, intrusive, lexical cast,
    log, metaparse, move, optional, phoenix, python, test,
    typeindex, units, unordered
  * see http://www.boost.org/users/history/version_1_63_0.html
    for complete list of changes
- refresh patches
  * boost-1.55.0-python-test-PyImport_AppendInittab.patch
  * boost-strict_aliasing.patch, and enable -fno-strict-aliasing
    for python module
- baselibs.conf:
  * add libboost_locale
  * rename python to include new soname
- remove python-2059618.patch, not needed
- make build condition --without buil_mpi work
- allow building without python3 bindings, for SLE11SP4
- remove versioned build dependency on libicu-devel, apparently
  not needed.
- split out the boost-devel package into individudal compiled
  libraries and their -devel subpackages and libboost_headers-devel
  package for header-only libraries.
- remove all the -mt.so symlinks, probably not needed anymore.
- ship MPI python bindings for both Python 2.7 and 3.x
  * add python_mpi.patch to allow proper compiled library loading
- dynamic_linking.patch: first attempt to remove static library
  generation during build process.</changelog>
  <changelog author="adam.majer@suse.de" date="1484481600">- remove non-existent dependency in the boost mpi python package</changelog>
  <changelog author="adam.majer@suse.de" date="1484654400">- test_lowcase.patch: downcase Boost::Test usage of uppercase
  variables. VERSION was clashing with GNU Autotools define
  resulting in compilation errors of various packages.
- recombine headers from various devel subpackages under the
  libboost_headers-devel package. Not all usage of headers that
  have compiled parts pull in their associated compiled symbols.
- general cleanup of the spec file from old, commented stuffs</changelog>
  <changelog author="adam.majer@suse.de" date="1485345600">- Fix dependency typos.</changelog>
  <changelog author="adam.majer@suse.de" date="1486123200">- baselibs.conf: (re)add python 2.7 and 3.x libraries</changelog>
  <changelog author="jmatejek@suse.com" date="1486728000">- update python macros</changelog>
  <changelog author="adam.majer@suse.de" date="1492689600">- New upstream version 1.64.0
  + process - new library providing cross platform methods to
  - create child processes
  - setup stream for child processes
  - sync and async communication streams with children
  - sync and async wait
  - process termination
  + geometry library had some breaking changes,
  - ublas_transformer is renamed to matrix_transformer
  - explicit modifier is added to constructors of rtree
    index::dynamic_* parameters
  - strategy::area::huiller replaced by strategy::area::spherical
  + context library updates
  - deprecated API:execution-context
  - fixed bad assembly for fcontext on ppc64/sysv/elf
  + Updated libraries: any, atomic, config, container, context,
    conversion, core, coroutine2, fiber, hash, interprocess,
    intrusive, lexicalcast, math, multi-index containers,
    multiprecision, predef, program options, regex, smart pointers,
    test ,typeindex, typetraits, unordered, variant
  + for details, see
    http://www.boost.org/users/history/version_1_64_0.html
- Build PyNumpy module
  + add build requires on python-numpy
- test_lowcase.patch: upstreamed
- refreshed patches: boost-strict_aliasing.patch, gcc_path.patch,
  python_mpi.patch
- mpi_upstream.patch: pending upstream fixes to OpenMPI build
- python_library_name.patch: we are building python versions in
  different stagings so drop library renames.
- python_numpy_retfunc.patch: rpmlint fixes</changelog>
  <changelog author="adam.majer@suse.de" date="1494244800">- make python-numpy optional build dependency
- fix building of mpi python3 plugin</changelog>
  <changelog author="adam.majer@suse.de" date="1494331200">- 1d862615.patch: Fix regression caused by refactoring of
  serialization code (bnc#1038083)</changelog>
  <changelog author="adam.majer@suse.de" date="1505908800">- New upstream version 1.65.1
  + config, fiber - Return a continuation from functions executed
    by resume_with.
  + stacktrace - Change preprocessor file extensions to work with
    the installation system.
- Changes in version 1.65.0
  + stacktrace - new library providing call sequence in human
    readable format.
  + polycollection - new library providing fast containers of
    polymorphic objects, from Joaquín M López Muñoz.
  + For full list of changes, see
    http://www.boost.org/users/history/version_1_65_1.html
- 1d862615.patch: upstreamed and removed
- gcc_path.patch: obsolete, tr1 module is removed
- mpi_upstream.patch: upstreamed and removed
- boost-1.57.0-python-abi_letters.patch: refreshed
- python_library_name.patch: refreshed and reverted upstream
  changes to mpi/build/Jamfile as we are building python2 and
  python3 versions of MPI separately.
- baselibs.conf
  + add libboost_stracktrace
  + update to version 1.65.1</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1507550400">- Setup MPI environment prior to building boost.
- Switch to OpenMPI2 as OpenMPI1 is becoming deprecated.</changelog>
  <changelog author="adam.majer@suse.de" date="1507636800">- Use multibuild setup - build no-dependency libraries in the
  base package and build the rest of the compiled libraries in
  the main variant. This should speed up bootstrapping.
- boost-devel not built by default anymore.
- libboost_headers-devel now provides boost-devel for legacy
  dependencies. If you need compiled boost libraries depend on
  the current compiled devel subpackage.
- run %fdupes only on the header files and documentation
- drop build dependencies on gcc-fortran, chrpath.</changelog>
  <changelog author="jmatejek@suse.com" date="1508846400">- build Python 2 conditionally</changelog>
  <changelog author="adam.majer@suse.de" date="1511956800">- re-enable Python 2 by default. It's still conditional, but
  remains enabled by default. This can be disabled in project
  config.</changelog>
  <changelog author="adam.majer@suse.de" date="1513598400">- Update to version 1.66.0
  + Beast: new portable HTTP, WebSocket and network operations
    using Boost.Asio. Header-only library.
  + Callable Traits: new library and successor to
    Boost.FunctionTypes. Header-only library.
  + Mp11: new metaprogramming library
  + Asio:
  * implemented interface changes to reflect the Networking TS
    (N4656)
  * functions and classes that have been superseded by
    Networking TS functionality have been deprecated.
  * added support for customized handler tracking
  * removed previously deprecated functions
  + Atomic: improved compatibility with GCC 7. 128-bit operations
    on x86_64 no longer require linking with compiled library.
  + DateTime: Fixed an integral overflow that could cause incorrect
    results when adding or subtracting many years from a date.
  + Format: New format specifiers added and volatile arguments
    can not be safely used with operator%
  + Fusion:
  * fix compile error with std::array
  * remove circular preprocessor include
  + PolyCollection: backported to GCC 4.8 and 4.9 with some
    limitations
  + Uuid: added RTF-4122 namespaces in boost::uuids::ns
  + for complete changelog, see
    http://www.boost.org/users/history/version_1_66_0.html
- refreshed patches: boost-rpmoptflags-only.patch</changelog>
  <changelog author="adam.majer@suse.de" date="1516363200">- Multibuild requires versioned Name: tag and doesn't seem to do
  this automatically. (bnc#1076640)</changelog>
  <changelog author="kukuk@suse.de" date="1522843200">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="adam.majer@suse.de" date="1584619200">- libreoffice_compat_backports.patch: add a backport of
  Boost.Optional::has_value() for LibreOffice</changelog>
  <changelog author="adam.majer@suse.de" date="1641816000">- variant.patch: backport fix allowing perfect forwarding in
  apply_visitor. Also fix wrong usage of boost::move (bsc#1194522)</changelog>
</package>
<package pkgid="9321bdd6422d2638086b7d47b9a76093cad05c0a5f1ef4da9192ddde645e516d" name="libboost_numpy-py2_7-1_66_0-devel" arch="aarch64">
  <version epoch="0" ver="1.66.0" rel="12.3.1"/>
  <changelog author="adam.majer@suse.de" date="1478606400">- Revert upstream change that set default python version and
  ignored user configuration.
  python-2059618.patch (boo#1006584)</changelog>
  <changelog author="adam.majer@suse.de" date="1483531200">- update to version 1.63.0
  * updated libraries: atomic, container, context, fiber,
    fusion, geometry, hash, interprocess, intrusive, lexical cast,
    log, metaparse, move, optional, phoenix, python, test,
    typeindex, units, unordered
  * see http://www.boost.org/users/history/version_1_63_0.html
    for complete list of changes
- refresh patches
  * boost-1.55.0-python-test-PyImport_AppendInittab.patch
  * boost-strict_aliasing.patch, and enable -fno-strict-aliasing
    for python module
- baselibs.conf:
  * add libboost_locale
  * rename python to include new soname
- remove python-2059618.patch, not needed
- make build condition --without buil_mpi work
- allow building without python3 bindings, for SLE11SP4
- remove versioned build dependency on libicu-devel, apparently
  not needed.
- split out the boost-devel package into individudal compiled
  libraries and their -devel subpackages and libboost_headers-devel
  package for header-only libraries.
- remove all the -mt.so symlinks, probably not needed anymore.
- ship MPI python bindings for both Python 2.7 and 3.x
  * add python_mpi.patch to allow proper compiled library loading
- dynamic_linking.patch: first attempt to remove static library
  generation during build process.</changelog>
  <changelog author="adam.majer@suse.de" date="1484481600">- remove non-existent dependency in the boost mpi python package</changelog>
  <changelog author="adam.majer@suse.de" date="1484654400">- test_lowcase.patch: downcase Boost::Test usage of uppercase
  variables. VERSION was clashing with GNU Autotools define
  resulting in compilation errors of various packages.
- recombine headers from various devel subpackages under the
  libboost_headers-devel package. Not all usage of headers that
  have compiled parts pull in their associated compiled symbols.
- general cleanup of the spec file from old, commented stuffs</changelog>
  <changelog author="adam.majer@suse.de" date="1485345600">- Fix dependency typos.</changelog>
  <changelog author="adam.majer@suse.de" date="1486123200">- baselibs.conf: (re)add python 2.7 and 3.x libraries</changelog>
  <changelog author="jmatejek@suse.com" date="1486728000">- update python macros</changelog>
  <changelog author="adam.majer@suse.de" date="1492689600">- New upstream version 1.64.0
  + process - new library providing cross platform methods to
  - create child processes
  - setup stream for child processes
  - sync and async communication streams with children
  - sync and async wait
  - process termination
  + geometry library had some breaking changes,
  - ublas_transformer is renamed to matrix_transformer
  - explicit modifier is added to constructors of rtree
    index::dynamic_* parameters
  - strategy::area::huiller replaced by strategy::area::spherical
  + context library updates
  - deprecated API:execution-context
  - fixed bad assembly for fcontext on ppc64/sysv/elf
  + Updated libraries: any, atomic, config, container, context,
    conversion, core, coroutine2, fiber, hash, interprocess,
    intrusive, lexicalcast, math, multi-index containers,
    multiprecision, predef, program options, regex, smart pointers,
    test ,typeindex, typetraits, unordered, variant
  + for details, see
    http://www.boost.org/users/history/version_1_64_0.html
- Build PyNumpy module
  + add build requires on python-numpy
- test_lowcase.patch: upstreamed
- refreshed patches: boost-strict_aliasing.patch, gcc_path.patch,
  python_mpi.patch
- mpi_upstream.patch: pending upstream fixes to OpenMPI build
- python_library_name.patch: we are building python versions in
  different stagings so drop library renames.
- python_numpy_retfunc.patch: rpmlint fixes</changelog>
  <changelog author="adam.majer@suse.de" date="1494244800">- make python-numpy optional build dependency
- fix building of mpi python3 plugin</changelog>
  <changelog author="adam.majer@suse.de" date="1494331200">- 1d862615.patch: Fix regression caused by refactoring of
  serialization code (bnc#1038083)</changelog>
  <changelog author="adam.majer@suse.de" date="1505908800">- New upstream version 1.65.1
  + config, fiber - Return a continuation from functions executed
    by resume_with.
  + stacktrace - Change preprocessor file extensions to work with
    the installation system.
- Changes in version 1.65.0
  + stacktrace - new library providing call sequence in human
    readable format.
  + polycollection - new library providing fast containers of
    polymorphic objects, from Joaquín M López Muñoz.
  + For full list of changes, see
    http://www.boost.org/users/history/version_1_65_1.html
- 1d862615.patch: upstreamed and removed
- gcc_path.patch: obsolete, tr1 module is removed
- mpi_upstream.patch: upstreamed and removed
- boost-1.57.0-python-abi_letters.patch: refreshed
- python_library_name.patch: refreshed and reverted upstream
  changes to mpi/build/Jamfile as we are building python2 and
  python3 versions of MPI separately.
- baselibs.conf
  + add libboost_stracktrace
  + update to version 1.65.1</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1507550400">- Setup MPI environment prior to building boost.
- Switch to OpenMPI2 as OpenMPI1 is becoming deprecated.</changelog>
  <changelog author="adam.majer@suse.de" date="1507636800">- Use multibuild setup - build no-dependency libraries in the
  base package and build the rest of the compiled libraries in
  the main variant. This should speed up bootstrapping.
- boost-devel not built by default anymore.
- libboost_headers-devel now provides boost-devel for legacy
  dependencies. If you need compiled boost libraries depend on
  the current compiled devel subpackage.
- run %fdupes only on the header files and documentation
- drop build dependencies on gcc-fortran, chrpath.</changelog>
  <changelog author="jmatejek@suse.com" date="1508846400">- build Python 2 conditionally</changelog>
  <changelog author="adam.majer@suse.de" date="1511956800">- re-enable Python 2 by default. It's still conditional, but
  remains enabled by default. This can be disabled in project
  config.</changelog>
  <changelog author="adam.majer@suse.de" date="1513598400">- Update to version 1.66.0
  + Beast: new portable HTTP, WebSocket and network operations
    using Boost.Asio. Header-only library.
  + Callable Traits: new library and successor to
    Boost.FunctionTypes. Header-only library.
  + Mp11: new metaprogramming library
  + Asio:
  * implemented interface changes to reflect the Networking TS
    (N4656)
  * functions and classes that have been superseded by
    Networking TS functionality have been deprecated.
  * added support for customized handler tracking
  * removed previously deprecated functions
  + Atomic: improved compatibility with GCC 7. 128-bit operations
    on x86_64 no longer require linking with compiled library.
  + DateTime: Fixed an integral overflow that could cause incorrect
    results when adding or subtracting many years from a date.
  + Format: New format specifiers added and volatile arguments
    can not be safely used with operator%
  + Fusion:
  * fix compile error with std::array
  * remove circular preprocessor include
  + PolyCollection: backported to GCC 4.8 and 4.9 with some
    limitations
  + Uuid: added RTF-4122 namespaces in boost::uuids::ns
  + for complete changelog, see
    http://www.boost.org/users/history/version_1_66_0.html
- refreshed patches: boost-rpmoptflags-only.patch</changelog>
  <changelog author="adam.majer@suse.de" date="1516363200">- Multibuild requires versioned Name: tag and doesn't seem to do
  this automatically. (bnc#1076640)</changelog>
  <changelog author="kukuk@suse.de" date="1522843200">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="adam.majer@suse.de" date="1584619200">- libreoffice_compat_backports.patch: add a backport of
  Boost.Optional::has_value() for LibreOffice</changelog>
  <changelog author="adam.majer@suse.de" date="1641816000">- variant.patch: backport fix allowing perfect forwarding in
  apply_visitor. Also fix wrong usage of boost::move (bsc#1194522)</changelog>
</package>
<package pkgid="47834f47358e9cfd1d005899e500b7b61fe764fbfbbe1ddb2a98300e8c461337" name="libboost_numpy-py2_7-1_66_0-devel" arch="ppc64le">
  <version epoch="0" ver="1.66.0" rel="12.3.1"/>
  <changelog author="adam.majer@suse.de" date="1478606400">- Revert upstream change that set default python version and
  ignored user configuration.
  python-2059618.patch (boo#1006584)</changelog>
  <changelog author="adam.majer@suse.de" date="1483531200">- update to version 1.63.0
  * updated libraries: atomic, container, context, fiber,
    fusion, geometry, hash, interprocess, intrusive, lexical cast,
    log, metaparse, move, optional, phoenix, python, test,
    typeindex, units, unordered
  * see http://www.boost.org/users/history/version_1_63_0.html
    for complete list of changes
- refresh patches
  * boost-1.55.0-python-test-PyImport_AppendInittab.patch
  * boost-strict_aliasing.patch, and enable -fno-strict-aliasing
    for python module
- baselibs.conf:
  * add libboost_locale
  * rename python to include new soname
- remove python-2059618.patch, not needed
- make build condition --without buil_mpi work
- allow building without python3 bindings, for SLE11SP4
- remove versioned build dependency on libicu-devel, apparently
  not needed.
- split out the boost-devel package into individudal compiled
  libraries and their -devel subpackages and libboost_headers-devel
  package for header-only libraries.
- remove all the -mt.so symlinks, probably not needed anymore.
- ship MPI python bindings for both Python 2.7 and 3.x
  * add python_mpi.patch to allow proper compiled library loading
- dynamic_linking.patch: first attempt to remove static library
  generation during build process.</changelog>
  <changelog author="adam.majer@suse.de" date="1484481600">- remove non-existent dependency in the boost mpi python package</changelog>
  <changelog author="adam.majer@suse.de" date="1484654400">- test_lowcase.patch: downcase Boost::Test usage of uppercase
  variables. VERSION was clashing with GNU Autotools define
  resulting in compilation errors of various packages.
- recombine headers from various devel subpackages under the
  libboost_headers-devel package. Not all usage of headers that
  have compiled parts pull in their associated compiled symbols.
- general cleanup of the spec file from old, commented stuffs</changelog>
  <changelog author="adam.majer@suse.de" date="1485345600">- Fix dependency typos.</changelog>
  <changelog author="adam.majer@suse.de" date="1486123200">- baselibs.conf: (re)add python 2.7 and 3.x libraries</changelog>
  <changelog author="jmatejek@suse.com" date="1486728000">- update python macros</changelog>
  <changelog author="adam.majer@suse.de" date="1492689600">- New upstream version 1.64.0
  + process - new library providing cross platform methods to
  - create child processes
  - setup stream for child processes
  - sync and async communication streams with children
  - sync and async wait
  - process termination
  + geometry library had some breaking changes,
  - ublas_transformer is renamed to matrix_transformer
  - explicit modifier is added to constructors of rtree
    index::dynamic_* parameters
  - strategy::area::huiller replaced by strategy::area::spherical
  + context library updates
  - deprecated API:execution-context
  - fixed bad assembly for fcontext on ppc64/sysv/elf
  + Updated libraries: any, atomic, config, container, context,
    conversion, core, coroutine2, fiber, hash, interprocess,
    intrusive, lexicalcast, math, multi-index containers,
    multiprecision, predef, program options, regex, smart pointers,
    test ,typeindex, typetraits, unordered, variant
  + for details, see
    http://www.boost.org/users/history/version_1_64_0.html
- Build PyNumpy module
  + add build requires on python-numpy
- test_lowcase.patch: upstreamed
- refreshed patches: boost-strict_aliasing.patch, gcc_path.patch,
  python_mpi.patch
- mpi_upstream.patch: pending upstream fixes to OpenMPI build
- python_library_name.patch: we are building python versions in
  different stagings so drop library renames.
- python_numpy_retfunc.patch: rpmlint fixes</changelog>
  <changelog author="adam.majer@suse.de" date="1494244800">- make python-numpy optional build dependency
- fix building of mpi python3 plugin</changelog>
  <changelog author="adam.majer@suse.de" date="1494331200">- 1d862615.patch: Fix regression caused by refactoring of
  serialization code (bnc#1038083)</changelog>
  <changelog author="adam.majer@suse.de" date="1505908800">- New upstream version 1.65.1
  + config, fiber - Return a continuation from functions executed
    by resume_with.
  + stacktrace - Change preprocessor file extensions to work with
    the installation system.
- Changes in version 1.65.0
  + stacktrace - new library providing call sequence in human
    readable format.
  + polycollection - new library providing fast containers of
    polymorphic objects, from Joaquín M López Muñoz.
  + For full list of changes, see
    http://www.boost.org/users/history/version_1_65_1.html
- 1d862615.patch: upstreamed and removed
- gcc_path.patch: obsolete, tr1 module is removed
- mpi_upstream.patch: upstreamed and removed
- boost-1.57.0-python-abi_letters.patch: refreshed
- python_library_name.patch: refreshed and reverted upstream
  changes to mpi/build/Jamfile as we are building python2 and
  python3 versions of MPI separately.
- baselibs.conf
  + add libboost_stracktrace
  + update to version 1.65.1</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1507550400">- Setup MPI environment prior to building boost.
- Switch to OpenMPI2 as OpenMPI1 is becoming deprecated.</changelog>
  <changelog author="adam.majer@suse.de" date="1507636800">- Use multibuild setup - build no-dependency libraries in the
  base package and build the rest of the compiled libraries in
  the main variant. This should speed up bootstrapping.
- boost-devel not built by default anymore.
- libboost_headers-devel now provides boost-devel for legacy
  dependencies. If you need compiled boost libraries depend on
  the current compiled devel subpackage.
- run %fdupes only on the header files and documentation
- drop build dependencies on gcc-fortran, chrpath.</changelog>
  <changelog author="jmatejek@suse.com" date="1508846400">- build Python 2 conditionally</changelog>
  <changelog author="adam.majer@suse.de" date="1511956800">- re-enable Python 2 by default. It's still conditional, but
  remains enabled by default. This can be disabled in project
  config.</changelog>
  <changelog author="adam.majer@suse.de" date="1513598400">- Update to version 1.66.0
  + Beast: new portable HTTP, WebSocket and network operations
    using Boost.Asio. Header-only library.
  + Callable Traits: new library and successor to
    Boost.FunctionTypes. Header-only library.
  + Mp11: new metaprogramming library
  + Asio:
  * implemented interface changes to reflect the Networking TS
    (N4656)
  * functions and classes that have been superseded by
    Networking TS functionality have been deprecated.
  * added support for customized handler tracking
  * removed previously deprecated functions
  + Atomic: improved compatibility with GCC 7. 128-bit operations
    on x86_64 no longer require linking with compiled library.
  + DateTime: Fixed an integral overflow that could cause incorrect
    results when adding or subtracting many years from a date.
  + Format: New format specifiers added and volatile arguments
    can not be safely used with operator%
  + Fusion:
  * fix compile error with std::array
  * remove circular preprocessor include
  + PolyCollection: backported to GCC 4.8 and 4.9 with some
    limitations
  + Uuid: added RTF-4122 namespaces in boost::uuids::ns
  + for complete changelog, see
    http://www.boost.org/users/history/version_1_66_0.html
- refreshed patches: boost-rpmoptflags-only.patch</changelog>
  <changelog author="adam.majer@suse.de" date="1516363200">- Multibuild requires versioned Name: tag and doesn't seem to do
  this automatically. (bnc#1076640)</changelog>
  <changelog author="kukuk@suse.de" date="1522843200">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="adam.majer@suse.de" date="1584619200">- libreoffice_compat_backports.patch: add a backport of
  Boost.Optional::has_value() for LibreOffice</changelog>
  <changelog author="adam.majer@suse.de" date="1641816000">- variant.patch: backport fix allowing perfect forwarding in
  apply_visitor. Also fix wrong usage of boost::move (bsc#1194522)</changelog>
</package>
<package pkgid="b8a84b5b9cdd77c4db182aabad6066cf978863a7e3abd41401db6dd000ce4819" name="libboost_numpy-py2_7-1_66_0-devel" arch="s390x">
  <version epoch="0" ver="1.66.0" rel="12.3.1"/>
  <changelog author="adam.majer@suse.de" date="1478606400">- Revert upstream change that set default python version and
  ignored user configuration.
  python-2059618.patch (boo#1006584)</changelog>
  <changelog author="adam.majer@suse.de" date="1483531200">- update to version 1.63.0
  * updated libraries: atomic, container, context, fiber,
    fusion, geometry, hash, interprocess, intrusive, lexical cast,
    log, metaparse, move, optional, phoenix, python, test,
    typeindex, units, unordered
  * see http://www.boost.org/users/history/version_1_63_0.html
    for complete list of changes
- refresh patches
  * boost-1.55.0-python-test-PyImport_AppendInittab.patch
  * boost-strict_aliasing.patch, and enable -fno-strict-aliasing
    for python module
- baselibs.conf:
  * add libboost_locale
  * rename python to include new soname
- remove python-2059618.patch, not needed
- make build condition --without buil_mpi work
- allow building without python3 bindings, for SLE11SP4
- remove versioned build dependency on libicu-devel, apparently
  not needed.
- split out the boost-devel package into individudal compiled
  libraries and their -devel subpackages and libboost_headers-devel
  package for header-only libraries.
- remove all the -mt.so symlinks, probably not needed anymore.
- ship MPI python bindings for both Python 2.7 and 3.x
  * add python_mpi.patch to allow proper compiled library loading
- dynamic_linking.patch: first attempt to remove static library
  generation during build process.</changelog>
  <changelog author="adam.majer@suse.de" date="1484481600">- remove non-existent dependency in the boost mpi python package</changelog>
  <changelog author="adam.majer@suse.de" date="1484654400">- test_lowcase.patch: downcase Boost::Test usage of uppercase
  variables. VERSION was clashing with GNU Autotools define
  resulting in compilation errors of various packages.
- recombine headers from various devel subpackages under the
  libboost_headers-devel package. Not all usage of headers that
  have compiled parts pull in their associated compiled symbols.
- general cleanup of the spec file from old, commented stuffs</changelog>
  <changelog author="adam.majer@suse.de" date="1485345600">- Fix dependency typos.</changelog>
  <changelog author="adam.majer@suse.de" date="1486123200">- baselibs.conf: (re)add python 2.7 and 3.x libraries</changelog>
  <changelog author="jmatejek@suse.com" date="1486728000">- update python macros</changelog>
  <changelog author="adam.majer@suse.de" date="1492689600">- New upstream version 1.64.0
  + process - new library providing cross platform methods to
  - create child processes
  - setup stream for child processes
  - sync and async communication streams with children
  - sync and async wait
  - process termination
  + geometry library had some breaking changes,
  - ublas_transformer is renamed to matrix_transformer
  - explicit modifier is added to constructors of rtree
    index::dynamic_* parameters
  - strategy::area::huiller replaced by strategy::area::spherical
  + context library updates
  - deprecated API:execution-context
  - fixed bad assembly for fcontext on ppc64/sysv/elf
  + Updated libraries: any, atomic, config, container, context,
    conversion, core, coroutine2, fiber, hash, interprocess,
    intrusive, lexicalcast, math, multi-index containers,
    multiprecision, predef, program options, regex, smart pointers,
    test ,typeindex, typetraits, unordered, variant
  + for details, see
    http://www.boost.org/users/history/version_1_64_0.html
- Build PyNumpy module
  + add build requires on python-numpy
- test_lowcase.patch: upstreamed
- refreshed patches: boost-strict_aliasing.patch, gcc_path.patch,
  python_mpi.patch
- mpi_upstream.patch: pending upstream fixes to OpenMPI build
- python_library_name.patch: we are building python versions in
  different stagings so drop library renames.
- python_numpy_retfunc.patch: rpmlint fixes</changelog>
  <changelog author="adam.majer@suse.de" date="1494244800">- make python-numpy optional build dependency
- fix building of mpi python3 plugin</changelog>
  <changelog author="adam.majer@suse.de" date="1494331200">- 1d862615.patch: Fix regression caused by refactoring of
  serialization code (bnc#1038083)</changelog>
  <changelog author="adam.majer@suse.de" date="1505908800">- New upstream version 1.65.1
  + config, fiber - Return a continuation from functions executed
    by resume_with.
  + stacktrace - Change preprocessor file extensions to work with
    the installation system.
- Changes in version 1.65.0
  + stacktrace - new library providing call sequence in human
    readable format.
  + polycollection - new library providing fast containers of
    polymorphic objects, from Joaquín M López Muñoz.
  + For full list of changes, see
    http://www.boost.org/users/history/version_1_65_1.html
- 1d862615.patch: upstreamed and removed
- gcc_path.patch: obsolete, tr1 module is removed
- mpi_upstream.patch: upstreamed and removed
- boost-1.57.0-python-abi_letters.patch: refreshed
- python_library_name.patch: refreshed and reverted upstream
  changes to mpi/build/Jamfile as we are building python2 and
  python3 versions of MPI separately.
- baselibs.conf
  + add libboost_stracktrace
  + update to version 1.65.1</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1507550400">- Setup MPI environment prior to building boost.
- Switch to OpenMPI2 as OpenMPI1 is becoming deprecated.</changelog>
  <changelog author="adam.majer@suse.de" date="1507636800">- Use multibuild setup - build no-dependency libraries in the
  base package and build the rest of the compiled libraries in
  the main variant. This should speed up bootstrapping.
- boost-devel not built by default anymore.
- libboost_headers-devel now provides boost-devel for legacy
  dependencies. If you need compiled boost libraries depend on
  the current compiled devel subpackage.
- run %fdupes only on the header files and documentation
- drop build dependencies on gcc-fortran, chrpath.</changelog>
  <changelog author="jmatejek@suse.com" date="1508846400">- build Python 2 conditionally</changelog>
  <changelog author="adam.majer@suse.de" date="1511956800">- re-enable Python 2 by default. It's still conditional, but
  remains enabled by default. This can be disabled in project
  config.</changelog>
  <changelog author="adam.majer@suse.de" date="1513598400">- Update to version 1.66.0
  + Beast: new portable HTTP, WebSocket and network operations
    using Boost.Asio. Header-only library.
  + Callable Traits: new library and successor to
    Boost.FunctionTypes. Header-only library.
  + Mp11: new metaprogramming library
  + Asio:
  * implemented interface changes to reflect the Networking TS
    (N4656)
  * functions and classes that have been superseded by
    Networking TS functionality have been deprecated.
  * added support for customized handler tracking
  * removed previously deprecated functions
  + Atomic: improved compatibility with GCC 7. 128-bit operations
    on x86_64 no longer require linking with compiled library.
  + DateTime: Fixed an integral overflow that could cause incorrect
    results when adding or subtracting many years from a date.
  + Format: New format specifiers added and volatile arguments
    can not be safely used with operator%
  + Fusion:
  * fix compile error with std::array
  * remove circular preprocessor include
  + PolyCollection: backported to GCC 4.8 and 4.9 with some
    limitations
  + Uuid: added RTF-4122 namespaces in boost::uuids::ns
  + for complete changelog, see
    http://www.boost.org/users/history/version_1_66_0.html
- refreshed patches: boost-rpmoptflags-only.patch</changelog>
  <changelog author="adam.majer@suse.de" date="1516363200">- Multibuild requires versioned Name: tag and doesn't seem to do
  this automatically. (bnc#1076640)</changelog>
  <changelog author="kukuk@suse.de" date="1522843200">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="adam.majer@suse.de" date="1584619200">- libreoffice_compat_backports.patch: add a backport of
  Boost.Optional::has_value() for LibreOffice</changelog>
  <changelog author="adam.majer@suse.de" date="1641816000">- variant.patch: backport fix allowing perfect forwarding in
  apply_visitor. Also fix wrong usage of boost::move (bsc#1194522)</changelog>
</package>
<package pkgid="d022ad473d791844cdfc1eafefcebad01a6446a7a557d888cfba03b19b226b0a" name="libboost_numpy-py2_7-1_66_0-devel" arch="x86_64">
  <version epoch="0" ver="1.66.0" rel="12.3.1"/>
  <changelog author="adam.majer@suse.de" date="1478606400">- Revert upstream change that set default python version and
  ignored user configuration.
  python-2059618.patch (boo#1006584)</changelog>
  <changelog author="adam.majer@suse.de" date="1483531200">- update to version 1.63.0
  * updated libraries: atomic, container, context, fiber,
    fusion, geometry, hash, interprocess, intrusive, lexical cast,
    log, metaparse, move, optional, phoenix, python, test,
    typeindex, units, unordered
  * see http://www.boost.org/users/history/version_1_63_0.html
    for complete list of changes
- refresh patches
  * boost-1.55.0-python-test-PyImport_AppendInittab.patch
  * boost-strict_aliasing.patch, and enable -fno-strict-aliasing
    for python module
- baselibs.conf:
  * add libboost_locale
  * rename python to include new soname
- remove python-2059618.patch, not needed
- make build condition --without buil_mpi work
- allow building without python3 bindings, for SLE11SP4
- remove versioned build dependency on libicu-devel, apparently
  not needed.
- split out the boost-devel package into individudal compiled
  libraries and their -devel subpackages and libboost_headers-devel
  package for header-only libraries.
- remove all the -mt.so symlinks, probably not needed anymore.
- ship MPI python bindings for both Python 2.7 and 3.x
  * add python_mpi.patch to allow proper compiled library loading
- dynamic_linking.patch: first attempt to remove static library
  generation during build process.</changelog>
  <changelog author="adam.majer@suse.de" date="1484481600">- remove non-existent dependency in the boost mpi python package</changelog>
  <changelog author="adam.majer@suse.de" date="1484654400">- test_lowcase.patch: downcase Boost::Test usage of uppercase
  variables. VERSION was clashing with GNU Autotools define
  resulting in compilation errors of various packages.
- recombine headers from various devel subpackages under the
  libboost_headers-devel package. Not all usage of headers that
  have compiled parts pull in their associated compiled symbols.
- general cleanup of the spec file from old, commented stuffs</changelog>
  <changelog author="adam.majer@suse.de" date="1485345600">- Fix dependency typos.</changelog>
  <changelog author="adam.majer@suse.de" date="1486123200">- baselibs.conf: (re)add python 2.7 and 3.x libraries</changelog>
  <changelog author="jmatejek@suse.com" date="1486728000">- update python macros</changelog>
  <changelog author="adam.majer@suse.de" date="1492689600">- New upstream version 1.64.0
  + process - new library providing cross platform methods to
  - create child processes
  - setup stream for child processes
  - sync and async communication streams with children
  - sync and async wait
  - process termination
  + geometry library had some breaking changes,
  - ublas_transformer is renamed to matrix_transformer
  - explicit modifier is added to constructors of rtree
    index::dynamic_* parameters
  - strategy::area::huiller replaced by strategy::area::spherical
  + context library updates
  - deprecated API:execution-context
  - fixed bad assembly for fcontext on ppc64/sysv/elf
  + Updated libraries: any, atomic, config, container, context,
    conversion, core, coroutine2, fiber, hash, interprocess,
    intrusive, lexicalcast, math, multi-index containers,
    multiprecision, predef, program options, regex, smart pointers,
    test ,typeindex, typetraits, unordered, variant
  + for details, see
    http://www.boost.org/users/history/version_1_64_0.html
- Build PyNumpy module
  + add build requires on python-numpy
- test_lowcase.patch: upstreamed
- refreshed patches: boost-strict_aliasing.patch, gcc_path.patch,
  python_mpi.patch
- mpi_upstream.patch: pending upstream fixes to OpenMPI build
- python_library_name.patch: we are building python versions in
  different stagings so drop library renames.
- python_numpy_retfunc.patch: rpmlint fixes</changelog>
  <changelog author="adam.majer@suse.de" date="1494244800">- make python-numpy optional build dependency
- fix building of mpi python3 plugin</changelog>
  <changelog author="adam.majer@suse.de" date="1494331200">- 1d862615.patch: Fix regression caused by refactoring of
  serialization code (bnc#1038083)</changelog>
  <changelog author="adam.majer@suse.de" date="1505908800">- New upstream version 1.65.1
  + config, fiber - Return a continuation from functions executed
    by resume_with.
  + stacktrace - Change preprocessor file extensions to work with
    the installation system.
- Changes in version 1.65.0
  + stacktrace - new library providing call sequence in human
    readable format.
  + polycollection - new library providing fast containers of
    polymorphic objects, from Joaquín M López Muñoz.
  + For full list of changes, see
    http://www.boost.org/users/history/version_1_65_1.html
- 1d862615.patch: upstreamed and removed
- gcc_path.patch: obsolete, tr1 module is removed
- mpi_upstream.patch: upstreamed and removed
- boost-1.57.0-python-abi_letters.patch: refreshed
- python_library_name.patch: refreshed and reverted upstream
  changes to mpi/build/Jamfile as we are building python2 and
  python3 versions of MPI separately.
- baselibs.conf
  + add libboost_stracktrace
  + update to version 1.65.1</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1507550400">- Setup MPI environment prior to building boost.
- Switch to OpenMPI2 as OpenMPI1 is becoming deprecated.</changelog>
  <changelog author="adam.majer@suse.de" date="1507636800">- Use multibuild setup - build no-dependency libraries in the
  base package and build the rest of the compiled libraries in
  the main variant. This should speed up bootstrapping.
- boost-devel not built by default anymore.
- libboost_headers-devel now provides boost-devel for legacy
  dependencies. If you need compiled boost libraries depend on
  the current compiled devel subpackage.
- run %fdupes only on the header files and documentation
- drop build dependencies on gcc-fortran, chrpath.</changelog>
  <changelog author="jmatejek@suse.com" date="1508846400">- build Python 2 conditionally</changelog>
  <changelog author="adam.majer@suse.de" date="1511956800">- re-enable Python 2 by default. It's still conditional, but
  remains enabled by default. This can be disabled in project
  config.</changelog>
  <changelog author="adam.majer@suse.de" date="1513598400">- Update to version 1.66.0
  + Beast: new portable HTTP, WebSocket and network operations
    using Boost.Asio. Header-only library.
  + Callable Traits: new library and successor to
    Boost.FunctionTypes. Header-only library.
  + Mp11: new metaprogramming library
  + Asio:
  * implemented interface changes to reflect the Networking TS
    (N4656)
  * functions and classes that have been superseded by
    Networking TS functionality have been deprecated.
  * added support for customized handler tracking
  * removed previously deprecated functions
  + Atomic: improved compatibility with GCC 7. 128-bit operations
    on x86_64 no longer require linking with compiled library.
  + DateTime: Fixed an integral overflow that could cause incorrect
    results when adding or subtracting many years from a date.
  + Format: New format specifiers added and volatile arguments
    can not be safely used with operator%
  + Fusion:
  * fix compile error with std::array
  * remove circular preprocessor include
  + PolyCollection: backported to GCC 4.8 and 4.9 with some
    limitations
  + Uuid: added RTF-4122 namespaces in boost::uuids::ns
  + for complete changelog, see
    http://www.boost.org/users/history/version_1_66_0.html
- refreshed patches: boost-rpmoptflags-only.patch</changelog>
  <changelog author="adam.majer@suse.de" date="1516363200">- Multibuild requires versioned Name: tag and doesn't seem to do
  this automatically. (bnc#1076640)</changelog>
  <changelog author="kukuk@suse.de" date="1522843200">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="adam.majer@suse.de" date="1584619200">- libreoffice_compat_backports.patch: add a backport of
  Boost.Optional::has_value() for LibreOffice</changelog>
  <changelog author="adam.majer@suse.de" date="1641816000">- variant.patch: backport fix allowing perfect forwarding in
  apply_visitor. Also fix wrong usage of boost::move (bsc#1194522)</changelog>
</package>
<package pkgid="4c97cf5e44b8beeb6655cebce200e9793effbc26e3ca222d09e78d5875512de2" name="libboost_python-py2_7-1_66_0" arch="aarch64">
  <version epoch="0" ver="1.66.0" rel="12.3.1"/>
  <changelog author="adam.majer@suse.de" date="1478606400">- Revert upstream change that set default python version and
  ignored user configuration.
  python-2059618.patch (boo#1006584)</changelog>
  <changelog author="adam.majer@suse.de" date="1483531200">- update to version 1.63.0
  * updated libraries: atomic, container, context, fiber,
    fusion, geometry, hash, interprocess, intrusive, lexical cast,
    log, metaparse, move, optional, phoenix, python, test,
    typeindex, units, unordered
  * see http://www.boost.org/users/history/version_1_63_0.html
    for complete list of changes
- refresh patches
  * boost-1.55.0-python-test-PyImport_AppendInittab.patch
  * boost-strict_aliasing.patch, and enable -fno-strict-aliasing
    for python module
- baselibs.conf:
  * add libboost_locale
  * rename python to include new soname
- remove python-2059618.patch, not needed
- make build condition --without buil_mpi work
- allow building without python3 bindings, for SLE11SP4
- remove versioned build dependency on libicu-devel, apparently
  not needed.
- split out the boost-devel package into individudal compiled
  libraries and their -devel subpackages and libboost_headers-devel
  package for header-only libraries.
- remove all the -mt.so symlinks, probably not needed anymore.
- ship MPI python bindings for both Python 2.7 and 3.x
  * add python_mpi.patch to allow proper compiled library loading
- dynamic_linking.patch: first attempt to remove static library
  generation during build process.</changelog>
  <changelog author="adam.majer@suse.de" date="1484481600">- remove non-existent dependency in the boost mpi python package</changelog>
  <changelog author="adam.majer@suse.de" date="1484654400">- test_lowcase.patch: downcase Boost::Test usage of uppercase
  variables. VERSION was clashing with GNU Autotools define
  resulting in compilation errors of various packages.
- recombine headers from various devel subpackages under the
  libboost_headers-devel package. Not all usage of headers that
  have compiled parts pull in their associated compiled symbols.
- general cleanup of the spec file from old, commented stuffs</changelog>
  <changelog author="adam.majer@suse.de" date="1485345600">- Fix dependency typos.</changelog>
  <changelog author="adam.majer@suse.de" date="1486123200">- baselibs.conf: (re)add python 2.7 and 3.x libraries</changelog>
  <changelog author="jmatejek@suse.com" date="1486728000">- update python macros</changelog>
  <changelog author="adam.majer@suse.de" date="1492689600">- New upstream version 1.64.0
  + process - new library providing cross platform methods to
  - create child processes
  - setup stream for child processes
  - sync and async communication streams with children
  - sync and async wait
  - process termination
  + geometry library had some breaking changes,
  - ublas_transformer is renamed to matrix_transformer
  - explicit modifier is added to constructors of rtree
    index::dynamic_* parameters
  - strategy::area::huiller replaced by strategy::area::spherical
  + context library updates
  - deprecated API:execution-context
  - fixed bad assembly for fcontext on ppc64/sysv/elf
  + Updated libraries: any, atomic, config, container, context,
    conversion, core, coroutine2, fiber, hash, interprocess,
    intrusive, lexicalcast, math, multi-index containers,
    multiprecision, predef, program options, regex, smart pointers,
    test ,typeindex, typetraits, unordered, variant
  + for details, see
    http://www.boost.org/users/history/version_1_64_0.html
- Build PyNumpy module
  + add build requires on python-numpy
- test_lowcase.patch: upstreamed
- refreshed patches: boost-strict_aliasing.patch, gcc_path.patch,
  python_mpi.patch
- mpi_upstream.patch: pending upstream fixes to OpenMPI build
- python_library_name.patch: we are building python versions in
  different stagings so drop library renames.
- python_numpy_retfunc.patch: rpmlint fixes</changelog>
  <changelog author="adam.majer@suse.de" date="1494244800">- make python-numpy optional build dependency
- fix building of mpi python3 plugin</changelog>
  <changelog author="adam.majer@suse.de" date="1494331200">- 1d862615.patch: Fix regression caused by refactoring of
  serialization code (bnc#1038083)</changelog>
  <changelog author="adam.majer@suse.de" date="1505908800">- New upstream version 1.65.1
  + config, fiber - Return a continuation from functions executed
    by resume_with.
  + stacktrace - Change preprocessor file extensions to work with
    the installation system.
- Changes in version 1.65.0
  + stacktrace - new library providing call sequence in human
    readable format.
  + polycollection - new library providing fast containers of
    polymorphic objects, from Joaquín M López Muñoz.
  + For full list of changes, see
    http://www.boost.org/users/history/version_1_65_1.html
- 1d862615.patch: upstreamed and removed
- gcc_path.patch: obsolete, tr1 module is removed
- mpi_upstream.patch: upstreamed and removed
- boost-1.57.0-python-abi_letters.patch: refreshed
- python_library_name.patch: refreshed and reverted upstream
  changes to mpi/build/Jamfile as we are building python2 and
  python3 versions of MPI separately.
- baselibs.conf
  + add libboost_stracktrace
  + update to version 1.65.1</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1507550400">- Setup MPI environment prior to building boost.
- Switch to OpenMPI2 as OpenMPI1 is becoming deprecated.</changelog>
  <changelog author="adam.majer@suse.de" date="1507636800">- Use multibuild setup - build no-dependency libraries in the
  base package and build the rest of the compiled libraries in
  the main variant. This should speed up bootstrapping.
- boost-devel not built by default anymore.
- libboost_headers-devel now provides boost-devel for legacy
  dependencies. If you need compiled boost libraries depend on
  the current compiled devel subpackage.
- run %fdupes only on the header files and documentation
- drop build dependencies on gcc-fortran, chrpath.</changelog>
  <changelog author="jmatejek@suse.com" date="1508846400">- build Python 2 conditionally</changelog>
  <changelog author="adam.majer@suse.de" date="1511956800">- re-enable Python 2 by default. It's still conditional, but
  remains enabled by default. This can be disabled in project
  config.</changelog>
  <changelog author="adam.majer@suse.de" date="1513598400">- Update to version 1.66.0
  + Beast: new portable HTTP, WebSocket and network operations
    using Boost.Asio. Header-only library.
  + Callable Traits: new library and successor to
    Boost.FunctionTypes. Header-only library.
  + Mp11: new metaprogramming library
  + Asio:
  * implemented interface changes to reflect the Networking TS
    (N4656)
  * functions and classes that have been superseded by
    Networking TS functionality have been deprecated.
  * added support for customized handler tracking
  * removed previously deprecated functions
  + Atomic: improved compatibility with GCC 7. 128-bit operations
    on x86_64 no longer require linking with compiled library.
  + DateTime: Fixed an integral overflow that could cause incorrect
    results when adding or subtracting many years from a date.
  + Format: New format specifiers added and volatile arguments
    can not be safely used with operator%
  + Fusion:
  * fix compile error with std::array
  * remove circular preprocessor include
  + PolyCollection: backported to GCC 4.8 and 4.9 with some
    limitations
  + Uuid: added RTF-4122 namespaces in boost::uuids::ns
  + for complete changelog, see
    http://www.boost.org/users/history/version_1_66_0.html
- refreshed patches: boost-rpmoptflags-only.patch</changelog>
  <changelog author="adam.majer@suse.de" date="1516363200">- Multibuild requires versioned Name: tag and doesn't seem to do
  this automatically. (bnc#1076640)</changelog>
  <changelog author="kukuk@suse.de" date="1522843200">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="adam.majer@suse.de" date="1584619200">- libreoffice_compat_backports.patch: add a backport of
  Boost.Optional::has_value() for LibreOffice</changelog>
  <changelog author="adam.majer@suse.de" date="1641816000">- variant.patch: backport fix allowing perfect forwarding in
  apply_visitor. Also fix wrong usage of boost::move (bsc#1194522)</changelog>
</package>
<package pkgid="7d643910a5b7c8134a2548fc4ad5c765c1d03a8d7a466d17ac5645c3da7de886" name="libboost_python-py2_7-1_66_0" arch="ppc64le">
  <version epoch="0" ver="1.66.0" rel="12.3.1"/>
  <changelog author="adam.majer@suse.de" date="1478606400">- Revert upstream change that set default python version and
  ignored user configuration.
  python-2059618.patch (boo#1006584)</changelog>
  <changelog author="adam.majer@suse.de" date="1483531200">- update to version 1.63.0
  * updated libraries: atomic, container, context, fiber,
    fusion, geometry, hash, interprocess, intrusive, lexical cast,
    log, metaparse, move, optional, phoenix, python, test,
    typeindex, units, unordered
  * see http://www.boost.org/users/history/version_1_63_0.html
    for complete list of changes
- refresh patches
  * boost-1.55.0-python-test-PyImport_AppendInittab.patch
  * boost-strict_aliasing.patch, and enable -fno-strict-aliasing
    for python module
- baselibs.conf:
  * add libboost_locale
  * rename python to include new soname
- remove python-2059618.patch, not needed
- make build condition --without buil_mpi work
- allow building without python3 bindings, for SLE11SP4
- remove versioned build dependency on libicu-devel, apparently
  not needed.
- split out the boost-devel package into individudal compiled
  libraries and their -devel subpackages and libboost_headers-devel
  package for header-only libraries.
- remove all the -mt.so symlinks, probably not needed anymore.
- ship MPI python bindings for both Python 2.7 and 3.x
  * add python_mpi.patch to allow proper compiled library loading
- dynamic_linking.patch: first attempt to remove static library
  generation during build process.</changelog>
  <changelog author="adam.majer@suse.de" date="1484481600">- remove non-existent dependency in the boost mpi python package</changelog>
  <changelog author="adam.majer@suse.de" date="1484654400">- test_lowcase.patch: downcase Boost::Test usage of uppercase
  variables. VERSION was clashing with GNU Autotools define
  resulting in compilation errors of various packages.
- recombine headers from various devel subpackages under the
  libboost_headers-devel package. Not all usage of headers that
  have compiled parts pull in their associated compiled symbols.
- general cleanup of the spec file from old, commented stuffs</changelog>
  <changelog author="adam.majer@suse.de" date="1485345600">- Fix dependency typos.</changelog>
  <changelog author="adam.majer@suse.de" date="1486123200">- baselibs.conf: (re)add python 2.7 and 3.x libraries</changelog>
  <changelog author="jmatejek@suse.com" date="1486728000">- update python macros</changelog>
  <changelog author="adam.majer@suse.de" date="1492689600">- New upstream version 1.64.0
  + process - new library providing cross platform methods to
  - create child processes
  - setup stream for child processes
  - sync and async communication streams with children
  - sync and async wait
  - process termination
  + geometry library had some breaking changes,
  - ublas_transformer is renamed to matrix_transformer
  - explicit modifier is added to constructors of rtree
    index::dynamic_* parameters
  - strategy::area::huiller replaced by strategy::area::spherical
  + context library updates
  - deprecated API:execution-context
  - fixed bad assembly for fcontext on ppc64/sysv/elf
  + Updated libraries: any, atomic, config, container, context,
    conversion, core, coroutine2, fiber, hash, interprocess,
    intrusive, lexicalcast, math, multi-index containers,
    multiprecision, predef, program options, regex, smart pointers,
    test ,typeindex, typetraits, unordered, variant
  + for details, see
    http://www.boost.org/users/history/version_1_64_0.html
- Build PyNumpy module
  + add build requires on python-numpy
- test_lowcase.patch: upstreamed
- refreshed patches: boost-strict_aliasing.patch, gcc_path.patch,
  python_mpi.patch
- mpi_upstream.patch: pending upstream fixes to OpenMPI build
- python_library_name.patch: we are building python versions in
  different stagings so drop library renames.
- python_numpy_retfunc.patch: rpmlint fixes</changelog>
  <changelog author="adam.majer@suse.de" date="1494244800">- make python-numpy optional build dependency
- fix building of mpi python3 plugin</changelog>
  <changelog author="adam.majer@suse.de" date="1494331200">- 1d862615.patch: Fix regression caused by refactoring of
  serialization code (bnc#1038083)</changelog>
  <changelog author="adam.majer@suse.de" date="1505908800">- New upstream version 1.65.1
  + config, fiber - Return a continuation from functions executed
    by resume_with.
  + stacktrace - Change preprocessor file extensions to work with
    the installation system.
- Changes in version 1.65.0
  + stacktrace - new library providing call sequence in human
    readable format.
  + polycollection - new library providing fast containers of
    polymorphic objects, from Joaquín M López Muñoz.
  + For full list of changes, see
    http://www.boost.org/users/history/version_1_65_1.html
- 1d862615.patch: upstreamed and removed
- gcc_path.patch: obsolete, tr1 module is removed
- mpi_upstream.patch: upstreamed and removed
- boost-1.57.0-python-abi_letters.patch: refreshed
- python_library_name.patch: refreshed and reverted upstream
  changes to mpi/build/Jamfile as we are building python2 and
  python3 versions of MPI separately.
- baselibs.conf
  + add libboost_stracktrace
  + update to version 1.65.1</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1507550400">- Setup MPI environment prior to building boost.
- Switch to OpenMPI2 as OpenMPI1 is becoming deprecated.</changelog>
  <changelog author="adam.majer@suse.de" date="1507636800">- Use multibuild setup - build no-dependency libraries in the
  base package and build the rest of the compiled libraries in
  the main variant. This should speed up bootstrapping.
- boost-devel not built by default anymore.
- libboost_headers-devel now provides boost-devel for legacy
  dependencies. If you need compiled boost libraries depend on
  the current compiled devel subpackage.
- run %fdupes only on the header files and documentation
- drop build dependencies on gcc-fortran, chrpath.</changelog>
  <changelog author="jmatejek@suse.com" date="1508846400">- build Python 2 conditionally</changelog>
  <changelog author="adam.majer@suse.de" date="1511956800">- re-enable Python 2 by default. It's still conditional, but
  remains enabled by default. This can be disabled in project
  config.</changelog>
  <changelog author="adam.majer@suse.de" date="1513598400">- Update to version 1.66.0
  + Beast: new portable HTTP, WebSocket and network operations
    using Boost.Asio. Header-only library.
  + Callable Traits: new library and successor to
    Boost.FunctionTypes. Header-only library.
  + Mp11: new metaprogramming library
  + Asio:
  * implemented interface changes to reflect the Networking TS
    (N4656)
  * functions and classes that have been superseded by
    Networking TS functionality have been deprecated.
  * added support for customized handler tracking
  * removed previously deprecated functions
  + Atomic: improved compatibility with GCC 7. 128-bit operations
    on x86_64 no longer require linking with compiled library.
  + DateTime: Fixed an integral overflow that could cause incorrect
    results when adding or subtracting many years from a date.
  + Format: New format specifiers added and volatile arguments
    can not be safely used with operator%
  + Fusion:
  * fix compile error with std::array
  * remove circular preprocessor include
  + PolyCollection: backported to GCC 4.8 and 4.9 with some
    limitations
  + Uuid: added RTF-4122 namespaces in boost::uuids::ns
  + for complete changelog, see
    http://www.boost.org/users/history/version_1_66_0.html
- refreshed patches: boost-rpmoptflags-only.patch</changelog>
  <changelog author="adam.majer@suse.de" date="1516363200">- Multibuild requires versioned Name: tag and doesn't seem to do
  this automatically. (bnc#1076640)</changelog>
  <changelog author="kukuk@suse.de" date="1522843200">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="adam.majer@suse.de" date="1584619200">- libreoffice_compat_backports.patch: add a backport of
  Boost.Optional::has_value() for LibreOffice</changelog>
  <changelog author="adam.majer@suse.de" date="1641816000">- variant.patch: backport fix allowing perfect forwarding in
  apply_visitor. Also fix wrong usage of boost::move (bsc#1194522)</changelog>
</package>
<package pkgid="bfb1c89a61a6f10857fd19081cc6edad8fc2fff508c2ff97d9e2e2d777f9f780" name="libboost_python-py2_7-1_66_0" arch="s390x">
  <version epoch="0" ver="1.66.0" rel="12.3.1"/>
  <changelog author="adam.majer@suse.de" date="1478606400">- Revert upstream change that set default python version and
  ignored user configuration.
  python-2059618.patch (boo#1006584)</changelog>
  <changelog author="adam.majer@suse.de" date="1483531200">- update to version 1.63.0
  * updated libraries: atomic, container, context, fiber,
    fusion, geometry, hash, interprocess, intrusive, lexical cast,
    log, metaparse, move, optional, phoenix, python, test,
    typeindex, units, unordered
  * see http://www.boost.org/users/history/version_1_63_0.html
    for complete list of changes
- refresh patches
  * boost-1.55.0-python-test-PyImport_AppendInittab.patch
  * boost-strict_aliasing.patch, and enable -fno-strict-aliasing
    for python module
- baselibs.conf:
  * add libboost_locale
  * rename python to include new soname
- remove python-2059618.patch, not needed
- make build condition --without buil_mpi work
- allow building without python3 bindings, for SLE11SP4
- remove versioned build dependency on libicu-devel, apparently
  not needed.
- split out the boost-devel package into individudal compiled
  libraries and their -devel subpackages and libboost_headers-devel
  package for header-only libraries.
- remove all the -mt.so symlinks, probably not needed anymore.
- ship MPI python bindings for both Python 2.7 and 3.x
  * add python_mpi.patch to allow proper compiled library loading
- dynamic_linking.patch: first attempt to remove static library
  generation during build process.</changelog>
  <changelog author="adam.majer@suse.de" date="1484481600">- remove non-existent dependency in the boost mpi python package</changelog>
  <changelog author="adam.majer@suse.de" date="1484654400">- test_lowcase.patch: downcase Boost::Test usage of uppercase
  variables. VERSION was clashing with GNU Autotools define
  resulting in compilation errors of various packages.
- recombine headers from various devel subpackages under the
  libboost_headers-devel package. Not all usage of headers that
  have compiled parts pull in their associated compiled symbols.
- general cleanup of the spec file from old, commented stuffs</changelog>
  <changelog author="adam.majer@suse.de" date="1485345600">- Fix dependency typos.</changelog>
  <changelog author="adam.majer@suse.de" date="1486123200">- baselibs.conf: (re)add python 2.7 and 3.x libraries</changelog>
  <changelog author="jmatejek@suse.com" date="1486728000">- update python macros</changelog>
  <changelog author="adam.majer@suse.de" date="1492689600">- New upstream version 1.64.0
  + process - new library providing cross platform methods to
  - create child processes
  - setup stream for child processes
  - sync and async communication streams with children
  - sync and async wait
  - process termination
  + geometry library had some breaking changes,
  - ublas_transformer is renamed to matrix_transformer
  - explicit modifier is added to constructors of rtree
    index::dynamic_* parameters
  - strategy::area::huiller replaced by strategy::area::spherical
  + context library updates
  - deprecated API:execution-context
  - fixed bad assembly for fcontext on ppc64/sysv/elf
  + Updated libraries: any, atomic, config, container, context,
    conversion, core, coroutine2, fiber, hash, interprocess,
    intrusive, lexicalcast, math, multi-index containers,
    multiprecision, predef, program options, regex, smart pointers,
    test ,typeindex, typetraits, unordered, variant
  + for details, see
    http://www.boost.org/users/history/version_1_64_0.html
- Build PyNumpy module
  + add build requires on python-numpy
- test_lowcase.patch: upstreamed
- refreshed patches: boost-strict_aliasing.patch, gcc_path.patch,
  python_mpi.patch
- mpi_upstream.patch: pending upstream fixes to OpenMPI build
- python_library_name.patch: we are building python versions in
  different stagings so drop library renames.
- python_numpy_retfunc.patch: rpmlint fixes</changelog>
  <changelog author="adam.majer@suse.de" date="1494244800">- make python-numpy optional build dependency
- fix building of mpi python3 plugin</changelog>
  <changelog author="adam.majer@suse.de" date="1494331200">- 1d862615.patch: Fix regression caused by refactoring of
  serialization code (bnc#1038083)</changelog>
  <changelog author="adam.majer@suse.de" date="1505908800">- New upstream version 1.65.1
  + config, fiber - Return a continuation from functions executed
    by resume_with.
  + stacktrace - Change preprocessor file extensions to work with
    the installation system.
- Changes in version 1.65.0
  + stacktrace - new library providing call sequence in human
    readable format.
  + polycollection - new library providing fast containers of
    polymorphic objects, from Joaquín M López Muñoz.
  + For full list of changes, see
    http://www.boost.org/users/history/version_1_65_1.html
- 1d862615.patch: upstreamed and removed
- gcc_path.patch: obsolete, tr1 module is removed
- mpi_upstream.patch: upstreamed and removed
- boost-1.57.0-python-abi_letters.patch: refreshed
- python_library_name.patch: refreshed and reverted upstream
  changes to mpi/build/Jamfile as we are building python2 and
  python3 versions of MPI separately.
- baselibs.conf
  + add libboost_stracktrace
  + update to version 1.65.1</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1507550400">- Setup MPI environment prior to building boost.
- Switch to OpenMPI2 as OpenMPI1 is becoming deprecated.</changelog>
  <changelog author="adam.majer@suse.de" date="1507636800">- Use multibuild setup - build no-dependency libraries in the
  base package and build the rest of the compiled libraries in
  the main variant. This should speed up bootstrapping.
- boost-devel not built by default anymore.
- libboost_headers-devel now provides boost-devel for legacy
  dependencies. If you need compiled boost libraries depend on
  the current compiled devel subpackage.
- run %fdupes only on the header files and documentation
- drop build dependencies on gcc-fortran, chrpath.</changelog>
  <changelog author="jmatejek@suse.com" date="1508846400">- build Python 2 conditionally</changelog>
  <changelog author="adam.majer@suse.de" date="1511956800">- re-enable Python 2 by default. It's still conditional, but
  remains enabled by default. This can be disabled in project
  config.</changelog>
  <changelog author="adam.majer@suse.de" date="1513598400">- Update to version 1.66.0
  + Beast: new portable HTTP, WebSocket and network operations
    using Boost.Asio. Header-only library.
  + Callable Traits: new library and successor to
    Boost.FunctionTypes. Header-only library.
  + Mp11: new metaprogramming library
  + Asio:
  * implemented interface changes to reflect the Networking TS
    (N4656)
  * functions and classes that have been superseded by
    Networking TS functionality have been deprecated.
  * added support for customized handler tracking
  * removed previously deprecated functions
  + Atomic: improved compatibility with GCC 7. 128-bit operations
    on x86_64 no longer require linking with compiled library.
  + DateTime: Fixed an integral overflow that could cause incorrect
    results when adding or subtracting many years from a date.
  + Format: New format specifiers added and volatile arguments
    can not be safely used with operator%
  + Fusion:
  * fix compile error with std::array
  * remove circular preprocessor include
  + PolyCollection: backported to GCC 4.8 and 4.9 with some
    limitations
  + Uuid: added RTF-4122 namespaces in boost::uuids::ns
  + for complete changelog, see
    http://www.boost.org/users/history/version_1_66_0.html
- refreshed patches: boost-rpmoptflags-only.patch</changelog>
  <changelog author="adam.majer@suse.de" date="1516363200">- Multibuild requires versioned Name: tag and doesn't seem to do
  this automatically. (bnc#1076640)</changelog>
  <changelog author="kukuk@suse.de" date="1522843200">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="adam.majer@suse.de" date="1584619200">- libreoffice_compat_backports.patch: add a backport of
  Boost.Optional::has_value() for LibreOffice</changelog>
  <changelog author="adam.majer@suse.de" date="1641816000">- variant.patch: backport fix allowing perfect forwarding in
  apply_visitor. Also fix wrong usage of boost::move (bsc#1194522)</changelog>
</package>
<package pkgid="342c0e3a8ca835f6eb619d8fd15e9370a776f5db63e166652e044e19435e68f2" name="libboost_python-py2_7-1_66_0" arch="x86_64">
  <version epoch="0" ver="1.66.0" rel="12.3.1"/>
  <changelog author="adam.majer@suse.de" date="1478606400">- Revert upstream change that set default python version and
  ignored user configuration.
  python-2059618.patch (boo#1006584)</changelog>
  <changelog author="adam.majer@suse.de" date="1483531200">- update to version 1.63.0
  * updated libraries: atomic, container, context, fiber,
    fusion, geometry, hash, interprocess, intrusive, lexical cast,
    log, metaparse, move, optional, phoenix, python, test,
    typeindex, units, unordered
  * see http://www.boost.org/users/history/version_1_63_0.html
    for complete list of changes
- refresh patches
  * boost-1.55.0-python-test-PyImport_AppendInittab.patch
  * boost-strict_aliasing.patch, and enable -fno-strict-aliasing
    for python module
- baselibs.conf:
  * add libboost_locale
  * rename python to include new soname
- remove python-2059618.patch, not needed
- make build condition --without buil_mpi work
- allow building without python3 bindings, for SLE11SP4
- remove versioned build dependency on libicu-devel, apparently
  not needed.
- split out the boost-devel package into individudal compiled
  libraries and their -devel subpackages and libboost_headers-devel
  package for header-only libraries.
- remove all the -mt.so symlinks, probably not needed anymore.
- ship MPI python bindings for both Python 2.7 and 3.x
  * add python_mpi.patch to allow proper compiled library loading
- dynamic_linking.patch: first attempt to remove static library
  generation during build process.</changelog>
  <changelog author="adam.majer@suse.de" date="1484481600">- remove non-existent dependency in the boost mpi python package</changelog>
  <changelog author="adam.majer@suse.de" date="1484654400">- test_lowcase.patch: downcase Boost::Test usage of uppercase
  variables. VERSION was clashing with GNU Autotools define
  resulting in compilation errors of various packages.
- recombine headers from various devel subpackages under the
  libboost_headers-devel package. Not all usage of headers that
  have compiled parts pull in their associated compiled symbols.
- general cleanup of the spec file from old, commented stuffs</changelog>
  <changelog author="adam.majer@suse.de" date="1485345600">- Fix dependency typos.</changelog>
  <changelog author="adam.majer@suse.de" date="1486123200">- baselibs.conf: (re)add python 2.7 and 3.x libraries</changelog>
  <changelog author="jmatejek@suse.com" date="1486728000">- update python macros</changelog>
  <changelog author="adam.majer@suse.de" date="1492689600">- New upstream version 1.64.0
  + process - new library providing cross platform methods to
  - create child processes
  - setup stream for child processes
  - sync and async communication streams with children
  - sync and async wait
  - process termination
  + geometry library had some breaking changes,
  - ublas_transformer is renamed to matrix_transformer
  - explicit modifier is added to constructors of rtree
    index::dynamic_* parameters
  - strategy::area::huiller replaced by strategy::area::spherical
  + context library updates
  - deprecated API:execution-context
  - fixed bad assembly for fcontext on ppc64/sysv/elf
  + Updated libraries: any, atomic, config, container, context,
    conversion, core, coroutine2, fiber, hash, interprocess,
    intrusive, lexicalcast, math, multi-index containers,
    multiprecision, predef, program options, regex, smart pointers,
    test ,typeindex, typetraits, unordered, variant
  + for details, see
    http://www.boost.org/users/history/version_1_64_0.html
- Build PyNumpy module
  + add build requires on python-numpy
- test_lowcase.patch: upstreamed
- refreshed patches: boost-strict_aliasing.patch, gcc_path.patch,
  python_mpi.patch
- mpi_upstream.patch: pending upstream fixes to OpenMPI build
- python_library_name.patch: we are building python versions in
  different stagings so drop library renames.
- python_numpy_retfunc.patch: rpmlint fixes</changelog>
  <changelog author="adam.majer@suse.de" date="1494244800">- make python-numpy optional build dependency
- fix building of mpi python3 plugin</changelog>
  <changelog author="adam.majer@suse.de" date="1494331200">- 1d862615.patch: Fix regression caused by refactoring of
  serialization code (bnc#1038083)</changelog>
  <changelog author="adam.majer@suse.de" date="1505908800">- New upstream version 1.65.1
  + config, fiber - Return a continuation from functions executed
    by resume_with.
  + stacktrace - Change preprocessor file extensions to work with
    the installation system.
- Changes in version 1.65.0
  + stacktrace - new library providing call sequence in human
    readable format.
  + polycollection - new library providing fast containers of
    polymorphic objects, from Joaquín M López Muñoz.
  + For full list of changes, see
    http://www.boost.org/users/history/version_1_65_1.html
- 1d862615.patch: upstreamed and removed
- gcc_path.patch: obsolete, tr1 module is removed
- mpi_upstream.patch: upstreamed and removed
- boost-1.57.0-python-abi_letters.patch: refreshed
- python_library_name.patch: refreshed and reverted upstream
  changes to mpi/build/Jamfile as we are building python2 and
  python3 versions of MPI separately.
- baselibs.conf
  + add libboost_stracktrace
  + update to version 1.65.1</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1507550400">- Setup MPI environment prior to building boost.
- Switch to OpenMPI2 as OpenMPI1 is becoming deprecated.</changelog>
  <changelog author="adam.majer@suse.de" date="1507636800">- Use multibuild setup - build no-dependency libraries in the
  base package and build the rest of the compiled libraries in
  the main variant. This should speed up bootstrapping.
- boost-devel not built by default anymore.
- libboost_headers-devel now provides boost-devel for legacy
  dependencies. If you need compiled boost libraries depend on
  the current compiled devel subpackage.
- run %fdupes only on the header files and documentation
- drop build dependencies on gcc-fortran, chrpath.</changelog>
  <changelog author="jmatejek@suse.com" date="1508846400">- build Python 2 conditionally</changelog>
  <changelog author="adam.majer@suse.de" date="1511956800">- re-enable Python 2 by default. It's still conditional, but
  remains enabled by default. This can be disabled in project
  config.</changelog>
  <changelog author="adam.majer@suse.de" date="1513598400">- Update to version 1.66.0
  + Beast: new portable HTTP, WebSocket and network operations
    using Boost.Asio. Header-only library.
  + Callable Traits: new library and successor to
    Boost.FunctionTypes. Header-only library.
  + Mp11: new metaprogramming library
  + Asio:
  * implemented interface changes to reflect the Networking TS
    (N4656)
  * functions and classes that have been superseded by
    Networking TS functionality have been deprecated.
  * added support for customized handler tracking
  * removed previously deprecated functions
  + Atomic: improved compatibility with GCC 7. 128-bit operations
    on x86_64 no longer require linking with compiled library.
  + DateTime: Fixed an integral overflow that could cause incorrect
    results when adding or subtracting many years from a date.
  + Format: New format specifiers added and volatile arguments
    can not be safely used with operator%
  + Fusion:
  * fix compile error with std::array
  * remove circular preprocessor include
  + PolyCollection: backported to GCC 4.8 and 4.9 with some
    limitations
  + Uuid: added RTF-4122 namespaces in boost::uuids::ns
  + for complete changelog, see
    http://www.boost.org/users/history/version_1_66_0.html
- refreshed patches: boost-rpmoptflags-only.patch</changelog>
  <changelog author="adam.majer@suse.de" date="1516363200">- Multibuild requires versioned Name: tag and doesn't seem to do
  this automatically. (bnc#1076640)</changelog>
  <changelog author="kukuk@suse.de" date="1522843200">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="adam.majer@suse.de" date="1584619200">- libreoffice_compat_backports.patch: add a backport of
  Boost.Optional::has_value() for LibreOffice</changelog>
  <changelog author="adam.majer@suse.de" date="1641816000">- variant.patch: backport fix allowing perfect forwarding in
  apply_visitor. Also fix wrong usage of boost::move (bsc#1194522)</changelog>
</package>
<package pkgid="965d421702b62510ef17f746ce07178129f8d610f6a62a5a7243725dc812cd81" name="libboost_python-py2_7-1_66_0-32bit" arch="x86_64">
  <version epoch="0" ver="1.66.0" rel="12.3.1"/>
  <changelog author="adam.majer@suse.de" date="1478606400">- Revert upstream change that set default python version and
  ignored user configuration.
  python-2059618.patch (boo#1006584)</changelog>
  <changelog author="adam.majer@suse.de" date="1483531200">- update to version 1.63.0
  * updated libraries: atomic, container, context, fiber,
    fusion, geometry, hash, interprocess, intrusive, lexical cast,
    log, metaparse, move, optional, phoenix, python, test,
    typeindex, units, unordered
  * see http://www.boost.org/users/history/version_1_63_0.html
    for complete list of changes
- refresh patches
  * boost-1.55.0-python-test-PyImport_AppendInittab.patch
  * boost-strict_aliasing.patch, and enable -fno-strict-aliasing
    for python module
- baselibs.conf:
  * add libboost_locale
  * rename python to include new soname
- remove python-2059618.patch, not needed
- make build condition --without buil_mpi work
- allow building without python3 bindings, for SLE11SP4
- remove versioned build dependency on libicu-devel, apparently
  not needed.
- split out the boost-devel package into individudal compiled
  libraries and their -devel subpackages and libboost_headers-devel
  package for header-only libraries.
- remove all the -mt.so symlinks, probably not needed anymore.
- ship MPI python bindings for both Python 2.7 and 3.x
  * add python_mpi.patch to allow proper compiled library loading
- dynamic_linking.patch: first attempt to remove static library
  generation during build process.</changelog>
  <changelog author="adam.majer@suse.de" date="1484481600">- remove non-existent dependency in the boost mpi python package</changelog>
  <changelog author="adam.majer@suse.de" date="1484654400">- test_lowcase.patch: downcase Boost::Test usage of uppercase
  variables. VERSION was clashing with GNU Autotools define
  resulting in compilation errors of various packages.
- recombine headers from various devel subpackages under the
  libboost_headers-devel package. Not all usage of headers that
  have compiled parts pull in their associated compiled symbols.
- general cleanup of the spec file from old, commented stuffs</changelog>
  <changelog author="adam.majer@suse.de" date="1485345600">- Fix dependency typos.</changelog>
  <changelog author="adam.majer@suse.de" date="1486123200">- baselibs.conf: (re)add python 2.7 and 3.x libraries</changelog>
  <changelog author="jmatejek@suse.com" date="1486728000">- update python macros</changelog>
  <changelog author="adam.majer@suse.de" date="1492689600">- New upstream version 1.64.0
  + process - new library providing cross platform methods to
  - create child processes
  - setup stream for child processes
  - sync and async communication streams with children
  - sync and async wait
  - process termination
  + geometry library had some breaking changes,
  - ublas_transformer is renamed to matrix_transformer
  - explicit modifier is added to constructors of rtree
    index::dynamic_* parameters
  - strategy::area::huiller replaced by strategy::area::spherical
  + context library updates
  - deprecated API:execution-context
  - fixed bad assembly for fcontext on ppc64/sysv/elf
  + Updated libraries: any, atomic, config, container, context,
    conversion, core, coroutine2, fiber, hash, interprocess,
    intrusive, lexicalcast, math, multi-index containers,
    multiprecision, predef, program options, regex, smart pointers,
    test ,typeindex, typetraits, unordered, variant
  + for details, see
    http://www.boost.org/users/history/version_1_64_0.html
- Build PyNumpy module
  + add build requires on python-numpy
- test_lowcase.patch: upstreamed
- refreshed patches: boost-strict_aliasing.patch, gcc_path.patch,
  python_mpi.patch
- mpi_upstream.patch: pending upstream fixes to OpenMPI build
- python_library_name.patch: we are building python versions in
  different stagings so drop library renames.
- python_numpy_retfunc.patch: rpmlint fixes</changelog>
  <changelog author="adam.majer@suse.de" date="1494244800">- make python-numpy optional build dependency
- fix building of mpi python3 plugin</changelog>
  <changelog author="adam.majer@suse.de" date="1494331200">- 1d862615.patch: Fix regression caused by refactoring of
  serialization code (bnc#1038083)</changelog>
  <changelog author="adam.majer@suse.de" date="1505908800">- New upstream version 1.65.1
  + config, fiber - Return a continuation from functions executed
    by resume_with.
  + stacktrace - Change preprocessor file extensions to work with
    the installation system.
- Changes in version 1.65.0
  + stacktrace - new library providing call sequence in human
    readable format.
  + polycollection - new library providing fast containers of
    polymorphic objects, from Joaquín M López Muñoz.
  + For full list of changes, see
    http://www.boost.org/users/history/version_1_65_1.html
- 1d862615.patch: upstreamed and removed
- gcc_path.patch: obsolete, tr1 module is removed
- mpi_upstream.patch: upstreamed and removed
- boost-1.57.0-python-abi_letters.patch: refreshed
- python_library_name.patch: refreshed and reverted upstream
  changes to mpi/build/Jamfile as we are building python2 and
  python3 versions of MPI separately.
- baselibs.conf
  + add libboost_stracktrace
  + update to version 1.65.1</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1507550400">- Setup MPI environment prior to building boost.
- Switch to OpenMPI2 as OpenMPI1 is becoming deprecated.</changelog>
  <changelog author="adam.majer@suse.de" date="1507636800">- Use multibuild setup - build no-dependency libraries in the
  base package and build the rest of the compiled libraries in
  the main variant. This should speed up bootstrapping.
- boost-devel not built by default anymore.
- libboost_headers-devel now provides boost-devel for legacy
  dependencies. If you need compiled boost libraries depend on
  the current compiled devel subpackage.
- run %fdupes only on the header files and documentation
- drop build dependencies on gcc-fortran, chrpath.</changelog>
  <changelog author="jmatejek@suse.com" date="1508846400">- build Python 2 conditionally</changelog>
  <changelog author="adam.majer@suse.de" date="1511956800">- re-enable Python 2 by default. It's still conditional, but
  remains enabled by default. This can be disabled in project
  config.</changelog>
  <changelog author="adam.majer@suse.de" date="1513598400">- Update to version 1.66.0
  + Beast: new portable HTTP, WebSocket and network operations
    using Boost.Asio. Header-only library.
  + Callable Traits: new library and successor to
    Boost.FunctionTypes. Header-only library.
  + Mp11: new metaprogramming library
  + Asio:
  * implemented interface changes to reflect the Networking TS
    (N4656)
  * functions and classes that have been superseded by
    Networking TS functionality have been deprecated.
  * added support for customized handler tracking
  * removed previously deprecated functions
  + Atomic: improved compatibility with GCC 7. 128-bit operations
    on x86_64 no longer require linking with compiled library.
  + DateTime: Fixed an integral overflow that could cause incorrect
    results when adding or subtracting many years from a date.
  + Format: New format specifiers added and volatile arguments
    can not be safely used with operator%
  + Fusion:
  * fix compile error with std::array
  * remove circular preprocessor include
  + PolyCollection: backported to GCC 4.8 and 4.9 with some
    limitations
  + Uuid: added RTF-4122 namespaces in boost::uuids::ns
  + for complete changelog, see
    http://www.boost.org/users/history/version_1_66_0.html
- refreshed patches: boost-rpmoptflags-only.patch</changelog>
  <changelog author="adam.majer@suse.de" date="1516363200">- Multibuild requires versioned Name: tag and doesn't seem to do
  this automatically. (bnc#1076640)</changelog>
  <changelog author="kukuk@suse.de" date="1522843200">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="adam.majer@suse.de" date="1584619200">- libreoffice_compat_backports.patch: add a backport of
  Boost.Optional::has_value() for LibreOffice</changelog>
  <changelog author="adam.majer@suse.de" date="1641816000">- variant.patch: backport fix allowing perfect forwarding in
  apply_visitor. Also fix wrong usage of boost::move (bsc#1194522)</changelog>
</package>
<package pkgid="3aea3e441a4977b93e5208403de12b49e7e422e4904a8dd10622a95905c5cc54" name="libboost_python-py2_7-1_66_0-devel" arch="aarch64">
  <version epoch="0" ver="1.66.0" rel="12.3.1"/>
  <changelog author="adam.majer@suse.de" date="1478606400">- Revert upstream change that set default python version and
  ignored user configuration.
  python-2059618.patch (boo#1006584)</changelog>
  <changelog author="adam.majer@suse.de" date="1483531200">- update to version 1.63.0
  * updated libraries: atomic, container, context, fiber,
    fusion, geometry, hash, interprocess, intrusive, lexical cast,
    log, metaparse, move, optional, phoenix, python, test,
    typeindex, units, unordered
  * see http://www.boost.org/users/history/version_1_63_0.html
    for complete list of changes
- refresh patches
  * boost-1.55.0-python-test-PyImport_AppendInittab.patch
  * boost-strict_aliasing.patch, and enable -fno-strict-aliasing
    for python module
- baselibs.conf:
  * add libboost_locale
  * rename python to include new soname
- remove python-2059618.patch, not needed
- make build condition --without buil_mpi work
- allow building without python3 bindings, for SLE11SP4
- remove versioned build dependency on libicu-devel, apparently
  not needed.
- split out the boost-devel package into individudal compiled
  libraries and their -devel subpackages and libboost_headers-devel
  package for header-only libraries.
- remove all the -mt.so symlinks, probably not needed anymore.
- ship MPI python bindings for both Python 2.7 and 3.x
  * add python_mpi.patch to allow proper compiled library loading
- dynamic_linking.patch: first attempt to remove static library
  generation during build process.</changelog>
  <changelog author="adam.majer@suse.de" date="1484481600">- remove non-existent dependency in the boost mpi python package</changelog>
  <changelog author="adam.majer@suse.de" date="1484654400">- test_lowcase.patch: downcase Boost::Test usage of uppercase
  variables. VERSION was clashing with GNU Autotools define
  resulting in compilation errors of various packages.
- recombine headers from various devel subpackages under the
  libboost_headers-devel package. Not all usage of headers that
  have compiled parts pull in their associated compiled symbols.
- general cleanup of the spec file from old, commented stuffs</changelog>
  <changelog author="adam.majer@suse.de" date="1485345600">- Fix dependency typos.</changelog>
  <changelog author="adam.majer@suse.de" date="1486123200">- baselibs.conf: (re)add python 2.7 and 3.x libraries</changelog>
  <changelog author="jmatejek@suse.com" date="1486728000">- update python macros</changelog>
  <changelog author="adam.majer@suse.de" date="1492689600">- New upstream version 1.64.0
  + process - new library providing cross platform methods to
  - create child processes
  - setup stream for child processes
  - sync and async communication streams with children
  - sync and async wait
  - process termination
  + geometry library had some breaking changes,
  - ublas_transformer is renamed to matrix_transformer
  - explicit modifier is added to constructors of rtree
    index::dynamic_* parameters
  - strategy::area::huiller replaced by strategy::area::spherical
  + context library updates
  - deprecated API:execution-context
  - fixed bad assembly for fcontext on ppc64/sysv/elf
  + Updated libraries: any, atomic, config, container, context,
    conversion, core, coroutine2, fiber, hash, interprocess,
    intrusive, lexicalcast, math, multi-index containers,
    multiprecision, predef, program options, regex, smart pointers,
    test ,typeindex, typetraits, unordered, variant
  + for details, see
    http://www.boost.org/users/history/version_1_64_0.html
- Build PyNumpy module
  + add build requires on python-numpy
- test_lowcase.patch: upstreamed
- refreshed patches: boost-strict_aliasing.patch, gcc_path.patch,
  python_mpi.patch
- mpi_upstream.patch: pending upstream fixes to OpenMPI build
- python_library_name.patch: we are building python versions in
  different stagings so drop library renames.
- python_numpy_retfunc.patch: rpmlint fixes</changelog>
  <changelog author="adam.majer@suse.de" date="1494244800">- make python-numpy optional build dependency
- fix building of mpi python3 plugin</changelog>
  <changelog author="adam.majer@suse.de" date="1494331200">- 1d862615.patch: Fix regression caused by refactoring of
  serialization code (bnc#1038083)</changelog>
  <changelog author="adam.majer@suse.de" date="1505908800">- New upstream version 1.65.1
  + config, fiber - Return a continuation from functions executed
    by resume_with.
  + stacktrace - Change preprocessor file extensions to work with
    the installation system.
- Changes in version 1.65.0
  + stacktrace - new library providing call sequence in human
    readable format.
  + polycollection - new library providing fast containers of
    polymorphic objects, from Joaquín M López Muñoz.
  + For full list of changes, see
    http://www.boost.org/users/history/version_1_65_1.html
- 1d862615.patch: upstreamed and removed
- gcc_path.patch: obsolete, tr1 module is removed
- mpi_upstream.patch: upstreamed and removed
- boost-1.57.0-python-abi_letters.patch: refreshed
- python_library_name.patch: refreshed and reverted upstream
  changes to mpi/build/Jamfile as we are building python2 and
  python3 versions of MPI separately.
- baselibs.conf
  + add libboost_stracktrace
  + update to version 1.65.1</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1507550400">- Setup MPI environment prior to building boost.
- Switch to OpenMPI2 as OpenMPI1 is becoming deprecated.</changelog>
  <changelog author="adam.majer@suse.de" date="1507636800">- Use multibuild setup - build no-dependency libraries in the
  base package and build the rest of the compiled libraries in
  the main variant. This should speed up bootstrapping.
- boost-devel not built by default anymore.
- libboost_headers-devel now provides boost-devel for legacy
  dependencies. If you need compiled boost libraries depend on
  the current compiled devel subpackage.
- run %fdupes only on the header files and documentation
- drop build dependencies on gcc-fortran, chrpath.</changelog>
  <changelog author="jmatejek@suse.com" date="1508846400">- build Python 2 conditionally</changelog>
  <changelog author="adam.majer@suse.de" date="1511956800">- re-enable Python 2 by default. It's still conditional, but
  remains enabled by default. This can be disabled in project
  config.</changelog>
  <changelog author="adam.majer@suse.de" date="1513598400">- Update to version 1.66.0
  + Beast: new portable HTTP, WebSocket and network operations
    using Boost.Asio. Header-only library.
  + Callable Traits: new library and successor to
    Boost.FunctionTypes. Header-only library.
  + Mp11: new metaprogramming library
  + Asio:
  * implemented interface changes to reflect the Networking TS
    (N4656)
  * functions and classes that have been superseded by
    Networking TS functionality have been deprecated.
  * added support for customized handler tracking
  * removed previously deprecated functions
  + Atomic: improved compatibility with GCC 7. 128-bit operations
    on x86_64 no longer require linking with compiled library.
  + DateTime: Fixed an integral overflow that could cause incorrect
    results when adding or subtracting many years from a date.
  + Format: New format specifiers added and volatile arguments
    can not be safely used with operator%
  + Fusion:
  * fix compile error with std::array
  * remove circular preprocessor include
  + PolyCollection: backported to GCC 4.8 and 4.9 with some
    limitations
  + Uuid: added RTF-4122 namespaces in boost::uuids::ns
  + for complete changelog, see
    http://www.boost.org/users/history/version_1_66_0.html
- refreshed patches: boost-rpmoptflags-only.patch</changelog>
  <changelog author="adam.majer@suse.de" date="1516363200">- Multibuild requires versioned Name: tag and doesn't seem to do
  this automatically. (bnc#1076640)</changelog>
  <changelog author="kukuk@suse.de" date="1522843200">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="adam.majer@suse.de" date="1584619200">- libreoffice_compat_backports.patch: add a backport of
  Boost.Optional::has_value() for LibreOffice</changelog>
  <changelog author="adam.majer@suse.de" date="1641816000">- variant.patch: backport fix allowing perfect forwarding in
  apply_visitor. Also fix wrong usage of boost::move (bsc#1194522)</changelog>
</package>
<package pkgid="6e861bffb17f80690908e09025e933a5835ce63a4ea8c021c9dd039e90e2fd5f" name="libboost_python-py2_7-1_66_0-devel" arch="ppc64le">
  <version epoch="0" ver="1.66.0" rel="12.3.1"/>
  <changelog author="adam.majer@suse.de" date="1478606400">- Revert upstream change that set default python version and
  ignored user configuration.
  python-2059618.patch (boo#1006584)</changelog>
  <changelog author="adam.majer@suse.de" date="1483531200">- update to version 1.63.0
  * updated libraries: atomic, container, context, fiber,
    fusion, geometry, hash, interprocess, intrusive, lexical cast,
    log, metaparse, move, optional, phoenix, python, test,
    typeindex, units, unordered
  * see http://www.boost.org/users/history/version_1_63_0.html
    for complete list of changes
- refresh patches
  * boost-1.55.0-python-test-PyImport_AppendInittab.patch
  * boost-strict_aliasing.patch, and enable -fno-strict-aliasing
    for python module
- baselibs.conf:
  * add libboost_locale
  * rename python to include new soname
- remove python-2059618.patch, not needed
- make build condition --without buil_mpi work
- allow building without python3 bindings, for SLE11SP4
- remove versioned build dependency on libicu-devel, apparently
  not needed.
- split out the boost-devel package into individudal compiled
  libraries and their -devel subpackages and libboost_headers-devel
  package for header-only libraries.
- remove all the -mt.so symlinks, probably not needed anymore.
- ship MPI python bindings for both Python 2.7 and 3.x
  * add python_mpi.patch to allow proper compiled library loading
- dynamic_linking.patch: first attempt to remove static library
  generation during build process.</changelog>
  <changelog author="adam.majer@suse.de" date="1484481600">- remove non-existent dependency in the boost mpi python package</changelog>
  <changelog author="adam.majer@suse.de" date="1484654400">- test_lowcase.patch: downcase Boost::Test usage of uppercase
  variables. VERSION was clashing with GNU Autotools define
  resulting in compilation errors of various packages.
- recombine headers from various devel subpackages under the
  libboost_headers-devel package. Not all usage of headers that
  have compiled parts pull in their associated compiled symbols.
- general cleanup of the spec file from old, commented stuffs</changelog>
  <changelog author="adam.majer@suse.de" date="1485345600">- Fix dependency typos.</changelog>
  <changelog author="adam.majer@suse.de" date="1486123200">- baselibs.conf: (re)add python 2.7 and 3.x libraries</changelog>
  <changelog author="jmatejek@suse.com" date="1486728000">- update python macros</changelog>
  <changelog author="adam.majer@suse.de" date="1492689600">- New upstream version 1.64.0
  + process - new library providing cross platform methods to
  - create child processes
  - setup stream for child processes
  - sync and async communication streams with children
  - sync and async wait
  - process termination
  + geometry library had some breaking changes,
  - ublas_transformer is renamed to matrix_transformer
  - explicit modifier is added to constructors of rtree
    index::dynamic_* parameters
  - strategy::area::huiller replaced by strategy::area::spherical
  + context library updates
  - deprecated API:execution-context
  - fixed bad assembly for fcontext on ppc64/sysv/elf
  + Updated libraries: any, atomic, config, container, context,
    conversion, core, coroutine2, fiber, hash, interprocess,
    intrusive, lexicalcast, math, multi-index containers,
    multiprecision, predef, program options, regex, smart pointers,
    test ,typeindex, typetraits, unordered, variant
  + for details, see
    http://www.boost.org/users/history/version_1_64_0.html
- Build PyNumpy module
  + add build requires on python-numpy
- test_lowcase.patch: upstreamed
- refreshed patches: boost-strict_aliasing.patch, gcc_path.patch,
  python_mpi.patch
- mpi_upstream.patch: pending upstream fixes to OpenMPI build
- python_library_name.patch: we are building python versions in
  different stagings so drop library renames.
- python_numpy_retfunc.patch: rpmlint fixes</changelog>
  <changelog author="adam.majer@suse.de" date="1494244800">- make python-numpy optional build dependency
- fix building of mpi python3 plugin</changelog>
  <changelog author="adam.majer@suse.de" date="1494331200">- 1d862615.patch: Fix regression caused by refactoring of
  serialization code (bnc#1038083)</changelog>
  <changelog author="adam.majer@suse.de" date="1505908800">- New upstream version 1.65.1
  + config, fiber - Return a continuation from functions executed
    by resume_with.
  + stacktrace - Change preprocessor file extensions to work with
    the installation system.
- Changes in version 1.65.0
  + stacktrace - new library providing call sequence in human
    readable format.
  + polycollection - new library providing fast containers of
    polymorphic objects, from Joaquín M López Muñoz.
  + For full list of changes, see
    http://www.boost.org/users/history/version_1_65_1.html
- 1d862615.patch: upstreamed and removed
- gcc_path.patch: obsolete, tr1 module is removed
- mpi_upstream.patch: upstreamed and removed
- boost-1.57.0-python-abi_letters.patch: refreshed
- python_library_name.patch: refreshed and reverted upstream
  changes to mpi/build/Jamfile as we are building python2 and
  python3 versions of MPI separately.
- baselibs.conf
  + add libboost_stracktrace
  + update to version 1.65.1</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1507550400">- Setup MPI environment prior to building boost.
- Switch to OpenMPI2 as OpenMPI1 is becoming deprecated.</changelog>
  <changelog author="adam.majer@suse.de" date="1507636800">- Use multibuild setup - build no-dependency libraries in the
  base package and build the rest of the compiled libraries in
  the main variant. This should speed up bootstrapping.
- boost-devel not built by default anymore.
- libboost_headers-devel now provides boost-devel for legacy
  dependencies. If you need compiled boost libraries depend on
  the current compiled devel subpackage.
- run %fdupes only on the header files and documentation
- drop build dependencies on gcc-fortran, chrpath.</changelog>
  <changelog author="jmatejek@suse.com" date="1508846400">- build Python 2 conditionally</changelog>
  <changelog author="adam.majer@suse.de" date="1511956800">- re-enable Python 2 by default. It's still conditional, but
  remains enabled by default. This can be disabled in project
  config.</changelog>
  <changelog author="adam.majer@suse.de" date="1513598400">- Update to version 1.66.0
  + Beast: new portable HTTP, WebSocket and network operations
    using Boost.Asio. Header-only library.
  + Callable Traits: new library and successor to
    Boost.FunctionTypes. Header-only library.
  + Mp11: new metaprogramming library
  + Asio:
  * implemented interface changes to reflect the Networking TS
    (N4656)
  * functions and classes that have been superseded by
    Networking TS functionality have been deprecated.
  * added support for customized handler tracking
  * removed previously deprecated functions
  + Atomic: improved compatibility with GCC 7. 128-bit operations
    on x86_64 no longer require linking with compiled library.
  + DateTime: Fixed an integral overflow that could cause incorrect
    results when adding or subtracting many years from a date.
  + Format: New format specifiers added and volatile arguments
    can not be safely used with operator%
  + Fusion:
  * fix compile error with std::array
  * remove circular preprocessor include
  + PolyCollection: backported to GCC 4.8 and 4.9 with some
    limitations
  + Uuid: added RTF-4122 namespaces in boost::uuids::ns
  + for complete changelog, see
    http://www.boost.org/users/history/version_1_66_0.html
- refreshed patches: boost-rpmoptflags-only.patch</changelog>
  <changelog author="adam.majer@suse.de" date="1516363200">- Multibuild requires versioned Name: tag and doesn't seem to do
  this automatically. (bnc#1076640)</changelog>
  <changelog author="kukuk@suse.de" date="1522843200">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="adam.majer@suse.de" date="1584619200">- libreoffice_compat_backports.patch: add a backport of
  Boost.Optional::has_value() for LibreOffice</changelog>
  <changelog author="adam.majer@suse.de" date="1641816000">- variant.patch: backport fix allowing perfect forwarding in
  apply_visitor. Also fix wrong usage of boost::move (bsc#1194522)</changelog>
</package>
<package pkgid="a5387d7a1663c680aedfbf7104a58bad4c80aaefdc6a4265b5fb472a5aa619ad" name="libboost_python-py2_7-1_66_0-devel" arch="s390x">
  <version epoch="0" ver="1.66.0" rel="12.3.1"/>
  <changelog author="adam.majer@suse.de" date="1478606400">- Revert upstream change that set default python version and
  ignored user configuration.
  python-2059618.patch (boo#1006584)</changelog>
  <changelog author="adam.majer@suse.de" date="1483531200">- update to version 1.63.0
  * updated libraries: atomic, container, context, fiber,
    fusion, geometry, hash, interprocess, intrusive, lexical cast,
    log, metaparse, move, optional, phoenix, python, test,
    typeindex, units, unordered
  * see http://www.boost.org/users/history/version_1_63_0.html
    for complete list of changes
- refresh patches
  * boost-1.55.0-python-test-PyImport_AppendInittab.patch
  * boost-strict_aliasing.patch, and enable -fno-strict-aliasing
    for python module
- baselibs.conf:
  * add libboost_locale
  * rename python to include new soname
- remove python-2059618.patch, not needed
- make build condition --without buil_mpi work
- allow building without python3 bindings, for SLE11SP4
- remove versioned build dependency on libicu-devel, apparently
  not needed.
- split out the boost-devel package into individudal compiled
  libraries and their -devel subpackages and libboost_headers-devel
  package for header-only libraries.
- remove all the -mt.so symlinks, probably not needed anymore.
- ship MPI python bindings for both Python 2.7 and 3.x
  * add python_mpi.patch to allow proper compiled library loading
- dynamic_linking.patch: first attempt to remove static library
  generation during build process.</changelog>
  <changelog author="adam.majer@suse.de" date="1484481600">- remove non-existent dependency in the boost mpi python package</changelog>
  <changelog author="adam.majer@suse.de" date="1484654400">- test_lowcase.patch: downcase Boost::Test usage of uppercase
  variables. VERSION was clashing with GNU Autotools define
  resulting in compilation errors of various packages.
- recombine headers from various devel subpackages under the
  libboost_headers-devel package. Not all usage of headers that
  have compiled parts pull in their associated compiled symbols.
- general cleanup of the spec file from old, commented stuffs</changelog>
  <changelog author="adam.majer@suse.de" date="1485345600">- Fix dependency typos.</changelog>
  <changelog author="adam.majer@suse.de" date="1486123200">- baselibs.conf: (re)add python 2.7 and 3.x libraries</changelog>
  <changelog author="jmatejek@suse.com" date="1486728000">- update python macros</changelog>
  <changelog author="adam.majer@suse.de" date="1492689600">- New upstream version 1.64.0
  + process - new library providing cross platform methods to
  - create child processes
  - setup stream for child processes
  - sync and async communication streams with children
  - sync and async wait
  - process termination
  + geometry library had some breaking changes,
  - ublas_transformer is renamed to matrix_transformer
  - explicit modifier is added to constructors of rtree
    index::dynamic_* parameters
  - strategy::area::huiller replaced by strategy::area::spherical
  + context library updates
  - deprecated API:execution-context
  - fixed bad assembly for fcontext on ppc64/sysv/elf
  + Updated libraries: any, atomic, config, container, context,
    conversion, core, coroutine2, fiber, hash, interprocess,
    intrusive, lexicalcast, math, multi-index containers,
    multiprecision, predef, program options, regex, smart pointers,
    test ,typeindex, typetraits, unordered, variant
  + for details, see
    http://www.boost.org/users/history/version_1_64_0.html
- Build PyNumpy module
  + add build requires on python-numpy
- test_lowcase.patch: upstreamed
- refreshed patches: boost-strict_aliasing.patch, gcc_path.patch,
  python_mpi.patch
- mpi_upstream.patch: pending upstream fixes to OpenMPI build
- python_library_name.patch: we are building python versions in
  different stagings so drop library renames.
- python_numpy_retfunc.patch: rpmlint fixes</changelog>
  <changelog author="adam.majer@suse.de" date="1494244800">- make python-numpy optional build dependency
- fix building of mpi python3 plugin</changelog>
  <changelog author="adam.majer@suse.de" date="1494331200">- 1d862615.patch: Fix regression caused by refactoring of
  serialization code (bnc#1038083)</changelog>
  <changelog author="adam.majer@suse.de" date="1505908800">- New upstream version 1.65.1
  + config, fiber - Return a continuation from functions executed
    by resume_with.
  + stacktrace - Change preprocessor file extensions to work with
    the installation system.
- Changes in version 1.65.0
  + stacktrace - new library providing call sequence in human
    readable format.
  + polycollection - new library providing fast containers of
    polymorphic objects, from Joaquín M López Muñoz.
  + For full list of changes, see
    http://www.boost.org/users/history/version_1_65_1.html
- 1d862615.patch: upstreamed and removed
- gcc_path.patch: obsolete, tr1 module is removed
- mpi_upstream.patch: upstreamed and removed
- boost-1.57.0-python-abi_letters.patch: refreshed
- python_library_name.patch: refreshed and reverted upstream
  changes to mpi/build/Jamfile as we are building python2 and
  python3 versions of MPI separately.
- baselibs.conf
  + add libboost_stracktrace
  + update to version 1.65.1</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1507550400">- Setup MPI environment prior to building boost.
- Switch to OpenMPI2 as OpenMPI1 is becoming deprecated.</changelog>
  <changelog author="adam.majer@suse.de" date="1507636800">- Use multibuild setup - build no-dependency libraries in the
  base package and build the rest of the compiled libraries in
  the main variant. This should speed up bootstrapping.
- boost-devel not built by default anymore.
- libboost_headers-devel now provides boost-devel for legacy
  dependencies. If you need compiled boost libraries depend on
  the current compiled devel subpackage.
- run %fdupes only on the header files and documentation
- drop build dependencies on gcc-fortran, chrpath.</changelog>
  <changelog author="jmatejek@suse.com" date="1508846400">- build Python 2 conditionally</changelog>
  <changelog author="adam.majer@suse.de" date="1511956800">- re-enable Python 2 by default. It's still conditional, but
  remains enabled by default. This can be disabled in project
  config.</changelog>
  <changelog author="adam.majer@suse.de" date="1513598400">- Update to version 1.66.0
  + Beast: new portable HTTP, WebSocket and network operations
    using Boost.Asio. Header-only library.
  + Callable Traits: new library and successor to
    Boost.FunctionTypes. Header-only library.
  + Mp11: new metaprogramming library
  + Asio:
  * implemented interface changes to reflect the Networking TS
    (N4656)
  * functions and classes that have been superseded by
    Networking TS functionality have been deprecated.
  * added support for customized handler tracking
  * removed previously deprecated functions
  + Atomic: improved compatibility with GCC 7. 128-bit operations
    on x86_64 no longer require linking with compiled library.
  + DateTime: Fixed an integral overflow that could cause incorrect
    results when adding or subtracting many years from a date.
  + Format: New format specifiers added and volatile arguments
    can not be safely used with operator%
  + Fusion:
  * fix compile error with std::array
  * remove circular preprocessor include
  + PolyCollection: backported to GCC 4.8 and 4.9 with some
    limitations
  + Uuid: added RTF-4122 namespaces in boost::uuids::ns
  + for complete changelog, see
    http://www.boost.org/users/history/version_1_66_0.html
- refreshed patches: boost-rpmoptflags-only.patch</changelog>
  <changelog author="adam.majer@suse.de" date="1516363200">- Multibuild requires versioned Name: tag and doesn't seem to do
  this automatically. (bnc#1076640)</changelog>
  <changelog author="kukuk@suse.de" date="1522843200">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="adam.majer@suse.de" date="1584619200">- libreoffice_compat_backports.patch: add a backport of
  Boost.Optional::has_value() for LibreOffice</changelog>
  <changelog author="adam.majer@suse.de" date="1641816000">- variant.patch: backport fix allowing perfect forwarding in
  apply_visitor. Also fix wrong usage of boost::move (bsc#1194522)</changelog>
</package>
<package pkgid="ae8ec9bd8b979ce9317ae1932a90f4df53fad9894d8baf4258e5d495da1be7a4" name="libboost_python-py2_7-1_66_0-devel" arch="x86_64">
  <version epoch="0" ver="1.66.0" rel="12.3.1"/>
  <changelog author="adam.majer@suse.de" date="1478606400">- Revert upstream change that set default python version and
  ignored user configuration.
  python-2059618.patch (boo#1006584)</changelog>
  <changelog author="adam.majer@suse.de" date="1483531200">- update to version 1.63.0
  * updated libraries: atomic, container, context, fiber,
    fusion, geometry, hash, interprocess, intrusive, lexical cast,
    log, metaparse, move, optional, phoenix, python, test,
    typeindex, units, unordered
  * see http://www.boost.org/users/history/version_1_63_0.html
    for complete list of changes
- refresh patches
  * boost-1.55.0-python-test-PyImport_AppendInittab.patch
  * boost-strict_aliasing.patch, and enable -fno-strict-aliasing
    for python module
- baselibs.conf:
  * add libboost_locale
  * rename python to include new soname
- remove python-2059618.patch, not needed
- make build condition --without buil_mpi work
- allow building without python3 bindings, for SLE11SP4
- remove versioned build dependency on libicu-devel, apparently
  not needed.
- split out the boost-devel package into individudal compiled
  libraries and their -devel subpackages and libboost_headers-devel
  package for header-only libraries.
- remove all the -mt.so symlinks, probably not needed anymore.
- ship MPI python bindings for both Python 2.7 and 3.x
  * add python_mpi.patch to allow proper compiled library loading
- dynamic_linking.patch: first attempt to remove static library
  generation during build process.</changelog>
  <changelog author="adam.majer@suse.de" date="1484481600">- remove non-existent dependency in the boost mpi python package</changelog>
  <changelog author="adam.majer@suse.de" date="1484654400">- test_lowcase.patch: downcase Boost::Test usage of uppercase
  variables. VERSION was clashing with GNU Autotools define
  resulting in compilation errors of various packages.
- recombine headers from various devel subpackages under the
  libboost_headers-devel package. Not all usage of headers that
  have compiled parts pull in their associated compiled symbols.
- general cleanup of the spec file from old, commented stuffs</changelog>
  <changelog author="adam.majer@suse.de" date="1485345600">- Fix dependency typos.</changelog>
  <changelog author="adam.majer@suse.de" date="1486123200">- baselibs.conf: (re)add python 2.7 and 3.x libraries</changelog>
  <changelog author="jmatejek@suse.com" date="1486728000">- update python macros</changelog>
  <changelog author="adam.majer@suse.de" date="1492689600">- New upstream version 1.64.0
  + process - new library providing cross platform methods to
  - create child processes
  - setup stream for child processes
  - sync and async communication streams with children
  - sync and async wait
  - process termination
  + geometry library had some breaking changes,
  - ublas_transformer is renamed to matrix_transformer
  - explicit modifier is added to constructors of rtree
    index::dynamic_* parameters
  - strategy::area::huiller replaced by strategy::area::spherical
  + context library updates
  - deprecated API:execution-context
  - fixed bad assembly for fcontext on ppc64/sysv/elf
  + Updated libraries: any, atomic, config, container, context,
    conversion, core, coroutine2, fiber, hash, interprocess,
    intrusive, lexicalcast, math, multi-index containers,
    multiprecision, predef, program options, regex, smart pointers,
    test ,typeindex, typetraits, unordered, variant
  + for details, see
    http://www.boost.org/users/history/version_1_64_0.html
- Build PyNumpy module
  + add build requires on python-numpy
- test_lowcase.patch: upstreamed
- refreshed patches: boost-strict_aliasing.patch, gcc_path.patch,
  python_mpi.patch
- mpi_upstream.patch: pending upstream fixes to OpenMPI build
- python_library_name.patch: we are building python versions in
  different stagings so drop library renames.
- python_numpy_retfunc.patch: rpmlint fixes</changelog>
  <changelog author="adam.majer@suse.de" date="1494244800">- make python-numpy optional build dependency
- fix building of mpi python3 plugin</changelog>
  <changelog author="adam.majer@suse.de" date="1494331200">- 1d862615.patch: Fix regression caused by refactoring of
  serialization code (bnc#1038083)</changelog>
  <changelog author="adam.majer@suse.de" date="1505908800">- New upstream version 1.65.1
  + config, fiber - Return a continuation from functions executed
    by resume_with.
  + stacktrace - Change preprocessor file extensions to work with
    the installation system.
- Changes in version 1.65.0
  + stacktrace - new library providing call sequence in human
    readable format.
  + polycollection - new library providing fast containers of
    polymorphic objects, from Joaquín M López Muñoz.
  + For full list of changes, see
    http://www.boost.org/users/history/version_1_65_1.html
- 1d862615.patch: upstreamed and removed
- gcc_path.patch: obsolete, tr1 module is removed
- mpi_upstream.patch: upstreamed and removed
- boost-1.57.0-python-abi_letters.patch: refreshed
- python_library_name.patch: refreshed and reverted upstream
  changes to mpi/build/Jamfile as we are building python2 and
  python3 versions of MPI separately.
- baselibs.conf
  + add libboost_stracktrace
  + update to version 1.65.1</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1507550400">- Setup MPI environment prior to building boost.
- Switch to OpenMPI2 as OpenMPI1 is becoming deprecated.</changelog>
  <changelog author="adam.majer@suse.de" date="1507636800">- Use multibuild setup - build no-dependency libraries in the
  base package and build the rest of the compiled libraries in
  the main variant. This should speed up bootstrapping.
- boost-devel not built by default anymore.
- libboost_headers-devel now provides boost-devel for legacy
  dependencies. If you need compiled boost libraries depend on
  the current compiled devel subpackage.
- run %fdupes only on the header files and documentation
- drop build dependencies on gcc-fortran, chrpath.</changelog>
  <changelog author="jmatejek@suse.com" date="1508846400">- build Python 2 conditionally</changelog>
  <changelog author="adam.majer@suse.de" date="1511956800">- re-enable Python 2 by default. It's still conditional, but
  remains enabled by default. This can be disabled in project
  config.</changelog>
  <changelog author="adam.majer@suse.de" date="1513598400">- Update to version 1.66.0
  + Beast: new portable HTTP, WebSocket and network operations
    using Boost.Asio. Header-only library.
  + Callable Traits: new library and successor to
    Boost.FunctionTypes. Header-only library.
  + Mp11: new metaprogramming library
  + Asio:
  * implemented interface changes to reflect the Networking TS
    (N4656)
  * functions and classes that have been superseded by
    Networking TS functionality have been deprecated.
  * added support for customized handler tracking
  * removed previously deprecated functions
  + Atomic: improved compatibility with GCC 7. 128-bit operations
    on x86_64 no longer require linking with compiled library.
  + DateTime: Fixed an integral overflow that could cause incorrect
    results when adding or subtracting many years from a date.
  + Format: New format specifiers added and volatile arguments
    can not be safely used with operator%
  + Fusion:
  * fix compile error with std::array
  * remove circular preprocessor include
  + PolyCollection: backported to GCC 4.8 and 4.9 with some
    limitations
  + Uuid: added RTF-4122 namespaces in boost::uuids::ns
  + for complete changelog, see
    http://www.boost.org/users/history/version_1_66_0.html
- refreshed patches: boost-rpmoptflags-only.patch</changelog>
  <changelog author="adam.majer@suse.de" date="1516363200">- Multibuild requires versioned Name: tag and doesn't seem to do
  this automatically. (bnc#1076640)</changelog>
  <changelog author="kukuk@suse.de" date="1522843200">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="adam.majer@suse.de" date="1584619200">- libreoffice_compat_backports.patch: add a backport of
  Boost.Optional::has_value() for LibreOffice</changelog>
  <changelog author="adam.majer@suse.de" date="1641816000">- variant.patch: backport fix allowing perfect forwarding in
  apply_visitor. Also fix wrong usage of boost::move (bsc#1194522)</changelog>
</package>
<package pkgid="880e24f023ab99a1a0e72f2066a14f320023115f9e4cc1832cf98943bfde0ca1" name="libclamav9" arch="aarch64">
  <version epoch="0" ver="0.103.5" rel="3.35.1"/>
  <changelog author="egdfree@opensuse.org" date="1553688000">- Update to version 0.101.2 (bsc#1130721)
  * CVE-2019-1787:
    An out-of-bounds heap read condition may occur when scanning PDF
    documents. The defect is a failure to correctly keep track of the number
    of bytes remaining in a buffer when indexing file data.
  * CVE-2019-1789:
    An out-of-bounds heap read condition may occur when scanning PE files
    (i.e. Windows EXE and DLL files) that have been packed using Aspack as a
    result of inadequate bound-checking.
  * CVE-2019-1788:
    An out-of-bounds heap write condition may occur when scanning OLE2 files
    such as Microsoft Office 97-2003 documents. The invalid write happens when
    an invalid pointer is mistakenly used to initialize a 32bit integer to
    zero. This is likely to crash the application.
  * CVE-2019-1786:
    An out-of-bounds heap read condition may occur when scanning malformed
    PDF documents as a result of improper bounds-checking.
  * CVE-2019-1785:
    A path-traversal write condition may occur as a result of improper
    input validation when scanning RAR archives.
  * CVE-2019-1798:
    A use-after-free condition may occur as a result of improper error
    handling when scanning nested RAR archives.
- added clamav-max_patch.patch to fix build
- dropped clamav-freshclam-exit.patch</changelog>
  <changelog author="max@suse.com" date="1565092800">- Update to version 0.101.3:
  * bsc#1144504: ZIP bomb causes extreme CPU spikes</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1567598400">- update to 0.101.4:
  * CVE-2019-12900: An out of bounds write in the NSIS bzip2
    (boo#1149458)
  * CVE-2019-12625: Introduce a configurable time limit to mitigate
    zip bomb vulnerability completely. Default is 2 minutes,
    configurable useing the clamscan --max-scantime and for clamd
    using the MaxScanTime config option (boo#1144504)</changelog>
  <changelog author="max@suse.com" date="1572004800">- bsc#1151839: Increase the startup timeout of clamd to 5 minutes
  to cater for the grown virus database as a workaround until
  clamd has learned to talk to systemd to extend the timeout as
  long as needed.</changelog>
  <changelog author="suse+build@de-korte.org" date="1572609600">- update to 0.102.0
  * The On-Access Scanning feature has been migrated out of clamd
    and into a brand new utility named clamonacc. This utility is
    similar to clamdscan and clamav-milter in that it acts as a
    client to clamd. This separation from clamd means that clamd no
    longer needs to run with root privileges while scanning potentially
    malicious files. Instead, clamd may drop privileges to run under an
    account that does not have super-user. In addition to improving the
    security posture of running clamd with On-Access enabled, this
    update fixed a few outstanding defects:
  - On-Access scanning for created and moved files (Extra-Scanning)
    is fixed.
  - VirusEvent for On-Access scans is fixed.
  - With clamonacc, it is now possible to copy, move, or remove a
    file if the scan triggered an alert, just like with clamdscan.
  * The freshclam database update utility has undergone a significant
    update. This includes:
  - Added support for HTTPS.
  - Support for database mirrors hosted on ports other than 80.
  - Removal of the mirror management feature (mirrors.dat).
  - An all new libfreshclam library API.
- created new subpackage libfreshclam2
- dropped clamav-max_patch.patch (upstreamed)
- added clamav-fix_building_milter.patch to fix build of milter</changelog>
  <changelog author="suse+build@de-korte.org" date="1574251200">- update to 0.102.1
  * CVE-2019-15961, bsc#1157763: A Denial-of-Service (DoS)
    vulnerability may occur when scanning a specially crafted email
    file as a result of excessively long scan times. The issue is
    resolved by implementing several maximums in parsing MIME
    messages and by optimizing use of memory allocation.
  * Build system fixes to build clamav-milter, to correctly link
    with libxml2 when detected, and to correctly detect fanotify
    for on-access scanning feature support.
  * Signature load time is significantly reduced by changing to a
    more efficient algorithm for loading signature patterns and
    allocating the AC trie. Patch courtesy of Alberto Wu.
  * Introduced a new configure option to statically link libjson-c
    with libclamav. Static linking with libjson is highly
    recommended to prevent crashes in applications that use
    libclamav alongside another JSON parsing library.
  * Null-dereference fix in email parser when using the
  - -gen-json metadata option.
  * Fixes for Authenticode parsing and certificate signature
    (.crb database) bugs.
- dropped clamav-fix_building_milter.patch (upstreamed)</changelog>
  <changelog author="dimstar@opensuse.org" date="1576756800">- BuildRequire pkgconfig(libsystemd) instead of systemd-devel:
  Allow OBS to shortcut through the -mini flavors.</changelog>
  <changelog author="suse+build@de-korte.org" date="1577188800">- The freshclam.service should not be started before the network is
  online (it checks for updates immediately upon service start)</changelog>
  <changelog author="suse+build@de-korte.org" date="1580904000">- update to 0.102.2
  * CVE-2020-3123: A denial-of-service (DoS) condition may occur when
    using the optional credit card data-loss-prevention (DLP) feature.
    Improper bounds checking of an unsigned variable resulted in an
    out-of-bounds read, which causes a crash.
  * Significantly improved the scan speed of PDF files on Windows.
  * Re-applied a fix to alleviate file access issues when scanning RAR
    files in downstream projects that use libclamav where the scanning
    engine is operating in a low-privilege process. This bug was originally
    fixed in 0.101.2 and the fix was mistakenly omitted from 0.102.0.
  * Fixed an issue where freshclam failed to update if the database version
    downloaded is one version older than advertised. This situation may
    occur after a new database version is published. The issue affected
    users downloading the whole CVD database file.
  * Changed the default freshclam ReceiveTimeout setting to 0 (infinite).
    The ReceiveTimeout had caused needless database update failures for
    users with slower internet connections.
  * Correctly display the number of kilobytes (KiB) in progress bar and
    reduced the size of the progress bar to accommodate 80-character width
    terminals.
  * Fixed an issue where running freshclam manually causes a daemonized
    freshclam process to fail when it updates because the manual instance
    deletes the temporary download directory. The freshclam temporary files
    will now download to a unique directory created at the time of an update
    instead of using a hardcoded directory created/destroyed at the program
    start/exit.
  * Fix for freshclam's OnOutdatedExecute config option.
  * Fixes a memory leak in the error condition handling for the email
    parser.
  * Improved bound checking and error handling in ARJ archive parser.
  * Improved error handling in PDF parser.
  * Fix for memory leak in byte-compare signature handler.</changelog>
  <changelog author="mpluskal@suse.com" date="1585742400">- Drop python build dependency as it is not needed</changelog>
  <changelog author="suse+build@de-korte.org" date="1589284800">- Update to 0.102.3
  * CVE-2020-3327: Fix a vulnerability in the ARJ archive parsing
    module in ClamAV 0.102.2 that could cause a Denial-of-Service (DoS)
    condition. Improper bounds checking of an unsigned variable results
    in an out-of-bounds read which causes a crash.
  * CVE-2020-3341: Fix a vulnerability in the PDF parsing module in
    ClamAV 0.101 - 0.102.2 that could cause a Denial-of-Service (DoS)
    condition. Improper size checking of a buffer used to initialize AES
    decryption routines results in an out-of-bounds read which may cause
    a crash.
  * Fix "Attempt to allocate 0 bytes" error when parsing some PDF
    documents.
  * Fix a couple of minor memory leaks.
  * Updated libclamunrar to UnRAR 5.9.2.</changelog>
  <changelog author="suse+build@de-korte.org" date="1594900800">- Update to 0.102.4
  * CVE-2020-3350: Fix a vulnerability wherein a malicious user could
    replace a scan target's directory with a symlink to another path
    to trick clamscan, clamdscan, or clamonacc into removing or moving
    a different file (eg. a critical system file). The issue would
    affect users that use the --move or --remove options for clamscan,
    clamdscan, and clamonacc.
  * CVE-2020-3327: Fix a vulnerability in the ARJ archive parsing
    module in ClamAV 0.102.3 that could cause a Denial-of-Service
    (DoS) condition. Improper bounds checking results in an
    out-of-bounds read which could cause a crash. The previous fix for
    this CVE in 0.102.3 was incomplete. This fix correctly resolves
    the issue.
  * CVE-2020-3481: Fix a vulnerability in the EGG archive module in
    ClamAV 0.102.0 - 0.102.3 could cause a Denial-of-Service (DoS)
    condition. Improper error handling may result in a crash due to a
    NULL pointer dereference. This vulnerability is mitigated for
    those using the official ClamAV signature databases because the
    file type signatures in daily.cvd will not enable the EGG archive
    parser in versions affected by the vulnerability.</changelog>
  <changelog author="suse+build@de-korte.org" date="1600084800">- Update to 0.103.0
  * clamd can now reload the signature database without blocking
    scanning. This multi-threaded database reload improvement was made
    possible thanks to a community effort.
  - Non-blocking database reloads are now the default behavior. Some
    systems that are more constrained on RAM may need to disable
    non-blocking reloads as it will temporarily consume two times as
    much memory. We added a new clamd config option
    ConcurrentDatabaseReload, which may be set to no.
  * Dropped clamav-str-h.patch (no longer needed)
  * Fix clamav-milter.service (requires clamd.service to run)</changelog>
  <changelog author="max@suse.com" date="1605009600">- Sync Factory to SLE-15 to implement jsc#ECO-3010 and bsc#1118459.
- bsc#1119353, clamav-fips.patch: Fix freshclam crash in FIPS mode.
- Keep OBS from installing an existing clamav instance to scan the
  sources, because this makes "make check" use the old library
  instead of the just built one. This is only a workaround until
  we found a way to keep libtool from adding libdir to rpath and
  LD_LIBRARY_PATH of the binaries in the testsuite.</changelog>
  <changelog author="dimstar@opensuse.org" date="1605182400">- Do not hard-depend on systemd: use systemd_ordering instead of
  systemd_requires.</changelog>
  <changelog author="max@suse.com" date="1617969600">- Update clamav.keyring
- Update to 0.103.2
  * CVE-2021-1252, bsc#1184532: Fix for Excel XLM parser infinite
    loop. Affects 0.103.0 and 0.103.1 only.
  * CVE-2021-1404, bsc#1184533: Fix for PDF parser buffer over-read;
    possible crash. Affects 0.103.0 and 0.103.1 only.
  * CVE-2021-1405, bsc#1184534: Fix for mail parser
    NULL-dereference crash. Affects 0.103.1 and prior.
  * Fix possible memory leak in PNG parser.
  * Fix ClamOnAcc scan on file-creation race condition so files are
    scanned after their contents are written.
  * FreshClam: Deprecate the SafeBrowsing config option. The
    SafeBrowsing option will no longer do anything.
  * For more details, see our blog post from last year about the
    future of the ClamAV Safe Browsing database.
  * FreshClam: Improved HTTP 304, 403, &amp; 429 handling.
  * FreshClam: Added back the mirrors.dat file to the database directory.
  * FreshClam will now exit with a failure in daemon mode if an HTTP 403
    (Forbidden) was received, because retrying later won't help any. The
    FreshClam user will have to take actions to get unblocked.
  * Fix the FreshClam mirror-sync issue where a downloaded database is
    "older than the version advertised."
  * bsc#1181256: Fix errors when scanning files &gt; 4G
  * obsoletes clamav-disable-timestamps.patch
- Update to 0.103.1
  * Added a new scan option to alert on broken media (graphics) file
    formats. This feature mitigates the risk of malformed media files
    intended to exploit vulnerabilities in other software. At present
    media validation exists for JPEG, TIFF, PNG, and GIF files. To
    enable this feature, set AlertBrokenMedia yes in clamd.conf, or
    use the --alert-broken-media option when using clamscan. These
    options are disabled by default in this patch release, but may be
    enabled in a subsequent release. Application developers may enable
    this scan option by enabling CL_SCAN_HEURISTIC_BROKEN_MEDIA for
    the heuristic scan option bit field.
  * Added CL_TYPE_TIFF, CL_TYPE_JPEG types to match GIF, PNG typing
    behavior. BMP and JPEG 2000 files will continue to detect as
    CL_TYPE_GRAPHICS because ClamAV does not yet have BMP or JPEG
    2000 format checking capabilities.
  * Fixed PNG parser logic bugs that caused an excess of parsing
    errors and fixed a stack exhaustion issue affecting some systems
    when scanning PNG files. PNG file type detection was disabled via
    signature database update for ClamAV version 0.103.0 to mitigate
    the effects from these bugs.
  * Fixed an issue where PNG and GIF files no longer work with
    Target:5 graphics signatures if detected as CL_TYPE_PNG/GIF rather
    than as CL_TYPE_GRAPHICS. Target types now support up to 10
    possible file types to make way for additional graphics types in
    future releases.
  * Fixed clamonacc's --fdpass option.
  - Interprocess file descriptor passing for clamonacc was broken
    since version 0.102.0 due to a bug introduced by the switch to
    curl for communicating with clamd. On Linux, passing file
    descriptors from one process to another is handled by the
    kernel, so we reverted clamonacc to use standard system calls
    for socket communication when fd passing is enabled.
  * Fixed a clamonacc stack corruption issue on some systems when
    using an older version of libcurl.
  * Allow clamscan and clamdscan scans to proceed even if the
    realpath lookup failed. This alleviates an issue on Windows
    scanning files hosted on file- systems that do not support the
    GetMappedFileNameW() API such as on ImDisk RAM-disks.
  * Fixed freshclam --on-update-execute=EXIT_1 temporary directory
    cleanup issue.
  * clamd's log output and VirusEvent now provide the scan target's
    file path instead of a file descriptor. The clamd socket API for
    submitting a scan by FD-passing doesn't include a file path, this
    feature works by looking up the file path by file descriptor.
    This feature works on Mac and Linux but is not yet implemented
    for other UNIX operating systems. FD-passing is not available for
    Windows.
  * Fixed an issue where freshclam database validation didn't work
    correctly when run in daemon mode on Linux/Unix.</changelog>
  <changelog author="suse+build@de-korte.org" date="1624276800">- bsc#1188284: Update to 0.103.3
  * Fixed a scan performance issue when ENGINE_OPTIONS_FORCE_TO_DISK is
    enabled. This issue did not impacted most users but for those
    affected it caused every scanned file to be copied to the temp
    directory before the scan.
  * Fix ClamDScan crashes when using the --fdpass --multiscan
    command-line options in combination with the ClamD ExcludePath
    config file options.
  * Fixed an issue where the mirrors.dat file is owned by root when
    starting as root (or with sudo) and using daemon-mode. File
    ownership will be set to the DatabaseOwner just before FreshClam
    switches to run as that user.
  * Renamed the mirrors.dat file to freshclam.dat.
  * Disabled the HTTPUserAgent config option if the DatabaseMirror uses
    clamav.net. This will prevent users from being inadvertently blocked
    and will ensure that we can keep better metrics on which ClamAV
    versions are being used.
  * Moved the detection for Heuristics.PNG.CVE-2010-1205 behind the
    ClamScan --alert-broken-media option (ClamD AlertBrokenMedia yes)
    option. This type of PNG issue appears to be common enough to be an
    annoyance, and the CVE is old enough that no one should be
    vulnerable at this point.
  * Fix ClamSubmit failures after changes to Cloudflare "__cfduid"
    cookies. See: https://blog.cloudflare.com/deprecating-cfduid-cookie/</changelog>
  <changelog author="meissner@suse.com" date="1625054400">- clamav-document-maxsize.patch: in the "clamscan" and "clamdscan" manpages,
  document that files over a certain size by default will silently not be
  scanned and how this can be adjusted (bsc#1187509)</changelog>
  <changelog author="max@suse.com" date="1636372800">- bsc#1192346: Update to 0.103.4
  * FreshClam:
  - Add a 24-hour cool-down for FreshClam clients that have received
    an HTTP 403 (Forbidden) response from the CDN. This is to reduce
    the volume of 403-response data served to blocked FreshClam
    clients that are configured with a tight update-loop.
  - Fixed a bug where FreshClam treats an empty CDIFF as an
    incremental update failure instead of as an intentional request
    to download the whole CVD.
  * ClamDScan: Fix a scan error when broken symlinks are encountered on
    macOS with "FollowDirectorySymlinks" and "FollowFileSymlinks"
    options disabled.
  * Overhauled the scan recursion / nested archive extraction logic and
    added new limits on embedded file-type recognition performed during
    the "raw" scan of each file. This limits embedded file-type
    misidentification and prevents detecting embedded file content that
    is found/extracted and scanned at other layers in the scanning
    process.
  * Fix an issue with the FMap module that failed to read from some
    nested files.
  * Fixed an issue where failing to load some rules from a Yara file
    containing multiple rules may cause a crash.
  * Fixed assorted compiler warnings.
  * Fixed assorted Coverity static code analysis issues.
  * Scan limits:
  - Added virus-name suffixes to the alerts that trigger when a scan
    limit has been exceeded. Rather than simply
    Heuristics.Limits.Exceeded, you may now see limit-specific
    virus-names, to include:
    + Heuristics.Limits.Exceeded.MaxFileSize
    + Heuristics.Limits.Exceeded.MaxScanSize
    + Heuristics.Limits.Exceeded.MaxFiles
    + Heuristics.Limits.Exceeded.MaxRecursion
    + Heuristics.Limits.Exceeded.MaxScanTime
  - Renamed the Heuristics.Email.ExceedsMax.* alerts to align with
    the other limit alerts names. These alerts include:
    + Heuristics.Limits.Exceeded.EmailLineFoldcnt
    + Heuristics.Limits.Exceeded.EmailHeaderBytes
    + Heuristics.Limits.Exceeded.EmailHeaders
    + Heuristics.Limits.Exceeded.EmailMIMEPartsPerMessage
    + Heuristics.Limits.Exceeded.EmailMIMEArguments
  - Fixed an issue where the Email-related scan limits would alert
    even when the "AlertExceedsMax" (--alert-exceeds-max) scan option
    is not enabled.
  - Fixes an issue in the Zip parser where exceeding the "MaxFiles"
    limit or the "MaxFileSize" limit would abort the scan but would
    fail to alert. The Zip scan limit issues were independently
    identified and reported by Aaron Leliaert and Max Allan.
  * Fixed a leak in the Email parser when using the --gen-json scan
    option.
  * Fixed an issue where a failure to record metadata in the Email
    parser when using the --gen-json scan option could cause the Email
    parser to abort the scan early and fail to extract and scan
    additional content.
  * Fixed a file name memory leak in the Zip parser.
  * Fixed an issue where certain signature patterns may cause a crash or
    cause unintended matches on some systems when converting characters
    to uppercase if a UTF-8 unicode single-byte grapheme becomes a
    multi-byte grapheme. Patch courtesy of Andrea De Pasquale.
- Fix unit test
  + clamav-ck_assert_msg.patch</changelog>
  <changelog author="max@suse.com" date="1642420800">- Update to 0.103.5
  * bsc#1194731, CVE-2022-20698:
    Fix for invalid pointer read that may cause a crash.
    This issue affects 0.104.1, 0.103.4 and prior when ClamAV is compiled
    with libjson-c and the CL_SCAN_GENERAL_COLLECT_METADATA scan option
    (the clamscan --gen-json option) is enabled.
  * Fixed ability to disable the file size limit with libclamav C API,
    like this:
    cl_engine_set_num(engine, CL_ENGINE_MAX_FILESIZE, 0);
    This issue didn't affect ClamD or ClamScan which also can disable the
    limit by setting it to zero using MaxFileSize 0 in clamd.conf for ClamD,
    or clamscan --max-filesize=0 for ClamScan.
    Note: Internally, the max file size is still set to 2 GiB. Disabling the
    limit for a scan will fall back on the internal 2 GiB limitation.
  * Increased the maximum line length for ClamAV config files from 512 bytes
    to 1,024 bytes to allow for longer config option strings.
  * SigTool: Fix insufficient buffer size for --list-sigs that caused a
    failure when listing a database containing one or more very long
    signatures. This fix was backported from 0.104.</changelog>
</package>
<package pkgid="6769507e747125334c63b1fbd95910157dc8b5705a937f411ccfa09c8f2a2da0" name="libclamav9" arch="ppc64le">
  <version epoch="0" ver="0.103.5" rel="3.35.1"/>
  <changelog author="egdfree@opensuse.org" date="1553688000">- Update to version 0.101.2 (bsc#1130721)
  * CVE-2019-1787:
    An out-of-bounds heap read condition may occur when scanning PDF
    documents. The defect is a failure to correctly keep track of the number
    of bytes remaining in a buffer when indexing file data.
  * CVE-2019-1789:
    An out-of-bounds heap read condition may occur when scanning PE files
    (i.e. Windows EXE and DLL files) that have been packed using Aspack as a
    result of inadequate bound-checking.
  * CVE-2019-1788:
    An out-of-bounds heap write condition may occur when scanning OLE2 files
    such as Microsoft Office 97-2003 documents. The invalid write happens when
    an invalid pointer is mistakenly used to initialize a 32bit integer to
    zero. This is likely to crash the application.
  * CVE-2019-1786:
    An out-of-bounds heap read condition may occur when scanning malformed
    PDF documents as a result of improper bounds-checking.
  * CVE-2019-1785:
    A path-traversal write condition may occur as a result of improper
    input validation when scanning RAR archives.
  * CVE-2019-1798:
    A use-after-free condition may occur as a result of improper error
    handling when scanning nested RAR archives.
- added clamav-max_patch.patch to fix build
- dropped clamav-freshclam-exit.patch</changelog>
  <changelog author="max@suse.com" date="1565092800">- Update to version 0.101.3:
  * bsc#1144504: ZIP bomb causes extreme CPU spikes</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1567598400">- update to 0.101.4:
  * CVE-2019-12900: An out of bounds write in the NSIS bzip2
    (boo#1149458)
  * CVE-2019-12625: Introduce a configurable time limit to mitigate
    zip bomb vulnerability completely. Default is 2 minutes,
    configurable useing the clamscan --max-scantime and for clamd
    using the MaxScanTime config option (boo#1144504)</changelog>
  <changelog author="max@suse.com" date="1572004800">- bsc#1151839: Increase the startup timeout of clamd to 5 minutes
  to cater for the grown virus database as a workaround until
  clamd has learned to talk to systemd to extend the timeout as
  long as needed.</changelog>
  <changelog author="suse+build@de-korte.org" date="1572609600">- update to 0.102.0
  * The On-Access Scanning feature has been migrated out of clamd
    and into a brand new utility named clamonacc. This utility is
    similar to clamdscan and clamav-milter in that it acts as a
    client to clamd. This separation from clamd means that clamd no
    longer needs to run with root privileges while scanning potentially
    malicious files. Instead, clamd may drop privileges to run under an
    account that does not have super-user. In addition to improving the
    security posture of running clamd with On-Access enabled, this
    update fixed a few outstanding defects:
  - On-Access scanning for created and moved files (Extra-Scanning)
    is fixed.
  - VirusEvent for On-Access scans is fixed.
  - With clamonacc, it is now possible to copy, move, or remove a
    file if the scan triggered an alert, just like with clamdscan.
  * The freshclam database update utility has undergone a significant
    update. This includes:
  - Added support for HTTPS.
  - Support for database mirrors hosted on ports other than 80.
  - Removal of the mirror management feature (mirrors.dat).
  - An all new libfreshclam library API.
- created new subpackage libfreshclam2
- dropped clamav-max_patch.patch (upstreamed)
- added clamav-fix_building_milter.patch to fix build of milter</changelog>
  <changelog author="suse+build@de-korte.org" date="1574251200">- update to 0.102.1
  * CVE-2019-15961, bsc#1157763: A Denial-of-Service (DoS)
    vulnerability may occur when scanning a specially crafted email
    file as a result of excessively long scan times. The issue is
    resolved by implementing several maximums in parsing MIME
    messages and by optimizing use of memory allocation.
  * Build system fixes to build clamav-milter, to correctly link
    with libxml2 when detected, and to correctly detect fanotify
    for on-access scanning feature support.
  * Signature load time is significantly reduced by changing to a
    more efficient algorithm for loading signature patterns and
    allocating the AC trie. Patch courtesy of Alberto Wu.
  * Introduced a new configure option to statically link libjson-c
    with libclamav. Static linking with libjson is highly
    recommended to prevent crashes in applications that use
    libclamav alongside another JSON parsing library.
  * Null-dereference fix in email parser when using the
  - -gen-json metadata option.
  * Fixes for Authenticode parsing and certificate signature
    (.crb database) bugs.
- dropped clamav-fix_building_milter.patch (upstreamed)</changelog>
  <changelog author="dimstar@opensuse.org" date="1576756800">- BuildRequire pkgconfig(libsystemd) instead of systemd-devel:
  Allow OBS to shortcut through the -mini flavors.</changelog>
  <changelog author="suse+build@de-korte.org" date="1577188800">- The freshclam.service should not be started before the network is
  online (it checks for updates immediately upon service start)</changelog>
  <changelog author="suse+build@de-korte.org" date="1580904000">- update to 0.102.2
  * CVE-2020-3123: A denial-of-service (DoS) condition may occur when
    using the optional credit card data-loss-prevention (DLP) feature.
    Improper bounds checking of an unsigned variable resulted in an
    out-of-bounds read, which causes a crash.
  * Significantly improved the scan speed of PDF files on Windows.
  * Re-applied a fix to alleviate file access issues when scanning RAR
    files in downstream projects that use libclamav where the scanning
    engine is operating in a low-privilege process. This bug was originally
    fixed in 0.101.2 and the fix was mistakenly omitted from 0.102.0.
  * Fixed an issue where freshclam failed to update if the database version
    downloaded is one version older than advertised. This situation may
    occur after a new database version is published. The issue affected
    users downloading the whole CVD database file.
  * Changed the default freshclam ReceiveTimeout setting to 0 (infinite).
    The ReceiveTimeout had caused needless database update failures for
    users with slower internet connections.
  * Correctly display the number of kilobytes (KiB) in progress bar and
    reduced the size of the progress bar to accommodate 80-character width
    terminals.
  * Fixed an issue where running freshclam manually causes a daemonized
    freshclam process to fail when it updates because the manual instance
    deletes the temporary download directory. The freshclam temporary files
    will now download to a unique directory created at the time of an update
    instead of using a hardcoded directory created/destroyed at the program
    start/exit.
  * Fix for freshclam's OnOutdatedExecute config option.
  * Fixes a memory leak in the error condition handling for the email
    parser.
  * Improved bound checking and error handling in ARJ archive parser.
  * Improved error handling in PDF parser.
  * Fix for memory leak in byte-compare signature handler.</changelog>
  <changelog author="mpluskal@suse.com" date="1585742400">- Drop python build dependency as it is not needed</changelog>
  <changelog author="suse+build@de-korte.org" date="1589284800">- Update to 0.102.3
  * CVE-2020-3327: Fix a vulnerability in the ARJ archive parsing
    module in ClamAV 0.102.2 that could cause a Denial-of-Service (DoS)
    condition. Improper bounds checking of an unsigned variable results
    in an out-of-bounds read which causes a crash.
  * CVE-2020-3341: Fix a vulnerability in the PDF parsing module in
    ClamAV 0.101 - 0.102.2 that could cause a Denial-of-Service (DoS)
    condition. Improper size checking of a buffer used to initialize AES
    decryption routines results in an out-of-bounds read which may cause
    a crash.
  * Fix "Attempt to allocate 0 bytes" error when parsing some PDF
    documents.
  * Fix a couple of minor memory leaks.
  * Updated libclamunrar to UnRAR 5.9.2.</changelog>
  <changelog author="suse+build@de-korte.org" date="1594900800">- Update to 0.102.4
  * CVE-2020-3350: Fix a vulnerability wherein a malicious user could
    replace a scan target's directory with a symlink to another path
    to trick clamscan, clamdscan, or clamonacc into removing or moving
    a different file (eg. a critical system file). The issue would
    affect users that use the --move or --remove options for clamscan,
    clamdscan, and clamonacc.
  * CVE-2020-3327: Fix a vulnerability in the ARJ archive parsing
    module in ClamAV 0.102.3 that could cause a Denial-of-Service
    (DoS) condition. Improper bounds checking results in an
    out-of-bounds read which could cause a crash. The previous fix for
    this CVE in 0.102.3 was incomplete. This fix correctly resolves
    the issue.
  * CVE-2020-3481: Fix a vulnerability in the EGG archive module in
    ClamAV 0.102.0 - 0.102.3 could cause a Denial-of-Service (DoS)
    condition. Improper error handling may result in a crash due to a
    NULL pointer dereference. This vulnerability is mitigated for
    those using the official ClamAV signature databases because the
    file type signatures in daily.cvd will not enable the EGG archive
    parser in versions affected by the vulnerability.</changelog>
  <changelog author="suse+build@de-korte.org" date="1600084800">- Update to 0.103.0
  * clamd can now reload the signature database without blocking
    scanning. This multi-threaded database reload improvement was made
    possible thanks to a community effort.
  - Non-blocking database reloads are now the default behavior. Some
    systems that are more constrained on RAM may need to disable
    non-blocking reloads as it will temporarily consume two times as
    much memory. We added a new clamd config option
    ConcurrentDatabaseReload, which may be set to no.
  * Dropped clamav-str-h.patch (no longer needed)
  * Fix clamav-milter.service (requires clamd.service to run)</changelog>
  <changelog author="max@suse.com" date="1605009600">- Sync Factory to SLE-15 to implement jsc#ECO-3010 and bsc#1118459.
- bsc#1119353, clamav-fips.patch: Fix freshclam crash in FIPS mode.
- Keep OBS from installing an existing clamav instance to scan the
  sources, because this makes "make check" use the old library
  instead of the just built one. This is only a workaround until
  we found a way to keep libtool from adding libdir to rpath and
  LD_LIBRARY_PATH of the binaries in the testsuite.</changelog>
  <changelog author="dimstar@opensuse.org" date="1605182400">- Do not hard-depend on systemd: use systemd_ordering instead of
  systemd_requires.</changelog>
  <changelog author="max@suse.com" date="1617969600">- Update clamav.keyring
- Update to 0.103.2
  * CVE-2021-1252, bsc#1184532: Fix for Excel XLM parser infinite
    loop. Affects 0.103.0 and 0.103.1 only.
  * CVE-2021-1404, bsc#1184533: Fix for PDF parser buffer over-read;
    possible crash. Affects 0.103.0 and 0.103.1 only.
  * CVE-2021-1405, bsc#1184534: Fix for mail parser
    NULL-dereference crash. Affects 0.103.1 and prior.
  * Fix possible memory leak in PNG parser.
  * Fix ClamOnAcc scan on file-creation race condition so files are
    scanned after their contents are written.
  * FreshClam: Deprecate the SafeBrowsing config option. The
    SafeBrowsing option will no longer do anything.
  * For more details, see our blog post from last year about the
    future of the ClamAV Safe Browsing database.
  * FreshClam: Improved HTTP 304, 403, &amp; 429 handling.
  * FreshClam: Added back the mirrors.dat file to the database directory.
  * FreshClam will now exit with a failure in daemon mode if an HTTP 403
    (Forbidden) was received, because retrying later won't help any. The
    FreshClam user will have to take actions to get unblocked.
  * Fix the FreshClam mirror-sync issue where a downloaded database is
    "older than the version advertised."
  * bsc#1181256: Fix errors when scanning files &gt; 4G
  * obsoletes clamav-disable-timestamps.patch
- Update to 0.103.1
  * Added a new scan option to alert on broken media (graphics) file
    formats. This feature mitigates the risk of malformed media files
    intended to exploit vulnerabilities in other software. At present
    media validation exists for JPEG, TIFF, PNG, and GIF files. To
    enable this feature, set AlertBrokenMedia yes in clamd.conf, or
    use the --alert-broken-media option when using clamscan. These
    options are disabled by default in this patch release, but may be
    enabled in a subsequent release. Application developers may enable
    this scan option by enabling CL_SCAN_HEURISTIC_BROKEN_MEDIA for
    the heuristic scan option bit field.
  * Added CL_TYPE_TIFF, CL_TYPE_JPEG types to match GIF, PNG typing
    behavior. BMP and JPEG 2000 files will continue to detect as
    CL_TYPE_GRAPHICS because ClamAV does not yet have BMP or JPEG
    2000 format checking capabilities.
  * Fixed PNG parser logic bugs that caused an excess of parsing
    errors and fixed a stack exhaustion issue affecting some systems
    when scanning PNG files. PNG file type detection was disabled via
    signature database update for ClamAV version 0.103.0 to mitigate
    the effects from these bugs.
  * Fixed an issue where PNG and GIF files no longer work with
    Target:5 graphics signatures if detected as CL_TYPE_PNG/GIF rather
    than as CL_TYPE_GRAPHICS. Target types now support up to 10
    possible file types to make way for additional graphics types in
    future releases.
  * Fixed clamonacc's --fdpass option.
  - Interprocess file descriptor passing for clamonacc was broken
    since version 0.102.0 due to a bug introduced by the switch to
    curl for communicating with clamd. On Linux, passing file
    descriptors from one process to another is handled by the
    kernel, so we reverted clamonacc to use standard system calls
    for socket communication when fd passing is enabled.
  * Fixed a clamonacc stack corruption issue on some systems when
    using an older version of libcurl.
  * Allow clamscan and clamdscan scans to proceed even if the
    realpath lookup failed. This alleviates an issue on Windows
    scanning files hosted on file- systems that do not support the
    GetMappedFileNameW() API such as on ImDisk RAM-disks.
  * Fixed freshclam --on-update-execute=EXIT_1 temporary directory
    cleanup issue.
  * clamd's log output and VirusEvent now provide the scan target's
    file path instead of a file descriptor. The clamd socket API for
    submitting a scan by FD-passing doesn't include a file path, this
    feature works by looking up the file path by file descriptor.
    This feature works on Mac and Linux but is not yet implemented
    for other UNIX operating systems. FD-passing is not available for
    Windows.
  * Fixed an issue where freshclam database validation didn't work
    correctly when run in daemon mode on Linux/Unix.</changelog>
  <changelog author="suse+build@de-korte.org" date="1624276800">- bsc#1188284: Update to 0.103.3
  * Fixed a scan performance issue when ENGINE_OPTIONS_FORCE_TO_DISK is
    enabled. This issue did not impacted most users but for those
    affected it caused every scanned file to be copied to the temp
    directory before the scan.
  * Fix ClamDScan crashes when using the --fdpass --multiscan
    command-line options in combination with the ClamD ExcludePath
    config file options.
  * Fixed an issue where the mirrors.dat file is owned by root when
    starting as root (or with sudo) and using daemon-mode. File
    ownership will be set to the DatabaseOwner just before FreshClam
    switches to run as that user.
  * Renamed the mirrors.dat file to freshclam.dat.
  * Disabled the HTTPUserAgent config option if the DatabaseMirror uses
    clamav.net. This will prevent users from being inadvertently blocked
    and will ensure that we can keep better metrics on which ClamAV
    versions are being used.
  * Moved the detection for Heuristics.PNG.CVE-2010-1205 behind the
    ClamScan --alert-broken-media option (ClamD AlertBrokenMedia yes)
    option. This type of PNG issue appears to be common enough to be an
    annoyance, and the CVE is old enough that no one should be
    vulnerable at this point.
  * Fix ClamSubmit failures after changes to Cloudflare "__cfduid"
    cookies. See: https://blog.cloudflare.com/deprecating-cfduid-cookie/</changelog>
  <changelog author="meissner@suse.com" date="1625054400">- clamav-document-maxsize.patch: in the "clamscan" and "clamdscan" manpages,
  document that files over a certain size by default will silently not be
  scanned and how this can be adjusted (bsc#1187509)</changelog>
  <changelog author="max@suse.com" date="1636372800">- bsc#1192346: Update to 0.103.4
  * FreshClam:
  - Add a 24-hour cool-down for FreshClam clients that have received
    an HTTP 403 (Forbidden) response from the CDN. This is to reduce
    the volume of 403-response data served to blocked FreshClam
    clients that are configured with a tight update-loop.
  - Fixed a bug where FreshClam treats an empty CDIFF as an
    incremental update failure instead of as an intentional request
    to download the whole CVD.
  * ClamDScan: Fix a scan error when broken symlinks are encountered on
    macOS with "FollowDirectorySymlinks" and "FollowFileSymlinks"
    options disabled.
  * Overhauled the scan recursion / nested archive extraction logic and
    added new limits on embedded file-type recognition performed during
    the "raw" scan of each file. This limits embedded file-type
    misidentification and prevents detecting embedded file content that
    is found/extracted and scanned at other layers in the scanning
    process.
  * Fix an issue with the FMap module that failed to read from some
    nested files.
  * Fixed an issue where failing to load some rules from a Yara file
    containing multiple rules may cause a crash.
  * Fixed assorted compiler warnings.
  * Fixed assorted Coverity static code analysis issues.
  * Scan limits:
  - Added virus-name suffixes to the alerts that trigger when a scan
    limit has been exceeded. Rather than simply
    Heuristics.Limits.Exceeded, you may now see limit-specific
    virus-names, to include:
    + Heuristics.Limits.Exceeded.MaxFileSize
    + Heuristics.Limits.Exceeded.MaxScanSize
    + Heuristics.Limits.Exceeded.MaxFiles
    + Heuristics.Limits.Exceeded.MaxRecursion
    + Heuristics.Limits.Exceeded.MaxScanTime
  - Renamed the Heuristics.Email.ExceedsMax.* alerts to align with
    the other limit alerts names. These alerts include:
    + Heuristics.Limits.Exceeded.EmailLineFoldcnt
    + Heuristics.Limits.Exceeded.EmailHeaderBytes
    + Heuristics.Limits.Exceeded.EmailHeaders
    + Heuristics.Limits.Exceeded.EmailMIMEPartsPerMessage
    + Heuristics.Limits.Exceeded.EmailMIMEArguments
  - Fixed an issue where the Email-related scan limits would alert
    even when the "AlertExceedsMax" (--alert-exceeds-max) scan option
    is not enabled.
  - Fixes an issue in the Zip parser where exceeding the "MaxFiles"
    limit or the "MaxFileSize" limit would abort the scan but would
    fail to alert. The Zip scan limit issues were independently
    identified and reported by Aaron Leliaert and Max Allan.
  * Fixed a leak in the Email parser when using the --gen-json scan
    option.
  * Fixed an issue where a failure to record metadata in the Email
    parser when using the --gen-json scan option could cause the Email
    parser to abort the scan early and fail to extract and scan
    additional content.
  * Fixed a file name memory leak in the Zip parser.
  * Fixed an issue where certain signature patterns may cause a crash or
    cause unintended matches on some systems when converting characters
    to uppercase if a UTF-8 unicode single-byte grapheme becomes a
    multi-byte grapheme. Patch courtesy of Andrea De Pasquale.
- Fix unit test
  + clamav-ck_assert_msg.patch</changelog>
  <changelog author="max@suse.com" date="1642420800">- Update to 0.103.5
  * bsc#1194731, CVE-2022-20698:
    Fix for invalid pointer read that may cause a crash.
    This issue affects 0.104.1, 0.103.4 and prior when ClamAV is compiled
    with libjson-c and the CL_SCAN_GENERAL_COLLECT_METADATA scan option
    (the clamscan --gen-json option) is enabled.
  * Fixed ability to disable the file size limit with libclamav C API,
    like this:
    cl_engine_set_num(engine, CL_ENGINE_MAX_FILESIZE, 0);
    This issue didn't affect ClamD or ClamScan which also can disable the
    limit by setting it to zero using MaxFileSize 0 in clamd.conf for ClamD,
    or clamscan --max-filesize=0 for ClamScan.
    Note: Internally, the max file size is still set to 2 GiB. Disabling the
    limit for a scan will fall back on the internal 2 GiB limitation.
  * Increased the maximum line length for ClamAV config files from 512 bytes
    to 1,024 bytes to allow for longer config option strings.
  * SigTool: Fix insufficient buffer size for --list-sigs that caused a
    failure when listing a database containing one or more very long
    signatures. This fix was backported from 0.104.</changelog>
</package>
<package pkgid="b4eb49c5d3b38318b62ffccf0b044bbd4525f98f9ad9286c5f0fadc9f433e3b2" name="libclamav9" arch="s390x">
  <version epoch="0" ver="0.103.5" rel="3.35.1"/>
  <changelog author="egdfree@opensuse.org" date="1553688000">- Update to version 0.101.2 (bsc#1130721)
  * CVE-2019-1787:
    An out-of-bounds heap read condition may occur when scanning PDF
    documents. The defect is a failure to correctly keep track of the number
    of bytes remaining in a buffer when indexing file data.
  * CVE-2019-1789:
    An out-of-bounds heap read condition may occur when scanning PE files
    (i.e. Windows EXE and DLL files) that have been packed using Aspack as a
    result of inadequate bound-checking.
  * CVE-2019-1788:
    An out-of-bounds heap write condition may occur when scanning OLE2 files
    such as Microsoft Office 97-2003 documents. The invalid write happens when
    an invalid pointer is mistakenly used to initialize a 32bit integer to
    zero. This is likely to crash the application.
  * CVE-2019-1786:
    An out-of-bounds heap read condition may occur when scanning malformed
    PDF documents as a result of improper bounds-checking.
  * CVE-2019-1785:
    A path-traversal write condition may occur as a result of improper
    input validation when scanning RAR archives.
  * CVE-2019-1798:
    A use-after-free condition may occur as a result of improper error
    handling when scanning nested RAR archives.
- added clamav-max_patch.patch to fix build
- dropped clamav-freshclam-exit.patch</changelog>
  <changelog author="max@suse.com" date="1565092800">- Update to version 0.101.3:
  * bsc#1144504: ZIP bomb causes extreme CPU spikes</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1567598400">- update to 0.101.4:
  * CVE-2019-12900: An out of bounds write in the NSIS bzip2
    (boo#1149458)
  * CVE-2019-12625: Introduce a configurable time limit to mitigate
    zip bomb vulnerability completely. Default is 2 minutes,
    configurable useing the clamscan --max-scantime and for clamd
    using the MaxScanTime config option (boo#1144504)</changelog>
  <changelog author="max@suse.com" date="1572004800">- bsc#1151839: Increase the startup timeout of clamd to 5 minutes
  to cater for the grown virus database as a workaround until
  clamd has learned to talk to systemd to extend the timeout as
  long as needed.</changelog>
  <changelog author="suse+build@de-korte.org" date="1572609600">- update to 0.102.0
  * The On-Access Scanning feature has been migrated out of clamd
    and into a brand new utility named clamonacc. This utility is
    similar to clamdscan and clamav-milter in that it acts as a
    client to clamd. This separation from clamd means that clamd no
    longer needs to run with root privileges while scanning potentially
    malicious files. Instead, clamd may drop privileges to run under an
    account that does not have super-user. In addition to improving the
    security posture of running clamd with On-Access enabled, this
    update fixed a few outstanding defects:
  - On-Access scanning for created and moved files (Extra-Scanning)
    is fixed.
  - VirusEvent for On-Access scans is fixed.
  - With clamonacc, it is now possible to copy, move, or remove a
    file if the scan triggered an alert, just like with clamdscan.
  * The freshclam database update utility has undergone a significant
    update. This includes:
  - Added support for HTTPS.
  - Support for database mirrors hosted on ports other than 80.
  - Removal of the mirror management feature (mirrors.dat).
  - An all new libfreshclam library API.
- created new subpackage libfreshclam2
- dropped clamav-max_patch.patch (upstreamed)
- added clamav-fix_building_milter.patch to fix build of milter</changelog>
  <changelog author="suse+build@de-korte.org" date="1574251200">- update to 0.102.1
  * CVE-2019-15961, bsc#1157763: A Denial-of-Service (DoS)
    vulnerability may occur when scanning a specially crafted email
    file as a result of excessively long scan times. The issue is
    resolved by implementing several maximums in parsing MIME
    messages and by optimizing use of memory allocation.
  * Build system fixes to build clamav-milter, to correctly link
    with libxml2 when detected, and to correctly detect fanotify
    for on-access scanning feature support.
  * Signature load time is significantly reduced by changing to a
    more efficient algorithm for loading signature patterns and
    allocating the AC trie. Patch courtesy of Alberto Wu.
  * Introduced a new configure option to statically link libjson-c
    with libclamav. Static linking with libjson is highly
    recommended to prevent crashes in applications that use
    libclamav alongside another JSON parsing library.
  * Null-dereference fix in email parser when using the
  - -gen-json metadata option.
  * Fixes for Authenticode parsing and certificate signature
    (.crb database) bugs.
- dropped clamav-fix_building_milter.patch (upstreamed)</changelog>
  <changelog author="dimstar@opensuse.org" date="1576756800">- BuildRequire pkgconfig(libsystemd) instead of systemd-devel:
  Allow OBS to shortcut through the -mini flavors.</changelog>
  <changelog author="suse+build@de-korte.org" date="1577188800">- The freshclam.service should not be started before the network is
  online (it checks for updates immediately upon service start)</changelog>
  <changelog author="suse+build@de-korte.org" date="1580904000">- update to 0.102.2
  * CVE-2020-3123: A denial-of-service (DoS) condition may occur when
    using the optional credit card data-loss-prevention (DLP) feature.
    Improper bounds checking of an unsigned variable resulted in an
    out-of-bounds read, which causes a crash.
  * Significantly improved the scan speed of PDF files on Windows.
  * Re-applied a fix to alleviate file access issues when scanning RAR
    files in downstream projects that use libclamav where the scanning
    engine is operating in a low-privilege process. This bug was originally
    fixed in 0.101.2 and the fix was mistakenly omitted from 0.102.0.
  * Fixed an issue where freshclam failed to update if the database version
    downloaded is one version older than advertised. This situation may
    occur after a new database version is published. The issue affected
    users downloading the whole CVD database file.
  * Changed the default freshclam ReceiveTimeout setting to 0 (infinite).
    The ReceiveTimeout had caused needless database update failures for
    users with slower internet connections.
  * Correctly display the number of kilobytes (KiB) in progress bar and
    reduced the size of the progress bar to accommodate 80-character width
    terminals.
  * Fixed an issue where running freshclam manually causes a daemonized
    freshclam process to fail when it updates because the manual instance
    deletes the temporary download directory. The freshclam temporary files
    will now download to a unique directory created at the time of an update
    instead of using a hardcoded directory created/destroyed at the program
    start/exit.
  * Fix for freshclam's OnOutdatedExecute config option.
  * Fixes a memory leak in the error condition handling for the email
    parser.
  * Improved bound checking and error handling in ARJ archive parser.
  * Improved error handling in PDF parser.
  * Fix for memory leak in byte-compare signature handler.</changelog>
  <changelog author="mpluskal@suse.com" date="1585742400">- Drop python build dependency as it is not needed</changelog>
  <changelog author="suse+build@de-korte.org" date="1589284800">- Update to 0.102.3
  * CVE-2020-3327: Fix a vulnerability in the ARJ archive parsing
    module in ClamAV 0.102.2 that could cause a Denial-of-Service (DoS)
    condition. Improper bounds checking of an unsigned variable results
    in an out-of-bounds read which causes a crash.
  * CVE-2020-3341: Fix a vulnerability in the PDF parsing module in
    ClamAV 0.101 - 0.102.2 that could cause a Denial-of-Service (DoS)
    condition. Improper size checking of a buffer used to initialize AES
    decryption routines results in an out-of-bounds read which may cause
    a crash.
  * Fix "Attempt to allocate 0 bytes" error when parsing some PDF
    documents.
  * Fix a couple of minor memory leaks.
  * Updated libclamunrar to UnRAR 5.9.2.</changelog>
  <changelog author="suse+build@de-korte.org" date="1594900800">- Update to 0.102.4
  * CVE-2020-3350: Fix a vulnerability wherein a malicious user could
    replace a scan target's directory with a symlink to another path
    to trick clamscan, clamdscan, or clamonacc into removing or moving
    a different file (eg. a critical system file). The issue would
    affect users that use the --move or --remove options for clamscan,
    clamdscan, and clamonacc.
  * CVE-2020-3327: Fix a vulnerability in the ARJ archive parsing
    module in ClamAV 0.102.3 that could cause a Denial-of-Service
    (DoS) condition. Improper bounds checking results in an
    out-of-bounds read which could cause a crash. The previous fix for
    this CVE in 0.102.3 was incomplete. This fix correctly resolves
    the issue.
  * CVE-2020-3481: Fix a vulnerability in the EGG archive module in
    ClamAV 0.102.0 - 0.102.3 could cause a Denial-of-Service (DoS)
    condition. Improper error handling may result in a crash due to a
    NULL pointer dereference. This vulnerability is mitigated for
    those using the official ClamAV signature databases because the
    file type signatures in daily.cvd will not enable the EGG archive
    parser in versions affected by the vulnerability.</changelog>
  <changelog author="suse+build@de-korte.org" date="1600084800">- Update to 0.103.0
  * clamd can now reload the signature database without blocking
    scanning. This multi-threaded database reload improvement was made
    possible thanks to a community effort.
  - Non-blocking database reloads are now the default behavior. Some
    systems that are more constrained on RAM may need to disable
    non-blocking reloads as it will temporarily consume two times as
    much memory. We added a new clamd config option
    ConcurrentDatabaseReload, which may be set to no.
  * Dropped clamav-str-h.patch (no longer needed)
  * Fix clamav-milter.service (requires clamd.service to run)</changelog>
  <changelog author="max@suse.com" date="1605009600">- Sync Factory to SLE-15 to implement jsc#ECO-3010 and bsc#1118459.
- bsc#1119353, clamav-fips.patch: Fix freshclam crash in FIPS mode.
- Keep OBS from installing an existing clamav instance to scan the
  sources, because this makes "make check" use the old library
  instead of the just built one. This is only a workaround until
  we found a way to keep libtool from adding libdir to rpath and
  LD_LIBRARY_PATH of the binaries in the testsuite.</changelog>
  <changelog author="dimstar@opensuse.org" date="1605182400">- Do not hard-depend on systemd: use systemd_ordering instead of
  systemd_requires.</changelog>
  <changelog author="max@suse.com" date="1617969600">- Update clamav.keyring
- Update to 0.103.2
  * CVE-2021-1252, bsc#1184532: Fix for Excel XLM parser infinite
    loop. Affects 0.103.0 and 0.103.1 only.
  * CVE-2021-1404, bsc#1184533: Fix for PDF parser buffer over-read;
    possible crash. Affects 0.103.0 and 0.103.1 only.
  * CVE-2021-1405, bsc#1184534: Fix for mail parser
    NULL-dereference crash. Affects 0.103.1 and prior.
  * Fix possible memory leak in PNG parser.
  * Fix ClamOnAcc scan on file-creation race condition so files are
    scanned after their contents are written.
  * FreshClam: Deprecate the SafeBrowsing config option. The
    SafeBrowsing option will no longer do anything.
  * For more details, see our blog post from last year about the
    future of the ClamAV Safe Browsing database.
  * FreshClam: Improved HTTP 304, 403, &amp; 429 handling.
  * FreshClam: Added back the mirrors.dat file to the database directory.
  * FreshClam will now exit with a failure in daemon mode if an HTTP 403
    (Forbidden) was received, because retrying later won't help any. The
    FreshClam user will have to take actions to get unblocked.
  * Fix the FreshClam mirror-sync issue where a downloaded database is
    "older than the version advertised."
  * bsc#1181256: Fix errors when scanning files &gt; 4G
  * obsoletes clamav-disable-timestamps.patch
- Update to 0.103.1
  * Added a new scan option to alert on broken media (graphics) file
    formats. This feature mitigates the risk of malformed media files
    intended to exploit vulnerabilities in other software. At present
    media validation exists for JPEG, TIFF, PNG, and GIF files. To
    enable this feature, set AlertBrokenMedia yes in clamd.conf, or
    use the --alert-broken-media option when using clamscan. These
    options are disabled by default in this patch release, but may be
    enabled in a subsequent release. Application developers may enable
    this scan option by enabling CL_SCAN_HEURISTIC_BROKEN_MEDIA for
    the heuristic scan option bit field.
  * Added CL_TYPE_TIFF, CL_TYPE_JPEG types to match GIF, PNG typing
    behavior. BMP and JPEG 2000 files will continue to detect as
    CL_TYPE_GRAPHICS because ClamAV does not yet have BMP or JPEG
    2000 format checking capabilities.
  * Fixed PNG parser logic bugs that caused an excess of parsing
    errors and fixed a stack exhaustion issue affecting some systems
    when scanning PNG files. PNG file type detection was disabled via
    signature database update for ClamAV version 0.103.0 to mitigate
    the effects from these bugs.
  * Fixed an issue where PNG and GIF files no longer work with
    Target:5 graphics signatures if detected as CL_TYPE_PNG/GIF rather
    than as CL_TYPE_GRAPHICS. Target types now support up to 10
    possible file types to make way for additional graphics types in
    future releases.
  * Fixed clamonacc's --fdpass option.
  - Interprocess file descriptor passing for clamonacc was broken
    since version 0.102.0 due to a bug introduced by the switch to
    curl for communicating with clamd. On Linux, passing file
    descriptors from one process to another is handled by the
    kernel, so we reverted clamonacc to use standard system calls
    for socket communication when fd passing is enabled.
  * Fixed a clamonacc stack corruption issue on some systems when
    using an older version of libcurl.
  * Allow clamscan and clamdscan scans to proceed even if the
    realpath lookup failed. This alleviates an issue on Windows
    scanning files hosted on file- systems that do not support the
    GetMappedFileNameW() API such as on ImDisk RAM-disks.
  * Fixed freshclam --on-update-execute=EXIT_1 temporary directory
    cleanup issue.
  * clamd's log output and VirusEvent now provide the scan target's
    file path instead of a file descriptor. The clamd socket API for
    submitting a scan by FD-passing doesn't include a file path, this
    feature works by looking up the file path by file descriptor.
    This feature works on Mac and Linux but is not yet implemented
    for other UNIX operating systems. FD-passing is not available for
    Windows.
  * Fixed an issue where freshclam database validation didn't work
    correctly when run in daemon mode on Linux/Unix.</changelog>
  <changelog author="suse+build@de-korte.org" date="1624276800">- bsc#1188284: Update to 0.103.3
  * Fixed a scan performance issue when ENGINE_OPTIONS_FORCE_TO_DISK is
    enabled. This issue did not impacted most users but for those
    affected it caused every scanned file to be copied to the temp
    directory before the scan.
  * Fix ClamDScan crashes when using the --fdpass --multiscan
    command-line options in combination with the ClamD ExcludePath
    config file options.
  * Fixed an issue where the mirrors.dat file is owned by root when
    starting as root (or with sudo) and using daemon-mode. File
    ownership will be set to the DatabaseOwner just before FreshClam
    switches to run as that user.
  * Renamed the mirrors.dat file to freshclam.dat.
  * Disabled the HTTPUserAgent config option if the DatabaseMirror uses
    clamav.net. This will prevent users from being inadvertently blocked
    and will ensure that we can keep better metrics on which ClamAV
    versions are being used.
  * Moved the detection for Heuristics.PNG.CVE-2010-1205 behind the
    ClamScan --alert-broken-media option (ClamD AlertBrokenMedia yes)
    option. This type of PNG issue appears to be common enough to be an
    annoyance, and the CVE is old enough that no one should be
    vulnerable at this point.
  * Fix ClamSubmit failures after changes to Cloudflare "__cfduid"
    cookies. See: https://blog.cloudflare.com/deprecating-cfduid-cookie/</changelog>
  <changelog author="meissner@suse.com" date="1625054400">- clamav-document-maxsize.patch: in the "clamscan" and "clamdscan" manpages,
  document that files over a certain size by default will silently not be
  scanned and how this can be adjusted (bsc#1187509)</changelog>
  <changelog author="max@suse.com" date="1636372800">- bsc#1192346: Update to 0.103.4
  * FreshClam:
  - Add a 24-hour cool-down for FreshClam clients that have received
    an HTTP 403 (Forbidden) response from the CDN. This is to reduce
    the volume of 403-response data served to blocked FreshClam
    clients that are configured with a tight update-loop.
  - Fixed a bug where FreshClam treats an empty CDIFF as an
    incremental update failure instead of as an intentional request
    to download the whole CVD.
  * ClamDScan: Fix a scan error when broken symlinks are encountered on
    macOS with "FollowDirectorySymlinks" and "FollowFileSymlinks"
    options disabled.
  * Overhauled the scan recursion / nested archive extraction logic and
    added new limits on embedded file-type recognition performed during
    the "raw" scan of each file. This limits embedded file-type
    misidentification and prevents detecting embedded file content that
    is found/extracted and scanned at other layers in the scanning
    process.
  * Fix an issue with the FMap module that failed to read from some
    nested files.
  * Fixed an issue where failing to load some rules from a Yara file
    containing multiple rules may cause a crash.
  * Fixed assorted compiler warnings.
  * Fixed assorted Coverity static code analysis issues.
  * Scan limits:
  - Added virus-name suffixes to the alerts that trigger when a scan
    limit has been exceeded. Rather than simply
    Heuristics.Limits.Exceeded, you may now see limit-specific
    virus-names, to include:
    + Heuristics.Limits.Exceeded.MaxFileSize
    + Heuristics.Limits.Exceeded.MaxScanSize
    + Heuristics.Limits.Exceeded.MaxFiles
    + Heuristics.Limits.Exceeded.MaxRecursion
    + Heuristics.Limits.Exceeded.MaxScanTime
  - Renamed the Heuristics.Email.ExceedsMax.* alerts to align with
    the other limit alerts names. These alerts include:
    + Heuristics.Limits.Exceeded.EmailLineFoldcnt
    + Heuristics.Limits.Exceeded.EmailHeaderBytes
    + Heuristics.Limits.Exceeded.EmailHeaders
    + Heuristics.Limits.Exceeded.EmailMIMEPartsPerMessage
    + Heuristics.Limits.Exceeded.EmailMIMEArguments
  - Fixed an issue where the Email-related scan limits would alert
    even when the "AlertExceedsMax" (--alert-exceeds-max) scan option
    is not enabled.
  - Fixes an issue in the Zip parser where exceeding the "MaxFiles"
    limit or the "MaxFileSize" limit would abort the scan but would
    fail to alert. The Zip scan limit issues were independently
    identified and reported by Aaron Leliaert and Max Allan.
  * Fixed a leak in the Email parser when using the --gen-json scan
    option.
  * Fixed an issue where a failure to record metadata in the Email
    parser when using the --gen-json scan option could cause the Email
    parser to abort the scan early and fail to extract and scan
    additional content.
  * Fixed a file name memory leak in the Zip parser.
  * Fixed an issue where certain signature patterns may cause a crash or
    cause unintended matches on some systems when converting characters
    to uppercase if a UTF-8 unicode single-byte grapheme becomes a
    multi-byte grapheme. Patch courtesy of Andrea De Pasquale.
- Fix unit test
  + clamav-ck_assert_msg.patch</changelog>
  <changelog author="max@suse.com" date="1642420800">- Update to 0.103.5
  * bsc#1194731, CVE-2022-20698:
    Fix for invalid pointer read that may cause a crash.
    This issue affects 0.104.1, 0.103.4 and prior when ClamAV is compiled
    with libjson-c and the CL_SCAN_GENERAL_COLLECT_METADATA scan option
    (the clamscan --gen-json option) is enabled.
  * Fixed ability to disable the file size limit with libclamav C API,
    like this:
    cl_engine_set_num(engine, CL_ENGINE_MAX_FILESIZE, 0);
    This issue didn't affect ClamD or ClamScan which also can disable the
    limit by setting it to zero using MaxFileSize 0 in clamd.conf for ClamD,
    or clamscan --max-filesize=0 for ClamScan.
    Note: Internally, the max file size is still set to 2 GiB. Disabling the
    limit for a scan will fall back on the internal 2 GiB limitation.
  * Increased the maximum line length for ClamAV config files from 512 bytes
    to 1,024 bytes to allow for longer config option strings.
  * SigTool: Fix insufficient buffer size for --list-sigs that caused a
    failure when listing a database containing one or more very long
    signatures. This fix was backported from 0.104.</changelog>
</package>
<package pkgid="575a725c8729e83c98f73de9e79baf864acf53b579726334f7788678750679c4" name="libclamav9" arch="x86_64">
  <version epoch="0" ver="0.103.5" rel="3.35.1"/>
  <changelog author="egdfree@opensuse.org" date="1553688000">- Update to version 0.101.2 (bsc#1130721)
  * CVE-2019-1787:
    An out-of-bounds heap read condition may occur when scanning PDF
    documents. The defect is a failure to correctly keep track of the number
    of bytes remaining in a buffer when indexing file data.
  * CVE-2019-1789:
    An out-of-bounds heap read condition may occur when scanning PE files
    (i.e. Windows EXE and DLL files) that have been packed using Aspack as a
    result of inadequate bound-checking.
  * CVE-2019-1788:
    An out-of-bounds heap write condition may occur when scanning OLE2 files
    such as Microsoft Office 97-2003 documents. The invalid write happens when
    an invalid pointer is mistakenly used to initialize a 32bit integer to
    zero. This is likely to crash the application.
  * CVE-2019-1786:
    An out-of-bounds heap read condition may occur when scanning malformed
    PDF documents as a result of improper bounds-checking.
  * CVE-2019-1785:
    A path-traversal write condition may occur as a result of improper
    input validation when scanning RAR archives.
  * CVE-2019-1798:
    A use-after-free condition may occur as a result of improper error
    handling when scanning nested RAR archives.
- added clamav-max_patch.patch to fix build
- dropped clamav-freshclam-exit.patch</changelog>
  <changelog author="max@suse.com" date="1565092800">- Update to version 0.101.3:
  * bsc#1144504: ZIP bomb causes extreme CPU spikes</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1567598400">- update to 0.101.4:
  * CVE-2019-12900: An out of bounds write in the NSIS bzip2
    (boo#1149458)
  * CVE-2019-12625: Introduce a configurable time limit to mitigate
    zip bomb vulnerability completely. Default is 2 minutes,
    configurable useing the clamscan --max-scantime and for clamd
    using the MaxScanTime config option (boo#1144504)</changelog>
  <changelog author="max@suse.com" date="1572004800">- bsc#1151839: Increase the startup timeout of clamd to 5 minutes
  to cater for the grown virus database as a workaround until
  clamd has learned to talk to systemd to extend the timeout as
  long as needed.</changelog>
  <changelog author="suse+build@de-korte.org" date="1572609600">- update to 0.102.0
  * The On-Access Scanning feature has been migrated out of clamd
    and into a brand new utility named clamonacc. This utility is
    similar to clamdscan and clamav-milter in that it acts as a
    client to clamd. This separation from clamd means that clamd no
    longer needs to run with root privileges while scanning potentially
    malicious files. Instead, clamd may drop privileges to run under an
    account that does not have super-user. In addition to improving the
    security posture of running clamd with On-Access enabled, this
    update fixed a few outstanding defects:
  - On-Access scanning for created and moved files (Extra-Scanning)
    is fixed.
  - VirusEvent for On-Access scans is fixed.
  - With clamonacc, it is now possible to copy, move, or remove a
    file if the scan triggered an alert, just like with clamdscan.
  * The freshclam database update utility has undergone a significant
    update. This includes:
  - Added support for HTTPS.
  - Support for database mirrors hosted on ports other than 80.
  - Removal of the mirror management feature (mirrors.dat).
  - An all new libfreshclam library API.
- created new subpackage libfreshclam2
- dropped clamav-max_patch.patch (upstreamed)
- added clamav-fix_building_milter.patch to fix build of milter</changelog>
  <changelog author="suse+build@de-korte.org" date="1574251200">- update to 0.102.1
  * CVE-2019-15961, bsc#1157763: A Denial-of-Service (DoS)
    vulnerability may occur when scanning a specially crafted email
    file as a result of excessively long scan times. The issue is
    resolved by implementing several maximums in parsing MIME
    messages and by optimizing use of memory allocation.
  * Build system fixes to build clamav-milter, to correctly link
    with libxml2 when detected, and to correctly detect fanotify
    for on-access scanning feature support.
  * Signature load time is significantly reduced by changing to a
    more efficient algorithm for loading signature patterns and
    allocating the AC trie. Patch courtesy of Alberto Wu.
  * Introduced a new configure option to statically link libjson-c
    with libclamav. Static linking with libjson is highly
    recommended to prevent crashes in applications that use
    libclamav alongside another JSON parsing library.
  * Null-dereference fix in email parser when using the
  - -gen-json metadata option.
  * Fixes for Authenticode parsing and certificate signature
    (.crb database) bugs.
- dropped clamav-fix_building_milter.patch (upstreamed)</changelog>
  <changelog author="dimstar@opensuse.org" date="1576756800">- BuildRequire pkgconfig(libsystemd) instead of systemd-devel:
  Allow OBS to shortcut through the -mini flavors.</changelog>
  <changelog author="suse+build@de-korte.org" date="1577188800">- The freshclam.service should not be started before the network is
  online (it checks for updates immediately upon service start)</changelog>
  <changelog author="suse+build@de-korte.org" date="1580904000">- update to 0.102.2
  * CVE-2020-3123: A denial-of-service (DoS) condition may occur when
    using the optional credit card data-loss-prevention (DLP) feature.
    Improper bounds checking of an unsigned variable resulted in an
    out-of-bounds read, which causes a crash.
  * Significantly improved the scan speed of PDF files on Windows.
  * Re-applied a fix to alleviate file access issues when scanning RAR
    files in downstream projects that use libclamav where the scanning
    engine is operating in a low-privilege process. This bug was originally
    fixed in 0.101.2 and the fix was mistakenly omitted from 0.102.0.
  * Fixed an issue where freshclam failed to update if the database version
    downloaded is one version older than advertised. This situation may
    occur after a new database version is published. The issue affected
    users downloading the whole CVD database file.
  * Changed the default freshclam ReceiveTimeout setting to 0 (infinite).
    The ReceiveTimeout had caused needless database update failures for
    users with slower internet connections.
  * Correctly display the number of kilobytes (KiB) in progress bar and
    reduced the size of the progress bar to accommodate 80-character width
    terminals.
  * Fixed an issue where running freshclam manually causes a daemonized
    freshclam process to fail when it updates because the manual instance
    deletes the temporary download directory. The freshclam temporary files
    will now download to a unique directory created at the time of an update
    instead of using a hardcoded directory created/destroyed at the program
    start/exit.
  * Fix for freshclam's OnOutdatedExecute config option.
  * Fixes a memory leak in the error condition handling for the email
    parser.
  * Improved bound checking and error handling in ARJ archive parser.
  * Improved error handling in PDF parser.
  * Fix for memory leak in byte-compare signature handler.</changelog>
  <changelog author="mpluskal@suse.com" date="1585742400">- Drop python build dependency as it is not needed</changelog>
  <changelog author="suse+build@de-korte.org" date="1589284800">- Update to 0.102.3
  * CVE-2020-3327: Fix a vulnerability in the ARJ archive parsing
    module in ClamAV 0.102.2 that could cause a Denial-of-Service (DoS)
    condition. Improper bounds checking of an unsigned variable results
    in an out-of-bounds read which causes a crash.
  * CVE-2020-3341: Fix a vulnerability in the PDF parsing module in
    ClamAV 0.101 - 0.102.2 that could cause a Denial-of-Service (DoS)
    condition. Improper size checking of a buffer used to initialize AES
    decryption routines results in an out-of-bounds read which may cause
    a crash.
  * Fix "Attempt to allocate 0 bytes" error when parsing some PDF
    documents.
  * Fix a couple of minor memory leaks.
  * Updated libclamunrar to UnRAR 5.9.2.</changelog>
  <changelog author="suse+build@de-korte.org" date="1594900800">- Update to 0.102.4
  * CVE-2020-3350: Fix a vulnerability wherein a malicious user could
    replace a scan target's directory with a symlink to another path
    to trick clamscan, clamdscan, or clamonacc into removing or moving
    a different file (eg. a critical system file). The issue would
    affect users that use the --move or --remove options for clamscan,
    clamdscan, and clamonacc.
  * CVE-2020-3327: Fix a vulnerability in the ARJ archive parsing
    module in ClamAV 0.102.3 that could cause a Denial-of-Service
    (DoS) condition. Improper bounds checking results in an
    out-of-bounds read which could cause a crash. The previous fix for
    this CVE in 0.102.3 was incomplete. This fix correctly resolves
    the issue.
  * CVE-2020-3481: Fix a vulnerability in the EGG archive module in
    ClamAV 0.102.0 - 0.102.3 could cause a Denial-of-Service (DoS)
    condition. Improper error handling may result in a crash due to a
    NULL pointer dereference. This vulnerability is mitigated for
    those using the official ClamAV signature databases because the
    file type signatures in daily.cvd will not enable the EGG archive
    parser in versions affected by the vulnerability.</changelog>
  <changelog author="suse+build@de-korte.org" date="1600084800">- Update to 0.103.0
  * clamd can now reload the signature database without blocking
    scanning. This multi-threaded database reload improvement was made
    possible thanks to a community effort.
  - Non-blocking database reloads are now the default behavior. Some
    systems that are more constrained on RAM may need to disable
    non-blocking reloads as it will temporarily consume two times as
    much memory. We added a new clamd config option
    ConcurrentDatabaseReload, which may be set to no.
  * Dropped clamav-str-h.patch (no longer needed)
  * Fix clamav-milter.service (requires clamd.service to run)</changelog>
  <changelog author="max@suse.com" date="1605009600">- Sync Factory to SLE-15 to implement jsc#ECO-3010 and bsc#1118459.
- bsc#1119353, clamav-fips.patch: Fix freshclam crash in FIPS mode.
- Keep OBS from installing an existing clamav instance to scan the
  sources, because this makes "make check" use the old library
  instead of the just built one. This is only a workaround until
  we found a way to keep libtool from adding libdir to rpath and
  LD_LIBRARY_PATH of the binaries in the testsuite.</changelog>
  <changelog author="dimstar@opensuse.org" date="1605182400">- Do not hard-depend on systemd: use systemd_ordering instead of
  systemd_requires.</changelog>
  <changelog author="max@suse.com" date="1617969600">- Update clamav.keyring
- Update to 0.103.2
  * CVE-2021-1252, bsc#1184532: Fix for Excel XLM parser infinite
    loop. Affects 0.103.0 and 0.103.1 only.
  * CVE-2021-1404, bsc#1184533: Fix for PDF parser buffer over-read;
    possible crash. Affects 0.103.0 and 0.103.1 only.
  * CVE-2021-1405, bsc#1184534: Fix for mail parser
    NULL-dereference crash. Affects 0.103.1 and prior.
  * Fix possible memory leak in PNG parser.
  * Fix ClamOnAcc scan on file-creation race condition so files are
    scanned after their contents are written.
  * FreshClam: Deprecate the SafeBrowsing config option. The
    SafeBrowsing option will no longer do anything.
  * For more details, see our blog post from last year about the
    future of the ClamAV Safe Browsing database.
  * FreshClam: Improved HTTP 304, 403, &amp; 429 handling.
  * FreshClam: Added back the mirrors.dat file to the database directory.
  * FreshClam will now exit with a failure in daemon mode if an HTTP 403
    (Forbidden) was received, because retrying later won't help any. The
    FreshClam user will have to take actions to get unblocked.
  * Fix the FreshClam mirror-sync issue where a downloaded database is
    "older than the version advertised."
  * bsc#1181256: Fix errors when scanning files &gt; 4G
  * obsoletes clamav-disable-timestamps.patch
- Update to 0.103.1
  * Added a new scan option to alert on broken media (graphics) file
    formats. This feature mitigates the risk of malformed media files
    intended to exploit vulnerabilities in other software. At present
    media validation exists for JPEG, TIFF, PNG, and GIF files. To
    enable this feature, set AlertBrokenMedia yes in clamd.conf, or
    use the --alert-broken-media option when using clamscan. These
    options are disabled by default in this patch release, but may be
    enabled in a subsequent release. Application developers may enable
    this scan option by enabling CL_SCAN_HEURISTIC_BROKEN_MEDIA for
    the heuristic scan option bit field.
  * Added CL_TYPE_TIFF, CL_TYPE_JPEG types to match GIF, PNG typing
    behavior. BMP and JPEG 2000 files will continue to detect as
    CL_TYPE_GRAPHICS because ClamAV does not yet have BMP or JPEG
    2000 format checking capabilities.
  * Fixed PNG parser logic bugs that caused an excess of parsing
    errors and fixed a stack exhaustion issue affecting some systems
    when scanning PNG files. PNG file type detection was disabled via
    signature database update for ClamAV version 0.103.0 to mitigate
    the effects from these bugs.
  * Fixed an issue where PNG and GIF files no longer work with
    Target:5 graphics signatures if detected as CL_TYPE_PNG/GIF rather
    than as CL_TYPE_GRAPHICS. Target types now support up to 10
    possible file types to make way for additional graphics types in
    future releases.
  * Fixed clamonacc's --fdpass option.
  - Interprocess file descriptor passing for clamonacc was broken
    since version 0.102.0 due to a bug introduced by the switch to
    curl for communicating with clamd. On Linux, passing file
    descriptors from one process to another is handled by the
    kernel, so we reverted clamonacc to use standard system calls
    for socket communication when fd passing is enabled.
  * Fixed a clamonacc stack corruption issue on some systems when
    using an older version of libcurl.
  * Allow clamscan and clamdscan scans to proceed even if the
    realpath lookup failed. This alleviates an issue on Windows
    scanning files hosted on file- systems that do not support the
    GetMappedFileNameW() API such as on ImDisk RAM-disks.
  * Fixed freshclam --on-update-execute=EXIT_1 temporary directory
    cleanup issue.
  * clamd's log output and VirusEvent now provide the scan target's
    file path instead of a file descriptor. The clamd socket API for
    submitting a scan by FD-passing doesn't include a file path, this
    feature works by looking up the file path by file descriptor.
    This feature works on Mac and Linux but is not yet implemented
    for other UNIX operating systems. FD-passing is not available for
    Windows.
  * Fixed an issue where freshclam database validation didn't work
    correctly when run in daemon mode on Linux/Unix.</changelog>
  <changelog author="suse+build@de-korte.org" date="1624276800">- bsc#1188284: Update to 0.103.3
  * Fixed a scan performance issue when ENGINE_OPTIONS_FORCE_TO_DISK is
    enabled. This issue did not impacted most users but for those
    affected it caused every scanned file to be copied to the temp
    directory before the scan.
  * Fix ClamDScan crashes when using the --fdpass --multiscan
    command-line options in combination with the ClamD ExcludePath
    config file options.
  * Fixed an issue where the mirrors.dat file is owned by root when
    starting as root (or with sudo) and using daemon-mode. File
    ownership will be set to the DatabaseOwner just before FreshClam
    switches to run as that user.
  * Renamed the mirrors.dat file to freshclam.dat.
  * Disabled the HTTPUserAgent config option if the DatabaseMirror uses
    clamav.net. This will prevent users from being inadvertently blocked
    and will ensure that we can keep better metrics on which ClamAV
    versions are being used.
  * Moved the detection for Heuristics.PNG.CVE-2010-1205 behind the
    ClamScan --alert-broken-media option (ClamD AlertBrokenMedia yes)
    option. This type of PNG issue appears to be common enough to be an
    annoyance, and the CVE is old enough that no one should be
    vulnerable at this point.
  * Fix ClamSubmit failures after changes to Cloudflare "__cfduid"
    cookies. See: https://blog.cloudflare.com/deprecating-cfduid-cookie/</changelog>
  <changelog author="meissner@suse.com" date="1625054400">- clamav-document-maxsize.patch: in the "clamscan" and "clamdscan" manpages,
  document that files over a certain size by default will silently not be
  scanned and how this can be adjusted (bsc#1187509)</changelog>
  <changelog author="max@suse.com" date="1636372800">- bsc#1192346: Update to 0.103.4
  * FreshClam:
  - Add a 24-hour cool-down for FreshClam clients that have received
    an HTTP 403 (Forbidden) response from the CDN. This is to reduce
    the volume of 403-response data served to blocked FreshClam
    clients that are configured with a tight update-loop.
  - Fixed a bug where FreshClam treats an empty CDIFF as an
    incremental update failure instead of as an intentional request
    to download the whole CVD.
  * ClamDScan: Fix a scan error when broken symlinks are encountered on
    macOS with "FollowDirectorySymlinks" and "FollowFileSymlinks"
    options disabled.
  * Overhauled the scan recursion / nested archive extraction logic and
    added new limits on embedded file-type recognition performed during
    the "raw" scan of each file. This limits embedded file-type
    misidentification and prevents detecting embedded file content that
    is found/extracted and scanned at other layers in the scanning
    process.
  * Fix an issue with the FMap module that failed to read from some
    nested files.
  * Fixed an issue where failing to load some rules from a Yara file
    containing multiple rules may cause a crash.
  * Fixed assorted compiler warnings.
  * Fixed assorted Coverity static code analysis issues.
  * Scan limits:
  - Added virus-name suffixes to the alerts that trigger when a scan
    limit has been exceeded. Rather than simply
    Heuristics.Limits.Exceeded, you may now see limit-specific
    virus-names, to include:
    + Heuristics.Limits.Exceeded.MaxFileSize
    + Heuristics.Limits.Exceeded.MaxScanSize
    + Heuristics.Limits.Exceeded.MaxFiles
    + Heuristics.Limits.Exceeded.MaxRecursion
    + Heuristics.Limits.Exceeded.MaxScanTime
  - Renamed the Heuristics.Email.ExceedsMax.* alerts to align with
    the other limit alerts names. These alerts include:
    + Heuristics.Limits.Exceeded.EmailLineFoldcnt
    + Heuristics.Limits.Exceeded.EmailHeaderBytes
    + Heuristics.Limits.Exceeded.EmailHeaders
    + Heuristics.Limits.Exceeded.EmailMIMEPartsPerMessage
    + Heuristics.Limits.Exceeded.EmailMIMEArguments
  - Fixed an issue where the Email-related scan limits would alert
    even when the "AlertExceedsMax" (--alert-exceeds-max) scan option
    is not enabled.
  - Fixes an issue in the Zip parser where exceeding the "MaxFiles"
    limit or the "MaxFileSize" limit would abort the scan but would
    fail to alert. The Zip scan limit issues were independently
    identified and reported by Aaron Leliaert and Max Allan.
  * Fixed a leak in the Email parser when using the --gen-json scan
    option.
  * Fixed an issue where a failure to record metadata in the Email
    parser when using the --gen-json scan option could cause the Email
    parser to abort the scan early and fail to extract and scan
    additional content.
  * Fixed a file name memory leak in the Zip parser.
  * Fixed an issue where certain signature patterns may cause a crash or
    cause unintended matches on some systems when converting characters
    to uppercase if a UTF-8 unicode single-byte grapheme becomes a
    multi-byte grapheme. Patch courtesy of Andrea De Pasquale.
- Fix unit test
  + clamav-ck_assert_msg.patch</changelog>
  <changelog author="max@suse.com" date="1642420800">- Update to 0.103.5
  * bsc#1194731, CVE-2022-20698:
    Fix for invalid pointer read that may cause a crash.
    This issue affects 0.104.1, 0.103.4 and prior when ClamAV is compiled
    with libjson-c and the CL_SCAN_GENERAL_COLLECT_METADATA scan option
    (the clamscan --gen-json option) is enabled.
  * Fixed ability to disable the file size limit with libclamav C API,
    like this:
    cl_engine_set_num(engine, CL_ENGINE_MAX_FILESIZE, 0);
    This issue didn't affect ClamD or ClamScan which also can disable the
    limit by setting it to zero using MaxFileSize 0 in clamd.conf for ClamD,
    or clamscan --max-filesize=0 for ClamScan.
    Note: Internally, the max file size is still set to 2 GiB. Disabling the
    limit for a scan will fall back on the internal 2 GiB limitation.
  * Increased the maximum line length for ClamAV config files from 512 bytes
    to 1,024 bytes to allow for longer config option strings.
  * SigTool: Fix insufficient buffer size for --list-sigs that caused a
    failure when listing a database containing one or more very long
    signatures. This fix was backported from 0.104.</changelog>
</package>
<package pkgid="9a7b925ca2421c3c7d782dfd4f20f9bc26bd37a5b715abd3e8173661a8004ae1" name="libfreshclam2" arch="aarch64">
  <version epoch="0" ver="0.103.5" rel="3.35.1"/>
  <changelog author="egdfree@opensuse.org" date="1553688000">- Update to version 0.101.2 (bsc#1130721)
  * CVE-2019-1787:
    An out-of-bounds heap read condition may occur when scanning PDF
    documents. The defect is a failure to correctly keep track of the number
    of bytes remaining in a buffer when indexing file data.
  * CVE-2019-1789:
    An out-of-bounds heap read condition may occur when scanning PE files
    (i.e. Windows EXE and DLL files) that have been packed using Aspack as a
    result of inadequate bound-checking.
  * CVE-2019-1788:
    An out-of-bounds heap write condition may occur when scanning OLE2 files
    such as Microsoft Office 97-2003 documents. The invalid write happens when
    an invalid pointer is mistakenly used to initialize a 32bit integer to
    zero. This is likely to crash the application.
  * CVE-2019-1786:
    An out-of-bounds heap read condition may occur when scanning malformed
    PDF documents as a result of improper bounds-checking.
  * CVE-2019-1785:
    A path-traversal write condition may occur as a result of improper
    input validation when scanning RAR archives.
  * CVE-2019-1798:
    A use-after-free condition may occur as a result of improper error
    handling when scanning nested RAR archives.
- added clamav-max_patch.patch to fix build
- dropped clamav-freshclam-exit.patch</changelog>
  <changelog author="max@suse.com" date="1565092800">- Update to version 0.101.3:
  * bsc#1144504: ZIP bomb causes extreme CPU spikes</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1567598400">- update to 0.101.4:
  * CVE-2019-12900: An out of bounds write in the NSIS bzip2
    (boo#1149458)
  * CVE-2019-12625: Introduce a configurable time limit to mitigate
    zip bomb vulnerability completely. Default is 2 minutes,
    configurable useing the clamscan --max-scantime and for clamd
    using the MaxScanTime config option (boo#1144504)</changelog>
  <changelog author="max@suse.com" date="1572004800">- bsc#1151839: Increase the startup timeout of clamd to 5 minutes
  to cater for the grown virus database as a workaround until
  clamd has learned to talk to systemd to extend the timeout as
  long as needed.</changelog>
  <changelog author="suse+build@de-korte.org" date="1572609600">- update to 0.102.0
  * The On-Access Scanning feature has been migrated out of clamd
    and into a brand new utility named clamonacc. This utility is
    similar to clamdscan and clamav-milter in that it acts as a
    client to clamd. This separation from clamd means that clamd no
    longer needs to run with root privileges while scanning potentially
    malicious files. Instead, clamd may drop privileges to run under an
    account that does not have super-user. In addition to improving the
    security posture of running clamd with On-Access enabled, this
    update fixed a few outstanding defects:
  - On-Access scanning for created and moved files (Extra-Scanning)
    is fixed.
  - VirusEvent for On-Access scans is fixed.
  - With clamonacc, it is now possible to copy, move, or remove a
    file if the scan triggered an alert, just like with clamdscan.
  * The freshclam database update utility has undergone a significant
    update. This includes:
  - Added support for HTTPS.
  - Support for database mirrors hosted on ports other than 80.
  - Removal of the mirror management feature (mirrors.dat).
  - An all new libfreshclam library API.
- created new subpackage libfreshclam2
- dropped clamav-max_patch.patch (upstreamed)
- added clamav-fix_building_milter.patch to fix build of milter</changelog>
  <changelog author="suse+build@de-korte.org" date="1574251200">- update to 0.102.1
  * CVE-2019-15961, bsc#1157763: A Denial-of-Service (DoS)
    vulnerability may occur when scanning a specially crafted email
    file as a result of excessively long scan times. The issue is
    resolved by implementing several maximums in parsing MIME
    messages and by optimizing use of memory allocation.
  * Build system fixes to build clamav-milter, to correctly link
    with libxml2 when detected, and to correctly detect fanotify
    for on-access scanning feature support.
  * Signature load time is significantly reduced by changing to a
    more efficient algorithm for loading signature patterns and
    allocating the AC trie. Patch courtesy of Alberto Wu.
  * Introduced a new configure option to statically link libjson-c
    with libclamav. Static linking with libjson is highly
    recommended to prevent crashes in applications that use
    libclamav alongside another JSON parsing library.
  * Null-dereference fix in email parser when using the
  - -gen-json metadata option.
  * Fixes for Authenticode parsing and certificate signature
    (.crb database) bugs.
- dropped clamav-fix_building_milter.patch (upstreamed)</changelog>
  <changelog author="dimstar@opensuse.org" date="1576756800">- BuildRequire pkgconfig(libsystemd) instead of systemd-devel:
  Allow OBS to shortcut through the -mini flavors.</changelog>
  <changelog author="suse+build@de-korte.org" date="1577188800">- The freshclam.service should not be started before the network is
  online (it checks for updates immediately upon service start)</changelog>
  <changelog author="suse+build@de-korte.org" date="1580904000">- update to 0.102.2
  * CVE-2020-3123: A denial-of-service (DoS) condition may occur when
    using the optional credit card data-loss-prevention (DLP) feature.
    Improper bounds checking of an unsigned variable resulted in an
    out-of-bounds read, which causes a crash.
  * Significantly improved the scan speed of PDF files on Windows.
  * Re-applied a fix to alleviate file access issues when scanning RAR
    files in downstream projects that use libclamav where the scanning
    engine is operating in a low-privilege process. This bug was originally
    fixed in 0.101.2 and the fix was mistakenly omitted from 0.102.0.
  * Fixed an issue where freshclam failed to update if the database version
    downloaded is one version older than advertised. This situation may
    occur after a new database version is published. The issue affected
    users downloading the whole CVD database file.
  * Changed the default freshclam ReceiveTimeout setting to 0 (infinite).
    The ReceiveTimeout had caused needless database update failures for
    users with slower internet connections.
  * Correctly display the number of kilobytes (KiB) in progress bar and
    reduced the size of the progress bar to accommodate 80-character width
    terminals.
  * Fixed an issue where running freshclam manually causes a daemonized
    freshclam process to fail when it updates because the manual instance
    deletes the temporary download directory. The freshclam temporary files
    will now download to a unique directory created at the time of an update
    instead of using a hardcoded directory created/destroyed at the program
    start/exit.
  * Fix for freshclam's OnOutdatedExecute config option.
  * Fixes a memory leak in the error condition handling for the email
    parser.
  * Improved bound checking and error handling in ARJ archive parser.
  * Improved error handling in PDF parser.
  * Fix for memory leak in byte-compare signature handler.</changelog>
  <changelog author="mpluskal@suse.com" date="1585742400">- Drop python build dependency as it is not needed</changelog>
  <changelog author="suse+build@de-korte.org" date="1589284800">- Update to 0.102.3
  * CVE-2020-3327: Fix a vulnerability in the ARJ archive parsing
    module in ClamAV 0.102.2 that could cause a Denial-of-Service (DoS)
    condition. Improper bounds checking of an unsigned variable results
    in an out-of-bounds read which causes a crash.
  * CVE-2020-3341: Fix a vulnerability in the PDF parsing module in
    ClamAV 0.101 - 0.102.2 that could cause a Denial-of-Service (DoS)
    condition. Improper size checking of a buffer used to initialize AES
    decryption routines results in an out-of-bounds read which may cause
    a crash.
  * Fix "Attempt to allocate 0 bytes" error when parsing some PDF
    documents.
  * Fix a couple of minor memory leaks.
  * Updated libclamunrar to UnRAR 5.9.2.</changelog>
  <changelog author="suse+build@de-korte.org" date="1594900800">- Update to 0.102.4
  * CVE-2020-3350: Fix a vulnerability wherein a malicious user could
    replace a scan target's directory with a symlink to another path
    to trick clamscan, clamdscan, or clamonacc into removing or moving
    a different file (eg. a critical system file). The issue would
    affect users that use the --move or --remove options for clamscan,
    clamdscan, and clamonacc.
  * CVE-2020-3327: Fix a vulnerability in the ARJ archive parsing
    module in ClamAV 0.102.3 that could cause a Denial-of-Service
    (DoS) condition. Improper bounds checking results in an
    out-of-bounds read which could cause a crash. The previous fix for
    this CVE in 0.102.3 was incomplete. This fix correctly resolves
    the issue.
  * CVE-2020-3481: Fix a vulnerability in the EGG archive module in
    ClamAV 0.102.0 - 0.102.3 could cause a Denial-of-Service (DoS)
    condition. Improper error handling may result in a crash due to a
    NULL pointer dereference. This vulnerability is mitigated for
    those using the official ClamAV signature databases because the
    file type signatures in daily.cvd will not enable the EGG archive
    parser in versions affected by the vulnerability.</changelog>
  <changelog author="suse+build@de-korte.org" date="1600084800">- Update to 0.103.0
  * clamd can now reload the signature database without blocking
    scanning. This multi-threaded database reload improvement was made
    possible thanks to a community effort.
  - Non-blocking database reloads are now the default behavior. Some
    systems that are more constrained on RAM may need to disable
    non-blocking reloads as it will temporarily consume two times as
    much memory. We added a new clamd config option
    ConcurrentDatabaseReload, which may be set to no.
  * Dropped clamav-str-h.patch (no longer needed)
  * Fix clamav-milter.service (requires clamd.service to run)</changelog>
  <changelog author="max@suse.com" date="1605009600">- Sync Factory to SLE-15 to implement jsc#ECO-3010 and bsc#1118459.
- bsc#1119353, clamav-fips.patch: Fix freshclam crash in FIPS mode.
- Keep OBS from installing an existing clamav instance to scan the
  sources, because this makes "make check" use the old library
  instead of the just built one. This is only a workaround until
  we found a way to keep libtool from adding libdir to rpath and
  LD_LIBRARY_PATH of the binaries in the testsuite.</changelog>
  <changelog author="dimstar@opensuse.org" date="1605182400">- Do not hard-depend on systemd: use systemd_ordering instead of
  systemd_requires.</changelog>
  <changelog author="max@suse.com" date="1617969600">- Update clamav.keyring
- Update to 0.103.2
  * CVE-2021-1252, bsc#1184532: Fix for Excel XLM parser infinite
    loop. Affects 0.103.0 and 0.103.1 only.
  * CVE-2021-1404, bsc#1184533: Fix for PDF parser buffer over-read;
    possible crash. Affects 0.103.0 and 0.103.1 only.
  * CVE-2021-1405, bsc#1184534: Fix for mail parser
    NULL-dereference crash. Affects 0.103.1 and prior.
  * Fix possible memory leak in PNG parser.
  * Fix ClamOnAcc scan on file-creation race condition so files are
    scanned after their contents are written.
  * FreshClam: Deprecate the SafeBrowsing config option. The
    SafeBrowsing option will no longer do anything.
  * For more details, see our blog post from last year about the
    future of the ClamAV Safe Browsing database.
  * FreshClam: Improved HTTP 304, 403, &amp; 429 handling.
  * FreshClam: Added back the mirrors.dat file to the database directory.
  * FreshClam will now exit with a failure in daemon mode if an HTTP 403
    (Forbidden) was received, because retrying later won't help any. The
    FreshClam user will have to take actions to get unblocked.
  * Fix the FreshClam mirror-sync issue where a downloaded database is
    "older than the version advertised."
  * bsc#1181256: Fix errors when scanning files &gt; 4G
  * obsoletes clamav-disable-timestamps.patch
- Update to 0.103.1
  * Added a new scan option to alert on broken media (graphics) file
    formats. This feature mitigates the risk of malformed media files
    intended to exploit vulnerabilities in other software. At present
    media validation exists for JPEG, TIFF, PNG, and GIF files. To
    enable this feature, set AlertBrokenMedia yes in clamd.conf, or
    use the --alert-broken-media option when using clamscan. These
    options are disabled by default in this patch release, but may be
    enabled in a subsequent release. Application developers may enable
    this scan option by enabling CL_SCAN_HEURISTIC_BROKEN_MEDIA for
    the heuristic scan option bit field.
  * Added CL_TYPE_TIFF, CL_TYPE_JPEG types to match GIF, PNG typing
    behavior. BMP and JPEG 2000 files will continue to detect as
    CL_TYPE_GRAPHICS because ClamAV does not yet have BMP or JPEG
    2000 format checking capabilities.
  * Fixed PNG parser logic bugs that caused an excess of parsing
    errors and fixed a stack exhaustion issue affecting some systems
    when scanning PNG files. PNG file type detection was disabled via
    signature database update for ClamAV version 0.103.0 to mitigate
    the effects from these bugs.
  * Fixed an issue where PNG and GIF files no longer work with
    Target:5 graphics signatures if detected as CL_TYPE_PNG/GIF rather
    than as CL_TYPE_GRAPHICS. Target types now support up to 10
    possible file types to make way for additional graphics types in
    future releases.
  * Fixed clamonacc's --fdpass option.
  - Interprocess file descriptor passing for clamonacc was broken
    since version 0.102.0 due to a bug introduced by the switch to
    curl for communicating with clamd. On Linux, passing file
    descriptors from one process to another is handled by the
    kernel, so we reverted clamonacc to use standard system calls
    for socket communication when fd passing is enabled.
  * Fixed a clamonacc stack corruption issue on some systems when
    using an older version of libcurl.
  * Allow clamscan and clamdscan scans to proceed even if the
    realpath lookup failed. This alleviates an issue on Windows
    scanning files hosted on file- systems that do not support the
    GetMappedFileNameW() API such as on ImDisk RAM-disks.
  * Fixed freshclam --on-update-execute=EXIT_1 temporary directory
    cleanup issue.
  * clamd's log output and VirusEvent now provide the scan target's
    file path instead of a file descriptor. The clamd socket API for
    submitting a scan by FD-passing doesn't include a file path, this
    feature works by looking up the file path by file descriptor.
    This feature works on Mac and Linux but is not yet implemented
    for other UNIX operating systems. FD-passing is not available for
    Windows.
  * Fixed an issue where freshclam database validation didn't work
    correctly when run in daemon mode on Linux/Unix.</changelog>
  <changelog author="suse+build@de-korte.org" date="1624276800">- bsc#1188284: Update to 0.103.3
  * Fixed a scan performance issue when ENGINE_OPTIONS_FORCE_TO_DISK is
    enabled. This issue did not impacted most users but for those
    affected it caused every scanned file to be copied to the temp
    directory before the scan.
  * Fix ClamDScan crashes when using the --fdpass --multiscan
    command-line options in combination with the ClamD ExcludePath
    config file options.
  * Fixed an issue where the mirrors.dat file is owned by root when
    starting as root (or with sudo) and using daemon-mode. File
    ownership will be set to the DatabaseOwner just before FreshClam
    switches to run as that user.
  * Renamed the mirrors.dat file to freshclam.dat.
  * Disabled the HTTPUserAgent config option if the DatabaseMirror uses
    clamav.net. This will prevent users from being inadvertently blocked
    and will ensure that we can keep better metrics on which ClamAV
    versions are being used.
  * Moved the detection for Heuristics.PNG.CVE-2010-1205 behind the
    ClamScan --alert-broken-media option (ClamD AlertBrokenMedia yes)
    option. This type of PNG issue appears to be common enough to be an
    annoyance, and the CVE is old enough that no one should be
    vulnerable at this point.
  * Fix ClamSubmit failures after changes to Cloudflare "__cfduid"
    cookies. See: https://blog.cloudflare.com/deprecating-cfduid-cookie/</changelog>
  <changelog author="meissner@suse.com" date="1625054400">- clamav-document-maxsize.patch: in the "clamscan" and "clamdscan" manpages,
  document that files over a certain size by default will silently not be
  scanned and how this can be adjusted (bsc#1187509)</changelog>
  <changelog author="max@suse.com" date="1636372800">- bsc#1192346: Update to 0.103.4
  * FreshClam:
  - Add a 24-hour cool-down for FreshClam clients that have received
    an HTTP 403 (Forbidden) response from the CDN. This is to reduce
    the volume of 403-response data served to blocked FreshClam
    clients that are configured with a tight update-loop.
  - Fixed a bug where FreshClam treats an empty CDIFF as an
    incremental update failure instead of as an intentional request
    to download the whole CVD.
  * ClamDScan: Fix a scan error when broken symlinks are encountered on
    macOS with "FollowDirectorySymlinks" and "FollowFileSymlinks"
    options disabled.
  * Overhauled the scan recursion / nested archive extraction logic and
    added new limits on embedded file-type recognition performed during
    the "raw" scan of each file. This limits embedded file-type
    misidentification and prevents detecting embedded file content that
    is found/extracted and scanned at other layers in the scanning
    process.
  * Fix an issue with the FMap module that failed to read from some
    nested files.
  * Fixed an issue where failing to load some rules from a Yara file
    containing multiple rules may cause a crash.
  * Fixed assorted compiler warnings.
  * Fixed assorted Coverity static code analysis issues.
  * Scan limits:
  - Added virus-name suffixes to the alerts that trigger when a scan
    limit has been exceeded. Rather than simply
    Heuristics.Limits.Exceeded, you may now see limit-specific
    virus-names, to include:
    + Heuristics.Limits.Exceeded.MaxFileSize
    + Heuristics.Limits.Exceeded.MaxScanSize
    + Heuristics.Limits.Exceeded.MaxFiles
    + Heuristics.Limits.Exceeded.MaxRecursion
    + Heuristics.Limits.Exceeded.MaxScanTime
  - Renamed the Heuristics.Email.ExceedsMax.* alerts to align with
    the other limit alerts names. These alerts include:
    + Heuristics.Limits.Exceeded.EmailLineFoldcnt
    + Heuristics.Limits.Exceeded.EmailHeaderBytes
    + Heuristics.Limits.Exceeded.EmailHeaders
    + Heuristics.Limits.Exceeded.EmailMIMEPartsPerMessage
    + Heuristics.Limits.Exceeded.EmailMIMEArguments
  - Fixed an issue where the Email-related scan limits would alert
    even when the "AlertExceedsMax" (--alert-exceeds-max) scan option
    is not enabled.
  - Fixes an issue in the Zip parser where exceeding the "MaxFiles"
    limit or the "MaxFileSize" limit would abort the scan but would
    fail to alert. The Zip scan limit issues were independently
    identified and reported by Aaron Leliaert and Max Allan.
  * Fixed a leak in the Email parser when using the --gen-json scan
    option.
  * Fixed an issue where a failure to record metadata in the Email
    parser when using the --gen-json scan option could cause the Email
    parser to abort the scan early and fail to extract and scan
    additional content.
  * Fixed a file name memory leak in the Zip parser.
  * Fixed an issue where certain signature patterns may cause a crash or
    cause unintended matches on some systems when converting characters
    to uppercase if a UTF-8 unicode single-byte grapheme becomes a
    multi-byte grapheme. Patch courtesy of Andrea De Pasquale.
- Fix unit test
  + clamav-ck_assert_msg.patch</changelog>
  <changelog author="max@suse.com" date="1642420800">- Update to 0.103.5
  * bsc#1194731, CVE-2022-20698:
    Fix for invalid pointer read that may cause a crash.
    This issue affects 0.104.1, 0.103.4 and prior when ClamAV is compiled
    with libjson-c and the CL_SCAN_GENERAL_COLLECT_METADATA scan option
    (the clamscan --gen-json option) is enabled.
  * Fixed ability to disable the file size limit with libclamav C API,
    like this:
    cl_engine_set_num(engine, CL_ENGINE_MAX_FILESIZE, 0);
    This issue didn't affect ClamD or ClamScan which also can disable the
    limit by setting it to zero using MaxFileSize 0 in clamd.conf for ClamD,
    or clamscan --max-filesize=0 for ClamScan.
    Note: Internally, the max file size is still set to 2 GiB. Disabling the
    limit for a scan will fall back on the internal 2 GiB limitation.
  * Increased the maximum line length for ClamAV config files from 512 bytes
    to 1,024 bytes to allow for longer config option strings.
  * SigTool: Fix insufficient buffer size for --list-sigs that caused a
    failure when listing a database containing one or more very long
    signatures. This fix was backported from 0.104.</changelog>
</package>
<package pkgid="d6e8109ec721499ccbaf62c8621ff8d0744e20c7a0f58fe1b00aec556b0d3c90" name="libfreshclam2" arch="ppc64le">
  <version epoch="0" ver="0.103.5" rel="3.35.1"/>
  <changelog author="egdfree@opensuse.org" date="1553688000">- Update to version 0.101.2 (bsc#1130721)
  * CVE-2019-1787:
    An out-of-bounds heap read condition may occur when scanning PDF
    documents. The defect is a failure to correctly keep track of the number
    of bytes remaining in a buffer when indexing file data.
  * CVE-2019-1789:
    An out-of-bounds heap read condition may occur when scanning PE files
    (i.e. Windows EXE and DLL files) that have been packed using Aspack as a
    result of inadequate bound-checking.
  * CVE-2019-1788:
    An out-of-bounds heap write condition may occur when scanning OLE2 files
    such as Microsoft Office 97-2003 documents. The invalid write happens when
    an invalid pointer is mistakenly used to initialize a 32bit integer to
    zero. This is likely to crash the application.
  * CVE-2019-1786:
    An out-of-bounds heap read condition may occur when scanning malformed
    PDF documents as a result of improper bounds-checking.
  * CVE-2019-1785:
    A path-traversal write condition may occur as a result of improper
    input validation when scanning RAR archives.
  * CVE-2019-1798:
    A use-after-free condition may occur as a result of improper error
    handling when scanning nested RAR archives.
- added clamav-max_patch.patch to fix build
- dropped clamav-freshclam-exit.patch</changelog>
  <changelog author="max@suse.com" date="1565092800">- Update to version 0.101.3:
  * bsc#1144504: ZIP bomb causes extreme CPU spikes</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1567598400">- update to 0.101.4:
  * CVE-2019-12900: An out of bounds write in the NSIS bzip2
    (boo#1149458)
  * CVE-2019-12625: Introduce a configurable time limit to mitigate
    zip bomb vulnerability completely. Default is 2 minutes,
    configurable useing the clamscan --max-scantime and for clamd
    using the MaxScanTime config option (boo#1144504)</changelog>
  <changelog author="max@suse.com" date="1572004800">- bsc#1151839: Increase the startup timeout of clamd to 5 minutes
  to cater for the grown virus database as a workaround until
  clamd has learned to talk to systemd to extend the timeout as
  long as needed.</changelog>
  <changelog author="suse+build@de-korte.org" date="1572609600">- update to 0.102.0
  * The On-Access Scanning feature has been migrated out of clamd
    and into a brand new utility named clamonacc. This utility is
    similar to clamdscan and clamav-milter in that it acts as a
    client to clamd. This separation from clamd means that clamd no
    longer needs to run with root privileges while scanning potentially
    malicious files. Instead, clamd may drop privileges to run under an
    account that does not have super-user. In addition to improving the
    security posture of running clamd with On-Access enabled, this
    update fixed a few outstanding defects:
  - On-Access scanning for created and moved files (Extra-Scanning)
    is fixed.
  - VirusEvent for On-Access scans is fixed.
  - With clamonacc, it is now possible to copy, move, or remove a
    file if the scan triggered an alert, just like with clamdscan.
  * The freshclam database update utility has undergone a significant
    update. This includes:
  - Added support for HTTPS.
  - Support for database mirrors hosted on ports other than 80.
  - Removal of the mirror management feature (mirrors.dat).
  - An all new libfreshclam library API.
- created new subpackage libfreshclam2
- dropped clamav-max_patch.patch (upstreamed)
- added clamav-fix_building_milter.patch to fix build of milter</changelog>
  <changelog author="suse+build@de-korte.org" date="1574251200">- update to 0.102.1
  * CVE-2019-15961, bsc#1157763: A Denial-of-Service (DoS)
    vulnerability may occur when scanning a specially crafted email
    file as a result of excessively long scan times. The issue is
    resolved by implementing several maximums in parsing MIME
    messages and by optimizing use of memory allocation.
  * Build system fixes to build clamav-milter, to correctly link
    with libxml2 when detected, and to correctly detect fanotify
    for on-access scanning feature support.
  * Signature load time is significantly reduced by changing to a
    more efficient algorithm for loading signature patterns and
    allocating the AC trie. Patch courtesy of Alberto Wu.
  * Introduced a new configure option to statically link libjson-c
    with libclamav. Static linking with libjson is highly
    recommended to prevent crashes in applications that use
    libclamav alongside another JSON parsing library.
  * Null-dereference fix in email parser when using the
  - -gen-json metadata option.
  * Fixes for Authenticode parsing and certificate signature
    (.crb database) bugs.
- dropped clamav-fix_building_milter.patch (upstreamed)</changelog>
  <changelog author="dimstar@opensuse.org" date="1576756800">- BuildRequire pkgconfig(libsystemd) instead of systemd-devel:
  Allow OBS to shortcut through the -mini flavors.</changelog>
  <changelog author="suse+build@de-korte.org" date="1577188800">- The freshclam.service should not be started before the network is
  online (it checks for updates immediately upon service start)</changelog>
  <changelog author="suse+build@de-korte.org" date="1580904000">- update to 0.102.2
  * CVE-2020-3123: A denial-of-service (DoS) condition may occur when
    using the optional credit card data-loss-prevention (DLP) feature.
    Improper bounds checking of an unsigned variable resulted in an
    out-of-bounds read, which causes a crash.
  * Significantly improved the scan speed of PDF files on Windows.
  * Re-applied a fix to alleviate file access issues when scanning RAR
    files in downstream projects that use libclamav where the scanning
    engine is operating in a low-privilege process. This bug was originally
    fixed in 0.101.2 and the fix was mistakenly omitted from 0.102.0.
  * Fixed an issue where freshclam failed to update if the database version
    downloaded is one version older than advertised. This situation may
    occur after a new database version is published. The issue affected
    users downloading the whole CVD database file.
  * Changed the default freshclam ReceiveTimeout setting to 0 (infinite).
    The ReceiveTimeout had caused needless database update failures for
    users with slower internet connections.
  * Correctly display the number of kilobytes (KiB) in progress bar and
    reduced the size of the progress bar to accommodate 80-character width
    terminals.
  * Fixed an issue where running freshclam manually causes a daemonized
    freshclam process to fail when it updates because the manual instance
    deletes the temporary download directory. The freshclam temporary files
    will now download to a unique directory created at the time of an update
    instead of using a hardcoded directory created/destroyed at the program
    start/exit.
  * Fix for freshclam's OnOutdatedExecute config option.
  * Fixes a memory leak in the error condition handling for the email
    parser.
  * Improved bound checking and error handling in ARJ archive parser.
  * Improved error handling in PDF parser.
  * Fix for memory leak in byte-compare signature handler.</changelog>
  <changelog author="mpluskal@suse.com" date="1585742400">- Drop python build dependency as it is not needed</changelog>
  <changelog author="suse+build@de-korte.org" date="1589284800">- Update to 0.102.3
  * CVE-2020-3327: Fix a vulnerability in the ARJ archive parsing
    module in ClamAV 0.102.2 that could cause a Denial-of-Service (DoS)
    condition. Improper bounds checking of an unsigned variable results
    in an out-of-bounds read which causes a crash.
  * CVE-2020-3341: Fix a vulnerability in the PDF parsing module in
    ClamAV 0.101 - 0.102.2 that could cause a Denial-of-Service (DoS)
    condition. Improper size checking of a buffer used to initialize AES
    decryption routines results in an out-of-bounds read which may cause
    a crash.
  * Fix "Attempt to allocate 0 bytes" error when parsing some PDF
    documents.
  * Fix a couple of minor memory leaks.
  * Updated libclamunrar to UnRAR 5.9.2.</changelog>
  <changelog author="suse+build@de-korte.org" date="1594900800">- Update to 0.102.4
  * CVE-2020-3350: Fix a vulnerability wherein a malicious user could
    replace a scan target's directory with a symlink to another path
    to trick clamscan, clamdscan, or clamonacc into removing or moving
    a different file (eg. a critical system file). The issue would
    affect users that use the --move or --remove options for clamscan,
    clamdscan, and clamonacc.
  * CVE-2020-3327: Fix a vulnerability in the ARJ archive parsing
    module in ClamAV 0.102.3 that could cause a Denial-of-Service
    (DoS) condition. Improper bounds checking results in an
    out-of-bounds read which could cause a crash. The previous fix for
    this CVE in 0.102.3 was incomplete. This fix correctly resolves
    the issue.
  * CVE-2020-3481: Fix a vulnerability in the EGG archive module in
    ClamAV 0.102.0 - 0.102.3 could cause a Denial-of-Service (DoS)
    condition. Improper error handling may result in a crash due to a
    NULL pointer dereference. This vulnerability is mitigated for
    those using the official ClamAV signature databases because the
    file type signatures in daily.cvd will not enable the EGG archive
    parser in versions affected by the vulnerability.</changelog>
  <changelog author="suse+build@de-korte.org" date="1600084800">- Update to 0.103.0
  * clamd can now reload the signature database without blocking
    scanning. This multi-threaded database reload improvement was made
    possible thanks to a community effort.
  - Non-blocking database reloads are now the default behavior. Some
    systems that are more constrained on RAM may need to disable
    non-blocking reloads as it will temporarily consume two times as
    much memory. We added a new clamd config option
    ConcurrentDatabaseReload, which may be set to no.
  * Dropped clamav-str-h.patch (no longer needed)
  * Fix clamav-milter.service (requires clamd.service to run)</changelog>
  <changelog author="max@suse.com" date="1605009600">- Sync Factory to SLE-15 to implement jsc#ECO-3010 and bsc#1118459.
- bsc#1119353, clamav-fips.patch: Fix freshclam crash in FIPS mode.
- Keep OBS from installing an existing clamav instance to scan the
  sources, because this makes "make check" use the old library
  instead of the just built one. This is only a workaround until
  we found a way to keep libtool from adding libdir to rpath and
  LD_LIBRARY_PATH of the binaries in the testsuite.</changelog>
  <changelog author="dimstar@opensuse.org" date="1605182400">- Do not hard-depend on systemd: use systemd_ordering instead of
  systemd_requires.</changelog>
  <changelog author="max@suse.com" date="1617969600">- Update clamav.keyring
- Update to 0.103.2
  * CVE-2021-1252, bsc#1184532: Fix for Excel XLM parser infinite
    loop. Affects 0.103.0 and 0.103.1 only.
  * CVE-2021-1404, bsc#1184533: Fix for PDF parser buffer over-read;
    possible crash. Affects 0.103.0 and 0.103.1 only.
  * CVE-2021-1405, bsc#1184534: Fix for mail parser
    NULL-dereference crash. Affects 0.103.1 and prior.
  * Fix possible memory leak in PNG parser.
  * Fix ClamOnAcc scan on file-creation race condition so files are
    scanned after their contents are written.
  * FreshClam: Deprecate the SafeBrowsing config option. The
    SafeBrowsing option will no longer do anything.
  * For more details, see our blog post from last year about the
    future of the ClamAV Safe Browsing database.
  * FreshClam: Improved HTTP 304, 403, &amp; 429 handling.
  * FreshClam: Added back the mirrors.dat file to the database directory.
  * FreshClam will now exit with a failure in daemon mode if an HTTP 403
    (Forbidden) was received, because retrying later won't help any. The
    FreshClam user will have to take actions to get unblocked.
  * Fix the FreshClam mirror-sync issue where a downloaded database is
    "older than the version advertised."
  * bsc#1181256: Fix errors when scanning files &gt; 4G
  * obsoletes clamav-disable-timestamps.patch
- Update to 0.103.1
  * Added a new scan option to alert on broken media (graphics) file
    formats. This feature mitigates the risk of malformed media files
    intended to exploit vulnerabilities in other software. At present
    media validation exists for JPEG, TIFF, PNG, and GIF files. To
    enable this feature, set AlertBrokenMedia yes in clamd.conf, or
    use the --alert-broken-media option when using clamscan. These
    options are disabled by default in this patch release, but may be
    enabled in a subsequent release. Application developers may enable
    this scan option by enabling CL_SCAN_HEURISTIC_BROKEN_MEDIA for
    the heuristic scan option bit field.
  * Added CL_TYPE_TIFF, CL_TYPE_JPEG types to match GIF, PNG typing
    behavior. BMP and JPEG 2000 files will continue to detect as
    CL_TYPE_GRAPHICS because ClamAV does not yet have BMP or JPEG
    2000 format checking capabilities.
  * Fixed PNG parser logic bugs that caused an excess of parsing
    errors and fixed a stack exhaustion issue affecting some systems
    when scanning PNG files. PNG file type detection was disabled via
    signature database update for ClamAV version 0.103.0 to mitigate
    the effects from these bugs.
  * Fixed an issue where PNG and GIF files no longer work with
    Target:5 graphics signatures if detected as CL_TYPE_PNG/GIF rather
    than as CL_TYPE_GRAPHICS. Target types now support up to 10
    possible file types to make way for additional graphics types in
    future releases.
  * Fixed clamonacc's --fdpass option.
  - Interprocess file descriptor passing for clamonacc was broken
    since version 0.102.0 due to a bug introduced by the switch to
    curl for communicating with clamd. On Linux, passing file
    descriptors from one process to another is handled by the
    kernel, so we reverted clamonacc to use standard system calls
    for socket communication when fd passing is enabled.
  * Fixed a clamonacc stack corruption issue on some systems when
    using an older version of libcurl.
  * Allow clamscan and clamdscan scans to proceed even if the
    realpath lookup failed. This alleviates an issue on Windows
    scanning files hosted on file- systems that do not support the
    GetMappedFileNameW() API such as on ImDisk RAM-disks.
  * Fixed freshclam --on-update-execute=EXIT_1 temporary directory
    cleanup issue.
  * clamd's log output and VirusEvent now provide the scan target's
    file path instead of a file descriptor. The clamd socket API for
    submitting a scan by FD-passing doesn't include a file path, this
    feature works by looking up the file path by file descriptor.
    This feature works on Mac and Linux but is not yet implemented
    for other UNIX operating systems. FD-passing is not available for
    Windows.
  * Fixed an issue where freshclam database validation didn't work
    correctly when run in daemon mode on Linux/Unix.</changelog>
  <changelog author="suse+build@de-korte.org" date="1624276800">- bsc#1188284: Update to 0.103.3
  * Fixed a scan performance issue when ENGINE_OPTIONS_FORCE_TO_DISK is
    enabled. This issue did not impacted most users but for those
    affected it caused every scanned file to be copied to the temp
    directory before the scan.
  * Fix ClamDScan crashes when using the --fdpass --multiscan
    command-line options in combination with the ClamD ExcludePath
    config file options.
  * Fixed an issue where the mirrors.dat file is owned by root when
    starting as root (or with sudo) and using daemon-mode. File
    ownership will be set to the DatabaseOwner just before FreshClam
    switches to run as that user.
  * Renamed the mirrors.dat file to freshclam.dat.
  * Disabled the HTTPUserAgent config option if the DatabaseMirror uses
    clamav.net. This will prevent users from being inadvertently blocked
    and will ensure that we can keep better metrics on which ClamAV
    versions are being used.
  * Moved the detection for Heuristics.PNG.CVE-2010-1205 behind the
    ClamScan --alert-broken-media option (ClamD AlertBrokenMedia yes)
    option. This type of PNG issue appears to be common enough to be an
    annoyance, and the CVE is old enough that no one should be
    vulnerable at this point.
  * Fix ClamSubmit failures after changes to Cloudflare "__cfduid"
    cookies. See: https://blog.cloudflare.com/deprecating-cfduid-cookie/</changelog>
  <changelog author="meissner@suse.com" date="1625054400">- clamav-document-maxsize.patch: in the "clamscan" and "clamdscan" manpages,
  document that files over a certain size by default will silently not be
  scanned and how this can be adjusted (bsc#1187509)</changelog>
  <changelog author="max@suse.com" date="1636372800">- bsc#1192346: Update to 0.103.4
  * FreshClam:
  - Add a 24-hour cool-down for FreshClam clients that have received
    an HTTP 403 (Forbidden) response from the CDN. This is to reduce
    the volume of 403-response data served to blocked FreshClam
    clients that are configured with a tight update-loop.
  - Fixed a bug where FreshClam treats an empty CDIFF as an
    incremental update failure instead of as an intentional request
    to download the whole CVD.
  * ClamDScan: Fix a scan error when broken symlinks are encountered on
    macOS with "FollowDirectorySymlinks" and "FollowFileSymlinks"
    options disabled.
  * Overhauled the scan recursion / nested archive extraction logic and
    added new limits on embedded file-type recognition performed during
    the "raw" scan of each file. This limits embedded file-type
    misidentification and prevents detecting embedded file content that
    is found/extracted and scanned at other layers in the scanning
    process.
  * Fix an issue with the FMap module that failed to read from some
    nested files.
  * Fixed an issue where failing to load some rules from a Yara file
    containing multiple rules may cause a crash.
  * Fixed assorted compiler warnings.
  * Fixed assorted Coverity static code analysis issues.
  * Scan limits:
  - Added virus-name suffixes to the alerts that trigger when a scan
    limit has been exceeded. Rather than simply
    Heuristics.Limits.Exceeded, you may now see limit-specific
    virus-names, to include:
    + Heuristics.Limits.Exceeded.MaxFileSize
    + Heuristics.Limits.Exceeded.MaxScanSize
    + Heuristics.Limits.Exceeded.MaxFiles
    + Heuristics.Limits.Exceeded.MaxRecursion
    + Heuristics.Limits.Exceeded.MaxScanTime
  - Renamed the Heuristics.Email.ExceedsMax.* alerts to align with
    the other limit alerts names. These alerts include:
    + Heuristics.Limits.Exceeded.EmailLineFoldcnt
    + Heuristics.Limits.Exceeded.EmailHeaderBytes
    + Heuristics.Limits.Exceeded.EmailHeaders
    + Heuristics.Limits.Exceeded.EmailMIMEPartsPerMessage
    + Heuristics.Limits.Exceeded.EmailMIMEArguments
  - Fixed an issue where the Email-related scan limits would alert
    even when the "AlertExceedsMax" (--alert-exceeds-max) scan option
    is not enabled.
  - Fixes an issue in the Zip parser where exceeding the "MaxFiles"
    limit or the "MaxFileSize" limit would abort the scan but would
    fail to alert. The Zip scan limit issues were independently
    identified and reported by Aaron Leliaert and Max Allan.
  * Fixed a leak in the Email parser when using the --gen-json scan
    option.
  * Fixed an issue where a failure to record metadata in the Email
    parser when using the --gen-json scan option could cause the Email
    parser to abort the scan early and fail to extract and scan
    additional content.
  * Fixed a file name memory leak in the Zip parser.
  * Fixed an issue where certain signature patterns may cause a crash or
    cause unintended matches on some systems when converting characters
    to uppercase if a UTF-8 unicode single-byte grapheme becomes a
    multi-byte grapheme. Patch courtesy of Andrea De Pasquale.
- Fix unit test
  + clamav-ck_assert_msg.patch</changelog>
  <changelog author="max@suse.com" date="1642420800">- Update to 0.103.5
  * bsc#1194731, CVE-2022-20698:
    Fix for invalid pointer read that may cause a crash.
    This issue affects 0.104.1, 0.103.4 and prior when ClamAV is compiled
    with libjson-c and the CL_SCAN_GENERAL_COLLECT_METADATA scan option
    (the clamscan --gen-json option) is enabled.
  * Fixed ability to disable the file size limit with libclamav C API,
    like this:
    cl_engine_set_num(engine, CL_ENGINE_MAX_FILESIZE, 0);
    This issue didn't affect ClamD or ClamScan which also can disable the
    limit by setting it to zero using MaxFileSize 0 in clamd.conf for ClamD,
    or clamscan --max-filesize=0 for ClamScan.
    Note: Internally, the max file size is still set to 2 GiB. Disabling the
    limit for a scan will fall back on the internal 2 GiB limitation.
  * Increased the maximum line length for ClamAV config files from 512 bytes
    to 1,024 bytes to allow for longer config option strings.
  * SigTool: Fix insufficient buffer size for --list-sigs that caused a
    failure when listing a database containing one or more very long
    signatures. This fix was backported from 0.104.</changelog>
</package>
<package pkgid="a28cffcf3506e92024a7d8f41c54d2e2ae601c821229d0bdbb72dcc74283e202" name="libfreshclam2" arch="s390x">
  <version epoch="0" ver="0.103.5" rel="3.35.1"/>
  <changelog author="egdfree@opensuse.org" date="1553688000">- Update to version 0.101.2 (bsc#1130721)
  * CVE-2019-1787:
    An out-of-bounds heap read condition may occur when scanning PDF
    documents. The defect is a failure to correctly keep track of the number
    of bytes remaining in a buffer when indexing file data.
  * CVE-2019-1789:
    An out-of-bounds heap read condition may occur when scanning PE files
    (i.e. Windows EXE and DLL files) that have been packed using Aspack as a
    result of inadequate bound-checking.
  * CVE-2019-1788:
    An out-of-bounds heap write condition may occur when scanning OLE2 files
    such as Microsoft Office 97-2003 documents. The invalid write happens when
    an invalid pointer is mistakenly used to initialize a 32bit integer to
    zero. This is likely to crash the application.
  * CVE-2019-1786:
    An out-of-bounds heap read condition may occur when scanning malformed
    PDF documents as a result of improper bounds-checking.
  * CVE-2019-1785:
    A path-traversal write condition may occur as a result of improper
    input validation when scanning RAR archives.
  * CVE-2019-1798:
    A use-after-free condition may occur as a result of improper error
    handling when scanning nested RAR archives.
- added clamav-max_patch.patch to fix build
- dropped clamav-freshclam-exit.patch</changelog>
  <changelog author="max@suse.com" date="1565092800">- Update to version 0.101.3:
  * bsc#1144504: ZIP bomb causes extreme CPU spikes</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1567598400">- update to 0.101.4:
  * CVE-2019-12900: An out of bounds write in the NSIS bzip2
    (boo#1149458)
  * CVE-2019-12625: Introduce a configurable time limit to mitigate
    zip bomb vulnerability completely. Default is 2 minutes,
    configurable useing the clamscan --max-scantime and for clamd
    using the MaxScanTime config option (boo#1144504)</changelog>
  <changelog author="max@suse.com" date="1572004800">- bsc#1151839: Increase the startup timeout of clamd to 5 minutes
  to cater for the grown virus database as a workaround until
  clamd has learned to talk to systemd to extend the timeout as
  long as needed.</changelog>
  <changelog author="suse+build@de-korte.org" date="1572609600">- update to 0.102.0
  * The On-Access Scanning feature has been migrated out of clamd
    and into a brand new utility named clamonacc. This utility is
    similar to clamdscan and clamav-milter in that it acts as a
    client to clamd. This separation from clamd means that clamd no
    longer needs to run with root privileges while scanning potentially
    malicious files. Instead, clamd may drop privileges to run under an
    account that does not have super-user. In addition to improving the
    security posture of running clamd with On-Access enabled, this
    update fixed a few outstanding defects:
  - On-Access scanning for created and moved files (Extra-Scanning)
    is fixed.
  - VirusEvent for On-Access scans is fixed.
  - With clamonacc, it is now possible to copy, move, or remove a
    file if the scan triggered an alert, just like with clamdscan.
  * The freshclam database update utility has undergone a significant
    update. This includes:
  - Added support for HTTPS.
  - Support for database mirrors hosted on ports other than 80.
  - Removal of the mirror management feature (mirrors.dat).
  - An all new libfreshclam library API.
- created new subpackage libfreshclam2
- dropped clamav-max_patch.patch (upstreamed)
- added clamav-fix_building_milter.patch to fix build of milter</changelog>
  <changelog author="suse+build@de-korte.org" date="1574251200">- update to 0.102.1
  * CVE-2019-15961, bsc#1157763: A Denial-of-Service (DoS)
    vulnerability may occur when scanning a specially crafted email
    file as a result of excessively long scan times. The issue is
    resolved by implementing several maximums in parsing MIME
    messages and by optimizing use of memory allocation.
  * Build system fixes to build clamav-milter, to correctly link
    with libxml2 when detected, and to correctly detect fanotify
    for on-access scanning feature support.
  * Signature load time is significantly reduced by changing to a
    more efficient algorithm for loading signature patterns and
    allocating the AC trie. Patch courtesy of Alberto Wu.
  * Introduced a new configure option to statically link libjson-c
    with libclamav. Static linking with libjson is highly
    recommended to prevent crashes in applications that use
    libclamav alongside another JSON parsing library.
  * Null-dereference fix in email parser when using the
  - -gen-json metadata option.
  * Fixes for Authenticode parsing and certificate signature
    (.crb database) bugs.
- dropped clamav-fix_building_milter.patch (upstreamed)</changelog>
  <changelog author="dimstar@opensuse.org" date="1576756800">- BuildRequire pkgconfig(libsystemd) instead of systemd-devel:
  Allow OBS to shortcut through the -mini flavors.</changelog>
  <changelog author="suse+build@de-korte.org" date="1577188800">- The freshclam.service should not be started before the network is
  online (it checks for updates immediately upon service start)</changelog>
  <changelog author="suse+build@de-korte.org" date="1580904000">- update to 0.102.2
  * CVE-2020-3123: A denial-of-service (DoS) condition may occur when
    using the optional credit card data-loss-prevention (DLP) feature.
    Improper bounds checking of an unsigned variable resulted in an
    out-of-bounds read, which causes a crash.
  * Significantly improved the scan speed of PDF files on Windows.
  * Re-applied a fix to alleviate file access issues when scanning RAR
    files in downstream projects that use libclamav where the scanning
    engine is operating in a low-privilege process. This bug was originally
    fixed in 0.101.2 and the fix was mistakenly omitted from 0.102.0.
  * Fixed an issue where freshclam failed to update if the database version
    downloaded is one version older than advertised. This situation may
    occur after a new database version is published. The issue affected
    users downloading the whole CVD database file.
  * Changed the default freshclam ReceiveTimeout setting to 0 (infinite).
    The ReceiveTimeout had caused needless database update failures for
    users with slower internet connections.
  * Correctly display the number of kilobytes (KiB) in progress bar and
    reduced the size of the progress bar to accommodate 80-character width
    terminals.
  * Fixed an issue where running freshclam manually causes a daemonized
    freshclam process to fail when it updates because the manual instance
    deletes the temporary download directory. The freshclam temporary files
    will now download to a unique directory created at the time of an update
    instead of using a hardcoded directory created/destroyed at the program
    start/exit.
  * Fix for freshclam's OnOutdatedExecute config option.
  * Fixes a memory leak in the error condition handling for the email
    parser.
  * Improved bound checking and error handling in ARJ archive parser.
  * Improved error handling in PDF parser.
  * Fix for memory leak in byte-compare signature handler.</changelog>
  <changelog author="mpluskal@suse.com" date="1585742400">- Drop python build dependency as it is not needed</changelog>
  <changelog author="suse+build@de-korte.org" date="1589284800">- Update to 0.102.3
  * CVE-2020-3327: Fix a vulnerability in the ARJ archive parsing
    module in ClamAV 0.102.2 that could cause a Denial-of-Service (DoS)
    condition. Improper bounds checking of an unsigned variable results
    in an out-of-bounds read which causes a crash.
  * CVE-2020-3341: Fix a vulnerability in the PDF parsing module in
    ClamAV 0.101 - 0.102.2 that could cause a Denial-of-Service (DoS)
    condition. Improper size checking of a buffer used to initialize AES
    decryption routines results in an out-of-bounds read which may cause
    a crash.
  * Fix "Attempt to allocate 0 bytes" error when parsing some PDF
    documents.
  * Fix a couple of minor memory leaks.
  * Updated libclamunrar to UnRAR 5.9.2.</changelog>
  <changelog author="suse+build@de-korte.org" date="1594900800">- Update to 0.102.4
  * CVE-2020-3350: Fix a vulnerability wherein a malicious user could
    replace a scan target's directory with a symlink to another path
    to trick clamscan, clamdscan, or clamonacc into removing or moving
    a different file (eg. a critical system file). The issue would
    affect users that use the --move or --remove options for clamscan,
    clamdscan, and clamonacc.
  * CVE-2020-3327: Fix a vulnerability in the ARJ archive parsing
    module in ClamAV 0.102.3 that could cause a Denial-of-Service
    (DoS) condition. Improper bounds checking results in an
    out-of-bounds read which could cause a crash. The previous fix for
    this CVE in 0.102.3 was incomplete. This fix correctly resolves
    the issue.
  * CVE-2020-3481: Fix a vulnerability in the EGG archive module in
    ClamAV 0.102.0 - 0.102.3 could cause a Denial-of-Service (DoS)
    condition. Improper error handling may result in a crash due to a
    NULL pointer dereference. This vulnerability is mitigated for
    those using the official ClamAV signature databases because the
    file type signatures in daily.cvd will not enable the EGG archive
    parser in versions affected by the vulnerability.</changelog>
  <changelog author="suse+build@de-korte.org" date="1600084800">- Update to 0.103.0
  * clamd can now reload the signature database without blocking
    scanning. This multi-threaded database reload improvement was made
    possible thanks to a community effort.
  - Non-blocking database reloads are now the default behavior. Some
    systems that are more constrained on RAM may need to disable
    non-blocking reloads as it will temporarily consume two times as
    much memory. We added a new clamd config option
    ConcurrentDatabaseReload, which may be set to no.
  * Dropped clamav-str-h.patch (no longer needed)
  * Fix clamav-milter.service (requires clamd.service to run)</changelog>
  <changelog author="max@suse.com" date="1605009600">- Sync Factory to SLE-15 to implement jsc#ECO-3010 and bsc#1118459.
- bsc#1119353, clamav-fips.patch: Fix freshclam crash in FIPS mode.
- Keep OBS from installing an existing clamav instance to scan the
  sources, because this makes "make check" use the old library
  instead of the just built one. This is only a workaround until
  we found a way to keep libtool from adding libdir to rpath and
  LD_LIBRARY_PATH of the binaries in the testsuite.</changelog>
  <changelog author="dimstar@opensuse.org" date="1605182400">- Do not hard-depend on systemd: use systemd_ordering instead of
  systemd_requires.</changelog>
  <changelog author="max@suse.com" date="1617969600">- Update clamav.keyring
- Update to 0.103.2
  * CVE-2021-1252, bsc#1184532: Fix for Excel XLM parser infinite
    loop. Affects 0.103.0 and 0.103.1 only.
  * CVE-2021-1404, bsc#1184533: Fix for PDF parser buffer over-read;
    possible crash. Affects 0.103.0 and 0.103.1 only.
  * CVE-2021-1405, bsc#1184534: Fix for mail parser
    NULL-dereference crash. Affects 0.103.1 and prior.
  * Fix possible memory leak in PNG parser.
  * Fix ClamOnAcc scan on file-creation race condition so files are
    scanned after their contents are written.
  * FreshClam: Deprecate the SafeBrowsing config option. The
    SafeBrowsing option will no longer do anything.
  * For more details, see our blog post from last year about the
    future of the ClamAV Safe Browsing database.
  * FreshClam: Improved HTTP 304, 403, &amp; 429 handling.
  * FreshClam: Added back the mirrors.dat file to the database directory.
  * FreshClam will now exit with a failure in daemon mode if an HTTP 403
    (Forbidden) was received, because retrying later won't help any. The
    FreshClam user will have to take actions to get unblocked.
  * Fix the FreshClam mirror-sync issue where a downloaded database is
    "older than the version advertised."
  * bsc#1181256: Fix errors when scanning files &gt; 4G
  * obsoletes clamav-disable-timestamps.patch
- Update to 0.103.1
  * Added a new scan option to alert on broken media (graphics) file
    formats. This feature mitigates the risk of malformed media files
    intended to exploit vulnerabilities in other software. At present
    media validation exists for JPEG, TIFF, PNG, and GIF files. To
    enable this feature, set AlertBrokenMedia yes in clamd.conf, or
    use the --alert-broken-media option when using clamscan. These
    options are disabled by default in this patch release, but may be
    enabled in a subsequent release. Application developers may enable
    this scan option by enabling CL_SCAN_HEURISTIC_BROKEN_MEDIA for
    the heuristic scan option bit field.
  * Added CL_TYPE_TIFF, CL_TYPE_JPEG types to match GIF, PNG typing
    behavior. BMP and JPEG 2000 files will continue to detect as
    CL_TYPE_GRAPHICS because ClamAV does not yet have BMP or JPEG
    2000 format checking capabilities.
  * Fixed PNG parser logic bugs that caused an excess of parsing
    errors and fixed a stack exhaustion issue affecting some systems
    when scanning PNG files. PNG file type detection was disabled via
    signature database update for ClamAV version 0.103.0 to mitigate
    the effects from these bugs.
  * Fixed an issue where PNG and GIF files no longer work with
    Target:5 graphics signatures if detected as CL_TYPE_PNG/GIF rather
    than as CL_TYPE_GRAPHICS. Target types now support up to 10
    possible file types to make way for additional graphics types in
    future releases.
  * Fixed clamonacc's --fdpass option.
  - Interprocess file descriptor passing for clamonacc was broken
    since version 0.102.0 due to a bug introduced by the switch to
    curl for communicating with clamd. On Linux, passing file
    descriptors from one process to another is handled by the
    kernel, so we reverted clamonacc to use standard system calls
    for socket communication when fd passing is enabled.
  * Fixed a clamonacc stack corruption issue on some systems when
    using an older version of libcurl.
  * Allow clamscan and clamdscan scans to proceed even if the
    realpath lookup failed. This alleviates an issue on Windows
    scanning files hosted on file- systems that do not support the
    GetMappedFileNameW() API such as on ImDisk RAM-disks.
  * Fixed freshclam --on-update-execute=EXIT_1 temporary directory
    cleanup issue.
  * clamd's log output and VirusEvent now provide the scan target's
    file path instead of a file descriptor. The clamd socket API for
    submitting a scan by FD-passing doesn't include a file path, this
    feature works by looking up the file path by file descriptor.
    This feature works on Mac and Linux but is not yet implemented
    for other UNIX operating systems. FD-passing is not available for
    Windows.
  * Fixed an issue where freshclam database validation didn't work
    correctly when run in daemon mode on Linux/Unix.</changelog>
  <changelog author="suse+build@de-korte.org" date="1624276800">- bsc#1188284: Update to 0.103.3
  * Fixed a scan performance issue when ENGINE_OPTIONS_FORCE_TO_DISK is
    enabled. This issue did not impacted most users but for those
    affected it caused every scanned file to be copied to the temp
    directory before the scan.
  * Fix ClamDScan crashes when using the --fdpass --multiscan
    command-line options in combination with the ClamD ExcludePath
    config file options.
  * Fixed an issue where the mirrors.dat file is owned by root when
    starting as root (or with sudo) and using daemon-mode. File
    ownership will be set to the DatabaseOwner just before FreshClam
    switches to run as that user.
  * Renamed the mirrors.dat file to freshclam.dat.
  * Disabled the HTTPUserAgent config option if the DatabaseMirror uses
    clamav.net. This will prevent users from being inadvertently blocked
    and will ensure that we can keep better metrics on which ClamAV
    versions are being used.
  * Moved the detection for Heuristics.PNG.CVE-2010-1205 behind the
    ClamScan --alert-broken-media option (ClamD AlertBrokenMedia yes)
    option. This type of PNG issue appears to be common enough to be an
    annoyance, and the CVE is old enough that no one should be
    vulnerable at this point.
  * Fix ClamSubmit failures after changes to Cloudflare "__cfduid"
    cookies. See: https://blog.cloudflare.com/deprecating-cfduid-cookie/</changelog>
  <changelog author="meissner@suse.com" date="1625054400">- clamav-document-maxsize.patch: in the "clamscan" and "clamdscan" manpages,
  document that files over a certain size by default will silently not be
  scanned and how this can be adjusted (bsc#1187509)</changelog>
  <changelog author="max@suse.com" date="1636372800">- bsc#1192346: Update to 0.103.4
  * FreshClam:
  - Add a 24-hour cool-down for FreshClam clients that have received
    an HTTP 403 (Forbidden) response from the CDN. This is to reduce
    the volume of 403-response data served to blocked FreshClam
    clients that are configured with a tight update-loop.
  - Fixed a bug where FreshClam treats an empty CDIFF as an
    incremental update failure instead of as an intentional request
    to download the whole CVD.
  * ClamDScan: Fix a scan error when broken symlinks are encountered on
    macOS with "FollowDirectorySymlinks" and "FollowFileSymlinks"
    options disabled.
  * Overhauled the scan recursion / nested archive extraction logic and
    added new limits on embedded file-type recognition performed during
    the "raw" scan of each file. This limits embedded file-type
    misidentification and prevents detecting embedded file content that
    is found/extracted and scanned at other layers in the scanning
    process.
  * Fix an issue with the FMap module that failed to read from some
    nested files.
  * Fixed an issue where failing to load some rules from a Yara file
    containing multiple rules may cause a crash.
  * Fixed assorted compiler warnings.
  * Fixed assorted Coverity static code analysis issues.
  * Scan limits:
  - Added virus-name suffixes to the alerts that trigger when a scan
    limit has been exceeded. Rather than simply
    Heuristics.Limits.Exceeded, you may now see limit-specific
    virus-names, to include:
    + Heuristics.Limits.Exceeded.MaxFileSize
    + Heuristics.Limits.Exceeded.MaxScanSize
    + Heuristics.Limits.Exceeded.MaxFiles
    + Heuristics.Limits.Exceeded.MaxRecursion
    + Heuristics.Limits.Exceeded.MaxScanTime
  - Renamed the Heuristics.Email.ExceedsMax.* alerts to align with
    the other limit alerts names. These alerts include:
    + Heuristics.Limits.Exceeded.EmailLineFoldcnt
    + Heuristics.Limits.Exceeded.EmailHeaderBytes
    + Heuristics.Limits.Exceeded.EmailHeaders
    + Heuristics.Limits.Exceeded.EmailMIMEPartsPerMessage
    + Heuristics.Limits.Exceeded.EmailMIMEArguments
  - Fixed an issue where the Email-related scan limits would alert
    even when the "AlertExceedsMax" (--alert-exceeds-max) scan option
    is not enabled.
  - Fixes an issue in the Zip parser where exceeding the "MaxFiles"
    limit or the "MaxFileSize" limit would abort the scan but would
    fail to alert. The Zip scan limit issues were independently
    identified and reported by Aaron Leliaert and Max Allan.
  * Fixed a leak in the Email parser when using the --gen-json scan
    option.
  * Fixed an issue where a failure to record metadata in the Email
    parser when using the --gen-json scan option could cause the Email
    parser to abort the scan early and fail to extract and scan
    additional content.
  * Fixed a file name memory leak in the Zip parser.
  * Fixed an issue where certain signature patterns may cause a crash or
    cause unintended matches on some systems when converting characters
    to uppercase if a UTF-8 unicode single-byte grapheme becomes a
    multi-byte grapheme. Patch courtesy of Andrea De Pasquale.
- Fix unit test
  + clamav-ck_assert_msg.patch</changelog>
  <changelog author="max@suse.com" date="1642420800">- Update to 0.103.5
  * bsc#1194731, CVE-2022-20698:
    Fix for invalid pointer read that may cause a crash.
    This issue affects 0.104.1, 0.103.4 and prior when ClamAV is compiled
    with libjson-c and the CL_SCAN_GENERAL_COLLECT_METADATA scan option
    (the clamscan --gen-json option) is enabled.
  * Fixed ability to disable the file size limit with libclamav C API,
    like this:
    cl_engine_set_num(engine, CL_ENGINE_MAX_FILESIZE, 0);
    This issue didn't affect ClamD or ClamScan which also can disable the
    limit by setting it to zero using MaxFileSize 0 in clamd.conf for ClamD,
    or clamscan --max-filesize=0 for ClamScan.
    Note: Internally, the max file size is still set to 2 GiB. Disabling the
    limit for a scan will fall back on the internal 2 GiB limitation.
  * Increased the maximum line length for ClamAV config files from 512 bytes
    to 1,024 bytes to allow for longer config option strings.
  * SigTool: Fix insufficient buffer size for --list-sigs that caused a
    failure when listing a database containing one or more very long
    signatures. This fix was backported from 0.104.</changelog>
</package>
<package pkgid="ccb72e7aad72b256cc9077048e57f5bc7e7def66361199132dcd2fa6e526c1d4" name="libfreshclam2" arch="x86_64">
  <version epoch="0" ver="0.103.5" rel="3.35.1"/>
  <changelog author="egdfree@opensuse.org" date="1553688000">- Update to version 0.101.2 (bsc#1130721)
  * CVE-2019-1787:
    An out-of-bounds heap read condition may occur when scanning PDF
    documents. The defect is a failure to correctly keep track of the number
    of bytes remaining in a buffer when indexing file data.
  * CVE-2019-1789:
    An out-of-bounds heap read condition may occur when scanning PE files
    (i.e. Windows EXE and DLL files) that have been packed using Aspack as a
    result of inadequate bound-checking.
  * CVE-2019-1788:
    An out-of-bounds heap write condition may occur when scanning OLE2 files
    such as Microsoft Office 97-2003 documents. The invalid write happens when
    an invalid pointer is mistakenly used to initialize a 32bit integer to
    zero. This is likely to crash the application.
  * CVE-2019-1786:
    An out-of-bounds heap read condition may occur when scanning malformed
    PDF documents as a result of improper bounds-checking.
  * CVE-2019-1785:
    A path-traversal write condition may occur as a result of improper
    input validation when scanning RAR archives.
  * CVE-2019-1798:
    A use-after-free condition may occur as a result of improper error
    handling when scanning nested RAR archives.
- added clamav-max_patch.patch to fix build
- dropped clamav-freshclam-exit.patch</changelog>
  <changelog author="max@suse.com" date="1565092800">- Update to version 0.101.3:
  * bsc#1144504: ZIP bomb causes extreme CPU spikes</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1567598400">- update to 0.101.4:
  * CVE-2019-12900: An out of bounds write in the NSIS bzip2
    (boo#1149458)
  * CVE-2019-12625: Introduce a configurable time limit to mitigate
    zip bomb vulnerability completely. Default is 2 minutes,
    configurable useing the clamscan --max-scantime and for clamd
    using the MaxScanTime config option (boo#1144504)</changelog>
  <changelog author="max@suse.com" date="1572004800">- bsc#1151839: Increase the startup timeout of clamd to 5 minutes
  to cater for the grown virus database as a workaround until
  clamd has learned to talk to systemd to extend the timeout as
  long as needed.</changelog>
  <changelog author="suse+build@de-korte.org" date="1572609600">- update to 0.102.0
  * The On-Access Scanning feature has been migrated out of clamd
    and into a brand new utility named clamonacc. This utility is
    similar to clamdscan and clamav-milter in that it acts as a
    client to clamd. This separation from clamd means that clamd no
    longer needs to run with root privileges while scanning potentially
    malicious files. Instead, clamd may drop privileges to run under an
    account that does not have super-user. In addition to improving the
    security posture of running clamd with On-Access enabled, this
    update fixed a few outstanding defects:
  - On-Access scanning for created and moved files (Extra-Scanning)
    is fixed.
  - VirusEvent for On-Access scans is fixed.
  - With clamonacc, it is now possible to copy, move, or remove a
    file if the scan triggered an alert, just like with clamdscan.
  * The freshclam database update utility has undergone a significant
    update. This includes:
  - Added support for HTTPS.
  - Support for database mirrors hosted on ports other than 80.
  - Removal of the mirror management feature (mirrors.dat).
  - An all new libfreshclam library API.
- created new subpackage libfreshclam2
- dropped clamav-max_patch.patch (upstreamed)
- added clamav-fix_building_milter.patch to fix build of milter</changelog>
  <changelog author="suse+build@de-korte.org" date="1574251200">- update to 0.102.1
  * CVE-2019-15961, bsc#1157763: A Denial-of-Service (DoS)
    vulnerability may occur when scanning a specially crafted email
    file as a result of excessively long scan times. The issue is
    resolved by implementing several maximums in parsing MIME
    messages and by optimizing use of memory allocation.
  * Build system fixes to build clamav-milter, to correctly link
    with libxml2 when detected, and to correctly detect fanotify
    for on-access scanning feature support.
  * Signature load time is significantly reduced by changing to a
    more efficient algorithm for loading signature patterns and
    allocating the AC trie. Patch courtesy of Alberto Wu.
  * Introduced a new configure option to statically link libjson-c
    with libclamav. Static linking with libjson is highly
    recommended to prevent crashes in applications that use
    libclamav alongside another JSON parsing library.
  * Null-dereference fix in email parser when using the
  - -gen-json metadata option.
  * Fixes for Authenticode parsing and certificate signature
    (.crb database) bugs.
- dropped clamav-fix_building_milter.patch (upstreamed)</changelog>
  <changelog author="dimstar@opensuse.org" date="1576756800">- BuildRequire pkgconfig(libsystemd) instead of systemd-devel:
  Allow OBS to shortcut through the -mini flavors.</changelog>
  <changelog author="suse+build@de-korte.org" date="1577188800">- The freshclam.service should not be started before the network is
  online (it checks for updates immediately upon service start)</changelog>
  <changelog author="suse+build@de-korte.org" date="1580904000">- update to 0.102.2
  * CVE-2020-3123: A denial-of-service (DoS) condition may occur when
    using the optional credit card data-loss-prevention (DLP) feature.
    Improper bounds checking of an unsigned variable resulted in an
    out-of-bounds read, which causes a crash.
  * Significantly improved the scan speed of PDF files on Windows.
  * Re-applied a fix to alleviate file access issues when scanning RAR
    files in downstream projects that use libclamav where the scanning
    engine is operating in a low-privilege process. This bug was originally
    fixed in 0.101.2 and the fix was mistakenly omitted from 0.102.0.
  * Fixed an issue where freshclam failed to update if the database version
    downloaded is one version older than advertised. This situation may
    occur after a new database version is published. The issue affected
    users downloading the whole CVD database file.
  * Changed the default freshclam ReceiveTimeout setting to 0 (infinite).
    The ReceiveTimeout had caused needless database update failures for
    users with slower internet connections.
  * Correctly display the number of kilobytes (KiB) in progress bar and
    reduced the size of the progress bar to accommodate 80-character width
    terminals.
  * Fixed an issue where running freshclam manually causes a daemonized
    freshclam process to fail when it updates because the manual instance
    deletes the temporary download directory. The freshclam temporary files
    will now download to a unique directory created at the time of an update
    instead of using a hardcoded directory created/destroyed at the program
    start/exit.
  * Fix for freshclam's OnOutdatedExecute config option.
  * Fixes a memory leak in the error condition handling for the email
    parser.
  * Improved bound checking and error handling in ARJ archive parser.
  * Improved error handling in PDF parser.
  * Fix for memory leak in byte-compare signature handler.</changelog>
  <changelog author="mpluskal@suse.com" date="1585742400">- Drop python build dependency as it is not needed</changelog>
  <changelog author="suse+build@de-korte.org" date="1589284800">- Update to 0.102.3
  * CVE-2020-3327: Fix a vulnerability in the ARJ archive parsing
    module in ClamAV 0.102.2 that could cause a Denial-of-Service (DoS)
    condition. Improper bounds checking of an unsigned variable results
    in an out-of-bounds read which causes a crash.
  * CVE-2020-3341: Fix a vulnerability in the PDF parsing module in
    ClamAV 0.101 - 0.102.2 that could cause a Denial-of-Service (DoS)
    condition. Improper size checking of a buffer used to initialize AES
    decryption routines results in an out-of-bounds read which may cause
    a crash.
  * Fix "Attempt to allocate 0 bytes" error when parsing some PDF
    documents.
  * Fix a couple of minor memory leaks.
  * Updated libclamunrar to UnRAR 5.9.2.</changelog>
  <changelog author="suse+build@de-korte.org" date="1594900800">- Update to 0.102.4
  * CVE-2020-3350: Fix a vulnerability wherein a malicious user could
    replace a scan target's directory with a symlink to another path
    to trick clamscan, clamdscan, or clamonacc into removing or moving
    a different file (eg. a critical system file). The issue would
    affect users that use the --move or --remove options for clamscan,
    clamdscan, and clamonacc.
  * CVE-2020-3327: Fix a vulnerability in the ARJ archive parsing
    module in ClamAV 0.102.3 that could cause a Denial-of-Service
    (DoS) condition. Improper bounds checking results in an
    out-of-bounds read which could cause a crash. The previous fix for
    this CVE in 0.102.3 was incomplete. This fix correctly resolves
    the issue.
  * CVE-2020-3481: Fix a vulnerability in the EGG archive module in
    ClamAV 0.102.0 - 0.102.3 could cause a Denial-of-Service (DoS)
    condition. Improper error handling may result in a crash due to a
    NULL pointer dereference. This vulnerability is mitigated for
    those using the official ClamAV signature databases because the
    file type signatures in daily.cvd will not enable the EGG archive
    parser in versions affected by the vulnerability.</changelog>
  <changelog author="suse+build@de-korte.org" date="1600084800">- Update to 0.103.0
  * clamd can now reload the signature database without blocking
    scanning. This multi-threaded database reload improvement was made
    possible thanks to a community effort.
  - Non-blocking database reloads are now the default behavior. Some
    systems that are more constrained on RAM may need to disable
    non-blocking reloads as it will temporarily consume two times as
    much memory. We added a new clamd config option
    ConcurrentDatabaseReload, which may be set to no.
  * Dropped clamav-str-h.patch (no longer needed)
  * Fix clamav-milter.service (requires clamd.service to run)</changelog>
  <changelog author="max@suse.com" date="1605009600">- Sync Factory to SLE-15 to implement jsc#ECO-3010 and bsc#1118459.
- bsc#1119353, clamav-fips.patch: Fix freshclam crash in FIPS mode.
- Keep OBS from installing an existing clamav instance to scan the
  sources, because this makes "make check" use the old library
  instead of the just built one. This is only a workaround until
  we found a way to keep libtool from adding libdir to rpath and
  LD_LIBRARY_PATH of the binaries in the testsuite.</changelog>
  <changelog author="dimstar@opensuse.org" date="1605182400">- Do not hard-depend on systemd: use systemd_ordering instead of
  systemd_requires.</changelog>
  <changelog author="max@suse.com" date="1617969600">- Update clamav.keyring
- Update to 0.103.2
  * CVE-2021-1252, bsc#1184532: Fix for Excel XLM parser infinite
    loop. Affects 0.103.0 and 0.103.1 only.
  * CVE-2021-1404, bsc#1184533: Fix for PDF parser buffer over-read;
    possible crash. Affects 0.103.0 and 0.103.1 only.
  * CVE-2021-1405, bsc#1184534: Fix for mail parser
    NULL-dereference crash. Affects 0.103.1 and prior.
  * Fix possible memory leak in PNG parser.
  * Fix ClamOnAcc scan on file-creation race condition so files are
    scanned after their contents are written.
  * FreshClam: Deprecate the SafeBrowsing config option. The
    SafeBrowsing option will no longer do anything.
  * For more details, see our blog post from last year about the
    future of the ClamAV Safe Browsing database.
  * FreshClam: Improved HTTP 304, 403, &amp; 429 handling.
  * FreshClam: Added back the mirrors.dat file to the database directory.
  * FreshClam will now exit with a failure in daemon mode if an HTTP 403
    (Forbidden) was received, because retrying later won't help any. The
    FreshClam user will have to take actions to get unblocked.
  * Fix the FreshClam mirror-sync issue where a downloaded database is
    "older than the version advertised."
  * bsc#1181256: Fix errors when scanning files &gt; 4G
  * obsoletes clamav-disable-timestamps.patch
- Update to 0.103.1
  * Added a new scan option to alert on broken media (graphics) file
    formats. This feature mitigates the risk of malformed media files
    intended to exploit vulnerabilities in other software. At present
    media validation exists for JPEG, TIFF, PNG, and GIF files. To
    enable this feature, set AlertBrokenMedia yes in clamd.conf, or
    use the --alert-broken-media option when using clamscan. These
    options are disabled by default in this patch release, but may be
    enabled in a subsequent release. Application developers may enable
    this scan option by enabling CL_SCAN_HEURISTIC_BROKEN_MEDIA for
    the heuristic scan option bit field.
  * Added CL_TYPE_TIFF, CL_TYPE_JPEG types to match GIF, PNG typing
    behavior. BMP and JPEG 2000 files will continue to detect as
    CL_TYPE_GRAPHICS because ClamAV does not yet have BMP or JPEG
    2000 format checking capabilities.
  * Fixed PNG parser logic bugs that caused an excess of parsing
    errors and fixed a stack exhaustion issue affecting some systems
    when scanning PNG files. PNG file type detection was disabled via
    signature database update for ClamAV version 0.103.0 to mitigate
    the effects from these bugs.
  * Fixed an issue where PNG and GIF files no longer work with
    Target:5 graphics signatures if detected as CL_TYPE_PNG/GIF rather
    than as CL_TYPE_GRAPHICS. Target types now support up to 10
    possible file types to make way for additional graphics types in
    future releases.
  * Fixed clamonacc's --fdpass option.
  - Interprocess file descriptor passing for clamonacc was broken
    since version 0.102.0 due to a bug introduced by the switch to
    curl for communicating with clamd. On Linux, passing file
    descriptors from one process to another is handled by the
    kernel, so we reverted clamonacc to use standard system calls
    for socket communication when fd passing is enabled.
  * Fixed a clamonacc stack corruption issue on some systems when
    using an older version of libcurl.
  * Allow clamscan and clamdscan scans to proceed even if the
    realpath lookup failed. This alleviates an issue on Windows
    scanning files hosted on file- systems that do not support the
    GetMappedFileNameW() API such as on ImDisk RAM-disks.
  * Fixed freshclam --on-update-execute=EXIT_1 temporary directory
    cleanup issue.
  * clamd's log output and VirusEvent now provide the scan target's
    file path instead of a file descriptor. The clamd socket API for
    submitting a scan by FD-passing doesn't include a file path, this
    feature works by looking up the file path by file descriptor.
    This feature works on Mac and Linux but is not yet implemented
    for other UNIX operating systems. FD-passing is not available for
    Windows.
  * Fixed an issue where freshclam database validation didn't work
    correctly when run in daemon mode on Linux/Unix.</changelog>
  <changelog author="suse+build@de-korte.org" date="1624276800">- bsc#1188284: Update to 0.103.3
  * Fixed a scan performance issue when ENGINE_OPTIONS_FORCE_TO_DISK is
    enabled. This issue did not impacted most users but for those
    affected it caused every scanned file to be copied to the temp
    directory before the scan.
  * Fix ClamDScan crashes when using the --fdpass --multiscan
    command-line options in combination with the ClamD ExcludePath
    config file options.
  * Fixed an issue where the mirrors.dat file is owned by root when
    starting as root (or with sudo) and using daemon-mode. File
    ownership will be set to the DatabaseOwner just before FreshClam
    switches to run as that user.
  * Renamed the mirrors.dat file to freshclam.dat.
  * Disabled the HTTPUserAgent config option if the DatabaseMirror uses
    clamav.net. This will prevent users from being inadvertently blocked
    and will ensure that we can keep better metrics on which ClamAV
    versions are being used.
  * Moved the detection for Heuristics.PNG.CVE-2010-1205 behind the
    ClamScan --alert-broken-media option (ClamD AlertBrokenMedia yes)
    option. This type of PNG issue appears to be common enough to be an
    annoyance, and the CVE is old enough that no one should be
    vulnerable at this point.
  * Fix ClamSubmit failures after changes to Cloudflare "__cfduid"
    cookies. See: https://blog.cloudflare.com/deprecating-cfduid-cookie/</changelog>
  <changelog author="meissner@suse.com" date="1625054400">- clamav-document-maxsize.patch: in the "clamscan" and "clamdscan" manpages,
  document that files over a certain size by default will silently not be
  scanned and how this can be adjusted (bsc#1187509)</changelog>
  <changelog author="max@suse.com" date="1636372800">- bsc#1192346: Update to 0.103.4
  * FreshClam:
  - Add a 24-hour cool-down for FreshClam clients that have received
    an HTTP 403 (Forbidden) response from the CDN. This is to reduce
    the volume of 403-response data served to blocked FreshClam
    clients that are configured with a tight update-loop.
  - Fixed a bug where FreshClam treats an empty CDIFF as an
    incremental update failure instead of as an intentional request
    to download the whole CVD.
  * ClamDScan: Fix a scan error when broken symlinks are encountered on
    macOS with "FollowDirectorySymlinks" and "FollowFileSymlinks"
    options disabled.
  * Overhauled the scan recursion / nested archive extraction logic and
    added new limits on embedded file-type recognition performed during
    the "raw" scan of each file. This limits embedded file-type
    misidentification and prevents detecting embedded file content that
    is found/extracted and scanned at other layers in the scanning
    process.
  * Fix an issue with the FMap module that failed to read from some
    nested files.
  * Fixed an issue where failing to load some rules from a Yara file
    containing multiple rules may cause a crash.
  * Fixed assorted compiler warnings.
  * Fixed assorted Coverity static code analysis issues.
  * Scan limits:
  - Added virus-name suffixes to the alerts that trigger when a scan
    limit has been exceeded. Rather than simply
    Heuristics.Limits.Exceeded, you may now see limit-specific
    virus-names, to include:
    + Heuristics.Limits.Exceeded.MaxFileSize
    + Heuristics.Limits.Exceeded.MaxScanSize
    + Heuristics.Limits.Exceeded.MaxFiles
    + Heuristics.Limits.Exceeded.MaxRecursion
    + Heuristics.Limits.Exceeded.MaxScanTime
  - Renamed the Heuristics.Email.ExceedsMax.* alerts to align with
    the other limit alerts names. These alerts include:
    + Heuristics.Limits.Exceeded.EmailLineFoldcnt
    + Heuristics.Limits.Exceeded.EmailHeaderBytes
    + Heuristics.Limits.Exceeded.EmailHeaders
    + Heuristics.Limits.Exceeded.EmailMIMEPartsPerMessage
    + Heuristics.Limits.Exceeded.EmailMIMEArguments
  - Fixed an issue where the Email-related scan limits would alert
    even when the "AlertExceedsMax" (--alert-exceeds-max) scan option
    is not enabled.
  - Fixes an issue in the Zip parser where exceeding the "MaxFiles"
    limit or the "MaxFileSize" limit would abort the scan but would
    fail to alert. The Zip scan limit issues were independently
    identified and reported by Aaron Leliaert and Max Allan.
  * Fixed a leak in the Email parser when using the --gen-json scan
    option.
  * Fixed an issue where a failure to record metadata in the Email
    parser when using the --gen-json scan option could cause the Email
    parser to abort the scan early and fail to extract and scan
    additional content.
  * Fixed a file name memory leak in the Zip parser.
  * Fixed an issue where certain signature patterns may cause a crash or
    cause unintended matches on some systems when converting characters
    to uppercase if a UTF-8 unicode single-byte grapheme becomes a
    multi-byte grapheme. Patch courtesy of Andrea De Pasquale.
- Fix unit test
  + clamav-ck_assert_msg.patch</changelog>
  <changelog author="max@suse.com" date="1642420800">- Update to 0.103.5
  * bsc#1194731, CVE-2022-20698:
    Fix for invalid pointer read that may cause a crash.
    This issue affects 0.104.1, 0.103.4 and prior when ClamAV is compiled
    with libjson-c and the CL_SCAN_GENERAL_COLLECT_METADATA scan option
    (the clamscan --gen-json option) is enabled.
  * Fixed ability to disable the file size limit with libclamav C API,
    like this:
    cl_engine_set_num(engine, CL_ENGINE_MAX_FILESIZE, 0);
    This issue didn't affect ClamD or ClamScan which also can disable the
    limit by setting it to zero using MaxFileSize 0 in clamd.conf for ClamD,
    or clamscan --max-filesize=0 for ClamScan.
    Note: Internally, the max file size is still set to 2 GiB. Disabling the
    limit for a scan will fall back on the internal 2 GiB limitation.
  * Increased the maximum line length for ClamAV config files from 512 bytes
    to 1,024 bytes to allow for longer config option strings.
  * SigTool: Fix insufficient buffer size for --list-sigs that caused a
    failure when listing a database containing one or more very long
    signatures. This fix was backported from 0.104.</changelog>
</package>
<package pkgid="1b1932cb0063413345560f05b7c8ceab312512197de3208ee047b7b5f9c587d5" name="libhunspell-1_6-0" arch="aarch64">
  <version epoch="0" ver="1.6.2" rel="3.8.1"/>
  <changelog author="tchvatal@suse.com" date="1459771200">- Version update to 1.3.4:
  * Various updates to the buildsystem
  * Various werror bugfixes
  * Loads of coverity fixes
- Add patch to build with grep 2.24:
  * hunspell-grep2.24.patch
- Remove upstreamed patch:
  * hunspell-emacs-utf8.patch
- Do not search for translations - broken automake from upstream
  * Not worth fixing only bit italian and mostly hungarian translations
    for cli anyway</changelog>
  <changelog author="mpluskal@suse.com" date="1461067200">- Update to 1.4.0
  * New release that strips out fixed length buffers from large
    parts of the library
  * Note: dictmgr.hxx header is dropped
- Drop upstreamed hunspell-grep2.24.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1462363200">- Update to 1.4.1:
  * Past begin() iterator decrement error
  * VS Debug build threw error on decrement past begin.
- Split shared library
- Do not call autoreconf
- Move manpages to corresponding packages</changelog>
  <changelog author="mpluskal@suse.com" date="1462968000">- Update baselibs.conf bnc#977784
- Add conflicts to hunspell 1.4.0</changelog>
  <changelog author="jengelh@inai.de" date="1463486400">- Drop Requires: pkgconfig because this is already autodetected
  by rpm. Use mode inheritance for defattr. Edit rpm group and
  description a tiny bit.</changelog>
  <changelog author="pgajdos@suse.com" date="1479729600">- update to 1.5.0:
  * Lot of stability fixes
  * Fixed compilation errors on various systems (Windows, FreeBSD)
  * Small performance improvement compared to 1.4.0
  * API is same as 1.4.</changelog>
  <changelog author="pgajdos@suse.com" date="1480593600">- update to 1.5.4:
  * fix API compatibility with 1.4</changelog>
  <changelog author="mpluskal@suse.com" date="1482494400">- Update to version 1.6.0:
  * Changes in the library:
    + Performance improvement in ngsuggest(), suggestions should be
    faster.
    + Revert MAXWORDLEN to 100 as in 1.3.3 for performance reasons.
    + MAXWORDLEN can be set during build time with -D defines.
    + Fix crash when word with 102 consecutive X is spelled.
  * Changes in the command line tool:
    + -D shows all loaded dictionares insted of only the first.
    + -D properly lists all available dictionaries on Windows.</changelog>
  <changelog author="mpluskal@suse.com" date="1496836800">- Update to version 1.6.1:
  * Library changes:
    + Performance improvements in suggest()
    + Fixes regressions for Hungarian related to compounding.
    + Fixes regressions for Korean related to ICONV.
  * Command line tool:
    + Added Tajik translation
    + Fix regarding serching of OOo dicts installed in user folder
  * Manpages:
    + Fix microsoft-cp1251 to cp1251. Dicts should not use the
    first.
    + Typos.</changelog>
  <changelog author="mpluskal@suse.com" date="1509105600">- Update to version 1.6.2:
  * Command line tool:
    + Added German translation
    + Fixed bug with wrong output encoding, not respecting system
    locale.</changelog>
  <changelog author="pgajdos@suse.com" date="1591704000">- security update
- added patches
  fix CVE-2019-16707 [bsc#1151867], invalid read operation in SuggestMgr:leftcommonsubstring in suggestmgr.cxx
  + hunspell-CVE-2019-16707.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1641470400">- suggests english directory [bsc#1193627]</changelog>
</package>
<package pkgid="5040eb94d3cd912350a85ceb16d073ddf775537004c9f7ec4f7ebd740bd45a30" name="libhunspell-1_6-0" arch="ppc64le">
  <version epoch="0" ver="1.6.2" rel="3.8.1"/>
  <changelog author="tchvatal@suse.com" date="1459771200">- Version update to 1.3.4:
  * Various updates to the buildsystem
  * Various werror bugfixes
  * Loads of coverity fixes
- Add patch to build with grep 2.24:
  * hunspell-grep2.24.patch
- Remove upstreamed patch:
  * hunspell-emacs-utf8.patch
- Do not search for translations - broken automake from upstream
  * Not worth fixing only bit italian and mostly hungarian translations
    for cli anyway</changelog>
  <changelog author="mpluskal@suse.com" date="1461067200">- Update to 1.4.0
  * New release that strips out fixed length buffers from large
    parts of the library
  * Note: dictmgr.hxx header is dropped
- Drop upstreamed hunspell-grep2.24.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1462363200">- Update to 1.4.1:
  * Past begin() iterator decrement error
  * VS Debug build threw error on decrement past begin.
- Split shared library
- Do not call autoreconf
- Move manpages to corresponding packages</changelog>
  <changelog author="mpluskal@suse.com" date="1462968000">- Update baselibs.conf bnc#977784
- Add conflicts to hunspell 1.4.0</changelog>
  <changelog author="jengelh@inai.de" date="1463486400">- Drop Requires: pkgconfig because this is already autodetected
  by rpm. Use mode inheritance for defattr. Edit rpm group and
  description a tiny bit.</changelog>
  <changelog author="pgajdos@suse.com" date="1479729600">- update to 1.5.0:
  * Lot of stability fixes
  * Fixed compilation errors on various systems (Windows, FreeBSD)
  * Small performance improvement compared to 1.4.0
  * API is same as 1.4.</changelog>
  <changelog author="pgajdos@suse.com" date="1480593600">- update to 1.5.4:
  * fix API compatibility with 1.4</changelog>
  <changelog author="mpluskal@suse.com" date="1482494400">- Update to version 1.6.0:
  * Changes in the library:
    + Performance improvement in ngsuggest(), suggestions should be
    faster.
    + Revert MAXWORDLEN to 100 as in 1.3.3 for performance reasons.
    + MAXWORDLEN can be set during build time with -D defines.
    + Fix crash when word with 102 consecutive X is spelled.
  * Changes in the command line tool:
    + -D shows all loaded dictionares insted of only the first.
    + -D properly lists all available dictionaries on Windows.</changelog>
  <changelog author="mpluskal@suse.com" date="1496836800">- Update to version 1.6.1:
  * Library changes:
    + Performance improvements in suggest()
    + Fixes regressions for Hungarian related to compounding.
    + Fixes regressions for Korean related to ICONV.
  * Command line tool:
    + Added Tajik translation
    + Fix regarding serching of OOo dicts installed in user folder
  * Manpages:
    + Fix microsoft-cp1251 to cp1251. Dicts should not use the
    first.
    + Typos.</changelog>
  <changelog author="mpluskal@suse.com" date="1509105600">- Update to version 1.6.2:
  * Command line tool:
    + Added German translation
    + Fixed bug with wrong output encoding, not respecting system
    locale.</changelog>
  <changelog author="pgajdos@suse.com" date="1591704000">- security update
- added patches
  fix CVE-2019-16707 [bsc#1151867], invalid read operation in SuggestMgr:leftcommonsubstring in suggestmgr.cxx
  + hunspell-CVE-2019-16707.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1641470400">- suggests english directory [bsc#1193627]</changelog>
</package>
<package pkgid="ff27571d863bb81e6de454d2301ef8908f93e26d22e0ba5f5e5d86bbbaad29bb" name="libhunspell-1_6-0" arch="s390x">
  <version epoch="0" ver="1.6.2" rel="3.8.1"/>
  <changelog author="tchvatal@suse.com" date="1459771200">- Version update to 1.3.4:
  * Various updates to the buildsystem
  * Various werror bugfixes
  * Loads of coverity fixes
- Add patch to build with grep 2.24:
  * hunspell-grep2.24.patch
- Remove upstreamed patch:
  * hunspell-emacs-utf8.patch
- Do not search for translations - broken automake from upstream
  * Not worth fixing only bit italian and mostly hungarian translations
    for cli anyway</changelog>
  <changelog author="mpluskal@suse.com" date="1461067200">- Update to 1.4.0
  * New release that strips out fixed length buffers from large
    parts of the library
  * Note: dictmgr.hxx header is dropped
- Drop upstreamed hunspell-grep2.24.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1462363200">- Update to 1.4.1:
  * Past begin() iterator decrement error
  * VS Debug build threw error on decrement past begin.
- Split shared library
- Do not call autoreconf
- Move manpages to corresponding packages</changelog>
  <changelog author="mpluskal@suse.com" date="1462968000">- Update baselibs.conf bnc#977784
- Add conflicts to hunspell 1.4.0</changelog>
  <changelog author="jengelh@inai.de" date="1463486400">- Drop Requires: pkgconfig because this is already autodetected
  by rpm. Use mode inheritance for defattr. Edit rpm group and
  description a tiny bit.</changelog>
  <changelog author="pgajdos@suse.com" date="1479729600">- update to 1.5.0:
  * Lot of stability fixes
  * Fixed compilation errors on various systems (Windows, FreeBSD)
  * Small performance improvement compared to 1.4.0
  * API is same as 1.4.</changelog>
  <changelog author="pgajdos@suse.com" date="1480593600">- update to 1.5.4:
  * fix API compatibility with 1.4</changelog>
  <changelog author="mpluskal@suse.com" date="1482494400">- Update to version 1.6.0:
  * Changes in the library:
    + Performance improvement in ngsuggest(), suggestions should be
    faster.
    + Revert MAXWORDLEN to 100 as in 1.3.3 for performance reasons.
    + MAXWORDLEN can be set during build time with -D defines.
    + Fix crash when word with 102 consecutive X is spelled.
  * Changes in the command line tool:
    + -D shows all loaded dictionares insted of only the first.
    + -D properly lists all available dictionaries on Windows.</changelog>
  <changelog author="mpluskal@suse.com" date="1496836800">- Update to version 1.6.1:
  * Library changes:
    + Performance improvements in suggest()
    + Fixes regressions for Hungarian related to compounding.
    + Fixes regressions for Korean related to ICONV.
  * Command line tool:
    + Added Tajik translation
    + Fix regarding serching of OOo dicts installed in user folder
  * Manpages:
    + Fix microsoft-cp1251 to cp1251. Dicts should not use the
    first.
    + Typos.</changelog>
  <changelog author="mpluskal@suse.com" date="1509105600">- Update to version 1.6.2:
  * Command line tool:
    + Added German translation
    + Fixed bug with wrong output encoding, not respecting system
    locale.</changelog>
  <changelog author="pgajdos@suse.com" date="1591704000">- security update
- added patches
  fix CVE-2019-16707 [bsc#1151867], invalid read operation in SuggestMgr:leftcommonsubstring in suggestmgr.cxx
  + hunspell-CVE-2019-16707.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1641470400">- suggests english directory [bsc#1193627]</changelog>
</package>
<package pkgid="f27be91bf405267049448822247eb2c11c0f588828fa366a56c59bec85e49066" name="libhunspell-1_6-0" arch="x86_64">
  <version epoch="0" ver="1.6.2" rel="3.8.1"/>
  <changelog author="tchvatal@suse.com" date="1459771200">- Version update to 1.3.4:
  * Various updates to the buildsystem
  * Various werror bugfixes
  * Loads of coverity fixes
- Add patch to build with grep 2.24:
  * hunspell-grep2.24.patch
- Remove upstreamed patch:
  * hunspell-emacs-utf8.patch
- Do not search for translations - broken automake from upstream
  * Not worth fixing only bit italian and mostly hungarian translations
    for cli anyway</changelog>
  <changelog author="mpluskal@suse.com" date="1461067200">- Update to 1.4.0
  * New release that strips out fixed length buffers from large
    parts of the library
  * Note: dictmgr.hxx header is dropped
- Drop upstreamed hunspell-grep2.24.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1462363200">- Update to 1.4.1:
  * Past begin() iterator decrement error
  * VS Debug build threw error on decrement past begin.
- Split shared library
- Do not call autoreconf
- Move manpages to corresponding packages</changelog>
  <changelog author="mpluskal@suse.com" date="1462968000">- Update baselibs.conf bnc#977784
- Add conflicts to hunspell 1.4.0</changelog>
  <changelog author="jengelh@inai.de" date="1463486400">- Drop Requires: pkgconfig because this is already autodetected
  by rpm. Use mode inheritance for defattr. Edit rpm group and
  description a tiny bit.</changelog>
  <changelog author="pgajdos@suse.com" date="1479729600">- update to 1.5.0:
  * Lot of stability fixes
  * Fixed compilation errors on various systems (Windows, FreeBSD)
  * Small performance improvement compared to 1.4.0
  * API is same as 1.4.</changelog>
  <changelog author="pgajdos@suse.com" date="1480593600">- update to 1.5.4:
  * fix API compatibility with 1.4</changelog>
  <changelog author="mpluskal@suse.com" date="1482494400">- Update to version 1.6.0:
  * Changes in the library:
    + Performance improvement in ngsuggest(), suggestions should be
    faster.
    + Revert MAXWORDLEN to 100 as in 1.3.3 for performance reasons.
    + MAXWORDLEN can be set during build time with -D defines.
    + Fix crash when word with 102 consecutive X is spelled.
  * Changes in the command line tool:
    + -D shows all loaded dictionares insted of only the first.
    + -D properly lists all available dictionaries on Windows.</changelog>
  <changelog author="mpluskal@suse.com" date="1496836800">- Update to version 1.6.1:
  * Library changes:
    + Performance improvements in suggest()
    + Fixes regressions for Hungarian related to compounding.
    + Fixes regressions for Korean related to ICONV.
  * Command line tool:
    + Added Tajik translation
    + Fix regarding serching of OOo dicts installed in user folder
  * Manpages:
    + Fix microsoft-cp1251 to cp1251. Dicts should not use the
    first.
    + Typos.</changelog>
  <changelog author="mpluskal@suse.com" date="1509105600">- Update to version 1.6.2:
  * Command line tool:
    + Added German translation
    + Fixed bug with wrong output encoding, not respecting system
    locale.</changelog>
  <changelog author="pgajdos@suse.com" date="1591704000">- security update
- added patches
  fix CVE-2019-16707 [bsc#1151867], invalid read operation in SuggestMgr:leftcommonsubstring in suggestmgr.cxx
  + hunspell-CVE-2019-16707.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1641470400">- suggests english directory [bsc#1193627]</changelog>
</package>
<package pkgid="2dd8bcf3c194570e8ca2a3c3f06d148f941daff3b7f632fae264fa895e75962f" name="libhunspell-1_6-0-32bit" arch="x86_64">
  <version epoch="0" ver="1.6.2" rel="3.8.1"/>
  <changelog author="tchvatal@suse.com" date="1459771200">- Version update to 1.3.4:
  * Various updates to the buildsystem
  * Various werror bugfixes
  * Loads of coverity fixes
- Add patch to build with grep 2.24:
  * hunspell-grep2.24.patch
- Remove upstreamed patch:
  * hunspell-emacs-utf8.patch
- Do not search for translations - broken automake from upstream
  * Not worth fixing only bit italian and mostly hungarian translations
    for cli anyway</changelog>
  <changelog author="mpluskal@suse.com" date="1461067200">- Update to 1.4.0
  * New release that strips out fixed length buffers from large
    parts of the library
  * Note: dictmgr.hxx header is dropped
- Drop upstreamed hunspell-grep2.24.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1462363200">- Update to 1.4.1:
  * Past begin() iterator decrement error
  * VS Debug build threw error on decrement past begin.
- Split shared library
- Do not call autoreconf
- Move manpages to corresponding packages</changelog>
  <changelog author="mpluskal@suse.com" date="1462968000">- Update baselibs.conf bnc#977784
- Add conflicts to hunspell 1.4.0</changelog>
  <changelog author="jengelh@inai.de" date="1463486400">- Drop Requires: pkgconfig because this is already autodetected
  by rpm. Use mode inheritance for defattr. Edit rpm group and
  description a tiny bit.</changelog>
  <changelog author="pgajdos@suse.com" date="1479729600">- update to 1.5.0:
  * Lot of stability fixes
  * Fixed compilation errors on various systems (Windows, FreeBSD)
  * Small performance improvement compared to 1.4.0
  * API is same as 1.4.</changelog>
  <changelog author="pgajdos@suse.com" date="1480593600">- update to 1.5.4:
  * fix API compatibility with 1.4</changelog>
  <changelog author="mpluskal@suse.com" date="1482494400">- Update to version 1.6.0:
  * Changes in the library:
    + Performance improvement in ngsuggest(), suggestions should be
    faster.
    + Revert MAXWORDLEN to 100 as in 1.3.3 for performance reasons.
    + MAXWORDLEN can be set during build time with -D defines.
    + Fix crash when word with 102 consecutive X is spelled.
  * Changes in the command line tool:
    + -D shows all loaded dictionares insted of only the first.
    + -D properly lists all available dictionaries on Windows.</changelog>
  <changelog author="mpluskal@suse.com" date="1496836800">- Update to version 1.6.1:
  * Library changes:
    + Performance improvements in suggest()
    + Fixes regressions for Hungarian related to compounding.
    + Fixes regressions for Korean related to ICONV.
  * Command line tool:
    + Added Tajik translation
    + Fix regarding serching of OOo dicts installed in user folder
  * Manpages:
    + Fix microsoft-cp1251 to cp1251. Dicts should not use the
    first.
    + Typos.</changelog>
  <changelog author="mpluskal@suse.com" date="1509105600">- Update to version 1.6.2:
  * Command line tool:
    + Added German translation
    + Fixed bug with wrong output encoding, not respecting system
    locale.</changelog>
  <changelog author="pgajdos@suse.com" date="1591704000">- security update
- added patches
  fix CVE-2019-16707 [bsc#1151867], invalid read operation in SuggestMgr:leftcommonsubstring in suggestmgr.cxx
  + hunspell-CVE-2019-16707.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1641470400">- suggests english directory [bsc#1193627]</changelog>
</package>
<package pkgid="1dbc62620faeea55ebc2bf2cfb9e2fabba24517ddbd44d464e971276ee9e0e54" name="libjasper-devel" arch="aarch64">
  <version epoch="0" ver="2.0.14" rel="3.22.1"/>
  <changelog author="sbrabec@suse.com" date="1488801600">- Add -D_BSD_SOURCE to fix redefinition of system types in
  jas_config.h and breakage in ppc64le, s390 and s390x
  (bsc#1028070).</changelog>
  <changelog author="fstrba@suse.com" date="1489665600">- Added patch:
  * jasper-CVE-2016-10251.patch
  - Upstream fix for bsc#1029497, CVE-2016-10251: Use of
    uninitialized value in jpc_pi_nextcprl (jpc_t2cod.c)</changelog>
  <changelog author="fstrba@suse.com" date="1489752000">- Added patches:
  * jasper-CVE-2017-5498.patch
  - Upstream changes putting braces and belts around
    CVE-2017-5498, bsc#1020353, left-shift undefined behaviour
  * jasper-CVE-2016-9600.patch
  - Upstream fix for "Null Pointer Dereference due to missing
    check for UNKNOWN color space in JP2 encoder" (CVE-2016-9600,
    bsc#1018088)</changelog>
  <changelog author="fstrba@suse.com" date="1490184000">- Added patches:
  * jasper-CVE-2016-9583.patch
  - Out of bounds heap read in jpc_pi_nextpcrl() (bsc#1015400,
    CVE-2016-9583)
  * jasper-CVE-2017-6850.patch
  - NULL pointer dereference in jp2_cdef_destroy (jp2_cod.c)
    (bsc#1021868, CVE-2017-6850)</changelog>
  <changelog author="fstrba@suse.com" date="1490875200">- Modified patch:
  * jasper-CVE-2016-9583.patch
    + integrate upstream change
    99a50593254d1b53002719bbecfc946c84b23d27, which fixed a null
    pointer dereferencing crash.</changelog>
  <changelog author="fstrba@suse.com" date="1499774400">- Added patch:
  * jasper-CVE-2017-1000050.patch
    + Upstream fix for NULL Pointer Dereference jp2_encode
    (bsc#1047958, CVE-2017-1000050)</changelog>
  <changelog author="fstrba@suse.com" date="1499774401">- Added patch:
  * jasper-CVE-2016-9262.patch
    + Fix for Multiple overflow vulnerabilities leading to use
    after free (bsc#1009994, CVE-2016-9262)</changelog>
  <changelog author="fstrba@suse.com" date="1499860800">- Other bugs fixed by existing patches:
  * jasper-CVE-2016-9395.patch
  - bsc#1010756, CVE-2016-9394: assertion in jas_matrix_t
  * jas_seq2d_create(int, int, int, int): Assertion
    `xstart &lt;= xend &amp;&amp; ystart &lt;= yend'
  - bsc#1010757, CVE-2016-9392: pc_dec.c:1637: void
    calcstepsizes(uint_fast16_t, int, uint_fast16_t *):
    Assertion `!((expn + (numrlvls - 1) - (numrlvls - 1 -
    ((bandno &gt; 0) ? ((bandno + 2) / 3) : (0)))) &amp; (~0x1f))'
    failed.
  - bsc#1010766, CVE-2016-9393: jpc_t2cod.c:297: int
    jpc_pi_nextrpcl(jpc_pi_t *): Assertion
    `pi-&gt;prcno pirlvl-&gt;numprcs' failed.
  - bsc#1010977, CVE-2016-9395: jas_seq.c:90: jas_matrix_t
  * jas_seq2d_create(int, int, int, int): Assertion `xstart
    &lt;= xend &amp;&amp; ystart &lt;= yend' failed.
- Other bugs fixed in current version:
  * bsc#1010774, CVE-2016-9390: jas_seq.c:90: jas_matrix_t
  * jas_seq2d_create(int, int, int, int): Assertion `xstart &lt;=
    xend &amp;&amp; ystart &lt;= yend' failed.
  * bsc#1010782, CVE-2016-9391: jpc_bs.c:197: long
    jpc_bitstream_getbits(jpc_bitstream_t *, int): Assertion
    `n &gt;= 0 &amp;&amp; n &lt; 32' failed.
  * bsc#1010968, CVE-2016-9389: Assertion `((c1)-&gt;numcols_) ==
    numcols &amp;&amp; ((c2)-&gt;numcols_) == numcols' failed.
  * bsc#1010975, CVE-2016-9388: ras_dec.c:330: int
    ras_getcmap(jas_stream_t *, ras_hdr_t *, ras_cmap_t *):
    Assertion `numcolors &lt;= 256' failed.
  * bsc#1010960, CVE-2016-9387: jas_seq.c:90: jas_matrix&lt;= yend'
    failed.</changelog>
  <changelog author="fstrba@suse.com" date="1522324800">- Upgrade to 2.0.14
  * Soname and package name change libjasper1 to libjasper4
  * Security fixes:
    + CVE-2016-9557 jasper: Signed integer overflow in jas_image.c
- Removed patches:
  * jasper-1.900.1-uninitialized.patch
    + not needed any more
  * jasper-CVE-2016-10251.patch
  * jasper-CVE-2016-8654.patch
  * jasper-CVE-2016-9262.patch
  * jasper-CVE-2016-9395.patch
  * jasper-CVE-2016-9560.patch
  * jasper-CVE-2016-9583.patch
  * jasper-CVE-2016-9591.patch
  * jasper-CVE-2016-9600.patch
  * jasper-CVE-2017-1000050.patch
  * jasper-CVE-2017-5498.patch
  * jasper-CVE-2017-6850.patch
    + Fixed upstream
- Added patches:
  * 0001-jpc_cs-reject-all-but-JPC_COX_INS-and-JPC_COX_RFT.patch
    + fix assertion failure JPC_NOMINALGAIN() which can be caused
    by a crafted JP2 file.
  * 0001-Added-a-fix-from-nrusch-to-allow-JasPer-to-be-build-.patch
    + allow JasPer to be build with CMake 2.x as well as CMake 3.x.</changelog>
  <changelog author="fstrba@suse.com" date="1522324801">- Added patch:
  * jasper-CVE-2018-9055.patch
    + fix CVE-2018-9055, bsc#1087020: jasper: denial of service via
    a reachable assertion in the function jpc_firstone in
    libjasper/jpc/jpc_math.c.</changelog>
  <changelog author="mvetter@suse.com" date="1552392000">- bsc#1117511 CVE-2018-19539 Fix access violation in jas_image_readcmpt:
  * Add jasper-CVE-2018-19539.patch</changelog>
  <changelog author="mvetter@suse.com" date="1553860800">- bsc#1117505 CVE-2018-19542 Fix NULL pointer dereference jp2_decode:
  Add jasper-CVE-2018-19542.patch
- bsc#1010783 CVE-2016-9396 Fix reachable assertion in jpc_cox_getcompparms:
  * Rename 0001-jpc_cs-reject-all-but-JPC_COX_INS-and-JPC_COX_RFT.patch
  to jasper-CVE-2016-9396.patch</changelog>
  <changelog author="mvetter@suse.com" date="1559822400">- bsc#1117508 CVE-2018-19540: Fix heap based overflow in jas_icctxtdesc_input
  Add jasper-CVE-2018-19540.patch: Make sure asclen is at least 1
- bsc#1117507 CVE-2018-19541: Fix heap based overread in jas_image_depalettize
  Add jasper-CVE-2018-19541.patch: Check number of lutents</changelog>
  <changelog author="adam.majer@suse.de" date="1569844800">- jasper-CVE-2018-19541.patch: verify color palette information
  in j2 files when it's read from the file as per specifications
  of JPEG2000. (bsc#1117507)</changelog>
  <changelog author="mvetter@suse.com" date="1584446400">- bsc#1092115 CVE-2018-9154: Fix possible denial of service
  Add jasper-CVE-2018-9154.patch: dont abort in jpc_dec_process_sot()</changelog>
  <changelog author="mvetter@suse.com" date="1597320000">- bsc#1010980 CVE-2016-9399: Fix assert in calcstepsizes
  Add jasper-CVE-2016-9399.patch
- bsc#1020451 CVE-2017-5499: Validate component depth bit
  Add jasper-CVE-2017-5499.patch
- bsc#1020456 CVE-2017-5503, bsc#1020458 CVE-2017-5504, bsc#1020460 CVE-2017-5505:
  Check bounds in jas_seq2d_bindsub()
  Add jasper-CVE-2017-5503-CVE-2017-5504-CVE-2017-5505.patch</changelog>
  <changelog author="mvetter@suse.com" date="1597665600">- bsc#1120807 CVE-2018-20570: Fix heap based buffer over-read in jp2_encode
  Add jasper-CVE-2018-20570.patch
- bsc#1120805 CVE-2018-20622: Fix memory leak in jas_malloc.c
  Add jasper-CVE-2018-20622.patch
- bsc#1117328 CVE-2018-19543, bsc#1045450 CVE-2017-9782: Fix numchans mixup
  Add jasper-CVE-2018-19543-CVE-2017-9782.patch
- bsc#1115637 CVE-2018-19139: Fix mem leaks by registering jpc_unk_destroyparms
  Add jasper-CVE-2018-19139.patch
- bsc#1114498 CVE-2018-18873: Fix null pointer deref in ras_putdatastd
  Add jasper-CVE-2018-18873.patch
- bsc#1088278 CVE-2018-9252: Fix reachable assertion in jpc_abstorelstepsize
  Add jasper-CVE-2018-9252.patch
- bsc#1057152 CVE-2017-14132: Fix heap base overflow in by checking components
  Add jasper-CVE-2017-14132.patch</changelog>
  <changelog author="mvetter@suse.com" date="1598443200">- bsc#1010979 CVE-2016-9398: Use new fix from upstream where we
  actually check for allowed value range instead of just negating
  Add jasper-CVE-2016-9398-upstream.patch</changelog>
  <changelog author="mvetter@suse.com" date="1612785600">- bsc#1179748 CVE-2020-27828: Fix heap overflow by checking maxrlvls
  Add jasper-CVE-2020-27828.patch
- bsc#1181483 CVE-2021-3272: Fix heap overflow by ensuring number
  of channels matches image components
  Add jasper-CVE-2021-3272.patch</changelog>
  <changelog author="mvetter@suse.com" date="1643803200">- bsc#1188437 CVE-2021-27845: Fix divide-by-zery in cp_create()
  Add jasper-CVE-2021-27845.patch</changelog>
</package>
<package pkgid="84c72d6981d652b60a4dfb4c24a4cfd01d6ede112540c5cb8184e0c327ebbb94" name="libjasper-devel" arch="ppc64le">
  <version epoch="0" ver="2.0.14" rel="3.22.1"/>
  <changelog author="sbrabec@suse.com" date="1488801600">- Add -D_BSD_SOURCE to fix redefinition of system types in
  jas_config.h and breakage in ppc64le, s390 and s390x
  (bsc#1028070).</changelog>
  <changelog author="fstrba@suse.com" date="1489665600">- Added patch:
  * jasper-CVE-2016-10251.patch
  - Upstream fix for bsc#1029497, CVE-2016-10251: Use of
    uninitialized value in jpc_pi_nextcprl (jpc_t2cod.c)</changelog>
  <changelog author="fstrba@suse.com" date="1489752000">- Added patches:
  * jasper-CVE-2017-5498.patch
  - Upstream changes putting braces and belts around
    CVE-2017-5498, bsc#1020353, left-shift undefined behaviour
  * jasper-CVE-2016-9600.patch
  - Upstream fix for "Null Pointer Dereference due to missing
    check for UNKNOWN color space in JP2 encoder" (CVE-2016-9600,
    bsc#1018088)</changelog>
  <changelog author="fstrba@suse.com" date="1490184000">- Added patches:
  * jasper-CVE-2016-9583.patch
  - Out of bounds heap read in jpc_pi_nextpcrl() (bsc#1015400,
    CVE-2016-9583)
  * jasper-CVE-2017-6850.patch
  - NULL pointer dereference in jp2_cdef_destroy (jp2_cod.c)
    (bsc#1021868, CVE-2017-6850)</changelog>
  <changelog author="fstrba@suse.com" date="1490875200">- Modified patch:
  * jasper-CVE-2016-9583.patch
    + integrate upstream change
    99a50593254d1b53002719bbecfc946c84b23d27, which fixed a null
    pointer dereferencing crash.</changelog>
  <changelog author="fstrba@suse.com" date="1499774400">- Added patch:
  * jasper-CVE-2017-1000050.patch
    + Upstream fix for NULL Pointer Dereference jp2_encode
    (bsc#1047958, CVE-2017-1000050)</changelog>
  <changelog author="fstrba@suse.com" date="1499774401">- Added patch:
  * jasper-CVE-2016-9262.patch
    + Fix for Multiple overflow vulnerabilities leading to use
    after free (bsc#1009994, CVE-2016-9262)</changelog>
  <changelog author="fstrba@suse.com" date="1499860800">- Other bugs fixed by existing patches:
  * jasper-CVE-2016-9395.patch
  - bsc#1010756, CVE-2016-9394: assertion in jas_matrix_t
  * jas_seq2d_create(int, int, int, int): Assertion
    `xstart &lt;= xend &amp;&amp; ystart &lt;= yend'
  - bsc#1010757, CVE-2016-9392: pc_dec.c:1637: void
    calcstepsizes(uint_fast16_t, int, uint_fast16_t *):
    Assertion `!((expn + (numrlvls - 1) - (numrlvls - 1 -
    ((bandno &gt; 0) ? ((bandno + 2) / 3) : (0)))) &amp; (~0x1f))'
    failed.
  - bsc#1010766, CVE-2016-9393: jpc_t2cod.c:297: int
    jpc_pi_nextrpcl(jpc_pi_t *): Assertion
    `pi-&gt;prcno pirlvl-&gt;numprcs' failed.
  - bsc#1010977, CVE-2016-9395: jas_seq.c:90: jas_matrix_t
  * jas_seq2d_create(int, int, int, int): Assertion `xstart
    &lt;= xend &amp;&amp; ystart &lt;= yend' failed.
- Other bugs fixed in current version:
  * bsc#1010774, CVE-2016-9390: jas_seq.c:90: jas_matrix_t
  * jas_seq2d_create(int, int, int, int): Assertion `xstart &lt;=
    xend &amp;&amp; ystart &lt;= yend' failed.
  * bsc#1010782, CVE-2016-9391: jpc_bs.c:197: long
    jpc_bitstream_getbits(jpc_bitstream_t *, int): Assertion
    `n &gt;= 0 &amp;&amp; n &lt; 32' failed.
  * bsc#1010968, CVE-2016-9389: Assertion `((c1)-&gt;numcols_) ==
    numcols &amp;&amp; ((c2)-&gt;numcols_) == numcols' failed.
  * bsc#1010975, CVE-2016-9388: ras_dec.c:330: int
    ras_getcmap(jas_stream_t *, ras_hdr_t *, ras_cmap_t *):
    Assertion `numcolors &lt;= 256' failed.
  * bsc#1010960, CVE-2016-9387: jas_seq.c:90: jas_matrix&lt;= yend'
    failed.</changelog>
  <changelog author="fstrba@suse.com" date="1522324800">- Upgrade to 2.0.14
  * Soname and package name change libjasper1 to libjasper4
  * Security fixes:
    + CVE-2016-9557 jasper: Signed integer overflow in jas_image.c
- Removed patches:
  * jasper-1.900.1-uninitialized.patch
    + not needed any more
  * jasper-CVE-2016-10251.patch
  * jasper-CVE-2016-8654.patch
  * jasper-CVE-2016-9262.patch
  * jasper-CVE-2016-9395.patch
  * jasper-CVE-2016-9560.patch
  * jasper-CVE-2016-9583.patch
  * jasper-CVE-2016-9591.patch
  * jasper-CVE-2016-9600.patch
  * jasper-CVE-2017-1000050.patch
  * jasper-CVE-2017-5498.patch
  * jasper-CVE-2017-6850.patch
    + Fixed upstream
- Added patches:
  * 0001-jpc_cs-reject-all-but-JPC_COX_INS-and-JPC_COX_RFT.patch
    + fix assertion failure JPC_NOMINALGAIN() which can be caused
    by a crafted JP2 file.
  * 0001-Added-a-fix-from-nrusch-to-allow-JasPer-to-be-build-.patch
    + allow JasPer to be build with CMake 2.x as well as CMake 3.x.</changelog>
  <changelog author="fstrba@suse.com" date="1522324801">- Added patch:
  * jasper-CVE-2018-9055.patch
    + fix CVE-2018-9055, bsc#1087020: jasper: denial of service via
    a reachable assertion in the function jpc_firstone in
    libjasper/jpc/jpc_math.c.</changelog>
  <changelog author="mvetter@suse.com" date="1552392000">- bsc#1117511 CVE-2018-19539 Fix access violation in jas_image_readcmpt:
  * Add jasper-CVE-2018-19539.patch</changelog>
  <changelog author="mvetter@suse.com" date="1553860800">- bsc#1117505 CVE-2018-19542 Fix NULL pointer dereference jp2_decode:
  Add jasper-CVE-2018-19542.patch
- bsc#1010783 CVE-2016-9396 Fix reachable assertion in jpc_cox_getcompparms:
  * Rename 0001-jpc_cs-reject-all-but-JPC_COX_INS-and-JPC_COX_RFT.patch
  to jasper-CVE-2016-9396.patch</changelog>
  <changelog author="mvetter@suse.com" date="1559822400">- bsc#1117508 CVE-2018-19540: Fix heap based overflow in jas_icctxtdesc_input
  Add jasper-CVE-2018-19540.patch: Make sure asclen is at least 1
- bsc#1117507 CVE-2018-19541: Fix heap based overread in jas_image_depalettize
  Add jasper-CVE-2018-19541.patch: Check number of lutents</changelog>
  <changelog author="adam.majer@suse.de" date="1569844800">- jasper-CVE-2018-19541.patch: verify color palette information
  in j2 files when it's read from the file as per specifications
  of JPEG2000. (bsc#1117507)</changelog>
  <changelog author="mvetter@suse.com" date="1584446400">- bsc#1092115 CVE-2018-9154: Fix possible denial of service
  Add jasper-CVE-2018-9154.patch: dont abort in jpc_dec_process_sot()</changelog>
  <changelog author="mvetter@suse.com" date="1597320000">- bsc#1010980 CVE-2016-9399: Fix assert in calcstepsizes
  Add jasper-CVE-2016-9399.patch
- bsc#1020451 CVE-2017-5499: Validate component depth bit
  Add jasper-CVE-2017-5499.patch
- bsc#1020456 CVE-2017-5503, bsc#1020458 CVE-2017-5504, bsc#1020460 CVE-2017-5505:
  Check bounds in jas_seq2d_bindsub()
  Add jasper-CVE-2017-5503-CVE-2017-5504-CVE-2017-5505.patch</changelog>
  <changelog author="mvetter@suse.com" date="1597665600">- bsc#1120807 CVE-2018-20570: Fix heap based buffer over-read in jp2_encode
  Add jasper-CVE-2018-20570.patch
- bsc#1120805 CVE-2018-20622: Fix memory leak in jas_malloc.c
  Add jasper-CVE-2018-20622.patch
- bsc#1117328 CVE-2018-19543, bsc#1045450 CVE-2017-9782: Fix numchans mixup
  Add jasper-CVE-2018-19543-CVE-2017-9782.patch
- bsc#1115637 CVE-2018-19139: Fix mem leaks by registering jpc_unk_destroyparms
  Add jasper-CVE-2018-19139.patch
- bsc#1114498 CVE-2018-18873: Fix null pointer deref in ras_putdatastd
  Add jasper-CVE-2018-18873.patch
- bsc#1088278 CVE-2018-9252: Fix reachable assertion in jpc_abstorelstepsize
  Add jasper-CVE-2018-9252.patch
- bsc#1057152 CVE-2017-14132: Fix heap base overflow in by checking components
  Add jasper-CVE-2017-14132.patch</changelog>
  <changelog author="mvetter@suse.com" date="1598443200">- bsc#1010979 CVE-2016-9398: Use new fix from upstream where we
  actually check for allowed value range instead of just negating
  Add jasper-CVE-2016-9398-upstream.patch</changelog>
  <changelog author="mvetter@suse.com" date="1612785600">- bsc#1179748 CVE-2020-27828: Fix heap overflow by checking maxrlvls
  Add jasper-CVE-2020-27828.patch
- bsc#1181483 CVE-2021-3272: Fix heap overflow by ensuring number
  of channels matches image components
  Add jasper-CVE-2021-3272.patch</changelog>
  <changelog author="mvetter@suse.com" date="1643803200">- bsc#1188437 CVE-2021-27845: Fix divide-by-zery in cp_create()
  Add jasper-CVE-2021-27845.patch</changelog>
</package>
<package pkgid="038d43ee5c68141881c27ce2bcc07b98b2b2b71d5bc9ca2d947134255ac797eb" name="libjasper-devel" arch="s390x">
  <version epoch="0" ver="2.0.14" rel="3.22.1"/>
  <changelog author="sbrabec@suse.com" date="1488801600">- Add -D_BSD_SOURCE to fix redefinition of system types in
  jas_config.h and breakage in ppc64le, s390 and s390x
  (bsc#1028070).</changelog>
  <changelog author="fstrba@suse.com" date="1489665600">- Added patch:
  * jasper-CVE-2016-10251.patch
  - Upstream fix for bsc#1029497, CVE-2016-10251: Use of
    uninitialized value in jpc_pi_nextcprl (jpc_t2cod.c)</changelog>
  <changelog author="fstrba@suse.com" date="1489752000">- Added patches:
  * jasper-CVE-2017-5498.patch
  - Upstream changes putting braces and belts around
    CVE-2017-5498, bsc#1020353, left-shift undefined behaviour
  * jasper-CVE-2016-9600.patch
  - Upstream fix for "Null Pointer Dereference due to missing
    check for UNKNOWN color space in JP2 encoder" (CVE-2016-9600,
    bsc#1018088)</changelog>
  <changelog author="fstrba@suse.com" date="1490184000">- Added patches:
  * jasper-CVE-2016-9583.patch
  - Out of bounds heap read in jpc_pi_nextpcrl() (bsc#1015400,
    CVE-2016-9583)
  * jasper-CVE-2017-6850.patch
  - NULL pointer dereference in jp2_cdef_destroy (jp2_cod.c)
    (bsc#1021868, CVE-2017-6850)</changelog>
  <changelog author="fstrba@suse.com" date="1490875200">- Modified patch:
  * jasper-CVE-2016-9583.patch
    + integrate upstream change
    99a50593254d1b53002719bbecfc946c84b23d27, which fixed a null
    pointer dereferencing crash.</changelog>
  <changelog author="fstrba@suse.com" date="1499774400">- Added patch:
  * jasper-CVE-2017-1000050.patch
    + Upstream fix for NULL Pointer Dereference jp2_encode
    (bsc#1047958, CVE-2017-1000050)</changelog>
  <changelog author="fstrba@suse.com" date="1499774401">- Added patch:
  * jasper-CVE-2016-9262.patch
    + Fix for Multiple overflow vulnerabilities leading to use
    after free (bsc#1009994, CVE-2016-9262)</changelog>
  <changelog author="fstrba@suse.com" date="1499860800">- Other bugs fixed by existing patches:
  * jasper-CVE-2016-9395.patch
  - bsc#1010756, CVE-2016-9394: assertion in jas_matrix_t
  * jas_seq2d_create(int, int, int, int): Assertion
    `xstart &lt;= xend &amp;&amp; ystart &lt;= yend'
  - bsc#1010757, CVE-2016-9392: pc_dec.c:1637: void
    calcstepsizes(uint_fast16_t, int, uint_fast16_t *):
    Assertion `!((expn + (numrlvls - 1) - (numrlvls - 1 -
    ((bandno &gt; 0) ? ((bandno + 2) / 3) : (0)))) &amp; (~0x1f))'
    failed.
  - bsc#1010766, CVE-2016-9393: jpc_t2cod.c:297: int
    jpc_pi_nextrpcl(jpc_pi_t *): Assertion
    `pi-&gt;prcno pirlvl-&gt;numprcs' failed.
  - bsc#1010977, CVE-2016-9395: jas_seq.c:90: jas_matrix_t
  * jas_seq2d_create(int, int, int, int): Assertion `xstart
    &lt;= xend &amp;&amp; ystart &lt;= yend' failed.
- Other bugs fixed in current version:
  * bsc#1010774, CVE-2016-9390: jas_seq.c:90: jas_matrix_t
  * jas_seq2d_create(int, int, int, int): Assertion `xstart &lt;=
    xend &amp;&amp; ystart &lt;= yend' failed.
  * bsc#1010782, CVE-2016-9391: jpc_bs.c:197: long
    jpc_bitstream_getbits(jpc_bitstream_t *, int): Assertion
    `n &gt;= 0 &amp;&amp; n &lt; 32' failed.
  * bsc#1010968, CVE-2016-9389: Assertion `((c1)-&gt;numcols_) ==
    numcols &amp;&amp; ((c2)-&gt;numcols_) == numcols' failed.
  * bsc#1010975, CVE-2016-9388: ras_dec.c:330: int
    ras_getcmap(jas_stream_t *, ras_hdr_t *, ras_cmap_t *):
    Assertion `numcolors &lt;= 256' failed.
  * bsc#1010960, CVE-2016-9387: jas_seq.c:90: jas_matrix&lt;= yend'
    failed.</changelog>
  <changelog author="fstrba@suse.com" date="1522324800">- Upgrade to 2.0.14
  * Soname and package name change libjasper1 to libjasper4
  * Security fixes:
    + CVE-2016-9557 jasper: Signed integer overflow in jas_image.c
- Removed patches:
  * jasper-1.900.1-uninitialized.patch
    + not needed any more
  * jasper-CVE-2016-10251.patch
  * jasper-CVE-2016-8654.patch
  * jasper-CVE-2016-9262.patch
  * jasper-CVE-2016-9395.patch
  * jasper-CVE-2016-9560.patch
  * jasper-CVE-2016-9583.patch
  * jasper-CVE-2016-9591.patch
  * jasper-CVE-2016-9600.patch
  * jasper-CVE-2017-1000050.patch
  * jasper-CVE-2017-5498.patch
  * jasper-CVE-2017-6850.patch
    + Fixed upstream
- Added patches:
  * 0001-jpc_cs-reject-all-but-JPC_COX_INS-and-JPC_COX_RFT.patch
    + fix assertion failure JPC_NOMINALGAIN() which can be caused
    by a crafted JP2 file.
  * 0001-Added-a-fix-from-nrusch-to-allow-JasPer-to-be-build-.patch
    + allow JasPer to be build with CMake 2.x as well as CMake 3.x.</changelog>
  <changelog author="fstrba@suse.com" date="1522324801">- Added patch:
  * jasper-CVE-2018-9055.patch
    + fix CVE-2018-9055, bsc#1087020: jasper: denial of service via
    a reachable assertion in the function jpc_firstone in
    libjasper/jpc/jpc_math.c.</changelog>
  <changelog author="mvetter@suse.com" date="1552392000">- bsc#1117511 CVE-2018-19539 Fix access violation in jas_image_readcmpt:
  * Add jasper-CVE-2018-19539.patch</changelog>
  <changelog author="mvetter@suse.com" date="1553860800">- bsc#1117505 CVE-2018-19542 Fix NULL pointer dereference jp2_decode:
  Add jasper-CVE-2018-19542.patch
- bsc#1010783 CVE-2016-9396 Fix reachable assertion in jpc_cox_getcompparms:
  * Rename 0001-jpc_cs-reject-all-but-JPC_COX_INS-and-JPC_COX_RFT.patch
  to jasper-CVE-2016-9396.patch</changelog>
  <changelog author="mvetter@suse.com" date="1559822400">- bsc#1117508 CVE-2018-19540: Fix heap based overflow in jas_icctxtdesc_input
  Add jasper-CVE-2018-19540.patch: Make sure asclen is at least 1
- bsc#1117507 CVE-2018-19541: Fix heap based overread in jas_image_depalettize
  Add jasper-CVE-2018-19541.patch: Check number of lutents</changelog>
  <changelog author="adam.majer@suse.de" date="1569844800">- jasper-CVE-2018-19541.patch: verify color palette information
  in j2 files when it's read from the file as per specifications
  of JPEG2000. (bsc#1117507)</changelog>
  <changelog author="mvetter@suse.com" date="1584446400">- bsc#1092115 CVE-2018-9154: Fix possible denial of service
  Add jasper-CVE-2018-9154.patch: dont abort in jpc_dec_process_sot()</changelog>
  <changelog author="mvetter@suse.com" date="1597320000">- bsc#1010980 CVE-2016-9399: Fix assert in calcstepsizes
  Add jasper-CVE-2016-9399.patch
- bsc#1020451 CVE-2017-5499: Validate component depth bit
  Add jasper-CVE-2017-5499.patch
- bsc#1020456 CVE-2017-5503, bsc#1020458 CVE-2017-5504, bsc#1020460 CVE-2017-5505:
  Check bounds in jas_seq2d_bindsub()
  Add jasper-CVE-2017-5503-CVE-2017-5504-CVE-2017-5505.patch</changelog>
  <changelog author="mvetter@suse.com" date="1597665600">- bsc#1120807 CVE-2018-20570: Fix heap based buffer over-read in jp2_encode
  Add jasper-CVE-2018-20570.patch
- bsc#1120805 CVE-2018-20622: Fix memory leak in jas_malloc.c
  Add jasper-CVE-2018-20622.patch
- bsc#1117328 CVE-2018-19543, bsc#1045450 CVE-2017-9782: Fix numchans mixup
  Add jasper-CVE-2018-19543-CVE-2017-9782.patch
- bsc#1115637 CVE-2018-19139: Fix mem leaks by registering jpc_unk_destroyparms
  Add jasper-CVE-2018-19139.patch
- bsc#1114498 CVE-2018-18873: Fix null pointer deref in ras_putdatastd
  Add jasper-CVE-2018-18873.patch
- bsc#1088278 CVE-2018-9252: Fix reachable assertion in jpc_abstorelstepsize
  Add jasper-CVE-2018-9252.patch
- bsc#1057152 CVE-2017-14132: Fix heap base overflow in by checking components
  Add jasper-CVE-2017-14132.patch</changelog>
  <changelog author="mvetter@suse.com" date="1598443200">- bsc#1010979 CVE-2016-9398: Use new fix from upstream where we
  actually check for allowed value range instead of just negating
  Add jasper-CVE-2016-9398-upstream.patch</changelog>
  <changelog author="mvetter@suse.com" date="1612785600">- bsc#1179748 CVE-2020-27828: Fix heap overflow by checking maxrlvls
  Add jasper-CVE-2020-27828.patch
- bsc#1181483 CVE-2021-3272: Fix heap overflow by ensuring number
  of channels matches image components
  Add jasper-CVE-2021-3272.patch</changelog>
  <changelog author="mvetter@suse.com" date="1643803200">- bsc#1188437 CVE-2021-27845: Fix divide-by-zery in cp_create()
  Add jasper-CVE-2021-27845.patch</changelog>
</package>
<package pkgid="c0f66053f323b67d926b2cbc1f0095b6469662feac01e8e6513ca11d3fd2efc0" name="libjasper-devel" arch="x86_64">
  <version epoch="0" ver="2.0.14" rel="3.22.1"/>
  <changelog author="sbrabec@suse.com" date="1488801600">- Add -D_BSD_SOURCE to fix redefinition of system types in
  jas_config.h and breakage in ppc64le, s390 and s390x
  (bsc#1028070).</changelog>
  <changelog author="fstrba@suse.com" date="1489665600">- Added patch:
  * jasper-CVE-2016-10251.patch
  - Upstream fix for bsc#1029497, CVE-2016-10251: Use of
    uninitialized value in jpc_pi_nextcprl (jpc_t2cod.c)</changelog>
  <changelog author="fstrba@suse.com" date="1489752000">- Added patches:
  * jasper-CVE-2017-5498.patch
  - Upstream changes putting braces and belts around
    CVE-2017-5498, bsc#1020353, left-shift undefined behaviour
  * jasper-CVE-2016-9600.patch
  - Upstream fix for "Null Pointer Dereference due to missing
    check for UNKNOWN color space in JP2 encoder" (CVE-2016-9600,
    bsc#1018088)</changelog>
  <changelog author="fstrba@suse.com" date="1490184000">- Added patches:
  * jasper-CVE-2016-9583.patch
  - Out of bounds heap read in jpc_pi_nextpcrl() (bsc#1015400,
    CVE-2016-9583)
  * jasper-CVE-2017-6850.patch
  - NULL pointer dereference in jp2_cdef_destroy (jp2_cod.c)
    (bsc#1021868, CVE-2017-6850)</changelog>
  <changelog author="fstrba@suse.com" date="1490875200">- Modified patch:
  * jasper-CVE-2016-9583.patch
    + integrate upstream change
    99a50593254d1b53002719bbecfc946c84b23d27, which fixed a null
    pointer dereferencing crash.</changelog>
  <changelog author="fstrba@suse.com" date="1499774400">- Added patch:
  * jasper-CVE-2017-1000050.patch
    + Upstream fix for NULL Pointer Dereference jp2_encode
    (bsc#1047958, CVE-2017-1000050)</changelog>
  <changelog author="fstrba@suse.com" date="1499774401">- Added patch:
  * jasper-CVE-2016-9262.patch
    + Fix for Multiple overflow vulnerabilities leading to use
    after free (bsc#1009994, CVE-2016-9262)</changelog>
  <changelog author="fstrba@suse.com" date="1499860800">- Other bugs fixed by existing patches:
  * jasper-CVE-2016-9395.patch
  - bsc#1010756, CVE-2016-9394: assertion in jas_matrix_t
  * jas_seq2d_create(int, int, int, int): Assertion
    `xstart &lt;= xend &amp;&amp; ystart &lt;= yend'
  - bsc#1010757, CVE-2016-9392: pc_dec.c:1637: void
    calcstepsizes(uint_fast16_t, int, uint_fast16_t *):
    Assertion `!((expn + (numrlvls - 1) - (numrlvls - 1 -
    ((bandno &gt; 0) ? ((bandno + 2) / 3) : (0)))) &amp; (~0x1f))'
    failed.
  - bsc#1010766, CVE-2016-9393: jpc_t2cod.c:297: int
    jpc_pi_nextrpcl(jpc_pi_t *): Assertion
    `pi-&gt;prcno pirlvl-&gt;numprcs' failed.
  - bsc#1010977, CVE-2016-9395: jas_seq.c:90: jas_matrix_t
  * jas_seq2d_create(int, int, int, int): Assertion `xstart
    &lt;= xend &amp;&amp; ystart &lt;= yend' failed.
- Other bugs fixed in current version:
  * bsc#1010774, CVE-2016-9390: jas_seq.c:90: jas_matrix_t
  * jas_seq2d_create(int, int, int, int): Assertion `xstart &lt;=
    xend &amp;&amp; ystart &lt;= yend' failed.
  * bsc#1010782, CVE-2016-9391: jpc_bs.c:197: long
    jpc_bitstream_getbits(jpc_bitstream_t *, int): Assertion
    `n &gt;= 0 &amp;&amp; n &lt; 32' failed.
  * bsc#1010968, CVE-2016-9389: Assertion `((c1)-&gt;numcols_) ==
    numcols &amp;&amp; ((c2)-&gt;numcols_) == numcols' failed.
  * bsc#1010975, CVE-2016-9388: ras_dec.c:330: int
    ras_getcmap(jas_stream_t *, ras_hdr_t *, ras_cmap_t *):
    Assertion `numcolors &lt;= 256' failed.
  * bsc#1010960, CVE-2016-9387: jas_seq.c:90: jas_matrix&lt;= yend'
    failed.</changelog>
  <changelog author="fstrba@suse.com" date="1522324800">- Upgrade to 2.0.14
  * Soname and package name change libjasper1 to libjasper4
  * Security fixes:
    + CVE-2016-9557 jasper: Signed integer overflow in jas_image.c
- Removed patches:
  * jasper-1.900.1-uninitialized.patch
    + not needed any more
  * jasper-CVE-2016-10251.patch
  * jasper-CVE-2016-8654.patch
  * jasper-CVE-2016-9262.patch
  * jasper-CVE-2016-9395.patch
  * jasper-CVE-2016-9560.patch
  * jasper-CVE-2016-9583.patch
  * jasper-CVE-2016-9591.patch
  * jasper-CVE-2016-9600.patch
  * jasper-CVE-2017-1000050.patch
  * jasper-CVE-2017-5498.patch
  * jasper-CVE-2017-6850.patch
    + Fixed upstream
- Added patches:
  * 0001-jpc_cs-reject-all-but-JPC_COX_INS-and-JPC_COX_RFT.patch
    + fix assertion failure JPC_NOMINALGAIN() which can be caused
    by a crafted JP2 file.
  * 0001-Added-a-fix-from-nrusch-to-allow-JasPer-to-be-build-.patch
    + allow JasPer to be build with CMake 2.x as well as CMake 3.x.</changelog>
  <changelog author="fstrba@suse.com" date="1522324801">- Added patch:
  * jasper-CVE-2018-9055.patch
    + fix CVE-2018-9055, bsc#1087020: jasper: denial of service via
    a reachable assertion in the function jpc_firstone in
    libjasper/jpc/jpc_math.c.</changelog>
  <changelog author="mvetter@suse.com" date="1552392000">- bsc#1117511 CVE-2018-19539 Fix access violation in jas_image_readcmpt:
  * Add jasper-CVE-2018-19539.patch</changelog>
  <changelog author="mvetter@suse.com" date="1553860800">- bsc#1117505 CVE-2018-19542 Fix NULL pointer dereference jp2_decode:
  Add jasper-CVE-2018-19542.patch
- bsc#1010783 CVE-2016-9396 Fix reachable assertion in jpc_cox_getcompparms:
  * Rename 0001-jpc_cs-reject-all-but-JPC_COX_INS-and-JPC_COX_RFT.patch
  to jasper-CVE-2016-9396.patch</changelog>
  <changelog author="mvetter@suse.com" date="1559822400">- bsc#1117508 CVE-2018-19540: Fix heap based overflow in jas_icctxtdesc_input
  Add jasper-CVE-2018-19540.patch: Make sure asclen is at least 1
- bsc#1117507 CVE-2018-19541: Fix heap based overread in jas_image_depalettize
  Add jasper-CVE-2018-19541.patch: Check number of lutents</changelog>
  <changelog author="adam.majer@suse.de" date="1569844800">- jasper-CVE-2018-19541.patch: verify color palette information
  in j2 files when it's read from the file as per specifications
  of JPEG2000. (bsc#1117507)</changelog>
  <changelog author="mvetter@suse.com" date="1584446400">- bsc#1092115 CVE-2018-9154: Fix possible denial of service
  Add jasper-CVE-2018-9154.patch: dont abort in jpc_dec_process_sot()</changelog>
  <changelog author="mvetter@suse.com" date="1597320000">- bsc#1010980 CVE-2016-9399: Fix assert in calcstepsizes
  Add jasper-CVE-2016-9399.patch
- bsc#1020451 CVE-2017-5499: Validate component depth bit
  Add jasper-CVE-2017-5499.patch
- bsc#1020456 CVE-2017-5503, bsc#1020458 CVE-2017-5504, bsc#1020460 CVE-2017-5505:
  Check bounds in jas_seq2d_bindsub()
  Add jasper-CVE-2017-5503-CVE-2017-5504-CVE-2017-5505.patch</changelog>
  <changelog author="mvetter@suse.com" date="1597665600">- bsc#1120807 CVE-2018-20570: Fix heap based buffer over-read in jp2_encode
  Add jasper-CVE-2018-20570.patch
- bsc#1120805 CVE-2018-20622: Fix memory leak in jas_malloc.c
  Add jasper-CVE-2018-20622.patch
- bsc#1117328 CVE-2018-19543, bsc#1045450 CVE-2017-9782: Fix numchans mixup
  Add jasper-CVE-2018-19543-CVE-2017-9782.patch
- bsc#1115637 CVE-2018-19139: Fix mem leaks by registering jpc_unk_destroyparms
  Add jasper-CVE-2018-19139.patch
- bsc#1114498 CVE-2018-18873: Fix null pointer deref in ras_putdatastd
  Add jasper-CVE-2018-18873.patch
- bsc#1088278 CVE-2018-9252: Fix reachable assertion in jpc_abstorelstepsize
  Add jasper-CVE-2018-9252.patch
- bsc#1057152 CVE-2017-14132: Fix heap base overflow in by checking components
  Add jasper-CVE-2017-14132.patch</changelog>
  <changelog author="mvetter@suse.com" date="1598443200">- bsc#1010979 CVE-2016-9398: Use new fix from upstream where we
  actually check for allowed value range instead of just negating
  Add jasper-CVE-2016-9398-upstream.patch</changelog>
  <changelog author="mvetter@suse.com" date="1612785600">- bsc#1179748 CVE-2020-27828: Fix heap overflow by checking maxrlvls
  Add jasper-CVE-2020-27828.patch
- bsc#1181483 CVE-2021-3272: Fix heap overflow by ensuring number
  of channels matches image components
  Add jasper-CVE-2021-3272.patch</changelog>
  <changelog author="mvetter@suse.com" date="1643803200">- bsc#1188437 CVE-2021-27845: Fix divide-by-zery in cp_create()
  Add jasper-CVE-2021-27845.patch</changelog>
</package>
<package pkgid="78d6eb3a4b0057747d3197fb07beca92872dcf907bc660e2113acdbd04ef5f48" name="libjasper4" arch="aarch64">
  <version epoch="0" ver="2.0.14" rel="3.22.1"/>
  <changelog author="sbrabec@suse.com" date="1488801600">- Add -D_BSD_SOURCE to fix redefinition of system types in
  jas_config.h and breakage in ppc64le, s390 and s390x
  (bsc#1028070).</changelog>
  <changelog author="fstrba@suse.com" date="1489665600">- Added patch:
  * jasper-CVE-2016-10251.patch
  - Upstream fix for bsc#1029497, CVE-2016-10251: Use of
    uninitialized value in jpc_pi_nextcprl (jpc_t2cod.c)</changelog>
  <changelog author="fstrba@suse.com" date="1489752000">- Added patches:
  * jasper-CVE-2017-5498.patch
  - Upstream changes putting braces and belts around
    CVE-2017-5498, bsc#1020353, left-shift undefined behaviour
  * jasper-CVE-2016-9600.patch
  - Upstream fix for "Null Pointer Dereference due to missing
    check for UNKNOWN color space in JP2 encoder" (CVE-2016-9600,
    bsc#1018088)</changelog>
  <changelog author="fstrba@suse.com" date="1490184000">- Added patches:
  * jasper-CVE-2016-9583.patch
  - Out of bounds heap read in jpc_pi_nextpcrl() (bsc#1015400,
    CVE-2016-9583)
  * jasper-CVE-2017-6850.patch
  - NULL pointer dereference in jp2_cdef_destroy (jp2_cod.c)
    (bsc#1021868, CVE-2017-6850)</changelog>
  <changelog author="fstrba@suse.com" date="1490875200">- Modified patch:
  * jasper-CVE-2016-9583.patch
    + integrate upstream change
    99a50593254d1b53002719bbecfc946c84b23d27, which fixed a null
    pointer dereferencing crash.</changelog>
  <changelog author="fstrba@suse.com" date="1499774400">- Added patch:
  * jasper-CVE-2017-1000050.patch
    + Upstream fix for NULL Pointer Dereference jp2_encode
    (bsc#1047958, CVE-2017-1000050)</changelog>
  <changelog author="fstrba@suse.com" date="1499774401">- Added patch:
  * jasper-CVE-2016-9262.patch
    + Fix for Multiple overflow vulnerabilities leading to use
    after free (bsc#1009994, CVE-2016-9262)</changelog>
  <changelog author="fstrba@suse.com" date="1499860800">- Other bugs fixed by existing patches:
  * jasper-CVE-2016-9395.patch
  - bsc#1010756, CVE-2016-9394: assertion in jas_matrix_t
  * jas_seq2d_create(int, int, int, int): Assertion
    `xstart &lt;= xend &amp;&amp; ystart &lt;= yend'
  - bsc#1010757, CVE-2016-9392: pc_dec.c:1637: void
    calcstepsizes(uint_fast16_t, int, uint_fast16_t *):
    Assertion `!((expn + (numrlvls - 1) - (numrlvls - 1 -
    ((bandno &gt; 0) ? ((bandno + 2) / 3) : (0)))) &amp; (~0x1f))'
    failed.
  - bsc#1010766, CVE-2016-9393: jpc_t2cod.c:297: int
    jpc_pi_nextrpcl(jpc_pi_t *): Assertion
    `pi-&gt;prcno pirlvl-&gt;numprcs' failed.
  - bsc#1010977, CVE-2016-9395: jas_seq.c:90: jas_matrix_t
  * jas_seq2d_create(int, int, int, int): Assertion `xstart
    &lt;= xend &amp;&amp; ystart &lt;= yend' failed.
- Other bugs fixed in current version:
  * bsc#1010774, CVE-2016-9390: jas_seq.c:90: jas_matrix_t
  * jas_seq2d_create(int, int, int, int): Assertion `xstart &lt;=
    xend &amp;&amp; ystart &lt;= yend' failed.
  * bsc#1010782, CVE-2016-9391: jpc_bs.c:197: long
    jpc_bitstream_getbits(jpc_bitstream_t *, int): Assertion
    `n &gt;= 0 &amp;&amp; n &lt; 32' failed.
  * bsc#1010968, CVE-2016-9389: Assertion `((c1)-&gt;numcols_) ==
    numcols &amp;&amp; ((c2)-&gt;numcols_) == numcols' failed.
  * bsc#1010975, CVE-2016-9388: ras_dec.c:330: int
    ras_getcmap(jas_stream_t *, ras_hdr_t *, ras_cmap_t *):
    Assertion `numcolors &lt;= 256' failed.
  * bsc#1010960, CVE-2016-9387: jas_seq.c:90: jas_matrix&lt;= yend'
    failed.</changelog>
  <changelog author="fstrba@suse.com" date="1522324800">- Upgrade to 2.0.14
  * Soname and package name change libjasper1 to libjasper4
  * Security fixes:
    + CVE-2016-9557 jasper: Signed integer overflow in jas_image.c
- Removed patches:
  * jasper-1.900.1-uninitialized.patch
    + not needed any more
  * jasper-CVE-2016-10251.patch
  * jasper-CVE-2016-8654.patch
  * jasper-CVE-2016-9262.patch
  * jasper-CVE-2016-9395.patch
  * jasper-CVE-2016-9560.patch
  * jasper-CVE-2016-9583.patch
  * jasper-CVE-2016-9591.patch
  * jasper-CVE-2016-9600.patch
  * jasper-CVE-2017-1000050.patch
  * jasper-CVE-2017-5498.patch
  * jasper-CVE-2017-6850.patch
    + Fixed upstream
- Added patches:
  * 0001-jpc_cs-reject-all-but-JPC_COX_INS-and-JPC_COX_RFT.patch
    + fix assertion failure JPC_NOMINALGAIN() which can be caused
    by a crafted JP2 file.
  * 0001-Added-a-fix-from-nrusch-to-allow-JasPer-to-be-build-.patch
    + allow JasPer to be build with CMake 2.x as well as CMake 3.x.</changelog>
  <changelog author="fstrba@suse.com" date="1522324801">- Added patch:
  * jasper-CVE-2018-9055.patch
    + fix CVE-2018-9055, bsc#1087020: jasper: denial of service via
    a reachable assertion in the function jpc_firstone in
    libjasper/jpc/jpc_math.c.</changelog>
  <changelog author="mvetter@suse.com" date="1552392000">- bsc#1117511 CVE-2018-19539 Fix access violation in jas_image_readcmpt:
  * Add jasper-CVE-2018-19539.patch</changelog>
  <changelog author="mvetter@suse.com" date="1553860800">- bsc#1117505 CVE-2018-19542 Fix NULL pointer dereference jp2_decode:
  Add jasper-CVE-2018-19542.patch
- bsc#1010783 CVE-2016-9396 Fix reachable assertion in jpc_cox_getcompparms:
  * Rename 0001-jpc_cs-reject-all-but-JPC_COX_INS-and-JPC_COX_RFT.patch
  to jasper-CVE-2016-9396.patch</changelog>
  <changelog author="mvetter@suse.com" date="1559822400">- bsc#1117508 CVE-2018-19540: Fix heap based overflow in jas_icctxtdesc_input
  Add jasper-CVE-2018-19540.patch: Make sure asclen is at least 1
- bsc#1117507 CVE-2018-19541: Fix heap based overread in jas_image_depalettize
  Add jasper-CVE-2018-19541.patch: Check number of lutents</changelog>
  <changelog author="adam.majer@suse.de" date="1569844800">- jasper-CVE-2018-19541.patch: verify color palette information
  in j2 files when it's read from the file as per specifications
  of JPEG2000. (bsc#1117507)</changelog>
  <changelog author="mvetter@suse.com" date="1584446400">- bsc#1092115 CVE-2018-9154: Fix possible denial of service
  Add jasper-CVE-2018-9154.patch: dont abort in jpc_dec_process_sot()</changelog>
  <changelog author="mvetter@suse.com" date="1597320000">- bsc#1010980 CVE-2016-9399: Fix assert in calcstepsizes
  Add jasper-CVE-2016-9399.patch
- bsc#1020451 CVE-2017-5499: Validate component depth bit
  Add jasper-CVE-2017-5499.patch
- bsc#1020456 CVE-2017-5503, bsc#1020458 CVE-2017-5504, bsc#1020460 CVE-2017-5505:
  Check bounds in jas_seq2d_bindsub()
  Add jasper-CVE-2017-5503-CVE-2017-5504-CVE-2017-5505.patch</changelog>
  <changelog author="mvetter@suse.com" date="1597665600">- bsc#1120807 CVE-2018-20570: Fix heap based buffer over-read in jp2_encode
  Add jasper-CVE-2018-20570.patch
- bsc#1120805 CVE-2018-20622: Fix memory leak in jas_malloc.c
  Add jasper-CVE-2018-20622.patch
- bsc#1117328 CVE-2018-19543, bsc#1045450 CVE-2017-9782: Fix numchans mixup
  Add jasper-CVE-2018-19543-CVE-2017-9782.patch
- bsc#1115637 CVE-2018-19139: Fix mem leaks by registering jpc_unk_destroyparms
  Add jasper-CVE-2018-19139.patch
- bsc#1114498 CVE-2018-18873: Fix null pointer deref in ras_putdatastd
  Add jasper-CVE-2018-18873.patch
- bsc#1088278 CVE-2018-9252: Fix reachable assertion in jpc_abstorelstepsize
  Add jasper-CVE-2018-9252.patch
- bsc#1057152 CVE-2017-14132: Fix heap base overflow in by checking components
  Add jasper-CVE-2017-14132.patch</changelog>
  <changelog author="mvetter@suse.com" date="1598443200">- bsc#1010979 CVE-2016-9398: Use new fix from upstream where we
  actually check for allowed value range instead of just negating
  Add jasper-CVE-2016-9398-upstream.patch</changelog>
  <changelog author="mvetter@suse.com" date="1612785600">- bsc#1179748 CVE-2020-27828: Fix heap overflow by checking maxrlvls
  Add jasper-CVE-2020-27828.patch
- bsc#1181483 CVE-2021-3272: Fix heap overflow by ensuring number
  of channels matches image components
  Add jasper-CVE-2021-3272.patch</changelog>
  <changelog author="mvetter@suse.com" date="1643803200">- bsc#1188437 CVE-2021-27845: Fix divide-by-zery in cp_create()
  Add jasper-CVE-2021-27845.patch</changelog>
</package>
<package pkgid="8d57af1184123924e40b3990635a0ed4b8535ff56c00332c3e55ce5958326fd4" name="libjasper4" arch="ppc64le">
  <version epoch="0" ver="2.0.14" rel="3.22.1"/>
  <changelog author="sbrabec@suse.com" date="1488801600">- Add -D_BSD_SOURCE to fix redefinition of system types in
  jas_config.h and breakage in ppc64le, s390 and s390x
  (bsc#1028070).</changelog>
  <changelog author="fstrba@suse.com" date="1489665600">- Added patch:
  * jasper-CVE-2016-10251.patch
  - Upstream fix for bsc#1029497, CVE-2016-10251: Use of
    uninitialized value in jpc_pi_nextcprl (jpc_t2cod.c)</changelog>
  <changelog author="fstrba@suse.com" date="1489752000">- Added patches:
  * jasper-CVE-2017-5498.patch
  - Upstream changes putting braces and belts around
    CVE-2017-5498, bsc#1020353, left-shift undefined behaviour
  * jasper-CVE-2016-9600.patch
  - Upstream fix for "Null Pointer Dereference due to missing
    check for UNKNOWN color space in JP2 encoder" (CVE-2016-9600,
    bsc#1018088)</changelog>
  <changelog author="fstrba@suse.com" date="1490184000">- Added patches:
  * jasper-CVE-2016-9583.patch
  - Out of bounds heap read in jpc_pi_nextpcrl() (bsc#1015400,
    CVE-2016-9583)
  * jasper-CVE-2017-6850.patch
  - NULL pointer dereference in jp2_cdef_destroy (jp2_cod.c)
    (bsc#1021868, CVE-2017-6850)</changelog>
  <changelog author="fstrba@suse.com" date="1490875200">- Modified patch:
  * jasper-CVE-2016-9583.patch
    + integrate upstream change
    99a50593254d1b53002719bbecfc946c84b23d27, which fixed a null
    pointer dereferencing crash.</changelog>
  <changelog author="fstrba@suse.com" date="1499774400">- Added patch:
  * jasper-CVE-2017-1000050.patch
    + Upstream fix for NULL Pointer Dereference jp2_encode
    (bsc#1047958, CVE-2017-1000050)</changelog>
  <changelog author="fstrba@suse.com" date="1499774401">- Added patch:
  * jasper-CVE-2016-9262.patch
    + Fix for Multiple overflow vulnerabilities leading to use
    after free (bsc#1009994, CVE-2016-9262)</changelog>
  <changelog author="fstrba@suse.com" date="1499860800">- Other bugs fixed by existing patches:
  * jasper-CVE-2016-9395.patch
  - bsc#1010756, CVE-2016-9394: assertion in jas_matrix_t
  * jas_seq2d_create(int, int, int, int): Assertion
    `xstart &lt;= xend &amp;&amp; ystart &lt;= yend'
  - bsc#1010757, CVE-2016-9392: pc_dec.c:1637: void
    calcstepsizes(uint_fast16_t, int, uint_fast16_t *):
    Assertion `!((expn + (numrlvls - 1) - (numrlvls - 1 -
    ((bandno &gt; 0) ? ((bandno + 2) / 3) : (0)))) &amp; (~0x1f))'
    failed.
  - bsc#1010766, CVE-2016-9393: jpc_t2cod.c:297: int
    jpc_pi_nextrpcl(jpc_pi_t *): Assertion
    `pi-&gt;prcno pirlvl-&gt;numprcs' failed.
  - bsc#1010977, CVE-2016-9395: jas_seq.c:90: jas_matrix_t
  * jas_seq2d_create(int, int, int, int): Assertion `xstart
    &lt;= xend &amp;&amp; ystart &lt;= yend' failed.
- Other bugs fixed in current version:
  * bsc#1010774, CVE-2016-9390: jas_seq.c:90: jas_matrix_t
  * jas_seq2d_create(int, int, int, int): Assertion `xstart &lt;=
    xend &amp;&amp; ystart &lt;= yend' failed.
  * bsc#1010782, CVE-2016-9391: jpc_bs.c:197: long
    jpc_bitstream_getbits(jpc_bitstream_t *, int): Assertion
    `n &gt;= 0 &amp;&amp; n &lt; 32' failed.
  * bsc#1010968, CVE-2016-9389: Assertion `((c1)-&gt;numcols_) ==
    numcols &amp;&amp; ((c2)-&gt;numcols_) == numcols' failed.
  * bsc#1010975, CVE-2016-9388: ras_dec.c:330: int
    ras_getcmap(jas_stream_t *, ras_hdr_t *, ras_cmap_t *):
    Assertion `numcolors &lt;= 256' failed.
  * bsc#1010960, CVE-2016-9387: jas_seq.c:90: jas_matrix&lt;= yend'
    failed.</changelog>
  <changelog author="fstrba@suse.com" date="1522324800">- Upgrade to 2.0.14
  * Soname and package name change libjasper1 to libjasper4
  * Security fixes:
    + CVE-2016-9557 jasper: Signed integer overflow in jas_image.c
- Removed patches:
  * jasper-1.900.1-uninitialized.patch
    + not needed any more
  * jasper-CVE-2016-10251.patch
  * jasper-CVE-2016-8654.patch
  * jasper-CVE-2016-9262.patch
  * jasper-CVE-2016-9395.patch
  * jasper-CVE-2016-9560.patch
  * jasper-CVE-2016-9583.patch
  * jasper-CVE-2016-9591.patch
  * jasper-CVE-2016-9600.patch
  * jasper-CVE-2017-1000050.patch
  * jasper-CVE-2017-5498.patch
  * jasper-CVE-2017-6850.patch
    + Fixed upstream
- Added patches:
  * 0001-jpc_cs-reject-all-but-JPC_COX_INS-and-JPC_COX_RFT.patch
    + fix assertion failure JPC_NOMINALGAIN() which can be caused
    by a crafted JP2 file.
  * 0001-Added-a-fix-from-nrusch-to-allow-JasPer-to-be-build-.patch
    + allow JasPer to be build with CMake 2.x as well as CMake 3.x.</changelog>
  <changelog author="fstrba@suse.com" date="1522324801">- Added patch:
  * jasper-CVE-2018-9055.patch
    + fix CVE-2018-9055, bsc#1087020: jasper: denial of service via
    a reachable assertion in the function jpc_firstone in
    libjasper/jpc/jpc_math.c.</changelog>
  <changelog author="mvetter@suse.com" date="1552392000">- bsc#1117511 CVE-2018-19539 Fix access violation in jas_image_readcmpt:
  * Add jasper-CVE-2018-19539.patch</changelog>
  <changelog author="mvetter@suse.com" date="1553860800">- bsc#1117505 CVE-2018-19542 Fix NULL pointer dereference jp2_decode:
  Add jasper-CVE-2018-19542.patch
- bsc#1010783 CVE-2016-9396 Fix reachable assertion in jpc_cox_getcompparms:
  * Rename 0001-jpc_cs-reject-all-but-JPC_COX_INS-and-JPC_COX_RFT.patch
  to jasper-CVE-2016-9396.patch</changelog>
  <changelog author="mvetter@suse.com" date="1559822400">- bsc#1117508 CVE-2018-19540: Fix heap based overflow in jas_icctxtdesc_input
  Add jasper-CVE-2018-19540.patch: Make sure asclen is at least 1
- bsc#1117507 CVE-2018-19541: Fix heap based overread in jas_image_depalettize
  Add jasper-CVE-2018-19541.patch: Check number of lutents</changelog>
  <changelog author="adam.majer@suse.de" date="1569844800">- jasper-CVE-2018-19541.patch: verify color palette information
  in j2 files when it's read from the file as per specifications
  of JPEG2000. (bsc#1117507)</changelog>
  <changelog author="mvetter@suse.com" date="1584446400">- bsc#1092115 CVE-2018-9154: Fix possible denial of service
  Add jasper-CVE-2018-9154.patch: dont abort in jpc_dec_process_sot()</changelog>
  <changelog author="mvetter@suse.com" date="1597320000">- bsc#1010980 CVE-2016-9399: Fix assert in calcstepsizes
  Add jasper-CVE-2016-9399.patch
- bsc#1020451 CVE-2017-5499: Validate component depth bit
  Add jasper-CVE-2017-5499.patch
- bsc#1020456 CVE-2017-5503, bsc#1020458 CVE-2017-5504, bsc#1020460 CVE-2017-5505:
  Check bounds in jas_seq2d_bindsub()
  Add jasper-CVE-2017-5503-CVE-2017-5504-CVE-2017-5505.patch</changelog>
  <changelog author="mvetter@suse.com" date="1597665600">- bsc#1120807 CVE-2018-20570: Fix heap based buffer over-read in jp2_encode
  Add jasper-CVE-2018-20570.patch
- bsc#1120805 CVE-2018-20622: Fix memory leak in jas_malloc.c
  Add jasper-CVE-2018-20622.patch
- bsc#1117328 CVE-2018-19543, bsc#1045450 CVE-2017-9782: Fix numchans mixup
  Add jasper-CVE-2018-19543-CVE-2017-9782.patch
- bsc#1115637 CVE-2018-19139: Fix mem leaks by registering jpc_unk_destroyparms
  Add jasper-CVE-2018-19139.patch
- bsc#1114498 CVE-2018-18873: Fix null pointer deref in ras_putdatastd
  Add jasper-CVE-2018-18873.patch
- bsc#1088278 CVE-2018-9252: Fix reachable assertion in jpc_abstorelstepsize
  Add jasper-CVE-2018-9252.patch
- bsc#1057152 CVE-2017-14132: Fix heap base overflow in by checking components
  Add jasper-CVE-2017-14132.patch</changelog>
  <changelog author="mvetter@suse.com" date="1598443200">- bsc#1010979 CVE-2016-9398: Use new fix from upstream where we
  actually check for allowed value range instead of just negating
  Add jasper-CVE-2016-9398-upstream.patch</changelog>
  <changelog author="mvetter@suse.com" date="1612785600">- bsc#1179748 CVE-2020-27828: Fix heap overflow by checking maxrlvls
  Add jasper-CVE-2020-27828.patch
- bsc#1181483 CVE-2021-3272: Fix heap overflow by ensuring number
  of channels matches image components
  Add jasper-CVE-2021-3272.patch</changelog>
  <changelog author="mvetter@suse.com" date="1643803200">- bsc#1188437 CVE-2021-27845: Fix divide-by-zery in cp_create()
  Add jasper-CVE-2021-27845.patch</changelog>
</package>
<package pkgid="c44ada88b08c285de2bee6c056b6dccfc15abb518f8f2f6afbeffc2c0e6ce5b6" name="libjasper4" arch="s390x">
  <version epoch="0" ver="2.0.14" rel="3.22.1"/>
  <changelog author="sbrabec@suse.com" date="1488801600">- Add -D_BSD_SOURCE to fix redefinition of system types in
  jas_config.h and breakage in ppc64le, s390 and s390x
  (bsc#1028070).</changelog>
  <changelog author="fstrba@suse.com" date="1489665600">- Added patch:
  * jasper-CVE-2016-10251.patch
  - Upstream fix for bsc#1029497, CVE-2016-10251: Use of
    uninitialized value in jpc_pi_nextcprl (jpc_t2cod.c)</changelog>
  <changelog author="fstrba@suse.com" date="1489752000">- Added patches:
  * jasper-CVE-2017-5498.patch
  - Upstream changes putting braces and belts around
    CVE-2017-5498, bsc#1020353, left-shift undefined behaviour
  * jasper-CVE-2016-9600.patch
  - Upstream fix for "Null Pointer Dereference due to missing
    check for UNKNOWN color space in JP2 encoder" (CVE-2016-9600,
    bsc#1018088)</changelog>
  <changelog author="fstrba@suse.com" date="1490184000">- Added patches:
  * jasper-CVE-2016-9583.patch
  - Out of bounds heap read in jpc_pi_nextpcrl() (bsc#1015400,
    CVE-2016-9583)
  * jasper-CVE-2017-6850.patch
  - NULL pointer dereference in jp2_cdef_destroy (jp2_cod.c)
    (bsc#1021868, CVE-2017-6850)</changelog>
  <changelog author="fstrba@suse.com" date="1490875200">- Modified patch:
  * jasper-CVE-2016-9583.patch
    + integrate upstream change
    99a50593254d1b53002719bbecfc946c84b23d27, which fixed a null
    pointer dereferencing crash.</changelog>
  <changelog author="fstrba@suse.com" date="1499774400">- Added patch:
  * jasper-CVE-2017-1000050.patch
    + Upstream fix for NULL Pointer Dereference jp2_encode
    (bsc#1047958, CVE-2017-1000050)</changelog>
  <changelog author="fstrba@suse.com" date="1499774401">- Added patch:
  * jasper-CVE-2016-9262.patch
    + Fix for Multiple overflow vulnerabilities leading to use
    after free (bsc#1009994, CVE-2016-9262)</changelog>
  <changelog author="fstrba@suse.com" date="1499860800">- Other bugs fixed by existing patches:
  * jasper-CVE-2016-9395.patch
  - bsc#1010756, CVE-2016-9394: assertion in jas_matrix_t
  * jas_seq2d_create(int, int, int, int): Assertion
    `xstart &lt;= xend &amp;&amp; ystart &lt;= yend'
  - bsc#1010757, CVE-2016-9392: pc_dec.c:1637: void
    calcstepsizes(uint_fast16_t, int, uint_fast16_t *):
    Assertion `!((expn + (numrlvls - 1) - (numrlvls - 1 -
    ((bandno &gt; 0) ? ((bandno + 2) / 3) : (0)))) &amp; (~0x1f))'
    failed.
  - bsc#1010766, CVE-2016-9393: jpc_t2cod.c:297: int
    jpc_pi_nextrpcl(jpc_pi_t *): Assertion
    `pi-&gt;prcno pirlvl-&gt;numprcs' failed.
  - bsc#1010977, CVE-2016-9395: jas_seq.c:90: jas_matrix_t
  * jas_seq2d_create(int, int, int, int): Assertion `xstart
    &lt;= xend &amp;&amp; ystart &lt;= yend' failed.
- Other bugs fixed in current version:
  * bsc#1010774, CVE-2016-9390: jas_seq.c:90: jas_matrix_t
  * jas_seq2d_create(int, int, int, int): Assertion `xstart &lt;=
    xend &amp;&amp; ystart &lt;= yend' failed.
  * bsc#1010782, CVE-2016-9391: jpc_bs.c:197: long
    jpc_bitstream_getbits(jpc_bitstream_t *, int): Assertion
    `n &gt;= 0 &amp;&amp; n &lt; 32' failed.
  * bsc#1010968, CVE-2016-9389: Assertion `((c1)-&gt;numcols_) ==
    numcols &amp;&amp; ((c2)-&gt;numcols_) == numcols' failed.
  * bsc#1010975, CVE-2016-9388: ras_dec.c:330: int
    ras_getcmap(jas_stream_t *, ras_hdr_t *, ras_cmap_t *):
    Assertion `numcolors &lt;= 256' failed.
  * bsc#1010960, CVE-2016-9387: jas_seq.c:90: jas_matrix&lt;= yend'
    failed.</changelog>
  <changelog author="fstrba@suse.com" date="1522324800">- Upgrade to 2.0.14
  * Soname and package name change libjasper1 to libjasper4
  * Security fixes:
    + CVE-2016-9557 jasper: Signed integer overflow in jas_image.c
- Removed patches:
  * jasper-1.900.1-uninitialized.patch
    + not needed any more
  * jasper-CVE-2016-10251.patch
  * jasper-CVE-2016-8654.patch
  * jasper-CVE-2016-9262.patch
  * jasper-CVE-2016-9395.patch
  * jasper-CVE-2016-9560.patch
  * jasper-CVE-2016-9583.patch
  * jasper-CVE-2016-9591.patch
  * jasper-CVE-2016-9600.patch
  * jasper-CVE-2017-1000050.patch
  * jasper-CVE-2017-5498.patch
  * jasper-CVE-2017-6850.patch
    + Fixed upstream
- Added patches:
  * 0001-jpc_cs-reject-all-but-JPC_COX_INS-and-JPC_COX_RFT.patch
    + fix assertion failure JPC_NOMINALGAIN() which can be caused
    by a crafted JP2 file.
  * 0001-Added-a-fix-from-nrusch-to-allow-JasPer-to-be-build-.patch
    + allow JasPer to be build with CMake 2.x as well as CMake 3.x.</changelog>
  <changelog author="fstrba@suse.com" date="1522324801">- Added patch:
  * jasper-CVE-2018-9055.patch
    + fix CVE-2018-9055, bsc#1087020: jasper: denial of service via
    a reachable assertion in the function jpc_firstone in
    libjasper/jpc/jpc_math.c.</changelog>
  <changelog author="mvetter@suse.com" date="1552392000">- bsc#1117511 CVE-2018-19539 Fix access violation in jas_image_readcmpt:
  * Add jasper-CVE-2018-19539.patch</changelog>
  <changelog author="mvetter@suse.com" date="1553860800">- bsc#1117505 CVE-2018-19542 Fix NULL pointer dereference jp2_decode:
  Add jasper-CVE-2018-19542.patch
- bsc#1010783 CVE-2016-9396 Fix reachable assertion in jpc_cox_getcompparms:
  * Rename 0001-jpc_cs-reject-all-but-JPC_COX_INS-and-JPC_COX_RFT.patch
  to jasper-CVE-2016-9396.patch</changelog>
  <changelog author="mvetter@suse.com" date="1559822400">- bsc#1117508 CVE-2018-19540: Fix heap based overflow in jas_icctxtdesc_input
  Add jasper-CVE-2018-19540.patch: Make sure asclen is at least 1
- bsc#1117507 CVE-2018-19541: Fix heap based overread in jas_image_depalettize
  Add jasper-CVE-2018-19541.patch: Check number of lutents</changelog>
  <changelog author="adam.majer@suse.de" date="1569844800">- jasper-CVE-2018-19541.patch: verify color palette information
  in j2 files when it's read from the file as per specifications
  of JPEG2000. (bsc#1117507)</changelog>
  <changelog author="mvetter@suse.com" date="1584446400">- bsc#1092115 CVE-2018-9154: Fix possible denial of service
  Add jasper-CVE-2018-9154.patch: dont abort in jpc_dec_process_sot()</changelog>
  <changelog author="mvetter@suse.com" date="1597320000">- bsc#1010980 CVE-2016-9399: Fix assert in calcstepsizes
  Add jasper-CVE-2016-9399.patch
- bsc#1020451 CVE-2017-5499: Validate component depth bit
  Add jasper-CVE-2017-5499.patch
- bsc#1020456 CVE-2017-5503, bsc#1020458 CVE-2017-5504, bsc#1020460 CVE-2017-5505:
  Check bounds in jas_seq2d_bindsub()
  Add jasper-CVE-2017-5503-CVE-2017-5504-CVE-2017-5505.patch</changelog>
  <changelog author="mvetter@suse.com" date="1597665600">- bsc#1120807 CVE-2018-20570: Fix heap based buffer over-read in jp2_encode
  Add jasper-CVE-2018-20570.patch
- bsc#1120805 CVE-2018-20622: Fix memory leak in jas_malloc.c
  Add jasper-CVE-2018-20622.patch
- bsc#1117328 CVE-2018-19543, bsc#1045450 CVE-2017-9782: Fix numchans mixup
  Add jasper-CVE-2018-19543-CVE-2017-9782.patch
- bsc#1115637 CVE-2018-19139: Fix mem leaks by registering jpc_unk_destroyparms
  Add jasper-CVE-2018-19139.patch
- bsc#1114498 CVE-2018-18873: Fix null pointer deref in ras_putdatastd
  Add jasper-CVE-2018-18873.patch
- bsc#1088278 CVE-2018-9252: Fix reachable assertion in jpc_abstorelstepsize
  Add jasper-CVE-2018-9252.patch
- bsc#1057152 CVE-2017-14132: Fix heap base overflow in by checking components
  Add jasper-CVE-2017-14132.patch</changelog>
  <changelog author="mvetter@suse.com" date="1598443200">- bsc#1010979 CVE-2016-9398: Use new fix from upstream where we
  actually check for allowed value range instead of just negating
  Add jasper-CVE-2016-9398-upstream.patch</changelog>
  <changelog author="mvetter@suse.com" date="1612785600">- bsc#1179748 CVE-2020-27828: Fix heap overflow by checking maxrlvls
  Add jasper-CVE-2020-27828.patch
- bsc#1181483 CVE-2021-3272: Fix heap overflow by ensuring number
  of channels matches image components
  Add jasper-CVE-2021-3272.patch</changelog>
  <changelog author="mvetter@suse.com" date="1643803200">- bsc#1188437 CVE-2021-27845: Fix divide-by-zery in cp_create()
  Add jasper-CVE-2021-27845.patch</changelog>
</package>
<package pkgid="7f0f419dd47f20952b4b0dfaa4ec6863c594278486627d22fa1d38f7f595a8d7" name="libjasper4" arch="x86_64">
  <version epoch="0" ver="2.0.14" rel="3.22.1"/>
  <changelog author="sbrabec@suse.com" date="1488801600">- Add -D_BSD_SOURCE to fix redefinition of system types in
  jas_config.h and breakage in ppc64le, s390 and s390x
  (bsc#1028070).</changelog>
  <changelog author="fstrba@suse.com" date="1489665600">- Added patch:
  * jasper-CVE-2016-10251.patch
  - Upstream fix for bsc#1029497, CVE-2016-10251: Use of
    uninitialized value in jpc_pi_nextcprl (jpc_t2cod.c)</changelog>
  <changelog author="fstrba@suse.com" date="1489752000">- Added patches:
  * jasper-CVE-2017-5498.patch
  - Upstream changes putting braces and belts around
    CVE-2017-5498, bsc#1020353, left-shift undefined behaviour
  * jasper-CVE-2016-9600.patch
  - Upstream fix for "Null Pointer Dereference due to missing
    check for UNKNOWN color space in JP2 encoder" (CVE-2016-9600,
    bsc#1018088)</changelog>
  <changelog author="fstrba@suse.com" date="1490184000">- Added patches:
  * jasper-CVE-2016-9583.patch
  - Out of bounds heap read in jpc_pi_nextpcrl() (bsc#1015400,
    CVE-2016-9583)
  * jasper-CVE-2017-6850.patch
  - NULL pointer dereference in jp2_cdef_destroy (jp2_cod.c)
    (bsc#1021868, CVE-2017-6850)</changelog>
  <changelog author="fstrba@suse.com" date="1490875200">- Modified patch:
  * jasper-CVE-2016-9583.patch
    + integrate upstream change
    99a50593254d1b53002719bbecfc946c84b23d27, which fixed a null
    pointer dereferencing crash.</changelog>
  <changelog author="fstrba@suse.com" date="1499774400">- Added patch:
  * jasper-CVE-2017-1000050.patch
    + Upstream fix for NULL Pointer Dereference jp2_encode
    (bsc#1047958, CVE-2017-1000050)</changelog>
  <changelog author="fstrba@suse.com" date="1499774401">- Added patch:
  * jasper-CVE-2016-9262.patch
    + Fix for Multiple overflow vulnerabilities leading to use
    after free (bsc#1009994, CVE-2016-9262)</changelog>
  <changelog author="fstrba@suse.com" date="1499860800">- Other bugs fixed by existing patches:
  * jasper-CVE-2016-9395.patch
  - bsc#1010756, CVE-2016-9394: assertion in jas_matrix_t
  * jas_seq2d_create(int, int, int, int): Assertion
    `xstart &lt;= xend &amp;&amp; ystart &lt;= yend'
  - bsc#1010757, CVE-2016-9392: pc_dec.c:1637: void
    calcstepsizes(uint_fast16_t, int, uint_fast16_t *):
    Assertion `!((expn + (numrlvls - 1) - (numrlvls - 1 -
    ((bandno &gt; 0) ? ((bandno + 2) / 3) : (0)))) &amp; (~0x1f))'
    failed.
  - bsc#1010766, CVE-2016-9393: jpc_t2cod.c:297: int
    jpc_pi_nextrpcl(jpc_pi_t *): Assertion
    `pi-&gt;prcno pirlvl-&gt;numprcs' failed.
  - bsc#1010977, CVE-2016-9395: jas_seq.c:90: jas_matrix_t
  * jas_seq2d_create(int, int, int, int): Assertion `xstart
    &lt;= xend &amp;&amp; ystart &lt;= yend' failed.
- Other bugs fixed in current version:
  * bsc#1010774, CVE-2016-9390: jas_seq.c:90: jas_matrix_t
  * jas_seq2d_create(int, int, int, int): Assertion `xstart &lt;=
    xend &amp;&amp; ystart &lt;= yend' failed.
  * bsc#1010782, CVE-2016-9391: jpc_bs.c:197: long
    jpc_bitstream_getbits(jpc_bitstream_t *, int): Assertion
    `n &gt;= 0 &amp;&amp; n &lt; 32' failed.
  * bsc#1010968, CVE-2016-9389: Assertion `((c1)-&gt;numcols_) ==
    numcols &amp;&amp; ((c2)-&gt;numcols_) == numcols' failed.
  * bsc#1010975, CVE-2016-9388: ras_dec.c:330: int
    ras_getcmap(jas_stream_t *, ras_hdr_t *, ras_cmap_t *):
    Assertion `numcolors &lt;= 256' failed.
  * bsc#1010960, CVE-2016-9387: jas_seq.c:90: jas_matrix&lt;= yend'
    failed.</changelog>
  <changelog author="fstrba@suse.com" date="1522324800">- Upgrade to 2.0.14
  * Soname and package name change libjasper1 to libjasper4
  * Security fixes:
    + CVE-2016-9557 jasper: Signed integer overflow in jas_image.c
- Removed patches:
  * jasper-1.900.1-uninitialized.patch
    + not needed any more
  * jasper-CVE-2016-10251.patch
  * jasper-CVE-2016-8654.patch
  * jasper-CVE-2016-9262.patch
  * jasper-CVE-2016-9395.patch
  * jasper-CVE-2016-9560.patch
  * jasper-CVE-2016-9583.patch
  * jasper-CVE-2016-9591.patch
  * jasper-CVE-2016-9600.patch
  * jasper-CVE-2017-1000050.patch
  * jasper-CVE-2017-5498.patch
  * jasper-CVE-2017-6850.patch
    + Fixed upstream
- Added patches:
  * 0001-jpc_cs-reject-all-but-JPC_COX_INS-and-JPC_COX_RFT.patch
    + fix assertion failure JPC_NOMINALGAIN() which can be caused
    by a crafted JP2 file.
  * 0001-Added-a-fix-from-nrusch-to-allow-JasPer-to-be-build-.patch
    + allow JasPer to be build with CMake 2.x as well as CMake 3.x.</changelog>
  <changelog author="fstrba@suse.com" date="1522324801">- Added patch:
  * jasper-CVE-2018-9055.patch
    + fix CVE-2018-9055, bsc#1087020: jasper: denial of service via
    a reachable assertion in the function jpc_firstone in
    libjasper/jpc/jpc_math.c.</changelog>
  <changelog author="mvetter@suse.com" date="1552392000">- bsc#1117511 CVE-2018-19539 Fix access violation in jas_image_readcmpt:
  * Add jasper-CVE-2018-19539.patch</changelog>
  <changelog author="mvetter@suse.com" date="1553860800">- bsc#1117505 CVE-2018-19542 Fix NULL pointer dereference jp2_decode:
  Add jasper-CVE-2018-19542.patch
- bsc#1010783 CVE-2016-9396 Fix reachable assertion in jpc_cox_getcompparms:
  * Rename 0001-jpc_cs-reject-all-but-JPC_COX_INS-and-JPC_COX_RFT.patch
  to jasper-CVE-2016-9396.patch</changelog>
  <changelog author="mvetter@suse.com" date="1559822400">- bsc#1117508 CVE-2018-19540: Fix heap based overflow in jas_icctxtdesc_input
  Add jasper-CVE-2018-19540.patch: Make sure asclen is at least 1
- bsc#1117507 CVE-2018-19541: Fix heap based overread in jas_image_depalettize
  Add jasper-CVE-2018-19541.patch: Check number of lutents</changelog>
  <changelog author="adam.majer@suse.de" date="1569844800">- jasper-CVE-2018-19541.patch: verify color palette information
  in j2 files when it's read from the file as per specifications
  of JPEG2000. (bsc#1117507)</changelog>
  <changelog author="mvetter@suse.com" date="1584446400">- bsc#1092115 CVE-2018-9154: Fix possible denial of service
  Add jasper-CVE-2018-9154.patch: dont abort in jpc_dec_process_sot()</changelog>
  <changelog author="mvetter@suse.com" date="1597320000">- bsc#1010980 CVE-2016-9399: Fix assert in calcstepsizes
  Add jasper-CVE-2016-9399.patch
- bsc#1020451 CVE-2017-5499: Validate component depth bit
  Add jasper-CVE-2017-5499.patch
- bsc#1020456 CVE-2017-5503, bsc#1020458 CVE-2017-5504, bsc#1020460 CVE-2017-5505:
  Check bounds in jas_seq2d_bindsub()
  Add jasper-CVE-2017-5503-CVE-2017-5504-CVE-2017-5505.patch</changelog>
  <changelog author="mvetter@suse.com" date="1597665600">- bsc#1120807 CVE-2018-20570: Fix heap based buffer over-read in jp2_encode
  Add jasper-CVE-2018-20570.patch
- bsc#1120805 CVE-2018-20622: Fix memory leak in jas_malloc.c
  Add jasper-CVE-2018-20622.patch
- bsc#1117328 CVE-2018-19543, bsc#1045450 CVE-2017-9782: Fix numchans mixup
  Add jasper-CVE-2018-19543-CVE-2017-9782.patch
- bsc#1115637 CVE-2018-19139: Fix mem leaks by registering jpc_unk_destroyparms
  Add jasper-CVE-2018-19139.patch
- bsc#1114498 CVE-2018-18873: Fix null pointer deref in ras_putdatastd
  Add jasper-CVE-2018-18873.patch
- bsc#1088278 CVE-2018-9252: Fix reachable assertion in jpc_abstorelstepsize
  Add jasper-CVE-2018-9252.patch
- bsc#1057152 CVE-2017-14132: Fix heap base overflow in by checking components
  Add jasper-CVE-2017-14132.patch</changelog>
  <changelog author="mvetter@suse.com" date="1598443200">- bsc#1010979 CVE-2016-9398: Use new fix from upstream where we
  actually check for allowed value range instead of just negating
  Add jasper-CVE-2016-9398-upstream.patch</changelog>
  <changelog author="mvetter@suse.com" date="1612785600">- bsc#1179748 CVE-2020-27828: Fix heap overflow by checking maxrlvls
  Add jasper-CVE-2020-27828.patch
- bsc#1181483 CVE-2021-3272: Fix heap overflow by ensuring number
  of channels matches image components
  Add jasper-CVE-2021-3272.patch</changelog>
  <changelog author="mvetter@suse.com" date="1643803200">- bsc#1188437 CVE-2021-27845: Fix divide-by-zery in cp_create()
  Add jasper-CVE-2021-27845.patch</changelog>
</package>
<package pkgid="21bd731435874a226119abd42591688f0ed96e43f8b7306f83680d5e8da55d7e" name="libjasper4-32bit" arch="x86_64">
  <version epoch="0" ver="2.0.14" rel="3.22.1"/>
  <changelog author="sbrabec@suse.com" date="1488801600">- Add -D_BSD_SOURCE to fix redefinition of system types in
  jas_config.h and breakage in ppc64le, s390 and s390x
  (bsc#1028070).</changelog>
  <changelog author="fstrba@suse.com" date="1489665600">- Added patch:
  * jasper-CVE-2016-10251.patch
  - Upstream fix for bsc#1029497, CVE-2016-10251: Use of
    uninitialized value in jpc_pi_nextcprl (jpc_t2cod.c)</changelog>
  <changelog author="fstrba@suse.com" date="1489752000">- Added patches:
  * jasper-CVE-2017-5498.patch
  - Upstream changes putting braces and belts around
    CVE-2017-5498, bsc#1020353, left-shift undefined behaviour
  * jasper-CVE-2016-9600.patch
  - Upstream fix for "Null Pointer Dereference due to missing
    check for UNKNOWN color space in JP2 encoder" (CVE-2016-9600,
    bsc#1018088)</changelog>
  <changelog author="fstrba@suse.com" date="1490184000">- Added patches:
  * jasper-CVE-2016-9583.patch
  - Out of bounds heap read in jpc_pi_nextpcrl() (bsc#1015400,
    CVE-2016-9583)
  * jasper-CVE-2017-6850.patch
  - NULL pointer dereference in jp2_cdef_destroy (jp2_cod.c)
    (bsc#1021868, CVE-2017-6850)</changelog>
  <changelog author="fstrba@suse.com" date="1490875200">- Modified patch:
  * jasper-CVE-2016-9583.patch
    + integrate upstream change
    99a50593254d1b53002719bbecfc946c84b23d27, which fixed a null
    pointer dereferencing crash.</changelog>
  <changelog author="fstrba@suse.com" date="1499774400">- Added patch:
  * jasper-CVE-2017-1000050.patch
    + Upstream fix for NULL Pointer Dereference jp2_encode
    (bsc#1047958, CVE-2017-1000050)</changelog>
  <changelog author="fstrba@suse.com" date="1499774401">- Added patch:
  * jasper-CVE-2016-9262.patch
    + Fix for Multiple overflow vulnerabilities leading to use
    after free (bsc#1009994, CVE-2016-9262)</changelog>
  <changelog author="fstrba@suse.com" date="1499860800">- Other bugs fixed by existing patches:
  * jasper-CVE-2016-9395.patch
  - bsc#1010756, CVE-2016-9394: assertion in jas_matrix_t
  * jas_seq2d_create(int, int, int, int): Assertion
    `xstart &lt;= xend &amp;&amp; ystart &lt;= yend'
  - bsc#1010757, CVE-2016-9392: pc_dec.c:1637: void
    calcstepsizes(uint_fast16_t, int, uint_fast16_t *):
    Assertion `!((expn + (numrlvls - 1) - (numrlvls - 1 -
    ((bandno &gt; 0) ? ((bandno + 2) / 3) : (0)))) &amp; (~0x1f))'
    failed.
  - bsc#1010766, CVE-2016-9393: jpc_t2cod.c:297: int
    jpc_pi_nextrpcl(jpc_pi_t *): Assertion
    `pi-&gt;prcno pirlvl-&gt;numprcs' failed.
  - bsc#1010977, CVE-2016-9395: jas_seq.c:90: jas_matrix_t
  * jas_seq2d_create(int, int, int, int): Assertion `xstart
    &lt;= xend &amp;&amp; ystart &lt;= yend' failed.
- Other bugs fixed in current version:
  * bsc#1010774, CVE-2016-9390: jas_seq.c:90: jas_matrix_t
  * jas_seq2d_create(int, int, int, int): Assertion `xstart &lt;=
    xend &amp;&amp; ystart &lt;= yend' failed.
  * bsc#1010782, CVE-2016-9391: jpc_bs.c:197: long
    jpc_bitstream_getbits(jpc_bitstream_t *, int): Assertion
    `n &gt;= 0 &amp;&amp; n &lt; 32' failed.
  * bsc#1010968, CVE-2016-9389: Assertion `((c1)-&gt;numcols_) ==
    numcols &amp;&amp; ((c2)-&gt;numcols_) == numcols' failed.
  * bsc#1010975, CVE-2016-9388: ras_dec.c:330: int
    ras_getcmap(jas_stream_t *, ras_hdr_t *, ras_cmap_t *):
    Assertion `numcolors &lt;= 256' failed.
  * bsc#1010960, CVE-2016-9387: jas_seq.c:90: jas_matrix&lt;= yend'
    failed.</changelog>
  <changelog author="fstrba@suse.com" date="1522324800">- Upgrade to 2.0.14
  * Soname and package name change libjasper1 to libjasper4
  * Security fixes:
    + CVE-2016-9557 jasper: Signed integer overflow in jas_image.c
- Removed patches:
  * jasper-1.900.1-uninitialized.patch
    + not needed any more
  * jasper-CVE-2016-10251.patch
  * jasper-CVE-2016-8654.patch
  * jasper-CVE-2016-9262.patch
  * jasper-CVE-2016-9395.patch
  * jasper-CVE-2016-9560.patch
  * jasper-CVE-2016-9583.patch
  * jasper-CVE-2016-9591.patch
  * jasper-CVE-2016-9600.patch
  * jasper-CVE-2017-1000050.patch
  * jasper-CVE-2017-5498.patch
  * jasper-CVE-2017-6850.patch
    + Fixed upstream
- Added patches:
  * 0001-jpc_cs-reject-all-but-JPC_COX_INS-and-JPC_COX_RFT.patch
    + fix assertion failure JPC_NOMINALGAIN() which can be caused
    by a crafted JP2 file.
  * 0001-Added-a-fix-from-nrusch-to-allow-JasPer-to-be-build-.patch
    + allow JasPer to be build with CMake 2.x as well as CMake 3.x.</changelog>
  <changelog author="fstrba@suse.com" date="1522324801">- Added patch:
  * jasper-CVE-2018-9055.patch
    + fix CVE-2018-9055, bsc#1087020: jasper: denial of service via
    a reachable assertion in the function jpc_firstone in
    libjasper/jpc/jpc_math.c.</changelog>
  <changelog author="mvetter@suse.com" date="1552392000">- bsc#1117511 CVE-2018-19539 Fix access violation in jas_image_readcmpt:
  * Add jasper-CVE-2018-19539.patch</changelog>
  <changelog author="mvetter@suse.com" date="1553860800">- bsc#1117505 CVE-2018-19542 Fix NULL pointer dereference jp2_decode:
  Add jasper-CVE-2018-19542.patch
- bsc#1010783 CVE-2016-9396 Fix reachable assertion in jpc_cox_getcompparms:
  * Rename 0001-jpc_cs-reject-all-but-JPC_COX_INS-and-JPC_COX_RFT.patch
  to jasper-CVE-2016-9396.patch</changelog>
  <changelog author="mvetter@suse.com" date="1559822400">- bsc#1117508 CVE-2018-19540: Fix heap based overflow in jas_icctxtdesc_input
  Add jasper-CVE-2018-19540.patch: Make sure asclen is at least 1
- bsc#1117507 CVE-2018-19541: Fix heap based overread in jas_image_depalettize
  Add jasper-CVE-2018-19541.patch: Check number of lutents</changelog>
  <changelog author="adam.majer@suse.de" date="1569844800">- jasper-CVE-2018-19541.patch: verify color palette information
  in j2 files when it's read from the file as per specifications
  of JPEG2000. (bsc#1117507)</changelog>
  <changelog author="mvetter@suse.com" date="1584446400">- bsc#1092115 CVE-2018-9154: Fix possible denial of service
  Add jasper-CVE-2018-9154.patch: dont abort in jpc_dec_process_sot()</changelog>
  <changelog author="mvetter@suse.com" date="1597320000">- bsc#1010980 CVE-2016-9399: Fix assert in calcstepsizes
  Add jasper-CVE-2016-9399.patch
- bsc#1020451 CVE-2017-5499: Validate component depth bit
  Add jasper-CVE-2017-5499.patch
- bsc#1020456 CVE-2017-5503, bsc#1020458 CVE-2017-5504, bsc#1020460 CVE-2017-5505:
  Check bounds in jas_seq2d_bindsub()
  Add jasper-CVE-2017-5503-CVE-2017-5504-CVE-2017-5505.patch</changelog>
  <changelog author="mvetter@suse.com" date="1597665600">- bsc#1120807 CVE-2018-20570: Fix heap based buffer over-read in jp2_encode
  Add jasper-CVE-2018-20570.patch
- bsc#1120805 CVE-2018-20622: Fix memory leak in jas_malloc.c
  Add jasper-CVE-2018-20622.patch
- bsc#1117328 CVE-2018-19543, bsc#1045450 CVE-2017-9782: Fix numchans mixup
  Add jasper-CVE-2018-19543-CVE-2017-9782.patch
- bsc#1115637 CVE-2018-19139: Fix mem leaks by registering jpc_unk_destroyparms
  Add jasper-CVE-2018-19139.patch
- bsc#1114498 CVE-2018-18873: Fix null pointer deref in ras_putdatastd
  Add jasper-CVE-2018-18873.patch
- bsc#1088278 CVE-2018-9252: Fix reachable assertion in jpc_abstorelstepsize
  Add jasper-CVE-2018-9252.patch
- bsc#1057152 CVE-2017-14132: Fix heap base overflow in by checking components
  Add jasper-CVE-2017-14132.patch</changelog>
  <changelog author="mvetter@suse.com" date="1598443200">- bsc#1010979 CVE-2016-9398: Use new fix from upstream where we
  actually check for allowed value range instead of just negating
  Add jasper-CVE-2016-9398-upstream.patch</changelog>
  <changelog author="mvetter@suse.com" date="1612785600">- bsc#1179748 CVE-2020-27828: Fix heap overflow by checking maxrlvls
  Add jasper-CVE-2020-27828.patch
- bsc#1181483 CVE-2021-3272: Fix heap overflow by ensuring number
  of channels matches image components
  Add jasper-CVE-2021-3272.patch</changelog>
  <changelog author="mvetter@suse.com" date="1643803200">- bsc#1188437 CVE-2021-27845: Fix divide-by-zery in cp_create()
  Add jasper-CVE-2021-27845.patch</changelog>
</package>
<package pkgid="d07735e927ce64f1a62151d2ad6cd38f1580598d8981b0c236b389870f01a92b" name="libjson-c-devel" arch="aarch64">
  <version epoch="0" ver="0.13" rel="3.3.1"/>
  <changelog author="bruno@ioda-net.ch" date="1362657600">- Update to 0.10 version :
  * Add a json_object_to_json_string_ext() function to allow output
  to be formatted in a more human readable form.
  * Add json_object_object_get_ex(), a NULL-safe get object method,
  to be able to distinguish between a key not present and the value
  being NULL.
  * Add an alternative iterator implementation, see json_object_iterator.h
  * Make json_object_iter public to enable external use of the
    json_object_object_foreachC macro.
  * Add a printbuf_memset() function to provide an effecient way to set and
    append things like whitespace indentation.
  * Adjust json_object_is_type and json_object_get_type so they return
    json_type_null for NULL objects and handle NULL passed to
    json_objct_object_get().
  * Rename boolean type to json_bool.
  * Fix various compile issues for Visual Studio and MinGW.
  * Allow json_tokener_parse_ex() to be re-used to parse multiple object.
    Also, fix some parsing issues with capitalized hexadecimal numbers and
    number in E notation.
  * Add json_tokener_get_error() and json_tokener_error_desc() to better
    encapsulate the process of retrieving errors while parsing.
  * Various improvements to the documentation of many functions.
  * Add new json_object_array_sort() function.
  * Fix a bug in json_object_get_int(), which would incorrectly return 0
    when called on a string type object.
    Eric Haszlakiewicz
  * Add a json_type_to_name() function.
    Eric Haszlakiewicz
  * Add a json_tokener_parse_verbose() function.
    Jehiah Czebotar
  * Improve support for null bytes within JSON strings.
    Jehiah Czebotar
  * Fix file descriptor leak if memory allocation fails in json_util
    Zachary Blair, zack_blair at hotmail dot com
  * Add int64 support. Two new functions json_object_net_int64 and
    json_object_get_int64. Binary compatibility preserved.
    Eric Haszlakiewicz, EHASZLA at transunion com
    Rui Miguel Silva Seabra, rms at 1407 dot org
  * Fix subtle bug in linkhash where lookup could hang after all slots
    were filled then successively freed.
    Spotted by Jean-Marc Naud, j dash m at newtraxtech dot com
  * Make json_object_from_file take const char *filename
    Spotted by Vikram Raj V, vsagar at attinteractive dot com
  * Add handling of surrogate pairs (json_tokener.c, test4.c, Makefile.am)
    Brent Miller, bdmiller at yahoo dash inc dot com
  * Correction to comment describing printbuf_memappend in printbuf.h
    Brent Miller, bdmiller at yahoo dash inc dot com
- Packaging :
  * upgrade upstream location https://gitub.com/json-c/json-c/wiki
  * cleanup old patches included now upstream
  . json-c-0.9-linkhash.patch
  . json-c-0.9-json_tokener.patch
  . json-c-0.9-json_object_from_file.patch
  . json-c-0.9-base.patch
  * Redone lfs patch against new 0.10 release
  * Removed empty NEWS file</changelog>
  <changelog author="coolo@suse.com" date="1362916800">- add json-c-fix-headers.patch from master branch to fix compilation
  of apps using the lib</changelog>
  <changelog author="fstrba@suse.com" date="1389009600">- Upgrade to 0.11 version:
  - SONAME change.
  - Fix provides and obsoletes accordingly
  - symlink the .pc file to the oldname for software that needs it
- Remove json-c-fix-headers.patch integrated upstream</changelog>
  <changelog author="jengelh@inai.de" date="1391515200">- Update metadata (description, RPM groups), and remove .la file
  in %install, not %check.</changelog>
  <changelog author="idonmez@suse.com" date="1396872000">- Add json-c-hash-dos-and-overflow-random-seed-4e.patch to fix
  CVE-2013-6370 and CVE-2013-6371 (bnc#870147)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1411214400">- json-c 0.12
  Fixes for security issues contained in this release have been
  previously patched into this package, but listed for completeness:
  * Address security issues:
  * CVE-2013-6371: hash collision denial of service
  * CVE-2013-6370: buffer overflow if size_t is larger than int
- Further changes:
  * Avoid potential overflow in json_object_get_double
  * Eliminate the mc_abort() function and MC_ABORT macro.
  * Make the json_tokener_errors array local.  It has been deprecated for
    a while, and json_tokener_error_desc() should be used instead.
  * change the floating point output format to %.17g so values with
    more than 6 digits show up in the output.
  * Remove the old libjson.so name compatibility support.  The library is
    only created as libjson-c.so now and headers are only installed
    into the ${prefix}/json-c directory.
  * When supported by the linker, add the -Bsymbolic-functions flag.
  * Make strict mode more strict:
  * number must not start with 0
  * no single-quote strings
  * no comments
  * trailing char not allowed
  * only allow lowercase literals
  * Added a json_object_new_double_s() convenience function to allow
    an exact string representation of a double to be specified when
    creating the object and use it in json_tokener_parse_ex() so
    a re-serialized object more exactly matches the input.
  * Add support NaN and Infinity
- packaging changes:
  * json-c-hash-dos-and-overflow-random-seed-4e.patch is upstream
  * Move from json-c-lfs.patch which removed warning errors and
    autoconf call to json-c-0.12-unused_variable_size.patch from
    upstream which fixes the warning
  * except for SLE 11 where autoreconf call is required
  * add licence file to main package</changelog>
  <changelog author="rpm@fthiessen.de" date="1468843200">- Update to upstream release 0.12.1
- Removed upstream fixed json-c-0.12-unused_variable_size.patch
- Added fix-set-but-not-used.patch</changelog>
  <changelog author="mliska@suse.cz" date="1490270400">- Added gcc7-fix.patch</changelog>
  <changelog author="avindra@opensuse.org" date="1514462400">- json-c 0.13
  + Deprecated and removed features:
  * Internal use of bits.h has been eliminated.
  * lh_abort() is deprecated
  + Behavior changes:
  * Tighten the number parsing algorithm to raise errors instead
    of truncating the results.  For example 12.3.4 or 2015-01-15,
    which now return null.
  * Use size_t for array length and size. Platforms where
    sizeof(size_t) != sizeof(int) may not be backwards compatible
  * Check for failue when allocating memory, returning NULL and
    errno=ENOMEM.
  * Change json_object_object_add() return type from void to int,
    and will return -1 on failures, instead of exiting. (Note:
    this is not an ABI change)
  + New features:
  * Aiming to follow RFC 7159 now.
  * Support for JSON pointer, RFC 6901 (see json_pointer.h)
  * Add a couple of additional option to json_object_to_json_string_ext:
  JSON_C_TO_STRING_PRETTY_TAB
  JSON_C_TO_STRING_NOSLASHESCAPE
  * json_object_object_add_ex() - better perf when certain
    constraints are known to be true
  * Serialization format of doubles now configurable
  * New functions
  - json_object_equal() - utility function for comparing
    json_objects
  - json_object_deep_copy() - a way to copy entire object
    trees
  - json_object_set_&lt;type&gt;() - modify the value of
    existing json_object's without the need to recreate them.
  Also add a json_object_int_inc function to adjust an int's'
  value.
  - json_util_get_last_err() - retrieve the string describing
    the cause of errors, instead of printing to stderr.
  - perllike hash function for strings
  * json_global_set_string_hash()
  * json_c_visit() - a way to iterate over a tree of json-c
    objects.
  + Notable bug fixes and other improvements:
  * Make reference increment and decrement atomic to allow
    passing json objects between threads.
  * Fix json_object_object_foreach to avoid uninitialized
    variable warnings.
  * Improve performance by removing unneeded data items from
    hashtable code and reducing duplicate hash computation.
  * Performance: store small strings inside json_object
  * Performance: of json_object_to_json_string by removing
    variadic printf
  * Fix parsing of "-Infinity", and avoid needlessly copying the
    input when doing so.
  * Fix stack buffer overflow in json_object_double_to_json_string_format()
  * Fix various potential null ptr deref and int32 overflows
  * Fix a long-standing bug in array_list_put_idx() where it
    would attempt to free previously free'd entries due to not
    checking the current array length.
  * use uselocale() instead of setlocale() in json_tokener to
    behave better in threaded environments.
  * Fix out of bounds read when handling unicode surrogate pairs.
  * Ensure doubles that happen to be a whole number are emitted
    with ".0"
  * Visual Studio: use a snprintf/vsnprintf wrapper that ensures
    the string is terminated.
  * Fix double to int cast overflow in json_object_get_int64.
  * Clamp double to int32 when narrowing in json_object_get_int.
  * Use strtoll() to parse ints - instead of sscanf
  * usual code linting
  + Build changes:
  * Add Appveyor and Travis build support
  * Support for MacOS and Windows through CMake
  * Silent build by default
  * Link against libm when needed
  * Add support for building with AddressSanitizer
  * Add support for building with Clang
  * Add a --enable-threading configure option, and only use the
    (slower) __sync_add_and_fetch()/__sync_sub_and_fetch()
    function when it is specified.
- cleanup with spec-cleaner
- remove fix-set-but-not-used.patch
  + fixed: https://github.com/json-c/json-c/issues/240
- remove gcc7-fix.patch
  + fixed in 014924ba899f659917bb64392bbff7d3c803afc2</changelog>
  <changelog author="ncutler@suse.com" date="1642161600">- Add patch bsc1171479.patch
  + fix integer overflow and out-of-bounds write (CVE-2020-12762, bsc#1171479)</changelog>
</package>
<package pkgid="a0d5a21464fa02fd876d2ab23e7719c2d23cd7b60d71029376e704b0c09228fe" name="libjson-c-devel" arch="ppc64le">
  <version epoch="0" ver="0.13" rel="3.3.1"/>
  <changelog author="bruno@ioda-net.ch" date="1362657600">- Update to 0.10 version :
  * Add a json_object_to_json_string_ext() function to allow output
  to be formatted in a more human readable form.
  * Add json_object_object_get_ex(), a NULL-safe get object method,
  to be able to distinguish between a key not present and the value
  being NULL.
  * Add an alternative iterator implementation, see json_object_iterator.h
  * Make json_object_iter public to enable external use of the
    json_object_object_foreachC macro.
  * Add a printbuf_memset() function to provide an effecient way to set and
    append things like whitespace indentation.
  * Adjust json_object_is_type and json_object_get_type so they return
    json_type_null for NULL objects and handle NULL passed to
    json_objct_object_get().
  * Rename boolean type to json_bool.
  * Fix various compile issues for Visual Studio and MinGW.
  * Allow json_tokener_parse_ex() to be re-used to parse multiple object.
    Also, fix some parsing issues with capitalized hexadecimal numbers and
    number in E notation.
  * Add json_tokener_get_error() and json_tokener_error_desc() to better
    encapsulate the process of retrieving errors while parsing.
  * Various improvements to the documentation of many functions.
  * Add new json_object_array_sort() function.
  * Fix a bug in json_object_get_int(), which would incorrectly return 0
    when called on a string type object.
    Eric Haszlakiewicz
  * Add a json_type_to_name() function.
    Eric Haszlakiewicz
  * Add a json_tokener_parse_verbose() function.
    Jehiah Czebotar
  * Improve support for null bytes within JSON strings.
    Jehiah Czebotar
  * Fix file descriptor leak if memory allocation fails in json_util
    Zachary Blair, zack_blair at hotmail dot com
  * Add int64 support. Two new functions json_object_net_int64 and
    json_object_get_int64. Binary compatibility preserved.
    Eric Haszlakiewicz, EHASZLA at transunion com
    Rui Miguel Silva Seabra, rms at 1407 dot org
  * Fix subtle bug in linkhash where lookup could hang after all slots
    were filled then successively freed.
    Spotted by Jean-Marc Naud, j dash m at newtraxtech dot com
  * Make json_object_from_file take const char *filename
    Spotted by Vikram Raj V, vsagar at attinteractive dot com
  * Add handling of surrogate pairs (json_tokener.c, test4.c, Makefile.am)
    Brent Miller, bdmiller at yahoo dash inc dot com
  * Correction to comment describing printbuf_memappend in printbuf.h
    Brent Miller, bdmiller at yahoo dash inc dot com
- Packaging :
  * upgrade upstream location https://gitub.com/json-c/json-c/wiki
  * cleanup old patches included now upstream
  . json-c-0.9-linkhash.patch
  . json-c-0.9-json_tokener.patch
  . json-c-0.9-json_object_from_file.patch
  . json-c-0.9-base.patch
  * Redone lfs patch against new 0.10 release
  * Removed empty NEWS file</changelog>
  <changelog author="coolo@suse.com" date="1362916800">- add json-c-fix-headers.patch from master branch to fix compilation
  of apps using the lib</changelog>
  <changelog author="fstrba@suse.com" date="1389009600">- Upgrade to 0.11 version:
  - SONAME change.
  - Fix provides and obsoletes accordingly
  - symlink the .pc file to the oldname for software that needs it
- Remove json-c-fix-headers.patch integrated upstream</changelog>
  <changelog author="jengelh@inai.de" date="1391515200">- Update metadata (description, RPM groups), and remove .la file
  in %install, not %check.</changelog>
  <changelog author="idonmez@suse.com" date="1396872000">- Add json-c-hash-dos-and-overflow-random-seed-4e.patch to fix
  CVE-2013-6370 and CVE-2013-6371 (bnc#870147)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1411214400">- json-c 0.12
  Fixes for security issues contained in this release have been
  previously patched into this package, but listed for completeness:
  * Address security issues:
  * CVE-2013-6371: hash collision denial of service
  * CVE-2013-6370: buffer overflow if size_t is larger than int
- Further changes:
  * Avoid potential overflow in json_object_get_double
  * Eliminate the mc_abort() function and MC_ABORT macro.
  * Make the json_tokener_errors array local.  It has been deprecated for
    a while, and json_tokener_error_desc() should be used instead.
  * change the floating point output format to %.17g so values with
    more than 6 digits show up in the output.
  * Remove the old libjson.so name compatibility support.  The library is
    only created as libjson-c.so now and headers are only installed
    into the ${prefix}/json-c directory.
  * When supported by the linker, add the -Bsymbolic-functions flag.
  * Make strict mode more strict:
  * number must not start with 0
  * no single-quote strings
  * no comments
  * trailing char not allowed
  * only allow lowercase literals
  * Added a json_object_new_double_s() convenience function to allow
    an exact string representation of a double to be specified when
    creating the object and use it in json_tokener_parse_ex() so
    a re-serialized object more exactly matches the input.
  * Add support NaN and Infinity
- packaging changes:
  * json-c-hash-dos-and-overflow-random-seed-4e.patch is upstream
  * Move from json-c-lfs.patch which removed warning errors and
    autoconf call to json-c-0.12-unused_variable_size.patch from
    upstream which fixes the warning
  * except for SLE 11 where autoreconf call is required
  * add licence file to main package</changelog>
  <changelog author="rpm@fthiessen.de" date="1468843200">- Update to upstream release 0.12.1
- Removed upstream fixed json-c-0.12-unused_variable_size.patch
- Added fix-set-but-not-used.patch</changelog>
  <changelog author="mliska@suse.cz" date="1490270400">- Added gcc7-fix.patch</changelog>
  <changelog author="avindra@opensuse.org" date="1514462400">- json-c 0.13
  + Deprecated and removed features:
  * Internal use of bits.h has been eliminated.
  * lh_abort() is deprecated
  + Behavior changes:
  * Tighten the number parsing algorithm to raise errors instead
    of truncating the results.  For example 12.3.4 or 2015-01-15,
    which now return null.
  * Use size_t for array length and size. Platforms where
    sizeof(size_t) != sizeof(int) may not be backwards compatible
  * Check for failue when allocating memory, returning NULL and
    errno=ENOMEM.
  * Change json_object_object_add() return type from void to int,
    and will return -1 on failures, instead of exiting. (Note:
    this is not an ABI change)
  + New features:
  * Aiming to follow RFC 7159 now.
  * Support for JSON pointer, RFC 6901 (see json_pointer.h)
  * Add a couple of additional option to json_object_to_json_string_ext:
  JSON_C_TO_STRING_PRETTY_TAB
  JSON_C_TO_STRING_NOSLASHESCAPE
  * json_object_object_add_ex() - better perf when certain
    constraints are known to be true
  * Serialization format of doubles now configurable
  * New functions
  - json_object_equal() - utility function for comparing
    json_objects
  - json_object_deep_copy() - a way to copy entire object
    trees
  - json_object_set_&lt;type&gt;() - modify the value of
    existing json_object's without the need to recreate them.
  Also add a json_object_int_inc function to adjust an int's'
  value.
  - json_util_get_last_err() - retrieve the string describing
    the cause of errors, instead of printing to stderr.
  - perllike hash function for strings
  * json_global_set_string_hash()
  * json_c_visit() - a way to iterate over a tree of json-c
    objects.
  + Notable bug fixes and other improvements:
  * Make reference increment and decrement atomic to allow
    passing json objects between threads.
  * Fix json_object_object_foreach to avoid uninitialized
    variable warnings.
  * Improve performance by removing unneeded data items from
    hashtable code and reducing duplicate hash computation.
  * Performance: store small strings inside json_object
  * Performance: of json_object_to_json_string by removing
    variadic printf
  * Fix parsing of "-Infinity", and avoid needlessly copying the
    input when doing so.
  * Fix stack buffer overflow in json_object_double_to_json_string_format()
  * Fix various potential null ptr deref and int32 overflows
  * Fix a long-standing bug in array_list_put_idx() where it
    would attempt to free previously free'd entries due to not
    checking the current array length.
  * use uselocale() instead of setlocale() in json_tokener to
    behave better in threaded environments.
  * Fix out of bounds read when handling unicode surrogate pairs.
  * Ensure doubles that happen to be a whole number are emitted
    with ".0"
  * Visual Studio: use a snprintf/vsnprintf wrapper that ensures
    the string is terminated.
  * Fix double to int cast overflow in json_object_get_int64.
  * Clamp double to int32 when narrowing in json_object_get_int.
  * Use strtoll() to parse ints - instead of sscanf
  * usual code linting
  + Build changes:
  * Add Appveyor and Travis build support
  * Support for MacOS and Windows through CMake
  * Silent build by default
  * Link against libm when needed
  * Add support for building with AddressSanitizer
  * Add support for building with Clang
  * Add a --enable-threading configure option, and only use the
    (slower) __sync_add_and_fetch()/__sync_sub_and_fetch()
    function when it is specified.
- cleanup with spec-cleaner
- remove fix-set-but-not-used.patch
  + fixed: https://github.com/json-c/json-c/issues/240
- remove gcc7-fix.patch
  + fixed in 014924ba899f659917bb64392bbff7d3c803afc2</changelog>
  <changelog author="ncutler@suse.com" date="1642161600">- Add patch bsc1171479.patch
  + fix integer overflow and out-of-bounds write (CVE-2020-12762, bsc#1171479)</changelog>
</package>
<package pkgid="13792c6b91b8452f935397f2d27f44c917cedfeac25c789330904b41e994e73d" name="libjson-c-devel" arch="s390x">
  <version epoch="0" ver="0.13" rel="3.3.1"/>
  <changelog author="bruno@ioda-net.ch" date="1362657600">- Update to 0.10 version :
  * Add a json_object_to_json_string_ext() function to allow output
  to be formatted in a more human readable form.
  * Add json_object_object_get_ex(), a NULL-safe get object method,
  to be able to distinguish between a key not present and the value
  being NULL.
  * Add an alternative iterator implementation, see json_object_iterator.h
  * Make json_object_iter public to enable external use of the
    json_object_object_foreachC macro.
  * Add a printbuf_memset() function to provide an effecient way to set and
    append things like whitespace indentation.
  * Adjust json_object_is_type and json_object_get_type so they return
    json_type_null for NULL objects and handle NULL passed to
    json_objct_object_get().
  * Rename boolean type to json_bool.
  * Fix various compile issues for Visual Studio and MinGW.
  * Allow json_tokener_parse_ex() to be re-used to parse multiple object.
    Also, fix some parsing issues with capitalized hexadecimal numbers and
    number in E notation.
  * Add json_tokener_get_error() and json_tokener_error_desc() to better
    encapsulate the process of retrieving errors while parsing.
  * Various improvements to the documentation of many functions.
  * Add new json_object_array_sort() function.
  * Fix a bug in json_object_get_int(), which would incorrectly return 0
    when called on a string type object.
    Eric Haszlakiewicz
  * Add a json_type_to_name() function.
    Eric Haszlakiewicz
  * Add a json_tokener_parse_verbose() function.
    Jehiah Czebotar
  * Improve support for null bytes within JSON strings.
    Jehiah Czebotar
  * Fix file descriptor leak if memory allocation fails in json_util
    Zachary Blair, zack_blair at hotmail dot com
  * Add int64 support. Two new functions json_object_net_int64 and
    json_object_get_int64. Binary compatibility preserved.
    Eric Haszlakiewicz, EHASZLA at transunion com
    Rui Miguel Silva Seabra, rms at 1407 dot org
  * Fix subtle bug in linkhash where lookup could hang after all slots
    were filled then successively freed.
    Spotted by Jean-Marc Naud, j dash m at newtraxtech dot com
  * Make json_object_from_file take const char *filename
    Spotted by Vikram Raj V, vsagar at attinteractive dot com
  * Add handling of surrogate pairs (json_tokener.c, test4.c, Makefile.am)
    Brent Miller, bdmiller at yahoo dash inc dot com
  * Correction to comment describing printbuf_memappend in printbuf.h
    Brent Miller, bdmiller at yahoo dash inc dot com
- Packaging :
  * upgrade upstream location https://gitub.com/json-c/json-c/wiki
  * cleanup old patches included now upstream
  . json-c-0.9-linkhash.patch
  . json-c-0.9-json_tokener.patch
  . json-c-0.9-json_object_from_file.patch
  . json-c-0.9-base.patch
  * Redone lfs patch against new 0.10 release
  * Removed empty NEWS file</changelog>
  <changelog author="coolo@suse.com" date="1362916800">- add json-c-fix-headers.patch from master branch to fix compilation
  of apps using the lib</changelog>
  <changelog author="fstrba@suse.com" date="1389009600">- Upgrade to 0.11 version:
  - SONAME change.
  - Fix provides and obsoletes accordingly
  - symlink the .pc file to the oldname for software that needs it
- Remove json-c-fix-headers.patch integrated upstream</changelog>
  <changelog author="jengelh@inai.de" date="1391515200">- Update metadata (description, RPM groups), and remove .la file
  in %install, not %check.</changelog>
  <changelog author="idonmez@suse.com" date="1396872000">- Add json-c-hash-dos-and-overflow-random-seed-4e.patch to fix
  CVE-2013-6370 and CVE-2013-6371 (bnc#870147)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1411214400">- json-c 0.12
  Fixes for security issues contained in this release have been
  previously patched into this package, but listed for completeness:
  * Address security issues:
  * CVE-2013-6371: hash collision denial of service
  * CVE-2013-6370: buffer overflow if size_t is larger than int
- Further changes:
  * Avoid potential overflow in json_object_get_double
  * Eliminate the mc_abort() function and MC_ABORT macro.
  * Make the json_tokener_errors array local.  It has been deprecated for
    a while, and json_tokener_error_desc() should be used instead.
  * change the floating point output format to %.17g so values with
    more than 6 digits show up in the output.
  * Remove the old libjson.so name compatibility support.  The library is
    only created as libjson-c.so now and headers are only installed
    into the ${prefix}/json-c directory.
  * When supported by the linker, add the -Bsymbolic-functions flag.
  * Make strict mode more strict:
  * number must not start with 0
  * no single-quote strings
  * no comments
  * trailing char not allowed
  * only allow lowercase literals
  * Added a json_object_new_double_s() convenience function to allow
    an exact string representation of a double to be specified when
    creating the object and use it in json_tokener_parse_ex() so
    a re-serialized object more exactly matches the input.
  * Add support NaN and Infinity
- packaging changes:
  * json-c-hash-dos-and-overflow-random-seed-4e.patch is upstream
  * Move from json-c-lfs.patch which removed warning errors and
    autoconf call to json-c-0.12-unused_variable_size.patch from
    upstream which fixes the warning
  * except for SLE 11 where autoreconf call is required
  * add licence file to main package</changelog>
  <changelog author="rpm@fthiessen.de" date="1468843200">- Update to upstream release 0.12.1
- Removed upstream fixed json-c-0.12-unused_variable_size.patch
- Added fix-set-but-not-used.patch</changelog>
  <changelog author="mliska@suse.cz" date="1490270400">- Added gcc7-fix.patch</changelog>
  <changelog author="avindra@opensuse.org" date="1514462400">- json-c 0.13
  + Deprecated and removed features:
  * Internal use of bits.h has been eliminated.
  * lh_abort() is deprecated
  + Behavior changes:
  * Tighten the number parsing algorithm to raise errors instead
    of truncating the results.  For example 12.3.4 or 2015-01-15,
    which now return null.
  * Use size_t for array length and size. Platforms where
    sizeof(size_t) != sizeof(int) may not be backwards compatible
  * Check for failue when allocating memory, returning NULL and
    errno=ENOMEM.
  * Change json_object_object_add() return type from void to int,
    and will return -1 on failures, instead of exiting. (Note:
    this is not an ABI change)
  + New features:
  * Aiming to follow RFC 7159 now.
  * Support for JSON pointer, RFC 6901 (see json_pointer.h)
  * Add a couple of additional option to json_object_to_json_string_ext:
  JSON_C_TO_STRING_PRETTY_TAB
  JSON_C_TO_STRING_NOSLASHESCAPE
  * json_object_object_add_ex() - better perf when certain
    constraints are known to be true
  * Serialization format of doubles now configurable
  * New functions
  - json_object_equal() - utility function for comparing
    json_objects
  - json_object_deep_copy() - a way to copy entire object
    trees
  - json_object_set_&lt;type&gt;() - modify the value of
    existing json_object's without the need to recreate them.
  Also add a json_object_int_inc function to adjust an int's'
  value.
  - json_util_get_last_err() - retrieve the string describing
    the cause of errors, instead of printing to stderr.
  - perllike hash function for strings
  * json_global_set_string_hash()
  * json_c_visit() - a way to iterate over a tree of json-c
    objects.
  + Notable bug fixes and other improvements:
  * Make reference increment and decrement atomic to allow
    passing json objects between threads.
  * Fix json_object_object_foreach to avoid uninitialized
    variable warnings.
  * Improve performance by removing unneeded data items from
    hashtable code and reducing duplicate hash computation.
  * Performance: store small strings inside json_object
  * Performance: of json_object_to_json_string by removing
    variadic printf
  * Fix parsing of "-Infinity", and avoid needlessly copying the
    input when doing so.
  * Fix stack buffer overflow in json_object_double_to_json_string_format()
  * Fix various potential null ptr deref and int32 overflows
  * Fix a long-standing bug in array_list_put_idx() where it
    would attempt to free previously free'd entries due to not
    checking the current array length.
  * use uselocale() instead of setlocale() in json_tokener to
    behave better in threaded environments.
  * Fix out of bounds read when handling unicode surrogate pairs.
  * Ensure doubles that happen to be a whole number are emitted
    with ".0"
  * Visual Studio: use a snprintf/vsnprintf wrapper that ensures
    the string is terminated.
  * Fix double to int cast overflow in json_object_get_int64.
  * Clamp double to int32 when narrowing in json_object_get_int.
  * Use strtoll() to parse ints - instead of sscanf
  * usual code linting
  + Build changes:
  * Add Appveyor and Travis build support
  * Support for MacOS and Windows through CMake
  * Silent build by default
  * Link against libm when needed
  * Add support for building with AddressSanitizer
  * Add support for building with Clang
  * Add a --enable-threading configure option, and only use the
    (slower) __sync_add_and_fetch()/__sync_sub_and_fetch()
    function when it is specified.
- cleanup with spec-cleaner
- remove fix-set-but-not-used.patch
  + fixed: https://github.com/json-c/json-c/issues/240
- remove gcc7-fix.patch
  + fixed in 014924ba899f659917bb64392bbff7d3c803afc2</changelog>
  <changelog author="ncutler@suse.com" date="1642161600">- Add patch bsc1171479.patch
  + fix integer overflow and out-of-bounds write (CVE-2020-12762, bsc#1171479)</changelog>
</package>
<package pkgid="be1d7468d23de55e12fc901293ca56ced52220feb599d80196ac7edfa796eb99" name="libjson-c-devel" arch="x86_64">
  <version epoch="0" ver="0.13" rel="3.3.1"/>
  <changelog author="bruno@ioda-net.ch" date="1362657600">- Update to 0.10 version :
  * Add a json_object_to_json_string_ext() function to allow output
  to be formatted in a more human readable form.
  * Add json_object_object_get_ex(), a NULL-safe get object method,
  to be able to distinguish between a key not present and the value
  being NULL.
  * Add an alternative iterator implementation, see json_object_iterator.h
  * Make json_object_iter public to enable external use of the
    json_object_object_foreachC macro.
  * Add a printbuf_memset() function to provide an effecient way to set and
    append things like whitespace indentation.
  * Adjust json_object_is_type and json_object_get_type so they return
    json_type_null for NULL objects and handle NULL passed to
    json_objct_object_get().
  * Rename boolean type to json_bool.
  * Fix various compile issues for Visual Studio and MinGW.
  * Allow json_tokener_parse_ex() to be re-used to parse multiple object.
    Also, fix some parsing issues with capitalized hexadecimal numbers and
    number in E notation.
  * Add json_tokener_get_error() and json_tokener_error_desc() to better
    encapsulate the process of retrieving errors while parsing.
  * Various improvements to the documentation of many functions.
  * Add new json_object_array_sort() function.
  * Fix a bug in json_object_get_int(), which would incorrectly return 0
    when called on a string type object.
    Eric Haszlakiewicz
  * Add a json_type_to_name() function.
    Eric Haszlakiewicz
  * Add a json_tokener_parse_verbose() function.
    Jehiah Czebotar
  * Improve support for null bytes within JSON strings.
    Jehiah Czebotar
  * Fix file descriptor leak if memory allocation fails in json_util
    Zachary Blair, zack_blair at hotmail dot com
  * Add int64 support. Two new functions json_object_net_int64 and
    json_object_get_int64. Binary compatibility preserved.
    Eric Haszlakiewicz, EHASZLA at transunion com
    Rui Miguel Silva Seabra, rms at 1407 dot org
  * Fix subtle bug in linkhash where lookup could hang after all slots
    were filled then successively freed.
    Spotted by Jean-Marc Naud, j dash m at newtraxtech dot com
  * Make json_object_from_file take const char *filename
    Spotted by Vikram Raj V, vsagar at attinteractive dot com
  * Add handling of surrogate pairs (json_tokener.c, test4.c, Makefile.am)
    Brent Miller, bdmiller at yahoo dash inc dot com
  * Correction to comment describing printbuf_memappend in printbuf.h
    Brent Miller, bdmiller at yahoo dash inc dot com
- Packaging :
  * upgrade upstream location https://gitub.com/json-c/json-c/wiki
  * cleanup old patches included now upstream
  . json-c-0.9-linkhash.patch
  . json-c-0.9-json_tokener.patch
  . json-c-0.9-json_object_from_file.patch
  . json-c-0.9-base.patch
  * Redone lfs patch against new 0.10 release
  * Removed empty NEWS file</changelog>
  <changelog author="coolo@suse.com" date="1362916800">- add json-c-fix-headers.patch from master branch to fix compilation
  of apps using the lib</changelog>
  <changelog author="fstrba@suse.com" date="1389009600">- Upgrade to 0.11 version:
  - SONAME change.
  - Fix provides and obsoletes accordingly
  - symlink the .pc file to the oldname for software that needs it
- Remove json-c-fix-headers.patch integrated upstream</changelog>
  <changelog author="jengelh@inai.de" date="1391515200">- Update metadata (description, RPM groups), and remove .la file
  in %install, not %check.</changelog>
  <changelog author="idonmez@suse.com" date="1396872000">- Add json-c-hash-dos-and-overflow-random-seed-4e.patch to fix
  CVE-2013-6370 and CVE-2013-6371 (bnc#870147)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1411214400">- json-c 0.12
  Fixes for security issues contained in this release have been
  previously patched into this package, but listed for completeness:
  * Address security issues:
  * CVE-2013-6371: hash collision denial of service
  * CVE-2013-6370: buffer overflow if size_t is larger than int
- Further changes:
  * Avoid potential overflow in json_object_get_double
  * Eliminate the mc_abort() function and MC_ABORT macro.
  * Make the json_tokener_errors array local.  It has been deprecated for
    a while, and json_tokener_error_desc() should be used instead.
  * change the floating point output format to %.17g so values with
    more than 6 digits show up in the output.
  * Remove the old libjson.so name compatibility support.  The library is
    only created as libjson-c.so now and headers are only installed
    into the ${prefix}/json-c directory.
  * When supported by the linker, add the -Bsymbolic-functions flag.
  * Make strict mode more strict:
  * number must not start with 0
  * no single-quote strings
  * no comments
  * trailing char not allowed
  * only allow lowercase literals
  * Added a json_object_new_double_s() convenience function to allow
    an exact string representation of a double to be specified when
    creating the object and use it in json_tokener_parse_ex() so
    a re-serialized object more exactly matches the input.
  * Add support NaN and Infinity
- packaging changes:
  * json-c-hash-dos-and-overflow-random-seed-4e.patch is upstream
  * Move from json-c-lfs.patch which removed warning errors and
    autoconf call to json-c-0.12-unused_variable_size.patch from
    upstream which fixes the warning
  * except for SLE 11 where autoreconf call is required
  * add licence file to main package</changelog>
  <changelog author="rpm@fthiessen.de" date="1468843200">- Update to upstream release 0.12.1
- Removed upstream fixed json-c-0.12-unused_variable_size.patch
- Added fix-set-but-not-used.patch</changelog>
  <changelog author="mliska@suse.cz" date="1490270400">- Added gcc7-fix.patch</changelog>
  <changelog author="avindra@opensuse.org" date="1514462400">- json-c 0.13
  + Deprecated and removed features:
  * Internal use of bits.h has been eliminated.
  * lh_abort() is deprecated
  + Behavior changes:
  * Tighten the number parsing algorithm to raise errors instead
    of truncating the results.  For example 12.3.4 or 2015-01-15,
    which now return null.
  * Use size_t for array length and size. Platforms where
    sizeof(size_t) != sizeof(int) may not be backwards compatible
  * Check for failue when allocating memory, returning NULL and
    errno=ENOMEM.
  * Change json_object_object_add() return type from void to int,
    and will return -1 on failures, instead of exiting. (Note:
    this is not an ABI change)
  + New features:
  * Aiming to follow RFC 7159 now.
  * Support for JSON pointer, RFC 6901 (see json_pointer.h)
  * Add a couple of additional option to json_object_to_json_string_ext:
  JSON_C_TO_STRING_PRETTY_TAB
  JSON_C_TO_STRING_NOSLASHESCAPE
  * json_object_object_add_ex() - better perf when certain
    constraints are known to be true
  * Serialization format of doubles now configurable
  * New functions
  - json_object_equal() - utility function for comparing
    json_objects
  - json_object_deep_copy() - a way to copy entire object
    trees
  - json_object_set_&lt;type&gt;() - modify the value of
    existing json_object's without the need to recreate them.
  Also add a json_object_int_inc function to adjust an int's'
  value.
  - json_util_get_last_err() - retrieve the string describing
    the cause of errors, instead of printing to stderr.
  - perllike hash function for strings
  * json_global_set_string_hash()
  * json_c_visit() - a way to iterate over a tree of json-c
    objects.
  + Notable bug fixes and other improvements:
  * Make reference increment and decrement atomic to allow
    passing json objects between threads.
  * Fix json_object_object_foreach to avoid uninitialized
    variable warnings.
  * Improve performance by removing unneeded data items from
    hashtable code and reducing duplicate hash computation.
  * Performance: store small strings inside json_object
  * Performance: of json_object_to_json_string by removing
    variadic printf
  * Fix parsing of "-Infinity", and avoid needlessly copying the
    input when doing so.
  * Fix stack buffer overflow in json_object_double_to_json_string_format()
  * Fix various potential null ptr deref and int32 overflows
  * Fix a long-standing bug in array_list_put_idx() where it
    would attempt to free previously free'd entries due to not
    checking the current array length.
  * use uselocale() instead of setlocale() in json_tokener to
    behave better in threaded environments.
  * Fix out of bounds read when handling unicode surrogate pairs.
  * Ensure doubles that happen to be a whole number are emitted
    with ".0"
  * Visual Studio: use a snprintf/vsnprintf wrapper that ensures
    the string is terminated.
  * Fix double to int cast overflow in json_object_get_int64.
  * Clamp double to int32 when narrowing in json_object_get_int.
  * Use strtoll() to parse ints - instead of sscanf
  * usual code linting
  + Build changes:
  * Add Appveyor and Travis build support
  * Support for MacOS and Windows through CMake
  * Silent build by default
  * Link against libm when needed
  * Add support for building with AddressSanitizer
  * Add support for building with Clang
  * Add a --enable-threading configure option, and only use the
    (slower) __sync_add_and_fetch()/__sync_sub_and_fetch()
    function when it is specified.
- cleanup with spec-cleaner
- remove fix-set-but-not-used.patch
  + fixed: https://github.com/json-c/json-c/issues/240
- remove gcc7-fix.patch
  + fixed in 014924ba899f659917bb64392bbff7d3c803afc2</changelog>
  <changelog author="ncutler@suse.com" date="1642161600">- Add patch bsc1171479.patch
  + fix integer overflow and out-of-bounds write (CVE-2020-12762, bsc#1171479)</changelog>
</package>
<package pkgid="8096fa4338184ab5015b156b7c852531371fae3bfdd103046b6181e553bab7a4" name="libjson-c-doc" arch="noarch">
  <version epoch="0" ver="0.13" rel="3.3.1"/>
  <changelog author="bruno@ioda-net.ch" date="1362657600">- Update to 0.10 version :
  * Add a json_object_to_json_string_ext() function to allow output
  to be formatted in a more human readable form.
  * Add json_object_object_get_ex(), a NULL-safe get object method,
  to be able to distinguish between a key not present and the value
  being NULL.
  * Add an alternative iterator implementation, see json_object_iterator.h
  * Make json_object_iter public to enable external use of the
    json_object_object_foreachC macro.
  * Add a printbuf_memset() function to provide an effecient way to set and
    append things like whitespace indentation.
  * Adjust json_object_is_type and json_object_get_type so they return
    json_type_null for NULL objects and handle NULL passed to
    json_objct_object_get().
  * Rename boolean type to json_bool.
  * Fix various compile issues for Visual Studio and MinGW.
  * Allow json_tokener_parse_ex() to be re-used to parse multiple object.
    Also, fix some parsing issues with capitalized hexadecimal numbers and
    number in E notation.
  * Add json_tokener_get_error() and json_tokener_error_desc() to better
    encapsulate the process of retrieving errors while parsing.
  * Various improvements to the documentation of many functions.
  * Add new json_object_array_sort() function.
  * Fix a bug in json_object_get_int(), which would incorrectly return 0
    when called on a string type object.
    Eric Haszlakiewicz
  * Add a json_type_to_name() function.
    Eric Haszlakiewicz
  * Add a json_tokener_parse_verbose() function.
    Jehiah Czebotar
  * Improve support for null bytes within JSON strings.
    Jehiah Czebotar
  * Fix file descriptor leak if memory allocation fails in json_util
    Zachary Blair, zack_blair at hotmail dot com
  * Add int64 support. Two new functions json_object_net_int64 and
    json_object_get_int64. Binary compatibility preserved.
    Eric Haszlakiewicz, EHASZLA at transunion com
    Rui Miguel Silva Seabra, rms at 1407 dot org
  * Fix subtle bug in linkhash where lookup could hang after all slots
    were filled then successively freed.
    Spotted by Jean-Marc Naud, j dash m at newtraxtech dot com
  * Make json_object_from_file take const char *filename
    Spotted by Vikram Raj V, vsagar at attinteractive dot com
  * Add handling of surrogate pairs (json_tokener.c, test4.c, Makefile.am)
    Brent Miller, bdmiller at yahoo dash inc dot com
  * Correction to comment describing printbuf_memappend in printbuf.h
    Brent Miller, bdmiller at yahoo dash inc dot com
- Packaging :
  * upgrade upstream location https://gitub.com/json-c/json-c/wiki
  * cleanup old patches included now upstream
  . json-c-0.9-linkhash.patch
  . json-c-0.9-json_tokener.patch
  . json-c-0.9-json_object_from_file.patch
  . json-c-0.9-base.patch
  * Redone lfs patch against new 0.10 release
  * Removed empty NEWS file</changelog>
  <changelog author="coolo@suse.com" date="1362916800">- add json-c-fix-headers.patch from master branch to fix compilation
  of apps using the lib</changelog>
  <changelog author="fstrba@suse.com" date="1389009600">- Upgrade to 0.11 version:
  - SONAME change.
  - Fix provides and obsoletes accordingly
  - symlink the .pc file to the oldname for software that needs it
- Remove json-c-fix-headers.patch integrated upstream</changelog>
  <changelog author="jengelh@inai.de" date="1391515200">- Update metadata (description, RPM groups), and remove .la file
  in %install, not %check.</changelog>
  <changelog author="idonmez@suse.com" date="1396872000">- Add json-c-hash-dos-and-overflow-random-seed-4e.patch to fix
  CVE-2013-6370 and CVE-2013-6371 (bnc#870147)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1411214400">- json-c 0.12
  Fixes for security issues contained in this release have been
  previously patched into this package, but listed for completeness:
  * Address security issues:
  * CVE-2013-6371: hash collision denial of service
  * CVE-2013-6370: buffer overflow if size_t is larger than int
- Further changes:
  * Avoid potential overflow in json_object_get_double
  * Eliminate the mc_abort() function and MC_ABORT macro.
  * Make the json_tokener_errors array local.  It has been deprecated for
    a while, and json_tokener_error_desc() should be used instead.
  * change the floating point output format to %.17g so values with
    more than 6 digits show up in the output.
  * Remove the old libjson.so name compatibility support.  The library is
    only created as libjson-c.so now and headers are only installed
    into the ${prefix}/json-c directory.
  * When supported by the linker, add the -Bsymbolic-functions flag.
  * Make strict mode more strict:
  * number must not start with 0
  * no single-quote strings
  * no comments
  * trailing char not allowed
  * only allow lowercase literals
  * Added a json_object_new_double_s() convenience function to allow
    an exact string representation of a double to be specified when
    creating the object and use it in json_tokener_parse_ex() so
    a re-serialized object more exactly matches the input.
  * Add support NaN and Infinity
- packaging changes:
  * json-c-hash-dos-and-overflow-random-seed-4e.patch is upstream
  * Move from json-c-lfs.patch which removed warning errors and
    autoconf call to json-c-0.12-unused_variable_size.patch from
    upstream which fixes the warning
  * except for SLE 11 where autoreconf call is required
  * add licence file to main package</changelog>
  <changelog author="rpm@fthiessen.de" date="1468843200">- Update to upstream release 0.12.1
- Removed upstream fixed json-c-0.12-unused_variable_size.patch
- Added fix-set-but-not-used.patch</changelog>
  <changelog author="mliska@suse.cz" date="1490270400">- Added gcc7-fix.patch</changelog>
  <changelog author="avindra@opensuse.org" date="1514462400">- json-c 0.13
  + Deprecated and removed features:
  * Internal use of bits.h has been eliminated.
  * lh_abort() is deprecated
  + Behavior changes:
  * Tighten the number parsing algorithm to raise errors instead
    of truncating the results.  For example 12.3.4 or 2015-01-15,
    which now return null.
  * Use size_t for array length and size. Platforms where
    sizeof(size_t) != sizeof(int) may not be backwards compatible
  * Check for failue when allocating memory, returning NULL and
    errno=ENOMEM.
  * Change json_object_object_add() return type from void to int,
    and will return -1 on failures, instead of exiting. (Note:
    this is not an ABI change)
  + New features:
  * Aiming to follow RFC 7159 now.
  * Support for JSON pointer, RFC 6901 (see json_pointer.h)
  * Add a couple of additional option to json_object_to_json_string_ext:
  JSON_C_TO_STRING_PRETTY_TAB
  JSON_C_TO_STRING_NOSLASHESCAPE
  * json_object_object_add_ex() - better perf when certain
    constraints are known to be true
  * Serialization format of doubles now configurable
  * New functions
  - json_object_equal() - utility function for comparing
    json_objects
  - json_object_deep_copy() - a way to copy entire object
    trees
  - json_object_set_&lt;type&gt;() - modify the value of
    existing json_object's without the need to recreate them.
  Also add a json_object_int_inc function to adjust an int's'
  value.
  - json_util_get_last_err() - retrieve the string describing
    the cause of errors, instead of printing to stderr.
  - perllike hash function for strings
  * json_global_set_string_hash()
  * json_c_visit() - a way to iterate over a tree of json-c
    objects.
  + Notable bug fixes and other improvements:
  * Make reference increment and decrement atomic to allow
    passing json objects between threads.
  * Fix json_object_object_foreach to avoid uninitialized
    variable warnings.
  * Improve performance by removing unneeded data items from
    hashtable code and reducing duplicate hash computation.
  * Performance: store small strings inside json_object
  * Performance: of json_object_to_json_string by removing
    variadic printf
  * Fix parsing of "-Infinity", and avoid needlessly copying the
    input when doing so.
  * Fix stack buffer overflow in json_object_double_to_json_string_format()
  * Fix various potential null ptr deref and int32 overflows
  * Fix a long-standing bug in array_list_put_idx() where it
    would attempt to free previously free'd entries due to not
    checking the current array length.
  * use uselocale() instead of setlocale() in json_tokener to
    behave better in threaded environments.
  * Fix out of bounds read when handling unicode surrogate pairs.
  * Ensure doubles that happen to be a whole number are emitted
    with ".0"
  * Visual Studio: use a snprintf/vsnprintf wrapper that ensures
    the string is terminated.
  * Fix double to int cast overflow in json_object_get_int64.
  * Clamp double to int32 when narrowing in json_object_get_int.
  * Use strtoll() to parse ints - instead of sscanf
  * usual code linting
  + Build changes:
  * Add Appveyor and Travis build support
  * Support for MacOS and Windows through CMake
  * Silent build by default
  * Link against libm when needed
  * Add support for building with AddressSanitizer
  * Add support for building with Clang
  * Add a --enable-threading configure option, and only use the
    (slower) __sync_add_and_fetch()/__sync_sub_and_fetch()
    function when it is specified.
- cleanup with spec-cleaner
- remove fix-set-but-not-used.patch
  + fixed: https://github.com/json-c/json-c/issues/240
- remove gcc7-fix.patch
  + fixed in 014924ba899f659917bb64392bbff7d3c803afc2</changelog>
  <changelog author="ncutler@suse.com" date="1642161600">- Add patch bsc1171479.patch
  + fix integer overflow and out-of-bounds write (CVE-2020-12762, bsc#1171479)</changelog>
</package>
<package pkgid="01f5a4bc3437418a3f8b26ececb5ead69564d75ebebcad1b7d299f20495d378d" name="libjson-c3" arch="aarch64">
  <version epoch="0" ver="0.13" rel="3.3.1"/>
  <changelog author="bruno@ioda-net.ch" date="1362657600">- Update to 0.10 version :
  * Add a json_object_to_json_string_ext() function to allow output
  to be formatted in a more human readable form.
  * Add json_object_object_get_ex(), a NULL-safe get object method,
  to be able to distinguish between a key not present and the value
  being NULL.
  * Add an alternative iterator implementation, see json_object_iterator.h
  * Make json_object_iter public to enable external use of the
    json_object_object_foreachC macro.
  * Add a printbuf_memset() function to provide an effecient way to set and
    append things like whitespace indentation.
  * Adjust json_object_is_type and json_object_get_type so they return
    json_type_null for NULL objects and handle NULL passed to
    json_objct_object_get().
  * Rename boolean type to json_bool.
  * Fix various compile issues for Visual Studio and MinGW.
  * Allow json_tokener_parse_ex() to be re-used to parse multiple object.
    Also, fix some parsing issues with capitalized hexadecimal numbers and
    number in E notation.
  * Add json_tokener_get_error() and json_tokener_error_desc() to better
    encapsulate the process of retrieving errors while parsing.
  * Various improvements to the documentation of many functions.
  * Add new json_object_array_sort() function.
  * Fix a bug in json_object_get_int(), which would incorrectly return 0
    when called on a string type object.
    Eric Haszlakiewicz
  * Add a json_type_to_name() function.
    Eric Haszlakiewicz
  * Add a json_tokener_parse_verbose() function.
    Jehiah Czebotar
  * Improve support for null bytes within JSON strings.
    Jehiah Czebotar
  * Fix file descriptor leak if memory allocation fails in json_util
    Zachary Blair, zack_blair at hotmail dot com
  * Add int64 support. Two new functions json_object_net_int64 and
    json_object_get_int64. Binary compatibility preserved.
    Eric Haszlakiewicz, EHASZLA at transunion com
    Rui Miguel Silva Seabra, rms at 1407 dot org
  * Fix subtle bug in linkhash where lookup could hang after all slots
    were filled then successively freed.
    Spotted by Jean-Marc Naud, j dash m at newtraxtech dot com
  * Make json_object_from_file take const char *filename
    Spotted by Vikram Raj V, vsagar at attinteractive dot com
  * Add handling of surrogate pairs (json_tokener.c, test4.c, Makefile.am)
    Brent Miller, bdmiller at yahoo dash inc dot com
  * Correction to comment describing printbuf_memappend in printbuf.h
    Brent Miller, bdmiller at yahoo dash inc dot com
- Packaging :
  * upgrade upstream location https://gitub.com/json-c/json-c/wiki
  * cleanup old patches included now upstream
  . json-c-0.9-linkhash.patch
  . json-c-0.9-json_tokener.patch
  . json-c-0.9-json_object_from_file.patch
  . json-c-0.9-base.patch
  * Redone lfs patch against new 0.10 release
  * Removed empty NEWS file</changelog>
  <changelog author="coolo@suse.com" date="1362916800">- add json-c-fix-headers.patch from master branch to fix compilation
  of apps using the lib</changelog>
  <changelog author="fstrba@suse.com" date="1389009600">- Upgrade to 0.11 version:
  - SONAME change.
  - Fix provides and obsoletes accordingly
  - symlink the .pc file to the oldname for software that needs it
- Remove json-c-fix-headers.patch integrated upstream</changelog>
  <changelog author="jengelh@inai.de" date="1391515200">- Update metadata (description, RPM groups), and remove .la file
  in %install, not %check.</changelog>
  <changelog author="idonmez@suse.com" date="1396872000">- Add json-c-hash-dos-and-overflow-random-seed-4e.patch to fix
  CVE-2013-6370 and CVE-2013-6371 (bnc#870147)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1411214400">- json-c 0.12
  Fixes for security issues contained in this release have been
  previously patched into this package, but listed for completeness:
  * Address security issues:
  * CVE-2013-6371: hash collision denial of service
  * CVE-2013-6370: buffer overflow if size_t is larger than int
- Further changes:
  * Avoid potential overflow in json_object_get_double
  * Eliminate the mc_abort() function and MC_ABORT macro.
  * Make the json_tokener_errors array local.  It has been deprecated for
    a while, and json_tokener_error_desc() should be used instead.
  * change the floating point output format to %.17g so values with
    more than 6 digits show up in the output.
  * Remove the old libjson.so name compatibility support.  The library is
    only created as libjson-c.so now and headers are only installed
    into the ${prefix}/json-c directory.
  * When supported by the linker, add the -Bsymbolic-functions flag.
  * Make strict mode more strict:
  * number must not start with 0
  * no single-quote strings
  * no comments
  * trailing char not allowed
  * only allow lowercase literals
  * Added a json_object_new_double_s() convenience function to allow
    an exact string representation of a double to be specified when
    creating the object and use it in json_tokener_parse_ex() so
    a re-serialized object more exactly matches the input.
  * Add support NaN and Infinity
- packaging changes:
  * json-c-hash-dos-and-overflow-random-seed-4e.patch is upstream
  * Move from json-c-lfs.patch which removed warning errors and
    autoconf call to json-c-0.12-unused_variable_size.patch from
    upstream which fixes the warning
  * except for SLE 11 where autoreconf call is required
  * add licence file to main package</changelog>
  <changelog author="rpm@fthiessen.de" date="1468843200">- Update to upstream release 0.12.1
- Removed upstream fixed json-c-0.12-unused_variable_size.patch
- Added fix-set-but-not-used.patch</changelog>
  <changelog author="mliska@suse.cz" date="1490270400">- Added gcc7-fix.patch</changelog>
  <changelog author="avindra@opensuse.org" date="1514462400">- json-c 0.13
  + Deprecated and removed features:
  * Internal use of bits.h has been eliminated.
  * lh_abort() is deprecated
  + Behavior changes:
  * Tighten the number parsing algorithm to raise errors instead
    of truncating the results.  For example 12.3.4 or 2015-01-15,
    which now return null.
  * Use size_t for array length and size. Platforms where
    sizeof(size_t) != sizeof(int) may not be backwards compatible
  * Check for failue when allocating memory, returning NULL and
    errno=ENOMEM.
  * Change json_object_object_add() return type from void to int,
    and will return -1 on failures, instead of exiting. (Note:
    this is not an ABI change)
  + New features:
  * Aiming to follow RFC 7159 now.
  * Support for JSON pointer, RFC 6901 (see json_pointer.h)
  * Add a couple of additional option to json_object_to_json_string_ext:
  JSON_C_TO_STRING_PRETTY_TAB
  JSON_C_TO_STRING_NOSLASHESCAPE
  * json_object_object_add_ex() - better perf when certain
    constraints are known to be true
  * Serialization format of doubles now configurable
  * New functions
  - json_object_equal() - utility function for comparing
    json_objects
  - json_object_deep_copy() - a way to copy entire object
    trees
  - json_object_set_&lt;type&gt;() - modify the value of
    existing json_object's without the need to recreate them.
  Also add a json_object_int_inc function to adjust an int's'
  value.
  - json_util_get_last_err() - retrieve the string describing
    the cause of errors, instead of printing to stderr.
  - perllike hash function for strings
  * json_global_set_string_hash()
  * json_c_visit() - a way to iterate over a tree of json-c
    objects.
  + Notable bug fixes and other improvements:
  * Make reference increment and decrement atomic to allow
    passing json objects between threads.
  * Fix json_object_object_foreach to avoid uninitialized
    variable warnings.
  * Improve performance by removing unneeded data items from
    hashtable code and reducing duplicate hash computation.
  * Performance: store small strings inside json_object
  * Performance: of json_object_to_json_string by removing
    variadic printf
  * Fix parsing of "-Infinity", and avoid needlessly copying the
    input when doing so.
  * Fix stack buffer overflow in json_object_double_to_json_string_format()
  * Fix various potential null ptr deref and int32 overflows
  * Fix a long-standing bug in array_list_put_idx() where it
    would attempt to free previously free'd entries due to not
    checking the current array length.
  * use uselocale() instead of setlocale() in json_tokener to
    behave better in threaded environments.
  * Fix out of bounds read when handling unicode surrogate pairs.
  * Ensure doubles that happen to be a whole number are emitted
    with ".0"
  * Visual Studio: use a snprintf/vsnprintf wrapper that ensures
    the string is terminated.
  * Fix double to int cast overflow in json_object_get_int64.
  * Clamp double to int32 when narrowing in json_object_get_int.
  * Use strtoll() to parse ints - instead of sscanf
  * usual code linting
  + Build changes:
  * Add Appveyor and Travis build support
  * Support for MacOS and Windows through CMake
  * Silent build by default
  * Link against libm when needed
  * Add support for building with AddressSanitizer
  * Add support for building with Clang
  * Add a --enable-threading configure option, and only use the
    (slower) __sync_add_and_fetch()/__sync_sub_and_fetch()
    function when it is specified.
- cleanup with spec-cleaner
- remove fix-set-but-not-used.patch
  + fixed: https://github.com/json-c/json-c/issues/240
- remove gcc7-fix.patch
  + fixed in 014924ba899f659917bb64392bbff7d3c803afc2</changelog>
  <changelog author="ncutler@suse.com" date="1642161600">- Add patch bsc1171479.patch
  + fix integer overflow and out-of-bounds write (CVE-2020-12762, bsc#1171479)</changelog>
</package>
<package pkgid="5e5be65a76fb1be776aadea7aee80a7dacf7dbd6488f1971a928073f6c3e83ce" name="libjson-c3" arch="ppc64le">
  <version epoch="0" ver="0.13" rel="3.3.1"/>
  <changelog author="bruno@ioda-net.ch" date="1362657600">- Update to 0.10 version :
  * Add a json_object_to_json_string_ext() function to allow output
  to be formatted in a more human readable form.
  * Add json_object_object_get_ex(), a NULL-safe get object method,
  to be able to distinguish between a key not present and the value
  being NULL.
  * Add an alternative iterator implementation, see json_object_iterator.h
  * Make json_object_iter public to enable external use of the
    json_object_object_foreachC macro.
  * Add a printbuf_memset() function to provide an effecient way to set and
    append things like whitespace indentation.
  * Adjust json_object_is_type and json_object_get_type so they return
    json_type_null for NULL objects and handle NULL passed to
    json_objct_object_get().
  * Rename boolean type to json_bool.
  * Fix various compile issues for Visual Studio and MinGW.
  * Allow json_tokener_parse_ex() to be re-used to parse multiple object.
    Also, fix some parsing issues with capitalized hexadecimal numbers and
    number in E notation.
  * Add json_tokener_get_error() and json_tokener_error_desc() to better
    encapsulate the process of retrieving errors while parsing.
  * Various improvements to the documentation of many functions.
  * Add new json_object_array_sort() function.
  * Fix a bug in json_object_get_int(), which would incorrectly return 0
    when called on a string type object.
    Eric Haszlakiewicz
  * Add a json_type_to_name() function.
    Eric Haszlakiewicz
  * Add a json_tokener_parse_verbose() function.
    Jehiah Czebotar
  * Improve support for null bytes within JSON strings.
    Jehiah Czebotar
  * Fix file descriptor leak if memory allocation fails in json_util
    Zachary Blair, zack_blair at hotmail dot com
  * Add int64 support. Two new functions json_object_net_int64 and
    json_object_get_int64. Binary compatibility preserved.
    Eric Haszlakiewicz, EHASZLA at transunion com
    Rui Miguel Silva Seabra, rms at 1407 dot org
  * Fix subtle bug in linkhash where lookup could hang after all slots
    were filled then successively freed.
    Spotted by Jean-Marc Naud, j dash m at newtraxtech dot com
  * Make json_object_from_file take const char *filename
    Spotted by Vikram Raj V, vsagar at attinteractive dot com
  * Add handling of surrogate pairs (json_tokener.c, test4.c, Makefile.am)
    Brent Miller, bdmiller at yahoo dash inc dot com
  * Correction to comment describing printbuf_memappend in printbuf.h
    Brent Miller, bdmiller at yahoo dash inc dot com
- Packaging :
  * upgrade upstream location https://gitub.com/json-c/json-c/wiki
  * cleanup old patches included now upstream
  . json-c-0.9-linkhash.patch
  . json-c-0.9-json_tokener.patch
  . json-c-0.9-json_object_from_file.patch
  . json-c-0.9-base.patch
  * Redone lfs patch against new 0.10 release
  * Removed empty NEWS file</changelog>
  <changelog author="coolo@suse.com" date="1362916800">- add json-c-fix-headers.patch from master branch to fix compilation
  of apps using the lib</changelog>
  <changelog author="fstrba@suse.com" date="1389009600">- Upgrade to 0.11 version:
  - SONAME change.
  - Fix provides and obsoletes accordingly
  - symlink the .pc file to the oldname for software that needs it
- Remove json-c-fix-headers.patch integrated upstream</changelog>
  <changelog author="jengelh@inai.de" date="1391515200">- Update metadata (description, RPM groups), and remove .la file
  in %install, not %check.</changelog>
  <changelog author="idonmez@suse.com" date="1396872000">- Add json-c-hash-dos-and-overflow-random-seed-4e.patch to fix
  CVE-2013-6370 and CVE-2013-6371 (bnc#870147)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1411214400">- json-c 0.12
  Fixes for security issues contained in this release have been
  previously patched into this package, but listed for completeness:
  * Address security issues:
  * CVE-2013-6371: hash collision denial of service
  * CVE-2013-6370: buffer overflow if size_t is larger than int
- Further changes:
  * Avoid potential overflow in json_object_get_double
  * Eliminate the mc_abort() function and MC_ABORT macro.
  * Make the json_tokener_errors array local.  It has been deprecated for
    a while, and json_tokener_error_desc() should be used instead.
  * change the floating point output format to %.17g so values with
    more than 6 digits show up in the output.
  * Remove the old libjson.so name compatibility support.  The library is
    only created as libjson-c.so now and headers are only installed
    into the ${prefix}/json-c directory.
  * When supported by the linker, add the -Bsymbolic-functions flag.
  * Make strict mode more strict:
  * number must not start with 0
  * no single-quote strings
  * no comments
  * trailing char not allowed
  * only allow lowercase literals
  * Added a json_object_new_double_s() convenience function to allow
    an exact string representation of a double to be specified when
    creating the object and use it in json_tokener_parse_ex() so
    a re-serialized object more exactly matches the input.
  * Add support NaN and Infinity
- packaging changes:
  * json-c-hash-dos-and-overflow-random-seed-4e.patch is upstream
  * Move from json-c-lfs.patch which removed warning errors and
    autoconf call to json-c-0.12-unused_variable_size.patch from
    upstream which fixes the warning
  * except for SLE 11 where autoreconf call is required
  * add licence file to main package</changelog>
  <changelog author="rpm@fthiessen.de" date="1468843200">- Update to upstream release 0.12.1
- Removed upstream fixed json-c-0.12-unused_variable_size.patch
- Added fix-set-but-not-used.patch</changelog>
  <changelog author="mliska@suse.cz" date="1490270400">- Added gcc7-fix.patch</changelog>
  <changelog author="avindra@opensuse.org" date="1514462400">- json-c 0.13
  + Deprecated and removed features:
  * Internal use of bits.h has been eliminated.
  * lh_abort() is deprecated
  + Behavior changes:
  * Tighten the number parsing algorithm to raise errors instead
    of truncating the results.  For example 12.3.4 or 2015-01-15,
    which now return null.
  * Use size_t for array length and size. Platforms where
    sizeof(size_t) != sizeof(int) may not be backwards compatible
  * Check for failue when allocating memory, returning NULL and
    errno=ENOMEM.
  * Change json_object_object_add() return type from void to int,
    and will return -1 on failures, instead of exiting. (Note:
    this is not an ABI change)
  + New features:
  * Aiming to follow RFC 7159 now.
  * Support for JSON pointer, RFC 6901 (see json_pointer.h)
  * Add a couple of additional option to json_object_to_json_string_ext:
  JSON_C_TO_STRING_PRETTY_TAB
  JSON_C_TO_STRING_NOSLASHESCAPE
  * json_object_object_add_ex() - better perf when certain
    constraints are known to be true
  * Serialization format of doubles now configurable
  * New functions
  - json_object_equal() - utility function for comparing
    json_objects
  - json_object_deep_copy() - a way to copy entire object
    trees
  - json_object_set_&lt;type&gt;() - modify the value of
    existing json_object's without the need to recreate them.
  Also add a json_object_int_inc function to adjust an int's'
  value.
  - json_util_get_last_err() - retrieve the string describing
    the cause of errors, instead of printing to stderr.
  - perllike hash function for strings
  * json_global_set_string_hash()
  * json_c_visit() - a way to iterate over a tree of json-c
    objects.
  + Notable bug fixes and other improvements:
  * Make reference increment and decrement atomic to allow
    passing json objects between threads.
  * Fix json_object_object_foreach to avoid uninitialized
    variable warnings.
  * Improve performance by removing unneeded data items from
    hashtable code and reducing duplicate hash computation.
  * Performance: store small strings inside json_object
  * Performance: of json_object_to_json_string by removing
    variadic printf
  * Fix parsing of "-Infinity", and avoid needlessly copying the
    input when doing so.
  * Fix stack buffer overflow in json_object_double_to_json_string_format()
  * Fix various potential null ptr deref and int32 overflows
  * Fix a long-standing bug in array_list_put_idx() where it
    would attempt to free previously free'd entries due to not
    checking the current array length.
  * use uselocale() instead of setlocale() in json_tokener to
    behave better in threaded environments.
  * Fix out of bounds read when handling unicode surrogate pairs.
  * Ensure doubles that happen to be a whole number are emitted
    with ".0"
  * Visual Studio: use a snprintf/vsnprintf wrapper that ensures
    the string is terminated.
  * Fix double to int cast overflow in json_object_get_int64.
  * Clamp double to int32 when narrowing in json_object_get_int.
  * Use strtoll() to parse ints - instead of sscanf
  * usual code linting
  + Build changes:
  * Add Appveyor and Travis build support
  * Support for MacOS and Windows through CMake
  * Silent build by default
  * Link against libm when needed
  * Add support for building with AddressSanitizer
  * Add support for building with Clang
  * Add a --enable-threading configure option, and only use the
    (slower) __sync_add_and_fetch()/__sync_sub_and_fetch()
    function when it is specified.
- cleanup with spec-cleaner
- remove fix-set-but-not-used.patch
  + fixed: https://github.com/json-c/json-c/issues/240
- remove gcc7-fix.patch
  + fixed in 014924ba899f659917bb64392bbff7d3c803afc2</changelog>
  <changelog author="ncutler@suse.com" date="1642161600">- Add patch bsc1171479.patch
  + fix integer overflow and out-of-bounds write (CVE-2020-12762, bsc#1171479)</changelog>
</package>
<package pkgid="a903ee3eeb578ec145b35e6399b576fa3023021a386a55340d2345172511ca0c" name="libjson-c3" arch="s390x">
  <version epoch="0" ver="0.13" rel="3.3.1"/>
  <changelog author="bruno@ioda-net.ch" date="1362657600">- Update to 0.10 version :
  * Add a json_object_to_json_string_ext() function to allow output
  to be formatted in a more human readable form.
  * Add json_object_object_get_ex(), a NULL-safe get object method,
  to be able to distinguish between a key not present and the value
  being NULL.
  * Add an alternative iterator implementation, see json_object_iterator.h
  * Make json_object_iter public to enable external use of the
    json_object_object_foreachC macro.
  * Add a printbuf_memset() function to provide an effecient way to set and
    append things like whitespace indentation.
  * Adjust json_object_is_type and json_object_get_type so they return
    json_type_null for NULL objects and handle NULL passed to
    json_objct_object_get().
  * Rename boolean type to json_bool.
  * Fix various compile issues for Visual Studio and MinGW.
  * Allow json_tokener_parse_ex() to be re-used to parse multiple object.
    Also, fix some parsing issues with capitalized hexadecimal numbers and
    number in E notation.
  * Add json_tokener_get_error() and json_tokener_error_desc() to better
    encapsulate the process of retrieving errors while parsing.
  * Various improvements to the documentation of many functions.
  * Add new json_object_array_sort() function.
  * Fix a bug in json_object_get_int(), which would incorrectly return 0
    when called on a string type object.
    Eric Haszlakiewicz
  * Add a json_type_to_name() function.
    Eric Haszlakiewicz
  * Add a json_tokener_parse_verbose() function.
    Jehiah Czebotar
  * Improve support for null bytes within JSON strings.
    Jehiah Czebotar
  * Fix file descriptor leak if memory allocation fails in json_util
    Zachary Blair, zack_blair at hotmail dot com
  * Add int64 support. Two new functions json_object_net_int64 and
    json_object_get_int64. Binary compatibility preserved.
    Eric Haszlakiewicz, EHASZLA at transunion com
    Rui Miguel Silva Seabra, rms at 1407 dot org
  * Fix subtle bug in linkhash where lookup could hang after all slots
    were filled then successively freed.
    Spotted by Jean-Marc Naud, j dash m at newtraxtech dot com
  * Make json_object_from_file take const char *filename
    Spotted by Vikram Raj V, vsagar at attinteractive dot com
  * Add handling of surrogate pairs (json_tokener.c, test4.c, Makefile.am)
    Brent Miller, bdmiller at yahoo dash inc dot com
  * Correction to comment describing printbuf_memappend in printbuf.h
    Brent Miller, bdmiller at yahoo dash inc dot com
- Packaging :
  * upgrade upstream location https://gitub.com/json-c/json-c/wiki
  * cleanup old patches included now upstream
  . json-c-0.9-linkhash.patch
  . json-c-0.9-json_tokener.patch
  . json-c-0.9-json_object_from_file.patch
  . json-c-0.9-base.patch
  * Redone lfs patch against new 0.10 release
  * Removed empty NEWS file</changelog>
  <changelog author="coolo@suse.com" date="1362916800">- add json-c-fix-headers.patch from master branch to fix compilation
  of apps using the lib</changelog>
  <changelog author="fstrba@suse.com" date="1389009600">- Upgrade to 0.11 version:
  - SONAME change.
  - Fix provides and obsoletes accordingly
  - symlink the .pc file to the oldname for software that needs it
- Remove json-c-fix-headers.patch integrated upstream</changelog>
  <changelog author="jengelh@inai.de" date="1391515200">- Update metadata (description, RPM groups), and remove .la file
  in %install, not %check.</changelog>
  <changelog author="idonmez@suse.com" date="1396872000">- Add json-c-hash-dos-and-overflow-random-seed-4e.patch to fix
  CVE-2013-6370 and CVE-2013-6371 (bnc#870147)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1411214400">- json-c 0.12
  Fixes for security issues contained in this release have been
  previously patched into this package, but listed for completeness:
  * Address security issues:
  * CVE-2013-6371: hash collision denial of service
  * CVE-2013-6370: buffer overflow if size_t is larger than int
- Further changes:
  * Avoid potential overflow in json_object_get_double
  * Eliminate the mc_abort() function and MC_ABORT macro.
  * Make the json_tokener_errors array local.  It has been deprecated for
    a while, and json_tokener_error_desc() should be used instead.
  * change the floating point output format to %.17g so values with
    more than 6 digits show up in the output.
  * Remove the old libjson.so name compatibility support.  The library is
    only created as libjson-c.so now and headers are only installed
    into the ${prefix}/json-c directory.
  * When supported by the linker, add the -Bsymbolic-functions flag.
  * Make strict mode more strict:
  * number must not start with 0
  * no single-quote strings
  * no comments
  * trailing char not allowed
  * only allow lowercase literals
  * Added a json_object_new_double_s() convenience function to allow
    an exact string representation of a double to be specified when
    creating the object and use it in json_tokener_parse_ex() so
    a re-serialized object more exactly matches the input.
  * Add support NaN and Infinity
- packaging changes:
  * json-c-hash-dos-and-overflow-random-seed-4e.patch is upstream
  * Move from json-c-lfs.patch which removed warning errors and
    autoconf call to json-c-0.12-unused_variable_size.patch from
    upstream which fixes the warning
  * except for SLE 11 where autoreconf call is required
  * add licence file to main package</changelog>
  <changelog author="rpm@fthiessen.de" date="1468843200">- Update to upstream release 0.12.1
- Removed upstream fixed json-c-0.12-unused_variable_size.patch
- Added fix-set-but-not-used.patch</changelog>
  <changelog author="mliska@suse.cz" date="1490270400">- Added gcc7-fix.patch</changelog>
  <changelog author="avindra@opensuse.org" date="1514462400">- json-c 0.13
  + Deprecated and removed features:
  * Internal use of bits.h has been eliminated.
  * lh_abort() is deprecated
  + Behavior changes:
  * Tighten the number parsing algorithm to raise errors instead
    of truncating the results.  For example 12.3.4 or 2015-01-15,
    which now return null.
  * Use size_t for array length and size. Platforms where
    sizeof(size_t) != sizeof(int) may not be backwards compatible
  * Check for failue when allocating memory, returning NULL and
    errno=ENOMEM.
  * Change json_object_object_add() return type from void to int,
    and will return -1 on failures, instead of exiting. (Note:
    this is not an ABI change)
  + New features:
  * Aiming to follow RFC 7159 now.
  * Support for JSON pointer, RFC 6901 (see json_pointer.h)
  * Add a couple of additional option to json_object_to_json_string_ext:
  JSON_C_TO_STRING_PRETTY_TAB
  JSON_C_TO_STRING_NOSLASHESCAPE
  * json_object_object_add_ex() - better perf when certain
    constraints are known to be true
  * Serialization format of doubles now configurable
  * New functions
  - json_object_equal() - utility function for comparing
    json_objects
  - json_object_deep_copy() - a way to copy entire object
    trees
  - json_object_set_&lt;type&gt;() - modify the value of
    existing json_object's without the need to recreate them.
  Also add a json_object_int_inc function to adjust an int's'
  value.
  - json_util_get_last_err() - retrieve the string describing
    the cause of errors, instead of printing to stderr.
  - perllike hash function for strings
  * json_global_set_string_hash()
  * json_c_visit() - a way to iterate over a tree of json-c
    objects.
  + Notable bug fixes and other improvements:
  * Make reference increment and decrement atomic to allow
    passing json objects between threads.
  * Fix json_object_object_foreach to avoid uninitialized
    variable warnings.
  * Improve performance by removing unneeded data items from
    hashtable code and reducing duplicate hash computation.
  * Performance: store small strings inside json_object
  * Performance: of json_object_to_json_string by removing
    variadic printf
  * Fix parsing of "-Infinity", and avoid needlessly copying the
    input when doing so.
  * Fix stack buffer overflow in json_object_double_to_json_string_format()
  * Fix various potential null ptr deref and int32 overflows
  * Fix a long-standing bug in array_list_put_idx() where it
    would attempt to free previously free'd entries due to not
    checking the current array length.
  * use uselocale() instead of setlocale() in json_tokener to
    behave better in threaded environments.
  * Fix out of bounds read when handling unicode surrogate pairs.
  * Ensure doubles that happen to be a whole number are emitted
    with ".0"
  * Visual Studio: use a snprintf/vsnprintf wrapper that ensures
    the string is terminated.
  * Fix double to int cast overflow in json_object_get_int64.
  * Clamp double to int32 when narrowing in json_object_get_int.
  * Use strtoll() to parse ints - instead of sscanf
  * usual code linting
  + Build changes:
  * Add Appveyor and Travis build support
  * Support for MacOS and Windows through CMake
  * Silent build by default
  * Link against libm when needed
  * Add support for building with AddressSanitizer
  * Add support for building with Clang
  * Add a --enable-threading configure option, and only use the
    (slower) __sync_add_and_fetch()/__sync_sub_and_fetch()
    function when it is specified.
- cleanup with spec-cleaner
- remove fix-set-but-not-used.patch
  + fixed: https://github.com/json-c/json-c/issues/240
- remove gcc7-fix.patch
  + fixed in 014924ba899f659917bb64392bbff7d3c803afc2</changelog>
  <changelog author="ncutler@suse.com" date="1642161600">- Add patch bsc1171479.patch
  + fix integer overflow and out-of-bounds write (CVE-2020-12762, bsc#1171479)</changelog>
</package>
<package pkgid="c57ea3e167cc68bbe14eb0fdfb6e2afc806629f4ffdd4590e06a569f770690c2" name="libjson-c3" arch="x86_64">
  <version epoch="0" ver="0.13" rel="3.3.1"/>
  <changelog author="bruno@ioda-net.ch" date="1362657600">- Update to 0.10 version :
  * Add a json_object_to_json_string_ext() function to allow output
  to be formatted in a more human readable form.
  * Add json_object_object_get_ex(), a NULL-safe get object method,
  to be able to distinguish between a key not present and the value
  being NULL.
  * Add an alternative iterator implementation, see json_object_iterator.h
  * Make json_object_iter public to enable external use of the
    json_object_object_foreachC macro.
  * Add a printbuf_memset() function to provide an effecient way to set and
    append things like whitespace indentation.
  * Adjust json_object_is_type and json_object_get_type so they return
    json_type_null for NULL objects and handle NULL passed to
    json_objct_object_get().
  * Rename boolean type to json_bool.
  * Fix various compile issues for Visual Studio and MinGW.
  * Allow json_tokener_parse_ex() to be re-used to parse multiple object.
    Also, fix some parsing issues with capitalized hexadecimal numbers and
    number in E notation.
  * Add json_tokener_get_error() and json_tokener_error_desc() to better
    encapsulate the process of retrieving errors while parsing.
  * Various improvements to the documentation of many functions.
  * Add new json_object_array_sort() function.
  * Fix a bug in json_object_get_int(), which would incorrectly return 0
    when called on a string type object.
    Eric Haszlakiewicz
  * Add a json_type_to_name() function.
    Eric Haszlakiewicz
  * Add a json_tokener_parse_verbose() function.
    Jehiah Czebotar
  * Improve support for null bytes within JSON strings.
    Jehiah Czebotar
  * Fix file descriptor leak if memory allocation fails in json_util
    Zachary Blair, zack_blair at hotmail dot com
  * Add int64 support. Two new functions json_object_net_int64 and
    json_object_get_int64. Binary compatibility preserved.
    Eric Haszlakiewicz, EHASZLA at transunion com
    Rui Miguel Silva Seabra, rms at 1407 dot org
  * Fix subtle bug in linkhash where lookup could hang after all slots
    were filled then successively freed.
    Spotted by Jean-Marc Naud, j dash m at newtraxtech dot com
  * Make json_object_from_file take const char *filename
    Spotted by Vikram Raj V, vsagar at attinteractive dot com
  * Add handling of surrogate pairs (json_tokener.c, test4.c, Makefile.am)
    Brent Miller, bdmiller at yahoo dash inc dot com
  * Correction to comment describing printbuf_memappend in printbuf.h
    Brent Miller, bdmiller at yahoo dash inc dot com
- Packaging :
  * upgrade upstream location https://gitub.com/json-c/json-c/wiki
  * cleanup old patches included now upstream
  . json-c-0.9-linkhash.patch
  . json-c-0.9-json_tokener.patch
  . json-c-0.9-json_object_from_file.patch
  . json-c-0.9-base.patch
  * Redone lfs patch against new 0.10 release
  * Removed empty NEWS file</changelog>
  <changelog author="coolo@suse.com" date="1362916800">- add json-c-fix-headers.patch from master branch to fix compilation
  of apps using the lib</changelog>
  <changelog author="fstrba@suse.com" date="1389009600">- Upgrade to 0.11 version:
  - SONAME change.
  - Fix provides and obsoletes accordingly
  - symlink the .pc file to the oldname for software that needs it
- Remove json-c-fix-headers.patch integrated upstream</changelog>
  <changelog author="jengelh@inai.de" date="1391515200">- Update metadata (description, RPM groups), and remove .la file
  in %install, not %check.</changelog>
  <changelog author="idonmez@suse.com" date="1396872000">- Add json-c-hash-dos-and-overflow-random-seed-4e.patch to fix
  CVE-2013-6370 and CVE-2013-6371 (bnc#870147)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1411214400">- json-c 0.12
  Fixes for security issues contained in this release have been
  previously patched into this package, but listed for completeness:
  * Address security issues:
  * CVE-2013-6371: hash collision denial of service
  * CVE-2013-6370: buffer overflow if size_t is larger than int
- Further changes:
  * Avoid potential overflow in json_object_get_double
  * Eliminate the mc_abort() function and MC_ABORT macro.
  * Make the json_tokener_errors array local.  It has been deprecated for
    a while, and json_tokener_error_desc() should be used instead.
  * change the floating point output format to %.17g so values with
    more than 6 digits show up in the output.
  * Remove the old libjson.so name compatibility support.  The library is
    only created as libjson-c.so now and headers are only installed
    into the ${prefix}/json-c directory.
  * When supported by the linker, add the -Bsymbolic-functions flag.
  * Make strict mode more strict:
  * number must not start with 0
  * no single-quote strings
  * no comments
  * trailing char not allowed
  * only allow lowercase literals
  * Added a json_object_new_double_s() convenience function to allow
    an exact string representation of a double to be specified when
    creating the object and use it in json_tokener_parse_ex() so
    a re-serialized object more exactly matches the input.
  * Add support NaN and Infinity
- packaging changes:
  * json-c-hash-dos-and-overflow-random-seed-4e.patch is upstream
  * Move from json-c-lfs.patch which removed warning errors and
    autoconf call to json-c-0.12-unused_variable_size.patch from
    upstream which fixes the warning
  * except for SLE 11 where autoreconf call is required
  * add licence file to main package</changelog>
  <changelog author="rpm@fthiessen.de" date="1468843200">- Update to upstream release 0.12.1
- Removed upstream fixed json-c-0.12-unused_variable_size.patch
- Added fix-set-but-not-used.patch</changelog>
  <changelog author="mliska@suse.cz" date="1490270400">- Added gcc7-fix.patch</changelog>
  <changelog author="avindra@opensuse.org" date="1514462400">- json-c 0.13
  + Deprecated and removed features:
  * Internal use of bits.h has been eliminated.
  * lh_abort() is deprecated
  + Behavior changes:
  * Tighten the number parsing algorithm to raise errors instead
    of truncating the results.  For example 12.3.4 or 2015-01-15,
    which now return null.
  * Use size_t for array length and size. Platforms where
    sizeof(size_t) != sizeof(int) may not be backwards compatible
  * Check for failue when allocating memory, returning NULL and
    errno=ENOMEM.
  * Change json_object_object_add() return type from void to int,
    and will return -1 on failures, instead of exiting. (Note:
    this is not an ABI change)
  + New features:
  * Aiming to follow RFC 7159 now.
  * Support for JSON pointer, RFC 6901 (see json_pointer.h)
  * Add a couple of additional option to json_object_to_json_string_ext:
  JSON_C_TO_STRING_PRETTY_TAB
  JSON_C_TO_STRING_NOSLASHESCAPE
  * json_object_object_add_ex() - better perf when certain
    constraints are known to be true
  * Serialization format of doubles now configurable
  * New functions
  - json_object_equal() - utility function for comparing
    json_objects
  - json_object_deep_copy() - a way to copy entire object
    trees
  - json_object_set_&lt;type&gt;() - modify the value of
    existing json_object's without the need to recreate them.
  Also add a json_object_int_inc function to adjust an int's'
  value.
  - json_util_get_last_err() - retrieve the string describing
    the cause of errors, instead of printing to stderr.
  - perllike hash function for strings
  * json_global_set_string_hash()
  * json_c_visit() - a way to iterate over a tree of json-c
    objects.
  + Notable bug fixes and other improvements:
  * Make reference increment and decrement atomic to allow
    passing json objects between threads.
  * Fix json_object_object_foreach to avoid uninitialized
    variable warnings.
  * Improve performance by removing unneeded data items from
    hashtable code and reducing duplicate hash computation.
  * Performance: store small strings inside json_object
  * Performance: of json_object_to_json_string by removing
    variadic printf
  * Fix parsing of "-Infinity", and avoid needlessly copying the
    input when doing so.
  * Fix stack buffer overflow in json_object_double_to_json_string_format()
  * Fix various potential null ptr deref and int32 overflows
  * Fix a long-standing bug in array_list_put_idx() where it
    would attempt to free previously free'd entries due to not
    checking the current array length.
  * use uselocale() instead of setlocale() in json_tokener to
    behave better in threaded environments.
  * Fix out of bounds read when handling unicode surrogate pairs.
  * Ensure doubles that happen to be a whole number are emitted
    with ".0"
  * Visual Studio: use a snprintf/vsnprintf wrapper that ensures
    the string is terminated.
  * Fix double to int cast overflow in json_object_get_int64.
  * Clamp double to int32 when narrowing in json_object_get_int.
  * Use strtoll() to parse ints - instead of sscanf
  * usual code linting
  + Build changes:
  * Add Appveyor and Travis build support
  * Support for MacOS and Windows through CMake
  * Silent build by default
  * Link against libm when needed
  * Add support for building with AddressSanitizer
  * Add support for building with Clang
  * Add a --enable-threading configure option, and only use the
    (slower) __sync_add_and_fetch()/__sync_sub_and_fetch()
    function when it is specified.
- cleanup with spec-cleaner
- remove fix-set-but-not-used.patch
  + fixed: https://github.com/json-c/json-c/issues/240
- remove gcc7-fix.patch
  + fixed in 014924ba899f659917bb64392bbff7d3c803afc2</changelog>
  <changelog author="ncutler@suse.com" date="1642161600">- Add patch bsc1171479.patch
  + fix integer overflow and out-of-bounds write (CVE-2020-12762, bsc#1171479)</changelog>
</package>
<package pkgid="6c35d51a0344725a3c5476a7e25f803e31713ab8829d2641ddf1a821ed3f2bf5" name="libjson-c3-32bit" arch="x86_64">
  <version epoch="0" ver="0.13" rel="3.3.1"/>
  <changelog author="bruno@ioda-net.ch" date="1362657600">- Update to 0.10 version :
  * Add a json_object_to_json_string_ext() function to allow output
  to be formatted in a more human readable form.
  * Add json_object_object_get_ex(), a NULL-safe get object method,
  to be able to distinguish between a key not present and the value
  being NULL.
  * Add an alternative iterator implementation, see json_object_iterator.h
  * Make json_object_iter public to enable external use of the
    json_object_object_foreachC macro.
  * Add a printbuf_memset() function to provide an effecient way to set and
    append things like whitespace indentation.
  * Adjust json_object_is_type and json_object_get_type so they return
    json_type_null for NULL objects and handle NULL passed to
    json_objct_object_get().
  * Rename boolean type to json_bool.
  * Fix various compile issues for Visual Studio and MinGW.
  * Allow json_tokener_parse_ex() to be re-used to parse multiple object.
    Also, fix some parsing issues with capitalized hexadecimal numbers and
    number in E notation.
  * Add json_tokener_get_error() and json_tokener_error_desc() to better
    encapsulate the process of retrieving errors while parsing.
  * Various improvements to the documentation of many functions.
  * Add new json_object_array_sort() function.
  * Fix a bug in json_object_get_int(), which would incorrectly return 0
    when called on a string type object.
    Eric Haszlakiewicz
  * Add a json_type_to_name() function.
    Eric Haszlakiewicz
  * Add a json_tokener_parse_verbose() function.
    Jehiah Czebotar
  * Improve support for null bytes within JSON strings.
    Jehiah Czebotar
  * Fix file descriptor leak if memory allocation fails in json_util
    Zachary Blair, zack_blair at hotmail dot com
  * Add int64 support. Two new functions json_object_net_int64 and
    json_object_get_int64. Binary compatibility preserved.
    Eric Haszlakiewicz, EHASZLA at transunion com
    Rui Miguel Silva Seabra, rms at 1407 dot org
  * Fix subtle bug in linkhash where lookup could hang after all slots
    were filled then successively freed.
    Spotted by Jean-Marc Naud, j dash m at newtraxtech dot com
  * Make json_object_from_file take const char *filename
    Spotted by Vikram Raj V, vsagar at attinteractive dot com
  * Add handling of surrogate pairs (json_tokener.c, test4.c, Makefile.am)
    Brent Miller, bdmiller at yahoo dash inc dot com
  * Correction to comment describing printbuf_memappend in printbuf.h
    Brent Miller, bdmiller at yahoo dash inc dot com
- Packaging :
  * upgrade upstream location https://gitub.com/json-c/json-c/wiki
  * cleanup old patches included now upstream
  . json-c-0.9-linkhash.patch
  . json-c-0.9-json_tokener.patch
  . json-c-0.9-json_object_from_file.patch
  . json-c-0.9-base.patch
  * Redone lfs patch against new 0.10 release
  * Removed empty NEWS file</changelog>
  <changelog author="coolo@suse.com" date="1362916800">- add json-c-fix-headers.patch from master branch to fix compilation
  of apps using the lib</changelog>
  <changelog author="fstrba@suse.com" date="1389009600">- Upgrade to 0.11 version:
  - SONAME change.
  - Fix provides and obsoletes accordingly
  - symlink the .pc file to the oldname for software that needs it
- Remove json-c-fix-headers.patch integrated upstream</changelog>
  <changelog author="jengelh@inai.de" date="1391515200">- Update metadata (description, RPM groups), and remove .la file
  in %install, not %check.</changelog>
  <changelog author="idonmez@suse.com" date="1396872000">- Add json-c-hash-dos-and-overflow-random-seed-4e.patch to fix
  CVE-2013-6370 and CVE-2013-6371 (bnc#870147)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1411214400">- json-c 0.12
  Fixes for security issues contained in this release have been
  previously patched into this package, but listed for completeness:
  * Address security issues:
  * CVE-2013-6371: hash collision denial of service
  * CVE-2013-6370: buffer overflow if size_t is larger than int
- Further changes:
  * Avoid potential overflow in json_object_get_double
  * Eliminate the mc_abort() function and MC_ABORT macro.
  * Make the json_tokener_errors array local.  It has been deprecated for
    a while, and json_tokener_error_desc() should be used instead.
  * change the floating point output format to %.17g so values with
    more than 6 digits show up in the output.
  * Remove the old libjson.so name compatibility support.  The library is
    only created as libjson-c.so now and headers are only installed
    into the ${prefix}/json-c directory.
  * When supported by the linker, add the -Bsymbolic-functions flag.
  * Make strict mode more strict:
  * number must not start with 0
  * no single-quote strings
  * no comments
  * trailing char not allowed
  * only allow lowercase literals
  * Added a json_object_new_double_s() convenience function to allow
    an exact string representation of a double to be specified when
    creating the object and use it in json_tokener_parse_ex() so
    a re-serialized object more exactly matches the input.
  * Add support NaN and Infinity
- packaging changes:
  * json-c-hash-dos-and-overflow-random-seed-4e.patch is upstream
  * Move from json-c-lfs.patch which removed warning errors and
    autoconf call to json-c-0.12-unused_variable_size.patch from
    upstream which fixes the warning
  * except for SLE 11 where autoreconf call is required
  * add licence file to main package</changelog>
  <changelog author="rpm@fthiessen.de" date="1468843200">- Update to upstream release 0.12.1
- Removed upstream fixed json-c-0.12-unused_variable_size.patch
- Added fix-set-but-not-used.patch</changelog>
  <changelog author="mliska@suse.cz" date="1490270400">- Added gcc7-fix.patch</changelog>
  <changelog author="avindra@opensuse.org" date="1514462400">- json-c 0.13
  + Deprecated and removed features:
  * Internal use of bits.h has been eliminated.
  * lh_abort() is deprecated
  + Behavior changes:
  * Tighten the number parsing algorithm to raise errors instead
    of truncating the results.  For example 12.3.4 or 2015-01-15,
    which now return null.
  * Use size_t for array length and size. Platforms where
    sizeof(size_t) != sizeof(int) may not be backwards compatible
  * Check for failue when allocating memory, returning NULL and
    errno=ENOMEM.
  * Change json_object_object_add() return type from void to int,
    and will return -1 on failures, instead of exiting. (Note:
    this is not an ABI change)
  + New features:
  * Aiming to follow RFC 7159 now.
  * Support for JSON pointer, RFC 6901 (see json_pointer.h)
  * Add a couple of additional option to json_object_to_json_string_ext:
  JSON_C_TO_STRING_PRETTY_TAB
  JSON_C_TO_STRING_NOSLASHESCAPE
  * json_object_object_add_ex() - better perf when certain
    constraints are known to be true
  * Serialization format of doubles now configurable
  * New functions
  - json_object_equal() - utility function for comparing
    json_objects
  - json_object_deep_copy() - a way to copy entire object
    trees
  - json_object_set_&lt;type&gt;() - modify the value of
    existing json_object's without the need to recreate them.
  Also add a json_object_int_inc function to adjust an int's'
  value.
  - json_util_get_last_err() - retrieve the string describing
    the cause of errors, instead of printing to stderr.
  - perllike hash function for strings
  * json_global_set_string_hash()
  * json_c_visit() - a way to iterate over a tree of json-c
    objects.
  + Notable bug fixes and other improvements:
  * Make reference increment and decrement atomic to allow
    passing json objects between threads.
  * Fix json_object_object_foreach to avoid uninitialized
    variable warnings.
  * Improve performance by removing unneeded data items from
    hashtable code and reducing duplicate hash computation.
  * Performance: store small strings inside json_object
  * Performance: of json_object_to_json_string by removing
    variadic printf
  * Fix parsing of "-Infinity", and avoid needlessly copying the
    input when doing so.
  * Fix stack buffer overflow in json_object_double_to_json_string_format()
  * Fix various potential null ptr deref and int32 overflows
  * Fix a long-standing bug in array_list_put_idx() where it
    would attempt to free previously free'd entries due to not
    checking the current array length.
  * use uselocale() instead of setlocale() in json_tokener to
    behave better in threaded environments.
  * Fix out of bounds read when handling unicode surrogate pairs.
  * Ensure doubles that happen to be a whole number are emitted
    with ".0"
  * Visual Studio: use a snprintf/vsnprintf wrapper that ensures
    the string is terminated.
  * Fix double to int cast overflow in json_object_get_int64.
  * Clamp double to int32 when narrowing in json_object_get_int.
  * Use strtoll() to parse ints - instead of sscanf
  * usual code linting
  + Build changes:
  * Add Appveyor and Travis build support
  * Support for MacOS and Windows through CMake
  * Silent build by default
  * Link against libm when needed
  * Add support for building with AddressSanitizer
  * Add support for building with Clang
  * Add a --enable-threading configure option, and only use the
    (slower) __sync_add_and_fetch()/__sync_sub_and_fetch()
    function when it is specified.
- cleanup with spec-cleaner
- remove fix-set-but-not-used.patch
  + fixed: https://github.com/json-c/json-c/issues/240
- remove gcc7-fix.patch
  + fixed in 014924ba899f659917bb64392bbff7d3c803afc2</changelog>
  <changelog author="ncutler@suse.com" date="1642161600">- Add patch bsc1171479.patch
  + fix integer overflow and out-of-bounds write (CVE-2020-12762, bsc#1171479)</changelog>
</package>
<package pkgid="f1c5c163fa665f87d03efba5720dd50104da671e9bca2e8846ac0cf77b881dc6" name="libmspack" arch="src">
  <version epoch="0" ver="0.6" rel="3.14.1"/>
  <changelog author="jengelh@medozas.de" date="1321790400">- Remove redundant/unwanted tags/section (cf. specfile guidelines)
- Use %_smp_mflags for parallel building</changelog>
  <changelog author="coolo@suse.com" date="1329134400">- patch license to follow spdx.org standard</changelog>
  <changelog author="cfarrell@suse.com" date="1330344000">- license update: LGPL-2.1+
  No indication of GPL-2.0+ code in the package</changelog>
  <changelog author="sbrabec@suse.cz" date="1342612800">- Update to version 0.3alpha:
  * code cleanup and build system update
  * handle corrupted cabinet files better
  * handle special cases of cabinet files
- License update: LGPL-2.1 only.</changelog>
  <changelog author="aj@suse.de" date="1342612801">- Remove autoreconf call and libtool buildrequires, they are not
  needed anymore.</changelog>
  <changelog author="dimstar@opensuse.org" date="1371902400">- Update to version 0.4alpha:
  + This release adds support for the Microsoft Exchange Offline
    Address Book (OAB) format, both compressed and incremental
    variants.</changelog>
  <changelog author="werner@suse.de" date="1372075200">- Avoid Source URL for http://www.cabextract.org.uk/ as this does
  not work</changelog>
  <changelog author="jengelh@inai.de" date="1396612800">- Add baselibs.conf: wxWidgets-32bit depends on libmspack0-32bit</changelog>
  <changelog author="sbrabec@suse.cz" date="1421755200">- Fix possible infinite loop caused DoS (bnc912214, CVE-2014-9556,
  libmspack-qtmd_decompress-loop.patch).</changelog>
  <changelog author="p.drouand@gmail.com" date="1423656000">- Update to version 0.5
  * Please read the changelog; too many things to list</changelog>
  <changelog author="sbrabec@suse.cz" date="1425038400">- Remove problematic libmspack-qtmd_decompress-loop.patch
  (bnc#912214#c10).
  Version 0.5 has a correct fix dated 2015-01-05.</changelog>
  <changelog author="mardnh@gmx.de" date="1516017600">- Update to version 0.6
  * read_spaninfo(): a CHM file can have no ResetTable and have a
  negative length in SpanInfo, which then feeds a negative output
  length to lzxd_init(), which then sets frame_size to a value of
  your choosing, the lower 32 bits of output length, larger than
  LZX_FRAME_SIZE. If the first LZX block is uncompressed, this
  writes data beyond the end of the window.
  This issue was raised by ClamAV as CVE-2017-6419.
  * lzxd_init(), lzxd_set_output_length(), mszipd_init(): due to the
  issue mentioned above, these functions now reject negative lengths
  * cabd_read_string(): add missing error check on result of read().
  If an mspack_system implementation returns an error, it's
  interpreted as a huge positive integer, which leads to reading
  past the end of the stack-based buffer.
  This issue was raised by ClamAV as CVE-2017-11423
- Add subpackage for helper tools
- Run spec-cleaner</changelog>
  <changelog author="mardnh@gmx.de" date="1516104000">- Fix typo</changelog>
  <changelog author="jengelh@inai.de" date="1516104001">- Correct SRPM group.</changelog>
  <changelog author="adam.majer@suse.de" date="1516363200">- Correct mspack-tools group to Productivity/File utilities</changelog>
  <changelog author="mcalabkova@suse.com" date="1540555200">- Added patches:
  * libmspack-resize-buffer.patch -- CAB block input buffer is one
    byte too small for maximal Quantum block.
  * libmspack-fix-bounds-checking.patch --  Fix off-by-one bounds
    check on CHM PMGI/PMGL chunk numbers and reject empty filenames.
  * libmspack-reject-blank-filenames.patch -- Avoid returning CHM
    file entries that are "blank" because they have embedded null
    bytes.
  * (the last two patches were modified by removing unneeded part
    in order to make them more independent)
- Fixed bugs:
  * CVE-2018-18584 (bsc#1113038)
  * CVE-2018-18585 (bsc#1113039)</changelog>
  <changelog author="mcalabkova@suse.com" date="1553860800">- Enable build-time tests (bsc#1130489)
  * Added patch libmspack-failing-tests.patch</changelog>
  <changelog author="kstreitova@suse.com" date="1572868800">- add libmspack-0.6alpha-CVE-2019-1010305.patch to fix a buffer
  overflow in chmd_read_headers(): a CHM file name beginning "::"
  but shorter than 33 bytes will lead to reading past the
  freshly-allocated name buffer - checks for specific control
  filenames didn't take length into account [bsc#1141680]
  [CVE-2019-1010305]</changelog>
  <changelog author="danilo.spinella@suse.com" date="1626264000">- There is an off-by-one error in the CHM PMGI/PMGL chunk number validity
  checks, which could lead to denial of service
  (CVE-2018-14679, bsc#1103032)
  * libmspack-CVE-2018-14679.patch
- Bad KWAJ file header extensions could cause a one or two byte overwrite
  (CVE-2018-14681, bsc#1103032).
  * libmspack-CVE-2018-14681.patch
- There is an off-by-one error in the TOLOWER() macro for CHM decompression
  (CVE-2018-14682, bsc#1103032).
  * libmspack-CVE-2018-14682.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1641384000">- chmextract.c add anti "../" and leading slash protection to chmextract
  (CVE-2018-18586.patch, bsc#1113040)
  * cve-2018-18586.patch</changelog>
</package>
<package pkgid="b97fcfee804e7f2baeb61ffca45e681ee85876d588f9de9fd8ab07efeba06c4a" name="libmspack-devel" arch="aarch64">
  <version epoch="0" ver="0.6" rel="3.14.1"/>
  <changelog author="sbrabec@suse.cz" date="1421755200">- Fix possible infinite loop caused DoS (bnc912214, CVE-2014-9556,
  libmspack-qtmd_decompress-loop.patch).</changelog>
  <changelog author="p.drouand@gmail.com" date="1423656000">- Update to version 0.5
  * Please read the changelog; too many things to list</changelog>
  <changelog author="sbrabec@suse.cz" date="1425038400">- Remove problematic libmspack-qtmd_decompress-loop.patch
  (bnc#912214#c10).
  Version 0.5 has a correct fix dated 2015-01-05.</changelog>
  <changelog author="mardnh@gmx.de" date="1516017600">- Update to version 0.6
  * read_spaninfo(): a CHM file can have no ResetTable and have a
  negative length in SpanInfo, which then feeds a negative output
  length to lzxd_init(), which then sets frame_size to a value of
  your choosing, the lower 32 bits of output length, larger than
  LZX_FRAME_SIZE. If the first LZX block is uncompressed, this
  writes data beyond the end of the window.
  This issue was raised by ClamAV as CVE-2017-6419.
  * lzxd_init(), lzxd_set_output_length(), mszipd_init(): due to the
  issue mentioned above, these functions now reject negative lengths
  * cabd_read_string(): add missing error check on result of read().
  If an mspack_system implementation returns an error, it's
  interpreted as a huge positive integer, which leads to reading
  past the end of the stack-based buffer.
  This issue was raised by ClamAV as CVE-2017-11423
- Add subpackage for helper tools
- Run spec-cleaner</changelog>
  <changelog author="mardnh@gmx.de" date="1516104000">- Fix typo</changelog>
  <changelog author="jengelh@inai.de" date="1516104001">- Correct SRPM group.</changelog>
  <changelog author="adam.majer@suse.de" date="1516363200">- Correct mspack-tools group to Productivity/File utilities</changelog>
  <changelog author="mcalabkova@suse.com" date="1540555200">- Added patches:
  * libmspack-resize-buffer.patch -- CAB block input buffer is one
    byte too small for maximal Quantum block.
  * libmspack-fix-bounds-checking.patch --  Fix off-by-one bounds
    check on CHM PMGI/PMGL chunk numbers and reject empty filenames.
  * libmspack-reject-blank-filenames.patch -- Avoid returning CHM
    file entries that are "blank" because they have embedded null
    bytes.
  * (the last two patches were modified by removing unneeded part
    in order to make them more independent)
- Fixed bugs:
  * CVE-2018-18584 (bsc#1113038)
  * CVE-2018-18585 (bsc#1113039)</changelog>
  <changelog author="mcalabkova@suse.com" date="1553860800">- Enable build-time tests (bsc#1130489)
  * Added patch libmspack-failing-tests.patch</changelog>
  <changelog author="kstreitova@suse.com" date="1572868800">- add libmspack-0.6alpha-CVE-2019-1010305.patch to fix a buffer
  overflow in chmd_read_headers(): a CHM file name beginning "::"
  but shorter than 33 bytes will lead to reading past the
  freshly-allocated name buffer - checks for specific control
  filenames didn't take length into account [bsc#1141680]
  [CVE-2019-1010305]</changelog>
  <changelog author="danilo.spinella@suse.com" date="1626264000">- There is an off-by-one error in the CHM PMGI/PMGL chunk number validity
  checks, which could lead to denial of service
  (CVE-2018-14679, bsc#1103032)
  * libmspack-CVE-2018-14679.patch
- Bad KWAJ file header extensions could cause a one or two byte overwrite
  (CVE-2018-14681, bsc#1103032).
  * libmspack-CVE-2018-14681.patch
- There is an off-by-one error in the TOLOWER() macro for CHM decompression
  (CVE-2018-14682, bsc#1103032).
  * libmspack-CVE-2018-14682.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1641384000">- chmextract.c add anti "../" and leading slash protection to chmextract
  (CVE-2018-18586.patch, bsc#1113040)
  * cve-2018-18586.patch</changelog>
</package>
<package pkgid="d878b438bcd2c7f4042e3892a62439653977e03d054087cac52194bc49897c92" name="libmspack-devel" arch="ppc64le">
  <version epoch="0" ver="0.6" rel="3.14.1"/>
  <changelog author="sbrabec@suse.cz" date="1421755200">- Fix possible infinite loop caused DoS (bnc912214, CVE-2014-9556,
  libmspack-qtmd_decompress-loop.patch).</changelog>
  <changelog author="p.drouand@gmail.com" date="1423656000">- Update to version 0.5
  * Please read the changelog; too many things to list</changelog>
  <changelog author="sbrabec@suse.cz" date="1425038400">- Remove problematic libmspack-qtmd_decompress-loop.patch
  (bnc#912214#c10).
  Version 0.5 has a correct fix dated 2015-01-05.</changelog>
  <changelog author="mardnh@gmx.de" date="1516017600">- Update to version 0.6
  * read_spaninfo(): a CHM file can have no ResetTable and have a
  negative length in SpanInfo, which then feeds a negative output
  length to lzxd_init(), which then sets frame_size to a value of
  your choosing, the lower 32 bits of output length, larger than
  LZX_FRAME_SIZE. If the first LZX block is uncompressed, this
  writes data beyond the end of the window.
  This issue was raised by ClamAV as CVE-2017-6419.
  * lzxd_init(), lzxd_set_output_length(), mszipd_init(): due to the
  issue mentioned above, these functions now reject negative lengths
  * cabd_read_string(): add missing error check on result of read().
  If an mspack_system implementation returns an error, it's
  interpreted as a huge positive integer, which leads to reading
  past the end of the stack-based buffer.
  This issue was raised by ClamAV as CVE-2017-11423
- Add subpackage for helper tools
- Run spec-cleaner</changelog>
  <changelog author="mardnh@gmx.de" date="1516104000">- Fix typo</changelog>
  <changelog author="jengelh@inai.de" date="1516104001">- Correct SRPM group.</changelog>
  <changelog author="adam.majer@suse.de" date="1516363200">- Correct mspack-tools group to Productivity/File utilities</changelog>
  <changelog author="mcalabkova@suse.com" date="1540555200">- Added patches:
  * libmspack-resize-buffer.patch -- CAB block input buffer is one
    byte too small for maximal Quantum block.
  * libmspack-fix-bounds-checking.patch --  Fix off-by-one bounds
    check on CHM PMGI/PMGL chunk numbers and reject empty filenames.
  * libmspack-reject-blank-filenames.patch -- Avoid returning CHM
    file entries that are "blank" because they have embedded null
    bytes.
  * (the last two patches were modified by removing unneeded part
    in order to make them more independent)
- Fixed bugs:
  * CVE-2018-18584 (bsc#1113038)
  * CVE-2018-18585 (bsc#1113039)</changelog>
  <changelog author="mcalabkova@suse.com" date="1553860800">- Enable build-time tests (bsc#1130489)
  * Added patch libmspack-failing-tests.patch</changelog>
  <changelog author="kstreitova@suse.com" date="1572868800">- add libmspack-0.6alpha-CVE-2019-1010305.patch to fix a buffer
  overflow in chmd_read_headers(): a CHM file name beginning "::"
  but shorter than 33 bytes will lead to reading past the
  freshly-allocated name buffer - checks for specific control
  filenames didn't take length into account [bsc#1141680]
  [CVE-2019-1010305]</changelog>
  <changelog author="danilo.spinella@suse.com" date="1626264000">- There is an off-by-one error in the CHM PMGI/PMGL chunk number validity
  checks, which could lead to denial of service
  (CVE-2018-14679, bsc#1103032)
  * libmspack-CVE-2018-14679.patch
- Bad KWAJ file header extensions could cause a one or two byte overwrite
  (CVE-2018-14681, bsc#1103032).
  * libmspack-CVE-2018-14681.patch
- There is an off-by-one error in the TOLOWER() macro for CHM decompression
  (CVE-2018-14682, bsc#1103032).
  * libmspack-CVE-2018-14682.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1641384000">- chmextract.c add anti "../" and leading slash protection to chmextract
  (CVE-2018-18586.patch, bsc#1113040)
  * cve-2018-18586.patch</changelog>
</package>
<package pkgid="4e8cf14173b6544f43f33eb88608b45aecf9ce88343b60719a83b3e2df40b975" name="libmspack-devel" arch="s390x">
  <version epoch="0" ver="0.6" rel="3.14.1"/>
  <changelog author="sbrabec@suse.cz" date="1421755200">- Fix possible infinite loop caused DoS (bnc912214, CVE-2014-9556,
  libmspack-qtmd_decompress-loop.patch).</changelog>
  <changelog author="p.drouand@gmail.com" date="1423656000">- Update to version 0.5
  * Please read the changelog; too many things to list</changelog>
  <changelog author="sbrabec@suse.cz" date="1425038400">- Remove problematic libmspack-qtmd_decompress-loop.patch
  (bnc#912214#c10).
  Version 0.5 has a correct fix dated 2015-01-05.</changelog>
  <changelog author="mardnh@gmx.de" date="1516017600">- Update to version 0.6
  * read_spaninfo(): a CHM file can have no ResetTable and have a
  negative length in SpanInfo, which then feeds a negative output
  length to lzxd_init(), which then sets frame_size to a value of
  your choosing, the lower 32 bits of output length, larger than
  LZX_FRAME_SIZE. If the first LZX block is uncompressed, this
  writes data beyond the end of the window.
  This issue was raised by ClamAV as CVE-2017-6419.
  * lzxd_init(), lzxd_set_output_length(), mszipd_init(): due to the
  issue mentioned above, these functions now reject negative lengths
  * cabd_read_string(): add missing error check on result of read().
  If an mspack_system implementation returns an error, it's
  interpreted as a huge positive integer, which leads to reading
  past the end of the stack-based buffer.
  This issue was raised by ClamAV as CVE-2017-11423
- Add subpackage for helper tools
- Run spec-cleaner</changelog>
  <changelog author="mardnh@gmx.de" date="1516104000">- Fix typo</changelog>
  <changelog author="jengelh@inai.de" date="1516104001">- Correct SRPM group.</changelog>
  <changelog author="adam.majer@suse.de" date="1516363200">- Correct mspack-tools group to Productivity/File utilities</changelog>
  <changelog author="mcalabkova@suse.com" date="1540555200">- Added patches:
  * libmspack-resize-buffer.patch -- CAB block input buffer is one
    byte too small for maximal Quantum block.
  * libmspack-fix-bounds-checking.patch --  Fix off-by-one bounds
    check on CHM PMGI/PMGL chunk numbers and reject empty filenames.
  * libmspack-reject-blank-filenames.patch -- Avoid returning CHM
    file entries that are "blank" because they have embedded null
    bytes.
  * (the last two patches were modified by removing unneeded part
    in order to make them more independent)
- Fixed bugs:
  * CVE-2018-18584 (bsc#1113038)
  * CVE-2018-18585 (bsc#1113039)</changelog>
  <changelog author="mcalabkova@suse.com" date="1553860800">- Enable build-time tests (bsc#1130489)
  * Added patch libmspack-failing-tests.patch</changelog>
  <changelog author="kstreitova@suse.com" date="1572868800">- add libmspack-0.6alpha-CVE-2019-1010305.patch to fix a buffer
  overflow in chmd_read_headers(): a CHM file name beginning "::"
  but shorter than 33 bytes will lead to reading past the
  freshly-allocated name buffer - checks for specific control
  filenames didn't take length into account [bsc#1141680]
  [CVE-2019-1010305]</changelog>
  <changelog author="danilo.spinella@suse.com" date="1626264000">- There is an off-by-one error in the CHM PMGI/PMGL chunk number validity
  checks, which could lead to denial of service
  (CVE-2018-14679, bsc#1103032)
  * libmspack-CVE-2018-14679.patch
- Bad KWAJ file header extensions could cause a one or two byte overwrite
  (CVE-2018-14681, bsc#1103032).
  * libmspack-CVE-2018-14681.patch
- There is an off-by-one error in the TOLOWER() macro for CHM decompression
  (CVE-2018-14682, bsc#1103032).
  * libmspack-CVE-2018-14682.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1641384000">- chmextract.c add anti "../" and leading slash protection to chmextract
  (CVE-2018-18586.patch, bsc#1113040)
  * cve-2018-18586.patch</changelog>
</package>
<package pkgid="7c782ad9ae57a5b185783353208e4fe7067326f0f1775358f019b59d4ad1ab8c" name="libmspack-devel" arch="x86_64">
  <version epoch="0" ver="0.6" rel="3.14.1"/>
  <changelog author="sbrabec@suse.cz" date="1421755200">- Fix possible infinite loop caused DoS (bnc912214, CVE-2014-9556,
  libmspack-qtmd_decompress-loop.patch).</changelog>
  <changelog author="p.drouand@gmail.com" date="1423656000">- Update to version 0.5
  * Please read the changelog; too many things to list</changelog>
  <changelog author="sbrabec@suse.cz" date="1425038400">- Remove problematic libmspack-qtmd_decompress-loop.patch
  (bnc#912214#c10).
  Version 0.5 has a correct fix dated 2015-01-05.</changelog>
  <changelog author="mardnh@gmx.de" date="1516017600">- Update to version 0.6
  * read_spaninfo(): a CHM file can have no ResetTable and have a
  negative length in SpanInfo, which then feeds a negative output
  length to lzxd_init(), which then sets frame_size to a value of
  your choosing, the lower 32 bits of output length, larger than
  LZX_FRAME_SIZE. If the first LZX block is uncompressed, this
  writes data beyond the end of the window.
  This issue was raised by ClamAV as CVE-2017-6419.
  * lzxd_init(), lzxd_set_output_length(), mszipd_init(): due to the
  issue mentioned above, these functions now reject negative lengths
  * cabd_read_string(): add missing error check on result of read().
  If an mspack_system implementation returns an error, it's
  interpreted as a huge positive integer, which leads to reading
  past the end of the stack-based buffer.
  This issue was raised by ClamAV as CVE-2017-11423
- Add subpackage for helper tools
- Run spec-cleaner</changelog>
  <changelog author="mardnh@gmx.de" date="1516104000">- Fix typo</changelog>
  <changelog author="jengelh@inai.de" date="1516104001">- Correct SRPM group.</changelog>
  <changelog author="adam.majer@suse.de" date="1516363200">- Correct mspack-tools group to Productivity/File utilities</changelog>
  <changelog author="mcalabkova@suse.com" date="1540555200">- Added patches:
  * libmspack-resize-buffer.patch -- CAB block input buffer is one
    byte too small for maximal Quantum block.
  * libmspack-fix-bounds-checking.patch --  Fix off-by-one bounds
    check on CHM PMGI/PMGL chunk numbers and reject empty filenames.
  * libmspack-reject-blank-filenames.patch -- Avoid returning CHM
    file entries that are "blank" because they have embedded null
    bytes.
  * (the last two patches were modified by removing unneeded part
    in order to make them more independent)
- Fixed bugs:
  * CVE-2018-18584 (bsc#1113038)
  * CVE-2018-18585 (bsc#1113039)</changelog>
  <changelog author="mcalabkova@suse.com" date="1553860800">- Enable build-time tests (bsc#1130489)
  * Added patch libmspack-failing-tests.patch</changelog>
  <changelog author="kstreitova@suse.com" date="1572868800">- add libmspack-0.6alpha-CVE-2019-1010305.patch to fix a buffer
  overflow in chmd_read_headers(): a CHM file name beginning "::"
  but shorter than 33 bytes will lead to reading past the
  freshly-allocated name buffer - checks for specific control
  filenames didn't take length into account [bsc#1141680]
  [CVE-2019-1010305]</changelog>
  <changelog author="danilo.spinella@suse.com" date="1626264000">- There is an off-by-one error in the CHM PMGI/PMGL chunk number validity
  checks, which could lead to denial of service
  (CVE-2018-14679, bsc#1103032)
  * libmspack-CVE-2018-14679.patch
- Bad KWAJ file header extensions could cause a one or two byte overwrite
  (CVE-2018-14681, bsc#1103032).
  * libmspack-CVE-2018-14681.patch
- There is an off-by-one error in the TOLOWER() macro for CHM decompression
  (CVE-2018-14682, bsc#1103032).
  * libmspack-CVE-2018-14682.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1641384000">- chmextract.c add anti "../" and leading slash protection to chmextract
  (CVE-2018-18586.patch, bsc#1113040)
  * cve-2018-18586.patch</changelog>
</package>
<package pkgid="d7f1f4ec14ae21faddafc77fc2fdb6a93097179cc9eef154ee8b0c2cd903d85e" name="libmspack0" arch="aarch64">
  <version epoch="0" ver="0.6" rel="3.14.1"/>
  <changelog author="sbrabec@suse.cz" date="1421755200">- Fix possible infinite loop caused DoS (bnc912214, CVE-2014-9556,
  libmspack-qtmd_decompress-loop.patch).</changelog>
  <changelog author="p.drouand@gmail.com" date="1423656000">- Update to version 0.5
  * Please read the changelog; too many things to list</changelog>
  <changelog author="sbrabec@suse.cz" date="1425038400">- Remove problematic libmspack-qtmd_decompress-loop.patch
  (bnc#912214#c10).
  Version 0.5 has a correct fix dated 2015-01-05.</changelog>
  <changelog author="mardnh@gmx.de" date="1516017600">- Update to version 0.6
  * read_spaninfo(): a CHM file can have no ResetTable and have a
  negative length in SpanInfo, which then feeds a negative output
  length to lzxd_init(), which then sets frame_size to a value of
  your choosing, the lower 32 bits of output length, larger than
  LZX_FRAME_SIZE. If the first LZX block is uncompressed, this
  writes data beyond the end of the window.
  This issue was raised by ClamAV as CVE-2017-6419.
  * lzxd_init(), lzxd_set_output_length(), mszipd_init(): due to the
  issue mentioned above, these functions now reject negative lengths
  * cabd_read_string(): add missing error check on result of read().
  If an mspack_system implementation returns an error, it's
  interpreted as a huge positive integer, which leads to reading
  past the end of the stack-based buffer.
  This issue was raised by ClamAV as CVE-2017-11423
- Add subpackage for helper tools
- Run spec-cleaner</changelog>
  <changelog author="mardnh@gmx.de" date="1516104000">- Fix typo</changelog>
  <changelog author="jengelh@inai.de" date="1516104001">- Correct SRPM group.</changelog>
  <changelog author="adam.majer@suse.de" date="1516363200">- Correct mspack-tools group to Productivity/File utilities</changelog>
  <changelog author="mcalabkova@suse.com" date="1540555200">- Added patches:
  * libmspack-resize-buffer.patch -- CAB block input buffer is one
    byte too small for maximal Quantum block.
  * libmspack-fix-bounds-checking.patch --  Fix off-by-one bounds
    check on CHM PMGI/PMGL chunk numbers and reject empty filenames.
  * libmspack-reject-blank-filenames.patch -- Avoid returning CHM
    file entries that are "blank" because they have embedded null
    bytes.
  * (the last two patches were modified by removing unneeded part
    in order to make them more independent)
- Fixed bugs:
  * CVE-2018-18584 (bsc#1113038)
  * CVE-2018-18585 (bsc#1113039)</changelog>
  <changelog author="mcalabkova@suse.com" date="1553860800">- Enable build-time tests (bsc#1130489)
  * Added patch libmspack-failing-tests.patch</changelog>
  <changelog author="kstreitova@suse.com" date="1572868800">- add libmspack-0.6alpha-CVE-2019-1010305.patch to fix a buffer
  overflow in chmd_read_headers(): a CHM file name beginning "::"
  but shorter than 33 bytes will lead to reading past the
  freshly-allocated name buffer - checks for specific control
  filenames didn't take length into account [bsc#1141680]
  [CVE-2019-1010305]</changelog>
  <changelog author="danilo.spinella@suse.com" date="1626264000">- There is an off-by-one error in the CHM PMGI/PMGL chunk number validity
  checks, which could lead to denial of service
  (CVE-2018-14679, bsc#1103032)
  * libmspack-CVE-2018-14679.patch
- Bad KWAJ file header extensions could cause a one or two byte overwrite
  (CVE-2018-14681, bsc#1103032).
  * libmspack-CVE-2018-14681.patch
- There is an off-by-one error in the TOLOWER() macro for CHM decompression
  (CVE-2018-14682, bsc#1103032).
  * libmspack-CVE-2018-14682.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1641384000">- chmextract.c add anti "../" and leading slash protection to chmextract
  (CVE-2018-18586.patch, bsc#1113040)
  * cve-2018-18586.patch</changelog>
</package>
<package pkgid="1dd7f95a477a95e6f92b2344f7d1628b283f5795ef8b48e6bb0bdc531cad5531" name="libmspack0" arch="ppc64le">
  <version epoch="0" ver="0.6" rel="3.14.1"/>
  <changelog author="sbrabec@suse.cz" date="1421755200">- Fix possible infinite loop caused DoS (bnc912214, CVE-2014-9556,
  libmspack-qtmd_decompress-loop.patch).</changelog>
  <changelog author="p.drouand@gmail.com" date="1423656000">- Update to version 0.5
  * Please read the changelog; too many things to list</changelog>
  <changelog author="sbrabec@suse.cz" date="1425038400">- Remove problematic libmspack-qtmd_decompress-loop.patch
  (bnc#912214#c10).
  Version 0.5 has a correct fix dated 2015-01-05.</changelog>
  <changelog author="mardnh@gmx.de" date="1516017600">- Update to version 0.6
  * read_spaninfo(): a CHM file can have no ResetTable and have a
  negative length in SpanInfo, which then feeds a negative output
  length to lzxd_init(), which then sets frame_size to a value of
  your choosing, the lower 32 bits of output length, larger than
  LZX_FRAME_SIZE. If the first LZX block is uncompressed, this
  writes data beyond the end of the window.
  This issue was raised by ClamAV as CVE-2017-6419.
  * lzxd_init(), lzxd_set_output_length(), mszipd_init(): due to the
  issue mentioned above, these functions now reject negative lengths
  * cabd_read_string(): add missing error check on result of read().
  If an mspack_system implementation returns an error, it's
  interpreted as a huge positive integer, which leads to reading
  past the end of the stack-based buffer.
  This issue was raised by ClamAV as CVE-2017-11423
- Add subpackage for helper tools
- Run spec-cleaner</changelog>
  <changelog author="mardnh@gmx.de" date="1516104000">- Fix typo</changelog>
  <changelog author="jengelh@inai.de" date="1516104001">- Correct SRPM group.</changelog>
  <changelog author="adam.majer@suse.de" date="1516363200">- Correct mspack-tools group to Productivity/File utilities</changelog>
  <changelog author="mcalabkova@suse.com" date="1540555200">- Added patches:
  * libmspack-resize-buffer.patch -- CAB block input buffer is one
    byte too small for maximal Quantum block.
  * libmspack-fix-bounds-checking.patch --  Fix off-by-one bounds
    check on CHM PMGI/PMGL chunk numbers and reject empty filenames.
  * libmspack-reject-blank-filenames.patch -- Avoid returning CHM
    file entries that are "blank" because they have embedded null
    bytes.
  * (the last two patches were modified by removing unneeded part
    in order to make them more independent)
- Fixed bugs:
  * CVE-2018-18584 (bsc#1113038)
  * CVE-2018-18585 (bsc#1113039)</changelog>
  <changelog author="mcalabkova@suse.com" date="1553860800">- Enable build-time tests (bsc#1130489)
  * Added patch libmspack-failing-tests.patch</changelog>
  <changelog author="kstreitova@suse.com" date="1572868800">- add libmspack-0.6alpha-CVE-2019-1010305.patch to fix a buffer
  overflow in chmd_read_headers(): a CHM file name beginning "::"
  but shorter than 33 bytes will lead to reading past the
  freshly-allocated name buffer - checks for specific control
  filenames didn't take length into account [bsc#1141680]
  [CVE-2019-1010305]</changelog>
  <changelog author="danilo.spinella@suse.com" date="1626264000">- There is an off-by-one error in the CHM PMGI/PMGL chunk number validity
  checks, which could lead to denial of service
  (CVE-2018-14679, bsc#1103032)
  * libmspack-CVE-2018-14679.patch
- Bad KWAJ file header extensions could cause a one or two byte overwrite
  (CVE-2018-14681, bsc#1103032).
  * libmspack-CVE-2018-14681.patch
- There is an off-by-one error in the TOLOWER() macro for CHM decompression
  (CVE-2018-14682, bsc#1103032).
  * libmspack-CVE-2018-14682.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1641384000">- chmextract.c add anti "../" and leading slash protection to chmextract
  (CVE-2018-18586.patch, bsc#1113040)
  * cve-2018-18586.patch</changelog>
</package>
<package pkgid="38e0274c47e0f0a3474bc9af3f3dd97a7e75a2affcdf919f1a576266b61a186d" name="libmspack0" arch="s390x">
  <version epoch="0" ver="0.6" rel="3.14.1"/>
  <changelog author="sbrabec@suse.cz" date="1421755200">- Fix possible infinite loop caused DoS (bnc912214, CVE-2014-9556,
  libmspack-qtmd_decompress-loop.patch).</changelog>
  <changelog author="p.drouand@gmail.com" date="1423656000">- Update to version 0.5
  * Please read the changelog; too many things to list</changelog>
  <changelog author="sbrabec@suse.cz" date="1425038400">- Remove problematic libmspack-qtmd_decompress-loop.patch
  (bnc#912214#c10).
  Version 0.5 has a correct fix dated 2015-01-05.</changelog>
  <changelog author="mardnh@gmx.de" date="1516017600">- Update to version 0.6
  * read_spaninfo(): a CHM file can have no ResetTable and have a
  negative length in SpanInfo, which then feeds a negative output
  length to lzxd_init(), which then sets frame_size to a value of
  your choosing, the lower 32 bits of output length, larger than
  LZX_FRAME_SIZE. If the first LZX block is uncompressed, this
  writes data beyond the end of the window.
  This issue was raised by ClamAV as CVE-2017-6419.
  * lzxd_init(), lzxd_set_output_length(), mszipd_init(): due to the
  issue mentioned above, these functions now reject negative lengths
  * cabd_read_string(): add missing error check on result of read().
  If an mspack_system implementation returns an error, it's
  interpreted as a huge positive integer, which leads to reading
  past the end of the stack-based buffer.
  This issue was raised by ClamAV as CVE-2017-11423
- Add subpackage for helper tools
- Run spec-cleaner</changelog>
  <changelog author="mardnh@gmx.de" date="1516104000">- Fix typo</changelog>
  <changelog author="jengelh@inai.de" date="1516104001">- Correct SRPM group.</changelog>
  <changelog author="adam.majer@suse.de" date="1516363200">- Correct mspack-tools group to Productivity/File utilities</changelog>
  <changelog author="mcalabkova@suse.com" date="1540555200">- Added patches:
  * libmspack-resize-buffer.patch -- CAB block input buffer is one
    byte too small for maximal Quantum block.
  * libmspack-fix-bounds-checking.patch --  Fix off-by-one bounds
    check on CHM PMGI/PMGL chunk numbers and reject empty filenames.
  * libmspack-reject-blank-filenames.patch -- Avoid returning CHM
    file entries that are "blank" because they have embedded null
    bytes.
  * (the last two patches were modified by removing unneeded part
    in order to make them more independent)
- Fixed bugs:
  * CVE-2018-18584 (bsc#1113038)
  * CVE-2018-18585 (bsc#1113039)</changelog>
  <changelog author="mcalabkova@suse.com" date="1553860800">- Enable build-time tests (bsc#1130489)
  * Added patch libmspack-failing-tests.patch</changelog>
  <changelog author="kstreitova@suse.com" date="1572868800">- add libmspack-0.6alpha-CVE-2019-1010305.patch to fix a buffer
  overflow in chmd_read_headers(): a CHM file name beginning "::"
  but shorter than 33 bytes will lead to reading past the
  freshly-allocated name buffer - checks for specific control
  filenames didn't take length into account [bsc#1141680]
  [CVE-2019-1010305]</changelog>
  <changelog author="danilo.spinella@suse.com" date="1626264000">- There is an off-by-one error in the CHM PMGI/PMGL chunk number validity
  checks, which could lead to denial of service
  (CVE-2018-14679, bsc#1103032)
  * libmspack-CVE-2018-14679.patch
- Bad KWAJ file header extensions could cause a one or two byte overwrite
  (CVE-2018-14681, bsc#1103032).
  * libmspack-CVE-2018-14681.patch
- There is an off-by-one error in the TOLOWER() macro for CHM decompression
  (CVE-2018-14682, bsc#1103032).
  * libmspack-CVE-2018-14682.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1641384000">- chmextract.c add anti "../" and leading slash protection to chmextract
  (CVE-2018-18586.patch, bsc#1113040)
  * cve-2018-18586.patch</changelog>
</package>
<package pkgid="8efc310032a746dd6036f5236de964946725fca3d46534a4df19d4295ec9106e" name="libmspack0" arch="x86_64">
  <version epoch="0" ver="0.6" rel="3.14.1"/>
  <changelog author="sbrabec@suse.cz" date="1421755200">- Fix possible infinite loop caused DoS (bnc912214, CVE-2014-9556,
  libmspack-qtmd_decompress-loop.patch).</changelog>
  <changelog author="p.drouand@gmail.com" date="1423656000">- Update to version 0.5
  * Please read the changelog; too many things to list</changelog>
  <changelog author="sbrabec@suse.cz" date="1425038400">- Remove problematic libmspack-qtmd_decompress-loop.patch
  (bnc#912214#c10).
  Version 0.5 has a correct fix dated 2015-01-05.</changelog>
  <changelog author="mardnh@gmx.de" date="1516017600">- Update to version 0.6
  * read_spaninfo(): a CHM file can have no ResetTable and have a
  negative length in SpanInfo, which then feeds a negative output
  length to lzxd_init(), which then sets frame_size to a value of
  your choosing, the lower 32 bits of output length, larger than
  LZX_FRAME_SIZE. If the first LZX block is uncompressed, this
  writes data beyond the end of the window.
  This issue was raised by ClamAV as CVE-2017-6419.
  * lzxd_init(), lzxd_set_output_length(), mszipd_init(): due to the
  issue mentioned above, these functions now reject negative lengths
  * cabd_read_string(): add missing error check on result of read().
  If an mspack_system implementation returns an error, it's
  interpreted as a huge positive integer, which leads to reading
  past the end of the stack-based buffer.
  This issue was raised by ClamAV as CVE-2017-11423
- Add subpackage for helper tools
- Run spec-cleaner</changelog>
  <changelog author="mardnh@gmx.de" date="1516104000">- Fix typo</changelog>
  <changelog author="jengelh@inai.de" date="1516104001">- Correct SRPM group.</changelog>
  <changelog author="adam.majer@suse.de" date="1516363200">- Correct mspack-tools group to Productivity/File utilities</changelog>
  <changelog author="mcalabkova@suse.com" date="1540555200">- Added patches:
  * libmspack-resize-buffer.patch -- CAB block input buffer is one
    byte too small for maximal Quantum block.
  * libmspack-fix-bounds-checking.patch --  Fix off-by-one bounds
    check on CHM PMGI/PMGL chunk numbers and reject empty filenames.
  * libmspack-reject-blank-filenames.patch -- Avoid returning CHM
    file entries that are "blank" because they have embedded null
    bytes.
  * (the last two patches were modified by removing unneeded part
    in order to make them more independent)
- Fixed bugs:
  * CVE-2018-18584 (bsc#1113038)
  * CVE-2018-18585 (bsc#1113039)</changelog>
  <changelog author="mcalabkova@suse.com" date="1553860800">- Enable build-time tests (bsc#1130489)
  * Added patch libmspack-failing-tests.patch</changelog>
  <changelog author="kstreitova@suse.com" date="1572868800">- add libmspack-0.6alpha-CVE-2019-1010305.patch to fix a buffer
  overflow in chmd_read_headers(): a CHM file name beginning "::"
  but shorter than 33 bytes will lead to reading past the
  freshly-allocated name buffer - checks for specific control
  filenames didn't take length into account [bsc#1141680]
  [CVE-2019-1010305]</changelog>
  <changelog author="danilo.spinella@suse.com" date="1626264000">- There is an off-by-one error in the CHM PMGI/PMGL chunk number validity
  checks, which could lead to denial of service
  (CVE-2018-14679, bsc#1103032)
  * libmspack-CVE-2018-14679.patch
- Bad KWAJ file header extensions could cause a one or two byte overwrite
  (CVE-2018-14681, bsc#1103032).
  * libmspack-CVE-2018-14681.patch
- There is an off-by-one error in the TOLOWER() macro for CHM decompression
  (CVE-2018-14682, bsc#1103032).
  * libmspack-CVE-2018-14682.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1641384000">- chmextract.c add anti "../" and leading slash protection to chmextract
  (CVE-2018-18586.patch, bsc#1113040)
  * cve-2018-18586.patch</changelog>
</package>
<package pkgid="a556b1e562858e1ee558358f0f262ca9cadc82dbd982f0c0dccd6e716f8397ec" name="libmspack0-32bit" arch="x86_64">
  <version epoch="0" ver="0.6" rel="3.14.1"/>
  <changelog author="sbrabec@suse.cz" date="1421755200">- Fix possible infinite loop caused DoS (bnc912214, CVE-2014-9556,
  libmspack-qtmd_decompress-loop.patch).</changelog>
  <changelog author="p.drouand@gmail.com" date="1423656000">- Update to version 0.5
  * Please read the changelog; too many things to list</changelog>
  <changelog author="sbrabec@suse.cz" date="1425038400">- Remove problematic libmspack-qtmd_decompress-loop.patch
  (bnc#912214#c10).
  Version 0.5 has a correct fix dated 2015-01-05.</changelog>
  <changelog author="mardnh@gmx.de" date="1516017600">- Update to version 0.6
  * read_spaninfo(): a CHM file can have no ResetTable and have a
  negative length in SpanInfo, which then feeds a negative output
  length to lzxd_init(), which then sets frame_size to a value of
  your choosing, the lower 32 bits of output length, larger than
  LZX_FRAME_SIZE. If the first LZX block is uncompressed, this
  writes data beyond the end of the window.
  This issue was raised by ClamAV as CVE-2017-6419.
  * lzxd_init(), lzxd_set_output_length(), mszipd_init(): due to the
  issue mentioned above, these functions now reject negative lengths
  * cabd_read_string(): add missing error check on result of read().
  If an mspack_system implementation returns an error, it's
  interpreted as a huge positive integer, which leads to reading
  past the end of the stack-based buffer.
  This issue was raised by ClamAV as CVE-2017-11423
- Add subpackage for helper tools
- Run spec-cleaner</changelog>
  <changelog author="mardnh@gmx.de" date="1516104000">- Fix typo</changelog>
  <changelog author="jengelh@inai.de" date="1516104001">- Correct SRPM group.</changelog>
  <changelog author="adam.majer@suse.de" date="1516363200">- Correct mspack-tools group to Productivity/File utilities</changelog>
  <changelog author="mcalabkova@suse.com" date="1540555200">- Added patches:
  * libmspack-resize-buffer.patch -- CAB block input buffer is one
    byte too small for maximal Quantum block.
  * libmspack-fix-bounds-checking.patch --  Fix off-by-one bounds
    check on CHM PMGI/PMGL chunk numbers and reject empty filenames.
  * libmspack-reject-blank-filenames.patch -- Avoid returning CHM
    file entries that are "blank" because they have embedded null
    bytes.
  * (the last two patches were modified by removing unneeded part
    in order to make them more independent)
- Fixed bugs:
  * CVE-2018-18584 (bsc#1113038)
  * CVE-2018-18585 (bsc#1113039)</changelog>
  <changelog author="mcalabkova@suse.com" date="1553860800">- Enable build-time tests (bsc#1130489)
  * Added patch libmspack-failing-tests.patch</changelog>
  <changelog author="kstreitova@suse.com" date="1572868800">- add libmspack-0.6alpha-CVE-2019-1010305.patch to fix a buffer
  overflow in chmd_read_headers(): a CHM file name beginning "::"
  but shorter than 33 bytes will lead to reading past the
  freshly-allocated name buffer - checks for specific control
  filenames didn't take length into account [bsc#1141680]
  [CVE-2019-1010305]</changelog>
  <changelog author="danilo.spinella@suse.com" date="1626264000">- There is an off-by-one error in the CHM PMGI/PMGL chunk number validity
  checks, which could lead to denial of service
  (CVE-2018-14679, bsc#1103032)
  * libmspack-CVE-2018-14679.patch
- Bad KWAJ file header extensions could cause a one or two byte overwrite
  (CVE-2018-14681, bsc#1103032).
  * libmspack-CVE-2018-14681.patch
- There is an off-by-one error in the TOLOWER() macro for CHM decompression
  (CVE-2018-14682, bsc#1103032).
  * libmspack-CVE-2018-14682.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1641384000">- chmextract.c add anti "../" and leading slash protection to chmextract
  (CVE-2018-18586.patch, bsc#1113040)
  * cve-2018-18586.patch</changelog>
</package>
<package pkgid="41e010188baca0bea4c64e730d249487a52f4b174a58e263d67c1f048126c4d1" name="libndr0-32bit" arch="x86_64">
  <version epoch="0" ver="4.11.14+git.319.91d693db37c" rel="4.35.1"/>
  <changelog author="scabrero@suse.de" date="1587556800">- CVE-2020-10704: LDAP Denial of Service (stack overflow) in
  Samba AD DC; (bso#14334); (bsc#1169851);
- CVE-2020-10700: Use-after-free in Samba AD DC LDAP Server with
  ASQ; (bso#14331); (bsc#1169850);</changelog>
  <changelog author="scabrero@suse.de" date="1588593600">- Require libldb2 &gt;= 2.0.10 after security release.</changelog>
  <changelog author="dmulder@suse.com" date="1589457600">- Fix samba_winbind package is installing python3-base without
  python3 package; (bsc#1169521);</changelog>
  <changelog author="scabrero@suse.de" date="1589457601">- Installing: samba - samba-ad-dc.service does not exist and unit
  not found; (bsc#1171437);</changelog>
  <changelog author="scabrero@suse.de" date="1591012800">- Add libnetapi-devel to baselibs conf, for wine usage; (bsc#1172307);</changelog>
  <changelog author="nopower@suse.com" date="1593691200">- Update to samba 4.11.11
  + CVE-2020-10730: NULL de-reference in AD DC LDAP server when ASQ
    and VLV combined; (bso#14364); (bsc#1173159]
  + CVE-2020-10745: invalid DNS or NBT queries containing dots use
    several seconds of CPU each; (bso#14378); (bsc#1173160).
  + CVE-2020-10760: Use-after-free in AD DC Global Catalog LDAP
    server with paged_result or VLV; (bso#14402); (bsc#1173161)
  + CVE-2020-14303: Endless loop from empty UDP packet sent to
    AD DC nbt_server; (bso#14417); (bsc#1173359).
- Update to samba 4.11.10
  + Fix segfault when using SMBC_opendir_ctx() routine for share
    folder that contains incorrect symbols in any file name;
    (bso#14374).
  + vfs_shadow_copy2 doesn't fail case looking in
    snapdirseverywhere mode; (bso#14350)
  + ldb_ldap: Fix off-by-one increment in lldb_add_msg_attr;
    (bso#14413).
  + Malicous SMB1 server can crash libsmbclient; (bso#14366)
  + winbindd: Fix a use-after-free when winbind clients exit;
    (bso#14382)
  + ldb: Bump version to 2.0.11, LMDB databases can grow without
    bounds. (bso#14330)
- Update to samba 4.11.9
  + nmblib: Avoid undefined behaviour in handle_name_ptrs();
    (bso#14242).
  + 'samba-tool group' commands do not handle group names with
    special chars correctly; (bso#14296).
  + smbd: avoid calling vfs_file_id_from_sbuf() if statinfo
    is not valid; (bso#14237).
  + Missing check for DMAPI offline status in async DOS
    attributes; (bso#14293).
  + smbd: Ignore set NTACL requests which contain
    S-1-5-88 NFS ACEs; (bso#14307).
  + vfs_recycle: Prevent flooding the log if we're called on
    non-existant paths; (bso#14316)
  + smbd mistakenly updates a file's write-time on close;
    (bso#14320).
  + RPC handles cannot be differentiated in source3 RPC server;
    (bso#14359).
  + librpc: Fix IDL for svcctl_ChangeServiceConfigW; (bso#14313).
  + nsswitch: Fix use-after-free causing segfault in
    _pam_delete_cred; (bso#14327).
  + Fix fruit:time machine max size on arm; (bso#13622)
  + CTDB recovery corner cases can cause record resurrection
    and node banning; (bso#14294).
  + ctdb: Fix a memleak; (bso#14348).
  + libsmb: Don't try to find posix stat info in SMBC_getatr().
  + ctdb-tcp: Move free of inbound queue to TCP restart;
    (bso#14295); (bsc#1162680).
  + s3/librpc/crypto: Fix double free with unresolved
    credential cache; (bso#14344); (bsc#1169095)
  + s3:libads: Fix ads_get_upn(); (bso#14336).
  + CTDB recovery corner cases can cause record resurrection
    and node banning; (bso#14294)
  + Starting ctdb node that was powered off hard before
    results in recovery loop; (bso#14295); (bsc#1162680).
  + ctdb-recoverd: Avoid dereferencing NULL rec-&gt;nodemap;
    (bso#14324)
- Update to samba 4.11.8
  + CVE-2020-10700: Use-after-free in Samba AD DC LDAP
    Server with ASQ; (bso#14331); (bsc#1169850);
  + CVE-2020-10704: LDAP Denial of Service (stack overflow)
    in Samba AD DC; (bso#14334); (bsc#1169851);
- Update to samba 4.11.7
  + s3: lib: nmblib. Clean up and harden nmb packet
    processing; (bso#14239).
  + s3: VFS: full_audit. Use system session_info if called
    from a temporary share definition; (bso#14283)
  + dsdb: Correctly handle memory in objectclass_attrs;
    (bso#14258).
  + ldb: version 2.0.9, Samba 4.11 and later give incorrect
    results for SCOPE_ONE searches; (bso#14270)
  + auth: Fix CIDs 1458418 and 1458420 Null pointer
    dereferences; (bso#14247).
  + smbd: Handle EINTR from open(2) properly; (bso#14285)
  + winbind member (source3) fails local SAM auth with empty
    domain name; (bso#14247)
  + winbindd: Handling missing idmap in getgrgid(); (bso#14265).
  + lib:util: Log mkdir error on correct debug levels;
    (bso#14253).
  + wafsamba: Do not use 'rU' as the 'U' is deprecated in
    Python 3.9; (bso#14266).
  + ctdb-tcp: Make error handling for outbound connection
    consistent; (bso#14274).
- Update to samba 4.11.6
  + pygpo: Use correct method flags; (bso#14209).
  + vfs_ceph_snapshots: Fix root relative path handling;
    (bso#14216); (bsc#1141320).
  + Avoiding bad call flags with python 3.8, using METH_NOARGS
    instead of zero; (bso#14209).
  + source4/utils/oLschema2ldif: Include stdint.h before
    cmocka.h; (bso#14218).
  + docs-xml/winbindnssinfo: Clarify interaction with
    idmap_ad etc; (bso#14122).
  + smbd: Fix the build with clang; (bso#14251).
  + upgradedns: Ensure lmdb lock files linked; (bso#14199).
  + s3: VFS: glusterfs: Reset nlinks for symlink entries during
    readdir; (bso#14182).
  + smbc_stat() doesn't return the correct st_mode and also
    the uid/gid is not filled (SMBv1) file; (bso#14101).
  + librpc: Fix string length checking in
    ndr_pull_charset_to_null(); (bso#14219).
  + ctdb-scripts: Strip square brackets when gathering
    connection info; (bso#14227).</changelog>
  <changelog author="dmulder@suse.com" date="1594728000">- Fix net command unable to negotiate SMB2; (bsc#1174120);</changelog>
  <changelog author="scabrero@suse.de" date="1595851200">- Add obsoletes to libsmbldap2 package to fix upgrades from previous
  versions; (bsc#1172810);</changelog>
  <changelog author="scabrero@suse.de" date="1600430400">- Update to samba 4.11.13
  + CVE-2020-1472(ZeroLogon): s3:rpc_server/netlogon: Protect
    netr_ServerPasswordSet2 against unencrypted passwords; (bsc#1176579);
    (bso#14497);
  + CVE-2020-1472(ZeroLogon): s3:rpc_server/netlogon: Support
    "server require schannel:WORKSTATION$ = no" about unsecure configurations;
    (bsc#1176579); (bso#14497);
  + CVE-2020-1472(ZeroLogon): s4 torture rpc: repeated bytes in client
    challenge; (bsc#1176579); (bso#14497);
  + CVE-2020-1472(ZeroLogon): libcli/auth: Reject weak client challenges in
    netlogon_creds_server_init() "server require schannel:WORKSTATION$ = no";
    (bsc#1176579); (bso#14497);
- Update to samba 4.11.12
  + s3: libsmb: Fix SMB2 client rename bug to a Windows server; (bso#14403);
  + dsdb: Allow "password hash userPassword schemes = CryptSHA256" to work
    on RHEL7; (bso#14424);
  + dbcheck: Allow a dangling forward link outside our known NCs; (bso#14450);
  + lib/debug: Set the correct default backend loglevel to MAX_DEBUG_LEVEL;
    (bso#14426);
  + s3:smbd: PANIC: assert failed in get_lease_type(); (bso#14428);
  + lib/util: do not install "test_util_paths"; (bso#14370);
  + lib:util: Fix smbclient -l basename dir; (bso#14345);
  + s3:smbd: PANIC: assert failed in get_lease_type(); (bso#14428);
  + util: Allow symlinks in directory_create_or_exist; (bso#14166);
  + docs: Fix documentation for require_membership_of of pam_winbind;
    (bso#14358);
  + s3:winbind:idmap_ad: Make failure to get attrnames for schema mode fatal;
    (bso#14425);</changelog>
  <changelog author="scabrero@suse.de" date="1602590400">- CVE-2020-14383: An authenticated user can crash the DCE/RPC DNS with
  easily crafted records; (bsc#1177613); (bso#14472);
- CVE-2020-14323: Unprivileged user can crash winbind; (bsc#1173994);
  (bso#14436);
- CVE-2020-14318: Missing handle permissions check in SMB1/2/3 ChangeNotify;
  (bsc#1173902); (bso#14434);
- Update to samba 4.11.14
  + lib/util: Do not install /usr/bin/test_util; (bso#14166);
  + smbd: don't log success as error; (bso#14490);
  + idmap_ad does not deal properly with a RFC4511 section 4.4.1 response;
    (bso#14465);
  + winbind: Fix a memleak; (bso#14388);
  + idmap_ad: Pass tldap debug messages on to DEBUG(); (bso#14465);
  + lib/replace: Move lib/replace/closefrom.c from ROKEN_HOSTCC_SOURCE to
    REPLACE_HOSTCC_SOURCE; (bso#14482);
  + ctdb disable/enable can fail due to race condition; (bso#14466);</changelog>
  <changelog author="nopower@suse.com" date="1604577600">- Adjust smbcacls '--propagate-inheritance' feature to align with
  upstream; (bsc#1178469).</changelog>
  <changelog author="nopower@suse.com" date="1612440000">- Avoid free'ing our own pointer in memcache when memcache_trim
  attempts to reduce cache size; (bso#14625); (bnc#1179156).</changelog>
  <changelog author="nopower@suse.com" date="1615896000">- CVE-2020-27840: samba: Unauthenticated remote heap corruption
  via bad DNs; (bso#14595); (bsc#1183572).
- CVE-2021-20277: samba: out of bounds read in ldb_handler_fold;
  (bso#14655); (bsc#1183574).</changelog>
  <changelog author="dmulder@suse.com" date="1616760000">- s3-libads: use dns name to open a ldap session; (bso#13124);
  (bsc#1184310).</changelog>
  <changelog author="nopower@suse.com" date="1618401600">-  CVE-2021-20254 Buffer overrun in sids_to_unixids();
  (bnc#14571); (bsc#1184677).</changelog>
  <changelog author="scabrero@suse.de" date="1619697600">- Add msDS-AdditionalDnsHostName to the keytab; (bso#14396);
  (bsc#1185420);
- Add net-ads-join dnshostname option; (bso#14396); (bsc#1185420);
- Fix adding msDS-AdditionalDnsHostName to keytab with Windows DC;
  (bso#14406); (bsc#1185420);</changelog>
  <changelog author="scabrero@suse.de" date="1629892800">- Fix wrong kvno exported to keytab after net ads changetrustpw due
  to replication delay; (bsc#1188727);</changelog>
  <changelog author="nopower@suse.com" date="1635854400">- CVE-2016-2124: SMB1 client connections can be downgraded to
  plaintext authentication (bsc#1014440); (bso#12444);
- CVE-2020-25717: A user in an AD Domain could become root on
  domain members; (bsc#1192284); (bso#14556);
- CVE-2021-23192: Subsequent DCE/RPC fragment injection vulnerability;
  (bsc#1192214); (bso#14875);</changelog>
  <changelog author="nopower@suse.com" date="1637236800">- The username map [script] advice from CVE-2020-25717 advisory
  note has undesired side effects for the local nt token. Fallback
  to a SID/UID based mapping if the name based lookup fails;
  (bsc#1192849); (bso#14901).</changelog>
  <changelog author="nopower@suse.com" date="1642766400">- CVE-2021-44142: Out-of-Bound Read/Write on Samba vfs_fruit
  module; (bsc#1194859); (bso#14914).</changelog>
</package>
<package pkgid="dac1fba55dcabe546f2a0876c0ab4f2b9d281c3bdb5dc52d150dcaaa9b8c8068" name="libndr0" arch="aarch64">
  <version epoch="0" ver="4.11.14+git.319.91d693db37c" rel="4.35.1"/>
  <changelog author="scabrero@suse.de" date="1587556800">- CVE-2020-10704: LDAP Denial of Service (stack overflow) in
  Samba AD DC; (bso#14334); (bsc#1169851);
- CVE-2020-10700: Use-after-free in Samba AD DC LDAP Server with
  ASQ; (bso#14331); (bsc#1169850);</changelog>
  <changelog author="scabrero@suse.de" date="1588593600">- Require libldb2 &gt;= 2.0.10 after security release.</changelog>
  <changelog author="dmulder@suse.com" date="1589457600">- Fix samba_winbind package is installing python3-base without
  python3 package; (bsc#1169521);</changelog>
  <changelog author="scabrero@suse.de" date="1589457601">- Installing: samba - samba-ad-dc.service does not exist and unit
  not found; (bsc#1171437);</changelog>
  <changelog author="scabrero@suse.de" date="1591012800">- Add libnetapi-devel to baselibs conf, for wine usage; (bsc#1172307);</changelog>
  <changelog author="nopower@suse.com" date="1593691200">- Update to samba 4.11.11
  + CVE-2020-10730: NULL de-reference in AD DC LDAP server when ASQ
    and VLV combined; (bso#14364); (bsc#1173159]
  + CVE-2020-10745: invalid DNS or NBT queries containing dots use
    several seconds of CPU each; (bso#14378); (bsc#1173160).
  + CVE-2020-10760: Use-after-free in AD DC Global Catalog LDAP
    server with paged_result or VLV; (bso#14402); (bsc#1173161)
  + CVE-2020-14303: Endless loop from empty UDP packet sent to
    AD DC nbt_server; (bso#14417); (bsc#1173359).
- Update to samba 4.11.10
  + Fix segfault when using SMBC_opendir_ctx() routine for share
    folder that contains incorrect symbols in any file name;
    (bso#14374).
  + vfs_shadow_copy2 doesn't fail case looking in
    snapdirseverywhere mode; (bso#14350)
  + ldb_ldap: Fix off-by-one increment in lldb_add_msg_attr;
    (bso#14413).
  + Malicous SMB1 server can crash libsmbclient; (bso#14366)
  + winbindd: Fix a use-after-free when winbind clients exit;
    (bso#14382)
  + ldb: Bump version to 2.0.11, LMDB databases can grow without
    bounds. (bso#14330)
- Update to samba 4.11.9
  + nmblib: Avoid undefined behaviour in handle_name_ptrs();
    (bso#14242).
  + 'samba-tool group' commands do not handle group names with
    special chars correctly; (bso#14296).
  + smbd: avoid calling vfs_file_id_from_sbuf() if statinfo
    is not valid; (bso#14237).
  + Missing check for DMAPI offline status in async DOS
    attributes; (bso#14293).
  + smbd: Ignore set NTACL requests which contain
    S-1-5-88 NFS ACEs; (bso#14307).
  + vfs_recycle: Prevent flooding the log if we're called on
    non-existant paths; (bso#14316)
  + smbd mistakenly updates a file's write-time on close;
    (bso#14320).
  + RPC handles cannot be differentiated in source3 RPC server;
    (bso#14359).
  + librpc: Fix IDL for svcctl_ChangeServiceConfigW; (bso#14313).
  + nsswitch: Fix use-after-free causing segfault in
    _pam_delete_cred; (bso#14327).
  + Fix fruit:time machine max size on arm; (bso#13622)
  + CTDB recovery corner cases can cause record resurrection
    and node banning; (bso#14294).
  + ctdb: Fix a memleak; (bso#14348).
  + libsmb: Don't try to find posix stat info in SMBC_getatr().
  + ctdb-tcp: Move free of inbound queue to TCP restart;
    (bso#14295); (bsc#1162680).
  + s3/librpc/crypto: Fix double free with unresolved
    credential cache; (bso#14344); (bsc#1169095)
  + s3:libads: Fix ads_get_upn(); (bso#14336).
  + CTDB recovery corner cases can cause record resurrection
    and node banning; (bso#14294)
  + Starting ctdb node that was powered off hard before
    results in recovery loop; (bso#14295); (bsc#1162680).
  + ctdb-recoverd: Avoid dereferencing NULL rec-&gt;nodemap;
    (bso#14324)
- Update to samba 4.11.8
  + CVE-2020-10700: Use-after-free in Samba AD DC LDAP
    Server with ASQ; (bso#14331); (bsc#1169850);
  + CVE-2020-10704: LDAP Denial of Service (stack overflow)
    in Samba AD DC; (bso#14334); (bsc#1169851);
- Update to samba 4.11.7
  + s3: lib: nmblib. Clean up and harden nmb packet
    processing; (bso#14239).
  + s3: VFS: full_audit. Use system session_info if called
    from a temporary share definition; (bso#14283)
  + dsdb: Correctly handle memory in objectclass_attrs;
    (bso#14258).
  + ldb: version 2.0.9, Samba 4.11 and later give incorrect
    results for SCOPE_ONE searches; (bso#14270)
  + auth: Fix CIDs 1458418 and 1458420 Null pointer
    dereferences; (bso#14247).
  + smbd: Handle EINTR from open(2) properly; (bso#14285)
  + winbind member (source3) fails local SAM auth with empty
    domain name; (bso#14247)
  + winbindd: Handling missing idmap in getgrgid(); (bso#14265).
  + lib:util: Log mkdir error on correct debug levels;
    (bso#14253).
  + wafsamba: Do not use 'rU' as the 'U' is deprecated in
    Python 3.9; (bso#14266).
  + ctdb-tcp: Make error handling for outbound connection
    consistent; (bso#14274).
- Update to samba 4.11.6
  + pygpo: Use correct method flags; (bso#14209).
  + vfs_ceph_snapshots: Fix root relative path handling;
    (bso#14216); (bsc#1141320).
  + Avoiding bad call flags with python 3.8, using METH_NOARGS
    instead of zero; (bso#14209).
  + source4/utils/oLschema2ldif: Include stdint.h before
    cmocka.h; (bso#14218).
  + docs-xml/winbindnssinfo: Clarify interaction with
    idmap_ad etc; (bso#14122).
  + smbd: Fix the build with clang; (bso#14251).
  + upgradedns: Ensure lmdb lock files linked; (bso#14199).
  + s3: VFS: glusterfs: Reset nlinks for symlink entries during
    readdir; (bso#14182).
  + smbc_stat() doesn't return the correct st_mode and also
    the uid/gid is not filled (SMBv1) file; (bso#14101).
  + librpc: Fix string length checking in
    ndr_pull_charset_to_null(); (bso#14219).
  + ctdb-scripts: Strip square brackets when gathering
    connection info; (bso#14227).</changelog>
  <changelog author="dmulder@suse.com" date="1594728000">- Fix net command unable to negotiate SMB2; (bsc#1174120);</changelog>
  <changelog author="scabrero@suse.de" date="1595851200">- Add obsoletes to libsmbldap2 package to fix upgrades from previous
  versions; (bsc#1172810);</changelog>
  <changelog author="scabrero@suse.de" date="1600430400">- Update to samba 4.11.13
  + CVE-2020-1472(ZeroLogon): s3:rpc_server/netlogon: Protect
    netr_ServerPasswordSet2 against unencrypted passwords; (bsc#1176579);
    (bso#14497);
  + CVE-2020-1472(ZeroLogon): s3:rpc_server/netlogon: Support
    "server require schannel:WORKSTATION$ = no" about unsecure configurations;
    (bsc#1176579); (bso#14497);
  + CVE-2020-1472(ZeroLogon): s4 torture rpc: repeated bytes in client
    challenge; (bsc#1176579); (bso#14497);
  + CVE-2020-1472(ZeroLogon): libcli/auth: Reject weak client challenges in
    netlogon_creds_server_init() "server require schannel:WORKSTATION$ = no";
    (bsc#1176579); (bso#14497);
- Update to samba 4.11.12
  + s3: libsmb: Fix SMB2 client rename bug to a Windows server; (bso#14403);
  + dsdb: Allow "password hash userPassword schemes = CryptSHA256" to work
    on RHEL7; (bso#14424);
  + dbcheck: Allow a dangling forward link outside our known NCs; (bso#14450);
  + lib/debug: Set the correct default backend loglevel to MAX_DEBUG_LEVEL;
    (bso#14426);
  + s3:smbd: PANIC: assert failed in get_lease_type(); (bso#14428);
  + lib/util: do not install "test_util_paths"; (bso#14370);
  + lib:util: Fix smbclient -l basename dir; (bso#14345);
  + s3:smbd: PANIC: assert failed in get_lease_type(); (bso#14428);
  + util: Allow symlinks in directory_create_or_exist; (bso#14166);
  + docs: Fix documentation for require_membership_of of pam_winbind;
    (bso#14358);
  + s3:winbind:idmap_ad: Make failure to get attrnames for schema mode fatal;
    (bso#14425);</changelog>
  <changelog author="scabrero@suse.de" date="1602590400">- CVE-2020-14383: An authenticated user can crash the DCE/RPC DNS with
  easily crafted records; (bsc#1177613); (bso#14472);
- CVE-2020-14323: Unprivileged user can crash winbind; (bsc#1173994);
  (bso#14436);
- CVE-2020-14318: Missing handle permissions check in SMB1/2/3 ChangeNotify;
  (bsc#1173902); (bso#14434);
- Update to samba 4.11.14
  + lib/util: Do not install /usr/bin/test_util; (bso#14166);
  + smbd: don't log success as error; (bso#14490);
  + idmap_ad does not deal properly with a RFC4511 section 4.4.1 response;
    (bso#14465);
  + winbind: Fix a memleak; (bso#14388);
  + idmap_ad: Pass tldap debug messages on to DEBUG(); (bso#14465);
  + lib/replace: Move lib/replace/closefrom.c from ROKEN_HOSTCC_SOURCE to
    REPLACE_HOSTCC_SOURCE; (bso#14482);
  + ctdb disable/enable can fail due to race condition; (bso#14466);</changelog>
  <changelog author="nopower@suse.com" date="1604577600">- Adjust smbcacls '--propagate-inheritance' feature to align with
  upstream; (bsc#1178469).</changelog>
  <changelog author="nopower@suse.com" date="1612440000">- Avoid free'ing our own pointer in memcache when memcache_trim
  attempts to reduce cache size; (bso#14625); (bnc#1179156).</changelog>
  <changelog author="nopower@suse.com" date="1615896000">- CVE-2020-27840: samba: Unauthenticated remote heap corruption
  via bad DNs; (bso#14595); (bsc#1183572).
- CVE-2021-20277: samba: out of bounds read in ldb_handler_fold;
  (bso#14655); (bsc#1183574).</changelog>
  <changelog author="dmulder@suse.com" date="1616760000">- s3-libads: use dns name to open a ldap session; (bso#13124);
  (bsc#1184310).</changelog>
  <changelog author="nopower@suse.com" date="1618401600">-  CVE-2021-20254 Buffer overrun in sids_to_unixids();
  (bnc#14571); (bsc#1184677).</changelog>
  <changelog author="scabrero@suse.de" date="1619697600">- Add msDS-AdditionalDnsHostName to the keytab; (bso#14396);
  (bsc#1185420);
- Add net-ads-join dnshostname option; (bso#14396); (bsc#1185420);
- Fix adding msDS-AdditionalDnsHostName to keytab with Windows DC;
  (bso#14406); (bsc#1185420);</changelog>
  <changelog author="scabrero@suse.de" date="1629892800">- Fix wrong kvno exported to keytab after net ads changetrustpw due
  to replication delay; (bsc#1188727);</changelog>
  <changelog author="nopower@suse.com" date="1635854400">- CVE-2016-2124: SMB1 client connections can be downgraded to
  plaintext authentication (bsc#1014440); (bso#12444);
- CVE-2020-25717: A user in an AD Domain could become root on
  domain members; (bsc#1192284); (bso#14556);
- CVE-2021-23192: Subsequent DCE/RPC fragment injection vulnerability;
  (bsc#1192214); (bso#14875);</changelog>
  <changelog author="nopower@suse.com" date="1637236800">- The username map [script] advice from CVE-2020-25717 advisory
  note has undesired side effects for the local nt token. Fallback
  to a SID/UID based mapping if the name based lookup fails;
  (bsc#1192849); (bso#14901).</changelog>
  <changelog author="nopower@suse.com" date="1642766400">- CVE-2021-44142: Out-of-Bound Read/Write on Samba vfs_fruit
  module; (bsc#1194859); (bso#14914).</changelog>
</package>
<package pkgid="e2037859bebee5d92e2bcde38f9ba86e84b547f81d29307913444a1fafe62469" name="libndr0" arch="ppc64le">
  <version epoch="0" ver="4.11.14+git.319.91d693db37c" rel="4.35.1"/>
  <changelog author="scabrero@suse.de" date="1587556800">- CVE-2020-10704: LDAP Denial of Service (stack overflow) in
  Samba AD DC; (bso#14334); (bsc#1169851);
- CVE-2020-10700: Use-after-free in Samba AD DC LDAP Server with
  ASQ; (bso#14331); (bsc#1169850);</changelog>
  <changelog author="scabrero@suse.de" date="1588593600">- Require libldb2 &gt;= 2.0.10 after security release.</changelog>
  <changelog author="dmulder@suse.com" date="1589457600">- Fix samba_winbind package is installing python3-base without
  python3 package; (bsc#1169521);</changelog>
  <changelog author="scabrero@suse.de" date="1589457601">- Installing: samba - samba-ad-dc.service does not exist and unit
  not found; (bsc#1171437);</changelog>
  <changelog author="scabrero@suse.de" date="1591012800">- Add libnetapi-devel to baselibs conf, for wine usage; (bsc#1172307);</changelog>
  <changelog author="nopower@suse.com" date="1593691200">- Update to samba 4.11.11
  + CVE-2020-10730: NULL de-reference in AD DC LDAP server when ASQ
    and VLV combined; (bso#14364); (bsc#1173159]
  + CVE-2020-10745: invalid DNS or NBT queries containing dots use
    several seconds of CPU each; (bso#14378); (bsc#1173160).
  + CVE-2020-10760: Use-after-free in AD DC Global Catalog LDAP
    server with paged_result or VLV; (bso#14402); (bsc#1173161)
  + CVE-2020-14303: Endless loop from empty UDP packet sent to
    AD DC nbt_server; (bso#14417); (bsc#1173359).
- Update to samba 4.11.10
  + Fix segfault when using SMBC_opendir_ctx() routine for share
    folder that contains incorrect symbols in any file name;
    (bso#14374).
  + vfs_shadow_copy2 doesn't fail case looking in
    snapdirseverywhere mode; (bso#14350)
  + ldb_ldap: Fix off-by-one increment in lldb_add_msg_attr;
    (bso#14413).
  + Malicous SMB1 server can crash libsmbclient; (bso#14366)
  + winbindd: Fix a use-after-free when winbind clients exit;
    (bso#14382)
  + ldb: Bump version to 2.0.11, LMDB databases can grow without
    bounds. (bso#14330)
- Update to samba 4.11.9
  + nmblib: Avoid undefined behaviour in handle_name_ptrs();
    (bso#14242).
  + 'samba-tool group' commands do not handle group names with
    special chars correctly; (bso#14296).
  + smbd: avoid calling vfs_file_id_from_sbuf() if statinfo
    is not valid; (bso#14237).
  + Missing check for DMAPI offline status in async DOS
    attributes; (bso#14293).
  + smbd: Ignore set NTACL requests which contain
    S-1-5-88 NFS ACEs; (bso#14307).
  + vfs_recycle: Prevent flooding the log if we're called on
    non-existant paths; (bso#14316)
  + smbd mistakenly updates a file's write-time on close;
    (bso#14320).
  + RPC handles cannot be differentiated in source3 RPC server;
    (bso#14359).
  + librpc: Fix IDL for svcctl_ChangeServiceConfigW; (bso#14313).
  + nsswitch: Fix use-after-free causing segfault in
    _pam_delete_cred; (bso#14327).
  + Fix fruit:time machine max size on arm; (bso#13622)
  + CTDB recovery corner cases can cause record resurrection
    and node banning; (bso#14294).
  + ctdb: Fix a memleak; (bso#14348).
  + libsmb: Don't try to find posix stat info in SMBC_getatr().
  + ctdb-tcp: Move free of inbound queue to TCP restart;
    (bso#14295); (bsc#1162680).
  + s3/librpc/crypto: Fix double free with unresolved
    credential cache; (bso#14344); (bsc#1169095)
  + s3:libads: Fix ads_get_upn(); (bso#14336).
  + CTDB recovery corner cases can cause record resurrection
    and node banning; (bso#14294)
  + Starting ctdb node that was powered off hard before
    results in recovery loop; (bso#14295); (bsc#1162680).
  + ctdb-recoverd: Avoid dereferencing NULL rec-&gt;nodemap;
    (bso#14324)
- Update to samba 4.11.8
  + CVE-2020-10700: Use-after-free in Samba AD DC LDAP
    Server with ASQ; (bso#14331); (bsc#1169850);
  + CVE-2020-10704: LDAP Denial of Service (stack overflow)
    in Samba AD DC; (bso#14334); (bsc#1169851);
- Update to samba 4.11.7
  + s3: lib: nmblib. Clean up and harden nmb packet
    processing; (bso#14239).
  + s3: VFS: full_audit. Use system session_info if called
    from a temporary share definition; (bso#14283)
  + dsdb: Correctly handle memory in objectclass_attrs;
    (bso#14258).
  + ldb: version 2.0.9, Samba 4.11 and later give incorrect
    results for SCOPE_ONE searches; (bso#14270)
  + auth: Fix CIDs 1458418 and 1458420 Null pointer
    dereferences; (bso#14247).
  + smbd: Handle EINTR from open(2) properly; (bso#14285)
  + winbind member (source3) fails local SAM auth with empty
    domain name; (bso#14247)
  + winbindd: Handling missing idmap in getgrgid(); (bso#14265).
  + lib:util: Log mkdir error on correct debug levels;
    (bso#14253).
  + wafsamba: Do not use 'rU' as the 'U' is deprecated in
    Python 3.9; (bso#14266).
  + ctdb-tcp: Make error handling for outbound connection
    consistent; (bso#14274).
- Update to samba 4.11.6
  + pygpo: Use correct method flags; (bso#14209).
  + vfs_ceph_snapshots: Fix root relative path handling;
    (bso#14216); (bsc#1141320).
  + Avoiding bad call flags with python 3.8, using METH_NOARGS
    instead of zero; (bso#14209).
  + source4/utils/oLschema2ldif: Include stdint.h before
    cmocka.h; (bso#14218).
  + docs-xml/winbindnssinfo: Clarify interaction with
    idmap_ad etc; (bso#14122).
  + smbd: Fix the build with clang; (bso#14251).
  + upgradedns: Ensure lmdb lock files linked; (bso#14199).
  + s3: VFS: glusterfs: Reset nlinks for symlink entries during
    readdir; (bso#14182).
  + smbc_stat() doesn't return the correct st_mode and also
    the uid/gid is not filled (SMBv1) file; (bso#14101).
  + librpc: Fix string length checking in
    ndr_pull_charset_to_null(); (bso#14219).
  + ctdb-scripts: Strip square brackets when gathering
    connection info; (bso#14227).</changelog>
  <changelog author="dmulder@suse.com" date="1594728000">- Fix net command unable to negotiate SMB2; (bsc#1174120);</changelog>
  <changelog author="scabrero@suse.de" date="1595851200">- Add obsoletes to libsmbldap2 package to fix upgrades from previous
  versions; (bsc#1172810);</changelog>
  <changelog author="scabrero@suse.de" date="1600430400">- Update to samba 4.11.13
  + CVE-2020-1472(ZeroLogon): s3:rpc_server/netlogon: Protect
    netr_ServerPasswordSet2 against unencrypted passwords; (bsc#1176579);
    (bso#14497);
  + CVE-2020-1472(ZeroLogon): s3:rpc_server/netlogon: Support
    "server require schannel:WORKSTATION$ = no" about unsecure configurations;
    (bsc#1176579); (bso#14497);
  + CVE-2020-1472(ZeroLogon): s4 torture rpc: repeated bytes in client
    challenge; (bsc#1176579); (bso#14497);
  + CVE-2020-1472(ZeroLogon): libcli/auth: Reject weak client challenges in
    netlogon_creds_server_init() "server require schannel:WORKSTATION$ = no";
    (bsc#1176579); (bso#14497);
- Update to samba 4.11.12
  + s3: libsmb: Fix SMB2 client rename bug to a Windows server; (bso#14403);
  + dsdb: Allow "password hash userPassword schemes = CryptSHA256" to work
    on RHEL7; (bso#14424);
  + dbcheck: Allow a dangling forward link outside our known NCs; (bso#14450);
  + lib/debug: Set the correct default backend loglevel to MAX_DEBUG_LEVEL;
    (bso#14426);
  + s3:smbd: PANIC: assert failed in get_lease_type(); (bso#14428);
  + lib/util: do not install "test_util_paths"; (bso#14370);
  + lib:util: Fix smbclient -l basename dir; (bso#14345);
  + s3:smbd: PANIC: assert failed in get_lease_type(); (bso#14428);
  + util: Allow symlinks in directory_create_or_exist; (bso#14166);
  + docs: Fix documentation for require_membership_of of pam_winbind;
    (bso#14358);
  + s3:winbind:idmap_ad: Make failure to get attrnames for schema mode fatal;
    (bso#14425);</changelog>
  <changelog author="scabrero@suse.de" date="1602590400">- CVE-2020-14383: An authenticated user can crash the DCE/RPC DNS with
  easily crafted records; (bsc#1177613); (bso#14472);
- CVE-2020-14323: Unprivileged user can crash winbind; (bsc#1173994);
  (bso#14436);
- CVE-2020-14318: Missing handle permissions check in SMB1/2/3 ChangeNotify;
  (bsc#1173902); (bso#14434);
- Update to samba 4.11.14
  + lib/util: Do not install /usr/bin/test_util; (bso#14166);
  + smbd: don't log success as error; (bso#14490);
  + idmap_ad does not deal properly with a RFC4511 section 4.4.1 response;
    (bso#14465);
  + winbind: Fix a memleak; (bso#14388);
  + idmap_ad: Pass tldap debug messages on to DEBUG(); (bso#14465);
  + lib/replace: Move lib/replace/closefrom.c from ROKEN_HOSTCC_SOURCE to
    REPLACE_HOSTCC_SOURCE; (bso#14482);
  + ctdb disable/enable can fail due to race condition; (bso#14466);</changelog>
  <changelog author="nopower@suse.com" date="1604577600">- Adjust smbcacls '--propagate-inheritance' feature to align with
  upstream; (bsc#1178469).</changelog>
  <changelog author="nopower@suse.com" date="1612440000">- Avoid free'ing our own pointer in memcache when memcache_trim
  attempts to reduce cache size; (bso#14625); (bnc#1179156).</changelog>
  <changelog author="nopower@suse.com" date="1615896000">- CVE-2020-27840: samba: Unauthenticated remote heap corruption
  via bad DNs; (bso#14595); (bsc#1183572).
- CVE-2021-20277: samba: out of bounds read in ldb_handler_fold;
  (bso#14655); (bsc#1183574).</changelog>
  <changelog author="dmulder@suse.com" date="1616760000">- s3-libads: use dns name to open a ldap session; (bso#13124);
  (bsc#1184310).</changelog>
  <changelog author="nopower@suse.com" date="1618401600">-  CVE-2021-20254 Buffer overrun in sids_to_unixids();
  (bnc#14571); (bsc#1184677).</changelog>
  <changelog author="scabrero@suse.de" date="1619697600">- Add msDS-AdditionalDnsHostName to the keytab; (bso#14396);
  (bsc#1185420);
- Add net-ads-join dnshostname option; (bso#14396); (bsc#1185420);
- Fix adding msDS-AdditionalDnsHostName to keytab with Windows DC;
  (bso#14406); (bsc#1185420);</changelog>
  <changelog author="scabrero@suse.de" date="1629892800">- Fix wrong kvno exported to keytab after net ads changetrustpw due
  to replication delay; (bsc#1188727);</changelog>
  <changelog author="nopower@suse.com" date="1635854400">- CVE-2016-2124: SMB1 client connections can be downgraded to
  plaintext authentication (bsc#1014440); (bso#12444);
- CVE-2020-25717: A user in an AD Domain could become root on
  domain members; (bsc#1192284); (bso#14556);
- CVE-2021-23192: Subsequent DCE/RPC fragment injection vulnerability;
  (bsc#1192214); (bso#14875);</changelog>
  <changelog author="nopower@suse.com" date="1637236800">- The username map [script] advice from CVE-2020-25717 advisory
  note has undesired side effects for the local nt token. Fallback
  to a SID/UID based mapping if the name based lookup fails;
  (bsc#1192849); (bso#14901).</changelog>
  <changelog author="nopower@suse.com" date="1642766400">- CVE-2021-44142: Out-of-Bound Read/Write on Samba vfs_fruit
  module; (bsc#1194859); (bso#14914).</changelog>
</package>
<package pkgid="930428733228386490afbbab6d4b252e990eced75d8905cb3e9b443edab1b9e6" name="libndr0" arch="s390x">
  <version epoch="0" ver="4.11.14+git.319.91d693db37c" rel="4.35.1"/>
  <changelog author="scabrero@suse.de" date="1587556800">- CVE-2020-10704: LDAP Denial of Service (stack overflow) in
  Samba AD DC; (bso#14334); (bsc#1169851);
- CVE-2020-10700: Use-after-free in Samba AD DC LDAP Server with
  ASQ; (bso#14331); (bsc#1169850);</changelog>
  <changelog author="scabrero@suse.de" date="1588593600">- Require libldb2 &gt;= 2.0.10 after security release.</changelog>
  <changelog author="dmulder@suse.com" date="1589457600">- Fix samba_winbind package is installing python3-base without
  python3 package; (bsc#1169521);</changelog>
  <changelog author="scabrero@suse.de" date="1589457601">- Installing: samba - samba-ad-dc.service does not exist and unit
  not found; (bsc#1171437);</changelog>
  <changelog author="scabrero@suse.de" date="1591012800">- Add libnetapi-devel to baselibs conf, for wine usage; (bsc#1172307);</changelog>
  <changelog author="nopower@suse.com" date="1593691200">- Update to samba 4.11.11
  + CVE-2020-10730: NULL de-reference in AD DC LDAP server when ASQ
    and VLV combined; (bso#14364); (bsc#1173159]
  + CVE-2020-10745: invalid DNS or NBT queries containing dots use
    several seconds of CPU each; (bso#14378); (bsc#1173160).
  + CVE-2020-10760: Use-after-free in AD DC Global Catalog LDAP
    server with paged_result or VLV; (bso#14402); (bsc#1173161)
  + CVE-2020-14303: Endless loop from empty UDP packet sent to
    AD DC nbt_server; (bso#14417); (bsc#1173359).
- Update to samba 4.11.10
  + Fix segfault when using SMBC_opendir_ctx() routine for share
    folder that contains incorrect symbols in any file name;
    (bso#14374).
  + vfs_shadow_copy2 doesn't fail case looking in
    snapdirseverywhere mode; (bso#14350)
  + ldb_ldap: Fix off-by-one increment in lldb_add_msg_attr;
    (bso#14413).
  + Malicous SMB1 server can crash libsmbclient; (bso#14366)
  + winbindd: Fix a use-after-free when winbind clients exit;
    (bso#14382)
  + ldb: Bump version to 2.0.11, LMDB databases can grow without
    bounds. (bso#14330)
- Update to samba 4.11.9
  + nmblib: Avoid undefined behaviour in handle_name_ptrs();
    (bso#14242).
  + 'samba-tool group' commands do not handle group names with
    special chars correctly; (bso#14296).
  + smbd: avoid calling vfs_file_id_from_sbuf() if statinfo
    is not valid; (bso#14237).
  + Missing check for DMAPI offline status in async DOS
    attributes; (bso#14293).
  + smbd: Ignore set NTACL requests which contain
    S-1-5-88 NFS ACEs; (bso#14307).
  + vfs_recycle: Prevent flooding the log if we're called on
    non-existant paths; (bso#14316)
  + smbd mistakenly updates a file's write-time on close;
    (bso#14320).
  + RPC handles cannot be differentiated in source3 RPC server;
    (bso#14359).
  + librpc: Fix IDL for svcctl_ChangeServiceConfigW; (bso#14313).
  + nsswitch: Fix use-after-free causing segfault in
    _pam_delete_cred; (bso#14327).
  + Fix fruit:time machine max size on arm; (bso#13622)
  + CTDB recovery corner cases can cause record resurrection
    and node banning; (bso#14294).
  + ctdb: Fix a memleak; (bso#14348).
  + libsmb: Don't try to find posix stat info in SMBC_getatr().
  + ctdb-tcp: Move free of inbound queue to TCP restart;
    (bso#14295); (bsc#1162680).
  + s3/librpc/crypto: Fix double free with unresolved
    credential cache; (bso#14344); (bsc#1169095)
  + s3:libads: Fix ads_get_upn(); (bso#14336).
  + CTDB recovery corner cases can cause record resurrection
    and node banning; (bso#14294)
  + Starting ctdb node that was powered off hard before
    results in recovery loop; (bso#14295); (bsc#1162680).
  + ctdb-recoverd: Avoid dereferencing NULL rec-&gt;nodemap;
    (bso#14324)
- Update to samba 4.11.8
  + CVE-2020-10700: Use-after-free in Samba AD DC LDAP
    Server with ASQ; (bso#14331); (bsc#1169850);
  + CVE-2020-10704: LDAP Denial of Service (stack overflow)
    in Samba AD DC; (bso#14334); (bsc#1169851);
- Update to samba 4.11.7
  + s3: lib: nmblib. Clean up and harden nmb packet
    processing; (bso#14239).
  + s3: VFS: full_audit. Use system session_info if called
    from a temporary share definition; (bso#14283)
  + dsdb: Correctly handle memory in objectclass_attrs;
    (bso#14258).
  + ldb: version 2.0.9, Samba 4.11 and later give incorrect
    results for SCOPE_ONE searches; (bso#14270)
  + auth: Fix CIDs 1458418 and 1458420 Null pointer
    dereferences; (bso#14247).
  + smbd: Handle EINTR from open(2) properly; (bso#14285)
  + winbind member (source3) fails local SAM auth with empty
    domain name; (bso#14247)
  + winbindd: Handling missing idmap in getgrgid(); (bso#14265).
  + lib:util: Log mkdir error on correct debug levels;
    (bso#14253).
  + wafsamba: Do not use 'rU' as the 'U' is deprecated in
    Python 3.9; (bso#14266).
  + ctdb-tcp: Make error handling for outbound connection
    consistent; (bso#14274).
- Update to samba 4.11.6
  + pygpo: Use correct method flags; (bso#14209).
  + vfs_ceph_snapshots: Fix root relative path handling;
    (bso#14216); (bsc#1141320).
  + Avoiding bad call flags with python 3.8, using METH_NOARGS
    instead of zero; (bso#14209).
  + source4/utils/oLschema2ldif: Include stdint.h before
    cmocka.h; (bso#14218).
  + docs-xml/winbindnssinfo: Clarify interaction with
    idmap_ad etc; (bso#14122).
  + smbd: Fix the build with clang; (bso#14251).
  + upgradedns: Ensure lmdb lock files linked; (bso#14199).
  + s3: VFS: glusterfs: Reset nlinks for symlink entries during
    readdir; (bso#14182).
  + smbc_stat() doesn't return the correct st_mode and also
    the uid/gid is not filled (SMBv1) file; (bso#14101).
  + librpc: Fix string length checking in
    ndr_pull_charset_to_null(); (bso#14219).
  + ctdb-scripts: Strip square brackets when gathering
    connection info; (bso#14227).</changelog>
  <changelog author="dmulder@suse.com" date="1594728000">- Fix net command unable to negotiate SMB2; (bsc#1174120);</changelog>
  <changelog author="scabrero@suse.de" date="1595851200">- Add obsoletes to libsmbldap2 package to fix upgrades from previous
  versions; (bsc#1172810);</changelog>
  <changelog author="scabrero@suse.de" date="1600430400">- Update to samba 4.11.13
  + CVE-2020-1472(ZeroLogon): s3:rpc_server/netlogon: Protect
    netr_ServerPasswordSet2 against unencrypted passwords; (bsc#1176579);
    (bso#14497);
  + CVE-2020-1472(ZeroLogon): s3:rpc_server/netlogon: Support
    "server require schannel:WORKSTATION$ = no" about unsecure configurations;
    (bsc#1176579); (bso#14497);
  + CVE-2020-1472(ZeroLogon): s4 torture rpc: repeated bytes in client
    challenge; (bsc#1176579); (bso#14497);
  + CVE-2020-1472(ZeroLogon): libcli/auth: Reject weak client challenges in
    netlogon_creds_server_init() "server require schannel:WORKSTATION$ = no";
    (bsc#1176579); (bso#14497);
- Update to samba 4.11.12
  + s3: libsmb: Fix SMB2 client rename bug to a Windows server; (bso#14403);
  + dsdb: Allow "password hash userPassword schemes = CryptSHA256" to work
    on RHEL7; (bso#14424);
  + dbcheck: Allow a dangling forward link outside our known NCs; (bso#14450);
  + lib/debug: Set the correct default backend loglevel to MAX_DEBUG_LEVEL;
    (bso#14426);
  + s3:smbd: PANIC: assert failed in get_lease_type(); (bso#14428);
  + lib/util: do not install "test_util_paths"; (bso#14370);
  + lib:util: Fix smbclient -l basename dir; (bso#14345);
  + s3:smbd: PANIC: assert failed in get_lease_type(); (bso#14428);
  + util: Allow symlinks in directory_create_or_exist; (bso#14166);
  + docs: Fix documentation for require_membership_of of pam_winbind;
    (bso#14358);
  + s3:winbind:idmap_ad: Make failure to get attrnames for schema mode fatal;
    (bso#14425);</changelog>
  <changelog author="scabrero@suse.de" date="1602590400">- CVE-2020-14383: An authenticated user can crash the DCE/RPC DNS with
  easily crafted records; (bsc#1177613); (bso#14472);
- CVE-2020-14323: Unprivileged user can crash winbind; (bsc#1173994);
  (bso#14436);
- CVE-2020-14318: Missing handle permissions check in SMB1/2/3 ChangeNotify;
  (bsc#1173902); (bso#14434);
- Update to samba 4.11.14
  + lib/util: Do not install /usr/bin/test_util; (bso#14166);
  + smbd: don't log success as error; (bso#14490);
  + idmap_ad does not deal properly with a RFC4511 section 4.4.1 response;
    (bso#14465);
  + winbind: Fix a memleak; (bso#14388);
  + idmap_ad: Pass tldap debug messages on to DEBUG(); (bso#14465);
  + lib/replace: Move lib/replace/closefrom.c from ROKEN_HOSTCC_SOURCE to
    REPLACE_HOSTCC_SOURCE; (bso#14482);
  + ctdb disable/enable can fail due to race condition; (bso#14466);</changelog>
  <changelog author="nopower@suse.com" date="1604577600">- Adjust smbcacls '--propagate-inheritance' feature to align with
  upstream; (bsc#1178469).</changelog>
  <changelog author="nopower@suse.com" date="1612440000">- Avoid free'ing our own pointer in memcache when memcache_trim
  attempts to reduce cache size; (bso#14625); (bnc#1179156).</changelog>
  <changelog author="nopower@suse.com" date="1615896000">- CVE-2020-27840: samba: Unauthenticated remote heap corruption
  via bad DNs; (bso#14595); (bsc#1183572).
- CVE-2021-20277: samba: out of bounds read in ldb_handler_fold;
  (bso#14655); (bsc#1183574).</changelog>
  <changelog author="dmulder@suse.com" date="1616760000">- s3-libads: use dns name to open a ldap session; (bso#13124);
  (bsc#1184310).</changelog>
  <changelog author="nopower@suse.com" date="1618401600">-  CVE-2021-20254 Buffer overrun in sids_to_unixids();
  (bnc#14571); (bsc#1184677).</changelog>
  <changelog author="scabrero@suse.de" date="1619697600">- Add msDS-AdditionalDnsHostName to the keytab; (bso#14396);
  (bsc#1185420);
- Add net-ads-join dnshostname option; (bso#14396); (bsc#1185420);
- Fix adding msDS-AdditionalDnsHostName to keytab with Windows DC;
  (bso#14406); (bsc#1185420);</changelog>
  <changelog author="scabrero@suse.de" date="1629892800">- Fix wrong kvno exported to keytab after net ads changetrustpw due
  to replication delay; (bsc#1188727);</changelog>
  <changelog author="nopower@suse.com" date="1635854400">- CVE-2016-2124: SMB1 client connections can be downgraded to
  plaintext authentication (bsc#1014440); (bso#12444);
- CVE-2020-25717: A user in an AD Domain could become root on
  domain members; (bsc#1192284); (bso#14556);
- CVE-2021-23192: Subsequent DCE/RPC fragment injection vulnerability;
  (bsc#1192214); (bso#14875);</changelog>
  <changelog author="nopower@suse.com" date="1637236800">- The username map [script] advice from CVE-2020-25717 advisory
  note has undesired side effects for the local nt token. Fallback
  to a SID/UID based mapping if the name based lookup fails;
  (bsc#1192849); (bso#14901).</changelog>
  <changelog author="nopower@suse.com" date="1642766400">- CVE-2021-44142: Out-of-Bound Read/Write on Samba vfs_fruit
  module; (bsc#1194859); (bso#14914).</changelog>
</package>
<package pkgid="e927c40cca999824bfcd0721fc7d8623165cb26d4e9ca1a9b0e61bfd91cc78e1" name="libndr0" arch="x86_64">
  <version epoch="0" ver="4.11.14+git.319.91d693db37c" rel="4.35.1"/>
  <changelog author="scabrero@suse.de" date="1587556800">- CVE-2020-10704: LDAP Denial of Service (stack overflow) in
  Samba AD DC; (bso#14334); (bsc#1169851);
- CVE-2020-10700: Use-after-free in Samba AD DC LDAP Server with
  ASQ; (bso#14331); (bsc#1169850);</changelog>
  <changelog author="scabrero@suse.de" date="1588593600">- Require libldb2 &gt;= 2.0.10 after security release.</changelog>
  <changelog author="dmulder@suse.com" date="1589457600">- Fix samba_winbind package is installing python3-base without
  python3 package; (bsc#1169521);</changelog>
  <changelog author="scabrero@suse.de" date="1589457601">- Installing: samba - samba-ad-dc.service does not exist and unit
  not found; (bsc#1171437);</changelog>
  <changelog author="scabrero@suse.de" date="1591012800">- Add libnetapi-devel to baselibs conf, for wine usage; (bsc#1172307);</changelog>
  <changelog author="nopower@suse.com" date="1593691200">- Update to samba 4.11.11
  + CVE-2020-10730: NULL de-reference in AD DC LDAP server when ASQ
    and VLV combined; (bso#14364); (bsc#1173159]
  + CVE-2020-10745: invalid DNS or NBT queries containing dots use
    several seconds of CPU each; (bso#14378); (bsc#1173160).
  + CVE-2020-10760: Use-after-free in AD DC Global Catalog LDAP
    server with paged_result or VLV; (bso#14402); (bsc#1173161)
  + CVE-2020-14303: Endless loop from empty UDP packet sent to
    AD DC nbt_server; (bso#14417); (bsc#1173359).
- Update to samba 4.11.10
  + Fix segfault when using SMBC_opendir_ctx() routine for share
    folder that contains incorrect symbols in any file name;
    (bso#14374).
  + vfs_shadow_copy2 doesn't fail case looking in
    snapdirseverywhere mode; (bso#14350)
  + ldb_ldap: Fix off-by-one increment in lldb_add_msg_attr;
    (bso#14413).
  + Malicous SMB1 server can crash libsmbclient; (bso#14366)
  + winbindd: Fix a use-after-free when winbind clients exit;
    (bso#14382)
  + ldb: Bump version to 2.0.11, LMDB databases can grow without
    bounds. (bso#14330)
- Update to samba 4.11.9
  + nmblib: Avoid undefined behaviour in handle_name_ptrs();
    (bso#14242).
  + 'samba-tool group' commands do not handle group names with
    special chars correctly; (bso#14296).
  + smbd: avoid calling vfs_file_id_from_sbuf() if statinfo
    is not valid; (bso#14237).
  + Missing check for DMAPI offline status in async DOS
    attributes; (bso#14293).
  + smbd: Ignore set NTACL requests which contain
    S-1-5-88 NFS ACEs; (bso#14307).
  + vfs_recycle: Prevent flooding the log if we're called on
    non-existant paths; (bso#14316)
  + smbd mistakenly updates a file's write-time on close;
    (bso#14320).
  + RPC handles cannot be differentiated in source3 RPC server;
    (bso#14359).
  + librpc: Fix IDL for svcctl_ChangeServiceConfigW; (bso#14313).
  + nsswitch: Fix use-after-free causing segfault in
    _pam_delete_cred; (bso#14327).
  + Fix fruit:time machine max size on arm; (bso#13622)
  + CTDB recovery corner cases can cause record resurrection
    and node banning; (bso#14294).
  + ctdb: Fix a memleak; (bso#14348).
  + libsmb: Don't try to find posix stat info in SMBC_getatr().
  + ctdb-tcp: Move free of inbound queue to TCP restart;
    (bso#14295); (bsc#1162680).
  + s3/librpc/crypto: Fix double free with unresolved
    credential cache; (bso#14344); (bsc#1169095)
  + s3:libads: Fix ads_get_upn(); (bso#14336).
  + CTDB recovery corner cases can cause record resurrection
    and node banning; (bso#14294)
  + Starting ctdb node that was powered off hard before
    results in recovery loop; (bso#14295); (bsc#1162680).
  + ctdb-recoverd: Avoid dereferencing NULL rec-&gt;nodemap;
    (bso#14324)
- Update to samba 4.11.8
  + CVE-2020-10700: Use-after-free in Samba AD DC LDAP
    Server with ASQ; (bso#14331); (bsc#1169850);
  + CVE-2020-10704: LDAP Denial of Service (stack overflow)
    in Samba AD DC; (bso#14334); (bsc#1169851);
- Update to samba 4.11.7
  + s3: lib: nmblib. Clean up and harden nmb packet
    processing; (bso#14239).
  + s3: VFS: full_audit. Use system session_info if called
    from a temporary share definition; (bso#14283)
  + dsdb: Correctly handle memory in objectclass_attrs;
    (bso#14258).
  + ldb: version 2.0.9, Samba 4.11 and later give incorrect
    results for SCOPE_ONE searches; (bso#14270)
  + auth: Fix CIDs 1458418 and 1458420 Null pointer
    dereferences; (bso#14247).
  + smbd: Handle EINTR from open(2) properly; (bso#14285)
  + winbind member (source3) fails local SAM auth with empty
    domain name; (bso#14247)
  + winbindd: Handling missing idmap in getgrgid(); (bso#14265).
  + lib:util: Log mkdir error on correct debug levels;
    (bso#14253).
  + wafsamba: Do not use 'rU' as the 'U' is deprecated in
    Python 3.9; (bso#14266).
  + ctdb-tcp: Make error handling for outbound connection
    consistent; (bso#14274).
- Update to samba 4.11.6
  + pygpo: Use correct method flags; (bso#14209).
  + vfs_ceph_snapshots: Fix root relative path handling;
    (bso#14216); (bsc#1141320).
  + Avoiding bad call flags with python 3.8, using METH_NOARGS
    instead of zero; (bso#14209).
  + source4/utils/oLschema2ldif: Include stdint.h before
    cmocka.h; (bso#14218).
  + docs-xml/winbindnssinfo: Clarify interaction with
    idmap_ad etc; (bso#14122).
  + smbd: Fix the build with clang; (bso#14251).
  + upgradedns: Ensure lmdb lock files linked; (bso#14199).
  + s3: VFS: glusterfs: Reset nlinks for symlink entries during
    readdir; (bso#14182).
  + smbc_stat() doesn't return the correct st_mode and also
    the uid/gid is not filled (SMBv1) file; (bso#14101).
  + librpc: Fix string length checking in
    ndr_pull_charset_to_null(); (bso#14219).
  + ctdb-scripts: Strip square brackets when gathering
    connection info; (bso#14227).</changelog>
  <changelog author="dmulder@suse.com" date="1594728000">- Fix net command unable to negotiate SMB2; (bsc#1174120);</changelog>
  <changelog author="scabrero@suse.de" date="1595851200">- Add obsoletes to libsmbldap2 package to fix upgrades from previous
  versions; (bsc#1172810);</changelog>
  <changelog author="scabrero@suse.de" date="1600430400">- Update to samba 4.11.13
  + CVE-2020-1472(ZeroLogon): s3:rpc_server/netlogon: Protect
    netr_ServerPasswordSet2 against unencrypted passwords; (bsc#1176579);
    (bso#14497);
  + CVE-2020-1472(ZeroLogon): s3:rpc_server/netlogon: Support
    "server require schannel:WORKSTATION$ = no" about unsecure configurations;
    (bsc#1176579); (bso#14497);
  + CVE-2020-1472(ZeroLogon): s4 torture rpc: repeated bytes in client
    challenge; (bsc#1176579); (bso#14497);
  + CVE-2020-1472(ZeroLogon): libcli/auth: Reject weak client challenges in
    netlogon_creds_server_init() "server require schannel:WORKSTATION$ = no";
    (bsc#1176579); (bso#14497);
- Update to samba 4.11.12
  + s3: libsmb: Fix SMB2 client rename bug to a Windows server; (bso#14403);
  + dsdb: Allow "password hash userPassword schemes = CryptSHA256" to work
    on RHEL7; (bso#14424);
  + dbcheck: Allow a dangling forward link outside our known NCs; (bso#14450);
  + lib/debug: Set the correct default backend loglevel to MAX_DEBUG_LEVEL;
    (bso#14426);
  + s3:smbd: PANIC: assert failed in get_lease_type(); (bso#14428);
  + lib/util: do not install "test_util_paths"; (bso#14370);
  + lib:util: Fix smbclient -l basename dir; (bso#14345);
  + s3:smbd: PANIC: assert failed in get_lease_type(); (bso#14428);
  + util: Allow symlinks in directory_create_or_exist; (bso#14166);
  + docs: Fix documentation for require_membership_of of pam_winbind;
    (bso#14358);
  + s3:winbind:idmap_ad: Make failure to get attrnames for schema mode fatal;
    (bso#14425);</changelog>
  <changelog author="scabrero@suse.de" date="1602590400">- CVE-2020-14383: An authenticated user can crash the DCE/RPC DNS with
  easily crafted records; (bsc#1177613); (bso#14472);
- CVE-2020-14323: Unprivileged user can crash winbind; (bsc#1173994);
  (bso#14436);
- CVE-2020-14318: Missing handle permissions check in SMB1/2/3 ChangeNotify;
  (bsc#1173902); (bso#14434);
- Update to samba 4.11.14
  + lib/util: Do not install /usr/bin/test_util; (bso#14166);
  + smbd: don't log success as error; (bso#14490);
  + idmap_ad does not deal properly with a RFC4511 section 4.4.1 response;
    (bso#14465);
  + winbind: Fix a memleak; (bso#14388);
  + idmap_ad: Pass tldap debug messages on to DEBUG(); (bso#14465);
  + lib/replace: Move lib/replace/closefrom.c from ROKEN_HOSTCC_SOURCE to
    REPLACE_HOSTCC_SOURCE; (bso#14482);
  + ctdb disable/enable can fail due to race condition; (bso#14466);</changelog>
  <changelog author="nopower@suse.com" date="1604577600">- Adjust smbcacls '--propagate-inheritance' feature to align with
  upstream; (bsc#1178469).</changelog>
  <changelog author="nopower@suse.com" date="1612440000">- Avoid free'ing our own pointer in memcache when memcache_trim
  attempts to reduce cache size; (bso#14625); (bnc#1179156).</changelog>
  <changelog author="nopower@suse.com" date="1615896000">- CVE-2020-27840: samba: Unauthenticated remote heap corruption
  via bad DNs; (bso#14595); (bsc#1183572).
- CVE-2021-20277: samba: out of bounds read in ldb_handler_fold;
  (bso#14655); (bsc#1183574).</changelog>
  <changelog author="dmulder@suse.com" date="1616760000">- s3-libads: use dns name to open a ldap session; (bso#13124);
  (bsc#1184310).</changelog>
  <changelog author="nopower@suse.com" date="1618401600">-  CVE-2021-20254 Buffer overrun in sids_to_unixids();
  (bnc#14571); (bsc#1184677).</changelog>
  <changelog author="scabrero@suse.de" date="1619697600">- Add msDS-AdditionalDnsHostName to the keytab; (bso#14396);
  (bsc#1185420);
- Add net-ads-join dnshostname option; (bso#14396); (bsc#1185420);
- Fix adding msDS-AdditionalDnsHostName to keytab with Windows DC;
  (bso#14406); (bsc#1185420);</changelog>
  <changelog author="scabrero@suse.de" date="1629892800">- Fix wrong kvno exported to keytab after net ads changetrustpw due
  to replication delay; (bsc#1188727);</changelog>
  <changelog author="nopower@suse.com" date="1635854400">- CVE-2016-2124: SMB1 client connections can be downgraded to
  plaintext authentication (bsc#1014440); (bso#12444);
- CVE-2020-25717: A user in an AD Domain could become root on
  domain members; (bsc#1192284); (bso#14556);
- CVE-2021-23192: Subsequent DCE/RPC fragment injection vulnerability;
  (bsc#1192214); (bso#14875);</changelog>
  <changelog author="nopower@suse.com" date="1637236800">- The username map [script] advice from CVE-2020-25717 advisory
  note has undesired side effects for the local nt token. Fallback
  to a SID/UID based mapping if the name based lookup fails;
  (bsc#1192849); (bso#14901).</changelog>
  <changelog author="nopower@suse.com" date="1642766400">- CVE-2021-44142: Out-of-Bound Read/Write on Samba vfs_fruit
  module; (bsc#1194859); (bso#14914).</changelog>
</package>
<package pkgid="391c30cd96a8cea0fdc381809dfcb4cbc14445a391a7d8036fb5bc8595695e2f" name="libpainter0" arch="aarch64">
  <version epoch="0" ver="0.9.13.1" rel="4.12.1"/>
  <changelog author="fezhang@suse.com" date="1537963200">- Update to version 0.9.8
  + New features
  - Add TLSv1.3 support #1193
  + Deprecation notice
  - TLSv1 and TLSv1.1 are removed from the default config.
    Current default is TLSv1.2 and TLSv1.3
  + Bug fixes
  - Ensure unmount redirected drive on fatal X error #1140
  + Other changes
  - Pulseaudio modules has been removed from xrdp source tree
  - Pass pulse socket name via environment variable #1198
- Update xrdp-fate318398-change-expired-password.patch: Use
  configured values instead of hardcoded ones in login_wnd inputs</changelog>
  <changelog author="fezhang@suse.com" date="1545912000">- Update to version 0.9.9
  + New features
  - Disconnection by idle timeout (requires xorgxrdp v0.2.9 or
    later) #1227
  + Bug fixes
  - Fix xrdp-chansrv crashes caused in drive redirection #1202
    [#1225]
  - Fix build with FDK AAC v2 #1257
  - Do not enable RemoteApp if the INFO_RAIL flag is not set
    (RDP-RDP proxy) #1253
  + Other changes
  - Add Spanish Latin Amarican keyboard #1237 #1240 #1244
  - Dynamic channel improvements #1222 #1224
  - Remove some deprecated sesman session types #1232
  - Refactoring and cleanups
  + Known issues
  - FreeRDP 2.0.0-rc4 or later might not able to connect to xrdp
    due to xrdp's bad-mannered behaviour, add `+glyph-cache`
    option to FreeRDP to connect #1266
  - Audio redirection by MP3 codec doesn't sound with some
    client, use AAC instead #965
  + Refresh xrdp-default-config.patch</changelog>
  <changelog author="fezhang@suse.com" date="1556539200">- Update to version 0.9.10 (jsc#SLE-5926)
  + New features
  - Restrict outbound (server-&gt;client) clipboard transfer,
    configured in `sesman.ini` #1298
  + Bug fixes
  - Fix libscp v1 not setting width but height twice #1293
  - Fix reconnecting to session causes duplicate drive entries
    in fuse fs #1299
  - Fix default_wm and reconnect_sh refer wrong path after sesman
    caught SIGUP #1315 #1331
  - Shutdown xrdp more responsively #1325
  - Improve remote file lookup in drive redirection #996 #1327
  - Overwriting &amp; appending to existing files now supported #1327
  + Other changes
  - Add Danish Keyboard #1290
  - Put xrdp- prefix to some executables appear in man page #1313
  - Replace some URLs from SF.net to xrdp.org #1313
  + Known issues
  - FreeRDP 2.0.0-rc4 or later might not able to connect to xrdp
    due to xrdp's bad-mannered behaviour, add `+glyph-cache`
    option to FreeRDP to connect #1266
  - Audio redirection by MP3 codec doesn't sound with some
    client, use AAC instead #965</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1564142400">- Removal of SuSEfirewall2 service, since SuSEfirewall2 has been
  replaced by firewalld, see:
  https://lists.opensuse.org/opensuse-factory/2019-01/msg00490.html</changelog>
  <changelog author="fezhang@suse.com" date="1565006400">- Update xrdp-pam.patch: Include the pam_keyinit.so module in
  /etc/pam.d/xrdp-sesman to support the kernel keyrings
  (boo#1144064).</changelog>
  <changelog author="fezhang@suse.com" date="1568116800">- Add xrdp-systemd-services.patch: Let systemd handle the daemons,
  fix daemon start failures (boo#1138954, boo#1144327).</changelog>
  <changelog author="fezhang@suse.com" date="1568635200">- Update to version 0.9.11 (jsc#SLE-9612)
  + New features
  - Suppress output (do not draw screen when client window is
    minimized) #1330
  - Audio input (microphone) redirection compatible with
    MS-RDPEAI #1369
  - Now xrdp can listen on more than one port #1124 #1366
  + Bug fixes
  - Fix the issue audio redirection sometimes sounds with long
    delay #1363
  - Check term event for more responsive shutdown #1372
  + Known issues
  - FreeRDP 2.0.0-rc4 or later might not able to connect to xrdp
    due to xrdp's bad-mannered behaviour, add +glyph-cache option
    to FreeRDP to connect #1266
  - Audio redirection by MP3 codec doesn't sound with some
    client, use AAC instead #965
- Rebase xrdp-avahi.diff, worked around stdint.h definitions
- Rebase xrdp-fate319683-allow-vnc-resizing.patch</changelog>
  <changelog author="yfjiang@suse.com" date="1573646400">- Make mkpamrules additionally support SUSE's usage of
  /usr/etc/pam.d (boo#1156094, gh#neutrinolabs/xrdp!1442):
  * xrdp-mkpamrules-support-usr-etc-distconfdir.patch
  https://lists.opensuse.org/opensuse-factory/2019-08/msg00113.html</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1581163200">- Build with --enable-vsock so xrdp can be used with hyper-v
  enhanced session mode.</changelog>
  <changelog author="fzhang.foss@gmail.com" date="1583928000">- Update xrdp-avahi.diff: Fix implicit definitions errors.</changelog>
  <changelog author="fzhang.foss@gmail.com" date="1584014400">- Update to version 0.9.13
  + Bug fixes: some regressions on drive redirection #1469 #1487
    [#1505] #1507
  + Support mousex button 8/9 #1478
- Update to version 0.9.12
  + Bug fixes
  - Fix "The log reference is NULL" error when sesman startup
    [#1425]
  - Fix behavior when shmem_id changes #1439
  - Make vsock config accept -1 for cid and port #1441
  - Cleanup refresh rect and check stream bounds #1437
  - Significant improvements in drive redirection #1449
  + Other changes
  - Proprietary microphone redirection via rdpsnd is now default
    off RDP compatible microphone redirection is on instead #1427
  - Skip connecting to chansrv when no channels enabled #1393
  - Add openSUSE's pam rules (boo#1156094, #1442)
  - Do not terminate xrdp daemon when caught SIGHUP #1319
- Known issues
  + FreeRDP 2.0.0-rc4 or later might not able to connect to xrdp
    due to xrdp's bad-mannered behaviour, add `+glyph-cache` option
    to FreeRDP to connect #1266
  + Audio redirection by MP3 codec doesn't sound with some client,
    use AAC instead #965
- Drop xrdp-mkpamrules-support-usr-etc-distconfdir.patch: Fixed
  upstream</changelog>
  <changelog author="qkzhu@suse.com" date="1585051200">- Update xrdp-bsc965647-allow-admin-choose-desktop.patch:
  Add `export XDG_SESSION_TYPE=x11` in startwm.sh for SLE, since
  lacking this variable in GNOME 3.34 causes GNOME crash (bsc#1159257).</changelog>
  <changelog author="qkzhu@suse.com" date="1585051201">- Update xrdp-bsc965647-allow-admin-choose-desktop.patch:
  + Set the default session to GNOME Session for SLE.
  + Update the variables to launch SLE-Classic Session.
  (bsc#1166746).</changelog>
  <changelog author="yfjiang@suse.com" date="1587729600">- Enable SLE only patches for Leap (jsc#SLE-11850).</changelog>
  <changelog author="dimstar@opensuse.org" date="1592395200">- Use %{_libexecdir} to install the legacy initscript actions to.</changelog>
  <changelog author="yfjiang@suse.com" date="1593691200">- Update to version 0.9.13.1
  + This is a security fix release that includes fixes for the
    following local buffer overflow vulnerability (bsc#1173580):
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-4044
- Rebase xrdp-fate318398-change-expired-password.patch</changelog>
  <changelog author="yfjiang@suse.com" date="1594382400">- Update xrdp.keyring according to:
  https://github.com/neutrinolabs/xrdp/issues/1627</changelog>
  <changelog author="yfjiang@suse.com" date="1597147200">- Update xrdp-bsc965647-allow-admin-choose-desktop.patch:
  + Fallback the session to icewm when a selected desktop
    environment is not found (bsc#1171415)
  + Support plasma session for Leap 15.2
  + Give more informative comments in start_wm.sh</changelog>
  <changelog author="yfjiang@suse.com" date="1604923200">- Introduce more buffer protection fixes (jsc#SLE-11518):
  + Add xrdp-memory-allocation-security-fix.patch
  + Add xrdp-remove-unecessary-gmalloc.patch
  + Add xrdp-safe-data-chunk-reassembly.patch
- Make the serial number of SLE patches on the bottom</changelog>
  <changelog author="yu.daike@suse.com" date="1628596800">- Fix crash in xrdp-fate318398-change-expired-password.patch (bsc#1187258)</changelog>
</package>
<package pkgid="704b07269c7ff121dd24595337e9be707867bb527e1a468448b00c217fdaf883" name="libpainter0" arch="ppc64le">
  <version epoch="0" ver="0.9.13.1" rel="4.12.1"/>
  <changelog author="fezhang@suse.com" date="1537963200">- Update to version 0.9.8
  + New features
  - Add TLSv1.3 support #1193
  + Deprecation notice
  - TLSv1 and TLSv1.1 are removed from the default config.
    Current default is TLSv1.2 and TLSv1.3
  + Bug fixes
  - Ensure unmount redirected drive on fatal X error #1140
  + Other changes
  - Pulseaudio modules has been removed from xrdp source tree
  - Pass pulse socket name via environment variable #1198
- Update xrdp-fate318398-change-expired-password.patch: Use
  configured values instead of hardcoded ones in login_wnd inputs</changelog>
  <changelog author="fezhang@suse.com" date="1545912000">- Update to version 0.9.9
  + New features
  - Disconnection by idle timeout (requires xorgxrdp v0.2.9 or
    later) #1227
  + Bug fixes
  - Fix xrdp-chansrv crashes caused in drive redirection #1202
    [#1225]
  - Fix build with FDK AAC v2 #1257
  - Do not enable RemoteApp if the INFO_RAIL flag is not set
    (RDP-RDP proxy) #1253
  + Other changes
  - Add Spanish Latin Amarican keyboard #1237 #1240 #1244
  - Dynamic channel improvements #1222 #1224
  - Remove some deprecated sesman session types #1232
  - Refactoring and cleanups
  + Known issues
  - FreeRDP 2.0.0-rc4 or later might not able to connect to xrdp
    due to xrdp's bad-mannered behaviour, add `+glyph-cache`
    option to FreeRDP to connect #1266
  - Audio redirection by MP3 codec doesn't sound with some
    client, use AAC instead #965
  + Refresh xrdp-default-config.patch</changelog>
  <changelog author="fezhang@suse.com" date="1556539200">- Update to version 0.9.10 (jsc#SLE-5926)
  + New features
  - Restrict outbound (server-&gt;client) clipboard transfer,
    configured in `sesman.ini` #1298
  + Bug fixes
  - Fix libscp v1 not setting width but height twice #1293
  - Fix reconnecting to session causes duplicate drive entries
    in fuse fs #1299
  - Fix default_wm and reconnect_sh refer wrong path after sesman
    caught SIGUP #1315 #1331
  - Shutdown xrdp more responsively #1325
  - Improve remote file lookup in drive redirection #996 #1327
  - Overwriting &amp; appending to existing files now supported #1327
  + Other changes
  - Add Danish Keyboard #1290
  - Put xrdp- prefix to some executables appear in man page #1313
  - Replace some URLs from SF.net to xrdp.org #1313
  + Known issues
  - FreeRDP 2.0.0-rc4 or later might not able to connect to xrdp
    due to xrdp's bad-mannered behaviour, add `+glyph-cache`
    option to FreeRDP to connect #1266
  - Audio redirection by MP3 codec doesn't sound with some
    client, use AAC instead #965</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1564142400">- Removal of SuSEfirewall2 service, since SuSEfirewall2 has been
  replaced by firewalld, see:
  https://lists.opensuse.org/opensuse-factory/2019-01/msg00490.html</changelog>
  <changelog author="fezhang@suse.com" date="1565006400">- Update xrdp-pam.patch: Include the pam_keyinit.so module in
  /etc/pam.d/xrdp-sesman to support the kernel keyrings
  (boo#1144064).</changelog>
  <changelog author="fezhang@suse.com" date="1568116800">- Add xrdp-systemd-services.patch: Let systemd handle the daemons,
  fix daemon start failures (boo#1138954, boo#1144327).</changelog>
  <changelog author="fezhang@suse.com" date="1568635200">- Update to version 0.9.11 (jsc#SLE-9612)
  + New features
  - Suppress output (do not draw screen when client window is
    minimized) #1330
  - Audio input (microphone) redirection compatible with
    MS-RDPEAI #1369
  - Now xrdp can listen on more than one port #1124 #1366
  + Bug fixes
  - Fix the issue audio redirection sometimes sounds with long
    delay #1363
  - Check term event for more responsive shutdown #1372
  + Known issues
  - FreeRDP 2.0.0-rc4 or later might not able to connect to xrdp
    due to xrdp's bad-mannered behaviour, add +glyph-cache option
    to FreeRDP to connect #1266
  - Audio redirection by MP3 codec doesn't sound with some
    client, use AAC instead #965
- Rebase xrdp-avahi.diff, worked around stdint.h definitions
- Rebase xrdp-fate319683-allow-vnc-resizing.patch</changelog>
  <changelog author="yfjiang@suse.com" date="1573646400">- Make mkpamrules additionally support SUSE's usage of
  /usr/etc/pam.d (boo#1156094, gh#neutrinolabs/xrdp!1442):
  * xrdp-mkpamrules-support-usr-etc-distconfdir.patch
  https://lists.opensuse.org/opensuse-factory/2019-08/msg00113.html</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1581163200">- Build with --enable-vsock so xrdp can be used with hyper-v
  enhanced session mode.</changelog>
  <changelog author="fzhang.foss@gmail.com" date="1583928000">- Update xrdp-avahi.diff: Fix implicit definitions errors.</changelog>
  <changelog author="fzhang.foss@gmail.com" date="1584014400">- Update to version 0.9.13
  + Bug fixes: some regressions on drive redirection #1469 #1487
    [#1505] #1507
  + Support mousex button 8/9 #1478
- Update to version 0.9.12
  + Bug fixes
  - Fix "The log reference is NULL" error when sesman startup
    [#1425]
  - Fix behavior when shmem_id changes #1439
  - Make vsock config accept -1 for cid and port #1441
  - Cleanup refresh rect and check stream bounds #1437
  - Significant improvements in drive redirection #1449
  + Other changes
  - Proprietary microphone redirection via rdpsnd is now default
    off RDP compatible microphone redirection is on instead #1427
  - Skip connecting to chansrv when no channels enabled #1393
  - Add openSUSE's pam rules (boo#1156094, #1442)
  - Do not terminate xrdp daemon when caught SIGHUP #1319
- Known issues
  + FreeRDP 2.0.0-rc4 or later might not able to connect to xrdp
    due to xrdp's bad-mannered behaviour, add `+glyph-cache` option
    to FreeRDP to connect #1266
  + Audio redirection by MP3 codec doesn't sound with some client,
    use AAC instead #965
- Drop xrdp-mkpamrules-support-usr-etc-distconfdir.patch: Fixed
  upstream</changelog>
  <changelog author="qkzhu@suse.com" date="1585051200">- Update xrdp-bsc965647-allow-admin-choose-desktop.patch:
  Add `export XDG_SESSION_TYPE=x11` in startwm.sh for SLE, since
  lacking this variable in GNOME 3.34 causes GNOME crash (bsc#1159257).</changelog>
  <changelog author="qkzhu@suse.com" date="1585051201">- Update xrdp-bsc965647-allow-admin-choose-desktop.patch:
  + Set the default session to GNOME Session for SLE.
  + Update the variables to launch SLE-Classic Session.
  (bsc#1166746).</changelog>
  <changelog author="yfjiang@suse.com" date="1587729600">- Enable SLE only patches for Leap (jsc#SLE-11850).</changelog>
  <changelog author="dimstar@opensuse.org" date="1592395200">- Use %{_libexecdir} to install the legacy initscript actions to.</changelog>
  <changelog author="yfjiang@suse.com" date="1593691200">- Update to version 0.9.13.1
  + This is a security fix release that includes fixes for the
    following local buffer overflow vulnerability (bsc#1173580):
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-4044
- Rebase xrdp-fate318398-change-expired-password.patch</changelog>
  <changelog author="yfjiang@suse.com" date="1594382400">- Update xrdp.keyring according to:
  https://github.com/neutrinolabs/xrdp/issues/1627</changelog>
  <changelog author="yfjiang@suse.com" date="1597147200">- Update xrdp-bsc965647-allow-admin-choose-desktop.patch:
  + Fallback the session to icewm when a selected desktop
    environment is not found (bsc#1171415)
  + Support plasma session for Leap 15.2
  + Give more informative comments in start_wm.sh</changelog>
  <changelog author="yfjiang@suse.com" date="1604923200">- Introduce more buffer protection fixes (jsc#SLE-11518):
  + Add xrdp-memory-allocation-security-fix.patch
  + Add xrdp-remove-unecessary-gmalloc.patch
  + Add xrdp-safe-data-chunk-reassembly.patch
- Make the serial number of SLE patches on the bottom</changelog>
  <changelog author="yu.daike@suse.com" date="1628596800">- Fix crash in xrdp-fate318398-change-expired-password.patch (bsc#1187258)</changelog>
</package>
<package pkgid="d97986af2a462aba89e73e7c8ad70b44683ddb2877f910737e965c9e1c34633b" name="libpainter0" arch="s390x">
  <version epoch="0" ver="0.9.13.1" rel="4.12.1"/>
  <changelog author="fezhang@suse.com" date="1537963200">- Update to version 0.9.8
  + New features
  - Add TLSv1.3 support #1193
  + Deprecation notice
  - TLSv1 and TLSv1.1 are removed from the default config.
    Current default is TLSv1.2 and TLSv1.3
  + Bug fixes
  - Ensure unmount redirected drive on fatal X error #1140
  + Other changes
  - Pulseaudio modules has been removed from xrdp source tree
  - Pass pulse socket name via environment variable #1198
- Update xrdp-fate318398-change-expired-password.patch: Use
  configured values instead of hardcoded ones in login_wnd inputs</changelog>
  <changelog author="fezhang@suse.com" date="1545912000">- Update to version 0.9.9
  + New features
  - Disconnection by idle timeout (requires xorgxrdp v0.2.9 or
    later) #1227
  + Bug fixes
  - Fix xrdp-chansrv crashes caused in drive redirection #1202
    [#1225]
  - Fix build with FDK AAC v2 #1257
  - Do not enable RemoteApp if the INFO_RAIL flag is not set
    (RDP-RDP proxy) #1253
  + Other changes
  - Add Spanish Latin Amarican keyboard #1237 #1240 #1244
  - Dynamic channel improvements #1222 #1224
  - Remove some deprecated sesman session types #1232
  - Refactoring and cleanups
  + Known issues
  - FreeRDP 2.0.0-rc4 or later might not able to connect to xrdp
    due to xrdp's bad-mannered behaviour, add `+glyph-cache`
    option to FreeRDP to connect #1266
  - Audio redirection by MP3 codec doesn't sound with some
    client, use AAC instead #965
  + Refresh xrdp-default-config.patch</changelog>
  <changelog author="fezhang@suse.com" date="1556539200">- Update to version 0.9.10 (jsc#SLE-5926)
  + New features
  - Restrict outbound (server-&gt;client) clipboard transfer,
    configured in `sesman.ini` #1298
  + Bug fixes
  - Fix libscp v1 not setting width but height twice #1293
  - Fix reconnecting to session causes duplicate drive entries
    in fuse fs #1299
  - Fix default_wm and reconnect_sh refer wrong path after sesman
    caught SIGUP #1315 #1331
  - Shutdown xrdp more responsively #1325
  - Improve remote file lookup in drive redirection #996 #1327
  - Overwriting &amp; appending to existing files now supported #1327
  + Other changes
  - Add Danish Keyboard #1290
  - Put xrdp- prefix to some executables appear in man page #1313
  - Replace some URLs from SF.net to xrdp.org #1313
  + Known issues
  - FreeRDP 2.0.0-rc4 or later might not able to connect to xrdp
    due to xrdp's bad-mannered behaviour, add `+glyph-cache`
    option to FreeRDP to connect #1266
  - Audio redirection by MP3 codec doesn't sound with some
    client, use AAC instead #965</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1564142400">- Removal of SuSEfirewall2 service, since SuSEfirewall2 has been
  replaced by firewalld, see:
  https://lists.opensuse.org/opensuse-factory/2019-01/msg00490.html</changelog>
  <changelog author="fezhang@suse.com" date="1565006400">- Update xrdp-pam.patch: Include the pam_keyinit.so module in
  /etc/pam.d/xrdp-sesman to support the kernel keyrings
  (boo#1144064).</changelog>
  <changelog author="fezhang@suse.com" date="1568116800">- Add xrdp-systemd-services.patch: Let systemd handle the daemons,
  fix daemon start failures (boo#1138954, boo#1144327).</changelog>
  <changelog author="fezhang@suse.com" date="1568635200">- Update to version 0.9.11 (jsc#SLE-9612)
  + New features
  - Suppress output (do not draw screen when client window is
    minimized) #1330
  - Audio input (microphone) redirection compatible with
    MS-RDPEAI #1369
  - Now xrdp can listen on more than one port #1124 #1366
  + Bug fixes
  - Fix the issue audio redirection sometimes sounds with long
    delay #1363
  - Check term event for more responsive shutdown #1372
  + Known issues
  - FreeRDP 2.0.0-rc4 or later might not able to connect to xrdp
    due to xrdp's bad-mannered behaviour, add +glyph-cache option
    to FreeRDP to connect #1266
  - Audio redirection by MP3 codec doesn't sound with some
    client, use AAC instead #965
- Rebase xrdp-avahi.diff, worked around stdint.h definitions
- Rebase xrdp-fate319683-allow-vnc-resizing.patch</changelog>
  <changelog author="yfjiang@suse.com" date="1573646400">- Make mkpamrules additionally support SUSE's usage of
  /usr/etc/pam.d (boo#1156094, gh#neutrinolabs/xrdp!1442):
  * xrdp-mkpamrules-support-usr-etc-distconfdir.patch
  https://lists.opensuse.org/opensuse-factory/2019-08/msg00113.html</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1581163200">- Build with --enable-vsock so xrdp can be used with hyper-v
  enhanced session mode.</changelog>
  <changelog author="fzhang.foss@gmail.com" date="1583928000">- Update xrdp-avahi.diff: Fix implicit definitions errors.</changelog>
  <changelog author="fzhang.foss@gmail.com" date="1584014400">- Update to version 0.9.13
  + Bug fixes: some regressions on drive redirection #1469 #1487
    [#1505] #1507
  + Support mousex button 8/9 #1478
- Update to version 0.9.12
  + Bug fixes
  - Fix "The log reference is NULL" error when sesman startup
    [#1425]
  - Fix behavior when shmem_id changes #1439
  - Make vsock config accept -1 for cid and port #1441
  - Cleanup refresh rect and check stream bounds #1437
  - Significant improvements in drive redirection #1449
  + Other changes
  - Proprietary microphone redirection via rdpsnd is now default
    off RDP compatible microphone redirection is on instead #1427
  - Skip connecting to chansrv when no channels enabled #1393
  - Add openSUSE's pam rules (boo#1156094, #1442)
  - Do not terminate xrdp daemon when caught SIGHUP #1319
- Known issues
  + FreeRDP 2.0.0-rc4 or later might not able to connect to xrdp
    due to xrdp's bad-mannered behaviour, add `+glyph-cache` option
    to FreeRDP to connect #1266
  + Audio redirection by MP3 codec doesn't sound with some client,
    use AAC instead #965
- Drop xrdp-mkpamrules-support-usr-etc-distconfdir.patch: Fixed
  upstream</changelog>
  <changelog author="qkzhu@suse.com" date="1585051200">- Update xrdp-bsc965647-allow-admin-choose-desktop.patch:
  Add `export XDG_SESSION_TYPE=x11` in startwm.sh for SLE, since
  lacking this variable in GNOME 3.34 causes GNOME crash (bsc#1159257).</changelog>
  <changelog author="qkzhu@suse.com" date="1585051201">- Update xrdp-bsc965647-allow-admin-choose-desktop.patch:
  + Set the default session to GNOME Session for SLE.
  + Update the variables to launch SLE-Classic Session.
  (bsc#1166746).</changelog>
  <changelog author="yfjiang@suse.com" date="1587729600">- Enable SLE only patches for Leap (jsc#SLE-11850).</changelog>
  <changelog author="dimstar@opensuse.org" date="1592395200">- Use %{_libexecdir} to install the legacy initscript actions to.</changelog>
  <changelog author="yfjiang@suse.com" date="1593691200">- Update to version 0.9.13.1
  + This is a security fix release that includes fixes for the
    following local buffer overflow vulnerability (bsc#1173580):
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-4044
- Rebase xrdp-fate318398-change-expired-password.patch</changelog>
  <changelog author="yfjiang@suse.com" date="1594382400">- Update xrdp.keyring according to:
  https://github.com/neutrinolabs/xrdp/issues/1627</changelog>
  <changelog author="yfjiang@suse.com" date="1597147200">- Update xrdp-bsc965647-allow-admin-choose-desktop.patch:
  + Fallback the session to icewm when a selected desktop
    environment is not found (bsc#1171415)
  + Support plasma session for Leap 15.2
  + Give more informative comments in start_wm.sh</changelog>
  <changelog author="yfjiang@suse.com" date="1604923200">- Introduce more buffer protection fixes (jsc#SLE-11518):
  + Add xrdp-memory-allocation-security-fix.patch
  + Add xrdp-remove-unecessary-gmalloc.patch
  + Add xrdp-safe-data-chunk-reassembly.patch
- Make the serial number of SLE patches on the bottom</changelog>
  <changelog author="yu.daike@suse.com" date="1628596800">- Fix crash in xrdp-fate318398-change-expired-password.patch (bsc#1187258)</changelog>
</package>
<package pkgid="0c07036653b83199e210e1e917753c0e1ed048d40fb46334e1068ff97a95e4c5" name="libpainter0" arch="x86_64">
  <version epoch="0" ver="0.9.13.1" rel="4.12.1"/>
  <changelog author="fezhang@suse.com" date="1537963200">- Update to version 0.9.8
  + New features
  - Add TLSv1.3 support #1193
  + Deprecation notice
  - TLSv1 and TLSv1.1 are removed from the default config.
    Current default is TLSv1.2 and TLSv1.3
  + Bug fixes
  - Ensure unmount redirected drive on fatal X error #1140
  + Other changes
  - Pulseaudio modules has been removed from xrdp source tree
  - Pass pulse socket name via environment variable #1198
- Update xrdp-fate318398-change-expired-password.patch: Use
  configured values instead of hardcoded ones in login_wnd inputs</changelog>
  <changelog author="fezhang@suse.com" date="1545912000">- Update to version 0.9.9
  + New features
  - Disconnection by idle timeout (requires xorgxrdp v0.2.9 or
    later) #1227
  + Bug fixes
  - Fix xrdp-chansrv crashes caused in drive redirection #1202
    [#1225]
  - Fix build with FDK AAC v2 #1257
  - Do not enable RemoteApp if the INFO_RAIL flag is not set
    (RDP-RDP proxy) #1253
  + Other changes
  - Add Spanish Latin Amarican keyboard #1237 #1240 #1244
  - Dynamic channel improvements #1222 #1224
  - Remove some deprecated sesman session types #1232
  - Refactoring and cleanups
  + Known issues
  - FreeRDP 2.0.0-rc4 or later might not able to connect to xrdp
    due to xrdp's bad-mannered behaviour, add `+glyph-cache`
    option to FreeRDP to connect #1266
  - Audio redirection by MP3 codec doesn't sound with some
    client, use AAC instead #965
  + Refresh xrdp-default-config.patch</changelog>
  <changelog author="fezhang@suse.com" date="1556539200">- Update to version 0.9.10 (jsc#SLE-5926)
  + New features
  - Restrict outbound (server-&gt;client) clipboard transfer,
    configured in `sesman.ini` #1298
  + Bug fixes
  - Fix libscp v1 not setting width but height twice #1293
  - Fix reconnecting to session causes duplicate drive entries
    in fuse fs #1299
  - Fix default_wm and reconnect_sh refer wrong path after sesman
    caught SIGUP #1315 #1331
  - Shutdown xrdp more responsively #1325
  - Improve remote file lookup in drive redirection #996 #1327
  - Overwriting &amp; appending to existing files now supported #1327
  + Other changes
  - Add Danish Keyboard #1290
  - Put xrdp- prefix to some executables appear in man page #1313
  - Replace some URLs from SF.net to xrdp.org #1313
  + Known issues
  - FreeRDP 2.0.0-rc4 or later might not able to connect to xrdp
    due to xrdp's bad-mannered behaviour, add `+glyph-cache`
    option to FreeRDP to connect #1266
  - Audio redirection by MP3 codec doesn't sound with some
    client, use AAC instead #965</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1564142400">- Removal of SuSEfirewall2 service, since SuSEfirewall2 has been
  replaced by firewalld, see:
  https://lists.opensuse.org/opensuse-factory/2019-01/msg00490.html</changelog>
  <changelog author="fezhang@suse.com" date="1565006400">- Update xrdp-pam.patch: Include the pam_keyinit.so module in
  /etc/pam.d/xrdp-sesman to support the kernel keyrings
  (boo#1144064).</changelog>
  <changelog author="fezhang@suse.com" date="1568116800">- Add xrdp-systemd-services.patch: Let systemd handle the daemons,
  fix daemon start failures (boo#1138954, boo#1144327).</changelog>
  <changelog author="fezhang@suse.com" date="1568635200">- Update to version 0.9.11 (jsc#SLE-9612)
  + New features
  - Suppress output (do not draw screen when client window is
    minimized) #1330
  - Audio input (microphone) redirection compatible with
    MS-RDPEAI #1369
  - Now xrdp can listen on more than one port #1124 #1366
  + Bug fixes
  - Fix the issue audio redirection sometimes sounds with long
    delay #1363
  - Check term event for more responsive shutdown #1372
  + Known issues
  - FreeRDP 2.0.0-rc4 or later might not able to connect to xrdp
    due to xrdp's bad-mannered behaviour, add +glyph-cache option
    to FreeRDP to connect #1266
  - Audio redirection by MP3 codec doesn't sound with some
    client, use AAC instead #965
- Rebase xrdp-avahi.diff, worked around stdint.h definitions
- Rebase xrdp-fate319683-allow-vnc-resizing.patch</changelog>
  <changelog author="yfjiang@suse.com" date="1573646400">- Make mkpamrules additionally support SUSE's usage of
  /usr/etc/pam.d (boo#1156094, gh#neutrinolabs/xrdp!1442):
  * xrdp-mkpamrules-support-usr-etc-distconfdir.patch
  https://lists.opensuse.org/opensuse-factory/2019-08/msg00113.html</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1581163200">- Build with --enable-vsock so xrdp can be used with hyper-v
  enhanced session mode.</changelog>
  <changelog author="fzhang.foss@gmail.com" date="1583928000">- Update xrdp-avahi.diff: Fix implicit definitions errors.</changelog>
  <changelog author="fzhang.foss@gmail.com" date="1584014400">- Update to version 0.9.13
  + Bug fixes: some regressions on drive redirection #1469 #1487
    [#1505] #1507
  + Support mousex button 8/9 #1478
- Update to version 0.9.12
  + Bug fixes
  - Fix "The log reference is NULL" error when sesman startup
    [#1425]
  - Fix behavior when shmem_id changes #1439
  - Make vsock config accept -1 for cid and port #1441
  - Cleanup refresh rect and check stream bounds #1437
  - Significant improvements in drive redirection #1449
  + Other changes
  - Proprietary microphone redirection via rdpsnd is now default
    off RDP compatible microphone redirection is on instead #1427
  - Skip connecting to chansrv when no channels enabled #1393
  - Add openSUSE's pam rules (boo#1156094, #1442)
  - Do not terminate xrdp daemon when caught SIGHUP #1319
- Known issues
  + FreeRDP 2.0.0-rc4 or later might not able to connect to xrdp
    due to xrdp's bad-mannered behaviour, add `+glyph-cache` option
    to FreeRDP to connect #1266
  + Audio redirection by MP3 codec doesn't sound with some client,
    use AAC instead #965
- Drop xrdp-mkpamrules-support-usr-etc-distconfdir.patch: Fixed
  upstream</changelog>
  <changelog author="qkzhu@suse.com" date="1585051200">- Update xrdp-bsc965647-allow-admin-choose-desktop.patch:
  Add `export XDG_SESSION_TYPE=x11` in startwm.sh for SLE, since
  lacking this variable in GNOME 3.34 causes GNOME crash (bsc#1159257).</changelog>
  <changelog author="qkzhu@suse.com" date="1585051201">- Update xrdp-bsc965647-allow-admin-choose-desktop.patch:
  + Set the default session to GNOME Session for SLE.
  + Update the variables to launch SLE-Classic Session.
  (bsc#1166746).</changelog>
  <changelog author="yfjiang@suse.com" date="1587729600">- Enable SLE only patches for Leap (jsc#SLE-11850).</changelog>
  <changelog author="dimstar@opensuse.org" date="1592395200">- Use %{_libexecdir} to install the legacy initscript actions to.</changelog>
  <changelog author="yfjiang@suse.com" date="1593691200">- Update to version 0.9.13.1
  + This is a security fix release that includes fixes for the
    following local buffer overflow vulnerability (bsc#1173580):
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-4044
- Rebase xrdp-fate318398-change-expired-password.patch</changelog>
  <changelog author="yfjiang@suse.com" date="1594382400">- Update xrdp.keyring according to:
  https://github.com/neutrinolabs/xrdp/issues/1627</changelog>
  <changelog author="yfjiang@suse.com" date="1597147200">- Update xrdp-bsc965647-allow-admin-choose-desktop.patch:
  + Fallback the session to icewm when a selected desktop
    environment is not found (bsc#1171415)
  + Support plasma session for Leap 15.2
  + Give more informative comments in start_wm.sh</changelog>
  <changelog author="yfjiang@suse.com" date="1604923200">- Introduce more buffer protection fixes (jsc#SLE-11518):
  + Add xrdp-memory-allocation-security-fix.patch
  + Add xrdp-remove-unecessary-gmalloc.patch
  + Add xrdp-safe-data-chunk-reassembly.patch
- Make the serial number of SLE patches on the bottom</changelog>
  <changelog author="yu.daike@suse.com" date="1628596800">- Fix crash in xrdp-fate318398-change-expired-password.patch (bsc#1187258)</changelog>
</package>
<package pkgid="4d24bb0aa5dd54fe5f20b10c9f1768ca91e5f641b4ec9778501ccee29ace97b1" name="libpolkit0" arch="aarch64">
  <version epoch="0" ver="0.116" rel="3.9.1"/>
  <changelog author="antoine.belvire@laposte.net" date="1438862400">- Update to 0.113:
  * Fix CVE-2015-4625
  * Fix CVE-2015-3256
  * Fix CVE-2015-3255
  * Fix CVE-2015-3218
  * On systemd-213 and later, the ?active? state is shared across
    all sessions of an user, instead of being tracked separately
  * pkexec: when not given a program to execute, runs the users?
    shell by default
- Remove polkit-no-kded-leak.patch (upstreamed)</changelog>
  <changelog author="meissner@suse.com" date="1448539200">- polkit-revert-session-magic.patch: revert a session detection change
  that could lead to sessions not being detected as active due to
  a systemd bug. bsc#954139</changelog>
  <changelog author="fbui@suse.com" date="1465300800">- systemd.pc is shipped by systemd main package (bsc#983167)
  Strangely polkit wants systemd.pc to detect that the target system
  is running systemd even if its configured to build systemd support...</changelog>
  <changelog author="fbui@suse.com" date="1465387200">- Use pkgconfig() instead of requiring systemd package names directly.</changelog>
  <changelog author="lnussel@suse.de" date="1497355200">- Use gettext as fallback to get potential distro translations for
  polkit actions. Similar mechnism as used for desktop file
  translations. That way it's possible to use weblate to add
  additional translations that are not provided by upstream
  (polkit-gettext.patch).</changelog>
  <changelog author="dimstar@opensuse.org" date="1502798400">- Add polkit-itstools.patch: Add gettext support for .policy files.</changelog>
  <changelog author="dimstar@opensuse.org" date="1519819200">- Modernize spec-file by calling spec-cleaner</changelog>
  <changelog author="schwab@suse.de" date="1519905600">- pkexec.patch: pkexec: allow --version and --help even if not setuid</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1523275200">- Update to version 0.114:
  + Port to mozjs 52, the latest version of the firefox JavaScript
    engine.
  + Add gettext support for policy files.
  + Fixes for various memory leaks.
  + Updated translations.
- Update keyring with Ray Strode &lt;halfline@gmail.com&gt; public key.
- Drop with_systemd define and all conditionals and
  polkit-no-systemd.patch and ConsoleKit BuildRequires, we only
  support systemd now.
- Drop upstream fixed polkit-itstools.patch.
- Rebase pkexec.patch with quilt.
- Add gcc-c++ and pkgconfig(mozjs-52) BuildRequires: New
  dependencies.
- Drop conditional pkgconfig(mozjs-17.0) and pkgconfig(mozjs185):
  no longer supported.
- Drop autoconf and automake BuildRequires: They are implicit via
  libtool BuildRequires.
- Replace glib2-devel and gobject-introspection-devel with their
  pkgconfig counterparts: pkgconfig(gio-unix-2.0),
  pkgconfig(gmodule-2.0) and pkgconfig(gobject-introspection-1.0).
- Add polkit-jsauthority-pass-format-string.patch: jsauthority:
  pass "%s" format string to remaining report function, patch from
  upstream git, adding missed commit (bgo#105865).
- Drop polkit-revert-session-magic.patch: Upstream systemd bug is
  since a long time fixed (gh#systemd#58) (boo#954139).</changelog>
  <changelog author="meissner@suse.com" date="1531310400">- Update to version 0.115:
  - Fix CVE-2018-1116: Trusting client-supplied UID (bsc#1099031)
  - jsauthority: pass "%s" format string to remaining report function
    (obsoletes polkit-jsauthority-pass-format-string.patch)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1534507200">- Add polkit-fix-possible-resource-leak.patch: Fix possible
  resource leak found by static analyzer.
- Add polkit-fix-leaking-zombie-child-processes.patch: polkitd: fix
  zombie not reaped when js spawned process timed out (fdo#106021).</changelog>
  <changelog author="meissner@suse.com" date="1545307200">- polkit-CVE-2018-19788.patch: Fixed handling of UIDs over MAX_UINT
  (bsc#1118277 CVE-2018-19788)</changelog>
  <changelog author="mvetter@suse.com" date="1556280000">- bsc#1130588: Require shadow instead of old pwdutils
- User proper Requires(pre)/Requires(post) for permissions and
  shadow</changelog>
  <changelog author="dimstar@opensuse.org" date="1557489600">- Use systemd_ordering instead of systemd_requires: strictly
  speaking, polkit does not require systemd to be present. Just
  that when we install on a system with systemd (e.g outside
  containers) we would want systemd to be present before
  installing polkit. Help also reduce a cycle without special hacks
  in systemd.spec.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1559131200">- Update to version 0.116:
  + Leaking zombie child processes.
  + Possible resource leak found by static analyzer.
  + Output messages tuneup.
  + Sanity fixes.
  + pkttyagent tty echo disabled on SIGINT.
  + HACKING: add link to Code of Conduct.
  + polkitbackend: comment typos fix.
  + configure.ac: fix detection of systemd with cgroups v2.
  + CVE-2018-19788 High UIDs overflow fix.
  + CVE-2019-6133 Slowfork vulnerability fix.
  + Allow unset process-uid.
  + Port the JS authority to mozjs-60.
  + Use JS_EncodeStringToUTF8.
  + Updated translations.
- Replace pkgconfig(mozjs-52) with pkgconfig(mozjs-60)
  BuildRequires following upstreams changes.
- Drop patches fixed upstream:
  + polkit-fix-possible-resource-leak.patch
  + polkit-fix-leaking-zombie-child-processes.patch
  + polkit-CVE-2018-19788.patch
- Refresh patches with quilt.</changelog>
  <changelog author="meissner@suse.com" date="1570536000">- polkit-keyinit.patch: add pam_keyinit to the polkit configuration (bsc#1144053)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1575028800">- Fix usage of libexecdir instead of prefix/lib where applicable.</changelog>
  <changelog author="meissner@suse.com" date="1622116800">- CVE-2021-3560: fixed a local privilege escalation using polkit_system_bus_name_get_creds_sync()
  (bsc#1186497)
  CVE-2021-3560.patch</changelog>
  <changelog author="meissner@suse.com" date="1642075200">- CVE-2021-4034: fixed a local privilege escalation in pkexec (bsc#1194568)
  added CVE-2021-4034-pkexec-fix.patch</changelog>
  <changelog author="rfrohl@suse.com" date="1644235200">- CVE-2021-4115: fixed a denial of service via file descriptor leak (bsc#1195542)
  added CVE-2021-4115.patch</changelog>
</package>
<package pkgid="e224e580d47284a046e69f5881439df103190675cd689fe46e21cb4d40b07c07" name="libpolkit0" arch="ppc64le">
  <version epoch="0" ver="0.116" rel="3.9.1"/>
  <changelog author="antoine.belvire@laposte.net" date="1438862400">- Update to 0.113:
  * Fix CVE-2015-4625
  * Fix CVE-2015-3256
  * Fix CVE-2015-3255
  * Fix CVE-2015-3218
  * On systemd-213 and later, the ?active? state is shared across
    all sessions of an user, instead of being tracked separately
  * pkexec: when not given a program to execute, runs the users?
    shell by default
- Remove polkit-no-kded-leak.patch (upstreamed)</changelog>
  <changelog author="meissner@suse.com" date="1448539200">- polkit-revert-session-magic.patch: revert a session detection change
  that could lead to sessions not being detected as active due to
  a systemd bug. bsc#954139</changelog>
  <changelog author="fbui@suse.com" date="1465300800">- systemd.pc is shipped by systemd main package (bsc#983167)
  Strangely polkit wants systemd.pc to detect that the target system
  is running systemd even if its configured to build systemd support...</changelog>
  <changelog author="fbui@suse.com" date="1465387200">- Use pkgconfig() instead of requiring systemd package names directly.</changelog>
  <changelog author="lnussel@suse.de" date="1497355200">- Use gettext as fallback to get potential distro translations for
  polkit actions. Similar mechnism as used for desktop file
  translations. That way it's possible to use weblate to add
  additional translations that are not provided by upstream
  (polkit-gettext.patch).</changelog>
  <changelog author="dimstar@opensuse.org" date="1502798400">- Add polkit-itstools.patch: Add gettext support for .policy files.</changelog>
  <changelog author="dimstar@opensuse.org" date="1519819200">- Modernize spec-file by calling spec-cleaner</changelog>
  <changelog author="schwab@suse.de" date="1519905600">- pkexec.patch: pkexec: allow --version and --help even if not setuid</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1523275200">- Update to version 0.114:
  + Port to mozjs 52, the latest version of the firefox JavaScript
    engine.
  + Add gettext support for policy files.
  + Fixes for various memory leaks.
  + Updated translations.
- Update keyring with Ray Strode &lt;halfline@gmail.com&gt; public key.
- Drop with_systemd define and all conditionals and
  polkit-no-systemd.patch and ConsoleKit BuildRequires, we only
  support systemd now.
- Drop upstream fixed polkit-itstools.patch.
- Rebase pkexec.patch with quilt.
- Add gcc-c++ and pkgconfig(mozjs-52) BuildRequires: New
  dependencies.
- Drop conditional pkgconfig(mozjs-17.0) and pkgconfig(mozjs185):
  no longer supported.
- Drop autoconf and automake BuildRequires: They are implicit via
  libtool BuildRequires.
- Replace glib2-devel and gobject-introspection-devel with their
  pkgconfig counterparts: pkgconfig(gio-unix-2.0),
  pkgconfig(gmodule-2.0) and pkgconfig(gobject-introspection-1.0).
- Add polkit-jsauthority-pass-format-string.patch: jsauthority:
  pass "%s" format string to remaining report function, patch from
  upstream git, adding missed commit (bgo#105865).
- Drop polkit-revert-session-magic.patch: Upstream systemd bug is
  since a long time fixed (gh#systemd#58) (boo#954139).</changelog>
  <changelog author="meissner@suse.com" date="1531310400">- Update to version 0.115:
  - Fix CVE-2018-1116: Trusting client-supplied UID (bsc#1099031)
  - jsauthority: pass "%s" format string to remaining report function
    (obsoletes polkit-jsauthority-pass-format-string.patch)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1534507200">- Add polkit-fix-possible-resource-leak.patch: Fix possible
  resource leak found by static analyzer.
- Add polkit-fix-leaking-zombie-child-processes.patch: polkitd: fix
  zombie not reaped when js spawned process timed out (fdo#106021).</changelog>
  <changelog author="meissner@suse.com" date="1545307200">- polkit-CVE-2018-19788.patch: Fixed handling of UIDs over MAX_UINT
  (bsc#1118277 CVE-2018-19788)</changelog>
  <changelog author="mvetter@suse.com" date="1556280000">- bsc#1130588: Require shadow instead of old pwdutils
- User proper Requires(pre)/Requires(post) for permissions and
  shadow</changelog>
  <changelog author="dimstar@opensuse.org" date="1557489600">- Use systemd_ordering instead of systemd_requires: strictly
  speaking, polkit does not require systemd to be present. Just
  that when we install on a system with systemd (e.g outside
  containers) we would want systemd to be present before
  installing polkit. Help also reduce a cycle without special hacks
  in systemd.spec.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1559131200">- Update to version 0.116:
  + Leaking zombie child processes.
  + Possible resource leak found by static analyzer.
  + Output messages tuneup.
  + Sanity fixes.
  + pkttyagent tty echo disabled on SIGINT.
  + HACKING: add link to Code of Conduct.
  + polkitbackend: comment typos fix.
  + configure.ac: fix detection of systemd with cgroups v2.
  + CVE-2018-19788 High UIDs overflow fix.
  + CVE-2019-6133 Slowfork vulnerability fix.
  + Allow unset process-uid.
  + Port the JS authority to mozjs-60.
  + Use JS_EncodeStringToUTF8.
  + Updated translations.
- Replace pkgconfig(mozjs-52) with pkgconfig(mozjs-60)
  BuildRequires following upstreams changes.
- Drop patches fixed upstream:
  + polkit-fix-possible-resource-leak.patch
  + polkit-fix-leaking-zombie-child-processes.patch
  + polkit-CVE-2018-19788.patch
- Refresh patches with quilt.</changelog>
  <changelog author="meissner@suse.com" date="1570536000">- polkit-keyinit.patch: add pam_keyinit to the polkit configuration (bsc#1144053)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1575028800">- Fix usage of libexecdir instead of prefix/lib where applicable.</changelog>
  <changelog author="meissner@suse.com" date="1622116800">- CVE-2021-3560: fixed a local privilege escalation using polkit_system_bus_name_get_creds_sync()
  (bsc#1186497)
  CVE-2021-3560.patch</changelog>
  <changelog author="meissner@suse.com" date="1642075200">- CVE-2021-4034: fixed a local privilege escalation in pkexec (bsc#1194568)
  added CVE-2021-4034-pkexec-fix.patch</changelog>
  <changelog author="rfrohl@suse.com" date="1644235200">- CVE-2021-4115: fixed a denial of service via file descriptor leak (bsc#1195542)
  added CVE-2021-4115.patch</changelog>
</package>
<package pkgid="d515fc4ddee185cfba04afd2d309c1e1f75a55e98f652b33719579c50b83ddc6" name="libpolkit0" arch="s390x">
  <version epoch="0" ver="0.116" rel="3.9.1"/>
  <changelog author="antoine.belvire@laposte.net" date="1438862400">- Update to 0.113:
  * Fix CVE-2015-4625
  * Fix CVE-2015-3256
  * Fix CVE-2015-3255
  * Fix CVE-2015-3218
  * On systemd-213 and later, the ?active? state is shared across
    all sessions of an user, instead of being tracked separately
  * pkexec: when not given a program to execute, runs the users?
    shell by default
- Remove polkit-no-kded-leak.patch (upstreamed)</changelog>
  <changelog author="meissner@suse.com" date="1448539200">- polkit-revert-session-magic.patch: revert a session detection change
  that could lead to sessions not being detected as active due to
  a systemd bug. bsc#954139</changelog>
  <changelog author="fbui@suse.com" date="1465300800">- systemd.pc is shipped by systemd main package (bsc#983167)
  Strangely polkit wants systemd.pc to detect that the target system
  is running systemd even if its configured to build systemd support...</changelog>
  <changelog author="fbui@suse.com" date="1465387200">- Use pkgconfig() instead of requiring systemd package names directly.</changelog>
  <changelog author="lnussel@suse.de" date="1497355200">- Use gettext as fallback to get potential distro translations for
  polkit actions. Similar mechnism as used for desktop file
  translations. That way it's possible to use weblate to add
  additional translations that are not provided by upstream
  (polkit-gettext.patch).</changelog>
  <changelog author="dimstar@opensuse.org" date="1502798400">- Add polkit-itstools.patch: Add gettext support for .policy files.</changelog>
  <changelog author="dimstar@opensuse.org" date="1519819200">- Modernize spec-file by calling spec-cleaner</changelog>
  <changelog author="schwab@suse.de" date="1519905600">- pkexec.patch: pkexec: allow --version and --help even if not setuid</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1523275200">- Update to version 0.114:
  + Port to mozjs 52, the latest version of the firefox JavaScript
    engine.
  + Add gettext support for policy files.
  + Fixes for various memory leaks.
  + Updated translations.
- Update keyring with Ray Strode &lt;halfline@gmail.com&gt; public key.
- Drop with_systemd define and all conditionals and
  polkit-no-systemd.patch and ConsoleKit BuildRequires, we only
  support systemd now.
- Drop upstream fixed polkit-itstools.patch.
- Rebase pkexec.patch with quilt.
- Add gcc-c++ and pkgconfig(mozjs-52) BuildRequires: New
  dependencies.
- Drop conditional pkgconfig(mozjs-17.0) and pkgconfig(mozjs185):
  no longer supported.
- Drop autoconf and automake BuildRequires: They are implicit via
  libtool BuildRequires.
- Replace glib2-devel and gobject-introspection-devel with their
  pkgconfig counterparts: pkgconfig(gio-unix-2.0),
  pkgconfig(gmodule-2.0) and pkgconfig(gobject-introspection-1.0).
- Add polkit-jsauthority-pass-format-string.patch: jsauthority:
  pass "%s" format string to remaining report function, patch from
  upstream git, adding missed commit (bgo#105865).
- Drop polkit-revert-session-magic.patch: Upstream systemd bug is
  since a long time fixed (gh#systemd#58) (boo#954139).</changelog>
  <changelog author="meissner@suse.com" date="1531310400">- Update to version 0.115:
  - Fix CVE-2018-1116: Trusting client-supplied UID (bsc#1099031)
  - jsauthority: pass "%s" format string to remaining report function
    (obsoletes polkit-jsauthority-pass-format-string.patch)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1534507200">- Add polkit-fix-possible-resource-leak.patch: Fix possible
  resource leak found by static analyzer.
- Add polkit-fix-leaking-zombie-child-processes.patch: polkitd: fix
  zombie not reaped when js spawned process timed out (fdo#106021).</changelog>
  <changelog author="meissner@suse.com" date="1545307200">- polkit-CVE-2018-19788.patch: Fixed handling of UIDs over MAX_UINT
  (bsc#1118277 CVE-2018-19788)</changelog>
  <changelog author="mvetter@suse.com" date="1556280000">- bsc#1130588: Require shadow instead of old pwdutils
- User proper Requires(pre)/Requires(post) for permissions and
  shadow</changelog>
  <changelog author="dimstar@opensuse.org" date="1557489600">- Use systemd_ordering instead of systemd_requires: strictly
  speaking, polkit does not require systemd to be present. Just
  that when we install on a system with systemd (e.g outside
  containers) we would want systemd to be present before
  installing polkit. Help also reduce a cycle without special hacks
  in systemd.spec.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1559131200">- Update to version 0.116:
  + Leaking zombie child processes.
  + Possible resource leak found by static analyzer.
  + Output messages tuneup.
  + Sanity fixes.
  + pkttyagent tty echo disabled on SIGINT.
  + HACKING: add link to Code of Conduct.
  + polkitbackend: comment typos fix.
  + configure.ac: fix detection of systemd with cgroups v2.
  + CVE-2018-19788 High UIDs overflow fix.
  + CVE-2019-6133 Slowfork vulnerability fix.
  + Allow unset process-uid.
  + Port the JS authority to mozjs-60.
  + Use JS_EncodeStringToUTF8.
  + Updated translations.
- Replace pkgconfig(mozjs-52) with pkgconfig(mozjs-60)
  BuildRequires following upstreams changes.
- Drop patches fixed upstream:
  + polkit-fix-possible-resource-leak.patch
  + polkit-fix-leaking-zombie-child-processes.patch
  + polkit-CVE-2018-19788.patch
- Refresh patches with quilt.</changelog>
  <changelog author="meissner@suse.com" date="1570536000">- polkit-keyinit.patch: add pam_keyinit to the polkit configuration (bsc#1144053)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1575028800">- Fix usage of libexecdir instead of prefix/lib where applicable.</changelog>
  <changelog author="meissner@suse.com" date="1622116800">- CVE-2021-3560: fixed a local privilege escalation using polkit_system_bus_name_get_creds_sync()
  (bsc#1186497)
  CVE-2021-3560.patch</changelog>
  <changelog author="meissner@suse.com" date="1642075200">- CVE-2021-4034: fixed a local privilege escalation in pkexec (bsc#1194568)
  added CVE-2021-4034-pkexec-fix.patch</changelog>
  <changelog author="rfrohl@suse.com" date="1644235200">- CVE-2021-4115: fixed a denial of service via file descriptor leak (bsc#1195542)
  added CVE-2021-4115.patch</changelog>
</package>
<package pkgid="82353d4ab4313668340c17ff73b50dd28a34ce6511d005da9d877c7c42e32bc3" name="libpolkit0" arch="x86_64">
  <version epoch="0" ver="0.116" rel="3.9.1"/>
  <changelog author="antoine.belvire@laposte.net" date="1438862400">- Update to 0.113:
  * Fix CVE-2015-4625
  * Fix CVE-2015-3256
  * Fix CVE-2015-3255
  * Fix CVE-2015-3218
  * On systemd-213 and later, the ?active? state is shared across
    all sessions of an user, instead of being tracked separately
  * pkexec: when not given a program to execute, runs the users?
    shell by default
- Remove polkit-no-kded-leak.patch (upstreamed)</changelog>
  <changelog author="meissner@suse.com" date="1448539200">- polkit-revert-session-magic.patch: revert a session detection change
  that could lead to sessions not being detected as active due to
  a systemd bug. bsc#954139</changelog>
  <changelog author="fbui@suse.com" date="1465300800">- systemd.pc is shipped by systemd main package (bsc#983167)
  Strangely polkit wants systemd.pc to detect that the target system
  is running systemd even if its configured to build systemd support...</changelog>
  <changelog author="fbui@suse.com" date="1465387200">- Use pkgconfig() instead of requiring systemd package names directly.</changelog>
  <changelog author="lnussel@suse.de" date="1497355200">- Use gettext as fallback to get potential distro translations for
  polkit actions. Similar mechnism as used for desktop file
  translations. That way it's possible to use weblate to add
  additional translations that are not provided by upstream
  (polkit-gettext.patch).</changelog>
  <changelog author="dimstar@opensuse.org" date="1502798400">- Add polkit-itstools.patch: Add gettext support for .policy files.</changelog>
  <changelog author="dimstar@opensuse.org" date="1519819200">- Modernize spec-file by calling spec-cleaner</changelog>
  <changelog author="schwab@suse.de" date="1519905600">- pkexec.patch: pkexec: allow --version and --help even if not setuid</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1523275200">- Update to version 0.114:
  + Port to mozjs 52, the latest version of the firefox JavaScript
    engine.
  + Add gettext support for policy files.
  + Fixes for various memory leaks.
  + Updated translations.
- Update keyring with Ray Strode &lt;halfline@gmail.com&gt; public key.
- Drop with_systemd define and all conditionals and
  polkit-no-systemd.patch and ConsoleKit BuildRequires, we only
  support systemd now.
- Drop upstream fixed polkit-itstools.patch.
- Rebase pkexec.patch with quilt.
- Add gcc-c++ and pkgconfig(mozjs-52) BuildRequires: New
  dependencies.
- Drop conditional pkgconfig(mozjs-17.0) and pkgconfig(mozjs185):
  no longer supported.
- Drop autoconf and automake BuildRequires: They are implicit via
  libtool BuildRequires.
- Replace glib2-devel and gobject-introspection-devel with their
  pkgconfig counterparts: pkgconfig(gio-unix-2.0),
  pkgconfig(gmodule-2.0) and pkgconfig(gobject-introspection-1.0).
- Add polkit-jsauthority-pass-format-string.patch: jsauthority:
  pass "%s" format string to remaining report function, patch from
  upstream git, adding missed commit (bgo#105865).
- Drop polkit-revert-session-magic.patch: Upstream systemd bug is
  since a long time fixed (gh#systemd#58) (boo#954139).</changelog>
  <changelog author="meissner@suse.com" date="1531310400">- Update to version 0.115:
  - Fix CVE-2018-1116: Trusting client-supplied UID (bsc#1099031)
  - jsauthority: pass "%s" format string to remaining report function
    (obsoletes polkit-jsauthority-pass-format-string.patch)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1534507200">- Add polkit-fix-possible-resource-leak.patch: Fix possible
  resource leak found by static analyzer.
- Add polkit-fix-leaking-zombie-child-processes.patch: polkitd: fix
  zombie not reaped when js spawned process timed out (fdo#106021).</changelog>
  <changelog author="meissner@suse.com" date="1545307200">- polkit-CVE-2018-19788.patch: Fixed handling of UIDs over MAX_UINT
  (bsc#1118277 CVE-2018-19788)</changelog>
  <changelog author="mvetter@suse.com" date="1556280000">- bsc#1130588: Require shadow instead of old pwdutils
- User proper Requires(pre)/Requires(post) for permissions and
  shadow</changelog>
  <changelog author="dimstar@opensuse.org" date="1557489600">- Use systemd_ordering instead of systemd_requires: strictly
  speaking, polkit does not require systemd to be present. Just
  that when we install on a system with systemd (e.g outside
  containers) we would want systemd to be present before
  installing polkit. Help also reduce a cycle without special hacks
  in systemd.spec.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1559131200">- Update to version 0.116:
  + Leaking zombie child processes.
  + Possible resource leak found by static analyzer.
  + Output messages tuneup.
  + Sanity fixes.
  + pkttyagent tty echo disabled on SIGINT.
  + HACKING: add link to Code of Conduct.
  + polkitbackend: comment typos fix.
  + configure.ac: fix detection of systemd with cgroups v2.
  + CVE-2018-19788 High UIDs overflow fix.
  + CVE-2019-6133 Slowfork vulnerability fix.
  + Allow unset process-uid.
  + Port the JS authority to mozjs-60.
  + Use JS_EncodeStringToUTF8.
  + Updated translations.
- Replace pkgconfig(mozjs-52) with pkgconfig(mozjs-60)
  BuildRequires following upstreams changes.
- Drop patches fixed upstream:
  + polkit-fix-possible-resource-leak.patch
  + polkit-fix-leaking-zombie-child-processes.patch
  + polkit-CVE-2018-19788.patch
- Refresh patches with quilt.</changelog>
  <changelog author="meissner@suse.com" date="1570536000">- polkit-keyinit.patch: add pam_keyinit to the polkit configuration (bsc#1144053)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1575028800">- Fix usage of libexecdir instead of prefix/lib where applicable.</changelog>
  <changelog author="meissner@suse.com" date="1622116800">- CVE-2021-3560: fixed a local privilege escalation using polkit_system_bus_name_get_creds_sync()
  (bsc#1186497)
  CVE-2021-3560.patch</changelog>
  <changelog author="meissner@suse.com" date="1642075200">- CVE-2021-4034: fixed a local privilege escalation in pkexec (bsc#1194568)
  added CVE-2021-4034-pkexec-fix.patch</changelog>
  <changelog author="rfrohl@suse.com" date="1644235200">- CVE-2021-4115: fixed a denial of service via file descriptor leak (bsc#1195542)
  added CVE-2021-4115.patch</changelog>
</package>
<package pkgid="f762643a1391b970fae8d7e3ef912b41bd0de4bfa1106b2d59a2876112498214" name="libpolkit0-32bit" arch="x86_64">
  <version epoch="0" ver="0.116" rel="3.9.1"/>
  <changelog author="antoine.belvire@laposte.net" date="1438862400">- Update to 0.113:
  * Fix CVE-2015-4625
  * Fix CVE-2015-3256
  * Fix CVE-2015-3255
  * Fix CVE-2015-3218
  * On systemd-213 and later, the ?active? state is shared across
    all sessions of an user, instead of being tracked separately
  * pkexec: when not given a program to execute, runs the users?
    shell by default
- Remove polkit-no-kded-leak.patch (upstreamed)</changelog>
  <changelog author="meissner@suse.com" date="1448539200">- polkit-revert-session-magic.patch: revert a session detection change
  that could lead to sessions not being detected as active due to
  a systemd bug. bsc#954139</changelog>
  <changelog author="fbui@suse.com" date="1465300800">- systemd.pc is shipped by systemd main package (bsc#983167)
  Strangely polkit wants systemd.pc to detect that the target system
  is running systemd even if its configured to build systemd support...</changelog>
  <changelog author="fbui@suse.com" date="1465387200">- Use pkgconfig() instead of requiring systemd package names directly.</changelog>
  <changelog author="lnussel@suse.de" date="1497355200">- Use gettext as fallback to get potential distro translations for
  polkit actions. Similar mechnism as used for desktop file
  translations. That way it's possible to use weblate to add
  additional translations that are not provided by upstream
  (polkit-gettext.patch).</changelog>
  <changelog author="dimstar@opensuse.org" date="1502798400">- Add polkit-itstools.patch: Add gettext support for .policy files.</changelog>
  <changelog author="dimstar@opensuse.org" date="1519819200">- Modernize spec-file by calling spec-cleaner</changelog>
  <changelog author="schwab@suse.de" date="1519905600">- pkexec.patch: pkexec: allow --version and --help even if not setuid</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1523275200">- Update to version 0.114:
  + Port to mozjs 52, the latest version of the firefox JavaScript
    engine.
  + Add gettext support for policy files.
  + Fixes for various memory leaks.
  + Updated translations.
- Update keyring with Ray Strode &lt;halfline@gmail.com&gt; public key.
- Drop with_systemd define and all conditionals and
  polkit-no-systemd.patch and ConsoleKit BuildRequires, we only
  support systemd now.
- Drop upstream fixed polkit-itstools.patch.
- Rebase pkexec.patch with quilt.
- Add gcc-c++ and pkgconfig(mozjs-52) BuildRequires: New
  dependencies.
- Drop conditional pkgconfig(mozjs-17.0) and pkgconfig(mozjs185):
  no longer supported.
- Drop autoconf and automake BuildRequires: They are implicit via
  libtool BuildRequires.
- Replace glib2-devel and gobject-introspection-devel with their
  pkgconfig counterparts: pkgconfig(gio-unix-2.0),
  pkgconfig(gmodule-2.0) and pkgconfig(gobject-introspection-1.0).
- Add polkit-jsauthority-pass-format-string.patch: jsauthority:
  pass "%s" format string to remaining report function, patch from
  upstream git, adding missed commit (bgo#105865).
- Drop polkit-revert-session-magic.patch: Upstream systemd bug is
  since a long time fixed (gh#systemd#58) (boo#954139).</changelog>
  <changelog author="meissner@suse.com" date="1531310400">- Update to version 0.115:
  - Fix CVE-2018-1116: Trusting client-supplied UID (bsc#1099031)
  - jsauthority: pass "%s" format string to remaining report function
    (obsoletes polkit-jsauthority-pass-format-string.patch)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1534507200">- Add polkit-fix-possible-resource-leak.patch: Fix possible
  resource leak found by static analyzer.
- Add polkit-fix-leaking-zombie-child-processes.patch: polkitd: fix
  zombie not reaped when js spawned process timed out (fdo#106021).</changelog>
  <changelog author="meissner@suse.com" date="1545307200">- polkit-CVE-2018-19788.patch: Fixed handling of UIDs over MAX_UINT
  (bsc#1118277 CVE-2018-19788)</changelog>
  <changelog author="mvetter@suse.com" date="1556280000">- bsc#1130588: Require shadow instead of old pwdutils
- User proper Requires(pre)/Requires(post) for permissions and
  shadow</changelog>
  <changelog author="dimstar@opensuse.org" date="1557489600">- Use systemd_ordering instead of systemd_requires: strictly
  speaking, polkit does not require systemd to be present. Just
  that when we install on a system with systemd (e.g outside
  containers) we would want systemd to be present before
  installing polkit. Help also reduce a cycle without special hacks
  in systemd.spec.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1559131200">- Update to version 0.116:
  + Leaking zombie child processes.
  + Possible resource leak found by static analyzer.
  + Output messages tuneup.
  + Sanity fixes.
  + pkttyagent tty echo disabled on SIGINT.
  + HACKING: add link to Code of Conduct.
  + polkitbackend: comment typos fix.
  + configure.ac: fix detection of systemd with cgroups v2.
  + CVE-2018-19788 High UIDs overflow fix.
  + CVE-2019-6133 Slowfork vulnerability fix.
  + Allow unset process-uid.
  + Port the JS authority to mozjs-60.
  + Use JS_EncodeStringToUTF8.
  + Updated translations.
- Replace pkgconfig(mozjs-52) with pkgconfig(mozjs-60)
  BuildRequires following upstreams changes.
- Drop patches fixed upstream:
  + polkit-fix-possible-resource-leak.patch
  + polkit-fix-leaking-zombie-child-processes.patch
  + polkit-CVE-2018-19788.patch
- Refresh patches with quilt.</changelog>
  <changelog author="meissner@suse.com" date="1570536000">- polkit-keyinit.patch: add pam_keyinit to the polkit configuration (bsc#1144053)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1575028800">- Fix usage of libexecdir instead of prefix/lib where applicable.</changelog>
  <changelog author="meissner@suse.com" date="1622116800">- CVE-2021-3560: fixed a local privilege escalation using polkit_system_bus_name_get_creds_sync()
  (bsc#1186497)
  CVE-2021-3560.patch</changelog>
  <changelog author="meissner@suse.com" date="1642075200">- CVE-2021-4034: fixed a local privilege escalation in pkexec (bsc#1194568)
  added CVE-2021-4034-pkexec-fix.patch</changelog>
  <changelog author="rfrohl@suse.com" date="1644235200">- CVE-2021-4115: fixed a denial of service via file descriptor leak (bsc#1195542)
  added CVE-2021-4115.patch</changelog>
</package>
<package pkgid="60c5d1c28a03f674d9d4382b79fdbb5f3ab172a243c2e9e2480d06c740701319" name="libreoffice" arch="aarch64">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="e72d4ca6c8af3d02cc59b72a04005cb24d961b9b84f96b51d40810de9cd0b571" name="libreoffice" arch="ppc64le">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="7dff488c10442904cfedbf1f65d94bca822eae67f7edf3fe7a95fd1104b4c39d" name="libreoffice" arch="src">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="5207e26da615617c847b2cdde23cd904ceaaf1219cb8c4a34e4863829d36821a" name="libreoffice" arch="x86_64">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="2ec1fdd254a8d6ec4a18727104438028a4c624a527fa9636839cd3687d6bcc35" name="libreoffice-base" arch="aarch64">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="900b2feb6b30f4357c982bcd71b3ecd91856c8a7dc91009121b7825737c49983" name="libreoffice-base" arch="ppc64le">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="d4d4564d0c5db3fe4becc5749da2b2f2d7314225205c9d9db665fab8c7c0165b" name="libreoffice-base" arch="x86_64">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="a2d0f371f43265f2e7d5d6d197b45a64970ccdbcf528271e48b0378a36f559ce" name="libreoffice-base-drivers-postgresql" arch="aarch64">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="da9dd9430d05d1712d71e4e3249839f14c7052caec12a210d19ad831d27b5f5e" name="libreoffice-base-drivers-postgresql" arch="ppc64le">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="ca39ed252831e76e09e2eca1c94b6345e043ba2bb2ea38797f25a454910fc650" name="libreoffice-base-drivers-postgresql" arch="x86_64">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="5b89f179958732c5f9824dad1795333c14cce6728e8973d81bd4fce809bc40a4" name="libreoffice-branding-upstream" arch="noarch">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="8fae3f585a2f862825da3d7efbc7c04b59543ae40d727682d21a316d27a27e94" name="libreoffice-calc" arch="aarch64">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="db1fa4981b6c85f8d2911f0952d65b2676e9b27e76aba5f336266807c70f1dfe" name="libreoffice-calc" arch="ppc64le">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="10ac2c82cee7f0108849b7bd170bceef1e5af6fb05b895b70ac2fbdf93569abd" name="libreoffice-calc" arch="x86_64">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="432cbc546ab599a9a687427ecb498bbc9f3051824681d66747a64c6d079f6984" name="libreoffice-calc-extensions" arch="aarch64">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="ae40f325fb526aee1d663afe70abc61672847d68fd543de6339bc9fc1b77f4d3" name="libreoffice-calc-extensions" arch="ppc64le">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="707fb1f8bfebe6bc82feea1295c681da840d95dc4bad8b635e64e447e21a95da" name="libreoffice-calc-extensions" arch="x86_64">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="bf3593e2f13b27de706d8b71835cdcf6802ae8d393f72837c3f1e8d80ba5d24c" name="libreoffice-draw" arch="aarch64">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="5eb44dbdd6bc5cb6e35c9c2351ecca38a371e670059c66a6f58a89aa91f92a80" name="libreoffice-draw" arch="ppc64le">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="3d9ba96249423e3d25075f4c5fe5609c5e137d69bcb2f0f7a662c92a39edc8e5" name="libreoffice-draw" arch="x86_64">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="22c567e1f80ded6e962162a7c3563772a4899915ac884d2c0186d6b7ed1ca963" name="libreoffice-filters-optional" arch="aarch64">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="59f44f55db5162e32a3d878981642a1deffbc3acf988438b46c8b4adb2d4c0ca" name="libreoffice-filters-optional" arch="ppc64le">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="d36719e3acb51bf9b6c4a14d7c11b494a15fbaeb188d60395a88b2a0b311bb07" name="libreoffice-filters-optional" arch="x86_64">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="bcc24c0e6bb60241b223cedadd122a7d560b93785bdf8a9a8fcf705d8d79de7e" name="libreoffice-gdb-pretty-printers" arch="noarch">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="bd77b4f7a86f9c6317244925b7cbe1277361af0b7dc6246e93873027f5807952" name="libreoffice-glade" arch="noarch">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="3e58b308c6d83617743f0ef1fd08b6d5d5acdb4052814ebe23e575b4419971e6" name="libreoffice-gnome" arch="aarch64">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="c413aacedb0098323a311dd6313dc75788bceee7e41049b412393bc535e0288f" name="libreoffice-gnome" arch="ppc64le">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="6d7c32091d47b6edfe68e7acbde3db0919add9139315368988b9834e0409fca0" name="libreoffice-gnome" arch="x86_64">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="ec7d8960509c7537e5efbe446ec2890e37d238470f4053282661ebbda5a68d93" name="libreoffice-gtk3" arch="aarch64">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="1134c34d881ca9155a57be85982edff718873c91c3bb798e2b51eb63f70cc39f" name="libreoffice-gtk3" arch="ppc64le">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="64931b6093b21914f1f8944809d6d6463fa713596b6ecb0dee8ec1129af0b806" name="libreoffice-gtk3" arch="x86_64">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="adf1927fd2203111ac9a0221ef489faa6d714a1e7ef73980c961539f4c2c448e" name="libreoffice-icon-themes" arch="noarch">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="9d5f83eb1cc739711946e84900c89926d12338e7ecf79220133ed6c7c3cc4926" name="libreoffice-impress" arch="aarch64">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="0ab393346ced3e367f2e3e8ac5eb9b87e9eefbf2f64c0c2d4198ae5c4cd0e0af" name="libreoffice-impress" arch="ppc64le">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="8f947aa719a83ebfbbff9bd2fab53a5c8d8419c8d18ff4ef76d20faf581a056a" name="libreoffice-impress" arch="x86_64">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="453688d26273c31c8ad461c29e6035b71a42a68ef09eb0304c9bdc6c1398a796" name="libreoffice-l10n-af" arch="noarch">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="83dc6f65c932dfb197d31795437eea43c56211ebba564148cfdf1f482c12c62d" name="libreoffice-l10n-am" arch="noarch">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="b9c6636d3b5c4f2e24ba6c596d85a32fb25e1561455948793705c310f800e29d" name="libreoffice-l10n-ar" arch="noarch">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="0ca5a0773129219b3e38d1dc111547a2aed08c19ee103e5a2c3b77ee0493f105" name="libreoffice-l10n-as" arch="noarch">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="fae340b89cb6cb47376b08d98ff84dab4bb15323d877ec67497b6a45bbff56d8" name="libreoffice-l10n-ast" arch="noarch">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="798b163fa3573df5e36a6f3102325bc02439fe7d03728781bb2cda76a43d67ff" name="libreoffice-l10n-be" arch="noarch">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="b61f7c400a33bf80bfc464ca90714f63d00a405744a72c609195da1556a80ac8" name="libreoffice-l10n-bg" arch="noarch">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="51b544598e4961d4df5c6d308e263d66eef3bfaf3021f28d934dc27fad05433f" name="libreoffice-l10n-bn" arch="noarch">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="b67d1c4e16c131d1c9725811a2cf5655a425d3c48544d674fa298c0d33808659" name="libreoffice-l10n-bn_IN" arch="noarch">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="044a5a63cdea924fb666067063e5c93535dfa23b5bcf9527e7f092ba7680654e" name="libreoffice-l10n-bo" arch="noarch">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="48d4b37b71ceefbc00c89e1759c47dc0c0e91fcffded9c526207c1aea07b811c" name="libreoffice-l10n-br" arch="noarch">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="77cf51ba5b70d5b130ef573e85a629856c7a5bf0054d7386ffaabe2084179689" name="libreoffice-l10n-brx" arch="noarch">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="b8509d82e639947daef5a1560aa5611997c215408a497653d52147635820d944" name="libreoffice-l10n-bs" arch="noarch">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="e999c8ae05abc4705ca2cd6d863091d16a5ec3912728b2b8b0eeea2561056264" name="libreoffice-l10n-ca" arch="noarch">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="5325fa6b09e83ba42f0a88876c1f3dc3a7d66b96f3b9d656b7281da65b20c1d8" name="libreoffice-l10n-ca_valencia" arch="noarch">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="0556b04afaec4b249fa0e7dad1a8bad56721d320284c06da48fc5ab4b58f3f8d" name="libreoffice-l10n-ckb" arch="noarch">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="deb6082c20a480e46ff2a86b7f78bbdd6c12eb3c7a9b1d7cd02cbf4fe4ef5910" name="libreoffice-l10n-cs" arch="noarch">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="90ca7c7bdc94bb94ff7ef3ffa38211910e96f1f6f228707ed4bbcde42c7cd610" name="libreoffice-l10n-cy" arch="noarch">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="fdccba1991c2d555c7a80a838f3a23ab27a2c197ea21b7e99acb3e4d090bd847" name="libreoffice-l10n-da" arch="noarch">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="9cfd9efc48040a39d93a6cf74707d2b6b5813bb12761e89e2c0d17ec91699472" name="libreoffice-l10n-de" arch="noarch">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="062e891f97356e2b1eddcb95c4cc6a28efd4aed9c6c129450bf732ee166cc9a9" name="libreoffice-l10n-dgo" arch="noarch">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="7b74e2d6547a6514991604f17c23c2822cbe802b14fbdfa9500f9cbc0fe7ebd6" name="libreoffice-l10n-dsb" arch="noarch">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="206614e122722133ab14ffd8aa1c4b1730fae2d601595c6d3451fd1fa8012c09" name="libreoffice-l10n-dz" arch="noarch">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="0e65b78415c03e5b95f3e3313eb93aabff16e5e1a56b49b9bf4c9a9be623613f" name="libreoffice-l10n-el" arch="noarch">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="b68b81a43c9efc7bc38d3df94f7a628ef6be87a71f9595986d6a823d3f2febb3" name="libreoffice-l10n-en" arch="noarch">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="7b9e069d616e7070e185e46f095da42fc0b007d713abd4b0e1bdcb1bd593870d" name="libreoffice-l10n-en_GB" arch="noarch">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="1427eb69bd014fc1e1b980f659def0f63333d0a503b8890ecb44b0e3c63d96be" name="libreoffice-l10n-en_ZA" arch="noarch">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="57f83dd24878cafd6fe22edf70b43947d553a60fb6af3c29c2868fa21a60fdbd" name="libreoffice-l10n-eo" arch="noarch">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="25fb1cea2b1871dc48baba59687a35ebad51de351d1fd1d076341169d07cd33a" name="libreoffice-l10n-es" arch="noarch">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="c8fa1fd5187259d4b276fedfb43dc1026a408789352256c5a8502e5276f44ac9" name="libreoffice-l10n-et" arch="noarch">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="3cdf82d145a0f6a2d23f75b329fe82a8e9fdcfdd84d441cfca3d20a073bc94c4" name="libreoffice-l10n-eu" arch="noarch">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="1fb97f6906ba0e5b7a51d0dbe2f9b08b0bab7a8259e4bc067f581c89eba6c9b5" name="libreoffice-l10n-fa" arch="noarch">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="c2c561b85906b5a5ecddf7a048e895dbb6204b83597daf47afec024d679f01a0" name="libreoffice-l10n-fi" arch="noarch">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="ed166c233aae954fad6303af24df533498ab3f6a45d9d036543f7a382a805701" name="libreoffice-l10n-fr" arch="noarch">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="3a822250f6619fecf9f9fa7f68be22ad9f178d0d55eff43ee56bbea407fe07e5" name="libreoffice-l10n-fur" arch="noarch">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="0d3b33be400b700dc07a010c12a34ec31a6d47f7901c4374dc58e8107572a27e" name="libreoffice-l10n-fy" arch="noarch">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="102022dacad6b0cc10d9c1138564e6c9eece67b9d5ebf487ffbddf9bf9e8dd3e" name="libreoffice-l10n-ga" arch="noarch">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="fee6661e65f6107cfc49a81c995624366399783b53e20dcbbc71084bece8f899" name="libreoffice-l10n-gd" arch="noarch">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="9f8db0a86cdf510536b1373982ed4fdd7186ed768f82f89c481f5f8a2efebffc" name="libreoffice-l10n-gl" arch="noarch">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="dda3a03a85a343968f1f24b1922cee4f2aa1ae439c5517527ad071733929dcb8" name="libreoffice-l10n-gu" arch="noarch">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="40274df16434f0cf1b576d511f72ff7788d067d31a06d90596e23ef2e5713084" name="libreoffice-l10n-gug" arch="noarch">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="4e0b06ec1f46f4d87df7dfb1d55da4e8c7dc209953586760d31f6167371e7bcc" name="libreoffice-l10n-he" arch="noarch">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="b87bbe858ec4691f068299989ce653eb436effdc80a97632f37d72471dab3d7a" name="libreoffice-l10n-hi" arch="noarch">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="211575480e8277291a4410ae9cd0b4ea9f0a2eb4063ac323b028cb8e6f52c0b9" name="libreoffice-l10n-hr" arch="noarch">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="99a2579aeb963cde7d48ca4cedfe0538113cca04902a54e82ee429bb32ef4bca" name="libreoffice-l10n-hsb" arch="noarch">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="b55f17f81cbe32dad190fd7a04046dd239684a8ab0ea374660b3ad98e5338863" name="libreoffice-l10n-hu" arch="noarch">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="c63817241b7a2c0eabe327b71ccc1319fa29d1262ab486c39c5c97b3b98a57d8" name="libreoffice-l10n-id" arch="noarch">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="9f791555165c82f6396c1a3b515688aee035c364212272dbb40607bb74c8bd12" name="libreoffice-l10n-is" arch="noarch">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="7ccd78839ef3af78757edb15546d8589f17375c1242aa134a61c18a3b8ec19ca" name="libreoffice-l10n-it" arch="noarch">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="95c7b1279d32214eac482781966b688d7670d8698aaa40c01dcca4edd9e1752f" name="libreoffice-l10n-ja" arch="noarch">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="e48bf602be3a1109605e6cd7af2f401793ad0644cece941b30cf43caacb77e44" name="libreoffice-l10n-ka" arch="noarch">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="dfaa5385e08dd00e834991c8a818e43dd580160b7e1d75f0fd1014a34dab4669" name="libreoffice-l10n-kab" arch="noarch">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="236b8b1f5e47766196f9925540308d659135374e53833ab5d0ad7f71c7e609f2" name="libreoffice-l10n-kk" arch="noarch">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="82a924de0e95b6f335b11bb3b72c841b2d51f4626207929959fc50effbed5379" name="libreoffice-l10n-km" arch="noarch">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="0b29649b19358a51261408c3ed2edaa914d0d1cb842d48bc9971a3d14bf3c114" name="libreoffice-l10n-kmr_Latn" arch="noarch">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="055702249220e30c751ae85e82bb4fc044304f77530d56d0f73e2c90b0dd37b8" name="libreoffice-l10n-kn" arch="noarch">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="13dc1ccd062ab9bceae88377719023c69962c6c52e57cf17368024940ae1ac01" name="libreoffice-l10n-ko" arch="noarch">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="2b5f12a84bab3369f6da0a1189bc0a5889265cf1181f9e9232e2476f801a5787" name="libreoffice-l10n-kok" arch="noarch">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="e6397ff26328b7329ce1a3979ad414bb397154a8d02016c5ab2ed5b56fe856f1" name="libreoffice-l10n-ks" arch="noarch">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="20dd468a594c1b4d37927e07a4808beecdca6ab1d6695b8d3bd10d53a60c4768" name="libreoffice-l10n-lb" arch="noarch">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="16b4a27cbac17ec3b80fd957f76981e2edd2b2ed48bf2f06f32d69ca169e5fad" name="libreoffice-l10n-lo" arch="noarch">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="9e31923d20796c987dcbd8a8c63513ae01d639b254b2c50f41b5423e6f735107" name="libreoffice-l10n-lt" arch="noarch">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="a5d59037bc802da5ef2078642c3ef0b7ee2c8f8fcd6f54951972d612784c4a25" name="libreoffice-l10n-lv" arch="noarch">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="3fa63a3433b35e730a572564524e61be2bc0cbfd8a0a28a855b1df8f2b5f1370" name="libreoffice-l10n-mai" arch="noarch">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="f7f15a16b8c14577a2ae2e5fa9fe46fca70aa3843302166ac443fc60c04e01ba" name="libreoffice-l10n-mk" arch="noarch">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="2dcdae0dae8a7b173e1c80b84387f8f0ea3824c5195b217d379a1d79f31480a5" name="libreoffice-l10n-ml" arch="noarch">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="f7b8b7aa18fc636068abf1e5e1c32894f1f4a3a400dc68447cbeec0a64a1055e" name="libreoffice-l10n-mn" arch="noarch">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="7a4c5d8171647a95f08fc848239450d527cfdd9d73909edbf265fa41f1186a99" name="libreoffice-l10n-mni" arch="noarch">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="5d10860272b12b755f050f18ae4d47ecdd50f1f55c39f3b95b6fd3d37118fc0f" name="libreoffice-l10n-mr" arch="noarch">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="e70ee8c0cba3ee73c14eaf4caa78f20d3f9484a0b8b50cde514eef65be546c6f" name="libreoffice-l10n-my" arch="noarch">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="aafdd1962b0a9699a348f7d56e009bdb2a60321c311644e056cc1aa890b94d59" name="libreoffice-l10n-nb" arch="noarch">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="720dca5fe02c96ece3ead71b97e7fd4f644b281b985818b1407126bd8ca8e95e" name="libreoffice-l10n-ne" arch="noarch">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="c57b8c842617819f1e394e81a58d1e78d7390b89a10fcf56af135fdfff2dd045" name="libreoffice-l10n-nl" arch="noarch">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="210d217caf3cc7a9a90f96130a5337072959c8f8dd8af04abe7049b61fd0ecd5" name="libreoffice-l10n-nn" arch="noarch">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="5402fbe766b30444506c1e91d2ab33ff99e4ff7dae1b9ca5b78079e7f6630a92" name="libreoffice-l10n-nr" arch="noarch">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="84b0a4418c491ab1872823c9aa0ca4a975da7f4dab60a3f0028957ca12f7b169" name="libreoffice-l10n-nso" arch="noarch">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="c2f1a6d440038c138b3f1ab111caf04f9a33f7bb49e5a6613ebb4dde55b51352" name="libreoffice-l10n-oc" arch="noarch">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="a8eb643a3943f119075bd9d682ea35d160a050740d6a69afe2cac6996ba493aa" name="libreoffice-l10n-om" arch="noarch">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="bc7466af7fd375b6282c9574fe39e150d2c133bf41052bf6a0496034f91fcae5" name="libreoffice-l10n-or" arch="noarch">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="c0eb4551bd066d4cf7e26f8bc5ab7e7236a78127db1e4f970bbe7c90bb704615" name="libreoffice-l10n-pa" arch="noarch">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="6cea6ca6c13c64281cd9d048b8b323d1640070bdc6d7818b3b9e581449c7cf0a" name="libreoffice-l10n-pl" arch="noarch">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="6f9ce996a011057dca90c9da2792db210dfc646ef5b38072eb10f987f53bc29a" name="libreoffice-l10n-pt_BR" arch="noarch">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="96818d936934a9cd804881c13bbce8c3694b8bd3cd6bcabfc044f2e5c5e30dd1" name="libreoffice-l10n-pt_PT" arch="noarch">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="3c7ee225275a2f2b4370a9f713a3b45c4b17c06b3942f964a3a6c7980ba239dc" name="libreoffice-l10n-ro" arch="noarch">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="993cc712949bfb625a9b50f8585cbc1bb7fbdec09ddfc115c0136552234b3fa7" name="libreoffice-l10n-ru" arch="noarch">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="d873be40f47ba2d912b09ff53396266de06a76b4277bdb3575169f015a61a772" name="libreoffice-l10n-rw" arch="noarch">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="b25248b09247c3bdab5d8993c3f1ed61b1a1d5e28f9efb43b0fb9e5406a4333a" name="libreoffice-l10n-sa_IN" arch="noarch">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="4c4d82960fccaf276f39191a215845ac26226df6dc6f3c16549da1a2d440b5f3" name="libreoffice-l10n-sat" arch="noarch">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="4dd9e0251751acb35192af158c24a599ce9f5c9d5b3ddb4a561d84f036087520" name="libreoffice-l10n-sd" arch="noarch">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="a7df62ed19da9534128bec488babab5108787afb2e274cce92df7382854cf34c" name="libreoffice-l10n-si" arch="noarch">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="c18475afbeafa49facc7cb78ffdda2357f2a10484b12c3b3567cfb76f6984f63" name="libreoffice-l10n-sid" arch="noarch">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="17aafff65f1dd629e92396992a6659ab017745b0df1a91ea538dc14d2e9c454e" name="libreoffice-l10n-sk" arch="noarch">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="437d15a5ddf71bbb01520f93d744cd25941ada80a074b6f585defc29901def3e" name="libreoffice-l10n-sl" arch="noarch">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="4e65208389caf48d3c20e6d82e7d4948ac08e8b9edc4cc06b8f686b30224bf3f" name="libreoffice-l10n-sq" arch="noarch">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="0ca09e35b421141b9a0a0df0d194b3fed55d63e7c8ed028dcc705b78ddcae635" name="libreoffice-l10n-sr" arch="noarch">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="1a13c03df2f2494b92df5879f351a49042d15a6f007fd96e56737eabe85910d5" name="libreoffice-l10n-ss" arch="noarch">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="58ec8df81b67baa66b9b3e2cba536f2c0c128a254fb1742f939bc13a3266abd6" name="libreoffice-l10n-st" arch="noarch">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="00a46f9a2bbcb8aef00a1efa504c26fab279ef9493d27f4a7582c58560c53c87" name="libreoffice-l10n-sv" arch="noarch">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="4ab9a9790e4e1bd8aff36d5e17da316caf3ab86ad6540b5b2b81c63a4411391b" name="libreoffice-l10n-sw_TZ" arch="noarch">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="386e21eacd4c8e61237a9e944c628f8fb2e80e92053b81c579d9cfbbdd435485" name="libreoffice-l10n-szl" arch="noarch">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="5b6b43db35c4ba8c666719ca81aef62208f8e11cb775e435550e7efeaf0e8797" name="libreoffice-l10n-ta" arch="noarch">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="70ed112e180858cad07f713dd75df592d11d483f198d87cc407feea17ec4346c" name="libreoffice-l10n-te" arch="noarch">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="1a604f8fad1610d166f10cf7bc0706354e37ac5cb551be5bc2e0b751f2edeeb5" name="libreoffice-l10n-tg" arch="noarch">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="059d6654f9e337bc0b81998ce72c79cc0759c71ea3380d6a70b573f714e1aafb" name="libreoffice-l10n-th" arch="noarch">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="74d8cd2e955985e512da5f0e931006989cd1efee28a2853f8b6e572f20355c71" name="libreoffice-l10n-tn" arch="noarch">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="ca72a042beabdabc060741d69ed02f3307a5a9e13fc930882656a147f279fcd9" name="libreoffice-l10n-tr" arch="noarch">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="a69a69dd7091107735b3c6b355992fa6628e0fbad2c1386f4c5cc7c824a6f0cd" name="libreoffice-l10n-ts" arch="noarch">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="7d265990aff77bcc02c0bf7ba2303c512ec3ce4ea5475440ef861e08a1dcf592" name="libreoffice-l10n-tt" arch="noarch">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="ceeabb8cacff50542e75bcbb4bac4fa0e940ff87c8c20db5699e13df5dad7d12" name="libreoffice-l10n-ug" arch="noarch">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="9d414dc822698d2b3d9b004c120e1926a0c5206fb877ecc24cd86e8ea46716d0" name="libreoffice-l10n-uk" arch="noarch">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="984097f770d04c6775300b4b67f082097d4079f23ccc138bcf5b65265b97a8f6" name="libreoffice-l10n-uz" arch="noarch">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="99cee0f4de1c63c03d78481725bd120d0c02c29dd93cf0924f2aacf32b092212" name="libreoffice-l10n-ve" arch="noarch">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="490378b18dd54501b1683ee799a80d123f9d4205b0affcd52faa4b75e7205daf" name="libreoffice-l10n-vec" arch="noarch">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="e9ed029a4222d32a8a60b532c1626756a075163998a801f00dbe47795168acc7" name="libreoffice-l10n-vi" arch="noarch">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="581e840d2529e058d11c2d817968f3735f639ae289f767ead6f8d5afe3b5a8c0" name="libreoffice-l10n-xh" arch="noarch">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="730cd58b5e63f9aa21251d6ef225d98dcf15bff04bbc29ab71824c5aa758522d" name="libreoffice-l10n-zh_CN" arch="noarch">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="e03057598c56b9c624dec65d9110c2418e44a19190189021f9f02f7f471af81b" name="libreoffice-l10n-zh_TW" arch="noarch">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="34706084ee9ef8f923c0faf4b0aeb4e0d8f8df351e6ddb9879499043f9020935" name="libreoffice-l10n-zu" arch="noarch">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="6d968f4fe0b3139bb43431c2fbb1d0d7809a479de3ffe609e2e9c44ed6c7b187" name="libreoffice-librelogo" arch="aarch64">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="038cf84c3cb6812b164f099864ef49bc9f9f07076adbd3956958012c1a0a0af4" name="libreoffice-librelogo" arch="ppc64le">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="f885635a979be2fbb5589763453698e5a8dcf1c58fef7d1d7ca0a3426804fecd" name="libreoffice-librelogo" arch="x86_64">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="71ed7a910727ebdbb9893b776086a4636c466319583a7f60af66fc0a888a6b17" name="libreoffice-mailmerge" arch="aarch64">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="d613edb15fe0cb439bfe82107ec85179a39fa2c10ecb33a86ee11dc6eb3893e1" name="libreoffice-mailmerge" arch="ppc64le">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="e0450f34357d1210d4986bd91567897d6b78d1e9d3db06b129048b10ea642c08" name="libreoffice-mailmerge" arch="x86_64">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="1ba2bc6eda126a4bfb76e40fec46949276034588e3d599ae3863335851f44b39" name="libreoffice-math" arch="aarch64">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="982fa2b037cf30fd3c5a16722cb728b64711af8ee3bf5c243a5b990d66aee32d" name="libreoffice-math" arch="ppc64le">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="1b6b46d5658d70366b2e5f50ff93b0bda51832a5e33438f88deba00f3360ad94" name="libreoffice-math" arch="x86_64">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="534335cc3b41d7a324edf02bbc1abde1452bec2845f5859c84cbcc0936948a5c" name="libreoffice-officebean" arch="aarch64">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="e2f08eee7de7b75e3d87457dcdf0255b77b24b46546e95515e634ca0595520ae" name="libreoffice-officebean" arch="ppc64le">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="d763f5e8c48b9dae48588db1228bcfd69d1c19879ad3921493340fd74a29f7c9" name="libreoffice-officebean" arch="x86_64">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="6b59ab1efe52855ed5d1a06d0a2c1eb8ac10e482bd5031302b657620394dfdb9" name="libreoffice-pyuno" arch="aarch64">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="bf74c3504b0f683cfde4c90b1ab5b876d9e41dc71efe7a41825eca8aa6f4b534" name="libreoffice-pyuno" arch="ppc64le">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="1501ef10a6546c779b614468c09af1ebccc5f0a6276dedc541824535e982ba37" name="libreoffice-pyuno" arch="x86_64">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="60b85628a0207a939178db277e1e55d323ae002dfaa0850ceef8a96ccbd4476c" name="libreoffice-qt5" arch="aarch64">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="dfbe7ed47fe4396b4f4f24984514c34a2275860d003ecfa78114f97112d8c234" name="libreoffice-qt5" arch="ppc64le">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="b142e362bb43713ca8de97c7b179dfe63326a196cb0aaf7170ec87db86886229" name="libreoffice-qt5" arch="x86_64">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="10e8d1a764a3b8e281074b42966e25a857bee6df8a8f9a7bf4eae1cda0ce3293" name="libreoffice-sdk" arch="aarch64">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="387715aae5ba462ab14e6496d1a2550cafcc545e6346875987ccf435241681c1" name="libreoffice-sdk" arch="ppc64le">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="95e58828819623b4ca0b96e4f43aa51c2cffb54fbb5b62a649195edbd4bdc0c6" name="libreoffice-sdk" arch="x86_64">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="45e15b291be68fe343d4287143c38a70261d6825730163adc77fb1e8bed5629e" name="libreoffice-sdk-doc" arch="aarch64">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="450f41b2a44797a3e4ac6787c9241bff1ee806bb897f9fb78287732bbcf40006" name="libreoffice-sdk-doc" arch="ppc64le">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="fd67c6d9e0fc6178e98fa8b2dc7fbcdf288cc092cdc6c063723c91b7b061ab9f" name="libreoffice-sdk-doc" arch="x86_64">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="67da18b56f86046101dde0b3ab41591e53fd399206fb601f986448fc5e6de6ce" name="libreoffice-writer" arch="aarch64">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="768f3104216783888177a59f9f6792d7e1598cfdf103df8e31b6f6fb555edbc6" name="libreoffice-writer" arch="ppc64le">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="1209d59f4ad7c2d96735f7ec5cee446f761b121563078f3b23cb12f231014686" name="libreoffice-writer" arch="x86_64">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="e59d13a3f8acf0f7de79fbec5111285d08bd8b0d97a3de782624158159718e88" name="libreoffice-writer-extensions" arch="aarch64">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="4e378bdc1e3bbdcaf328059e05709748c49feb3acb4d2c6c8c0c52afd7db8c86" name="libreoffice-writer-extensions" arch="ppc64le">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="d107b47f9ec77d2aad2c221972db2f5ae002a7e33236abdd9de9813a62bec3c0" name="libreoffice-writer-extensions" arch="x86_64">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="262a6eaf5b44fc49c3c2f984433d42a35a1054f56554aba8737c5dd8cd204609" name="libreofficekit" arch="aarch64">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="f2c9ee7f2b2188d474c391500cca76d3f5e1e45b7642002b5acf76035ce65cb9" name="libreofficekit" arch="ppc64le">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="6e0699679231844968c126376da4bcc47a624b5d5e3772969276870a6438c438" name="libreofficekit" arch="x86_64">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="792c54a253571fb07d01f9a5cd20226cfd32dc3d52ae3a2095318c74e84dc10f" name="libreofficekit-devel" arch="aarch64">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="2c7fa2f6f804890ca195156b87bce2447ccaeaaf0a02eee5031a3dc923c286ee" name="libreofficekit-devel" arch="ppc64le">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="4793185d535f4a9b3f39e0cc9e071b601ec104204faf689e2d478ae3aeb77689" name="libreofficekit-devel" arch="x86_64">
  <version epoch="0" ver="7.2.3.2" rel="150300.14.22.15.3"/>
  <changelog author="tomas.chvatal@gmail.com" date="1616673600">- Version update to 7.1.2.2:
  * 7.1.2 final release
- Drop merged patches:
  * bsc1174465.diff
  * bsc1181644.diff
  * bsc1176547_1.diff
  * bsc1176547_2.diff</changelog>
  <changelog author="andras.timar@collabora.com" date="1617278400">- Fix bsc#1182970 - LO-L3: PPTX: image styles that clip images into curvy shapes missing (and images shown rectangular)
  * bsc1182970.patch</changelog>
  <changelog author="mmachova@suse.com" date="1617710400">- Adjust the package to work on SLE-12-SP5
  * bundle boost and icu
  * add patches 0001-Revert-java-9-changes.patch and
    0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch</changelog>
  <changelog author="mmachova@suse.com" date="1618920000">- Install qt5 plugin when the desktop environment needs it (boo#1184596)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- Update to 7.1.3.2
  * 7.1.3 final release
- Drop merged patches:
  * 0002-fix-the-endif-placement-for-GTK_CHECK_VERSION.patch
  * bsc1182970.patch
- Add temporary 0001-Revert-rhbz-1931423.patch (bsc#1184961, bsc#1184527)
  * libreoffice oomath does not ask to save changes when closing document</changelog>
  <changelog author="mmachova@suse.com" date="1620129600">- Add bsc1184961.patch to fix bsc#1184961 more cleanly
- Drop 0001-Revert-rhbz-1931423.patch</changelog>
  <changelog author="mmachova@suse.com" date="1620993600">- libreoffice requires at least java 1.8.0 to run properly
- mention some forgotten issues in the changelog</changelog>
  <changelog author="mliska@suse.cz" date="1621339200">- Add gcc11-fix-error.patch as fix for boo#1186110.</changelog>
  <changelog author="mmachova@suse.com" date="1621425600">- Recommend libreoffice-qt5 only when it is actually created</changelog>
  <changelog author="andras.timar@collabora.com" date="1622030400">- Fix bsc#1185505 - LO-L3: Text highlight "bleeds" when saving as PPTX
  * bsc1185505.patch</changelog>
  <changelog author="mmachova@suse.com" date="1622116800">- Fix bsc#1185797:  Searching in PPTX document makes LibreOffice crash
  * bsc1185797.patch</changelog>
  <changelog author="mmachova@suse.com" date="1623326400">- Update to 7.1.4.2 (bsc#1178806)
  * 7.1.4 final release
- Dropped patches:
  * bsc1184961.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1623672000">- Fix bsc#1182969: LO-L3: PPTX: one column becomes two within one text frame (two occurrences)
  * bsc1182969.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1623758400">- Use asimdrdm CPU flag for aarch64 to select only powerful buildhosts</changelog>
  <changelog author="andras.timar@collabora.com" date="1623931200">- Fix tdf#142839: a regression caused by "Multi column textbox in editengine"
  * tdf142839.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624363200">- Avoid crash getting default item for OWN_ATTR_TEXTCOLUMNS
  * multicolumn-crash-fix.patch</changelog>
  <changelog author="andras.timar@collabora.com" date="1624881600">- Fix bsc#1187173 and bsc#1186871: fix component handling for ucpdav1 when --with-webdav=serf
  * bsc1187173.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635422400">- Update to 7.2.3.2 (jsc#SLE-18214)
  * Fixes for the following issues:
    bsc#1187982
    bsc#1189813
- Use vendored boost for all codestreams except Tumbleweed.
  Update boost vendored version.
- Add vendored poppler to use for all codestreams except Tumbleweed.
- Keep upstream desktop file names (bsc#1183655) and display math icon (bsc#1180479)
- Source profile.d/alljava.sh from either /etc (if found) or
  /usr/etc).
- Dropped patches:
  * bsc1187173.patch
  * bsc1182969.patch
  * tdf142839.patch
  * bsc1185797.patch
  * multicolumn-crash-fix.patch
  * use-comphelper.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639656000">- Removed unrecognized option `--disable-vlc`
  This option has been removed from upstream in commit
  https://gerrit.libreoffice.org/c/core/+/108283
  There's no real change in our build given that the
  VLC avmedia backend was explicitly disabled.
  * Fix provided by Marina Latini
- Fix gtk popover usage on gtk 3.20
  * patch provided by Gustavo Boiko fix_gtk_popover_on_3.20.patch
- Revert upstream commit https://gerrit.libreoffice.org/c/core/+/116884
  * patch provided by Gustavo Boiko fix_math_desktop_file.patch
- Fix generated list of files for python scripts
- Updating some LibreOffice buildrequires
  * Fix provided by Marina Latini
- Fix UI scaling on HIDPI Wayland/KDE screens
  https://bugs.documentfoundation.org/show_bug.cgi?id=137924
  * fix-wayland-scaling-in-plasma.patch
- Refreshed patch 0001-Revert-java-9-changes.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643025600">- Fix bsc#1183308: LO-L3: Simple, seven page slide deck of 3.7MB takes
  looong to open, start presentation mode, or move back to slide 1
  * bsc1183308.patch</changelog>
</package>
<package pkgid="702917a24c4df267e457ec6ef4e41c3684cd1f5c34de5eeb88fcab44dcc38f29" name="librfxencode0" arch="aarch64">
  <version epoch="0" ver="0.9.13.1" rel="4.12.1"/>
  <changelog author="fezhang@suse.com" date="1537963200">- Update to version 0.9.8
  + New features
  - Add TLSv1.3 support #1193
  + Deprecation notice
  - TLSv1 and TLSv1.1 are removed from the default config.
    Current default is TLSv1.2 and TLSv1.3
  + Bug fixes
  - Ensure unmount redirected drive on fatal X error #1140
  + Other changes
  - Pulseaudio modules has been removed from xrdp source tree
  - Pass pulse socket name via environment variable #1198
- Update xrdp-fate318398-change-expired-password.patch: Use
  configured values instead of hardcoded ones in login_wnd inputs</changelog>
  <changelog author="fezhang@suse.com" date="1545912000">- Update to version 0.9.9
  + New features
  - Disconnection by idle timeout (requires xorgxrdp v0.2.9 or
    later) #1227
  + Bug fixes
  - Fix xrdp-chansrv crashes caused in drive redirection #1202
    [#1225]
  - Fix build with FDK AAC v2 #1257
  - Do not enable RemoteApp if the INFO_RAIL flag is not set
    (RDP-RDP proxy) #1253
  + Other changes
  - Add Spanish Latin Amarican keyboard #1237 #1240 #1244
  - Dynamic channel improvements #1222 #1224
  - Remove some deprecated sesman session types #1232
  - Refactoring and cleanups
  + Known issues
  - FreeRDP 2.0.0-rc4 or later might not able to connect to xrdp
    due to xrdp's bad-mannered behaviour, add `+glyph-cache`
    option to FreeRDP to connect #1266
  - Audio redirection by MP3 codec doesn't sound with some
    client, use AAC instead #965
  + Refresh xrdp-default-config.patch</changelog>
  <changelog author="fezhang@suse.com" date="1556539200">- Update to version 0.9.10 (jsc#SLE-5926)
  + New features
  - Restrict outbound (server-&gt;client) clipboard transfer,
    configured in `sesman.ini` #1298
  + Bug fixes
  - Fix libscp v1 not setting width but height twice #1293
  - Fix reconnecting to session causes duplicate drive entries
    in fuse fs #1299
  - Fix default_wm and reconnect_sh refer wrong path after sesman
    caught SIGUP #1315 #1331
  - Shutdown xrdp more responsively #1325
  - Improve remote file lookup in drive redirection #996 #1327
  - Overwriting &amp; appending to existing files now supported #1327
  + Other changes
  - Add Danish Keyboard #1290
  - Put xrdp- prefix to some executables appear in man page #1313
  - Replace some URLs from SF.net to xrdp.org #1313
  + Known issues
  - FreeRDP 2.0.0-rc4 or later might not able to connect to xrdp
    due to xrdp's bad-mannered behaviour, add `+glyph-cache`
    option to FreeRDP to connect #1266
  - Audio redirection by MP3 codec doesn't sound with some
    client, use AAC instead #965</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1564142400">- Removal of SuSEfirewall2 service, since SuSEfirewall2 has been
  replaced by firewalld, see:
  https://lists.opensuse.org/opensuse-factory/2019-01/msg00490.html</changelog>
  <changelog author="fezhang@suse.com" date="1565006400">- Update xrdp-pam.patch: Include the pam_keyinit.so module in
  /etc/pam.d/xrdp-sesman to support the kernel keyrings
  (boo#1144064).</changelog>
  <changelog author="fezhang@suse.com" date="1568116800">- Add xrdp-systemd-services.patch: Let systemd handle the daemons,
  fix daemon start failures (boo#1138954, boo#1144327).</changelog>
  <changelog author="fezhang@suse.com" date="1568635200">- Update to version 0.9.11 (jsc#SLE-9612)
  + New features
  - Suppress output (do not draw screen when client window is
    minimized) #1330
  - Audio input (microphone) redirection compatible with
    MS-RDPEAI #1369
  - Now xrdp can listen on more than one port #1124 #1366
  + Bug fixes
  - Fix the issue audio redirection sometimes sounds with long
    delay #1363
  - Check term event for more responsive shutdown #1372
  + Known issues
  - FreeRDP 2.0.0-rc4 or later might not able to connect to xrdp
    due to xrdp's bad-mannered behaviour, add +glyph-cache option
    to FreeRDP to connect #1266
  - Audio redirection by MP3 codec doesn't sound with some
    client, use AAC instead #965
- Rebase xrdp-avahi.diff, worked around stdint.h definitions
- Rebase xrdp-fate319683-allow-vnc-resizing.patch</changelog>
  <changelog author="yfjiang@suse.com" date="1573646400">- Make mkpamrules additionally support SUSE's usage of
  /usr/etc/pam.d (boo#1156094, gh#neutrinolabs/xrdp!1442):
  * xrdp-mkpamrules-support-usr-etc-distconfdir.patch
  https://lists.opensuse.org/opensuse-factory/2019-08/msg00113.html</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1581163200">- Build with --enable-vsock so xrdp can be used with hyper-v
  enhanced session mode.</changelog>
  <changelog author="fzhang.foss@gmail.com" date="1583928000">- Update xrdp-avahi.diff: Fix implicit definitions errors.</changelog>
  <changelog author="fzhang.foss@gmail.com" date="1584014400">- Update to version 0.9.13
  + Bug fixes: some regressions on drive redirection #1469 #1487
    [#1505] #1507
  + Support mousex button 8/9 #1478
- Update to version 0.9.12
  + Bug fixes
  - Fix "The log reference is NULL" error when sesman startup
    [#1425]
  - Fix behavior when shmem_id changes #1439
  - Make vsock config accept -1 for cid and port #1441
  - Cleanup refresh rect and check stream bounds #1437
  - Significant improvements in drive redirection #1449
  + Other changes
  - Proprietary microphone redirection via rdpsnd is now default
    off RDP compatible microphone redirection is on instead #1427
  - Skip connecting to chansrv when no channels enabled #1393
  - Add openSUSE's pam rules (boo#1156094, #1442)
  - Do not terminate xrdp daemon when caught SIGHUP #1319
- Known issues
  + FreeRDP 2.0.0-rc4 or later might not able to connect to xrdp
    due to xrdp's bad-mannered behaviour, add `+glyph-cache` option
    to FreeRDP to connect #1266
  + Audio redirection by MP3 codec doesn't sound with some client,
    use AAC instead #965
- Drop xrdp-mkpamrules-support-usr-etc-distconfdir.patch: Fixed
  upstream</changelog>
  <changelog author="qkzhu@suse.com" date="1585051200">- Update xrdp-bsc965647-allow-admin-choose-desktop.patch:
  Add `export XDG_SESSION_TYPE=x11` in startwm.sh for SLE, since
  lacking this variable in GNOME 3.34 causes GNOME crash (bsc#1159257).</changelog>
  <changelog author="qkzhu@suse.com" date="1585051201">- Update xrdp-bsc965647-allow-admin-choose-desktop.patch:
  + Set the default session to GNOME Session for SLE.
  + Update the variables to launch SLE-Classic Session.
  (bsc#1166746).</changelog>
  <changelog author="yfjiang@suse.com" date="1587729600">- Enable SLE only patches for Leap (jsc#SLE-11850).</changelog>
  <changelog author="dimstar@opensuse.org" date="1592395200">- Use %{_libexecdir} to install the legacy initscript actions to.</changelog>
  <changelog author="yfjiang@suse.com" date="1593691200">- Update to version 0.9.13.1
  + This is a security fix release that includes fixes for the
    following local buffer overflow vulnerability (bsc#1173580):
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-4044
- Rebase xrdp-fate318398-change-expired-password.patch</changelog>
  <changelog author="yfjiang@suse.com" date="1594382400">- Update xrdp.keyring according to:
  https://github.com/neutrinolabs/xrdp/issues/1627</changelog>
  <changelog author="yfjiang@suse.com" date="1597147200">- Update xrdp-bsc965647-allow-admin-choose-desktop.patch:
  + Fallback the session to icewm when a selected desktop
    environment is not found (bsc#1171415)
  + Support plasma session for Leap 15.2
  + Give more informative comments in start_wm.sh</changelog>
  <changelog author="yfjiang@suse.com" date="1604923200">- Introduce more buffer protection fixes (jsc#SLE-11518):
  + Add xrdp-memory-allocation-security-fix.patch
  + Add xrdp-remove-unecessary-gmalloc.patch
  + Add xrdp-safe-data-chunk-reassembly.patch
- Make the serial number of SLE patches on the bottom</changelog>
  <changelog author="yu.daike@suse.com" date="1628596800">- Fix crash in xrdp-fate318398-change-expired-password.patch (bsc#1187258)</changelog>
</package>
<package pkgid="b8b1f68e668a2fdd251b5ab6d27a38b9dd51eb7c852fde06cbd28c27b6ea1705" name="librfxencode0" arch="ppc64le">
  <version epoch="0" ver="0.9.13.1" rel="4.12.1"/>
  <changelog author="fezhang@suse.com" date="1537963200">- Update to version 0.9.8
  + New features
  - Add TLSv1.3 support #1193
  + Deprecation notice
  - TLSv1 and TLSv1.1 are removed from the default config.
    Current default is TLSv1.2 and TLSv1.3
  + Bug fixes
  - Ensure unmount redirected drive on fatal X error #1140
  + Other changes
  - Pulseaudio modules has been removed from xrdp source tree
  - Pass pulse socket name via environment variable #1198
- Update xrdp-fate318398-change-expired-password.patch: Use
  configured values instead of hardcoded ones in login_wnd inputs</changelog>
  <changelog author="fezhang@suse.com" date="1545912000">- Update to version 0.9.9
  + New features
  - Disconnection by idle timeout (requires xorgxrdp v0.2.9 or
    later) #1227
  + Bug fixes
  - Fix xrdp-chansrv crashes caused in drive redirection #1202
    [#1225]
  - Fix build with FDK AAC v2 #1257
  - Do not enable RemoteApp if the INFO_RAIL flag is not set
    (RDP-RDP proxy) #1253
  + Other changes
  - Add Spanish Latin Amarican keyboard #1237 #1240 #1244
  - Dynamic channel improvements #1222 #1224
  - Remove some deprecated sesman session types #1232
  - Refactoring and cleanups
  + Known issues
  - FreeRDP 2.0.0-rc4 or later might not able to connect to xrdp
    due to xrdp's bad-mannered behaviour, add `+glyph-cache`
    option to FreeRDP to connect #1266
  - Audio redirection by MP3 codec doesn't sound with some
    client, use AAC instead #965
  + Refresh xrdp-default-config.patch</changelog>
  <changelog author="fezhang@suse.com" date="1556539200">- Update to version 0.9.10 (jsc#SLE-5926)
  + New features
  - Restrict outbound (server-&gt;client) clipboard transfer,
    configured in `sesman.ini` #1298
  + Bug fixes
  - Fix libscp v1 not setting width but height twice #1293
  - Fix reconnecting to session causes duplicate drive entries
    in fuse fs #1299
  - Fix default_wm and reconnect_sh refer wrong path after sesman
    caught SIGUP #1315 #1331
  - Shutdown xrdp more responsively #1325
  - Improve remote file lookup in drive redirection #996 #1327
  - Overwriting &amp; appending to existing files now supported #1327
  + Other changes
  - Add Danish Keyboard #1290
  - Put xrdp- prefix to some executables appear in man page #1313
  - Replace some URLs from SF.net to xrdp.org #1313
  + Known issues
  - FreeRDP 2.0.0-rc4 or later might not able to connect to xrdp
    due to xrdp's bad-mannered behaviour, add `+glyph-cache`
    option to FreeRDP to connect #1266
  - Audio redirection by MP3 codec doesn't sound with some
    client, use AAC instead #965</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1564142400">- Removal of SuSEfirewall2 service, since SuSEfirewall2 has been
  replaced by firewalld, see:
  https://lists.opensuse.org/opensuse-factory/2019-01/msg00490.html</changelog>
  <changelog author="fezhang@suse.com" date="1565006400">- Update xrdp-pam.patch: Include the pam_keyinit.so module in
  /etc/pam.d/xrdp-sesman to support the kernel keyrings
  (boo#1144064).</changelog>
  <changelog author="fezhang@suse.com" date="1568116800">- Add xrdp-systemd-services.patch: Let systemd handle the daemons,
  fix daemon start failures (boo#1138954, boo#1144327).</changelog>
  <changelog author="fezhang@suse.com" date="1568635200">- Update to version 0.9.11 (jsc#SLE-9612)
  + New features
  - Suppress output (do not draw screen when client window is
    minimized) #1330
  - Audio input (microphone) redirection compatible with
    MS-RDPEAI #1369
  - Now xrdp can listen on more than one port #1124 #1366
  + Bug fixes
  - Fix the issue audio redirection sometimes sounds with long
    delay #1363
  - Check term event for more responsive shutdown #1372
  + Known issues
  - FreeRDP 2.0.0-rc4 or later might not able to connect to xrdp
    due to xrdp's bad-mannered behaviour, add +glyph-cache option
    to FreeRDP to connect #1266
  - Audio redirection by MP3 codec doesn't sound with some
    client, use AAC instead #965
- Rebase xrdp-avahi.diff, worked around stdint.h definitions
- Rebase xrdp-fate319683-allow-vnc-resizing.patch</changelog>
  <changelog author="yfjiang@suse.com" date="1573646400">- Make mkpamrules additionally support SUSE's usage of
  /usr/etc/pam.d (boo#1156094, gh#neutrinolabs/xrdp!1442):
  * xrdp-mkpamrules-support-usr-etc-distconfdir.patch
  https://lists.opensuse.org/opensuse-factory/2019-08/msg00113.html</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1581163200">- Build with --enable-vsock so xrdp can be used with hyper-v
  enhanced session mode.</changelog>
  <changelog author="fzhang.foss@gmail.com" date="1583928000">- Update xrdp-avahi.diff: Fix implicit definitions errors.</changelog>
  <changelog author="fzhang.foss@gmail.com" date="1584014400">- Update to version 0.9.13
  + Bug fixes: some regressions on drive redirection #1469 #1487
    [#1505] #1507
  + Support mousex button 8/9 #1478
- Update to version 0.9.12
  + Bug fixes
  - Fix "The log reference is NULL" error when sesman startup
    [#1425]
  - Fix behavior when shmem_id changes #1439
  - Make vsock config accept -1 for cid and port #1441
  - Cleanup refresh rect and check stream bounds #1437
  - Significant improvements in drive redirection #1449
  + Other changes
  - Proprietary microphone redirection via rdpsnd is now default
    off RDP compatible microphone redirection is on instead #1427
  - Skip connecting to chansrv when no channels enabled #1393
  - Add openSUSE's pam rules (boo#1156094, #1442)
  - Do not terminate xrdp daemon when caught SIGHUP #1319
- Known issues
  + FreeRDP 2.0.0-rc4 or later might not able to connect to xrdp
    due to xrdp's bad-mannered behaviour, add `+glyph-cache` option
    to FreeRDP to connect #1266
  + Audio redirection by MP3 codec doesn't sound with some client,
    use AAC instead #965
- Drop xrdp-mkpamrules-support-usr-etc-distconfdir.patch: Fixed
  upstream</changelog>
  <changelog author="qkzhu@suse.com" date="1585051200">- Update xrdp-bsc965647-allow-admin-choose-desktop.patch:
  Add `export XDG_SESSION_TYPE=x11` in startwm.sh for SLE, since
  lacking this variable in GNOME 3.34 causes GNOME crash (bsc#1159257).</changelog>
  <changelog author="qkzhu@suse.com" date="1585051201">- Update xrdp-bsc965647-allow-admin-choose-desktop.patch:
  + Set the default session to GNOME Session for SLE.
  + Update the variables to launch SLE-Classic Session.
  (bsc#1166746).</changelog>
  <changelog author="yfjiang@suse.com" date="1587729600">- Enable SLE only patches for Leap (jsc#SLE-11850).</changelog>
  <changelog author="dimstar@opensuse.org" date="1592395200">- Use %{_libexecdir} to install the legacy initscript actions to.</changelog>
  <changelog author="yfjiang@suse.com" date="1593691200">- Update to version 0.9.13.1
  + This is a security fix release that includes fixes for the
    following local buffer overflow vulnerability (bsc#1173580):
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-4044
- Rebase xrdp-fate318398-change-expired-password.patch</changelog>
  <changelog author="yfjiang@suse.com" date="1594382400">- Update xrdp.keyring according to:
  https://github.com/neutrinolabs/xrdp/issues/1627</changelog>
  <changelog author="yfjiang@suse.com" date="1597147200">- Update xrdp-bsc965647-allow-admin-choose-desktop.patch:
  + Fallback the session to icewm when a selected desktop
    environment is not found (bsc#1171415)
  + Support plasma session for Leap 15.2
  + Give more informative comments in start_wm.sh</changelog>
  <changelog author="yfjiang@suse.com" date="1604923200">- Introduce more buffer protection fixes (jsc#SLE-11518):
  + Add xrdp-memory-allocation-security-fix.patch
  + Add xrdp-remove-unecessary-gmalloc.patch
  + Add xrdp-safe-data-chunk-reassembly.patch
- Make the serial number of SLE patches on the bottom</changelog>
  <changelog author="yu.daike@suse.com" date="1628596800">- Fix crash in xrdp-fate318398-change-expired-password.patch (bsc#1187258)</changelog>
</package>
<package pkgid="d84047f1714d9d8796d62da8aceaf6400f911f7ece8fdbcc2fec3f72a6a6b2ce" name="librfxencode0" arch="s390x">
  <version epoch="0" ver="0.9.13.1" rel="4.12.1"/>
  <changelog author="fezhang@suse.com" date="1537963200">- Update to version 0.9.8
  + New features
  - Add TLSv1.3 support #1193
  + Deprecation notice
  - TLSv1 and TLSv1.1 are removed from the default config.
    Current default is TLSv1.2 and TLSv1.3
  + Bug fixes
  - Ensure unmount redirected drive on fatal X error #1140
  + Other changes
  - Pulseaudio modules has been removed from xrdp source tree
  - Pass pulse socket name via environment variable #1198
- Update xrdp-fate318398-change-expired-password.patch: Use
  configured values instead of hardcoded ones in login_wnd inputs</changelog>
  <changelog author="fezhang@suse.com" date="1545912000">- Update to version 0.9.9
  + New features
  - Disconnection by idle timeout (requires xorgxrdp v0.2.9 or
    later) #1227
  + Bug fixes
  - Fix xrdp-chansrv crashes caused in drive redirection #1202
    [#1225]
  - Fix build with FDK AAC v2 #1257
  - Do not enable RemoteApp if the INFO_RAIL flag is not set
    (RDP-RDP proxy) #1253
  + Other changes
  - Add Spanish Latin Amarican keyboard #1237 #1240 #1244
  - Dynamic channel improvements #1222 #1224
  - Remove some deprecated sesman session types #1232
  - Refactoring and cleanups
  + Known issues
  - FreeRDP 2.0.0-rc4 or later might not able to connect to xrdp
    due to xrdp's bad-mannered behaviour, add `+glyph-cache`
    option to FreeRDP to connect #1266
  - Audio redirection by MP3 codec doesn't sound with some
    client, use AAC instead #965
  + Refresh xrdp-default-config.patch</changelog>
  <changelog author="fezhang@suse.com" date="1556539200">- Update to version 0.9.10 (jsc#SLE-5926)
  + New features
  - Restrict outbound (server-&gt;client) clipboard transfer,
    configured in `sesman.ini` #1298
  + Bug fixes
  - Fix libscp v1 not setting width but height twice #1293
  - Fix reconnecting to session causes duplicate drive entries
    in fuse fs #1299
  - Fix default_wm and reconnect_sh refer wrong path after sesman
    caught SIGUP #1315 #1331
  - Shutdown xrdp more responsively #1325
  - Improve remote file lookup in drive redirection #996 #1327
  - Overwriting &amp; appending to existing files now supported #1327
  + Other changes
  - Add Danish Keyboard #1290
  - Put xrdp- prefix to some executables appear in man page #1313
  - Replace some URLs from SF.net to xrdp.org #1313
  + Known issues
  - FreeRDP 2.0.0-rc4 or later might not able to connect to xrdp
    due to xrdp's bad-mannered behaviour, add `+glyph-cache`
    option to FreeRDP to connect #1266
  - Audio redirection by MP3 codec doesn't sound with some
    client, use AAC instead #965</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1564142400">- Removal of SuSEfirewall2 service, since SuSEfirewall2 has been
  replaced by firewalld, see:
  https://lists.opensuse.org/opensuse-factory/2019-01/msg00490.html</changelog>
  <changelog author="fezhang@suse.com" date="1565006400">- Update xrdp-pam.patch: Include the pam_keyinit.so module in
  /etc/pam.d/xrdp-sesman to support the kernel keyrings
  (boo#1144064).</changelog>
  <changelog author="fezhang@suse.com" date="1568116800">- Add xrdp-systemd-services.patch: Let systemd handle the daemons,
  fix daemon start failures (boo#1138954, boo#1144327).</changelog>
  <changelog author="fezhang@suse.com" date="1568635200">- Update to version 0.9.11 (jsc#SLE-9612)
  + New features
  - Suppress output (do not draw screen when client window is
    minimized) #1330
  - Audio input (microphone) redirection compatible with
    MS-RDPEAI #1369
  - Now xrdp can listen on more than one port #1124 #1366
  + Bug fixes
  - Fix the issue audio redirection sometimes sounds with long
    delay #1363
  - Check term event for more responsive shutdown #1372
  + Known issues
  - FreeRDP 2.0.0-rc4 or later might not able to connect to xrdp
    due to xrdp's bad-mannered behaviour, add +glyph-cache option
    to FreeRDP to connect #1266
  - Audio redirection by MP3 codec doesn't sound with some
    client, use AAC instead #965
- Rebase xrdp-avahi.diff, worked around stdint.h definitions
- Rebase xrdp-fate319683-allow-vnc-resizing.patch</changelog>
  <changelog author="yfjiang@suse.com" date="1573646400">- Make mkpamrules additionally support SUSE's usage of
  /usr/etc/pam.d (boo#1156094, gh#neutrinolabs/xrdp!1442):
  * xrdp-mkpamrules-support-usr-etc-distconfdir.patch
  https://lists.opensuse.org/opensuse-factory/2019-08/msg00113.html</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1581163200">- Build with --enable-vsock so xrdp can be used with hyper-v
  enhanced session mode.</changelog>
  <changelog author="fzhang.foss@gmail.com" date="1583928000">- Update xrdp-avahi.diff: Fix implicit definitions errors.</changelog>
  <changelog author="fzhang.foss@gmail.com" date="1584014400">- Update to version 0.9.13
  + Bug fixes: some regressions on drive redirection #1469 #1487
    [#1505] #1507
  + Support mousex button 8/9 #1478
- Update to version 0.9.12
  + Bug fixes
  - Fix "The log reference is NULL" error when sesman startup
    [#1425]
  - Fix behavior when shmem_id changes #1439
  - Make vsock config accept -1 for cid and port #1441
  - Cleanup refresh rect and check stream bounds #1437
  - Significant improvements in drive redirection #1449
  + Other changes
  - Proprietary microphone redirection via rdpsnd is now default
    off RDP compatible microphone redirection is on instead #1427
  - Skip connecting to chansrv when no channels enabled #1393
  - Add openSUSE's pam rules (boo#1156094, #1442)
  - Do not terminate xrdp daemon when caught SIGHUP #1319
- Known issues
  + FreeRDP 2.0.0-rc4 or later might not able to connect to xrdp
    due to xrdp's bad-mannered behaviour, add `+glyph-cache` option
    to FreeRDP to connect #1266
  + Audio redirection by MP3 codec doesn't sound with some client,
    use AAC instead #965
- Drop xrdp-mkpamrules-support-usr-etc-distconfdir.patch: Fixed
  upstream</changelog>
  <changelog author="qkzhu@suse.com" date="1585051200">- Update xrdp-bsc965647-allow-admin-choose-desktop.patch:
  Add `export XDG_SESSION_TYPE=x11` in startwm.sh for SLE, since
  lacking this variable in GNOME 3.34 causes GNOME crash (bsc#1159257).</changelog>
  <changelog author="qkzhu@suse.com" date="1585051201">- Update xrdp-bsc965647-allow-admin-choose-desktop.patch:
  + Set the default session to GNOME Session for SLE.
  + Update the variables to launch SLE-Classic Session.
  (bsc#1166746).</changelog>
  <changelog author="yfjiang@suse.com" date="1587729600">- Enable SLE only patches for Leap (jsc#SLE-11850).</changelog>
  <changelog author="dimstar@opensuse.org" date="1592395200">- Use %{_libexecdir} to install the legacy initscript actions to.</changelog>
  <changelog author="yfjiang@suse.com" date="1593691200">- Update to version 0.9.13.1
  + This is a security fix release that includes fixes for the
    following local buffer overflow vulnerability (bsc#1173580):
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-4044
- Rebase xrdp-fate318398-change-expired-password.patch</changelog>
  <changelog author="yfjiang@suse.com" date="1594382400">- Update xrdp.keyring according to:
  https://github.com/neutrinolabs/xrdp/issues/1627</changelog>
  <changelog author="yfjiang@suse.com" date="1597147200">- Update xrdp-bsc965647-allow-admin-choose-desktop.patch:
  + Fallback the session to icewm when a selected desktop
    environment is not found (bsc#1171415)
  + Support plasma session for Leap 15.2
  + Give more informative comments in start_wm.sh</changelog>
  <changelog author="yfjiang@suse.com" date="1604923200">- Introduce more buffer protection fixes (jsc#SLE-11518):
  + Add xrdp-memory-allocation-security-fix.patch
  + Add xrdp-remove-unecessary-gmalloc.patch
  + Add xrdp-safe-data-chunk-reassembly.patch
- Make the serial number of SLE patches on the bottom</changelog>
  <changelog author="yu.daike@suse.com" date="1628596800">- Fix crash in xrdp-fate318398-change-expired-password.patch (bsc#1187258)</changelog>
</package>
<package pkgid="0309946b28e1008df582c92c73949e3090ffdb1c2227bd91cb82fce8aa09f258" name="librfxencode0" arch="x86_64">
  <version epoch="0" ver="0.9.13.1" rel="4.12.1"/>
  <changelog author="fezhang@suse.com" date="1537963200">- Update to version 0.9.8
  + New features
  - Add TLSv1.3 support #1193
  + Deprecation notice
  - TLSv1 and TLSv1.1 are removed from the default config.
    Current default is TLSv1.2 and TLSv1.3
  + Bug fixes
  - Ensure unmount redirected drive on fatal X error #1140
  + Other changes
  - Pulseaudio modules has been removed from xrdp source tree
  - Pass pulse socket name via environment variable #1198
- Update xrdp-fate318398-change-expired-password.patch: Use
  configured values instead of hardcoded ones in login_wnd inputs</changelog>
  <changelog author="fezhang@suse.com" date="1545912000">- Update to version 0.9.9
  + New features
  - Disconnection by idle timeout (requires xorgxrdp v0.2.9 or
    later) #1227
  + Bug fixes
  - Fix xrdp-chansrv crashes caused in drive redirection #1202
    [#1225]
  - Fix build with FDK AAC v2 #1257
  - Do not enable RemoteApp if the INFO_RAIL flag is not set
    (RDP-RDP proxy) #1253
  + Other changes
  - Add Spanish Latin Amarican keyboard #1237 #1240 #1244
  - Dynamic channel improvements #1222 #1224
  - Remove some deprecated sesman session types #1232
  - Refactoring and cleanups
  + Known issues
  - FreeRDP 2.0.0-rc4 or later might not able to connect to xrdp
    due to xrdp's bad-mannered behaviour, add `+glyph-cache`
    option to FreeRDP to connect #1266
  - Audio redirection by MP3 codec doesn't sound with some
    client, use AAC instead #965
  + Refresh xrdp-default-config.patch</changelog>
  <changelog author="fezhang@suse.com" date="1556539200">- Update to version 0.9.10 (jsc#SLE-5926)
  + New features
  - Restrict outbound (server-&gt;client) clipboard transfer,
    configured in `sesman.ini` #1298
  + Bug fixes
  - Fix libscp v1 not setting width but height twice #1293
  - Fix reconnecting to session causes duplicate drive entries
    in fuse fs #1299
  - Fix default_wm and reconnect_sh refer wrong path after sesman
    caught SIGUP #1315 #1331
  - Shutdown xrdp more responsively #1325
  - Improve remote file lookup in drive redirection #996 #1327
  - Overwriting &amp; appending to existing files now supported #1327
  + Other changes
  - Add Danish Keyboard #1290
  - Put xrdp- prefix to some executables appear in man page #1313
  - Replace some URLs from SF.net to xrdp.org #1313
  + Known issues
  - FreeRDP 2.0.0-rc4 or later might not able to connect to xrdp
    due to xrdp's bad-mannered behaviour, add `+glyph-cache`
    option to FreeRDP to connect #1266
  - Audio redirection by MP3 codec doesn't sound with some
    client, use AAC instead #965</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1564142400">- Removal of SuSEfirewall2 service, since SuSEfirewall2 has been
  replaced by firewalld, see:
  https://lists.opensuse.org/opensuse-factory/2019-01/msg00490.html</changelog>
  <changelog author="fezhang@suse.com" date="1565006400">- Update xrdp-pam.patch: Include the pam_keyinit.so module in
  /etc/pam.d/xrdp-sesman to support the kernel keyrings
  (boo#1144064).</changelog>
  <changelog author="fezhang@suse.com" date="1568116800">- Add xrdp-systemd-services.patch: Let systemd handle the daemons,
  fix daemon start failures (boo#1138954, boo#1144327).</changelog>
  <changelog author="fezhang@suse.com" date="1568635200">- Update to version 0.9.11 (jsc#SLE-9612)
  + New features
  - Suppress output (do not draw screen when client window is
    minimized) #1330
  - Audio input (microphone) redirection compatible with
    MS-RDPEAI #1369
  - Now xrdp can listen on more than one port #1124 #1366
  + Bug fixes
  - Fix the issue audio redirection sometimes sounds with long
    delay #1363
  - Check term event for more responsive shutdown #1372
  + Known issues
  - FreeRDP 2.0.0-rc4 or later might not able to connect to xrdp
    due to xrdp's bad-mannered behaviour, add +glyph-cache option
    to FreeRDP to connect #1266
  - Audio redirection by MP3 codec doesn't sound with some
    client, use AAC instead #965
- Rebase xrdp-avahi.diff, worked around stdint.h definitions
- Rebase xrdp-fate319683-allow-vnc-resizing.patch</changelog>
  <changelog author="yfjiang@suse.com" date="1573646400">- Make mkpamrules additionally support SUSE's usage of
  /usr/etc/pam.d (boo#1156094, gh#neutrinolabs/xrdp!1442):
  * xrdp-mkpamrules-support-usr-etc-distconfdir.patch
  https://lists.opensuse.org/opensuse-factory/2019-08/msg00113.html</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1581163200">- Build with --enable-vsock so xrdp can be used with hyper-v
  enhanced session mode.</changelog>
  <changelog author="fzhang.foss@gmail.com" date="1583928000">- Update xrdp-avahi.diff: Fix implicit definitions errors.</changelog>
  <changelog author="fzhang.foss@gmail.com" date="1584014400">- Update to version 0.9.13
  + Bug fixes: some regressions on drive redirection #1469 #1487
    [#1505] #1507
  + Support mousex button 8/9 #1478
- Update to version 0.9.12
  + Bug fixes
  - Fix "The log reference is NULL" error when sesman startup
    [#1425]
  - Fix behavior when shmem_id changes #1439
  - Make vsock config accept -1 for cid and port #1441
  - Cleanup refresh rect and check stream bounds #1437
  - Significant improvements in drive redirection #1449
  + Other changes
  - Proprietary microphone redirection via rdpsnd is now default
    off RDP compatible microphone redirection is on instead #1427
  - Skip connecting to chansrv when no channels enabled #1393
  - Add openSUSE's pam rules (boo#1156094, #1442)
  - Do not terminate xrdp daemon when caught SIGHUP #1319
- Known issues
  + FreeRDP 2.0.0-rc4 or later might not able to connect to xrdp
    due to xrdp's bad-mannered behaviour, add `+glyph-cache` option
    to FreeRDP to connect #1266
  + Audio redirection by MP3 codec doesn't sound with some client,
    use AAC instead #965
- Drop xrdp-mkpamrules-support-usr-etc-distconfdir.patch: Fixed
  upstream</changelog>
  <changelog author="qkzhu@suse.com" date="1585051200">- Update xrdp-bsc965647-allow-admin-choose-desktop.patch:
  Add `export XDG_SESSION_TYPE=x11` in startwm.sh for SLE, since
  lacking this variable in GNOME 3.34 causes GNOME crash (bsc#1159257).</changelog>
  <changelog author="qkzhu@suse.com" date="1585051201">- Update xrdp-bsc965647-allow-admin-choose-desktop.patch:
  + Set the default session to GNOME Session for SLE.
  + Update the variables to launch SLE-Classic Session.
  (bsc#1166746).</changelog>
  <changelog author="yfjiang@suse.com" date="1587729600">- Enable SLE only patches for Leap (jsc#SLE-11850).</changelog>
  <changelog author="dimstar@opensuse.org" date="1592395200">- Use %{_libexecdir} to install the legacy initscript actions to.</changelog>
  <changelog author="yfjiang@suse.com" date="1593691200">- Update to version 0.9.13.1
  + This is a security fix release that includes fixes for the
    following local buffer overflow vulnerability (bsc#1173580):
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-4044
- Rebase xrdp-fate318398-change-expired-password.patch</changelog>
  <changelog author="yfjiang@suse.com" date="1594382400">- Update xrdp.keyring according to:
  https://github.com/neutrinolabs/xrdp/issues/1627</changelog>
  <changelog author="yfjiang@suse.com" date="1597147200">- Update xrdp-bsc965647-allow-admin-choose-desktop.patch:
  + Fallback the session to icewm when a selected desktop
    environment is not found (bsc#1171415)
  + Support plasma session for Leap 15.2
  + Give more informative comments in start_wm.sh</changelog>
  <changelog author="yfjiang@suse.com" date="1604923200">- Introduce more buffer protection fixes (jsc#SLE-11518):
  + Add xrdp-memory-allocation-security-fix.patch
  + Add xrdp-remove-unecessary-gmalloc.patch
  + Add xrdp-safe-data-chunk-reassembly.patch
- Make the serial number of SLE patches on the bottom</changelog>
  <changelog author="yu.daike@suse.com" date="1628596800">- Fix crash in xrdp-fate318398-change-expired-password.patch (bsc#1187258)</changelog>
</package>
<package pkgid="ae933121b91973f5dae10bb6c039c34965be83d682d742fc20909918ba0f0655" name="libsamba-policy-python-devel" arch="aarch64">
  <version epoch="0" ver="4.9.5+git.483.212a7ebca6b" rel="3.64.1"/>
  <changelog author="nopower@suse.com" date="1584705600">- Fix CLI tools still printing "Unable to initialize messaging
  context" messages; (bso#13925); (bsc#1167070).
- Do print mkdir failure message on error debug level when
  initializing messaging; (bso#13823); (bsc#1167070).</changelog>
  <changelog author="dmulder@suse.com" date="1586865600">- Fix spnego fallback from kerberos to ntlmssp in smbd server;
  (bso#14106); (bsc#1169473);</changelog>
  <changelog author="nopower@suse.com" date="1587556800">- CVE-2020-10704: samba: Stack overflow in AD DC (C)LDAP server;
  (bso#14334); (bsc#1169851).</changelog>
  <changelog author="scabrero@suse.de" date="1589457600">- Installing: samba - samba-ad-dc.service does not exist and unit
  not found; (bsc#1171437);</changelog>
  <changelog author="scabrero@suse.de" date="1591012800">- Add libnetapi-devel to baselibs conf, for wine usage; (bsc#1172307);</changelog>
  <changelog author="nopower@suse.com" date="1592827200">- CVE-2020-10730: NULL de-reference in AD DC LDAP server when ASQ
  and VLV combined; (bso#14364); (bsc#1173159].
- CVE-2020-10745: invalid DNS or NBT queries containing dots use
  several seconds of CPU each; (bso#14378); (bsc#1173160).
- CVE-2020-10760: Use-after-free in AD DC Global Catalog LDAP server
  with paged_result or VLV; (bso#14402); (bsc#1173161).</changelog>
  <changelog author="nopower@suse.com" date="1593086400">- CVE-2020-14303: Endless loop from empty UDP packet sent to AD DC
  nbt_server; (bso#14417); (bsc#1173359).</changelog>
  <changelog author="dmulder@suse.com" date="1594728000">- Fix net command unable to negotiate SMB2; (bsc#1174120);</changelog>
  <changelog author="scabrero@suse.de" date="1595851200">- Add obsoletes to libsmbldap2 package to fix upgrades from previous
  versions; (bsc#1172810);</changelog>
  <changelog author="scabrero@suse.de" date="1600430400">- CVE-2020-1472: Unauthenticated domain takeover via netlogon ("ZeroLogon").
  + s3:rpc_server/netlogon: Protect netr_ServerPasswordSet2 against
    unencrypted passwords; (bsc#1176579); (bso#14497);
  + s3:rpc_server/netlogon: Support "server require schannel:WORKSTATION$ = no"
    about unsecure configurations; (bsc#1176579); (bso#14497);
  + s4 torture rpc: repeated bytes in client challenge; (bsc#1176579);
    (bso#14497);
  + libcli/auth: Reject weak client challenges in netlogon_creds_server_init()
    "server require schannel:WORKSTATION$ = no"; (bsc#1176579); (bso#14497);</changelog>
  <changelog author="scabrero@suse.de" date="1602590400">- CVE-2020-14383: An authenticated user can crash the DCE/RPC DNS with
  easily crafted records; (bsc#1177613); (bso#14472);
- CVE-2020-14323: Unprivileged user can crash winbind; (bsc#1173994);
  (bso#14436);
- CVE-2020-14318: Missing handle permissions check in SMB1/2/3 ChangeNotify;
  (bsc#1173902); (bso#14434);</changelog>
  <changelog author="nopower@suse.com" date="1604577600">- Adjust smbcacls '--propagate-inheritance' feature to align with
  upstream; (bsc#1178469).</changelog>
  <changelog author="nopower@suse.com" date="1612440000">- Avoid free'ing our own pointer in memcache when memcache_trim
  attempts to reduce cache size; (bso#14625); (bnc#1179156).</changelog>
  <changelog author="nopower@suse.com" date="1615896000">-  CVE-2020-27840: samba: Unauthenticated remote heap corruption
  via bad DNs; (bso#14595); (bsc#1183572).
-  CVE-2021-20277: samba: out of bounds read in ldb_handler_fold;
  (bso#14655); (bsc#1183574).</changelog>
  <changelog author="dmulder@suse.com" date="1616760000">- s3-libads: use dns name to open a ldap session; (bso#13124);
  (bsc#1184310).</changelog>
  <changelog author="nopower@suse.com" date="1618401600">- CVE-2021-20254 Buffer overrun in sids_to_unixids();
  (bso#14571); (bsc#1184677).</changelog>
  <changelog author="scabrero@suse.de" date="1621598400">- s3-libads: Do not turn on canonicalization flag. Fixes a regression
  changing the computer account password; (bsc#1185089); (bso#14155);</changelog>
  <changelog author="scabrero@suse.de" date="1636372800">- CVE-2016-2124: Don't fallback to non spnego authentication if
  kerberos is required; (bsc#1014440); (bso#12444);
- CVE-2020-25717: A user in an AD Domain could become root on
  domain members; (bsc#1192284); (bso#14556);</changelog>
  <changelog author="nopower@suse.com" date="1637236800">- The username map [script] advice from CVE-2020-25717 advisory
  note has undesired side effects for the local nt token. Fallback
  to a SID/UID based mapping if the name based lookup fails;
  (bsc#1192849); (bso#14901).</changelog>
  <changelog author="nopower@suse.com" date="1642766400">- CVE-2021-44142: Out-of-Bound Read/Write on Samba vfs_fruit
  module; (bsc#1194859); (bso#14914).</changelog>
</package>
<package pkgid="119758f2b23b15a6b62b94851484e8e8781d0b614778179497ebd10925806618" name="libsamba-policy-python-devel" arch="ppc64le">
  <version epoch="0" ver="4.9.5+git.483.212a7ebca6b" rel="3.64.1"/>
  <changelog author="nopower@suse.com" date="1584705600">- Fix CLI tools still printing "Unable to initialize messaging
  context" messages; (bso#13925); (bsc#1167070).
- Do print mkdir failure message on error debug level when
  initializing messaging; (bso#13823); (bsc#1167070).</changelog>
  <changelog author="dmulder@suse.com" date="1586865600">- Fix spnego fallback from kerberos to ntlmssp in smbd server;
  (bso#14106); (bsc#1169473);</changelog>
  <changelog author="nopower@suse.com" date="1587556800">- CVE-2020-10704: samba: Stack overflow in AD DC (C)LDAP server;
  (bso#14334); (bsc#1169851).</changelog>
  <changelog author="scabrero@suse.de" date="1589457600">- Installing: samba - samba-ad-dc.service does not exist and unit
  not found; (bsc#1171437);</changelog>
  <changelog author="scabrero@suse.de" date="1591012800">- Add libnetapi-devel to baselibs conf, for wine usage; (bsc#1172307);</changelog>
  <changelog author="nopower@suse.com" date="1592827200">- CVE-2020-10730: NULL de-reference in AD DC LDAP server when ASQ
  and VLV combined; (bso#14364); (bsc#1173159].
- CVE-2020-10745: invalid DNS or NBT queries containing dots use
  several seconds of CPU each; (bso#14378); (bsc#1173160).
- CVE-2020-10760: Use-after-free in AD DC Global Catalog LDAP server
  with paged_result or VLV; (bso#14402); (bsc#1173161).</changelog>
  <changelog author="nopower@suse.com" date="1593086400">- CVE-2020-14303: Endless loop from empty UDP packet sent to AD DC
  nbt_server; (bso#14417); (bsc#1173359).</changelog>
  <changelog author="dmulder@suse.com" date="1594728000">- Fix net command unable to negotiate SMB2; (bsc#1174120);</changelog>
  <changelog author="scabrero@suse.de" date="1595851200">- Add obsoletes to libsmbldap2 package to fix upgrades from previous
  versions; (bsc#1172810);</changelog>
  <changelog author="scabrero@suse.de" date="1600430400">- CVE-2020-1472: Unauthenticated domain takeover via netlogon ("ZeroLogon").
  + s3:rpc_server/netlogon: Protect netr_ServerPasswordSet2 against
    unencrypted passwords; (bsc#1176579); (bso#14497);
  + s3:rpc_server/netlogon: Support "server require schannel:WORKSTATION$ = no"
    about unsecure configurations; (bsc#1176579); (bso#14497);
  + s4 torture rpc: repeated bytes in client challenge; (bsc#1176579);
    (bso#14497);
  + libcli/auth: Reject weak client challenges in netlogon_creds_server_init()
    "server require schannel:WORKSTATION$ = no"; (bsc#1176579); (bso#14497);</changelog>
  <changelog author="scabrero@suse.de" date="1602590400">- CVE-2020-14383: An authenticated user can crash the DCE/RPC DNS with
  easily crafted records; (bsc#1177613); (bso#14472);
- CVE-2020-14323: Unprivileged user can crash winbind; (bsc#1173994);
  (bso#14436);
- CVE-2020-14318: Missing handle permissions check in SMB1/2/3 ChangeNotify;
  (bsc#1173902); (bso#14434);</changelog>
  <changelog author="nopower@suse.com" date="1604577600">- Adjust smbcacls '--propagate-inheritance' feature to align with
  upstream; (bsc#1178469).</changelog>
  <changelog author="nopower@suse.com" date="1612440000">- Avoid free'ing our own pointer in memcache when memcache_trim
  attempts to reduce cache size; (bso#14625); (bnc#1179156).</changelog>
  <changelog author="nopower@suse.com" date="1615896000">-  CVE-2020-27840: samba: Unauthenticated remote heap corruption
  via bad DNs; (bso#14595); (bsc#1183572).
-  CVE-2021-20277: samba: out of bounds read in ldb_handler_fold;
  (bso#14655); (bsc#1183574).</changelog>
  <changelog author="dmulder@suse.com" date="1616760000">- s3-libads: use dns name to open a ldap session; (bso#13124);
  (bsc#1184310).</changelog>
  <changelog author="nopower@suse.com" date="1618401600">- CVE-2021-20254 Buffer overrun in sids_to_unixids();
  (bso#14571); (bsc#1184677).</changelog>
  <changelog author="scabrero@suse.de" date="1621598400">- s3-libads: Do not turn on canonicalization flag. Fixes a regression
  changing the computer account password; (bsc#1185089); (bso#14155);</changelog>
  <changelog author="scabrero@suse.de" date="1636372800">- CVE-2016-2124: Don't fallback to non spnego authentication if
  kerberos is required; (bsc#1014440); (bso#12444);
- CVE-2020-25717: A user in an AD Domain could become root on
  domain members; (bsc#1192284); (bso#14556);</changelog>
  <changelog author="nopower@suse.com" date="1637236800">- The username map [script] advice from CVE-2020-25717 advisory
  note has undesired side effects for the local nt token. Fallback
  to a SID/UID based mapping if the name based lookup fails;
  (bsc#1192849); (bso#14901).</changelog>
  <changelog author="nopower@suse.com" date="1642766400">- CVE-2021-44142: Out-of-Bound Read/Write on Samba vfs_fruit
  module; (bsc#1194859); (bso#14914).</changelog>
</package>
<package pkgid="c848df36724bed0af43c5a44f05e448567b1b29dfa0f7aa4b67e839a68ae4f4e" name="libsamba-policy-python-devel" arch="s390x">
  <version epoch="0" ver="4.9.5+git.483.212a7ebca6b" rel="3.64.1"/>
  <changelog author="nopower@suse.com" date="1584705600">- Fix CLI tools still printing "Unable to initialize messaging
  context" messages; (bso#13925); (bsc#1167070).
- Do print mkdir failure message on error debug level when
  initializing messaging; (bso#13823); (bsc#1167070).</changelog>
  <changelog author="dmulder@suse.com" date="1586865600">- Fix spnego fallback from kerberos to ntlmssp in smbd server;
  (bso#14106); (bsc#1169473);</changelog>
  <changelog author="nopower@suse.com" date="1587556800">- CVE-2020-10704: samba: Stack overflow in AD DC (C)LDAP server;
  (bso#14334); (bsc#1169851).</changelog>
  <changelog author="scabrero@suse.de" date="1589457600">- Installing: samba - samba-ad-dc.service does not exist and unit
  not found; (bsc#1171437);</changelog>
  <changelog author="scabrero@suse.de" date="1591012800">- Add libnetapi-devel to baselibs conf, for wine usage; (bsc#1172307);</changelog>
  <changelog author="nopower@suse.com" date="1592827200">- CVE-2020-10730: NULL de-reference in AD DC LDAP server when ASQ
  and VLV combined; (bso#14364); (bsc#1173159].
- CVE-2020-10745: invalid DNS or NBT queries containing dots use
  several seconds of CPU each; (bso#14378); (bsc#1173160).
- CVE-2020-10760: Use-after-free in AD DC Global Catalog LDAP server
  with paged_result or VLV; (bso#14402); (bsc#1173161).</changelog>
  <changelog author="nopower@suse.com" date="1593086400">- CVE-2020-14303: Endless loop from empty UDP packet sent to AD DC
  nbt_server; (bso#14417); (bsc#1173359).</changelog>
  <changelog author="dmulder@suse.com" date="1594728000">- Fix net command unable to negotiate SMB2; (bsc#1174120);</changelog>
  <changelog author="scabrero@suse.de" date="1595851200">- Add obsoletes to libsmbldap2 package to fix upgrades from previous
  versions; (bsc#1172810);</changelog>
  <changelog author="scabrero@suse.de" date="1600430400">- CVE-2020-1472: Unauthenticated domain takeover via netlogon ("ZeroLogon").
  + s3:rpc_server/netlogon: Protect netr_ServerPasswordSet2 against
    unencrypted passwords; (bsc#1176579); (bso#14497);
  + s3:rpc_server/netlogon: Support "server require schannel:WORKSTATION$ = no"
    about unsecure configurations; (bsc#1176579); (bso#14497);
  + s4 torture rpc: repeated bytes in client challenge; (bsc#1176579);
    (bso#14497);
  + libcli/auth: Reject weak client challenges in netlogon_creds_server_init()
    "server require schannel:WORKSTATION$ = no"; (bsc#1176579); (bso#14497);</changelog>
  <changelog author="scabrero@suse.de" date="1602590400">- CVE-2020-14383: An authenticated user can crash the DCE/RPC DNS with
  easily crafted records; (bsc#1177613); (bso#14472);
- CVE-2020-14323: Unprivileged user can crash winbind; (bsc#1173994);
  (bso#14436);
- CVE-2020-14318: Missing handle permissions check in SMB1/2/3 ChangeNotify;
  (bsc#1173902); (bso#14434);</changelog>
  <changelog author="nopower@suse.com" date="1604577600">- Adjust smbcacls '--propagate-inheritance' feature to align with
  upstream; (bsc#1178469).</changelog>
  <changelog author="nopower@suse.com" date="1612440000">- Avoid free'ing our own pointer in memcache when memcache_trim
  attempts to reduce cache size; (bso#14625); (bnc#1179156).</changelog>
  <changelog author="nopower@suse.com" date="1615896000">-  CVE-2020-27840: samba: Unauthenticated remote heap corruption
  via bad DNs; (bso#14595); (bsc#1183572).
-  CVE-2021-20277: samba: out of bounds read in ldb_handler_fold;
  (bso#14655); (bsc#1183574).</changelog>
  <changelog author="dmulder@suse.com" date="1616760000">- s3-libads: use dns name to open a ldap session; (bso#13124);
  (bsc#1184310).</changelog>
  <changelog author="nopower@suse.com" date="1618401600">- CVE-2021-20254 Buffer overrun in sids_to_unixids();
  (bso#14571); (bsc#1184677).</changelog>
  <changelog author="scabrero@suse.de" date="1621598400">- s3-libads: Do not turn on canonicalization flag. Fixes a regression
  changing the computer account password; (bsc#1185089); (bso#14155);</changelog>
  <changelog author="scabrero@suse.de" date="1636372800">- CVE-2016-2124: Don't fallback to non spnego authentication if
  kerberos is required; (bsc#1014440); (bso#12444);
- CVE-2020-25717: A user in an AD Domain could become root on
  domain members; (bsc#1192284); (bso#14556);</changelog>
  <changelog author="nopower@suse.com" date="1637236800">- The username map [script] advice from CVE-2020-25717 advisory
  note has undesired side effects for the local nt token. Fallback
  to a SID/UID based mapping if the name based lookup fails;
  (bsc#1192849); (bso#14901).</changelog>
  <changelog author="nopower@suse.com" date="1642766400">- CVE-2021-44142: Out-of-Bound Read/Write on Samba vfs_fruit
  module; (bsc#1194859); (bso#14914).</changelog>
</package>
<package pkgid="86f93e264a903ad943cc8dac1ec25614ff1f692721219103e5a7f6f39c35d337" name="libsamba-policy-python-devel" arch="x86_64">
  <version epoch="0" ver="4.9.5+git.483.212a7ebca6b" rel="3.64.1"/>
  <changelog author="nopower@suse.com" date="1584705600">- Fix CLI tools still printing "Unable to initialize messaging
  context" messages; (bso#13925); (bsc#1167070).
- Do print mkdir failure message on error debug level when
  initializing messaging; (bso#13823); (bsc#1167070).</changelog>
  <changelog author="dmulder@suse.com" date="1586865600">- Fix spnego fallback from kerberos to ntlmssp in smbd server;
  (bso#14106); (bsc#1169473);</changelog>
  <changelog author="nopower@suse.com" date="1587556800">- CVE-2020-10704: samba: Stack overflow in AD DC (C)LDAP server;
  (bso#14334); (bsc#1169851).</changelog>
  <changelog author="scabrero@suse.de" date="1589457600">- Installing: samba - samba-ad-dc.service does not exist and unit
  not found; (bsc#1171437);</changelog>
  <changelog author="scabrero@suse.de" date="1591012800">- Add libnetapi-devel to baselibs conf, for wine usage; (bsc#1172307);</changelog>
  <changelog author="nopower@suse.com" date="1592827200">- CVE-2020-10730: NULL de-reference in AD DC LDAP server when ASQ
  and VLV combined; (bso#14364); (bsc#1173159].
- CVE-2020-10745: invalid DNS or NBT queries containing dots use
  several seconds of CPU each; (bso#14378); (bsc#1173160).
- CVE-2020-10760: Use-after-free in AD DC Global Catalog LDAP server
  with paged_result or VLV; (bso#14402); (bsc#1173161).</changelog>
  <changelog author="nopower@suse.com" date="1593086400">- CVE-2020-14303: Endless loop from empty UDP packet sent to AD DC
  nbt_server; (bso#14417); (bsc#1173359).</changelog>
  <changelog author="dmulder@suse.com" date="1594728000">- Fix net command unable to negotiate SMB2; (bsc#1174120);</changelog>
  <changelog author="scabrero@suse.de" date="1595851200">- Add obsoletes to libsmbldap2 package to fix upgrades from previous
  versions; (bsc#1172810);</changelog>
  <changelog author="scabrero@suse.de" date="1600430400">- CVE-2020-1472: Unauthenticated domain takeover via netlogon ("ZeroLogon").
  + s3:rpc_server/netlogon: Protect netr_ServerPasswordSet2 against
    unencrypted passwords; (bsc#1176579); (bso#14497);
  + s3:rpc_server/netlogon: Support "server require schannel:WORKSTATION$ = no"
    about unsecure configurations; (bsc#1176579); (bso#14497);
  + s4 torture rpc: repeated bytes in client challenge; (bsc#1176579);
    (bso#14497);
  + libcli/auth: Reject weak client challenges in netlogon_creds_server_init()
    "server require schannel:WORKSTATION$ = no"; (bsc#1176579); (bso#14497);</changelog>
  <changelog author="scabrero@suse.de" date="1602590400">- CVE-2020-14383: An authenticated user can crash the DCE/RPC DNS with
  easily crafted records; (bsc#1177613); (bso#14472);
- CVE-2020-14323: Unprivileged user can crash winbind; (bsc#1173994);
  (bso#14436);
- CVE-2020-14318: Missing handle permissions check in SMB1/2/3 ChangeNotify;
  (bsc#1173902); (bso#14434);</changelog>
  <changelog author="nopower@suse.com" date="1604577600">- Adjust smbcacls '--propagate-inheritance' feature to align with
  upstream; (bsc#1178469).</changelog>
  <changelog author="nopower@suse.com" date="1612440000">- Avoid free'ing our own pointer in memcache when memcache_trim
  attempts to reduce cache size; (bso#14625); (bnc#1179156).</changelog>
  <changelog author="nopower@suse.com" date="1615896000">-  CVE-2020-27840: samba: Unauthenticated remote heap corruption
  via bad DNs; (bso#14595); (bsc#1183572).
-  CVE-2021-20277: samba: out of bounds read in ldb_handler_fold;
  (bso#14655); (bsc#1183574).</changelog>
  <changelog author="dmulder@suse.com" date="1616760000">- s3-libads: use dns name to open a ldap session; (bso#13124);
  (bsc#1184310).</changelog>
  <changelog author="nopower@suse.com" date="1618401600">- CVE-2021-20254 Buffer overrun in sids_to_unixids();
  (bso#14571); (bsc#1184677).</changelog>
  <changelog author="scabrero@suse.de" date="1621598400">- s3-libads: Do not turn on canonicalization flag. Fixes a regression
  changing the computer account password; (bsc#1185089); (bso#14155);</changelog>
  <changelog author="scabrero@suse.de" date="1636372800">- CVE-2016-2124: Don't fallback to non spnego authentication if
  kerberos is required; (bsc#1014440); (bso#12444);
- CVE-2020-25717: A user in an AD Domain could become root on
  domain members; (bsc#1192284); (bso#14556);</changelog>
  <changelog author="nopower@suse.com" date="1637236800">- The username map [script] advice from CVE-2020-25717 advisory
  note has undesired side effects for the local nt token. Fallback
  to a SID/UID based mapping if the name based lookup fails;
  (bsc#1192849); (bso#14901).</changelog>
  <changelog author="nopower@suse.com" date="1642766400">- CVE-2021-44142: Out-of-Bound Read/Write on Samba vfs_fruit
  module; (bsc#1194859); (bso#14914).</changelog>
</package>
<package pkgid="09c65ca426df7a229879fd747af673fef154e4aa920e403b584f34cd91cfbcc0" name="libsamba-policy0-32bit" arch="x86_64">
  <version epoch="0" ver="4.9.5+git.483.212a7ebca6b" rel="3.64.1"/>
  <changelog author="nopower@suse.com" date="1584705600">- Fix CLI tools still printing "Unable to initialize messaging
  context" messages; (bso#13925); (bsc#1167070).
- Do print mkdir failure message on error debug level when
  initializing messaging; (bso#13823); (bsc#1167070).</changelog>
  <changelog author="dmulder@suse.com" date="1586865600">- Fix spnego fallback from kerberos to ntlmssp in smbd server;
  (bso#14106); (bsc#1169473);</changelog>
  <changelog author="nopower@suse.com" date="1587556800">- CVE-2020-10704: samba: Stack overflow in AD DC (C)LDAP server;
  (bso#14334); (bsc#1169851).</changelog>
  <changelog author="scabrero@suse.de" date="1589457600">- Installing: samba - samba-ad-dc.service does not exist and unit
  not found; (bsc#1171437);</changelog>
  <changelog author="scabrero@suse.de" date="1591012800">- Add libnetapi-devel to baselibs conf, for wine usage; (bsc#1172307);</changelog>
  <changelog author="nopower@suse.com" date="1592827200">- CVE-2020-10730: NULL de-reference in AD DC LDAP server when ASQ
  and VLV combined; (bso#14364); (bsc#1173159].
- CVE-2020-10745: invalid DNS or NBT queries containing dots use
  several seconds of CPU each; (bso#14378); (bsc#1173160).
- CVE-2020-10760: Use-after-free in AD DC Global Catalog LDAP server
  with paged_result or VLV; (bso#14402); (bsc#1173161).</changelog>
  <changelog author="nopower@suse.com" date="1593086400">- CVE-2020-14303: Endless loop from empty UDP packet sent to AD DC
  nbt_server; (bso#14417); (bsc#1173359).</changelog>
  <changelog author="dmulder@suse.com" date="1594728000">- Fix net command unable to negotiate SMB2; (bsc#1174120);</changelog>
  <changelog author="scabrero@suse.de" date="1595851200">- Add obsoletes to libsmbldap2 package to fix upgrades from previous
  versions; (bsc#1172810);</changelog>
  <changelog author="scabrero@suse.de" date="1600430400">- CVE-2020-1472: Unauthenticated domain takeover via netlogon ("ZeroLogon").
  + s3:rpc_server/netlogon: Protect netr_ServerPasswordSet2 against
    unencrypted passwords; (bsc#1176579); (bso#14497);
  + s3:rpc_server/netlogon: Support "server require schannel:WORKSTATION$ = no"
    about unsecure configurations; (bsc#1176579); (bso#14497);
  + s4 torture rpc: repeated bytes in client challenge; (bsc#1176579);
    (bso#14497);
  + libcli/auth: Reject weak client challenges in netlogon_creds_server_init()
    "server require schannel:WORKSTATION$ = no"; (bsc#1176579); (bso#14497);</changelog>
  <changelog author="scabrero@suse.de" date="1602590400">- CVE-2020-14383: An authenticated user can crash the DCE/RPC DNS with
  easily crafted records; (bsc#1177613); (bso#14472);
- CVE-2020-14323: Unprivileged user can crash winbind; (bsc#1173994);
  (bso#14436);
- CVE-2020-14318: Missing handle permissions check in SMB1/2/3 ChangeNotify;
  (bsc#1173902); (bso#14434);</changelog>
  <changelog author="nopower@suse.com" date="1604577600">- Adjust smbcacls '--propagate-inheritance' feature to align with
  upstream; (bsc#1178469).</changelog>
  <changelog author="nopower@suse.com" date="1612440000">- Avoid free'ing our own pointer in memcache when memcache_trim
  attempts to reduce cache size; (bso#14625); (bnc#1179156).</changelog>
  <changelog author="nopower@suse.com" date="1615896000">-  CVE-2020-27840: samba: Unauthenticated remote heap corruption
  via bad DNs; (bso#14595); (bsc#1183572).
-  CVE-2021-20277: samba: out of bounds read in ldb_handler_fold;
  (bso#14655); (bsc#1183574).</changelog>
  <changelog author="dmulder@suse.com" date="1616760000">- s3-libads: use dns name to open a ldap session; (bso#13124);
  (bsc#1184310).</changelog>
  <changelog author="nopower@suse.com" date="1618401600">- CVE-2021-20254 Buffer overrun in sids_to_unixids();
  (bso#14571); (bsc#1184677).</changelog>
  <changelog author="scabrero@suse.de" date="1621598400">- s3-libads: Do not turn on canonicalization flag. Fixes a regression
  changing the computer account password; (bsc#1185089); (bso#14155);</changelog>
  <changelog author="scabrero@suse.de" date="1636372800">- CVE-2016-2124: Don't fallback to non spnego authentication if
  kerberos is required; (bsc#1014440); (bso#12444);
- CVE-2020-25717: A user in an AD Domain could become root on
  domain members; (bsc#1192284); (bso#14556);</changelog>
  <changelog author="nopower@suse.com" date="1637236800">- The username map [script] advice from CVE-2020-25717 advisory
  note has undesired side effects for the local nt token. Fallback
  to a SID/UID based mapping if the name based lookup fails;
  (bsc#1192849); (bso#14901).</changelog>
  <changelog author="nopower@suse.com" date="1642766400">- CVE-2021-44142: Out-of-Bound Read/Write on Samba vfs_fruit
  module; (bsc#1194859); (bso#14914).</changelog>
</package>
<package pkgid="12e558c369537abf0d3d9c1a069e39b3fb7158a02d0aa26c114b832f75ead967" name="libsamba-policy0" arch="aarch64">
  <version epoch="0" ver="4.9.5+git.483.212a7ebca6b" rel="3.64.1"/>
  <changelog author="nopower@suse.com" date="1584705600">- Fix CLI tools still printing "Unable to initialize messaging
  context" messages; (bso#13925); (bsc#1167070).
- Do print mkdir failure message on error debug level when
  initializing messaging; (bso#13823); (bsc#1167070).</changelog>
  <changelog author="dmulder@suse.com" date="1586865600">- Fix spnego fallback from kerberos to ntlmssp in smbd server;
  (bso#14106); (bsc#1169473);</changelog>
  <changelog author="nopower@suse.com" date="1587556800">- CVE-2020-10704: samba: Stack overflow in AD DC (C)LDAP server;
  (bso#14334); (bsc#1169851).</changelog>
  <changelog author="scabrero@suse.de" date="1589457600">- Installing: samba - samba-ad-dc.service does not exist and unit
  not found; (bsc#1171437);</changelog>
  <changelog author="scabrero@suse.de" date="1591012800">- Add libnetapi-devel to baselibs conf, for wine usage; (bsc#1172307);</changelog>
  <changelog author="nopower@suse.com" date="1592827200">- CVE-2020-10730: NULL de-reference in AD DC LDAP server when ASQ
  and VLV combined; (bso#14364); (bsc#1173159].
- CVE-2020-10745: invalid DNS or NBT queries containing dots use
  several seconds of CPU each; (bso#14378); (bsc#1173160).
- CVE-2020-10760: Use-after-free in AD DC Global Catalog LDAP server
  with paged_result or VLV; (bso#14402); (bsc#1173161).</changelog>
  <changelog author="nopower@suse.com" date="1593086400">- CVE-2020-14303: Endless loop from empty UDP packet sent to AD DC
  nbt_server; (bso#14417); (bsc#1173359).</changelog>
  <changelog author="dmulder@suse.com" date="1594728000">- Fix net command unable to negotiate SMB2; (bsc#1174120);</changelog>
  <changelog author="scabrero@suse.de" date="1595851200">- Add obsoletes to libsmbldap2 package to fix upgrades from previous
  versions; (bsc#1172810);</changelog>
  <changelog author="scabrero@suse.de" date="1600430400">- CVE-2020-1472: Unauthenticated domain takeover via netlogon ("ZeroLogon").
  + s3:rpc_server/netlogon: Protect netr_ServerPasswordSet2 against
    unencrypted passwords; (bsc#1176579); (bso#14497);
  + s3:rpc_server/netlogon: Support "server require schannel:WORKSTATION$ = no"
    about unsecure configurations; (bsc#1176579); (bso#14497);
  + s4 torture rpc: repeated bytes in client challenge; (bsc#1176579);
    (bso#14497);
  + libcli/auth: Reject weak client challenges in netlogon_creds_server_init()
    "server require schannel:WORKSTATION$ = no"; (bsc#1176579); (bso#14497);</changelog>
  <changelog author="scabrero@suse.de" date="1602590400">- CVE-2020-14383: An authenticated user can crash the DCE/RPC DNS with
  easily crafted records; (bsc#1177613); (bso#14472);
- CVE-2020-14323: Unprivileged user can crash winbind; (bsc#1173994);
  (bso#14436);
- CVE-2020-14318: Missing handle permissions check in SMB1/2/3 ChangeNotify;
  (bsc#1173902); (bso#14434);</changelog>
  <changelog author="nopower@suse.com" date="1604577600">- Adjust smbcacls '--propagate-inheritance' feature to align with
  upstream; (bsc#1178469).</changelog>
  <changelog author="nopower@suse.com" date="1612440000">- Avoid free'ing our own pointer in memcache when memcache_trim
  attempts to reduce cache size; (bso#14625); (bnc#1179156).</changelog>
  <changelog author="nopower@suse.com" date="1615896000">-  CVE-2020-27840: samba: Unauthenticated remote heap corruption
  via bad DNs; (bso#14595); (bsc#1183572).
-  CVE-2021-20277: samba: out of bounds read in ldb_handler_fold;
  (bso#14655); (bsc#1183574).</changelog>
  <changelog author="dmulder@suse.com" date="1616760000">- s3-libads: use dns name to open a ldap session; (bso#13124);
  (bsc#1184310).</changelog>
  <changelog author="nopower@suse.com" date="1618401600">- CVE-2021-20254 Buffer overrun in sids_to_unixids();
  (bso#14571); (bsc#1184677).</changelog>
  <changelog author="scabrero@suse.de" date="1621598400">- s3-libads: Do not turn on canonicalization flag. Fixes a regression
  changing the computer account password; (bsc#1185089); (bso#14155);</changelog>
  <changelog author="scabrero@suse.de" date="1636372800">- CVE-2016-2124: Don't fallback to non spnego authentication if
  kerberos is required; (bsc#1014440); (bso#12444);
- CVE-2020-25717: A user in an AD Domain could become root on
  domain members; (bsc#1192284); (bso#14556);</changelog>
  <changelog author="nopower@suse.com" date="1637236800">- The username map [script] advice from CVE-2020-25717 advisory
  note has undesired side effects for the local nt token. Fallback
  to a SID/UID based mapping if the name based lookup fails;
  (bsc#1192849); (bso#14901).</changelog>
  <changelog author="nopower@suse.com" date="1642766400">- CVE-2021-44142: Out-of-Bound Read/Write on Samba vfs_fruit
  module; (bsc#1194859); (bso#14914).</changelog>
</package>
<package pkgid="a8a4227fa14b93037c26abf07bd4c60bdf79065f3303d058c2f638fa33b17dd9" name="libsamba-policy0" arch="ppc64le">
  <version epoch="0" ver="4.9.5+git.483.212a7ebca6b" rel="3.64.1"/>
  <changelog author="nopower@suse.com" date="1584705600">- Fix CLI tools still printing "Unable to initialize messaging
  context" messages; (bso#13925); (bsc#1167070).
- Do print mkdir failure message on error debug level when
  initializing messaging; (bso#13823); (bsc#1167070).</changelog>
  <changelog author="dmulder@suse.com" date="1586865600">- Fix spnego fallback from kerberos to ntlmssp in smbd server;
  (bso#14106); (bsc#1169473);</changelog>
  <changelog author="nopower@suse.com" date="1587556800">- CVE-2020-10704: samba: Stack overflow in AD DC (C)LDAP server;
  (bso#14334); (bsc#1169851).</changelog>
  <changelog author="scabrero@suse.de" date="1589457600">- Installing: samba - samba-ad-dc.service does not exist and unit
  not found; (bsc#1171437);</changelog>
  <changelog author="scabrero@suse.de" date="1591012800">- Add libnetapi-devel to baselibs conf, for wine usage; (bsc#1172307);</changelog>
  <changelog author="nopower@suse.com" date="1592827200">- CVE-2020-10730: NULL de-reference in AD DC LDAP server when ASQ
  and VLV combined; (bso#14364); (bsc#1173159].
- CVE-2020-10745: invalid DNS or NBT queries containing dots use
  several seconds of CPU each; (bso#14378); (bsc#1173160).
- CVE-2020-10760: Use-after-free in AD DC Global Catalog LDAP server
  with paged_result or VLV; (bso#14402); (bsc#1173161).</changelog>
  <changelog author="nopower@suse.com" date="1593086400">- CVE-2020-14303: Endless loop from empty UDP packet sent to AD DC
  nbt_server; (bso#14417); (bsc#1173359).</changelog>
  <changelog author="dmulder@suse.com" date="1594728000">- Fix net command unable to negotiate SMB2; (bsc#1174120);</changelog>
  <changelog author="scabrero@suse.de" date="1595851200">- Add obsoletes to libsmbldap2 package to fix upgrades from previous
  versions; (bsc#1172810);</changelog>
  <changelog author="scabrero@suse.de" date="1600430400">- CVE-2020-1472: Unauthenticated domain takeover via netlogon ("ZeroLogon").
  + s3:rpc_server/netlogon: Protect netr_ServerPasswordSet2 against
    unencrypted passwords; (bsc#1176579); (bso#14497);
  + s3:rpc_server/netlogon: Support "server require schannel:WORKSTATION$ = no"
    about unsecure configurations; (bsc#1176579); (bso#14497);
  + s4 torture rpc: repeated bytes in client challenge; (bsc#1176579);
    (bso#14497);
  + libcli/auth: Reject weak client challenges in netlogon_creds_server_init()
    "server require schannel:WORKSTATION$ = no"; (bsc#1176579); (bso#14497);</changelog>
  <changelog author="scabrero@suse.de" date="1602590400">- CVE-2020-14383: An authenticated user can crash the DCE/RPC DNS with
  easily crafted records; (bsc#1177613); (bso#14472);
- CVE-2020-14323: Unprivileged user can crash winbind; (bsc#1173994);
  (bso#14436);
- CVE-2020-14318: Missing handle permissions check in SMB1/2/3 ChangeNotify;
  (bsc#1173902); (bso#14434);</changelog>
  <changelog author="nopower@suse.com" date="1604577600">- Adjust smbcacls '--propagate-inheritance' feature to align with
  upstream; (bsc#1178469).</changelog>
  <changelog author="nopower@suse.com" date="1612440000">- Avoid free'ing our own pointer in memcache when memcache_trim
  attempts to reduce cache size; (bso#14625); (bnc#1179156).</changelog>
  <changelog author="nopower@suse.com" date="1615896000">-  CVE-2020-27840: samba: Unauthenticated remote heap corruption
  via bad DNs; (bso#14595); (bsc#1183572).
-  CVE-2021-20277: samba: out of bounds read in ldb_handler_fold;
  (bso#14655); (bsc#1183574).</changelog>
  <changelog author="dmulder@suse.com" date="1616760000">- s3-libads: use dns name to open a ldap session; (bso#13124);
  (bsc#1184310).</changelog>
  <changelog author="nopower@suse.com" date="1618401600">- CVE-2021-20254 Buffer overrun in sids_to_unixids();
  (bso#14571); (bsc#1184677).</changelog>
  <changelog author="scabrero@suse.de" date="1621598400">- s3-libads: Do not turn on canonicalization flag. Fixes a regression
  changing the computer account password; (bsc#1185089); (bso#14155);</changelog>
  <changelog author="scabrero@suse.de" date="1636372800">- CVE-2016-2124: Don't fallback to non spnego authentication if
  kerberos is required; (bsc#1014440); (bso#12444);
- CVE-2020-25717: A user in an AD Domain could become root on
  domain members; (bsc#1192284); (bso#14556);</changelog>
  <changelog author="nopower@suse.com" date="1637236800">- The username map [script] advice from CVE-2020-25717 advisory
  note has undesired side effects for the local nt token. Fallback
  to a SID/UID based mapping if the name based lookup fails;
  (bsc#1192849); (bso#14901).</changelog>
  <changelog author="nopower@suse.com" date="1642766400">- CVE-2021-44142: Out-of-Bound Read/Write on Samba vfs_fruit
  module; (bsc#1194859); (bso#14914).</changelog>
</package>
<package pkgid="9b72d562742b5f6db88b261af85f41869aaceb27b17eddabc6e1b5d5bc275091" name="libsamba-policy0" arch="s390x">
  <version epoch="0" ver="4.9.5+git.483.212a7ebca6b" rel="3.64.1"/>
  <changelog author="nopower@suse.com" date="1584705600">- Fix CLI tools still printing "Unable to initialize messaging
  context" messages; (bso#13925); (bsc#1167070).
- Do print mkdir failure message on error debug level when
  initializing messaging; (bso#13823); (bsc#1167070).</changelog>
  <changelog author="dmulder@suse.com" date="1586865600">- Fix spnego fallback from kerberos to ntlmssp in smbd server;
  (bso#14106); (bsc#1169473);</changelog>
  <changelog author="nopower@suse.com" date="1587556800">- CVE-2020-10704: samba: Stack overflow in AD DC (C)LDAP server;
  (bso#14334); (bsc#1169851).</changelog>
  <changelog author="scabrero@suse.de" date="1589457600">- Installing: samba - samba-ad-dc.service does not exist and unit
  not found; (bsc#1171437);</changelog>
  <changelog author="scabrero@suse.de" date="1591012800">- Add libnetapi-devel to baselibs conf, for wine usage; (bsc#1172307);</changelog>
  <changelog author="nopower@suse.com" date="1592827200">- CVE-2020-10730: NULL de-reference in AD DC LDAP server when ASQ
  and VLV combined; (bso#14364); (bsc#1173159].
- CVE-2020-10745: invalid DNS or NBT queries containing dots use
  several seconds of CPU each; (bso#14378); (bsc#1173160).
- CVE-2020-10760: Use-after-free in AD DC Global Catalog LDAP server
  with paged_result or VLV; (bso#14402); (bsc#1173161).</changelog>
  <changelog author="nopower@suse.com" date="1593086400">- CVE-2020-14303: Endless loop from empty UDP packet sent to AD DC
  nbt_server; (bso#14417); (bsc#1173359).</changelog>
  <changelog author="dmulder@suse.com" date="1594728000">- Fix net command unable to negotiate SMB2; (bsc#1174120);</changelog>
  <changelog author="scabrero@suse.de" date="1595851200">- Add obsoletes to libsmbldap2 package to fix upgrades from previous
  versions; (bsc#1172810);</changelog>
  <changelog author="scabrero@suse.de" date="1600430400">- CVE-2020-1472: Unauthenticated domain takeover via netlogon ("ZeroLogon").
  + s3:rpc_server/netlogon: Protect netr_ServerPasswordSet2 against
    unencrypted passwords; (bsc#1176579); (bso#14497);
  + s3:rpc_server/netlogon: Support "server require schannel:WORKSTATION$ = no"
    about unsecure configurations; (bsc#1176579); (bso#14497);
  + s4 torture rpc: repeated bytes in client challenge; (bsc#1176579);
    (bso#14497);
  + libcli/auth: Reject weak client challenges in netlogon_creds_server_init()
    "server require schannel:WORKSTATION$ = no"; (bsc#1176579); (bso#14497);</changelog>
  <changelog author="scabrero@suse.de" date="1602590400">- CVE-2020-14383: An authenticated user can crash the DCE/RPC DNS with
  easily crafted records; (bsc#1177613); (bso#14472);
- CVE-2020-14323: Unprivileged user can crash winbind; (bsc#1173994);
  (bso#14436);
- CVE-2020-14318: Missing handle permissions check in SMB1/2/3 ChangeNotify;
  (bsc#1173902); (bso#14434);</changelog>
  <changelog author="nopower@suse.com" date="1604577600">- Adjust smbcacls '--propagate-inheritance' feature to align with
  upstream; (bsc#1178469).</changelog>
  <changelog author="nopower@suse.com" date="1612440000">- Avoid free'ing our own pointer in memcache when memcache_trim
  attempts to reduce cache size; (bso#14625); (bnc#1179156).</changelog>
  <changelog author="nopower@suse.com" date="1615896000">-  CVE-2020-27840: samba: Unauthenticated remote heap corruption
  via bad DNs; (bso#14595); (bsc#1183572).
-  CVE-2021-20277: samba: out of bounds read in ldb_handler_fold;
  (bso#14655); (bsc#1183574).</changelog>
  <changelog author="dmulder@suse.com" date="1616760000">- s3-libads: use dns name to open a ldap session; (bso#13124);
  (bsc#1184310).</changelog>
  <changelog author="nopower@suse.com" date="1618401600">- CVE-2021-20254 Buffer overrun in sids_to_unixids();
  (bso#14571); (bsc#1184677).</changelog>
  <changelog author="scabrero@suse.de" date="1621598400">- s3-libads: Do not turn on canonicalization flag. Fixes a regression
  changing the computer account password; (bsc#1185089); (bso#14155);</changelog>
  <changelog author="scabrero@suse.de" date="1636372800">- CVE-2016-2124: Don't fallback to non spnego authentication if
  kerberos is required; (bsc#1014440); (bso#12444);
- CVE-2020-25717: A user in an AD Domain could become root on
  domain members; (bsc#1192284); (bso#14556);</changelog>
  <changelog author="nopower@suse.com" date="1637236800">- The username map [script] advice from CVE-2020-25717 advisory
  note has undesired side effects for the local nt token. Fallback
  to a SID/UID based mapping if the name based lookup fails;
  (bsc#1192849); (bso#14901).</changelog>
  <changelog author="nopower@suse.com" date="1642766400">- CVE-2021-44142: Out-of-Bound Read/Write on Samba vfs_fruit
  module; (bsc#1194859); (bso#14914).</changelog>
</package>
<package pkgid="834344ee932e1cf2fc0cd751b0da54b51b3998d27383b42094fcc706c9b1c972" name="libsamba-policy0" arch="x86_64">
  <version epoch="0" ver="4.9.5+git.483.212a7ebca6b" rel="3.64.1"/>
  <changelog author="nopower@suse.com" date="1584705600">- Fix CLI tools still printing "Unable to initialize messaging
  context" messages; (bso#13925); (bsc#1167070).
- Do print mkdir failure message on error debug level when
  initializing messaging; (bso#13823); (bsc#1167070).</changelog>
  <changelog author="dmulder@suse.com" date="1586865600">- Fix spnego fallback from kerberos to ntlmssp in smbd server;
  (bso#14106); (bsc#1169473);</changelog>
  <changelog author="nopower@suse.com" date="1587556800">- CVE-2020-10704: samba: Stack overflow in AD DC (C)LDAP server;
  (bso#14334); (bsc#1169851).</changelog>
  <changelog author="scabrero@suse.de" date="1589457600">- Installing: samba - samba-ad-dc.service does not exist and unit
  not found; (bsc#1171437);</changelog>
  <changelog author="scabrero@suse.de" date="1591012800">- Add libnetapi-devel to baselibs conf, for wine usage; (bsc#1172307);</changelog>
  <changelog author="nopower@suse.com" date="1592827200">- CVE-2020-10730: NULL de-reference in AD DC LDAP server when ASQ
  and VLV combined; (bso#14364); (bsc#1173159].
- CVE-2020-10745: invalid DNS or NBT queries containing dots use
  several seconds of CPU each; (bso#14378); (bsc#1173160).
- CVE-2020-10760: Use-after-free in AD DC Global Catalog LDAP server
  with paged_result or VLV; (bso#14402); (bsc#1173161).</changelog>
  <changelog author="nopower@suse.com" date="1593086400">- CVE-2020-14303: Endless loop from empty UDP packet sent to AD DC
  nbt_server; (bso#14417); (bsc#1173359).</changelog>
  <changelog author="dmulder@suse.com" date="1594728000">- Fix net command unable to negotiate SMB2; (bsc#1174120);</changelog>
  <changelog author="scabrero@suse.de" date="1595851200">- Add obsoletes to libsmbldap2 package to fix upgrades from previous
  versions; (bsc#1172810);</changelog>
  <changelog author="scabrero@suse.de" date="1600430400">- CVE-2020-1472: Unauthenticated domain takeover via netlogon ("ZeroLogon").
  + s3:rpc_server/netlogon: Protect netr_ServerPasswordSet2 against
    unencrypted passwords; (bsc#1176579); (bso#14497);
  + s3:rpc_server/netlogon: Support "server require schannel:WORKSTATION$ = no"
    about unsecure configurations; (bsc#1176579); (bso#14497);
  + s4 torture rpc: repeated bytes in client challenge; (bsc#1176579);
    (bso#14497);
  + libcli/auth: Reject weak client challenges in netlogon_creds_server_init()
    "server require schannel:WORKSTATION$ = no"; (bsc#1176579); (bso#14497);</changelog>
  <changelog author="scabrero@suse.de" date="1602590400">- CVE-2020-14383: An authenticated user can crash the DCE/RPC DNS with
  easily crafted records; (bsc#1177613); (bso#14472);
- CVE-2020-14323: Unprivileged user can crash winbind; (bsc#1173994);
  (bso#14436);
- CVE-2020-14318: Missing handle permissions check in SMB1/2/3 ChangeNotify;
  (bsc#1173902); (bso#14434);</changelog>
  <changelog author="nopower@suse.com" date="1604577600">- Adjust smbcacls '--propagate-inheritance' feature to align with
  upstream; (bsc#1178469).</changelog>
  <changelog author="nopower@suse.com" date="1612440000">- Avoid free'ing our own pointer in memcache when memcache_trim
  attempts to reduce cache size; (bso#14625); (bnc#1179156).</changelog>
  <changelog author="nopower@suse.com" date="1615896000">-  CVE-2020-27840: samba: Unauthenticated remote heap corruption
  via bad DNs; (bso#14595); (bsc#1183572).
-  CVE-2021-20277: samba: out of bounds read in ldb_handler_fold;
  (bso#14655); (bsc#1183574).</changelog>
  <changelog author="dmulder@suse.com" date="1616760000">- s3-libads: use dns name to open a ldap session; (bso#13124);
  (bsc#1184310).</changelog>
  <changelog author="nopower@suse.com" date="1618401600">- CVE-2021-20254 Buffer overrun in sids_to_unixids();
  (bso#14571); (bsc#1184677).</changelog>
  <changelog author="scabrero@suse.de" date="1621598400">- s3-libads: Do not turn on canonicalization flag. Fixes a regression
  changing the computer account password; (bsc#1185089); (bso#14155);</changelog>
  <changelog author="scabrero@suse.de" date="1636372800">- CVE-2016-2124: Don't fallback to non spnego authentication if
  kerberos is required; (bsc#1014440); (bso#12444);
- CVE-2020-25717: A user in an AD Domain could become root on
  domain members; (bsc#1192284); (bso#14556);</changelog>
  <changelog author="nopower@suse.com" date="1637236800">- The username map [script] advice from CVE-2020-25717 advisory
  note has undesired side effects for the local nt token. Fallback
  to a SID/UID based mapping if the name based lookup fails;
  (bsc#1192849); (bso#14901).</changelog>
  <changelog author="nopower@suse.com" date="1642766400">- CVE-2021-44142: Out-of-Bound Read/Write on Samba vfs_fruit
  module; (bsc#1194859); (bso#14914).</changelog>
</package>
<package pkgid="3afeb13c3efbbe52c40f14134ae7019aee150082129ca39bc8b050937a1bc020" name="libsndfile" arch="src">
  <version epoch="0" ver="1.0.28" rel="5.15.1"/>
  <changelog author="tiwai@suse.de" date="1322136000">- add missing provides/obsoletes for libsndfile -&gt; libsndfile1
  rename (bnc#732565)</changelog>
  <changelog author="coolo@suse.com" date="1322827200">- add libtool as buildrequire to avoid implicit dependency</changelog>
  <changelog author="mmeister@suse.com" date="1366027200">- Added url as source.
  Please see http://en.opensuse.org/SourceUrls</changelog>
  <changelog author="tiwai@suse.de" date="1420632000">- VUL-0: two buffer read overflows in sd2_parse_rsrc_fork()
  (CVE-2014-9496, bnc#911796): backported upstream fix patches
  sndfile-src-sd2.c-Fix-segfault-in-SD2-RSRC-parser.patch
  sndfile-src-sd2.c-Fix-two-potential-buffer-read-overflows.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1426939200">- Cleanup spec file with spec-cleaner
- Add gpg signature
- Remove old ppc provides/obsoletes</changelog>
  <changelog author="tiwai@suse.de" date="1446638400">- VUL-1: libsndfile DoS/divide-by-zero (CVE-2014-9756, bsc#953521):
  libsndfile-src-file_io.c-Prevent-potential-divide-by-zero.patch</changelog>
  <changelog author="tiwai@suse.de" date="1446638401">- VUL-0: libsndfile 1.0.25 heap overflow (CVE-2015-7805, bsc#953516)
  libsndfile-src-common.c-Fix-a-header-parsing-bug.patch
  libsndfile-fix-header-read-CVE-2015-7805.patch
- VUL-0: libsndfile 1.0.25 heap overflow (CVE-2015-8075, bsc#953519)
  libsndfile-psf_strlcpy_crlf-fix-CVE-2015-8075.patch
- Fix the build with SLE11-SP3 due to AM_SILENT_RULE macro</changelog>
  <changelog author="tiwai@suse.de" date="1448280000">- Update to version 1.0.26:
  * Fix for CVE-2014-9496, CVE-2014-9756 and CVE-2015-7805.
  * Add ALAC/CAF support. Minor bug fixes and improvements.
- Refreshed patches:
  sndfile-ocloexec.patch
  libsndfile-psf_strlcpy_crlf-fix-CVE-2015-8075.patch
- Removed obsoleted patches:
  libsndfile-example-fix.diff
  libsndfile-fix-header-read-CVE-2015-7805.patch
  libsndfile-paf-zero-division-fix.diff
  libsndfile-src-common.c-Fix-a-header-parsing-bug.patch
  libsndfile-src-file_io.c-Prevent-potential-divide-by-zero.patch
  sndfile-src-sd2.c-Fix-segfault-in-SD2-RSRC-parser.patch
  sndfile-src-sd2.c-Fix-two-potential-buffer-read-overflows.patch</changelog>
  <changelog author="tom.mbrt@googlemail.com" date="1462881600">- Fix spec file to enable builds on non opensuse OS</changelog>
  <changelog author="tiwai@suse.de" date="1491825600">- Update to version 1.0.27:
  * Fix a seek regression in 1.0.26
  * Add metadata read/write for CAF and RF64
  * FIx PAF endian-ness issue
- Update to version 1.0.28
  * Fix buffer overruns in FLAC and ID3 handling code
  (CVE-2017-7585, CVE-2017-7586, bsc#1033054, bsc#1033053)
  * Reduce default header memory requirements
  * Fix detection of Large File Support for 32 bit systems.
- Obsoleted patch:
  libsndfile-psf_strlcpy_crlf-fix-CVE-2015-8075.patch</changelog>
  <changelog author="tiwai@suse.de" date="1493726400">- Fix FLAC buffer overflows (CVE-2017-8361 CVE-2017-8363
  CVE-2017-8365 CVE-2017-8362 bsc#1036944 bsc#1036945 bsc#1036946
  bsc#1036943):
  0001-FLAC-Fix-a-buffer-read-overrun.patch
  0002-src-flac.c-Fix-a-buffer-read-overflow.patch</changelog>
  <changelog author="tiwai@suse.de" date="1497355200">- Fix out-of-bounds read memory access in the aiff_read_chanmap()
  (CVE-2017-6892, bsc#1043978):
  0010-src-aiff.c-Fix-a-buffer-read-overflow.patch</changelog>
  <changelog author="tiwai@suse.de" date="1502193600">- Fix Heap-based Buffer Overflow in the psf_binheader_writef
  (CVE-2017-12562, bsc#1052476):
  0020-src-common.c-Fix-heap-buffer-overflows-when-writing-.patch</changelog>
  <changelog author="tiwai@suse.de" date="1513684800">- Fix VUL-0: divide-by-zero error exists in the function
  double64_init() in double64.c (CVE-2017-14634, bsc#1059911):
  0030-double64_init-Check-psf-sf.channels-against-upper-bo.patch
- Tentative fix for VUL-0: out of bounds read in the function
  d2alaw_array() in alaw.c (CVE-2017-14245, bsc#1059912) and
  VUL-0: out of bounds read in the function d2ulaw_array() in
  ulaw.c (CVE-2017-14246, bsc#1059913):
  0031-sfe_copy_data_fp-check-value-of-max-variable.patch</changelog>
  <changelog author="tiwai@suse.de" date="1528459200">- Fix potential overflow in d2alaw_array() (CVE-2017-17456,
  bsc#1071777):
  libsndfile-CVE-2017-17456-alaw-range-check.patch
- Fix potential overflow in d2ulaw_array() (CVE-2017-17457,
  bsc#1071767):
  libsndfile-CVE-2017-17457-ulaw-range-check.patch</changelog>
  <changelog author="tiwai@suse.de" date="1528459201">- Use license file tag</changelog>
  <changelog author="tiwai@suse.de" date="1530878400">- Fix buffer overflow in sndfile-deinterleave, which isn't really a
  security issue (bsc#1100167, CVE-2018-13139, bsc#1116993,
  CVE-2018-19432):
  sndfile-deinterlace-channels-check.patch</changelog>
  <changelog author="tiwai@suse.de" date="1543924800">- Fix segfault in wav conversion due to the invalid loop count
  (CVE-2018-19758, bsc#1117954):
  libsndfile-wav-loop-count-fix.patch</changelog>
  <changelog author="tiwai@suse.de" date="1627041600">- Fix heap buffer overflow vulnerability in msadpcm_decode_block
  (CVE-2021-3246, bsc#1188540):
  ms_adpcm-Fix-and-extend-size-checks.patch</changelog>
  <changelog author="tiwai@suse.de" date="1641211200">- Fix heap buffer overflow in flac_buffer_copy (CVE-2021-4156,
  bsc#1194006):
  libsndfile-CVE-2021-4156.patch</changelog>
</package>
<package pkgid="3ebeabf9c65fde2182ab97e9e2ed7b7121a7ac49cc84df675a904317634b84bc" name="libsndfile-devel" arch="aarch64">
  <version epoch="0" ver="1.0.28" rel="5.15.1"/>
  <changelog author="tiwai@suse.de" date="1420632000">- VUL-0: two buffer read overflows in sd2_parse_rsrc_fork()
  (CVE-2014-9496, bnc#911796): backported upstream fix patches
  sndfile-src-sd2.c-Fix-segfault-in-SD2-RSRC-parser.patch
  sndfile-src-sd2.c-Fix-two-potential-buffer-read-overflows.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1426939200">- Cleanup spec file with spec-cleaner
- Add gpg signature
- Remove old ppc provides/obsoletes</changelog>
  <changelog author="tiwai@suse.de" date="1446638400">- VUL-1: libsndfile DoS/divide-by-zero (CVE-2014-9756, bsc#953521):
  libsndfile-src-file_io.c-Prevent-potential-divide-by-zero.patch</changelog>
  <changelog author="tiwai@suse.de" date="1446638401">- VUL-0: libsndfile 1.0.25 heap overflow (CVE-2015-7805, bsc#953516)
  libsndfile-src-common.c-Fix-a-header-parsing-bug.patch
  libsndfile-fix-header-read-CVE-2015-7805.patch
- VUL-0: libsndfile 1.0.25 heap overflow (CVE-2015-8075, bsc#953519)
  libsndfile-psf_strlcpy_crlf-fix-CVE-2015-8075.patch
- Fix the build with SLE11-SP3 due to AM_SILENT_RULE macro</changelog>
  <changelog author="tiwai@suse.de" date="1448280000">- Update to version 1.0.26:
  * Fix for CVE-2014-9496, CVE-2014-9756 and CVE-2015-7805.
  * Add ALAC/CAF support. Minor bug fixes and improvements.
- Refreshed patches:
  sndfile-ocloexec.patch
  libsndfile-psf_strlcpy_crlf-fix-CVE-2015-8075.patch
- Removed obsoleted patches:
  libsndfile-example-fix.diff
  libsndfile-fix-header-read-CVE-2015-7805.patch
  libsndfile-paf-zero-division-fix.diff
  libsndfile-src-common.c-Fix-a-header-parsing-bug.patch
  libsndfile-src-file_io.c-Prevent-potential-divide-by-zero.patch
  sndfile-src-sd2.c-Fix-segfault-in-SD2-RSRC-parser.patch
  sndfile-src-sd2.c-Fix-two-potential-buffer-read-overflows.patch</changelog>
  <changelog author="tom.mbrt@googlemail.com" date="1462881600">- Fix spec file to enable builds on non opensuse OS</changelog>
  <changelog author="tiwai@suse.de" date="1491825600">- Update to version 1.0.27:
  * Fix a seek regression in 1.0.26
  * Add metadata read/write for CAF and RF64
  * FIx PAF endian-ness issue
- Update to version 1.0.28
  * Fix buffer overruns in FLAC and ID3 handling code
  (CVE-2017-7585, CVE-2017-7586, bsc#1033054, bsc#1033053)
  * Reduce default header memory requirements
  * Fix detection of Large File Support for 32 bit systems.
- Obsoleted patch:
  libsndfile-psf_strlcpy_crlf-fix-CVE-2015-8075.patch</changelog>
  <changelog author="tiwai@suse.de" date="1493726400">- Fix FLAC buffer overflows (CVE-2017-8361 CVE-2017-8363
  CVE-2017-8365 CVE-2017-8362 bsc#1036944 bsc#1036945 bsc#1036946
  bsc#1036943):
  0001-FLAC-Fix-a-buffer-read-overrun.patch
  0002-src-flac.c-Fix-a-buffer-read-overflow.patch</changelog>
  <changelog author="tiwai@suse.de" date="1497355200">- Fix out-of-bounds read memory access in the aiff_read_chanmap()
  (CVE-2017-6892, bsc#1043978):
  0010-src-aiff.c-Fix-a-buffer-read-overflow.patch</changelog>
  <changelog author="tiwai@suse.de" date="1502193600">- Fix Heap-based Buffer Overflow in the psf_binheader_writef
  (CVE-2017-12562, bsc#1052476):
  0020-src-common.c-Fix-heap-buffer-overflows-when-writing-.patch</changelog>
  <changelog author="tiwai@suse.de" date="1513684800">- Fix VUL-0: divide-by-zero error exists in the function
  double64_init() in double64.c (CVE-2017-14634, bsc#1059911):
  0030-double64_init-Check-psf-sf.channels-against-upper-bo.patch
- Tentative fix for VUL-0: out of bounds read in the function
  d2alaw_array() in alaw.c (CVE-2017-14245, bsc#1059912) and
  VUL-0: out of bounds read in the function d2ulaw_array() in
  ulaw.c (CVE-2017-14246, bsc#1059913):
  0031-sfe_copy_data_fp-check-value-of-max-variable.patch</changelog>
  <changelog author="tiwai@suse.de" date="1528459200">- Fix potential overflow in d2alaw_array() (CVE-2017-17456,
  bsc#1071777):
  libsndfile-CVE-2017-17456-alaw-range-check.patch
- Fix potential overflow in d2ulaw_array() (CVE-2017-17457,
  bsc#1071767):
  libsndfile-CVE-2017-17457-ulaw-range-check.patch</changelog>
  <changelog author="tiwai@suse.de" date="1528459201">- Use license file tag</changelog>
  <changelog author="tiwai@suse.de" date="1530878400">- Fix buffer overflow in sndfile-deinterleave, which isn't really a
  security issue (bsc#1100167, CVE-2018-13139, bsc#1116993,
  CVE-2018-19432):
  sndfile-deinterlace-channels-check.patch</changelog>
  <changelog author="tiwai@suse.de" date="1543924800">- Fix segfault in wav conversion due to the invalid loop count
  (CVE-2018-19758, bsc#1117954):
  libsndfile-wav-loop-count-fix.patch</changelog>
  <changelog author="tiwai@suse.de" date="1627041600">- Fix heap buffer overflow vulnerability in msadpcm_decode_block
  (CVE-2021-3246, bsc#1188540):
  ms_adpcm-Fix-and-extend-size-checks.patch</changelog>
  <changelog author="tiwai@suse.de" date="1641211200">- Fix heap buffer overflow in flac_buffer_copy (CVE-2021-4156,
  bsc#1194006):
  libsndfile-CVE-2021-4156.patch</changelog>
</package>
<package pkgid="080bd9f21adc64a86af46be53dc1ccb963ead0d4d32ed0864809e1047438f37a" name="libsndfile-devel" arch="ppc64le">
  <version epoch="0" ver="1.0.28" rel="5.15.1"/>
  <changelog author="tiwai@suse.de" date="1420632000">- VUL-0: two buffer read overflows in sd2_parse_rsrc_fork()
  (CVE-2014-9496, bnc#911796): backported upstream fix patches
  sndfile-src-sd2.c-Fix-segfault-in-SD2-RSRC-parser.patch
  sndfile-src-sd2.c-Fix-two-potential-buffer-read-overflows.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1426939200">- Cleanup spec file with spec-cleaner
- Add gpg signature
- Remove old ppc provides/obsoletes</changelog>
  <changelog author="tiwai@suse.de" date="1446638400">- VUL-1: libsndfile DoS/divide-by-zero (CVE-2014-9756, bsc#953521):
  libsndfile-src-file_io.c-Prevent-potential-divide-by-zero.patch</changelog>
  <changelog author="tiwai@suse.de" date="1446638401">- VUL-0: libsndfile 1.0.25 heap overflow (CVE-2015-7805, bsc#953516)
  libsndfile-src-common.c-Fix-a-header-parsing-bug.patch
  libsndfile-fix-header-read-CVE-2015-7805.patch
- VUL-0: libsndfile 1.0.25 heap overflow (CVE-2015-8075, bsc#953519)
  libsndfile-psf_strlcpy_crlf-fix-CVE-2015-8075.patch
- Fix the build with SLE11-SP3 due to AM_SILENT_RULE macro</changelog>
  <changelog author="tiwai@suse.de" date="1448280000">- Update to version 1.0.26:
  * Fix for CVE-2014-9496, CVE-2014-9756 and CVE-2015-7805.
  * Add ALAC/CAF support. Minor bug fixes and improvements.
- Refreshed patches:
  sndfile-ocloexec.patch
  libsndfile-psf_strlcpy_crlf-fix-CVE-2015-8075.patch
- Removed obsoleted patches:
  libsndfile-example-fix.diff
  libsndfile-fix-header-read-CVE-2015-7805.patch
  libsndfile-paf-zero-division-fix.diff
  libsndfile-src-common.c-Fix-a-header-parsing-bug.patch
  libsndfile-src-file_io.c-Prevent-potential-divide-by-zero.patch
  sndfile-src-sd2.c-Fix-segfault-in-SD2-RSRC-parser.patch
  sndfile-src-sd2.c-Fix-two-potential-buffer-read-overflows.patch</changelog>
  <changelog author="tom.mbrt@googlemail.com" date="1462881600">- Fix spec file to enable builds on non opensuse OS</changelog>
  <changelog author="tiwai@suse.de" date="1491825600">- Update to version 1.0.27:
  * Fix a seek regression in 1.0.26
  * Add metadata read/write for CAF and RF64
  * FIx PAF endian-ness issue
- Update to version 1.0.28
  * Fix buffer overruns in FLAC and ID3 handling code
  (CVE-2017-7585, CVE-2017-7586, bsc#1033054, bsc#1033053)
  * Reduce default header memory requirements
  * Fix detection of Large File Support for 32 bit systems.
- Obsoleted patch:
  libsndfile-psf_strlcpy_crlf-fix-CVE-2015-8075.patch</changelog>
  <changelog author="tiwai@suse.de" date="1493726400">- Fix FLAC buffer overflows (CVE-2017-8361 CVE-2017-8363
  CVE-2017-8365 CVE-2017-8362 bsc#1036944 bsc#1036945 bsc#1036946
  bsc#1036943):
  0001-FLAC-Fix-a-buffer-read-overrun.patch
  0002-src-flac.c-Fix-a-buffer-read-overflow.patch</changelog>
  <changelog author="tiwai@suse.de" date="1497355200">- Fix out-of-bounds read memory access in the aiff_read_chanmap()
  (CVE-2017-6892, bsc#1043978):
  0010-src-aiff.c-Fix-a-buffer-read-overflow.patch</changelog>
  <changelog author="tiwai@suse.de" date="1502193600">- Fix Heap-based Buffer Overflow in the psf_binheader_writef
  (CVE-2017-12562, bsc#1052476):
  0020-src-common.c-Fix-heap-buffer-overflows-when-writing-.patch</changelog>
  <changelog author="tiwai@suse.de" date="1513684800">- Fix VUL-0: divide-by-zero error exists in the function
  double64_init() in double64.c (CVE-2017-14634, bsc#1059911):
  0030-double64_init-Check-psf-sf.channels-against-upper-bo.patch
- Tentative fix for VUL-0: out of bounds read in the function
  d2alaw_array() in alaw.c (CVE-2017-14245, bsc#1059912) and
  VUL-0: out of bounds read in the function d2ulaw_array() in
  ulaw.c (CVE-2017-14246, bsc#1059913):
  0031-sfe_copy_data_fp-check-value-of-max-variable.patch</changelog>
  <changelog author="tiwai@suse.de" date="1528459200">- Fix potential overflow in d2alaw_array() (CVE-2017-17456,
  bsc#1071777):
  libsndfile-CVE-2017-17456-alaw-range-check.patch
- Fix potential overflow in d2ulaw_array() (CVE-2017-17457,
  bsc#1071767):
  libsndfile-CVE-2017-17457-ulaw-range-check.patch</changelog>
  <changelog author="tiwai@suse.de" date="1528459201">- Use license file tag</changelog>
  <changelog author="tiwai@suse.de" date="1530878400">- Fix buffer overflow in sndfile-deinterleave, which isn't really a
  security issue (bsc#1100167, CVE-2018-13139, bsc#1116993,
  CVE-2018-19432):
  sndfile-deinterlace-channels-check.patch</changelog>
  <changelog author="tiwai@suse.de" date="1543924800">- Fix segfault in wav conversion due to the invalid loop count
  (CVE-2018-19758, bsc#1117954):
  libsndfile-wav-loop-count-fix.patch</changelog>
  <changelog author="tiwai@suse.de" date="1627041600">- Fix heap buffer overflow vulnerability in msadpcm_decode_block
  (CVE-2021-3246, bsc#1188540):
  ms_adpcm-Fix-and-extend-size-checks.patch</changelog>
  <changelog author="tiwai@suse.de" date="1641211200">- Fix heap buffer overflow in flac_buffer_copy (CVE-2021-4156,
  bsc#1194006):
  libsndfile-CVE-2021-4156.patch</changelog>
</package>
<package pkgid="3e468bb1e47439b447691eb1c17a580d7a3c99db8b1a1b9f52f05037612bc374" name="libsndfile-devel" arch="s390x">
  <version epoch="0" ver="1.0.28" rel="5.15.1"/>
  <changelog author="tiwai@suse.de" date="1420632000">- VUL-0: two buffer read overflows in sd2_parse_rsrc_fork()
  (CVE-2014-9496, bnc#911796): backported upstream fix patches
  sndfile-src-sd2.c-Fix-segfault-in-SD2-RSRC-parser.patch
  sndfile-src-sd2.c-Fix-two-potential-buffer-read-overflows.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1426939200">- Cleanup spec file with spec-cleaner
- Add gpg signature
- Remove old ppc provides/obsoletes</changelog>
  <changelog author="tiwai@suse.de" date="1446638400">- VUL-1: libsndfile DoS/divide-by-zero (CVE-2014-9756, bsc#953521):
  libsndfile-src-file_io.c-Prevent-potential-divide-by-zero.patch</changelog>
  <changelog author="tiwai@suse.de" date="1446638401">- VUL-0: libsndfile 1.0.25 heap overflow (CVE-2015-7805, bsc#953516)
  libsndfile-src-common.c-Fix-a-header-parsing-bug.patch
  libsndfile-fix-header-read-CVE-2015-7805.patch
- VUL-0: libsndfile 1.0.25 heap overflow (CVE-2015-8075, bsc#953519)
  libsndfile-psf_strlcpy_crlf-fix-CVE-2015-8075.patch
- Fix the build with SLE11-SP3 due to AM_SILENT_RULE macro</changelog>
  <changelog author="tiwai@suse.de" date="1448280000">- Update to version 1.0.26:
  * Fix for CVE-2014-9496, CVE-2014-9756 and CVE-2015-7805.
  * Add ALAC/CAF support. Minor bug fixes and improvements.
- Refreshed patches:
  sndfile-ocloexec.patch
  libsndfile-psf_strlcpy_crlf-fix-CVE-2015-8075.patch
- Removed obsoleted patches:
  libsndfile-example-fix.diff
  libsndfile-fix-header-read-CVE-2015-7805.patch
  libsndfile-paf-zero-division-fix.diff
  libsndfile-src-common.c-Fix-a-header-parsing-bug.patch
  libsndfile-src-file_io.c-Prevent-potential-divide-by-zero.patch
  sndfile-src-sd2.c-Fix-segfault-in-SD2-RSRC-parser.patch
  sndfile-src-sd2.c-Fix-two-potential-buffer-read-overflows.patch</changelog>
  <changelog author="tom.mbrt@googlemail.com" date="1462881600">- Fix spec file to enable builds on non opensuse OS</changelog>
  <changelog author="tiwai@suse.de" date="1491825600">- Update to version 1.0.27:
  * Fix a seek regression in 1.0.26
  * Add metadata read/write for CAF and RF64
  * FIx PAF endian-ness issue
- Update to version 1.0.28
  * Fix buffer overruns in FLAC and ID3 handling code
  (CVE-2017-7585, CVE-2017-7586, bsc#1033054, bsc#1033053)
  * Reduce default header memory requirements
  * Fix detection of Large File Support for 32 bit systems.
- Obsoleted patch:
  libsndfile-psf_strlcpy_crlf-fix-CVE-2015-8075.patch</changelog>
  <changelog author="tiwai@suse.de" date="1493726400">- Fix FLAC buffer overflows (CVE-2017-8361 CVE-2017-8363
  CVE-2017-8365 CVE-2017-8362 bsc#1036944 bsc#1036945 bsc#1036946
  bsc#1036943):
  0001-FLAC-Fix-a-buffer-read-overrun.patch
  0002-src-flac.c-Fix-a-buffer-read-overflow.patch</changelog>
  <changelog author="tiwai@suse.de" date="1497355200">- Fix out-of-bounds read memory access in the aiff_read_chanmap()
  (CVE-2017-6892, bsc#1043978):
  0010-src-aiff.c-Fix-a-buffer-read-overflow.patch</changelog>
  <changelog author="tiwai@suse.de" date="1502193600">- Fix Heap-based Buffer Overflow in the psf_binheader_writef
  (CVE-2017-12562, bsc#1052476):
  0020-src-common.c-Fix-heap-buffer-overflows-when-writing-.patch</changelog>
  <changelog author="tiwai@suse.de" date="1513684800">- Fix VUL-0: divide-by-zero error exists in the function
  double64_init() in double64.c (CVE-2017-14634, bsc#1059911):
  0030-double64_init-Check-psf-sf.channels-against-upper-bo.patch
- Tentative fix for VUL-0: out of bounds read in the function
  d2alaw_array() in alaw.c (CVE-2017-14245, bsc#1059912) and
  VUL-0: out of bounds read in the function d2ulaw_array() in
  ulaw.c (CVE-2017-14246, bsc#1059913):
  0031-sfe_copy_data_fp-check-value-of-max-variable.patch</changelog>
  <changelog author="tiwai@suse.de" date="1528459200">- Fix potential overflow in d2alaw_array() (CVE-2017-17456,
  bsc#1071777):
  libsndfile-CVE-2017-17456-alaw-range-check.patch
- Fix potential overflow in d2ulaw_array() (CVE-2017-17457,
  bsc#1071767):
  libsndfile-CVE-2017-17457-ulaw-range-check.patch</changelog>
  <changelog author="tiwai@suse.de" date="1528459201">- Use license file tag</changelog>
  <changelog author="tiwai@suse.de" date="1530878400">- Fix buffer overflow in sndfile-deinterleave, which isn't really a
  security issue (bsc#1100167, CVE-2018-13139, bsc#1116993,
  CVE-2018-19432):
  sndfile-deinterlace-channels-check.patch</changelog>
  <changelog author="tiwai@suse.de" date="1543924800">- Fix segfault in wav conversion due to the invalid loop count
  (CVE-2018-19758, bsc#1117954):
  libsndfile-wav-loop-count-fix.patch</changelog>
  <changelog author="tiwai@suse.de" date="1627041600">- Fix heap buffer overflow vulnerability in msadpcm_decode_block
  (CVE-2021-3246, bsc#1188540):
  ms_adpcm-Fix-and-extend-size-checks.patch</changelog>
  <changelog author="tiwai@suse.de" date="1641211200">- Fix heap buffer overflow in flac_buffer_copy (CVE-2021-4156,
  bsc#1194006):
  libsndfile-CVE-2021-4156.patch</changelog>
</package>
<package pkgid="1ede2ebfef66e0c7168b2712bbcc4ef265e2c3e50acee7ab9be5feefed699423" name="libsndfile-devel" arch="x86_64">
  <version epoch="0" ver="1.0.28" rel="5.15.1"/>
  <changelog author="tiwai@suse.de" date="1420632000">- VUL-0: two buffer read overflows in sd2_parse_rsrc_fork()
  (CVE-2014-9496, bnc#911796): backported upstream fix patches
  sndfile-src-sd2.c-Fix-segfault-in-SD2-RSRC-parser.patch
  sndfile-src-sd2.c-Fix-two-potential-buffer-read-overflows.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1426939200">- Cleanup spec file with spec-cleaner
- Add gpg signature
- Remove old ppc provides/obsoletes</changelog>
  <changelog author="tiwai@suse.de" date="1446638400">- VUL-1: libsndfile DoS/divide-by-zero (CVE-2014-9756, bsc#953521):
  libsndfile-src-file_io.c-Prevent-potential-divide-by-zero.patch</changelog>
  <changelog author="tiwai@suse.de" date="1446638401">- VUL-0: libsndfile 1.0.25 heap overflow (CVE-2015-7805, bsc#953516)
  libsndfile-src-common.c-Fix-a-header-parsing-bug.patch
  libsndfile-fix-header-read-CVE-2015-7805.patch
- VUL-0: libsndfile 1.0.25 heap overflow (CVE-2015-8075, bsc#953519)
  libsndfile-psf_strlcpy_crlf-fix-CVE-2015-8075.patch
- Fix the build with SLE11-SP3 due to AM_SILENT_RULE macro</changelog>
  <changelog author="tiwai@suse.de" date="1448280000">- Update to version 1.0.26:
  * Fix for CVE-2014-9496, CVE-2014-9756 and CVE-2015-7805.
  * Add ALAC/CAF support. Minor bug fixes and improvements.
- Refreshed patches:
  sndfile-ocloexec.patch
  libsndfile-psf_strlcpy_crlf-fix-CVE-2015-8075.patch
- Removed obsoleted patches:
  libsndfile-example-fix.diff
  libsndfile-fix-header-read-CVE-2015-7805.patch
  libsndfile-paf-zero-division-fix.diff
  libsndfile-src-common.c-Fix-a-header-parsing-bug.patch
  libsndfile-src-file_io.c-Prevent-potential-divide-by-zero.patch
  sndfile-src-sd2.c-Fix-segfault-in-SD2-RSRC-parser.patch
  sndfile-src-sd2.c-Fix-two-potential-buffer-read-overflows.patch</changelog>
  <changelog author="tom.mbrt@googlemail.com" date="1462881600">- Fix spec file to enable builds on non opensuse OS</changelog>
  <changelog author="tiwai@suse.de" date="1491825600">- Update to version 1.0.27:
  * Fix a seek regression in 1.0.26
  * Add metadata read/write for CAF and RF64
  * FIx PAF endian-ness issue
- Update to version 1.0.28
  * Fix buffer overruns in FLAC and ID3 handling code
  (CVE-2017-7585, CVE-2017-7586, bsc#1033054, bsc#1033053)
  * Reduce default header memory requirements
  * Fix detection of Large File Support for 32 bit systems.
- Obsoleted patch:
  libsndfile-psf_strlcpy_crlf-fix-CVE-2015-8075.patch</changelog>
  <changelog author="tiwai@suse.de" date="1493726400">- Fix FLAC buffer overflows (CVE-2017-8361 CVE-2017-8363
  CVE-2017-8365 CVE-2017-8362 bsc#1036944 bsc#1036945 bsc#1036946
  bsc#1036943):
  0001-FLAC-Fix-a-buffer-read-overrun.patch
  0002-src-flac.c-Fix-a-buffer-read-overflow.patch</changelog>
  <changelog author="tiwai@suse.de" date="1497355200">- Fix out-of-bounds read memory access in the aiff_read_chanmap()
  (CVE-2017-6892, bsc#1043978):
  0010-src-aiff.c-Fix-a-buffer-read-overflow.patch</changelog>
  <changelog author="tiwai@suse.de" date="1502193600">- Fix Heap-based Buffer Overflow in the psf_binheader_writef
  (CVE-2017-12562, bsc#1052476):
  0020-src-common.c-Fix-heap-buffer-overflows-when-writing-.patch</changelog>
  <changelog author="tiwai@suse.de" date="1513684800">- Fix VUL-0: divide-by-zero error exists in the function
  double64_init() in double64.c (CVE-2017-14634, bsc#1059911):
  0030-double64_init-Check-psf-sf.channels-against-upper-bo.patch
- Tentative fix for VUL-0: out of bounds read in the function
  d2alaw_array() in alaw.c (CVE-2017-14245, bsc#1059912) and
  VUL-0: out of bounds read in the function d2ulaw_array() in
  ulaw.c (CVE-2017-14246, bsc#1059913):
  0031-sfe_copy_data_fp-check-value-of-max-variable.patch</changelog>
  <changelog author="tiwai@suse.de" date="1528459200">- Fix potential overflow in d2alaw_array() (CVE-2017-17456,
  bsc#1071777):
  libsndfile-CVE-2017-17456-alaw-range-check.patch
- Fix potential overflow in d2ulaw_array() (CVE-2017-17457,
  bsc#1071767):
  libsndfile-CVE-2017-17457-ulaw-range-check.patch</changelog>
  <changelog author="tiwai@suse.de" date="1528459201">- Use license file tag</changelog>
  <changelog author="tiwai@suse.de" date="1530878400">- Fix buffer overflow in sndfile-deinterleave, which isn't really a
  security issue (bsc#1100167, CVE-2018-13139, bsc#1116993,
  CVE-2018-19432):
  sndfile-deinterlace-channels-check.patch</changelog>
  <changelog author="tiwai@suse.de" date="1543924800">- Fix segfault in wav conversion due to the invalid loop count
  (CVE-2018-19758, bsc#1117954):
  libsndfile-wav-loop-count-fix.patch</changelog>
  <changelog author="tiwai@suse.de" date="1627041600">- Fix heap buffer overflow vulnerability in msadpcm_decode_block
  (CVE-2021-3246, bsc#1188540):
  ms_adpcm-Fix-and-extend-size-checks.patch</changelog>
  <changelog author="tiwai@suse.de" date="1641211200">- Fix heap buffer overflow in flac_buffer_copy (CVE-2021-4156,
  bsc#1194006):
  libsndfile-CVE-2021-4156.patch</changelog>
</package>
<package pkgid="f51ec27c18ff9e0bab4a4fc2e766b35528c93b26ba86f04eec15b87ffa4f401d" name="libsndfile-progs" arch="aarch64">
  <version epoch="0" ver="1.0.28" rel="5.15.1"/>
  <changelog author="oliver.bengs@opensuse.org" date="1300881600">- Update to version 1.0.24
- Upstream changes :
  * WAV files are now written with an 18 byte u-law and A-law fmt chunk
  * A document on virtual I/O functionality was added
  * Two new methods were added in sndfile.hh
  * A fix was made for a non-zero SSND offset values on AIFF
  * Minor bug fixes and improvements were done</changelog>
  <changelog author="tiwai@suse.de" date="1310990400">- updated to version 1.0.25:
  Fix for Secunia Advisory SA45125 (CVE-2011-2696, bnc#705681)
  Minor bug fixes and improvements</changelog>
  <changelog author="tiwai@suse.de" date="1311940800">- Fix zero-division in PAF parser (bnc#708988)</changelog>
  <changelog author="jengelh@medozas.de" date="1321876800">- Remove redundant/unwanted tags/section (cf. specfile guidelines)</changelog>
  <changelog author="mmeister@suse.com" date="1366027200">- Added url as source.
  Please see http://en.opensuse.org/SourceUrls</changelog>
  <changelog author="mpluskal@suse.com" date="1426939200">- Cleanup spec file with spec-cleaner
- Add gpg signature</changelog>
  <changelog author="tiwai@suse.de" date="1448280000">- Update to version 1.0.26:
  * Fix for CVE-2014-9496, CVE-2014-9756 and CVE-2015-7805.
  * Add ALAC/CAF support. Minor bug fixes and improvements.
- Drop libsndfile-example-fix.diff</changelog>
  <changelog author="idonmez@suse.com" date="1448366400">- Remove documentation, it belongs to the libsndfile package.</changelog>
  <changelog author="tiwai@suse.de" date="1491825600">- Update to version 1.0.27:
  * Fix a seek regression in 1.0.26
  * Add metadata read/write for CAF and RF64
  * FIx PAF endian-ness issue
- Update to version 1.0.28
  * Fix buffer overruns in FLAC and ID3 handling code
  (CVE-2017-7585, CVE-2017-7586, bsc#1033054, bsc#1033053)
  * Reduce default header memory requirements
  * Fix detection of Large File Support for 32 bit systems.
- Obsoleted patch:
  libsndfile-psf_strlcpy_crlf-fix-CVE-2015-8075.patch</changelog>
  <changelog author="tiwai@suse.de" date="1530878400">- Fix buffer overflow in sndfile-deinterleave, which isn't really a
  security issue (bsc#1100167, CVE-2018-13139, bsc#1116993,
  CVE-2018-19432):
  (Apply all the rest as well to sync with libsndfile.spec)
  0001-FLAC-Fix-a-buffer-read-overrun.patch
  0002-src-flac.c-Fix-a-buffer-read-overflow.patch
  0010-src-aiff.c-Fix-a-buffer-read-overflow.patch
  0020-src-common.c-Fix-heap-buffer-overflows-when-writing-.patch
  0030-double64_init-Check-psf-sf.channels-against-upper-bo.patch
  0031-sfe_copy_data_fp-check-value-of-max-variable.patch
  libsndfile-CVE-2017-17456-alaw-range-check.patch
  libsndfile-CVE-2017-17457-ulaw-range-check.patch
  sndfile-deinterlace-channels-check.patch
  sndfile-ocloexec.patch</changelog>
</package>
<package pkgid="f0457c905daa69110756e30bc6e01e17620a57a7fca51b8de3a460aa2294598c" name="libsndfile-progs" arch="ppc64le">
  <version epoch="0" ver="1.0.28" rel="5.15.1"/>
  <changelog author="oliver.bengs@opensuse.org" date="1300881600">- Update to version 1.0.24
- Upstream changes :
  * WAV files are now written with an 18 byte u-law and A-law fmt chunk
  * A document on virtual I/O functionality was added
  * Two new methods were added in sndfile.hh
  * A fix was made for a non-zero SSND offset values on AIFF
  * Minor bug fixes and improvements were done</changelog>
  <changelog author="tiwai@suse.de" date="1310990400">- updated to version 1.0.25:
  Fix for Secunia Advisory SA45125 (CVE-2011-2696, bnc#705681)
  Minor bug fixes and improvements</changelog>
  <changelog author="tiwai@suse.de" date="1311940800">- Fix zero-division in PAF parser (bnc#708988)</changelog>
  <changelog author="jengelh@medozas.de" date="1321876800">- Remove redundant/unwanted tags/section (cf. specfile guidelines)</changelog>
  <changelog author="mmeister@suse.com" date="1366027200">- Added url as source.
  Please see http://en.opensuse.org/SourceUrls</changelog>
  <changelog author="mpluskal@suse.com" date="1426939200">- Cleanup spec file with spec-cleaner
- Add gpg signature</changelog>
  <changelog author="tiwai@suse.de" date="1448280000">- Update to version 1.0.26:
  * Fix for CVE-2014-9496, CVE-2014-9756 and CVE-2015-7805.
  * Add ALAC/CAF support. Minor bug fixes and improvements.
- Drop libsndfile-example-fix.diff</changelog>
  <changelog author="idonmez@suse.com" date="1448366400">- Remove documentation, it belongs to the libsndfile package.</changelog>
  <changelog author="tiwai@suse.de" date="1491825600">- Update to version 1.0.27:
  * Fix a seek regression in 1.0.26
  * Add metadata read/write for CAF and RF64
  * FIx PAF endian-ness issue
- Update to version 1.0.28
  * Fix buffer overruns in FLAC and ID3 handling code
  (CVE-2017-7585, CVE-2017-7586, bsc#1033054, bsc#1033053)
  * Reduce default header memory requirements
  * Fix detection of Large File Support for 32 bit systems.
- Obsoleted patch:
  libsndfile-psf_strlcpy_crlf-fix-CVE-2015-8075.patch</changelog>
  <changelog author="tiwai@suse.de" date="1530878400">- Fix buffer overflow in sndfile-deinterleave, which isn't really a
  security issue (bsc#1100167, CVE-2018-13139, bsc#1116993,
  CVE-2018-19432):
  (Apply all the rest as well to sync with libsndfile.spec)
  0001-FLAC-Fix-a-buffer-read-overrun.patch
  0002-src-flac.c-Fix-a-buffer-read-overflow.patch
  0010-src-aiff.c-Fix-a-buffer-read-overflow.patch
  0020-src-common.c-Fix-heap-buffer-overflows-when-writing-.patch
  0030-double64_init-Check-psf-sf.channels-against-upper-bo.patch
  0031-sfe_copy_data_fp-check-value-of-max-variable.patch
  libsndfile-CVE-2017-17456-alaw-range-check.patch
  libsndfile-CVE-2017-17457-ulaw-range-check.patch
  sndfile-deinterlace-channels-check.patch
  sndfile-ocloexec.patch</changelog>
</package>
<package pkgid="3166bd33ee93eb22a1e5402ab7285b3e1f2fcd45c082855508c3f40fcb6a3c29" name="libsndfile-progs" arch="s390x">
  <version epoch="0" ver="1.0.28" rel="5.15.1"/>
  <changelog author="oliver.bengs@opensuse.org" date="1300881600">- Update to version 1.0.24
- Upstream changes :
  * WAV files are now written with an 18 byte u-law and A-law fmt chunk
  * A document on virtual I/O functionality was added
  * Two new methods were added in sndfile.hh
  * A fix was made for a non-zero SSND offset values on AIFF
  * Minor bug fixes and improvements were done</changelog>
  <changelog author="tiwai@suse.de" date="1310990400">- updated to version 1.0.25:
  Fix for Secunia Advisory SA45125 (CVE-2011-2696, bnc#705681)
  Minor bug fixes and improvements</changelog>
  <changelog author="tiwai@suse.de" date="1311940800">- Fix zero-division in PAF parser (bnc#708988)</changelog>
  <changelog author="jengelh@medozas.de" date="1321876800">- Remove redundant/unwanted tags/section (cf. specfile guidelines)</changelog>
  <changelog author="mmeister@suse.com" date="1366027200">- Added url as source.
  Please see http://en.opensuse.org/SourceUrls</changelog>
  <changelog author="mpluskal@suse.com" date="1426939200">- Cleanup spec file with spec-cleaner
- Add gpg signature</changelog>
  <changelog author="tiwai@suse.de" date="1448280000">- Update to version 1.0.26:
  * Fix for CVE-2014-9496, CVE-2014-9756 and CVE-2015-7805.
  * Add ALAC/CAF support. Minor bug fixes and improvements.
- Drop libsndfile-example-fix.diff</changelog>
  <changelog author="idonmez@suse.com" date="1448366400">- Remove documentation, it belongs to the libsndfile package.</changelog>
  <changelog author="tiwai@suse.de" date="1491825600">- Update to version 1.0.27:
  * Fix a seek regression in 1.0.26
  * Add metadata read/write for CAF and RF64
  * FIx PAF endian-ness issue
- Update to version 1.0.28
  * Fix buffer overruns in FLAC and ID3 handling code
  (CVE-2017-7585, CVE-2017-7586, bsc#1033054, bsc#1033053)
  * Reduce default header memory requirements
  * Fix detection of Large File Support for 32 bit systems.
- Obsoleted patch:
  libsndfile-psf_strlcpy_crlf-fix-CVE-2015-8075.patch</changelog>
  <changelog author="tiwai@suse.de" date="1530878400">- Fix buffer overflow in sndfile-deinterleave, which isn't really a
  security issue (bsc#1100167, CVE-2018-13139, bsc#1116993,
  CVE-2018-19432):
  (Apply all the rest as well to sync with libsndfile.spec)
  0001-FLAC-Fix-a-buffer-read-overrun.patch
  0002-src-flac.c-Fix-a-buffer-read-overflow.patch
  0010-src-aiff.c-Fix-a-buffer-read-overflow.patch
  0020-src-common.c-Fix-heap-buffer-overflows-when-writing-.patch
  0030-double64_init-Check-psf-sf.channels-against-upper-bo.patch
  0031-sfe_copy_data_fp-check-value-of-max-variable.patch
  libsndfile-CVE-2017-17456-alaw-range-check.patch
  libsndfile-CVE-2017-17457-ulaw-range-check.patch
  sndfile-deinterlace-channels-check.patch
  sndfile-ocloexec.patch</changelog>
</package>
<package pkgid="7fb7bf352208dc41dbe59cc2d57efeab0f46cd6e8d72fe2bbf594d7ce3788df4" name="libsndfile-progs" arch="src">
  <version epoch="0" ver="1.0.28" rel="5.15.1"/>
  <changelog author="olh@suse.de" date="1231329600">- obsolete old -XXbit packages (bnc#437293)</changelog>
  <changelog author="tiwai@suse.de" date="1234180800">- updated to version 1.0.18
  * Add Ogg/Vorbis support (disabled right now due to vorbis
    version mismatch; SVN version is required)
  * Remove captive FLAC library.
  * Many new features and bug fixes.
  * Generate Win32 and Win64 pre-compiled binaries.
- Dropped libsndfile-octave subpackage (as octave itself is
  dropped from FACTORY)</changelog>
  <changelog author="tiwai@suse.de" date="1236168000">- updated to version 1.0.19:
  * Fix for CVE-2009-0186 (bnc#481769 - VUL-0: libsndfile CAF
    Processing Integer Overflow Vulnerability)
  * Huge number of minor fixes as a result of static analysis
- remove INSTALL file from filelist</changelog>
  <changelog author="tiwai@suse.de" date="1240574400">- built progs subpackage from an individual spec file to cut the
  circular dependency with jack.</changelog>
  <changelog author="ro@suse.de" date="1240833600">- buildfix: tar basedir is libsndfile not libsndfile-progs</changelog>
  <changelog author="tiwai@suse.de" date="1242388800">- updated to version 1.0.20:
  * Fix for potential heap overflow
- enable ogg/vorbis support</changelog>
  <changelog author="dmueller@suse.de" date="1244030400">- explicitely enable sqlite support to avoid random flipping</changelog>
  <changelog author="tiwai@suse.de" date="1281960000">- updated to version 1.0.21:
  * Bunch of minor bug fixes.
  * including VUL-1 divide-by-zero fix (bnc#631379)</changelog>
  <changelog author="davejplater@gmail.com" date="1286539200">- Update to version 1.0.22
- Upstream changes :
  * Bunch of minor bug fixes.</changelog>
  <changelog author="oliver.bengs@opensuse.org" date="1286798400">- Update to version 1.0.23:
- Upstream changes :
  * configure.ac src/version-metadata.rc.in src/Makefile.am
    Add version string resources to the windows DLL.
  * doc/api.html
    Update to add missing SF_FORMAT_* values. Closed Debian bug #545257.
  * NEWS README configure.ac doc/*.html
    Updates for 1.0.23 release.
  * Other minor bug fixes</changelog>
  <changelog author="oliver.bengs@opensuse.org" date="1300881600">- Update to version 1.0.24
- Upstream changes :
  * WAV files are now written with an 18 byte u-law and A-law fmt chunk
  * A document on virtual I/O functionality was added
  * Two new methods were added in sndfile.hh
  * A fix was made for a non-zero SSND offset values on AIFF
  * Minor bug fixes and improvements were done</changelog>
  <changelog author="tiwai@suse.de" date="1310990400">- updated to version 1.0.25:
  Fix for Secunia Advisory SA45125 (CVE-2011-2696, bnc#705681)
  Minor bug fixes and improvements</changelog>
  <changelog author="tiwai@suse.de" date="1311940800">- Fix zero-division in PAF parser (bnc#708988)</changelog>
  <changelog author="jengelh@medozas.de" date="1321876800">- Remove redundant/unwanted tags/section (cf. specfile guidelines)</changelog>
  <changelog author="mmeister@suse.com" date="1366027200">- Added url as source.
  Please see http://en.opensuse.org/SourceUrls</changelog>
  <changelog author="mpluskal@suse.com" date="1426939200">- Cleanup spec file with spec-cleaner
- Add gpg signature</changelog>
  <changelog author="tiwai@suse.de" date="1448280000">- Update to version 1.0.26:
  * Fix for CVE-2014-9496, CVE-2014-9756 and CVE-2015-7805.
  * Add ALAC/CAF support. Minor bug fixes and improvements.
- Drop libsndfile-example-fix.diff</changelog>
  <changelog author="idonmez@suse.com" date="1448366400">- Remove documentation, it belongs to the libsndfile package.</changelog>
  <changelog author="tiwai@suse.de" date="1491825600">- Update to version 1.0.27:
  * Fix a seek regression in 1.0.26
  * Add metadata read/write for CAF and RF64
  * FIx PAF endian-ness issue
- Update to version 1.0.28
  * Fix buffer overruns in FLAC and ID3 handling code
  (CVE-2017-7585, CVE-2017-7586, bsc#1033054, bsc#1033053)
  * Reduce default header memory requirements
  * Fix detection of Large File Support for 32 bit systems.
- Obsoleted patch:
  libsndfile-psf_strlcpy_crlf-fix-CVE-2015-8075.patch</changelog>
  <changelog author="tiwai@suse.de" date="1530878400">- Fix buffer overflow in sndfile-deinterleave, which isn't really a
  security issue (bsc#1100167, CVE-2018-13139, bsc#1116993,
  CVE-2018-19432):
  (Apply all the rest as well to sync with libsndfile.spec)
  0001-FLAC-Fix-a-buffer-read-overrun.patch
  0002-src-flac.c-Fix-a-buffer-read-overflow.patch
  0010-src-aiff.c-Fix-a-buffer-read-overflow.patch
  0020-src-common.c-Fix-heap-buffer-overflows-when-writing-.patch
  0030-double64_init-Check-psf-sf.channels-against-upper-bo.patch
  0031-sfe_copy_data_fp-check-value-of-max-variable.patch
  libsndfile-CVE-2017-17456-alaw-range-check.patch
  libsndfile-CVE-2017-17457-ulaw-range-check.patch
  sndfile-deinterlace-channels-check.patch
  sndfile-ocloexec.patch</changelog>
</package>
<package pkgid="10e302aeb69e72134c85eac6588f2491542c932b77c0fedda23e8b41ae744252" name="libsndfile-progs" arch="x86_64">
  <version epoch="0" ver="1.0.28" rel="5.15.1"/>
  <changelog author="oliver.bengs@opensuse.org" date="1300881600">- Update to version 1.0.24
- Upstream changes :
  * WAV files are now written with an 18 byte u-law and A-law fmt chunk
  * A document on virtual I/O functionality was added
  * Two new methods were added in sndfile.hh
  * A fix was made for a non-zero SSND offset values on AIFF
  * Minor bug fixes and improvements were done</changelog>
  <changelog author="tiwai@suse.de" date="1310990400">- updated to version 1.0.25:
  Fix for Secunia Advisory SA45125 (CVE-2011-2696, bnc#705681)
  Minor bug fixes and improvements</changelog>
  <changelog author="tiwai@suse.de" date="1311940800">- Fix zero-division in PAF parser (bnc#708988)</changelog>
  <changelog author="jengelh@medozas.de" date="1321876800">- Remove redundant/unwanted tags/section (cf. specfile guidelines)</changelog>
  <changelog author="mmeister@suse.com" date="1366027200">- Added url as source.
  Please see http://en.opensuse.org/SourceUrls</changelog>
  <changelog author="mpluskal@suse.com" date="1426939200">- Cleanup spec file with spec-cleaner
- Add gpg signature</changelog>
  <changelog author="tiwai@suse.de" date="1448280000">- Update to version 1.0.26:
  * Fix for CVE-2014-9496, CVE-2014-9756 and CVE-2015-7805.
  * Add ALAC/CAF support. Minor bug fixes and improvements.
- Drop libsndfile-example-fix.diff</changelog>
  <changelog author="idonmez@suse.com" date="1448366400">- Remove documentation, it belongs to the libsndfile package.</changelog>
  <changelog author="tiwai@suse.de" date="1491825600">- Update to version 1.0.27:
  * Fix a seek regression in 1.0.26
  * Add metadata read/write for CAF and RF64
  * FIx PAF endian-ness issue
- Update to version 1.0.28
  * Fix buffer overruns in FLAC and ID3 handling code
  (CVE-2017-7585, CVE-2017-7586, bsc#1033054, bsc#1033053)
  * Reduce default header memory requirements
  * Fix detection of Large File Support for 32 bit systems.
- Obsoleted patch:
  libsndfile-psf_strlcpy_crlf-fix-CVE-2015-8075.patch</changelog>
  <changelog author="tiwai@suse.de" date="1530878400">- Fix buffer overflow in sndfile-deinterleave, which isn't really a
  security issue (bsc#1100167, CVE-2018-13139, bsc#1116993,
  CVE-2018-19432):
  (Apply all the rest as well to sync with libsndfile.spec)
  0001-FLAC-Fix-a-buffer-read-overrun.patch
  0002-src-flac.c-Fix-a-buffer-read-overflow.patch
  0010-src-aiff.c-Fix-a-buffer-read-overflow.patch
  0020-src-common.c-Fix-heap-buffer-overflows-when-writing-.patch
  0030-double64_init-Check-psf-sf.channels-against-upper-bo.patch
  0031-sfe_copy_data_fp-check-value-of-max-variable.patch
  libsndfile-CVE-2017-17456-alaw-range-check.patch
  libsndfile-CVE-2017-17457-ulaw-range-check.patch
  sndfile-deinterlace-channels-check.patch
  sndfile-ocloexec.patch</changelog>
</package>
<package pkgid="4887bd4596c877d6eb27ed7744095f58195f5f29883b3265ffb7d69f7b8e2a5c" name="libsndfile1" arch="aarch64">
  <version epoch="0" ver="1.0.28" rel="5.15.1"/>
  <changelog author="tiwai@suse.de" date="1420632000">- VUL-0: two buffer read overflows in sd2_parse_rsrc_fork()
  (CVE-2014-9496, bnc#911796): backported upstream fix patches
  sndfile-src-sd2.c-Fix-segfault-in-SD2-RSRC-parser.patch
  sndfile-src-sd2.c-Fix-two-potential-buffer-read-overflows.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1426939200">- Cleanup spec file with spec-cleaner
- Add gpg signature
- Remove old ppc provides/obsoletes</changelog>
  <changelog author="tiwai@suse.de" date="1446638400">- VUL-1: libsndfile DoS/divide-by-zero (CVE-2014-9756, bsc#953521):
  libsndfile-src-file_io.c-Prevent-potential-divide-by-zero.patch</changelog>
  <changelog author="tiwai@suse.de" date="1446638401">- VUL-0: libsndfile 1.0.25 heap overflow (CVE-2015-7805, bsc#953516)
  libsndfile-src-common.c-Fix-a-header-parsing-bug.patch
  libsndfile-fix-header-read-CVE-2015-7805.patch
- VUL-0: libsndfile 1.0.25 heap overflow (CVE-2015-8075, bsc#953519)
  libsndfile-psf_strlcpy_crlf-fix-CVE-2015-8075.patch
- Fix the build with SLE11-SP3 due to AM_SILENT_RULE macro</changelog>
  <changelog author="tiwai@suse.de" date="1448280000">- Update to version 1.0.26:
  * Fix for CVE-2014-9496, CVE-2014-9756 and CVE-2015-7805.
  * Add ALAC/CAF support. Minor bug fixes and improvements.
- Refreshed patches:
  sndfile-ocloexec.patch
  libsndfile-psf_strlcpy_crlf-fix-CVE-2015-8075.patch
- Removed obsoleted patches:
  libsndfile-example-fix.diff
  libsndfile-fix-header-read-CVE-2015-7805.patch
  libsndfile-paf-zero-division-fix.diff
  libsndfile-src-common.c-Fix-a-header-parsing-bug.patch
  libsndfile-src-file_io.c-Prevent-potential-divide-by-zero.patch
  sndfile-src-sd2.c-Fix-segfault-in-SD2-RSRC-parser.patch
  sndfile-src-sd2.c-Fix-two-potential-buffer-read-overflows.patch</changelog>
  <changelog author="tom.mbrt@googlemail.com" date="1462881600">- Fix spec file to enable builds on non opensuse OS</changelog>
  <changelog author="tiwai@suse.de" date="1491825600">- Update to version 1.0.27:
  * Fix a seek regression in 1.0.26
  * Add metadata read/write for CAF and RF64
  * FIx PAF endian-ness issue
- Update to version 1.0.28
  * Fix buffer overruns in FLAC and ID3 handling code
  (CVE-2017-7585, CVE-2017-7586, bsc#1033054, bsc#1033053)
  * Reduce default header memory requirements
  * Fix detection of Large File Support for 32 bit systems.
- Obsoleted patch:
  libsndfile-psf_strlcpy_crlf-fix-CVE-2015-8075.patch</changelog>
  <changelog author="tiwai@suse.de" date="1493726400">- Fix FLAC buffer overflows (CVE-2017-8361 CVE-2017-8363
  CVE-2017-8365 CVE-2017-8362 bsc#1036944 bsc#1036945 bsc#1036946
  bsc#1036943):
  0001-FLAC-Fix-a-buffer-read-overrun.patch
  0002-src-flac.c-Fix-a-buffer-read-overflow.patch</changelog>
  <changelog author="tiwai@suse.de" date="1497355200">- Fix out-of-bounds read memory access in the aiff_read_chanmap()
  (CVE-2017-6892, bsc#1043978):
  0010-src-aiff.c-Fix-a-buffer-read-overflow.patch</changelog>
  <changelog author="tiwai@suse.de" date="1502193600">- Fix Heap-based Buffer Overflow in the psf_binheader_writef
  (CVE-2017-12562, bsc#1052476):
  0020-src-common.c-Fix-heap-buffer-overflows-when-writing-.patch</changelog>
  <changelog author="tiwai@suse.de" date="1513684800">- Fix VUL-0: divide-by-zero error exists in the function
  double64_init() in double64.c (CVE-2017-14634, bsc#1059911):
  0030-double64_init-Check-psf-sf.channels-against-upper-bo.patch
- Tentative fix for VUL-0: out of bounds read in the function
  d2alaw_array() in alaw.c (CVE-2017-14245, bsc#1059912) and
  VUL-0: out of bounds read in the function d2ulaw_array() in
  ulaw.c (CVE-2017-14246, bsc#1059913):
  0031-sfe_copy_data_fp-check-value-of-max-variable.patch</changelog>
  <changelog author="tiwai@suse.de" date="1528459200">- Fix potential overflow in d2alaw_array() (CVE-2017-17456,
  bsc#1071777):
  libsndfile-CVE-2017-17456-alaw-range-check.patch
- Fix potential overflow in d2ulaw_array() (CVE-2017-17457,
  bsc#1071767):
  libsndfile-CVE-2017-17457-ulaw-range-check.patch</changelog>
  <changelog author="tiwai@suse.de" date="1528459201">- Use license file tag</changelog>
  <changelog author="tiwai@suse.de" date="1530878400">- Fix buffer overflow in sndfile-deinterleave, which isn't really a
  security issue (bsc#1100167, CVE-2018-13139, bsc#1116993,
  CVE-2018-19432):
  sndfile-deinterlace-channels-check.patch</changelog>
  <changelog author="tiwai@suse.de" date="1543924800">- Fix segfault in wav conversion due to the invalid loop count
  (CVE-2018-19758, bsc#1117954):
  libsndfile-wav-loop-count-fix.patch</changelog>
  <changelog author="tiwai@suse.de" date="1627041600">- Fix heap buffer overflow vulnerability in msadpcm_decode_block
  (CVE-2021-3246, bsc#1188540):
  ms_adpcm-Fix-and-extend-size-checks.patch</changelog>
  <changelog author="tiwai@suse.de" date="1641211200">- Fix heap buffer overflow in flac_buffer_copy (CVE-2021-4156,
  bsc#1194006):
  libsndfile-CVE-2021-4156.patch</changelog>
</package>
<package pkgid="c7a18696348f2aac44265aeb40a63c53b379300c4021a8bd478ca2ac4af335ff" name="libsndfile1" arch="ppc64le">
  <version epoch="0" ver="1.0.28" rel="5.15.1"/>
  <changelog author="tiwai@suse.de" date="1420632000">- VUL-0: two buffer read overflows in sd2_parse_rsrc_fork()
  (CVE-2014-9496, bnc#911796): backported upstream fix patches
  sndfile-src-sd2.c-Fix-segfault-in-SD2-RSRC-parser.patch
  sndfile-src-sd2.c-Fix-two-potential-buffer-read-overflows.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1426939200">- Cleanup spec file with spec-cleaner
- Add gpg signature
- Remove old ppc provides/obsoletes</changelog>
  <changelog author="tiwai@suse.de" date="1446638400">- VUL-1: libsndfile DoS/divide-by-zero (CVE-2014-9756, bsc#953521):
  libsndfile-src-file_io.c-Prevent-potential-divide-by-zero.patch</changelog>
  <changelog author="tiwai@suse.de" date="1446638401">- VUL-0: libsndfile 1.0.25 heap overflow (CVE-2015-7805, bsc#953516)
  libsndfile-src-common.c-Fix-a-header-parsing-bug.patch
  libsndfile-fix-header-read-CVE-2015-7805.patch
- VUL-0: libsndfile 1.0.25 heap overflow (CVE-2015-8075, bsc#953519)
  libsndfile-psf_strlcpy_crlf-fix-CVE-2015-8075.patch
- Fix the build with SLE11-SP3 due to AM_SILENT_RULE macro</changelog>
  <changelog author="tiwai@suse.de" date="1448280000">- Update to version 1.0.26:
  * Fix for CVE-2014-9496, CVE-2014-9756 and CVE-2015-7805.
  * Add ALAC/CAF support. Minor bug fixes and improvements.
- Refreshed patches:
  sndfile-ocloexec.patch
  libsndfile-psf_strlcpy_crlf-fix-CVE-2015-8075.patch
- Removed obsoleted patches:
  libsndfile-example-fix.diff
  libsndfile-fix-header-read-CVE-2015-7805.patch
  libsndfile-paf-zero-division-fix.diff
  libsndfile-src-common.c-Fix-a-header-parsing-bug.patch
  libsndfile-src-file_io.c-Prevent-potential-divide-by-zero.patch
  sndfile-src-sd2.c-Fix-segfault-in-SD2-RSRC-parser.patch
  sndfile-src-sd2.c-Fix-two-potential-buffer-read-overflows.patch</changelog>
  <changelog author="tom.mbrt@googlemail.com" date="1462881600">- Fix spec file to enable builds on non opensuse OS</changelog>
  <changelog author="tiwai@suse.de" date="1491825600">- Update to version 1.0.27:
  * Fix a seek regression in 1.0.26
  * Add metadata read/write for CAF and RF64
  * FIx PAF endian-ness issue
- Update to version 1.0.28
  * Fix buffer overruns in FLAC and ID3 handling code
  (CVE-2017-7585, CVE-2017-7586, bsc#1033054, bsc#1033053)
  * Reduce default header memory requirements
  * Fix detection of Large File Support for 32 bit systems.
- Obsoleted patch:
  libsndfile-psf_strlcpy_crlf-fix-CVE-2015-8075.patch</changelog>
  <changelog author="tiwai@suse.de" date="1493726400">- Fix FLAC buffer overflows (CVE-2017-8361 CVE-2017-8363
  CVE-2017-8365 CVE-2017-8362 bsc#1036944 bsc#1036945 bsc#1036946
  bsc#1036943):
  0001-FLAC-Fix-a-buffer-read-overrun.patch
  0002-src-flac.c-Fix-a-buffer-read-overflow.patch</changelog>
  <changelog author="tiwai@suse.de" date="1497355200">- Fix out-of-bounds read memory access in the aiff_read_chanmap()
  (CVE-2017-6892, bsc#1043978):
  0010-src-aiff.c-Fix-a-buffer-read-overflow.patch</changelog>
  <changelog author="tiwai@suse.de" date="1502193600">- Fix Heap-based Buffer Overflow in the psf_binheader_writef
  (CVE-2017-12562, bsc#1052476):
  0020-src-common.c-Fix-heap-buffer-overflows-when-writing-.patch</changelog>
  <changelog author="tiwai@suse.de" date="1513684800">- Fix VUL-0: divide-by-zero error exists in the function
  double64_init() in double64.c (CVE-2017-14634, bsc#1059911):
  0030-double64_init-Check-psf-sf.channels-against-upper-bo.patch
- Tentative fix for VUL-0: out of bounds read in the function
  d2alaw_array() in alaw.c (CVE-2017-14245, bsc#1059912) and
  VUL-0: out of bounds read in the function d2ulaw_array() in
  ulaw.c (CVE-2017-14246, bsc#1059913):
  0031-sfe_copy_data_fp-check-value-of-max-variable.patch</changelog>
  <changelog author="tiwai@suse.de" date="1528459200">- Fix potential overflow in d2alaw_array() (CVE-2017-17456,
  bsc#1071777):
  libsndfile-CVE-2017-17456-alaw-range-check.patch
- Fix potential overflow in d2ulaw_array() (CVE-2017-17457,
  bsc#1071767):
  libsndfile-CVE-2017-17457-ulaw-range-check.patch</changelog>
  <changelog author="tiwai@suse.de" date="1528459201">- Use license file tag</changelog>
  <changelog author="tiwai@suse.de" date="1530878400">- Fix buffer overflow in sndfile-deinterleave, which isn't really a
  security issue (bsc#1100167, CVE-2018-13139, bsc#1116993,
  CVE-2018-19432):
  sndfile-deinterlace-channels-check.patch</changelog>
  <changelog author="tiwai@suse.de" date="1543924800">- Fix segfault in wav conversion due to the invalid loop count
  (CVE-2018-19758, bsc#1117954):
  libsndfile-wav-loop-count-fix.patch</changelog>
  <changelog author="tiwai@suse.de" date="1627041600">- Fix heap buffer overflow vulnerability in msadpcm_decode_block
  (CVE-2021-3246, bsc#1188540):
  ms_adpcm-Fix-and-extend-size-checks.patch</changelog>
  <changelog author="tiwai@suse.de" date="1641211200">- Fix heap buffer overflow in flac_buffer_copy (CVE-2021-4156,
  bsc#1194006):
  libsndfile-CVE-2021-4156.patch</changelog>
</package>
<package pkgid="bd855247ad426627ff254b87adf09da79ff38a06786f142e9aed09e44492f9ad" name="libsndfile1" arch="s390x">
  <version epoch="0" ver="1.0.28" rel="5.15.1"/>
  <changelog author="tiwai@suse.de" date="1420632000">- VUL-0: two buffer read overflows in sd2_parse_rsrc_fork()
  (CVE-2014-9496, bnc#911796): backported upstream fix patches
  sndfile-src-sd2.c-Fix-segfault-in-SD2-RSRC-parser.patch
  sndfile-src-sd2.c-Fix-two-potential-buffer-read-overflows.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1426939200">- Cleanup spec file with spec-cleaner
- Add gpg signature
- Remove old ppc provides/obsoletes</changelog>
  <changelog author="tiwai@suse.de" date="1446638400">- VUL-1: libsndfile DoS/divide-by-zero (CVE-2014-9756, bsc#953521):
  libsndfile-src-file_io.c-Prevent-potential-divide-by-zero.patch</changelog>
  <changelog author="tiwai@suse.de" date="1446638401">- VUL-0: libsndfile 1.0.25 heap overflow (CVE-2015-7805, bsc#953516)
  libsndfile-src-common.c-Fix-a-header-parsing-bug.patch
  libsndfile-fix-header-read-CVE-2015-7805.patch
- VUL-0: libsndfile 1.0.25 heap overflow (CVE-2015-8075, bsc#953519)
  libsndfile-psf_strlcpy_crlf-fix-CVE-2015-8075.patch
- Fix the build with SLE11-SP3 due to AM_SILENT_RULE macro</changelog>
  <changelog author="tiwai@suse.de" date="1448280000">- Update to version 1.0.26:
  * Fix for CVE-2014-9496, CVE-2014-9756 and CVE-2015-7805.
  * Add ALAC/CAF support. Minor bug fixes and improvements.
- Refreshed patches:
  sndfile-ocloexec.patch
  libsndfile-psf_strlcpy_crlf-fix-CVE-2015-8075.patch
- Removed obsoleted patches:
  libsndfile-example-fix.diff
  libsndfile-fix-header-read-CVE-2015-7805.patch
  libsndfile-paf-zero-division-fix.diff
  libsndfile-src-common.c-Fix-a-header-parsing-bug.patch
  libsndfile-src-file_io.c-Prevent-potential-divide-by-zero.patch
  sndfile-src-sd2.c-Fix-segfault-in-SD2-RSRC-parser.patch
  sndfile-src-sd2.c-Fix-two-potential-buffer-read-overflows.patch</changelog>
  <changelog author="tom.mbrt@googlemail.com" date="1462881600">- Fix spec file to enable builds on non opensuse OS</changelog>
  <changelog author="tiwai@suse.de" date="1491825600">- Update to version 1.0.27:
  * Fix a seek regression in 1.0.26
  * Add metadata read/write for CAF and RF64
  * FIx PAF endian-ness issue
- Update to version 1.0.28
  * Fix buffer overruns in FLAC and ID3 handling code
  (CVE-2017-7585, CVE-2017-7586, bsc#1033054, bsc#1033053)
  * Reduce default header memory requirements
  * Fix detection of Large File Support for 32 bit systems.
- Obsoleted patch:
  libsndfile-psf_strlcpy_crlf-fix-CVE-2015-8075.patch</changelog>
  <changelog author="tiwai@suse.de" date="1493726400">- Fix FLAC buffer overflows (CVE-2017-8361 CVE-2017-8363
  CVE-2017-8365 CVE-2017-8362 bsc#1036944 bsc#1036945 bsc#1036946
  bsc#1036943):
  0001-FLAC-Fix-a-buffer-read-overrun.patch
  0002-src-flac.c-Fix-a-buffer-read-overflow.patch</changelog>
  <changelog author="tiwai@suse.de" date="1497355200">- Fix out-of-bounds read memory access in the aiff_read_chanmap()
  (CVE-2017-6892, bsc#1043978):
  0010-src-aiff.c-Fix-a-buffer-read-overflow.patch</changelog>
  <changelog author="tiwai@suse.de" date="1502193600">- Fix Heap-based Buffer Overflow in the psf_binheader_writef
  (CVE-2017-12562, bsc#1052476):
  0020-src-common.c-Fix-heap-buffer-overflows-when-writing-.patch</changelog>
  <changelog author="tiwai@suse.de" date="1513684800">- Fix VUL-0: divide-by-zero error exists in the function
  double64_init() in double64.c (CVE-2017-14634, bsc#1059911):
  0030-double64_init-Check-psf-sf.channels-against-upper-bo.patch
- Tentative fix for VUL-0: out of bounds read in the function
  d2alaw_array() in alaw.c (CVE-2017-14245, bsc#1059912) and
  VUL-0: out of bounds read in the function d2ulaw_array() in
  ulaw.c (CVE-2017-14246, bsc#1059913):
  0031-sfe_copy_data_fp-check-value-of-max-variable.patch</changelog>
  <changelog author="tiwai@suse.de" date="1528459200">- Fix potential overflow in d2alaw_array() (CVE-2017-17456,
  bsc#1071777):
  libsndfile-CVE-2017-17456-alaw-range-check.patch
- Fix potential overflow in d2ulaw_array() (CVE-2017-17457,
  bsc#1071767):
  libsndfile-CVE-2017-17457-ulaw-range-check.patch</changelog>
  <changelog author="tiwai@suse.de" date="1528459201">- Use license file tag</changelog>
  <changelog author="tiwai@suse.de" date="1530878400">- Fix buffer overflow in sndfile-deinterleave, which isn't really a
  security issue (bsc#1100167, CVE-2018-13139, bsc#1116993,
  CVE-2018-19432):
  sndfile-deinterlace-channels-check.patch</changelog>
  <changelog author="tiwai@suse.de" date="1543924800">- Fix segfault in wav conversion due to the invalid loop count
  (CVE-2018-19758, bsc#1117954):
  libsndfile-wav-loop-count-fix.patch</changelog>
  <changelog author="tiwai@suse.de" date="1627041600">- Fix heap buffer overflow vulnerability in msadpcm_decode_block
  (CVE-2021-3246, bsc#1188540):
  ms_adpcm-Fix-and-extend-size-checks.patch</changelog>
  <changelog author="tiwai@suse.de" date="1641211200">- Fix heap buffer overflow in flac_buffer_copy (CVE-2021-4156,
  bsc#1194006):
  libsndfile-CVE-2021-4156.patch</changelog>
</package>
<package pkgid="4428bc090ccc0c66a67a943ae05325df2fb45a6583cc1ca349aad9673757ccd9" name="libsndfile1" arch="x86_64">
  <version epoch="0" ver="1.0.28" rel="5.15.1"/>
  <changelog author="tiwai@suse.de" date="1420632000">- VUL-0: two buffer read overflows in sd2_parse_rsrc_fork()
  (CVE-2014-9496, bnc#911796): backported upstream fix patches
  sndfile-src-sd2.c-Fix-segfault-in-SD2-RSRC-parser.patch
  sndfile-src-sd2.c-Fix-two-potential-buffer-read-overflows.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1426939200">- Cleanup spec file with spec-cleaner
- Add gpg signature
- Remove old ppc provides/obsoletes</changelog>
  <changelog author="tiwai@suse.de" date="1446638400">- VUL-1: libsndfile DoS/divide-by-zero (CVE-2014-9756, bsc#953521):
  libsndfile-src-file_io.c-Prevent-potential-divide-by-zero.patch</changelog>
  <changelog author="tiwai@suse.de" date="1446638401">- VUL-0: libsndfile 1.0.25 heap overflow (CVE-2015-7805, bsc#953516)
  libsndfile-src-common.c-Fix-a-header-parsing-bug.patch
  libsndfile-fix-header-read-CVE-2015-7805.patch
- VUL-0: libsndfile 1.0.25 heap overflow (CVE-2015-8075, bsc#953519)
  libsndfile-psf_strlcpy_crlf-fix-CVE-2015-8075.patch
- Fix the build with SLE11-SP3 due to AM_SILENT_RULE macro</changelog>
  <changelog author="tiwai@suse.de" date="1448280000">- Update to version 1.0.26:
  * Fix for CVE-2014-9496, CVE-2014-9756 and CVE-2015-7805.
  * Add ALAC/CAF support. Minor bug fixes and improvements.
- Refreshed patches:
  sndfile-ocloexec.patch
  libsndfile-psf_strlcpy_crlf-fix-CVE-2015-8075.patch
- Removed obsoleted patches:
  libsndfile-example-fix.diff
  libsndfile-fix-header-read-CVE-2015-7805.patch
  libsndfile-paf-zero-division-fix.diff
  libsndfile-src-common.c-Fix-a-header-parsing-bug.patch
  libsndfile-src-file_io.c-Prevent-potential-divide-by-zero.patch
  sndfile-src-sd2.c-Fix-segfault-in-SD2-RSRC-parser.patch
  sndfile-src-sd2.c-Fix-two-potential-buffer-read-overflows.patch</changelog>
  <changelog author="tom.mbrt@googlemail.com" date="1462881600">- Fix spec file to enable builds on non opensuse OS</changelog>
  <changelog author="tiwai@suse.de" date="1491825600">- Update to version 1.0.27:
  * Fix a seek regression in 1.0.26
  * Add metadata read/write for CAF and RF64
  * FIx PAF endian-ness issue
- Update to version 1.0.28
  * Fix buffer overruns in FLAC and ID3 handling code
  (CVE-2017-7585, CVE-2017-7586, bsc#1033054, bsc#1033053)
  * Reduce default header memory requirements
  * Fix detection of Large File Support for 32 bit systems.
- Obsoleted patch:
  libsndfile-psf_strlcpy_crlf-fix-CVE-2015-8075.patch</changelog>
  <changelog author="tiwai@suse.de" date="1493726400">- Fix FLAC buffer overflows (CVE-2017-8361 CVE-2017-8363
  CVE-2017-8365 CVE-2017-8362 bsc#1036944 bsc#1036945 bsc#1036946
  bsc#1036943):
  0001-FLAC-Fix-a-buffer-read-overrun.patch
  0002-src-flac.c-Fix-a-buffer-read-overflow.patch</changelog>
  <changelog author="tiwai@suse.de" date="1497355200">- Fix out-of-bounds read memory access in the aiff_read_chanmap()
  (CVE-2017-6892, bsc#1043978):
  0010-src-aiff.c-Fix-a-buffer-read-overflow.patch</changelog>
  <changelog author="tiwai@suse.de" date="1502193600">- Fix Heap-based Buffer Overflow in the psf_binheader_writef
  (CVE-2017-12562, bsc#1052476):
  0020-src-common.c-Fix-heap-buffer-overflows-when-writing-.patch</changelog>
  <changelog author="tiwai@suse.de" date="1513684800">- Fix VUL-0: divide-by-zero error exists in the function
  double64_init() in double64.c (CVE-2017-14634, bsc#1059911):
  0030-double64_init-Check-psf-sf.channels-against-upper-bo.patch
- Tentative fix for VUL-0: out of bounds read in the function
  d2alaw_array() in alaw.c (CVE-2017-14245, bsc#1059912) and
  VUL-0: out of bounds read in the function d2ulaw_array() in
  ulaw.c (CVE-2017-14246, bsc#1059913):
  0031-sfe_copy_data_fp-check-value-of-max-variable.patch</changelog>
  <changelog author="tiwai@suse.de" date="1528459200">- Fix potential overflow in d2alaw_array() (CVE-2017-17456,
  bsc#1071777):
  libsndfile-CVE-2017-17456-alaw-range-check.patch
- Fix potential overflow in d2ulaw_array() (CVE-2017-17457,
  bsc#1071767):
  libsndfile-CVE-2017-17457-ulaw-range-check.patch</changelog>
  <changelog author="tiwai@suse.de" date="1528459201">- Use license file tag</changelog>
  <changelog author="tiwai@suse.de" date="1530878400">- Fix buffer overflow in sndfile-deinterleave, which isn't really a
  security issue (bsc#1100167, CVE-2018-13139, bsc#1116993,
  CVE-2018-19432):
  sndfile-deinterlace-channels-check.patch</changelog>
  <changelog author="tiwai@suse.de" date="1543924800">- Fix segfault in wav conversion due to the invalid loop count
  (CVE-2018-19758, bsc#1117954):
  libsndfile-wav-loop-count-fix.patch</changelog>
  <changelog author="tiwai@suse.de" date="1627041600">- Fix heap buffer overflow vulnerability in msadpcm_decode_block
  (CVE-2021-3246, bsc#1188540):
  ms_adpcm-Fix-and-extend-size-checks.patch</changelog>
  <changelog author="tiwai@suse.de" date="1641211200">- Fix heap buffer overflow in flac_buffer_copy (CVE-2021-4156,
  bsc#1194006):
  libsndfile-CVE-2021-4156.patch</changelog>
</package>
<package pkgid="73d254f6fded4aaeeca12f94ba43e2122d283a5ed965fc3e6eead015e2ae1db7" name="libsndfile1-32bit" arch="x86_64">
  <version epoch="0" ver="1.0.28" rel="5.15.1"/>
  <changelog author="tiwai@suse.de" date="1420632000">- VUL-0: two buffer read overflows in sd2_parse_rsrc_fork()
  (CVE-2014-9496, bnc#911796): backported upstream fix patches
  sndfile-src-sd2.c-Fix-segfault-in-SD2-RSRC-parser.patch
  sndfile-src-sd2.c-Fix-two-potential-buffer-read-overflows.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1426939200">- Cleanup spec file with spec-cleaner
- Add gpg signature
- Remove old ppc provides/obsoletes</changelog>
  <changelog author="tiwai@suse.de" date="1446638400">- VUL-1: libsndfile DoS/divide-by-zero (CVE-2014-9756, bsc#953521):
  libsndfile-src-file_io.c-Prevent-potential-divide-by-zero.patch</changelog>
  <changelog author="tiwai@suse.de" date="1446638401">- VUL-0: libsndfile 1.0.25 heap overflow (CVE-2015-7805, bsc#953516)
  libsndfile-src-common.c-Fix-a-header-parsing-bug.patch
  libsndfile-fix-header-read-CVE-2015-7805.patch
- VUL-0: libsndfile 1.0.25 heap overflow (CVE-2015-8075, bsc#953519)
  libsndfile-psf_strlcpy_crlf-fix-CVE-2015-8075.patch
- Fix the build with SLE11-SP3 due to AM_SILENT_RULE macro</changelog>
  <changelog author="tiwai@suse.de" date="1448280000">- Update to version 1.0.26:
  * Fix for CVE-2014-9496, CVE-2014-9756 and CVE-2015-7805.
  * Add ALAC/CAF support. Minor bug fixes and improvements.
- Refreshed patches:
  sndfile-ocloexec.patch
  libsndfile-psf_strlcpy_crlf-fix-CVE-2015-8075.patch
- Removed obsoleted patches:
  libsndfile-example-fix.diff
  libsndfile-fix-header-read-CVE-2015-7805.patch
  libsndfile-paf-zero-division-fix.diff
  libsndfile-src-common.c-Fix-a-header-parsing-bug.patch
  libsndfile-src-file_io.c-Prevent-potential-divide-by-zero.patch
  sndfile-src-sd2.c-Fix-segfault-in-SD2-RSRC-parser.patch
  sndfile-src-sd2.c-Fix-two-potential-buffer-read-overflows.patch</changelog>
  <changelog author="tom.mbrt@googlemail.com" date="1462881600">- Fix spec file to enable builds on non opensuse OS</changelog>
  <changelog author="tiwai@suse.de" date="1491825600">- Update to version 1.0.27:
  * Fix a seek regression in 1.0.26
  * Add metadata read/write for CAF and RF64
  * FIx PAF endian-ness issue
- Update to version 1.0.28
  * Fix buffer overruns in FLAC and ID3 handling code
  (CVE-2017-7585, CVE-2017-7586, bsc#1033054, bsc#1033053)
  * Reduce default header memory requirements
  * Fix detection of Large File Support for 32 bit systems.
- Obsoleted patch:
  libsndfile-psf_strlcpy_crlf-fix-CVE-2015-8075.patch</changelog>
  <changelog author="tiwai@suse.de" date="1493726400">- Fix FLAC buffer overflows (CVE-2017-8361 CVE-2017-8363
  CVE-2017-8365 CVE-2017-8362 bsc#1036944 bsc#1036945 bsc#1036946
  bsc#1036943):
  0001-FLAC-Fix-a-buffer-read-overrun.patch
  0002-src-flac.c-Fix-a-buffer-read-overflow.patch</changelog>
  <changelog author="tiwai@suse.de" date="1497355200">- Fix out-of-bounds read memory access in the aiff_read_chanmap()
  (CVE-2017-6892, bsc#1043978):
  0010-src-aiff.c-Fix-a-buffer-read-overflow.patch</changelog>
  <changelog author="tiwai@suse.de" date="1502193600">- Fix Heap-based Buffer Overflow in the psf_binheader_writef
  (CVE-2017-12562, bsc#1052476):
  0020-src-common.c-Fix-heap-buffer-overflows-when-writing-.patch</changelog>
  <changelog author="tiwai@suse.de" date="1513684800">- Fix VUL-0: divide-by-zero error exists in the function
  double64_init() in double64.c (CVE-2017-14634, bsc#1059911):
  0030-double64_init-Check-psf-sf.channels-against-upper-bo.patch
- Tentative fix for VUL-0: out of bounds read in the function
  d2alaw_array() in alaw.c (CVE-2017-14245, bsc#1059912) and
  VUL-0: out of bounds read in the function d2ulaw_array() in
  ulaw.c (CVE-2017-14246, bsc#1059913):
  0031-sfe_copy_data_fp-check-value-of-max-variable.patch</changelog>
  <changelog author="tiwai@suse.de" date="1528459200">- Fix potential overflow in d2alaw_array() (CVE-2017-17456,
  bsc#1071777):
  libsndfile-CVE-2017-17456-alaw-range-check.patch
- Fix potential overflow in d2ulaw_array() (CVE-2017-17457,
  bsc#1071767):
  libsndfile-CVE-2017-17457-ulaw-range-check.patch</changelog>
  <changelog author="tiwai@suse.de" date="1528459201">- Use license file tag</changelog>
  <changelog author="tiwai@suse.de" date="1530878400">- Fix buffer overflow in sndfile-deinterleave, which isn't really a
  security issue (bsc#1100167, CVE-2018-13139, bsc#1116993,
  CVE-2018-19432):
  sndfile-deinterlace-channels-check.patch</changelog>
  <changelog author="tiwai@suse.de" date="1543924800">- Fix segfault in wav conversion due to the invalid loop count
  (CVE-2018-19758, bsc#1117954):
  libsndfile-wav-loop-count-fix.patch</changelog>
  <changelog author="tiwai@suse.de" date="1627041600">- Fix heap buffer overflow vulnerability in msadpcm_decode_block
  (CVE-2021-3246, bsc#1188540):
  ms_adpcm-Fix-and-extend-size-checks.patch</changelog>
  <changelog author="tiwai@suse.de" date="1641211200">- Fix heap buffer overflow in flac_buffer_copy (CVE-2021-4156,
  bsc#1194006):
  libsndfile-CVE-2021-4156.patch</changelog>
</package>
<package pkgid="41e0e523c21d9c4400e68a3704426a774789d981b2fe4d588ee243735fa0cbe8" name="libtiff-devel-32bit" arch="x86_64">
  <version epoch="0" ver="4.0.9" rel="45.5.1"/>
  <changelog author="fstrba@suse.com" date="1511956800">- Upgrade to upstream release 4.0.9
  * Changes in the software configuration:
    + test/Makefile.am: Add some tests for tiff2bw.
    + .appveyor.yml, .travis.yml, build/travis-ci: apply patches
    0001-ci-Travis-script-improvements.patch and
    0002-ci-Invoke-helper-script-via-shell.patch by Roger Leigh
    + .travis.yml, build/travis-ci: new files from
    0001-ci-Add-Travis-support-for-Linux-builds-with-Autoconf.patch
    by Roger Leigh. This patch adds support for the Travis-CI
    service.
    + .appveyor.yml: new file from
    0002-ci-Add-AppVeyor-support.patch by Roger Leigh (sent to
    mailing list on 2017-06-08) This patch adds a .appveyor.yml
    file to the top-level. This allows one to opt in to having a
    branch built on Windows with Cygwin, MinGW and MSVC
    automatically when a branch is pushed to GitHub, GitLab,
    BitBucket or any other supported git hosting service.
    + CMakeLists.txt, test/CMakeLists.txt,
    test/TiffTestCommon.cmake: apply patch
    0001-cmake-Improve-Cygwin-and-MingGW-test-support.patch from
    Roger Leigh. This patch makes the CMake build system support
    running the tests with MinGW or  Cygwin.
    + test/tiffcp-lzw-compat.sh, test/images/quad-lzw-compat.tiff:
    new files to test old-style LZW decompression
    + test/common.sh, Makefile.am, CMakeList.txt: updated with above
    + test/Makefile.am: add missing reference to
    images/quad-lzw-compat.tiff to fix "make distcheck". Patch by
    Roger Leigh
    + nmake.opt: support a DEBUG=1 option, so as to adjust OPTFLAGS
    and use /MDd runtime in debug mode.
  * Changes in libtiff:
    + libtiff/tif_color.c: TIFFYCbCrToRGBInit(): stricter clamping
    to avoid int32 overflow in TIFFYCbCrtoRGB(). Fixes
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1844
    + libtiff/tif_getimage.c: initYCbCrConversion(): stricter
    validation for refBlackWhite coefficients values. To avoid
    invalid float-&gt;int32 conversion (when refBlackWhite[0] ==
    2147483648.f) Fixes
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1907
    + libtiff/tif_dirinfo.c, tif_dirread.c: add
    _TIFFCheckFieldIsValidForCodec(), and use it in
    TIFFReadDirectory() so as to ignore fields whose tag is a
    codec-specified tag but this codec is not enabled. This avoids
    TIFFGetField() to behave differently depending on whether the
    codec is enabled or not, and thus can avoid stack based buffer
    overflows in a number of TIFF utilities such as tiffsplit,
    tiffcmp, thumbnail, etc. Patch derived from
    0063-Handle-properly-CODEC-specific-tags.patch
    (http://bugzilla.maptools.org/show_bug.cgi?id=2580) by Raphaël
    Hertzog.
    Fixes: http://bugzilla.maptools.org/show_bug.cgi?id=2580
    http://bugzilla.maptools.org/show_bug.cgi?id=2693
    http://bugzilla.maptools.org/show_bug.cgi?id=2625
    (CVE-2016-10095, bsc#1017690)
    http://bugzilla.maptools.org/show_bug.cgi?id=2564
    (CVE-2015-7554, bsc#960341)
    http://bugzilla.maptools.org/show_bug.cgi?id=2561
    (CVE-2016-5318, bsc#983436)
    http://bugzilla.maptools.org/show_bug.cgi?id=2499
    (CVE-2014-8128, bsc#969783)
    http://bugzilla.maptools.org/show_bug.cgi?id=2441
    http://bugzilla.maptools.org/show_bug.cgi?id=2433
    + libtiff/tif_swab.c: if DISABLE_CHECK_TIFFSWABMACROS is
    defined, do not do the #ifdef TIFFSwabXXX checks. Make it
    easier for GDAL to rename the symbols of its internal libtiff
    copy.
    + libtiff/tif_dirread.c: fix regression of libtiff 4.0.8 in
    ChopUpSingleUncompressedStrip() regarding update of newly
    single-strip uncompressed files whose bytecount is 0. Before
    the change of 2016-12-03, the condition bytecount==0 used to
    trigger an early exit/disabling of strip chop. Re-introduce
    that in update mode. Otherwise this cause later incorrect
    setting for the value of StripByCounts/StripOffsets.
    (https://trac.osgeo.org/gdal/ticket/6924)
    + libtiff/tif_dirread.c: TIFFFetchStripThing(): limit the
    number of items read in StripOffsets/StripByteCounts tags to
    the number of strips to avoid excessive memory allocation.
    Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2215
    + libtiff/tif_getimage.c: avoid many (harmless) unsigned int
    overflows.
    + libtiff/tif_fax3.c: avoid unsigned int overflow in
    Fax3Encode2DRow(). Could potentially be a bug with huge rows.
    + libtiff/tif_jpeg.c: avoid (harmless) unsigned int overflow on
    tiled images.
    + libtiff/tif_dirread.c: avoid unsigned int overflow in
    EstimateStripByteCounts() and BYTECOUNTLOOKSBAD when file is
    too short.
    + libtiff/tif_predict.c: decorate legitimate functions where
    unsigned int overflow occur with
    TIFF_NOSANITIZE_UNSIGNED_INT_OVERFLOW
    + libtiff/tif_dirread.c: avoid unsigned int overflow in
    EstimateStripByteCounts()
    + libtiff/tiffiop.h: add TIFF_NOSANITIZE_UNSIGNED_INT_OVERFLOW
    macro to disable CLang warnings raised by
  - fsanitize=undefined,unsigned-integer-overflow
    + libtiff/tif_jpeg.c: add anti-denial of service measure to
    avoid excessive CPU consumption on progressive JPEGs with a
    huge number of scans. See
    http://www.libjpeg-turbo.org/pmwiki/uploads/About/TwoIssueswiththeJPEGStandard.pdf
    Note: only affects libtiff since 2014-12-29 where support of
    non-baseline JPEG was added.
    + libtiff/tif_jpeg.c: error out at decoding time if anticipated
    libjpeg memory allocation is above 100 MB. libjpeg in case of
    multiple scans, which is allowed even in baseline JPEG, if
    components are spread over several scans and not
    interleavedin a single one, needs to allocate memory (or
    backing store) for the whole strip/tile. See
    http://www.libjpeg-turbo.org/pmwiki/uploads/About/TwoIssueswiththeJPEGStandard.pdf
    This limitation may be overriden by setting the
    LIBTIFF_ALLOW_LARGE_LIBJPEG_MEM_ALLOC environment variable, or
    recompiling libtiff with a custom value of
    TIFF_LIBJPEG_LARGEST_MEM_ALLOC macro.
    + libtiff/tif_jbig.c: fix memory leak in error code path of
    JBIGDecode()
    Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2706
    (CVE-2017-9936, bsc#1046073)
    + libtiff/tif_dirread.c: in TIFFReadDirEntryFloat(), check that
    a double value can fit in a float before casting.
    + libtiff/tiffiop.h, libtiff/tif_jpeg.c, libtiff/tif_jpeg_12.c,
    libtiff/tif_read.c: make TIFFReadScanline() works in
    CHUNKY_STRIP_READ_SUPPORT mode with JPEG stream with multiple
    scans. Also make configurable through a
    LIBTIFF_JPEG_MAX_ALLOWED_SCAN_NUMBER environment variable the
    maximum number of scans allowed. Defaults to 100.
    + libtiff/tif_read.c: TIFFFillTile(): add limitation to the
    number of bytes read in case td_stripbytecount[strip] is
    bigger than reasonable, so as to avoid excessive memory
    allocation (similarly to what was done for TIFFFileStrip() on
    2017-05-10)
    + libtiff/tif_getimage.c: use
    _TIFFReadEncodedStripAndAllocBuffer(). Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2708 and
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2433
    + libtiff/tif_read.c, tiffiop.h: add a
    _TIFFReadEncodedStripAndAllocBuffer() function, variant of
    TIFFReadEncodedStrip() that allocates the decoded buffer only
    after a first successful TIFFFillStrip(). This avoids
    excessive memory allocation on corrupted files.
    + libtiff/tif_dirwrite.c: in TIFFWriteDirectoryTagCheckedXXXX()
    functions associated with LONG8/SLONG8 data type, replace
    assertion that the file is BigTIFF, by a non-fatal error.
    Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2712
    + libtiff/tif_read.c: TIFFStartTile(): set tif_rawcc to
    tif_rawdataloaded when it is set. Similarly to
    TIFFStartStrip(). This issue was revealed by the change of
    2017-06-30 in TIFFFileTile(), limiting the number of bytes
    read. But it could probably have been hit too in
    CHUNKY_STRIP_READ_SUPPORT mode previously. Fixes
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2454
    + libtiff/tif_error.c, tif_warning.c: correctly use va_list
    when both an old-style and new-style warning/error handlers
    are installed. Patch by Paavo Helde (sent on the mailing list)
    + libtiff/tif_getimage.c: use _TIFFReadTileAndAllocBuffer().
    Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2470
    + libtiff/tif_read.c, tiffiop.h: add a
    _TIFFReadEncodedTileAndAllocBuffer() and
    _TIFFReadTileAndAllocBuffer() variants of
    TIFFReadEncodedTile() and TIFFReadTile() that allocates the
    decoded buffer only after a first successful TIFFFillTile().
    This avoids excessive memory allocation on corrupted files.
    + libtiff/tif_pixarlog.c: avoid excessive memory allocation on
    decoding when RowsPerStrip tag is not defined (and thus
    td_rowsperstrip == UINT_MAX) Fixes
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2554
    + libtiff/tif_lzw.c: fix 4.0.8 regression in the decoding of
    old-style LZW compressed files.
    + libtiff/tif_lzw.c: fix potential out-of-buffer read on 1-byte
    LZW strips. Crashing issue only on memory mapped files, where
    the strip offset is the last byte of the file, and the file
    size is a multiple of one page size on the CPU architecture
    (typically 4096)
    + libtiff/tif_dir.c: avoid potential null pointer dereference
    in _TIFFVGetField() on corrupted TIFFTAG_NUMBEROFINKS tag
    instance.
    Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2713
    + tools/tiff2pdf.c: prevent heap buffer overflow write in "Raw"
    mode on PlanarConfig=Contig input images. Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2715
    + libtiff/tif_read.c: TIFFFillStrip() / TIFFFillTile().
    Complementary fix for
    http://bugzilla.maptools.org/show_bug.cgi?id=2708 in the
    isMapped() case, so as to avoid excessive memory allocation
    when we need a temporary buffer but the file is truncated.
    + libtiff/tif_read.c: in TIFFFetchStripThing(), only grow the
    arrays that hold StripOffsets/StripByteCounts, when they are
    smaller than the expected number of striles, up to 1 million
    striles, and error out beyond. Can be tweaked by setting the
    environment variable LIBTIFF_STRILE_ARRAY_MAX_RESIZE_COUNT.
    This partially goes against a change added on 2002-12-17 to
    accept those arrays of wrong sizes, but is needed to avoid
    denial of services. Fixes
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2350
    + libtiff/tif_read.c: add protection against excessive memory
    allocation attempts in TIFFReadDirEntryArray() on short files.
    Effective for mmap'ed case. And non-mmap'ed case, but
    restricted to 64bit builds. Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2675
    (CVE-2017-12944, bsc#1054594)
    + libtiff/tif_luv.c: LogLuvInitState(): avoid excessive memory
    allocation when RowsPerStrip tag is missing. Fixes
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2683
    + libtiff/tif_getimage.c: gtTileContig() and gtTileSeparate():
    properly break from loops on error when stoponerr is set,
    instead of going on iterating on row based loop.
    + libtiff/tif_getimage.c: fix fromskew computation when
    to-be-skipped pixel number is not a multiple of the horizontal
    subsampling, and also in some other cases. Impact
    putcontig8bitYCbCr44tile, putcontig8bitYCbCr42tile,
    putcontig8bitYCbCr41tile, putcontig8bitYCbCr21tile and
    putcontig8bitYCbCr12tile Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2637 and
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2691
    + libtiff/tif_luv.c: further reduce memory requirements for
    temporary buffer when RowsPerStrip &gt;= image_length in
    LogLuvInitState() and LogL16InitState(). Fixes
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2700
    + libtiff/tif_dirwrite.c: replace assertion related to not
    finding the SubIFD tag by runtime check (in
    TIFFWriteDirectorySec()) Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2727
    + libtiff/tif_dirwrite.c: replace assertion to tag value not
    fitting on uint32 when selecting the value of SubIFD tag by
    runtime check (in TIFFWriteDirectoryTagSubifd()). Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2728
    + libtiff/tif_jpeg.c: accept reading the last strip of a JPEG
    compressed file if the codestream height is larger than the
    truncated height of the strip. Emit a warning in this
    situation since this is non compliant.
    + libtiff/tiffiop.h, tif_aux.c: redirect SeekOK() macro to a
    _TIFFSeekoK() function that checks if the offset is not
    bigger than INT64_MAX, so as to avoid a -1 error return code
    of TIFFSeekFile() to match a required seek to UINT64_MAX/-1.
    Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2726
    + libtiff/tif_dirread.c: add NULL check to avoid likely false
    positive null-pointer dereference warning by CLang Static
    Analyzer.
    + libtiff/libtiff.def: add TIFFReadRGBAStripExt and
    TIFFReadRGBATileExt Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2735
    + libtiff/tif_jpeg.c: add compatibility with libjpeg-turbo
    1.5.2 that honours max_memory_to_use &gt; 0. Cf
    https://github.com/libjpeg-turbo/libjpeg-turbo/issues/162
    + libtiff/tif_getimage.c: avoid floating point division by zero
    in initCIELabConversion() Fixes
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=3733
  * Changes in the tools:
    + tools/tiff2pdf.c: prevent heap buffer overflow write in "Raw"
    mode on PlanarConfig=Contig input images. Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2715
    + tools/tiffset.c: fix setting a single value for the
    ExtraSamples tag (and other tags with variable number of
    values). So 'tiffset -s ExtraSamples 1 X'. This only worked
    when setting 2 or more values, but not just one.
    + tools/fax2tiff.c (_FAX_Client_Data): Pass FAX_Client_Data as
    the client data. This client data is not used at all at the
    moment, but it makes the most sense. Issue that the value of
    client_data.fd was passed where a pointer is expected.
    + tools/tiff2pdf.c (t2p_sample_realize_palette): Fix possible
    arithmetic overflow in bounds checking code and eliminate
    comparison between signed and unsigned type.
    + tools/tiff2bw.c (main): Free memory allocated in the tiff2bw
    program. This is in response to the report associated with
    CVE-2017-16232, bsc#1069213 but does not solve the extremely
    high memory usage with the associated POC file.</changelog>
  <changelog author="dimstar@opensuse.org" date="1513857600">- Fix check section:
  + Make sure to get back to the right directory after chdir to
    'tools', or we can't run the 2nd test suite.
  + Fix typo: the tests are located in a directory called 'test',
    not 'tests'.</changelog>
  <changelog author="mvetter@suse.com" date="1518782400">- bsc#1046077: Add tiff-4.0.9-bsc1046077-CVE-2017-9935.patch
  Fix Heap-based buffer overflow in t2p_write_pdf</changelog>
  <changelog author="mvetter@suse.com" date="1519128000">- bsc#1081690: Add tiff-4.0.9-bsc1081690-CVE-2018-5784.patch
  Fix uncontrolled resource consumption in TIFFSetDirectory</changelog>
  <changelog author="pgajdos@suse.com" date="1526385600">- security update
  * CVE-2018-10963 [bsc#1092949]
    + tiff-CVE-2018-10963.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1526644800">- security update
  * CVE-2017-18013 [bsc#1074317]
    + tiff-CVE-2017-18013.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1528113600">- security update
  * CVE-2018-7456 [bsc#1082825]
    + tiff-CVE-2018-7456.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1528113601">- security update
  * CVE-2017-11613 [bsc#1082332]
    + tiff-CVE-2017-11613.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1528200000">- security update
  * CVE-2018-8905 [bsc#1086408]
    + tiff-CVE-2018-8905.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1534334400">- security update
  * CVE-2018-10779 [bsc#1092480]
    + tiff-CVE-2018-10779.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1539777600">- security update
  * CVE-2018-17100 [bsc#1108637]
    + tiff-CVE-2018-17100.patch
  * CVE-2018-17101 [bsc#1108627]
    + tiff-CVE-2018-17101.patch
  * CVE-2018-17795 [bsc#1110358]
    % tiff-4.0.9-bsc1046077-CVE-2017-9935.patch renamed to
    tiff-CVE-2017-9935,CVE-2018-17795.patch
  * CVE-2018-16335 [bsc#1106853]
    % tiff-CVE-2017-11613.patch renamed to
    tiff-CVE-2017-11613,CVE-2018-16335,15209.patch
- add a possibility to build with ASAN</changelog>
  <changelog author="pgajdos@suse.com" date="1542024000">- asan_build: build ASAN included
- debug_build: build more suitable for debugging</changelog>
  <changelog author="pgajdos@suse.com" date="1542024001">- security update
  * CVE-2018-18661 [bsc#1113672]
    + tiff-CVE-2018-18661.patch
  * CVE-2018-18557 [bsc#1113094]
    + tiff-CVE-2018-18557.patch
  * CVE-2018-12900 [bsc#1099257]
    + tiff-CVE-2018-12900.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1542628800">- security update
  * CVE-2018-19210 [bsc#1115717]
    + tiff-CVE-2018-19210.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1548849600">- extend tiff-CVE-2018-19210.patch and rename it to
  tiff-CVE-2018-17000,19210.patch [bsc#1108606c#11]
  * solves CVE-2018-19210 [bsc#1115717] and CVE-2018-17000 [bsc#1108606]</changelog>
  <changelog author="mvetter@suse.com" date="1549281600">- security update
  * CVE-2019-6128 [bsc#1121626]
    + tiff-CVE-2019-6128.patch</changelog>
  <changelog author="mvetter@suse.com" date="1549972800">- security update
  * CVE-2019-7663 [bsc#1125113]
    + tiff-CVE-2019-7663.patch</changelog>
  <changelog author="mvetter@suse.com" date="1573041600">- security update: Fix integer overflow in _TIFFCheckMalloc()
  * CVE-2019-14973 [bsc#1146608]
    + tiff-CVE-2019-14973.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1573041601">- security update: amend patch to fix test
- modified patches
  % tiff-CVE-2019-14973.patch (refreshed)</changelog>
  <changelog author="mvetter@suse.com" date="1642420800">- security update: Fix buffer overwrite
  * CVE-2019-17546[bsc#1154365]
    + tiff-CVE-2019-17546.patch
- security update: Fix heap based buffer overflow in pal2rgb
  * CVE-2017-17095[bsc#1071031]
    + tiff-CVE-2017-17095.patch
- security update: Fix OOB in _TIFFmemcpy
  * CVE-2022-22844[bsc#1194539]
    + tiff-CVE-2022-22844.patch
- security update: Fix memory allocation failure in tif_read.c
  * CVE-2020-35521[bsc#1182808] CVE-2020-35522[bsc#1182809]
    + tiff-CVE-2020-35521,CVE-2020-35522.patch
- security update: Fix DOS via invertImage()
  * CVE-2020-19131[bsc#1190312]
    + tiff-CVE-2020-19131.patch
- security update: Fix heap-based buffer overflow in TIFF2PDF tool
  * CVE-2020-35524[bsc#1182812]
    + tiff-CVE-2020-35524.patch
- security update: Fix integer overflow in tif_getimage
  * CVE-2020-35523 [bsc#1182811]
    + tiff-CVE-2020-35523.patch</changelog>
</package>
<package pkgid="f6f2e9a048f107ad6a090de33d18d9d8e08e9438be57f7e01338378c9f78d8b0" name="libtiff-devel" arch="aarch64">
  <version epoch="0" ver="4.0.9" rel="45.5.1"/>
  <changelog author="fstrba@suse.com" date="1511956800">- Upgrade to upstream release 4.0.9
  * Changes in the software configuration:
    + test/Makefile.am: Add some tests for tiff2bw.
    + .appveyor.yml, .travis.yml, build/travis-ci: apply patches
    0001-ci-Travis-script-improvements.patch and
    0002-ci-Invoke-helper-script-via-shell.patch by Roger Leigh
    + .travis.yml, build/travis-ci: new files from
    0001-ci-Add-Travis-support-for-Linux-builds-with-Autoconf.patch
    by Roger Leigh. This patch adds support for the Travis-CI
    service.
    + .appveyor.yml: new file from
    0002-ci-Add-AppVeyor-support.patch by Roger Leigh (sent to
    mailing list on 2017-06-08) This patch adds a .appveyor.yml
    file to the top-level. This allows one to opt in to having a
    branch built on Windows with Cygwin, MinGW and MSVC
    automatically when a branch is pushed to GitHub, GitLab,
    BitBucket or any other supported git hosting service.
    + CMakeLists.txt, test/CMakeLists.txt,
    test/TiffTestCommon.cmake: apply patch
    0001-cmake-Improve-Cygwin-and-MingGW-test-support.patch from
    Roger Leigh. This patch makes the CMake build system support
    running the tests with MinGW or  Cygwin.
    + test/tiffcp-lzw-compat.sh, test/images/quad-lzw-compat.tiff:
    new files to test old-style LZW decompression
    + test/common.sh, Makefile.am, CMakeList.txt: updated with above
    + test/Makefile.am: add missing reference to
    images/quad-lzw-compat.tiff to fix "make distcheck". Patch by
    Roger Leigh
    + nmake.opt: support a DEBUG=1 option, so as to adjust OPTFLAGS
    and use /MDd runtime in debug mode.
  * Changes in libtiff:
    + libtiff/tif_color.c: TIFFYCbCrToRGBInit(): stricter clamping
    to avoid int32 overflow in TIFFYCbCrtoRGB(). Fixes
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1844
    + libtiff/tif_getimage.c: initYCbCrConversion(): stricter
    validation for refBlackWhite coefficients values. To avoid
    invalid float-&gt;int32 conversion (when refBlackWhite[0] ==
    2147483648.f) Fixes
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1907
    + libtiff/tif_dirinfo.c, tif_dirread.c: add
    _TIFFCheckFieldIsValidForCodec(), and use it in
    TIFFReadDirectory() so as to ignore fields whose tag is a
    codec-specified tag but this codec is not enabled. This avoids
    TIFFGetField() to behave differently depending on whether the
    codec is enabled or not, and thus can avoid stack based buffer
    overflows in a number of TIFF utilities such as tiffsplit,
    tiffcmp, thumbnail, etc. Patch derived from
    0063-Handle-properly-CODEC-specific-tags.patch
    (http://bugzilla.maptools.org/show_bug.cgi?id=2580) by Raphaël
    Hertzog.
    Fixes: http://bugzilla.maptools.org/show_bug.cgi?id=2580
    http://bugzilla.maptools.org/show_bug.cgi?id=2693
    http://bugzilla.maptools.org/show_bug.cgi?id=2625
    (CVE-2016-10095, bsc#1017690)
    http://bugzilla.maptools.org/show_bug.cgi?id=2564
    (CVE-2015-7554, bsc#960341)
    http://bugzilla.maptools.org/show_bug.cgi?id=2561
    (CVE-2016-5318, bsc#983436)
    http://bugzilla.maptools.org/show_bug.cgi?id=2499
    (CVE-2014-8128, bsc#969783)
    http://bugzilla.maptools.org/show_bug.cgi?id=2441
    http://bugzilla.maptools.org/show_bug.cgi?id=2433
    + libtiff/tif_swab.c: if DISABLE_CHECK_TIFFSWABMACROS is
    defined, do not do the #ifdef TIFFSwabXXX checks. Make it
    easier for GDAL to rename the symbols of its internal libtiff
    copy.
    + libtiff/tif_dirread.c: fix regression of libtiff 4.0.8 in
    ChopUpSingleUncompressedStrip() regarding update of newly
    single-strip uncompressed files whose bytecount is 0. Before
    the change of 2016-12-03, the condition bytecount==0 used to
    trigger an early exit/disabling of strip chop. Re-introduce
    that in update mode. Otherwise this cause later incorrect
    setting for the value of StripByCounts/StripOffsets.
    (https://trac.osgeo.org/gdal/ticket/6924)
    + libtiff/tif_dirread.c: TIFFFetchStripThing(): limit the
    number of items read in StripOffsets/StripByteCounts tags to
    the number of strips to avoid excessive memory allocation.
    Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2215
    + libtiff/tif_getimage.c: avoid many (harmless) unsigned int
    overflows.
    + libtiff/tif_fax3.c: avoid unsigned int overflow in
    Fax3Encode2DRow(). Could potentially be a bug with huge rows.
    + libtiff/tif_jpeg.c: avoid (harmless) unsigned int overflow on
    tiled images.
    + libtiff/tif_dirread.c: avoid unsigned int overflow in
    EstimateStripByteCounts() and BYTECOUNTLOOKSBAD when file is
    too short.
    + libtiff/tif_predict.c: decorate legitimate functions where
    unsigned int overflow occur with
    TIFF_NOSANITIZE_UNSIGNED_INT_OVERFLOW
    + libtiff/tif_dirread.c: avoid unsigned int overflow in
    EstimateStripByteCounts()
    + libtiff/tiffiop.h: add TIFF_NOSANITIZE_UNSIGNED_INT_OVERFLOW
    macro to disable CLang warnings raised by
  - fsanitize=undefined,unsigned-integer-overflow
    + libtiff/tif_jpeg.c: add anti-denial of service measure to
    avoid excessive CPU consumption on progressive JPEGs with a
    huge number of scans. See
    http://www.libjpeg-turbo.org/pmwiki/uploads/About/TwoIssueswiththeJPEGStandard.pdf
    Note: only affects libtiff since 2014-12-29 where support of
    non-baseline JPEG was added.
    + libtiff/tif_jpeg.c: error out at decoding time if anticipated
    libjpeg memory allocation is above 100 MB. libjpeg in case of
    multiple scans, which is allowed even in baseline JPEG, if
    components are spread over several scans and not
    interleavedin a single one, needs to allocate memory (or
    backing store) for the whole strip/tile. See
    http://www.libjpeg-turbo.org/pmwiki/uploads/About/TwoIssueswiththeJPEGStandard.pdf
    This limitation may be overriden by setting the
    LIBTIFF_ALLOW_LARGE_LIBJPEG_MEM_ALLOC environment variable, or
    recompiling libtiff with a custom value of
    TIFF_LIBJPEG_LARGEST_MEM_ALLOC macro.
    + libtiff/tif_jbig.c: fix memory leak in error code path of
    JBIGDecode()
    Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2706
    (CVE-2017-9936, bsc#1046073)
    + libtiff/tif_dirread.c: in TIFFReadDirEntryFloat(), check that
    a double value can fit in a float before casting.
    + libtiff/tiffiop.h, libtiff/tif_jpeg.c, libtiff/tif_jpeg_12.c,
    libtiff/tif_read.c: make TIFFReadScanline() works in
    CHUNKY_STRIP_READ_SUPPORT mode with JPEG stream with multiple
    scans. Also make configurable through a
    LIBTIFF_JPEG_MAX_ALLOWED_SCAN_NUMBER environment variable the
    maximum number of scans allowed. Defaults to 100.
    + libtiff/tif_read.c: TIFFFillTile(): add limitation to the
    number of bytes read in case td_stripbytecount[strip] is
    bigger than reasonable, so as to avoid excessive memory
    allocation (similarly to what was done for TIFFFileStrip() on
    2017-05-10)
    + libtiff/tif_getimage.c: use
    _TIFFReadEncodedStripAndAllocBuffer(). Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2708 and
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2433
    + libtiff/tif_read.c, tiffiop.h: add a
    _TIFFReadEncodedStripAndAllocBuffer() function, variant of
    TIFFReadEncodedStrip() that allocates the decoded buffer only
    after a first successful TIFFFillStrip(). This avoids
    excessive memory allocation on corrupted files.
    + libtiff/tif_dirwrite.c: in TIFFWriteDirectoryTagCheckedXXXX()
    functions associated with LONG8/SLONG8 data type, replace
    assertion that the file is BigTIFF, by a non-fatal error.
    Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2712
    + libtiff/tif_read.c: TIFFStartTile(): set tif_rawcc to
    tif_rawdataloaded when it is set. Similarly to
    TIFFStartStrip(). This issue was revealed by the change of
    2017-06-30 in TIFFFileTile(), limiting the number of bytes
    read. But it could probably have been hit too in
    CHUNKY_STRIP_READ_SUPPORT mode previously. Fixes
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2454
    + libtiff/tif_error.c, tif_warning.c: correctly use va_list
    when both an old-style and new-style warning/error handlers
    are installed. Patch by Paavo Helde (sent on the mailing list)
    + libtiff/tif_getimage.c: use _TIFFReadTileAndAllocBuffer().
    Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2470
    + libtiff/tif_read.c, tiffiop.h: add a
    _TIFFReadEncodedTileAndAllocBuffer() and
    _TIFFReadTileAndAllocBuffer() variants of
    TIFFReadEncodedTile() and TIFFReadTile() that allocates the
    decoded buffer only after a first successful TIFFFillTile().
    This avoids excessive memory allocation on corrupted files.
    + libtiff/tif_pixarlog.c: avoid excessive memory allocation on
    decoding when RowsPerStrip tag is not defined (and thus
    td_rowsperstrip == UINT_MAX) Fixes
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2554
    + libtiff/tif_lzw.c: fix 4.0.8 regression in the decoding of
    old-style LZW compressed files.
    + libtiff/tif_lzw.c: fix potential out-of-buffer read on 1-byte
    LZW strips. Crashing issue only on memory mapped files, where
    the strip offset is the last byte of the file, and the file
    size is a multiple of one page size on the CPU architecture
    (typically 4096)
    + libtiff/tif_dir.c: avoid potential null pointer dereference
    in _TIFFVGetField() on corrupted TIFFTAG_NUMBEROFINKS tag
    instance.
    Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2713
    + tools/tiff2pdf.c: prevent heap buffer overflow write in "Raw"
    mode on PlanarConfig=Contig input images. Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2715
    + libtiff/tif_read.c: TIFFFillStrip() / TIFFFillTile().
    Complementary fix for
    http://bugzilla.maptools.org/show_bug.cgi?id=2708 in the
    isMapped() case, so as to avoid excessive memory allocation
    when we need a temporary buffer but the file is truncated.
    + libtiff/tif_read.c: in TIFFFetchStripThing(), only grow the
    arrays that hold StripOffsets/StripByteCounts, when they are
    smaller than the expected number of striles, up to 1 million
    striles, and error out beyond. Can be tweaked by setting the
    environment variable LIBTIFF_STRILE_ARRAY_MAX_RESIZE_COUNT.
    This partially goes against a change added on 2002-12-17 to
    accept those arrays of wrong sizes, but is needed to avoid
    denial of services. Fixes
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2350
    + libtiff/tif_read.c: add protection against excessive memory
    allocation attempts in TIFFReadDirEntryArray() on short files.
    Effective for mmap'ed case. And non-mmap'ed case, but
    restricted to 64bit builds. Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2675
    (CVE-2017-12944, bsc#1054594)
    + libtiff/tif_luv.c: LogLuvInitState(): avoid excessive memory
    allocation when RowsPerStrip tag is missing. Fixes
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2683
    + libtiff/tif_getimage.c: gtTileContig() and gtTileSeparate():
    properly break from loops on error when stoponerr is set,
    instead of going on iterating on row based loop.
    + libtiff/tif_getimage.c: fix fromskew computation when
    to-be-skipped pixel number is not a multiple of the horizontal
    subsampling, and also in some other cases. Impact
    putcontig8bitYCbCr44tile, putcontig8bitYCbCr42tile,
    putcontig8bitYCbCr41tile, putcontig8bitYCbCr21tile and
    putcontig8bitYCbCr12tile Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2637 and
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2691
    + libtiff/tif_luv.c: further reduce memory requirements for
    temporary buffer when RowsPerStrip &gt;= image_length in
    LogLuvInitState() and LogL16InitState(). Fixes
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2700
    + libtiff/tif_dirwrite.c: replace assertion related to not
    finding the SubIFD tag by runtime check (in
    TIFFWriteDirectorySec()) Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2727
    + libtiff/tif_dirwrite.c: replace assertion to tag value not
    fitting on uint32 when selecting the value of SubIFD tag by
    runtime check (in TIFFWriteDirectoryTagSubifd()). Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2728
    + libtiff/tif_jpeg.c: accept reading the last strip of a JPEG
    compressed file if the codestream height is larger than the
    truncated height of the strip. Emit a warning in this
    situation since this is non compliant.
    + libtiff/tiffiop.h, tif_aux.c: redirect SeekOK() macro to a
    _TIFFSeekoK() function that checks if the offset is not
    bigger than INT64_MAX, so as to avoid a -1 error return code
    of TIFFSeekFile() to match a required seek to UINT64_MAX/-1.
    Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2726
    + libtiff/tif_dirread.c: add NULL check to avoid likely false
    positive null-pointer dereference warning by CLang Static
    Analyzer.
    + libtiff/libtiff.def: add TIFFReadRGBAStripExt and
    TIFFReadRGBATileExt Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2735
    + libtiff/tif_jpeg.c: add compatibility with libjpeg-turbo
    1.5.2 that honours max_memory_to_use &gt; 0. Cf
    https://github.com/libjpeg-turbo/libjpeg-turbo/issues/162
    + libtiff/tif_getimage.c: avoid floating point division by zero
    in initCIELabConversion() Fixes
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=3733
  * Changes in the tools:
    + tools/tiff2pdf.c: prevent heap buffer overflow write in "Raw"
    mode on PlanarConfig=Contig input images. Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2715
    + tools/tiffset.c: fix setting a single value for the
    ExtraSamples tag (and other tags with variable number of
    values). So 'tiffset -s ExtraSamples 1 X'. This only worked
    when setting 2 or more values, but not just one.
    + tools/fax2tiff.c (_FAX_Client_Data): Pass FAX_Client_Data as
    the client data. This client data is not used at all at the
    moment, but it makes the most sense. Issue that the value of
    client_data.fd was passed where a pointer is expected.
    + tools/tiff2pdf.c (t2p_sample_realize_palette): Fix possible
    arithmetic overflow in bounds checking code and eliminate
    comparison between signed and unsigned type.
    + tools/tiff2bw.c (main): Free memory allocated in the tiff2bw
    program. This is in response to the report associated with
    CVE-2017-16232, bsc#1069213 but does not solve the extremely
    high memory usage with the associated POC file.</changelog>
  <changelog author="dimstar@opensuse.org" date="1513857600">- Fix check section:
  + Make sure to get back to the right directory after chdir to
    'tools', or we can't run the 2nd test suite.
  + Fix typo: the tests are located in a directory called 'test',
    not 'tests'.</changelog>
  <changelog author="mvetter@suse.com" date="1518782400">- bsc#1046077: Add tiff-4.0.9-bsc1046077-CVE-2017-9935.patch
  Fix Heap-based buffer overflow in t2p_write_pdf</changelog>
  <changelog author="mvetter@suse.com" date="1519128000">- bsc#1081690: Add tiff-4.0.9-bsc1081690-CVE-2018-5784.patch
  Fix uncontrolled resource consumption in TIFFSetDirectory</changelog>
  <changelog author="pgajdos@suse.com" date="1526385600">- security update
  * CVE-2018-10963 [bsc#1092949]
    + tiff-CVE-2018-10963.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1526644800">- security update
  * CVE-2017-18013 [bsc#1074317]
    + tiff-CVE-2017-18013.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1528113600">- security update
  * CVE-2018-7456 [bsc#1082825]
    + tiff-CVE-2018-7456.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1528113601">- security update
  * CVE-2017-11613 [bsc#1082332]
    + tiff-CVE-2017-11613.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1528200000">- security update
  * CVE-2018-8905 [bsc#1086408]
    + tiff-CVE-2018-8905.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1534334400">- security update
  * CVE-2018-10779 [bsc#1092480]
    + tiff-CVE-2018-10779.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1539777600">- security update
  * CVE-2018-17100 [bsc#1108637]
    + tiff-CVE-2018-17100.patch
  * CVE-2018-17101 [bsc#1108627]
    + tiff-CVE-2018-17101.patch
  * CVE-2018-17795 [bsc#1110358]
    % tiff-4.0.9-bsc1046077-CVE-2017-9935.patch renamed to
    tiff-CVE-2017-9935,CVE-2018-17795.patch
  * CVE-2018-16335 [bsc#1106853]
    % tiff-CVE-2017-11613.patch renamed to
    tiff-CVE-2017-11613,CVE-2018-16335,15209.patch
- add a possibility to build with ASAN</changelog>
  <changelog author="pgajdos@suse.com" date="1542024000">- asan_build: build ASAN included
- debug_build: build more suitable for debugging</changelog>
  <changelog author="pgajdos@suse.com" date="1542024001">- security update
  * CVE-2018-18661 [bsc#1113672]
    + tiff-CVE-2018-18661.patch
  * CVE-2018-18557 [bsc#1113094]
    + tiff-CVE-2018-18557.patch
  * CVE-2018-12900 [bsc#1099257]
    + tiff-CVE-2018-12900.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1542628800">- security update
  * CVE-2018-19210 [bsc#1115717]
    + tiff-CVE-2018-19210.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1548849600">- extend tiff-CVE-2018-19210.patch and rename it to
  tiff-CVE-2018-17000,19210.patch [bsc#1108606c#11]
  * solves CVE-2018-19210 [bsc#1115717] and CVE-2018-17000 [bsc#1108606]</changelog>
  <changelog author="mvetter@suse.com" date="1549281600">- security update
  * CVE-2019-6128 [bsc#1121626]
    + tiff-CVE-2019-6128.patch</changelog>
  <changelog author="mvetter@suse.com" date="1549972800">- security update
  * CVE-2019-7663 [bsc#1125113]
    + tiff-CVE-2019-7663.patch</changelog>
  <changelog author="mvetter@suse.com" date="1573041600">- security update: Fix integer overflow in _TIFFCheckMalloc()
  * CVE-2019-14973 [bsc#1146608]
    + tiff-CVE-2019-14973.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1573041601">- security update: amend patch to fix test
- modified patches
  % tiff-CVE-2019-14973.patch (refreshed)</changelog>
  <changelog author="mvetter@suse.com" date="1642420800">- security update: Fix buffer overwrite
  * CVE-2019-17546[bsc#1154365]
    + tiff-CVE-2019-17546.patch
- security update: Fix heap based buffer overflow in pal2rgb
  * CVE-2017-17095[bsc#1071031]
    + tiff-CVE-2017-17095.patch
- security update: Fix OOB in _TIFFmemcpy
  * CVE-2022-22844[bsc#1194539]
    + tiff-CVE-2022-22844.patch
- security update: Fix memory allocation failure in tif_read.c
  * CVE-2020-35521[bsc#1182808] CVE-2020-35522[bsc#1182809]
    + tiff-CVE-2020-35521,CVE-2020-35522.patch
- security update: Fix DOS via invertImage()
  * CVE-2020-19131[bsc#1190312]
    + tiff-CVE-2020-19131.patch
- security update: Fix heap-based buffer overflow in TIFF2PDF tool
  * CVE-2020-35524[bsc#1182812]
    + tiff-CVE-2020-35524.patch
- security update: Fix integer overflow in tif_getimage
  * CVE-2020-35523 [bsc#1182811]
    + tiff-CVE-2020-35523.patch</changelog>
</package>
<package pkgid="90f175b239f61e5bc8bc2777f4b1547ad8d74a53a962232b934d508b2b5cb14d" name="libtiff-devel" arch="ppc64le">
  <version epoch="0" ver="4.0.9" rel="45.5.1"/>
  <changelog author="fstrba@suse.com" date="1511956800">- Upgrade to upstream release 4.0.9
  * Changes in the software configuration:
    + test/Makefile.am: Add some tests for tiff2bw.
    + .appveyor.yml, .travis.yml, build/travis-ci: apply patches
    0001-ci-Travis-script-improvements.patch and
    0002-ci-Invoke-helper-script-via-shell.patch by Roger Leigh
    + .travis.yml, build/travis-ci: new files from
    0001-ci-Add-Travis-support-for-Linux-builds-with-Autoconf.patch
    by Roger Leigh. This patch adds support for the Travis-CI
    service.
    + .appveyor.yml: new file from
    0002-ci-Add-AppVeyor-support.patch by Roger Leigh (sent to
    mailing list on 2017-06-08) This patch adds a .appveyor.yml
    file to the top-level. This allows one to opt in to having a
    branch built on Windows with Cygwin, MinGW and MSVC
    automatically when a branch is pushed to GitHub, GitLab,
    BitBucket or any other supported git hosting service.
    + CMakeLists.txt, test/CMakeLists.txt,
    test/TiffTestCommon.cmake: apply patch
    0001-cmake-Improve-Cygwin-and-MingGW-test-support.patch from
    Roger Leigh. This patch makes the CMake build system support
    running the tests with MinGW or  Cygwin.
    + test/tiffcp-lzw-compat.sh, test/images/quad-lzw-compat.tiff:
    new files to test old-style LZW decompression
    + test/common.sh, Makefile.am, CMakeList.txt: updated with above
    + test/Makefile.am: add missing reference to
    images/quad-lzw-compat.tiff to fix "make distcheck". Patch by
    Roger Leigh
    + nmake.opt: support a DEBUG=1 option, so as to adjust OPTFLAGS
    and use /MDd runtime in debug mode.
  * Changes in libtiff:
    + libtiff/tif_color.c: TIFFYCbCrToRGBInit(): stricter clamping
    to avoid int32 overflow in TIFFYCbCrtoRGB(). Fixes
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1844
    + libtiff/tif_getimage.c: initYCbCrConversion(): stricter
    validation for refBlackWhite coefficients values. To avoid
    invalid float-&gt;int32 conversion (when refBlackWhite[0] ==
    2147483648.f) Fixes
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1907
    + libtiff/tif_dirinfo.c, tif_dirread.c: add
    _TIFFCheckFieldIsValidForCodec(), and use it in
    TIFFReadDirectory() so as to ignore fields whose tag is a
    codec-specified tag but this codec is not enabled. This avoids
    TIFFGetField() to behave differently depending on whether the
    codec is enabled or not, and thus can avoid stack based buffer
    overflows in a number of TIFF utilities such as tiffsplit,
    tiffcmp, thumbnail, etc. Patch derived from
    0063-Handle-properly-CODEC-specific-tags.patch
    (http://bugzilla.maptools.org/show_bug.cgi?id=2580) by Raphaël
    Hertzog.
    Fixes: http://bugzilla.maptools.org/show_bug.cgi?id=2580
    http://bugzilla.maptools.org/show_bug.cgi?id=2693
    http://bugzilla.maptools.org/show_bug.cgi?id=2625
    (CVE-2016-10095, bsc#1017690)
    http://bugzilla.maptools.org/show_bug.cgi?id=2564
    (CVE-2015-7554, bsc#960341)
    http://bugzilla.maptools.org/show_bug.cgi?id=2561
    (CVE-2016-5318, bsc#983436)
    http://bugzilla.maptools.org/show_bug.cgi?id=2499
    (CVE-2014-8128, bsc#969783)
    http://bugzilla.maptools.org/show_bug.cgi?id=2441
    http://bugzilla.maptools.org/show_bug.cgi?id=2433
    + libtiff/tif_swab.c: if DISABLE_CHECK_TIFFSWABMACROS is
    defined, do not do the #ifdef TIFFSwabXXX checks. Make it
    easier for GDAL to rename the symbols of its internal libtiff
    copy.
    + libtiff/tif_dirread.c: fix regression of libtiff 4.0.8 in
    ChopUpSingleUncompressedStrip() regarding update of newly
    single-strip uncompressed files whose bytecount is 0. Before
    the change of 2016-12-03, the condition bytecount==0 used to
    trigger an early exit/disabling of strip chop. Re-introduce
    that in update mode. Otherwise this cause later incorrect
    setting for the value of StripByCounts/StripOffsets.
    (https://trac.osgeo.org/gdal/ticket/6924)
    + libtiff/tif_dirread.c: TIFFFetchStripThing(): limit the
    number of items read in StripOffsets/StripByteCounts tags to
    the number of strips to avoid excessive memory allocation.
    Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2215
    + libtiff/tif_getimage.c: avoid many (harmless) unsigned int
    overflows.
    + libtiff/tif_fax3.c: avoid unsigned int overflow in
    Fax3Encode2DRow(). Could potentially be a bug with huge rows.
    + libtiff/tif_jpeg.c: avoid (harmless) unsigned int overflow on
    tiled images.
    + libtiff/tif_dirread.c: avoid unsigned int overflow in
    EstimateStripByteCounts() and BYTECOUNTLOOKSBAD when file is
    too short.
    + libtiff/tif_predict.c: decorate legitimate functions where
    unsigned int overflow occur with
    TIFF_NOSANITIZE_UNSIGNED_INT_OVERFLOW
    + libtiff/tif_dirread.c: avoid unsigned int overflow in
    EstimateStripByteCounts()
    + libtiff/tiffiop.h: add TIFF_NOSANITIZE_UNSIGNED_INT_OVERFLOW
    macro to disable CLang warnings raised by
  - fsanitize=undefined,unsigned-integer-overflow
    + libtiff/tif_jpeg.c: add anti-denial of service measure to
    avoid excessive CPU consumption on progressive JPEGs with a
    huge number of scans. See
    http://www.libjpeg-turbo.org/pmwiki/uploads/About/TwoIssueswiththeJPEGStandard.pdf
    Note: only affects libtiff since 2014-12-29 where support of
    non-baseline JPEG was added.
    + libtiff/tif_jpeg.c: error out at decoding time if anticipated
    libjpeg memory allocation is above 100 MB. libjpeg in case of
    multiple scans, which is allowed even in baseline JPEG, if
    components are spread over several scans and not
    interleavedin a single one, needs to allocate memory (or
    backing store) for the whole strip/tile. See
    http://www.libjpeg-turbo.org/pmwiki/uploads/About/TwoIssueswiththeJPEGStandard.pdf
    This limitation may be overriden by setting the
    LIBTIFF_ALLOW_LARGE_LIBJPEG_MEM_ALLOC environment variable, or
    recompiling libtiff with a custom value of
    TIFF_LIBJPEG_LARGEST_MEM_ALLOC macro.
    + libtiff/tif_jbig.c: fix memory leak in error code path of
    JBIGDecode()
    Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2706
    (CVE-2017-9936, bsc#1046073)
    + libtiff/tif_dirread.c: in TIFFReadDirEntryFloat(), check that
    a double value can fit in a float before casting.
    + libtiff/tiffiop.h, libtiff/tif_jpeg.c, libtiff/tif_jpeg_12.c,
    libtiff/tif_read.c: make TIFFReadScanline() works in
    CHUNKY_STRIP_READ_SUPPORT mode with JPEG stream with multiple
    scans. Also make configurable through a
    LIBTIFF_JPEG_MAX_ALLOWED_SCAN_NUMBER environment variable the
    maximum number of scans allowed. Defaults to 100.
    + libtiff/tif_read.c: TIFFFillTile(): add limitation to the
    number of bytes read in case td_stripbytecount[strip] is
    bigger than reasonable, so as to avoid excessive memory
    allocation (similarly to what was done for TIFFFileStrip() on
    2017-05-10)
    + libtiff/tif_getimage.c: use
    _TIFFReadEncodedStripAndAllocBuffer(). Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2708 and
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2433
    + libtiff/tif_read.c, tiffiop.h: add a
    _TIFFReadEncodedStripAndAllocBuffer() function, variant of
    TIFFReadEncodedStrip() that allocates the decoded buffer only
    after a first successful TIFFFillStrip(). This avoids
    excessive memory allocation on corrupted files.
    + libtiff/tif_dirwrite.c: in TIFFWriteDirectoryTagCheckedXXXX()
    functions associated with LONG8/SLONG8 data type, replace
    assertion that the file is BigTIFF, by a non-fatal error.
    Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2712
    + libtiff/tif_read.c: TIFFStartTile(): set tif_rawcc to
    tif_rawdataloaded when it is set. Similarly to
    TIFFStartStrip(). This issue was revealed by the change of
    2017-06-30 in TIFFFileTile(), limiting the number of bytes
    read. But it could probably have been hit too in
    CHUNKY_STRIP_READ_SUPPORT mode previously. Fixes
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2454
    + libtiff/tif_error.c, tif_warning.c: correctly use va_list
    when both an old-style and new-style warning/error handlers
    are installed. Patch by Paavo Helde (sent on the mailing list)
    + libtiff/tif_getimage.c: use _TIFFReadTileAndAllocBuffer().
    Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2470
    + libtiff/tif_read.c, tiffiop.h: add a
    _TIFFReadEncodedTileAndAllocBuffer() and
    _TIFFReadTileAndAllocBuffer() variants of
    TIFFReadEncodedTile() and TIFFReadTile() that allocates the
    decoded buffer only after a first successful TIFFFillTile().
    This avoids excessive memory allocation on corrupted files.
    + libtiff/tif_pixarlog.c: avoid excessive memory allocation on
    decoding when RowsPerStrip tag is not defined (and thus
    td_rowsperstrip == UINT_MAX) Fixes
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2554
    + libtiff/tif_lzw.c: fix 4.0.8 regression in the decoding of
    old-style LZW compressed files.
    + libtiff/tif_lzw.c: fix potential out-of-buffer read on 1-byte
    LZW strips. Crashing issue only on memory mapped files, where
    the strip offset is the last byte of the file, and the file
    size is a multiple of one page size on the CPU architecture
    (typically 4096)
    + libtiff/tif_dir.c: avoid potential null pointer dereference
    in _TIFFVGetField() on corrupted TIFFTAG_NUMBEROFINKS tag
    instance.
    Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2713
    + tools/tiff2pdf.c: prevent heap buffer overflow write in "Raw"
    mode on PlanarConfig=Contig input images. Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2715
    + libtiff/tif_read.c: TIFFFillStrip() / TIFFFillTile().
    Complementary fix for
    http://bugzilla.maptools.org/show_bug.cgi?id=2708 in the
    isMapped() case, so as to avoid excessive memory allocation
    when we need a temporary buffer but the file is truncated.
    + libtiff/tif_read.c: in TIFFFetchStripThing(), only grow the
    arrays that hold StripOffsets/StripByteCounts, when they are
    smaller than the expected number of striles, up to 1 million
    striles, and error out beyond. Can be tweaked by setting the
    environment variable LIBTIFF_STRILE_ARRAY_MAX_RESIZE_COUNT.
    This partially goes against a change added on 2002-12-17 to
    accept those arrays of wrong sizes, but is needed to avoid
    denial of services. Fixes
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2350
    + libtiff/tif_read.c: add protection against excessive memory
    allocation attempts in TIFFReadDirEntryArray() on short files.
    Effective for mmap'ed case. And non-mmap'ed case, but
    restricted to 64bit builds. Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2675
    (CVE-2017-12944, bsc#1054594)
    + libtiff/tif_luv.c: LogLuvInitState(): avoid excessive memory
    allocation when RowsPerStrip tag is missing. Fixes
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2683
    + libtiff/tif_getimage.c: gtTileContig() and gtTileSeparate():
    properly break from loops on error when stoponerr is set,
    instead of going on iterating on row based loop.
    + libtiff/tif_getimage.c: fix fromskew computation when
    to-be-skipped pixel number is not a multiple of the horizontal
    subsampling, and also in some other cases. Impact
    putcontig8bitYCbCr44tile, putcontig8bitYCbCr42tile,
    putcontig8bitYCbCr41tile, putcontig8bitYCbCr21tile and
    putcontig8bitYCbCr12tile Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2637 and
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2691
    + libtiff/tif_luv.c: further reduce memory requirements for
    temporary buffer when RowsPerStrip &gt;= image_length in
    LogLuvInitState() and LogL16InitState(). Fixes
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2700
    + libtiff/tif_dirwrite.c: replace assertion related to not
    finding the SubIFD tag by runtime check (in
    TIFFWriteDirectorySec()) Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2727
    + libtiff/tif_dirwrite.c: replace assertion to tag value not
    fitting on uint32 when selecting the value of SubIFD tag by
    runtime check (in TIFFWriteDirectoryTagSubifd()). Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2728
    + libtiff/tif_jpeg.c: accept reading the last strip of a JPEG
    compressed file if the codestream height is larger than the
    truncated height of the strip. Emit a warning in this
    situation since this is non compliant.
    + libtiff/tiffiop.h, tif_aux.c: redirect SeekOK() macro to a
    _TIFFSeekoK() function that checks if the offset is not
    bigger than INT64_MAX, so as to avoid a -1 error return code
    of TIFFSeekFile() to match a required seek to UINT64_MAX/-1.
    Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2726
    + libtiff/tif_dirread.c: add NULL check to avoid likely false
    positive null-pointer dereference warning by CLang Static
    Analyzer.
    + libtiff/libtiff.def: add TIFFReadRGBAStripExt and
    TIFFReadRGBATileExt Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2735
    + libtiff/tif_jpeg.c: add compatibility with libjpeg-turbo
    1.5.2 that honours max_memory_to_use &gt; 0. Cf
    https://github.com/libjpeg-turbo/libjpeg-turbo/issues/162
    + libtiff/tif_getimage.c: avoid floating point division by zero
    in initCIELabConversion() Fixes
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=3733
  * Changes in the tools:
    + tools/tiff2pdf.c: prevent heap buffer overflow write in "Raw"
    mode on PlanarConfig=Contig input images. Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2715
    + tools/tiffset.c: fix setting a single value for the
    ExtraSamples tag (and other tags with variable number of
    values). So 'tiffset -s ExtraSamples 1 X'. This only worked
    when setting 2 or more values, but not just one.
    + tools/fax2tiff.c (_FAX_Client_Data): Pass FAX_Client_Data as
    the client data. This client data is not used at all at the
    moment, but it makes the most sense. Issue that the value of
    client_data.fd was passed where a pointer is expected.
    + tools/tiff2pdf.c (t2p_sample_realize_palette): Fix possible
    arithmetic overflow in bounds checking code and eliminate
    comparison between signed and unsigned type.
    + tools/tiff2bw.c (main): Free memory allocated in the tiff2bw
    program. This is in response to the report associated with
    CVE-2017-16232, bsc#1069213 but does not solve the extremely
    high memory usage with the associated POC file.</changelog>
  <changelog author="dimstar@opensuse.org" date="1513857600">- Fix check section:
  + Make sure to get back to the right directory after chdir to
    'tools', or we can't run the 2nd test suite.
  + Fix typo: the tests are located in a directory called 'test',
    not 'tests'.</changelog>
  <changelog author="mvetter@suse.com" date="1518782400">- bsc#1046077: Add tiff-4.0.9-bsc1046077-CVE-2017-9935.patch
  Fix Heap-based buffer overflow in t2p_write_pdf</changelog>
  <changelog author="mvetter@suse.com" date="1519128000">- bsc#1081690: Add tiff-4.0.9-bsc1081690-CVE-2018-5784.patch
  Fix uncontrolled resource consumption in TIFFSetDirectory</changelog>
  <changelog author="pgajdos@suse.com" date="1526385600">- security update
  * CVE-2018-10963 [bsc#1092949]
    + tiff-CVE-2018-10963.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1526644800">- security update
  * CVE-2017-18013 [bsc#1074317]
    + tiff-CVE-2017-18013.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1528113600">- security update
  * CVE-2018-7456 [bsc#1082825]
    + tiff-CVE-2018-7456.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1528113601">- security update
  * CVE-2017-11613 [bsc#1082332]
    + tiff-CVE-2017-11613.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1528200000">- security update
  * CVE-2018-8905 [bsc#1086408]
    + tiff-CVE-2018-8905.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1534334400">- security update
  * CVE-2018-10779 [bsc#1092480]
    + tiff-CVE-2018-10779.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1539777600">- security update
  * CVE-2018-17100 [bsc#1108637]
    + tiff-CVE-2018-17100.patch
  * CVE-2018-17101 [bsc#1108627]
    + tiff-CVE-2018-17101.patch
  * CVE-2018-17795 [bsc#1110358]
    % tiff-4.0.9-bsc1046077-CVE-2017-9935.patch renamed to
    tiff-CVE-2017-9935,CVE-2018-17795.patch
  * CVE-2018-16335 [bsc#1106853]
    % tiff-CVE-2017-11613.patch renamed to
    tiff-CVE-2017-11613,CVE-2018-16335,15209.patch
- add a possibility to build with ASAN</changelog>
  <changelog author="pgajdos@suse.com" date="1542024000">- asan_build: build ASAN included
- debug_build: build more suitable for debugging</changelog>
  <changelog author="pgajdos@suse.com" date="1542024001">- security update
  * CVE-2018-18661 [bsc#1113672]
    + tiff-CVE-2018-18661.patch
  * CVE-2018-18557 [bsc#1113094]
    + tiff-CVE-2018-18557.patch
  * CVE-2018-12900 [bsc#1099257]
    + tiff-CVE-2018-12900.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1542628800">- security update
  * CVE-2018-19210 [bsc#1115717]
    + tiff-CVE-2018-19210.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1548849600">- extend tiff-CVE-2018-19210.patch and rename it to
  tiff-CVE-2018-17000,19210.patch [bsc#1108606c#11]
  * solves CVE-2018-19210 [bsc#1115717] and CVE-2018-17000 [bsc#1108606]</changelog>
  <changelog author="mvetter@suse.com" date="1549281600">- security update
  * CVE-2019-6128 [bsc#1121626]
    + tiff-CVE-2019-6128.patch</changelog>
  <changelog author="mvetter@suse.com" date="1549972800">- security update
  * CVE-2019-7663 [bsc#1125113]
    + tiff-CVE-2019-7663.patch</changelog>
  <changelog author="mvetter@suse.com" date="1573041600">- security update: Fix integer overflow in _TIFFCheckMalloc()
  * CVE-2019-14973 [bsc#1146608]
    + tiff-CVE-2019-14973.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1573041601">- security update: amend patch to fix test
- modified patches
  % tiff-CVE-2019-14973.patch (refreshed)</changelog>
  <changelog author="mvetter@suse.com" date="1642420800">- security update: Fix buffer overwrite
  * CVE-2019-17546[bsc#1154365]
    + tiff-CVE-2019-17546.patch
- security update: Fix heap based buffer overflow in pal2rgb
  * CVE-2017-17095[bsc#1071031]
    + tiff-CVE-2017-17095.patch
- security update: Fix OOB in _TIFFmemcpy
  * CVE-2022-22844[bsc#1194539]
    + tiff-CVE-2022-22844.patch
- security update: Fix memory allocation failure in tif_read.c
  * CVE-2020-35521[bsc#1182808] CVE-2020-35522[bsc#1182809]
    + tiff-CVE-2020-35521,CVE-2020-35522.patch
- security update: Fix DOS via invertImage()
  * CVE-2020-19131[bsc#1190312]
    + tiff-CVE-2020-19131.patch
- security update: Fix heap-based buffer overflow in TIFF2PDF tool
  * CVE-2020-35524[bsc#1182812]
    + tiff-CVE-2020-35524.patch
- security update: Fix integer overflow in tif_getimage
  * CVE-2020-35523 [bsc#1182811]
    + tiff-CVE-2020-35523.patch</changelog>
</package>
<package pkgid="517cb86d3c89314ac69360a87b7e340239bbdf2baf072576b6554bf7a6bb3938" name="libtiff-devel" arch="s390x">
  <version epoch="0" ver="4.0.9" rel="45.5.1"/>
  <changelog author="fstrba@suse.com" date="1511956800">- Upgrade to upstream release 4.0.9
  * Changes in the software configuration:
    + test/Makefile.am: Add some tests for tiff2bw.
    + .appveyor.yml, .travis.yml, build/travis-ci: apply patches
    0001-ci-Travis-script-improvements.patch and
    0002-ci-Invoke-helper-script-via-shell.patch by Roger Leigh
    + .travis.yml, build/travis-ci: new files from
    0001-ci-Add-Travis-support-for-Linux-builds-with-Autoconf.patch
    by Roger Leigh. This patch adds support for the Travis-CI
    service.
    + .appveyor.yml: new file from
    0002-ci-Add-AppVeyor-support.patch by Roger Leigh (sent to
    mailing list on 2017-06-08) This patch adds a .appveyor.yml
    file to the top-level. This allows one to opt in to having a
    branch built on Windows with Cygwin, MinGW and MSVC
    automatically when a branch is pushed to GitHub, GitLab,
    BitBucket or any other supported git hosting service.
    + CMakeLists.txt, test/CMakeLists.txt,
    test/TiffTestCommon.cmake: apply patch
    0001-cmake-Improve-Cygwin-and-MingGW-test-support.patch from
    Roger Leigh. This patch makes the CMake build system support
    running the tests with MinGW or  Cygwin.
    + test/tiffcp-lzw-compat.sh, test/images/quad-lzw-compat.tiff:
    new files to test old-style LZW decompression
    + test/common.sh, Makefile.am, CMakeList.txt: updated with above
    + test/Makefile.am: add missing reference to
    images/quad-lzw-compat.tiff to fix "make distcheck". Patch by
    Roger Leigh
    + nmake.opt: support a DEBUG=1 option, so as to adjust OPTFLAGS
    and use /MDd runtime in debug mode.
  * Changes in libtiff:
    + libtiff/tif_color.c: TIFFYCbCrToRGBInit(): stricter clamping
    to avoid int32 overflow in TIFFYCbCrtoRGB(). Fixes
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1844
    + libtiff/tif_getimage.c: initYCbCrConversion(): stricter
    validation for refBlackWhite coefficients values. To avoid
    invalid float-&gt;int32 conversion (when refBlackWhite[0] ==
    2147483648.f) Fixes
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1907
    + libtiff/tif_dirinfo.c, tif_dirread.c: add
    _TIFFCheckFieldIsValidForCodec(), and use it in
    TIFFReadDirectory() so as to ignore fields whose tag is a
    codec-specified tag but this codec is not enabled. This avoids
    TIFFGetField() to behave differently depending on whether the
    codec is enabled or not, and thus can avoid stack based buffer
    overflows in a number of TIFF utilities such as tiffsplit,
    tiffcmp, thumbnail, etc. Patch derived from
    0063-Handle-properly-CODEC-specific-tags.patch
    (http://bugzilla.maptools.org/show_bug.cgi?id=2580) by Raphaël
    Hertzog.
    Fixes: http://bugzilla.maptools.org/show_bug.cgi?id=2580
    http://bugzilla.maptools.org/show_bug.cgi?id=2693
    http://bugzilla.maptools.org/show_bug.cgi?id=2625
    (CVE-2016-10095, bsc#1017690)
    http://bugzilla.maptools.org/show_bug.cgi?id=2564
    (CVE-2015-7554, bsc#960341)
    http://bugzilla.maptools.org/show_bug.cgi?id=2561
    (CVE-2016-5318, bsc#983436)
    http://bugzilla.maptools.org/show_bug.cgi?id=2499
    (CVE-2014-8128, bsc#969783)
    http://bugzilla.maptools.org/show_bug.cgi?id=2441
    http://bugzilla.maptools.org/show_bug.cgi?id=2433
    + libtiff/tif_swab.c: if DISABLE_CHECK_TIFFSWABMACROS is
    defined, do not do the #ifdef TIFFSwabXXX checks. Make it
    easier for GDAL to rename the symbols of its internal libtiff
    copy.
    + libtiff/tif_dirread.c: fix regression of libtiff 4.0.8 in
    ChopUpSingleUncompressedStrip() regarding update of newly
    single-strip uncompressed files whose bytecount is 0. Before
    the change of 2016-12-03, the condition bytecount==0 used to
    trigger an early exit/disabling of strip chop. Re-introduce
    that in update mode. Otherwise this cause later incorrect
    setting for the value of StripByCounts/StripOffsets.
    (https://trac.osgeo.org/gdal/ticket/6924)
    + libtiff/tif_dirread.c: TIFFFetchStripThing(): limit the
    number of items read in StripOffsets/StripByteCounts tags to
    the number of strips to avoid excessive memory allocation.
    Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2215
    + libtiff/tif_getimage.c: avoid many (harmless) unsigned int
    overflows.
    + libtiff/tif_fax3.c: avoid unsigned int overflow in
    Fax3Encode2DRow(). Could potentially be a bug with huge rows.
    + libtiff/tif_jpeg.c: avoid (harmless) unsigned int overflow on
    tiled images.
    + libtiff/tif_dirread.c: avoid unsigned int overflow in
    EstimateStripByteCounts() and BYTECOUNTLOOKSBAD when file is
    too short.
    + libtiff/tif_predict.c: decorate legitimate functions where
    unsigned int overflow occur with
    TIFF_NOSANITIZE_UNSIGNED_INT_OVERFLOW
    + libtiff/tif_dirread.c: avoid unsigned int overflow in
    EstimateStripByteCounts()
    + libtiff/tiffiop.h: add TIFF_NOSANITIZE_UNSIGNED_INT_OVERFLOW
    macro to disable CLang warnings raised by
  - fsanitize=undefined,unsigned-integer-overflow
    + libtiff/tif_jpeg.c: add anti-denial of service measure to
    avoid excessive CPU consumption on progressive JPEGs with a
    huge number of scans. See
    http://www.libjpeg-turbo.org/pmwiki/uploads/About/TwoIssueswiththeJPEGStandard.pdf
    Note: only affects libtiff since 2014-12-29 where support of
    non-baseline JPEG was added.
    + libtiff/tif_jpeg.c: error out at decoding time if anticipated
    libjpeg memory allocation is above 100 MB. libjpeg in case of
    multiple scans, which is allowed even in baseline JPEG, if
    components are spread over several scans and not
    interleavedin a single one, needs to allocate memory (or
    backing store) for the whole strip/tile. See
    http://www.libjpeg-turbo.org/pmwiki/uploads/About/TwoIssueswiththeJPEGStandard.pdf
    This limitation may be overriden by setting the
    LIBTIFF_ALLOW_LARGE_LIBJPEG_MEM_ALLOC environment variable, or
    recompiling libtiff with a custom value of
    TIFF_LIBJPEG_LARGEST_MEM_ALLOC macro.
    + libtiff/tif_jbig.c: fix memory leak in error code path of
    JBIGDecode()
    Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2706
    (CVE-2017-9936, bsc#1046073)
    + libtiff/tif_dirread.c: in TIFFReadDirEntryFloat(), check that
    a double value can fit in a float before casting.
    + libtiff/tiffiop.h, libtiff/tif_jpeg.c, libtiff/tif_jpeg_12.c,
    libtiff/tif_read.c: make TIFFReadScanline() works in
    CHUNKY_STRIP_READ_SUPPORT mode with JPEG stream with multiple
    scans. Also make configurable through a
    LIBTIFF_JPEG_MAX_ALLOWED_SCAN_NUMBER environment variable the
    maximum number of scans allowed. Defaults to 100.
    + libtiff/tif_read.c: TIFFFillTile(): add limitation to the
    number of bytes read in case td_stripbytecount[strip] is
    bigger than reasonable, so as to avoid excessive memory
    allocation (similarly to what was done for TIFFFileStrip() on
    2017-05-10)
    + libtiff/tif_getimage.c: use
    _TIFFReadEncodedStripAndAllocBuffer(). Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2708 and
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2433
    + libtiff/tif_read.c, tiffiop.h: add a
    _TIFFReadEncodedStripAndAllocBuffer() function, variant of
    TIFFReadEncodedStrip() that allocates the decoded buffer only
    after a first successful TIFFFillStrip(). This avoids
    excessive memory allocation on corrupted files.
    + libtiff/tif_dirwrite.c: in TIFFWriteDirectoryTagCheckedXXXX()
    functions associated with LONG8/SLONG8 data type, replace
    assertion that the file is BigTIFF, by a non-fatal error.
    Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2712
    + libtiff/tif_read.c: TIFFStartTile(): set tif_rawcc to
    tif_rawdataloaded when it is set. Similarly to
    TIFFStartStrip(). This issue was revealed by the change of
    2017-06-30 in TIFFFileTile(), limiting the number of bytes
    read. But it could probably have been hit too in
    CHUNKY_STRIP_READ_SUPPORT mode previously. Fixes
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2454
    + libtiff/tif_error.c, tif_warning.c: correctly use va_list
    when both an old-style and new-style warning/error handlers
    are installed. Patch by Paavo Helde (sent on the mailing list)
    + libtiff/tif_getimage.c: use _TIFFReadTileAndAllocBuffer().
    Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2470
    + libtiff/tif_read.c, tiffiop.h: add a
    _TIFFReadEncodedTileAndAllocBuffer() and
    _TIFFReadTileAndAllocBuffer() variants of
    TIFFReadEncodedTile() and TIFFReadTile() that allocates the
    decoded buffer only after a first successful TIFFFillTile().
    This avoids excessive memory allocation on corrupted files.
    + libtiff/tif_pixarlog.c: avoid excessive memory allocation on
    decoding when RowsPerStrip tag is not defined (and thus
    td_rowsperstrip == UINT_MAX) Fixes
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2554
    + libtiff/tif_lzw.c: fix 4.0.8 regression in the decoding of
    old-style LZW compressed files.
    + libtiff/tif_lzw.c: fix potential out-of-buffer read on 1-byte
    LZW strips. Crashing issue only on memory mapped files, where
    the strip offset is the last byte of the file, and the file
    size is a multiple of one page size on the CPU architecture
    (typically 4096)
    + libtiff/tif_dir.c: avoid potential null pointer dereference
    in _TIFFVGetField() on corrupted TIFFTAG_NUMBEROFINKS tag
    instance.
    Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2713
    + tools/tiff2pdf.c: prevent heap buffer overflow write in "Raw"
    mode on PlanarConfig=Contig input images. Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2715
    + libtiff/tif_read.c: TIFFFillStrip() / TIFFFillTile().
    Complementary fix for
    http://bugzilla.maptools.org/show_bug.cgi?id=2708 in the
    isMapped() case, so as to avoid excessive memory allocation
    when we need a temporary buffer but the file is truncated.
    + libtiff/tif_read.c: in TIFFFetchStripThing(), only grow the
    arrays that hold StripOffsets/StripByteCounts, when they are
    smaller than the expected number of striles, up to 1 million
    striles, and error out beyond. Can be tweaked by setting the
    environment variable LIBTIFF_STRILE_ARRAY_MAX_RESIZE_COUNT.
    This partially goes against a change added on 2002-12-17 to
    accept those arrays of wrong sizes, but is needed to avoid
    denial of services. Fixes
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2350
    + libtiff/tif_read.c: add protection against excessive memory
    allocation attempts in TIFFReadDirEntryArray() on short files.
    Effective for mmap'ed case. And non-mmap'ed case, but
    restricted to 64bit builds. Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2675
    (CVE-2017-12944, bsc#1054594)
    + libtiff/tif_luv.c: LogLuvInitState(): avoid excessive memory
    allocation when RowsPerStrip tag is missing. Fixes
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2683
    + libtiff/tif_getimage.c: gtTileContig() and gtTileSeparate():
    properly break from loops on error when stoponerr is set,
    instead of going on iterating on row based loop.
    + libtiff/tif_getimage.c: fix fromskew computation when
    to-be-skipped pixel number is not a multiple of the horizontal
    subsampling, and also in some other cases. Impact
    putcontig8bitYCbCr44tile, putcontig8bitYCbCr42tile,
    putcontig8bitYCbCr41tile, putcontig8bitYCbCr21tile and
    putcontig8bitYCbCr12tile Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2637 and
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2691
    + libtiff/tif_luv.c: further reduce memory requirements for
    temporary buffer when RowsPerStrip &gt;= image_length in
    LogLuvInitState() and LogL16InitState(). Fixes
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2700
    + libtiff/tif_dirwrite.c: replace assertion related to not
    finding the SubIFD tag by runtime check (in
    TIFFWriteDirectorySec()) Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2727
    + libtiff/tif_dirwrite.c: replace assertion to tag value not
    fitting on uint32 when selecting the value of SubIFD tag by
    runtime check (in TIFFWriteDirectoryTagSubifd()). Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2728
    + libtiff/tif_jpeg.c: accept reading the last strip of a JPEG
    compressed file if the codestream height is larger than the
    truncated height of the strip. Emit a warning in this
    situation since this is non compliant.
    + libtiff/tiffiop.h, tif_aux.c: redirect SeekOK() macro to a
    _TIFFSeekoK() function that checks if the offset is not
    bigger than INT64_MAX, so as to avoid a -1 error return code
    of TIFFSeekFile() to match a required seek to UINT64_MAX/-1.
    Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2726
    + libtiff/tif_dirread.c: add NULL check to avoid likely false
    positive null-pointer dereference warning by CLang Static
    Analyzer.
    + libtiff/libtiff.def: add TIFFReadRGBAStripExt and
    TIFFReadRGBATileExt Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2735
    + libtiff/tif_jpeg.c: add compatibility with libjpeg-turbo
    1.5.2 that honours max_memory_to_use &gt; 0. Cf
    https://github.com/libjpeg-turbo/libjpeg-turbo/issues/162
    + libtiff/tif_getimage.c: avoid floating point division by zero
    in initCIELabConversion() Fixes
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=3733
  * Changes in the tools:
    + tools/tiff2pdf.c: prevent heap buffer overflow write in "Raw"
    mode on PlanarConfig=Contig input images. Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2715
    + tools/tiffset.c: fix setting a single value for the
    ExtraSamples tag (and other tags with variable number of
    values). So 'tiffset -s ExtraSamples 1 X'. This only worked
    when setting 2 or more values, but not just one.
    + tools/fax2tiff.c (_FAX_Client_Data): Pass FAX_Client_Data as
    the client data. This client data is not used at all at the
    moment, but it makes the most sense. Issue that the value of
    client_data.fd was passed where a pointer is expected.
    + tools/tiff2pdf.c (t2p_sample_realize_palette): Fix possible
    arithmetic overflow in bounds checking code and eliminate
    comparison between signed and unsigned type.
    + tools/tiff2bw.c (main): Free memory allocated in the tiff2bw
    program. This is in response to the report associated with
    CVE-2017-16232, bsc#1069213 but does not solve the extremely
    high memory usage with the associated POC file.</changelog>
  <changelog author="dimstar@opensuse.org" date="1513857600">- Fix check section:
  + Make sure to get back to the right directory after chdir to
    'tools', or we can't run the 2nd test suite.
  + Fix typo: the tests are located in a directory called 'test',
    not 'tests'.</changelog>
  <changelog author="mvetter@suse.com" date="1518782400">- bsc#1046077: Add tiff-4.0.9-bsc1046077-CVE-2017-9935.patch
  Fix Heap-based buffer overflow in t2p_write_pdf</changelog>
  <changelog author="mvetter@suse.com" date="1519128000">- bsc#1081690: Add tiff-4.0.9-bsc1081690-CVE-2018-5784.patch
  Fix uncontrolled resource consumption in TIFFSetDirectory</changelog>
  <changelog author="pgajdos@suse.com" date="1526385600">- security update
  * CVE-2018-10963 [bsc#1092949]
    + tiff-CVE-2018-10963.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1526644800">- security update
  * CVE-2017-18013 [bsc#1074317]
    + tiff-CVE-2017-18013.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1528113600">- security update
  * CVE-2018-7456 [bsc#1082825]
    + tiff-CVE-2018-7456.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1528113601">- security update
  * CVE-2017-11613 [bsc#1082332]
    + tiff-CVE-2017-11613.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1528200000">- security update
  * CVE-2018-8905 [bsc#1086408]
    + tiff-CVE-2018-8905.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1534334400">- security update
  * CVE-2018-10779 [bsc#1092480]
    + tiff-CVE-2018-10779.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1539777600">- security update
  * CVE-2018-17100 [bsc#1108637]
    + tiff-CVE-2018-17100.patch
  * CVE-2018-17101 [bsc#1108627]
    + tiff-CVE-2018-17101.patch
  * CVE-2018-17795 [bsc#1110358]
    % tiff-4.0.9-bsc1046077-CVE-2017-9935.patch renamed to
    tiff-CVE-2017-9935,CVE-2018-17795.patch
  * CVE-2018-16335 [bsc#1106853]
    % tiff-CVE-2017-11613.patch renamed to
    tiff-CVE-2017-11613,CVE-2018-16335,15209.patch
- add a possibility to build with ASAN</changelog>
  <changelog author="pgajdos@suse.com" date="1542024000">- asan_build: build ASAN included
- debug_build: build more suitable for debugging</changelog>
  <changelog author="pgajdos@suse.com" date="1542024001">- security update
  * CVE-2018-18661 [bsc#1113672]
    + tiff-CVE-2018-18661.patch
  * CVE-2018-18557 [bsc#1113094]
    + tiff-CVE-2018-18557.patch
  * CVE-2018-12900 [bsc#1099257]
    + tiff-CVE-2018-12900.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1542628800">- security update
  * CVE-2018-19210 [bsc#1115717]
    + tiff-CVE-2018-19210.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1548849600">- extend tiff-CVE-2018-19210.patch and rename it to
  tiff-CVE-2018-17000,19210.patch [bsc#1108606c#11]
  * solves CVE-2018-19210 [bsc#1115717] and CVE-2018-17000 [bsc#1108606]</changelog>
  <changelog author="mvetter@suse.com" date="1549281600">- security update
  * CVE-2019-6128 [bsc#1121626]
    + tiff-CVE-2019-6128.patch</changelog>
  <changelog author="mvetter@suse.com" date="1549972800">- security update
  * CVE-2019-7663 [bsc#1125113]
    + tiff-CVE-2019-7663.patch</changelog>
  <changelog author="mvetter@suse.com" date="1573041600">- security update: Fix integer overflow in _TIFFCheckMalloc()
  * CVE-2019-14973 [bsc#1146608]
    + tiff-CVE-2019-14973.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1573041601">- security update: amend patch to fix test
- modified patches
  % tiff-CVE-2019-14973.patch (refreshed)</changelog>
  <changelog author="mvetter@suse.com" date="1642420800">- security update: Fix buffer overwrite
  * CVE-2019-17546[bsc#1154365]
    + tiff-CVE-2019-17546.patch
- security update: Fix heap based buffer overflow in pal2rgb
  * CVE-2017-17095[bsc#1071031]
    + tiff-CVE-2017-17095.patch
- security update: Fix OOB in _TIFFmemcpy
  * CVE-2022-22844[bsc#1194539]
    + tiff-CVE-2022-22844.patch
- security update: Fix memory allocation failure in tif_read.c
  * CVE-2020-35521[bsc#1182808] CVE-2020-35522[bsc#1182809]
    + tiff-CVE-2020-35521,CVE-2020-35522.patch
- security update: Fix DOS via invertImage()
  * CVE-2020-19131[bsc#1190312]
    + tiff-CVE-2020-19131.patch
- security update: Fix heap-based buffer overflow in TIFF2PDF tool
  * CVE-2020-35524[bsc#1182812]
    + tiff-CVE-2020-35524.patch
- security update: Fix integer overflow in tif_getimage
  * CVE-2020-35523 [bsc#1182811]
    + tiff-CVE-2020-35523.patch</changelog>
</package>
<package pkgid="e2516cd08042920a368c306a3befd395a6777f5fdcb5a422539aa0a0adf460f3" name="libtiff-devel" arch="x86_64">
  <version epoch="0" ver="4.0.9" rel="45.5.1"/>
  <changelog author="fstrba@suse.com" date="1511956800">- Upgrade to upstream release 4.0.9
  * Changes in the software configuration:
    + test/Makefile.am: Add some tests for tiff2bw.
    + .appveyor.yml, .travis.yml, build/travis-ci: apply patches
    0001-ci-Travis-script-improvements.patch and
    0002-ci-Invoke-helper-script-via-shell.patch by Roger Leigh
    + .travis.yml, build/travis-ci: new files from
    0001-ci-Add-Travis-support-for-Linux-builds-with-Autoconf.patch
    by Roger Leigh. This patch adds support for the Travis-CI
    service.
    + .appveyor.yml: new file from
    0002-ci-Add-AppVeyor-support.patch by Roger Leigh (sent to
    mailing list on 2017-06-08) This patch adds a .appveyor.yml
    file to the top-level. This allows one to opt in to having a
    branch built on Windows with Cygwin, MinGW and MSVC
    automatically when a branch is pushed to GitHub, GitLab,
    BitBucket or any other supported git hosting service.
    + CMakeLists.txt, test/CMakeLists.txt,
    test/TiffTestCommon.cmake: apply patch
    0001-cmake-Improve-Cygwin-and-MingGW-test-support.patch from
    Roger Leigh. This patch makes the CMake build system support
    running the tests with MinGW or  Cygwin.
    + test/tiffcp-lzw-compat.sh, test/images/quad-lzw-compat.tiff:
    new files to test old-style LZW decompression
    + test/common.sh, Makefile.am, CMakeList.txt: updated with above
    + test/Makefile.am: add missing reference to
    images/quad-lzw-compat.tiff to fix "make distcheck". Patch by
    Roger Leigh
    + nmake.opt: support a DEBUG=1 option, so as to adjust OPTFLAGS
    and use /MDd runtime in debug mode.
  * Changes in libtiff:
    + libtiff/tif_color.c: TIFFYCbCrToRGBInit(): stricter clamping
    to avoid int32 overflow in TIFFYCbCrtoRGB(). Fixes
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1844
    + libtiff/tif_getimage.c: initYCbCrConversion(): stricter
    validation for refBlackWhite coefficients values. To avoid
    invalid float-&gt;int32 conversion (when refBlackWhite[0] ==
    2147483648.f) Fixes
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1907
    + libtiff/tif_dirinfo.c, tif_dirread.c: add
    _TIFFCheckFieldIsValidForCodec(), and use it in
    TIFFReadDirectory() so as to ignore fields whose tag is a
    codec-specified tag but this codec is not enabled. This avoids
    TIFFGetField() to behave differently depending on whether the
    codec is enabled or not, and thus can avoid stack based buffer
    overflows in a number of TIFF utilities such as tiffsplit,
    tiffcmp, thumbnail, etc. Patch derived from
    0063-Handle-properly-CODEC-specific-tags.patch
    (http://bugzilla.maptools.org/show_bug.cgi?id=2580) by Raphaël
    Hertzog.
    Fixes: http://bugzilla.maptools.org/show_bug.cgi?id=2580
    http://bugzilla.maptools.org/show_bug.cgi?id=2693
    http://bugzilla.maptools.org/show_bug.cgi?id=2625
    (CVE-2016-10095, bsc#1017690)
    http://bugzilla.maptools.org/show_bug.cgi?id=2564
    (CVE-2015-7554, bsc#960341)
    http://bugzilla.maptools.org/show_bug.cgi?id=2561
    (CVE-2016-5318, bsc#983436)
    http://bugzilla.maptools.org/show_bug.cgi?id=2499
    (CVE-2014-8128, bsc#969783)
    http://bugzilla.maptools.org/show_bug.cgi?id=2441
    http://bugzilla.maptools.org/show_bug.cgi?id=2433
    + libtiff/tif_swab.c: if DISABLE_CHECK_TIFFSWABMACROS is
    defined, do not do the #ifdef TIFFSwabXXX checks. Make it
    easier for GDAL to rename the symbols of its internal libtiff
    copy.
    + libtiff/tif_dirread.c: fix regression of libtiff 4.0.8 in
    ChopUpSingleUncompressedStrip() regarding update of newly
    single-strip uncompressed files whose bytecount is 0. Before
    the change of 2016-12-03, the condition bytecount==0 used to
    trigger an early exit/disabling of strip chop. Re-introduce
    that in update mode. Otherwise this cause later incorrect
    setting for the value of StripByCounts/StripOffsets.
    (https://trac.osgeo.org/gdal/ticket/6924)
    + libtiff/tif_dirread.c: TIFFFetchStripThing(): limit the
    number of items read in StripOffsets/StripByteCounts tags to
    the number of strips to avoid excessive memory allocation.
    Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2215
    + libtiff/tif_getimage.c: avoid many (harmless) unsigned int
    overflows.
    + libtiff/tif_fax3.c: avoid unsigned int overflow in
    Fax3Encode2DRow(). Could potentially be a bug with huge rows.
    + libtiff/tif_jpeg.c: avoid (harmless) unsigned int overflow on
    tiled images.
    + libtiff/tif_dirread.c: avoid unsigned int overflow in
    EstimateStripByteCounts() and BYTECOUNTLOOKSBAD when file is
    too short.
    + libtiff/tif_predict.c: decorate legitimate functions where
    unsigned int overflow occur with
    TIFF_NOSANITIZE_UNSIGNED_INT_OVERFLOW
    + libtiff/tif_dirread.c: avoid unsigned int overflow in
    EstimateStripByteCounts()
    + libtiff/tiffiop.h: add TIFF_NOSANITIZE_UNSIGNED_INT_OVERFLOW
    macro to disable CLang warnings raised by
  - fsanitize=undefined,unsigned-integer-overflow
    + libtiff/tif_jpeg.c: add anti-denial of service measure to
    avoid excessive CPU consumption on progressive JPEGs with a
    huge number of scans. See
    http://www.libjpeg-turbo.org/pmwiki/uploads/About/TwoIssueswiththeJPEGStandard.pdf
    Note: only affects libtiff since 2014-12-29 where support of
    non-baseline JPEG was added.
    + libtiff/tif_jpeg.c: error out at decoding time if anticipated
    libjpeg memory allocation is above 100 MB. libjpeg in case of
    multiple scans, which is allowed even in baseline JPEG, if
    components are spread over several scans and not
    interleavedin a single one, needs to allocate memory (or
    backing store) for the whole strip/tile. See
    http://www.libjpeg-turbo.org/pmwiki/uploads/About/TwoIssueswiththeJPEGStandard.pdf
    This limitation may be overriden by setting the
    LIBTIFF_ALLOW_LARGE_LIBJPEG_MEM_ALLOC environment variable, or
    recompiling libtiff with a custom value of
    TIFF_LIBJPEG_LARGEST_MEM_ALLOC macro.
    + libtiff/tif_jbig.c: fix memory leak in error code path of
    JBIGDecode()
    Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2706
    (CVE-2017-9936, bsc#1046073)
    + libtiff/tif_dirread.c: in TIFFReadDirEntryFloat(), check that
    a double value can fit in a float before casting.
    + libtiff/tiffiop.h, libtiff/tif_jpeg.c, libtiff/tif_jpeg_12.c,
    libtiff/tif_read.c: make TIFFReadScanline() works in
    CHUNKY_STRIP_READ_SUPPORT mode with JPEG stream with multiple
    scans. Also make configurable through a
    LIBTIFF_JPEG_MAX_ALLOWED_SCAN_NUMBER environment variable the
    maximum number of scans allowed. Defaults to 100.
    + libtiff/tif_read.c: TIFFFillTile(): add limitation to the
    number of bytes read in case td_stripbytecount[strip] is
    bigger than reasonable, so as to avoid excessive memory
    allocation (similarly to what was done for TIFFFileStrip() on
    2017-05-10)
    + libtiff/tif_getimage.c: use
    _TIFFReadEncodedStripAndAllocBuffer(). Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2708 and
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2433
    + libtiff/tif_read.c, tiffiop.h: add a
    _TIFFReadEncodedStripAndAllocBuffer() function, variant of
    TIFFReadEncodedStrip() that allocates the decoded buffer only
    after a first successful TIFFFillStrip(). This avoids
    excessive memory allocation on corrupted files.
    + libtiff/tif_dirwrite.c: in TIFFWriteDirectoryTagCheckedXXXX()
    functions associated with LONG8/SLONG8 data type, replace
    assertion that the file is BigTIFF, by a non-fatal error.
    Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2712
    + libtiff/tif_read.c: TIFFStartTile(): set tif_rawcc to
    tif_rawdataloaded when it is set. Similarly to
    TIFFStartStrip(). This issue was revealed by the change of
    2017-06-30 in TIFFFileTile(), limiting the number of bytes
    read. But it could probably have been hit too in
    CHUNKY_STRIP_READ_SUPPORT mode previously. Fixes
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2454
    + libtiff/tif_error.c, tif_warning.c: correctly use va_list
    when both an old-style and new-style warning/error handlers
    are installed. Patch by Paavo Helde (sent on the mailing list)
    + libtiff/tif_getimage.c: use _TIFFReadTileAndAllocBuffer().
    Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2470
    + libtiff/tif_read.c, tiffiop.h: add a
    _TIFFReadEncodedTileAndAllocBuffer() and
    _TIFFReadTileAndAllocBuffer() variants of
    TIFFReadEncodedTile() and TIFFReadTile() that allocates the
    decoded buffer only after a first successful TIFFFillTile().
    This avoids excessive memory allocation on corrupted files.
    + libtiff/tif_pixarlog.c: avoid excessive memory allocation on
    decoding when RowsPerStrip tag is not defined (and thus
    td_rowsperstrip == UINT_MAX) Fixes
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2554
    + libtiff/tif_lzw.c: fix 4.0.8 regression in the decoding of
    old-style LZW compressed files.
    + libtiff/tif_lzw.c: fix potential out-of-buffer read on 1-byte
    LZW strips. Crashing issue only on memory mapped files, where
    the strip offset is the last byte of the file, and the file
    size is a multiple of one page size on the CPU architecture
    (typically 4096)
    + libtiff/tif_dir.c: avoid potential null pointer dereference
    in _TIFFVGetField() on corrupted TIFFTAG_NUMBEROFINKS tag
    instance.
    Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2713
    + tools/tiff2pdf.c: prevent heap buffer overflow write in "Raw"
    mode on PlanarConfig=Contig input images. Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2715
    + libtiff/tif_read.c: TIFFFillStrip() / TIFFFillTile().
    Complementary fix for
    http://bugzilla.maptools.org/show_bug.cgi?id=2708 in the
    isMapped() case, so as to avoid excessive memory allocation
    when we need a temporary buffer but the file is truncated.
    + libtiff/tif_read.c: in TIFFFetchStripThing(), only grow the
    arrays that hold StripOffsets/StripByteCounts, when they are
    smaller than the expected number of striles, up to 1 million
    striles, and error out beyond. Can be tweaked by setting the
    environment variable LIBTIFF_STRILE_ARRAY_MAX_RESIZE_COUNT.
    This partially goes against a change added on 2002-12-17 to
    accept those arrays of wrong sizes, but is needed to avoid
    denial of services. Fixes
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2350
    + libtiff/tif_read.c: add protection against excessive memory
    allocation attempts in TIFFReadDirEntryArray() on short files.
    Effective for mmap'ed case. And non-mmap'ed case, but
    restricted to 64bit builds. Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2675
    (CVE-2017-12944, bsc#1054594)
    + libtiff/tif_luv.c: LogLuvInitState(): avoid excessive memory
    allocation when RowsPerStrip tag is missing. Fixes
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2683
    + libtiff/tif_getimage.c: gtTileContig() and gtTileSeparate():
    properly break from loops on error when stoponerr is set,
    instead of going on iterating on row based loop.
    + libtiff/tif_getimage.c: fix fromskew computation when
    to-be-skipped pixel number is not a multiple of the horizontal
    subsampling, and also in some other cases. Impact
    putcontig8bitYCbCr44tile, putcontig8bitYCbCr42tile,
    putcontig8bitYCbCr41tile, putcontig8bitYCbCr21tile and
    putcontig8bitYCbCr12tile Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2637 and
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2691
    + libtiff/tif_luv.c: further reduce memory requirements for
    temporary buffer when RowsPerStrip &gt;= image_length in
    LogLuvInitState() and LogL16InitState(). Fixes
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2700
    + libtiff/tif_dirwrite.c: replace assertion related to not
    finding the SubIFD tag by runtime check (in
    TIFFWriteDirectorySec()) Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2727
    + libtiff/tif_dirwrite.c: replace assertion to tag value not
    fitting on uint32 when selecting the value of SubIFD tag by
    runtime check (in TIFFWriteDirectoryTagSubifd()). Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2728
    + libtiff/tif_jpeg.c: accept reading the last strip of a JPEG
    compressed file if the codestream height is larger than the
    truncated height of the strip. Emit a warning in this
    situation since this is non compliant.
    + libtiff/tiffiop.h, tif_aux.c: redirect SeekOK() macro to a
    _TIFFSeekoK() function that checks if the offset is not
    bigger than INT64_MAX, so as to avoid a -1 error return code
    of TIFFSeekFile() to match a required seek to UINT64_MAX/-1.
    Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2726
    + libtiff/tif_dirread.c: add NULL check to avoid likely false
    positive null-pointer dereference warning by CLang Static
    Analyzer.
    + libtiff/libtiff.def: add TIFFReadRGBAStripExt and
    TIFFReadRGBATileExt Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2735
    + libtiff/tif_jpeg.c: add compatibility with libjpeg-turbo
    1.5.2 that honours max_memory_to_use &gt; 0. Cf
    https://github.com/libjpeg-turbo/libjpeg-turbo/issues/162
    + libtiff/tif_getimage.c: avoid floating point division by zero
    in initCIELabConversion() Fixes
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=3733
  * Changes in the tools:
    + tools/tiff2pdf.c: prevent heap buffer overflow write in "Raw"
    mode on PlanarConfig=Contig input images. Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2715
    + tools/tiffset.c: fix setting a single value for the
    ExtraSamples tag (and other tags with variable number of
    values). So 'tiffset -s ExtraSamples 1 X'. This only worked
    when setting 2 or more values, but not just one.
    + tools/fax2tiff.c (_FAX_Client_Data): Pass FAX_Client_Data as
    the client data. This client data is not used at all at the
    moment, but it makes the most sense. Issue that the value of
    client_data.fd was passed where a pointer is expected.
    + tools/tiff2pdf.c (t2p_sample_realize_palette): Fix possible
    arithmetic overflow in bounds checking code and eliminate
    comparison between signed and unsigned type.
    + tools/tiff2bw.c (main): Free memory allocated in the tiff2bw
    program. This is in response to the report associated with
    CVE-2017-16232, bsc#1069213 but does not solve the extremely
    high memory usage with the associated POC file.</changelog>
  <changelog author="dimstar@opensuse.org" date="1513857600">- Fix check section:
  + Make sure to get back to the right directory after chdir to
    'tools', or we can't run the 2nd test suite.
  + Fix typo: the tests are located in a directory called 'test',
    not 'tests'.</changelog>
  <changelog author="mvetter@suse.com" date="1518782400">- bsc#1046077: Add tiff-4.0.9-bsc1046077-CVE-2017-9935.patch
  Fix Heap-based buffer overflow in t2p_write_pdf</changelog>
  <changelog author="mvetter@suse.com" date="1519128000">- bsc#1081690: Add tiff-4.0.9-bsc1081690-CVE-2018-5784.patch
  Fix uncontrolled resource consumption in TIFFSetDirectory</changelog>
  <changelog author="pgajdos@suse.com" date="1526385600">- security update
  * CVE-2018-10963 [bsc#1092949]
    + tiff-CVE-2018-10963.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1526644800">- security update
  * CVE-2017-18013 [bsc#1074317]
    + tiff-CVE-2017-18013.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1528113600">- security update
  * CVE-2018-7456 [bsc#1082825]
    + tiff-CVE-2018-7456.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1528113601">- security update
  * CVE-2017-11613 [bsc#1082332]
    + tiff-CVE-2017-11613.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1528200000">- security update
  * CVE-2018-8905 [bsc#1086408]
    + tiff-CVE-2018-8905.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1534334400">- security update
  * CVE-2018-10779 [bsc#1092480]
    + tiff-CVE-2018-10779.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1539777600">- security update
  * CVE-2018-17100 [bsc#1108637]
    + tiff-CVE-2018-17100.patch
  * CVE-2018-17101 [bsc#1108627]
    + tiff-CVE-2018-17101.patch
  * CVE-2018-17795 [bsc#1110358]
    % tiff-4.0.9-bsc1046077-CVE-2017-9935.patch renamed to
    tiff-CVE-2017-9935,CVE-2018-17795.patch
  * CVE-2018-16335 [bsc#1106853]
    % tiff-CVE-2017-11613.patch renamed to
    tiff-CVE-2017-11613,CVE-2018-16335,15209.patch
- add a possibility to build with ASAN</changelog>
  <changelog author="pgajdos@suse.com" date="1542024000">- asan_build: build ASAN included
- debug_build: build more suitable for debugging</changelog>
  <changelog author="pgajdos@suse.com" date="1542024001">- security update
  * CVE-2018-18661 [bsc#1113672]
    + tiff-CVE-2018-18661.patch
  * CVE-2018-18557 [bsc#1113094]
    + tiff-CVE-2018-18557.patch
  * CVE-2018-12900 [bsc#1099257]
    + tiff-CVE-2018-12900.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1542628800">- security update
  * CVE-2018-19210 [bsc#1115717]
    + tiff-CVE-2018-19210.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1548849600">- extend tiff-CVE-2018-19210.patch and rename it to
  tiff-CVE-2018-17000,19210.patch [bsc#1108606c#11]
  * solves CVE-2018-19210 [bsc#1115717] and CVE-2018-17000 [bsc#1108606]</changelog>
  <changelog author="mvetter@suse.com" date="1549281600">- security update
  * CVE-2019-6128 [bsc#1121626]
    + tiff-CVE-2019-6128.patch</changelog>
  <changelog author="mvetter@suse.com" date="1549972800">- security update
  * CVE-2019-7663 [bsc#1125113]
    + tiff-CVE-2019-7663.patch</changelog>
  <changelog author="mvetter@suse.com" date="1573041600">- security update: Fix integer overflow in _TIFFCheckMalloc()
  * CVE-2019-14973 [bsc#1146608]
    + tiff-CVE-2019-14973.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1573041601">- security update: amend patch to fix test
- modified patches
  % tiff-CVE-2019-14973.patch (refreshed)</changelog>
  <changelog author="mvetter@suse.com" date="1642420800">- security update: Fix buffer overwrite
  * CVE-2019-17546[bsc#1154365]
    + tiff-CVE-2019-17546.patch
- security update: Fix heap based buffer overflow in pal2rgb
  * CVE-2017-17095[bsc#1071031]
    + tiff-CVE-2017-17095.patch
- security update: Fix OOB in _TIFFmemcpy
  * CVE-2022-22844[bsc#1194539]
    + tiff-CVE-2022-22844.patch
- security update: Fix memory allocation failure in tif_read.c
  * CVE-2020-35521[bsc#1182808] CVE-2020-35522[bsc#1182809]
    + tiff-CVE-2020-35521,CVE-2020-35522.patch
- security update: Fix DOS via invertImage()
  * CVE-2020-19131[bsc#1190312]
    + tiff-CVE-2020-19131.patch
- security update: Fix heap-based buffer overflow in TIFF2PDF tool
  * CVE-2020-35524[bsc#1182812]
    + tiff-CVE-2020-35524.patch
- security update: Fix integer overflow in tif_getimage
  * CVE-2020-35523 [bsc#1182811]
    + tiff-CVE-2020-35523.patch</changelog>
</package>
<package pkgid="112668b55223d66868fbb470cb4d93057dfbfd7d32e02d7b3f3e1a70482c3f70" name="libtiff5-32bit" arch="x86_64">
  <version epoch="0" ver="4.0.9" rel="45.5.1"/>
  <changelog author="fstrba@suse.com" date="1511956800">- Upgrade to upstream release 4.0.9
  * Changes in the software configuration:
    + test/Makefile.am: Add some tests for tiff2bw.
    + .appveyor.yml, .travis.yml, build/travis-ci: apply patches
    0001-ci-Travis-script-improvements.patch and
    0002-ci-Invoke-helper-script-via-shell.patch by Roger Leigh
    + .travis.yml, build/travis-ci: new files from
    0001-ci-Add-Travis-support-for-Linux-builds-with-Autoconf.patch
    by Roger Leigh. This patch adds support for the Travis-CI
    service.
    + .appveyor.yml: new file from
    0002-ci-Add-AppVeyor-support.patch by Roger Leigh (sent to
    mailing list on 2017-06-08) This patch adds a .appveyor.yml
    file to the top-level. This allows one to opt in to having a
    branch built on Windows with Cygwin, MinGW and MSVC
    automatically when a branch is pushed to GitHub, GitLab,
    BitBucket or any other supported git hosting service.
    + CMakeLists.txt, test/CMakeLists.txt,
    test/TiffTestCommon.cmake: apply patch
    0001-cmake-Improve-Cygwin-and-MingGW-test-support.patch from
    Roger Leigh. This patch makes the CMake build system support
    running the tests with MinGW or  Cygwin.
    + test/tiffcp-lzw-compat.sh, test/images/quad-lzw-compat.tiff:
    new files to test old-style LZW decompression
    + test/common.sh, Makefile.am, CMakeList.txt: updated with above
    + test/Makefile.am: add missing reference to
    images/quad-lzw-compat.tiff to fix "make distcheck". Patch by
    Roger Leigh
    + nmake.opt: support a DEBUG=1 option, so as to adjust OPTFLAGS
    and use /MDd runtime in debug mode.
  * Changes in libtiff:
    + libtiff/tif_color.c: TIFFYCbCrToRGBInit(): stricter clamping
    to avoid int32 overflow in TIFFYCbCrtoRGB(). Fixes
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1844
    + libtiff/tif_getimage.c: initYCbCrConversion(): stricter
    validation for refBlackWhite coefficients values. To avoid
    invalid float-&gt;int32 conversion (when refBlackWhite[0] ==
    2147483648.f) Fixes
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1907
    + libtiff/tif_dirinfo.c, tif_dirread.c: add
    _TIFFCheckFieldIsValidForCodec(), and use it in
    TIFFReadDirectory() so as to ignore fields whose tag is a
    codec-specified tag but this codec is not enabled. This avoids
    TIFFGetField() to behave differently depending on whether the
    codec is enabled or not, and thus can avoid stack based buffer
    overflows in a number of TIFF utilities such as tiffsplit,
    tiffcmp, thumbnail, etc. Patch derived from
    0063-Handle-properly-CODEC-specific-tags.patch
    (http://bugzilla.maptools.org/show_bug.cgi?id=2580) by Raphaël
    Hertzog.
    Fixes: http://bugzilla.maptools.org/show_bug.cgi?id=2580
    http://bugzilla.maptools.org/show_bug.cgi?id=2693
    http://bugzilla.maptools.org/show_bug.cgi?id=2625
    (CVE-2016-10095, bsc#1017690)
    http://bugzilla.maptools.org/show_bug.cgi?id=2564
    (CVE-2015-7554, bsc#960341)
    http://bugzilla.maptools.org/show_bug.cgi?id=2561
    (CVE-2016-5318, bsc#983436)
    http://bugzilla.maptools.org/show_bug.cgi?id=2499
    (CVE-2014-8128, bsc#969783)
    http://bugzilla.maptools.org/show_bug.cgi?id=2441
    http://bugzilla.maptools.org/show_bug.cgi?id=2433
    + libtiff/tif_swab.c: if DISABLE_CHECK_TIFFSWABMACROS is
    defined, do not do the #ifdef TIFFSwabXXX checks. Make it
    easier for GDAL to rename the symbols of its internal libtiff
    copy.
    + libtiff/tif_dirread.c: fix regression of libtiff 4.0.8 in
    ChopUpSingleUncompressedStrip() regarding update of newly
    single-strip uncompressed files whose bytecount is 0. Before
    the change of 2016-12-03, the condition bytecount==0 used to
    trigger an early exit/disabling of strip chop. Re-introduce
    that in update mode. Otherwise this cause later incorrect
    setting for the value of StripByCounts/StripOffsets.
    (https://trac.osgeo.org/gdal/ticket/6924)
    + libtiff/tif_dirread.c: TIFFFetchStripThing(): limit the
    number of items read in StripOffsets/StripByteCounts tags to
    the number of strips to avoid excessive memory allocation.
    Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2215
    + libtiff/tif_getimage.c: avoid many (harmless) unsigned int
    overflows.
    + libtiff/tif_fax3.c: avoid unsigned int overflow in
    Fax3Encode2DRow(). Could potentially be a bug with huge rows.
    + libtiff/tif_jpeg.c: avoid (harmless) unsigned int overflow on
    tiled images.
    + libtiff/tif_dirread.c: avoid unsigned int overflow in
    EstimateStripByteCounts() and BYTECOUNTLOOKSBAD when file is
    too short.
    + libtiff/tif_predict.c: decorate legitimate functions where
    unsigned int overflow occur with
    TIFF_NOSANITIZE_UNSIGNED_INT_OVERFLOW
    + libtiff/tif_dirread.c: avoid unsigned int overflow in
    EstimateStripByteCounts()
    + libtiff/tiffiop.h: add TIFF_NOSANITIZE_UNSIGNED_INT_OVERFLOW
    macro to disable CLang warnings raised by
  - fsanitize=undefined,unsigned-integer-overflow
    + libtiff/tif_jpeg.c: add anti-denial of service measure to
    avoid excessive CPU consumption on progressive JPEGs with a
    huge number of scans. See
    http://www.libjpeg-turbo.org/pmwiki/uploads/About/TwoIssueswiththeJPEGStandard.pdf
    Note: only affects libtiff since 2014-12-29 where support of
    non-baseline JPEG was added.
    + libtiff/tif_jpeg.c: error out at decoding time if anticipated
    libjpeg memory allocation is above 100 MB. libjpeg in case of
    multiple scans, which is allowed even in baseline JPEG, if
    components are spread over several scans and not
    interleavedin a single one, needs to allocate memory (or
    backing store) for the whole strip/tile. See
    http://www.libjpeg-turbo.org/pmwiki/uploads/About/TwoIssueswiththeJPEGStandard.pdf
    This limitation may be overriden by setting the
    LIBTIFF_ALLOW_LARGE_LIBJPEG_MEM_ALLOC environment variable, or
    recompiling libtiff with a custom value of
    TIFF_LIBJPEG_LARGEST_MEM_ALLOC macro.
    + libtiff/tif_jbig.c: fix memory leak in error code path of
    JBIGDecode()
    Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2706
    (CVE-2017-9936, bsc#1046073)
    + libtiff/tif_dirread.c: in TIFFReadDirEntryFloat(), check that
    a double value can fit in a float before casting.
    + libtiff/tiffiop.h, libtiff/tif_jpeg.c, libtiff/tif_jpeg_12.c,
    libtiff/tif_read.c: make TIFFReadScanline() works in
    CHUNKY_STRIP_READ_SUPPORT mode with JPEG stream with multiple
    scans. Also make configurable through a
    LIBTIFF_JPEG_MAX_ALLOWED_SCAN_NUMBER environment variable the
    maximum number of scans allowed. Defaults to 100.
    + libtiff/tif_read.c: TIFFFillTile(): add limitation to the
    number of bytes read in case td_stripbytecount[strip] is
    bigger than reasonable, so as to avoid excessive memory
    allocation (similarly to what was done for TIFFFileStrip() on
    2017-05-10)
    + libtiff/tif_getimage.c: use
    _TIFFReadEncodedStripAndAllocBuffer(). Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2708 and
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2433
    + libtiff/tif_read.c, tiffiop.h: add a
    _TIFFReadEncodedStripAndAllocBuffer() function, variant of
    TIFFReadEncodedStrip() that allocates the decoded buffer only
    after a first successful TIFFFillStrip(). This avoids
    excessive memory allocation on corrupted files.
    + libtiff/tif_dirwrite.c: in TIFFWriteDirectoryTagCheckedXXXX()
    functions associated with LONG8/SLONG8 data type, replace
    assertion that the file is BigTIFF, by a non-fatal error.
    Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2712
    + libtiff/tif_read.c: TIFFStartTile(): set tif_rawcc to
    tif_rawdataloaded when it is set. Similarly to
    TIFFStartStrip(). This issue was revealed by the change of
    2017-06-30 in TIFFFileTile(), limiting the number of bytes
    read. But it could probably have been hit too in
    CHUNKY_STRIP_READ_SUPPORT mode previously. Fixes
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2454
    + libtiff/tif_error.c, tif_warning.c: correctly use va_list
    when both an old-style and new-style warning/error handlers
    are installed. Patch by Paavo Helde (sent on the mailing list)
    + libtiff/tif_getimage.c: use _TIFFReadTileAndAllocBuffer().
    Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2470
    + libtiff/tif_read.c, tiffiop.h: add a
    _TIFFReadEncodedTileAndAllocBuffer() and
    _TIFFReadTileAndAllocBuffer() variants of
    TIFFReadEncodedTile() and TIFFReadTile() that allocates the
    decoded buffer only after a first successful TIFFFillTile().
    This avoids excessive memory allocation on corrupted files.
    + libtiff/tif_pixarlog.c: avoid excessive memory allocation on
    decoding when RowsPerStrip tag is not defined (and thus
    td_rowsperstrip == UINT_MAX) Fixes
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2554
    + libtiff/tif_lzw.c: fix 4.0.8 regression in the decoding of
    old-style LZW compressed files.
    + libtiff/tif_lzw.c: fix potential out-of-buffer read on 1-byte
    LZW strips. Crashing issue only on memory mapped files, where
    the strip offset is the last byte of the file, and the file
    size is a multiple of one page size on the CPU architecture
    (typically 4096)
    + libtiff/tif_dir.c: avoid potential null pointer dereference
    in _TIFFVGetField() on corrupted TIFFTAG_NUMBEROFINKS tag
    instance.
    Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2713
    + tools/tiff2pdf.c: prevent heap buffer overflow write in "Raw"
    mode on PlanarConfig=Contig input images. Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2715
    + libtiff/tif_read.c: TIFFFillStrip() / TIFFFillTile().
    Complementary fix for
    http://bugzilla.maptools.org/show_bug.cgi?id=2708 in the
    isMapped() case, so as to avoid excessive memory allocation
    when we need a temporary buffer but the file is truncated.
    + libtiff/tif_read.c: in TIFFFetchStripThing(), only grow the
    arrays that hold StripOffsets/StripByteCounts, when they are
    smaller than the expected number of striles, up to 1 million
    striles, and error out beyond. Can be tweaked by setting the
    environment variable LIBTIFF_STRILE_ARRAY_MAX_RESIZE_COUNT.
    This partially goes against a change added on 2002-12-17 to
    accept those arrays of wrong sizes, but is needed to avoid
    denial of services. Fixes
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2350
    + libtiff/tif_read.c: add protection against excessive memory
    allocation attempts in TIFFReadDirEntryArray() on short files.
    Effective for mmap'ed case. And non-mmap'ed case, but
    restricted to 64bit builds. Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2675
    (CVE-2017-12944, bsc#1054594)
    + libtiff/tif_luv.c: LogLuvInitState(): avoid excessive memory
    allocation when RowsPerStrip tag is missing. Fixes
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2683
    + libtiff/tif_getimage.c: gtTileContig() and gtTileSeparate():
    properly break from loops on error when stoponerr is set,
    instead of going on iterating on row based loop.
    + libtiff/tif_getimage.c: fix fromskew computation when
    to-be-skipped pixel number is not a multiple of the horizontal
    subsampling, and also in some other cases. Impact
    putcontig8bitYCbCr44tile, putcontig8bitYCbCr42tile,
    putcontig8bitYCbCr41tile, putcontig8bitYCbCr21tile and
    putcontig8bitYCbCr12tile Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2637 and
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2691
    + libtiff/tif_luv.c: further reduce memory requirements for
    temporary buffer when RowsPerStrip &gt;= image_length in
    LogLuvInitState() and LogL16InitState(). Fixes
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2700
    + libtiff/tif_dirwrite.c: replace assertion related to not
    finding the SubIFD tag by runtime check (in
    TIFFWriteDirectorySec()) Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2727
    + libtiff/tif_dirwrite.c: replace assertion to tag value not
    fitting on uint32 when selecting the value of SubIFD tag by
    runtime check (in TIFFWriteDirectoryTagSubifd()). Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2728
    + libtiff/tif_jpeg.c: accept reading the last strip of a JPEG
    compressed file if the codestream height is larger than the
    truncated height of the strip. Emit a warning in this
    situation since this is non compliant.
    + libtiff/tiffiop.h, tif_aux.c: redirect SeekOK() macro to a
    _TIFFSeekoK() function that checks if the offset is not
    bigger than INT64_MAX, so as to avoid a -1 error return code
    of TIFFSeekFile() to match a required seek to UINT64_MAX/-1.
    Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2726
    + libtiff/tif_dirread.c: add NULL check to avoid likely false
    positive null-pointer dereference warning by CLang Static
    Analyzer.
    + libtiff/libtiff.def: add TIFFReadRGBAStripExt and
    TIFFReadRGBATileExt Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2735
    + libtiff/tif_jpeg.c: add compatibility with libjpeg-turbo
    1.5.2 that honours max_memory_to_use &gt; 0. Cf
    https://github.com/libjpeg-turbo/libjpeg-turbo/issues/162
    + libtiff/tif_getimage.c: avoid floating point division by zero
    in initCIELabConversion() Fixes
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=3733
  * Changes in the tools:
    + tools/tiff2pdf.c: prevent heap buffer overflow write in "Raw"
    mode on PlanarConfig=Contig input images. Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2715
    + tools/tiffset.c: fix setting a single value for the
    ExtraSamples tag (and other tags with variable number of
    values). So 'tiffset -s ExtraSamples 1 X'. This only worked
    when setting 2 or more values, but not just one.
    + tools/fax2tiff.c (_FAX_Client_Data): Pass FAX_Client_Data as
    the client data. This client data is not used at all at the
    moment, but it makes the most sense. Issue that the value of
    client_data.fd was passed where a pointer is expected.
    + tools/tiff2pdf.c (t2p_sample_realize_palette): Fix possible
    arithmetic overflow in bounds checking code and eliminate
    comparison between signed and unsigned type.
    + tools/tiff2bw.c (main): Free memory allocated in the tiff2bw
    program. This is in response to the report associated with
    CVE-2017-16232, bsc#1069213 but does not solve the extremely
    high memory usage with the associated POC file.</changelog>
  <changelog author="dimstar@opensuse.org" date="1513857600">- Fix check section:
  + Make sure to get back to the right directory after chdir to
    'tools', or we can't run the 2nd test suite.
  + Fix typo: the tests are located in a directory called 'test',
    not 'tests'.</changelog>
  <changelog author="mvetter@suse.com" date="1518782400">- bsc#1046077: Add tiff-4.0.9-bsc1046077-CVE-2017-9935.patch
  Fix Heap-based buffer overflow in t2p_write_pdf</changelog>
  <changelog author="mvetter@suse.com" date="1519128000">- bsc#1081690: Add tiff-4.0.9-bsc1081690-CVE-2018-5784.patch
  Fix uncontrolled resource consumption in TIFFSetDirectory</changelog>
  <changelog author="pgajdos@suse.com" date="1526385600">- security update
  * CVE-2018-10963 [bsc#1092949]
    + tiff-CVE-2018-10963.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1526644800">- security update
  * CVE-2017-18013 [bsc#1074317]
    + tiff-CVE-2017-18013.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1528113600">- security update
  * CVE-2018-7456 [bsc#1082825]
    + tiff-CVE-2018-7456.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1528113601">- security update
  * CVE-2017-11613 [bsc#1082332]
    + tiff-CVE-2017-11613.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1528200000">- security update
  * CVE-2018-8905 [bsc#1086408]
    + tiff-CVE-2018-8905.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1534334400">- security update
  * CVE-2018-10779 [bsc#1092480]
    + tiff-CVE-2018-10779.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1539777600">- security update
  * CVE-2018-17100 [bsc#1108637]
    + tiff-CVE-2018-17100.patch
  * CVE-2018-17101 [bsc#1108627]
    + tiff-CVE-2018-17101.patch
  * CVE-2018-17795 [bsc#1110358]
    % tiff-4.0.9-bsc1046077-CVE-2017-9935.patch renamed to
    tiff-CVE-2017-9935,CVE-2018-17795.patch
  * CVE-2018-16335 [bsc#1106853]
    % tiff-CVE-2017-11613.patch renamed to
    tiff-CVE-2017-11613,CVE-2018-16335,15209.patch
- add a possibility to build with ASAN</changelog>
  <changelog author="pgajdos@suse.com" date="1542024000">- asan_build: build ASAN included
- debug_build: build more suitable for debugging</changelog>
  <changelog author="pgajdos@suse.com" date="1542024001">- security update
  * CVE-2018-18661 [bsc#1113672]
    + tiff-CVE-2018-18661.patch
  * CVE-2018-18557 [bsc#1113094]
    + tiff-CVE-2018-18557.patch
  * CVE-2018-12900 [bsc#1099257]
    + tiff-CVE-2018-12900.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1542628800">- security update
  * CVE-2018-19210 [bsc#1115717]
    + tiff-CVE-2018-19210.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1548849600">- extend tiff-CVE-2018-19210.patch and rename it to
  tiff-CVE-2018-17000,19210.patch [bsc#1108606c#11]
  * solves CVE-2018-19210 [bsc#1115717] and CVE-2018-17000 [bsc#1108606]</changelog>
  <changelog author="mvetter@suse.com" date="1549281600">- security update
  * CVE-2019-6128 [bsc#1121626]
    + tiff-CVE-2019-6128.patch</changelog>
  <changelog author="mvetter@suse.com" date="1549972800">- security update
  * CVE-2019-7663 [bsc#1125113]
    + tiff-CVE-2019-7663.patch</changelog>
  <changelog author="mvetter@suse.com" date="1573041600">- security update: Fix integer overflow in _TIFFCheckMalloc()
  * CVE-2019-14973 [bsc#1146608]
    + tiff-CVE-2019-14973.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1573041601">- security update: amend patch to fix test
- modified patches
  % tiff-CVE-2019-14973.patch (refreshed)</changelog>
  <changelog author="mvetter@suse.com" date="1642420800">- security update: Fix buffer overwrite
  * CVE-2019-17546[bsc#1154365]
    + tiff-CVE-2019-17546.patch
- security update: Fix heap based buffer overflow in pal2rgb
  * CVE-2017-17095[bsc#1071031]
    + tiff-CVE-2017-17095.patch
- security update: Fix OOB in _TIFFmemcpy
  * CVE-2022-22844[bsc#1194539]
    + tiff-CVE-2022-22844.patch
- security update: Fix memory allocation failure in tif_read.c
  * CVE-2020-35521[bsc#1182808] CVE-2020-35522[bsc#1182809]
    + tiff-CVE-2020-35521,CVE-2020-35522.patch
- security update: Fix DOS via invertImage()
  * CVE-2020-19131[bsc#1190312]
    + tiff-CVE-2020-19131.patch
- security update: Fix heap-based buffer overflow in TIFF2PDF tool
  * CVE-2020-35524[bsc#1182812]
    + tiff-CVE-2020-35524.patch
- security update: Fix integer overflow in tif_getimage
  * CVE-2020-35523 [bsc#1182811]
    + tiff-CVE-2020-35523.patch</changelog>
</package>
<package pkgid="ec86abfbb66fea934895bce6e534283d325ee6fd25675f4e7810e1bd5c28db50" name="libtiff5" arch="aarch64">
  <version epoch="0" ver="4.0.9" rel="45.5.1"/>
  <changelog author="fstrba@suse.com" date="1511956800">- Upgrade to upstream release 4.0.9
  * Changes in the software configuration:
    + test/Makefile.am: Add some tests for tiff2bw.
    + .appveyor.yml, .travis.yml, build/travis-ci: apply patches
    0001-ci-Travis-script-improvements.patch and
    0002-ci-Invoke-helper-script-via-shell.patch by Roger Leigh
    + .travis.yml, build/travis-ci: new files from
    0001-ci-Add-Travis-support-for-Linux-builds-with-Autoconf.patch
    by Roger Leigh. This patch adds support for the Travis-CI
    service.
    + .appveyor.yml: new file from
    0002-ci-Add-AppVeyor-support.patch by Roger Leigh (sent to
    mailing list on 2017-06-08) This patch adds a .appveyor.yml
    file to the top-level. This allows one to opt in to having a
    branch built on Windows with Cygwin, MinGW and MSVC
    automatically when a branch is pushed to GitHub, GitLab,
    BitBucket or any other supported git hosting service.
    + CMakeLists.txt, test/CMakeLists.txt,
    test/TiffTestCommon.cmake: apply patch
    0001-cmake-Improve-Cygwin-and-MingGW-test-support.patch from
    Roger Leigh. This patch makes the CMake build system support
    running the tests with MinGW or  Cygwin.
    + test/tiffcp-lzw-compat.sh, test/images/quad-lzw-compat.tiff:
    new files to test old-style LZW decompression
    + test/common.sh, Makefile.am, CMakeList.txt: updated with above
    + test/Makefile.am: add missing reference to
    images/quad-lzw-compat.tiff to fix "make distcheck". Patch by
    Roger Leigh
    + nmake.opt: support a DEBUG=1 option, so as to adjust OPTFLAGS
    and use /MDd runtime in debug mode.
  * Changes in libtiff:
    + libtiff/tif_color.c: TIFFYCbCrToRGBInit(): stricter clamping
    to avoid int32 overflow in TIFFYCbCrtoRGB(). Fixes
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1844
    + libtiff/tif_getimage.c: initYCbCrConversion(): stricter
    validation for refBlackWhite coefficients values. To avoid
    invalid float-&gt;int32 conversion (when refBlackWhite[0] ==
    2147483648.f) Fixes
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1907
    + libtiff/tif_dirinfo.c, tif_dirread.c: add
    _TIFFCheckFieldIsValidForCodec(), and use it in
    TIFFReadDirectory() so as to ignore fields whose tag is a
    codec-specified tag but this codec is not enabled. This avoids
    TIFFGetField() to behave differently depending on whether the
    codec is enabled or not, and thus can avoid stack based buffer
    overflows in a number of TIFF utilities such as tiffsplit,
    tiffcmp, thumbnail, etc. Patch derived from
    0063-Handle-properly-CODEC-specific-tags.patch
    (http://bugzilla.maptools.org/show_bug.cgi?id=2580) by Raphaël
    Hertzog.
    Fixes: http://bugzilla.maptools.org/show_bug.cgi?id=2580
    http://bugzilla.maptools.org/show_bug.cgi?id=2693
    http://bugzilla.maptools.org/show_bug.cgi?id=2625
    (CVE-2016-10095, bsc#1017690)
    http://bugzilla.maptools.org/show_bug.cgi?id=2564
    (CVE-2015-7554, bsc#960341)
    http://bugzilla.maptools.org/show_bug.cgi?id=2561
    (CVE-2016-5318, bsc#983436)
    http://bugzilla.maptools.org/show_bug.cgi?id=2499
    (CVE-2014-8128, bsc#969783)
    http://bugzilla.maptools.org/show_bug.cgi?id=2441
    http://bugzilla.maptools.org/show_bug.cgi?id=2433
    + libtiff/tif_swab.c: if DISABLE_CHECK_TIFFSWABMACROS is
    defined, do not do the #ifdef TIFFSwabXXX checks. Make it
    easier for GDAL to rename the symbols of its internal libtiff
    copy.
    + libtiff/tif_dirread.c: fix regression of libtiff 4.0.8 in
    ChopUpSingleUncompressedStrip() regarding update of newly
    single-strip uncompressed files whose bytecount is 0. Before
    the change of 2016-12-03, the condition bytecount==0 used to
    trigger an early exit/disabling of strip chop. Re-introduce
    that in update mode. Otherwise this cause later incorrect
    setting for the value of StripByCounts/StripOffsets.
    (https://trac.osgeo.org/gdal/ticket/6924)
    + libtiff/tif_dirread.c: TIFFFetchStripThing(): limit the
    number of items read in StripOffsets/StripByteCounts tags to
    the number of strips to avoid excessive memory allocation.
    Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2215
    + libtiff/tif_getimage.c: avoid many (harmless) unsigned int
    overflows.
    + libtiff/tif_fax3.c: avoid unsigned int overflow in
    Fax3Encode2DRow(). Could potentially be a bug with huge rows.
    + libtiff/tif_jpeg.c: avoid (harmless) unsigned int overflow on
    tiled images.
    + libtiff/tif_dirread.c: avoid unsigned int overflow in
    EstimateStripByteCounts() and BYTECOUNTLOOKSBAD when file is
    too short.
    + libtiff/tif_predict.c: decorate legitimate functions where
    unsigned int overflow occur with
    TIFF_NOSANITIZE_UNSIGNED_INT_OVERFLOW
    + libtiff/tif_dirread.c: avoid unsigned int overflow in
    EstimateStripByteCounts()
    + libtiff/tiffiop.h: add TIFF_NOSANITIZE_UNSIGNED_INT_OVERFLOW
    macro to disable CLang warnings raised by
  - fsanitize=undefined,unsigned-integer-overflow
    + libtiff/tif_jpeg.c: add anti-denial of service measure to
    avoid excessive CPU consumption on progressive JPEGs with a
    huge number of scans. See
    http://www.libjpeg-turbo.org/pmwiki/uploads/About/TwoIssueswiththeJPEGStandard.pdf
    Note: only affects libtiff since 2014-12-29 where support of
    non-baseline JPEG was added.
    + libtiff/tif_jpeg.c: error out at decoding time if anticipated
    libjpeg memory allocation is above 100 MB. libjpeg in case of
    multiple scans, which is allowed even in baseline JPEG, if
    components are spread over several scans and not
    interleavedin a single one, needs to allocate memory (or
    backing store) for the whole strip/tile. See
    http://www.libjpeg-turbo.org/pmwiki/uploads/About/TwoIssueswiththeJPEGStandard.pdf
    This limitation may be overriden by setting the
    LIBTIFF_ALLOW_LARGE_LIBJPEG_MEM_ALLOC environment variable, or
    recompiling libtiff with a custom value of
    TIFF_LIBJPEG_LARGEST_MEM_ALLOC macro.
    + libtiff/tif_jbig.c: fix memory leak in error code path of
    JBIGDecode()
    Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2706
    (CVE-2017-9936, bsc#1046073)
    + libtiff/tif_dirread.c: in TIFFReadDirEntryFloat(), check that
    a double value can fit in a float before casting.
    + libtiff/tiffiop.h, libtiff/tif_jpeg.c, libtiff/tif_jpeg_12.c,
    libtiff/tif_read.c: make TIFFReadScanline() works in
    CHUNKY_STRIP_READ_SUPPORT mode with JPEG stream with multiple
    scans. Also make configurable through a
    LIBTIFF_JPEG_MAX_ALLOWED_SCAN_NUMBER environment variable the
    maximum number of scans allowed. Defaults to 100.
    + libtiff/tif_read.c: TIFFFillTile(): add limitation to the
    number of bytes read in case td_stripbytecount[strip] is
    bigger than reasonable, so as to avoid excessive memory
    allocation (similarly to what was done for TIFFFileStrip() on
    2017-05-10)
    + libtiff/tif_getimage.c: use
    _TIFFReadEncodedStripAndAllocBuffer(). Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2708 and
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2433
    + libtiff/tif_read.c, tiffiop.h: add a
    _TIFFReadEncodedStripAndAllocBuffer() function, variant of
    TIFFReadEncodedStrip() that allocates the decoded buffer only
    after a first successful TIFFFillStrip(). This avoids
    excessive memory allocation on corrupted files.
    + libtiff/tif_dirwrite.c: in TIFFWriteDirectoryTagCheckedXXXX()
    functions associated with LONG8/SLONG8 data type, replace
    assertion that the file is BigTIFF, by a non-fatal error.
    Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2712
    + libtiff/tif_read.c: TIFFStartTile(): set tif_rawcc to
    tif_rawdataloaded when it is set. Similarly to
    TIFFStartStrip(). This issue was revealed by the change of
    2017-06-30 in TIFFFileTile(), limiting the number of bytes
    read. But it could probably have been hit too in
    CHUNKY_STRIP_READ_SUPPORT mode previously. Fixes
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2454
    + libtiff/tif_error.c, tif_warning.c: correctly use va_list
    when both an old-style and new-style warning/error handlers
    are installed. Patch by Paavo Helde (sent on the mailing list)
    + libtiff/tif_getimage.c: use _TIFFReadTileAndAllocBuffer().
    Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2470
    + libtiff/tif_read.c, tiffiop.h: add a
    _TIFFReadEncodedTileAndAllocBuffer() and
    _TIFFReadTileAndAllocBuffer() variants of
    TIFFReadEncodedTile() and TIFFReadTile() that allocates the
    decoded buffer only after a first successful TIFFFillTile().
    This avoids excessive memory allocation on corrupted files.
    + libtiff/tif_pixarlog.c: avoid excessive memory allocation on
    decoding when RowsPerStrip tag is not defined (and thus
    td_rowsperstrip == UINT_MAX) Fixes
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2554
    + libtiff/tif_lzw.c: fix 4.0.8 regression in the decoding of
    old-style LZW compressed files.
    + libtiff/tif_lzw.c: fix potential out-of-buffer read on 1-byte
    LZW strips. Crashing issue only on memory mapped files, where
    the strip offset is the last byte of the file, and the file
    size is a multiple of one page size on the CPU architecture
    (typically 4096)
    + libtiff/tif_dir.c: avoid potential null pointer dereference
    in _TIFFVGetField() on corrupted TIFFTAG_NUMBEROFINKS tag
    instance.
    Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2713
    + tools/tiff2pdf.c: prevent heap buffer overflow write in "Raw"
    mode on PlanarConfig=Contig input images. Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2715
    + libtiff/tif_read.c: TIFFFillStrip() / TIFFFillTile().
    Complementary fix for
    http://bugzilla.maptools.org/show_bug.cgi?id=2708 in the
    isMapped() case, so as to avoid excessive memory allocation
    when we need a temporary buffer but the file is truncated.
    + libtiff/tif_read.c: in TIFFFetchStripThing(), only grow the
    arrays that hold StripOffsets/StripByteCounts, when they are
    smaller than the expected number of striles, up to 1 million
    striles, and error out beyond. Can be tweaked by setting the
    environment variable LIBTIFF_STRILE_ARRAY_MAX_RESIZE_COUNT.
    This partially goes against a change added on 2002-12-17 to
    accept those arrays of wrong sizes, but is needed to avoid
    denial of services. Fixes
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2350
    + libtiff/tif_read.c: add protection against excessive memory
    allocation attempts in TIFFReadDirEntryArray() on short files.
    Effective for mmap'ed case. And non-mmap'ed case, but
    restricted to 64bit builds. Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2675
    (CVE-2017-12944, bsc#1054594)
    + libtiff/tif_luv.c: LogLuvInitState(): avoid excessive memory
    allocation when RowsPerStrip tag is missing. Fixes
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2683
    + libtiff/tif_getimage.c: gtTileContig() and gtTileSeparate():
    properly break from loops on error when stoponerr is set,
    instead of going on iterating on row based loop.
    + libtiff/tif_getimage.c: fix fromskew computation when
    to-be-skipped pixel number is not a multiple of the horizontal
    subsampling, and also in some other cases. Impact
    putcontig8bitYCbCr44tile, putcontig8bitYCbCr42tile,
    putcontig8bitYCbCr41tile, putcontig8bitYCbCr21tile and
    putcontig8bitYCbCr12tile Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2637 and
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2691
    + libtiff/tif_luv.c: further reduce memory requirements for
    temporary buffer when RowsPerStrip &gt;= image_length in
    LogLuvInitState() and LogL16InitState(). Fixes
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2700
    + libtiff/tif_dirwrite.c: replace assertion related to not
    finding the SubIFD tag by runtime check (in
    TIFFWriteDirectorySec()) Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2727
    + libtiff/tif_dirwrite.c: replace assertion to tag value not
    fitting on uint32 when selecting the value of SubIFD tag by
    runtime check (in TIFFWriteDirectoryTagSubifd()). Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2728
    + libtiff/tif_jpeg.c: accept reading the last strip of a JPEG
    compressed file if the codestream height is larger than the
    truncated height of the strip. Emit a warning in this
    situation since this is non compliant.
    + libtiff/tiffiop.h, tif_aux.c: redirect SeekOK() macro to a
    _TIFFSeekoK() function that checks if the offset is not
    bigger than INT64_MAX, so as to avoid a -1 error return code
    of TIFFSeekFile() to match a required seek to UINT64_MAX/-1.
    Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2726
    + libtiff/tif_dirread.c: add NULL check to avoid likely false
    positive null-pointer dereference warning by CLang Static
    Analyzer.
    + libtiff/libtiff.def: add TIFFReadRGBAStripExt and
    TIFFReadRGBATileExt Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2735
    + libtiff/tif_jpeg.c: add compatibility with libjpeg-turbo
    1.5.2 that honours max_memory_to_use &gt; 0. Cf
    https://github.com/libjpeg-turbo/libjpeg-turbo/issues/162
    + libtiff/tif_getimage.c: avoid floating point division by zero
    in initCIELabConversion() Fixes
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=3733
  * Changes in the tools:
    + tools/tiff2pdf.c: prevent heap buffer overflow write in "Raw"
    mode on PlanarConfig=Contig input images. Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2715
    + tools/tiffset.c: fix setting a single value for the
    ExtraSamples tag (and other tags with variable number of
    values). So 'tiffset -s ExtraSamples 1 X'. This only worked
    when setting 2 or more values, but not just one.
    + tools/fax2tiff.c (_FAX_Client_Data): Pass FAX_Client_Data as
    the client data. This client data is not used at all at the
    moment, but it makes the most sense. Issue that the value of
    client_data.fd was passed where a pointer is expected.
    + tools/tiff2pdf.c (t2p_sample_realize_palette): Fix possible
    arithmetic overflow in bounds checking code and eliminate
    comparison between signed and unsigned type.
    + tools/tiff2bw.c (main): Free memory allocated in the tiff2bw
    program. This is in response to the report associated with
    CVE-2017-16232, bsc#1069213 but does not solve the extremely
    high memory usage with the associated POC file.</changelog>
  <changelog author="dimstar@opensuse.org" date="1513857600">- Fix check section:
  + Make sure to get back to the right directory after chdir to
    'tools', or we can't run the 2nd test suite.
  + Fix typo: the tests are located in a directory called 'test',
    not 'tests'.</changelog>
  <changelog author="mvetter@suse.com" date="1518782400">- bsc#1046077: Add tiff-4.0.9-bsc1046077-CVE-2017-9935.patch
  Fix Heap-based buffer overflow in t2p_write_pdf</changelog>
  <changelog author="mvetter@suse.com" date="1519128000">- bsc#1081690: Add tiff-4.0.9-bsc1081690-CVE-2018-5784.patch
  Fix uncontrolled resource consumption in TIFFSetDirectory</changelog>
  <changelog author="pgajdos@suse.com" date="1526385600">- security update
  * CVE-2018-10963 [bsc#1092949]
    + tiff-CVE-2018-10963.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1526644800">- security update
  * CVE-2017-18013 [bsc#1074317]
    + tiff-CVE-2017-18013.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1528113600">- security update
  * CVE-2018-7456 [bsc#1082825]
    + tiff-CVE-2018-7456.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1528113601">- security update
  * CVE-2017-11613 [bsc#1082332]
    + tiff-CVE-2017-11613.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1528200000">- security update
  * CVE-2018-8905 [bsc#1086408]
    + tiff-CVE-2018-8905.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1534334400">- security update
  * CVE-2018-10779 [bsc#1092480]
    + tiff-CVE-2018-10779.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1539777600">- security update
  * CVE-2018-17100 [bsc#1108637]
    + tiff-CVE-2018-17100.patch
  * CVE-2018-17101 [bsc#1108627]
    + tiff-CVE-2018-17101.patch
  * CVE-2018-17795 [bsc#1110358]
    % tiff-4.0.9-bsc1046077-CVE-2017-9935.patch renamed to
    tiff-CVE-2017-9935,CVE-2018-17795.patch
  * CVE-2018-16335 [bsc#1106853]
    % tiff-CVE-2017-11613.patch renamed to
    tiff-CVE-2017-11613,CVE-2018-16335,15209.patch
- add a possibility to build with ASAN</changelog>
  <changelog author="pgajdos@suse.com" date="1542024000">- asan_build: build ASAN included
- debug_build: build more suitable for debugging</changelog>
  <changelog author="pgajdos@suse.com" date="1542024001">- security update
  * CVE-2018-18661 [bsc#1113672]
    + tiff-CVE-2018-18661.patch
  * CVE-2018-18557 [bsc#1113094]
    + tiff-CVE-2018-18557.patch
  * CVE-2018-12900 [bsc#1099257]
    + tiff-CVE-2018-12900.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1542628800">- security update
  * CVE-2018-19210 [bsc#1115717]
    + tiff-CVE-2018-19210.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1548849600">- extend tiff-CVE-2018-19210.patch and rename it to
  tiff-CVE-2018-17000,19210.patch [bsc#1108606c#11]
  * solves CVE-2018-19210 [bsc#1115717] and CVE-2018-17000 [bsc#1108606]</changelog>
  <changelog author="mvetter@suse.com" date="1549281600">- security update
  * CVE-2019-6128 [bsc#1121626]
    + tiff-CVE-2019-6128.patch</changelog>
  <changelog author="mvetter@suse.com" date="1549972800">- security update
  * CVE-2019-7663 [bsc#1125113]
    + tiff-CVE-2019-7663.patch</changelog>
  <changelog author="mvetter@suse.com" date="1573041600">- security update: Fix integer overflow in _TIFFCheckMalloc()
  * CVE-2019-14973 [bsc#1146608]
    + tiff-CVE-2019-14973.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1573041601">- security update: amend patch to fix test
- modified patches
  % tiff-CVE-2019-14973.patch (refreshed)</changelog>
  <changelog author="mvetter@suse.com" date="1642420800">- security update: Fix buffer overwrite
  * CVE-2019-17546[bsc#1154365]
    + tiff-CVE-2019-17546.patch
- security update: Fix heap based buffer overflow in pal2rgb
  * CVE-2017-17095[bsc#1071031]
    + tiff-CVE-2017-17095.patch
- security update: Fix OOB in _TIFFmemcpy
  * CVE-2022-22844[bsc#1194539]
    + tiff-CVE-2022-22844.patch
- security update: Fix memory allocation failure in tif_read.c
  * CVE-2020-35521[bsc#1182808] CVE-2020-35522[bsc#1182809]
    + tiff-CVE-2020-35521,CVE-2020-35522.patch
- security update: Fix DOS via invertImage()
  * CVE-2020-19131[bsc#1190312]
    + tiff-CVE-2020-19131.patch
- security update: Fix heap-based buffer overflow in TIFF2PDF tool
  * CVE-2020-35524[bsc#1182812]
    + tiff-CVE-2020-35524.patch
- security update: Fix integer overflow in tif_getimage
  * CVE-2020-35523 [bsc#1182811]
    + tiff-CVE-2020-35523.patch</changelog>
</package>
<package pkgid="f8cb01663695d02ada2029f03c7b7cf93c4061434bd5ae724bedfb12fabe4167" name="libtiff5" arch="ppc64le">
  <version epoch="0" ver="4.0.9" rel="45.5.1"/>
  <changelog author="fstrba@suse.com" date="1511956800">- Upgrade to upstream release 4.0.9
  * Changes in the software configuration:
    + test/Makefile.am: Add some tests for tiff2bw.
    + .appveyor.yml, .travis.yml, build/travis-ci: apply patches
    0001-ci-Travis-script-improvements.patch and
    0002-ci-Invoke-helper-script-via-shell.patch by Roger Leigh
    + .travis.yml, build/travis-ci: new files from
    0001-ci-Add-Travis-support-for-Linux-builds-with-Autoconf.patch
    by Roger Leigh. This patch adds support for the Travis-CI
    service.
    + .appveyor.yml: new file from
    0002-ci-Add-AppVeyor-support.patch by Roger Leigh (sent to
    mailing list on 2017-06-08) This patch adds a .appveyor.yml
    file to the top-level. This allows one to opt in to having a
    branch built on Windows with Cygwin, MinGW and MSVC
    automatically when a branch is pushed to GitHub, GitLab,
    BitBucket or any other supported git hosting service.
    + CMakeLists.txt, test/CMakeLists.txt,
    test/TiffTestCommon.cmake: apply patch
    0001-cmake-Improve-Cygwin-and-MingGW-test-support.patch from
    Roger Leigh. This patch makes the CMake build system support
    running the tests with MinGW or  Cygwin.
    + test/tiffcp-lzw-compat.sh, test/images/quad-lzw-compat.tiff:
    new files to test old-style LZW decompression
    + test/common.sh, Makefile.am, CMakeList.txt: updated with above
    + test/Makefile.am: add missing reference to
    images/quad-lzw-compat.tiff to fix "make distcheck". Patch by
    Roger Leigh
    + nmake.opt: support a DEBUG=1 option, so as to adjust OPTFLAGS
    and use /MDd runtime in debug mode.
  * Changes in libtiff:
    + libtiff/tif_color.c: TIFFYCbCrToRGBInit(): stricter clamping
    to avoid int32 overflow in TIFFYCbCrtoRGB(). Fixes
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1844
    + libtiff/tif_getimage.c: initYCbCrConversion(): stricter
    validation for refBlackWhite coefficients values. To avoid
    invalid float-&gt;int32 conversion (when refBlackWhite[0] ==
    2147483648.f) Fixes
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1907
    + libtiff/tif_dirinfo.c, tif_dirread.c: add
    _TIFFCheckFieldIsValidForCodec(), and use it in
    TIFFReadDirectory() so as to ignore fields whose tag is a
    codec-specified tag but this codec is not enabled. This avoids
    TIFFGetField() to behave differently depending on whether the
    codec is enabled or not, and thus can avoid stack based buffer
    overflows in a number of TIFF utilities such as tiffsplit,
    tiffcmp, thumbnail, etc. Patch derived from
    0063-Handle-properly-CODEC-specific-tags.patch
    (http://bugzilla.maptools.org/show_bug.cgi?id=2580) by Raphaël
    Hertzog.
    Fixes: http://bugzilla.maptools.org/show_bug.cgi?id=2580
    http://bugzilla.maptools.org/show_bug.cgi?id=2693
    http://bugzilla.maptools.org/show_bug.cgi?id=2625
    (CVE-2016-10095, bsc#1017690)
    http://bugzilla.maptools.org/show_bug.cgi?id=2564
    (CVE-2015-7554, bsc#960341)
    http://bugzilla.maptools.org/show_bug.cgi?id=2561
    (CVE-2016-5318, bsc#983436)
    http://bugzilla.maptools.org/show_bug.cgi?id=2499
    (CVE-2014-8128, bsc#969783)
    http://bugzilla.maptools.org/show_bug.cgi?id=2441
    http://bugzilla.maptools.org/show_bug.cgi?id=2433
    + libtiff/tif_swab.c: if DISABLE_CHECK_TIFFSWABMACROS is
    defined, do not do the #ifdef TIFFSwabXXX checks. Make it
    easier for GDAL to rename the symbols of its internal libtiff
    copy.
    + libtiff/tif_dirread.c: fix regression of libtiff 4.0.8 in
    ChopUpSingleUncompressedStrip() regarding update of newly
    single-strip uncompressed files whose bytecount is 0. Before
    the change of 2016-12-03, the condition bytecount==0 used to
    trigger an early exit/disabling of strip chop. Re-introduce
    that in update mode. Otherwise this cause later incorrect
    setting for the value of StripByCounts/StripOffsets.
    (https://trac.osgeo.org/gdal/ticket/6924)
    + libtiff/tif_dirread.c: TIFFFetchStripThing(): limit the
    number of items read in StripOffsets/StripByteCounts tags to
    the number of strips to avoid excessive memory allocation.
    Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2215
    + libtiff/tif_getimage.c: avoid many (harmless) unsigned int
    overflows.
    + libtiff/tif_fax3.c: avoid unsigned int overflow in
    Fax3Encode2DRow(). Could potentially be a bug with huge rows.
    + libtiff/tif_jpeg.c: avoid (harmless) unsigned int overflow on
    tiled images.
    + libtiff/tif_dirread.c: avoid unsigned int overflow in
    EstimateStripByteCounts() and BYTECOUNTLOOKSBAD when file is
    too short.
    + libtiff/tif_predict.c: decorate legitimate functions where
    unsigned int overflow occur with
    TIFF_NOSANITIZE_UNSIGNED_INT_OVERFLOW
    + libtiff/tif_dirread.c: avoid unsigned int overflow in
    EstimateStripByteCounts()
    + libtiff/tiffiop.h: add TIFF_NOSANITIZE_UNSIGNED_INT_OVERFLOW
    macro to disable CLang warnings raised by
  - fsanitize=undefined,unsigned-integer-overflow
    + libtiff/tif_jpeg.c: add anti-denial of service measure to
    avoid excessive CPU consumption on progressive JPEGs with a
    huge number of scans. See
    http://www.libjpeg-turbo.org/pmwiki/uploads/About/TwoIssueswiththeJPEGStandard.pdf
    Note: only affects libtiff since 2014-12-29 where support of
    non-baseline JPEG was added.
    + libtiff/tif_jpeg.c: error out at decoding time if anticipated
    libjpeg memory allocation is above 100 MB. libjpeg in case of
    multiple scans, which is allowed even in baseline JPEG, if
    components are spread over several scans and not
    interleavedin a single one, needs to allocate memory (or
    backing store) for the whole strip/tile. See
    http://www.libjpeg-turbo.org/pmwiki/uploads/About/TwoIssueswiththeJPEGStandard.pdf
    This limitation may be overriden by setting the
    LIBTIFF_ALLOW_LARGE_LIBJPEG_MEM_ALLOC environment variable, or
    recompiling libtiff with a custom value of
    TIFF_LIBJPEG_LARGEST_MEM_ALLOC macro.
    + libtiff/tif_jbig.c: fix memory leak in error code path of
    JBIGDecode()
    Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2706
    (CVE-2017-9936, bsc#1046073)
    + libtiff/tif_dirread.c: in TIFFReadDirEntryFloat(), check that
    a double value can fit in a float before casting.
    + libtiff/tiffiop.h, libtiff/tif_jpeg.c, libtiff/tif_jpeg_12.c,
    libtiff/tif_read.c: make TIFFReadScanline() works in
    CHUNKY_STRIP_READ_SUPPORT mode with JPEG stream with multiple
    scans. Also make configurable through a
    LIBTIFF_JPEG_MAX_ALLOWED_SCAN_NUMBER environment variable the
    maximum number of scans allowed. Defaults to 100.
    + libtiff/tif_read.c: TIFFFillTile(): add limitation to the
    number of bytes read in case td_stripbytecount[strip] is
    bigger than reasonable, so as to avoid excessive memory
    allocation (similarly to what was done for TIFFFileStrip() on
    2017-05-10)
    + libtiff/tif_getimage.c: use
    _TIFFReadEncodedStripAndAllocBuffer(). Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2708 and
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2433
    + libtiff/tif_read.c, tiffiop.h: add a
    _TIFFReadEncodedStripAndAllocBuffer() function, variant of
    TIFFReadEncodedStrip() that allocates the decoded buffer only
    after a first successful TIFFFillStrip(). This avoids
    excessive memory allocation on corrupted files.
    + libtiff/tif_dirwrite.c: in TIFFWriteDirectoryTagCheckedXXXX()
    functions associated with LONG8/SLONG8 data type, replace
    assertion that the file is BigTIFF, by a non-fatal error.
    Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2712
    + libtiff/tif_read.c: TIFFStartTile(): set tif_rawcc to
    tif_rawdataloaded when it is set. Similarly to
    TIFFStartStrip(). This issue was revealed by the change of
    2017-06-30 in TIFFFileTile(), limiting the number of bytes
    read. But it could probably have been hit too in
    CHUNKY_STRIP_READ_SUPPORT mode previously. Fixes
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2454
    + libtiff/tif_error.c, tif_warning.c: correctly use va_list
    when both an old-style and new-style warning/error handlers
    are installed. Patch by Paavo Helde (sent on the mailing list)
    + libtiff/tif_getimage.c: use _TIFFReadTileAndAllocBuffer().
    Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2470
    + libtiff/tif_read.c, tiffiop.h: add a
    _TIFFReadEncodedTileAndAllocBuffer() and
    _TIFFReadTileAndAllocBuffer() variants of
    TIFFReadEncodedTile() and TIFFReadTile() that allocates the
    decoded buffer only after a first successful TIFFFillTile().
    This avoids excessive memory allocation on corrupted files.
    + libtiff/tif_pixarlog.c: avoid excessive memory allocation on
    decoding when RowsPerStrip tag is not defined (and thus
    td_rowsperstrip == UINT_MAX) Fixes
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2554
    + libtiff/tif_lzw.c: fix 4.0.8 regression in the decoding of
    old-style LZW compressed files.
    + libtiff/tif_lzw.c: fix potential out-of-buffer read on 1-byte
    LZW strips. Crashing issue only on memory mapped files, where
    the strip offset is the last byte of the file, and the file
    size is a multiple of one page size on the CPU architecture
    (typically 4096)
    + libtiff/tif_dir.c: avoid potential null pointer dereference
    in _TIFFVGetField() on corrupted TIFFTAG_NUMBEROFINKS tag
    instance.
    Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2713
    + tools/tiff2pdf.c: prevent heap buffer overflow write in "Raw"
    mode on PlanarConfig=Contig input images. Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2715
    + libtiff/tif_read.c: TIFFFillStrip() / TIFFFillTile().
    Complementary fix for
    http://bugzilla.maptools.org/show_bug.cgi?id=2708 in the
    isMapped() case, so as to avoid excessive memory allocation
    when we need a temporary buffer but the file is truncated.
    + libtiff/tif_read.c: in TIFFFetchStripThing(), only grow the
    arrays that hold StripOffsets/StripByteCounts, when they are
    smaller than the expected number of striles, up to 1 million
    striles, and error out beyond. Can be tweaked by setting the
    environment variable LIBTIFF_STRILE_ARRAY_MAX_RESIZE_COUNT.
    This partially goes against a change added on 2002-12-17 to
    accept those arrays of wrong sizes, but is needed to avoid
    denial of services. Fixes
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2350
    + libtiff/tif_read.c: add protection against excessive memory
    allocation attempts in TIFFReadDirEntryArray() on short files.
    Effective for mmap'ed case. And non-mmap'ed case, but
    restricted to 64bit builds. Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2675
    (CVE-2017-12944, bsc#1054594)
    + libtiff/tif_luv.c: LogLuvInitState(): avoid excessive memory
    allocation when RowsPerStrip tag is missing. Fixes
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2683
    + libtiff/tif_getimage.c: gtTileContig() and gtTileSeparate():
    properly break from loops on error when stoponerr is set,
    instead of going on iterating on row based loop.
    + libtiff/tif_getimage.c: fix fromskew computation when
    to-be-skipped pixel number is not a multiple of the horizontal
    subsampling, and also in some other cases. Impact
    putcontig8bitYCbCr44tile, putcontig8bitYCbCr42tile,
    putcontig8bitYCbCr41tile, putcontig8bitYCbCr21tile and
    putcontig8bitYCbCr12tile Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2637 and
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2691
    + libtiff/tif_luv.c: further reduce memory requirements for
    temporary buffer when RowsPerStrip &gt;= image_length in
    LogLuvInitState() and LogL16InitState(). Fixes
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2700
    + libtiff/tif_dirwrite.c: replace assertion related to not
    finding the SubIFD tag by runtime check (in
    TIFFWriteDirectorySec()) Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2727
    + libtiff/tif_dirwrite.c: replace assertion to tag value not
    fitting on uint32 when selecting the value of SubIFD tag by
    runtime check (in TIFFWriteDirectoryTagSubifd()). Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2728
    + libtiff/tif_jpeg.c: accept reading the last strip of a JPEG
    compressed file if the codestream height is larger than the
    truncated height of the strip. Emit a warning in this
    situation since this is non compliant.
    + libtiff/tiffiop.h, tif_aux.c: redirect SeekOK() macro to a
    _TIFFSeekoK() function that checks if the offset is not
    bigger than INT64_MAX, so as to avoid a -1 error return code
    of TIFFSeekFile() to match a required seek to UINT64_MAX/-1.
    Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2726
    + libtiff/tif_dirread.c: add NULL check to avoid likely false
    positive null-pointer dereference warning by CLang Static
    Analyzer.
    + libtiff/libtiff.def: add TIFFReadRGBAStripExt and
    TIFFReadRGBATileExt Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2735
    + libtiff/tif_jpeg.c: add compatibility with libjpeg-turbo
    1.5.2 that honours max_memory_to_use &gt; 0. Cf
    https://github.com/libjpeg-turbo/libjpeg-turbo/issues/162
    + libtiff/tif_getimage.c: avoid floating point division by zero
    in initCIELabConversion() Fixes
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=3733
  * Changes in the tools:
    + tools/tiff2pdf.c: prevent heap buffer overflow write in "Raw"
    mode on PlanarConfig=Contig input images. Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2715
    + tools/tiffset.c: fix setting a single value for the
    ExtraSamples tag (and other tags with variable number of
    values). So 'tiffset -s ExtraSamples 1 X'. This only worked
    when setting 2 or more values, but not just one.
    + tools/fax2tiff.c (_FAX_Client_Data): Pass FAX_Client_Data as
    the client data. This client data is not used at all at the
    moment, but it makes the most sense. Issue that the value of
    client_data.fd was passed where a pointer is expected.
    + tools/tiff2pdf.c (t2p_sample_realize_palette): Fix possible
    arithmetic overflow in bounds checking code and eliminate
    comparison between signed and unsigned type.
    + tools/tiff2bw.c (main): Free memory allocated in the tiff2bw
    program. This is in response to the report associated with
    CVE-2017-16232, bsc#1069213 but does not solve the extremely
    high memory usage with the associated POC file.</changelog>
  <changelog author="dimstar@opensuse.org" date="1513857600">- Fix check section:
  + Make sure to get back to the right directory after chdir to
    'tools', or we can't run the 2nd test suite.
  + Fix typo: the tests are located in a directory called 'test',
    not 'tests'.</changelog>
  <changelog author="mvetter@suse.com" date="1518782400">- bsc#1046077: Add tiff-4.0.9-bsc1046077-CVE-2017-9935.patch
  Fix Heap-based buffer overflow in t2p_write_pdf</changelog>
  <changelog author="mvetter@suse.com" date="1519128000">- bsc#1081690: Add tiff-4.0.9-bsc1081690-CVE-2018-5784.patch
  Fix uncontrolled resource consumption in TIFFSetDirectory</changelog>
  <changelog author="pgajdos@suse.com" date="1526385600">- security update
  * CVE-2018-10963 [bsc#1092949]
    + tiff-CVE-2018-10963.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1526644800">- security update
  * CVE-2017-18013 [bsc#1074317]
    + tiff-CVE-2017-18013.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1528113600">- security update
  * CVE-2018-7456 [bsc#1082825]
    + tiff-CVE-2018-7456.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1528113601">- security update
  * CVE-2017-11613 [bsc#1082332]
    + tiff-CVE-2017-11613.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1528200000">- security update
  * CVE-2018-8905 [bsc#1086408]
    + tiff-CVE-2018-8905.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1534334400">- security update
  * CVE-2018-10779 [bsc#1092480]
    + tiff-CVE-2018-10779.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1539777600">- security update
  * CVE-2018-17100 [bsc#1108637]
    + tiff-CVE-2018-17100.patch
  * CVE-2018-17101 [bsc#1108627]
    + tiff-CVE-2018-17101.patch
  * CVE-2018-17795 [bsc#1110358]
    % tiff-4.0.9-bsc1046077-CVE-2017-9935.patch renamed to
    tiff-CVE-2017-9935,CVE-2018-17795.patch
  * CVE-2018-16335 [bsc#1106853]
    % tiff-CVE-2017-11613.patch renamed to
    tiff-CVE-2017-11613,CVE-2018-16335,15209.patch
- add a possibility to build with ASAN</changelog>
  <changelog author="pgajdos@suse.com" date="1542024000">- asan_build: build ASAN included
- debug_build: build more suitable for debugging</changelog>
  <changelog author="pgajdos@suse.com" date="1542024001">- security update
  * CVE-2018-18661 [bsc#1113672]
    + tiff-CVE-2018-18661.patch
  * CVE-2018-18557 [bsc#1113094]
    + tiff-CVE-2018-18557.patch
  * CVE-2018-12900 [bsc#1099257]
    + tiff-CVE-2018-12900.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1542628800">- security update
  * CVE-2018-19210 [bsc#1115717]
    + tiff-CVE-2018-19210.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1548849600">- extend tiff-CVE-2018-19210.patch and rename it to
  tiff-CVE-2018-17000,19210.patch [bsc#1108606c#11]
  * solves CVE-2018-19210 [bsc#1115717] and CVE-2018-17000 [bsc#1108606]</changelog>
  <changelog author="mvetter@suse.com" date="1549281600">- security update
  * CVE-2019-6128 [bsc#1121626]
    + tiff-CVE-2019-6128.patch</changelog>
  <changelog author="mvetter@suse.com" date="1549972800">- security update
  * CVE-2019-7663 [bsc#1125113]
    + tiff-CVE-2019-7663.patch</changelog>
  <changelog author="mvetter@suse.com" date="1573041600">- security update: Fix integer overflow in _TIFFCheckMalloc()
  * CVE-2019-14973 [bsc#1146608]
    + tiff-CVE-2019-14973.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1573041601">- security update: amend patch to fix test
- modified patches
  % tiff-CVE-2019-14973.patch (refreshed)</changelog>
  <changelog author="mvetter@suse.com" date="1642420800">- security update: Fix buffer overwrite
  * CVE-2019-17546[bsc#1154365]
    + tiff-CVE-2019-17546.patch
- security update: Fix heap based buffer overflow in pal2rgb
  * CVE-2017-17095[bsc#1071031]
    + tiff-CVE-2017-17095.patch
- security update: Fix OOB in _TIFFmemcpy
  * CVE-2022-22844[bsc#1194539]
    + tiff-CVE-2022-22844.patch
- security update: Fix memory allocation failure in tif_read.c
  * CVE-2020-35521[bsc#1182808] CVE-2020-35522[bsc#1182809]
    + tiff-CVE-2020-35521,CVE-2020-35522.patch
- security update: Fix DOS via invertImage()
  * CVE-2020-19131[bsc#1190312]
    + tiff-CVE-2020-19131.patch
- security update: Fix heap-based buffer overflow in TIFF2PDF tool
  * CVE-2020-35524[bsc#1182812]
    + tiff-CVE-2020-35524.patch
- security update: Fix integer overflow in tif_getimage
  * CVE-2020-35523 [bsc#1182811]
    + tiff-CVE-2020-35523.patch</changelog>
</package>
<package pkgid="a61f492ee4e38b0a874ef8b0bd50aa7038e08e7f03d167970d05e9f933a83c7f" name="libtiff5" arch="s390x">
  <version epoch="0" ver="4.0.9" rel="45.5.1"/>
  <changelog author="fstrba@suse.com" date="1511956800">- Upgrade to upstream release 4.0.9
  * Changes in the software configuration:
    + test/Makefile.am: Add some tests for tiff2bw.
    + .appveyor.yml, .travis.yml, build/travis-ci: apply patches
    0001-ci-Travis-script-improvements.patch and
    0002-ci-Invoke-helper-script-via-shell.patch by Roger Leigh
    + .travis.yml, build/travis-ci: new files from
    0001-ci-Add-Travis-support-for-Linux-builds-with-Autoconf.patch
    by Roger Leigh. This patch adds support for the Travis-CI
    service.
    + .appveyor.yml: new file from
    0002-ci-Add-AppVeyor-support.patch by Roger Leigh (sent to
    mailing list on 2017-06-08) This patch adds a .appveyor.yml
    file to the top-level. This allows one to opt in to having a
    branch built on Windows with Cygwin, MinGW and MSVC
    automatically when a branch is pushed to GitHub, GitLab,
    BitBucket or any other supported git hosting service.
    + CMakeLists.txt, test/CMakeLists.txt,
    test/TiffTestCommon.cmake: apply patch
    0001-cmake-Improve-Cygwin-and-MingGW-test-support.patch from
    Roger Leigh. This patch makes the CMake build system support
    running the tests with MinGW or  Cygwin.
    + test/tiffcp-lzw-compat.sh, test/images/quad-lzw-compat.tiff:
    new files to test old-style LZW decompression
    + test/common.sh, Makefile.am, CMakeList.txt: updated with above
    + test/Makefile.am: add missing reference to
    images/quad-lzw-compat.tiff to fix "make distcheck". Patch by
    Roger Leigh
    + nmake.opt: support a DEBUG=1 option, so as to adjust OPTFLAGS
    and use /MDd runtime in debug mode.
  * Changes in libtiff:
    + libtiff/tif_color.c: TIFFYCbCrToRGBInit(): stricter clamping
    to avoid int32 overflow in TIFFYCbCrtoRGB(). Fixes
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1844
    + libtiff/tif_getimage.c: initYCbCrConversion(): stricter
    validation for refBlackWhite coefficients values. To avoid
    invalid float-&gt;int32 conversion (when refBlackWhite[0] ==
    2147483648.f) Fixes
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1907
    + libtiff/tif_dirinfo.c, tif_dirread.c: add
    _TIFFCheckFieldIsValidForCodec(), and use it in
    TIFFReadDirectory() so as to ignore fields whose tag is a
    codec-specified tag but this codec is not enabled. This avoids
    TIFFGetField() to behave differently depending on whether the
    codec is enabled or not, and thus can avoid stack based buffer
    overflows in a number of TIFF utilities such as tiffsplit,
    tiffcmp, thumbnail, etc. Patch derived from
    0063-Handle-properly-CODEC-specific-tags.patch
    (http://bugzilla.maptools.org/show_bug.cgi?id=2580) by Raphaël
    Hertzog.
    Fixes: http://bugzilla.maptools.org/show_bug.cgi?id=2580
    http://bugzilla.maptools.org/show_bug.cgi?id=2693
    http://bugzilla.maptools.org/show_bug.cgi?id=2625
    (CVE-2016-10095, bsc#1017690)
    http://bugzilla.maptools.org/show_bug.cgi?id=2564
    (CVE-2015-7554, bsc#960341)
    http://bugzilla.maptools.org/show_bug.cgi?id=2561
    (CVE-2016-5318, bsc#983436)
    http://bugzilla.maptools.org/show_bug.cgi?id=2499
    (CVE-2014-8128, bsc#969783)
    http://bugzilla.maptools.org/show_bug.cgi?id=2441
    http://bugzilla.maptools.org/show_bug.cgi?id=2433
    + libtiff/tif_swab.c: if DISABLE_CHECK_TIFFSWABMACROS is
    defined, do not do the #ifdef TIFFSwabXXX checks. Make it
    easier for GDAL to rename the symbols of its internal libtiff
    copy.
    + libtiff/tif_dirread.c: fix regression of libtiff 4.0.8 in
    ChopUpSingleUncompressedStrip() regarding update of newly
    single-strip uncompressed files whose bytecount is 0. Before
    the change of 2016-12-03, the condition bytecount==0 used to
    trigger an early exit/disabling of strip chop. Re-introduce
    that in update mode. Otherwise this cause later incorrect
    setting for the value of StripByCounts/StripOffsets.
    (https://trac.osgeo.org/gdal/ticket/6924)
    + libtiff/tif_dirread.c: TIFFFetchStripThing(): limit the
    number of items read in StripOffsets/StripByteCounts tags to
    the number of strips to avoid excessive memory allocation.
    Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2215
    + libtiff/tif_getimage.c: avoid many (harmless) unsigned int
    overflows.
    + libtiff/tif_fax3.c: avoid unsigned int overflow in
    Fax3Encode2DRow(). Could potentially be a bug with huge rows.
    + libtiff/tif_jpeg.c: avoid (harmless) unsigned int overflow on
    tiled images.
    + libtiff/tif_dirread.c: avoid unsigned int overflow in
    EstimateStripByteCounts() and BYTECOUNTLOOKSBAD when file is
    too short.
    + libtiff/tif_predict.c: decorate legitimate functions where
    unsigned int overflow occur with
    TIFF_NOSANITIZE_UNSIGNED_INT_OVERFLOW
    + libtiff/tif_dirread.c: avoid unsigned int overflow in
    EstimateStripByteCounts()
    + libtiff/tiffiop.h: add TIFF_NOSANITIZE_UNSIGNED_INT_OVERFLOW
    macro to disable CLang warnings raised by
  - fsanitize=undefined,unsigned-integer-overflow
    + libtiff/tif_jpeg.c: add anti-denial of service measure to
    avoid excessive CPU consumption on progressive JPEGs with a
    huge number of scans. See
    http://www.libjpeg-turbo.org/pmwiki/uploads/About/TwoIssueswiththeJPEGStandard.pdf
    Note: only affects libtiff since 2014-12-29 where support of
    non-baseline JPEG was added.
    + libtiff/tif_jpeg.c: error out at decoding time if anticipated
    libjpeg memory allocation is above 100 MB. libjpeg in case of
    multiple scans, which is allowed even in baseline JPEG, if
    components are spread over several scans and not
    interleavedin a single one, needs to allocate memory (or
    backing store) for the whole strip/tile. See
    http://www.libjpeg-turbo.org/pmwiki/uploads/About/TwoIssueswiththeJPEGStandard.pdf
    This limitation may be overriden by setting the
    LIBTIFF_ALLOW_LARGE_LIBJPEG_MEM_ALLOC environment variable, or
    recompiling libtiff with a custom value of
    TIFF_LIBJPEG_LARGEST_MEM_ALLOC macro.
    + libtiff/tif_jbig.c: fix memory leak in error code path of
    JBIGDecode()
    Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2706
    (CVE-2017-9936, bsc#1046073)
    + libtiff/tif_dirread.c: in TIFFReadDirEntryFloat(), check that
    a double value can fit in a float before casting.
    + libtiff/tiffiop.h, libtiff/tif_jpeg.c, libtiff/tif_jpeg_12.c,
    libtiff/tif_read.c: make TIFFReadScanline() works in
    CHUNKY_STRIP_READ_SUPPORT mode with JPEG stream with multiple
    scans. Also make configurable through a
    LIBTIFF_JPEG_MAX_ALLOWED_SCAN_NUMBER environment variable the
    maximum number of scans allowed. Defaults to 100.
    + libtiff/tif_read.c: TIFFFillTile(): add limitation to the
    number of bytes read in case td_stripbytecount[strip] is
    bigger than reasonable, so as to avoid excessive memory
    allocation (similarly to what was done for TIFFFileStrip() on
    2017-05-10)
    + libtiff/tif_getimage.c: use
    _TIFFReadEncodedStripAndAllocBuffer(). Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2708 and
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2433
    + libtiff/tif_read.c, tiffiop.h: add a
    _TIFFReadEncodedStripAndAllocBuffer() function, variant of
    TIFFReadEncodedStrip() that allocates the decoded buffer only
    after a first successful TIFFFillStrip(). This avoids
    excessive memory allocation on corrupted files.
    + libtiff/tif_dirwrite.c: in TIFFWriteDirectoryTagCheckedXXXX()
    functions associated with LONG8/SLONG8 data type, replace
    assertion that the file is BigTIFF, by a non-fatal error.
    Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2712
    + libtiff/tif_read.c: TIFFStartTile(): set tif_rawcc to
    tif_rawdataloaded when it is set. Similarly to
    TIFFStartStrip(). This issue was revealed by the change of
    2017-06-30 in TIFFFileTile(), limiting the number of bytes
    read. But it could probably have been hit too in
    CHUNKY_STRIP_READ_SUPPORT mode previously. Fixes
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2454
    + libtiff/tif_error.c, tif_warning.c: correctly use va_list
    when both an old-style and new-style warning/error handlers
    are installed. Patch by Paavo Helde (sent on the mailing list)
    + libtiff/tif_getimage.c: use _TIFFReadTileAndAllocBuffer().
    Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2470
    + libtiff/tif_read.c, tiffiop.h: add a
    _TIFFReadEncodedTileAndAllocBuffer() and
    _TIFFReadTileAndAllocBuffer() variants of
    TIFFReadEncodedTile() and TIFFReadTile() that allocates the
    decoded buffer only after a first successful TIFFFillTile().
    This avoids excessive memory allocation on corrupted files.
    + libtiff/tif_pixarlog.c: avoid excessive memory allocation on
    decoding when RowsPerStrip tag is not defined (and thus
    td_rowsperstrip == UINT_MAX) Fixes
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2554
    + libtiff/tif_lzw.c: fix 4.0.8 regression in the decoding of
    old-style LZW compressed files.
    + libtiff/tif_lzw.c: fix potential out-of-buffer read on 1-byte
    LZW strips. Crashing issue only on memory mapped files, where
    the strip offset is the last byte of the file, and the file
    size is a multiple of one page size on the CPU architecture
    (typically 4096)
    + libtiff/tif_dir.c: avoid potential null pointer dereference
    in _TIFFVGetField() on corrupted TIFFTAG_NUMBEROFINKS tag
    instance.
    Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2713
    + tools/tiff2pdf.c: prevent heap buffer overflow write in "Raw"
    mode on PlanarConfig=Contig input images. Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2715
    + libtiff/tif_read.c: TIFFFillStrip() / TIFFFillTile().
    Complementary fix for
    http://bugzilla.maptools.org/show_bug.cgi?id=2708 in the
    isMapped() case, so as to avoid excessive memory allocation
    when we need a temporary buffer but the file is truncated.
    + libtiff/tif_read.c: in TIFFFetchStripThing(), only grow the
    arrays that hold StripOffsets/StripByteCounts, when they are
    smaller than the expected number of striles, up to 1 million
    striles, and error out beyond. Can be tweaked by setting the
    environment variable LIBTIFF_STRILE_ARRAY_MAX_RESIZE_COUNT.
    This partially goes against a change added on 2002-12-17 to
    accept those arrays of wrong sizes, but is needed to avoid
    denial of services. Fixes
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2350
    + libtiff/tif_read.c: add protection against excessive memory
    allocation attempts in TIFFReadDirEntryArray() on short files.
    Effective for mmap'ed case. And non-mmap'ed case, but
    restricted to 64bit builds. Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2675
    (CVE-2017-12944, bsc#1054594)
    + libtiff/tif_luv.c: LogLuvInitState(): avoid excessive memory
    allocation when RowsPerStrip tag is missing. Fixes
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2683
    + libtiff/tif_getimage.c: gtTileContig() and gtTileSeparate():
    properly break from loops on error when stoponerr is set,
    instead of going on iterating on row based loop.
    + libtiff/tif_getimage.c: fix fromskew computation when
    to-be-skipped pixel number is not a multiple of the horizontal
    subsampling, and also in some other cases. Impact
    putcontig8bitYCbCr44tile, putcontig8bitYCbCr42tile,
    putcontig8bitYCbCr41tile, putcontig8bitYCbCr21tile and
    putcontig8bitYCbCr12tile Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2637 and
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2691
    + libtiff/tif_luv.c: further reduce memory requirements for
    temporary buffer when RowsPerStrip &gt;= image_length in
    LogLuvInitState() and LogL16InitState(). Fixes
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2700
    + libtiff/tif_dirwrite.c: replace assertion related to not
    finding the SubIFD tag by runtime check (in
    TIFFWriteDirectorySec()) Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2727
    + libtiff/tif_dirwrite.c: replace assertion to tag value not
    fitting on uint32 when selecting the value of SubIFD tag by
    runtime check (in TIFFWriteDirectoryTagSubifd()). Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2728
    + libtiff/tif_jpeg.c: accept reading the last strip of a JPEG
    compressed file if the codestream height is larger than the
    truncated height of the strip. Emit a warning in this
    situation since this is non compliant.
    + libtiff/tiffiop.h, tif_aux.c: redirect SeekOK() macro to a
    _TIFFSeekoK() function that checks if the offset is not
    bigger than INT64_MAX, so as to avoid a -1 error return code
    of TIFFSeekFile() to match a required seek to UINT64_MAX/-1.
    Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2726
    + libtiff/tif_dirread.c: add NULL check to avoid likely false
    positive null-pointer dereference warning by CLang Static
    Analyzer.
    + libtiff/libtiff.def: add TIFFReadRGBAStripExt and
    TIFFReadRGBATileExt Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2735
    + libtiff/tif_jpeg.c: add compatibility with libjpeg-turbo
    1.5.2 that honours max_memory_to_use &gt; 0. Cf
    https://github.com/libjpeg-turbo/libjpeg-turbo/issues/162
    + libtiff/tif_getimage.c: avoid floating point division by zero
    in initCIELabConversion() Fixes
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=3733
  * Changes in the tools:
    + tools/tiff2pdf.c: prevent heap buffer overflow write in "Raw"
    mode on PlanarConfig=Contig input images. Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2715
    + tools/tiffset.c: fix setting a single value for the
    ExtraSamples tag (and other tags with variable number of
    values). So 'tiffset -s ExtraSamples 1 X'. This only worked
    when setting 2 or more values, but not just one.
    + tools/fax2tiff.c (_FAX_Client_Data): Pass FAX_Client_Data as
    the client data. This client data is not used at all at the
    moment, but it makes the most sense. Issue that the value of
    client_data.fd was passed where a pointer is expected.
    + tools/tiff2pdf.c (t2p_sample_realize_palette): Fix possible
    arithmetic overflow in bounds checking code and eliminate
    comparison between signed and unsigned type.
    + tools/tiff2bw.c (main): Free memory allocated in the tiff2bw
    program. This is in response to the report associated with
    CVE-2017-16232, bsc#1069213 but does not solve the extremely
    high memory usage with the associated POC file.</changelog>
  <changelog author="dimstar@opensuse.org" date="1513857600">- Fix check section:
  + Make sure to get back to the right directory after chdir to
    'tools', or we can't run the 2nd test suite.
  + Fix typo: the tests are located in a directory called 'test',
    not 'tests'.</changelog>
  <changelog author="mvetter@suse.com" date="1518782400">- bsc#1046077: Add tiff-4.0.9-bsc1046077-CVE-2017-9935.patch
  Fix Heap-based buffer overflow in t2p_write_pdf</changelog>
  <changelog author="mvetter@suse.com" date="1519128000">- bsc#1081690: Add tiff-4.0.9-bsc1081690-CVE-2018-5784.patch
  Fix uncontrolled resource consumption in TIFFSetDirectory</changelog>
  <changelog author="pgajdos@suse.com" date="1526385600">- security update
  * CVE-2018-10963 [bsc#1092949]
    + tiff-CVE-2018-10963.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1526644800">- security update
  * CVE-2017-18013 [bsc#1074317]
    + tiff-CVE-2017-18013.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1528113600">- security update
  * CVE-2018-7456 [bsc#1082825]
    + tiff-CVE-2018-7456.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1528113601">- security update
  * CVE-2017-11613 [bsc#1082332]
    + tiff-CVE-2017-11613.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1528200000">- security update
  * CVE-2018-8905 [bsc#1086408]
    + tiff-CVE-2018-8905.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1534334400">- security update
  * CVE-2018-10779 [bsc#1092480]
    + tiff-CVE-2018-10779.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1539777600">- security update
  * CVE-2018-17100 [bsc#1108637]
    + tiff-CVE-2018-17100.patch
  * CVE-2018-17101 [bsc#1108627]
    + tiff-CVE-2018-17101.patch
  * CVE-2018-17795 [bsc#1110358]
    % tiff-4.0.9-bsc1046077-CVE-2017-9935.patch renamed to
    tiff-CVE-2017-9935,CVE-2018-17795.patch
  * CVE-2018-16335 [bsc#1106853]
    % tiff-CVE-2017-11613.patch renamed to
    tiff-CVE-2017-11613,CVE-2018-16335,15209.patch
- add a possibility to build with ASAN</changelog>
  <changelog author="pgajdos@suse.com" date="1542024000">- asan_build: build ASAN included
- debug_build: build more suitable for debugging</changelog>
  <changelog author="pgajdos@suse.com" date="1542024001">- security update
  * CVE-2018-18661 [bsc#1113672]
    + tiff-CVE-2018-18661.patch
  * CVE-2018-18557 [bsc#1113094]
    + tiff-CVE-2018-18557.patch
  * CVE-2018-12900 [bsc#1099257]
    + tiff-CVE-2018-12900.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1542628800">- security update
  * CVE-2018-19210 [bsc#1115717]
    + tiff-CVE-2018-19210.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1548849600">- extend tiff-CVE-2018-19210.patch and rename it to
  tiff-CVE-2018-17000,19210.patch [bsc#1108606c#11]
  * solves CVE-2018-19210 [bsc#1115717] and CVE-2018-17000 [bsc#1108606]</changelog>
  <changelog author="mvetter@suse.com" date="1549281600">- security update
  * CVE-2019-6128 [bsc#1121626]
    + tiff-CVE-2019-6128.patch</changelog>
  <changelog author="mvetter@suse.com" date="1549972800">- security update
  * CVE-2019-7663 [bsc#1125113]
    + tiff-CVE-2019-7663.patch</changelog>
  <changelog author="mvetter@suse.com" date="1573041600">- security update: Fix integer overflow in _TIFFCheckMalloc()
  * CVE-2019-14973 [bsc#1146608]
    + tiff-CVE-2019-14973.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1573041601">- security update: amend patch to fix test
- modified patches
  % tiff-CVE-2019-14973.patch (refreshed)</changelog>
  <changelog author="mvetter@suse.com" date="1642420800">- security update: Fix buffer overwrite
  * CVE-2019-17546[bsc#1154365]
    + tiff-CVE-2019-17546.patch
- security update: Fix heap based buffer overflow in pal2rgb
  * CVE-2017-17095[bsc#1071031]
    + tiff-CVE-2017-17095.patch
- security update: Fix OOB in _TIFFmemcpy
  * CVE-2022-22844[bsc#1194539]
    + tiff-CVE-2022-22844.patch
- security update: Fix memory allocation failure in tif_read.c
  * CVE-2020-35521[bsc#1182808] CVE-2020-35522[bsc#1182809]
    + tiff-CVE-2020-35521,CVE-2020-35522.patch
- security update: Fix DOS via invertImage()
  * CVE-2020-19131[bsc#1190312]
    + tiff-CVE-2020-19131.patch
- security update: Fix heap-based buffer overflow in TIFF2PDF tool
  * CVE-2020-35524[bsc#1182812]
    + tiff-CVE-2020-35524.patch
- security update: Fix integer overflow in tif_getimage
  * CVE-2020-35523 [bsc#1182811]
    + tiff-CVE-2020-35523.patch</changelog>
</package>
<package pkgid="dea44dd874ad6de47bb849c493345dddf6d0a769e3e36e6b9c5c2f913bb0f68a" name="libtiff5" arch="x86_64">
  <version epoch="0" ver="4.0.9" rel="45.5.1"/>
  <changelog author="fstrba@suse.com" date="1511956800">- Upgrade to upstream release 4.0.9
  * Changes in the software configuration:
    + test/Makefile.am: Add some tests for tiff2bw.
    + .appveyor.yml, .travis.yml, build/travis-ci: apply patches
    0001-ci-Travis-script-improvements.patch and
    0002-ci-Invoke-helper-script-via-shell.patch by Roger Leigh
    + .travis.yml, build/travis-ci: new files from
    0001-ci-Add-Travis-support-for-Linux-builds-with-Autoconf.patch
    by Roger Leigh. This patch adds support for the Travis-CI
    service.
    + .appveyor.yml: new file from
    0002-ci-Add-AppVeyor-support.patch by Roger Leigh (sent to
    mailing list on 2017-06-08) This patch adds a .appveyor.yml
    file to the top-level. This allows one to opt in to having a
    branch built on Windows with Cygwin, MinGW and MSVC
    automatically when a branch is pushed to GitHub, GitLab,
    BitBucket or any other supported git hosting service.
    + CMakeLists.txt, test/CMakeLists.txt,
    test/TiffTestCommon.cmake: apply patch
    0001-cmake-Improve-Cygwin-and-MingGW-test-support.patch from
    Roger Leigh. This patch makes the CMake build system support
    running the tests with MinGW or  Cygwin.
    + test/tiffcp-lzw-compat.sh, test/images/quad-lzw-compat.tiff:
    new files to test old-style LZW decompression
    + test/common.sh, Makefile.am, CMakeList.txt: updated with above
    + test/Makefile.am: add missing reference to
    images/quad-lzw-compat.tiff to fix "make distcheck". Patch by
    Roger Leigh
    + nmake.opt: support a DEBUG=1 option, so as to adjust OPTFLAGS
    and use /MDd runtime in debug mode.
  * Changes in libtiff:
    + libtiff/tif_color.c: TIFFYCbCrToRGBInit(): stricter clamping
    to avoid int32 overflow in TIFFYCbCrtoRGB(). Fixes
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1844
    + libtiff/tif_getimage.c: initYCbCrConversion(): stricter
    validation for refBlackWhite coefficients values. To avoid
    invalid float-&gt;int32 conversion (when refBlackWhite[0] ==
    2147483648.f) Fixes
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1907
    + libtiff/tif_dirinfo.c, tif_dirread.c: add
    _TIFFCheckFieldIsValidForCodec(), and use it in
    TIFFReadDirectory() so as to ignore fields whose tag is a
    codec-specified tag but this codec is not enabled. This avoids
    TIFFGetField() to behave differently depending on whether the
    codec is enabled or not, and thus can avoid stack based buffer
    overflows in a number of TIFF utilities such as tiffsplit,
    tiffcmp, thumbnail, etc. Patch derived from
    0063-Handle-properly-CODEC-specific-tags.patch
    (http://bugzilla.maptools.org/show_bug.cgi?id=2580) by Raphaël
    Hertzog.
    Fixes: http://bugzilla.maptools.org/show_bug.cgi?id=2580
    http://bugzilla.maptools.org/show_bug.cgi?id=2693
    http://bugzilla.maptools.org/show_bug.cgi?id=2625
    (CVE-2016-10095, bsc#1017690)
    http://bugzilla.maptools.org/show_bug.cgi?id=2564
    (CVE-2015-7554, bsc#960341)
    http://bugzilla.maptools.org/show_bug.cgi?id=2561
    (CVE-2016-5318, bsc#983436)
    http://bugzilla.maptools.org/show_bug.cgi?id=2499
    (CVE-2014-8128, bsc#969783)
    http://bugzilla.maptools.org/show_bug.cgi?id=2441
    http://bugzilla.maptools.org/show_bug.cgi?id=2433
    + libtiff/tif_swab.c: if DISABLE_CHECK_TIFFSWABMACROS is
    defined, do not do the #ifdef TIFFSwabXXX checks. Make it
    easier for GDAL to rename the symbols of its internal libtiff
    copy.
    + libtiff/tif_dirread.c: fix regression of libtiff 4.0.8 in
    ChopUpSingleUncompressedStrip() regarding update of newly
    single-strip uncompressed files whose bytecount is 0. Before
    the change of 2016-12-03, the condition bytecount==0 used to
    trigger an early exit/disabling of strip chop. Re-introduce
    that in update mode. Otherwise this cause later incorrect
    setting for the value of StripByCounts/StripOffsets.
    (https://trac.osgeo.org/gdal/ticket/6924)
    + libtiff/tif_dirread.c: TIFFFetchStripThing(): limit the
    number of items read in StripOffsets/StripByteCounts tags to
    the number of strips to avoid excessive memory allocation.
    Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2215
    + libtiff/tif_getimage.c: avoid many (harmless) unsigned int
    overflows.
    + libtiff/tif_fax3.c: avoid unsigned int overflow in
    Fax3Encode2DRow(). Could potentially be a bug with huge rows.
    + libtiff/tif_jpeg.c: avoid (harmless) unsigned int overflow on
    tiled images.
    + libtiff/tif_dirread.c: avoid unsigned int overflow in
    EstimateStripByteCounts() and BYTECOUNTLOOKSBAD when file is
    too short.
    + libtiff/tif_predict.c: decorate legitimate functions where
    unsigned int overflow occur with
    TIFF_NOSANITIZE_UNSIGNED_INT_OVERFLOW
    + libtiff/tif_dirread.c: avoid unsigned int overflow in
    EstimateStripByteCounts()
    + libtiff/tiffiop.h: add TIFF_NOSANITIZE_UNSIGNED_INT_OVERFLOW
    macro to disable CLang warnings raised by
  - fsanitize=undefined,unsigned-integer-overflow
    + libtiff/tif_jpeg.c: add anti-denial of service measure to
    avoid excessive CPU consumption on progressive JPEGs with a
    huge number of scans. See
    http://www.libjpeg-turbo.org/pmwiki/uploads/About/TwoIssueswiththeJPEGStandard.pdf
    Note: only affects libtiff since 2014-12-29 where support of
    non-baseline JPEG was added.
    + libtiff/tif_jpeg.c: error out at decoding time if anticipated
    libjpeg memory allocation is above 100 MB. libjpeg in case of
    multiple scans, which is allowed even in baseline JPEG, if
    components are spread over several scans and not
    interleavedin a single one, needs to allocate memory (or
    backing store) for the whole strip/tile. See
    http://www.libjpeg-turbo.org/pmwiki/uploads/About/TwoIssueswiththeJPEGStandard.pdf
    This limitation may be overriden by setting the
    LIBTIFF_ALLOW_LARGE_LIBJPEG_MEM_ALLOC environment variable, or
    recompiling libtiff with a custom value of
    TIFF_LIBJPEG_LARGEST_MEM_ALLOC macro.
    + libtiff/tif_jbig.c: fix memory leak in error code path of
    JBIGDecode()
    Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2706
    (CVE-2017-9936, bsc#1046073)
    + libtiff/tif_dirread.c: in TIFFReadDirEntryFloat(), check that
    a double value can fit in a float before casting.
    + libtiff/tiffiop.h, libtiff/tif_jpeg.c, libtiff/tif_jpeg_12.c,
    libtiff/tif_read.c: make TIFFReadScanline() works in
    CHUNKY_STRIP_READ_SUPPORT mode with JPEG stream with multiple
    scans. Also make configurable through a
    LIBTIFF_JPEG_MAX_ALLOWED_SCAN_NUMBER environment variable the
    maximum number of scans allowed. Defaults to 100.
    + libtiff/tif_read.c: TIFFFillTile(): add limitation to the
    number of bytes read in case td_stripbytecount[strip] is
    bigger than reasonable, so as to avoid excessive memory
    allocation (similarly to what was done for TIFFFileStrip() on
    2017-05-10)
    + libtiff/tif_getimage.c: use
    _TIFFReadEncodedStripAndAllocBuffer(). Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2708 and
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2433
    + libtiff/tif_read.c, tiffiop.h: add a
    _TIFFReadEncodedStripAndAllocBuffer() function, variant of
    TIFFReadEncodedStrip() that allocates the decoded buffer only
    after a first successful TIFFFillStrip(). This avoids
    excessive memory allocation on corrupted files.
    + libtiff/tif_dirwrite.c: in TIFFWriteDirectoryTagCheckedXXXX()
    functions associated with LONG8/SLONG8 data type, replace
    assertion that the file is BigTIFF, by a non-fatal error.
    Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2712
    + libtiff/tif_read.c: TIFFStartTile(): set tif_rawcc to
    tif_rawdataloaded when it is set. Similarly to
    TIFFStartStrip(). This issue was revealed by the change of
    2017-06-30 in TIFFFileTile(), limiting the number of bytes
    read. But it could probably have been hit too in
    CHUNKY_STRIP_READ_SUPPORT mode previously. Fixes
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2454
    + libtiff/tif_error.c, tif_warning.c: correctly use va_list
    when both an old-style and new-style warning/error handlers
    are installed. Patch by Paavo Helde (sent on the mailing list)
    + libtiff/tif_getimage.c: use _TIFFReadTileAndAllocBuffer().
    Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2470
    + libtiff/tif_read.c, tiffiop.h: add a
    _TIFFReadEncodedTileAndAllocBuffer() and
    _TIFFReadTileAndAllocBuffer() variants of
    TIFFReadEncodedTile() and TIFFReadTile() that allocates the
    decoded buffer only after a first successful TIFFFillTile().
    This avoids excessive memory allocation on corrupted files.
    + libtiff/tif_pixarlog.c: avoid excessive memory allocation on
    decoding when RowsPerStrip tag is not defined (and thus
    td_rowsperstrip == UINT_MAX) Fixes
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2554
    + libtiff/tif_lzw.c: fix 4.0.8 regression in the decoding of
    old-style LZW compressed files.
    + libtiff/tif_lzw.c: fix potential out-of-buffer read on 1-byte
    LZW strips. Crashing issue only on memory mapped files, where
    the strip offset is the last byte of the file, and the file
    size is a multiple of one page size on the CPU architecture
    (typically 4096)
    + libtiff/tif_dir.c: avoid potential null pointer dereference
    in _TIFFVGetField() on corrupted TIFFTAG_NUMBEROFINKS tag
    instance.
    Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2713
    + tools/tiff2pdf.c: prevent heap buffer overflow write in "Raw"
    mode on PlanarConfig=Contig input images. Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2715
    + libtiff/tif_read.c: TIFFFillStrip() / TIFFFillTile().
    Complementary fix for
    http://bugzilla.maptools.org/show_bug.cgi?id=2708 in the
    isMapped() case, so as to avoid excessive memory allocation
    when we need a temporary buffer but the file is truncated.
    + libtiff/tif_read.c: in TIFFFetchStripThing(), only grow the
    arrays that hold StripOffsets/StripByteCounts, when they are
    smaller than the expected number of striles, up to 1 million
    striles, and error out beyond. Can be tweaked by setting the
    environment variable LIBTIFF_STRILE_ARRAY_MAX_RESIZE_COUNT.
    This partially goes against a change added on 2002-12-17 to
    accept those arrays of wrong sizes, but is needed to avoid
    denial of services. Fixes
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2350
    + libtiff/tif_read.c: add protection against excessive memory
    allocation attempts in TIFFReadDirEntryArray() on short files.
    Effective for mmap'ed case. And non-mmap'ed case, but
    restricted to 64bit builds. Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2675
    (CVE-2017-12944, bsc#1054594)
    + libtiff/tif_luv.c: LogLuvInitState(): avoid excessive memory
    allocation when RowsPerStrip tag is missing. Fixes
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2683
    + libtiff/tif_getimage.c: gtTileContig() and gtTileSeparate():
    properly break from loops on error when stoponerr is set,
    instead of going on iterating on row based loop.
    + libtiff/tif_getimage.c: fix fromskew computation when
    to-be-skipped pixel number is not a multiple of the horizontal
    subsampling, and also in some other cases. Impact
    putcontig8bitYCbCr44tile, putcontig8bitYCbCr42tile,
    putcontig8bitYCbCr41tile, putcontig8bitYCbCr21tile and
    putcontig8bitYCbCr12tile Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2637 and
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2691
    + libtiff/tif_luv.c: further reduce memory requirements for
    temporary buffer when RowsPerStrip &gt;= image_length in
    LogLuvInitState() and LogL16InitState(). Fixes
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2700
    + libtiff/tif_dirwrite.c: replace assertion related to not
    finding the SubIFD tag by runtime check (in
    TIFFWriteDirectorySec()) Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2727
    + libtiff/tif_dirwrite.c: replace assertion to tag value not
    fitting on uint32 when selecting the value of SubIFD tag by
    runtime check (in TIFFWriteDirectoryTagSubifd()). Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2728
    + libtiff/tif_jpeg.c: accept reading the last strip of a JPEG
    compressed file if the codestream height is larger than the
    truncated height of the strip. Emit a warning in this
    situation since this is non compliant.
    + libtiff/tiffiop.h, tif_aux.c: redirect SeekOK() macro to a
    _TIFFSeekoK() function that checks if the offset is not
    bigger than INT64_MAX, so as to avoid a -1 error return code
    of TIFFSeekFile() to match a required seek to UINT64_MAX/-1.
    Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2726
    + libtiff/tif_dirread.c: add NULL check to avoid likely false
    positive null-pointer dereference warning by CLang Static
    Analyzer.
    + libtiff/libtiff.def: add TIFFReadRGBAStripExt and
    TIFFReadRGBATileExt Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2735
    + libtiff/tif_jpeg.c: add compatibility with libjpeg-turbo
    1.5.2 that honours max_memory_to_use &gt; 0. Cf
    https://github.com/libjpeg-turbo/libjpeg-turbo/issues/162
    + libtiff/tif_getimage.c: avoid floating point division by zero
    in initCIELabConversion() Fixes
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=3733
  * Changes in the tools:
    + tools/tiff2pdf.c: prevent heap buffer overflow write in "Raw"
    mode on PlanarConfig=Contig input images. Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2715
    + tools/tiffset.c: fix setting a single value for the
    ExtraSamples tag (and other tags with variable number of
    values). So 'tiffset -s ExtraSamples 1 X'. This only worked
    when setting 2 or more values, but not just one.
    + tools/fax2tiff.c (_FAX_Client_Data): Pass FAX_Client_Data as
    the client data. This client data is not used at all at the
    moment, but it makes the most sense. Issue that the value of
    client_data.fd was passed where a pointer is expected.
    + tools/tiff2pdf.c (t2p_sample_realize_palette): Fix possible
    arithmetic overflow in bounds checking code and eliminate
    comparison between signed and unsigned type.
    + tools/tiff2bw.c (main): Free memory allocated in the tiff2bw
    program. This is in response to the report associated with
    CVE-2017-16232, bsc#1069213 but does not solve the extremely
    high memory usage with the associated POC file.</changelog>
  <changelog author="dimstar@opensuse.org" date="1513857600">- Fix check section:
  + Make sure to get back to the right directory after chdir to
    'tools', or we can't run the 2nd test suite.
  + Fix typo: the tests are located in a directory called 'test',
    not 'tests'.</changelog>
  <changelog author="mvetter@suse.com" date="1518782400">- bsc#1046077: Add tiff-4.0.9-bsc1046077-CVE-2017-9935.patch
  Fix Heap-based buffer overflow in t2p_write_pdf</changelog>
  <changelog author="mvetter@suse.com" date="1519128000">- bsc#1081690: Add tiff-4.0.9-bsc1081690-CVE-2018-5784.patch
  Fix uncontrolled resource consumption in TIFFSetDirectory</changelog>
  <changelog author="pgajdos@suse.com" date="1526385600">- security update
  * CVE-2018-10963 [bsc#1092949]
    + tiff-CVE-2018-10963.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1526644800">- security update
  * CVE-2017-18013 [bsc#1074317]
    + tiff-CVE-2017-18013.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1528113600">- security update
  * CVE-2018-7456 [bsc#1082825]
    + tiff-CVE-2018-7456.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1528113601">- security update
  * CVE-2017-11613 [bsc#1082332]
    + tiff-CVE-2017-11613.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1528200000">- security update
  * CVE-2018-8905 [bsc#1086408]
    + tiff-CVE-2018-8905.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1534334400">- security update
  * CVE-2018-10779 [bsc#1092480]
    + tiff-CVE-2018-10779.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1539777600">- security update
  * CVE-2018-17100 [bsc#1108637]
    + tiff-CVE-2018-17100.patch
  * CVE-2018-17101 [bsc#1108627]
    + tiff-CVE-2018-17101.patch
  * CVE-2018-17795 [bsc#1110358]
    % tiff-4.0.9-bsc1046077-CVE-2017-9935.patch renamed to
    tiff-CVE-2017-9935,CVE-2018-17795.patch
  * CVE-2018-16335 [bsc#1106853]
    % tiff-CVE-2017-11613.patch renamed to
    tiff-CVE-2017-11613,CVE-2018-16335,15209.patch
- add a possibility to build with ASAN</changelog>
  <changelog author="pgajdos@suse.com" date="1542024000">- asan_build: build ASAN included
- debug_build: build more suitable for debugging</changelog>
  <changelog author="pgajdos@suse.com" date="1542024001">- security update
  * CVE-2018-18661 [bsc#1113672]
    + tiff-CVE-2018-18661.patch
  * CVE-2018-18557 [bsc#1113094]
    + tiff-CVE-2018-18557.patch
  * CVE-2018-12900 [bsc#1099257]
    + tiff-CVE-2018-12900.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1542628800">- security update
  * CVE-2018-19210 [bsc#1115717]
    + tiff-CVE-2018-19210.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1548849600">- extend tiff-CVE-2018-19210.patch and rename it to
  tiff-CVE-2018-17000,19210.patch [bsc#1108606c#11]
  * solves CVE-2018-19210 [bsc#1115717] and CVE-2018-17000 [bsc#1108606]</changelog>
  <changelog author="mvetter@suse.com" date="1549281600">- security update
  * CVE-2019-6128 [bsc#1121626]
    + tiff-CVE-2019-6128.patch</changelog>
  <changelog author="mvetter@suse.com" date="1549972800">- security update
  * CVE-2019-7663 [bsc#1125113]
    + tiff-CVE-2019-7663.patch</changelog>
  <changelog author="mvetter@suse.com" date="1573041600">- security update: Fix integer overflow in _TIFFCheckMalloc()
  * CVE-2019-14973 [bsc#1146608]
    + tiff-CVE-2019-14973.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1573041601">- security update: amend patch to fix test
- modified patches
  % tiff-CVE-2019-14973.patch (refreshed)</changelog>
  <changelog author="mvetter@suse.com" date="1642420800">- security update: Fix buffer overwrite
  * CVE-2019-17546[bsc#1154365]
    + tiff-CVE-2019-17546.patch
- security update: Fix heap based buffer overflow in pal2rgb
  * CVE-2017-17095[bsc#1071031]
    + tiff-CVE-2017-17095.patch
- security update: Fix OOB in _TIFFmemcpy
  * CVE-2022-22844[bsc#1194539]
    + tiff-CVE-2022-22844.patch
- security update: Fix memory allocation failure in tif_read.c
  * CVE-2020-35521[bsc#1182808] CVE-2020-35522[bsc#1182809]
    + tiff-CVE-2020-35521,CVE-2020-35522.patch
- security update: Fix DOS via invertImage()
  * CVE-2020-19131[bsc#1190312]
    + tiff-CVE-2020-19131.patch
- security update: Fix heap-based buffer overflow in TIFF2PDF tool
  * CVE-2020-35524[bsc#1182812]
    + tiff-CVE-2020-35524.patch
- security update: Fix integer overflow in tif_getimage
  * CVE-2020-35523 [bsc#1182811]
    + tiff-CVE-2020-35523.patch</changelog>
</package>
<package pkgid="5481f74aca14626fd3e90475f2f3eb6fc33fe047d4e3d9f6c2bf0d1338c5b500" name="libunbound2" arch="aarch64">
  <version epoch="0" ver="1.6.8" rel="10.6.1"/>
  <changelog author="michael@stroeder.com" date="1497441600">- update to 1.6.3
  Bug Fixes
- Fix #1280: Unbound fails assert when response from authoritative
  contains malformed qname. When 0x20 caps-for-id is enabled, when
  assertions are not enabled the malformed qname is handled correctly.</changelog>
  <changelog author="michael@stroeder.com" date="1498564800">- update to 1.6.4
  Features:
- Implemented trust anchor signaling using key tag query.
- unbound-checkconf -o allows query of dnstap config variables.
  Also unbound-control get_option.  Also for dnscrypt.
- unbound.h exports the shm stats structures.  They use
  type long long and no ifdefs, and ub_ before the typenames.
- Implemented opportunistic IPsec support module (ipsecmod).
- Added redirect-bogus.patch to contrib directory.
- Support for the ED25519 algorithm with openssl (from openssl 1.1.1).
- renumbering B-Root's IPv6 address to 2001:500:200::b.
- Fix #1276: [dnscrypt] add XChaCha20-Poly1305 cipher.
- Fix #1277: disable domain ratelimit by setting value to 0.
- Added fastrpz patch to contrib
  Bug Fixes:
- Added ECS unit test (from Manu Bretelle).
- ECS documentation fix (from Manu Bretelle).
- Fix #1252: more indentation inconsistencies.
- Fix #1253: unused variable in edns-subnet/addrtree.c:getbit().
- Fix #1254: clarify ratelimit-{for,below}-domain (from Manu Bretelle).
- iana portlist update
- Based on #1257: check parse limit before t increment in sldns RR
  string parse routine.
- Fix #1258: Windows 10 X64 unbound 1.6.2 service will not start.
  and fix that 64bit getting installed in C:\Program Files (x86).
- Fix #1259: "--disable-ecdsa" argument overwritten
  by "#ifdef SHA256_DIGEST_LENGTH@daemon/remote.c".
- iana portlist update
- Added test for leak of stub information.
- Fix sldns wire2str printout of RR type CAA tags.
- Fix sldns int16_data parse.
- Fix sldns parse and printout of TSIG RRs.
- sldns SMIMEA and AVC definitions, same as getdns definitions.
- Fix tcp-mss failure printout text.
- Set SO_REUSEADDR on outgoing tcp connections to fix the bind before
  connect limited tcp connections.  With the option tcp connections
  can share the same source port (for different destinations).
- Add 'c' to getopt() in testbound.
- Adjust servfail by iterator to not store in cache when serve-expired
  is enabled, to avoid overwriting useful information there.
- Fix queries for nameservers under a stub leaking to the internet.
- document trust-anchor-signaling in example config file.
- updated configure, dependencies and flex output.
- better module memory lookup, fix of unbound-control shm names for
  module memory printout of statistics.
- Fix type AVC sldns rrdef.
- Some whitespace fixup.
- Fix #1265: contrib/unbound.service contains hardcoded path.
- Fix #1265 to use /bin/kill.
- Fix #1267: Libunbound validator/val_secalgo.c uses obsolete APIs,
  and compatibility with BoringSSL.
- Fix #1268: SIGSEGV after log_reopen.
- exec_prefix is by default equal to prefix.
- printout localzone for duplicate local-zone warnings.
- Fix assertion for low buffer size and big edns payload when worker
  overrides udpsize.
- Support for openssl EVP_DigestVerify.
- Fix #1269: inconsistent use of built-in local zones with views.
- Add defaults for new local-zone trees added to views using
  unbound-control.
- Fix #1273: cachedb.c doesn't compile with -Wextra.
- If MSG_FASTOPEN gives EPIPE fallthrough to try normal tcp write.
- Also use global local-zones when there is a matching view that does
  not have any local-zone specified.
- Fix fastopen EPIPE fallthrough to perform connect.
- Fix #1274: automatically trim chroot path from dnscrypt key/cert paths
  (from Manu Bretelle).
- Fix #1275: cached data in cachedb is never used.
- Fix that unbound-control can set val_clean_additional and
  val_permissive_mode.
- Add dnscrypt XChaCha20 tests.
- Detect chacha for dnscrypt at configure time.
- dnscrypt unit tests with chacha.
- Added domain name based ECS whitelist.
- Fix #1278: Incomplete wildcard proof.
- Fix #1279: Memory leak on reload when python module is enabled.
- Fix #1280: Unbound fails assert when response from authoritative
  contains malformed qname.  When 0x20 caps-for-id is enabled, when
  assertions are not enabled the malformed qname is handled correctly.
- More fixes in depth for buffer checks in 0x20 qname checks.
- Fix stub zone queries leaking to the internet for
  harden-referral-path ns checks.
- Fix query for refetch_glue of stub leaking to internet.
- Fix #1301: memory leak in respip and tests.
- Free callback in edns-subnetmod on exit and restart.
- Fix memory leak in sldns_buffer_new_frm_data.
- Fix memory leak in dnscrypt config read.
- Fix dnscrypt chacha cert support ifdefs.
- Fix dnscrypt chacha cert unit test escapes in grep.
- Fix to unlock view in view test.
- Fix warning in pythonmod under clang compiler.
- Fix lintian typo.
- Fix #1316: heap read buffer overflow in parse_edns_options.</changelog>
  <changelog author="jengelh@inai.de" date="1502193600">- RPM group fix. Do not suppress user/group creation problems.
  Replace %__ type macro indirections.</changelog>
  <changelog author="michael@stroeder.com" date="1503316800">- update to 1.6.5
  * Fix install of trust anchor when two anchors are present, makes both
    valid.  Checks hash of DS but not signature of new key.  This fixes
    installs between sep11 and oct11 2017.</changelog>
  <changelog author="michael@stroeder.com" date="1504526400">- update to 1.6.6
  Features:
- unbound-control dump_infra prints port number for address if not 53.
- Fix #1344: RFC6761-reserved domains: test. and invalid.
- Fix #1349: allow suppression of pidfiles (from Daniel Kahn Gillmor).
  With the -p option unbound does not create a pidfile.
- Added stats for queries that have been ratelimited by domain
  recursion.
- Patch to show DNSCrypt status in help output, from Carsten
  Strotmann.
- Fix #1407: Add ECS options check to unbound-checkconf.
- Fix #1415: [dnscrypt] shared secret cache, patch from
  Manu Bretelle.
  Bug Fixes:
- fixup of dnscrypt_cert_chacha test (from Manu Bretelle).
- First fix for zero b64 and hex text zone format in sldns.
- Better fixup of dnscrypt_cert_chacha test for different escapes.
- Fix that infra cache host hash does not change after reconfig.
- Fix python example0 return module wait instead of error for pass.
- enhancement for hardened-tls for DNS over TLS.  Removed duplicated
  security settings.
- Fix for unbound-checkconf, check ipsecmod-hook if ipsecmod is turned
  on.
- Fix #1331: libunbound segfault in threaded mode when context is
  deleted.
- Fix pythonmod link line option flag.
- Fix openssl 1.1.0 load of ssl error strings from ssl init.
- Fix 1332: Bump verbosity of failed chown'ing of the control socket.
- Redirect all localhost names to localhost address for RFC6761.
- Fix #1350: make cachedb backend configurable (from JINMEI Tatuya).
- Fix tests to use .tdir (from Manu Bretelle) instead of .tpkg.
- upgrade aclocal(pkg.m4 0.29.1), config.guess(2016-10-02),
  config.sub(2016-09-05).
- annotate case statement fallthrough for gcc 7.1.1.
- flex output from flex 2.6.1.
- snprintf of thread number does not warn about truncated string.
- squelch TCP fast open error on FreeBSD when kernel has it disabled,
  unless verbosity is high.
- remove warning from windows compile.
- Fix compile with libnettle
- Fix DSA configure switch (--disable dsa) for libnettle and libnss.
- Fix #1365: Add Ed25519 support using libnettle.
- Fix #1394: mix of serve-expired and response-ip could cause a crash.
- Remove unused iter_env member (ip6arpa_dname)
- Do not reset rrset.bogus stats when called using stats_noreset.
- Do not add rrset_bogus and query ratelimiting stats per thread, these
  module stats are global.
- Fix #1397: Recursive DS lookups for AS112 zones names should recurse.
- Fix #1398: make cachedb secret configurable.
- Remove spaces from Makefile.
- Fix issue on macOX 10.10 where TCP fast open is detected but not
  implemented causing TCP to fail. The fix allows fallback to regular
  TCP in this case and is also more robust for cases where connectx()
  fails for some reason.
- Fix #1402: squelch invalid argument error for fd_set_block on windows.
- Fix to reclaim tcp handler when it is closed due to dnscrypt buffer
  allocation failure.
- Fix #1415: patch to free dnscrypt environment on reload.
- iana portlist update
- Small fixes for the shared secret cache patch.
- Fix WKS records on kvm autobuild host, with default protobyname
  entries for udp and tcp.
- Fix #1414: fix segfault on parse failure and log_replies.
- zero qinfo in handle_request, this zeroes local_alias and also the
  qname member.
- new keys and certs for dnscrypt tests.
- fixup WKS test on buildhost without servicebyname.
- updated contrib/fastrpz.patch to apply with configparser changes.
- Fix 1416: qname-minimisation breaks TLSA lookups with CNAMEs.
- Fix #1424: cachedb:testframe is not thread safe.
- Fix #1417: [dnscrypt] shared secret cache counters, and works when
  dnscrypt is not enabled.  And cache size configuration option.
- Fix #1418: [ip ratelimit] initialize slabhash using
  ip-ratelimit-slabs.
- Recommend 1472 buffer size in unbound.conf</changelog>
  <changelog author="michael@stroeder.com" date="1507636800">- update to 1.6.7
  Features:
- Set trust-anchor-signaling default to yes
- Fix #1440: [dnscrypt] client nonce cache.
- Fix #1435: Please allow UDP to be disabled separately upstream and
  downstream.
  Bug fixes:
- Fix that looping modules always stop the query, and don't pass
  control.
- Fix unbound-host to report error for DNSSEC state of failed lookups.
- Spelling fixes, from Josh Soref.
- Fix #1400: allowing use of global cache on ECS-forwarding unless
  always-forward.
- use a cachedb answer even if it's "expired" when serve-expired is yes
  (patch from Jinmei Tatuya).
- trigger refetching of the answer in that case (this will bypass
  cachedb lookup)
- allow storing a 0-TTL answer from cachedb in the in-memory message
  cache when serve-expired is yes
- Fix DNSCACHE_STORE_ZEROTTL to be bigger than 0xffff.
- Log name of looping module
- Fix #1450: Generate again patch contrib/aaaa-filter-iterator.patch
  (by Danilo G. Baio).
- Fix param unused warning for windows exportsymbol compile.
- Use RCODE from A query on DNS64 synthesized answer.
- Fix trust-anchor-signaling works in libunbound.
- Fix spelling in unbound-control man page.</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="cbosdonnat@suse.com" date="1512129600">- Use python3 instead of python2 (fate#323526)</changelog>
  <changelog author="michael@stroeder.com" date="1516363200">- update to 1.6.8 (bsc#1076963)
  patch for CVE-2017-15105: vulnerability in the processing of
  wildcard synthesized NSEC records.</changelog>
  <changelog author="dmueller@suse.com" date="1539691200">- adjust for root KSK rollover (bsc#1112009, bsc#1004165)</changelog>
  <changelog author="kbabioch@suse.com" date="1539691201">- Disabled DLV configuration by default (bsc#1055060)
- Updated the DNSSEC root trust anchor due to KSK roll over (bsc#1112009)</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1542283200">- Migrated from cron to systemd timers (bsc#1115417)</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1546603200">- Use systemd-tmpfiles to create /var/lib/unbound/root.key
  to avoid transactional update breakage (bsc#1111383)</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1551960000">- Remove old pwdutils dependency and add shadow to cover both useradd
  and groupadd as suggested in (bsc#1126757)</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1556020800">- Add systemd require in unbound-anchor to reflect new dependency (due to systemd-timers)</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1592913600">- Avoid amplifying an incoming query to a large number of queries
  Resolves CVE-2020-12662 CVE-2020-12663 (bsc#1171889)
  [ + unbound-1.6.8-amplifying-an-incoming-query.patch ]</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1592913601">- Avoid shell code execution after receiving a specially crafted answer
  Resolves CVE-2019-18934 (bsc#1157268)
  [ + patch_cve_2019-18934.patch ]</changelog>
  <changelog author="werner@suse.de" date="1642420800">- Add patches
  * bsc1185382_CVE-2019-25031_f8875527.patch
    bsc#1185382 for CVE-2019-25031
    configuration injection in create_unbound_ad_servers.sh upon a successful man-in-the-middle attack
  * bsc1185383.4_CVE-2019-25032.3_226298bb.patch
    bsc#1185383 for CVE-2019-25032
    integer overflow in the regional allocator via regional_alloc
    bsc#1185384 for CVE-2019-25033
    integer overflow in the regional allocator via the ALIGN_UP macro
  * bsc1185385_CVE-2019-25034_a3545867.patch
    bsc#1185385 for CVE-2019-25034
    integer overflow in sldns_str2wire_dname_buf_origin, leading to an out-of-bounds write
  * bsc1185386.7_CVE-2019-25035.6_fa23ee8f.patch
    bsc#1185386 for CVE-2019-25035
    out-of-bounds write in sldns_bget_token_par
    bsc#1185387 for CVE-2019-25036
    assertion failure and denial of service in synth_cname
  * bsc1185391.2_CVE-2019-25040.1_2d444a50.patch
    bsc#1185391 for CVE-2019-25040
    infinite loop via a compressed name in dname_pkt_copy
    bsc#1185392 for CVE-2019-25041
    assertion failure via a compressed name in dname_pkt_copy
  * bsc1185389.90_CVE-2019-25038.9_02080f6b.patch
    bsc#1185389 for CVE-2019-25038
    integer overflow in a size calculation in dnscrypt/dnscrypt.c
    bsc#1185390 for CVE-2019-25039
    integer overflow in a size calculation in respip/respip.c
  * bsc1185388_CVE-2019-25037_d2eb78e8.patch
    bsc#1185388 for CVE-2019-25037
    assertion failure and denial of service in dname_pkt_copy via an invalid packet
  * bsc1185393_CVE-2019-25042_6c3a0b54.patch
    bsc#1185393 for CVE-2019-25042
    out-of-bounds write via a compressed name in rdata_copy
- Correct indentation in patch unbound-1.6.8-amplifying-an-incoming-query.patch
  to make it fit to above patches</changelog>
  <changelog author="werner@suse.de" date="1642593600">- Add patch bsc1179191_CVE-2020-28935_19f8f4d9.patch to really fix
  bsc#1179191 CVE-2020-28935: unbound: symbolic link traversal when
  writing PID file</changelog>
  <changelog author="werner@suse.de" date="1642593601">- Import changes from OBS for dlv.isc.org.key, root.anchor, and
  root.key to fix bsc#1112033</changelog>
</package>
<package pkgid="e6f6c9f0bb57ac05fee881fe10debd77eed811a2903b4f0c63c389d04ea95931" name="libunbound2" arch="ppc64le">
  <version epoch="0" ver="1.6.8" rel="10.6.1"/>
  <changelog author="michael@stroeder.com" date="1497441600">- update to 1.6.3
  Bug Fixes
- Fix #1280: Unbound fails assert when response from authoritative
  contains malformed qname. When 0x20 caps-for-id is enabled, when
  assertions are not enabled the malformed qname is handled correctly.</changelog>
  <changelog author="michael@stroeder.com" date="1498564800">- update to 1.6.4
  Features:
- Implemented trust anchor signaling using key tag query.
- unbound-checkconf -o allows query of dnstap config variables.
  Also unbound-control get_option.  Also for dnscrypt.
- unbound.h exports the shm stats structures.  They use
  type long long and no ifdefs, and ub_ before the typenames.
- Implemented opportunistic IPsec support module (ipsecmod).
- Added redirect-bogus.patch to contrib directory.
- Support for the ED25519 algorithm with openssl (from openssl 1.1.1).
- renumbering B-Root's IPv6 address to 2001:500:200::b.
- Fix #1276: [dnscrypt] add XChaCha20-Poly1305 cipher.
- Fix #1277: disable domain ratelimit by setting value to 0.
- Added fastrpz patch to contrib
  Bug Fixes:
- Added ECS unit test (from Manu Bretelle).
- ECS documentation fix (from Manu Bretelle).
- Fix #1252: more indentation inconsistencies.
- Fix #1253: unused variable in edns-subnet/addrtree.c:getbit().
- Fix #1254: clarify ratelimit-{for,below}-domain (from Manu Bretelle).
- iana portlist update
- Based on #1257: check parse limit before t increment in sldns RR
  string parse routine.
- Fix #1258: Windows 10 X64 unbound 1.6.2 service will not start.
  and fix that 64bit getting installed in C:\Program Files (x86).
- Fix #1259: "--disable-ecdsa" argument overwritten
  by "#ifdef SHA256_DIGEST_LENGTH@daemon/remote.c".
- iana portlist update
- Added test for leak of stub information.
- Fix sldns wire2str printout of RR type CAA tags.
- Fix sldns int16_data parse.
- Fix sldns parse and printout of TSIG RRs.
- sldns SMIMEA and AVC definitions, same as getdns definitions.
- Fix tcp-mss failure printout text.
- Set SO_REUSEADDR on outgoing tcp connections to fix the bind before
  connect limited tcp connections.  With the option tcp connections
  can share the same source port (for different destinations).
- Add 'c' to getopt() in testbound.
- Adjust servfail by iterator to not store in cache when serve-expired
  is enabled, to avoid overwriting useful information there.
- Fix queries for nameservers under a stub leaking to the internet.
- document trust-anchor-signaling in example config file.
- updated configure, dependencies and flex output.
- better module memory lookup, fix of unbound-control shm names for
  module memory printout of statistics.
- Fix type AVC sldns rrdef.
- Some whitespace fixup.
- Fix #1265: contrib/unbound.service contains hardcoded path.
- Fix #1265 to use /bin/kill.
- Fix #1267: Libunbound validator/val_secalgo.c uses obsolete APIs,
  and compatibility with BoringSSL.
- Fix #1268: SIGSEGV after log_reopen.
- exec_prefix is by default equal to prefix.
- printout localzone for duplicate local-zone warnings.
- Fix assertion for low buffer size and big edns payload when worker
  overrides udpsize.
- Support for openssl EVP_DigestVerify.
- Fix #1269: inconsistent use of built-in local zones with views.
- Add defaults for new local-zone trees added to views using
  unbound-control.
- Fix #1273: cachedb.c doesn't compile with -Wextra.
- If MSG_FASTOPEN gives EPIPE fallthrough to try normal tcp write.
- Also use global local-zones when there is a matching view that does
  not have any local-zone specified.
- Fix fastopen EPIPE fallthrough to perform connect.
- Fix #1274: automatically trim chroot path from dnscrypt key/cert paths
  (from Manu Bretelle).
- Fix #1275: cached data in cachedb is never used.
- Fix that unbound-control can set val_clean_additional and
  val_permissive_mode.
- Add dnscrypt XChaCha20 tests.
- Detect chacha for dnscrypt at configure time.
- dnscrypt unit tests with chacha.
- Added domain name based ECS whitelist.
- Fix #1278: Incomplete wildcard proof.
- Fix #1279: Memory leak on reload when python module is enabled.
- Fix #1280: Unbound fails assert when response from authoritative
  contains malformed qname.  When 0x20 caps-for-id is enabled, when
  assertions are not enabled the malformed qname is handled correctly.
- More fixes in depth for buffer checks in 0x20 qname checks.
- Fix stub zone queries leaking to the internet for
  harden-referral-path ns checks.
- Fix query for refetch_glue of stub leaking to internet.
- Fix #1301: memory leak in respip and tests.
- Free callback in edns-subnetmod on exit and restart.
- Fix memory leak in sldns_buffer_new_frm_data.
- Fix memory leak in dnscrypt config read.
- Fix dnscrypt chacha cert support ifdefs.
- Fix dnscrypt chacha cert unit test escapes in grep.
- Fix to unlock view in view test.
- Fix warning in pythonmod under clang compiler.
- Fix lintian typo.
- Fix #1316: heap read buffer overflow in parse_edns_options.</changelog>
  <changelog author="jengelh@inai.de" date="1502193600">- RPM group fix. Do not suppress user/group creation problems.
  Replace %__ type macro indirections.</changelog>
  <changelog author="michael@stroeder.com" date="1503316800">- update to 1.6.5
  * Fix install of trust anchor when two anchors are present, makes both
    valid.  Checks hash of DS but not signature of new key.  This fixes
    installs between sep11 and oct11 2017.</changelog>
  <changelog author="michael@stroeder.com" date="1504526400">- update to 1.6.6
  Features:
- unbound-control dump_infra prints port number for address if not 53.
- Fix #1344: RFC6761-reserved domains: test. and invalid.
- Fix #1349: allow suppression of pidfiles (from Daniel Kahn Gillmor).
  With the -p option unbound does not create a pidfile.
- Added stats for queries that have been ratelimited by domain
  recursion.
- Patch to show DNSCrypt status in help output, from Carsten
  Strotmann.
- Fix #1407: Add ECS options check to unbound-checkconf.
- Fix #1415: [dnscrypt] shared secret cache, patch from
  Manu Bretelle.
  Bug Fixes:
- fixup of dnscrypt_cert_chacha test (from Manu Bretelle).
- First fix for zero b64 and hex text zone format in sldns.
- Better fixup of dnscrypt_cert_chacha test for different escapes.
- Fix that infra cache host hash does not change after reconfig.
- Fix python example0 return module wait instead of error for pass.
- enhancement for hardened-tls for DNS over TLS.  Removed duplicated
  security settings.
- Fix for unbound-checkconf, check ipsecmod-hook if ipsecmod is turned
  on.
- Fix #1331: libunbound segfault in threaded mode when context is
  deleted.
- Fix pythonmod link line option flag.
- Fix openssl 1.1.0 load of ssl error strings from ssl init.
- Fix 1332: Bump verbosity of failed chown'ing of the control socket.
- Redirect all localhost names to localhost address for RFC6761.
- Fix #1350: make cachedb backend configurable (from JINMEI Tatuya).
- Fix tests to use .tdir (from Manu Bretelle) instead of .tpkg.
- upgrade aclocal(pkg.m4 0.29.1), config.guess(2016-10-02),
  config.sub(2016-09-05).
- annotate case statement fallthrough for gcc 7.1.1.
- flex output from flex 2.6.1.
- snprintf of thread number does not warn about truncated string.
- squelch TCP fast open error on FreeBSD when kernel has it disabled,
  unless verbosity is high.
- remove warning from windows compile.
- Fix compile with libnettle
- Fix DSA configure switch (--disable dsa) for libnettle and libnss.
- Fix #1365: Add Ed25519 support using libnettle.
- Fix #1394: mix of serve-expired and response-ip could cause a crash.
- Remove unused iter_env member (ip6arpa_dname)
- Do not reset rrset.bogus stats when called using stats_noreset.
- Do not add rrset_bogus and query ratelimiting stats per thread, these
  module stats are global.
- Fix #1397: Recursive DS lookups for AS112 zones names should recurse.
- Fix #1398: make cachedb secret configurable.
- Remove spaces from Makefile.
- Fix issue on macOX 10.10 where TCP fast open is detected but not
  implemented causing TCP to fail. The fix allows fallback to regular
  TCP in this case and is also more robust for cases where connectx()
  fails for some reason.
- Fix #1402: squelch invalid argument error for fd_set_block on windows.
- Fix to reclaim tcp handler when it is closed due to dnscrypt buffer
  allocation failure.
- Fix #1415: patch to free dnscrypt environment on reload.
- iana portlist update
- Small fixes for the shared secret cache patch.
- Fix WKS records on kvm autobuild host, with default protobyname
  entries for udp and tcp.
- Fix #1414: fix segfault on parse failure and log_replies.
- zero qinfo in handle_request, this zeroes local_alias and also the
  qname member.
- new keys and certs for dnscrypt tests.
- fixup WKS test on buildhost without servicebyname.
- updated contrib/fastrpz.patch to apply with configparser changes.
- Fix 1416: qname-minimisation breaks TLSA lookups with CNAMEs.
- Fix #1424: cachedb:testframe is not thread safe.
- Fix #1417: [dnscrypt] shared secret cache counters, and works when
  dnscrypt is not enabled.  And cache size configuration option.
- Fix #1418: [ip ratelimit] initialize slabhash using
  ip-ratelimit-slabs.
- Recommend 1472 buffer size in unbound.conf</changelog>
  <changelog author="michael@stroeder.com" date="1507636800">- update to 1.6.7
  Features:
- Set trust-anchor-signaling default to yes
- Fix #1440: [dnscrypt] client nonce cache.
- Fix #1435: Please allow UDP to be disabled separately upstream and
  downstream.
  Bug fixes:
- Fix that looping modules always stop the query, and don't pass
  control.
- Fix unbound-host to report error for DNSSEC state of failed lookups.
- Spelling fixes, from Josh Soref.
- Fix #1400: allowing use of global cache on ECS-forwarding unless
  always-forward.
- use a cachedb answer even if it's "expired" when serve-expired is yes
  (patch from Jinmei Tatuya).
- trigger refetching of the answer in that case (this will bypass
  cachedb lookup)
- allow storing a 0-TTL answer from cachedb in the in-memory message
  cache when serve-expired is yes
- Fix DNSCACHE_STORE_ZEROTTL to be bigger than 0xffff.
- Log name of looping module
- Fix #1450: Generate again patch contrib/aaaa-filter-iterator.patch
  (by Danilo G. Baio).
- Fix param unused warning for windows exportsymbol compile.
- Use RCODE from A query on DNS64 synthesized answer.
- Fix trust-anchor-signaling works in libunbound.
- Fix spelling in unbound-control man page.</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="cbosdonnat@suse.com" date="1512129600">- Use python3 instead of python2 (fate#323526)</changelog>
  <changelog author="michael@stroeder.com" date="1516363200">- update to 1.6.8 (bsc#1076963)
  patch for CVE-2017-15105: vulnerability in the processing of
  wildcard synthesized NSEC records.</changelog>
  <changelog author="dmueller@suse.com" date="1539691200">- adjust for root KSK rollover (bsc#1112009, bsc#1004165)</changelog>
  <changelog author="kbabioch@suse.com" date="1539691201">- Disabled DLV configuration by default (bsc#1055060)
- Updated the DNSSEC root trust anchor due to KSK roll over (bsc#1112009)</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1542283200">- Migrated from cron to systemd timers (bsc#1115417)</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1546603200">- Use systemd-tmpfiles to create /var/lib/unbound/root.key
  to avoid transactional update breakage (bsc#1111383)</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1551960000">- Remove old pwdutils dependency and add shadow to cover both useradd
  and groupadd as suggested in (bsc#1126757)</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1556020800">- Add systemd require in unbound-anchor to reflect new dependency (due to systemd-timers)</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1592913600">- Avoid amplifying an incoming query to a large number of queries
  Resolves CVE-2020-12662 CVE-2020-12663 (bsc#1171889)
  [ + unbound-1.6.8-amplifying-an-incoming-query.patch ]</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1592913601">- Avoid shell code execution after receiving a specially crafted answer
  Resolves CVE-2019-18934 (bsc#1157268)
  [ + patch_cve_2019-18934.patch ]</changelog>
  <changelog author="werner@suse.de" date="1642420800">- Add patches
  * bsc1185382_CVE-2019-25031_f8875527.patch
    bsc#1185382 for CVE-2019-25031
    configuration injection in create_unbound_ad_servers.sh upon a successful man-in-the-middle attack
  * bsc1185383.4_CVE-2019-25032.3_226298bb.patch
    bsc#1185383 for CVE-2019-25032
    integer overflow in the regional allocator via regional_alloc
    bsc#1185384 for CVE-2019-25033
    integer overflow in the regional allocator via the ALIGN_UP macro
  * bsc1185385_CVE-2019-25034_a3545867.patch
    bsc#1185385 for CVE-2019-25034
    integer overflow in sldns_str2wire_dname_buf_origin, leading to an out-of-bounds write
  * bsc1185386.7_CVE-2019-25035.6_fa23ee8f.patch
    bsc#1185386 for CVE-2019-25035
    out-of-bounds write in sldns_bget_token_par
    bsc#1185387 for CVE-2019-25036
    assertion failure and denial of service in synth_cname
  * bsc1185391.2_CVE-2019-25040.1_2d444a50.patch
    bsc#1185391 for CVE-2019-25040
    infinite loop via a compressed name in dname_pkt_copy
    bsc#1185392 for CVE-2019-25041
    assertion failure via a compressed name in dname_pkt_copy
  * bsc1185389.90_CVE-2019-25038.9_02080f6b.patch
    bsc#1185389 for CVE-2019-25038
    integer overflow in a size calculation in dnscrypt/dnscrypt.c
    bsc#1185390 for CVE-2019-25039
    integer overflow in a size calculation in respip/respip.c
  * bsc1185388_CVE-2019-25037_d2eb78e8.patch
    bsc#1185388 for CVE-2019-25037
    assertion failure and denial of service in dname_pkt_copy via an invalid packet
  * bsc1185393_CVE-2019-25042_6c3a0b54.patch
    bsc#1185393 for CVE-2019-25042
    out-of-bounds write via a compressed name in rdata_copy
- Correct indentation in patch unbound-1.6.8-amplifying-an-incoming-query.patch
  to make it fit to above patches</changelog>
  <changelog author="werner@suse.de" date="1642593600">- Add patch bsc1179191_CVE-2020-28935_19f8f4d9.patch to really fix
  bsc#1179191 CVE-2020-28935: unbound: symbolic link traversal when
  writing PID file</changelog>
  <changelog author="werner@suse.de" date="1642593601">- Import changes from OBS for dlv.isc.org.key, root.anchor, and
  root.key to fix bsc#1112033</changelog>
</package>
<package pkgid="1d924a14344a771654e9e157c5de4a82378c54deda67ff86cd1600581a846011" name="libunbound2" arch="s390x">
  <version epoch="0" ver="1.6.8" rel="10.6.1"/>
  <changelog author="michael@stroeder.com" date="1497441600">- update to 1.6.3
  Bug Fixes
- Fix #1280: Unbound fails assert when response from authoritative
  contains malformed qname. When 0x20 caps-for-id is enabled, when
  assertions are not enabled the malformed qname is handled correctly.</changelog>
  <changelog author="michael@stroeder.com" date="1498564800">- update to 1.6.4
  Features:
- Implemented trust anchor signaling using key tag query.
- unbound-checkconf -o allows query of dnstap config variables.
  Also unbound-control get_option.  Also for dnscrypt.
- unbound.h exports the shm stats structures.  They use
  type long long and no ifdefs, and ub_ before the typenames.
- Implemented opportunistic IPsec support module (ipsecmod).
- Added redirect-bogus.patch to contrib directory.
- Support for the ED25519 algorithm with openssl (from openssl 1.1.1).
- renumbering B-Root's IPv6 address to 2001:500:200::b.
- Fix #1276: [dnscrypt] add XChaCha20-Poly1305 cipher.
- Fix #1277: disable domain ratelimit by setting value to 0.
- Added fastrpz patch to contrib
  Bug Fixes:
- Added ECS unit test (from Manu Bretelle).
- ECS documentation fix (from Manu Bretelle).
- Fix #1252: more indentation inconsistencies.
- Fix #1253: unused variable in edns-subnet/addrtree.c:getbit().
- Fix #1254: clarify ratelimit-{for,below}-domain (from Manu Bretelle).
- iana portlist update
- Based on #1257: check parse limit before t increment in sldns RR
  string parse routine.
- Fix #1258: Windows 10 X64 unbound 1.6.2 service will not start.
  and fix that 64bit getting installed in C:\Program Files (x86).
- Fix #1259: "--disable-ecdsa" argument overwritten
  by "#ifdef SHA256_DIGEST_LENGTH@daemon/remote.c".
- iana portlist update
- Added test for leak of stub information.
- Fix sldns wire2str printout of RR type CAA tags.
- Fix sldns int16_data parse.
- Fix sldns parse and printout of TSIG RRs.
- sldns SMIMEA and AVC definitions, same as getdns definitions.
- Fix tcp-mss failure printout text.
- Set SO_REUSEADDR on outgoing tcp connections to fix the bind before
  connect limited tcp connections.  With the option tcp connections
  can share the same source port (for different destinations).
- Add 'c' to getopt() in testbound.
- Adjust servfail by iterator to not store in cache when serve-expired
  is enabled, to avoid overwriting useful information there.
- Fix queries for nameservers under a stub leaking to the internet.
- document trust-anchor-signaling in example config file.
- updated configure, dependencies and flex output.
- better module memory lookup, fix of unbound-control shm names for
  module memory printout of statistics.
- Fix type AVC sldns rrdef.
- Some whitespace fixup.
- Fix #1265: contrib/unbound.service contains hardcoded path.
- Fix #1265 to use /bin/kill.
- Fix #1267: Libunbound validator/val_secalgo.c uses obsolete APIs,
  and compatibility with BoringSSL.
- Fix #1268: SIGSEGV after log_reopen.
- exec_prefix is by default equal to prefix.
- printout localzone for duplicate local-zone warnings.
- Fix assertion for low buffer size and big edns payload when worker
  overrides udpsize.
- Support for openssl EVP_DigestVerify.
- Fix #1269: inconsistent use of built-in local zones with views.
- Add defaults for new local-zone trees added to views using
  unbound-control.
- Fix #1273: cachedb.c doesn't compile with -Wextra.
- If MSG_FASTOPEN gives EPIPE fallthrough to try normal tcp write.
- Also use global local-zones when there is a matching view that does
  not have any local-zone specified.
- Fix fastopen EPIPE fallthrough to perform connect.
- Fix #1274: automatically trim chroot path from dnscrypt key/cert paths
  (from Manu Bretelle).
- Fix #1275: cached data in cachedb is never used.
- Fix that unbound-control can set val_clean_additional and
  val_permissive_mode.
- Add dnscrypt XChaCha20 tests.
- Detect chacha for dnscrypt at configure time.
- dnscrypt unit tests with chacha.
- Added domain name based ECS whitelist.
- Fix #1278: Incomplete wildcard proof.
- Fix #1279: Memory leak on reload when python module is enabled.
- Fix #1280: Unbound fails assert when response from authoritative
  contains malformed qname.  When 0x20 caps-for-id is enabled, when
  assertions are not enabled the malformed qname is handled correctly.
- More fixes in depth for buffer checks in 0x20 qname checks.
- Fix stub zone queries leaking to the internet for
  harden-referral-path ns checks.
- Fix query for refetch_glue of stub leaking to internet.
- Fix #1301: memory leak in respip and tests.
- Free callback in edns-subnetmod on exit and restart.
- Fix memory leak in sldns_buffer_new_frm_data.
- Fix memory leak in dnscrypt config read.
- Fix dnscrypt chacha cert support ifdefs.
- Fix dnscrypt chacha cert unit test escapes in grep.
- Fix to unlock view in view test.
- Fix warning in pythonmod under clang compiler.
- Fix lintian typo.
- Fix #1316: heap read buffer overflow in parse_edns_options.</changelog>
  <changelog author="jengelh@inai.de" date="1502193600">- RPM group fix. Do not suppress user/group creation problems.
  Replace %__ type macro indirections.</changelog>
  <changelog author="michael@stroeder.com" date="1503316800">- update to 1.6.5
  * Fix install of trust anchor when two anchors are present, makes both
    valid.  Checks hash of DS but not signature of new key.  This fixes
    installs between sep11 and oct11 2017.</changelog>
  <changelog author="michael@stroeder.com" date="1504526400">- update to 1.6.6
  Features:
- unbound-control dump_infra prints port number for address if not 53.
- Fix #1344: RFC6761-reserved domains: test. and invalid.
- Fix #1349: allow suppression of pidfiles (from Daniel Kahn Gillmor).
  With the -p option unbound does not create a pidfile.
- Added stats for queries that have been ratelimited by domain
  recursion.
- Patch to show DNSCrypt status in help output, from Carsten
  Strotmann.
- Fix #1407: Add ECS options check to unbound-checkconf.
- Fix #1415: [dnscrypt] shared secret cache, patch from
  Manu Bretelle.
  Bug Fixes:
- fixup of dnscrypt_cert_chacha test (from Manu Bretelle).
- First fix for zero b64 and hex text zone format in sldns.
- Better fixup of dnscrypt_cert_chacha test for different escapes.
- Fix that infra cache host hash does not change after reconfig.
- Fix python example0 return module wait instead of error for pass.
- enhancement for hardened-tls for DNS over TLS.  Removed duplicated
  security settings.
- Fix for unbound-checkconf, check ipsecmod-hook if ipsecmod is turned
  on.
- Fix #1331: libunbound segfault in threaded mode when context is
  deleted.
- Fix pythonmod link line option flag.
- Fix openssl 1.1.0 load of ssl error strings from ssl init.
- Fix 1332: Bump verbosity of failed chown'ing of the control socket.
- Redirect all localhost names to localhost address for RFC6761.
- Fix #1350: make cachedb backend configurable (from JINMEI Tatuya).
- Fix tests to use .tdir (from Manu Bretelle) instead of .tpkg.
- upgrade aclocal(pkg.m4 0.29.1), config.guess(2016-10-02),
  config.sub(2016-09-05).
- annotate case statement fallthrough for gcc 7.1.1.
- flex output from flex 2.6.1.
- snprintf of thread number does not warn about truncated string.
- squelch TCP fast open error on FreeBSD when kernel has it disabled,
  unless verbosity is high.
- remove warning from windows compile.
- Fix compile with libnettle
- Fix DSA configure switch (--disable dsa) for libnettle and libnss.
- Fix #1365: Add Ed25519 support using libnettle.
- Fix #1394: mix of serve-expired and response-ip could cause a crash.
- Remove unused iter_env member (ip6arpa_dname)
- Do not reset rrset.bogus stats when called using stats_noreset.
- Do not add rrset_bogus and query ratelimiting stats per thread, these
  module stats are global.
- Fix #1397: Recursive DS lookups for AS112 zones names should recurse.
- Fix #1398: make cachedb secret configurable.
- Remove spaces from Makefile.
- Fix issue on macOX 10.10 where TCP fast open is detected but not
  implemented causing TCP to fail. The fix allows fallback to regular
  TCP in this case and is also more robust for cases where connectx()
  fails for some reason.
- Fix #1402: squelch invalid argument error for fd_set_block on windows.
- Fix to reclaim tcp handler when it is closed due to dnscrypt buffer
  allocation failure.
- Fix #1415: patch to free dnscrypt environment on reload.
- iana portlist update
- Small fixes for the shared secret cache patch.
- Fix WKS records on kvm autobuild host, with default protobyname
  entries for udp and tcp.
- Fix #1414: fix segfault on parse failure and log_replies.
- zero qinfo in handle_request, this zeroes local_alias and also the
  qname member.
- new keys and certs for dnscrypt tests.
- fixup WKS test on buildhost without servicebyname.
- updated contrib/fastrpz.patch to apply with configparser changes.
- Fix 1416: qname-minimisation breaks TLSA lookups with CNAMEs.
- Fix #1424: cachedb:testframe is not thread safe.
- Fix #1417: [dnscrypt] shared secret cache counters, and works when
  dnscrypt is not enabled.  And cache size configuration option.
- Fix #1418: [ip ratelimit] initialize slabhash using
  ip-ratelimit-slabs.
- Recommend 1472 buffer size in unbound.conf</changelog>
  <changelog author="michael@stroeder.com" date="1507636800">- update to 1.6.7
  Features:
- Set trust-anchor-signaling default to yes
- Fix #1440: [dnscrypt] client nonce cache.
- Fix #1435: Please allow UDP to be disabled separately upstream and
  downstream.
  Bug fixes:
- Fix that looping modules always stop the query, and don't pass
  control.
- Fix unbound-host to report error for DNSSEC state of failed lookups.
- Spelling fixes, from Josh Soref.
- Fix #1400: allowing use of global cache on ECS-forwarding unless
  always-forward.
- use a cachedb answer even if it's "expired" when serve-expired is yes
  (patch from Jinmei Tatuya).
- trigger refetching of the answer in that case (this will bypass
  cachedb lookup)
- allow storing a 0-TTL answer from cachedb in the in-memory message
  cache when serve-expired is yes
- Fix DNSCACHE_STORE_ZEROTTL to be bigger than 0xffff.
- Log name of looping module
- Fix #1450: Generate again patch contrib/aaaa-filter-iterator.patch
  (by Danilo G. Baio).
- Fix param unused warning for windows exportsymbol compile.
- Use RCODE from A query on DNS64 synthesized answer.
- Fix trust-anchor-signaling works in libunbound.
- Fix spelling in unbound-control man page.</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="cbosdonnat@suse.com" date="1512129600">- Use python3 instead of python2 (fate#323526)</changelog>
  <changelog author="michael@stroeder.com" date="1516363200">- update to 1.6.8 (bsc#1076963)
  patch for CVE-2017-15105: vulnerability in the processing of
  wildcard synthesized NSEC records.</changelog>
  <changelog author="dmueller@suse.com" date="1539691200">- adjust for root KSK rollover (bsc#1112009, bsc#1004165)</changelog>
  <changelog author="kbabioch@suse.com" date="1539691201">- Disabled DLV configuration by default (bsc#1055060)
- Updated the DNSSEC root trust anchor due to KSK roll over (bsc#1112009)</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1542283200">- Migrated from cron to systemd timers (bsc#1115417)</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1546603200">- Use systemd-tmpfiles to create /var/lib/unbound/root.key
  to avoid transactional update breakage (bsc#1111383)</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1551960000">- Remove old pwdutils dependency and add shadow to cover both useradd
  and groupadd as suggested in (bsc#1126757)</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1556020800">- Add systemd require in unbound-anchor to reflect new dependency (due to systemd-timers)</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1592913600">- Avoid amplifying an incoming query to a large number of queries
  Resolves CVE-2020-12662 CVE-2020-12663 (bsc#1171889)
  [ + unbound-1.6.8-amplifying-an-incoming-query.patch ]</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1592913601">- Avoid shell code execution after receiving a specially crafted answer
  Resolves CVE-2019-18934 (bsc#1157268)
  [ + patch_cve_2019-18934.patch ]</changelog>
  <changelog author="werner@suse.de" date="1642420800">- Add patches
  * bsc1185382_CVE-2019-25031_f8875527.patch
    bsc#1185382 for CVE-2019-25031
    configuration injection in create_unbound_ad_servers.sh upon a successful man-in-the-middle attack
  * bsc1185383.4_CVE-2019-25032.3_226298bb.patch
    bsc#1185383 for CVE-2019-25032
    integer overflow in the regional allocator via regional_alloc
    bsc#1185384 for CVE-2019-25033
    integer overflow in the regional allocator via the ALIGN_UP macro
  * bsc1185385_CVE-2019-25034_a3545867.patch
    bsc#1185385 for CVE-2019-25034
    integer overflow in sldns_str2wire_dname_buf_origin, leading to an out-of-bounds write
  * bsc1185386.7_CVE-2019-25035.6_fa23ee8f.patch
    bsc#1185386 for CVE-2019-25035
    out-of-bounds write in sldns_bget_token_par
    bsc#1185387 for CVE-2019-25036
    assertion failure and denial of service in synth_cname
  * bsc1185391.2_CVE-2019-25040.1_2d444a50.patch
    bsc#1185391 for CVE-2019-25040
    infinite loop via a compressed name in dname_pkt_copy
    bsc#1185392 for CVE-2019-25041
    assertion failure via a compressed name in dname_pkt_copy
  * bsc1185389.90_CVE-2019-25038.9_02080f6b.patch
    bsc#1185389 for CVE-2019-25038
    integer overflow in a size calculation in dnscrypt/dnscrypt.c
    bsc#1185390 for CVE-2019-25039
    integer overflow in a size calculation in respip/respip.c
  * bsc1185388_CVE-2019-25037_d2eb78e8.patch
    bsc#1185388 for CVE-2019-25037
    assertion failure and denial of service in dname_pkt_copy via an invalid packet
  * bsc1185393_CVE-2019-25042_6c3a0b54.patch
    bsc#1185393 for CVE-2019-25042
    out-of-bounds write via a compressed name in rdata_copy
- Correct indentation in patch unbound-1.6.8-amplifying-an-incoming-query.patch
  to make it fit to above patches</changelog>
  <changelog author="werner@suse.de" date="1642593600">- Add patch bsc1179191_CVE-2020-28935_19f8f4d9.patch to really fix
  bsc#1179191 CVE-2020-28935: unbound: symbolic link traversal when
  writing PID file</changelog>
  <changelog author="werner@suse.de" date="1642593601">- Import changes from OBS for dlv.isc.org.key, root.anchor, and
  root.key to fix bsc#1112033</changelog>
</package>
<package pkgid="b1206d75f8afdb2520d60085c3b670800d4c3e21035940bb9d5a8ceaab49e9a6" name="libunbound2" arch="x86_64">
  <version epoch="0" ver="1.6.8" rel="10.6.1"/>
  <changelog author="michael@stroeder.com" date="1497441600">- update to 1.6.3
  Bug Fixes
- Fix #1280: Unbound fails assert when response from authoritative
  contains malformed qname. When 0x20 caps-for-id is enabled, when
  assertions are not enabled the malformed qname is handled correctly.</changelog>
  <changelog author="michael@stroeder.com" date="1498564800">- update to 1.6.4
  Features:
- Implemented trust anchor signaling using key tag query.
- unbound-checkconf -o allows query of dnstap config variables.
  Also unbound-control get_option.  Also for dnscrypt.
- unbound.h exports the shm stats structures.  They use
  type long long and no ifdefs, and ub_ before the typenames.
- Implemented opportunistic IPsec support module (ipsecmod).
- Added redirect-bogus.patch to contrib directory.
- Support for the ED25519 algorithm with openssl (from openssl 1.1.1).
- renumbering B-Root's IPv6 address to 2001:500:200::b.
- Fix #1276: [dnscrypt] add XChaCha20-Poly1305 cipher.
- Fix #1277: disable domain ratelimit by setting value to 0.
- Added fastrpz patch to contrib
  Bug Fixes:
- Added ECS unit test (from Manu Bretelle).
- ECS documentation fix (from Manu Bretelle).
- Fix #1252: more indentation inconsistencies.
- Fix #1253: unused variable in edns-subnet/addrtree.c:getbit().
- Fix #1254: clarify ratelimit-{for,below}-domain (from Manu Bretelle).
- iana portlist update
- Based on #1257: check parse limit before t increment in sldns RR
  string parse routine.
- Fix #1258: Windows 10 X64 unbound 1.6.2 service will not start.
  and fix that 64bit getting installed in C:\Program Files (x86).
- Fix #1259: "--disable-ecdsa" argument overwritten
  by "#ifdef SHA256_DIGEST_LENGTH@daemon/remote.c".
- iana portlist update
- Added test for leak of stub information.
- Fix sldns wire2str printout of RR type CAA tags.
- Fix sldns int16_data parse.
- Fix sldns parse and printout of TSIG RRs.
- sldns SMIMEA and AVC definitions, same as getdns definitions.
- Fix tcp-mss failure printout text.
- Set SO_REUSEADDR on outgoing tcp connections to fix the bind before
  connect limited tcp connections.  With the option tcp connections
  can share the same source port (for different destinations).
- Add 'c' to getopt() in testbound.
- Adjust servfail by iterator to not store in cache when serve-expired
  is enabled, to avoid overwriting useful information there.
- Fix queries for nameservers under a stub leaking to the internet.
- document trust-anchor-signaling in example config file.
- updated configure, dependencies and flex output.
- better module memory lookup, fix of unbound-control shm names for
  module memory printout of statistics.
- Fix type AVC sldns rrdef.
- Some whitespace fixup.
- Fix #1265: contrib/unbound.service contains hardcoded path.
- Fix #1265 to use /bin/kill.
- Fix #1267: Libunbound validator/val_secalgo.c uses obsolete APIs,
  and compatibility with BoringSSL.
- Fix #1268: SIGSEGV after log_reopen.
- exec_prefix is by default equal to prefix.
- printout localzone for duplicate local-zone warnings.
- Fix assertion for low buffer size and big edns payload when worker
  overrides udpsize.
- Support for openssl EVP_DigestVerify.
- Fix #1269: inconsistent use of built-in local zones with views.
- Add defaults for new local-zone trees added to views using
  unbound-control.
- Fix #1273: cachedb.c doesn't compile with -Wextra.
- If MSG_FASTOPEN gives EPIPE fallthrough to try normal tcp write.
- Also use global local-zones when there is a matching view that does
  not have any local-zone specified.
- Fix fastopen EPIPE fallthrough to perform connect.
- Fix #1274: automatically trim chroot path from dnscrypt key/cert paths
  (from Manu Bretelle).
- Fix #1275: cached data in cachedb is never used.
- Fix that unbound-control can set val_clean_additional and
  val_permissive_mode.
- Add dnscrypt XChaCha20 tests.
- Detect chacha for dnscrypt at configure time.
- dnscrypt unit tests with chacha.
- Added domain name based ECS whitelist.
- Fix #1278: Incomplete wildcard proof.
- Fix #1279: Memory leak on reload when python module is enabled.
- Fix #1280: Unbound fails assert when response from authoritative
  contains malformed qname.  When 0x20 caps-for-id is enabled, when
  assertions are not enabled the malformed qname is handled correctly.
- More fixes in depth for buffer checks in 0x20 qname checks.
- Fix stub zone queries leaking to the internet for
  harden-referral-path ns checks.
- Fix query for refetch_glue of stub leaking to internet.
- Fix #1301: memory leak in respip and tests.
- Free callback in edns-subnetmod on exit and restart.
- Fix memory leak in sldns_buffer_new_frm_data.
- Fix memory leak in dnscrypt config read.
- Fix dnscrypt chacha cert support ifdefs.
- Fix dnscrypt chacha cert unit test escapes in grep.
- Fix to unlock view in view test.
- Fix warning in pythonmod under clang compiler.
- Fix lintian typo.
- Fix #1316: heap read buffer overflow in parse_edns_options.</changelog>
  <changelog author="jengelh@inai.de" date="1502193600">- RPM group fix. Do not suppress user/group creation problems.
  Replace %__ type macro indirections.</changelog>
  <changelog author="michael@stroeder.com" date="1503316800">- update to 1.6.5
  * Fix install of trust anchor when two anchors are present, makes both
    valid.  Checks hash of DS but not signature of new key.  This fixes
    installs between sep11 and oct11 2017.</changelog>
  <changelog author="michael@stroeder.com" date="1504526400">- update to 1.6.6
  Features:
- unbound-control dump_infra prints port number for address if not 53.
- Fix #1344: RFC6761-reserved domains: test. and invalid.
- Fix #1349: allow suppression of pidfiles (from Daniel Kahn Gillmor).
  With the -p option unbound does not create a pidfile.
- Added stats for queries that have been ratelimited by domain
  recursion.
- Patch to show DNSCrypt status in help output, from Carsten
  Strotmann.
- Fix #1407: Add ECS options check to unbound-checkconf.
- Fix #1415: [dnscrypt] shared secret cache, patch from
  Manu Bretelle.
  Bug Fixes:
- fixup of dnscrypt_cert_chacha test (from Manu Bretelle).
- First fix for zero b64 and hex text zone format in sldns.
- Better fixup of dnscrypt_cert_chacha test for different escapes.
- Fix that infra cache host hash does not change after reconfig.
- Fix python example0 return module wait instead of error for pass.
- enhancement for hardened-tls for DNS over TLS.  Removed duplicated
  security settings.
- Fix for unbound-checkconf, check ipsecmod-hook if ipsecmod is turned
  on.
- Fix #1331: libunbound segfault in threaded mode when context is
  deleted.
- Fix pythonmod link line option flag.
- Fix openssl 1.1.0 load of ssl error strings from ssl init.
- Fix 1332: Bump verbosity of failed chown'ing of the control socket.
- Redirect all localhost names to localhost address for RFC6761.
- Fix #1350: make cachedb backend configurable (from JINMEI Tatuya).
- Fix tests to use .tdir (from Manu Bretelle) instead of .tpkg.
- upgrade aclocal(pkg.m4 0.29.1), config.guess(2016-10-02),
  config.sub(2016-09-05).
- annotate case statement fallthrough for gcc 7.1.1.
- flex output from flex 2.6.1.
- snprintf of thread number does not warn about truncated string.
- squelch TCP fast open error on FreeBSD when kernel has it disabled,
  unless verbosity is high.
- remove warning from windows compile.
- Fix compile with libnettle
- Fix DSA configure switch (--disable dsa) for libnettle and libnss.
- Fix #1365: Add Ed25519 support using libnettle.
- Fix #1394: mix of serve-expired and response-ip could cause a crash.
- Remove unused iter_env member (ip6arpa_dname)
- Do not reset rrset.bogus stats when called using stats_noreset.
- Do not add rrset_bogus and query ratelimiting stats per thread, these
  module stats are global.
- Fix #1397: Recursive DS lookups for AS112 zones names should recurse.
- Fix #1398: make cachedb secret configurable.
- Remove spaces from Makefile.
- Fix issue on macOX 10.10 where TCP fast open is detected but not
  implemented causing TCP to fail. The fix allows fallback to regular
  TCP in this case and is also more robust for cases where connectx()
  fails for some reason.
- Fix #1402: squelch invalid argument error for fd_set_block on windows.
- Fix to reclaim tcp handler when it is closed due to dnscrypt buffer
  allocation failure.
- Fix #1415: patch to free dnscrypt environment on reload.
- iana portlist update
- Small fixes for the shared secret cache patch.
- Fix WKS records on kvm autobuild host, with default protobyname
  entries for udp and tcp.
- Fix #1414: fix segfault on parse failure and log_replies.
- zero qinfo in handle_request, this zeroes local_alias and also the
  qname member.
- new keys and certs for dnscrypt tests.
- fixup WKS test on buildhost without servicebyname.
- updated contrib/fastrpz.patch to apply with configparser changes.
- Fix 1416: qname-minimisation breaks TLSA lookups with CNAMEs.
- Fix #1424: cachedb:testframe is not thread safe.
- Fix #1417: [dnscrypt] shared secret cache counters, and works when
  dnscrypt is not enabled.  And cache size configuration option.
- Fix #1418: [ip ratelimit] initialize slabhash using
  ip-ratelimit-slabs.
- Recommend 1472 buffer size in unbound.conf</changelog>
  <changelog author="michael@stroeder.com" date="1507636800">- update to 1.6.7
  Features:
- Set trust-anchor-signaling default to yes
- Fix #1440: [dnscrypt] client nonce cache.
- Fix #1435: Please allow UDP to be disabled separately upstream and
  downstream.
  Bug fixes:
- Fix that looping modules always stop the query, and don't pass
  control.
- Fix unbound-host to report error for DNSSEC state of failed lookups.
- Spelling fixes, from Josh Soref.
- Fix #1400: allowing use of global cache on ECS-forwarding unless
  always-forward.
- use a cachedb answer even if it's "expired" when serve-expired is yes
  (patch from Jinmei Tatuya).
- trigger refetching of the answer in that case (this will bypass
  cachedb lookup)
- allow storing a 0-TTL answer from cachedb in the in-memory message
  cache when serve-expired is yes
- Fix DNSCACHE_STORE_ZEROTTL to be bigger than 0xffff.
- Log name of looping module
- Fix #1450: Generate again patch contrib/aaaa-filter-iterator.patch
  (by Danilo G. Baio).
- Fix param unused warning for windows exportsymbol compile.
- Use RCODE from A query on DNS64 synthesized answer.
- Fix trust-anchor-signaling works in libunbound.
- Fix spelling in unbound-control man page.</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="cbosdonnat@suse.com" date="1512129600">- Use python3 instead of python2 (fate#323526)</changelog>
  <changelog author="michael@stroeder.com" date="1516363200">- update to 1.6.8 (bsc#1076963)
  patch for CVE-2017-15105: vulnerability in the processing of
  wildcard synthesized NSEC records.</changelog>
  <changelog author="dmueller@suse.com" date="1539691200">- adjust for root KSK rollover (bsc#1112009, bsc#1004165)</changelog>
  <changelog author="kbabioch@suse.com" date="1539691201">- Disabled DLV configuration by default (bsc#1055060)
- Updated the DNSSEC root trust anchor due to KSK roll over (bsc#1112009)</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1542283200">- Migrated from cron to systemd timers (bsc#1115417)</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1546603200">- Use systemd-tmpfiles to create /var/lib/unbound/root.key
  to avoid transactional update breakage (bsc#1111383)</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1551960000">- Remove old pwdutils dependency and add shadow to cover both useradd
  and groupadd as suggested in (bsc#1126757)</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1556020800">- Add systemd require in unbound-anchor to reflect new dependency (due to systemd-timers)</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1592913600">- Avoid amplifying an incoming query to a large number of queries
  Resolves CVE-2020-12662 CVE-2020-12663 (bsc#1171889)
  [ + unbound-1.6.8-amplifying-an-incoming-query.patch ]</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1592913601">- Avoid shell code execution after receiving a specially crafted answer
  Resolves CVE-2019-18934 (bsc#1157268)
  [ + patch_cve_2019-18934.patch ]</changelog>
  <changelog author="werner@suse.de" date="1642420800">- Add patches
  * bsc1185382_CVE-2019-25031_f8875527.patch
    bsc#1185382 for CVE-2019-25031
    configuration injection in create_unbound_ad_servers.sh upon a successful man-in-the-middle attack
  * bsc1185383.4_CVE-2019-25032.3_226298bb.patch
    bsc#1185383 for CVE-2019-25032
    integer overflow in the regional allocator via regional_alloc
    bsc#1185384 for CVE-2019-25033
    integer overflow in the regional allocator via the ALIGN_UP macro
  * bsc1185385_CVE-2019-25034_a3545867.patch
    bsc#1185385 for CVE-2019-25034
    integer overflow in sldns_str2wire_dname_buf_origin, leading to an out-of-bounds write
  * bsc1185386.7_CVE-2019-25035.6_fa23ee8f.patch
    bsc#1185386 for CVE-2019-25035
    out-of-bounds write in sldns_bget_token_par
    bsc#1185387 for CVE-2019-25036
    assertion failure and denial of service in synth_cname
  * bsc1185391.2_CVE-2019-25040.1_2d444a50.patch
    bsc#1185391 for CVE-2019-25040
    infinite loop via a compressed name in dname_pkt_copy
    bsc#1185392 for CVE-2019-25041
    assertion failure via a compressed name in dname_pkt_copy
  * bsc1185389.90_CVE-2019-25038.9_02080f6b.patch
    bsc#1185389 for CVE-2019-25038
    integer overflow in a size calculation in dnscrypt/dnscrypt.c
    bsc#1185390 for CVE-2019-25039
    integer overflow in a size calculation in respip/respip.c
  * bsc1185388_CVE-2019-25037_d2eb78e8.patch
    bsc#1185388 for CVE-2019-25037
    assertion failure and denial of service in dname_pkt_copy via an invalid packet
  * bsc1185393_CVE-2019-25042_6c3a0b54.patch
    bsc#1185393 for CVE-2019-25042
    out-of-bounds write via a compressed name in rdata_copy
- Correct indentation in patch unbound-1.6.8-amplifying-an-incoming-query.patch
  to make it fit to above patches</changelog>
  <changelog author="werner@suse.de" date="1642593600">- Add patch bsc1179191_CVE-2020-28935_19f8f4d9.patch to really fix
  bsc#1179191 CVE-2020-28935: unbound: symbolic link traversal when
  writing PID file</changelog>
  <changelog author="werner@suse.de" date="1642593601">- Import changes from OBS for dlv.isc.org.key, root.anchor, and
  root.key to fix bsc#1112033</changelog>
</package>
<package pkgid="224f791b95d3ab0f984409144051d9b92750c5c50d64234e040a069ca3d31358" name="libvirglrenderer0" arch="aarch64">
  <version epoch="0" ver="0.6.0" rel="4.9.1"/>
  <changelog author="lma@suse.com" date="1460462400">- Initial package, based upon virglrenderer upstream sources
  (git tag: 0.5.0)</changelog>
  <changelog author="lma@suse.com" date="1460548800">- Fixed epoxy dependency</changelog>
  <changelog author="brogers@suse.com" date="1460635200">- Fixed url in spec file</changelog>
  <changelog author="brogers@suse.com" date="1464782400">- Refine BuildRequires tags</changelog>
  <changelog author="brogers@suse.com" date="1464955200">- Further tweaks to package layout, including splitting out
  the test server into it's own package.</changelog>
  <changelog author="lma@suse.com" date="1487332800">- Address various security issues
  * Fix null pointer dereference in vrend_clear (CVE-2017-5937 bsc#1024232)
  0001-48f67f60-renderer-fix-NULL-pointer-deref-in-vrend_clear.patch
  * Fix host memory leak issue in virgl_resource_attach_backing (CVE-2016-10214 bsc#1024244)
  0002-40b0e781-renderer-fix-a-leak-in-resource-attach.patch
  * Fix memory leak in int blit context (CVE-2017-5993 bsc#1025505)
  0003-6eb13f7a-vrend-fix-memory-leak-in-int-blit-context.patch
  * Fix heap overflow in vertex elements state create (CVE-2017-5994 bsc#1025507)
  0004-114688c5-renderer-fix-heap-overflow-in-vertex-elements-state-.patch
  * Fix a stack overflow in set framebuffer state (CVE-2017-5957 bsc#1024993)
  0005-926b9b34-vrend-fix-a-stack-overflow-in-set-framebuffer-state.patch</changelog>
  <changelog author="lma@suse.com" date="1487937600">- Update package to 0.6.0
  The following patches will be removed:
  0001-48f67f60-renderer-fix-NULL-pointer-deref-in-vrend_clear.patch
  0002-40b0e781-renderer-fix-a-leak-in-resource-attach.patch
  0003-6eb13f7a-vrend-fix-memory-leak-in-int-blit-context.patch
  0004-114688c5-renderer-fix-heap-overflow-in-vertex-elements-state-.patch
  0005-926b9b34-vrend-fix-a-stack-overflow-in-set-framebuffer-state.patch
  All of the removed patches were already included in 0.6.0,
  So we dont need them any more.</changelog>
  <changelog author="jengelh@inai.de" date="1488456000">- Fix RPM groups</changelog>
  <changelog author="lma@suse.com" date="1489147200">- Fix memory leak in vertex elements state create (CVE-2017-6386 bsc#1027376)
  0001-737c3350-renderer-fix-memory-leak-in-vertex-elements-state-cr.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1509537600">- Clean up spec file with spec-cleaner
- Use source url
- Add gpg signature
- Make building more verbose
- Explicitly require python2</changelog>
  <changelog author="lma@suse.com" date="1576843200">- Add 4 security fixes
  * Check resource creation more thoroughly (CVE-2019-18388 bsc#1159479)
  0002-5d03711-vrend-Keep-the-max-texture-sizes-in-the-vrend_state.patch
  0003-0d9a2c8-vrend-Check-resource-creation-more-thoroughly.patch
  * check info formats in blits (CVE-2019-18390 bsc#1159478)
  0004-24f67de-vrend-check-info-formats-in-blits.patch
  * check transfer bounds for negative values too (CVE-2019-18389 bsc#1159482)
  0005-cbc8d8b-vrend-check-transfer-bounds-for-negative-values-too-.patch
  * check transfer iov holds enough data for the data upload (CVE-2019-18391 bsc#1159486)
  0006-2abeb18-vrend-check-that-the-transfer-iov-holds-enough-data-.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1642420800">- security update
- added patches
  fix CVE-2022-0175 [bsc#1194601], VUL-0: CVE-2022-0175: virglrenderer: Missing initialization of res-&gt;ptr
  + virglrenderer-CVE-2022-0175.patch</changelog>
  <changelog author="mvetter@suse.com" date="1643803200">- security update
  * Fix OOB in read_transfer_data() (CVE-2022-0135 bsc#1195389)
    Add 0007-95e581fd-vrend-fix-oob-read_transfer_data.patch</changelog>
</package>
<package pkgid="6be1c21c0da5ad434c2ed5cb1ca6b35be5e54e63ae10505a5f1778b1ed564b51" name="libvirglrenderer0" arch="ppc64le">
  <version epoch="0" ver="0.6.0" rel="4.9.1"/>
  <changelog author="lma@suse.com" date="1460462400">- Initial package, based upon virglrenderer upstream sources
  (git tag: 0.5.0)</changelog>
  <changelog author="lma@suse.com" date="1460548800">- Fixed epoxy dependency</changelog>
  <changelog author="brogers@suse.com" date="1460635200">- Fixed url in spec file</changelog>
  <changelog author="brogers@suse.com" date="1464782400">- Refine BuildRequires tags</changelog>
  <changelog author="brogers@suse.com" date="1464955200">- Further tweaks to package layout, including splitting out
  the test server into it's own package.</changelog>
  <changelog author="lma@suse.com" date="1487332800">- Address various security issues
  * Fix null pointer dereference in vrend_clear (CVE-2017-5937 bsc#1024232)
  0001-48f67f60-renderer-fix-NULL-pointer-deref-in-vrend_clear.patch
  * Fix host memory leak issue in virgl_resource_attach_backing (CVE-2016-10214 bsc#1024244)
  0002-40b0e781-renderer-fix-a-leak-in-resource-attach.patch
  * Fix memory leak in int blit context (CVE-2017-5993 bsc#1025505)
  0003-6eb13f7a-vrend-fix-memory-leak-in-int-blit-context.patch
  * Fix heap overflow in vertex elements state create (CVE-2017-5994 bsc#1025507)
  0004-114688c5-renderer-fix-heap-overflow-in-vertex-elements-state-.patch
  * Fix a stack overflow in set framebuffer state (CVE-2017-5957 bsc#1024993)
  0005-926b9b34-vrend-fix-a-stack-overflow-in-set-framebuffer-state.patch</changelog>
  <changelog author="lma@suse.com" date="1487937600">- Update package to 0.6.0
  The following patches will be removed:
  0001-48f67f60-renderer-fix-NULL-pointer-deref-in-vrend_clear.patch
  0002-40b0e781-renderer-fix-a-leak-in-resource-attach.patch
  0003-6eb13f7a-vrend-fix-memory-leak-in-int-blit-context.patch
  0004-114688c5-renderer-fix-heap-overflow-in-vertex-elements-state-.patch
  0005-926b9b34-vrend-fix-a-stack-overflow-in-set-framebuffer-state.patch
  All of the removed patches were already included in 0.6.0,
  So we dont need them any more.</changelog>
  <changelog author="jengelh@inai.de" date="1488456000">- Fix RPM groups</changelog>
  <changelog author="lma@suse.com" date="1489147200">- Fix memory leak in vertex elements state create (CVE-2017-6386 bsc#1027376)
  0001-737c3350-renderer-fix-memory-leak-in-vertex-elements-state-cr.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1509537600">- Clean up spec file with spec-cleaner
- Use source url
- Add gpg signature
- Make building more verbose
- Explicitly require python2</changelog>
  <changelog author="lma@suse.com" date="1576843200">- Add 4 security fixes
  * Check resource creation more thoroughly (CVE-2019-18388 bsc#1159479)
  0002-5d03711-vrend-Keep-the-max-texture-sizes-in-the-vrend_state.patch
  0003-0d9a2c8-vrend-Check-resource-creation-more-thoroughly.patch
  * check info formats in blits (CVE-2019-18390 bsc#1159478)
  0004-24f67de-vrend-check-info-formats-in-blits.patch
  * check transfer bounds for negative values too (CVE-2019-18389 bsc#1159482)
  0005-cbc8d8b-vrend-check-transfer-bounds-for-negative-values-too-.patch
  * check transfer iov holds enough data for the data upload (CVE-2019-18391 bsc#1159486)
  0006-2abeb18-vrend-check-that-the-transfer-iov-holds-enough-data-.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1642420800">- security update
- added patches
  fix CVE-2022-0175 [bsc#1194601], VUL-0: CVE-2022-0175: virglrenderer: Missing initialization of res-&gt;ptr
  + virglrenderer-CVE-2022-0175.patch</changelog>
  <changelog author="mvetter@suse.com" date="1643803200">- security update
  * Fix OOB in read_transfer_data() (CVE-2022-0135 bsc#1195389)
    Add 0007-95e581fd-vrend-fix-oob-read_transfer_data.patch</changelog>
</package>
<package pkgid="20548c766fea43e7795a76a0bc1ca2732bb3495adcc3554d5259d20e09404545" name="libvirglrenderer0" arch="s390x">
  <version epoch="0" ver="0.6.0" rel="4.9.1"/>
  <changelog author="lma@suse.com" date="1460462400">- Initial package, based upon virglrenderer upstream sources
  (git tag: 0.5.0)</changelog>
  <changelog author="lma@suse.com" date="1460548800">- Fixed epoxy dependency</changelog>
  <changelog author="brogers@suse.com" date="1460635200">- Fixed url in spec file</changelog>
  <changelog author="brogers@suse.com" date="1464782400">- Refine BuildRequires tags</changelog>
  <changelog author="brogers@suse.com" date="1464955200">- Further tweaks to package layout, including splitting out
  the test server into it's own package.</changelog>
  <changelog author="lma@suse.com" date="1487332800">- Address various security issues
  * Fix null pointer dereference in vrend_clear (CVE-2017-5937 bsc#1024232)
  0001-48f67f60-renderer-fix-NULL-pointer-deref-in-vrend_clear.patch
  * Fix host memory leak issue in virgl_resource_attach_backing (CVE-2016-10214 bsc#1024244)
  0002-40b0e781-renderer-fix-a-leak-in-resource-attach.patch
  * Fix memory leak in int blit context (CVE-2017-5993 bsc#1025505)
  0003-6eb13f7a-vrend-fix-memory-leak-in-int-blit-context.patch
  * Fix heap overflow in vertex elements state create (CVE-2017-5994 bsc#1025507)
  0004-114688c5-renderer-fix-heap-overflow-in-vertex-elements-state-.patch
  * Fix a stack overflow in set framebuffer state (CVE-2017-5957 bsc#1024993)
  0005-926b9b34-vrend-fix-a-stack-overflow-in-set-framebuffer-state.patch</changelog>
  <changelog author="lma@suse.com" date="1487937600">- Update package to 0.6.0
  The following patches will be removed:
  0001-48f67f60-renderer-fix-NULL-pointer-deref-in-vrend_clear.patch
  0002-40b0e781-renderer-fix-a-leak-in-resource-attach.patch
  0003-6eb13f7a-vrend-fix-memory-leak-in-int-blit-context.patch
  0004-114688c5-renderer-fix-heap-overflow-in-vertex-elements-state-.patch
  0005-926b9b34-vrend-fix-a-stack-overflow-in-set-framebuffer-state.patch
  All of the removed patches were already included in 0.6.0,
  So we dont need them any more.</changelog>
  <changelog author="jengelh@inai.de" date="1488456000">- Fix RPM groups</changelog>
  <changelog author="lma@suse.com" date="1489147200">- Fix memory leak in vertex elements state create (CVE-2017-6386 bsc#1027376)
  0001-737c3350-renderer-fix-memory-leak-in-vertex-elements-state-cr.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1509537600">- Clean up spec file with spec-cleaner
- Use source url
- Add gpg signature
- Make building more verbose
- Explicitly require python2</changelog>
  <changelog author="lma@suse.com" date="1576843200">- Add 4 security fixes
  * Check resource creation more thoroughly (CVE-2019-18388 bsc#1159479)
  0002-5d03711-vrend-Keep-the-max-texture-sizes-in-the-vrend_state.patch
  0003-0d9a2c8-vrend-Check-resource-creation-more-thoroughly.patch
  * check info formats in blits (CVE-2019-18390 bsc#1159478)
  0004-24f67de-vrend-check-info-formats-in-blits.patch
  * check transfer bounds for negative values too (CVE-2019-18389 bsc#1159482)
  0005-cbc8d8b-vrend-check-transfer-bounds-for-negative-values-too-.patch
  * check transfer iov holds enough data for the data upload (CVE-2019-18391 bsc#1159486)
  0006-2abeb18-vrend-check-that-the-transfer-iov-holds-enough-data-.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1642420800">- security update
- added patches
  fix CVE-2022-0175 [bsc#1194601], VUL-0: CVE-2022-0175: virglrenderer: Missing initialization of res-&gt;ptr
  + virglrenderer-CVE-2022-0175.patch</changelog>
  <changelog author="mvetter@suse.com" date="1643803200">- security update
  * Fix OOB in read_transfer_data() (CVE-2022-0135 bsc#1195389)
    Add 0007-95e581fd-vrend-fix-oob-read_transfer_data.patch</changelog>
</package>
<package pkgid="c4597c798f45f76d89093bd622e2f7e601743ee3f3f62c5cf23fe1376e6b5996" name="libvirglrenderer0" arch="x86_64">
  <version epoch="0" ver="0.6.0" rel="4.9.1"/>
  <changelog author="lma@suse.com" date="1460462400">- Initial package, based upon virglrenderer upstream sources
  (git tag: 0.5.0)</changelog>
  <changelog author="lma@suse.com" date="1460548800">- Fixed epoxy dependency</changelog>
  <changelog author="brogers@suse.com" date="1460635200">- Fixed url in spec file</changelog>
  <changelog author="brogers@suse.com" date="1464782400">- Refine BuildRequires tags</changelog>
  <changelog author="brogers@suse.com" date="1464955200">- Further tweaks to package layout, including splitting out
  the test server into it's own package.</changelog>
  <changelog author="lma@suse.com" date="1487332800">- Address various security issues
  * Fix null pointer dereference in vrend_clear (CVE-2017-5937 bsc#1024232)
  0001-48f67f60-renderer-fix-NULL-pointer-deref-in-vrend_clear.patch
  * Fix host memory leak issue in virgl_resource_attach_backing (CVE-2016-10214 bsc#1024244)
  0002-40b0e781-renderer-fix-a-leak-in-resource-attach.patch
  * Fix memory leak in int blit context (CVE-2017-5993 bsc#1025505)
  0003-6eb13f7a-vrend-fix-memory-leak-in-int-blit-context.patch
  * Fix heap overflow in vertex elements state create (CVE-2017-5994 bsc#1025507)
  0004-114688c5-renderer-fix-heap-overflow-in-vertex-elements-state-.patch
  * Fix a stack overflow in set framebuffer state (CVE-2017-5957 bsc#1024993)
  0005-926b9b34-vrend-fix-a-stack-overflow-in-set-framebuffer-state.patch</changelog>
  <changelog author="lma@suse.com" date="1487937600">- Update package to 0.6.0
  The following patches will be removed:
  0001-48f67f60-renderer-fix-NULL-pointer-deref-in-vrend_clear.patch
  0002-40b0e781-renderer-fix-a-leak-in-resource-attach.patch
  0003-6eb13f7a-vrend-fix-memory-leak-in-int-blit-context.patch
  0004-114688c5-renderer-fix-heap-overflow-in-vertex-elements-state-.patch
  0005-926b9b34-vrend-fix-a-stack-overflow-in-set-framebuffer-state.patch
  All of the removed patches were already included in 0.6.0,
  So we dont need them any more.</changelog>
  <changelog author="jengelh@inai.de" date="1488456000">- Fix RPM groups</changelog>
  <changelog author="lma@suse.com" date="1489147200">- Fix memory leak in vertex elements state create (CVE-2017-6386 bsc#1027376)
  0001-737c3350-renderer-fix-memory-leak-in-vertex-elements-state-cr.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1509537600">- Clean up spec file with spec-cleaner
- Use source url
- Add gpg signature
- Make building more verbose
- Explicitly require python2</changelog>
  <changelog author="lma@suse.com" date="1576843200">- Add 4 security fixes
  * Check resource creation more thoroughly (CVE-2019-18388 bsc#1159479)
  0002-5d03711-vrend-Keep-the-max-texture-sizes-in-the-vrend_state.patch
  0003-0d9a2c8-vrend-Check-resource-creation-more-thoroughly.patch
  * check info formats in blits (CVE-2019-18390 bsc#1159478)
  0004-24f67de-vrend-check-info-formats-in-blits.patch
  * check transfer bounds for negative values too (CVE-2019-18389 bsc#1159482)
  0005-cbc8d8b-vrend-check-transfer-bounds-for-negative-values-too-.patch
  * check transfer iov holds enough data for the data upload (CVE-2019-18391 bsc#1159486)
  0006-2abeb18-vrend-check-that-the-transfer-iov-holds-enough-data-.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1642420800">- security update
- added patches
  fix CVE-2022-0175 [bsc#1194601], VUL-0: CVE-2022-0175: virglrenderer: Missing initialization of res-&gt;ptr
  + virglrenderer-CVE-2022-0175.patch</changelog>
  <changelog author="mvetter@suse.com" date="1643803200">- security update
  * Fix OOB in read_transfer_data() (CVE-2022-0135 bsc#1195389)
    Add 0007-95e581fd-vrend-fix-oob-read_transfer_data.patch</changelog>
</package>
<package pkgid="443be235088f095aa90e60c77e089ff377c3dc515c696da173ea40d8d68193e8" name="libwebkit2gtk3-lang" arch="noarch">
  <version epoch="0" ver="2.34.3" rel="23.3"/>
  <changelog author="mgorse@suse.com" date="1600084800">- Update to version 2.30.0:
  + Fix NTLM authentication.
  + Don't try to use SHM on wayland with older wpebackend-fdo.
  + Fix the build due to seccomp.h header not found.
  + Security fixes: CVE-2020-9947, CVE-2020-9948, CVE-2020-9951,
  CVE-2021-1817, CVE-2021-1820, CVE-2021-1825, CVE-2021-1826,
  CVE-2021-30661.
- Drop seccomp-build-fix.patch and wpe-shm-check.patch: fixed
  upstream.</changelog>
  <changelog author="mgorse@suse.com" date="1600776000">- Update to version 2.30.1:
  + Bring back the environment variable to force single process
    mode when PSON is disabled.
  + Fix downloads started by an ephemeral web context.
  + Updated translations.</changelog>
  <changelog author="mgorse@suse.com" date="1601467200">- Enable c_loop on aarch64: currently needed for compilation to
  succeed with JIT disabled. Also disable sampling profiler, since
  it conflicts with c_loop (boo#1177087).</changelog>
  <changelog author="dimstar@opensuse.org" date="1603454400">- Update to version 2.30.2:
  + Fix scrolling when smooth scrolling is enabled in async
    scrolling mode.
  + Fix WebSocket requests with same-site cookies.
  + Fix TLS certificate information for service workers.
  + Handle chassis type when its value is quoted.
  + Fix the build with ENABLE_MEDIA_STREAM enabled and
    ENABLE_WEB_RTC_DISABLED.
  + Fix the build with ENABLE_GAMEPAD enabled.
  + Fix several crashes and rendering issues.</changelog>
  <changelog author="mgorse@suse.com" date="1606046400">- Update to version 2.30.3 (boo#1179122 boo#1179451):
  + Add new build option USE(64KB_PAGE_BLOCK).
  + Fix backdrop filters with rounded borders.
  + Fix scrolling iframes when async scrolling is enabled.
  + Allow applications to handle drag and drop on the web view
    again.
  + Update Outlook user agent quirk.
  + Fix the build with video support disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2020-13584, CVE-2020-9983, CVE-2020-13543.
- Drop webkit2gtk3-fdo-soname.patch: fixed upstream.
- Rebase webkit-process.patch.</changelog>
  <changelog author="dimstar@opensuse.org" date="1606910400">- 0001-ICU-68.1-no-longer-exposes-FALSE-and-TRUE-macros-by-.patch:
  ICU 68.1 no longer exposes FALSE and TRUE macros by default.</changelog>
  <changelog author="mgorse@suse.com" date="1606996800">- Add old-wayland-scanner.patch for 15.0: support older
  wayland-scanner. ALso renumber patches to group 15.0-specific
  patches together.
- Have the libwebkit2gtk package require libjavascriptcoregtk of
  the same version (boo#1171531).</changelog>
  <changelog author="dimstar@opensuse.org" date="1608033600">- Update to version 2.30.4:
  + Fix text data sent with WebSockets when using libsoup &lt; 2.68.
  + Fix the rendering on Raspberry Pi 3 using the proprietary video
    driver.
  + Fix clipping of descedant layers of a mask layer.
  + Fix the build with ICU 68.1.
- Drop upstream merged patch:
  + 0001-ICU-68.1-no-longer-exposes-FALSE-and-TRUE-macros-by-.patch</changelog>
  <changelog author="badshah400@gmail.com" date="1611057600">- Add webkit-font-scaling.patch: Fix system font scaling not
  applied to 'font-size: XXXpt'; patch taken from upstream and
  rebased to apply cleanly
  (https://bugs.webkit.org/show_bug.cgi?id=218450).
- Pass `-q` to setup to disable printing long list of files
  extracted from source tarball.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1611144000">- Add gir-multilib.patch: Fix multilib conflict in gir files.
- Disable gold linker for ppc64le</changelog>
  <changelog author="mgorse@suse.com" date="1613217600">- Update to version 2.30.5 (boo#1182286):
  + Bring back the WebKitPluginProcess installation that was
    removed by mistake.
  + Fix RunLoop objects leaked in worker threads.
  + Fix aarch64 llint build with JIT disabled.
  + Use Internet Explorer quirk for Google Docs.
  + Security fixes: CVE-2020-13558.
- Drop gir-multilib.patch: fixed upstream.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1613736000">- Update _constraints for armv6/armv7 (bsc#1182719)</changelog>
  <changelog author="mgorse@suse.com" date="1617710400">- Update to version 2.32.0 (boo#1184155):
  + Fix the authentication request port when URL omits the port.
  + Fix iframe scrolling when main frame is scrolled in async
    scrolling mode.
  + Stop using g_memdup.
  + Show a warning message when overriding signal handler for
    threading suspension.
  - Fix the build on RISC-V with GCC 11.
  - Fix several crashes and rendering issues.
  + Security fixes: CVE-2021-1788, CVE-2021-1844, CVE-2021-1871,
  CVE-2021-30682.
  + Changes in version 2.30.6 (boo#1184262):
  + Update user agent quirks again for Google Docs and Google Drive.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2020-27918, CVE-2020-29623, CVE-2021-1765,
  CVE-2021-1789, CVE-2021-1799, CVE-2021-1801, CVE-2021-1870,
  CVE-2021-21806.
- Remove webkit-font-scaling.patch: contained in upstream
- Drop original SLE 15 support from the spec. Drop
  webkit-process.patch and old-wayland-scanner.patch; they are not
  needed for SP2.
- Pass ENABLE_GAMEPAD=OFF to cmake, since we don't have manette.
- Add glproto-devel to BuildRequires: now needed for the build on
  SLE 15.</changelog>
  <changelog author="mgorse@suse.com" date="1618228800">- Per discussion with maintenance, let's not remove features that
  customers could possibly be using:
- Add webkit2gtk3-restore-npapi.patch: restore NPAPI plugin
  support. Reverts webkit#215503.</changelog>
  <changelog author="mgorse@suse.com" date="1627300800">- Update to version 2.32.3 (boo#1188697):
  + Properly set the cookies settings after a network process
    crash.
  + Fix accessibility tree after a cross site navigation with PSON
    enabled.
  + Ensure WebKitScriptWorld::window-object-cleared signal is
    always emitted.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2021-21775, CVE-2021-21779, CVE-2021-30663,
  CVE-2021-30665, CVE-2021-30689, CVE-2021-30720, CVE-2021-30734,
  CVE-2021-30744, CVE-2021-30749, CVE-2021-30795, CVE-2021-30797,
  CVE-2021-30799.
  + Changes in version 2.32.2:
  + Improve calculation of initial WebKitWebView size.
  + Fix kinetic scrolling on touchpad with async scrolling off.
  + Fix a crash on empty drag operation in X11.
  + Fix rendering on HiDPI /4k screen and scaling.
  + Handle null native surface for for surfaceless rendering.
  + Fix JavaScriptCore crash on 32-bit big endian systems.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2021-30758.
  + Changes in version 2.32.1:
  + Support building against the Musl C library.
  + Support building against ICU version 69 or newer.
  + Improve handling of Media Capture devices.
  + Improve WebAudio playback.
  + Improve video orientation handling.
  + Improve seeking support for MSE playback.
  + Improve flush support in EME decryptors.
  + Fix HTTP status codes for requests done through a custom URI
    handler.
  + Fix the Bubblewrap sandbox in certain 32-bit systems.
  + Fix inconsistencies between the WebKitWebView.is-muted property
    state and values returned by
    webkit_web_view_is_playing_audio().
  + Fix the build with ENABLE_VIDEO=OFF.
  + Fix wrong timestamps for long-lived cookies.
  + Fix UI process crash when failing to load favicons.
  + Fix several crashes and rendering issues.
  + Updated translations.
- Fix webkit2gtk3-restore-npapi.patch to install the plugin
    process.
- Disable WPE renderer: our FDO backend is now too old.</changelog>
  <changelog author="mgorse@suse.com" date="1632225600">- Update to version 2.32.4 (boo#1190701):
  + Do not append .asc extension to downloaded text/plain files.
  + Fix several crashes and rendering issues.
  +  + Security fixes: CVE-2021-30848, CVE-2021-30849, CVE-2021-30858,
  +  CVE-2021-30809, CVE-2021-30836.
- Enable LTO; disabling it is no longer necessary.</changelog>
  <changelog author="mgorse@suse.com" date="1634904000">- Add webkit2gtk3-CVE-2021-42762.patch: update seccomp rules with
  latest changes from flatpak (boo#1191937 CVE-2021-42762).</changelog>
  <changelog author="mgorse@suse.com" date="1635422400">- Update to version 2.34.1 (boo#1191937):
  + Update user agent browser versions.
  + Fix a crash with GTK &gt;= 3.24.30.
  + Fix a crash when loading videos on reddit.
  + Fix file type detection when application calls
    g_desktop_app_info_set_as_default_for_extension() passing html.
  + Security fixes: CVE-2021-42762.
  + Changes in version 2.34.0 (boo#1192063):
  + Add support for CSS Scroll Snap.
  + Add support for date and datetime-local input elements.
  + Add support for display capture.
  + Add support for ICC color management.
  * Add support color-schemes CSS property.
  + Add multi-track support to MSE media backend.
  + Add new API to handle web process unresponsiveness.
  + Add API to disable CORS on a web view for particular domains.
  + Add new API to access/modify capture devices states.
  + Add new API to configure the memory pressure handler.
  +  + Security fixes: CVE-2021-30846, CVE-2021-30851, CVE-2021-30818,
  +  CVE-2021-30823, CVE-2021-30884, CVE-2021-30888, CVE-2021-30889,
  +  CVE-2021-30897.
- Rebase no-forsed-sse.patch and webkit2gtk3-restore-npapi.patch.
- Add fix-warnings.patch: silence return-type warnings.
- Add webkit2gtk3-link-fix.patch: fix the build.
- Add webkitgtk-memfd-build-fix.patch: build fix for glibc 2.26.
- Drop webkit2gtk3-CVE-2021-42762.patch: fixed upstream.
- Add pkgconfig(lcms2) BuildRequires: new dependency.
- Pass -DUSE_SOUP2=ON to cmake.
- Compile with gcc 10. Build fails with gcc 7.</changelog>
  <changelog author="mgorse@suse.com" date="1637323200">- Increase disk space in _constraints; attempt to fix build
  failure.</changelog>
  <changelog author="mgorse@suse.com" date="1640260800">- Update to version 2.34.3 (boo#1194019):
  + Make audio tools (like mixers) display the actual name of the
    application producing sound, instead of a generic one.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2021-30887, CVE-2021-30890.
- Increase disk space in _constraints again. Attempt to fix "no
  space left on device" during clamav check.</changelog>
</package>
<package pkgid="4fd01103be96eaabfdf5085a26cb437cb48a2e4dca925b8d62816abd1fc5f535" name="libxmltooling7" arch="aarch64">
  <version epoch="0" ver="1.6.4" rel="3.6.1"/>
  <changelog author="kstreitova@suse.com" date="1437739200">- initial revision</changelog>
  <changelog author="kstreitova@suse.com" date="1437998400">- use spec-cleaner
- package cleaning
- add xmltooling-1.5.5-doxygen_timestamp.patch to remove timestamps
  in a documentation generated by Doxygen and avoid RPMLINT warnings
  (file-contains-date-and-time).</changelog>
  <changelog author="kstreitova@suse.com" date="1438257600">- adjust Summary in the specfile
- remove unused conditionals</changelog>
  <changelog author="mpluskal@suse.com" date="1438776000">- Add gpg signature</changelog>
  <changelog author="kstreitova@suse.com" date="1441627200">- update to xmltooling 1.5.6
  * [CPPXT-105] - PKIX revocation checking calls OpenSSL's
    X509_verify_cert in an unsupported way (breaks with OpenSSL
    1.0.1p/1.0.2d and later)</changelog>
  <changelog author="adam.majer@suse.de" date="1486036800">- use individual libboost-*-devel packages instead of boost-devel</changelog>
  <changelog author="jengelh@inai.de" date="1486814400">- Update RPM groups</changelog>
  <changelog author="kstreitova@suse.com" date="1505995200">- update to 1.6.0
  * [CPPXT-108] - Potential nullpointer dereference in
    InlineCredential::getKeyInfo
  * [CPPXT-109] - XSECCryptoX509CRL::loadX509CRLPEM() can read past
    unterminated buffer
- update soname for libxmltooling library from 6 to 7
- add version for boost-devel buildrequires
- add %{opensaml_version} macro
- run spec-cleaner</changelog>
  <changelog author="vcizek@suse.com" date="1510228800">- add upstream patches to support building with openssl 1.1 (bsc#1067419)
  * 0023-CPPXT-110-OpenSSL-1.1-removes-BIO_s_file_internal.patch
  * 0011-CPPXT-110-Clean-up-some-collateral-damage-from-previ.patch
  * 0005-CPPXT-110-OpenSSL-1.1-removes-BIO_s_file_internal.patch
  * 0026-CPPXT-110-OpenSSL-1.1-library-names-have-changes.patch
  * 0027-Commit-a-xmltoolingtest.vcxproj.user.patch
  * 0010-CPPXT-110-Start-to-add-tests-to-exercise-XSEC-paths-.patch
  * 0003-CPPXT-110-OpenSSL-1.1-makes-DSA-opaque.patch
  * 0002-CPPXT-110-Add-new-OpenSSL-support-files-to-Unix-buil.patch
  * 0012-CPPXT-110-Add-test-path-for-RSA-loadXXXBigNums.patch
  * 0009-CPPXT-110-Start-to-add-tests-to-exercise-XSEC-paths-.patch
  * 0020-CPPXT-110-Add-new-OpenSSL-support-files-to-Unix-buil.patch
  * 0024-CPPXT-110-OpenSSL-1.1-internalizes-locking.patch
  * 0006-CPPXT-110-OpenSSL-1.1-internalizes-locking.patch
  * 0028-CPPXT-110-OpenSSL-1.1-OpenSSL1.1-changes-to-newly-in.patch
  * 0025-CPPXT-110-OpenSSL-1.1-Fix-some-signatures-and-names.patch
  * 0016-CPPXT-110-Round-trip-verify-test-for-OpenSSLCryptoKe.patch
  * 0021-CPPXT-110-OpenSSL-1.1-makes-DSA-opaque.patch
  * 0007-Unwind-previous.patch
  * 0013-CPPXT-110-Used-Named-curves-for-EC-testing.patch
  * 0030-CPPXT-110-OpenSSL-1.1-New-build-mechanisms.patch
  * 0031-Missed-file-for-OpenSSL1.1-support.patch
  * 0029-CPPXT-110-OpenSSL-1.1-Cleanup-tests.patch
  * 0022-CPPXT-110-OpenSSL-1.1-makes-EVP_PKEY-opaque.patch
  * 0017-CPPXT-110-Inverted-parameters-to-TSM_ASSERT-in-DSA-t.patch
  * 0008-CPPXT-110-Checkin-prototypical-vcxproj.user-file-for.patch
  * 0019-CPPXT-110-OpenSSL-1.1-makes-X509_STORE_CTX-and-X509_.patch
  * 0001-CPPXT-110-OpenSSL-1.1-makes-X509_STORE_CTX-and-X509_.patch
  * 0018-CPPXT-110-Test-for-OpenSSL-part-of-ExplicitKeyTrustE.patch
  * 0004-CPPXT-110-OpenSSL-1.1-makes-EVP_PKEY-opaque.patch
  * 0015-CPPXT-110-test-for-code-changes-to-OpenSSLCryptoKeyE.patch
  * 0014-CPPXT-110-test-for-code-changes-to-OpenSSLCryptoKeyD.patch</changelog>
  <changelog author="kstreitova@suse.com" date="1510747200">- update to 1.6.2
  * 1.6.2:
    [CPPXT-124] - Regression caused by CPPXT-116
  * 1.6.1:
    [CPPXT-107] - Issues compiling with Boost and VC15</changelog>
  <changelog author="kstreitova@suse.com" date="1516017600">- update to 1.6.3
  * [CPPXT-127] - DTD-defined entities can be added to XML without
    breaking signature [CVE-2018-0486], [bsc#1075975]
- 'Url' -&gt; 'URL'</changelog>
  <changelog author="kstreitova@suse.com" date="1519819200">- update to 1.6.4
  * [CPPXT-128] - Additional nodes can be added to XML without
    breaking signature [bsc#1083247] [CVE-2018-0489]</changelog>
  <changelog author="kstreitova@suse.com" date="1553169600">- add xmltooling-1.6.4-CVE-2019-9628.patch to fix a security bug
  where XML parser class fails to trap exceptions on malformed XML
  declaration [bsc#1129537] [CVE-2019-9628]</changelog>
  <changelog author="kstreitova@suse.com" date="1591358400">- add xmltooling-1.6.4-fix_build_openssl_111.patch to fix build
  with openSSL 1.1.1 [bsc#1172351]</changelog>
</package>
<package pkgid="cf1d8c6f3d339b521a332c0861dbaf7c3d1a8f1f00174912485ed909a30a26e4" name="libxmltooling7" arch="ppc64le">
  <version epoch="0" ver="1.6.4" rel="3.6.1"/>
  <changelog author="kstreitova@suse.com" date="1437739200">- initial revision</changelog>
  <changelog author="kstreitova@suse.com" date="1437998400">- use spec-cleaner
- package cleaning
- add xmltooling-1.5.5-doxygen_timestamp.patch to remove timestamps
  in a documentation generated by Doxygen and avoid RPMLINT warnings
  (file-contains-date-and-time).</changelog>
  <changelog author="kstreitova@suse.com" date="1438257600">- adjust Summary in the specfile
- remove unused conditionals</changelog>
  <changelog author="mpluskal@suse.com" date="1438776000">- Add gpg signature</changelog>
  <changelog author="kstreitova@suse.com" date="1441627200">- update to xmltooling 1.5.6
  * [CPPXT-105] - PKIX revocation checking calls OpenSSL's
    X509_verify_cert in an unsupported way (breaks with OpenSSL
    1.0.1p/1.0.2d and later)</changelog>
  <changelog author="adam.majer@suse.de" date="1486036800">- use individual libboost-*-devel packages instead of boost-devel</changelog>
  <changelog author="jengelh@inai.de" date="1486814400">- Update RPM groups</changelog>
  <changelog author="kstreitova@suse.com" date="1505995200">- update to 1.6.0
  * [CPPXT-108] - Potential nullpointer dereference in
    InlineCredential::getKeyInfo
  * [CPPXT-109] - XSECCryptoX509CRL::loadX509CRLPEM() can read past
    unterminated buffer
- update soname for libxmltooling library from 6 to 7
- add version for boost-devel buildrequires
- add %{opensaml_version} macro
- run spec-cleaner</changelog>
  <changelog author="vcizek@suse.com" date="1510228800">- add upstream patches to support building with openssl 1.1 (bsc#1067419)
  * 0023-CPPXT-110-OpenSSL-1.1-removes-BIO_s_file_internal.patch
  * 0011-CPPXT-110-Clean-up-some-collateral-damage-from-previ.patch
  * 0005-CPPXT-110-OpenSSL-1.1-removes-BIO_s_file_internal.patch
  * 0026-CPPXT-110-OpenSSL-1.1-library-names-have-changes.patch
  * 0027-Commit-a-xmltoolingtest.vcxproj.user.patch
  * 0010-CPPXT-110-Start-to-add-tests-to-exercise-XSEC-paths-.patch
  * 0003-CPPXT-110-OpenSSL-1.1-makes-DSA-opaque.patch
  * 0002-CPPXT-110-Add-new-OpenSSL-support-files-to-Unix-buil.patch
  * 0012-CPPXT-110-Add-test-path-for-RSA-loadXXXBigNums.patch
  * 0009-CPPXT-110-Start-to-add-tests-to-exercise-XSEC-paths-.patch
  * 0020-CPPXT-110-Add-new-OpenSSL-support-files-to-Unix-buil.patch
  * 0024-CPPXT-110-OpenSSL-1.1-internalizes-locking.patch
  * 0006-CPPXT-110-OpenSSL-1.1-internalizes-locking.patch
  * 0028-CPPXT-110-OpenSSL-1.1-OpenSSL1.1-changes-to-newly-in.patch
  * 0025-CPPXT-110-OpenSSL-1.1-Fix-some-signatures-and-names.patch
  * 0016-CPPXT-110-Round-trip-verify-test-for-OpenSSLCryptoKe.patch
  * 0021-CPPXT-110-OpenSSL-1.1-makes-DSA-opaque.patch
  * 0007-Unwind-previous.patch
  * 0013-CPPXT-110-Used-Named-curves-for-EC-testing.patch
  * 0030-CPPXT-110-OpenSSL-1.1-New-build-mechanisms.patch
  * 0031-Missed-file-for-OpenSSL1.1-support.patch
  * 0029-CPPXT-110-OpenSSL-1.1-Cleanup-tests.patch
  * 0022-CPPXT-110-OpenSSL-1.1-makes-EVP_PKEY-opaque.patch
  * 0017-CPPXT-110-Inverted-parameters-to-TSM_ASSERT-in-DSA-t.patch
  * 0008-CPPXT-110-Checkin-prototypical-vcxproj.user-file-for.patch
  * 0019-CPPXT-110-OpenSSL-1.1-makes-X509_STORE_CTX-and-X509_.patch
  * 0001-CPPXT-110-OpenSSL-1.1-makes-X509_STORE_CTX-and-X509_.patch
  * 0018-CPPXT-110-Test-for-OpenSSL-part-of-ExplicitKeyTrustE.patch
  * 0004-CPPXT-110-OpenSSL-1.1-makes-EVP_PKEY-opaque.patch
  * 0015-CPPXT-110-test-for-code-changes-to-OpenSSLCryptoKeyE.patch
  * 0014-CPPXT-110-test-for-code-changes-to-OpenSSLCryptoKeyD.patch</changelog>
  <changelog author="kstreitova@suse.com" date="1510747200">- update to 1.6.2
  * 1.6.2:
    [CPPXT-124] - Regression caused by CPPXT-116
  * 1.6.1:
    [CPPXT-107] - Issues compiling with Boost and VC15</changelog>
  <changelog author="kstreitova@suse.com" date="1516017600">- update to 1.6.3
  * [CPPXT-127] - DTD-defined entities can be added to XML without
    breaking signature [CVE-2018-0486], [bsc#1075975]
- 'Url' -&gt; 'URL'</changelog>
  <changelog author="kstreitova@suse.com" date="1519819200">- update to 1.6.4
  * [CPPXT-128] - Additional nodes can be added to XML without
    breaking signature [bsc#1083247] [CVE-2018-0489]</changelog>
  <changelog author="kstreitova@suse.com" date="1553169600">- add xmltooling-1.6.4-CVE-2019-9628.patch to fix a security bug
  where XML parser class fails to trap exceptions on malformed XML
  declaration [bsc#1129537] [CVE-2019-9628]</changelog>
  <changelog author="kstreitova@suse.com" date="1591358400">- add xmltooling-1.6.4-fix_build_openssl_111.patch to fix build
  with openSSL 1.1.1 [bsc#1172351]</changelog>
</package>
<package pkgid="7e6e23791a188f3446bee0d48837280d14fca2b0e82371ff78b4de6fea8dc8a8" name="libxmltooling7" arch="s390x">
  <version epoch="0" ver="1.6.4" rel="3.6.1"/>
  <changelog author="kstreitova@suse.com" date="1437739200">- initial revision</changelog>
  <changelog author="kstreitova@suse.com" date="1437998400">- use spec-cleaner
- package cleaning
- add xmltooling-1.5.5-doxygen_timestamp.patch to remove timestamps
  in a documentation generated by Doxygen and avoid RPMLINT warnings
  (file-contains-date-and-time).</changelog>
  <changelog author="kstreitova@suse.com" date="1438257600">- adjust Summary in the specfile
- remove unused conditionals</changelog>
  <changelog author="mpluskal@suse.com" date="1438776000">- Add gpg signature</changelog>
  <changelog author="kstreitova@suse.com" date="1441627200">- update to xmltooling 1.5.6
  * [CPPXT-105] - PKIX revocation checking calls OpenSSL's
    X509_verify_cert in an unsupported way (breaks with OpenSSL
    1.0.1p/1.0.2d and later)</changelog>
  <changelog author="adam.majer@suse.de" date="1486036800">- use individual libboost-*-devel packages instead of boost-devel</changelog>
  <changelog author="jengelh@inai.de" date="1486814400">- Update RPM groups</changelog>
  <changelog author="kstreitova@suse.com" date="1505995200">- update to 1.6.0
  * [CPPXT-108] - Potential nullpointer dereference in
    InlineCredential::getKeyInfo
  * [CPPXT-109] - XSECCryptoX509CRL::loadX509CRLPEM() can read past
    unterminated buffer
- update soname for libxmltooling library from 6 to 7
- add version for boost-devel buildrequires
- add %{opensaml_version} macro
- run spec-cleaner</changelog>
  <changelog author="vcizek@suse.com" date="1510228800">- add upstream patches to support building with openssl 1.1 (bsc#1067419)
  * 0023-CPPXT-110-OpenSSL-1.1-removes-BIO_s_file_internal.patch
  * 0011-CPPXT-110-Clean-up-some-collateral-damage-from-previ.patch
  * 0005-CPPXT-110-OpenSSL-1.1-removes-BIO_s_file_internal.patch
  * 0026-CPPXT-110-OpenSSL-1.1-library-names-have-changes.patch
  * 0027-Commit-a-xmltoolingtest.vcxproj.user.patch
  * 0010-CPPXT-110-Start-to-add-tests-to-exercise-XSEC-paths-.patch
  * 0003-CPPXT-110-OpenSSL-1.1-makes-DSA-opaque.patch
  * 0002-CPPXT-110-Add-new-OpenSSL-support-files-to-Unix-buil.patch
  * 0012-CPPXT-110-Add-test-path-for-RSA-loadXXXBigNums.patch
  * 0009-CPPXT-110-Start-to-add-tests-to-exercise-XSEC-paths-.patch
  * 0020-CPPXT-110-Add-new-OpenSSL-support-files-to-Unix-buil.patch
  * 0024-CPPXT-110-OpenSSL-1.1-internalizes-locking.patch
  * 0006-CPPXT-110-OpenSSL-1.1-internalizes-locking.patch
  * 0028-CPPXT-110-OpenSSL-1.1-OpenSSL1.1-changes-to-newly-in.patch
  * 0025-CPPXT-110-OpenSSL-1.1-Fix-some-signatures-and-names.patch
  * 0016-CPPXT-110-Round-trip-verify-test-for-OpenSSLCryptoKe.patch
  * 0021-CPPXT-110-OpenSSL-1.1-makes-DSA-opaque.patch
  * 0007-Unwind-previous.patch
  * 0013-CPPXT-110-Used-Named-curves-for-EC-testing.patch
  * 0030-CPPXT-110-OpenSSL-1.1-New-build-mechanisms.patch
  * 0031-Missed-file-for-OpenSSL1.1-support.patch
  * 0029-CPPXT-110-OpenSSL-1.1-Cleanup-tests.patch
  * 0022-CPPXT-110-OpenSSL-1.1-makes-EVP_PKEY-opaque.patch
  * 0017-CPPXT-110-Inverted-parameters-to-TSM_ASSERT-in-DSA-t.patch
  * 0008-CPPXT-110-Checkin-prototypical-vcxproj.user-file-for.patch
  * 0019-CPPXT-110-OpenSSL-1.1-makes-X509_STORE_CTX-and-X509_.patch
  * 0001-CPPXT-110-OpenSSL-1.1-makes-X509_STORE_CTX-and-X509_.patch
  * 0018-CPPXT-110-Test-for-OpenSSL-part-of-ExplicitKeyTrustE.patch
  * 0004-CPPXT-110-OpenSSL-1.1-makes-EVP_PKEY-opaque.patch
  * 0015-CPPXT-110-test-for-code-changes-to-OpenSSLCryptoKeyE.patch
  * 0014-CPPXT-110-test-for-code-changes-to-OpenSSLCryptoKeyD.patch</changelog>
  <changelog author="kstreitova@suse.com" date="1510747200">- update to 1.6.2
  * 1.6.2:
    [CPPXT-124] - Regression caused by CPPXT-116
  * 1.6.1:
    [CPPXT-107] - Issues compiling with Boost and VC15</changelog>
  <changelog author="kstreitova@suse.com" date="1516017600">- update to 1.6.3
  * [CPPXT-127] - DTD-defined entities can be added to XML without
    breaking signature [CVE-2018-0486], [bsc#1075975]
- 'Url' -&gt; 'URL'</changelog>
  <changelog author="kstreitova@suse.com" date="1519819200">- update to 1.6.4
  * [CPPXT-128] - Additional nodes can be added to XML without
    breaking signature [bsc#1083247] [CVE-2018-0489]</changelog>
  <changelog author="kstreitova@suse.com" date="1553169600">- add xmltooling-1.6.4-CVE-2019-9628.patch to fix a security bug
  where XML parser class fails to trap exceptions on malformed XML
  declaration [bsc#1129537] [CVE-2019-9628]</changelog>
  <changelog author="kstreitova@suse.com" date="1591358400">- add xmltooling-1.6.4-fix_build_openssl_111.patch to fix build
  with openSSL 1.1.1 [bsc#1172351]</changelog>
</package>
<package pkgid="38cc6356e66f8f537aff76f131fafdf85f103f36ee881f4745b5e94fa8370336" name="libxmltooling7" arch="x86_64">
  <version epoch="0" ver="1.6.4" rel="3.6.1"/>
  <changelog author="kstreitova@suse.com" date="1437739200">- initial revision</changelog>
  <changelog author="kstreitova@suse.com" date="1437998400">- use spec-cleaner
- package cleaning
- add xmltooling-1.5.5-doxygen_timestamp.patch to remove timestamps
  in a documentation generated by Doxygen and avoid RPMLINT warnings
  (file-contains-date-and-time).</changelog>
  <changelog author="kstreitova@suse.com" date="1438257600">- adjust Summary in the specfile
- remove unused conditionals</changelog>
  <changelog author="mpluskal@suse.com" date="1438776000">- Add gpg signature</changelog>
  <changelog author="kstreitova@suse.com" date="1441627200">- update to xmltooling 1.5.6
  * [CPPXT-105] - PKIX revocation checking calls OpenSSL's
    X509_verify_cert in an unsupported way (breaks with OpenSSL
    1.0.1p/1.0.2d and later)</changelog>
  <changelog author="adam.majer@suse.de" date="1486036800">- use individual libboost-*-devel packages instead of boost-devel</changelog>
  <changelog author="jengelh@inai.de" date="1486814400">- Update RPM groups</changelog>
  <changelog author="kstreitova@suse.com" date="1505995200">- update to 1.6.0
  * [CPPXT-108] - Potential nullpointer dereference in
    InlineCredential::getKeyInfo
  * [CPPXT-109] - XSECCryptoX509CRL::loadX509CRLPEM() can read past
    unterminated buffer
- update soname for libxmltooling library from 6 to 7
- add version for boost-devel buildrequires
- add %{opensaml_version} macro
- run spec-cleaner</changelog>
  <changelog author="vcizek@suse.com" date="1510228800">- add upstream patches to support building with openssl 1.1 (bsc#1067419)
  * 0023-CPPXT-110-OpenSSL-1.1-removes-BIO_s_file_internal.patch
  * 0011-CPPXT-110-Clean-up-some-collateral-damage-from-previ.patch
  * 0005-CPPXT-110-OpenSSL-1.1-removes-BIO_s_file_internal.patch
  * 0026-CPPXT-110-OpenSSL-1.1-library-names-have-changes.patch
  * 0027-Commit-a-xmltoolingtest.vcxproj.user.patch
  * 0010-CPPXT-110-Start-to-add-tests-to-exercise-XSEC-paths-.patch
  * 0003-CPPXT-110-OpenSSL-1.1-makes-DSA-opaque.patch
  * 0002-CPPXT-110-Add-new-OpenSSL-support-files-to-Unix-buil.patch
  * 0012-CPPXT-110-Add-test-path-for-RSA-loadXXXBigNums.patch
  * 0009-CPPXT-110-Start-to-add-tests-to-exercise-XSEC-paths-.patch
  * 0020-CPPXT-110-Add-new-OpenSSL-support-files-to-Unix-buil.patch
  * 0024-CPPXT-110-OpenSSL-1.1-internalizes-locking.patch
  * 0006-CPPXT-110-OpenSSL-1.1-internalizes-locking.patch
  * 0028-CPPXT-110-OpenSSL-1.1-OpenSSL1.1-changes-to-newly-in.patch
  * 0025-CPPXT-110-OpenSSL-1.1-Fix-some-signatures-and-names.patch
  * 0016-CPPXT-110-Round-trip-verify-test-for-OpenSSLCryptoKe.patch
  * 0021-CPPXT-110-OpenSSL-1.1-makes-DSA-opaque.patch
  * 0007-Unwind-previous.patch
  * 0013-CPPXT-110-Used-Named-curves-for-EC-testing.patch
  * 0030-CPPXT-110-OpenSSL-1.1-New-build-mechanisms.patch
  * 0031-Missed-file-for-OpenSSL1.1-support.patch
  * 0029-CPPXT-110-OpenSSL-1.1-Cleanup-tests.patch
  * 0022-CPPXT-110-OpenSSL-1.1-makes-EVP_PKEY-opaque.patch
  * 0017-CPPXT-110-Inverted-parameters-to-TSM_ASSERT-in-DSA-t.patch
  * 0008-CPPXT-110-Checkin-prototypical-vcxproj.user-file-for.patch
  * 0019-CPPXT-110-OpenSSL-1.1-makes-X509_STORE_CTX-and-X509_.patch
  * 0001-CPPXT-110-OpenSSL-1.1-makes-X509_STORE_CTX-and-X509_.patch
  * 0018-CPPXT-110-Test-for-OpenSSL-part-of-ExplicitKeyTrustE.patch
  * 0004-CPPXT-110-OpenSSL-1.1-makes-EVP_PKEY-opaque.patch
  * 0015-CPPXT-110-test-for-code-changes-to-OpenSSLCryptoKeyE.patch
  * 0014-CPPXT-110-test-for-code-changes-to-OpenSSLCryptoKeyD.patch</changelog>
  <changelog author="kstreitova@suse.com" date="1510747200">- update to 1.6.2
  * 1.6.2:
    [CPPXT-124] - Regression caused by CPPXT-116
  * 1.6.1:
    [CPPXT-107] - Issues compiling with Boost and VC15</changelog>
  <changelog author="kstreitova@suse.com" date="1516017600">- update to 1.6.3
  * [CPPXT-127] - DTD-defined entities can be added to XML without
    breaking signature [CVE-2018-0486], [bsc#1075975]
- 'Url' -&gt; 'URL'</changelog>
  <changelog author="kstreitova@suse.com" date="1519819200">- update to 1.6.4
  * [CPPXT-128] - Additional nodes can be added to XML without
    breaking signature [bsc#1083247] [CVE-2018-0489]</changelog>
  <changelog author="kstreitova@suse.com" date="1553169600">- add xmltooling-1.6.4-CVE-2019-9628.patch to fix a security bug
  where XML parser class fails to trap exceptions on malformed XML
  declaration [bsc#1129537] [CVE-2019-9628]</changelog>
  <changelog author="kstreitova@suse.com" date="1591358400">- add xmltooling-1.6.4-fix_build_openssl_111.patch to fix build
  with openSSL 1.1.1 [bsc#1172351]</changelog>
</package>
<package pkgid="6eb80da7b7bc3779e967ac373f5a9d751743fd5295c27bce580618b461fc5508" name="log4j" arch="src">
  <version epoch="0" ver="1.2.17" rel="5.9.1"/>
  <changelog author="mls@suse.de" date="1138190400">- converted neededforbuild to BuildRequires</changelog>
  <changelog author="stbinner@suse.de" date="1140004800">- add GenericName to .desktop files</changelog>
  <changelog author="dbornkessel@suse.de" date="1178625600">- use mx4j instead of jmx</changelog>
  <changelog author="dbornkessel@suse.de" date="1179489600">- removed mx4j BuildReq to avoid build cycle ... apparently it was not used at compile time</changelog>
  <changelog author="sbrabec@suse.cz" date="1181217600">- Removed invalid desktop Category "Application" (#254654).</changelog>
  <changelog author="mvyskocil@suse.cz" date="1207656000">- updated to 1.2.5 [bnc#355798]
- merged a spec with jpackage 1.7
  - the ant arguments was splitted to several lines
  - new BuildRequires:
  - classpathx-javamail
  - geronimo-jaf
  - geronimo-jms
  - a new patches to break of a dependendy on Sun's HtmlAdaptorServer
    (replaced by HttpAdaptor from mx4j package)
  - added a gjc build branch
- created an autogenerated -mini specfile used for bootstrap (hint from sbrabec@suse.cz)
  - added an explicit provides of log4j symbol for log4j-mini (automatically by script)
- replaced a name `macro' by `real', because the -mini package has a different name
- disable the javadoc and manual subpackages for -mini build</changelog>
  <changelog author="mvyskocil@suse.cz" date="1210075200">- removed a dots in a names of geronimo-* packages</changelog>
  <changelog author="coolo@suse.de" date="1214568000">- avoid build cycle between axis and log4j</changelog>
  <changelog author="coolo@suse.de" date="1216209600">- even more packages to build ignore</changelog>
  <changelog author="mvyskocil@suse.cz" date="1260446400">- refreshed patches
  * log4j-javadoc-xlink.patch
  * log4j-jmx-Agent.patch
  * log4j-logfactor5-userdir.patch
  * log4j-mx4j-tools.patch</changelog>
  <changelog author="mls@suse.de" date="1373976000">- get rid of wrong dir modifier in filelist</changelog>
  <changelog author="tchvatal@suse.com" date="1378728000">- Move from jpackage-utils to javapackage-tools</changelog>
  <changelog author="mvyskocil@suse.com" date="1378987200">- log4j and log4j-mini are in conflict</changelog>
  <changelog author="tchvatal@suse.com" date="1425297600">- Cleanup with a spec-cleaner so I can understand what
  is going around here.</changelog>
  <changelog author="tchvatal@suse.com" date="1425297601">- Version bump to 1.2.17 latest 1.2 series:
  * No short changelog provided - many small changes
- Try to avoid cycle between log4j and apache-common-loggings
- Remove obsoleted patch:
  * log4j-jmx-Agent.patch
- Refresh patch to apply to new source:
  * log4j-mx4j-tools.patch</changelog>
  <changelog author="fstrba@suse.com" date="1505217600">- Specify java source and target level 1.6 to allow building with
  jdk9</changelog>
  <changelog author="bwiedemann@suse.com" date="1515585600">- Add log4j-reproducible.patch to drop javadoc timestamps to make
  package builds more reproducible (boo#1047218)</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1577966400">- Security fix: [bsc#1159646, CVE-2019-17571]
  * Remote code execution: Deserialization of untrusted data in SocketServer
  * Backported from CVE-2017-5645 for Log4j 2.8.2
- Add log4j-CVE-2019-17571.patch
- Use fdupes macro to avoid duplicated files</changelog>
  <changelog author="psimons@suse.com" date="1639656000">- Remove src/main/java/org/apache/log4j/net/JMSAppender.java from
  the build to mitigate CVE-2021-4104. [bsc#1193662]</changelog>
  <changelog author="fstrba@suse.com" date="1642593600">- Remove the chainsaw sub-package (bsc#1194844, CVE-2022-23307)
- Remove src/main/java/org/apache/log4j/jdbc/JDBCAppender.java from
  the build to mitigate bsc#1194843, CVE-2022-23305
- Remove src/main/java/org/apache/log4j/net/JMSSink.java from the
  build to mitigate bsc#1194842, CVE-2022-23302
- Obsolete chainsaw &lt; 2.1 by the log4j package
- Added patch:
  * log4j-missingmodules.patch
    + do not package org.apache.log4j.chainsaw classes
    + package org.apache.log4j.pattern classes that will be needed
    by apache-log4j-extras which is a dependency of chainsaw 2.x</changelog>
</package>
<package pkgid="fa7463c276542d0af08579603fcb770b018c14d99fc0a11009d38d3ea36cbaf2" name="log4j-manual" arch="noarch">
  <version epoch="0" ver="1.2.17" rel="5.9.1"/>
  <changelog author="mls@suse.de" date="1373976000">- get rid of wrong dir modifier in filelist</changelog>
  <changelog author="tchvatal@suse.com" date="1378728000">- Move from jpackage-utils to javapackage-tools</changelog>
  <changelog author="mvyskocil@suse.com" date="1378987200">- log4j and log4j-mini are in conflict</changelog>
  <changelog author="tchvatal@suse.com" date="1425297600">- Cleanup with a spec-cleaner so I can understand what
  is going around here.</changelog>
  <changelog author="tchvatal@suse.com" date="1425297601">- Version bump to 1.2.17 latest 1.2 series:
  * No short changelog provided - many small changes
- Try to avoid cycle between log4j and apache-common-loggings
- Remove obsoleted patch:
  * log4j-jmx-Agent.patch
- Refresh patch to apply to new source:
  * log4j-mx4j-tools.patch</changelog>
  <changelog author="fstrba@suse.com" date="1505217600">- Specify java source and target level 1.6 to allow building with
  jdk9</changelog>
  <changelog author="bwiedemann@suse.com" date="1515585600">- Add log4j-reproducible.patch to drop javadoc timestamps to make
  package builds more reproducible (boo#1047218)</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1577966400">- Security fix: [bsc#1159646, CVE-2019-17571]
  * Remote code execution: Deserialization of untrusted data in SocketServer
  * Backported from CVE-2017-5645 for Log4j 2.8.2
- Add log4j-CVE-2019-17571.patch
- Use fdupes macro to avoid duplicated files</changelog>
  <changelog author="psimons@suse.com" date="1639656000">- Remove src/main/java/org/apache/log4j/net/JMSAppender.java from
  the build to mitigate CVE-2021-4104. [bsc#1193662]</changelog>
  <changelog author="fstrba@suse.com" date="1642593600">- Remove the chainsaw sub-package (bsc#1194844, CVE-2022-23307)
- Remove src/main/java/org/apache/log4j/jdbc/JDBCAppender.java from
  the build to mitigate bsc#1194843, CVE-2022-23305
- Remove src/main/java/org/apache/log4j/net/JMSSink.java from the
  build to mitigate bsc#1194842, CVE-2022-23302
- Obsolete chainsaw &lt; 2.1 by the log4j package
- Added patch:
  * log4j-missingmodules.patch
    + do not package org.apache.log4j.chainsaw classes
    + package org.apache.log4j.pattern classes that will be needed
    by apache-log4j-extras which is a dependency of chainsaw 2.x</changelog>
</package>
<package pkgid="7e24f17d98055f923282a7511b1b057e2f28af0dc63e19ed882abc203addedff" name="log4j12" arch="noarch">
  <version epoch="0" ver="1.2.17" rel="4.9.1"/>
  <changelog author="tchvatal@suse.com" date="1425297600">- Cleanup with a spec-cleaner so I can understand what
  is going around here.</changelog>
  <changelog author="tchvatal@suse.com" date="1425297601">- Version bump to 1.2.17 latest 1.2 series:
  * No short changelog provided - many small changes
- Try to avoid cycle between log4j and apache-common-loggings
- Remove obsoleted patch:
  * log4j-jmx-Agent.patch
- Refresh patch to apply to new source:
  * log4j-mx4j-tools.patch</changelog>
  <changelog author="fstrba@suse.com" date="1505217600">- Specify java source and target level 1.6 to allow building with
  jdk9</changelog>
  <changelog author="bwiedemann@suse.com" date="1515585600">- Add log4j-reproducible.patch to drop javadoc timestamps to make
  package builds more reproducible (boo#1047218)</changelog>
  <changelog author="fstrba@suse.com" date="1532520000">- Require at least java 8 for build</changelog>
  <changelog author="fstrba@suse.com" date="1539864000">- Install and package the maven pom and metadata files for the
  non-bootstrap log4j</changelog>
  <changelog author="fstrba@suse.com" date="1544702400">- Depend on the generic xml-apis</changelog>
  <changelog author="fstrba@suse.com" date="1547553600">- Let log4j provide the log4j-mini and obsolete it too.
- Remove conflicts on each other</changelog>
  <changelog author="fstrba@suse.com" date="1548158400">- Build against a generic javamail provider instead of against
  classpathx-mail</changelog>
  <changelog author="fstrba@suse.com" date="1569931200">- Rename to log4j12/log4j12-mini as a compatibility packages
- Convert to multibuild
- Clean up with the spec-cleaner
- Install maven pom files even with the mini package</changelog>
  <changelog author="fstrba@suse.com" date="1578312000">- Let both the log4j12 and log4j12-mini packages obsolete the log4j
  and log4j-mini &lt; 1.3 in order to simplify upgrades</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1578398400">- Remove script jpackage-mini-prepare.sh</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1578398401">- Security fix: [bsc#1159646, CVE-2019-17571]
  * Remote code execution: Deserialization of untrusted data in SocketServer
  * Backported from CVE-2017-5645 for Log4j 2.8.2
- Add log4j-CVE-2019-17571.patch</changelog>
  <changelog author="fstrba@suse.com" date="1584705600">- Added patch:
  * log4j12-bundle_manifest.patch
    + Add a bundle manifest to the log4j12 package so that it can
    be used by eclipse</changelog>
  <changelog author="mailaender@opensuse.org" date="1638187200">- Put GUI tools into separate packages</changelog>
  <changelog author="psimons@suse.com" date="1639656000">- Remove src/main/java/org/apache/log4j/net/JMSAppender.java from
  the build to mitigate CVE-2021-4104. [bsc#1193662]</changelog>
  <changelog author="david.anes@suse.com" date="1641297600">- Fix 'chainsaw' package: [bsc#1193184 - Chainsaw does not start]
  * log4j-chainsaw.sh:
    + Add proper BASE_JARS, using log4j12 instead of log4j.
  * Add missing dependency to log4j12 for 'chainsaw' package.</changelog>
  <changelog author="fstrba@suse.com" date="1642593600">- Remove the chainsaw sub-package (bsc#1194844, CVE-2022-23307)
- Remove src/main/java/org/apache/log4j/jdbc/JDBCAppender.java from
  the build to mitigate bsc#1194843, CVE-2022-23305
- Remove src/main/java/org/apache/log4j/net/JMSSink.java from the
  build to mitigate bsc#1194842, CVE-2022-23302
- Obsolete chainsaw &lt; 2.1 by the log4j12 package
- Added patch:
  * log4j12-missingmodules.patch
    + do not package org.apache.log4j.chainsaw classes
    + package org.apache.log4j.pattern classes that will be needed
    by apache-log4j-extras which is a dependency of chainsaw 2.x</changelog>
</package>
<package pkgid="c185f8ec5f30a641571c4a1a6b4e3bf78f0774e075b4bfa6b54e385017f7ff88" name="log4j12" arch="src">
  <version epoch="0" ver="1.2.17" rel="4.9.1"/>
  <changelog author="tchvatal@suse.com" date="1378728000">- Move from jpackage-utils to javapackage-tools</changelog>
  <changelog author="mvyskocil@suse.com" date="1378987200">- log4j and log4j-mini are in conflict</changelog>
  <changelog author="tchvatal@suse.com" date="1425297600">- Cleanup with a spec-cleaner so I can understand what
  is going around here.</changelog>
  <changelog author="tchvatal@suse.com" date="1425297601">- Version bump to 1.2.17 latest 1.2 series:
  * No short changelog provided - many small changes
- Try to avoid cycle between log4j and apache-common-loggings
- Remove obsoleted patch:
  * log4j-jmx-Agent.patch
- Refresh patch to apply to new source:
  * log4j-mx4j-tools.patch</changelog>
  <changelog author="fstrba@suse.com" date="1505217600">- Specify java source and target level 1.6 to allow building with
  jdk9</changelog>
  <changelog author="bwiedemann@suse.com" date="1515585600">- Add log4j-reproducible.patch to drop javadoc timestamps to make
  package builds more reproducible (boo#1047218)</changelog>
  <changelog author="fstrba@suse.com" date="1532520000">- Require at least java 8 for build</changelog>
  <changelog author="fstrba@suse.com" date="1539864000">- Install and package the maven pom and metadata files for the
  non-bootstrap log4j</changelog>
  <changelog author="fstrba@suse.com" date="1544702400">- Depend on the generic xml-apis</changelog>
  <changelog author="fstrba@suse.com" date="1547553600">- Let log4j provide the log4j-mini and obsolete it too.
- Remove conflicts on each other</changelog>
  <changelog author="fstrba@suse.com" date="1548158400">- Build against a generic javamail provider instead of against
  classpathx-mail</changelog>
  <changelog author="fstrba@suse.com" date="1569931200">- Rename to log4j12/log4j12-mini as a compatibility packages
- Convert to multibuild
- Clean up with the spec-cleaner
- Install maven pom files even with the mini package</changelog>
  <changelog author="fstrba@suse.com" date="1578312000">- Let both the log4j12 and log4j12-mini packages obsolete the log4j
  and log4j-mini &lt; 1.3 in order to simplify upgrades</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1578398400">- Remove script jpackage-mini-prepare.sh</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1578398401">- Security fix: [bsc#1159646, CVE-2019-17571]
  * Remote code execution: Deserialization of untrusted data in SocketServer
  * Backported from CVE-2017-5645 for Log4j 2.8.2
- Add log4j-CVE-2019-17571.patch</changelog>
  <changelog author="fstrba@suse.com" date="1584705600">- Added patch:
  * log4j12-bundle_manifest.patch
    + Add a bundle manifest to the log4j12 package so that it can
    be used by eclipse</changelog>
  <changelog author="mailaender@opensuse.org" date="1638187200">- Put GUI tools into separate packages</changelog>
  <changelog author="psimons@suse.com" date="1639656000">- Remove src/main/java/org/apache/log4j/net/JMSAppender.java from
  the build to mitigate CVE-2021-4104. [bsc#1193662]</changelog>
  <changelog author="david.anes@suse.com" date="1641297600">- Fix 'chainsaw' package: [bsc#1193184 - Chainsaw does not start]
  * log4j-chainsaw.sh:
    + Add proper BASE_JARS, using log4j12 instead of log4j.
  * Add missing dependency to log4j12 for 'chainsaw' package.</changelog>
  <changelog author="fstrba@suse.com" date="1642593600">- Remove the chainsaw sub-package (bsc#1194844, CVE-2022-23307)
- Remove src/main/java/org/apache/log4j/jdbc/JDBCAppender.java from
  the build to mitigate bsc#1194843, CVE-2022-23305
- Remove src/main/java/org/apache/log4j/net/JMSSink.java from the
  build to mitigate bsc#1194842, CVE-2022-23302
- Obsolete chainsaw &lt; 2.1 by the log4j12 package
- Added patch:
  * log4j12-missingmodules.patch
    + do not package org.apache.log4j.chainsaw classes
    + package org.apache.log4j.pattern classes that will be needed
    by apache-log4j-extras which is a dependency of chainsaw 2.x</changelog>
</package>
<package pkgid="b138e51bbf98d0289d18fe94d0d41fa32430903f4421154eaf22c4a228a42a6b" name="log4j12-javadoc" arch="noarch">
  <version epoch="0" ver="1.2.17" rel="4.9.1"/>
  <changelog author="tchvatal@suse.com" date="1425297600">- Cleanup with a spec-cleaner so I can understand what
  is going around here.</changelog>
  <changelog author="tchvatal@suse.com" date="1425297601">- Version bump to 1.2.17 latest 1.2 series:
  * No short changelog provided - many small changes
- Try to avoid cycle between log4j and apache-common-loggings
- Remove obsoleted patch:
  * log4j-jmx-Agent.patch
- Refresh patch to apply to new source:
  * log4j-mx4j-tools.patch</changelog>
  <changelog author="fstrba@suse.com" date="1505217600">- Specify java source and target level 1.6 to allow building with
  jdk9</changelog>
  <changelog author="bwiedemann@suse.com" date="1515585600">- Add log4j-reproducible.patch to drop javadoc timestamps to make
  package builds more reproducible (boo#1047218)</changelog>
  <changelog author="fstrba@suse.com" date="1532520000">- Require at least java 8 for build</changelog>
  <changelog author="fstrba@suse.com" date="1539864000">- Install and package the maven pom and metadata files for the
  non-bootstrap log4j</changelog>
  <changelog author="fstrba@suse.com" date="1544702400">- Depend on the generic xml-apis</changelog>
  <changelog author="fstrba@suse.com" date="1547553600">- Let log4j provide the log4j-mini and obsolete it too.
- Remove conflicts on each other</changelog>
  <changelog author="fstrba@suse.com" date="1548158400">- Build against a generic javamail provider instead of against
  classpathx-mail</changelog>
  <changelog author="fstrba@suse.com" date="1569931200">- Rename to log4j12/log4j12-mini as a compatibility packages
- Convert to multibuild
- Clean up with the spec-cleaner
- Install maven pom files even with the mini package</changelog>
  <changelog author="fstrba@suse.com" date="1578312000">- Let both the log4j12 and log4j12-mini packages obsolete the log4j
  and log4j-mini &lt; 1.3 in order to simplify upgrades</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1578398400">- Remove script jpackage-mini-prepare.sh</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1578398401">- Security fix: [bsc#1159646, CVE-2019-17571]
  * Remote code execution: Deserialization of untrusted data in SocketServer
  * Backported from CVE-2017-5645 for Log4j 2.8.2
- Add log4j-CVE-2019-17571.patch</changelog>
  <changelog author="fstrba@suse.com" date="1584705600">- Added patch:
  * log4j12-bundle_manifest.patch
    + Add a bundle manifest to the log4j12 package so that it can
    be used by eclipse</changelog>
  <changelog author="mailaender@opensuse.org" date="1638187200">- Put GUI tools into separate packages</changelog>
  <changelog author="psimons@suse.com" date="1639656000">- Remove src/main/java/org/apache/log4j/net/JMSAppender.java from
  the build to mitigate CVE-2021-4104. [bsc#1193662]</changelog>
  <changelog author="david.anes@suse.com" date="1641297600">- Fix 'chainsaw' package: [bsc#1193184 - Chainsaw does not start]
  * log4j-chainsaw.sh:
    + Add proper BASE_JARS, using log4j12 instead of log4j.
  * Add missing dependency to log4j12 for 'chainsaw' package.</changelog>
  <changelog author="fstrba@suse.com" date="1642593600">- Remove the chainsaw sub-package (bsc#1194844, CVE-2022-23307)
- Remove src/main/java/org/apache/log4j/jdbc/JDBCAppender.java from
  the build to mitigate bsc#1194843, CVE-2022-23305
- Remove src/main/java/org/apache/log4j/net/JMSSink.java from the
  build to mitigate bsc#1194842, CVE-2022-23302
- Obsolete chainsaw &lt; 2.1 by the log4j12 package
- Added patch:
  * log4j12-missingmodules.patch
    + do not package org.apache.log4j.chainsaw classes
    + package org.apache.log4j.pattern classes that will be needed
    by apache-log4j-extras which is a dependency of chainsaw 2.x</changelog>
</package>
<package pkgid="3c938352820d9fb35582518c72b71541848589134b9b8a9bd226f7868a327d56" name="log4j12-manual" arch="noarch">
  <version epoch="0" ver="1.2.17" rel="4.9.1"/>
  <changelog author="tchvatal@suse.com" date="1425297600">- Cleanup with a spec-cleaner so I can understand what
  is going around here.</changelog>
  <changelog author="tchvatal@suse.com" date="1425297601">- Version bump to 1.2.17 latest 1.2 series:
  * No short changelog provided - many small changes
- Try to avoid cycle between log4j and apache-common-loggings
- Remove obsoleted patch:
  * log4j-jmx-Agent.patch
- Refresh patch to apply to new source:
  * log4j-mx4j-tools.patch</changelog>
  <changelog author="fstrba@suse.com" date="1505217600">- Specify java source and target level 1.6 to allow building with
  jdk9</changelog>
  <changelog author="bwiedemann@suse.com" date="1515585600">- Add log4j-reproducible.patch to drop javadoc timestamps to make
  package builds more reproducible (boo#1047218)</changelog>
  <changelog author="fstrba@suse.com" date="1532520000">- Require at least java 8 for build</changelog>
  <changelog author="fstrba@suse.com" date="1539864000">- Install and package the maven pom and metadata files for the
  non-bootstrap log4j</changelog>
  <changelog author="fstrba@suse.com" date="1544702400">- Depend on the generic xml-apis</changelog>
  <changelog author="fstrba@suse.com" date="1547553600">- Let log4j provide the log4j-mini and obsolete it too.
- Remove conflicts on each other</changelog>
  <changelog author="fstrba@suse.com" date="1548158400">- Build against a generic javamail provider instead of against
  classpathx-mail</changelog>
  <changelog author="fstrba@suse.com" date="1569931200">- Rename to log4j12/log4j12-mini as a compatibility packages
- Convert to multibuild
- Clean up with the spec-cleaner
- Install maven pom files even with the mini package</changelog>
  <changelog author="fstrba@suse.com" date="1578312000">- Let both the log4j12 and log4j12-mini packages obsolete the log4j
  and log4j-mini &lt; 1.3 in order to simplify upgrades</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1578398400">- Remove script jpackage-mini-prepare.sh</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1578398401">- Security fix: [bsc#1159646, CVE-2019-17571]
  * Remote code execution: Deserialization of untrusted data in SocketServer
  * Backported from CVE-2017-5645 for Log4j 2.8.2
- Add log4j-CVE-2019-17571.patch</changelog>
  <changelog author="fstrba@suse.com" date="1584705600">- Added patch:
  * log4j12-bundle_manifest.patch
    + Add a bundle manifest to the log4j12 package so that it can
    be used by eclipse</changelog>
  <changelog author="mailaender@opensuse.org" date="1638187200">- Put GUI tools into separate packages</changelog>
  <changelog author="psimons@suse.com" date="1639656000">- Remove src/main/java/org/apache/log4j/net/JMSAppender.java from
  the build to mitigate CVE-2021-4104. [bsc#1193662]</changelog>
  <changelog author="david.anes@suse.com" date="1641297600">- Fix 'chainsaw' package: [bsc#1193184 - Chainsaw does not start]
  * log4j-chainsaw.sh:
    + Add proper BASE_JARS, using log4j12 instead of log4j.
  * Add missing dependency to log4j12 for 'chainsaw' package.</changelog>
  <changelog author="fstrba@suse.com" date="1642593600">- Remove the chainsaw sub-package (bsc#1194844, CVE-2022-23307)
- Remove src/main/java/org/apache/log4j/jdbc/JDBCAppender.java from
  the build to mitigate bsc#1194843, CVE-2022-23305
- Remove src/main/java/org/apache/log4j/net/JMSSink.java from the
  build to mitigate bsc#1194842, CVE-2022-23302
- Obsolete chainsaw &lt; 2.1 by the log4j12 package
- Added patch:
  * log4j12-missingmodules.patch
    + do not package org.apache.log4j.chainsaw classes
    + package org.apache.log4j.pattern classes that will be needed
    by apache-log4j-extras which is a dependency of chainsaw 2.x</changelog>
</package>
<package pkgid="5245903c39e0b69984b0f2102bd2a5214efed135ca9ec8125f3771bff10f51a8" name="monitoring-plugins" arch="aarch64">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="8049598f85579c783ca1853afbe165031757f33278696930b76188359f6d4a08" name="monitoring-plugins" arch="ppc64le">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="f5241b3f9bf5a7205ff3ecc76242727458988b23b603a56bb2470dd7c4ed1a23" name="monitoring-plugins" arch="s390x">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="b1b352937d6a8ad60a72af60e7daaa7744c2b3d66215fd9b03a3b6a7f5fb482e" name="monitoring-plugins" arch="src">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="d833091c819962a1da1578a01b63aecaa360d3f210948ebcad400c4790bdd9b6" name="monitoring-plugins" arch="x86_64">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="fdfbd80f34378f8b09de50b763ba73920e087d5bb4651184d8dfa7ad38be6705" name="monitoring-plugins-all" arch="aarch64">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="5742a78261bebaf61fffaa5ce7b736e87b3603df5faa015554d054f1ee4b9779" name="monitoring-plugins-all" arch="ppc64le">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="39f30595bc89ef6fde4df2179ad8d7eef066bd5f7212f8916ec31d1cf9868839" name="monitoring-plugins-all" arch="s390x">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="69596b603e9ce9d9dd2bef01e876bdd541f4d4b0e4ee7cee7acb69905d1937e8" name="monitoring-plugins-all" arch="x86_64">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="a0e339ba0680fdb6e512c2e4b1c11a64dad2b3391ef312c91765adf5d463589a" name="monitoring-plugins-breeze" arch="aarch64">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="db715d6cac7f7a6c79afd4173cb04dca733699e2902924d51a933feb27727da4" name="monitoring-plugins-breeze" arch="ppc64le">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="b3f57c6d4e0426389cbdb14a8a0186b98eb4322deaad30aaaed0ca46298ca098" name="monitoring-plugins-breeze" arch="s390x">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="f926b090b406c8ccedf0988888c7517d2850ced25a6aabb4014896281b690de9" name="monitoring-plugins-breeze" arch="x86_64">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="b0573290f3a8c74ae3cb52a7b2b94440f1eee3a8b44aecf839b94f1692442cdc" name="monitoring-plugins-by_ssh" arch="aarch64">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="4cfc46e74e15ae9428604f325aacbe100d88362e3d5ed6e26a06fa5bc10e1f5f" name="monitoring-plugins-by_ssh" arch="ppc64le">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="716e6103a718aba753bc1b39aad65562b7172e5e7a92fdcc3172fa5b3eadf6c9" name="monitoring-plugins-by_ssh" arch="s390x">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="298a8454e4ca2e6cad9fc20a4a2344702f1d6d1b44fe37ce4d2ec4638fd408fd" name="monitoring-plugins-by_ssh" arch="x86_64">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="1a0def8d6a34fcf8c2d2dc9ba0edd1aa3fcc1558781b922c50acd76d332ffbc4" name="monitoring-plugins-cluster" arch="aarch64">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="3125953f4d7f9385917c141954ef499f6c268cd466b297c660ca331c2c7ca1e7" name="monitoring-plugins-cluster" arch="ppc64le">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="edaa347cb7aef80bf1481fccc56df390ab3aee51d1768c308ee9b82fac2c995a" name="monitoring-plugins-cluster" arch="s390x">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="3e66c5eebfa7b8390ed06d9c01a63998c1c213302f2f44a2e8ffff8cbbf16184" name="monitoring-plugins-cluster" arch="x86_64">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="702c8cdd0a4a0976e7caf7b035c8ce035c73e5b6ce0d797daeb137c1b6aac168" name="monitoring-plugins-common" arch="aarch64">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="d3e04de498981176adea22b6817992a573548d3b3fe6ad93adadf22cd5374f61" name="monitoring-plugins-common" arch="ppc64le">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="d4ab5a16efff903856ec64a1c838781f259a75cee4afc2a714f879a21db81ea2" name="monitoring-plugins-common" arch="s390x">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="6924fe74c6683a5e3831024fd87025eff823d96af0e07b9aab4d8a3c60b12273" name="monitoring-plugins-common" arch="x86_64">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="8866644caa5b55c5e825ebea34acd5df331f728fc0ffdde76f103bd6f1ab70f1" name="monitoring-plugins-cups" arch="aarch64">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="39cb13b07dab37d31401f9ecb09ac50f64f98542fcd61a7b36a3a6313537d3f0" name="monitoring-plugins-cups" arch="ppc64le">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="baf274df9ccc5ec2c983a0dea8f6a606a2074e020f20a9d74acdf7f91b80cc0f" name="monitoring-plugins-cups" arch="s390x">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="050d5cac52d592310686c059f9bacf367fbfc3ce44504cff987e5428f6441ad9" name="monitoring-plugins-cups" arch="x86_64">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="5efbbbe6cfc50e571cca63096257cdd057108afb16ce19f28fbddf56716d9cc6" name="monitoring-plugins-dbi" arch="aarch64">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="e45c1a78eec3dd0d390ca624972866ff492aa6cddc6f54463249583a1d54ecdd" name="monitoring-plugins-dbi" arch="ppc64le">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="04a439561bbce8dab149045fe7352528cd2342c2a94f64aa69b2918c5d4e82ca" name="monitoring-plugins-dbi" arch="s390x">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="974c337f0cabccb84a574f12a8d7aede97fd066202051538b12369de514d1596" name="monitoring-plugins-dbi" arch="x86_64">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="2a490fee82e4e279a368513437238fbf075e7afffbf1e92b9fbd312f1ac1355d" name="monitoring-plugins-dbi-mysql" arch="aarch64">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="f42ba36450bbfdcdd196646020767ff2dfefc528edbf2872bb45d3654d4dc5b5" name="monitoring-plugins-dbi-mysql" arch="ppc64le">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="da50068a023d7ea1e361242d0569fd78468d05bb420f9d07ae8c09a3da3e0e20" name="monitoring-plugins-dbi-mysql" arch="s390x">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="62e721e6f8afa0b31f0913a8f4cd93252493e0f1ae160268f943d7a6d8182fea" name="monitoring-plugins-dbi-mysql" arch="x86_64">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="8ecfdc6e075ab8cabda2057ba3386450af58673c86da42210f182f5d61413ac0" name="monitoring-plugins-dbi-pgsql" arch="aarch64">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="654f6b6710e373a2c4f646c0673161e51b25e5e220c867c8592bd250694bd85b" name="monitoring-plugins-dbi-pgsql" arch="ppc64le">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="5315b582025d44e27a56c0d5c44b060adec9acf3274f2cc68ab0a86a0f74165b" name="monitoring-plugins-dbi-pgsql" arch="s390x">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="6526e37c23a94646e159e8f67dacb8b89fcb70e7bc82e71a339d1a7495c2f145" name="monitoring-plugins-dbi-pgsql" arch="x86_64">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="31c0131a134f703f2015fe8d03b2d493caccd911bf1c5cab1efacfebf723c735" name="monitoring-plugins-dbi-sqlite3" arch="aarch64">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="7c35ee4453e25e939a364d7756f28924cb475749c3b58f6755ef7ee760b51893" name="monitoring-plugins-dbi-sqlite3" arch="ppc64le">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="c183b5adc7d8e89c72a8db703c4759490481ea4eb3bfa5e80cbe51163ebed93f" name="monitoring-plugins-dbi-sqlite3" arch="s390x">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="4556965b48218922691fe31cdf8c3c2dafbec261bf976fc1176f758a957f4eb9" name="monitoring-plugins-dbi-sqlite3" arch="x86_64">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="a817f6fe05e4ce978862ae4331b6d8dcce513892fc44381ce6fb4de9563237ec" name="monitoring-plugins-dhcp" arch="aarch64">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="ec4d9e934fb0737d942ab6d1e3b00181792f5156770c13f0079eed844603e3f7" name="monitoring-plugins-dhcp" arch="ppc64le">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="c265719f34d81453ca25a1e9381642a10bac99b18c8967b881713262b0837b68" name="monitoring-plugins-dhcp" arch="s390x">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="cc1693557510dbce17ae9d36d11be438359fef2e48117e2039060ffd98bb2741" name="monitoring-plugins-dhcp" arch="x86_64">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="6939d263fb9e87bd0357e1d67b27a0e84219039c9320ad3b1abf88ddec25e325" name="monitoring-plugins-dig" arch="aarch64">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="aede6d6d61e5e6d207ba42744f348dcc1662d730fae5f313013e503fd7e21329" name="monitoring-plugins-dig" arch="ppc64le">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="bc21f9a1864b6f6d180f739c04b45c2a3777f41e59cdeddf208513a8988f18b3" name="monitoring-plugins-dig" arch="s390x">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="02e847bf360de4fd710f7a3f7b7c1aea297edd9bb0f82eb6efec4c37b2db4bb2" name="monitoring-plugins-dig" arch="x86_64">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="726f59f6b73cbaf7cc7695a7272ea3883a6b1b742851c7a20dbc6ede652f7d07" name="monitoring-plugins-disk" arch="aarch64">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="8c4abc36ece4712915f0302599dd23d20142ae145eb0597ecdd9fc2a09a5fa2f" name="monitoring-plugins-disk" arch="ppc64le">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="4d0c6f66e492b90a47300ed09994f0ab4de8562f3f5b85e8973d7d095f335052" name="monitoring-plugins-disk" arch="s390x">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="544783296fd3f36329a4a3270ac42886f39aef5be27c68dcb01c8f849630be03" name="monitoring-plugins-disk" arch="x86_64">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="f1b7127cad948c61a6a505b6fa81a92acf29bb4d22abb1bd45fb1094fadaae4b" name="monitoring-plugins-disk_smb" arch="aarch64">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="84ad592e58cee634f33085d45ffc0945ac16448f5db35bf567829b5ce772a7f3" name="monitoring-plugins-disk_smb" arch="ppc64le">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="4682b77a0a15e8f7306847f60d46dab272a7e74e6c0bf15c7172251a2627af0e" name="monitoring-plugins-disk_smb" arch="s390x">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="64501eb3a43a2f191c7c12038cc44aef6b4f0fa33a80040bcde83d186bf5e004" name="monitoring-plugins-disk_smb" arch="x86_64">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="e08a7ec489e4fd9ac8f7b9379336cc66072d5ad9752455bd8b80699728f2c6f4" name="monitoring-plugins-dns" arch="aarch64">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="d04b6f698bd36ddb9a86a618e55540e6b05c526b35ee8873276bf227bf3bdb8b" name="monitoring-plugins-dns" arch="ppc64le">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="61f72609fdd6671d92f9a5e4b91692f65f9706c77c5b958b55e5fd298303bcfd" name="monitoring-plugins-dns" arch="s390x">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="fdcd095bf5f1db687a6945bd675edf5ed36e87f83019f874387614b7d37724b8" name="monitoring-plugins-dns" arch="x86_64">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="30eea196a2babf1b43c79d3e9b08538f1ff05f0046e73a2b5b1e110d4b02d313" name="monitoring-plugins-dummy" arch="aarch64">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="840ef6e47927cacb2f90adb87d45b5b9c93d8889875d8ce883a9b944d9e854e1" name="monitoring-plugins-dummy" arch="ppc64le">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="e50f97a83386860ffa01c46b3589477acb757c735a68caa85b1f36ca1781fdf3" name="monitoring-plugins-dummy" arch="s390x">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="18784105cc8e834cd98296c9b875aaa64587bda10d700ef42c489084811901dd" name="monitoring-plugins-dummy" arch="x86_64">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="11da78ad24b9865c576588e794a261fa866a91383f6c55744b3063a5423b4602" name="monitoring-plugins-extras" arch="aarch64">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="6b3910022d757e0e665d9ec2d20ca77edffdac8c4de970a0e9eee55bb35b543c" name="monitoring-plugins-extras" arch="ppc64le">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="0a7c35aa8095d1ea83f1572a5e60ec18e4020200a419805933f43150311df388" name="monitoring-plugins-extras" arch="s390x">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="5b8fdf87df4bbcb7c7ac53587fa7872845ac409de2f3cd87fb0dfac0a20e987d" name="monitoring-plugins-extras" arch="x86_64">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="0f56ae1da7b76c45a6b781d9a8c6625e94459d6dc1a77fdd9c285704088994e2" name="monitoring-plugins-file_age" arch="aarch64">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="f2e82fc766b8235454597689f717ab53a25f30c5d64eacda5349ae81af0069be" name="monitoring-plugins-file_age" arch="ppc64le">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="bd6dea0544b9ae0c832f9aee27a664182f4091afc6e5f08481a260cd8be16b77" name="monitoring-plugins-file_age" arch="s390x">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="013c8ea156f819c819583563a10785771ece0189cdc2ab9565a8134918c56cca" name="monitoring-plugins-file_age" arch="x86_64">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="5f00a0dd8b585977a6fbb37a5ca52abdcbce05bea2f888b4a912381e799d7ad1" name="monitoring-plugins-flexlm" arch="aarch64">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="7937c83496df9e3fb2010719b93ec14cfe5d331ea4694a68edd8157ee823de34" name="monitoring-plugins-flexlm" arch="ppc64le">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="99539915fc4c3f311f8b26238b149b6e1da42ac8f8c26f01e0b5953903a8ca5b" name="monitoring-plugins-flexlm" arch="s390x">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="2de4a5cbad9d0cfce40b722ee4dc95def7611b136f66e9328ddab7667857cbac" name="monitoring-plugins-flexlm" arch="x86_64">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="ef08c80da02f9f53011b843f684d601662cabe2b5656fb6abaab75b6d3bef6b0" name="monitoring-plugins-fping" arch="aarch64">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="c2730f3279240c2a456c7016315b73c4cc7b2de147b3ae7c30d617f151301723" name="monitoring-plugins-fping" arch="ppc64le">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="f2b202d1ef55ad2601b4f77fb7ba3d1b5d37f06be0254476392e3b0f3fe80365" name="monitoring-plugins-fping" arch="s390x">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="8ed3a97690f80124c82e772f1c9086c6ffbcda3a018b3e51dd974812243aef3e" name="monitoring-plugins-fping" arch="x86_64">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="c3dc68c153166a043d89887b9e66af84d7af981f3d7fe8297641ebd2c0e18edd" name="monitoring-plugins-hpjd" arch="aarch64">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="bf1ea48371b92f87d231f3ce3a1f476d0329f328cfd0d740c1769a8d5c938077" name="monitoring-plugins-hpjd" arch="ppc64le">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="0a7987ff23de5ff4f2afd64515fa0f50d261f62ecda0cfe8f56de3e6ecbf6f1f" name="monitoring-plugins-hpjd" arch="s390x">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="9d97d58d0374ec01db4475580dca6f2cab5865f48df9d3baa469c95f7be11f09" name="monitoring-plugins-hpjd" arch="x86_64">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="d90168c822bac31f6e9391b911aad8f0ff29054e88e6ce4c19c41971d18ed40f" name="monitoring-plugins-http" arch="aarch64">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="43278bc03f10e8e369fa26aea90ceafe05a29ea0a1923a43ede903380250ce56" name="monitoring-plugins-http" arch="ppc64le">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="7c1a6fbfbec80e4b6b7e4db07b01eaa0881d7af6f4e1438c74e513493d03075b" name="monitoring-plugins-http" arch="s390x">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="6a1dc4405a0ec50982f490774cce2d863c93e6a6224d720d61005e65d623ad33" name="monitoring-plugins-http" arch="x86_64">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="b7c9953d32adcab6b04668659399d8f262a99c62fbf614f880ba620c6bacffb0" name="monitoring-plugins-icmp" arch="aarch64">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="3dc610cc3240ec8b8e9a9eeddadf36695063a8e1538e960c97cb609da5e3f317" name="monitoring-plugins-icmp" arch="ppc64le">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="fc78ecd934c927fc669bc8d14e007a703ff782c1592505fa6c6a1bf17cbe2d6e" name="monitoring-plugins-icmp" arch="s390x">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="08c292ce5d3eaf9b696915db3f7f8d4883d8b8f30d0b7abdf62229143633efb6" name="monitoring-plugins-icmp" arch="x86_64">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="a9ed264cb49c7199440922c67f054597e2bd4561cb11c7f682c1e7516bdfc436" name="monitoring-plugins-ide_smart" arch="aarch64">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="3431638d9573e4599db954533f1024e6c4415a5f70dc13c62feb99577d4fc169" name="monitoring-plugins-ide_smart" arch="ppc64le">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="f3c5cfa59157891156b868c70e8e5443ad6d1f63b79421d9e921c5f79c5a4ab8" name="monitoring-plugins-ide_smart" arch="s390x">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="2654e03025bd61d1aef5034d2cd0eaa8f731e99974c809df3f9e64c24c396550" name="monitoring-plugins-ide_smart" arch="x86_64">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="cc31bfc3b727248da8fa692fb11511185f8f1b2fcd71965f631e0b0a1b5f8d70" name="monitoring-plugins-ifoperstatus" arch="aarch64">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="0c7fbdcaeee8f8e65b52e98066eb09bc0e2f308e01af36330ffdd2000ae59106" name="monitoring-plugins-ifoperstatus" arch="ppc64le">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="57506bae205f767b5c98118402239aa36e6f11d09b0166720afe8e19f10fa821" name="monitoring-plugins-ifoperstatus" arch="s390x">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="585bb9060ef28d1a35eb9f2e3d0549c97465a315215f513aff29255480933979" name="monitoring-plugins-ifoperstatus" arch="x86_64">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="509260bce5775871b8ad30ae5a93e0f4e0a1dc93e13dd555cda5d6f712f196e8" name="monitoring-plugins-ifstatus" arch="aarch64">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="1319f1d6e5c5a42ea87906c307dabbc3cc7fade2c3f97d66b0b1cb3b305421a7" name="monitoring-plugins-ifstatus" arch="ppc64le">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="09a6ecea09eb68a77996c50589a3c412f7149e97820846a0b708a27a4aa825c0" name="monitoring-plugins-ifstatus" arch="s390x">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="99e20aef79af8bbd8659ac7a45ef2208edc1cd63fd2e9c0172fc57664a8d56bb" name="monitoring-plugins-ifstatus" arch="x86_64">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="388a0f7c2ffbe3a569daf10cea57b619c687bc4ead36a01c5242a5cce598ce15" name="monitoring-plugins-ircd" arch="aarch64">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="af8cc1f3f6f2654690eb1aeaa8b51bf74ff88c090e36c141a63e3754a3fd8a75" name="monitoring-plugins-ircd" arch="ppc64le">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="a392644d60db4cba17167b7749fab184f0844ac802636e3b2f8cf38a6b3881ca" name="monitoring-plugins-ircd" arch="s390x">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="0ba66e065a366bed3ac100b92cdbd803a709f640b3d0540fb86ab9cd6ab63d52" name="monitoring-plugins-ircd" arch="x86_64">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="3c7e59b5a5b90f93b5602728bc46302df719354df7d1a28340eb45f0ad1813a0" name="monitoring-plugins-ldap" arch="aarch64">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="8eb8556088ed53c403f7469862bf8f5639e8dccc118858aaa414878ae8911cd8" name="monitoring-plugins-ldap" arch="ppc64le">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="b828e89be9d31d15eae6a831852abd17f41256cc9a6d4dbb14515ecc19b828d6" name="monitoring-plugins-ldap" arch="s390x">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="fad94c270b7ab8ca00584d42e26e49e6f7c309962825d19b50543469d45eb30d" name="monitoring-plugins-ldap" arch="x86_64">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="18a25c5e47cf0aab394467615cfdee8a873c9e8362f5c3f98f62c89e1a00beed" name="monitoring-plugins-load" arch="aarch64">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="72667c8171d7f0d355f2a75ac4cf8104db6f8fab72f3f9963a81a23ea1a89edd" name="monitoring-plugins-load" arch="ppc64le">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="da7d93189b8ab044e8a9c5e18fba28efc76e6a3b662d2699d54304c4f3cb7996" name="monitoring-plugins-load" arch="s390x">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="834400ef09e700e52bc1cc4e2ce07b7e9d387fc3b82edbde4d272a99ab8caaf8" name="monitoring-plugins-load" arch="x86_64">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="7821be8b65cd9a07706e8ea58c64e1f87ff9ee49f565067c6b1c0c164799ccfc" name="monitoring-plugins-log" arch="aarch64">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="b443659270cdfb25c837d21b691d9148024c5f9ac02c80965adc5e35eb2e532f" name="monitoring-plugins-log" arch="ppc64le">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="a689e8a39c799c4bafe459f1ad1956a0674ebbb69f673c14e39b6ce64596695c" name="monitoring-plugins-log" arch="s390x">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="ca3ae624464e8e9871f57edba682d378e34c49121638d579f40be8783a9fba87" name="monitoring-plugins-log" arch="x86_64">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="48199e669f924186121afd0697f1290d129d5c28881d1586af33ca1825d0a528" name="monitoring-plugins-mailq" arch="aarch64">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="f0ac2714e159baba745289644f71c06f99228cd1486fef594aeed43508426e35" name="monitoring-plugins-mailq" arch="ppc64le">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="bd1fc95841d73d5c5d9781dbde3ebe7266e38bbf961a88817be0f153729184a1" name="monitoring-plugins-mailq" arch="s390x">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="f44be92b8b52b280ccba7414ffd4366616be9788f3acfca7ca1bf18b7c86dc2d" name="monitoring-plugins-mailq" arch="x86_64">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="f812a338885c6b9d0f47f96bcda65843ffdebf7271e02b734148ce4da70fc7ed" name="monitoring-plugins-mrtg" arch="aarch64">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="2690938d1922992b1b30884ebc24e8212eeb5614fe1d19f7f92a2c489442bf37" name="monitoring-plugins-mrtg" arch="ppc64le">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="f887821162f21f525164c4d98adef251035124ef91796898dadfdab35323525a" name="monitoring-plugins-mrtg" arch="s390x">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="7501ec588840d1f143c5e1a31a5e4a5c7e75401b65014e0866de673e58a9d84d" name="monitoring-plugins-mrtg" arch="x86_64">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="e79bcf3893a3f248ab772b691134f21f80cc7a7bc76c3dcf22713b30d4bf4dbc" name="monitoring-plugins-mrtgtraf" arch="aarch64">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="fa5921222599e99cbe8f6a44763e2e673834c4d8234077049c34a6a2b2fef132" name="monitoring-plugins-mrtgtraf" arch="ppc64le">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="dbc0a1595487b8843f8bdceb1670cfc894e67627fecfde6e85aa9f41a154bc1d" name="monitoring-plugins-mrtgtraf" arch="s390x">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="a68a006aae0341014aaca3552469295ba7591b045f359598c5b701bf291b4ef9" name="monitoring-plugins-mrtgtraf" arch="x86_64">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="5c340190e9935d23f3d03dc8ff70cbf628815c8ea8c022f72f4ef382310b05f7" name="monitoring-plugins-mysql" arch="aarch64">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="97266d97a0f528745fa19852eea4156f02d11576c3afd38cce2311cd0f31064e" name="monitoring-plugins-mysql" arch="ppc64le">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="6e2d3a1c1b3c999671468cc010e39c2f4b177d10229144d4a94008a6ade7b354" name="monitoring-plugins-mysql" arch="s390x">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="f953895b49fb5443281c8f1f5eb29a40dff64eb60de56afa4d53a65b8f3e5f72" name="monitoring-plugins-mysql" arch="x86_64">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="e5ff69de3cc2d7bcdb56956355575037c5e593a415454cb4ed3cfe037f35e69d" name="monitoring-plugins-nagios" arch="aarch64">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="d1bccfac53c015616cb10ca38c6cabff83882425e9cc7fa15fcebd1119cb29d9" name="monitoring-plugins-nagios" arch="ppc64le">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="e68fd4e0d8becf7517708bb2d6c98c36bcf34d3abc3b6ab5bf4d16715a3e3989" name="monitoring-plugins-nagios" arch="s390x">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="4a25ae6c0eacf54b45d95afd1c5b5e69a364e0070291ec99c90d3ade4f79ca58" name="monitoring-plugins-nagios" arch="x86_64">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="31b2146c5644919739607d5add6e971f4bbe090a906d96e716214f4a05dbb9ef" name="monitoring-plugins-nt" arch="aarch64">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="5eb5430439420e371969fa437a2160dc48bf8781b83e4112a48fb9ea79e3fef6" name="monitoring-plugins-nt" arch="ppc64le">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="cfcf9d0fa94ca34ad1bd9dbc7d9da65858aa71d6c04a37add225a2867d0eae77" name="monitoring-plugins-nt" arch="s390x">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="1ce5a5f31bd9d779cf5946edad0f95156ae9cd5772c5049c18ed963d48b0d95d" name="monitoring-plugins-nt" arch="x86_64">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="29627f91c5e974ff715cbed935f8a63cd69e99b6f9f21ebcf55bbf07e03ef461" name="monitoring-plugins-ntp_peer" arch="aarch64">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="e90061b755760773f3cc7e1966f2c2fb79aafd7f515e64246c676b3c0d039f51" name="monitoring-plugins-ntp_peer" arch="ppc64le">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="e438141462810e78fd2f61265ba8e9f473d235b294f6e51d99f5a43bf7963733" name="monitoring-plugins-ntp_peer" arch="s390x">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="9c5ed2514a28504b0dc3e68178f40c43909f38525e080f9cf9cd437393c52a24" name="monitoring-plugins-ntp_peer" arch="x86_64">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="af448a3cc70fb4c4d52e3977189c7df81d8e5f8705d72d824b89aca4e05a5e28" name="monitoring-plugins-ntp_time" arch="aarch64">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="5b88aed750169594e727625e11425a4c16a8d5290ade78020ce98f66b23114c0" name="monitoring-plugins-ntp_time" arch="ppc64le">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="d0d642c5109fece738c5ba444ed872026fc663c7a4765f1b82a8a399afe67896" name="monitoring-plugins-ntp_time" arch="s390x">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="539a6d09fea84c109d98933ad8ddb5fbd3062c8118f0c3e6c8c85fa1632b324e" name="monitoring-plugins-ntp_time" arch="x86_64">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="981d1bb6f079cb9c234ef21550e424e030da5f6e5f15b7b8d6f5835f351015f4" name="monitoring-plugins-nwstat" arch="aarch64">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="d9a917251d434512dd18d82a990f23b819f924091887dd866ab91e9822a668f1" name="monitoring-plugins-nwstat" arch="ppc64le">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="cfcf7cc34a013dccb120b16aa746a4cabcb48edb34d29cb51055e680c1c8df68" name="monitoring-plugins-nwstat" arch="s390x">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="420e6cca24746be56cc3199540901898fadf39f122ab4f2fe32ef6a736ab8c34" name="monitoring-plugins-nwstat" arch="x86_64">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="c6db932fcd915604c8f51f1eb205dabcda1d3fc36c82dcd876f2221be708fcdd" name="monitoring-plugins-oracle" arch="aarch64">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="6c61a3130e8483ce50f605a56d045ee7ec71016a99c1a293ed9110829eb77985" name="monitoring-plugins-oracle" arch="ppc64le">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="e06200a025e9ad0304e68c12c22d48d19a5cb7a18626754843f221955e607715" name="monitoring-plugins-oracle" arch="s390x">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="fa7507bd04d0c07cdb3585404269d2b7fbbe86a0b1d9cc63fcfa6e68a67670c8" name="monitoring-plugins-oracle" arch="x86_64">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="52df3bd58bd6f5e01d6490c1c2e85d51cfd288dbf86f2ada486a54bbc20244c8" name="monitoring-plugins-overcr" arch="aarch64">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="82be1b22c5a65077a89003ab96df3ce580f65dcc3a6ddd992e709f08d41224ee" name="monitoring-plugins-overcr" arch="ppc64le">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="eabc6e1d91db21e6d2ba2bfa4677f6535547fca4062481bc36835f8245187c56" name="monitoring-plugins-overcr" arch="s390x">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="9a48e143cb487ecaf2394cf0d34f7805f5262fd2728ead997be2ec3d1b036919" name="monitoring-plugins-overcr" arch="x86_64">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="42a7a9a65d9c71e71618ba16daed98a8f2e3fa7411778bdeef0911b86bc8c013" name="monitoring-plugins-pgsql" arch="aarch64">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="a43e31e119414162905b01a9766ce9b4adeb325de817369e59883a4b95a5ee20" name="monitoring-plugins-pgsql" arch="ppc64le">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="4a2eb74923c74c0386a36f7d5496c840c3362a10a6d722e32b90922577c656de" name="monitoring-plugins-pgsql" arch="s390x">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="e02a7de970d684a26a509a5b5dc4380d7a9707a0961ab282c887af3e773d2221" name="monitoring-plugins-pgsql" arch="x86_64">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="b8c0c58dfcb868a2253f319811bf7b2d8734303dafb24ecded1f03dd12f07a3f" name="monitoring-plugins-ping" arch="aarch64">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="d62a7a090de0a3802cb7b7ee04b207c8d6306fef9af2f22edbbfdf092db6574a" name="monitoring-plugins-ping" arch="ppc64le">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="d033fb856230c3e8c23d0ebac833b2d254fb6390cccee690df59f203f4379d29" name="monitoring-plugins-ping" arch="s390x">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="3f91de1755e22d42842284047f998a258cbaeb630ef925596137043991def566" name="monitoring-plugins-ping" arch="x86_64">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="d61d0c80dea858ee986f16a4282f7aac25341d96522df0b8c86971e3f1d8adb5" name="monitoring-plugins-procs" arch="aarch64">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="7f0e17dcce4d5d789134ad397420d31e97fd39bec1dc8c201b0dacd47ca125a0" name="monitoring-plugins-procs" arch="ppc64le">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="b183a16463d173d9ce237eae035ad99ddf71b179157649fa4c1a26e0223a2fc9" name="monitoring-plugins-procs" arch="s390x">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="6d02db59bb7db9f8aa87f31320c963b3d61751254a97a508058a512467defe37" name="monitoring-plugins-procs" arch="x86_64">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="2e3c37622134a5546b193b043d1d37488aa63d783e63f6bb61f7d32095539db5" name="monitoring-plugins-radius" arch="aarch64">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="64afd45cffaec682d1e0b763dce31ef1803e7a6f4f617bcfb96d219b068ed0cd" name="monitoring-plugins-radius" arch="ppc64le">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="00d1d3c9fffcc1cad22db1809deb8b371b763129e5faf3af1312c1c39f0882d4" name="monitoring-plugins-radius" arch="s390x">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="e8271e846d62cdca3c3fd584a38f5347d93ea9061ca8ae8c47c5e62f1384c269" name="monitoring-plugins-radius" arch="x86_64">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="2a260dd97c24631497a686ac265dd9d10676cb0934b0d15415bd7e70800ba1db" name="monitoring-plugins-real" arch="aarch64">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="1c02cde34b6596237e3cf253399cf4813091c2d6be5dc1562eb455cd07642e9c" name="monitoring-plugins-real" arch="ppc64le">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="cb9a94e640d3439fb70bfdb5d5c3fb33d2767e493795242e17a1dd5e391a54d5" name="monitoring-plugins-real" arch="s390x">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="e6c7edd28204cf5eb1b759f67c68b4eb34ab0b9d19a7425796a53f770d281464" name="monitoring-plugins-real" arch="x86_64">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="bdc039afb58d9a7030f7f829a49a699f811b046680d63be41378dae8e8594017" name="monitoring-plugins-rpc" arch="aarch64">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="8fd465907bbcc2d5328284eb7a9f1e0ca3287f2d454794acd5c02b7fbe79461f" name="monitoring-plugins-rpc" arch="ppc64le">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="ac8bc43573da465325cb66c5b19845245390bc03510dc4bf8c01acd5385b07a7" name="monitoring-plugins-rpc" arch="s390x">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="29df9483e617358b74e2a9e2752957a937be79545eb2459eecf76f071ed40594" name="monitoring-plugins-rpc" arch="x86_64">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="b605cb80aae618519b9077d9461d5d65ceef941178e2751139e93be481984fb0" name="monitoring-plugins-sensors" arch="aarch64">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="6248c01adee8d03c2ef325f6a5f8640554d2933c9baee8c88e8230937a48f77a" name="monitoring-plugins-sensors" arch="ppc64le">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="ef195c1018acec41cb2fb47bc6eb4b7c59053b55c7f98ab9d52e04b79477037c" name="monitoring-plugins-sensors" arch="x86_64">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="6905fd077b8afa8af14d4f0e85f680a5cbfc82e5aae7fb47a31012a77dd0fdde" name="monitoring-plugins-smtp" arch="aarch64">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="8577547896112315b523d5e8de287919c8538a9d4102a16cd4aeb50baeed230c" name="monitoring-plugins-smtp" arch="ppc64le">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="9e2da142764380179c78f84024edc5e123c08b9a8987cb0a8ed78b30ad0c0a65" name="monitoring-plugins-smtp" arch="s390x">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="574d571d698962411ee624d788d62d4cbc51265b89625f758fb9ae7b09562249" name="monitoring-plugins-smtp" arch="x86_64">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="01fb5ae45243c6f4759dfac881c2dccf892adf3ecb31cc42dab850eb7e1f89cc" name="monitoring-plugins-snmp" arch="aarch64">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="4ffa1c9c2f523df6b2f47d8fadad9d3a46a07a31fc5eec88b2656630487d69ec" name="monitoring-plugins-snmp" arch="ppc64le">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="7106ab5e74d7104a58b205055110c57ccd8ea280c5deb4efdd1c2ac6af118bc6" name="monitoring-plugins-snmp" arch="s390x">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="a842178867d60858946c71dc05110cffe9e52ca493e7b37c93e257136a67207c" name="monitoring-plugins-snmp" arch="x86_64">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="8ecbdd6e748a0ac0b21b668f4f08f8d59d04188152c14332d41526e9752f5465" name="monitoring-plugins-ssh" arch="aarch64">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="39ec0794e9af5ca3a88d06ba7f868ff3effed4184876dfe3d25c05b9515ffa18" name="monitoring-plugins-ssh" arch="ppc64le">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="21f16c82e9d76a8178f86093fda88a5a76a4953874c6189a245015cb7f0a64ae" name="monitoring-plugins-ssh" arch="s390x">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="df20b60acefc013d0e791fd680895b2b2898300325afd3d72f4b3afaf78fa31c" name="monitoring-plugins-ssh" arch="x86_64">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="613812f2dd276c64157ef872263d0ac6d054907630cc95e839f5844002c0fb63" name="monitoring-plugins-swap" arch="aarch64">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="819b91cd8ad246b5a6e9fc8e2c63ea4e611450e44cb261515d2f7feb3d9c077c" name="monitoring-plugins-swap" arch="ppc64le">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="ac0082b50ec33db61e648fc54428dc80f4b6cd791fa24ad18bb95d65daec6f23" name="monitoring-plugins-swap" arch="s390x">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="e4df1873e78bb4bb04f058738a454f68c27824543f27f95e0ce27c2f835a6542" name="monitoring-plugins-swap" arch="x86_64">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="0e20ac549486386258eeda98a760fd2cc70e330515aaa5768a6da64589160273" name="monitoring-plugins-tcp" arch="aarch64">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="7ace2622676d6224f7f7e001e48d973d6d07427b9f14779f78a73897ed0267fc" name="monitoring-plugins-tcp" arch="ppc64le">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="cbb36b109f3cb0eaeac78aee39b23af767b479efd947e7ab32eee617232b1fe0" name="monitoring-plugins-tcp" arch="s390x">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="73113255be7655d4fd44980f196e9e125a0b1bb72555e97f906dfbbe4483a8e0" name="monitoring-plugins-tcp" arch="x86_64">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="4274f799649385cfbb8d9cca818dcde89c61f5660b9fedb990a9fd02ce744b00" name="monitoring-plugins-time" arch="aarch64">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="426fa0fa498f56ef612c017f235df3ab9c099b00aa21c4c6148ca42d811a6258" name="monitoring-plugins-time" arch="ppc64le">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="b46368dd98b519a4585e2a149065b01ae04ac2aeef307146dedaa6d2d293a2db" name="monitoring-plugins-time" arch="s390x">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="a69118a2160e6b204f447921fb960946fab9e02a5a0a7bf2ddb1e431564eb111" name="monitoring-plugins-time" arch="x86_64">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="2225d2caa3285be3302df299ea34645fb243f8dd63a32e900c3dacb1a5ba1171" name="monitoring-plugins-ups" arch="aarch64">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="67029f3bfa8dbaa46f5e91c8c95101ed6f9516610d36973be271b01deb5adc25" name="monitoring-plugins-ups" arch="ppc64le">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="d322cd016913ef6344ab3e4138830a7d633251fdb4533e5ac52cc9eaaea07ab7" name="monitoring-plugins-ups" arch="s390x">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="ba5b6729b53ad7f762b7d0fb659d68b994a2f17f39b824d2d121f4a969cea25e" name="monitoring-plugins-ups" arch="x86_64">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="dd060d4869f087f5ae290c0f7b186ddca069a671df0070d5c04004aa0c9ae8b4" name="monitoring-plugins-users" arch="aarch64">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="c58217ba86916441cf2716e0c750e7d129f32714ad9c831b9b685e57e44063f2" name="monitoring-plugins-users" arch="ppc64le">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="dfe979704ece1e7bb7bad0df5c4c4487cc7fa0be0016395f7ec2271c63b6928b" name="monitoring-plugins-users" arch="s390x">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="0ccb6e645156ab876f6794e2dbd049444bae63cfac49b01261aa3be49ede74ba" name="monitoring-plugins-users" arch="x86_64">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="4af695258806287cba81c38fec3758d9933e06543a022924dce78a644887ba6d" name="monitoring-plugins-wave" arch="aarch64">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="265bce874f7bf3e333e187c4b0ffede0931df9f0190169fb054065590c8c4fd2" name="monitoring-plugins-wave" arch="ppc64le">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="58164bc5d3d883f14f0ae08cda1174ac8de24ed8fb37f199c37b64d46bf2e971" name="monitoring-plugins-wave" arch="s390x">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="248a1159a0b3b475d7dce7ce7ef0497af0b6564a646f54c4367efb905f90bcef" name="monitoring-plugins-wave" arch="x86_64">
  <version epoch="0" ver="2.3.1" rel="3.9.2"/>
  <changelog author="ro@suse.de" date="1533816000">- copy usr.lib.nagios.plugins.check_procs as
  usr.lib.nagios.plugins.check_procs.sle15 and use that for sle15
  and above. "ptrace" to enable ptrace globally is needed here.</changelog>
  <changelog author="lars@linux-schulserver.de" date="1538568000">- add /etc/nrpe.d/*.cfg snipplets for
  + nrpe-check_load =&gt; check_load
  + nrpe-check_mailq =&gt; check_mailq
  + nrpe-check_ntp_time =&gt; check_ntp_time
  + nrpe-check_swap =&gt; check_swap
  + nrpe-check_total_procs =&gt; check_procs
  + nrpe-check_zombie_procs =&gt; check_procs
  + nrpe-check_users =&gt; check_users
  + nrpe-check_mysql =&gt; check_mysql
  + nrpe-check_proc_cron =&gt; check_procs
  + nrpe-check_partition =&gt; check_disk
  + nrpe-check_ups =&gt; check_ups
- use %%license macro on newer versions</changelog>
  <changelog author="ro@suse.de" date="1543579200">- update usr.lib.nagios.plugins.check_procs again for &gt;= sle15
  case so that ptrace is allowed (boo#1133107)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1554811200">- support IPv4 ping for dual stacked host again: check_ping_fix_ip4.patch</changelog>
  <changelog author="ro@suse.de" date="1555070400">- update usr.lib.nagios.plugins.check_procs to bash in /usr</changelog>
  <changelog author="suse-beta@cboltz.de" date="1555243200">- update AppArmor profiles for usrMerge (related to boo#1132350)
  - grep in check_cups
  - ps in check_procs and check_procs.sle15</changelog>
  <changelog author="ro@suse.de" date="1556020800">- apply check_ping_fix_ip4.patch only for suse_version &gt;= 1500
  sle12/leap42 ping does not know the -4 parameter (boo#1132903)</changelog>
  <changelog author="lars@linux-schulserver.de - 2.2" date="1563192000">- monitoring-plugins-mysql should also provide monitoring-plugins-mysql_query
- Provide/Obsolete nagios-plugins in old version for better
  compatibility and to allow dist upgrade (boo#1114483)</changelog>
  <changelog author="ro@suse.de" date="1600084800">- include upstream fixes for check_swap
- add patch monitoring-plugins-check_swap-fix_comment.patch
  simply fix the plugin name in the comment
- monitoring-plugins-check_swap-fix_zero_output.patch
  improve the output if the swap has zero size
- monitoring-plugins-check_swap-return_unknown.patch
  use unknown exit code for help/version in plugins
- add patch monitoring-plugins-check_swap-fix-n.patch
  check_swap fix behaviour for "-n" if 0 free swap is left
  from git commit 6995b510759cf531d70745b7d0c6e8a0d9010b06
  (bug#1175828)
- updated context in
  monitoring-plugins-wrong_return_in_check_swap.patch</changelog>
  <changelog author="ro@suse.de" date="1600084801">- change version to 2.3~alpha.$date.$commit
  update to current git as of 20200520T233014.cadac85e
  changes summarized
  * detect unreachable dns service in nslookup output
  * check_curl: host_name may be null
  * update test parameter according to check_http
  * check_curl: use CURLOPT_RESOLVE to fix connecting to the right ip
  * workaround for issue #1550 - better use "ping -4" instead
    of "ping" if supported
  * Use size_t instead of int when calling sysctl(3)
  * check_tcp: add --sni
  * Fix timeout_interval declarations
  * check_curl: NSS, parse more date formats from certificate (in
  - C cert check)
  * check_curl: more tolerant CN= parsing when checking
    certificates (hit on Centos 8)
  * setting no_body to TRUE when we have a HEAD request
  * some LIBCURL_VERSION checks around HTTP/2 feature
  * added --http-version option to check_curl to choose HTTP
  * improved curlhelp_parse_statusline to handle both HTTP/1.x
    and HTTP/2
  * check_curl: updates embedded picohttpparser to newest git
    version
  * setting progname of check_curl plugin to check_curl (at least
    for now)
  * Allow mariadbclient to be used for check_mysql
  * fix maxfd being zero
  * include -P switch in help
  * check_swap: repaired "-n" behaviour
  * improve command examples for 'at least' processes
  * check_mysql: Allow sockets to be specified to -H
  * Adding packages-warning option to check_apt plugin
  * Adding print top consuming processes option to check_load
  * check_snmp: make calcualtion of timeout value in help output more clear
  * [check_disk] add support to display inodes usage in perfdata
  * check_by_ssh: fix child process leak on timeouts
  * check_icmp: Add IPv6 support
  * check_dns: fix typo in parameter description
  * Also support the --show-body/-B flag when --expect is used
  * check_dns: improve support for checking multiple addresses
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_icmp: emit error if multiple protocol version
  * check_icmp: move opts string into a variable
  * check_cluster.c: Added data argument validation.
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: process protocol version args first
  * check_icmp: Add IPv6 support
- monitoring-plugins-1.4.6-no_chown.patch
  drop hunk for Makefile.in (not present in git)
- monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  update context
- deleted monitoring-plugins-check_swap-fix-n.patch
  drop patch, is upstream
- drop explicit attr in filelist for check_host and check_rta_multi
  as they are symlinks to check_icmp
- add new subpackage monitoring-plugins-uptime</changelog>
  <changelog author="opensuse@dstoecker.de" date="1600430400">- Drop check_ping_fix_ip4.patch (obsolete, conflicts with upstream fix)</changelog>
  <changelog author="ro@suse.de" date="1602590400">- add patch monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  return ntp offset absolute (as positive value) in performance
  data since warn and crit are also positive values</changelog>
  <changelog author="lars@linux-schulserver.de" date="1610625600">- Update to 2.3 (final):
  Enhancements
  * check_dns: allow 'expected address' (-a) to be specified in CIDR notation (IPv4 only).
  * check_dns: allow for IPv6 RDNS
  * check_dns: Accept CIDR
  * check_dns: allow unsorted addresses
  * check_dns: allow forcing complete match of all addresses
  * check_apt: add --only-critical switch
  * check_apt: add -l/--list option to print packages
  * check_file_age: add range checking
  * check_file_age: enable to test for maximum file size
  * check_apt: adding packages-warning option
  * check_load: Adding top consuming processes option
  * check_http: Adding Proxy-Authorization and extra headers
  * check_snmp: make calcualtion of timeout value in help output more clear
  * check_uptime: new plugin for checking uptime to see how long the system is running
  * check_curl: check_http replacement based on libcurl
  * check_http: Allow user to specify HTTP method after proxy CONNECT
  * check_http: Add new flag --show-body/-B to print body
  * check_cluster: Added data argument validation
  * check_icmp: Add IPv6 support
  * check_icmp: Automatically detect IP protocol
  * check_icmp: emit error if multiple protocol version
  * check_disk: add support to display inodes usage in perfdata
  * check_hpjd: Added -D option to disable warning on 'out of paper'
  * check_http: support the --show-body/-B flag when --expect is used
  * check_mysql: allow mariadbclient to be used
  * check_tcp: add --sni
  * check_dns: detect unreachable dns service in nslookup output
  Fixes
  * Fix regression where check_dhcp was rereading response in a tight loop
  * check_dns: fix error detection on sles nslookup
  * check_disk_smb: fix timeout issue
  * check_swap: repaired -n behaviour
  * check_icmp: Correctly set address_family on lookup
  * check_icmp: Do not overwrite -4,-6 on lookup
  * check_smtp: initializes n before it is used
  * check_dns: fix typo in parameter description
  * check_by_ssh: fix child process leak on timeouts
  * check_mysql: Allow sockets to be specified to -H
  * check_procs: improve command examples for 'at least' processes
  * check_disk: include -P switch in help
  * check_mailq: restore accidentially removed options</changelog>
  <changelog author="lars@linux-schulserver.de" date="1619006400">- Update to 2.3.1:
  Enhancements
  * check_curl: Add an option to verify the peer certificate &amp; host using the system CA's
  Fixes
  * check_icmp: fix simple typo, conspicuosly -&gt; conspicuously
  * check_curl: fixed help, usage and errors for TLS 1.3
  * check_curl: fixed a potential buffer overflow in url buffer
  * check_dns: split multiple IP addresses passed in one -a argument
  * check_curl: added string_statuscode function for printing HTTP/1.1 and HTTP/2 correctly
  * check_curl: fix crash if http header contains leading spaces
  * check_curl: display a specific human-readable error message where possible
  * check_pgsql: Using snprintf which honors the buffers size and guarantees null termination.
  * check_snmp: put the "c" (to mark a counter) after the perfdata value
  * check_http: Increase regexp limit
  * check_http: make -C obvious
  * check_curl: Increase regexp limit (to 1024 as in check_http)
  * check_curl: make -C obvious (from check_http)
- refreshed patches:
  + monitoring-plugins-1.4.6-no_chown.patch
  + monitoring-plugins-2.1.1-check_logfile.patch
  + monitoring-plugins-2.2-mariadb_102_build_fix.patch
  + monitoring-plugins-2.3-check_ntp_perf_absolute.patch
  + monitoring-plugins-too_few_arguments_for_check_disk.patch
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins.check_hpjd.c-64bit-portability-issue.patch
  + monitoring-plugins.check_snmp.arrayaddress.patch
- add sha1 checksum file as source</changelog>
  <changelog author="bwiedemann@suse.com" date="1625140800">- Call gettextize with --no-changelog to make package build
  reproducible (boo#1047218)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1627300800">- Remove unneeded BuildRequires on python-devel (bsc#1191011)</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Remove unneeded build requirement on "syslog"</changelog>
  <changelog author="lars@linux-schulserver.de" date="1637323200">- recommend syslog for monitoring-plugins-log, as people probably
  want to analize logs generated by (r)syslog or journald
  Renamed patches:
- renamed monitoring-plugins-1.4.6-no_chown.patch to
  monitoring-plugins-1.4.6-Makefile_-_no_chown.patch to make it
  easier to detect the patched file
- renamed monitoring-plugins-2.1.1-check_logfile.patch to
  monitoring-plugins-2.1.1-check_log_-_quoting.patch to make it
  easier to detect the patched file and reason for the patch
  New patches:
- added monitoring-plugins-2.3.1-check_snmp_segfaults.patch
  check_snmp will segfaults at line 489 if number of lines returned
  by SNMPD is greater than number of defined thresholds
  - &gt; https://github.com/monitoring-plugins/monitoring-plugins/pull/1589
- added monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  When the MIBs are not quite right, snmpget outputs lots of errors on
  STDERR before getting down to business.
  If this is enough to fill the pipe buffer, snmpget hangs waiting for
  it to be cleared, which it never will be because check_snmp is
  waiting for snmpget to output something on STDOUT.
  This simple fix from s2156945 for this is to read STDERR before STDOUT.
  cmd_run_array from utils_cmd.c is also used by plugins/check_by_ssh
  and plugins/negate but you're likely to get lots of errors or lots
  of output, not both at the same time.
  The real fix is probably to do a select() and read from both as
  they come in.
  https://github.com/monitoring-plugins/monitoring-plugins/issues/1706
- added monitoring-plugins-2.3.1-check_dhcp_-_detect_rogue_dhcp_servers.patch
  feature enhancement from Patrick Cervicek for check_dhcp, which allows
  to detect rogue DHCP servers. Use it with the "-x" flag, example:
  ./check_dhcp -s 192.168.1.1 -x
  CRITICAL: Rogue DHCP Server detected! Server 192.168.1.205 offered 192.168.1.239
- added monitoring-plugins-2.3.1-check_ssh.patch , which includes patches
  provided by op5, mainly around RFC 4253:4.2 and 4253:5
  + fixing a few typos
  + properly parse a (delayed) version control string
  + Handle non-alpha software versions reported by the checked service
- added monitoring-plugins-2.3.1-check_ssh.t_-_improve_testing.patch
  which improves the testing of check_ssh - including the patches mentioned in
  monitoring-plugins-2.3.1-check_ssh.patch
- added monitoring-plugins-2.3.1-fixing-shellcheck.patch , which fixes
  some complains from shellcheck(.net):
  + quoting and parenthesis in check_log.sh, check_oracle.sh, check_sensors.sh</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638446400">- remove monitoring-plugins-2.3.1-check_snmp_hang_on_STDERR_workaround.patch
  the patch just reverts the problem, if you get more than 64K on
  stdout</changelog>
  <changelog author="lars@linux-schulserver.de" date="1638532800">- removed the following, either upstreamed or integrated in other patches:
  + monitoring-plugins-wrong_return_in_check_swap.patch
  + monitoring-plugins-check_swap-fix_comment.patch
  + monitoring-plugins-check_swap-return_unknown.patch
  + monitoring-plugins-check_swap-fix-n.patch</changelog>
</package>
<package pkgid="6ca285cd40b2af3a2b97e414ebb914a315fea58a4d50700154b97422a7990f10" name="mspack-tools" arch="aarch64">
  <version epoch="0" ver="0.6" rel="3.14.1"/>
  <changelog author="sbrabec@suse.cz" date="1421755200">- Fix possible infinite loop caused DoS (bnc912214, CVE-2014-9556,
  libmspack-qtmd_decompress-loop.patch).</changelog>
  <changelog author="p.drouand@gmail.com" date="1423656000">- Update to version 0.5
  * Please read the changelog; too many things to list</changelog>
  <changelog author="sbrabec@suse.cz" date="1425038400">- Remove problematic libmspack-qtmd_decompress-loop.patch
  (bnc#912214#c10).
  Version 0.5 has a correct fix dated 2015-01-05.</changelog>
  <changelog author="mardnh@gmx.de" date="1516017600">- Update to version 0.6
  * read_spaninfo(): a CHM file can have no ResetTable and have a
  negative length in SpanInfo, which then feeds a negative output
  length to lzxd_init(), which then sets frame_size to a value of
  your choosing, the lower 32 bits of output length, larger than
  LZX_FRAME_SIZE. If the first LZX block is uncompressed, this
  writes data beyond the end of the window.
  This issue was raised by ClamAV as CVE-2017-6419.
  * lzxd_init(), lzxd_set_output_length(), mszipd_init(): due to the
  issue mentioned above, these functions now reject negative lengths
  * cabd_read_string(): add missing error check on result of read().
  If an mspack_system implementation returns an error, it's
  interpreted as a huge positive integer, which leads to reading
  past the end of the stack-based buffer.
  This issue was raised by ClamAV as CVE-2017-11423
- Add subpackage for helper tools
- Run spec-cleaner</changelog>
  <changelog author="mardnh@gmx.de" date="1516104000">- Fix typo</changelog>
  <changelog author="jengelh@inai.de" date="1516104001">- Correct SRPM group.</changelog>
  <changelog author="adam.majer@suse.de" date="1516363200">- Correct mspack-tools group to Productivity/File utilities</changelog>
  <changelog author="mcalabkova@suse.com" date="1540555200">- Added patches:
  * libmspack-resize-buffer.patch -- CAB block input buffer is one
    byte too small for maximal Quantum block.
  * libmspack-fix-bounds-checking.patch --  Fix off-by-one bounds
    check on CHM PMGI/PMGL chunk numbers and reject empty filenames.
  * libmspack-reject-blank-filenames.patch -- Avoid returning CHM
    file entries that are "blank" because they have embedded null
    bytes.
  * (the last two patches were modified by removing unneeded part
    in order to make them more independent)
- Fixed bugs:
  * CVE-2018-18584 (bsc#1113038)
  * CVE-2018-18585 (bsc#1113039)</changelog>
  <changelog author="mcalabkova@suse.com" date="1553860800">- Enable build-time tests (bsc#1130489)
  * Added patch libmspack-failing-tests.patch</changelog>
  <changelog author="kstreitova@suse.com" date="1572868800">- add libmspack-0.6alpha-CVE-2019-1010305.patch to fix a buffer
  overflow in chmd_read_headers(): a CHM file name beginning "::"
  but shorter than 33 bytes will lead to reading past the
  freshly-allocated name buffer - checks for specific control
  filenames didn't take length into account [bsc#1141680]
  [CVE-2019-1010305]</changelog>
  <changelog author="danilo.spinella@suse.com" date="1626264000">- There is an off-by-one error in the CHM PMGI/PMGL chunk number validity
  checks, which could lead to denial of service
  (CVE-2018-14679, bsc#1103032)
  * libmspack-CVE-2018-14679.patch
- Bad KWAJ file header extensions could cause a one or two byte overwrite
  (CVE-2018-14681, bsc#1103032).
  * libmspack-CVE-2018-14681.patch
- There is an off-by-one error in the TOLOWER() macro for CHM decompression
  (CVE-2018-14682, bsc#1103032).
  * libmspack-CVE-2018-14682.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1641384000">- chmextract.c add anti "../" and leading slash protection to chmextract
  (CVE-2018-18586.patch, bsc#1113040)
  * cve-2018-18586.patch</changelog>
</package>
<package pkgid="efdbcc2bb4bb569a4a221a13260dbdb264a93ca3971bce1bd2ed568ab15ed5e4" name="mspack-tools" arch="ppc64le">
  <version epoch="0" ver="0.6" rel="3.14.1"/>
  <changelog author="sbrabec@suse.cz" date="1421755200">- Fix possible infinite loop caused DoS (bnc912214, CVE-2014-9556,
  libmspack-qtmd_decompress-loop.patch).</changelog>
  <changelog author="p.drouand@gmail.com" date="1423656000">- Update to version 0.5
  * Please read the changelog; too many things to list</changelog>
  <changelog author="sbrabec@suse.cz" date="1425038400">- Remove problematic libmspack-qtmd_decompress-loop.patch
  (bnc#912214#c10).
  Version 0.5 has a correct fix dated 2015-01-05.</changelog>
  <changelog author="mardnh@gmx.de" date="1516017600">- Update to version 0.6
  * read_spaninfo(): a CHM file can have no ResetTable and have a
  negative length in SpanInfo, which then feeds a negative output
  length to lzxd_init(), which then sets frame_size to a value of
  your choosing, the lower 32 bits of output length, larger than
  LZX_FRAME_SIZE. If the first LZX block is uncompressed, this
  writes data beyond the end of the window.
  This issue was raised by ClamAV as CVE-2017-6419.
  * lzxd_init(), lzxd_set_output_length(), mszipd_init(): due to the
  issue mentioned above, these functions now reject negative lengths
  * cabd_read_string(): add missing error check on result of read().
  If an mspack_system implementation returns an error, it's
  interpreted as a huge positive integer, which leads to reading
  past the end of the stack-based buffer.
  This issue was raised by ClamAV as CVE-2017-11423
- Add subpackage for helper tools
- Run spec-cleaner</changelog>
  <changelog author="mardnh@gmx.de" date="1516104000">- Fix typo</changelog>
  <changelog author="jengelh@inai.de" date="1516104001">- Correct SRPM group.</changelog>
  <changelog author="adam.majer@suse.de" date="1516363200">- Correct mspack-tools group to Productivity/File utilities</changelog>
  <changelog author="mcalabkova@suse.com" date="1540555200">- Added patches:
  * libmspack-resize-buffer.patch -- CAB block input buffer is one
    byte too small for maximal Quantum block.
  * libmspack-fix-bounds-checking.patch --  Fix off-by-one bounds
    check on CHM PMGI/PMGL chunk numbers and reject empty filenames.
  * libmspack-reject-blank-filenames.patch -- Avoid returning CHM
    file entries that are "blank" because they have embedded null
    bytes.
  * (the last two patches were modified by removing unneeded part
    in order to make them more independent)
- Fixed bugs:
  * CVE-2018-18584 (bsc#1113038)
  * CVE-2018-18585 (bsc#1113039)</changelog>
  <changelog author="mcalabkova@suse.com" date="1553860800">- Enable build-time tests (bsc#1130489)
  * Added patch libmspack-failing-tests.patch</changelog>
  <changelog author="kstreitova@suse.com" date="1572868800">- add libmspack-0.6alpha-CVE-2019-1010305.patch to fix a buffer
  overflow in chmd_read_headers(): a CHM file name beginning "::"
  but shorter than 33 bytes will lead to reading past the
  freshly-allocated name buffer - checks for specific control
  filenames didn't take length into account [bsc#1141680]
  [CVE-2019-1010305]</changelog>
  <changelog author="danilo.spinella@suse.com" date="1626264000">- There is an off-by-one error in the CHM PMGI/PMGL chunk number validity
  checks, which could lead to denial of service
  (CVE-2018-14679, bsc#1103032)
  * libmspack-CVE-2018-14679.patch
- Bad KWAJ file header extensions could cause a one or two byte overwrite
  (CVE-2018-14681, bsc#1103032).
  * libmspack-CVE-2018-14681.patch
- There is an off-by-one error in the TOLOWER() macro for CHM decompression
  (CVE-2018-14682, bsc#1103032).
  * libmspack-CVE-2018-14682.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1641384000">- chmextract.c add anti "../" and leading slash protection to chmextract
  (CVE-2018-18586.patch, bsc#1113040)
  * cve-2018-18586.patch</changelog>
</package>
<package pkgid="74ea3cf63588ddc13c03fa3c66f1cc254ce1e38d7e643df1cfde03afecc247c8" name="mspack-tools" arch="s390x">
  <version epoch="0" ver="0.6" rel="3.14.1"/>
  <changelog author="sbrabec@suse.cz" date="1421755200">- Fix possible infinite loop caused DoS (bnc912214, CVE-2014-9556,
  libmspack-qtmd_decompress-loop.patch).</changelog>
  <changelog author="p.drouand@gmail.com" date="1423656000">- Update to version 0.5
  * Please read the changelog; too many things to list</changelog>
  <changelog author="sbrabec@suse.cz" date="1425038400">- Remove problematic libmspack-qtmd_decompress-loop.patch
  (bnc#912214#c10).
  Version 0.5 has a correct fix dated 2015-01-05.</changelog>
  <changelog author="mardnh@gmx.de" date="1516017600">- Update to version 0.6
  * read_spaninfo(): a CHM file can have no ResetTable and have a
  negative length in SpanInfo, which then feeds a negative output
  length to lzxd_init(), which then sets frame_size to a value of
  your choosing, the lower 32 bits of output length, larger than
  LZX_FRAME_SIZE. If the first LZX block is uncompressed, this
  writes data beyond the end of the window.
  This issue was raised by ClamAV as CVE-2017-6419.
  * lzxd_init(), lzxd_set_output_length(), mszipd_init(): due to the
  issue mentioned above, these functions now reject negative lengths
  * cabd_read_string(): add missing error check on result of read().
  If an mspack_system implementation returns an error, it's
  interpreted as a huge positive integer, which leads to reading
  past the end of the stack-based buffer.
  This issue was raised by ClamAV as CVE-2017-11423
- Add subpackage for helper tools
- Run spec-cleaner</changelog>
  <changelog author="mardnh@gmx.de" date="1516104000">- Fix typo</changelog>
  <changelog author="jengelh@inai.de" date="1516104001">- Correct SRPM group.</changelog>
  <changelog author="adam.majer@suse.de" date="1516363200">- Correct mspack-tools group to Productivity/File utilities</changelog>
  <changelog author="mcalabkova@suse.com" date="1540555200">- Added patches:
  * libmspack-resize-buffer.patch -- CAB block input buffer is one
    byte too small for maximal Quantum block.
  * libmspack-fix-bounds-checking.patch --  Fix off-by-one bounds
    check on CHM PMGI/PMGL chunk numbers and reject empty filenames.
  * libmspack-reject-blank-filenames.patch -- Avoid returning CHM
    file entries that are "blank" because they have embedded null
    bytes.
  * (the last two patches were modified by removing unneeded part
    in order to make them more independent)
- Fixed bugs:
  * CVE-2018-18584 (bsc#1113038)
  * CVE-2018-18585 (bsc#1113039)</changelog>
  <changelog author="mcalabkova@suse.com" date="1553860800">- Enable build-time tests (bsc#1130489)
  * Added patch libmspack-failing-tests.patch</changelog>
  <changelog author="kstreitova@suse.com" date="1572868800">- add libmspack-0.6alpha-CVE-2019-1010305.patch to fix a buffer
  overflow in chmd_read_headers(): a CHM file name beginning "::"
  but shorter than 33 bytes will lead to reading past the
  freshly-allocated name buffer - checks for specific control
  filenames didn't take length into account [bsc#1141680]
  [CVE-2019-1010305]</changelog>
  <changelog author="danilo.spinella@suse.com" date="1626264000">- There is an off-by-one error in the CHM PMGI/PMGL chunk number validity
  checks, which could lead to denial of service
  (CVE-2018-14679, bsc#1103032)
  * libmspack-CVE-2018-14679.patch
- Bad KWAJ file header extensions could cause a one or two byte overwrite
  (CVE-2018-14681, bsc#1103032).
  * libmspack-CVE-2018-14681.patch
- There is an off-by-one error in the TOLOWER() macro for CHM decompression
  (CVE-2018-14682, bsc#1103032).
  * libmspack-CVE-2018-14682.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1641384000">- chmextract.c add anti "../" and leading slash protection to chmextract
  (CVE-2018-18586.patch, bsc#1113040)
  * cve-2018-18586.patch</changelog>
</package>
<package pkgid="527e874b39a2d3109c42542e841a7ea3b2151b51d517893a475a090e2438ede7" name="mspack-tools" arch="x86_64">
  <version epoch="0" ver="0.6" rel="3.14.1"/>
  <changelog author="sbrabec@suse.cz" date="1421755200">- Fix possible infinite loop caused DoS (bnc912214, CVE-2014-9556,
  libmspack-qtmd_decompress-loop.patch).</changelog>
  <changelog author="p.drouand@gmail.com" date="1423656000">- Update to version 0.5
  * Please read the changelog; too many things to list</changelog>
  <changelog author="sbrabec@suse.cz" date="1425038400">- Remove problematic libmspack-qtmd_decompress-loop.patch
  (bnc#912214#c10).
  Version 0.5 has a correct fix dated 2015-01-05.</changelog>
  <changelog author="mardnh@gmx.de" date="1516017600">- Update to version 0.6
  * read_spaninfo(): a CHM file can have no ResetTable and have a
  negative length in SpanInfo, which then feeds a negative output
  length to lzxd_init(), which then sets frame_size to a value of
  your choosing, the lower 32 bits of output length, larger than
  LZX_FRAME_SIZE. If the first LZX block is uncompressed, this
  writes data beyond the end of the window.
  This issue was raised by ClamAV as CVE-2017-6419.
  * lzxd_init(), lzxd_set_output_length(), mszipd_init(): due to the
  issue mentioned above, these functions now reject negative lengths
  * cabd_read_string(): add missing error check on result of read().
  If an mspack_system implementation returns an error, it's
  interpreted as a huge positive integer, which leads to reading
  past the end of the stack-based buffer.
  This issue was raised by ClamAV as CVE-2017-11423
- Add subpackage for helper tools
- Run spec-cleaner</changelog>
  <changelog author="mardnh@gmx.de" date="1516104000">- Fix typo</changelog>
  <changelog author="jengelh@inai.de" date="1516104001">- Correct SRPM group.</changelog>
  <changelog author="adam.majer@suse.de" date="1516363200">- Correct mspack-tools group to Productivity/File utilities</changelog>
  <changelog author="mcalabkova@suse.com" date="1540555200">- Added patches:
  * libmspack-resize-buffer.patch -- CAB block input buffer is one
    byte too small for maximal Quantum block.
  * libmspack-fix-bounds-checking.patch --  Fix off-by-one bounds
    check on CHM PMGI/PMGL chunk numbers and reject empty filenames.
  * libmspack-reject-blank-filenames.patch -- Avoid returning CHM
    file entries that are "blank" because they have embedded null
    bytes.
  * (the last two patches were modified by removing unneeded part
    in order to make them more independent)
- Fixed bugs:
  * CVE-2018-18584 (bsc#1113038)
  * CVE-2018-18585 (bsc#1113039)</changelog>
  <changelog author="mcalabkova@suse.com" date="1553860800">- Enable build-time tests (bsc#1130489)
  * Added patch libmspack-failing-tests.patch</changelog>
  <changelog author="kstreitova@suse.com" date="1572868800">- add libmspack-0.6alpha-CVE-2019-1010305.patch to fix a buffer
  overflow in chmd_read_headers(): a CHM file name beginning "::"
  but shorter than 33 bytes will lead to reading past the
  freshly-allocated name buffer - checks for specific control
  filenames didn't take length into account [bsc#1141680]
  [CVE-2019-1010305]</changelog>
  <changelog author="danilo.spinella@suse.com" date="1626264000">- There is an off-by-one error in the CHM PMGI/PMGL chunk number validity
  checks, which could lead to denial of service
  (CVE-2018-14679, bsc#1103032)
  * libmspack-CVE-2018-14679.patch
- Bad KWAJ file header extensions could cause a one or two byte overwrite
  (CVE-2018-14681, bsc#1103032).
  * libmspack-CVE-2018-14681.patch
- There is an off-by-one error in the TOLOWER() macro for CHM decompression
  (CVE-2018-14682, bsc#1103032).
  * libmspack-CVE-2018-14682.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1641384000">- chmextract.c add anti "../" and leading slash protection to chmextract
  (CVE-2018-18586.patch, bsc#1113040)
  * cve-2018-18586.patch</changelog>
</package>
<package pkgid="ab3f0311710bcd9c79fdbbcc409e13ddbb207033e83f76d353b54af2c5a4b1b5" name="mysql-connector-java" arch="noarch">
  <version epoch="0" ver="5.1.47" rel="3.6.1"/>
  <changelog author="tchvatal@suse.com" date="1426680000">- Fix build with new javapackages-tools</changelog>
  <changelog author="tchvatal@suse.com" date="1429617600">- Update to 5.1.35 (see CHANGES for full list of issues)
  bnc#927981 CVE-2015-2575:
  * http://dev.mysql.com/doc/relnotes/connector-j/en/news-5-1.html
- Remove not applicable patch:
  * mysql-connector-java-7-jdbc-4.1.patch
- Do not explicitely check for jdk6 but be happy with 7 and 8:
  * jdk6-check-use-jdk7.patch
- Do not require hibernate4 to actually build:
  * extra-libs-build.patch
- Do not build jdk5 depending jdbc3:
  * no-jdk5-requirement.patch
- Add and rebase jdbc4.1 patch:
  * mysql-connector-java-jdbc-4.1.patch
- Add new patch to build tests:
  * use-classpath-in-tests.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1434024000">- Fix the patches to allow jdbc3 build and reenable it:
  * mysql-connector-java-jdbc-4.1.patch
  * no-jdk5-requirement.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1493726400">- Fix for CVE-2017-3523 (bsc#1035697)
  * Unexpected automatic deserialisation of Java objects
  * Affected software: MySQL Connector/J
  * Remote Code Execution Vulnerability
- Added patch: mysql-connector-java-5.1.35-CVE-2017-3523.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1495108800">- Version update to 5.1.42 bsc#1035210 bsc#1035697 bsc#1035211:
  * CVE-2017-3589 CVE-2017-3523 CVE-2017-3586
  * http://dev.mysql.com/doc/relnotes/connector-j/en/news-5-1.html
- Remove upstreamed mysql-connector-java-5.1.35-CVE-2017-3523.patch
- Refresh patch extra-libs-build.patch
- Drop obsolete patch jdk6-check-use-jdk7.patch
- Refresh patch no-jdk5-requirement.patch
- Attempt to refresh mysql-connector-java-jdbc-4.1.patch
  * Partialy merged by upstream, many conflicts
- Add patch to relax compiler check:
  * javac-check.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1495108801">- Drop patch use-classpath-in-tests.patch
- Add patch disabling testsuite:
  * disable-testsuite.patch
- Drop patch extra-libs-build.patch:
  * Rather use the thing to propagate some wrongly found libs
- Drop patch no-jdk5-requirement.patch:
  * Simply override the value in ant command
- Add patch hibernate-check.patch to remove hibernate check
- Add patch compile-jdk7.patch to compile with old JDK versions</changelog>
  <changelog author="tchvatal@suse.com" date="1495108802">- Hardcode requirement for java 1.8 or newer to build</changelog>
  <changelog author="dziolkowski@suse.com" date="1495195200">- New build dependency: javapackages-local
- cleaned spec using spec-cleaner</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1503316800">- Update to version 5.1.43
  * Fixed problems connecting to MYSQL 8.0.3.
  * Deprecating COM_SHUTDOWN
  * GETDATE(),GETTIME() AND GETTIMESTAMP() called with NULL
    calendar returs NPE
  * C/J 5.1 GIS tests are failing with MYSQL 8.0.1C/J 5.1 GIS
  * Updated time zone mappings with latest TZ databases
  * For a full list of fixed issues see CHANGES or:
    http://dev.mysql.com/doc/relnotes/connector-j/en/news-5-1.html</changelog>
  <changelog author="fstrba@suse.com" date="1505044800">- Require for building java-devel = 1.8.0, since this package needs
  a javac compiler able to build with source and target level 1.5</changelog>
  <changelog author="fstrba@suse.com" date="1506686400">- Don't condition the maven defines on release version, but on
  _maven_repository being defined</changelog>
  <changelog author="fstrba@suse.com" date="1507291200">- Fix build with jdk9
- Added patch:
  * mysql-connector-java-sourcetarget.patch
    + Don't hardcode java source and target levels; specify them
    on command-line.</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1541419200">- Updated to 5.1.47
  - Bug#28449601, MASTER : UNITTEST FOR BUG#22305979 (TESTBUG22305979) STILL FAILS ON QA SETUP.
  - Bug#81063 (23098159), w/ rewriteBatchedStatements, when 2 tables involved, the rewriting not correct.
  - Bug#84813 (25501750), rewriteBatchedStatements fails in INSERT.
  - Fix for Bug#81196 (23227334), CONNECTOR/J NOT FOLLOWING DATABASE CHARACTER SET.
  - Bug#72609 (18749544), SETDATE() NOT USING A PROLEPTIC GREGORIAN CALENDAR.
  - Bug#87534 (26730196), UNION ALL query fails when useServerPrepStmts=true
    on database connection. Test case only. Base bug fixed in MySQL 5.7.22.
  - Bug#89948 (27658489), Batched statements are not committed for useLocalTransactionState=true.
  - BUG#80532 (22847443), ENCODING OF RESULTSET.UPDATEROW IS BROKEN FOR NON ASCII CHARCTERS.
  - BUG#22305979, WRONG RECORD UPDATED IF SENDFRACTIONALSECONDS=FALSE AND SMT IS SCROLLABLE.
  - BUG#90024 (27677574), SOME TESTS FAILED AGAINST MYSQL 8.0.5 BECAUSE OF DEPRECATED FEATURES REMOVAL.
- Updated to 5.1.46
  - WL#11629, Change caching_sha2_password padding.
  - Bug#86741 (26314325), Multi-Host connection with autocommit=0 getAutoCommit maybe wrong.
  - Bug#27231383, PROVIDE MAVEN-FRIENDLY COMMERCIAL PACKAGES WITHOUT "-BIN".
  - Bug#26819691, SETTING PACKETDEBUGBUFFERSIZE=0 RESULTS IN CONNECTION FAILURE.
  - WL#11200, Add caching_sha2_password support.
  - Bug#88227 (27029657), Connector/J 5.1.44 cannot be used against MySQL 5.7.20 without warnings.
  - Bug#27374581, CONNECTION FAILS WHEN GPL SERVER STARTED WITH TLS-VERSION=TLSV1.2.
  - Bug#79612 (22362474), CONNECTION ATTRIBUTES LOST WHEN CONNECTING WITHOUT DEFAULT DATABASE.
- Updated to 5.1.45
  - Bug#27131768, NULL POINTER EXCEPTION IN CONNECTION.
  - Bug#88232 (27047676), c/J does not rollback transaction when autoReconnect=true.
  - Bug#88242 (27040063), autoReconnect and socketTimeout JDBC option makes wrong order of client packet.
  - Bug#88021 (26939943), High GC pressure when driver configured with serversideprepared statements.
  - Bug#26724085, CHARSET MAPPING TO BE UPDATED FOR MYSQL 8.0.3.
  - Bug#26794652, TEST FAILING DUE TO BINARY LOGGING ENABLED BY DEFAULT IN MYSQL 8.0.3.
  - Bug#26794602, TESTS FAILING DUE TO CHANGE IN INFORMATION_SCHEMA.INNODB_SYS_* NAMING.
  - Bug#87704 (26771560), THE STREAM GETS THE RESULT SET ?THE DRIVER SIDE GET WRONG ABOUT GETLONG().
- Updated to 5.1.44
  - Bug#87429 (26633984), repeated close of ServerPreparedStatement causes memory leak.
  - Bug#87379 (26646676), Perform actual TLS capabilities check when restricting TLSv1.2.
  - Bug#85601 (25777822), Unit notation is missing in the description of the property involved in the time.
  - Bug#87153 (26501245), INCORRECT RESULT OF DBMD.GETVERSIONCOLUMNS() AGAINST MYSQL 8.0.2+.
  - Bug#26440544, CONNECTOR/J SHOULD NOT USE TX_{READ_ONLY,ISOLATION} WHICH IS PLANNED FOR REMOVAL.
- Rebased patch mysql-connector-java-jdbc-4.1.patch</changelog>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini
- Clean the spec file by spec-cleaner</changelog>
  <changelog author="pmonreal@suse.com" date="1627387200">- Security fix: [bsc#1173600, CVE-2020-2875, CVE-2020-2933, CVE-2020-2934]
  * CVE-2020-2875: Unauthenticated attacker with network access via
    multiple protocols can compromise MySQL Connectors. Can result in
    unauthorized update, insert or delete access to some of MySQL
    Connectors accessible data as well as unauthorized read access
    to a subset of MySQL Connectors accessible data.
  * CVE-2020-2934: Can result in unauthorized update, insert or
    delete access to some of MySQL Connectors accessible data as well
    as unauthorized read access to a subset of MySQL Connectors
    accessible data and unauthorized ability to cause a partial denial
    of service (partial DOS) of MySQL Connectors.
  * CVE-2020-2933: Allows high privileged attacker with network access
    via multiple protocols to compromise MySQL Connectors. Can result
    in unauthorized ability to cause a partial denial of service
    (partial DOS) of MySQL Connectors.
  * https://www.oracle.com/security-alerts/cpuapr2020verbose.html#MSQL
  * Add mysql-connector-java-CVE-2020-2875_CVE-2020-2933_CVE-2020-2934.patch</changelog>
  <changelog author="david.anes@suse.com" date="1645704000">- Security fix (CVE-2021-2471, bsc#1195557, jsc#PM-3307):
  - mysql-connector-java: unauthorized access
  - Add mysql-connector-java-CVE-2021-2471.patch</changelog>
</package>
<package pkgid="71f421feac98cae5f9f589d01b7525c941ab86a3df32a9c239b31a50d84c13cf" name="mysql-connector-java" arch="src">
  <version epoch="0" ver="5.1.47" rel="3.6.1"/>
  <changelog author="mvyskocil@suse.com" date="1377259200">- use add_maven_depmap provided by javapackages-tools</changelog>
  <changelog author="pgajdos@suse.com" date="1379073600">- add jpackages-tools to buildrequires</changelog>
  <changelog author="mvyskocil@suse.com" date="1379592000">- update to 5.1.25 (see CHANGES for full list)
  * support for Connection Attributes when used with MySQL Server versions (5.6+).
  5.1.24
  * support of password expiration protocol. This introduces new boolean
    connection property disconnectOnExpiredPasswords.
  5.1.23
  * added support of password expiration protocol.
  * driver now allows the mechanism for caching MySQL server configuration
    values replaceable at runtime.
  * Connection.setReadOnly() will take advantage of server-side support for
    read-only transactions present in MySQL-5.6 and newer. Calling .isReadOnly()
    will incur a round-trip if useLocalSessionState.
  5.1.22
  * support of ON UPDATE CURRENT_TIMESTAMP for TIMESTAMP and DATETIME fields.
  5.1.21
  * new built-in authentication plugin
    com.mysql.jdbc.authentication.Sha256PasswordPlugin ("sha256_password").
  * Added new built-in authentication plugin
    com.mysql.jdbc.authentication.MysqlClearPasswordPlugin ("mysql_clear_password").
    It allows C/J based clients to connect to MySQL accounts.
  * the ability to add new client-side prepared statement parse info caches
  * implemented several JDBC-4.1 methods from Java-7:
  5.1.19:
  * Added support for pluggable authentication via the com.mysql.jdbc.AuthenticationPlugin
- rebase and rename mysql-connector-java-5.1.19-java7.patch to
  * mysql-connector-java-7-jdbc-4.1.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1403870400">- Cleanup with spec-cleaner
- Try to build on SLE_11</changelog>
  <changelog author="tchvatal@suse.com" date="1426680000">- Fix build with new javapackages-tools</changelog>
  <changelog author="tchvatal@suse.com" date="1429617600">- Update to 5.1.35 (see CHANGES for full list of issues)
  bnc#927981 CVE-2015-2575:
  * http://dev.mysql.com/doc/relnotes/connector-j/en/news-5-1.html
- Remove not applicable patch:
  * mysql-connector-java-7-jdbc-4.1.patch
- Do not explicitely check for jdk6 but be happy with 7 and 8:
  * jdk6-check-use-jdk7.patch
- Do not require hibernate4 to actually build:
  * extra-libs-build.patch
- Do not build jdk5 depending jdbc3:
  * no-jdk5-requirement.patch
- Add and rebase jdbc4.1 patch:
  * mysql-connector-java-jdbc-4.1.patch
- Add new patch to build tests:
  * use-classpath-in-tests.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1434024000">- Fix the patches to allow jdbc3 build and reenable it:
  * mysql-connector-java-jdbc-4.1.patch
  * no-jdk5-requirement.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1493726400">- Fix for CVE-2017-3523 (bsc#1035697)
  * Unexpected automatic deserialisation of Java objects
  * Affected software: MySQL Connector/J
  * Remote Code Execution Vulnerability
- Added patch: mysql-connector-java-5.1.35-CVE-2017-3523.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1495108800">- Version update to 5.1.42 bsc#1035210 bsc#1035697 bsc#1035211:
  * CVE-2017-3589 CVE-2017-3523 CVE-2017-3586
  * http://dev.mysql.com/doc/relnotes/connector-j/en/news-5-1.html
- Remove upstreamed mysql-connector-java-5.1.35-CVE-2017-3523.patch
- Refresh patch extra-libs-build.patch
- Drop obsolete patch jdk6-check-use-jdk7.patch
- Refresh patch no-jdk5-requirement.patch
- Attempt to refresh mysql-connector-java-jdbc-4.1.patch
  * Partialy merged by upstream, many conflicts
- Add patch to relax compiler check:
  * javac-check.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1495108801">- Drop patch use-classpath-in-tests.patch
- Add patch disabling testsuite:
  * disable-testsuite.patch
- Drop patch extra-libs-build.patch:
  * Rather use the thing to propagate some wrongly found libs
- Drop patch no-jdk5-requirement.patch:
  * Simply override the value in ant command
- Add patch hibernate-check.patch to remove hibernate check
- Add patch compile-jdk7.patch to compile with old JDK versions</changelog>
  <changelog author="tchvatal@suse.com" date="1495108802">- Hardcode requirement for java 1.8 or newer to build</changelog>
  <changelog author="dziolkowski@suse.com" date="1495195200">- New build dependency: javapackages-local
- cleaned spec using spec-cleaner</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1503316800">- Update to version 5.1.43
  * Fixed problems connecting to MYSQL 8.0.3.
  * Deprecating COM_SHUTDOWN
  * GETDATE(),GETTIME() AND GETTIMESTAMP() called with NULL
    calendar returs NPE
  * C/J 5.1 GIS tests are failing with MYSQL 8.0.1C/J 5.1 GIS
  * Updated time zone mappings with latest TZ databases
  * For a full list of fixed issues see CHANGES or:
    http://dev.mysql.com/doc/relnotes/connector-j/en/news-5-1.html</changelog>
  <changelog author="fstrba@suse.com" date="1505044800">- Require for building java-devel = 1.8.0, since this package needs
  a javac compiler able to build with source and target level 1.5</changelog>
  <changelog author="fstrba@suse.com" date="1506686400">- Don't condition the maven defines on release version, but on
  _maven_repository being defined</changelog>
  <changelog author="fstrba@suse.com" date="1507291200">- Fix build with jdk9
- Added patch:
  * mysql-connector-java-sourcetarget.patch
    + Don't hardcode java source and target levels; specify them
    on command-line.</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1541419200">- Updated to 5.1.47
  - Bug#28449601, MASTER : UNITTEST FOR BUG#22305979 (TESTBUG22305979) STILL FAILS ON QA SETUP.
  - Bug#81063 (23098159), w/ rewriteBatchedStatements, when 2 tables involved, the rewriting not correct.
  - Bug#84813 (25501750), rewriteBatchedStatements fails in INSERT.
  - Fix for Bug#81196 (23227334), CONNECTOR/J NOT FOLLOWING DATABASE CHARACTER SET.
  - Bug#72609 (18749544), SETDATE() NOT USING A PROLEPTIC GREGORIAN CALENDAR.
  - Bug#87534 (26730196), UNION ALL query fails when useServerPrepStmts=true
    on database connection. Test case only. Base bug fixed in MySQL 5.7.22.
  - Bug#89948 (27658489), Batched statements are not committed for useLocalTransactionState=true.
  - BUG#80532 (22847443), ENCODING OF RESULTSET.UPDATEROW IS BROKEN FOR NON ASCII CHARCTERS.
  - BUG#22305979, WRONG RECORD UPDATED IF SENDFRACTIONALSECONDS=FALSE AND SMT IS SCROLLABLE.
  - BUG#90024 (27677574), SOME TESTS FAILED AGAINST MYSQL 8.0.5 BECAUSE OF DEPRECATED FEATURES REMOVAL.
- Updated to 5.1.46
  - WL#11629, Change caching_sha2_password padding.
  - Bug#86741 (26314325), Multi-Host connection with autocommit=0 getAutoCommit maybe wrong.
  - Bug#27231383, PROVIDE MAVEN-FRIENDLY COMMERCIAL PACKAGES WITHOUT "-BIN".
  - Bug#26819691, SETTING PACKETDEBUGBUFFERSIZE=0 RESULTS IN CONNECTION FAILURE.
  - WL#11200, Add caching_sha2_password support.
  - Bug#88227 (27029657), Connector/J 5.1.44 cannot be used against MySQL 5.7.20 without warnings.
  - Bug#27374581, CONNECTION FAILS WHEN GPL SERVER STARTED WITH TLS-VERSION=TLSV1.2.
  - Bug#79612 (22362474), CONNECTION ATTRIBUTES LOST WHEN CONNECTING WITHOUT DEFAULT DATABASE.
- Updated to 5.1.45
  - Bug#27131768, NULL POINTER EXCEPTION IN CONNECTION.
  - Bug#88232 (27047676), c/J does not rollback transaction when autoReconnect=true.
  - Bug#88242 (27040063), autoReconnect and socketTimeout JDBC option makes wrong order of client packet.
  - Bug#88021 (26939943), High GC pressure when driver configured with serversideprepared statements.
  - Bug#26724085, CHARSET MAPPING TO BE UPDATED FOR MYSQL 8.0.3.
  - Bug#26794652, TEST FAILING DUE TO BINARY LOGGING ENABLED BY DEFAULT IN MYSQL 8.0.3.
  - Bug#26794602, TESTS FAILING DUE TO CHANGE IN INFORMATION_SCHEMA.INNODB_SYS_* NAMING.
  - Bug#87704 (26771560), THE STREAM GETS THE RESULT SET ?THE DRIVER SIDE GET WRONG ABOUT GETLONG().
- Updated to 5.1.44
  - Bug#87429 (26633984), repeated close of ServerPreparedStatement causes memory leak.
  - Bug#87379 (26646676), Perform actual TLS capabilities check when restricting TLSv1.2.
  - Bug#85601 (25777822), Unit notation is missing in the description of the property involved in the time.
  - Bug#87153 (26501245), INCORRECT RESULT OF DBMD.GETVERSIONCOLUMNS() AGAINST MYSQL 8.0.2+.
  - Bug#26440544, CONNECTOR/J SHOULD NOT USE TX_{READ_ONLY,ISOLATION} WHICH IS PLANNED FOR REMOVAL.
- Rebased patch mysql-connector-java-jdbc-4.1.patch</changelog>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini
- Clean the spec file by spec-cleaner</changelog>
  <changelog author="pmonreal@suse.com" date="1627387200">- Security fix: [bsc#1173600, CVE-2020-2875, CVE-2020-2933, CVE-2020-2934]
  * CVE-2020-2875: Unauthenticated attacker with network access via
    multiple protocols can compromise MySQL Connectors. Can result in
    unauthorized update, insert or delete access to some of MySQL
    Connectors accessible data as well as unauthorized read access
    to a subset of MySQL Connectors accessible data.
  * CVE-2020-2934: Can result in unauthorized update, insert or
    delete access to some of MySQL Connectors accessible data as well
    as unauthorized read access to a subset of MySQL Connectors
    accessible data and unauthorized ability to cause a partial denial
    of service (partial DOS) of MySQL Connectors.
  * CVE-2020-2933: Allows high privileged attacker with network access
    via multiple protocols to compromise MySQL Connectors. Can result
    in unauthorized ability to cause a partial denial of service
    (partial DOS) of MySQL Connectors.
  * https://www.oracle.com/security-alerts/cpuapr2020verbose.html#MSQL
  * Add mysql-connector-java-CVE-2020-2875_CVE-2020-2933_CVE-2020-2934.patch</changelog>
  <changelog author="david.anes@suse.com" date="1645704000">- Security fix (CVE-2021-2471, bsc#1195557, jsc#PM-3307):
  - mysql-connector-java: unauthorized access
  - Add mysql-connector-java-CVE-2021-2471.patch</changelog>
</package>
<package pkgid="319901e0bc9a6d65090bbe315966caa7a77563b184921aaa08601e36e50ffdbe" name="nfs-client" arch="aarch64">
  <version epoch="0" ver="2.1.1" rel="10.21.1"/>
  <changelog author="nfbrown@suse.com" date="1471780800">- 0001-Make-location-of-nfs-utils_env.sh-configurable.patch
  1.3.4 moved the config script location to somewhere
  that doesn't exist on openSUSE.  Move it somewhere
  better and install it there.
  (bsc#990356)</changelog>
  <changelog author="nfbrown@suse.com" date="1477051200">- move rpc.svcgssd and corresponding man page from
  nfs-client package to nfs-kernel-server.
  For NFSv4.0 this is needed on client as well as
  the server to support the back-channel.
  (bsc#1005609)</changelog>
  <changelog author="dimstar@opensuse.org" date="1479124800">- Also ignore errors on the first chown call: this can happen
  especially in the build system when shadow is not present and
  the user has not been generated in the %pre phase.</changelog>
  <changelog author="jengelh@inai.de" date="1484827200">- Check for existence of "statd" user before creating it,
  and do not suppress errors about it.
- Ensure units passed to %service_* are full filenames.
- Pass all units (non-templated) to %service_*.</changelog>
  <changelog author="nfbrown@suse.com" date="1486555200">- update upstream version from 1.3.4 to 2.1.1
  The significant update is that configuration can
  now be read from a central /etc/nfs.conf file, and
  it can include other files such as /etc/sysconfig/nfs
  This means that the old nfs-config.service systemd
  unit is no longer needed.
- /etc/nfs.conf file created to import all sysconfig
  settings except *_OPTIONS directly into running code.
- dropins created to pass *_OPTIONS sysconfig setting to
  the various daemons.
- various specfile improvements, such as using "-D" in
  "install" commands, and adding "verify_permissions".
- "xtab" has not been needed for years and has now been remove.
- sysconfig.nfs updated, particular the ServiceRestart
  declarations have been tuned for systemd units.
- 0003-nfs-server-generator-handle-noauto-mounts-correctly.patch
  Fix the nfs-server-generator so that mounts marked "noauto"
  are not automatically mounted when NFS exported.
  (bsc#1019211)
- 0001-conffile-ignore-empty-environment-variables.patch
  0002-mount-call-setgroups-before-setuid.patch
  Other minor fixes found during testing.
- REMOVED 0001-Make-location-of-nfs-utils_env.sh-configurable.patch
  now included upstream</changelog>
  <changelog author="kukuk@suse.de" date="1493726400">- Prerequire needed group "nogroup"</changelog>
  <changelog author="schwab@suse.de" date="1499256000">- nsm-headers.patch: add missing &lt;stdint.h&gt;</changelog>
  <changelog author="nfbrown@suse.com" date="1507291200">- fix incorrect dependency in
  /usr/lib/systemd/system/nfs-client.target.d/nfs.conf
  When yast restarts "nfs" it should propagate to nfs-client,
  but doesn't.
  (boo#1053691)</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="kukuk@suse.de" date="1530878400">- Create files in /var/lib/nfs via tmpfiles.d [bsc#1100404],
  [FATE#325524]</changelog>
  <changelog author="nfbrown@suse.com" date="1543838400">- 0002-Let-systemd-know-when-rpc.statd-is-needed.patch
  0003-systemd-run-statd-notify-even-when-nfs-client-isn-t-.patch
  Fixes for systemd integration
  (bsc#1116221)
- nfs.conf: spell NFSV4LEASETIME correctly.
  (bsc#1098532)</changelog>
  <changelog author="nfbrown@suse.com" date="1569844800">- Don't make /var/lib/nfs owned by statd.
  Only sm and sm.bak need to be accessible by
  statd or sm-notify after they drop privs.
  Providing they get created, the parent
  directory can be root-owned.
- 0007-statd-user-from-sm
  Change rpc.statd and sm-notify to take uid from the sm
  directory.
  (bsc#1150733 CVE-2019-3689)</changelog>
  <changelog author="nfbrown@suse.com" date="1594296000">- 0008-gssd-replace-non-thread-safe-strtok-with-strsep.patch
  Fix bug with concurrent gssd requests arriving from kernel.
  (bsc#1174260)</changelog>
  <changelog author="nfbrown@suse.com" date="1599134400">- 0009-Convert-remaining-python-scripts-to-python3.patch
  Python is no longer installed by default and these scripts
  work with python3, so request that explicitly.
  (bsc#1173104)</changelog>
  <changelog author="nfbrown@suse.com" date="1616068800">- Add 0010-gssd-Fix-locking-for-machine-principal-list.patch
  (bsc#1183194)</changelog>
  <changelog author="nfbrown@suse.com" date="1616068801">- Add 0011-manpage-Add-a-description-of-the-nconnect-mount-opti.patch
  (bsc#1181651)</changelog>
  <changelog author="nfbrown@suse.com" date="1616068802">- 0012-mountd-reject-unknown-client-IP-when-use_ipaddr.patch
  0013-mountd-Don-t-proactively-add-export-info-when-fh-inf.patch
  0014-mountd-add-logging-for-authentication-results-for-ac.patch
  0015-mountd-add-cache-use-ipaddr-option-to-force-use_ipad.patch
  0116-mountd-make-default-ttl-settable-by-option.patch
  Improve logging of authentication (bsc#1181540)</changelog>
  <changelog author="nfbrown@suse.com" date="1620388800">- Add 0018-Replace-all-var-run-with-run.patch
  /var/run is long deprecated - switch all relevant paths to /run
  (bsc#1185170)</changelog>
  <changelog author="nfbrown@suse.com" date="1621598400">- Add 0019-gssd-use-mutex-to-protect-decrement-of-refcount.patch
  A field was modified by multiple threads without locking.
  This can lead to use-after-free.
  (bsc#1183194)</changelog>
  <changelog author="nfbrown@suse.com" date="1642507200">- Add 0020-mountd-Initialize-logging-early.patch
  If an error or warning message is produced before
  closeall() is called, mountd gets confused and doesn't work.
  (bsc#1194661)</changelog>
</package>
<package pkgid="6060e93c08135081f790287ac1667781058607f1f2261f41c71c8bbf359d62d4" name="nfs-client" arch="ppc64le">
  <version epoch="0" ver="2.1.1" rel="10.21.1"/>
  <changelog author="nfbrown@suse.com" date="1471780800">- 0001-Make-location-of-nfs-utils_env.sh-configurable.patch
  1.3.4 moved the config script location to somewhere
  that doesn't exist on openSUSE.  Move it somewhere
  better and install it there.
  (bsc#990356)</changelog>
  <changelog author="nfbrown@suse.com" date="1477051200">- move rpc.svcgssd and corresponding man page from
  nfs-client package to nfs-kernel-server.
  For NFSv4.0 this is needed on client as well as
  the server to support the back-channel.
  (bsc#1005609)</changelog>
  <changelog author="dimstar@opensuse.org" date="1479124800">- Also ignore errors on the first chown call: this can happen
  especially in the build system when shadow is not present and
  the user has not been generated in the %pre phase.</changelog>
  <changelog author="jengelh@inai.de" date="1484827200">- Check for existence of "statd" user before creating it,
  and do not suppress errors about it.
- Ensure units passed to %service_* are full filenames.
- Pass all units (non-templated) to %service_*.</changelog>
  <changelog author="nfbrown@suse.com" date="1486555200">- update upstream version from 1.3.4 to 2.1.1
  The significant update is that configuration can
  now be read from a central /etc/nfs.conf file, and
  it can include other files such as /etc/sysconfig/nfs
  This means that the old nfs-config.service systemd
  unit is no longer needed.
- /etc/nfs.conf file created to import all sysconfig
  settings except *_OPTIONS directly into running code.
- dropins created to pass *_OPTIONS sysconfig setting to
  the various daemons.
- various specfile improvements, such as using "-D" in
  "install" commands, and adding "verify_permissions".
- "xtab" has not been needed for years and has now been remove.
- sysconfig.nfs updated, particular the ServiceRestart
  declarations have been tuned for systemd units.
- 0003-nfs-server-generator-handle-noauto-mounts-correctly.patch
  Fix the nfs-server-generator so that mounts marked "noauto"
  are not automatically mounted when NFS exported.
  (bsc#1019211)
- 0001-conffile-ignore-empty-environment-variables.patch
  0002-mount-call-setgroups-before-setuid.patch
  Other minor fixes found during testing.
- REMOVED 0001-Make-location-of-nfs-utils_env.sh-configurable.patch
  now included upstream</changelog>
  <changelog author="kukuk@suse.de" date="1493726400">- Prerequire needed group "nogroup"</changelog>
  <changelog author="schwab@suse.de" date="1499256000">- nsm-headers.patch: add missing &lt;stdint.h&gt;</changelog>
  <changelog author="nfbrown@suse.com" date="1507291200">- fix incorrect dependency in
  /usr/lib/systemd/system/nfs-client.target.d/nfs.conf
  When yast restarts "nfs" it should propagate to nfs-client,
  but doesn't.
  (boo#1053691)</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="kukuk@suse.de" date="1530878400">- Create files in /var/lib/nfs via tmpfiles.d [bsc#1100404],
  [FATE#325524]</changelog>
  <changelog author="nfbrown@suse.com" date="1543838400">- 0002-Let-systemd-know-when-rpc.statd-is-needed.patch
  0003-systemd-run-statd-notify-even-when-nfs-client-isn-t-.patch
  Fixes for systemd integration
  (bsc#1116221)
- nfs.conf: spell NFSV4LEASETIME correctly.
  (bsc#1098532)</changelog>
  <changelog author="nfbrown@suse.com" date="1569844800">- Don't make /var/lib/nfs owned by statd.
  Only sm and sm.bak need to be accessible by
  statd or sm-notify after they drop privs.
  Providing they get created, the parent
  directory can be root-owned.
- 0007-statd-user-from-sm
  Change rpc.statd and sm-notify to take uid from the sm
  directory.
  (bsc#1150733 CVE-2019-3689)</changelog>
  <changelog author="nfbrown@suse.com" date="1594296000">- 0008-gssd-replace-non-thread-safe-strtok-with-strsep.patch
  Fix bug with concurrent gssd requests arriving from kernel.
  (bsc#1174260)</changelog>
  <changelog author="nfbrown@suse.com" date="1599134400">- 0009-Convert-remaining-python-scripts-to-python3.patch
  Python is no longer installed by default and these scripts
  work with python3, so request that explicitly.
  (bsc#1173104)</changelog>
  <changelog author="nfbrown@suse.com" date="1616068800">- Add 0010-gssd-Fix-locking-for-machine-principal-list.patch
  (bsc#1183194)</changelog>
  <changelog author="nfbrown@suse.com" date="1616068801">- Add 0011-manpage-Add-a-description-of-the-nconnect-mount-opti.patch
  (bsc#1181651)</changelog>
  <changelog author="nfbrown@suse.com" date="1616068802">- 0012-mountd-reject-unknown-client-IP-when-use_ipaddr.patch
  0013-mountd-Don-t-proactively-add-export-info-when-fh-inf.patch
  0014-mountd-add-logging-for-authentication-results-for-ac.patch
  0015-mountd-add-cache-use-ipaddr-option-to-force-use_ipad.patch
  0116-mountd-make-default-ttl-settable-by-option.patch
  Improve logging of authentication (bsc#1181540)</changelog>
  <changelog author="nfbrown@suse.com" date="1620388800">- Add 0018-Replace-all-var-run-with-run.patch
  /var/run is long deprecated - switch all relevant paths to /run
  (bsc#1185170)</changelog>
  <changelog author="nfbrown@suse.com" date="1621598400">- Add 0019-gssd-use-mutex-to-protect-decrement-of-refcount.patch
  A field was modified by multiple threads without locking.
  This can lead to use-after-free.
  (bsc#1183194)</changelog>
  <changelog author="nfbrown@suse.com" date="1642507200">- Add 0020-mountd-Initialize-logging-early.patch
  If an error or warning message is produced before
  closeall() is called, mountd gets confused and doesn't work.
  (bsc#1194661)</changelog>
</package>
<package pkgid="575eac9f120e6e4b0addc98d45d489ef0b8e1119f0af3a21c2966b6421513ef4" name="nfs-client" arch="s390x">
  <version epoch="0" ver="2.1.1" rel="10.21.1"/>
  <changelog author="nfbrown@suse.com" date="1471780800">- 0001-Make-location-of-nfs-utils_env.sh-configurable.patch
  1.3.4 moved the config script location to somewhere
  that doesn't exist on openSUSE.  Move it somewhere
  better and install it there.
  (bsc#990356)</changelog>
  <changelog author="nfbrown@suse.com" date="1477051200">- move rpc.svcgssd and corresponding man page from
  nfs-client package to nfs-kernel-server.
  For NFSv4.0 this is needed on client as well as
  the server to support the back-channel.
  (bsc#1005609)</changelog>
  <changelog author="dimstar@opensuse.org" date="1479124800">- Also ignore errors on the first chown call: this can happen
  especially in the build system when shadow is not present and
  the user has not been generated in the %pre phase.</changelog>
  <changelog author="jengelh@inai.de" date="1484827200">- Check for existence of "statd" user before creating it,
  and do not suppress errors about it.
- Ensure units passed to %service_* are full filenames.
- Pass all units (non-templated) to %service_*.</changelog>
  <changelog author="nfbrown@suse.com" date="1486555200">- update upstream version from 1.3.4 to 2.1.1
  The significant update is that configuration can
  now be read from a central /etc/nfs.conf file, and
  it can include other files such as /etc/sysconfig/nfs
  This means that the old nfs-config.service systemd
  unit is no longer needed.
- /etc/nfs.conf file created to import all sysconfig
  settings except *_OPTIONS directly into running code.
- dropins created to pass *_OPTIONS sysconfig setting to
  the various daemons.
- various specfile improvements, such as using "-D" in
  "install" commands, and adding "verify_permissions".
- "xtab" has not been needed for years and has now been remove.
- sysconfig.nfs updated, particular the ServiceRestart
  declarations have been tuned for systemd units.
- 0003-nfs-server-generator-handle-noauto-mounts-correctly.patch
  Fix the nfs-server-generator so that mounts marked "noauto"
  are not automatically mounted when NFS exported.
  (bsc#1019211)
- 0001-conffile-ignore-empty-environment-variables.patch
  0002-mount-call-setgroups-before-setuid.patch
  Other minor fixes found during testing.
- REMOVED 0001-Make-location-of-nfs-utils_env.sh-configurable.patch
  now included upstream</changelog>
  <changelog author="kukuk@suse.de" date="1493726400">- Prerequire needed group "nogroup"</changelog>
  <changelog author="schwab@suse.de" date="1499256000">- nsm-headers.patch: add missing &lt;stdint.h&gt;</changelog>
  <changelog author="nfbrown@suse.com" date="1507291200">- fix incorrect dependency in
  /usr/lib/systemd/system/nfs-client.target.d/nfs.conf
  When yast restarts "nfs" it should propagate to nfs-client,
  but doesn't.
  (boo#1053691)</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="kukuk@suse.de" date="1530878400">- Create files in /var/lib/nfs via tmpfiles.d [bsc#1100404],
  [FATE#325524]</changelog>
  <changelog author="nfbrown@suse.com" date="1543838400">- 0002-Let-systemd-know-when-rpc.statd-is-needed.patch
  0003-systemd-run-statd-notify-even-when-nfs-client-isn-t-.patch
  Fixes for systemd integration
  (bsc#1116221)
- nfs.conf: spell NFSV4LEASETIME correctly.
  (bsc#1098532)</changelog>
  <changelog author="nfbrown@suse.com" date="1569844800">- Don't make /var/lib/nfs owned by statd.
  Only sm and sm.bak need to be accessible by
  statd or sm-notify after they drop privs.
  Providing they get created, the parent
  directory can be root-owned.
- 0007-statd-user-from-sm
  Change rpc.statd and sm-notify to take uid from the sm
  directory.
  (bsc#1150733 CVE-2019-3689)</changelog>
  <changelog author="nfbrown@suse.com" date="1594296000">- 0008-gssd-replace-non-thread-safe-strtok-with-strsep.patch
  Fix bug with concurrent gssd requests arriving from kernel.
  (bsc#1174260)</changelog>
  <changelog author="nfbrown@suse.com" date="1599134400">- 0009-Convert-remaining-python-scripts-to-python3.patch
  Python is no longer installed by default and these scripts
  work with python3, so request that explicitly.
  (bsc#1173104)</changelog>
  <changelog author="nfbrown@suse.com" date="1616068800">- Add 0010-gssd-Fix-locking-for-machine-principal-list.patch
  (bsc#1183194)</changelog>
  <changelog author="nfbrown@suse.com" date="1616068801">- Add 0011-manpage-Add-a-description-of-the-nconnect-mount-opti.patch
  (bsc#1181651)</changelog>
  <changelog author="nfbrown@suse.com" date="1616068802">- 0012-mountd-reject-unknown-client-IP-when-use_ipaddr.patch
  0013-mountd-Don-t-proactively-add-export-info-when-fh-inf.patch
  0014-mountd-add-logging-for-authentication-results-for-ac.patch
  0015-mountd-add-cache-use-ipaddr-option-to-force-use_ipad.patch
  0116-mountd-make-default-ttl-settable-by-option.patch
  Improve logging of authentication (bsc#1181540)</changelog>
  <changelog author="nfbrown@suse.com" date="1620388800">- Add 0018-Replace-all-var-run-with-run.patch
  /var/run is long deprecated - switch all relevant paths to /run
  (bsc#1185170)</changelog>
  <changelog author="nfbrown@suse.com" date="1621598400">- Add 0019-gssd-use-mutex-to-protect-decrement-of-refcount.patch
  A field was modified by multiple threads without locking.
  This can lead to use-after-free.
  (bsc#1183194)</changelog>
  <changelog author="nfbrown@suse.com" date="1642507200">- Add 0020-mountd-Initialize-logging-early.patch
  If an error or warning message is produced before
  closeall() is called, mountd gets confused and doesn't work.
  (bsc#1194661)</changelog>
</package>
<package pkgid="08f759cb521276ebe25ea5be8047528d29f148533a3cbd28120880eaacdbf937" name="nfs-client" arch="x86_64">
  <version epoch="0" ver="2.1.1" rel="10.21.1"/>
  <changelog author="nfbrown@suse.com" date="1471780800">- 0001-Make-location-of-nfs-utils_env.sh-configurable.patch
  1.3.4 moved the config script location to somewhere
  that doesn't exist on openSUSE.  Move it somewhere
  better and install it there.
  (bsc#990356)</changelog>
  <changelog author="nfbrown@suse.com" date="1477051200">- move rpc.svcgssd and corresponding man page from
  nfs-client package to nfs-kernel-server.
  For NFSv4.0 this is needed on client as well as
  the server to support the back-channel.
  (bsc#1005609)</changelog>
  <changelog author="dimstar@opensuse.org" date="1479124800">- Also ignore errors on the first chown call: this can happen
  especially in the build system when shadow is not present and
  the user has not been generated in the %pre phase.</changelog>
  <changelog author="jengelh@inai.de" date="1484827200">- Check for existence of "statd" user before creating it,
  and do not suppress errors about it.
- Ensure units passed to %service_* are full filenames.
- Pass all units (non-templated) to %service_*.</changelog>
  <changelog author="nfbrown@suse.com" date="1486555200">- update upstream version from 1.3.4 to 2.1.1
  The significant update is that configuration can
  now be read from a central /etc/nfs.conf file, and
  it can include other files such as /etc/sysconfig/nfs
  This means that the old nfs-config.service systemd
  unit is no longer needed.
- /etc/nfs.conf file created to import all sysconfig
  settings except *_OPTIONS directly into running code.
- dropins created to pass *_OPTIONS sysconfig setting to
  the various daemons.
- various specfile improvements, such as using "-D" in
  "install" commands, and adding "verify_permissions".
- "xtab" has not been needed for years and has now been remove.
- sysconfig.nfs updated, particular the ServiceRestart
  declarations have been tuned for systemd units.
- 0003-nfs-server-generator-handle-noauto-mounts-correctly.patch
  Fix the nfs-server-generator so that mounts marked "noauto"
  are not automatically mounted when NFS exported.
  (bsc#1019211)
- 0001-conffile-ignore-empty-environment-variables.patch
  0002-mount-call-setgroups-before-setuid.patch
  Other minor fixes found during testing.
- REMOVED 0001-Make-location-of-nfs-utils_env.sh-configurable.patch
  now included upstream</changelog>
  <changelog author="kukuk@suse.de" date="1493726400">- Prerequire needed group "nogroup"</changelog>
  <changelog author="schwab@suse.de" date="1499256000">- nsm-headers.patch: add missing &lt;stdint.h&gt;</changelog>
  <changelog author="nfbrown@suse.com" date="1507291200">- fix incorrect dependency in
  /usr/lib/systemd/system/nfs-client.target.d/nfs.conf
  When yast restarts "nfs" it should propagate to nfs-client,
  but doesn't.
  (boo#1053691)</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="kukuk@suse.de" date="1530878400">- Create files in /var/lib/nfs via tmpfiles.d [bsc#1100404],
  [FATE#325524]</changelog>
  <changelog author="nfbrown@suse.com" date="1543838400">- 0002-Let-systemd-know-when-rpc.statd-is-needed.patch
  0003-systemd-run-statd-notify-even-when-nfs-client-isn-t-.patch
  Fixes for systemd integration
  (bsc#1116221)
- nfs.conf: spell NFSV4LEASETIME correctly.
  (bsc#1098532)</changelog>
  <changelog author="nfbrown@suse.com" date="1569844800">- Don't make /var/lib/nfs owned by statd.
  Only sm and sm.bak need to be accessible by
  statd or sm-notify after they drop privs.
  Providing they get created, the parent
  directory can be root-owned.
- 0007-statd-user-from-sm
  Change rpc.statd and sm-notify to take uid from the sm
  directory.
  (bsc#1150733 CVE-2019-3689)</changelog>
  <changelog author="nfbrown@suse.com" date="1594296000">- 0008-gssd-replace-non-thread-safe-strtok-with-strsep.patch
  Fix bug with concurrent gssd requests arriving from kernel.
  (bsc#1174260)</changelog>
  <changelog author="nfbrown@suse.com" date="1599134400">- 0009-Convert-remaining-python-scripts-to-python3.patch
  Python is no longer installed by default and these scripts
  work with python3, so request that explicitly.
  (bsc#1173104)</changelog>
  <changelog author="nfbrown@suse.com" date="1616068800">- Add 0010-gssd-Fix-locking-for-machine-principal-list.patch
  (bsc#1183194)</changelog>
  <changelog author="nfbrown@suse.com" date="1616068801">- Add 0011-manpage-Add-a-description-of-the-nconnect-mount-opti.patch
  (bsc#1181651)</changelog>
  <changelog author="nfbrown@suse.com" date="1616068802">- 0012-mountd-reject-unknown-client-IP-when-use_ipaddr.patch
  0013-mountd-Don-t-proactively-add-export-info-when-fh-inf.patch
  0014-mountd-add-logging-for-authentication-results-for-ac.patch
  0015-mountd-add-cache-use-ipaddr-option-to-force-use_ipad.patch
  0116-mountd-make-default-ttl-settable-by-option.patch
  Improve logging of authentication (bsc#1181540)</changelog>
  <changelog author="nfbrown@suse.com" date="1620388800">- Add 0018-Replace-all-var-run-with-run.patch
  /var/run is long deprecated - switch all relevant paths to /run
  (bsc#1185170)</changelog>
  <changelog author="nfbrown@suse.com" date="1621598400">- Add 0019-gssd-use-mutex-to-protect-decrement-of-refcount.patch
  A field was modified by multiple threads without locking.
  This can lead to use-after-free.
  (bsc#1183194)</changelog>
  <changelog author="nfbrown@suse.com" date="1642507200">- Add 0020-mountd-Initialize-logging-early.patch
  If an error or warning message is produced before
  closeall() is called, mountd gets confused and doesn't work.
  (bsc#1194661)</changelog>
</package>
<package pkgid="360ba868747d78cb674effe6dc003003f865e9682ea4d42be0f58717dea2bb3f" name="nfs-doc" arch="aarch64">
  <version epoch="0" ver="2.1.1" rel="10.21.1"/>
  <changelog author="nfbrown@suse.com" date="1471780800">- 0001-Make-location-of-nfs-utils_env.sh-configurable.patch
  1.3.4 moved the config script location to somewhere
  that doesn't exist on openSUSE.  Move it somewhere
  better and install it there.
  (bsc#990356)</changelog>
  <changelog author="nfbrown@suse.com" date="1477051200">- move rpc.svcgssd and corresponding man page from
  nfs-client package to nfs-kernel-server.
  For NFSv4.0 this is needed on client as well as
  the server to support the back-channel.
  (bsc#1005609)</changelog>
  <changelog author="dimstar@opensuse.org" date="1479124800">- Also ignore errors on the first chown call: this can happen
  especially in the build system when shadow is not present and
  the user has not been generated in the %pre phase.</changelog>
  <changelog author="jengelh@inai.de" date="1484827200">- Check for existence of "statd" user before creating it,
  and do not suppress errors about it.
- Ensure units passed to %service_* are full filenames.
- Pass all units (non-templated) to %service_*.</changelog>
  <changelog author="nfbrown@suse.com" date="1486555200">- update upstream version from 1.3.4 to 2.1.1
  The significant update is that configuration can
  now be read from a central /etc/nfs.conf file, and
  it can include other files such as /etc/sysconfig/nfs
  This means that the old nfs-config.service systemd
  unit is no longer needed.
- /etc/nfs.conf file created to import all sysconfig
  settings except *_OPTIONS directly into running code.
- dropins created to pass *_OPTIONS sysconfig setting to
  the various daemons.
- various specfile improvements, such as using "-D" in
  "install" commands, and adding "verify_permissions".
- "xtab" has not been needed for years and has now been remove.
- sysconfig.nfs updated, particular the ServiceRestart
  declarations have been tuned for systemd units.
- 0003-nfs-server-generator-handle-noauto-mounts-correctly.patch
  Fix the nfs-server-generator so that mounts marked "noauto"
  are not automatically mounted when NFS exported.
  (bsc#1019211)
- 0001-conffile-ignore-empty-environment-variables.patch
  0002-mount-call-setgroups-before-setuid.patch
  Other minor fixes found during testing.
- REMOVED 0001-Make-location-of-nfs-utils_env.sh-configurable.patch
  now included upstream</changelog>
  <changelog author="kukuk@suse.de" date="1493726400">- Prerequire needed group "nogroup"</changelog>
  <changelog author="schwab@suse.de" date="1499256000">- nsm-headers.patch: add missing &lt;stdint.h&gt;</changelog>
  <changelog author="nfbrown@suse.com" date="1507291200">- fix incorrect dependency in
  /usr/lib/systemd/system/nfs-client.target.d/nfs.conf
  When yast restarts "nfs" it should propagate to nfs-client,
  but doesn't.
  (boo#1053691)</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="kukuk@suse.de" date="1530878400">- Create files in /var/lib/nfs via tmpfiles.d [bsc#1100404],
  [FATE#325524]</changelog>
  <changelog author="nfbrown@suse.com" date="1543838400">- 0002-Let-systemd-know-when-rpc.statd-is-needed.patch
  0003-systemd-run-statd-notify-even-when-nfs-client-isn-t-.patch
  Fixes for systemd integration
  (bsc#1116221)
- nfs.conf: spell NFSV4LEASETIME correctly.
  (bsc#1098532)</changelog>
  <changelog author="nfbrown@suse.com" date="1569844800">- Don't make /var/lib/nfs owned by statd.
  Only sm and sm.bak need to be accessible by
  statd or sm-notify after they drop privs.
  Providing they get created, the parent
  directory can be root-owned.
- 0007-statd-user-from-sm
  Change rpc.statd and sm-notify to take uid from the sm
  directory.
  (bsc#1150733 CVE-2019-3689)</changelog>
  <changelog author="nfbrown@suse.com" date="1594296000">- 0008-gssd-replace-non-thread-safe-strtok-with-strsep.patch
  Fix bug with concurrent gssd requests arriving from kernel.
  (bsc#1174260)</changelog>
  <changelog author="nfbrown@suse.com" date="1599134400">- 0009-Convert-remaining-python-scripts-to-python3.patch
  Python is no longer installed by default and these scripts
  work with python3, so request that explicitly.
  (bsc#1173104)</changelog>
  <changelog author="nfbrown@suse.com" date="1616068800">- Add 0010-gssd-Fix-locking-for-machine-principal-list.patch
  (bsc#1183194)</changelog>
  <changelog author="nfbrown@suse.com" date="1616068801">- Add 0011-manpage-Add-a-description-of-the-nconnect-mount-opti.patch
  (bsc#1181651)</changelog>
  <changelog author="nfbrown@suse.com" date="1616068802">- 0012-mountd-reject-unknown-client-IP-when-use_ipaddr.patch
  0013-mountd-Don-t-proactively-add-export-info-when-fh-inf.patch
  0014-mountd-add-logging-for-authentication-results-for-ac.patch
  0015-mountd-add-cache-use-ipaddr-option-to-force-use_ipad.patch
  0116-mountd-make-default-ttl-settable-by-option.patch
  Improve logging of authentication (bsc#1181540)</changelog>
  <changelog author="nfbrown@suse.com" date="1620388800">- Add 0018-Replace-all-var-run-with-run.patch
  /var/run is long deprecated - switch all relevant paths to /run
  (bsc#1185170)</changelog>
  <changelog author="nfbrown@suse.com" date="1621598400">- Add 0019-gssd-use-mutex-to-protect-decrement-of-refcount.patch
  A field was modified by multiple threads without locking.
  This can lead to use-after-free.
  (bsc#1183194)</changelog>
  <changelog author="nfbrown@suse.com" date="1642507200">- Add 0020-mountd-Initialize-logging-early.patch
  If an error or warning message is produced before
  closeall() is called, mountd gets confused and doesn't work.
  (bsc#1194661)</changelog>
</package>
<package pkgid="a17a22d433aa4635f9c23909ffcd0c368adf120e75a34533d1300fc149532527" name="nfs-doc" arch="ppc64le">
  <version epoch="0" ver="2.1.1" rel="10.21.1"/>
  <changelog author="nfbrown@suse.com" date="1471780800">- 0001-Make-location-of-nfs-utils_env.sh-configurable.patch
  1.3.4 moved the config script location to somewhere
  that doesn't exist on openSUSE.  Move it somewhere
  better and install it there.
  (bsc#990356)</changelog>
  <changelog author="nfbrown@suse.com" date="1477051200">- move rpc.svcgssd and corresponding man page from
  nfs-client package to nfs-kernel-server.
  For NFSv4.0 this is needed on client as well as
  the server to support the back-channel.
  (bsc#1005609)</changelog>
  <changelog author="dimstar@opensuse.org" date="1479124800">- Also ignore errors on the first chown call: this can happen
  especially in the build system when shadow is not present and
  the user has not been generated in the %pre phase.</changelog>
  <changelog author="jengelh@inai.de" date="1484827200">- Check for existence of "statd" user before creating it,
  and do not suppress errors about it.
- Ensure units passed to %service_* are full filenames.
- Pass all units (non-templated) to %service_*.</changelog>
  <changelog author="nfbrown@suse.com" date="1486555200">- update upstream version from 1.3.4 to 2.1.1
  The significant update is that configuration can
  now be read from a central /etc/nfs.conf file, and
  it can include other files such as /etc/sysconfig/nfs
  This means that the old nfs-config.service systemd
  unit is no longer needed.
- /etc/nfs.conf file created to import all sysconfig
  settings except *_OPTIONS directly into running code.
- dropins created to pass *_OPTIONS sysconfig setting to
  the various daemons.
- various specfile improvements, such as using "-D" in
  "install" commands, and adding "verify_permissions".
- "xtab" has not been needed for years and has now been remove.
- sysconfig.nfs updated, particular the ServiceRestart
  declarations have been tuned for systemd units.
- 0003-nfs-server-generator-handle-noauto-mounts-correctly.patch
  Fix the nfs-server-generator so that mounts marked "noauto"
  are not automatically mounted when NFS exported.
  (bsc#1019211)
- 0001-conffile-ignore-empty-environment-variables.patch
  0002-mount-call-setgroups-before-setuid.patch
  Other minor fixes found during testing.
- REMOVED 0001-Make-location-of-nfs-utils_env.sh-configurable.patch
  now included upstream</changelog>
  <changelog author="kukuk@suse.de" date="1493726400">- Prerequire needed group "nogroup"</changelog>
  <changelog author="schwab@suse.de" date="1499256000">- nsm-headers.patch: add missing &lt;stdint.h&gt;</changelog>
  <changelog author="nfbrown@suse.com" date="1507291200">- fix incorrect dependency in
  /usr/lib/systemd/system/nfs-client.target.d/nfs.conf
  When yast restarts "nfs" it should propagate to nfs-client,
  but doesn't.
  (boo#1053691)</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="kukuk@suse.de" date="1530878400">- Create files in /var/lib/nfs via tmpfiles.d [bsc#1100404],
  [FATE#325524]</changelog>
  <changelog author="nfbrown@suse.com" date="1543838400">- 0002-Let-systemd-know-when-rpc.statd-is-needed.patch
  0003-systemd-run-statd-notify-even-when-nfs-client-isn-t-.patch
  Fixes for systemd integration
  (bsc#1116221)
- nfs.conf: spell NFSV4LEASETIME correctly.
  (bsc#1098532)</changelog>
  <changelog author="nfbrown@suse.com" date="1569844800">- Don't make /var/lib/nfs owned by statd.
  Only sm and sm.bak need to be accessible by
  statd or sm-notify after they drop privs.
  Providing they get created, the parent
  directory can be root-owned.
- 0007-statd-user-from-sm
  Change rpc.statd and sm-notify to take uid from the sm
  directory.
  (bsc#1150733 CVE-2019-3689)</changelog>
  <changelog author="nfbrown@suse.com" date="1594296000">- 0008-gssd-replace-non-thread-safe-strtok-with-strsep.patch
  Fix bug with concurrent gssd requests arriving from kernel.
  (bsc#1174260)</changelog>
  <changelog author="nfbrown@suse.com" date="1599134400">- 0009-Convert-remaining-python-scripts-to-python3.patch
  Python is no longer installed by default and these scripts
  work with python3, so request that explicitly.
  (bsc#1173104)</changelog>
  <changelog author="nfbrown@suse.com" date="1616068800">- Add 0010-gssd-Fix-locking-for-machine-principal-list.patch
  (bsc#1183194)</changelog>
  <changelog author="nfbrown@suse.com" date="1616068801">- Add 0011-manpage-Add-a-description-of-the-nconnect-mount-opti.patch
  (bsc#1181651)</changelog>
  <changelog author="nfbrown@suse.com" date="1616068802">- 0012-mountd-reject-unknown-client-IP-when-use_ipaddr.patch
  0013-mountd-Don-t-proactively-add-export-info-when-fh-inf.patch
  0014-mountd-add-logging-for-authentication-results-for-ac.patch
  0015-mountd-add-cache-use-ipaddr-option-to-force-use_ipad.patch
  0116-mountd-make-default-ttl-settable-by-option.patch
  Improve logging of authentication (bsc#1181540)</changelog>
  <changelog author="nfbrown@suse.com" date="1620388800">- Add 0018-Replace-all-var-run-with-run.patch
  /var/run is long deprecated - switch all relevant paths to /run
  (bsc#1185170)</changelog>
  <changelog author="nfbrown@suse.com" date="1621598400">- Add 0019-gssd-use-mutex-to-protect-decrement-of-refcount.patch
  A field was modified by multiple threads without locking.
  This can lead to use-after-free.
  (bsc#1183194)</changelog>
  <changelog author="nfbrown@suse.com" date="1642507200">- Add 0020-mountd-Initialize-logging-early.patch
  If an error or warning message is produced before
  closeall() is called, mountd gets confused and doesn't work.
  (bsc#1194661)</changelog>
</package>
<package pkgid="d0a618dccdb00b99ac2fd718f654f37de654bf517dbcd18cb41f194ead64e950" name="nfs-doc" arch="s390x">
  <version epoch="0" ver="2.1.1" rel="10.21.1"/>
  <changelog author="nfbrown@suse.com" date="1471780800">- 0001-Make-location-of-nfs-utils_env.sh-configurable.patch
  1.3.4 moved the config script location to somewhere
  that doesn't exist on openSUSE.  Move it somewhere
  better and install it there.
  (bsc#990356)</changelog>
  <changelog author="nfbrown@suse.com" date="1477051200">- move rpc.svcgssd and corresponding man page from
  nfs-client package to nfs-kernel-server.
  For NFSv4.0 this is needed on client as well as
  the server to support the back-channel.
  (bsc#1005609)</changelog>
  <changelog author="dimstar@opensuse.org" date="1479124800">- Also ignore errors on the first chown call: this can happen
  especially in the build system when shadow is not present and
  the user has not been generated in the %pre phase.</changelog>
  <changelog author="jengelh@inai.de" date="1484827200">- Check for existence of "statd" user before creating it,
  and do not suppress errors about it.
- Ensure units passed to %service_* are full filenames.
- Pass all units (non-templated) to %service_*.</changelog>
  <changelog author="nfbrown@suse.com" date="1486555200">- update upstream version from 1.3.4 to 2.1.1
  The significant update is that configuration can
  now be read from a central /etc/nfs.conf file, and
  it can include other files such as /etc/sysconfig/nfs
  This means that the old nfs-config.service systemd
  unit is no longer needed.
- /etc/nfs.conf file created to import all sysconfig
  settings except *_OPTIONS directly into running code.
- dropins created to pass *_OPTIONS sysconfig setting to
  the various daemons.
- various specfile improvements, such as using "-D" in
  "install" commands, and adding "verify_permissions".
- "xtab" has not been needed for years and has now been remove.
- sysconfig.nfs updated, particular the ServiceRestart
  declarations have been tuned for systemd units.
- 0003-nfs-server-generator-handle-noauto-mounts-correctly.patch
  Fix the nfs-server-generator so that mounts marked "noauto"
  are not automatically mounted when NFS exported.
  (bsc#1019211)
- 0001-conffile-ignore-empty-environment-variables.patch
  0002-mount-call-setgroups-before-setuid.patch
  Other minor fixes found during testing.
- REMOVED 0001-Make-location-of-nfs-utils_env.sh-configurable.patch
  now included upstream</changelog>
  <changelog author="kukuk@suse.de" date="1493726400">- Prerequire needed group "nogroup"</changelog>
  <changelog author="schwab@suse.de" date="1499256000">- nsm-headers.patch: add missing &lt;stdint.h&gt;</changelog>
  <changelog author="nfbrown@suse.com" date="1507291200">- fix incorrect dependency in
  /usr/lib/systemd/system/nfs-client.target.d/nfs.conf
  When yast restarts "nfs" it should propagate to nfs-client,
  but doesn't.
  (boo#1053691)</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="kukuk@suse.de" date="1530878400">- Create files in /var/lib/nfs via tmpfiles.d [bsc#1100404],
  [FATE#325524]</changelog>
  <changelog author="nfbrown@suse.com" date="1543838400">- 0002-Let-systemd-know-when-rpc.statd-is-needed.patch
  0003-systemd-run-statd-notify-even-when-nfs-client-isn-t-.patch
  Fixes for systemd integration
  (bsc#1116221)
- nfs.conf: spell NFSV4LEASETIME correctly.
  (bsc#1098532)</changelog>
  <changelog author="nfbrown@suse.com" date="1569844800">- Don't make /var/lib/nfs owned by statd.
  Only sm and sm.bak need to be accessible by
  statd or sm-notify after they drop privs.
  Providing they get created, the parent
  directory can be root-owned.
- 0007-statd-user-from-sm
  Change rpc.statd and sm-notify to take uid from the sm
  directory.
  (bsc#1150733 CVE-2019-3689)</changelog>
  <changelog author="nfbrown@suse.com" date="1594296000">- 0008-gssd-replace-non-thread-safe-strtok-with-strsep.patch
  Fix bug with concurrent gssd requests arriving from kernel.
  (bsc#1174260)</changelog>
  <changelog author="nfbrown@suse.com" date="1599134400">- 0009-Convert-remaining-python-scripts-to-python3.patch
  Python is no longer installed by default and these scripts
  work with python3, so request that explicitly.
  (bsc#1173104)</changelog>
  <changelog author="nfbrown@suse.com" date="1616068800">- Add 0010-gssd-Fix-locking-for-machine-principal-list.patch
  (bsc#1183194)</changelog>
  <changelog author="nfbrown@suse.com" date="1616068801">- Add 0011-manpage-Add-a-description-of-the-nconnect-mount-opti.patch
  (bsc#1181651)</changelog>
  <changelog author="nfbrown@suse.com" date="1616068802">- 0012-mountd-reject-unknown-client-IP-when-use_ipaddr.patch
  0013-mountd-Don-t-proactively-add-export-info-when-fh-inf.patch
  0014-mountd-add-logging-for-authentication-results-for-ac.patch
  0015-mountd-add-cache-use-ipaddr-option-to-force-use_ipad.patch
  0116-mountd-make-default-ttl-settable-by-option.patch
  Improve logging of authentication (bsc#1181540)</changelog>
  <changelog author="nfbrown@suse.com" date="1620388800">- Add 0018-Replace-all-var-run-with-run.patch
  /var/run is long deprecated - switch all relevant paths to /run
  (bsc#1185170)</changelog>
  <changelog author="nfbrown@suse.com" date="1621598400">- Add 0019-gssd-use-mutex-to-protect-decrement-of-refcount.patch
  A field was modified by multiple threads without locking.
  This can lead to use-after-free.
  (bsc#1183194)</changelog>
  <changelog author="nfbrown@suse.com" date="1642507200">- Add 0020-mountd-Initialize-logging-early.patch
  If an error or warning message is produced before
  closeall() is called, mountd gets confused and doesn't work.
  (bsc#1194661)</changelog>
</package>
<package pkgid="42ff6b47d96b91e445c12f8c17c8193082f380cf80ee8f4a981d35766b60e661" name="nfs-doc" arch="x86_64">
  <version epoch="0" ver="2.1.1" rel="10.21.1"/>
  <changelog author="nfbrown@suse.com" date="1471780800">- 0001-Make-location-of-nfs-utils_env.sh-configurable.patch
  1.3.4 moved the config script location to somewhere
  that doesn't exist on openSUSE.  Move it somewhere
  better and install it there.
  (bsc#990356)</changelog>
  <changelog author="nfbrown@suse.com" date="1477051200">- move rpc.svcgssd and corresponding man page from
  nfs-client package to nfs-kernel-server.
  For NFSv4.0 this is needed on client as well as
  the server to support the back-channel.
  (bsc#1005609)</changelog>
  <changelog author="dimstar@opensuse.org" date="1479124800">- Also ignore errors on the first chown call: this can happen
  especially in the build system when shadow is not present and
  the user has not been generated in the %pre phase.</changelog>
  <changelog author="jengelh@inai.de" date="1484827200">- Check for existence of "statd" user before creating it,
  and do not suppress errors about it.
- Ensure units passed to %service_* are full filenames.
- Pass all units (non-templated) to %service_*.</changelog>
  <changelog author="nfbrown@suse.com" date="1486555200">- update upstream version from 1.3.4 to 2.1.1
  The significant update is that configuration can
  now be read from a central /etc/nfs.conf file, and
  it can include other files such as /etc/sysconfig/nfs
  This means that the old nfs-config.service systemd
  unit is no longer needed.
- /etc/nfs.conf file created to import all sysconfig
  settings except *_OPTIONS directly into running code.
- dropins created to pass *_OPTIONS sysconfig setting to
  the various daemons.
- various specfile improvements, such as using "-D" in
  "install" commands, and adding "verify_permissions".
- "xtab" has not been needed for years and has now been remove.
- sysconfig.nfs updated, particular the ServiceRestart
  declarations have been tuned for systemd units.
- 0003-nfs-server-generator-handle-noauto-mounts-correctly.patch
  Fix the nfs-server-generator so that mounts marked "noauto"
  are not automatically mounted when NFS exported.
  (bsc#1019211)
- 0001-conffile-ignore-empty-environment-variables.patch
  0002-mount-call-setgroups-before-setuid.patch
  Other minor fixes found during testing.
- REMOVED 0001-Make-location-of-nfs-utils_env.sh-configurable.patch
  now included upstream</changelog>
  <changelog author="kukuk@suse.de" date="1493726400">- Prerequire needed group "nogroup"</changelog>
  <changelog author="schwab@suse.de" date="1499256000">- nsm-headers.patch: add missing &lt;stdint.h&gt;</changelog>
  <changelog author="nfbrown@suse.com" date="1507291200">- fix incorrect dependency in
  /usr/lib/systemd/system/nfs-client.target.d/nfs.conf
  When yast restarts "nfs" it should propagate to nfs-client,
  but doesn't.
  (boo#1053691)</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="kukuk@suse.de" date="1530878400">- Create files in /var/lib/nfs via tmpfiles.d [bsc#1100404],
  [FATE#325524]</changelog>
  <changelog author="nfbrown@suse.com" date="1543838400">- 0002-Let-systemd-know-when-rpc.statd-is-needed.patch
  0003-systemd-run-statd-notify-even-when-nfs-client-isn-t-.patch
  Fixes for systemd integration
  (bsc#1116221)
- nfs.conf: spell NFSV4LEASETIME correctly.
  (bsc#1098532)</changelog>
  <changelog author="nfbrown@suse.com" date="1569844800">- Don't make /var/lib/nfs owned by statd.
  Only sm and sm.bak need to be accessible by
  statd or sm-notify after they drop privs.
  Providing they get created, the parent
  directory can be root-owned.
- 0007-statd-user-from-sm
  Change rpc.statd and sm-notify to take uid from the sm
  directory.
  (bsc#1150733 CVE-2019-3689)</changelog>
  <changelog author="nfbrown@suse.com" date="1594296000">- 0008-gssd-replace-non-thread-safe-strtok-with-strsep.patch
  Fix bug with concurrent gssd requests arriving from kernel.
  (bsc#1174260)</changelog>
  <changelog author="nfbrown@suse.com" date="1599134400">- 0009-Convert-remaining-python-scripts-to-python3.patch
  Python is no longer installed by default and these scripts
  work with python3, so request that explicitly.
  (bsc#1173104)</changelog>
  <changelog author="nfbrown@suse.com" date="1616068800">- Add 0010-gssd-Fix-locking-for-machine-principal-list.patch
  (bsc#1183194)</changelog>
  <changelog author="nfbrown@suse.com" date="1616068801">- Add 0011-manpage-Add-a-description-of-the-nconnect-mount-opti.patch
  (bsc#1181651)</changelog>
  <changelog author="nfbrown@suse.com" date="1616068802">- 0012-mountd-reject-unknown-client-IP-when-use_ipaddr.patch
  0013-mountd-Don-t-proactively-add-export-info-when-fh-inf.patch
  0014-mountd-add-logging-for-authentication-results-for-ac.patch
  0015-mountd-add-cache-use-ipaddr-option-to-force-use_ipad.patch
  0116-mountd-make-default-ttl-settable-by-option.patch
  Improve logging of authentication (bsc#1181540)</changelog>
  <changelog author="nfbrown@suse.com" date="1620388800">- Add 0018-Replace-all-var-run-with-run.patch
  /var/run is long deprecated - switch all relevant paths to /run
  (bsc#1185170)</changelog>
  <changelog author="nfbrown@suse.com" date="1621598400">- Add 0019-gssd-use-mutex-to-protect-decrement-of-refcount.patch
  A field was modified by multiple threads without locking.
  This can lead to use-after-free.
  (bsc#1183194)</changelog>
  <changelog author="nfbrown@suse.com" date="1642507200">- Add 0020-mountd-Initialize-logging-early.patch
  If an error or warning message is produced before
  closeall() is called, mountd gets confused and doesn't work.
  (bsc#1194661)</changelog>
</package>
<package pkgid="e483795ac838a7421c766ac67993a5598fc94070674ac8a2dbf0d71a50d0eebd" name="nfs-kernel-server" arch="aarch64">
  <version epoch="0" ver="2.1.1" rel="10.21.1"/>
  <changelog author="nfbrown@suse.com" date="1471780800">- 0001-Make-location-of-nfs-utils_env.sh-configurable.patch
  1.3.4 moved the config script location to somewhere
  that doesn't exist on openSUSE.  Move it somewhere
  better and install it there.
  (bsc#990356)</changelog>
  <changelog author="nfbrown@suse.com" date="1477051200">- move rpc.svcgssd and corresponding man page from
  nfs-client package to nfs-kernel-server.
  For NFSv4.0 this is needed on client as well as
  the server to support the back-channel.
  (bsc#1005609)</changelog>
  <changelog author="dimstar@opensuse.org" date="1479124800">- Also ignore errors on the first chown call: this can happen
  especially in the build system when shadow is not present and
  the user has not been generated in the %pre phase.</changelog>
  <changelog author="jengelh@inai.de" date="1484827200">- Check for existence of "statd" user before creating it,
  and do not suppress errors about it.
- Ensure units passed to %service_* are full filenames.
- Pass all units (non-templated) to %service_*.</changelog>
  <changelog author="nfbrown@suse.com" date="1486555200">- update upstream version from 1.3.4 to 2.1.1
  The significant update is that configuration can
  now be read from a central /etc/nfs.conf file, and
  it can include other files such as /etc/sysconfig/nfs
  This means that the old nfs-config.service systemd
  unit is no longer needed.
- /etc/nfs.conf file created to import all sysconfig
  settings except *_OPTIONS directly into running code.
- dropins created to pass *_OPTIONS sysconfig setting to
  the various daemons.
- various specfile improvements, such as using "-D" in
  "install" commands, and adding "verify_permissions".
- "xtab" has not been needed for years and has now been remove.
- sysconfig.nfs updated, particular the ServiceRestart
  declarations have been tuned for systemd units.
- 0003-nfs-server-generator-handle-noauto-mounts-correctly.patch
  Fix the nfs-server-generator so that mounts marked "noauto"
  are not automatically mounted when NFS exported.
  (bsc#1019211)
- 0001-conffile-ignore-empty-environment-variables.patch
  0002-mount-call-setgroups-before-setuid.patch
  Other minor fixes found during testing.
- REMOVED 0001-Make-location-of-nfs-utils_env.sh-configurable.patch
  now included upstream</changelog>
  <changelog author="kukuk@suse.de" date="1493726400">- Prerequire needed group "nogroup"</changelog>
  <changelog author="schwab@suse.de" date="1499256000">- nsm-headers.patch: add missing &lt;stdint.h&gt;</changelog>
  <changelog author="nfbrown@suse.com" date="1507291200">- fix incorrect dependency in
  /usr/lib/systemd/system/nfs-client.target.d/nfs.conf
  When yast restarts "nfs" it should propagate to nfs-client,
  but doesn't.
  (boo#1053691)</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="kukuk@suse.de" date="1530878400">- Create files in /var/lib/nfs via tmpfiles.d [bsc#1100404],
  [FATE#325524]</changelog>
  <changelog author="nfbrown@suse.com" date="1543838400">- 0002-Let-systemd-know-when-rpc.statd-is-needed.patch
  0003-systemd-run-statd-notify-even-when-nfs-client-isn-t-.patch
  Fixes for systemd integration
  (bsc#1116221)
- nfs.conf: spell NFSV4LEASETIME correctly.
  (bsc#1098532)</changelog>
  <changelog author="nfbrown@suse.com" date="1569844800">- Don't make /var/lib/nfs owned by statd.
  Only sm and sm.bak need to be accessible by
  statd or sm-notify after they drop privs.
  Providing they get created, the parent
  directory can be root-owned.
- 0007-statd-user-from-sm
  Change rpc.statd and sm-notify to take uid from the sm
  directory.
  (bsc#1150733 CVE-2019-3689)</changelog>
  <changelog author="nfbrown@suse.com" date="1594296000">- 0008-gssd-replace-non-thread-safe-strtok-with-strsep.patch
  Fix bug with concurrent gssd requests arriving from kernel.
  (bsc#1174260)</changelog>
  <changelog author="nfbrown@suse.com" date="1599134400">- 0009-Convert-remaining-python-scripts-to-python3.patch
  Python is no longer installed by default and these scripts
  work with python3, so request that explicitly.
  (bsc#1173104)</changelog>
  <changelog author="nfbrown@suse.com" date="1616068800">- Add 0010-gssd-Fix-locking-for-machine-principal-list.patch
  (bsc#1183194)</changelog>
  <changelog author="nfbrown@suse.com" date="1616068801">- Add 0011-manpage-Add-a-description-of-the-nconnect-mount-opti.patch
  (bsc#1181651)</changelog>
  <changelog author="nfbrown@suse.com" date="1616068802">- 0012-mountd-reject-unknown-client-IP-when-use_ipaddr.patch
  0013-mountd-Don-t-proactively-add-export-info-when-fh-inf.patch
  0014-mountd-add-logging-for-authentication-results-for-ac.patch
  0015-mountd-add-cache-use-ipaddr-option-to-force-use_ipad.patch
  0116-mountd-make-default-ttl-settable-by-option.patch
  Improve logging of authentication (bsc#1181540)</changelog>
  <changelog author="nfbrown@suse.com" date="1620388800">- Add 0018-Replace-all-var-run-with-run.patch
  /var/run is long deprecated - switch all relevant paths to /run
  (bsc#1185170)</changelog>
  <changelog author="nfbrown@suse.com" date="1621598400">- Add 0019-gssd-use-mutex-to-protect-decrement-of-refcount.patch
  A field was modified by multiple threads without locking.
  This can lead to use-after-free.
  (bsc#1183194)</changelog>
  <changelog author="nfbrown@suse.com" date="1642507200">- Add 0020-mountd-Initialize-logging-early.patch
  If an error or warning message is produced before
  closeall() is called, mountd gets confused and doesn't work.
  (bsc#1194661)</changelog>
</package>
<package pkgid="b499d3d5d306ef817ff817eed05ed9bf5a1a7b0a96ae364b9303edc72a34279a" name="nfs-kernel-server" arch="ppc64le">
  <version epoch="0" ver="2.1.1" rel="10.21.1"/>
  <changelog author="nfbrown@suse.com" date="1471780800">- 0001-Make-location-of-nfs-utils_env.sh-configurable.patch
  1.3.4 moved the config script location to somewhere
  that doesn't exist on openSUSE.  Move it somewhere
  better and install it there.
  (bsc#990356)</changelog>
  <changelog author="nfbrown@suse.com" date="1477051200">- move rpc.svcgssd and corresponding man page from
  nfs-client package to nfs-kernel-server.
  For NFSv4.0 this is needed on client as well as
  the server to support the back-channel.
  (bsc#1005609)</changelog>
  <changelog author="dimstar@opensuse.org" date="1479124800">- Also ignore errors on the first chown call: this can happen
  especially in the build system when shadow is not present and
  the user has not been generated in the %pre phase.</changelog>
  <changelog author="jengelh@inai.de" date="1484827200">- Check for existence of "statd" user before creating it,
  and do not suppress errors about it.
- Ensure units passed to %service_* are full filenames.
- Pass all units (non-templated) to %service_*.</changelog>
  <changelog author="nfbrown@suse.com" date="1486555200">- update upstream version from 1.3.4 to 2.1.1
  The significant update is that configuration can
  now be read from a central /etc/nfs.conf file, and
  it can include other files such as /etc/sysconfig/nfs
  This means that the old nfs-config.service systemd
  unit is no longer needed.
- /etc/nfs.conf file created to import all sysconfig
  settings except *_OPTIONS directly into running code.
- dropins created to pass *_OPTIONS sysconfig setting to
  the various daemons.
- various specfile improvements, such as using "-D" in
  "install" commands, and adding "verify_permissions".
- "xtab" has not been needed for years and has now been remove.
- sysconfig.nfs updated, particular the ServiceRestart
  declarations have been tuned for systemd units.
- 0003-nfs-server-generator-handle-noauto-mounts-correctly.patch
  Fix the nfs-server-generator so that mounts marked "noauto"
  are not automatically mounted when NFS exported.
  (bsc#1019211)
- 0001-conffile-ignore-empty-environment-variables.patch
  0002-mount-call-setgroups-before-setuid.patch
  Other minor fixes found during testing.
- REMOVED 0001-Make-location-of-nfs-utils_env.sh-configurable.patch
  now included upstream</changelog>
  <changelog author="kukuk@suse.de" date="1493726400">- Prerequire needed group "nogroup"</changelog>
  <changelog author="schwab@suse.de" date="1499256000">- nsm-headers.patch: add missing &lt;stdint.h&gt;</changelog>
  <changelog author="nfbrown@suse.com" date="1507291200">- fix incorrect dependency in
  /usr/lib/systemd/system/nfs-client.target.d/nfs.conf
  When yast restarts "nfs" it should propagate to nfs-client,
  but doesn't.
  (boo#1053691)</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="kukuk@suse.de" date="1530878400">- Create files in /var/lib/nfs via tmpfiles.d [bsc#1100404],
  [FATE#325524]</changelog>
  <changelog author="nfbrown@suse.com" date="1543838400">- 0002-Let-systemd-know-when-rpc.statd-is-needed.patch
  0003-systemd-run-statd-notify-even-when-nfs-client-isn-t-.patch
  Fixes for systemd integration
  (bsc#1116221)
- nfs.conf: spell NFSV4LEASETIME correctly.
  (bsc#1098532)</changelog>
  <changelog author="nfbrown@suse.com" date="1569844800">- Don't make /var/lib/nfs owned by statd.
  Only sm and sm.bak need to be accessible by
  statd or sm-notify after they drop privs.
  Providing they get created, the parent
  directory can be root-owned.
- 0007-statd-user-from-sm
  Change rpc.statd and sm-notify to take uid from the sm
  directory.
  (bsc#1150733 CVE-2019-3689)</changelog>
  <changelog author="nfbrown@suse.com" date="1594296000">- 0008-gssd-replace-non-thread-safe-strtok-with-strsep.patch
  Fix bug with concurrent gssd requests arriving from kernel.
  (bsc#1174260)</changelog>
  <changelog author="nfbrown@suse.com" date="1599134400">- 0009-Convert-remaining-python-scripts-to-python3.patch
  Python is no longer installed by default and these scripts
  work with python3, so request that explicitly.
  (bsc#1173104)</changelog>
  <changelog author="nfbrown@suse.com" date="1616068800">- Add 0010-gssd-Fix-locking-for-machine-principal-list.patch
  (bsc#1183194)</changelog>
  <changelog author="nfbrown@suse.com" date="1616068801">- Add 0011-manpage-Add-a-description-of-the-nconnect-mount-opti.patch
  (bsc#1181651)</changelog>
  <changelog author="nfbrown@suse.com" date="1616068802">- 0012-mountd-reject-unknown-client-IP-when-use_ipaddr.patch
  0013-mountd-Don-t-proactively-add-export-info-when-fh-inf.patch
  0014-mountd-add-logging-for-authentication-results-for-ac.patch
  0015-mountd-add-cache-use-ipaddr-option-to-force-use_ipad.patch
  0116-mountd-make-default-ttl-settable-by-option.patch
  Improve logging of authentication (bsc#1181540)</changelog>
  <changelog author="nfbrown@suse.com" date="1620388800">- Add 0018-Replace-all-var-run-with-run.patch
  /var/run is long deprecated - switch all relevant paths to /run
  (bsc#1185170)</changelog>
  <changelog author="nfbrown@suse.com" date="1621598400">- Add 0019-gssd-use-mutex-to-protect-decrement-of-refcount.patch
  A field was modified by multiple threads without locking.
  This can lead to use-after-free.
  (bsc#1183194)</changelog>
  <changelog author="nfbrown@suse.com" date="1642507200">- Add 0020-mountd-Initialize-logging-early.patch
  If an error or warning message is produced before
  closeall() is called, mountd gets confused and doesn't work.
  (bsc#1194661)</changelog>
</package>
<package pkgid="f94139a23e2d134fa73c3e41f2b72dae96169586c5388475cdbbbec235812894" name="nfs-kernel-server" arch="s390x">
  <version epoch="0" ver="2.1.1" rel="10.21.1"/>
  <changelog author="nfbrown@suse.com" date="1471780800">- 0001-Make-location-of-nfs-utils_env.sh-configurable.patch
  1.3.4 moved the config script location to somewhere
  that doesn't exist on openSUSE.  Move it somewhere
  better and install it there.
  (bsc#990356)</changelog>
  <changelog author="nfbrown@suse.com" date="1477051200">- move rpc.svcgssd and corresponding man page from
  nfs-client package to nfs-kernel-server.
  For NFSv4.0 this is needed on client as well as
  the server to support the back-channel.
  (bsc#1005609)</changelog>
  <changelog author="dimstar@opensuse.org" date="1479124800">- Also ignore errors on the first chown call: this can happen
  especially in the build system when shadow is not present and
  the user has not been generated in the %pre phase.</changelog>
  <changelog author="jengelh@inai.de" date="1484827200">- Check for existence of "statd" user before creating it,
  and do not suppress errors about it.
- Ensure units passed to %service_* are full filenames.
- Pass all units (non-templated) to %service_*.</changelog>
  <changelog author="nfbrown@suse.com" date="1486555200">- update upstream version from 1.3.4 to 2.1.1
  The significant update is that configuration can
  now be read from a central /etc/nfs.conf file, and
  it can include other files such as /etc/sysconfig/nfs
  This means that the old nfs-config.service systemd
  unit is no longer needed.
- /etc/nfs.conf file created to import all sysconfig
  settings except *_OPTIONS directly into running code.
- dropins created to pass *_OPTIONS sysconfig setting to
  the various daemons.
- various specfile improvements, such as using "-D" in
  "install" commands, and adding "verify_permissions".
- "xtab" has not been needed for years and has now been remove.
- sysconfig.nfs updated, particular the ServiceRestart
  declarations have been tuned for systemd units.
- 0003-nfs-server-generator-handle-noauto-mounts-correctly.patch
  Fix the nfs-server-generator so that mounts marked "noauto"
  are not automatically mounted when NFS exported.
  (bsc#1019211)
- 0001-conffile-ignore-empty-environment-variables.patch
  0002-mount-call-setgroups-before-setuid.patch
  Other minor fixes found during testing.
- REMOVED 0001-Make-location-of-nfs-utils_env.sh-configurable.patch
  now included upstream</changelog>
  <changelog author="kukuk@suse.de" date="1493726400">- Prerequire needed group "nogroup"</changelog>
  <changelog author="schwab@suse.de" date="1499256000">- nsm-headers.patch: add missing &lt;stdint.h&gt;</changelog>
  <changelog author="nfbrown@suse.com" date="1507291200">- fix incorrect dependency in
  /usr/lib/systemd/system/nfs-client.target.d/nfs.conf
  When yast restarts "nfs" it should propagate to nfs-client,
  but doesn't.
  (boo#1053691)</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="kukuk@suse.de" date="1530878400">- Create files in /var/lib/nfs via tmpfiles.d [bsc#1100404],
  [FATE#325524]</changelog>
  <changelog author="nfbrown@suse.com" date="1543838400">- 0002-Let-systemd-know-when-rpc.statd-is-needed.patch
  0003-systemd-run-statd-notify-even-when-nfs-client-isn-t-.patch
  Fixes for systemd integration
  (bsc#1116221)
- nfs.conf: spell NFSV4LEASETIME correctly.
  (bsc#1098532)</changelog>
  <changelog author="nfbrown@suse.com" date="1569844800">- Don't make /var/lib/nfs owned by statd.
  Only sm and sm.bak need to be accessible by
  statd or sm-notify after they drop privs.
  Providing they get created, the parent
  directory can be root-owned.
- 0007-statd-user-from-sm
  Change rpc.statd and sm-notify to take uid from the sm
  directory.
  (bsc#1150733 CVE-2019-3689)</changelog>
  <changelog author="nfbrown@suse.com" date="1594296000">- 0008-gssd-replace-non-thread-safe-strtok-with-strsep.patch
  Fix bug with concurrent gssd requests arriving from kernel.
  (bsc#1174260)</changelog>
  <changelog author="nfbrown@suse.com" date="1599134400">- 0009-Convert-remaining-python-scripts-to-python3.patch
  Python is no longer installed by default and these scripts
  work with python3, so request that explicitly.
  (bsc#1173104)</changelog>
  <changelog author="nfbrown@suse.com" date="1616068800">- Add 0010-gssd-Fix-locking-for-machine-principal-list.patch
  (bsc#1183194)</changelog>
  <changelog author="nfbrown@suse.com" date="1616068801">- Add 0011-manpage-Add-a-description-of-the-nconnect-mount-opti.patch
  (bsc#1181651)</changelog>
  <changelog author="nfbrown@suse.com" date="1616068802">- 0012-mountd-reject-unknown-client-IP-when-use_ipaddr.patch
  0013-mountd-Don-t-proactively-add-export-info-when-fh-inf.patch
  0014-mountd-add-logging-for-authentication-results-for-ac.patch
  0015-mountd-add-cache-use-ipaddr-option-to-force-use_ipad.patch
  0116-mountd-make-default-ttl-settable-by-option.patch
  Improve logging of authentication (bsc#1181540)</changelog>
  <changelog author="nfbrown@suse.com" date="1620388800">- Add 0018-Replace-all-var-run-with-run.patch
  /var/run is long deprecated - switch all relevant paths to /run
  (bsc#1185170)</changelog>
  <changelog author="nfbrown@suse.com" date="1621598400">- Add 0019-gssd-use-mutex-to-protect-decrement-of-refcount.patch
  A field was modified by multiple threads without locking.
  This can lead to use-after-free.
  (bsc#1183194)</changelog>
  <changelog author="nfbrown@suse.com" date="1642507200">- Add 0020-mountd-Initialize-logging-early.patch
  If an error or warning message is produced before
  closeall() is called, mountd gets confused and doesn't work.
  (bsc#1194661)</changelog>
</package>
<package pkgid="6e21722d7cba4516799ac61f1337a4ca1d6438edbdca69c3e8f3f7cf3865a647" name="nfs-kernel-server" arch="x86_64">
  <version epoch="0" ver="2.1.1" rel="10.21.1"/>
  <changelog author="nfbrown@suse.com" date="1471780800">- 0001-Make-location-of-nfs-utils_env.sh-configurable.patch
  1.3.4 moved the config script location to somewhere
  that doesn't exist on openSUSE.  Move it somewhere
  better and install it there.
  (bsc#990356)</changelog>
  <changelog author="nfbrown@suse.com" date="1477051200">- move rpc.svcgssd and corresponding man page from
  nfs-client package to nfs-kernel-server.
  For NFSv4.0 this is needed on client as well as
  the server to support the back-channel.
  (bsc#1005609)</changelog>
  <changelog author="dimstar@opensuse.org" date="1479124800">- Also ignore errors on the first chown call: this can happen
  especially in the build system when shadow is not present and
  the user has not been generated in the %pre phase.</changelog>
  <changelog author="jengelh@inai.de" date="1484827200">- Check for existence of "statd" user before creating it,
  and do not suppress errors about it.
- Ensure units passed to %service_* are full filenames.
- Pass all units (non-templated) to %service_*.</changelog>
  <changelog author="nfbrown@suse.com" date="1486555200">- update upstream version from 1.3.4 to 2.1.1
  The significant update is that configuration can
  now be read from a central /etc/nfs.conf file, and
  it can include other files such as /etc/sysconfig/nfs
  This means that the old nfs-config.service systemd
  unit is no longer needed.
- /etc/nfs.conf file created to import all sysconfig
  settings except *_OPTIONS directly into running code.
- dropins created to pass *_OPTIONS sysconfig setting to
  the various daemons.
- various specfile improvements, such as using "-D" in
  "install" commands, and adding "verify_permissions".
- "xtab" has not been needed for years and has now been remove.
- sysconfig.nfs updated, particular the ServiceRestart
  declarations have been tuned for systemd units.
- 0003-nfs-server-generator-handle-noauto-mounts-correctly.patch
  Fix the nfs-server-generator so that mounts marked "noauto"
  are not automatically mounted when NFS exported.
  (bsc#1019211)
- 0001-conffile-ignore-empty-environment-variables.patch
  0002-mount-call-setgroups-before-setuid.patch
  Other minor fixes found during testing.
- REMOVED 0001-Make-location-of-nfs-utils_env.sh-configurable.patch
  now included upstream</changelog>
  <changelog author="kukuk@suse.de" date="1493726400">- Prerequire needed group "nogroup"</changelog>
  <changelog author="schwab@suse.de" date="1499256000">- nsm-headers.patch: add missing &lt;stdint.h&gt;</changelog>
  <changelog author="nfbrown@suse.com" date="1507291200">- fix incorrect dependency in
  /usr/lib/systemd/system/nfs-client.target.d/nfs.conf
  When yast restarts "nfs" it should propagate to nfs-client,
  but doesn't.
  (boo#1053691)</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="kukuk@suse.de" date="1530878400">- Create files in /var/lib/nfs via tmpfiles.d [bsc#1100404],
  [FATE#325524]</changelog>
  <changelog author="nfbrown@suse.com" date="1543838400">- 0002-Let-systemd-know-when-rpc.statd-is-needed.patch
  0003-systemd-run-statd-notify-even-when-nfs-client-isn-t-.patch
  Fixes for systemd integration
  (bsc#1116221)
- nfs.conf: spell NFSV4LEASETIME correctly.
  (bsc#1098532)</changelog>
  <changelog author="nfbrown@suse.com" date="1569844800">- Don't make /var/lib/nfs owned by statd.
  Only sm and sm.bak need to be accessible by
  statd or sm-notify after they drop privs.
  Providing they get created, the parent
  directory can be root-owned.
- 0007-statd-user-from-sm
  Change rpc.statd and sm-notify to take uid from the sm
  directory.
  (bsc#1150733 CVE-2019-3689)</changelog>
  <changelog author="nfbrown@suse.com" date="1594296000">- 0008-gssd-replace-non-thread-safe-strtok-with-strsep.patch
  Fix bug with concurrent gssd requests arriving from kernel.
  (bsc#1174260)</changelog>
  <changelog author="nfbrown@suse.com" date="1599134400">- 0009-Convert-remaining-python-scripts-to-python3.patch
  Python is no longer installed by default and these scripts
  work with python3, so request that explicitly.
  (bsc#1173104)</changelog>
  <changelog author="nfbrown@suse.com" date="1616068800">- Add 0010-gssd-Fix-locking-for-machine-principal-list.patch
  (bsc#1183194)</changelog>
  <changelog author="nfbrown@suse.com" date="1616068801">- Add 0011-manpage-Add-a-description-of-the-nconnect-mount-opti.patch
  (bsc#1181651)</changelog>
  <changelog author="nfbrown@suse.com" date="1616068802">- 0012-mountd-reject-unknown-client-IP-when-use_ipaddr.patch
  0013-mountd-Don-t-proactively-add-export-info-when-fh-inf.patch
  0014-mountd-add-logging-for-authentication-results-for-ac.patch
  0015-mountd-add-cache-use-ipaddr-option-to-force-use_ipad.patch
  0116-mountd-make-default-ttl-settable-by-option.patch
  Improve logging of authentication (bsc#1181540)</changelog>
  <changelog author="nfbrown@suse.com" date="1620388800">- Add 0018-Replace-all-var-run-with-run.patch
  /var/run is long deprecated - switch all relevant paths to /run
  (bsc#1185170)</changelog>
  <changelog author="nfbrown@suse.com" date="1621598400">- Add 0019-gssd-use-mutex-to-protect-decrement-of-refcount.patch
  A field was modified by multiple threads without locking.
  This can lead to use-after-free.
  (bsc#1183194)</changelog>
  <changelog author="nfbrown@suse.com" date="1642507200">- Add 0020-mountd-Initialize-logging-early.patch
  If an error or warning message is produced before
  closeall() is called, mountd gets confused and doesn't work.
  (bsc#1194661)</changelog>
</package>
<package pkgid="817fbe3e860b2cb0e8e68a67c459d2922e402e7d70eff690671e3176fa9eec92" name="nfs-utils" arch="src">
  <version epoch="0" ver="2.1.1" rel="10.21.1"/>
  <changelog author="nfbrown@suse.com" date="1471780800">- 0001-Make-location-of-nfs-utils_env.sh-configurable.patch
  1.3.4 moved the config script location to somewhere
  that doesn't exist on openSUSE.  Move it somewhere
  better and install it there.
  (bsc#990356)</changelog>
  <changelog author="nfbrown@suse.com" date="1477051200">- move rpc.svcgssd and corresponding man page from
  nfs-client package to nfs-kernel-server.
  For NFSv4.0 this is needed on client as well as
  the server to support the back-channel.
  (bsc#1005609)</changelog>
  <changelog author="dimstar@opensuse.org" date="1479124800">- Also ignore errors on the first chown call: this can happen
  especially in the build system when shadow is not present and
  the user has not been generated in the %pre phase.</changelog>
  <changelog author="jengelh@inai.de" date="1484827200">- Check for existence of "statd" user before creating it,
  and do not suppress errors about it.
- Ensure units passed to %service_* are full filenames.
- Pass all units (non-templated) to %service_*.</changelog>
  <changelog author="nfbrown@suse.com" date="1486555200">- update upstream version from 1.3.4 to 2.1.1
  The significant update is that configuration can
  now be read from a central /etc/nfs.conf file, and
  it can include other files such as /etc/sysconfig/nfs
  This means that the old nfs-config.service systemd
  unit is no longer needed.
- /etc/nfs.conf file created to import all sysconfig
  settings except *_OPTIONS directly into running code.
- dropins created to pass *_OPTIONS sysconfig setting to
  the various daemons.
- various specfile improvements, such as using "-D" in
  "install" commands, and adding "verify_permissions".
- "xtab" has not been needed for years and has now been remove.
- sysconfig.nfs updated, particular the ServiceRestart
  declarations have been tuned for systemd units.
- 0003-nfs-server-generator-handle-noauto-mounts-correctly.patch
  Fix the nfs-server-generator so that mounts marked "noauto"
  are not automatically mounted when NFS exported.
  (bsc#1019211)
- 0001-conffile-ignore-empty-environment-variables.patch
  0002-mount-call-setgroups-before-setuid.patch
  Other minor fixes found during testing.
- REMOVED 0001-Make-location-of-nfs-utils_env.sh-configurable.patch
  now included upstream</changelog>
  <changelog author="kukuk@suse.de" date="1493726400">- Prerequire needed group "nogroup"</changelog>
  <changelog author="schwab@suse.de" date="1499256000">- nsm-headers.patch: add missing &lt;stdint.h&gt;</changelog>
  <changelog author="nfbrown@suse.com" date="1507291200">- fix incorrect dependency in
  /usr/lib/systemd/system/nfs-client.target.d/nfs.conf
  When yast restarts "nfs" it should propagate to nfs-client,
  but doesn't.
  (boo#1053691)</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="kukuk@suse.de" date="1530878400">- Create files in /var/lib/nfs via tmpfiles.d [bsc#1100404],
  [FATE#325524]</changelog>
  <changelog author="nfbrown@suse.com" date="1543838400">- 0002-Let-systemd-know-when-rpc.statd-is-needed.patch
  0003-systemd-run-statd-notify-even-when-nfs-client-isn-t-.patch
  Fixes for systemd integration
  (bsc#1116221)
- nfs.conf: spell NFSV4LEASETIME correctly.
  (bsc#1098532)</changelog>
  <changelog author="nfbrown@suse.com" date="1569844800">- Don't make /var/lib/nfs owned by statd.
  Only sm and sm.bak need to be accessible by
  statd or sm-notify after they drop privs.
  Providing they get created, the parent
  directory can be root-owned.
- 0007-statd-user-from-sm
  Change rpc.statd and sm-notify to take uid from the sm
  directory.
  (bsc#1150733 CVE-2019-3689)</changelog>
  <changelog author="nfbrown@suse.com" date="1594296000">- 0008-gssd-replace-non-thread-safe-strtok-with-strsep.patch
  Fix bug with concurrent gssd requests arriving from kernel.
  (bsc#1174260)</changelog>
  <changelog author="nfbrown@suse.com" date="1599134400">- 0009-Convert-remaining-python-scripts-to-python3.patch
  Python is no longer installed by default and these scripts
  work with python3, so request that explicitly.
  (bsc#1173104)</changelog>
  <changelog author="nfbrown@suse.com" date="1616068800">- Add 0010-gssd-Fix-locking-for-machine-principal-list.patch
  (bsc#1183194)</changelog>
  <changelog author="nfbrown@suse.com" date="1616068801">- Add 0011-manpage-Add-a-description-of-the-nconnect-mount-opti.patch
  (bsc#1181651)</changelog>
  <changelog author="nfbrown@suse.com" date="1616068802">- 0012-mountd-reject-unknown-client-IP-when-use_ipaddr.patch
  0013-mountd-Don-t-proactively-add-export-info-when-fh-inf.patch
  0014-mountd-add-logging-for-authentication-results-for-ac.patch
  0015-mountd-add-cache-use-ipaddr-option-to-force-use_ipad.patch
  0116-mountd-make-default-ttl-settable-by-option.patch
  Improve logging of authentication (bsc#1181540)</changelog>
  <changelog author="nfbrown@suse.com" date="1620388800">- Add 0018-Replace-all-var-run-with-run.patch
  /var/run is long deprecated - switch all relevant paths to /run
  (bsc#1185170)</changelog>
  <changelog author="nfbrown@suse.com" date="1621598400">- Add 0019-gssd-use-mutex-to-protect-decrement-of-refcount.patch
  A field was modified by multiple threads without locking.
  This can lead to use-after-free.
  (bsc#1183194)</changelog>
  <changelog author="nfbrown@suse.com" date="1642507200">- Add 0020-mountd-Initialize-logging-early.patch
  If an error or warning message is produced before
  closeall() is called, mountd gets confused and doesn't work.
  (bsc#1194661)</changelog>
</package>
<package pkgid="83c782503f283895967d03153ddf65ce147831295f5b1a2f243b30e126d30e94" name="nodejs12" arch="aarch64">
  <version epoch="0" ver="12.22.10" rel="4.29.3"/>
  <changelog author="adam.majer@suse.de" date="1602244800">- fix_ci_tests.patch: add support to SUSE's ECDH backport errors
  in SLE's openssl</changelog>
  <changelog author="adam.majer@suse.de" date="1605268800">- python3.patch: allows building of node with python3 toolchain</changelog>
  <changelog author="adam.majer@suse.de" date="1605787200">- New upstream LTS version 12.19.1:
  * deps: Denial of Service through DNS request (High).
  A Node.js application that allows an attacker to trigger a DNS
  request for a host of their choice could trigger a Denial of Service
  by getting the application to resolve a DNS record with
  a larger number of responses (bsc#1178882, CVE-2020-8277)</changelog>
  <changelog author="adam.majer@suse.de" date="1606132800">- Update Requires: so -devel requires npm
- Rely on rpmbuild to define necessary python dependencies</changelog>
  <changelog author="adam.majer@suse.de" date="1606392000">- New upstream LTS version 12.20.0:
  * deps:
    + update llhttp '2.1.2' -&gt; '2.1.3'
    + update uv '1.39.0' -&gt; '1.40.0'
    + update uvwasi '0.0.10' -&gt; '0.0.11'
  * fs: add .ref() and .unref() methods to watcher classes
  * http: added scheduling option to http agent
  * module:
    + exports pattern support
    + named exports for CJS via static analysis
  * n-api: add more property defaults (gh#35214)</changelog>
  <changelog author="adam.majer@suse.de" date="1606737600">- openssl_binary_detection.patch: fixes unit tests on SLE12</changelog>
  <changelog author="adam.majer@suse.de" date="1609761600">- New upstream LTS version 12.20.1:
  * CVE-2020-8265: use-after-free in TLSWrap (High) bug in TLS
    implementation. When writing to a TLS enabled socket,
    node::StreamBase::Write calls node::TLSWrap::DoWrite with
    a freshly allocated WriteWrap object as first argument.
    If the DoWrite method does not return an error, this object is
    passed back to the caller as part of a StreamWriteResult structure.
    This may be exploited to corrupt memory leading to a
    Denial of Service or potentially other exploits (bsc#1180553)
  * CVE-2020-8287: HTTP Request Smuggling allow two copies of a
    header field in a http request. For example, two Transfer-Encoding
    header fields. In this case Node.js identifies the first header
    field and ignores the second. This can lead to HTTP Request
    Smuggling (https://cwe.mitre.org/data/definitions/444.html).
    (bsc#1180554)
  * CVE-2020-1971: OpenSSL - EDIPARTYNAME NULL pointer de-reference
    (High) This is a vulnerability in OpenSSL which may be exploited
    through Node.js. (bsc#1179491)
- versioned.patch, nodejs-libpath.patch: refreshed</changelog>
  <changelog author="adam.majer@suse.de" date="1613563200">- New upstream LTS version 12.20.2:
  * deps: upgrade npm to 6.14.11
- relax OpenSSL cipher suite policies for unit tests</changelog>
  <changelog author="adam.majer@suse.de" date="1614081600">- New upstream LTS version 12.21.0:
  * CVE-2021-22883: HTTP2 'unknownProtocol' cause Denial of Service
    by resource exhaustion (bsc#1182619)
  * CVE-2021-22884: DNS rebinding in --inspect (bsc#1182620)
  * CVE-2021-23840: OpenSSL - Integer overflow in CipherUpdate
    (bsc#1182333)</changelog>
  <changelog author="adam.majer@suse.de" date="1617796800">- New upstream LTS version 12.22.1:
  * CVE-2021-3450: OpenSSL - CA certificate check bypass with
    X509_V_FLAG_X509_STRICT (High). (bsc#1183851)
  * CVE-2021-3449: OpenSSL - NULL pointer deref in
    signature_algorithms processing (High) (bsc#1183852)
  * CVE-2020-7774: npm - Update y18n to fix Prototype-Pollution
    (bsc#1184450)
- Changes in LTS version 12.22.0:
  * node-api: define version 8
  * http: runtime deprecate legacy HTTP parser
  * v8: implement v8.stopCoverage() and v8.takeCoverage()
  * worker: add eventLoopUtilization()
- versioned.patch: refreshed</changelog>
  <changelog author="adam.majer@suse.de" date="1622462400">- Use libalternatives instead of update-alternatives</changelog>
  <changelog author="adam.majer@suse.de" date="1623326400">- Fix-build-with-icu-69.patch: fix building with ICU 69</changelog>
  <changelog author="adam.majer@suse.de" date="1625572800">- update to 12.22.2:
  * deps: libuv upgrade - Out of bounds read (Medium)
    (bsc#1187973, CVE-2021-22918)
  * deps: npm update to 6.14.13 fixing
    ssri Regular Expression Denial of Service and hosted-git-info
    Regular Expression Denial of Service
    (bsc#1187976, bsc#1187977, CVE-2021-27290, CVE-2021-23362)
- specfile cleanup</changelog>
  <changelog author="adam.majer@suse.de" date="1628078400">- update to 12.22.4:
  http2: fixes use after free on close http2 on stream canceling
  (bsc#1188917, CVE-2021-22930)
  deps: upgrade npm to 6.14.14
- versioned.patch: refreshed</changelog>
  <changelog author="adam.majer@suse.de" date="1628510400">- z15-test-skip.patch: skip problematic test on s390x</changelog>
  <changelog author="adam.majer@suse.de" date="1628769600">- update to 12.22.5:
  * CVE-2021-3672/CVE-2021-22931: Improper handling of untypical
    characters in domain names (bsc#1189370, bsc#1188881)
  * CVE-2021-22940: Use after free on close http2 on stream canceling
    (bsc#1189368)
  * CVE-2021-22939: Incomplete validation of rejectUnauthorized parameter
    (bsc#1189369)
- Fix-build-with-icu-69.patch: dropped, not for factory
- cares_public_headers.patch: don't use private headers</changelog>
  <changelog author="adam.majer@suse.de" date="1637928000">- update to 12.22.7:
  * deps: update llhttp to 2.1.4
  - HTTP Request Smuggling due to spaced in headers
    (bsc#1191601, CVE-2021-22959)
  - HTTP Request Smuggling when parsing the body
    (bsc#1191602, CVE-2021-22960)
- changes in 12.22.6:
  * deps: upgrade npm to 6.14.15 which fixes a number of
    security issues
    (bsc#1190057, CVE-2021-37701, bsc#1190056, CVE-2021-37712,
    bsc#1190055, CVE-2021-37713, bsc#1190054, CVE-2021-39134,
    bsc#1190053, CVE-2021-39135)
- versioned.patch: refreshed</changelog>
  <changelog author="adam.majer@suse.de" date="1641556800">- update to 12.22.8:
  * src: fix crash in AfterGetAddrInfo
  * deps: update c-ares to 1.18.1</changelog>
  <changelog author="adam.majer@suse.de" date="1641902400">- update to 12.22.9:
  Security update fixing the following issues:
  * Improper handling of URI Subject Alternative Names (Medium)
  (CVE-2021-44531, bsc#1194511)
  * Certificate Verification Bypass via String Injection (Medium)
  (CVE-2021-44532, bsc#1194512)
  * Incorrect handling of certificate subject and issuer fields (Medium)
  (CVE-2021-44533, bsc#1194513)
  * Prototype pollution via console.table properties (Low)
  (CVE-2022-21824, bsc#1194514)</changelog>
  <changelog author="adam.majer@suse.de" date="1645012800">- update to 12.22.10
  * Upgrade npm to 6.14.16
    + CVE-2021-23343 - ReDoS via splitDeviceRe, splitTailRe and
    splitPathRe (bsc#1192153)
    + CVE-2021-32803 - node-tar: Insufficient symlink protection
    allowing arbitrary file creation and overwrite (bsc#1191963)
    + CVE-2021-32804 - node-tar: Insufficient absolute path sanitization
    allowing arbitrary file creation and overwrite (bsc#1191962)
    + CVE-2021-3918 - json-schema is vulnerable to Improperly
    Controlled Modification of Object Prototype Attributes (bsc#1192696)
  * Updated ICU time zone data
- CVE-2021-3807.patch: node-ansi-regex: Regular expression
  denial of service (ReDoS) matching ANSI escape codes
  (bsc#1192154, CVE-2021-3807)
- versioned.patch: refreshed
- z15-test-skip.patch: dropped
- fix_ci_tests.patch: fix tests on z15</changelog>
</package>
<package pkgid="5a37bee4e6c3c0a0dae02bf99f8cccc036d2f53aa7f8aab899b1a90f4915e66e" name="nodejs12" arch="ppc64le">
  <version epoch="0" ver="12.22.10" rel="4.29.3"/>
  <changelog author="adam.majer@suse.de" date="1602244800">- fix_ci_tests.patch: add support to SUSE's ECDH backport errors
  in SLE's openssl</changelog>
  <changelog author="adam.majer@suse.de" date="1605268800">- python3.patch: allows building of node with python3 toolchain</changelog>
  <changelog author="adam.majer@suse.de" date="1605787200">- New upstream LTS version 12.19.1:
  * deps: Denial of Service through DNS request (High).
  A Node.js application that allows an attacker to trigger a DNS
  request for a host of their choice could trigger a Denial of Service
  by getting the application to resolve a DNS record with
  a larger number of responses (bsc#1178882, CVE-2020-8277)</changelog>
  <changelog author="adam.majer@suse.de" date="1606132800">- Update Requires: so -devel requires npm
- Rely on rpmbuild to define necessary python dependencies</changelog>
  <changelog author="adam.majer@suse.de" date="1606392000">- New upstream LTS version 12.20.0:
  * deps:
    + update llhttp '2.1.2' -&gt; '2.1.3'
    + update uv '1.39.0' -&gt; '1.40.0'
    + update uvwasi '0.0.10' -&gt; '0.0.11'
  * fs: add .ref() and .unref() methods to watcher classes
  * http: added scheduling option to http agent
  * module:
    + exports pattern support
    + named exports for CJS via static analysis
  * n-api: add more property defaults (gh#35214)</changelog>
  <changelog author="adam.majer@suse.de" date="1606737600">- openssl_binary_detection.patch: fixes unit tests on SLE12</changelog>
  <changelog author="adam.majer@suse.de" date="1609761600">- New upstream LTS version 12.20.1:
  * CVE-2020-8265: use-after-free in TLSWrap (High) bug in TLS
    implementation. When writing to a TLS enabled socket,
    node::StreamBase::Write calls node::TLSWrap::DoWrite with
    a freshly allocated WriteWrap object as first argument.
    If the DoWrite method does not return an error, this object is
    passed back to the caller as part of a StreamWriteResult structure.
    This may be exploited to corrupt memory leading to a
    Denial of Service or potentially other exploits (bsc#1180553)
  * CVE-2020-8287: HTTP Request Smuggling allow two copies of a
    header field in a http request. For example, two Transfer-Encoding
    header fields. In this case Node.js identifies the first header
    field and ignores the second. This can lead to HTTP Request
    Smuggling (https://cwe.mitre.org/data/definitions/444.html).
    (bsc#1180554)
  * CVE-2020-1971: OpenSSL - EDIPARTYNAME NULL pointer de-reference
    (High) This is a vulnerability in OpenSSL which may be exploited
    through Node.js. (bsc#1179491)
- versioned.patch, nodejs-libpath.patch: refreshed</changelog>
  <changelog author="adam.majer@suse.de" date="1613563200">- New upstream LTS version 12.20.2:
  * deps: upgrade npm to 6.14.11
- relax OpenSSL cipher suite policies for unit tests</changelog>
  <changelog author="adam.majer@suse.de" date="1614081600">- New upstream LTS version 12.21.0:
  * CVE-2021-22883: HTTP2 'unknownProtocol' cause Denial of Service
    by resource exhaustion (bsc#1182619)
  * CVE-2021-22884: DNS rebinding in --inspect (bsc#1182620)
  * CVE-2021-23840: OpenSSL - Integer overflow in CipherUpdate
    (bsc#1182333)</changelog>
  <changelog author="adam.majer@suse.de" date="1617796800">- New upstream LTS version 12.22.1:
  * CVE-2021-3450: OpenSSL - CA certificate check bypass with
    X509_V_FLAG_X509_STRICT (High). (bsc#1183851)
  * CVE-2021-3449: OpenSSL - NULL pointer deref in
    signature_algorithms processing (High) (bsc#1183852)
  * CVE-2020-7774: npm - Update y18n to fix Prototype-Pollution
    (bsc#1184450)
- Changes in LTS version 12.22.0:
  * node-api: define version 8
  * http: runtime deprecate legacy HTTP parser
  * v8: implement v8.stopCoverage() and v8.takeCoverage()
  * worker: add eventLoopUtilization()
- versioned.patch: refreshed</changelog>
  <changelog author="adam.majer@suse.de" date="1622462400">- Use libalternatives instead of update-alternatives</changelog>
  <changelog author="adam.majer@suse.de" date="1623326400">- Fix-build-with-icu-69.patch: fix building with ICU 69</changelog>
  <changelog author="adam.majer@suse.de" date="1625572800">- update to 12.22.2:
  * deps: libuv upgrade - Out of bounds read (Medium)
    (bsc#1187973, CVE-2021-22918)
  * deps: npm update to 6.14.13 fixing
    ssri Regular Expression Denial of Service and hosted-git-info
    Regular Expression Denial of Service
    (bsc#1187976, bsc#1187977, CVE-2021-27290, CVE-2021-23362)
- specfile cleanup</changelog>
  <changelog author="adam.majer@suse.de" date="1628078400">- update to 12.22.4:
  http2: fixes use after free on close http2 on stream canceling
  (bsc#1188917, CVE-2021-22930)
  deps: upgrade npm to 6.14.14
- versioned.patch: refreshed</changelog>
  <changelog author="adam.majer@suse.de" date="1628510400">- z15-test-skip.patch: skip problematic test on s390x</changelog>
  <changelog author="adam.majer@suse.de" date="1628769600">- update to 12.22.5:
  * CVE-2021-3672/CVE-2021-22931: Improper handling of untypical
    characters in domain names (bsc#1189370, bsc#1188881)
  * CVE-2021-22940: Use after free on close http2 on stream canceling
    (bsc#1189368)
  * CVE-2021-22939: Incomplete validation of rejectUnauthorized parameter
    (bsc#1189369)
- Fix-build-with-icu-69.patch: dropped, not for factory
- cares_public_headers.patch: don't use private headers</changelog>
  <changelog author="adam.majer@suse.de" date="1637928000">- update to 12.22.7:
  * deps: update llhttp to 2.1.4
  - HTTP Request Smuggling due to spaced in headers
    (bsc#1191601, CVE-2021-22959)
  - HTTP Request Smuggling when parsing the body
    (bsc#1191602, CVE-2021-22960)
- changes in 12.22.6:
  * deps: upgrade npm to 6.14.15 which fixes a number of
    security issues
    (bsc#1190057, CVE-2021-37701, bsc#1190056, CVE-2021-37712,
    bsc#1190055, CVE-2021-37713, bsc#1190054, CVE-2021-39134,
    bsc#1190053, CVE-2021-39135)
- versioned.patch: refreshed</changelog>
  <changelog author="adam.majer@suse.de" date="1641556800">- update to 12.22.8:
  * src: fix crash in AfterGetAddrInfo
  * deps: update c-ares to 1.18.1</changelog>
  <changelog author="adam.majer@suse.de" date="1641902400">- update to 12.22.9:
  Security update fixing the following issues:
  * Improper handling of URI Subject Alternative Names (Medium)
  (CVE-2021-44531, bsc#1194511)
  * Certificate Verification Bypass via String Injection (Medium)
  (CVE-2021-44532, bsc#1194512)
  * Incorrect handling of certificate subject and issuer fields (Medium)
  (CVE-2021-44533, bsc#1194513)
  * Prototype pollution via console.table properties (Low)
  (CVE-2022-21824, bsc#1194514)</changelog>
  <changelog author="adam.majer@suse.de" date="1645012800">- update to 12.22.10
  * Upgrade npm to 6.14.16
    + CVE-2021-23343 - ReDoS via splitDeviceRe, splitTailRe and
    splitPathRe (bsc#1192153)
    + CVE-2021-32803 - node-tar: Insufficient symlink protection
    allowing arbitrary file creation and overwrite (bsc#1191963)
    + CVE-2021-32804 - node-tar: Insufficient absolute path sanitization
    allowing arbitrary file creation and overwrite (bsc#1191962)
    + CVE-2021-3918 - json-schema is vulnerable to Improperly
    Controlled Modification of Object Prototype Attributes (bsc#1192696)
  * Updated ICU time zone data
- CVE-2021-3807.patch: node-ansi-regex: Regular expression
  denial of service (ReDoS) matching ANSI escape codes
  (bsc#1192154, CVE-2021-3807)
- versioned.patch: refreshed
- z15-test-skip.patch: dropped
- fix_ci_tests.patch: fix tests on z15</changelog>
</package>
<package pkgid="9596a173955e78651490611a59dcc9dacf9cbf0eef45cee156c69c3561a24903" name="nodejs12" arch="s390x">
  <version epoch="0" ver="12.22.10" rel="4.29.3"/>
  <changelog author="adam.majer@suse.de" date="1602244800">- fix_ci_tests.patch: add support to SUSE's ECDH backport errors
  in SLE's openssl</changelog>
  <changelog author="adam.majer@suse.de" date="1605268800">- python3.patch: allows building of node with python3 toolchain</changelog>
  <changelog author="adam.majer@suse.de" date="1605787200">- New upstream LTS version 12.19.1:
  * deps: Denial of Service through DNS request (High).
  A Node.js application that allows an attacker to trigger a DNS
  request for a host of their choice could trigger a Denial of Service
  by getting the application to resolve a DNS record with
  a larger number of responses (bsc#1178882, CVE-2020-8277)</changelog>
  <changelog author="adam.majer@suse.de" date="1606132800">- Update Requires: so -devel requires npm
- Rely on rpmbuild to define necessary python dependencies</changelog>
  <changelog author="adam.majer@suse.de" date="1606392000">- New upstream LTS version 12.20.0:
  * deps:
    + update llhttp '2.1.2' -&gt; '2.1.3'
    + update uv '1.39.0' -&gt; '1.40.0'
    + update uvwasi '0.0.10' -&gt; '0.0.11'
  * fs: add .ref() and .unref() methods to watcher classes
  * http: added scheduling option to http agent
  * module:
    + exports pattern support
    + named exports for CJS via static analysis
  * n-api: add more property defaults (gh#35214)</changelog>
  <changelog author="adam.majer@suse.de" date="1606737600">- openssl_binary_detection.patch: fixes unit tests on SLE12</changelog>
  <changelog author="adam.majer@suse.de" date="1609761600">- New upstream LTS version 12.20.1:
  * CVE-2020-8265: use-after-free in TLSWrap (High) bug in TLS
    implementation. When writing to a TLS enabled socket,
    node::StreamBase::Write calls node::TLSWrap::DoWrite with
    a freshly allocated WriteWrap object as first argument.
    If the DoWrite method does not return an error, this object is
    passed back to the caller as part of a StreamWriteResult structure.
    This may be exploited to corrupt memory leading to a
    Denial of Service or potentially other exploits (bsc#1180553)
  * CVE-2020-8287: HTTP Request Smuggling allow two copies of a
    header field in a http request. For example, two Transfer-Encoding
    header fields. In this case Node.js identifies the first header
    field and ignores the second. This can lead to HTTP Request
    Smuggling (https://cwe.mitre.org/data/definitions/444.html).
    (bsc#1180554)
  * CVE-2020-1971: OpenSSL - EDIPARTYNAME NULL pointer de-reference
    (High) This is a vulnerability in OpenSSL which may be exploited
    through Node.js. (bsc#1179491)
- versioned.patch, nodejs-libpath.patch: refreshed</changelog>
  <changelog author="adam.majer@suse.de" date="1613563200">- New upstream LTS version 12.20.2:
  * deps: upgrade npm to 6.14.11
- relax OpenSSL cipher suite policies for unit tests</changelog>
  <changelog author="adam.majer@suse.de" date="1614081600">- New upstream LTS version 12.21.0:
  * CVE-2021-22883: HTTP2 'unknownProtocol' cause Denial of Service
    by resource exhaustion (bsc#1182619)
  * CVE-2021-22884: DNS rebinding in --inspect (bsc#1182620)
  * CVE-2021-23840: OpenSSL - Integer overflow in CipherUpdate
    (bsc#1182333)</changelog>
  <changelog author="adam.majer@suse.de" date="1617796800">- New upstream LTS version 12.22.1:
  * CVE-2021-3450: OpenSSL - CA certificate check bypass with
    X509_V_FLAG_X509_STRICT (High). (bsc#1183851)
  * CVE-2021-3449: OpenSSL - NULL pointer deref in
    signature_algorithms processing (High) (bsc#1183852)
  * CVE-2020-7774: npm - Update y18n to fix Prototype-Pollution
    (bsc#1184450)
- Changes in LTS version 12.22.0:
  * node-api: define version 8
  * http: runtime deprecate legacy HTTP parser
  * v8: implement v8.stopCoverage() and v8.takeCoverage()
  * worker: add eventLoopUtilization()
- versioned.patch: refreshed</changelog>
  <changelog author="adam.majer@suse.de" date="1622462400">- Use libalternatives instead of update-alternatives</changelog>
  <changelog author="adam.majer@suse.de" date="1623326400">- Fix-build-with-icu-69.patch: fix building with ICU 69</changelog>
  <changelog author="adam.majer@suse.de" date="1625572800">- update to 12.22.2:
  * deps: libuv upgrade - Out of bounds read (Medium)
    (bsc#1187973, CVE-2021-22918)
  * deps: npm update to 6.14.13 fixing
    ssri Regular Expression Denial of Service and hosted-git-info
    Regular Expression Denial of Service
    (bsc#1187976, bsc#1187977, CVE-2021-27290, CVE-2021-23362)
- specfile cleanup</changelog>
  <changelog author="adam.majer@suse.de" date="1628078400">- update to 12.22.4:
  http2: fixes use after free on close http2 on stream canceling
  (bsc#1188917, CVE-2021-22930)
  deps: upgrade npm to 6.14.14
- versioned.patch: refreshed</changelog>
  <changelog author="adam.majer@suse.de" date="1628510400">- z15-test-skip.patch: skip problematic test on s390x</changelog>
  <changelog author="adam.majer@suse.de" date="1628769600">- update to 12.22.5:
  * CVE-2021-3672/CVE-2021-22931: Improper handling of untypical
    characters in domain names (bsc#1189370, bsc#1188881)
  * CVE-2021-22940: Use after free on close http2 on stream canceling
    (bsc#1189368)
  * CVE-2021-22939: Incomplete validation of rejectUnauthorized parameter
    (bsc#1189369)
- Fix-build-with-icu-69.patch: dropped, not for factory
- cares_public_headers.patch: don't use private headers</changelog>
  <changelog author="adam.majer@suse.de" date="1637928000">- update to 12.22.7:
  * deps: update llhttp to 2.1.4
  - HTTP Request Smuggling due to spaced in headers
    (bsc#1191601, CVE-2021-22959)
  - HTTP Request Smuggling when parsing the body
    (bsc#1191602, CVE-2021-22960)
- changes in 12.22.6:
  * deps: upgrade npm to 6.14.15 which fixes a number of
    security issues
    (bsc#1190057, CVE-2021-37701, bsc#1190056, CVE-2021-37712,
    bsc#1190055, CVE-2021-37713, bsc#1190054, CVE-2021-39134,
    bsc#1190053, CVE-2021-39135)
- versioned.patch: refreshed</changelog>
  <changelog author="adam.majer@suse.de" date="1641556800">- update to 12.22.8:
  * src: fix crash in AfterGetAddrInfo
  * deps: update c-ares to 1.18.1</changelog>
  <changelog author="adam.majer@suse.de" date="1641902400">- update to 12.22.9:
  Security update fixing the following issues:
  * Improper handling of URI Subject Alternative Names (Medium)
  (CVE-2021-44531, bsc#1194511)
  * Certificate Verification Bypass via String Injection (Medium)
  (CVE-2021-44532, bsc#1194512)
  * Incorrect handling of certificate subject and issuer fields (Medium)
  (CVE-2021-44533, bsc#1194513)
  * Prototype pollution via console.table properties (Low)
  (CVE-2022-21824, bsc#1194514)</changelog>
  <changelog author="adam.majer@suse.de" date="1645012800">- update to 12.22.10
  * Upgrade npm to 6.14.16
    + CVE-2021-23343 - ReDoS via splitDeviceRe, splitTailRe and
    splitPathRe (bsc#1192153)
    + CVE-2021-32803 - node-tar: Insufficient symlink protection
    allowing arbitrary file creation and overwrite (bsc#1191963)
    + CVE-2021-32804 - node-tar: Insufficient absolute path sanitization
    allowing arbitrary file creation and overwrite (bsc#1191962)
    + CVE-2021-3918 - json-schema is vulnerable to Improperly
    Controlled Modification of Object Prototype Attributes (bsc#1192696)
  * Updated ICU time zone data
- CVE-2021-3807.patch: node-ansi-regex: Regular expression
  denial of service (ReDoS) matching ANSI escape codes
  (bsc#1192154, CVE-2021-3807)
- versioned.patch: refreshed
- z15-test-skip.patch: dropped
- fix_ci_tests.patch: fix tests on z15</changelog>
</package>
<package pkgid="4f6c06d8039378d456666738c8eabb6fe2334d66e9fa48cfcf34e55a046ae0f5" name="nodejs12" arch="src">
  <version epoch="0" ver="12.22.10" rel="4.29.3"/>
  <changelog author="adam.majer@suse.de" date="1602244800">- fix_ci_tests.patch: add support to SUSE's ECDH backport errors
  in SLE's openssl</changelog>
  <changelog author="adam.majer@suse.de" date="1605268800">- python3.patch: allows building of node with python3 toolchain</changelog>
  <changelog author="adam.majer@suse.de" date="1605787200">- New upstream LTS version 12.19.1:
  * deps: Denial of Service through DNS request (High).
  A Node.js application that allows an attacker to trigger a DNS
  request for a host of their choice could trigger a Denial of Service
  by getting the application to resolve a DNS record with
  a larger number of responses (bsc#1178882, CVE-2020-8277)</changelog>
  <changelog author="adam.majer@suse.de" date="1606132800">- Update Requires: so -devel requires npm
- Rely on rpmbuild to define necessary python dependencies</changelog>
  <changelog author="adam.majer@suse.de" date="1606392000">- New upstream LTS version 12.20.0:
  * deps:
    + update llhttp '2.1.2' -&gt; '2.1.3'
    + update uv '1.39.0' -&gt; '1.40.0'
    + update uvwasi '0.0.10' -&gt; '0.0.11'
  * fs: add .ref() and .unref() methods to watcher classes
  * http: added scheduling option to http agent
  * module:
    + exports pattern support
    + named exports for CJS via static analysis
  * n-api: add more property defaults (gh#35214)</changelog>
  <changelog author="adam.majer@suse.de" date="1606737600">- openssl_binary_detection.patch: fixes unit tests on SLE12</changelog>
  <changelog author="adam.majer@suse.de" date="1609761600">- New upstream LTS version 12.20.1:
  * CVE-2020-8265: use-after-free in TLSWrap (High) bug in TLS
    implementation. When writing to a TLS enabled socket,
    node::StreamBase::Write calls node::TLSWrap::DoWrite with
    a freshly allocated WriteWrap object as first argument.
    If the DoWrite method does not return an error, this object is
    passed back to the caller as part of a StreamWriteResult structure.
    This may be exploited to corrupt memory leading to a
    Denial of Service or potentially other exploits (bsc#1180553)
  * CVE-2020-8287: HTTP Request Smuggling allow two copies of a
    header field in a http request. For example, two Transfer-Encoding
    header fields. In this case Node.js identifies the first header
    field and ignores the second. This can lead to HTTP Request
    Smuggling (https://cwe.mitre.org/data/definitions/444.html).
    (bsc#1180554)
  * CVE-2020-1971: OpenSSL - EDIPARTYNAME NULL pointer de-reference
    (High) This is a vulnerability in OpenSSL which may be exploited
    through Node.js. (bsc#1179491)
- versioned.patch, nodejs-libpath.patch: refreshed</changelog>
  <changelog author="adam.majer@suse.de" date="1613563200">- New upstream LTS version 12.20.2:
  * deps: upgrade npm to 6.14.11
- relax OpenSSL cipher suite policies for unit tests</changelog>
  <changelog author="adam.majer@suse.de" date="1614081600">- New upstream LTS version 12.21.0:
  * CVE-2021-22883: HTTP2 'unknownProtocol' cause Denial of Service
    by resource exhaustion (bsc#1182619)
  * CVE-2021-22884: DNS rebinding in --inspect (bsc#1182620)
  * CVE-2021-23840: OpenSSL - Integer overflow in CipherUpdate
    (bsc#1182333)</changelog>
  <changelog author="adam.majer@suse.de" date="1617796800">- New upstream LTS version 12.22.1:
  * CVE-2021-3450: OpenSSL - CA certificate check bypass with
    X509_V_FLAG_X509_STRICT (High). (bsc#1183851)
  * CVE-2021-3449: OpenSSL - NULL pointer deref in
    signature_algorithms processing (High) (bsc#1183852)
  * CVE-2020-7774: npm - Update y18n to fix Prototype-Pollution
    (bsc#1184450)
- Changes in LTS version 12.22.0:
  * node-api: define version 8
  * http: runtime deprecate legacy HTTP parser
  * v8: implement v8.stopCoverage() and v8.takeCoverage()
  * worker: add eventLoopUtilization()
- versioned.patch: refreshed</changelog>
  <changelog author="adam.majer@suse.de" date="1622462400">- Use libalternatives instead of update-alternatives</changelog>
  <changelog author="adam.majer@suse.de" date="1623326400">- Fix-build-with-icu-69.patch: fix building with ICU 69</changelog>
  <changelog author="adam.majer@suse.de" date="1625572800">- update to 12.22.2:
  * deps: libuv upgrade - Out of bounds read (Medium)
    (bsc#1187973, CVE-2021-22918)
  * deps: npm update to 6.14.13 fixing
    ssri Regular Expression Denial of Service and hosted-git-info
    Regular Expression Denial of Service
    (bsc#1187976, bsc#1187977, CVE-2021-27290, CVE-2021-23362)
- specfile cleanup</changelog>
  <changelog author="adam.majer@suse.de" date="1628078400">- update to 12.22.4:
  http2: fixes use after free on close http2 on stream canceling
  (bsc#1188917, CVE-2021-22930)
  deps: upgrade npm to 6.14.14
- versioned.patch: refreshed</changelog>
  <changelog author="adam.majer@suse.de" date="1628510400">- z15-test-skip.patch: skip problematic test on s390x</changelog>
  <changelog author="adam.majer@suse.de" date="1628769600">- update to 12.22.5:
  * CVE-2021-3672/CVE-2021-22931: Improper handling of untypical
    characters in domain names (bsc#1189370, bsc#1188881)
  * CVE-2021-22940: Use after free on close http2 on stream canceling
    (bsc#1189368)
  * CVE-2021-22939: Incomplete validation of rejectUnauthorized parameter
    (bsc#1189369)
- Fix-build-with-icu-69.patch: dropped, not for factory
- cares_public_headers.patch: don't use private headers</changelog>
  <changelog author="adam.majer@suse.de" date="1637928000">- update to 12.22.7:
  * deps: update llhttp to 2.1.4
  - HTTP Request Smuggling due to spaced in headers
    (bsc#1191601, CVE-2021-22959)
  - HTTP Request Smuggling when parsing the body
    (bsc#1191602, CVE-2021-22960)
- changes in 12.22.6:
  * deps: upgrade npm to 6.14.15 which fixes a number of
    security issues
    (bsc#1190057, CVE-2021-37701, bsc#1190056, CVE-2021-37712,
    bsc#1190055, CVE-2021-37713, bsc#1190054, CVE-2021-39134,
    bsc#1190053, CVE-2021-39135)
- versioned.patch: refreshed</changelog>
  <changelog author="adam.majer@suse.de" date="1641556800">- update to 12.22.8:
  * src: fix crash in AfterGetAddrInfo
  * deps: update c-ares to 1.18.1</changelog>
  <changelog author="adam.majer@suse.de" date="1641902400">- update to 12.22.9:
  Security update fixing the following issues:
  * Improper handling of URI Subject Alternative Names (Medium)
  (CVE-2021-44531, bsc#1194511)
  * Certificate Verification Bypass via String Injection (Medium)
  (CVE-2021-44532, bsc#1194512)
  * Incorrect handling of certificate subject and issuer fields (Medium)
  (CVE-2021-44533, bsc#1194513)
  * Prototype pollution via console.table properties (Low)
  (CVE-2022-21824, bsc#1194514)</changelog>
  <changelog author="adam.majer@suse.de" date="1645012800">- update to 12.22.10
  * Upgrade npm to 6.14.16
    + CVE-2021-23343 - ReDoS via splitDeviceRe, splitTailRe and
    splitPathRe (bsc#1192153)
    + CVE-2021-32803 - node-tar: Insufficient symlink protection
    allowing arbitrary file creation and overwrite (bsc#1191963)
    + CVE-2021-32804 - node-tar: Insufficient absolute path sanitization
    allowing arbitrary file creation and overwrite (bsc#1191962)
    + CVE-2021-3918 - json-schema is vulnerable to Improperly
    Controlled Modification of Object Prototype Attributes (bsc#1192696)
  * Updated ICU time zone data
- CVE-2021-3807.patch: node-ansi-regex: Regular expression
  denial of service (ReDoS) matching ANSI escape codes
  (bsc#1192154, CVE-2021-3807)
- versioned.patch: refreshed
- z15-test-skip.patch: dropped
- fix_ci_tests.patch: fix tests on z15</changelog>
</package>
<package pkgid="3c2decae3f0285e3404bd8403a3bd4d32a3baef88543eb4ee108e39249895643" name="nodejs12" arch="x86_64">
  <version epoch="0" ver="12.22.10" rel="4.29.3"/>
  <changelog author="adam.majer@suse.de" date="1602244800">- fix_ci_tests.patch: add support to SUSE's ECDH backport errors
  in SLE's openssl</changelog>
  <changelog author="adam.majer@suse.de" date="1605268800">- python3.patch: allows building of node with python3 toolchain</changelog>
  <changelog author="adam.majer@suse.de" date="1605787200">- New upstream LTS version 12.19.1:
  * deps: Denial of Service through DNS request (High).
  A Node.js application that allows an attacker to trigger a DNS
  request for a host of their choice could trigger a Denial of Service
  by getting the application to resolve a DNS record with
  a larger number of responses (bsc#1178882, CVE-2020-8277)</changelog>
  <changelog author="adam.majer@suse.de" date="1606132800">- Update Requires: so -devel requires npm
- Rely on rpmbuild to define necessary python dependencies</changelog>
  <changelog author="adam.majer@suse.de" date="1606392000">- New upstream LTS version 12.20.0:
  * deps:
    + update llhttp '2.1.2' -&gt; '2.1.3'
    + update uv '1.39.0' -&gt; '1.40.0'
    + update uvwasi '0.0.10' -&gt; '0.0.11'
  * fs: add .ref() and .unref() methods to watcher classes
  * http: added scheduling option to http agent
  * module:
    + exports pattern support
    + named exports for CJS via static analysis
  * n-api: add more property defaults (gh#35214)</changelog>
  <changelog author="adam.majer@suse.de" date="1606737600">- openssl_binary_detection.patch: fixes unit tests on SLE12</changelog>
  <changelog author="adam.majer@suse.de" date="1609761600">- New upstream LTS version 12.20.1:
  * CVE-2020-8265: use-after-free in TLSWrap (High) bug in TLS
    implementation. When writing to a TLS enabled socket,
    node::StreamBase::Write calls node::TLSWrap::DoWrite with
    a freshly allocated WriteWrap object as first argument.
    If the DoWrite method does not return an error, this object is
    passed back to the caller as part of a StreamWriteResult structure.
    This may be exploited to corrupt memory leading to a
    Denial of Service or potentially other exploits (bsc#1180553)
  * CVE-2020-8287: HTTP Request Smuggling allow two copies of a
    header field in a http request. For example, two Transfer-Encoding
    header fields. In this case Node.js identifies the first header
    field and ignores the second. This can lead to HTTP Request
    Smuggling (https://cwe.mitre.org/data/definitions/444.html).
    (bsc#1180554)
  * CVE-2020-1971: OpenSSL - EDIPARTYNAME NULL pointer de-reference
    (High) This is a vulnerability in OpenSSL which may be exploited
    through Node.js. (bsc#1179491)
- versioned.patch, nodejs-libpath.patch: refreshed</changelog>
  <changelog author="adam.majer@suse.de" date="1613563200">- New upstream LTS version 12.20.2:
  * deps: upgrade npm to 6.14.11
- relax OpenSSL cipher suite policies for unit tests</changelog>
  <changelog author="adam.majer@suse.de" date="1614081600">- New upstream LTS version 12.21.0:
  * CVE-2021-22883: HTTP2 'unknownProtocol' cause Denial of Service
    by resource exhaustion (bsc#1182619)
  * CVE-2021-22884: DNS rebinding in --inspect (bsc#1182620)
  * CVE-2021-23840: OpenSSL - Integer overflow in CipherUpdate
    (bsc#1182333)</changelog>
  <changelog author="adam.majer@suse.de" date="1617796800">- New upstream LTS version 12.22.1:
  * CVE-2021-3450: OpenSSL - CA certificate check bypass with
    X509_V_FLAG_X509_STRICT (High). (bsc#1183851)
  * CVE-2021-3449: OpenSSL - NULL pointer deref in
    signature_algorithms processing (High) (bsc#1183852)
  * CVE-2020-7774: npm - Update y18n to fix Prototype-Pollution
    (bsc#1184450)
- Changes in LTS version 12.22.0:
  * node-api: define version 8
  * http: runtime deprecate legacy HTTP parser
  * v8: implement v8.stopCoverage() and v8.takeCoverage()
  * worker: add eventLoopUtilization()
- versioned.patch: refreshed</changelog>
  <changelog author="adam.majer@suse.de" date="1622462400">- Use libalternatives instead of update-alternatives</changelog>
  <changelog author="adam.majer@suse.de" date="1623326400">- Fix-build-with-icu-69.patch: fix building with ICU 69</changelog>
  <changelog author="adam.majer@suse.de" date="1625572800">- update to 12.22.2:
  * deps: libuv upgrade - Out of bounds read (Medium)
    (bsc#1187973, CVE-2021-22918)
  * deps: npm update to 6.14.13 fixing
    ssri Regular Expression Denial of Service and hosted-git-info
    Regular Expression Denial of Service
    (bsc#1187976, bsc#1187977, CVE-2021-27290, CVE-2021-23362)
- specfile cleanup</changelog>
  <changelog author="adam.majer@suse.de" date="1628078400">- update to 12.22.4:
  http2: fixes use after free on close http2 on stream canceling
  (bsc#1188917, CVE-2021-22930)
  deps: upgrade npm to 6.14.14
- versioned.patch: refreshed</changelog>
  <changelog author="adam.majer@suse.de" date="1628510400">- z15-test-skip.patch: skip problematic test on s390x</changelog>
  <changelog author="adam.majer@suse.de" date="1628769600">- update to 12.22.5:
  * CVE-2021-3672/CVE-2021-22931: Improper handling of untypical
    characters in domain names (bsc#1189370, bsc#1188881)
  * CVE-2021-22940: Use after free on close http2 on stream canceling
    (bsc#1189368)
  * CVE-2021-22939: Incomplete validation of rejectUnauthorized parameter
    (bsc#1189369)
- Fix-build-with-icu-69.patch: dropped, not for factory
- cares_public_headers.patch: don't use private headers</changelog>
  <changelog author="adam.majer@suse.de" date="1637928000">- update to 12.22.7:
  * deps: update llhttp to 2.1.4
  - HTTP Request Smuggling due to spaced in headers
    (bsc#1191601, CVE-2021-22959)
  - HTTP Request Smuggling when parsing the body
    (bsc#1191602, CVE-2021-22960)
- changes in 12.22.6:
  * deps: upgrade npm to 6.14.15 which fixes a number of
    security issues
    (bsc#1190057, CVE-2021-37701, bsc#1190056, CVE-2021-37712,
    bsc#1190055, CVE-2021-37713, bsc#1190054, CVE-2021-39134,
    bsc#1190053, CVE-2021-39135)
- versioned.patch: refreshed</changelog>
  <changelog author="adam.majer@suse.de" date="1641556800">- update to 12.22.8:
  * src: fix crash in AfterGetAddrInfo
  * deps: update c-ares to 1.18.1</changelog>
  <changelog author="adam.majer@suse.de" date="1641902400">- update to 12.22.9:
  Security update fixing the following issues:
  * Improper handling of URI Subject Alternative Names (Medium)
  (CVE-2021-44531, bsc#1194511)
  * Certificate Verification Bypass via String Injection (Medium)
  (CVE-2021-44532, bsc#1194512)
  * Incorrect handling of certificate subject and issuer fields (Medium)
  (CVE-2021-44533, bsc#1194513)
  * Prototype pollution via console.table properties (Low)
  (CVE-2022-21824, bsc#1194514)</changelog>
  <changelog author="adam.majer@suse.de" date="1645012800">- update to 12.22.10
  * Upgrade npm to 6.14.16
    + CVE-2021-23343 - ReDoS via splitDeviceRe, splitTailRe and
    splitPathRe (bsc#1192153)
    + CVE-2021-32803 - node-tar: Insufficient symlink protection
    allowing arbitrary file creation and overwrite (bsc#1191963)
    + CVE-2021-32804 - node-tar: Insufficient absolute path sanitization
    allowing arbitrary file creation and overwrite (bsc#1191962)
    + CVE-2021-3918 - json-schema is vulnerable to Improperly
    Controlled Modification of Object Prototype Attributes (bsc#1192696)
  * Updated ICU time zone data
- CVE-2021-3807.patch: node-ansi-regex: Regular expression
  denial of service (ReDoS) matching ANSI escape codes
  (bsc#1192154, CVE-2021-3807)
- versioned.patch: refreshed
- z15-test-skip.patch: dropped
- fix_ci_tests.patch: fix tests on z15</changelog>
</package>
<package pkgid="eed19908facb3a73857cc9f2dd30815d8665954f8a793e6329c723c330fccc5e" name="nodejs12-devel" arch="aarch64">
  <version epoch="0" ver="12.22.10" rel="4.29.3"/>
  <changelog author="adam.majer@suse.de" date="1602244800">- fix_ci_tests.patch: add support to SUSE's ECDH backport errors
  in SLE's openssl</changelog>
  <changelog author="adam.majer@suse.de" date="1605268800">- python3.patch: allows building of node with python3 toolchain</changelog>
  <changelog author="adam.majer@suse.de" date="1605787200">- New upstream LTS version 12.19.1:
  * deps: Denial of Service through DNS request (High).
  A Node.js application that allows an attacker to trigger a DNS
  request for a host of their choice could trigger a Denial of Service
  by getting the application to resolve a DNS record with
  a larger number of responses (bsc#1178882, CVE-2020-8277)</changelog>
  <changelog author="adam.majer@suse.de" date="1606132800">- Update Requires: so -devel requires npm
- Rely on rpmbuild to define necessary python dependencies</changelog>
  <changelog author="adam.majer@suse.de" date="1606392000">- New upstream LTS version 12.20.0:
  * deps:
    + update llhttp '2.1.2' -&gt; '2.1.3'
    + update uv '1.39.0' -&gt; '1.40.0'
    + update uvwasi '0.0.10' -&gt; '0.0.11'
  * fs: add .ref() and .unref() methods to watcher classes
  * http: added scheduling option to http agent
  * module:
    + exports pattern support
    + named exports for CJS via static analysis
  * n-api: add more property defaults (gh#35214)</changelog>
  <changelog author="adam.majer@suse.de" date="1606737600">- openssl_binary_detection.patch: fixes unit tests on SLE12</changelog>
  <changelog author="adam.majer@suse.de" date="1609761600">- New upstream LTS version 12.20.1:
  * CVE-2020-8265: use-after-free in TLSWrap (High) bug in TLS
    implementation. When writing to a TLS enabled socket,
    node::StreamBase::Write calls node::TLSWrap::DoWrite with
    a freshly allocated WriteWrap object as first argument.
    If the DoWrite method does not return an error, this object is
    passed back to the caller as part of a StreamWriteResult structure.
    This may be exploited to corrupt memory leading to a
    Denial of Service or potentially other exploits (bsc#1180553)
  * CVE-2020-8287: HTTP Request Smuggling allow two copies of a
    header field in a http request. For example, two Transfer-Encoding
    header fields. In this case Node.js identifies the first header
    field and ignores the second. This can lead to HTTP Request
    Smuggling (https://cwe.mitre.org/data/definitions/444.html).
    (bsc#1180554)
  * CVE-2020-1971: OpenSSL - EDIPARTYNAME NULL pointer de-reference
    (High) This is a vulnerability in OpenSSL which may be exploited
    through Node.js. (bsc#1179491)
- versioned.patch, nodejs-libpath.patch: refreshed</changelog>
  <changelog author="adam.majer@suse.de" date="1613563200">- New upstream LTS version 12.20.2:
  * deps: upgrade npm to 6.14.11
- relax OpenSSL cipher suite policies for unit tests</changelog>
  <changelog author="adam.majer@suse.de" date="1614081600">- New upstream LTS version 12.21.0:
  * CVE-2021-22883: HTTP2 'unknownProtocol' cause Denial of Service
    by resource exhaustion (bsc#1182619)
  * CVE-2021-22884: DNS rebinding in --inspect (bsc#1182620)
  * CVE-2021-23840: OpenSSL - Integer overflow in CipherUpdate
    (bsc#1182333)</changelog>
  <changelog author="adam.majer@suse.de" date="1617796800">- New upstream LTS version 12.22.1:
  * CVE-2021-3450: OpenSSL - CA certificate check bypass with
    X509_V_FLAG_X509_STRICT (High). (bsc#1183851)
  * CVE-2021-3449: OpenSSL - NULL pointer deref in
    signature_algorithms processing (High) (bsc#1183852)
  * CVE-2020-7774: npm - Update y18n to fix Prototype-Pollution
    (bsc#1184450)
- Changes in LTS version 12.22.0:
  * node-api: define version 8
  * http: runtime deprecate legacy HTTP parser
  * v8: implement v8.stopCoverage() and v8.takeCoverage()
  * worker: add eventLoopUtilization()
- versioned.patch: refreshed</changelog>
  <changelog author="adam.majer@suse.de" date="1622462400">- Use libalternatives instead of update-alternatives</changelog>
  <changelog author="adam.majer@suse.de" date="1623326400">- Fix-build-with-icu-69.patch: fix building with ICU 69</changelog>
  <changelog author="adam.majer@suse.de" date="1625572800">- update to 12.22.2:
  * deps: libuv upgrade - Out of bounds read (Medium)
    (bsc#1187973, CVE-2021-22918)
  * deps: npm update to 6.14.13 fixing
    ssri Regular Expression Denial of Service and hosted-git-info
    Regular Expression Denial of Service
    (bsc#1187976, bsc#1187977, CVE-2021-27290, CVE-2021-23362)
- specfile cleanup</changelog>
  <changelog author="adam.majer@suse.de" date="1628078400">- update to 12.22.4:
  http2: fixes use after free on close http2 on stream canceling
  (bsc#1188917, CVE-2021-22930)
  deps: upgrade npm to 6.14.14
- versioned.patch: refreshed</changelog>
  <changelog author="adam.majer@suse.de" date="1628510400">- z15-test-skip.patch: skip problematic test on s390x</changelog>
  <changelog author="adam.majer@suse.de" date="1628769600">- update to 12.22.5:
  * CVE-2021-3672/CVE-2021-22931: Improper handling of untypical
    characters in domain names (bsc#1189370, bsc#1188881)
  * CVE-2021-22940: Use after free on close http2 on stream canceling
    (bsc#1189368)
  * CVE-2021-22939: Incomplete validation of rejectUnauthorized parameter
    (bsc#1189369)
- Fix-build-with-icu-69.patch: dropped, not for factory
- cares_public_headers.patch: don't use private headers</changelog>
  <changelog author="adam.majer@suse.de" date="1637928000">- update to 12.22.7:
  * deps: update llhttp to 2.1.4
  - HTTP Request Smuggling due to spaced in headers
    (bsc#1191601, CVE-2021-22959)
  - HTTP Request Smuggling when parsing the body
    (bsc#1191602, CVE-2021-22960)
- changes in 12.22.6:
  * deps: upgrade npm to 6.14.15 which fixes a number of
    security issues
    (bsc#1190057, CVE-2021-37701, bsc#1190056, CVE-2021-37712,
    bsc#1190055, CVE-2021-37713, bsc#1190054, CVE-2021-39134,
    bsc#1190053, CVE-2021-39135)
- versioned.patch: refreshed</changelog>
  <changelog author="adam.majer@suse.de" date="1641556800">- update to 12.22.8:
  * src: fix crash in AfterGetAddrInfo
  * deps: update c-ares to 1.18.1</changelog>
  <changelog author="adam.majer@suse.de" date="1641902400">- update to 12.22.9:
  Security update fixing the following issues:
  * Improper handling of URI Subject Alternative Names (Medium)
  (CVE-2021-44531, bsc#1194511)
  * Certificate Verification Bypass via String Injection (Medium)
  (CVE-2021-44532, bsc#1194512)
  * Incorrect handling of certificate subject and issuer fields (Medium)
  (CVE-2021-44533, bsc#1194513)
  * Prototype pollution via console.table properties (Low)
  (CVE-2022-21824, bsc#1194514)</changelog>
  <changelog author="adam.majer@suse.de" date="1645012800">- update to 12.22.10
  * Upgrade npm to 6.14.16
    + CVE-2021-23343 - ReDoS via splitDeviceRe, splitTailRe and
    splitPathRe (bsc#1192153)
    + CVE-2021-32803 - node-tar: Insufficient symlink protection
    allowing arbitrary file creation and overwrite (bsc#1191963)
    + CVE-2021-32804 - node-tar: Insufficient absolute path sanitization
    allowing arbitrary file creation and overwrite (bsc#1191962)
    + CVE-2021-3918 - json-schema is vulnerable to Improperly
    Controlled Modification of Object Prototype Attributes (bsc#1192696)
  * Updated ICU time zone data
- CVE-2021-3807.patch: node-ansi-regex: Regular expression
  denial of service (ReDoS) matching ANSI escape codes
  (bsc#1192154, CVE-2021-3807)
- versioned.patch: refreshed
- z15-test-skip.patch: dropped
- fix_ci_tests.patch: fix tests on z15</changelog>
</package>
<package pkgid="6c09d8a7c9c98751009c5fd4f40b4aa0954ba9f079c76b06ce16d7def34476d6" name="nodejs12-devel" arch="ppc64le">
  <version epoch="0" ver="12.22.10" rel="4.29.3"/>
  <changelog author="adam.majer@suse.de" date="1602244800">- fix_ci_tests.patch: add support to SUSE's ECDH backport errors
  in SLE's openssl</changelog>
  <changelog author="adam.majer@suse.de" date="1605268800">- python3.patch: allows building of node with python3 toolchain</changelog>
  <changelog author="adam.majer@suse.de" date="1605787200">- New upstream LTS version 12.19.1:
  * deps: Denial of Service through DNS request (High).
  A Node.js application that allows an attacker to trigger a DNS
  request for a host of their choice could trigger a Denial of Service
  by getting the application to resolve a DNS record with
  a larger number of responses (bsc#1178882, CVE-2020-8277)</changelog>
  <changelog author="adam.majer@suse.de" date="1606132800">- Update Requires: so -devel requires npm
- Rely on rpmbuild to define necessary python dependencies</changelog>
  <changelog author="adam.majer@suse.de" date="1606392000">- New upstream LTS version 12.20.0:
  * deps:
    + update llhttp '2.1.2' -&gt; '2.1.3'
    + update uv '1.39.0' -&gt; '1.40.0'
    + update uvwasi '0.0.10' -&gt; '0.0.11'
  * fs: add .ref() and .unref() methods to watcher classes
  * http: added scheduling option to http agent
  * module:
    + exports pattern support
    + named exports for CJS via static analysis
  * n-api: add more property defaults (gh#35214)</changelog>
  <changelog author="adam.majer@suse.de" date="1606737600">- openssl_binary_detection.patch: fixes unit tests on SLE12</changelog>
  <changelog author="adam.majer@suse.de" date="1609761600">- New upstream LTS version 12.20.1:
  * CVE-2020-8265: use-after-free in TLSWrap (High) bug in TLS
    implementation. When writing to a TLS enabled socket,
    node::StreamBase::Write calls node::TLSWrap::DoWrite with
    a freshly allocated WriteWrap object as first argument.
    If the DoWrite method does not return an error, this object is
    passed back to the caller as part of a StreamWriteResult structure.
    This may be exploited to corrupt memory leading to a
    Denial of Service or potentially other exploits (bsc#1180553)
  * CVE-2020-8287: HTTP Request Smuggling allow two copies of a
    header field in a http request. For example, two Transfer-Encoding
    header fields. In this case Node.js identifies the first header
    field and ignores the second. This can lead to HTTP Request
    Smuggling (https://cwe.mitre.org/data/definitions/444.html).
    (bsc#1180554)
  * CVE-2020-1971: OpenSSL - EDIPARTYNAME NULL pointer de-reference
    (High) This is a vulnerability in OpenSSL which may be exploited
    through Node.js. (bsc#1179491)
- versioned.patch, nodejs-libpath.patch: refreshed</changelog>
  <changelog author="adam.majer@suse.de" date="1613563200">- New upstream LTS version 12.20.2:
  * deps: upgrade npm to 6.14.11
- relax OpenSSL cipher suite policies for unit tests</changelog>
  <changelog author="adam.majer@suse.de" date="1614081600">- New upstream LTS version 12.21.0:
  * CVE-2021-22883: HTTP2 'unknownProtocol' cause Denial of Service
    by resource exhaustion (bsc#1182619)
  * CVE-2021-22884: DNS rebinding in --inspect (bsc#1182620)
  * CVE-2021-23840: OpenSSL - Integer overflow in CipherUpdate
    (bsc#1182333)</changelog>
  <changelog author="adam.majer@suse.de" date="1617796800">- New upstream LTS version 12.22.1:
  * CVE-2021-3450: OpenSSL - CA certificate check bypass with
    X509_V_FLAG_X509_STRICT (High). (bsc#1183851)
  * CVE-2021-3449: OpenSSL - NULL pointer deref in
    signature_algorithms processing (High) (bsc#1183852)
  * CVE-2020-7774: npm - Update y18n to fix Prototype-Pollution
    (bsc#1184450)
- Changes in LTS version 12.22.0:
  * node-api: define version 8
  * http: runtime deprecate legacy HTTP parser
  * v8: implement v8.stopCoverage() and v8.takeCoverage()
  * worker: add eventLoopUtilization()
- versioned.patch: refreshed</changelog>
  <changelog author="adam.majer@suse.de" date="1622462400">- Use libalternatives instead of update-alternatives</changelog>
  <changelog author="adam.majer@suse.de" date="1623326400">- Fix-build-with-icu-69.patch: fix building with ICU 69</changelog>
  <changelog author="adam.majer@suse.de" date="1625572800">- update to 12.22.2:
  * deps: libuv upgrade - Out of bounds read (Medium)
    (bsc#1187973, CVE-2021-22918)
  * deps: npm update to 6.14.13 fixing
    ssri Regular Expression Denial of Service and hosted-git-info
    Regular Expression Denial of Service
    (bsc#1187976, bsc#1187977, CVE-2021-27290, CVE-2021-23362)
- specfile cleanup</changelog>
  <changelog author="adam.majer@suse.de" date="1628078400">- update to 12.22.4:
  http2: fixes use after free on close http2 on stream canceling
  (bsc#1188917, CVE-2021-22930)
  deps: upgrade npm to 6.14.14
- versioned.patch: refreshed</changelog>
  <changelog author="adam.majer@suse.de" date="1628510400">- z15-test-skip.patch: skip problematic test on s390x</changelog>
  <changelog author="adam.majer@suse.de" date="1628769600">- update to 12.22.5:
  * CVE-2021-3672/CVE-2021-22931: Improper handling of untypical
    characters in domain names (bsc#1189370, bsc#1188881)
  * CVE-2021-22940: Use after free on close http2 on stream canceling
    (bsc#1189368)
  * CVE-2021-22939: Incomplete validation of rejectUnauthorized parameter
    (bsc#1189369)
- Fix-build-with-icu-69.patch: dropped, not for factory
- cares_public_headers.patch: don't use private headers</changelog>
  <changelog author="adam.majer@suse.de" date="1637928000">- update to 12.22.7:
  * deps: update llhttp to 2.1.4
  - HTTP Request Smuggling due to spaced in headers
    (bsc#1191601, CVE-2021-22959)
  - HTTP Request Smuggling when parsing the body
    (bsc#1191602, CVE-2021-22960)
- changes in 12.22.6:
  * deps: upgrade npm to 6.14.15 which fixes a number of
    security issues
    (bsc#1190057, CVE-2021-37701, bsc#1190056, CVE-2021-37712,
    bsc#1190055, CVE-2021-37713, bsc#1190054, CVE-2021-39134,
    bsc#1190053, CVE-2021-39135)
- versioned.patch: refreshed</changelog>
  <changelog author="adam.majer@suse.de" date="1641556800">- update to 12.22.8:
  * src: fix crash in AfterGetAddrInfo
  * deps: update c-ares to 1.18.1</changelog>
  <changelog author="adam.majer@suse.de" date="1641902400">- update to 12.22.9:
  Security update fixing the following issues:
  * Improper handling of URI Subject Alternative Names (Medium)
  (CVE-2021-44531, bsc#1194511)
  * Certificate Verification Bypass via String Injection (Medium)
  (CVE-2021-44532, bsc#1194512)
  * Incorrect handling of certificate subject and issuer fields (Medium)
  (CVE-2021-44533, bsc#1194513)
  * Prototype pollution via console.table properties (Low)
  (CVE-2022-21824, bsc#1194514)</changelog>
  <changelog author="adam.majer@suse.de" date="1645012800">- update to 12.22.10
  * Upgrade npm to 6.14.16
    + CVE-2021-23343 - ReDoS via splitDeviceRe, splitTailRe and
    splitPathRe (bsc#1192153)
    + CVE-2021-32803 - node-tar: Insufficient symlink protection
    allowing arbitrary file creation and overwrite (bsc#1191963)
    + CVE-2021-32804 - node-tar: Insufficient absolute path sanitization
    allowing arbitrary file creation and overwrite (bsc#1191962)
    + CVE-2021-3918 - json-schema is vulnerable to Improperly
    Controlled Modification of Object Prototype Attributes (bsc#1192696)
  * Updated ICU time zone data
- CVE-2021-3807.patch: node-ansi-regex: Regular expression
  denial of service (ReDoS) matching ANSI escape codes
  (bsc#1192154, CVE-2021-3807)
- versioned.patch: refreshed
- z15-test-skip.patch: dropped
- fix_ci_tests.patch: fix tests on z15</changelog>
</package>
<package pkgid="e5733d56ca96f952b6348fd810bd093cfd0a3c96f6184b5ffe6b41b2c58727ed" name="nodejs12-devel" arch="s390x">
  <version epoch="0" ver="12.22.10" rel="4.29.3"/>
  <changelog author="adam.majer@suse.de" date="1602244800">- fix_ci_tests.patch: add support to SUSE's ECDH backport errors
  in SLE's openssl</changelog>
  <changelog author="adam.majer@suse.de" date="1605268800">- python3.patch: allows building of node with python3 toolchain</changelog>
  <changelog author="adam.majer@suse.de" date="1605787200">- New upstream LTS version 12.19.1:
  * deps: Denial of Service through DNS request (High).
  A Node.js application that allows an attacker to trigger a DNS
  request for a host of their choice could trigger a Denial of Service
  by getting the application to resolve a DNS record with
  a larger number of responses (bsc#1178882, CVE-2020-8277)</changelog>
  <changelog author="adam.majer@suse.de" date="1606132800">- Update Requires: so -devel requires npm
- Rely on rpmbuild to define necessary python dependencies</changelog>
  <changelog author="adam.majer@suse.de" date="1606392000">- New upstream LTS version 12.20.0:
  * deps:
    + update llhttp '2.1.2' -&gt; '2.1.3'
    + update uv '1.39.0' -&gt; '1.40.0'
    + update uvwasi '0.0.10' -&gt; '0.0.11'
  * fs: add .ref() and .unref() methods to watcher classes
  * http: added scheduling option to http agent
  * module:
    + exports pattern support
    + named exports for CJS via static analysis
  * n-api: add more property defaults (gh#35214)</changelog>
  <changelog author="adam.majer@suse.de" date="1606737600">- openssl_binary_detection.patch: fixes unit tests on SLE12</changelog>
  <changelog author="adam.majer@suse.de" date="1609761600">- New upstream LTS version 12.20.1:
  * CVE-2020-8265: use-after-free in TLSWrap (High) bug in TLS
    implementation. When writing to a TLS enabled socket,
    node::StreamBase::Write calls node::TLSWrap::DoWrite with
    a freshly allocated WriteWrap object as first argument.
    If the DoWrite method does not return an error, this object is
    passed back to the caller as part of a StreamWriteResult structure.
    This may be exploited to corrupt memory leading to a
    Denial of Service or potentially other exploits (bsc#1180553)
  * CVE-2020-8287: HTTP Request Smuggling allow two copies of a
    header field in a http request. For example, two Transfer-Encoding
    header fields. In this case Node.js identifies the first header
    field and ignores the second. This can lead to HTTP Request
    Smuggling (https://cwe.mitre.org/data/definitions/444.html).
    (bsc#1180554)
  * CVE-2020-1971: OpenSSL - EDIPARTYNAME NULL pointer de-reference
    (High) This is a vulnerability in OpenSSL which may be exploited
    through Node.js. (bsc#1179491)
- versioned.patch, nodejs-libpath.patch: refreshed</changelog>
  <changelog author="adam.majer@suse.de" date="1613563200">- New upstream LTS version 12.20.2:
  * deps: upgrade npm to 6.14.11
- relax OpenSSL cipher suite policies for unit tests</changelog>
  <changelog author="adam.majer@suse.de" date="1614081600">- New upstream LTS version 12.21.0:
  * CVE-2021-22883: HTTP2 'unknownProtocol' cause Denial of Service
    by resource exhaustion (bsc#1182619)
  * CVE-2021-22884: DNS rebinding in --inspect (bsc#1182620)
  * CVE-2021-23840: OpenSSL - Integer overflow in CipherUpdate
    (bsc#1182333)</changelog>
  <changelog author="adam.majer@suse.de" date="1617796800">- New upstream LTS version 12.22.1:
  * CVE-2021-3450: OpenSSL - CA certificate check bypass with
    X509_V_FLAG_X509_STRICT (High). (bsc#1183851)
  * CVE-2021-3449: OpenSSL - NULL pointer deref in
    signature_algorithms processing (High) (bsc#1183852)
  * CVE-2020-7774: npm - Update y18n to fix Prototype-Pollution
    (bsc#1184450)
- Changes in LTS version 12.22.0:
  * node-api: define version 8
  * http: runtime deprecate legacy HTTP parser
  * v8: implement v8.stopCoverage() and v8.takeCoverage()
  * worker: add eventLoopUtilization()
- versioned.patch: refreshed</changelog>
  <changelog author="adam.majer@suse.de" date="1622462400">- Use libalternatives instead of update-alternatives</changelog>
  <changelog author="adam.majer@suse.de" date="1623326400">- Fix-build-with-icu-69.patch: fix building with ICU 69</changelog>
  <changelog author="adam.majer@suse.de" date="1625572800">- update to 12.22.2:
  * deps: libuv upgrade - Out of bounds read (Medium)
    (bsc#1187973, CVE-2021-22918)
  * deps: npm update to 6.14.13 fixing
    ssri Regular Expression Denial of Service and hosted-git-info
    Regular Expression Denial of Service
    (bsc#1187976, bsc#1187977, CVE-2021-27290, CVE-2021-23362)
- specfile cleanup</changelog>
  <changelog author="adam.majer@suse.de" date="1628078400">- update to 12.22.4:
  http2: fixes use after free on close http2 on stream canceling
  (bsc#1188917, CVE-2021-22930)
  deps: upgrade npm to 6.14.14
- versioned.patch: refreshed</changelog>
  <changelog author="adam.majer@suse.de" date="1628510400">- z15-test-skip.patch: skip problematic test on s390x</changelog>
  <changelog author="adam.majer@suse.de" date="1628769600">- update to 12.22.5:
  * CVE-2021-3672/CVE-2021-22931: Improper handling of untypical
    characters in domain names (bsc#1189370, bsc#1188881)
  * CVE-2021-22940: Use after free on close http2 on stream canceling
    (bsc#1189368)
  * CVE-2021-22939: Incomplete validation of rejectUnauthorized parameter
    (bsc#1189369)
- Fix-build-with-icu-69.patch: dropped, not for factory
- cares_public_headers.patch: don't use private headers</changelog>
  <changelog author="adam.majer@suse.de" date="1637928000">- update to 12.22.7:
  * deps: update llhttp to 2.1.4
  - HTTP Request Smuggling due to spaced in headers
    (bsc#1191601, CVE-2021-22959)
  - HTTP Request Smuggling when parsing the body
    (bsc#1191602, CVE-2021-22960)
- changes in 12.22.6:
  * deps: upgrade npm to 6.14.15 which fixes a number of
    security issues
    (bsc#1190057, CVE-2021-37701, bsc#1190056, CVE-2021-37712,
    bsc#1190055, CVE-2021-37713, bsc#1190054, CVE-2021-39134,
    bsc#1190053, CVE-2021-39135)
- versioned.patch: refreshed</changelog>
  <changelog author="adam.majer@suse.de" date="1641556800">- update to 12.22.8:
  * src: fix crash in AfterGetAddrInfo
  * deps: update c-ares to 1.18.1</changelog>
  <changelog author="adam.majer@suse.de" date="1641902400">- update to 12.22.9:
  Security update fixing the following issues:
  * Improper handling of URI Subject Alternative Names (Medium)
  (CVE-2021-44531, bsc#1194511)
  * Certificate Verification Bypass via String Injection (Medium)
  (CVE-2021-44532, bsc#1194512)
  * Incorrect handling of certificate subject and issuer fields (Medium)
  (CVE-2021-44533, bsc#1194513)
  * Prototype pollution via console.table properties (Low)
  (CVE-2022-21824, bsc#1194514)</changelog>
  <changelog author="adam.majer@suse.de" date="1645012800">- update to 12.22.10
  * Upgrade npm to 6.14.16
    + CVE-2021-23343 - ReDoS via splitDeviceRe, splitTailRe and
    splitPathRe (bsc#1192153)
    + CVE-2021-32803 - node-tar: Insufficient symlink protection
    allowing arbitrary file creation and overwrite (bsc#1191963)
    + CVE-2021-32804 - node-tar: Insufficient absolute path sanitization
    allowing arbitrary file creation and overwrite (bsc#1191962)
    + CVE-2021-3918 - json-schema is vulnerable to Improperly
    Controlled Modification of Object Prototype Attributes (bsc#1192696)
  * Updated ICU time zone data
- CVE-2021-3807.patch: node-ansi-regex: Regular expression
  denial of service (ReDoS) matching ANSI escape codes
  (bsc#1192154, CVE-2021-3807)
- versioned.patch: refreshed
- z15-test-skip.patch: dropped
- fix_ci_tests.patch: fix tests on z15</changelog>
</package>
<package pkgid="6a4aaae1d52a75627e72c0f2a19e6942dd89da6bcaf750aa68e0852f73289182" name="nodejs12-devel" arch="x86_64">
  <version epoch="0" ver="12.22.10" rel="4.29.3"/>
  <changelog author="adam.majer@suse.de" date="1602244800">- fix_ci_tests.patch: add support to SUSE's ECDH backport errors
  in SLE's openssl</changelog>
  <changelog author="adam.majer@suse.de" date="1605268800">- python3.patch: allows building of node with python3 toolchain</changelog>
  <changelog author="adam.majer@suse.de" date="1605787200">- New upstream LTS version 12.19.1:
  * deps: Denial of Service through DNS request (High).
  A Node.js application that allows an attacker to trigger a DNS
  request for a host of their choice could trigger a Denial of Service
  by getting the application to resolve a DNS record with
  a larger number of responses (bsc#1178882, CVE-2020-8277)</changelog>
  <changelog author="adam.majer@suse.de" date="1606132800">- Update Requires: so -devel requires npm
- Rely on rpmbuild to define necessary python dependencies</changelog>
  <changelog author="adam.majer@suse.de" date="1606392000">- New upstream LTS version 12.20.0:
  * deps:
    + update llhttp '2.1.2' -&gt; '2.1.3'
    + update uv '1.39.0' -&gt; '1.40.0'
    + update uvwasi '0.0.10' -&gt; '0.0.11'
  * fs: add .ref() and .unref() methods to watcher classes
  * http: added scheduling option to http agent
  * module:
    + exports pattern support
    + named exports for CJS via static analysis
  * n-api: add more property defaults (gh#35214)</changelog>
  <changelog author="adam.majer@suse.de" date="1606737600">- openssl_binary_detection.patch: fixes unit tests on SLE12</changelog>
  <changelog author="adam.majer@suse.de" date="1609761600">- New upstream LTS version 12.20.1:
  * CVE-2020-8265: use-after-free in TLSWrap (High) bug in TLS
    implementation. When writing to a TLS enabled socket,
    node::StreamBase::Write calls node::TLSWrap::DoWrite with
    a freshly allocated WriteWrap object as first argument.
    If the DoWrite method does not return an error, this object is
    passed back to the caller as part of a StreamWriteResult structure.
    This may be exploited to corrupt memory leading to a
    Denial of Service or potentially other exploits (bsc#1180553)
  * CVE-2020-8287: HTTP Request Smuggling allow two copies of a
    header field in a http request. For example, two Transfer-Encoding
    header fields. In this case Node.js identifies the first header
    field and ignores the second. This can lead to HTTP Request
    Smuggling (https://cwe.mitre.org/data/definitions/444.html).
    (bsc#1180554)
  * CVE-2020-1971: OpenSSL - EDIPARTYNAME NULL pointer de-reference
    (High) This is a vulnerability in OpenSSL which may be exploited
    through Node.js. (bsc#1179491)
- versioned.patch, nodejs-libpath.patch: refreshed</changelog>
  <changelog author="adam.majer@suse.de" date="1613563200">- New upstream LTS version 12.20.2:
  * deps: upgrade npm to 6.14.11
- relax OpenSSL cipher suite policies for unit tests</changelog>
  <changelog author="adam.majer@suse.de" date="1614081600">- New upstream LTS version 12.21.0:
  * CVE-2021-22883: HTTP2 'unknownProtocol' cause Denial of Service
    by resource exhaustion (bsc#1182619)
  * CVE-2021-22884: DNS rebinding in --inspect (bsc#1182620)
  * CVE-2021-23840: OpenSSL - Integer overflow in CipherUpdate
    (bsc#1182333)</changelog>
  <changelog author="adam.majer@suse.de" date="1617796800">- New upstream LTS version 12.22.1:
  * CVE-2021-3450: OpenSSL - CA certificate check bypass with
    X509_V_FLAG_X509_STRICT (High). (bsc#1183851)
  * CVE-2021-3449: OpenSSL - NULL pointer deref in
    signature_algorithms processing (High) (bsc#1183852)
  * CVE-2020-7774: npm - Update y18n to fix Prototype-Pollution
    (bsc#1184450)
- Changes in LTS version 12.22.0:
  * node-api: define version 8
  * http: runtime deprecate legacy HTTP parser
  * v8: implement v8.stopCoverage() and v8.takeCoverage()
  * worker: add eventLoopUtilization()
- versioned.patch: refreshed</changelog>
  <changelog author="adam.majer@suse.de" date="1622462400">- Use libalternatives instead of update-alternatives</changelog>
  <changelog author="adam.majer@suse.de" date="1623326400">- Fix-build-with-icu-69.patch: fix building with ICU 69</changelog>
  <changelog author="adam.majer@suse.de" date="1625572800">- update to 12.22.2:
  * deps: libuv upgrade - Out of bounds read (Medium)
    (bsc#1187973, CVE-2021-22918)
  * deps: npm update to 6.14.13 fixing
    ssri Regular Expression Denial of Service and hosted-git-info
    Regular Expression Denial of Service
    (bsc#1187976, bsc#1187977, CVE-2021-27290, CVE-2021-23362)
- specfile cleanup</changelog>
  <changelog author="adam.majer@suse.de" date="1628078400">- update to 12.22.4:
  http2: fixes use after free on close http2 on stream canceling
  (bsc#1188917, CVE-2021-22930)
  deps: upgrade npm to 6.14.14
- versioned.patch: refreshed</changelog>
  <changelog author="adam.majer@suse.de" date="1628510400">- z15-test-skip.patch: skip problematic test on s390x</changelog>
  <changelog author="adam.majer@suse.de" date="1628769600">- update to 12.22.5:
  * CVE-2021-3672/CVE-2021-22931: Improper handling of untypical
    characters in domain names (bsc#1189370, bsc#1188881)
  * CVE-2021-22940: Use after free on close http2 on stream canceling
    (bsc#1189368)
  * CVE-2021-22939: Incomplete validation of rejectUnauthorized parameter
    (bsc#1189369)
- Fix-build-with-icu-69.patch: dropped, not for factory
- cares_public_headers.patch: don't use private headers</changelog>
  <changelog author="adam.majer@suse.de" date="1637928000">- update to 12.22.7:
  * deps: update llhttp to 2.1.4
  - HTTP Request Smuggling due to spaced in headers
    (bsc#1191601, CVE-2021-22959)
  - HTTP Request Smuggling when parsing the body
    (bsc#1191602, CVE-2021-22960)
- changes in 12.22.6:
  * deps: upgrade npm to 6.14.15 which fixes a number of
    security issues
    (bsc#1190057, CVE-2021-37701, bsc#1190056, CVE-2021-37712,
    bsc#1190055, CVE-2021-37713, bsc#1190054, CVE-2021-39134,
    bsc#1190053, CVE-2021-39135)
- versioned.patch: refreshed</changelog>
  <changelog author="adam.majer@suse.de" date="1641556800">- update to 12.22.8:
  * src: fix crash in AfterGetAddrInfo
  * deps: update c-ares to 1.18.1</changelog>
  <changelog author="adam.majer@suse.de" date="1641902400">- update to 12.22.9:
  Security update fixing the following issues:
  * Improper handling of URI Subject Alternative Names (Medium)
  (CVE-2021-44531, bsc#1194511)
  * Certificate Verification Bypass via String Injection (Medium)
  (CVE-2021-44532, bsc#1194512)
  * Incorrect handling of certificate subject and issuer fields (Medium)
  (CVE-2021-44533, bsc#1194513)
  * Prototype pollution via console.table properties (Low)
  (CVE-2022-21824, bsc#1194514)</changelog>
  <changelog author="adam.majer@suse.de" date="1645012800">- update to 12.22.10
  * Upgrade npm to 6.14.16
    + CVE-2021-23343 - ReDoS via splitDeviceRe, splitTailRe and
    splitPathRe (bsc#1192153)
    + CVE-2021-32803 - node-tar: Insufficient symlink protection
    allowing arbitrary file creation and overwrite (bsc#1191963)
    + CVE-2021-32804 - node-tar: Insufficient absolute path sanitization
    allowing arbitrary file creation and overwrite (bsc#1191962)
    + CVE-2021-3918 - json-schema is vulnerable to Improperly
    Controlled Modification of Object Prototype Attributes (bsc#1192696)
  * Updated ICU time zone data
- CVE-2021-3807.patch: node-ansi-regex: Regular expression
  denial of service (ReDoS) matching ANSI escape codes
  (bsc#1192154, CVE-2021-3807)
- versioned.patch: refreshed
- z15-test-skip.patch: dropped
- fix_ci_tests.patch: fix tests on z15</changelog>
</package>
<package pkgid="d12130ccc48c4c28f3effb55830f64ea1f58d6608726276cbfeeb955ac708a6e" name="nodejs12-docs" arch="noarch">
  <version epoch="0" ver="12.22.10" rel="4.29.3"/>
  <changelog author="adam.majer@suse.de" date="1602244800">- fix_ci_tests.patch: add support to SUSE's ECDH backport errors
  in SLE's openssl</changelog>
  <changelog author="adam.majer@suse.de" date="1605268800">- python3.patch: allows building of node with python3 toolchain</changelog>
  <changelog author="adam.majer@suse.de" date="1605787200">- New upstream LTS version 12.19.1:
  * deps: Denial of Service through DNS request (High).
  A Node.js application that allows an attacker to trigger a DNS
  request for a host of their choice could trigger a Denial of Service
  by getting the application to resolve a DNS record with
  a larger number of responses (bsc#1178882, CVE-2020-8277)</changelog>
  <changelog author="adam.majer@suse.de" date="1606132800">- Update Requires: so -devel requires npm
- Rely on rpmbuild to define necessary python dependencies</changelog>
  <changelog author="adam.majer@suse.de" date="1606392000">- New upstream LTS version 12.20.0:
  * deps:
    + update llhttp '2.1.2' -&gt; '2.1.3'
    + update uv '1.39.0' -&gt; '1.40.0'
    + update uvwasi '0.0.10' -&gt; '0.0.11'
  * fs: add .ref() and .unref() methods to watcher classes
  * http: added scheduling option to http agent
  * module:
    + exports pattern support
    + named exports for CJS via static analysis
  * n-api: add more property defaults (gh#35214)</changelog>
  <changelog author="adam.majer@suse.de" date="1606737600">- openssl_binary_detection.patch: fixes unit tests on SLE12</changelog>
  <changelog author="adam.majer@suse.de" date="1609761600">- New upstream LTS version 12.20.1:
  * CVE-2020-8265: use-after-free in TLSWrap (High) bug in TLS
    implementation. When writing to a TLS enabled socket,
    node::StreamBase::Write calls node::TLSWrap::DoWrite with
    a freshly allocated WriteWrap object as first argument.
    If the DoWrite method does not return an error, this object is
    passed back to the caller as part of a StreamWriteResult structure.
    This may be exploited to corrupt memory leading to a
    Denial of Service or potentially other exploits (bsc#1180553)
  * CVE-2020-8287: HTTP Request Smuggling allow two copies of a
    header field in a http request. For example, two Transfer-Encoding
    header fields. In this case Node.js identifies the first header
    field and ignores the second. This can lead to HTTP Request
    Smuggling (https://cwe.mitre.org/data/definitions/444.html).
    (bsc#1180554)
  * CVE-2020-1971: OpenSSL - EDIPARTYNAME NULL pointer de-reference
    (High) This is a vulnerability in OpenSSL which may be exploited
    through Node.js. (bsc#1179491)
- versioned.patch, nodejs-libpath.patch: refreshed</changelog>
  <changelog author="adam.majer@suse.de" date="1613563200">- New upstream LTS version 12.20.2:
  * deps: upgrade npm to 6.14.11
- relax OpenSSL cipher suite policies for unit tests</changelog>
  <changelog author="adam.majer@suse.de" date="1614081600">- New upstream LTS version 12.21.0:
  * CVE-2021-22883: HTTP2 'unknownProtocol' cause Denial of Service
    by resource exhaustion (bsc#1182619)
  * CVE-2021-22884: DNS rebinding in --inspect (bsc#1182620)
  * CVE-2021-23840: OpenSSL - Integer overflow in CipherUpdate
    (bsc#1182333)</changelog>
  <changelog author="adam.majer@suse.de" date="1617796800">- New upstream LTS version 12.22.1:
  * CVE-2021-3450: OpenSSL - CA certificate check bypass with
    X509_V_FLAG_X509_STRICT (High). (bsc#1183851)
  * CVE-2021-3449: OpenSSL - NULL pointer deref in
    signature_algorithms processing (High) (bsc#1183852)
  * CVE-2020-7774: npm - Update y18n to fix Prototype-Pollution
    (bsc#1184450)
- Changes in LTS version 12.22.0:
  * node-api: define version 8
  * http: runtime deprecate legacy HTTP parser
  * v8: implement v8.stopCoverage() and v8.takeCoverage()
  * worker: add eventLoopUtilization()
- versioned.patch: refreshed</changelog>
  <changelog author="adam.majer@suse.de" date="1622462400">- Use libalternatives instead of update-alternatives</changelog>
  <changelog author="adam.majer@suse.de" date="1623326400">- Fix-build-with-icu-69.patch: fix building with ICU 69</changelog>
  <changelog author="adam.majer@suse.de" date="1625572800">- update to 12.22.2:
  * deps: libuv upgrade - Out of bounds read (Medium)
    (bsc#1187973, CVE-2021-22918)
  * deps: npm update to 6.14.13 fixing
    ssri Regular Expression Denial of Service and hosted-git-info
    Regular Expression Denial of Service
    (bsc#1187976, bsc#1187977, CVE-2021-27290, CVE-2021-23362)
- specfile cleanup</changelog>
  <changelog author="adam.majer@suse.de" date="1628078400">- update to 12.22.4:
  http2: fixes use after free on close http2 on stream canceling
  (bsc#1188917, CVE-2021-22930)
  deps: upgrade npm to 6.14.14
- versioned.patch: refreshed</changelog>
  <changelog author="adam.majer@suse.de" date="1628510400">- z15-test-skip.patch: skip problematic test on s390x</changelog>
  <changelog author="adam.majer@suse.de" date="1628769600">- update to 12.22.5:
  * CVE-2021-3672/CVE-2021-22931: Improper handling of untypical
    characters in domain names (bsc#1189370, bsc#1188881)
  * CVE-2021-22940: Use after free on close http2 on stream canceling
    (bsc#1189368)
  * CVE-2021-22939: Incomplete validation of rejectUnauthorized parameter
    (bsc#1189369)
- Fix-build-with-icu-69.patch: dropped, not for factory
- cares_public_headers.patch: don't use private headers</changelog>
  <changelog author="adam.majer@suse.de" date="1637928000">- update to 12.22.7:
  * deps: update llhttp to 2.1.4
  - HTTP Request Smuggling due to spaced in headers
    (bsc#1191601, CVE-2021-22959)
  - HTTP Request Smuggling when parsing the body
    (bsc#1191602, CVE-2021-22960)
- changes in 12.22.6:
  * deps: upgrade npm to 6.14.15 which fixes a number of
    security issues
    (bsc#1190057, CVE-2021-37701, bsc#1190056, CVE-2021-37712,
    bsc#1190055, CVE-2021-37713, bsc#1190054, CVE-2021-39134,
    bsc#1190053, CVE-2021-39135)
- versioned.patch: refreshed</changelog>
  <changelog author="adam.majer@suse.de" date="1641556800">- update to 12.22.8:
  * src: fix crash in AfterGetAddrInfo
  * deps: update c-ares to 1.18.1</changelog>
  <changelog author="adam.majer@suse.de" date="1641902400">- update to 12.22.9:
  Security update fixing the following issues:
  * Improper handling of URI Subject Alternative Names (Medium)
  (CVE-2021-44531, bsc#1194511)
  * Certificate Verification Bypass via String Injection (Medium)
  (CVE-2021-44532, bsc#1194512)
  * Incorrect handling of certificate subject and issuer fields (Medium)
  (CVE-2021-44533, bsc#1194513)
  * Prototype pollution via console.table properties (Low)
  (CVE-2022-21824, bsc#1194514)</changelog>
  <changelog author="adam.majer@suse.de" date="1645012800">- update to 12.22.10
  * Upgrade npm to 6.14.16
    + CVE-2021-23343 - ReDoS via splitDeviceRe, splitTailRe and
    splitPathRe (bsc#1192153)
    + CVE-2021-32803 - node-tar: Insufficient symlink protection
    allowing arbitrary file creation and overwrite (bsc#1191963)
    + CVE-2021-32804 - node-tar: Insufficient absolute path sanitization
    allowing arbitrary file creation and overwrite (bsc#1191962)
    + CVE-2021-3918 - json-schema is vulnerable to Improperly
    Controlled Modification of Object Prototype Attributes (bsc#1192696)
  * Updated ICU time zone data
- CVE-2021-3807.patch: node-ansi-regex: Regular expression
  denial of service (ReDoS) matching ANSI escape codes
  (bsc#1192154, CVE-2021-3807)
- versioned.patch: refreshed
- z15-test-skip.patch: dropped
- fix_ci_tests.patch: fix tests on z15</changelog>
</package>
<package pkgid="71e20d84a1f91bcc9bd124ce707a507bd66a4eb36f8ecd432ce7b1d951e7f88d" name="npm12" arch="aarch64">
  <version epoch="0" ver="12.22.10" rel="4.29.3"/>
  <changelog author="adam.majer@suse.de" date="1602244800">- fix_ci_tests.patch: add support to SUSE's ECDH backport errors
  in SLE's openssl</changelog>
  <changelog author="adam.majer@suse.de" date="1605268800">- python3.patch: allows building of node with python3 toolchain</changelog>
  <changelog author="adam.majer@suse.de" date="1605787200">- New upstream LTS version 12.19.1:
  * deps: Denial of Service through DNS request (High).
  A Node.js application that allows an attacker to trigger a DNS
  request for a host of their choice could trigger a Denial of Service
  by getting the application to resolve a DNS record with
  a larger number of responses (bsc#1178882, CVE-2020-8277)</changelog>
  <changelog author="adam.majer@suse.de" date="1606132800">- Update Requires: so -devel requires npm
- Rely on rpmbuild to define necessary python dependencies</changelog>
  <changelog author="adam.majer@suse.de" date="1606392000">- New upstream LTS version 12.20.0:
  * deps:
    + update llhttp '2.1.2' -&gt; '2.1.3'
    + update uv '1.39.0' -&gt; '1.40.0'
    + update uvwasi '0.0.10' -&gt; '0.0.11'
  * fs: add .ref() and .unref() methods to watcher classes
  * http: added scheduling option to http agent
  * module:
    + exports pattern support
    + named exports for CJS via static analysis
  * n-api: add more property defaults (gh#35214)</changelog>
  <changelog author="adam.majer@suse.de" date="1606737600">- openssl_binary_detection.patch: fixes unit tests on SLE12</changelog>
  <changelog author="adam.majer@suse.de" date="1609761600">- New upstream LTS version 12.20.1:
  * CVE-2020-8265: use-after-free in TLSWrap (High) bug in TLS
    implementation. When writing to a TLS enabled socket,
    node::StreamBase::Write calls node::TLSWrap::DoWrite with
    a freshly allocated WriteWrap object as first argument.
    If the DoWrite method does not return an error, this object is
    passed back to the caller as part of a StreamWriteResult structure.
    This may be exploited to corrupt memory leading to a
    Denial of Service or potentially other exploits (bsc#1180553)
  * CVE-2020-8287: HTTP Request Smuggling allow two copies of a
    header field in a http request. For example, two Transfer-Encoding
    header fields. In this case Node.js identifies the first header
    field and ignores the second. This can lead to HTTP Request
    Smuggling (https://cwe.mitre.org/data/definitions/444.html).
    (bsc#1180554)
  * CVE-2020-1971: OpenSSL - EDIPARTYNAME NULL pointer de-reference
    (High) This is a vulnerability in OpenSSL which may be exploited
    through Node.js. (bsc#1179491)
- versioned.patch, nodejs-libpath.patch: refreshed</changelog>
  <changelog author="adam.majer@suse.de" date="1613563200">- New upstream LTS version 12.20.2:
  * deps: upgrade npm to 6.14.11
- relax OpenSSL cipher suite policies for unit tests</changelog>
  <changelog author="adam.majer@suse.de" date="1614081600">- New upstream LTS version 12.21.0:
  * CVE-2021-22883: HTTP2 'unknownProtocol' cause Denial of Service
    by resource exhaustion (bsc#1182619)
  * CVE-2021-22884: DNS rebinding in --inspect (bsc#1182620)
  * CVE-2021-23840: OpenSSL - Integer overflow in CipherUpdate
    (bsc#1182333)</changelog>
  <changelog author="adam.majer@suse.de" date="1617796800">- New upstream LTS version 12.22.1:
  * CVE-2021-3450: OpenSSL - CA certificate check bypass with
    X509_V_FLAG_X509_STRICT (High). (bsc#1183851)
  * CVE-2021-3449: OpenSSL - NULL pointer deref in
    signature_algorithms processing (High) (bsc#1183852)
  * CVE-2020-7774: npm - Update y18n to fix Prototype-Pollution
    (bsc#1184450)
- Changes in LTS version 12.22.0:
  * node-api: define version 8
  * http: runtime deprecate legacy HTTP parser
  * v8: implement v8.stopCoverage() and v8.takeCoverage()
  * worker: add eventLoopUtilization()
- versioned.patch: refreshed</changelog>
  <changelog author="adam.majer@suse.de" date="1622462400">- Use libalternatives instead of update-alternatives</changelog>
  <changelog author="adam.majer@suse.de" date="1623326400">- Fix-build-with-icu-69.patch: fix building with ICU 69</changelog>
  <changelog author="adam.majer@suse.de" date="1625572800">- update to 12.22.2:
  * deps: libuv upgrade - Out of bounds read (Medium)
    (bsc#1187973, CVE-2021-22918)
  * deps: npm update to 6.14.13 fixing
    ssri Regular Expression Denial of Service and hosted-git-info
    Regular Expression Denial of Service
    (bsc#1187976, bsc#1187977, CVE-2021-27290, CVE-2021-23362)
- specfile cleanup</changelog>
  <changelog author="adam.majer@suse.de" date="1628078400">- update to 12.22.4:
  http2: fixes use after free on close http2 on stream canceling
  (bsc#1188917, CVE-2021-22930)
  deps: upgrade npm to 6.14.14
- versioned.patch: refreshed</changelog>
  <changelog author="adam.majer@suse.de" date="1628510400">- z15-test-skip.patch: skip problematic test on s390x</changelog>
  <changelog author="adam.majer@suse.de" date="1628769600">- update to 12.22.5:
  * CVE-2021-3672/CVE-2021-22931: Improper handling of untypical
    characters in domain names (bsc#1189370, bsc#1188881)
  * CVE-2021-22940: Use after free on close http2 on stream canceling
    (bsc#1189368)
  * CVE-2021-22939: Incomplete validation of rejectUnauthorized parameter
    (bsc#1189369)
- Fix-build-with-icu-69.patch: dropped, not for factory
- cares_public_headers.patch: don't use private headers</changelog>
  <changelog author="adam.majer@suse.de" date="1637928000">- update to 12.22.7:
  * deps: update llhttp to 2.1.4
  - HTTP Request Smuggling due to spaced in headers
    (bsc#1191601, CVE-2021-22959)
  - HTTP Request Smuggling when parsing the body
    (bsc#1191602, CVE-2021-22960)
- changes in 12.22.6:
  * deps: upgrade npm to 6.14.15 which fixes a number of
    security issues
    (bsc#1190057, CVE-2021-37701, bsc#1190056, CVE-2021-37712,
    bsc#1190055, CVE-2021-37713, bsc#1190054, CVE-2021-39134,
    bsc#1190053, CVE-2021-39135)
- versioned.patch: refreshed</changelog>
  <changelog author="adam.majer@suse.de" date="1641556800">- update to 12.22.8:
  * src: fix crash in AfterGetAddrInfo
  * deps: update c-ares to 1.18.1</changelog>
  <changelog author="adam.majer@suse.de" date="1641902400">- update to 12.22.9:
  Security update fixing the following issues:
  * Improper handling of URI Subject Alternative Names (Medium)
  (CVE-2021-44531, bsc#1194511)
  * Certificate Verification Bypass via String Injection (Medium)
  (CVE-2021-44532, bsc#1194512)
  * Incorrect handling of certificate subject and issuer fields (Medium)
  (CVE-2021-44533, bsc#1194513)
  * Prototype pollution via console.table properties (Low)
  (CVE-2022-21824, bsc#1194514)</changelog>
  <changelog author="adam.majer@suse.de" date="1645012800">- update to 12.22.10
  * Upgrade npm to 6.14.16
    + CVE-2021-23343 - ReDoS via splitDeviceRe, splitTailRe and
    splitPathRe (bsc#1192153)
    + CVE-2021-32803 - node-tar: Insufficient symlink protection
    allowing arbitrary file creation and overwrite (bsc#1191963)
    + CVE-2021-32804 - node-tar: Insufficient absolute path sanitization
    allowing arbitrary file creation and overwrite (bsc#1191962)
    + CVE-2021-3918 - json-schema is vulnerable to Improperly
    Controlled Modification of Object Prototype Attributes (bsc#1192696)
  * Updated ICU time zone data
- CVE-2021-3807.patch: node-ansi-regex: Regular expression
  denial of service (ReDoS) matching ANSI escape codes
  (bsc#1192154, CVE-2021-3807)
- versioned.patch: refreshed
- z15-test-skip.patch: dropped
- fix_ci_tests.patch: fix tests on z15</changelog>
</package>
<package pkgid="fe3f44d91db970b7ab100165b73d2cfad9e6a2ff5a3270551000bb5ce67993c7" name="npm12" arch="ppc64le">
  <version epoch="0" ver="12.22.10" rel="4.29.3"/>
  <changelog author="adam.majer@suse.de" date="1602244800">- fix_ci_tests.patch: add support to SUSE's ECDH backport errors
  in SLE's openssl</changelog>
  <changelog author="adam.majer@suse.de" date="1605268800">- python3.patch: allows building of node with python3 toolchain</changelog>
  <changelog author="adam.majer@suse.de" date="1605787200">- New upstream LTS version 12.19.1:
  * deps: Denial of Service through DNS request (High).
  A Node.js application that allows an attacker to trigger a DNS
  request for a host of their choice could trigger a Denial of Service
  by getting the application to resolve a DNS record with
  a larger number of responses (bsc#1178882, CVE-2020-8277)</changelog>
  <changelog author="adam.majer@suse.de" date="1606132800">- Update Requires: so -devel requires npm
- Rely on rpmbuild to define necessary python dependencies</changelog>
  <changelog author="adam.majer@suse.de" date="1606392000">- New upstream LTS version 12.20.0:
  * deps:
    + update llhttp '2.1.2' -&gt; '2.1.3'
    + update uv '1.39.0' -&gt; '1.40.0'
    + update uvwasi '0.0.10' -&gt; '0.0.11'
  * fs: add .ref() and .unref() methods to watcher classes
  * http: added scheduling option to http agent
  * module:
    + exports pattern support
    + named exports for CJS via static analysis
  * n-api: add more property defaults (gh#35214)</changelog>
  <changelog author="adam.majer@suse.de" date="1606737600">- openssl_binary_detection.patch: fixes unit tests on SLE12</changelog>
  <changelog author="adam.majer@suse.de" date="1609761600">- New upstream LTS version 12.20.1:
  * CVE-2020-8265: use-after-free in TLSWrap (High) bug in TLS
    implementation. When writing to a TLS enabled socket,
    node::StreamBase::Write calls node::TLSWrap::DoWrite with
    a freshly allocated WriteWrap object as first argument.
    If the DoWrite method does not return an error, this object is
    passed back to the caller as part of a StreamWriteResult structure.
    This may be exploited to corrupt memory leading to a
    Denial of Service or potentially other exploits (bsc#1180553)
  * CVE-2020-8287: HTTP Request Smuggling allow two copies of a
    header field in a http request. For example, two Transfer-Encoding
    header fields. In this case Node.js identifies the first header
    field and ignores the second. This can lead to HTTP Request
    Smuggling (https://cwe.mitre.org/data/definitions/444.html).
    (bsc#1180554)
  * CVE-2020-1971: OpenSSL - EDIPARTYNAME NULL pointer de-reference
    (High) This is a vulnerability in OpenSSL which may be exploited
    through Node.js. (bsc#1179491)
- versioned.patch, nodejs-libpath.patch: refreshed</changelog>
  <changelog author="adam.majer@suse.de" date="1613563200">- New upstream LTS version 12.20.2:
  * deps: upgrade npm to 6.14.11
- relax OpenSSL cipher suite policies for unit tests</changelog>
  <changelog author="adam.majer@suse.de" date="1614081600">- New upstream LTS version 12.21.0:
  * CVE-2021-22883: HTTP2 'unknownProtocol' cause Denial of Service
    by resource exhaustion (bsc#1182619)
  * CVE-2021-22884: DNS rebinding in --inspect (bsc#1182620)
  * CVE-2021-23840: OpenSSL - Integer overflow in CipherUpdate
    (bsc#1182333)</changelog>
  <changelog author="adam.majer@suse.de" date="1617796800">- New upstream LTS version 12.22.1:
  * CVE-2021-3450: OpenSSL - CA certificate check bypass with
    X509_V_FLAG_X509_STRICT (High). (bsc#1183851)
  * CVE-2021-3449: OpenSSL - NULL pointer deref in
    signature_algorithms processing (High) (bsc#1183852)
  * CVE-2020-7774: npm - Update y18n to fix Prototype-Pollution
    (bsc#1184450)
- Changes in LTS version 12.22.0:
  * node-api: define version 8
  * http: runtime deprecate legacy HTTP parser
  * v8: implement v8.stopCoverage() and v8.takeCoverage()
  * worker: add eventLoopUtilization()
- versioned.patch: refreshed</changelog>
  <changelog author="adam.majer@suse.de" date="1622462400">- Use libalternatives instead of update-alternatives</changelog>
  <changelog author="adam.majer@suse.de" date="1623326400">- Fix-build-with-icu-69.patch: fix building with ICU 69</changelog>
  <changelog author="adam.majer@suse.de" date="1625572800">- update to 12.22.2:
  * deps: libuv upgrade - Out of bounds read (Medium)
    (bsc#1187973, CVE-2021-22918)
  * deps: npm update to 6.14.13 fixing
    ssri Regular Expression Denial of Service and hosted-git-info
    Regular Expression Denial of Service
    (bsc#1187976, bsc#1187977, CVE-2021-27290, CVE-2021-23362)
- specfile cleanup</changelog>
  <changelog author="adam.majer@suse.de" date="1628078400">- update to 12.22.4:
  http2: fixes use after free on close http2 on stream canceling
  (bsc#1188917, CVE-2021-22930)
  deps: upgrade npm to 6.14.14
- versioned.patch: refreshed</changelog>
  <changelog author="adam.majer@suse.de" date="1628510400">- z15-test-skip.patch: skip problematic test on s390x</changelog>
  <changelog author="adam.majer@suse.de" date="1628769600">- update to 12.22.5:
  * CVE-2021-3672/CVE-2021-22931: Improper handling of untypical
    characters in domain names (bsc#1189370, bsc#1188881)
  * CVE-2021-22940: Use after free on close http2 on stream canceling
    (bsc#1189368)
  * CVE-2021-22939: Incomplete validation of rejectUnauthorized parameter
    (bsc#1189369)
- Fix-build-with-icu-69.patch: dropped, not for factory
- cares_public_headers.patch: don't use private headers</changelog>
  <changelog author="adam.majer@suse.de" date="1637928000">- update to 12.22.7:
  * deps: update llhttp to 2.1.4
  - HTTP Request Smuggling due to spaced in headers
    (bsc#1191601, CVE-2021-22959)
  - HTTP Request Smuggling when parsing the body
    (bsc#1191602, CVE-2021-22960)
- changes in 12.22.6:
  * deps: upgrade npm to 6.14.15 which fixes a number of
    security issues
    (bsc#1190057, CVE-2021-37701, bsc#1190056, CVE-2021-37712,
    bsc#1190055, CVE-2021-37713, bsc#1190054, CVE-2021-39134,
    bsc#1190053, CVE-2021-39135)
- versioned.patch: refreshed</changelog>
  <changelog author="adam.majer@suse.de" date="1641556800">- update to 12.22.8:
  * src: fix crash in AfterGetAddrInfo
  * deps: update c-ares to 1.18.1</changelog>
  <changelog author="adam.majer@suse.de" date="1641902400">- update to 12.22.9:
  Security update fixing the following issues:
  * Improper handling of URI Subject Alternative Names (Medium)
  (CVE-2021-44531, bsc#1194511)
  * Certificate Verification Bypass via String Injection (Medium)
  (CVE-2021-44532, bsc#1194512)
  * Incorrect handling of certificate subject and issuer fields (Medium)
  (CVE-2021-44533, bsc#1194513)
  * Prototype pollution via console.table properties (Low)
  (CVE-2022-21824, bsc#1194514)</changelog>
  <changelog author="adam.majer@suse.de" date="1645012800">- update to 12.22.10
  * Upgrade npm to 6.14.16
    + CVE-2021-23343 - ReDoS via splitDeviceRe, splitTailRe and
    splitPathRe (bsc#1192153)
    + CVE-2021-32803 - node-tar: Insufficient symlink protection
    allowing arbitrary file creation and overwrite (bsc#1191963)
    + CVE-2021-32804 - node-tar: Insufficient absolute path sanitization
    allowing arbitrary file creation and overwrite (bsc#1191962)
    + CVE-2021-3918 - json-schema is vulnerable to Improperly
    Controlled Modification of Object Prototype Attributes (bsc#1192696)
  * Updated ICU time zone data
- CVE-2021-3807.patch: node-ansi-regex: Regular expression
  denial of service (ReDoS) matching ANSI escape codes
  (bsc#1192154, CVE-2021-3807)
- versioned.patch: refreshed
- z15-test-skip.patch: dropped
- fix_ci_tests.patch: fix tests on z15</changelog>
</package>
<package pkgid="8be506de8fc7a4c738a6751983421cdecf08ca186b08a27507dcaf40d0efdab7" name="npm12" arch="s390x">
  <version epoch="0" ver="12.22.10" rel="4.29.3"/>
  <changelog author="adam.majer@suse.de" date="1602244800">- fix_ci_tests.patch: add support to SUSE's ECDH backport errors
  in SLE's openssl</changelog>
  <changelog author="adam.majer@suse.de" date="1605268800">- python3.patch: allows building of node with python3 toolchain</changelog>
  <changelog author="adam.majer@suse.de" date="1605787200">- New upstream LTS version 12.19.1:
  * deps: Denial of Service through DNS request (High).
  A Node.js application that allows an attacker to trigger a DNS
  request for a host of their choice could trigger a Denial of Service
  by getting the application to resolve a DNS record with
  a larger number of responses (bsc#1178882, CVE-2020-8277)</changelog>
  <changelog author="adam.majer@suse.de" date="1606132800">- Update Requires: so -devel requires npm
- Rely on rpmbuild to define necessary python dependencies</changelog>
  <changelog author="adam.majer@suse.de" date="1606392000">- New upstream LTS version 12.20.0:
  * deps:
    + update llhttp '2.1.2' -&gt; '2.1.3'
    + update uv '1.39.0' -&gt; '1.40.0'
    + update uvwasi '0.0.10' -&gt; '0.0.11'
  * fs: add .ref() and .unref() methods to watcher classes
  * http: added scheduling option to http agent
  * module:
    + exports pattern support
    + named exports for CJS via static analysis
  * n-api: add more property defaults (gh#35214)</changelog>
  <changelog author="adam.majer@suse.de" date="1606737600">- openssl_binary_detection.patch: fixes unit tests on SLE12</changelog>
  <changelog author="adam.majer@suse.de" date="1609761600">- New upstream LTS version 12.20.1:
  * CVE-2020-8265: use-after-free in TLSWrap (High) bug in TLS
    implementation. When writing to a TLS enabled socket,
    node::StreamBase::Write calls node::TLSWrap::DoWrite with
    a freshly allocated WriteWrap object as first argument.
    If the DoWrite method does not return an error, this object is
    passed back to the caller as part of a StreamWriteResult structure.
    This may be exploited to corrupt memory leading to a
    Denial of Service or potentially other exploits (bsc#1180553)
  * CVE-2020-8287: HTTP Request Smuggling allow two copies of a
    header field in a http request. For example, two Transfer-Encoding
    header fields. In this case Node.js identifies the first header
    field and ignores the second. This can lead to HTTP Request
    Smuggling (https://cwe.mitre.org/data/definitions/444.html).
    (bsc#1180554)
  * CVE-2020-1971: OpenSSL - EDIPARTYNAME NULL pointer de-reference
    (High) This is a vulnerability in OpenSSL which may be exploited
    through Node.js. (bsc#1179491)
- versioned.patch, nodejs-libpath.patch: refreshed</changelog>
  <changelog author="adam.majer@suse.de" date="1613563200">- New upstream LTS version 12.20.2:
  * deps: upgrade npm to 6.14.11
- relax OpenSSL cipher suite policies for unit tests</changelog>
  <changelog author="adam.majer@suse.de" date="1614081600">- New upstream LTS version 12.21.0:
  * CVE-2021-22883: HTTP2 'unknownProtocol' cause Denial of Service
    by resource exhaustion (bsc#1182619)
  * CVE-2021-22884: DNS rebinding in --inspect (bsc#1182620)
  * CVE-2021-23840: OpenSSL - Integer overflow in CipherUpdate
    (bsc#1182333)</changelog>
  <changelog author="adam.majer@suse.de" date="1617796800">- New upstream LTS version 12.22.1:
  * CVE-2021-3450: OpenSSL - CA certificate check bypass with
    X509_V_FLAG_X509_STRICT (High). (bsc#1183851)
  * CVE-2021-3449: OpenSSL - NULL pointer deref in
    signature_algorithms processing (High) (bsc#1183852)
  * CVE-2020-7774: npm - Update y18n to fix Prototype-Pollution
    (bsc#1184450)
- Changes in LTS version 12.22.0:
  * node-api: define version 8
  * http: runtime deprecate legacy HTTP parser
  * v8: implement v8.stopCoverage() and v8.takeCoverage()
  * worker: add eventLoopUtilization()
- versioned.patch: refreshed</changelog>
  <changelog author="adam.majer@suse.de" date="1622462400">- Use libalternatives instead of update-alternatives</changelog>
  <changelog author="adam.majer@suse.de" date="1623326400">- Fix-build-with-icu-69.patch: fix building with ICU 69</changelog>
  <changelog author="adam.majer@suse.de" date="1625572800">- update to 12.22.2:
  * deps: libuv upgrade - Out of bounds read (Medium)
    (bsc#1187973, CVE-2021-22918)
  * deps: npm update to 6.14.13 fixing
    ssri Regular Expression Denial of Service and hosted-git-info
    Regular Expression Denial of Service
    (bsc#1187976, bsc#1187977, CVE-2021-27290, CVE-2021-23362)
- specfile cleanup</changelog>
  <changelog author="adam.majer@suse.de" date="1628078400">- update to 12.22.4:
  http2: fixes use after free on close http2 on stream canceling
  (bsc#1188917, CVE-2021-22930)
  deps: upgrade npm to 6.14.14
- versioned.patch: refreshed</changelog>
  <changelog author="adam.majer@suse.de" date="1628510400">- z15-test-skip.patch: skip problematic test on s390x</changelog>
  <changelog author="adam.majer@suse.de" date="1628769600">- update to 12.22.5:
  * CVE-2021-3672/CVE-2021-22931: Improper handling of untypical
    characters in domain names (bsc#1189370, bsc#1188881)
  * CVE-2021-22940: Use after free on close http2 on stream canceling
    (bsc#1189368)
  * CVE-2021-22939: Incomplete validation of rejectUnauthorized parameter
    (bsc#1189369)
- Fix-build-with-icu-69.patch: dropped, not for factory
- cares_public_headers.patch: don't use private headers</changelog>
  <changelog author="adam.majer@suse.de" date="1637928000">- update to 12.22.7:
  * deps: update llhttp to 2.1.4
  - HTTP Request Smuggling due to spaced in headers
    (bsc#1191601, CVE-2021-22959)
  - HTTP Request Smuggling when parsing the body
    (bsc#1191602, CVE-2021-22960)
- changes in 12.22.6:
  * deps: upgrade npm to 6.14.15 which fixes a number of
    security issues
    (bsc#1190057, CVE-2021-37701, bsc#1190056, CVE-2021-37712,
    bsc#1190055, CVE-2021-37713, bsc#1190054, CVE-2021-39134,
    bsc#1190053, CVE-2021-39135)
- versioned.patch: refreshed</changelog>
  <changelog author="adam.majer@suse.de" date="1641556800">- update to 12.22.8:
  * src: fix crash in AfterGetAddrInfo
  * deps: update c-ares to 1.18.1</changelog>
  <changelog author="adam.majer@suse.de" date="1641902400">- update to 12.22.9:
  Security update fixing the following issues:
  * Improper handling of URI Subject Alternative Names (Medium)
  (CVE-2021-44531, bsc#1194511)
  * Certificate Verification Bypass via String Injection (Medium)
  (CVE-2021-44532, bsc#1194512)
  * Incorrect handling of certificate subject and issuer fields (Medium)
  (CVE-2021-44533, bsc#1194513)
  * Prototype pollution via console.table properties (Low)
  (CVE-2022-21824, bsc#1194514)</changelog>
  <changelog author="adam.majer@suse.de" date="1645012800">- update to 12.22.10
  * Upgrade npm to 6.14.16
    + CVE-2021-23343 - ReDoS via splitDeviceRe, splitTailRe and
    splitPathRe (bsc#1192153)
    + CVE-2021-32803 - node-tar: Insufficient symlink protection
    allowing arbitrary file creation and overwrite (bsc#1191963)
    + CVE-2021-32804 - node-tar: Insufficient absolute path sanitization
    allowing arbitrary file creation and overwrite (bsc#1191962)
    + CVE-2021-3918 - json-schema is vulnerable to Improperly
    Controlled Modification of Object Prototype Attributes (bsc#1192696)
  * Updated ICU time zone data
- CVE-2021-3807.patch: node-ansi-regex: Regular expression
  denial of service (ReDoS) matching ANSI escape codes
  (bsc#1192154, CVE-2021-3807)
- versioned.patch: refreshed
- z15-test-skip.patch: dropped
- fix_ci_tests.patch: fix tests on z15</changelog>
</package>
<package pkgid="cb20dc0a4757596109aeb4c135fd6adf0497176e2b6e7a0c8622f77f8f60f3e4" name="npm12" arch="x86_64">
  <version epoch="0" ver="12.22.10" rel="4.29.3"/>
  <changelog author="adam.majer@suse.de" date="1602244800">- fix_ci_tests.patch: add support to SUSE's ECDH backport errors
  in SLE's openssl</changelog>
  <changelog author="adam.majer@suse.de" date="1605268800">- python3.patch: allows building of node with python3 toolchain</changelog>
  <changelog author="adam.majer@suse.de" date="1605787200">- New upstream LTS version 12.19.1:
  * deps: Denial of Service through DNS request (High).
  A Node.js application that allows an attacker to trigger a DNS
  request for a host of their choice could trigger a Denial of Service
  by getting the application to resolve a DNS record with
  a larger number of responses (bsc#1178882, CVE-2020-8277)</changelog>
  <changelog author="adam.majer@suse.de" date="1606132800">- Update Requires: so -devel requires npm
- Rely on rpmbuild to define necessary python dependencies</changelog>
  <changelog author="adam.majer@suse.de" date="1606392000">- New upstream LTS version 12.20.0:
  * deps:
    + update llhttp '2.1.2' -&gt; '2.1.3'
    + update uv '1.39.0' -&gt; '1.40.0'
    + update uvwasi '0.0.10' -&gt; '0.0.11'
  * fs: add .ref() and .unref() methods to watcher classes
  * http: added scheduling option to http agent
  * module:
    + exports pattern support
    + named exports for CJS via static analysis
  * n-api: add more property defaults (gh#35214)</changelog>
  <changelog author="adam.majer@suse.de" date="1606737600">- openssl_binary_detection.patch: fixes unit tests on SLE12</changelog>
  <changelog author="adam.majer@suse.de" date="1609761600">- New upstream LTS version 12.20.1:
  * CVE-2020-8265: use-after-free in TLSWrap (High) bug in TLS
    implementation. When writing to a TLS enabled socket,
    node::StreamBase::Write calls node::TLSWrap::DoWrite with
    a freshly allocated WriteWrap object as first argument.
    If the DoWrite method does not return an error, this object is
    passed back to the caller as part of a StreamWriteResult structure.
    This may be exploited to corrupt memory leading to a
    Denial of Service or potentially other exploits (bsc#1180553)
  * CVE-2020-8287: HTTP Request Smuggling allow two copies of a
    header field in a http request. For example, two Transfer-Encoding
    header fields. In this case Node.js identifies the first header
    field and ignores the second. This can lead to HTTP Request
    Smuggling (https://cwe.mitre.org/data/definitions/444.html).
    (bsc#1180554)
  * CVE-2020-1971: OpenSSL - EDIPARTYNAME NULL pointer de-reference
    (High) This is a vulnerability in OpenSSL which may be exploited
    through Node.js. (bsc#1179491)
- versioned.patch, nodejs-libpath.patch: refreshed</changelog>
  <changelog author="adam.majer@suse.de" date="1613563200">- New upstream LTS version 12.20.2:
  * deps: upgrade npm to 6.14.11
- relax OpenSSL cipher suite policies for unit tests</changelog>
  <changelog author="adam.majer@suse.de" date="1614081600">- New upstream LTS version 12.21.0:
  * CVE-2021-22883: HTTP2 'unknownProtocol' cause Denial of Service
    by resource exhaustion (bsc#1182619)
  * CVE-2021-22884: DNS rebinding in --inspect (bsc#1182620)
  * CVE-2021-23840: OpenSSL - Integer overflow in CipherUpdate
    (bsc#1182333)</changelog>
  <changelog author="adam.majer@suse.de" date="1617796800">- New upstream LTS version 12.22.1:
  * CVE-2021-3450: OpenSSL - CA certificate check bypass with
    X509_V_FLAG_X509_STRICT (High). (bsc#1183851)
  * CVE-2021-3449: OpenSSL - NULL pointer deref in
    signature_algorithms processing (High) (bsc#1183852)
  * CVE-2020-7774: npm - Update y18n to fix Prototype-Pollution
    (bsc#1184450)
- Changes in LTS version 12.22.0:
  * node-api: define version 8
  * http: runtime deprecate legacy HTTP parser
  * v8: implement v8.stopCoverage() and v8.takeCoverage()
  * worker: add eventLoopUtilization()
- versioned.patch: refreshed</changelog>
  <changelog author="adam.majer@suse.de" date="1622462400">- Use libalternatives instead of update-alternatives</changelog>
  <changelog author="adam.majer@suse.de" date="1623326400">- Fix-build-with-icu-69.patch: fix building with ICU 69</changelog>
  <changelog author="adam.majer@suse.de" date="1625572800">- update to 12.22.2:
  * deps: libuv upgrade - Out of bounds read (Medium)
    (bsc#1187973, CVE-2021-22918)
  * deps: npm update to 6.14.13 fixing
    ssri Regular Expression Denial of Service and hosted-git-info
    Regular Expression Denial of Service
    (bsc#1187976, bsc#1187977, CVE-2021-27290, CVE-2021-23362)
- specfile cleanup</changelog>
  <changelog author="adam.majer@suse.de" date="1628078400">- update to 12.22.4:
  http2: fixes use after free on close http2 on stream canceling
  (bsc#1188917, CVE-2021-22930)
  deps: upgrade npm to 6.14.14
- versioned.patch: refreshed</changelog>
  <changelog author="adam.majer@suse.de" date="1628510400">- z15-test-skip.patch: skip problematic test on s390x</changelog>
  <changelog author="adam.majer@suse.de" date="1628769600">- update to 12.22.5:
  * CVE-2021-3672/CVE-2021-22931: Improper handling of untypical
    characters in domain names (bsc#1189370, bsc#1188881)
  * CVE-2021-22940: Use after free on close http2 on stream canceling
    (bsc#1189368)
  * CVE-2021-22939: Incomplete validation of rejectUnauthorized parameter
    (bsc#1189369)
- Fix-build-with-icu-69.patch: dropped, not for factory
- cares_public_headers.patch: don't use private headers</changelog>
  <changelog author="adam.majer@suse.de" date="1637928000">- update to 12.22.7:
  * deps: update llhttp to 2.1.4
  - HTTP Request Smuggling due to spaced in headers
    (bsc#1191601, CVE-2021-22959)
  - HTTP Request Smuggling when parsing the body
    (bsc#1191602, CVE-2021-22960)
- changes in 12.22.6:
  * deps: upgrade npm to 6.14.15 which fixes a number of
    security issues
    (bsc#1190057, CVE-2021-37701, bsc#1190056, CVE-2021-37712,
    bsc#1190055, CVE-2021-37713, bsc#1190054, CVE-2021-39134,
    bsc#1190053, CVE-2021-39135)
- versioned.patch: refreshed</changelog>
  <changelog author="adam.majer@suse.de" date="1641556800">- update to 12.22.8:
  * src: fix crash in AfterGetAddrInfo
  * deps: update c-ares to 1.18.1</changelog>
  <changelog author="adam.majer@suse.de" date="1641902400">- update to 12.22.9:
  Security update fixing the following issues:
  * Improper handling of URI Subject Alternative Names (Medium)
  (CVE-2021-44531, bsc#1194511)
  * Certificate Verification Bypass via String Injection (Medium)
  (CVE-2021-44532, bsc#1194512)
  * Incorrect handling of certificate subject and issuer fields (Medium)
  (CVE-2021-44533, bsc#1194513)
  * Prototype pollution via console.table properties (Low)
  (CVE-2022-21824, bsc#1194514)</changelog>
  <changelog author="adam.majer@suse.de" date="1645012800">- update to 12.22.10
  * Upgrade npm to 6.14.16
    + CVE-2021-23343 - ReDoS via splitDeviceRe, splitTailRe and
    splitPathRe (bsc#1192153)
    + CVE-2021-32803 - node-tar: Insufficient symlink protection
    allowing arbitrary file creation and overwrite (bsc#1191963)
    + CVE-2021-32804 - node-tar: Insufficient absolute path sanitization
    allowing arbitrary file creation and overwrite (bsc#1191962)
    + CVE-2021-3918 - json-schema is vulnerable to Improperly
    Controlled Modification of Object Prototype Attributes (bsc#1192696)
  * Updated ICU time zone data
- CVE-2021-3807.patch: node-ansi-regex: Regular expression
  denial of service (ReDoS) matching ANSI escape codes
  (bsc#1192154, CVE-2021-3807)
- versioned.patch: refreshed
- z15-test-skip.patch: dropped
- fix_ci_tests.patch: fix tests on z15</changelog>
</package>
<package pkgid="e2e2c4e246dcd45e3605339a3ad578be7239970e43198cdfc5a7b870016f7435" name="nscd" arch="aarch64">
  <version epoch="0" ver="2.31" rel="150300.9.12.1"/>
  <changelog author="schwab@suse.de" date="1583841600">- dl-sort-maps.patch, dlopen-filter-object.patch: Allow dlopen of filter
  object to work (bsc#1166106, BZ #16272)</changelog>
  <changelog author="schwab@suse.de" date="1585137600">- glob-use-after-free.patch: Fix use-after-free in glob when expanding
  ~user (CVE-2020-1752, bsc#1167631, BZ #25414)</changelog>
  <changelog author="schwab@suse.de" date="1589371200">- nptl-setxid-race.patch: nptl: wait for pending setxid request also in
  detached thread (bsc#1162930, BZ #25942)</changelog>
  <changelog author="schwab@suse.de" date="1593518400">- nscd-senfile.patch: Fix concurrent changes on nscd aware files
  (bsc#1171878, BZ #23178)
- nscd-prune.patch: nscd: bump GC cycle during cache pruning (bsc#1171878,
  BZ #26130)
- syslog-locking.patch: Correct locking and cancellation cleanup in syslog
  functions (bsc#1172085, BZ #26100)</changelog>
  <changelog author="schwab@suse.de" date="1599048000">- Update to glibc 2.31
- glibc-2.14-crypt.diff, crypt_blowfish-const.patch,
  crypt_blowfish-1.2-sha.diff, crypt_blowfish-gensalt.patch,
  crypt_blowfish-1.2-hack_around_arm.diff, glibc-nodate.patch,
  powerpc-elision-enable-envvar.patch, s390-elision-enable-envvar.patch,
  crt-nocompress-debug-sections.patch, resolv-context-leak.patch,
  dl-runtime-resolve-opt-avx512f.patch, libpthread-compat-wrappers.patch,
  math-c++-compat.patch, remove-nss-nis-compat.patch,
  eh-frame-zero-terminator.patch, ld-so-hwcap-x86-64.patch,
  assert-pedantic.patch, getaddrinfo-errno.patch, resolv-conf-oom.patch,
  dynarray-allocation.patch, nearbyint-inexact.patch, nss-compat.patch,
  nscd-libnsl.patch, malloc-tcache-leak.patch,
  falkor-memcpy-memmove.patch, aarch64-cpu-features.patch,
  nss-files-large-buffers.patch, sysconf-uio-maxiov.patch,
  glob-tilde-overflow.patch, dl-runtime-resolve-xsave.patch,
  spawni-assert.patch, x86-64-dl-platform.patch, glob64-s390.patch,
  tst-tlsopt-powerpc.patch, powerpc-hwcap-bits.patch,
  malloc-tcache-check-overflow.patch, dl-init-paths-overflow.patch,
  fillin-rpath-empty-tokens.patch, getcwd-absolute.patch,
  memalign-overflow.patch, stack-guard-size-accounting.patch,
  libgcc-rtld-now.patch, res-send-enomem.patch,
  glibc-fix-avx512-mempcpy.patch, i386-memmove-sse2-unaligned.patch,
  realpath-ssize-max-overflow.patch, localtime-2039.patch,
  math-remove-slow-path.patch, aarch64-hwcap-atomics.patch,
  glibc-fix-aarch64-build.diff, absolute-symbols.patch,
  x86-haswell-string-flags.patch,
  pthread-cond-broadcast-waiters-after-spinning.patch,
  mman-map-sync.patch, mman-linux-map-shared-validate.patch,
  nptl-setxid-error.patch, pthread-mutex-trylock-barrier.patch,
  getaddrinfo-parse-ipv4-address.patch, japanese-era-name-may-2019.patch,
  force-elision-race.patch, regex-read-overrun.patch,
  regex-parse-reg-exp.patch,
  0001-S390-Add-configure-check-to-detect-z10-as-mininum-ar.patch,
  0002-S390-Use-hwcap-instead-of-dl_hwcap-in-ifunc-resolver.patch,
  0003-S390-Unify-31-64bit-memcpy.patch,
  0004-S390-Refactor-memcpy-mempcpy-ifunc-handling.patch,
  0005-S390-Remove-s390-specific-implementation-of-bcopy.patch,
  0006-S390-Use-memcpy-for-forward-cases-in-memmove.patch,
  0007-S390-Add-configure-check-to-detect-z13-as-mininum-ar.patch,
  0008-S390-Add-z13-memmove-ifunc-variant.patch,
  0009-S390-Add-z13-strstr-ifunc-variant.patch,
  0010-S390-Add-z13-memmem-ifunc-variant.patch,
  0011-S390-Cleanup-ifunc-resolve.h.patch,
  0012-S390-Mark-vx-and-vxe-as-important-hwcap.patch,
  0013-S390-Add-new-hwcap-values-for-new-cpu-architecture-a.patch,
  0014-S390-Add-configure-check-to-detect-support-for-arch1.patch,
  0015-S390-Add-arch13-memmove-ifunc-variant.patch,
  0016-S390-Add-arch13-strstr-ifunc-variant.patch,
  0017-S390-Add-arch13-memmem-ifunc-variant.patch,
  prefer-map-32bit-exec.patch, s390-strstr-page-boundary.patch,
  ppc-tle-htm-nosc.patch,
  posix-Add-internal-symbols-for-posix_spawn-interface.patch,
  glibc-2.29-posix-Use-posix_spawn-on-popen.patch,
  backtrace-powerpc.patch, pthread-rwlock-pwn.patch,
  manual-memory-protection.patch, ldbl-96-rem-pio2l.patch,
  dl-sort-maps.patch, dlopen-filter-object.patch,
  glob-use-after-free.patch, nptl-setxid-race.patch, nscd-senfile.patch,
  ldd-system-interp.patch, abort-no-flush.patch,
  fnmatch-collating-elements.patch, nss-files-long-lines-2.patch,
  iconv-reset-input-buffer.patch, nscd-prune.patch, syslog-locking.patch:
  Removed.
- long-double-alias.patch, glibc-nsswitch-usr.diff, euc-kr-overrun.patch,
  riscv-syscall-clobber.patch, nscd-gc-cycle.patch: Added.</changelog>
  <changelog author="schwab@suse.de" date="1604923200">- power10-support.patch: Add support for POWER10 (jsc#SLE-13520)
- iconv-option-parsing.patch: Rewrite iconv option parsing
  (CVE-2016-10228, bsc#1027496, BZ #19519)</changelog>
  <changelog author="schwab@suse.de" date="1608120000">- aarch64-getauxval.patch: aarch64: Accept PLT calls to __getauxval within
  libc.so (bsc#1167939)
- iconv-redundant-shift.patch: iconv: Accept redundant shift sequences in
  IBM1364 (CVE-2020-27618, bsc#1178386, BZ #26224)
- iconv-ucs4-loop-bounds.patch: iconv: Fix incorrect UCS4 inner loop
  bounds (CVE-2020-29562, bsc#1179694, BZ #26923)
- printf-long-double-non-normal.patch: x86: Harden printf against
  non-normal long double values (CVE-2020-29573, bsc#1179721, BZ #26649)
- get-nprocs-cpu-online-parsing.patch: Fix parsing of
  /sys/devices/system/cpu/online (bsc#1180038, BZ #25859)</changelog>
  <changelog author="schwab@suse.de" date="1609848000">- sysvipc-sem-stat-any.patch: sysvipc: Fix SEM_STAT_ANY kernel argument
  pass (bsc#1180557, BZ #26637)</changelog>
  <changelog author="schwab@suse.de" date="1611835200">- gconv-assertion-iso-2022-jp.patch: gconv: Fix assertion failure in
  ISO-2022-JP-3 module (CVE-2021-3326, bsc#1181505, BZ #27256)</changelog>
  <changelog author="schwab@suse.de" date="1614772800">- nscd-netgroupcache.patch: nscd: Fix double free in netgroupcache
  (CVE-2021-27645, bsc#1182733, BZ #27462)</changelog>
  <changelog author="rguenther@suse.com" date="1615377600">- Add glibc-2.31-HTM-vzeroupper.diff to avoid VZEROUPPER in the
  AVX2 accelerated string routines which cause HTM transaction
  aborts.  Instead use EVEX or SSE.  (bsc#1181403)</changelog>
  <changelog author="rguenther@suse.com" date="1615377601">- Update glibc-2.31-HTM-vzeroupper.diff with a AVX-SSE transition
  fix.</changelog>
  <changelog author="schwab@suse.de" date="1617019200">- s390-memmove-ifunc-selector-arch13.patch: S390: Also check vector
  support in memmove ifunc-selector (bsc#1184035, BZ #27511)</changelog>
  <changelog author="schwab@suse.de" date="1625140800">- wordexp-param-overflow.patch: wordexp: handle overflow in positional
  parameter number (CVE-2021-35942, bsc#1187911, BZ #28011)</changelog>
  <changelog author="schwab@suse.de" date="1630584000">- mq-notify-use-after-free.patch: Use __pthread_attr_copy in mq_notify
  (CVE-2021-33574, bsc#1186489, BZ #27896)</changelog>
  <changelog author="schwab@suse.de" date="1636027200">- 0001-s390x-Align-child-stack-while-clone.-BZ-27968.patch,
  0002-S390-Optimize-__memcpy_z196.patch,
  0003-S390-Optimize-__memset_z196.patch,
  0004-S390-Sync-HWCAP-names-with-kernel-by-adding-aliases-.patch,
  0005-S390-Add-new-hwcap-values.patch,
  0006-S390-Add-PCI_MIO-and-SIE-HWCAPs.patch: [15sp4 FEAT] GNU2007 -
  GLIBC: Support for new IBM Z Hardware (bsc#1191592, jsc#IBM-869)</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1640174400">- Add support for livepatches (jsc#SLE-20049).
- Enable livepatching on x86_64.
- Generate ipa-clones tarball artifact when livepatching is enabled.</changelog>
  <changelog author="schwab@suse.de" date="1642420800">- clnt-create-unix-overflow.patch: Buffer overflow in sunrpc clnt_create
  for "unix" (CVE-2022-23219, bsc#1194768, BZ #22542)
- svcunix-create-overflow.patch: Buffer overflow in sunrpc svcunix_create
  (CVE-2022-23218, bsc#1194770, BZ #28768)</changelog>
  <changelog author="schwab@suse.de" date="1642593600">- 0001-powerpc-Optimized-strcpy-for-POWER9.patch,
  0002-powerpc-Optimized-stpcpy-for-POWER9.patch,
  0003-powerpc-Optimized-rawmemchr-for-POWER9.patch,
  0004-powerpc64le-add-optimized-strlen-for-P9.patch,
  0005-powerpc-fix-ifunc-implementation-list-for-POWER9-str.patch,
  0006-powerpc-Add-optimized-strncpy-for-POWER9.patch,
  0007-powerpc-Add-optimized-stpncpy-for-POWER9.patch,
  0008-powerpc-Add-optimized-ilogb-for-POWER9.patch,
  0009-powerpc-Add-optimized-llogb-for-POWER9.patch,
  0010-powerpc-Add-optimized-strlen-for-POWER10.patch,
  0011-powerpc64le-Optimized-memmove-for-POWER10.patch,
  0012-powerpc64le-Optimize-memcpy-for-POWER10.patch,
  0013-powerpc64le-Optimize-memset-for-POWER10.patch,
  0014-powerpc64le-Fix-ifunc-selection-for-memset-memmove-b.patch,
  0015-powerpc-Add-optimized-rawmemchr-for-POWER10.patch: ppc64le ifunc
  improvements (bsc#1194785, jsc#SLE-18195)</changelog>
  <changelog author="schwab@suse.de" date="1643025600">- getcwd-erange.patch: getcwd: Set errno to ERANGE for size == 1
  (CVE-2021-3999, bsc#1194640, BZ #28769)</changelog>
</package>
<package pkgid="51392645be880740b2636f228e5bbabaaab5435c24c5138c809023a7e4883ae7" name="nscd" arch="ppc64le">
  <version epoch="0" ver="2.31" rel="150300.9.12.1"/>
  <changelog author="schwab@suse.de" date="1583841600">- dl-sort-maps.patch, dlopen-filter-object.patch: Allow dlopen of filter
  object to work (bsc#1166106, BZ #16272)</changelog>
  <changelog author="schwab@suse.de" date="1585137600">- glob-use-after-free.patch: Fix use-after-free in glob when expanding
  ~user (CVE-2020-1752, bsc#1167631, BZ #25414)</changelog>
  <changelog author="schwab@suse.de" date="1589371200">- nptl-setxid-race.patch: nptl: wait for pending setxid request also in
  detached thread (bsc#1162930, BZ #25942)</changelog>
  <changelog author="schwab@suse.de" date="1593518400">- nscd-senfile.patch: Fix concurrent changes on nscd aware files
  (bsc#1171878, BZ #23178)
- nscd-prune.patch: nscd: bump GC cycle during cache pruning (bsc#1171878,
  BZ #26130)
- syslog-locking.patch: Correct locking and cancellation cleanup in syslog
  functions (bsc#1172085, BZ #26100)</changelog>
  <changelog author="schwab@suse.de" date="1599048000">- Update to glibc 2.31
- glibc-2.14-crypt.diff, crypt_blowfish-const.patch,
  crypt_blowfish-1.2-sha.diff, crypt_blowfish-gensalt.patch,
  crypt_blowfish-1.2-hack_around_arm.diff, glibc-nodate.patch,
  powerpc-elision-enable-envvar.patch, s390-elision-enable-envvar.patch,
  crt-nocompress-debug-sections.patch, resolv-context-leak.patch,
  dl-runtime-resolve-opt-avx512f.patch, libpthread-compat-wrappers.patch,
  math-c++-compat.patch, remove-nss-nis-compat.patch,
  eh-frame-zero-terminator.patch, ld-so-hwcap-x86-64.patch,
  assert-pedantic.patch, getaddrinfo-errno.patch, resolv-conf-oom.patch,
  dynarray-allocation.patch, nearbyint-inexact.patch, nss-compat.patch,
  nscd-libnsl.patch, malloc-tcache-leak.patch,
  falkor-memcpy-memmove.patch, aarch64-cpu-features.patch,
  nss-files-large-buffers.patch, sysconf-uio-maxiov.patch,
  glob-tilde-overflow.patch, dl-runtime-resolve-xsave.patch,
  spawni-assert.patch, x86-64-dl-platform.patch, glob64-s390.patch,
  tst-tlsopt-powerpc.patch, powerpc-hwcap-bits.patch,
  malloc-tcache-check-overflow.patch, dl-init-paths-overflow.patch,
  fillin-rpath-empty-tokens.patch, getcwd-absolute.patch,
  memalign-overflow.patch, stack-guard-size-accounting.patch,
  libgcc-rtld-now.patch, res-send-enomem.patch,
  glibc-fix-avx512-mempcpy.patch, i386-memmove-sse2-unaligned.patch,
  realpath-ssize-max-overflow.patch, localtime-2039.patch,
  math-remove-slow-path.patch, aarch64-hwcap-atomics.patch,
  glibc-fix-aarch64-build.diff, absolute-symbols.patch,
  x86-haswell-string-flags.patch,
  pthread-cond-broadcast-waiters-after-spinning.patch,
  mman-map-sync.patch, mman-linux-map-shared-validate.patch,
  nptl-setxid-error.patch, pthread-mutex-trylock-barrier.patch,
  getaddrinfo-parse-ipv4-address.patch, japanese-era-name-may-2019.patch,
  force-elision-race.patch, regex-read-overrun.patch,
  regex-parse-reg-exp.patch,
  0001-S390-Add-configure-check-to-detect-z10-as-mininum-ar.patch,
  0002-S390-Use-hwcap-instead-of-dl_hwcap-in-ifunc-resolver.patch,
  0003-S390-Unify-31-64bit-memcpy.patch,
  0004-S390-Refactor-memcpy-mempcpy-ifunc-handling.patch,
  0005-S390-Remove-s390-specific-implementation-of-bcopy.patch,
  0006-S390-Use-memcpy-for-forward-cases-in-memmove.patch,
  0007-S390-Add-configure-check-to-detect-z13-as-mininum-ar.patch,
  0008-S390-Add-z13-memmove-ifunc-variant.patch,
  0009-S390-Add-z13-strstr-ifunc-variant.patch,
  0010-S390-Add-z13-memmem-ifunc-variant.patch,
  0011-S390-Cleanup-ifunc-resolve.h.patch,
  0012-S390-Mark-vx-and-vxe-as-important-hwcap.patch,
  0013-S390-Add-new-hwcap-values-for-new-cpu-architecture-a.patch,
  0014-S390-Add-configure-check-to-detect-support-for-arch1.patch,
  0015-S390-Add-arch13-memmove-ifunc-variant.patch,
  0016-S390-Add-arch13-strstr-ifunc-variant.patch,
  0017-S390-Add-arch13-memmem-ifunc-variant.patch,
  prefer-map-32bit-exec.patch, s390-strstr-page-boundary.patch,
  ppc-tle-htm-nosc.patch,
  posix-Add-internal-symbols-for-posix_spawn-interface.patch,
  glibc-2.29-posix-Use-posix_spawn-on-popen.patch,
  backtrace-powerpc.patch, pthread-rwlock-pwn.patch,
  manual-memory-protection.patch, ldbl-96-rem-pio2l.patch,
  dl-sort-maps.patch, dlopen-filter-object.patch,
  glob-use-after-free.patch, nptl-setxid-race.patch, nscd-senfile.patch,
  ldd-system-interp.patch, abort-no-flush.patch,
  fnmatch-collating-elements.patch, nss-files-long-lines-2.patch,
  iconv-reset-input-buffer.patch, nscd-prune.patch, syslog-locking.patch:
  Removed.
- long-double-alias.patch, glibc-nsswitch-usr.diff, euc-kr-overrun.patch,
  riscv-syscall-clobber.patch, nscd-gc-cycle.patch: Added.</changelog>
  <changelog author="schwab@suse.de" date="1604923200">- power10-support.patch: Add support for POWER10 (jsc#SLE-13520)
- iconv-option-parsing.patch: Rewrite iconv option parsing
  (CVE-2016-10228, bsc#1027496, BZ #19519)</changelog>
  <changelog author="schwab@suse.de" date="1608120000">- aarch64-getauxval.patch: aarch64: Accept PLT calls to __getauxval within
  libc.so (bsc#1167939)
- iconv-redundant-shift.patch: iconv: Accept redundant shift sequences in
  IBM1364 (CVE-2020-27618, bsc#1178386, BZ #26224)
- iconv-ucs4-loop-bounds.patch: iconv: Fix incorrect UCS4 inner loop
  bounds (CVE-2020-29562, bsc#1179694, BZ #26923)
- printf-long-double-non-normal.patch: x86: Harden printf against
  non-normal long double values (CVE-2020-29573, bsc#1179721, BZ #26649)
- get-nprocs-cpu-online-parsing.patch: Fix parsing of
  /sys/devices/system/cpu/online (bsc#1180038, BZ #25859)</changelog>
  <changelog author="schwab@suse.de" date="1609848000">- sysvipc-sem-stat-any.patch: sysvipc: Fix SEM_STAT_ANY kernel argument
  pass (bsc#1180557, BZ #26637)</changelog>
  <changelog author="schwab@suse.de" date="1611835200">- gconv-assertion-iso-2022-jp.patch: gconv: Fix assertion failure in
  ISO-2022-JP-3 module (CVE-2021-3326, bsc#1181505, BZ #27256)</changelog>
  <changelog author="schwab@suse.de" date="1614772800">- nscd-netgroupcache.patch: nscd: Fix double free in netgroupcache
  (CVE-2021-27645, bsc#1182733, BZ #27462)</changelog>
  <changelog author="rguenther@suse.com" date="1615377600">- Add glibc-2.31-HTM-vzeroupper.diff to avoid VZEROUPPER in the
  AVX2 accelerated string routines which cause HTM transaction
  aborts.  Instead use EVEX or SSE.  (bsc#1181403)</changelog>
  <changelog author="rguenther@suse.com" date="1615377601">- Update glibc-2.31-HTM-vzeroupper.diff with a AVX-SSE transition
  fix.</changelog>
  <changelog author="schwab@suse.de" date="1617019200">- s390-memmove-ifunc-selector-arch13.patch: S390: Also check vector
  support in memmove ifunc-selector (bsc#1184035, BZ #27511)</changelog>
  <changelog author="schwab@suse.de" date="1625140800">- wordexp-param-overflow.patch: wordexp: handle overflow in positional
  parameter number (CVE-2021-35942, bsc#1187911, BZ #28011)</changelog>
  <changelog author="schwab@suse.de" date="1630584000">- mq-notify-use-after-free.patch: Use __pthread_attr_copy in mq_notify
  (CVE-2021-33574, bsc#1186489, BZ #27896)</changelog>
  <changelog author="schwab@suse.de" date="1636027200">- 0001-s390x-Align-child-stack-while-clone.-BZ-27968.patch,
  0002-S390-Optimize-__memcpy_z196.patch,
  0003-S390-Optimize-__memset_z196.patch,
  0004-S390-Sync-HWCAP-names-with-kernel-by-adding-aliases-.patch,
  0005-S390-Add-new-hwcap-values.patch,
  0006-S390-Add-PCI_MIO-and-SIE-HWCAPs.patch: [15sp4 FEAT] GNU2007 -
  GLIBC: Support for new IBM Z Hardware (bsc#1191592, jsc#IBM-869)</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1640174400">- Add support for livepatches (jsc#SLE-20049).
- Enable livepatching on x86_64.
- Generate ipa-clones tarball artifact when livepatching is enabled.</changelog>
  <changelog author="schwab@suse.de" date="1642420800">- clnt-create-unix-overflow.patch: Buffer overflow in sunrpc clnt_create
  for "unix" (CVE-2022-23219, bsc#1194768, BZ #22542)
- svcunix-create-overflow.patch: Buffer overflow in sunrpc svcunix_create
  (CVE-2022-23218, bsc#1194770, BZ #28768)</changelog>
  <changelog author="schwab@suse.de" date="1642593600">- 0001-powerpc-Optimized-strcpy-for-POWER9.patch,
  0002-powerpc-Optimized-stpcpy-for-POWER9.patch,
  0003-powerpc-Optimized-rawmemchr-for-POWER9.patch,
  0004-powerpc64le-add-optimized-strlen-for-P9.patch,
  0005-powerpc-fix-ifunc-implementation-list-for-POWER9-str.patch,
  0006-powerpc-Add-optimized-strncpy-for-POWER9.patch,
  0007-powerpc-Add-optimized-stpncpy-for-POWER9.patch,
  0008-powerpc-Add-optimized-ilogb-for-POWER9.patch,
  0009-powerpc-Add-optimized-llogb-for-POWER9.patch,
  0010-powerpc-Add-optimized-strlen-for-POWER10.patch,
  0011-powerpc64le-Optimized-memmove-for-POWER10.patch,
  0012-powerpc64le-Optimize-memcpy-for-POWER10.patch,
  0013-powerpc64le-Optimize-memset-for-POWER10.patch,
  0014-powerpc64le-Fix-ifunc-selection-for-memset-memmove-b.patch,
  0015-powerpc-Add-optimized-rawmemchr-for-POWER10.patch: ppc64le ifunc
  improvements (bsc#1194785, jsc#SLE-18195)</changelog>
  <changelog author="schwab@suse.de" date="1643025600">- getcwd-erange.patch: getcwd: Set errno to ERANGE for size == 1
  (CVE-2021-3999, bsc#1194640, BZ #28769)</changelog>
</package>
<package pkgid="22918fcb245d22493bbfe0ad8dbb4ed00a801f32fba2e0bf26946d8e9086c42f" name="nscd" arch="s390x">
  <version epoch="0" ver="2.31" rel="150300.9.12.1"/>
  <changelog author="schwab@suse.de" date="1583841600">- dl-sort-maps.patch, dlopen-filter-object.patch: Allow dlopen of filter
  object to work (bsc#1166106, BZ #16272)</changelog>
  <changelog author="schwab@suse.de" date="1585137600">- glob-use-after-free.patch: Fix use-after-free in glob when expanding
  ~user (CVE-2020-1752, bsc#1167631, BZ #25414)</changelog>
  <changelog author="schwab@suse.de" date="1589371200">- nptl-setxid-race.patch: nptl: wait for pending setxid request also in
  detached thread (bsc#1162930, BZ #25942)</changelog>
  <changelog author="schwab@suse.de" date="1593518400">- nscd-senfile.patch: Fix concurrent changes on nscd aware files
  (bsc#1171878, BZ #23178)
- nscd-prune.patch: nscd: bump GC cycle during cache pruning (bsc#1171878,
  BZ #26130)
- syslog-locking.patch: Correct locking and cancellation cleanup in syslog
  functions (bsc#1172085, BZ #26100)</changelog>
  <changelog author="schwab@suse.de" date="1599048000">- Update to glibc 2.31
- glibc-2.14-crypt.diff, crypt_blowfish-const.patch,
  crypt_blowfish-1.2-sha.diff, crypt_blowfish-gensalt.patch,
  crypt_blowfish-1.2-hack_around_arm.diff, glibc-nodate.patch,
  powerpc-elision-enable-envvar.patch, s390-elision-enable-envvar.patch,
  crt-nocompress-debug-sections.patch, resolv-context-leak.patch,
  dl-runtime-resolve-opt-avx512f.patch, libpthread-compat-wrappers.patch,
  math-c++-compat.patch, remove-nss-nis-compat.patch,
  eh-frame-zero-terminator.patch, ld-so-hwcap-x86-64.patch,
  assert-pedantic.patch, getaddrinfo-errno.patch, resolv-conf-oom.patch,
  dynarray-allocation.patch, nearbyint-inexact.patch, nss-compat.patch,
  nscd-libnsl.patch, malloc-tcache-leak.patch,
  falkor-memcpy-memmove.patch, aarch64-cpu-features.patch,
  nss-files-large-buffers.patch, sysconf-uio-maxiov.patch,
  glob-tilde-overflow.patch, dl-runtime-resolve-xsave.patch,
  spawni-assert.patch, x86-64-dl-platform.patch, glob64-s390.patch,
  tst-tlsopt-powerpc.patch, powerpc-hwcap-bits.patch,
  malloc-tcache-check-overflow.patch, dl-init-paths-overflow.patch,
  fillin-rpath-empty-tokens.patch, getcwd-absolute.patch,
  memalign-overflow.patch, stack-guard-size-accounting.patch,
  libgcc-rtld-now.patch, res-send-enomem.patch,
  glibc-fix-avx512-mempcpy.patch, i386-memmove-sse2-unaligned.patch,
  realpath-ssize-max-overflow.patch, localtime-2039.patch,
  math-remove-slow-path.patch, aarch64-hwcap-atomics.patch,
  glibc-fix-aarch64-build.diff, absolute-symbols.patch,
  x86-haswell-string-flags.patch,
  pthread-cond-broadcast-waiters-after-spinning.patch,
  mman-map-sync.patch, mman-linux-map-shared-validate.patch,
  nptl-setxid-error.patch, pthread-mutex-trylock-barrier.patch,
  getaddrinfo-parse-ipv4-address.patch, japanese-era-name-may-2019.patch,
  force-elision-race.patch, regex-read-overrun.patch,
  regex-parse-reg-exp.patch,
  0001-S390-Add-configure-check-to-detect-z10-as-mininum-ar.patch,
  0002-S390-Use-hwcap-instead-of-dl_hwcap-in-ifunc-resolver.patch,
  0003-S390-Unify-31-64bit-memcpy.patch,
  0004-S390-Refactor-memcpy-mempcpy-ifunc-handling.patch,
  0005-S390-Remove-s390-specific-implementation-of-bcopy.patch,
  0006-S390-Use-memcpy-for-forward-cases-in-memmove.patch,
  0007-S390-Add-configure-check-to-detect-z13-as-mininum-ar.patch,
  0008-S390-Add-z13-memmove-ifunc-variant.patch,
  0009-S390-Add-z13-strstr-ifunc-variant.patch,
  0010-S390-Add-z13-memmem-ifunc-variant.patch,
  0011-S390-Cleanup-ifunc-resolve.h.patch,
  0012-S390-Mark-vx-and-vxe-as-important-hwcap.patch,
  0013-S390-Add-new-hwcap-values-for-new-cpu-architecture-a.patch,
  0014-S390-Add-configure-check-to-detect-support-for-arch1.patch,
  0015-S390-Add-arch13-memmove-ifunc-variant.patch,
  0016-S390-Add-arch13-strstr-ifunc-variant.patch,
  0017-S390-Add-arch13-memmem-ifunc-variant.patch,
  prefer-map-32bit-exec.patch, s390-strstr-page-boundary.patch,
  ppc-tle-htm-nosc.patch,
  posix-Add-internal-symbols-for-posix_spawn-interface.patch,
  glibc-2.29-posix-Use-posix_spawn-on-popen.patch,
  backtrace-powerpc.patch, pthread-rwlock-pwn.patch,
  manual-memory-protection.patch, ldbl-96-rem-pio2l.patch,
  dl-sort-maps.patch, dlopen-filter-object.patch,
  glob-use-after-free.patch, nptl-setxid-race.patch, nscd-senfile.patch,
  ldd-system-interp.patch, abort-no-flush.patch,
  fnmatch-collating-elements.patch, nss-files-long-lines-2.patch,
  iconv-reset-input-buffer.patch, nscd-prune.patch, syslog-locking.patch:
  Removed.
- long-double-alias.patch, glibc-nsswitch-usr.diff, euc-kr-overrun.patch,
  riscv-syscall-clobber.patch, nscd-gc-cycle.patch: Added.</changelog>
  <changelog author="schwab@suse.de" date="1604923200">- power10-support.patch: Add support for POWER10 (jsc#SLE-13520)
- iconv-option-parsing.patch: Rewrite iconv option parsing
  (CVE-2016-10228, bsc#1027496, BZ #19519)</changelog>
  <changelog author="schwab@suse.de" date="1608120000">- aarch64-getauxval.patch: aarch64: Accept PLT calls to __getauxval within
  libc.so (bsc#1167939)
- iconv-redundant-shift.patch: iconv: Accept redundant shift sequences in
  IBM1364 (CVE-2020-27618, bsc#1178386, BZ #26224)
- iconv-ucs4-loop-bounds.patch: iconv: Fix incorrect UCS4 inner loop
  bounds (CVE-2020-29562, bsc#1179694, BZ #26923)
- printf-long-double-non-normal.patch: x86: Harden printf against
  non-normal long double values (CVE-2020-29573, bsc#1179721, BZ #26649)
- get-nprocs-cpu-online-parsing.patch: Fix parsing of
  /sys/devices/system/cpu/online (bsc#1180038, BZ #25859)</changelog>
  <changelog author="schwab@suse.de" date="1609848000">- sysvipc-sem-stat-any.patch: sysvipc: Fix SEM_STAT_ANY kernel argument
  pass (bsc#1180557, BZ #26637)</changelog>
  <changelog author="schwab@suse.de" date="1611835200">- gconv-assertion-iso-2022-jp.patch: gconv: Fix assertion failure in
  ISO-2022-JP-3 module (CVE-2021-3326, bsc#1181505, BZ #27256)</changelog>
  <changelog author="schwab@suse.de" date="1614772800">- nscd-netgroupcache.patch: nscd: Fix double free in netgroupcache
  (CVE-2021-27645, bsc#1182733, BZ #27462)</changelog>
  <changelog author="rguenther@suse.com" date="1615377600">- Add glibc-2.31-HTM-vzeroupper.diff to avoid VZEROUPPER in the
  AVX2 accelerated string routines which cause HTM transaction
  aborts.  Instead use EVEX or SSE.  (bsc#1181403)</changelog>
  <changelog author="rguenther@suse.com" date="1615377601">- Update glibc-2.31-HTM-vzeroupper.diff with a AVX-SSE transition
  fix.</changelog>
  <changelog author="schwab@suse.de" date="1617019200">- s390-memmove-ifunc-selector-arch13.patch: S390: Also check vector
  support in memmove ifunc-selector (bsc#1184035, BZ #27511)</changelog>
  <changelog author="schwab@suse.de" date="1625140800">- wordexp-param-overflow.patch: wordexp: handle overflow in positional
  parameter number (CVE-2021-35942, bsc#1187911, BZ #28011)</changelog>
  <changelog author="schwab@suse.de" date="1630584000">- mq-notify-use-after-free.patch: Use __pthread_attr_copy in mq_notify
  (CVE-2021-33574, bsc#1186489, BZ #27896)</changelog>
  <changelog author="schwab@suse.de" date="1636027200">- 0001-s390x-Align-child-stack-while-clone.-BZ-27968.patch,
  0002-S390-Optimize-__memcpy_z196.patch,
  0003-S390-Optimize-__memset_z196.patch,
  0004-S390-Sync-HWCAP-names-with-kernel-by-adding-aliases-.patch,
  0005-S390-Add-new-hwcap-values.patch,
  0006-S390-Add-PCI_MIO-and-SIE-HWCAPs.patch: [15sp4 FEAT] GNU2007 -
  GLIBC: Support for new IBM Z Hardware (bsc#1191592, jsc#IBM-869)</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1640174400">- Add support for livepatches (jsc#SLE-20049).
- Enable livepatching on x86_64.
- Generate ipa-clones tarball artifact when livepatching is enabled.</changelog>
  <changelog author="schwab@suse.de" date="1642420800">- clnt-create-unix-overflow.patch: Buffer overflow in sunrpc clnt_create
  for "unix" (CVE-2022-23219, bsc#1194768, BZ #22542)
- svcunix-create-overflow.patch: Buffer overflow in sunrpc svcunix_create
  (CVE-2022-23218, bsc#1194770, BZ #28768)</changelog>
  <changelog author="schwab@suse.de" date="1642593600">- 0001-powerpc-Optimized-strcpy-for-POWER9.patch,
  0002-powerpc-Optimized-stpcpy-for-POWER9.patch,
  0003-powerpc-Optimized-rawmemchr-for-POWER9.patch,
  0004-powerpc64le-add-optimized-strlen-for-P9.patch,
  0005-powerpc-fix-ifunc-implementation-list-for-POWER9-str.patch,
  0006-powerpc-Add-optimized-strncpy-for-POWER9.patch,
  0007-powerpc-Add-optimized-stpncpy-for-POWER9.patch,
  0008-powerpc-Add-optimized-ilogb-for-POWER9.patch,
  0009-powerpc-Add-optimized-llogb-for-POWER9.patch,
  0010-powerpc-Add-optimized-strlen-for-POWER10.patch,
  0011-powerpc64le-Optimized-memmove-for-POWER10.patch,
  0012-powerpc64le-Optimize-memcpy-for-POWER10.patch,
  0013-powerpc64le-Optimize-memset-for-POWER10.patch,
  0014-powerpc64le-Fix-ifunc-selection-for-memset-memmove-b.patch,
  0015-powerpc-Add-optimized-rawmemchr-for-POWER10.patch: ppc64le ifunc
  improvements (bsc#1194785, jsc#SLE-18195)</changelog>
  <changelog author="schwab@suse.de" date="1643025600">- getcwd-erange.patch: getcwd: Set errno to ERANGE for size == 1
  (CVE-2021-3999, bsc#1194640, BZ #28769)</changelog>
</package>
<package pkgid="5b3368aeaa2ea8360db09be11aa3f8866b69c19dfdc27bb5f1637dee7325815f" name="nscd" arch="x86_64">
  <version epoch="0" ver="2.31" rel="150300.9.12.1"/>
  <changelog author="schwab@suse.de" date="1583841600">- dl-sort-maps.patch, dlopen-filter-object.patch: Allow dlopen of filter
  object to work (bsc#1166106, BZ #16272)</changelog>
  <changelog author="schwab@suse.de" date="1585137600">- glob-use-after-free.patch: Fix use-after-free in glob when expanding
  ~user (CVE-2020-1752, bsc#1167631, BZ #25414)</changelog>
  <changelog author="schwab@suse.de" date="1589371200">- nptl-setxid-race.patch: nptl: wait for pending setxid request also in
  detached thread (bsc#1162930, BZ #25942)</changelog>
  <changelog author="schwab@suse.de" date="1593518400">- nscd-senfile.patch: Fix concurrent changes on nscd aware files
  (bsc#1171878, BZ #23178)
- nscd-prune.patch: nscd: bump GC cycle during cache pruning (bsc#1171878,
  BZ #26130)
- syslog-locking.patch: Correct locking and cancellation cleanup in syslog
  functions (bsc#1172085, BZ #26100)</changelog>
  <changelog author="schwab@suse.de" date="1599048000">- Update to glibc 2.31
- glibc-2.14-crypt.diff, crypt_blowfish-const.patch,
  crypt_blowfish-1.2-sha.diff, crypt_blowfish-gensalt.patch,
  crypt_blowfish-1.2-hack_around_arm.diff, glibc-nodate.patch,
  powerpc-elision-enable-envvar.patch, s390-elision-enable-envvar.patch,
  crt-nocompress-debug-sections.patch, resolv-context-leak.patch,
  dl-runtime-resolve-opt-avx512f.patch, libpthread-compat-wrappers.patch,
  math-c++-compat.patch, remove-nss-nis-compat.patch,
  eh-frame-zero-terminator.patch, ld-so-hwcap-x86-64.patch,
  assert-pedantic.patch, getaddrinfo-errno.patch, resolv-conf-oom.patch,
  dynarray-allocation.patch, nearbyint-inexact.patch, nss-compat.patch,
  nscd-libnsl.patch, malloc-tcache-leak.patch,
  falkor-memcpy-memmove.patch, aarch64-cpu-features.patch,
  nss-files-large-buffers.patch, sysconf-uio-maxiov.patch,
  glob-tilde-overflow.patch, dl-runtime-resolve-xsave.patch,
  spawni-assert.patch, x86-64-dl-platform.patch, glob64-s390.patch,
  tst-tlsopt-powerpc.patch, powerpc-hwcap-bits.patch,
  malloc-tcache-check-overflow.patch, dl-init-paths-overflow.patch,
  fillin-rpath-empty-tokens.patch, getcwd-absolute.patch,
  memalign-overflow.patch, stack-guard-size-accounting.patch,
  libgcc-rtld-now.patch, res-send-enomem.patch,
  glibc-fix-avx512-mempcpy.patch, i386-memmove-sse2-unaligned.patch,
  realpath-ssize-max-overflow.patch, localtime-2039.patch,
  math-remove-slow-path.patch, aarch64-hwcap-atomics.patch,
  glibc-fix-aarch64-build.diff, absolute-symbols.patch,
  x86-haswell-string-flags.patch,
  pthread-cond-broadcast-waiters-after-spinning.patch,
  mman-map-sync.patch, mman-linux-map-shared-validate.patch,
  nptl-setxid-error.patch, pthread-mutex-trylock-barrier.patch,
  getaddrinfo-parse-ipv4-address.patch, japanese-era-name-may-2019.patch,
  force-elision-race.patch, regex-read-overrun.patch,
  regex-parse-reg-exp.patch,
  0001-S390-Add-configure-check-to-detect-z10-as-mininum-ar.patch,
  0002-S390-Use-hwcap-instead-of-dl_hwcap-in-ifunc-resolver.patch,
  0003-S390-Unify-31-64bit-memcpy.patch,
  0004-S390-Refactor-memcpy-mempcpy-ifunc-handling.patch,
  0005-S390-Remove-s390-specific-implementation-of-bcopy.patch,
  0006-S390-Use-memcpy-for-forward-cases-in-memmove.patch,
  0007-S390-Add-configure-check-to-detect-z13-as-mininum-ar.patch,
  0008-S390-Add-z13-memmove-ifunc-variant.patch,
  0009-S390-Add-z13-strstr-ifunc-variant.patch,
  0010-S390-Add-z13-memmem-ifunc-variant.patch,
  0011-S390-Cleanup-ifunc-resolve.h.patch,
  0012-S390-Mark-vx-and-vxe-as-important-hwcap.patch,
  0013-S390-Add-new-hwcap-values-for-new-cpu-architecture-a.patch,
  0014-S390-Add-configure-check-to-detect-support-for-arch1.patch,
  0015-S390-Add-arch13-memmove-ifunc-variant.patch,
  0016-S390-Add-arch13-strstr-ifunc-variant.patch,
  0017-S390-Add-arch13-memmem-ifunc-variant.patch,
  prefer-map-32bit-exec.patch, s390-strstr-page-boundary.patch,
  ppc-tle-htm-nosc.patch,
  posix-Add-internal-symbols-for-posix_spawn-interface.patch,
  glibc-2.29-posix-Use-posix_spawn-on-popen.patch,
  backtrace-powerpc.patch, pthread-rwlock-pwn.patch,
  manual-memory-protection.patch, ldbl-96-rem-pio2l.patch,
  dl-sort-maps.patch, dlopen-filter-object.patch,
  glob-use-after-free.patch, nptl-setxid-race.patch, nscd-senfile.patch,
  ldd-system-interp.patch, abort-no-flush.patch,
  fnmatch-collating-elements.patch, nss-files-long-lines-2.patch,
  iconv-reset-input-buffer.patch, nscd-prune.patch, syslog-locking.patch:
  Removed.
- long-double-alias.patch, glibc-nsswitch-usr.diff, euc-kr-overrun.patch,
  riscv-syscall-clobber.patch, nscd-gc-cycle.patch: Added.</changelog>
  <changelog author="schwab@suse.de" date="1604923200">- power10-support.patch: Add support for POWER10 (jsc#SLE-13520)
- iconv-option-parsing.patch: Rewrite iconv option parsing
  (CVE-2016-10228, bsc#1027496, BZ #19519)</changelog>
  <changelog author="schwab@suse.de" date="1608120000">- aarch64-getauxval.patch: aarch64: Accept PLT calls to __getauxval within
  libc.so (bsc#1167939)
- iconv-redundant-shift.patch: iconv: Accept redundant shift sequences in
  IBM1364 (CVE-2020-27618, bsc#1178386, BZ #26224)
- iconv-ucs4-loop-bounds.patch: iconv: Fix incorrect UCS4 inner loop
  bounds (CVE-2020-29562, bsc#1179694, BZ #26923)
- printf-long-double-non-normal.patch: x86: Harden printf against
  non-normal long double values (CVE-2020-29573, bsc#1179721, BZ #26649)
- get-nprocs-cpu-online-parsing.patch: Fix parsing of
  /sys/devices/system/cpu/online (bsc#1180038, BZ #25859)</changelog>
  <changelog author="schwab@suse.de" date="1609848000">- sysvipc-sem-stat-any.patch: sysvipc: Fix SEM_STAT_ANY kernel argument
  pass (bsc#1180557, BZ #26637)</changelog>
  <changelog author="schwab@suse.de" date="1611835200">- gconv-assertion-iso-2022-jp.patch: gconv: Fix assertion failure in
  ISO-2022-JP-3 module (CVE-2021-3326, bsc#1181505, BZ #27256)</changelog>
  <changelog author="schwab@suse.de" date="1614772800">- nscd-netgroupcache.patch: nscd: Fix double free in netgroupcache
  (CVE-2021-27645, bsc#1182733, BZ #27462)</changelog>
  <changelog author="rguenther@suse.com" date="1615377600">- Add glibc-2.31-HTM-vzeroupper.diff to avoid VZEROUPPER in the
  AVX2 accelerated string routines which cause HTM transaction
  aborts.  Instead use EVEX or SSE.  (bsc#1181403)</changelog>
  <changelog author="rguenther@suse.com" date="1615377601">- Update glibc-2.31-HTM-vzeroupper.diff with a AVX-SSE transition
  fix.</changelog>
  <changelog author="schwab@suse.de" date="1617019200">- s390-memmove-ifunc-selector-arch13.patch: S390: Also check vector
  support in memmove ifunc-selector (bsc#1184035, BZ #27511)</changelog>
  <changelog author="schwab@suse.de" date="1625140800">- wordexp-param-overflow.patch: wordexp: handle overflow in positional
  parameter number (CVE-2021-35942, bsc#1187911, BZ #28011)</changelog>
  <changelog author="schwab@suse.de" date="1630584000">- mq-notify-use-after-free.patch: Use __pthread_attr_copy in mq_notify
  (CVE-2021-33574, bsc#1186489, BZ #27896)</changelog>
  <changelog author="schwab@suse.de" date="1636027200">- 0001-s390x-Align-child-stack-while-clone.-BZ-27968.patch,
  0002-S390-Optimize-__memcpy_z196.patch,
  0003-S390-Optimize-__memset_z196.patch,
  0004-S390-Sync-HWCAP-names-with-kernel-by-adding-aliases-.patch,
  0005-S390-Add-new-hwcap-values.patch,
  0006-S390-Add-PCI_MIO-and-SIE-HWCAPs.patch: [15sp4 FEAT] GNU2007 -
  GLIBC: Support for new IBM Z Hardware (bsc#1191592, jsc#IBM-869)</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1640174400">- Add support for livepatches (jsc#SLE-20049).
- Enable livepatching on x86_64.
- Generate ipa-clones tarball artifact when livepatching is enabled.</changelog>
  <changelog author="schwab@suse.de" date="1642420800">- clnt-create-unix-overflow.patch: Buffer overflow in sunrpc clnt_create
  for "unix" (CVE-2022-23219, bsc#1194768, BZ #22542)
- svcunix-create-overflow.patch: Buffer overflow in sunrpc svcunix_create
  (CVE-2022-23218, bsc#1194770, BZ #28768)</changelog>
  <changelog author="schwab@suse.de" date="1642593600">- 0001-powerpc-Optimized-strcpy-for-POWER9.patch,
  0002-powerpc-Optimized-stpcpy-for-POWER9.patch,
  0003-powerpc-Optimized-rawmemchr-for-POWER9.patch,
  0004-powerpc64le-add-optimized-strlen-for-P9.patch,
  0005-powerpc-fix-ifunc-implementation-list-for-POWER9-str.patch,
  0006-powerpc-Add-optimized-strncpy-for-POWER9.patch,
  0007-powerpc-Add-optimized-stpncpy-for-POWER9.patch,
  0008-powerpc-Add-optimized-ilogb-for-POWER9.patch,
  0009-powerpc-Add-optimized-llogb-for-POWER9.patch,
  0010-powerpc-Add-optimized-strlen-for-POWER10.patch,
  0011-powerpc64le-Optimized-memmove-for-POWER10.patch,
  0012-powerpc64le-Optimize-memcpy-for-POWER10.patch,
  0013-powerpc64le-Optimize-memset-for-POWER10.patch,
  0014-powerpc64le-Fix-ifunc-selection-for-memset-memmove-b.patch,
  0015-powerpc-Add-optimized-rawmemchr-for-POWER10.patch: ppc64le ifunc
  improvements (bsc#1194785, jsc#SLE-18195)</changelog>
  <changelog author="schwab@suse.de" date="1643025600">- getcwd-erange.patch: getcwd: Set errno to ERANGE for size == 1
  (CVE-2021-3999, bsc#1194640, BZ #28769)</changelog>
</package>
<package pkgid="eec5a0a02b49ab89ede3f0491d3759fb0d03a2be2eb362212255fbdf5f5c51c4" name="obs-service-kiwi_metainfo_helper" arch="noarch">
  <version epoch="0" ver="0.5" rel="1.15.1"/>
  <changelog author="fvogt@suse.com" date="1539777600">- Initial commit (fate#326856, bsc#1118103)</changelog>
  <changelog author="fvogt@suse.com" date="1547121600">- Remove spurious parameter to %setup -T
- Mention that it's a service in the summary</changelog>
  <changelog author="fvogt@suse.com" date="1547121601">- Add %OS_VERSION_ID(_SP)% and %PRETTY_NAME% (boo#1119378)</changelog>
  <changelog author="fvogt@suse.com" date="1588593600">- Strip service prefix from the recipe name to work with enabled
  services in OBS</changelog>
  <changelog author="fvogt@suse.com" date="1588680000">- Also allow working on Dockerfile (jsc#CAPS-10)</changelog>
  <changelog author="fvogt@suse.com" date="1594123200">- Add explicit fallback for chroot builds
- Refactor into a single sed call</changelog>
  <changelog author="snica@suse.com" date="1598356800">- Also allow working on Chart.yaml (jsc#CAPS-5)</changelog>
  <changelog author="fvogt@suse.com" date="1598529600">- Fix grammar, update README and .service. Technically the name
  should be changed as well, but that's just cosmetic.</changelog>
  <changelog author="fvogt@suse.com" date="1598961600">- Use a boolean dep to avoid use of %{is_opensuse}. The prjconf
  selects which one to use this way.
- Bump version to 0.1</changelog>
  <changelog author="fvogt@suse.com" date="1611748800">- Read os-release from the to be installed RPMs. This avoids pulling
  in distribution-release when not necessary (boo#1180263)
- Bump version to 0.2</changelog>
  <changelog author="fvogt@suse.com" date="1612180800">- Don't enable pipefail: rpm got SIGPIPE because grep -q exits early
  and closes the other end, which made the whole expression fail</changelog>
  <changelog author="jkowalczyk@suse.com" date="1622635200">- Provide various modified spellings of PRETTY_NAME useful for
  writing KIWI image definitions with reduced diff between SLE,
  Leap and Tumbleweed. DASHED satisfies the requirement that kiwi
  image names must not have spaces. The BEFORE_PAREN variations
  drop the release label in parentheses (SLE only) and can be used
  as a stable name for image registries and WSL app store
  submissions.
  * VENDOR
  * PRETTY_NAME_DASHED
  * PRETTY_NAME_BEFORE_PAREN
  * PRETTY_NAME_BEFORE_PAREN_DASHED
  (Needed for jsc#SLE-12986)
- Update README and service definition XML to reflect all variables
- Bump version to 0.3</changelog>
  <changelog author="fcrozat@suse.com" date="1642075200">- Generate SOURCEURL based on DISTURL.
- Bump version to 0.4</changelog>
  <changelog author="fvogt@suse.com" date="1642420800">- Add test suite (test.sh, sles-release-15.4-150400.32.2.x86_64.rpm)
- Fix SOURCEURL for multibuild DISTURLs
- Set SOURCEURL also in chroot builds</changelog>
  <changelog author="fcrozat@suse.com" date="1643025600">- Generate OS_VERSION based on os-release VERSION (bsc#1195061).
- Bump version to 0.5</changelog>
</package>
<package pkgid="f64a9f1f5cade53b4c350e515ba174fc373352949f213c3bccc207cc8bb1cacc" name="obs-service-kiwi_metainfo_helper" arch="src">
  <version epoch="0" ver="0.5" rel="1.15.1"/>
  <changelog author="fvogt@suse.com" date="1539777600">- Initial commit (fate#326856, bsc#1118103)</changelog>
  <changelog author="fvogt@suse.com" date="1547121600">- Remove spurious parameter to %setup -T
- Mention that it's a service in the summary</changelog>
  <changelog author="fvogt@suse.com" date="1547121601">- Add %OS_VERSION_ID(_SP)% and %PRETTY_NAME% (boo#1119378)</changelog>
  <changelog author="fvogt@suse.com" date="1588593600">- Strip service prefix from the recipe name to work with enabled
  services in OBS</changelog>
  <changelog author="fvogt@suse.com" date="1588680000">- Also allow working on Dockerfile (jsc#CAPS-10)</changelog>
  <changelog author="fvogt@suse.com" date="1594123200">- Add explicit fallback for chroot builds
- Refactor into a single sed call</changelog>
  <changelog author="snica@suse.com" date="1598356800">- Also allow working on Chart.yaml (jsc#CAPS-5)</changelog>
  <changelog author="fvogt@suse.com" date="1598529600">- Fix grammar, update README and .service. Technically the name
  should be changed as well, but that's just cosmetic.</changelog>
  <changelog author="fvogt@suse.com" date="1598961600">- Use a boolean dep to avoid use of %{is_opensuse}. The prjconf
  selects which one to use this way.
- Bump version to 0.1</changelog>
  <changelog author="fvogt@suse.com" date="1611748800">- Read os-release from the to be installed RPMs. This avoids pulling
  in distribution-release when not necessary (boo#1180263)
- Bump version to 0.2</changelog>
  <changelog author="fvogt@suse.com" date="1612180800">- Don't enable pipefail: rpm got SIGPIPE because grep -q exits early
  and closes the other end, which made the whole expression fail</changelog>
  <changelog author="jkowalczyk@suse.com" date="1622635200">- Provide various modified spellings of PRETTY_NAME useful for
  writing KIWI image definitions with reduced diff between SLE,
  Leap and Tumbleweed. DASHED satisfies the requirement that kiwi
  image names must not have spaces. The BEFORE_PAREN variations
  drop the release label in parentheses (SLE only) and can be used
  as a stable name for image registries and WSL app store
  submissions.
  * VENDOR
  * PRETTY_NAME_DASHED
  * PRETTY_NAME_BEFORE_PAREN
  * PRETTY_NAME_BEFORE_PAREN_DASHED
  (Needed for jsc#SLE-12986)
- Update README and service definition XML to reflect all variables
- Bump version to 0.3</changelog>
  <changelog author="fcrozat@suse.com" date="1642075200">- Generate SOURCEURL based on DISTURL.
- Bump version to 0.4</changelog>
  <changelog author="fvogt@suse.com" date="1642420800">- Add test suite (test.sh, sles-release-15.4-150400.32.2.x86_64.rpm)
- Fix SOURCEURL for multibuild DISTURLs
- Set SOURCEURL also in chroot builds</changelog>
  <changelog author="fcrozat@suse.com" date="1643025600">- Generate OS_VERSION based on os-release VERSION (bsc#1195061).
- Bump version to 0.5</changelog>
</package>
<package pkgid="f5c8114c1daca377c8e2865d08d677d954b37d4334df0bf20db1db90504062f2" name="ocfs2-kmp-preempt" arch="x86_64">
  <version epoch="0" ver="5.3.18" rel="150300.59.43.1"/>
  <changelog author="tiwai@suse.de" date="1642593600">- Add cherry-picked IDs for qemu fw_cfg patches
- commit 8f947ad</changelog>
  <changelog author="msuchanek@suse.de" date="1642593601">- powerpc/pseries/cpuhp: delete add/remove_by_count code
  (bsc#1065729).
- powerpc/pseries/cpuhp: cache node corrections (bsc#1065729).
- commit 9c04898</changelog>
  <changelog author="tiwai@suse.de" date="1642593602">- dmaengine: at_xdmac: Fix at_xdmac_lld struct definition
  (git-fixes).
- dmaengine: at_xdmac: Fix lld view setting (git-fixes).
- dmaengine: at_xdmac: Fix concurrency over xfers_list
  (git-fixes).
- dmaengine: at_xdmac: Print debug message after realeasing the
  lock (git-fixes).
- dmaengine: at_xdmac: Don't start transactions at tx_submit level
  (git-fixes).
- Documentation: dmaengine: Correctly describe dmatest with
  channel unset (git-fixes).
- rpmsg: core: Clean up resources on announce_create failure
  (git-fixes).
- ACPI: APD: Check for NULL pointer after calling devm_ioremap()
  (git-fixes).
- Input: ti_am335x_tsc - fix STEPCONFIG setup for Z2 (git-fixes).
- Input: ti_am335x_tsc - set ADCREFM for X configuration
  (git-fixes).
- i3c: master: dw: check return of dw_i3c_master_get_free_pos()
  (git-fixes).
- i3c: fix incorrect address slot lookup on 64-bit (git-fixes).
- commit 3d8614c</changelog>
  <changelog author="msuchanek@suse.de" date="1642593603">- powerpc/prom_init: Fix improper check of prom_getprop()
  (bsc#1065729).
- commit 954fa51</changelog>
  <changelog author="msuchanek@suse.de" date="1642593604">- powerpc/perf: Fix PMU callbacks to clear pending PMI before
  resetting an overflown PMC (bsc#1156395).
- commit 8bdce1e</changelog>
  <changelog author="mbenes@suse.cz" date="1642593605">- livepatch: Avoid CPU hogging with cond_resched (bsc#1071995).
- commit 27c7aa0</changelog>
  <changelog author="msuchanek@suse.de" date="1642593606">- blacklist.conf: Add 79ca6f74dae0 tpm: fix Atmel TPM crash caused by too frequent queries
  Breaks kABI, there is no report of this problem affecting users, likely
  broken old TPM firmware.
- commit 4ea9f96</changelog>
  <changelog author="msuchanek@suse.de" date="1642593607">- Update patches.suse/tpm-fix-potential-NULL-pointer-access-in-tpm_del_cha.patch
  (git-fixes bsc#1193660 ltc#195634).
- commit 11ac3f6</changelog>
  <changelog author="lhenriques@suse.de" date="1642680000">- fuse: Pass correct lend value to filemap_write_and_wait_range()
  (bsc#1194953).
- commit d2355ea</changelog>
  <changelog author="msuchanek@suse.de" date="1642680001">- blacklist.conf: Add a2308836880b powerpc: Fix arch_stack_walk() to have
  running function as first entry
  The stacktrace interface in this kernel version does not provide the
  parameters used to implement the fix.
- commit ee041a3</changelog>
  <changelog author="msuchanek@suse.de" date="1642680002">- powerpc/64s: fix program check interrupt emergency stack path
  (bsc#1156395).
- commit a3c26ed</changelog>
  <changelog author="msuchanek@suse.de" date="1642680003">- powerpc/traps: do not enable irqs in _exception (bsc#1065729).
- powerpc: add interrupt_cond_local_irq_enable helper
  (bsc#1065729).
- commit 65f660c</changelog>
  <changelog author="msuchanek@suse.de" date="1642680004">- powerpc/pseries/mobility: ignore ibm, platform-facilities
  updates (bsc#1065729).
- commit b253330</changelog>
  <changelog author="rgoldwyn@suse.com" date="1642680005">- vfs: check fd has read access in kernel_read_file_from_fd() (bsc#1194888).
- commit 4717473</changelog>
  <changelog author="vkarasulli@suse.de" date="1642680006">- moxart: fix potential use-after-free on remove path
  (bsc#1194516).
- commit 3fae095</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1642766400">- sctp: account stream padding length for reconf chunk
  (bsc#1194985 CVE-2022-0322).
- commit a6cab40</changelog>
  <changelog author="ddiss@suse.de" date="1642766401">- vfs: fs_context: fix up param length parsing in
  legacy_parse_param (CVE-2022-0185 bsc#1194517).
- Rename and retag following upstream merge from:
  patches.suse/vfs-Out-of-bounds-write-of-heap-buffer-in-fs_context-c.patch
  to patches.suse/vfs-fs_context-fix-up-param-length-parsing-in-legacy.patch
- commit 33860f2</changelog>
  <changelog author="mkubecek@suse.cz" date="1642766402">- series.conf: cleanup
- move to "mainline soon" section:
  - patches.suse/0001-mmc-moxart_remove-Fix-UAF.patch
- commit 07d55c3</changelog>
  <changelog author="mkubecek@suse.cz" date="1642766403">- series.conf: refresh
- update upstream references and resort:
  - patches.suse/powerpc-fadump-Fix-inaccurate-CPU-state-info-in-vmco.patch
  - patches.suse/powerpc-handle-kdump-appropriately-with-crash_kexec_.patch
  - patches.suse/powerpc-watchdog-Avoid-holding-wd_smp_lock-over-prin.patch
  - patches.suse/powerpc-watchdog-Fix-missed-watchdog-reset-due-to-me.patch
  - patches.suse/powerpc-watchdog-Fix-wd_smp_last_reset_tb-reporting.patch
  - patches.suse/powerpc-watchdog-read-TB-close-to-where-it-is-used.patch
  - patches.suse/powerpc-watchdog-tighten-non-atomic-read-modify-writ.patch
- commit 72b7db7</changelog>
  <changelog author="osalvador@suse.de" date="1642939200">- Rename colliding patches before the next cve/linux-5.3 -&gt; SLE15-SP3 merge
- commit 84178b8</changelog>
</package>
<package pkgid="8f265544fa986ad896d4d5a1407d1f2053d62959d78d6481510c7522c76dfd4e" name="ocfs2-kmp-preempt" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="150300.59.49.1"/>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235200">- IB/mlx5: Add missing error code (git-fixes)
- commit 06919f0</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235201">- RDMA/cxgb4: Fix adapter LE hash errors while destroying ipv6 listening server (git-fixes)
- commit 0f86491</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235202">- RDMA/addr: Be strict with gid size (git-fixes)
- commit 0b96850</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235203">- IB/isert: Fix a use after free in isert_connect_request (git-fixes)
- commit fa7abfc</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235204">- RDMA/core: Fix corrupted SL on passive side (git-fixes)
- commit d86d9cb</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235205">- IB/hfi1: Use kzalloc() for mmu_rb_handler allocation (git-fixes)
- commit 05c0e16</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235206">- IB/hfi1: Fix error return code in parse_platform_config() (git-fixes)
- commit 270bb46</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235207">- RDMA/bnxt_re: Fix error return code in bnxt_qplib_cq_process_terminal() (git-fixes)
- commit 76267d4</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235208">- RDMA/core: Unify RoCE check and re-factor code (git-fixes)
- commit e5e3d6f</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235209">- RDMA/cxgb4: add missing qpid increment (git-fixes)
- commit 591cdce</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235210">- RDMA/i40iw: Fix error unwinding when i40iw_hmc_sd_one fails (git-fixes)
- commit 2db1c84</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235211">- RDMA/siw: Fix a use after free in siw_alloc_mr (git-fixes)
- commit a7eff62</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235212">- RDMA/bnxt_re: Fix a double free in bnxt_qplib_alloc_res (git-fixes)
- commit 8c226d5</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235213">- RDMA/siw: Properly check send and receive CQ pointers (git-fixes)
- commit d84b45b</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235214">- RDMA/rxe: Clear all QP fields if creation failed (git-fixes)
- commit 07c8b4d</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235215">- RDMA/mlx5: Recover from fatal event in dual port mode (git-fixes)
- commit 875e0ed</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235216">- RDMA/core: Don't access cm_id after its destruction (git-fixes)
- commit 4a117e6</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235217">- RDMA/mlx5: Fix query DCT via DEVX (git-fixes)
- commit 4b56cb2</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235218">- RDMA/uverbs: Fix a NULL vs IS_ERR() bug (git-fixes)
- commit 82ce09e</changelog>
  <changelog author="msuchanek@suse.de" date="1644235219">- powerpc/perf: Fix power_pmu_disable to call
  clear_pmi_irq_pending only if PMI is pending (bsc#1156395).
- commit a08ca77</changelog>
</package>
<package pkgid="651d7b4dfa2a4fb67fb795b75fc396ebf14cfe354bdeae69cf78889c1579acd2" name="ocfs2-kmp-preempt" arch="x86_64">
  <version epoch="0" ver="5.3.18" rel="150300.59.49.1"/>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235200">- IB/mlx5: Add missing error code (git-fixes)
- commit 06919f0</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235201">- RDMA/cxgb4: Fix adapter LE hash errors while destroying ipv6 listening server (git-fixes)
- commit 0f86491</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235202">- RDMA/addr: Be strict with gid size (git-fixes)
- commit 0b96850</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235203">- IB/isert: Fix a use after free in isert_connect_request (git-fixes)
- commit fa7abfc</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235204">- RDMA/core: Fix corrupted SL on passive side (git-fixes)
- commit d86d9cb</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235205">- IB/hfi1: Use kzalloc() for mmu_rb_handler allocation (git-fixes)
- commit 05c0e16</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235206">- IB/hfi1: Fix error return code in parse_platform_config() (git-fixes)
- commit 270bb46</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235207">- RDMA/bnxt_re: Fix error return code in bnxt_qplib_cq_process_terminal() (git-fixes)
- commit 76267d4</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235208">- RDMA/core: Unify RoCE check and re-factor code (git-fixes)
- commit e5e3d6f</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235209">- RDMA/cxgb4: add missing qpid increment (git-fixes)
- commit 591cdce</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235210">- RDMA/i40iw: Fix error unwinding when i40iw_hmc_sd_one fails (git-fixes)
- commit 2db1c84</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235211">- RDMA/siw: Fix a use after free in siw_alloc_mr (git-fixes)
- commit a7eff62</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235212">- RDMA/bnxt_re: Fix a double free in bnxt_qplib_alloc_res (git-fixes)
- commit 8c226d5</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235213">- RDMA/siw: Properly check send and receive CQ pointers (git-fixes)
- commit d84b45b</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235214">- RDMA/rxe: Clear all QP fields if creation failed (git-fixes)
- commit 07c8b4d</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235215">- RDMA/mlx5: Recover from fatal event in dual port mode (git-fixes)
- commit 875e0ed</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235216">- RDMA/core: Don't access cm_id after its destruction (git-fixes)
- commit 4a117e6</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235217">- RDMA/mlx5: Fix query DCT via DEVX (git-fixes)
- commit 4b56cb2</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235218">- RDMA/uverbs: Fix a NULL vs IS_ERR() bug (git-fixes)
- commit 82ce09e</changelog>
  <changelog author="msuchanek@suse.de" date="1644235219">- powerpc/perf: Fix power_pmu_disable to call
  clear_pmi_irq_pending only if PMI is pending (bsc#1156395).
- commit a08ca77</changelog>
</package>
<package pkgid="1b3d62486b7df26efeccac4d175d347acaf3e1b38b197dd7ee2a406d51db3376" name="openexr" arch="aarch64">
  <version epoch="0" ver="2.2.1" rel="3.41.1"/>
  <changelog author="tchvatal@suse.com" date="1499860800">- Cleanup a bit with spec-cleaner</changelog>
  <changelog author="avindra@opensuse.org" date="1516017600">- Update to 2.2.1
  * Fix reported OpenEXR security vulnerabilities: CVE-2017-9110,
    CVE-2017-9111, CVE-2017-9112, CVE-2017-9113, CVE-2017-9114,
    CVE-2017-9115 and CVE-2017-9116
- pgajdos@suse.com: but really seem to fix only:
  CVE-2017-9110 [bsc#1040107], CVE-2017-9114 [bsc#1040114],
  CVE-2017-9116 [bsc#1040116], CVE-2017-12596 [bsc#1052522]; for
  the rest of issues see [bsc#1040109], [bsc#1040112],
  [bsc#1040113], [bsc#1040114], [bsc#1040115], and [bsc#1061305]</changelog>
  <changelog author="pgajdos@suse.com" date="1541505600">- asan_build: build ASAN included
- debug_build: build more suitable for debugging</changelog>
  <changelog author="pgajdos@suse.com" date="1541592000">- security update
  * CVE-2018-18444 [bsc#1113455]
    + openexr-CVE-2018-18444.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1560513600">- security update
- added patches
  CVE-2017-9111 [bsc#1040109], CVE-2017-9113 [bsc#1040113], CVE-2017-9115 [bsc#1040115]
  + openexr-CVE-2017-9111,9113,9115.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1563192000">- security update
- added patches
  CVE-2017-14988 [bsc#1061305]
  + openexr-CVE-2017-14988.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1568980800">- on behalf of Martin Pluskal:
- Enable tests on architectures with enough memory - boo#1146648
  * disable imffuzztest as it takes to much resources</changelog>
  <changelog author="pgajdos@suse.com" date="1568980801">- testsuite only for x86_64 [bsc#1146648]</changelog>
  <changelog author="pgajdos@suse.com" date="1587556800">- security update
- added patches
  fix CVE-2020-11762 [bsc#1169549], out-of-bounds read and write in DwaCompressor:uncompress in ImfDwaCompressor.cpp when handling the UNKNOWN compression case
  fix CVE-2020-11758 [bsc#1169573], out-of-bounds read in ImfOptimizedPixelReading.h.
  fix CVE-2020-11764 [bsc#1169574], out-of-bounds write in copyIntoFrameBuffer in ImfMisc.cpp
  fix CVE-2020-11765 [bsc#1169575], off-by-one error in use of the ImfXdr.h read function by DwaCompressor:Classifier:Classifier
  fix CVE-2020-11763 [bsc#1169576], out-of-bounds read and write, as demonstrated by ImfTileOffsets.cpp
  fix CVE-2020-11761 [bsc#1169578], out-of-bounds read during Huffman uncompression, as demonstrated by FastHufDecoder:refill in ImfFastHuf.cpp
  fix CVE-2020-11760 [bsc#1169580], out-of-bounds read during RLE uncompression in rleUncompress in ImfRle.cpp
  + openexr-CVE-2020-11762,11758,11764,11765,11763,11761,11760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1593604800">- security update
- added patches
  fix CVE-2020-15304 [bsc#1173466], NULL pointer dereference in TiledInputFile:TiledInputFile()
  + openexr-CVE-2020-15304.patch
  fix CVE-2020-15305 [bsc#1173467], use-after-free in DeepScanLineInputFile:DeepScanLineInputFile()
  + openexr-CVE-2020-15305.patch
  fix CVE-2020-15306 [bsc#1173469], invalid chunkCount attributes could cause a heap buffer overflow in getChunkOffsetTableSize()
  + openexr-CVE-2020-15306.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1608120000">- security update
- added patches
  fix CVE-2020-16587, CVE-2020-16588, CVE-2020-16589 [bsc#1179879], multiple memory safety issues
  + openexr-CVE-2020-16587.patch
  + openexr-CVE-2020-16588.patch
  + openexr-CVE-2020-16589.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1617192000">- security update
- added patches
  fix CVE-2021-3474 [bsc#1184174], Undefined-shift in Imf_2_5::FastHufDecoder::FastHufDecoder
  + openexr-CVE-2021-3474.patch
  fix CVE-2021-3475 [bsc#1184173], Integer-overflow in Imf_2_5::calculateNumTiles
  + openexr-CVE-2021-3475.patch
  fix CVE-2021-3476 [bsc#1184172], Undefined-shift in Imf_2_5::unpack14
  + openexr-CVE-2021-3476.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1617883200">- security update
- modified patches
  % openexr-CVE-2021-3474.patch (splitted into openexr-CVE-2021-20296.patch)
- added patches
  fix CVE-2021-20296 [bsc#1184355], Segv on unknown address in Imf_2_5:hufUncompress - Null Pointer dereference
  + openexr-CVE-2021-20296.patch
  fix CVE-2021-3477 [bsc#1184353], Heap-buffer-overflow in Imf_2_5::DeepTiledInputFile::readPixelSampleCounts
  + openexr-CVE-2021-3477.patch
  fix CVE-2021-3479 [bsc#1184354], Out-of-memory caused by allocation of a very large buffer
  + openexr-CVE-2021-3479.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1619524800">- security update
- added patches
  fix CVE-2021-23215 [bsc#1185216], Integer-overflow in Imf_2_5:DwaCompressor:initializeBuffers
  fix CVE-2021-26260 [bsc#1185217], Integer-overflow in Imf_2_5:DwaCompressor:initializeBuffers
  + openexr-CVE-2021-23215,26260.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623758400">- security update
- added patches
  fix CVE-2021-3598 [bsc#1187310], Heap buffer overflow in Imf_3_1:CharPtrIO:readChars
  + openexr-CVE-2021-3598.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623844800">- security update
- added patches
  fix CVE-2021-3605 [bsc#1187395], Heap buffer overflow in the rleUncompress function
  + openexr-CVE-2021-3605.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1627992000">- security update
- modified patches
  % openexr-CVE-2021-3476.patch (refreshed)
- added patches
  fix CVE-2021-20298 [bsc#1188460], Out-of-memory in B44Compressor
  + openexr-CVE-2021-20298.patch
  fix CVE-2021-20299 [bsc#1188459], Null-dereference READ in Imf_2_5:Header:operator
  + openexr-CVE-2021-20299.patch
  fix CVE-2021-20300 [bsc#1188458], Integer-overflow in Imf_2_5:hufUncompress
  + openexr-CVE-2021-20300.patch
  fix CVE-2021-20302 [bsc#1188462], Floating-point-exception in Imf_2_5:precalculateTileInfot
  + openexr-CVE-2021-20302.patch
  fix CVE-2021-20303 [bsc#1188457], Heap-buffer-overflow in Imf_2_5::copyIntoFrameBuffer
  + openexr-CVE-2021-20303.patch
  fix CVE-2021-20304 [bsc#1188461], Undefined-shift in Imf_2_5:hufDecode
  + openexr-CVE-2021-20304.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1636459200">- security update
- added patches
  fix CVE-2021-3933 [bsc#1192498], Integer-overflow in Imf_3_1:bytesPerDeepLineTable
  + openexr-CVE-2021-3933.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1636632000">- security update
- added patches
  fix CVE-2021-3941 [bsc#1192556], Divide-by-zero in Imf_3_1:RGBtoXYZ
  + openexr-CVE-2021-3941.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1641384000">- security update
- added patches
  fix CVE-2021-45942 [bsc#1194333], heap-based buffer overflow in Imf_3_1:LineCompositeTask:execute
  + openexr-CVE-2021-45942.patch</changelog>
</package>
<package pkgid="e442f18cfe040cae6f57819179c7bb069afc51b567a18952cf3d468dc57d1109" name="openexr" arch="ppc64le">
  <version epoch="0" ver="2.2.1" rel="3.41.1"/>
  <changelog author="tchvatal@suse.com" date="1499860800">- Cleanup a bit with spec-cleaner</changelog>
  <changelog author="avindra@opensuse.org" date="1516017600">- Update to 2.2.1
  * Fix reported OpenEXR security vulnerabilities: CVE-2017-9110,
    CVE-2017-9111, CVE-2017-9112, CVE-2017-9113, CVE-2017-9114,
    CVE-2017-9115 and CVE-2017-9116
- pgajdos@suse.com: but really seem to fix only:
  CVE-2017-9110 [bsc#1040107], CVE-2017-9114 [bsc#1040114],
  CVE-2017-9116 [bsc#1040116], CVE-2017-12596 [bsc#1052522]; for
  the rest of issues see [bsc#1040109], [bsc#1040112],
  [bsc#1040113], [bsc#1040114], [bsc#1040115], and [bsc#1061305]</changelog>
  <changelog author="pgajdos@suse.com" date="1541505600">- asan_build: build ASAN included
- debug_build: build more suitable for debugging</changelog>
  <changelog author="pgajdos@suse.com" date="1541592000">- security update
  * CVE-2018-18444 [bsc#1113455]
    + openexr-CVE-2018-18444.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1560513600">- security update
- added patches
  CVE-2017-9111 [bsc#1040109], CVE-2017-9113 [bsc#1040113], CVE-2017-9115 [bsc#1040115]
  + openexr-CVE-2017-9111,9113,9115.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1563192000">- security update
- added patches
  CVE-2017-14988 [bsc#1061305]
  + openexr-CVE-2017-14988.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1568980800">- on behalf of Martin Pluskal:
- Enable tests on architectures with enough memory - boo#1146648
  * disable imffuzztest as it takes to much resources</changelog>
  <changelog author="pgajdos@suse.com" date="1568980801">- testsuite only for x86_64 [bsc#1146648]</changelog>
  <changelog author="pgajdos@suse.com" date="1587556800">- security update
- added patches
  fix CVE-2020-11762 [bsc#1169549], out-of-bounds read and write in DwaCompressor:uncompress in ImfDwaCompressor.cpp when handling the UNKNOWN compression case
  fix CVE-2020-11758 [bsc#1169573], out-of-bounds read in ImfOptimizedPixelReading.h.
  fix CVE-2020-11764 [bsc#1169574], out-of-bounds write in copyIntoFrameBuffer in ImfMisc.cpp
  fix CVE-2020-11765 [bsc#1169575], off-by-one error in use of the ImfXdr.h read function by DwaCompressor:Classifier:Classifier
  fix CVE-2020-11763 [bsc#1169576], out-of-bounds read and write, as demonstrated by ImfTileOffsets.cpp
  fix CVE-2020-11761 [bsc#1169578], out-of-bounds read during Huffman uncompression, as demonstrated by FastHufDecoder:refill in ImfFastHuf.cpp
  fix CVE-2020-11760 [bsc#1169580], out-of-bounds read during RLE uncompression in rleUncompress in ImfRle.cpp
  + openexr-CVE-2020-11762,11758,11764,11765,11763,11761,11760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1593604800">- security update
- added patches
  fix CVE-2020-15304 [bsc#1173466], NULL pointer dereference in TiledInputFile:TiledInputFile()
  + openexr-CVE-2020-15304.patch
  fix CVE-2020-15305 [bsc#1173467], use-after-free in DeepScanLineInputFile:DeepScanLineInputFile()
  + openexr-CVE-2020-15305.patch
  fix CVE-2020-15306 [bsc#1173469], invalid chunkCount attributes could cause a heap buffer overflow in getChunkOffsetTableSize()
  + openexr-CVE-2020-15306.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1608120000">- security update
- added patches
  fix CVE-2020-16587, CVE-2020-16588, CVE-2020-16589 [bsc#1179879], multiple memory safety issues
  + openexr-CVE-2020-16587.patch
  + openexr-CVE-2020-16588.patch
  + openexr-CVE-2020-16589.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1617192000">- security update
- added patches
  fix CVE-2021-3474 [bsc#1184174], Undefined-shift in Imf_2_5::FastHufDecoder::FastHufDecoder
  + openexr-CVE-2021-3474.patch
  fix CVE-2021-3475 [bsc#1184173], Integer-overflow in Imf_2_5::calculateNumTiles
  + openexr-CVE-2021-3475.patch
  fix CVE-2021-3476 [bsc#1184172], Undefined-shift in Imf_2_5::unpack14
  + openexr-CVE-2021-3476.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1617883200">- security update
- modified patches
  % openexr-CVE-2021-3474.patch (splitted into openexr-CVE-2021-20296.patch)
- added patches
  fix CVE-2021-20296 [bsc#1184355], Segv on unknown address in Imf_2_5:hufUncompress - Null Pointer dereference
  + openexr-CVE-2021-20296.patch
  fix CVE-2021-3477 [bsc#1184353], Heap-buffer-overflow in Imf_2_5::DeepTiledInputFile::readPixelSampleCounts
  + openexr-CVE-2021-3477.patch
  fix CVE-2021-3479 [bsc#1184354], Out-of-memory caused by allocation of a very large buffer
  + openexr-CVE-2021-3479.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1619524800">- security update
- added patches
  fix CVE-2021-23215 [bsc#1185216], Integer-overflow in Imf_2_5:DwaCompressor:initializeBuffers
  fix CVE-2021-26260 [bsc#1185217], Integer-overflow in Imf_2_5:DwaCompressor:initializeBuffers
  + openexr-CVE-2021-23215,26260.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623758400">- security update
- added patches
  fix CVE-2021-3598 [bsc#1187310], Heap buffer overflow in Imf_3_1:CharPtrIO:readChars
  + openexr-CVE-2021-3598.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623844800">- security update
- added patches
  fix CVE-2021-3605 [bsc#1187395], Heap buffer overflow in the rleUncompress function
  + openexr-CVE-2021-3605.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1627992000">- security update
- modified patches
  % openexr-CVE-2021-3476.patch (refreshed)
- added patches
  fix CVE-2021-20298 [bsc#1188460], Out-of-memory in B44Compressor
  + openexr-CVE-2021-20298.patch
  fix CVE-2021-20299 [bsc#1188459], Null-dereference READ in Imf_2_5:Header:operator
  + openexr-CVE-2021-20299.patch
  fix CVE-2021-20300 [bsc#1188458], Integer-overflow in Imf_2_5:hufUncompress
  + openexr-CVE-2021-20300.patch
  fix CVE-2021-20302 [bsc#1188462], Floating-point-exception in Imf_2_5:precalculateTileInfot
  + openexr-CVE-2021-20302.patch
  fix CVE-2021-20303 [bsc#1188457], Heap-buffer-overflow in Imf_2_5::copyIntoFrameBuffer
  + openexr-CVE-2021-20303.patch
  fix CVE-2021-20304 [bsc#1188461], Undefined-shift in Imf_2_5:hufDecode
  + openexr-CVE-2021-20304.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1636459200">- security update
- added patches
  fix CVE-2021-3933 [bsc#1192498], Integer-overflow in Imf_3_1:bytesPerDeepLineTable
  + openexr-CVE-2021-3933.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1636632000">- security update
- added patches
  fix CVE-2021-3941 [bsc#1192556], Divide-by-zero in Imf_3_1:RGBtoXYZ
  + openexr-CVE-2021-3941.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1641384000">- security update
- added patches
  fix CVE-2021-45942 [bsc#1194333], heap-based buffer overflow in Imf_3_1:LineCompositeTask:execute
  + openexr-CVE-2021-45942.patch</changelog>
</package>
<package pkgid="faab90a6b3facc82ad7923b7007cafc47137d8bef8612160e55c20cbe38b9f82" name="openexr" arch="s390x">
  <version epoch="0" ver="2.2.1" rel="3.41.1"/>
  <changelog author="tchvatal@suse.com" date="1499860800">- Cleanup a bit with spec-cleaner</changelog>
  <changelog author="avindra@opensuse.org" date="1516017600">- Update to 2.2.1
  * Fix reported OpenEXR security vulnerabilities: CVE-2017-9110,
    CVE-2017-9111, CVE-2017-9112, CVE-2017-9113, CVE-2017-9114,
    CVE-2017-9115 and CVE-2017-9116
- pgajdos@suse.com: but really seem to fix only:
  CVE-2017-9110 [bsc#1040107], CVE-2017-9114 [bsc#1040114],
  CVE-2017-9116 [bsc#1040116], CVE-2017-12596 [bsc#1052522]; for
  the rest of issues see [bsc#1040109], [bsc#1040112],
  [bsc#1040113], [bsc#1040114], [bsc#1040115], and [bsc#1061305]</changelog>
  <changelog author="pgajdos@suse.com" date="1541505600">- asan_build: build ASAN included
- debug_build: build more suitable for debugging</changelog>
  <changelog author="pgajdos@suse.com" date="1541592000">- security update
  * CVE-2018-18444 [bsc#1113455]
    + openexr-CVE-2018-18444.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1560513600">- security update
- added patches
  CVE-2017-9111 [bsc#1040109], CVE-2017-9113 [bsc#1040113], CVE-2017-9115 [bsc#1040115]
  + openexr-CVE-2017-9111,9113,9115.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1563192000">- security update
- added patches
  CVE-2017-14988 [bsc#1061305]
  + openexr-CVE-2017-14988.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1568980800">- on behalf of Martin Pluskal:
- Enable tests on architectures with enough memory - boo#1146648
  * disable imffuzztest as it takes to much resources</changelog>
  <changelog author="pgajdos@suse.com" date="1568980801">- testsuite only for x86_64 [bsc#1146648]</changelog>
  <changelog author="pgajdos@suse.com" date="1587556800">- security update
- added patches
  fix CVE-2020-11762 [bsc#1169549], out-of-bounds read and write in DwaCompressor:uncompress in ImfDwaCompressor.cpp when handling the UNKNOWN compression case
  fix CVE-2020-11758 [bsc#1169573], out-of-bounds read in ImfOptimizedPixelReading.h.
  fix CVE-2020-11764 [bsc#1169574], out-of-bounds write in copyIntoFrameBuffer in ImfMisc.cpp
  fix CVE-2020-11765 [bsc#1169575], off-by-one error in use of the ImfXdr.h read function by DwaCompressor:Classifier:Classifier
  fix CVE-2020-11763 [bsc#1169576], out-of-bounds read and write, as demonstrated by ImfTileOffsets.cpp
  fix CVE-2020-11761 [bsc#1169578], out-of-bounds read during Huffman uncompression, as demonstrated by FastHufDecoder:refill in ImfFastHuf.cpp
  fix CVE-2020-11760 [bsc#1169580], out-of-bounds read during RLE uncompression in rleUncompress in ImfRle.cpp
  + openexr-CVE-2020-11762,11758,11764,11765,11763,11761,11760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1593604800">- security update
- added patches
  fix CVE-2020-15304 [bsc#1173466], NULL pointer dereference in TiledInputFile:TiledInputFile()
  + openexr-CVE-2020-15304.patch
  fix CVE-2020-15305 [bsc#1173467], use-after-free in DeepScanLineInputFile:DeepScanLineInputFile()
  + openexr-CVE-2020-15305.patch
  fix CVE-2020-15306 [bsc#1173469], invalid chunkCount attributes could cause a heap buffer overflow in getChunkOffsetTableSize()
  + openexr-CVE-2020-15306.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1608120000">- security update
- added patches
  fix CVE-2020-16587, CVE-2020-16588, CVE-2020-16589 [bsc#1179879], multiple memory safety issues
  + openexr-CVE-2020-16587.patch
  + openexr-CVE-2020-16588.patch
  + openexr-CVE-2020-16589.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1617192000">- security update
- added patches
  fix CVE-2021-3474 [bsc#1184174], Undefined-shift in Imf_2_5::FastHufDecoder::FastHufDecoder
  + openexr-CVE-2021-3474.patch
  fix CVE-2021-3475 [bsc#1184173], Integer-overflow in Imf_2_5::calculateNumTiles
  + openexr-CVE-2021-3475.patch
  fix CVE-2021-3476 [bsc#1184172], Undefined-shift in Imf_2_5::unpack14
  + openexr-CVE-2021-3476.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1617883200">- security update
- modified patches
  % openexr-CVE-2021-3474.patch (splitted into openexr-CVE-2021-20296.patch)
- added patches
  fix CVE-2021-20296 [bsc#1184355], Segv on unknown address in Imf_2_5:hufUncompress - Null Pointer dereference
  + openexr-CVE-2021-20296.patch
  fix CVE-2021-3477 [bsc#1184353], Heap-buffer-overflow in Imf_2_5::DeepTiledInputFile::readPixelSampleCounts
  + openexr-CVE-2021-3477.patch
  fix CVE-2021-3479 [bsc#1184354], Out-of-memory caused by allocation of a very large buffer
  + openexr-CVE-2021-3479.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1619524800">- security update
- added patches
  fix CVE-2021-23215 [bsc#1185216], Integer-overflow in Imf_2_5:DwaCompressor:initializeBuffers
  fix CVE-2021-26260 [bsc#1185217], Integer-overflow in Imf_2_5:DwaCompressor:initializeBuffers
  + openexr-CVE-2021-23215,26260.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623758400">- security update
- added patches
  fix CVE-2021-3598 [bsc#1187310], Heap buffer overflow in Imf_3_1:CharPtrIO:readChars
  + openexr-CVE-2021-3598.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623844800">- security update
- added patches
  fix CVE-2021-3605 [bsc#1187395], Heap buffer overflow in the rleUncompress function
  + openexr-CVE-2021-3605.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1627992000">- security update
- modified patches
  % openexr-CVE-2021-3476.patch (refreshed)
- added patches
  fix CVE-2021-20298 [bsc#1188460], Out-of-memory in B44Compressor
  + openexr-CVE-2021-20298.patch
  fix CVE-2021-20299 [bsc#1188459], Null-dereference READ in Imf_2_5:Header:operator
  + openexr-CVE-2021-20299.patch
  fix CVE-2021-20300 [bsc#1188458], Integer-overflow in Imf_2_5:hufUncompress
  + openexr-CVE-2021-20300.patch
  fix CVE-2021-20302 [bsc#1188462], Floating-point-exception in Imf_2_5:precalculateTileInfot
  + openexr-CVE-2021-20302.patch
  fix CVE-2021-20303 [bsc#1188457], Heap-buffer-overflow in Imf_2_5::copyIntoFrameBuffer
  + openexr-CVE-2021-20303.patch
  fix CVE-2021-20304 [bsc#1188461], Undefined-shift in Imf_2_5:hufDecode
  + openexr-CVE-2021-20304.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1636459200">- security update
- added patches
  fix CVE-2021-3933 [bsc#1192498], Integer-overflow in Imf_3_1:bytesPerDeepLineTable
  + openexr-CVE-2021-3933.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1636632000">- security update
- added patches
  fix CVE-2021-3941 [bsc#1192556], Divide-by-zero in Imf_3_1:RGBtoXYZ
  + openexr-CVE-2021-3941.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1641384000">- security update
- added patches
  fix CVE-2021-45942 [bsc#1194333], heap-based buffer overflow in Imf_3_1:LineCompositeTask:execute
  + openexr-CVE-2021-45942.patch</changelog>
</package>
<package pkgid="3b9c4c83419468dcf89872b8f03a33dc4e2c9e02a2f0e0a6490626a5ec33a392" name="openexr" arch="src">
  <version epoch="0" ver="2.2.1" rel="3.41.1"/>
  <changelog author="tchvatal@suse.com" date="1499860800">- Cleanup a bit with spec-cleaner</changelog>
  <changelog author="avindra@opensuse.org" date="1516017600">- Update to 2.2.1
  * Fix reported OpenEXR security vulnerabilities: CVE-2017-9110,
    CVE-2017-9111, CVE-2017-9112, CVE-2017-9113, CVE-2017-9114,
    CVE-2017-9115 and CVE-2017-9116
- pgajdos@suse.com: but really seem to fix only:
  CVE-2017-9110 [bsc#1040107], CVE-2017-9114 [bsc#1040114],
  CVE-2017-9116 [bsc#1040116], CVE-2017-12596 [bsc#1052522]; for
  the rest of issues see [bsc#1040109], [bsc#1040112],
  [bsc#1040113], [bsc#1040114], [bsc#1040115], and [bsc#1061305]</changelog>
  <changelog author="pgajdos@suse.com" date="1541505600">- asan_build: build ASAN included
- debug_build: build more suitable for debugging</changelog>
  <changelog author="pgajdos@suse.com" date="1541592000">- security update
  * CVE-2018-18444 [bsc#1113455]
    + openexr-CVE-2018-18444.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1560513600">- security update
- added patches
  CVE-2017-9111 [bsc#1040109], CVE-2017-9113 [bsc#1040113], CVE-2017-9115 [bsc#1040115]
  + openexr-CVE-2017-9111,9113,9115.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1563192000">- security update
- added patches
  CVE-2017-14988 [bsc#1061305]
  + openexr-CVE-2017-14988.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1568980800">- on behalf of Martin Pluskal:
- Enable tests on architectures with enough memory - boo#1146648
  * disable imffuzztest as it takes to much resources</changelog>
  <changelog author="pgajdos@suse.com" date="1568980801">- testsuite only for x86_64 [bsc#1146648]</changelog>
  <changelog author="pgajdos@suse.com" date="1587556800">- security update
- added patches
  fix CVE-2020-11762 [bsc#1169549], out-of-bounds read and write in DwaCompressor:uncompress in ImfDwaCompressor.cpp when handling the UNKNOWN compression case
  fix CVE-2020-11758 [bsc#1169573], out-of-bounds read in ImfOptimizedPixelReading.h.
  fix CVE-2020-11764 [bsc#1169574], out-of-bounds write in copyIntoFrameBuffer in ImfMisc.cpp
  fix CVE-2020-11765 [bsc#1169575], off-by-one error in use of the ImfXdr.h read function by DwaCompressor:Classifier:Classifier
  fix CVE-2020-11763 [bsc#1169576], out-of-bounds read and write, as demonstrated by ImfTileOffsets.cpp
  fix CVE-2020-11761 [bsc#1169578], out-of-bounds read during Huffman uncompression, as demonstrated by FastHufDecoder:refill in ImfFastHuf.cpp
  fix CVE-2020-11760 [bsc#1169580], out-of-bounds read during RLE uncompression in rleUncompress in ImfRle.cpp
  + openexr-CVE-2020-11762,11758,11764,11765,11763,11761,11760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1593604800">- security update
- added patches
  fix CVE-2020-15304 [bsc#1173466], NULL pointer dereference in TiledInputFile:TiledInputFile()
  + openexr-CVE-2020-15304.patch
  fix CVE-2020-15305 [bsc#1173467], use-after-free in DeepScanLineInputFile:DeepScanLineInputFile()
  + openexr-CVE-2020-15305.patch
  fix CVE-2020-15306 [bsc#1173469], invalid chunkCount attributes could cause a heap buffer overflow in getChunkOffsetTableSize()
  + openexr-CVE-2020-15306.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1608120000">- security update
- added patches
  fix CVE-2020-16587, CVE-2020-16588, CVE-2020-16589 [bsc#1179879], multiple memory safety issues
  + openexr-CVE-2020-16587.patch
  + openexr-CVE-2020-16588.patch
  + openexr-CVE-2020-16589.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1617192000">- security update
- added patches
  fix CVE-2021-3474 [bsc#1184174], Undefined-shift in Imf_2_5::FastHufDecoder::FastHufDecoder
  + openexr-CVE-2021-3474.patch
  fix CVE-2021-3475 [bsc#1184173], Integer-overflow in Imf_2_5::calculateNumTiles
  + openexr-CVE-2021-3475.patch
  fix CVE-2021-3476 [bsc#1184172], Undefined-shift in Imf_2_5::unpack14
  + openexr-CVE-2021-3476.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1617883200">- security update
- modified patches
  % openexr-CVE-2021-3474.patch (splitted into openexr-CVE-2021-20296.patch)
- added patches
  fix CVE-2021-20296 [bsc#1184355], Segv on unknown address in Imf_2_5:hufUncompress - Null Pointer dereference
  + openexr-CVE-2021-20296.patch
  fix CVE-2021-3477 [bsc#1184353], Heap-buffer-overflow in Imf_2_5::DeepTiledInputFile::readPixelSampleCounts
  + openexr-CVE-2021-3477.patch
  fix CVE-2021-3479 [bsc#1184354], Out-of-memory caused by allocation of a very large buffer
  + openexr-CVE-2021-3479.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1619524800">- security update
- added patches
  fix CVE-2021-23215 [bsc#1185216], Integer-overflow in Imf_2_5:DwaCompressor:initializeBuffers
  fix CVE-2021-26260 [bsc#1185217], Integer-overflow in Imf_2_5:DwaCompressor:initializeBuffers
  + openexr-CVE-2021-23215,26260.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623758400">- security update
- added patches
  fix CVE-2021-3598 [bsc#1187310], Heap buffer overflow in Imf_3_1:CharPtrIO:readChars
  + openexr-CVE-2021-3598.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623844800">- security update
- added patches
  fix CVE-2021-3605 [bsc#1187395], Heap buffer overflow in the rleUncompress function
  + openexr-CVE-2021-3605.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1627992000">- security update
- modified patches
  % openexr-CVE-2021-3476.patch (refreshed)
- added patches
  fix CVE-2021-20298 [bsc#1188460], Out-of-memory in B44Compressor
  + openexr-CVE-2021-20298.patch
  fix CVE-2021-20299 [bsc#1188459], Null-dereference READ in Imf_2_5:Header:operator
  + openexr-CVE-2021-20299.patch
  fix CVE-2021-20300 [bsc#1188458], Integer-overflow in Imf_2_5:hufUncompress
  + openexr-CVE-2021-20300.patch
  fix CVE-2021-20302 [bsc#1188462], Floating-point-exception in Imf_2_5:precalculateTileInfot
  + openexr-CVE-2021-20302.patch
  fix CVE-2021-20303 [bsc#1188457], Heap-buffer-overflow in Imf_2_5::copyIntoFrameBuffer
  + openexr-CVE-2021-20303.patch
  fix CVE-2021-20304 [bsc#1188461], Undefined-shift in Imf_2_5:hufDecode
  + openexr-CVE-2021-20304.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1636459200">- security update
- added patches
  fix CVE-2021-3933 [bsc#1192498], Integer-overflow in Imf_3_1:bytesPerDeepLineTable
  + openexr-CVE-2021-3933.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1636632000">- security update
- added patches
  fix CVE-2021-3941 [bsc#1192556], Divide-by-zero in Imf_3_1:RGBtoXYZ
  + openexr-CVE-2021-3941.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1641384000">- security update
- added patches
  fix CVE-2021-45942 [bsc#1194333], heap-based buffer overflow in Imf_3_1:LineCompositeTask:execute
  + openexr-CVE-2021-45942.patch</changelog>
</package>
<package pkgid="ef8109f70ce657ce3ecd085caeae68dfd9494664880e18845001653d0262838d" name="openexr" arch="x86_64">
  <version epoch="0" ver="2.2.1" rel="3.41.1"/>
  <changelog author="tchvatal@suse.com" date="1499860800">- Cleanup a bit with spec-cleaner</changelog>
  <changelog author="avindra@opensuse.org" date="1516017600">- Update to 2.2.1
  * Fix reported OpenEXR security vulnerabilities: CVE-2017-9110,
    CVE-2017-9111, CVE-2017-9112, CVE-2017-9113, CVE-2017-9114,
    CVE-2017-9115 and CVE-2017-9116
- pgajdos@suse.com: but really seem to fix only:
  CVE-2017-9110 [bsc#1040107], CVE-2017-9114 [bsc#1040114],
  CVE-2017-9116 [bsc#1040116], CVE-2017-12596 [bsc#1052522]; for
  the rest of issues see [bsc#1040109], [bsc#1040112],
  [bsc#1040113], [bsc#1040114], [bsc#1040115], and [bsc#1061305]</changelog>
  <changelog author="pgajdos@suse.com" date="1541505600">- asan_build: build ASAN included
- debug_build: build more suitable for debugging</changelog>
  <changelog author="pgajdos@suse.com" date="1541592000">- security update
  * CVE-2018-18444 [bsc#1113455]
    + openexr-CVE-2018-18444.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1560513600">- security update
- added patches
  CVE-2017-9111 [bsc#1040109], CVE-2017-9113 [bsc#1040113], CVE-2017-9115 [bsc#1040115]
  + openexr-CVE-2017-9111,9113,9115.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1563192000">- security update
- added patches
  CVE-2017-14988 [bsc#1061305]
  + openexr-CVE-2017-14988.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1568980800">- on behalf of Martin Pluskal:
- Enable tests on architectures with enough memory - boo#1146648
  * disable imffuzztest as it takes to much resources</changelog>
  <changelog author="pgajdos@suse.com" date="1568980801">- testsuite only for x86_64 [bsc#1146648]</changelog>
  <changelog author="pgajdos@suse.com" date="1587556800">- security update
- added patches
  fix CVE-2020-11762 [bsc#1169549], out-of-bounds read and write in DwaCompressor:uncompress in ImfDwaCompressor.cpp when handling the UNKNOWN compression case
  fix CVE-2020-11758 [bsc#1169573], out-of-bounds read in ImfOptimizedPixelReading.h.
  fix CVE-2020-11764 [bsc#1169574], out-of-bounds write in copyIntoFrameBuffer in ImfMisc.cpp
  fix CVE-2020-11765 [bsc#1169575], off-by-one error in use of the ImfXdr.h read function by DwaCompressor:Classifier:Classifier
  fix CVE-2020-11763 [bsc#1169576], out-of-bounds read and write, as demonstrated by ImfTileOffsets.cpp
  fix CVE-2020-11761 [bsc#1169578], out-of-bounds read during Huffman uncompression, as demonstrated by FastHufDecoder:refill in ImfFastHuf.cpp
  fix CVE-2020-11760 [bsc#1169580], out-of-bounds read during RLE uncompression in rleUncompress in ImfRle.cpp
  + openexr-CVE-2020-11762,11758,11764,11765,11763,11761,11760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1593604800">- security update
- added patches
  fix CVE-2020-15304 [bsc#1173466], NULL pointer dereference in TiledInputFile:TiledInputFile()
  + openexr-CVE-2020-15304.patch
  fix CVE-2020-15305 [bsc#1173467], use-after-free in DeepScanLineInputFile:DeepScanLineInputFile()
  + openexr-CVE-2020-15305.patch
  fix CVE-2020-15306 [bsc#1173469], invalid chunkCount attributes could cause a heap buffer overflow in getChunkOffsetTableSize()
  + openexr-CVE-2020-15306.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1608120000">- security update
- added patches
  fix CVE-2020-16587, CVE-2020-16588, CVE-2020-16589 [bsc#1179879], multiple memory safety issues
  + openexr-CVE-2020-16587.patch
  + openexr-CVE-2020-16588.patch
  + openexr-CVE-2020-16589.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1617192000">- security update
- added patches
  fix CVE-2021-3474 [bsc#1184174], Undefined-shift in Imf_2_5::FastHufDecoder::FastHufDecoder
  + openexr-CVE-2021-3474.patch
  fix CVE-2021-3475 [bsc#1184173], Integer-overflow in Imf_2_5::calculateNumTiles
  + openexr-CVE-2021-3475.patch
  fix CVE-2021-3476 [bsc#1184172], Undefined-shift in Imf_2_5::unpack14
  + openexr-CVE-2021-3476.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1617883200">- security update
- modified patches
  % openexr-CVE-2021-3474.patch (splitted into openexr-CVE-2021-20296.patch)
- added patches
  fix CVE-2021-20296 [bsc#1184355], Segv on unknown address in Imf_2_5:hufUncompress - Null Pointer dereference
  + openexr-CVE-2021-20296.patch
  fix CVE-2021-3477 [bsc#1184353], Heap-buffer-overflow in Imf_2_5::DeepTiledInputFile::readPixelSampleCounts
  + openexr-CVE-2021-3477.patch
  fix CVE-2021-3479 [bsc#1184354], Out-of-memory caused by allocation of a very large buffer
  + openexr-CVE-2021-3479.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1619524800">- security update
- added patches
  fix CVE-2021-23215 [bsc#1185216], Integer-overflow in Imf_2_5:DwaCompressor:initializeBuffers
  fix CVE-2021-26260 [bsc#1185217], Integer-overflow in Imf_2_5:DwaCompressor:initializeBuffers
  + openexr-CVE-2021-23215,26260.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623758400">- security update
- added patches
  fix CVE-2021-3598 [bsc#1187310], Heap buffer overflow in Imf_3_1:CharPtrIO:readChars
  + openexr-CVE-2021-3598.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623844800">- security update
- added patches
  fix CVE-2021-3605 [bsc#1187395], Heap buffer overflow in the rleUncompress function
  + openexr-CVE-2021-3605.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1627992000">- security update
- modified patches
  % openexr-CVE-2021-3476.patch (refreshed)
- added patches
  fix CVE-2021-20298 [bsc#1188460], Out-of-memory in B44Compressor
  + openexr-CVE-2021-20298.patch
  fix CVE-2021-20299 [bsc#1188459], Null-dereference READ in Imf_2_5:Header:operator
  + openexr-CVE-2021-20299.patch
  fix CVE-2021-20300 [bsc#1188458], Integer-overflow in Imf_2_5:hufUncompress
  + openexr-CVE-2021-20300.patch
  fix CVE-2021-20302 [bsc#1188462], Floating-point-exception in Imf_2_5:precalculateTileInfot
  + openexr-CVE-2021-20302.patch
  fix CVE-2021-20303 [bsc#1188457], Heap-buffer-overflow in Imf_2_5::copyIntoFrameBuffer
  + openexr-CVE-2021-20303.patch
  fix CVE-2021-20304 [bsc#1188461], Undefined-shift in Imf_2_5:hufDecode
  + openexr-CVE-2021-20304.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1636459200">- security update
- added patches
  fix CVE-2021-3933 [bsc#1192498], Integer-overflow in Imf_3_1:bytesPerDeepLineTable
  + openexr-CVE-2021-3933.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1636632000">- security update
- added patches
  fix CVE-2021-3941 [bsc#1192556], Divide-by-zero in Imf_3_1:RGBtoXYZ
  + openexr-CVE-2021-3941.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1641384000">- security update
- added patches
  fix CVE-2021-45942 [bsc#1194333], heap-based buffer overflow in Imf_3_1:LineCompositeTask:execute
  + openexr-CVE-2021-45942.patch</changelog>
</package>
<package pkgid="cd459105cea193764d332ee2b8cad6247362f9f4858292b64c54b6461a330476" name="openexr-devel" arch="aarch64">
  <version epoch="0" ver="2.2.1" rel="3.41.1"/>
  <changelog author="tchvatal@suse.com" date="1499860800">- Cleanup a bit with spec-cleaner</changelog>
  <changelog author="avindra@opensuse.org" date="1516017600">- Update to 2.2.1
  * Fix reported OpenEXR security vulnerabilities: CVE-2017-9110,
    CVE-2017-9111, CVE-2017-9112, CVE-2017-9113, CVE-2017-9114,
    CVE-2017-9115 and CVE-2017-9116
- pgajdos@suse.com: but really seem to fix only:
  CVE-2017-9110 [bsc#1040107], CVE-2017-9114 [bsc#1040114],
  CVE-2017-9116 [bsc#1040116], CVE-2017-12596 [bsc#1052522]; for
  the rest of issues see [bsc#1040109], [bsc#1040112],
  [bsc#1040113], [bsc#1040114], [bsc#1040115], and [bsc#1061305]</changelog>
  <changelog author="pgajdos@suse.com" date="1541505600">- asan_build: build ASAN included
- debug_build: build more suitable for debugging</changelog>
  <changelog author="pgajdos@suse.com" date="1541592000">- security update
  * CVE-2018-18444 [bsc#1113455]
    + openexr-CVE-2018-18444.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1560513600">- security update
- added patches
  CVE-2017-9111 [bsc#1040109], CVE-2017-9113 [bsc#1040113], CVE-2017-9115 [bsc#1040115]
  + openexr-CVE-2017-9111,9113,9115.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1563192000">- security update
- added patches
  CVE-2017-14988 [bsc#1061305]
  + openexr-CVE-2017-14988.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1568980800">- on behalf of Martin Pluskal:
- Enable tests on architectures with enough memory - boo#1146648
  * disable imffuzztest as it takes to much resources</changelog>
  <changelog author="pgajdos@suse.com" date="1568980801">- testsuite only for x86_64 [bsc#1146648]</changelog>
  <changelog author="pgajdos@suse.com" date="1587556800">- security update
- added patches
  fix CVE-2020-11762 [bsc#1169549], out-of-bounds read and write in DwaCompressor:uncompress in ImfDwaCompressor.cpp when handling the UNKNOWN compression case
  fix CVE-2020-11758 [bsc#1169573], out-of-bounds read in ImfOptimizedPixelReading.h.
  fix CVE-2020-11764 [bsc#1169574], out-of-bounds write in copyIntoFrameBuffer in ImfMisc.cpp
  fix CVE-2020-11765 [bsc#1169575], off-by-one error in use of the ImfXdr.h read function by DwaCompressor:Classifier:Classifier
  fix CVE-2020-11763 [bsc#1169576], out-of-bounds read and write, as demonstrated by ImfTileOffsets.cpp
  fix CVE-2020-11761 [bsc#1169578], out-of-bounds read during Huffman uncompression, as demonstrated by FastHufDecoder:refill in ImfFastHuf.cpp
  fix CVE-2020-11760 [bsc#1169580], out-of-bounds read during RLE uncompression in rleUncompress in ImfRle.cpp
  + openexr-CVE-2020-11762,11758,11764,11765,11763,11761,11760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1593604800">- security update
- added patches
  fix CVE-2020-15304 [bsc#1173466], NULL pointer dereference in TiledInputFile:TiledInputFile()
  + openexr-CVE-2020-15304.patch
  fix CVE-2020-15305 [bsc#1173467], use-after-free in DeepScanLineInputFile:DeepScanLineInputFile()
  + openexr-CVE-2020-15305.patch
  fix CVE-2020-15306 [bsc#1173469], invalid chunkCount attributes could cause a heap buffer overflow in getChunkOffsetTableSize()
  + openexr-CVE-2020-15306.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1608120000">- security update
- added patches
  fix CVE-2020-16587, CVE-2020-16588, CVE-2020-16589 [bsc#1179879], multiple memory safety issues
  + openexr-CVE-2020-16587.patch
  + openexr-CVE-2020-16588.patch
  + openexr-CVE-2020-16589.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1617192000">- security update
- added patches
  fix CVE-2021-3474 [bsc#1184174], Undefined-shift in Imf_2_5::FastHufDecoder::FastHufDecoder
  + openexr-CVE-2021-3474.patch
  fix CVE-2021-3475 [bsc#1184173], Integer-overflow in Imf_2_5::calculateNumTiles
  + openexr-CVE-2021-3475.patch
  fix CVE-2021-3476 [bsc#1184172], Undefined-shift in Imf_2_5::unpack14
  + openexr-CVE-2021-3476.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1617883200">- security update
- modified patches
  % openexr-CVE-2021-3474.patch (splitted into openexr-CVE-2021-20296.patch)
- added patches
  fix CVE-2021-20296 [bsc#1184355], Segv on unknown address in Imf_2_5:hufUncompress - Null Pointer dereference
  + openexr-CVE-2021-20296.patch
  fix CVE-2021-3477 [bsc#1184353], Heap-buffer-overflow in Imf_2_5::DeepTiledInputFile::readPixelSampleCounts
  + openexr-CVE-2021-3477.patch
  fix CVE-2021-3479 [bsc#1184354], Out-of-memory caused by allocation of a very large buffer
  + openexr-CVE-2021-3479.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1619524800">- security update
- added patches
  fix CVE-2021-23215 [bsc#1185216], Integer-overflow in Imf_2_5:DwaCompressor:initializeBuffers
  fix CVE-2021-26260 [bsc#1185217], Integer-overflow in Imf_2_5:DwaCompressor:initializeBuffers
  + openexr-CVE-2021-23215,26260.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623758400">- security update
- added patches
  fix CVE-2021-3598 [bsc#1187310], Heap buffer overflow in Imf_3_1:CharPtrIO:readChars
  + openexr-CVE-2021-3598.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623844800">- security update
- added patches
  fix CVE-2021-3605 [bsc#1187395], Heap buffer overflow in the rleUncompress function
  + openexr-CVE-2021-3605.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1627992000">- security update
- modified patches
  % openexr-CVE-2021-3476.patch (refreshed)
- added patches
  fix CVE-2021-20298 [bsc#1188460], Out-of-memory in B44Compressor
  + openexr-CVE-2021-20298.patch
  fix CVE-2021-20299 [bsc#1188459], Null-dereference READ in Imf_2_5:Header:operator
  + openexr-CVE-2021-20299.patch
  fix CVE-2021-20300 [bsc#1188458], Integer-overflow in Imf_2_5:hufUncompress
  + openexr-CVE-2021-20300.patch
  fix CVE-2021-20302 [bsc#1188462], Floating-point-exception in Imf_2_5:precalculateTileInfot
  + openexr-CVE-2021-20302.patch
  fix CVE-2021-20303 [bsc#1188457], Heap-buffer-overflow in Imf_2_5::copyIntoFrameBuffer
  + openexr-CVE-2021-20303.patch
  fix CVE-2021-20304 [bsc#1188461], Undefined-shift in Imf_2_5:hufDecode
  + openexr-CVE-2021-20304.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1636459200">- security update
- added patches
  fix CVE-2021-3933 [bsc#1192498], Integer-overflow in Imf_3_1:bytesPerDeepLineTable
  + openexr-CVE-2021-3933.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1636632000">- security update
- added patches
  fix CVE-2021-3941 [bsc#1192556], Divide-by-zero in Imf_3_1:RGBtoXYZ
  + openexr-CVE-2021-3941.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1641384000">- security update
- added patches
  fix CVE-2021-45942 [bsc#1194333], heap-based buffer overflow in Imf_3_1:LineCompositeTask:execute
  + openexr-CVE-2021-45942.patch</changelog>
</package>
<package pkgid="ac53b530542058ebe97670a11d6d2cca558e1cd676d0c56affa78adf2a2d0da3" name="openexr-devel" arch="ppc64le">
  <version epoch="0" ver="2.2.1" rel="3.41.1"/>
  <changelog author="tchvatal@suse.com" date="1499860800">- Cleanup a bit with spec-cleaner</changelog>
  <changelog author="avindra@opensuse.org" date="1516017600">- Update to 2.2.1
  * Fix reported OpenEXR security vulnerabilities: CVE-2017-9110,
    CVE-2017-9111, CVE-2017-9112, CVE-2017-9113, CVE-2017-9114,
    CVE-2017-9115 and CVE-2017-9116
- pgajdos@suse.com: but really seem to fix only:
  CVE-2017-9110 [bsc#1040107], CVE-2017-9114 [bsc#1040114],
  CVE-2017-9116 [bsc#1040116], CVE-2017-12596 [bsc#1052522]; for
  the rest of issues see [bsc#1040109], [bsc#1040112],
  [bsc#1040113], [bsc#1040114], [bsc#1040115], and [bsc#1061305]</changelog>
  <changelog author="pgajdos@suse.com" date="1541505600">- asan_build: build ASAN included
- debug_build: build more suitable for debugging</changelog>
  <changelog author="pgajdos@suse.com" date="1541592000">- security update
  * CVE-2018-18444 [bsc#1113455]
    + openexr-CVE-2018-18444.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1560513600">- security update
- added patches
  CVE-2017-9111 [bsc#1040109], CVE-2017-9113 [bsc#1040113], CVE-2017-9115 [bsc#1040115]
  + openexr-CVE-2017-9111,9113,9115.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1563192000">- security update
- added patches
  CVE-2017-14988 [bsc#1061305]
  + openexr-CVE-2017-14988.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1568980800">- on behalf of Martin Pluskal:
- Enable tests on architectures with enough memory - boo#1146648
  * disable imffuzztest as it takes to much resources</changelog>
  <changelog author="pgajdos@suse.com" date="1568980801">- testsuite only for x86_64 [bsc#1146648]</changelog>
  <changelog author="pgajdos@suse.com" date="1587556800">- security update
- added patches
  fix CVE-2020-11762 [bsc#1169549], out-of-bounds read and write in DwaCompressor:uncompress in ImfDwaCompressor.cpp when handling the UNKNOWN compression case
  fix CVE-2020-11758 [bsc#1169573], out-of-bounds read in ImfOptimizedPixelReading.h.
  fix CVE-2020-11764 [bsc#1169574], out-of-bounds write in copyIntoFrameBuffer in ImfMisc.cpp
  fix CVE-2020-11765 [bsc#1169575], off-by-one error in use of the ImfXdr.h read function by DwaCompressor:Classifier:Classifier
  fix CVE-2020-11763 [bsc#1169576], out-of-bounds read and write, as demonstrated by ImfTileOffsets.cpp
  fix CVE-2020-11761 [bsc#1169578], out-of-bounds read during Huffman uncompression, as demonstrated by FastHufDecoder:refill in ImfFastHuf.cpp
  fix CVE-2020-11760 [bsc#1169580], out-of-bounds read during RLE uncompression in rleUncompress in ImfRle.cpp
  + openexr-CVE-2020-11762,11758,11764,11765,11763,11761,11760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1593604800">- security update
- added patches
  fix CVE-2020-15304 [bsc#1173466], NULL pointer dereference in TiledInputFile:TiledInputFile()
  + openexr-CVE-2020-15304.patch
  fix CVE-2020-15305 [bsc#1173467], use-after-free in DeepScanLineInputFile:DeepScanLineInputFile()
  + openexr-CVE-2020-15305.patch
  fix CVE-2020-15306 [bsc#1173469], invalid chunkCount attributes could cause a heap buffer overflow in getChunkOffsetTableSize()
  + openexr-CVE-2020-15306.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1608120000">- security update
- added patches
  fix CVE-2020-16587, CVE-2020-16588, CVE-2020-16589 [bsc#1179879], multiple memory safety issues
  + openexr-CVE-2020-16587.patch
  + openexr-CVE-2020-16588.patch
  + openexr-CVE-2020-16589.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1617192000">- security update
- added patches
  fix CVE-2021-3474 [bsc#1184174], Undefined-shift in Imf_2_5::FastHufDecoder::FastHufDecoder
  + openexr-CVE-2021-3474.patch
  fix CVE-2021-3475 [bsc#1184173], Integer-overflow in Imf_2_5::calculateNumTiles
  + openexr-CVE-2021-3475.patch
  fix CVE-2021-3476 [bsc#1184172], Undefined-shift in Imf_2_5::unpack14
  + openexr-CVE-2021-3476.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1617883200">- security update
- modified patches
  % openexr-CVE-2021-3474.patch (splitted into openexr-CVE-2021-20296.patch)
- added patches
  fix CVE-2021-20296 [bsc#1184355], Segv on unknown address in Imf_2_5:hufUncompress - Null Pointer dereference
  + openexr-CVE-2021-20296.patch
  fix CVE-2021-3477 [bsc#1184353], Heap-buffer-overflow in Imf_2_5::DeepTiledInputFile::readPixelSampleCounts
  + openexr-CVE-2021-3477.patch
  fix CVE-2021-3479 [bsc#1184354], Out-of-memory caused by allocation of a very large buffer
  + openexr-CVE-2021-3479.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1619524800">- security update
- added patches
  fix CVE-2021-23215 [bsc#1185216], Integer-overflow in Imf_2_5:DwaCompressor:initializeBuffers
  fix CVE-2021-26260 [bsc#1185217], Integer-overflow in Imf_2_5:DwaCompressor:initializeBuffers
  + openexr-CVE-2021-23215,26260.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623758400">- security update
- added patches
  fix CVE-2021-3598 [bsc#1187310], Heap buffer overflow in Imf_3_1:CharPtrIO:readChars
  + openexr-CVE-2021-3598.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623844800">- security update
- added patches
  fix CVE-2021-3605 [bsc#1187395], Heap buffer overflow in the rleUncompress function
  + openexr-CVE-2021-3605.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1627992000">- security update
- modified patches
  % openexr-CVE-2021-3476.patch (refreshed)
- added patches
  fix CVE-2021-20298 [bsc#1188460], Out-of-memory in B44Compressor
  + openexr-CVE-2021-20298.patch
  fix CVE-2021-20299 [bsc#1188459], Null-dereference READ in Imf_2_5:Header:operator
  + openexr-CVE-2021-20299.patch
  fix CVE-2021-20300 [bsc#1188458], Integer-overflow in Imf_2_5:hufUncompress
  + openexr-CVE-2021-20300.patch
  fix CVE-2021-20302 [bsc#1188462], Floating-point-exception in Imf_2_5:precalculateTileInfot
  + openexr-CVE-2021-20302.patch
  fix CVE-2021-20303 [bsc#1188457], Heap-buffer-overflow in Imf_2_5::copyIntoFrameBuffer
  + openexr-CVE-2021-20303.patch
  fix CVE-2021-20304 [bsc#1188461], Undefined-shift in Imf_2_5:hufDecode
  + openexr-CVE-2021-20304.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1636459200">- security update
- added patches
  fix CVE-2021-3933 [bsc#1192498], Integer-overflow in Imf_3_1:bytesPerDeepLineTable
  + openexr-CVE-2021-3933.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1636632000">- security update
- added patches
  fix CVE-2021-3941 [bsc#1192556], Divide-by-zero in Imf_3_1:RGBtoXYZ
  + openexr-CVE-2021-3941.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1641384000">- security update
- added patches
  fix CVE-2021-45942 [bsc#1194333], heap-based buffer overflow in Imf_3_1:LineCompositeTask:execute
  + openexr-CVE-2021-45942.patch</changelog>
</package>
<package pkgid="629cb01140b070f6fd058e14851ca7ae4bbe76ce3181f353ad56c195c783c31c" name="openexr-devel" arch="s390x">
  <version epoch="0" ver="2.2.1" rel="3.41.1"/>
  <changelog author="tchvatal@suse.com" date="1499860800">- Cleanup a bit with spec-cleaner</changelog>
  <changelog author="avindra@opensuse.org" date="1516017600">- Update to 2.2.1
  * Fix reported OpenEXR security vulnerabilities: CVE-2017-9110,
    CVE-2017-9111, CVE-2017-9112, CVE-2017-9113, CVE-2017-9114,
    CVE-2017-9115 and CVE-2017-9116
- pgajdos@suse.com: but really seem to fix only:
  CVE-2017-9110 [bsc#1040107], CVE-2017-9114 [bsc#1040114],
  CVE-2017-9116 [bsc#1040116], CVE-2017-12596 [bsc#1052522]; for
  the rest of issues see [bsc#1040109], [bsc#1040112],
  [bsc#1040113], [bsc#1040114], [bsc#1040115], and [bsc#1061305]</changelog>
  <changelog author="pgajdos@suse.com" date="1541505600">- asan_build: build ASAN included
- debug_build: build more suitable for debugging</changelog>
  <changelog author="pgajdos@suse.com" date="1541592000">- security update
  * CVE-2018-18444 [bsc#1113455]
    + openexr-CVE-2018-18444.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1560513600">- security update
- added patches
  CVE-2017-9111 [bsc#1040109], CVE-2017-9113 [bsc#1040113], CVE-2017-9115 [bsc#1040115]
  + openexr-CVE-2017-9111,9113,9115.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1563192000">- security update
- added patches
  CVE-2017-14988 [bsc#1061305]
  + openexr-CVE-2017-14988.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1568980800">- on behalf of Martin Pluskal:
- Enable tests on architectures with enough memory - boo#1146648
  * disable imffuzztest as it takes to much resources</changelog>
  <changelog author="pgajdos@suse.com" date="1568980801">- testsuite only for x86_64 [bsc#1146648]</changelog>
  <changelog author="pgajdos@suse.com" date="1587556800">- security update
- added patches
  fix CVE-2020-11762 [bsc#1169549], out-of-bounds read and write in DwaCompressor:uncompress in ImfDwaCompressor.cpp when handling the UNKNOWN compression case
  fix CVE-2020-11758 [bsc#1169573], out-of-bounds read in ImfOptimizedPixelReading.h.
  fix CVE-2020-11764 [bsc#1169574], out-of-bounds write in copyIntoFrameBuffer in ImfMisc.cpp
  fix CVE-2020-11765 [bsc#1169575], off-by-one error in use of the ImfXdr.h read function by DwaCompressor:Classifier:Classifier
  fix CVE-2020-11763 [bsc#1169576], out-of-bounds read and write, as demonstrated by ImfTileOffsets.cpp
  fix CVE-2020-11761 [bsc#1169578], out-of-bounds read during Huffman uncompression, as demonstrated by FastHufDecoder:refill in ImfFastHuf.cpp
  fix CVE-2020-11760 [bsc#1169580], out-of-bounds read during RLE uncompression in rleUncompress in ImfRle.cpp
  + openexr-CVE-2020-11762,11758,11764,11765,11763,11761,11760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1593604800">- security update
- added patches
  fix CVE-2020-15304 [bsc#1173466], NULL pointer dereference in TiledInputFile:TiledInputFile()
  + openexr-CVE-2020-15304.patch
  fix CVE-2020-15305 [bsc#1173467], use-after-free in DeepScanLineInputFile:DeepScanLineInputFile()
  + openexr-CVE-2020-15305.patch
  fix CVE-2020-15306 [bsc#1173469], invalid chunkCount attributes could cause a heap buffer overflow in getChunkOffsetTableSize()
  + openexr-CVE-2020-15306.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1608120000">- security update
- added patches
  fix CVE-2020-16587, CVE-2020-16588, CVE-2020-16589 [bsc#1179879], multiple memory safety issues
  + openexr-CVE-2020-16587.patch
  + openexr-CVE-2020-16588.patch
  + openexr-CVE-2020-16589.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1617192000">- security update
- added patches
  fix CVE-2021-3474 [bsc#1184174], Undefined-shift in Imf_2_5::FastHufDecoder::FastHufDecoder
  + openexr-CVE-2021-3474.patch
  fix CVE-2021-3475 [bsc#1184173], Integer-overflow in Imf_2_5::calculateNumTiles
  + openexr-CVE-2021-3475.patch
  fix CVE-2021-3476 [bsc#1184172], Undefined-shift in Imf_2_5::unpack14
  + openexr-CVE-2021-3476.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1617883200">- security update
- modified patches
  % openexr-CVE-2021-3474.patch (splitted into openexr-CVE-2021-20296.patch)
- added patches
  fix CVE-2021-20296 [bsc#1184355], Segv on unknown address in Imf_2_5:hufUncompress - Null Pointer dereference
  + openexr-CVE-2021-20296.patch
  fix CVE-2021-3477 [bsc#1184353], Heap-buffer-overflow in Imf_2_5::DeepTiledInputFile::readPixelSampleCounts
  + openexr-CVE-2021-3477.patch
  fix CVE-2021-3479 [bsc#1184354], Out-of-memory caused by allocation of a very large buffer
  + openexr-CVE-2021-3479.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1619524800">- security update
- added patches
  fix CVE-2021-23215 [bsc#1185216], Integer-overflow in Imf_2_5:DwaCompressor:initializeBuffers
  fix CVE-2021-26260 [bsc#1185217], Integer-overflow in Imf_2_5:DwaCompressor:initializeBuffers
  + openexr-CVE-2021-23215,26260.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623758400">- security update
- added patches
  fix CVE-2021-3598 [bsc#1187310], Heap buffer overflow in Imf_3_1:CharPtrIO:readChars
  + openexr-CVE-2021-3598.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623844800">- security update
- added patches
  fix CVE-2021-3605 [bsc#1187395], Heap buffer overflow in the rleUncompress function
  + openexr-CVE-2021-3605.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1627992000">- security update
- modified patches
  % openexr-CVE-2021-3476.patch (refreshed)
- added patches
  fix CVE-2021-20298 [bsc#1188460], Out-of-memory in B44Compressor
  + openexr-CVE-2021-20298.patch
  fix CVE-2021-20299 [bsc#1188459], Null-dereference READ in Imf_2_5:Header:operator
  + openexr-CVE-2021-20299.patch
  fix CVE-2021-20300 [bsc#1188458], Integer-overflow in Imf_2_5:hufUncompress
  + openexr-CVE-2021-20300.patch
  fix CVE-2021-20302 [bsc#1188462], Floating-point-exception in Imf_2_5:precalculateTileInfot
  + openexr-CVE-2021-20302.patch
  fix CVE-2021-20303 [bsc#1188457], Heap-buffer-overflow in Imf_2_5::copyIntoFrameBuffer
  + openexr-CVE-2021-20303.patch
  fix CVE-2021-20304 [bsc#1188461], Undefined-shift in Imf_2_5:hufDecode
  + openexr-CVE-2021-20304.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1636459200">- security update
- added patches
  fix CVE-2021-3933 [bsc#1192498], Integer-overflow in Imf_3_1:bytesPerDeepLineTable
  + openexr-CVE-2021-3933.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1636632000">- security update
- added patches
  fix CVE-2021-3941 [bsc#1192556], Divide-by-zero in Imf_3_1:RGBtoXYZ
  + openexr-CVE-2021-3941.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1641384000">- security update
- added patches
  fix CVE-2021-45942 [bsc#1194333], heap-based buffer overflow in Imf_3_1:LineCompositeTask:execute
  + openexr-CVE-2021-45942.patch</changelog>
</package>
<package pkgid="bf6c47033f20b7877b4964819be67ec03d7c36955b537424f59d8881d1509e99" name="openexr-devel" arch="x86_64">
  <version epoch="0" ver="2.2.1" rel="3.41.1"/>
  <changelog author="tchvatal@suse.com" date="1499860800">- Cleanup a bit with spec-cleaner</changelog>
  <changelog author="avindra@opensuse.org" date="1516017600">- Update to 2.2.1
  * Fix reported OpenEXR security vulnerabilities: CVE-2017-9110,
    CVE-2017-9111, CVE-2017-9112, CVE-2017-9113, CVE-2017-9114,
    CVE-2017-9115 and CVE-2017-9116
- pgajdos@suse.com: but really seem to fix only:
  CVE-2017-9110 [bsc#1040107], CVE-2017-9114 [bsc#1040114],
  CVE-2017-9116 [bsc#1040116], CVE-2017-12596 [bsc#1052522]; for
  the rest of issues see [bsc#1040109], [bsc#1040112],
  [bsc#1040113], [bsc#1040114], [bsc#1040115], and [bsc#1061305]</changelog>
  <changelog author="pgajdos@suse.com" date="1541505600">- asan_build: build ASAN included
- debug_build: build more suitable for debugging</changelog>
  <changelog author="pgajdos@suse.com" date="1541592000">- security update
  * CVE-2018-18444 [bsc#1113455]
    + openexr-CVE-2018-18444.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1560513600">- security update
- added patches
  CVE-2017-9111 [bsc#1040109], CVE-2017-9113 [bsc#1040113], CVE-2017-9115 [bsc#1040115]
  + openexr-CVE-2017-9111,9113,9115.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1563192000">- security update
- added patches
  CVE-2017-14988 [bsc#1061305]
  + openexr-CVE-2017-14988.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1568980800">- on behalf of Martin Pluskal:
- Enable tests on architectures with enough memory - boo#1146648
  * disable imffuzztest as it takes to much resources</changelog>
  <changelog author="pgajdos@suse.com" date="1568980801">- testsuite only for x86_64 [bsc#1146648]</changelog>
  <changelog author="pgajdos@suse.com" date="1587556800">- security update
- added patches
  fix CVE-2020-11762 [bsc#1169549], out-of-bounds read and write in DwaCompressor:uncompress in ImfDwaCompressor.cpp when handling the UNKNOWN compression case
  fix CVE-2020-11758 [bsc#1169573], out-of-bounds read in ImfOptimizedPixelReading.h.
  fix CVE-2020-11764 [bsc#1169574], out-of-bounds write in copyIntoFrameBuffer in ImfMisc.cpp
  fix CVE-2020-11765 [bsc#1169575], off-by-one error in use of the ImfXdr.h read function by DwaCompressor:Classifier:Classifier
  fix CVE-2020-11763 [bsc#1169576], out-of-bounds read and write, as demonstrated by ImfTileOffsets.cpp
  fix CVE-2020-11761 [bsc#1169578], out-of-bounds read during Huffman uncompression, as demonstrated by FastHufDecoder:refill in ImfFastHuf.cpp
  fix CVE-2020-11760 [bsc#1169580], out-of-bounds read during RLE uncompression in rleUncompress in ImfRle.cpp
  + openexr-CVE-2020-11762,11758,11764,11765,11763,11761,11760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1593604800">- security update
- added patches
  fix CVE-2020-15304 [bsc#1173466], NULL pointer dereference in TiledInputFile:TiledInputFile()
  + openexr-CVE-2020-15304.patch
  fix CVE-2020-15305 [bsc#1173467], use-after-free in DeepScanLineInputFile:DeepScanLineInputFile()
  + openexr-CVE-2020-15305.patch
  fix CVE-2020-15306 [bsc#1173469], invalid chunkCount attributes could cause a heap buffer overflow in getChunkOffsetTableSize()
  + openexr-CVE-2020-15306.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1608120000">- security update
- added patches
  fix CVE-2020-16587, CVE-2020-16588, CVE-2020-16589 [bsc#1179879], multiple memory safety issues
  + openexr-CVE-2020-16587.patch
  + openexr-CVE-2020-16588.patch
  + openexr-CVE-2020-16589.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1617192000">- security update
- added patches
  fix CVE-2021-3474 [bsc#1184174], Undefined-shift in Imf_2_5::FastHufDecoder::FastHufDecoder
  + openexr-CVE-2021-3474.patch
  fix CVE-2021-3475 [bsc#1184173], Integer-overflow in Imf_2_5::calculateNumTiles
  + openexr-CVE-2021-3475.patch
  fix CVE-2021-3476 [bsc#1184172], Undefined-shift in Imf_2_5::unpack14
  + openexr-CVE-2021-3476.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1617883200">- security update
- modified patches
  % openexr-CVE-2021-3474.patch (splitted into openexr-CVE-2021-20296.patch)
- added patches
  fix CVE-2021-20296 [bsc#1184355], Segv on unknown address in Imf_2_5:hufUncompress - Null Pointer dereference
  + openexr-CVE-2021-20296.patch
  fix CVE-2021-3477 [bsc#1184353], Heap-buffer-overflow in Imf_2_5::DeepTiledInputFile::readPixelSampleCounts
  + openexr-CVE-2021-3477.patch
  fix CVE-2021-3479 [bsc#1184354], Out-of-memory caused by allocation of a very large buffer
  + openexr-CVE-2021-3479.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1619524800">- security update
- added patches
  fix CVE-2021-23215 [bsc#1185216], Integer-overflow in Imf_2_5:DwaCompressor:initializeBuffers
  fix CVE-2021-26260 [bsc#1185217], Integer-overflow in Imf_2_5:DwaCompressor:initializeBuffers
  + openexr-CVE-2021-23215,26260.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623758400">- security update
- added patches
  fix CVE-2021-3598 [bsc#1187310], Heap buffer overflow in Imf_3_1:CharPtrIO:readChars
  + openexr-CVE-2021-3598.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623844800">- security update
- added patches
  fix CVE-2021-3605 [bsc#1187395], Heap buffer overflow in the rleUncompress function
  + openexr-CVE-2021-3605.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1627992000">- security update
- modified patches
  % openexr-CVE-2021-3476.patch (refreshed)
- added patches
  fix CVE-2021-20298 [bsc#1188460], Out-of-memory in B44Compressor
  + openexr-CVE-2021-20298.patch
  fix CVE-2021-20299 [bsc#1188459], Null-dereference READ in Imf_2_5:Header:operator
  + openexr-CVE-2021-20299.patch
  fix CVE-2021-20300 [bsc#1188458], Integer-overflow in Imf_2_5:hufUncompress
  + openexr-CVE-2021-20300.patch
  fix CVE-2021-20302 [bsc#1188462], Floating-point-exception in Imf_2_5:precalculateTileInfot
  + openexr-CVE-2021-20302.patch
  fix CVE-2021-20303 [bsc#1188457], Heap-buffer-overflow in Imf_2_5::copyIntoFrameBuffer
  + openexr-CVE-2021-20303.patch
  fix CVE-2021-20304 [bsc#1188461], Undefined-shift in Imf_2_5:hufDecode
  + openexr-CVE-2021-20304.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1636459200">- security update
- added patches
  fix CVE-2021-3933 [bsc#1192498], Integer-overflow in Imf_3_1:bytesPerDeepLineTable
  + openexr-CVE-2021-3933.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1636632000">- security update
- added patches
  fix CVE-2021-3941 [bsc#1192556], Divide-by-zero in Imf_3_1:RGBtoXYZ
  + openexr-CVE-2021-3941.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1641384000">- security update
- added patches
  fix CVE-2021-45942 [bsc#1194333], heap-based buffer overflow in Imf_3_1:LineCompositeTask:execute
  + openexr-CVE-2021-45942.patch</changelog>
</package>
<package pkgid="9eba3b21444f3abcd60726dc898d03e984e1a5cbd00b1a17839e79bee09b8ee5" name="openexr-doc" arch="aarch64">
  <version epoch="0" ver="2.2.1" rel="3.41.1"/>
  <changelog author="tchvatal@suse.com" date="1499860800">- Cleanup a bit with spec-cleaner</changelog>
  <changelog author="avindra@opensuse.org" date="1516017600">- Update to 2.2.1
  * Fix reported OpenEXR security vulnerabilities: CVE-2017-9110,
    CVE-2017-9111, CVE-2017-9112, CVE-2017-9113, CVE-2017-9114,
    CVE-2017-9115 and CVE-2017-9116
- pgajdos@suse.com: but really seem to fix only:
  CVE-2017-9110 [bsc#1040107], CVE-2017-9114 [bsc#1040114],
  CVE-2017-9116 [bsc#1040116], CVE-2017-12596 [bsc#1052522]; for
  the rest of issues see [bsc#1040109], [bsc#1040112],
  [bsc#1040113], [bsc#1040114], [bsc#1040115], and [bsc#1061305]</changelog>
  <changelog author="pgajdos@suse.com" date="1541505600">- asan_build: build ASAN included
- debug_build: build more suitable for debugging</changelog>
  <changelog author="pgajdos@suse.com" date="1541592000">- security update
  * CVE-2018-18444 [bsc#1113455]
    + openexr-CVE-2018-18444.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1560513600">- security update
- added patches
  CVE-2017-9111 [bsc#1040109], CVE-2017-9113 [bsc#1040113], CVE-2017-9115 [bsc#1040115]
  + openexr-CVE-2017-9111,9113,9115.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1563192000">- security update
- added patches
  CVE-2017-14988 [bsc#1061305]
  + openexr-CVE-2017-14988.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1568980800">- on behalf of Martin Pluskal:
- Enable tests on architectures with enough memory - boo#1146648
  * disable imffuzztest as it takes to much resources</changelog>
  <changelog author="pgajdos@suse.com" date="1568980801">- testsuite only for x86_64 [bsc#1146648]</changelog>
  <changelog author="pgajdos@suse.com" date="1587556800">- security update
- added patches
  fix CVE-2020-11762 [bsc#1169549], out-of-bounds read and write in DwaCompressor:uncompress in ImfDwaCompressor.cpp when handling the UNKNOWN compression case
  fix CVE-2020-11758 [bsc#1169573], out-of-bounds read in ImfOptimizedPixelReading.h.
  fix CVE-2020-11764 [bsc#1169574], out-of-bounds write in copyIntoFrameBuffer in ImfMisc.cpp
  fix CVE-2020-11765 [bsc#1169575], off-by-one error in use of the ImfXdr.h read function by DwaCompressor:Classifier:Classifier
  fix CVE-2020-11763 [bsc#1169576], out-of-bounds read and write, as demonstrated by ImfTileOffsets.cpp
  fix CVE-2020-11761 [bsc#1169578], out-of-bounds read during Huffman uncompression, as demonstrated by FastHufDecoder:refill in ImfFastHuf.cpp
  fix CVE-2020-11760 [bsc#1169580], out-of-bounds read during RLE uncompression in rleUncompress in ImfRle.cpp
  + openexr-CVE-2020-11762,11758,11764,11765,11763,11761,11760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1593604800">- security update
- added patches
  fix CVE-2020-15304 [bsc#1173466], NULL pointer dereference in TiledInputFile:TiledInputFile()
  + openexr-CVE-2020-15304.patch
  fix CVE-2020-15305 [bsc#1173467], use-after-free in DeepScanLineInputFile:DeepScanLineInputFile()
  + openexr-CVE-2020-15305.patch
  fix CVE-2020-15306 [bsc#1173469], invalid chunkCount attributes could cause a heap buffer overflow in getChunkOffsetTableSize()
  + openexr-CVE-2020-15306.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1608120000">- security update
- added patches
  fix CVE-2020-16587, CVE-2020-16588, CVE-2020-16589 [bsc#1179879], multiple memory safety issues
  + openexr-CVE-2020-16587.patch
  + openexr-CVE-2020-16588.patch
  + openexr-CVE-2020-16589.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1617192000">- security update
- added patches
  fix CVE-2021-3474 [bsc#1184174], Undefined-shift in Imf_2_5::FastHufDecoder::FastHufDecoder
  + openexr-CVE-2021-3474.patch
  fix CVE-2021-3475 [bsc#1184173], Integer-overflow in Imf_2_5::calculateNumTiles
  + openexr-CVE-2021-3475.patch
  fix CVE-2021-3476 [bsc#1184172], Undefined-shift in Imf_2_5::unpack14
  + openexr-CVE-2021-3476.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1617883200">- security update
- modified patches
  % openexr-CVE-2021-3474.patch (splitted into openexr-CVE-2021-20296.patch)
- added patches
  fix CVE-2021-20296 [bsc#1184355], Segv on unknown address in Imf_2_5:hufUncompress - Null Pointer dereference
  + openexr-CVE-2021-20296.patch
  fix CVE-2021-3477 [bsc#1184353], Heap-buffer-overflow in Imf_2_5::DeepTiledInputFile::readPixelSampleCounts
  + openexr-CVE-2021-3477.patch
  fix CVE-2021-3479 [bsc#1184354], Out-of-memory caused by allocation of a very large buffer
  + openexr-CVE-2021-3479.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1619524800">- security update
- added patches
  fix CVE-2021-23215 [bsc#1185216], Integer-overflow in Imf_2_5:DwaCompressor:initializeBuffers
  fix CVE-2021-26260 [bsc#1185217], Integer-overflow in Imf_2_5:DwaCompressor:initializeBuffers
  + openexr-CVE-2021-23215,26260.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623758400">- security update
- added patches
  fix CVE-2021-3598 [bsc#1187310], Heap buffer overflow in Imf_3_1:CharPtrIO:readChars
  + openexr-CVE-2021-3598.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623844800">- security update
- added patches
  fix CVE-2021-3605 [bsc#1187395], Heap buffer overflow in the rleUncompress function
  + openexr-CVE-2021-3605.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1627992000">- security update
- modified patches
  % openexr-CVE-2021-3476.patch (refreshed)
- added patches
  fix CVE-2021-20298 [bsc#1188460], Out-of-memory in B44Compressor
  + openexr-CVE-2021-20298.patch
  fix CVE-2021-20299 [bsc#1188459], Null-dereference READ in Imf_2_5:Header:operator
  + openexr-CVE-2021-20299.patch
  fix CVE-2021-20300 [bsc#1188458], Integer-overflow in Imf_2_5:hufUncompress
  + openexr-CVE-2021-20300.patch
  fix CVE-2021-20302 [bsc#1188462], Floating-point-exception in Imf_2_5:precalculateTileInfot
  + openexr-CVE-2021-20302.patch
  fix CVE-2021-20303 [bsc#1188457], Heap-buffer-overflow in Imf_2_5::copyIntoFrameBuffer
  + openexr-CVE-2021-20303.patch
  fix CVE-2021-20304 [bsc#1188461], Undefined-shift in Imf_2_5:hufDecode
  + openexr-CVE-2021-20304.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1636459200">- security update
- added patches
  fix CVE-2021-3933 [bsc#1192498], Integer-overflow in Imf_3_1:bytesPerDeepLineTable
  + openexr-CVE-2021-3933.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1636632000">- security update
- added patches
  fix CVE-2021-3941 [bsc#1192556], Divide-by-zero in Imf_3_1:RGBtoXYZ
  + openexr-CVE-2021-3941.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1641384000">- security update
- added patches
  fix CVE-2021-45942 [bsc#1194333], heap-based buffer overflow in Imf_3_1:LineCompositeTask:execute
  + openexr-CVE-2021-45942.patch</changelog>
</package>
<package pkgid="1f1eddc2f7e9816b9ca7577977eaf8a540c0c2a8f8cf66eb2e3a9a2fc16794bb" name="openexr-doc" arch="ppc64le">
  <version epoch="0" ver="2.2.1" rel="3.41.1"/>
  <changelog author="tchvatal@suse.com" date="1499860800">- Cleanup a bit with spec-cleaner</changelog>
  <changelog author="avindra@opensuse.org" date="1516017600">- Update to 2.2.1
  * Fix reported OpenEXR security vulnerabilities: CVE-2017-9110,
    CVE-2017-9111, CVE-2017-9112, CVE-2017-9113, CVE-2017-9114,
    CVE-2017-9115 and CVE-2017-9116
- pgajdos@suse.com: but really seem to fix only:
  CVE-2017-9110 [bsc#1040107], CVE-2017-9114 [bsc#1040114],
  CVE-2017-9116 [bsc#1040116], CVE-2017-12596 [bsc#1052522]; for
  the rest of issues see [bsc#1040109], [bsc#1040112],
  [bsc#1040113], [bsc#1040114], [bsc#1040115], and [bsc#1061305]</changelog>
  <changelog author="pgajdos@suse.com" date="1541505600">- asan_build: build ASAN included
- debug_build: build more suitable for debugging</changelog>
  <changelog author="pgajdos@suse.com" date="1541592000">- security update
  * CVE-2018-18444 [bsc#1113455]
    + openexr-CVE-2018-18444.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1560513600">- security update
- added patches
  CVE-2017-9111 [bsc#1040109], CVE-2017-9113 [bsc#1040113], CVE-2017-9115 [bsc#1040115]
  + openexr-CVE-2017-9111,9113,9115.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1563192000">- security update
- added patches
  CVE-2017-14988 [bsc#1061305]
  + openexr-CVE-2017-14988.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1568980800">- on behalf of Martin Pluskal:
- Enable tests on architectures with enough memory - boo#1146648
  * disable imffuzztest as it takes to much resources</changelog>
  <changelog author="pgajdos@suse.com" date="1568980801">- testsuite only for x86_64 [bsc#1146648]</changelog>
  <changelog author="pgajdos@suse.com" date="1587556800">- security update
- added patches
  fix CVE-2020-11762 [bsc#1169549], out-of-bounds read and write in DwaCompressor:uncompress in ImfDwaCompressor.cpp when handling the UNKNOWN compression case
  fix CVE-2020-11758 [bsc#1169573], out-of-bounds read in ImfOptimizedPixelReading.h.
  fix CVE-2020-11764 [bsc#1169574], out-of-bounds write in copyIntoFrameBuffer in ImfMisc.cpp
  fix CVE-2020-11765 [bsc#1169575], off-by-one error in use of the ImfXdr.h read function by DwaCompressor:Classifier:Classifier
  fix CVE-2020-11763 [bsc#1169576], out-of-bounds read and write, as demonstrated by ImfTileOffsets.cpp
  fix CVE-2020-11761 [bsc#1169578], out-of-bounds read during Huffman uncompression, as demonstrated by FastHufDecoder:refill in ImfFastHuf.cpp
  fix CVE-2020-11760 [bsc#1169580], out-of-bounds read during RLE uncompression in rleUncompress in ImfRle.cpp
  + openexr-CVE-2020-11762,11758,11764,11765,11763,11761,11760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1593604800">- security update
- added patches
  fix CVE-2020-15304 [bsc#1173466], NULL pointer dereference in TiledInputFile:TiledInputFile()
  + openexr-CVE-2020-15304.patch
  fix CVE-2020-15305 [bsc#1173467], use-after-free in DeepScanLineInputFile:DeepScanLineInputFile()
  + openexr-CVE-2020-15305.patch
  fix CVE-2020-15306 [bsc#1173469], invalid chunkCount attributes could cause a heap buffer overflow in getChunkOffsetTableSize()
  + openexr-CVE-2020-15306.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1608120000">- security update
- added patches
  fix CVE-2020-16587, CVE-2020-16588, CVE-2020-16589 [bsc#1179879], multiple memory safety issues
  + openexr-CVE-2020-16587.patch
  + openexr-CVE-2020-16588.patch
  + openexr-CVE-2020-16589.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1617192000">- security update
- added patches
  fix CVE-2021-3474 [bsc#1184174], Undefined-shift in Imf_2_5::FastHufDecoder::FastHufDecoder
  + openexr-CVE-2021-3474.patch
  fix CVE-2021-3475 [bsc#1184173], Integer-overflow in Imf_2_5::calculateNumTiles
  + openexr-CVE-2021-3475.patch
  fix CVE-2021-3476 [bsc#1184172], Undefined-shift in Imf_2_5::unpack14
  + openexr-CVE-2021-3476.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1617883200">- security update
- modified patches
  % openexr-CVE-2021-3474.patch (splitted into openexr-CVE-2021-20296.patch)
- added patches
  fix CVE-2021-20296 [bsc#1184355], Segv on unknown address in Imf_2_5:hufUncompress - Null Pointer dereference
  + openexr-CVE-2021-20296.patch
  fix CVE-2021-3477 [bsc#1184353], Heap-buffer-overflow in Imf_2_5::DeepTiledInputFile::readPixelSampleCounts
  + openexr-CVE-2021-3477.patch
  fix CVE-2021-3479 [bsc#1184354], Out-of-memory caused by allocation of a very large buffer
  + openexr-CVE-2021-3479.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1619524800">- security update
- added patches
  fix CVE-2021-23215 [bsc#1185216], Integer-overflow in Imf_2_5:DwaCompressor:initializeBuffers
  fix CVE-2021-26260 [bsc#1185217], Integer-overflow in Imf_2_5:DwaCompressor:initializeBuffers
  + openexr-CVE-2021-23215,26260.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623758400">- security update
- added patches
  fix CVE-2021-3598 [bsc#1187310], Heap buffer overflow in Imf_3_1:CharPtrIO:readChars
  + openexr-CVE-2021-3598.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623844800">- security update
- added patches
  fix CVE-2021-3605 [bsc#1187395], Heap buffer overflow in the rleUncompress function
  + openexr-CVE-2021-3605.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1627992000">- security update
- modified patches
  % openexr-CVE-2021-3476.patch (refreshed)
- added patches
  fix CVE-2021-20298 [bsc#1188460], Out-of-memory in B44Compressor
  + openexr-CVE-2021-20298.patch
  fix CVE-2021-20299 [bsc#1188459], Null-dereference READ in Imf_2_5:Header:operator
  + openexr-CVE-2021-20299.patch
  fix CVE-2021-20300 [bsc#1188458], Integer-overflow in Imf_2_5:hufUncompress
  + openexr-CVE-2021-20300.patch
  fix CVE-2021-20302 [bsc#1188462], Floating-point-exception in Imf_2_5:precalculateTileInfot
  + openexr-CVE-2021-20302.patch
  fix CVE-2021-20303 [bsc#1188457], Heap-buffer-overflow in Imf_2_5::copyIntoFrameBuffer
  + openexr-CVE-2021-20303.patch
  fix CVE-2021-20304 [bsc#1188461], Undefined-shift in Imf_2_5:hufDecode
  + openexr-CVE-2021-20304.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1636459200">- security update
- added patches
  fix CVE-2021-3933 [bsc#1192498], Integer-overflow in Imf_3_1:bytesPerDeepLineTable
  + openexr-CVE-2021-3933.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1636632000">- security update
- added patches
  fix CVE-2021-3941 [bsc#1192556], Divide-by-zero in Imf_3_1:RGBtoXYZ
  + openexr-CVE-2021-3941.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1641384000">- security update
- added patches
  fix CVE-2021-45942 [bsc#1194333], heap-based buffer overflow in Imf_3_1:LineCompositeTask:execute
  + openexr-CVE-2021-45942.patch</changelog>
</package>
<package pkgid="81a0078dcd8ca9f7cd48f0c4651b07b4c4eebf1bbe73b0f2bebc83044b0356fc" name="openexr-doc" arch="s390x">
  <version epoch="0" ver="2.2.1" rel="3.41.1"/>
  <changelog author="tchvatal@suse.com" date="1499860800">- Cleanup a bit with spec-cleaner</changelog>
  <changelog author="avindra@opensuse.org" date="1516017600">- Update to 2.2.1
  * Fix reported OpenEXR security vulnerabilities: CVE-2017-9110,
    CVE-2017-9111, CVE-2017-9112, CVE-2017-9113, CVE-2017-9114,
    CVE-2017-9115 and CVE-2017-9116
- pgajdos@suse.com: but really seem to fix only:
  CVE-2017-9110 [bsc#1040107], CVE-2017-9114 [bsc#1040114],
  CVE-2017-9116 [bsc#1040116], CVE-2017-12596 [bsc#1052522]; for
  the rest of issues see [bsc#1040109], [bsc#1040112],
  [bsc#1040113], [bsc#1040114], [bsc#1040115], and [bsc#1061305]</changelog>
  <changelog author="pgajdos@suse.com" date="1541505600">- asan_build: build ASAN included
- debug_build: build more suitable for debugging</changelog>
  <changelog author="pgajdos@suse.com" date="1541592000">- security update
  * CVE-2018-18444 [bsc#1113455]
    + openexr-CVE-2018-18444.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1560513600">- security update
- added patches
  CVE-2017-9111 [bsc#1040109], CVE-2017-9113 [bsc#1040113], CVE-2017-9115 [bsc#1040115]
  + openexr-CVE-2017-9111,9113,9115.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1563192000">- security update
- added patches
  CVE-2017-14988 [bsc#1061305]
  + openexr-CVE-2017-14988.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1568980800">- on behalf of Martin Pluskal:
- Enable tests on architectures with enough memory - boo#1146648
  * disable imffuzztest as it takes to much resources</changelog>
  <changelog author="pgajdos@suse.com" date="1568980801">- testsuite only for x86_64 [bsc#1146648]</changelog>
  <changelog author="pgajdos@suse.com" date="1587556800">- security update
- added patches
  fix CVE-2020-11762 [bsc#1169549], out-of-bounds read and write in DwaCompressor:uncompress in ImfDwaCompressor.cpp when handling the UNKNOWN compression case
  fix CVE-2020-11758 [bsc#1169573], out-of-bounds read in ImfOptimizedPixelReading.h.
  fix CVE-2020-11764 [bsc#1169574], out-of-bounds write in copyIntoFrameBuffer in ImfMisc.cpp
  fix CVE-2020-11765 [bsc#1169575], off-by-one error in use of the ImfXdr.h read function by DwaCompressor:Classifier:Classifier
  fix CVE-2020-11763 [bsc#1169576], out-of-bounds read and write, as demonstrated by ImfTileOffsets.cpp
  fix CVE-2020-11761 [bsc#1169578], out-of-bounds read during Huffman uncompression, as demonstrated by FastHufDecoder:refill in ImfFastHuf.cpp
  fix CVE-2020-11760 [bsc#1169580], out-of-bounds read during RLE uncompression in rleUncompress in ImfRle.cpp
  + openexr-CVE-2020-11762,11758,11764,11765,11763,11761,11760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1593604800">- security update
- added patches
  fix CVE-2020-15304 [bsc#1173466], NULL pointer dereference in TiledInputFile:TiledInputFile()
  + openexr-CVE-2020-15304.patch
  fix CVE-2020-15305 [bsc#1173467], use-after-free in DeepScanLineInputFile:DeepScanLineInputFile()
  + openexr-CVE-2020-15305.patch
  fix CVE-2020-15306 [bsc#1173469], invalid chunkCount attributes could cause a heap buffer overflow in getChunkOffsetTableSize()
  + openexr-CVE-2020-15306.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1608120000">- security update
- added patches
  fix CVE-2020-16587, CVE-2020-16588, CVE-2020-16589 [bsc#1179879], multiple memory safety issues
  + openexr-CVE-2020-16587.patch
  + openexr-CVE-2020-16588.patch
  + openexr-CVE-2020-16589.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1617192000">- security update
- added patches
  fix CVE-2021-3474 [bsc#1184174], Undefined-shift in Imf_2_5::FastHufDecoder::FastHufDecoder
  + openexr-CVE-2021-3474.patch
  fix CVE-2021-3475 [bsc#1184173], Integer-overflow in Imf_2_5::calculateNumTiles
  + openexr-CVE-2021-3475.patch
  fix CVE-2021-3476 [bsc#1184172], Undefined-shift in Imf_2_5::unpack14
  + openexr-CVE-2021-3476.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1617883200">- security update
- modified patches
  % openexr-CVE-2021-3474.patch (splitted into openexr-CVE-2021-20296.patch)
- added patches
  fix CVE-2021-20296 [bsc#1184355], Segv on unknown address in Imf_2_5:hufUncompress - Null Pointer dereference
  + openexr-CVE-2021-20296.patch
  fix CVE-2021-3477 [bsc#1184353], Heap-buffer-overflow in Imf_2_5::DeepTiledInputFile::readPixelSampleCounts
  + openexr-CVE-2021-3477.patch
  fix CVE-2021-3479 [bsc#1184354], Out-of-memory caused by allocation of a very large buffer
  + openexr-CVE-2021-3479.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1619524800">- security update
- added patches
  fix CVE-2021-23215 [bsc#1185216], Integer-overflow in Imf_2_5:DwaCompressor:initializeBuffers
  fix CVE-2021-26260 [bsc#1185217], Integer-overflow in Imf_2_5:DwaCompressor:initializeBuffers
  + openexr-CVE-2021-23215,26260.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623758400">- security update
- added patches
  fix CVE-2021-3598 [bsc#1187310], Heap buffer overflow in Imf_3_1:CharPtrIO:readChars
  + openexr-CVE-2021-3598.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623844800">- security update
- added patches
  fix CVE-2021-3605 [bsc#1187395], Heap buffer overflow in the rleUncompress function
  + openexr-CVE-2021-3605.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1627992000">- security update
- modified patches
  % openexr-CVE-2021-3476.patch (refreshed)
- added patches
  fix CVE-2021-20298 [bsc#1188460], Out-of-memory in B44Compressor
  + openexr-CVE-2021-20298.patch
  fix CVE-2021-20299 [bsc#1188459], Null-dereference READ in Imf_2_5:Header:operator
  + openexr-CVE-2021-20299.patch
  fix CVE-2021-20300 [bsc#1188458], Integer-overflow in Imf_2_5:hufUncompress
  + openexr-CVE-2021-20300.patch
  fix CVE-2021-20302 [bsc#1188462], Floating-point-exception in Imf_2_5:precalculateTileInfot
  + openexr-CVE-2021-20302.patch
  fix CVE-2021-20303 [bsc#1188457], Heap-buffer-overflow in Imf_2_5::copyIntoFrameBuffer
  + openexr-CVE-2021-20303.patch
  fix CVE-2021-20304 [bsc#1188461], Undefined-shift in Imf_2_5:hufDecode
  + openexr-CVE-2021-20304.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1636459200">- security update
- added patches
  fix CVE-2021-3933 [bsc#1192498], Integer-overflow in Imf_3_1:bytesPerDeepLineTable
  + openexr-CVE-2021-3933.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1636632000">- security update
- added patches
  fix CVE-2021-3941 [bsc#1192556], Divide-by-zero in Imf_3_1:RGBtoXYZ
  + openexr-CVE-2021-3941.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1641384000">- security update
- added patches
  fix CVE-2021-45942 [bsc#1194333], heap-based buffer overflow in Imf_3_1:LineCompositeTask:execute
  + openexr-CVE-2021-45942.patch</changelog>
</package>
<package pkgid="b0fbba3e2bdf745f57b4db2455b37b6a166775600377592dac8eeaf98a46c267" name="openexr-doc" arch="x86_64">
  <version epoch="0" ver="2.2.1" rel="3.41.1"/>
  <changelog author="tchvatal@suse.com" date="1499860800">- Cleanup a bit with spec-cleaner</changelog>
  <changelog author="avindra@opensuse.org" date="1516017600">- Update to 2.2.1
  * Fix reported OpenEXR security vulnerabilities: CVE-2017-9110,
    CVE-2017-9111, CVE-2017-9112, CVE-2017-9113, CVE-2017-9114,
    CVE-2017-9115 and CVE-2017-9116
- pgajdos@suse.com: but really seem to fix only:
  CVE-2017-9110 [bsc#1040107], CVE-2017-9114 [bsc#1040114],
  CVE-2017-9116 [bsc#1040116], CVE-2017-12596 [bsc#1052522]; for
  the rest of issues see [bsc#1040109], [bsc#1040112],
  [bsc#1040113], [bsc#1040114], [bsc#1040115], and [bsc#1061305]</changelog>
  <changelog author="pgajdos@suse.com" date="1541505600">- asan_build: build ASAN included
- debug_build: build more suitable for debugging</changelog>
  <changelog author="pgajdos@suse.com" date="1541592000">- security update
  * CVE-2018-18444 [bsc#1113455]
    + openexr-CVE-2018-18444.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1560513600">- security update
- added patches
  CVE-2017-9111 [bsc#1040109], CVE-2017-9113 [bsc#1040113], CVE-2017-9115 [bsc#1040115]
  + openexr-CVE-2017-9111,9113,9115.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1563192000">- security update
- added patches
  CVE-2017-14988 [bsc#1061305]
  + openexr-CVE-2017-14988.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1568980800">- on behalf of Martin Pluskal:
- Enable tests on architectures with enough memory - boo#1146648
  * disable imffuzztest as it takes to much resources</changelog>
  <changelog author="pgajdos@suse.com" date="1568980801">- testsuite only for x86_64 [bsc#1146648]</changelog>
  <changelog author="pgajdos@suse.com" date="1587556800">- security update
- added patches
  fix CVE-2020-11762 [bsc#1169549], out-of-bounds read and write in DwaCompressor:uncompress in ImfDwaCompressor.cpp when handling the UNKNOWN compression case
  fix CVE-2020-11758 [bsc#1169573], out-of-bounds read in ImfOptimizedPixelReading.h.
  fix CVE-2020-11764 [bsc#1169574], out-of-bounds write in copyIntoFrameBuffer in ImfMisc.cpp
  fix CVE-2020-11765 [bsc#1169575], off-by-one error in use of the ImfXdr.h read function by DwaCompressor:Classifier:Classifier
  fix CVE-2020-11763 [bsc#1169576], out-of-bounds read and write, as demonstrated by ImfTileOffsets.cpp
  fix CVE-2020-11761 [bsc#1169578], out-of-bounds read during Huffman uncompression, as demonstrated by FastHufDecoder:refill in ImfFastHuf.cpp
  fix CVE-2020-11760 [bsc#1169580], out-of-bounds read during RLE uncompression in rleUncompress in ImfRle.cpp
  + openexr-CVE-2020-11762,11758,11764,11765,11763,11761,11760.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1593604800">- security update
- added patches
  fix CVE-2020-15304 [bsc#1173466], NULL pointer dereference in TiledInputFile:TiledInputFile()
  + openexr-CVE-2020-15304.patch
  fix CVE-2020-15305 [bsc#1173467], use-after-free in DeepScanLineInputFile:DeepScanLineInputFile()
  + openexr-CVE-2020-15305.patch
  fix CVE-2020-15306 [bsc#1173469], invalid chunkCount attributes could cause a heap buffer overflow in getChunkOffsetTableSize()
  + openexr-CVE-2020-15306.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1608120000">- security update
- added patches
  fix CVE-2020-16587, CVE-2020-16588, CVE-2020-16589 [bsc#1179879], multiple memory safety issues
  + openexr-CVE-2020-16587.patch
  + openexr-CVE-2020-16588.patch
  + openexr-CVE-2020-16589.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1617192000">- security update
- added patches
  fix CVE-2021-3474 [bsc#1184174], Undefined-shift in Imf_2_5::FastHufDecoder::FastHufDecoder
  + openexr-CVE-2021-3474.patch
  fix CVE-2021-3475 [bsc#1184173], Integer-overflow in Imf_2_5::calculateNumTiles
  + openexr-CVE-2021-3475.patch
  fix CVE-2021-3476 [bsc#1184172], Undefined-shift in Imf_2_5::unpack14
  + openexr-CVE-2021-3476.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1617883200">- security update
- modified patches
  % openexr-CVE-2021-3474.patch (splitted into openexr-CVE-2021-20296.patch)
- added patches
  fix CVE-2021-20296 [bsc#1184355], Segv on unknown address in Imf_2_5:hufUncompress - Null Pointer dereference
  + openexr-CVE-2021-20296.patch
  fix CVE-2021-3477 [bsc#1184353], Heap-buffer-overflow in Imf_2_5::DeepTiledInputFile::readPixelSampleCounts
  + openexr-CVE-2021-3477.patch
  fix CVE-2021-3479 [bsc#1184354], Out-of-memory caused by allocation of a very large buffer
  + openexr-CVE-2021-3479.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1619524800">- security update
- added patches
  fix CVE-2021-23215 [bsc#1185216], Integer-overflow in Imf_2_5:DwaCompressor:initializeBuffers
  fix CVE-2021-26260 [bsc#1185217], Integer-overflow in Imf_2_5:DwaCompressor:initializeBuffers
  + openexr-CVE-2021-23215,26260.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623758400">- security update
- added patches
  fix CVE-2021-3598 [bsc#1187310], Heap buffer overflow in Imf_3_1:CharPtrIO:readChars
  + openexr-CVE-2021-3598.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623844800">- security update
- added patches
  fix CVE-2021-3605 [bsc#1187395], Heap buffer overflow in the rleUncompress function
  + openexr-CVE-2021-3605.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1627992000">- security update
- modified patches
  % openexr-CVE-2021-3476.patch (refreshed)
- added patches
  fix CVE-2021-20298 [bsc#1188460], Out-of-memory in B44Compressor
  + openexr-CVE-2021-20298.patch
  fix CVE-2021-20299 [bsc#1188459], Null-dereference READ in Imf_2_5:Header:operator
  + openexr-CVE-2021-20299.patch
  fix CVE-2021-20300 [bsc#1188458], Integer-overflow in Imf_2_5:hufUncompress
  + openexr-CVE-2021-20300.patch
  fix CVE-2021-20302 [bsc#1188462], Floating-point-exception in Imf_2_5:precalculateTileInfot
  + openexr-CVE-2021-20302.patch
  fix CVE-2021-20303 [bsc#1188457], Heap-buffer-overflow in Imf_2_5::copyIntoFrameBuffer
  + openexr-CVE-2021-20303.patch
  fix CVE-2021-20304 [bsc#1188461], Undefined-shift in Imf_2_5:hufDecode
  + openexr-CVE-2021-20304.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1636459200">- security update
- added patches
  fix CVE-2021-3933 [bsc#1192498], Integer-overflow in Imf_3_1:bytesPerDeepLineTable
  + openexr-CVE-2021-3933.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1636632000">- security update
- added patches
  fix CVE-2021-3941 [bsc#1192556], Divide-by-zero in Imf_3_1:RGBtoXYZ
  + openexr-CVE-2021-3941.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1641384000">- security update
- added patches
  fix CVE-2021-45942 [bsc#1194333], heap-based buffer overflow in Imf_3_1:LineCompositeTask:execute
  + openexr-CVE-2021-45942.patch</changelog>
</package>
<package pkgid="aa3071f236c2bceb88d6ed38358554efd1970bd0d03968ece6ef5c80ac4a3f68" name="perl-Crypt-DES" arch="aarch64">
  <version epoch="0" ver="2.07" rel="3.2.1"/>
  <changelog author="anicka@suse.cz" date="1136289600">- update to 2.05</changelog>
  <changelog author="mls@suse.de" date="1138190400">- converted neededforbuild to BuildRequires</changelog>
  <changelog author="jengelh@medozas.de" date="1263124800">- enable parallel build</changelog>
  <changelog author="coolo@novell.com" date="1287489600">- add perl as explicit buildrequire</changelog>
  <changelog author="chris@computersalat.de" date="1290600000">- recreated by cpanspec 1.78
  o fix deps</changelog>
  <changelog author="coolo@novell.com" date="1291204800">- switch to perl_requires macro</changelog>
  <changelog author="coolo@suse.com" date="1321617600">- use original .tar.gz</changelog>
  <changelog author="coolo@suse.com" date="1371816000">- add svupgrade.patch from RT#82943</changelog>
  <changelog author="coolo@suse.com" date="1374926400">- updated to 2.07
  SvUPGRADE was changed to a statement.
  a minor bug in META.yml was fixed.
- remove old svupgrade.patch</changelog>
  <changelog author="cfarrell@suse.com" date="1375099200">- license update: BSD-3-Clause
  See Copyright</changelog>
</package>
<package pkgid="ceb744d949a4ac240ae6bc1bd75aaaf12e89980ecf305df6825f346934642dcf" name="perl-Crypt-DES" arch="ppc64le">
  <version epoch="0" ver="2.07" rel="3.2.1"/>
  <changelog author="anicka@suse.cz" date="1136289600">- update to 2.05</changelog>
  <changelog author="mls@suse.de" date="1138190400">- converted neededforbuild to BuildRequires</changelog>
  <changelog author="jengelh@medozas.de" date="1263124800">- enable parallel build</changelog>
  <changelog author="coolo@novell.com" date="1287489600">- add perl as explicit buildrequire</changelog>
  <changelog author="chris@computersalat.de" date="1290600000">- recreated by cpanspec 1.78
  o fix deps</changelog>
  <changelog author="coolo@novell.com" date="1291204800">- switch to perl_requires macro</changelog>
  <changelog author="coolo@suse.com" date="1321617600">- use original .tar.gz</changelog>
  <changelog author="coolo@suse.com" date="1371816000">- add svupgrade.patch from RT#82943</changelog>
  <changelog author="coolo@suse.com" date="1374926400">- updated to 2.07
  SvUPGRADE was changed to a statement.
  a minor bug in META.yml was fixed.
- remove old svupgrade.patch</changelog>
  <changelog author="cfarrell@suse.com" date="1375099200">- license update: BSD-3-Clause
  See Copyright</changelog>
</package>
<package pkgid="9497425456e4d6f44529959ad267c4699e40d87c41848a6898a2b096869b8179" name="perl-Crypt-DES" arch="s390x">
  <version epoch="0" ver="2.07" rel="3.2.1"/>
  <changelog author="anicka@suse.cz" date="1136289600">- update to 2.05</changelog>
  <changelog author="mls@suse.de" date="1138190400">- converted neededforbuild to BuildRequires</changelog>
  <changelog author="jengelh@medozas.de" date="1263124800">- enable parallel build</changelog>
  <changelog author="coolo@novell.com" date="1287489600">- add perl as explicit buildrequire</changelog>
  <changelog author="chris@computersalat.de" date="1290600000">- recreated by cpanspec 1.78
  o fix deps</changelog>
  <changelog author="coolo@novell.com" date="1291204800">- switch to perl_requires macro</changelog>
  <changelog author="coolo@suse.com" date="1321617600">- use original .tar.gz</changelog>
  <changelog author="coolo@suse.com" date="1371816000">- add svupgrade.patch from RT#82943</changelog>
  <changelog author="coolo@suse.com" date="1374926400">- updated to 2.07
  SvUPGRADE was changed to a statement.
  a minor bug in META.yml was fixed.
- remove old svupgrade.patch</changelog>
  <changelog author="cfarrell@suse.com" date="1375099200">- license update: BSD-3-Clause
  See Copyright</changelog>
</package>
<package pkgid="7b8cf986bd94c3b54eba777ea6c02304788c7c170088eaef684989cb83b80e76" name="perl-Crypt-DES" arch="src">
  <version epoch="0" ver="2.07" rel="3.2.1"/>
  <changelog author="jantos@suse.cz" date="1015934400">- Package created</changelog>
  <changelog author="mls@suse.de" date="1025611200">- remove race in .packlist generation</changelog>
  <changelog author="mjancar@suse.cz" date="1053432000">- remove unpackaged files</changelog>
  <changelog author="mjancar@suse.cz" date="1054728000">- use $RPM_OPT_FLAGS
- add missing prototypes</changelog>
  <changelog author="mls@suse.de" date="1058184000">- fix build</changelog>
  <changelog author="ro@suse.de" date="1061380800">- remove perl-Crypt-CBC from neededforbuild (not really used)</changelog>
  <changelog author="mjancar@suse.cz" date="1061553600">- require the perl version we build with</changelog>
  <changelog author="adrian@suse.de" date="1073822400">- build as user</changelog>
  <changelog author="anicka@suse.cz" date="1136289600">- update to 2.05</changelog>
  <changelog author="mls@suse.de" date="1138190400">- converted neededforbuild to BuildRequires</changelog>
  <changelog author="jengelh@medozas.de" date="1263124800">- enable parallel build</changelog>
  <changelog author="coolo@novell.com" date="1287489600">- add perl as explicit buildrequire</changelog>
  <changelog author="chris@computersalat.de" date="1290600000">- recreated by cpanspec 1.78
  o fix deps</changelog>
  <changelog author="coolo@novell.com" date="1291204800">- switch to perl_requires macro</changelog>
  <changelog author="coolo@suse.com" date="1321617600">- use original .tar.gz</changelog>
  <changelog author="coolo@suse.com" date="1371816000">- add svupgrade.patch from RT#82943</changelog>
  <changelog author="coolo@suse.com" date="1374926400">- updated to 2.07
  SvUPGRADE was changed to a statement.
  a minor bug in META.yml was fixed.
- remove old svupgrade.patch</changelog>
  <changelog author="cfarrell@suse.com" date="1375099200">- license update: BSD-3-Clause
  See Copyright</changelog>
</package>
<package pkgid="d4e21a58c02b32d681076d744d1a19e3ed3c3f8352cbd3cfb243e49a36239805" name="perl-Crypt-DES" arch="x86_64">
  <version epoch="0" ver="2.07" rel="3.2.1"/>
  <changelog author="anicka@suse.cz" date="1136289600">- update to 2.05</changelog>
  <changelog author="mls@suse.de" date="1138190400">- converted neededforbuild to BuildRequires</changelog>
  <changelog author="jengelh@medozas.de" date="1263124800">- enable parallel build</changelog>
  <changelog author="coolo@novell.com" date="1287489600">- add perl as explicit buildrequire</changelog>
  <changelog author="chris@computersalat.de" date="1290600000">- recreated by cpanspec 1.78
  o fix deps</changelog>
  <changelog author="coolo@novell.com" date="1291204800">- switch to perl_requires macro</changelog>
  <changelog author="coolo@suse.com" date="1321617600">- use original .tar.gz</changelog>
  <changelog author="coolo@suse.com" date="1371816000">- add svupgrade.patch from RT#82943</changelog>
  <changelog author="coolo@suse.com" date="1374926400">- updated to 2.07
  SvUPGRADE was changed to a statement.
  a minor bug in META.yml was fixed.
- remove old svupgrade.patch</changelog>
  <changelog author="cfarrell@suse.com" date="1375099200">- license update: BSD-3-Clause
  See Copyright</changelog>
</package>
<package pkgid="0b51404f68dd87e5acefd9a7027bdaa66397bcf3e4443b101e3f7f3c3e22b873" name="perl-Crypt-Rijndael" arch="aarch64">
  <version epoch="0" ver="1.13" rel="3.2.1"/>
  <changelog author="chris@computersalat.de" date="1280232000">- initial package 1.09
  * created by cpanspec 1.78</changelog>
  <changelog author="coolo@novell.com" date="1291204800">- switch to perl_requires macro</changelog>
  <changelog author="coolo@suse.com" date="1321617600">- use original .tar.gz</changelog>
  <changelog author="coolo@suse.com" date="1370260800">- updated to 1.11
  * Clarify the license as LGPL v3 (29 June 2007) (RT 78629)
  * Add MirBSD support. It's the same options as Sun stuff.</changelog>
  <changelog author="i@marguerite.su" date="1392206400">- update version 1.12
  * Get rid of MYMETA</changelog>
  <changelog author="coolo@suse.com" date="1433419200">- updated to 1.13
  see /usr/share/doc/packages/perl-Crypt-Rijndael/Changes
  Revision history for Perl module Crypt::Rijndael</changelog>
  <changelog author="i@marguerite.su" date="1433851200">- automatic update wasn't right, license should be LGPL</changelog>
  <changelog author="i@marguerite.su" date="1434369600">- use cpanspec.yml to correct license automatically</changelog>
</package>
<package pkgid="f848b9f4cc02163463163bca9baeb38afa46b79d6db3ad7e35e76b38416cbdb8" name="perl-Crypt-Rijndael" arch="ppc64le">
  <version epoch="0" ver="1.13" rel="3.2.1"/>
  <changelog author="chris@computersalat.de" date="1280232000">- initial package 1.09
  * created by cpanspec 1.78</changelog>
  <changelog author="coolo@novell.com" date="1291204800">- switch to perl_requires macro</changelog>
  <changelog author="coolo@suse.com" date="1321617600">- use original .tar.gz</changelog>
  <changelog author="coolo@suse.com" date="1370260800">- updated to 1.11
  * Clarify the license as LGPL v3 (29 June 2007) (RT 78629)
  * Add MirBSD support. It's the same options as Sun stuff.</changelog>
  <changelog author="i@marguerite.su" date="1392206400">- update version 1.12
  * Get rid of MYMETA</changelog>
  <changelog author="coolo@suse.com" date="1433419200">- updated to 1.13
  see /usr/share/doc/packages/perl-Crypt-Rijndael/Changes
  Revision history for Perl module Crypt::Rijndael</changelog>
  <changelog author="i@marguerite.su" date="1433851200">- automatic update wasn't right, license should be LGPL</changelog>
  <changelog author="i@marguerite.su" date="1434369600">- use cpanspec.yml to correct license automatically</changelog>
</package>
<package pkgid="6c15b3b0dad6ef76e0269fb930d2b465883069099a54cfcaf1b95ec43ba8c4a2" name="perl-Crypt-Rijndael" arch="s390x">
  <version epoch="0" ver="1.13" rel="3.2.1"/>
  <changelog author="chris@computersalat.de" date="1280232000">- initial package 1.09
  * created by cpanspec 1.78</changelog>
  <changelog author="coolo@novell.com" date="1291204800">- switch to perl_requires macro</changelog>
  <changelog author="coolo@suse.com" date="1321617600">- use original .tar.gz</changelog>
  <changelog author="coolo@suse.com" date="1370260800">- updated to 1.11
  * Clarify the license as LGPL v3 (29 June 2007) (RT 78629)
  * Add MirBSD support. It's the same options as Sun stuff.</changelog>
  <changelog author="i@marguerite.su" date="1392206400">- update version 1.12
  * Get rid of MYMETA</changelog>
  <changelog author="coolo@suse.com" date="1433419200">- updated to 1.13
  see /usr/share/doc/packages/perl-Crypt-Rijndael/Changes
  Revision history for Perl module Crypt::Rijndael</changelog>
  <changelog author="i@marguerite.su" date="1433851200">- automatic update wasn't right, license should be LGPL</changelog>
  <changelog author="i@marguerite.su" date="1434369600">- use cpanspec.yml to correct license automatically</changelog>
</package>
<package pkgid="ee84f56057f61281896acd3d36f9a52eb218e8936a20240cf8f29afb2f6f1310" name="perl-Crypt-Rijndael" arch="src">
  <version epoch="0" ver="1.13" rel="3.2.1"/>
  <changelog author="chris@computersalat.de" date="1280232000">- initial package 1.09
  * created by cpanspec 1.78</changelog>
  <changelog author="coolo@novell.com" date="1291204800">- switch to perl_requires macro</changelog>
  <changelog author="coolo@suse.com" date="1321617600">- use original .tar.gz</changelog>
  <changelog author="coolo@suse.com" date="1370260800">- updated to 1.11
  * Clarify the license as LGPL v3 (29 June 2007) (RT 78629)
  * Add MirBSD support. It's the same options as Sun stuff.</changelog>
  <changelog author="i@marguerite.su" date="1392206400">- update version 1.12
  * Get rid of MYMETA</changelog>
  <changelog author="coolo@suse.com" date="1433419200">- updated to 1.13
  see /usr/share/doc/packages/perl-Crypt-Rijndael/Changes
  Revision history for Perl module Crypt::Rijndael</changelog>
  <changelog author="i@marguerite.su" date="1433851200">- automatic update wasn't right, license should be LGPL</changelog>
  <changelog author="i@marguerite.su" date="1434369600">- use cpanspec.yml to correct license automatically</changelog>
</package>
<package pkgid="89878121c0c70fd8c3c076d1363727456e01389ea137e042b2cdc00c63a825a2" name="perl-Crypt-Rijndael" arch="x86_64">
  <version epoch="0" ver="1.13" rel="3.2.1"/>
  <changelog author="chris@computersalat.de" date="1280232000">- initial package 1.09
  * created by cpanspec 1.78</changelog>
  <changelog author="coolo@novell.com" date="1291204800">- switch to perl_requires macro</changelog>
  <changelog author="coolo@suse.com" date="1321617600">- use original .tar.gz</changelog>
  <changelog author="coolo@suse.com" date="1370260800">- updated to 1.11
  * Clarify the license as LGPL v3 (29 June 2007) (RT 78629)
  * Add MirBSD support. It's the same options as Sun stuff.</changelog>
  <changelog author="i@marguerite.su" date="1392206400">- update version 1.12
  * Get rid of MYMETA</changelog>
  <changelog author="coolo@suse.com" date="1433419200">- updated to 1.13
  see /usr/share/doc/packages/perl-Crypt-Rijndael/Changes
  Revision history for Perl module Crypt::Rijndael</changelog>
  <changelog author="i@marguerite.su" date="1433851200">- automatic update wasn't right, license should be LGPL</changelog>
  <changelog author="i@marguerite.su" date="1434369600">- use cpanspec.yml to correct license automatically</changelog>
</package>
<package pkgid="48db71cb38806d62f2d9f1642e4fd0a93c335aa7ccef5dc08c0eba846324d969" name="perl-Net-SNMP" arch="noarch">
  <version epoch="0" ver="6.0.1" rel="3.2.1"/>
  <changelog author="mjancar@suse.cz" date="1108641600">- update to 5.0.1</changelog>
  <changelog author="cthiel@suse.de" date="1122897600">- update to version 5.1.0</changelog>
  <changelog author="anicka@suse.cz" date="1136548800">- update to 5.2.0</changelog>
  <changelog author="mls@suse.de" date="1138190400">- converted neededforbuild to BuildRequires</changelog>
  <changelog author="jengelh@medozas.de" date="1263124800">- enable parallel build</changelog>
  <changelog author="chris@computersalat.de" date="1280232000">- update to v6.0.0
- Substantial internal code cleanup was performed based upon the
  Perl::Critic module and the "Perl Best Practices" book.
- Added support for the Module::Build system for building, testing,
  and installing Perl modules.
- The translation logic for OCTET STRINGs now uses the definition of
  a DisplayString in RFC 2579 to determine if the octets are to be
  converted into a hexadecimal representation.
- The get_table() and get_entries() methods were refactored as part
  of the code cleanup.  The get_entries() method now handles "holes"
  in tables better and indexes with a value of zero.
- The inheritance structure of the Transport Domain objects was
  updated to reduce code duplication and increase maintainability.
- The resolution of IPv6 addresses was made more exhaustive.
- The handling of OBJECT IDENTIFIERs was made more efficient by
  using [un]pack() with a BER compressed integer template.
- Additional validation of the values passed to most methods is now
  performed and the error messages have been made more robust.
- The documented examples were updated based upon commonly asked
  questions (specifically Example 3 and Example 4).
- A Response-PDU with an error-status set to "noError" no longer
  generates an error when the error-index is non-zero, as decribed
  in Section 4.2.4 of RFC 3416.
- The function oid_lex_cmp() was added to provide for the
  lexicographical comparison of two OBJECT IDENTIFIERs.
- The error-status is no longer set for the exceptions noSuchObject,
  noSuchInstance, and endOfMibView when translation is not enabled.
- recreated by cpanspec 1.78
- noarch pkg</changelog>
  <changelog author="lars@linux-schulserver.de" date="1290168000">- update to v6.0.1
  + Removed all occurrences of the "locked" attribute that was
    deprecated in Perl 5.12.0.
  + Changed the test validating the presence of a monotonic time value
    to check for invalid implementations.
  + The SNMPv3 contextEngineID and contextName are now stored as part
    of the request allowing for these values to be changed between
    messages.
- also package the examples</changelog>
  <changelog author="coolo@novell.com" date="1291204800">- switch to perl_requires macro</changelog>
  <changelog author="coolo@suse.com" date="1321617600">- use original .tar.gz</changelog>
  <changelog author="coolo@suse.com" date="1350302400">- buildrequire netcfg for the test suite</changelog>
</package>
<package pkgid="c9a1c31186f11f1ebcfa066d2451bb75fafdd184c68ae1773227e52508ea68ea" name="perl-Net-SNMP" arch="src">
  <version epoch="0" ver="6.0.1" rel="3.2.1"/>
  <changelog author="prehak@suse.cz" date="1040385600">- updated to version 4.0.3</changelog>
  <changelog author="mjancar@suse.cz" date="1053432000">- remove unpackaged files</changelog>
  <changelog author="mjancar@suse.cz" date="1054900800">- update to 4.1.0
- don't package MANIFEST</changelog>
  <changelog author="mjancar@suse.cz" date="1055851200">- fix filelist</changelog>
  <changelog author="mjancar@suse.cz" date="1058443200">- adapt to perl-5.8.1
- use %perl_process_packlist</changelog>
  <changelog author="mjancar@suse.cz" date="1061553600">- require the perl version we build with</changelog>
  <changelog author="mjancar@suse.cz" date="1066824000">- update to 4.1.2</changelog>
  <changelog author="ro@suse.de" date="1077969600">- fix requirement for /usr/local</changelog>
  <changelog author="ro@suse.de" date="1087732800">- fix find command in specfile</changelog>
  <changelog author="mjancar@suse.cz" date="1091793600">- update to 5.0.0</changelog>
  <changelog author="mjancar@suse.cz" date="1108641600">- update to 5.0.1</changelog>
  <changelog author="cthiel@suse.de" date="1122897600">- update to version 5.1.0</changelog>
  <changelog author="anicka@suse.cz" date="1136548800">- update to 5.2.0</changelog>
  <changelog author="mls@suse.de" date="1138190400">- converted neededforbuild to BuildRequires</changelog>
  <changelog author="jengelh@medozas.de" date="1263124800">- enable parallel build</changelog>
  <changelog author="chris@computersalat.de" date="1280232000">- update to v6.0.0
- Substantial internal code cleanup was performed based upon the
  Perl::Critic module and the "Perl Best Practices" book.
- Added support for the Module::Build system for building, testing,
  and installing Perl modules.
- The translation logic for OCTET STRINGs now uses the definition of
  a DisplayString in RFC 2579 to determine if the octets are to be
  converted into a hexadecimal representation.
- The get_table() and get_entries() methods were refactored as part
  of the code cleanup.  The get_entries() method now handles "holes"
  in tables better and indexes with a value of zero.
- The inheritance structure of the Transport Domain objects was
  updated to reduce code duplication and increase maintainability.
- The resolution of IPv6 addresses was made more exhaustive.
- The handling of OBJECT IDENTIFIERs was made more efficient by
  using [un]pack() with a BER compressed integer template.
- Additional validation of the values passed to most methods is now
  performed and the error messages have been made more robust.
- The documented examples were updated based upon commonly asked
  questions (specifically Example 3 and Example 4).
- A Response-PDU with an error-status set to "noError" no longer
  generates an error when the error-index is non-zero, as decribed
  in Section 4.2.4 of RFC 3416.
- The function oid_lex_cmp() was added to provide for the
  lexicographical comparison of two OBJECT IDENTIFIERs.
- The error-status is no longer set for the exceptions noSuchObject,
  noSuchInstance, and endOfMibView when translation is not enabled.
- recreated by cpanspec 1.78
- noarch pkg</changelog>
  <changelog author="lars@linux-schulserver.de" date="1290168000">- update to v6.0.1
  + Removed all occurrences of the "locked" attribute that was
    deprecated in Perl 5.12.0.
  + Changed the test validating the presence of a monotonic time value
    to check for invalid implementations.
  + The SNMPv3 contextEngineID and contextName are now stored as part
    of the request allowing for these values to be changed between
    messages.
- also package the examples</changelog>
  <changelog author="coolo@novell.com" date="1291204800">- switch to perl_requires macro</changelog>
  <changelog author="coolo@suse.com" date="1321617600">- use original .tar.gz</changelog>
  <changelog author="coolo@suse.com" date="1350302400">- buildrequire netcfg for the test suite</changelog>
</package>
<package pkgid="12f84448cfa7682482f55e887716aeab2f9f4ec2abd8d6984630d818fc14fc27" name="permissions" arch="aarch64">
  <version epoch="0" ver="20181225" rel="23.12.1"/>
  <changelog author="jsegitz@suse.com" date="1556625600">- Added 0004-var-cache-man.patch. Removed entry for /var/cache/man.
  Conflicts with packaging and man:man is the better setting anyway
  (bsc#1133678)</changelog>
  <changelog author="malte.kraus@suse.com" date="1560427200">- Added ./0005-singularity-starter-suid.patch (bsc#1128598)
  New whitelisting for /usr/lib/singularity/bin/starter-suid</changelog>
  <changelog author="jsegitz@suse.com" date="1569499200">- Updated permissons for amanda, added 0006-bsc1110797_amanda.patch
  (bsc#1110797)</changelog>
  <changelog author="malte.kraus@suse.com" date="1572264000">- fix privilege escalation through untrusted symlinks (bsc#1150734,
  CVE-2019-3690, 0007-chkstat-fix-privesc-CVE-2019-3690.patch)</changelog>
  <changelog author="malte.kraus@suse.com" date="1572264001">- fix /usr/sbin/pinger ownership to root:squid (bsc#1093414,
  CVE-2019-3688, 0008-squid-pinger-owner-fix-CVE-2019-3688.patch)</changelog>
  <changelog author="malte.kraus@suse.com" date="1574164800">- fix invalid free() when permfiles points to argv (bsc#1157198,
  changed 0007-chkstat-fix-privesc-CVE-2019-3690.patch)</changelog>
  <changelog author="malte.kraus@suse.com" date="1580472000">- fix regression where chkstat breaks without /proc available
  (bsc#1160764, bsc#1160594, 0009-chkstat-handle-missing-proc.patch)
- fix capability handling when doing multiple permission changes
  at once (bsc#1161779,
  0010-chkstat-capabilities-implicit-changes.patch)</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1580904000">Sync upstream SLE-15-SP1 branch with our SLE-15-SP1:Update package. Therefore
  remove all of the following patches which are now included in the tarball:
- 0001-whitelisting-update-virtualbox.patch
- 0002-consistency-between-profiles.patch 0003-var-run-postgresql.patch
- 0004-var-cache-man.patch
- 0005-singularity-starter-suid.patch
- 0006-bsc1110797_amanda.patch
- 0007-chkstat-fix-privesc-CVE-2019-3690.patch
- 0008-squid-pinger-owner-fix-CVE-2019-3688.patch
- 0009-chkstat-handle-missing-proc.patch
- 0010-chkstat-capabilities-implicit-changes.patch
  Because of inconsistencies between the upstream branch and the package state
  the following previously missing changes are introduced by this update:
- Update to version 20181117:
  * removed old entry for rmtab
  * Fixed typo in icinga2 whitelist entry</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1580990400">- Update to version 20181224:
  * mariadb: settings for new auth_pam_tool (bsc#1160285)
  * chkstat: capability handling fixes (bsc#1161779)
  * chkstat: fix regression where chkstat breaks without /proc available (bsc#1160764, bsc#1160594)
  * dumpcap: remove 'other' executable bit because of capabilities (boo#1148788, CVE-2019-3687)</changelog>
  <changelog author="malte.kraus@suse.com" date="1582891200">- Update to version 20181224:
  * whitelist WMP (bsc#1161335)
  * Makefile: allow to build test version programmatically
  * chkstat: handle symlinks in final path elements correctly
  * add .gitignore for chkstat binary
  * faxq-helper: correct "secure" permission for trusted group (bsc#1157498)
  * fix syntax of paranoid profile</changelog>
  <changelog author="malte.kraus@suse.com" date="1583150400">- run testsuite during package build
- Update to version 20181224:
  * testsuite: adapt expected behavior to legacy branches
  * adjust testsuite to post CVE-2020-8013 link handling
  * testsuite: add option to not mount /proc
  * do not follow symlinks that are the final path element: CVE-2020-8013, bsc#1163922
  * add a test for symlinked directories
  * fix relative symlink handling
  * regtest: fix the static PATH list which was missing /usr/bin
  * regtest: also unshare the PID namespace to support /proc mounting
  * Makefile: force remove upon clean target to prevent bogus errors
  * regtest: by default automatically (re)build chkstat before testing
  * regtest: add test for symlink targets
  * regtest: make capability setting tests optional
  * regtest: fix capability assertion helper logic
  * regtests: add another test case that catches set*id or caps in world-writable sub-trees
  * regtest: add another test that catches when privilege bits are set for special files
  * regtest: add test case for user owned symlinks
  * regtest: employ subuid and subgid feature in user namespace
  * regtest: add another test case that covers unknown user/group config
  * regtest: add another test that checks rejection of insecure mixed-owner paths
  * regtest: add test that checks for rejection of world-writable paths
  * regtest: add test for detection of unexpected parent directory ownership
  * regtest: add further helper functions, allow access to main instance
  * regtest: introduce some basic coloring support to improve readability
  * regtest: sort imports, another piece of rationale
  * regtest: add capability test case
  * regtest: improve error flagging of test cases and introduce warnings
  * regtest: support caps
  * regtest: add a couple of command line parameter test cases
  * regtest: add another test that checks whether the default profile works
  * regtests: add tests for correct application of local profiles
  * regtest: add further test cases that test correct profile application
  * regtest: simplify test implementation and readability
  * regtest: add helpers for permissions.d per package profiles
  * regtest: support read-only bind mounts, also bind-mount permissions repo
  * tests: introduce a regression test suite for chkstat</changelog>
  <changelog author="jsegitz@suse.com" date="1585051200">- whitelist s390-tools setgid bit on log directory (bsc#1167163)</changelog>
  <changelog author="jsegitz@suse.com" date="1585828800">- correct spelling of icinga group (icingagmd -&gt; icingacmd, bsc#1168364)</changelog>
  <changelog author="jsegitz@suse.com" date="1589198400">- Remove setuid bit for newgidmap and newuidmap in paranoid profile
  (bsc#1171173)</changelog>
  <changelog author="malte.kraus@suse.com" date="1590667200">- whitelist texlive public binary (bsc#1171686)</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1591099200">- Update to version 20181224:
  * profiles: add entries for enlightenment (bsc#1171686)</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1611230400">- Update to version 20181224:
  * pcp: remove no longer needed / conflicting entries
    (bsc#1171883, CVE-2020-8025)</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1619784000">- Update to version 20181225:
  * etc/permissions: remove unnecessary entries (bsc#1182899)</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1640174400">- Update to version 20181225:
  * drop ping capabilities in favor of ICMP_PROTO sockets (bsc#1174504)</changelog>
  <changelog author="jsegitz@suse.com" date="1642161600">- Update to version 20181225:
  * setuid bit for cockpit session binary (bsc#1169614)</changelog>
</package>
<package pkgid="2e6db24b303ef1fc2fac5301ee67fbe203d79e69f3262309ea1461c6808215b3" name="permissions" arch="ppc64le">
  <version epoch="0" ver="20181225" rel="23.12.1"/>
  <changelog author="jsegitz@suse.com" date="1556625600">- Added 0004-var-cache-man.patch. Removed entry for /var/cache/man.
  Conflicts with packaging and man:man is the better setting anyway
  (bsc#1133678)</changelog>
  <changelog author="malte.kraus@suse.com" date="1560427200">- Added ./0005-singularity-starter-suid.patch (bsc#1128598)
  New whitelisting for /usr/lib/singularity/bin/starter-suid</changelog>
  <changelog author="jsegitz@suse.com" date="1569499200">- Updated permissons for amanda, added 0006-bsc1110797_amanda.patch
  (bsc#1110797)</changelog>
  <changelog author="malte.kraus@suse.com" date="1572264000">- fix privilege escalation through untrusted symlinks (bsc#1150734,
  CVE-2019-3690, 0007-chkstat-fix-privesc-CVE-2019-3690.patch)</changelog>
  <changelog author="malte.kraus@suse.com" date="1572264001">- fix /usr/sbin/pinger ownership to root:squid (bsc#1093414,
  CVE-2019-3688, 0008-squid-pinger-owner-fix-CVE-2019-3688.patch)</changelog>
  <changelog author="malte.kraus@suse.com" date="1574164800">- fix invalid free() when permfiles points to argv (bsc#1157198,
  changed 0007-chkstat-fix-privesc-CVE-2019-3690.patch)</changelog>
  <changelog author="malte.kraus@suse.com" date="1580472000">- fix regression where chkstat breaks without /proc available
  (bsc#1160764, bsc#1160594, 0009-chkstat-handle-missing-proc.patch)
- fix capability handling when doing multiple permission changes
  at once (bsc#1161779,
  0010-chkstat-capabilities-implicit-changes.patch)</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1580904000">Sync upstream SLE-15-SP1 branch with our SLE-15-SP1:Update package. Therefore
  remove all of the following patches which are now included in the tarball:
- 0001-whitelisting-update-virtualbox.patch
- 0002-consistency-between-profiles.patch 0003-var-run-postgresql.patch
- 0004-var-cache-man.patch
- 0005-singularity-starter-suid.patch
- 0006-bsc1110797_amanda.patch
- 0007-chkstat-fix-privesc-CVE-2019-3690.patch
- 0008-squid-pinger-owner-fix-CVE-2019-3688.patch
- 0009-chkstat-handle-missing-proc.patch
- 0010-chkstat-capabilities-implicit-changes.patch
  Because of inconsistencies between the upstream branch and the package state
  the following previously missing changes are introduced by this update:
- Update to version 20181117:
  * removed old entry for rmtab
  * Fixed typo in icinga2 whitelist entry</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1580990400">- Update to version 20181224:
  * mariadb: settings for new auth_pam_tool (bsc#1160285)
  * chkstat: capability handling fixes (bsc#1161779)
  * chkstat: fix regression where chkstat breaks without /proc available (bsc#1160764, bsc#1160594)
  * dumpcap: remove 'other' executable bit because of capabilities (boo#1148788, CVE-2019-3687)</changelog>
  <changelog author="malte.kraus@suse.com" date="1582891200">- Update to version 20181224:
  * whitelist WMP (bsc#1161335)
  * Makefile: allow to build test version programmatically
  * chkstat: handle symlinks in final path elements correctly
  * add .gitignore for chkstat binary
  * faxq-helper: correct "secure" permission for trusted group (bsc#1157498)
  * fix syntax of paranoid profile</changelog>
  <changelog author="malte.kraus@suse.com" date="1583150400">- run testsuite during package build
- Update to version 20181224:
  * testsuite: adapt expected behavior to legacy branches
  * adjust testsuite to post CVE-2020-8013 link handling
  * testsuite: add option to not mount /proc
  * do not follow symlinks that are the final path element: CVE-2020-8013, bsc#1163922
  * add a test for symlinked directories
  * fix relative symlink handling
  * regtest: fix the static PATH list which was missing /usr/bin
  * regtest: also unshare the PID namespace to support /proc mounting
  * Makefile: force remove upon clean target to prevent bogus errors
  * regtest: by default automatically (re)build chkstat before testing
  * regtest: add test for symlink targets
  * regtest: make capability setting tests optional
  * regtest: fix capability assertion helper logic
  * regtests: add another test case that catches set*id or caps in world-writable sub-trees
  * regtest: add another test that catches when privilege bits are set for special files
  * regtest: add test case for user owned symlinks
  * regtest: employ subuid and subgid feature in user namespace
  * regtest: add another test case that covers unknown user/group config
  * regtest: add another test that checks rejection of insecure mixed-owner paths
  * regtest: add test that checks for rejection of world-writable paths
  * regtest: add test for detection of unexpected parent directory ownership
  * regtest: add further helper functions, allow access to main instance
  * regtest: introduce some basic coloring support to improve readability
  * regtest: sort imports, another piece of rationale
  * regtest: add capability test case
  * regtest: improve error flagging of test cases and introduce warnings
  * regtest: support caps
  * regtest: add a couple of command line parameter test cases
  * regtest: add another test that checks whether the default profile works
  * regtests: add tests for correct application of local profiles
  * regtest: add further test cases that test correct profile application
  * regtest: simplify test implementation and readability
  * regtest: add helpers for permissions.d per package profiles
  * regtest: support read-only bind mounts, also bind-mount permissions repo
  * tests: introduce a regression test suite for chkstat</changelog>
  <changelog author="jsegitz@suse.com" date="1585051200">- whitelist s390-tools setgid bit on log directory (bsc#1167163)</changelog>
  <changelog author="jsegitz@suse.com" date="1585828800">- correct spelling of icinga group (icingagmd -&gt; icingacmd, bsc#1168364)</changelog>
  <changelog author="jsegitz@suse.com" date="1589198400">- Remove setuid bit for newgidmap and newuidmap in paranoid profile
  (bsc#1171173)</changelog>
  <changelog author="malte.kraus@suse.com" date="1590667200">- whitelist texlive public binary (bsc#1171686)</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1591099200">- Update to version 20181224:
  * profiles: add entries for enlightenment (bsc#1171686)</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1611230400">- Update to version 20181224:
  * pcp: remove no longer needed / conflicting entries
    (bsc#1171883, CVE-2020-8025)</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1619784000">- Update to version 20181225:
  * etc/permissions: remove unnecessary entries (bsc#1182899)</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1640174400">- Update to version 20181225:
  * drop ping capabilities in favor of ICMP_PROTO sockets (bsc#1174504)</changelog>
  <changelog author="jsegitz@suse.com" date="1642161600">- Update to version 20181225:
  * setuid bit for cockpit session binary (bsc#1169614)</changelog>
</package>
<package pkgid="c6a28e023d675d6f392ee90a329ea804615f414830b1409adb66a2509221c50f" name="permissions" arch="s390x">
  <version epoch="0" ver="20181225" rel="23.12.1"/>
  <changelog author="jsegitz@suse.com" date="1556625600">- Added 0004-var-cache-man.patch. Removed entry for /var/cache/man.
  Conflicts with packaging and man:man is the better setting anyway
  (bsc#1133678)</changelog>
  <changelog author="malte.kraus@suse.com" date="1560427200">- Added ./0005-singularity-starter-suid.patch (bsc#1128598)
  New whitelisting for /usr/lib/singularity/bin/starter-suid</changelog>
  <changelog author="jsegitz@suse.com" date="1569499200">- Updated permissons for amanda, added 0006-bsc1110797_amanda.patch
  (bsc#1110797)</changelog>
  <changelog author="malte.kraus@suse.com" date="1572264000">- fix privilege escalation through untrusted symlinks (bsc#1150734,
  CVE-2019-3690, 0007-chkstat-fix-privesc-CVE-2019-3690.patch)</changelog>
  <changelog author="malte.kraus@suse.com" date="1572264001">- fix /usr/sbin/pinger ownership to root:squid (bsc#1093414,
  CVE-2019-3688, 0008-squid-pinger-owner-fix-CVE-2019-3688.patch)</changelog>
  <changelog author="malte.kraus@suse.com" date="1574164800">- fix invalid free() when permfiles points to argv (bsc#1157198,
  changed 0007-chkstat-fix-privesc-CVE-2019-3690.patch)</changelog>
  <changelog author="malte.kraus@suse.com" date="1580472000">- fix regression where chkstat breaks without /proc available
  (bsc#1160764, bsc#1160594, 0009-chkstat-handle-missing-proc.patch)
- fix capability handling when doing multiple permission changes
  at once (bsc#1161779,
  0010-chkstat-capabilities-implicit-changes.patch)</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1580904000">Sync upstream SLE-15-SP1 branch with our SLE-15-SP1:Update package. Therefore
  remove all of the following patches which are now included in the tarball:
- 0001-whitelisting-update-virtualbox.patch
- 0002-consistency-between-profiles.patch 0003-var-run-postgresql.patch
- 0004-var-cache-man.patch
- 0005-singularity-starter-suid.patch
- 0006-bsc1110797_amanda.patch
- 0007-chkstat-fix-privesc-CVE-2019-3690.patch
- 0008-squid-pinger-owner-fix-CVE-2019-3688.patch
- 0009-chkstat-handle-missing-proc.patch
- 0010-chkstat-capabilities-implicit-changes.patch
  Because of inconsistencies between the upstream branch and the package state
  the following previously missing changes are introduced by this update:
- Update to version 20181117:
  * removed old entry for rmtab
  * Fixed typo in icinga2 whitelist entry</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1580990400">- Update to version 20181224:
  * mariadb: settings for new auth_pam_tool (bsc#1160285)
  * chkstat: capability handling fixes (bsc#1161779)
  * chkstat: fix regression where chkstat breaks without /proc available (bsc#1160764, bsc#1160594)
  * dumpcap: remove 'other' executable bit because of capabilities (boo#1148788, CVE-2019-3687)</changelog>
  <changelog author="malte.kraus@suse.com" date="1582891200">- Update to version 20181224:
  * whitelist WMP (bsc#1161335)
  * Makefile: allow to build test version programmatically
  * chkstat: handle symlinks in final path elements correctly
  * add .gitignore for chkstat binary
  * faxq-helper: correct "secure" permission for trusted group (bsc#1157498)
  * fix syntax of paranoid profile</changelog>
  <changelog author="malte.kraus@suse.com" date="1583150400">- run testsuite during package build
- Update to version 20181224:
  * testsuite: adapt expected behavior to legacy branches
  * adjust testsuite to post CVE-2020-8013 link handling
  * testsuite: add option to not mount /proc
  * do not follow symlinks that are the final path element: CVE-2020-8013, bsc#1163922
  * add a test for symlinked directories
  * fix relative symlink handling
  * regtest: fix the static PATH list which was missing /usr/bin
  * regtest: also unshare the PID namespace to support /proc mounting
  * Makefile: force remove upon clean target to prevent bogus errors
  * regtest: by default automatically (re)build chkstat before testing
  * regtest: add test for symlink targets
  * regtest: make capability setting tests optional
  * regtest: fix capability assertion helper logic
  * regtests: add another test case that catches set*id or caps in world-writable sub-trees
  * regtest: add another test that catches when privilege bits are set for special files
  * regtest: add test case for user owned symlinks
  * regtest: employ subuid and subgid feature in user namespace
  * regtest: add another test case that covers unknown user/group config
  * regtest: add another test that checks rejection of insecure mixed-owner paths
  * regtest: add test that checks for rejection of world-writable paths
  * regtest: add test for detection of unexpected parent directory ownership
  * regtest: add further helper functions, allow access to main instance
  * regtest: introduce some basic coloring support to improve readability
  * regtest: sort imports, another piece of rationale
  * regtest: add capability test case
  * regtest: improve error flagging of test cases and introduce warnings
  * regtest: support caps
  * regtest: add a couple of command line parameter test cases
  * regtest: add another test that checks whether the default profile works
  * regtests: add tests for correct application of local profiles
  * regtest: add further test cases that test correct profile application
  * regtest: simplify test implementation and readability
  * regtest: add helpers for permissions.d per package profiles
  * regtest: support read-only bind mounts, also bind-mount permissions repo
  * tests: introduce a regression test suite for chkstat</changelog>
  <changelog author="jsegitz@suse.com" date="1585051200">- whitelist s390-tools setgid bit on log directory (bsc#1167163)</changelog>
  <changelog author="jsegitz@suse.com" date="1585828800">- correct spelling of icinga group (icingagmd -&gt; icingacmd, bsc#1168364)</changelog>
  <changelog author="jsegitz@suse.com" date="1589198400">- Remove setuid bit for newgidmap and newuidmap in paranoid profile
  (bsc#1171173)</changelog>
  <changelog author="malte.kraus@suse.com" date="1590667200">- whitelist texlive public binary (bsc#1171686)</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1591099200">- Update to version 20181224:
  * profiles: add entries for enlightenment (bsc#1171686)</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1611230400">- Update to version 20181224:
  * pcp: remove no longer needed / conflicting entries
    (bsc#1171883, CVE-2020-8025)</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1619784000">- Update to version 20181225:
  * etc/permissions: remove unnecessary entries (bsc#1182899)</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1640174400">- Update to version 20181225:
  * drop ping capabilities in favor of ICMP_PROTO sockets (bsc#1174504)</changelog>
  <changelog author="jsegitz@suse.com" date="1642161600">- Update to version 20181225:
  * setuid bit for cockpit session binary (bsc#1169614)</changelog>
</package>
<package pkgid="1b308c60d69eded5d2103519c5c813eadfeb9bdb7b828f8e862dd960010c2bf8" name="permissions" arch="src">
  <version epoch="0" ver="20181225" rel="23.12.1"/>
  <changelog author="jsegitz@suse.com" date="1556625600">- Added 0004-var-cache-man.patch. Removed entry for /var/cache/man.
  Conflicts with packaging and man:man is the better setting anyway
  (bsc#1133678)</changelog>
  <changelog author="malte.kraus@suse.com" date="1560427200">- Added ./0005-singularity-starter-suid.patch (bsc#1128598)
  New whitelisting for /usr/lib/singularity/bin/starter-suid</changelog>
  <changelog author="jsegitz@suse.com" date="1569499200">- Updated permissons for amanda, added 0006-bsc1110797_amanda.patch
  (bsc#1110797)</changelog>
  <changelog author="malte.kraus@suse.com" date="1572264000">- fix privilege escalation through untrusted symlinks (bsc#1150734,
  CVE-2019-3690, 0007-chkstat-fix-privesc-CVE-2019-3690.patch)</changelog>
  <changelog author="malte.kraus@suse.com" date="1572264001">- fix /usr/sbin/pinger ownership to root:squid (bsc#1093414,
  CVE-2019-3688, 0008-squid-pinger-owner-fix-CVE-2019-3688.patch)</changelog>
  <changelog author="malte.kraus@suse.com" date="1574164800">- fix invalid free() when permfiles points to argv (bsc#1157198,
  changed 0007-chkstat-fix-privesc-CVE-2019-3690.patch)</changelog>
  <changelog author="malte.kraus@suse.com" date="1580472000">- fix regression where chkstat breaks without /proc available
  (bsc#1160764, bsc#1160594, 0009-chkstat-handle-missing-proc.patch)
- fix capability handling when doing multiple permission changes
  at once (bsc#1161779,
  0010-chkstat-capabilities-implicit-changes.patch)</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1580904000">Sync upstream SLE-15-SP1 branch with our SLE-15-SP1:Update package. Therefore
  remove all of the following patches which are now included in the tarball:
- 0001-whitelisting-update-virtualbox.patch
- 0002-consistency-between-profiles.patch 0003-var-run-postgresql.patch
- 0004-var-cache-man.patch
- 0005-singularity-starter-suid.patch
- 0006-bsc1110797_amanda.patch
- 0007-chkstat-fix-privesc-CVE-2019-3690.patch
- 0008-squid-pinger-owner-fix-CVE-2019-3688.patch
- 0009-chkstat-handle-missing-proc.patch
- 0010-chkstat-capabilities-implicit-changes.patch
  Because of inconsistencies between the upstream branch and the package state
  the following previously missing changes are introduced by this update:
- Update to version 20181117:
  * removed old entry for rmtab
  * Fixed typo in icinga2 whitelist entry</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1580990400">- Update to version 20181224:
  * mariadb: settings for new auth_pam_tool (bsc#1160285)
  * chkstat: capability handling fixes (bsc#1161779)
  * chkstat: fix regression where chkstat breaks without /proc available (bsc#1160764, bsc#1160594)
  * dumpcap: remove 'other' executable bit because of capabilities (boo#1148788, CVE-2019-3687)</changelog>
  <changelog author="malte.kraus@suse.com" date="1582891200">- Update to version 20181224:
  * whitelist WMP (bsc#1161335)
  * Makefile: allow to build test version programmatically
  * chkstat: handle symlinks in final path elements correctly
  * add .gitignore for chkstat binary
  * faxq-helper: correct "secure" permission for trusted group (bsc#1157498)
  * fix syntax of paranoid profile</changelog>
  <changelog author="malte.kraus@suse.com" date="1583150400">- run testsuite during package build
- Update to version 20181224:
  * testsuite: adapt expected behavior to legacy branches
  * adjust testsuite to post CVE-2020-8013 link handling
  * testsuite: add option to not mount /proc
  * do not follow symlinks that are the final path element: CVE-2020-8013, bsc#1163922
  * add a test for symlinked directories
  * fix relative symlink handling
  * regtest: fix the static PATH list which was missing /usr/bin
  * regtest: also unshare the PID namespace to support /proc mounting
  * Makefile: force remove upon clean target to prevent bogus errors
  * regtest: by default automatically (re)build chkstat before testing
  * regtest: add test for symlink targets
  * regtest: make capability setting tests optional
  * regtest: fix capability assertion helper logic
  * regtests: add another test case that catches set*id or caps in world-writable sub-trees
  * regtest: add another test that catches when privilege bits are set for special files
  * regtest: add test case for user owned symlinks
  * regtest: employ subuid and subgid feature in user namespace
  * regtest: add another test case that covers unknown user/group config
  * regtest: add another test that checks rejection of insecure mixed-owner paths
  * regtest: add test that checks for rejection of world-writable paths
  * regtest: add test for detection of unexpected parent directory ownership
  * regtest: add further helper functions, allow access to main instance
  * regtest: introduce some basic coloring support to improve readability
  * regtest: sort imports, another piece of rationale
  * regtest: add capability test case
  * regtest: improve error flagging of test cases and introduce warnings
  * regtest: support caps
  * regtest: add a couple of command line parameter test cases
  * regtest: add another test that checks whether the default profile works
  * regtests: add tests for correct application of local profiles
  * regtest: add further test cases that test correct profile application
  * regtest: simplify test implementation and readability
  * regtest: add helpers for permissions.d per package profiles
  * regtest: support read-only bind mounts, also bind-mount permissions repo
  * tests: introduce a regression test suite for chkstat</changelog>
  <changelog author="jsegitz@suse.com" date="1585051200">- whitelist s390-tools setgid bit on log directory (bsc#1167163)</changelog>
  <changelog author="jsegitz@suse.com" date="1585828800">- correct spelling of icinga group (icingagmd -&gt; icingacmd, bsc#1168364)</changelog>
  <changelog author="jsegitz@suse.com" date="1589198400">- Remove setuid bit for newgidmap and newuidmap in paranoid profile
  (bsc#1171173)</changelog>
  <changelog author="malte.kraus@suse.com" date="1590667200">- whitelist texlive public binary (bsc#1171686)</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1591099200">- Update to version 20181224:
  * profiles: add entries for enlightenment (bsc#1171686)</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1611230400">- Update to version 20181224:
  * pcp: remove no longer needed / conflicting entries
    (bsc#1171883, CVE-2020-8025)</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1619784000">- Update to version 20181225:
  * etc/permissions: remove unnecessary entries (bsc#1182899)</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1640174400">- Update to version 20181225:
  * drop ping capabilities in favor of ICMP_PROTO sockets (bsc#1174504)</changelog>
  <changelog author="jsegitz@suse.com" date="1642161600">- Update to version 20181225:
  * setuid bit for cockpit session binary (bsc#1169614)</changelog>
</package>
<package pkgid="6b1ed2cef6e745e13818c3496bfebd679590a1dd82f9a7a23f8cde2fc0257d7d" name="permissions" arch="x86_64">
  <version epoch="0" ver="20181225" rel="23.12.1"/>
  <changelog author="jsegitz@suse.com" date="1556625600">- Added 0004-var-cache-man.patch. Removed entry for /var/cache/man.
  Conflicts with packaging and man:man is the better setting anyway
  (bsc#1133678)</changelog>
  <changelog author="malte.kraus@suse.com" date="1560427200">- Added ./0005-singularity-starter-suid.patch (bsc#1128598)
  New whitelisting for /usr/lib/singularity/bin/starter-suid</changelog>
  <changelog author="jsegitz@suse.com" date="1569499200">- Updated permissons for amanda, added 0006-bsc1110797_amanda.patch
  (bsc#1110797)</changelog>
  <changelog author="malte.kraus@suse.com" date="1572264000">- fix privilege escalation through untrusted symlinks (bsc#1150734,
  CVE-2019-3690, 0007-chkstat-fix-privesc-CVE-2019-3690.patch)</changelog>
  <changelog author="malte.kraus@suse.com" date="1572264001">- fix /usr/sbin/pinger ownership to root:squid (bsc#1093414,
  CVE-2019-3688, 0008-squid-pinger-owner-fix-CVE-2019-3688.patch)</changelog>
  <changelog author="malte.kraus@suse.com" date="1574164800">- fix invalid free() when permfiles points to argv (bsc#1157198,
  changed 0007-chkstat-fix-privesc-CVE-2019-3690.patch)</changelog>
  <changelog author="malte.kraus@suse.com" date="1580472000">- fix regression where chkstat breaks without /proc available
  (bsc#1160764, bsc#1160594, 0009-chkstat-handle-missing-proc.patch)
- fix capability handling when doing multiple permission changes
  at once (bsc#1161779,
  0010-chkstat-capabilities-implicit-changes.patch)</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1580904000">Sync upstream SLE-15-SP1 branch with our SLE-15-SP1:Update package. Therefore
  remove all of the following patches which are now included in the tarball:
- 0001-whitelisting-update-virtualbox.patch
- 0002-consistency-between-profiles.patch 0003-var-run-postgresql.patch
- 0004-var-cache-man.patch
- 0005-singularity-starter-suid.patch
- 0006-bsc1110797_amanda.patch
- 0007-chkstat-fix-privesc-CVE-2019-3690.patch
- 0008-squid-pinger-owner-fix-CVE-2019-3688.patch
- 0009-chkstat-handle-missing-proc.patch
- 0010-chkstat-capabilities-implicit-changes.patch
  Because of inconsistencies between the upstream branch and the package state
  the following previously missing changes are introduced by this update:
- Update to version 20181117:
  * removed old entry for rmtab
  * Fixed typo in icinga2 whitelist entry</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1580990400">- Update to version 20181224:
  * mariadb: settings for new auth_pam_tool (bsc#1160285)
  * chkstat: capability handling fixes (bsc#1161779)
  * chkstat: fix regression where chkstat breaks without /proc available (bsc#1160764, bsc#1160594)
  * dumpcap: remove 'other' executable bit because of capabilities (boo#1148788, CVE-2019-3687)</changelog>
  <changelog author="malte.kraus@suse.com" date="1582891200">- Update to version 20181224:
  * whitelist WMP (bsc#1161335)
  * Makefile: allow to build test version programmatically
  * chkstat: handle symlinks in final path elements correctly
  * add .gitignore for chkstat binary
  * faxq-helper: correct "secure" permission for trusted group (bsc#1157498)
  * fix syntax of paranoid profile</changelog>
  <changelog author="malte.kraus@suse.com" date="1583150400">- run testsuite during package build
- Update to version 20181224:
  * testsuite: adapt expected behavior to legacy branches
  * adjust testsuite to post CVE-2020-8013 link handling
  * testsuite: add option to not mount /proc
  * do not follow symlinks that are the final path element: CVE-2020-8013, bsc#1163922
  * add a test for symlinked directories
  * fix relative symlink handling
  * regtest: fix the static PATH list which was missing /usr/bin
  * regtest: also unshare the PID namespace to support /proc mounting
  * Makefile: force remove upon clean target to prevent bogus errors
  * regtest: by default automatically (re)build chkstat before testing
  * regtest: add test for symlink targets
  * regtest: make capability setting tests optional
  * regtest: fix capability assertion helper logic
  * regtests: add another test case that catches set*id or caps in world-writable sub-trees
  * regtest: add another test that catches when privilege bits are set for special files
  * regtest: add test case for user owned symlinks
  * regtest: employ subuid and subgid feature in user namespace
  * regtest: add another test case that covers unknown user/group config
  * regtest: add another test that checks rejection of insecure mixed-owner paths
  * regtest: add test that checks for rejection of world-writable paths
  * regtest: add test for detection of unexpected parent directory ownership
  * regtest: add further helper functions, allow access to main instance
  * regtest: introduce some basic coloring support to improve readability
  * regtest: sort imports, another piece of rationale
  * regtest: add capability test case
  * regtest: improve error flagging of test cases and introduce warnings
  * regtest: support caps
  * regtest: add a couple of command line parameter test cases
  * regtest: add another test that checks whether the default profile works
  * regtests: add tests for correct application of local profiles
  * regtest: add further test cases that test correct profile application
  * regtest: simplify test implementation and readability
  * regtest: add helpers for permissions.d per package profiles
  * regtest: support read-only bind mounts, also bind-mount permissions repo
  * tests: introduce a regression test suite for chkstat</changelog>
  <changelog author="jsegitz@suse.com" date="1585051200">- whitelist s390-tools setgid bit on log directory (bsc#1167163)</changelog>
  <changelog author="jsegitz@suse.com" date="1585828800">- correct spelling of icinga group (icingagmd -&gt; icingacmd, bsc#1168364)</changelog>
  <changelog author="jsegitz@suse.com" date="1589198400">- Remove setuid bit for newgidmap and newuidmap in paranoid profile
  (bsc#1171173)</changelog>
  <changelog author="malte.kraus@suse.com" date="1590667200">- whitelist texlive public binary (bsc#1171686)</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1591099200">- Update to version 20181224:
  * profiles: add entries for enlightenment (bsc#1171686)</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1611230400">- Update to version 20181224:
  * pcp: remove no longer needed / conflicting entries
    (bsc#1171883, CVE-2020-8025)</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1619784000">- Update to version 20181225:
  * etc/permissions: remove unnecessary entries (bsc#1182899)</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1640174400">- Update to version 20181225:
  * drop ping capabilities in favor of ICMP_PROTO sockets (bsc#1174504)</changelog>
  <changelog author="jsegitz@suse.com" date="1642161600">- Update to version 20181225:
  * setuid bit for cockpit session binary (bsc#1169614)</changelog>
</package>
<package pkgid="6c4510c3fa96b26295acf0881a4d29548a6b001ac5f85c4ce688328bb46bde22" name="permissions-zypp-plugin" arch="noarch">
  <version epoch="0" ver="20181225" rel="23.12.1"/>
  <changelog author="jsegitz@suse.com" date="1556625600">- Added 0004-var-cache-man.patch. Removed entry for /var/cache/man.
  Conflicts with packaging and man:man is the better setting anyway
  (bsc#1133678)</changelog>
  <changelog author="malte.kraus@suse.com" date="1560427200">- Added ./0005-singularity-starter-suid.patch (bsc#1128598)
  New whitelisting for /usr/lib/singularity/bin/starter-suid</changelog>
  <changelog author="jsegitz@suse.com" date="1569499200">- Updated permissons for amanda, added 0006-bsc1110797_amanda.patch
  (bsc#1110797)</changelog>
  <changelog author="malte.kraus@suse.com" date="1572264000">- fix privilege escalation through untrusted symlinks (bsc#1150734,
  CVE-2019-3690, 0007-chkstat-fix-privesc-CVE-2019-3690.patch)</changelog>
  <changelog author="malte.kraus@suse.com" date="1572264001">- fix /usr/sbin/pinger ownership to root:squid (bsc#1093414,
  CVE-2019-3688, 0008-squid-pinger-owner-fix-CVE-2019-3688.patch)</changelog>
  <changelog author="malte.kraus@suse.com" date="1574164800">- fix invalid free() when permfiles points to argv (bsc#1157198,
  changed 0007-chkstat-fix-privesc-CVE-2019-3690.patch)</changelog>
  <changelog author="malte.kraus@suse.com" date="1580472000">- fix regression where chkstat breaks without /proc available
  (bsc#1160764, bsc#1160594, 0009-chkstat-handle-missing-proc.patch)
- fix capability handling when doing multiple permission changes
  at once (bsc#1161779,
  0010-chkstat-capabilities-implicit-changes.patch)</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1580904000">Sync upstream SLE-15-SP1 branch with our SLE-15-SP1:Update package. Therefore
  remove all of the following patches which are now included in the tarball:
- 0001-whitelisting-update-virtualbox.patch
- 0002-consistency-between-profiles.patch 0003-var-run-postgresql.patch
- 0004-var-cache-man.patch
- 0005-singularity-starter-suid.patch
- 0006-bsc1110797_amanda.patch
- 0007-chkstat-fix-privesc-CVE-2019-3690.patch
- 0008-squid-pinger-owner-fix-CVE-2019-3688.patch
- 0009-chkstat-handle-missing-proc.patch
- 0010-chkstat-capabilities-implicit-changes.patch
  Because of inconsistencies between the upstream branch and the package state
  the following previously missing changes are introduced by this update:
- Update to version 20181117:
  * removed old entry for rmtab
  * Fixed typo in icinga2 whitelist entry</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1580990400">- Update to version 20181224:
  * mariadb: settings for new auth_pam_tool (bsc#1160285)
  * chkstat: capability handling fixes (bsc#1161779)
  * chkstat: fix regression where chkstat breaks without /proc available (bsc#1160764, bsc#1160594)
  * dumpcap: remove 'other' executable bit because of capabilities (boo#1148788, CVE-2019-3687)</changelog>
  <changelog author="malte.kraus@suse.com" date="1582891200">- Update to version 20181224:
  * whitelist WMP (bsc#1161335)
  * Makefile: allow to build test version programmatically
  * chkstat: handle symlinks in final path elements correctly
  * add .gitignore for chkstat binary
  * faxq-helper: correct "secure" permission for trusted group (bsc#1157498)
  * fix syntax of paranoid profile</changelog>
  <changelog author="malte.kraus@suse.com" date="1583150400">- run testsuite during package build
- Update to version 20181224:
  * testsuite: adapt expected behavior to legacy branches
  * adjust testsuite to post CVE-2020-8013 link handling
  * testsuite: add option to not mount /proc
  * do not follow symlinks that are the final path element: CVE-2020-8013, bsc#1163922
  * add a test for symlinked directories
  * fix relative symlink handling
  * regtest: fix the static PATH list which was missing /usr/bin
  * regtest: also unshare the PID namespace to support /proc mounting
  * Makefile: force remove upon clean target to prevent bogus errors
  * regtest: by default automatically (re)build chkstat before testing
  * regtest: add test for symlink targets
  * regtest: make capability setting tests optional
  * regtest: fix capability assertion helper logic
  * regtests: add another test case that catches set*id or caps in world-writable sub-trees
  * regtest: add another test that catches when privilege bits are set for special files
  * regtest: add test case for user owned symlinks
  * regtest: employ subuid and subgid feature in user namespace
  * regtest: add another test case that covers unknown user/group config
  * regtest: add another test that checks rejection of insecure mixed-owner paths
  * regtest: add test that checks for rejection of world-writable paths
  * regtest: add test for detection of unexpected parent directory ownership
  * regtest: add further helper functions, allow access to main instance
  * regtest: introduce some basic coloring support to improve readability
  * regtest: sort imports, another piece of rationale
  * regtest: add capability test case
  * regtest: improve error flagging of test cases and introduce warnings
  * regtest: support caps
  * regtest: add a couple of command line parameter test cases
  * regtest: add another test that checks whether the default profile works
  * regtests: add tests for correct application of local profiles
  * regtest: add further test cases that test correct profile application
  * regtest: simplify test implementation and readability
  * regtest: add helpers for permissions.d per package profiles
  * regtest: support read-only bind mounts, also bind-mount permissions repo
  * tests: introduce a regression test suite for chkstat</changelog>
  <changelog author="jsegitz@suse.com" date="1585051200">- whitelist s390-tools setgid bit on log directory (bsc#1167163)</changelog>
  <changelog author="jsegitz@suse.com" date="1585828800">- correct spelling of icinga group (icingagmd -&gt; icingacmd, bsc#1168364)</changelog>
  <changelog author="jsegitz@suse.com" date="1589198400">- Remove setuid bit for newgidmap and newuidmap in paranoid profile
  (bsc#1171173)</changelog>
  <changelog author="malte.kraus@suse.com" date="1590667200">- whitelist texlive public binary (bsc#1171686)</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1591099200">- Update to version 20181224:
  * profiles: add entries for enlightenment (bsc#1171686)</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1611230400">- Update to version 20181224:
  * pcp: remove no longer needed / conflicting entries
    (bsc#1171883, CVE-2020-8025)</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1619784000">- Update to version 20181225:
  * etc/permissions: remove unnecessary entries (bsc#1182899)</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1640174400">- Update to version 20181225:
  * drop ping capabilities in favor of ICMP_PROTO sockets (bsc#1174504)</changelog>
  <changelog author="jsegitz@suse.com" date="1642161600">- Update to version 20181225:
  * setuid bit for cockpit session binary (bsc#1169614)</changelog>
</package>
<package pkgid="12abf163d11f5b862a688bdce1b8dda9455d5c12d443f7d8900891bb45521575" name="polkit" arch="aarch64">
  <version epoch="0" ver="0.116" rel="3.9.1"/>
  <changelog author="antoine.belvire@laposte.net" date="1438862400">- Update to 0.113:
  * Fix CVE-2015-4625
  * Fix CVE-2015-3256
  * Fix CVE-2015-3255
  * Fix CVE-2015-3218
  * On systemd-213 and later, the ?active? state is shared across
    all sessions of an user, instead of being tracked separately
  * pkexec: when not given a program to execute, runs the users?
    shell by default
- Remove polkit-no-kded-leak.patch (upstreamed)</changelog>
  <changelog author="meissner@suse.com" date="1448539200">- polkit-revert-session-magic.patch: revert a session detection change
  that could lead to sessions not being detected as active due to
  a systemd bug. bsc#954139</changelog>
  <changelog author="fbui@suse.com" date="1465300800">- systemd.pc is shipped by systemd main package (bsc#983167)
  Strangely polkit wants systemd.pc to detect that the target system
  is running systemd even if its configured to build systemd support...</changelog>
  <changelog author="fbui@suse.com" date="1465387200">- Use pkgconfig() instead of requiring systemd package names directly.</changelog>
  <changelog author="lnussel@suse.de" date="1497355200">- Use gettext as fallback to get potential distro translations for
  polkit actions. Similar mechnism as used for desktop file
  translations. That way it's possible to use weblate to add
  additional translations that are not provided by upstream
  (polkit-gettext.patch).</changelog>
  <changelog author="dimstar@opensuse.org" date="1502798400">- Add polkit-itstools.patch: Add gettext support for .policy files.</changelog>
  <changelog author="dimstar@opensuse.org" date="1519819200">- Modernize spec-file by calling spec-cleaner</changelog>
  <changelog author="schwab@suse.de" date="1519905600">- pkexec.patch: pkexec: allow --version and --help even if not setuid</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1523275200">- Update to version 0.114:
  + Port to mozjs 52, the latest version of the firefox JavaScript
    engine.
  + Add gettext support for policy files.
  + Fixes for various memory leaks.
  + Updated translations.
- Update keyring with Ray Strode &lt;halfline@gmail.com&gt; public key.
- Drop with_systemd define and all conditionals and
  polkit-no-systemd.patch and ConsoleKit BuildRequires, we only
  support systemd now.
- Drop upstream fixed polkit-itstools.patch.
- Rebase pkexec.patch with quilt.
- Add gcc-c++ and pkgconfig(mozjs-52) BuildRequires: New
  dependencies.
- Drop conditional pkgconfig(mozjs-17.0) and pkgconfig(mozjs185):
  no longer supported.
- Drop autoconf and automake BuildRequires: They are implicit via
  libtool BuildRequires.
- Replace glib2-devel and gobject-introspection-devel with their
  pkgconfig counterparts: pkgconfig(gio-unix-2.0),
  pkgconfig(gmodule-2.0) and pkgconfig(gobject-introspection-1.0).
- Add polkit-jsauthority-pass-format-string.patch: jsauthority:
  pass "%s" format string to remaining report function, patch from
  upstream git, adding missed commit (bgo#105865).
- Drop polkit-revert-session-magic.patch: Upstream systemd bug is
  since a long time fixed (gh#systemd#58) (boo#954139).</changelog>
  <changelog author="meissner@suse.com" date="1531310400">- Update to version 0.115:
  - Fix CVE-2018-1116: Trusting client-supplied UID (bsc#1099031)
  - jsauthority: pass "%s" format string to remaining report function
    (obsoletes polkit-jsauthority-pass-format-string.patch)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1534507200">- Add polkit-fix-possible-resource-leak.patch: Fix possible
  resource leak found by static analyzer.
- Add polkit-fix-leaking-zombie-child-processes.patch: polkitd: fix
  zombie not reaped when js spawned process timed out (fdo#106021).</changelog>
  <changelog author="meissner@suse.com" date="1545307200">- polkit-CVE-2018-19788.patch: Fixed handling of UIDs over MAX_UINT
  (bsc#1118277 CVE-2018-19788)</changelog>
  <changelog author="mvetter@suse.com" date="1556280000">- bsc#1130588: Require shadow instead of old pwdutils
- User proper Requires(pre)/Requires(post) for permissions and
  shadow</changelog>
  <changelog author="dimstar@opensuse.org" date="1557489600">- Use systemd_ordering instead of systemd_requires: strictly
  speaking, polkit does not require systemd to be present. Just
  that when we install on a system with systemd (e.g outside
  containers) we would want systemd to be present before
  installing polkit. Help also reduce a cycle without special hacks
  in systemd.spec.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1559131200">- Update to version 0.116:
  + Leaking zombie child processes.
  + Possible resource leak found by static analyzer.
  + Output messages tuneup.
  + Sanity fixes.
  + pkttyagent tty echo disabled on SIGINT.
  + HACKING: add link to Code of Conduct.
  + polkitbackend: comment typos fix.
  + configure.ac: fix detection of systemd with cgroups v2.
  + CVE-2018-19788 High UIDs overflow fix.
  + CVE-2019-6133 Slowfork vulnerability fix.
  + Allow unset process-uid.
  + Port the JS authority to mozjs-60.
  + Use JS_EncodeStringToUTF8.
  + Updated translations.
- Replace pkgconfig(mozjs-52) with pkgconfig(mozjs-60)
  BuildRequires following upstreams changes.
- Drop patches fixed upstream:
  + polkit-fix-possible-resource-leak.patch
  + polkit-fix-leaking-zombie-child-processes.patch
  + polkit-CVE-2018-19788.patch
- Refresh patches with quilt.</changelog>
  <changelog author="meissner@suse.com" date="1570536000">- polkit-keyinit.patch: add pam_keyinit to the polkit configuration (bsc#1144053)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1575028800">- Fix usage of libexecdir instead of prefix/lib where applicable.</changelog>
  <changelog author="meissner@suse.com" date="1622116800">- CVE-2021-3560: fixed a local privilege escalation using polkit_system_bus_name_get_creds_sync()
  (bsc#1186497)
  CVE-2021-3560.patch</changelog>
  <changelog author="meissner@suse.com" date="1642075200">- CVE-2021-4034: fixed a local privilege escalation in pkexec (bsc#1194568)
  added CVE-2021-4034-pkexec-fix.patch</changelog>
  <changelog author="rfrohl@suse.com" date="1644235200">- CVE-2021-4115: fixed a denial of service via file descriptor leak (bsc#1195542)
  added CVE-2021-4115.patch</changelog>
</package>
<package pkgid="99773bb59e7499433b2c8b4cf8eaef83f96493d96cee163231a023de19badd46" name="polkit" arch="ppc64le">
  <version epoch="0" ver="0.116" rel="3.9.1"/>
  <changelog author="antoine.belvire@laposte.net" date="1438862400">- Update to 0.113:
  * Fix CVE-2015-4625
  * Fix CVE-2015-3256
  * Fix CVE-2015-3255
  * Fix CVE-2015-3218
  * On systemd-213 and later, the ?active? state is shared across
    all sessions of an user, instead of being tracked separately
  * pkexec: when not given a program to execute, runs the users?
    shell by default
- Remove polkit-no-kded-leak.patch (upstreamed)</changelog>
  <changelog author="meissner@suse.com" date="1448539200">- polkit-revert-session-magic.patch: revert a session detection change
  that could lead to sessions not being detected as active due to
  a systemd bug. bsc#954139</changelog>
  <changelog author="fbui@suse.com" date="1465300800">- systemd.pc is shipped by systemd main package (bsc#983167)
  Strangely polkit wants systemd.pc to detect that the target system
  is running systemd even if its configured to build systemd support...</changelog>
  <changelog author="fbui@suse.com" date="1465387200">- Use pkgconfig() instead of requiring systemd package names directly.</changelog>
  <changelog author="lnussel@suse.de" date="1497355200">- Use gettext as fallback to get potential distro translations for
  polkit actions. Similar mechnism as used for desktop file
  translations. That way it's possible to use weblate to add
  additional translations that are not provided by upstream
  (polkit-gettext.patch).</changelog>
  <changelog author="dimstar@opensuse.org" date="1502798400">- Add polkit-itstools.patch: Add gettext support for .policy files.</changelog>
  <changelog author="dimstar@opensuse.org" date="1519819200">- Modernize spec-file by calling spec-cleaner</changelog>
  <changelog author="schwab@suse.de" date="1519905600">- pkexec.patch: pkexec: allow --version and --help even if not setuid</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1523275200">- Update to version 0.114:
  + Port to mozjs 52, the latest version of the firefox JavaScript
    engine.
  + Add gettext support for policy files.
  + Fixes for various memory leaks.
  + Updated translations.
- Update keyring with Ray Strode &lt;halfline@gmail.com&gt; public key.
- Drop with_systemd define and all conditionals and
  polkit-no-systemd.patch and ConsoleKit BuildRequires, we only
  support systemd now.
- Drop upstream fixed polkit-itstools.patch.
- Rebase pkexec.patch with quilt.
- Add gcc-c++ and pkgconfig(mozjs-52) BuildRequires: New
  dependencies.
- Drop conditional pkgconfig(mozjs-17.0) and pkgconfig(mozjs185):
  no longer supported.
- Drop autoconf and automake BuildRequires: They are implicit via
  libtool BuildRequires.
- Replace glib2-devel and gobject-introspection-devel with their
  pkgconfig counterparts: pkgconfig(gio-unix-2.0),
  pkgconfig(gmodule-2.0) and pkgconfig(gobject-introspection-1.0).
- Add polkit-jsauthority-pass-format-string.patch: jsauthority:
  pass "%s" format string to remaining report function, patch from
  upstream git, adding missed commit (bgo#105865).
- Drop polkit-revert-session-magic.patch: Upstream systemd bug is
  since a long time fixed (gh#systemd#58) (boo#954139).</changelog>
  <changelog author="meissner@suse.com" date="1531310400">- Update to version 0.115:
  - Fix CVE-2018-1116: Trusting client-supplied UID (bsc#1099031)
  - jsauthority: pass "%s" format string to remaining report function
    (obsoletes polkit-jsauthority-pass-format-string.patch)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1534507200">- Add polkit-fix-possible-resource-leak.patch: Fix possible
  resource leak found by static analyzer.
- Add polkit-fix-leaking-zombie-child-processes.patch: polkitd: fix
  zombie not reaped when js spawned process timed out (fdo#106021).</changelog>
  <changelog author="meissner@suse.com" date="1545307200">- polkit-CVE-2018-19788.patch: Fixed handling of UIDs over MAX_UINT
  (bsc#1118277 CVE-2018-19788)</changelog>
  <changelog author="mvetter@suse.com" date="1556280000">- bsc#1130588: Require shadow instead of old pwdutils
- User proper Requires(pre)/Requires(post) for permissions and
  shadow</changelog>
  <changelog author="dimstar@opensuse.org" date="1557489600">- Use systemd_ordering instead of systemd_requires: strictly
  speaking, polkit does not require systemd to be present. Just
  that when we install on a system with systemd (e.g outside
  containers) we would want systemd to be present before
  installing polkit. Help also reduce a cycle without special hacks
  in systemd.spec.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1559131200">- Update to version 0.116:
  + Leaking zombie child processes.
  + Possible resource leak found by static analyzer.
  + Output messages tuneup.
  + Sanity fixes.
  + pkttyagent tty echo disabled on SIGINT.
  + HACKING: add link to Code of Conduct.
  + polkitbackend: comment typos fix.
  + configure.ac: fix detection of systemd with cgroups v2.
  + CVE-2018-19788 High UIDs overflow fix.
  + CVE-2019-6133 Slowfork vulnerability fix.
  + Allow unset process-uid.
  + Port the JS authority to mozjs-60.
  + Use JS_EncodeStringToUTF8.
  + Updated translations.
- Replace pkgconfig(mozjs-52) with pkgconfig(mozjs-60)
  BuildRequires following upstreams changes.
- Drop patches fixed upstream:
  + polkit-fix-possible-resource-leak.patch
  + polkit-fix-leaking-zombie-child-processes.patch
  + polkit-CVE-2018-19788.patch
- Refresh patches with quilt.</changelog>
  <changelog author="meissner@suse.com" date="1570536000">- polkit-keyinit.patch: add pam_keyinit to the polkit configuration (bsc#1144053)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1575028800">- Fix usage of libexecdir instead of prefix/lib where applicable.</changelog>
  <changelog author="meissner@suse.com" date="1622116800">- CVE-2021-3560: fixed a local privilege escalation using polkit_system_bus_name_get_creds_sync()
  (bsc#1186497)
  CVE-2021-3560.patch</changelog>
  <changelog author="meissner@suse.com" date="1642075200">- CVE-2021-4034: fixed a local privilege escalation in pkexec (bsc#1194568)
  added CVE-2021-4034-pkexec-fix.patch</changelog>
  <changelog author="rfrohl@suse.com" date="1644235200">- CVE-2021-4115: fixed a denial of service via file descriptor leak (bsc#1195542)
  added CVE-2021-4115.patch</changelog>
</package>
<package pkgid="a9d1af359c1d158571c403fd3b78c4d23206d7932012eb5eecf12adfdc0ec5ed" name="polkit" arch="s390x">
  <version epoch="0" ver="0.116" rel="3.9.1"/>
  <changelog author="antoine.belvire@laposte.net" date="1438862400">- Update to 0.113:
  * Fix CVE-2015-4625
  * Fix CVE-2015-3256
  * Fix CVE-2015-3255
  * Fix CVE-2015-3218
  * On systemd-213 and later, the ?active? state is shared across
    all sessions of an user, instead of being tracked separately
  * pkexec: when not given a program to execute, runs the users?
    shell by default
- Remove polkit-no-kded-leak.patch (upstreamed)</changelog>
  <changelog author="meissner@suse.com" date="1448539200">- polkit-revert-session-magic.patch: revert a session detection change
  that could lead to sessions not being detected as active due to
  a systemd bug. bsc#954139</changelog>
  <changelog author="fbui@suse.com" date="1465300800">- systemd.pc is shipped by systemd main package (bsc#983167)
  Strangely polkit wants systemd.pc to detect that the target system
  is running systemd even if its configured to build systemd support...</changelog>
  <changelog author="fbui@suse.com" date="1465387200">- Use pkgconfig() instead of requiring systemd package names directly.</changelog>
  <changelog author="lnussel@suse.de" date="1497355200">- Use gettext as fallback to get potential distro translations for
  polkit actions. Similar mechnism as used for desktop file
  translations. That way it's possible to use weblate to add
  additional translations that are not provided by upstream
  (polkit-gettext.patch).</changelog>
  <changelog author="dimstar@opensuse.org" date="1502798400">- Add polkit-itstools.patch: Add gettext support for .policy files.</changelog>
  <changelog author="dimstar@opensuse.org" date="1519819200">- Modernize spec-file by calling spec-cleaner</changelog>
  <changelog author="schwab@suse.de" date="1519905600">- pkexec.patch: pkexec: allow --version and --help even if not setuid</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1523275200">- Update to version 0.114:
  + Port to mozjs 52, the latest version of the firefox JavaScript
    engine.
  + Add gettext support for policy files.
  + Fixes for various memory leaks.
  + Updated translations.
- Update keyring with Ray Strode &lt;halfline@gmail.com&gt; public key.
- Drop with_systemd define and all conditionals and
  polkit-no-systemd.patch and ConsoleKit BuildRequires, we only
  support systemd now.
- Drop upstream fixed polkit-itstools.patch.
- Rebase pkexec.patch with quilt.
- Add gcc-c++ and pkgconfig(mozjs-52) BuildRequires: New
  dependencies.
- Drop conditional pkgconfig(mozjs-17.0) and pkgconfig(mozjs185):
  no longer supported.
- Drop autoconf and automake BuildRequires: They are implicit via
  libtool BuildRequires.
- Replace glib2-devel and gobject-introspection-devel with their
  pkgconfig counterparts: pkgconfig(gio-unix-2.0),
  pkgconfig(gmodule-2.0) and pkgconfig(gobject-introspection-1.0).
- Add polkit-jsauthority-pass-format-string.patch: jsauthority:
  pass "%s" format string to remaining report function, patch from
  upstream git, adding missed commit (bgo#105865).
- Drop polkit-revert-session-magic.patch: Upstream systemd bug is
  since a long time fixed (gh#systemd#58) (boo#954139).</changelog>
  <changelog author="meissner@suse.com" date="1531310400">- Update to version 0.115:
  - Fix CVE-2018-1116: Trusting client-supplied UID (bsc#1099031)
  - jsauthority: pass "%s" format string to remaining report function
    (obsoletes polkit-jsauthority-pass-format-string.patch)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1534507200">- Add polkit-fix-possible-resource-leak.patch: Fix possible
  resource leak found by static analyzer.
- Add polkit-fix-leaking-zombie-child-processes.patch: polkitd: fix
  zombie not reaped when js spawned process timed out (fdo#106021).</changelog>
  <changelog author="meissner@suse.com" date="1545307200">- polkit-CVE-2018-19788.patch: Fixed handling of UIDs over MAX_UINT
  (bsc#1118277 CVE-2018-19788)</changelog>
  <changelog author="mvetter@suse.com" date="1556280000">- bsc#1130588: Require shadow instead of old pwdutils
- User proper Requires(pre)/Requires(post) for permissions and
  shadow</changelog>
  <changelog author="dimstar@opensuse.org" date="1557489600">- Use systemd_ordering instead of systemd_requires: strictly
  speaking, polkit does not require systemd to be present. Just
  that when we install on a system with systemd (e.g outside
  containers) we would want systemd to be present before
  installing polkit. Help also reduce a cycle without special hacks
  in systemd.spec.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1559131200">- Update to version 0.116:
  + Leaking zombie child processes.
  + Possible resource leak found by static analyzer.
  + Output messages tuneup.
  + Sanity fixes.
  + pkttyagent tty echo disabled on SIGINT.
  + HACKING: add link to Code of Conduct.
  + polkitbackend: comment typos fix.
  + configure.ac: fix detection of systemd with cgroups v2.
  + CVE-2018-19788 High UIDs overflow fix.
  + CVE-2019-6133 Slowfork vulnerability fix.
  + Allow unset process-uid.
  + Port the JS authority to mozjs-60.
  + Use JS_EncodeStringToUTF8.
  + Updated translations.
- Replace pkgconfig(mozjs-52) with pkgconfig(mozjs-60)
  BuildRequires following upstreams changes.
- Drop patches fixed upstream:
  + polkit-fix-possible-resource-leak.patch
  + polkit-fix-leaking-zombie-child-processes.patch
  + polkit-CVE-2018-19788.patch
- Refresh patches with quilt.</changelog>
  <changelog author="meissner@suse.com" date="1570536000">- polkit-keyinit.patch: add pam_keyinit to the polkit configuration (bsc#1144053)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1575028800">- Fix usage of libexecdir instead of prefix/lib where applicable.</changelog>
  <changelog author="meissner@suse.com" date="1622116800">- CVE-2021-3560: fixed a local privilege escalation using polkit_system_bus_name_get_creds_sync()
  (bsc#1186497)
  CVE-2021-3560.patch</changelog>
  <changelog author="meissner@suse.com" date="1642075200">- CVE-2021-4034: fixed a local privilege escalation in pkexec (bsc#1194568)
  added CVE-2021-4034-pkexec-fix.patch</changelog>
  <changelog author="rfrohl@suse.com" date="1644235200">- CVE-2021-4115: fixed a denial of service via file descriptor leak (bsc#1195542)
  added CVE-2021-4115.patch</changelog>
</package>
<package pkgid="79e048ccdea175f3cf1b53cc874785babdeedcfe76e1523738d1aec917212f9e" name="polkit" arch="src">
  <version epoch="0" ver="0.116" rel="3.9.1"/>
  <changelog author="antoine.belvire@laposte.net" date="1438862400">- Update to 0.113:
  * Fix CVE-2015-4625
  * Fix CVE-2015-3256
  * Fix CVE-2015-3255
  * Fix CVE-2015-3218
  * On systemd-213 and later, the ?active? state is shared across
    all sessions of an user, instead of being tracked separately
  * pkexec: when not given a program to execute, runs the users?
    shell by default
- Remove polkit-no-kded-leak.patch (upstreamed)</changelog>
  <changelog author="meissner@suse.com" date="1448539200">- polkit-revert-session-magic.patch: revert a session detection change
  that could lead to sessions not being detected as active due to
  a systemd bug. bsc#954139</changelog>
  <changelog author="fbui@suse.com" date="1465300800">- systemd.pc is shipped by systemd main package (bsc#983167)
  Strangely polkit wants systemd.pc to detect that the target system
  is running systemd even if its configured to build systemd support...</changelog>
  <changelog author="fbui@suse.com" date="1465387200">- Use pkgconfig() instead of requiring systemd package names directly.</changelog>
  <changelog author="lnussel@suse.de" date="1497355200">- Use gettext as fallback to get potential distro translations for
  polkit actions. Similar mechnism as used for desktop file
  translations. That way it's possible to use weblate to add
  additional translations that are not provided by upstream
  (polkit-gettext.patch).</changelog>
  <changelog author="dimstar@opensuse.org" date="1502798400">- Add polkit-itstools.patch: Add gettext support for .policy files.</changelog>
  <changelog author="dimstar@opensuse.org" date="1519819200">- Modernize spec-file by calling spec-cleaner</changelog>
  <changelog author="schwab@suse.de" date="1519905600">- pkexec.patch: pkexec: allow --version and --help even if not setuid</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1523275200">- Update to version 0.114:
  + Port to mozjs 52, the latest version of the firefox JavaScript
    engine.
  + Add gettext support for policy files.
  + Fixes for various memory leaks.
  + Updated translations.
- Update keyring with Ray Strode &lt;halfline@gmail.com&gt; public key.
- Drop with_systemd define and all conditionals and
  polkit-no-systemd.patch and ConsoleKit BuildRequires, we only
  support systemd now.
- Drop upstream fixed polkit-itstools.patch.
- Rebase pkexec.patch with quilt.
- Add gcc-c++ and pkgconfig(mozjs-52) BuildRequires: New
  dependencies.
- Drop conditional pkgconfig(mozjs-17.0) and pkgconfig(mozjs185):
  no longer supported.
- Drop autoconf and automake BuildRequires: They are implicit via
  libtool BuildRequires.
- Replace glib2-devel and gobject-introspection-devel with their
  pkgconfig counterparts: pkgconfig(gio-unix-2.0),
  pkgconfig(gmodule-2.0) and pkgconfig(gobject-introspection-1.0).
- Add polkit-jsauthority-pass-format-string.patch: jsauthority:
  pass "%s" format string to remaining report function, patch from
  upstream git, adding missed commit (bgo#105865).
- Drop polkit-revert-session-magic.patch: Upstream systemd bug is
  since a long time fixed (gh#systemd#58) (boo#954139).</changelog>
  <changelog author="meissner@suse.com" date="1531310400">- Update to version 0.115:
  - Fix CVE-2018-1116: Trusting client-supplied UID (bsc#1099031)
  - jsauthority: pass "%s" format string to remaining report function
    (obsoletes polkit-jsauthority-pass-format-string.patch)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1534507200">- Add polkit-fix-possible-resource-leak.patch: Fix possible
  resource leak found by static analyzer.
- Add polkit-fix-leaking-zombie-child-processes.patch: polkitd: fix
  zombie not reaped when js spawned process timed out (fdo#106021).</changelog>
  <changelog author="meissner@suse.com" date="1545307200">- polkit-CVE-2018-19788.patch: Fixed handling of UIDs over MAX_UINT
  (bsc#1118277 CVE-2018-19788)</changelog>
  <changelog author="mvetter@suse.com" date="1556280000">- bsc#1130588: Require shadow instead of old pwdutils
- User proper Requires(pre)/Requires(post) for permissions and
  shadow</changelog>
  <changelog author="dimstar@opensuse.org" date="1557489600">- Use systemd_ordering instead of systemd_requires: strictly
  speaking, polkit does not require systemd to be present. Just
  that when we install on a system with systemd (e.g outside
  containers) we would want systemd to be present before
  installing polkit. Help also reduce a cycle without special hacks
  in systemd.spec.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1559131200">- Update to version 0.116:
  + Leaking zombie child processes.
  + Possible resource leak found by static analyzer.
  + Output messages tuneup.
  + Sanity fixes.
  + pkttyagent tty echo disabled on SIGINT.
  + HACKING: add link to Code of Conduct.
  + polkitbackend: comment typos fix.
  + configure.ac: fix detection of systemd with cgroups v2.
  + CVE-2018-19788 High UIDs overflow fix.
  + CVE-2019-6133 Slowfork vulnerability fix.
  + Allow unset process-uid.
  + Port the JS authority to mozjs-60.
  + Use JS_EncodeStringToUTF8.
  + Updated translations.
- Replace pkgconfig(mozjs-52) with pkgconfig(mozjs-60)
  BuildRequires following upstreams changes.
- Drop patches fixed upstream:
  + polkit-fix-possible-resource-leak.patch
  + polkit-fix-leaking-zombie-child-processes.patch
  + polkit-CVE-2018-19788.patch
- Refresh patches with quilt.</changelog>
  <changelog author="meissner@suse.com" date="1570536000">- polkit-keyinit.patch: add pam_keyinit to the polkit configuration (bsc#1144053)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1575028800">- Fix usage of libexecdir instead of prefix/lib where applicable.</changelog>
  <changelog author="meissner@suse.com" date="1622116800">- CVE-2021-3560: fixed a local privilege escalation using polkit_system_bus_name_get_creds_sync()
  (bsc#1186497)
  CVE-2021-3560.patch</changelog>
  <changelog author="meissner@suse.com" date="1642075200">- CVE-2021-4034: fixed a local privilege escalation in pkexec (bsc#1194568)
  added CVE-2021-4034-pkexec-fix.patch</changelog>
  <changelog author="rfrohl@suse.com" date="1644235200">- CVE-2021-4115: fixed a denial of service via file descriptor leak (bsc#1195542)
  added CVE-2021-4115.patch</changelog>
</package>
<package pkgid="4dfd09b831cfa804d8214c8b027ae4e27c26c44572f7f861b4ac453fccad8a1f" name="polkit" arch="x86_64">
  <version epoch="0" ver="0.116" rel="3.9.1"/>
  <changelog author="antoine.belvire@laposte.net" date="1438862400">- Update to 0.113:
  * Fix CVE-2015-4625
  * Fix CVE-2015-3256
  * Fix CVE-2015-3255
  * Fix CVE-2015-3218
  * On systemd-213 and later, the ?active? state is shared across
    all sessions of an user, instead of being tracked separately
  * pkexec: when not given a program to execute, runs the users?
    shell by default
- Remove polkit-no-kded-leak.patch (upstreamed)</changelog>
  <changelog author="meissner@suse.com" date="1448539200">- polkit-revert-session-magic.patch: revert a session detection change
  that could lead to sessions not being detected as active due to
  a systemd bug. bsc#954139</changelog>
  <changelog author="fbui@suse.com" date="1465300800">- systemd.pc is shipped by systemd main package (bsc#983167)
  Strangely polkit wants systemd.pc to detect that the target system
  is running systemd even if its configured to build systemd support...</changelog>
  <changelog author="fbui@suse.com" date="1465387200">- Use pkgconfig() instead of requiring systemd package names directly.</changelog>
  <changelog author="lnussel@suse.de" date="1497355200">- Use gettext as fallback to get potential distro translations for
  polkit actions. Similar mechnism as used for desktop file
  translations. That way it's possible to use weblate to add
  additional translations that are not provided by upstream
  (polkit-gettext.patch).</changelog>
  <changelog author="dimstar@opensuse.org" date="1502798400">- Add polkit-itstools.patch: Add gettext support for .policy files.</changelog>
  <changelog author="dimstar@opensuse.org" date="1519819200">- Modernize spec-file by calling spec-cleaner</changelog>
  <changelog author="schwab@suse.de" date="1519905600">- pkexec.patch: pkexec: allow --version and --help even if not setuid</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1523275200">- Update to version 0.114:
  + Port to mozjs 52, the latest version of the firefox JavaScript
    engine.
  + Add gettext support for policy files.
  + Fixes for various memory leaks.
  + Updated translations.
- Update keyring with Ray Strode &lt;halfline@gmail.com&gt; public key.
- Drop with_systemd define and all conditionals and
  polkit-no-systemd.patch and ConsoleKit BuildRequires, we only
  support systemd now.
- Drop upstream fixed polkit-itstools.patch.
- Rebase pkexec.patch with quilt.
- Add gcc-c++ and pkgconfig(mozjs-52) BuildRequires: New
  dependencies.
- Drop conditional pkgconfig(mozjs-17.0) and pkgconfig(mozjs185):
  no longer supported.
- Drop autoconf and automake BuildRequires: They are implicit via
  libtool BuildRequires.
- Replace glib2-devel and gobject-introspection-devel with their
  pkgconfig counterparts: pkgconfig(gio-unix-2.0),
  pkgconfig(gmodule-2.0) and pkgconfig(gobject-introspection-1.0).
- Add polkit-jsauthority-pass-format-string.patch: jsauthority:
  pass "%s" format string to remaining report function, patch from
  upstream git, adding missed commit (bgo#105865).
- Drop polkit-revert-session-magic.patch: Upstream systemd bug is
  since a long time fixed (gh#systemd#58) (boo#954139).</changelog>
  <changelog author="meissner@suse.com" date="1531310400">- Update to version 0.115:
  - Fix CVE-2018-1116: Trusting client-supplied UID (bsc#1099031)
  - jsauthority: pass "%s" format string to remaining report function
    (obsoletes polkit-jsauthority-pass-format-string.patch)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1534507200">- Add polkit-fix-possible-resource-leak.patch: Fix possible
  resource leak found by static analyzer.
- Add polkit-fix-leaking-zombie-child-processes.patch: polkitd: fix
  zombie not reaped when js spawned process timed out (fdo#106021).</changelog>
  <changelog author="meissner@suse.com" date="1545307200">- polkit-CVE-2018-19788.patch: Fixed handling of UIDs over MAX_UINT
  (bsc#1118277 CVE-2018-19788)</changelog>
  <changelog author="mvetter@suse.com" date="1556280000">- bsc#1130588: Require shadow instead of old pwdutils
- User proper Requires(pre)/Requires(post) for permissions and
  shadow</changelog>
  <changelog author="dimstar@opensuse.org" date="1557489600">- Use systemd_ordering instead of systemd_requires: strictly
  speaking, polkit does not require systemd to be present. Just
  that when we install on a system with systemd (e.g outside
  containers) we would want systemd to be present before
  installing polkit. Help also reduce a cycle without special hacks
  in systemd.spec.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1559131200">- Update to version 0.116:
  + Leaking zombie child processes.
  + Possible resource leak found by static analyzer.
  + Output messages tuneup.
  + Sanity fixes.
  + pkttyagent tty echo disabled on SIGINT.
  + HACKING: add link to Code of Conduct.
  + polkitbackend: comment typos fix.
  + configure.ac: fix detection of systemd with cgroups v2.
  + CVE-2018-19788 High UIDs overflow fix.
  + CVE-2019-6133 Slowfork vulnerability fix.
  + Allow unset process-uid.
  + Port the JS authority to mozjs-60.
  + Use JS_EncodeStringToUTF8.
  + Updated translations.
- Replace pkgconfig(mozjs-52) with pkgconfig(mozjs-60)
  BuildRequires following upstreams changes.
- Drop patches fixed upstream:
  + polkit-fix-possible-resource-leak.patch
  + polkit-fix-leaking-zombie-child-processes.patch
  + polkit-CVE-2018-19788.patch
- Refresh patches with quilt.</changelog>
  <changelog author="meissner@suse.com" date="1570536000">- polkit-keyinit.patch: add pam_keyinit to the polkit configuration (bsc#1144053)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1575028800">- Fix usage of libexecdir instead of prefix/lib where applicable.</changelog>
  <changelog author="meissner@suse.com" date="1622116800">- CVE-2021-3560: fixed a local privilege escalation using polkit_system_bus_name_get_creds_sync()
  (bsc#1186497)
  CVE-2021-3560.patch</changelog>
  <changelog author="meissner@suse.com" date="1642075200">- CVE-2021-4034: fixed a local privilege escalation in pkexec (bsc#1194568)
  added CVE-2021-4034-pkexec-fix.patch</changelog>
  <changelog author="rfrohl@suse.com" date="1644235200">- CVE-2021-4115: fixed a denial of service via file descriptor leak (bsc#1195542)
  added CVE-2021-4115.patch</changelog>
</package>
<package pkgid="c7775db7f81ada3e8203f46fd0dd0295ef9c7bc7387e96d87b6ceffe8579827f" name="polkit-devel" arch="aarch64">
  <version epoch="0" ver="0.116" rel="3.9.1"/>
  <changelog author="antoine.belvire@laposte.net" date="1438862400">- Update to 0.113:
  * Fix CVE-2015-4625
  * Fix CVE-2015-3256
  * Fix CVE-2015-3255
  * Fix CVE-2015-3218
  * On systemd-213 and later, the ?active? state is shared across
    all sessions of an user, instead of being tracked separately
  * pkexec: when not given a program to execute, runs the users?
    shell by default
- Remove polkit-no-kded-leak.patch (upstreamed)</changelog>
  <changelog author="meissner@suse.com" date="1448539200">- polkit-revert-session-magic.patch: revert a session detection change
  that could lead to sessions not being detected as active due to
  a systemd bug. bsc#954139</changelog>
  <changelog author="fbui@suse.com" date="1465300800">- systemd.pc is shipped by systemd main package (bsc#983167)
  Strangely polkit wants systemd.pc to detect that the target system
  is running systemd even if its configured to build systemd support...</changelog>
  <changelog author="fbui@suse.com" date="1465387200">- Use pkgconfig() instead of requiring systemd package names directly.</changelog>
  <changelog author="lnussel@suse.de" date="1497355200">- Use gettext as fallback to get potential distro translations for
  polkit actions. Similar mechnism as used for desktop file
  translations. That way it's possible to use weblate to add
  additional translations that are not provided by upstream
  (polkit-gettext.patch).</changelog>
  <changelog author="dimstar@opensuse.org" date="1502798400">- Add polkit-itstools.patch: Add gettext support for .policy files.</changelog>
  <changelog author="dimstar@opensuse.org" date="1519819200">- Modernize spec-file by calling spec-cleaner</changelog>
  <changelog author="schwab@suse.de" date="1519905600">- pkexec.patch: pkexec: allow --version and --help even if not setuid</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1523275200">- Update to version 0.114:
  + Port to mozjs 52, the latest version of the firefox JavaScript
    engine.
  + Add gettext support for policy files.
  + Fixes for various memory leaks.
  + Updated translations.
- Update keyring with Ray Strode &lt;halfline@gmail.com&gt; public key.
- Drop with_systemd define and all conditionals and
  polkit-no-systemd.patch and ConsoleKit BuildRequires, we only
  support systemd now.
- Drop upstream fixed polkit-itstools.patch.
- Rebase pkexec.patch with quilt.
- Add gcc-c++ and pkgconfig(mozjs-52) BuildRequires: New
  dependencies.
- Drop conditional pkgconfig(mozjs-17.0) and pkgconfig(mozjs185):
  no longer supported.
- Drop autoconf and automake BuildRequires: They are implicit via
  libtool BuildRequires.
- Replace glib2-devel and gobject-introspection-devel with their
  pkgconfig counterparts: pkgconfig(gio-unix-2.0),
  pkgconfig(gmodule-2.0) and pkgconfig(gobject-introspection-1.0).
- Add polkit-jsauthority-pass-format-string.patch: jsauthority:
  pass "%s" format string to remaining report function, patch from
  upstream git, adding missed commit (bgo#105865).
- Drop polkit-revert-session-magic.patch: Upstream systemd bug is
  since a long time fixed (gh#systemd#58) (boo#954139).</changelog>
  <changelog author="meissner@suse.com" date="1531310400">- Update to version 0.115:
  - Fix CVE-2018-1116: Trusting client-supplied UID (bsc#1099031)
  - jsauthority: pass "%s" format string to remaining report function
    (obsoletes polkit-jsauthority-pass-format-string.patch)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1534507200">- Add polkit-fix-possible-resource-leak.patch: Fix possible
  resource leak found by static analyzer.
- Add polkit-fix-leaking-zombie-child-processes.patch: polkitd: fix
  zombie not reaped when js spawned process timed out (fdo#106021).</changelog>
  <changelog author="meissner@suse.com" date="1545307200">- polkit-CVE-2018-19788.patch: Fixed handling of UIDs over MAX_UINT
  (bsc#1118277 CVE-2018-19788)</changelog>
  <changelog author="mvetter@suse.com" date="1556280000">- bsc#1130588: Require shadow instead of old pwdutils
- User proper Requires(pre)/Requires(post) for permissions and
  shadow</changelog>
  <changelog author="dimstar@opensuse.org" date="1557489600">- Use systemd_ordering instead of systemd_requires: strictly
  speaking, polkit does not require systemd to be present. Just
  that when we install on a system with systemd (e.g outside
  containers) we would want systemd to be present before
  installing polkit. Help also reduce a cycle without special hacks
  in systemd.spec.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1559131200">- Update to version 0.116:
  + Leaking zombie child processes.
  + Possible resource leak found by static analyzer.
  + Output messages tuneup.
  + Sanity fixes.
  + pkttyagent tty echo disabled on SIGINT.
  + HACKING: add link to Code of Conduct.
  + polkitbackend: comment typos fix.
  + configure.ac: fix detection of systemd with cgroups v2.
  + CVE-2018-19788 High UIDs overflow fix.
  + CVE-2019-6133 Slowfork vulnerability fix.
  + Allow unset process-uid.
  + Port the JS authority to mozjs-60.
  + Use JS_EncodeStringToUTF8.
  + Updated translations.
- Replace pkgconfig(mozjs-52) with pkgconfig(mozjs-60)
  BuildRequires following upstreams changes.
- Drop patches fixed upstream:
  + polkit-fix-possible-resource-leak.patch
  + polkit-fix-leaking-zombie-child-processes.patch
  + polkit-CVE-2018-19788.patch
- Refresh patches with quilt.</changelog>
  <changelog author="meissner@suse.com" date="1570536000">- polkit-keyinit.patch: add pam_keyinit to the polkit configuration (bsc#1144053)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1575028800">- Fix usage of libexecdir instead of prefix/lib where applicable.</changelog>
  <changelog author="meissner@suse.com" date="1622116800">- CVE-2021-3560: fixed a local privilege escalation using polkit_system_bus_name_get_creds_sync()
  (bsc#1186497)
  CVE-2021-3560.patch</changelog>
  <changelog author="meissner@suse.com" date="1642075200">- CVE-2021-4034: fixed a local privilege escalation in pkexec (bsc#1194568)
  added CVE-2021-4034-pkexec-fix.patch</changelog>
  <changelog author="rfrohl@suse.com" date="1644235200">- CVE-2021-4115: fixed a denial of service via file descriptor leak (bsc#1195542)
  added CVE-2021-4115.patch</changelog>
</package>
<package pkgid="e07443d4296e88400a72d5a7c5d1b4bbc7d64b22a3000509aee63286d97461d0" name="polkit-devel" arch="ppc64le">
  <version epoch="0" ver="0.116" rel="3.9.1"/>
  <changelog author="antoine.belvire@laposte.net" date="1438862400">- Update to 0.113:
  * Fix CVE-2015-4625
  * Fix CVE-2015-3256
  * Fix CVE-2015-3255
  * Fix CVE-2015-3218
  * On systemd-213 and later, the ?active? state is shared across
    all sessions of an user, instead of being tracked separately
  * pkexec: when not given a program to execute, runs the users?
    shell by default
- Remove polkit-no-kded-leak.patch (upstreamed)</changelog>
  <changelog author="meissner@suse.com" date="1448539200">- polkit-revert-session-magic.patch: revert a session detection change
  that could lead to sessions not being detected as active due to
  a systemd bug. bsc#954139</changelog>
  <changelog author="fbui@suse.com" date="1465300800">- systemd.pc is shipped by systemd main package (bsc#983167)
  Strangely polkit wants systemd.pc to detect that the target system
  is running systemd even if its configured to build systemd support...</changelog>
  <changelog author="fbui@suse.com" date="1465387200">- Use pkgconfig() instead of requiring systemd package names directly.</changelog>
  <changelog author="lnussel@suse.de" date="1497355200">- Use gettext as fallback to get potential distro translations for
  polkit actions. Similar mechnism as used for desktop file
  translations. That way it's possible to use weblate to add
  additional translations that are not provided by upstream
  (polkit-gettext.patch).</changelog>
  <changelog author="dimstar@opensuse.org" date="1502798400">- Add polkit-itstools.patch: Add gettext support for .policy files.</changelog>
  <changelog author="dimstar@opensuse.org" date="1519819200">- Modernize spec-file by calling spec-cleaner</changelog>
  <changelog author="schwab@suse.de" date="1519905600">- pkexec.patch: pkexec: allow --version and --help even if not setuid</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1523275200">- Update to version 0.114:
  + Port to mozjs 52, the latest version of the firefox JavaScript
    engine.
  + Add gettext support for policy files.
  + Fixes for various memory leaks.
  + Updated translations.
- Update keyring with Ray Strode &lt;halfline@gmail.com&gt; public key.
- Drop with_systemd define and all conditionals and
  polkit-no-systemd.patch and ConsoleKit BuildRequires, we only
  support systemd now.
- Drop upstream fixed polkit-itstools.patch.
- Rebase pkexec.patch with quilt.
- Add gcc-c++ and pkgconfig(mozjs-52) BuildRequires: New
  dependencies.
- Drop conditional pkgconfig(mozjs-17.0) and pkgconfig(mozjs185):
  no longer supported.
- Drop autoconf and automake BuildRequires: They are implicit via
  libtool BuildRequires.
- Replace glib2-devel and gobject-introspection-devel with their
  pkgconfig counterparts: pkgconfig(gio-unix-2.0),
  pkgconfig(gmodule-2.0) and pkgconfig(gobject-introspection-1.0).
- Add polkit-jsauthority-pass-format-string.patch: jsauthority:
  pass "%s" format string to remaining report function, patch from
  upstream git, adding missed commit (bgo#105865).
- Drop polkit-revert-session-magic.patch: Upstream systemd bug is
  since a long time fixed (gh#systemd#58) (boo#954139).</changelog>
  <changelog author="meissner@suse.com" date="1531310400">- Update to version 0.115:
  - Fix CVE-2018-1116: Trusting client-supplied UID (bsc#1099031)
  - jsauthority: pass "%s" format string to remaining report function
    (obsoletes polkit-jsauthority-pass-format-string.patch)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1534507200">- Add polkit-fix-possible-resource-leak.patch: Fix possible
  resource leak found by static analyzer.
- Add polkit-fix-leaking-zombie-child-processes.patch: polkitd: fix
  zombie not reaped when js spawned process timed out (fdo#106021).</changelog>
  <changelog author="meissner@suse.com" date="1545307200">- polkit-CVE-2018-19788.patch: Fixed handling of UIDs over MAX_UINT
  (bsc#1118277 CVE-2018-19788)</changelog>
  <changelog author="mvetter@suse.com" date="1556280000">- bsc#1130588: Require shadow instead of old pwdutils
- User proper Requires(pre)/Requires(post) for permissions and
  shadow</changelog>
  <changelog author="dimstar@opensuse.org" date="1557489600">- Use systemd_ordering instead of systemd_requires: strictly
  speaking, polkit does not require systemd to be present. Just
  that when we install on a system with systemd (e.g outside
  containers) we would want systemd to be present before
  installing polkit. Help also reduce a cycle without special hacks
  in systemd.spec.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1559131200">- Update to version 0.116:
  + Leaking zombie child processes.
  + Possible resource leak found by static analyzer.
  + Output messages tuneup.
  + Sanity fixes.
  + pkttyagent tty echo disabled on SIGINT.
  + HACKING: add link to Code of Conduct.
  + polkitbackend: comment typos fix.
  + configure.ac: fix detection of systemd with cgroups v2.
  + CVE-2018-19788 High UIDs overflow fix.
  + CVE-2019-6133 Slowfork vulnerability fix.
  + Allow unset process-uid.
  + Port the JS authority to mozjs-60.
  + Use JS_EncodeStringToUTF8.
  + Updated translations.
- Replace pkgconfig(mozjs-52) with pkgconfig(mozjs-60)
  BuildRequires following upstreams changes.
- Drop patches fixed upstream:
  + polkit-fix-possible-resource-leak.patch
  + polkit-fix-leaking-zombie-child-processes.patch
  + polkit-CVE-2018-19788.patch
- Refresh patches with quilt.</changelog>
  <changelog author="meissner@suse.com" date="1570536000">- polkit-keyinit.patch: add pam_keyinit to the polkit configuration (bsc#1144053)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1575028800">- Fix usage of libexecdir instead of prefix/lib where applicable.</changelog>
  <changelog author="meissner@suse.com" date="1622116800">- CVE-2021-3560: fixed a local privilege escalation using polkit_system_bus_name_get_creds_sync()
  (bsc#1186497)
  CVE-2021-3560.patch</changelog>
  <changelog author="meissner@suse.com" date="1642075200">- CVE-2021-4034: fixed a local privilege escalation in pkexec (bsc#1194568)
  added CVE-2021-4034-pkexec-fix.patch</changelog>
  <changelog author="rfrohl@suse.com" date="1644235200">- CVE-2021-4115: fixed a denial of service via file descriptor leak (bsc#1195542)
  added CVE-2021-4115.patch</changelog>
</package>
<package pkgid="4d43ee455831f51a8eee78d9e842172dbb10af9c42e682be9216bd02b18f5771" name="polkit-devel" arch="s390x">
  <version epoch="0" ver="0.116" rel="3.9.1"/>
  <changelog author="antoine.belvire@laposte.net" date="1438862400">- Update to 0.113:
  * Fix CVE-2015-4625
  * Fix CVE-2015-3256
  * Fix CVE-2015-3255
  * Fix CVE-2015-3218
  * On systemd-213 and later, the ?active? state is shared across
    all sessions of an user, instead of being tracked separately
  * pkexec: when not given a program to execute, runs the users?
    shell by default
- Remove polkit-no-kded-leak.patch (upstreamed)</changelog>
  <changelog author="meissner@suse.com" date="1448539200">- polkit-revert-session-magic.patch: revert a session detection change
  that could lead to sessions not being detected as active due to
  a systemd bug. bsc#954139</changelog>
  <changelog author="fbui@suse.com" date="1465300800">- systemd.pc is shipped by systemd main package (bsc#983167)
  Strangely polkit wants systemd.pc to detect that the target system
  is running systemd even if its configured to build systemd support...</changelog>
  <changelog author="fbui@suse.com" date="1465387200">- Use pkgconfig() instead of requiring systemd package names directly.</changelog>
  <changelog author="lnussel@suse.de" date="1497355200">- Use gettext as fallback to get potential distro translations for
  polkit actions. Similar mechnism as used for desktop file
  translations. That way it's possible to use weblate to add
  additional translations that are not provided by upstream
  (polkit-gettext.patch).</changelog>
  <changelog author="dimstar@opensuse.org" date="1502798400">- Add polkit-itstools.patch: Add gettext support for .policy files.</changelog>
  <changelog author="dimstar@opensuse.org" date="1519819200">- Modernize spec-file by calling spec-cleaner</changelog>
  <changelog author="schwab@suse.de" date="1519905600">- pkexec.patch: pkexec: allow --version and --help even if not setuid</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1523275200">- Update to version 0.114:
  + Port to mozjs 52, the latest version of the firefox JavaScript
    engine.
  + Add gettext support for policy files.
  + Fixes for various memory leaks.
  + Updated translations.
- Update keyring with Ray Strode &lt;halfline@gmail.com&gt; public key.
- Drop with_systemd define and all conditionals and
  polkit-no-systemd.patch and ConsoleKit BuildRequires, we only
  support systemd now.
- Drop upstream fixed polkit-itstools.patch.
- Rebase pkexec.patch with quilt.
- Add gcc-c++ and pkgconfig(mozjs-52) BuildRequires: New
  dependencies.
- Drop conditional pkgconfig(mozjs-17.0) and pkgconfig(mozjs185):
  no longer supported.
- Drop autoconf and automake BuildRequires: They are implicit via
  libtool BuildRequires.
- Replace glib2-devel and gobject-introspection-devel with their
  pkgconfig counterparts: pkgconfig(gio-unix-2.0),
  pkgconfig(gmodule-2.0) and pkgconfig(gobject-introspection-1.0).
- Add polkit-jsauthority-pass-format-string.patch: jsauthority:
  pass "%s" format string to remaining report function, patch from
  upstream git, adding missed commit (bgo#105865).
- Drop polkit-revert-session-magic.patch: Upstream systemd bug is
  since a long time fixed (gh#systemd#58) (boo#954139).</changelog>
  <changelog author="meissner@suse.com" date="1531310400">- Update to version 0.115:
  - Fix CVE-2018-1116: Trusting client-supplied UID (bsc#1099031)
  - jsauthority: pass "%s" format string to remaining report function
    (obsoletes polkit-jsauthority-pass-format-string.patch)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1534507200">- Add polkit-fix-possible-resource-leak.patch: Fix possible
  resource leak found by static analyzer.
- Add polkit-fix-leaking-zombie-child-processes.patch: polkitd: fix
  zombie not reaped when js spawned process timed out (fdo#106021).</changelog>
  <changelog author="meissner@suse.com" date="1545307200">- polkit-CVE-2018-19788.patch: Fixed handling of UIDs over MAX_UINT
  (bsc#1118277 CVE-2018-19788)</changelog>
  <changelog author="mvetter@suse.com" date="1556280000">- bsc#1130588: Require shadow instead of old pwdutils
- User proper Requires(pre)/Requires(post) for permissions and
  shadow</changelog>
  <changelog author="dimstar@opensuse.org" date="1557489600">- Use systemd_ordering instead of systemd_requires: strictly
  speaking, polkit does not require systemd to be present. Just
  that when we install on a system with systemd (e.g outside
  containers) we would want systemd to be present before
  installing polkit. Help also reduce a cycle without special hacks
  in systemd.spec.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1559131200">- Update to version 0.116:
  + Leaking zombie child processes.
  + Possible resource leak found by static analyzer.
  + Output messages tuneup.
  + Sanity fixes.
  + pkttyagent tty echo disabled on SIGINT.
  + HACKING: add link to Code of Conduct.
  + polkitbackend: comment typos fix.
  + configure.ac: fix detection of systemd with cgroups v2.
  + CVE-2018-19788 High UIDs overflow fix.
  + CVE-2019-6133 Slowfork vulnerability fix.
  + Allow unset process-uid.
  + Port the JS authority to mozjs-60.
  + Use JS_EncodeStringToUTF8.
  + Updated translations.
- Replace pkgconfig(mozjs-52) with pkgconfig(mozjs-60)
  BuildRequires following upstreams changes.
- Drop patches fixed upstream:
  + polkit-fix-possible-resource-leak.patch
  + polkit-fix-leaking-zombie-child-processes.patch
  + polkit-CVE-2018-19788.patch
- Refresh patches with quilt.</changelog>
  <changelog author="meissner@suse.com" date="1570536000">- polkit-keyinit.patch: add pam_keyinit to the polkit configuration (bsc#1144053)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1575028800">- Fix usage of libexecdir instead of prefix/lib where applicable.</changelog>
  <changelog author="meissner@suse.com" date="1622116800">- CVE-2021-3560: fixed a local privilege escalation using polkit_system_bus_name_get_creds_sync()
  (bsc#1186497)
  CVE-2021-3560.patch</changelog>
  <changelog author="meissner@suse.com" date="1642075200">- CVE-2021-4034: fixed a local privilege escalation in pkexec (bsc#1194568)
  added CVE-2021-4034-pkexec-fix.patch</changelog>
  <changelog author="rfrohl@suse.com" date="1644235200">- CVE-2021-4115: fixed a denial of service via file descriptor leak (bsc#1195542)
  added CVE-2021-4115.patch</changelog>
</package>
<package pkgid="ab5dc08e95091e5aec528b675e5bac27d433c908ca63ecd10d6b9f544f8d8e63" name="polkit-devel" arch="x86_64">
  <version epoch="0" ver="0.116" rel="3.9.1"/>
  <changelog author="antoine.belvire@laposte.net" date="1438862400">- Update to 0.113:
  * Fix CVE-2015-4625
  * Fix CVE-2015-3256
  * Fix CVE-2015-3255
  * Fix CVE-2015-3218
  * On systemd-213 and later, the ?active? state is shared across
    all sessions of an user, instead of being tracked separately
  * pkexec: when not given a program to execute, runs the users?
    shell by default
- Remove polkit-no-kded-leak.patch (upstreamed)</changelog>
  <changelog author="meissner@suse.com" date="1448539200">- polkit-revert-session-magic.patch: revert a session detection change
  that could lead to sessions not being detected as active due to
  a systemd bug. bsc#954139</changelog>
  <changelog author="fbui@suse.com" date="1465300800">- systemd.pc is shipped by systemd main package (bsc#983167)
  Strangely polkit wants systemd.pc to detect that the target system
  is running systemd even if its configured to build systemd support...</changelog>
  <changelog author="fbui@suse.com" date="1465387200">- Use pkgconfig() instead of requiring systemd package names directly.</changelog>
  <changelog author="lnussel@suse.de" date="1497355200">- Use gettext as fallback to get potential distro translations for
  polkit actions. Similar mechnism as used for desktop file
  translations. That way it's possible to use weblate to add
  additional translations that are not provided by upstream
  (polkit-gettext.patch).</changelog>
  <changelog author="dimstar@opensuse.org" date="1502798400">- Add polkit-itstools.patch: Add gettext support for .policy files.</changelog>
  <changelog author="dimstar@opensuse.org" date="1519819200">- Modernize spec-file by calling spec-cleaner</changelog>
  <changelog author="schwab@suse.de" date="1519905600">- pkexec.patch: pkexec: allow --version and --help even if not setuid</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1523275200">- Update to version 0.114:
  + Port to mozjs 52, the latest version of the firefox JavaScript
    engine.
  + Add gettext support for policy files.
  + Fixes for various memory leaks.
  + Updated translations.
- Update keyring with Ray Strode &lt;halfline@gmail.com&gt; public key.
- Drop with_systemd define and all conditionals and
  polkit-no-systemd.patch and ConsoleKit BuildRequires, we only
  support systemd now.
- Drop upstream fixed polkit-itstools.patch.
- Rebase pkexec.patch with quilt.
- Add gcc-c++ and pkgconfig(mozjs-52) BuildRequires: New
  dependencies.
- Drop conditional pkgconfig(mozjs-17.0) and pkgconfig(mozjs185):
  no longer supported.
- Drop autoconf and automake BuildRequires: They are implicit via
  libtool BuildRequires.
- Replace glib2-devel and gobject-introspection-devel with their
  pkgconfig counterparts: pkgconfig(gio-unix-2.0),
  pkgconfig(gmodule-2.0) and pkgconfig(gobject-introspection-1.0).
- Add polkit-jsauthority-pass-format-string.patch: jsauthority:
  pass "%s" format string to remaining report function, patch from
  upstream git, adding missed commit (bgo#105865).
- Drop polkit-revert-session-magic.patch: Upstream systemd bug is
  since a long time fixed (gh#systemd#58) (boo#954139).</changelog>
  <changelog author="meissner@suse.com" date="1531310400">- Update to version 0.115:
  - Fix CVE-2018-1116: Trusting client-supplied UID (bsc#1099031)
  - jsauthority: pass "%s" format string to remaining report function
    (obsoletes polkit-jsauthority-pass-format-string.patch)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1534507200">- Add polkit-fix-possible-resource-leak.patch: Fix possible
  resource leak found by static analyzer.
- Add polkit-fix-leaking-zombie-child-processes.patch: polkitd: fix
  zombie not reaped when js spawned process timed out (fdo#106021).</changelog>
  <changelog author="meissner@suse.com" date="1545307200">- polkit-CVE-2018-19788.patch: Fixed handling of UIDs over MAX_UINT
  (bsc#1118277 CVE-2018-19788)</changelog>
  <changelog author="mvetter@suse.com" date="1556280000">- bsc#1130588: Require shadow instead of old pwdutils
- User proper Requires(pre)/Requires(post) for permissions and
  shadow</changelog>
  <changelog author="dimstar@opensuse.org" date="1557489600">- Use systemd_ordering instead of systemd_requires: strictly
  speaking, polkit does not require systemd to be present. Just
  that when we install on a system with systemd (e.g outside
  containers) we would want systemd to be present before
  installing polkit. Help also reduce a cycle without special hacks
  in systemd.spec.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1559131200">- Update to version 0.116:
  + Leaking zombie child processes.
  + Possible resource leak found by static analyzer.
  + Output messages tuneup.
  + Sanity fixes.
  + pkttyagent tty echo disabled on SIGINT.
  + HACKING: add link to Code of Conduct.
  + polkitbackend: comment typos fix.
  + configure.ac: fix detection of systemd with cgroups v2.
  + CVE-2018-19788 High UIDs overflow fix.
  + CVE-2019-6133 Slowfork vulnerability fix.
  + Allow unset process-uid.
  + Port the JS authority to mozjs-60.
  + Use JS_EncodeStringToUTF8.
  + Updated translations.
- Replace pkgconfig(mozjs-52) with pkgconfig(mozjs-60)
  BuildRequires following upstreams changes.
- Drop patches fixed upstream:
  + polkit-fix-possible-resource-leak.patch
  + polkit-fix-leaking-zombie-child-processes.patch
  + polkit-CVE-2018-19788.patch
- Refresh patches with quilt.</changelog>
  <changelog author="meissner@suse.com" date="1570536000">- polkit-keyinit.patch: add pam_keyinit to the polkit configuration (bsc#1144053)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1575028800">- Fix usage of libexecdir instead of prefix/lib where applicable.</changelog>
  <changelog author="meissner@suse.com" date="1622116800">- CVE-2021-3560: fixed a local privilege escalation using polkit_system_bus_name_get_creds_sync()
  (bsc#1186497)
  CVE-2021-3560.patch</changelog>
  <changelog author="meissner@suse.com" date="1642075200">- CVE-2021-4034: fixed a local privilege escalation in pkexec (bsc#1194568)
  added CVE-2021-4034-pkexec-fix.patch</changelog>
  <changelog author="rfrohl@suse.com" date="1644235200">- CVE-2021-4115: fixed a denial of service via file descriptor leak (bsc#1195542)
  added CVE-2021-4115.patch</changelog>
</package>
<package pkgid="62c6a554ee1e8152bf0b1a20cf4de9b5d5a50fda56d7073b912228d6c8c11bb4" name="polkit-doc" arch="noarch">
  <version epoch="0" ver="0.116" rel="3.9.1"/>
  <changelog author="antoine.belvire@laposte.net" date="1438862400">- Update to 0.113:
  * Fix CVE-2015-4625
  * Fix CVE-2015-3256
  * Fix CVE-2015-3255
  * Fix CVE-2015-3218
  * On systemd-213 and later, the ?active? state is shared across
    all sessions of an user, instead of being tracked separately
  * pkexec: when not given a program to execute, runs the users?
    shell by default
- Remove polkit-no-kded-leak.patch (upstreamed)</changelog>
  <changelog author="meissner@suse.com" date="1448539200">- polkit-revert-session-magic.patch: revert a session detection change
  that could lead to sessions not being detected as active due to
  a systemd bug. bsc#954139</changelog>
  <changelog author="fbui@suse.com" date="1465300800">- systemd.pc is shipped by systemd main package (bsc#983167)
  Strangely polkit wants systemd.pc to detect that the target system
  is running systemd even if its configured to build systemd support...</changelog>
  <changelog author="fbui@suse.com" date="1465387200">- Use pkgconfig() instead of requiring systemd package names directly.</changelog>
  <changelog author="lnussel@suse.de" date="1497355200">- Use gettext as fallback to get potential distro translations for
  polkit actions. Similar mechnism as used for desktop file
  translations. That way it's possible to use weblate to add
  additional translations that are not provided by upstream
  (polkit-gettext.patch).</changelog>
  <changelog author="dimstar@opensuse.org" date="1502798400">- Add polkit-itstools.patch: Add gettext support for .policy files.</changelog>
  <changelog author="dimstar@opensuse.org" date="1519819200">- Modernize spec-file by calling spec-cleaner</changelog>
  <changelog author="schwab@suse.de" date="1519905600">- pkexec.patch: pkexec: allow --version and --help even if not setuid</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1523275200">- Update to version 0.114:
  + Port to mozjs 52, the latest version of the firefox JavaScript
    engine.
  + Add gettext support for policy files.
  + Fixes for various memory leaks.
  + Updated translations.
- Update keyring with Ray Strode &lt;halfline@gmail.com&gt; public key.
- Drop with_systemd define and all conditionals and
  polkit-no-systemd.patch and ConsoleKit BuildRequires, we only
  support systemd now.
- Drop upstream fixed polkit-itstools.patch.
- Rebase pkexec.patch with quilt.
- Add gcc-c++ and pkgconfig(mozjs-52) BuildRequires: New
  dependencies.
- Drop conditional pkgconfig(mozjs-17.0) and pkgconfig(mozjs185):
  no longer supported.
- Drop autoconf and automake BuildRequires: They are implicit via
  libtool BuildRequires.
- Replace glib2-devel and gobject-introspection-devel with their
  pkgconfig counterparts: pkgconfig(gio-unix-2.0),
  pkgconfig(gmodule-2.0) and pkgconfig(gobject-introspection-1.0).
- Add polkit-jsauthority-pass-format-string.patch: jsauthority:
  pass "%s" format string to remaining report function, patch from
  upstream git, adding missed commit (bgo#105865).
- Drop polkit-revert-session-magic.patch: Upstream systemd bug is
  since a long time fixed (gh#systemd#58) (boo#954139).</changelog>
  <changelog author="meissner@suse.com" date="1531310400">- Update to version 0.115:
  - Fix CVE-2018-1116: Trusting client-supplied UID (bsc#1099031)
  - jsauthority: pass "%s" format string to remaining report function
    (obsoletes polkit-jsauthority-pass-format-string.patch)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1534507200">- Add polkit-fix-possible-resource-leak.patch: Fix possible
  resource leak found by static analyzer.
- Add polkit-fix-leaking-zombie-child-processes.patch: polkitd: fix
  zombie not reaped when js spawned process timed out (fdo#106021).</changelog>
  <changelog author="meissner@suse.com" date="1545307200">- polkit-CVE-2018-19788.patch: Fixed handling of UIDs over MAX_UINT
  (bsc#1118277 CVE-2018-19788)</changelog>
  <changelog author="mvetter@suse.com" date="1556280000">- bsc#1130588: Require shadow instead of old pwdutils
- User proper Requires(pre)/Requires(post) for permissions and
  shadow</changelog>
  <changelog author="dimstar@opensuse.org" date="1557489600">- Use systemd_ordering instead of systemd_requires: strictly
  speaking, polkit does not require systemd to be present. Just
  that when we install on a system with systemd (e.g outside
  containers) we would want systemd to be present before
  installing polkit. Help also reduce a cycle without special hacks
  in systemd.spec.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1559131200">- Update to version 0.116:
  + Leaking zombie child processes.
  + Possible resource leak found by static analyzer.
  + Output messages tuneup.
  + Sanity fixes.
  + pkttyagent tty echo disabled on SIGINT.
  + HACKING: add link to Code of Conduct.
  + polkitbackend: comment typos fix.
  + configure.ac: fix detection of systemd with cgroups v2.
  + CVE-2018-19788 High UIDs overflow fix.
  + CVE-2019-6133 Slowfork vulnerability fix.
  + Allow unset process-uid.
  + Port the JS authority to mozjs-60.
  + Use JS_EncodeStringToUTF8.
  + Updated translations.
- Replace pkgconfig(mozjs-52) with pkgconfig(mozjs-60)
  BuildRequires following upstreams changes.
- Drop patches fixed upstream:
  + polkit-fix-possible-resource-leak.patch
  + polkit-fix-leaking-zombie-child-processes.patch
  + polkit-CVE-2018-19788.patch
- Refresh patches with quilt.</changelog>
  <changelog author="meissner@suse.com" date="1570536000">- polkit-keyinit.patch: add pam_keyinit to the polkit configuration (bsc#1144053)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1575028800">- Fix usage of libexecdir instead of prefix/lib where applicable.</changelog>
  <changelog author="meissner@suse.com" date="1622116800">- CVE-2021-3560: fixed a local privilege escalation using polkit_system_bus_name_get_creds_sync()
  (bsc#1186497)
  CVE-2021-3560.patch</changelog>
  <changelog author="meissner@suse.com" date="1642075200">- CVE-2021-4034: fixed a local privilege escalation in pkexec (bsc#1194568)
  added CVE-2021-4034-pkexec-fix.patch</changelog>
  <changelog author="rfrohl@suse.com" date="1644235200">- CVE-2021-4115: fixed a denial of service via file descriptor leak (bsc#1195542)
  added CVE-2021-4115.patch</changelog>
</package>
<package pkgid="7493190d0e0b7ede39e0d0905e225b16e183eaba0da6c815860477dc953d5dd7" name="psmisc" arch="aarch64">
  <version epoch="0" ver="23.0" rel="6.19.1"/>
  <changelog author="werner@suse.de" date="1427198400">- Add patch psmisc-22.21-boo908063.patch to avoid to close files
  which are never open (boo#908063)</changelog>
  <changelog author="schwab@suse.de" date="1432209600">- Replace negative list %nopeek with positive list %have_peekfd</changelog>
  <changelog author="werner@suse.de" date="1497960000">- Modify psmisc-22.21.dif to enforce the usage of `m' flag in
  sscanf() instead of `a' for allocation. Also avoid to small
  buffers and include sys/sysmacros.h for makedev macro.
- Add the patch psmisc-22.21-lessnfs.patch to support device
  files of mount points as well (boo#1044638)
- Add the patch psmisc-22.21-mntpt.patch to do strinfg comparision
  only for NFS shares</changelog>
  <changelog author="werner@suse.de" date="1497960001">- Update to version 23.0
  * killall: Fix process age race condition !11 Debian #822861
  * killall: only use scope of current namespace by default
  * killall: better parsing of command names
  * pstree: add cgroup namespaces !10
  * peekfd: Help give long options too !5
  * killall: correctly report when 32+ procs match !8
  * prtat: Remove duplicate options in man page !3 Debian #846387
  * pslog: New program to check what logs are open merge !1
  * fuser: increase path length for octal escaping SF [#37]
  * Make usage of linked lists of devices found in
    /proc/self/mountinfo optional
  * Make timeout() in timeout.c work with shared mmap to
    reduce the load due write/read the stat buffers
  * Add list_sort() to lists.h to be able to sort lists
  * fuser: Fixed typo for  -M flag. Debian #740275
  * pstree: by default doesn't show threadnames, use -t to show
    as it disables compaction. SF [#33] Debian #815902
  * pstree: Removed need for PATH_MAX Debian #750405
  * pstree: ignores disappeared processes. SF [#34]
  * killall: -o and -y work with -r flags. SF [#64]
  * m4/gettext.m4: Upgrade to gettext-0.19.4.
  * m4/iconv.m4: Upgrade to gettext-0.19.4.
  * m4/lib-ld.m4: Upgrade to gettext-0.19.4.
  * m4/lib-link.m4: Upgrade to gettext-0.19.4.
  * m4/lib-prefix.m4: Upgrade to gettext-0.19.4.
  * m4/nls.m4: Upgrade to gettext-0.19.4.
  * m4/po.m4: Upgrade to gettext-0.19.4.
  * m4/progtest.m4: Upgrade to gettext-0.19.4.
  * configure.ac (AM_GNU_GETTEXT_VERSION): Bump to 0.19.4.
- Make it build, that is create a po/POTFILES.in
- Remove obsolete patches
  * psmisc-22.21-boo908063.patch
  * psmisc-22.12-tigetstr.patch
  * psmisc-22.21-upstream.patch
  * psmisc-git-3638cc55b4d08851faba46635d737b24d016665b.patch
- Rename patch psmisc-22.21.dif which becomes psmisc-23.0.dif
- Make /bin/fuser a symblic link of /usr/bin/fuser (boo#1029973)
- Last revision was 78</changelog>
  <changelog author="werner@suse.de" date="1498651200">- Add patch psmisc-23.0-killall.patch to remove left over debug
  output in killall utility (boo#1046237)</changelog>
  <changelog author="werner@suse.de" date="1498651201">- Add patch psmisc-23.0-net.patch to reenable network support
  broken to my own upstream commit</changelog>
  <changelog author="werner@suse.de" date="1499256000">- Remove patches
  * psmisc-22.21-lessnfs.patch
  * psmisc-22.21-mntpt.patch
  * psmisc-23.0-net.patch
- Add patch
  0001-Use-mountinfo-to-be-able-to-use-the-mount-identity.patch
  from https://gitlab.com/bitstreamout/psmisc/tree/mountinfo
  which is a heavily rework fuser used on NFS
  * Use mountinfo to be able to use the mount identity
    which allows to distinguish different mounts with the
    same device number as it happens with NFS shares.
  * Smaller cleanup as support of chroot environments
    and older systems.
  * Add support for name_to_handle_at() system call to
    get the real mount ID for each file
- Use test suite of psmisc in %check rpm section</changelog>
  <changelog author="werner@suse.de" date="1499342400">- Update patch
  0001-Use-mountinfo-to-be-able-to-use-the-mount-identity.patch</changelog>
  <changelog author="werner@suse.de" date="1505736000">- Add patch psmisc-23.0-killall-signals.patch to fix boo#1058990
  by prior scanning for signal names in the arguments of killall</changelog>
  <changelog author="werner@suse.de" date="1507896000">- Modify patch 0001-Use-mountinfo-to-be-able-to-use-the-mount-identity.patch
  to run even on older kernels missing mnt_id tag in fdinfo</changelog>
  <changelog author="werner@suse.de" date="1526558400">- Modify patch 0001-Use-mountinfo-to-be-able-to-use-the-mount-identity.patch
  to let fuser -m also work for private mounts as well (boo#1093665)</changelog>
  <changelog author="werner@suse.de" date="1529668800">- Modify patch 0001-Use-mountinfo-to-be-able-to-use-the-mount-identity.patch
  to make fuser option -m &lt;block_device&gt; work even with mountinfo
  (bsc#1098697)</changelog>
  <changelog author="werner@suse.de" date="1540296000">- Support also btrFS entries in mountinfo, that is use stat(2) to
  determine the device of the mounted subvolume (bsc#1098697, bsc#1112780)
  this modifies patch 0001-Use-mountinfo-to-be-able-to-use-the-mount-identity.patch</changelog>
  <changelog author="werner@suse.de" date="1542196800">- Modify patch 0001-Use-mountinfo-to-be-able-to-use-the-mount-identity.patch
  to handle sub volumes of the btrFS (bsc#1112780)</changelog>
  <changelog author="werner@suse.de" date="1543579200">- Modify patch 0001-Use-mountinfo-to-be-able-to-use-the-mount-identity.patch
  * Always initialize head of simple linked list (bsc#1098697)
  * stat(2) on binary does not see subvol dev</changelog>
  <changelog author="werner@suse.de" date="1587988800">- Modify patch 0001-Use-mountinfo-to-be-able-to-use-the-mount-identity.patch
  * Allow not unique mounts as well as not unique mountpoint (bsc#1170247)</changelog>
  <changelog author="werner@suse.de" date="1614945600">- Change patch 0001-Use-mountinfo-to-be-able-to-use-the-mount-identity.patch
  * Fix bsc#1178407: fuser does not show open kvm storage image files
    such as qcow2 files. Patch from Ali Abdallah &lt;ali.abdallah@suse.com&gt;</changelog>
  <changelog author="werner@suse.de" date="1621339200">- Change patch 0001-Use-mountinfo-to-be-able-to-use-the-mount-identity.patch
  * Fix bsc#1185208 to make private mount namespaces work as well
    as to distinguish NFS mounts from same remote device share.</changelog>
  <changelog author="werner@suse.de" date="1644840000">- Change patch 0001-Use-mountinfo-to-be-able-to-use-the-mount-identity.patch
  * Determine the namespace of a process only once to speed
    up the parsing of fdinfo (bsc#1194172).</changelog>
</package>
<package pkgid="3d59e9975091f475bfc6ceb40913bec01aafd6d7459c4fef1f8eb48685bbec7e" name="psmisc" arch="ppc64le">
  <version epoch="0" ver="23.0" rel="6.19.1"/>
  <changelog author="werner@suse.de" date="1427198400">- Add patch psmisc-22.21-boo908063.patch to avoid to close files
  which are never open (boo#908063)</changelog>
  <changelog author="schwab@suse.de" date="1432209600">- Replace negative list %nopeek with positive list %have_peekfd</changelog>
  <changelog author="werner@suse.de" date="1497960000">- Modify psmisc-22.21.dif to enforce the usage of `m' flag in
  sscanf() instead of `a' for allocation. Also avoid to small
  buffers and include sys/sysmacros.h for makedev macro.
- Add the patch psmisc-22.21-lessnfs.patch to support device
  files of mount points as well (boo#1044638)
- Add the patch psmisc-22.21-mntpt.patch to do strinfg comparision
  only for NFS shares</changelog>
  <changelog author="werner@suse.de" date="1497960001">- Update to version 23.0
  * killall: Fix process age race condition !11 Debian #822861
  * killall: only use scope of current namespace by default
  * killall: better parsing of command names
  * pstree: add cgroup namespaces !10
  * peekfd: Help give long options too !5
  * killall: correctly report when 32+ procs match !8
  * prtat: Remove duplicate options in man page !3 Debian #846387
  * pslog: New program to check what logs are open merge !1
  * fuser: increase path length for octal escaping SF [#37]
  * Make usage of linked lists of devices found in
    /proc/self/mountinfo optional
  * Make timeout() in timeout.c work with shared mmap to
    reduce the load due write/read the stat buffers
  * Add list_sort() to lists.h to be able to sort lists
  * fuser: Fixed typo for  -M flag. Debian #740275
  * pstree: by default doesn't show threadnames, use -t to show
    as it disables compaction. SF [#33] Debian #815902
  * pstree: Removed need for PATH_MAX Debian #750405
  * pstree: ignores disappeared processes. SF [#34]
  * killall: -o and -y work with -r flags. SF [#64]
  * m4/gettext.m4: Upgrade to gettext-0.19.4.
  * m4/iconv.m4: Upgrade to gettext-0.19.4.
  * m4/lib-ld.m4: Upgrade to gettext-0.19.4.
  * m4/lib-link.m4: Upgrade to gettext-0.19.4.
  * m4/lib-prefix.m4: Upgrade to gettext-0.19.4.
  * m4/nls.m4: Upgrade to gettext-0.19.4.
  * m4/po.m4: Upgrade to gettext-0.19.4.
  * m4/progtest.m4: Upgrade to gettext-0.19.4.
  * configure.ac (AM_GNU_GETTEXT_VERSION): Bump to 0.19.4.
- Make it build, that is create a po/POTFILES.in
- Remove obsolete patches
  * psmisc-22.21-boo908063.patch
  * psmisc-22.12-tigetstr.patch
  * psmisc-22.21-upstream.patch
  * psmisc-git-3638cc55b4d08851faba46635d737b24d016665b.patch
- Rename patch psmisc-22.21.dif which becomes psmisc-23.0.dif
- Make /bin/fuser a symblic link of /usr/bin/fuser (boo#1029973)
- Last revision was 78</changelog>
  <changelog author="werner@suse.de" date="1498651200">- Add patch psmisc-23.0-killall.patch to remove left over debug
  output in killall utility (boo#1046237)</changelog>
  <changelog author="werner@suse.de" date="1498651201">- Add patch psmisc-23.0-net.patch to reenable network support
  broken to my own upstream commit</changelog>
  <changelog author="werner@suse.de" date="1499256000">- Remove patches
  * psmisc-22.21-lessnfs.patch
  * psmisc-22.21-mntpt.patch
  * psmisc-23.0-net.patch
- Add patch
  0001-Use-mountinfo-to-be-able-to-use-the-mount-identity.patch
  from https://gitlab.com/bitstreamout/psmisc/tree/mountinfo
  which is a heavily rework fuser used on NFS
  * Use mountinfo to be able to use the mount identity
    which allows to distinguish different mounts with the
    same device number as it happens with NFS shares.
  * Smaller cleanup as support of chroot environments
    and older systems.
  * Add support for name_to_handle_at() system call to
    get the real mount ID for each file
- Use test suite of psmisc in %check rpm section</changelog>
  <changelog author="werner@suse.de" date="1499342400">- Update patch
  0001-Use-mountinfo-to-be-able-to-use-the-mount-identity.patch</changelog>
  <changelog author="werner@suse.de" date="1505736000">- Add patch psmisc-23.0-killall-signals.patch to fix boo#1058990
  by prior scanning for signal names in the arguments of killall</changelog>
  <changelog author="werner@suse.de" date="1507896000">- Modify patch 0001-Use-mountinfo-to-be-able-to-use-the-mount-identity.patch
  to run even on older kernels missing mnt_id tag in fdinfo</changelog>
  <changelog author="werner@suse.de" date="1526558400">- Modify patch 0001-Use-mountinfo-to-be-able-to-use-the-mount-identity.patch
  to let fuser -m also work for private mounts as well (boo#1093665)</changelog>
  <changelog author="werner@suse.de" date="1529668800">- Modify patch 0001-Use-mountinfo-to-be-able-to-use-the-mount-identity.patch
  to make fuser option -m &lt;block_device&gt; work even with mountinfo
  (bsc#1098697)</changelog>
  <changelog author="werner@suse.de" date="1540296000">- Support also btrFS entries in mountinfo, that is use stat(2) to
  determine the device of the mounted subvolume (bsc#1098697, bsc#1112780)
  this modifies patch 0001-Use-mountinfo-to-be-able-to-use-the-mount-identity.patch</changelog>
  <changelog author="werner@suse.de" date="1542196800">- Modify patch 0001-Use-mountinfo-to-be-able-to-use-the-mount-identity.patch
  to handle sub volumes of the btrFS (bsc#1112780)</changelog>
  <changelog author="werner@suse.de" date="1543579200">- Modify patch 0001-Use-mountinfo-to-be-able-to-use-the-mount-identity.patch
  * Always initialize head of simple linked list (bsc#1098697)
  * stat(2) on binary does not see subvol dev</changelog>
  <changelog author="werner@suse.de" date="1587988800">- Modify patch 0001-Use-mountinfo-to-be-able-to-use-the-mount-identity.patch
  * Allow not unique mounts as well as not unique mountpoint (bsc#1170247)</changelog>
  <changelog author="werner@suse.de" date="1614945600">- Change patch 0001-Use-mountinfo-to-be-able-to-use-the-mount-identity.patch
  * Fix bsc#1178407: fuser does not show open kvm storage image files
    such as qcow2 files. Patch from Ali Abdallah &lt;ali.abdallah@suse.com&gt;</changelog>
  <changelog author="werner@suse.de" date="1621339200">- Change patch 0001-Use-mountinfo-to-be-able-to-use-the-mount-identity.patch
  * Fix bsc#1185208 to make private mount namespaces work as well
    as to distinguish NFS mounts from same remote device share.</changelog>
  <changelog author="werner@suse.de" date="1644840000">- Change patch 0001-Use-mountinfo-to-be-able-to-use-the-mount-identity.patch
  * Determine the namespace of a process only once to speed
    up the parsing of fdinfo (bsc#1194172).</changelog>
</package>
<package pkgid="be684abeb4ed09d457d580eb7b4bedb5d7cfd2c3ed070816f7bcc8fe4a71bf9f" name="psmisc" arch="s390x">
  <version epoch="0" ver="23.0" rel="6.19.1"/>
  <changelog author="werner@suse.de" date="1427198400">- Add patch psmisc-22.21-boo908063.patch to avoid to close files
  which are never open (boo#908063)</changelog>
  <changelog author="schwab@suse.de" date="1432209600">- Replace negative list %nopeek with positive list %have_peekfd</changelog>
  <changelog author="werner@suse.de" date="1497960000">- Modify psmisc-22.21.dif to enforce the usage of `m' flag in
  sscanf() instead of `a' for allocation. Also avoid to small
  buffers and include sys/sysmacros.h for makedev macro.
- Add the patch psmisc-22.21-lessnfs.patch to support device
  files of mount points as well (boo#1044638)
- Add the patch psmisc-22.21-mntpt.patch to do strinfg comparision
  only for NFS shares</changelog>
  <changelog author="werner@suse.de" date="1497960001">- Update to version 23.0
  * killall: Fix process age race condition !11 Debian #822861
  * killall: only use scope of current namespace by default
  * killall: better parsing of command names
  * pstree: add cgroup namespaces !10
  * peekfd: Help give long options too !5
  * killall: correctly report when 32+ procs match !8
  * prtat: Remove duplicate options in man page !3 Debian #846387
  * pslog: New program to check what logs are open merge !1
  * fuser: increase path length for octal escaping SF [#37]
  * Make usage of linked lists of devices found in
    /proc/self/mountinfo optional
  * Make timeout() in timeout.c work with shared mmap to
    reduce the load due write/read the stat buffers
  * Add list_sort() to lists.h to be able to sort lists
  * fuser: Fixed typo for  -M flag. Debian #740275
  * pstree: by default doesn't show threadnames, use -t to show
    as it disables compaction. SF [#33] Debian #815902
  * pstree: Removed need for PATH_MAX Debian #750405
  * pstree: ignores disappeared processes. SF [#34]
  * killall: -o and -y work with -r flags. SF [#64]
  * m4/gettext.m4: Upgrade to gettext-0.19.4.
  * m4/iconv.m4: Upgrade to gettext-0.19.4.
  * m4/lib-ld.m4: Upgrade to gettext-0.19.4.
  * m4/lib-link.m4: Upgrade to gettext-0.19.4.
  * m4/lib-prefix.m4: Upgrade to gettext-0.19.4.
  * m4/nls.m4: Upgrade to gettext-0.19.4.
  * m4/po.m4: Upgrade to gettext-0.19.4.
  * m4/progtest.m4: Upgrade to gettext-0.19.4.
  * configure.ac (AM_GNU_GETTEXT_VERSION): Bump to 0.19.4.
- Make it build, that is create a po/POTFILES.in
- Remove obsolete patches
  * psmisc-22.21-boo908063.patch
  * psmisc-22.12-tigetstr.patch
  * psmisc-22.21-upstream.patch
  * psmisc-git-3638cc55b4d08851faba46635d737b24d016665b.patch
- Rename patch psmisc-22.21.dif which becomes psmisc-23.0.dif
- Make /bin/fuser a symblic link of /usr/bin/fuser (boo#1029973)
- Last revision was 78</changelog>
  <changelog author="werner@suse.de" date="1498651200">- Add patch psmisc-23.0-killall.patch to remove left over debug
  output in killall utility (boo#1046237)</changelog>
  <changelog author="werner@suse.de" date="1498651201">- Add patch psmisc-23.0-net.patch to reenable network support
  broken to my own upstream commit</changelog>
  <changelog author="werner@suse.de" date="1499256000">- Remove patches
  * psmisc-22.21-lessnfs.patch
  * psmisc-22.21-mntpt.patch
  * psmisc-23.0-net.patch
- Add patch
  0001-Use-mountinfo-to-be-able-to-use-the-mount-identity.patch
  from https://gitlab.com/bitstreamout/psmisc/tree/mountinfo
  which is a heavily rework fuser used on NFS
  * Use mountinfo to be able to use the mount identity
    which allows to distinguish different mounts with the
    same device number as it happens with NFS shares.
  * Smaller cleanup as support of chroot environments
    and older systems.
  * Add support for name_to_handle_at() system call to
    get the real mount ID for each file
- Use test suite of psmisc in %check rpm section</changelog>
  <changelog author="werner@suse.de" date="1499342400">- Update patch
  0001-Use-mountinfo-to-be-able-to-use-the-mount-identity.patch</changelog>
  <changelog author="werner@suse.de" date="1505736000">- Add patch psmisc-23.0-killall-signals.patch to fix boo#1058990
  by prior scanning for signal names in the arguments of killall</changelog>
  <changelog author="werner@suse.de" date="1507896000">- Modify patch 0001-Use-mountinfo-to-be-able-to-use-the-mount-identity.patch
  to run even on older kernels missing mnt_id tag in fdinfo</changelog>
  <changelog author="werner@suse.de" date="1526558400">- Modify patch 0001-Use-mountinfo-to-be-able-to-use-the-mount-identity.patch
  to let fuser -m also work for private mounts as well (boo#1093665)</changelog>
  <changelog author="werner@suse.de" date="1529668800">- Modify patch 0001-Use-mountinfo-to-be-able-to-use-the-mount-identity.patch
  to make fuser option -m &lt;block_device&gt; work even with mountinfo
  (bsc#1098697)</changelog>
  <changelog author="werner@suse.de" date="1540296000">- Support also btrFS entries in mountinfo, that is use stat(2) to
  determine the device of the mounted subvolume (bsc#1098697, bsc#1112780)
  this modifies patch 0001-Use-mountinfo-to-be-able-to-use-the-mount-identity.patch</changelog>
  <changelog author="werner@suse.de" date="1542196800">- Modify patch 0001-Use-mountinfo-to-be-able-to-use-the-mount-identity.patch
  to handle sub volumes of the btrFS (bsc#1112780)</changelog>
  <changelog author="werner@suse.de" date="1543579200">- Modify patch 0001-Use-mountinfo-to-be-able-to-use-the-mount-identity.patch
  * Always initialize head of simple linked list (bsc#1098697)
  * stat(2) on binary does not see subvol dev</changelog>
  <changelog author="werner@suse.de" date="1587988800">- Modify patch 0001-Use-mountinfo-to-be-able-to-use-the-mount-identity.patch
  * Allow not unique mounts as well as not unique mountpoint (bsc#1170247)</changelog>
  <changelog author="werner@suse.de" date="1614945600">- Change patch 0001-Use-mountinfo-to-be-able-to-use-the-mount-identity.patch
  * Fix bsc#1178407: fuser does not show open kvm storage image files
    such as qcow2 files. Patch from Ali Abdallah &lt;ali.abdallah@suse.com&gt;</changelog>
  <changelog author="werner@suse.de" date="1621339200">- Change patch 0001-Use-mountinfo-to-be-able-to-use-the-mount-identity.patch
  * Fix bsc#1185208 to make private mount namespaces work as well
    as to distinguish NFS mounts from same remote device share.</changelog>
  <changelog author="werner@suse.de" date="1644840000">- Change patch 0001-Use-mountinfo-to-be-able-to-use-the-mount-identity.patch
  * Determine the namespace of a process only once to speed
    up the parsing of fdinfo (bsc#1194172).</changelog>
</package>
<package pkgid="7ea6e8477aabb06d427b639315fa0de846812cebc5433a66d19bd16a8e9d276f" name="psmisc" arch="src">
  <version epoch="0" ver="23.0" rel="6.19.1"/>
  <changelog author="ro@suse.de" date="1398340800">- add patch to fix fuser -M option active all the time (bnc#874983)
  psmisc-git-3638cc55b4d08851faba46635d737b24d016665b.patch</changelog>
  <changelog author="werner@suse.de" date="1427198400">- Add patch psmisc-22.21-boo908063.patch to avoid to close files
  which are never open (boo#908063)</changelog>
  <changelog author="schwab@suse.de" date="1432209600">- Replace negative list %nopeek with positive list %have_peekfd</changelog>
  <changelog author="werner@suse.de" date="1497960000">- Modify psmisc-22.21.dif to enforce the usage of `m' flag in
  sscanf() instead of `a' for allocation. Also avoid to small
  buffers and include sys/sysmacros.h for makedev macro.
- Add the patch psmisc-22.21-lessnfs.patch to support device
  files of mount points as well (boo#1044638)
- Add the patch psmisc-22.21-mntpt.patch to do strinfg comparision
  only for NFS shares</changelog>
  <changelog author="werner@suse.de" date="1497960001">- Update to version 23.0
  * killall: Fix process age race condition !11 Debian #822861
  * killall: only use scope of current namespace by default
  * killall: better parsing of command names
  * pstree: add cgroup namespaces !10
  * peekfd: Help give long options too !5
  * killall: correctly report when 32+ procs match !8
  * prtat: Remove duplicate options in man page !3 Debian #846387
  * pslog: New program to check what logs are open merge !1
  * fuser: increase path length for octal escaping SF [#37]
  * Make usage of linked lists of devices found in
    /proc/self/mountinfo optional
  * Make timeout() in timeout.c work with shared mmap to
    reduce the load due write/read the stat buffers
  * Add list_sort() to lists.h to be able to sort lists
  * fuser: Fixed typo for  -M flag. Debian #740275
  * pstree: by default doesn't show threadnames, use -t to show
    as it disables compaction. SF [#33] Debian #815902
  * pstree: Removed need for PATH_MAX Debian #750405
  * pstree: ignores disappeared processes. SF [#34]
  * killall: -o and -y work with -r flags. SF [#64]
  * m4/gettext.m4: Upgrade to gettext-0.19.4.
  * m4/iconv.m4: Upgrade to gettext-0.19.4.
  * m4/lib-ld.m4: Upgrade to gettext-0.19.4.
  * m4/lib-link.m4: Upgrade to gettext-0.19.4.
  * m4/lib-prefix.m4: Upgrade to gettext-0.19.4.
  * m4/nls.m4: Upgrade to gettext-0.19.4.
  * m4/po.m4: Upgrade to gettext-0.19.4.
  * m4/progtest.m4: Upgrade to gettext-0.19.4.
  * configure.ac (AM_GNU_GETTEXT_VERSION): Bump to 0.19.4.
- Make it build, that is create a po/POTFILES.in
- Remove obsolete patches
  * psmisc-22.21-boo908063.patch
  * psmisc-22.12-tigetstr.patch
  * psmisc-22.21-upstream.patch
  * psmisc-git-3638cc55b4d08851faba46635d737b24d016665b.patch
- Rename patch psmisc-22.21.dif which becomes psmisc-23.0.dif
- Make /bin/fuser a symblic link of /usr/bin/fuser (boo#1029973)
- Last revision was 78</changelog>
  <changelog author="werner@suse.de" date="1498651200">- Add patch psmisc-23.0-killall.patch to remove left over debug
  output in killall utility (boo#1046237)</changelog>
  <changelog author="werner@suse.de" date="1498651201">- Add patch psmisc-23.0-net.patch to reenable network support
  broken to my own upstream commit</changelog>
  <changelog author="werner@suse.de" date="1499256000">- Remove patches
  * psmisc-22.21-lessnfs.patch
  * psmisc-22.21-mntpt.patch
  * psmisc-23.0-net.patch
- Add patch
  0001-Use-mountinfo-to-be-able-to-use-the-mount-identity.patch
  from https://gitlab.com/bitstreamout/psmisc/tree/mountinfo
  which is a heavily rework fuser used on NFS
  * Use mountinfo to be able to use the mount identity
    which allows to distinguish different mounts with the
    same device number as it happens with NFS shares.
  * Smaller cleanup as support of chroot environments
    and older systems.
  * Add support for name_to_handle_at() system call to
    get the real mount ID for each file
- Use test suite of psmisc in %check rpm section</changelog>
  <changelog author="werner@suse.de" date="1499342400">- Update patch
  0001-Use-mountinfo-to-be-able-to-use-the-mount-identity.patch</changelog>
  <changelog author="werner@suse.de" date="1505736000">- Add patch psmisc-23.0-killall-signals.patch to fix boo#1058990
  by prior scanning for signal names in the arguments of killall</changelog>
  <changelog author="werner@suse.de" date="1507896000">- Modify patch 0001-Use-mountinfo-to-be-able-to-use-the-mount-identity.patch
  to run even on older kernels missing mnt_id tag in fdinfo</changelog>
  <changelog author="werner@suse.de" date="1526558400">- Modify patch 0001-Use-mountinfo-to-be-able-to-use-the-mount-identity.patch
  to let fuser -m also work for private mounts as well (boo#1093665)</changelog>
  <changelog author="werner@suse.de" date="1529668800">- Modify patch 0001-Use-mountinfo-to-be-able-to-use-the-mount-identity.patch
  to make fuser option -m &lt;block_device&gt; work even with mountinfo
  (bsc#1098697)</changelog>
  <changelog author="werner@suse.de" date="1540296000">- Support also btrFS entries in mountinfo, that is use stat(2) to
  determine the device of the mounted subvolume (bsc#1098697, bsc#1112780)
  this modifies patch 0001-Use-mountinfo-to-be-able-to-use-the-mount-identity.patch</changelog>
  <changelog author="werner@suse.de" date="1542196800">- Modify patch 0001-Use-mountinfo-to-be-able-to-use-the-mount-identity.patch
  to handle sub volumes of the btrFS (bsc#1112780)</changelog>
  <changelog author="werner@suse.de" date="1543579200">- Modify patch 0001-Use-mountinfo-to-be-able-to-use-the-mount-identity.patch
  * Always initialize head of simple linked list (bsc#1098697)
  * stat(2) on binary does not see subvol dev</changelog>
  <changelog author="werner@suse.de" date="1587988800">- Modify patch 0001-Use-mountinfo-to-be-able-to-use-the-mount-identity.patch
  * Allow not unique mounts as well as not unique mountpoint (bsc#1170247)</changelog>
  <changelog author="werner@suse.de" date="1614945600">- Change patch 0001-Use-mountinfo-to-be-able-to-use-the-mount-identity.patch
  * Fix bsc#1178407: fuser does not show open kvm storage image files
    such as qcow2 files. Patch from Ali Abdallah &lt;ali.abdallah@suse.com&gt;</changelog>
  <changelog author="werner@suse.de" date="1621339200">- Change patch 0001-Use-mountinfo-to-be-able-to-use-the-mount-identity.patch
  * Fix bsc#1185208 to make private mount namespaces work as well
    as to distinguish NFS mounts from same remote device share.</changelog>
  <changelog author="werner@suse.de" date="1644840000">- Change patch 0001-Use-mountinfo-to-be-able-to-use-the-mount-identity.patch
  * Determine the namespace of a process only once to speed
    up the parsing of fdinfo (bsc#1194172).</changelog>
</package>
<package pkgid="529153814b3422619a6a5d0ff599e0328474dcdc88eaa16bf0279284890c1627" name="psmisc" arch="x86_64">
  <version epoch="0" ver="23.0" rel="6.19.1"/>
  <changelog author="werner@suse.de" date="1427198400">- Add patch psmisc-22.21-boo908063.patch to avoid to close files
  which are never open (boo#908063)</changelog>
  <changelog author="schwab@suse.de" date="1432209600">- Replace negative list %nopeek with positive list %have_peekfd</changelog>
  <changelog author="werner@suse.de" date="1497960000">- Modify psmisc-22.21.dif to enforce the usage of `m' flag in
  sscanf() instead of `a' for allocation. Also avoid to small
  buffers and include sys/sysmacros.h for makedev macro.
- Add the patch psmisc-22.21-lessnfs.patch to support device
  files of mount points as well (boo#1044638)
- Add the patch psmisc-22.21-mntpt.patch to do strinfg comparision
  only for NFS shares</changelog>
  <changelog author="werner@suse.de" date="1497960001">- Update to version 23.0
  * killall: Fix process age race condition !11 Debian #822861
  * killall: only use scope of current namespace by default
  * killall: better parsing of command names
  * pstree: add cgroup namespaces !10
  * peekfd: Help give long options too !5
  * killall: correctly report when 32+ procs match !8
  * prtat: Remove duplicate options in man page !3 Debian #846387
  * pslog: New program to check what logs are open merge !1
  * fuser: increase path length for octal escaping SF [#37]
  * Make usage of linked lists of devices found in
    /proc/self/mountinfo optional
  * Make timeout() in timeout.c work with shared mmap to
    reduce the load due write/read the stat buffers
  * Add list_sort() to lists.h to be able to sort lists
  * fuser: Fixed typo for  -M flag. Debian #740275
  * pstree: by default doesn't show threadnames, use -t to show
    as it disables compaction. SF [#33] Debian #815902
  * pstree: Removed need for PATH_MAX Debian #750405
  * pstree: ignores disappeared processes. SF [#34]
  * killall: -o and -y work with -r flags. SF [#64]
  * m4/gettext.m4: Upgrade to gettext-0.19.4.
  * m4/iconv.m4: Upgrade to gettext-0.19.4.
  * m4/lib-ld.m4: Upgrade to gettext-0.19.4.
  * m4/lib-link.m4: Upgrade to gettext-0.19.4.
  * m4/lib-prefix.m4: Upgrade to gettext-0.19.4.
  * m4/nls.m4: Upgrade to gettext-0.19.4.
  * m4/po.m4: Upgrade to gettext-0.19.4.
  * m4/progtest.m4: Upgrade to gettext-0.19.4.
  * configure.ac (AM_GNU_GETTEXT_VERSION): Bump to 0.19.4.
- Make it build, that is create a po/POTFILES.in
- Remove obsolete patches
  * psmisc-22.21-boo908063.patch
  * psmisc-22.12-tigetstr.patch
  * psmisc-22.21-upstream.patch
  * psmisc-git-3638cc55b4d08851faba46635d737b24d016665b.patch
- Rename patch psmisc-22.21.dif which becomes psmisc-23.0.dif
- Make /bin/fuser a symblic link of /usr/bin/fuser (boo#1029973)
- Last revision was 78</changelog>
  <changelog author="werner@suse.de" date="1498651200">- Add patch psmisc-23.0-killall.patch to remove left over debug
  output in killall utility (boo#1046237)</changelog>
  <changelog author="werner@suse.de" date="1498651201">- Add patch psmisc-23.0-net.patch to reenable network support
  broken to my own upstream commit</changelog>
  <changelog author="werner@suse.de" date="1499256000">- Remove patches
  * psmisc-22.21-lessnfs.patch
  * psmisc-22.21-mntpt.patch
  * psmisc-23.0-net.patch
- Add patch
  0001-Use-mountinfo-to-be-able-to-use-the-mount-identity.patch
  from https://gitlab.com/bitstreamout/psmisc/tree/mountinfo
  which is a heavily rework fuser used on NFS
  * Use mountinfo to be able to use the mount identity
    which allows to distinguish different mounts with the
    same device number as it happens with NFS shares.
  * Smaller cleanup as support of chroot environments
    and older systems.
  * Add support for name_to_handle_at() system call to
    get the real mount ID for each file
- Use test suite of psmisc in %check rpm section</changelog>
  <changelog author="werner@suse.de" date="1499342400">- Update patch
  0001-Use-mountinfo-to-be-able-to-use-the-mount-identity.patch</changelog>
  <changelog author="werner@suse.de" date="1505736000">- Add patch psmisc-23.0-killall-signals.patch to fix boo#1058990
  by prior scanning for signal names in the arguments of killall</changelog>
  <changelog author="werner@suse.de" date="1507896000">- Modify patch 0001-Use-mountinfo-to-be-able-to-use-the-mount-identity.patch
  to run even on older kernels missing mnt_id tag in fdinfo</changelog>
  <changelog author="werner@suse.de" date="1526558400">- Modify patch 0001-Use-mountinfo-to-be-able-to-use-the-mount-identity.patch
  to let fuser -m also work for private mounts as well (boo#1093665)</changelog>
  <changelog author="werner@suse.de" date="1529668800">- Modify patch 0001-Use-mountinfo-to-be-able-to-use-the-mount-identity.patch
  to make fuser option -m &lt;block_device&gt; work even with mountinfo
  (bsc#1098697)</changelog>
  <changelog author="werner@suse.de" date="1540296000">- Support also btrFS entries in mountinfo, that is use stat(2) to
  determine the device of the mounted subvolume (bsc#1098697, bsc#1112780)
  this modifies patch 0001-Use-mountinfo-to-be-able-to-use-the-mount-identity.patch</changelog>
  <changelog author="werner@suse.de" date="1542196800">- Modify patch 0001-Use-mountinfo-to-be-able-to-use-the-mount-identity.patch
  to handle sub volumes of the btrFS (bsc#1112780)</changelog>
  <changelog author="werner@suse.de" date="1543579200">- Modify patch 0001-Use-mountinfo-to-be-able-to-use-the-mount-identity.patch
  * Always initialize head of simple linked list (bsc#1098697)
  * stat(2) on binary does not see subvol dev</changelog>
  <changelog author="werner@suse.de" date="1587988800">- Modify patch 0001-Use-mountinfo-to-be-able-to-use-the-mount-identity.patch
  * Allow not unique mounts as well as not unique mountpoint (bsc#1170247)</changelog>
  <changelog author="werner@suse.de" date="1614945600">- Change patch 0001-Use-mountinfo-to-be-able-to-use-the-mount-identity.patch
  * Fix bsc#1178407: fuser does not show open kvm storage image files
    such as qcow2 files. Patch from Ali Abdallah &lt;ali.abdallah@suse.com&gt;</changelog>
  <changelog author="werner@suse.de" date="1621339200">- Change patch 0001-Use-mountinfo-to-be-able-to-use-the-mount-identity.patch
  * Fix bsc#1185208 to make private mount namespaces work as well
    as to distinguish NFS mounts from same remote device share.</changelog>
  <changelog author="werner@suse.de" date="1644840000">- Change patch 0001-Use-mountinfo-to-be-able-to-use-the-mount-identity.patch
  * Determine the namespace of a process only once to speed
    up the parsing of fdinfo (bsc#1194172).</changelog>
</package>
<package pkgid="85fddab8efb46139d882de697b5371ed5ff8eb0c1da54a0ca95db673eb85dea7" name="psmisc-lang" arch="noarch">
  <version epoch="0" ver="23.0" rel="6.19.1"/>
  <changelog author="werner@suse.de" date="1427198400">- Add patch psmisc-22.21-boo908063.patch to avoid to close files
  which are never open (boo#908063)</changelog>
  <changelog author="schwab@suse.de" date="1432209600">- Replace negative list %nopeek with positive list %have_peekfd</changelog>
  <changelog author="werner@suse.de" date="1497960000">- Modify psmisc-22.21.dif to enforce the usage of `m' flag in
  sscanf() instead of `a' for allocation. Also avoid to small
  buffers and include sys/sysmacros.h for makedev macro.
- Add the patch psmisc-22.21-lessnfs.patch to support device
  files of mount points as well (boo#1044638)
- Add the patch psmisc-22.21-mntpt.patch to do strinfg comparision
  only for NFS shares</changelog>
  <changelog author="werner@suse.de" date="1497960001">- Update to version 23.0
  * killall: Fix process age race condition !11 Debian #822861
  * killall: only use scope of current namespace by default
  * killall: better parsing of command names
  * pstree: add cgroup namespaces !10
  * peekfd: Help give long options too !5
  * killall: correctly report when 32+ procs match !8
  * prtat: Remove duplicate options in man page !3 Debian #846387
  * pslog: New program to check what logs are open merge !1
  * fuser: increase path length for octal escaping SF [#37]
  * Make usage of linked lists of devices found in
    /proc/self/mountinfo optional
  * Make timeout() in timeout.c work with shared mmap to
    reduce the load due write/read the stat buffers
  * Add list_sort() to lists.h to be able to sort lists
  * fuser: Fixed typo for  -M flag. Debian #740275
  * pstree: by default doesn't show threadnames, use -t to show
    as it disables compaction. SF [#33] Debian #815902
  * pstree: Removed need for PATH_MAX Debian #750405
  * pstree: ignores disappeared processes. SF [#34]
  * killall: -o and -y work with -r flags. SF [#64]
  * m4/gettext.m4: Upgrade to gettext-0.19.4.
  * m4/iconv.m4: Upgrade to gettext-0.19.4.
  * m4/lib-ld.m4: Upgrade to gettext-0.19.4.
  * m4/lib-link.m4: Upgrade to gettext-0.19.4.
  * m4/lib-prefix.m4: Upgrade to gettext-0.19.4.
  * m4/nls.m4: Upgrade to gettext-0.19.4.
  * m4/po.m4: Upgrade to gettext-0.19.4.
  * m4/progtest.m4: Upgrade to gettext-0.19.4.
  * configure.ac (AM_GNU_GETTEXT_VERSION): Bump to 0.19.4.
- Make it build, that is create a po/POTFILES.in
- Remove obsolete patches
  * psmisc-22.21-boo908063.patch
  * psmisc-22.12-tigetstr.patch
  * psmisc-22.21-upstream.patch
  * psmisc-git-3638cc55b4d08851faba46635d737b24d016665b.patch
- Rename patch psmisc-22.21.dif which becomes psmisc-23.0.dif
- Make /bin/fuser a symblic link of /usr/bin/fuser (boo#1029973)
- Last revision was 78</changelog>
  <changelog author="werner@suse.de" date="1498651200">- Add patch psmisc-23.0-killall.patch to remove left over debug
  output in killall utility (boo#1046237)</changelog>
  <changelog author="werner@suse.de" date="1498651201">- Add patch psmisc-23.0-net.patch to reenable network support
  broken to my own upstream commit</changelog>
  <changelog author="werner@suse.de" date="1499256000">- Remove patches
  * psmisc-22.21-lessnfs.patch
  * psmisc-22.21-mntpt.patch
  * psmisc-23.0-net.patch
- Add patch
  0001-Use-mountinfo-to-be-able-to-use-the-mount-identity.patch
  from https://gitlab.com/bitstreamout/psmisc/tree/mountinfo
  which is a heavily rework fuser used on NFS
  * Use mountinfo to be able to use the mount identity
    which allows to distinguish different mounts with the
    same device number as it happens with NFS shares.
  * Smaller cleanup as support of chroot environments
    and older systems.
  * Add support for name_to_handle_at() system call to
    get the real mount ID for each file
- Use test suite of psmisc in %check rpm section</changelog>
  <changelog author="werner@suse.de" date="1499342400">- Update patch
  0001-Use-mountinfo-to-be-able-to-use-the-mount-identity.patch</changelog>
  <changelog author="werner@suse.de" date="1505736000">- Add patch psmisc-23.0-killall-signals.patch to fix boo#1058990
  by prior scanning for signal names in the arguments of killall</changelog>
  <changelog author="werner@suse.de" date="1507896000">- Modify patch 0001-Use-mountinfo-to-be-able-to-use-the-mount-identity.patch
  to run even on older kernels missing mnt_id tag in fdinfo</changelog>
  <changelog author="werner@suse.de" date="1526558400">- Modify patch 0001-Use-mountinfo-to-be-able-to-use-the-mount-identity.patch
  to let fuser -m also work for private mounts as well (boo#1093665)</changelog>
  <changelog author="werner@suse.de" date="1529668800">- Modify patch 0001-Use-mountinfo-to-be-able-to-use-the-mount-identity.patch
  to make fuser option -m &lt;block_device&gt; work even with mountinfo
  (bsc#1098697)</changelog>
  <changelog author="werner@suse.de" date="1540296000">- Support also btrFS entries in mountinfo, that is use stat(2) to
  determine the device of the mounted subvolume (bsc#1098697, bsc#1112780)
  this modifies patch 0001-Use-mountinfo-to-be-able-to-use-the-mount-identity.patch</changelog>
  <changelog author="werner@suse.de" date="1542196800">- Modify patch 0001-Use-mountinfo-to-be-able-to-use-the-mount-identity.patch
  to handle sub volumes of the btrFS (bsc#1112780)</changelog>
  <changelog author="werner@suse.de" date="1543579200">- Modify patch 0001-Use-mountinfo-to-be-able-to-use-the-mount-identity.patch
  * Always initialize head of simple linked list (bsc#1098697)
  * stat(2) on binary does not see subvol dev</changelog>
  <changelog author="werner@suse.de" date="1587988800">- Modify patch 0001-Use-mountinfo-to-be-able-to-use-the-mount-identity.patch
  * Allow not unique mounts as well as not unique mountpoint (bsc#1170247)</changelog>
  <changelog author="werner@suse.de" date="1614945600">- Change patch 0001-Use-mountinfo-to-be-able-to-use-the-mount-identity.patch
  * Fix bsc#1178407: fuser does not show open kvm storage image files
    such as qcow2 files. Patch from Ali Abdallah &lt;ali.abdallah@suse.com&gt;</changelog>
  <changelog author="werner@suse.de" date="1621339200">- Change patch 0001-Use-mountinfo-to-be-able-to-use-the-mount-identity.patch
  * Fix bsc#1185208 to make private mount namespaces work as well
    as to distinguish NFS mounts from same remote device share.</changelog>
  <changelog author="werner@suse.de" date="1644840000">- Change patch 0001-Use-mountinfo-to-be-able-to-use-the-mount-identity.patch
  * Determine the namespace of a process only once to speed
    up the parsing of fdinfo (bsc#1194172).</changelog>
</package>
<package pkgid="c42a262396321ded9e836ef2442ca4a951c185f6f86d49782d36cd93adf3b898" name="python-Twisted" arch="src">
  <version epoch="0" ver="19.10.0" rel="3.6.1"/>
  <changelog author="mimi.vx@gmail.com" date="1510315200">- update to 17.9.0
  For full list of changes please see:
  https://github.com/twisted/twisted/blob/twisted-17.9.0/NEWS.rst
  * mailman is only in python2 package</changelog>
  <changelog author="termim@gmail.com" date="1526644800">- update to 18.4.0
  For full list of changes please see:
  https://github.com/twisted/twisted/blob/twisted-18.4.0/NEWS.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1527595200">- Add python-service_identity Recommends.</changelog>
  <changelog author="dmueller@suse.com" date="1531828800">- update to 18.7.0:
  for full list of changes please see
  https://github.com/twisted/twisted/blob/twisted-18.7.0/NEWS.rst</changelog>
  <changelog author="tchvatal@suse.com" date="1539259200">- Fix the dependencies to match up upstream setup.py
- Run the tests
- Add patch to build with python3.7:
  * python37.patch
- Add missing dependency on pyamcrest
- Remove unused patch lp1102685.diff</changelog>
  <changelog author="ecsos@opensuse.org" date="1539345600">- Add missing Requires.</changelog>
  <changelog author="mcepl@suse.com" date="1539950400">- Add BuildRequires python-tz, which seems to be required to test suite
  to pass.
- Also, add skip_MultiCast.patch to skip tests requiring full
  netrworking stack.</changelog>
  <changelog author="tchvatal@suse.com" date="1540209600">- Do not write bytecode stuff when running the tests</changelog>
  <changelog author="tchvatal@suse.com" date="1541073600">- Version update to 18.9.0:
  * Fixes for the 3.7 python
- Remove merged python37.patch
- Add patch openssl111.patch which fixes tests with new pyOpenssl
  * Asserts changed behaviour</changelog>
  <changelog author="mcepl@suse.com" date="1541678400">- Add no-pygtkcompat.patch to avoid dependency on Gtk (boo#1110669)</changelog>
  <changelog author="schwab@suse.de" date="1548331200">- test-mktime-invalid-tm_isdst.patch: don't pass invalid tm_isdst value to
  mktime (see also bpo-15750)</changelog>
  <changelog author="tchvatal@suse.com" date="1550491200">- Add another patch for openssl 1.1.1 (from upstream git):
  * openssl-errormsg.aptch</changelog>
  <changelog author="tchvatal@suse.com" date="1558526400">- Update to 19.2.0:
  * twisted.internet.ssl.CertificateOptions now uses 32 random bytes instead of an MD5 hash for the ssl session identifier context. (#9463)
  * DeferredLock and DeferredSemaphore can be used as asynchronous context managers on Python 3.5+. (#9546)
  * t.i.b.BaseConnector has custom __repr__ (#9548)
  * twisted.internet.ssl.optionsForClientTLS now supports validating IP addresses from the certificate subjectAltName (#9585)
  * Twisted's minimum Cryptography requirement is now 2.5. (#9592)
  * twisted.conch.ssh.keys can now read private keys in the new "openssh-key-v1" format, introduced in OpenSSH 6.5 and made the default in OpenSSH 7.8. (#9515)
  * twisted.web.client.HostnameCachingHTTPSPolicy was added as a new contextFactory option. The policy caches a specified number of twisted.internet.interfaces.IOpenSSLClientConnectionCreator instances to to avoid the cost of instantiating a connection creator for multiple requests to the same host. (#9138)
- Remove merged patches:
  * openssl-errormsg.aptch
  * openssl111.patch
- Add patch to tests for new hyperlink:
  * hyperlink.patch</changelog>
  <changelog author="tbechtold@suse.com" date="1560340800">- update to 19.2.1 (bsc#1137825, CVE-2019-12387):
  * Prevent CRLF injections described in CVE-2019-12387</changelog>
  <changelog author="tbechtold@suse.com" date="1560340801">- Add 0001-Prevent-CRLF-injections-described-in-CVE-2019-12387.patch
  (bsc#1137825, CVE-2019-12387)
  Prevent CRLF injections</changelog>
  <changelog author="tbechtold@suse.com" date="1565784000">- Add PR-1147.patch (bsc#1138461, CVE-2019-12855)
  In words.protocols.jabber.xmlstream in Twisted through 19.2.1,
  XMPP support did not verify certificates when used with TLS,
  allowing an attacker to MITM connections.</changelog>
  <changelog author="tchvatal@suse.com" date="1568376000">- Update to 19.7.0:
  * The callable argument to twisted.internet.task.deferLater() is no longer required. (#9577)
  * twisted.internet.utils.getProcessOutputAndValue now accepts stdinBytes to write to the child process's standard input. (#9607)
  * Add new twisted.logger.capturedLogs context manager for capturing observed log events in tests. (#9617)
  * twisted.internet.base.PluggableResolverMixin, which implements the pluggable resolver interfaces for easier re-use in other reactors, has been factored out of ReactorBase. (#9632)
  * The PyPI page for Twisted has been enhanced to include more information and useful links. (#9648)
- Refresh patch:
  * skip_MultiCast.patch
- Remove merged patch hyperlink.patch
- Remove patch 0001-Prevent-CRLF-injections-described-in-CVE-2019-12387.patch
- Remove patch PR-1147.patch</changelog>
  <changelog author="jayvdb@gmail.com" date="1568462400">- Remove mailmail when only building Python 3 flavour</changelog>
  <changelog author="steven.kowalik@suse.com" date="1575460800">- Update to 19.10.0 bsc#1162424:
  * twisted.trial.successResultOf, twisted.trial.failureResultOf, and twisted.trial.assertNoResult accept coroutines as well as Deferreds. (#9006)
  * Fixed circular import in twisted.trial.reporter, introduced in Twisted 16.0.0. (#8267)
  * The POP3 server implemented by twisted.mail.pop3 now accepts passwords that contain spaces. (#9100)
  * Incoming HTTP/2 connections will now not time out if they persist for longer than one minute. (#9653)
  * twisted.conch.ssh.keys now correctly writes the "iqmp" parameter in serialized RSA private keys as q^-1 mod p rather than p^-1 mod q. (#9681)
  * twisted.web.server.Request will now use twisted.web.server.Site.getContentFile, if it exists, to get a file into which to write request content. If getContentFile is not provided by the site, it will fall back to the previous behavior of using io.BytesIO for small requests and tempfile.TemporaryFile for large ones. (#9655)
  * twisted.web.client.FileBodyProducer will now stop producing when the Deferred returned by FileBodyProducer.startProducing is cancelled. (#9547)
  * The HTTP/2 server implementation now enforces TCP flow control on control frame messages and times out clients that send invalid data without reading responses. This closes CVE-2019-9512 (Ping Flood), CVE-2019-9514 (Reset Flood), and CVE-2019-9515 (Settings Flood). Thanks to Jonathan Looney and Piotr Sikora. (#9694)
- Add python-38-xml-namespace.patch to fix dictionary mutation under Python 3.8
- Add python-38-hmac-digestmod.patch to add digestmod parameter where required
- Add python-38-no-cgi-parseqs.patch to no longer import parse_qs from cgi</changelog>
  <changelog author="mcepl@suse.com" date="1644667200">- Add CVE-2022-21712-sec-expo-CO-redirect.patch to properly
  remove sensitive headers when redirecting to a different origin
  (CVE-2022-21712, bsc#1195667).</changelog>
</package>
<package pkgid="7ed6795362aecb8b648660084b75e496da43b94c2a7ba28eaf3e8a266ee656a4" name="python-configshell-fb" arch="src">
  <version epoch="0" ver="1.1.29" rel="3.3.1"/>
  <changelog author="lduncan@suse.com" date="1461067200">- Initial creation of this package, from upstream
  version 1.1.fb20</changelog>
  <changelog author="dmueller@suse.com" date="1462536000">- cleanup buildroot parts</changelog>
  <changelog author="lduncan@suse.com" date="1466769600">- Updated SPEC file: removed "Provides"/"Obsoletes" for
  package name "python-confishell" (bsc#984935)</changelog>
  <changelog author="lduncan@suse.com" date="1466769601">- Updated spec file: added Conflicts for python-configshell
  (bsc#986475)</changelog>
  <changelog author="shshyukriev@suse.com" date="1488196800">- Update to v 1.1.22fb
  * Fixed github source namespace</changelog>
  <changelog author="lszhu@suse.com" date="1502971200">- Update to version 1.1.23fb
  * improving ALUA and TCMU support</changelog>
  <changelog author="lduncan@suse.com" date="1512734400">- Converting RPM SPEC file to singlespec format (bsc#1045332),
  adding patch:
  * configshell-fb-example-should-not-specify-path.patch
- Fix targetcli.service problem when TERM not set (bsc#1071194),
  adding patch (from LSZhu):
  * configshell-fb-Handle-if-TERM-is-not-set.patch
- Moved build requirement on urwid to runtime requirement,
  as suggested by scarabeus_iv
- ran spec-cleaner to clean up SPEC file
- Converted from manually-added configshell-fb tar file to
  tar_scm service-generated file by adding _service and
  _servicedata</changelog>
  <changelog author="tchvatal@suse.com" date="1514980800">- Do not build epydoc documentation to allow py3 only build</changelog>
  <changelog author="olaf@aepfle.de" date="1519560000">- Fix upgrade path by provide/obsolete python-configshell (bsc#1082693)</changelog>
  <changelog author="opensuse-packaging@opensuse.org" date="1539864000">- Update to version 1.1.fb23:
  * version 1.1.25
  * Fix failing to parse param like pool/rbd;id=user
  * Acquire a lock to a preference file before working with it
  * Fix failing to pasre param like "cfgstr,par=val"
  * version 1.1.fb24
  * Remove explicit dependency on /usr/bin/python
  * make run_cmdline() log "Running command line" msg to new loglevel
  * tweak ConfigShell.run_stdin() to strip whitespace/newline from cmds
  * Fix failing to pasre par=val parameters
  * Add missing dependency on pyparsing and six
  * Fix path regex for [ and ]
  * Handle if TERM is not set
  Replacing configshell-fb-1.1.fb23.tar.xz with configshell-fb-1.1.fb25.tar.xz,
  and updating the SPEC file. Also, two patches subsumed/removed:
  * configshell-fb-example-should-not-specify-path.patch
  * configshell-fb-Handle-if-TERM-is-not-set.patch</changelog>
  <changelog author="mcepl@suse.com" date="1543924800">- Remove superfluous devel dependency for noarch package</changelog>
  <changelog author="mcepl@suse.com" date="1552046400">- Using now new proper upstream release 1.1.25:
  - Fix failing to parse param like pool/rbd;id=user
  - Acquire a lock to a preference file before working with it
  - Fix failing to pasre param like "cfgstr,par=val"
  - Remove explicit dependency on /usr/bin/python
  - make run_cmdline() log "Running command line" msg to new loglevel
  - tweak ConfigShell.run_stdin() to strip whitespace/newline from cmds
  - Fix failing to pasre par=val parameters
  - Add missing dependency on pyparsing and six
  - Fix path regex for [ and ]
  - Handle if TERM is not set</changelog>
  <changelog author="lduncan@suse.com" date="1568635200">- Updated to latest upstream version 1.1.26. There were not very
  many changes:
  * Version number no longer contains "fb" to designate "free
    branch", e.g. old was 1.1.fb25, new is 1.1.26
  * Add urwid to setup.py dependencies
  * Fix failing to parse params with additional chars
  * export __version__ variable
  resulting in replacing configshell-fb-1.1.25.tar.gz with
  configshell-fb-1.1.26.tar.gz, and corresponding SPEC-file
  updates.</changelog>
  <changelog author="lduncan@suse.com" date="1583236800">- Update to version v1.1.27 from v1.1.26 (jre#SLE-7751):
  * version 1.1.27
  * Use pyparsing's locatedExpr instead of our custom helper
  And updated the SPEC file, also adding a _service file.
  Replacing configshell-fb-1.1.26.tar.gz with
  python-configshell-fb-v1.1.27.tar.xz, and adding one
  upstrem patch:
  * Ensure-that-all-output-reaches-the-client-when-daemo.patch</changelog>
  <changelog author="lduncan@suse.com" date="1612008000">- Update to version v1.1.28 from v1.1.27 (jre#SLE-17360):
  * version 1.1.28
  * Ensure that all output reaches the client when daemonized
  * Remove Epydoc markup from command messages
  * Remove epydoc imports and epydoc calls
  Which removed the need for patch:
  * Ensure-that-all-output-reaches-the-client-when-daemo.patch</changelog>
  <changelog author="lduncan@suse.com" date="1632052800">- Upgrade to latest upstream version v1.1.29 (jre#SLE-17360):
  * setup.py: specify a version range for pyparsing
  * setup.py: lets stick to pyparsing v2.4.7
  * Don't warn if prefs file doesn't exist</changelog>
</package>
<package pkgid="6484c2f931d3e739f39a9054cf9ba54849a0efb1a8a8002dd372133291fb1ad2" name="python-python-docs-theme" arch="src">
  <version epoch="0" ver="2022.1" rel="150300.3.3.1"/>
  <changelog author="mcepl@suse.com" date="1560168000">- Initial packaging effort for 2018.7 version.</changelog>
  <changelog author="pgajdos@suse.com" date="1584705600">- version update to 2020.1
  * no upstream changelog found</changelog>
  <changelog author="mcepl@suse.com" date="1642593600">- Update to 2022.1:
  - Add a configuration for license URL.
  - Exclude the floating navbar from CHM help.
  - Make sidebar scrollable and sticky (on modern browsers)
  - Fix monospace again, on buggy Google Chrome
  - Add the copyright_url variable in the theme
  - Improve readability
  - Remove #searchbox on mobile to fix a layout bug
  - Fix the appearance of version/language selects
  - Make the theme responsive
  - Use default pygments theme
  - Test Github action to validate the theme against docsbuild scripts.
  - Add the copy button to pycon3 highlighted code blocks.
  - Updated the readme, to remind user to install the package in a virtual environment.
  - Updated the package url, using the GitHub repository instead of docs.python.org
  - Added license information to the footer of the doc
  - Fixed typo in the footer
  - Added information on how to use the package
  - Fixed code formatting
  - Fixed code bgcolor and codetextcolor for Sphinx 3.1.0+</changelog>
  <changelog author="mcepl@suse.com" date="1643112000">- Switch to setup.py based installation for compatibility with
  old SLE distros.</changelog>
</package>
<package pkgid="b317cd19aee6a7e0dd2c5fcadaa5c3e78d72df28b33d86422d2122101ae1653d" name="python-rpm" arch="src">
  <version epoch="0" ver="4.14.3" rel="150300.46.1"/>
  <changelog author="cthiel@suse.de" date="1223467200">- added libelf-devel to BuildRequires to fix build</changelog>
  <changelog author="ro@suse.de" date="1234440000">- adapt buildrequires</changelog>
  <changelog author="dmueller@suse.de" date="1287403200">- adapt buildrequires</changelog>
  <changelog author="coolo@novell.com" date="1287748800">- adapt second spec file to changes done to rpm.spec</changelog>
  <changelog author="mls@suse.de" date="1298462400">- drop standard python directories from filelist [bnc#229189]</changelog>
  <changelog author="coolo@suse.com" date="1323604800">- add libtool as explicit buildrequire</changelog>
  <changelog author="saschpe@suse.de" date="1326801600">- Spec file cleanup:
  * Don't rm -rf %{buildroot}
  * Removed %clean section
  * Removed authors from description</changelog>
  <changelog author="klaussfreire@gmail.com" date="1334145600">- Fix usage of deprecated AsVoidPtr Python/C API,
  replaced by Capsule API</changelog>
  <changelog author="mls@suse.de" date="1335182400">- modified capsule api diff to match rpm upstream</changelog>
  <changelog author="dmueller@suse.com" date="1357128000">- Update to 4.10.2</changelog>
  <changelog author="mls@suse.de" date="1373630400">- update to rpm-4.11.1</changelog>
  <changelog author="mls@suse.de" date="1384948800">- adapt to python-3.3, which no longer looks at XXXmodule.so</changelog>
  <changelog author="ngompa13@gmail.com" date="1508068800">- Unify rpm-python and python3-rpm into singlespec
- Switch the build to use setuptools-based build, so that
  the Python module is properly built with all its metadata</changelog>
  <changelog author="ngompa13@gmail.com" date="1508155200">- Properly quote the conditional for Obsoletes+Provides</changelog>
  <changelog author="ngompa13@gmail.com" date="1509192000">- Add a comment to note that prep and build stages come from rpm.spec</changelog>
  <changelog author="jengelh@inai.de" date="1513684800">- Update RPM groups</changelog>
  <changelog author="mls@suse.de" date="1517400000">- update to rpm-4.14.1</changelog>
  <changelog author="tchvatal@suse.com" date="1521547200">- Switch really to singlespec thus allowing us to build without
  python2-devel present in the distribution</changelog>
  <changelog author="mls@suse.de" date="1523016000">- remove rpmlint-Factory buildignore</changelog>
  <changelog author="ngompa13@gmail.com" date="1618401600">- update to rpm-4.14.3</changelog>
</package>
<package pkgid="bd67bd61a0df61d54ae4b3d118c6824eba05597b71f222c381f79e875a47477e" name="python2-Twisted" arch="aarch64">
  <version epoch="0" ver="19.10.0" rel="3.6.1"/>
  <changelog author="mimi.vx@gmail.com" date="1510315200">- update to 17.9.0
  For full list of changes please see:
  https://github.com/twisted/twisted/blob/twisted-17.9.0/NEWS.rst
  * mailman is only in python2 package</changelog>
  <changelog author="termim@gmail.com" date="1526644800">- update to 18.4.0
  For full list of changes please see:
  https://github.com/twisted/twisted/blob/twisted-18.4.0/NEWS.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1527595200">- Add python-service_identity Recommends.</changelog>
  <changelog author="dmueller@suse.com" date="1531828800">- update to 18.7.0:
  for full list of changes please see
  https://github.com/twisted/twisted/blob/twisted-18.7.0/NEWS.rst</changelog>
  <changelog author="tchvatal@suse.com" date="1539259200">- Fix the dependencies to match up upstream setup.py
- Run the tests
- Add patch to build with python3.7:
  * python37.patch
- Add missing dependency on pyamcrest
- Remove unused patch lp1102685.diff</changelog>
  <changelog author="ecsos@opensuse.org" date="1539345600">- Add missing Requires.</changelog>
  <changelog author="mcepl@suse.com" date="1539950400">- Add BuildRequires python-tz, which seems to be required to test suite
  to pass.
- Also, add skip_MultiCast.patch to skip tests requiring full
  netrworking stack.</changelog>
  <changelog author="tchvatal@suse.com" date="1540209600">- Do not write bytecode stuff when running the tests</changelog>
  <changelog author="tchvatal@suse.com" date="1541073600">- Version update to 18.9.0:
  * Fixes for the 3.7 python
- Remove merged python37.patch
- Add patch openssl111.patch which fixes tests with new pyOpenssl
  * Asserts changed behaviour</changelog>
  <changelog author="mcepl@suse.com" date="1541678400">- Add no-pygtkcompat.patch to avoid dependency on Gtk (boo#1110669)</changelog>
  <changelog author="schwab@suse.de" date="1548331200">- test-mktime-invalid-tm_isdst.patch: don't pass invalid tm_isdst value to
  mktime (see also bpo-15750)</changelog>
  <changelog author="tchvatal@suse.com" date="1550491200">- Add another patch for openssl 1.1.1 (from upstream git):
  * openssl-errormsg.aptch</changelog>
  <changelog author="tchvatal@suse.com" date="1558526400">- Update to 19.2.0:
  * twisted.internet.ssl.CertificateOptions now uses 32 random bytes instead of an MD5 hash for the ssl session identifier context. (#9463)
  * DeferredLock and DeferredSemaphore can be used as asynchronous context managers on Python 3.5+. (#9546)
  * t.i.b.BaseConnector has custom __repr__ (#9548)
  * twisted.internet.ssl.optionsForClientTLS now supports validating IP addresses from the certificate subjectAltName (#9585)
  * Twisted's minimum Cryptography requirement is now 2.5. (#9592)
  * twisted.conch.ssh.keys can now read private keys in the new "openssh-key-v1" format, introduced in OpenSSH 6.5 and made the default in OpenSSH 7.8. (#9515)
  * twisted.web.client.HostnameCachingHTTPSPolicy was added as a new contextFactory option. The policy caches a specified number of twisted.internet.interfaces.IOpenSSLClientConnectionCreator instances to to avoid the cost of instantiating a connection creator for multiple requests to the same host. (#9138)
- Remove merged patches:
  * openssl-errormsg.aptch
  * openssl111.patch
- Add patch to tests for new hyperlink:
  * hyperlink.patch</changelog>
  <changelog author="tbechtold@suse.com" date="1560340800">- update to 19.2.1 (bsc#1137825, CVE-2019-12387):
  * Prevent CRLF injections described in CVE-2019-12387</changelog>
  <changelog author="tbechtold@suse.com" date="1560340801">- Add 0001-Prevent-CRLF-injections-described-in-CVE-2019-12387.patch
  (bsc#1137825, CVE-2019-12387)
  Prevent CRLF injections</changelog>
  <changelog author="tbechtold@suse.com" date="1565784000">- Add PR-1147.patch (bsc#1138461, CVE-2019-12855)
  In words.protocols.jabber.xmlstream in Twisted through 19.2.1,
  XMPP support did not verify certificates when used with TLS,
  allowing an attacker to MITM connections.</changelog>
  <changelog author="tchvatal@suse.com" date="1568376000">- Update to 19.7.0:
  * The callable argument to twisted.internet.task.deferLater() is no longer required. (#9577)
  * twisted.internet.utils.getProcessOutputAndValue now accepts stdinBytes to write to the child process's standard input. (#9607)
  * Add new twisted.logger.capturedLogs context manager for capturing observed log events in tests. (#9617)
  * twisted.internet.base.PluggableResolverMixin, which implements the pluggable resolver interfaces for easier re-use in other reactors, has been factored out of ReactorBase. (#9632)
  * The PyPI page for Twisted has been enhanced to include more information and useful links. (#9648)
- Refresh patch:
  * skip_MultiCast.patch
- Remove merged patch hyperlink.patch
- Remove patch 0001-Prevent-CRLF-injections-described-in-CVE-2019-12387.patch
- Remove patch PR-1147.patch</changelog>
  <changelog author="jayvdb@gmail.com" date="1568462400">- Remove mailmail when only building Python 3 flavour</changelog>
  <changelog author="steven.kowalik@suse.com" date="1575460800">- Update to 19.10.0 bsc#1162424:
  * twisted.trial.successResultOf, twisted.trial.failureResultOf, and twisted.trial.assertNoResult accept coroutines as well as Deferreds. (#9006)
  * Fixed circular import in twisted.trial.reporter, introduced in Twisted 16.0.0. (#8267)
  * The POP3 server implemented by twisted.mail.pop3 now accepts passwords that contain spaces. (#9100)
  * Incoming HTTP/2 connections will now not time out if they persist for longer than one minute. (#9653)
  * twisted.conch.ssh.keys now correctly writes the "iqmp" parameter in serialized RSA private keys as q^-1 mod p rather than p^-1 mod q. (#9681)
  * twisted.web.server.Request will now use twisted.web.server.Site.getContentFile, if it exists, to get a file into which to write request content. If getContentFile is not provided by the site, it will fall back to the previous behavior of using io.BytesIO for small requests and tempfile.TemporaryFile for large ones. (#9655)
  * twisted.web.client.FileBodyProducer will now stop producing when the Deferred returned by FileBodyProducer.startProducing is cancelled. (#9547)
  * The HTTP/2 server implementation now enforces TCP flow control on control frame messages and times out clients that send invalid data without reading responses. This closes CVE-2019-9512 (Ping Flood), CVE-2019-9514 (Reset Flood), and CVE-2019-9515 (Settings Flood). Thanks to Jonathan Looney and Piotr Sikora. (#9694)
- Add python-38-xml-namespace.patch to fix dictionary mutation under Python 3.8
- Add python-38-hmac-digestmod.patch to add digestmod parameter where required
- Add python-38-no-cgi-parseqs.patch to no longer import parse_qs from cgi</changelog>
  <changelog author="mcepl@suse.com" date="1644667200">- Add CVE-2022-21712-sec-expo-CO-redirect.patch to properly
  remove sensitive headers when redirecting to a different origin
  (CVE-2022-21712, bsc#1195667).</changelog>
</package>
<package pkgid="bdf079fd011a8be3e00a54aa4117243b06a88dd5ffa5aba3ee395fb16a8cf1c2" name="python2-Twisted" arch="ppc64le">
  <version epoch="0" ver="19.10.0" rel="3.6.1"/>
  <changelog author="mimi.vx@gmail.com" date="1510315200">- update to 17.9.0
  For full list of changes please see:
  https://github.com/twisted/twisted/blob/twisted-17.9.0/NEWS.rst
  * mailman is only in python2 package</changelog>
  <changelog author="termim@gmail.com" date="1526644800">- update to 18.4.0
  For full list of changes please see:
  https://github.com/twisted/twisted/blob/twisted-18.4.0/NEWS.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1527595200">- Add python-service_identity Recommends.</changelog>
  <changelog author="dmueller@suse.com" date="1531828800">- update to 18.7.0:
  for full list of changes please see
  https://github.com/twisted/twisted/blob/twisted-18.7.0/NEWS.rst</changelog>
  <changelog author="tchvatal@suse.com" date="1539259200">- Fix the dependencies to match up upstream setup.py
- Run the tests
- Add patch to build with python3.7:
  * python37.patch
- Add missing dependency on pyamcrest
- Remove unused patch lp1102685.diff</changelog>
  <changelog author="ecsos@opensuse.org" date="1539345600">- Add missing Requires.</changelog>
  <changelog author="mcepl@suse.com" date="1539950400">- Add BuildRequires python-tz, which seems to be required to test suite
  to pass.
- Also, add skip_MultiCast.patch to skip tests requiring full
  netrworking stack.</changelog>
  <changelog author="tchvatal@suse.com" date="1540209600">- Do not write bytecode stuff when running the tests</changelog>
  <changelog author="tchvatal@suse.com" date="1541073600">- Version update to 18.9.0:
  * Fixes for the 3.7 python
- Remove merged python37.patch
- Add patch openssl111.patch which fixes tests with new pyOpenssl
  * Asserts changed behaviour</changelog>
  <changelog author="mcepl@suse.com" date="1541678400">- Add no-pygtkcompat.patch to avoid dependency on Gtk (boo#1110669)</changelog>
  <changelog author="schwab@suse.de" date="1548331200">- test-mktime-invalid-tm_isdst.patch: don't pass invalid tm_isdst value to
  mktime (see also bpo-15750)</changelog>
  <changelog author="tchvatal@suse.com" date="1550491200">- Add another patch for openssl 1.1.1 (from upstream git):
  * openssl-errormsg.aptch</changelog>
  <changelog author="tchvatal@suse.com" date="1558526400">- Update to 19.2.0:
  * twisted.internet.ssl.CertificateOptions now uses 32 random bytes instead of an MD5 hash for the ssl session identifier context. (#9463)
  * DeferredLock and DeferredSemaphore can be used as asynchronous context managers on Python 3.5+. (#9546)
  * t.i.b.BaseConnector has custom __repr__ (#9548)
  * twisted.internet.ssl.optionsForClientTLS now supports validating IP addresses from the certificate subjectAltName (#9585)
  * Twisted's minimum Cryptography requirement is now 2.5. (#9592)
  * twisted.conch.ssh.keys can now read private keys in the new "openssh-key-v1" format, introduced in OpenSSH 6.5 and made the default in OpenSSH 7.8. (#9515)
  * twisted.web.client.HostnameCachingHTTPSPolicy was added as a new contextFactory option. The policy caches a specified number of twisted.internet.interfaces.IOpenSSLClientConnectionCreator instances to to avoid the cost of instantiating a connection creator for multiple requests to the same host. (#9138)
- Remove merged patches:
  * openssl-errormsg.aptch
  * openssl111.patch
- Add patch to tests for new hyperlink:
  * hyperlink.patch</changelog>
  <changelog author="tbechtold@suse.com" date="1560340800">- update to 19.2.1 (bsc#1137825, CVE-2019-12387):
  * Prevent CRLF injections described in CVE-2019-12387</changelog>
  <changelog author="tbechtold@suse.com" date="1560340801">- Add 0001-Prevent-CRLF-injections-described-in-CVE-2019-12387.patch
  (bsc#1137825, CVE-2019-12387)
  Prevent CRLF injections</changelog>
  <changelog author="tbechtold@suse.com" date="1565784000">- Add PR-1147.patch (bsc#1138461, CVE-2019-12855)
  In words.protocols.jabber.xmlstream in Twisted through 19.2.1,
  XMPP support did not verify certificates when used with TLS,
  allowing an attacker to MITM connections.</changelog>
  <changelog author="tchvatal@suse.com" date="1568376000">- Update to 19.7.0:
  * The callable argument to twisted.internet.task.deferLater() is no longer required. (#9577)
  * twisted.internet.utils.getProcessOutputAndValue now accepts stdinBytes to write to the child process's standard input. (#9607)
  * Add new twisted.logger.capturedLogs context manager for capturing observed log events in tests. (#9617)
  * twisted.internet.base.PluggableResolverMixin, which implements the pluggable resolver interfaces for easier re-use in other reactors, has been factored out of ReactorBase. (#9632)
  * The PyPI page for Twisted has been enhanced to include more information and useful links. (#9648)
- Refresh patch:
  * skip_MultiCast.patch
- Remove merged patch hyperlink.patch
- Remove patch 0001-Prevent-CRLF-injections-described-in-CVE-2019-12387.patch
- Remove patch PR-1147.patch</changelog>
  <changelog author="jayvdb@gmail.com" date="1568462400">- Remove mailmail when only building Python 3 flavour</changelog>
  <changelog author="steven.kowalik@suse.com" date="1575460800">- Update to 19.10.0 bsc#1162424:
  * twisted.trial.successResultOf, twisted.trial.failureResultOf, and twisted.trial.assertNoResult accept coroutines as well as Deferreds. (#9006)
  * Fixed circular import in twisted.trial.reporter, introduced in Twisted 16.0.0. (#8267)
  * The POP3 server implemented by twisted.mail.pop3 now accepts passwords that contain spaces. (#9100)
  * Incoming HTTP/2 connections will now not time out if they persist for longer than one minute. (#9653)
  * twisted.conch.ssh.keys now correctly writes the "iqmp" parameter in serialized RSA private keys as q^-1 mod p rather than p^-1 mod q. (#9681)
  * twisted.web.server.Request will now use twisted.web.server.Site.getContentFile, if it exists, to get a file into which to write request content. If getContentFile is not provided by the site, it will fall back to the previous behavior of using io.BytesIO for small requests and tempfile.TemporaryFile for large ones. (#9655)
  * twisted.web.client.FileBodyProducer will now stop producing when the Deferred returned by FileBodyProducer.startProducing is cancelled. (#9547)
  * The HTTP/2 server implementation now enforces TCP flow control on control frame messages and times out clients that send invalid data without reading responses. This closes CVE-2019-9512 (Ping Flood), CVE-2019-9514 (Reset Flood), and CVE-2019-9515 (Settings Flood). Thanks to Jonathan Looney and Piotr Sikora. (#9694)
- Add python-38-xml-namespace.patch to fix dictionary mutation under Python 3.8
- Add python-38-hmac-digestmod.patch to add digestmod parameter where required
- Add python-38-no-cgi-parseqs.patch to no longer import parse_qs from cgi</changelog>
  <changelog author="mcepl@suse.com" date="1644667200">- Add CVE-2022-21712-sec-expo-CO-redirect.patch to properly
  remove sensitive headers when redirecting to a different origin
  (CVE-2022-21712, bsc#1195667).</changelog>
</package>
<package pkgid="bd5148e595b6e0d14e2d4bd83be589b8135d23d0a52e4192a2ff5260dd70f44a" name="python2-Twisted" arch="s390x">
  <version epoch="0" ver="19.10.0" rel="3.6.1"/>
  <changelog author="mimi.vx@gmail.com" date="1510315200">- update to 17.9.0
  For full list of changes please see:
  https://github.com/twisted/twisted/blob/twisted-17.9.0/NEWS.rst
  * mailman is only in python2 package</changelog>
  <changelog author="termim@gmail.com" date="1526644800">- update to 18.4.0
  For full list of changes please see:
  https://github.com/twisted/twisted/blob/twisted-18.4.0/NEWS.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1527595200">- Add python-service_identity Recommends.</changelog>
  <changelog author="dmueller@suse.com" date="1531828800">- update to 18.7.0:
  for full list of changes please see
  https://github.com/twisted/twisted/blob/twisted-18.7.0/NEWS.rst</changelog>
  <changelog author="tchvatal@suse.com" date="1539259200">- Fix the dependencies to match up upstream setup.py
- Run the tests
- Add patch to build with python3.7:
  * python37.patch
- Add missing dependency on pyamcrest
- Remove unused patch lp1102685.diff</changelog>
  <changelog author="ecsos@opensuse.org" date="1539345600">- Add missing Requires.</changelog>
  <changelog author="mcepl@suse.com" date="1539950400">- Add BuildRequires python-tz, which seems to be required to test suite
  to pass.
- Also, add skip_MultiCast.patch to skip tests requiring full
  netrworking stack.</changelog>
  <changelog author="tchvatal@suse.com" date="1540209600">- Do not write bytecode stuff when running the tests</changelog>
  <changelog author="tchvatal@suse.com" date="1541073600">- Version update to 18.9.0:
  * Fixes for the 3.7 python
- Remove merged python37.patch
- Add patch openssl111.patch which fixes tests with new pyOpenssl
  * Asserts changed behaviour</changelog>
  <changelog author="mcepl@suse.com" date="1541678400">- Add no-pygtkcompat.patch to avoid dependency on Gtk (boo#1110669)</changelog>
  <changelog author="schwab@suse.de" date="1548331200">- test-mktime-invalid-tm_isdst.patch: don't pass invalid tm_isdst value to
  mktime (see also bpo-15750)</changelog>
  <changelog author="tchvatal@suse.com" date="1550491200">- Add another patch for openssl 1.1.1 (from upstream git):
  * openssl-errormsg.aptch</changelog>
  <changelog author="tchvatal@suse.com" date="1558526400">- Update to 19.2.0:
  * twisted.internet.ssl.CertificateOptions now uses 32 random bytes instead of an MD5 hash for the ssl session identifier context. (#9463)
  * DeferredLock and DeferredSemaphore can be used as asynchronous context managers on Python 3.5+. (#9546)
  * t.i.b.BaseConnector has custom __repr__ (#9548)
  * twisted.internet.ssl.optionsForClientTLS now supports validating IP addresses from the certificate subjectAltName (#9585)
  * Twisted's minimum Cryptography requirement is now 2.5. (#9592)
  * twisted.conch.ssh.keys can now read private keys in the new "openssh-key-v1" format, introduced in OpenSSH 6.5 and made the default in OpenSSH 7.8. (#9515)
  * twisted.web.client.HostnameCachingHTTPSPolicy was added as a new contextFactory option. The policy caches a specified number of twisted.internet.interfaces.IOpenSSLClientConnectionCreator instances to to avoid the cost of instantiating a connection creator for multiple requests to the same host. (#9138)
- Remove merged patches:
  * openssl-errormsg.aptch
  * openssl111.patch
- Add patch to tests for new hyperlink:
  * hyperlink.patch</changelog>
  <changelog author="tbechtold@suse.com" date="1560340800">- update to 19.2.1 (bsc#1137825, CVE-2019-12387):
  * Prevent CRLF injections described in CVE-2019-12387</changelog>
  <changelog author="tbechtold@suse.com" date="1560340801">- Add 0001-Prevent-CRLF-injections-described-in-CVE-2019-12387.patch
  (bsc#1137825, CVE-2019-12387)
  Prevent CRLF injections</changelog>
  <changelog author="tbechtold@suse.com" date="1565784000">- Add PR-1147.patch (bsc#1138461, CVE-2019-12855)
  In words.protocols.jabber.xmlstream in Twisted through 19.2.1,
  XMPP support did not verify certificates when used with TLS,
  allowing an attacker to MITM connections.</changelog>
  <changelog author="tchvatal@suse.com" date="1568376000">- Update to 19.7.0:
  * The callable argument to twisted.internet.task.deferLater() is no longer required. (#9577)
  * twisted.internet.utils.getProcessOutputAndValue now accepts stdinBytes to write to the child process's standard input. (#9607)
  * Add new twisted.logger.capturedLogs context manager for capturing observed log events in tests. (#9617)
  * twisted.internet.base.PluggableResolverMixin, which implements the pluggable resolver interfaces for easier re-use in other reactors, has been factored out of ReactorBase. (#9632)
  * The PyPI page for Twisted has been enhanced to include more information and useful links. (#9648)
- Refresh patch:
  * skip_MultiCast.patch
- Remove merged patch hyperlink.patch
- Remove patch 0001-Prevent-CRLF-injections-described-in-CVE-2019-12387.patch
- Remove patch PR-1147.patch</changelog>
  <changelog author="jayvdb@gmail.com" date="1568462400">- Remove mailmail when only building Python 3 flavour</changelog>
  <changelog author="steven.kowalik@suse.com" date="1575460800">- Update to 19.10.0 bsc#1162424:
  * twisted.trial.successResultOf, twisted.trial.failureResultOf, and twisted.trial.assertNoResult accept coroutines as well as Deferreds. (#9006)
  * Fixed circular import in twisted.trial.reporter, introduced in Twisted 16.0.0. (#8267)
  * The POP3 server implemented by twisted.mail.pop3 now accepts passwords that contain spaces. (#9100)
  * Incoming HTTP/2 connections will now not time out if they persist for longer than one minute. (#9653)
  * twisted.conch.ssh.keys now correctly writes the "iqmp" parameter in serialized RSA private keys as q^-1 mod p rather than p^-1 mod q. (#9681)
  * twisted.web.server.Request will now use twisted.web.server.Site.getContentFile, if it exists, to get a file into which to write request content. If getContentFile is not provided by the site, it will fall back to the previous behavior of using io.BytesIO for small requests and tempfile.TemporaryFile for large ones. (#9655)
  * twisted.web.client.FileBodyProducer will now stop producing when the Deferred returned by FileBodyProducer.startProducing is cancelled. (#9547)
  * The HTTP/2 server implementation now enforces TCP flow control on control frame messages and times out clients that send invalid data without reading responses. This closes CVE-2019-9512 (Ping Flood), CVE-2019-9514 (Reset Flood), and CVE-2019-9515 (Settings Flood). Thanks to Jonathan Looney and Piotr Sikora. (#9694)
- Add python-38-xml-namespace.patch to fix dictionary mutation under Python 3.8
- Add python-38-hmac-digestmod.patch to add digestmod parameter where required
- Add python-38-no-cgi-parseqs.patch to no longer import parse_qs from cgi</changelog>
  <changelog author="mcepl@suse.com" date="1644667200">- Add CVE-2022-21712-sec-expo-CO-redirect.patch to properly
  remove sensitive headers when redirecting to a different origin
  (CVE-2022-21712, bsc#1195667).</changelog>
</package>
<package pkgid="177f120a4a44f96abf232ef08f72d5c510bbc87d9a8e33fad5392122286a7f3d" name="python2-Twisted" arch="x86_64">
  <version epoch="0" ver="19.10.0" rel="3.6.1"/>
  <changelog author="mimi.vx@gmail.com" date="1510315200">- update to 17.9.0
  For full list of changes please see:
  https://github.com/twisted/twisted/blob/twisted-17.9.0/NEWS.rst
  * mailman is only in python2 package</changelog>
  <changelog author="termim@gmail.com" date="1526644800">- update to 18.4.0
  For full list of changes please see:
  https://github.com/twisted/twisted/blob/twisted-18.4.0/NEWS.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1527595200">- Add python-service_identity Recommends.</changelog>
  <changelog author="dmueller@suse.com" date="1531828800">- update to 18.7.0:
  for full list of changes please see
  https://github.com/twisted/twisted/blob/twisted-18.7.0/NEWS.rst</changelog>
  <changelog author="tchvatal@suse.com" date="1539259200">- Fix the dependencies to match up upstream setup.py
- Run the tests
- Add patch to build with python3.7:
  * python37.patch
- Add missing dependency on pyamcrest
- Remove unused patch lp1102685.diff</changelog>
  <changelog author="ecsos@opensuse.org" date="1539345600">- Add missing Requires.</changelog>
  <changelog author="mcepl@suse.com" date="1539950400">- Add BuildRequires python-tz, which seems to be required to test suite
  to pass.
- Also, add skip_MultiCast.patch to skip tests requiring full
  netrworking stack.</changelog>
  <changelog author="tchvatal@suse.com" date="1540209600">- Do not write bytecode stuff when running the tests</changelog>
  <changelog author="tchvatal@suse.com" date="1541073600">- Version update to 18.9.0:
  * Fixes for the 3.7 python
- Remove merged python37.patch
- Add patch openssl111.patch which fixes tests with new pyOpenssl
  * Asserts changed behaviour</changelog>
  <changelog author="mcepl@suse.com" date="1541678400">- Add no-pygtkcompat.patch to avoid dependency on Gtk (boo#1110669)</changelog>
  <changelog author="schwab@suse.de" date="1548331200">- test-mktime-invalid-tm_isdst.patch: don't pass invalid tm_isdst value to
  mktime (see also bpo-15750)</changelog>
  <changelog author="tchvatal@suse.com" date="1550491200">- Add another patch for openssl 1.1.1 (from upstream git):
  * openssl-errormsg.aptch</changelog>
  <changelog author="tchvatal@suse.com" date="1558526400">- Update to 19.2.0:
  * twisted.internet.ssl.CertificateOptions now uses 32 random bytes instead of an MD5 hash for the ssl session identifier context. (#9463)
  * DeferredLock and DeferredSemaphore can be used as asynchronous context managers on Python 3.5+. (#9546)
  * t.i.b.BaseConnector has custom __repr__ (#9548)
  * twisted.internet.ssl.optionsForClientTLS now supports validating IP addresses from the certificate subjectAltName (#9585)
  * Twisted's minimum Cryptography requirement is now 2.5. (#9592)
  * twisted.conch.ssh.keys can now read private keys in the new "openssh-key-v1" format, introduced in OpenSSH 6.5 and made the default in OpenSSH 7.8. (#9515)
  * twisted.web.client.HostnameCachingHTTPSPolicy was added as a new contextFactory option. The policy caches a specified number of twisted.internet.interfaces.IOpenSSLClientConnectionCreator instances to to avoid the cost of instantiating a connection creator for multiple requests to the same host. (#9138)
- Remove merged patches:
  * openssl-errormsg.aptch
  * openssl111.patch
- Add patch to tests for new hyperlink:
  * hyperlink.patch</changelog>
  <changelog author="tbechtold@suse.com" date="1560340800">- update to 19.2.1 (bsc#1137825, CVE-2019-12387):
  * Prevent CRLF injections described in CVE-2019-12387</changelog>
  <changelog author="tbechtold@suse.com" date="1560340801">- Add 0001-Prevent-CRLF-injections-described-in-CVE-2019-12387.patch
  (bsc#1137825, CVE-2019-12387)
  Prevent CRLF injections</changelog>
  <changelog author="tbechtold@suse.com" date="1565784000">- Add PR-1147.patch (bsc#1138461, CVE-2019-12855)
  In words.protocols.jabber.xmlstream in Twisted through 19.2.1,
  XMPP support did not verify certificates when used with TLS,
  allowing an attacker to MITM connections.</changelog>
  <changelog author="tchvatal@suse.com" date="1568376000">- Update to 19.7.0:
  * The callable argument to twisted.internet.task.deferLater() is no longer required. (#9577)
  * twisted.internet.utils.getProcessOutputAndValue now accepts stdinBytes to write to the child process's standard input. (#9607)
  * Add new twisted.logger.capturedLogs context manager for capturing observed log events in tests. (#9617)
  * twisted.internet.base.PluggableResolverMixin, which implements the pluggable resolver interfaces for easier re-use in other reactors, has been factored out of ReactorBase. (#9632)
  * The PyPI page for Twisted has been enhanced to include more information and useful links. (#9648)
- Refresh patch:
  * skip_MultiCast.patch
- Remove merged patch hyperlink.patch
- Remove patch 0001-Prevent-CRLF-injections-described-in-CVE-2019-12387.patch
- Remove patch PR-1147.patch</changelog>
  <changelog author="jayvdb@gmail.com" date="1568462400">- Remove mailmail when only building Python 3 flavour</changelog>
  <changelog author="steven.kowalik@suse.com" date="1575460800">- Update to 19.10.0 bsc#1162424:
  * twisted.trial.successResultOf, twisted.trial.failureResultOf, and twisted.trial.assertNoResult accept coroutines as well as Deferreds. (#9006)
  * Fixed circular import in twisted.trial.reporter, introduced in Twisted 16.0.0. (#8267)
  * The POP3 server implemented by twisted.mail.pop3 now accepts passwords that contain spaces. (#9100)
  * Incoming HTTP/2 connections will now not time out if they persist for longer than one minute. (#9653)
  * twisted.conch.ssh.keys now correctly writes the "iqmp" parameter in serialized RSA private keys as q^-1 mod p rather than p^-1 mod q. (#9681)
  * twisted.web.server.Request will now use twisted.web.server.Site.getContentFile, if it exists, to get a file into which to write request content. If getContentFile is not provided by the site, it will fall back to the previous behavior of using io.BytesIO for small requests and tempfile.TemporaryFile for large ones. (#9655)
  * twisted.web.client.FileBodyProducer will now stop producing when the Deferred returned by FileBodyProducer.startProducing is cancelled. (#9547)
  * The HTTP/2 server implementation now enforces TCP flow control on control frame messages and times out clients that send invalid data without reading responses. This closes CVE-2019-9512 (Ping Flood), CVE-2019-9514 (Reset Flood), and CVE-2019-9515 (Settings Flood). Thanks to Jonathan Looney and Piotr Sikora. (#9694)
- Add python-38-xml-namespace.patch to fix dictionary mutation under Python 3.8
- Add python-38-hmac-digestmod.patch to add digestmod parameter where required
- Add python-38-no-cgi-parseqs.patch to no longer import parse_qs from cgi</changelog>
  <changelog author="mcepl@suse.com" date="1644667200">- Add CVE-2022-21712-sec-expo-CO-redirect.patch to properly
  remove sensitive headers when redirecting to a different origin
  (CVE-2022-21712, bsc#1195667).</changelog>
</package>
<package pkgid="7c884ede7629816a8535261053f694232f93a9fb3f4cc0a9b589ac9f57cc2258" name="python2-boost_parallel_mpi1_66_0" arch="aarch64">
  <version epoch="0" ver="1.66.0" rel="12.3.1"/>
  <changelog author="adam.majer@suse.de" date="1478606400">- Revert upstream change that set default python version and
  ignored user configuration.
  python-2059618.patch (boo#1006584)</changelog>
  <changelog author="adam.majer@suse.de" date="1483531200">- update to version 1.63.0
  * updated libraries: atomic, container, context, fiber,
    fusion, geometry, hash, interprocess, intrusive, lexical cast,
    log, metaparse, move, optional, phoenix, python, test,
    typeindex, units, unordered
  * see http://www.boost.org/users/history/version_1_63_0.html
    for complete list of changes
- refresh patches
  * boost-1.55.0-python-test-PyImport_AppendInittab.patch
  * boost-strict_aliasing.patch, and enable -fno-strict-aliasing
    for python module
- baselibs.conf:
  * add libboost_locale
  * rename python to include new soname
- remove python-2059618.patch, not needed
- make build condition --without buil_mpi work
- allow building without python3 bindings, for SLE11SP4
- remove versioned build dependency on libicu-devel, apparently
  not needed.
- split out the boost-devel package into individudal compiled
  libraries and their -devel subpackages and libboost_headers-devel
  package for header-only libraries.
- remove all the -mt.so symlinks, probably not needed anymore.
- ship MPI python bindings for both Python 2.7 and 3.x
  * add python_mpi.patch to allow proper compiled library loading
- dynamic_linking.patch: first attempt to remove static library
  generation during build process.</changelog>
  <changelog author="adam.majer@suse.de" date="1484481600">- remove non-existent dependency in the boost mpi python package</changelog>
  <changelog author="adam.majer@suse.de" date="1484654400">- test_lowcase.patch: downcase Boost::Test usage of uppercase
  variables. VERSION was clashing with GNU Autotools define
  resulting in compilation errors of various packages.
- recombine headers from various devel subpackages under the
  libboost_headers-devel package. Not all usage of headers that
  have compiled parts pull in their associated compiled symbols.
- general cleanup of the spec file from old, commented stuffs</changelog>
  <changelog author="adam.majer@suse.de" date="1485345600">- Fix dependency typos.</changelog>
  <changelog author="adam.majer@suse.de" date="1486123200">- baselibs.conf: (re)add python 2.7 and 3.x libraries</changelog>
  <changelog author="jmatejek@suse.com" date="1486728000">- update python macros</changelog>
  <changelog author="adam.majer@suse.de" date="1492689600">- New upstream version 1.64.0
  + process - new library providing cross platform methods to
  - create child processes
  - setup stream for child processes
  - sync and async communication streams with children
  - sync and async wait
  - process termination
  + geometry library had some breaking changes,
  - ublas_transformer is renamed to matrix_transformer
  - explicit modifier is added to constructors of rtree
    index::dynamic_* parameters
  - strategy::area::huiller replaced by strategy::area::spherical
  + context library updates
  - deprecated API:execution-context
  - fixed bad assembly for fcontext on ppc64/sysv/elf
  + Updated libraries: any, atomic, config, container, context,
    conversion, core, coroutine2, fiber, hash, interprocess,
    intrusive, lexicalcast, math, multi-index containers,
    multiprecision, predef, program options, regex, smart pointers,
    test ,typeindex, typetraits, unordered, variant
  + for details, see
    http://www.boost.org/users/history/version_1_64_0.html
- Build PyNumpy module
  + add build requires on python-numpy
- test_lowcase.patch: upstreamed
- refreshed patches: boost-strict_aliasing.patch, gcc_path.patch,
  python_mpi.patch
- mpi_upstream.patch: pending upstream fixes to OpenMPI build
- python_library_name.patch: we are building python versions in
  different stagings so drop library renames.
- python_numpy_retfunc.patch: rpmlint fixes</changelog>
  <changelog author="adam.majer@suse.de" date="1494244800">- make python-numpy optional build dependency
- fix building of mpi python3 plugin</changelog>
  <changelog author="adam.majer@suse.de" date="1494331200">- 1d862615.patch: Fix regression caused by refactoring of
  serialization code (bnc#1038083)</changelog>
  <changelog author="adam.majer@suse.de" date="1505908800">- New upstream version 1.65.1
  + config, fiber - Return a continuation from functions executed
    by resume_with.
  + stacktrace - Change preprocessor file extensions to work with
    the installation system.
- Changes in version 1.65.0
  + stacktrace - new library providing call sequence in human
    readable format.
  + polycollection - new library providing fast containers of
    polymorphic objects, from Joaquín M López Muñoz.
  + For full list of changes, see
    http://www.boost.org/users/history/version_1_65_1.html
- 1d862615.patch: upstreamed and removed
- gcc_path.patch: obsolete, tr1 module is removed
- mpi_upstream.patch: upstreamed and removed
- boost-1.57.0-python-abi_letters.patch: refreshed
- python_library_name.patch: refreshed and reverted upstream
  changes to mpi/build/Jamfile as we are building python2 and
  python3 versions of MPI separately.
- baselibs.conf
  + add libboost_stracktrace
  + update to version 1.65.1</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1507550400">- Setup MPI environment prior to building boost.
- Switch to OpenMPI2 as OpenMPI1 is becoming deprecated.</changelog>
  <changelog author="adam.majer@suse.de" date="1507636800">- Use multibuild setup - build no-dependency libraries in the
  base package and build the rest of the compiled libraries in
  the main variant. This should speed up bootstrapping.
- boost-devel not built by default anymore.
- libboost_headers-devel now provides boost-devel for legacy
  dependencies. If you need compiled boost libraries depend on
  the current compiled devel subpackage.
- run %fdupes only on the header files and documentation
- drop build dependencies on gcc-fortran, chrpath.</changelog>
  <changelog author="jmatejek@suse.com" date="1508846400">- build Python 2 conditionally</changelog>
  <changelog author="adam.majer@suse.de" date="1511956800">- re-enable Python 2 by default. It's still conditional, but
  remains enabled by default. This can be disabled in project
  config.</changelog>
  <changelog author="adam.majer@suse.de" date="1513598400">- Update to version 1.66.0
  + Beast: new portable HTTP, WebSocket and network operations
    using Boost.Asio. Header-only library.
  + Callable Traits: new library and successor to
    Boost.FunctionTypes. Header-only library.
  + Mp11: new metaprogramming library
  + Asio:
  * implemented interface changes to reflect the Networking TS
    (N4656)
  * functions and classes that have been superseded by
    Networking TS functionality have been deprecated.
  * added support for customized handler tracking
  * removed previously deprecated functions
  + Atomic: improved compatibility with GCC 7. 128-bit operations
    on x86_64 no longer require linking with compiled library.
  + DateTime: Fixed an integral overflow that could cause incorrect
    results when adding or subtracting many years from a date.
  + Format: New format specifiers added and volatile arguments
    can not be safely used with operator%
  + Fusion:
  * fix compile error with std::array
  * remove circular preprocessor include
  + PolyCollection: backported to GCC 4.8 and 4.9 with some
    limitations
  + Uuid: added RTF-4122 namespaces in boost::uuids::ns
  + for complete changelog, see
    http://www.boost.org/users/history/version_1_66_0.html
- refreshed patches: boost-rpmoptflags-only.patch</changelog>
  <changelog author="adam.majer@suse.de" date="1516363200">- Multibuild requires versioned Name: tag and doesn't seem to do
  this automatically. (bnc#1076640)</changelog>
  <changelog author="kukuk@suse.de" date="1522843200">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="adam.majer@suse.de" date="1584619200">- libreoffice_compat_backports.patch: add a backport of
  Boost.Optional::has_value() for LibreOffice</changelog>
  <changelog author="adam.majer@suse.de" date="1641816000">- variant.patch: backport fix allowing perfect forwarding in
  apply_visitor. Also fix wrong usage of boost::move (bsc#1194522)</changelog>
</package>
<package pkgid="b06b5a67995e836effed6e3ae06c813a84d84ec75b589adf05947abe955c7a4b" name="python2-boost_parallel_mpi1_66_0" arch="ppc64le">
  <version epoch="0" ver="1.66.0" rel="12.3.1"/>
  <changelog author="adam.majer@suse.de" date="1478606400">- Revert upstream change that set default python version and
  ignored user configuration.
  python-2059618.patch (boo#1006584)</changelog>
  <changelog author="adam.majer@suse.de" date="1483531200">- update to version 1.63.0
  * updated libraries: atomic, container, context, fiber,
    fusion, geometry, hash, interprocess, intrusive, lexical cast,
    log, metaparse, move, optional, phoenix, python, test,
    typeindex, units, unordered
  * see http://www.boost.org/users/history/version_1_63_0.html
    for complete list of changes
- refresh patches
  * boost-1.55.0-python-test-PyImport_AppendInittab.patch
  * boost-strict_aliasing.patch, and enable -fno-strict-aliasing
    for python module
- baselibs.conf:
  * add libboost_locale
  * rename python to include new soname
- remove python-2059618.patch, not needed
- make build condition --without buil_mpi work
- allow building without python3 bindings, for SLE11SP4
- remove versioned build dependency on libicu-devel, apparently
  not needed.
- split out the boost-devel package into individudal compiled
  libraries and their -devel subpackages and libboost_headers-devel
  package for header-only libraries.
- remove all the -mt.so symlinks, probably not needed anymore.
- ship MPI python bindings for both Python 2.7 and 3.x
  * add python_mpi.patch to allow proper compiled library loading
- dynamic_linking.patch: first attempt to remove static library
  generation during build process.</changelog>
  <changelog author="adam.majer@suse.de" date="1484481600">- remove non-existent dependency in the boost mpi python package</changelog>
  <changelog author="adam.majer@suse.de" date="1484654400">- test_lowcase.patch: downcase Boost::Test usage of uppercase
  variables. VERSION was clashing with GNU Autotools define
  resulting in compilation errors of various packages.
- recombine headers from various devel subpackages under the
  libboost_headers-devel package. Not all usage of headers that
  have compiled parts pull in their associated compiled symbols.
- general cleanup of the spec file from old, commented stuffs</changelog>
  <changelog author="adam.majer@suse.de" date="1485345600">- Fix dependency typos.</changelog>
  <changelog author="adam.majer@suse.de" date="1486123200">- baselibs.conf: (re)add python 2.7 and 3.x libraries</changelog>
  <changelog author="jmatejek@suse.com" date="1486728000">- update python macros</changelog>
  <changelog author="adam.majer@suse.de" date="1492689600">- New upstream version 1.64.0
  + process - new library providing cross platform methods to
  - create child processes
  - setup stream for child processes
  - sync and async communication streams with children
  - sync and async wait
  - process termination
  + geometry library had some breaking changes,
  - ublas_transformer is renamed to matrix_transformer
  - explicit modifier is added to constructors of rtree
    index::dynamic_* parameters
  - strategy::area::huiller replaced by strategy::area::spherical
  + context library updates
  - deprecated API:execution-context
  - fixed bad assembly for fcontext on ppc64/sysv/elf
  + Updated libraries: any, atomic, config, container, context,
    conversion, core, coroutine2, fiber, hash, interprocess,
    intrusive, lexicalcast, math, multi-index containers,
    multiprecision, predef, program options, regex, smart pointers,
    test ,typeindex, typetraits, unordered, variant
  + for details, see
    http://www.boost.org/users/history/version_1_64_0.html
- Build PyNumpy module
  + add build requires on python-numpy
- test_lowcase.patch: upstreamed
- refreshed patches: boost-strict_aliasing.patch, gcc_path.patch,
  python_mpi.patch
- mpi_upstream.patch: pending upstream fixes to OpenMPI build
- python_library_name.patch: we are building python versions in
  different stagings so drop library renames.
- python_numpy_retfunc.patch: rpmlint fixes</changelog>
  <changelog author="adam.majer@suse.de" date="1494244800">- make python-numpy optional build dependency
- fix building of mpi python3 plugin</changelog>
  <changelog author="adam.majer@suse.de" date="1494331200">- 1d862615.patch: Fix regression caused by refactoring of
  serialization code (bnc#1038083)</changelog>
  <changelog author="adam.majer@suse.de" date="1505908800">- New upstream version 1.65.1
  + config, fiber - Return a continuation from functions executed
    by resume_with.
  + stacktrace - Change preprocessor file extensions to work with
    the installation system.
- Changes in version 1.65.0
  + stacktrace - new library providing call sequence in human
    readable format.
  + polycollection - new library providing fast containers of
    polymorphic objects, from Joaquín M López Muñoz.
  + For full list of changes, see
    http://www.boost.org/users/history/version_1_65_1.html
- 1d862615.patch: upstreamed and removed
- gcc_path.patch: obsolete, tr1 module is removed
- mpi_upstream.patch: upstreamed and removed
- boost-1.57.0-python-abi_letters.patch: refreshed
- python_library_name.patch: refreshed and reverted upstream
  changes to mpi/build/Jamfile as we are building python2 and
  python3 versions of MPI separately.
- baselibs.conf
  + add libboost_stracktrace
  + update to version 1.65.1</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1507550400">- Setup MPI environment prior to building boost.
- Switch to OpenMPI2 as OpenMPI1 is becoming deprecated.</changelog>
  <changelog author="adam.majer@suse.de" date="1507636800">- Use multibuild setup - build no-dependency libraries in the
  base package and build the rest of the compiled libraries in
  the main variant. This should speed up bootstrapping.
- boost-devel not built by default anymore.
- libboost_headers-devel now provides boost-devel for legacy
  dependencies. If you need compiled boost libraries depend on
  the current compiled devel subpackage.
- run %fdupes only on the header files and documentation
- drop build dependencies on gcc-fortran, chrpath.</changelog>
  <changelog author="jmatejek@suse.com" date="1508846400">- build Python 2 conditionally</changelog>
  <changelog author="adam.majer@suse.de" date="1511956800">- re-enable Python 2 by default. It's still conditional, but
  remains enabled by default. This can be disabled in project
  config.</changelog>
  <changelog author="adam.majer@suse.de" date="1513598400">- Update to version 1.66.0
  + Beast: new portable HTTP, WebSocket and network operations
    using Boost.Asio. Header-only library.
  + Callable Traits: new library and successor to
    Boost.FunctionTypes. Header-only library.
  + Mp11: new metaprogramming library
  + Asio:
  * implemented interface changes to reflect the Networking TS
    (N4656)
  * functions and classes that have been superseded by
    Networking TS functionality have been deprecated.
  * added support for customized handler tracking
  * removed previously deprecated functions
  + Atomic: improved compatibility with GCC 7. 128-bit operations
    on x86_64 no longer require linking with compiled library.
  + DateTime: Fixed an integral overflow that could cause incorrect
    results when adding or subtracting many years from a date.
  + Format: New format specifiers added and volatile arguments
    can not be safely used with operator%
  + Fusion:
  * fix compile error with std::array
  * remove circular preprocessor include
  + PolyCollection: backported to GCC 4.8 and 4.9 with some
    limitations
  + Uuid: added RTF-4122 namespaces in boost::uuids::ns
  + for complete changelog, see
    http://www.boost.org/users/history/version_1_66_0.html
- refreshed patches: boost-rpmoptflags-only.patch</changelog>
  <changelog author="adam.majer@suse.de" date="1516363200">- Multibuild requires versioned Name: tag and doesn't seem to do
  this automatically. (bnc#1076640)</changelog>
  <changelog author="kukuk@suse.de" date="1522843200">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="adam.majer@suse.de" date="1584619200">- libreoffice_compat_backports.patch: add a backport of
  Boost.Optional::has_value() for LibreOffice</changelog>
  <changelog author="adam.majer@suse.de" date="1641816000">- variant.patch: backport fix allowing perfect forwarding in
  apply_visitor. Also fix wrong usage of boost::move (bsc#1194522)</changelog>
</package>
<package pkgid="5dba99a49b32e14782f87141684871ca66f0a35f3c88ad5a280c82b11cf3bc30" name="python2-boost_parallel_mpi1_66_0" arch="s390x">
  <version epoch="0" ver="1.66.0" rel="12.3.1"/>
  <changelog author="adam.majer@suse.de" date="1478606400">- Revert upstream change that set default python version and
  ignored user configuration.
  python-2059618.patch (boo#1006584)</changelog>
  <changelog author="adam.majer@suse.de" date="1483531200">- update to version 1.63.0
  * updated libraries: atomic, container, context, fiber,
    fusion, geometry, hash, interprocess, intrusive, lexical cast,
    log, metaparse, move, optional, phoenix, python, test,
    typeindex, units, unordered
  * see http://www.boost.org/users/history/version_1_63_0.html
    for complete list of changes
- refresh patches
  * boost-1.55.0-python-test-PyImport_AppendInittab.patch
  * boost-strict_aliasing.patch, and enable -fno-strict-aliasing
    for python module
- baselibs.conf:
  * add libboost_locale
  * rename python to include new soname
- remove python-2059618.patch, not needed
- make build condition --without buil_mpi work
- allow building without python3 bindings, for SLE11SP4
- remove versioned build dependency on libicu-devel, apparently
  not needed.
- split out the boost-devel package into individudal compiled
  libraries and their -devel subpackages and libboost_headers-devel
  package for header-only libraries.
- remove all the -mt.so symlinks, probably not needed anymore.
- ship MPI python bindings for both Python 2.7 and 3.x
  * add python_mpi.patch to allow proper compiled library loading
- dynamic_linking.patch: first attempt to remove static library
  generation during build process.</changelog>
  <changelog author="adam.majer@suse.de" date="1484481600">- remove non-existent dependency in the boost mpi python package</changelog>
  <changelog author="adam.majer@suse.de" date="1484654400">- test_lowcase.patch: downcase Boost::Test usage of uppercase
  variables. VERSION was clashing with GNU Autotools define
  resulting in compilation errors of various packages.
- recombine headers from various devel subpackages under the
  libboost_headers-devel package. Not all usage of headers that
  have compiled parts pull in their associated compiled symbols.
- general cleanup of the spec file from old, commented stuffs</changelog>
  <changelog author="adam.majer@suse.de" date="1485345600">- Fix dependency typos.</changelog>
  <changelog author="adam.majer@suse.de" date="1486123200">- baselibs.conf: (re)add python 2.7 and 3.x libraries</changelog>
  <changelog author="jmatejek@suse.com" date="1486728000">- update python macros</changelog>
  <changelog author="adam.majer@suse.de" date="1492689600">- New upstream version 1.64.0
  + process - new library providing cross platform methods to
  - create child processes
  - setup stream for child processes
  - sync and async communication streams with children
  - sync and async wait
  - process termination
  + geometry library had some breaking changes,
  - ublas_transformer is renamed to matrix_transformer
  - explicit modifier is added to constructors of rtree
    index::dynamic_* parameters
  - strategy::area::huiller replaced by strategy::area::spherical
  + context library updates
  - deprecated API:execution-context
  - fixed bad assembly for fcontext on ppc64/sysv/elf
  + Updated libraries: any, atomic, config, container, context,
    conversion, core, coroutine2, fiber, hash, interprocess,
    intrusive, lexicalcast, math, multi-index containers,
    multiprecision, predef, program options, regex, smart pointers,
    test ,typeindex, typetraits, unordered, variant
  + for details, see
    http://www.boost.org/users/history/version_1_64_0.html
- Build PyNumpy module
  + add build requires on python-numpy
- test_lowcase.patch: upstreamed
- refreshed patches: boost-strict_aliasing.patch, gcc_path.patch,
  python_mpi.patch
- mpi_upstream.patch: pending upstream fixes to OpenMPI build
- python_library_name.patch: we are building python versions in
  different stagings so drop library renames.
- python_numpy_retfunc.patch: rpmlint fixes</changelog>
  <changelog author="adam.majer@suse.de" date="1494244800">- make python-numpy optional build dependency
- fix building of mpi python3 plugin</changelog>
  <changelog author="adam.majer@suse.de" date="1494331200">- 1d862615.patch: Fix regression caused by refactoring of
  serialization code (bnc#1038083)</changelog>
  <changelog author="adam.majer@suse.de" date="1505908800">- New upstream version 1.65.1
  + config, fiber - Return a continuation from functions executed
    by resume_with.
  + stacktrace - Change preprocessor file extensions to work with
    the installation system.
- Changes in version 1.65.0
  + stacktrace - new library providing call sequence in human
    readable format.
  + polycollection - new library providing fast containers of
    polymorphic objects, from Joaquín M López Muñoz.
  + For full list of changes, see
    http://www.boost.org/users/history/version_1_65_1.html
- 1d862615.patch: upstreamed and removed
- gcc_path.patch: obsolete, tr1 module is removed
- mpi_upstream.patch: upstreamed and removed
- boost-1.57.0-python-abi_letters.patch: refreshed
- python_library_name.patch: refreshed and reverted upstream
  changes to mpi/build/Jamfile as we are building python2 and
  python3 versions of MPI separately.
- baselibs.conf
  + add libboost_stracktrace
  + update to version 1.65.1</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1507550400">- Setup MPI environment prior to building boost.
- Switch to OpenMPI2 as OpenMPI1 is becoming deprecated.</changelog>
  <changelog author="adam.majer@suse.de" date="1507636800">- Use multibuild setup - build no-dependency libraries in the
  base package and build the rest of the compiled libraries in
  the main variant. This should speed up bootstrapping.
- boost-devel not built by default anymore.
- libboost_headers-devel now provides boost-devel for legacy
  dependencies. If you need compiled boost libraries depend on
  the current compiled devel subpackage.
- run %fdupes only on the header files and documentation
- drop build dependencies on gcc-fortran, chrpath.</changelog>
  <changelog author="jmatejek@suse.com" date="1508846400">- build Python 2 conditionally</changelog>
  <changelog author="adam.majer@suse.de" date="1511956800">- re-enable Python 2 by default. It's still conditional, but
  remains enabled by default. This can be disabled in project
  config.</changelog>
  <changelog author="adam.majer@suse.de" date="1513598400">- Update to version 1.66.0
  + Beast: new portable HTTP, WebSocket and network operations
    using Boost.Asio. Header-only library.
  + Callable Traits: new library and successor to
    Boost.FunctionTypes. Header-only library.
  + Mp11: new metaprogramming library
  + Asio:
  * implemented interface changes to reflect the Networking TS
    (N4656)
  * functions and classes that have been superseded by
    Networking TS functionality have been deprecated.
  * added support for customized handler tracking
  * removed previously deprecated functions
  + Atomic: improved compatibility with GCC 7. 128-bit operations
    on x86_64 no longer require linking with compiled library.
  + DateTime: Fixed an integral overflow that could cause incorrect
    results when adding or subtracting many years from a date.
  + Format: New format specifiers added and volatile arguments
    can not be safely used with operator%
  + Fusion:
  * fix compile error with std::array
  * remove circular preprocessor include
  + PolyCollection: backported to GCC 4.8 and 4.9 with some
    limitations
  + Uuid: added RTF-4122 namespaces in boost::uuids::ns
  + for complete changelog, see
    http://www.boost.org/users/history/version_1_66_0.html
- refreshed patches: boost-rpmoptflags-only.patch</changelog>
  <changelog author="adam.majer@suse.de" date="1516363200">- Multibuild requires versioned Name: tag and doesn't seem to do
  this automatically. (bnc#1076640)</changelog>
  <changelog author="kukuk@suse.de" date="1522843200">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="adam.majer@suse.de" date="1584619200">- libreoffice_compat_backports.patch: add a backport of
  Boost.Optional::has_value() for LibreOffice</changelog>
  <changelog author="adam.majer@suse.de" date="1641816000">- variant.patch: backport fix allowing perfect forwarding in
  apply_visitor. Also fix wrong usage of boost::move (bsc#1194522)</changelog>
</package>
<package pkgid="f72141b96dd1767b7dba6cad22443c69bb089941c16e21abf0c2199277381e93" name="python2-boost_parallel_mpi1_66_0" arch="x86_64">
  <version epoch="0" ver="1.66.0" rel="12.3.1"/>
  <changelog author="adam.majer@suse.de" date="1478606400">- Revert upstream change that set default python version and
  ignored user configuration.
  python-2059618.patch (boo#1006584)</changelog>
  <changelog author="adam.majer@suse.de" date="1483531200">- update to version 1.63.0
  * updated libraries: atomic, container, context, fiber,
    fusion, geometry, hash, interprocess, intrusive, lexical cast,
    log, metaparse, move, optional, phoenix, python, test,
    typeindex, units, unordered
  * see http://www.boost.org/users/history/version_1_63_0.html
    for complete list of changes
- refresh patches
  * boost-1.55.0-python-test-PyImport_AppendInittab.patch
  * boost-strict_aliasing.patch, and enable -fno-strict-aliasing
    for python module
- baselibs.conf:
  * add libboost_locale
  * rename python to include new soname
- remove python-2059618.patch, not needed
- make build condition --without buil_mpi work
- allow building without python3 bindings, for SLE11SP4
- remove versioned build dependency on libicu-devel, apparently
  not needed.
- split out the boost-devel package into individudal compiled
  libraries and their -devel subpackages and libboost_headers-devel
  package for header-only libraries.
- remove all the -mt.so symlinks, probably not needed anymore.
- ship MPI python bindings for both Python 2.7 and 3.x
  * add python_mpi.patch to allow proper compiled library loading
- dynamic_linking.patch: first attempt to remove static library
  generation during build process.</changelog>
  <changelog author="adam.majer@suse.de" date="1484481600">- remove non-existent dependency in the boost mpi python package</changelog>
  <changelog author="adam.majer@suse.de" date="1484654400">- test_lowcase.patch: downcase Boost::Test usage of uppercase
  variables. VERSION was clashing with GNU Autotools define
  resulting in compilation errors of various packages.
- recombine headers from various devel subpackages under the
  libboost_headers-devel package. Not all usage of headers that
  have compiled parts pull in their associated compiled symbols.
- general cleanup of the spec file from old, commented stuffs</changelog>
  <changelog author="adam.majer@suse.de" date="1485345600">- Fix dependency typos.</changelog>
  <changelog author="adam.majer@suse.de" date="1486123200">- baselibs.conf: (re)add python 2.7 and 3.x libraries</changelog>
  <changelog author="jmatejek@suse.com" date="1486728000">- update python macros</changelog>
  <changelog author="adam.majer@suse.de" date="1492689600">- New upstream version 1.64.0
  + process - new library providing cross platform methods to
  - create child processes
  - setup stream for child processes
  - sync and async communication streams with children
  - sync and async wait
  - process termination
  + geometry library had some breaking changes,
  - ublas_transformer is renamed to matrix_transformer
  - explicit modifier is added to constructors of rtree
    index::dynamic_* parameters
  - strategy::area::huiller replaced by strategy::area::spherical
  + context library updates
  - deprecated API:execution-context
  - fixed bad assembly for fcontext on ppc64/sysv/elf
  + Updated libraries: any, atomic, config, container, context,
    conversion, core, coroutine2, fiber, hash, interprocess,
    intrusive, lexicalcast, math, multi-index containers,
    multiprecision, predef, program options, regex, smart pointers,
    test ,typeindex, typetraits, unordered, variant
  + for details, see
    http://www.boost.org/users/history/version_1_64_0.html
- Build PyNumpy module
  + add build requires on python-numpy
- test_lowcase.patch: upstreamed
- refreshed patches: boost-strict_aliasing.patch, gcc_path.patch,
  python_mpi.patch
- mpi_upstream.patch: pending upstream fixes to OpenMPI build
- python_library_name.patch: we are building python versions in
  different stagings so drop library renames.
- python_numpy_retfunc.patch: rpmlint fixes</changelog>
  <changelog author="adam.majer@suse.de" date="1494244800">- make python-numpy optional build dependency
- fix building of mpi python3 plugin</changelog>
  <changelog author="adam.majer@suse.de" date="1494331200">- 1d862615.patch: Fix regression caused by refactoring of
  serialization code (bnc#1038083)</changelog>
  <changelog author="adam.majer@suse.de" date="1505908800">- New upstream version 1.65.1
  + config, fiber - Return a continuation from functions executed
    by resume_with.
  + stacktrace - Change preprocessor file extensions to work with
    the installation system.
- Changes in version 1.65.0
  + stacktrace - new library providing call sequence in human
    readable format.
  + polycollection - new library providing fast containers of
    polymorphic objects, from Joaquín M López Muñoz.
  + For full list of changes, see
    http://www.boost.org/users/history/version_1_65_1.html
- 1d862615.patch: upstreamed and removed
- gcc_path.patch: obsolete, tr1 module is removed
- mpi_upstream.patch: upstreamed and removed
- boost-1.57.0-python-abi_letters.patch: refreshed
- python_library_name.patch: refreshed and reverted upstream
  changes to mpi/build/Jamfile as we are building python2 and
  python3 versions of MPI separately.
- baselibs.conf
  + add libboost_stracktrace
  + update to version 1.65.1</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1507550400">- Setup MPI environment prior to building boost.
- Switch to OpenMPI2 as OpenMPI1 is becoming deprecated.</changelog>
  <changelog author="adam.majer@suse.de" date="1507636800">- Use multibuild setup - build no-dependency libraries in the
  base package and build the rest of the compiled libraries in
  the main variant. This should speed up bootstrapping.
- boost-devel not built by default anymore.
- libboost_headers-devel now provides boost-devel for legacy
  dependencies. If you need compiled boost libraries depend on
  the current compiled devel subpackage.
- run %fdupes only on the header files and documentation
- drop build dependencies on gcc-fortran, chrpath.</changelog>
  <changelog author="jmatejek@suse.com" date="1508846400">- build Python 2 conditionally</changelog>
  <changelog author="adam.majer@suse.de" date="1511956800">- re-enable Python 2 by default. It's still conditional, but
  remains enabled by default. This can be disabled in project
  config.</changelog>
  <changelog author="adam.majer@suse.de" date="1513598400">- Update to version 1.66.0
  + Beast: new portable HTTP, WebSocket and network operations
    using Boost.Asio. Header-only library.
  + Callable Traits: new library and successor to
    Boost.FunctionTypes. Header-only library.
  + Mp11: new metaprogramming library
  + Asio:
  * implemented interface changes to reflect the Networking TS
    (N4656)
  * functions and classes that have been superseded by
    Networking TS functionality have been deprecated.
  * added support for customized handler tracking
  * removed previously deprecated functions
  + Atomic: improved compatibility with GCC 7. 128-bit operations
    on x86_64 no longer require linking with compiled library.
  + DateTime: Fixed an integral overflow that could cause incorrect
    results when adding or subtracting many years from a date.
  + Format: New format specifiers added and volatile arguments
    can not be safely used with operator%
  + Fusion:
  * fix compile error with std::array
  * remove circular preprocessor include
  + PolyCollection: backported to GCC 4.8 and 4.9 with some
    limitations
  + Uuid: added RTF-4122 namespaces in boost::uuids::ns
  + for complete changelog, see
    http://www.boost.org/users/history/version_1_66_0.html
- refreshed patches: boost-rpmoptflags-only.patch</changelog>
  <changelog author="adam.majer@suse.de" date="1516363200">- Multibuild requires versioned Name: tag and doesn't seem to do
  this automatically. (bnc#1076640)</changelog>
  <changelog author="kukuk@suse.de" date="1522843200">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="adam.majer@suse.de" date="1584619200">- libreoffice_compat_backports.patch: add a backport of
  Boost.Optional::has_value() for LibreOffice</changelog>
  <changelog author="adam.majer@suse.de" date="1641816000">- variant.patch: backport fix allowing perfect forwarding in
  apply_visitor. Also fix wrong usage of boost::move (bsc#1194522)</changelog>
</package>
<package pkgid="d6a15bfd3d77438998e5d942c32e0d92c36339d016b1ea53f516dde0cad050d8" name="python2-configshell-fb" arch="noarch">
  <version epoch="0" ver="1.1.29" rel="3.3.1"/>
  <changelog author="lduncan@suse.com" date="1461067200">- Initial creation of this package, from upstream
  version 1.1.fb20</changelog>
  <changelog author="dmueller@suse.com" date="1462536000">- cleanup buildroot parts</changelog>
  <changelog author="lduncan@suse.com" date="1466769600">- Updated SPEC file: removed "Provides"/"Obsoletes" for
  package name "python-confishell" (bsc#984935)</changelog>
  <changelog author="lduncan@suse.com" date="1466769601">- Updated spec file: added Conflicts for python-configshell
  (bsc#986475)</changelog>
  <changelog author="shshyukriev@suse.com" date="1488196800">- Update to v 1.1.22fb
  * Fixed github source namespace</changelog>
  <changelog author="lszhu@suse.com" date="1502971200">- Update to version 1.1.23fb
  * improving ALUA and TCMU support</changelog>
  <changelog author="lduncan@suse.com" date="1512734400">- Converting RPM SPEC file to singlespec format (bsc#1045332),
  adding patch:
  * configshell-fb-example-should-not-specify-path.patch
- Fix targetcli.service problem when TERM not set (bsc#1071194),
  adding patch (from LSZhu):
  * configshell-fb-Handle-if-TERM-is-not-set.patch
- Moved build requirement on urwid to runtime requirement,
  as suggested by scarabeus_iv
- ran spec-cleaner to clean up SPEC file
- Converted from manually-added configshell-fb tar file to
  tar_scm service-generated file by adding _service and
  _servicedata</changelog>
  <changelog author="tchvatal@suse.com" date="1514980800">- Do not build epydoc documentation to allow py3 only build</changelog>
  <changelog author="olaf@aepfle.de" date="1519560000">- Fix upgrade path by provide/obsolete python-configshell (bsc#1082693)</changelog>
  <changelog author="opensuse-packaging@opensuse.org" date="1539864000">- Update to version 1.1.fb23:
  * version 1.1.25
  * Fix failing to parse param like pool/rbd;id=user
  * Acquire a lock to a preference file before working with it
  * Fix failing to pasre param like "cfgstr,par=val"
  * version 1.1.fb24
  * Remove explicit dependency on /usr/bin/python
  * make run_cmdline() log "Running command line" msg to new loglevel
  * tweak ConfigShell.run_stdin() to strip whitespace/newline from cmds
  * Fix failing to pasre par=val parameters
  * Add missing dependency on pyparsing and six
  * Fix path regex for [ and ]
  * Handle if TERM is not set
  Replacing configshell-fb-1.1.fb23.tar.xz with configshell-fb-1.1.fb25.tar.xz,
  and updating the SPEC file. Also, two patches subsumed/removed:
  * configshell-fb-example-should-not-specify-path.patch
  * configshell-fb-Handle-if-TERM-is-not-set.patch</changelog>
  <changelog author="mcepl@suse.com" date="1543924800">- Remove superfluous devel dependency for noarch package</changelog>
  <changelog author="mcepl@suse.com" date="1552046400">- Using now new proper upstream release 1.1.25:
  - Fix failing to parse param like pool/rbd;id=user
  - Acquire a lock to a preference file before working with it
  - Fix failing to pasre param like "cfgstr,par=val"
  - Remove explicit dependency on /usr/bin/python
  - make run_cmdline() log "Running command line" msg to new loglevel
  - tweak ConfigShell.run_stdin() to strip whitespace/newline from cmds
  - Fix failing to pasre par=val parameters
  - Add missing dependency on pyparsing and six
  - Fix path regex for [ and ]
  - Handle if TERM is not set</changelog>
  <changelog author="lduncan@suse.com" date="1568635200">- Updated to latest upstream version 1.1.26. There were not very
  many changes:
  * Version number no longer contains "fb" to designate "free
    branch", e.g. old was 1.1.fb25, new is 1.1.26
  * Add urwid to setup.py dependencies
  * Fix failing to parse params with additional chars
  * export __version__ variable
  resulting in replacing configshell-fb-1.1.25.tar.gz with
  configshell-fb-1.1.26.tar.gz, and corresponding SPEC-file
  updates.</changelog>
  <changelog author="lduncan@suse.com" date="1583236800">- Update to version v1.1.27 from v1.1.26 (jre#SLE-7751):
  * version 1.1.27
  * Use pyparsing's locatedExpr instead of our custom helper
  And updated the SPEC file, also adding a _service file.
  Replacing configshell-fb-1.1.26.tar.gz with
  python-configshell-fb-v1.1.27.tar.xz, and adding one
  upstrem patch:
  * Ensure-that-all-output-reaches-the-client-when-daemo.patch</changelog>
  <changelog author="lduncan@suse.com" date="1612008000">- Update to version v1.1.28 from v1.1.27 (jre#SLE-17360):
  * version 1.1.28
  * Ensure that all output reaches the client when daemonized
  * Remove Epydoc markup from command messages
  * Remove epydoc imports and epydoc calls
  Which removed the need for patch:
  * Ensure-that-all-output-reaches-the-client-when-daemo.patch</changelog>
  <changelog author="lduncan@suse.com" date="1632052800">- Upgrade to latest upstream version v1.1.29 (jre#SLE-17360):
  * setup.py: specify a version range for pyparsing
  * setup.py: lets stick to pyparsing v2.4.7
  * Don't warn if prefs file doesn't exist</changelog>
</package>
<package pkgid="ea5349636c67bc1a6ab9a37d1fb4c3b98f93e466b536ebb228cce98045d1321e" name="python2-rhnlib" arch="noarch">
  <version epoch="0" ver="4.2.5" rel="3.31.1"/>
  <changelog author="jgonzalez@suse.com" date="1517572800">- version 2.8.5.3-1
- replace netstat with ss command</changelog>
  <changelog author="jgonzalez@suse.com" date="1519387200">- version 2.8.7.1-1
- Sync with upstream</changelog>
  <changelog author="jgonzalez@suse.com" date="1520251200">- version 2.8.7.2-1
- remove empty clean section from spec (bsc#1083294)</changelog>
  <changelog author="jgonzalez@suse.com" date="1522065600">- version 2.8.10.1-1
- Sync with upstream (bsc#1083294)</changelog>
  <changelog author="jgonzalez@suse.com" date="1525694400">- version 2.8.11.1-1
- Sync with upstream (bsc#1083294)</changelog>
  <changelog author="jgonzalez@suse.com" date="1533902400">- version 4.0.1-1
- Bump version to 4.0.0 (bsc#1104034)
- Fix copyright for the package specfile (bsc#1103696)</changelog>
  <changelog author="jgonzalez@suse.com" date="1540555200">- version 4.0.2-1
- use rpm for debian packaging</changelog>
  <changelog author="jgonzalez@suse.com" date="1548936000">- version 4.0.3-1
- Sync changes from Spacewalk
- 1652859 - python3 http.client does not contain _set_hostport()</changelog>
  <changelog author="jgonzalez@suse.com" date="1551268800">- version 4.0.4-1
- Fix encoding issues after porting to Python 3.</changelog>
  <changelog author="jgonzalez@suse.com" date="1551528000">- version 4.0.5-1
- Read SSL decoded buffer completely when no pending bytes on the
  underlying connection.</changelog>
  <changelog author="jgonzalez@suse.com" date="1553860800">- version 4.0.6-1
- Add group to python*-rhnlib to fix building at SLE11</changelog>
  <changelog author="jgonzalez@suse.com" date="1555934400">- version 4.0.7-1
- Add makefile and pylint configuration for PyLint</changelog>
  <changelog author="jgonzalez@suse.com" date="1557921600">- version 4.0.8-1
- SPEC cleanup</changelog>
  <changelog author="jgonzalez@suse.com" date="1574856000">- version 4.1.1-1
- Fix malformed XML response when data contains non-ASCII chars (bsc#1154968)
- Bump version to 4.1.0 (bsc#1154940)
- fix initialize ssl connection (bsc#1144155)
- Add SNI support for clients
- Fix bootstrapping SLE11SP4 trad client with SSL enabled (bsc#1148177)</changelog>
  <changelog author="jgonzalez@suse.com" date="1583928000">- version 4.1.2-1
- Fix building</changelog>
  <changelog author="jgonzalez@suse.com" date="1600430400">- version 4.2.1-1
- Update package version to 4.2.0</changelog>
  <changelog author="jgonzalez@suse.com" date="1613563200">- version 4.2.2-1
- change SSL implementation to python ssl for better SAN and
  hostname matching support (bsc#1181807)</changelog>
  <changelog author="jgonzalez@suse.com" date="1618574400">- version 4.2.3-1
- require missing python-backports.ssl_match_hostname on SLE 11 (bsc#1183959)</changelog>
  <changelog author="jgonzalez@suse.com" date="1626436800">- version 4.2.4-1
- Adapt the tests to the new images</changelog>
  <changelog author="jmassaguerpla@suse.de" date="1643803200">- version 4.2.5-1
  * do not build python 2 package for SLE15</changelog>
</package>
<package pkgid="96d1102f0f0fa5b48593ea566ec54462be642c0ab35404cbf2ea3c272f46307f" name="python2-rpm" arch="aarch64">
  <version epoch="0" ver="4.14.3" rel="150300.46.1"/>
  <changelog author="mls@suse.de" date="1373630400">- update to rpm-4.11.1</changelog>
  <changelog author="mls@suse.de" date="1384948800">- adapt to python-3.3, which no longer looks at XXXmodule.so</changelog>
  <changelog author="ngompa13@gmail.com" date="1508068800">- Unify rpm-python and python3-rpm into singlespec
- Switch the build to use setuptools-based build, so that
  the Python module is properly built with all its metadata</changelog>
  <changelog author="ngompa13@gmail.com" date="1508155200">- Properly quote the conditional for Obsoletes+Provides</changelog>
  <changelog author="ngompa13@gmail.com" date="1509192000">- Add a comment to note that prep and build stages come from rpm.spec</changelog>
  <changelog author="jengelh@inai.de" date="1513684800">- Update RPM groups</changelog>
  <changelog author="mls@suse.de" date="1517400000">- update to rpm-4.14.1</changelog>
  <changelog author="tchvatal@suse.com" date="1521547200">- Switch really to singlespec thus allowing us to build without
  python2-devel present in the distribution</changelog>
  <changelog author="mls@suse.de" date="1523016000">- remove rpmlint-Factory buildignore</changelog>
  <changelog author="ngompa13@gmail.com" date="1618401600">- update to rpm-4.14.3</changelog>
</package>
<package pkgid="e61e50576ec205609cff656f49e71e85fcf6b91b69aee304731ec17ca102df86" name="python2-rpm" arch="ppc64le">
  <version epoch="0" ver="4.14.3" rel="150300.46.1"/>
  <changelog author="mls@suse.de" date="1373630400">- update to rpm-4.11.1</changelog>
  <changelog author="mls@suse.de" date="1384948800">- adapt to python-3.3, which no longer looks at XXXmodule.so</changelog>
  <changelog author="ngompa13@gmail.com" date="1508068800">- Unify rpm-python and python3-rpm into singlespec
- Switch the build to use setuptools-based build, so that
  the Python module is properly built with all its metadata</changelog>
  <changelog author="ngompa13@gmail.com" date="1508155200">- Properly quote the conditional for Obsoletes+Provides</changelog>
  <changelog author="ngompa13@gmail.com" date="1509192000">- Add a comment to note that prep and build stages come from rpm.spec</changelog>
  <changelog author="jengelh@inai.de" date="1513684800">- Update RPM groups</changelog>
  <changelog author="mls@suse.de" date="1517400000">- update to rpm-4.14.1</changelog>
  <changelog author="tchvatal@suse.com" date="1521547200">- Switch really to singlespec thus allowing us to build without
  python2-devel present in the distribution</changelog>
  <changelog author="mls@suse.de" date="1523016000">- remove rpmlint-Factory buildignore</changelog>
  <changelog author="ngompa13@gmail.com" date="1618401600">- update to rpm-4.14.3</changelog>
</package>
<package pkgid="70954fd51544b3f5e38842811ec48f0d750d1919c4d2142da5fa433292120caa" name="python2-rpm" arch="s390x">
  <version epoch="0" ver="4.14.3" rel="150300.46.1"/>
  <changelog author="mls@suse.de" date="1373630400">- update to rpm-4.11.1</changelog>
  <changelog author="mls@suse.de" date="1384948800">- adapt to python-3.3, which no longer looks at XXXmodule.so</changelog>
  <changelog author="ngompa13@gmail.com" date="1508068800">- Unify rpm-python and python3-rpm into singlespec
- Switch the build to use setuptools-based build, so that
  the Python module is properly built with all its metadata</changelog>
  <changelog author="ngompa13@gmail.com" date="1508155200">- Properly quote the conditional for Obsoletes+Provides</changelog>
  <changelog author="ngompa13@gmail.com" date="1509192000">- Add a comment to note that prep and build stages come from rpm.spec</changelog>
  <changelog author="jengelh@inai.de" date="1513684800">- Update RPM groups</changelog>
  <changelog author="mls@suse.de" date="1517400000">- update to rpm-4.14.1</changelog>
  <changelog author="tchvatal@suse.com" date="1521547200">- Switch really to singlespec thus allowing us to build without
  python2-devel present in the distribution</changelog>
  <changelog author="mls@suse.de" date="1523016000">- remove rpmlint-Factory buildignore</changelog>
  <changelog author="ngompa13@gmail.com" date="1618401600">- update to rpm-4.14.3</changelog>
</package>
<package pkgid="9e05bfdef63e5d4353d9ac5f051257d43f1a72966f170ac1223842406bd53053" name="python2-rpm" arch="x86_64">
  <version epoch="0" ver="4.14.3" rel="150300.46.1"/>
  <changelog author="mls@suse.de" date="1373630400">- update to rpm-4.11.1</changelog>
  <changelog author="mls@suse.de" date="1384948800">- adapt to python-3.3, which no longer looks at XXXmodule.so</changelog>
  <changelog author="ngompa13@gmail.com" date="1508068800">- Unify rpm-python and python3-rpm into singlespec
- Switch the build to use setuptools-based build, so that
  the Python module is properly built with all its metadata</changelog>
  <changelog author="ngompa13@gmail.com" date="1508155200">- Properly quote the conditional for Obsoletes+Provides</changelog>
  <changelog author="ngompa13@gmail.com" date="1509192000">- Add a comment to note that prep and build stages come from rpm.spec</changelog>
  <changelog author="jengelh@inai.de" date="1513684800">- Update RPM groups</changelog>
  <changelog author="mls@suse.de" date="1517400000">- update to rpm-4.14.1</changelog>
  <changelog author="tchvatal@suse.com" date="1521547200">- Switch really to singlespec thus allowing us to build without
  python2-devel present in the distribution</changelog>
  <changelog author="mls@suse.de" date="1523016000">- remove rpmlint-Factory buildignore</changelog>
  <changelog author="ngompa13@gmail.com" date="1618401600">- update to rpm-4.14.3</changelog>
</package>
<package pkgid="5bc47c58218e5f9b7f3b504aeec45f072348ea078264d22625c2edcff6267b61" name="python3-configshell-fb" arch="noarch">
  <version epoch="0" ver="1.1.29" rel="3.3.1"/>
  <changelog author="lduncan@suse.com" date="1461067200">- Initial creation of this package, from upstream
  version 1.1.fb20</changelog>
  <changelog author="dmueller@suse.com" date="1462536000">- cleanup buildroot parts</changelog>
  <changelog author="lduncan@suse.com" date="1466769600">- Updated SPEC file: removed "Provides"/"Obsoletes" for
  package name "python-confishell" (bsc#984935)</changelog>
  <changelog author="lduncan@suse.com" date="1466769601">- Updated spec file: added Conflicts for python-configshell
  (bsc#986475)</changelog>
  <changelog author="shshyukriev@suse.com" date="1488196800">- Update to v 1.1.22fb
  * Fixed github source namespace</changelog>
  <changelog author="lszhu@suse.com" date="1502971200">- Update to version 1.1.23fb
  * improving ALUA and TCMU support</changelog>
  <changelog author="lduncan@suse.com" date="1512734400">- Converting RPM SPEC file to singlespec format (bsc#1045332),
  adding patch:
  * configshell-fb-example-should-not-specify-path.patch
- Fix targetcli.service problem when TERM not set (bsc#1071194),
  adding patch (from LSZhu):
  * configshell-fb-Handle-if-TERM-is-not-set.patch
- Moved build requirement on urwid to runtime requirement,
  as suggested by scarabeus_iv
- ran spec-cleaner to clean up SPEC file
- Converted from manually-added configshell-fb tar file to
  tar_scm service-generated file by adding _service and
  _servicedata</changelog>
  <changelog author="tchvatal@suse.com" date="1514980800">- Do not build epydoc documentation to allow py3 only build</changelog>
  <changelog author="olaf@aepfle.de" date="1519560000">- Fix upgrade path by provide/obsolete python-configshell (bsc#1082693)</changelog>
  <changelog author="opensuse-packaging@opensuse.org" date="1539864000">- Update to version 1.1.fb23:
  * version 1.1.25
  * Fix failing to parse param like pool/rbd;id=user
  * Acquire a lock to a preference file before working with it
  * Fix failing to pasre param like "cfgstr,par=val"
  * version 1.1.fb24
  * Remove explicit dependency on /usr/bin/python
  * make run_cmdline() log "Running command line" msg to new loglevel
  * tweak ConfigShell.run_stdin() to strip whitespace/newline from cmds
  * Fix failing to pasre par=val parameters
  * Add missing dependency on pyparsing and six
  * Fix path regex for [ and ]
  * Handle if TERM is not set
  Replacing configshell-fb-1.1.fb23.tar.xz with configshell-fb-1.1.fb25.tar.xz,
  and updating the SPEC file. Also, two patches subsumed/removed:
  * configshell-fb-example-should-not-specify-path.patch
  * configshell-fb-Handle-if-TERM-is-not-set.patch</changelog>
  <changelog author="mcepl@suse.com" date="1543924800">- Remove superfluous devel dependency for noarch package</changelog>
  <changelog author="mcepl@suse.com" date="1552046400">- Using now new proper upstream release 1.1.25:
  - Fix failing to parse param like pool/rbd;id=user
  - Acquire a lock to a preference file before working with it
  - Fix failing to pasre param like "cfgstr,par=val"
  - Remove explicit dependency on /usr/bin/python
  - make run_cmdline() log "Running command line" msg to new loglevel
  - tweak ConfigShell.run_stdin() to strip whitespace/newline from cmds
  - Fix failing to pasre par=val parameters
  - Add missing dependency on pyparsing and six
  - Fix path regex for [ and ]
  - Handle if TERM is not set</changelog>
  <changelog author="lduncan@suse.com" date="1568635200">- Updated to latest upstream version 1.1.26. There were not very
  many changes:
  * Version number no longer contains "fb" to designate "free
    branch", e.g. old was 1.1.fb25, new is 1.1.26
  * Add urwid to setup.py dependencies
  * Fix failing to parse params with additional chars
  * export __version__ variable
  resulting in replacing configshell-fb-1.1.25.tar.gz with
  configshell-fb-1.1.26.tar.gz, and corresponding SPEC-file
  updates.</changelog>
  <changelog author="lduncan@suse.com" date="1583236800">- Update to version v1.1.27 from v1.1.26 (jre#SLE-7751):
  * version 1.1.27
  * Use pyparsing's locatedExpr instead of our custom helper
  And updated the SPEC file, also adding a _service file.
  Replacing configshell-fb-1.1.26.tar.gz with
  python-configshell-fb-v1.1.27.tar.xz, and adding one
  upstrem patch:
  * Ensure-that-all-output-reaches-the-client-when-daemo.patch</changelog>
  <changelog author="lduncan@suse.com" date="1612008000">- Update to version v1.1.28 from v1.1.27 (jre#SLE-17360):
  * version 1.1.28
  * Ensure that all output reaches the client when daemonized
  * Remove Epydoc markup from command messages
  * Remove epydoc imports and epydoc calls
  Which removed the need for patch:
  * Ensure-that-all-output-reaches-the-client-when-daemo.patch</changelog>
  <changelog author="lduncan@suse.com" date="1632052800">- Upgrade to latest upstream version v1.1.29 (jre#SLE-17360):
  * setup.py: specify a version range for pyparsing
  * setup.py: lets stick to pyparsing v2.4.7
  * Don't warn if prefs file doesn't exist</changelog>
</package>
<package pkgid="00a63ed61cd90529d95e265093a5eb3d3c26d5331c984f4c1324c0625e89f60d" name="python3-python-docs-theme" arch="noarch">
  <version epoch="0" ver="2022.1" rel="150300.3.3.1"/>
  <changelog author="mcepl@suse.com" date="1560168000">- Initial packaging effort for 2018.7 version.</changelog>
  <changelog author="pgajdos@suse.com" date="1584705600">- version update to 2020.1
  * no upstream changelog found</changelog>
  <changelog author="mcepl@suse.com" date="1642593600">- Update to 2022.1:
  - Add a configuration for license URL.
  - Exclude the floating navbar from CHM help.
  - Make sidebar scrollable and sticky (on modern browsers)
  - Fix monospace again, on buggy Google Chrome
  - Add the copyright_url variable in the theme
  - Improve readability
  - Remove #searchbox on mobile to fix a layout bug
  - Fix the appearance of version/language selects
  - Make the theme responsive
  - Use default pygments theme
  - Test Github action to validate the theme against docsbuild scripts.
  - Add the copy button to pycon3 highlighted code blocks.
  - Updated the readme, to remind user to install the package in a virtual environment.
  - Updated the package url, using the GitHub repository instead of docs.python.org
  - Added license information to the footer of the doc
  - Fixed typo in the footer
  - Added information on how to use the package
  - Fixed code formatting
  - Fixed code bgcolor and codetextcolor for Sphinx 3.1.0+</changelog>
  <changelog author="mcepl@suse.com" date="1643112000">- Switch to setup.py based installation for compatibility with
  old SLE distros.</changelog>
</package>
<package pkgid="f442926b39e8cc4c81065c2f0e74aee0090da00997dcc61894b8b74d5d0449d9" name="python3-rhnlib" arch="noarch">
  <version epoch="0" ver="4.2.5" rel="3.31.1"/>
  <changelog author="jgonzalez@suse.com" date="1517572800">- version 2.8.5.3-1
- replace netstat with ss command</changelog>
  <changelog author="jgonzalez@suse.com" date="1519387200">- version 2.8.7.1-1
- Sync with upstream</changelog>
  <changelog author="jgonzalez@suse.com" date="1520251200">- version 2.8.7.2-1
- remove empty clean section from spec (bsc#1083294)</changelog>
  <changelog author="jgonzalez@suse.com" date="1522065600">- version 2.8.10.1-1
- Sync with upstream (bsc#1083294)</changelog>
  <changelog author="jgonzalez@suse.com" date="1525694400">- version 2.8.11.1-1
- Sync with upstream (bsc#1083294)</changelog>
  <changelog author="jgonzalez@suse.com" date="1533902400">- version 4.0.1-1
- Bump version to 4.0.0 (bsc#1104034)
- Fix copyright for the package specfile (bsc#1103696)</changelog>
  <changelog author="jgonzalez@suse.com" date="1540555200">- version 4.0.2-1
- use rpm for debian packaging</changelog>
  <changelog author="jgonzalez@suse.com" date="1548936000">- version 4.0.3-1
- Sync changes from Spacewalk
- 1652859 - python3 http.client does not contain _set_hostport()</changelog>
  <changelog author="jgonzalez@suse.com" date="1551268800">- version 4.0.4-1
- Fix encoding issues after porting to Python 3.</changelog>
  <changelog author="jgonzalez@suse.com" date="1551528000">- version 4.0.5-1
- Read SSL decoded buffer completely when no pending bytes on the
  underlying connection.</changelog>
  <changelog author="jgonzalez@suse.com" date="1553860800">- version 4.0.6-1
- Add group to python*-rhnlib to fix building at SLE11</changelog>
  <changelog author="jgonzalez@suse.com" date="1555934400">- version 4.0.7-1
- Add makefile and pylint configuration for PyLint</changelog>
  <changelog author="jgonzalez@suse.com" date="1557921600">- version 4.0.8-1
- SPEC cleanup</changelog>
  <changelog author="jgonzalez@suse.com" date="1574856000">- version 4.1.1-1
- Fix malformed XML response when data contains non-ASCII chars (bsc#1154968)
- Bump version to 4.1.0 (bsc#1154940)
- fix initialize ssl connection (bsc#1144155)
- Add SNI support for clients
- Fix bootstrapping SLE11SP4 trad client with SSL enabled (bsc#1148177)</changelog>
  <changelog author="jgonzalez@suse.com" date="1583928000">- version 4.1.2-1
- Fix building</changelog>
  <changelog author="jgonzalez@suse.com" date="1600430400">- version 4.2.1-1
- Update package version to 4.2.0</changelog>
  <changelog author="jgonzalez@suse.com" date="1613563200">- version 4.2.2-1
- change SSL implementation to python ssl for better SAN and
  hostname matching support (bsc#1181807)</changelog>
  <changelog author="jgonzalez@suse.com" date="1618574400">- version 4.2.3-1
- require missing python-backports.ssl_match_hostname on SLE 11 (bsc#1183959)</changelog>
  <changelog author="jgonzalez@suse.com" date="1626436800">- version 4.2.4-1
- Adapt the tests to the new images</changelog>
  <changelog author="jmassaguerpla@suse.de" date="1643803200">- version 4.2.5-1
  * do not build python 2 package for SLE15</changelog>
</package>
<package pkgid="18ac93efd59e2dd7d8cfe4091e08edba4e0d37fcc6628034a518a7efc2783580" name="qemu" arch="src">
  <version epoch="0" ver="4.2.1" rel="11.34.2"/>
  <changelog author="lma@suse.com" date="1622721600">- Fix qemu hang while cancelling migrating hugepage vm (bsc#1185591)
  * Patches added:
  migration-migration.c-Fix-hang-in-ram_sa.patch</changelog>
  <changelog author="jose.ziviani@suse.com" date="1623067200">- Fix out-of-bounds write in virgl_cmd_get_capset
  CVE-2021-3546 bsc#1185981
  vhost-user-gpu-abstract-vg_cleanup_mappi.patch
- Fix memory leaks found in the virtio vhost-user GPU device
  CVE-2021-3544 bsc#1186010
  vhost-user-gpu-fix-leak-in-virgl_cmd_res.patch
  vhost-user-gpu-fix-leak-in-virgl_resourc.patch
  vhost-user-gpu-fix-memory-disclosure-in-.patch
  vhost-user-gpu-fix-memory-leak-in-vg_res.patch
  vhost-user-gpu-fix-memory-leak-while-cal.patch
  vhost-user-gpu-fix-OOB-write-in-virgl_cm.patch
- Fix information disclosure due to uninitialized memory read
  CVE-2021-3545 bsc#1185990
  vhost-user-gpu-fix-resource-leak-in-vg_r.patch</changelog>
  <changelog author="lma@suse.com" date="1623326400">- Fix qemu crash with iothread when block commit after snapshot (bsc#1187013)
  * Patches added:
  blockjob-Fix-crash-with-IOthread-when-bl.patch</changelog>
  <changelog author="lma@suse.com" date="1624276800">- Fix testsuite error (bsc#1184574)
  * Patches added:
  device-plug-test-use-qtest_qmp-to-send-t.patch
  qemu-iotests-qtest-rewrite-test-067-as-a.patch
  qtest-check-that-drives-are-really-appea.patch
  qtest-Reintroduce-qtest_qmp_receive-with.patch
  qtest-remove-qtest_qmp_receive_success.patch
  qtest-rename-qtest_qmp_receive-to-qtest_.patch
  qtest-switch-users-back-to-qtest_qmp_rec.patch
  tests-add-migration-helpers-unit.patch</changelog>
  <changelog author="acho@suse.com" date="1625486400">* Fix intel-hda segmentation fault due to stack overflow
  (bsc#1187529)
  qom-code-hardening-have-bound-checking-w.patch</changelog>
  <changelog author="jose.ziviani@suse.com" date="1625486401">- Fix possible mremap overflow in the pvrdma
  (CVE-2021-3582, bsc#1187499)
  hw-rdma-Fix-possible-mremap-overflow-in-.patch
- Ensure correct input on ring init
  (CVE-2021-3607, bsc#1187539)
  pvrdma-Ensure-correct-input-on-ring-init.patch
- Fix the ring init error flow
  (CVE-2021-3608, bsc#1187538)
  pvrdma-Fix-the-ring-init-error-flow-CVE-.patch</changelog>
  <changelog author="jose.ziviani@suse.com" date="1625659200">- Fix for bsc#1187364, CVE-2021-3592 and
  Fix for bsc#1187367, CVE-2021-3594 and
  Fix for bsc#1187365, CVE-2021-3593 and
  Fix for bsc#1187366, CVE-2021-3595
  Add-mtod_check.patch
  bootp-check-bootp_input-buffer-size.patch
  bootp-limit-vendor-specific-area-to-inpu.patch
  dhcp-Always-send-DHCP_OPT_LEN-bytes-in-o.patch
  tftp-check-tftp_input-buffer-size.patch
  tftp-introduce-a-header-structure.patch
  udp-check-upd_input-buffer-size.patch
  upd6-check-udp6_input-buffer-size.patch</changelog>
  <changelog author="jose.ziviani@suse.com" date="1627646400">- NULL pointer dereference in ESP
  (bsc#1180433, CVE-2020-35504)
  (bsc#1180434, CVE-2020-35505)
  (bsc#1180435, CVE-2020-35506)
  esp-always-check-current_req-is-not-NULL.patch
  esp-don-t-reset-async_len-directly-in-es.patch
  esp-ensure-cmdfifo-is-not-empty-and-curr.patch
  esp-ensure-that-do_cmd-is-set-to-zero-be.patch
- NULL pointer dereference issue in megasas-gen2 host bus adapter
  (bsc#1180432, CVE-2020-35503)
  hw-scsi-megasas-check-for-NULL-frame-in-.patch
- eepro100: stack overflow via infinite recursion
  (bsc#1182651, CVE-2021-20255)
  net-eepro100-validate-various-address-va.patch
- usb: unbounded stack allocation in usbredir
  (bsc#1186012, CVE-2021-3527)
  hw-usb-host-stub-Remove-unused-header.patch
  usb-hid-avoid-dynamic-stack-allocation.patch
  usb-limit-combined-packets-to-1-MiB-CVE-.patch
  usb-mtp-avoid-dynamic-stack-allocation.patch
  usb-redir-avoid-dynamic-stack-allocation.patch</changelog>
  <changelog author="jose.ziviani@suse.com" date="1628251200">- usbredir: free call on invalid pointer in bufp_alloc
  (bsc#1189145, CVE-2021-3682)
  usbredir-fix-free-call.patch</changelog>
  <changelog author="lma@suse.com" date="1630670400">- Fix qemu crash while deleting xen-block (bsc#1189234)
  * Patches added:
  xen-remove-BlockBackend-object-reference.patch</changelog>
  <changelog author="lma@suse.com" date="1631620800">- Add transfer length item in block limits page of scsi vpd (bsc#1190425)
  * Patches added:
  block-add-max_hw_transfer-to-BlockLimits.patch
  block-backend-align-max_transfer-to-requ.patch
  file-posix-fix-max_iov-for-dev-sg-device.patch
  file-posix-try-BLKSECTGET-on-block-devic.patch
  osdep-provide-ROUND_DOWN-macro.patch
  scsi-generic-pass-max_segments-via-max_i.patch</changelog>
  <changelog author="jose.ziviani@suse.com" date="1633003200">- Fix out-of-bounds write in UAS (USB Attached SCSI) device emulation
  (bsc#1189702, CVE-2021-3713)
  uas-add-stream-number-sanity-checks.patch
- Fix heap use-after-free in virtio_net_receive_rcu
  (bsc#1189938, CVE-2021-3748)
  virtio-net-fix-use-after-unmap-free-for-.patch</changelog>
  <changelog author="lma@suse.com" date="1634558400">- Fix qemu guest agent assert (bsc#1191699)
  * Patches added:
  qga-fix-assert-regression-on-guest-shutd.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1637928000">- update_git.sh: make sure special directories are defined and created
  before they're used</changelog>
  <changelog author="dfaggioli@suse.com" date="1638360000">* Un-break the main package build
  * Patches added:
  build-no-pie-is-no-functional-linker-fla.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1638360001">* Un-break the seabios build
  * Patches added:
  ldnoexec-Add-script-to-remove-ET_EXEC-fl.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1638878400">* Un-break seabios build on aarch64
  * Patches added:
  vgasrc-ignore-.node.gnu.property-binutil.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1640260800">- Amend .changes file: avoid declaring a still unfixed CVE, as
  fixed (bsc#1187529)</changelog>
  <changelog author="dfaggioli@suse.com" date="1640260801">- Fix "block/fdc: null pointer dereference may lead to guest crash"
  (CVE 2021-20196, bsc#1181361)
  * Patches added:
    hw-block-fdc-Kludge-missing-floppy-drive.patch
    hw-block-fdc-Extract-blk_create_empty_dr.patch</changelog>
  <changelog author="lyan@suse.com" date="1641297600">- Fix the the OOB access of sd could crash the guest resulting in DoS
  (CVE-2020-13253, bsc#1172033)
  hw-sd-sdcard-Do-not-switch-to-ReceivingD.patch
  hw-sd-sdcard-Update-coding-style-to-make.patch</changelog>
</package>
<package pkgid="0ec9d2e7fa55361d24d8cfe9028439fc61345733f11a40da96b3df466a36cb6d" name="qemu-s390" arch="aarch64">
  <version epoch="0" ver="4.2.1" rel="11.34.2"/>
  <changelog author="lma@suse.com" date="1622721600">- Fix qemu hang while cancelling migrating hugepage vm (bsc#1185591)
  * Patches added:
  migration-migration.c-Fix-hang-in-ram_sa.patch</changelog>
  <changelog author="jose.ziviani@suse.com" date="1623067200">- Fix out-of-bounds write in virgl_cmd_get_capset
  CVE-2021-3546 bsc#1185981
  vhost-user-gpu-abstract-vg_cleanup_mappi.patch
- Fix memory leaks found in the virtio vhost-user GPU device
  CVE-2021-3544 bsc#1186010
  vhost-user-gpu-fix-leak-in-virgl_cmd_res.patch
  vhost-user-gpu-fix-leak-in-virgl_resourc.patch
  vhost-user-gpu-fix-memory-disclosure-in-.patch
  vhost-user-gpu-fix-memory-leak-in-vg_res.patch
  vhost-user-gpu-fix-memory-leak-while-cal.patch
  vhost-user-gpu-fix-OOB-write-in-virgl_cm.patch
- Fix information disclosure due to uninitialized memory read
  CVE-2021-3545 bsc#1185990
  vhost-user-gpu-fix-resource-leak-in-vg_r.patch</changelog>
  <changelog author="lma@suse.com" date="1623326400">- Fix qemu crash with iothread when block commit after snapshot (bsc#1187013)
  * Patches added:
  blockjob-Fix-crash-with-IOthread-when-bl.patch</changelog>
  <changelog author="lma@suse.com" date="1624276800">- Fix testsuite error (bsc#1184574)
  * Patches added:
  device-plug-test-use-qtest_qmp-to-send-t.patch
  qemu-iotests-qtest-rewrite-test-067-as-a.patch
  qtest-check-that-drives-are-really-appea.patch
  qtest-Reintroduce-qtest_qmp_receive-with.patch
  qtest-remove-qtest_qmp_receive_success.patch
  qtest-rename-qtest_qmp_receive-to-qtest_.patch
  qtest-switch-users-back-to-qtest_qmp_rec.patch
  tests-add-migration-helpers-unit.patch</changelog>
  <changelog author="acho@suse.com" date="1625486400">* Fix intel-hda segmentation fault due to stack overflow
  (bsc#1187529)
  qom-code-hardening-have-bound-checking-w.patch</changelog>
  <changelog author="jose.ziviani@suse.com" date="1625486401">- Fix possible mremap overflow in the pvrdma
  (CVE-2021-3582, bsc#1187499)
  hw-rdma-Fix-possible-mremap-overflow-in-.patch
- Ensure correct input on ring init
  (CVE-2021-3607, bsc#1187539)
  pvrdma-Ensure-correct-input-on-ring-init.patch
- Fix the ring init error flow
  (CVE-2021-3608, bsc#1187538)
  pvrdma-Fix-the-ring-init-error-flow-CVE-.patch</changelog>
  <changelog author="jose.ziviani@suse.com" date="1625659200">- Fix for bsc#1187364, CVE-2021-3592 and
  Fix for bsc#1187367, CVE-2021-3594 and
  Fix for bsc#1187365, CVE-2021-3593 and
  Fix for bsc#1187366, CVE-2021-3595
  Add-mtod_check.patch
  bootp-check-bootp_input-buffer-size.patch
  bootp-limit-vendor-specific-area-to-inpu.patch
  dhcp-Always-send-DHCP_OPT_LEN-bytes-in-o.patch
  tftp-check-tftp_input-buffer-size.patch
  tftp-introduce-a-header-structure.patch
  udp-check-upd_input-buffer-size.patch
  upd6-check-udp6_input-buffer-size.patch</changelog>
  <changelog author="jose.ziviani@suse.com" date="1627646400">- NULL pointer dereference in ESP
  (bsc#1180433, CVE-2020-35504)
  (bsc#1180434, CVE-2020-35505)
  (bsc#1180435, CVE-2020-35506)
  esp-always-check-current_req-is-not-NULL.patch
  esp-don-t-reset-async_len-directly-in-es.patch
  esp-ensure-cmdfifo-is-not-empty-and-curr.patch
  esp-ensure-that-do_cmd-is-set-to-zero-be.patch
- NULL pointer dereference issue in megasas-gen2 host bus adapter
  (bsc#1180432, CVE-2020-35503)
  hw-scsi-megasas-check-for-NULL-frame-in-.patch
- eepro100: stack overflow via infinite recursion
  (bsc#1182651, CVE-2021-20255)
  net-eepro100-validate-various-address-va.patch
- usb: unbounded stack allocation in usbredir
  (bsc#1186012, CVE-2021-3527)
  hw-usb-host-stub-Remove-unused-header.patch
  usb-hid-avoid-dynamic-stack-allocation.patch
  usb-limit-combined-packets-to-1-MiB-CVE-.patch
  usb-mtp-avoid-dynamic-stack-allocation.patch
  usb-redir-avoid-dynamic-stack-allocation.patch</changelog>
  <changelog author="jose.ziviani@suse.com" date="1628251200">- usbredir: free call on invalid pointer in bufp_alloc
  (bsc#1189145, CVE-2021-3682)
  usbredir-fix-free-call.patch</changelog>
  <changelog author="lma@suse.com" date="1630670400">- Fix qemu crash while deleting xen-block (bsc#1189234)
  * Patches added:
  xen-remove-BlockBackend-object-reference.patch</changelog>
  <changelog author="lma@suse.com" date="1631620800">- Add transfer length item in block limits page of scsi vpd (bsc#1190425)
  * Patches added:
  block-add-max_hw_transfer-to-BlockLimits.patch
  block-backend-align-max_transfer-to-requ.patch
  file-posix-fix-max_iov-for-dev-sg-device.patch
  file-posix-try-BLKSECTGET-on-block-devic.patch
  osdep-provide-ROUND_DOWN-macro.patch
  scsi-generic-pass-max_segments-via-max_i.patch</changelog>
  <changelog author="jose.ziviani@suse.com" date="1633003200">- Fix out-of-bounds write in UAS (USB Attached SCSI) device emulation
  (bsc#1189702, CVE-2021-3713)
  uas-add-stream-number-sanity-checks.patch
- Fix heap use-after-free in virtio_net_receive_rcu
  (bsc#1189938, CVE-2021-3748)
  virtio-net-fix-use-after-unmap-free-for-.patch</changelog>
  <changelog author="lma@suse.com" date="1634558400">- Fix qemu guest agent assert (bsc#1191699)
  * Patches added:
  qga-fix-assert-regression-on-guest-shutd.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1637928000">- update_git.sh: make sure special directories are defined and created
  before they're used</changelog>
  <changelog author="dfaggioli@suse.com" date="1638360000">* Un-break the main package build
  * Patches added:
  build-no-pie-is-no-functional-linker-fla.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1638360001">* Un-break the seabios build
  * Patches added:
  ldnoexec-Add-script-to-remove-ET_EXEC-fl.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1638878400">* Un-break seabios build on aarch64
  * Patches added:
  vgasrc-ignore-.node.gnu.property-binutil.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1640260800">- Amend .changes file: avoid declaring a still unfixed CVE, as
  fixed (bsc#1187529)</changelog>
  <changelog author="dfaggioli@suse.com" date="1640260801">- Fix "block/fdc: null pointer dereference may lead to guest crash"
  (CVE 2021-20196, bsc#1181361)
  * Patches added:
    hw-block-fdc-Kludge-missing-floppy-drive.patch
    hw-block-fdc-Extract-blk_create_empty_dr.patch</changelog>
  <changelog author="lyan@suse.com" date="1641297600">- Fix the the OOB access of sd could crash the guest resulting in DoS
  (CVE-2020-13253, bsc#1172033)
  hw-sd-sdcard-Do-not-switch-to-ReceivingD.patch
  hw-sd-sdcard-Update-coding-style-to-make.patch</changelog>
</package>
<package pkgid="319a4bd8fae8aea3a81451824927feb0051635139add16e403d7abab06d37110" name="qemu-s390" arch="ppc64le">
  <version epoch="0" ver="4.2.1" rel="11.34.2"/>
  <changelog author="lma@suse.com" date="1622721600">- Fix qemu hang while cancelling migrating hugepage vm (bsc#1185591)
  * Patches added:
  migration-migration.c-Fix-hang-in-ram_sa.patch</changelog>
  <changelog author="jose.ziviani@suse.com" date="1623067200">- Fix out-of-bounds write in virgl_cmd_get_capset
  CVE-2021-3546 bsc#1185981
  vhost-user-gpu-abstract-vg_cleanup_mappi.patch
- Fix memory leaks found in the virtio vhost-user GPU device
  CVE-2021-3544 bsc#1186010
  vhost-user-gpu-fix-leak-in-virgl_cmd_res.patch
  vhost-user-gpu-fix-leak-in-virgl_resourc.patch
  vhost-user-gpu-fix-memory-disclosure-in-.patch
  vhost-user-gpu-fix-memory-leak-in-vg_res.patch
  vhost-user-gpu-fix-memory-leak-while-cal.patch
  vhost-user-gpu-fix-OOB-write-in-virgl_cm.patch
- Fix information disclosure due to uninitialized memory read
  CVE-2021-3545 bsc#1185990
  vhost-user-gpu-fix-resource-leak-in-vg_r.patch</changelog>
  <changelog author="lma@suse.com" date="1623326400">- Fix qemu crash with iothread when block commit after snapshot (bsc#1187013)
  * Patches added:
  blockjob-Fix-crash-with-IOthread-when-bl.patch</changelog>
  <changelog author="lma@suse.com" date="1624276800">- Fix testsuite error (bsc#1184574)
  * Patches added:
  device-plug-test-use-qtest_qmp-to-send-t.patch
  qemu-iotests-qtest-rewrite-test-067-as-a.patch
  qtest-check-that-drives-are-really-appea.patch
  qtest-Reintroduce-qtest_qmp_receive-with.patch
  qtest-remove-qtest_qmp_receive_success.patch
  qtest-rename-qtest_qmp_receive-to-qtest_.patch
  qtest-switch-users-back-to-qtest_qmp_rec.patch
  tests-add-migration-helpers-unit.patch</changelog>
  <changelog author="acho@suse.com" date="1625486400">* Fix intel-hda segmentation fault due to stack overflow
  (bsc#1187529)
  qom-code-hardening-have-bound-checking-w.patch</changelog>
  <changelog author="jose.ziviani@suse.com" date="1625486401">- Fix possible mremap overflow in the pvrdma
  (CVE-2021-3582, bsc#1187499)
  hw-rdma-Fix-possible-mremap-overflow-in-.patch
- Ensure correct input on ring init
  (CVE-2021-3607, bsc#1187539)
  pvrdma-Ensure-correct-input-on-ring-init.patch
- Fix the ring init error flow
  (CVE-2021-3608, bsc#1187538)
  pvrdma-Fix-the-ring-init-error-flow-CVE-.patch</changelog>
  <changelog author="jose.ziviani@suse.com" date="1625659200">- Fix for bsc#1187364, CVE-2021-3592 and
  Fix for bsc#1187367, CVE-2021-3594 and
  Fix for bsc#1187365, CVE-2021-3593 and
  Fix for bsc#1187366, CVE-2021-3595
  Add-mtod_check.patch
  bootp-check-bootp_input-buffer-size.patch
  bootp-limit-vendor-specific-area-to-inpu.patch
  dhcp-Always-send-DHCP_OPT_LEN-bytes-in-o.patch
  tftp-check-tftp_input-buffer-size.patch
  tftp-introduce-a-header-structure.patch
  udp-check-upd_input-buffer-size.patch
  upd6-check-udp6_input-buffer-size.patch</changelog>
  <changelog author="jose.ziviani@suse.com" date="1627646400">- NULL pointer dereference in ESP
  (bsc#1180433, CVE-2020-35504)
  (bsc#1180434, CVE-2020-35505)
  (bsc#1180435, CVE-2020-35506)
  esp-always-check-current_req-is-not-NULL.patch
  esp-don-t-reset-async_len-directly-in-es.patch
  esp-ensure-cmdfifo-is-not-empty-and-curr.patch
  esp-ensure-that-do_cmd-is-set-to-zero-be.patch
- NULL pointer dereference issue in megasas-gen2 host bus adapter
  (bsc#1180432, CVE-2020-35503)
  hw-scsi-megasas-check-for-NULL-frame-in-.patch
- eepro100: stack overflow via infinite recursion
  (bsc#1182651, CVE-2021-20255)
  net-eepro100-validate-various-address-va.patch
- usb: unbounded stack allocation in usbredir
  (bsc#1186012, CVE-2021-3527)
  hw-usb-host-stub-Remove-unused-header.patch
  usb-hid-avoid-dynamic-stack-allocation.patch
  usb-limit-combined-packets-to-1-MiB-CVE-.patch
  usb-mtp-avoid-dynamic-stack-allocation.patch
  usb-redir-avoid-dynamic-stack-allocation.patch</changelog>
  <changelog author="jose.ziviani@suse.com" date="1628251200">- usbredir: free call on invalid pointer in bufp_alloc
  (bsc#1189145, CVE-2021-3682)
  usbredir-fix-free-call.patch</changelog>
  <changelog author="lma@suse.com" date="1630670400">- Fix qemu crash while deleting xen-block (bsc#1189234)
  * Patches added:
  xen-remove-BlockBackend-object-reference.patch</changelog>
  <changelog author="lma@suse.com" date="1631620800">- Add transfer length item in block limits page of scsi vpd (bsc#1190425)
  * Patches added:
  block-add-max_hw_transfer-to-BlockLimits.patch
  block-backend-align-max_transfer-to-requ.patch
  file-posix-fix-max_iov-for-dev-sg-device.patch
  file-posix-try-BLKSECTGET-on-block-devic.patch
  osdep-provide-ROUND_DOWN-macro.patch
  scsi-generic-pass-max_segments-via-max_i.patch</changelog>
  <changelog author="jose.ziviani@suse.com" date="1633003200">- Fix out-of-bounds write in UAS (USB Attached SCSI) device emulation
  (bsc#1189702, CVE-2021-3713)
  uas-add-stream-number-sanity-checks.patch
- Fix heap use-after-free in virtio_net_receive_rcu
  (bsc#1189938, CVE-2021-3748)
  virtio-net-fix-use-after-unmap-free-for-.patch</changelog>
  <changelog author="lma@suse.com" date="1634558400">- Fix qemu guest agent assert (bsc#1191699)
  * Patches added:
  qga-fix-assert-regression-on-guest-shutd.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1637928000">- update_git.sh: make sure special directories are defined and created
  before they're used</changelog>
  <changelog author="dfaggioli@suse.com" date="1638360000">* Un-break the main package build
  * Patches added:
  build-no-pie-is-no-functional-linker-fla.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1638360001">* Un-break the seabios build
  * Patches added:
  ldnoexec-Add-script-to-remove-ET_EXEC-fl.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1638878400">* Un-break seabios build on aarch64
  * Patches added:
  vgasrc-ignore-.node.gnu.property-binutil.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1640260800">- Amend .changes file: avoid declaring a still unfixed CVE, as
  fixed (bsc#1187529)</changelog>
  <changelog author="dfaggioli@suse.com" date="1640260801">- Fix "block/fdc: null pointer dereference may lead to guest crash"
  (CVE 2021-20196, bsc#1181361)
  * Patches added:
    hw-block-fdc-Kludge-missing-floppy-drive.patch
    hw-block-fdc-Extract-blk_create_empty_dr.patch</changelog>
  <changelog author="lyan@suse.com" date="1641297600">- Fix the the OOB access of sd could crash the guest resulting in DoS
  (CVE-2020-13253, bsc#1172033)
  hw-sd-sdcard-Do-not-switch-to-ReceivingD.patch
  hw-sd-sdcard-Update-coding-style-to-make.patch</changelog>
</package>
<package pkgid="b04e70a917d7acbe5010b0995ecf449b174220854ff724616b0e558096899aa0" name="qemu-s390" arch="s390x">
  <version epoch="0" ver="4.2.1" rel="11.34.2"/>
  <changelog author="lma@suse.com" date="1622721600">- Fix qemu hang while cancelling migrating hugepage vm (bsc#1185591)
  * Patches added:
  migration-migration.c-Fix-hang-in-ram_sa.patch</changelog>
  <changelog author="jose.ziviani@suse.com" date="1623067200">- Fix out-of-bounds write in virgl_cmd_get_capset
  CVE-2021-3546 bsc#1185981
  vhost-user-gpu-abstract-vg_cleanup_mappi.patch
- Fix memory leaks found in the virtio vhost-user GPU device
  CVE-2021-3544 bsc#1186010
  vhost-user-gpu-fix-leak-in-virgl_cmd_res.patch
  vhost-user-gpu-fix-leak-in-virgl_resourc.patch
  vhost-user-gpu-fix-memory-disclosure-in-.patch
  vhost-user-gpu-fix-memory-leak-in-vg_res.patch
  vhost-user-gpu-fix-memory-leak-while-cal.patch
  vhost-user-gpu-fix-OOB-write-in-virgl_cm.patch
- Fix information disclosure due to uninitialized memory read
  CVE-2021-3545 bsc#1185990
  vhost-user-gpu-fix-resource-leak-in-vg_r.patch</changelog>
  <changelog author="lma@suse.com" date="1623326400">- Fix qemu crash with iothread when block commit after snapshot (bsc#1187013)
  * Patches added:
  blockjob-Fix-crash-with-IOthread-when-bl.patch</changelog>
  <changelog author="lma@suse.com" date="1624276800">- Fix testsuite error (bsc#1184574)
  * Patches added:
  device-plug-test-use-qtest_qmp-to-send-t.patch
  qemu-iotests-qtest-rewrite-test-067-as-a.patch
  qtest-check-that-drives-are-really-appea.patch
  qtest-Reintroduce-qtest_qmp_receive-with.patch
  qtest-remove-qtest_qmp_receive_success.patch
  qtest-rename-qtest_qmp_receive-to-qtest_.patch
  qtest-switch-users-back-to-qtest_qmp_rec.patch
  tests-add-migration-helpers-unit.patch</changelog>
  <changelog author="acho@suse.com" date="1625486400">* Fix intel-hda segmentation fault due to stack overflow
  (bsc#1187529)
  qom-code-hardening-have-bound-checking-w.patch</changelog>
  <changelog author="jose.ziviani@suse.com" date="1625486401">- Fix possible mremap overflow in the pvrdma
  (CVE-2021-3582, bsc#1187499)
  hw-rdma-Fix-possible-mremap-overflow-in-.patch
- Ensure correct input on ring init
  (CVE-2021-3607, bsc#1187539)
  pvrdma-Ensure-correct-input-on-ring-init.patch
- Fix the ring init error flow
  (CVE-2021-3608, bsc#1187538)
  pvrdma-Fix-the-ring-init-error-flow-CVE-.patch</changelog>
  <changelog author="jose.ziviani@suse.com" date="1625659200">- Fix for bsc#1187364, CVE-2021-3592 and
  Fix for bsc#1187367, CVE-2021-3594 and
  Fix for bsc#1187365, CVE-2021-3593 and
  Fix for bsc#1187366, CVE-2021-3595
  Add-mtod_check.patch
  bootp-check-bootp_input-buffer-size.patch
  bootp-limit-vendor-specific-area-to-inpu.patch
  dhcp-Always-send-DHCP_OPT_LEN-bytes-in-o.patch
  tftp-check-tftp_input-buffer-size.patch
  tftp-introduce-a-header-structure.patch
  udp-check-upd_input-buffer-size.patch
  upd6-check-udp6_input-buffer-size.patch</changelog>
  <changelog author="jose.ziviani@suse.com" date="1627646400">- NULL pointer dereference in ESP
  (bsc#1180433, CVE-2020-35504)
  (bsc#1180434, CVE-2020-35505)
  (bsc#1180435, CVE-2020-35506)
  esp-always-check-current_req-is-not-NULL.patch
  esp-don-t-reset-async_len-directly-in-es.patch
  esp-ensure-cmdfifo-is-not-empty-and-curr.patch
  esp-ensure-that-do_cmd-is-set-to-zero-be.patch
- NULL pointer dereference issue in megasas-gen2 host bus adapter
  (bsc#1180432, CVE-2020-35503)
  hw-scsi-megasas-check-for-NULL-frame-in-.patch
- eepro100: stack overflow via infinite recursion
  (bsc#1182651, CVE-2021-20255)
  net-eepro100-validate-various-address-va.patch
- usb: unbounded stack allocation in usbredir
  (bsc#1186012, CVE-2021-3527)
  hw-usb-host-stub-Remove-unused-header.patch
  usb-hid-avoid-dynamic-stack-allocation.patch
  usb-limit-combined-packets-to-1-MiB-CVE-.patch
  usb-mtp-avoid-dynamic-stack-allocation.patch
  usb-redir-avoid-dynamic-stack-allocation.patch</changelog>
  <changelog author="jose.ziviani@suse.com" date="1628251200">- usbredir: free call on invalid pointer in bufp_alloc
  (bsc#1189145, CVE-2021-3682)
  usbredir-fix-free-call.patch</changelog>
  <changelog author="lma@suse.com" date="1630670400">- Fix qemu crash while deleting xen-block (bsc#1189234)
  * Patches added:
  xen-remove-BlockBackend-object-reference.patch</changelog>
  <changelog author="lma@suse.com" date="1631620800">- Add transfer length item in block limits page of scsi vpd (bsc#1190425)
  * Patches added:
  block-add-max_hw_transfer-to-BlockLimits.patch
  block-backend-align-max_transfer-to-requ.patch
  file-posix-fix-max_iov-for-dev-sg-device.patch
  file-posix-try-BLKSECTGET-on-block-devic.patch
  osdep-provide-ROUND_DOWN-macro.patch
  scsi-generic-pass-max_segments-via-max_i.patch</changelog>
  <changelog author="jose.ziviani@suse.com" date="1633003200">- Fix out-of-bounds write in UAS (USB Attached SCSI) device emulation
  (bsc#1189702, CVE-2021-3713)
  uas-add-stream-number-sanity-checks.patch
- Fix heap use-after-free in virtio_net_receive_rcu
  (bsc#1189938, CVE-2021-3748)
  virtio-net-fix-use-after-unmap-free-for-.patch</changelog>
  <changelog author="lma@suse.com" date="1634558400">- Fix qemu guest agent assert (bsc#1191699)
  * Patches added:
  qga-fix-assert-regression-on-guest-shutd.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1637928000">- update_git.sh: make sure special directories are defined and created
  before they're used</changelog>
  <changelog author="dfaggioli@suse.com" date="1638360000">* Un-break the main package build
  * Patches added:
  build-no-pie-is-no-functional-linker-fla.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1638360001">* Un-break the seabios build
  * Patches added:
  ldnoexec-Add-script-to-remove-ET_EXEC-fl.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1638878400">* Un-break seabios build on aarch64
  * Patches added:
  vgasrc-ignore-.node.gnu.property-binutil.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1640260800">- Amend .changes file: avoid declaring a still unfixed CVE, as
  fixed (bsc#1187529)</changelog>
  <changelog author="dfaggioli@suse.com" date="1640260801">- Fix "block/fdc: null pointer dereference may lead to guest crash"
  (CVE 2021-20196, bsc#1181361)
  * Patches added:
    hw-block-fdc-Kludge-missing-floppy-drive.patch
    hw-block-fdc-Extract-blk_create_empty_dr.patch</changelog>
  <changelog author="lyan@suse.com" date="1641297600">- Fix the the OOB access of sd could crash the guest resulting in DoS
  (CVE-2020-13253, bsc#1172033)
  hw-sd-sdcard-Do-not-switch-to-ReceivingD.patch
  hw-sd-sdcard-Update-coding-style-to-make.patch</changelog>
</package>
<package pkgid="58f1d91b8a6ce2bac365c409a663851a5d5717d234c81e5ece71e29cbbb9ccdd" name="qemu-s390" arch="x86_64">
  <version epoch="0" ver="4.2.1" rel="11.34.2"/>
  <changelog author="lma@suse.com" date="1622721600">- Fix qemu hang while cancelling migrating hugepage vm (bsc#1185591)
  * Patches added:
  migration-migration.c-Fix-hang-in-ram_sa.patch</changelog>
  <changelog author="jose.ziviani@suse.com" date="1623067200">- Fix out-of-bounds write in virgl_cmd_get_capset
  CVE-2021-3546 bsc#1185981
  vhost-user-gpu-abstract-vg_cleanup_mappi.patch
- Fix memory leaks found in the virtio vhost-user GPU device
  CVE-2021-3544 bsc#1186010
  vhost-user-gpu-fix-leak-in-virgl_cmd_res.patch
  vhost-user-gpu-fix-leak-in-virgl_resourc.patch
  vhost-user-gpu-fix-memory-disclosure-in-.patch
  vhost-user-gpu-fix-memory-leak-in-vg_res.patch
  vhost-user-gpu-fix-memory-leak-while-cal.patch
  vhost-user-gpu-fix-OOB-write-in-virgl_cm.patch
- Fix information disclosure due to uninitialized memory read
  CVE-2021-3545 bsc#1185990
  vhost-user-gpu-fix-resource-leak-in-vg_r.patch</changelog>
  <changelog author="lma@suse.com" date="1623326400">- Fix qemu crash with iothread when block commit after snapshot (bsc#1187013)
  * Patches added:
  blockjob-Fix-crash-with-IOthread-when-bl.patch</changelog>
  <changelog author="lma@suse.com" date="1624276800">- Fix testsuite error (bsc#1184574)
  * Patches added:
  device-plug-test-use-qtest_qmp-to-send-t.patch
  qemu-iotests-qtest-rewrite-test-067-as-a.patch
  qtest-check-that-drives-are-really-appea.patch
  qtest-Reintroduce-qtest_qmp_receive-with.patch
  qtest-remove-qtest_qmp_receive_success.patch
  qtest-rename-qtest_qmp_receive-to-qtest_.patch
  qtest-switch-users-back-to-qtest_qmp_rec.patch
  tests-add-migration-helpers-unit.patch</changelog>
  <changelog author="acho@suse.com" date="1625486400">* Fix intel-hda segmentation fault due to stack overflow
  (bsc#1187529)
  qom-code-hardening-have-bound-checking-w.patch</changelog>
  <changelog author="jose.ziviani@suse.com" date="1625486401">- Fix possible mremap overflow in the pvrdma
  (CVE-2021-3582, bsc#1187499)
  hw-rdma-Fix-possible-mremap-overflow-in-.patch
- Ensure correct input on ring init
  (CVE-2021-3607, bsc#1187539)
  pvrdma-Ensure-correct-input-on-ring-init.patch
- Fix the ring init error flow
  (CVE-2021-3608, bsc#1187538)
  pvrdma-Fix-the-ring-init-error-flow-CVE-.patch</changelog>
  <changelog author="jose.ziviani@suse.com" date="1625659200">- Fix for bsc#1187364, CVE-2021-3592 and
  Fix for bsc#1187367, CVE-2021-3594 and
  Fix for bsc#1187365, CVE-2021-3593 and
  Fix for bsc#1187366, CVE-2021-3595
  Add-mtod_check.patch
  bootp-check-bootp_input-buffer-size.patch
  bootp-limit-vendor-specific-area-to-inpu.patch
  dhcp-Always-send-DHCP_OPT_LEN-bytes-in-o.patch
  tftp-check-tftp_input-buffer-size.patch
  tftp-introduce-a-header-structure.patch
  udp-check-upd_input-buffer-size.patch
  upd6-check-udp6_input-buffer-size.patch</changelog>
  <changelog author="jose.ziviani@suse.com" date="1627646400">- NULL pointer dereference in ESP
  (bsc#1180433, CVE-2020-35504)
  (bsc#1180434, CVE-2020-35505)
  (bsc#1180435, CVE-2020-35506)
  esp-always-check-current_req-is-not-NULL.patch
  esp-don-t-reset-async_len-directly-in-es.patch
  esp-ensure-cmdfifo-is-not-empty-and-curr.patch
  esp-ensure-that-do_cmd-is-set-to-zero-be.patch
- NULL pointer dereference issue in megasas-gen2 host bus adapter
  (bsc#1180432, CVE-2020-35503)
  hw-scsi-megasas-check-for-NULL-frame-in-.patch
- eepro100: stack overflow via infinite recursion
  (bsc#1182651, CVE-2021-20255)
  net-eepro100-validate-various-address-va.patch
- usb: unbounded stack allocation in usbredir
  (bsc#1186012, CVE-2021-3527)
  hw-usb-host-stub-Remove-unused-header.patch
  usb-hid-avoid-dynamic-stack-allocation.patch
  usb-limit-combined-packets-to-1-MiB-CVE-.patch
  usb-mtp-avoid-dynamic-stack-allocation.patch
  usb-redir-avoid-dynamic-stack-allocation.patch</changelog>
  <changelog author="jose.ziviani@suse.com" date="1628251200">- usbredir: free call on invalid pointer in bufp_alloc
  (bsc#1189145, CVE-2021-3682)
  usbredir-fix-free-call.patch</changelog>
  <changelog author="lma@suse.com" date="1630670400">- Fix qemu crash while deleting xen-block (bsc#1189234)
  * Patches added:
  xen-remove-BlockBackend-object-reference.patch</changelog>
  <changelog author="lma@suse.com" date="1631620800">- Add transfer length item in block limits page of scsi vpd (bsc#1190425)
  * Patches added:
  block-add-max_hw_transfer-to-BlockLimits.patch
  block-backend-align-max_transfer-to-requ.patch
  file-posix-fix-max_iov-for-dev-sg-device.patch
  file-posix-try-BLKSECTGET-on-block-devic.patch
  osdep-provide-ROUND_DOWN-macro.patch
  scsi-generic-pass-max_segments-via-max_i.patch</changelog>
  <changelog author="jose.ziviani@suse.com" date="1633003200">- Fix out-of-bounds write in UAS (USB Attached SCSI) device emulation
  (bsc#1189702, CVE-2021-3713)
  uas-add-stream-number-sanity-checks.patch
- Fix heap use-after-free in virtio_net_receive_rcu
  (bsc#1189938, CVE-2021-3748)
  virtio-net-fix-use-after-unmap-free-for-.patch</changelog>
  <changelog author="lma@suse.com" date="1634558400">- Fix qemu guest agent assert (bsc#1191699)
  * Patches added:
  qga-fix-assert-regression-on-guest-shutd.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1637928000">- update_git.sh: make sure special directories are defined and created
  before they're used</changelog>
  <changelog author="dfaggioli@suse.com" date="1638360000">* Un-break the main package build
  * Patches added:
  build-no-pie-is-no-functional-linker-fla.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1638360001">* Un-break the seabios build
  * Patches added:
  ldnoexec-Add-script-to-remove-ET_EXEC-fl.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1638878400">* Un-break seabios build on aarch64
  * Patches added:
  vgasrc-ignore-.node.gnu.property-binutil.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1640260800">- Amend .changes file: avoid declaring a still unfixed CVE, as
  fixed (bsc#1187529)</changelog>
  <changelog author="dfaggioli@suse.com" date="1640260801">- Fix "block/fdc: null pointer dereference may lead to guest crash"
  (CVE 2021-20196, bsc#1181361)
  * Patches added:
    hw-block-fdc-Kludge-missing-floppy-drive.patch
    hw-block-fdc-Extract-blk_create_empty_dr.patch</changelog>
  <changelog author="lyan@suse.com" date="1641297600">- Fix the the OOB access of sd could crash the guest resulting in DoS
  (CVE-2020-13253, bsc#1172033)
  hw-sd-sdcard-Do-not-switch-to-ReceivingD.patch
  hw-sd-sdcard-Update-coding-style-to-make.patch</changelog>
</package>
<package pkgid="1d174d0327cb3d76464960ad9a91b2c8704e4afad4a38fbc822c14160916afdd" name="raspberrypi-eeprom" arch="noarch">
  <version epoch="0" ver="2021.04.29" rel="150300.3.3.1"/>
  <changelog author="nsaenzjulienne@suse.com" date="1611316800">- First commit
- Introduce patches: 'add-suse-config.patch' and 'don't-use-env.patch'.</changelog>
  <changelog author="jengelh@inai.de" date="1611576000">- Ditch unnecessarily split package.</changelog>
  <changelog author="nsaenzjulienne@suse.com" date="1611576001">- Introduce _service file.</changelog>
  <changelog author="nsaenzjulienne@suse.com" date="1611662400">- Update to b9c255d:
  * rpi-eeprom-config: Properly decode sysfs binary files</changelog>
  <changelog author="nsaenzjulienne@suse.com" date="1611748800">- Define _firmwaredir when relevant</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1611835200">- Prefix version with 0.0~</changelog>
  <changelog author="nsaenzjulienne@suse.com" date="1611835201">- Remove VL805 firmware version from package version as it prevents it from
  incresing monotonically.</changelog>
  <changelog author="nsaenzjulienne@suse.com" date="1612440000">- Fix 'Supplements:' in spec file, as per
  https://doc.opensuse.org/projects/libzypp/HEAD/zypp-modalias.html commas are
  special charactes that should be replaced with '%2C'</changelog>
  <changelog author="nsaenzjulienne@suse.com" date="1613736000">- Add 'pciutils' as a requirement. 'rpi-eeprom-update' uses lspci.
  (bsc#1182437)
- Update to version 0.0~2020.09.03.65~gb9c255d: Simplifies code by removing
  legacy functions.
- Add patch: "rpi-eeprom-update-Use-tr-instead-of-strings.patch" to avoid the
  dependency with binutils. (bsc#1182437)</changelog>
  <changelog author="rpm@fthiessen.de" date="1625054400">- Use upstream version schema (year.month.day) instead of arbitrary 0.0
- Update to version 2021.04.29
  * Add support for NVMe to the bootloader with a new NVMe boot mode
  * Add support for [cm4] and [pi400] config conditionals filters.
  * TFTP - reply to duplicate ACKS
  * Skip rendering of HDMI diagnostics display for the first 8 seconds
    unless an error occurs.
  * Add support for the BCM2711 XHCI controller - BOOT_ORDER 0x5
  * XHCI protocol layer fixes for non-VLI controllers
  * Avoid USB MSD timeout of there is only one device
  * Fix recovery.bin error handler so that the LED error pattern
    is still displayed even if HDMI or SDRAM fail.
  * Fix GPIO expander reset issue on some Pi4B 1.1 to 1.3 boards
  * Fix regression for GPIO expander reset change which caused PMIC
    reset to get card out of 1V8 mode to be missed.
  * Timeout USB MSD commands and move to the next boot mode if a device
    stops responding.
  * Add support for booting from the BCM2711 XHCI controller which is
    the USB-C socket on Pi 4B / Pi 400 and the type A sockets on Compute
    Module 4 IO board.
  * Validate SDRAM in recovery mode.
- Fixes bsc#1194950.</changelog>
</package>
<package pkgid="63115fe2621cfd4f74e48f2992096aaf66d127b5605620410ad43a4ea02f0b96" name="raspberrypi-eeprom" arch="src">
  <version epoch="0" ver="2021.04.29" rel="150300.3.3.1"/>
  <changelog author="nsaenzjulienne@suse.com" date="1611316800">- First commit
- Introduce patches: 'add-suse-config.patch' and 'don't-use-env.patch'.</changelog>
  <changelog author="jengelh@inai.de" date="1611576000">- Ditch unnecessarily split package.</changelog>
  <changelog author="nsaenzjulienne@suse.com" date="1611576001">- Introduce _service file.</changelog>
  <changelog author="nsaenzjulienne@suse.com" date="1611662400">- Update to b9c255d:
  * rpi-eeprom-config: Properly decode sysfs binary files</changelog>
  <changelog author="nsaenzjulienne@suse.com" date="1611748800">- Define _firmwaredir when relevant</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1611835200">- Prefix version with 0.0~</changelog>
  <changelog author="nsaenzjulienne@suse.com" date="1611835201">- Remove VL805 firmware version from package version as it prevents it from
  incresing monotonically.</changelog>
  <changelog author="nsaenzjulienne@suse.com" date="1612440000">- Fix 'Supplements:' in spec file, as per
  https://doc.opensuse.org/projects/libzypp/HEAD/zypp-modalias.html commas are
  special charactes that should be replaced with '%2C'</changelog>
  <changelog author="nsaenzjulienne@suse.com" date="1613736000">- Add 'pciutils' as a requirement. 'rpi-eeprom-update' uses lspci.
  (bsc#1182437)
- Update to version 0.0~2020.09.03.65~gb9c255d: Simplifies code by removing
  legacy functions.
- Add patch: "rpi-eeprom-update-Use-tr-instead-of-strings.patch" to avoid the
  dependency with binutils. (bsc#1182437)</changelog>
  <changelog author="rpm@fthiessen.de" date="1625054400">- Use upstream version schema (year.month.day) instead of arbitrary 0.0
- Update to version 2021.04.29
  * Add support for NVMe to the bootloader with a new NVMe boot mode
  * Add support for [cm4] and [pi400] config conditionals filters.
  * TFTP - reply to duplicate ACKS
  * Skip rendering of HDMI diagnostics display for the first 8 seconds
    unless an error occurs.
  * Add support for the BCM2711 XHCI controller - BOOT_ORDER 0x5
  * XHCI protocol layer fixes for non-VLI controllers
  * Avoid USB MSD timeout of there is only one device
  * Fix recovery.bin error handler so that the LED error pattern
    is still displayed even if HDMI or SDRAM fail.
  * Fix GPIO expander reset issue on some Pi4B 1.1 to 1.3 boards
  * Fix regression for GPIO expander reset change which caused PMIC
    reset to get card out of 1V8 mode to be missed.
  * Timeout USB MSD commands and move to the next boot mode if a device
    stops responding.
  * Add support for booting from the BCM2711 XHCI controller which is
    the USB-C socket on Pi 4B / Pi 400 and the type A sockets on Compute
    Module 4 IO board.
  * Validate SDRAM in recovery mode.
- Fixes bsc#1194950.</changelog>
</package>
<package pkgid="a72c81fe90f36509667a44f4ca818e0dd9a1a437bcb743ec73cc8bde0000f836" name="raspberrypi-eeprom-firmware" arch="noarch">
  <version epoch="0" ver="2021.04.29" rel="150300.3.3.1"/>
  <changelog author="nsaenzjulienne@suse.com" date="1611316800">- First commit
- Introduce patches: 'add-suse-config.patch' and 'don't-use-env.patch'.</changelog>
  <changelog author="jengelh@inai.de" date="1611576000">- Ditch unnecessarily split package.</changelog>
  <changelog author="nsaenzjulienne@suse.com" date="1611576001">- Introduce _service file.</changelog>
  <changelog author="nsaenzjulienne@suse.com" date="1611662400">- Update to b9c255d:
  * rpi-eeprom-config: Properly decode sysfs binary files</changelog>
  <changelog author="nsaenzjulienne@suse.com" date="1611748800">- Define _firmwaredir when relevant</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1611835200">- Prefix version with 0.0~</changelog>
  <changelog author="nsaenzjulienne@suse.com" date="1611835201">- Remove VL805 firmware version from package version as it prevents it from
  incresing monotonically.</changelog>
  <changelog author="nsaenzjulienne@suse.com" date="1612440000">- Fix 'Supplements:' in spec file, as per
  https://doc.opensuse.org/projects/libzypp/HEAD/zypp-modalias.html commas are
  special charactes that should be replaced with '%2C'</changelog>
  <changelog author="nsaenzjulienne@suse.com" date="1613736000">- Add 'pciutils' as a requirement. 'rpi-eeprom-update' uses lspci.
  (bsc#1182437)
- Update to version 0.0~2020.09.03.65~gb9c255d: Simplifies code by removing
  legacy functions.
- Add patch: "rpi-eeprom-update-Use-tr-instead-of-strings.patch" to avoid the
  dependency with binutils. (bsc#1182437)</changelog>
  <changelog author="rpm@fthiessen.de" date="1625054400">- Use upstream version schema (year.month.day) instead of arbitrary 0.0
- Update to version 2021.04.29
  * Add support for NVMe to the bootloader with a new NVMe boot mode
  * Add support for [cm4] and [pi400] config conditionals filters.
  * TFTP - reply to duplicate ACKS
  * Skip rendering of HDMI diagnostics display for the first 8 seconds
    unless an error occurs.
  * Add support for the BCM2711 XHCI controller - BOOT_ORDER 0x5
  * XHCI protocol layer fixes for non-VLI controllers
  * Avoid USB MSD timeout of there is only one device
  * Fix recovery.bin error handler so that the LED error pattern
    is still displayed even if HDMI or SDRAM fail.
  * Fix GPIO expander reset issue on some Pi4B 1.1 to 1.3 boards
  * Fix regression for GPIO expander reset change which caused PMIC
    reset to get card out of 1V8 mode to be missed.
  * Timeout USB MSD commands and move to the next boot mode if a device
    stops responding.
  * Add support for booting from the BCM2711 XHCI controller which is
    the USB-C socket on Pi 4B / Pi 400 and the type A sockets on Compute
    Module 4 IO board.
  * Validate SDRAM in recovery mode.
- Fixes bsc#1194950.</changelog>
</package>
<package pkgid="6a30ebdcd1b76039e541c944ae85acd026736aa34acafce9c4493260a40ba625" name="reiserfs-kmp-preempt" arch="x86_64">
  <version epoch="0" ver="5.3.18" rel="150300.59.43.1"/>
  <changelog author="tiwai@suse.de" date="1642593600">- Add cherry-picked IDs for qemu fw_cfg patches
- commit 8f947ad</changelog>
  <changelog author="msuchanek@suse.de" date="1642593601">- powerpc/pseries/cpuhp: delete add/remove_by_count code
  (bsc#1065729).
- powerpc/pseries/cpuhp: cache node corrections (bsc#1065729).
- commit 9c04898</changelog>
  <changelog author="tiwai@suse.de" date="1642593602">- dmaengine: at_xdmac: Fix at_xdmac_lld struct definition
  (git-fixes).
- dmaengine: at_xdmac: Fix lld view setting (git-fixes).
- dmaengine: at_xdmac: Fix concurrency over xfers_list
  (git-fixes).
- dmaengine: at_xdmac: Print debug message after realeasing the
  lock (git-fixes).
- dmaengine: at_xdmac: Don't start transactions at tx_submit level
  (git-fixes).
- Documentation: dmaengine: Correctly describe dmatest with
  channel unset (git-fixes).
- rpmsg: core: Clean up resources on announce_create failure
  (git-fixes).
- ACPI: APD: Check for NULL pointer after calling devm_ioremap()
  (git-fixes).
- Input: ti_am335x_tsc - fix STEPCONFIG setup for Z2 (git-fixes).
- Input: ti_am335x_tsc - set ADCREFM for X configuration
  (git-fixes).
- i3c: master: dw: check return of dw_i3c_master_get_free_pos()
  (git-fixes).
- i3c: fix incorrect address slot lookup on 64-bit (git-fixes).
- commit 3d8614c</changelog>
  <changelog author="msuchanek@suse.de" date="1642593603">- powerpc/prom_init: Fix improper check of prom_getprop()
  (bsc#1065729).
- commit 954fa51</changelog>
  <changelog author="msuchanek@suse.de" date="1642593604">- powerpc/perf: Fix PMU callbacks to clear pending PMI before
  resetting an overflown PMC (bsc#1156395).
- commit 8bdce1e</changelog>
  <changelog author="mbenes@suse.cz" date="1642593605">- livepatch: Avoid CPU hogging with cond_resched (bsc#1071995).
- commit 27c7aa0</changelog>
  <changelog author="msuchanek@suse.de" date="1642593606">- blacklist.conf: Add 79ca6f74dae0 tpm: fix Atmel TPM crash caused by too frequent queries
  Breaks kABI, there is no report of this problem affecting users, likely
  broken old TPM firmware.
- commit 4ea9f96</changelog>
  <changelog author="msuchanek@suse.de" date="1642593607">- Update patches.suse/tpm-fix-potential-NULL-pointer-access-in-tpm_del_cha.patch
  (git-fixes bsc#1193660 ltc#195634).
- commit 11ac3f6</changelog>
  <changelog author="lhenriques@suse.de" date="1642680000">- fuse: Pass correct lend value to filemap_write_and_wait_range()
  (bsc#1194953).
- commit d2355ea</changelog>
  <changelog author="msuchanek@suse.de" date="1642680001">- blacklist.conf: Add a2308836880b powerpc: Fix arch_stack_walk() to have
  running function as first entry
  The stacktrace interface in this kernel version does not provide the
  parameters used to implement the fix.
- commit ee041a3</changelog>
  <changelog author="msuchanek@suse.de" date="1642680002">- powerpc/64s: fix program check interrupt emergency stack path
  (bsc#1156395).
- commit a3c26ed</changelog>
  <changelog author="msuchanek@suse.de" date="1642680003">- powerpc/traps: do not enable irqs in _exception (bsc#1065729).
- powerpc: add interrupt_cond_local_irq_enable helper
  (bsc#1065729).
- commit 65f660c</changelog>
  <changelog author="msuchanek@suse.de" date="1642680004">- powerpc/pseries/mobility: ignore ibm, platform-facilities
  updates (bsc#1065729).
- commit b253330</changelog>
  <changelog author="rgoldwyn@suse.com" date="1642680005">- vfs: check fd has read access in kernel_read_file_from_fd() (bsc#1194888).
- commit 4717473</changelog>
  <changelog author="vkarasulli@suse.de" date="1642680006">- moxart: fix potential use-after-free on remove path
  (bsc#1194516).
- commit 3fae095</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1642766400">- sctp: account stream padding length for reconf chunk
  (bsc#1194985 CVE-2022-0322).
- commit a6cab40</changelog>
  <changelog author="ddiss@suse.de" date="1642766401">- vfs: fs_context: fix up param length parsing in
  legacy_parse_param (CVE-2022-0185 bsc#1194517).
- Rename and retag following upstream merge from:
  patches.suse/vfs-Out-of-bounds-write-of-heap-buffer-in-fs_context-c.patch
  to patches.suse/vfs-fs_context-fix-up-param-length-parsing-in-legacy.patch
- commit 33860f2</changelog>
  <changelog author="mkubecek@suse.cz" date="1642766402">- series.conf: cleanup
- move to "mainline soon" section:
  - patches.suse/0001-mmc-moxart_remove-Fix-UAF.patch
- commit 07d55c3</changelog>
  <changelog author="mkubecek@suse.cz" date="1642766403">- series.conf: refresh
- update upstream references and resort:
  - patches.suse/powerpc-fadump-Fix-inaccurate-CPU-state-info-in-vmco.patch
  - patches.suse/powerpc-handle-kdump-appropriately-with-crash_kexec_.patch
  - patches.suse/powerpc-watchdog-Avoid-holding-wd_smp_lock-over-prin.patch
  - patches.suse/powerpc-watchdog-Fix-missed-watchdog-reset-due-to-me.patch
  - patches.suse/powerpc-watchdog-Fix-wd_smp_last_reset_tb-reporting.patch
  - patches.suse/powerpc-watchdog-read-TB-close-to-where-it-is-used.patch
  - patches.suse/powerpc-watchdog-tighten-non-atomic-read-modify-writ.patch
- commit 72b7db7</changelog>
  <changelog author="osalvador@suse.de" date="1642939200">- Rename colliding patches before the next cve/linux-5.3 -&gt; SLE15-SP3 merge
- commit 84178b8</changelog>
</package>
<package pkgid="4d8ba640f30c3858da648d658118e68ff347f0aa977782bf24fc1fe505f00fb6" name="reiserfs-kmp-preempt" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="150300.59.49.1"/>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235200">- IB/mlx5: Add missing error code (git-fixes)
- commit 06919f0</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235201">- RDMA/cxgb4: Fix adapter LE hash errors while destroying ipv6 listening server (git-fixes)
- commit 0f86491</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235202">- RDMA/addr: Be strict with gid size (git-fixes)
- commit 0b96850</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235203">- IB/isert: Fix a use after free in isert_connect_request (git-fixes)
- commit fa7abfc</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235204">- RDMA/core: Fix corrupted SL on passive side (git-fixes)
- commit d86d9cb</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235205">- IB/hfi1: Use kzalloc() for mmu_rb_handler allocation (git-fixes)
- commit 05c0e16</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235206">- IB/hfi1: Fix error return code in parse_platform_config() (git-fixes)
- commit 270bb46</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235207">- RDMA/bnxt_re: Fix error return code in bnxt_qplib_cq_process_terminal() (git-fixes)
- commit 76267d4</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235208">- RDMA/core: Unify RoCE check and re-factor code (git-fixes)
- commit e5e3d6f</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235209">- RDMA/cxgb4: add missing qpid increment (git-fixes)
- commit 591cdce</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235210">- RDMA/i40iw: Fix error unwinding when i40iw_hmc_sd_one fails (git-fixes)
- commit 2db1c84</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235211">- RDMA/siw: Fix a use after free in siw_alloc_mr (git-fixes)
- commit a7eff62</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235212">- RDMA/bnxt_re: Fix a double free in bnxt_qplib_alloc_res (git-fixes)
- commit 8c226d5</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235213">- RDMA/siw: Properly check send and receive CQ pointers (git-fixes)
- commit d84b45b</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235214">- RDMA/rxe: Clear all QP fields if creation failed (git-fixes)
- commit 07c8b4d</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235215">- RDMA/mlx5: Recover from fatal event in dual port mode (git-fixes)
- commit 875e0ed</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235216">- RDMA/core: Don't access cm_id after its destruction (git-fixes)
- commit 4a117e6</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235217">- RDMA/mlx5: Fix query DCT via DEVX (git-fixes)
- commit 4b56cb2</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235218">- RDMA/uverbs: Fix a NULL vs IS_ERR() bug (git-fixes)
- commit 82ce09e</changelog>
  <changelog author="msuchanek@suse.de" date="1644235219">- powerpc/perf: Fix power_pmu_disable to call
  clear_pmi_irq_pending only if PMI is pending (bsc#1156395).
- commit a08ca77</changelog>
</package>
<package pkgid="9b63dfc8e9ca3366574488b06e86cbba5d578660546832779eeb1e76d747526e" name="reiserfs-kmp-preempt" arch="x86_64">
  <version epoch="0" ver="5.3.18" rel="150300.59.49.1"/>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235200">- IB/mlx5: Add missing error code (git-fixes)
- commit 06919f0</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235201">- RDMA/cxgb4: Fix adapter LE hash errors while destroying ipv6 listening server (git-fixes)
- commit 0f86491</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235202">- RDMA/addr: Be strict with gid size (git-fixes)
- commit 0b96850</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235203">- IB/isert: Fix a use after free in isert_connect_request (git-fixes)
- commit fa7abfc</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235204">- RDMA/core: Fix corrupted SL on passive side (git-fixes)
- commit d86d9cb</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235205">- IB/hfi1: Use kzalloc() for mmu_rb_handler allocation (git-fixes)
- commit 05c0e16</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235206">- IB/hfi1: Fix error return code in parse_platform_config() (git-fixes)
- commit 270bb46</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235207">- RDMA/bnxt_re: Fix error return code in bnxt_qplib_cq_process_terminal() (git-fixes)
- commit 76267d4</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235208">- RDMA/core: Unify RoCE check and re-factor code (git-fixes)
- commit e5e3d6f</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235209">- RDMA/cxgb4: add missing qpid increment (git-fixes)
- commit 591cdce</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235210">- RDMA/i40iw: Fix error unwinding when i40iw_hmc_sd_one fails (git-fixes)
- commit 2db1c84</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235211">- RDMA/siw: Fix a use after free in siw_alloc_mr (git-fixes)
- commit a7eff62</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235212">- RDMA/bnxt_re: Fix a double free in bnxt_qplib_alloc_res (git-fixes)
- commit 8c226d5</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235213">- RDMA/siw: Properly check send and receive CQ pointers (git-fixes)
- commit d84b45b</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235214">- RDMA/rxe: Clear all QP fields if creation failed (git-fixes)
- commit 07c8b4d</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235215">- RDMA/mlx5: Recover from fatal event in dual port mode (git-fixes)
- commit 875e0ed</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235216">- RDMA/core: Don't access cm_id after its destruction (git-fixes)
- commit 4a117e6</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235217">- RDMA/mlx5: Fix query DCT via DEVX (git-fixes)
- commit 4b56cb2</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1644235218">- RDMA/uverbs: Fix a NULL vs IS_ERR() bug (git-fixes)
- commit 82ce09e</changelog>
  <changelog author="msuchanek@suse.de" date="1644235219">- powerpc/perf: Fix power_pmu_disable to call
  clear_pmi_irq_pending only if PMI is pending (bsc#1156395).
- commit a08ca77</changelog>
</package>
<package pkgid="010fd3087da31d181b558e0322efad606e0db4d74eae6906de4cf7055856fd08" name="rhnlib" arch="src">
  <version epoch="0" ver="4.2.5" rel="3.31.1"/>
  <changelog author="jgonzalez@suse.com" date="1517572800">- version 2.8.5.3-1
- replace netstat with ss command</changelog>
  <changelog author="jgonzalez@suse.com" date="1519387200">- version 2.8.7.1-1
- Sync with upstream</changelog>
  <changelog author="jgonzalez@suse.com" date="1520251200">- version 2.8.7.2-1
- remove empty clean section from spec (bsc#1083294)</changelog>
  <changelog author="jgonzalez@suse.com" date="1522065600">- version 2.8.10.1-1
- Sync with upstream (bsc#1083294)</changelog>
  <changelog author="jgonzalez@suse.com" date="1525694400">- version 2.8.11.1-1
- Sync with upstream (bsc#1083294)</changelog>
  <changelog author="jgonzalez@suse.com" date="1533902400">- version 4.0.1-1
- Bump version to 4.0.0 (bsc#1104034)
- Fix copyright for the package specfile (bsc#1103696)</changelog>
  <changelog author="jgonzalez@suse.com" date="1540555200">- version 4.0.2-1
- use rpm for debian packaging</changelog>
  <changelog author="jgonzalez@suse.com" date="1548936000">- version 4.0.3-1
- Sync changes from Spacewalk
- 1652859 - python3 http.client does not contain _set_hostport()</changelog>
  <changelog author="jgonzalez@suse.com" date="1551268800">- version 4.0.4-1
- Fix encoding issues after porting to Python 3.</changelog>
  <changelog author="jgonzalez@suse.com" date="1551528000">- version 4.0.5-1
- Read SSL decoded buffer completely when no pending bytes on the
  underlying connection.</changelog>
  <changelog author="jgonzalez@suse.com" date="1553860800">- version 4.0.6-1
- Add group to python*-rhnlib to fix building at SLE11</changelog>
  <changelog author="jgonzalez@suse.com" date="1555934400">- version 4.0.7-1
- Add makefile and pylint configuration for PyLint</changelog>
  <changelog author="jgonzalez@suse.com" date="1557921600">- version 4.0.8-1
- SPEC cleanup</changelog>
  <changelog author="jgonzalez@suse.com" date="1574856000">- version 4.1.1-1
- Fix malformed XML response when data contains non-ASCII chars (bsc#1154968)
- Bump version to 4.1.0 (bsc#1154940)
- fix initialize ssl connection (bsc#1144155)
- Add SNI support for clients
- Fix bootstrapping SLE11SP4 trad client with SSL enabled (bsc#1148177)</changelog>
  <changelog author="jgonzalez@suse.com" date="1583928000">- version 4.1.2-1
- Fix building</changelog>
  <changelog author="jgonzalez@suse.com" date="1600430400">- version 4.2.1-1
- Update package version to 4.2.0</changelog>
  <changelog author="jgonzalez@suse.com" date="1613563200">- version 4.2.2-1
- change SSL implementation to python ssl for better SAN and
  hostname matching support (bsc#1181807)</changelog>
  <changelog author="jgonzalez@suse.com" date="1618574400">- version 4.2.3-1
- require missing python-backports.ssl_match_hostname on SLE 11 (bsc#1183959)</changelog>
  <changelog author="jgonzalez@suse.com" date="1626436800">- version 4.2.4-1
- Adapt the tests to the new images</changelog>
  <changelog author="jmassaguerpla@suse.de" date="1643803200">- version 4.2.5-1
  * do not build python 2 package for SLE15</changelog>
</package>
<package pkgid="30c7858013d3c92365d436c50c8b27769773e92f8698549e4ded70edb32ba349" name="rpmlint" arch="noarch">
  <version epoch="0" ver="1.10" rel="7.38.1"/>
  <changelog author="alarrosa@suse.com" date="1542369600">- Add mpd user</changelog>
  <changelog author="eich@suse.com" date="1542715200">- Add user/group 'slurm' for package slurm
  (See network:cluster/slurm) (FATE#316379).</changelog>
  <changelog author="eich@suse.com" date="1542715201">- Add group 'singularity', remove user 'singularity' which was
  added mistakenly.</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1543838400">- whitelist pam_slurm_adopt (bsc#1116758)</changelog>
  <changelog author="toddrme2178@gmail.com" date="1544184000">- Add xrootd gid and uid whitelist.
  This is needed by the latest versions of xrootd.</changelog>
  <changelog author="mardnh@gmx.de" date="1544616000">- Add user/group 'bird' for package bird (network/bird)</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1545393600">- whitelist boltd dbus service (bsc#1119975)</changelog>
  <changelog author="mliska@suse.cz" date="1546430400">- Add 0001-Backport-d8f423b575e8be387d33bc3af176baf978efacbb.patch</changelog>
  <changelog author="opensuse-packaging@opensuse.org" date="1547035200">- Update rpmlint-checks to version master (bsc#1116686):
  * Ignore decoding errors as we're not sure we know the encoding
  * Use UTF-8 encoding when opening .pc file (#42)
  * whitelist otrs permission file (#41)
  * Relax various flake8 warnings
  * Handle '-n' option for %service_del_preun %service_del_postun
  * There isn't a good standard, whether the directory should be called 'tests/' or 'test/'</changelog>
  <changelog author="malte.kraus@suse.com" date="1574942400">- whitelist sssd infopipe (bsc#1157663)
- whitelist sysprof3 D-Bus services (bsc#1151418)</changelog>
  <changelog author="malte.kraus@suse.com" date="1586865600">- whitelist certmonger (bsc#1169365, bsc#1129452)</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1602244800">- backport systemd portable1 D-Bus whitelisting (bsc#1176676)</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1602763200">- backport pam_pwquality whitelisting for PackageHub (bsc#1177684)</changelog>
  <changelog author="jsegitz@suse.com" date="1606132800">- Whitelist PAM modules and DBUS rules for cockpit (bsc#1169614)</changelog>
  <changelog author="wolfgang.frisch@suse.com" date="1629115200">- Backport whitelisting of oddjob (bsc#1189106 bsc#1169494).</changelog>
  <changelog author="paolo.perego@suse.com" date="1634644800">- Backport whitelisting of systemd-homed (bsc#1191821)</changelog>
  <changelog author="paolo.perego@suse.com" date="1634817600">- Whitelist pam_u2f (bsc#1190790 jsc#SLE-21888)</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643112000">- Add accept-licenses-with-plus.patch to accept any license ending
  with a + (as indicated in the SPDX syntax), fixes bsc#1195085
- Remove licenses ending with + from valid license array</changelog>
  <changelog author="wolfgang.frisch@suse.com" date="1643889600">- Backport whitelisting of plasma5-disks (bsc#1195491).</changelog>
  <changelog author="wolfgang.frisch@suse.com" date="1644408000">- Backport whitelisting of kdenetwork-filesharing (bsc#1195548).
- Backport whitelisting of powerdevil5 (bsc#1195662).</changelog>
</package>
<package pkgid="298cf1d93bab795b8ac58f998021dfd814f79fab993211f5e9e28c39ae07ca19" name="rpmlint" arch="src">
  <version epoch="0" ver="1.10" rel="7.38.1"/>
  <changelog author="alarrosa@suse.com" date="1542369600">- Add mpd user</changelog>
  <changelog author="eich@suse.com" date="1542715200">- Add user/group 'slurm' for package slurm
  (See network:cluster/slurm) (FATE#316379).</changelog>
  <changelog author="eich@suse.com" date="1542715201">- Add group 'singularity', remove user 'singularity' which was
  added mistakenly.</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1543838400">- whitelist pam_slurm_adopt (bsc#1116758)</changelog>
  <changelog author="toddrme2178@gmail.com" date="1544184000">- Add xrootd gid and uid whitelist.
  This is needed by the latest versions of xrootd.</changelog>
  <changelog author="mardnh@gmx.de" date="1544616000">- Add user/group 'bird' for package bird (network/bird)</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1545393600">- whitelist boltd dbus service (bsc#1119975)</changelog>
  <changelog author="mliska@suse.cz" date="1546430400">- Add 0001-Backport-d8f423b575e8be387d33bc3af176baf978efacbb.patch</changelog>
  <changelog author="opensuse-packaging@opensuse.org" date="1547035200">- Update rpmlint-checks to version master (bsc#1116686):
  * Ignore decoding errors as we're not sure we know the encoding
  * Use UTF-8 encoding when opening .pc file (#42)
  * whitelist otrs permission file (#41)
  * Relax various flake8 warnings
  * Handle '-n' option for %service_del_preun %service_del_postun
  * There isn't a good standard, whether the directory should be called 'tests/' or 'test/'</changelog>
  <changelog author="malte.kraus@suse.com" date="1574942400">- whitelist sssd infopipe (bsc#1157663)
- whitelist sysprof3 D-Bus services (bsc#1151418)</changelog>
  <changelog author="malte.kraus@suse.com" date="1586865600">- whitelist certmonger (bsc#1169365, bsc#1129452)</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1602244800">- backport systemd portable1 D-Bus whitelisting (bsc#1176676)</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1602763200">- backport pam_pwquality whitelisting for PackageHub (bsc#1177684)</changelog>
  <changelog author="jsegitz@suse.com" date="1606132800">- Whitelist PAM modules and DBUS rules for cockpit (bsc#1169614)</changelog>
  <changelog author="wolfgang.frisch@suse.com" date="1629115200">- Backport whitelisting of oddjob (bsc#1189106 bsc#1169494).</changelog>
  <changelog author="paolo.perego@suse.com" date="1634644800">- Backport whitelisting of systemd-homed (bsc#1191821)</changelog>
  <changelog author="paolo.perego@suse.com" date="1634817600">- Whitelist pam_u2f (bsc#1190790 jsc#SLE-21888)</changelog>
  <changelog author="danilo.spinella@suse.com" date="1643112000">- Add accept-licenses-with-plus.patch to accept any license ending
  with a + (as indicated in the SPDX syntax), fixes bsc#1195085
- Remove licenses ending with + from valid license array</changelog>
  <changelog author="wolfgang.frisch@suse.com" date="1643889600">- Backport whitelisting of plasma5-disks (bsc#1195491).</changelog>
  <changelog author="wolfgang.frisch@suse.com" date="1644408000">- Backport whitelisting of kdenetwork-filesharing (bsc#1195548).
- Backport whitelisting of powerdevil5 (bsc#1195662).</changelog>
</package>
<package pkgid="a12afd7e568bf4602367638c4fe17fb8a71dc0211ea69064c004fce0db60b30f" name="rust" arch="src">
  <version epoch="0" ver="1.53.0" rel="22.1"/>
  <changelog author="luke@ljones.dev" date="1569844800">- Add patch add-option-to-allow-warnings.patch to add a config option
  which allows warnings and so enables v1.38 to bootstrap itself.</changelog>
  <changelog author="rhafer@suse.com" date="1571832000">- Switch to bundled version of libgit2 for now. libgit2-sys seems
  to expect using the bundled variant, which just seems to point
  to a snapshot of the master branch and doesn't match any released
  libgit2 (bsc#1154817).
  See: https://github.com/rust-lang/rust/issues/63476 and
  https://github.com/rust-lang/git2-rs/issues/458 for details.</changelog>
  <changelog author="aplanas@suse.com" date="1573128000">- Update to version 1.39.0
  + Language
  - You can now create async functions and blocks with async fn,
    async move {}, and async {} respectively, and you can now call
    .await on async expressions.
  - You can now use certain attributes on function, closure, and
    function pointer parameters.
  - You can now take shared references to bind-by-move patterns in
    the if guards of match arms.
  + Compiler
  - Added tier 3 support for the i686-unknown-uefi target.
  - Added tier 3 support for the sparc64-unknown-openbsd target.
  - rustc will now trim code snippets in diagnostics to fit in your
    terminal.
  - You can now pass --show-output argument to test binaries to
    print the output of successful tests.
  + For more details:
    https://github.com/rust-lang/rust/blob/stable/RELEASES.md#version-1390-2019-11-07
- Drop patches already merged in upstream:
  + rust-61206-assume-tarball-llvm-is-fresh.patch
  + add-option-to-allow-warnings.patch</changelog>
  <changelog author="aplanas@suse.com" date="1573214400">- Add hopefully-fix-rustdoc-build.patch to fix rustdoc compilation</changelog>
  <changelog author="aplanas@suse.com" date="1574683200">- Re-format the spec file
- Add a README to explain the update process
- Add _service file for download the assets and re-base the patches</changelog>
  <changelog author="ngompa13@gmail.com" date="1575028800">- Rename README to README.suse-maint and add it as a source
  to stop factory-auto from declining submissions automatically</changelog>
  <changelog author="opensuse-packaging@opensuse.org" date="1577707200">- Rebased patches:
  + hopefully-fix-rustdoc-build.patch dropped (merged upstream)</changelog>
  <changelog author="luke@ljones.dev" date="1577707201">- Update to version 1.40.0
  + Language
  - You can now use tuple `struct`s and tuple `enum` variant's constructors in
    `const` contexts. e.g.
    pub struct Point(i32, i32);
    const ORIGIN: Point = {
    let constructor = Point;
    constructor(0, 0)
    };
  - You can now mark `struct`s, `enum`s, and `enum` variants with the `#[non_exhaustive]` attribute to
    indicate that there may be variants or fields added in the future.
    For example this requires adding a wild-card branch (`_ =&gt; {}`) to any match
    statements on a non-exhaustive `enum`.
  - You can now use function-like procedural macros in `extern` blocks and in
    type positions. e.g. `type Generated = macro!();`
  - Function-like and attribute procedural macros can now emit
    `macro_rules!` items, so you can now have your macros generate macros.
  - The `meta` pattern matcher in `macro_rules!` now correctly matches the modern
    attribute syntax. For example `(#[$m:meta])` now matches `#[attr]`,
    `#[attr{tokens}]`, `#[attr[tokens]]`, and `#[attr(tokens)]`.
  + Compiler
  - Added tier 3 support\* for the
    `thumbv7neon-unknown-linux-musleabihf` target.
  - Added tier 3 support for the
    `aarch64-unknown-none-softfloat` target.
  - Added tier 3 support for the `mips64-unknown-linux-muslabi64`, and
    `mips64el-unknown-linux-muslabi64` targets.
  + Libraries
  - The `is_power_of_two` method on unsigned numeric types is now a `const` function.
  + Stabilized APIs
  - BTreeMap::get_key_value
  - HashMap::get_key_value
  - Option::as_deref_mut
  - Option::as_deref
  - Option::flatten
  - UdpSocket::peer_addr
  - f32::to_be_bytes
  - f32::to_le_bytes
  - f32::to_ne_bytes
  - f64::to_be_bytes
  - f64::to_le_bytes
  - f64::to_ne_bytes
  - f32::from_be_bytes
  - f32::from_le_bytes
  - f32::from_ne_bytes
  - f64::from_be_bytes
  - f64::from_le_bytes
  - f64::from_ne_bytes
  - mem::take
  - slice::repeat
  - todo!
  + Cargo
  - Cargo will now always display warnings, rather than only on
    fresh builds.
  - Feature flags (except `--all-features`) passed to a virtual workspace will
    now produce an error. Previously these flags were ignored.
  - You can now publish `dev-dependencies` without including
    a `version`.
  + Misc
  - You can now specify the `#[cfg(doctest)]` attribute to include an item only
    when running documentation tests with `rustdoc`.
  + Compatibility Notes
  - As previously announced, any previous NLL warnings in the 2015 edition are
    now hard errors.
  - The `include!` macro will now warn if it failed to include the
    entire file. The `include!` macro unintentionally only includes the
    first _expression_ in a file, and this can be unintuitive. This will become
    either a hard error in a future release, or the behavior may be fixed to include all expressions as expected.
  - Using `#[inline]` on function prototypes and consts now emits a warning under
    `unused_attribute` lint. Using `#[inline]` anywhere else inside traits
    or `extern` blocks now correctly emits a hard error.</changelog>
  <changelog author="federico@suse.com" date="1578484800">- Bump version of libssh2 for SLE15; we now need a version with
  libssh2_userauth_publickey_frommemory(), which appeared in libssh2
  1.6.0.
- Use the bundled libssh2 prior to SLE15.  SLE12 has 1.4.3, which is
  too old for the ssh crate now.</changelog>
  <changelog author="dimstar@opensuse.org" date="1579262400">- Adjust constraints: Request 20GB HDD for all archs. Simplify the
  file by removing the overrides for various disk sizes. All archs
  are curretnly at roughly 17GB storage in use.</changelog>
  <changelog author="federico@suse.com" date="1584964800">- Update to version 1.41.1:
  - Always check types of static items
  - Always check lifetime bounds of `Copy` impls
  - Fix miscompilation in callers of `Layout::repeat`
- Update to version 1.41.0:
  + Language
  - You can now pass type parameters to foreign items when implementing
    traits. E.g. You can now write `impl&lt;T&gt; From&lt;Foo&gt; for Vec&lt;T&gt; {}`.
  - You can now arbitrarily nest receiver types in the `self` position. E.g. you can
    now write `fn foo(self: Box&lt;Box&lt;Self&gt;&gt;) {}`. Previously only `Self`, `&amp;Self`,
    `&amp;mut Self`, `Arc&lt;Self&gt;`, `Rc&lt;Self&gt;`, and `Box&lt;Self&gt;` were allowed.
  - You can now use any valid identifier in a `format_args` macro.
    Previously identifiers starting with an underscore were not allowed.
  - Visibility modifiers (e.g. `pub`) are now syntactically allowed on trait items and
    enum variants. These are still rejected semantically, but
    can be seen and parsed by procedural macros and conditional compilation.
  + Compiler
  - Rustc will now warn if you have unused loop `'label`s.
  - Removed support for the `i686-unknown-dragonfly` target.
  - Added tier 3 support\* for the `riscv64gc-unknown-linux-gnu` target.
  - You can now pass an arguments file passing the `@path` syntax
    to rustc. Note that the format differs somewhat from what is
    found in other tooling; please see the documentation for
    more information.
  - You can now provide `--extern` flag without a path, indicating that it is
    available from the search path or specified with an `-L` flag.
    Refer to Rust's [platform support page][forge-platform-support] for more
    information on Rust's tiered platform support.
  + Libraries
  - The `core::panic` module is now stable. It was already stable
    through `std`.
  - `NonZero*` numerics now implement `From&lt;NonZero*&gt;` if it's a smaller integer
    width. E.g. `NonZeroU16` now implements `From&lt;NonZeroU8&gt;`.
  - `MaybeUninit&lt;T&gt;` now implements `fmt::Debug`.
  + Stabilized APIs
  - `Result::map_or`
  - `Result::map_or_else`
  - `std::rc::Weak::weak_count`
  - `std::rc::Weak::strong_count`
  - `std::sync::Weak::weak_count`
  - `std::sync::Weak::strong_count`
  + Cargo
  - Cargo will now document all the private items for binary crates
    by default.
  - `cargo-install` will now reinstall the package if it detects that it is out
    of date.
  - Cargo.lock now uses a more git friendly format that should help to reduce
    merge conflicts.
  - You can now override specific dependencies's build settings. E.g.
    `[profile.dev.package.image] opt-level = 2` sets the `image` crate's
    optimisation level to `2` for debug builds. You can also use
    `[profile.&lt;profile&gt;.build-override]` to override build scripts and
    their dependencies.
  + Misc
  - You can now specify `edition` in documentation code blocks to compile the block
    for that edition. E.g. `edition2018` tells rustdoc that the code sample
    should be compiled the 2018 edition of Rust.
  - You can now provide custom themes to rustdoc with `--theme`, and check the
    current theme with `--check-theme`.
  - You can use `#[cfg(doc)]` to compile an item when building documentation.
  + Compatibility Notes
  - As previously announced 1.41.0 will be the last tier 1 release for 32-bit
    Apple targets. This means that the source code is still
    available to build, but the targets are no longer being tested and release
    binaries for those platforms will no longer be distributed by the Rust project.
    Please refer to the linked blog post for more information.</changelog>
  <changelog author="alarrosa@suse.com" date="1585656000">- Rebased patches:
  + ignore-Wstring-conversion.patch (offset / fuzz)</changelog>
  <changelog author="alarrosa@suse.com" date="1585656001">- Update to version 1.42.0:
  + Language
  - You can now use the slice pattern syntax with subslices.
  - You can now use #[repr(transparent)] on univariant enums. Meaning
    that you can create an enum that has the exact layout and ABI of
    the type it contains.
  - There are some syntax-only changes:
  * default is syntactically allowed before items in trait
    definitions.
  * Items in impls (i.e. consts, types, and fns) may syntactically
    leave out their bodies in favor of ;.
  * Bounds on associated types in impls are now syntactically
    allowed (e.g. type Foo: Ord;).
  * ... (the C-variadic type) may occur syntactically directly
    as the type of any function parameter.
    These are still rejected semantically, so you will likely receive
    an error but these changes can be seen and parsed by procedural
    macros and conditional compilation.
  + Compiler
  - Added tier 2 support for armv7a-none-eabi.
  - Added tier 2 support for riscv64gc-unknown-linux-gnu.
  - Option::{expect,unwrap} and Result::{expect, expect_err, unwrap,
    unwrap_err} now produce panic messages pointing to the location
    where they were called, rather than core's internals.
    Refer to Rust's platform support page for more information on
    Rust's tiered platform support.
  + Libraries
  - iter::Empty&lt;T&gt; now implements Send and Sync for any T.
  - Pin::{map_unchecked, map_unchecked_mut} no longer require the
    return type to implement Sized.
  - io::Cursor now derives PartialEq and Eq.
  - Layout::new is now const.
  - Added Standard Library support for riscv64gc-unknown-linux-gnu.
  + Stabilized APIs
  - CondVar::wait_while
  - CondVar::wait_timeout_while
  - DebugMap::key
  - DebugMap::value
  - ManuallyDrop::take
  - matches!
  - ptr::slice_from_raw_parts_mut
  - ptr::slice_from_raw_parts
  + Cargo
  - You no longer need to include extern crate proc_macro; to be
    able to use proc_macro; in the 2018 edition.
  + Compatibility Notes
  - Error::description has been deprecated, and its use will now
    produce a warning. It's recommended to use Display/to_string
    instead.</changelog>
  <changelog author="schwab@suse.de" date="1586260800">- Avoid duplication of environment settings</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1588161600">- Update to version 1.43.0
  + Language
  - Fixed using binary operations with `&amp;{number}` (e.g. `&amp;1.0`)
    not having the type inferred correctly.
  - Attributes such as `#[cfg()]` can now be used on `if`
    expressions.
  - Syntax only changes:
  * Allow `type Foo: Ord` syntactically.
  * Fuse associated and extern items up to defaultness.
  * Syntactically allow `self` in all `fn` contexts.
  * Merge `fn` syntax + cleanup item parsing.
  * `item` macro fragments can be interpolated into `trait`s,
    `impl`s, and `extern` blocks.
    For example, you may now write:
    ```rust
    macro_rules! mac_trait {
    ($i:item) =&gt; {
    trait T { $i }
    }
    }
    mac_trait! {
    fn foo() {}
    }
    ```
  * These are still rejected *semantically*, so you will likely
    receive an error but these changes can be seen and parsed by
    macros and conditional compilation.
  + Compiler
  - You can now pass multiple lint flags to rustc to override the
    previous flags.
    For example; `rustc -D unused -A unused-variables` denies
    everything in the `unused` lint group except `unused-variables`
    which is explicitly allowed. However, passing
    `rustc -A unused-variables -D unused` denies everything in
    the `unused` lint group **including** `unused-variables` since
    the allow flag is specified before the deny flag (and therefore
    overridden).
  - rustc will now prefer your system MinGW libraries over its
    bundled libraries if they are available on `windows-gnu`.
  - rustc now buffers errors/warnings printed in JSON.
  + Libraries
  - `Arc&lt;[T; N]&gt;`, `Box&lt;[T; N]&gt;`, and `Rc&lt;[T; N]&gt;`, now implement
    `TryFrom&lt;Arc&lt;[T]&gt;&gt;`,`TryFrom&lt;Box&lt;[T]&gt;&gt;`, and `TryFrom&lt;Rc&lt;[T]&gt;&gt;`
    respectively.
  * *Note** These conversions are only available when `N` is
    `0..=32`.
  - You can now use associated constants on floats and integers
    directly, rather than having to import the module.
    e.g. You can now write `u32::MAX` or `f32::NAN` with no imports.
  - `u8::is_ascii` is now `const`.
  - `String` now implements `AsMut&lt;str&gt;`.
  - Added the `primitive` module to `std` and `core`.
    This module reexports Rust's primitive types. This is mainly
    useful in macros where you want avoid these types being shadowed.
  - Relaxed some of the trait bounds on `HashMap` and `HashSet`.
  - `string::FromUtf8Error` now implements `Clone + Eq`.
  + Stabilized APIs
  - `Once::is_completed`
  - `f32::LOG10_2`
  - `f32::LOG2_10`
  - `f64::LOG10_2`
  - `f64::LOG2_10`
  - `iter::once_with`
  + Cargo
  - You can now set config `[profile]`s in your `.cargo/config`,
    or through your environment.
  - Cargo will now set `CARGO_BIN_EXE_&lt;name&gt;` pointing to a
    binary's executable path when running integration tests or
    benchmarks.
    `&lt;name&gt;` is the name of your binary as-is e.g. If you wanted
    the executable path for a binary named `my-program`you would
    use `env!("CARGO_BIN_EXE_my-program")`.
  + Misc
  - Certain checks in the `const_err` lint were deemed unrelated
    to const evaluation, and have been moved to the
    `unconditional_panic` and `arithmetic_overflow` lints.
  + Compatibility Notes
  - Having trailing syntax in the `assert!` macro is now a hard
    error. This has been a warning since 1.36.0.
  - Fixed `Self` not having the correctly inferred type. This
    incorrectly led to some instances being accepted, and now
    correctly emits a hard error.</changelog>
  <changelog author="schwab@suse.de" date="1588593600">- Update rustfmt_version</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1589457600">- Update to version 1.43.1
  - Updated openssl-src to 1.1.1g for CVE-2020-1967.
  - Fixed the stabilization of AVX-512 features.
  - Fixed `cargo package --list` not working with unpublished
    dependencies.
- Check upstream signatures for binaries
- Add rust.keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1592827200">- Add patch Fix-big-endian-miscompile-of-bitcast-zex.patch
  to fix miscompilations with rustc 1.43 that lead to LTO failures
  (bsc#1173202)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1627387200">- Needed for Firefox91 (bsc#1188891)
- Rebased patches:
  + ignore-Wstring-conversion.patch (offset / fuzz)
  + Fix-big-endian-miscompile-of-bitcast-zex.patch dropped
- Add support for riscv64
- Make all shared libraries in %{common_libdir} executable; otherwise
  fdupes will not find any duplicates in %{rustlibdir}.
- rust-rpmlintrc: Reflect updated LLVM name in the filter.
- &lt;https://github.com/rust-lang/rust/issues/74976&gt;: Add "--stage 1"
  to the "./x.py doc" call to ensure the newly built compiler gets
  used.
- Resolve issue in constraints to select aarch64 builders in OBS that
  have correctly functioning CPU's.
- Resolve issue with zlib selection and buildrequires.
- Correct build issues with esoteric cpu architectures, by removing
  developer facing tools in some cases.
- Updates to spec file and legacy cleanups during build processes
- Correct issues with incorrect tuning of codegen units that caused
  builders to OOM
- Update to version 1.53:
  + Language
  - [You can now use unicode for identifiers.][83799] This allows multilingual
    identifiers but still doesn't allow glyphs that are not considered characters
    such as `?` or `?`. More specifically you can now use any identifier that
    matches the UAX #31 "Unicode Identifier and Pattern Syntax" standard. This
    is the same standard as languages like Python, however Rust uses NFC
    normalization which may be different from other languages.
  - [You can now specify "or patterns" inside pattern matches.][79278]
    Previously you could only use `|` (OR) on complete patterns. E.g.
    ```rust
    let x = Some(2u8);
    // Before
    matches!(x, Some(1) | Some(2));
    // Now
    matches!(x, Some(1 | 2));
    ```
  - [Added the `:pat_param` `macro_rules!` matcher.][83386] This matcher
    has the same semantics as the `:pat` matcher. This is to allow `:pat`
    to change semantics to being a pattern fragment in a future edition.
  + Compiler
  - [Updated the minimum external LLVM version to LLVM 10.][83387]
  - [Added Tier 3\* support for the `wasm64-unknown-unknown` target.][80525]
  - [Improved debuginfo for closures and async functions on Windows MSVC.][83941]
    \* Refer to Rust's [platform support page][platform-support-doc] for more
    information on Rust's tiered platform support.
  + Libraries
  - [Abort messages will now forward to `android_set_abort_message` on
    Android platforms when available.][81469]
  - [`slice::IterMut&lt;'_, T&gt;` now implements `AsRef&lt;[T]&gt;`][82771]
  - [Arrays of any length now implement `IntoIterator`.][84147]
    Currently calling `.into_iter()` as a method on an array will
    return `impl Iterator&lt;Item=&amp;T&gt;`, but this may change in a
    future edition to change `Item` to `T`. Calling `IntoIterator::into_iter`
    directly on arrays will provide `impl Iterator&lt;Item=T&gt;` as expected.
  - [`leading_zeros`, and `trailing_zeros` are now available on all
    `NonZero` integer types.][84082]
  - [`{f32, f64}::from_str` now parse and print special values
    (`NaN`, `-0`) according to IEEE RFC 754.][78618]
  - [You can now index into slices using `(Bound&lt;usize&gt;, Bound&lt;usize&gt;)`.][77704]
  - [Add the `BITS` associated constant to all numeric types.][82565]
  + Cargo
  - [Cargo now supports git repositories where the default `HEAD` branch is not
    "master".][cargo/9392] This also includes a switch to the version 3 `Cargo.lock` format
    which can handle default branches correctly.
  - [macOS targets now default to `unpacked` split-debuginfo.][cargo/9298]
  - [The `authors` field is no longer included in `Cargo.toml` for new
    projects.][cargo/9282]
  + Rustdoc
  - [Added the `rustdoc::bare_urls` lint that warns when you have URLs
    without hyperlinks.][81764]
  + Compatibility Notes
  - [Implement token-based handling of attributes during expansion][82608]
  - [`Ipv4::from_str` will now reject octal format IP addresses in addition
    to rejecting hexadecimal IP addresses.][83652] The octal format can lead
    to confusion and potential security vulnerabilities and [is no
    longer recommended][ietf6943].
- Update to version 1.52:
  + Language
  - [Added the `unsafe_op_in_unsafe_fn` lint, which checks whether the unsafe code
    in an `unsafe fn` is wrapped in a `unsafe` block.][79208] This lint
    is allowed by default, and may become a warning or hard error in a
    future edition.
  - [You can now cast mutable references to arrays to a pointer of the same type as
    the element.][81479]
  + Compiler
  - [Upgraded the default LLVM to LLVM 12.][81451]
  - Added tier 3\* support for the following targets.
  - [`s390x-unknown-linux-musl`][82166]
  - [`riscv32gc-unknown-linux-musl` &amp; `riscv64gc-unknown-linux-musl`][82202]
  - [`powerpc-unknown-openbsd`][82733]
  + Libraries
  - [`OsString` now implements `Extend` and `FromIterator`.][82121]
  - [`cmp::Reverse` now has `#[repr(transparent)]` representation.][81879]
  - [`Arc&lt;impl Error&gt;` now implements `error::Error`.][80553]
  - [All integer division and remainder operations are now `const`.][80962]
  + Stabilised APIs
  - [`Arguments::as_str`]
  - [`char::MAX`]
  - [`char::REPLACEMENT_CHARACTER`]
  - [`char::UNICODE_VERSION`]
  - [`char::decode_utf16`]
  - [`char::from_digit`]
  - [`char::from_u32_unchecked`]
  - [`char::from_u32`]
  - [`slice::partition_point`]
  - [`str::rsplit_once`]
  - [`str::split_once`]
    The following previously stable APIs are now `const`.
  - [`char::len_utf8`]
  - [`char::len_utf16`]
  - [`char::to_ascii_uppercase`]
  - [`char::to_ascii_lowercase`]
  - [`char::eq_ignore_ascii_case`]
  - [`u8::to_ascii_uppercase`]
  - [`u8::to_ascii_lowercase`]
  - [`u8::eq_ignore_ascii_case`]
  + Rustdoc
  - [Rustdoc lints are now treated as a tool lint, meaning that
    lints are now prefixed with `rustdoc::` (e.g. `#[warn(rustdoc::non_autolinks)]`).][80527]
    Using the old style is still allowed, and will become a warning in
    a future release.
  - [Rustdoc now supports argument files.][82261]
  - [Rustdoc now generates smart punctuation for documentation.][79423]
  - [You can now use "task lists" in Rustdoc Markdown.][81766] E.g.
    ```markdown
  - [x] Complete
  - [ ] Todo
    ```
  + Misc
  - [You can now pass multiple filters to tests.][81356] E.g.
    `cargo test -- foo bar` will run all tests that match `foo` and `bar`.
  - [Rustup now distributes PDB symbols for the `std` library on Windows,
    allowing you to see `std` symbols when debugging.][82218]
  + Internal Only
    These changes provide no direct user facing benefits, but represent significant
    improvements to the internals and overall performance of rustc and
    related tools.
  - [Check the result cache before the DepGraph when ensuring queries][81855]
  - [Try fast_reject::simplify_type in coherence before doing full check][81744]
  - [Only store a LocalDefId in some HIR nodes][81611]
  - [Store HIR attributes in a side table][79519]
  + Compatibility Notes
  - ------------------
  - [Cargo build scripts are now forbidden from setting `RUSTC_BOOTSTRAP`.][cargo/9181]
  - [Removed support for the `x86_64-rumprun-netbsd` target.][82594]
  - [Deprecated the `x86_64-sun-solaris` target in favor of `x86_64-pc-solaris`.][82216]
  - [Rustdoc now only accepts `,`, ` `, and `\t` as delimiters for specifying
    languages in code blocks.][78429]
  - [Rustc now catches more cases of `pub_use_of_private_extern_crate`][80763]
  - [Changes in how proc macros handle whitespace may lead to panics when used
    with older `proc-macro-hack` versions. A `cargo update` should be sufficient to fix
    this in all cases.][84136]
- Update to version 1.51:
  + Language
  - [You can now parameterize items such as functions, traits, and `struct`s by constant
    values in addition to by types and lifetimes.][79135] Also known as "const generics"
    E.g. you can now write the following. Note: Only values of primitive integers,
    `bool`, or `char` types are currently permitted.
  + Compiler
  - [Added the `-Csplit-debuginfo` codegen option for macOS platforms.][79570]
    This option controls whether debug information is split across multiple files
    or packed into a single file. **Note** This option is unstable on other platforms.
  - [Added tier 3\* support for `aarch64_be-unknown-linux-gnu`,
    `aarch64-unknown-linux-gnu_ilp32`, and `aarch64_be-unknown-linux-gnu_ilp32` targets.][81455]
  - [Added tier 3 support for `i386-unknown-linux-gnu` and `i486-unknown-linux-gnu` targets.][80662]
  - [The `target-cpu=native` option will now detect individual features of CPUs.][80749]
    \* Refer to Rust's [platform support page][platform-support-doc] for more
    information on Rust's tiered platform support.
  + Libraries
  - [`Box::downcast` is now also implemented for any `dyn Any + Send + Sync` object.][80945]
  - [`str` now implements `AsMut&lt;str&gt;`.][80279]
  - [`u64` and `u128` now implement `From&lt;char&gt;`.][79502]
  - [`Error` is now implemented for `&amp;T` where `T` implements `Error`.][75180]
  - [`Poll::{map_ok, map_err}` are now implemented for `Poll&lt;Option&lt;Result&lt;T, E&gt;&gt;&gt;`.][80968]
  - [`unsigned_abs` is now implemented for all signed integer types.][80959]
  - [`io::Empty` now implements `io::Seek`.][78044]
  - [`rc::Weak&lt;T&gt;` and `sync::Weak&lt;T&gt;`'s methods such as `as_ptr` are now implemented for
    `T: ?Sized` types.][80764]
  + Stabilized APIs
  - [`Arc::decrement_strong_count`]
  - [`Arc::increment_strong_count`]
  - [`Once::call_once_force`]
  - [`Peekable::next_if_eq`]
  - [`Peekable::next_if`]
  - [`Seek::stream_position`]
  - [`array::IntoIter`]
  - [`panic::panic_any`]
  - [`ptr::addr_of!`]
  - [`ptr::addr_of_mut!`]
  - [`slice::fill_with`]
  - [`slice::split_inclusive_mut`]
  - [`slice::split_inclusive`]
  - [`slice::strip_prefix`]
  - [`slice::strip_suffix`]
  - [`str::split_inclusive`]
  - [`sync::OnceState`]
  - [`task::Wake`]
  + Cargo
  - [Added the `split-debuginfo` profile option to control the -Csplit-debuginfo
    codegen option.][cargo/9112]
  - [Added the `resolver` field to `Cargo.toml` to enable the new feature resolver
    and CLI option behavior.][cargo/8997] Version 2 of the feature resolver will try
    to avoid unifying features of dependencies where that unification could be unwanted.
    Such as using the same dependency with a `std` feature in a build scripts and
    proc-macros, while using the `no-std` feature in the final binary. See the
    [Cargo book documentation][feature-resolver@2.0] for more information on the feature.
  + Rustdoc
  - [Rustdoc will now include documentation for methods available from _nested_ `Deref` traits.][80653]
  - [You can now provide a `--default-theme` flag which sets the default theme to use for
    documentation.][79642]
    Various improvements to intra-doc links:
  - [You can link to non-path primitives such as `slice`.][80181]
  - [You can link to associated items.][74489]
  - [You can now include generic parameters when linking to items, like `Vec&lt;T&gt;`.][76934]
  + Misc
  - [You can now pass `--include-ignored` to tests (e.g. with
    `cargo test -- --include-ignored`) to include testing tests marked `#[ignore]`.][80053]
  + Compatibility Notes
  - [WASI platforms no longer use the `wasm-bindgen` ABI, and instead use the wasm32 ABI.][79998]
  - [`rustc` no longer promotes division, modulo and indexing operations to `const` that
    could fail.][80579]
  - [The minimum version of glibc for the following platforms has been bumped to version 2.31
    for the distributed artifacts.][81521]
  - `armv5te-unknown-linux-gnueabi`
  - `sparc64-unknown-linux-gnu`
  - `thumbv7neon-unknown-linux-gnueabihf`
  - `armv7-unknown-linux-gnueabi`
  - `x86_64-unknown-linux-gnux32`
- Update to version 1.50:
  * This fixes build on armv7 - boo#1181643
  + Language
  - You can now use const values for x in [x; N] array expressions.
    This has been technically possible since 1.38.0, as it was
    unintentionally stabilized.
  - Assignments to ManuallyDrop&lt;T&gt; union fields are now considered safe.
  + Compiler
  - Added tier 3* support for the armv5te-unknown-linux-uclibceabi
    target.
  - Added tier 3 support for the aarch64-apple-ios-macabi target.
  - The x86_64-unknown-freebsd is now built with the full toolset.
  - Dropped support for all cloudabi targets.
  * Refer to Rust's platform support page for more information on
    Rust's tiered platform support.
  + Libraries
  - proc_macro::Punct now implements PartialEq&lt;char&gt;.
  - ops::{Index, IndexMut} are now implemented for fixed sized
    arrays of any length.
  - On Unix platforms, the std::fs::File type now has a "niche" of -1.
    This value cannot be a valid file descriptor, and now means Option&lt;File&gt;
    takes up the same amount of space as File.
  + Stabilized APIs
    bool::then
    btree_map::Entry::or_insert_with_key
    f32::clamp
    f64::clamp
    hash_map::Entry::or_insert_with_key
    Ord::clamp
    RefCell::take
    slice::fill
    UnsafeCell::get_mut
  - The following previously stable methods are now const.
    IpAddr::is_ipv4
    IpAddr::is_ipv6
    IpAddr::is_unspecified
    IpAddr::is_loopback
    IpAddr::is_multicast
    Ipv4Addr::octets
    Ipv4Addr::is_loopback
    Ipv4Addr::is_private
    Ipv4Addr::is_link_local
    Ipv4Addr::is_multicast
    Ipv4Addr::is_broadcast
    Ipv4Addr::is_documentation
    Ipv4Addr::to_ipv6_compatible
    Ipv4Addr::to_ipv6_mapped
    Ipv6Addr::segments
    Ipv6Addr::is_unspecified
    Ipv6Addr::is_loopback
    Ipv6Addr::is_multicast
    Ipv6Addr::to_ipv4
    Layout::size
    Layout::align
    Layout::from_size_align
    pow for all integer types.
    checked_pow for all integer types.
    saturating_pow for all integer types.
    wrapping_pow for all integer types.
    next_power_of_two for all unsigned integer types.
    checked_next_power_of_two for all unsigned integer types.
  + Cargo
  - Added the [build.rustc-workspace-wrapper] option. This option
    sets a wrapper to execute instead of rustc, for workspace members only.
  - cargo:rerun-if-changed will now, if provided a directory,
    scan the entire contents of that directory for changes.
  - Added the --workspace flag to the cargo update command.
  + Misc
  - The search results tab and the help button are focusable
    with keyboard in rustdoc.
  - Running tests will now print the total time taken to execute.
  + Compatibility Notes
  - The compare_and_swap method on atomics has been deprecated.
    It's recommended to use the compare_exchange and
    compare_exchange_weak methods instead.
  - Changes in how TokenStreams are checked have fixed some cases
    where you could write unhygenic macro_rules! macros.
  - #![test] as an inner attribute is now considered unstable
    like other inner macro attributes, and reports an error by
    default through the soft_unstable lint.
  - Overriding a forbid lint at the same level that it was set
    is now a hard error.
  - You can no longer intercept panic! calls by supplying your own
    macro. It's recommended to use the #[panic_handler] attribute
    to provide your own implementation.
  - Semi-colons after item statements (e.g. struct Foo {};)
    now produce a warning.
- Update to version 1.49.0
  + Language
  - Unions can now implement Drop, and you can now have a field in
    a union with ManuallyDrop&lt;T&gt;.
  - You can now cast uninhabited enums to integers.
  - You can now bind by reference and by move in patterns. This
    allows you to selectively borrow individual components of a type.
    E.g.
    [#][derive(Debug)]
    struct Person {
    name: String,
    age: u8,
    }
    let person = Person {
    name: String::from("Alice"),
    age: 20,
    };
    // `name` is moved out of person, but `age` is referenced.
    let Person { name, ref age } = person;
    println!("{} {}", name, age);
  + Compiler
  - Added tier 1* support for aarch64-unknown-linux-gnu.
  - Added tier 2 support for aarch64-apple-darwin.
  - Added tier 2 support for aarch64-pc-windows-msvc.
  - Added tier 3 support for mipsel-unknown-none.
  - Raised the minimum supported LLVM version to LLVM 9.
  - Output from threads spawned in tests is now captured.
  - Change os and vendor values to "none" and "unknown" for some targets
  * Refer to Rust's platform support page for more information on Rust's
    tiered platform support.
  + Libraries
  - RangeInclusive now checks for exhaustion when calling contains and
    indexing.
  - ToString::to_string now no longer shrinks the internal buffer in
    the default implementation.
  - ops::{Index, IndexMut} are now implemented for fixed sized arrays
    of any length.
  + Stabilized APIs
  - slice::select_nth_unstable
  - slice::select_nth_unstable_by
  - slice::select_nth_unstable_by_key
  The following previously stable methods are now const.
  - Poll::is_ready
  - Poll::is_pending
  + Cargo
  - Building a crate with cargo-package should now be independently
    reproducible.
  - cargo-tree now marks proc-macro crates.
  - Added CARGO_PRIMARY_PACKAGE build-time environment variable. This
    variable will be set if the crate being built is one the user
    selected to build, either with -p or through defaults.
  - You can now use glob patterns when specifying packages &amp; targets.
  + Compatibility Notes
  - Demoted i686-unknown-freebsd from host tier 2 to target tier 2
    support.
  - Macros that end with a semi-colon are now treated as statements
    even if they expand to nothing.
  - Rustc will now check for the validity of some built-in attributes
    on enum variants. Previously such invalid or unused attributes
    could be ignored.
  - Leading whitespace is stripped more uniformly in documentation
    comments, which may change behavior. You read this post about
    the changes for more details.
  - Trait bounds are no longer inferred for associated types.
  + Internal Only
  These changes provide no direct user facing benefits, but
  represent significant improvements to the internals and overall
  performance of rustc and related tools.
  - rustc's internal crates are now compiled using the initial-exec
    Thread Local Storage model.
  - Calculate visibilities once in resolve.
  - Added system to the llvm-libunwind bootstrap config option.
  - Added --color for configuring terminal color support to bootstrap.
- Update to version 1.48.0
  + Language
  - The `unsafe` keyword is now syntactically permitted on modules.
    This is still rejected semantically, but can now be parsed by procedural
    macros.
  + Compiler
  - Stabilised the `-C link-self-contained=&lt;yes|no&gt;` compiler flag.
    This tells `rustc` whether to link its own C runtime and libraries or to
    rely on a external linker to find them. (Supported only on `windows-gnu`,
    `linux-musl`, and `wasi` platforms.)
  - You can now use `-C target-feature=+crt-static` on `linux-gnu` targets.
    Note: If you're using cargo you must explicitly pass the `--target` flag.
  - Added tier 2* support for aarch64-unknown-linux-musl.
  * Refer to Rust's platform support page for more information on Rust's
    tiered platform support.
  + Libraries
  - io::Write is now implemented for &amp;ChildStdin &amp;Sink, &amp;Stdout, and &amp;Stderr.
  - All arrays of any length now implement TryFrom&lt;Vec&lt;T&gt;&gt;.
  - The matches! macro now supports having a trailing comma.
  - Vec&lt;A&gt; now implements PartialEq&lt;[B]&gt; where A: PartialEq&lt;B&gt;.
  - The RefCell::{replace, replace_with, clone} methods now all use #[track_caller].
  + Stabilized APIs
  - slice::as_ptr_range
  - slice::as_mut_ptr_range
  - VecDeque::make_contiguous
  - future::pending
  - future::ready
  The following previously stable methods are now `const fn's`:
  - Option::is_some
  - Option::is_none
  - Option::as_ref
  - Result::is_ok
  - Result::is_err
  - Result::as_ref
  - Ordering::reverse
  - Ordering::then
  + Cargo
  + Rustdoc
  - You can now link to items in rustdoc using the intra-doc link syntax.
    E.g. /// Uses [`std::future`] will automatically generate a link to
    std::future's documentation. See "Linking to items by name" for more
    information.
  - You can now specify #[doc(alias = "&lt;alias&gt;")] on items to add search
    aliases when searching through rustdoc's UI.
  + Compatibility Notes
  - Promotion of references to 'static lifetime inside const fn now
    follows the same rules as inside a fn body. In particular, &amp;foo()
    will not be promoted to 'static lifetime any more inside const fns.
  - Associated type bindings on trait objects are now verified to meet
    the bounds declared on the trait when checking that they implement
    the trait.
  - When trait bounds on associated types or opaque types are ambiguous,
    the compiler no longer makes an arbitrary choice on which bound to use.
  - Fixed recursive nonterminals not being expanded in macros during
    pretty-print/reparse check. This may cause errors if your macro
    wasn't correctly handling recursive nonterminal tokens.
  - &amp;mut references to non zero-sized types are no longer promoted.
  - rustc will now warn if you use attributes like #[link_name] or
    [#][cold] in places where they have no effect.
  - Updated _mm256_extract_epi8 and _mm256_extract_epi16 signatures
    in arch::{x86, x86_64} to return i32 to match the vendor signatures.
  - mem::uninitialized will now panic if any inner types inside a struct
    or enum disallow zero-initialization.
  - #[target_feature] will now error if used in a place where it has no effect.
  - Foreign exceptions are now caught by catch_unwind and will cause an
    abort. Note: This behaviour is not guaranteed and is still considered
    undefined behaviour, see the catch_unwind documentation for further
    information.
  + Internal Only
    These changes provide no direct user facing benefits, but represent
    significant improvements to the internals and overall performance of
    rustc and related tools.
  - Building rustc from source now uses ninja by default over make.
    You can continue building with make by setting ninja=false in
    your config.toml.
  - cg_llvm: fewer_names in uncached_llvm_type
  - Made ensure_sufficient_stack() non-generic
- Update to version 1.47.0
  + Language
  - [Closures will now warn when not used.][74869]
  + Compiler
  - [Stabilized the `-C control-flow-guard` codegen option][73893], which enables
    [Control Flow Guard][1.47.0-cfg] for Windows platforms, and is ignored on other
    platforms.
  - [Upgraded to LLVM 11.][73526]
  - [Added tier 3\* support for the `thumbv4t-none-eabi` target.][74419]
  - [Upgrade the FreeBSD toolchain to version 11.4][75204]
  - [`RUST_BACKTRACE`'s output is now more compact.][75048]
  \* Refer to Rust's [platform support page][forge-platform-support] for more
  information on Rust's tiered platform support.
  + Libraries
  - [`CStr` now implements `Index&lt;RangeFrom&lt;usize&gt;&gt;`.][74021]
  - [Traits in `std`/`core` are now implemented for arrays of any length, not just
    those of length less than 33.][74060]
  - [`ops::RangeFull` and `ops::Range` now implement Default.][73197]
  - [`panic::Location` now implements `Copy`, `Clone`, `Eq`, `Hash`, `Ord`,
    `PartialEq`, and `PartialOrd`.][73583]
  + Stabilized APIs
  - [`Ident::new_raw`]
  - [`Range::is_empty`]
  - [`RangeInclusive::is_empty`]
  - [`Result::as_deref`]
  - [`Result::as_deref_mut`]
  - [`Vec::leak`]
  - [`pointer::offset_from`]
  - [`f32::TAU`]
  - [`f64::TAU`]
  The following previously stable APIs have now been made const.
  - [The `new` method for all `NonZero` integers.][73858]
  - [The `checked_add`,`checked_sub`,`checked_mul`,`checked_neg`, `checked_shl`,
    `checked_shr`, `saturating_add`, `saturating_sub`, and `saturating_mul`
    methods for all integers.][73858]
  - [The `checked_abs`, `saturating_abs`, `saturating_neg`, and `signum`  for all
    signed integers.][73858]
  - [The `is_ascii_alphabetic`, `is_ascii_uppercase`, `is_ascii_lowercase`,
    `is_ascii_alphanumeric`, `is_ascii_digit`, `is_ascii_hexdigit`,
    `is_ascii_punctuation`, `is_ascii_graphic`, `is_ascii_whitespace`, and
    `is_ascii_control` methods for `char` and `u8`.][73858]
  + Cargo
  - [`build-dependencies` are now built with opt-level 0 by default.][cargo/8500]
    You can override this by setting the following in your `Cargo.toml`.
    ```toml
    [profile.release.build-override]
    opt-level = 3
    ```
  - [`cargo-help` will now display man pages for commands rather just the
    `--help` text.][cargo/8456]
  - [`cargo-metadata` now emits a `test` field indicating if a target has
    tests enabled.][cargo/8478]
  - [`workspace.default-members` now respects `workspace.exclude`.][cargo/8485]
  - [`cargo-publish` will now use an alternative registry by default if it's the
    only registry specified in `package.publish`.][cargo/8571]
  + Misc
  - [Added a help button beside Rustdoc's searchbar that explains rustdoc's
    type based search.][75366]
  - [Added the Ayu theme to rustdoc.][71237]
- Update to version 1.46.0
  + Language
  - [`if`, `match`, and `loop` expressions can now be used in const functions.][72437]
  - [Additionally you are now also able to coerce and cast to slices (`&amp;[T]`) in
    const functions.][73862]
  - [The `#[track_caller]` attribute can now be added to functions to use the
    function's caller's location information for panic messages.][72445]
  - [Recursively indexing into tuples no longer needs parentheses.][71322] E.g.
    `x.0.0` over `(x.0).0`.
  - [`mem::transmute` can now be used in statics and constants.][72920] **Note**
    You currently can't use `mem::transmute` in constant functions.
  + Compiler
  - [You can now use the `cdylib` target on Apple iOS and tvOS platforms.][73516]
  - [Enabled static "Position Independent Executables" by default
    for `x86_64-unknown-linux-musl`.][70740]
  + Libraries
  - [`mem::forget` is now a `const fn`.][73887]
  - [`String` now implements `From&lt;char&gt;`.][73466]
  - [The `leading_ones`, and `trailing_ones` methods have been stabilised for all
    integer types.][73032]
  - [`vec::IntoIter&lt;T&gt;` now implements `AsRef&lt;[T]&gt;`.][72583]
  - [All non-zero integer types (`NonZeroU8`) now implement `TryFrom` for their
    zero-able equivalent (e.g. `TryFrom&lt;u8&gt;`).][72717]
  - [`&amp;[T]` and `&amp;mut [T]` now implement `PartialEq&lt;Vec&lt;T&gt;&gt;`.][71660]
  - [`(String, u16)` now implements `ToSocketAddrs`.][73007]
  - [`vec::Drain&lt;'_, T&gt;` now implements `AsRef&lt;[T]&gt;`.][72584]
  + Stabilized APIs
  - [`Option::zip`]
  - [`vec::Drain::as_slice`]
  + Cargo
    Added a number of new environment variables that are now available when
    compiling your crate.
  - [`CARGO_BIN_NAME` and `CARGO_CRATE_NAME`][cargo/8270] Providing the name of
    the specific binary being compiled and the name of the crate.
  - [`CARGO_PKG_LICENSE`][cargo/8325] The license from the manifest of the package.
  - [`CARGO_PKG_LICENSE_FILE`][cargo/8387] The path to the license file.
- Update to version 1.44.1
  * rustfmt accepts rustfmt_skip in cfg_attr again.
  * Don't hash executable filenames on apple platforms, fixing backtraces.
  * Fix crashes when finding backtrace on macOS.
  * Clippy applies lint levels into different files.
- Update to version 1.44.0
  + Language
  - You can now use `async/.await` with `#[no_std]` enabled.
  - Added the `unused_braces` lint.
  - Expansion-driven outline module parsing
  + Compiler
  - Rustc now respects the `-C codegen-units` flag in incremental mode.
    Additionally when in incremental mode rustc defaults to 256 codegen units.
  - Refactored `catch_unwind` to have zero-cost, unless unwinding is enabled and
    a panic is thrown.
  - Added tier 3\* support for the `aarch64-unknown-none` and
    `aarch64-unknown-none-softfloat` targets.
  - Added tier 3 support for `arm64-apple-tvos` and
    `x86_64-apple-tvos` targets.
  + Libraries
  - Special cased `vec![]` to map directly to `Vec::new()`. This allows
    `vec![]` to be able to be used in `const` contexts.
  - `convert::Infallible` now implements `Hash`.
  - `OsString` now implements `DerefMut` and `IndexMut` returning
    a `&amp;mut OsStr`.
  - Unicode 13 is now supported.
  - `String` now implements `From&lt;&amp;mut str&gt;`.
  - `IoSlice` now implements `Copy`.
  - `Vec&lt;T&gt;` now implements `From&lt;[T; N]&gt;`. Where `N` is at most 32.
  - `proc_macro::LexError` now implements `fmt::Display` and `Error`.
  - `from_le_bytes`, `to_le_bytes`, `from_be_bytes`, `to_be_bytes`,
    `from_ne_bytes`, and `to_ne_bytes` methods are now `const` for all
    integer types.
  + Stabilizd APIs
  - [`PathBuf::with_capacity`]
  - [`PathBuf::capacity`]
  - [`PathBuf::clear`]
  - [`PathBuf::reserve`]
  - [`PathBuf::reserve_exact`]
  - [`PathBuf::shrink_to_fit`]
  - [`f32::to_int_unchecked`]
  - [`f64::to_int_unchecked`]
  - [`Layout::align_to`]
  - [`Layout::pad_to_align`]
  - [`Layout::array`]
  - [`Layout::extend`]
  + Cargo
  - Added the `cargo tree` command which will print a tree graph of
    your dependencies
  + Misc
  - Rustdoc now allows you to specify `--crate-version` to have rustdoc include
    the version in the sidebar.
  + Compatibility Notes
  - Rustc now correctly generates static libraries on Windows GNU targets with
    the `.a` extension, rather than the previous `.lib`.
  - Removed the `-C no_integrated_as` flag from rustc.
  - The `file_name` property in JSON output of macro errors now points the actual
    source file rather than the previous format of `&lt;NAME macros&gt;`.
  * *Note:** this may not point to a file that actually exists on the user's system.
  - The minimum required external LLVM version has been bumped to LLVM 8.
  - `mem::{zeroed, uninitialised}` will now panic when used with types that do
    not allow zero initialization such as `NonZeroU8`. This was
    previously a warning.
  - In 1.45.0 (the next release) converting a `f64` to `u32` using the `as`
    operator has been defined as a saturating operation. This was previously
    undefined behaviour, but you can use the `{f64, f32}::to_int_unchecked` methods to
    continue using the current behaviour, which may be desirable in rare performance
    sensitive situations.</changelog>
  <changelog author="william.brown@suse.com" date="1642680000">- bsc#1194767 - CVE-2022-21658 - Resolve race condition in std::fs::remove_dir_all
  - 0001-Fix-CVE-2022-21658-for-UNIX-like.patch</changelog>
</package>
<package pkgid="c07d6ae9f3964148c20055eb03728f960fc2e22b219a936c5f85603f1b6a852a" name="rust-analysis" arch="aarch64">
  <version epoch="0" ver="1.53.0" rel="22.1"/>
  <changelog author="luke@ljones.dev" date="1569844800">- Add patch add-option-to-allow-warnings.patch to add a config option
  which allows warnings and so enables v1.38 to bootstrap itself.</changelog>
  <changelog author="rhafer@suse.com" date="1571832000">- Switch to bundled version of libgit2 for now. libgit2-sys seems
  to expect using the bundled variant, which just seems to point
  to a snapshot of the master branch and doesn't match any released
  libgit2 (bsc#1154817).
  See: https://github.com/rust-lang/rust/issues/63476 and
  https://github.com/rust-lang/git2-rs/issues/458 for details.</changelog>
  <changelog author="aplanas@suse.com" date="1573128000">- Update to version 1.39.0
  + Language
  - You can now create async functions and blocks with async fn,
    async move {}, and async {} respectively, and you can now call
    .await on async expressions.
  - You can now use certain attributes on function, closure, and
    function pointer parameters.
  - You can now take shared references to bind-by-move patterns in
    the if guards of match arms.
  + Compiler
  - Added tier 3 support for the i686-unknown-uefi target.
  - Added tier 3 support for the sparc64-unknown-openbsd target.
  - rustc will now trim code snippets in diagnostics to fit in your
    terminal.
  - You can now pass --show-output argument to test binaries to
    print the output of successful tests.
  + For more details:
    https://github.com/rust-lang/rust/blob/stable/RELEASES.md#version-1390-2019-11-07
- Drop patches already merged in upstream:
  + rust-61206-assume-tarball-llvm-is-fresh.patch
  + add-option-to-allow-warnings.patch</changelog>
  <changelog author="aplanas@suse.com" date="1573214400">- Add hopefully-fix-rustdoc-build.patch to fix rustdoc compilation</changelog>
  <changelog author="aplanas@suse.com" date="1574683200">- Re-format the spec file
- Add a README to explain the update process
- Add _service file for download the assets and re-base the patches</changelog>
  <changelog author="ngompa13@gmail.com" date="1575028800">- Rename README to README.suse-maint and add it as a source
  to stop factory-auto from declining submissions automatically</changelog>
  <changelog author="opensuse-packaging@opensuse.org" date="1577707200">- Rebased patches:
  + hopefully-fix-rustdoc-build.patch dropped (merged upstream)</changelog>
  <changelog author="luke@ljones.dev" date="1577707201">- Update to version 1.40.0
  + Language
  - You can now use tuple `struct`s and tuple `enum` variant's constructors in
    `const` contexts. e.g.
    pub struct Point(i32, i32);
    const ORIGIN: Point = {
    let constructor = Point;
    constructor(0, 0)
    };
  - You can now mark `struct`s, `enum`s, and `enum` variants with the `#[non_exhaustive]` attribute to
    indicate that there may be variants or fields added in the future.
    For example this requires adding a wild-card branch (`_ =&gt; {}`) to any match
    statements on a non-exhaustive `enum`.
  - You can now use function-like procedural macros in `extern` blocks and in
    type positions. e.g. `type Generated = macro!();`
  - Function-like and attribute procedural macros can now emit
    `macro_rules!` items, so you can now have your macros generate macros.
  - The `meta` pattern matcher in `macro_rules!` now correctly matches the modern
    attribute syntax. For example `(#[$m:meta])` now matches `#[attr]`,
    `#[attr{tokens}]`, `#[attr[tokens]]`, and `#[attr(tokens)]`.
  + Compiler
  - Added tier 3 support\* for the
    `thumbv7neon-unknown-linux-musleabihf` target.
  - Added tier 3 support for the
    `aarch64-unknown-none-softfloat` target.
  - Added tier 3 support for the `mips64-unknown-linux-muslabi64`, and
    `mips64el-unknown-linux-muslabi64` targets.
  + Libraries
  - The `is_power_of_two` method on unsigned numeric types is now a `const` function.
  + Stabilized APIs
  - BTreeMap::get_key_value
  - HashMap::get_key_value
  - Option::as_deref_mut
  - Option::as_deref
  - Option::flatten
  - UdpSocket::peer_addr
  - f32::to_be_bytes
  - f32::to_le_bytes
  - f32::to_ne_bytes
  - f64::to_be_bytes
  - f64::to_le_bytes
  - f64::to_ne_bytes
  - f32::from_be_bytes
  - f32::from_le_bytes
  - f32::from_ne_bytes
  - f64::from_be_bytes
  - f64::from_le_bytes
  - f64::from_ne_bytes
  - mem::take
  - slice::repeat
  - todo!
  + Cargo
  - Cargo will now always display warnings, rather than only on
    fresh builds.
  - Feature flags (except `--all-features`) passed to a virtual workspace will
    now produce an error. Previously these flags were ignored.
  - You can now publish `dev-dependencies` without including
    a `version`.
  + Misc
  - You can now specify the `#[cfg(doctest)]` attribute to include an item only
    when running documentation tests with `rustdoc`.
  + Compatibility Notes
  - As previously announced, any previous NLL warnings in the 2015 edition are
    now hard errors.
  - The `include!` macro will now warn if it failed to include the
    entire file. The `include!` macro unintentionally only includes the
    first _expression_ in a file, and this can be unintuitive. This will become
    either a hard error in a future release, or the behavior may be fixed to include all expressions as expected.
  - Using `#[inline]` on function prototypes and consts now emits a warning under
    `unused_attribute` lint. Using `#[inline]` anywhere else inside traits
    or `extern` blocks now correctly emits a hard error.</changelog>
  <changelog author="federico@suse.com" date="1578484800">- Bump version of libssh2 for SLE15; we now need a version with
  libssh2_userauth_publickey_frommemory(), which appeared in libssh2
  1.6.0.
- Use the bundled libssh2 prior to SLE15.  SLE12 has 1.4.3, which is
  too old for the ssh crate now.</changelog>
  <changelog author="dimstar@opensuse.org" date="1579262400">- Adjust constraints: Request 20GB HDD for all archs. Simplify the
  file by removing the overrides for various disk sizes. All archs
  are curretnly at roughly 17GB storage in use.</changelog>
  <changelog author="federico@suse.com" date="1584964800">- Update to version 1.41.1:
  - Always check types of static items
  - Always check lifetime bounds of `Copy` impls
  - Fix miscompilation in callers of `Layout::repeat`
- Update to version 1.41.0:
  + Language
  - You can now pass type parameters to foreign items when implementing
    traits. E.g. You can now write `impl&lt;T&gt; From&lt;Foo&gt; for Vec&lt;T&gt; {}`.
  - You can now arbitrarily nest receiver types in the `self` position. E.g. you can
    now write `fn foo(self: Box&lt;Box&lt;Self&gt;&gt;) {}`. Previously only `Self`, `&amp;Self`,
    `&amp;mut Self`, `Arc&lt;Self&gt;`, `Rc&lt;Self&gt;`, and `Box&lt;Self&gt;` were allowed.
  - You can now use any valid identifier in a `format_args` macro.
    Previously identifiers starting with an underscore were not allowed.
  - Visibility modifiers (e.g. `pub`) are now syntactically allowed on trait items and
    enum variants. These are still rejected semantically, but
    can be seen and parsed by procedural macros and conditional compilation.
  + Compiler
  - Rustc will now warn if you have unused loop `'label`s.
  - Removed support for the `i686-unknown-dragonfly` target.
  - Added tier 3 support\* for the `riscv64gc-unknown-linux-gnu` target.
  - You can now pass an arguments file passing the `@path` syntax
    to rustc. Note that the format differs somewhat from what is
    found in other tooling; please see the documentation for
    more information.
  - You can now provide `--extern` flag without a path, indicating that it is
    available from the search path or specified with an `-L` flag.
    Refer to Rust's [platform support page][forge-platform-support] for more
    information on Rust's tiered platform support.
  + Libraries
  - The `core::panic` module is now stable. It was already stable
    through `std`.
  - `NonZero*` numerics now implement `From&lt;NonZero*&gt;` if it's a smaller integer
    width. E.g. `NonZeroU16` now implements `From&lt;NonZeroU8&gt;`.
  - `MaybeUninit&lt;T&gt;` now implements `fmt::Debug`.
  + Stabilized APIs
  - `Result::map_or`
  - `Result::map_or_else`
  - `std::rc::Weak::weak_count`
  - `std::rc::Weak::strong_count`
  - `std::sync::Weak::weak_count`
  - `std::sync::Weak::strong_count`
  + Cargo
  - Cargo will now document all the private items for binary crates
    by default.
  - `cargo-install` will now reinstall the package if it detects that it is out
    of date.
  - Cargo.lock now uses a more git friendly format that should help to reduce
    merge conflicts.
  - You can now override specific dependencies's build settings. E.g.
    `[profile.dev.package.image] opt-level = 2` sets the `image` crate's
    optimisation level to `2` for debug builds. You can also use
    `[profile.&lt;profile&gt;.build-override]` to override build scripts and
    their dependencies.
  + Misc
  - You can now specify `edition` in documentation code blocks to compile the block
    for that edition. E.g. `edition2018` tells rustdoc that the code sample
    should be compiled the 2018 edition of Rust.
  - You can now provide custom themes to rustdoc with `--theme`, and check the
    current theme with `--check-theme`.
  - You can use `#[cfg(doc)]` to compile an item when building documentation.
  + Compatibility Notes
  - As previously announced 1.41.0 will be the last tier 1 release for 32-bit
    Apple targets. This means that the source code is still
    available to build, but the targets are no longer being tested and release
    binaries for those platforms will no longer be distributed by the Rust project.
    Please refer to the linked blog post for more information.</changelog>
  <changelog author="alarrosa@suse.com" date="1585656000">- Rebased patches:
  + ignore-Wstring-conversion.patch (offset / fuzz)</changelog>
  <changelog author="alarrosa@suse.com" date="1585656001">- Update to version 1.42.0:
  + Language
  - You can now use the slice pattern syntax with subslices.
  - You can now use #[repr(transparent)] on univariant enums. Meaning
    that you can create an enum that has the exact layout and ABI of
    the type it contains.
  - There are some syntax-only changes:
  * default is syntactically allowed before items in trait
    definitions.
  * Items in impls (i.e. consts, types, and fns) may syntactically
    leave out their bodies in favor of ;.
  * Bounds on associated types in impls are now syntactically
    allowed (e.g. type Foo: Ord;).
  * ... (the C-variadic type) may occur syntactically directly
    as the type of any function parameter.
    These are still rejected semantically, so you will likely receive
    an error but these changes can be seen and parsed by procedural
    macros and conditional compilation.
  + Compiler
  - Added tier 2 support for armv7a-none-eabi.
  - Added tier 2 support for riscv64gc-unknown-linux-gnu.
  - Option::{expect,unwrap} and Result::{expect, expect_err, unwrap,
    unwrap_err} now produce panic messages pointing to the location
    where they were called, rather than core's internals.
    Refer to Rust's platform support page for more information on
    Rust's tiered platform support.
  + Libraries
  - iter::Empty&lt;T&gt; now implements Send and Sync for any T.
  - Pin::{map_unchecked, map_unchecked_mut} no longer require the
    return type to implement Sized.
  - io::Cursor now derives PartialEq and Eq.
  - Layout::new is now const.
  - Added Standard Library support for riscv64gc-unknown-linux-gnu.
  + Stabilized APIs
  - CondVar::wait_while
  - CondVar::wait_timeout_while
  - DebugMap::key
  - DebugMap::value
  - ManuallyDrop::take
  - matches!
  - ptr::slice_from_raw_parts_mut
  - ptr::slice_from_raw_parts
  + Cargo
  - You no longer need to include extern crate proc_macro; to be
    able to use proc_macro; in the 2018 edition.
  + Compatibility Notes
  - Error::description has been deprecated, and its use will now
    produce a warning. It's recommended to use Display/to_string
    instead.</changelog>
  <changelog author="schwab@suse.de" date="1586260800">- Avoid duplication of environment settings</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1588161600">- Update to version 1.43.0
  + Language
  - Fixed using binary operations with `&amp;{number}` (e.g. `&amp;1.0`)
    not having the type inferred correctly.
  - Attributes such as `#[cfg()]` can now be used on `if`
    expressions.
  - Syntax only changes:
  * Allow `type Foo: Ord` syntactically.
  * Fuse associated and extern items up to defaultness.
  * Syntactically allow `self` in all `fn` contexts.
  * Merge `fn` syntax + cleanup item parsing.
  * `item` macro fragments can be interpolated into `trait`s,
    `impl`s, and `extern` blocks.
    For example, you may now write:
    ```rust
    macro_rules! mac_trait {
    ($i:item) =&gt; {
    trait T { $i }
    }
    }
    mac_trait! {
    fn foo() {}
    }
    ```
  * These are still rejected *semantically*, so you will likely
    receive an error but these changes can be seen and parsed by
    macros and conditional compilation.
  + Compiler
  - You can now pass multiple lint flags to rustc to override the
    previous flags.
    For example; `rustc -D unused -A unused-variables` denies
    everything in the `unused` lint group except `unused-variables`
    which is explicitly allowed. However, passing
    `rustc -A unused-variables -D unused` denies everything in
    the `unused` lint group **including** `unused-variables` since
    the allow flag is specified before the deny flag (and therefore
    overridden).
  - rustc will now prefer your system MinGW libraries over its
    bundled libraries if they are available on `windows-gnu`.
  - rustc now buffers errors/warnings printed in JSON.
  + Libraries
  - `Arc&lt;[T; N]&gt;`, `Box&lt;[T; N]&gt;`, and `Rc&lt;[T; N]&gt;`, now implement
    `TryFrom&lt;Arc&lt;[T]&gt;&gt;`,`TryFrom&lt;Box&lt;[T]&gt;&gt;`, and `TryFrom&lt;Rc&lt;[T]&gt;&gt;`
    respectively.
  * *Note** These conversions are only available when `N` is
    `0..=32`.
  - You can now use associated constants on floats and integers
    directly, rather than having to import the module.
    e.g. You can now write `u32::MAX` or `f32::NAN` with no imports.
  - `u8::is_ascii` is now `const`.
  - `String` now implements `AsMut&lt;str&gt;`.
  - Added the `primitive` module to `std` and `core`.
    This module reexports Rust's primitive types. This is mainly
    useful in macros where you want avoid these types being shadowed.
  - Relaxed some of the trait bounds on `HashMap` and `HashSet`.
  - `string::FromUtf8Error` now implements `Clone + Eq`.
  + Stabilized APIs
  - `Once::is_completed`
  - `f32::LOG10_2`
  - `f32::LOG2_10`
  - `f64::LOG10_2`
  - `f64::LOG2_10`
  - `iter::once_with`
  + Cargo
  - You can now set config `[profile]`s in your `.cargo/config`,
    or through your environment.
  - Cargo will now set `CARGO_BIN_EXE_&lt;name&gt;` pointing to a
    binary's executable path when running integration tests or
    benchmarks.
    `&lt;name&gt;` is the name of your binary as-is e.g. If you wanted
    the executable path for a binary named `my-program`you would
    use `env!("CARGO_BIN_EXE_my-program")`.
  + Misc
  - Certain checks in the `const_err` lint were deemed unrelated
    to const evaluation, and have been moved to the
    `unconditional_panic` and `arithmetic_overflow` lints.
  + Compatibility Notes
  - Having trailing syntax in the `assert!` macro is now a hard
    error. This has been a warning since 1.36.0.
  - Fixed `Self` not having the correctly inferred type. This
    incorrectly led to some instances being accepted, and now
    correctly emits a hard error.</changelog>
  <changelog author="schwab@suse.de" date="1588593600">- Update rustfmt_version</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1589457600">- Update to version 1.43.1
  - Updated openssl-src to 1.1.1g for CVE-2020-1967.
  - Fixed the stabilization of AVX-512 features.
  - Fixed `cargo package --list` not working with unpublished
    dependencies.
- Check upstream signatures for binaries
- Add rust.keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1592827200">- Add patch Fix-big-endian-miscompile-of-bitcast-zex.patch
  to fix miscompilations with rustc 1.43 that lead to LTO failures
  (bsc#1173202)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1627387200">- Needed for Firefox91 (bsc#1188891)
- Rebased patches:
  + ignore-Wstring-conversion.patch (offset / fuzz)
  + Fix-big-endian-miscompile-of-bitcast-zex.patch dropped
- Add support for riscv64
- Make all shared libraries in %{common_libdir} executable; otherwise
  fdupes will not find any duplicates in %{rustlibdir}.
- rust-rpmlintrc: Reflect updated LLVM name in the filter.
- &lt;https://github.com/rust-lang/rust/issues/74976&gt;: Add "--stage 1"
  to the "./x.py doc" call to ensure the newly built compiler gets
  used.
- Resolve issue in constraints to select aarch64 builders in OBS that
  have correctly functioning CPU's.
- Resolve issue with zlib selection and buildrequires.
- Correct build issues with esoteric cpu architectures, by removing
  developer facing tools in some cases.
- Updates to spec file and legacy cleanups during build processes
- Correct issues with incorrect tuning of codegen units that caused
  builders to OOM
- Update to version 1.53:
  + Language
  - [You can now use unicode for identifiers.][83799] This allows multilingual
    identifiers but still doesn't allow glyphs that are not considered characters
    such as `?` or `?`. More specifically you can now use any identifier that
    matches the UAX #31 "Unicode Identifier and Pattern Syntax" standard. This
    is the same standard as languages like Python, however Rust uses NFC
    normalization which may be different from other languages.
  - [You can now specify "or patterns" inside pattern matches.][79278]
    Previously you could only use `|` (OR) on complete patterns. E.g.
    ```rust
    let x = Some(2u8);
    // Before
    matches!(x, Some(1) | Some(2));
    // Now
    matches!(x, Some(1 | 2));
    ```
  - [Added the `:pat_param` `macro_rules!` matcher.][83386] This matcher
    has the same semantics as the `:pat` matcher. This is to allow `:pat`
    to change semantics to being a pattern fragment in a future edition.
  + Compiler
  - [Updated the minimum external LLVM version to LLVM 10.][83387]
  - [Added Tier 3\* support for the `wasm64-unknown-unknown` target.][80525]
  - [Improved debuginfo for closures and async functions on Windows MSVC.][83941]
    \* Refer to Rust's [platform support page][platform-support-doc] for more
    information on Rust's tiered platform support.
  + Libraries
  - [Abort messages will now forward to `android_set_abort_message` on
    Android platforms when available.][81469]
  - [`slice::IterMut&lt;'_, T&gt;` now implements `AsRef&lt;[T]&gt;`][82771]
  - [Arrays of any length now implement `IntoIterator`.][84147]
    Currently calling `.into_iter()` as a method on an array will
    return `impl Iterator&lt;Item=&amp;T&gt;`, but this may change in a
    future edition to change `Item` to `T`. Calling `IntoIterator::into_iter`
    directly on arrays will provide `impl Iterator&lt;Item=T&gt;` as expected.
  - [`leading_zeros`, and `trailing_zeros` are now available on all
    `NonZero` integer types.][84082]
  - [`{f32, f64}::from_str` now parse and print special values
    (`NaN`, `-0`) according to IEEE RFC 754.][78618]
  - [You can now index into slices using `(Bound&lt;usize&gt;, Bound&lt;usize&gt;)`.][77704]
  - [Add the `BITS` associated constant to all numeric types.][82565]
  + Cargo
  - [Cargo now supports git repositories where the default `HEAD` branch is not
    "master".][cargo/9392] This also includes a switch to the version 3 `Cargo.lock` format
    which can handle default branches correctly.
  - [macOS targets now default to `unpacked` split-debuginfo.][cargo/9298]
  - [The `authors` field is no longer included in `Cargo.toml` for new
    projects.][cargo/9282]
  + Rustdoc
  - [Added the `rustdoc::bare_urls` lint that warns when you have URLs
    without hyperlinks.][81764]
  + Compatibility Notes
  - [Implement token-based handling of attributes during expansion][82608]
  - [`Ipv4::from_str` will now reject octal format IP addresses in addition
    to rejecting hexadecimal IP addresses.][83652] The octal format can lead
    to confusion and potential security vulnerabilities and [is no
    longer recommended][ietf6943].
- Update to version 1.52:
  + Language
  - [Added the `unsafe_op_in_unsafe_fn` lint, which checks whether the unsafe code
    in an `unsafe fn` is wrapped in a `unsafe` block.][79208] This lint
    is allowed by default, and may become a warning or hard error in a
    future edition.
  - [You can now cast mutable references to arrays to a pointer of the same type as
    the element.][81479]
  + Compiler
  - [Upgraded the default LLVM to LLVM 12.][81451]
  - Added tier 3\* support for the following targets.
  - [`s390x-unknown-linux-musl`][82166]
  - [`riscv32gc-unknown-linux-musl` &amp; `riscv64gc-unknown-linux-musl`][82202]
  - [`powerpc-unknown-openbsd`][82733]
  + Libraries
  - [`OsString` now implements `Extend` and `FromIterator`.][82121]
  - [`cmp::Reverse` now has `#[repr(transparent)]` representation.][81879]
  - [`Arc&lt;impl Error&gt;` now implements `error::Error`.][80553]
  - [All integer division and remainder operations are now `const`.][80962]
  + Stabilised APIs
  - [`Arguments::as_str`]
  - [`char::MAX`]
  - [`char::REPLACEMENT_CHARACTER`]
  - [`char::UNICODE_VERSION`]
  - [`char::decode_utf16`]
  - [`char::from_digit`]
  - [`char::from_u32_unchecked`]
  - [`char::from_u32`]
  - [`slice::partition_point`]
  - [`str::rsplit_once`]
  - [`str::split_once`]
    The following previously stable APIs are now `const`.
  - [`char::len_utf8`]
  - [`char::len_utf16`]
  - [`char::to_ascii_uppercase`]
  - [`char::to_ascii_lowercase`]
  - [`char::eq_ignore_ascii_case`]
  - [`u8::to_ascii_uppercase`]
  - [`u8::to_ascii_lowercase`]
  - [`u8::eq_ignore_ascii_case`]
  + Rustdoc
  - [Rustdoc lints are now treated as a tool lint, meaning that
    lints are now prefixed with `rustdoc::` (e.g. `#[warn(rustdoc::non_autolinks)]`).][80527]
    Using the old style is still allowed, and will become a warning in
    a future release.
  - [Rustdoc now supports argument files.][82261]
  - [Rustdoc now generates smart punctuation for documentation.][79423]
  - [You can now use "task lists" in Rustdoc Markdown.][81766] E.g.
    ```markdown
  - [x] Complete
  - [ ] Todo
    ```
  + Misc
  - [You can now pass multiple filters to tests.][81356] E.g.
    `cargo test -- foo bar` will run all tests that match `foo` and `bar`.
  - [Rustup now distributes PDB symbols for the `std` library on Windows,
    allowing you to see `std` symbols when debugging.][82218]
  + Internal Only
    These changes provide no direct user facing benefits, but represent significant
    improvements to the internals and overall performance of rustc and
    related tools.
  - [Check the result cache before the DepGraph when ensuring queries][81855]
  - [Try fast_reject::simplify_type in coherence before doing full check][81744]
  - [Only store a LocalDefId in some HIR nodes][81611]
  - [Store HIR attributes in a side table][79519]
  + Compatibility Notes
  - ------------------
  - [Cargo build scripts are now forbidden from setting `RUSTC_BOOTSTRAP`.][cargo/9181]
  - [Removed support for the `x86_64-rumprun-netbsd` target.][82594]
  - [Deprecated the `x86_64-sun-solaris` target in favor of `x86_64-pc-solaris`.][82216]
  - [Rustdoc now only accepts `,`, ` `, and `\t` as delimiters for specifying
    languages in code blocks.][78429]
  - [Rustc now catches more cases of `pub_use_of_private_extern_crate`][80763]
  - [Changes in how proc macros handle whitespace may lead to panics when used
    with older `proc-macro-hack` versions. A `cargo update` should be sufficient to fix
    this in all cases.][84136]
- Update to version 1.51:
  + Language
  - [You can now parameterize items such as functions, traits, and `struct`s by constant
    values in addition to by types and lifetimes.][79135] Also known as "const generics"
    E.g. you can now write the following. Note: Only values of primitive integers,
    `bool`, or `char` types are currently permitted.
  + Compiler
  - [Added the `-Csplit-debuginfo` codegen option for macOS platforms.][79570]
    This option controls whether debug information is split across multiple files
    or packed into a single file. **Note** This option is unstable on other platforms.
  - [Added tier 3\* support for `aarch64_be-unknown-linux-gnu`,
    `aarch64-unknown-linux-gnu_ilp32`, and `aarch64_be-unknown-linux-gnu_ilp32` targets.][81455]
  - [Added tier 3 support for `i386-unknown-linux-gnu` and `i486-unknown-linux-gnu` targets.][80662]
  - [The `target-cpu=native` option will now detect individual features of CPUs.][80749]
    \* Refer to Rust's [platform support page][platform-support-doc] for more
    information on Rust's tiered platform support.
  + Libraries
  - [`Box::downcast` is now also implemented for any `dyn Any + Send + Sync` object.][80945]
  - [`str` now implements `AsMut&lt;str&gt;`.][80279]
  - [`u64` and `u128` now implement `From&lt;char&gt;`.][79502]
  - [`Error` is now implemented for `&amp;T` where `T` implements `Error`.][75180]
  - [`Poll::{map_ok, map_err}` are now implemented for `Poll&lt;Option&lt;Result&lt;T, E&gt;&gt;&gt;`.][80968]
  - [`unsigned_abs` is now implemented for all signed integer types.][80959]
  - [`io::Empty` now implements `io::Seek`.][78044]
  - [`rc::Weak&lt;T&gt;` and `sync::Weak&lt;T&gt;`'s methods such as `as_ptr` are now implemented for
    `T: ?Sized` types.][80764]
  + Stabilized APIs
  - [`Arc::decrement_strong_count`]
  - [`Arc::increment_strong_count`]
  - [`Once::call_once_force`]
  - [`Peekable::next_if_eq`]
  - [`Peekable::next_if`]
  - [`Seek::stream_position`]
  - [`array::IntoIter`]
  - [`panic::panic_any`]
  - [`ptr::addr_of!`]
  - [`ptr::addr_of_mut!`]
  - [`slice::fill_with`]
  - [`slice::split_inclusive_mut`]
  - [`slice::split_inclusive`]
  - [`slice::strip_prefix`]
  - [`slice::strip_suffix`]
  - [`str::split_inclusive`]
  - [`sync::OnceState`]
  - [`task::Wake`]
  + Cargo
  - [Added the `split-debuginfo` profile option to control the -Csplit-debuginfo
    codegen option.][cargo/9112]
  - [Added the `resolver` field to `Cargo.toml` to enable the new feature resolver
    and CLI option behavior.][cargo/8997] Version 2 of the feature resolver will try
    to avoid unifying features of dependencies where that unification could be unwanted.
    Such as using the same dependency with a `std` feature in a build scripts and
    proc-macros, while using the `no-std` feature in the final binary. See the
    [Cargo book documentation][feature-resolver@2.0] for more information on the feature.
  + Rustdoc
  - [Rustdoc will now include documentation for methods available from _nested_ `Deref` traits.][80653]
  - [You can now provide a `--default-theme` flag which sets the default theme to use for
    documentation.][79642]
    Various improvements to intra-doc links:
  - [You can link to non-path primitives such as `slice`.][80181]
  - [You can link to associated items.][74489]
  - [You can now include generic parameters when linking to items, like `Vec&lt;T&gt;`.][76934]
  + Misc
  - [You can now pass `--include-ignored` to tests (e.g. with
    `cargo test -- --include-ignored`) to include testing tests marked `#[ignore]`.][80053]
  + Compatibility Notes
  - [WASI platforms no longer use the `wasm-bindgen` ABI, and instead use the wasm32 ABI.][79998]
  - [`rustc` no longer promotes division, modulo and indexing operations to `const` that
    could fail.][80579]
  - [The minimum version of glibc for the following platforms has been bumped to version 2.31
    for the distributed artifacts.][81521]
  - `armv5te-unknown-linux-gnueabi`
  - `sparc64-unknown-linux-gnu`
  - `thumbv7neon-unknown-linux-gnueabihf`
  - `armv7-unknown-linux-gnueabi`
  - `x86_64-unknown-linux-gnux32`
- Update to version 1.50:
  * This fixes build on armv7 - boo#1181643
  + Language
  - You can now use const values for x in [x; N] array expressions.
    This has been technically possible since 1.38.0, as it was
    unintentionally stabilized.
  - Assignments to ManuallyDrop&lt;T&gt; union fields are now considered safe.
  + Compiler
  - Added tier 3* support for the armv5te-unknown-linux-uclibceabi
    target.
  - Added tier 3 support for the aarch64-apple-ios-macabi target.
  - The x86_64-unknown-freebsd is now built with the full toolset.
  - Dropped support for all cloudabi targets.
  * Refer to Rust's platform support page for more information on
    Rust's tiered platform support.
  + Libraries
  - proc_macro::Punct now implements PartialEq&lt;char&gt;.
  - ops::{Index, IndexMut} are now implemented for fixed sized
    arrays of any length.
  - On Unix platforms, the std::fs::File type now has a "niche" of -1.
    This value cannot be a valid file descriptor, and now means Option&lt;File&gt;
    takes up the same amount of space as File.
  + Stabilized APIs
    bool::then
    btree_map::Entry::or_insert_with_key
    f32::clamp
    f64::clamp
    hash_map::Entry::or_insert_with_key
    Ord::clamp
    RefCell::take
    slice::fill
    UnsafeCell::get_mut
  - The following previously stable methods are now const.
    IpAddr::is_ipv4
    IpAddr::is_ipv6
    IpAddr::is_unspecified
    IpAddr::is_loopback
    IpAddr::is_multicast
    Ipv4Addr::octets
    Ipv4Addr::is_loopback
    Ipv4Addr::is_private
    Ipv4Addr::is_link_local
    Ipv4Addr::is_multicast
    Ipv4Addr::is_broadcast
    Ipv4Addr::is_documentation
    Ipv4Addr::to_ipv6_compatible
    Ipv4Addr::to_ipv6_mapped
    Ipv6Addr::segments
    Ipv6Addr::is_unspecified
    Ipv6Addr::is_loopback
    Ipv6Addr::is_multicast
    Ipv6Addr::to_ipv4
    Layout::size
    Layout::align
    Layout::from_size_align
    pow for all integer types.
    checked_pow for all integer types.
    saturating_pow for all integer types.
    wrapping_pow for all integer types.
    next_power_of_two for all unsigned integer types.
    checked_next_power_of_two for all unsigned integer types.
  + Cargo
  - Added the [build.rustc-workspace-wrapper] option. This option
    sets a wrapper to execute instead of rustc, for workspace members only.
  - cargo:rerun-if-changed will now, if provided a directory,
    scan the entire contents of that directory for changes.
  - Added the --workspace flag to the cargo update command.
  + Misc
  - The search results tab and the help button are focusable
    with keyboard in rustdoc.
  - Running tests will now print the total time taken to execute.
  + Compatibility Notes
  - The compare_and_swap method on atomics has been deprecated.
    It's recommended to use the compare_exchange and
    compare_exchange_weak methods instead.
  - Changes in how TokenStreams are checked have fixed some cases
    where you could write unhygenic macro_rules! macros.
  - #![test] as an inner attribute is now considered unstable
    like other inner macro attributes, and reports an error by
    default through the soft_unstable lint.
  - Overriding a forbid lint at the same level that it was set
    is now a hard error.
  - You can no longer intercept panic! calls by supplying your own
    macro. It's recommended to use the #[panic_handler] attribute
    to provide your own implementation.
  - Semi-colons after item statements (e.g. struct Foo {};)
    now produce a warning.
- Update to version 1.49.0
  + Language
  - Unions can now implement Drop, and you can now have a field in
    a union with ManuallyDrop&lt;T&gt;.
  - You can now cast uninhabited enums to integers.
  - You can now bind by reference and by move in patterns. This
    allows you to selectively borrow individual components of a type.
    E.g.
    [#][derive(Debug)]
    struct Person {
    name: String,
    age: u8,
    }
    let person = Person {
    name: String::from("Alice"),
    age: 20,
    };
    // `name` is moved out of person, but `age` is referenced.
    let Person { name, ref age } = person;
    println!("{} {}", name, age);
  + Compiler
  - Added tier 1* support for aarch64-unknown-linux-gnu.
  - Added tier 2 support for aarch64-apple-darwin.
  - Added tier 2 support for aarch64-pc-windows-msvc.
  - Added tier 3 support for mipsel-unknown-none.
  - Raised the minimum supported LLVM version to LLVM 9.
  - Output from threads spawned in tests is now captured.
  - Change os and vendor values to "none" and "unknown" for some targets
  * Refer to Rust's platform support page for more information on Rust's
    tiered platform support.
  + Libraries
  - RangeInclusive now checks for exhaustion when calling contains and
    indexing.
  - ToString::to_string now no longer shrinks the internal buffer in
    the default implementation.
  - ops::{Index, IndexMut} are now implemented for fixed sized arrays
    of any length.
  + Stabilized APIs
  - slice::select_nth_unstable
  - slice::select_nth_unstable_by
  - slice::select_nth_unstable_by_key
  The following previously stable methods are now const.
  - Poll::is_ready
  - Poll::is_pending
  + Cargo
  - Building a crate with cargo-package should now be independently
    reproducible.
  - cargo-tree now marks proc-macro crates.
  - Added CARGO_PRIMARY_PACKAGE build-time environment variable. This
    variable will be set if the crate being built is one the user
    selected to build, either with -p or through defaults.
  - You can now use glob patterns when specifying packages &amp; targets.
  + Compatibility Notes
  - Demoted i686-unknown-freebsd from host tier 2 to target tier 2
    support.
  - Macros that end with a semi-colon are now treated as statements
    even if they expand to nothing.
  - Rustc will now check for the validity of some built-in attributes
    on enum variants. Previously such invalid or unused attributes
    could be ignored.
  - Leading whitespace is stripped more uniformly in documentation
    comments, which may change behavior. You read this post about
    the changes for more details.
  - Trait bounds are no longer inferred for associated types.
  + Internal Only
  These changes provide no direct user facing benefits, but
  represent significant improvements to the internals and overall
  performance of rustc and related tools.
  - rustc's internal crates are now compiled using the initial-exec
    Thread Local Storage model.
  - Calculate visibilities once in resolve.
  - Added system to the llvm-libunwind bootstrap config option.
  - Added --color for configuring terminal color support to bootstrap.
- Update to version 1.48.0
  + Language
  - The `unsafe` keyword is now syntactically permitted on modules.
    This is still rejected semantically, but can now be parsed by procedural
    macros.
  + Compiler
  - Stabilised the `-C link-self-contained=&lt;yes|no&gt;` compiler flag.
    This tells `rustc` whether to link its own C runtime and libraries or to
    rely on a external linker to find them. (Supported only on `windows-gnu`,
    `linux-musl`, and `wasi` platforms.)
  - You can now use `-C target-feature=+crt-static` on `linux-gnu` targets.
    Note: If you're using cargo you must explicitly pass the `--target` flag.
  - Added tier 2* support for aarch64-unknown-linux-musl.
  * Refer to Rust's platform support page for more information on Rust's
    tiered platform support.
  + Libraries
  - io::Write is now implemented for &amp;ChildStdin &amp;Sink, &amp;Stdout, and &amp;Stderr.
  - All arrays of any length now implement TryFrom&lt;Vec&lt;T&gt;&gt;.
  - The matches! macro now supports having a trailing comma.
  - Vec&lt;A&gt; now implements PartialEq&lt;[B]&gt; where A: PartialEq&lt;B&gt;.
  - The RefCell::{replace, replace_with, clone} methods now all use #[track_caller].
  + Stabilized APIs
  - slice::as_ptr_range
  - slice::as_mut_ptr_range
  - VecDeque::make_contiguous
  - future::pending
  - future::ready
  The following previously stable methods are now `const fn's`:
  - Option::is_some
  - Option::is_none
  - Option::as_ref
  - Result::is_ok
  - Result::is_err
  - Result::as_ref
  - Ordering::reverse
  - Ordering::then
  + Cargo
  + Rustdoc
  - You can now link to items in rustdoc using the intra-doc link syntax.
    E.g. /// Uses [`std::future`] will automatically generate a link to
    std::future's documentation. See "Linking to items by name" for more
    information.
  - You can now specify #[doc(alias = "&lt;alias&gt;")] on items to add search
    aliases when searching through rustdoc's UI.
  + Compatibility Notes
  - Promotion of references to 'static lifetime inside const fn now
    follows the same rules as inside a fn body. In particular, &amp;foo()
    will not be promoted to 'static lifetime any more inside const fns.
  - Associated type bindings on trait objects are now verified to meet
    the bounds declared on the trait when checking that they implement
    the trait.
  - When trait bounds on associated types or opaque types are ambiguous,
    the compiler no longer makes an arbitrary choice on which bound to use.
  - Fixed recursive nonterminals not being expanded in macros during
    pretty-print/reparse check. This may cause errors if your macro
    wasn't correctly handling recursive nonterminal tokens.
  - &amp;mut references to non zero-sized types are no longer promoted.
  - rustc will now warn if you use attributes like #[link_name] or
    [#][cold] in places where they have no effect.
  - Updated _mm256_extract_epi8 and _mm256_extract_epi16 signatures
    in arch::{x86, x86_64} to return i32 to match the vendor signatures.
  - mem::uninitialized will now panic if any inner types inside a struct
    or enum disallow zero-initialization.
  - #[target_feature] will now error if used in a place where it has no effect.
  - Foreign exceptions are now caught by catch_unwind and will cause an
    abort. Note: This behaviour is not guaranteed and is still considered
    undefined behaviour, see the catch_unwind documentation for further
    information.
  + Internal Only
    These changes provide no direct user facing benefits, but represent
    significant improvements to the internals and overall performance of
    rustc and related tools.
  - Building rustc from source now uses ninja by default over make.
    You can continue building with make by setting ninja=false in
    your config.toml.
  - cg_llvm: fewer_names in uncached_llvm_type
  - Made ensure_sufficient_stack() non-generic
- Update to version 1.47.0
  + Language
  - [Closures will now warn when not used.][74869]
  + Compiler
  - [Stabilized the `-C control-flow-guard` codegen option][73893], which enables
    [Control Flow Guard][1.47.0-cfg] for Windows platforms, and is ignored on other
    platforms.
  - [Upgraded to LLVM 11.][73526]
  - [Added tier 3\* support for the `thumbv4t-none-eabi` target.][74419]
  - [Upgrade the FreeBSD toolchain to version 11.4][75204]
  - [`RUST_BACKTRACE`'s output is now more compact.][75048]
  \* Refer to Rust's [platform support page][forge-platform-support] for more
  information on Rust's tiered platform support.
  + Libraries
  - [`CStr` now implements `Index&lt;RangeFrom&lt;usize&gt;&gt;`.][74021]
  - [Traits in `std`/`core` are now implemented for arrays of any length, not just
    those of length less than 33.][74060]
  - [`ops::RangeFull` and `ops::Range` now implement Default.][73197]
  - [`panic::Location` now implements `Copy`, `Clone`, `Eq`, `Hash`, `Ord`,
    `PartialEq`, and `PartialOrd`.][73583]
  + Stabilized APIs
  - [`Ident::new_raw`]
  - [`Range::is_empty`]
  - [`RangeInclusive::is_empty`]
  - [`Result::as_deref`]
  - [`Result::as_deref_mut`]
  - [`Vec::leak`]
  - [`pointer::offset_from`]
  - [`f32::TAU`]
  - [`f64::TAU`]
  The following previously stable APIs have now been made const.
  - [The `new` method for all `NonZero` integers.][73858]
  - [The `checked_add`,`checked_sub`,`checked_mul`,`checked_neg`, `checked_shl`,
    `checked_shr`, `saturating_add`, `saturating_sub`, and `saturating_mul`
    methods for all integers.][73858]
  - [The `checked_abs`, `saturating_abs`, `saturating_neg`, and `signum`  for all
    signed integers.][73858]
  - [The `is_ascii_alphabetic`, `is_ascii_uppercase`, `is_ascii_lowercase`,
    `is_ascii_alphanumeric`, `is_ascii_digit`, `is_ascii_hexdigit`,
    `is_ascii_punctuation`, `is_ascii_graphic`, `is_ascii_whitespace`, and
    `is_ascii_control` methods for `char` and `u8`.][73858]
  + Cargo
  - [`build-dependencies` are now built with opt-level 0 by default.][cargo/8500]
    You can override this by setting the following in your `Cargo.toml`.
    ```toml
    [profile.release.build-override]
    opt-level = 3
    ```
  - [`cargo-help` will now display man pages for commands rather just the
    `--help` text.][cargo/8456]
  - [`cargo-metadata` now emits a `test` field indicating if a target has
    tests enabled.][cargo/8478]
  - [`workspace.default-members` now respects `workspace.exclude`.][cargo/8485]
  - [`cargo-publish` will now use an alternative registry by default if it's the
    only registry specified in `package.publish`.][cargo/8571]
  + Misc
  - [Added a help button beside Rustdoc's searchbar that explains rustdoc's
    type based search.][75366]
  - [Added the Ayu theme to rustdoc.][71237]
- Update to version 1.46.0
  + Language
  - [`if`, `match`, and `loop` expressions can now be used in const functions.][72437]
  - [Additionally you are now also able to coerce and cast to slices (`&amp;[T]`) in
    const functions.][73862]
  - [The `#[track_caller]` attribute can now be added to functions to use the
    function's caller's location information for panic messages.][72445]
  - [Recursively indexing into tuples no longer needs parentheses.][71322] E.g.
    `x.0.0` over `(x.0).0`.
  - [`mem::transmute` can now be used in statics and constants.][72920] **Note**
    You currently can't use `mem::transmute` in constant functions.
  + Compiler
  - [You can now use the `cdylib` target on Apple iOS and tvOS platforms.][73516]
  - [Enabled static "Position Independent Executables" by default
    for `x86_64-unknown-linux-musl`.][70740]
  + Libraries
  - [`mem::forget` is now a `const fn`.][73887]
  - [`String` now implements `From&lt;char&gt;`.][73466]
  - [The `leading_ones`, and `trailing_ones` methods have been stabilised for all
    integer types.][73032]
  - [`vec::IntoIter&lt;T&gt;` now implements `AsRef&lt;[T]&gt;`.][72583]
  - [All non-zero integer types (`NonZeroU8`) now implement `TryFrom` for their
    zero-able equivalent (e.g. `TryFrom&lt;u8&gt;`).][72717]
  - [`&amp;[T]` and `&amp;mut [T]` now implement `PartialEq&lt;Vec&lt;T&gt;&gt;`.][71660]
  - [`(String, u16)` now implements `ToSocketAddrs`.][73007]
  - [`vec::Drain&lt;'_, T&gt;` now implements `AsRef&lt;[T]&gt;`.][72584]
  + Stabilized APIs
  - [`Option::zip`]
  - [`vec::Drain::as_slice`]
  + Cargo
    Added a number of new environment variables that are now available when
    compiling your crate.
  - [`CARGO_BIN_NAME` and `CARGO_CRATE_NAME`][cargo/8270] Providing the name of
    the specific binary being compiled and the name of the crate.
  - [`CARGO_PKG_LICENSE`][cargo/8325] The license from the manifest of the package.
  - [`CARGO_PKG_LICENSE_FILE`][cargo/8387] The path to the license file.
- Update to version 1.44.1
  * rustfmt accepts rustfmt_skip in cfg_attr again.
  * Don't hash executable filenames on apple platforms, fixing backtraces.
  * Fix crashes when finding backtrace on macOS.
  * Clippy applies lint levels into different files.
- Update to version 1.44.0
  + Language
  - You can now use `async/.await` with `#[no_std]` enabled.
  - Added the `unused_braces` lint.
  - Expansion-driven outline module parsing
  + Compiler
  - Rustc now respects the `-C codegen-units` flag in incremental mode.
    Additionally when in incremental mode rustc defaults to 256 codegen units.
  - Refactored `catch_unwind` to have zero-cost, unless unwinding is enabled and
    a panic is thrown.
  - Added tier 3\* support for the `aarch64-unknown-none` and
    `aarch64-unknown-none-softfloat` targets.
  - Added tier 3 support for `arm64-apple-tvos` and
    `x86_64-apple-tvos` targets.
  + Libraries
  - Special cased `vec![]` to map directly to `Vec::new()`. This allows
    `vec![]` to be able to be used in `const` contexts.
  - `convert::Infallible` now implements `Hash`.
  - `OsString` now implements `DerefMut` and `IndexMut` returning
    a `&amp;mut OsStr`.
  - Unicode 13 is now supported.
  - `String` now implements `From&lt;&amp;mut str&gt;`.
  - `IoSlice` now implements `Copy`.
  - `Vec&lt;T&gt;` now implements `From&lt;[T; N]&gt;`. Where `N` is at most 32.
  - `proc_macro::LexError` now implements `fmt::Display` and `Error`.
  - `from_le_bytes`, `to_le_bytes`, `from_be_bytes`, `to_be_bytes`,
    `from_ne_bytes`, and `to_ne_bytes` methods are now `const` for all
    integer types.
  + Stabilizd APIs
  - [`PathBuf::with_capacity`]
  - [`PathBuf::capacity`]
  - [`PathBuf::clear`]
  - [`PathBuf::reserve`]
  - [`PathBuf::reserve_exact`]
  - [`PathBuf::shrink_to_fit`]
  - [`f32::to_int_unchecked`]
  - [`f64::to_int_unchecked`]
  - [`Layout::align_to`]
  - [`Layout::pad_to_align`]
  - [`Layout::array`]
  - [`Layout::extend`]
  + Cargo
  - Added the `cargo tree` command which will print a tree graph of
    your dependencies
  + Misc
  - Rustdoc now allows you to specify `--crate-version` to have rustdoc include
    the version in the sidebar.
  + Compatibility Notes
  - Rustc now correctly generates static libraries on Windows GNU targets with
    the `.a` extension, rather than the previous `.lib`.
  - Removed the `-C no_integrated_as` flag from rustc.
  - The `file_name` property in JSON output of macro errors now points the actual
    source file rather than the previous format of `&lt;NAME macros&gt;`.
  * *Note:** this may not point to a file that actually exists on the user's system.
  - The minimum required external LLVM version has been bumped to LLVM 8.
  - `mem::{zeroed, uninitialised}` will now panic when used with types that do
    not allow zero initialization such as `NonZeroU8`. This was
    previously a warning.
  - In 1.45.0 (the next release) converting a `f64` to `u32` using the `as`
    operator has been defined as a saturating operation. This was previously
    undefined behaviour, but you can use the `{f64, f32}::to_int_unchecked` methods to
    continue using the current behaviour, which may be desirable in rare performance
    sensitive situations.</changelog>
  <changelog author="william.brown@suse.com" date="1642680000">- bsc#1194767 - CVE-2022-21658 - Resolve race condition in std::fs::remove_dir_all
  - 0001-Fix-CVE-2022-21658-for-UNIX-like.patch</changelog>
</package>
<package pkgid="02e2cf40eaebc1dd1d0cd685499dd296a3f7a3e6eb7d7d8453c6a66c17fffed8" name="rust-analysis" arch="x86_64">
  <version epoch="0" ver="1.53.0" rel="22.1"/>
  <changelog author="luke@ljones.dev" date="1569844800">- Add patch add-option-to-allow-warnings.patch to add a config option
  which allows warnings and so enables v1.38 to bootstrap itself.</changelog>
  <changelog author="rhafer@suse.com" date="1571832000">- Switch to bundled version of libgit2 for now. libgit2-sys seems
  to expect using the bundled variant, which just seems to point
  to a snapshot of the master branch and doesn't match any released
  libgit2 (bsc#1154817).
  See: https://github.com/rust-lang/rust/issues/63476 and
  https://github.com/rust-lang/git2-rs/issues/458 for details.</changelog>
  <changelog author="aplanas@suse.com" date="1573128000">- Update to version 1.39.0
  + Language
  - You can now create async functions and blocks with async fn,
    async move {}, and async {} respectively, and you can now call
    .await on async expressions.
  - You can now use certain attributes on function, closure, and
    function pointer parameters.
  - You can now take shared references to bind-by-move patterns in
    the if guards of match arms.
  + Compiler
  - Added tier 3 support for the i686-unknown-uefi target.
  - Added tier 3 support for the sparc64-unknown-openbsd target.
  - rustc will now trim code snippets in diagnostics to fit in your
    terminal.
  - You can now pass --show-output argument to test binaries to
    print the output of successful tests.
  + For more details:
    https://github.com/rust-lang/rust/blob/stable/RELEASES.md#version-1390-2019-11-07
- Drop patches already merged in upstream:
  + rust-61206-assume-tarball-llvm-is-fresh.patch
  + add-option-to-allow-warnings.patch</changelog>
  <changelog author="aplanas@suse.com" date="1573214400">- Add hopefully-fix-rustdoc-build.patch to fix rustdoc compilation</changelog>
  <changelog author="aplanas@suse.com" date="1574683200">- Re-format the spec file
- Add a README to explain the update process
- Add _service file for download the assets and re-base the patches</changelog>
  <changelog author="ngompa13@gmail.com" date="1575028800">- Rename README to README.suse-maint and add it as a source
  to stop factory-auto from declining submissions automatically</changelog>
  <changelog author="opensuse-packaging@opensuse.org" date="1577707200">- Rebased patches:
  + hopefully-fix-rustdoc-build.patch dropped (merged upstream)</changelog>
  <changelog author="luke@ljones.dev" date="1577707201">- Update to version 1.40.0
  + Language
  - You can now use tuple `struct`s and tuple `enum` variant's constructors in
    `const` contexts. e.g.
    pub struct Point(i32, i32);
    const ORIGIN: Point = {
    let constructor = Point;
    constructor(0, 0)
    };
  - You can now mark `struct`s, `enum`s, and `enum` variants with the `#[non_exhaustive]` attribute to
    indicate that there may be variants or fields added in the future.
    For example this requires adding a wild-card branch (`_ =&gt; {}`) to any match
    statements on a non-exhaustive `enum`.
  - You can now use function-like procedural macros in `extern` blocks and in
    type positions. e.g. `type Generated = macro!();`
  - Function-like and attribute procedural macros can now emit
    `macro_rules!` items, so you can now have your macros generate macros.
  - The `meta` pattern matcher in `macro_rules!` now correctly matches the modern
    attribute syntax. For example `(#[$m:meta])` now matches `#[attr]`,
    `#[attr{tokens}]`, `#[attr[tokens]]`, and `#[attr(tokens)]`.
  + Compiler
  - Added tier 3 support\* for the
    `thumbv7neon-unknown-linux-musleabihf` target.
  - Added tier 3 support for the
    `aarch64-unknown-none-softfloat` target.
  - Added tier 3 support for the `mips64-unknown-linux-muslabi64`, and
    `mips64el-unknown-linux-muslabi64` targets.
  + Libraries
  - The `is_power_of_two` method on unsigned numeric types is now a `const` function.
  + Stabilized APIs
  - BTreeMap::get_key_value
  - HashMap::get_key_value
  - Option::as_deref_mut
  - Option::as_deref
  - Option::flatten
  - UdpSocket::peer_addr
  - f32::to_be_bytes
  - f32::to_le_bytes
  - f32::to_ne_bytes
  - f64::to_be_bytes
  - f64::to_le_bytes
  - f64::to_ne_bytes
  - f32::from_be_bytes
  - f32::from_le_bytes
  - f32::from_ne_bytes
  - f64::from_be_bytes
  - f64::from_le_bytes
  - f64::from_ne_bytes
  - mem::take
  - slice::repeat
  - todo!
  + Cargo
  - Cargo will now always display warnings, rather than only on
    fresh builds.
  - Feature flags (except `--all-features`) passed to a virtual workspace will
    now produce an error. Previously these flags were ignored.
  - You can now publish `dev-dependencies` without including
    a `version`.
  + Misc
  - You can now specify the `#[cfg(doctest)]` attribute to include an item only
    when running documentation tests with `rustdoc`.
  + Compatibility Notes
  - As previously announced, any previous NLL warnings in the 2015 edition are
    now hard errors.
  - The `include!` macro will now warn if it failed to include the
    entire file. The `include!` macro unintentionally only includes the
    first _expression_ in a file, and this can be unintuitive. This will become
    either a hard error in a future release, or the behavior may be fixed to include all expressions as expected.
  - Using `#[inline]` on function prototypes and consts now emits a warning under
    `unused_attribute` lint. Using `#[inline]` anywhere else inside traits
    or `extern` blocks now correctly emits a hard error.</changelog>
  <changelog author="federico@suse.com" date="1578484800">- Bump version of libssh2 for SLE15; we now need a version with
  libssh2_userauth_publickey_frommemory(), which appeared in libssh2
  1.6.0.
- Use the bundled libssh2 prior to SLE15.  SLE12 has 1.4.3, which is
  too old for the ssh crate now.</changelog>
  <changelog author="dimstar@opensuse.org" date="1579262400">- Adjust constraints: Request 20GB HDD for all archs. Simplify the
  file by removing the overrides for various disk sizes. All archs
  are curretnly at roughly 17GB storage in use.</changelog>
  <changelog author="federico@suse.com" date="1584964800">- Update to version 1.41.1:
  - Always check types of static items
  - Always check lifetime bounds of `Copy` impls
  - Fix miscompilation in callers of `Layout::repeat`
- Update to version 1.41.0:
  + Language
  - You can now pass type parameters to foreign items when implementing
    traits. E.g. You can now write `impl&lt;T&gt; From&lt;Foo&gt; for Vec&lt;T&gt; {}`.
  - You can now arbitrarily nest receiver types in the `self` position. E.g. you can
    now write `fn foo(self: Box&lt;Box&lt;Self&gt;&gt;) {}`. Previously only `Self`, `&amp;Self`,
    `&amp;mut Self`, `Arc&lt;Self&gt;`, `Rc&lt;Self&gt;`, and `Box&lt;Self&gt;` were allowed.
  - You can now use any valid identifier in a `format_args` macro.
    Previously identifiers starting with an underscore were not allowed.
  - Visibility modifiers (e.g. `pub`) are now syntactically allowed on trait items and
    enum variants. These are still rejected semantically, but
    can be seen and parsed by procedural macros and conditional compilation.
  + Compiler
  - Rustc will now warn if you have unused loop `'label`s.
  - Removed support for the `i686-unknown-dragonfly` target.
  - Added tier 3 support\* for the `riscv64gc-unknown-linux-gnu` target.
  - You can now pass an arguments file passing the `@path` syntax
    to rustc. Note that the format differs somewhat from what is
    found in other tooling; please see the documentation for
    more information.
  - You can now provide `--extern` flag without a path, indicating that it is
    available from the search path or specified with an `-L` flag.
    Refer to Rust's [platform support page][forge-platform-support] for more
    information on Rust's tiered platform support.
  + Libraries
  - The `core::panic` module is now stable. It was already stable
    through `std`.
  - `NonZero*` numerics now implement `From&lt;NonZero*&gt;` if it's a smaller integer
    width. E.g. `NonZeroU16` now implements `From&lt;NonZeroU8&gt;`.
  - `MaybeUninit&lt;T&gt;` now implements `fmt::Debug`.
  + Stabilized APIs
  - `Result::map_or`
  - `Result::map_or_else`
  - `std::rc::Weak::weak_count`
  - `std::rc::Weak::strong_count`
  - `std::sync::Weak::weak_count`
  - `std::sync::Weak::strong_count`
  + Cargo
  - Cargo will now document all the private items for binary crates
    by default.
  - `cargo-install` will now reinstall the package if it detects that it is out
    of date.
  - Cargo.lock now uses a more git friendly format that should help to reduce
    merge conflicts.
  - You can now override specific dependencies's build settings. E.g.
    `[profile.dev.package.image] opt-level = 2` sets the `image` crate's
    optimisation level to `2` for debug builds. You can also use
    `[profile.&lt;profile&gt;.build-override]` to override build scripts and
    their dependencies.
  + Misc
  - You can now specify `edition` in documentation code blocks to compile the block
    for that edition. E.g. `edition2018` tells rustdoc that the code sample
    should be compiled the 2018 edition of Rust.
  - You can now provide custom themes to rustdoc with `--theme`, and check the
    current theme with `--check-theme`.
  - You can use `#[cfg(doc)]` to compile an item when building documentation.
  + Compatibility Notes
  - As previously announced 1.41.0 will be the last tier 1 release for 32-bit
    Apple targets. This means that the source code is still
    available to build, but the targets are no longer being tested and release
    binaries for those platforms will no longer be distributed by the Rust project.
    Please refer to the linked blog post for more information.</changelog>
  <changelog author="alarrosa@suse.com" date="1585656000">- Rebased patches:
  + ignore-Wstring-conversion.patch (offset / fuzz)</changelog>
  <changelog author="alarrosa@suse.com" date="1585656001">- Update to version 1.42.0:
  + Language
  - You can now use the slice pattern syntax with subslices.
  - You can now use #[repr(transparent)] on univariant enums. Meaning
    that you can create an enum that has the exact layout and ABI of
    the type it contains.
  - There are some syntax-only changes:
  * default is syntactically allowed before items in trait
    definitions.
  * Items in impls (i.e. consts, types, and fns) may syntactically
    leave out their bodies in favor of ;.
  * Bounds on associated types in impls are now syntactically
    allowed (e.g. type Foo: Ord;).
  * ... (the C-variadic type) may occur syntactically directly
    as the type of any function parameter.
    These are still rejected semantically, so you will likely receive
    an error but these changes can be seen and parsed by procedural
    macros and conditional compilation.
  + Compiler
  - Added tier 2 support for armv7a-none-eabi.
  - Added tier 2 support for riscv64gc-unknown-linux-gnu.
  - Option::{expect,unwrap} and Result::{expect, expect_err, unwrap,
    unwrap_err} now produce panic messages pointing to the location
    where they were called, rather than core's internals.
    Refer to Rust's platform support page for more information on
    Rust's tiered platform support.
  + Libraries
  - iter::Empty&lt;T&gt; now implements Send and Sync for any T.
  - Pin::{map_unchecked, map_unchecked_mut} no longer require the
    return type to implement Sized.
  - io::Cursor now derives PartialEq and Eq.
  - Layout::new is now const.
  - Added Standard Library support for riscv64gc-unknown-linux-gnu.
  + Stabilized APIs
  - CondVar::wait_while
  - CondVar::wait_timeout_while
  - DebugMap::key
  - DebugMap::value
  - ManuallyDrop::take
  - matches!
  - ptr::slice_from_raw_parts_mut
  - ptr::slice_from_raw_parts
  + Cargo
  - You no longer need to include extern crate proc_macro; to be
    able to use proc_macro; in the 2018 edition.
  + Compatibility Notes
  - Error::description has been deprecated, and its use will now
    produce a warning. It's recommended to use Display/to_string
    instead.</changelog>
  <changelog author="schwab@suse.de" date="1586260800">- Avoid duplication of environment settings</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1588161600">- Update to version 1.43.0
  + Language
  - Fixed using binary operations with `&amp;{number}` (e.g. `&amp;1.0`)
    not having the type inferred correctly.
  - Attributes such as `#[cfg()]` can now be used on `if`
    expressions.
  - Syntax only changes:
  * Allow `type Foo: Ord` syntactically.
  * Fuse associated and extern items up to defaultness.
  * Syntactically allow `self` in all `fn` contexts.
  * Merge `fn` syntax + cleanup item parsing.
  * `item` macro fragments can be interpolated into `trait`s,
    `impl`s, and `extern` blocks.
    For example, you may now write:
    ```rust
    macro_rules! mac_trait {
    ($i:item) =&gt; {
    trait T { $i }
    }
    }
    mac_trait! {
    fn foo() {}
    }
    ```
  * These are still rejected *semantically*, so you will likely
    receive an error but these changes can be seen and parsed by
    macros and conditional compilation.
  + Compiler
  - You can now pass multiple lint flags to rustc to override the
    previous flags.
    For example; `rustc -D unused -A unused-variables` denies
    everything in the `unused` lint group except `unused-variables`
    which is explicitly allowed. However, passing
    `rustc -A unused-variables -D unused` denies everything in
    the `unused` lint group **including** `unused-variables` since
    the allow flag is specified before the deny flag (and therefore
    overridden).
  - rustc will now prefer your system MinGW libraries over its
    bundled libraries if they are available on `windows-gnu`.
  - rustc now buffers errors/warnings printed in JSON.
  + Libraries
  - `Arc&lt;[T; N]&gt;`, `Box&lt;[T; N]&gt;`, and `Rc&lt;[T; N]&gt;`, now implement
    `TryFrom&lt;Arc&lt;[T]&gt;&gt;`,`TryFrom&lt;Box&lt;[T]&gt;&gt;`, and `TryFrom&lt;Rc&lt;[T]&gt;&gt;`
    respectively.
  * *Note** These conversions are only available when `N` is
    `0..=32`.
  - You can now use associated constants on floats and integers
    directly, rather than having to import the module.
    e.g. You can now write `u32::MAX` or `f32::NAN` with no imports.
  - `u8::is_ascii` is now `const`.
  - `String` now implements `AsMut&lt;str&gt;`.
  - Added the `primitive` module to `std` and `core`.
    This module reexports Rust's primitive types. This is mainly
    useful in macros where you want avoid these types being shadowed.
  - Relaxed some of the trait bounds on `HashMap` and `HashSet`.
  - `string::FromUtf8Error` now implements `Clone + Eq`.
  + Stabilized APIs
  - `Once::is_completed`
  - `f32::LOG10_2`
  - `f32::LOG2_10`
  - `f64::LOG10_2`
  - `f64::LOG2_10`
  - `iter::once_with`
  + Cargo
  - You can now set config `[profile]`s in your `.cargo/config`,
    or through your environment.
  - Cargo will now set `CARGO_BIN_EXE_&lt;name&gt;` pointing to a
    binary's executable path when running integration tests or
    benchmarks.
    `&lt;name&gt;` is the name of your binary as-is e.g. If you wanted
    the executable path for a binary named `my-program`you would
    use `env!("CARGO_BIN_EXE_my-program")`.
  + Misc
  - Certain checks in the `const_err` lint were deemed unrelated
    to const evaluation, and have been moved to the
    `unconditional_panic` and `arithmetic_overflow` lints.
  + Compatibility Notes
  - Having trailing syntax in the `assert!` macro is now a hard
    error. This has been a warning since 1.36.0.
  - Fixed `Self` not having the correctly inferred type. This
    incorrectly led to some instances being accepted, and now
    correctly emits a hard error.</changelog>
  <changelog author="schwab@suse.de" date="1588593600">- Update rustfmt_version</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1589457600">- Update to version 1.43.1
  - Updated openssl-src to 1.1.1g for CVE-2020-1967.
  - Fixed the stabilization of AVX-512 features.
  - Fixed `cargo package --list` not working with unpublished
    dependencies.
- Check upstream signatures for binaries
- Add rust.keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1592827200">- Add patch Fix-big-endian-miscompile-of-bitcast-zex.patch
  to fix miscompilations with rustc 1.43 that lead to LTO failures
  (bsc#1173202)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1627387200">- Needed for Firefox91 (bsc#1188891)
- Rebased patches:
  + ignore-Wstring-conversion.patch (offset / fuzz)
  + Fix-big-endian-miscompile-of-bitcast-zex.patch dropped
- Add support for riscv64
- Make all shared libraries in %{common_libdir} executable; otherwise
  fdupes will not find any duplicates in %{rustlibdir}.
- rust-rpmlintrc: Reflect updated LLVM name in the filter.
- &lt;https://github.com/rust-lang/rust/issues/74976&gt;: Add "--stage 1"
  to the "./x.py doc" call to ensure the newly built compiler gets
  used.
- Resolve issue in constraints to select aarch64 builders in OBS that
  have correctly functioning CPU's.
- Resolve issue with zlib selection and buildrequires.
- Correct build issues with esoteric cpu architectures, by removing
  developer facing tools in some cases.
- Updates to spec file and legacy cleanups during build processes
- Correct issues with incorrect tuning of codegen units that caused
  builders to OOM
- Update to version 1.53:
  + Language
  - [You can now use unicode for identifiers.][83799] This allows multilingual
    identifiers but still doesn't allow glyphs that are not considered characters
    such as `?` or `?`. More specifically you can now use any identifier that
    matches the UAX #31 "Unicode Identifier and Pattern Syntax" standard. This
    is the same standard as languages like Python, however Rust uses NFC
    normalization which may be different from other languages.
  - [You can now specify "or patterns" inside pattern matches.][79278]
    Previously you could only use `|` (OR) on complete patterns. E.g.
    ```rust
    let x = Some(2u8);
    // Before
    matches!(x, Some(1) | Some(2));
    // Now
    matches!(x, Some(1 | 2));
    ```
  - [Added the `:pat_param` `macro_rules!` matcher.][83386] This matcher
    has the same semantics as the `:pat` matcher. This is to allow `:pat`
    to change semantics to being a pattern fragment in a future edition.
  + Compiler
  - [Updated the minimum external LLVM version to LLVM 10.][83387]
  - [Added Tier 3\* support for the `wasm64-unknown-unknown` target.][80525]
  - [Improved debuginfo for closures and async functions on Windows MSVC.][83941]
    \* Refer to Rust's [platform support page][platform-support-doc] for more
    information on Rust's tiered platform support.
  + Libraries
  - [Abort messages will now forward to `android_set_abort_message` on
    Android platforms when available.][81469]
  - [`slice::IterMut&lt;'_, T&gt;` now implements `AsRef&lt;[T]&gt;`][82771]
  - [Arrays of any length now implement `IntoIterator`.][84147]
    Currently calling `.into_iter()` as a method on an array will
    return `impl Iterator&lt;Item=&amp;T&gt;`, but this may change in a
    future edition to change `Item` to `T`. Calling `IntoIterator::into_iter`
    directly on arrays will provide `impl Iterator&lt;Item=T&gt;` as expected.
  - [`leading_zeros`, and `trailing_zeros` are now available on all
    `NonZero` integer types.][84082]
  - [`{f32, f64}::from_str` now parse and print special values
    (`NaN`, `-0`) according to IEEE RFC 754.][78618]
  - [You can now index into slices using `(Bound&lt;usize&gt;, Bound&lt;usize&gt;)`.][77704]
  - [Add the `BITS` associated constant to all numeric types.][82565]
  + Cargo
  - [Cargo now supports git repositories where the default `HEAD` branch is not
    "master".][cargo/9392] This also includes a switch to the version 3 `Cargo.lock` format
    which can handle default branches correctly.
  - [macOS targets now default to `unpacked` split-debuginfo.][cargo/9298]
  - [The `authors` field is no longer included in `Cargo.toml` for new
    projects.][cargo/9282]
  + Rustdoc
  - [Added the `rustdoc::bare_urls` lint that warns when you have URLs
    without hyperlinks.][81764]
  + Compatibility Notes
  - [Implement token-based handling of attributes during expansion][82608]
  - [`Ipv4::from_str` will now reject octal format IP addresses in addition
    to rejecting hexadecimal IP addresses.][83652] The octal format can lead
    to confusion and potential security vulnerabilities and [is no
    longer recommended][ietf6943].
- Update to version 1.52:
  + Language
  - [Added the `unsafe_op_in_unsafe_fn` lint, which checks whether the unsafe code
    in an `unsafe fn` is wrapped in a `unsafe` block.][79208] This lint
    is allowed by default, and may become a warning or hard error in a
    future edition.
  - [You can now cast mutable references to arrays to a pointer of the same type as
    the element.][81479]
  + Compiler
  - [Upgraded the default LLVM to LLVM 12.][81451]
  - Added tier 3\* support for the following targets.
  - [`s390x-unknown-linux-musl`][82166]
  - [`riscv32gc-unknown-linux-musl` &amp; `riscv64gc-unknown-linux-musl`][82202]
  - [`powerpc-unknown-openbsd`][82733]
  + Libraries
  - [`OsString` now implements `Extend` and `FromIterator`.][82121]
  - [`cmp::Reverse` now has `#[repr(transparent)]` representation.][81879]
  - [`Arc&lt;impl Error&gt;` now implements `error::Error`.][80553]
  - [All integer division and remainder operations are now `const`.][80962]
  + Stabilised APIs
  - [`Arguments::as_str`]
  - [`char::MAX`]
  - [`char::REPLACEMENT_CHARACTER`]
  - [`char::UNICODE_VERSION`]
  - [`char::decode_utf16`]
  - [`char::from_digit`]
  - [`char::from_u32_unchecked`]
  - [`char::from_u32`]
  - [`slice::partition_point`]
  - [`str::rsplit_once`]
  - [`str::split_once`]
    The following previously stable APIs are now `const`.
  - [`char::len_utf8`]
  - [`char::len_utf16`]
  - [`char::to_ascii_uppercase`]
  - [`char::to_ascii_lowercase`]
  - [`char::eq_ignore_ascii_case`]
  - [`u8::to_ascii_uppercase`]
  - [`u8::to_ascii_lowercase`]
  - [`u8::eq_ignore_ascii_case`]
  + Rustdoc
  - [Rustdoc lints are now treated as a tool lint, meaning that
    lints are now prefixed with `rustdoc::` (e.g. `#[warn(rustdoc::non_autolinks)]`).][80527]
    Using the old style is still allowed, and will become a warning in
    a future release.
  - [Rustdoc now supports argument files.][82261]
  - [Rustdoc now generates smart punctuation for documentation.][79423]
  - [You can now use "task lists" in Rustdoc Markdown.][81766] E.g.
    ```markdown
  - [x] Complete
  - [ ] Todo
    ```
  + Misc
  - [You can now pass multiple filters to tests.][81356] E.g.
    `cargo test -- foo bar` will run all tests that match `foo` and `bar`.
  - [Rustup now distributes PDB symbols for the `std` library on Windows,
    allowing you to see `std` symbols when debugging.][82218]
  + Internal Only
    These changes provide no direct user facing benefits, but represent significant
    improvements to the internals and overall performance of rustc and
    related tools.
  - [Check the result cache before the DepGraph when ensuring queries][81855]
  - [Try fast_reject::simplify_type in coherence before doing full check][81744]
  - [Only store a LocalDefId in some HIR nodes][81611]
  - [Store HIR attributes in a side table][79519]
  + Compatibility Notes
  - ------------------
  - [Cargo build scripts are now forbidden from setting `RUSTC_BOOTSTRAP`.][cargo/9181]
  - [Removed support for the `x86_64-rumprun-netbsd` target.][82594]
  - [Deprecated the `x86_64-sun-solaris` target in favor of `x86_64-pc-solaris`.][82216]
  - [Rustdoc now only accepts `,`, ` `, and `\t` as delimiters for specifying
    languages in code blocks.][78429]
  - [Rustc now catches more cases of `pub_use_of_private_extern_crate`][80763]
  - [Changes in how proc macros handle whitespace may lead to panics when used
    with older `proc-macro-hack` versions. A `cargo update` should be sufficient to fix
    this in all cases.][84136]
- Update to version 1.51:
  + Language
  - [You can now parameterize items such as functions, traits, and `struct`s by constant
    values in addition to by types and lifetimes.][79135] Also known as "const generics"
    E.g. you can now write the following. Note: Only values of primitive integers,
    `bool`, or `char` types are currently permitted.
  + Compiler
  - [Added the `-Csplit-debuginfo` codegen option for macOS platforms.][79570]
    This option controls whether debug information is split across multiple files
    or packed into a single file. **Note** This option is unstable on other platforms.
  - [Added tier 3\* support for `aarch64_be-unknown-linux-gnu`,
    `aarch64-unknown-linux-gnu_ilp32`, and `aarch64_be-unknown-linux-gnu_ilp32` targets.][81455]
  - [Added tier 3 support for `i386-unknown-linux-gnu` and `i486-unknown-linux-gnu` targets.][80662]
  - [The `target-cpu=native` option will now detect individual features of CPUs.][80749]
    \* Refer to Rust's [platform support page][platform-support-doc] for more
    information on Rust's tiered platform support.
  + Libraries
  - [`Box::downcast` is now also implemented for any `dyn Any + Send + Sync` object.][80945]
  - [`str` now implements `AsMut&lt;str&gt;`.][80279]
  - [`u64` and `u128` now implement `From&lt;char&gt;`.][79502]
  - [`Error` is now implemented for `&amp;T` where `T` implements `Error`.][75180]
  - [`Poll::{map_ok, map_err}` are now implemented for `Poll&lt;Option&lt;Result&lt;T, E&gt;&gt;&gt;`.][80968]
  - [`unsigned_abs` is now implemented for all signed integer types.][80959]
  - [`io::Empty` now implements `io::Seek`.][78044]
  - [`rc::Weak&lt;T&gt;` and `sync::Weak&lt;T&gt;`'s methods such as `as_ptr` are now implemented for
    `T: ?Sized` types.][80764]
  + Stabilized APIs
  - [`Arc::decrement_strong_count`]
  - [`Arc::increment_strong_count`]
  - [`Once::call_once_force`]
  - [`Peekable::next_if_eq`]
  - [`Peekable::next_if`]
  - [`Seek::stream_position`]
  - [`array::IntoIter`]
  - [`panic::panic_any`]
  - [`ptr::addr_of!`]
  - [`ptr::addr_of_mut!`]
  - [`slice::fill_with`]
  - [`slice::split_inclusive_mut`]
  - [`slice::split_inclusive`]
  - [`slice::strip_prefix`]
  - [`slice::strip_suffix`]
  - [`str::split_inclusive`]
  - [`sync::OnceState`]
  - [`task::Wake`]
  + Cargo
  - [Added the `split-debuginfo` profile option to control the -Csplit-debuginfo
    codegen option.][cargo/9112]
  - [Added the `resolver` field to `Cargo.toml` to enable the new feature resolver
    and CLI option behavior.][cargo/8997] Version 2 of the feature resolver will try
    to avoid unifying features of dependencies where that unification could be unwanted.
    Such as using the same dependency with a `std` feature in a build scripts and
    proc-macros, while using the `no-std` feature in the final binary. See the
    [Cargo book documentation][feature-resolver@2.0] for more information on the feature.
  + Rustdoc
  - [Rustdoc will now include documentation for methods available from _nested_ `Deref` traits.][80653]
  - [You can now provide a `--default-theme` flag which sets the default theme to use for
    documentation.][79642]
    Various improvements to intra-doc links:
  - [You can link to non-path primitives such as `slice`.][80181]
  - [You can link to associated items.][74489]
  - [You can now include generic parameters when linking to items, like `Vec&lt;T&gt;`.][76934]
  + Misc
  - [You can now pass `--include-ignored` to tests (e.g. with
    `cargo test -- --include-ignored`) to include testing tests marked `#[ignore]`.][80053]
  + Compatibility Notes
  - [WASI platforms no longer use the `wasm-bindgen` ABI, and instead use the wasm32 ABI.][79998]
  - [`rustc` no longer promotes division, modulo and indexing operations to `const` that
    could fail.][80579]
  - [The minimum version of glibc for the following platforms has been bumped to version 2.31
    for the distributed artifacts.][81521]
  - `armv5te-unknown-linux-gnueabi`
  - `sparc64-unknown-linux-gnu`
  - `thumbv7neon-unknown-linux-gnueabihf`
  - `armv7-unknown-linux-gnueabi`
  - `x86_64-unknown-linux-gnux32`
- Update to version 1.50:
  * This fixes build on armv7 - boo#1181643
  + Language
  - You can now use const values for x in [x; N] array expressions.
    This has been technically possible since 1.38.0, as it was
    unintentionally stabilized.
  - Assignments to ManuallyDrop&lt;T&gt; union fields are now considered safe.
  + Compiler
  - Added tier 3* support for the armv5te-unknown-linux-uclibceabi
    target.
  - Added tier 3 support for the aarch64-apple-ios-macabi target.
  - The x86_64-unknown-freebsd is now built with the full toolset.
  - Dropped support for all cloudabi targets.
  * Refer to Rust's platform support page for more information on
    Rust's tiered platform support.
  + Libraries
  - proc_macro::Punct now implements PartialEq&lt;char&gt;.
  - ops::{Index, IndexMut} are now implemented for fixed sized
    arrays of any length.
  - On Unix platforms, the std::fs::File type now has a "niche" of -1.
    This value cannot be a valid file descriptor, and now means Option&lt;File&gt;
    takes up the same amount of space as File.
  + Stabilized APIs
    bool::then
    btree_map::Entry::or_insert_with_key
    f32::clamp
    f64::clamp
    hash_map::Entry::or_insert_with_key
    Ord::clamp
    RefCell::take
    slice::fill
    UnsafeCell::get_mut
  - The following previously stable methods are now const.
    IpAddr::is_ipv4
    IpAddr::is_ipv6
    IpAddr::is_unspecified
    IpAddr::is_loopback
    IpAddr::is_multicast
    Ipv4Addr::octets
    Ipv4Addr::is_loopback
    Ipv4Addr::is_private
    Ipv4Addr::is_link_local
    Ipv4Addr::is_multicast
    Ipv4Addr::is_broadcast
    Ipv4Addr::is_documentation
    Ipv4Addr::to_ipv6_compatible
    Ipv4Addr::to_ipv6_mapped
    Ipv6Addr::segments
    Ipv6Addr::is_unspecified
    Ipv6Addr::is_loopback
    Ipv6Addr::is_multicast
    Ipv6Addr::to_ipv4
    Layout::size
    Layout::align
    Layout::from_size_align
    pow for all integer types.
    checked_pow for all integer types.
    saturating_pow for all integer types.
    wrapping_pow for all integer types.
    next_power_of_two for all unsigned integer types.
    checked_next_power_of_two for all unsigned integer types.
  + Cargo
  - Added the [build.rustc-workspace-wrapper] option. This option
    sets a wrapper to execute instead of rustc, for workspace members only.
  - cargo:rerun-if-changed will now, if provided a directory,
    scan the entire contents of that directory for changes.
  - Added the --workspace flag to the cargo update command.
  + Misc
  - The search results tab and the help button are focusable
    with keyboard in rustdoc.
  - Running tests will now print the total time taken to execute.
  + Compatibility Notes
  - The compare_and_swap method on atomics has been deprecated.
    It's recommended to use the compare_exchange and
    compare_exchange_weak methods instead.
  - Changes in how TokenStreams are checked have fixed some cases
    where you could write unhygenic macro_rules! macros.
  - #![test] as an inner attribute is now considered unstable
    like other inner macro attributes, and reports an error by
    default through the soft_unstable lint.
  - Overriding a forbid lint at the same level that it was set
    is now a hard error.
  - You can no longer intercept panic! calls by supplying your own
    macro. It's recommended to use the #[panic_handler] attribute
    to provide your own implementation.
  - Semi-colons after item statements (e.g. struct Foo {};)
    now produce a warning.
- Update to version 1.49.0
  + Language
  - Unions can now implement Drop, and you can now have a field in
    a union with ManuallyDrop&lt;T&gt;.
  - You can now cast uninhabited enums to integers.
  - You can now bind by reference and by move in patterns. This
    allows you to selectively borrow individual components of a type.
    E.g.
    [#][derive(Debug)]
    struct Person {
    name: String,
    age: u8,
    }
    let person = Person {
    name: String::from("Alice"),
    age: 20,
    };
    // `name` is moved out of person, but `age` is referenced.
    let Person { name, ref age } = person;
    println!("{} {}", name, age);
  + Compiler
  - Added tier 1* support for aarch64-unknown-linux-gnu.
  - Added tier 2 support for aarch64-apple-darwin.
  - Added tier 2 support for aarch64-pc-windows-msvc.
  - Added tier 3 support for mipsel-unknown-none.
  - Raised the minimum supported LLVM version to LLVM 9.
  - Output from threads spawned in tests is now captured.
  - Change os and vendor values to "none" and "unknown" for some targets
  * Refer to Rust's platform support page for more information on Rust's
    tiered platform support.
  + Libraries
  - RangeInclusive now checks for exhaustion when calling contains and
    indexing.
  - ToString::to_string now no longer shrinks the internal buffer in
    the default implementation.
  - ops::{Index, IndexMut} are now implemented for fixed sized arrays
    of any length.
  + Stabilized APIs
  - slice::select_nth_unstable
  - slice::select_nth_unstable_by
  - slice::select_nth_unstable_by_key
  The following previously stable methods are now const.
  - Poll::is_ready
  - Poll::is_pending
  + Cargo
  - Building a crate with cargo-package should now be independently
    reproducible.
  - cargo-tree now marks proc-macro crates.
  - Added CARGO_PRIMARY_PACKAGE build-time environment variable. This
    variable will be set if the crate being built is one the user
    selected to build, either with -p or through defaults.
  - You can now use glob patterns when specifying packages &amp; targets.
  + Compatibility Notes
  - Demoted i686-unknown-freebsd from host tier 2 to target tier 2
    support.
  - Macros that end with a semi-colon are now treated as statements
    even if they expand to nothing.
  - Rustc will now check for the validity of some built-in attributes
    on enum variants. Previously such invalid or unused attributes
    could be ignored.
  - Leading whitespace is stripped more uniformly in documentation
    comments, which may change behavior. You read this post about
    the changes for more details.
  - Trait bounds are no longer inferred for associated types.
  + Internal Only
  These changes provide no direct user facing benefits, but
  represent significant improvements to the internals and overall
  performance of rustc and related tools.
  - rustc's internal crates are now compiled using the initial-exec
    Thread Local Storage model.
  - Calculate visibilities once in resolve.
  - Added system to the llvm-libunwind bootstrap config option.
  - Added --color for configuring terminal color support to bootstrap.
- Update to version 1.48.0
  + Language
  - The `unsafe` keyword is now syntactically permitted on modules.
    This is still rejected semantically, but can now be parsed by procedural
    macros.
  + Compiler
  - Stabilised the `-C link-self-contained=&lt;yes|no&gt;` compiler flag.
    This tells `rustc` whether to link its own C runtime and libraries or to
    rely on a external linker to find them. (Supported only on `windows-gnu`,
    `linux-musl`, and `wasi` platforms.)
  - You can now use `-C target-feature=+crt-static` on `linux-gnu` targets.
    Note: If you're using cargo you must explicitly pass the `--target` flag.
  - Added tier 2* support for aarch64-unknown-linux-musl.
  * Refer to Rust's platform support page for more information on Rust's
    tiered platform support.
  + Libraries
  - io::Write is now implemented for &amp;ChildStdin &amp;Sink, &amp;Stdout, and &amp;Stderr.
  - All arrays of any length now implement TryFrom&lt;Vec&lt;T&gt;&gt;.
  - The matches! macro now supports having a trailing comma.
  - Vec&lt;A&gt; now implements PartialEq&lt;[B]&gt; where A: PartialEq&lt;B&gt;.
  - The RefCell::{replace, replace_with, clone} methods now all use #[track_caller].
  + Stabilized APIs
  - slice::as_ptr_range
  - slice::as_mut_ptr_range
  - VecDeque::make_contiguous
  - future::pending
  - future::ready
  The following previously stable methods are now `const fn's`:
  - Option::is_some
  - Option::is_none
  - Option::as_ref
  - Result::is_ok
  - Result::is_err
  - Result::as_ref
  - Ordering::reverse
  - Ordering::then
  + Cargo
  + Rustdoc
  - You can now link to items in rustdoc using the intra-doc link syntax.
    E.g. /// Uses [`std::future`] will automatically generate a link to
    std::future's documentation. See "Linking to items by name" for more
    information.
  - You can now specify #[doc(alias = "&lt;alias&gt;")] on items to add search
    aliases when searching through rustdoc's UI.
  + Compatibility Notes
  - Promotion of references to 'static lifetime inside const fn now
    follows the same rules as inside a fn body. In particular, &amp;foo()
    will not be promoted to 'static lifetime any more inside const fns.
  - Associated type bindings on trait objects are now verified to meet
    the bounds declared on the trait when checking that they implement
    the trait.
  - When trait bounds on associated types or opaque types are ambiguous,
    the compiler no longer makes an arbitrary choice on which bound to use.
  - Fixed recursive nonterminals not being expanded in macros during
    pretty-print/reparse check. This may cause errors if your macro
    wasn't correctly handling recursive nonterminal tokens.
  - &amp;mut references to non zero-sized types are no longer promoted.
  - rustc will now warn if you use attributes like #[link_name] or
    [#][cold] in places where they have no effect.
  - Updated _mm256_extract_epi8 and _mm256_extract_epi16 signatures
    in arch::{x86, x86_64} to return i32 to match the vendor signatures.
  - mem::uninitialized will now panic if any inner types inside a struct
    or enum disallow zero-initialization.
  - #[target_feature] will now error if used in a place where it has no effect.
  - Foreign exceptions are now caught by catch_unwind and will cause an
    abort. Note: This behaviour is not guaranteed and is still considered
    undefined behaviour, see the catch_unwind documentation for further
    information.
  + Internal Only
    These changes provide no direct user facing benefits, but represent
    significant improvements to the internals and overall performance of
    rustc and related tools.
  - Building rustc from source now uses ninja by default over make.
    You can continue building with make by setting ninja=false in
    your config.toml.
  - cg_llvm: fewer_names in uncached_llvm_type
  - Made ensure_sufficient_stack() non-generic
- Update to version 1.47.0
  + Language
  - [Closures will now warn when not used.][74869]
  + Compiler
  - [Stabilized the `-C control-flow-guard` codegen option][73893], which enables
    [Control Flow Guard][1.47.0-cfg] for Windows platforms, and is ignored on other
    platforms.
  - [Upgraded to LLVM 11.][73526]
  - [Added tier 3\* support for the `thumbv4t-none-eabi` target.][74419]
  - [Upgrade the FreeBSD toolchain to version 11.4][75204]
  - [`RUST_BACKTRACE`'s output is now more compact.][75048]
  \* Refer to Rust's [platform support page][forge-platform-support] for more
  information on Rust's tiered platform support.
  + Libraries
  - [`CStr` now implements `Index&lt;RangeFrom&lt;usize&gt;&gt;`.][74021]
  - [Traits in `std`/`core` are now implemented for arrays of any length, not just
    those of length less than 33.][74060]
  - [`ops::RangeFull` and `ops::Range` now implement Default.][73197]
  - [`panic::Location` now implements `Copy`, `Clone`, `Eq`, `Hash`, `Ord`,
    `PartialEq`, and `PartialOrd`.][73583]
  + Stabilized APIs
  - [`Ident::new_raw`]
  - [`Range::is_empty`]
  - [`RangeInclusive::is_empty`]
  - [`Result::as_deref`]
  - [`Result::as_deref_mut`]
  - [`Vec::leak`]
  - [`pointer::offset_from`]
  - [`f32::TAU`]
  - [`f64::TAU`]
  The following previously stable APIs have now been made const.
  - [The `new` method for all `NonZero` integers.][73858]
  - [The `checked_add`,`checked_sub`,`checked_mul`,`checked_neg`, `checked_shl`,
    `checked_shr`, `saturating_add`, `saturating_sub`, and `saturating_mul`
    methods for all integers.][73858]
  - [The `checked_abs`, `saturating_abs`, `saturating_neg`, and `signum`  for all
    signed integers.][73858]
  - [The `is_ascii_alphabetic`, `is_ascii_uppercase`, `is_ascii_lowercase`,
    `is_ascii_alphanumeric`, `is_ascii_digit`, `is_ascii_hexdigit`,
    `is_ascii_punctuation`, `is_ascii_graphic`, `is_ascii_whitespace`, and
    `is_ascii_control` methods for `char` and `u8`.][73858]
  + Cargo
  - [`build-dependencies` are now built with opt-level 0 by default.][cargo/8500]
    You can override this by setting the following in your `Cargo.toml`.
    ```toml
    [profile.release.build-override]
    opt-level = 3
    ```
  - [`cargo-help` will now display man pages for commands rather just the
    `--help` text.][cargo/8456]
  - [`cargo-metadata` now emits a `test` field indicating if a target has
    tests enabled.][cargo/8478]
  - [`workspace.default-members` now respects `workspace.exclude`.][cargo/8485]
  - [`cargo-publish` will now use an alternative registry by default if it's the
    only registry specified in `package.publish`.][cargo/8571]
  + Misc
  - [Added a help button beside Rustdoc's searchbar that explains rustdoc's
    type based search.][75366]
  - [Added the Ayu theme to rustdoc.][71237]
- Update to version 1.46.0
  + Language
  - [`if`, `match`, and `loop` expressions can now be used in const functions.][72437]
  - [Additionally you are now also able to coerce and cast to slices (`&amp;[T]`) in
    const functions.][73862]
  - [The `#[track_caller]` attribute can now be added to functions to use the
    function's caller's location information for panic messages.][72445]
  - [Recursively indexing into tuples no longer needs parentheses.][71322] E.g.
    `x.0.0` over `(x.0).0`.
  - [`mem::transmute` can now be used in statics and constants.][72920] **Note**
    You currently can't use `mem::transmute` in constant functions.
  + Compiler
  - [You can now use the `cdylib` target on Apple iOS and tvOS platforms.][73516]
  - [Enabled static "Position Independent Executables" by default
    for `x86_64-unknown-linux-musl`.][70740]
  + Libraries
  - [`mem::forget` is now a `const fn`.][73887]
  - [`String` now implements `From&lt;char&gt;`.][73466]
  - [The `leading_ones`, and `trailing_ones` methods have been stabilised for all
    integer types.][73032]
  - [`vec::IntoIter&lt;T&gt;` now implements `AsRef&lt;[T]&gt;`.][72583]
  - [All non-zero integer types (`NonZeroU8`) now implement `TryFrom` for their
    zero-able equivalent (e.g. `TryFrom&lt;u8&gt;`).][72717]
  - [`&amp;[T]` and `&amp;mut [T]` now implement `PartialEq&lt;Vec&lt;T&gt;&gt;`.][71660]
  - [`(String, u16)` now implements `ToSocketAddrs`.][73007]
  - [`vec::Drain&lt;'_, T&gt;` now implements `AsRef&lt;[T]&gt;`.][72584]
  + Stabilized APIs
  - [`Option::zip`]
  - [`vec::Drain::as_slice`]
  + Cargo
    Added a number of new environment variables that are now available when
    compiling your crate.
  - [`CARGO_BIN_NAME` and `CARGO_CRATE_NAME`][cargo/8270] Providing the name of
    the specific binary being compiled and the name of the crate.
  - [`CARGO_PKG_LICENSE`][cargo/8325] The license from the manifest of the package.
  - [`CARGO_PKG_LICENSE_FILE`][cargo/8387] The path to the license file.
- Update to version 1.44.1
  * rustfmt accepts rustfmt_skip in cfg_attr again.
  * Don't hash executable filenames on apple platforms, fixing backtraces.
  * Fix crashes when finding backtrace on macOS.
  * Clippy applies lint levels into different files.
- Update to version 1.44.0
  + Language
  - You can now use `async/.await` with `#[no_std]` enabled.
  - Added the `unused_braces` lint.
  - Expansion-driven outline module parsing
  + Compiler
  - Rustc now respects the `-C codegen-units` flag in incremental mode.
    Additionally when in incremental mode rustc defaults to 256 codegen units.
  - Refactored `catch_unwind` to have zero-cost, unless unwinding is enabled and
    a panic is thrown.
  - Added tier 3\* support for the `aarch64-unknown-none` and
    `aarch64-unknown-none-softfloat` targets.
  - Added tier 3 support for `arm64-apple-tvos` and
    `x86_64-apple-tvos` targets.
  + Libraries
  - Special cased `vec![]` to map directly to `Vec::new()`. This allows
    `vec![]` to be able to be used in `const` contexts.
  - `convert::Infallible` now implements `Hash`.
  - `OsString` now implements `DerefMut` and `IndexMut` returning
    a `&amp;mut OsStr`.
  - Unicode 13 is now supported.
  - `String` now implements `From&lt;&amp;mut str&gt;`.
  - `IoSlice` now implements `Copy`.
  - `Vec&lt;T&gt;` now implements `From&lt;[T; N]&gt;`. Where `N` is at most 32.
  - `proc_macro::LexError` now implements `fmt::Display` and `Error`.
  - `from_le_bytes`, `to_le_bytes`, `from_be_bytes`, `to_be_bytes`,
    `from_ne_bytes`, and `to_ne_bytes` methods are now `const` for all
    integer types.
  + Stabilizd APIs
  - [`PathBuf::with_capacity`]
  - [`PathBuf::capacity`]
  - [`PathBuf::clear`]
  - [`PathBuf::reserve`]
  - [`PathBuf::reserve_exact`]
  - [`PathBuf::shrink_to_fit`]
  - [`f32::to_int_unchecked`]
  - [`f64::to_int_unchecked`]
  - [`Layout::align_to`]
  - [`Layout::pad_to_align`]
  - [`Layout::array`]
  - [`Layout::extend`]
  + Cargo
  - Added the `cargo tree` command which will print a tree graph of
    your dependencies
  + Misc
  - Rustdoc now allows you to specify `--crate-version` to have rustdoc include
    the version in the sidebar.
  + Compatibility Notes
  - Rustc now correctly generates static libraries on Windows GNU targets with
    the `.a` extension, rather than the previous `.lib`.
  - Removed the `-C no_integrated_as` flag from rustc.
  - The `file_name` property in JSON output of macro errors now points the actual
    source file rather than the previous format of `&lt;NAME macros&gt;`.
  * *Note:** this may not point to a file that actually exists on the user's system.
  - The minimum required external LLVM version has been bumped to LLVM 8.
  - `mem::{zeroed, uninitialised}` will now panic when used with types that do
    not allow zero initialization such as `NonZeroU8`. This was
    previously a warning.
  - In 1.45.0 (the next release) converting a `f64` to `u32` using the `as`
    operator has been defined as a saturating operation. This was previously
    undefined behaviour, but you can use the `{f64, f32}::to_int_unchecked` methods to
    continue using the current behaviour, which may be desirable in rare performance
    sensitive situations.</changelog>
  <changelog author="william.brown@suse.com" date="1642680000">- bsc#1194767 - CVE-2022-21658 - Resolve race condition in std::fs::remove_dir_all
  - 0001-Fix-CVE-2022-21658-for-UNIX-like.patch</changelog>
</package>
<package pkgid="38aa2b87bb573d51532aee9a982d5ed8ab0ce322246bf415100ba34de5b6f561" name="rust-doc" arch="aarch64">
  <version epoch="0" ver="1.53.0" rel="22.1"/>
  <changelog author="luke@ljones.dev" date="1569844800">- Add patch add-option-to-allow-warnings.patch to add a config option
  which allows warnings and so enables v1.38 to bootstrap itself.</changelog>
  <changelog author="rhafer@suse.com" date="1571832000">- Switch to bundled version of libgit2 for now. libgit2-sys seems
  to expect using the bundled variant, which just seems to point
  to a snapshot of the master branch and doesn't match any released
  libgit2 (bsc#1154817).
  See: https://github.com/rust-lang/rust/issues/63476 and
  https://github.com/rust-lang/git2-rs/issues/458 for details.</changelog>
  <changelog author="aplanas@suse.com" date="1573128000">- Update to version 1.39.0
  + Language
  - You can now create async functions and blocks with async fn,
    async move {}, and async {} respectively, and you can now call
    .await on async expressions.
  - You can now use certain attributes on function, closure, and
    function pointer parameters.
  - You can now take shared references to bind-by-move patterns in
    the if guards of match arms.
  + Compiler
  - Added tier 3 support for the i686-unknown-uefi target.
  - Added tier 3 support for the sparc64-unknown-openbsd target.
  - rustc will now trim code snippets in diagnostics to fit in your
    terminal.
  - You can now pass --show-output argument to test binaries to
    print the output of successful tests.
  + For more details:
    https://github.com/rust-lang/rust/blob/stable/RELEASES.md#version-1390-2019-11-07
- Drop patches already merged in upstream:
  + rust-61206-assume-tarball-llvm-is-fresh.patch
  + add-option-to-allow-warnings.patch</changelog>
  <changelog author="aplanas@suse.com" date="1573214400">- Add hopefully-fix-rustdoc-build.patch to fix rustdoc compilation</changelog>
  <changelog author="aplanas@suse.com" date="1574683200">- Re-format the spec file
- Add a README to explain the update process
- Add _service file for download the assets and re-base the patches</changelog>
  <changelog author="ngompa13@gmail.com" date="1575028800">- Rename README to README.suse-maint and add it as a source
  to stop factory-auto from declining submissions automatically</changelog>
  <changelog author="opensuse-packaging@opensuse.org" date="1577707200">- Rebased patches:
  + hopefully-fix-rustdoc-build.patch dropped (merged upstream)</changelog>
  <changelog author="luke@ljones.dev" date="1577707201">- Update to version 1.40.0
  + Language
  - You can now use tuple `struct`s and tuple `enum` variant's constructors in
    `const` contexts. e.g.
    pub struct Point(i32, i32);
    const ORIGIN: Point = {
    let constructor = Point;
    constructor(0, 0)
    };
  - You can now mark `struct`s, `enum`s, and `enum` variants with the `#[non_exhaustive]` attribute to
    indicate that there may be variants or fields added in the future.
    For example this requires adding a wild-card branch (`_ =&gt; {}`) to any match
    statements on a non-exhaustive `enum`.
  - You can now use function-like procedural macros in `extern` blocks and in
    type positions. e.g. `type Generated = macro!();`
  - Function-like and attribute procedural macros can now emit
    `macro_rules!` items, so you can now have your macros generate macros.
  - The `meta` pattern matcher in `macro_rules!` now correctly matches the modern
    attribute syntax. For example `(#[$m:meta])` now matches `#[attr]`,
    `#[attr{tokens}]`, `#[attr[tokens]]`, and `#[attr(tokens)]`.
  + Compiler
  - Added tier 3 support\* for the
    `thumbv7neon-unknown-linux-musleabihf` target.
  - Added tier 3 support for the
    `aarch64-unknown-none-softfloat` target.
  - Added tier 3 support for the `mips64-unknown-linux-muslabi64`, and
    `mips64el-unknown-linux-muslabi64` targets.
  + Libraries
  - The `is_power_of_two` method on unsigned numeric types is now a `const` function.
  + Stabilized APIs
  - BTreeMap::get_key_value
  - HashMap::get_key_value
  - Option::as_deref_mut
  - Option::as_deref
  - Option::flatten
  - UdpSocket::peer_addr
  - f32::to_be_bytes
  - f32::to_le_bytes
  - f32::to_ne_bytes
  - f64::to_be_bytes
  - f64::to_le_bytes
  - f64::to_ne_bytes
  - f32::from_be_bytes
  - f32::from_le_bytes
  - f32::from_ne_bytes
  - f64::from_be_bytes
  - f64::from_le_bytes
  - f64::from_ne_bytes
  - mem::take
  - slice::repeat
  - todo!
  + Cargo
  - Cargo will now always display warnings, rather than only on
    fresh builds.
  - Feature flags (except `--all-features`) passed to a virtual workspace will
    now produce an error. Previously these flags were ignored.
  - You can now publish `dev-dependencies` without including
    a `version`.
  + Misc
  - You can now specify the `#[cfg(doctest)]` attribute to include an item only
    when running documentation tests with `rustdoc`.
  + Compatibility Notes
  - As previously announced, any previous NLL warnings in the 2015 edition are
    now hard errors.
  - The `include!` macro will now warn if it failed to include the
    entire file. The `include!` macro unintentionally only includes the
    first _expression_ in a file, and this can be unintuitive. This will become
    either a hard error in a future release, or the behavior may be fixed to include all expressions as expected.
  - Using `#[inline]` on function prototypes and consts now emits a warning under
    `unused_attribute` lint. Using `#[inline]` anywhere else inside traits
    or `extern` blocks now correctly emits a hard error.</changelog>
  <changelog author="federico@suse.com" date="1578484800">- Bump version of libssh2 for SLE15; we now need a version with
  libssh2_userauth_publickey_frommemory(), which appeared in libssh2
  1.6.0.
- Use the bundled libssh2 prior to SLE15.  SLE12 has 1.4.3, which is
  too old for the ssh crate now.</changelog>
  <changelog author="dimstar@opensuse.org" date="1579262400">- Adjust constraints: Request 20GB HDD for all archs. Simplify the
  file by removing the overrides for various disk sizes. All archs
  are curretnly at roughly 17GB storage in use.</changelog>
  <changelog author="federico@suse.com" date="1584964800">- Update to version 1.41.1:
  - Always check types of static items
  - Always check lifetime bounds of `Copy` impls
  - Fix miscompilation in callers of `Layout::repeat`
- Update to version 1.41.0:
  + Language
  - You can now pass type parameters to foreign items when implementing
    traits. E.g. You can now write `impl&lt;T&gt; From&lt;Foo&gt; for Vec&lt;T&gt; {}`.
  - You can now arbitrarily nest receiver types in the `self` position. E.g. you can
    now write `fn foo(self: Box&lt;Box&lt;Self&gt;&gt;) {}`. Previously only `Self`, `&amp;Self`,
    `&amp;mut Self`, `Arc&lt;Self&gt;`, `Rc&lt;Self&gt;`, and `Box&lt;Self&gt;` were allowed.
  - You can now use any valid identifier in a `format_args` macro.
    Previously identifiers starting with an underscore were not allowed.
  - Visibility modifiers (e.g. `pub`) are now syntactically allowed on trait items and
    enum variants. These are still rejected semantically, but
    can be seen and parsed by procedural macros and conditional compilation.
  + Compiler
  - Rustc will now warn if you have unused loop `'label`s.
  - Removed support for the `i686-unknown-dragonfly` target.
  - Added tier 3 support\* for the `riscv64gc-unknown-linux-gnu` target.
  - You can now pass an arguments file passing the `@path` syntax
    to rustc. Note that the format differs somewhat from what is
    found in other tooling; please see the documentation for
    more information.
  - You can now provide `--extern` flag without a path, indicating that it is
    available from the search path or specified with an `-L` flag.
    Refer to Rust's [platform support page][forge-platform-support] for more
    information on Rust's tiered platform support.
  + Libraries
  - The `core::panic` module is now stable. It was already stable
    through `std`.
  - `NonZero*` numerics now implement `From&lt;NonZero*&gt;` if it's a smaller integer
    width. E.g. `NonZeroU16` now implements `From&lt;NonZeroU8&gt;`.
  - `MaybeUninit&lt;T&gt;` now implements `fmt::Debug`.
  + Stabilized APIs
  - `Result::map_or`
  - `Result::map_or_else`
  - `std::rc::Weak::weak_count`
  - `std::rc::Weak::strong_count`
  - `std::sync::Weak::weak_count`
  - `std::sync::Weak::strong_count`
  + Cargo
  - Cargo will now document all the private items for binary crates
    by default.
  - `cargo-install` will now reinstall the package if it detects that it is out
    of date.
  - Cargo.lock now uses a more git friendly format that should help to reduce
    merge conflicts.
  - You can now override specific dependencies's build settings. E.g.
    `[profile.dev.package.image] opt-level = 2` sets the `image` crate's
    optimisation level to `2` for debug builds. You can also use
    `[profile.&lt;profile&gt;.build-override]` to override build scripts and
    their dependencies.
  + Misc
  - You can now specify `edition` in documentation code blocks to compile the block
    for that edition. E.g. `edition2018` tells rustdoc that the code sample
    should be compiled the 2018 edition of Rust.
  - You can now provide custom themes to rustdoc with `--theme`, and check the
    current theme with `--check-theme`.
  - You can use `#[cfg(doc)]` to compile an item when building documentation.
  + Compatibility Notes
  - As previously announced 1.41.0 will be the last tier 1 release for 32-bit
    Apple targets. This means that the source code is still
    available to build, but the targets are no longer being tested and release
    binaries for those platforms will no longer be distributed by the Rust project.
    Please refer to the linked blog post for more information.</changelog>
  <changelog author="alarrosa@suse.com" date="1585656000">- Rebased patches:
  + ignore-Wstring-conversion.patch (offset / fuzz)</changelog>
  <changelog author="alarrosa@suse.com" date="1585656001">- Update to version 1.42.0:
  + Language
  - You can now use the slice pattern syntax with subslices.
  - You can now use #[repr(transparent)] on univariant enums. Meaning
    that you can create an enum that has the exact layout and ABI of
    the type it contains.
  - There are some syntax-only changes:
  * default is syntactically allowed before items in trait
    definitions.
  * Items in impls (i.e. consts, types, and fns) may syntactically
    leave out their bodies in favor of ;.
  * Bounds on associated types in impls are now syntactically
    allowed (e.g. type Foo: Ord;).
  * ... (the C-variadic type) may occur syntactically directly
    as the type of any function parameter.
    These are still rejected semantically, so you will likely receive
    an error but these changes can be seen and parsed by procedural
    macros and conditional compilation.
  + Compiler
  - Added tier 2 support for armv7a-none-eabi.
  - Added tier 2 support for riscv64gc-unknown-linux-gnu.
  - Option::{expect,unwrap} and Result::{expect, expect_err, unwrap,
    unwrap_err} now produce panic messages pointing to the location
    where they were called, rather than core's internals.
    Refer to Rust's platform support page for more information on
    Rust's tiered platform support.
  + Libraries
  - iter::Empty&lt;T&gt; now implements Send and Sync for any T.
  - Pin::{map_unchecked, map_unchecked_mut} no longer require the
    return type to implement Sized.
  - io::Cursor now derives PartialEq and Eq.
  - Layout::new is now const.
  - Added Standard Library support for riscv64gc-unknown-linux-gnu.
  + Stabilized APIs
  - CondVar::wait_while
  - CondVar::wait_timeout_while
  - DebugMap::key
  - DebugMap::value
  - ManuallyDrop::take
  - matches!
  - ptr::slice_from_raw_parts_mut
  - ptr::slice_from_raw_parts
  + Cargo
  - You no longer need to include extern crate proc_macro; to be
    able to use proc_macro; in the 2018 edition.
  + Compatibility Notes
  - Error::description has been deprecated, and its use will now
    produce a warning. It's recommended to use Display/to_string
    instead.</changelog>
  <changelog author="schwab@suse.de" date="1586260800">- Avoid duplication of environment settings</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1588161600">- Update to version 1.43.0
  + Language
  - Fixed using binary operations with `&amp;{number}` (e.g. `&amp;1.0`)
    not having the type inferred correctly.
  - Attributes such as `#[cfg()]` can now be used on `if`
    expressions.
  - Syntax only changes:
  * Allow `type Foo: Ord` syntactically.
  * Fuse associated and extern items up to defaultness.
  * Syntactically allow `self` in all `fn` contexts.
  * Merge `fn` syntax + cleanup item parsing.
  * `item` macro fragments can be interpolated into `trait`s,
    `impl`s, and `extern` blocks.
    For example, you may now write:
    ```rust
    macro_rules! mac_trait {
    ($i:item) =&gt; {
    trait T { $i }
    }
    }
    mac_trait! {
    fn foo() {}
    }
    ```
  * These are still rejected *semantically*, so you will likely
    receive an error but these changes can be seen and parsed by
    macros and conditional compilation.
  + Compiler
  - You can now pass multiple lint flags to rustc to override the
    previous flags.
    For example; `rustc -D unused -A unused-variables` denies
    everything in the `unused` lint group except `unused-variables`
    which is explicitly allowed. However, passing
    `rustc -A unused-variables -D unused` denies everything in
    the `unused` lint group **including** `unused-variables` since
    the allow flag is specified before the deny flag (and therefore
    overridden).
  - rustc will now prefer your system MinGW libraries over its
    bundled libraries if they are available on `windows-gnu`.
  - rustc now buffers errors/warnings printed in JSON.
  + Libraries
  - `Arc&lt;[T; N]&gt;`, `Box&lt;[T; N]&gt;`, and `Rc&lt;[T; N]&gt;`, now implement
    `TryFrom&lt;Arc&lt;[T]&gt;&gt;`,`TryFrom&lt;Box&lt;[T]&gt;&gt;`, and `TryFrom&lt;Rc&lt;[T]&gt;&gt;`
    respectively.
  * *Note** These conversions are only available when `N` is
    `0..=32`.
  - You can now use associated constants on floats and integers
    directly, rather than having to import the module.
    e.g. You can now write `u32::MAX` or `f32::NAN` with no imports.
  - `u8::is_ascii` is now `const`.
  - `String` now implements `AsMut&lt;str&gt;`.
  - Added the `primitive` module to `std` and `core`.
    This module reexports Rust's primitive types. This is mainly
    useful in macros where you want avoid these types being shadowed.
  - Relaxed some of the trait bounds on `HashMap` and `HashSet`.
  - `string::FromUtf8Error` now implements `Clone + Eq`.
  + Stabilized APIs
  - `Once::is_completed`
  - `f32::LOG10_2`
  - `f32::LOG2_10`
  - `f64::LOG10_2`
  - `f64::LOG2_10`
  - `iter::once_with`
  + Cargo
  - You can now set config `[profile]`s in your `.cargo/config`,
    or through your environment.
  - Cargo will now set `CARGO_BIN_EXE_&lt;name&gt;` pointing to a
    binary's executable path when running integration tests or
    benchmarks.
    `&lt;name&gt;` is the name of your binary as-is e.g. If you wanted
    the executable path for a binary named `my-program`you would
    use `env!("CARGO_BIN_EXE_my-program")`.
  + Misc
  - Certain checks in the `const_err` lint were deemed unrelated
    to const evaluation, and have been moved to the
    `unconditional_panic` and `arithmetic_overflow` lints.
  + Compatibility Notes
  - Having trailing syntax in the `assert!` macro is now a hard
    error. This has been a warning since 1.36.0.
  - Fixed `Self` not having the correctly inferred type. This
    incorrectly led to some instances being accepted, and now
    correctly emits a hard error.</changelog>
  <changelog author="schwab@suse.de" date="1588593600">- Update rustfmt_version</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1589457600">- Update to version 1.43.1
  - Updated openssl-src to 1.1.1g for CVE-2020-1967.
  - Fixed the stabilization of AVX-512 features.
  - Fixed `cargo package --list` not working with unpublished
    dependencies.
- Check upstream signatures for binaries
- Add rust.keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1592827200">- Add patch Fix-big-endian-miscompile-of-bitcast-zex.patch
  to fix miscompilations with rustc 1.43 that lead to LTO failures
  (bsc#1173202)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1627387200">- Needed for Firefox91 (bsc#1188891)
- Rebased patches:
  + ignore-Wstring-conversion.patch (offset / fuzz)
  + Fix-big-endian-miscompile-of-bitcast-zex.patch dropped
- Add support for riscv64
- Make all shared libraries in %{common_libdir} executable; otherwise
  fdupes will not find any duplicates in %{rustlibdir}.
- rust-rpmlintrc: Reflect updated LLVM name in the filter.
- &lt;https://github.com/rust-lang/rust/issues/74976&gt;: Add "--stage 1"
  to the "./x.py doc" call to ensure the newly built compiler gets
  used.
- Resolve issue in constraints to select aarch64 builders in OBS that
  have correctly functioning CPU's.
- Resolve issue with zlib selection and buildrequires.
- Correct build issues with esoteric cpu architectures, by removing
  developer facing tools in some cases.
- Updates to spec file and legacy cleanups during build processes
- Correct issues with incorrect tuning of codegen units that caused
  builders to OOM
- Update to version 1.53:
  + Language
  - [You can now use unicode for identifiers.][83799] This allows multilingual
    identifiers but still doesn't allow glyphs that are not considered characters
    such as `?` or `?`. More specifically you can now use any identifier that
    matches the UAX #31 "Unicode Identifier and Pattern Syntax" standard. This
    is the same standard as languages like Python, however Rust uses NFC
    normalization which may be different from other languages.
  - [You can now specify "or patterns" inside pattern matches.][79278]
    Previously you could only use `|` (OR) on complete patterns. E.g.
    ```rust
    let x = Some(2u8);
    // Before
    matches!(x, Some(1) | Some(2));
    // Now
    matches!(x, Some(1 | 2));
    ```
  - [Added the `:pat_param` `macro_rules!` matcher.][83386] This matcher
    has the same semantics as the `:pat` matcher. This is to allow `:pat`
    to change semantics to being a pattern fragment in a future edition.
  + Compiler
  - [Updated the minimum external LLVM version to LLVM 10.][83387]
  - [Added Tier 3\* support for the `wasm64-unknown-unknown` target.][80525]
  - [Improved debuginfo for closures and async functions on Windows MSVC.][83941]
    \* Refer to Rust's [platform support page][platform-support-doc] for more
    information on Rust's tiered platform support.
  + Libraries
  - [Abort messages will now forward to `android_set_abort_message` on
    Android platforms when available.][81469]
  - [`slice::IterMut&lt;'_, T&gt;` now implements `AsRef&lt;[T]&gt;`][82771]
  - [Arrays of any length now implement `IntoIterator`.][84147]
    Currently calling `.into_iter()` as a method on an array will
    return `impl Iterator&lt;Item=&amp;T&gt;`, but this may change in a
    future edition to change `Item` to `T`. Calling `IntoIterator::into_iter`
    directly on arrays will provide `impl Iterator&lt;Item=T&gt;` as expected.
  - [`leading_zeros`, and `trailing_zeros` are now available on all
    `NonZero` integer types.][84082]
  - [`{f32, f64}::from_str` now parse and print special values
    (`NaN`, `-0`) according to IEEE RFC 754.][78618]
  - [You can now index into slices using `(Bound&lt;usize&gt;, Bound&lt;usize&gt;)`.][77704]
  - [Add the `BITS` associated constant to all numeric types.][82565]
  + Cargo
  - [Cargo now supports git repositories where the default `HEAD` branch is not
    "master".][cargo/9392] This also includes a switch to the version 3 `Cargo.lock` format
    which can handle default branches correctly.
  - [macOS targets now default to `unpacked` split-debuginfo.][cargo/9298]
  - [The `authors` field is no longer included in `Cargo.toml` for new
    projects.][cargo/9282]
  + Rustdoc
  - [Added the `rustdoc::bare_urls` lint that warns when you have URLs
    without hyperlinks.][81764]
  + Compatibility Notes
  - [Implement token-based handling of attributes during expansion][82608]
  - [`Ipv4::from_str` will now reject octal format IP addresses in addition
    to rejecting hexadecimal IP addresses.][83652] The octal format can lead
    to confusion and potential security vulnerabilities and [is no
    longer recommended][ietf6943].
- Update to version 1.52:
  + Language
  - [Added the `unsafe_op_in_unsafe_fn` lint, which checks whether the unsafe code
    in an `unsafe fn` is wrapped in a `unsafe` block.][79208] This lint
    is allowed by default, and may become a warning or hard error in a
    future edition.
  - [You can now cast mutable references to arrays to a pointer of the same type as
    the element.][81479]
  + Compiler
  - [Upgraded the default LLVM to LLVM 12.][81451]
  - Added tier 3\* support for the following targets.
  - [`s390x-unknown-linux-musl`][82166]
  - [`riscv32gc-unknown-linux-musl` &amp; `riscv64gc-unknown-linux-musl`][82202]
  - [`powerpc-unknown-openbsd`][82733]
  + Libraries
  - [`OsString` now implements `Extend` and `FromIterator`.][82121]
  - [`cmp::Reverse` now has `#[repr(transparent)]` representation.][81879]
  - [`Arc&lt;impl Error&gt;` now implements `error::Error`.][80553]
  - [All integer division and remainder operations are now `const`.][80962]
  + Stabilised APIs
  - [`Arguments::as_str`]
  - [`char::MAX`]
  - [`char::REPLACEMENT_CHARACTER`]
  - [`char::UNICODE_VERSION`]
  - [`char::decode_utf16`]
  - [`char::from_digit`]
  - [`char::from_u32_unchecked`]
  - [`char::from_u32`]
  - [`slice::partition_point`]
  - [`str::rsplit_once`]
  - [`str::split_once`]
    The following previously stable APIs are now `const`.
  - [`char::len_utf8`]
  - [`char::len_utf16`]
  - [`char::to_ascii_uppercase`]
  - [`char::to_ascii_lowercase`]
  - [`char::eq_ignore_ascii_case`]
  - [`u8::to_ascii_uppercase`]
  - [`u8::to_ascii_lowercase`]
  - [`u8::eq_ignore_ascii_case`]
  + Rustdoc
  - [Rustdoc lints are now treated as a tool lint, meaning that
    lints are now prefixed with `rustdoc::` (e.g. `#[warn(rustdoc::non_autolinks)]`).][80527]
    Using the old style is still allowed, and will become a warning in
    a future release.
  - [Rustdoc now supports argument files.][82261]
  - [Rustdoc now generates smart punctuation for documentation.][79423]
  - [You can now use "task lists" in Rustdoc Markdown.][81766] E.g.
    ```markdown
  - [x] Complete
  - [ ] Todo
    ```
  + Misc
  - [You can now pass multiple filters to tests.][81356] E.g.
    `cargo test -- foo bar` will run all tests that match `foo` and `bar`.
  - [Rustup now distributes PDB symbols for the `std` library on Windows,
    allowing you to see `std` symbols when debugging.][82218]
  + Internal Only
    These changes provide no direct user facing benefits, but represent significant
    improvements to the internals and overall performance of rustc and
    related tools.
  - [Check the result cache before the DepGraph when ensuring queries][81855]
  - [Try fast_reject::simplify_type in coherence before doing full check][81744]
  - [Only store a LocalDefId in some HIR nodes][81611]
  - [Store HIR attributes in a side table][79519]
  + Compatibility Notes
  - ------------------
  - [Cargo build scripts are now forbidden from setting `RUSTC_BOOTSTRAP`.][cargo/9181]
  - [Removed support for the `x86_64-rumprun-netbsd` target.][82594]
  - [Deprecated the `x86_64-sun-solaris` target in favor of `x86_64-pc-solaris`.][82216]
  - [Rustdoc now only accepts `,`, ` `, and `\t` as delimiters for specifying
    languages in code blocks.][78429]
  - [Rustc now catches more cases of `pub_use_of_private_extern_crate`][80763]
  - [Changes in how proc macros handle whitespace may lead to panics when used
    with older `proc-macro-hack` versions. A `cargo update` should be sufficient to fix
    this in all cases.][84136]
- Update to version 1.51:
  + Language
  - [You can now parameterize items such as functions, traits, and `struct`s by constant
    values in addition to by types and lifetimes.][79135] Also known as "const generics"
    E.g. you can now write the following. Note: Only values of primitive integers,
    `bool`, or `char` types are currently permitted.
  + Compiler
  - [Added the `-Csplit-debuginfo` codegen option for macOS platforms.][79570]
    This option controls whether debug information is split across multiple files
    or packed into a single file. **Note** This option is unstable on other platforms.
  - [Added tier 3\* support for `aarch64_be-unknown-linux-gnu`,
    `aarch64-unknown-linux-gnu_ilp32`, and `aarch64_be-unknown-linux-gnu_ilp32` targets.][81455]
  - [Added tier 3 support for `i386-unknown-linux-gnu` and `i486-unknown-linux-gnu` targets.][80662]
  - [The `target-cpu=native` option will now detect individual features of CPUs.][80749]
    \* Refer to Rust's [platform support page][platform-support-doc] for more
    information on Rust's tiered platform support.
  + Libraries
  - [`Box::downcast` is now also implemented for any `dyn Any + Send + Sync` object.][80945]
  - [`str` now implements `AsMut&lt;str&gt;`.][80279]
  - [`u64` and `u128` now implement `From&lt;char&gt;`.][79502]
  - [`Error` is now implemented for `&amp;T` where `T` implements `Error`.][75180]
  - [`Poll::{map_ok, map_err}` are now implemented for `Poll&lt;Option&lt;Result&lt;T, E&gt;&gt;&gt;`.][80968]
  - [`unsigned_abs` is now implemented for all signed integer types.][80959]
  - [`io::Empty` now implements `io::Seek`.][78044]
  - [`rc::Weak&lt;T&gt;` and `sync::Weak&lt;T&gt;`'s methods such as `as_ptr` are now implemented for
    `T: ?Sized` types.][80764]
  + Stabilized APIs
  - [`Arc::decrement_strong_count`]
  - [`Arc::increment_strong_count`]
  - [`Once::call_once_force`]
  - [`Peekable::next_if_eq`]
  - [`Peekable::next_if`]
  - [`Seek::stream_position`]
  - [`array::IntoIter`]
  - [`panic::panic_any`]
  - [`ptr::addr_of!`]
  - [`ptr::addr_of_mut!`]
  - [`slice::fill_with`]
  - [`slice::split_inclusive_mut`]
  - [`slice::split_inclusive`]
  - [`slice::strip_prefix`]
  - [`slice::strip_suffix`]
  - [`str::split_inclusive`]
  - [`sync::OnceState`]
  - [`task::Wake`]
  + Cargo
  - [Added the `split-debuginfo` profile option to control the -Csplit-debuginfo
    codegen option.][cargo/9112]
  - [Added the `resolver` field to `Cargo.toml` to enable the new feature resolver
    and CLI option behavior.][cargo/8997] Version 2 of the feature resolver will try
    to avoid unifying features of dependencies where that unification could be unwanted.
    Such as using the same dependency with a `std` feature in a build scripts and
    proc-macros, while using the `no-std` feature in the final binary. See the
    [Cargo book documentation][feature-resolver@2.0] for more information on the feature.
  + Rustdoc
  - [Rustdoc will now include documentation for methods available from _nested_ `Deref` traits.][80653]
  - [You can now provide a `--default-theme` flag which sets the default theme to use for
    documentation.][79642]
    Various improvements to intra-doc links:
  - [You can link to non-path primitives such as `slice`.][80181]
  - [You can link to associated items.][74489]
  - [You can now include generic parameters when linking to items, like `Vec&lt;T&gt;`.][76934]
  + Misc
  - [You can now pass `--include-ignored` to tests (e.g. with
    `cargo test -- --include-ignored`) to include testing tests marked `#[ignore]`.][80053]
  + Compatibility Notes
  - [WASI platforms no longer use the `wasm-bindgen` ABI, and instead use the wasm32 ABI.][79998]
  - [`rustc` no longer promotes division, modulo and indexing operations to `const` that
    could fail.][80579]
  - [The minimum version of glibc for the following platforms has been bumped to version 2.31
    for the distributed artifacts.][81521]
  - `armv5te-unknown-linux-gnueabi`
  - `sparc64-unknown-linux-gnu`
  - `thumbv7neon-unknown-linux-gnueabihf`
  - `armv7-unknown-linux-gnueabi`
  - `x86_64-unknown-linux-gnux32`
- Update to version 1.50:
  * This fixes build on armv7 - boo#1181643
  + Language
  - You can now use const values for x in [x; N] array expressions.
    This has been technically possible since 1.38.0, as it was
    unintentionally stabilized.
  - Assignments to ManuallyDrop&lt;T&gt; union fields are now considered safe.
  + Compiler
  - Added tier 3* support for the armv5te-unknown-linux-uclibceabi
    target.
  - Added tier 3 support for the aarch64-apple-ios-macabi target.
  - The x86_64-unknown-freebsd is now built with the full toolset.
  - Dropped support for all cloudabi targets.
  * Refer to Rust's platform support page for more information on
    Rust's tiered platform support.
  + Libraries
  - proc_macro::Punct now implements PartialEq&lt;char&gt;.
  - ops::{Index, IndexMut} are now implemented for fixed sized
    arrays of any length.
  - On Unix platforms, the std::fs::File type now has a "niche" of -1.
    This value cannot be a valid file descriptor, and now means Option&lt;File&gt;
    takes up the same amount of space as File.
  + Stabilized APIs
    bool::then
    btree_map::Entry::or_insert_with_key
    f32::clamp
    f64::clamp
    hash_map::Entry::or_insert_with_key
    Ord::clamp
    RefCell::take
    slice::fill
    UnsafeCell::get_mut
  - The following previously stable methods are now const.
    IpAddr::is_ipv4
    IpAddr::is_ipv6
    IpAddr::is_unspecified
    IpAddr::is_loopback
    IpAddr::is_multicast
    Ipv4Addr::octets
    Ipv4Addr::is_loopback
    Ipv4Addr::is_private
    Ipv4Addr::is_link_local
    Ipv4Addr::is_multicast
    Ipv4Addr::is_broadcast
    Ipv4Addr::is_documentation
    Ipv4Addr::to_ipv6_compatible
    Ipv4Addr::to_ipv6_mapped
    Ipv6Addr::segments
    Ipv6Addr::is_unspecified
    Ipv6Addr::is_loopback
    Ipv6Addr::is_multicast
    Ipv6Addr::to_ipv4
    Layout::size
    Layout::align
    Layout::from_size_align
    pow for all integer types.
    checked_pow for all integer types.
    saturating_pow for all integer types.
    wrapping_pow for all integer types.
    next_power_of_two for all unsigned integer types.
    checked_next_power_of_two for all unsigned integer types.
  + Cargo
  - Added the [build.rustc-workspace-wrapper] option. This option
    sets a wrapper to execute instead of rustc, for workspace members only.
  - cargo:rerun-if-changed will now, if provided a directory,
    scan the entire contents of that directory for changes.
  - Added the --workspace flag to the cargo update command.
  + Misc
  - The search results tab and the help button are focusable
    with keyboard in rustdoc.
  - Running tests will now print the total time taken to execute.
  + Compatibility Notes
  - The compare_and_swap method on atomics has been deprecated.
    It's recommended to use the compare_exchange and
    compare_exchange_weak methods instead.
  - Changes in how TokenStreams are checked have fixed some cases
    where you could write unhygenic macro_rules! macros.
  - #![test] as an inner attribute is now considered unstable
    like other inner macro attributes, and reports an error by
    default through the soft_unstable lint.
  - Overriding a forbid lint at the same level that it was set
    is now a hard error.
  - You can no longer intercept panic! calls by supplying your own
    macro. It's recommended to use the #[panic_handler] attribute
    to provide your own implementation.
  - Semi-colons after item statements (e.g. struct Foo {};)
    now produce a warning.
- Update to version 1.49.0
  + Language
  - Unions can now implement Drop, and you can now have a field in
    a union with ManuallyDrop&lt;T&gt;.
  - You can now cast uninhabited enums to integers.
  - You can now bind by reference and by move in patterns. This
    allows you to selectively borrow individual components of a type.
    E.g.
    [#][derive(Debug)]
    struct Person {
    name: String,
    age: u8,
    }
    let person = Person {
    name: String::from("Alice"),
    age: 20,
    };
    // `name` is moved out of person, but `age` is referenced.
    let Person { name, ref age } = person;
    println!("{} {}", name, age);
  + Compiler
  - Added tier 1* support for aarch64-unknown-linux-gnu.
  - Added tier 2 support for aarch64-apple-darwin.
  - Added tier 2 support for aarch64-pc-windows-msvc.
  - Added tier 3 support for mipsel-unknown-none.
  - Raised the minimum supported LLVM version to LLVM 9.
  - Output from threads spawned in tests is now captured.
  - Change os and vendor values to "none" and "unknown" for some targets
  * Refer to Rust's platform support page for more information on Rust's
    tiered platform support.
  + Libraries
  - RangeInclusive now checks for exhaustion when calling contains and
    indexing.
  - ToString::to_string now no longer shrinks the internal buffer in
    the default implementation.
  - ops::{Index, IndexMut} are now implemented for fixed sized arrays
    of any length.
  + Stabilized APIs
  - slice::select_nth_unstable
  - slice::select_nth_unstable_by
  - slice::select_nth_unstable_by_key
  The following previously stable methods are now const.
  - Poll::is_ready
  - Poll::is_pending
  + Cargo
  - Building a crate with cargo-package should now be independently
    reproducible.
  - cargo-tree now marks proc-macro crates.
  - Added CARGO_PRIMARY_PACKAGE build-time environment variable. This
    variable will be set if the crate being built is one the user
    selected to build, either with -p or through defaults.
  - You can now use glob patterns when specifying packages &amp; targets.
  + Compatibility Notes
  - Demoted i686-unknown-freebsd from host tier 2 to target tier 2
    support.
  - Macros that end with a semi-colon are now treated as statements
    even if they expand to nothing.
  - Rustc will now check for the validity of some built-in attributes
    on enum variants. Previously such invalid or unused attributes
    could be ignored.
  - Leading whitespace is stripped more uniformly in documentation
    comments, which may change behavior. You read this post about
    the changes for more details.
  - Trait bounds are no longer inferred for associated types.
  + Internal Only
  These changes provide no direct user facing benefits, but
  represent significant improvements to the internals and overall
  performance of rustc and related tools.
  - rustc's internal crates are now compiled using the initial-exec
    Thread Local Storage model.
  - Calculate visibilities once in resolve.
  - Added system to the llvm-libunwind bootstrap config option.
  - Added --color for configuring terminal color support to bootstrap.
- Update to version 1.48.0
  + Language
  - The `unsafe` keyword is now syntactically permitted on modules.
    This is still rejected semantically, but can now be parsed by procedural
    macros.
  + Compiler
  - Stabilised the `-C link-self-contained=&lt;yes|no&gt;` compiler flag.
    This tells `rustc` whether to link its own C runtime and libraries or to
    rely on a external linker to find them. (Supported only on `windows-gnu`,
    `linux-musl`, and `wasi` platforms.)
  - You can now use `-C target-feature=+crt-static` on `linux-gnu` targets.
    Note: If you're using cargo you must explicitly pass the `--target` flag.
  - Added tier 2* support for aarch64-unknown-linux-musl.
  * Refer to Rust's platform support page for more information on Rust's
    tiered platform support.
  + Libraries
  - io::Write is now implemented for &amp;ChildStdin &amp;Sink, &amp;Stdout, and &amp;Stderr.
  - All arrays of any length now implement TryFrom&lt;Vec&lt;T&gt;&gt;.
  - The matches! macro now supports having a trailing comma.
  - Vec&lt;A&gt; now implements PartialEq&lt;[B]&gt; where A: PartialEq&lt;B&gt;.
  - The RefCell::{replace, replace_with, clone} methods now all use #[track_caller].
  + Stabilized APIs
  - slice::as_ptr_range
  - slice::as_mut_ptr_range
  - VecDeque::make_contiguous
  - future::pending
  - future::ready
  The following previously stable methods are now `const fn's`:
  - Option::is_some
  - Option::is_none
  - Option::as_ref
  - Result::is_ok
  - Result::is_err
  - Result::as_ref
  - Ordering::reverse
  - Ordering::then
  + Cargo
  + Rustdoc
  - You can now link to items in rustdoc using the intra-doc link syntax.
    E.g. /// Uses [`std::future`] will automatically generate a link to
    std::future's documentation. See "Linking to items by name" for more
    information.
  - You can now specify #[doc(alias = "&lt;alias&gt;")] on items to add search
    aliases when searching through rustdoc's UI.
  + Compatibility Notes
  - Promotion of references to 'static lifetime inside const fn now
    follows the same rules as inside a fn body. In particular, &amp;foo()
    will not be promoted to 'static lifetime any more inside const fns.
  - Associated type bindings on trait objects are now verified to meet
    the bounds declared on the trait when checking that they implement
    the trait.
  - When trait bounds on associated types or opaque types are ambiguous,
    the compiler no longer makes an arbitrary choice on which bound to use.
  - Fixed recursive nonterminals not being expanded in macros during
    pretty-print/reparse check. This may cause errors if your macro
    wasn't correctly handling recursive nonterminal tokens.
  - &amp;mut references to non zero-sized types are no longer promoted.
  - rustc will now warn if you use attributes like #[link_name] or
    [#][cold] in places where they have no effect.
  - Updated _mm256_extract_epi8 and _mm256_extract_epi16 signatures
    in arch::{x86, x86_64} to return i32 to match the vendor signatures.
  - mem::uninitialized will now panic if any inner types inside a struct
    or enum disallow zero-initialization.
  - #[target_feature] will now error if used in a place where it has no effect.
  - Foreign exceptions are now caught by catch_unwind and will cause an
    abort. Note: This behaviour is not guaranteed and is still considered
    undefined behaviour, see the catch_unwind documentation for further
    information.
  + Internal Only
    These changes provide no direct user facing benefits, but represent
    significant improvements to the internals and overall performance of
    rustc and related tools.
  - Building rustc from source now uses ninja by default over make.
    You can continue building with make by setting ninja=false in
    your config.toml.
  - cg_llvm: fewer_names in uncached_llvm_type
  - Made ensure_sufficient_stack() non-generic
- Update to version 1.47.0
  + Language
  - [Closures will now warn when not used.][74869]
  + Compiler
  - [Stabilized the `-C control-flow-guard` codegen option][73893], which enables
    [Control Flow Guard][1.47.0-cfg] for Windows platforms, and is ignored on other
    platforms.
  - [Upgraded to LLVM 11.][73526]
  - [Added tier 3\* support for the `thumbv4t-none-eabi` target.][74419]
  - [Upgrade the FreeBSD toolchain to version 11.4][75204]
  - [`RUST_BACKTRACE`'s output is now more compact.][75048]
  \* Refer to Rust's [platform support page][forge-platform-support] for more
  information on Rust's tiered platform support.
  + Libraries
  - [`CStr` now implements `Index&lt;RangeFrom&lt;usize&gt;&gt;`.][74021]
  - [Traits in `std`/`core` are now implemented for arrays of any length, not just
    those of length less than 33.][74060]
  - [`ops::RangeFull` and `ops::Range` now implement Default.][73197]
  - [`panic::Location` now implements `Copy`, `Clone`, `Eq`, `Hash`, `Ord`,
    `PartialEq`, and `PartialOrd`.][73583]
  + Stabilized APIs
  - [`Ident::new_raw`]
  - [`Range::is_empty`]
  - [`RangeInclusive::is_empty`]
  - [`Result::as_deref`]
  - [`Result::as_deref_mut`]
  - [`Vec::leak`]
  - [`pointer::offset_from`]
  - [`f32::TAU`]
  - [`f64::TAU`]
  The following previously stable APIs have now been made const.
  - [The `new` method for all `NonZero` integers.][73858]
  - [The `checked_add`,`checked_sub`,`checked_mul`,`checked_neg`, `checked_shl`,
    `checked_shr`, `saturating_add`, `saturating_sub`, and `saturating_mul`
    methods for all integers.][73858]
  - [The `checked_abs`, `saturating_abs`, `saturating_neg`, and `signum`  for all
    signed integers.][73858]
  - [The `is_ascii_alphabetic`, `is_ascii_uppercase`, `is_ascii_lowercase`,
    `is_ascii_alphanumeric`, `is_ascii_digit`, `is_ascii_hexdigit`,
    `is_ascii_punctuation`, `is_ascii_graphic`, `is_ascii_whitespace`, and
    `is_ascii_control` methods for `char` and `u8`.][73858]
  + Cargo
  - [`build-dependencies` are now built with opt-level 0 by default.][cargo/8500]
    You can override this by setting the following in your `Cargo.toml`.
    ```toml
    [profile.release.build-override]
    opt-level = 3
    ```
  - [`cargo-help` will now display man pages for commands rather just the
    `--help` text.][cargo/8456]
  - [`cargo-metadata` now emits a `test` field indicating if a target has
    tests enabled.][cargo/8478]
  - [`workspace.default-members` now respects `workspace.exclude`.][cargo/8485]
  - [`cargo-publish` will now use an alternative registry by default if it's the
    only registry specified in `package.publish`.][cargo/8571]
  + Misc
  - [Added a help button beside Rustdoc's searchbar that explains rustdoc's
    type based search.][75366]
  - [Added the Ayu theme to rustdoc.][71237]
- Update to version 1.46.0
  + Language
  - [`if`, `match`, and `loop` expressions can now be used in const functions.][72437]
  - [Additionally you are now also able to coerce and cast to slices (`&amp;[T]`) in
    const functions.][73862]
  - [The `#[track_caller]` attribute can now be added to functions to use the
    function's caller's location information for panic messages.][72445]
  - [Recursively indexing into tuples no longer needs parentheses.][71322] E.g.
    `x.0.0` over `(x.0).0`.
  - [`mem::transmute` can now be used in statics and constants.][72920] **Note**
    You currently can't use `mem::transmute` in constant functions.
  + Compiler
  - [You can now use the `cdylib` target on Apple iOS and tvOS platforms.][73516]
  - [Enabled static "Position Independent Executables" by default
    for `x86_64-unknown-linux-musl`.][70740]
  + Libraries
  - [`mem::forget` is now a `const fn`.][73887]
  - [`String` now implements `From&lt;char&gt;`.][73466]
  - [The `leading_ones`, and `trailing_ones` methods have been stabilised for all
    integer types.][73032]
  - [`vec::IntoIter&lt;T&gt;` now implements `AsRef&lt;[T]&gt;`.][72583]
  - [All non-zero integer types (`NonZeroU8`) now implement `TryFrom` for their
    zero-able equivalent (e.g. `TryFrom&lt;u8&gt;`).][72717]
  - [`&amp;[T]` and `&amp;mut [T]` now implement `PartialEq&lt;Vec&lt;T&gt;&gt;`.][71660]
  - [`(String, u16)` now implements `ToSocketAddrs`.][73007]
  - [`vec::Drain&lt;'_, T&gt;` now implements `AsRef&lt;[T]&gt;`.][72584]
  + Stabilized APIs
  - [`Option::zip`]
  - [`vec::Drain::as_slice`]
  + Cargo
    Added a number of new environment variables that are now available when
    compiling your crate.
  - [`CARGO_BIN_NAME` and `CARGO_CRATE_NAME`][cargo/8270] Providing the name of
    the specific binary being compiled and the name of the crate.
  - [`CARGO_PKG_LICENSE`][cargo/8325] The license from the manifest of the package.
  - [`CARGO_PKG_LICENSE_FILE`][cargo/8387] The path to the license file.
- Update to version 1.44.1
  * rustfmt accepts rustfmt_skip in cfg_attr again.
  * Don't hash executable filenames on apple platforms, fixing backtraces.
  * Fix crashes when finding backtrace on macOS.
  * Clippy applies lint levels into different files.
- Update to version 1.44.0
  + Language
  - You can now use `async/.await` with `#[no_std]` enabled.
  - Added the `unused_braces` lint.
  - Expansion-driven outline module parsing
  + Compiler
  - Rustc now respects the `-C codegen-units` flag in incremental mode.
    Additionally when in incremental mode rustc defaults to 256 codegen units.
  - Refactored `catch_unwind` to have zero-cost, unless unwinding is enabled and
    a panic is thrown.
  - Added tier 3\* support for the `aarch64-unknown-none` and
    `aarch64-unknown-none-softfloat` targets.
  - Added tier 3 support for `arm64-apple-tvos` and
    `x86_64-apple-tvos` targets.
  + Libraries
  - Special cased `vec![]` to map directly to `Vec::new()`. This allows
    `vec![]` to be able to be used in `const` contexts.
  - `convert::Infallible` now implements `Hash`.
  - `OsString` now implements `DerefMut` and `IndexMut` returning
    a `&amp;mut OsStr`.
  - Unicode 13 is now supported.
  - `String` now implements `From&lt;&amp;mut str&gt;`.
  - `IoSlice` now implements `Copy`.
  - `Vec&lt;T&gt;` now implements `From&lt;[T; N]&gt;`. Where `N` is at most 32.
  - `proc_macro::LexError` now implements `fmt::Display` and `Error`.
  - `from_le_bytes`, `to_le_bytes`, `from_be_bytes`, `to_be_bytes`,
    `from_ne_bytes`, and `to_ne_bytes` methods are now `const` for all
    integer types.
  + Stabilizd APIs
  - [`PathBuf::with_capacity`]
  - [`PathBuf::capacity`]
  - [`PathBuf::clear`]
  - [`PathBuf::reserve`]
  - [`PathBuf::reserve_exact`]
  - [`PathBuf::shrink_to_fit`]
  - [`f32::to_int_unchecked`]
  - [`f64::to_int_unchecked`]
  - [`Layout::align_to`]
  - [`Layout::pad_to_align`]
  - [`Layout::array`]
  - [`Layout::extend`]
  + Cargo
  - Added the `cargo tree` command which will print a tree graph of
    your dependencies
  + Misc
  - Rustdoc now allows you to specify `--crate-version` to have rustdoc include
    the version in the sidebar.
  + Compatibility Notes
  - Rustc now correctly generates static libraries on Windows GNU targets with
    the `.a` extension, rather than the previous `.lib`.
  - Removed the `-C no_integrated_as` flag from rustc.
  - The `file_name` property in JSON output of macro errors now points the actual
    source file rather than the previous format of `&lt;NAME macros&gt;`.
  * *Note:** this may not point to a file that actually exists on the user's system.
  - The minimum required external LLVM version has been bumped to LLVM 8.
  - `mem::{zeroed, uninitialised}` will now panic when used with types that do
    not allow zero initialization such as `NonZeroU8`. This was
    previously a warning.
  - In 1.45.0 (the next release) converting a `f64` to `u32` using the `as`
    operator has been defined as a saturating operation. This was previously
    undefined behaviour, but you can use the `{f64, f32}::to_int_unchecked` methods to
    continue using the current behaviour, which may be desirable in rare performance
    sensitive situations.</changelog>
  <changelog author="william.brown@suse.com" date="1642680000">- bsc#1194767 - CVE-2022-21658 - Resolve race condition in std::fs::remove_dir_all
  - 0001-Fix-CVE-2022-21658-for-UNIX-like.patch</changelog>
</package>
<package pkgid="aa31d37f21705e99ae9e81a4df54fc3f585731c46d9ad8d6d77ceed27438d057" name="rust-doc" arch="x86_64">
  <version epoch="0" ver="1.53.0" rel="22.1"/>
  <changelog author="luke@ljones.dev" date="1569844800">- Add patch add-option-to-allow-warnings.patch to add a config option
  which allows warnings and so enables v1.38 to bootstrap itself.</changelog>
  <changelog author="rhafer@suse.com" date="1571832000">- Switch to bundled version of libgit2 for now. libgit2-sys seems
  to expect using the bundled variant, which just seems to point
  to a snapshot of the master branch and doesn't match any released
  libgit2 (bsc#1154817).
  See: https://github.com/rust-lang/rust/issues/63476 and
  https://github.com/rust-lang/git2-rs/issues/458 for details.</changelog>
  <changelog author="aplanas@suse.com" date="1573128000">- Update to version 1.39.0
  + Language
  - You can now create async functions and blocks with async fn,
    async move {}, and async {} respectively, and you can now call
    .await on async expressions.
  - You can now use certain attributes on function, closure, and
    function pointer parameters.
  - You can now take shared references to bind-by-move patterns in
    the if guards of match arms.
  + Compiler
  - Added tier 3 support for the i686-unknown-uefi target.
  - Added tier 3 support for the sparc64-unknown-openbsd target.
  - rustc will now trim code snippets in diagnostics to fit in your
    terminal.
  - You can now pass --show-output argument to test binaries to
    print the output of successful tests.
  + For more details:
    https://github.com/rust-lang/rust/blob/stable/RELEASES.md#version-1390-2019-11-07
- Drop patches already merged in upstream:
  + rust-61206-assume-tarball-llvm-is-fresh.patch
  + add-option-to-allow-warnings.patch</changelog>
  <changelog author="aplanas@suse.com" date="1573214400">- Add hopefully-fix-rustdoc-build.patch to fix rustdoc compilation</changelog>
  <changelog author="aplanas@suse.com" date="1574683200">- Re-format the spec file
- Add a README to explain the update process
- Add _service file for download the assets and re-base the patches</changelog>
  <changelog author="ngompa13@gmail.com" date="1575028800">- Rename README to README.suse-maint and add it as a source
  to stop factory-auto from declining submissions automatically</changelog>
  <changelog author="opensuse-packaging@opensuse.org" date="1577707200">- Rebased patches:
  + hopefully-fix-rustdoc-build.patch dropped (merged upstream)</changelog>
  <changelog author="luke@ljones.dev" date="1577707201">- Update to version 1.40.0
  + Language
  - You can now use tuple `struct`s and tuple `enum` variant's constructors in
    `const` contexts. e.g.
    pub struct Point(i32, i32);
    const ORIGIN: Point = {
    let constructor = Point;
    constructor(0, 0)
    };
  - You can now mark `struct`s, `enum`s, and `enum` variants with the `#[non_exhaustive]` attribute to
    indicate that there may be variants or fields added in the future.
    For example this requires adding a wild-card branch (`_ =&gt; {}`) to any match
    statements on a non-exhaustive `enum`.
  - You can now use function-like procedural macros in `extern` blocks and in
    type positions. e.g. `type Generated = macro!();`
  - Function-like and attribute procedural macros can now emit
    `macro_rules!` items, so you can now have your macros generate macros.
  - The `meta` pattern matcher in `macro_rules!` now correctly matches the modern
    attribute syntax. For example `(#[$m:meta])` now matches `#[attr]`,
    `#[attr{tokens}]`, `#[attr[tokens]]`, and `#[attr(tokens)]`.
  + Compiler
  - Added tier 3 support\* for the
    `thumbv7neon-unknown-linux-musleabihf` target.
  - Added tier 3 support for the
    `aarch64-unknown-none-softfloat` target.
  - Added tier 3 support for the `mips64-unknown-linux-muslabi64`, and
    `mips64el-unknown-linux-muslabi64` targets.
  + Libraries
  - The `is_power_of_two` method on unsigned numeric types is now a `const` function.
  + Stabilized APIs
  - BTreeMap::get_key_value
  - HashMap::get_key_value
  - Option::as_deref_mut
  - Option::as_deref
  - Option::flatten
  - UdpSocket::peer_addr
  - f32::to_be_bytes
  - f32::to_le_bytes
  - f32::to_ne_bytes
  - f64::to_be_bytes
  - f64::to_le_bytes
  - f64::to_ne_bytes
  - f32::from_be_bytes
  - f32::from_le_bytes
  - f32::from_ne_bytes
  - f64::from_be_bytes
  - f64::from_le_bytes
  - f64::from_ne_bytes
  - mem::take
  - slice::repeat
  - todo!
  + Cargo
  - Cargo will now always display warnings, rather than only on
    fresh builds.
  - Feature flags (except `--all-features`) passed to a virtual workspace will
    now produce an error. Previously these flags were ignored.
  - You can now publish `dev-dependencies` without including
    a `version`.
  + Misc
  - You can now specify the `#[cfg(doctest)]` attribute to include an item only
    when running documentation tests with `rustdoc`.
  + Compatibility Notes
  - As previously announced, any previous NLL warnings in the 2015 edition are
    now hard errors.
  - The `include!` macro will now warn if it failed to include the
    entire file. The `include!` macro unintentionally only includes the
    first _expression_ in a file, and this can be unintuitive. This will become
    either a hard error in a future release, or the behavior may be fixed to include all expressions as expected.
  - Using `#[inline]` on function prototypes and consts now emits a warning under
    `unused_attribute` lint. Using `#[inline]` anywhere else inside traits
    or `extern` blocks now correctly emits a hard error.</changelog>
  <changelog author="federico@suse.com" date="1578484800">- Bump version of libssh2 for SLE15; we now need a version with
  libssh2_userauth_publickey_frommemory(), which appeared in libssh2
  1.6.0.
- Use the bundled libssh2 prior to SLE15.  SLE12 has 1.4.3, which is
  too old for the ssh crate now.</changelog>
  <changelog author="dimstar@opensuse.org" date="1579262400">- Adjust constraints: Request 20GB HDD for all archs. Simplify the
  file by removing the overrides for various disk sizes. All archs
  are curretnly at roughly 17GB storage in use.</changelog>
  <changelog author="federico@suse.com" date="1584964800">- Update to version 1.41.1:
  - Always check types of static items
  - Always check lifetime bounds of `Copy` impls
  - Fix miscompilation in callers of `Layout::repeat`
- Update to version 1.41.0:
  + Language
  - You can now pass type parameters to foreign items when implementing
    traits. E.g. You can now write `impl&lt;T&gt; From&lt;Foo&gt; for Vec&lt;T&gt; {}`.
  - You can now arbitrarily nest receiver types in the `self` position. E.g. you can
    now write `fn foo(self: Box&lt;Box&lt;Self&gt;&gt;) {}`. Previously only `Self`, `&amp;Self`,
    `&amp;mut Self`, `Arc&lt;Self&gt;`, `Rc&lt;Self&gt;`, and `Box&lt;Self&gt;` were allowed.
  - You can now use any valid identifier in a `format_args` macro.
    Previously identifiers starting with an underscore were not allowed.
  - Visibility modifiers (e.g. `pub`) are now syntactically allowed on trait items and
    enum variants. These are still rejected semantically, but
    can be seen and parsed by procedural macros and conditional compilation.
  + Compiler
  - Rustc will now warn if you have unused loop `'label`s.
  - Removed support for the `i686-unknown-dragonfly` target.
  - Added tier 3 support\* for the `riscv64gc-unknown-linux-gnu` target.
  - You can now pass an arguments file passing the `@path` syntax
    to rustc. Note that the format differs somewhat from what is
    found in other tooling; please see the documentation for
    more information.
  - You can now provide `--extern` flag without a path, indicating that it is
    available from the search path or specified with an `-L` flag.
    Refer to Rust's [platform support page][forge-platform-support] for more
    information on Rust's tiered platform support.
  + Libraries
  - The `core::panic` module is now stable. It was already stable
    through `std`.
  - `NonZero*` numerics now implement `From&lt;NonZero*&gt;` if it's a smaller integer
    width. E.g. `NonZeroU16` now implements `From&lt;NonZeroU8&gt;`.
  - `MaybeUninit&lt;T&gt;` now implements `fmt::Debug`.
  + Stabilized APIs
  - `Result::map_or`
  - `Result::map_or_else`
  - `std::rc::Weak::weak_count`
  - `std::rc::Weak::strong_count`
  - `std::sync::Weak::weak_count`
  - `std::sync::Weak::strong_count`
  + Cargo
  - Cargo will now document all the private items for binary crates
    by default.
  - `cargo-install` will now reinstall the package if it detects that it is out
    of date.
  - Cargo.lock now uses a more git friendly format that should help to reduce
    merge conflicts.
  - You can now override specific dependencies's build settings. E.g.
    `[profile.dev.package.image] opt-level = 2` sets the `image` crate's
    optimisation level to `2` for debug builds. You can also use
    `[profile.&lt;profile&gt;.build-override]` to override build scripts and
    their dependencies.
  + Misc
  - You can now specify `edition` in documentation code blocks to compile the block
    for that edition. E.g. `edition2018` tells rustdoc that the code sample
    should be compiled the 2018 edition of Rust.
  - You can now provide custom themes to rustdoc with `--theme`, and check the
    current theme with `--check-theme`.
  - You can use `#[cfg(doc)]` to compile an item when building documentation.
  + Compatibility Notes
  - As previously announced 1.41.0 will be the last tier 1 release for 32-bit
    Apple targets. This means that the source code is still
    available to build, but the targets are no longer being tested and release
    binaries for those platforms will no longer be distributed by the Rust project.
    Please refer to the linked blog post for more information.</changelog>
  <changelog author="alarrosa@suse.com" date="1585656000">- Rebased patches:
  + ignore-Wstring-conversion.patch (offset / fuzz)</changelog>
  <changelog author="alarrosa@suse.com" date="1585656001">- Update to version 1.42.0:
  + Language
  - You can now use the slice pattern syntax with subslices.
  - You can now use #[repr(transparent)] on univariant enums. Meaning
    that you can create an enum that has the exact layout and ABI of
    the type it contains.
  - There are some syntax-only changes:
  * default is syntactically allowed before items in trait
    definitions.
  * Items in impls (i.e. consts, types, and fns) may syntactically
    leave out their bodies in favor of ;.
  * Bounds on associated types in impls are now syntactically
    allowed (e.g. type Foo: Ord;).
  * ... (the C-variadic type) may occur syntactically directly
    as the type of any function parameter.
    These are still rejected semantically, so you will likely receive
    an error but these changes can be seen and parsed by procedural
    macros and conditional compilation.
  + Compiler
  - Added tier 2 support for armv7a-none-eabi.
  - Added tier 2 support for riscv64gc-unknown-linux-gnu.
  - Option::{expect,unwrap} and Result::{expect, expect_err, unwrap,
    unwrap_err} now produce panic messages pointing to the location
    where they were called, rather than core's internals.
    Refer to Rust's platform support page for more information on
    Rust's tiered platform support.
  + Libraries
  - iter::Empty&lt;T&gt; now implements Send and Sync for any T.
  - Pin::{map_unchecked, map_unchecked_mut} no longer require the
    return type to implement Sized.
  - io::Cursor now derives PartialEq and Eq.
  - Layout::new is now const.
  - Added Standard Library support for riscv64gc-unknown-linux-gnu.
  + Stabilized APIs
  - CondVar::wait_while
  - CondVar::wait_timeout_while
  - DebugMap::key
  - DebugMap::value
  - ManuallyDrop::take
  - matches!
  - ptr::slice_from_raw_parts_mut
  - ptr::slice_from_raw_parts
  + Cargo
  - You no longer need to include extern crate proc_macro; to be
    able to use proc_macro; in the 2018 edition.
  + Compatibility Notes
  - Error::description has been deprecated, and its use will now
    produce a warning. It's recommended to use Display/to_string
    instead.</changelog>
  <changelog author="schwab@suse.de" date="1586260800">- Avoid duplication of environment settings</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1588161600">- Update to version 1.43.0
  + Language
  - Fixed using binary operations with `&amp;{number}` (e.g. `&amp;1.0`)
    not having the type inferred correctly.
  - Attributes such as `#[cfg()]` can now be used on `if`
    expressions.
  - Syntax only changes:
  * Allow `type Foo: Ord` syntactically.
  * Fuse associated and extern items up to defaultness.
  * Syntactically allow `self` in all `fn` contexts.
  * Merge `fn` syntax + cleanup item parsing.
  * `item` macro fragments can be interpolated into `trait`s,
    `impl`s, and `extern` blocks.
    For example, you may now write:
    ```rust
    macro_rules! mac_trait {
    ($i:item) =&gt; {
    trait T { $i }
    }
    }
    mac_trait! {
    fn foo() {}
    }
    ```
  * These are still rejected *semantically*, so you will likely
    receive an error but these changes can be seen and parsed by
    macros and conditional compilation.
  + Compiler
  - You can now pass multiple lint flags to rustc to override the
    previous flags.
    For example; `rustc -D unused -A unused-variables` denies
    everything in the `unused` lint group except `unused-variables`
    which is explicitly allowed. However, passing
    `rustc -A unused-variables -D unused` denies everything in
    the `unused` lint group **including** `unused-variables` since
    the allow flag is specified before the deny flag (and therefore
    overridden).
  - rustc will now prefer your system MinGW libraries over its
    bundled libraries if they are available on `windows-gnu`.
  - rustc now buffers errors/warnings printed in JSON.
  + Libraries
  - `Arc&lt;[T; N]&gt;`, `Box&lt;[T; N]&gt;`, and `Rc&lt;[T; N]&gt;`, now implement
    `TryFrom&lt;Arc&lt;[T]&gt;&gt;`,`TryFrom&lt;Box&lt;[T]&gt;&gt;`, and `TryFrom&lt;Rc&lt;[T]&gt;&gt;`
    respectively.
  * *Note** These conversions are only available when `N` is
    `0..=32`.
  - You can now use associated constants on floats and integers
    directly, rather than having to import the module.
    e.g. You can now write `u32::MAX` or `f32::NAN` with no imports.
  - `u8::is_ascii` is now `const`.
  - `String` now implements `AsMut&lt;str&gt;`.
  - Added the `primitive` module to `std` and `core`.
    This module reexports Rust's primitive types. This is mainly
    useful in macros where you want avoid these types being shadowed.
  - Relaxed some of the trait bounds on `HashMap` and `HashSet`.
  - `string::FromUtf8Error` now implements `Clone + Eq`.
  + Stabilized APIs
  - `Once::is_completed`
  - `f32::LOG10_2`
  - `f32::LOG2_10`
  - `f64::LOG10_2`
  - `f64::LOG2_10`
  - `iter::once_with`
  + Cargo
  - You can now set config `[profile]`s in your `.cargo/config`,
    or through your environment.
  - Cargo will now set `CARGO_BIN_EXE_&lt;name&gt;` pointing to a
    binary's executable path when running integration tests or
    benchmarks.
    `&lt;name&gt;` is the name of your binary as-is e.g. If you wanted
    the executable path for a binary named `my-program`you would
    use `env!("CARGO_BIN_EXE_my-program")`.
  + Misc
  - Certain checks in the `const_err` lint were deemed unrelated
    to const evaluation, and have been moved to the
    `unconditional_panic` and `arithmetic_overflow` lints.
  + Compatibility Notes
  - Having trailing syntax in the `assert!` macro is now a hard
    error. This has been a warning since 1.36.0.
  - Fixed `Self` not having the correctly inferred type. This
    incorrectly led to some instances being accepted, and now
    correctly emits a hard error.</changelog>
  <changelog author="schwab@suse.de" date="1588593600">- Update rustfmt_version</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1589457600">- Update to version 1.43.1
  - Updated openssl-src to 1.1.1g for CVE-2020-1967.
  - Fixed the stabilization of AVX-512 features.
  - Fixed `cargo package --list` not working with unpublished
    dependencies.
- Check upstream signatures for binaries
- Add rust.keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1592827200">- Add patch Fix-big-endian-miscompile-of-bitcast-zex.patch
  to fix miscompilations with rustc 1.43 that lead to LTO failures
  (bsc#1173202)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1627387200">- Needed for Firefox91 (bsc#1188891)
- Rebased patches:
  + ignore-Wstring-conversion.patch (offset / fuzz)
  + Fix-big-endian-miscompile-of-bitcast-zex.patch dropped
- Add support for riscv64
- Make all shared libraries in %{common_libdir} executable; otherwise
  fdupes will not find any duplicates in %{rustlibdir}.
- rust-rpmlintrc: Reflect updated LLVM name in the filter.
- &lt;https://github.com/rust-lang/rust/issues/74976&gt;: Add "--stage 1"
  to the "./x.py doc" call to ensure the newly built compiler gets
  used.
- Resolve issue in constraints to select aarch64 builders in OBS that
  have correctly functioning CPU's.
- Resolve issue with zlib selection and buildrequires.
- Correct build issues with esoteric cpu architectures, by removing
  developer facing tools in some cases.
- Updates to spec file and legacy cleanups during build processes
- Correct issues with incorrect tuning of codegen units that caused
  builders to OOM
- Update to version 1.53:
  + Language
  - [You can now use unicode for identifiers.][83799] This allows multilingual
    identifiers but still doesn't allow glyphs that are not considered characters
    such as `?` or `?`. More specifically you can now use any identifier that
    matches the UAX #31 "Unicode Identifier and Pattern Syntax" standard. This
    is the same standard as languages like Python, however Rust uses NFC
    normalization which may be different from other languages.
  - [You can now specify "or patterns" inside pattern matches.][79278]
    Previously you could only use `|` (OR) on complete patterns. E.g.
    ```rust
    let x = Some(2u8);
    // Before
    matches!(x, Some(1) | Some(2));
    // Now
    matches!(x, Some(1 | 2));
    ```
  - [Added the `:pat_param` `macro_rules!` matcher.][83386] This matcher
    has the same semantics as the `:pat` matcher. This is to allow `:pat`
    to change semantics to being a pattern fragment in a future edition.
  + Compiler
  - [Updated the minimum external LLVM version to LLVM 10.][83387]
  - [Added Tier 3\* support for the `wasm64-unknown-unknown` target.][80525]
  - [Improved debuginfo for closures and async functions on Windows MSVC.][83941]
    \* Refer to Rust's [platform support page][platform-support-doc] for more
    information on Rust's tiered platform support.
  + Libraries
  - [Abort messages will now forward to `android_set_abort_message` on
    Android platforms when available.][81469]
  - [`slice::IterMut&lt;'_, T&gt;` now implements `AsRef&lt;[T]&gt;`][82771]
  - [Arrays of any length now implement `IntoIterator`.][84147]
    Currently calling `.into_iter()` as a method on an array will
    return `impl Iterator&lt;Item=&amp;T&gt;`, but this may change in a
    future edition to change `Item` to `T`. Calling `IntoIterator::into_iter`
    directly on arrays will provide `impl Iterator&lt;Item=T&gt;` as expected.
  - [`leading_zeros`, and `trailing_zeros` are now available on all
    `NonZero` integer types.][84082]
  - [`{f32, f64}::from_str` now parse and print special values
    (`NaN`, `-0`) according to IEEE RFC 754.][78618]
  - [You can now index into slices using `(Bound&lt;usize&gt;, Bound&lt;usize&gt;)`.][77704]
  - [Add the `BITS` associated constant to all numeric types.][82565]
  + Cargo
  - [Cargo now supports git repositories where the default `HEAD` branch is not
    "master".][cargo/9392] This also includes a switch to the version 3 `Cargo.lock` format
    which can handle default branches correctly.
  - [macOS targets now default to `unpacked` split-debuginfo.][cargo/9298]
  - [The `authors` field is no longer included in `Cargo.toml` for new
    projects.][cargo/9282]
  + Rustdoc
  - [Added the `rustdoc::bare_urls` lint that warns when you have URLs
    without hyperlinks.][81764]
  + Compatibility Notes
  - [Implement token-based handling of attributes during expansion][82608]
  - [`Ipv4::from_str` will now reject octal format IP addresses in addition
    to rejecting hexadecimal IP addresses.][83652] The octal format can lead
    to confusion and potential security vulnerabilities and [is no
    longer recommended][ietf6943].
- Update to version 1.52:
  + Language
  - [Added the `unsafe_op_in_unsafe_fn` lint, which checks whether the unsafe code
    in an `unsafe fn` is wrapped in a `unsafe` block.][79208] This lint
    is allowed by default, and may become a warning or hard error in a
    future edition.
  - [You can now cast mutable references to arrays to a pointer of the same type as
    the element.][81479]
  + Compiler
  - [Upgraded the default LLVM to LLVM 12.][81451]
  - Added tier 3\* support for the following targets.
  - [`s390x-unknown-linux-musl`][82166]
  - [`riscv32gc-unknown-linux-musl` &amp; `riscv64gc-unknown-linux-musl`][82202]
  - [`powerpc-unknown-openbsd`][82733]
  + Libraries
  - [`OsString` now implements `Extend` and `FromIterator`.][82121]
  - [`cmp::Reverse` now has `#[repr(transparent)]` representation.][81879]
  - [`Arc&lt;impl Error&gt;` now implements `error::Error`.][80553]
  - [All integer division and remainder operations are now `const`.][80962]
  + Stabilised APIs
  - [`Arguments::as_str`]
  - [`char::MAX`]
  - [`char::REPLACEMENT_CHARACTER`]
  - [`char::UNICODE_VERSION`]
  - [`char::decode_utf16`]
  - [`char::from_digit`]
  - [`char::from_u32_unchecked`]
  - [`char::from_u32`]
  - [`slice::partition_point`]
  - [`str::rsplit_once`]
  - [`str::split_once`]
    The following previously stable APIs are now `const`.
  - [`char::len_utf8`]
  - [`char::len_utf16`]
  - [`char::to_ascii_uppercase`]
  - [`char::to_ascii_lowercase`]
  - [`char::eq_ignore_ascii_case`]
  - [`u8::to_ascii_uppercase`]
  - [`u8::to_ascii_lowercase`]
  - [`u8::eq_ignore_ascii_case`]
  + Rustdoc
  - [Rustdoc lints are now treated as a tool lint, meaning that
    lints are now prefixed with `rustdoc::` (e.g. `#[warn(rustdoc::non_autolinks)]`).][80527]
    Using the old style is still allowed, and will become a warning in
    a future release.
  - [Rustdoc now supports argument files.][82261]
  - [Rustdoc now generates smart punctuation for documentation.][79423]
  - [You can now use "task lists" in Rustdoc Markdown.][81766] E.g.
    ```markdown
  - [x] Complete
  - [ ] Todo
    ```
  + Misc
  - [You can now pass multiple filters to tests.][81356] E.g.
    `cargo test -- foo bar` will run all tests that match `foo` and `bar`.
  - [Rustup now distributes PDB symbols for the `std` library on Windows,
    allowing you to see `std` symbols when debugging.][82218]
  + Internal Only
    These changes provide no direct user facing benefits, but represent significant
    improvements to the internals and overall performance of rustc and
    related tools.
  - [Check the result cache before the DepGraph when ensuring queries][81855]
  - [Try fast_reject::simplify_type in coherence before doing full check][81744]
  - [Only store a LocalDefId in some HIR nodes][81611]
  - [Store HIR attributes in a side table][79519]
  + Compatibility Notes
  - ------------------
  - [Cargo build scripts are now forbidden from setting `RUSTC_BOOTSTRAP`.][cargo/9181]
  - [Removed support for the `x86_64-rumprun-netbsd` target.][82594]
  - [Deprecated the `x86_64-sun-solaris` target in favor of `x86_64-pc-solaris`.][82216]
  - [Rustdoc now only accepts `,`, ` `, and `\t` as delimiters for specifying
    languages in code blocks.][78429]
  - [Rustc now catches more cases of `pub_use_of_private_extern_crate`][80763]
  - [Changes in how proc macros handle whitespace may lead to panics when used
    with older `proc-macro-hack` versions. A `cargo update` should be sufficient to fix
    this in all cases.][84136]
- Update to version 1.51:
  + Language
  - [You can now parameterize items such as functions, traits, and `struct`s by constant
    values in addition to by types and lifetimes.][79135] Also known as "const generics"
    E.g. you can now write the following. Note: Only values of primitive integers,
    `bool`, or `char` types are currently permitted.
  + Compiler
  - [Added the `-Csplit-debuginfo` codegen option for macOS platforms.][79570]
    This option controls whether debug information is split across multiple files
    or packed into a single file. **Note** This option is unstable on other platforms.
  - [Added tier 3\* support for `aarch64_be-unknown-linux-gnu`,
    `aarch64-unknown-linux-gnu_ilp32`, and `aarch64_be-unknown-linux-gnu_ilp32` targets.][81455]
  - [Added tier 3 support for `i386-unknown-linux-gnu` and `i486-unknown-linux-gnu` targets.][80662]
  - [The `target-cpu=native` option will now detect individual features of CPUs.][80749]
    \* Refer to Rust's [platform support page][platform-support-doc] for more
    information on Rust's tiered platform support.
  + Libraries
  - [`Box::downcast` is now also implemented for any `dyn Any + Send + Sync` object.][80945]
  - [`str` now implements `AsMut&lt;str&gt;`.][80279]
  - [`u64` and `u128` now implement `From&lt;char&gt;`.][79502]
  - [`Error` is now implemented for `&amp;T` where `T` implements `Error`.][75180]
  - [`Poll::{map_ok, map_err}` are now implemented for `Poll&lt;Option&lt;Result&lt;T, E&gt;&gt;&gt;`.][80968]
  - [`unsigned_abs` is now implemented for all signed integer types.][80959]
  - [`io::Empty` now implements `io::Seek`.][78044]
  - [`rc::Weak&lt;T&gt;` and `sync::Weak&lt;T&gt;`'s methods such as `as_ptr` are now implemented for
    `T: ?Sized` types.][80764]
  + Stabilized APIs
  - [`Arc::decrement_strong_count`]
  - [`Arc::increment_strong_count`]
  - [`Once::call_once_force`]
  - [`Peekable::next_if_eq`]
  - [`Peekable::next_if`]
  - [`Seek::stream_position`]
  - [`array::IntoIter`]
  - [`panic::panic_any`]
  - [`ptr::addr_of!`]
  - [`ptr::addr_of_mut!`]
  - [`slice::fill_with`]
  - [`slice::split_inclusive_mut`]
  - [`slice::split_inclusive`]
  - [`slice::strip_prefix`]
  - [`slice::strip_suffix`]
  - [`str::split_inclusive`]
  - [`sync::OnceState`]
  - [`task::Wake`]
  + Cargo
  - [Added the `split-debuginfo` profile option to control the -Csplit-debuginfo
    codegen option.][cargo/9112]
  - [Added the `resolver` field to `Cargo.toml` to enable the new feature resolver
    and CLI option behavior.][cargo/8997] Version 2 of the feature resolver will try
    to avoid unifying features of dependencies where that unification could be unwanted.
    Such as using the same dependency with a `std` feature in a build scripts and
    proc-macros, while using the `no-std` feature in the final binary. See the
    [Cargo book documentation][feature-resolver@2.0] for more information on the feature.
  + Rustdoc
  - [Rustdoc will now include documentation for methods available from _nested_ `Deref` traits.][80653]
  - [You can now provide a `--default-theme` flag which sets the default theme to use for
    documentation.][79642]
    Various improvements to intra-doc links:
  - [You can link to non-path primitives such as `slice`.][80181]
  - [You can link to associated items.][74489]
  - [You can now include generic parameters when linking to items, like `Vec&lt;T&gt;`.][76934]
  + Misc
  - [You can now pass `--include-ignored` to tests (e.g. with
    `cargo test -- --include-ignored`) to include testing tests marked `#[ignore]`.][80053]
  + Compatibility Notes
  - [WASI platforms no longer use the `wasm-bindgen` ABI, and instead use the wasm32 ABI.][79998]
  - [`rustc` no longer promotes division, modulo and indexing operations to `const` that
    could fail.][80579]
  - [The minimum version of glibc for the following platforms has been bumped to version 2.31
    for the distributed artifacts.][81521]
  - `armv5te-unknown-linux-gnueabi`
  - `sparc64-unknown-linux-gnu`
  - `thumbv7neon-unknown-linux-gnueabihf`
  - `armv7-unknown-linux-gnueabi`
  - `x86_64-unknown-linux-gnux32`
- Update to version 1.50:
  * This fixes build on armv7 - boo#1181643
  + Language
  - You can now use const values for x in [x; N] array expressions.
    This has been technically possible since 1.38.0, as it was
    unintentionally stabilized.
  - Assignments to ManuallyDrop&lt;T&gt; union fields are now considered safe.
  + Compiler
  - Added tier 3* support for the armv5te-unknown-linux-uclibceabi
    target.
  - Added tier 3 support for the aarch64-apple-ios-macabi target.
  - The x86_64-unknown-freebsd is now built with the full toolset.
  - Dropped support for all cloudabi targets.
  * Refer to Rust's platform support page for more information on
    Rust's tiered platform support.
  + Libraries
  - proc_macro::Punct now implements PartialEq&lt;char&gt;.
  - ops::{Index, IndexMut} are now implemented for fixed sized
    arrays of any length.
  - On Unix platforms, the std::fs::File type now has a "niche" of -1.
    This value cannot be a valid file descriptor, and now means Option&lt;File&gt;
    takes up the same amount of space as File.
  + Stabilized APIs
    bool::then
    btree_map::Entry::or_insert_with_key
    f32::clamp
    f64::clamp
    hash_map::Entry::or_insert_with_key
    Ord::clamp
    RefCell::take
    slice::fill
    UnsafeCell::get_mut
  - The following previously stable methods are now const.
    IpAddr::is_ipv4
    IpAddr::is_ipv6
    IpAddr::is_unspecified
    IpAddr::is_loopback
    IpAddr::is_multicast
    Ipv4Addr::octets
    Ipv4Addr::is_loopback
    Ipv4Addr::is_private
    Ipv4Addr::is_link_local
    Ipv4Addr::is_multicast
    Ipv4Addr::is_broadcast
    Ipv4Addr::is_documentation
    Ipv4Addr::to_ipv6_compatible
    Ipv4Addr::to_ipv6_mapped
    Ipv6Addr::segments
    Ipv6Addr::is_unspecified
    Ipv6Addr::is_loopback
    Ipv6Addr::is_multicast
    Ipv6Addr::to_ipv4
    Layout::size
    Layout::align
    Layout::from_size_align
    pow for all integer types.
    checked_pow for all integer types.
    saturating_pow for all integer types.
    wrapping_pow for all integer types.
    next_power_of_two for all unsigned integer types.
    checked_next_power_of_two for all unsigned integer types.
  + Cargo
  - Added the [build.rustc-workspace-wrapper] option. This option
    sets a wrapper to execute instead of rustc, for workspace members only.
  - cargo:rerun-if-changed will now, if provided a directory,
    scan the entire contents of that directory for changes.
  - Added the --workspace flag to the cargo update command.
  + Misc
  - The search results tab and the help button are focusable
    with keyboard in rustdoc.
  - Running tests will now print the total time taken to execute.
  + Compatibility Notes
  - The compare_and_swap method on atomics has been deprecated.
    It's recommended to use the compare_exchange and
    compare_exchange_weak methods instead.
  - Changes in how TokenStreams are checked have fixed some cases
    where you could write unhygenic macro_rules! macros.
  - #![test] as an inner attribute is now considered unstable
    like other inner macro attributes, and reports an error by
    default through the soft_unstable lint.
  - Overriding a forbid lint at the same level that it was set
    is now a hard error.
  - You can no longer intercept panic! calls by supplying your own
    macro. It's recommended to use the #[panic_handler] attribute
    to provide your own implementation.
  - Semi-colons after item statements (e.g. struct Foo {};)
    now produce a warning.
- Update to version 1.49.0
  + Language
  - Unions can now implement Drop, and you can now have a field in
    a union with ManuallyDrop&lt;T&gt;.
  - You can now cast uninhabited enums to integers.
  - You can now bind by reference and by move in patterns. This
    allows you to selectively borrow individual components of a type.
    E.g.
    [#][derive(Debug)]
    struct Person {
    name: String,
    age: u8,
    }
    let person = Person {
    name: String::from("Alice"),
    age: 20,
    };
    // `name` is moved out of person, but `age` is referenced.
    let Person { name, ref age } = person;
    println!("{} {}", name, age);
  + Compiler
  - Added tier 1* support for aarch64-unknown-linux-gnu.
  - Added tier 2 support for aarch64-apple-darwin.
  - Added tier 2 support for aarch64-pc-windows-msvc.
  - Added tier 3 support for mipsel-unknown-none.
  - Raised the minimum supported LLVM version to LLVM 9.
  - Output from threads spawned in tests is now captured.
  - Change os and vendor values to "none" and "unknown" for some targets
  * Refer to Rust's platform support page for more information on Rust's
    tiered platform support.
  + Libraries
  - RangeInclusive now checks for exhaustion when calling contains and
    indexing.
  - ToString::to_string now no longer shrinks the internal buffer in
    the default implementation.
  - ops::{Index, IndexMut} are now implemented for fixed sized arrays
    of any length.
  + Stabilized APIs
  - slice::select_nth_unstable
  - slice::select_nth_unstable_by
  - slice::select_nth_unstable_by_key
  The following previously stable methods are now const.
  - Poll::is_ready
  - Poll::is_pending
  + Cargo
  - Building a crate with cargo-package should now be independently
    reproducible.
  - cargo-tree now marks proc-macro crates.
  - Added CARGO_PRIMARY_PACKAGE build-time environment variable. This
    variable will be set if the crate being built is one the user
    selected to build, either with -p or through defaults.
  - You can now use glob patterns when specifying packages &amp; targets.
  + Compatibility Notes
  - Demoted i686-unknown-freebsd from host tier 2 to target tier 2
    support.
  - Macros that end with a semi-colon are now treated as statements
    even if they expand to nothing.
  - Rustc will now check for the validity of some built-in attributes
    on enum variants. Previously such invalid or unused attributes
    could be ignored.
  - Leading whitespace is stripped more uniformly in documentation
    comments, which may change behavior. You read this post about
    the changes for more details.
  - Trait bounds are no longer inferred for associated types.
  + Internal Only
  These changes provide no direct user facing benefits, but
  represent significant improvements to the internals and overall
  performance of rustc and related tools.
  - rustc's internal crates are now compiled using the initial-exec
    Thread Local Storage model.
  - Calculate visibilities once in resolve.
  - Added system to the llvm-libunwind bootstrap config option.
  - Added --color for configuring terminal color support to bootstrap.
- Update to version 1.48.0
  + Language
  - The `unsafe` keyword is now syntactically permitted on modules.
    This is still rejected semantically, but can now be parsed by procedural
    macros.
  + Compiler
  - Stabilised the `-C link-self-contained=&lt;yes|no&gt;` compiler flag.
    This tells `rustc` whether to link its own C runtime and libraries or to
    rely on a external linker to find them. (Supported only on `windows-gnu`,
    `linux-musl`, and `wasi` platforms.)
  - You can now use `-C target-feature=+crt-static` on `linux-gnu` targets.
    Note: If you're using cargo you must explicitly pass the `--target` flag.
  - Added tier 2* support for aarch64-unknown-linux-musl.
  * Refer to Rust's platform support page for more information on Rust's
    tiered platform support.
  + Libraries
  - io::Write is now implemented for &amp;ChildStdin &amp;Sink, &amp;Stdout, and &amp;Stderr.
  - All arrays of any length now implement TryFrom&lt;Vec&lt;T&gt;&gt;.
  - The matches! macro now supports having a trailing comma.
  - Vec&lt;A&gt; now implements PartialEq&lt;[B]&gt; where A: PartialEq&lt;B&gt;.
  - The RefCell::{replace, replace_with, clone} methods now all use #[track_caller].
  + Stabilized APIs
  - slice::as_ptr_range
  - slice::as_mut_ptr_range
  - VecDeque::make_contiguous
  - future::pending
  - future::ready
  The following previously stable methods are now `const fn's`:
  - Option::is_some
  - Option::is_none
  - Option::as_ref
  - Result::is_ok
  - Result::is_err
  - Result::as_ref
  - Ordering::reverse
  - Ordering::then
  + Cargo
  + Rustdoc
  - You can now link to items in rustdoc using the intra-doc link syntax.
    E.g. /// Uses [`std::future`] will automatically generate a link to
    std::future's documentation. See "Linking to items by name" for more
    information.
  - You can now specify #[doc(alias = "&lt;alias&gt;")] on items to add search
    aliases when searching through rustdoc's UI.
  + Compatibility Notes
  - Promotion of references to 'static lifetime inside const fn now
    follows the same rules as inside a fn body. In particular, &amp;foo()
    will not be promoted to 'static lifetime any more inside const fns.
  - Associated type bindings on trait objects are now verified to meet
    the bounds declared on the trait when checking that they implement
    the trait.
  - When trait bounds on associated types or opaque types are ambiguous,
    the compiler no longer makes an arbitrary choice on which bound to use.
  - Fixed recursive nonterminals not being expanded in macros during
    pretty-print/reparse check. This may cause errors if your macro
    wasn't correctly handling recursive nonterminal tokens.
  - &amp;mut references to non zero-sized types are no longer promoted.
  - rustc will now warn if you use attributes like #[link_name] or
    [#][cold] in places where they have no effect.
  - Updated _mm256_extract_epi8 and _mm256_extract_epi16 signatures
    in arch::{x86, x86_64} to return i32 to match the vendor signatures.
  - mem::uninitialized will now panic if any inner types inside a struct
    or enum disallow zero-initialization.
  - #[target_feature] will now error if used in a place where it has no effect.
  - Foreign exceptions are now caught by catch_unwind and will cause an
    abort. Note: This behaviour is not guaranteed and is still considered
    undefined behaviour, see the catch_unwind documentation for further
    information.
  + Internal Only
    These changes provide no direct user facing benefits, but represent
    significant improvements to the internals and overall performance of
    rustc and related tools.
  - Building rustc from source now uses ninja by default over make.
    You can continue building with make by setting ninja=false in
    your config.toml.
  - cg_llvm: fewer_names in uncached_llvm_type
  - Made ensure_sufficient_stack() non-generic
- Update to version 1.47.0
  + Language
  - [Closures will now warn when not used.][74869]
  + Compiler
  - [Stabilized the `-C control-flow-guard` codegen option][73893], which enables
    [Control Flow Guard][1.47.0-cfg] for Windows platforms, and is ignored on other
    platforms.
  - [Upgraded to LLVM 11.][73526]
  - [Added tier 3\* support for the `thumbv4t-none-eabi` target.][74419]
  - [Upgrade the FreeBSD toolchain to version 11.4][75204]
  - [`RUST_BACKTRACE`'s output is now more compact.][75048]
  \* Refer to Rust's [platform support page][forge-platform-support] for more
  information on Rust's tiered platform support.
  + Libraries
  - [`CStr` now implements `Index&lt;RangeFrom&lt;usize&gt;&gt;`.][74021]
  - [Traits in `std`/`core` are now implemented for arrays of any length, not just
    those of length less than 33.][74060]
  - [`ops::RangeFull` and `ops::Range` now implement Default.][73197]
  - [`panic::Location` now implements `Copy`, `Clone`, `Eq`, `Hash`, `Ord`,
    `PartialEq`, and `PartialOrd`.][73583]
  + Stabilized APIs
  - [`Ident::new_raw`]
  - [`Range::is_empty`]
  - [`RangeInclusive::is_empty`]
  - [`Result::as_deref`]
  - [`Result::as_deref_mut`]
  - [`Vec::leak`]
  - [`pointer::offset_from`]
  - [`f32::TAU`]
  - [`f64::TAU`]
  The following previously stable APIs have now been made const.
  - [The `new` method for all `NonZero` integers.][73858]
  - [The `checked_add`,`checked_sub`,`checked_mul`,`checked_neg`, `checked_shl`,
    `checked_shr`, `saturating_add`, `saturating_sub`, and `saturating_mul`
    methods for all integers.][73858]
  - [The `checked_abs`, `saturating_abs`, `saturating_neg`, and `signum`  for all
    signed integers.][73858]
  - [The `is_ascii_alphabetic`, `is_ascii_uppercase`, `is_ascii_lowercase`,
    `is_ascii_alphanumeric`, `is_ascii_digit`, `is_ascii_hexdigit`,
    `is_ascii_punctuation`, `is_ascii_graphic`, `is_ascii_whitespace`, and
    `is_ascii_control` methods for `char` and `u8`.][73858]
  + Cargo
  - [`build-dependencies` are now built with opt-level 0 by default.][cargo/8500]
    You can override this by setting the following in your `Cargo.toml`.
    ```toml
    [profile.release.build-override]
    opt-level = 3
    ```
  - [`cargo-help` will now display man pages for commands rather just the
    `--help` text.][cargo/8456]
  - [`cargo-metadata` now emits a `test` field indicating if a target has
    tests enabled.][cargo/8478]
  - [`workspace.default-members` now respects `workspace.exclude`.][cargo/8485]
  - [`cargo-publish` will now use an alternative registry by default if it's the
    only registry specified in `package.publish`.][cargo/8571]
  + Misc
  - [Added a help button beside Rustdoc's searchbar that explains rustdoc's
    type based search.][75366]
  - [Added the Ayu theme to rustdoc.][71237]
- Update to version 1.46.0
  + Language
  - [`if`, `match`, and `loop` expressions can now be used in const functions.][72437]
  - [Additionally you are now also able to coerce and cast to slices (`&amp;[T]`) in
    const functions.][73862]
  - [The `#[track_caller]` attribute can now be added to functions to use the
    function's caller's location information for panic messages.][72445]
  - [Recursively indexing into tuples no longer needs parentheses.][71322] E.g.
    `x.0.0` over `(x.0).0`.
  - [`mem::transmute` can now be used in statics and constants.][72920] **Note**
    You currently can't use `mem::transmute` in constant functions.
  + Compiler
  - [You can now use the `cdylib` target on Apple iOS and tvOS platforms.][73516]
  - [Enabled static "Position Independent Executables" by default
    for `x86_64-unknown-linux-musl`.][70740]
  + Libraries
  - [`mem::forget` is now a `const fn`.][73887]
  - [`String` now implements `From&lt;char&gt;`.][73466]
  - [The `leading_ones`, and `trailing_ones` methods have been stabilised for all
    integer types.][73032]
  - [`vec::IntoIter&lt;T&gt;` now implements `AsRef&lt;[T]&gt;`.][72583]
  - [All non-zero integer types (`NonZeroU8`) now implement `TryFrom` for their
    zero-able equivalent (e.g. `TryFrom&lt;u8&gt;`).][72717]
  - [`&amp;[T]` and `&amp;mut [T]` now implement `PartialEq&lt;Vec&lt;T&gt;&gt;`.][71660]
  - [`(String, u16)` now implements `ToSocketAddrs`.][73007]
  - [`vec::Drain&lt;'_, T&gt;` now implements `AsRef&lt;[T]&gt;`.][72584]
  + Stabilized APIs
  - [`Option::zip`]
  - [`vec::Drain::as_slice`]
  + Cargo
    Added a number of new environment variables that are now available when
    compiling your crate.
  - [`CARGO_BIN_NAME` and `CARGO_CRATE_NAME`][cargo/8270] Providing the name of
    the specific binary being compiled and the name of the crate.
  - [`CARGO_PKG_LICENSE`][cargo/8325] The license from the manifest of the package.
  - [`CARGO_PKG_LICENSE_FILE`][cargo/8387] The path to the license file.
- Update to version 1.44.1
  * rustfmt accepts rustfmt_skip in cfg_attr again.
  * Don't hash executable filenames on apple platforms, fixing backtraces.
  * Fix crashes when finding backtrace on macOS.
  * Clippy applies lint levels into different files.
- Update to version 1.44.0
  + Language
  - You can now use `async/.await` with `#[no_std]` enabled.
  - Added the `unused_braces` lint.
  - Expansion-driven outline module parsing
  + Compiler
  - Rustc now respects the `-C codegen-units` flag in incremental mode.
    Additionally when in incremental mode rustc defaults to 256 codegen units.
  - Refactored `catch_unwind` to have zero-cost, unless unwinding is enabled and
    a panic is thrown.
  - Added tier 3\* support for the `aarch64-unknown-none` and
    `aarch64-unknown-none-softfloat` targets.
  - Added tier 3 support for `arm64-apple-tvos` and
    `x86_64-apple-tvos` targets.
  + Libraries
  - Special cased `vec![]` to map directly to `Vec::new()`. This allows
    `vec![]` to be able to be used in `const` contexts.
  - `convert::Infallible` now implements `Hash`.
  - `OsString` now implements `DerefMut` and `IndexMut` returning
    a `&amp;mut OsStr`.
  - Unicode 13 is now supported.
  - `String` now implements `From&lt;&amp;mut str&gt;`.
  - `IoSlice` now implements `Copy`.
  - `Vec&lt;T&gt;` now implements `From&lt;[T; N]&gt;`. Where `N` is at most 32.
  - `proc_macro::LexError` now implements `fmt::Display` and `Error`.
  - `from_le_bytes`, `to_le_bytes`, `from_be_bytes`, `to_be_bytes`,
    `from_ne_bytes`, and `to_ne_bytes` methods are now `const` for all
    integer types.
  + Stabilizd APIs
  - [`PathBuf::with_capacity`]
  - [`PathBuf::capacity`]
  - [`PathBuf::clear`]
  - [`PathBuf::reserve`]
  - [`PathBuf::reserve_exact`]
  - [`PathBuf::shrink_to_fit`]
  - [`f32::to_int_unchecked`]
  - [`f64::to_int_unchecked`]
  - [`Layout::align_to`]
  - [`Layout::pad_to_align`]
  - [`Layout::array`]
  - [`Layout::extend`]
  + Cargo
  - Added the `cargo tree` command which will print a tree graph of
    your dependencies
  + Misc
  - Rustdoc now allows you to specify `--crate-version` to have rustdoc include
    the version in the sidebar.
  + Compatibility Notes
  - Rustc now correctly generates static libraries on Windows GNU targets with
    the `.a` extension, rather than the previous `.lib`.
  - Removed the `-C no_integrated_as` flag from rustc.
  - The `file_name` property in JSON output of macro errors now points the actual
    source file rather than the previous format of `&lt;NAME macros&gt;`.
  * *Note:** this may not point to a file that actually exists on the user's system.
  - The minimum required external LLVM version has been bumped to LLVM 8.
  - `mem::{zeroed, uninitialised}` will now panic when used with types that do
    not allow zero initialization such as `NonZeroU8`. This was
    previously a warning.
  - In 1.45.0 (the next release) converting a `f64` to `u32` using the `as`
    operator has been defined as a saturating operation. This was previously
    undefined behaviour, but you can use the `{f64, f32}::to_int_unchecked` methods to
    continue using the current behaviour, which may be desirable in rare performance
    sensitive situations.</changelog>
  <changelog author="william.brown@suse.com" date="1642680000">- bsc#1194767 - CVE-2022-21658 - Resolve race condition in std::fs::remove_dir_all
  - 0001-Fix-CVE-2022-21658-for-UNIX-like.patch</changelog>
</package>
<package pkgid="92c1fdf8e9c9f971c3ebd7497720834e3d461b40125a59b1f9b64848c1fdb070" name="rust-src" arch="noarch">
  <version epoch="0" ver="1.53.0" rel="22.1"/>
  <changelog author="luke@ljones.dev" date="1569844800">- Add patch add-option-to-allow-warnings.patch to add a config option
  which allows warnings and so enables v1.38 to bootstrap itself.</changelog>
  <changelog author="rhafer@suse.com" date="1571832000">- Switch to bundled version of libgit2 for now. libgit2-sys seems
  to expect using the bundled variant, which just seems to point
  to a snapshot of the master branch and doesn't match any released
  libgit2 (bsc#1154817).
  See: https://github.com/rust-lang/rust/issues/63476 and
  https://github.com/rust-lang/git2-rs/issues/458 for details.</changelog>
  <changelog author="aplanas@suse.com" date="1573128000">- Update to version 1.39.0
  + Language
  - You can now create async functions and blocks with async fn,
    async move {}, and async {} respectively, and you can now call
    .await on async expressions.
  - You can now use certain attributes on function, closure, and
    function pointer parameters.
  - You can now take shared references to bind-by-move patterns in
    the if guards of match arms.
  + Compiler
  - Added tier 3 support for the i686-unknown-uefi target.
  - Added tier 3 support for the sparc64-unknown-openbsd target.
  - rustc will now trim code snippets in diagnostics to fit in your
    terminal.
  - You can now pass --show-output argument to test binaries to
    print the output of successful tests.
  + For more details:
    https://github.com/rust-lang/rust/blob/stable/RELEASES.md#version-1390-2019-11-07
- Drop patches already merged in upstream:
  + rust-61206-assume-tarball-llvm-is-fresh.patch
  + add-option-to-allow-warnings.patch</changelog>
  <changelog author="aplanas@suse.com" date="1573214400">- Add hopefully-fix-rustdoc-build.patch to fix rustdoc compilation</changelog>
  <changelog author="aplanas@suse.com" date="1574683200">- Re-format the spec file
- Add a README to explain the update process
- Add _service file for download the assets and re-base the patches</changelog>
  <changelog author="ngompa13@gmail.com" date="1575028800">- Rename README to README.suse-maint and add it as a source
  to stop factory-auto from declining submissions automatically</changelog>
  <changelog author="opensuse-packaging@opensuse.org" date="1577707200">- Rebased patches:
  + hopefully-fix-rustdoc-build.patch dropped (merged upstream)</changelog>
  <changelog author="luke@ljones.dev" date="1577707201">- Update to version 1.40.0
  + Language
  - You can now use tuple `struct`s and tuple `enum` variant's constructors in
    `const` contexts. e.g.
    pub struct Point(i32, i32);
    const ORIGIN: Point = {
    let constructor = Point;
    constructor(0, 0)
    };
  - You can now mark `struct`s, `enum`s, and `enum` variants with the `#[non_exhaustive]` attribute to
    indicate that there may be variants or fields added in the future.
    For example this requires adding a wild-card branch (`_ =&gt; {}`) to any match
    statements on a non-exhaustive `enum`.
  - You can now use function-like procedural macros in `extern` blocks and in
    type positions. e.g. `type Generated = macro!();`
  - Function-like and attribute procedural macros can now emit
    `macro_rules!` items, so you can now have your macros generate macros.
  - The `meta` pattern matcher in `macro_rules!` now correctly matches the modern
    attribute syntax. For example `(#[$m:meta])` now matches `#[attr]`,
    `#[attr{tokens}]`, `#[attr[tokens]]`, and `#[attr(tokens)]`.
  + Compiler
  - Added tier 3 support\* for the
    `thumbv7neon-unknown-linux-musleabihf` target.
  - Added tier 3 support for the
    `aarch64-unknown-none-softfloat` target.
  - Added tier 3 support for the `mips64-unknown-linux-muslabi64`, and
    `mips64el-unknown-linux-muslabi64` targets.
  + Libraries
  - The `is_power_of_two` method on unsigned numeric types is now a `const` function.
  + Stabilized APIs
  - BTreeMap::get_key_value
  - HashMap::get_key_value
  - Option::as_deref_mut
  - Option::as_deref
  - Option::flatten
  - UdpSocket::peer_addr
  - f32::to_be_bytes
  - f32::to_le_bytes
  - f32::to_ne_bytes
  - f64::to_be_bytes
  - f64::to_le_bytes
  - f64::to_ne_bytes
  - f32::from_be_bytes
  - f32::from_le_bytes
  - f32::from_ne_bytes
  - f64::from_be_bytes
  - f64::from_le_bytes
  - f64::from_ne_bytes
  - mem::take
  - slice::repeat
  - todo!
  + Cargo
  - Cargo will now always display warnings, rather than only on
    fresh builds.
  - Feature flags (except `--all-features`) passed to a virtual workspace will
    now produce an error. Previously these flags were ignored.
  - You can now publish `dev-dependencies` without including
    a `version`.
  + Misc
  - You can now specify the `#[cfg(doctest)]` attribute to include an item only
    when running documentation tests with `rustdoc`.
  + Compatibility Notes
  - As previously announced, any previous NLL warnings in the 2015 edition are
    now hard errors.
  - The `include!` macro will now warn if it failed to include the
    entire file. The `include!` macro unintentionally only includes the
    first _expression_ in a file, and this can be unintuitive. This will become
    either a hard error in a future release, or the behavior may be fixed to include all expressions as expected.
  - Using `#[inline]` on function prototypes and consts now emits a warning under
    `unused_attribute` lint. Using `#[inline]` anywhere else inside traits
    or `extern` blocks now correctly emits a hard error.</changelog>
  <changelog author="federico@suse.com" date="1578484800">- Bump version of libssh2 for SLE15; we now need a version with
  libssh2_userauth_publickey_frommemory(), which appeared in libssh2
  1.6.0.
- Use the bundled libssh2 prior to SLE15.  SLE12 has 1.4.3, which is
  too old for the ssh crate now.</changelog>
  <changelog author="dimstar@opensuse.org" date="1579262400">- Adjust constraints: Request 20GB HDD for all archs. Simplify the
  file by removing the overrides for various disk sizes. All archs
  are curretnly at roughly 17GB storage in use.</changelog>
  <changelog author="federico@suse.com" date="1584964800">- Update to version 1.41.1:
  - Always check types of static items
  - Always check lifetime bounds of `Copy` impls
  - Fix miscompilation in callers of `Layout::repeat`
- Update to version 1.41.0:
  + Language
  - You can now pass type parameters to foreign items when implementing
    traits. E.g. You can now write `impl&lt;T&gt; From&lt;Foo&gt; for Vec&lt;T&gt; {}`.
  - You can now arbitrarily nest receiver types in the `self` position. E.g. you can
    now write `fn foo(self: Box&lt;Box&lt;Self&gt;&gt;) {}`. Previously only `Self`, `&amp;Self`,
    `&amp;mut Self`, `Arc&lt;Self&gt;`, `Rc&lt;Self&gt;`, and `Box&lt;Self&gt;` were allowed.
  - You can now use any valid identifier in a `format_args` macro.
    Previously identifiers starting with an underscore were not allowed.
  - Visibility modifiers (e.g. `pub`) are now syntactically allowed on trait items and
    enum variants. These are still rejected semantically, but
    can be seen and parsed by procedural macros and conditional compilation.
  + Compiler
  - Rustc will now warn if you have unused loop `'label`s.
  - Removed support for the `i686-unknown-dragonfly` target.
  - Added tier 3 support\* for the `riscv64gc-unknown-linux-gnu` target.
  - You can now pass an arguments file passing the `@path` syntax
    to rustc. Note that the format differs somewhat from what is
    found in other tooling; please see the documentation for
    more information.
  - You can now provide `--extern` flag without a path, indicating that it is
    available from the search path or specified with an `-L` flag.
    Refer to Rust's [platform support page][forge-platform-support] for more
    information on Rust's tiered platform support.
  + Libraries
  - The `core::panic` module is now stable. It was already stable
    through `std`.
  - `NonZero*` numerics now implement `From&lt;NonZero*&gt;` if it's a smaller integer
    width. E.g. `NonZeroU16` now implements `From&lt;NonZeroU8&gt;`.
  - `MaybeUninit&lt;T&gt;` now implements `fmt::Debug`.
  + Stabilized APIs
  - `Result::map_or`
  - `Result::map_or_else`
  - `std::rc::Weak::weak_count`
  - `std::rc::Weak::strong_count`
  - `std::sync::Weak::weak_count`
  - `std::sync::Weak::strong_count`
  + Cargo
  - Cargo will now document all the private items for binary crates
    by default.
  - `cargo-install` will now reinstall the package if it detects that it is out
    of date.
  - Cargo.lock now uses a more git friendly format that should help to reduce
    merge conflicts.
  - You can now override specific dependencies's build settings. E.g.
    `[profile.dev.package.image] opt-level = 2` sets the `image` crate's
    optimisation level to `2` for debug builds. You can also use
    `[profile.&lt;profile&gt;.build-override]` to override build scripts and
    their dependencies.
  + Misc
  - You can now specify `edition` in documentation code blocks to compile the block
    for that edition. E.g. `edition2018` tells rustdoc that the code sample
    should be compiled the 2018 edition of Rust.
  - You can now provide custom themes to rustdoc with `--theme`, and check the
    current theme with `--check-theme`.
  - You can use `#[cfg(doc)]` to compile an item when building documentation.
  + Compatibility Notes
  - As previously announced 1.41.0 will be the last tier 1 release for 32-bit
    Apple targets. This means that the source code is still
    available to build, but the targets are no longer being tested and release
    binaries for those platforms will no longer be distributed by the Rust project.
    Please refer to the linked blog post for more information.</changelog>
  <changelog author="alarrosa@suse.com" date="1585656000">- Rebased patches:
  + ignore-Wstring-conversion.patch (offset / fuzz)</changelog>
  <changelog author="alarrosa@suse.com" date="1585656001">- Update to version 1.42.0:
  + Language
  - You can now use the slice pattern syntax with subslices.
  - You can now use #[repr(transparent)] on univariant enums. Meaning
    that you can create an enum that has the exact layout and ABI of
    the type it contains.
  - There are some syntax-only changes:
  * default is syntactically allowed before items in trait
    definitions.
  * Items in impls (i.e. consts, types, and fns) may syntactically
    leave out their bodies in favor of ;.
  * Bounds on associated types in impls are now syntactically
    allowed (e.g. type Foo: Ord;).
  * ... (the C-variadic type) may occur syntactically directly
    as the type of any function parameter.
    These are still rejected semantically, so you will likely receive
    an error but these changes can be seen and parsed by procedural
    macros and conditional compilation.
  + Compiler
  - Added tier 2 support for armv7a-none-eabi.
  - Added tier 2 support for riscv64gc-unknown-linux-gnu.
  - Option::{expect,unwrap} and Result::{expect, expect_err, unwrap,
    unwrap_err} now produce panic messages pointing to the location
    where they were called, rather than core's internals.
    Refer to Rust's platform support page for more information on
    Rust's tiered platform support.
  + Libraries
  - iter::Empty&lt;T&gt; now implements Send and Sync for any T.
  - Pin::{map_unchecked, map_unchecked_mut} no longer require the
    return type to implement Sized.
  - io::Cursor now derives PartialEq and Eq.
  - Layout::new is now const.
  - Added Standard Library support for riscv64gc-unknown-linux-gnu.
  + Stabilized APIs
  - CondVar::wait_while
  - CondVar::wait_timeout_while
  - DebugMap::key
  - DebugMap::value
  - ManuallyDrop::take
  - matches!
  - ptr::slice_from_raw_parts_mut
  - ptr::slice_from_raw_parts
  + Cargo
  - You no longer need to include extern crate proc_macro; to be
    able to use proc_macro; in the 2018 edition.
  + Compatibility Notes
  - Error::description has been deprecated, and its use will now
    produce a warning. It's recommended to use Display/to_string
    instead.</changelog>
  <changelog author="schwab@suse.de" date="1586260800">- Avoid duplication of environment settings</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1588161600">- Update to version 1.43.0
  + Language
  - Fixed using binary operations with `&amp;{number}` (e.g. `&amp;1.0`)
    not having the type inferred correctly.
  - Attributes such as `#[cfg()]` can now be used on `if`
    expressions.
  - Syntax only changes:
  * Allow `type Foo: Ord` syntactically.
  * Fuse associated and extern items up to defaultness.
  * Syntactically allow `self` in all `fn` contexts.
  * Merge `fn` syntax + cleanup item parsing.
  * `item` macro fragments can be interpolated into `trait`s,
    `impl`s, and `extern` blocks.
    For example, you may now write:
    ```rust
    macro_rules! mac_trait {
    ($i:item) =&gt; {
    trait T { $i }
    }
    }
    mac_trait! {
    fn foo() {}
    }
    ```
  * These are still rejected *semantically*, so you will likely
    receive an error but these changes can be seen and parsed by
    macros and conditional compilation.
  + Compiler
  - You can now pass multiple lint flags to rustc to override the
    previous flags.
    For example; `rustc -D unused -A unused-variables` denies
    everything in the `unused` lint group except `unused-variables`
    which is explicitly allowed. However, passing
    `rustc -A unused-variables -D unused` denies everything in
    the `unused` lint group **including** `unused-variables` since
    the allow flag is specified before the deny flag (and therefore
    overridden).
  - rustc will now prefer your system MinGW libraries over its
    bundled libraries if they are available on `windows-gnu`.
  - rustc now buffers errors/warnings printed in JSON.
  + Libraries
  - `Arc&lt;[T; N]&gt;`, `Box&lt;[T; N]&gt;`, and `Rc&lt;[T; N]&gt;`, now implement
    `TryFrom&lt;Arc&lt;[T]&gt;&gt;`,`TryFrom&lt;Box&lt;[T]&gt;&gt;`, and `TryFrom&lt;Rc&lt;[T]&gt;&gt;`
    respectively.
  * *Note** These conversions are only available when `N` is
    `0..=32`.
  - You can now use associated constants on floats and integers
    directly, rather than having to import the module.
    e.g. You can now write `u32::MAX` or `f32::NAN` with no imports.
  - `u8::is_ascii` is now `const`.
  - `String` now implements `AsMut&lt;str&gt;`.
  - Added the `primitive` module to `std` and `core`.
    This module reexports Rust's primitive types. This is mainly
    useful in macros where you want avoid these types being shadowed.
  - Relaxed some of the trait bounds on `HashMap` and `HashSet`.
  - `string::FromUtf8Error` now implements `Clone + Eq`.
  + Stabilized APIs
  - `Once::is_completed`
  - `f32::LOG10_2`
  - `f32::LOG2_10`
  - `f64::LOG10_2`
  - `f64::LOG2_10`
  - `iter::once_with`
  + Cargo
  - You can now set config `[profile]`s in your `.cargo/config`,
    or through your environment.
  - Cargo will now set `CARGO_BIN_EXE_&lt;name&gt;` pointing to a
    binary's executable path when running integration tests or
    benchmarks.
    `&lt;name&gt;` is the name of your binary as-is e.g. If you wanted
    the executable path for a binary named `my-program`you would
    use `env!("CARGO_BIN_EXE_my-program")`.
  + Misc
  - Certain checks in the `const_err` lint were deemed unrelated
    to const evaluation, and have been moved to the
    `unconditional_panic` and `arithmetic_overflow` lints.
  + Compatibility Notes
  - Having trailing syntax in the `assert!` macro is now a hard
    error. This has been a warning since 1.36.0.
  - Fixed `Self` not having the correctly inferred type. This
    incorrectly led to some instances being accepted, and now
    correctly emits a hard error.</changelog>
  <changelog author="schwab@suse.de" date="1588593600">- Update rustfmt_version</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1589457600">- Update to version 1.43.1
  - Updated openssl-src to 1.1.1g for CVE-2020-1967.
  - Fixed the stabilization of AVX-512 features.
  - Fixed `cargo package --list` not working with unpublished
    dependencies.
- Check upstream signatures for binaries
- Add rust.keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1592827200">- Add patch Fix-big-endian-miscompile-of-bitcast-zex.patch
  to fix miscompilations with rustc 1.43 that lead to LTO failures
  (bsc#1173202)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1627387200">- Needed for Firefox91 (bsc#1188891)
- Rebased patches:
  + ignore-Wstring-conversion.patch (offset / fuzz)
  + Fix-big-endian-miscompile-of-bitcast-zex.patch dropped
- Add support for riscv64
- Make all shared libraries in %{common_libdir} executable; otherwise
  fdupes will not find any duplicates in %{rustlibdir}.
- rust-rpmlintrc: Reflect updated LLVM name in the filter.
- &lt;https://github.com/rust-lang/rust/issues/74976&gt;: Add "--stage 1"
  to the "./x.py doc" call to ensure the newly built compiler gets
  used.
- Resolve issue in constraints to select aarch64 builders in OBS that
  have correctly functioning CPU's.
- Resolve issue with zlib selection and buildrequires.
- Correct build issues with esoteric cpu architectures, by removing
  developer facing tools in some cases.
- Updates to spec file and legacy cleanups during build processes
- Correct issues with incorrect tuning of codegen units that caused
  builders to OOM
- Update to version 1.53:
  + Language
  - [You can now use unicode for identifiers.][83799] This allows multilingual
    identifiers but still doesn't allow glyphs that are not considered characters
    such as `?` or `?`. More specifically you can now use any identifier that
    matches the UAX #31 "Unicode Identifier and Pattern Syntax" standard. This
    is the same standard as languages like Python, however Rust uses NFC
    normalization which may be different from other languages.
  - [You can now specify "or patterns" inside pattern matches.][79278]
    Previously you could only use `|` (OR) on complete patterns. E.g.
    ```rust
    let x = Some(2u8);
    // Before
    matches!(x, Some(1) | Some(2));
    // Now
    matches!(x, Some(1 | 2));
    ```
  - [Added the `:pat_param` `macro_rules!` matcher.][83386] This matcher
    has the same semantics as the `:pat` matcher. This is to allow `:pat`
    to change semantics to being a pattern fragment in a future edition.
  + Compiler
  - [Updated the minimum external LLVM version to LLVM 10.][83387]
  - [Added Tier 3\* support for the `wasm64-unknown-unknown` target.][80525]
  - [Improved debuginfo for closures and async functions on Windows MSVC.][83941]
    \* Refer to Rust's [platform support page][platform-support-doc] for more
    information on Rust's tiered platform support.
  + Libraries
  - [Abort messages will now forward to `android_set_abort_message` on
    Android platforms when available.][81469]
  - [`slice::IterMut&lt;'_, T&gt;` now implements `AsRef&lt;[T]&gt;`][82771]
  - [Arrays of any length now implement `IntoIterator`.][84147]
    Currently calling `.into_iter()` as a method on an array will
    return `impl Iterator&lt;Item=&amp;T&gt;`, but this may change in a
    future edition to change `Item` to `T`. Calling `IntoIterator::into_iter`
    directly on arrays will provide `impl Iterator&lt;Item=T&gt;` as expected.
  - [`leading_zeros`, and `trailing_zeros` are now available on all
    `NonZero` integer types.][84082]
  - [`{f32, f64}::from_str` now parse and print special values
    (`NaN`, `-0`) according to IEEE RFC 754.][78618]
  - [You can now index into slices using `(Bound&lt;usize&gt;, Bound&lt;usize&gt;)`.][77704]
  - [Add the `BITS` associated constant to all numeric types.][82565]
  + Cargo
  - [Cargo now supports git repositories where the default `HEAD` branch is not
    "master".][cargo/9392] This also includes a switch to the version 3 `Cargo.lock` format
    which can handle default branches correctly.
  - [macOS targets now default to `unpacked` split-debuginfo.][cargo/9298]
  - [The `authors` field is no longer included in `Cargo.toml` for new
    projects.][cargo/9282]
  + Rustdoc
  - [Added the `rustdoc::bare_urls` lint that warns when you have URLs
    without hyperlinks.][81764]
  + Compatibility Notes
  - [Implement token-based handling of attributes during expansion][82608]
  - [`Ipv4::from_str` will now reject octal format IP addresses in addition
    to rejecting hexadecimal IP addresses.][83652] The octal format can lead
    to confusion and potential security vulnerabilities and [is no
    longer recommended][ietf6943].
- Update to version 1.52:
  + Language
  - [Added the `unsafe_op_in_unsafe_fn` lint, which checks whether the unsafe code
    in an `unsafe fn` is wrapped in a `unsafe` block.][79208] This lint
    is allowed by default, and may become a warning or hard error in a
    future edition.
  - [You can now cast mutable references to arrays to a pointer of the same type as
    the element.][81479]
  + Compiler
  - [Upgraded the default LLVM to LLVM 12.][81451]
  - Added tier 3\* support for the following targets.
  - [`s390x-unknown-linux-musl`][82166]
  - [`riscv32gc-unknown-linux-musl` &amp; `riscv64gc-unknown-linux-musl`][82202]
  - [`powerpc-unknown-openbsd`][82733]
  + Libraries
  - [`OsString` now implements `Extend` and `FromIterator`.][82121]
  - [`cmp::Reverse` now has `#[repr(transparent)]` representation.][81879]
  - [`Arc&lt;impl Error&gt;` now implements `error::Error`.][80553]
  - [All integer division and remainder operations are now `const`.][80962]
  + Stabilised APIs
  - [`Arguments::as_str`]
  - [`char::MAX`]
  - [`char::REPLACEMENT_CHARACTER`]
  - [`char::UNICODE_VERSION`]
  - [`char::decode_utf16`]
  - [`char::from_digit`]
  - [`char::from_u32_unchecked`]
  - [`char::from_u32`]
  - [`slice::partition_point`]
  - [`str::rsplit_once`]
  - [`str::split_once`]
    The following previously stable APIs are now `const`.
  - [`char::len_utf8`]
  - [`char::len_utf16`]
  - [`char::to_ascii_uppercase`]
  - [`char::to_ascii_lowercase`]
  - [`char::eq_ignore_ascii_case`]
  - [`u8::to_ascii_uppercase`]
  - [`u8::to_ascii_lowercase`]
  - [`u8::eq_ignore_ascii_case`]
  + Rustdoc
  - [Rustdoc lints are now treated as a tool lint, meaning that
    lints are now prefixed with `rustdoc::` (e.g. `#[warn(rustdoc::non_autolinks)]`).][80527]
    Using the old style is still allowed, and will become a warning in
    a future release.
  - [Rustdoc now supports argument files.][82261]
  - [Rustdoc now generates smart punctuation for documentation.][79423]
  - [You can now use "task lists" in Rustdoc Markdown.][81766] E.g.
    ```markdown
  - [x] Complete
  - [ ] Todo
    ```
  + Misc
  - [You can now pass multiple filters to tests.][81356] E.g.
    `cargo test -- foo bar` will run all tests that match `foo` and `bar`.
  - [Rustup now distributes PDB symbols for the `std` library on Windows,
    allowing you to see `std` symbols when debugging.][82218]
  + Internal Only
    These changes provide no direct user facing benefits, but represent significant
    improvements to the internals and overall performance of rustc and
    related tools.
  - [Check the result cache before the DepGraph when ensuring queries][81855]
  - [Try fast_reject::simplify_type in coherence before doing full check][81744]
  - [Only store a LocalDefId in some HIR nodes][81611]
  - [Store HIR attributes in a side table][79519]
  + Compatibility Notes
  - ------------------
  - [Cargo build scripts are now forbidden from setting `RUSTC_BOOTSTRAP`.][cargo/9181]
  - [Removed support for the `x86_64-rumprun-netbsd` target.][82594]
  - [Deprecated the `x86_64-sun-solaris` target in favor of `x86_64-pc-solaris`.][82216]
  - [Rustdoc now only accepts `,`, ` `, and `\t` as delimiters for specifying
    languages in code blocks.][78429]
  - [Rustc now catches more cases of `pub_use_of_private_extern_crate`][80763]
  - [Changes in how proc macros handle whitespace may lead to panics when used
    with older `proc-macro-hack` versions. A `cargo update` should be sufficient to fix
    this in all cases.][84136]
- Update to version 1.51:
  + Language
  - [You can now parameterize items such as functions, traits, and `struct`s by constant
    values in addition to by types and lifetimes.][79135] Also known as "const generics"
    E.g. you can now write the following. Note: Only values of primitive integers,
    `bool`, or `char` types are currently permitted.
  + Compiler
  - [Added the `-Csplit-debuginfo` codegen option for macOS platforms.][79570]
    This option controls whether debug information is split across multiple files
    or packed into a single file. **Note** This option is unstable on other platforms.
  - [Added tier 3\* support for `aarch64_be-unknown-linux-gnu`,
    `aarch64-unknown-linux-gnu_ilp32`, and `aarch64_be-unknown-linux-gnu_ilp32` targets.][81455]
  - [Added tier 3 support for `i386-unknown-linux-gnu` and `i486-unknown-linux-gnu` targets.][80662]
  - [The `target-cpu=native` option will now detect individual features of CPUs.][80749]
    \* Refer to Rust's [platform support page][platform-support-doc] for more
    information on Rust's tiered platform support.
  + Libraries
  - [`Box::downcast` is now also implemented for any `dyn Any + Send + Sync` object.][80945]
  - [`str` now implements `AsMut&lt;str&gt;`.][80279]
  - [`u64` and `u128` now implement `From&lt;char&gt;`.][79502]
  - [`Error` is now implemented for `&amp;T` where `T` implements `Error`.][75180]
  - [`Poll::{map_ok, map_err}` are now implemented for `Poll&lt;Option&lt;Result&lt;T, E&gt;&gt;&gt;`.][80968]
  - [`unsigned_abs` is now implemented for all signed integer types.][80959]
  - [`io::Empty` now implements `io::Seek`.][78044]
  - [`rc::Weak&lt;T&gt;` and `sync::Weak&lt;T&gt;`'s methods such as `as_ptr` are now implemented for
    `T: ?Sized` types.][80764]
  + Stabilized APIs
  - [`Arc::decrement_strong_count`]
  - [`Arc::increment_strong_count`]
  - [`Once::call_once_force`]
  - [`Peekable::next_if_eq`]
  - [`Peekable::next_if`]
  - [`Seek::stream_position`]
  - [`array::IntoIter`]
  - [`panic::panic_any`]
  - [`ptr::addr_of!`]
  - [`ptr::addr_of_mut!`]
  - [`slice::fill_with`]
  - [`slice::split_inclusive_mut`]
  - [`slice::split_inclusive`]
  - [`slice::strip_prefix`]
  - [`slice::strip_suffix`]
  - [`str::split_inclusive`]
  - [`sync::OnceState`]
  - [`task::Wake`]
  + Cargo
  - [Added the `split-debuginfo` profile option to control the -Csplit-debuginfo
    codegen option.][cargo/9112]
  - [Added the `resolver` field to `Cargo.toml` to enable the new feature resolver
    and CLI option behavior.][cargo/8997] Version 2 of the feature resolver will try
    to avoid unifying features of dependencies where that unification could be unwanted.
    Such as using the same dependency with a `std` feature in a build scripts and
    proc-macros, while using the `no-std` feature in the final binary. See the
    [Cargo book documentation][feature-resolver@2.0] for more information on the feature.
  + Rustdoc
  - [Rustdoc will now include documentation for methods available from _nested_ `Deref` traits.][80653]
  - [You can now provide a `--default-theme` flag which sets the default theme to use for
    documentation.][79642]
    Various improvements to intra-doc links:
  - [You can link to non-path primitives such as `slice`.][80181]
  - [You can link to associated items.][74489]
  - [You can now include generic parameters when linking to items, like `Vec&lt;T&gt;`.][76934]
  + Misc
  - [You can now pass `--include-ignored` to tests (e.g. with
    `cargo test -- --include-ignored`) to include testing tests marked `#[ignore]`.][80053]
  + Compatibility Notes
  - [WASI platforms no longer use the `wasm-bindgen` ABI, and instead use the wasm32 ABI.][79998]
  - [`rustc` no longer promotes division, modulo and indexing operations to `const` that
    could fail.][80579]
  - [The minimum version of glibc for the following platforms has been bumped to version 2.31
    for the distributed artifacts.][81521]
  - `armv5te-unknown-linux-gnueabi`
  - `sparc64-unknown-linux-gnu`
  - `thumbv7neon-unknown-linux-gnueabihf`
  - `armv7-unknown-linux-gnueabi`
  - `x86_64-unknown-linux-gnux32`
- Update to version 1.50:
  * This fixes build on armv7 - boo#1181643
  + Language
  - You can now use const values for x in [x; N] array expressions.
    This has been technically possible since 1.38.0, as it was
    unintentionally stabilized.
  - Assignments to ManuallyDrop&lt;T&gt; union fields are now considered safe.
  + Compiler
  - Added tier 3* support for the armv5te-unknown-linux-uclibceabi
    target.
  - Added tier 3 support for the aarch64-apple-ios-macabi target.
  - The x86_64-unknown-freebsd is now built with the full toolset.
  - Dropped support for all cloudabi targets.
  * Refer to Rust's platform support page for more information on
    Rust's tiered platform support.
  + Libraries
  - proc_macro::Punct now implements PartialEq&lt;char&gt;.
  - ops::{Index, IndexMut} are now implemented for fixed sized
    arrays of any length.
  - On Unix platforms, the std::fs::File type now has a "niche" of -1.
    This value cannot be a valid file descriptor, and now means Option&lt;File&gt;
    takes up the same amount of space as File.
  + Stabilized APIs
    bool::then
    btree_map::Entry::or_insert_with_key
    f32::clamp
    f64::clamp
    hash_map::Entry::or_insert_with_key
    Ord::clamp
    RefCell::take
    slice::fill
    UnsafeCell::get_mut
  - The following previously stable methods are now const.
    IpAddr::is_ipv4
    IpAddr::is_ipv6
    IpAddr::is_unspecified
    IpAddr::is_loopback
    IpAddr::is_multicast
    Ipv4Addr::octets
    Ipv4Addr::is_loopback
    Ipv4Addr::is_private
    Ipv4Addr::is_link_local
    Ipv4Addr::is_multicast
    Ipv4Addr::is_broadcast
    Ipv4Addr::is_documentation
    Ipv4Addr::to_ipv6_compatible
    Ipv4Addr::to_ipv6_mapped
    Ipv6Addr::segments
    Ipv6Addr::is_unspecified
    Ipv6Addr::is_loopback
    Ipv6Addr::is_multicast
    Ipv6Addr::to_ipv4
    Layout::size
    Layout::align
    Layout::from_size_align
    pow for all integer types.
    checked_pow for all integer types.
    saturating_pow for all integer types.
    wrapping_pow for all integer types.
    next_power_of_two for all unsigned integer types.
    checked_next_power_of_two for all unsigned integer types.
  + Cargo
  - Added the [build.rustc-workspace-wrapper] option. This option
    sets a wrapper to execute instead of rustc, for workspace members only.
  - cargo:rerun-if-changed will now, if provided a directory,
    scan the entire contents of that directory for changes.
  - Added the --workspace flag to the cargo update command.
  + Misc
  - The search results tab and the help button are focusable
    with keyboard in rustdoc.
  - Running tests will now print the total time taken to execute.
  + Compatibility Notes
  - The compare_and_swap method on atomics has been deprecated.
    It's recommended to use the compare_exchange and
    compare_exchange_weak methods instead.
  - Changes in how TokenStreams are checked have fixed some cases
    where you could write unhygenic macro_rules! macros.
  - #![test] as an inner attribute is now considered unstable
    like other inner macro attributes, and reports an error by
    default through the soft_unstable lint.
  - Overriding a forbid lint at the same level that it was set
    is now a hard error.
  - You can no longer intercept panic! calls by supplying your own
    macro. It's recommended to use the #[panic_handler] attribute
    to provide your own implementation.
  - Semi-colons after item statements (e.g. struct Foo {};)
    now produce a warning.
- Update to version 1.49.0
  + Language
  - Unions can now implement Drop, and you can now have a field in
    a union with ManuallyDrop&lt;T&gt;.
  - You can now cast uninhabited enums to integers.
  - You can now bind by reference and by move in patterns. This
    allows you to selectively borrow individual components of a type.
    E.g.
    [#][derive(Debug)]
    struct Person {
    name: String,
    age: u8,
    }
    let person = Person {
    name: String::from("Alice"),
    age: 20,
    };
    // `name` is moved out of person, but `age` is referenced.
    let Person { name, ref age } = person;
    println!("{} {}", name, age);
  + Compiler
  - Added tier 1* support for aarch64-unknown-linux-gnu.
  - Added tier 2 support for aarch64-apple-darwin.
  - Added tier 2 support for aarch64-pc-windows-msvc.
  - Added tier 3 support for mipsel-unknown-none.
  - Raised the minimum supported LLVM version to LLVM 9.
  - Output from threads spawned in tests is now captured.
  - Change os and vendor values to "none" and "unknown" for some targets
  * Refer to Rust's platform support page for more information on Rust's
    tiered platform support.
  + Libraries
  - RangeInclusive now checks for exhaustion when calling contains and
    indexing.
  - ToString::to_string now no longer shrinks the internal buffer in
    the default implementation.
  - ops::{Index, IndexMut} are now implemented for fixed sized arrays
    of any length.
  + Stabilized APIs
  - slice::select_nth_unstable
  - slice::select_nth_unstable_by
  - slice::select_nth_unstable_by_key
  The following previously stable methods are now const.
  - Poll::is_ready
  - Poll::is_pending
  + Cargo
  - Building a crate with cargo-package should now be independently
    reproducible.
  - cargo-tree now marks proc-macro crates.
  - Added CARGO_PRIMARY_PACKAGE build-time environment variable. This
    variable will be set if the crate being built is one the user
    selected to build, either with -p or through defaults.
  - You can now use glob patterns when specifying packages &amp; targets.
  + Compatibility Notes
  - Demoted i686-unknown-freebsd from host tier 2 to target tier 2
    support.
  - Macros that end with a semi-colon are now treated as statements
    even if they expand to nothing.
  - Rustc will now check for the validity of some built-in attributes
    on enum variants. Previously such invalid or unused attributes
    could be ignored.
  - Leading whitespace is stripped more uniformly in documentation
    comments, which may change behavior. You read this post about
    the changes for more details.
  - Trait bounds are no longer inferred for associated types.
  + Internal Only
  These changes provide no direct user facing benefits, but
  represent significant improvements to the internals and overall
  performance of rustc and related tools.
  - rustc's internal crates are now compiled using the initial-exec
    Thread Local Storage model.
  - Calculate visibilities once in resolve.
  - Added system to the llvm-libunwind bootstrap config option.
  - Added --color for configuring terminal color support to bootstrap.
- Update to version 1.48.0
  + Language
  - The `unsafe` keyword is now syntactically permitted on modules.
    This is still rejected semantically, but can now be parsed by procedural
    macros.
  + Compiler
  - Stabilised the `-C link-self-contained=&lt;yes|no&gt;` compiler flag.
    This tells `rustc` whether to link its own C runtime and libraries or to
    rely on a external linker to find them. (Supported only on `windows-gnu`,
    `linux-musl`, and `wasi` platforms.)
  - You can now use `-C target-feature=+crt-static` on `linux-gnu` targets.
    Note: If you're using cargo you must explicitly pass the `--target` flag.
  - Added tier 2* support for aarch64-unknown-linux-musl.
  * Refer to Rust's platform support page for more information on Rust's
    tiered platform support.
  + Libraries
  - io::Write is now implemented for &amp;ChildStdin &amp;Sink, &amp;Stdout, and &amp;Stderr.
  - All arrays of any length now implement TryFrom&lt;Vec&lt;T&gt;&gt;.
  - The matches! macro now supports having a trailing comma.
  - Vec&lt;A&gt; now implements PartialEq&lt;[B]&gt; where A: PartialEq&lt;B&gt;.
  - The RefCell::{replace, replace_with, clone} methods now all use #[track_caller].
  + Stabilized APIs
  - slice::as_ptr_range
  - slice::as_mut_ptr_range
  - VecDeque::make_contiguous
  - future::pending
  - future::ready
  The following previously stable methods are now `const fn's`:
  - Option::is_some
  - Option::is_none
  - Option::as_ref
  - Result::is_ok
  - Result::is_err
  - Result::as_ref
  - Ordering::reverse
  - Ordering::then
  + Cargo
  + Rustdoc
  - You can now link to items in rustdoc using the intra-doc link syntax.
    E.g. /// Uses [`std::future`] will automatically generate a link to
    std::future's documentation. See "Linking to items by name" for more
    information.
  - You can now specify #[doc(alias = "&lt;alias&gt;")] on items to add search
    aliases when searching through rustdoc's UI.
  + Compatibility Notes
  - Promotion of references to 'static lifetime inside const fn now
    follows the same rules as inside a fn body. In particular, &amp;foo()
    will not be promoted to 'static lifetime any more inside const fns.
  - Associated type bindings on trait objects are now verified to meet
    the bounds declared on the trait when checking that they implement
    the trait.
  - When trait bounds on associated types or opaque types are ambiguous,
    the compiler no longer makes an arbitrary choice on which bound to use.
  - Fixed recursive nonterminals not being expanded in macros during
    pretty-print/reparse check. This may cause errors if your macro
    wasn't correctly handling recursive nonterminal tokens.
  - &amp;mut references to non zero-sized types are no longer promoted.
  - rustc will now warn if you use attributes like #[link_name] or
    [#][cold] in places where they have no effect.
  - Updated _mm256_extract_epi8 and _mm256_extract_epi16 signatures
    in arch::{x86, x86_64} to return i32 to match the vendor signatures.
  - mem::uninitialized will now panic if any inner types inside a struct
    or enum disallow zero-initialization.
  - #[target_feature] will now error if used in a place where it has no effect.
  - Foreign exceptions are now caught by catch_unwind and will cause an
    abort. Note: This behaviour is not guaranteed and is still considered
    undefined behaviour, see the catch_unwind documentation for further
    information.
  + Internal Only
    These changes provide no direct user facing benefits, but represent
    significant improvements to the internals and overall performance of
    rustc and related tools.
  - Building rustc from source now uses ninja by default over make.
    You can continue building with make by setting ninja=false in
    your config.toml.
  - cg_llvm: fewer_names in uncached_llvm_type
  - Made ensure_sufficient_stack() non-generic
- Update to version 1.47.0
  + Language
  - [Closures will now warn when not used.][74869]
  + Compiler
  - [Stabilized the `-C control-flow-guard` codegen option][73893], which enables
    [Control Flow Guard][1.47.0-cfg] for Windows platforms, and is ignored on other
    platforms.
  - [Upgraded to LLVM 11.][73526]
  - [Added tier 3\* support for the `thumbv4t-none-eabi` target.][74419]
  - [Upgrade the FreeBSD toolchain to version 11.4][75204]
  - [`RUST_BACKTRACE`'s output is now more compact.][75048]
  \* Refer to Rust's [platform support page][forge-platform-support] for more
  information on Rust's tiered platform support.
  + Libraries
  - [`CStr` now implements `Index&lt;RangeFrom&lt;usize&gt;&gt;`.][74021]
  - [Traits in `std`/`core` are now implemented for arrays of any length, not just
    those of length less than 33.][74060]
  - [`ops::RangeFull` and `ops::Range` now implement Default.][73197]
  - [`panic::Location` now implements `Copy`, `Clone`, `Eq`, `Hash`, `Ord`,
    `PartialEq`, and `PartialOrd`.][73583]
  + Stabilized APIs
  - [`Ident::new_raw`]
  - [`Range::is_empty`]
  - [`RangeInclusive::is_empty`]
  - [`Result::as_deref`]
  - [`Result::as_deref_mut`]
  - [`Vec::leak`]
  - [`pointer::offset_from`]
  - [`f32::TAU`]
  - [`f64::TAU`]
  The following previously stable APIs have now been made const.
  - [The `new` method for all `NonZero` integers.][73858]
  - [The `checked_add`,`checked_sub`,`checked_mul`,`checked_neg`, `checked_shl`,
    `checked_shr`, `saturating_add`, `saturating_sub`, and `saturating_mul`
    methods for all integers.][73858]
  - [The `checked_abs`, `saturating_abs`, `saturating_neg`, and `signum`  for all
    signed integers.][73858]
  - [The `is_ascii_alphabetic`, `is_ascii_uppercase`, `is_ascii_lowercase`,
    `is_ascii_alphanumeric`, `is_ascii_digit`, `is_ascii_hexdigit`,
    `is_ascii_punctuation`, `is_ascii_graphic`, `is_ascii_whitespace`, and
    `is_ascii_control` methods for `char` and `u8`.][73858]
  + Cargo
  - [`build-dependencies` are now built with opt-level 0 by default.][cargo/8500]
    You can override this by setting the following in your `Cargo.toml`.
    ```toml
    [profile.release.build-override]
    opt-level = 3
    ```
  - [`cargo-help` will now display man pages for commands rather just the
    `--help` text.][cargo/8456]
  - [`cargo-metadata` now emits a `test` field indicating if a target has
    tests enabled.][cargo/8478]
  - [`workspace.default-members` now respects `workspace.exclude`.][cargo/8485]
  - [`cargo-publish` will now use an alternative registry by default if it's the
    only registry specified in `package.publish`.][cargo/8571]
  + Misc
  - [Added a help button beside Rustdoc's searchbar that explains rustdoc's
    type based search.][75366]
  - [Added the Ayu theme to rustdoc.][71237]
- Update to version 1.46.0
  + Language
  - [`if`, `match`, and `loop` expressions can now be used in const functions.][72437]
  - [Additionally you are now also able to coerce and cast to slices (`&amp;[T]`) in
    const functions.][73862]
  - [The `#[track_caller]` attribute can now be added to functions to use the
    function's caller's location information for panic messages.][72445]
  - [Recursively indexing into tuples no longer needs parentheses.][71322] E.g.
    `x.0.0` over `(x.0).0`.
  - [`mem::transmute` can now be used in statics and constants.][72920] **Note**
    You currently can't use `mem::transmute` in constant functions.
  + Compiler
  - [You can now use the `cdylib` target on Apple iOS and tvOS platforms.][73516]
  - [Enabled static "Position Independent Executables" by default
    for `x86_64-unknown-linux-musl`.][70740]
  + Libraries
  - [`mem::forget` is now a `const fn`.][73887]
  - [`String` now implements `From&lt;char&gt;`.][73466]
  - [The `leading_ones`, and `trailing_ones` methods have been stabilised for all
    integer types.][73032]
  - [`vec::IntoIter&lt;T&gt;` now implements `AsRef&lt;[T]&gt;`.][72583]
  - [All non-zero integer types (`NonZeroU8`) now implement `TryFrom` for their
    zero-able equivalent (e.g. `TryFrom&lt;u8&gt;`).][72717]
  - [`&amp;[T]` and `&amp;mut [T]` now implement `PartialEq&lt;Vec&lt;T&gt;&gt;`.][71660]
  - [`(String, u16)` now implements `ToSocketAddrs`.][73007]
  - [`vec::Drain&lt;'_, T&gt;` now implements `AsRef&lt;[T]&gt;`.][72584]
  + Stabilized APIs
  - [`Option::zip`]
  - [`vec::Drain::as_slice`]
  + Cargo
    Added a number of new environment variables that are now available when
    compiling your crate.
  - [`CARGO_BIN_NAME` and `CARGO_CRATE_NAME`][cargo/8270] Providing the name of
    the specific binary being compiled and the name of the crate.
  - [`CARGO_PKG_LICENSE`][cargo/8325] The license from the manifest of the package.
  - [`CARGO_PKG_LICENSE_FILE`][cargo/8387] The path to the license file.
- Update to version 1.44.1
  * rustfmt accepts rustfmt_skip in cfg_attr again.
  * Don't hash executable filenames on apple platforms, fixing backtraces.
  * Fix crashes when finding backtrace on macOS.
  * Clippy applies lint levels into different files.
- Update to version 1.44.0
  + Language
  - You can now use `async/.await` with `#[no_std]` enabled.
  - Added the `unused_braces` lint.
  - Expansion-driven outline module parsing
  + Compiler
  - Rustc now respects the `-C codegen-units` flag in incremental mode.
    Additionally when in incremental mode rustc defaults to 256 codegen units.
  - Refactored `catch_unwind` to have zero-cost, unless unwinding is enabled and
    a panic is thrown.
  - Added tier 3\* support for the `aarch64-unknown-none` and
    `aarch64-unknown-none-softfloat` targets.
  - Added tier 3 support for `arm64-apple-tvos` and
    `x86_64-apple-tvos` targets.
  + Libraries
  - Special cased `vec![]` to map directly to `Vec::new()`. This allows
    `vec![]` to be able to be used in `const` contexts.
  - `convert::Infallible` now implements `Hash`.
  - `OsString` now implements `DerefMut` and `IndexMut` returning
    a `&amp;mut OsStr`.
  - Unicode 13 is now supported.
  - `String` now implements `From&lt;&amp;mut str&gt;`.
  - `IoSlice` now implements `Copy`.
  - `Vec&lt;T&gt;` now implements `From&lt;[T; N]&gt;`. Where `N` is at most 32.
  - `proc_macro::LexError` now implements `fmt::Display` and `Error`.
  - `from_le_bytes`, `to_le_bytes`, `from_be_bytes`, `to_be_bytes`,
    `from_ne_bytes`, and `to_ne_bytes` methods are now `const` for all
    integer types.
  + Stabilizd APIs
  - [`PathBuf::with_capacity`]
  - [`PathBuf::capacity`]
  - [`PathBuf::clear`]
  - [`PathBuf::reserve`]
  - [`PathBuf::reserve_exact`]
  - [`PathBuf::shrink_to_fit`]
  - [`f32::to_int_unchecked`]
  - [`f64::to_int_unchecked`]
  - [`Layout::align_to`]
  - [`Layout::pad_to_align`]
  - [`Layout::array`]
  - [`Layout::extend`]
  + Cargo
  - Added the `cargo tree` command which will print a tree graph of
    your dependencies
  + Misc
  - Rustdoc now allows you to specify `--crate-version` to have rustdoc include
    the version in the sidebar.
  + Compatibility Notes
  - Rustc now correctly generates static libraries on Windows GNU targets with
    the `.a` extension, rather than the previous `.lib`.
  - Removed the `-C no_integrated_as` flag from rustc.
  - The `file_name` property in JSON output of macro errors now points the actual
    source file rather than the previous format of `&lt;NAME macros&gt;`.
  * *Note:** this may not point to a file that actually exists on the user's system.
  - The minimum required external LLVM version has been bumped to LLVM 8.
  - `mem::{zeroed, uninitialised}` will now panic when used with types that do
    not allow zero initialization such as `NonZeroU8`. This was
    previously a warning.
  - In 1.45.0 (the next release) converting a `f64` to `u32` using the `as`
    operator has been defined as a saturating operation. This was previously
    undefined behaviour, but you can use the `{f64, f32}::to_int_unchecked` methods to
    continue using the current behaviour, which may be desirable in rare performance
    sensitive situations.</changelog>
  <changelog author="william.brown@suse.com" date="1642680000">- bsc#1194767 - CVE-2022-21658 - Resolve race condition in std::fs::remove_dir_all
  - 0001-Fix-CVE-2022-21658-for-UNIX-like.patch</changelog>
</package>
<package pkgid="0586067b685ca52be9bb08bc8d788173aa1c20a5774504eb5ff6c7e4d55e678e" name="samba" arch="src">
  <version epoch="0" ver="4.11.14+git.319.91d693db37c" rel="4.35.1"/>
  <changelog author="scabrero@suse.de" date="1587556800">- CVE-2020-10704: LDAP Denial of Service (stack overflow) in
  Samba AD DC; (bso#14334); (bsc#1169851);
- CVE-2020-10700: Use-after-free in Samba AD DC LDAP Server with
  ASQ; (bso#14331); (bsc#1169850);</changelog>
  <changelog author="scabrero@suse.de" date="1588593600">- Require libldb2 &gt;= 2.0.10 after security release.</changelog>
  <changelog author="dmulder@suse.com" date="1589457600">- Fix samba_winbind package is installing python3-base without
  python3 package; (bsc#1169521);</changelog>
  <changelog author="scabrero@suse.de" date="1589457601">- Installing: samba - samba-ad-dc.service does not exist and unit
  not found; (bsc#1171437);</changelog>
  <changelog author="scabrero@suse.de" date="1591012800">- Add libnetapi-devel to baselibs conf, for wine usage; (bsc#1172307);</changelog>
  <changelog author="nopower@suse.com" date="1593691200">- Update to samba 4.11.11
  + CVE-2020-10730: NULL de-reference in AD DC LDAP server when ASQ
    and VLV combined; (bso#14364); (bsc#1173159]
  + CVE-2020-10745: invalid DNS or NBT queries containing dots use
    several seconds of CPU each; (bso#14378); (bsc#1173160).
  + CVE-2020-10760: Use-after-free in AD DC Global Catalog LDAP
    server with paged_result or VLV; (bso#14402); (bsc#1173161)
  + CVE-2020-14303: Endless loop from empty UDP packet sent to
    AD DC nbt_server; (bso#14417); (bsc#1173359).
- Update to samba 4.11.10
  + Fix segfault when using SMBC_opendir_ctx() routine for share
    folder that contains incorrect symbols in any file name;
    (bso#14374).
  + vfs_shadow_copy2 doesn't fail case looking in
    snapdirseverywhere mode; (bso#14350)
  + ldb_ldap: Fix off-by-one increment in lldb_add_msg_attr;
    (bso#14413).
  + Malicous SMB1 server can crash libsmbclient; (bso#14366)
  + winbindd: Fix a use-after-free when winbind clients exit;
    (bso#14382)
  + ldb: Bump version to 2.0.11, LMDB databases can grow without
    bounds. (bso#14330)
- Update to samba 4.11.9
  + nmblib: Avoid undefined behaviour in handle_name_ptrs();
    (bso#14242).
  + 'samba-tool group' commands do not handle group names with
    special chars correctly; (bso#14296).
  + smbd: avoid calling vfs_file_id_from_sbuf() if statinfo
    is not valid; (bso#14237).
  + Missing check for DMAPI offline status in async DOS
    attributes; (bso#14293).
  + smbd: Ignore set NTACL requests which contain
    S-1-5-88 NFS ACEs; (bso#14307).
  + vfs_recycle: Prevent flooding the log if we're called on
    non-existant paths; (bso#14316)
  + smbd mistakenly updates a file's write-time on close;
    (bso#14320).
  + RPC handles cannot be differentiated in source3 RPC server;
    (bso#14359).
  + librpc: Fix IDL for svcctl_ChangeServiceConfigW; (bso#14313).
  + nsswitch: Fix use-after-free causing segfault in
    _pam_delete_cred; (bso#14327).
  + Fix fruit:time machine max size on arm; (bso#13622)
  + CTDB recovery corner cases can cause record resurrection
    and node banning; (bso#14294).
  + ctdb: Fix a memleak; (bso#14348).
  + libsmb: Don't try to find posix stat info in SMBC_getatr().
  + ctdb-tcp: Move free of inbound queue to TCP restart;
    (bso#14295); (bsc#1162680).
  + s3/librpc/crypto: Fix double free with unresolved
    credential cache; (bso#14344); (bsc#1169095)
  + s3:libads: Fix ads_get_upn(); (bso#14336).
  + CTDB recovery corner cases can cause record resurrection
    and node banning; (bso#14294)
  + Starting ctdb node that was powered off hard before
    results in recovery loop; (bso#14295); (bsc#1162680).
  + ctdb-recoverd: Avoid dereferencing NULL rec-&gt;nodemap;
    (bso#14324)
- Update to samba 4.11.8
  + CVE-2020-10700: Use-after-free in Samba AD DC LDAP
    Server with ASQ; (bso#14331); (bsc#1169850);
  + CVE-2020-10704: LDAP Denial of Service (stack overflow)
    in Samba AD DC; (bso#14334); (bsc#1169851);
- Update to samba 4.11.7
  + s3: lib: nmblib. Clean up and harden nmb packet
    processing; (bso#14239).
  + s3: VFS: full_audit. Use system session_info if called
    from a temporary share definition; (bso#14283)
  + dsdb: Correctly handle memory in objectclass_attrs;
    (bso#14258).
  + ldb: version 2.0.9, Samba 4.11 and later give incorrect
    results for SCOPE_ONE searches; (bso#14270)
  + auth: Fix CIDs 1458418 and 1458420 Null pointer
    dereferences; (bso#14247).
  + smbd: Handle EINTR from open(2) properly; (bso#14285)
  + winbind member (source3) fails local SAM auth with empty
    domain name; (bso#14247)
  + winbindd: Handling missing idmap in getgrgid(); (bso#14265).
  + lib:util: Log mkdir error on correct debug levels;
    (bso#14253).
  + wafsamba: Do not use 'rU' as the 'U' is deprecated in
    Python 3.9; (bso#14266).
  + ctdb-tcp: Make error handling for outbound connection
    consistent; (bso#14274).
- Update to samba 4.11.6
  + pygpo: Use correct method flags; (bso#14209).
  + vfs_ceph_snapshots: Fix root relative path handling;
    (bso#14216); (bsc#1141320).
  + Avoiding bad call flags with python 3.8, using METH_NOARGS
    instead of zero; (bso#14209).
  + source4/utils/oLschema2ldif: Include stdint.h before
    cmocka.h; (bso#14218).
  + docs-xml/winbindnssinfo: Clarify interaction with
    idmap_ad etc; (bso#14122).
  + smbd: Fix the build with clang; (bso#14251).
  + upgradedns: Ensure lmdb lock files linked; (bso#14199).
  + s3: VFS: glusterfs: Reset nlinks for symlink entries during
    readdir; (bso#14182).
  + smbc_stat() doesn't return the correct st_mode and also
    the uid/gid is not filled (SMBv1) file; (bso#14101).
  + librpc: Fix string length checking in
    ndr_pull_charset_to_null(); (bso#14219).
  + ctdb-scripts: Strip square brackets when gathering
    connection info; (bso#14227).</changelog>
  <changelog author="dmulder@suse.com" date="1594728000">- Fix net command unable to negotiate SMB2; (bsc#1174120);</changelog>
  <changelog author="scabrero@suse.de" date="1595851200">- Add obsoletes to libsmbldap2 package to fix upgrades from previous
  versions; (bsc#1172810);</changelog>
  <changelog author="scabrero@suse.de" date="1600430400">- Update to samba 4.11.13
  + CVE-2020-1472(ZeroLogon): s3:rpc_server/netlogon: Protect
    netr_ServerPasswordSet2 against unencrypted passwords; (bsc#1176579);
    (bso#14497);
  + CVE-2020-1472(ZeroLogon): s3:rpc_server/netlogon: Support
    "server require schannel:WORKSTATION$ = no" about unsecure configurations;
    (bsc#1176579); (bso#14497);
  + CVE-2020-1472(ZeroLogon): s4 torture rpc: repeated bytes in client
    challenge; (bsc#1176579); (bso#14497);
  + CVE-2020-1472(ZeroLogon): libcli/auth: Reject weak client challenges in
    netlogon_creds_server_init() "server require schannel:WORKSTATION$ = no";
    (bsc#1176579); (bso#14497);
- Update to samba 4.11.12
  + s3: libsmb: Fix SMB2 client rename bug to a Windows server; (bso#14403);
  + dsdb: Allow "password hash userPassword schemes = CryptSHA256" to work
    on RHEL7; (bso#14424);
  + dbcheck: Allow a dangling forward link outside our known NCs; (bso#14450);
  + lib/debug: Set the correct default backend loglevel to MAX_DEBUG_LEVEL;
    (bso#14426);
  + s3:smbd: PANIC: assert failed in get_lease_type(); (bso#14428);
  + lib/util: do not install "test_util_paths"; (bso#14370);
  + lib:util: Fix smbclient -l basename dir; (bso#14345);
  + s3:smbd: PANIC: assert failed in get_lease_type(); (bso#14428);
  + util: Allow symlinks in directory_create_or_exist; (bso#14166);
  + docs: Fix documentation for require_membership_of of pam_winbind;
    (bso#14358);
  + s3:winbind:idmap_ad: Make failure to get attrnames for schema mode fatal;
    (bso#14425);</changelog>
  <changelog author="scabrero@suse.de" date="1602590400">- CVE-2020-14383: An authenticated user can crash the DCE/RPC DNS with
  easily crafted records; (bsc#1177613); (bso#14472);
- CVE-2020-14323: Unprivileged user can crash winbind; (bsc#1173994);
  (bso#14436);
- CVE-2020-14318: Missing handle permissions check in SMB1/2/3 ChangeNotify;
  (bsc#1173902); (bso#14434);
- Update to samba 4.11.14
  + lib/util: Do not install /usr/bin/test_util; (bso#14166);
  + smbd: don't log success as error; (bso#14490);
  + idmap_ad does not deal properly with a RFC4511 section 4.4.1 response;
    (bso#14465);
  + winbind: Fix a memleak; (bso#14388);
  + idmap_ad: Pass tldap debug messages on to DEBUG(); (bso#14465);
  + lib/replace: Move lib/replace/closefrom.c from ROKEN_HOSTCC_SOURCE to
    REPLACE_HOSTCC_SOURCE; (bso#14482);
  + ctdb disable/enable can fail due to race condition; (bso#14466);</changelog>
  <changelog author="nopower@suse.com" date="1604577600">- Adjust smbcacls '--propagate-inheritance' feature to align with
  upstream; (bsc#1178469).</changelog>
  <changelog author="nopower@suse.com" date="1612440000">- Avoid free'ing our own pointer in memcache when memcache_trim
  attempts to reduce cache size; (bso#14625); (bnc#1179156).</changelog>
  <changelog author="nopower@suse.com" date="1615896000">- CVE-2020-27840: samba: Unauthenticated remote heap corruption
  via bad DNs; (bso#14595); (bsc#1183572).
- CVE-2021-20277: samba: out of bounds read in ldb_handler_fold;
  (bso#14655); (bsc#1183574).</changelog>
  <changelog author="dmulder@suse.com" date="1616760000">- s3-libads: use dns name to open a ldap session; (bso#13124);
  (bsc#1184310).</changelog>
  <changelog author="nopower@suse.com" date="1618401600">-  CVE-2021-20254 Buffer overrun in sids_to_unixids();
  (bnc#14571); (bsc#1184677).</changelog>
  <changelog author="scabrero@suse.de" date="1619697600">- Add msDS-AdditionalDnsHostName to the keytab; (bso#14396);
  (bsc#1185420);
- Add net-ads-join dnshostname option; (bso#14396); (bsc#1185420);
- Fix adding msDS-AdditionalDnsHostName to keytab with Windows DC;
  (bso#14406); (bsc#1185420);</changelog>
  <changelog author="scabrero@suse.de" date="1629892800">- Fix wrong kvno exported to keytab after net ads changetrustpw due
  to replication delay; (bsc#1188727);</changelog>
  <changelog author="nopower@suse.com" date="1635854400">- CVE-2016-2124: SMB1 client connections can be downgraded to
  plaintext authentication (bsc#1014440); (bso#12444);
- CVE-2020-25717: A user in an AD Domain could become root on
  domain members; (bsc#1192284); (bso#14556);
- CVE-2021-23192: Subsequent DCE/RPC fragment injection vulnerability;
  (bsc#1192214); (bso#14875);</changelog>
  <changelog author="nopower@suse.com" date="1637236800">- The username map [script] advice from CVE-2020-25717 advisory
  note has undesired side effects for the local nt token. Fallback
  to a SID/UID based mapping if the name based lookup fails;
  (bsc#1192849); (bso#14901).</changelog>
  <changelog author="nopower@suse.com" date="1642766400">- CVE-2021-44142: Out-of-Bound Read/Write on Samba vfs_fruit
  module; (bsc#1194859); (bso#14914).</changelog>
</package>
<package pkgid="284390cdda27023fcfb97f4ba04218291c1d28351aa2177d80b35bab6e0058d2" name="samba" arch="src">
  <version epoch="0" ver="4.9.5+git.483.212a7ebca6b" rel="3.64.1"/>
  <changelog author="nopower@suse.com" date="1584705600">- Fix CLI tools still printing "Unable to initialize messaging
  context" messages; (bso#13925); (bsc#1167070).
- Do print mkdir failure message on error debug level when
  initializing messaging; (bso#13823); (bsc#1167070).</changelog>
  <changelog author="dmulder@suse.com" date="1586865600">- Fix spnego fallback from kerberos to ntlmssp in smbd server;
  (bso#14106); (bsc#1169473);</changelog>
  <changelog author="nopower@suse.com" date="1587556800">- CVE-2020-10704: samba: Stack overflow in AD DC (C)LDAP server;
  (bso#14334); (bsc#1169851).</changelog>
  <changelog author="scabrero@suse.de" date="1589457600">- Installing: samba - samba-ad-dc.service does not exist and unit
  not found; (bsc#1171437);</changelog>
  <changelog author="scabrero@suse.de" date="1591012800">- Add libnetapi-devel to baselibs conf, for wine usage; (bsc#1172307);</changelog>
  <changelog author="nopower@suse.com" date="1592827200">- CVE-2020-10730: NULL de-reference in AD DC LDAP server when ASQ
  and VLV combined; (bso#14364); (bsc#1173159].
- CVE-2020-10745: invalid DNS or NBT queries containing dots use
  several seconds of CPU each; (bso#14378); (bsc#1173160).
- CVE-2020-10760: Use-after-free in AD DC Global Catalog LDAP server
  with paged_result or VLV; (bso#14402); (bsc#1173161).</changelog>
  <changelog author="nopower@suse.com" date="1593086400">- CVE-2020-14303: Endless loop from empty UDP packet sent to AD DC
  nbt_server; (bso#14417); (bsc#1173359).</changelog>
  <changelog author="dmulder@suse.com" date="1594728000">- Fix net command unable to negotiate SMB2; (bsc#1174120);</changelog>
  <changelog author="scabrero@suse.de" date="1595851200">- Add obsoletes to libsmbldap2 package to fix upgrades from previous
  versions; (bsc#1172810);</changelog>
  <changelog author="scabrero@suse.de" date="1600430400">- CVE-2020-1472: Unauthenticated domain takeover via netlogon ("ZeroLogon").
  + s3:rpc_server/netlogon: Protect netr_ServerPasswordSet2 against
    unencrypted passwords; (bsc#1176579); (bso#14497);
  + s3:rpc_server/netlogon: Support "server require schannel:WORKSTATION$ = no"
    about unsecure configurations; (bsc#1176579); (bso#14497);
  + s4 torture rpc: repeated bytes in client challenge; (bsc#1176579);
    (bso#14497);
  + libcli/auth: Reject weak client challenges in netlogon_creds_server_init()
    "server require schannel:WORKSTATION$ = no"; (bsc#1176579); (bso#14497);</changelog>
  <changelog author="scabrero@suse.de" date="1602590400">- CVE-2020-14383: An authenticated user can crash the DCE/RPC DNS with
  easily crafted records; (bsc#1177613); (bso#14472);
- CVE-2020-14323: Unprivileged user can crash winbind; (bsc#1173994);
  (bso#14436);
- CVE-2020-14318: Missing handle permissions check in SMB1/2/3 ChangeNotify;
  (bsc#1173902); (bso#14434);</changelog>
  <changelog author="nopower@suse.com" date="1604577600">- Adjust smbcacls '--propagate-inheritance' feature to align with
  upstream; (bsc#1178469).</changelog>
  <changelog author="nopower@suse.com" date="1612440000">- Avoid free'ing our own pointer in memcache when memcache_trim
  attempts to reduce cache size; (bso#14625); (bnc#1179156).</changelog>
  <changelog author="nopower@suse.com" date="1615896000">-  CVE-2020-27840: samba: Unauthenticated remote heap corruption
  via bad DNs; (bso#14595); (bsc#1183572).
-  CVE-2021-20277: samba: out of bounds read in ldb_handler_fold;
  (bso#14655); (bsc#1183574).</changelog>
  <changelog author="dmulder@suse.com" date="1616760000">- s3-libads: use dns name to open a ldap session; (bso#13124);
  (bsc#1184310).</changelog>
  <changelog author="nopower@suse.com" date="1618401600">- CVE-2021-20254 Buffer overrun in sids_to_unixids();
  (bso#14571); (bsc#1184677).</changelog>
  <changelog author="scabrero@suse.de" date="1621598400">- s3-libads: Do not turn on canonicalization flag. Fixes a regression
  changing the computer account password; (bsc#1185089); (bso#14155);</changelog>
  <changelog author="scabrero@suse.de" date="1636372800">- CVE-2016-2124: Don't fallback to non spnego authentication if
  kerberos is required; (bsc#1014440); (bso#12444);
- CVE-2020-25717: A user in an AD Domain could become root on
  domain members; (bsc#1192284); (bso#14556);</changelog>
  <changelog author="nopower@suse.com" date="1637236800">- The username map [script] advice from CVE-2020-25717 advisory
  note has undesired side effects for the local nt token. Fallback
  to a SID/UID based mapping if the name based lookup fails;
  (bsc#1192849); (bso#14901).</changelog>
  <changelog author="nopower@suse.com" date="1642766400">- CVE-2021-44142: Out-of-Bound Read/Write on Samba vfs_fruit
  module; (bsc#1194859); (bso#14914).</changelog>
</package>
<package pkgid="7f41454abb1cf43bff787d78018e379942b8b2795080d139448a30f982089e99" name="samba-libs-python-32bit" arch="x86_64">
  <version epoch="0" ver="4.9.5+git.483.212a7ebca6b" rel="3.64.1"/>
  <changelog author="nopower@suse.com" date="1584705600">- Fix CLI tools still printing "Unable to initialize messaging
  context" messages; (bso#13925); (bsc#1167070).
- Do print mkdir failure message on error debug level when
  initializing messaging; (bso#13823); (bsc#1167070).</changelog>
  <changelog author="dmulder@suse.com" date="1586865600">- Fix spnego fallback from kerberos to ntlmssp in smbd server;
  (bso#14106); (bsc#1169473);</changelog>
  <changelog author="nopower@suse.com" date="1587556800">- CVE-2020-10704: samba: Stack overflow in AD DC (C)LDAP server;
  (bso#14334); (bsc#1169851).</changelog>
  <changelog author="scabrero@suse.de" date="1589457600">- Installing: samba - samba-ad-dc.service does not exist and unit
  not found; (bsc#1171437);</changelog>
  <changelog author="scabrero@suse.de" date="1591012800">- Add libnetapi-devel to baselibs conf, for wine usage; (bsc#1172307);</changelog>
  <changelog author="nopower@suse.com" date="1592827200">- CVE-2020-10730: NULL de-reference in AD DC LDAP server when ASQ
  and VLV combined; (bso#14364); (bsc#1173159].
- CVE-2020-10745: invalid DNS or NBT queries containing dots use
  several seconds of CPU each; (bso#14378); (bsc#1173160).
- CVE-2020-10760: Use-after-free in AD DC Global Catalog LDAP server
  with paged_result or VLV; (bso#14402); (bsc#1173161).</changelog>
  <changelog author="nopower@suse.com" date="1593086400">- CVE-2020-14303: Endless loop from empty UDP packet sent to AD DC
  nbt_server; (bso#14417); (bsc#1173359).</changelog>
  <changelog author="dmulder@suse.com" date="1594728000">- Fix net command unable to negotiate SMB2; (bsc#1174120);</changelog>
  <changelog author="scabrero@suse.de" date="1595851200">- Add obsoletes to libsmbldap2 package to fix upgrades from previous
  versions; (bsc#1172810);</changelog>
  <changelog author="scabrero@suse.de" date="1600430400">- CVE-2020-1472: Unauthenticated domain takeover via netlogon ("ZeroLogon").
  + s3:rpc_server/netlogon: Protect netr_ServerPasswordSet2 against
    unencrypted passwords; (bsc#1176579); (bso#14497);
  + s3:rpc_server/netlogon: Support "server require schannel:WORKSTATION$ = no"
    about unsecure configurations; (bsc#1176579); (bso#14497);
  + s4 torture rpc: repeated bytes in client challenge; (bsc#1176579);
    (bso#14497);
  + libcli/auth: Reject weak client challenges in netlogon_creds_server_init()
    "server require schannel:WORKSTATION$ = no"; (bsc#1176579); (bso#14497);</changelog>
  <changelog author="scabrero@suse.de" date="1602590400">- CVE-2020-14383: An authenticated user can crash the DCE/RPC DNS with
  easily crafted records; (bsc#1177613); (bso#14472);
- CVE-2020-14323: Unprivileged user can crash winbind; (bsc#1173994);
  (bso#14436);
- CVE-2020-14318: Missing handle permissions check in SMB1/2/3 ChangeNotify;
  (bsc#1173902); (bso#14434);</changelog>
  <changelog author="nopower@suse.com" date="1604577600">- Adjust smbcacls '--propagate-inheritance' feature to align with
  upstream; (bsc#1178469).</changelog>
  <changelog author="nopower@suse.com" date="1612440000">- Avoid free'ing our own pointer in memcache when memcache_trim
  attempts to reduce cache size; (bso#14625); (bnc#1179156).</changelog>
  <changelog author="nopower@suse.com" date="1615896000">-  CVE-2020-27840: samba: Unauthenticated remote heap corruption
  via bad DNs; (bso#14595); (bsc#1183572).
-  CVE-2021-20277: samba: out of bounds read in ldb_handler_fold;
  (bso#14655); (bsc#1183574).</changelog>
  <changelog author="dmulder@suse.com" date="1616760000">- s3-libads: use dns name to open a ldap session; (bso#13124);
  (bsc#1184310).</changelog>
  <changelog author="nopower@suse.com" date="1618401600">- CVE-2021-20254 Buffer overrun in sids_to_unixids();
  (bso#14571); (bsc#1184677).</changelog>
  <changelog author="scabrero@suse.de" date="1621598400">- s3-libads: Do not turn on canonicalization flag. Fixes a regression
  changing the computer account password; (bsc#1185089); (bso#14155);</changelog>
  <changelog author="scabrero@suse.de" date="1636372800">- CVE-2016-2124: Don't fallback to non spnego authentication if
  kerberos is required; (bsc#1014440); (bso#12444);
- CVE-2020-25717: A user in an AD Domain could become root on
  domain members; (bsc#1192284); (bso#14556);</changelog>
  <changelog author="nopower@suse.com" date="1637236800">- The username map [script] advice from CVE-2020-25717 advisory
  note has undesired side effects for the local nt token. Fallback
  to a SID/UID based mapping if the name based lookup fails;
  (bsc#1192849); (bso#14901).</changelog>
  <changelog author="nopower@suse.com" date="1642766400">- CVE-2021-44142: Out-of-Bound Read/Write on Samba vfs_fruit
  module; (bsc#1194859); (bso#14914).</changelog>
</package>
<package pkgid="ed56c4384982162c3a7808ce9d8ce949f43579b56c43caaa6734d9c63ca2b5b9" name="samba-libs-python" arch="aarch64">
  <version epoch="0" ver="4.9.5+git.483.212a7ebca6b" rel="3.64.1"/>
  <changelog author="nopower@suse.com" date="1584705600">- Fix CLI tools still printing "Unable to initialize messaging
  context" messages; (bso#13925); (bsc#1167070).
- Do print mkdir failure message on error debug level when
  initializing messaging; (bso#13823); (bsc#1167070).</changelog>
  <changelog author="dmulder@suse.com" date="1586865600">- Fix spnego fallback from kerberos to ntlmssp in smbd server;
  (bso#14106); (bsc#1169473);</changelog>
  <changelog author="nopower@suse.com" date="1587556800">- CVE-2020-10704: samba: Stack overflow in AD DC (C)LDAP server;
  (bso#14334); (bsc#1169851).</changelog>
  <changelog author="scabrero@suse.de" date="1589457600">- Installing: samba - samba-ad-dc.service does not exist and unit
  not found; (bsc#1171437);</changelog>
  <changelog author="scabrero@suse.de" date="1591012800">- Add libnetapi-devel to baselibs conf, for wine usage; (bsc#1172307);</changelog>
  <changelog author="nopower@suse.com" date="1592827200">- CVE-2020-10730: NULL de-reference in AD DC LDAP server when ASQ
  and VLV combined; (bso#14364); (bsc#1173159].
- CVE-2020-10745: invalid DNS or NBT queries containing dots use
  several seconds of CPU each; (bso#14378); (bsc#1173160).
- CVE-2020-10760: Use-after-free in AD DC Global Catalog LDAP server
  with paged_result or VLV; (bso#14402); (bsc#1173161).</changelog>
  <changelog author="nopower@suse.com" date="1593086400">- CVE-2020-14303: Endless loop from empty UDP packet sent to AD DC
  nbt_server; (bso#14417); (bsc#1173359).</changelog>
  <changelog author="dmulder@suse.com" date="1594728000">- Fix net command unable to negotiate SMB2; (bsc#1174120);</changelog>
  <changelog author="scabrero@suse.de" date="1595851200">- Add obsoletes to libsmbldap2 package to fix upgrades from previous
  versions; (bsc#1172810);</changelog>
  <changelog author="scabrero@suse.de" date="1600430400">- CVE-2020-1472: Unauthenticated domain takeover via netlogon ("ZeroLogon").
  + s3:rpc_server/netlogon: Protect netr_ServerPasswordSet2 against
    unencrypted passwords; (bsc#1176579); (bso#14497);
  + s3:rpc_server/netlogon: Support "server require schannel:WORKSTATION$ = no"
    about unsecure configurations; (bsc#1176579); (bso#14497);
  + s4 torture rpc: repeated bytes in client challenge; (bsc#1176579);
    (bso#14497);
  + libcli/auth: Reject weak client challenges in netlogon_creds_server_init()
    "server require schannel:WORKSTATION$ = no"; (bsc#1176579); (bso#14497);</changelog>
  <changelog author="scabrero@suse.de" date="1602590400">- CVE-2020-14383: An authenticated user can crash the DCE/RPC DNS with
  easily crafted records; (bsc#1177613); (bso#14472);
- CVE-2020-14323: Unprivileged user can crash winbind; (bsc#1173994);
  (bso#14436);
- CVE-2020-14318: Missing handle permissions check in SMB1/2/3 ChangeNotify;
  (bsc#1173902); (bso#14434);</changelog>
  <changelog author="nopower@suse.com" date="1604577600">- Adjust smbcacls '--propagate-inheritance' feature to align with
  upstream; (bsc#1178469).</changelog>
  <changelog author="nopower@suse.com" date="1612440000">- Avoid free'ing our own pointer in memcache when memcache_trim
  attempts to reduce cache size; (bso#14625); (bnc#1179156).</changelog>
  <changelog author="nopower@suse.com" date="1615896000">-  CVE-2020-27840: samba: Unauthenticated remote heap corruption
  via bad DNs; (bso#14595); (bsc#1183572).
-  CVE-2021-20277: samba: out of bounds read in ldb_handler_fold;
  (bso#14655); (bsc#1183574).</changelog>
  <changelog author="dmulder@suse.com" date="1616760000">- s3-libads: use dns name to open a ldap session; (bso#13124);
  (bsc#1184310).</changelog>
  <changelog author="nopower@suse.com" date="1618401600">- CVE-2021-20254 Buffer overrun in sids_to_unixids();
  (bso#14571); (bsc#1184677).</changelog>
  <changelog author="scabrero@suse.de" date="1621598400">- s3-libads: Do not turn on canonicalization flag. Fixes a regression
  changing the computer account password; (bsc#1185089); (bso#14155);</changelog>
  <changelog author="scabrero@suse.de" date="1636372800">- CVE-2016-2124: Don't fallback to non spnego authentication if
  kerberos is required; (bsc#1014440); (bso#12444);
- CVE-2020-25717: A user in an AD Domain could become root on
  domain members; (bsc#1192284); (bso#14556);</changelog>
  <changelog author="nopower@suse.com" date="1637236800">- The username map [script] advice from CVE-2020-25717 advisory
  note has undesired side effects for the local nt token. Fallback
  to a SID/UID based mapping if the name based lookup fails;
  (bsc#1192849); (bso#14901).</changelog>
  <changelog author="nopower@suse.com" date="1642766400">- CVE-2021-44142: Out-of-Bound Read/Write on Samba vfs_fruit
  module; (bsc#1194859); (bso#14914).</changelog>
</package>
<package pkgid="097026d554fff92c9efd4a90ef8587449cd5d2cca2b36052e32480217950dab2" name="samba-libs-python" arch="ppc64le">
  <version epoch="0" ver="4.9.5+git.483.212a7ebca6b" rel="3.64.1"/>
  <changelog author="nopower@suse.com" date="1584705600">- Fix CLI tools still printing "Unable to initialize messaging
  context" messages; (bso#13925); (bsc#1167070).
- Do print mkdir failure message on error debug level when
  initializing messaging; (bso#13823); (bsc#1167070).</changelog>
  <changelog author="dmulder@suse.com" date="1586865600">- Fix spnego fallback from kerberos to ntlmssp in smbd server;
  (bso#14106); (bsc#1169473);</changelog>
  <changelog author="nopower@suse.com" date="1587556800">- CVE-2020-10704: samba: Stack overflow in AD DC (C)LDAP server;
  (bso#14334); (bsc#1169851).</changelog>
  <changelog author="scabrero@suse.de" date="1589457600">- Installing: samba - samba-ad-dc.service does not exist and unit
  not found; (bsc#1171437);</changelog>
  <changelog author="scabrero@suse.de" date="1591012800">- Add libnetapi-devel to baselibs conf, for wine usage; (bsc#1172307);</changelog>
  <changelog author="nopower@suse.com" date="1592827200">- CVE-2020-10730: NULL de-reference in AD DC LDAP server when ASQ
  and VLV combined; (bso#14364); (bsc#1173159].
- CVE-2020-10745: invalid DNS or NBT queries containing dots use
  several seconds of CPU each; (bso#14378); (bsc#1173160).
- CVE-2020-10760: Use-after-free in AD DC Global Catalog LDAP server
  with paged_result or VLV; (bso#14402); (bsc#1173161).</changelog>
  <changelog author="nopower@suse.com" date="1593086400">- CVE-2020-14303: Endless loop from empty UDP packet sent to AD DC
  nbt_server; (bso#14417); (bsc#1173359).</changelog>
  <changelog author="dmulder@suse.com" date="1594728000">- Fix net command unable to negotiate SMB2; (bsc#1174120);</changelog>
  <changelog author="scabrero@suse.de" date="1595851200">- Add obsoletes to libsmbldap2 package to fix upgrades from previous
  versions; (bsc#1172810);</changelog>
  <changelog author="scabrero@suse.de" date="1600430400">- CVE-2020-1472: Unauthenticated domain takeover via netlogon ("ZeroLogon").
  + s3:rpc_server/netlogon: Protect netr_ServerPasswordSet2 against
    unencrypted passwords; (bsc#1176579); (bso#14497);
  + s3:rpc_server/netlogon: Support "server require schannel:WORKSTATION$ = no"
    about unsecure configurations; (bsc#1176579); (bso#14497);
  + s4 torture rpc: repeated bytes in client challenge; (bsc#1176579);
    (bso#14497);
  + libcli/auth: Reject weak client challenges in netlogon_creds_server_init()
    "server require schannel:WORKSTATION$ = no"; (bsc#1176579); (bso#14497);</changelog>
  <changelog author="scabrero@suse.de" date="1602590400">- CVE-2020-14383: An authenticated user can crash the DCE/RPC DNS with
  easily crafted records; (bsc#1177613); (bso#14472);
- CVE-2020-14323: Unprivileged user can crash winbind; (bsc#1173994);
  (bso#14436);
- CVE-2020-14318: Missing handle permissions check in SMB1/2/3 ChangeNotify;
  (bsc#1173902); (bso#14434);</changelog>
  <changelog author="nopower@suse.com" date="1604577600">- Adjust smbcacls '--propagate-inheritance' feature to align with
  upstream; (bsc#1178469).</changelog>
  <changelog author="nopower@suse.com" date="1612440000">- Avoid free'ing our own pointer in memcache when memcache_trim
  attempts to reduce cache size; (bso#14625); (bnc#1179156).</changelog>
  <changelog author="nopower@suse.com" date="1615896000">-  CVE-2020-27840: samba: Unauthenticated remote heap corruption
  via bad DNs; (bso#14595); (bsc#1183572).
-  CVE-2021-20277: samba: out of bounds read in ldb_handler_fold;
  (bso#14655); (bsc#1183574).</changelog>
  <changelog author="dmulder@suse.com" date="1616760000">- s3-libads: use dns name to open a ldap session; (bso#13124);
  (bsc#1184310).</changelog>
  <changelog author="nopower@suse.com" date="1618401600">- CVE-2021-20254 Buffer overrun in sids_to_unixids();
  (bso#14571); (bsc#1184677).</changelog>
  <changelog author="scabrero@suse.de" date="1621598400">- s3-libads: Do not turn on canonicalization flag. Fixes a regression
  changing the computer account password; (bsc#1185089); (bso#14155);</changelog>
  <changelog author="scabrero@suse.de" date="1636372800">- CVE-2016-2124: Don't fallback to non spnego authentication if
  kerberos is required; (bsc#1014440); (bso#12444);
- CVE-2020-25717: A user in an AD Domain could become root on
  domain members; (bsc#1192284); (bso#14556);</changelog>
  <changelog author="nopower@suse.com" date="1637236800">- The username map [script] advice from CVE-2020-25717 advisory
  note has undesired side effects for the local nt token. Fallback
  to a SID/UID based mapping if the name based lookup fails;
  (bsc#1192849); (bso#14901).</changelog>
  <changelog author="nopower@suse.com" date="1642766400">- CVE-2021-44142: Out-of-Bound Read/Write on Samba vfs_fruit
  module; (bsc#1194859); (bso#14914).</changelog>
</package>
<package pkgid="6b78614278eb04afd6afbf152855a497d2f2606afc0427c4a425a22a02774ab4" name="samba-libs-python" arch="s390x">
  <version epoch="0" ver="4.9.5+git.483.212a7ebca6b" rel="3.64.1"/>
  <changelog author="nopower@suse.com" date="1584705600">- Fix CLI tools still printing "Unable to initialize messaging
  context" messages; (bso#13925); (bsc#1167070).
- Do print mkdir failure message on error debug level when
  initializing messaging; (bso#13823); (bsc#1167070).</changelog>
  <changelog author="dmulder@suse.com" date="1586865600">- Fix spnego fallback from kerberos to ntlmssp in smbd server;
  (bso#14106); (bsc#1169473);</changelog>
  <changelog author="nopower@suse.com" date="1587556800">- CVE-2020-10704: samba: Stack overflow in AD DC (C)LDAP server;
  (bso#14334); (bsc#1169851).</changelog>
  <changelog author="scabrero@suse.de" date="1589457600">- Installing: samba - samba-ad-dc.service does not exist and unit
  not found; (bsc#1171437);</changelog>
  <changelog author="scabrero@suse.de" date="1591012800">- Add libnetapi-devel to baselibs conf, for wine usage; (bsc#1172307);</changelog>
  <changelog author="nopower@suse.com" date="1592827200">- CVE-2020-10730: NULL de-reference in AD DC LDAP server when ASQ
  and VLV combined; (bso#14364); (bsc#1173159].
- CVE-2020-10745: invalid DNS or NBT queries containing dots use
  several seconds of CPU each; (bso#14378); (bsc#1173160).
- CVE-2020-10760: Use-after-free in AD DC Global Catalog LDAP server
  with paged_result or VLV; (bso#14402); (bsc#1173161).</changelog>
  <changelog author="nopower@suse.com" date="1593086400">- CVE-2020-14303: Endless loop from empty UDP packet sent to AD DC
  nbt_server; (bso#14417); (bsc#1173359).</changelog>
  <changelog author="dmulder@suse.com" date="1594728000">- Fix net command unable to negotiate SMB2; (bsc#1174120);</changelog>
  <changelog author="scabrero@suse.de" date="1595851200">- Add obsoletes to libsmbldap2 package to fix upgrades from previous
  versions; (bsc#1172810);</changelog>
  <changelog author="scabrero@suse.de" date="1600430400">- CVE-2020-1472: Unauthenticated domain takeover via netlogon ("ZeroLogon").
  + s3:rpc_server/netlogon: Protect netr_ServerPasswordSet2 against
    unencrypted passwords; (bsc#1176579); (bso#14497);
  + s3:rpc_server/netlogon: Support "server require schannel:WORKSTATION$ = no"
    about unsecure configurations; (bsc#1176579); (bso#14497);
  + s4 torture rpc: repeated bytes in client challenge; (bsc#1176579);
    (bso#14497);
  + libcli/auth: Reject weak client challenges in netlogon_creds_server_init()
    "server require schannel:WORKSTATION$ = no"; (bsc#1176579); (bso#14497);</changelog>
  <changelog author="scabrero@suse.de" date="1602590400">- CVE-2020-14383: An authenticated user can crash the DCE/RPC DNS with
  easily crafted records; (bsc#1177613); (bso#14472);
- CVE-2020-14323: Unprivileged user can crash winbind; (bsc#1173994);
  (bso#14436);
- CVE-2020-14318: Missing handle permissions check in SMB1/2/3 ChangeNotify;
  (bsc#1173902); (bso#14434);</changelog>
  <changelog author="nopower@suse.com" date="1604577600">- Adjust smbcacls '--propagate-inheritance' feature to align with
  upstream; (bsc#1178469).</changelog>
  <changelog author="nopower@suse.com" date="1612440000">- Avoid free'ing our own pointer in memcache when memcache_trim
  attempts to reduce cache size; (bso#14625); (bnc#1179156).</changelog>
  <changelog author="nopower@suse.com" date="1615896000">-  CVE-2020-27840: samba: Unauthenticated remote heap corruption
  via bad DNs; (bso#14595); (bsc#1183572).
-  CVE-2021-20277: samba: out of bounds read in ldb_handler_fold;
  (bso#14655); (bsc#1183574).</changelog>
  <changelog author="dmulder@suse.com" date="1616760000">- s3-libads: use dns name to open a ldap session; (bso#13124);
  (bsc#1184310).</changelog>
  <changelog author="nopower@suse.com" date="1618401600">- CVE-2021-20254 Buffer overrun in sids_to_unixids();
  (bso#14571); (bsc#1184677).</changelog>
  <changelog author="scabrero@suse.de" date="1621598400">- s3-libads: Do not turn on canonicalization flag. Fixes a regression
  changing the computer account password; (bsc#1185089); (bso#14155);</changelog>
  <changelog author="scabrero@suse.de" date="1636372800">- CVE-2016-2124: Don't fallback to non spnego authentication if
  kerberos is required; (bsc#1014440); (bso#12444);
- CVE-2020-25717: A user in an AD Domain could become root on
  domain members; (bsc#1192284); (bso#14556);</changelog>
  <changelog author="nopower@suse.com" date="1637236800">- The username map [script] advice from CVE-2020-25717 advisory
  note has undesired side effects for the local nt token. Fallback
  to a SID/UID based mapping if the name based lookup fails;
  (bsc#1192849); (bso#14901).</changelog>
  <changelog author="nopower@suse.com" date="1642766400">- CVE-2021-44142: Out-of-Bound Read/Write on Samba vfs_fruit
  module; (bsc#1194859); (bso#14914).</changelog>
</package>
<package pkgid="0e12263eb4a8bb4a1529b35d4afe5f7bb903ab4592306ccd1d622b71e2ca4ca0" name="samba-libs-python" arch="x86_64">
  <version epoch="0" ver="4.9.5+git.483.212a7ebca6b" rel="3.64.1"/>
  <changelog author="nopower@suse.com" date="1584705600">- Fix CLI tools still printing "Unable to initialize messaging
  context" messages; (bso#13925); (bsc#1167070).
- Do print mkdir failure message on error debug level when
  initializing messaging; (bso#13823); (bsc#1167070).</changelog>
  <changelog author="dmulder@suse.com" date="1586865600">- Fix spnego fallback from kerberos to ntlmssp in smbd server;
  (bso#14106); (bsc#1169473);</changelog>
  <changelog author="nopower@suse.com" date="1587556800">- CVE-2020-10704: samba: Stack overflow in AD DC (C)LDAP server;
  (bso#14334); (bsc#1169851).</changelog>
  <changelog author="scabrero@suse.de" date="1589457600">- Installing: samba - samba-ad-dc.service does not exist and unit
  not found; (bsc#1171437);</changelog>
  <changelog author="scabrero@suse.de" date="1591012800">- Add libnetapi-devel to baselibs conf, for wine usage; (bsc#1172307);</changelog>
  <changelog author="nopower@suse.com" date="1592827200">- CVE-2020-10730: NULL de-reference in AD DC LDAP server when ASQ
  and VLV combined; (bso#14364); (bsc#1173159].
- CVE-2020-10745: invalid DNS or NBT queries containing dots use
  several seconds of CPU each; (bso#14378); (bsc#1173160).
- CVE-2020-10760: Use-after-free in AD DC Global Catalog LDAP server
  with paged_result or VLV; (bso#14402); (bsc#1173161).</changelog>
  <changelog author="nopower@suse.com" date="1593086400">- CVE-2020-14303: Endless loop from empty UDP packet sent to AD DC
  nbt_server; (bso#14417); (bsc#1173359).</changelog>
  <changelog author="dmulder@suse.com" date="1594728000">- Fix net command unable to negotiate SMB2; (bsc#1174120);</changelog>
  <changelog author="scabrero@suse.de" date="1595851200">- Add obsoletes to libsmbldap2 package to fix upgrades from previous
  versions; (bsc#1172810);</changelog>
  <changelog author="scabrero@suse.de" date="1600430400">- CVE-2020-1472: Unauthenticated domain takeover via netlogon ("ZeroLogon").
  + s3:rpc_server/netlogon: Protect netr_ServerPasswordSet2 against
    unencrypted passwords; (bsc#1176579); (bso#14497);
  + s3:rpc_server/netlogon: Support "server require schannel:WORKSTATION$ = no"
    about unsecure configurations; (bsc#1176579); (bso#14497);
  + s4 torture rpc: repeated bytes in client challenge; (bsc#1176579);
    (bso#14497);
  + libcli/auth: Reject weak client challenges in netlogon_creds_server_init()
    "server require schannel:WORKSTATION$ = no"; (bsc#1176579); (bso#14497);</changelog>
  <changelog author="scabrero@suse.de" date="1602590400">- CVE-2020-14383: An authenticated user can crash the DCE/RPC DNS with
  easily crafted records; (bsc#1177613); (bso#14472);
- CVE-2020-14323: Unprivileged user can crash winbind; (bsc#1173994);
  (bso#14436);
- CVE-2020-14318: Missing handle permissions check in SMB1/2/3 ChangeNotify;
  (bsc#1173902); (bso#14434);</changelog>
  <changelog author="nopower@suse.com" date="1604577600">- Adjust smbcacls '--propagate-inheritance' feature to align with
  upstream; (bsc#1178469).</changelog>
  <changelog author="nopower@suse.com" date="1612440000">- Avoid free'ing our own pointer in memcache when memcache_trim
  attempts to reduce cache size; (bso#14625); (bnc#1179156).</changelog>
  <changelog author="nopower@suse.com" date="1615896000">-  CVE-2020-27840: samba: Unauthenticated remote heap corruption
  via bad DNs; (bso#14595); (bsc#1183572).
-  CVE-2021-20277: samba: out of bounds read in ldb_handler_fold;
  (bso#14655); (bsc#1183574).</changelog>
  <changelog author="dmulder@suse.com" date="1616760000">- s3-libads: use dns name to open a ldap session; (bso#13124);
  (bsc#1184310).</changelog>
  <changelog author="nopower@suse.com" date="1618401600">- CVE-2021-20254 Buffer overrun in sids_to_unixids();
  (bso#14571); (bsc#1184677).</changelog>
  <changelog author="scabrero@suse.de" date="1621598400">- s3-libads: Do not turn on canonicalization flag. Fixes a regression
  changing the computer account password; (bsc#1185089); (bso#14155);</changelog>
  <changelog author="scabrero@suse.de" date="1636372800">- CVE-2016-2124: Don't fallback to non spnego authentication if
  kerberos is required; (bsc#1014440); (bso#12444);
- CVE-2020-25717: A user in an AD Domain could become root on
  domain members; (bsc#1192284); (bso#14556);</changelog>
  <changelog author="nopower@suse.com" date="1637236800">- The username map [script] advice from CVE-2020-25717 advisory
  note has undesired side effects for the local nt token. Fallback
  to a SID/UID based mapping if the name based lookup fails;
  (bsc#1192849); (bso#14901).</changelog>
  <changelog author="nopower@suse.com" date="1642766400">- CVE-2021-44142: Out-of-Bound Read/Write on Samba vfs_fruit
  module; (bsc#1194859); (bso#14914).</changelog>
</package>
<package pkgid="866fe961ddce2120467f3d321985d05bd59a1a9e4ca16556b08fda2c76e5eee1" name="samba-python" arch="aarch64">
  <version epoch="0" ver="4.9.5+git.483.212a7ebca6b" rel="3.64.1"/>
  <changelog author="nopower@suse.com" date="1584705600">- Fix CLI tools still printing "Unable to initialize messaging
  context" messages; (bso#13925); (bsc#1167070).
- Do print mkdir failure message on error debug level when
  initializing messaging; (bso#13823); (bsc#1167070).</changelog>
  <changelog author="dmulder@suse.com" date="1586865600">- Fix spnego fallback from kerberos to ntlmssp in smbd server;
  (bso#14106); (bsc#1169473);</changelog>
  <changelog author="nopower@suse.com" date="1587556800">- CVE-2020-10704: samba: Stack overflow in AD DC (C)LDAP server;
  (bso#14334); (bsc#1169851).</changelog>
  <changelog author="scabrero@suse.de" date="1589457600">- Installing: samba - samba-ad-dc.service does not exist and unit
  not found; (bsc#1171437);</changelog>
  <changelog author="scabrero@suse.de" date="1591012800">- Add libnetapi-devel to baselibs conf, for wine usage; (bsc#1172307);</changelog>
  <changelog author="nopower@suse.com" date="1592827200">- CVE-2020-10730: NULL de-reference in AD DC LDAP server when ASQ
  and VLV combined; (bso#14364); (bsc#1173159].
- CVE-2020-10745: invalid DNS or NBT queries containing dots use
  several seconds of CPU each; (bso#14378); (bsc#1173160).
- CVE-2020-10760: Use-after-free in AD DC Global Catalog LDAP server
  with paged_result or VLV; (bso#14402); (bsc#1173161).</changelog>
  <changelog author="nopower@suse.com" date="1593086400">- CVE-2020-14303: Endless loop from empty UDP packet sent to AD DC
  nbt_server; (bso#14417); (bsc#1173359).</changelog>
  <changelog author="dmulder@suse.com" date="1594728000">- Fix net command unable to negotiate SMB2; (bsc#1174120);</changelog>
  <changelog author="scabrero@suse.de" date="1595851200">- Add obsoletes to libsmbldap2 package to fix upgrades from previous
  versions; (bsc#1172810);</changelog>
  <changelog author="scabrero@suse.de" date="1600430400">- CVE-2020-1472: Unauthenticated domain takeover via netlogon ("ZeroLogon").
  + s3:rpc_server/netlogon: Protect netr_ServerPasswordSet2 against
    unencrypted passwords; (bsc#1176579); (bso#14497);
  + s3:rpc_server/netlogon: Support "server require schannel:WORKSTATION$ = no"
    about unsecure configurations; (bsc#1176579); (bso#14497);
  + s4 torture rpc: repeated bytes in client challenge; (bsc#1176579);
    (bso#14497);
  + libcli/auth: Reject weak client challenges in netlogon_creds_server_init()
    "server require schannel:WORKSTATION$ = no"; (bsc#1176579); (bso#14497);</changelog>
  <changelog author="scabrero@suse.de" date="1602590400">- CVE-2020-14383: An authenticated user can crash the DCE/RPC DNS with
  easily crafted records; (bsc#1177613); (bso#14472);
- CVE-2020-14323: Unprivileged user can crash winbind; (bsc#1173994);
  (bso#14436);
- CVE-2020-14318: Missing handle permissions check in SMB1/2/3 ChangeNotify;
  (bsc#1173902); (bso#14434);</changelog>
  <changelog author="nopower@suse.com" date="1604577600">- Adjust smbcacls '--propagate-inheritance' feature to align with
  upstream; (bsc#1178469).</changelog>
  <changelog author="nopower@suse.com" date="1612440000">- Avoid free'ing our own pointer in memcache when memcache_trim
  attempts to reduce cache size; (bso#14625); (bnc#1179156).</changelog>
  <changelog author="nopower@suse.com" date="1615896000">-  CVE-2020-27840: samba: Unauthenticated remote heap corruption
  via bad DNs; (bso#14595); (bsc#1183572).
-  CVE-2021-20277: samba: out of bounds read in ldb_handler_fold;
  (bso#14655); (bsc#1183574).</changelog>
  <changelog author="dmulder@suse.com" date="1616760000">- s3-libads: use dns name to open a ldap session; (bso#13124);
  (bsc#1184310).</changelog>
  <changelog author="nopower@suse.com" date="1618401600">- CVE-2021-20254 Buffer overrun in sids_to_unixids();
  (bso#14571); (bsc#1184677).</changelog>
  <changelog author="scabrero@suse.de" date="1621598400">- s3-libads: Do not turn on canonicalization flag. Fixes a regression
  changing the computer account password; (bsc#1185089); (bso#14155);</changelog>
  <changelog author="scabrero@suse.de" date="1636372800">- CVE-2016-2124: Don't fallback to non spnego authentication if
  kerberos is required; (bsc#1014440); (bso#12444);
- CVE-2020-25717: A user in an AD Domain could become root on
  domain members; (bsc#1192284); (bso#14556);</changelog>
  <changelog author="nopower@suse.com" date="1637236800">- The username map [script] advice from CVE-2020-25717 advisory
  note has undesired side effects for the local nt token. Fallback
  to a SID/UID based mapping if the name based lookup fails;
  (bsc#1192849); (bso#14901).</changelog>
  <changelog author="nopower@suse.com" date="1642766400">- CVE-2021-44142: Out-of-Bound Read/Write on Samba vfs_fruit
  module; (bsc#1194859); (bso#14914).</changelog>
</package>
<package pkgid="5804ae0535d5ef9d1c38b2dce72f206780a220d74446ddcab70b867a74bcadb9" name="samba-python" arch="ppc64le">
  <version epoch="0" ver="4.9.5+git.483.212a7ebca6b" rel="3.64.1"/>
  <changelog author="nopower@suse.com" date="1584705600">- Fix CLI tools still printing "Unable to initialize messaging
  context" messages; (bso#13925); (bsc#1167070).
- Do print mkdir failure message on error debug level when
  initializing messaging; (bso#13823); (bsc#1167070).</changelog>
  <changelog author="dmulder@suse.com" date="1586865600">- Fix spnego fallback from kerberos to ntlmssp in smbd server;
  (bso#14106); (bsc#1169473);</changelog>
  <changelog author="nopower@suse.com" date="1587556800">- CVE-2020-10704: samba: Stack overflow in AD DC (C)LDAP server;
  (bso#14334); (bsc#1169851).</changelog>
  <changelog author="scabrero@suse.de" date="1589457600">- Installing: samba - samba-ad-dc.service does not exist and unit
  not found; (bsc#1171437);</changelog>
  <changelog author="scabrero@suse.de" date="1591012800">- Add libnetapi-devel to baselibs conf, for wine usage; (bsc#1172307);</changelog>
  <changelog author="nopower@suse.com" date="1592827200">- CVE-2020-10730: NULL de-reference in AD DC LDAP server when ASQ
  and VLV combined; (bso#14364); (bsc#1173159].
- CVE-2020-10745: invalid DNS or NBT queries containing dots use
  several seconds of CPU each; (bso#14378); (bsc#1173160).
- CVE-2020-10760: Use-after-free in AD DC Global Catalog LDAP server
  with paged_result or VLV; (bso#14402); (bsc#1173161).</changelog>
  <changelog author="nopower@suse.com" date="1593086400">- CVE-2020-14303: Endless loop from empty UDP packet sent to AD DC
  nbt_server; (bso#14417); (bsc#1173359).</changelog>
  <changelog author="dmulder@suse.com" date="1594728000">- Fix net command unable to negotiate SMB2; (bsc#1174120);</changelog>
  <changelog author="scabrero@suse.de" date="1595851200">- Add obsoletes to libsmbldap2 package to fix upgrades from previous
  versions; (bsc#1172810);</changelog>
  <changelog author="scabrero@suse.de" date="1600430400">- CVE-2020-1472: Unauthenticated domain takeover via netlogon ("ZeroLogon").
  + s3:rpc_server/netlogon: Protect netr_ServerPasswordSet2 against
    unencrypted passwords; (bsc#1176579); (bso#14497);
  + s3:rpc_server/netlogon: Support "server require schannel:WORKSTATION$ = no"
    about unsecure configurations; (bsc#1176579); (bso#14497);
  + s4 torture rpc: repeated bytes in client challenge; (bsc#1176579);
    (bso#14497);
  + libcli/auth: Reject weak client challenges in netlogon_creds_server_init()
    "server require schannel:WORKSTATION$ = no"; (bsc#1176579); (bso#14497);</changelog>
  <changelog author="scabrero@suse.de" date="1602590400">- CVE-2020-14383: An authenticated user can crash the DCE/RPC DNS with
  easily crafted records; (bsc#1177613); (bso#14472);
- CVE-2020-14323: Unprivileged user can crash winbind; (bsc#1173994);
  (bso#14436);
- CVE-2020-14318: Missing handle permissions check in SMB1/2/3 ChangeNotify;
  (bsc#1173902); (bso#14434);</changelog>
  <changelog author="nopower@suse.com" date="1604577600">- Adjust smbcacls '--propagate-inheritance' feature to align with
  upstream; (bsc#1178469).</changelog>
  <changelog author="nopower@suse.com" date="1612440000">- Avoid free'ing our own pointer in memcache when memcache_trim
  attempts to reduce cache size; (bso#14625); (bnc#1179156).</changelog>
  <changelog author="nopower@suse.com" date="1615896000">-  CVE-2020-27840: samba: Unauthenticated remote heap corruption
  via bad DNs; (bso#14595); (bsc#1183572).
-  CVE-2021-20277: samba: out of bounds read in ldb_handler_fold;
  (bso#14655); (bsc#1183574).</changelog>
  <changelog author="dmulder@suse.com" date="1616760000">- s3-libads: use dns name to open a ldap session; (bso#13124);
  (bsc#1184310).</changelog>
  <changelog author="nopower@suse.com" date="1618401600">- CVE-2021-20254 Buffer overrun in sids_to_unixids();
  (bso#14571); (bsc#1184677).</changelog>
  <changelog author="scabrero@suse.de" date="1621598400">- s3-libads: Do not turn on canonicalization flag. Fixes a regression
  changing the computer account password; (bsc#1185089); (bso#14155);</changelog>
  <changelog author="scabrero@suse.de" date="1636372800">- CVE-2016-2124: Don't fallback to non spnego authentication if
  kerberos is required; (bsc#1014440); (bso#12444);
- CVE-2020-25717: A user in an AD Domain could become root on
  domain members; (bsc#1192284); (bso#14556);</changelog>
  <changelog author="nopower@suse.com" date="1637236800">- The username map [script] advice from CVE-2020-25717 advisory
  note has undesired side effects for the local nt token. Fallback
  to a SID/UID based mapping if the name based lookup fails;
  (bsc#1192849); (bso#14901).</changelog>
  <changelog author="nopower@suse.com" date="1642766400">- CVE-2021-44142: Out-of-Bound Read/Write on Samba vfs_fruit
  module; (bsc#1194859); (bso#14914).</changelog>
</package>
<package pkgid="0dec6667444ad1f71a46bd487a6205ed055514d961ca6eec3523aaad47e1c755" name="samba-python" arch="s390x">
  <version epoch="0" ver="4.9.5+git.483.212a7ebca6b" rel="3.64.1"/>
  <changelog author="nopower@suse.com" date="1584705600">- Fix CLI tools still printing "Unable to initialize messaging
  context" messages; (bso#13925); (bsc#1167070).
- Do print mkdir failure message on error debug level when
  initializing messaging; (bso#13823); (bsc#1167070).</changelog>
  <changelog author="dmulder@suse.com" date="1586865600">- Fix spnego fallback from kerberos to ntlmssp in smbd server;
  (bso#14106); (bsc#1169473);</changelog>
  <changelog author="nopower@suse.com" date="1587556800">- CVE-2020-10704: samba: Stack overflow in AD DC (C)LDAP server;
  (bso#14334); (bsc#1169851).</changelog>
  <changelog author="scabrero@suse.de" date="1589457600">- Installing: samba - samba-ad-dc.service does not exist and unit
  not found; (bsc#1171437);</changelog>
  <changelog author="scabrero@suse.de" date="1591012800">- Add libnetapi-devel to baselibs conf, for wine usage; (bsc#1172307);</changelog>
  <changelog author="nopower@suse.com" date="1592827200">- CVE-2020-10730: NULL de-reference in AD DC LDAP server when ASQ
  and VLV combined; (bso#14364); (bsc#1173159].
- CVE-2020-10745: invalid DNS or NBT queries containing dots use
  several seconds of CPU each; (bso#14378); (bsc#1173160).
- CVE-2020-10760: Use-after-free in AD DC Global Catalog LDAP server
  with paged_result or VLV; (bso#14402); (bsc#1173161).</changelog>
  <changelog author="nopower@suse.com" date="1593086400">- CVE-2020-14303: Endless loop from empty UDP packet sent to AD DC
  nbt_server; (bso#14417); (bsc#1173359).</changelog>
  <changelog author="dmulder@suse.com" date="1594728000">- Fix net command unable to negotiate SMB2; (bsc#1174120);</changelog>
  <changelog author="scabrero@suse.de" date="1595851200">- Add obsoletes to libsmbldap2 package to fix upgrades from previous
  versions; (bsc#1172810);</changelog>
  <changelog author="scabrero@suse.de" date="1600430400">- CVE-2020-1472: Unauthenticated domain takeover via netlogon ("ZeroLogon").
  + s3:rpc_server/netlogon: Protect netr_ServerPasswordSet2 against
    unencrypted passwords; (bsc#1176579); (bso#14497);
  + s3:rpc_server/netlogon: Support "server require schannel:WORKSTATION$ = no"
    about unsecure configurations; (bsc#1176579); (bso#14497);
  + s4 torture rpc: repeated bytes in client challenge; (bsc#1176579);
    (bso#14497);
  + libcli/auth: Reject weak client challenges in netlogon_creds_server_init()
    "server require schannel:WORKSTATION$ = no"; (bsc#1176579); (bso#14497);</changelog>
  <changelog author="scabrero@suse.de" date="1602590400">- CVE-2020-14383: An authenticated user can crash the DCE/RPC DNS with
  easily crafted records; (bsc#1177613); (bso#14472);
- CVE-2020-14323: Unprivileged user can crash winbind; (bsc#1173994);
  (bso#14436);
- CVE-2020-14318: Missing handle permissions check in SMB1/2/3 ChangeNotify;
  (bsc#1173902); (bso#14434);</changelog>
  <changelog author="nopower@suse.com" date="1604577600">- Adjust smbcacls '--propagate-inheritance' feature to align with
  upstream; (bsc#1178469).</changelog>
  <changelog author="nopower@suse.com" date="1612440000">- Avoid free'ing our own pointer in memcache when memcache_trim
  attempts to reduce cache size; (bso#14625); (bnc#1179156).</changelog>
  <changelog author="nopower@suse.com" date="1615896000">-  CVE-2020-27840: samba: Unauthenticated remote heap corruption
  via bad DNs; (bso#14595); (bsc#1183572).
-  CVE-2021-20277: samba: out of bounds read in ldb_handler_fold;
  (bso#14655); (bsc#1183574).</changelog>
  <changelog author="dmulder@suse.com" date="1616760000">- s3-libads: use dns name to open a ldap session; (bso#13124);
  (bsc#1184310).</changelog>
  <changelog author="nopower@suse.com" date="1618401600">- CVE-2021-20254 Buffer overrun in sids_to_unixids();
  (bso#14571); (bsc#1184677).</changelog>
  <changelog author="scabrero@suse.de" date="1621598400">- s3-libads: Do not turn on canonicalization flag. Fixes a regression
  changing the computer account password; (bsc#1185089); (bso#14155);</changelog>
  <changelog author="scabrero@suse.de" date="1636372800">- CVE-2016-2124: Don't fallback to non spnego authentication if
  kerberos is required; (bsc#1014440); (bso#12444);
- CVE-2020-25717: A user in an AD Domain could become root on
  domain members; (bsc#1192284); (bso#14556);</changelog>
  <changelog author="nopower@suse.com" date="1637236800">- The username map [script] advice from CVE-2020-25717 advisory
  note has undesired side effects for the local nt token. Fallback
  to a SID/UID based mapping if the name based lookup fails;
  (bsc#1192849); (bso#14901).</changelog>
  <changelog author="nopower@suse.com" date="1642766400">- CVE-2021-44142: Out-of-Bound Read/Write on Samba vfs_fruit
  module; (bsc#1194859); (bso#14914).</changelog>
</package>
<package pkgid="e714fc4a0d46d4d152ad4db5ff8e9c0e3e6e8c11b0d2aab1715159360de6fa69" name="samba-python" arch="x86_64">
  <version epoch="0" ver="4.9.5+git.483.212a7ebca6b" rel="3.64.1"/>
  <changelog author="nopower@suse.com" date="1584705600">- Fix CLI tools still printing "Unable to initialize messaging
  context" messages; (bso#13925); (bsc#1167070).
- Do print mkdir failure message on error debug level when
  initializing messaging; (bso#13823); (bsc#1167070).</changelog>
  <changelog author="dmulder@suse.com" date="1586865600">- Fix spnego fallback from kerberos to ntlmssp in smbd server;
  (bso#14106); (bsc#1169473);</changelog>
  <changelog author="nopower@suse.com" date="1587556800">- CVE-2020-10704: samba: Stack overflow in AD DC (C)LDAP server;
  (bso#14334); (bsc#1169851).</changelog>
  <changelog author="scabrero@suse.de" date="1589457600">- Installing: samba - samba-ad-dc.service does not exist and unit
  not found; (bsc#1171437);</changelog>
  <changelog author="scabrero@suse.de" date="1591012800">- Add libnetapi-devel to baselibs conf, for wine usage; (bsc#1172307);</changelog>
  <changelog author="nopower@suse.com" date="1592827200">- CVE-2020-10730: NULL de-reference in AD DC LDAP server when ASQ
  and VLV combined; (bso#14364); (bsc#1173159].
- CVE-2020-10745: invalid DNS or NBT queries containing dots use
  several seconds of CPU each; (bso#14378); (bsc#1173160).
- CVE-2020-10760: Use-after-free in AD DC Global Catalog LDAP server
  with paged_result or VLV; (bso#14402); (bsc#1173161).</changelog>
  <changelog author="nopower@suse.com" date="1593086400">- CVE-2020-14303: Endless loop from empty UDP packet sent to AD DC
  nbt_server; (bso#14417); (bsc#1173359).</changelog>
  <changelog author="dmulder@suse.com" date="1594728000">- Fix net command unable to negotiate SMB2; (bsc#1174120);</changelog>
  <changelog author="scabrero@suse.de" date="1595851200">- Add obsoletes to libsmbldap2 package to fix upgrades from previous
  versions; (bsc#1172810);</changelog>
  <changelog author="scabrero@suse.de" date="1600430400">- CVE-2020-1472: Unauthenticated domain takeover via netlogon ("ZeroLogon").
  + s3:rpc_server/netlogon: Protect netr_ServerPasswordSet2 against
    unencrypted passwords; (bsc#1176579); (bso#14497);
  + s3:rpc_server/netlogon: Support "server require schannel:WORKSTATION$ = no"
    about unsecure configurations; (bsc#1176579); (bso#14497);
  + s4 torture rpc: repeated bytes in client challenge; (bsc#1176579);
    (bso#14497);
  + libcli/auth: Reject weak client challenges in netlogon_creds_server_init()
    "server require schannel:WORKSTATION$ = no"; (bsc#1176579); (bso#14497);</changelog>
  <changelog author="scabrero@suse.de" date="1602590400">- CVE-2020-14383: An authenticated user can crash the DCE/RPC DNS with
  easily crafted records; (bsc#1177613); (bso#14472);
- CVE-2020-14323: Unprivileged user can crash winbind; (bsc#1173994);
  (bso#14436);
- CVE-2020-14318: Missing handle permissions check in SMB1/2/3 ChangeNotify;
  (bsc#1173902); (bso#14434);</changelog>
  <changelog author="nopower@suse.com" date="1604577600">- Adjust smbcacls '--propagate-inheritance' feature to align with
  upstream; (bsc#1178469).</changelog>
  <changelog author="nopower@suse.com" date="1612440000">- Avoid free'ing our own pointer in memcache when memcache_trim
  attempts to reduce cache size; (bso#14625); (bnc#1179156).</changelog>
  <changelog author="nopower@suse.com" date="1615896000">-  CVE-2020-27840: samba: Unauthenticated remote heap corruption
  via bad DNs; (bso#14595); (bsc#1183572).
-  CVE-2021-20277: samba: out of bounds read in ldb_handler_fold;
  (bso#14655); (bsc#1183574).</changelog>
  <changelog author="dmulder@suse.com" date="1616760000">- s3-libads: use dns name to open a ldap session; (bso#13124);
  (bsc#1184310).</changelog>
  <changelog author="nopower@suse.com" date="1618401600">- CVE-2021-20254 Buffer overrun in sids_to_unixids();
  (bso#14571); (bsc#1184677).</changelog>
  <changelog author="scabrero@suse.de" date="1621598400">- s3-libads: Do not turn on canonicalization flag. Fixes a regression
  changing the computer account password; (bsc#1185089); (bso#14155);</changelog>
  <changelog author="scabrero@suse.de" date="1636372800">- CVE-2016-2124: Don't fallback to non spnego authentication if
  kerberos is required; (bsc#1014440); (bso#12444);
- CVE-2020-25717: A user in an AD Domain could become root on
  domain members; (bsc#1192284); (bso#14556);</changelog>
  <changelog author="nopower@suse.com" date="1637236800">- The username map [script] advice from CVE-2020-25717 advisory
  note has undesired side effects for the local nt token. Fallback
  to a SID/UID based mapping if the name based lookup fails;
  (bsc#1192849); (bso#14901).</changelog>
  <changelog author="nopower@suse.com" date="1642766400">- CVE-2021-44142: Out-of-Bound Read/Write on Samba vfs_fruit
  module; (bsc#1194859); (bso#14914).</changelog>
</package>
<package pkgid="999e76c8d51c74e15df6403d825d23c7b70d402fb4e602b98431f985ecad855c" name="spacecmd" arch="noarch">
  <version epoch="0" ver="4.2.15" rel="3.74.1"/>
  <changelog author="jgonzalez@suse.com" date="1574856000">- version 4.1.1-1
- Bump version to 4.1.0 (bsc#1154940)
- Prevent error when piping stdout in Python 2 (bsc#1153090)
- Java api expects content as encoded string instead of encoded bytes like before (bsc#1153277)
- Enable building and installing for Ubuntu 16.04 and Ubuntu 18.04
- Fix building and installing on CentOS8/RES8/RHEL8
- Check that a channel doesn't have clones before deleting it (bsc#1138454)
- Add unit test for schedule, errata, user, utils, misc, configchannel
  and kickstart modules
- Multiple minor bugfixes alongside the unit tests
- Fix missing runtime dependencies that made spacecmd return old versions of
  packages in some cases, even if newer ones were available (bsc#1148311)</changelog>
  <changelog author="jgonzalez@suse.com" date="1580385600">- version 4.1.2-1
- Bugfix: attempt to purge SSM when it is empty (bsc#1155372)</changelog>
  <changelog author="jgonzalez@suse.com" date="1581940800">- version 4.1.3-1
- disable globbing for api subcommand to allow wildcards in filter
  settings (bsc#1163871)</changelog>
  <changelog author="jgonzalez@suse.com" date="1591790400">- version 4.1.4-1
- only report real error, not result (bsc#1171687)
- use defined return values for spacecmd methods so scripts can
  check for failure (bsc#1171687)</changelog>
  <changelog author="jgonzalez@suse.com" date="1595505600">- version 4.1.5-1
- fix escaping of package names (bsc#1171281)</changelog>
  <changelog author="jgonzalez@suse.com" date="1600430400">- version 4.2.1-1
- Fix softwarechannel_listlatestpackages throwing error on
  empty channels (bsc#1175889)
- Add Service Pack migration operations (bsc#1173557)
- Fix softwarechannel update for vendor channels (bsc#1172709)
- Update package version to 4.2.0</changelog>
  <changelog author="jgonzalez@suse.com" date="1606305600">- version 4.2.2-1
- Fix: make spacecmd build on Debian
- Python3 fixes for errata in spacecmd (bsc#1169664)
- Added support for i18n of user-facing strings
- Python3 fix for sorted usage (bsc#1167907)</changelog>
  <changelog author="jgonzalez@suse.com" date="1606996800">- version 4.2.3-1
- Update translations</changelog>
  <changelog author="jgonzalez@suse.com" date="1611748800">- version 4.2.4-1
- Fix spacecmd with no parameters produces traceback
  on SLE 11 SP4 (bsc#1176823)
- Fixed "non-advanced" package search when using multiple package names (bsc#1180584)
- Added '-r REVISION' option to the 'configchannel_updateinitsls' command (bsc#1179566)
- Fix: internal: workaround for future tee of logs translation</changelog>
  <changelog author="jgonzalez@suse.com" date="1613131200">- version 4.2.5-1
- Deprecated "Software Crashes" feature
- Document advanced package search on '--help' (bsc#1180583)
- Fixed advanced search on 'package_listinstalledsystems'
- Fixed duplicate results when using multiple search criteria (bsc#1180585)</changelog>
  <changelog author="jgonzalez@suse.com" date="1618574400">- version 4.2.6-1
- Add group_addconfigchannel and group_removeconfigchannel
- Add group_listconfigchannels and configchannel_listgroups
- Handle SIGPIPE without user-visible Exception (bsc#1181124)
- Fix spacecmd compat with Python 3</changelog>
  <changelog author="jgonzalez@suse.com" date="1618833600">- version 4.2.7-1
- Update translation strings</changelog>
  <changelog author="jgonzalez@suse.com" date="1620216000">- version 4.2.8-1
- Rename system migration to system transfer
- Rename SP to product migration</changelog>
  <changelog author="jgonzalez@suse.com" date="1621857600">- version 4.2.9-1
- Parse empty argument when nothing in between the separator</changelog>
  <changelog author="jgonzalez@suse.com" date="1622548800">- version 4.2.10-1
- enhance help for installation types when creating distributions (bsc#1186581)</changelog>
  <changelog author="jgonzalez@suse.com" date="1626436800">- version 4.2.11-1
- make spacecmd aware of retracted patches/packages</changelog>
  <changelog author="jmassaguerpla@suse.de" date="1630324800">- version 4.2.12-1
- Update translation strings
- Make schedule_deletearchived to get all actions without display limit
- Allow passing a date limit for schedule_deletearchived on spacecmd (bsc#1181223)
- Use correct API endpoint in list_proxies (bsc#1188042)
- Add schedule_deletearchived to bulk delete archived actions (bsc#1181223)</changelog>
  <changelog author="jgonzalez@suse.com" date="1633521600">- version 4.2.13-1
  * Update translation strings
  * configchannel_updatefile handles directory properly (bsc#1190512)
  * Add schedule_archivecompleted to mass archive actions (bsc#1181223)
  * Remove whoami from the list of unauthenticated commands (bsc#1188977)</changelog>
  <changelog author="jmassaguerpla@suse.de" date="1637150400">- version 4.2.14-1
  * Update translation strings</changelog>
  <changelog author="jmassaguerpla@suse.de" date="1643803200">- version 4.2.15-1
  * require python macros for building</changelog>
</package>
<package pkgid="a2f85be2ff69819ed70437946c86235b783c8d70129d9be2ed6bc4b0fd1fa171" name="spacecmd" arch="src">
  <version epoch="0" ver="4.2.15" rel="3.74.1"/>
  <changelog author="jgonzalez@suse.com" date="1574856000">- version 4.1.1-1
- Bump version to 4.1.0 (bsc#1154940)
- Prevent error when piping stdout in Python 2 (bsc#1153090)
- Java api expects content as encoded string instead of encoded bytes like before (bsc#1153277)
- Enable building and installing for Ubuntu 16.04 and Ubuntu 18.04
- Fix building and installing on CentOS8/RES8/RHEL8
- Check that a channel doesn't have clones before deleting it (bsc#1138454)
- Add unit test for schedule, errata, user, utils, misc, configchannel
  and kickstart modules
- Multiple minor bugfixes alongside the unit tests
- Fix missing runtime dependencies that made spacecmd return old versions of
  packages in some cases, even if newer ones were available (bsc#1148311)</changelog>
  <changelog author="jgonzalez@suse.com" date="1580385600">- version 4.1.2-1
- Bugfix: attempt to purge SSM when it is empty (bsc#1155372)</changelog>
  <changelog author="jgonzalez@suse.com" date="1581940800">- version 4.1.3-1
- disable globbing for api subcommand to allow wildcards in filter
  settings (bsc#1163871)</changelog>
  <changelog author="jgonzalez@suse.com" date="1591790400">- version 4.1.4-1
- only report real error, not result (bsc#1171687)
- use defined return values for spacecmd methods so scripts can
  check for failure (bsc#1171687)</changelog>
  <changelog author="jgonzalez@suse.com" date="1595505600">- version 4.1.5-1
- fix escaping of package names (bsc#1171281)</changelog>
  <changelog author="jgonzalez@suse.com" date="1600430400">- version 4.2.1-1
- Fix softwarechannel_listlatestpackages throwing error on
  empty channels (bsc#1175889)
- Add Service Pack migration operations (bsc#1173557)
- Fix softwarechannel update for vendor channels (bsc#1172709)
- Update package version to 4.2.0</changelog>
  <changelog author="jgonzalez@suse.com" date="1606305600">- version 4.2.2-1
- Fix: make spacecmd build on Debian
- Python3 fixes for errata in spacecmd (bsc#1169664)
- Added support for i18n of user-facing strings
- Python3 fix for sorted usage (bsc#1167907)</changelog>
  <changelog author="jgonzalez@suse.com" date="1606996800">- version 4.2.3-1
- Update translations</changelog>
  <changelog author="jgonzalez@suse.com" date="1611748800">- version 4.2.4-1
- Fix spacecmd with no parameters produces traceback
  on SLE 11 SP4 (bsc#1176823)
- Fixed "non-advanced" package search when using multiple package names (bsc#1180584)
- Added '-r REVISION' option to the 'configchannel_updateinitsls' command (bsc#1179566)
- Fix: internal: workaround for future tee of logs translation</changelog>
  <changelog author="jgonzalez@suse.com" date="1613131200">- version 4.2.5-1
- Deprecated "Software Crashes" feature
- Document advanced package search on '--help' (bsc#1180583)
- Fixed advanced search on 'package_listinstalledsystems'
- Fixed duplicate results when using multiple search criteria (bsc#1180585)</changelog>
  <changelog author="jgonzalez@suse.com" date="1618574400">- version 4.2.6-1
- Add group_addconfigchannel and group_removeconfigchannel
- Add group_listconfigchannels and configchannel_listgroups
- Handle SIGPIPE without user-visible Exception (bsc#1181124)
- Fix spacecmd compat with Python 3</changelog>
  <changelog author="jgonzalez@suse.com" date="1618833600">- version 4.2.7-1
- Update translation strings</changelog>
  <changelog author="jgonzalez@suse.com" date="1620216000">- version 4.2.8-1
- Rename system migration to system transfer
- Rename SP to product migration</changelog>
  <changelog author="jgonzalez@suse.com" date="1621857600">- version 4.2.9-1
- Parse empty argument when nothing in between the separator</changelog>
  <changelog author="jgonzalez@suse.com" date="1622548800">- version 4.2.10-1
- enhance help for installation types when creating distributions (bsc#1186581)</changelog>
  <changelog author="jgonzalez@suse.com" date="1626436800">- version 4.2.11-1
- make spacecmd aware of retracted patches/packages</changelog>
  <changelog author="jmassaguerpla@suse.de" date="1630324800">- version 4.2.12-1
- Update translation strings
- Make schedule_deletearchived to get all actions without display limit
- Allow passing a date limit for schedule_deletearchived on spacecmd (bsc#1181223)
- Use correct API endpoint in list_proxies (bsc#1188042)
- Add schedule_deletearchived to bulk delete archived actions (bsc#1181223)</changelog>
  <changelog author="jgonzalez@suse.com" date="1633521600">- version 4.2.13-1
  * Update translation strings
  * configchannel_updatefile handles directory properly (bsc#1190512)
  * Add schedule_archivecompleted to mass archive actions (bsc#1181223)
  * Remove whoami from the list of unauthenticated commands (bsc#1188977)</changelog>
  <changelog author="jmassaguerpla@suse.de" date="1637150400">- version 4.2.14-1
  * Update translation strings</changelog>
  <changelog author="jmassaguerpla@suse.de" date="1643803200">- version 4.2.15-1
  * require python macros for building</changelog>
</package>
<package pkgid="fe68befad1cf046b516dd402017f489ddebc6bb11681c0672f8113c02d47b96e" name="strongswan" arch="aarch64">
  <version epoch="0" ver="5.8.2" rel="11.24.1"/>
  <changelog author="ndas@suse.de" date="1501502400">- Updated to strongSwan 5.3.5(bsc#1050691) providing the following changes:
  * Fixed a DoS vulnerability in the gmp plugin that was caused by insufficient input
    validation when verifying RSA signatures. More specifically, mpz_powm_sec() has two
    requirements regarding the passed exponent and modulus that the plugin did not
    enforce, if these are not met the calculation will result in a floating point exception
    that crashes the whole process.
    This vulnerability has been registered as CVE-2017-9022.
    Please refer to our blog for details.
  * Fixed a DoS vulnerability in the x509 plugin that was caused because the ASN.1 parser
    didn't handle ASN.1 CHOICE types properly, which could result in an infinite loop when
    parsing X.509 extensions that use such types.
    This vulnerability has been registered as CVE-2017-9023.
    Please refer to our blog for details.
  * The behavior during IKEv2 CHILD_SA rekeying has been changed in order to avoid
    traffic loss. When responding to a CREATE_CHILD_SA request to rekey a CHILD_SA
    the responder already has everything available to install and use the new CHILD_SA.
    However, this could lead to lost traffic as the initiator won't be able to process
    inbound packets until it processed the CREATE_CHILD_SA response and updated the
    inbound SA. To avoid this the responder now only installs the new inbound SA and
    delays installing the outbound SA until it receives the DELETE for the replaced CHILD_SA.
  * The messages transporting these DELETEs could reach the peer before packets sent
    with the deleted outbound SAs reach it. To reduce the chance of traffic loss due
    to this the inbound SA of the replaced CHILD_SA is not removed for a configurable
    amount of seconds (charon.delete_rekeyed_delay) after the DELETE has been processed.
  * The code base has been ported to Apple's ARM64 iOS platform, which required several
    changes regarding the use of variadic functions. This was necessary because the calling
    conventions for variadic and regular functions are different there.
    This means that assigning a non-variadic function to a variadic function pointer, as we
    did with our enumerator_t::enumerate() implementations and several callbacks, will
    result in crashes as the called function accesses the arguments differently than the
    caller provided them. To avoid this issue the enumerator_t interface has been changed
    and the signature of the callback functions for enumerator_create_filter() and two
    methods on linked_list_t have been changed. Refer to the developer notes below
    for details.
  * Adds support for fuzzing the certificate parser provided by the default plugins
    (x509, pem, gmp etc.) on Google's OSS-Fuzz infrastructure (or generally with
    libFuzzer). Several issues found while fuzzing these plugins were fixed.
  * Two new options have been added to charon's retransmission settings:
    retransmit_limit and retransmit_jitter. The former adds an upper limit to the
    calculated retransmission timeout, the latter randomly reduces it.
    Refer to Retransmission for details.
  * A bug in swanctl's --load-creds command was fixed that caused unencrypted
    private keys to get unloaded if the command was called multiple times.
    The load-key VICI command now returns the key ID of the loaded key on success.
  * The credential manager now enumerates local credential sets before global ones.
    This means certificates supplied by the peer will now be preferred over certificates
    with the same identity that may be locally stored (e.g. in the certificate cache).
  * Adds support for hardware offload of IPsec SAs as introduced by Linux 4.11 for
    specific hardware that supports this.
  * The pki tool loads the curve25519 plugin by default.
    [- 0006-Make-sure-the-modulus-is-odd-and-the-exponent-not-zero.patch,
  - 0007-asn1-parser-Fix-CHOICE-parsing.patch]
- libhydra is removed as all kernel plugins moved to libcharon</changelog>
  <changelog author="ndas@suse.de" date="1504612800">- fix "uintptr_t? undeclared" compilation error.
  [+0006-fix-compilation-error-by-adding-stdint.h.patch]</changelog>
  <changelog author="ndas@suse.de" date="1504612801">- Updated to strongSwan 5.6.0 providing the following changes:
  * Fixed a DoS vulnerability in the gmp plugin that was caused by insufficient input validation
    when verifying RSA signatures, which requires decryption with the operation m^e mod n,
    where m is the signature, and e and n are the exponent and modulus of the public key.
    The value m is an integer between 0 and n-1, however, the gmp plugin did not verify this.
    So if m equals n the calculation results in 0, in which case mpz_export() returns NULL.
    This result wasn't handled properly causing a null-pointer dereference.
    This vulnerability has been registered as CVE-2017-11185. (bsc#1051222)
  * New SWIMA IMC/IMV pair implements the draft-ietf-sacm-nea-swima-patnc Internet
    Draft and has been demonstrated at the IETF 99 Prague Hackathon.
  * The IMV database template has been adapted to achieve full compliance with the
    ISO 19770-2:2015 SWID tag standard.
  * The pt-tls-client can attach and use TPM 2.0 protected private keys via the --keyid parameter.
  * By default the /etc/swanctl/conf.d directory is created and *.conf files in it are included in the default
    swanctl.conf file.
  * The curl plugin now follows HTTP redirects (configurable via strongswan.conf).
  * The CHILD_SA rekeying was fixed in charon-tkm and the behavior is refined a bit more since 5.5.3
  * libtpmtss supports Intel's TSS2 Architecture Broker and Resource Manager interface (tcti-tabrmd).
  * more on https://wiki.strongswan.org/versions/66</changelog>
  <changelog author="mmnelemane@suse.com" date="1521028800">- Removed unused requires and macro calls(bsc#1083261)</changelog>
  <changelog author="mmnelemane@suse.com" date="1573646400">- Added patch to fix vulnerability: CVE-2018-16151,CVE-2018-16152 (bsc#1107874)
  - Insufficient input validation in gmp plugin
  [+ 0007-strongswan-5.3.1-5.6.0_gmp-pkcs1-verify.patch]</changelog>
  <changelog author="mmnelemane@suse.com" date="1573646401">- Added patch to fix vulnerability: CVE-2018-5388 (bsc#1094462)
  - Buffer Underflow in stroke_socket.c
  [+ 0008-strongswan-5.1.2-5.6.2_stroke_msg_len.patch]</changelog>
  <changelog author="mmnelemane@suse.com" date="1573646402">- Added patch to fix vulnerability: CVE-2018-10811 (bsc#1093536)
  - denial-of-service vulnerability
  [+ 0009-strongswan-5.5.0-5.6.2_skeyseed_init.patch]</changelog>
  <changelog author="mmnelemane@suse.com" date="1573732800">- Added patch to fix vulnerability: CVE-2018-17540 (bsc#1109845)
  [+ 0010-strongswan-4.4.0-5.7.0_gmp-pkcs1-overflow.patch]</changelog>
  <changelog author="mmnelemane@suse.com" date="1580212800">- Updated to version 5.8.2 (jsc#SLE-11370)
  - Dropped following patches due to irrelevance in the updated version:
    [- strongswan_modprobe_syslog.patch ]
    [- strongswan_fipsfilter.patch ]
    [- 0006-fix-compilation-error-by-adding-stdint.h.patch ]
    [- 0007-strongswan-5.3.1-5.6.0_gmp-pkcs1-verify.patch ]
    [- 0008-strongswan-5.1.2-5.6.2_stroke_msg_len.patch ]
    [- 0009-strongswan-5.5.0-5.6.2_skeyseed_init.patch ]
    [- 0010-strongswan-4.4.0-5.7.0_gmp-pkcs1-overflow.patch ]
  - Version 5.8.2
  ===============
  * Identity-based CA constraints, which enforce that the certificate chain of the remote
    peer contains a CA certificate with a specific identity, are supported via
    vici/swanctl.conf. This is similar to the existing CA constraints but doesn't require
    that the CA certificate is locally installed, for instance, intermediate CA certificates
    received from the peers. Wildcard identity matching (e.g. ..., OU=Research, CN=*) could
    also be used for the latter but requires trust in the intermediate CAs to only issue
    certificates with legitimate subject DNs (e.g. the "Sales" CA must not issue certificates
    with OU=Research). With the new constraint that's not necessary as long as a path length
    basic constraint (--pathlen for pki --issue) prevents intermediate CAs from issuing further
    intermediate CAs.
  * Intermediate CA certificates may now be sent in hash-and-URL encoding by configuring a
    base URL for the parent CA (#3234, swanctl/rw-hash-and-url-multi-level).
  * Implemented NIST SP-800-90A Deterministic Random Bit Generator (DRBG) based on AES-CTR
    and SHA2-HMAC modes. Currently used by the gmp and ntru plugins.
  * Random nonces sent in an OCSP requests are now expected in the corresponding OCSP responses.
  * The kernel-netlink plugin now ignores deprecated IPv6 addresses for MOBIKE. Whether temporary
    or permanent IPv6 addresses are included now depends on the charon.prefer_temporary_addrs
    setting (#3192).
  * Extended Sequence Numbers (ESN) are configured via PF_KEY if supported by the kernel.
  * The PF_KEY socket's receive buffer in the kernel-pfkey plugin is now cleared before sending
    requests, as many of the messages sent by the kernel are sent as broadcasts to all PF_KEY
    sockets. This is an issue if an external tool is used to manage SAs/policies unrelated to
    IPsec (#3225).
  * The vici plugin now uses unique section names for CHILD_SAs in child-updown events (7c74ce9190).
  * For individually deleted CHILD_SAs (in particular for IKEv1) the vici child-updown event
    now includes more information about the CHILD_SAs such as traffic statistics (#3198).
  * Custom loggers are correctly re-registered if log levels are changed via stroke loglevel (#3182).
  * Avoid lockups during startup on low entropy systems when using OpenSSL 1.1.1 (095a2c2eac).
  * Instead of failing later when setting a key, creating HMACs via openssl plugin now fails
    instantly if the underlying hash algorithm isn't supported (e.g. MD5 in FIPS-mode) so fallbacks
    to other plugins work properly (#3284).
  * Exponents of RSA keys read from TPM 2.0 via SAPI are correctly converted (8ee1242f1438).
  * Routing table IDs &gt; 255 are supported for custom routes on Linux.
  * To avoid races, the check for hardware offloading support in the kernel-netlink plugin is
    performed during initialization of the plugin (a605452c03).
  * The D-Bus config file for charon-nm is now installed in $(datadir)/dbus-1/system.d instead of
    $(sysconfdir)/dbus-1/system.d, which is intended for sysadmin overrides.
    INVALID_MAJOR_VERSION notifies are now correctly sent in messages of the same exchange type
    and with the same message ID as the request.
  * IKEv2 SAs are now immediately destroyed when sending or receiving INVALID_SYNTAX notifies
    in authenticated messages.
  * For developers working from the repository the configure script now aborts if GNU gperf is
    not found.
  - Version 5.8.1
  ===============
  * RDNs in DNs of X.509 certificates can now optionally be matched less strict. The global
    strongswan.conf option charon.rdn_matching takes two alternative values that cause the
    matching algorithm to either ignore the order of matched RDNs (reordered) or additionally
    (relaxed) accept DNs that contain more RDNs than configured (unmatched RDNs are treated
    like wildcard matches).
  * The updown plugin now passes the same interface to the script that is also used for the
    automatically installed routes, that is, the interface over which the peer is reached
    instead of the interface on which the local address is found (#3095).
  * TPM 2.0 contexts are now protected by a mutex to prevent issues if multiple IKE_SAs use
    the same private key concurrently (4b25885025).
  * Do a rekey check after the third QM message was received (#3060).
  * If available, explicit_bzero() is now used as memwipe() instead of our own implementation.
  * An .editorconfig file has been added, mainly so Github shows files with proper indentation
    (68346b6962).
  * The internal certificate of the load-tester plugin has been modified so it can again be
    used as end-entity cert with 5.6.3 and later (#3139).
  * The maximum data length of received COOKIE notifies (64 bytes) is now enforced (#3160).
  - Version 5.8.0
  ===============
  * The systemd service units have been renamed. The modern unit, which was called
    strongswan-swanctl, is now called strongswan (the previous name is configured as alias in
    the unit, for which a symlink is created when the unit is enabled). The legacy unit is now
    called strongswan-starter.
  * Support for XFRM interfaces (available since Linux 4.19) has been added, which are intended
    to replace VTI devices (they are similar but offer several advantages, for instance, they
    are not bound to an address or address family).
  * IPsec SAs and policies are associated with such interfaces via interface IDs that can be
    configured in swanctl.conf (dynamic IDs may optionally be allocated for each SA and even
    direction). It's possible to use separate interfaces for in- and outbound traffic (or
    only use an interface in one direction and regular policies in the other).
  * Interfaces may be created dynamically via updown/vici scripts, or statically before or after
    establishing the SAs. Routes must be added manually as needed (the daemon will not install
    any routes for outbound policies with an interface ID).
  * When moving XFRM interfaces to other network namespaces they retain access to the SAs and
    policies installed in the original namespace, which allows providing IPsec tunnels for
    processes in other network namespaces without giving them access to the IPsec keys or
    IKE credentials.
    More information can be found on the page about route-based VPNs.
  * Initiation of childless IKE_SAs is supported (RFC 6023). If enabled and supported by the
    responder, no CHILD_SA is established during IKE_AUTH. Instead, all CHILD_SAs are created
    with CREATE_CHILD_SA exchanges. This allows using a separate DH exchange even for the
    first CHILD_SA, which is otherwise created during IKE_AUTH with keys derived from the
    IKE_SA's key material.
  * The swanctl --initiate command may be used to initiate only the IKE_SA via --ike
    option if --child is omitted and the peer supports this extension.
  * The NetworkManager backend and plugin support IPv6.
  * The new wolfssl plugin is a wrapper around the wolfSSL crypto library. Thanks to Sean
    Parkinson of wolfSSL Inc. for the initial patch.
  * IKE SPIs may optionally be labeled via the charon.spi_mask|label options in
    strongswan.conf. This feature was extracted from charon-tkm, however, now applies the
    mask/label in network order.
  * The openssl plugin supports ChaCha20-Poly1305 when built with OpenSSL 1.1.0.
  * The PB-TNC finite state machine according to section 3.2 of RFC 5793 was not correctly
    implemented when sending either a CRETRY or SRETRY batch. These batches can only be sent
    in the "Decided" state and a CRETRY batch can immediately carry all messages usually
    transported by a CDATA batch. It is currently not possible to send a SRETRY batch since
    full-duplex mode for PT-TLS transport is not supported.
  * Instead of marking IPv6 virtual IPs as deprecated, the kernel-netlink plugin now uses
    address labels to avoid that such addresses are used for non-VPN traffic (00a953d090).
  * The agent plugin now creates sockets to the ssh/gpg-agent dynamically and does not keep
    them open, which otherwise might prevent the agent from getting terminated.
  * To avoid broadcast loops the forecast plugin now only reinjects packets that are marked
    or received from the configured interface.
  * UTF-8 encoded passwords are supported via EAP-MSCHAPv2, which internally uses an UTF-16LE
    encoding to calculate the NT hash (#3014).
  * Properly delete temporary drop policies (used when updating IP addresses of SAs) if manual
    priorities are used, which was broken since 5.6.2 (8e31d65730).
  * Avoid overwriting start_action when parsing the inactivity timeout in the vici plugin (#2954).
  * Fixed the automatic termination of reloaded vici connections with start_action=start,
    which was broken since 5.6.3 (71b22c250f).
  * The lookup for shared secrets for IKEv1 SAs via sql plugin should now work better
    (6ec9f68f32).
  * Fixed a race condition in the trap manager between installation and removal of a policy
    (69cbe2ca3f).
  * Compilation of the kernel-netlink plugin has been fixed on old kernels (&lt; 2.6.39), which
    was caused by the HW offload changes (c7f579fa17).
  * The IPsec stack detection and module loading in starter has been removed (it wasn't
    enforced anyway and loading modules doesn't seem necessary, also KLIPS hasn't been
    supported for a long time and PF_KEY will eventually be removed from the Linux kernel,
    ba817d2917).
  * Several IKEv2 protocol details are now handled more strictly: Unrequested virtual IPs are
    ignored, CFG_REPLY payloads are ignored if no CFG_REQUEST payloads were sent, a USE
    TRANSPORT_MODE notify received from the responder is checked against the local configuration.
  * The keys and certificates used by the scenarios in the testing environment are now generated
    dynamically. Running the testing/scripts/build-certs script after creating the base and root
    images uses the pki utility installed in the latter to create the keys and certificates for
    all the CAs and in some cases for individual scenarios. These credentials are stored in the
    source tree, not the image, so this has to be called only once even if the images are later
    rebuilt. The script automatically (re-)rebuilds the guest images as that generates fresh
    CRLs and signs the DNS zones. The only keys/certificates currently not generated are the
    very large ones used by the ikev2/rw-eap-tls-fragments scenario.
  - Version 5.7.2
  ===============
  * For RSA with PSS padding, the TPM 2.0 specification mandates the maximum salt length
    (as defined by the length of the key and hash). However, if the TPM is FIPS-168-4 compliant,
    the salt length equals the hash length. This is assumed for FIPS-140-2 compliant TPMs, but
    if that's not the case, it might be necessary to manually enable charon.plugins.tpm.fips_186_4
    if the TPM doesn't use the maximum salt length.
  * Directories for credentials loaded by swanctl are now accessed relative to the loaded
    swanctl.conf file, in particular, when loading it from a custom location via --file argument.
  * The base directory, which is used if no custom location for swanctl.conf is specified, is now
    also configurable at runtime via SWANCTL_DIR environment variable.
  * If RADIUS Accounting is enabled, the eap-radius plugin will add the session ID (Acct-Session-Id)
    to Access-Request messages, which e.g. simplifies associating database entries for IP leases and
    accounting with sessions (the session ID does not change when IKE_SAs are rekeyed, #2853).
  * All IP addresses assigned by a RADIUS server are included in Accounting-Stop messages even if
    the client did not claim them, allowing to release them early in case of connection errors (#2856).
  * Selectors installed on transport mode SAs by the kernel-netlink plugin are now updated if an
    IP address changes (e.g. via MOBIKE) and it was part of the selectors.
  * No deletes are sent anymore when a rekeyed CHILD_SA expires (#2815).
  * The bypass-lan plugin now tracks interfaces to handle subnets that move from one interface
    to another and properly update associated routes (#2820).
  * Only valid and expected inbound IKEv2 messages are used to update the timestamp of the
    last received message (previously, retransmits also triggered an update).
  * IKEv2 requests from responders are now ignored until the IKE_SA is fully established (e.g. if a
    DPD request from the peer arrives before the IKE_AUTH response does, 46bea1add9).
    Delayed IKE_SA_INIT responses with COOKIE notifies we already recevied are ignored, they caused
    another reset of the IKE_SA previously (#2837).
  * Active and queued Quick Mode tasks are now adopted if the peer reauthenticates an IKEv1 SA
    while creating lots of CHILD_SAs.
  * Newer versions of the FreeBSD kernel add an SADB_X_EXT_SA2 extension to SADB_ACQUIRE
    messages, which allows the kernel-pfkey plugin to determine the reqid of the policy even if it
    wasn't installed by the daemon previously (e.g. when using FreeBSD's if_ipsec(4) VTIs, which
    install policies themselves, 872b9b3e8d).
  * Added support for RSA signatures with SHA-256 and SHA-512 to the agent plugin. For older
    versions of ssh/gpg-agent that only support SHA-1, IKEv2 signature authentication has to be
    disabled via charon.signature_authentication.
  * The sshkey and agent plugins support Ed25519/Ed448 SSH keys and signatures.
  * The openssl plugin supports X25519/X448 Diffie-Hellman and Ed25519/Ed448 keys and
    signatures when built against OpenSSL 1.1.1.
  * Support for Ed25519, ChaCha20/Poly1305, SHA-3 and AES-CCM were added to the botan plugin.
  * The mysql plugin now properly handles database connections with transactions
    under heavy load (#2779).
  * IP addresses in ha pools are now distributed evenly among all segments (#2828).
  * Private key implementations may optionally provide a list of supported signature schemes,
    which, as described above, is used by the tpm plugin because for each key on a TPM 2.0 the
    hash algorithm and for RSA also the padding scheme is predefined.
  * The testing environment is now based on Debian 9 (stretch) by default. This required
    some changes, in particular, updating to FreeRADIUS 3.x (which forced us to abandon the
    TNC@FHH patches and scenarios, 2fbe44bef3) and removing FIPS-enabled versions of
    OpenSSL (the FIPS module only supports OpenSSL 1.0.2).
  * Most test scenarios were migrated to swanctl.
  - Version 5.7.1
  ===============
  * Fixes a vulnerability in the gmp plugin triggered by crafted certificates with RSA keys with
    very small moduli. When verifying signatures with such keys, the code patched with the fix
    for CVE-2018-16151/2 caused an integer underflow and subsequent heap buffer overflow
    that results in a crash of the daemon.
  * The vulnerability has been registered as CVE-2018-17540.
  - Version 5.7.0
  ===============
  * Fixes a potential authorization bypass vulnerability in the gmp plugin that was caused by a
    too lenient verification of PKCS#1 v1.5 signatures. Several flaws could be exploited by a
    Bleichenbacher-style attack to forge signatures for low-exponent keys (i.e. with e=3).
  * CVE-2018-16151 has been assigned to the problem of accepting random bytes after the OID
    of the hash function in such signatures, and CVE-2018-16152 has been assigned to the issue
    of not verifying that the parameters in the ASN.1 algorithmIdentitifer structure is empty.
    Other flaws that don't lead to a vulnerability directly (e.g. not checking for at least
    8 bytes of padding) have no separate CVE assigned.
  * Dots are not allowed anymore in section names in swanctl.conf and strongswan.conf.
    This mainly affects the configuration of file loggers. If the path for such a log file
    contains dots it now has to be configured in the new path setting within the arbitrarily
    renamed subsection in the filelog section.
  * Sections in swanctl.conf and strongswan.conf may now reference other sections. All settings
    and subsections from such a section are inherited. This allows to simplify configs as
    redundant information has only to be specified once and may then be included in other
    sections (see strongswan.conf for an example).
  * The originally selected IKE config (based on the IPs and IKE version) can now change
    if no matching algorithm proposal is found. This way the order of the configs doesn't
    matter that much anymore and it's easily possible to specify separate configs for
    clients that require weaker algorithms (instead of having to also add them in other
    configs that might be selected).
  * Support for Postquantum Preshared Keys for IKEv2 (draft-ietf-ipsecme-qr-ikev2) has been added.
    For an example refer to the swanctl/rw-cert-ppk scenario (or with EAP, or PSK authentication).
  * The new botan plugin is a wrapper around the Botan C++ crypto library.
    It requires a fairly recent build from Botan's master branch (or the upcoming 2.8.0 release).
    Thanks to René Korthaus and his team from Rohde &amp; Schwarz Cybersecurity for the initial
    patch and to Jack Lloyd for quickly adding missing functions to Botan's FFI (C89) interface.
  * Implementation of RFC 8412 "Software Inventory Message and Attributes (SWIMA) for PA-TNC".
  * SWIMA subscription option sets CLOSE_WRITE trigger on apt history.log file resulting in
    a ClientRetry PB-TNC batch to initialize a new measurement cycle. The new imv/imc-swima
    plugins replace the previous imv/imc-swid plugins, which were removed.
  * Added support for fuzzing the PA-TNC (RFC 5792) and PB-TNC (RFC 5793) NEA protocols
    on Google's OSS-Fuzz infrastructure.
  * Support for version 2 of Intel's TPM2-TSS TGC Software Stack. The presence of the
    in-kernel /dev/tpmrm0 resource manager is automatically detected.
  * The pki tool accepts a xmppAddr otherName as a subjectAlternativeName using the
    syntax --san xmppaddr:&lt;jid&gt;.
  * swanctl.conf supports the configuration of marks the in- and/or outbound SA should apply
    to packets after processing on Linux. Configuring such a mark for outbound SAs requires
    at least a 4.14 kernel. The ability to set a mask and configuring a mark/mask for
    inbound SAs will be added with the upcoming 4.19 kernel.
  * New options in swanctl.conf allow configuring how/whether DF, ECN and DS fields in the
    IP headers are copied during IPsec processing. Controlling this is currently only possible
    on Linux.
  * The handling of sequence numbers in IKEv1 DPDs has been improved (#2714).
  * To avoid conflicts, the dhcp plugin now only uses the DHCP server port if explicitly
    configured.
  - Version 5.6.3
  ===============
  * Fixed a DoS vulnerability in the IKEv2 key derivation if the openssl plugin is used in FIPS
    mode and HMAC-MD5 is negotiated as PRF.
    This vulnerability has been registered as CVE-2018-10811.
  * Fixed a vulnerability in the stroke plugin, which did not check the received length before
    reading a message from the socket. Unless a group is configured, root privileges are
    required to access that socket, so in the default configuration this shouldn't be an issue.
    This vulnerability has been registered as CVE-2018-5388.
  * CRLs that are not yet valid are now ignored to avoid problems in scenarios where expired
    certificates are removed from new CRLs and the clock on the host doing the revocation
    check is trailing behind that of the host issuing CRLs. Not doing this could result in
    accepting a revoked and expired certificate, if it's still valid according to the
    trailing clock but not contained anymore in not yet valid CRLs.
  * The issuer of fetched CRLs is now compared to the issuer of the checked certificate (#2608).
  * CRL validation results other than revocation (e.g. a skipped check because the CRL couldn't
    be fetched) are now stored also for intermediate CA certificates and not only for end-entity
    certificates, so a strict CRL policy can be enforced in such cases.
  * In compliance with RFC 4945, section 5.1.3.2, certificates used for IKE must now either
    not contain a keyUsage extension (like the ones generated by pki), or have at least one of the
    digitalSignature or nonRepudiation bits set.
  * New options for vici/swanctl allow forcing the local termination of an IKE_SA. This might be
    useful in situations where it's known the other end is not reachable anymore, or that it
    already removed the IKE_SA, so retransmitting a DELETE and waiting for a response would
    be pointless.
  * Waiting only a certain amount of time for a response (i.e. shorter than all retransmits
    would be) before destroying the IKE_SA is also possible by additionally specifying a
    timeout in the forced termination request.
  * When removing routes, the kernel-netlink plugin now checks if it tracks other routes for
    the same destination and replaces the installed route instead of just removing it. Same
    during installation, where existing routes previously weren't replaced. This should allow
    using traps with virtual IPs on Linux (#2162).
  * The dhcp plugin now only sends the client identifier DHCP option if the identity_lease
    setting is enabled (7b660944b6). It can also send identities of up to 255 bytes length,
    instead of the previous 64 bytes (30e886fe3b, 0e5b94d038). If a server address is
    configured, DHCP requests are now sent from port 67 instead of 68 to avoid ICMP port
    unreachables (becf027cd9).
  * The handling of faulty INVALID_KE_PAYLOAD notifies (e.g. one containing a DH group
    that wasn't proposed) during CREATE_CHILD_SA exchanges has been improved (#2536).
  * Roam events are now completely ignored for IKEv1 SAs (there is no MOBIKE to handle such
    changes properly).
  * ChaCha20/Poly1305 is now correctly proposed without key length (#2614). For compatibility with
    older releases the chacha20poly1305compat keyword may be included in proposals to also propose
    the algorithm with a key length (c58434aeff).
  * Configuration of hardware offload of IPsec SAs is now more flexible and allows a new
    setting (auto), which automatically uses it if the kernel and device both support it. If hw
    offload is set to yes and offloading is not supported, the CHILD_SA installation now fails.
  * The kernel-pfkey plugin optionally installs routes via internal interface (one with an IP
    in the local traffic selector). On FreeBSD, enabling this selects the correct source IP
    when sending packets from the gateway itself (e811659323).
  * SHA-2 based PRFs are supported in PKCS#8 files as generated by OpenSSL 1.1 (#2574).
  * The pki --verify tool may load CA certificates and CRLs from directories.
  * The IKE daemon now also switches to port 4500 if the remote port is not 500 (e.g. because the
    remote maps the response to a different port, as might happen on Azure), as long as the local
    port is 500 (85bfab621d).
  * Fixed an issue with DNS servers passed to NetworkManager in charon-nm (ee8c25516a).
  * Logged traffic selectors now always contain the protocol if either protocol or port are set
    (a36d8097ed).
  * Only the inbound SA/policy will be updated as reaction to IP address changes for rekeyed
    CHILD_SAs that are kept around.
  * The parser for strongswan.conf/swanctl.conf now accepts = characters in values without
    having to put the value in quotes (e.g. for Base64 encoded shared secrets).
    Notes for developers:
  * trap_manager_t: Trap policies are now unistalled by peer/child name and not the reqid.
  * No reqid is returned anymore when installing trap policies.
  * child_sa_t: A new state (CHILD_DELETED) is used for CHILD_SAs that have been deleted but
    not yet destroyed (after a rekeying CHILD_SAs are kept around for a while to process
    delayed packets).
    This way child_updown events are not triggered anymore for such SAs when an IKE_SA that
    has such CHILD_SAs assigned is deleted.
  - Version 5.6.2
  ===============
  * Fixed a DoS vulnerability in the parser for PKCS#1 RSASSA-PSS signatures that was caused
    by insufficient input validation. One of the configurable parameters in algorithm identifier
    structures for RSASSA-PSS signatures is the mask generation function (MGF). Only MGF1 is
    currently specified for this purpose. However, this in turn takes itself a parameter that
    specifies the underlying hash function. strongSwan's parser did not correctly handle the
    case of this parameter being absent, causing an undefined data read.
    This vulnerability has been registered as CVE-2018-6459.
  * When rekeying IKEv2 IKE_SAs the previously negotiated DH group will be reused, instead of
    using the first configured group, which avoids an additional exchange if the peer previously
    selected a different DH group via INVALID_KE_PAYLOAD notify. The same is also done when
    rekeying CHILD_SAs except for the first rekeying of the CHILD_SA that was created with the
    IKE_SA, where no DH group was negotiated yet.
    Also, the selected DH group is moved to the front in all sent proposals that contain it
    and all proposals that don't are moved to the back in order to convey the preference for
    this group to the peer.
  * Handling of MOBIKE task queuing has been improved. In particular, the response to an
    address update (with NAT-D payloads) is not ignored anymore if only an address list update
    or DPD is queued as that could prevent updating the UDP encapsulation in the kernel.
  * On Linux, roam events may optionally be triggered by changes to the routing rules, which
    can be useful if routing rules (instead of e.g. route metrics) are used to switch from one
    to another interface (i.e. from one to another routing table). Since routing rules are
    currently not evaluated when doing route lookups this is only useful if the kernel-based
    route lookup is used (4664992f7d).
  * The fallback drop policies installed to avoid traffic leaks when replacing addresses in
    installed policies are now replaced by temporary drop policies, which also prevent
    acquires because we currently delete and reinstall IPsec SAs to update their addresses
    (35ef1b032d).
  * Access X.509 certificates held in non-volatile storage of a TPM 2.0 referenced via the
    NV index.
    Adding the --keyid parameter to pki --print allows to print private keys or certificates
    stored in a smartcard or a TPM 2.0.
  * Fixed proposal selection if a peer incorrectly sends DH groups in the ESP proposal during
    IKE_AUTH and also if a DH group is configured in the local ESP proposal and charon.prefer
    configured_proposals is disabled (d058fd3c32).
  * The lookup for PSK secrets for IKEv1 has been improved for certain scenarios (see #2497
    for details).
  * MSKs received via RADIUS are now padded to 64 bytes to avoid compatibility issues with
    EAP-MSCHAPv2 and PRFs that have a block size &lt; 64 bytes (e.g. AES-XCBC-PRF-128, see
    73cbce6013).
  * The tpm_extendpcr command line tool extends a digest into a TPM PCR.
  * Ported the NetworkManager backend from the deprecated libnm-glib to libnm.
  * The save-keys debugging/development plugin saves IKE and/or ESP keys to files compatible
    with Wireshark.
  - Version 5.6.1
  ===============
  * Several algorithms were removed from the default ESP/AH and IKE proposals in compliance with
    RFC 8221 and RFC 8247, respectively. Removed from the default ESP/AH proposal were the
    3DES and Blowfish encryption algorithms and the HMAC-MD5 integrity algorithm. From the IKE
    default proposal the HMAC-MD5 integrity algorithm and the MODP-1024 Diffie-Hellman group
    were removed (the latter is significant for Windows clients in their default configuration).
    These algorithms may still be used in custom proposals.
  * Support for RSASSA-PSS signatures has been added. For compatibility with previous
    releases they are currently not used automatically, by default, to change that charon.rsa_pss
    may be enabled. To explicitly use or require such signatures during IKEv2 signature
    authentication (RFC 7427) ike:rsa/pss... authentication constraints may be used for specific
    connections (regardless of whether the strongswan.conf option above is enabled). Only the
    hash algorithm can be specified in such constraints, the MGF1 will be based on that hash
    and the salt length will equal the hash length (when verifying the salt length is not
    enforced).
    To enforce such signatures during PKI verification use rsa/pss... authentication constraints.
  * All pki commands that create certificates/CRLs can be made to sign with RSASSA-PSS instead
    of the classing PKCS#1 scheme with the --rsa-padding pss option. As with signatures during
    authentication, only the hash algorithm is configurable (via --digest option), the MGF1 will
    be based on that and the salt length will equal the hash length.
  * These signatures are supported by all RSA backends except pkcs11 (i.e. gmp, gcrypt, openssl).
    The gmp plugin requires the mgf1 plugin.
    Note that RSASSA-PSS algorithm identifiers and parameters in keys (public keys in
    certificates or private keys in PKCS#8 files) are currently not used as constraints.
  * The sec-updater tool checks for security updates in dpkg-based repositories
    (e.g. Debian/Ubuntu) and sets the security flags in the IMV policy database accordingly.
    Additionally for each new package version a SWID tag for the given OS and HW architecture
    is created and stored in the database.
  * Using the sec-updater.sh script template the lookup can be automated (e.g. via an hourly
    cron job).
  * When restarting an IKEv2 negotiation after receiving an INVALID_KE_PAYLOAD notify (or due
    to other reasons like too many retransmits) a new initiator SPI is allocated. This
    prevents issues caused by retransmits for IKE_SA_INIT messages.
  * Because the initiator SPI was previously reused when restarting the connection delayed
    responses for previous connection attempts were processed and might have caused fatal
    errors due to a failed DH negotiation or because of the internal retry counter in the
    ike-init task. For instance, if we proposed a DH group the responder rejected we
    might have later received delayed responses that either contained INVALID_KE_PAYLOAD
    notifies with the DH group we already switched to, or, if we retransmitted an
    IKE_SA_INIT with the requested group but then had to restart again, a KE payload with
    a group different from the one we proposed.
  * The introduction of file versions in the IMV database scheme broke file reference hash
    measurements. This has been fixed by creating generic product versions having an empty
    package name.
  * A new timeout option for the systime-fix plugin stops periodic system time checks after
    a while and enforces a certificate verification, closing or reauthenticating all SAs
    with invalid certificates.
  * The IKE event counters, previously only available via ipsec listcounters command, may
    now also be queried and reset via vici and the new swanctl --counters command. They
    are collected and provided by the optional counters plugin (enabled by default for
    backwards compatibility if the stroke plugin is built).
  * Class attributes received in RADIUS Access-Accept messages may optionally be added to
    RADIUS accounting messages (655924074b).
  * Basic support for systemd sockets has been added, which may be used for privilege separation
    (59db98fb94).
  * Inbound marks may optionally be installed in the SA again (was removed with 5.5.2) by
    enabling the mark_in_sa option in swanctl.conf.
  * The timeout of leases in pools configured via pool utility may be configured in other
    units than hours.
    INITIAL_CONTACT notifies are now only omitted if never is configured as uniqueness policy.
  * Outbound FWD policies for shunts are not installed anymore, by default (as is the case
    for other policies since 5.5.1).
  * Don't consider a DH group mismatch during CHILD_SA rekeying as failure as responder
    (e7276f78aa).
  * Handling of fragmented IPv4 and IPv6 packets in libipsec has been improved (e138003de9).
  * Trigger expire events for the correct IPsec SA in libipsec (6e861947a0).
  * A crash in CRL verification via openssl plugin using OpenSSL 1.1 has been fixed (78acaba6a1).
  * No hard-coded default proposals are passed from starter to the stroke plugin anymore (the
    IKE proposal used curve25519 since 5.5.2, which is an optional plugin).
  * A workaround for an issue with virtual IPs on macOS 10.13 (High Sierra) has been added
    (039b85dd43).
  * Handling of IKE_SA rekey collisions in charon-tkm has been fixed.
  * Instead of failing or just silently doing nothing unit tests may now warn about certain
    conditions (e.g. if a test was not executed due to external dependencies).</changelog>
  <changelog author="mmnelemane@suse.com" date="1585224000">- Fix for to resolve multiple definition of swanctl_dir (bsc #1164493)
  [+ 0006-Resolve-multiple-definition-of-swanctl_dir.patch]</changelog>
  <changelog author="mbuil@suse.com" date="1610712000">- Fix typo in README (bsc #1167880)
  [+ 0007-Fix-typo-in-README.patch ]</changelog>
  <changelog author="mbuil@suse.com" date="1611576000">- Fix FIPS bug (bsc #1180801)
  [+ 0008-gcrypt-Use-a-dummy-buffer-to-initialize-static-alloc.patch ]</changelog>
  <changelog author="mbuil@suse.com" date="1617019200">- Keep using ipsec as the main binary. Therefore, make strongswan.service point to it instead of swanctl</changelog>
  <changelog author="mbuil@suse.com" date="1617019201">- Information added in README about the rcstrongswan-starter</changelog>
  <changelog author="mbuil@suse.com" date="1617624000">- Add config to run ipsec on namespaces (bsc #1183670)</changelog>
  <changelog author="mt@suse.com" date="1619006400">- Add support for AES CCM aead algorithms to openssl plugin (cc/fips,bsc#1185363)
  [+ 0009-strongswan-openssl-aead-add-ccm-support.patch]</changelog>
  <changelog author="mt@suse.com" date="1620388800">- Replace AEAD AES CCM patch with upstream variant (cc/fips,bsc#1185363)
  [* 0009-strongswan-openssl-aead-add-ccm-support.patch]</changelog>
  <changelog author="hare@suse.de" date="1627646400">- Add auth_els plugin to support Marvell FC-SP encryption (jsc#SLE-20151)
  [* strongswan-marvell-auth-els.patch]</changelog>
  <changelog author="abergmann@suse.com" date="1634040000">- Fix integer overflow in gmp plugin (bsc#1191367, CVE-2021-41990)
  [* strongswan-5.6.1-5.9.3_gmp-rsa-ssa-salt-len.patch]
- Fix integer overflow when replacing certificates in cache (bsc#1191435, CVE-2021-41991)
  [* strongswan-4.4.1-5.9.3_cert-cache-random.patch]</changelog>
  <changelog author="meissner@suse.com" date="1643025600">- strongswan-5.5.0-5.9.4_eap_success-CVE-2021-45079.patch:
  Fixed authentication bypass in EAP authentication (CVE-2021-45079
  bsc#1194471)</changelog>
</package>
<package pkgid="7404cab5ff730996fd76c32035e05b7e7020312b80e1cb3ad1ef78899a3c5f90" name="strongswan" arch="ppc64le">
  <version epoch="0" ver="5.8.2" rel="11.24.1"/>
  <changelog author="ndas@suse.de" date="1501502400">- Updated to strongSwan 5.3.5(bsc#1050691) providing the following changes:
  * Fixed a DoS vulnerability in the gmp plugin that was caused by insufficient input
    validation when verifying RSA signatures. More specifically, mpz_powm_sec() has two
    requirements regarding the passed exponent and modulus that the plugin did not
    enforce, if these are not met the calculation will result in a floating point exception
    that crashes the whole process.
    This vulnerability has been registered as CVE-2017-9022.
    Please refer to our blog for details.
  * Fixed a DoS vulnerability in the x509 plugin that was caused because the ASN.1 parser
    didn't handle ASN.1 CHOICE types properly, which could result in an infinite loop when
    parsing X.509 extensions that use such types.
    This vulnerability has been registered as CVE-2017-9023.
    Please refer to our blog for details.
  * The behavior during IKEv2 CHILD_SA rekeying has been changed in order to avoid
    traffic loss. When responding to a CREATE_CHILD_SA request to rekey a CHILD_SA
    the responder already has everything available to install and use the new CHILD_SA.
    However, this could lead to lost traffic as the initiator won't be able to process
    inbound packets until it processed the CREATE_CHILD_SA response and updated the
    inbound SA. To avoid this the responder now only installs the new inbound SA and
    delays installing the outbound SA until it receives the DELETE for the replaced CHILD_SA.
  * The messages transporting these DELETEs could reach the peer before packets sent
    with the deleted outbound SAs reach it. To reduce the chance of traffic loss due
    to this the inbound SA of the replaced CHILD_SA is not removed for a configurable
    amount of seconds (charon.delete_rekeyed_delay) after the DELETE has been processed.
  * The code base has been ported to Apple's ARM64 iOS platform, which required several
    changes regarding the use of variadic functions. This was necessary because the calling
    conventions for variadic and regular functions are different there.
    This means that assigning a non-variadic function to a variadic function pointer, as we
    did with our enumerator_t::enumerate() implementations and several callbacks, will
    result in crashes as the called function accesses the arguments differently than the
    caller provided them. To avoid this issue the enumerator_t interface has been changed
    and the signature of the callback functions for enumerator_create_filter() and two
    methods on linked_list_t have been changed. Refer to the developer notes below
    for details.
  * Adds support for fuzzing the certificate parser provided by the default plugins
    (x509, pem, gmp etc.) on Google's OSS-Fuzz infrastructure (or generally with
    libFuzzer). Several issues found while fuzzing these plugins were fixed.
  * Two new options have been added to charon's retransmission settings:
    retransmit_limit and retransmit_jitter. The former adds an upper limit to the
    calculated retransmission timeout, the latter randomly reduces it.
    Refer to Retransmission for details.
  * A bug in swanctl's --load-creds command was fixed that caused unencrypted
    private keys to get unloaded if the command was called multiple times.
    The load-key VICI command now returns the key ID of the loaded key on success.
  * The credential manager now enumerates local credential sets before global ones.
    This means certificates supplied by the peer will now be preferred over certificates
    with the same identity that may be locally stored (e.g. in the certificate cache).
  * Adds support for hardware offload of IPsec SAs as introduced by Linux 4.11 for
    specific hardware that supports this.
  * The pki tool loads the curve25519 plugin by default.
    [- 0006-Make-sure-the-modulus-is-odd-and-the-exponent-not-zero.patch,
  - 0007-asn1-parser-Fix-CHOICE-parsing.patch]
- libhydra is removed as all kernel plugins moved to libcharon</changelog>
  <changelog author="ndas@suse.de" date="1504612800">- fix "uintptr_t? undeclared" compilation error.
  [+0006-fix-compilation-error-by-adding-stdint.h.patch]</changelog>
  <changelog author="ndas@suse.de" date="1504612801">- Updated to strongSwan 5.6.0 providing the following changes:
  * Fixed a DoS vulnerability in the gmp plugin that was caused by insufficient input validation
    when verifying RSA signatures, which requires decryption with the operation m^e mod n,
    where m is the signature, and e and n are the exponent and modulus of the public key.
    The value m is an integer between 0 and n-1, however, the gmp plugin did not verify this.
    So if m equals n the calculation results in 0, in which case mpz_export() returns NULL.
    This result wasn't handled properly causing a null-pointer dereference.
    This vulnerability has been registered as CVE-2017-11185. (bsc#1051222)
  * New SWIMA IMC/IMV pair implements the draft-ietf-sacm-nea-swima-patnc Internet
    Draft and has been demonstrated at the IETF 99 Prague Hackathon.
  * The IMV database template has been adapted to achieve full compliance with the
    ISO 19770-2:2015 SWID tag standard.
  * The pt-tls-client can attach and use TPM 2.0 protected private keys via the --keyid parameter.
  * By default the /etc/swanctl/conf.d directory is created and *.conf files in it are included in the default
    swanctl.conf file.
  * The curl plugin now follows HTTP redirects (configurable via strongswan.conf).
  * The CHILD_SA rekeying was fixed in charon-tkm and the behavior is refined a bit more since 5.5.3
  * libtpmtss supports Intel's TSS2 Architecture Broker and Resource Manager interface (tcti-tabrmd).
  * more on https://wiki.strongswan.org/versions/66</changelog>
  <changelog author="mmnelemane@suse.com" date="1521028800">- Removed unused requires and macro calls(bsc#1083261)</changelog>
  <changelog author="mmnelemane@suse.com" date="1573646400">- Added patch to fix vulnerability: CVE-2018-16151,CVE-2018-16152 (bsc#1107874)
  - Insufficient input validation in gmp plugin
  [+ 0007-strongswan-5.3.1-5.6.0_gmp-pkcs1-verify.patch]</changelog>
  <changelog author="mmnelemane@suse.com" date="1573646401">- Added patch to fix vulnerability: CVE-2018-5388 (bsc#1094462)
  - Buffer Underflow in stroke_socket.c
  [+ 0008-strongswan-5.1.2-5.6.2_stroke_msg_len.patch]</changelog>
  <changelog author="mmnelemane@suse.com" date="1573646402">- Added patch to fix vulnerability: CVE-2018-10811 (bsc#1093536)
  - denial-of-service vulnerability
  [+ 0009-strongswan-5.5.0-5.6.2_skeyseed_init.patch]</changelog>
  <changelog author="mmnelemane@suse.com" date="1573732800">- Added patch to fix vulnerability: CVE-2018-17540 (bsc#1109845)
  [+ 0010-strongswan-4.4.0-5.7.0_gmp-pkcs1-overflow.patch]</changelog>
  <changelog author="mmnelemane@suse.com" date="1580212800">- Updated to version 5.8.2 (jsc#SLE-11370)
  - Dropped following patches due to irrelevance in the updated version:
    [- strongswan_modprobe_syslog.patch ]
    [- strongswan_fipsfilter.patch ]
    [- 0006-fix-compilation-error-by-adding-stdint.h.patch ]
    [- 0007-strongswan-5.3.1-5.6.0_gmp-pkcs1-verify.patch ]
    [- 0008-strongswan-5.1.2-5.6.2_stroke_msg_len.patch ]
    [- 0009-strongswan-5.5.0-5.6.2_skeyseed_init.patch ]
    [- 0010-strongswan-4.4.0-5.7.0_gmp-pkcs1-overflow.patch ]
  - Version 5.8.2
  ===============
  * Identity-based CA constraints, which enforce that the certificate chain of the remote
    peer contains a CA certificate with a specific identity, are supported via
    vici/swanctl.conf. This is similar to the existing CA constraints but doesn't require
    that the CA certificate is locally installed, for instance, intermediate CA certificates
    received from the peers. Wildcard identity matching (e.g. ..., OU=Research, CN=*) could
    also be used for the latter but requires trust in the intermediate CAs to only issue
    certificates with legitimate subject DNs (e.g. the "Sales" CA must not issue certificates
    with OU=Research). With the new constraint that's not necessary as long as a path length
    basic constraint (--pathlen for pki --issue) prevents intermediate CAs from issuing further
    intermediate CAs.
  * Intermediate CA certificates may now be sent in hash-and-URL encoding by configuring a
    base URL for the parent CA (#3234, swanctl/rw-hash-and-url-multi-level).
  * Implemented NIST SP-800-90A Deterministic Random Bit Generator (DRBG) based on AES-CTR
    and SHA2-HMAC modes. Currently used by the gmp and ntru plugins.
  * Random nonces sent in an OCSP requests are now expected in the corresponding OCSP responses.
  * The kernel-netlink plugin now ignores deprecated IPv6 addresses for MOBIKE. Whether temporary
    or permanent IPv6 addresses are included now depends on the charon.prefer_temporary_addrs
    setting (#3192).
  * Extended Sequence Numbers (ESN) are configured via PF_KEY if supported by the kernel.
  * The PF_KEY socket's receive buffer in the kernel-pfkey plugin is now cleared before sending
    requests, as many of the messages sent by the kernel are sent as broadcasts to all PF_KEY
    sockets. This is an issue if an external tool is used to manage SAs/policies unrelated to
    IPsec (#3225).
  * The vici plugin now uses unique section names for CHILD_SAs in child-updown events (7c74ce9190).
  * For individually deleted CHILD_SAs (in particular for IKEv1) the vici child-updown event
    now includes more information about the CHILD_SAs such as traffic statistics (#3198).
  * Custom loggers are correctly re-registered if log levels are changed via stroke loglevel (#3182).
  * Avoid lockups during startup on low entropy systems when using OpenSSL 1.1.1 (095a2c2eac).
  * Instead of failing later when setting a key, creating HMACs via openssl plugin now fails
    instantly if the underlying hash algorithm isn't supported (e.g. MD5 in FIPS-mode) so fallbacks
    to other plugins work properly (#3284).
  * Exponents of RSA keys read from TPM 2.0 via SAPI are correctly converted (8ee1242f1438).
  * Routing table IDs &gt; 255 are supported for custom routes on Linux.
  * To avoid races, the check for hardware offloading support in the kernel-netlink plugin is
    performed during initialization of the plugin (a605452c03).
  * The D-Bus config file for charon-nm is now installed in $(datadir)/dbus-1/system.d instead of
    $(sysconfdir)/dbus-1/system.d, which is intended for sysadmin overrides.
    INVALID_MAJOR_VERSION notifies are now correctly sent in messages of the same exchange type
    and with the same message ID as the request.
  * IKEv2 SAs are now immediately destroyed when sending or receiving INVALID_SYNTAX notifies
    in authenticated messages.
  * For developers working from the repository the configure script now aborts if GNU gperf is
    not found.
  - Version 5.8.1
  ===============
  * RDNs in DNs of X.509 certificates can now optionally be matched less strict. The global
    strongswan.conf option charon.rdn_matching takes two alternative values that cause the
    matching algorithm to either ignore the order of matched RDNs (reordered) or additionally
    (relaxed) accept DNs that contain more RDNs than configured (unmatched RDNs are treated
    like wildcard matches).
  * The updown plugin now passes the same interface to the script that is also used for the
    automatically installed routes, that is, the interface over which the peer is reached
    instead of the interface on which the local address is found (#3095).
  * TPM 2.0 contexts are now protected by a mutex to prevent issues if multiple IKE_SAs use
    the same private key concurrently (4b25885025).
  * Do a rekey check after the third QM message was received (#3060).
  * If available, explicit_bzero() is now used as memwipe() instead of our own implementation.
  * An .editorconfig file has been added, mainly so Github shows files with proper indentation
    (68346b6962).
  * The internal certificate of the load-tester plugin has been modified so it can again be
    used as end-entity cert with 5.6.3 and later (#3139).
  * The maximum data length of received COOKIE notifies (64 bytes) is now enforced (#3160).
  - Version 5.8.0
  ===============
  * The systemd service units have been renamed. The modern unit, which was called
    strongswan-swanctl, is now called strongswan (the previous name is configured as alias in
    the unit, for which a symlink is created when the unit is enabled). The legacy unit is now
    called strongswan-starter.
  * Support for XFRM interfaces (available since Linux 4.19) has been added, which are intended
    to replace VTI devices (they are similar but offer several advantages, for instance, they
    are not bound to an address or address family).
  * IPsec SAs and policies are associated with such interfaces via interface IDs that can be
    configured in swanctl.conf (dynamic IDs may optionally be allocated for each SA and even
    direction). It's possible to use separate interfaces for in- and outbound traffic (or
    only use an interface in one direction and regular policies in the other).
  * Interfaces may be created dynamically via updown/vici scripts, or statically before or after
    establishing the SAs. Routes must be added manually as needed (the daemon will not install
    any routes for outbound policies with an interface ID).
  * When moving XFRM interfaces to other network namespaces they retain access to the SAs and
    policies installed in the original namespace, which allows providing IPsec tunnels for
    processes in other network namespaces without giving them access to the IPsec keys or
    IKE credentials.
    More information can be found on the page about route-based VPNs.
  * Initiation of childless IKE_SAs is supported (RFC 6023). If enabled and supported by the
    responder, no CHILD_SA is established during IKE_AUTH. Instead, all CHILD_SAs are created
    with CREATE_CHILD_SA exchanges. This allows using a separate DH exchange even for the
    first CHILD_SA, which is otherwise created during IKE_AUTH with keys derived from the
    IKE_SA's key material.
  * The swanctl --initiate command may be used to initiate only the IKE_SA via --ike
    option if --child is omitted and the peer supports this extension.
  * The NetworkManager backend and plugin support IPv6.
  * The new wolfssl plugin is a wrapper around the wolfSSL crypto library. Thanks to Sean
    Parkinson of wolfSSL Inc. for the initial patch.
  * IKE SPIs may optionally be labeled via the charon.spi_mask|label options in
    strongswan.conf. This feature was extracted from charon-tkm, however, now applies the
    mask/label in network order.
  * The openssl plugin supports ChaCha20-Poly1305 when built with OpenSSL 1.1.0.
  * The PB-TNC finite state machine according to section 3.2 of RFC 5793 was not correctly
    implemented when sending either a CRETRY or SRETRY batch. These batches can only be sent
    in the "Decided" state and a CRETRY batch can immediately carry all messages usually
    transported by a CDATA batch. It is currently not possible to send a SRETRY batch since
    full-duplex mode for PT-TLS transport is not supported.
  * Instead of marking IPv6 virtual IPs as deprecated, the kernel-netlink plugin now uses
    address labels to avoid that such addresses are used for non-VPN traffic (00a953d090).
  * The agent plugin now creates sockets to the ssh/gpg-agent dynamically and does not keep
    them open, which otherwise might prevent the agent from getting terminated.
  * To avoid broadcast loops the forecast plugin now only reinjects packets that are marked
    or received from the configured interface.
  * UTF-8 encoded passwords are supported via EAP-MSCHAPv2, which internally uses an UTF-16LE
    encoding to calculate the NT hash (#3014).
  * Properly delete temporary drop policies (used when updating IP addresses of SAs) if manual
    priorities are used, which was broken since 5.6.2 (8e31d65730).
  * Avoid overwriting start_action when parsing the inactivity timeout in the vici plugin (#2954).
  * Fixed the automatic termination of reloaded vici connections with start_action=start,
    which was broken since 5.6.3 (71b22c250f).
  * The lookup for shared secrets for IKEv1 SAs via sql plugin should now work better
    (6ec9f68f32).
  * Fixed a race condition in the trap manager between installation and removal of a policy
    (69cbe2ca3f).
  * Compilation of the kernel-netlink plugin has been fixed on old kernels (&lt; 2.6.39), which
    was caused by the HW offload changes (c7f579fa17).
  * The IPsec stack detection and module loading in starter has been removed (it wasn't
    enforced anyway and loading modules doesn't seem necessary, also KLIPS hasn't been
    supported for a long time and PF_KEY will eventually be removed from the Linux kernel,
    ba817d2917).
  * Several IKEv2 protocol details are now handled more strictly: Unrequested virtual IPs are
    ignored, CFG_REPLY payloads are ignored if no CFG_REQUEST payloads were sent, a USE
    TRANSPORT_MODE notify received from the responder is checked against the local configuration.
  * The keys and certificates used by the scenarios in the testing environment are now generated
    dynamically. Running the testing/scripts/build-certs script after creating the base and root
    images uses the pki utility installed in the latter to create the keys and certificates for
    all the CAs and in some cases for individual scenarios. These credentials are stored in the
    source tree, not the image, so this has to be called only once even if the images are later
    rebuilt. The script automatically (re-)rebuilds the guest images as that generates fresh
    CRLs and signs the DNS zones. The only keys/certificates currently not generated are the
    very large ones used by the ikev2/rw-eap-tls-fragments scenario.
  - Version 5.7.2
  ===============
  * For RSA with PSS padding, the TPM 2.0 specification mandates the maximum salt length
    (as defined by the length of the key and hash). However, if the TPM is FIPS-168-4 compliant,
    the salt length equals the hash length. This is assumed for FIPS-140-2 compliant TPMs, but
    if that's not the case, it might be necessary to manually enable charon.plugins.tpm.fips_186_4
    if the TPM doesn't use the maximum salt length.
  * Directories for credentials loaded by swanctl are now accessed relative to the loaded
    swanctl.conf file, in particular, when loading it from a custom location via --file argument.
  * The base directory, which is used if no custom location for swanctl.conf is specified, is now
    also configurable at runtime via SWANCTL_DIR environment variable.
  * If RADIUS Accounting is enabled, the eap-radius plugin will add the session ID (Acct-Session-Id)
    to Access-Request messages, which e.g. simplifies associating database entries for IP leases and
    accounting with sessions (the session ID does not change when IKE_SAs are rekeyed, #2853).
  * All IP addresses assigned by a RADIUS server are included in Accounting-Stop messages even if
    the client did not claim them, allowing to release them early in case of connection errors (#2856).
  * Selectors installed on transport mode SAs by the kernel-netlink plugin are now updated if an
    IP address changes (e.g. via MOBIKE) and it was part of the selectors.
  * No deletes are sent anymore when a rekeyed CHILD_SA expires (#2815).
  * The bypass-lan plugin now tracks interfaces to handle subnets that move from one interface
    to another and properly update associated routes (#2820).
  * Only valid and expected inbound IKEv2 messages are used to update the timestamp of the
    last received message (previously, retransmits also triggered an update).
  * IKEv2 requests from responders are now ignored until the IKE_SA is fully established (e.g. if a
    DPD request from the peer arrives before the IKE_AUTH response does, 46bea1add9).
    Delayed IKE_SA_INIT responses with COOKIE notifies we already recevied are ignored, they caused
    another reset of the IKE_SA previously (#2837).
  * Active and queued Quick Mode tasks are now adopted if the peer reauthenticates an IKEv1 SA
    while creating lots of CHILD_SAs.
  * Newer versions of the FreeBSD kernel add an SADB_X_EXT_SA2 extension to SADB_ACQUIRE
    messages, which allows the kernel-pfkey plugin to determine the reqid of the policy even if it
    wasn't installed by the daemon previously (e.g. when using FreeBSD's if_ipsec(4) VTIs, which
    install policies themselves, 872b9b3e8d).
  * Added support for RSA signatures with SHA-256 and SHA-512 to the agent plugin. For older
    versions of ssh/gpg-agent that only support SHA-1, IKEv2 signature authentication has to be
    disabled via charon.signature_authentication.
  * The sshkey and agent plugins support Ed25519/Ed448 SSH keys and signatures.
  * The openssl plugin supports X25519/X448 Diffie-Hellman and Ed25519/Ed448 keys and
    signatures when built against OpenSSL 1.1.1.
  * Support for Ed25519, ChaCha20/Poly1305, SHA-3 and AES-CCM were added to the botan plugin.
  * The mysql plugin now properly handles database connections with transactions
    under heavy load (#2779).
  * IP addresses in ha pools are now distributed evenly among all segments (#2828).
  * Private key implementations may optionally provide a list of supported signature schemes,
    which, as described above, is used by the tpm plugin because for each key on a TPM 2.0 the
    hash algorithm and for RSA also the padding scheme is predefined.
  * The testing environment is now based on Debian 9 (stretch) by default. This required
    some changes, in particular, updating to FreeRADIUS 3.x (which forced us to abandon the
    TNC@FHH patches and scenarios, 2fbe44bef3) and removing FIPS-enabled versions of
    OpenSSL (the FIPS module only supports OpenSSL 1.0.2).
  * Most test scenarios were migrated to swanctl.
  - Version 5.7.1
  ===============
  * Fixes a vulnerability in the gmp plugin triggered by crafted certificates with RSA keys with
    very small moduli. When verifying signatures with such keys, the code patched with the fix
    for CVE-2018-16151/2 caused an integer underflow and subsequent heap buffer overflow
    that results in a crash of the daemon.
  * The vulnerability has been registered as CVE-2018-17540.
  - Version 5.7.0
  ===============
  * Fixes a potential authorization bypass vulnerability in the gmp plugin that was caused by a
    too lenient verification of PKCS#1 v1.5 signatures. Several flaws could be exploited by a
    Bleichenbacher-style attack to forge signatures for low-exponent keys (i.e. with e=3).
  * CVE-2018-16151 has been assigned to the problem of accepting random bytes after the OID
    of the hash function in such signatures, and CVE-2018-16152 has been assigned to the issue
    of not verifying that the parameters in the ASN.1 algorithmIdentitifer structure is empty.
    Other flaws that don't lead to a vulnerability directly (e.g. not checking for at least
    8 bytes of padding) have no separate CVE assigned.
  * Dots are not allowed anymore in section names in swanctl.conf and strongswan.conf.
    This mainly affects the configuration of file loggers. If the path for such a log file
    contains dots it now has to be configured in the new path setting within the arbitrarily
    renamed subsection in the filelog section.
  * Sections in swanctl.conf and strongswan.conf may now reference other sections. All settings
    and subsections from such a section are inherited. This allows to simplify configs as
    redundant information has only to be specified once and may then be included in other
    sections (see strongswan.conf for an example).
  * The originally selected IKE config (based on the IPs and IKE version) can now change
    if no matching algorithm proposal is found. This way the order of the configs doesn't
    matter that much anymore and it's easily possible to specify separate configs for
    clients that require weaker algorithms (instead of having to also add them in other
    configs that might be selected).
  * Support for Postquantum Preshared Keys for IKEv2 (draft-ietf-ipsecme-qr-ikev2) has been added.
    For an example refer to the swanctl/rw-cert-ppk scenario (or with EAP, or PSK authentication).
  * The new botan plugin is a wrapper around the Botan C++ crypto library.
    It requires a fairly recent build from Botan's master branch (or the upcoming 2.8.0 release).
    Thanks to René Korthaus and his team from Rohde &amp; Schwarz Cybersecurity for the initial
    patch and to Jack Lloyd for quickly adding missing functions to Botan's FFI (C89) interface.
  * Implementation of RFC 8412 "Software Inventory Message and Attributes (SWIMA) for PA-TNC".
  * SWIMA subscription option sets CLOSE_WRITE trigger on apt history.log file resulting in
    a ClientRetry PB-TNC batch to initialize a new measurement cycle. The new imv/imc-swima
    plugins replace the previous imv/imc-swid plugins, which were removed.
  * Added support for fuzzing the PA-TNC (RFC 5792) and PB-TNC (RFC 5793) NEA protocols
    on Google's OSS-Fuzz infrastructure.
  * Support for version 2 of Intel's TPM2-TSS TGC Software Stack. The presence of the
    in-kernel /dev/tpmrm0 resource manager is automatically detected.
  * The pki tool accepts a xmppAddr otherName as a subjectAlternativeName using the
    syntax --san xmppaddr:&lt;jid&gt;.
  * swanctl.conf supports the configuration of marks the in- and/or outbound SA should apply
    to packets after processing on Linux. Configuring such a mark for outbound SAs requires
    at least a 4.14 kernel. The ability to set a mask and configuring a mark/mask for
    inbound SAs will be added with the upcoming 4.19 kernel.
  * New options in swanctl.conf allow configuring how/whether DF, ECN and DS fields in the
    IP headers are copied during IPsec processing. Controlling this is currently only possible
    on Linux.
  * The handling of sequence numbers in IKEv1 DPDs has been improved (#2714).
  * To avoid conflicts, the dhcp plugin now only uses the DHCP server port if explicitly
    configured.
  - Version 5.6.3
  ===============
  * Fixed a DoS vulnerability in the IKEv2 key derivation if the openssl plugin is used in FIPS
    mode and HMAC-MD5 is negotiated as PRF.
    This vulnerability has been registered as CVE-2018-10811.
  * Fixed a vulnerability in the stroke plugin, which did not check the received length before
    reading a message from the socket. Unless a group is configured, root privileges are
    required to access that socket, so in the default configuration this shouldn't be an issue.
    This vulnerability has been registered as CVE-2018-5388.
  * CRLs that are not yet valid are now ignored to avoid problems in scenarios where expired
    certificates are removed from new CRLs and the clock on the host doing the revocation
    check is trailing behind that of the host issuing CRLs. Not doing this could result in
    accepting a revoked and expired certificate, if it's still valid according to the
    trailing clock but not contained anymore in not yet valid CRLs.
  * The issuer of fetched CRLs is now compared to the issuer of the checked certificate (#2608).
  * CRL validation results other than revocation (e.g. a skipped check because the CRL couldn't
    be fetched) are now stored also for intermediate CA certificates and not only for end-entity
    certificates, so a strict CRL policy can be enforced in such cases.
  * In compliance with RFC 4945, section 5.1.3.2, certificates used for IKE must now either
    not contain a keyUsage extension (like the ones generated by pki), or have at least one of the
    digitalSignature or nonRepudiation bits set.
  * New options for vici/swanctl allow forcing the local termination of an IKE_SA. This might be
    useful in situations where it's known the other end is not reachable anymore, or that it
    already removed the IKE_SA, so retransmitting a DELETE and waiting for a response would
    be pointless.
  * Waiting only a certain amount of time for a response (i.e. shorter than all retransmits
    would be) before destroying the IKE_SA is also possible by additionally specifying a
    timeout in the forced termination request.
  * When removing routes, the kernel-netlink plugin now checks if it tracks other routes for
    the same destination and replaces the installed route instead of just removing it. Same
    during installation, where existing routes previously weren't replaced. This should allow
    using traps with virtual IPs on Linux (#2162).
  * The dhcp plugin now only sends the client identifier DHCP option if the identity_lease
    setting is enabled (7b660944b6). It can also send identities of up to 255 bytes length,
    instead of the previous 64 bytes (30e886fe3b, 0e5b94d038). If a server address is
    configured, DHCP requests are now sent from port 67 instead of 68 to avoid ICMP port
    unreachables (becf027cd9).
  * The handling of faulty INVALID_KE_PAYLOAD notifies (e.g. one containing a DH group
    that wasn't proposed) during CREATE_CHILD_SA exchanges has been improved (#2536).
  * Roam events are now completely ignored for IKEv1 SAs (there is no MOBIKE to handle such
    changes properly).
  * ChaCha20/Poly1305 is now correctly proposed without key length (#2614). For compatibility with
    older releases the chacha20poly1305compat keyword may be included in proposals to also propose
    the algorithm with a key length (c58434aeff).
  * Configuration of hardware offload of IPsec SAs is now more flexible and allows a new
    setting (auto), which automatically uses it if the kernel and device both support it. If hw
    offload is set to yes and offloading is not supported, the CHILD_SA installation now fails.
  * The kernel-pfkey plugin optionally installs routes via internal interface (one with an IP
    in the local traffic selector). On FreeBSD, enabling this selects the correct source IP
    when sending packets from the gateway itself (e811659323).
  * SHA-2 based PRFs are supported in PKCS#8 files as generated by OpenSSL 1.1 (#2574).
  * The pki --verify tool may load CA certificates and CRLs from directories.
  * The IKE daemon now also switches to port 4500 if the remote port is not 500 (e.g. because the
    remote maps the response to a different port, as might happen on Azure), as long as the local
    port is 500 (85bfab621d).
  * Fixed an issue with DNS servers passed to NetworkManager in charon-nm (ee8c25516a).
  * Logged traffic selectors now always contain the protocol if either protocol or port are set
    (a36d8097ed).
  * Only the inbound SA/policy will be updated as reaction to IP address changes for rekeyed
    CHILD_SAs that are kept around.
  * The parser for strongswan.conf/swanctl.conf now accepts = characters in values without
    having to put the value in quotes (e.g. for Base64 encoded shared secrets).
    Notes for developers:
  * trap_manager_t: Trap policies are now unistalled by peer/child name and not the reqid.
  * No reqid is returned anymore when installing trap policies.
  * child_sa_t: A new state (CHILD_DELETED) is used for CHILD_SAs that have been deleted but
    not yet destroyed (after a rekeying CHILD_SAs are kept around for a while to process
    delayed packets).
    This way child_updown events are not triggered anymore for such SAs when an IKE_SA that
    has such CHILD_SAs assigned is deleted.
  - Version 5.6.2
  ===============
  * Fixed a DoS vulnerability in the parser for PKCS#1 RSASSA-PSS signatures that was caused
    by insufficient input validation. One of the configurable parameters in algorithm identifier
    structures for RSASSA-PSS signatures is the mask generation function (MGF). Only MGF1 is
    currently specified for this purpose. However, this in turn takes itself a parameter that
    specifies the underlying hash function. strongSwan's parser did not correctly handle the
    case of this parameter being absent, causing an undefined data read.
    This vulnerability has been registered as CVE-2018-6459.
  * When rekeying IKEv2 IKE_SAs the previously negotiated DH group will be reused, instead of
    using the first configured group, which avoids an additional exchange if the peer previously
    selected a different DH group via INVALID_KE_PAYLOAD notify. The same is also done when
    rekeying CHILD_SAs except for the first rekeying of the CHILD_SA that was created with the
    IKE_SA, where no DH group was negotiated yet.
    Also, the selected DH group is moved to the front in all sent proposals that contain it
    and all proposals that don't are moved to the back in order to convey the preference for
    this group to the peer.
  * Handling of MOBIKE task queuing has been improved. In particular, the response to an
    address update (with NAT-D payloads) is not ignored anymore if only an address list update
    or DPD is queued as that could prevent updating the UDP encapsulation in the kernel.
  * On Linux, roam events may optionally be triggered by changes to the routing rules, which
    can be useful if routing rules (instead of e.g. route metrics) are used to switch from one
    to another interface (i.e. from one to another routing table). Since routing rules are
    currently not evaluated when doing route lookups this is only useful if the kernel-based
    route lookup is used (4664992f7d).
  * The fallback drop policies installed to avoid traffic leaks when replacing addresses in
    installed policies are now replaced by temporary drop policies, which also prevent
    acquires because we currently delete and reinstall IPsec SAs to update their addresses
    (35ef1b032d).
  * Access X.509 certificates held in non-volatile storage of a TPM 2.0 referenced via the
    NV index.
    Adding the --keyid parameter to pki --print allows to print private keys or certificates
    stored in a smartcard or a TPM 2.0.
  * Fixed proposal selection if a peer incorrectly sends DH groups in the ESP proposal during
    IKE_AUTH and also if a DH group is configured in the local ESP proposal and charon.prefer
    configured_proposals is disabled (d058fd3c32).
  * The lookup for PSK secrets for IKEv1 has been improved for certain scenarios (see #2497
    for details).
  * MSKs received via RADIUS are now padded to 64 bytes to avoid compatibility issues with
    EAP-MSCHAPv2 and PRFs that have a block size &lt; 64 bytes (e.g. AES-XCBC-PRF-128, see
    73cbce6013).
  * The tpm_extendpcr command line tool extends a digest into a TPM PCR.
  * Ported the NetworkManager backend from the deprecated libnm-glib to libnm.
  * The save-keys debugging/development plugin saves IKE and/or ESP keys to files compatible
    with Wireshark.
  - Version 5.6.1
  ===============
  * Several algorithms were removed from the default ESP/AH and IKE proposals in compliance with
    RFC 8221 and RFC 8247, respectively. Removed from the default ESP/AH proposal were the
    3DES and Blowfish encryption algorithms and the HMAC-MD5 integrity algorithm. From the IKE
    default proposal the HMAC-MD5 integrity algorithm and the MODP-1024 Diffie-Hellman group
    were removed (the latter is significant for Windows clients in their default configuration).
    These algorithms may still be used in custom proposals.
  * Support for RSASSA-PSS signatures has been added. For compatibility with previous
    releases they are currently not used automatically, by default, to change that charon.rsa_pss
    may be enabled. To explicitly use or require such signatures during IKEv2 signature
    authentication (RFC 7427) ike:rsa/pss... authentication constraints may be used for specific
    connections (regardless of whether the strongswan.conf option above is enabled). Only the
    hash algorithm can be specified in such constraints, the MGF1 will be based on that hash
    and the salt length will equal the hash length (when verifying the salt length is not
    enforced).
    To enforce such signatures during PKI verification use rsa/pss... authentication constraints.
  * All pki commands that create certificates/CRLs can be made to sign with RSASSA-PSS instead
    of the classing PKCS#1 scheme with the --rsa-padding pss option. As with signatures during
    authentication, only the hash algorithm is configurable (via --digest option), the MGF1 will
    be based on that and the salt length will equal the hash length.
  * These signatures are supported by all RSA backends except pkcs11 (i.e. gmp, gcrypt, openssl).
    The gmp plugin requires the mgf1 plugin.
    Note that RSASSA-PSS algorithm identifiers and parameters in keys (public keys in
    certificates or private keys in PKCS#8 files) are currently not used as constraints.
  * The sec-updater tool checks for security updates in dpkg-based repositories
    (e.g. Debian/Ubuntu) and sets the security flags in the IMV policy database accordingly.
    Additionally for each new package version a SWID tag for the given OS and HW architecture
    is created and stored in the database.
  * Using the sec-updater.sh script template the lookup can be automated (e.g. via an hourly
    cron job).
  * When restarting an IKEv2 negotiation after receiving an INVALID_KE_PAYLOAD notify (or due
    to other reasons like too many retransmits) a new initiator SPI is allocated. This
    prevents issues caused by retransmits for IKE_SA_INIT messages.
  * Because the initiator SPI was previously reused when restarting the connection delayed
    responses for previous connection attempts were processed and might have caused fatal
    errors due to a failed DH negotiation or because of the internal retry counter in the
    ike-init task. For instance, if we proposed a DH group the responder rejected we
    might have later received delayed responses that either contained INVALID_KE_PAYLOAD
    notifies with the DH group we already switched to, or, if we retransmitted an
    IKE_SA_INIT with the requested group but then had to restart again, a KE payload with
    a group different from the one we proposed.
  * The introduction of file versions in the IMV database scheme broke file reference hash
    measurements. This has been fixed by creating generic product versions having an empty
    package name.
  * A new timeout option for the systime-fix plugin stops periodic system time checks after
    a while and enforces a certificate verification, closing or reauthenticating all SAs
    with invalid certificates.
  * The IKE event counters, previously only available via ipsec listcounters command, may
    now also be queried and reset via vici and the new swanctl --counters command. They
    are collected and provided by the optional counters plugin (enabled by default for
    backwards compatibility if the stroke plugin is built).
  * Class attributes received in RADIUS Access-Accept messages may optionally be added to
    RADIUS accounting messages (655924074b).
  * Basic support for systemd sockets has been added, which may be used for privilege separation
    (59db98fb94).
  * Inbound marks may optionally be installed in the SA again (was removed with 5.5.2) by
    enabling the mark_in_sa option in swanctl.conf.
  * The timeout of leases in pools configured via pool utility may be configured in other
    units than hours.
    INITIAL_CONTACT notifies are now only omitted if never is configured as uniqueness policy.
  * Outbound FWD policies for shunts are not installed anymore, by default (as is the case
    for other policies since 5.5.1).
  * Don't consider a DH group mismatch during CHILD_SA rekeying as failure as responder
    (e7276f78aa).
  * Handling of fragmented IPv4 and IPv6 packets in libipsec has been improved (e138003de9).
  * Trigger expire events for the correct IPsec SA in libipsec (6e861947a0).
  * A crash in CRL verification via openssl plugin using OpenSSL 1.1 has been fixed (78acaba6a1).
  * No hard-coded default proposals are passed from starter to the stroke plugin anymore (the
    IKE proposal used curve25519 since 5.5.2, which is an optional plugin).
  * A workaround for an issue with virtual IPs on macOS 10.13 (High Sierra) has been added
    (039b85dd43).
  * Handling of IKE_SA rekey collisions in charon-tkm has been fixed.
  * Instead of failing or just silently doing nothing unit tests may now warn about certain
    conditions (e.g. if a test was not executed due to external dependencies).</changelog>
  <changelog author="mmnelemane@suse.com" date="1585224000">- Fix for to resolve multiple definition of swanctl_dir (bsc #1164493)
  [+ 0006-Resolve-multiple-definition-of-swanctl_dir.patch]</changelog>
  <changelog author="mbuil@suse.com" date="1610712000">- Fix typo in README (bsc #1167880)
  [+ 0007-Fix-typo-in-README.patch ]</changelog>
  <changelog author="mbuil@suse.com" date="1611576000">- Fix FIPS bug (bsc #1180801)
  [+ 0008-gcrypt-Use-a-dummy-buffer-to-initialize-static-alloc.patch ]</changelog>
  <changelog author="mbuil@suse.com" date="1617019200">- Keep using ipsec as the main binary. Therefore, make strongswan.service point to it instead of swanctl</changelog>
  <changelog author="mbuil@suse.com" date="1617019201">- Information added in README about the rcstrongswan-starter</changelog>
  <changelog author="mbuil@suse.com" date="1617624000">- Add config to run ipsec on namespaces (bsc #1183670)</changelog>
  <changelog author="mt@suse.com" date="1619006400">- Add support for AES CCM aead algorithms to openssl plugin (cc/fips,bsc#1185363)
  [+ 0009-strongswan-openssl-aead-add-ccm-support.patch]</changelog>
  <changelog author="mt@suse.com" date="1620388800">- Replace AEAD AES CCM patch with upstream variant (cc/fips,bsc#1185363)
  [* 0009-strongswan-openssl-aead-add-ccm-support.patch]</changelog>
  <changelog author="hare@suse.de" date="1627646400">- Add auth_els plugin to support Marvell FC-SP encryption (jsc#SLE-20151)
  [* strongswan-marvell-auth-els.patch]</changelog>
  <changelog author="abergmann@suse.com" date="1634040000">- Fix integer overflow in gmp plugin (bsc#1191367, CVE-2021-41990)
  [* strongswan-5.6.1-5.9.3_gmp-rsa-ssa-salt-len.patch]
- Fix integer overflow when replacing certificates in cache (bsc#1191435, CVE-2021-41991)
  [* strongswan-4.4.1-5.9.3_cert-cache-random.patch]</changelog>
  <changelog author="meissner@suse.com" date="1643025600">- strongswan-5.5.0-5.9.4_eap_success-CVE-2021-45079.patch:
  Fixed authentication bypass in EAP authentication (CVE-2021-45079
  bsc#1194471)</changelog>
</package>
<package pkgid="d0c009c3f9a45ca91c3813a2ca4b9421411c044892da62815285d9fdb32e6920" name="strongswan" arch="s390x">
  <version epoch="0" ver="5.8.2" rel="11.24.1"/>
  <changelog author="ndas@suse.de" date="1501502400">- Updated to strongSwan 5.3.5(bsc#1050691) providing the following changes:
  * Fixed a DoS vulnerability in the gmp plugin that was caused by insufficient input
    validation when verifying RSA signatures. More specifically, mpz_powm_sec() has two
    requirements regarding the passed exponent and modulus that the plugin did not
    enforce, if these are not met the calculation will result in a floating point exception
    that crashes the whole process.
    This vulnerability has been registered as CVE-2017-9022.
    Please refer to our blog for details.
  * Fixed a DoS vulnerability in the x509 plugin that was caused because the ASN.1 parser
    didn't handle ASN.1 CHOICE types properly, which could result in an infinite loop when
    parsing X.509 extensions that use such types.
    This vulnerability has been registered as CVE-2017-9023.
    Please refer to our blog for details.
  * The behavior during IKEv2 CHILD_SA rekeying has been changed in order to avoid
    traffic loss. When responding to a CREATE_CHILD_SA request to rekey a CHILD_SA
    the responder already has everything available to install and use the new CHILD_SA.
    However, this could lead to lost traffic as the initiator won't be able to process
    inbound packets until it processed the CREATE_CHILD_SA response and updated the
    inbound SA. To avoid this the responder now only installs the new inbound SA and
    delays installing the outbound SA until it receives the DELETE for the replaced CHILD_SA.
  * The messages transporting these DELETEs could reach the peer before packets sent
    with the deleted outbound SAs reach it. To reduce the chance of traffic loss due
    to this the inbound SA of the replaced CHILD_SA is not removed for a configurable
    amount of seconds (charon.delete_rekeyed_delay) after the DELETE has been processed.
  * The code base has been ported to Apple's ARM64 iOS platform, which required several
    changes regarding the use of variadic functions. This was necessary because the calling
    conventions for variadic and regular functions are different there.
    This means that assigning a non-variadic function to a variadic function pointer, as we
    did with our enumerator_t::enumerate() implementations and several callbacks, will
    result in crashes as the called function accesses the arguments differently than the
    caller provided them. To avoid this issue the enumerator_t interface has been changed
    and the signature of the callback functions for enumerator_create_filter() and two
    methods on linked_list_t have been changed. Refer to the developer notes below
    for details.
  * Adds support for fuzzing the certificate parser provided by the default plugins
    (x509, pem, gmp etc.) on Google's OSS-Fuzz infrastructure (or generally with
    libFuzzer). Several issues found while fuzzing these plugins were fixed.
  * Two new options have been added to charon's retransmission settings:
    retransmit_limit and retransmit_jitter. The former adds an upper limit to the
    calculated retransmission timeout, the latter randomly reduces it.
    Refer to Retransmission for details.
  * A bug in swanctl's --load-creds command was fixed that caused unencrypted
    private keys to get unloaded if the command was called multiple times.
    The load-key VICI command now returns the key ID of the loaded key on success.
  * The credential manager now enumerates local credential sets before global ones.
    This means certificates supplied by the peer will now be preferred over certificates
    with the same identity that may be locally stored (e.g. in the certificate cache).
  * Adds support for hardware offload of IPsec SAs as introduced by Linux 4.11 for
    specific hardware that supports this.
  * The pki tool loads the curve25519 plugin by default.
    [- 0006-Make-sure-the-modulus-is-odd-and-the-exponent-not-zero.patch,
  - 0007-asn1-parser-Fix-CHOICE-parsing.patch]
- libhydra is removed as all kernel plugins moved to libcharon</changelog>
  <changelog author="ndas@suse.de" date="1504612800">- fix "uintptr_t? undeclared" compilation error.
  [+0006-fix-compilation-error-by-adding-stdint.h.patch]</changelog>
  <changelog author="ndas@suse.de" date="1504612801">- Updated to strongSwan 5.6.0 providing the following changes:
  * Fixed a DoS vulnerability in the gmp plugin that was caused by insufficient input validation
    when verifying RSA signatures, which requires decryption with the operation m^e mod n,
    where m is the signature, and e and n are the exponent and modulus of the public key.
    The value m is an integer between 0 and n-1, however, the gmp plugin did not verify this.
    So if m equals n the calculation results in 0, in which case mpz_export() returns NULL.
    This result wasn't handled properly causing a null-pointer dereference.
    This vulnerability has been registered as CVE-2017-11185. (bsc#1051222)
  * New SWIMA IMC/IMV pair implements the draft-ietf-sacm-nea-swima-patnc Internet
    Draft and has been demonstrated at the IETF 99 Prague Hackathon.
  * The IMV database template has been adapted to achieve full compliance with the
    ISO 19770-2:2015 SWID tag standard.
  * The pt-tls-client can attach and use TPM 2.0 protected private keys via the --keyid parameter.
  * By default the /etc/swanctl/conf.d directory is created and *.conf files in it are included in the default
    swanctl.conf file.
  * The curl plugin now follows HTTP redirects (configurable via strongswan.conf).
  * The CHILD_SA rekeying was fixed in charon-tkm and the behavior is refined a bit more since 5.5.3
  * libtpmtss supports Intel's TSS2 Architecture Broker and Resource Manager interface (tcti-tabrmd).
  * more on https://wiki.strongswan.org/versions/66</changelog>
  <changelog author="mmnelemane@suse.com" date="1521028800">- Removed unused requires and macro calls(bsc#1083261)</changelog>
  <changelog author="mmnelemane@suse.com" date="1573646400">- Added patch to fix vulnerability: CVE-2018-16151,CVE-2018-16152 (bsc#1107874)
  - Insufficient input validation in gmp plugin
  [+ 0007-strongswan-5.3.1-5.6.0_gmp-pkcs1-verify.patch]</changelog>
  <changelog author="mmnelemane@suse.com" date="1573646401">- Added patch to fix vulnerability: CVE-2018-5388 (bsc#1094462)
  - Buffer Underflow in stroke_socket.c
  [+ 0008-strongswan-5.1.2-5.6.2_stroke_msg_len.patch]</changelog>
  <changelog author="mmnelemane@suse.com" date="1573646402">- Added patch to fix vulnerability: CVE-2018-10811 (bsc#1093536)
  - denial-of-service vulnerability
  [+ 0009-strongswan-5.5.0-5.6.2_skeyseed_init.patch]</changelog>
  <changelog author="mmnelemane@suse.com" date="1573732800">- Added patch to fix vulnerability: CVE-2018-17540 (bsc#1109845)
  [+ 0010-strongswan-4.4.0-5.7.0_gmp-pkcs1-overflow.patch]</changelog>
  <changelog author="mmnelemane@suse.com" date="1580212800">- Updated to version 5.8.2 (jsc#SLE-11370)
  - Dropped following patches due to irrelevance in the updated version:
    [- strongswan_modprobe_syslog.patch ]
    [- strongswan_fipsfilter.patch ]
    [- 0006-fix-compilation-error-by-adding-stdint.h.patch ]
    [- 0007-strongswan-5.3.1-5.6.0_gmp-pkcs1-verify.patch ]
    [- 0008-strongswan-5.1.2-5.6.2_stroke_msg_len.patch ]
    [- 0009-strongswan-5.5.0-5.6.2_skeyseed_init.patch ]
    [- 0010-strongswan-4.4.0-5.7.0_gmp-pkcs1-overflow.patch ]
  - Version 5.8.2
  ===============
  * Identity-based CA constraints, which enforce that the certificate chain of the remote
    peer contains a CA certificate with a specific identity, are supported via
    vici/swanctl.conf. This is similar to the existing CA constraints but doesn't require
    that the CA certificate is locally installed, for instance, intermediate CA certificates
    received from the peers. Wildcard identity matching (e.g. ..., OU=Research, CN=*) could
    also be used for the latter but requires trust in the intermediate CAs to only issue
    certificates with legitimate subject DNs (e.g. the "Sales" CA must not issue certificates
    with OU=Research). With the new constraint that's not necessary as long as a path length
    basic constraint (--pathlen for pki --issue) prevents intermediate CAs from issuing further
    intermediate CAs.
  * Intermediate CA certificates may now be sent in hash-and-URL encoding by configuring a
    base URL for the parent CA (#3234, swanctl/rw-hash-and-url-multi-level).
  * Implemented NIST SP-800-90A Deterministic Random Bit Generator (DRBG) based on AES-CTR
    and SHA2-HMAC modes. Currently used by the gmp and ntru plugins.
  * Random nonces sent in an OCSP requests are now expected in the corresponding OCSP responses.
  * The kernel-netlink plugin now ignores deprecated IPv6 addresses for MOBIKE. Whether temporary
    or permanent IPv6 addresses are included now depends on the charon.prefer_temporary_addrs
    setting (#3192).
  * Extended Sequence Numbers (ESN) are configured via PF_KEY if supported by the kernel.
  * The PF_KEY socket's receive buffer in the kernel-pfkey plugin is now cleared before sending
    requests, as many of the messages sent by the kernel are sent as broadcasts to all PF_KEY
    sockets. This is an issue if an external tool is used to manage SAs/policies unrelated to
    IPsec (#3225).
  * The vici plugin now uses unique section names for CHILD_SAs in child-updown events (7c74ce9190).
  * For individually deleted CHILD_SAs (in particular for IKEv1) the vici child-updown event
    now includes more information about the CHILD_SAs such as traffic statistics (#3198).
  * Custom loggers are correctly re-registered if log levels are changed via stroke loglevel (#3182).
  * Avoid lockups during startup on low entropy systems when using OpenSSL 1.1.1 (095a2c2eac).
  * Instead of failing later when setting a key, creating HMACs via openssl plugin now fails
    instantly if the underlying hash algorithm isn't supported (e.g. MD5 in FIPS-mode) so fallbacks
    to other plugins work properly (#3284).
  * Exponents of RSA keys read from TPM 2.0 via SAPI are correctly converted (8ee1242f1438).
  * Routing table IDs &gt; 255 are supported for custom routes on Linux.
  * To avoid races, the check for hardware offloading support in the kernel-netlink plugin is
    performed during initialization of the plugin (a605452c03).
  * The D-Bus config file for charon-nm is now installed in $(datadir)/dbus-1/system.d instead of
    $(sysconfdir)/dbus-1/system.d, which is intended for sysadmin overrides.
    INVALID_MAJOR_VERSION notifies are now correctly sent in messages of the same exchange type
    and with the same message ID as the request.
  * IKEv2 SAs are now immediately destroyed when sending or receiving INVALID_SYNTAX notifies
    in authenticated messages.
  * For developers working from the repository the configure script now aborts if GNU gperf is
    not found.
  - Version 5.8.1
  ===============
  * RDNs in DNs of X.509 certificates can now optionally be matched less strict. The global
    strongswan.conf option charon.rdn_matching takes two alternative values that cause the
    matching algorithm to either ignore the order of matched RDNs (reordered) or additionally
    (relaxed) accept DNs that contain more RDNs than configured (unmatched RDNs are treated
    like wildcard matches).
  * The updown plugin now passes the same interface to the script that is also used for the
    automatically installed routes, that is, the interface over which the peer is reached
    instead of the interface on which the local address is found (#3095).
  * TPM 2.0 contexts are now protected by a mutex to prevent issues if multiple IKE_SAs use
    the same private key concurrently (4b25885025).
  * Do a rekey check after the third QM message was received (#3060).
  * If available, explicit_bzero() is now used as memwipe() instead of our own implementation.
  * An .editorconfig file has been added, mainly so Github shows files with proper indentation
    (68346b6962).
  * The internal certificate of the load-tester plugin has been modified so it can again be
    used as end-entity cert with 5.6.3 and later (#3139).
  * The maximum data length of received COOKIE notifies (64 bytes) is now enforced (#3160).
  - Version 5.8.0
  ===============
  * The systemd service units have been renamed. The modern unit, which was called
    strongswan-swanctl, is now called strongswan (the previous name is configured as alias in
    the unit, for which a symlink is created when the unit is enabled). The legacy unit is now
    called strongswan-starter.
  * Support for XFRM interfaces (available since Linux 4.19) has been added, which are intended
    to replace VTI devices (they are similar but offer several advantages, for instance, they
    are not bound to an address or address family).
  * IPsec SAs and policies are associated with such interfaces via interface IDs that can be
    configured in swanctl.conf (dynamic IDs may optionally be allocated for each SA and even
    direction). It's possible to use separate interfaces for in- and outbound traffic (or
    only use an interface in one direction and regular policies in the other).
  * Interfaces may be created dynamically via updown/vici scripts, or statically before or after
    establishing the SAs. Routes must be added manually as needed (the daemon will not install
    any routes for outbound policies with an interface ID).
  * When moving XFRM interfaces to other network namespaces they retain access to the SAs and
    policies installed in the original namespace, which allows providing IPsec tunnels for
    processes in other network namespaces without giving them access to the IPsec keys or
    IKE credentials.
    More information can be found on the page about route-based VPNs.
  * Initiation of childless IKE_SAs is supported (RFC 6023). If enabled and supported by the
    responder, no CHILD_SA is established during IKE_AUTH. Instead, all CHILD_SAs are created
    with CREATE_CHILD_SA exchanges. This allows using a separate DH exchange even for the
    first CHILD_SA, which is otherwise created during IKE_AUTH with keys derived from the
    IKE_SA's key material.
  * The swanctl --initiate command may be used to initiate only the IKE_SA via --ike
    option if --child is omitted and the peer supports this extension.
  * The NetworkManager backend and plugin support IPv6.
  * The new wolfssl plugin is a wrapper around the wolfSSL crypto library. Thanks to Sean
    Parkinson of wolfSSL Inc. for the initial patch.
  * IKE SPIs may optionally be labeled via the charon.spi_mask|label options in
    strongswan.conf. This feature was extracted from charon-tkm, however, now applies the
    mask/label in network order.
  * The openssl plugin supports ChaCha20-Poly1305 when built with OpenSSL 1.1.0.
  * The PB-TNC finite state machine according to section 3.2 of RFC 5793 was not correctly
    implemented when sending either a CRETRY or SRETRY batch. These batches can only be sent
    in the "Decided" state and a CRETRY batch can immediately carry all messages usually
    transported by a CDATA batch. It is currently not possible to send a SRETRY batch since
    full-duplex mode for PT-TLS transport is not supported.
  * Instead of marking IPv6 virtual IPs as deprecated, the kernel-netlink plugin now uses
    address labels to avoid that such addresses are used for non-VPN traffic (00a953d090).
  * The agent plugin now creates sockets to the ssh/gpg-agent dynamically and does not keep
    them open, which otherwise might prevent the agent from getting terminated.
  * To avoid broadcast loops the forecast plugin now only reinjects packets that are marked
    or received from the configured interface.
  * UTF-8 encoded passwords are supported via EAP-MSCHAPv2, which internally uses an UTF-16LE
    encoding to calculate the NT hash (#3014).
  * Properly delete temporary drop policies (used when updating IP addresses of SAs) if manual
    priorities are used, which was broken since 5.6.2 (8e31d65730).
  * Avoid overwriting start_action when parsing the inactivity timeout in the vici plugin (#2954).
  * Fixed the automatic termination of reloaded vici connections with start_action=start,
    which was broken since 5.6.3 (71b22c250f).
  * The lookup for shared secrets for IKEv1 SAs via sql plugin should now work better
    (6ec9f68f32).
  * Fixed a race condition in the trap manager between installation and removal of a policy
    (69cbe2ca3f).
  * Compilation of the kernel-netlink plugin has been fixed on old kernels (&lt; 2.6.39), which
    was caused by the HW offload changes (c7f579fa17).
  * The IPsec stack detection and module loading in starter has been removed (it wasn't
    enforced anyway and loading modules doesn't seem necessary, also KLIPS hasn't been
    supported for a long time and PF_KEY will eventually be removed from the Linux kernel,
    ba817d2917).
  * Several IKEv2 protocol details are now handled more strictly: Unrequested virtual IPs are
    ignored, CFG_REPLY payloads are ignored if no CFG_REQUEST payloads were sent, a USE
    TRANSPORT_MODE notify received from the responder is checked against the local configuration.
  * The keys and certificates used by the scenarios in the testing environment are now generated
    dynamically. Running the testing/scripts/build-certs script after creating the base and root
    images uses the pki utility installed in the latter to create the keys and certificates for
    all the CAs and in some cases for individual scenarios. These credentials are stored in the
    source tree, not the image, so this has to be called only once even if the images are later
    rebuilt. The script automatically (re-)rebuilds the guest images as that generates fresh
    CRLs and signs the DNS zones. The only keys/certificates currently not generated are the
    very large ones used by the ikev2/rw-eap-tls-fragments scenario.
  - Version 5.7.2
  ===============
  * For RSA with PSS padding, the TPM 2.0 specification mandates the maximum salt length
    (as defined by the length of the key and hash). However, if the TPM is FIPS-168-4 compliant,
    the salt length equals the hash length. This is assumed for FIPS-140-2 compliant TPMs, but
    if that's not the case, it might be necessary to manually enable charon.plugins.tpm.fips_186_4
    if the TPM doesn't use the maximum salt length.
  * Directories for credentials loaded by swanctl are now accessed relative to the loaded
    swanctl.conf file, in particular, when loading it from a custom location via --file argument.
  * The base directory, which is used if no custom location for swanctl.conf is specified, is now
    also configurable at runtime via SWANCTL_DIR environment variable.
  * If RADIUS Accounting is enabled, the eap-radius plugin will add the session ID (Acct-Session-Id)
    to Access-Request messages, which e.g. simplifies associating database entries for IP leases and
    accounting with sessions (the session ID does not change when IKE_SAs are rekeyed, #2853).
  * All IP addresses assigned by a RADIUS server are included in Accounting-Stop messages even if
    the client did not claim them, allowing to release them early in case of connection errors (#2856).
  * Selectors installed on transport mode SAs by the kernel-netlink plugin are now updated if an
    IP address changes (e.g. via MOBIKE) and it was part of the selectors.
  * No deletes are sent anymore when a rekeyed CHILD_SA expires (#2815).
  * The bypass-lan plugin now tracks interfaces to handle subnets that move from one interface
    to another and properly update associated routes (#2820).
  * Only valid and expected inbound IKEv2 messages are used to update the timestamp of the
    last received message (previously, retransmits also triggered an update).
  * IKEv2 requests from responders are now ignored until the IKE_SA is fully established (e.g. if a
    DPD request from the peer arrives before the IKE_AUTH response does, 46bea1add9).
    Delayed IKE_SA_INIT responses with COOKIE notifies we already recevied are ignored, they caused
    another reset of the IKE_SA previously (#2837).
  * Active and queued Quick Mode tasks are now adopted if the peer reauthenticates an IKEv1 SA
    while creating lots of CHILD_SAs.
  * Newer versions of the FreeBSD kernel add an SADB_X_EXT_SA2 extension to SADB_ACQUIRE
    messages, which allows the kernel-pfkey plugin to determine the reqid of the policy even if it
    wasn't installed by the daemon previously (e.g. when using FreeBSD's if_ipsec(4) VTIs, which
    install policies themselves, 872b9b3e8d).
  * Added support for RSA signatures with SHA-256 and SHA-512 to the agent plugin. For older
    versions of ssh/gpg-agent that only support SHA-1, IKEv2 signature authentication has to be
    disabled via charon.signature_authentication.
  * The sshkey and agent plugins support Ed25519/Ed448 SSH keys and signatures.
  * The openssl plugin supports X25519/X448 Diffie-Hellman and Ed25519/Ed448 keys and
    signatures when built against OpenSSL 1.1.1.
  * Support for Ed25519, ChaCha20/Poly1305, SHA-3 and AES-CCM were added to the botan plugin.
  * The mysql plugin now properly handles database connections with transactions
    under heavy load (#2779).
  * IP addresses in ha pools are now distributed evenly among all segments (#2828).
  * Private key implementations may optionally provide a list of supported signature schemes,
    which, as described above, is used by the tpm plugin because for each key on a TPM 2.0 the
    hash algorithm and for RSA also the padding scheme is predefined.
  * The testing environment is now based on Debian 9 (stretch) by default. This required
    some changes, in particular, updating to FreeRADIUS 3.x (which forced us to abandon the
    TNC@FHH patches and scenarios, 2fbe44bef3) and removing FIPS-enabled versions of
    OpenSSL (the FIPS module only supports OpenSSL 1.0.2).
  * Most test scenarios were migrated to swanctl.
  - Version 5.7.1
  ===============
  * Fixes a vulnerability in the gmp plugin triggered by crafted certificates with RSA keys with
    very small moduli. When verifying signatures with such keys, the code patched with the fix
    for CVE-2018-16151/2 caused an integer underflow and subsequent heap buffer overflow
    that results in a crash of the daemon.
  * The vulnerability has been registered as CVE-2018-17540.
  - Version 5.7.0
  ===============
  * Fixes a potential authorization bypass vulnerability in the gmp plugin that was caused by a
    too lenient verification of PKCS#1 v1.5 signatures. Several flaws could be exploited by a
    Bleichenbacher-style attack to forge signatures for low-exponent keys (i.e. with e=3).
  * CVE-2018-16151 has been assigned to the problem of accepting random bytes after the OID
    of the hash function in such signatures, and CVE-2018-16152 has been assigned to the issue
    of not verifying that the parameters in the ASN.1 algorithmIdentitifer structure is empty.
    Other flaws that don't lead to a vulnerability directly (e.g. not checking for at least
    8 bytes of padding) have no separate CVE assigned.
  * Dots are not allowed anymore in section names in swanctl.conf and strongswan.conf.
    This mainly affects the configuration of file loggers. If the path for such a log file
    contains dots it now has to be configured in the new path setting within the arbitrarily
    renamed subsection in the filelog section.
  * Sections in swanctl.conf and strongswan.conf may now reference other sections. All settings
    and subsections from such a section are inherited. This allows to simplify configs as
    redundant information has only to be specified once and may then be included in other
    sections (see strongswan.conf for an example).
  * The originally selected IKE config (based on the IPs and IKE version) can now change
    if no matching algorithm proposal is found. This way the order of the configs doesn't
    matter that much anymore and it's easily possible to specify separate configs for
    clients that require weaker algorithms (instead of having to also add them in other
    configs that might be selected).
  * Support for Postquantum Preshared Keys for IKEv2 (draft-ietf-ipsecme-qr-ikev2) has been added.
    For an example refer to the swanctl/rw-cert-ppk scenario (or with EAP, or PSK authentication).
  * The new botan plugin is a wrapper around the Botan C++ crypto library.
    It requires a fairly recent build from Botan's master branch (or the upcoming 2.8.0 release).
    Thanks to René Korthaus and his team from Rohde &amp; Schwarz Cybersecurity for the initial
    patch and to Jack Lloyd for quickly adding missing functions to Botan's FFI (C89) interface.
  * Implementation of RFC 8412 "Software Inventory Message and Attributes (SWIMA) for PA-TNC".
  * SWIMA subscription option sets CLOSE_WRITE trigger on apt history.log file resulting in
    a ClientRetry PB-TNC batch to initialize a new measurement cycle. The new imv/imc-swima
    plugins replace the previous imv/imc-swid plugins, which were removed.
  * Added support for fuzzing the PA-TNC (RFC 5792) and PB-TNC (RFC 5793) NEA protocols
    on Google's OSS-Fuzz infrastructure.
  * Support for version 2 of Intel's TPM2-TSS TGC Software Stack. The presence of the
    in-kernel /dev/tpmrm0 resource manager is automatically detected.
  * The pki tool accepts a xmppAddr otherName as a subjectAlternativeName using the
    syntax --san xmppaddr:&lt;jid&gt;.
  * swanctl.conf supports the configuration of marks the in- and/or outbound SA should apply
    to packets after processing on Linux. Configuring such a mark for outbound SAs requires
    at least a 4.14 kernel. The ability to set a mask and configuring a mark/mask for
    inbound SAs will be added with the upcoming 4.19 kernel.
  * New options in swanctl.conf allow configuring how/whether DF, ECN and DS fields in the
    IP headers are copied during IPsec processing. Controlling this is currently only possible
    on Linux.
  * The handling of sequence numbers in IKEv1 DPDs has been improved (#2714).
  * To avoid conflicts, the dhcp plugin now only uses the DHCP server port if explicitly
    configured.
  - Version 5.6.3
  ===============
  * Fixed a DoS vulnerability in the IKEv2 key derivation if the openssl plugin is used in FIPS
    mode and HMAC-MD5 is negotiated as PRF.
    This vulnerability has been registered as CVE-2018-10811.
  * Fixed a vulnerability in the stroke plugin, which did not check the received length before
    reading a message from the socket. Unless a group is configured, root privileges are
    required to access that socket, so in the default configuration this shouldn't be an issue.
    This vulnerability has been registered as CVE-2018-5388.
  * CRLs that are not yet valid are now ignored to avoid problems in scenarios where expired
    certificates are removed from new CRLs and the clock on the host doing the revocation
    check is trailing behind that of the host issuing CRLs. Not doing this could result in
    accepting a revoked and expired certificate, if it's still valid according to the
    trailing clock but not contained anymore in not yet valid CRLs.
  * The issuer of fetched CRLs is now compared to the issuer of the checked certificate (#2608).
  * CRL validation results other than revocation (e.g. a skipped check because the CRL couldn't
    be fetched) are now stored also for intermediate CA certificates and not only for end-entity
    certificates, so a strict CRL policy can be enforced in such cases.
  * In compliance with RFC 4945, section 5.1.3.2, certificates used for IKE must now either
    not contain a keyUsage extension (like the ones generated by pki), or have at least one of the
    digitalSignature or nonRepudiation bits set.
  * New options for vici/swanctl allow forcing the local termination of an IKE_SA. This might be
    useful in situations where it's known the other end is not reachable anymore, or that it
    already removed the IKE_SA, so retransmitting a DELETE and waiting for a response would
    be pointless.
  * Waiting only a certain amount of time for a response (i.e. shorter than all retransmits
    would be) before destroying the IKE_SA is also possible by additionally specifying a
    timeout in the forced termination request.
  * When removing routes, the kernel-netlink plugin now checks if it tracks other routes for
    the same destination and replaces the installed route instead of just removing it. Same
    during installation, where existing routes previously weren't replaced. This should allow
    using traps with virtual IPs on Linux (#2162).
  * The dhcp plugin now only sends the client identifier DHCP option if the identity_lease
    setting is enabled (7b660944b6). It can also send identities of up to 255 bytes length,
    instead of the previous 64 bytes (30e886fe3b, 0e5b94d038). If a server address is
    configured, DHCP requests are now sent from port 67 instead of 68 to avoid ICMP port
    unreachables (becf027cd9).
  * The handling of faulty INVALID_KE_PAYLOAD notifies (e.g. one containing a DH group
    that wasn't proposed) during CREATE_CHILD_SA exchanges has been improved (#2536).
  * Roam events are now completely ignored for IKEv1 SAs (there is no MOBIKE to handle such
    changes properly).
  * ChaCha20/Poly1305 is now correctly proposed without key length (#2614). For compatibility with
    older releases the chacha20poly1305compat keyword may be included in proposals to also propose
    the algorithm with a key length (c58434aeff).
  * Configuration of hardware offload of IPsec SAs is now more flexible and allows a new
    setting (auto), which automatically uses it if the kernel and device both support it. If hw
    offload is set to yes and offloading is not supported, the CHILD_SA installation now fails.
  * The kernel-pfkey plugin optionally installs routes via internal interface (one with an IP
    in the local traffic selector). On FreeBSD, enabling this selects the correct source IP
    when sending packets from the gateway itself (e811659323).
  * SHA-2 based PRFs are supported in PKCS#8 files as generated by OpenSSL 1.1 (#2574).
  * The pki --verify tool may load CA certificates and CRLs from directories.
  * The IKE daemon now also switches to port 4500 if the remote port is not 500 (e.g. because the
    remote maps the response to a different port, as might happen on Azure), as long as the local
    port is 500 (85bfab621d).
  * Fixed an issue with DNS servers passed to NetworkManager in charon-nm (ee8c25516a).
  * Logged traffic selectors now always contain the protocol if either protocol or port are set
    (a36d8097ed).
  * Only the inbound SA/policy will be updated as reaction to IP address changes for rekeyed
    CHILD_SAs that are kept around.
  * The parser for strongswan.conf/swanctl.conf now accepts = characters in values without
    having to put the value in quotes (e.g. for Base64 encoded shared secrets).
    Notes for developers:
  * trap_manager_t: Trap policies are now unistalled by peer/child name and not the reqid.
  * No reqid is returned anymore when installing trap policies.
  * child_sa_t: A new state (CHILD_DELETED) is used for CHILD_SAs that have been deleted but
    not yet destroyed (after a rekeying CHILD_SAs are kept around for a while to process
    delayed packets).
    This way child_updown events are not triggered anymore for such SAs when an IKE_SA that
    has such CHILD_SAs assigned is deleted.
  - Version 5.6.2
  ===============
  * Fixed a DoS vulnerability in the parser for PKCS#1 RSASSA-PSS signatures that was caused
    by insufficient input validation. One of the configurable parameters in algorithm identifier
    structures for RSASSA-PSS signatures is the mask generation function (MGF). Only MGF1 is
    currently specified for this purpose. However, this in turn takes itself a parameter that
    specifies the underlying hash function. strongSwan's parser did not correctly handle the
    case of this parameter being absent, causing an undefined data read.
    This vulnerability has been registered as CVE-2018-6459.
  * When rekeying IKEv2 IKE_SAs the previously negotiated DH group will be reused, instead of
    using the first configured group, which avoids an additional exchange if the peer previously
    selected a different DH group via INVALID_KE_PAYLOAD notify. The same is also done when
    rekeying CHILD_SAs except for the first rekeying of the CHILD_SA that was created with the
    IKE_SA, where no DH group was negotiated yet.
    Also, the selected DH group is moved to the front in all sent proposals that contain it
    and all proposals that don't are moved to the back in order to convey the preference for
    this group to the peer.
  * Handling of MOBIKE task queuing has been improved. In particular, the response to an
    address update (with NAT-D payloads) is not ignored anymore if only an address list update
    or DPD is queued as that could prevent updating the UDP encapsulation in the kernel.
  * On Linux, roam events may optionally be triggered by changes to the routing rules, which
    can be useful if routing rules (instead of e.g. route metrics) are used to switch from one
    to another interface (i.e. from one to another routing table). Since routing rules are
    currently not evaluated when doing route lookups this is only useful if the kernel-based
    route lookup is used (4664992f7d).
  * The fallback drop policies installed to avoid traffic leaks when replacing addresses in
    installed policies are now replaced by temporary drop policies, which also prevent
    acquires because we currently delete and reinstall IPsec SAs to update their addresses
    (35ef1b032d).
  * Access X.509 certificates held in non-volatile storage of a TPM 2.0 referenced via the
    NV index.
    Adding the --keyid parameter to pki --print allows to print private keys or certificates
    stored in a smartcard or a TPM 2.0.
  * Fixed proposal selection if a peer incorrectly sends DH groups in the ESP proposal during
    IKE_AUTH and also if a DH group is configured in the local ESP proposal and charon.prefer
    configured_proposals is disabled (d058fd3c32).
  * The lookup for PSK secrets for IKEv1 has been improved for certain scenarios (see #2497
    for details).
  * MSKs received via RADIUS are now padded to 64 bytes to avoid compatibility issues with
    EAP-MSCHAPv2 and PRFs that have a block size &lt; 64 bytes (e.g. AES-XCBC-PRF-128, see
    73cbce6013).
  * The tpm_extendpcr command line tool extends a digest into a TPM PCR.
  * Ported the NetworkManager backend from the deprecated libnm-glib to libnm.
  * The save-keys debugging/development plugin saves IKE and/or ESP keys to files compatible
    with Wireshark.
  - Version 5.6.1
  ===============
  * Several algorithms were removed from the default ESP/AH and IKE proposals in compliance with
    RFC 8221 and RFC 8247, respectively. Removed from the default ESP/AH proposal were the
    3DES and Blowfish encryption algorithms and the HMAC-MD5 integrity algorithm. From the IKE
    default proposal the HMAC-MD5 integrity algorithm and the MODP-1024 Diffie-Hellman group
    were removed (the latter is significant for Windows clients in their default configuration).
    These algorithms may still be used in custom proposals.
  * Support for RSASSA-PSS signatures has been added. For compatibility with previous
    releases they are currently not used automatically, by default, to change that charon.rsa_pss
    may be enabled. To explicitly use or require such signatures during IKEv2 signature
    authentication (RFC 7427) ike:rsa/pss... authentication constraints may be used for specific
    connections (regardless of whether the strongswan.conf option above is enabled). Only the
    hash algorithm can be specified in such constraints, the MGF1 will be based on that hash
    and the salt length will equal the hash length (when verifying the salt length is not
    enforced).
    To enforce such signatures during PKI verification use rsa/pss... authentication constraints.
  * All pki commands that create certificates/CRLs can be made to sign with RSASSA-PSS instead
    of the classing PKCS#1 scheme with the --rsa-padding pss option. As with signatures during
    authentication, only the hash algorithm is configurable (via --digest option), the MGF1 will
    be based on that and the salt length will equal the hash length.
  * These signatures are supported by all RSA backends except pkcs11 (i.e. gmp, gcrypt, openssl).
    The gmp plugin requires the mgf1 plugin.
    Note that RSASSA-PSS algorithm identifiers and parameters in keys (public keys in
    certificates or private keys in PKCS#8 files) are currently not used as constraints.
  * The sec-updater tool checks for security updates in dpkg-based repositories
    (e.g. Debian/Ubuntu) and sets the security flags in the IMV policy database accordingly.
    Additionally for each new package version a SWID tag for the given OS and HW architecture
    is created and stored in the database.
  * Using the sec-updater.sh script template the lookup can be automated (e.g. via an hourly
    cron job).
  * When restarting an IKEv2 negotiation after receiving an INVALID_KE_PAYLOAD notify (or due
    to other reasons like too many retransmits) a new initiator SPI is allocated. This
    prevents issues caused by retransmits for IKE_SA_INIT messages.
  * Because the initiator SPI was previously reused when restarting the connection delayed
    responses for previous connection attempts were processed and might have caused fatal
    errors due to a failed DH negotiation or because of the internal retry counter in the
    ike-init task. For instance, if we proposed a DH group the responder rejected we
    might have later received delayed responses that either contained INVALID_KE_PAYLOAD
    notifies with the DH group we already switched to, or, if we retransmitted an
    IKE_SA_INIT with the requested group but then had to restart again, a KE payload with
    a group different from the one we proposed.
  * The introduction of file versions in the IMV database scheme broke file reference hash
    measurements. This has been fixed by creating generic product versions having an empty
    package name.
  * A new timeout option for the systime-fix plugin stops periodic system time checks after
    a while and enforces a certificate verification, closing or reauthenticating all SAs
    with invalid certificates.
  * The IKE event counters, previously only available via ipsec listcounters command, may
    now also be queried and reset via vici and the new swanctl --counters command. They
    are collected and provided by the optional counters plugin (enabled by default for
    backwards compatibility if the stroke plugin is built).
  * Class attributes received in RADIUS Access-Accept messages may optionally be added to
    RADIUS accounting messages (655924074b).
  * Basic support for systemd sockets has been added, which may be used for privilege separation
    (59db98fb94).
  * Inbound marks may optionally be installed in the SA again (was removed with 5.5.2) by
    enabling the mark_in_sa option in swanctl.conf.
  * The timeout of leases in pools configured via pool utility may be configured in other
    units than hours.
    INITIAL_CONTACT notifies are now only omitted if never is configured as uniqueness policy.
  * Outbound FWD policies for shunts are not installed anymore, by default (as is the case
    for other policies since 5.5.1).
  * Don't consider a DH group mismatch during CHILD_SA rekeying as failure as responder
    (e7276f78aa).
  * Handling of fragmented IPv4 and IPv6 packets in libipsec has been improved (e138003de9).
  * Trigger expire events for the correct IPsec SA in libipsec (6e861947a0).
  * A crash in CRL verification via openssl plugin using OpenSSL 1.1 has been fixed (78acaba6a1).
  * No hard-coded default proposals are passed from starter to the stroke plugin anymore (the
    IKE proposal used curve25519 since 5.5.2, which is an optional plugin).
  * A workaround for an issue with virtual IPs on macOS 10.13 (High Sierra) has been added
    (039b85dd43).
  * Handling of IKE_SA rekey collisions in charon-tkm has been fixed.
  * Instead of failing or just silently doing nothing unit tests may now warn about certain
    conditions (e.g. if a test was not executed due to external dependencies).</changelog>
  <changelog author="mmnelemane@suse.com" date="1585224000">- Fix for to resolve multiple definition of swanctl_dir (bsc #1164493)
  [+ 0006-Resolve-multiple-definition-of-swanctl_dir.patch]</changelog>
  <changelog author="mbuil@suse.com" date="1610712000">- Fix typo in README (bsc #1167880)
  [+ 0007-Fix-typo-in-README.patch ]</changelog>
  <changelog author="mbuil@suse.com" date="1611576000">- Fix FIPS bug (bsc #1180801)
  [+ 0008-gcrypt-Use-a-dummy-buffer-to-initialize-static-alloc.patch ]</changelog>
  <changelog author="mbuil@suse.com" date="1617019200">- Keep using ipsec as the main binary. Therefore, make strongswan.service point to it instead of swanctl</changelog>
  <changelog author="mbuil@suse.com" date="1617019201">- Information added in README about the rcstrongswan-starter</changelog>
  <changelog author="mbuil@suse.com" date="1617624000">- Add config to run ipsec on namespaces (bsc #1183670)</changelog>
  <changelog author="mt@suse.com" date="1619006400">- Add support for AES CCM aead algorithms to openssl plugin (cc/fips,bsc#1185363)
  [+ 0009-strongswan-openssl-aead-add-ccm-support.patch]</changelog>
  <changelog author="mt@suse.com" date="1620388800">- Replace AEAD AES CCM patch with upstream variant (cc/fips,bsc#1185363)
  [* 0009-strongswan-openssl-aead-add-ccm-support.patch]</changelog>
  <changelog author="hare@suse.de" date="1627646400">- Add auth_els plugin to support Marvell FC-SP encryption (jsc#SLE-20151)
  [* strongswan-marvell-auth-els.patch]</changelog>
  <changelog author="abergmann@suse.com" date="1634040000">- Fix integer overflow in gmp plugin (bsc#1191367, CVE-2021-41990)
  [* strongswan-5.6.1-5.9.3_gmp-rsa-ssa-salt-len.patch]
- Fix integer overflow when replacing certificates in cache (bsc#1191435, CVE-2021-41991)
  [* strongswan-4.4.1-5.9.3_cert-cache-random.patch]</changelog>
  <changelog author="meissner@suse.com" date="1643025600">- strongswan-5.5.0-5.9.4_eap_success-CVE-2021-45079.patch:
  Fixed authentication bypass in EAP authentication (CVE-2021-45079
  bsc#1194471)</changelog>
</package>
<package pkgid="7cfafb18efa7e6b7892aae444cfb14f1bdc7e2191c7224cdbeb61c12515f97d5" name="strongswan" arch="src">
  <version epoch="0" ver="5.8.2" rel="11.24.1"/>
  <changelog author="ndas@suse.de" date="1501502400">- Updated to strongSwan 5.3.5(bsc#1050691) providing the following changes:
  * Fixed a DoS vulnerability in the gmp plugin that was caused by insufficient input
    validation when verifying RSA signatures. More specifically, mpz_powm_sec() has two
    requirements regarding the passed exponent and modulus that the plugin did not
    enforce, if these are not met the calculation will result in a floating point exception
    that crashes the whole process.
    This vulnerability has been registered as CVE-2017-9022.
    Please refer to our blog for details.
  * Fixed a DoS vulnerability in the x509 plugin that was caused because the ASN.1 parser
    didn't handle ASN.1 CHOICE types properly, which could result in an infinite loop when
    parsing X.509 extensions that use such types.
    This vulnerability has been registered as CVE-2017-9023.
    Please refer to our blog for details.
  * The behavior during IKEv2 CHILD_SA rekeying has been changed in order to avoid
    traffic loss. When responding to a CREATE_CHILD_SA request to rekey a CHILD_SA
    the responder already has everything available to install and use the new CHILD_SA.
    However, this could lead to lost traffic as the initiator won't be able to process
    inbound packets until it processed the CREATE_CHILD_SA response and updated the
    inbound SA. To avoid this the responder now only installs the new inbound SA and
    delays installing the outbound SA until it receives the DELETE for the replaced CHILD_SA.
  * The messages transporting these DELETEs could reach the peer before packets sent
    with the deleted outbound SAs reach it. To reduce the chance of traffic loss due
    to this the inbound SA of the replaced CHILD_SA is not removed for a configurable
    amount of seconds (charon.delete_rekeyed_delay) after the DELETE has been processed.
  * The code base has been ported to Apple's ARM64 iOS platform, which required several
    changes regarding the use of variadic functions. This was necessary because the calling
    conventions for variadic and regular functions are different there.
    This means that assigning a non-variadic function to a variadic function pointer, as we
    did with our enumerator_t::enumerate() implementations and several callbacks, will
    result in crashes as the called function accesses the arguments differently than the
    caller provided them. To avoid this issue the enumerator_t interface has been changed
    and the signature of the callback functions for enumerator_create_filter() and two
    methods on linked_list_t have been changed. Refer to the developer notes below
    for details.
  * Adds support for fuzzing the certificate parser provided by the default plugins
    (x509, pem, gmp etc.) on Google's OSS-Fuzz infrastructure (or generally with
    libFuzzer). Several issues found while fuzzing these plugins were fixed.
  * Two new options have been added to charon's retransmission settings:
    retransmit_limit and retransmit_jitter. The former adds an upper limit to the
    calculated retransmission timeout, the latter randomly reduces it.
    Refer to Retransmission for details.
  * A bug in swanctl's --load-creds command was fixed that caused unencrypted
    private keys to get unloaded if the command was called multiple times.
    The load-key VICI command now returns the key ID of the loaded key on success.
  * The credential manager now enumerates local credential sets before global ones.
    This means certificates supplied by the peer will now be preferred over certificates
    with the same identity that may be locally stored (e.g. in the certificate cache).
  * Adds support for hardware offload of IPsec SAs as introduced by Linux 4.11 for
    specific hardware that supports this.
  * The pki tool loads the curve25519 plugin by default.
    [- 0006-Make-sure-the-modulus-is-odd-and-the-exponent-not-zero.patch,
  - 0007-asn1-parser-Fix-CHOICE-parsing.patch]
- libhydra is removed as all kernel plugins moved to libcharon</changelog>
  <changelog author="ndas@suse.de" date="1504612800">- fix "uintptr_t? undeclared" compilation error.
  [+0006-fix-compilation-error-by-adding-stdint.h.patch]</changelog>
  <changelog author="ndas@suse.de" date="1504612801">- Updated to strongSwan 5.6.0 providing the following changes:
  * Fixed a DoS vulnerability in the gmp plugin that was caused by insufficient input validation
    when verifying RSA signatures, which requires decryption with the operation m^e mod n,
    where m is the signature, and e and n are the exponent and modulus of the public key.
    The value m is an integer between 0 and n-1, however, the gmp plugin did not verify this.
    So if m equals n the calculation results in 0, in which case mpz_export() returns NULL.
    This result wasn't handled properly causing a null-pointer dereference.
    This vulnerability has been registered as CVE-2017-11185. (bsc#1051222)
  * New SWIMA IMC/IMV pair implements the draft-ietf-sacm-nea-swima-patnc Internet
    Draft and has been demonstrated at the IETF 99 Prague Hackathon.
  * The IMV database template has been adapted to achieve full compliance with the
    ISO 19770-2:2015 SWID tag standard.
  * The pt-tls-client can attach and use TPM 2.0 protected private keys via the --keyid parameter.
  * By default the /etc/swanctl/conf.d directory is created and *.conf files in it are included in the default
    swanctl.conf file.
  * The curl plugin now follows HTTP redirects (configurable via strongswan.conf).
  * The CHILD_SA rekeying was fixed in charon-tkm and the behavior is refined a bit more since 5.5.3
  * libtpmtss supports Intel's TSS2 Architecture Broker and Resource Manager interface (tcti-tabrmd).
  * more on https://wiki.strongswan.org/versions/66</changelog>
  <changelog author="mmnelemane@suse.com" date="1521028800">- Removed unused requires and macro calls(bsc#1083261)</changelog>
  <changelog author="mmnelemane@suse.com" date="1573646400">- Added patch to fix vulnerability: CVE-2018-16151,CVE-2018-16152 (bsc#1107874)
  - Insufficient input validation in gmp plugin
  [+ 0007-strongswan-5.3.1-5.6.0_gmp-pkcs1-verify.patch]</changelog>
  <changelog author="mmnelemane@suse.com" date="1573646401">- Added patch to fix vulnerability: CVE-2018-5388 (bsc#1094462)
  - Buffer Underflow in stroke_socket.c
  [+ 0008-strongswan-5.1.2-5.6.2_stroke_msg_len.patch]</changelog>
  <changelog author="mmnelemane@suse.com" date="1573646402">- Added patch to fix vulnerability: CVE-2018-10811 (bsc#1093536)
  - denial-of-service vulnerability
  [+ 0009-strongswan-5.5.0-5.6.2_skeyseed_init.patch]</changelog>
  <changelog author="mmnelemane@suse.com" date="1573732800">- Added patch to fix vulnerability: CVE-2018-17540 (bsc#1109845)
  [+ 0010-strongswan-4.4.0-5.7.0_gmp-pkcs1-overflow.patch]</changelog>
  <changelog author="mmnelemane@suse.com" date="1580212800">- Updated to version 5.8.2 (jsc#SLE-11370)
  - Dropped following patches due to irrelevance in the updated version:
    [- strongswan_modprobe_syslog.patch ]
    [- strongswan_fipsfilter.patch ]
    [- 0006-fix-compilation-error-by-adding-stdint.h.patch ]
    [- 0007-strongswan-5.3.1-5.6.0_gmp-pkcs1-verify.patch ]
    [- 0008-strongswan-5.1.2-5.6.2_stroke_msg_len.patch ]
    [- 0009-strongswan-5.5.0-5.6.2_skeyseed_init.patch ]
    [- 0010-strongswan-4.4.0-5.7.0_gmp-pkcs1-overflow.patch ]
  - Version 5.8.2
  ===============
  * Identity-based CA constraints, which enforce that the certificate chain of the remote
    peer contains a CA certificate with a specific identity, are supported via
    vici/swanctl.conf. This is similar to the existing CA constraints but doesn't require
    that the CA certificate is locally installed, for instance, intermediate CA certificates
    received from the peers. Wildcard identity matching (e.g. ..., OU=Research, CN=*) could
    also be used for the latter but requires trust in the intermediate CAs to only issue
    certificates with legitimate subject DNs (e.g. the "Sales" CA must not issue certificates
    with OU=Research). With the new constraint that's not necessary as long as a path length
    basic constraint (--pathlen for pki --issue) prevents intermediate CAs from issuing further
    intermediate CAs.
  * Intermediate CA certificates may now be sent in hash-and-URL encoding by configuring a
    base URL for the parent CA (#3234, swanctl/rw-hash-and-url-multi-level).
  * Implemented NIST SP-800-90A Deterministic Random Bit Generator (DRBG) based on AES-CTR
    and SHA2-HMAC modes. Currently used by the gmp and ntru plugins.
  * Random nonces sent in an OCSP requests are now expected in the corresponding OCSP responses.
  * The kernel-netlink plugin now ignores deprecated IPv6 addresses for MOBIKE. Whether temporary
    or permanent IPv6 addresses are included now depends on the charon.prefer_temporary_addrs
    setting (#3192).
  * Extended Sequence Numbers (ESN) are configured via PF_KEY if supported by the kernel.
  * The PF_KEY socket's receive buffer in the kernel-pfkey plugin is now cleared before sending
    requests, as many of the messages sent by the kernel are sent as broadcasts to all PF_KEY
    sockets. This is an issue if an external tool is used to manage SAs/policies unrelated to
    IPsec (#3225).
  * The vici plugin now uses unique section names for CHILD_SAs in child-updown events (7c74ce9190).
  * For individually deleted CHILD_SAs (in particular for IKEv1) the vici child-updown event
    now includes more information about the CHILD_SAs such as traffic statistics (#3198).
  * Custom loggers are correctly re-registered if log levels are changed via stroke loglevel (#3182).
  * Avoid lockups during startup on low entropy systems when using OpenSSL 1.1.1 (095a2c2eac).
  * Instead of failing later when setting a key, creating HMACs via openssl plugin now fails
    instantly if the underlying hash algorithm isn't supported (e.g. MD5 in FIPS-mode) so fallbacks
    to other plugins work properly (#3284).
  * Exponents of RSA keys read from TPM 2.0 via SAPI are correctly converted (8ee1242f1438).
  * Routing table IDs &gt; 255 are supported for custom routes on Linux.
  * To avoid races, the check for hardware offloading support in the kernel-netlink plugin is
    performed during initialization of the plugin (a605452c03).
  * The D-Bus config file for charon-nm is now installed in $(datadir)/dbus-1/system.d instead of
    $(sysconfdir)/dbus-1/system.d, which is intended for sysadmin overrides.
    INVALID_MAJOR_VERSION notifies are now correctly sent in messages of the same exchange type
    and with the same message ID as the request.
  * IKEv2 SAs are now immediately destroyed when sending or receiving INVALID_SYNTAX notifies
    in authenticated messages.
  * For developers working from the repository the configure script now aborts if GNU gperf is
    not found.
  - Version 5.8.1
  ===============
  * RDNs in DNs of X.509 certificates can now optionally be matched less strict. The global
    strongswan.conf option charon.rdn_matching takes two alternative values that cause the
    matching algorithm to either ignore the order of matched RDNs (reordered) or additionally
    (relaxed) accept DNs that contain more RDNs than configured (unmatched RDNs are treated
    like wildcard matches).
  * The updown plugin now passes the same interface to the script that is also used for the
    automatically installed routes, that is, the interface over which the peer is reached
    instead of the interface on which the local address is found (#3095).
  * TPM 2.0 contexts are now protected by a mutex to prevent issues if multiple IKE_SAs use
    the same private key concurrently (4b25885025).
  * Do a rekey check after the third QM message was received (#3060).
  * If available, explicit_bzero() is now used as memwipe() instead of our own implementation.
  * An .editorconfig file has been added, mainly so Github shows files with proper indentation
    (68346b6962).
  * The internal certificate of the load-tester plugin has been modified so it can again be
    used as end-entity cert with 5.6.3 and later (#3139).
  * The maximum data length of received COOKIE notifies (64 bytes) is now enforced (#3160).
  - Version 5.8.0
  ===============
  * The systemd service units have been renamed. The modern unit, which was called
    strongswan-swanctl, is now called strongswan (the previous name is configured as alias in
    the unit, for which a symlink is created when the unit is enabled). The legacy unit is now
    called strongswan-starter.
  * Support for XFRM interfaces (available since Linux 4.19) has been added, which are intended
    to replace VTI devices (they are similar but offer several advantages, for instance, they
    are not bound to an address or address family).
  * IPsec SAs and policies are associated with such interfaces via interface IDs that can be
    configured in swanctl.conf (dynamic IDs may optionally be allocated for each SA and even
    direction). It's possible to use separate interfaces for in- and outbound traffic (or
    only use an interface in one direction and regular policies in the other).
  * Interfaces may be created dynamically via updown/vici scripts, or statically before or after
    establishing the SAs. Routes must be added manually as needed (the daemon will not install
    any routes for outbound policies with an interface ID).
  * When moving XFRM interfaces to other network namespaces they retain access to the SAs and
    policies installed in the original namespace, which allows providing IPsec tunnels for
    processes in other network namespaces without giving them access to the IPsec keys or
    IKE credentials.
    More information can be found on the page about route-based VPNs.
  * Initiation of childless IKE_SAs is supported (RFC 6023). If enabled and supported by the
    responder, no CHILD_SA is established during IKE_AUTH. Instead, all CHILD_SAs are created
    with CREATE_CHILD_SA exchanges. This allows using a separate DH exchange even for the
    first CHILD_SA, which is otherwise created during IKE_AUTH with keys derived from the
    IKE_SA's key material.
  * The swanctl --initiate command may be used to initiate only the IKE_SA via --ike
    option if --child is omitted and the peer supports this extension.
  * The NetworkManager backend and plugin support IPv6.
  * The new wolfssl plugin is a wrapper around the wolfSSL crypto library. Thanks to Sean
    Parkinson of wolfSSL Inc. for the initial patch.
  * IKE SPIs may optionally be labeled via the charon.spi_mask|label options in
    strongswan.conf. This feature was extracted from charon-tkm, however, now applies the
    mask/label in network order.
  * The openssl plugin supports ChaCha20-Poly1305 when built with OpenSSL 1.1.0.
  * The PB-TNC finite state machine according to section 3.2 of RFC 5793 was not correctly
    implemented when sending either a CRETRY or SRETRY batch. These batches can only be sent
    in the "Decided" state and a CRETRY batch can immediately carry all messages usually
    transported by a CDATA batch. It is currently not possible to send a SRETRY batch since
    full-duplex mode for PT-TLS transport is not supported.
  * Instead of marking IPv6 virtual IPs as deprecated, the kernel-netlink plugin now uses
    address labels to avoid that such addresses are used for non-VPN traffic (00a953d090).
  * The agent plugin now creates sockets to the ssh/gpg-agent dynamically and does not keep
    them open, which otherwise might prevent the agent from getting terminated.
  * To avoid broadcast loops the forecast plugin now only reinjects packets that are marked
    or received from the configured interface.
  * UTF-8 encoded passwords are supported via EAP-MSCHAPv2, which internally uses an UTF-16LE
    encoding to calculate the NT hash (#3014).
  * Properly delete temporary drop policies (used when updating IP addresses of SAs) if manual
    priorities are used, which was broken since 5.6.2 (8e31d65730).
  * Avoid overwriting start_action when parsing the inactivity timeout in the vici plugin (#2954).
  * Fixed the automatic termination of reloaded vici connections with start_action=start,
    which was broken since 5.6.3 (71b22c250f).
  * The lookup for shared secrets for IKEv1 SAs via sql plugin should now work better
    (6ec9f68f32).
  * Fixed a race condition in the trap manager between installation and removal of a policy
    (69cbe2ca3f).
  * Compilation of the kernel-netlink plugin has been fixed on old kernels (&lt; 2.6.39), which
    was caused by the HW offload changes (c7f579fa17).
  * The IPsec stack detection and module loading in starter has been removed (it wasn't
    enforced anyway and loading modules doesn't seem necessary, also KLIPS hasn't been
    supported for a long time and PF_KEY will eventually be removed from the Linux kernel,
    ba817d2917).
  * Several IKEv2 protocol details are now handled more strictly: Unrequested virtual IPs are
    ignored, CFG_REPLY payloads are ignored if no CFG_REQUEST payloads were sent, a USE
    TRANSPORT_MODE notify received from the responder is checked against the local configuration.
  * The keys and certificates used by the scenarios in the testing environment are now generated
    dynamically. Running the testing/scripts/build-certs script after creating the base and root
    images uses the pki utility installed in the latter to create the keys and certificates for
    all the CAs and in some cases for individual scenarios. These credentials are stored in the
    source tree, not the image, so this has to be called only once even if the images are later
    rebuilt. The script automatically (re-)rebuilds the guest images as that generates fresh
    CRLs and signs the DNS zones. The only keys/certificates currently not generated are the
    very large ones used by the ikev2/rw-eap-tls-fragments scenario.
  - Version 5.7.2
  ===============
  * For RSA with PSS padding, the TPM 2.0 specification mandates the maximum salt length
    (as defined by the length of the key and hash). However, if the TPM is FIPS-168-4 compliant,
    the salt length equals the hash length. This is assumed for FIPS-140-2 compliant TPMs, but
    if that's not the case, it might be necessary to manually enable charon.plugins.tpm.fips_186_4
    if the TPM doesn't use the maximum salt length.
  * Directories for credentials loaded by swanctl are now accessed relative to the loaded
    swanctl.conf file, in particular, when loading it from a custom location via --file argument.
  * The base directory, which is used if no custom location for swanctl.conf is specified, is now
    also configurable at runtime via SWANCTL_DIR environment variable.
  * If RADIUS Accounting is enabled, the eap-radius plugin will add the session ID (Acct-Session-Id)
    to Access-Request messages, which e.g. simplifies associating database entries for IP leases and
    accounting with sessions (the session ID does not change when IKE_SAs are rekeyed, #2853).
  * All IP addresses assigned by a RADIUS server are included in Accounting-Stop messages even if
    the client did not claim them, allowing to release them early in case of connection errors (#2856).
  * Selectors installed on transport mode SAs by the kernel-netlink plugin are now updated if an
    IP address changes (e.g. via MOBIKE) and it was part of the selectors.
  * No deletes are sent anymore when a rekeyed CHILD_SA expires (#2815).
  * The bypass-lan plugin now tracks interfaces to handle subnets that move from one interface
    to another and properly update associated routes (#2820).
  * Only valid and expected inbound IKEv2 messages are used to update the timestamp of the
    last received message (previously, retransmits also triggered an update).
  * IKEv2 requests from responders are now ignored until the IKE_SA is fully established (e.g. if a
    DPD request from the peer arrives before the IKE_AUTH response does, 46bea1add9).
    Delayed IKE_SA_INIT responses with COOKIE notifies we already recevied are ignored, they caused
    another reset of the IKE_SA previously (#2837).
  * Active and queued Quick Mode tasks are now adopted if the peer reauthenticates an IKEv1 SA
    while creating lots of CHILD_SAs.
  * Newer versions of the FreeBSD kernel add an SADB_X_EXT_SA2 extension to SADB_ACQUIRE
    messages, which allows the kernel-pfkey plugin to determine the reqid of the policy even if it
    wasn't installed by the daemon previously (e.g. when using FreeBSD's if_ipsec(4) VTIs, which
    install policies themselves, 872b9b3e8d).
  * Added support for RSA signatures with SHA-256 and SHA-512 to the agent plugin. For older
    versions of ssh/gpg-agent that only support SHA-1, IKEv2 signature authentication has to be
    disabled via charon.signature_authentication.
  * The sshkey and agent plugins support Ed25519/Ed448 SSH keys and signatures.
  * The openssl plugin supports X25519/X448 Diffie-Hellman and Ed25519/Ed448 keys and
    signatures when built against OpenSSL 1.1.1.
  * Support for Ed25519, ChaCha20/Poly1305, SHA-3 and AES-CCM were added to the botan plugin.
  * The mysql plugin now properly handles database connections with transactions
    under heavy load (#2779).
  * IP addresses in ha pools are now distributed evenly among all segments (#2828).
  * Private key implementations may optionally provide a list of supported signature schemes,
    which, as described above, is used by the tpm plugin because for each key on a TPM 2.0 the
    hash algorithm and for RSA also the padding scheme is predefined.
  * The testing environment is now based on Debian 9 (stretch) by default. This required
    some changes, in particular, updating to FreeRADIUS 3.x (which forced us to abandon the
    TNC@FHH patches and scenarios, 2fbe44bef3) and removing FIPS-enabled versions of
    OpenSSL (the FIPS module only supports OpenSSL 1.0.2).
  * Most test scenarios were migrated to swanctl.
  - Version 5.7.1
  ===============
  * Fixes a vulnerability in the gmp plugin triggered by crafted certificates with RSA keys with
    very small moduli. When verifying signatures with such keys, the code patched with the fix
    for CVE-2018-16151/2 caused an integer underflow and subsequent heap buffer overflow
    that results in a crash of the daemon.
  * The vulnerability has been registered as CVE-2018-17540.
  - Version 5.7.0
  ===============
  * Fixes a potential authorization bypass vulnerability in the gmp plugin that was caused by a
    too lenient verification of PKCS#1 v1.5 signatures. Several flaws could be exploited by a
    Bleichenbacher-style attack to forge signatures for low-exponent keys (i.e. with e=3).
  * CVE-2018-16151 has been assigned to the problem of accepting random bytes after the OID
    of the hash function in such signatures, and CVE-2018-16152 has been assigned to the issue
    of not verifying that the parameters in the ASN.1 algorithmIdentitifer structure is empty.
    Other flaws that don't lead to a vulnerability directly (e.g. not checking for at least
    8 bytes of padding) have no separate CVE assigned.
  * Dots are not allowed anymore in section names in swanctl.conf and strongswan.conf.
    This mainly affects the configuration of file loggers. If the path for such a log file
    contains dots it now has to be configured in the new path setting within the arbitrarily
    renamed subsection in the filelog section.
  * Sections in swanctl.conf and strongswan.conf may now reference other sections. All settings
    and subsections from such a section are inherited. This allows to simplify configs as
    redundant information has only to be specified once and may then be included in other
    sections (see strongswan.conf for an example).
  * The originally selected IKE config (based on the IPs and IKE version) can now change
    if no matching algorithm proposal is found. This way the order of the configs doesn't
    matter that much anymore and it's easily possible to specify separate configs for
    clients that require weaker algorithms (instead of having to also add them in other
    configs that might be selected).
  * Support for Postquantum Preshared Keys for IKEv2 (draft-ietf-ipsecme-qr-ikev2) has been added.
    For an example refer to the swanctl/rw-cert-ppk scenario (or with EAP, or PSK authentication).
  * The new botan plugin is a wrapper around the Botan C++ crypto library.
    It requires a fairly recent build from Botan's master branch (or the upcoming 2.8.0 release).
    Thanks to René Korthaus and his team from Rohde &amp; Schwarz Cybersecurity for the initial
    patch and to Jack Lloyd for quickly adding missing functions to Botan's FFI (C89) interface.
  * Implementation of RFC 8412 "Software Inventory Message and Attributes (SWIMA) for PA-TNC".
  * SWIMA subscription option sets CLOSE_WRITE trigger on apt history.log file resulting in
    a ClientRetry PB-TNC batch to initialize a new measurement cycle. The new imv/imc-swima
    plugins replace the previous imv/imc-swid plugins, which were removed.
  * Added support for fuzzing the PA-TNC (RFC 5792) and PB-TNC (RFC 5793) NEA protocols
    on Google's OSS-Fuzz infrastructure.
  * Support for version 2 of Intel's TPM2-TSS TGC Software Stack. The presence of the
    in-kernel /dev/tpmrm0 resource manager is automatically detected.
  * The pki tool accepts a xmppAddr otherName as a subjectAlternativeName using the
    syntax --san xmppaddr:&lt;jid&gt;.
  * swanctl.conf supports the configuration of marks the in- and/or outbound SA should apply
    to packets after processing on Linux. Configuring such a mark for outbound SAs requires
    at least a 4.14 kernel. The ability to set a mask and configuring a mark/mask for
    inbound SAs will be added with the upcoming 4.19 kernel.
  * New options in swanctl.conf allow configuring how/whether DF, ECN and DS fields in the
    IP headers are copied during IPsec processing. Controlling this is currently only possible
    on Linux.
  * The handling of sequence numbers in IKEv1 DPDs has been improved (#2714).
  * To avoid conflicts, the dhcp plugin now only uses the DHCP server port if explicitly
    configured.
  - Version 5.6.3
  ===============
  * Fixed a DoS vulnerability in the IKEv2 key derivation if the openssl plugin is used in FIPS
    mode and HMAC-MD5 is negotiated as PRF.
    This vulnerability has been registered as CVE-2018-10811.
  * Fixed a vulnerability in the stroke plugin, which did not check the received length before
    reading a message from the socket. Unless a group is configured, root privileges are
    required to access that socket, so in the default configuration this shouldn't be an issue.
    This vulnerability has been registered as CVE-2018-5388.
  * CRLs that are not yet valid are now ignored to avoid problems in scenarios where expired
    certificates are removed from new CRLs and the clock on the host doing the revocation
    check is trailing behind that of the host issuing CRLs. Not doing this could result in
    accepting a revoked and expired certificate, if it's still valid according to the
    trailing clock but not contained anymore in not yet valid CRLs.
  * The issuer of fetched CRLs is now compared to the issuer of the checked certificate (#2608).
  * CRL validation results other than revocation (e.g. a skipped check because the CRL couldn't
    be fetched) are now stored also for intermediate CA certificates and not only for end-entity
    certificates, so a strict CRL policy can be enforced in such cases.
  * In compliance with RFC 4945, section 5.1.3.2, certificates used for IKE must now either
    not contain a keyUsage extension (like the ones generated by pki), or have at least one of the
    digitalSignature or nonRepudiation bits set.
  * New options for vici/swanctl allow forcing the local termination of an IKE_SA. This might be
    useful in situations where it's known the other end is not reachable anymore, or that it
    already removed the IKE_SA, so retransmitting a DELETE and waiting for a response would
    be pointless.
  * Waiting only a certain amount of time for a response (i.e. shorter than all retransmits
    would be) before destroying the IKE_SA is also possible by additionally specifying a
    timeout in the forced termination request.
  * When removing routes, the kernel-netlink plugin now checks if it tracks other routes for
    the same destination and replaces the installed route instead of just removing it. Same
    during installation, where existing routes previously weren't replaced. This should allow
    using traps with virtual IPs on Linux (#2162).
  * The dhcp plugin now only sends the client identifier DHCP option if the identity_lease
    setting is enabled (7b660944b6). It can also send identities of up to 255 bytes length,
    instead of the previous 64 bytes (30e886fe3b, 0e5b94d038). If a server address is
    configured, DHCP requests are now sent from port 67 instead of 68 to avoid ICMP port
    unreachables (becf027cd9).
  * The handling of faulty INVALID_KE_PAYLOAD notifies (e.g. one containing a DH group
    that wasn't proposed) during CREATE_CHILD_SA exchanges has been improved (#2536).
  * Roam events are now completely ignored for IKEv1 SAs (there is no MOBIKE to handle such
    changes properly).
  * ChaCha20/Poly1305 is now correctly proposed without key length (#2614). For compatibility with
    older releases the chacha20poly1305compat keyword may be included in proposals to also propose
    the algorithm with a key length (c58434aeff).
  * Configuration of hardware offload of IPsec SAs is now more flexible and allows a new
    setting (auto), which automatically uses it if the kernel and device both support it. If hw
    offload is set to yes and offloading is not supported, the CHILD_SA installation now fails.
  * The kernel-pfkey plugin optionally installs routes via internal interface (one with an IP
    in the local traffic selector). On FreeBSD, enabling this selects the correct source IP
    when sending packets from the gateway itself (e811659323).
  * SHA-2 based PRFs are supported in PKCS#8 files as generated by OpenSSL 1.1 (#2574).
  * The pki --verify tool may load CA certificates and CRLs from directories.
  * The IKE daemon now also switches to port 4500 if the remote port is not 500 (e.g. because the
    remote maps the response to a different port, as might happen on Azure), as long as the local
    port is 500 (85bfab621d).
  * Fixed an issue with DNS servers passed to NetworkManager in charon-nm (ee8c25516a).
  * Logged traffic selectors now always contain the protocol if either protocol or port are set
    (a36d8097ed).
  * Only the inbound SA/policy will be updated as reaction to IP address changes for rekeyed
    CHILD_SAs that are kept around.
  * The parser for strongswan.conf/swanctl.conf now accepts = characters in values without
    having to put the value in quotes (e.g. for Base64 encoded shared secrets).
    Notes for developers:
  * trap_manager_t: Trap policies are now unistalled by peer/child name and not the reqid.
  * No reqid is returned anymore when installing trap policies.
  * child_sa_t: A new state (CHILD_DELETED) is used for CHILD_SAs that have been deleted but
    not yet destroyed (after a rekeying CHILD_SAs are kept around for a while to process
    delayed packets).
    This way child_updown events are not triggered anymore for such SAs when an IKE_SA that
    has such CHILD_SAs assigned is deleted.
  - Version 5.6.2
  ===============
  * Fixed a DoS vulnerability in the parser for PKCS#1 RSASSA-PSS signatures that was caused
    by insufficient input validation. One of the configurable parameters in algorithm identifier
    structures for RSASSA-PSS signatures is the mask generation function (MGF). Only MGF1 is
    currently specified for this purpose. However, this in turn takes itself a parameter that
    specifies the underlying hash function. strongSwan's parser did not correctly handle the
    case of this parameter being absent, causing an undefined data read.
    This vulnerability has been registered as CVE-2018-6459.
  * When rekeying IKEv2 IKE_SAs the previously negotiated DH group will be reused, instead of
    using the first configured group, which avoids an additional exchange if the peer previously
    selected a different DH group via INVALID_KE_PAYLOAD notify. The same is also done when
    rekeying CHILD_SAs except for the first rekeying of the CHILD_SA that was created with the
    IKE_SA, where no DH group was negotiated yet.
    Also, the selected DH group is moved to the front in all sent proposals that contain it
    and all proposals that don't are moved to the back in order to convey the preference for
    this group to the peer.
  * Handling of MOBIKE task queuing has been improved. In particular, the response to an
    address update (with NAT-D payloads) is not ignored anymore if only an address list update
    or DPD is queued as that could prevent updating the UDP encapsulation in the kernel.
  * On Linux, roam events may optionally be triggered by changes to the routing rules, which
    can be useful if routing rules (instead of e.g. route metrics) are used to switch from one
    to another interface (i.e. from one to another routing table). Since routing rules are
    currently not evaluated when doing route lookups this is only useful if the kernel-based
    route lookup is used (4664992f7d).
  * The fallback drop policies installed to avoid traffic leaks when replacing addresses in
    installed policies are now replaced by temporary drop policies, which also prevent
    acquires because we currently delete and reinstall IPsec SAs to update their addresses
    (35ef1b032d).
  * Access X.509 certificates held in non-volatile storage of a TPM 2.0 referenced via the
    NV index.
    Adding the --keyid parameter to pki --print allows to print private keys or certificates
    stored in a smartcard or a TPM 2.0.
  * Fixed proposal selection if a peer incorrectly sends DH groups in the ESP proposal during
    IKE_AUTH and also if a DH group is configured in the local ESP proposal and charon.prefer
    configured_proposals is disabled (d058fd3c32).
  * The lookup for PSK secrets for IKEv1 has been improved for certain scenarios (see #2497
    for details).
  * MSKs received via RADIUS are now padded to 64 bytes to avoid compatibility issues with
    EAP-MSCHAPv2 and PRFs that have a block size &lt; 64 bytes (e.g. AES-XCBC-PRF-128, see
    73cbce6013).
  * The tpm_extendpcr command line tool extends a digest into a TPM PCR.
  * Ported the NetworkManager backend from the deprecated libnm-glib to libnm.
  * The save-keys debugging/development plugin saves IKE and/or ESP keys to files compatible
    with Wireshark.
  - Version 5.6.1
  ===============
  * Several algorithms were removed from the default ESP/AH and IKE proposals in compliance with
    RFC 8221 and RFC 8247, respectively. Removed from the default ESP/AH proposal were the
    3DES and Blowfish encryption algorithms and the HMAC-MD5 integrity algorithm. From the IKE
    default proposal the HMAC-MD5 integrity algorithm and the MODP-1024 Diffie-Hellman group
    were removed (the latter is significant for Windows clients in their default configuration).
    These algorithms may still be used in custom proposals.
  * Support for RSASSA-PSS signatures has been added. For compatibility with previous
    releases they are currently not used automatically, by default, to change that charon.rsa_pss
    may be enabled. To explicitly use or require such signatures during IKEv2 signature
    authentication (RFC 7427) ike:rsa/pss... authentication constraints may be used for specific
    connections (regardless of whether the strongswan.conf option above is enabled). Only the
    hash algorithm can be specified in such constraints, the MGF1 will be based on that hash
    and the salt length will equal the hash length (when verifying the salt length is not
    enforced).
    To enforce such signatures during PKI verification use rsa/pss... authentication constraints.
  * All pki commands that create certificates/CRLs can be made to sign with RSASSA-PSS instead
    of the classing PKCS#1 scheme with the --rsa-padding pss option. As with signatures during
    authentication, only the hash algorithm is configurable (via --digest option), the MGF1 will
    be based on that and the salt length will equal the hash length.
  * These signatures are supported by all RSA backends except pkcs11 (i.e. gmp, gcrypt, openssl).
    The gmp plugin requires the mgf1 plugin.
    Note that RSASSA-PSS algorithm identifiers and parameters in keys (public keys in
    certificates or private keys in PKCS#8 files) are currently not used as constraints.
  * The sec-updater tool checks for security updates in dpkg-based repositories
    (e.g. Debian/Ubuntu) and sets the security flags in the IMV policy database accordingly.
    Additionally for each new package version a SWID tag for the given OS and HW architecture
    is created and stored in the database.
  * Using the sec-updater.sh script template the lookup can be automated (e.g. via an hourly
    cron job).
  * When restarting an IKEv2 negotiation after receiving an INVALID_KE_PAYLOAD notify (or due
    to other reasons like too many retransmits) a new initiator SPI is allocated. This
    prevents issues caused by retransmits for IKE_SA_INIT messages.
  * Because the initiator SPI was previously reused when restarting the connection delayed
    responses for previous connection attempts were processed and might have caused fatal
    errors due to a failed DH negotiation or because of the internal retry counter in the
    ike-init task. For instance, if we proposed a DH group the responder rejected we
    might have later received delayed responses that either contained INVALID_KE_PAYLOAD
    notifies with the DH group we already switched to, or, if we retransmitted an
    IKE_SA_INIT with the requested group but then had to restart again, a KE payload with
    a group different from the one we proposed.
  * The introduction of file versions in the IMV database scheme broke file reference hash
    measurements. This has been fixed by creating generic product versions having an empty
    package name.
  * A new timeout option for the systime-fix plugin stops periodic system time checks after
    a while and enforces a certificate verification, closing or reauthenticating all SAs
    with invalid certificates.
  * The IKE event counters, previously only available via ipsec listcounters command, may
    now also be queried and reset via vici and the new swanctl --counters command. They
    are collected and provided by the optional counters plugin (enabled by default for
    backwards compatibility if the stroke plugin is built).
  * Class attributes received in RADIUS Access-Accept messages may optionally be added to
    RADIUS accounting messages (655924074b).
  * Basic support for systemd sockets has been added, which may be used for privilege separation
    (59db98fb94).
  * Inbound marks may optionally be installed in the SA again (was removed with 5.5.2) by
    enabling the mark_in_sa option in swanctl.conf.
  * The timeout of leases in pools configured via pool utility may be configured in other
    units than hours.
    INITIAL_CONTACT notifies are now only omitted if never is configured as uniqueness policy.
  * Outbound FWD policies for shunts are not installed anymore, by default (as is the case
    for other policies since 5.5.1).
  * Don't consider a DH group mismatch during CHILD_SA rekeying as failure as responder
    (e7276f78aa).
  * Handling of fragmented IPv4 and IPv6 packets in libipsec has been improved (e138003de9).
  * Trigger expire events for the correct IPsec SA in libipsec (6e861947a0).
  * A crash in CRL verification via openssl plugin using OpenSSL 1.1 has been fixed (78acaba6a1).
  * No hard-coded default proposals are passed from starter to the stroke plugin anymore (the
    IKE proposal used curve25519 since 5.5.2, which is an optional plugin).
  * A workaround for an issue with virtual IPs on macOS 10.13 (High Sierra) has been added
    (039b85dd43).
  * Handling of IKE_SA rekey collisions in charon-tkm has been fixed.
  * Instead of failing or just silently doing nothing unit tests may now warn about certain
    conditions (e.g. if a test was not executed due to external dependencies).</changelog>
  <changelog author="mmnelemane@suse.com" date="1585224000">- Fix for to resolve multiple definition of swanctl_dir (bsc #1164493)
  [+ 0006-Resolve-multiple-definition-of-swanctl_dir.patch]</changelog>
  <changelog author="mbuil@suse.com" date="1610712000">- Fix typo in README (bsc #1167880)
  [+ 0007-Fix-typo-in-README.patch ]</changelog>
  <changelog author="mbuil@suse.com" date="1611576000">- Fix FIPS bug (bsc #1180801)
  [+ 0008-gcrypt-Use-a-dummy-buffer-to-initialize-static-alloc.patch ]</changelog>
  <changelog author="mbuil@suse.com" date="1617019200">- Keep using ipsec as the main binary. Therefore, make strongswan.service point to it instead of swanctl</changelog>
  <changelog author="mbuil@suse.com" date="1617019201">- Information added in README about the rcstrongswan-starter</changelog>
  <changelog author="mbuil@suse.com" date="1617624000">- Add config to run ipsec on namespaces (bsc #1183670)</changelog>
  <changelog author="mt@suse.com" date="1619006400">- Add support for AES CCM aead algorithms to openssl plugin (cc/fips,bsc#1185363)
  [+ 0009-strongswan-openssl-aead-add-ccm-support.patch]</changelog>
  <changelog author="mt@suse.com" date="1620388800">- Replace AEAD AES CCM patch with upstream variant (cc/fips,bsc#1185363)
  [* 0009-strongswan-openssl-aead-add-ccm-support.patch]</changelog>
  <changelog author="hare@suse.de" date="1627646400">- Add auth_els plugin to support Marvell FC-SP encryption (jsc#SLE-20151)
  [* strongswan-marvell-auth-els.patch]</changelog>
  <changelog author="abergmann@suse.com" date="1634040000">- Fix integer overflow in gmp plugin (bsc#1191367, CVE-2021-41990)
  [* strongswan-5.6.1-5.9.3_gmp-rsa-ssa-salt-len.patch]
- Fix integer overflow when replacing certificates in cache (bsc#1191435, CVE-2021-41991)
  [* strongswan-4.4.1-5.9.3_cert-cache-random.patch]</changelog>
  <changelog author="meissner@suse.com" date="1643025600">- strongswan-5.5.0-5.9.4_eap_success-CVE-2021-45079.patch:
  Fixed authentication bypass in EAP authentication (CVE-2021-45079
  bsc#1194471)</changelog>
</package>
<package pkgid="86c6c7518ff0ce8f1464f63e5e03a4b04435f9d9e3d2870bde258377761d8d3b" name="strongswan" arch="x86_64">
  <version epoch="0" ver="5.8.2" rel="11.24.1"/>
  <changelog author="ndas@suse.de" date="1501502400">- Updated to strongSwan 5.3.5(bsc#1050691) providing the following changes:
  * Fixed a DoS vulnerability in the gmp plugin that was caused by insufficient input
    validation when verifying RSA signatures. More specifically, mpz_powm_sec() has two
    requirements regarding the passed exponent and modulus that the plugin did not
    enforce, if these are not met the calculation will result in a floating point exception
    that crashes the whole process.
    This vulnerability has been registered as CVE-2017-9022.
    Please refer to our blog for details.
  * Fixed a DoS vulnerability in the x509 plugin that was caused because the ASN.1 parser
    didn't handle ASN.1 CHOICE types properly, which could result in an infinite loop when
    parsing X.509 extensions that use such types.
    This vulnerability has been registered as CVE-2017-9023.
    Please refer to our blog for details.
  * The behavior during IKEv2 CHILD_SA rekeying has been changed in order to avoid
    traffic loss. When responding to a CREATE_CHILD_SA request to rekey a CHILD_SA
    the responder already has everything available to install and use the new CHILD_SA.
    However, this could lead to lost traffic as the initiator won't be able to process
    inbound packets until it processed the CREATE_CHILD_SA response and updated the
    inbound SA. To avoid this the responder now only installs the new inbound SA and
    delays installing the outbound SA until it receives the DELETE for the replaced CHILD_SA.
  * The messages transporting these DELETEs could reach the peer before packets sent
    with the deleted outbound SAs reach it. To reduce the chance of traffic loss due
    to this the inbound SA of the replaced CHILD_SA is not removed for a configurable
    amount of seconds (charon.delete_rekeyed_delay) after the DELETE has been processed.
  * The code base has been ported to Apple's ARM64 iOS platform, which required several
    changes regarding the use of variadic functions. This was necessary because the calling
    conventions for variadic and regular functions are different there.
    This means that assigning a non-variadic function to a variadic function pointer, as we
    did with our enumerator_t::enumerate() implementations and several callbacks, will
    result in crashes as the called function accesses the arguments differently than the
    caller provided them. To avoid this issue the enumerator_t interface has been changed
    and the signature of the callback functions for enumerator_create_filter() and two
    methods on linked_list_t have been changed. Refer to the developer notes below
    for details.
  * Adds support for fuzzing the certificate parser provided by the default plugins
    (x509, pem, gmp etc.) on Google's OSS-Fuzz infrastructure (or generally with
    libFuzzer). Several issues found while fuzzing these plugins were fixed.
  * Two new options have been added to charon's retransmission settings:
    retransmit_limit and retransmit_jitter. The former adds an upper limit to the
    calculated retransmission timeout, the latter randomly reduces it.
    Refer to Retransmission for details.
  * A bug in swanctl's --load-creds command was fixed that caused unencrypted
    private keys to get unloaded if the command was called multiple times.
    The load-key VICI command now returns the key ID of the loaded key on success.
  * The credential manager now enumerates local credential sets before global ones.
    This means certificates supplied by the peer will now be preferred over certificates
    with the same identity that may be locally stored (e.g. in the certificate cache).
  * Adds support for hardware offload of IPsec SAs as introduced by Linux 4.11 for
    specific hardware that supports this.
  * The pki tool loads the curve25519 plugin by default.
    [- 0006-Make-sure-the-modulus-is-odd-and-the-exponent-not-zero.patch,
  - 0007-asn1-parser-Fix-CHOICE-parsing.patch]
- libhydra is removed as all kernel plugins moved to libcharon</changelog>
  <changelog author="ndas@suse.de" date="1504612800">- fix "uintptr_t? undeclared" compilation error.
  [+0006-fix-compilation-error-by-adding-stdint.h.patch]</changelog>
  <changelog author="ndas@suse.de" date="1504612801">- Updated to strongSwan 5.6.0 providing the following changes:
  * Fixed a DoS vulnerability in the gmp plugin that was caused by insufficient input validation
    when verifying RSA signatures, which requires decryption with the operation m^e mod n,
    where m is the signature, and e and n are the exponent and modulus of the public key.
    The value m is an integer between 0 and n-1, however, the gmp plugin did not verify this.
    So if m equals n the calculation results in 0, in which case mpz_export() returns NULL.
    This result wasn't handled properly causing a null-pointer dereference.
    This vulnerability has been registered as CVE-2017-11185. (bsc#1051222)
  * New SWIMA IMC/IMV pair implements the draft-ietf-sacm-nea-swima-patnc Internet
    Draft and has been demonstrated at the IETF 99 Prague Hackathon.
  * The IMV database template has been adapted to achieve full compliance with the
    ISO 19770-2:2015 SWID tag standard.
  * The pt-tls-client can attach and use TPM 2.0 protected private keys via the --keyid parameter.
  * By default the /etc/swanctl/conf.d directory is created and *.conf files in it are included in the default
    swanctl.conf file.
  * The curl plugin now follows HTTP redirects (configurable via strongswan.conf).
  * The CHILD_SA rekeying was fixed in charon-tkm and the behavior is refined a bit more since 5.5.3
  * libtpmtss supports Intel's TSS2 Architecture Broker and Resource Manager interface (tcti-tabrmd).
  * more on https://wiki.strongswan.org/versions/66</changelog>
  <changelog author="mmnelemane@suse.com" date="1521028800">- Removed unused requires and macro calls(bsc#1083261)</changelog>
  <changelog author="mmnelemane@suse.com" date="1573646400">- Added patch to fix vulnerability: CVE-2018-16151,CVE-2018-16152 (bsc#1107874)
  - Insufficient input validation in gmp plugin
  [+ 0007-strongswan-5.3.1-5.6.0_gmp-pkcs1-verify.patch]</changelog>
  <changelog author="mmnelemane@suse.com" date="1573646401">- Added patch to fix vulnerability: CVE-2018-5388 (bsc#1094462)
  - Buffer Underflow in stroke_socket.c
  [+ 0008-strongswan-5.1.2-5.6.2_stroke_msg_len.patch]</changelog>
  <changelog author="mmnelemane@suse.com" date="1573646402">- Added patch to fix vulnerability: CVE-2018-10811 (bsc#1093536)
  - denial-of-service vulnerability
  [+ 0009-strongswan-5.5.0-5.6.2_skeyseed_init.patch]</changelog>
  <changelog author="mmnelemane@suse.com" date="1573732800">- Added patch to fix vulnerability: CVE-2018-17540 (bsc#1109845)
  [+ 0010-strongswan-4.4.0-5.7.0_gmp-pkcs1-overflow.patch]</changelog>
  <changelog author="mmnelemane@suse.com" date="1580212800">- Updated to version 5.8.2 (jsc#SLE-11370)
  - Dropped following patches due to irrelevance in the updated version:
    [- strongswan_modprobe_syslog.patch ]
    [- strongswan_fipsfilter.patch ]
    [- 0006-fix-compilation-error-by-adding-stdint.h.patch ]
    [- 0007-strongswan-5.3.1-5.6.0_gmp-pkcs1-verify.patch ]
    [- 0008-strongswan-5.1.2-5.6.2_stroke_msg_len.patch ]
    [- 0009-strongswan-5.5.0-5.6.2_skeyseed_init.patch ]
    [- 0010-strongswan-4.4.0-5.7.0_gmp-pkcs1-overflow.patch ]
  - Version 5.8.2
  ===============
  * Identity-based CA constraints, which enforce that the certificate chain of the remote
    peer contains a CA certificate with a specific identity, are supported via
    vici/swanctl.conf. This is similar to the existing CA constraints but doesn't require
    that the CA certificate is locally installed, for instance, intermediate CA certificates
    received from the peers. Wildcard identity matching (e.g. ..., OU=Research, CN=*) could
    also be used for the latter but requires trust in the intermediate CAs to only issue
    certificates with legitimate subject DNs (e.g. the "Sales" CA must not issue certificates
    with OU=Research). With the new constraint that's not necessary as long as a path length
    basic constraint (--pathlen for pki --issue) prevents intermediate CAs from issuing further
    intermediate CAs.
  * Intermediate CA certificates may now be sent in hash-and-URL encoding by configuring a
    base URL for the parent CA (#3234, swanctl/rw-hash-and-url-multi-level).
  * Implemented NIST SP-800-90A Deterministic Random Bit Generator (DRBG) based on AES-CTR
    and SHA2-HMAC modes. Currently used by the gmp and ntru plugins.
  * Random nonces sent in an OCSP requests are now expected in the corresponding OCSP responses.
  * The kernel-netlink plugin now ignores deprecated IPv6 addresses for MOBIKE. Whether temporary
    or permanent IPv6 addresses are included now depends on the charon.prefer_temporary_addrs
    setting (#3192).
  * Extended Sequence Numbers (ESN) are configured via PF_KEY if supported by the kernel.
  * The PF_KEY socket's receive buffer in the kernel-pfkey plugin is now cleared before sending
    requests, as many of the messages sent by the kernel are sent as broadcasts to all PF_KEY
    sockets. This is an issue if an external tool is used to manage SAs/policies unrelated to
    IPsec (#3225).
  * The vici plugin now uses unique section names for CHILD_SAs in child-updown events (7c74ce9190).
  * For individually deleted CHILD_SAs (in particular for IKEv1) the vici child-updown event
    now includes more information about the CHILD_SAs such as traffic statistics (#3198).
  * Custom loggers are correctly re-registered if log levels are changed via stroke loglevel (#3182).
  * Avoid lockups during startup on low entropy systems when using OpenSSL 1.1.1 (095a2c2eac).
  * Instead of failing later when setting a key, creating HMACs via openssl plugin now fails
    instantly if the underlying hash algorithm isn't supported (e.g. MD5 in FIPS-mode) so fallbacks
    to other plugins work properly (#3284).
  * Exponents of RSA keys read from TPM 2.0 via SAPI are correctly converted (8ee1242f1438).
  * Routing table IDs &gt; 255 are supported for custom routes on Linux.
  * To avoid races, the check for hardware offloading support in the kernel-netlink plugin is
    performed during initialization of the plugin (a605452c03).
  * The D-Bus config file for charon-nm is now installed in $(datadir)/dbus-1/system.d instead of
    $(sysconfdir)/dbus-1/system.d, which is intended for sysadmin overrides.
    INVALID_MAJOR_VERSION notifies are now correctly sent in messages of the same exchange type
    and with the same message ID as the request.
  * IKEv2 SAs are now immediately destroyed when sending or receiving INVALID_SYNTAX notifies
    in authenticated messages.
  * For developers working from the repository the configure script now aborts if GNU gperf is
    not found.
  - Version 5.8.1
  ===============
  * RDNs in DNs of X.509 certificates can now optionally be matched less strict. The global
    strongswan.conf option charon.rdn_matching takes two alternative values that cause the
    matching algorithm to either ignore the order of matched RDNs (reordered) or additionally
    (relaxed) accept DNs that contain more RDNs than configured (unmatched RDNs are treated
    like wildcard matches).
  * The updown plugin now passes the same interface to the script that is also used for the
    automatically installed routes, that is, the interface over which the peer is reached
    instead of the interface on which the local address is found (#3095).
  * TPM 2.0 contexts are now protected by a mutex to prevent issues if multiple IKE_SAs use
    the same private key concurrently (4b25885025).
  * Do a rekey check after the third QM message was received (#3060).
  * If available, explicit_bzero() is now used as memwipe() instead of our own implementation.
  * An .editorconfig file has been added, mainly so Github shows files with proper indentation
    (68346b6962).
  * The internal certificate of the load-tester plugin has been modified so it can again be
    used as end-entity cert with 5.6.3 and later (#3139).
  * The maximum data length of received COOKIE notifies (64 bytes) is now enforced (#3160).
  - Version 5.8.0
  ===============
  * The systemd service units have been renamed. The modern unit, which was called
    strongswan-swanctl, is now called strongswan (the previous name is configured as alias in
    the unit, for which a symlink is created when the unit is enabled). The legacy unit is now
    called strongswan-starter.
  * Support for XFRM interfaces (available since Linux 4.19) has been added, which are intended
    to replace VTI devices (they are similar but offer several advantages, for instance, they
    are not bound to an address or address family).
  * IPsec SAs and policies are associated with such interfaces via interface IDs that can be
    configured in swanctl.conf (dynamic IDs may optionally be allocated for each SA and even
    direction). It's possible to use separate interfaces for in- and outbound traffic (or
    only use an interface in one direction and regular policies in the other).
  * Interfaces may be created dynamically via updown/vici scripts, or statically before or after
    establishing the SAs. Routes must be added manually as needed (the daemon will not install
    any routes for outbound policies with an interface ID).
  * When moving XFRM interfaces to other network namespaces they retain access to the SAs and
    policies installed in the original namespace, which allows providing IPsec tunnels for
    processes in other network namespaces without giving them access to the IPsec keys or
    IKE credentials.
    More information can be found on the page about route-based VPNs.
  * Initiation of childless IKE_SAs is supported (RFC 6023). If enabled and supported by the
    responder, no CHILD_SA is established during IKE_AUTH. Instead, all CHILD_SAs are created
    with CREATE_CHILD_SA exchanges. This allows using a separate DH exchange even for the
    first CHILD_SA, which is otherwise created during IKE_AUTH with keys derived from the
    IKE_SA's key material.
  * The swanctl --initiate command may be used to initiate only the IKE_SA via --ike
    option if --child is omitted and the peer supports this extension.
  * The NetworkManager backend and plugin support IPv6.
  * The new wolfssl plugin is a wrapper around the wolfSSL crypto library. Thanks to Sean
    Parkinson of wolfSSL Inc. for the initial patch.
  * IKE SPIs may optionally be labeled via the charon.spi_mask|label options in
    strongswan.conf. This feature was extracted from charon-tkm, however, now applies the
    mask/label in network order.
  * The openssl plugin supports ChaCha20-Poly1305 when built with OpenSSL 1.1.0.
  * The PB-TNC finite state machine according to section 3.2 of RFC 5793 was not correctly
    implemented when sending either a CRETRY or SRETRY batch. These batches can only be sent
    in the "Decided" state and a CRETRY batch can immediately carry all messages usually
    transported by a CDATA batch. It is currently not possible to send a SRETRY batch since
    full-duplex mode for PT-TLS transport is not supported.
  * Instead of marking IPv6 virtual IPs as deprecated, the kernel-netlink plugin now uses
    address labels to avoid that such addresses are used for non-VPN traffic (00a953d090).
  * The agent plugin now creates sockets to the ssh/gpg-agent dynamically and does not keep
    them open, which otherwise might prevent the agent from getting terminated.
  * To avoid broadcast loops the forecast plugin now only reinjects packets that are marked
    or received from the configured interface.
  * UTF-8 encoded passwords are supported via EAP-MSCHAPv2, which internally uses an UTF-16LE
    encoding to calculate the NT hash (#3014).
  * Properly delete temporary drop policies (used when updating IP addresses of SAs) if manual
    priorities are used, which was broken since 5.6.2 (8e31d65730).
  * Avoid overwriting start_action when parsing the inactivity timeout in the vici plugin (#2954).
  * Fixed the automatic termination of reloaded vici connections with start_action=start,
    which was broken since 5.6.3 (71b22c250f).
  * The lookup for shared secrets for IKEv1 SAs via sql plugin should now work better
    (6ec9f68f32).
  * Fixed a race condition in the trap manager between installation and removal of a policy
    (69cbe2ca3f).
  * Compilation of the kernel-netlink plugin has been fixed on old kernels (&lt; 2.6.39), which
    was caused by the HW offload changes (c7f579fa17).
  * The IPsec stack detection and module loading in starter has been removed (it wasn't
    enforced anyway and loading modules doesn't seem necessary, also KLIPS hasn't been
    supported for a long time and PF_KEY will eventually be removed from the Linux kernel,
    ba817d2917).
  * Several IKEv2 protocol details are now handled more strictly: Unrequested virtual IPs are
    ignored, CFG_REPLY payloads are ignored if no CFG_REQUEST payloads were sent, a USE
    TRANSPORT_MODE notify received from the responder is checked against the local configuration.
  * The keys and certificates used by the scenarios in the testing environment are now generated
    dynamically. Running the testing/scripts/build-certs script after creating the base and root
    images uses the pki utility installed in the latter to create the keys and certificates for
    all the CAs and in some cases for individual scenarios. These credentials are stored in the
    source tree, not the image, so this has to be called only once even if the images are later
    rebuilt. The script automatically (re-)rebuilds the guest images as that generates fresh
    CRLs and signs the DNS zones. The only keys/certificates currently not generated are the
    very large ones used by the ikev2/rw-eap-tls-fragments scenario.
  - Version 5.7.2
  ===============
  * For RSA with PSS padding, the TPM 2.0 specification mandates the maximum salt length
    (as defined by the length of the key and hash). However, if the TPM is FIPS-168-4 compliant,
    the salt length equals the hash length. This is assumed for FIPS-140-2 compliant TPMs, but
    if that's not the case, it might be necessary to manually enable charon.plugins.tpm.fips_186_4
    if the TPM doesn't use the maximum salt length.
  * Directories for credentials loaded by swanctl are now accessed relative to the loaded
    swanctl.conf file, in particular, when loading it from a custom location via --file argument.
  * The base directory, which is used if no custom location for swanctl.conf is specified, is now
    also configurable at runtime via SWANCTL_DIR environment variable.
  * If RADIUS Accounting is enabled, the eap-radius plugin will add the session ID (Acct-Session-Id)
    to Access-Request messages, which e.g. simplifies associating database entries for IP leases and
    accounting with sessions (the session ID does not change when IKE_SAs are rekeyed, #2853).
  * All IP addresses assigned by a RADIUS server are included in Accounting-Stop messages even if
    the client did not claim them, allowing to release them early in case of connection errors (#2856).
  * Selectors installed on transport mode SAs by the kernel-netlink plugin are now updated if an
    IP address changes (e.g. via MOBIKE) and it was part of the selectors.
  * No deletes are sent anymore when a rekeyed CHILD_SA expires (#2815).
  * The bypass-lan plugin now tracks interfaces to handle subnets that move from one interface
    to another and properly update associated routes (#2820).
  * Only valid and expected inbound IKEv2 messages are used to update the timestamp of the
    last received message (previously, retransmits also triggered an update).
  * IKEv2 requests from responders are now ignored until the IKE_SA is fully established (e.g. if a
    DPD request from the peer arrives before the IKE_AUTH response does, 46bea1add9).
    Delayed IKE_SA_INIT responses with COOKIE notifies we already recevied are ignored, they caused
    another reset of the IKE_SA previously (#2837).
  * Active and queued Quick Mode tasks are now adopted if the peer reauthenticates an IKEv1 SA
    while creating lots of CHILD_SAs.
  * Newer versions of the FreeBSD kernel add an SADB_X_EXT_SA2 extension to SADB_ACQUIRE
    messages, which allows the kernel-pfkey plugin to determine the reqid of the policy even if it
    wasn't installed by the daemon previously (e.g. when using FreeBSD's if_ipsec(4) VTIs, which
    install policies themselves, 872b9b3e8d).
  * Added support for RSA signatures with SHA-256 and SHA-512 to the agent plugin. For older
    versions of ssh/gpg-agent that only support SHA-1, IKEv2 signature authentication has to be
    disabled via charon.signature_authentication.
  * The sshkey and agent plugins support Ed25519/Ed448 SSH keys and signatures.
  * The openssl plugin supports X25519/X448 Diffie-Hellman and Ed25519/Ed448 keys and
    signatures when built against OpenSSL 1.1.1.
  * Support for Ed25519, ChaCha20/Poly1305, SHA-3 and AES-CCM were added to the botan plugin.
  * The mysql plugin now properly handles database connections with transactions
    under heavy load (#2779).
  * IP addresses in ha pools are now distributed evenly among all segments (#2828).
  * Private key implementations may optionally provide a list of supported signature schemes,
    which, as described above, is used by the tpm plugin because for each key on a TPM 2.0 the
    hash algorithm and for RSA also the padding scheme is predefined.
  * The testing environment is now based on Debian 9 (stretch) by default. This required
    some changes, in particular, updating to FreeRADIUS 3.x (which forced us to abandon the
    TNC@FHH patches and scenarios, 2fbe44bef3) and removing FIPS-enabled versions of
    OpenSSL (the FIPS module only supports OpenSSL 1.0.2).
  * Most test scenarios were migrated to swanctl.
  - Version 5.7.1
  ===============
  * Fixes a vulnerability in the gmp plugin triggered by crafted certificates with RSA keys with
    very small moduli. When verifying signatures with such keys, the code patched with the fix
    for CVE-2018-16151/2 caused an integer underflow and subsequent heap buffer overflow
    that results in a crash of the daemon.
  * The vulnerability has been registered as CVE-2018-17540.
  - Version 5.7.0
  ===============
  * Fixes a potential authorization bypass vulnerability in the gmp plugin that was caused by a
    too lenient verification of PKCS#1 v1.5 signatures. Several flaws could be exploited by a
    Bleichenbacher-style attack to forge signatures for low-exponent keys (i.e. with e=3).
  * CVE-2018-16151 has been assigned to the problem of accepting random bytes after the OID
    of the hash function in such signatures, and CVE-2018-16152 has been assigned to the issue
    of not verifying that the parameters in the ASN.1 algorithmIdentitifer structure is empty.
    Other flaws that don't lead to a vulnerability directly (e.g. not checking for at least
    8 bytes of padding) have no separate CVE assigned.
  * Dots are not allowed anymore in section names in swanctl.conf and strongswan.conf.
    This mainly affects the configuration of file loggers. If the path for such a log file
    contains dots it now has to be configured in the new path setting within the arbitrarily
    renamed subsection in the filelog section.
  * Sections in swanctl.conf and strongswan.conf may now reference other sections. All settings
    and subsections from such a section are inherited. This allows to simplify configs as
    redundant information has only to be specified once and may then be included in other
    sections (see strongswan.conf for an example).
  * The originally selected IKE config (based on the IPs and IKE version) can now change
    if no matching algorithm proposal is found. This way the order of the configs doesn't
    matter that much anymore and it's easily possible to specify separate configs for
    clients that require weaker algorithms (instead of having to also add them in other
    configs that might be selected).
  * Support for Postquantum Preshared Keys for IKEv2 (draft-ietf-ipsecme-qr-ikev2) has been added.
    For an example refer to the swanctl/rw-cert-ppk scenario (or with EAP, or PSK authentication).
  * The new botan plugin is a wrapper around the Botan C++ crypto library.
    It requires a fairly recent build from Botan's master branch (or the upcoming 2.8.0 release).
    Thanks to René Korthaus and his team from Rohde &amp; Schwarz Cybersecurity for the initial
    patch and to Jack Lloyd for quickly adding missing functions to Botan's FFI (C89) interface.
  * Implementation of RFC 8412 "Software Inventory Message and Attributes (SWIMA) for PA-TNC".
  * SWIMA subscription option sets CLOSE_WRITE trigger on apt history.log file resulting in
    a ClientRetry PB-TNC batch to initialize a new measurement cycle. The new imv/imc-swima
    plugins replace the previous imv/imc-swid plugins, which were removed.
  * Added support for fuzzing the PA-TNC (RFC 5792) and PB-TNC (RFC 5793) NEA protocols
    on Google's OSS-Fuzz infrastructure.
  * Support for version 2 of Intel's TPM2-TSS TGC Software Stack. The presence of the
    in-kernel /dev/tpmrm0 resource manager is automatically detected.
  * The pki tool accepts a xmppAddr otherName as a subjectAlternativeName using the
    syntax --san xmppaddr:&lt;jid&gt;.
  * swanctl.conf supports the configuration of marks the in- and/or outbound SA should apply
    to packets after processing on Linux. Configuring such a mark for outbound SAs requires
    at least a 4.14 kernel. The ability to set a mask and configuring a mark/mask for
    inbound SAs will be added with the upcoming 4.19 kernel.
  * New options in swanctl.conf allow configuring how/whether DF, ECN and DS fields in the
    IP headers are copied during IPsec processing. Controlling this is currently only possible
    on Linux.
  * The handling of sequence numbers in IKEv1 DPDs has been improved (#2714).
  * To avoid conflicts, the dhcp plugin now only uses the DHCP server port if explicitly
    configured.
  - Version 5.6.3
  ===============
  * Fixed a DoS vulnerability in the IKEv2 key derivation if the openssl plugin is used in FIPS
    mode and HMAC-MD5 is negotiated as PRF.
    This vulnerability has been registered as CVE-2018-10811.
  * Fixed a vulnerability in the stroke plugin, which did not check the received length before
    reading a message from the socket. Unless a group is configured, root privileges are
    required to access that socket, so in the default configuration this shouldn't be an issue.
    This vulnerability has been registered as CVE-2018-5388.
  * CRLs that are not yet valid are now ignored to avoid problems in scenarios where expired
    certificates are removed from new CRLs and the clock on the host doing the revocation
    check is trailing behind that of the host issuing CRLs. Not doing this could result in
    accepting a revoked and expired certificate, if it's still valid according to the
    trailing clock but not contained anymore in not yet valid CRLs.
  * The issuer of fetched CRLs is now compared to the issuer of the checked certificate (#2608).
  * CRL validation results other than revocation (e.g. a skipped check because the CRL couldn't
    be fetched) are now stored also for intermediate CA certificates and not only for end-entity
    certificates, so a strict CRL policy can be enforced in such cases.
  * In compliance with RFC 4945, section 5.1.3.2, certificates used for IKE must now either
    not contain a keyUsage extension (like the ones generated by pki), or have at least one of the
    digitalSignature or nonRepudiation bits set.
  * New options for vici/swanctl allow forcing the local termination of an IKE_SA. This might be
    useful in situations where it's known the other end is not reachable anymore, or that it
    already removed the IKE_SA, so retransmitting a DELETE and waiting for a response would
    be pointless.
  * Waiting only a certain amount of time for a response (i.e. shorter than all retransmits
    would be) before destroying the IKE_SA is also possible by additionally specifying a
    timeout in the forced termination request.
  * When removing routes, the kernel-netlink plugin now checks if it tracks other routes for
    the same destination and replaces the installed route instead of just removing it. Same
    during installation, where existing routes previously weren't replaced. This should allow
    using traps with virtual IPs on Linux (#2162).
  * The dhcp plugin now only sends the client identifier DHCP option if the identity_lease
    setting is enabled (7b660944b6). It can also send identities of up to 255 bytes length,
    instead of the previous 64 bytes (30e886fe3b, 0e5b94d038). If a server address is
    configured, DHCP requests are now sent from port 67 instead of 68 to avoid ICMP port
    unreachables (becf027cd9).
  * The handling of faulty INVALID_KE_PAYLOAD notifies (e.g. one containing a DH group
    that wasn't proposed) during CREATE_CHILD_SA exchanges has been improved (#2536).
  * Roam events are now completely ignored for IKEv1 SAs (there is no MOBIKE to handle such
    changes properly).
  * ChaCha20/Poly1305 is now correctly proposed without key length (#2614). For compatibility with
    older releases the chacha20poly1305compat keyword may be included in proposals to also propose
    the algorithm with a key length (c58434aeff).
  * Configuration of hardware offload of IPsec SAs is now more flexible and allows a new
    setting (auto), which automatically uses it if the kernel and device both support it. If hw
    offload is set to yes and offloading is not supported, the CHILD_SA installation now fails.
  * The kernel-pfkey plugin optionally installs routes via internal interface (one with an IP
    in the local traffic selector). On FreeBSD, enabling this selects the correct source IP
    when sending packets from the gateway itself (e811659323).
  * SHA-2 based PRFs are supported in PKCS#8 files as generated by OpenSSL 1.1 (#2574).
  * The pki --verify tool may load CA certificates and CRLs from directories.
  * The IKE daemon now also switches to port 4500 if the remote port is not 500 (e.g. because the
    remote maps the response to a different port, as might happen on Azure), as long as the local
    port is 500 (85bfab621d).
  * Fixed an issue with DNS servers passed to NetworkManager in charon-nm (ee8c25516a).
  * Logged traffic selectors now always contain the protocol if either protocol or port are set
    (a36d8097ed).
  * Only the inbound SA/policy will be updated as reaction to IP address changes for rekeyed
    CHILD_SAs that are kept around.
  * The parser for strongswan.conf/swanctl.conf now accepts = characters in values without
    having to put the value in quotes (e.g. for Base64 encoded shared secrets).
    Notes for developers:
  * trap_manager_t: Trap policies are now unistalled by peer/child name and not the reqid.
  * No reqid is returned anymore when installing trap policies.
  * child_sa_t: A new state (CHILD_DELETED) is used for CHILD_SAs that have been deleted but
    not yet destroyed (after a rekeying CHILD_SAs are kept around for a while to process
    delayed packets).
    This way child_updown events are not triggered anymore for such SAs when an IKE_SA that
    has such CHILD_SAs assigned is deleted.
  - Version 5.6.2
  ===============
  * Fixed a DoS vulnerability in the parser for PKCS#1 RSASSA-PSS signatures that was caused
    by insufficient input validation. One of the configurable parameters in algorithm identifier
    structures for RSASSA-PSS signatures is the mask generation function (MGF). Only MGF1 is
    currently specified for this purpose. However, this in turn takes itself a parameter that
    specifies the underlying hash function. strongSwan's parser did not correctly handle the
    case of this parameter being absent, causing an undefined data read.
    This vulnerability has been registered as CVE-2018-6459.
  * When rekeying IKEv2 IKE_SAs the previously negotiated DH group will be reused, instead of
    using the first configured group, which avoids an additional exchange if the peer previously
    selected a different DH group via INVALID_KE_PAYLOAD notify. The same is also done when
    rekeying CHILD_SAs except for the first rekeying of the CHILD_SA that was created with the
    IKE_SA, where no DH group was negotiated yet.
    Also, the selected DH group is moved to the front in all sent proposals that contain it
    and all proposals that don't are moved to the back in order to convey the preference for
    this group to the peer.
  * Handling of MOBIKE task queuing has been improved. In particular, the response to an
    address update (with NAT-D payloads) is not ignored anymore if only an address list update
    or DPD is queued as that could prevent updating the UDP encapsulation in the kernel.
  * On Linux, roam events may optionally be triggered by changes to the routing rules, which
    can be useful if routing rules (instead of e.g. route metrics) are used to switch from one
    to another interface (i.e. from one to another routing table). Since routing rules are
    currently not evaluated when doing route lookups this is only useful if the kernel-based
    route lookup is used (4664992f7d).
  * The fallback drop policies installed to avoid traffic leaks when replacing addresses in
    installed policies are now replaced by temporary drop policies, which also prevent
    acquires because we currently delete and reinstall IPsec SAs to update their addresses
    (35ef1b032d).
  * Access X.509 certificates held in non-volatile storage of a TPM 2.0 referenced via the
    NV index.
    Adding the --keyid parameter to pki --print allows to print private keys or certificates
    stored in a smartcard or a TPM 2.0.
  * Fixed proposal selection if a peer incorrectly sends DH groups in the ESP proposal during
    IKE_AUTH and also if a DH group is configured in the local ESP proposal and charon.prefer
    configured_proposals is disabled (d058fd3c32).
  * The lookup for PSK secrets for IKEv1 has been improved for certain scenarios (see #2497
    for details).
  * MSKs received via RADIUS are now padded to 64 bytes to avoid compatibility issues with
    EAP-MSCHAPv2 and PRFs that have a block size &lt; 64 bytes (e.g. AES-XCBC-PRF-128, see
    73cbce6013).
  * The tpm_extendpcr command line tool extends a digest into a TPM PCR.
  * Ported the NetworkManager backend from the deprecated libnm-glib to libnm.
  * The save-keys debugging/development plugin saves IKE and/or ESP keys to files compatible
    with Wireshark.
  - Version 5.6.1
  ===============
  * Several algorithms were removed from the default ESP/AH and IKE proposals in compliance with
    RFC 8221 and RFC 8247, respectively. Removed from the default ESP/AH proposal were the
    3DES and Blowfish encryption algorithms and the HMAC-MD5 integrity algorithm. From the IKE
    default proposal the HMAC-MD5 integrity algorithm and the MODP-1024 Diffie-Hellman group
    were removed (the latter is significant for Windows clients in their default configuration).
    These algorithms may still be used in custom proposals.
  * Support for RSASSA-PSS signatures has been added. For compatibility with previous
    releases they are currently not used automatically, by default, to change that charon.rsa_pss
    may be enabled. To explicitly use or require such signatures during IKEv2 signature
    authentication (RFC 7427) ike:rsa/pss... authentication constraints may be used for specific
    connections (regardless of whether the strongswan.conf option above is enabled). Only the
    hash algorithm can be specified in such constraints, the MGF1 will be based on that hash
    and the salt length will equal the hash length (when verifying the salt length is not
    enforced).
    To enforce such signatures during PKI verification use rsa/pss... authentication constraints.
  * All pki commands that create certificates/CRLs can be made to sign with RSASSA-PSS instead
    of the classing PKCS#1 scheme with the --rsa-padding pss option. As with signatures during
    authentication, only the hash algorithm is configurable (via --digest option), the MGF1 will
    be based on that and the salt length will equal the hash length.
  * These signatures are supported by all RSA backends except pkcs11 (i.e. gmp, gcrypt, openssl).
    The gmp plugin requires the mgf1 plugin.
    Note that RSASSA-PSS algorithm identifiers and parameters in keys (public keys in
    certificates or private keys in PKCS#8 files) are currently not used as constraints.
  * The sec-updater tool checks for security updates in dpkg-based repositories
    (e.g. Debian/Ubuntu) and sets the security flags in the IMV policy database accordingly.
    Additionally for each new package version a SWID tag for the given OS and HW architecture
    is created and stored in the database.
  * Using the sec-updater.sh script template the lookup can be automated (e.g. via an hourly
    cron job).
  * When restarting an IKEv2 negotiation after receiving an INVALID_KE_PAYLOAD notify (or due
    to other reasons like too many retransmits) a new initiator SPI is allocated. This
    prevents issues caused by retransmits for IKE_SA_INIT messages.
  * Because the initiator SPI was previously reused when restarting the connection delayed
    responses for previous connection attempts were processed and might have caused fatal
    errors due to a failed DH negotiation or because of the internal retry counter in the
    ike-init task. For instance, if we proposed a DH group the responder rejected we
    might have later received delayed responses that either contained INVALID_KE_PAYLOAD
    notifies with the DH group we already switched to, or, if we retransmitted an
    IKE_SA_INIT with the requested group but then had to restart again, a KE payload with
    a group different from the one we proposed.
  * The introduction of file versions in the IMV database scheme broke file reference hash
    measurements. This has been fixed by creating generic product versions having an empty
    package name.
  * A new timeout option for the systime-fix plugin stops periodic system time checks after
    a while and enforces a certificate verification, closing or reauthenticating all SAs
    with invalid certificates.
  * The IKE event counters, previously only available via ipsec listcounters command, may
    now also be queried and reset via vici and the new swanctl --counters command. They
    are collected and provided by the optional counters plugin (enabled by default for
    backwards compatibility if the stroke plugin is built).
  * Class attributes received in RADIUS Access-Accept messages may optionally be added to
    RADIUS accounting messages (655924074b).
  * Basic support for systemd sockets has been added, which may be used for privilege separation
    (59db98fb94).
  * Inbound marks may optionally be installed in the SA again (was removed with 5.5.2) by
    enabling the mark_in_sa option in swanctl.conf.
  * The timeout of leases in pools configured via pool utility may be configured in other
    units than hours.
    INITIAL_CONTACT notifies are now only omitted if never is configured as uniqueness policy.
  * Outbound FWD policies for shunts are not installed anymore, by default (as is the case
    for other policies since 5.5.1).
  * Don't consider a DH group mismatch during CHILD_SA rekeying as failure as responder
    (e7276f78aa).
  * Handling of fragmented IPv4 and IPv6 packets in libipsec has been improved (e138003de9).
  * Trigger expire events for the correct IPsec SA in libipsec (6e861947a0).
  * A crash in CRL verification via openssl plugin using OpenSSL 1.1 has been fixed (78acaba6a1).
  * No hard-coded default proposals are passed from starter to the stroke plugin anymore (the
    IKE proposal used curve25519 since 5.5.2, which is an optional plugin).
  * A workaround for an issue with virtual IPs on macOS 10.13 (High Sierra) has been added
    (039b85dd43).
  * Handling of IKE_SA rekey collisions in charon-tkm has been fixed.
  * Instead of failing or just silently doing nothing unit tests may now warn about certain
    conditions (e.g. if a test was not executed due to external dependencies).</changelog>
  <changelog author="mmnelemane@suse.com" date="1585224000">- Fix for to resolve multiple definition of swanctl_dir (bsc #1164493)
  [+ 0006-Resolve-multiple-definition-of-swanctl_dir.patch]</changelog>
  <changelog author="mbuil@suse.com" date="1610712000">- Fix typo in README (bsc #1167880)
  [+ 0007-Fix-typo-in-README.patch ]</changelog>
  <changelog author="mbuil@suse.com" date="1611576000">- Fix FIPS bug (bsc #1180801)
  [+ 0008-gcrypt-Use-a-dummy-buffer-to-initialize-static-alloc.patch ]</changelog>
  <changelog author="mbuil@suse.com" date="1617019200">- Keep using ipsec as the main binary. Therefore, make strongswan.service point to it instead of swanctl</changelog>
  <changelog author="mbuil@suse.com" date="1617019201">- Information added in README about the rcstrongswan-starter</changelog>
  <changelog author="mbuil@suse.com" date="1617624000">- Add config to run ipsec on namespaces (bsc #1183670)</changelog>
  <changelog author="mt@suse.com" date="1619006400">- Add support for AES CCM aead algorithms to openssl plugin (cc/fips,bsc#1185363)
  [+ 0009-strongswan-openssl-aead-add-ccm-support.patch]</changelog>
  <changelog author="mt@suse.com" date="1620388800">- Replace AEAD AES CCM patch with upstream variant (cc/fips,bsc#1185363)
  [* 0009-strongswan-openssl-aead-add-ccm-support.patch]</changelog>
  <changelog author="hare@suse.de" date="1627646400">- Add auth_els plugin to support Marvell FC-SP encryption (jsc#SLE-20151)
  [* strongswan-marvell-auth-els.patch]</changelog>
  <changelog author="abergmann@suse.com" date="1634040000">- Fix integer overflow in gmp plugin (bsc#1191367, CVE-2021-41990)
  [* strongswan-5.6.1-5.9.3_gmp-rsa-ssa-salt-len.patch]
- Fix integer overflow when replacing certificates in cache (bsc#1191435, CVE-2021-41991)
  [* strongswan-4.4.1-5.9.3_cert-cache-random.patch]</changelog>
  <changelog author="meissner@suse.com" date="1643025600">- strongswan-5.5.0-5.9.4_eap_success-CVE-2021-45079.patch:
  Fixed authentication bypass in EAP authentication (CVE-2021-45079
  bsc#1194471)</changelog>
</package>
<package pkgid="decd3706144a5bf52c6bdcf8080a80d949b9962873815cdceb4f50f7cf9ba96a" name="strongswan-doc" arch="noarch">
  <version epoch="0" ver="5.8.2" rel="11.24.1"/>
  <changelog author="ndas@suse.de" date="1501502400">- Updated to strongSwan 5.3.5(bsc#1050691) providing the following changes:
  * Fixed a DoS vulnerability in the gmp plugin that was caused by insufficient input
    validation when verifying RSA signatures. More specifically, mpz_powm_sec() has two
    requirements regarding the passed exponent and modulus that the plugin did not
    enforce, if these are not met the calculation will result in a floating point exception
    that crashes the whole process.
    This vulnerability has been registered as CVE-2017-9022.
    Please refer to our blog for details.
  * Fixed a DoS vulnerability in the x509 plugin that was caused because the ASN.1 parser
    didn't handle ASN.1 CHOICE types properly, which could result in an infinite loop when
    parsing X.509 extensions that use such types.
    This vulnerability has been registered as CVE-2017-9023.
    Please refer to our blog for details.
  * The behavior during IKEv2 CHILD_SA rekeying has been changed in order to avoid
    traffic loss. When responding to a CREATE_CHILD_SA request to rekey a CHILD_SA
    the responder already has everything available to install and use the new CHILD_SA.
    However, this could lead to lost traffic as the initiator won't be able to process
    inbound packets until it processed the CREATE_CHILD_SA response and updated the
    inbound SA. To avoid this the responder now only installs the new inbound SA and
    delays installing the outbound SA until it receives the DELETE for the replaced CHILD_SA.
  * The messages transporting these DELETEs could reach the peer before packets sent
    with the deleted outbound SAs reach it. To reduce the chance of traffic loss due
    to this the inbound SA of the replaced CHILD_SA is not removed for a configurable
    amount of seconds (charon.delete_rekeyed_delay) after the DELETE has been processed.
  * The code base has been ported to Apple's ARM64 iOS platform, which required several
    changes regarding the use of variadic functions. This was necessary because the calling
    conventions for variadic and regular functions are different there.
    This means that assigning a non-variadic function to a variadic function pointer, as we
    did with our enumerator_t::enumerate() implementations and several callbacks, will
    result in crashes as the called function accesses the arguments differently than the
    caller provided them. To avoid this issue the enumerator_t interface has been changed
    and the signature of the callback functions for enumerator_create_filter() and two
    methods on linked_list_t have been changed. Refer to the developer notes below
    for details.
  * Adds support for fuzzing the certificate parser provided by the default plugins
    (x509, pem, gmp etc.) on Google's OSS-Fuzz infrastructure (or generally with
    libFuzzer). Several issues found while fuzzing these plugins were fixed.
  * Two new options have been added to charon's retransmission settings:
    retransmit_limit and retransmit_jitter. The former adds an upper limit to the
    calculated retransmission timeout, the latter randomly reduces it.
    Refer to Retransmission for details.
  * A bug in swanctl's --load-creds command was fixed that caused unencrypted
    private keys to get unloaded if the command was called multiple times.
    The load-key VICI command now returns the key ID of the loaded key on success.
  * The credential manager now enumerates local credential sets before global ones.
    This means certificates supplied by the peer will now be preferred over certificates
    with the same identity that may be locally stored (e.g. in the certificate cache).
  * Adds support for hardware offload of IPsec SAs as introduced by Linux 4.11 for
    specific hardware that supports this.
  * The pki tool loads the curve25519 plugin by default.
    [- 0006-Make-sure-the-modulus-is-odd-and-the-exponent-not-zero.patch,
  - 0007-asn1-parser-Fix-CHOICE-parsing.patch]
- libhydra is removed as all kernel plugins moved to libcharon</changelog>
  <changelog author="ndas@suse.de" date="1504612800">- fix "uintptr_t? undeclared" compilation error.
  [+0006-fix-compilation-error-by-adding-stdint.h.patch]</changelog>
  <changelog author="ndas@suse.de" date="1504612801">- Updated to strongSwan 5.6.0 providing the following changes:
  * Fixed a DoS vulnerability in the gmp plugin that was caused by insufficient input validation
    when verifying RSA signatures, which requires decryption with the operation m^e mod n,
    where m is the signature, and e and n are the exponent and modulus of the public key.
    The value m is an integer between 0 and n-1, however, the gmp plugin did not verify this.
    So if m equals n the calculation results in 0, in which case mpz_export() returns NULL.
    This result wasn't handled properly causing a null-pointer dereference.
    This vulnerability has been registered as CVE-2017-11185. (bsc#1051222)
  * New SWIMA IMC/IMV pair implements the draft-ietf-sacm-nea-swima-patnc Internet
    Draft and has been demonstrated at the IETF 99 Prague Hackathon.
  * The IMV database template has been adapted to achieve full compliance with the
    ISO 19770-2:2015 SWID tag standard.
  * The pt-tls-client can attach and use TPM 2.0 protected private keys via the --keyid parameter.
  * By default the /etc/swanctl/conf.d directory is created and *.conf files in it are included in the default
    swanctl.conf file.
  * The curl plugin now follows HTTP redirects (configurable via strongswan.conf).
  * The CHILD_SA rekeying was fixed in charon-tkm and the behavior is refined a bit more since 5.5.3
  * libtpmtss supports Intel's TSS2 Architecture Broker and Resource Manager interface (tcti-tabrmd).
  * more on https://wiki.strongswan.org/versions/66</changelog>
  <changelog author="mmnelemane@suse.com" date="1521028800">- Removed unused requires and macro calls(bsc#1083261)</changelog>
  <changelog author="mmnelemane@suse.com" date="1573646400">- Added patch to fix vulnerability: CVE-2018-16151,CVE-2018-16152 (bsc#1107874)
  - Insufficient input validation in gmp plugin
  [+ 0007-strongswan-5.3.1-5.6.0_gmp-pkcs1-verify.patch]</changelog>
  <changelog author="mmnelemane@suse.com" date="1573646401">- Added patch to fix vulnerability: CVE-2018-5388 (bsc#1094462)
  - Buffer Underflow in stroke_socket.c
  [+ 0008-strongswan-5.1.2-5.6.2_stroke_msg_len.patch]</changelog>
  <changelog author="mmnelemane@suse.com" date="1573646402">- Added patch to fix vulnerability: CVE-2018-10811 (bsc#1093536)
  - denial-of-service vulnerability
  [+ 0009-strongswan-5.5.0-5.6.2_skeyseed_init.patch]</changelog>
  <changelog author="mmnelemane@suse.com" date="1573732800">- Added patch to fix vulnerability: CVE-2018-17540 (bsc#1109845)
  [+ 0010-strongswan-4.4.0-5.7.0_gmp-pkcs1-overflow.patch]</changelog>
  <changelog author="mmnelemane@suse.com" date="1580212800">- Updated to version 5.8.2 (jsc#SLE-11370)
  - Dropped following patches due to irrelevance in the updated version:
    [- strongswan_modprobe_syslog.patch ]
    [- strongswan_fipsfilter.patch ]
    [- 0006-fix-compilation-error-by-adding-stdint.h.patch ]
    [- 0007-strongswan-5.3.1-5.6.0_gmp-pkcs1-verify.patch ]
    [- 0008-strongswan-5.1.2-5.6.2_stroke_msg_len.patch ]
    [- 0009-strongswan-5.5.0-5.6.2_skeyseed_init.patch ]
    [- 0010-strongswan-4.4.0-5.7.0_gmp-pkcs1-overflow.patch ]
  - Version 5.8.2
  ===============
  * Identity-based CA constraints, which enforce that the certificate chain of the remote
    peer contains a CA certificate with a specific identity, are supported via
    vici/swanctl.conf. This is similar to the existing CA constraints but doesn't require
    that the CA certificate is locally installed, for instance, intermediate CA certificates
    received from the peers. Wildcard identity matching (e.g. ..., OU=Research, CN=*) could
    also be used for the latter but requires trust in the intermediate CAs to only issue
    certificates with legitimate subject DNs (e.g. the "Sales" CA must not issue certificates
    with OU=Research). With the new constraint that's not necessary as long as a path length
    basic constraint (--pathlen for pki --issue) prevents intermediate CAs from issuing further
    intermediate CAs.
  * Intermediate CA certificates may now be sent in hash-and-URL encoding by configuring a
    base URL for the parent CA (#3234, swanctl/rw-hash-and-url-multi-level).
  * Implemented NIST SP-800-90A Deterministic Random Bit Generator (DRBG) based on AES-CTR
    and SHA2-HMAC modes. Currently used by the gmp and ntru plugins.
  * Random nonces sent in an OCSP requests are now expected in the corresponding OCSP responses.
  * The kernel-netlink plugin now ignores deprecated IPv6 addresses for MOBIKE. Whether temporary
    or permanent IPv6 addresses are included now depends on the charon.prefer_temporary_addrs
    setting (#3192).
  * Extended Sequence Numbers (ESN) are configured via PF_KEY if supported by the kernel.
  * The PF_KEY socket's receive buffer in the kernel-pfkey plugin is now cleared before sending
    requests, as many of the messages sent by the kernel are sent as broadcasts to all PF_KEY
    sockets. This is an issue if an external tool is used to manage SAs/policies unrelated to
    IPsec (#3225).
  * The vici plugin now uses unique section names for CHILD_SAs in child-updown events (7c74ce9190).
  * For individually deleted CHILD_SAs (in particular for IKEv1) the vici child-updown event
    now includes more information about the CHILD_SAs such as traffic statistics (#3198).
  * Custom loggers are correctly re-registered if log levels are changed via stroke loglevel (#3182).
  * Avoid lockups during startup on low entropy systems when using OpenSSL 1.1.1 (095a2c2eac).
  * Instead of failing later when setting a key, creating HMACs via openssl plugin now fails
    instantly if the underlying hash algorithm isn't supported (e.g. MD5 in FIPS-mode) so fallbacks
    to other plugins work properly (#3284).
  * Exponents of RSA keys read from TPM 2.0 via SAPI are correctly converted (8ee1242f1438).
  * Routing table IDs &gt; 255 are supported for custom routes on Linux.
  * To avoid races, the check for hardware offloading support in the kernel-netlink plugin is
    performed during initialization of the plugin (a605452c03).
  * The D-Bus config file for charon-nm is now installed in $(datadir)/dbus-1/system.d instead of
    $(sysconfdir)/dbus-1/system.d, which is intended for sysadmin overrides.
    INVALID_MAJOR_VERSION notifies are now correctly sent in messages of the same exchange type
    and with the same message ID as the request.
  * IKEv2 SAs are now immediately destroyed when sending or receiving INVALID_SYNTAX notifies
    in authenticated messages.
  * For developers working from the repository the configure script now aborts if GNU gperf is
    not found.
  - Version 5.8.1
  ===============
  * RDNs in DNs of X.509 certificates can now optionally be matched less strict. The global
    strongswan.conf option charon.rdn_matching takes two alternative values that cause the
    matching algorithm to either ignore the order of matched RDNs (reordered) or additionally
    (relaxed) accept DNs that contain more RDNs than configured (unmatched RDNs are treated
    like wildcard matches).
  * The updown plugin now passes the same interface to the script that is also used for the
    automatically installed routes, that is, the interface over which the peer is reached
    instead of the interface on which the local address is found (#3095).
  * TPM 2.0 contexts are now protected by a mutex to prevent issues if multiple IKE_SAs use
    the same private key concurrently (4b25885025).
  * Do a rekey check after the third QM message was received (#3060).
  * If available, explicit_bzero() is now used as memwipe() instead of our own implementation.
  * An .editorconfig file has been added, mainly so Github shows files with proper indentation
    (68346b6962).
  * The internal certificate of the load-tester plugin has been modified so it can again be
    used as end-entity cert with 5.6.3 and later (#3139).
  * The maximum data length of received COOKIE notifies (64 bytes) is now enforced (#3160).
  - Version 5.8.0
  ===============
  * The systemd service units have been renamed. The modern unit, which was called
    strongswan-swanctl, is now called strongswan (the previous name is configured as alias in
    the unit, for which a symlink is created when the unit is enabled). The legacy unit is now
    called strongswan-starter.
  * Support for XFRM interfaces (available since Linux 4.19) has been added, which are intended
    to replace VTI devices (they are similar but offer several advantages, for instance, they
    are not bound to an address or address family).
  * IPsec SAs and policies are associated with such interfaces via interface IDs that can be
    configured in swanctl.conf (dynamic IDs may optionally be allocated for each SA and even
    direction). It's possible to use separate interfaces for in- and outbound traffic (or
    only use an interface in one direction and regular policies in the other).
  * Interfaces may be created dynamically via updown/vici scripts, or statically before or after
    establishing the SAs. Routes must be added manually as needed (the daemon will not install
    any routes for outbound policies with an interface ID).
  * When moving XFRM interfaces to other network namespaces they retain access to the SAs and
    policies installed in the original namespace, which allows providing IPsec tunnels for
    processes in other network namespaces without giving them access to the IPsec keys or
    IKE credentials.
    More information can be found on the page about route-based VPNs.
  * Initiation of childless IKE_SAs is supported (RFC 6023). If enabled and supported by the
    responder, no CHILD_SA is established during IKE_AUTH. Instead, all CHILD_SAs are created
    with CREATE_CHILD_SA exchanges. This allows using a separate DH exchange even for the
    first CHILD_SA, which is otherwise created during IKE_AUTH with keys derived from the
    IKE_SA's key material.
  * The swanctl --initiate command may be used to initiate only the IKE_SA via --ike
    option if --child is omitted and the peer supports this extension.
  * The NetworkManager backend and plugin support IPv6.
  * The new wolfssl plugin is a wrapper around the wolfSSL crypto library. Thanks to Sean
    Parkinson of wolfSSL Inc. for the initial patch.
  * IKE SPIs may optionally be labeled via the charon.spi_mask|label options in
    strongswan.conf. This feature was extracted from charon-tkm, however, now applies the
    mask/label in network order.
  * The openssl plugin supports ChaCha20-Poly1305 when built with OpenSSL 1.1.0.
  * The PB-TNC finite state machine according to section 3.2 of RFC 5793 was not correctly
    implemented when sending either a CRETRY or SRETRY batch. These batches can only be sent
    in the "Decided" state and a CRETRY batch can immediately carry all messages usually
    transported by a CDATA batch. It is currently not possible to send a SRETRY batch since
    full-duplex mode for PT-TLS transport is not supported.
  * Instead of marking IPv6 virtual IPs as deprecated, the kernel-netlink plugin now uses
    address labels to avoid that such addresses are used for non-VPN traffic (00a953d090).
  * The agent plugin now creates sockets to the ssh/gpg-agent dynamically and does not keep
    them open, which otherwise might prevent the agent from getting terminated.
  * To avoid broadcast loops the forecast plugin now only reinjects packets that are marked
    or received from the configured interface.
  * UTF-8 encoded passwords are supported via EAP-MSCHAPv2, which internally uses an UTF-16LE
    encoding to calculate the NT hash (#3014).
  * Properly delete temporary drop policies (used when updating IP addresses of SAs) if manual
    priorities are used, which was broken since 5.6.2 (8e31d65730).
  * Avoid overwriting start_action when parsing the inactivity timeout in the vici plugin (#2954).
  * Fixed the automatic termination of reloaded vici connections with start_action=start,
    which was broken since 5.6.3 (71b22c250f).
  * The lookup for shared secrets for IKEv1 SAs via sql plugin should now work better
    (6ec9f68f32).
  * Fixed a race condition in the trap manager between installation and removal of a policy
    (69cbe2ca3f).
  * Compilation of the kernel-netlink plugin has been fixed on old kernels (&lt; 2.6.39), which
    was caused by the HW offload changes (c7f579fa17).
  * The IPsec stack detection and module loading in starter has been removed (it wasn't
    enforced anyway and loading modules doesn't seem necessary, also KLIPS hasn't been
    supported for a long time and PF_KEY will eventually be removed from the Linux kernel,
    ba817d2917).
  * Several IKEv2 protocol details are now handled more strictly: Unrequested virtual IPs are
    ignored, CFG_REPLY payloads are ignored if no CFG_REQUEST payloads were sent, a USE
    TRANSPORT_MODE notify received from the responder is checked against the local configuration.
  * The keys and certificates used by the scenarios in the testing environment are now generated
    dynamically. Running the testing/scripts/build-certs script after creating the base and root
    images uses the pki utility installed in the latter to create the keys and certificates for
    all the CAs and in some cases for individual scenarios. These credentials are stored in the
    source tree, not the image, so this has to be called only once even if the images are later
    rebuilt. The script automatically (re-)rebuilds the guest images as that generates fresh
    CRLs and signs the DNS zones. The only keys/certificates currently not generated are the
    very large ones used by the ikev2/rw-eap-tls-fragments scenario.
  - Version 5.7.2
  ===============
  * For RSA with PSS padding, the TPM 2.0 specification mandates the maximum salt length
    (as defined by the length of the key and hash). However, if the TPM is FIPS-168-4 compliant,
    the salt length equals the hash length. This is assumed for FIPS-140-2 compliant TPMs, but
    if that's not the case, it might be necessary to manually enable charon.plugins.tpm.fips_186_4
    if the TPM doesn't use the maximum salt length.
  * Directories for credentials loaded by swanctl are now accessed relative to the loaded
    swanctl.conf file, in particular, when loading it from a custom location via --file argument.
  * The base directory, which is used if no custom location for swanctl.conf is specified, is now
    also configurable at runtime via SWANCTL_DIR environment variable.
  * If RADIUS Accounting is enabled, the eap-radius plugin will add the session ID (Acct-Session-Id)
    to Access-Request messages, which e.g. simplifies associating database entries for IP leases and
    accounting with sessions (the session ID does not change when IKE_SAs are rekeyed, #2853).
  * All IP addresses assigned by a RADIUS server are included in Accounting-Stop messages even if
    the client did not claim them, allowing to release them early in case of connection errors (#2856).
  * Selectors installed on transport mode SAs by the kernel-netlink plugin are now updated if an
    IP address changes (e.g. via MOBIKE) and it was part of the selectors.
  * No deletes are sent anymore when a rekeyed CHILD_SA expires (#2815).
  * The bypass-lan plugin now tracks interfaces to handle subnets that move from one interface
    to another and properly update associated routes (#2820).
  * Only valid and expected inbound IKEv2 messages are used to update the timestamp of the
    last received message (previously, retransmits also triggered an update).
  * IKEv2 requests from responders are now ignored until the IKE_SA is fully established (e.g. if a
    DPD request from the peer arrives before the IKE_AUTH response does, 46bea1add9).
    Delayed IKE_SA_INIT responses with COOKIE notifies we already recevied are ignored, they caused
    another reset of the IKE_SA previously (#2837).
  * Active and queued Quick Mode tasks are now adopted if the peer reauthenticates an IKEv1 SA
    while creating lots of CHILD_SAs.
  * Newer versions of the FreeBSD kernel add an SADB_X_EXT_SA2 extension to SADB_ACQUIRE
    messages, which allows the kernel-pfkey plugin to determine the reqid of the policy even if it
    wasn't installed by the daemon previously (e.g. when using FreeBSD's if_ipsec(4) VTIs, which
    install policies themselves, 872b9b3e8d).
  * Added support for RSA signatures with SHA-256 and SHA-512 to the agent plugin. For older
    versions of ssh/gpg-agent that only support SHA-1, IKEv2 signature authentication has to be
    disabled via charon.signature_authentication.
  * The sshkey and agent plugins support Ed25519/Ed448 SSH keys and signatures.
  * The openssl plugin supports X25519/X448 Diffie-Hellman and Ed25519/Ed448 keys and
    signatures when built against OpenSSL 1.1.1.
  * Support for Ed25519, ChaCha20/Poly1305, SHA-3 and AES-CCM were added to the botan plugin.
  * The mysql plugin now properly handles database connections with transactions
    under heavy load (#2779).
  * IP addresses in ha pools are now distributed evenly among all segments (#2828).
  * Private key implementations may optionally provide a list of supported signature schemes,
    which, as described above, is used by the tpm plugin because for each key on a TPM 2.0 the
    hash algorithm and for RSA also the padding scheme is predefined.
  * The testing environment is now based on Debian 9 (stretch) by default. This required
    some changes, in particular, updating to FreeRADIUS 3.x (which forced us to abandon the
    TNC@FHH patches and scenarios, 2fbe44bef3) and removing FIPS-enabled versions of
    OpenSSL (the FIPS module only supports OpenSSL 1.0.2).
  * Most test scenarios were migrated to swanctl.
  - Version 5.7.1
  ===============
  * Fixes a vulnerability in the gmp plugin triggered by crafted certificates with RSA keys with
    very small moduli. When verifying signatures with such keys, the code patched with the fix
    for CVE-2018-16151/2 caused an integer underflow and subsequent heap buffer overflow
    that results in a crash of the daemon.
  * The vulnerability has been registered as CVE-2018-17540.
  - Version 5.7.0
  ===============
  * Fixes a potential authorization bypass vulnerability in the gmp plugin that was caused by a
    too lenient verification of PKCS#1 v1.5 signatures. Several flaws could be exploited by a
    Bleichenbacher-style attack to forge signatures for low-exponent keys (i.e. with e=3).
  * CVE-2018-16151 has been assigned to the problem of accepting random bytes after the OID
    of the hash function in such signatures, and CVE-2018-16152 has been assigned to the issue
    of not verifying that the parameters in the ASN.1 algorithmIdentitifer structure is empty.
    Other flaws that don't lead to a vulnerability directly (e.g. not checking for at least
    8 bytes of padding) have no separate CVE assigned.
  * Dots are not allowed anymore in section names in swanctl.conf and strongswan.conf.
    This mainly affects the configuration of file loggers. If the path for such a log file
    contains dots it now has to be configured in the new path setting within the arbitrarily
    renamed subsection in the filelog section.
  * Sections in swanctl.conf and strongswan.conf may now reference other sections. All settings
    and subsections from such a section are inherited. This allows to simplify configs as
    redundant information has only to be specified once and may then be included in other
    sections (see strongswan.conf for an example).
  * The originally selected IKE config (based on the IPs and IKE version) can now change
    if no matching algorithm proposal is found. This way the order of the configs doesn't
    matter that much anymore and it's easily possible to specify separate configs for
    clients that require weaker algorithms (instead of having to also add them in other
    configs that might be selected).
  * Support for Postquantum Preshared Keys for IKEv2 (draft-ietf-ipsecme-qr-ikev2) has been added.
    For an example refer to the swanctl/rw-cert-ppk scenario (or with EAP, or PSK authentication).
  * The new botan plugin is a wrapper around the Botan C++ crypto library.
    It requires a fairly recent build from Botan's master branch (or the upcoming 2.8.0 release).
    Thanks to René Korthaus and his team from Rohde &amp; Schwarz Cybersecurity for the initial
    patch and to Jack Lloyd for quickly adding missing functions to Botan's FFI (C89) interface.
  * Implementation of RFC 8412 "Software Inventory Message and Attributes (SWIMA) for PA-TNC".
  * SWIMA subscription option sets CLOSE_WRITE trigger on apt history.log file resulting in
    a ClientRetry PB-TNC batch to initialize a new measurement cycle. The new imv/imc-swima
    plugins replace the previous imv/imc-swid plugins, which were removed.
  * Added support for fuzzing the PA-TNC (RFC 5792) and PB-TNC (RFC 5793) NEA protocols
    on Google's OSS-Fuzz infrastructure.
  * Support for version 2 of Intel's TPM2-TSS TGC Software Stack. The presence of the
    in-kernel /dev/tpmrm0 resource manager is automatically detected.
  * The pki tool accepts a xmppAddr otherName as a subjectAlternativeName using the
    syntax --san xmppaddr:&lt;jid&gt;.
  * swanctl.conf supports the configuration of marks the in- and/or outbound SA should apply
    to packets after processing on Linux. Configuring such a mark for outbound SAs requires
    at least a 4.14 kernel. The ability to set a mask and configuring a mark/mask for
    inbound SAs will be added with the upcoming 4.19 kernel.
  * New options in swanctl.conf allow configuring how/whether DF, ECN and DS fields in the
    IP headers are copied during IPsec processing. Controlling this is currently only possible
    on Linux.
  * The handling of sequence numbers in IKEv1 DPDs has been improved (#2714).
  * To avoid conflicts, the dhcp plugin now only uses the DHCP server port if explicitly
    configured.
  - Version 5.6.3
  ===============
  * Fixed a DoS vulnerability in the IKEv2 key derivation if the openssl plugin is used in FIPS
    mode and HMAC-MD5 is negotiated as PRF.
    This vulnerability has been registered as CVE-2018-10811.
  * Fixed a vulnerability in the stroke plugin, which did not check the received length before
    reading a message from the socket. Unless a group is configured, root privileges are
    required to access that socket, so in the default configuration this shouldn't be an issue.
    This vulnerability has been registered as CVE-2018-5388.
  * CRLs that are not yet valid are now ignored to avoid problems in scenarios where expired
    certificates are removed from new CRLs and the clock on the host doing the revocation
    check is trailing behind that of the host issuing CRLs. Not doing this could result in
    accepting a revoked and expired certificate, if it's still valid according to the
    trailing clock but not contained anymore in not yet valid CRLs.
  * The issuer of fetched CRLs is now compared to the issuer of the checked certificate (#2608).
  * CRL validation results other than revocation (e.g. a skipped check because the CRL couldn't
    be fetched) are now stored also for intermediate CA certificates and not only for end-entity
    certificates, so a strict CRL policy can be enforced in such cases.
  * In compliance with RFC 4945, section 5.1.3.2, certificates used for IKE must now either
    not contain a keyUsage extension (like the ones generated by pki), or have at least one of the
    digitalSignature or nonRepudiation bits set.
  * New options for vici/swanctl allow forcing the local termination of an IKE_SA. This might be
    useful in situations where it's known the other end is not reachable anymore, or that it
    already removed the IKE_SA, so retransmitting a DELETE and waiting for a response would
    be pointless.
  * Waiting only a certain amount of time for a response (i.e. shorter than all retransmits
    would be) before destroying the IKE_SA is also possible by additionally specifying a
    timeout in the forced termination request.
  * When removing routes, the kernel-netlink plugin now checks if it tracks other routes for
    the same destination and replaces the installed route instead of just removing it. Same
    during installation, where existing routes previously weren't replaced. This should allow
    using traps with virtual IPs on Linux (#2162).
  * The dhcp plugin now only sends the client identifier DHCP option if the identity_lease
    setting is enabled (7b660944b6). It can also send identities of up to 255 bytes length,
    instead of the previous 64 bytes (30e886fe3b, 0e5b94d038). If a server address is
    configured, DHCP requests are now sent from port 67 instead of 68 to avoid ICMP port
    unreachables (becf027cd9).
  * The handling of faulty INVALID_KE_PAYLOAD notifies (e.g. one containing a DH group
    that wasn't proposed) during CREATE_CHILD_SA exchanges has been improved (#2536).
  * Roam events are now completely ignored for IKEv1 SAs (there is no MOBIKE to handle such
    changes properly).
  * ChaCha20/Poly1305 is now correctly proposed without key length (#2614). For compatibility with
    older releases the chacha20poly1305compat keyword may be included in proposals to also propose
    the algorithm with a key length (c58434aeff).
  * Configuration of hardware offload of IPsec SAs is now more flexible and allows a new
    setting (auto), which automatically uses it if the kernel and device both support it. If hw
    offload is set to yes and offloading is not supported, the CHILD_SA installation now fails.
  * The kernel-pfkey plugin optionally installs routes via internal interface (one with an IP
    in the local traffic selector). On FreeBSD, enabling this selects the correct source IP
    when sending packets from the gateway itself (e811659323).
  * SHA-2 based PRFs are supported in PKCS#8 files as generated by OpenSSL 1.1 (#2574).
  * The pki --verify tool may load CA certificates and CRLs from directories.
  * The IKE daemon now also switches to port 4500 if the remote port is not 500 (e.g. because the
    remote maps the response to a different port, as might happen on Azure), as long as the local
    port is 500 (85bfab621d).
  * Fixed an issue with DNS servers passed to NetworkManager in charon-nm (ee8c25516a).
  * Logged traffic selectors now always contain the protocol if either protocol or port are set
    (a36d8097ed).
  * Only the inbound SA/policy will be updated as reaction to IP address changes for rekeyed
    CHILD_SAs that are kept around.
  * The parser for strongswan.conf/swanctl.conf now accepts = characters in values without
    having to put the value in quotes (e.g. for Base64 encoded shared secrets).
    Notes for developers:
  * trap_manager_t: Trap policies are now unistalled by peer/child name and not the reqid.
  * No reqid is returned anymore when installing trap policies.
  * child_sa_t: A new state (CHILD_DELETED) is used for CHILD_SAs that have been deleted but
    not yet destroyed (after a rekeying CHILD_SAs are kept around for a while to process
    delayed packets).
    This way child_updown events are not triggered anymore for such SAs when an IKE_SA that
    has such CHILD_SAs assigned is deleted.
  - Version 5.6.2
  ===============
  * Fixed a DoS vulnerability in the parser for PKCS#1 RSASSA-PSS signatures that was caused
    by insufficient input validation. One of the configurable parameters in algorithm identifier
    structures for RSASSA-PSS signatures is the mask generation function (MGF). Only MGF1 is
    currently specified for this purpose. However, this in turn takes itself a parameter that
    specifies the underlying hash function. strongSwan's parser did not correctly handle the
    case of this parameter being absent, causing an undefined data read.
    This vulnerability has been registered as CVE-2018-6459.
  * When rekeying IKEv2 IKE_SAs the previously negotiated DH group will be reused, instead of
    using the first configured group, which avoids an additional exchange if the peer previously
    selected a different DH group via INVALID_KE_PAYLOAD notify. The same is also done when
    rekeying CHILD_SAs except for the first rekeying of the CHILD_SA that was created with the
    IKE_SA, where no DH group was negotiated yet.
    Also, the selected DH group is moved to the front in all sent proposals that contain it
    and all proposals that don't are moved to the back in order to convey the preference for
    this group to the peer.
  * Handling of MOBIKE task queuing has been improved. In particular, the response to an
    address update (with NAT-D payloads) is not ignored anymore if only an address list update
    or DPD is queued as that could prevent updating the UDP encapsulation in the kernel.
  * On Linux, roam events may optionally be triggered by changes to the routing rules, which
    can be useful if routing rules (instead of e.g. route metrics) are used to switch from one
    to another interface (i.e. from one to another routing table). Since routing rules are
    currently not evaluated when doing route lookups this is only useful if the kernel-based
    route lookup is used (4664992f7d).
  * The fallback drop policies installed to avoid traffic leaks when replacing addresses in
    installed policies are now replaced by temporary drop policies, which also prevent
    acquires because we currently delete and reinstall IPsec SAs to update their addresses
    (35ef1b032d).
  * Access X.509 certificates held in non-volatile storage of a TPM 2.0 referenced via the
    NV index.
    Adding the --keyid parameter to pki --print allows to print private keys or certificates
    stored in a smartcard or a TPM 2.0.
  * Fixed proposal selection if a peer incorrectly sends DH groups in the ESP proposal during
    IKE_AUTH and also if a DH group is configured in the local ESP proposal and charon.prefer
    configured_proposals is disabled (d058fd3c32).
  * The lookup for PSK secrets for IKEv1 has been improved for certain scenarios (see #2497
    for details).
  * MSKs received via RADIUS are now padded to 64 bytes to avoid compatibility issues with
    EAP-MSCHAPv2 and PRFs that have a block size &lt; 64 bytes (e.g. AES-XCBC-PRF-128, see
    73cbce6013).
  * The tpm_extendpcr command line tool extends a digest into a TPM PCR.
  * Ported the NetworkManager backend from the deprecated libnm-glib to libnm.
  * The save-keys debugging/development plugin saves IKE and/or ESP keys to files compatible
    with Wireshark.
  - Version 5.6.1
  ===============
  * Several algorithms were removed from the default ESP/AH and IKE proposals in compliance with
    RFC 8221 and RFC 8247, respectively. Removed from the default ESP/AH proposal were the
    3DES and Blowfish encryption algorithms and the HMAC-MD5 integrity algorithm. From the IKE
    default proposal the HMAC-MD5 integrity algorithm and the MODP-1024 Diffie-Hellman group
    were removed (the latter is significant for Windows clients in their default configuration).
    These algorithms may still be used in custom proposals.
  * Support for RSASSA-PSS signatures has been added. For compatibility with previous
    releases they are currently not used automatically, by default, to change that charon.rsa_pss
    may be enabled. To explicitly use or require such signatures during IKEv2 signature
    authentication (RFC 7427) ike:rsa/pss... authentication constraints may be used for specific
    connections (regardless of whether the strongswan.conf option above is enabled). Only the
    hash algorithm can be specified in such constraints, the MGF1 will be based on that hash
    and the salt length will equal the hash length (when verifying the salt length is not
    enforced).
    To enforce such signatures during PKI verification use rsa/pss... authentication constraints.
  * All pki commands that create certificates/CRLs can be made to sign with RSASSA-PSS instead
    of the classing PKCS#1 scheme with the --rsa-padding pss option. As with signatures during
    authentication, only the hash algorithm is configurable (via --digest option), the MGF1 will
    be based on that and the salt length will equal the hash length.
  * These signatures are supported by all RSA backends except pkcs11 (i.e. gmp, gcrypt, openssl).
    The gmp plugin requires the mgf1 plugin.
    Note that RSASSA-PSS algorithm identifiers and parameters in keys (public keys in
    certificates or private keys in PKCS#8 files) are currently not used as constraints.
  * The sec-updater tool checks for security updates in dpkg-based repositories
    (e.g. Debian/Ubuntu) and sets the security flags in the IMV policy database accordingly.
    Additionally for each new package version a SWID tag for the given OS and HW architecture
    is created and stored in the database.
  * Using the sec-updater.sh script template the lookup can be automated (e.g. via an hourly
    cron job).
  * When restarting an IKEv2 negotiation after receiving an INVALID_KE_PAYLOAD notify (or due
    to other reasons like too many retransmits) a new initiator SPI is allocated. This
    prevents issues caused by retransmits for IKE_SA_INIT messages.
  * Because the initiator SPI was previously reused when restarting the connection delayed
    responses for previous connection attempts were processed and might have caused fatal
    errors due to a failed DH negotiation or because of the internal retry counter in the
    ike-init task. For instance, if we proposed a DH group the responder rejected we
    might have later received delayed responses that either contained INVALID_KE_PAYLOAD
    notifies with the DH group we already switched to, or, if we retransmitted an
    IKE_SA_INIT with the requested group but then had to restart again, a KE payload with
    a group different from the one we proposed.
  * The introduction of file versions in the IMV database scheme broke file reference hash
    measurements. This has been fixed by creating generic product versions having an empty
    package name.
  * A new timeout option for the systime-fix plugin stops periodic system time checks after
    a while and enforces a certificate verification, closing or reauthenticating all SAs
    with invalid certificates.
  * The IKE event counters, previously only available via ipsec listcounters command, may
    now also be queried and reset via vici and the new swanctl --counters command. They
    are collected and provided by the optional counters plugin (enabled by default for
    backwards compatibility if the stroke plugin is built).
  * Class attributes received in RADIUS Access-Accept messages may optionally be added to
    RADIUS accounting messages (655924074b).
  * Basic support for systemd sockets has been added, which may be used for privilege separation
    (59db98fb94).
  * Inbound marks may optionally be installed in the SA again (was removed with 5.5.2) by
    enabling the mark_in_sa option in swanctl.conf.
  * The timeout of leases in pools configured via pool utility may be configured in other
    units than hours.
    INITIAL_CONTACT notifies are now only omitted if never is configured as uniqueness policy.
  * Outbound FWD policies for shunts are not installed anymore, by default (as is the case
    for other policies since 5.5.1).
  * Don't consider a DH group mismatch during CHILD_SA rekeying as failure as responder
    (e7276f78aa).
  * Handling of fragmented IPv4 and IPv6 packets in libipsec has been improved (e138003de9).
  * Trigger expire events for the correct IPsec SA in libipsec (6e861947a0).
  * A crash in CRL verification via openssl plugin using OpenSSL 1.1 has been fixed (78acaba6a1).
  * No hard-coded default proposals are passed from starter to the stroke plugin anymore (the
    IKE proposal used curve25519 since 5.5.2, which is an optional plugin).
  * A workaround for an issue with virtual IPs on macOS 10.13 (High Sierra) has been added
    (039b85dd43).
  * Handling of IKE_SA rekey collisions in charon-tkm has been fixed.
  * Instead of failing or just silently doing nothing unit tests may now warn about certain
    conditions (e.g. if a test was not executed due to external dependencies).</changelog>
  <changelog author="mmnelemane@suse.com" date="1585224000">- Fix for to resolve multiple definition of swanctl_dir (bsc #1164493)
  [+ 0006-Resolve-multiple-definition-of-swanctl_dir.patch]</changelog>
  <changelog author="mbuil@suse.com" date="1610712000">- Fix typo in README (bsc #1167880)
  [+ 0007-Fix-typo-in-README.patch ]</changelog>
  <changelog author="mbuil@suse.com" date="1611576000">- Fix FIPS bug (bsc #1180801)
  [+ 0008-gcrypt-Use-a-dummy-buffer-to-initialize-static-alloc.patch ]</changelog>
  <changelog author="mbuil@suse.com" date="1617019200">- Keep using ipsec as the main binary. Therefore, make strongswan.service point to it instead of swanctl</changelog>
  <changelog author="mbuil@suse.com" date="1617019201">- Information added in README about the rcstrongswan-starter</changelog>
  <changelog author="mbuil@suse.com" date="1617624000">- Add config to run ipsec on namespaces (bsc #1183670)</changelog>
  <changelog author="mt@suse.com" date="1619006400">- Add support for AES CCM aead algorithms to openssl plugin (cc/fips,bsc#1185363)
  [+ 0009-strongswan-openssl-aead-add-ccm-support.patch]</changelog>
  <changelog author="mt@suse.com" date="1620388800">- Replace AEAD AES CCM patch with upstream variant (cc/fips,bsc#1185363)
  [* 0009-strongswan-openssl-aead-add-ccm-support.patch]</changelog>
  <changelog author="hare@suse.de" date="1627646400">- Add auth_els plugin to support Marvell FC-SP encryption (jsc#SLE-20151)
  [* strongswan-marvell-auth-els.patch]</changelog>
  <changelog author="abergmann@suse.com" date="1634040000">- Fix integer overflow in gmp plugin (bsc#1191367, CVE-2021-41990)
  [* strongswan-5.6.1-5.9.3_gmp-rsa-ssa-salt-len.patch]
- Fix integer overflow when replacing certificates in cache (bsc#1191435, CVE-2021-41991)
  [* strongswan-4.4.1-5.9.3_cert-cache-random.patch]</changelog>
  <changelog author="meissner@suse.com" date="1643025600">- strongswan-5.5.0-5.9.4_eap_success-CVE-2021-45079.patch:
  Fixed authentication bypass in EAP authentication (CVE-2021-45079
  bsc#1194471)</changelog>
</package>
<package pkgid="5dd8f3b692e64d2c84dddf8cc46f49e3e9f547f8eae67a109a6eb14767d8f456" name="strongswan-hmac" arch="aarch64">
  <version epoch="0" ver="5.8.2" rel="11.24.1"/>
  <changelog author="ndas@suse.de" date="1501502400">- Updated to strongSwan 5.3.5(bsc#1050691) providing the following changes:
  * Fixed a DoS vulnerability in the gmp plugin that was caused by insufficient input
    validation when verifying RSA signatures. More specifically, mpz_powm_sec() has two
    requirements regarding the passed exponent and modulus that the plugin did not
    enforce, if these are not met the calculation will result in a floating point exception
    that crashes the whole process.
    This vulnerability has been registered as CVE-2017-9022.
    Please refer to our blog for details.
  * Fixed a DoS vulnerability in the x509 plugin that was caused because the ASN.1 parser
    didn't handle ASN.1 CHOICE types properly, which could result in an infinite loop when
    parsing X.509 extensions that use such types.
    This vulnerability has been registered as CVE-2017-9023.
    Please refer to our blog for details.
  * The behavior during IKEv2 CHILD_SA rekeying has been changed in order to avoid
    traffic loss. When responding to a CREATE_CHILD_SA request to rekey a CHILD_SA
    the responder already has everything available to install and use the new CHILD_SA.
    However, this could lead to lost traffic as the initiator won't be able to process
    inbound packets until it processed the CREATE_CHILD_SA response and updated the
    inbound SA. To avoid this the responder now only installs the new inbound SA and
    delays installing the outbound SA until it receives the DELETE for the replaced CHILD_SA.
  * The messages transporting these DELETEs could reach the peer before packets sent
    with the deleted outbound SAs reach it. To reduce the chance of traffic loss due
    to this the inbound SA of the replaced CHILD_SA is not removed for a configurable
    amount of seconds (charon.delete_rekeyed_delay) after the DELETE has been processed.
  * The code base has been ported to Apple's ARM64 iOS platform, which required several
    changes regarding the use of variadic functions. This was necessary because the calling
    conventions for variadic and regular functions are different there.
    This means that assigning a non-variadic function to a variadic function pointer, as we
    did with our enumerator_t::enumerate() implementations and several callbacks, will
    result in crashes as the called function accesses the arguments differently than the
    caller provided them. To avoid this issue the enumerator_t interface has been changed
    and the signature of the callback functions for enumerator_create_filter() and two
    methods on linked_list_t have been changed. Refer to the developer notes below
    for details.
  * Adds support for fuzzing the certificate parser provided by the default plugins
    (x509, pem, gmp etc.) on Google's OSS-Fuzz infrastructure (or generally with
    libFuzzer). Several issues found while fuzzing these plugins were fixed.
  * Two new options have been added to charon's retransmission settings:
    retransmit_limit and retransmit_jitter. The former adds an upper limit to the
    calculated retransmission timeout, the latter randomly reduces it.
    Refer to Retransmission for details.
  * A bug in swanctl's --load-creds command was fixed that caused unencrypted
    private keys to get unloaded if the command was called multiple times.
    The load-key VICI command now returns the key ID of the loaded key on success.
  * The credential manager now enumerates local credential sets before global ones.
    This means certificates supplied by the peer will now be preferred over certificates
    with the same identity that may be locally stored (e.g. in the certificate cache).
  * Adds support for hardware offload of IPsec SAs as introduced by Linux 4.11 for
    specific hardware that supports this.
  * The pki tool loads the curve25519 plugin by default.
    [- 0006-Make-sure-the-modulus-is-odd-and-the-exponent-not-zero.patch,
  - 0007-asn1-parser-Fix-CHOICE-parsing.patch]
- libhydra is removed as all kernel plugins moved to libcharon</changelog>
  <changelog author="ndas@suse.de" date="1504612800">- fix "uintptr_t? undeclared" compilation error.
  [+0006-fix-compilation-error-by-adding-stdint.h.patch]</changelog>
  <changelog author="ndas@suse.de" date="1504612801">- Updated to strongSwan 5.6.0 providing the following changes:
  * Fixed a DoS vulnerability in the gmp plugin that was caused by insufficient input validation
    when verifying RSA signatures, which requires decryption with the operation m^e mod n,
    where m is the signature, and e and n are the exponent and modulus of the public key.
    The value m is an integer between 0 and n-1, however, the gmp plugin did not verify this.
    So if m equals n the calculation results in 0, in which case mpz_export() returns NULL.
    This result wasn't handled properly causing a null-pointer dereference.
    This vulnerability has been registered as CVE-2017-11185. (bsc#1051222)
  * New SWIMA IMC/IMV pair implements the draft-ietf-sacm-nea-swima-patnc Internet
    Draft and has been demonstrated at the IETF 99 Prague Hackathon.
  * The IMV database template has been adapted to achieve full compliance with the
    ISO 19770-2:2015 SWID tag standard.
  * The pt-tls-client can attach and use TPM 2.0 protected private keys via the --keyid parameter.
  * By default the /etc/swanctl/conf.d directory is created and *.conf files in it are included in the default
    swanctl.conf file.
  * The curl plugin now follows HTTP redirects (configurable via strongswan.conf).
  * The CHILD_SA rekeying was fixed in charon-tkm and the behavior is refined a bit more since 5.5.3
  * libtpmtss supports Intel's TSS2 Architecture Broker and Resource Manager interface (tcti-tabrmd).
  * more on https://wiki.strongswan.org/versions/66</changelog>
  <changelog author="mmnelemane@suse.com" date="1521028800">- Removed unused requires and macro calls(bsc#1083261)</changelog>
  <changelog author="mmnelemane@suse.com" date="1573646400">- Added patch to fix vulnerability: CVE-2018-16151,CVE-2018-16152 (bsc#1107874)
  - Insufficient input validation in gmp plugin
  [+ 0007-strongswan-5.3.1-5.6.0_gmp-pkcs1-verify.patch]</changelog>
  <changelog author="mmnelemane@suse.com" date="1573646401">- Added patch to fix vulnerability: CVE-2018-5388 (bsc#1094462)
  - Buffer Underflow in stroke_socket.c
  [+ 0008-strongswan-5.1.2-5.6.2_stroke_msg_len.patch]</changelog>
  <changelog author="mmnelemane@suse.com" date="1573646402">- Added patch to fix vulnerability: CVE-2018-10811 (bsc#1093536)
  - denial-of-service vulnerability
  [+ 0009-strongswan-5.5.0-5.6.2_skeyseed_init.patch]</changelog>
  <changelog author="mmnelemane@suse.com" date="1573732800">- Added patch to fix vulnerability: CVE-2018-17540 (bsc#1109845)
  [+ 0010-strongswan-4.4.0-5.7.0_gmp-pkcs1-overflow.patch]</changelog>
  <changelog author="mmnelemane@suse.com" date="1580212800">- Updated to version 5.8.2 (jsc#SLE-11370)
  - Dropped following patches due to irrelevance in the updated version:
    [- strongswan_modprobe_syslog.patch ]
    [- strongswan_fipsfilter.patch ]
    [- 0006-fix-compilation-error-by-adding-stdint.h.patch ]
    [- 0007-strongswan-5.3.1-5.6.0_gmp-pkcs1-verify.patch ]
    [- 0008-strongswan-5.1.2-5.6.2_stroke_msg_len.patch ]
    [- 0009-strongswan-5.5.0-5.6.2_skeyseed_init.patch ]
    [- 0010-strongswan-4.4.0-5.7.0_gmp-pkcs1-overflow.patch ]
  - Version 5.8.2
  ===============
  * Identity-based CA constraints, which enforce that the certificate chain of the remote
    peer contains a CA certificate with a specific identity, are supported via
    vici/swanctl.conf. This is similar to the existing CA constraints but doesn't require
    that the CA certificate is locally installed, for instance, intermediate CA certificates
    received from the peers. Wildcard identity matching (e.g. ..., OU=Research, CN=*) could
    also be used for the latter but requires trust in the intermediate CAs to only issue
    certificates with legitimate subject DNs (e.g. the "Sales" CA must not issue certificates
    with OU=Research). With the new constraint that's not necessary as long as a path length
    basic constraint (--pathlen for pki --issue) prevents intermediate CAs from issuing further
    intermediate CAs.
  * Intermediate CA certificates may now be sent in hash-and-URL encoding by configuring a
    base URL for the parent CA (#3234, swanctl/rw-hash-and-url-multi-level).
  * Implemented NIST SP-800-90A Deterministic Random Bit Generator (DRBG) based on AES-CTR
    and SHA2-HMAC modes. Currently used by the gmp and ntru plugins.
  * Random nonces sent in an OCSP requests are now expected in the corresponding OCSP responses.
  * The kernel-netlink plugin now ignores deprecated IPv6 addresses for MOBIKE. Whether temporary
    or permanent IPv6 addresses are included now depends on the charon.prefer_temporary_addrs
    setting (#3192).
  * Extended Sequence Numbers (ESN) are configured via PF_KEY if supported by the kernel.
  * The PF_KEY socket's receive buffer in the kernel-pfkey plugin is now cleared before sending
    requests, as many of the messages sent by the kernel are sent as broadcasts to all PF_KEY
    sockets. This is an issue if an external tool is used to manage SAs/policies unrelated to
    IPsec (#3225).
  * The vici plugin now uses unique section names for CHILD_SAs in child-updown events (7c74ce9190).
  * For individually deleted CHILD_SAs (in particular for IKEv1) the vici child-updown event
    now includes more information about the CHILD_SAs such as traffic statistics (#3198).
  * Custom loggers are correctly re-registered if log levels are changed via stroke loglevel (#3182).
  * Avoid lockups during startup on low entropy systems when using OpenSSL 1.1.1 (095a2c2eac).
  * Instead of failing later when setting a key, creating HMACs via openssl plugin now fails
    instantly if the underlying hash algorithm isn't supported (e.g. MD5 in FIPS-mode) so fallbacks
    to other plugins work properly (#3284).
  * Exponents of RSA keys read from TPM 2.0 via SAPI are correctly converted (8ee1242f1438).
  * Routing table IDs &gt; 255 are supported for custom routes on Linux.
  * To avoid races, the check for hardware offloading support in the kernel-netlink plugin is
    performed during initialization of the plugin (a605452c03).
  * The D-Bus config file for charon-nm is now installed in $(datadir)/dbus-1/system.d instead of
    $(sysconfdir)/dbus-1/system.d, which is intended for sysadmin overrides.
    INVALID_MAJOR_VERSION notifies are now correctly sent in messages of the same exchange type
    and with the same message ID as the request.
  * IKEv2 SAs are now immediately destroyed when sending or receiving INVALID_SYNTAX notifies
    in authenticated messages.
  * For developers working from the repository the configure script now aborts if GNU gperf is
    not found.
  - Version 5.8.1
  ===============
  * RDNs in DNs of X.509 certificates can now optionally be matched less strict. The global
    strongswan.conf option charon.rdn_matching takes two alternative values that cause the
    matching algorithm to either ignore the order of matched RDNs (reordered) or additionally
    (relaxed) accept DNs that contain more RDNs than configured (unmatched RDNs are treated
    like wildcard matches).
  * The updown plugin now passes the same interface to the script that is also used for the
    automatically installed routes, that is, the interface over which the peer is reached
    instead of the interface on which the local address is found (#3095).
  * TPM 2.0 contexts are now protected by a mutex to prevent issues if multiple IKE_SAs use
    the same private key concurrently (4b25885025).
  * Do a rekey check after the third QM message was received (#3060).
  * If available, explicit_bzero() is now used as memwipe() instead of our own implementation.
  * An .editorconfig file has been added, mainly so Github shows files with proper indentation
    (68346b6962).
  * The internal certificate of the load-tester plugin has been modified so it can again be
    used as end-entity cert with 5.6.3 and later (#3139).
  * The maximum data length of received COOKIE notifies (64 bytes) is now enforced (#3160).
  - Version 5.8.0
  ===============
  * The systemd service units have been renamed. The modern unit, which was called
    strongswan-swanctl, is now called strongswan (the previous name is configured as alias in
    the unit, for which a symlink is created when the unit is enabled). The legacy unit is now
    called strongswan-starter.
  * Support for XFRM interfaces (available since Linux 4.19) has been added, which are intended
    to replace VTI devices (they are similar but offer several advantages, for instance, they
    are not bound to an address or address family).
  * IPsec SAs and policies are associated with such interfaces via interface IDs that can be
    configured in swanctl.conf (dynamic IDs may optionally be allocated for each SA and even
    direction). It's possible to use separate interfaces for in- and outbound traffic (or
    only use an interface in one direction and regular policies in the other).
  * Interfaces may be created dynamically via updown/vici scripts, or statically before or after
    establishing the SAs. Routes must be added manually as needed (the daemon will not install
    any routes for outbound policies with an interface ID).
  * When moving XFRM interfaces to other network namespaces they retain access to the SAs and
    policies installed in the original namespace, which allows providing IPsec tunnels for
    processes in other network namespaces without giving them access to the IPsec keys or
    IKE credentials.
    More information can be found on the page about route-based VPNs.
  * Initiation of childless IKE_SAs is supported (RFC 6023). If enabled and supported by the
    responder, no CHILD_SA is established during IKE_AUTH. Instead, all CHILD_SAs are created
    with CREATE_CHILD_SA exchanges. This allows using a separate DH exchange even for the
    first CHILD_SA, which is otherwise created during IKE_AUTH with keys derived from the
    IKE_SA's key material.
  * The swanctl --initiate command may be used to initiate only the IKE_SA via --ike
    option if --child is omitted and the peer supports this extension.
  * The NetworkManager backend and plugin support IPv6.
  * The new wolfssl plugin is a wrapper around the wolfSSL crypto library. Thanks to Sean
    Parkinson of wolfSSL Inc. for the initial patch.
  * IKE SPIs may optionally be labeled via the charon.spi_mask|label options in
    strongswan.conf. This feature was extracted from charon-tkm, however, now applies the
    mask/label in network order.
  * The openssl plugin supports ChaCha20-Poly1305 when built with OpenSSL 1.1.0.
  * The PB-TNC finite state machine according to section 3.2 of RFC 5793 was not correctly
    implemented when sending either a CRETRY or SRETRY batch. These batches can only be sent
    in the "Decided" state and a CRETRY batch can immediately carry all messages usually
    transported by a CDATA batch. It is currently not possible to send a SRETRY batch since
    full-duplex mode for PT-TLS transport is not supported.
  * Instead of marking IPv6 virtual IPs as deprecated, the kernel-netlink plugin now uses
    address labels to avoid that such addresses are used for non-VPN traffic (00a953d090).
  * The agent plugin now creates sockets to the ssh/gpg-agent dynamically and does not keep
    them open, which otherwise might prevent the agent from getting terminated.
  * To avoid broadcast loops the forecast plugin now only reinjects packets that are marked
    or received from the configured interface.
  * UTF-8 encoded passwords are supported via EAP-MSCHAPv2, which internally uses an UTF-16LE
    encoding to calculate the NT hash (#3014).
  * Properly delete temporary drop policies (used when updating IP addresses of SAs) if manual
    priorities are used, which was broken since 5.6.2 (8e31d65730).
  * Avoid overwriting start_action when parsing the inactivity timeout in the vici plugin (#2954).
  * Fixed the automatic termination of reloaded vici connections with start_action=start,
    which was broken since 5.6.3 (71b22c250f).
  * The lookup for shared secrets for IKEv1 SAs via sql plugin should now work better
    (6ec9f68f32).
  * Fixed a race condition in the trap manager between installation and removal of a policy
    (69cbe2ca3f).
  * Compilation of the kernel-netlink plugin has been fixed on old kernels (&lt; 2.6.39), which
    was caused by the HW offload changes (c7f579fa17).
  * The IPsec stack detection and module loading in starter has been removed (it wasn't
    enforced anyway and loading modules doesn't seem necessary, also KLIPS hasn't been
    supported for a long time and PF_KEY will eventually be removed from the Linux kernel,
    ba817d2917).
  * Several IKEv2 protocol details are now handled more strictly: Unrequested virtual IPs are
    ignored, CFG_REPLY payloads are ignored if no CFG_REQUEST payloads were sent, a USE
    TRANSPORT_MODE notify received from the responder is checked against the local configuration.
  * The keys and certificates used by the scenarios in the testing environment are now generated
    dynamically. Running the testing/scripts/build-certs script after creating the base and root
    images uses the pki utility installed in the latter to create the keys and certificates for
    all the CAs and in some cases for individual scenarios. These credentials are stored in the
    source tree, not the image, so this has to be called only once even if the images are later
    rebuilt. The script automatically (re-)rebuilds the guest images as that generates fresh
    CRLs and signs the DNS zones. The only keys/certificates currently not generated are the
    very large ones used by the ikev2/rw-eap-tls-fragments scenario.
  - Version 5.7.2
  ===============
  * For RSA with PSS padding, the TPM 2.0 specification mandates the maximum salt length
    (as defined by the length of the key and hash). However, if the TPM is FIPS-168-4 compliant,
    the salt length equals the hash length. This is assumed for FIPS-140-2 compliant TPMs, but
    if that's not the case, it might be necessary to manually enable charon.plugins.tpm.fips_186_4
    if the TPM doesn't use the maximum salt length.
  * Directories for credentials loaded by swanctl are now accessed relative to the loaded
    swanctl.conf file, in particular, when loading it from a custom location via --file argument.
  * The base directory, which is used if no custom location for swanctl.conf is specified, is now
    also configurable at runtime via SWANCTL_DIR environment variable.
  * If RADIUS Accounting is enabled, the eap-radius plugin will add the session ID (Acct-Session-Id)
    to Access-Request messages, which e.g. simplifies associating database entries for IP leases and
    accounting with sessions (the session ID does not change when IKE_SAs are rekeyed, #2853).
  * All IP addresses assigned by a RADIUS server are included in Accounting-Stop messages even if
    the client did not claim them, allowing to release them early in case of connection errors (#2856).
  * Selectors installed on transport mode SAs by the kernel-netlink plugin are now updated if an
    IP address changes (e.g. via MOBIKE) and it was part of the selectors.
  * No deletes are sent anymore when a rekeyed CHILD_SA expires (#2815).
  * The bypass-lan plugin now tracks interfaces to handle subnets that move from one interface
    to another and properly update associated routes (#2820).
  * Only valid and expected inbound IKEv2 messages are used to update the timestamp of the
    last received message (previously, retransmits also triggered an update).
  * IKEv2 requests from responders are now ignored until the IKE_SA is fully established (e.g. if a
    DPD request from the peer arrives before the IKE_AUTH response does, 46bea1add9).
    Delayed IKE_SA_INIT responses with COOKIE notifies we already recevied are ignored, they caused
    another reset of the IKE_SA previously (#2837).
  * Active and queued Quick Mode tasks are now adopted if the peer reauthenticates an IKEv1 SA
    while creating lots of CHILD_SAs.
  * Newer versions of the FreeBSD kernel add an SADB_X_EXT_SA2 extension to SADB_ACQUIRE
    messages, which allows the kernel-pfkey plugin to determine the reqid of the policy even if it
    wasn't installed by the daemon previously (e.g. when using FreeBSD's if_ipsec(4) VTIs, which
    install policies themselves, 872b9b3e8d).
  * Added support for RSA signatures with SHA-256 and SHA-512 to the agent plugin. For older
    versions of ssh/gpg-agent that only support SHA-1, IKEv2 signature authentication has to be
    disabled via charon.signature_authentication.
  * The sshkey and agent plugins support Ed25519/Ed448 SSH keys and signatures.
  * The openssl plugin supports X25519/X448 Diffie-Hellman and Ed25519/Ed448 keys and
    signatures when built against OpenSSL 1.1.1.
  * Support for Ed25519, ChaCha20/Poly1305, SHA-3 and AES-CCM were added to the botan plugin.
  * The mysql plugin now properly handles database connections with transactions
    under heavy load (#2779).
  * IP addresses in ha pools are now distributed evenly among all segments (#2828).
  * Private key implementations may optionally provide a list of supported signature schemes,
    which, as described above, is used by the tpm plugin because for each key on a TPM 2.0 the
    hash algorithm and for RSA also the padding scheme is predefined.
  * The testing environment is now based on Debian 9 (stretch) by default. This required
    some changes, in particular, updating to FreeRADIUS 3.x (which forced us to abandon the
    TNC@FHH patches and scenarios, 2fbe44bef3) and removing FIPS-enabled versions of
    OpenSSL (the FIPS module only supports OpenSSL 1.0.2).
  * Most test scenarios were migrated to swanctl.
  - Version 5.7.1
  ===============
  * Fixes a vulnerability in the gmp plugin triggered by crafted certificates with RSA keys with
    very small moduli. When verifying signatures with such keys, the code patched with the fix
    for CVE-2018-16151/2 caused an integer underflow and subsequent heap buffer overflow
    that results in a crash of the daemon.
  * The vulnerability has been registered as CVE-2018-17540.
  - Version 5.7.0
  ===============
  * Fixes a potential authorization bypass vulnerability in the gmp plugin that was caused by a
    too lenient verification of PKCS#1 v1.5 signatures. Several flaws could be exploited by a
    Bleichenbacher-style attack to forge signatures for low-exponent keys (i.e. with e=3).
  * CVE-2018-16151 has been assigned to the problem of accepting random bytes after the OID
    of the hash function in such signatures, and CVE-2018-16152 has been assigned to the issue
    of not verifying that the parameters in the ASN.1 algorithmIdentitifer structure is empty.
    Other flaws that don't lead to a vulnerability directly (e.g. not checking for at least
    8 bytes of padding) have no separate CVE assigned.
  * Dots are not allowed anymore in section names in swanctl.conf and strongswan.conf.
    This mainly affects the configuration of file loggers. If the path for such a log file
    contains dots it now has to be configured in the new path setting within the arbitrarily
    renamed subsection in the filelog section.
  * Sections in swanctl.conf and strongswan.conf may now reference other sections. All settings
    and subsections from such a section are inherited. This allows to simplify configs as
    redundant information has only to be specified once and may then be included in other
    sections (see strongswan.conf for an example).
  * The originally selected IKE config (based on the IPs and IKE version) can now change
    if no matching algorithm proposal is found. This way the order of the configs doesn't
    matter that much anymore and it's easily possible to specify separate configs for
    clients that require weaker algorithms (instead of having to also add them in other
    configs that might be selected).
  * Support for Postquantum Preshared Keys for IKEv2 (draft-ietf-ipsecme-qr-ikev2) has been added.
    For an example refer to the swanctl/rw-cert-ppk scenario (or with EAP, or PSK authentication).
  * The new botan plugin is a wrapper around the Botan C++ crypto library.
    It requires a fairly recent build from Botan's master branch (or the upcoming 2.8.0 release).
    Thanks to René Korthaus and his team from Rohde &amp; Schwarz Cybersecurity for the initial
    patch and to Jack Lloyd for quickly adding missing functions to Botan's FFI (C89) interface.
  * Implementation of RFC 8412 "Software Inventory Message and Attributes (SWIMA) for PA-TNC".
  * SWIMA subscription option sets CLOSE_WRITE trigger on apt history.log file resulting in
    a ClientRetry PB-TNC batch to initialize a new measurement cycle. The new imv/imc-swima
    plugins replace the previous imv/imc-swid plugins, which were removed.
  * Added support for fuzzing the PA-TNC (RFC 5792) and PB-TNC (RFC 5793) NEA protocols
    on Google's OSS-Fuzz infrastructure.
  * Support for version 2 of Intel's TPM2-TSS TGC Software Stack. The presence of the
    in-kernel /dev/tpmrm0 resource manager is automatically detected.
  * The pki tool accepts a xmppAddr otherName as a subjectAlternativeName using the
    syntax --san xmppaddr:&lt;jid&gt;.
  * swanctl.conf supports the configuration of marks the in- and/or outbound SA should apply
    to packets after processing on Linux. Configuring such a mark for outbound SAs requires
    at least a 4.14 kernel. The ability to set a mask and configuring a mark/mask for
    inbound SAs will be added with the upcoming 4.19 kernel.
  * New options in swanctl.conf allow configuring how/whether DF, ECN and DS fields in the
    IP headers are copied during IPsec processing. Controlling this is currently only possible
    on Linux.
  * The handling of sequence numbers in IKEv1 DPDs has been improved (#2714).
  * To avoid conflicts, the dhcp plugin now only uses the DHCP server port if explicitly
    configured.
  - Version 5.6.3
  ===============
  * Fixed a DoS vulnerability in the IKEv2 key derivation if the openssl plugin is used in FIPS
    mode and HMAC-MD5 is negotiated as PRF.
    This vulnerability has been registered as CVE-2018-10811.
  * Fixed a vulnerability in the stroke plugin, which did not check the received length before
    reading a message from the socket. Unless a group is configured, root privileges are
    required to access that socket, so in the default configuration this shouldn't be an issue.
    This vulnerability has been registered as CVE-2018-5388.
  * CRLs that are not yet valid are now ignored to avoid problems in scenarios where expired
    certificates are removed from new CRLs and the clock on the host doing the revocation
    check is trailing behind that of the host issuing CRLs. Not doing this could result in
    accepting a revoked and expired certificate, if it's still valid according to the
    trailing clock but not contained anymore in not yet valid CRLs.
  * The issuer of fetched CRLs is now compared to the issuer of the checked certificate (#2608).
  * CRL validation results other than revocation (e.g. a skipped check because the CRL couldn't
    be fetched) are now stored also for intermediate CA certificates and not only for end-entity
    certificates, so a strict CRL policy can be enforced in such cases.
  * In compliance with RFC 4945, section 5.1.3.2, certificates used for IKE must now either
    not contain a keyUsage extension (like the ones generated by pki), or have at least one of the
    digitalSignature or nonRepudiation bits set.
  * New options for vici/swanctl allow forcing the local termination of an IKE_SA. This might be
    useful in situations where it's known the other end is not reachable anymore, or that it
    already removed the IKE_SA, so retransmitting a DELETE and waiting for a response would
    be pointless.
  * Waiting only a certain amount of time for a response (i.e. shorter than all retransmits
    would be) before destroying the IKE_SA is also possible by additionally specifying a
    timeout in the forced termination request.
  * When removing routes, the kernel-netlink plugin now checks if it tracks other routes for
    the same destination and replaces the installed route instead of just removing it. Same
    during installation, where existing routes previously weren't replaced. This should allow
    using traps with virtual IPs on Linux (#2162).
  * The dhcp plugin now only sends the client identifier DHCP option if the identity_lease
    setting is enabled (7b660944b6). It can also send identities of up to 255 bytes length,
    instead of the previous 64 bytes (30e886fe3b, 0e5b94d038). If a server address is
    configured, DHCP requests are now sent from port 67 instead of 68 to avoid ICMP port
    unreachables (becf027cd9).
  * The handling of faulty INVALID_KE_PAYLOAD notifies (e.g. one containing a DH group
    that wasn't proposed) during CREATE_CHILD_SA exchanges has been improved (#2536).
  * Roam events are now completely ignored for IKEv1 SAs (there is no MOBIKE to handle such
    changes properly).
  * ChaCha20/Poly1305 is now correctly proposed without key length (#2614). For compatibility with
    older releases the chacha20poly1305compat keyword may be included in proposals to also propose
    the algorithm with a key length (c58434aeff).
  * Configuration of hardware offload of IPsec SAs is now more flexible and allows a new
    setting (auto), which automatically uses it if the kernel and device both support it. If hw
    offload is set to yes and offloading is not supported, the CHILD_SA installation now fails.
  * The kernel-pfkey plugin optionally installs routes via internal interface (one with an IP
    in the local traffic selector). On FreeBSD, enabling this selects the correct source IP
    when sending packets from the gateway itself (e811659323).
  * SHA-2 based PRFs are supported in PKCS#8 files as generated by OpenSSL 1.1 (#2574).
  * The pki --verify tool may load CA certificates and CRLs from directories.
  * The IKE daemon now also switches to port 4500 if the remote port is not 500 (e.g. because the
    remote maps the response to a different port, as might happen on Azure), as long as the local
    port is 500 (85bfab621d).
  * Fixed an issue with DNS servers passed to NetworkManager in charon-nm (ee8c25516a).
  * Logged traffic selectors now always contain the protocol if either protocol or port are set
    (a36d8097ed).
  * Only the inbound SA/policy will be updated as reaction to IP address changes for rekeyed
    CHILD_SAs that are kept around.
  * The parser for strongswan.conf/swanctl.conf now accepts = characters in values without
    having to put the value in quotes (e.g. for Base64 encoded shared secrets).
    Notes for developers:
  * trap_manager_t: Trap policies are now unistalled by peer/child name and not the reqid.
  * No reqid is returned anymore when installing trap policies.
  * child_sa_t: A new state (CHILD_DELETED) is used for CHILD_SAs that have been deleted but
    not yet destroyed (after a rekeying CHILD_SAs are kept around for a while to process
    delayed packets).
    This way child_updown events are not triggered anymore for such SAs when an IKE_SA that
    has such CHILD_SAs assigned is deleted.
  - Version 5.6.2
  ===============
  * Fixed a DoS vulnerability in the parser for PKCS#1 RSASSA-PSS signatures that was caused
    by insufficient input validation. One of the configurable parameters in algorithm identifier
    structures for RSASSA-PSS signatures is the mask generation function (MGF). Only MGF1 is
    currently specified for this purpose. However, this in turn takes itself a parameter that
    specifies the underlying hash function. strongSwan's parser did not correctly handle the
    case of this parameter being absent, causing an undefined data read.
    This vulnerability has been registered as CVE-2018-6459.
  * When rekeying IKEv2 IKE_SAs the previously negotiated DH group will be reused, instead of
    using the first configured group, which avoids an additional exchange if the peer previously
    selected a different DH group via INVALID_KE_PAYLOAD notify. The same is also done when
    rekeying CHILD_SAs except for the first rekeying of the CHILD_SA that was created with the
    IKE_SA, where no DH group was negotiated yet.
    Also, the selected DH group is moved to the front in all sent proposals that contain it
    and all proposals that don't are moved to the back in order to convey the preference for
    this group to the peer.
  * Handling of MOBIKE task queuing has been improved. In particular, the response to an
    address update (with NAT-D payloads) is not ignored anymore if only an address list update
    or DPD is queued as that could prevent updating the UDP encapsulation in the kernel.
  * On Linux, roam events may optionally be triggered by changes to the routing rules, which
    can be useful if routing rules (instead of e.g. route metrics) are used to switch from one
    to another interface (i.e. from one to another routing table). Since routing rules are
    currently not evaluated when doing route lookups this is only useful if the kernel-based
    route lookup is used (4664992f7d).
  * The fallback drop policies installed to avoid traffic leaks when replacing addresses in
    installed policies are now replaced by temporary drop policies, which also prevent
    acquires because we currently delete and reinstall IPsec SAs to update their addresses
    (35ef1b032d).
  * Access X.509 certificates held in non-volatile storage of a TPM 2.0 referenced via the
    NV index.
    Adding the --keyid parameter to pki --print allows to print private keys or certificates
    stored in a smartcard or a TPM 2.0.
  * Fixed proposal selection if a peer incorrectly sends DH groups in the ESP proposal during
    IKE_AUTH and also if a DH group is configured in the local ESP proposal and charon.prefer
    configured_proposals is disabled (d058fd3c32).
  * The lookup for PSK secrets for IKEv1 has been improved for certain scenarios (see #2497
    for details).
  * MSKs received via RADIUS are now padded to 64 bytes to avoid compatibility issues with
    EAP-MSCHAPv2 and PRFs that have a block size &lt; 64 bytes (e.g. AES-XCBC-PRF-128, see
    73cbce6013).
  * The tpm_extendpcr command line tool extends a digest into a TPM PCR.
  * Ported the NetworkManager backend from the deprecated libnm-glib to libnm.
  * The save-keys debugging/development plugin saves IKE and/or ESP keys to files compatible
    with Wireshark.
  - Version 5.6.1
  ===============
  * Several algorithms were removed from the default ESP/AH and IKE proposals in compliance with
    RFC 8221 and RFC 8247, respectively. Removed from the default ESP/AH proposal were the
    3DES and Blowfish encryption algorithms and the HMAC-MD5 integrity algorithm. From the IKE
    default proposal the HMAC-MD5 integrity algorithm and the MODP-1024 Diffie-Hellman group
    were removed (the latter is significant for Windows clients in their default configuration).
    These algorithms may still be used in custom proposals.
  * Support for RSASSA-PSS signatures has been added. For compatibility with previous
    releases they are currently not used automatically, by default, to change that charon.rsa_pss
    may be enabled. To explicitly use or require such signatures during IKEv2 signature
    authentication (RFC 7427) ike:rsa/pss... authentication constraints may be used for specific
    connections (regardless of whether the strongswan.conf option above is enabled). Only the
    hash algorithm can be specified in such constraints, the MGF1 will be based on that hash
    and the salt length will equal the hash length (when verifying the salt length is not
    enforced).
    To enforce such signatures during PKI verification use rsa/pss... authentication constraints.
  * All pki commands that create certificates/CRLs can be made to sign with RSASSA-PSS instead
    of the classing PKCS#1 scheme with the --rsa-padding pss option. As with signatures during
    authentication, only the hash algorithm is configurable (via --digest option), the MGF1 will
    be based on that and the salt length will equal the hash length.
  * These signatures are supported by all RSA backends except pkcs11 (i.e. gmp, gcrypt, openssl).
    The gmp plugin requires the mgf1 plugin.
    Note that RSASSA-PSS algorithm identifiers and parameters in keys (public keys in
    certificates or private keys in PKCS#8 files) are currently not used as constraints.
  * The sec-updater tool checks for security updates in dpkg-based repositories
    (e.g. Debian/Ubuntu) and sets the security flags in the IMV policy database accordingly.
    Additionally for each new package version a SWID tag for the given OS and HW architecture
    is created and stored in the database.
  * Using the sec-updater.sh script template the lookup can be automated (e.g. via an hourly
    cron job).
  * When restarting an IKEv2 negotiation after receiving an INVALID_KE_PAYLOAD notify (or due
    to other reasons like too many retransmits) a new initiator SPI is allocated. This
    prevents issues caused by retransmits for IKE_SA_INIT messages.
  * Because the initiator SPI was previously reused when restarting the connection delayed
    responses for previous connection attempts were processed and might have caused fatal
    errors due to a failed DH negotiation or because of the internal retry counter in the
    ike-init task. For instance, if we proposed a DH group the responder rejected we
    might have later received delayed responses that either contained INVALID_KE_PAYLOAD
    notifies with the DH group we already switched to, or, if we retransmitted an
    IKE_SA_INIT with the requested group but then had to restart again, a KE payload with
    a group different from the one we proposed.
  * The introduction of file versions in the IMV database scheme broke file reference hash
    measurements. This has been fixed by creating generic product versions having an empty
    package name.
  * A new timeout option for the systime-fix plugin stops periodic system time checks after
    a while and enforces a certificate verification, closing or reauthenticating all SAs
    with invalid certificates.
  * The IKE event counters, previously only available via ipsec listcounters command, may
    now also be queried and reset via vici and the new swanctl --counters command. They
    are collected and provided by the optional counters plugin (enabled by default for
    backwards compatibility if the stroke plugin is built).
  * Class attributes received in RADIUS Access-Accept messages may optionally be added to
    RADIUS accounting messages (655924074b).
  * Basic support for systemd sockets has been added, which may be used for privilege separation
    (59db98fb94).
  * Inbound marks may optionally be installed in the SA again (was removed with 5.5.2) by
    enabling the mark_in_sa option in swanctl.conf.
  * The timeout of leases in pools configured via pool utility may be configured in other
    units than hours.
    INITIAL_CONTACT notifies are now only omitted if never is configured as uniqueness policy.
  * Outbound FWD policies for shunts are not installed anymore, by default (as is the case
    for other policies since 5.5.1).
  * Don't consider a DH group mismatch during CHILD_SA rekeying as failure as responder
    (e7276f78aa).
  * Handling of fragmented IPv4 and IPv6 packets in libipsec has been improved (e138003de9).
  * Trigger expire events for the correct IPsec SA in libipsec (6e861947a0).
  * A crash in CRL verification via openssl plugin using OpenSSL 1.1 has been fixed (78acaba6a1).
  * No hard-coded default proposals are passed from starter to the stroke plugin anymore (the
    IKE proposal used curve25519 since 5.5.2, which is an optional plugin).
  * A workaround for an issue with virtual IPs on macOS 10.13 (High Sierra) has been added
    (039b85dd43).
  * Handling of IKE_SA rekey collisions in charon-tkm has been fixed.
  * Instead of failing or just silently doing nothing unit tests may now warn about certain
    conditions (e.g. if a test was not executed due to external dependencies).</changelog>
  <changelog author="mmnelemane@suse.com" date="1585224000">- Fix for to resolve multiple definition of swanctl_dir (bsc #1164493)
  [+ 0006-Resolve-multiple-definition-of-swanctl_dir.patch]</changelog>
  <changelog author="mbuil@suse.com" date="1610712000">- Fix typo in README (bsc #1167880)
  [+ 0007-Fix-typo-in-README.patch ]</changelog>
  <changelog author="mbuil@suse.com" date="1611576000">- Fix FIPS bug (bsc #1180801)
  [+ 0008-gcrypt-Use-a-dummy-buffer-to-initialize-static-alloc.patch ]</changelog>
  <changelog author="mbuil@suse.com" date="1617019200">- Keep using ipsec as the main binary. Therefore, make strongswan.service point to it instead of swanctl</changelog>
  <changelog author="mbuil@suse.com" date="1617019201">- Information added in README about the rcstrongswan-starter</changelog>
  <changelog author="mbuil@suse.com" date="1617624000">- Add config to run ipsec on namespaces (bsc #1183670)</changelog>
  <changelog author="mt@suse.com" date="1619006400">- Add support for AES CCM aead algorithms to openssl plugin (cc/fips,bsc#1185363)
  [+ 0009-strongswan-openssl-aead-add-ccm-support.patch]</changelog>
  <changelog author="mt@suse.com" date="1620388800">- Replace AEAD AES CCM patch with upstream variant (cc/fips,bsc#1185363)
  [* 0009-strongswan-openssl-aead-add-ccm-support.patch]</changelog>
  <changelog author="hare@suse.de" date="1627646400">- Add auth_els plugin to support Marvell FC-SP encryption (jsc#SLE-20151)
  [* strongswan-marvell-auth-els.patch]</changelog>
  <changelog author="abergmann@suse.com" date="1634040000">- Fix integer overflow in gmp plugin (bsc#1191367, CVE-2021-41990)
  [* strongswan-5.6.1-5.9.3_gmp-rsa-ssa-salt-len.patch]
- Fix integer overflow when replacing certificates in cache (bsc#1191435, CVE-2021-41991)
  [* strongswan-4.4.1-5.9.3_cert-cache-random.patch]</changelog>
  <changelog author="meissner@suse.com" date="1643025600">- strongswan-5.5.0-5.9.4_eap_success-CVE-2021-45079.patch:
  Fixed authentication bypass in EAP authentication (CVE-2021-45079
  bsc#1194471)</changelog>
</package>
<package pkgid="487c5060c06ce60d1be31672c0ca35c234017f832632f4b59210d477c7d437c4" name="strongswan-hmac" arch="ppc64le">
  <version epoch="0" ver="5.8.2" rel="11.24.1"/>
  <changelog author="ndas@suse.de" date="1501502400">- Updated to strongSwan 5.3.5(bsc#1050691) providing the following changes:
  * Fixed a DoS vulnerability in the gmp plugin that was caused by insufficient input
    validation when verifying RSA signatures. More specifically, mpz_powm_sec() has two
    requirements regarding the passed exponent and modulus that the plugin did not
    enforce, if these are not met the calculation will result in a floating point exception
    that crashes the whole process.
    This vulnerability has been registered as CVE-2017-9022.
    Please refer to our blog for details.
  * Fixed a DoS vulnerability in the x509 plugin that was caused because the ASN.1 parser
    didn't handle ASN.1 CHOICE types properly, which could result in an infinite loop when
    parsing X.509 extensions that use such types.
    This vulnerability has been registered as CVE-2017-9023.
    Please refer to our blog for details.
  * The behavior during IKEv2 CHILD_SA rekeying has been changed in order to avoid
    traffic loss. When responding to a CREATE_CHILD_SA request to rekey a CHILD_SA
    the responder already has everything available to install and use the new CHILD_SA.
    However, this could lead to lost traffic as the initiator won't be able to process
    inbound packets until it processed the CREATE_CHILD_SA response and updated the
    inbound SA. To avoid this the responder now only installs the new inbound SA and
    delays installing the outbound SA until it receives the DELETE for the replaced CHILD_SA.
  * The messages transporting these DELETEs could reach the peer before packets sent
    with the deleted outbound SAs reach it. To reduce the chance of traffic loss due
    to this the inbound SA of the replaced CHILD_SA is not removed for a configurable
    amount of seconds (charon.delete_rekeyed_delay) after the DELETE has been processed.
  * The code base has been ported to Apple's ARM64 iOS platform, which required several
    changes regarding the use of variadic functions. This was necessary because the calling
    conventions for variadic and regular functions are different there.
    This means that assigning a non-variadic function to a variadic function pointer, as we
    did with our enumerator_t::enumerate() implementations and several callbacks, will
    result in crashes as the called function accesses the arguments differently than the
    caller provided them. To avoid this issue the enumerator_t interface has been changed
    and the signature of the callback functions for enumerator_create_filter() and two
    methods on linked_list_t have been changed. Refer to the developer notes below
    for details.
  * Adds support for fuzzing the certificate parser provided by the default plugins
    (x509, pem, gmp etc.) on Google's OSS-Fuzz infrastructure (or generally with
    libFuzzer). Several issues found while fuzzing these plugins were fixed.
  * Two new options have been added to charon's retransmission settings:
    retransmit_limit and retransmit_jitter. The former adds an upper limit to the
    calculated retransmission timeout, the latter randomly reduces it.
    Refer to Retransmission for details.
  * A bug in swanctl's --load-creds command was fixed that caused unencrypted
    private keys to get unloaded if the command was called multiple times.
    The load-key VICI command now returns the key ID of the loaded key on success.
  * The credential manager now enumerates local credential sets before global ones.
    This means certificates supplied by the peer will now be preferred over certificates
    with the same identity that may be locally stored (e.g. in the certificate cache).
  * Adds support for hardware offload of IPsec SAs as introduced by Linux 4.11 for
    specific hardware that supports this.
  * The pki tool loads the curve25519 plugin by default.
    [- 0006-Make-sure-the-modulus-is-odd-and-the-exponent-not-zero.patch,
  - 0007-asn1-parser-Fix-CHOICE-parsing.patch]
- libhydra is removed as all kernel plugins moved to libcharon</changelog>
  <changelog author="ndas@suse.de" date="1504612800">- fix "uintptr_t? undeclared" compilation error.
  [+0006-fix-compilation-error-by-adding-stdint.h.patch]</changelog>
  <changelog author="ndas@suse.de" date="1504612801">- Updated to strongSwan 5.6.0 providing the following changes:
  * Fixed a DoS vulnerability in the gmp plugin that was caused by insufficient input validation
    when verifying RSA signatures, which requires decryption with the operation m^e mod n,
    where m is the signature, and e and n are the exponent and modulus of the public key.
    The value m is an integer between 0 and n-1, however, the gmp plugin did not verify this.
    So if m equals n the calculation results in 0, in which case mpz_export() returns NULL.
    This result wasn't handled properly causing a null-pointer dereference.
    This vulnerability has been registered as CVE-2017-11185. (bsc#1051222)
  * New SWIMA IMC/IMV pair implements the draft-ietf-sacm-nea-swima-patnc Internet
    Draft and has been demonstrated at the IETF 99 Prague Hackathon.
  * The IMV database template has been adapted to achieve full compliance with the
    ISO 19770-2:2015 SWID tag standard.
  * The pt-tls-client can attach and use TPM 2.0 protected private keys via the --keyid parameter.
  * By default the /etc/swanctl/conf.d directory is created and *.conf files in it are included in the default
    swanctl.conf file.
  * The curl plugin now follows HTTP redirects (configurable via strongswan.conf).
  * The CHILD_SA rekeying was fixed in charon-tkm and the behavior is refined a bit more since 5.5.3
  * libtpmtss supports Intel's TSS2 Architecture Broker and Resource Manager interface (tcti-tabrmd).
  * more on https://wiki.strongswan.org/versions/66</changelog>
  <changelog author="mmnelemane@suse.com" date="1521028800">- Removed unused requires and macro calls(bsc#1083261)</changelog>
  <changelog author="mmnelemane@suse.com" date="1573646400">- Added patch to fix vulnerability: CVE-2018-16151,CVE-2018-16152 (bsc#1107874)
  - Insufficient input validation in gmp plugin
  [+ 0007-strongswan-5.3.1-5.6.0_gmp-pkcs1-verify.patch]</changelog>
  <changelog author="mmnelemane@suse.com" date="1573646401">- Added patch to fix vulnerability: CVE-2018-5388 (bsc#1094462)
  - Buffer Underflow in stroke_socket.c
  [+ 0008-strongswan-5.1.2-5.6.2_stroke_msg_len.patch]</changelog>
  <changelog author="mmnelemane@suse.com" date="1573646402">- Added patch to fix vulnerability: CVE-2018-10811 (bsc#1093536)
  - denial-of-service vulnerability
  [+ 0009-strongswan-5.5.0-5.6.2_skeyseed_init.patch]</changelog>
  <changelog author="mmnelemane@suse.com" date="1573732800">- Added patch to fix vulnerability: CVE-2018-17540 (bsc#1109845)
  [+ 0010-strongswan-4.4.0-5.7.0_gmp-pkcs1-overflow.patch]</changelog>
  <changelog author="mmnelemane@suse.com" date="1580212800">- Updated to version 5.8.2 (jsc#SLE-11370)
  - Dropped following patches due to irrelevance in the updated version:
    [- strongswan_modprobe_syslog.patch ]
    [- strongswan_fipsfilter.patch ]
    [- 0006-fix-compilation-error-by-adding-stdint.h.patch ]
    [- 0007-strongswan-5.3.1-5.6.0_gmp-pkcs1-verify.patch ]
    [- 0008-strongswan-5.1.2-5.6.2_stroke_msg_len.patch ]
    [- 0009-strongswan-5.5.0-5.6.2_skeyseed_init.patch ]
    [- 0010-strongswan-4.4.0-5.7.0_gmp-pkcs1-overflow.patch ]
  - Version 5.8.2
  ===============
  * Identity-based CA constraints, which enforce that the certificate chain of the remote
    peer contains a CA certificate with a specific identity, are supported via
    vici/swanctl.conf. This is similar to the existing CA constraints but doesn't require
    that the CA certificate is locally installed, for instance, intermediate CA certificates
    received from the peers. Wildcard identity matching (e.g. ..., OU=Research, CN=*) could
    also be used for the latter but requires trust in the intermediate CAs to only issue
    certificates with legitimate subject DNs (e.g. the "Sales" CA must not issue certificates
    with OU=Research). With the new constraint that's not necessary as long as a path length
    basic constraint (--pathlen for pki --issue) prevents intermediate CAs from issuing further
    intermediate CAs.
  * Intermediate CA certificates may now be sent in hash-and-URL encoding by configuring a
    base URL for the parent CA (#3234, swanctl/rw-hash-and-url-multi-level).
  * Implemented NIST SP-800-90A Deterministic Random Bit Generator (DRBG) based on AES-CTR
    and SHA2-HMAC modes. Currently used by the gmp and ntru plugins.
  * Random nonces sent in an OCSP requests are now expected in the corresponding OCSP responses.
  * The kernel-netlink plugin now ignores deprecated IPv6 addresses for MOBIKE. Whether temporary
    or permanent IPv6 addresses are included now depends on the charon.prefer_temporary_addrs
    setting (#3192).
  * Extended Sequence Numbers (ESN) are configured via PF_KEY if supported by the kernel.
  * The PF_KEY socket's receive buffer in the kernel-pfkey plugin is now cleared before sending
    requests, as many of the messages sent by the kernel are sent as broadcasts to all PF_KEY
    sockets. This is an issue if an external tool is used to manage SAs/policies unrelated to
    IPsec (#3225).
  * The vici plugin now uses unique section names for CHILD_SAs in child-updown events (7c74ce9190).
  * For individually deleted CHILD_SAs (in particular for IKEv1) the vici child-updown event
    now includes more information about the CHILD_SAs such as traffic statistics (#3198).
  * Custom loggers are correctly re-registered if log levels are changed via stroke loglevel (#3182).
  * Avoid lockups during startup on low entropy systems when using OpenSSL 1.1.1 (095a2c2eac).
  * Instead of failing later when setting a key, creating HMACs via openssl plugin now fails
    instantly if the underlying hash algorithm isn't supported (e.g. MD5 in FIPS-mode) so fallbacks
    to other plugins work properly (#3284).
  * Exponents of RSA keys read from TPM 2.0 via SAPI are correctly converted (8ee1242f1438).
  * Routing table IDs &gt; 255 are supported for custom routes on Linux.
  * To avoid races, the check for hardware offloading support in the kernel-netlink plugin is
    performed during initialization of the plugin (a605452c03).
  * The D-Bus config file for charon-nm is now installed in $(datadir)/dbus-1/system.d instead of
    $(sysconfdir)/dbus-1/system.d, which is intended for sysadmin overrides.
    INVALID_MAJOR_VERSION notifies are now correctly sent in messages of the same exchange type
    and with the same message ID as the request.
  * IKEv2 SAs are now immediately destroyed when sending or receiving INVALID_SYNTAX notifies
    in authenticated messages.
  * For developers working from the repository the configure script now aborts if GNU gperf is
    not found.
  - Version 5.8.1
  ===============
  * RDNs in DNs of X.509 certificates can now optionally be matched less strict. The global
    strongswan.conf option charon.rdn_matching takes two alternative values that cause the
    matching algorithm to either ignore the order of matched RDNs (reordered) or additionally
    (relaxed) accept DNs that contain more RDNs than configured (unmatched RDNs are treated
    like wildcard matches).
  * The updown plugin now passes the same interface to the script that is also used for the
    automatically installed routes, that is, the interface over which the peer is reached
    instead of the interface on which the local address is found (#3095).
  * TPM 2.0 contexts are now protected by a mutex to prevent issues if multiple IKE_SAs use
    the same private key concurrently (4b25885025).
  * Do a rekey check after the third QM message was received (#3060).
  * If available, explicit_bzero() is now used as memwipe() instead of our own implementation.
  * An .editorconfig file has been added, mainly so Github shows files with proper indentation
    (68346b6962).
  * The internal certificate of the load-tester plugin has been modified so it can again be
    used as end-entity cert with 5.6.3 and later (#3139).
  * The maximum data length of received COOKIE notifies (64 bytes) is now enforced (#3160).
  - Version 5.8.0
  ===============
  * The systemd service units have been renamed. The modern unit, which was called
    strongswan-swanctl, is now called strongswan (the previous name is configured as alias in
    the unit, for which a symlink is created when the unit is enabled). The legacy unit is now
    called strongswan-starter.
  * Support for XFRM interfaces (available since Linux 4.19) has been added, which are intended
    to replace VTI devices (they are similar but offer several advantages, for instance, they
    are not bound to an address or address family).
  * IPsec SAs and policies are associated with such interfaces via interface IDs that can be
    configured in swanctl.conf (dynamic IDs may optionally be allocated for each SA and even
    direction). It's possible to use separate interfaces for in- and outbound traffic (or
    only use an interface in one direction and regular policies in the other).
  * Interfaces may be created dynamically via updown/vici scripts, or statically before or after
    establishing the SAs. Routes must be added manually as needed (the daemon will not install
    any routes for outbound policies with an interface ID).
  * When moving XFRM interfaces to other network namespaces they retain access to the SAs and
    policies installed in the original namespace, which allows providing IPsec tunnels for
    processes in other network namespaces without giving them access to the IPsec keys or
    IKE credentials.
    More information can be found on the page about route-based VPNs.
  * Initiation of childless IKE_SAs is supported (RFC 6023). If enabled and supported by the
    responder, no CHILD_SA is established during IKE_AUTH. Instead, all CHILD_SAs are created
    with CREATE_CHILD_SA exchanges. This allows using a separate DH exchange even for the
    first CHILD_SA, which is otherwise created during IKE_AUTH with keys derived from the
    IKE_SA's key material.
  * The swanctl --initiate command may be used to initiate only the IKE_SA via --ike
    option if --child is omitted and the peer supports this extension.
  * The NetworkManager backend and plugin support IPv6.
  * The new wolfssl plugin is a wrapper around the wolfSSL crypto library. Thanks to Sean
    Parkinson of wolfSSL Inc. for the initial patch.
  * IKE SPIs may optionally be labeled via the charon.spi_mask|label options in
    strongswan.conf. This feature was extracted from charon-tkm, however, now applies the
    mask/label in network order.
  * The openssl plugin supports ChaCha20-Poly1305 when built with OpenSSL 1.1.0.
  * The PB-TNC finite state machine according to section 3.2 of RFC 5793 was not correctly
    implemented when sending either a CRETRY or SRETRY batch. These batches can only be sent
    in the "Decided" state and a CRETRY batch can immediately carry all messages usually
    transported by a CDATA batch. It is currently not possible to send a SRETRY batch since
    full-duplex mode for PT-TLS transport is not supported.
  * Instead of marking IPv6 virtual IPs as deprecated, the kernel-netlink plugin now uses
    address labels to avoid that such addresses are used for non-VPN traffic (00a953d090).
  * The agent plugin now creates sockets to the ssh/gpg-agent dynamically and does not keep
    them open, which otherwise might prevent the agent from getting terminated.
  * To avoid broadcast loops the forecast plugin now only reinjects packets that are marked
    or received from the configured interface.
  * UTF-8 encoded passwords are supported via EAP-MSCHAPv2, which internally uses an UTF-16LE
    encoding to calculate the NT hash (#3014).
  * Properly delete temporary drop policies (used when updating IP addresses of SAs) if manual
    priorities are used, which was broken since 5.6.2 (8e31d65730).
  * Avoid overwriting start_action when parsing the inactivity timeout in the vici plugin (#2954).
  * Fixed the automatic termination of reloaded vici connections with start_action=start,
    which was broken since 5.6.3 (71b22c250f).
  * The lookup for shared secrets for IKEv1 SAs via sql plugin should now work better
    (6ec9f68f32).
  * Fixed a race condition in the trap manager between installation and removal of a policy
    (69cbe2ca3f).
  * Compilation of the kernel-netlink plugin has been fixed on old kernels (&lt; 2.6.39), which
    was caused by the HW offload changes (c7f579fa17).
  * The IPsec stack detection and module loading in starter has been removed (it wasn't
    enforced anyway and loading modules doesn't seem necessary, also KLIPS hasn't been
    supported for a long time and PF_KEY will eventually be removed from the Linux kernel,
    ba817d2917).
  * Several IKEv2 protocol details are now handled more strictly: Unrequested virtual IPs are
    ignored, CFG_REPLY payloads are ignored if no CFG_REQUEST payloads were sent, a USE
    TRANSPORT_MODE notify received from the responder is checked against the local configuration.
  * The keys and certificates used by the scenarios in the testing environment are now generated
    dynamically. Running the testing/scripts/build-certs script after creating the base and root
    images uses the pki utility installed in the latter to create the keys and certificates for
    all the CAs and in some cases for individual scenarios. These credentials are stored in the
    source tree, not the image, so this has to be called only once even if the images are later
    rebuilt. The script automatically (re-)rebuilds the guest images as that generates fresh
    CRLs and signs the DNS zones. The only keys/certificates currently not generated are the
    very large ones used by the ikev2/rw-eap-tls-fragments scenario.
  - Version 5.7.2
  ===============
  * For RSA with PSS padding, the TPM 2.0 specification mandates the maximum salt length
    (as defined by the length of the key and hash). However, if the TPM is FIPS-168-4 compliant,
    the salt length equals the hash length. This is assumed for FIPS-140-2 compliant TPMs, but
    if that's not the case, it might be necessary to manually enable charon.plugins.tpm.fips_186_4
    if the TPM doesn't use the maximum salt length.
  * Directories for credentials loaded by swanctl are now accessed relative to the loaded
    swanctl.conf file, in particular, when loading it from a custom location via --file argument.
  * The base directory, which is used if no custom location for swanctl.conf is specified, is now
    also configurable at runtime via SWANCTL_DIR environment variable.
  * If RADIUS Accounting is enabled, the eap-radius plugin will add the session ID (Acct-Session-Id)
    to Access-Request messages, which e.g. simplifies associating database entries for IP leases and
    accounting with sessions (the session ID does not change when IKE_SAs are rekeyed, #2853).
  * All IP addresses assigned by a RADIUS server are included in Accounting-Stop messages even if
    the client did not claim them, allowing to release them early in case of connection errors (#2856).
  * Selectors installed on transport mode SAs by the kernel-netlink plugin are now updated if an
    IP address changes (e.g. via MOBIKE) and it was part of the selectors.
  * No deletes are sent anymore when a rekeyed CHILD_SA expires (#2815).
  * The bypass-lan plugin now tracks interfaces to handle subnets that move from one interface
    to another and properly update associated routes (#2820).
  * Only valid and expected inbound IKEv2 messages are used to update the timestamp of the
    last received message (previously, retransmits also triggered an update).
  * IKEv2 requests from responders are now ignored until the IKE_SA is fully established (e.g. if a
    DPD request from the peer arrives before the IKE_AUTH response does, 46bea1add9).
    Delayed IKE_SA_INIT responses with COOKIE notifies we already recevied are ignored, they caused
    another reset of the IKE_SA previously (#2837).
  * Active and queued Quick Mode tasks are now adopted if the peer reauthenticates an IKEv1 SA
    while creating lots of CHILD_SAs.
  * Newer versions of the FreeBSD kernel add an SADB_X_EXT_SA2 extension to SADB_ACQUIRE
    messages, which allows the kernel-pfkey plugin to determine the reqid of the policy even if it
    wasn't installed by the daemon previously (e.g. when using FreeBSD's if_ipsec(4) VTIs, which
    install policies themselves, 872b9b3e8d).
  * Added support for RSA signatures with SHA-256 and SHA-512 to the agent plugin. For older
    versions of ssh/gpg-agent that only support SHA-1, IKEv2 signature authentication has to be
    disabled via charon.signature_authentication.
  * The sshkey and agent plugins support Ed25519/Ed448 SSH keys and signatures.
  * The openssl plugin supports X25519/X448 Diffie-Hellman and Ed25519/Ed448 keys and
    signatures when built against OpenSSL 1.1.1.
  * Support for Ed25519, ChaCha20/Poly1305, SHA-3 and AES-CCM were added to the botan plugin.
  * The mysql plugin now properly handles database connections with transactions
    under heavy load (#2779).
  * IP addresses in ha pools are now distributed evenly among all segments (#2828).
  * Private key implementations may optionally provide a list of supported signature schemes,
    which, as described above, is used by the tpm plugin because for each key on a TPM 2.0 the
    hash algorithm and for RSA also the padding scheme is predefined.
  * The testing environment is now based on Debian 9 (stretch) by default. This required
    some changes, in particular, updating to FreeRADIUS 3.x (which forced us to abandon the
    TNC@FHH patches and scenarios, 2fbe44bef3) and removing FIPS-enabled versions of
    OpenSSL (the FIPS module only supports OpenSSL 1.0.2).
  * Most test scenarios were migrated to swanctl.
  - Version 5.7.1
  ===============
  * Fixes a vulnerability in the gmp plugin triggered by crafted certificates with RSA keys with
    very small moduli. When verifying signatures with such keys, the code patched with the fix
    for CVE-2018-16151/2 caused an integer underflow and subsequent heap buffer overflow
    that results in a crash of the daemon.
  * The vulnerability has been registered as CVE-2018-17540.
  - Version 5.7.0
  ===============
  * Fixes a potential authorization bypass vulnerability in the gmp plugin that was caused by a
    too lenient verification of PKCS#1 v1.5 signatures. Several flaws could be exploited by a
    Bleichenbacher-style attack to forge signatures for low-exponent keys (i.e. with e=3).
  * CVE-2018-16151 has been assigned to the problem of accepting random bytes after the OID
    of the hash function in such signatures, and CVE-2018-16152 has been assigned to the issue
    of not verifying that the parameters in the ASN.1 algorithmIdentitifer structure is empty.
    Other flaws that don't lead to a vulnerability directly (e.g. not checking for at least
    8 bytes of padding) have no separate CVE assigned.
  * Dots are not allowed anymore in section names in swanctl.conf and strongswan.conf.
    This mainly affects the configuration of file loggers. If the path for such a log file
    contains dots it now has to be configured in the new path setting within the arbitrarily
    renamed subsection in the filelog section.
  * Sections in swanctl.conf and strongswan.conf may now reference other sections. All settings
    and subsections from such a section are inherited. This allows to simplify configs as
    redundant information has only to be specified once and may then be included in other
    sections (see strongswan.conf for an example).
  * The originally selected IKE config (based on the IPs and IKE version) can now change
    if no matching algorithm proposal is found. This way the order of the configs doesn't
    matter that much anymore and it's easily possible to specify separate configs for
    clients that require weaker algorithms (instead of having to also add them in other
    configs that might be selected).
  * Support for Postquantum Preshared Keys for IKEv2 (draft-ietf-ipsecme-qr-ikev2) has been added.
    For an example refer to the swanctl/rw-cert-ppk scenario (or with EAP, or PSK authentication).
  * The new botan plugin is a wrapper around the Botan C++ crypto library.
    It requires a fairly recent build from Botan's master branch (or the upcoming 2.8.0 release).
    Thanks to René Korthaus and his team from Rohde &amp; Schwarz Cybersecurity for the initial
    patch and to Jack Lloyd for quickly adding missing functions to Botan's FFI (C89) interface.
  * Implementation of RFC 8412 "Software Inventory Message and Attributes (SWIMA) for PA-TNC".
  * SWIMA subscription option sets CLOSE_WRITE trigger on apt history.log file resulting in
    a ClientRetry PB-TNC batch to initialize a new measurement cycle. The new imv/imc-swima
    plugins replace the previous imv/imc-swid plugins, which were removed.
  * Added support for fuzzing the PA-TNC (RFC 5792) and PB-TNC (RFC 5793) NEA protocols
    on Google's OSS-Fuzz infrastructure.
  * Support for version 2 of Intel's TPM2-TSS TGC Software Stack. The presence of the
    in-kernel /dev/tpmrm0 resource manager is automatically detected.
  * The pki tool accepts a xmppAddr otherName as a subjectAlternativeName using the
    syntax --san xmppaddr:&lt;jid&gt;.
  * swanctl.conf supports the configuration of marks the in- and/or outbound SA should apply
    to packets after processing on Linux. Configuring such a mark for outbound SAs requires
    at least a 4.14 kernel. The ability to set a mask and configuring a mark/mask for
    inbound SAs will be added with the upcoming 4.19 kernel.
  * New options in swanctl.conf allow configuring how/whether DF, ECN and DS fields in the
    IP headers are copied during IPsec processing. Controlling this is currently only possible
    on Linux.
  * The handling of sequence numbers in IKEv1 DPDs has been improved (#2714).
  * To avoid conflicts, the dhcp plugin now only uses the DHCP server port if explicitly
    configured.
  - Version 5.6.3
  ===============
  * Fixed a DoS vulnerability in the IKEv2 key derivation if the openssl plugin is used in FIPS
    mode and HMAC-MD5 is negotiated as PRF.
    This vulnerability has been registered as CVE-2018-10811.
  * Fixed a vulnerability in the stroke plugin, which did not check the received length before
    reading a message from the socket. Unless a group is configured, root privileges are
    required to access that socket, so in the default configuration this shouldn't be an issue.
    This vulnerability has been registered as CVE-2018-5388.
  * CRLs that are not yet valid are now ignored to avoid problems in scenarios where expired
    certificates are removed from new CRLs and the clock on the host doing the revocation
    check is trailing behind that of the host issuing CRLs. Not doing this could result in
    accepting a revoked and expired certificate, if it's still valid according to the
    trailing clock but not contained anymore in not yet valid CRLs.
  * The issuer of fetched CRLs is now compared to the issuer of the checked certificate (#2608).
  * CRL validation results other than revocation (e.g. a skipped check because the CRL couldn't
    be fetched) are now stored also for intermediate CA certificates and not only for end-entity
    certificates, so a strict CRL policy can be enforced in such cases.
  * In compliance with RFC 4945, section 5.1.3.2, certificates used for IKE must now either
    not contain a keyUsage extension (like the ones generated by pki), or have at least one of the
    digitalSignature or nonRepudiation bits set.
  * New options for vici/swanctl allow forcing the local termination of an IKE_SA. This might be
    useful in situations where it's known the other end is not reachable anymore, or that it
    already removed the IKE_SA, so retransmitting a DELETE and waiting for a response would
    be pointless.
  * Waiting only a certain amount of time for a response (i.e. shorter than all retransmits
    would be) before destroying the IKE_SA is also possible by additionally specifying a
    timeout in the forced termination request.
  * When removing routes, the kernel-netlink plugin now checks if it tracks other routes for
    the same destination and replaces the installed route instead of just removing it. Same
    during installation, where existing routes previously weren't replaced. This should allow
    using traps with virtual IPs on Linux (#2162).
  * The dhcp plugin now only sends the client identifier DHCP option if the identity_lease
    setting is enabled (7b660944b6). It can also send identities of up to 255 bytes length,
    instead of the previous 64 bytes (30e886fe3b, 0e5b94d038). If a server address is
    configured, DHCP requests are now sent from port 67 instead of 68 to avoid ICMP port
    unreachables (becf027cd9).
  * The handling of faulty INVALID_KE_PAYLOAD notifies (e.g. one containing a DH group
    that wasn't proposed) during CREATE_CHILD_SA exchanges has been improved (#2536).
  * Roam events are now completely ignored for IKEv1 SAs (there is no MOBIKE to handle such
    changes properly).
  * ChaCha20/Poly1305 is now correctly proposed without key length (#2614). For compatibility with
    older releases the chacha20poly1305compat keyword may be included in proposals to also propose
    the algorithm with a key length (c58434aeff).
  * Configuration of hardware offload of IPsec SAs is now more flexible and allows a new
    setting (auto), which automatically uses it if the kernel and device both support it. If hw
    offload is set to yes and offloading is not supported, the CHILD_SA installation now fails.
  * The kernel-pfkey plugin optionally installs routes via internal interface (one with an IP
    in the local traffic selector). On FreeBSD, enabling this selects the correct source IP
    when sending packets from the gateway itself (e811659323).
  * SHA-2 based PRFs are supported in PKCS#8 files as generated by OpenSSL 1.1 (#2574).
  * The pki --verify tool may load CA certificates and CRLs from directories.
  * The IKE daemon now also switches to port 4500 if the remote port is not 500 (e.g. because the
    remote maps the response to a different port, as might happen on Azure), as long as the local
    port is 500 (85bfab621d).
  * Fixed an issue with DNS servers passed to NetworkManager in charon-nm (ee8c25516a).
  * Logged traffic selectors now always contain the protocol if either protocol or port are set
    (a36d8097ed).
  * Only the inbound SA/policy will be updated as reaction to IP address changes for rekeyed
    CHILD_SAs that are kept around.
  * The parser for strongswan.conf/swanctl.conf now accepts = characters in values without
    having to put the value in quotes (e.g. for Base64 encoded shared secrets).
    Notes for developers:
  * trap_manager_t: Trap policies are now unistalled by peer/child name and not the reqid.
  * No reqid is returned anymore when installing trap policies.
  * child_sa_t: A new state (CHILD_DELETED) is used for CHILD_SAs that have been deleted but
    not yet destroyed (after a rekeying CHILD_SAs are kept around for a while to process
    delayed packets).
    This way child_updown events are not triggered anymore for such SAs when an IKE_SA that
    has such CHILD_SAs assigned is deleted.
  - Version 5.6.2
  ===============
  * Fixed a DoS vulnerability in the parser for PKCS#1 RSASSA-PSS signatures that was caused
    by insufficient input validation. One of the configurable parameters in algorithm identifier
    structures for RSASSA-PSS signatures is the mask generation function (MGF). Only MGF1 is
    currently specified for this purpose. However, this in turn takes itself a parameter that
    specifies the underlying hash function. strongSwan's parser did not correctly handle the
    case of this parameter being absent, causing an undefined data read.
    This vulnerability has been registered as CVE-2018-6459.
  * When rekeying IKEv2 IKE_SAs the previously negotiated DH group will be reused, instead of
    using the first configured group, which avoids an additional exchange if the peer previously
    selected a different DH group via INVALID_KE_PAYLOAD notify. The same is also done when
    rekeying CHILD_SAs except for the first rekeying of the CHILD_SA that was created with the
    IKE_SA, where no DH group was negotiated yet.
    Also, the selected DH group is moved to the front in all sent proposals that contain it
    and all proposals that don't are moved to the back in order to convey the preference for
    this group to the peer.
  * Handling of MOBIKE task queuing has been improved. In particular, the response to an
    address update (with NAT-D payloads) is not ignored anymore if only an address list update
    or DPD is queued as that could prevent updating the UDP encapsulation in the kernel.
  * On Linux, roam events may optionally be triggered by changes to the routing rules, which
    can be useful if routing rules (instead of e.g. route metrics) are used to switch from one
    to another interface (i.e. from one to another routing table). Since routing rules are
    currently not evaluated when doing route lookups this is only useful if the kernel-based
    route lookup is used (4664992f7d).
  * The fallback drop policies installed to avoid traffic leaks when replacing addresses in
    installed policies are now replaced by temporary drop policies, which also prevent
    acquires because we currently delete and reinstall IPsec SAs to update their addresses
    (35ef1b032d).
  * Access X.509 certificates held in non-volatile storage of a TPM 2.0 referenced via the
    NV index.
    Adding the --keyid parameter to pki --print allows to print private keys or certificates
    stored in a smartcard or a TPM 2.0.
  * Fixed proposal selection if a peer incorrectly sends DH groups in the ESP proposal during
    IKE_AUTH and also if a DH group is configured in the local ESP proposal and charon.prefer
    configured_proposals is disabled (d058fd3c32).
  * The lookup for PSK secrets for IKEv1 has been improved for certain scenarios (see #2497
    for details).
  * MSKs received via RADIUS are now padded to 64 bytes to avoid compatibility issues with
    EAP-MSCHAPv2 and PRFs that have a block size &lt; 64 bytes (e.g. AES-XCBC-PRF-128, see
    73cbce6013).
  * The tpm_extendpcr command line tool extends a digest into a TPM PCR.
  * Ported the NetworkManager backend from the deprecated libnm-glib to libnm.
  * The save-keys debugging/development plugin saves IKE and/or ESP keys to files compatible
    with Wireshark.
  - Version 5.6.1
  ===============
  * Several algorithms were removed from the default ESP/AH and IKE proposals in compliance with
    RFC 8221 and RFC 8247, respectively. Removed from the default ESP/AH proposal were the
    3DES and Blowfish encryption algorithms and the HMAC-MD5 integrity algorithm. From the IKE
    default proposal the HMAC-MD5 integrity algorithm and the MODP-1024 Diffie-Hellman group
    were removed (the latter is significant for Windows clients in their default configuration).
    These algorithms may still be used in custom proposals.
  * Support for RSASSA-PSS signatures has been added. For compatibility with previous
    releases they are currently not used automatically, by default, to change that charon.rsa_pss
    may be enabled. To explicitly use or require such signatures during IKEv2 signature
    authentication (RFC 7427) ike:rsa/pss... authentication constraints may be used for specific
    connections (regardless of whether the strongswan.conf option above is enabled). Only the
    hash algorithm can be specified in such constraints, the MGF1 will be based on that hash
    and the salt length will equal the hash length (when verifying the salt length is not
    enforced).
    To enforce such signatures during PKI verification use rsa/pss... authentication constraints.
  * All pki commands that create certificates/CRLs can be made to sign with RSASSA-PSS instead
    of the classing PKCS#1 scheme with the --rsa-padding pss option. As with signatures during
    authentication, only the hash algorithm is configurable (via --digest option), the MGF1 will
    be based on that and the salt length will equal the hash length.
  * These signatures are supported by all RSA backends except pkcs11 (i.e. gmp, gcrypt, openssl).
    The gmp plugin requires the mgf1 plugin.
    Note that RSASSA-PSS algorithm identifiers and parameters in keys (public keys in
    certificates or private keys in PKCS#8 files) are currently not used as constraints.
  * The sec-updater tool checks for security updates in dpkg-based repositories
    (e.g. Debian/Ubuntu) and sets the security flags in the IMV policy database accordingly.
    Additionally for each new package version a SWID tag for the given OS and HW architecture
    is created and stored in the database.
  * Using the sec-updater.sh script template the lookup can be automated (e.g. via an hourly
    cron job).
  * When restarting an IKEv2 negotiation after receiving an INVALID_KE_PAYLOAD notify (or due
    to other reasons like too many retransmits) a new initiator SPI is allocated. This
    prevents issues caused by retransmits for IKE_SA_INIT messages.
  * Because the initiator SPI was previously reused when restarting the connection delayed
    responses for previous connection attempts were processed and might have caused fatal
    errors due to a failed DH negotiation or because of the internal retry counter in the
    ike-init task. For instance, if we proposed a DH group the responder rejected we
    might have later received delayed responses that either contained INVALID_KE_PAYLOAD
    notifies with the DH group we already switched to, or, if we retransmitted an
    IKE_SA_INIT with the requested group but then had to restart again, a KE payload with
    a group different from the one we proposed.
  * The introduction of file versions in the IMV database scheme broke file reference hash
    measurements. This has been fixed by creating generic product versions having an empty
    package name.
  * A new timeout option for the systime-fix plugin stops periodic system time checks after
    a while and enforces a certificate verification, closing or reauthenticating all SAs
    with invalid certificates.
  * The IKE event counters, previously only available via ipsec listcounters command, may
    now also be queried and reset via vici and the new swanctl --counters command. They
    are collected and provided by the optional counters plugin (enabled by default for
    backwards compatibility if the stroke plugin is built).
  * Class attributes received in RADIUS Access-Accept messages may optionally be added to
    RADIUS accounting messages (655924074b).
  * Basic support for systemd sockets has been added, which may be used for privilege separation
    (59db98fb94).
  * Inbound marks may optionally be installed in the SA again (was removed with 5.5.2) by
    enabling the mark_in_sa option in swanctl.conf.
  * The timeout of leases in pools configured via pool utility may be configured in other
    units than hours.
    INITIAL_CONTACT notifies are now only omitted if never is configured as uniqueness policy.
  * Outbound FWD policies for shunts are not installed anymore, by default (as is the case
    for other policies since 5.5.1).
  * Don't consider a DH group mismatch during CHILD_SA rekeying as failure as responder
    (e7276f78aa).
  * Handling of fragmented IPv4 and IPv6 packets in libipsec has been improved (e138003de9).
  * Trigger expire events for the correct IPsec SA in libipsec (6e861947a0).
  * A crash in CRL verification via openssl plugin using OpenSSL 1.1 has been fixed (78acaba6a1).
  * No hard-coded default proposals are passed from starter to the stroke plugin anymore (the
    IKE proposal used curve25519 since 5.5.2, which is an optional plugin).
  * A workaround for an issue with virtual IPs on macOS 10.13 (High Sierra) has been added
    (039b85dd43).
  * Handling of IKE_SA rekey collisions in charon-tkm has been fixed.
  * Instead of failing or just silently doing nothing unit tests may now warn about certain
    conditions (e.g. if a test was not executed due to external dependencies).</changelog>
  <changelog author="mmnelemane@suse.com" date="1585224000">- Fix for to resolve multiple definition of swanctl_dir (bsc #1164493)
  [+ 0006-Resolve-multiple-definition-of-swanctl_dir.patch]</changelog>
  <changelog author="mbuil@suse.com" date="1610712000">- Fix typo in README (bsc #1167880)
  [+ 0007-Fix-typo-in-README.patch ]</changelog>
  <changelog author="mbuil@suse.com" date="1611576000">- Fix FIPS bug (bsc #1180801)
  [+ 0008-gcrypt-Use-a-dummy-buffer-to-initialize-static-alloc.patch ]</changelog>
  <changelog author="mbuil@suse.com" date="1617019200">- Keep using ipsec as the main binary. Therefore, make strongswan.service point to it instead of swanctl</changelog>
  <changelog author="mbuil@suse.com" date="1617019201">- Information added in README about the rcstrongswan-starter</changelog>
  <changelog author="mbuil@suse.com" date="1617624000">- Add config to run ipsec on namespaces (bsc #1183670)</changelog>
  <changelog author="mt@suse.com" date="1619006400">- Add support for AES CCM aead algorithms to openssl plugin (cc/fips,bsc#1185363)
  [+ 0009-strongswan-openssl-aead-add-ccm-support.patch]</changelog>
  <changelog author="mt@suse.com" date="1620388800">- Replace AEAD AES CCM patch with upstream variant (cc/fips,bsc#1185363)
  [* 0009-strongswan-openssl-aead-add-ccm-support.patch]</changelog>
  <changelog author="hare@suse.de" date="1627646400">- Add auth_els plugin to support Marvell FC-SP encryption (jsc#SLE-20151)
  [* strongswan-marvell-auth-els.patch]</changelog>
  <changelog author="abergmann@suse.com" date="1634040000">- Fix integer overflow in gmp plugin (bsc#1191367, CVE-2021-41990)
  [* strongswan-5.6.1-5.9.3_gmp-rsa-ssa-salt-len.patch]
- Fix integer overflow when replacing certificates in cache (bsc#1191435, CVE-2021-41991)
  [* strongswan-4.4.1-5.9.3_cert-cache-random.patch]</changelog>
  <changelog author="meissner@suse.com" date="1643025600">- strongswan-5.5.0-5.9.4_eap_success-CVE-2021-45079.patch:
  Fixed authentication bypass in EAP authentication (CVE-2021-45079
  bsc#1194471)</changelog>
</package>
<package pkgid="51fc1fc6ef4200acb5bb7b920ceb5eeeda7d2fea13c4e53d56849bef52860812" name="strongswan-hmac" arch="s390x">
  <version epoch="0" ver="5.8.2" rel="11.24.1"/>
  <changelog author="ndas@suse.de" date="1501502400">- Updated to strongSwan 5.3.5(bsc#1050691) providing the following changes:
  * Fixed a DoS vulnerability in the gmp plugin that was caused by insufficient input
    validation when verifying RSA signatures. More specifically, mpz_powm_sec() has two
    requirements regarding the passed exponent and modulus that the plugin did not
    enforce, if these are not met the calculation will result in a floating point exception
    that crashes the whole process.
    This vulnerability has been registered as CVE-2017-9022.
    Please refer to our blog for details.
  * Fixed a DoS vulnerability in the x509 plugin that was caused because the ASN.1 parser
    didn't handle ASN.1 CHOICE types properly, which could result in an infinite loop when
    parsing X.509 extensions that use such types.
    This vulnerability has been registered as CVE-2017-9023.
    Please refer to our blog for details.
  * The behavior during IKEv2 CHILD_SA rekeying has been changed in order to avoid
    traffic loss. When responding to a CREATE_CHILD_SA request to rekey a CHILD_SA
    the responder already has everything available to install and use the new CHILD_SA.
    However, this could lead to lost traffic as the initiator won't be able to process
    inbound packets until it processed the CREATE_CHILD_SA response and updated the
    inbound SA. To avoid this the responder now only installs the new inbound SA and
    delays installing the outbound SA until it receives the DELETE for the replaced CHILD_SA.
  * The messages transporting these DELETEs could reach the peer before packets sent
    with the deleted outbound SAs reach it. To reduce the chance of traffic loss due
    to this the inbound SA of the replaced CHILD_SA is not removed for a configurable
    amount of seconds (charon.delete_rekeyed_delay) after the DELETE has been processed.
  * The code base has been ported to Apple's ARM64 iOS platform, which required several
    changes regarding the use of variadic functions. This was necessary because the calling
    conventions for variadic and regular functions are different there.
    This means that assigning a non-variadic function to a variadic function pointer, as we
    did with our enumerator_t::enumerate() implementations and several callbacks, will
    result in crashes as the called function accesses the arguments differently than the
    caller provided them. To avoid this issue the enumerator_t interface has been changed
    and the signature of the callback functions for enumerator_create_filter() and two
    methods on linked_list_t have been changed. Refer to the developer notes below
    for details.
  * Adds support for fuzzing the certificate parser provided by the default plugins
    (x509, pem, gmp etc.) on Google's OSS-Fuzz infrastructure (or generally with
    libFuzzer). Several issues found while fuzzing these plugins were fixed.
  * Two new options have been added to charon's retransmission settings:
    retransmit_limit and retransmit_jitter. The former adds an upper limit to the
    calculated retransmission timeout, the latter randomly reduces it.
    Refer to Retransmission for details.
  * A bug in swanctl's --load-creds command was fixed that caused unencrypted
    private keys to get unloaded if the command was called multiple times.
    The load-key VICI command now returns the key ID of the loaded key on success.
  * The credential manager now enumerates local credential sets before global ones.
    This means certificates supplied by the peer will now be preferred over certificates
    with the same identity that may be locally stored (e.g. in the certificate cache).
  * Adds support for hardware offload of IPsec SAs as introduced by Linux 4.11 for
    specific hardware that supports this.
  * The pki tool loads the curve25519 plugin by default.
    [- 0006-Make-sure-the-modulus-is-odd-and-the-exponent-not-zero.patch,
  - 0007-asn1-parser-Fix-CHOICE-parsing.patch]
- libhydra is removed as all kernel plugins moved to libcharon</changelog>
  <changelog author="ndas@suse.de" date="1504612800">- fix "uintptr_t? undeclared" compilation error.
  [+0006-fix-compilation-error-by-adding-stdint.h.patch]</changelog>
  <changelog author="ndas@suse.de" date="1504612801">- Updated to strongSwan 5.6.0 providing the following changes:
  * Fixed a DoS vulnerability in the gmp plugin that was caused by insufficient input validation
    when verifying RSA signatures, which requires decryption with the operation m^e mod n,
    where m is the signature, and e and n are the exponent and modulus of the public key.
    The value m is an integer between 0 and n-1, however, the gmp plugin did not verify this.
    So if m equals n the calculation results in 0, in which case mpz_export() returns NULL.
    This result wasn't handled properly causing a null-pointer dereference.
    This vulnerability has been registered as CVE-2017-11185. (bsc#1051222)
  * New SWIMA IMC/IMV pair implements the draft-ietf-sacm-nea-swima-patnc Internet
    Draft and has been demonstrated at the IETF 99 Prague Hackathon.
  * The IMV database template has been adapted to achieve full compliance with the
    ISO 19770-2:2015 SWID tag standard.
  * The pt-tls-client can attach and use TPM 2.0 protected private keys via the --keyid parameter.
  * By default the /etc/swanctl/conf.d directory is created and *.conf files in it are included in the default
    swanctl.conf file.
  * The curl plugin now follows HTTP redirects (configurable via strongswan.conf).
  * The CHILD_SA rekeying was fixed in charon-tkm and the behavior is refined a bit more since 5.5.3
  * libtpmtss supports Intel's TSS2 Architecture Broker and Resource Manager interface (tcti-tabrmd).
  * more on https://wiki.strongswan.org/versions/66</changelog>
  <changelog author="mmnelemane@suse.com" date="1521028800">- Removed unused requires and macro calls(bsc#1083261)</changelog>
  <changelog author="mmnelemane@suse.com" date="1573646400">- Added patch to fix vulnerability: CVE-2018-16151,CVE-2018-16152 (bsc#1107874)
  - Insufficient input validation in gmp plugin
  [+ 0007-strongswan-5.3.1-5.6.0_gmp-pkcs1-verify.patch]</changelog>
  <changelog author="mmnelemane@suse.com" date="1573646401">- Added patch to fix vulnerability: CVE-2018-5388 (bsc#1094462)
  - Buffer Underflow in stroke_socket.c
  [+ 0008-strongswan-5.1.2-5.6.2_stroke_msg_len.patch]</changelog>
  <changelog author="mmnelemane@suse.com" date="1573646402">- Added patch to fix vulnerability: CVE-2018-10811 (bsc#1093536)
  - denial-of-service vulnerability
  [+ 0009-strongswan-5.5.0-5.6.2_skeyseed_init.patch]</changelog>
  <changelog author="mmnelemane@suse.com" date="1573732800">- Added patch to fix vulnerability: CVE-2018-17540 (bsc#1109845)
  [+ 0010-strongswan-4.4.0-5.7.0_gmp-pkcs1-overflow.patch]</changelog>
  <changelog author="mmnelemane@suse.com" date="1580212800">- Updated to version 5.8.2 (jsc#SLE-11370)
  - Dropped following patches due to irrelevance in the updated version:
    [- strongswan_modprobe_syslog.patch ]
    [- strongswan_fipsfilter.patch ]
    [- 0006-fix-compilation-error-by-adding-stdint.h.patch ]
    [- 0007-strongswan-5.3.1-5.6.0_gmp-pkcs1-verify.patch ]
    [- 0008-strongswan-5.1.2-5.6.2_stroke_msg_len.patch ]
    [- 0009-strongswan-5.5.0-5.6.2_skeyseed_init.patch ]
    [- 0010-strongswan-4.4.0-5.7.0_gmp-pkcs1-overflow.patch ]
  - Version 5.8.2
  ===============
  * Identity-based CA constraints, which enforce that the certificate chain of the remote
    peer contains a CA certificate with a specific identity, are supported via
    vici/swanctl.conf. This is similar to the existing CA constraints but doesn't require
    that the CA certificate is locally installed, for instance, intermediate CA certificates
    received from the peers. Wildcard identity matching (e.g. ..., OU=Research, CN=*) could
    also be used for the latter but requires trust in the intermediate CAs to only issue
    certificates with legitimate subject DNs (e.g. the "Sales" CA must not issue certificates
    with OU=Research). With the new constraint that's not necessary as long as a path length
    basic constraint (--pathlen for pki --issue) prevents intermediate CAs from issuing further
    intermediate CAs.
  * Intermediate CA certificates may now be sent in hash-and-URL encoding by configuring a
    base URL for the parent CA (#3234, swanctl/rw-hash-and-url-multi-level).
  * Implemented NIST SP-800-90A Deterministic Random Bit Generator (DRBG) based on AES-CTR
    and SHA2-HMAC modes. Currently used by the gmp and ntru plugins.
  * Random nonces sent in an OCSP requests are now expected in the corresponding OCSP responses.
  * The kernel-netlink plugin now ignores deprecated IPv6 addresses for MOBIKE. Whether temporary
    or permanent IPv6 addresses are included now depends on the charon.prefer_temporary_addrs
    setting (#3192).
  * Extended Sequence Numbers (ESN) are configured via PF_KEY if supported by the kernel.
  * The PF_KEY socket's receive buffer in the kernel-pfkey plugin is now cleared before sending
    requests, as many of the messages sent by the kernel are sent as broadcasts to all PF_KEY
    sockets. This is an issue if an external tool is used to manage SAs/policies unrelated to
    IPsec (#3225).
  * The vici plugin now uses unique section names for CHILD_SAs in child-updown events (7c74ce9190).
  * For individually deleted CHILD_SAs (in particular for IKEv1) the vici child-updown event
    now includes more information about the CHILD_SAs such as traffic statistics (#3198).
  * Custom loggers are correctly re-registered if log levels are changed via stroke loglevel (#3182).
  * Avoid lockups during startup on low entropy systems when using OpenSSL 1.1.1 (095a2c2eac).
  * Instead of failing later when setting a key, creating HMACs via openssl plugin now fails
    instantly if the underlying hash algorithm isn't supported (e.g. MD5 in FIPS-mode) so fallbacks
    to other plugins work properly (#3284).
  * Exponents of RSA keys read from TPM 2.0 via SAPI are correctly converted (8ee1242f1438).
  * Routing table IDs &gt; 255 are supported for custom routes on Linux.
  * To avoid races, the check for hardware offloading support in the kernel-netlink plugin is
    performed during initialization of the plugin (a605452c03).
  * The D-Bus config file for charon-nm is now installed in $(datadir)/dbus-1/system.d instead of
    $(sysconfdir)/dbus-1/system.d, which is intended for sysadmin overrides.
    INVALID_MAJOR_VERSION notifies are now correctly sent in messages of the same exchange type
    and with the same message ID as the request.
  * IKEv2 SAs are now immediately destroyed when sending or receiving INVALID_SYNTAX notifies
    in authenticated messages.
  * For developers working from the repository the configure script now aborts if GNU gperf is
    not found.
  - Version 5.8.1
  ===============
  * RDNs in DNs of X.509 certificates can now optionally be matched less strict. The global
    strongswan.conf option charon.rdn_matching takes two alternative values that cause the
    matching algorithm to either ignore the order of matched RDNs (reordered) or additionally
    (relaxed) accept DNs that contain more RDNs than configured (unmatched RDNs are treated
    like wildcard matches).
  * The updown plugin now passes the same interface to the script that is also used for the
    automatically installed routes, that is, the interface over which the peer is reached
    instead of the interface on which the local address is found (#3095).
  * TPM 2.0 contexts are now protected by a mutex to prevent issues if multiple IKE_SAs use
    the same private key concurrently (4b25885025).
  * Do a rekey check after the third QM message was received (#3060).
  * If available, explicit_bzero() is now used as memwipe() instead of our own implementation.
  * An .editorconfig file has been added, mainly so Github shows files with proper indentation
    (68346b6962).
  * The internal certificate of the load-tester plugin has been modified so it can again be
    used as end-entity cert with 5.6.3 and later (#3139).
  * The maximum data length of received COOKIE notifies (64 bytes) is now enforced (#3160).
  - Version 5.8.0
  ===============
  * The systemd service units have been renamed. The modern unit, which was called
    strongswan-swanctl, is now called strongswan (the previous name is configured as alias in
    the unit, for which a symlink is created when the unit is enabled). The legacy unit is now
    called strongswan-starter.
  * Support for XFRM interfaces (available since Linux 4.19) has been added, which are intended
    to replace VTI devices (they are similar but offer several advantages, for instance, they
    are not bound to an address or address family).
  * IPsec SAs and policies are associated with such interfaces via interface IDs that can be
    configured in swanctl.conf (dynamic IDs may optionally be allocated for each SA and even
    direction). It's possible to use separate interfaces for in- and outbound traffic (or
    only use an interface in one direction and regular policies in the other).
  * Interfaces may be created dynamically via updown/vici scripts, or statically before or after
    establishing the SAs. Routes must be added manually as needed (the daemon will not install
    any routes for outbound policies with an interface ID).
  * When moving XFRM interfaces to other network namespaces they retain access to the SAs and
    policies installed in the original namespace, which allows providing IPsec tunnels for
    processes in other network namespaces without giving them access to the IPsec keys or
    IKE credentials.
    More information can be found on the page about route-based VPNs.
  * Initiation of childless IKE_SAs is supported (RFC 6023). If enabled and supported by the
    responder, no CHILD_SA is established during IKE_AUTH. Instead, all CHILD_SAs are created
    with CREATE_CHILD_SA exchanges. This allows using a separate DH exchange even for the
    first CHILD_SA, which is otherwise created during IKE_AUTH with keys derived from the
    IKE_SA's key material.
  * The swanctl --initiate command may be used to initiate only the IKE_SA via --ike
    option if --child is omitted and the peer supports this extension.
  * The NetworkManager backend and plugin support IPv6.
  * The new wolfssl plugin is a wrapper around the wolfSSL crypto library. Thanks to Sean
    Parkinson of wolfSSL Inc. for the initial patch.
  * IKE SPIs may optionally be labeled via the charon.spi_mask|label options in
    strongswan.conf. This feature was extracted from charon-tkm, however, now applies the
    mask/label in network order.
  * The openssl plugin supports ChaCha20-Poly1305 when built with OpenSSL 1.1.0.
  * The PB-TNC finite state machine according to section 3.2 of RFC 5793 was not correctly
    implemented when sending either a CRETRY or SRETRY batch. These batches can only be sent
    in the "Decided" state and a CRETRY batch can immediately carry all messages usually
    transported by a CDATA batch. It is currently not possible to send a SRETRY batch since
    full-duplex mode for PT-TLS transport is not supported.
  * Instead of marking IPv6 virtual IPs as deprecated, the kernel-netlink plugin now uses
    address labels to avoid that such addresses are used for non-VPN traffic (00a953d090).
  * The agent plugin now creates sockets to the ssh/gpg-agent dynamically and does not keep
    them open, which otherwise might prevent the agent from getting terminated.
  * To avoid broadcast loops the forecast plugin now only reinjects packets that are marked
    or received from the configured interface.
  * UTF-8 encoded passwords are supported via EAP-MSCHAPv2, which internally uses an UTF-16LE
    encoding to calculate the NT hash (#3014).
  * Properly delete temporary drop policies (used when updating IP addresses of SAs) if manual
    priorities are used, which was broken since 5.6.2 (8e31d65730).
  * Avoid overwriting start_action when parsing the inactivity timeout in the vici plugin (#2954).
  * Fixed the automatic termination of reloaded vici connections with start_action=start,
    which was broken since 5.6.3 (71b22c250f).
  * The lookup for shared secrets for IKEv1 SAs via sql plugin should now work better
    (6ec9f68f32).
  * Fixed a race condition in the trap manager between installation and removal of a policy
    (69cbe2ca3f).
  * Compilation of the kernel-netlink plugin has been fixed on old kernels (&lt; 2.6.39), which
    was caused by the HW offload changes (c7f579fa17).
  * The IPsec stack detection and module loading in starter has been removed (it wasn't
    enforced anyway and loading modules doesn't seem necessary, also KLIPS hasn't been
    supported for a long time and PF_KEY will eventually be removed from the Linux kernel,
    ba817d2917).
  * Several IKEv2 protocol details are now handled more strictly: Unrequested virtual IPs are
    ignored, CFG_REPLY payloads are ignored if no CFG_REQUEST payloads were sent, a USE
    TRANSPORT_MODE notify received from the responder is checked against the local configuration.
  * The keys and certificates used by the scenarios in the testing environment are now generated
    dynamically. Running the testing/scripts/build-certs script after creating the base and root
    images uses the pki utility installed in the latter to create the keys and certificates for
    all the CAs and in some cases for individual scenarios. These credentials are stored in the
    source tree, not the image, so this has to be called only once even if the images are later
    rebuilt. The script automatically (re-)rebuilds the guest images as that generates fresh
    CRLs and signs the DNS zones. The only keys/certificates currently not generated are the
    very large ones used by the ikev2/rw-eap-tls-fragments scenario.
  - Version 5.7.2
  ===============
  * For RSA with PSS padding, the TPM 2.0 specification mandates the maximum salt length
    (as defined by the length of the key and hash). However, if the TPM is FIPS-168-4 compliant,
    the salt length equals the hash length. This is assumed for FIPS-140-2 compliant TPMs, but
    if that's not the case, it might be necessary to manually enable charon.plugins.tpm.fips_186_4
    if the TPM doesn't use the maximum salt length.
  * Directories for credentials loaded by swanctl are now accessed relative to the loaded
    swanctl.conf file, in particular, when loading it from a custom location via --file argument.
  * The base directory, which is used if no custom location for swanctl.conf is specified, is now
    also configurable at runtime via SWANCTL_DIR environment variable.
  * If RADIUS Accounting is enabled, the eap-radius plugin will add the session ID (Acct-Session-Id)
    to Access-Request messages, which e.g. simplifies associating database entries for IP leases and
    accounting with sessions (the session ID does not change when IKE_SAs are rekeyed, #2853).
  * All IP addresses assigned by a RADIUS server are included in Accounting-Stop messages even if
    the client did not claim them, allowing to release them early in case of connection errors (#2856).
  * Selectors installed on transport mode SAs by the kernel-netlink plugin are now updated if an
    IP address changes (e.g. via MOBIKE) and it was part of the selectors.
  * No deletes are sent anymore when a rekeyed CHILD_SA expires (#2815).
  * The bypass-lan plugin now tracks interfaces to handle subnets that move from one interface
    to another and properly update associated routes (#2820).
  * Only valid and expected inbound IKEv2 messages are used to update the timestamp of the
    last received message (previously, retransmits also triggered an update).
  * IKEv2 requests from responders are now ignored until the IKE_SA is fully established (e.g. if a
    DPD request from the peer arrives before the IKE_AUTH response does, 46bea1add9).
    Delayed IKE_SA_INIT responses with COOKIE notifies we already recevied are ignored, they caused
    another reset of the IKE_SA previously (#2837).
  * Active and queued Quick Mode tasks are now adopted if the peer reauthenticates an IKEv1 SA
    while creating lots of CHILD_SAs.
  * Newer versions of the FreeBSD kernel add an SADB_X_EXT_SA2 extension to SADB_ACQUIRE
    messages, which allows the kernel-pfkey plugin to determine the reqid of the policy even if it
    wasn't installed by the daemon previously (e.g. when using FreeBSD's if_ipsec(4) VTIs, which
    install policies themselves, 872b9b3e8d).
  * Added support for RSA signatures with SHA-256 and SHA-512 to the agent plugin. For older
    versions of ssh/gpg-agent that only support SHA-1, IKEv2 signature authentication has to be
    disabled via charon.signature_authentication.
  * The sshkey and agent plugins support Ed25519/Ed448 SSH keys and signatures.
  * The openssl plugin supports X25519/X448 Diffie-Hellman and Ed25519/Ed448 keys and
    signatures when built against OpenSSL 1.1.1.
  * Support for Ed25519, ChaCha20/Poly1305, SHA-3 and AES-CCM were added to the botan plugin.
  * The mysql plugin now properly handles database connections with transactions
    under heavy load (#2779).
  * IP addresses in ha pools are now distributed evenly among all segments (#2828).
  * Private key implementations may optionally provide a list of supported signature schemes,
    which, as described above, is used by the tpm plugin because for each key on a TPM 2.0 the
    hash algorithm and for RSA also the padding scheme is predefined.
  * The testing environment is now based on Debian 9 (stretch) by default. This required
    some changes, in particular, updating to FreeRADIUS 3.x (which forced us to abandon the
    TNC@FHH patches and scenarios, 2fbe44bef3) and removing FIPS-enabled versions of
    OpenSSL (the FIPS module only supports OpenSSL 1.0.2).
  * Most test scenarios were migrated to swanctl.
  - Version 5.7.1
  ===============
  * Fixes a vulnerability in the gmp plugin triggered by crafted certificates with RSA keys with
    very small moduli. When verifying signatures with such keys, the code patched with the fix
    for CVE-2018-16151/2 caused an integer underflow and subsequent heap buffer overflow
    that results in a crash of the daemon.
  * The vulnerability has been registered as CVE-2018-17540.
  - Version 5.7.0
  ===============
  * Fixes a potential authorization bypass vulnerability in the gmp plugin that was caused by a
    too lenient verification of PKCS#1 v1.5 signatures. Several flaws could be exploited by a
    Bleichenbacher-style attack to forge signatures for low-exponent keys (i.e. with e=3).
  * CVE-2018-16151 has been assigned to the problem of accepting random bytes after the OID
    of the hash function in such signatures, and CVE-2018-16152 has been assigned to the issue
    of not verifying that the parameters in the ASN.1 algorithmIdentitifer structure is empty.
    Other flaws that don't lead to a vulnerability directly (e.g. not checking for at least
    8 bytes of padding) have no separate CVE assigned.
  * Dots are not allowed anymore in section names in swanctl.conf and strongswan.conf.
    This mainly affects the configuration of file loggers. If the path for such a log file
    contains dots it now has to be configured in the new path setting within the arbitrarily
    renamed subsection in the filelog section.
  * Sections in swanctl.conf and strongswan.conf may now reference other sections. All settings
    and subsections from such a section are inherited. This allows to simplify configs as
    redundant information has only to be specified once and may then be included in other
    sections (see strongswan.conf for an example).
  * The originally selected IKE config (based on the IPs and IKE version) can now change
    if no matching algorithm proposal is found. This way the order of the configs doesn't
    matter that much anymore and it's easily possible to specify separate configs for
    clients that require weaker algorithms (instead of having to also add them in other
    configs that might be selected).
  * Support for Postquantum Preshared Keys for IKEv2 (draft-ietf-ipsecme-qr-ikev2) has been added.
    For an example refer to the swanctl/rw-cert-ppk scenario (or with EAP, or PSK authentication).
  * The new botan plugin is a wrapper around the Botan C++ crypto library.
    It requires a fairly recent build from Botan's master branch (or the upcoming 2.8.0 release).
    Thanks to René Korthaus and his team from Rohde &amp; Schwarz Cybersecurity for the initial
    patch and to Jack Lloyd for quickly adding missing functions to Botan's FFI (C89) interface.
  * Implementation of RFC 8412 "Software Inventory Message and Attributes (SWIMA) for PA-TNC".
  * SWIMA subscription option sets CLOSE_WRITE trigger on apt history.log file resulting in
    a ClientRetry PB-TNC batch to initialize a new measurement cycle. The new imv/imc-swima
    plugins replace the previous imv/imc-swid plugins, which were removed.
  * Added support for fuzzing the PA-TNC (RFC 5792) and PB-TNC (RFC 5793) NEA protocols
    on Google's OSS-Fuzz infrastructure.
  * Support for version 2 of Intel's TPM2-TSS TGC Software Stack. The presence of the
    in-kernel /dev/tpmrm0 resource manager is automatically detected.
  * The pki tool accepts a xmppAddr otherName as a subjectAlternativeName using the
    syntax --san xmppaddr:&lt;jid&gt;.
  * swanctl.conf supports the configuration of marks the in- and/or outbound SA should apply
    to packets after processing on Linux. Configuring such a mark for outbound SAs requires
    at least a 4.14 kernel. The ability to set a mask and configuring a mark/mask for
    inbound SAs will be added with the upcoming 4.19 kernel.
  * New options in swanctl.conf allow configuring how/whether DF, ECN and DS fields in the
    IP headers are copied during IPsec processing. Controlling this is currently only possible
    on Linux.
  * The handling of sequence numbers in IKEv1 DPDs has been improved (#2714).
  * To avoid conflicts, the dhcp plugin now only uses the DHCP server port if explicitly
    configured.
  - Version 5.6.3
  ===============
  * Fixed a DoS vulnerability in the IKEv2 key derivation if the openssl plugin is used in FIPS
    mode and HMAC-MD5 is negotiated as PRF.
    This vulnerability has been registered as CVE-2018-10811.
  * Fixed a vulnerability in the stroke plugin, which did not check the received length before
    reading a message from the socket. Unless a group is configured, root privileges are
    required to access that socket, so in the default configuration this shouldn't be an issue.
    This vulnerability has been registered as CVE-2018-5388.
  * CRLs that are not yet valid are now ignored to avoid problems in scenarios where expired
    certificates are removed from new CRLs and the clock on the host doing the revocation
    check is trailing behind that of the host issuing CRLs. Not doing this could result in
    accepting a revoked and expired certificate, if it's still valid according to the
    trailing clock but not contained anymore in not yet valid CRLs.
  * The issuer of fetched CRLs is now compared to the issuer of the checked certificate (#2608).
  * CRL validation results other than revocation (e.g. a skipped check because the CRL couldn't
    be fetched) are now stored also for intermediate CA certificates and not only for end-entity
    certificates, so a strict CRL policy can be enforced in such cases.
  * In compliance with RFC 4945, section 5.1.3.2, certificates used for IKE must now either
    not contain a keyUsage extension (like the ones generated by pki), or have at least one of the
    digitalSignature or nonRepudiation bits set.
  * New options for vici/swanctl allow forcing the local termination of an IKE_SA. This might be
    useful in situations where it's known the other end is not reachable anymore, or that it
    already removed the IKE_SA, so retransmitting a DELETE and waiting for a response would
    be pointless.
  * Waiting only a certain amount of time for a response (i.e. shorter than all retransmits
    would be) before destroying the IKE_SA is also possible by additionally specifying a
    timeout in the forced termination request.
  * When removing routes, the kernel-netlink plugin now checks if it tracks other routes for
    the same destination and replaces the installed route instead of just removing it. Same
    during installation, where existing routes previously weren't replaced. This should allow
    using traps with virtual IPs on Linux (#2162).
  * The dhcp plugin now only sends the client identifier DHCP option if the identity_lease
    setting is enabled (7b660944b6). It can also send identities of up to 255 bytes length,
    instead of the previous 64 bytes (30e886fe3b, 0e5b94d038). If a server address is
    configured, DHCP requests are now sent from port 67 instead of 68 to avoid ICMP port
    unreachables (becf027cd9).
  * The handling of faulty INVALID_KE_PAYLOAD notifies (e.g. one containing a DH group
    that wasn't proposed) during CREATE_CHILD_SA exchanges has been improved (#2536).
  * Roam events are now completely ignored for IKEv1 SAs (there is no MOBIKE to handle such
    changes properly).
  * ChaCha20/Poly1305 is now correctly proposed without key length (#2614). For compatibility with
    older releases the chacha20poly1305compat keyword may be included in proposals to also propose
    the algorithm with a key length (c58434aeff).
  * Configuration of hardware offload of IPsec SAs is now more flexible and allows a new
    setting (auto), which automatically uses it if the kernel and device both support it. If hw
    offload is set to yes and offloading is not supported, the CHILD_SA installation now fails.
  * The kernel-pfkey plugin optionally installs routes via internal interface (one with an IP
    in the local traffic selector). On FreeBSD, enabling this selects the correct source IP
    when sending packets from the gateway itself (e811659323).
  * SHA-2 based PRFs are supported in PKCS#8 files as generated by OpenSSL 1.1 (#2574).
  * The pki --verify tool may load CA certificates and CRLs from directories.
  * The IKE daemon now also switches to port 4500 if the remote port is not 500 (e.g. because the
    remote maps the response to a different port, as might happen on Azure), as long as the local
    port is 500 (85bfab621d).
  * Fixed an issue with DNS servers passed to NetworkManager in charon-nm (ee8c25516a).
  * Logged traffic selectors now always contain the protocol if either protocol or port are set
    (a36d8097ed).
  * Only the inbound SA/policy will be updated as reaction to IP address changes for rekeyed
    CHILD_SAs that are kept around.
  * The parser for strongswan.conf/swanctl.conf now accepts = characters in values without
    having to put the value in quotes (e.g. for Base64 encoded shared secrets).
    Notes for developers:
  * trap_manager_t: Trap policies are now unistalled by peer/child name and not the reqid.
  * No reqid is returned anymore when installing trap policies.
  * child_sa_t: A new state (CHILD_DELETED) is used for CHILD_SAs that have been deleted but
    not yet destroyed (after a rekeying CHILD_SAs are kept around for a while to process
    delayed packets).
    This way child_updown events are not triggered anymore for such SAs when an IKE_SA that
    has such CHILD_SAs assigned is deleted.
  - Version 5.6.2
  ===============
  * Fixed a DoS vulnerability in the parser for PKCS#1 RSASSA-PSS signatures that was caused
    by insufficient input validation. One of the configurable parameters in algorithm identifier
    structures for RSASSA-PSS signatures is the mask generation function (MGF). Only MGF1 is
    currently specified for this purpose. However, this in turn takes itself a parameter that
    specifies the underlying hash function. strongSwan's parser did not correctly handle the
    case of this parameter being absent, causing an undefined data read.
    This vulnerability has been registered as CVE-2018-6459.
  * When rekeying IKEv2 IKE_SAs the previously negotiated DH group will be reused, instead of
    using the first configured group, which avoids an additional exchange if the peer previously
    selected a different DH group via INVALID_KE_PAYLOAD notify. The same is also done when
    rekeying CHILD_SAs except for the first rekeying of the CHILD_SA that was created with the
    IKE_SA, where no DH group was negotiated yet.
    Also, the selected DH group is moved to the front in all sent proposals that contain it
    and all proposals that don't are moved to the back in order to convey the preference for
    this group to the peer.
  * Handling of MOBIKE task queuing has been improved. In particular, the response to an
    address update (with NAT-D payloads) is not ignored anymore if only an address list update
    or DPD is queued as that could prevent updating the UDP encapsulation in the kernel.
  * On Linux, roam events may optionally be triggered by changes to the routing rules, which
    can be useful if routing rules (instead of e.g. route metrics) are used to switch from one
    to another interface (i.e. from one to another routing table). Since routing rules are
    currently not evaluated when doing route lookups this is only useful if the kernel-based
    route lookup is used (4664992f7d).
  * The fallback drop policies installed to avoid traffic leaks when replacing addresses in
    installed policies are now replaced by temporary drop policies, which also prevent
    acquires because we currently delete and reinstall IPsec SAs to update their addresses
    (35ef1b032d).
  * Access X.509 certificates held in non-volatile storage of a TPM 2.0 referenced via the
    NV index.
    Adding the --keyid parameter to pki --print allows to print private keys or certificates
    stored in a smartcard or a TPM 2.0.
  * Fixed proposal selection if a peer incorrectly sends DH groups in the ESP proposal during
    IKE_AUTH and also if a DH group is configured in the local ESP proposal and charon.prefer
    configured_proposals is disabled (d058fd3c32).
  * The lookup for PSK secrets for IKEv1 has been improved for certain scenarios (see #2497
    for details).
  * MSKs received via RADIUS are now padded to 64 bytes to avoid compatibility issues with
    EAP-MSCHAPv2 and PRFs that have a block size &lt; 64 bytes (e.g. AES-XCBC-PRF-128, see
    73cbce6013).
  * The tpm_extendpcr command line tool extends a digest into a TPM PCR.
  * Ported the NetworkManager backend from the deprecated libnm-glib to libnm.
  * The save-keys debugging/development plugin saves IKE and/or ESP keys to files compatible
    with Wireshark.
  - Version 5.6.1
  ===============
  * Several algorithms were removed from the default ESP/AH and IKE proposals in compliance with
    RFC 8221 and RFC 8247, respectively. Removed from the default ESP/AH proposal were the
    3DES and Blowfish encryption algorithms and the HMAC-MD5 integrity algorithm. From the IKE
    default proposal the HMAC-MD5 integrity algorithm and the MODP-1024 Diffie-Hellman group
    were removed (the latter is significant for Windows clients in their default configuration).
    These algorithms may still be used in custom proposals.
  * Support for RSASSA-PSS signatures has been added. For compatibility with previous
    releases they are currently not used automatically, by default, to change that charon.rsa_pss
    may be enabled. To explicitly use or require such signatures during IKEv2 signature
    authentication (RFC 7427) ike:rsa/pss... authentication constraints may be used for specific
    connections (regardless of whether the strongswan.conf option above is enabled). Only the
    hash algorithm can be specified in such constraints, the MGF1 will be based on that hash
    and the salt length will equal the hash length (when verifying the salt length is not
    enforced).
    To enforce such signatures during PKI verification use rsa/pss... authentication constraints.
  * All pki commands that create certificates/CRLs can be made to sign with RSASSA-PSS instead
    of the classing PKCS#1 scheme with the --rsa-padding pss option. As with signatures during
    authentication, only the hash algorithm is configurable (via --digest option), the MGF1 will
    be based on that and the salt length will equal the hash length.
  * These signatures are supported by all RSA backends except pkcs11 (i.e. gmp, gcrypt, openssl).
    The gmp plugin requires the mgf1 plugin.
    Note that RSASSA-PSS algorithm identifiers and parameters in keys (public keys in
    certificates or private keys in PKCS#8 files) are currently not used as constraints.
  * The sec-updater tool checks for security updates in dpkg-based repositories
    (e.g. Debian/Ubuntu) and sets the security flags in the IMV policy database accordingly.
    Additionally for each new package version a SWID tag for the given OS and HW architecture
    is created and stored in the database.
  * Using the sec-updater.sh script template the lookup can be automated (e.g. via an hourly
    cron job).
  * When restarting an IKEv2 negotiation after receiving an INVALID_KE_PAYLOAD notify (or due
    to other reasons like too many retransmits) a new initiator SPI is allocated. This
    prevents issues caused by retransmits for IKE_SA_INIT messages.
  * Because the initiator SPI was previously reused when restarting the connection delayed
    responses for previous connection attempts were processed and might have caused fatal
    errors due to a failed DH negotiation or because of the internal retry counter in the
    ike-init task. For instance, if we proposed a DH group the responder rejected we
    might have later received delayed responses that either contained INVALID_KE_PAYLOAD
    notifies with the DH group we already switched to, or, if we retransmitted an
    IKE_SA_INIT with the requested group but then had to restart again, a KE payload with
    a group different from the one we proposed.
  * The introduction of file versions in the IMV database scheme broke file reference hash
    measurements. This has been fixed by creating generic product versions having an empty
    package name.
  * A new timeout option for the systime-fix plugin stops periodic system time checks after
    a while and enforces a certificate verification, closing or reauthenticating all SAs
    with invalid certificates.
  * The IKE event counters, previously only available via ipsec listcounters command, may
    now also be queried and reset via vici and the new swanctl --counters command. They
    are collected and provided by the optional counters plugin (enabled by default for
    backwards compatibility if the stroke plugin is built).
  * Class attributes received in RADIUS Access-Accept messages may optionally be added to
    RADIUS accounting messages (655924074b).
  * Basic support for systemd sockets has been added, which may be used for privilege separation
    (59db98fb94).
  * Inbound marks may optionally be installed in the SA again (was removed with 5.5.2) by
    enabling the mark_in_sa option in swanctl.conf.
  * The timeout of leases in pools configured via pool utility may be configured in other
    units than hours.
    INITIAL_CONTACT notifies are now only omitted if never is configured as uniqueness policy.
  * Outbound FWD policies for shunts are not installed anymore, by default (as is the case
    for other policies since 5.5.1).
  * Don't consider a DH group mismatch during CHILD_SA rekeying as failure as responder
    (e7276f78aa).
  * Handling of fragmented IPv4 and IPv6 packets in libipsec has been improved (e138003de9).
  * Trigger expire events for the correct IPsec SA in libipsec (6e861947a0).
  * A crash in CRL verification via openssl plugin using OpenSSL 1.1 has been fixed (78acaba6a1).
  * No hard-coded default proposals are passed from starter to the stroke plugin anymore (the
    IKE proposal used curve25519 since 5.5.2, which is an optional plugin).
  * A workaround for an issue with virtual IPs on macOS 10.13 (High Sierra) has been added
    (039b85dd43).
  * Handling of IKE_SA rekey collisions in charon-tkm has been fixed.
  * Instead of failing or just silently doing nothing unit tests may now warn about certain
    conditions (e.g. if a test was not executed due to external dependencies).</changelog>
  <changelog author="mmnelemane@suse.com" date="1585224000">- Fix for to resolve multiple definition of swanctl_dir (bsc #1164493)
  [+ 0006-Resolve-multiple-definition-of-swanctl_dir.patch]</changelog>
  <changelog author="mbuil@suse.com" date="1610712000">- Fix typo in README (bsc #1167880)
  [+ 0007-Fix-typo-in-README.patch ]</changelog>
  <changelog author="mbuil@suse.com" date="1611576000">- Fix FIPS bug (bsc #1180801)
  [+ 0008-gcrypt-Use-a-dummy-buffer-to-initialize-static-alloc.patch ]</changelog>
  <changelog author="mbuil@suse.com" date="1617019200">- Keep using ipsec as the main binary. Therefore, make strongswan.service point to it instead of swanctl</changelog>
  <changelog author="mbuil@suse.com" date="1617019201">- Information added in README about the rcstrongswan-starter</changelog>
  <changelog author="mbuil@suse.com" date="1617624000">- Add config to run ipsec on namespaces (bsc #1183670)</changelog>
  <changelog author="mt@suse.com" date="1619006400">- Add support for AES CCM aead algorithms to openssl plugin (cc/fips,bsc#1185363)
  [+ 0009-strongswan-openssl-aead-add-ccm-support.patch]</changelog>
  <changelog author="mt@suse.com" date="1620388800">- Replace AEAD AES CCM patch with upstream variant (cc/fips,bsc#1185363)
  [* 0009-strongswan-openssl-aead-add-ccm-support.patch]</changelog>
  <changelog author="hare@suse.de" date="1627646400">- Add auth_els plugin to support Marvell FC-SP encryption (jsc#SLE-20151)
  [* strongswan-marvell-auth-els.patch]</changelog>
  <changelog author="abergmann@suse.com" date="1634040000">- Fix integer overflow in gmp plugin (bsc#1191367, CVE-2021-41990)
  [* strongswan-5.6.1-5.9.3_gmp-rsa-ssa-salt-len.patch]
- Fix integer overflow when replacing certificates in cache (bsc#1191435, CVE-2021-41991)
  [* strongswan-4.4.1-5.9.3_cert-cache-random.patch]</changelog>
  <changelog author="meissner@suse.com" date="1643025600">- strongswan-5.5.0-5.9.4_eap_success-CVE-2021-45079.patch:
  Fixed authentication bypass in EAP authentication (CVE-2021-45079
  bsc#1194471)</changelog>
</package>
<package pkgid="e2e05b4345ea66ce39d2a7e7becec62eeb45dae1b08968e7e007865d308368bb" name="strongswan-hmac" arch="x86_64">
  <version epoch="0" ver="5.8.2" rel="11.24.1"/>
  <changelog author="ndas@suse.de" date="1501502400">- Updated to strongSwan 5.3.5(bsc#1050691) providing the following changes:
  * Fixed a DoS vulnerability in the gmp plugin that was caused by insufficient input
    validation when verifying RSA signatures. More specifically, mpz_powm_sec() has two
    requirements regarding the passed exponent and modulus that the plugin did not
    enforce, if these are not met the calculation will result in a floating point exception
    that crashes the whole process.
    This vulnerability has been registered as CVE-2017-9022.
    Please refer to our blog for details.
  * Fixed a DoS vulnerability in the x509 plugin that was caused because the ASN.1 parser
    didn't handle ASN.1 CHOICE types properly, which could result in an infinite loop when
    parsing X.509 extensions that use such types.
    This vulnerability has been registered as CVE-2017-9023.
    Please refer to our blog for details.
  * The behavior during IKEv2 CHILD_SA rekeying has been changed in order to avoid
    traffic loss. When responding to a CREATE_CHILD_SA request to rekey a CHILD_SA
    the responder already has everything available to install and use the new CHILD_SA.
    However, this could lead to lost traffic as the initiator won't be able to process
    inbound packets until it processed the CREATE_CHILD_SA response and updated the
    inbound SA. To avoid this the responder now only installs the new inbound SA and
    delays installing the outbound SA until it receives the DELETE for the replaced CHILD_SA.
  * The messages transporting these DELETEs could reach the peer before packets sent
    with the deleted outbound SAs reach it. To reduce the chance of traffic loss due
    to this the inbound SA of the replaced CHILD_SA is not removed for a configurable
    amount of seconds (charon.delete_rekeyed_delay) after the DELETE has been processed.
  * The code base has been ported to Apple's ARM64 iOS platform, which required several
    changes regarding the use of variadic functions. This was necessary because the calling
    conventions for variadic and regular functions are different there.
    This means that assigning a non-variadic function to a variadic function pointer, as we
    did with our enumerator_t::enumerate() implementations and several callbacks, will
    result in crashes as the called function accesses the arguments differently than the
    caller provided them. To avoid this issue the enumerator_t interface has been changed
    and the signature of the callback functions for enumerator_create_filter() and two
    methods on linked_list_t have been changed. Refer to the developer notes below
    for details.
  * Adds support for fuzzing the certificate parser provided by the default plugins
    (x509, pem, gmp etc.) on Google's OSS-Fuzz infrastructure (or generally with
    libFuzzer). Several issues found while fuzzing these plugins were fixed.
  * Two new options have been added to charon's retransmission settings:
    retransmit_limit and retransmit_jitter. The former adds an upper limit to the
    calculated retransmission timeout, the latter randomly reduces it.
    Refer to Retransmission for details.
  * A bug in swanctl's --load-creds command was fixed that caused unencrypted
    private keys to get unloaded if the command was called multiple times.
    The load-key VICI command now returns the key ID of the loaded key on success.
  * The credential manager now enumerates local credential sets before global ones.
    This means certificates supplied by the peer will now be preferred over certificates
    with the same identity that may be locally stored (e.g. in the certificate cache).
  * Adds support for hardware offload of IPsec SAs as introduced by Linux 4.11 for
    specific hardware that supports this.
  * The pki tool loads the curve25519 plugin by default.
    [- 0006-Make-sure-the-modulus-is-odd-and-the-exponent-not-zero.patch,
  - 0007-asn1-parser-Fix-CHOICE-parsing.patch]
- libhydra is removed as all kernel plugins moved to libcharon</changelog>
  <changelog author="ndas@suse.de" date="1504612800">- fix "uintptr_t? undeclared" compilation error.
  [+0006-fix-compilation-error-by-adding-stdint.h.patch]</changelog>
  <changelog author="ndas@suse.de" date="1504612801">- Updated to strongSwan 5.6.0 providing the following changes:
  * Fixed a DoS vulnerability in the gmp plugin that was caused by insufficient input validation
    when verifying RSA signatures, which requires decryption with the operation m^e mod n,
    where m is the signature, and e and n are the exponent and modulus of the public key.
    The value m is an integer between 0 and n-1, however, the gmp plugin did not verify this.
    So if m equals n the calculation results in 0, in which case mpz_export() returns NULL.
    This result wasn't handled properly causing a null-pointer dereference.
    This vulnerability has been registered as CVE-2017-11185. (bsc#1051222)
  * New SWIMA IMC/IMV pair implements the draft-ietf-sacm-nea-swima-patnc Internet
    Draft and has been demonstrated at the IETF 99 Prague Hackathon.
  * The IMV database template has been adapted to achieve full compliance with the
    ISO 19770-2:2015 SWID tag standard.
  * The pt-tls-client can attach and use TPM 2.0 protected private keys via the --keyid parameter.
  * By default the /etc/swanctl/conf.d directory is created and *.conf files in it are included in the default
    swanctl.conf file.
  * The curl plugin now follows HTTP redirects (configurable via strongswan.conf).
  * The CHILD_SA rekeying was fixed in charon-tkm and the behavior is refined a bit more since 5.5.3
  * libtpmtss supports Intel's TSS2 Architecture Broker and Resource Manager interface (tcti-tabrmd).
  * more on https://wiki.strongswan.org/versions/66</changelog>
  <changelog author="mmnelemane@suse.com" date="1521028800">- Removed unused requires and macro calls(bsc#1083261)</changelog>
  <changelog author="mmnelemane@suse.com" date="1573646400">- Added patch to fix vulnerability: CVE-2018-16151,CVE-2018-16152 (bsc#1107874)
  - Insufficient input validation in gmp plugin
  [+ 0007-strongswan-5.3.1-5.6.0_gmp-pkcs1-verify.patch]</changelog>
  <changelog author="mmnelemane@suse.com" date="1573646401">- Added patch to fix vulnerability: CVE-2018-5388 (bsc#1094462)
  - Buffer Underflow in stroke_socket.c
  [+ 0008-strongswan-5.1.2-5.6.2_stroke_msg_len.patch]</changelog>
  <changelog author="mmnelemane@suse.com" date="1573646402">- Added patch to fix vulnerability: CVE-2018-10811 (bsc#1093536)
  - denial-of-service vulnerability
  [+ 0009-strongswan-5.5.0-5.6.2_skeyseed_init.patch]</changelog>
  <changelog author="mmnelemane@suse.com" date="1573732800">- Added patch to fix vulnerability: CVE-2018-17540 (bsc#1109845)
  [+ 0010-strongswan-4.4.0-5.7.0_gmp-pkcs1-overflow.patch]</changelog>
  <changelog author="mmnelemane@suse.com" date="1580212800">- Updated to version 5.8.2 (jsc#SLE-11370)
  - Dropped following patches due to irrelevance in the updated version:
    [- strongswan_modprobe_syslog.patch ]
    [- strongswan_fipsfilter.patch ]
    [- 0006-fix-compilation-error-by-adding-stdint.h.patch ]
    [- 0007-strongswan-5.3.1-5.6.0_gmp-pkcs1-verify.patch ]
    [- 0008-strongswan-5.1.2-5.6.2_stroke_msg_len.patch ]
    [- 0009-strongswan-5.5.0-5.6.2_skeyseed_init.patch ]
    [- 0010-strongswan-4.4.0-5.7.0_gmp-pkcs1-overflow.patch ]
  - Version 5.8.2
  ===============
  * Identity-based CA constraints, which enforce that the certificate chain of the remote
    peer contains a CA certificate with a specific identity, are supported via
    vici/swanctl.conf. This is similar to the existing CA constraints but doesn't require
    that the CA certificate is locally installed, for instance, intermediate CA certificates
    received from the peers. Wildcard identity matching (e.g. ..., OU=Research, CN=*) could
    also be used for the latter but requires trust in the intermediate CAs to only issue
    certificates with legitimate subject DNs (e.g. the "Sales" CA must not issue certificates
    with OU=Research). With the new constraint that's not necessary as long as a path length
    basic constraint (--pathlen for pki --issue) prevents intermediate CAs from issuing further
    intermediate CAs.
  * Intermediate CA certificates may now be sent in hash-and-URL encoding by configuring a
    base URL for the parent CA (#3234, swanctl/rw-hash-and-url-multi-level).
  * Implemented NIST SP-800-90A Deterministic Random Bit Generator (DRBG) based on AES-CTR
    and SHA2-HMAC modes. Currently used by the gmp and ntru plugins.
  * Random nonces sent in an OCSP requests are now expected in the corresponding OCSP responses.
  * The kernel-netlink plugin now ignores deprecated IPv6 addresses for MOBIKE. Whether temporary
    or permanent IPv6 addresses are included now depends on the charon.prefer_temporary_addrs
    setting (#3192).
  * Extended Sequence Numbers (ESN) are configured via PF_KEY if supported by the kernel.
  * The PF_KEY socket's receive buffer in the kernel-pfkey plugin is now cleared before sending
    requests, as many of the messages sent by the kernel are sent as broadcasts to all PF_KEY
    sockets. This is an issue if an external tool is used to manage SAs/policies unrelated to
    IPsec (#3225).
  * The vici plugin now uses unique section names for CHILD_SAs in child-updown events (7c74ce9190).
  * For individually deleted CHILD_SAs (in particular for IKEv1) the vici child-updown event
    now includes more information about the CHILD_SAs such as traffic statistics (#3198).
  * Custom loggers are correctly re-registered if log levels are changed via stroke loglevel (#3182).
  * Avoid lockups during startup on low entropy systems when using OpenSSL 1.1.1 (095a2c2eac).
  * Instead of failing later when setting a key, creating HMACs via openssl plugin now fails
    instantly if the underlying hash algorithm isn't supported (e.g. MD5 in FIPS-mode) so fallbacks
    to other plugins work properly (#3284).
  * Exponents of RSA keys read from TPM 2.0 via SAPI are correctly converted (8ee1242f1438).
  * Routing table IDs &gt; 255 are supported for custom routes on Linux.
  * To avoid races, the check for hardware offloading support in the kernel-netlink plugin is
    performed during initialization of the plugin (a605452c03).
  * The D-Bus config file for charon-nm is now installed in $(datadir)/dbus-1/system.d instead of
    $(sysconfdir)/dbus-1/system.d, which is intended for sysadmin overrides.
    INVALID_MAJOR_VERSION notifies are now correctly sent in messages of the same exchange type
    and with the same message ID as the request.
  * IKEv2 SAs are now immediately destroyed when sending or receiving INVALID_SYNTAX notifies
    in authenticated messages.
  * For developers working from the repository the configure script now aborts if GNU gperf is
    not found.
  - Version 5.8.1
  ===============
  * RDNs in DNs of X.509 certificates can now optionally be matched less strict. The global
    strongswan.conf option charon.rdn_matching takes two alternative values that cause the
    matching algorithm to either ignore the order of matched RDNs (reordered) or additionally
    (relaxed) accept DNs that contain more RDNs than configured (unmatched RDNs are treated
    like wildcard matches).
  * The updown plugin now passes the same interface to the script that is also used for the
    automatically installed routes, that is, the interface over which the peer is reached
    instead of the interface on which the local address is found (#3095).
  * TPM 2.0 contexts are now protected by a mutex to prevent issues if multiple IKE_SAs use
    the same private key concurrently (4b25885025).
  * Do a rekey check after the third QM message was received (#3060).
  * If available, explicit_bzero() is now used as memwipe() instead of our own implementation.
  * An .editorconfig file has been added, mainly so Github shows files with proper indentation
    (68346b6962).
  * The internal certificate of the load-tester plugin has been modified so it can again be
    used as end-entity cert with 5.6.3 and later (#3139).
  * The maximum data length of received COOKIE notifies (64 bytes) is now enforced (#3160).
  - Version 5.8.0
  ===============
  * The systemd service units have been renamed. The modern unit, which was called
    strongswan-swanctl, is now called strongswan (the previous name is configured as alias in
    the unit, for which a symlink is created when the unit is enabled). The legacy unit is now
    called strongswan-starter.
  * Support for XFRM interfaces (available since Linux 4.19) has been added, which are intended
    to replace VTI devices (they are similar but offer several advantages, for instance, they
    are not bound to an address or address family).
  * IPsec SAs and policies are associated with such interfaces via interface IDs that can be
    configured in swanctl.conf (dynamic IDs may optionally be allocated for each SA and even
    direction). It's possible to use separate interfaces for in- and outbound traffic (or
    only use an interface in one direction and regular policies in the other).
  * Interfaces may be created dynamically via updown/vici scripts, or statically before or after
    establishing the SAs. Routes must be added manually as needed (the daemon will not install
    any routes for outbound policies with an interface ID).
  * When moving XFRM interfaces to other network namespaces they retain access to the SAs and
    policies installed in the original namespace, which allows providing IPsec tunnels for
    processes in other network namespaces without giving them access to the IPsec keys or
    IKE credentials.
    More information can be found on the page about route-based VPNs.
  * Initiation of childless IKE_SAs is supported (RFC 6023). If enabled and supported by the
    responder, no CHILD_SA is established during IKE_AUTH. Instead, all CHILD_SAs are created
    with CREATE_CHILD_SA exchanges. This allows using a separate DH exchange even for the
    first CHILD_SA, which is otherwise created during IKE_AUTH with keys derived from the
    IKE_SA's key material.
  * The swanctl --initiate command may be used to initiate only the IKE_SA via --ike
    option if --child is omitted and the peer supports this extension.
  * The NetworkManager backend and plugin support IPv6.
  * The new wolfssl plugin is a wrapper around the wolfSSL crypto library. Thanks to Sean
    Parkinson of wolfSSL Inc. for the initial patch.
  * IKE SPIs may optionally be labeled via the charon.spi_mask|label options in
    strongswan.conf. This feature was extracted from charon-tkm, however, now applies the
    mask/label in network order.
  * The openssl plugin supports ChaCha20-Poly1305 when built with OpenSSL 1.1.0.
  * The PB-TNC finite state machine according to section 3.2 of RFC 5793 was not correctly
    implemented when sending either a CRETRY or SRETRY batch. These batches can only be sent
    in the "Decided" state and a CRETRY batch can immediately carry all messages usually
    transported by a CDATA batch. It is currently not possible to send a SRETRY batch since
    full-duplex mode for PT-TLS transport is not supported.
  * Instead of marking IPv6 virtual IPs as deprecated, the kernel-netlink plugin now uses
    address labels to avoid that such addresses are used for non-VPN traffic (00a953d090).
  * The agent plugin now creates sockets to the ssh/gpg-agent dynamically and does not keep
    them open, which otherwise might prevent the agent from getting terminated.
  * To avoid broadcast loops the forecast plugin now only reinjects packets that are marked
    or received from the configured interface.
  * UTF-8 encoded passwords are supported via EAP-MSCHAPv2, which internally uses an UTF-16LE
    encoding to calculate the NT hash (#3014).
  * Properly delete temporary drop policies (used when updating IP addresses of SAs) if manual
    priorities are used, which was broken since 5.6.2 (8e31d65730).
  * Avoid overwriting start_action when parsing the inactivity timeout in the vici plugin (#2954).
  * Fixed the automatic termination of reloaded vici connections with start_action=start,
    which was broken since 5.6.3 (71b22c250f).
  * The lookup for shared secrets for IKEv1 SAs via sql plugin should now work better
    (6ec9f68f32).
  * Fixed a race condition in the trap manager between installation and removal of a policy
    (69cbe2ca3f).
  * Compilation of the kernel-netlink plugin has been fixed on old kernels (&lt; 2.6.39), which
    was caused by the HW offload changes (c7f579fa17).
  * The IPsec stack detection and module loading in starter has been removed (it wasn't
    enforced anyway and loading modules doesn't seem necessary, also KLIPS hasn't been
    supported for a long time and PF_KEY will eventually be removed from the Linux kernel,
    ba817d2917).
  * Several IKEv2 protocol details are now handled more strictly: Unrequested virtual IPs are
    ignored, CFG_REPLY payloads are ignored if no CFG_REQUEST payloads were sent, a USE
    TRANSPORT_MODE notify received from the responder is checked against the local configuration.
  * The keys and certificates used by the scenarios in the testing environment are now generated
    dynamically. Running the testing/scripts/build-certs script after creating the base and root
    images uses the pki utility installed in the latter to create the keys and certificates for
    all the CAs and in some cases for individual scenarios. These credentials are stored in the
    source tree, not the image, so this has to be called only once even if the images are later
    rebuilt. The script automatically (re-)rebuilds the guest images as that generates fresh
    CRLs and signs the DNS zones. The only keys/certificates currently not generated are the
    very large ones used by the ikev2/rw-eap-tls-fragments scenario.
  - Version 5.7.2
  ===============
  * For RSA with PSS padding, the TPM 2.0 specification mandates the maximum salt length
    (as defined by the length of the key and hash). However, if the TPM is FIPS-168-4 compliant,
    the salt length equals the hash length. This is assumed for FIPS-140-2 compliant TPMs, but
    if that's not the case, it might be necessary to manually enable charon.plugins.tpm.fips_186_4
    if the TPM doesn't use the maximum salt length.
  * Directories for credentials loaded by swanctl are now accessed relative to the loaded
    swanctl.conf file, in particular, when loading it from a custom location via --file argument.
  * The base directory, which is used if no custom location for swanctl.conf is specified, is now
    also configurable at runtime via SWANCTL_DIR environment variable.
  * If RADIUS Accounting is enabled, the eap-radius plugin will add the session ID (Acct-Session-Id)
    to Access-Request messages, which e.g. simplifies associating database entries for IP leases and
    accounting with sessions (the session ID does not change when IKE_SAs are rekeyed, #2853).
  * All IP addresses assigned by a RADIUS server are included in Accounting-Stop messages even if
    the client did not claim them, allowing to release them early in case of connection errors (#2856).
  * Selectors installed on transport mode SAs by the kernel-netlink plugin are now updated if an
    IP address changes (e.g. via MOBIKE) and it was part of the selectors.
  * No deletes are sent anymore when a rekeyed CHILD_SA expires (#2815).
  * The bypass-lan plugin now tracks interfaces to handle subnets that move from one interface
    to another and properly update associated routes (#2820).
  * Only valid and expected inbound IKEv2 messages are used to update the timestamp of the
    last received message (previously, retransmits also triggered an update).
  * IKEv2 requests from responders are now ignored until the IKE_SA is fully established (e.g. if a
    DPD request from the peer arrives before the IKE_AUTH response does, 46bea1add9).
    Delayed IKE_SA_INIT responses with COOKIE notifies we already recevied are ignored, they caused
    another reset of the IKE_SA previously (#2837).
  * Active and queued Quick Mode tasks are now adopted if the peer reauthenticates an IKEv1 SA
    while creating lots of CHILD_SAs.
  * Newer versions of the FreeBSD kernel add an SADB_X_EXT_SA2 extension to SADB_ACQUIRE
    messages, which allows the kernel-pfkey plugin to determine the reqid of the policy even if it
    wasn't installed by the daemon previously (e.g. when using FreeBSD's if_ipsec(4) VTIs, which
    install policies themselves, 872b9b3e8d).
  * Added support for RSA signatures with SHA-256 and SHA-512 to the agent plugin. For older
    versions of ssh/gpg-agent that only support SHA-1, IKEv2 signature authentication has to be
    disabled via charon.signature_authentication.
  * The sshkey and agent plugins support Ed25519/Ed448 SSH keys and signatures.
  * The openssl plugin supports X25519/X448 Diffie-Hellman and Ed25519/Ed448 keys and
    signatures when built against OpenSSL 1.1.1.
  * Support for Ed25519, ChaCha20/Poly1305, SHA-3 and AES-CCM were added to the botan plugin.
  * The mysql plugin now properly handles database connections with transactions
    under heavy load (#2779).
  * IP addresses in ha pools are now distributed evenly among all segments (#2828).
  * Private key implementations may optionally provide a list of supported signature schemes,
    which, as described above, is used by the tpm plugin because for each key on a TPM 2.0 the
    hash algorithm and for RSA also the padding scheme is predefined.
  * The testing environment is now based on Debian 9 (stretch) by default. This required
    some changes, in particular, updating to FreeRADIUS 3.x (which forced us to abandon the
    TNC@FHH patches and scenarios, 2fbe44bef3) and removing FIPS-enabled versions of
    OpenSSL (the FIPS module only supports OpenSSL 1.0.2).
  * Most test scenarios were migrated to swanctl.
  - Version 5.7.1
  ===============
  * Fixes a vulnerability in the gmp plugin triggered by crafted certificates with RSA keys with
    very small moduli. When verifying signatures with such keys, the code patched with the fix
    for CVE-2018-16151/2 caused an integer underflow and subsequent heap buffer overflow
    that results in a crash of the daemon.
  * The vulnerability has been registered as CVE-2018-17540.
  - Version 5.7.0
  ===============
  * Fixes a potential authorization bypass vulnerability in the gmp plugin that was caused by a
    too lenient verification of PKCS#1 v1.5 signatures. Several flaws could be exploited by a
    Bleichenbacher-style attack to forge signatures for low-exponent keys (i.e. with e=3).
  * CVE-2018-16151 has been assigned to the problem of accepting random bytes after the OID
    of the hash function in such signatures, and CVE-2018-16152 has been assigned to the issue
    of not verifying that the parameters in the ASN.1 algorithmIdentitifer structure is empty.
    Other flaws that don't lead to a vulnerability directly (e.g. not checking for at least
    8 bytes of padding) have no separate CVE assigned.
  * Dots are not allowed anymore in section names in swanctl.conf and strongswan.conf.
    This mainly affects the configuration of file loggers. If the path for such a log file
    contains dots it now has to be configured in the new path setting within the arbitrarily
    renamed subsection in the filelog section.
  * Sections in swanctl.conf and strongswan.conf may now reference other sections. All settings
    and subsections from such a section are inherited. This allows to simplify configs as
    redundant information has only to be specified once and may then be included in other
    sections (see strongswan.conf for an example).
  * The originally selected IKE config (based on the IPs and IKE version) can now change
    if no matching algorithm proposal is found. This way the order of the configs doesn't
    matter that much anymore and it's easily possible to specify separate configs for
    clients that require weaker algorithms (instead of having to also add them in other
    configs that might be selected).
  * Support for Postquantum Preshared Keys for IKEv2 (draft-ietf-ipsecme-qr-ikev2) has been added.
    For an example refer to the swanctl/rw-cert-ppk scenario (or with EAP, or PSK authentication).
  * The new botan plugin is a wrapper around the Botan C++ crypto library.
    It requires a fairly recent build from Botan's master branch (or the upcoming 2.8.0 release).
    Thanks to René Korthaus and his team from Rohde &amp; Schwarz Cybersecurity for the initial
    patch and to Jack Lloyd for quickly adding missing functions to Botan's FFI (C89) interface.
  * Implementation of RFC 8412 "Software Inventory Message and Attributes (SWIMA) for PA-TNC".
  * SWIMA subscription option sets CLOSE_WRITE trigger on apt history.log file resulting in
    a ClientRetry PB-TNC batch to initialize a new measurement cycle. The new imv/imc-swima
    plugins replace the previous imv/imc-swid plugins, which were removed.
  * Added support for fuzzing the PA-TNC (RFC 5792) and PB-TNC (RFC 5793) NEA protocols
    on Google's OSS-Fuzz infrastructure.
  * Support for version 2 of Intel's TPM2-TSS TGC Software Stack. The presence of the
    in-kernel /dev/tpmrm0 resource manager is automatically detected.
  * The pki tool accepts a xmppAddr otherName as a subjectAlternativeName using the
    syntax --san xmppaddr:&lt;jid&gt;.
  * swanctl.conf supports the configuration of marks the in- and/or outbound SA should apply
    to packets after processing on Linux. Configuring such a mark for outbound SAs requires
    at least a 4.14 kernel. The ability to set a mask and configuring a mark/mask for
    inbound SAs will be added with the upcoming 4.19 kernel.
  * New options in swanctl.conf allow configuring how/whether DF, ECN and DS fields in the
    IP headers are copied during IPsec processing. Controlling this is currently only possible
    on Linux.
  * The handling of sequence numbers in IKEv1 DPDs has been improved (#2714).
  * To avoid conflicts, the dhcp plugin now only uses the DHCP server port if explicitly
    configured.
  - Version 5.6.3
  ===============
  * Fixed a DoS vulnerability in the IKEv2 key derivation if the openssl plugin is used in FIPS
    mode and HMAC-MD5 is negotiated as PRF.
    This vulnerability has been registered as CVE-2018-10811.
  * Fixed a vulnerability in the stroke plugin, which did not check the received length before
    reading a message from the socket. Unless a group is configured, root privileges are
    required to access that socket, so in the default configuration this shouldn't be an issue.
    This vulnerability has been registered as CVE-2018-5388.
  * CRLs that are not yet valid are now ignored to avoid problems in scenarios where expired
    certificates are removed from new CRLs and the clock on the host doing the revocation
    check is trailing behind that of the host issuing CRLs. Not doing this could result in
    accepting a revoked and expired certificate, if it's still valid according to the
    trailing clock but not contained anymore in not yet valid CRLs.
  * The issuer of fetched CRLs is now compared to the issuer of the checked certificate (#2608).
  * CRL validation results other than revocation (e.g. a skipped check because the CRL couldn't
    be fetched) are now stored also for intermediate CA certificates and not only for end-entity
    certificates, so a strict CRL policy can be enforced in such cases.
  * In compliance with RFC 4945, section 5.1.3.2, certificates used for IKE must now either
    not contain a keyUsage extension (like the ones generated by pki), or have at least one of the
    digitalSignature or nonRepudiation bits set.
  * New options for vici/swanctl allow forcing the local termination of an IKE_SA. This might be
    useful in situations where it's known the other end is not reachable anymore, or that it
    already removed the IKE_SA, so retransmitting a DELETE and waiting for a response would
    be pointless.
  * Waiting only a certain amount of time for a response (i.e. shorter than all retransmits
    would be) before destroying the IKE_SA is also possible by additionally specifying a
    timeout in the forced termination request.
  * When removing routes, the kernel-netlink plugin now checks if it tracks other routes for
    the same destination and replaces the installed route instead of just removing it. Same
    during installation, where existing routes previously weren't replaced. This should allow
    using traps with virtual IPs on Linux (#2162).
  * The dhcp plugin now only sends the client identifier DHCP option if the identity_lease
    setting is enabled (7b660944b6). It can also send identities of up to 255 bytes length,
    instead of the previous 64 bytes (30e886fe3b, 0e5b94d038). If a server address is
    configured, DHCP requests are now sent from port 67 instead of 68 to avoid ICMP port
    unreachables (becf027cd9).
  * The handling of faulty INVALID_KE_PAYLOAD notifies (e.g. one containing a DH group
    that wasn't proposed) during CREATE_CHILD_SA exchanges has been improved (#2536).
  * Roam events are now completely ignored for IKEv1 SAs (there is no MOBIKE to handle such
    changes properly).
  * ChaCha20/Poly1305 is now correctly proposed without key length (#2614). For compatibility with
    older releases the chacha20poly1305compat keyword may be included in proposals to also propose
    the algorithm with a key length (c58434aeff).
  * Configuration of hardware offload of IPsec SAs is now more flexible and allows a new
    setting (auto), which automatically uses it if the kernel and device both support it. If hw
    offload is set to yes and offloading is not supported, the CHILD_SA installation now fails.
  * The kernel-pfkey plugin optionally installs routes via internal interface (one with an IP
    in the local traffic selector). On FreeBSD, enabling this selects the correct source IP
    when sending packets from the gateway itself (e811659323).
  * SHA-2 based PRFs are supported in PKCS#8 files as generated by OpenSSL 1.1 (#2574).
  * The pki --verify tool may load CA certificates and CRLs from directories.
  * The IKE daemon now also switches to port 4500 if the remote port is not 500 (e.g. because the
    remote maps the response to a different port, as might happen on Azure), as long as the local
    port is 500 (85bfab621d).
  * Fixed an issue with DNS servers passed to NetworkManager in charon-nm (ee8c25516a).
  * Logged traffic selectors now always contain the protocol if either protocol or port are set
    (a36d8097ed).
  * Only the inbound SA/policy will be updated as reaction to IP address changes for rekeyed
    CHILD_SAs that are kept around.
  * The parser for strongswan.conf/swanctl.conf now accepts = characters in values without
    having to put the value in quotes (e.g. for Base64 encoded shared secrets).
    Notes for developers:
  * trap_manager_t: Trap policies are now unistalled by peer/child name and not the reqid.
  * No reqid is returned anymore when installing trap policies.
  * child_sa_t: A new state (CHILD_DELETED) is used for CHILD_SAs that have been deleted but
    not yet destroyed (after a rekeying CHILD_SAs are kept around for a while to process
    delayed packets).
    This way child_updown events are not triggered anymore for such SAs when an IKE_SA that
    has such CHILD_SAs assigned is deleted.
  - Version 5.6.2
  ===============
  * Fixed a DoS vulnerability in the parser for PKCS#1 RSASSA-PSS signatures that was caused
    by insufficient input validation. One of the configurable parameters in algorithm identifier
    structures for RSASSA-PSS signatures is the mask generation function (MGF). Only MGF1 is
    currently specified for this purpose. However, this in turn takes itself a parameter that
    specifies the underlying hash function. strongSwan's parser did not correctly handle the
    case of this parameter being absent, causing an undefined data read.
    This vulnerability has been registered as CVE-2018-6459.
  * When rekeying IKEv2 IKE_SAs the previously negotiated DH group will be reused, instead of
    using the first configured group, which avoids an additional exchange if the peer previously
    selected a different DH group via INVALID_KE_PAYLOAD notify. The same is also done when
    rekeying CHILD_SAs except for the first rekeying of the CHILD_SA that was created with the
    IKE_SA, where no DH group was negotiated yet.
    Also, the selected DH group is moved to the front in all sent proposals that contain it
    and all proposals that don't are moved to the back in order to convey the preference for
    this group to the peer.
  * Handling of MOBIKE task queuing has been improved. In particular, the response to an
    address update (with NAT-D payloads) is not ignored anymore if only an address list update
    or DPD is queued as that could prevent updating the UDP encapsulation in the kernel.
  * On Linux, roam events may optionally be triggered by changes to the routing rules, which
    can be useful if routing rules (instead of e.g. route metrics) are used to switch from one
    to another interface (i.e. from one to another routing table). Since routing rules are
    currently not evaluated when doing route lookups this is only useful if the kernel-based
    route lookup is used (4664992f7d).
  * The fallback drop policies installed to avoid traffic leaks when replacing addresses in
    installed policies are now replaced by temporary drop policies, which also prevent
    acquires because we currently delete and reinstall IPsec SAs to update their addresses
    (35ef1b032d).
  * Access X.509 certificates held in non-volatile storage of a TPM 2.0 referenced via the
    NV index.
    Adding the --keyid parameter to pki --print allows to print private keys or certificates
    stored in a smartcard or a TPM 2.0.
  * Fixed proposal selection if a peer incorrectly sends DH groups in the ESP proposal during
    IKE_AUTH and also if a DH group is configured in the local ESP proposal and charon.prefer
    configured_proposals is disabled (d058fd3c32).
  * The lookup for PSK secrets for IKEv1 has been improved for certain scenarios (see #2497
    for details).
  * MSKs received via RADIUS are now padded to 64 bytes to avoid compatibility issues with
    EAP-MSCHAPv2 and PRFs that have a block size &lt; 64 bytes (e.g. AES-XCBC-PRF-128, see
    73cbce6013).
  * The tpm_extendpcr command line tool extends a digest into a TPM PCR.
  * Ported the NetworkManager backend from the deprecated libnm-glib to libnm.
  * The save-keys debugging/development plugin saves IKE and/or ESP keys to files compatible
    with Wireshark.
  - Version 5.6.1
  ===============
  * Several algorithms were removed from the default ESP/AH and IKE proposals in compliance with
    RFC 8221 and RFC 8247, respectively. Removed from the default ESP/AH proposal were the
    3DES and Blowfish encryption algorithms and the HMAC-MD5 integrity algorithm. From the IKE
    default proposal the HMAC-MD5 integrity algorithm and the MODP-1024 Diffie-Hellman group
    were removed (the latter is significant for Windows clients in their default configuration).
    These algorithms may still be used in custom proposals.
  * Support for RSASSA-PSS signatures has been added. For compatibility with previous
    releases they are currently not used automatically, by default, to change that charon.rsa_pss
    may be enabled. To explicitly use or require such signatures during IKEv2 signature
    authentication (RFC 7427) ike:rsa/pss... authentication constraints may be used for specific
    connections (regardless of whether the strongswan.conf option above is enabled). Only the
    hash algorithm can be specified in such constraints, the MGF1 will be based on that hash
    and the salt length will equal the hash length (when verifying the salt length is not
    enforced).
    To enforce such signatures during PKI verification use rsa/pss... authentication constraints.
  * All pki commands that create certificates/CRLs can be made to sign with RSASSA-PSS instead
    of the classing PKCS#1 scheme with the --rsa-padding pss option. As with signatures during
    authentication, only the hash algorithm is configurable (via --digest option), the MGF1 will
    be based on that and the salt length will equal the hash length.
  * These signatures are supported by all RSA backends except pkcs11 (i.e. gmp, gcrypt, openssl).
    The gmp plugin requires the mgf1 plugin.
    Note that RSASSA-PSS algorithm identifiers and parameters in keys (public keys in
    certificates or private keys in PKCS#8 files) are currently not used as constraints.
  * The sec-updater tool checks for security updates in dpkg-based repositories
    (e.g. Debian/Ubuntu) and sets the security flags in the IMV policy database accordingly.
    Additionally for each new package version a SWID tag for the given OS and HW architecture
    is created and stored in the database.
  * Using the sec-updater.sh script template the lookup can be automated (e.g. via an hourly
    cron job).
  * When restarting an IKEv2 negotiation after receiving an INVALID_KE_PAYLOAD notify (or due
    to other reasons like too many retransmits) a new initiator SPI is allocated. This
    prevents issues caused by retransmits for IKE_SA_INIT messages.
  * Because the initiator SPI was previously reused when restarting the connection delayed
    responses for previous connection attempts were processed and might have caused fatal
    errors due to a failed DH negotiation or because of the internal retry counter in the
    ike-init task. For instance, if we proposed a DH group the responder rejected we
    might have later received delayed responses that either contained INVALID_KE_PAYLOAD
    notifies with the DH group we already switched to, or, if we retransmitted an
    IKE_SA_INIT with the requested group but then had to restart again, a KE payload with
    a group different from the one we proposed.
  * The introduction of file versions in the IMV database scheme broke file reference hash
    measurements. This has been fixed by creating generic product versions having an empty
    package name.
  * A new timeout option for the systime-fix plugin stops periodic system time checks after
    a while and enforces a certificate verification, closing or reauthenticating all SAs
    with invalid certificates.
  * The IKE event counters, previously only available via ipsec listcounters command, may
    now also be queried and reset via vici and the new swanctl --counters command. They
    are collected and provided by the optional counters plugin (enabled by default for
    backwards compatibility if the stroke plugin is built).
  * Class attributes received in RADIUS Access-Accept messages may optionally be added to
    RADIUS accounting messages (655924074b).
  * Basic support for systemd sockets has been added, which may be used for privilege separation
    (59db98fb94).
  * Inbound marks may optionally be installed in the SA again (was removed with 5.5.2) by
    enabling the mark_in_sa option in swanctl.conf.
  * The timeout of leases in pools configured via pool utility may be configured in other
    units than hours.
    INITIAL_CONTACT notifies are now only omitted if never is configured as uniqueness policy.
  * Outbound FWD policies for shunts are not installed anymore, by default (as is the case
    for other policies since 5.5.1).
  * Don't consider a DH group mismatch during CHILD_SA rekeying as failure as responder
    (e7276f78aa).
  * Handling of fragmented IPv4 and IPv6 packets in libipsec has been improved (e138003de9).
  * Trigger expire events for the correct IPsec SA in libipsec (6e861947a0).
  * A crash in CRL verification via openssl plugin using OpenSSL 1.1 has been fixed (78acaba6a1).
  * No hard-coded default proposals are passed from starter to the stroke plugin anymore (the
    IKE proposal used curve25519 since 5.5.2, which is an optional plugin).
  * A workaround for an issue with virtual IPs on macOS 10.13 (High Sierra) has been added
    (039b85dd43).
  * Handling of IKE_SA rekey collisions in charon-tkm has been fixed.
  * Instead of failing or just silently doing nothing unit tests may now warn about certain
    conditions (e.g. if a test was not executed due to external dependencies).</changelog>
  <changelog author="mmnelemane@suse.com" date="1585224000">- Fix for to resolve multiple definition of swanctl_dir (bsc #1164493)
  [+ 0006-Resolve-multiple-definition-of-swanctl_dir.patch]</changelog>
  <changelog author="mbuil@suse.com" date="1610712000">- Fix typo in README (bsc #1167880)
  [+ 0007-Fix-typo-in-README.patch ]</changelog>
  <changelog author="mbuil@suse.com" date="1611576000">- Fix FIPS bug (bsc #1180801)
  [+ 0008-gcrypt-Use-a-dummy-buffer-to-initialize-static-alloc.patch ]</changelog>
  <changelog author="mbuil@suse.com" date="1617019200">- Keep using ipsec as the main binary. Therefore, make strongswan.service point to it instead of swanctl</changelog>
  <changelog author="mbuil@suse.com" date="1617019201">- Information added in README about the rcstrongswan-starter</changelog>
  <changelog author="mbuil@suse.com" date="1617624000">- Add config to run ipsec on namespaces (bsc #1183670)</changelog>
  <changelog author="mt@suse.com" date="1619006400">- Add support for AES CCM aead algorithms to openssl plugin (cc/fips,bsc#1185363)
  [+ 0009-strongswan-openssl-aead-add-ccm-support.patch]</changelog>
  <changelog author="mt@suse.com" date="1620388800">- Replace AEAD AES CCM patch with upstream variant (cc/fips,bsc#1185363)
  [* 0009-strongswan-openssl-aead-add-ccm-support.patch]</changelog>
  <changelog author="hare@suse.de" date="1627646400">- Add auth_els plugin to support Marvell FC-SP encryption (jsc#SLE-20151)
  [* strongswan-marvell-auth-els.patch]</changelog>
  <changelog author="abergmann@suse.com" date="1634040000">- Fix integer overflow in gmp plugin (bsc#1191367, CVE-2021-41990)
  [* strongswan-5.6.1-5.9.3_gmp-rsa-ssa-salt-len.patch]
- Fix integer overflow when replacing certificates in cache (bsc#1191435, CVE-2021-41991)
  [* strongswan-4.4.1-5.9.3_cert-cache-random.patch]</changelog>
  <changelog author="meissner@suse.com" date="1643025600">- strongswan-5.5.0-5.9.4_eap_success-CVE-2021-45079.patch:
  Fixed authentication bypass in EAP authentication (CVE-2021-45079
  bsc#1194471)</changelog>
</package>
<package pkgid="0f328fdaab189ec9c772b535581cc83587a425f5db18e27695fdec8f1346080d" name="strongswan-ipsec" arch="aarch64">
  <version epoch="0" ver="5.8.2" rel="11.24.1"/>
  <changelog author="ndas@suse.de" date="1501502400">- Updated to strongSwan 5.3.5(bsc#1050691) providing the following changes:
  * Fixed a DoS vulnerability in the gmp plugin that was caused by insufficient input
    validation when verifying RSA signatures. More specifically, mpz_powm_sec() has two
    requirements regarding the passed exponent and modulus that the plugin did not
    enforce, if these are not met the calculation will result in a floating point exception
    that crashes the whole process.
    This vulnerability has been registered as CVE-2017-9022.
    Please refer to our blog for details.
  * Fixed a DoS vulnerability in the x509 plugin that was caused because the ASN.1 parser
    didn't handle ASN.1 CHOICE types properly, which could result in an infinite loop when
    parsing X.509 extensions that use such types.
    This vulnerability has been registered as CVE-2017-9023.
    Please refer to our blog for details.
  * The behavior during IKEv2 CHILD_SA rekeying has been changed in order to avoid
    traffic loss. When responding to a CREATE_CHILD_SA request to rekey a CHILD_SA
    the responder already has everything available to install and use the new CHILD_SA.
    However, this could lead to lost traffic as the initiator won't be able to process
    inbound packets until it processed the CREATE_CHILD_SA response and updated the
    inbound SA. To avoid this the responder now only installs the new inbound SA and
    delays installing the outbound SA until it receives the DELETE for the replaced CHILD_SA.
  * The messages transporting these DELETEs could reach the peer before packets sent
    with the deleted outbound SAs reach it. To reduce the chance of traffic loss due
    to this the inbound SA of the replaced CHILD_SA is not removed for a configurable
    amount of seconds (charon.delete_rekeyed_delay) after the DELETE has been processed.
  * The code base has been ported to Apple's ARM64 iOS platform, which required several
    changes regarding the use of variadic functions. This was necessary because the calling
    conventions for variadic and regular functions are different there.
    This means that assigning a non-variadic function to a variadic function pointer, as we
    did with our enumerator_t::enumerate() implementations and several callbacks, will
    result in crashes as the called function accesses the arguments differently than the
    caller provided them. To avoid this issue the enumerator_t interface has been changed
    and the signature of the callback functions for enumerator_create_filter() and two
    methods on linked_list_t have been changed. Refer to the developer notes below
    for details.
  * Adds support for fuzzing the certificate parser provided by the default plugins
    (x509, pem, gmp etc.) on Google's OSS-Fuzz infrastructure (or generally with
    libFuzzer). Several issues found while fuzzing these plugins were fixed.
  * Two new options have been added to charon's retransmission settings:
    retransmit_limit and retransmit_jitter. The former adds an upper limit to the
    calculated retransmission timeout, the latter randomly reduces it.
    Refer to Retransmission for details.
  * A bug in swanctl's --load-creds command was fixed that caused unencrypted
    private keys to get unloaded if the command was called multiple times.
    The load-key VICI command now returns the key ID of the loaded key on success.
  * The credential manager now enumerates local credential sets before global ones.
    This means certificates supplied by the peer will now be preferred over certificates
    with the same identity that may be locally stored (e.g. in the certificate cache).
  * Adds support for hardware offload of IPsec SAs as introduced by Linux 4.11 for
    specific hardware that supports this.
  * The pki tool loads the curve25519 plugin by default.
    [- 0006-Make-sure-the-modulus-is-odd-and-the-exponent-not-zero.patch,
  - 0007-asn1-parser-Fix-CHOICE-parsing.patch]
- libhydra is removed as all kernel plugins moved to libcharon</changelog>
  <changelog author="ndas@suse.de" date="1504612800">- fix "uintptr_t? undeclared" compilation error.
  [+0006-fix-compilation-error-by-adding-stdint.h.patch]</changelog>
  <changelog author="ndas@suse.de" date="1504612801">- Updated to strongSwan 5.6.0 providing the following changes:
  * Fixed a DoS vulnerability in the gmp plugin that was caused by insufficient input validation
    when verifying RSA signatures, which requires decryption with the operation m^e mod n,
    where m is the signature, and e and n are the exponent and modulus of the public key.
    The value m is an integer between 0 and n-1, however, the gmp plugin did not verify this.
    So if m equals n the calculation results in 0, in which case mpz_export() returns NULL.
    This result wasn't handled properly causing a null-pointer dereference.
    This vulnerability has been registered as CVE-2017-11185. (bsc#1051222)
  * New SWIMA IMC/IMV pair implements the draft-ietf-sacm-nea-swima-patnc Internet
    Draft and has been demonstrated at the IETF 99 Prague Hackathon.
  * The IMV database template has been adapted to achieve full compliance with the
    ISO 19770-2:2015 SWID tag standard.
  * The pt-tls-client can attach and use TPM 2.0 protected private keys via the --keyid parameter.
  * By default the /etc/swanctl/conf.d directory is created and *.conf files in it are included in the default
    swanctl.conf file.
  * The curl plugin now follows HTTP redirects (configurable via strongswan.conf).
  * The CHILD_SA rekeying was fixed in charon-tkm and the behavior is refined a bit more since 5.5.3
  * libtpmtss supports Intel's TSS2 Architecture Broker and Resource Manager interface (tcti-tabrmd).
  * more on https://wiki.strongswan.org/versions/66</changelog>
  <changelog author="mmnelemane@suse.com" date="1521028800">- Removed unused requires and macro calls(bsc#1083261)</changelog>
  <changelog author="mmnelemane@suse.com" date="1573646400">- Added patch to fix vulnerability: CVE-2018-16151,CVE-2018-16152 (bsc#1107874)
  - Insufficient input validation in gmp plugin
  [+ 0007-strongswan-5.3.1-5.6.0_gmp-pkcs1-verify.patch]</changelog>
  <changelog author="mmnelemane@suse.com" date="1573646401">- Added patch to fix vulnerability: CVE-2018-5388 (bsc#1094462)
  - Buffer Underflow in stroke_socket.c
  [+ 0008-strongswan-5.1.2-5.6.2_stroke_msg_len.patch]</changelog>
  <changelog author="mmnelemane@suse.com" date="1573646402">- Added patch to fix vulnerability: CVE-2018-10811 (bsc#1093536)
  - denial-of-service vulnerability
  [+ 0009-strongswan-5.5.0-5.6.2_skeyseed_init.patch]</changelog>
  <changelog author="mmnelemane@suse.com" date="1573732800">- Added patch to fix vulnerability: CVE-2018-17540 (bsc#1109845)
  [+ 0010-strongswan-4.4.0-5.7.0_gmp-pkcs1-overflow.patch]</changelog>
  <changelog author="mmnelemane@suse.com" date="1580212800">- Updated to version 5.8.2 (jsc#SLE-11370)
  - Dropped following patches due to irrelevance in the updated version:
    [- strongswan_modprobe_syslog.patch ]
    [- strongswan_fipsfilter.patch ]
    [- 0006-fix-compilation-error-by-adding-stdint.h.patch ]
    [- 0007-strongswan-5.3.1-5.6.0_gmp-pkcs1-verify.patch ]
    [- 0008-strongswan-5.1.2-5.6.2_stroke_msg_len.patch ]
    [- 0009-strongswan-5.5.0-5.6.2_skeyseed_init.patch ]
    [- 0010-strongswan-4.4.0-5.7.0_gmp-pkcs1-overflow.patch ]
  - Version 5.8.2
  ===============
  * Identity-based CA constraints, which enforce that the certificate chain of the remote
    peer contains a CA certificate with a specific identity, are supported via
    vici/swanctl.conf. This is similar to the existing CA constraints but doesn't require
    that the CA certificate is locally installed, for instance, intermediate CA certificates
    received from the peers. Wildcard identity matching (e.g. ..., OU=Research, CN=*) could
    also be used for the latter but requires trust in the intermediate CAs to only issue
    certificates with legitimate subject DNs (e.g. the "Sales" CA must not issue certificates
    with OU=Research). With the new constraint that's not necessary as long as a path length
    basic constraint (--pathlen for pki --issue) prevents intermediate CAs from issuing further
    intermediate CAs.
  * Intermediate CA certificates may now be sent in hash-and-URL encoding by configuring a
    base URL for the parent CA (#3234, swanctl/rw-hash-and-url-multi-level).
  * Implemented NIST SP-800-90A Deterministic Random Bit Generator (DRBG) based on AES-CTR
    and SHA2-HMAC modes. Currently used by the gmp and ntru plugins.
  * Random nonces sent in an OCSP requests are now expected in the corresponding OCSP responses.
  * The kernel-netlink plugin now ignores deprecated IPv6 addresses for MOBIKE. Whether temporary
    or permanent IPv6 addresses are included now depends on the charon.prefer_temporary_addrs
    setting (#3192).
  * Extended Sequence Numbers (ESN) are configured via PF_KEY if supported by the kernel.
  * The PF_KEY socket's receive buffer in the kernel-pfkey plugin is now cleared before sending
    requests, as many of the messages sent by the kernel are sent as broadcasts to all PF_KEY
    sockets. This is an issue if an external tool is used to manage SAs/policies unrelated to
    IPsec (#3225).
  * The vici plugin now uses unique section names for CHILD_SAs in child-updown events (7c74ce9190).
  * For individually deleted CHILD_SAs (in particular for IKEv1) the vici child-updown event
    now includes more information about the CHILD_SAs such as traffic statistics (#3198).
  * Custom loggers are correctly re-registered if log levels are changed via stroke loglevel (#3182).
  * Avoid lockups during startup on low entropy systems when using OpenSSL 1.1.1 (095a2c2eac).
  * Instead of failing later when setting a key, creating HMACs via openssl plugin now fails
    instantly if the underlying hash algorithm isn't supported (e.g. MD5 in FIPS-mode) so fallbacks
    to other plugins work properly (#3284).
  * Exponents of RSA keys read from TPM 2.0 via SAPI are correctly converted (8ee1242f1438).
  * Routing table IDs &gt; 255 are supported for custom routes on Linux.
  * To avoid races, the check for hardware offloading support in the kernel-netlink plugin is
    performed during initialization of the plugin (a605452c03).
  * The D-Bus config file for charon-nm is now installed in $(datadir)/dbus-1/system.d instead of
    $(sysconfdir)/dbus-1/system.d, which is intended for sysadmin overrides.
    INVALID_MAJOR_VERSION notifies are now correctly sent in messages of the same exchange type
    and with the same message ID as the request.
  * IKEv2 SAs are now immediately destroyed when sending or receiving INVALID_SYNTAX notifies
    in authenticated messages.
  * For developers working from the repository the configure script now aborts if GNU gperf is
    not found.
  - Version 5.8.1
  ===============
  * RDNs in DNs of X.509 certificates can now optionally be matched less strict. The global
    strongswan.conf option charon.rdn_matching takes two alternative values that cause the
    matching algorithm to either ignore the order of matched RDNs (reordered) or additionally
    (relaxed) accept DNs that contain more RDNs than configured (unmatched RDNs are treated
    like wildcard matches).
  * The updown plugin now passes the same interface to the script that is also used for the
    automatically installed routes, that is, the interface over which the peer is reached
    instead of the interface on which the local address is found (#3095).
  * TPM 2.0 contexts are now protected by a mutex to prevent issues if multiple IKE_SAs use
    the same private key concurrently (4b25885025).
  * Do a rekey check after the third QM message was received (#3060).
  * If available, explicit_bzero() is now used as memwipe() instead of our own implementation.
  * An .editorconfig file has been added, mainly so Github shows files with proper indentation
    (68346b6962).
  * The internal certificate of the load-tester plugin has been modified so it can again be
    used as end-entity cert with 5.6.3 and later (#3139).
  * The maximum data length of received COOKIE notifies (64 bytes) is now enforced (#3160).
  - Version 5.8.0
  ===============
  * The systemd service units have been renamed. The modern unit, which was called
    strongswan-swanctl, is now called strongswan (the previous name is configured as alias in
    the unit, for which a symlink is created when the unit is enabled). The legacy unit is now
    called strongswan-starter.
  * Support for XFRM interfaces (available since Linux 4.19) has been added, which are intended
    to replace VTI devices (they are similar but offer several advantages, for instance, they
    are not bound to an address or address family).
  * IPsec SAs and policies are associated with such interfaces via interface IDs that can be
    configured in swanctl.conf (dynamic IDs may optionally be allocated for each SA and even
    direction). It's possible to use separate interfaces for in- and outbound traffic (or
    only use an interface in one direction and regular policies in the other).
  * Interfaces may be created dynamically via updown/vici scripts, or statically before or after
    establishing the SAs. Routes must be added manually as needed (the daemon will not install
    any routes for outbound policies with an interface ID).
  * When moving XFRM interfaces to other network namespaces they retain access to the SAs and
    policies installed in the original namespace, which allows providing IPsec tunnels for
    processes in other network namespaces without giving them access to the IPsec keys or
    IKE credentials.
    More information can be found on the page about route-based VPNs.
  * Initiation of childless IKE_SAs is supported (RFC 6023). If enabled and supported by the
    responder, no CHILD_SA is established during IKE_AUTH. Instead, all CHILD_SAs are created
    with CREATE_CHILD_SA exchanges. This allows using a separate DH exchange even for the
    first CHILD_SA, which is otherwise created during IKE_AUTH with keys derived from the
    IKE_SA's key material.
  * The swanctl --initiate command may be used to initiate only the IKE_SA via --ike
    option if --child is omitted and the peer supports this extension.
  * The NetworkManager backend and plugin support IPv6.
  * The new wolfssl plugin is a wrapper around the wolfSSL crypto library. Thanks to Sean
    Parkinson of wolfSSL Inc. for the initial patch.
  * IKE SPIs may optionally be labeled via the charon.spi_mask|label options in
    strongswan.conf. This feature was extracted from charon-tkm, however, now applies the
    mask/label in network order.
  * The openssl plugin supports ChaCha20-Poly1305 when built with OpenSSL 1.1.0.
  * The PB-TNC finite state machine according to section 3.2 of RFC 5793 was not correctly
    implemented when sending either a CRETRY or SRETRY batch. These batches can only be sent
    in the "Decided" state and a CRETRY batch can immediately carry all messages usually
    transported by a CDATA batch. It is currently not possible to send a SRETRY batch since
    full-duplex mode for PT-TLS transport is not supported.
  * Instead of marking IPv6 virtual IPs as deprecated, the kernel-netlink plugin now uses
    address labels to avoid that such addresses are used for non-VPN traffic (00a953d090).
  * The agent plugin now creates sockets to the ssh/gpg-agent dynamically and does not keep
    them open, which otherwise might prevent the agent from getting terminated.
  * To avoid broadcast loops the forecast plugin now only reinjects packets that are marked
    or received from the configured interface.
  * UTF-8 encoded passwords are supported via EAP-MSCHAPv2, which internally uses an UTF-16LE
    encoding to calculate the NT hash (#3014).
  * Properly delete temporary drop policies (used when updating IP addresses of SAs) if manual
    priorities are used, which was broken since 5.6.2 (8e31d65730).
  * Avoid overwriting start_action when parsing the inactivity timeout in the vici plugin (#2954).
  * Fixed the automatic termination of reloaded vici connections with start_action=start,
    which was broken since 5.6.3 (71b22c250f).
  * The lookup for shared secrets for IKEv1 SAs via sql plugin should now work better
    (6ec9f68f32).
  * Fixed a race condition in the trap manager between installation and removal of a policy
    (69cbe2ca3f).
  * Compilation of the kernel-netlink plugin has been fixed on old kernels (&lt; 2.6.39), which
    was caused by the HW offload changes (c7f579fa17).
  * The IPsec stack detection and module loading in starter has been removed (it wasn't
    enforced anyway and loading modules doesn't seem necessary, also KLIPS hasn't been
    supported for a long time and PF_KEY will eventually be removed from the Linux kernel,
    ba817d2917).
  * Several IKEv2 protocol details are now handled more strictly: Unrequested virtual IPs are
    ignored, CFG_REPLY payloads are ignored if no CFG_REQUEST payloads were sent, a USE
    TRANSPORT_MODE notify received from the responder is checked against the local configuration.
  * The keys and certificates used by the scenarios in the testing environment are now generated
    dynamically. Running the testing/scripts/build-certs script after creating the base and root
    images uses the pki utility installed in the latter to create the keys and certificates for
    all the CAs and in some cases for individual scenarios. These credentials are stored in the
    source tree, not the image, so this has to be called only once even if the images are later
    rebuilt. The script automatically (re-)rebuilds the guest images as that generates fresh
    CRLs and signs the DNS zones. The only keys/certificates currently not generated are the
    very large ones used by the ikev2/rw-eap-tls-fragments scenario.
  - Version 5.7.2
  ===============
  * For RSA with PSS padding, the TPM 2.0 specification mandates the maximum salt length
    (as defined by the length of the key and hash). However, if the TPM is FIPS-168-4 compliant,
    the salt length equals the hash length. This is assumed for FIPS-140-2 compliant TPMs, but
    if that's not the case, it might be necessary to manually enable charon.plugins.tpm.fips_186_4
    if the TPM doesn't use the maximum salt length.
  * Directories for credentials loaded by swanctl are now accessed relative to the loaded
    swanctl.conf file, in particular, when loading it from a custom location via --file argument.
  * The base directory, which is used if no custom location for swanctl.conf is specified, is now
    also configurable at runtime via SWANCTL_DIR environment variable.
  * If RADIUS Accounting is enabled, the eap-radius plugin will add the session ID (Acct-Session-Id)
    to Access-Request messages, which e.g. simplifies associating database entries for IP leases and
    accounting with sessions (the session ID does not change when IKE_SAs are rekeyed, #2853).
  * All IP addresses assigned by a RADIUS server are included in Accounting-Stop messages even if
    the client did not claim them, allowing to release them early in case of connection errors (#2856).
  * Selectors installed on transport mode SAs by the kernel-netlink plugin are now updated if an
    IP address changes (e.g. via MOBIKE) and it was part of the selectors.
  * No deletes are sent anymore when a rekeyed CHILD_SA expires (#2815).
  * The bypass-lan plugin now tracks interfaces to handle subnets that move from one interface
    to another and properly update associated routes (#2820).
  * Only valid and expected inbound IKEv2 messages are used to update the timestamp of the
    last received message (previously, retransmits also triggered an update).
  * IKEv2 requests from responders are now ignored until the IKE_SA is fully established (e.g. if a
    DPD request from the peer arrives before the IKE_AUTH response does, 46bea1add9).
    Delayed IKE_SA_INIT responses with COOKIE notifies we already recevied are ignored, they caused
    another reset of the IKE_SA previously (#2837).
  * Active and queued Quick Mode tasks are now adopted if the peer reauthenticates an IKEv1 SA
    while creating lots of CHILD_SAs.
  * Newer versions of the FreeBSD kernel add an SADB_X_EXT_SA2 extension to SADB_ACQUIRE
    messages, which allows the kernel-pfkey plugin to determine the reqid of the policy even if it
    wasn't installed by the daemon previously (e.g. when using FreeBSD's if_ipsec(4) VTIs, which
    install policies themselves, 872b9b3e8d).
  * Added support for RSA signatures with SHA-256 and SHA-512 to the agent plugin. For older
    versions of ssh/gpg-agent that only support SHA-1, IKEv2 signature authentication has to be
    disabled via charon.signature_authentication.
  * The sshkey and agent plugins support Ed25519/Ed448 SSH keys and signatures.
  * The openssl plugin supports X25519/X448 Diffie-Hellman and Ed25519/Ed448 keys and
    signatures when built against OpenSSL 1.1.1.
  * Support for Ed25519, ChaCha20/Poly1305, SHA-3 and AES-CCM were added to the botan plugin.
  * The mysql plugin now properly handles database connections with transactions
    under heavy load (#2779).
  * IP addresses in ha pools are now distributed evenly among all segments (#2828).
  * Private key implementations may optionally provide a list of supported signature schemes,
    which, as described above, is used by the tpm plugin because for each key on a TPM 2.0 the
    hash algorithm and for RSA also the padding scheme is predefined.
  * The testing environment is now based on Debian 9 (stretch) by default. This required
    some changes, in particular, updating to FreeRADIUS 3.x (which forced us to abandon the
    TNC@FHH patches and scenarios, 2fbe44bef3) and removing FIPS-enabled versions of
    OpenSSL (the FIPS module only supports OpenSSL 1.0.2).
  * Most test scenarios were migrated to swanctl.
  - Version 5.7.1
  ===============
  * Fixes a vulnerability in the gmp plugin triggered by crafted certificates with RSA keys with
    very small moduli. When verifying signatures with such keys, the code patched with the fix
    for CVE-2018-16151/2 caused an integer underflow and subsequent heap buffer overflow
    that results in a crash of the daemon.
  * The vulnerability has been registered as CVE-2018-17540.
  - Version 5.7.0
  ===============
  * Fixes a potential authorization bypass vulnerability in the gmp plugin that was caused by a
    too lenient verification of PKCS#1 v1.5 signatures. Several flaws could be exploited by a
    Bleichenbacher-style attack to forge signatures for low-exponent keys (i.e. with e=3).
  * CVE-2018-16151 has been assigned to the problem of accepting random bytes after the OID
    of the hash function in such signatures, and CVE-2018-16152 has been assigned to the issue
    of not verifying that the parameters in the ASN.1 algorithmIdentitifer structure is empty.
    Other flaws that don't lead to a vulnerability directly (e.g. not checking for at least
    8 bytes of padding) have no separate CVE assigned.
  * Dots are not allowed anymore in section names in swanctl.conf and strongswan.conf.
    This mainly affects the configuration of file loggers. If the path for such a log file
    contains dots it now has to be configured in the new path setting within the arbitrarily
    renamed subsection in the filelog section.
  * Sections in swanctl.conf and strongswan.conf may now reference other sections. All settings
    and subsections from such a section are inherited. This allows to simplify configs as
    redundant information has only to be specified once and may then be included in other
    sections (see strongswan.conf for an example).
  * The originally selected IKE config (based on the IPs and IKE version) can now change
    if no matching algorithm proposal is found. This way the order of the configs doesn't
    matter that much anymore and it's easily possible to specify separate configs for
    clients that require weaker algorithms (instead of having to also add them in other
    configs that might be selected).
  * Support for Postquantum Preshared Keys for IKEv2 (draft-ietf-ipsecme-qr-ikev2) has been added.
    For an example refer to the swanctl/rw-cert-ppk scenario (or with EAP, or PSK authentication).
  * The new botan plugin is a wrapper around the Botan C++ crypto library.
    It requires a fairly recent build from Botan's master branch (or the upcoming 2.8.0 release).
    Thanks to René Korthaus and his team from Rohde &amp; Schwarz Cybersecurity for the initial
    patch and to Jack Lloyd for quickly adding missing functions to Botan's FFI (C89) interface.
  * Implementation of RFC 8412 "Software Inventory Message and Attributes (SWIMA) for PA-TNC".
  * SWIMA subscription option sets CLOSE_WRITE trigger on apt history.log file resulting in
    a ClientRetry PB-TNC batch to initialize a new measurement cycle. The new imv/imc-swima
    plugins replace the previous imv/imc-swid plugins, which were removed.
  * Added support for fuzzing the PA-TNC (RFC 5792) and PB-TNC (RFC 5793) NEA protocols
    on Google's OSS-Fuzz infrastructure.
  * Support for version 2 of Intel's TPM2-TSS TGC Software Stack. The presence of the
    in-kernel /dev/tpmrm0 resource manager is automatically detected.
  * The pki tool accepts a xmppAddr otherName as a subjectAlternativeName using the
    syntax --san xmppaddr:&lt;jid&gt;.
  * swanctl.conf supports the configuration of marks the in- and/or outbound SA should apply
    to packets after processing on Linux. Configuring such a mark for outbound SAs requires
    at least a 4.14 kernel. The ability to set a mask and configuring a mark/mask for
    inbound SAs will be added with the upcoming 4.19 kernel.
  * New options in swanctl.conf allow configuring how/whether DF, ECN and DS fields in the
    IP headers are copied during IPsec processing. Controlling this is currently only possible
    on Linux.
  * The handling of sequence numbers in IKEv1 DPDs has been improved (#2714).
  * To avoid conflicts, the dhcp plugin now only uses the DHCP server port if explicitly
    configured.
  - Version 5.6.3
  ===============
  * Fixed a DoS vulnerability in the IKEv2 key derivation if the openssl plugin is used in FIPS
    mode and HMAC-MD5 is negotiated as PRF.
    This vulnerability has been registered as CVE-2018-10811.
  * Fixed a vulnerability in the stroke plugin, which did not check the received length before
    reading a message from the socket. Unless a group is configured, root privileges are
    required to access that socket, so in the default configuration this shouldn't be an issue.
    This vulnerability has been registered as CVE-2018-5388.
  * CRLs that are not yet valid are now ignored to avoid problems in scenarios where expired
    certificates are removed from new CRLs and the clock on the host doing the revocation
    check is trailing behind that of the host issuing CRLs. Not doing this could result in
    accepting a revoked and expired certificate, if it's still valid according to the
    trailing clock but not contained anymore in not yet valid CRLs.
  * The issuer of fetched CRLs is now compared to the issuer of the checked certificate (#2608).
  * CRL validation results other than revocation (e.g. a skipped check because the CRL couldn't
    be fetched) are now stored also for intermediate CA certificates and not only for end-entity
    certificates, so a strict CRL policy can be enforced in such cases.
  * In compliance with RFC 4945, section 5.1.3.2, certificates used for IKE must now either
    not contain a keyUsage extension (like the ones generated by pki), or have at least one of the
    digitalSignature or nonRepudiation bits set.
  * New options for vici/swanctl allow forcing the local termination of an IKE_SA. This might be
    useful in situations where it's known the other end is not reachable anymore, or that it
    already removed the IKE_SA, so retransmitting a DELETE and waiting for a response would
    be pointless.
  * Waiting only a certain amount of time for a response (i.e. shorter than all retransmits
    would be) before destroying the IKE_SA is also possible by additionally specifying a
    timeout in the forced termination request.
  * When removing routes, the kernel-netlink plugin now checks if it tracks other routes for
    the same destination and replaces the installed route instead of just removing it. Same
    during installation, where existing routes previously weren't replaced. This should allow
    using traps with virtual IPs on Linux (#2162).
  * The dhcp plugin now only sends the client identifier DHCP option if the identity_lease
    setting is enabled (7b660944b6). It can also send identities of up to 255 bytes length,
    instead of the previous 64 bytes (30e886fe3b, 0e5b94d038). If a server address is
    configured, DHCP requests are now sent from port 67 instead of 68 to avoid ICMP port
    unreachables (becf027cd9).
  * The handling of faulty INVALID_KE_PAYLOAD notifies (e.g. one containing a DH group
    that wasn't proposed) during CREATE_CHILD_SA exchanges has been improved (#2536).
  * Roam events are now completely ignored for IKEv1 SAs (there is no MOBIKE to handle such
    changes properly).
  * ChaCha20/Poly1305 is now correctly proposed without key length (#2614). For compatibility with
    older releases the chacha20poly1305compat keyword may be included in proposals to also propose
    the algorithm with a key length (c58434aeff).
  * Configuration of hardware offload of IPsec SAs is now more flexible and allows a new
    setting (auto), which automatically uses it if the kernel and device both support it. If hw
    offload is set to yes and offloading is not supported, the CHILD_SA installation now fails.
  * The kernel-pfkey plugin optionally installs routes via internal interface (one with an IP
    in the local traffic selector). On FreeBSD, enabling this selects the correct source IP
    when sending packets from the gateway itself (e811659323).
  * SHA-2 based PRFs are supported in PKCS#8 files as generated by OpenSSL 1.1 (#2574).
  * The pki --verify tool may load CA certificates and CRLs from directories.
  * The IKE daemon now also switches to port 4500 if the remote port is not 500 (e.g. because the
    remote maps the response to a different port, as might happen on Azure), as long as the local
    port is 500 (85bfab621d).
  * Fixed an issue with DNS servers passed to NetworkManager in charon-nm (ee8c25516a).
  * Logged traffic selectors now always contain the protocol if either protocol or port are set
    (a36d8097ed).
  * Only the inbound SA/policy will be updated as reaction to IP address changes for rekeyed
    CHILD_SAs that are kept around.
  * The parser for strongswan.conf/swanctl.conf now accepts = characters in values without
    having to put the value in quotes (e.g. for Base64 encoded shared secrets).
    Notes for developers:
  * trap_manager_t: Trap policies are now unistalled by peer/child name and not the reqid.
  * No reqid is returned anymore when installing trap policies.
  * child_sa_t: A new state (CHILD_DELETED) is used for CHILD_SAs that have been deleted but
    not yet destroyed (after a rekeying CHILD_SAs are kept around for a while to process
    delayed packets).
    This way child_updown events are not triggered anymore for such SAs when an IKE_SA that
    has such CHILD_SAs assigned is deleted.
  - Version 5.6.2
  ===============
  * Fixed a DoS vulnerability in the parser for PKCS#1 RSASSA-PSS signatures that was caused
    by insufficient input validation. One of the configurable parameters in algorithm identifier
    structures for RSASSA-PSS signatures is the mask generation function (MGF). Only MGF1 is
    currently specified for this purpose. However, this in turn takes itself a parameter that
    specifies the underlying hash function. strongSwan's parser did not correctly handle the
    case of this parameter being absent, causing an undefined data read.
    This vulnerability has been registered as CVE-2018-6459.
  * When rekeying IKEv2 IKE_SAs the previously negotiated DH group will be reused, instead of
    using the first configured group, which avoids an additional exchange if the peer previously
    selected a different DH group via INVALID_KE_PAYLOAD notify. The same is also done when
    rekeying CHILD_SAs except for the first rekeying of the CHILD_SA that was created with the
    IKE_SA, where no DH group was negotiated yet.
    Also, the selected DH group is moved to the front in all sent proposals that contain it
    and all proposals that don't are moved to the back in order to convey the preference for
    this group to the peer.
  * Handling of MOBIKE task queuing has been improved. In particular, the response to an
    address update (with NAT-D payloads) is not ignored anymore if only an address list update
    or DPD is queued as that could prevent updating the UDP encapsulation in the kernel.
  * On Linux, roam events may optionally be triggered by changes to the routing rules, which
    can be useful if routing rules (instead of e.g. route metrics) are used to switch from one
    to another interface (i.e. from one to another routing table). Since routing rules are
    currently not evaluated when doing route lookups this is only useful if the kernel-based
    route lookup is used (4664992f7d).
  * The fallback drop policies installed to avoid traffic leaks when replacing addresses in
    installed policies are now replaced by temporary drop policies, which also prevent
    acquires because we currently delete and reinstall IPsec SAs to update their addresses
    (35ef1b032d).
  * Access X.509 certificates held in non-volatile storage of a TPM 2.0 referenced via the
    NV index.
    Adding the --keyid parameter to pki --print allows to print private keys or certificates
    stored in a smartcard or a TPM 2.0.
  * Fixed proposal selection if a peer incorrectly sends DH groups in the ESP proposal during
    IKE_AUTH and also if a DH group is configured in the local ESP proposal and charon.prefer
    configured_proposals is disabled (d058fd3c32).
  * The lookup for PSK secrets for IKEv1 has been improved for certain scenarios (see #2497
    for details).
  * MSKs received via RADIUS are now padded to 64 bytes to avoid compatibility issues with
    EAP-MSCHAPv2 and PRFs that have a block size &lt; 64 bytes (e.g. AES-XCBC-PRF-128, see
    73cbce6013).
  * The tpm_extendpcr command line tool extends a digest into a TPM PCR.
  * Ported the NetworkManager backend from the deprecated libnm-glib to libnm.
  * The save-keys debugging/development plugin saves IKE and/or ESP keys to files compatible
    with Wireshark.
  - Version 5.6.1
  ===============
  * Several algorithms were removed from the default ESP/AH and IKE proposals in compliance with
    RFC 8221 and RFC 8247, respectively. Removed from the default ESP/AH proposal were the
    3DES and Blowfish encryption algorithms and the HMAC-MD5 integrity algorithm. From the IKE
    default proposal the HMAC-MD5 integrity algorithm and the MODP-1024 Diffie-Hellman group
    were removed (the latter is significant for Windows clients in their default configuration).
    These algorithms may still be used in custom proposals.
  * Support for RSASSA-PSS signatures has been added. For compatibility with previous
    releases they are currently not used automatically, by default, to change that charon.rsa_pss
    may be enabled. To explicitly use or require such signatures during IKEv2 signature
    authentication (RFC 7427) ike:rsa/pss... authentication constraints may be used for specific
    connections (regardless of whether the strongswan.conf option above is enabled). Only the
    hash algorithm can be specified in such constraints, the MGF1 will be based on that hash
    and the salt length will equal the hash length (when verifying the salt length is not
    enforced).
    To enforce such signatures during PKI verification use rsa/pss... authentication constraints.
  * All pki commands that create certificates/CRLs can be made to sign with RSASSA-PSS instead
    of the classing PKCS#1 scheme with the --rsa-padding pss option. As with signatures during
    authentication, only the hash algorithm is configurable (via --digest option), the MGF1 will
    be based on that and the salt length will equal the hash length.
  * These signatures are supported by all RSA backends except pkcs11 (i.e. gmp, gcrypt, openssl).
    The gmp plugin requires the mgf1 plugin.
    Note that RSASSA-PSS algorithm identifiers and parameters in keys (public keys in
    certificates or private keys in PKCS#8 files) are currently not used as constraints.
  * The sec-updater tool checks for security updates in dpkg-based repositories
    (e.g. Debian/Ubuntu) and sets the security flags in the IMV policy database accordingly.
    Additionally for each new package version a SWID tag for the given OS and HW architecture
    is created and stored in the database.
  * Using the sec-updater.sh script template the lookup can be automated (e.g. via an hourly
    cron job).
  * When restarting an IKEv2 negotiation after receiving an INVALID_KE_PAYLOAD notify (or due
    to other reasons like too many retransmits) a new initiator SPI is allocated. This
    prevents issues caused by retransmits for IKE_SA_INIT messages.
  * Because the initiator SPI was previously reused when restarting the connection delayed
    responses for previous connection attempts were processed and might have caused fatal
    errors due to a failed DH negotiation or because of the internal retry counter in the
    ike-init task. For instance, if we proposed a DH group the responder rejected we
    might have later received delayed responses that either contained INVALID_KE_PAYLOAD
    notifies with the DH group we already switched to, or, if we retransmitted an
    IKE_SA_INIT with the requested group but then had to restart again, a KE payload with
    a group different from the one we proposed.
  * The introduction of file versions in the IMV database scheme broke file reference hash
    measurements. This has been fixed by creating generic product versions having an empty
    package name.
  * A new timeout option for the systime-fix plugin stops periodic system time checks after
    a while and enforces a certificate verification, closing or reauthenticating all SAs
    with invalid certificates.
  * The IKE event counters, previously only available via ipsec listcounters command, may
    now also be queried and reset via vici and the new swanctl --counters command. They
    are collected and provided by the optional counters plugin (enabled by default for
    backwards compatibility if the stroke plugin is built).
  * Class attributes received in RADIUS Access-Accept messages may optionally be added to
    RADIUS accounting messages (655924074b).
  * Basic support for systemd sockets has been added, which may be used for privilege separation
    (59db98fb94).
  * Inbound marks may optionally be installed in the SA again (was removed with 5.5.2) by
    enabling the mark_in_sa option in swanctl.conf.
  * The timeout of leases in pools configured via pool utility may be configured in other
    units than hours.
    INITIAL_CONTACT notifies are now only omitted if never is configured as uniqueness policy.
  * Outbound FWD policies for shunts are not installed anymore, by default (as is the case
    for other policies since 5.5.1).
  * Don't consider a DH group mismatch during CHILD_SA rekeying as failure as responder
    (e7276f78aa).
  * Handling of fragmented IPv4 and IPv6 packets in libipsec has been improved (e138003de9).
  * Trigger expire events for the correct IPsec SA in libipsec (6e861947a0).
  * A crash in CRL verification via openssl plugin using OpenSSL 1.1 has been fixed (78acaba6a1).
  * No hard-coded default proposals are passed from starter to the stroke plugin anymore (the
    IKE proposal used curve25519 since 5.5.2, which is an optional plugin).
  * A workaround for an issue with virtual IPs on macOS 10.13 (High Sierra) has been added
    (039b85dd43).
  * Handling of IKE_SA rekey collisions in charon-tkm has been fixed.
  * Instead of failing or just silently doing nothing unit tests may now warn about certain
    conditions (e.g. if a test was not executed due to external dependencies).</changelog>
  <changelog author="mmnelemane@suse.com" date="1585224000">- Fix for to resolve multiple definition of swanctl_dir (bsc #1164493)
  [+ 0006-Resolve-multiple-definition-of-swanctl_dir.patch]</changelog>
  <changelog author="mbuil@suse.com" date="1610712000">- Fix typo in README (bsc #1167880)
  [+ 0007-Fix-typo-in-README.patch ]</changelog>
  <changelog author="mbuil@suse.com" date="1611576000">- Fix FIPS bug (bsc #1180801)
  [+ 0008-gcrypt-Use-a-dummy-buffer-to-initialize-static-alloc.patch ]</changelog>
  <changelog author="mbuil@suse.com" date="1617019200">- Keep using ipsec as the main binary. Therefore, make strongswan.service point to it instead of swanctl</changelog>
  <changelog author="mbuil@suse.com" date="1617019201">- Information added in README about the rcstrongswan-starter</changelog>
  <changelog author="mbuil@suse.com" date="1617624000">- Add config to run ipsec on namespaces (bsc #1183670)</changelog>
  <changelog author="mt@suse.com" date="1619006400">- Add support for AES CCM aead algorithms to openssl plugin (cc/fips,bsc#1185363)
  [+ 0009-strongswan-openssl-aead-add-ccm-support.patch]</changelog>
  <changelog author="mt@suse.com" date="1620388800">- Replace AEAD AES CCM patch with upstream variant (cc/fips,bsc#1185363)
  [* 0009-strongswan-openssl-aead-add-ccm-support.patch]</changelog>
  <changelog author="hare@suse.de" date="1627646400">- Add auth_els plugin to support Marvell FC-SP encryption (jsc#SLE-20151)
  [* strongswan-marvell-auth-els.patch]</changelog>
  <changelog author="abergmann@suse.com" date="1634040000">- Fix integer overflow in gmp plugin (bsc#1191367, CVE-2021-41990)
  [* strongswan-5.6.1-5.9.3_gmp-rsa-ssa-salt-len.patch]
- Fix integer overflow when replacing certificates in cache (bsc#1191435, CVE-2021-41991)
  [* strongswan-4.4.1-5.9.3_cert-cache-random.patch]</changelog>
  <changelog author="meissner@suse.com" date="1643025600">- strongswan-5.5.0-5.9.4_eap_success-CVE-2021-45079.patch:
  Fixed authentication bypass in EAP authentication (CVE-2021-45079
  bsc#1194471)</changelog>
</package>
<package pkgid="b2f77a32f4906c83eb51a9478eb0ceb4bb8356443586f843789908287578970b" name="strongswan-ipsec" arch="ppc64le">
  <version epoch="0" ver="5.8.2" rel="11.24.1"/>
  <changelog author="ndas@suse.de" date="1501502400">- Updated to strongSwan 5.3.5(bsc#1050691) providing the following changes:
  * Fixed a DoS vulnerability in the gmp plugin that was caused by insufficient input
    validation when verifying RSA signatures. More specifically, mpz_powm_sec() has two
    requirements regarding the passed exponent and modulus that the plugin did not
    enforce, if these are not met the calculation will result in a floating point exception
    that crashes the whole process.
    This vulnerability has been registered as CVE-2017-9022.
    Please refer to our blog for details.
  * Fixed a DoS vulnerability in the x509 plugin that was caused because the ASN.1 parser
    didn't handle ASN.1 CHOICE types properly, which could result in an infinite loop when
    parsing X.509 extensions that use such types.
    This vulnerability has been registered as CVE-2017-9023.
    Please refer to our blog for details.
  * The behavior during IKEv2 CHILD_SA rekeying has been changed in order to avoid
    traffic loss. When responding to a CREATE_CHILD_SA request to rekey a CHILD_SA
    the responder already has everything available to install and use the new CHILD_SA.
    However, this could lead to lost traffic as the initiator won't be able to process
    inbound packets until it processed the CREATE_CHILD_SA response and updated the
    inbound SA. To avoid this the responder now only installs the new inbound SA and
    delays installing the outbound SA until it receives the DELETE for the replaced CHILD_SA.
  * The messages transporting these DELETEs could reach the peer before packets sent
    with the deleted outbound SAs reach it. To reduce the chance of traffic loss due
    to this the inbound SA of the replaced CHILD_SA is not removed for a configurable
    amount of seconds (charon.delete_rekeyed_delay) after the DELETE has been processed.
  * The code base has been ported to Apple's ARM64 iOS platform, which required several
    changes regarding the use of variadic functions. This was necessary because the calling
    conventions for variadic and regular functions are different there.
    This means that assigning a non-variadic function to a variadic function pointer, as we
    did with our enumerator_t::enumerate() implementations and several callbacks, will
    result in crashes as the called function accesses the arguments differently than the
    caller provided them. To avoid this issue the enumerator_t interface has been changed
    and the signature of the callback functions for enumerator_create_filter() and two
    methods on linked_list_t have been changed. Refer to the developer notes below
    for details.
  * Adds support for fuzzing the certificate parser provided by the default plugins
    (x509, pem, gmp etc.) on Google's OSS-Fuzz infrastructure (or generally with
    libFuzzer). Several issues found while fuzzing these plugins were fixed.
  * Two new options have been added to charon's retransmission settings:
    retransmit_limit and retransmit_jitter. The former adds an upper limit to the
    calculated retransmission timeout, the latter randomly reduces it.
    Refer to Retransmission for details.
  * A bug in swanctl's --load-creds command was fixed that caused unencrypted
    private keys to get unloaded if the command was called multiple times.
    The load-key VICI command now returns the key ID of the loaded key on success.
  * The credential manager now enumerates local credential sets before global ones.
    This means certificates supplied by the peer will now be preferred over certificates
    with the same identity that may be locally stored (e.g. in the certificate cache).
  * Adds support for hardware offload of IPsec SAs as introduced by Linux 4.11 for
    specific hardware that supports this.
  * The pki tool loads the curve25519 plugin by default.
    [- 0006-Make-sure-the-modulus-is-odd-and-the-exponent-not-zero.patch,
  - 0007-asn1-parser-Fix-CHOICE-parsing.patch]
- libhydra is removed as all kernel plugins moved to libcharon</changelog>
  <changelog author="ndas@suse.de" date="1504612800">- fix "uintptr_t? undeclared" compilation error.
  [+0006-fix-compilation-error-by-adding-stdint.h.patch]</changelog>
  <changelog author="ndas@suse.de" date="1504612801">- Updated to strongSwan 5.6.0 providing the following changes:
  * Fixed a DoS vulnerability in the gmp plugin that was caused by insufficient input validation
    when verifying RSA signatures, which requires decryption with the operation m^e mod n,
    where m is the signature, and e and n are the exponent and modulus of the public key.
    The value m is an integer between 0 and n-1, however, the gmp plugin did not verify this.
    So if m equals n the calculation results in 0, in which case mpz_export() returns NULL.
    This result wasn't handled properly causing a null-pointer dereference.
    This vulnerability has been registered as CVE-2017-11185. (bsc#1051222)
  * New SWIMA IMC/IMV pair implements the draft-ietf-sacm-nea-swima-patnc Internet
    Draft and has been demonstrated at the IETF 99 Prague Hackathon.
  * The IMV database template has been adapted to achieve full compliance with the
    ISO 19770-2:2015 SWID tag standard.
  * The pt-tls-client can attach and use TPM 2.0 protected private keys via the --keyid parameter.
  * By default the /etc/swanctl/conf.d directory is created and *.conf files in it are included in the default
    swanctl.conf file.
  * The curl plugin now follows HTTP redirects (configurable via strongswan.conf).
  * The CHILD_SA rekeying was fixed in charon-tkm and the behavior is refined a bit more since 5.5.3
  * libtpmtss supports Intel's TSS2 Architecture Broker and Resource Manager interface (tcti-tabrmd).
  * more on https://wiki.strongswan.org/versions/66</changelog>
  <changelog author="mmnelemane@suse.com" date="1521028800">- Removed unused requires and macro calls(bsc#1083261)</changelog>
  <changelog author="mmnelemane@suse.com" date="1573646400">- Added patch to fix vulnerability: CVE-2018-16151,CVE-2018-16152 (bsc#1107874)
  - Insufficient input validation in gmp plugin
  [+ 0007-strongswan-5.3.1-5.6.0_gmp-pkcs1-verify.patch]</changelog>
  <changelog author="mmnelemane@suse.com" date="1573646401">- Added patch to fix vulnerability: CVE-2018-5388 (bsc#1094462)
  - Buffer Underflow in stroke_socket.c
  [+ 0008-strongswan-5.1.2-5.6.2_stroke_msg_len.patch]</changelog>
  <changelog author="mmnelemane@suse.com" date="1573646402">- Added patch to fix vulnerability: CVE-2018-10811 (bsc#1093536)
  - denial-of-service vulnerability
  [+ 0009-strongswan-5.5.0-5.6.2_skeyseed_init.patch]</changelog>
  <changelog author="mmnelemane@suse.com" date="1573732800">- Added patch to fix vulnerability: CVE-2018-17540 (bsc#1109845)
  [+ 0010-strongswan-4.4.0-5.7.0_gmp-pkcs1-overflow.patch]</changelog>
  <changelog author="mmnelemane@suse.com" date="1580212800">- Updated to version 5.8.2 (jsc#SLE-11370)
  - Dropped following patches due to irrelevance in the updated version:
    [- strongswan_modprobe_syslog.patch ]
    [- strongswan_fipsfilter.patch ]
    [- 0006-fix-compilation-error-by-adding-stdint.h.patch ]
    [- 0007-strongswan-5.3.1-5.6.0_gmp-pkcs1-verify.patch ]
    [- 0008-strongswan-5.1.2-5.6.2_stroke_msg_len.patch ]
    [- 0009-strongswan-5.5.0-5.6.2_skeyseed_init.patch ]
    [- 0010-strongswan-4.4.0-5.7.0_gmp-pkcs1-overflow.patch ]
  - Version 5.8.2
  ===============
  * Identity-based CA constraints, which enforce that the certificate chain of the remote
    peer contains a CA certificate with a specific identity, are supported via
    vici/swanctl.conf. This is similar to the existing CA constraints but doesn't require
    that the CA certificate is locally installed, for instance, intermediate CA certificates
    received from the peers. Wildcard identity matching (e.g. ..., OU=Research, CN=*) could
    also be used for the latter but requires trust in the intermediate CAs to only issue
    certificates with legitimate subject DNs (e.g. the "Sales" CA must not issue certificates
    with OU=Research). With the new constraint that's not necessary as long as a path length
    basic constraint (--pathlen for pki --issue) prevents intermediate CAs from issuing further
    intermediate CAs.
  * Intermediate CA certificates may now be sent in hash-and-URL encoding by configuring a
    base URL for the parent CA (#3234, swanctl/rw-hash-and-url-multi-level).
  * Implemented NIST SP-800-90A Deterministic Random Bit Generator (DRBG) based on AES-CTR
    and SHA2-HMAC modes. Currently used by the gmp and ntru plugins.
  * Random nonces sent in an OCSP requests are now expected in the corresponding OCSP responses.
  * The kernel-netlink plugin now ignores deprecated IPv6 addresses for MOBIKE. Whether temporary
    or permanent IPv6 addresses are included now depends on the charon.prefer_temporary_addrs
    setting (#3192).
  * Extended Sequence Numbers (ESN) are configured via PF_KEY if supported by the kernel.
  * The PF_KEY socket's receive buffer in the kernel-pfkey plugin is now cleared before sending
    requests, as many of the messages sent by the kernel are sent as broadcasts to all PF_KEY
    sockets. This is an issue if an external tool is used to manage SAs/policies unrelated to
    IPsec (#3225).
  * The vici plugin now uses unique section names for CHILD_SAs in child-updown events (7c74ce9190).
  * For individually deleted CHILD_SAs (in particular for IKEv1) the vici child-updown event
    now includes more information about the CHILD_SAs such as traffic statistics (#3198).
  * Custom loggers are correctly re-registered if log levels are changed via stroke loglevel (#3182).
  * Avoid lockups during startup on low entropy systems when using OpenSSL 1.1.1 (095a2c2eac).
  * Instead of failing later when setting a key, creating HMACs via openssl plugin now fails
    instantly if the underlying hash algorithm isn't supported (e.g. MD5 in FIPS-mode) so fallbacks
    to other plugins work properly (#3284).
  * Exponents of RSA keys read from TPM 2.0 via SAPI are correctly converted (8ee1242f1438).
  * Routing table IDs &gt; 255 are supported for custom routes on Linux.
  * To avoid races, the check for hardware offloading support in the kernel-netlink plugin is
    performed during initialization of the plugin (a605452c03).
  * The D-Bus config file for charon-nm is now installed in $(datadir)/dbus-1/system.d instead of
    $(sysconfdir)/dbus-1/system.d, which is intended for sysadmin overrides.
    INVALID_MAJOR_VERSION notifies are now correctly sent in messages of the same exchange type
    and with the same message ID as the request.
  * IKEv2 SAs are now immediately destroyed when sending or receiving INVALID_SYNTAX notifies
    in authenticated messages.
  * For developers working from the repository the configure script now aborts if GNU gperf is
    not found.
  - Version 5.8.1
  ===============
  * RDNs in DNs of X.509 certificates can now optionally be matched less strict. The global
    strongswan.conf option charon.rdn_matching takes two alternative values that cause the
    matching algorithm to either ignore the order of matched RDNs (reordered) or additionally
    (relaxed) accept DNs that contain more RDNs than configured (unmatched RDNs are treated
    like wildcard matches).
  * The updown plugin now passes the same interface to the script that is also used for the
    automatically installed routes, that is, the interface over which the peer is reached
    instead of the interface on which the local address is found (#3095).
  * TPM 2.0 contexts are now protected by a mutex to prevent issues if multiple IKE_SAs use
    the same private key concurrently (4b25885025).
  * Do a rekey check after the third QM message was received (#3060).
  * If available, explicit_bzero() is now used as memwipe() instead of our own implementation.
  * An .editorconfig file has been added, mainly so Github shows files with proper indentation
    (68346b6962).
  * The internal certificate of the load-tester plugin has been modified so it can again be
    used as end-entity cert with 5.6.3 and later (#3139).
  * The maximum data length of received COOKIE notifies (64 bytes) is now enforced (#3160).
  - Version 5.8.0
  ===============
  * The systemd service units have been renamed. The modern unit, which was called
    strongswan-swanctl, is now called strongswan (the previous name is configured as alias in
    the unit, for which a symlink is created when the unit is enabled). The legacy unit is now
    called strongswan-starter.
  * Support for XFRM interfaces (available since Linux 4.19) has been added, which are intended
    to replace VTI devices (they are similar but offer several advantages, for instance, they
    are not bound to an address or address family).
  * IPsec SAs and policies are associated with such interfaces via interface IDs that can be
    configured in swanctl.conf (dynamic IDs may optionally be allocated for each SA and even
    direction). It's possible to use separate interfaces for in- and outbound traffic (or
    only use an interface in one direction and regular policies in the other).
  * Interfaces may be created dynamically via updown/vici scripts, or statically before or after
    establishing the SAs. Routes must be added manually as needed (the daemon will not install
    any routes for outbound policies with an interface ID).
  * When moving XFRM interfaces to other network namespaces they retain access to the SAs and
    policies installed in the original namespace, which allows providing IPsec tunnels for
    processes in other network namespaces without giving them access to the IPsec keys or
    IKE credentials.
    More information can be found on the page about route-based VPNs.
  * Initiation of childless IKE_SAs is supported (RFC 6023). If enabled and supported by the
    responder, no CHILD_SA is established during IKE_AUTH. Instead, all CHILD_SAs are created
    with CREATE_CHILD_SA exchanges. This allows using a separate DH exchange even for the
    first CHILD_SA, which is otherwise created during IKE_AUTH with keys derived from the
    IKE_SA's key material.
  * The swanctl --initiate command may be used to initiate only the IKE_SA via --ike
    option if --child is omitted and the peer supports this extension.
  * The NetworkManager backend and plugin support IPv6.
  * The new wolfssl plugin is a wrapper around the wolfSSL crypto library. Thanks to Sean
    Parkinson of wolfSSL Inc. for the initial patch.
  * IKE SPIs may optionally be labeled via the charon.spi_mask|label options in
    strongswan.conf. This feature was extracted from charon-tkm, however, now applies the
    mask/label in network order.
  * The openssl plugin supports ChaCha20-Poly1305 when built with OpenSSL 1.1.0.
  * The PB-TNC finite state machine according to section 3.2 of RFC 5793 was not correctly
    implemented when sending either a CRETRY or SRETRY batch. These batches can only be sent
    in the "Decided" state and a CRETRY batch can immediately carry all messages usually
    transported by a CDATA batch. It is currently not possible to send a SRETRY batch since
    full-duplex mode for PT-TLS transport is not supported.
  * Instead of marking IPv6 virtual IPs as deprecated, the kernel-netlink plugin now uses
    address labels to avoid that such addresses are used for non-VPN traffic (00a953d090).
  * The agent plugin now creates sockets to the ssh/gpg-agent dynamically and does not keep
    them open, which otherwise might prevent the agent from getting terminated.
  * To avoid broadcast loops the forecast plugin now only reinjects packets that are marked
    or received from the configured interface.
  * UTF-8 encoded passwords are supported via EAP-MSCHAPv2, which internally uses an UTF-16LE
    encoding to calculate the NT hash (#3014).
  * Properly delete temporary drop policies (used when updating IP addresses of SAs) if manual
    priorities are used, which was broken since 5.6.2 (8e31d65730).
  * Avoid overwriting start_action when parsing the inactivity timeout in the vici plugin (#2954).
  * Fixed the automatic termination of reloaded vici connections with start_action=start,
    which was broken since 5.6.3 (71b22c250f).
  * The lookup for shared secrets for IKEv1 SAs via sql plugin should now work better
    (6ec9f68f32).
  * Fixed a race condition in the trap manager between installation and removal of a policy
    (69cbe2ca3f).
  * Compilation of the kernel-netlink plugin has been fixed on old kernels (&lt; 2.6.39), which
    was caused by the HW offload changes (c7f579fa17).
  * The IPsec stack detection and module loading in starter has been removed (it wasn't
    enforced anyway and loading modules doesn't seem necessary, also KLIPS hasn't been
    supported for a long time and PF_KEY will eventually be removed from the Linux kernel,
    ba817d2917).
  * Several IKEv2 protocol details are now handled more strictly: Unrequested virtual IPs are
    ignored, CFG_REPLY payloads are ignored if no CFG_REQUEST payloads were sent, a USE
    TRANSPORT_MODE notify received from the responder is checked against the local configuration.
  * The keys and certificates used by the scenarios in the testing environment are now generated
    dynamically. Running the testing/scripts/build-certs script after creating the base and root
    images uses the pki utility installed in the latter to create the keys and certificates for
    all the CAs and in some cases for individual scenarios. These credentials are stored in the
    source tree, not the image, so this has to be called only once even if the images are later
    rebuilt. The script automatically (re-)rebuilds the guest images as that generates fresh
    CRLs and signs the DNS zones. The only keys/certificates currently not generated are the
    very large ones used by the ikev2/rw-eap-tls-fragments scenario.
  - Version 5.7.2
  ===============
  * For RSA with PSS padding, the TPM 2.0 specification mandates the maximum salt length
    (as defined by the length of the key and hash). However, if the TPM is FIPS-168-4 compliant,
    the salt length equals the hash length. This is assumed for FIPS-140-2 compliant TPMs, but
    if that's not the case, it might be necessary to manually enable charon.plugins.tpm.fips_186_4
    if the TPM doesn't use the maximum salt length.
  * Directories for credentials loaded by swanctl are now accessed relative to the loaded
    swanctl.conf file, in particular, when loading it from a custom location via --file argument.
  * The base directory, which is used if no custom location for swanctl.conf is specified, is now
    also configurable at runtime via SWANCTL_DIR environment variable.
  * If RADIUS Accounting is enabled, the eap-radius plugin will add the session ID (Acct-Session-Id)
    to Access-Request messages, which e.g. simplifies associating database entries for IP leases and
    accounting with sessions (the session ID does not change when IKE_SAs are rekeyed, #2853).
  * All IP addresses assigned by a RADIUS server are included in Accounting-Stop messages even if
    the client did not claim them, allowing to release them early in case of connection errors (#2856).
  * Selectors installed on transport mode SAs by the kernel-netlink plugin are now updated if an
    IP address changes (e.g. via MOBIKE) and it was part of the selectors.
  * No deletes are sent anymore when a rekeyed CHILD_SA expires (#2815).
  * The bypass-lan plugin now tracks interfaces to handle subnets that move from one interface
    to another and properly update associated routes (#2820).
  * Only valid and expected inbound IKEv2 messages are used to update the timestamp of the
    last received message (previously, retransmits also triggered an update).
  * IKEv2 requests from responders are now ignored until the IKE_SA is fully established (e.g. if a
    DPD request from the peer arrives before the IKE_AUTH response does, 46bea1add9).
    Delayed IKE_SA_INIT responses with COOKIE notifies we already recevied are ignored, they caused
    another reset of the IKE_SA previously (#2837).
  * Active and queued Quick Mode tasks are now adopted if the peer reauthenticates an IKEv1 SA
    while creating lots of CHILD_SAs.
  * Newer versions of the FreeBSD kernel add an SADB_X_EXT_SA2 extension to SADB_ACQUIRE
    messages, which allows the kernel-pfkey plugin to determine the reqid of the policy even if it
    wasn't installed by the daemon previously (e.g. when using FreeBSD's if_ipsec(4) VTIs, which
    install policies themselves, 872b9b3e8d).
  * Added support for RSA signatures with SHA-256 and SHA-512 to the agent plugin. For older
    versions of ssh/gpg-agent that only support SHA-1, IKEv2 signature authentication has to be
    disabled via charon.signature_authentication.
  * The sshkey and agent plugins support Ed25519/Ed448 SSH keys and signatures.
  * The openssl plugin supports X25519/X448 Diffie-Hellman and Ed25519/Ed448 keys and
    signatures when built against OpenSSL 1.1.1.
  * Support for Ed25519, ChaCha20/Poly1305, SHA-3 and AES-CCM were added to the botan plugin.
  * The mysql plugin now properly handles database connections with transactions
    under heavy load (#2779).
  * IP addresses in ha pools are now distributed evenly among all segments (#2828).
  * Private key implementations may optionally provide a list of supported signature schemes,
    which, as described above, is used by the tpm plugin because for each key on a TPM 2.0 the
    hash algorithm and for RSA also the padding scheme is predefined.
  * The testing environment is now based on Debian 9 (stretch) by default. This required
    some changes, in particular, updating to FreeRADIUS 3.x (which forced us to abandon the
    TNC@FHH patches and scenarios, 2fbe44bef3) and removing FIPS-enabled versions of
    OpenSSL (the FIPS module only supports OpenSSL 1.0.2).
  * Most test scenarios were migrated to swanctl.
  - Version 5.7.1
  ===============
  * Fixes a vulnerability in the gmp plugin triggered by crafted certificates with RSA keys with
    very small moduli. When verifying signatures with such keys, the code patched with the fix
    for CVE-2018-16151/2 caused an integer underflow and subsequent heap buffer overflow
    that results in a crash of the daemon.
  * The vulnerability has been registered as CVE-2018-17540.
  - Version 5.7.0
  ===============
  * Fixes a potential authorization bypass vulnerability in the gmp plugin that was caused by a
    too lenient verification of PKCS#1 v1.5 signatures. Several flaws could be exploited by a
    Bleichenbacher-style attack to forge signatures for low-exponent keys (i.e. with e=3).
  * CVE-2018-16151 has been assigned to the problem of accepting random bytes after the OID
    of the hash function in such signatures, and CVE-2018-16152 has been assigned to the issue
    of not verifying that the parameters in the ASN.1 algorithmIdentitifer structure is empty.
    Other flaws that don't lead to a vulnerability directly (e.g. not checking for at least
    8 bytes of padding) have no separate CVE assigned.
  * Dots are not allowed anymore in section names in swanctl.conf and strongswan.conf.
    This mainly affects the configuration of file loggers. If the path for such a log file
    contains dots it now has to be configured in the new path setting within the arbitrarily
    renamed subsection in the filelog section.
  * Sections in swanctl.conf and strongswan.conf may now reference other sections. All settings
    and subsections from such a section are inherited. This allows to simplify configs as
    redundant information has only to be specified once and may then be included in other
    sections (see strongswan.conf for an example).
  * The originally selected IKE config (based on the IPs and IKE version) can now change
    if no matching algorithm proposal is found. This way the order of the configs doesn't
    matter that much anymore and it's easily possible to specify separate configs for
    clients that require weaker algorithms (instead of having to also add them in other
    configs that might be selected).
  * Support for Postquantum Preshared Keys for IKEv2 (draft-ietf-ipsecme-qr-ikev2) has been added.
    For an example refer to the swanctl/rw-cert-ppk scenario (or with EAP, or PSK authentication).
  * The new botan plugin is a wrapper around the Botan C++ crypto library.
    It requires a fairly recent build from Botan's master branch (or the upcoming 2.8.0 release).
    Thanks to René Korthaus and his team from Rohde &amp; Schwarz Cybersecurity for the initial
    patch and to Jack Lloyd for quickly adding missing functions to Botan's FFI (C89) interface.
  * Implementation of RFC 8412 "Software Inventory Message and Attributes (SWIMA) for PA-TNC".
  * SWIMA subscription option sets CLOSE_WRITE trigger on apt history.log file resulting in
    a ClientRetry PB-TNC batch to initialize a new measurement cycle. The new imv/imc-swima
    plugins replace the previous imv/imc-swid plugins, which were removed.
  * Added support for fuzzing the PA-TNC (RFC 5792) and PB-TNC (RFC 5793) NEA protocols
    on Google's OSS-Fuzz infrastructure.
  * Support for version 2 of Intel's TPM2-TSS TGC Software Stack. The presence of the
    in-kernel /dev/tpmrm0 resource manager is automatically detected.
  * The pki tool accepts a xmppAddr otherName as a subjectAlternativeName using the
    syntax --san xmppaddr:&lt;jid&gt;.
  * swanctl.conf supports the configuration of marks the in- and/or outbound SA should apply
    to packets after processing on Linux. Configuring such a mark for outbound SAs requires
    at least a 4.14 kernel. The ability to set a mask and configuring a mark/mask for
    inbound SAs will be added with the upcoming 4.19 kernel.
  * New options in swanctl.conf allow configuring how/whether DF, ECN and DS fields in the
    IP headers are copied during IPsec processing. Controlling this is currently only possible
    on Linux.
  * The handling of sequence numbers in IKEv1 DPDs has been improved (#2714).
  * To avoid conflicts, the dhcp plugin now only uses the DHCP server port if explicitly
    configured.
  - Version 5.6.3
  ===============
  * Fixed a DoS vulnerability in the IKEv2 key derivation if the openssl plugin is used in FIPS
    mode and HMAC-MD5 is negotiated as PRF.
    This vulnerability has been registered as CVE-2018-10811.
  * Fixed a vulnerability in the stroke plugin, which did not check the received length before
    reading a message from the socket. Unless a group is configured, root privileges are
    required to access that socket, so in the default configuration this shouldn't be an issue.
    This vulnerability has been registered as CVE-2018-5388.
  * CRLs that are not yet valid are now ignored to avoid problems in scenarios where expired
    certificates are removed from new CRLs and the clock on the host doing the revocation
    check is trailing behind that of the host issuing CRLs. Not doing this could result in
    accepting a revoked and expired certificate, if it's still valid according to the
    trailing clock but not contained anymore in not yet valid CRLs.
  * The issuer of fetched CRLs is now compared to the issuer of the checked certificate (#2608).
  * CRL validation results other than revocation (e.g. a skipped check because the CRL couldn't
    be fetched) are now stored also for intermediate CA certificates and not only for end-entity
    certificates, so a strict CRL policy can be enforced in such cases.
  * In compliance with RFC 4945, section 5.1.3.2, certificates used for IKE must now either
    not contain a keyUsage extension (like the ones generated by pki), or have at least one of the
    digitalSignature or nonRepudiation bits set.
  * New options for vici/swanctl allow forcing the local termination of an IKE_SA. This might be
    useful in situations where it's known the other end is not reachable anymore, or that it
    already removed the IKE_SA, so retransmitting a DELETE and waiting for a response would
    be pointless.
  * Waiting only a certain amount of time for a response (i.e. shorter than all retransmits
    would be) before destroying the IKE_SA is also possible by additionally specifying a
    timeout in the forced termination request.
  * When removing routes, the kernel-netlink plugin now checks if it tracks other routes for
    the same destination and replaces the installed route instead of just removing it. Same
    during installation, where existing routes previously weren't replaced. This should allow
    using traps with virtual IPs on Linux (#2162).
  * The dhcp plugin now only sends the client identifier DHCP option if the identity_lease
    setting is enabled (7b660944b6). It can also send identities of up to 255 bytes length,
    instead of the previous 64 bytes (30e886fe3b, 0e5b94d038). If a server address is
    configured, DHCP requests are now sent from port 67 instead of 68 to avoid ICMP port
    unreachables (becf027cd9).
  * The handling of faulty INVALID_KE_PAYLOAD notifies (e.g. one containing a DH group
    that wasn't proposed) during CREATE_CHILD_SA exchanges has been improved (#2536).
  * Roam events are now completely ignored for IKEv1 SAs (there is no MOBIKE to handle such
    changes properly).
  * ChaCha20/Poly1305 is now correctly proposed without key length (#2614). For compatibility with
    older releases the chacha20poly1305compat keyword may be included in proposals to also propose
    the algorithm with a key length (c58434aeff).
  * Configuration of hardware offload of IPsec SAs is now more flexible and allows a new
    setting (auto), which automatically uses it if the kernel and device both support it. If hw
    offload is set to yes and offloading is not supported, the CHILD_SA installation now fails.
  * The kernel-pfkey plugin optionally installs routes via internal interface (one with an IP
    in the local traffic selector). On FreeBSD, enabling this selects the correct source IP
    when sending packets from the gateway itself (e811659323).
  * SHA-2 based PRFs are supported in PKCS#8 files as generated by OpenSSL 1.1 (#2574).
  * The pki --verify tool may load CA certificates and CRLs from directories.
  * The IKE daemon now also switches to port 4500 if the remote port is not 500 (e.g. because the
    remote maps the response to a different port, as might happen on Azure), as long as the local
    port is 500 (85bfab621d).
  * Fixed an issue with DNS servers passed to NetworkManager in charon-nm (ee8c25516a).
  * Logged traffic selectors now always contain the protocol if either protocol or port are set
    (a36d8097ed).
  * Only the inbound SA/policy will be updated as reaction to IP address changes for rekeyed
    CHILD_SAs that are kept around.
  * The parser for strongswan.conf/swanctl.conf now accepts = characters in values without
    having to put the value in quotes (e.g. for Base64 encoded shared secrets).
    Notes for developers:
  * trap_manager_t: Trap policies are now unistalled by peer/child name and not the reqid.
  * No reqid is returned anymore when installing trap policies.
  * child_sa_t: A new state (CHILD_DELETED) is used for CHILD_SAs that have been deleted but
    not yet destroyed (after a rekeying CHILD_SAs are kept around for a while to process
    delayed packets).
    This way child_updown events are not triggered anymore for such SAs when an IKE_SA that
    has such CHILD_SAs assigned is deleted.
  - Version 5.6.2
  ===============
  * Fixed a DoS vulnerability in the parser for PKCS#1 RSASSA-PSS signatures that was caused
    by insufficient input validation. One of the configurable parameters in algorithm identifier
    structures for RSASSA-PSS signatures is the mask generation function (MGF). Only MGF1 is
    currently specified for this purpose. However, this in turn takes itself a parameter that
    specifies the underlying hash function. strongSwan's parser did not correctly handle the
    case of this parameter being absent, causing an undefined data read.
    This vulnerability has been registered as CVE-2018-6459.
  * When rekeying IKEv2 IKE_SAs the previously negotiated DH group will be reused, instead of
    using the first configured group, which avoids an additional exchange if the peer previously
    selected a different DH group via INVALID_KE_PAYLOAD notify. The same is also done when
    rekeying CHILD_SAs except for the first rekeying of the CHILD_SA that was created with the
    IKE_SA, where no DH group was negotiated yet.
    Also, the selected DH group is moved to the front in all sent proposals that contain it
    and all proposals that don't are moved to the back in order to convey the preference for
    this group to the peer.
  * Handling of MOBIKE task queuing has been improved. In particular, the response to an
    address update (with NAT-D payloads) is not ignored anymore if only an address list update
    or DPD is queued as that could prevent updating the UDP encapsulation in the kernel.
  * On Linux, roam events may optionally be triggered by changes to the routing rules, which
    can be useful if routing rules (instead of e.g. route metrics) are used to switch from one
    to another interface (i.e. from one to another routing table). Since routing rules are
    currently not evaluated when doing route lookups this is only useful if the kernel-based
    route lookup is used (4664992f7d).
  * The fallback drop policies installed to avoid traffic leaks when replacing addresses in
    installed policies are now replaced by temporary drop policies, which also prevent
    acquires because we currently delete and reinstall IPsec SAs to update their addresses
    (35ef1b032d).
  * Access X.509 certificates held in non-volatile storage of a TPM 2.0 referenced via the
    NV index.
    Adding the --keyid parameter to pki --print allows to print private keys or certificates
    stored in a smartcard or a TPM 2.0.
  * Fixed proposal selection if a peer incorrectly sends DH groups in the ESP proposal during
    IKE_AUTH and also if a DH group is configured in the local ESP proposal and charon.prefer
    configured_proposals is disabled (d058fd3c32).
  * The lookup for PSK secrets for IKEv1 has been improved for certain scenarios (see #2497
    for details).
  * MSKs received via RADIUS are now padded to 64 bytes to avoid compatibility issues with
    EAP-MSCHAPv2 and PRFs that have a block size &lt; 64 bytes (e.g. AES-XCBC-PRF-128, see
    73cbce6013).
  * The tpm_extendpcr command line tool extends a digest into a TPM PCR.
  * Ported the NetworkManager backend from the deprecated libnm-glib to libnm.
  * The save-keys debugging/development plugin saves IKE and/or ESP keys to files compatible
    with Wireshark.
  - Version 5.6.1
  ===============
  * Several algorithms were removed from the default ESP/AH and IKE proposals in compliance with
    RFC 8221 and RFC 8247, respectively. Removed from the default ESP/AH proposal were the
    3DES and Blowfish encryption algorithms and the HMAC-MD5 integrity algorithm. From the IKE
    default proposal the HMAC-MD5 integrity algorithm and the MODP-1024 Diffie-Hellman group
    were removed (the latter is significant for Windows clients in their default configuration).
    These algorithms may still be used in custom proposals.
  * Support for RSASSA-PSS signatures has been added. For compatibility with previous
    releases they are currently not used automatically, by default, to change that charon.rsa_pss
    may be enabled. To explicitly use or require such signatures during IKEv2 signature
    authentication (RFC 7427) ike:rsa/pss... authentication constraints may be used for specific
    connections (regardless of whether the strongswan.conf option above is enabled). Only the
    hash algorithm can be specified in such constraints, the MGF1 will be based on that hash
    and the salt length will equal the hash length (when verifying the salt length is not
    enforced).
    To enforce such signatures during PKI verification use rsa/pss... authentication constraints.
  * All pki commands that create certificates/CRLs can be made to sign with RSASSA-PSS instead
    of the classing PKCS#1 scheme with the --rsa-padding pss option. As with signatures during
    authentication, only the hash algorithm is configurable (via --digest option), the MGF1 will
    be based on that and the salt length will equal the hash length.
  * These signatures are supported by all RSA backends except pkcs11 (i.e. gmp, gcrypt, openssl).
    The gmp plugin requires the mgf1 plugin.
    Note that RSASSA-PSS algorithm identifiers and parameters in keys (public keys in
    certificates or private keys in PKCS#8 files) are currently not used as constraints.
  * The sec-updater tool checks for security updates in dpkg-based repositories
    (e.g. Debian/Ubuntu) and sets the security flags in the IMV policy database accordingly.
    Additionally for each new package version a SWID tag for the given OS and HW architecture
    is created and stored in the database.
  * Using the sec-updater.sh script template the lookup can be automated (e.g. via an hourly
    cron job).
  * When restarting an IKEv2 negotiation after receiving an INVALID_KE_PAYLOAD notify (or due
    to other reasons like too many retransmits) a new initiator SPI is allocated. This
    prevents issues caused by retransmits for IKE_SA_INIT messages.
  * Because the initiator SPI was previously reused when restarting the connection delayed
    responses for previous connection attempts were processed and might have caused fatal
    errors due to a failed DH negotiation or because of the internal retry counter in the
    ike-init task. For instance, if we proposed a DH group the responder rejected we
    might have later received delayed responses that either contained INVALID_KE_PAYLOAD
    notifies with the DH group we already switched to, or, if we retransmitted an
    IKE_SA_INIT with the requested group but then had to restart again, a KE payload with
    a group different from the one we proposed.
  * The introduction of file versions in the IMV database scheme broke file reference hash
    measurements. This has been fixed by creating generic product versions having an empty
    package name.
  * A new timeout option for the systime-fix plugin stops periodic system time checks after
    a while and enforces a certificate verification, closing or reauthenticating all SAs
    with invalid certificates.
  * The IKE event counters, previously only available via ipsec listcounters command, may
    now also be queried and reset via vici and the new swanctl --counters command. They
    are collected and provided by the optional counters plugin (enabled by default for
    backwards compatibility if the stroke plugin is built).
  * Class attributes received in RADIUS Access-Accept messages may optionally be added to
    RADIUS accounting messages (655924074b).
  * Basic support for systemd sockets has been added, which may be used for privilege separation
    (59db98fb94).
  * Inbound marks may optionally be installed in the SA again (was removed with 5.5.2) by
    enabling the mark_in_sa option in swanctl.conf.
  * The timeout of leases in pools configured via pool utility may be configured in other
    units than hours.
    INITIAL_CONTACT notifies are now only omitted if never is configured as uniqueness policy.
  * Outbound FWD policies for shunts are not installed anymore, by default (as is the case
    for other policies since 5.5.1).
  * Don't consider a DH group mismatch during CHILD_SA rekeying as failure as responder
    (e7276f78aa).
  * Handling of fragmented IPv4 and IPv6 packets in libipsec has been improved (e138003de9).
  * Trigger expire events for the correct IPsec SA in libipsec (6e861947a0).
  * A crash in CRL verification via openssl plugin using OpenSSL 1.1 has been fixed (78acaba6a1).
  * No hard-coded default proposals are passed from starter to the stroke plugin anymore (the
    IKE proposal used curve25519 since 5.5.2, which is an optional plugin).
  * A workaround for an issue with virtual IPs on macOS 10.13 (High Sierra) has been added
    (039b85dd43).
  * Handling of IKE_SA rekey collisions in charon-tkm has been fixed.
  * Instead of failing or just silently doing nothing unit tests may now warn about certain
    conditions (e.g. if a test was not executed due to external dependencies).</changelog>
  <changelog author="mmnelemane@suse.com" date="1585224000">- Fix for to resolve multiple definition of swanctl_dir (bsc #1164493)
  [+ 0006-Resolve-multiple-definition-of-swanctl_dir.patch]</changelog>
  <changelog author="mbuil@suse.com" date="1610712000">- Fix typo in README (bsc #1167880)
  [+ 0007-Fix-typo-in-README.patch ]</changelog>
  <changelog author="mbuil@suse.com" date="1611576000">- Fix FIPS bug (bsc #1180801)
  [+ 0008-gcrypt-Use-a-dummy-buffer-to-initialize-static-alloc.patch ]</changelog>
  <changelog author="mbuil@suse.com" date="1617019200">- Keep using ipsec as the main binary. Therefore, make strongswan.service point to it instead of swanctl</changelog>
  <changelog author="mbuil@suse.com" date="1617019201">- Information added in README about the rcstrongswan-starter</changelog>
  <changelog author="mbuil@suse.com" date="1617624000">- Add config to run ipsec on namespaces (bsc #1183670)</changelog>
  <changelog author="mt@suse.com" date="1619006400">- Add support for AES CCM aead algorithms to openssl plugin (cc/fips,bsc#1185363)
  [+ 0009-strongswan-openssl-aead-add-ccm-support.patch]</changelog>
  <changelog author="mt@suse.com" date="1620388800">- Replace AEAD AES CCM patch with upstream variant (cc/fips,bsc#1185363)
  [* 0009-strongswan-openssl-aead-add-ccm-support.patch]</changelog>
  <changelog author="hare@suse.de" date="1627646400">- Add auth_els plugin to support Marvell FC-SP encryption (jsc#SLE-20151)
  [* strongswan-marvell-auth-els.patch]</changelog>
  <changelog author="abergmann@suse.com" date="1634040000">- Fix integer overflow in gmp plugin (bsc#1191367, CVE-2021-41990)
  [* strongswan-5.6.1-5.9.3_gmp-rsa-ssa-salt-len.patch]
- Fix integer overflow when replacing certificates in cache (bsc#1191435, CVE-2021-41991)
  [* strongswan-4.4.1-5.9.3_cert-cache-random.patch]</changelog>
  <changelog author="meissner@suse.com" date="1643025600">- strongswan-5.5.0-5.9.4_eap_success-CVE-2021-45079.patch:
  Fixed authentication bypass in EAP authentication (CVE-2021-45079
  bsc#1194471)</changelog>
</package>
<package pkgid="5c5eb09e294e77e57aac48645bd58c618448b6985b49b2a3d94958565380b689" name="strongswan-ipsec" arch="s390x">
  <version epoch="0" ver="5.8.2" rel="11.24.1"/>
  <changelog author="ndas@suse.de" date="1501502400">- Updated to strongSwan 5.3.5(bsc#1050691) providing the following changes:
  * Fixed a DoS vulnerability in the gmp plugin that was caused by insufficient input
    validation when verifying RSA signatures. More specifically, mpz_powm_sec() has two
    requirements regarding the passed exponent and modulus that the plugin did not
    enforce, if these are not met the calculation will result in a floating point exception
    that crashes the whole process.
    This vulnerability has been registered as CVE-2017-9022.
    Please refer to our blog for details.
  * Fixed a DoS vulnerability in the x509 plugin that was caused because the ASN.1 parser
    didn't handle ASN.1 CHOICE types properly, which could result in an infinite loop when
    parsing X.509 extensions that use such types.
    This vulnerability has been registered as CVE-2017-9023.
    Please refer to our blog for details.
  * The behavior during IKEv2 CHILD_SA rekeying has been changed in order to avoid
    traffic loss. When responding to a CREATE_CHILD_SA request to rekey a CHILD_SA
    the responder already has everything available to install and use the new CHILD_SA.
    However, this could lead to lost traffic as the initiator won't be able to process
    inbound packets until it processed the CREATE_CHILD_SA response and updated the
    inbound SA. To avoid this the responder now only installs the new inbound SA and
    delays installing the outbound SA until it receives the DELETE for the replaced CHILD_SA.
  * The messages transporting these DELETEs could reach the peer before packets sent
    with the deleted outbound SAs reach it. To reduce the chance of traffic loss due
    to this the inbound SA of the replaced CHILD_SA is not removed for a configurable
    amount of seconds (charon.delete_rekeyed_delay) after the DELETE has been processed.
  * The code base has been ported to Apple's ARM64 iOS platform, which required several
    changes regarding the use of variadic functions. This was necessary because the calling
    conventions for variadic and regular functions are different there.
    This means that assigning a non-variadic function to a variadic function pointer, as we
    did with our enumerator_t::enumerate() implementations and several callbacks, will
    result in crashes as the called function accesses the arguments differently than the
    caller provided them. To avoid this issue the enumerator_t interface has been changed
    and the signature of the callback functions for enumerator_create_filter() and two
    methods on linked_list_t have been changed. Refer to the developer notes below
    for details.
  * Adds support for fuzzing the certificate parser provided by the default plugins
    (x509, pem, gmp etc.) on Google's OSS-Fuzz infrastructure (or generally with
    libFuzzer). Several issues found while fuzzing these plugins were fixed.
  * Two new options have been added to charon's retransmission settings:
    retransmit_limit and retransmit_jitter. The former adds an upper limit to the
    calculated retransmission timeout, the latter randomly reduces it.
    Refer to Retransmission for details.
  * A bug in swanctl's --load-creds command was fixed that caused unencrypted
    private keys to get unloaded if the command was called multiple times.
    The load-key VICI command now returns the key ID of the loaded key on success.
  * The credential manager now enumerates local credential sets before global ones.
    This means certificates supplied by the peer will now be preferred over certificates
    with the same identity that may be locally stored (e.g. in the certificate cache).
  * Adds support for hardware offload of IPsec SAs as introduced by Linux 4.11 for
    specific hardware that supports this.
  * The pki tool loads the curve25519 plugin by default.
    [- 0006-Make-sure-the-modulus-is-odd-and-the-exponent-not-zero.patch,
  - 0007-asn1-parser-Fix-CHOICE-parsing.patch]
- libhydra is removed as all kernel plugins moved to libcharon</changelog>
  <changelog author="ndas@suse.de" date="1504612800">- fix "uintptr_t? undeclared" compilation error.
  [+0006-fix-compilation-error-by-adding-stdint.h.patch]</changelog>
  <changelog author="ndas@suse.de" date="1504612801">- Updated to strongSwan 5.6.0 providing the following changes:
  * Fixed a DoS vulnerability in the gmp plugin that was caused by insufficient input validation
    when verifying RSA signatures, which requires decryption with the operation m^e mod n,
    where m is the signature, and e and n are the exponent and modulus of the public key.
    The value m is an integer between 0 and n-1, however, the gmp plugin did not verify this.
    So if m equals n the calculation results in 0, in which case mpz_export() returns NULL.
    This result wasn't handled properly causing a null-pointer dereference.
    This vulnerability has been registered as CVE-2017-11185. (bsc#1051222)
  * New SWIMA IMC/IMV pair implements the draft-ietf-sacm-nea-swima-patnc Internet
    Draft and has been demonstrated at the IETF 99 Prague Hackathon.
  * The IMV database template has been adapted to achieve full compliance with the
    ISO 19770-2:2015 SWID tag standard.
  * The pt-tls-client can attach and use TPM 2.0 protected private keys via the --keyid parameter.
  * By default the /etc/swanctl/conf.d directory is created and *.conf files in it are included in the default
    swanctl.conf file.
  * The curl plugin now follows HTTP redirects (configurable via strongswan.conf).
  * The CHILD_SA rekeying was fixed in charon-tkm and the behavior is refined a bit more since 5.5.3
  * libtpmtss supports Intel's TSS2 Architecture Broker and Resource Manager interface (tcti-tabrmd).
  * more on https://wiki.strongswan.org/versions/66</changelog>
  <changelog author="mmnelemane@suse.com" date="1521028800">- Removed unused requires and macro calls(bsc#1083261)</changelog>
  <changelog author="mmnelemane@suse.com" date="1573646400">- Added patch to fix vulnerability: CVE-2018-16151,CVE-2018-16152 (bsc#1107874)
  - Insufficient input validation in gmp plugin
  [+ 0007-strongswan-5.3.1-5.6.0_gmp-pkcs1-verify.patch]</changelog>
  <changelog author="mmnelemane@suse.com" date="1573646401">- Added patch to fix vulnerability: CVE-2018-5388 (bsc#1094462)
  - Buffer Underflow in stroke_socket.c
  [+ 0008-strongswan-5.1.2-5.6.2_stroke_msg_len.patch]</changelog>
  <changelog author="mmnelemane@suse.com" date="1573646402">- Added patch to fix vulnerability: CVE-2018-10811 (bsc#1093536)
  - denial-of-service vulnerability
  [+ 0009-strongswan-5.5.0-5.6.2_skeyseed_init.patch]</changelog>
  <changelog author="mmnelemane@suse.com" date="1573732800">- Added patch to fix vulnerability: CVE-2018-17540 (bsc#1109845)
  [+ 0010-strongswan-4.4.0-5.7.0_gmp-pkcs1-overflow.patch]</changelog>
  <changelog author="mmnelemane@suse.com" date="1580212800">- Updated to version 5.8.2 (jsc#SLE-11370)
  - Dropped following patches due to irrelevance in the updated version:
    [- strongswan_modprobe_syslog.patch ]
    [- strongswan_fipsfilter.patch ]
    [- 0006-fix-compilation-error-by-adding-stdint.h.patch ]
    [- 0007-strongswan-5.3.1-5.6.0_gmp-pkcs1-verify.patch ]
    [- 0008-strongswan-5.1.2-5.6.2_stroke_msg_len.patch ]
    [- 0009-strongswan-5.5.0-5.6.2_skeyseed_init.patch ]
    [- 0010-strongswan-4.4.0-5.7.0_gmp-pkcs1-overflow.patch ]
  - Version 5.8.2
  ===============
  * Identity-based CA constraints, which enforce that the certificate chain of the remote
    peer contains a CA certificate with a specific identity, are supported via
    vici/swanctl.conf. This is similar to the existing CA constraints but doesn't require
    that the CA certificate is locally installed, for instance, intermediate CA certificates
    received from the peers. Wildcard identity matching (e.g. ..., OU=Research, CN=*) could
    also be used for the latter but requires trust in the intermediate CAs to only issue
    certificates with legitimate subject DNs (e.g. the "Sales" CA must not issue certificates
    with OU=Research). With the new constraint that's not necessary as long as a path length
    basic constraint (--pathlen for pki --issue) prevents intermediate CAs from issuing further
    intermediate CAs.
  * Intermediate CA certificates may now be sent in hash-and-URL encoding by configuring a
    base URL for the parent CA (#3234, swanctl/rw-hash-and-url-multi-level).
  * Implemented NIST SP-800-90A Deterministic Random Bit Generator (DRBG) based on AES-CTR
    and SHA2-HMAC modes. Currently used by the gmp and ntru plugins.
  * Random nonces sent in an OCSP requests are now expected in the corresponding OCSP responses.
  * The kernel-netlink plugin now ignores deprecated IPv6 addresses for MOBIKE. Whether temporary
    or permanent IPv6 addresses are included now depends on the charon.prefer_temporary_addrs
    setting (#3192).
  * Extended Sequence Numbers (ESN) are configured via PF_KEY if supported by the kernel.
  * The PF_KEY socket's receive buffer in the kernel-pfkey plugin is now cleared before sending
    requests, as many of the messages sent by the kernel are sent as broadcasts to all PF_KEY
    sockets. This is an issue if an external tool is used to manage SAs/policies unrelated to
    IPsec (#3225).
  * The vici plugin now uses unique section names for CHILD_SAs in child-updown events (7c74ce9190).
  * For individually deleted CHILD_SAs (in particular for IKEv1) the vici child-updown event
    now includes more information about the CHILD_SAs such as traffic statistics (#3198).
  * Custom loggers are correctly re-registered if log levels are changed via stroke loglevel (#3182).
  * Avoid lockups during startup on low entropy systems when using OpenSSL 1.1.1 (095a2c2eac).
  * Instead of failing later when setting a key, creating HMACs via openssl plugin now fails
    instantly if the underlying hash algorithm isn't supported (e.g. MD5 in FIPS-mode) so fallbacks
    to other plugins work properly (#3284).
  * Exponents of RSA keys read from TPM 2.0 via SAPI are correctly converted (8ee1242f1438).
  * Routing table IDs &gt; 255 are supported for custom routes on Linux.
  * To avoid races, the check for hardware offloading support in the kernel-netlink plugin is
    performed during initialization of the plugin (a605452c03).
  * The D-Bus config file for charon-nm is now installed in $(datadir)/dbus-1/system.d instead of
    $(sysconfdir)/dbus-1/system.d, which is intended for sysadmin overrides.
    INVALID_MAJOR_VERSION notifies are now correctly sent in messages of the same exchange type
    and with the same message ID as the request.
  * IKEv2 SAs are now immediately destroyed when sending or receiving INVALID_SYNTAX notifies
    in authenticated messages.
  * For developers working from the repository the configure script now aborts if GNU gperf is
    not found.
  - Version 5.8.1
  ===============
  * RDNs in DNs of X.509 certificates can now optionally be matched less strict. The global
    strongswan.conf option charon.rdn_matching takes two alternative values that cause the
    matching algorithm to either ignore the order of matched RDNs (reordered) or additionally
    (relaxed) accept DNs that contain more RDNs than configured (unmatched RDNs are treated
    like wildcard matches).
  * The updown plugin now passes the same interface to the script that is also used for the
    automatically installed routes, that is, the interface over which the peer is reached
    instead of the interface on which the local address is found (#3095).
  * TPM 2.0 contexts are now protected by a mutex to prevent issues if multiple IKE_SAs use
    the same private key concurrently (4b25885025).
  * Do a rekey check after the third QM message was received (#3060).
  * If available, explicit_bzero() is now used as memwipe() instead of our own implementation.
  * An .editorconfig file has been added, mainly so Github shows files with proper indentation
    (68346b6962).
  * The internal certificate of the load-tester plugin has been modified so it can again be
    used as end-entity cert with 5.6.3 and later (#3139).
  * The maximum data length of received COOKIE notifies (64 bytes) is now enforced (#3160).
  - Version 5.8.0
  ===============
  * The systemd service units have been renamed. The modern unit, which was called
    strongswan-swanctl, is now called strongswan (the previous name is configured as alias in
    the unit, for which a symlink is created when the unit is enabled). The legacy unit is now
    called strongswan-starter.
  * Support for XFRM interfaces (available since Linux 4.19) has been added, which are intended
    to replace VTI devices (they are similar but offer several advantages, for instance, they
    are not bound to an address or address family).
  * IPsec SAs and policies are associated with such interfaces via interface IDs that can be
    configured in swanctl.conf (dynamic IDs may optionally be allocated for each SA and even
    direction). It's possible to use separate interfaces for in- and outbound traffic (or
    only use an interface in one direction and regular policies in the other).
  * Interfaces may be created dynamically via updown/vici scripts, or statically before or after
    establishing the SAs. Routes must be added manually as needed (the daemon will not install
    any routes for outbound policies with an interface ID).
  * When moving XFRM interfaces to other network namespaces they retain access to the SAs and
    policies installed in the original namespace, which allows providing IPsec tunnels for
    processes in other network namespaces without giving them access to the IPsec keys or
    IKE credentials.
    More information can be found on the page about route-based VPNs.
  * Initiation of childless IKE_SAs is supported (RFC 6023). If enabled and supported by the
    responder, no CHILD_SA is established during IKE_AUTH. Instead, all CHILD_SAs are created
    with CREATE_CHILD_SA exchanges. This allows using a separate DH exchange even for the
    first CHILD_SA, which is otherwise created during IKE_AUTH with keys derived from the
    IKE_SA's key material.
  * The swanctl --initiate command may be used to initiate only the IKE_SA via --ike
    option if --child is omitted and the peer supports this extension.
  * The NetworkManager backend and plugin support IPv6.
  * The new wolfssl plugin is a wrapper around the wolfSSL crypto library. Thanks to Sean
    Parkinson of wolfSSL Inc. for the initial patch.
  * IKE SPIs may optionally be labeled via the charon.spi_mask|label options in
    strongswan.conf. This feature was extracted from charon-tkm, however, now applies the
    mask/label in network order.
  * The openssl plugin supports ChaCha20-Poly1305 when built with OpenSSL 1.1.0.
  * The PB-TNC finite state machine according to section 3.2 of RFC 5793 was not correctly
    implemented when sending either a CRETRY or SRETRY batch. These batches can only be sent
    in the "Decided" state and a CRETRY batch can immediately carry all messages usually
    transported by a CDATA batch. It is currently not possible to send a SRETRY batch since
    full-duplex mode for PT-TLS transport is not supported.
  * Instead of marking IPv6 virtual IPs as deprecated, the kernel-netlink plugin now uses
    address labels to avoid that such addresses are used for non-VPN traffic (00a953d090).
  * The agent plugin now creates sockets to the ssh/gpg-agent dynamically and does not keep
    them open, which otherwise might prevent the agent from getting terminated.
  * To avoid broadcast loops the forecast plugin now only reinjects packets that are marked
    or received from the configured interface.
  * UTF-8 encoded passwords are supported via EAP-MSCHAPv2, which internally uses an UTF-16LE
    encoding to calculate the NT hash (#3014).
  * Properly delete temporary drop policies (used when updating IP addresses of SAs) if manual
    priorities are used, which was broken since 5.6.2 (8e31d65730).
  * Avoid overwriting start_action when parsing the inactivity timeout in the vici plugin (#2954).
  * Fixed the automatic termination of reloaded vici connections with start_action=start,
    which was broken since 5.6.3 (71b22c250f).
  * The lookup for shared secrets for IKEv1 SAs via sql plugin should now work better
    (6ec9f68f32).
  * Fixed a race condition in the trap manager between installation and removal of a policy
    (69cbe2ca3f).
  * Compilation of the kernel-netlink plugin has been fixed on old kernels (&lt; 2.6.39), which
    was caused by the HW offload changes (c7f579fa17).
  * The IPsec stack detection and module loading in starter has been removed (it wasn't
    enforced anyway and loading modules doesn't seem necessary, also KLIPS hasn't been
    supported for a long time and PF_KEY will eventually be removed from the Linux kernel,
    ba817d2917).
  * Several IKEv2 protocol details are now handled more strictly: Unrequested virtual IPs are
    ignored, CFG_REPLY payloads are ignored if no CFG_REQUEST payloads were sent, a USE
    TRANSPORT_MODE notify received from the responder is checked against the local configuration.
  * The keys and certificates used by the scenarios in the testing environment are now generated
    dynamically. Running the testing/scripts/build-certs script after creating the base and root
    images uses the pki utility installed in the latter to create the keys and certificates for
    all the CAs and in some cases for individual scenarios. These credentials are stored in the
    source tree, not the image, so this has to be called only once even if the images are later
    rebuilt. The script automatically (re-)rebuilds the guest images as that generates fresh
    CRLs and signs the DNS zones. The only keys/certificates currently not generated are the
    very large ones used by the ikev2/rw-eap-tls-fragments scenario.
  - Version 5.7.2
  ===============
  * For RSA with PSS padding, the TPM 2.0 specification mandates the maximum salt length
    (as defined by the length of the key and hash). However, if the TPM is FIPS-168-4 compliant,
    the salt length equals the hash length. This is assumed for FIPS-140-2 compliant TPMs, but
    if that's not the case, it might be necessary to manually enable charon.plugins.tpm.fips_186_4
    if the TPM doesn't use the maximum salt length.
  * Directories for credentials loaded by swanctl are now accessed relative to the loaded
    swanctl.conf file, in particular, when loading it from a custom location via --file argument.
  * The base directory, which is used if no custom location for swanctl.conf is specified, is now
    also configurable at runtime via SWANCTL_DIR environment variable.
  * If RADIUS Accounting is enabled, the eap-radius plugin will add the session ID (Acct-Session-Id)
    to Access-Request messages, which e.g. simplifies associating database entries for IP leases and
    accounting with sessions (the session ID does not change when IKE_SAs are rekeyed, #2853).
  * All IP addresses assigned by a RADIUS server are included in Accounting-Stop messages even if
    the client did not claim them, allowing to release them early in case of connection errors (#2856).
  * Selectors installed on transport mode SAs by the kernel-netlink plugin are now updated if an
    IP address changes (e.g. via MOBIKE) and it was part of the selectors.
  * No deletes are sent anymore when a rekeyed CHILD_SA expires (#2815).
  * The bypass-lan plugin now tracks interfaces to handle subnets that move from one interface
    to another and properly update associated routes (#2820).
  * Only valid and expected inbound IKEv2 messages are used to update the timestamp of the
    last received message (previously, retransmits also triggered an update).
  * IKEv2 requests from responders are now ignored until the IKE_SA is fully established (e.g. if a
    DPD request from the peer arrives before the IKE_AUTH response does, 46bea1add9).
    Delayed IKE_SA_INIT responses with COOKIE notifies we already recevied are ignored, they caused
    another reset of the IKE_SA previously (#2837).
  * Active and queued Quick Mode tasks are now adopted if the peer reauthenticates an IKEv1 SA
    while creating lots of CHILD_SAs.
  * Newer versions of the FreeBSD kernel add an SADB_X_EXT_SA2 extension to SADB_ACQUIRE
    messages, which allows the kernel-pfkey plugin to determine the reqid of the policy even if it
    wasn't installed by the daemon previously (e.g. when using FreeBSD's if_ipsec(4) VTIs, which
    install policies themselves, 872b9b3e8d).
  * Added support for RSA signatures with SHA-256 and SHA-512 to the agent plugin. For older
    versions of ssh/gpg-agent that only support SHA-1, IKEv2 signature authentication has to be
    disabled via charon.signature_authentication.
  * The sshkey and agent plugins support Ed25519/Ed448 SSH keys and signatures.
  * The openssl plugin supports X25519/X448 Diffie-Hellman and Ed25519/Ed448 keys and
    signatures when built against OpenSSL 1.1.1.
  * Support for Ed25519, ChaCha20/Poly1305, SHA-3 and AES-CCM were added to the botan plugin.
  * The mysql plugin now properly handles database connections with transactions
    under heavy load (#2779).
  * IP addresses in ha pools are now distributed evenly among all segments (#2828).
  * Private key implementations may optionally provide a list of supported signature schemes,
    which, as described above, is used by the tpm plugin because for each key on a TPM 2.0 the
    hash algorithm and for RSA also the padding scheme is predefined.
  * The testing environment is now based on Debian 9 (stretch) by default. This required
    some changes, in particular, updating to FreeRADIUS 3.x (which forced us to abandon the
    TNC@FHH patches and scenarios, 2fbe44bef3) and removing FIPS-enabled versions of
    OpenSSL (the FIPS module only supports OpenSSL 1.0.2).
  * Most test scenarios were migrated to swanctl.
  - Version 5.7.1
  ===============
  * Fixes a vulnerability in the gmp plugin triggered by crafted certificates with RSA keys with
    very small moduli. When verifying signatures with such keys, the code patched with the fix
    for CVE-2018-16151/2 caused an integer underflow and subsequent heap buffer overflow
    that results in a crash of the daemon.
  * The vulnerability has been registered as CVE-2018-17540.
  - Version 5.7.0
  ===============
  * Fixes a potential authorization bypass vulnerability in the gmp plugin that was caused by a
    too lenient verification of PKCS#1 v1.5 signatures. Several flaws could be exploited by a
    Bleichenbacher-style attack to forge signatures for low-exponent keys (i.e. with e=3).
  * CVE-2018-16151 has been assigned to the problem of accepting random bytes after the OID
    of the hash function in such signatures, and CVE-2018-16152 has been assigned to the issue
    of not verifying that the parameters in the ASN.1 algorithmIdentitifer structure is empty.
    Other flaws that don't lead to a vulnerability directly (e.g. not checking for at least
    8 bytes of padding) have no separate CVE assigned.
  * Dots are not allowed anymore in section names in swanctl.conf and strongswan.conf.
    This mainly affects the configuration of file loggers. If the path for such a log file
    contains dots it now has to be configured in the new path setting within the arbitrarily
    renamed subsection in the filelog section.
  * Sections in swanctl.conf and strongswan.conf may now reference other sections. All settings
    and subsections from such a section are inherited. This allows to simplify configs as
    redundant information has only to be specified once and may then be included in other
    sections (see strongswan.conf for an example).
  * The originally selected IKE config (based on the IPs and IKE version) can now change
    if no matching algorithm proposal is found. This way the order of the configs doesn't
    matter that much anymore and it's easily possible to specify separate configs for
    clients that require weaker algorithms (instead of having to also add them in other
    configs that might be selected).
  * Support for Postquantum Preshared Keys for IKEv2 (draft-ietf-ipsecme-qr-ikev2) has been added.
    For an example refer to the swanctl/rw-cert-ppk scenario (or with EAP, or PSK authentication).
  * The new botan plugin is a wrapper around the Botan C++ crypto library.
    It requires a fairly recent build from Botan's master branch (or the upcoming 2.8.0 release).
    Thanks to René Korthaus and his team from Rohde &amp; Schwarz Cybersecurity for the initial
    patch and to Jack Lloyd for quickly adding missing functions to Botan's FFI (C89) interface.
  * Implementation of RFC 8412 "Software Inventory Message and Attributes (SWIMA) for PA-TNC".
  * SWIMA subscription option sets CLOSE_WRITE trigger on apt history.log file resulting in
    a ClientRetry PB-TNC batch to initialize a new measurement cycle. The new imv/imc-swima
    plugins replace the previous imv/imc-swid plugins, which were removed.
  * Added support for fuzzing the PA-TNC (RFC 5792) and PB-TNC (RFC 5793) NEA protocols
    on Google's OSS-Fuzz infrastructure.
  * Support for version 2 of Intel's TPM2-TSS TGC Software Stack. The presence of the
    in-kernel /dev/tpmrm0 resource manager is automatically detected.
  * The pki tool accepts a xmppAddr otherName as a subjectAlternativeName using the
    syntax --san xmppaddr:&lt;jid&gt;.
  * swanctl.conf supports the configuration of marks the in- and/or outbound SA should apply
    to packets after processing on Linux. Configuring such a mark for outbound SAs requires
    at least a 4.14 kernel. The ability to set a mask and configuring a mark/mask for
    inbound SAs will be added with the upcoming 4.19 kernel.
  * New options in swanctl.conf allow configuring how/whether DF, ECN and DS fields in the
    IP headers are copied during IPsec processing. Controlling this is currently only possible
    on Linux.
  * The handling of sequence numbers in IKEv1 DPDs has been improved (#2714).
  * To avoid conflicts, the dhcp plugin now only uses the DHCP server port if explicitly
    configured.
  - Version 5.6.3
  ===============
  * Fixed a DoS vulnerability in the IKEv2 key derivation if the openssl plugin is used in FIPS
    mode and HMAC-MD5 is negotiated as PRF.
    This vulnerability has been registered as CVE-2018-10811.
  * Fixed a vulnerability in the stroke plugin, which did not check the received length before
    reading a message from the socket. Unless a group is configured, root privileges are
    required to access that socket, so in the default configuration this shouldn't be an issue.
    This vulnerability has been registered as CVE-2018-5388.
  * CRLs that are not yet valid are now ignored to avoid problems in scenarios where expired
    certificates are removed from new CRLs and the clock on the host doing the revocation
    check is trailing behind that of the host issuing CRLs. Not doing this could result in
    accepting a revoked and expired certificate, if it's still valid according to the
    trailing clock but not contained anymore in not yet valid CRLs.
  * The issuer of fetched CRLs is now compared to the issuer of the checked certificate (#2608).
  * CRL validation results other than revocation (e.g. a skipped check because the CRL couldn't
    be fetched) are now stored also for intermediate CA certificates and not only for end-entity
    certificates, so a strict CRL policy can be enforced in such cases.
  * In compliance with RFC 4945, section 5.1.3.2, certificates used for IKE must now either
    not contain a keyUsage extension (like the ones generated by pki), or have at least one of the
    digitalSignature or nonRepudiation bits set.
  * New options for vici/swanctl allow forcing the local termination of an IKE_SA. This might be
    useful in situations where it's known the other end is not reachable anymore, or that it
    already removed the IKE_SA, so retransmitting a DELETE and waiting for a response would
    be pointless.
  * Waiting only a certain amount of time for a response (i.e. shorter than all retransmits
    would be) before destroying the IKE_SA is also possible by additionally specifying a
    timeout in the forced termination request.
  * When removing routes, the kernel-netlink plugin now checks if it tracks other routes for
    the same destination and replaces the installed route instead of just removing it. Same
    during installation, where existing routes previously weren't replaced. This should allow
    using traps with virtual IPs on Linux (#2162).
  * The dhcp plugin now only sends the client identifier DHCP option if the identity_lease
    setting is enabled (7b660944b6). It can also send identities of up to 255 bytes length,
    instead of the previous 64 bytes (30e886fe3b, 0e5b94d038). If a server address is
    configured, DHCP requests are now sent from port 67 instead of 68 to avoid ICMP port
    unreachables (becf027cd9).
  * The handling of faulty INVALID_KE_PAYLOAD notifies (e.g. one containing a DH group
    that wasn't proposed) during CREATE_CHILD_SA exchanges has been improved (#2536).
  * Roam events are now completely ignored for IKEv1 SAs (there is no MOBIKE to handle such
    changes properly).
  * ChaCha20/Poly1305 is now correctly proposed without key length (#2614). For compatibility with
    older releases the chacha20poly1305compat keyword may be included in proposals to also propose
    the algorithm with a key length (c58434aeff).
  * Configuration of hardware offload of IPsec SAs is now more flexible and allows a new
    setting (auto), which automatically uses it if the kernel and device both support it. If hw
    offload is set to yes and offloading is not supported, the CHILD_SA installation now fails.
  * The kernel-pfkey plugin optionally installs routes via internal interface (one with an IP
    in the local traffic selector). On FreeBSD, enabling this selects the correct source IP
    when sending packets from the gateway itself (e811659323).
  * SHA-2 based PRFs are supported in PKCS#8 files as generated by OpenSSL 1.1 (#2574).
  * The pki --verify tool may load CA certificates and CRLs from directories.
  * The IKE daemon now also switches to port 4500 if the remote port is not 500 (e.g. because the
    remote maps the response to a different port, as might happen on Azure), as long as the local
    port is 500 (85bfab621d).
  * Fixed an issue with DNS servers passed to NetworkManager in charon-nm (ee8c25516a).
  * Logged traffic selectors now always contain the protocol if either protocol or port are set
    (a36d8097ed).
  * Only the inbound SA/policy will be updated as reaction to IP address changes for rekeyed
    CHILD_SAs that are kept around.
  * The parser for strongswan.conf/swanctl.conf now accepts = characters in values without
    having to put the value in quotes (e.g. for Base64 encoded shared secrets).
    Notes for developers:
  * trap_manager_t: Trap policies are now unistalled by peer/child name and not the reqid.
  * No reqid is returned anymore when installing trap policies.
  * child_sa_t: A new state (CHILD_DELETED) is used for CHILD_SAs that have been deleted but
    not yet destroyed (after a rekeying CHILD_SAs are kept around for a while to process
    delayed packets).
    This way child_updown events are not triggered anymore for such SAs when an IKE_SA that
    has such CHILD_SAs assigned is deleted.
  - Version 5.6.2
  ===============
  * Fixed a DoS vulnerability in the parser for PKCS#1 RSASSA-PSS signatures that was caused
    by insufficient input validation. One of the configurable parameters in algorithm identifier
    structures for RSASSA-PSS signatures is the mask generation function (MGF). Only MGF1 is
    currently specified for this purpose. However, this in turn takes itself a parameter that
    specifies the underlying hash function. strongSwan's parser did not correctly handle the
    case of this parameter being absent, causing an undefined data read.
    This vulnerability has been registered as CVE-2018-6459.
  * When rekeying IKEv2 IKE_SAs the previously negotiated DH group will be reused, instead of
    using the first configured group, which avoids an additional exchange if the peer previously
    selected a different DH group via INVALID_KE_PAYLOAD notify. The same is also done when
    rekeying CHILD_SAs except for the first rekeying of the CHILD_SA that was created with the
    IKE_SA, where no DH group was negotiated yet.
    Also, the selected DH group is moved to the front in all sent proposals that contain it
    and all proposals that don't are moved to the back in order to convey the preference for
    this group to the peer.
  * Handling of MOBIKE task queuing has been improved. In particular, the response to an
    address update (with NAT-D payloads) is not ignored anymore if only an address list update
    or DPD is queued as that could prevent updating the UDP encapsulation in the kernel.
  * On Linux, roam events may optionally be triggered by changes to the routing rules, which
    can be useful if routing rules (instead of e.g. route metrics) are used to switch from one
    to another interface (i.e. from one to another routing table). Since routing rules are
    currently not evaluated when doing route lookups this is only useful if the kernel-based
    route lookup is used (4664992f7d).
  * The fallback drop policies installed to avoid traffic leaks when replacing addresses in
    installed policies are now replaced by temporary drop policies, which also prevent
    acquires because we currently delete and reinstall IPsec SAs to update their addresses
    (35ef1b032d).
  * Access X.509 certificates held in non-volatile storage of a TPM 2.0 referenced via the
    NV index.
    Adding the --keyid parameter to pki --print allows to print private keys or certificates
    stored in a smartcard or a TPM 2.0.
  * Fixed proposal selection if a peer incorrectly sends DH groups in the ESP proposal during
    IKE_AUTH and also if a DH group is configured in the local ESP proposal and charon.prefer
    configured_proposals is disabled (d058fd3c32).
  * The lookup for PSK secrets for IKEv1 has been improved for certain scenarios (see #2497
    for details).
  * MSKs received via RADIUS are now padded to 64 bytes to avoid compatibility issues with
    EAP-MSCHAPv2 and PRFs that have a block size &lt; 64 bytes (e.g. AES-XCBC-PRF-128, see
    73cbce6013).
  * The tpm_extendpcr command line tool extends a digest into a TPM PCR.
  * Ported the NetworkManager backend from the deprecated libnm-glib to libnm.
  * The save-keys debugging/development plugin saves IKE and/or ESP keys to files compatible
    with Wireshark.
  - Version 5.6.1
  ===============
  * Several algorithms were removed from the default ESP/AH and IKE proposals in compliance with
    RFC 8221 and RFC 8247, respectively. Removed from the default ESP/AH proposal were the
    3DES and Blowfish encryption algorithms and the HMAC-MD5 integrity algorithm. From the IKE
    default proposal the HMAC-MD5 integrity algorithm and the MODP-1024 Diffie-Hellman group
    were removed (the latter is significant for Windows clients in their default configuration).
    These algorithms may still be used in custom proposals.
  * Support for RSASSA-PSS signatures has been added. For compatibility with previous
    releases they are currently not used automatically, by default, to change that charon.rsa_pss
    may be enabled. To explicitly use or require such signatures during IKEv2 signature
    authentication (RFC 7427) ike:rsa/pss... authentication constraints may be used for specific
    connections (regardless of whether the strongswan.conf option above is enabled). Only the
    hash algorithm can be specified in such constraints, the MGF1 will be based on that hash
    and the salt length will equal the hash length (when verifying the salt length is not
    enforced).
    To enforce such signatures during PKI verification use rsa/pss... authentication constraints.
  * All pki commands that create certificates/CRLs can be made to sign with RSASSA-PSS instead
    of the classing PKCS#1 scheme with the --rsa-padding pss option. As with signatures during
    authentication, only the hash algorithm is configurable (via --digest option), the MGF1 will
    be based on that and the salt length will equal the hash length.
  * These signatures are supported by all RSA backends except pkcs11 (i.e. gmp, gcrypt, openssl).
    The gmp plugin requires the mgf1 plugin.
    Note that RSASSA-PSS algorithm identifiers and parameters in keys (public keys in
    certificates or private keys in PKCS#8 files) are currently not used as constraints.
  * The sec-updater tool checks for security updates in dpkg-based repositories
    (e.g. Debian/Ubuntu) and sets the security flags in the IMV policy database accordingly.
    Additionally for each new package version a SWID tag for the given OS and HW architecture
    is created and stored in the database.
  * Using the sec-updater.sh script template the lookup can be automated (e.g. via an hourly
    cron job).
  * When restarting an IKEv2 negotiation after receiving an INVALID_KE_PAYLOAD notify (or due
    to other reasons like too many retransmits) a new initiator SPI is allocated. This
    prevents issues caused by retransmits for IKE_SA_INIT messages.
  * Because the initiator SPI was previously reused when restarting the connection delayed
    responses for previous connection attempts were processed and might have caused fatal
    errors due to a failed DH negotiation or because of the internal retry counter in the
    ike-init task. For instance, if we proposed a DH group the responder rejected we
    might have later received delayed responses that either contained INVALID_KE_PAYLOAD
    notifies with the DH group we already switched to, or, if we retransmitted an
    IKE_SA_INIT with the requested group but then had to restart again, a KE payload with
    a group different from the one we proposed.
  * The introduction of file versions in the IMV database scheme broke file reference hash
    measurements. This has been fixed by creating generic product versions having an empty
    package name.
  * A new timeout option for the systime-fix plugin stops periodic system time checks after
    a while and enforces a certificate verification, closing or reauthenticating all SAs
    with invalid certificates.
  * The IKE event counters, previously only available via ipsec listcounters command, may
    now also be queried and reset via vici and the new swanctl --counters command. They
    are collected and provided by the optional counters plugin (enabled by default for
    backwards compatibility if the stroke plugin is built).
  * Class attributes received in RADIUS Access-Accept messages may optionally be added to
    RADIUS accounting messages (655924074b).
  * Basic support for systemd sockets has been added, which may be used for privilege separation
    (59db98fb94).
  * Inbound marks may optionally be installed in the SA again (was removed with 5.5.2) by
    enabling the mark_in_sa option in swanctl.conf.
  * The timeout of leases in pools configured via pool utility may be configured in other
    units than hours.
    INITIAL_CONTACT notifies are now only omitted if never is configured as uniqueness policy.
  * Outbound FWD policies for shunts are not installed anymore, by default (as is the case
    for other policies since 5.5.1).
  * Don't consider a DH group mismatch during CHILD_SA rekeying as failure as responder
    (e7276f78aa).
  * Handling of fragmented IPv4 and IPv6 packets in libipsec has been improved (e138003de9).
  * Trigger expire events for the correct IPsec SA in libipsec (6e861947a0).
  * A crash in CRL verification via openssl plugin using OpenSSL 1.1 has been fixed (78acaba6a1).
  * No hard-coded default proposals are passed from starter to the stroke plugin anymore (the
    IKE proposal used curve25519 since 5.5.2, which is an optional plugin).
  * A workaround for an issue with virtual IPs on macOS 10.13 (High Sierra) has been added
    (039b85dd43).
  * Handling of IKE_SA rekey collisions in charon-tkm has been fixed.
  * Instead of failing or just silently doing nothing unit tests may now warn about certain
    conditions (e.g. if a test was not executed due to external dependencies).</changelog>
  <changelog author="mmnelemane@suse.com" date="1585224000">- Fix for to resolve multiple definition of swanctl_dir (bsc #1164493)
  [+ 0006-Resolve-multiple-definition-of-swanctl_dir.patch]</changelog>
  <changelog author="mbuil@suse.com" date="1610712000">- Fix typo in README (bsc #1167880)
  [+ 0007-Fix-typo-in-README.patch ]</changelog>
  <changelog author="mbuil@suse.com" date="1611576000">- Fix FIPS bug (bsc #1180801)
  [+ 0008-gcrypt-Use-a-dummy-buffer-to-initialize-static-alloc.patch ]</changelog>
  <changelog author="mbuil@suse.com" date="1617019200">- Keep using ipsec as the main binary. Therefore, make strongswan.service point to it instead of swanctl</changelog>
  <changelog author="mbuil@suse.com" date="1617019201">- Information added in README about the rcstrongswan-starter</changelog>
  <changelog author="mbuil@suse.com" date="1617624000">- Add config to run ipsec on namespaces (bsc #1183670)</changelog>
  <changelog author="mt@suse.com" date="1619006400">- Add support for AES CCM aead algorithms to openssl plugin (cc/fips,bsc#1185363)
  [+ 0009-strongswan-openssl-aead-add-ccm-support.patch]</changelog>
  <changelog author="mt@suse.com" date="1620388800">- Replace AEAD AES CCM patch with upstream variant (cc/fips,bsc#1185363)
  [* 0009-strongswan-openssl-aead-add-ccm-support.patch]</changelog>
  <changelog author="hare@suse.de" date="1627646400">- Add auth_els plugin to support Marvell FC-SP encryption (jsc#SLE-20151)
  [* strongswan-marvell-auth-els.patch]</changelog>
  <changelog author="abergmann@suse.com" date="1634040000">- Fix integer overflow in gmp plugin (bsc#1191367, CVE-2021-41990)
  [* strongswan-5.6.1-5.9.3_gmp-rsa-ssa-salt-len.patch]
- Fix integer overflow when replacing certificates in cache (bsc#1191435, CVE-2021-41991)
  [* strongswan-4.4.1-5.9.3_cert-cache-random.patch]</changelog>
  <changelog author="meissner@suse.com" date="1643025600">- strongswan-5.5.0-5.9.4_eap_success-CVE-2021-45079.patch:
  Fixed authentication bypass in EAP authentication (CVE-2021-45079
  bsc#1194471)</changelog>
</package>
<package pkgid="eec60633be47f059465ca0a3a8e2b70ebb714c41bd9d9ced527909d80dd7639b" name="strongswan-ipsec" arch="x86_64">
  <version epoch="0" ver="5.8.2" rel="11.24.1"/>
  <changelog author="ndas@suse.de" date="1501502400">- Updated to strongSwan 5.3.5(bsc#1050691) providing the following changes:
  * Fixed a DoS vulnerability in the gmp plugin that was caused by insufficient input
    validation when verifying RSA signatures. More specifically, mpz_powm_sec() has two
    requirements regarding the passed exponent and modulus that the plugin did not
    enforce, if these are not met the calculation will result in a floating point exception
    that crashes the whole process.
    This vulnerability has been registered as CVE-2017-9022.
    Please refer to our blog for details.
  * Fixed a DoS vulnerability in the x509 plugin that was caused because the ASN.1 parser
    didn't handle ASN.1 CHOICE types properly, which could result in an infinite loop when
    parsing X.509 extensions that use such types.
    This vulnerability has been registered as CVE-2017-9023.
    Please refer to our blog for details.
  * The behavior during IKEv2 CHILD_SA rekeying has been changed in order to avoid
    traffic loss. When responding to a CREATE_CHILD_SA request to rekey a CHILD_SA
    the responder already has everything available to install and use the new CHILD_SA.
    However, this could lead to lost traffic as the initiator won't be able to process
    inbound packets until it processed the CREATE_CHILD_SA response and updated the
    inbound SA. To avoid this the responder now only installs the new inbound SA and
    delays installing the outbound SA until it receives the DELETE for the replaced CHILD_SA.
  * The messages transporting these DELETEs could reach the peer before packets sent
    with the deleted outbound SAs reach it. To reduce the chance of traffic loss due
    to this the inbound SA of the replaced CHILD_SA is not removed for a configurable
    amount of seconds (charon.delete_rekeyed_delay) after the DELETE has been processed.
  * The code base has been ported to Apple's ARM64 iOS platform, which required several
    changes regarding the use of variadic functions. This was necessary because the calling
    conventions for variadic and regular functions are different there.
    This means that assigning a non-variadic function to a variadic function pointer, as we
    did with our enumerator_t::enumerate() implementations and several callbacks, will
    result in crashes as the called function accesses the arguments differently than the
    caller provided them. To avoid this issue the enumerator_t interface has been changed
    and the signature of the callback functions for enumerator_create_filter() and two
    methods on linked_list_t have been changed. Refer to the developer notes below
    for details.
  * Adds support for fuzzing the certificate parser provided by the default plugins
    (x509, pem, gmp etc.) on Google's OSS-Fuzz infrastructure (or generally with
    libFuzzer). Several issues found while fuzzing these plugins were fixed.
  * Two new options have been added to charon's retransmission settings:
    retransmit_limit and retransmit_jitter. The former adds an upper limit to the
    calculated retransmission timeout, the latter randomly reduces it.
    Refer to Retransmission for details.
  * A bug in swanctl's --load-creds command was fixed that caused unencrypted
    private keys to get unloaded if the command was called multiple times.
    The load-key VICI command now returns the key ID of the loaded key on success.
  * The credential manager now enumerates local credential sets before global ones.
    This means certificates supplied by the peer will now be preferred over certificates
    with the same identity that may be locally stored (e.g. in the certificate cache).
  * Adds support for hardware offload of IPsec SAs as introduced by Linux 4.11 for
    specific hardware that supports this.
  * The pki tool loads the curve25519 plugin by default.
    [- 0006-Make-sure-the-modulus-is-odd-and-the-exponent-not-zero.patch,
  - 0007-asn1-parser-Fix-CHOICE-parsing.patch]
- libhydra is removed as all kernel plugins moved to libcharon</changelog>
  <changelog author="ndas@suse.de" date="1504612800">- fix "uintptr_t? undeclared" compilation error.
  [+0006-fix-compilation-error-by-adding-stdint.h.patch]</changelog>
  <changelog author="ndas@suse.de" date="1504612801">- Updated to strongSwan 5.6.0 providing the following changes:
  * Fixed a DoS vulnerability in the gmp plugin that was caused by insufficient input validation
    when verifying RSA signatures, which requires decryption with the operation m^e mod n,
    where m is the signature, and e and n are the exponent and modulus of the public key.
    The value m is an integer between 0 and n-1, however, the gmp plugin did not verify this.
    So if m equals n the calculation results in 0, in which case mpz_export() returns NULL.
    This result wasn't handled properly causing a null-pointer dereference.
    This vulnerability has been registered as CVE-2017-11185. (bsc#1051222)
  * New SWIMA IMC/IMV pair implements the draft-ietf-sacm-nea-swima-patnc Internet
    Draft and has been demonstrated at the IETF 99 Prague Hackathon.
  * The IMV database template has been adapted to achieve full compliance with the
    ISO 19770-2:2015 SWID tag standard.
  * The pt-tls-client can attach and use TPM 2.0 protected private keys via the --keyid parameter.
  * By default the /etc/swanctl/conf.d directory is created and *.conf files in it are included in the default
    swanctl.conf file.
  * The curl plugin now follows HTTP redirects (configurable via strongswan.conf).
  * The CHILD_SA rekeying was fixed in charon-tkm and the behavior is refined a bit more since 5.5.3
  * libtpmtss supports Intel's TSS2 Architecture Broker and Resource Manager interface (tcti-tabrmd).
  * more on https://wiki.strongswan.org/versions/66</changelog>
  <changelog author="mmnelemane@suse.com" date="1521028800">- Removed unused requires and macro calls(bsc#1083261)</changelog>
  <changelog author="mmnelemane@suse.com" date="1573646400">- Added patch to fix vulnerability: CVE-2018-16151,CVE-2018-16152 (bsc#1107874)
  - Insufficient input validation in gmp plugin
  [+ 0007-strongswan-5.3.1-5.6.0_gmp-pkcs1-verify.patch]</changelog>
  <changelog author="mmnelemane@suse.com" date="1573646401">- Added patch to fix vulnerability: CVE-2018-5388 (bsc#1094462)
  - Buffer Underflow in stroke_socket.c
  [+ 0008-strongswan-5.1.2-5.6.2_stroke_msg_len.patch]</changelog>
  <changelog author="mmnelemane@suse.com" date="1573646402">- Added patch to fix vulnerability: CVE-2018-10811 (bsc#1093536)
  - denial-of-service vulnerability
  [+ 0009-strongswan-5.5.0-5.6.2_skeyseed_init.patch]</changelog>
  <changelog author="mmnelemane@suse.com" date="1573732800">- Added patch to fix vulnerability: CVE-2018-17540 (bsc#1109845)
  [+ 0010-strongswan-4.4.0-5.7.0_gmp-pkcs1-overflow.patch]</changelog>
  <changelog author="mmnelemane@suse.com" date="1580212800">- Updated to version 5.8.2 (jsc#SLE-11370)
  - Dropped following patches due to irrelevance in the updated version:
    [- strongswan_modprobe_syslog.patch ]
    [- strongswan_fipsfilter.patch ]
    [- 0006-fix-compilation-error-by-adding-stdint.h.patch ]
    [- 0007-strongswan-5.3.1-5.6.0_gmp-pkcs1-verify.patch ]
    [- 0008-strongswan-5.1.2-5.6.2_stroke_msg_len.patch ]
    [- 0009-strongswan-5.5.0-5.6.2_skeyseed_init.patch ]
    [- 0010-strongswan-4.4.0-5.7.0_gmp-pkcs1-overflow.patch ]
  - Version 5.8.2
  ===============
  * Identity-based CA constraints, which enforce that the certificate chain of the remote
    peer contains a CA certificate with a specific identity, are supported via
    vici/swanctl.conf. This is similar to the existing CA constraints but doesn't require
    that the CA certificate is locally installed, for instance, intermediate CA certificates
    received from the peers. Wildcard identity matching (e.g. ..., OU=Research, CN=*) could
    also be used for the latter but requires trust in the intermediate CAs to only issue
    certificates with legitimate subject DNs (e.g. the "Sales" CA must not issue certificates
    with OU=Research). With the new constraint that's not necessary as long as a path length
    basic constraint (--pathlen for pki --issue) prevents intermediate CAs from issuing further
    intermediate CAs.
  * Intermediate CA certificates may now be sent in hash-and-URL encoding by configuring a
    base URL for the parent CA (#3234, swanctl/rw-hash-and-url-multi-level).
  * Implemented NIST SP-800-90A Deterministic Random Bit Generator (DRBG) based on AES-CTR
    and SHA2-HMAC modes. Currently used by the gmp and ntru plugins.
  * Random nonces sent in an OCSP requests are now expected in the corresponding OCSP responses.
  * The kernel-netlink plugin now ignores deprecated IPv6 addresses for MOBIKE. Whether temporary
    or permanent IPv6 addresses are included now depends on the charon.prefer_temporary_addrs
    setting (#3192).
  * Extended Sequence Numbers (ESN) are configured via PF_KEY if supported by the kernel.
  * The PF_KEY socket's receive buffer in the kernel-pfkey plugin is now cleared before sending
    requests, as many of the messages sent by the kernel are sent as broadcasts to all PF_KEY
    sockets. This is an issue if an external tool is used to manage SAs/policies unrelated to
    IPsec (#3225).
  * The vici plugin now uses unique section names for CHILD_SAs in child-updown events (7c74ce9190).
  * For individually deleted CHILD_SAs (in particular for IKEv1) the vici child-updown event
    now includes more information about the CHILD_SAs such as traffic statistics (#3198).
  * Custom loggers are correctly re-registered if log levels are changed via stroke loglevel (#3182).
  * Avoid lockups during startup on low entropy systems when using OpenSSL 1.1.1 (095a2c2eac).
  * Instead of failing later when setting a key, creating HMACs via openssl plugin now fails
    instantly if the underlying hash algorithm isn't supported (e.g. MD5 in FIPS-mode) so fallbacks
    to other plugins work properly (#3284).
  * Exponents of RSA keys read from TPM 2.0 via SAPI are correctly converted (8ee1242f1438).
  * Routing table IDs &gt; 255 are supported for custom routes on Linux.
  * To avoid races, the check for hardware offloading support in the kernel-netlink plugin is
    performed during initialization of the plugin (a605452c03).
  * The D-Bus config file for charon-nm is now installed in $(datadir)/dbus-1/system.d instead of
    $(sysconfdir)/dbus-1/system.d, which is intended for sysadmin overrides.
    INVALID_MAJOR_VERSION notifies are now correctly sent in messages of the same exchange type
    and with the same message ID as the request.
  * IKEv2 SAs are now immediately destroyed when sending or receiving INVALID_SYNTAX notifies
    in authenticated messages.
  * For developers working from the repository the configure script now aborts if GNU gperf is
    not found.
  - Version 5.8.1
  ===============
  * RDNs in DNs of X.509 certificates can now optionally be matched less strict. The global
    strongswan.conf option charon.rdn_matching takes two alternative values that cause the
    matching algorithm to either ignore the order of matched RDNs (reordered) or additionally
    (relaxed) accept DNs that contain more RDNs than configured (unmatched RDNs are treated
    like wildcard matches).
  * The updown plugin now passes the same interface to the script that is also used for the
    automatically installed routes, that is, the interface over which the peer is reached
    instead of the interface on which the local address is found (#3095).
  * TPM 2.0 contexts are now protected by a mutex to prevent issues if multiple IKE_SAs use
    the same private key concurrently (4b25885025).
  * Do a rekey check after the third QM message was received (#3060).
  * If available, explicit_bzero() is now used as memwipe() instead of our own implementation.
  * An .editorconfig file has been added, mainly so Github shows files with proper indentation
    (68346b6962).
  * The internal certificate of the load-tester plugin has been modified so it can again be
    used as end-entity cert with 5.6.3 and later (#3139).
  * The maximum data length of received COOKIE notifies (64 bytes) is now enforced (#3160).
  - Version 5.8.0
  ===============
  * The systemd service units have been renamed. The modern unit, which was called
    strongswan-swanctl, is now called strongswan (the previous name is configured as alias in
    the unit, for which a symlink is created when the unit is enabled). The legacy unit is now
    called strongswan-starter.
  * Support for XFRM interfaces (available since Linux 4.19) has been added, which are intended
    to replace VTI devices (they are similar but offer several advantages, for instance, they
    are not bound to an address or address family).
  * IPsec SAs and policies are associated with such interfaces via interface IDs that can be
    configured in swanctl.conf (dynamic IDs may optionally be allocated for each SA and even
    direction). It's possible to use separate interfaces for in- and outbound traffic (or
    only use an interface in one direction and regular policies in the other).
  * Interfaces may be created dynamically via updown/vici scripts, or statically before or after
    establishing the SAs. Routes must be added manually as needed (the daemon will not install
    any routes for outbound policies with an interface ID).
  * When moving XFRM interfaces to other network namespaces they retain access to the SAs and
    policies installed in the original namespace, which allows providing IPsec tunnels for
    processes in other network namespaces without giving them access to the IPsec keys or
    IKE credentials.
    More information can be found on the page about route-based VPNs.
  * Initiation of childless IKE_SAs is supported (RFC 6023). If enabled and supported by the
    responder, no CHILD_SA is established during IKE_AUTH. Instead, all CHILD_SAs are created
    with CREATE_CHILD_SA exchanges. This allows using a separate DH exchange even for the
    first CHILD_SA, which is otherwise created during IKE_AUTH with keys derived from the
    IKE_SA's key material.
  * The swanctl --initiate command may be used to initiate only the IKE_SA via --ike
    option if --child is omitted and the peer supports this extension.
  * The NetworkManager backend and plugin support IPv6.
  * The new wolfssl plugin is a wrapper around the wolfSSL crypto library. Thanks to Sean
    Parkinson of wolfSSL Inc. for the initial patch.
  * IKE SPIs may optionally be labeled via the charon.spi_mask|label options in
    strongswan.conf. This feature was extracted from charon-tkm, however, now applies the
    mask/label in network order.
  * The openssl plugin supports ChaCha20-Poly1305 when built with OpenSSL 1.1.0.
  * The PB-TNC finite state machine according to section 3.2 of RFC 5793 was not correctly
    implemented when sending either a CRETRY or SRETRY batch. These batches can only be sent
    in the "Decided" state and a CRETRY batch can immediately carry all messages usually
    transported by a CDATA batch. It is currently not possible to send a SRETRY batch since
    full-duplex mode for PT-TLS transport is not supported.
  * Instead of marking IPv6 virtual IPs as deprecated, the kernel-netlink plugin now uses
    address labels to avoid that such addresses are used for non-VPN traffic (00a953d090).
  * The agent plugin now creates sockets to the ssh/gpg-agent dynamically and does not keep
    them open, which otherwise might prevent the agent from getting terminated.
  * To avoid broadcast loops the forecast plugin now only reinjects packets that are marked
    or received from the configured interface.
  * UTF-8 encoded passwords are supported via EAP-MSCHAPv2, which internally uses an UTF-16LE
    encoding to calculate the NT hash (#3014).
  * Properly delete temporary drop policies (used when updating IP addresses of SAs) if manual
    priorities are used, which was broken since 5.6.2 (8e31d65730).
  * Avoid overwriting start_action when parsing the inactivity timeout in the vici plugin (#2954).
  * Fixed the automatic termination of reloaded vici connections with start_action=start,
    which was broken since 5.6.3 (71b22c250f).
  * The lookup for shared secrets for IKEv1 SAs via sql plugin should now work better
    (6ec9f68f32).
  * Fixed a race condition in the trap manager between installation and removal of a policy
    (69cbe2ca3f).
  * Compilation of the kernel-netlink plugin has been fixed on old kernels (&lt; 2.6.39), which
    was caused by the HW offload changes (c7f579fa17).
  * The IPsec stack detection and module loading in starter has been removed (it wasn't
    enforced anyway and loading modules doesn't seem necessary, also KLIPS hasn't been
    supported for a long time and PF_KEY will eventually be removed from the Linux kernel,
    ba817d2917).
  * Several IKEv2 protocol details are now handled more strictly: Unrequested virtual IPs are
    ignored, CFG_REPLY payloads are ignored if no CFG_REQUEST payloads were sent, a USE
    TRANSPORT_MODE notify received from the responder is checked against the local configuration.
  * The keys and certificates used by the scenarios in the testing environment are now generated
    dynamically. Running the testing/scripts/build-certs script after creating the base and root
    images uses the pki utility installed in the latter to create the keys and certificates for
    all the CAs and in some cases for individual scenarios. These credentials are stored in the
    source tree, not the image, so this has to be called only once even if the images are later
    rebuilt. The script automatically (re-)rebuilds the guest images as that generates fresh
    CRLs and signs the DNS zones. The only keys/certificates currently not generated are the
    very large ones used by the ikev2/rw-eap-tls-fragments scenario.
  - Version 5.7.2
  ===============
  * For RSA with PSS padding, the TPM 2.0 specification mandates the maximum salt length
    (as defined by the length of the key and hash). However, if the TPM is FIPS-168-4 compliant,
    the salt length equals the hash length. This is assumed for FIPS-140-2 compliant TPMs, but
    if that's not the case, it might be necessary to manually enable charon.plugins.tpm.fips_186_4
    if the TPM doesn't use the maximum salt length.
  * Directories for credentials loaded by swanctl are now accessed relative to the loaded
    swanctl.conf file, in particular, when loading it from a custom location via --file argument.
  * The base directory, which is used if no custom location for swanctl.conf is specified, is now
    also configurable at runtime via SWANCTL_DIR environment variable.
  * If RADIUS Accounting is enabled, the eap-radius plugin will add the session ID (Acct-Session-Id)
    to Access-Request messages, which e.g. simplifies associating database entries for IP leases and
    accounting with sessions (the session ID does not change when IKE_SAs are rekeyed, #2853).
  * All IP addresses assigned by a RADIUS server are included in Accounting-Stop messages even if
    the client did not claim them, allowing to release them early in case of connection errors (#2856).
  * Selectors installed on transport mode SAs by the kernel-netlink plugin are now updated if an
    IP address changes (e.g. via MOBIKE) and it was part of the selectors.
  * No deletes are sent anymore when a rekeyed CHILD_SA expires (#2815).
  * The bypass-lan plugin now tracks interfaces to handle subnets that move from one interface
    to another and properly update associated routes (#2820).
  * Only valid and expected inbound IKEv2 messages are used to update the timestamp of the
    last received message (previously, retransmits also triggered an update).
  * IKEv2 requests from responders are now ignored until the IKE_SA is fully established (e.g. if a
    DPD request from the peer arrives before the IKE_AUTH response does, 46bea1add9).
    Delayed IKE_SA_INIT responses with COOKIE notifies we already recevied are ignored, they caused
    another reset of the IKE_SA previously (#2837).
  * Active and queued Quick Mode tasks are now adopted if the peer reauthenticates an IKEv1 SA
    while creating lots of CHILD_SAs.
  * Newer versions of the FreeBSD kernel add an SADB_X_EXT_SA2 extension to SADB_ACQUIRE
    messages, which allows the kernel-pfkey plugin to determine the reqid of the policy even if it
    wasn't installed by the daemon previously (e.g. when using FreeBSD's if_ipsec(4) VTIs, which
    install policies themselves, 872b9b3e8d).
  * Added support for RSA signatures with SHA-256 and SHA-512 to the agent plugin. For older
    versions of ssh/gpg-agent that only support SHA-1, IKEv2 signature authentication has to be
    disabled via charon.signature_authentication.
  * The sshkey and agent plugins support Ed25519/Ed448 SSH keys and signatures.
  * The openssl plugin supports X25519/X448 Diffie-Hellman and Ed25519/Ed448 keys and
    signatures when built against OpenSSL 1.1.1.
  * Support for Ed25519, ChaCha20/Poly1305, SHA-3 and AES-CCM were added to the botan plugin.
  * The mysql plugin now properly handles database connections with transactions
    under heavy load (#2779).
  * IP addresses in ha pools are now distributed evenly among all segments (#2828).
  * Private key implementations may optionally provide a list of supported signature schemes,
    which, as described above, is used by the tpm plugin because for each key on a TPM 2.0 the
    hash algorithm and for RSA also the padding scheme is predefined.
  * The testing environment is now based on Debian 9 (stretch) by default. This required
    some changes, in particular, updating to FreeRADIUS 3.x (which forced us to abandon the
    TNC@FHH patches and scenarios, 2fbe44bef3) and removing FIPS-enabled versions of
    OpenSSL (the FIPS module only supports OpenSSL 1.0.2).
  * Most test scenarios were migrated to swanctl.
  - Version 5.7.1
  ===============
  * Fixes a vulnerability in the gmp plugin triggered by crafted certificates with RSA keys with
    very small moduli. When verifying signatures with such keys, the code patched with the fix
    for CVE-2018-16151/2 caused an integer underflow and subsequent heap buffer overflow
    that results in a crash of the daemon.
  * The vulnerability has been registered as CVE-2018-17540.
  - Version 5.7.0
  ===============
  * Fixes a potential authorization bypass vulnerability in the gmp plugin that was caused by a
    too lenient verification of PKCS#1 v1.5 signatures. Several flaws could be exploited by a
    Bleichenbacher-style attack to forge signatures for low-exponent keys (i.e. with e=3).
  * CVE-2018-16151 has been assigned to the problem of accepting random bytes after the OID
    of the hash function in such signatures, and CVE-2018-16152 has been assigned to the issue
    of not verifying that the parameters in the ASN.1 algorithmIdentitifer structure is empty.
    Other flaws that don't lead to a vulnerability directly (e.g. not checking for at least
    8 bytes of padding) have no separate CVE assigned.
  * Dots are not allowed anymore in section names in swanctl.conf and strongswan.conf.
    This mainly affects the configuration of file loggers. If the path for such a log file
    contains dots it now has to be configured in the new path setting within the arbitrarily
    renamed subsection in the filelog section.
  * Sections in swanctl.conf and strongswan.conf may now reference other sections. All settings
    and subsections from such a section are inherited. This allows to simplify configs as
    redundant information has only to be specified once and may then be included in other
    sections (see strongswan.conf for an example).
  * The originally selected IKE config (based on the IPs and IKE version) can now change
    if no matching algorithm proposal is found. This way the order of the configs doesn't
    matter that much anymore and it's easily possible to specify separate configs for
    clients that require weaker algorithms (instead of having to also add them in other
    configs that might be selected).
  * Support for Postquantum Preshared Keys for IKEv2 (draft-ietf-ipsecme-qr-ikev2) has been added.
    For an example refer to the swanctl/rw-cert-ppk scenario (or with EAP, or PSK authentication).
  * The new botan plugin is a wrapper around the Botan C++ crypto library.
    It requires a fairly recent build from Botan's master branch (or the upcoming 2.8.0 release).
    Thanks to René Korthaus and his team from Rohde &amp; Schwarz Cybersecurity for the initial
    patch and to Jack Lloyd for quickly adding missing functions to Botan's FFI (C89) interface.
  * Implementation of RFC 8412 "Software Inventory Message and Attributes (SWIMA) for PA-TNC".
  * SWIMA subscription option sets CLOSE_WRITE trigger on apt history.log file resulting in
    a ClientRetry PB-TNC batch to initialize a new measurement cycle. The new imv/imc-swima
    plugins replace the previous imv/imc-swid plugins, which were removed.
  * Added support for fuzzing the PA-TNC (RFC 5792) and PB-TNC (RFC 5793) NEA protocols
    on Google's OSS-Fuzz infrastructure.
  * Support for version 2 of Intel's TPM2-TSS TGC Software Stack. The presence of the
    in-kernel /dev/tpmrm0 resource manager is automatically detected.
  * The pki tool accepts a xmppAddr otherName as a subjectAlternativeName using the
    syntax --san xmppaddr:&lt;jid&gt;.
  * swanctl.conf supports the configuration of marks the in- and/or outbound SA should apply
    to packets after processing on Linux. Configuring such a mark for outbound SAs requires
    at least a 4.14 kernel. The ability to set a mask and configuring a mark/mask for
    inbound SAs will be added with the upcoming 4.19 kernel.
  * New options in swanctl.conf allow configuring how/whether DF, ECN and DS fields in the
    IP headers are copied during IPsec processing. Controlling this is currently only possible
    on Linux.
  * The handling of sequence numbers in IKEv1 DPDs has been improved (#2714).
  * To avoid conflicts, the dhcp plugin now only uses the DHCP server port if explicitly
    configured.
  - Version 5.6.3
  ===============
  * Fixed a DoS vulnerability in the IKEv2 key derivation if the openssl plugin is used in FIPS
    mode and HMAC-MD5 is negotiated as PRF.
    This vulnerability has been registered as CVE-2018-10811.
  * Fixed a vulnerability in the stroke plugin, which did not check the received length before
    reading a message from the socket. Unless a group is configured, root privileges are
    required to access that socket, so in the default configuration this shouldn't be an issue.
    This vulnerability has been registered as CVE-2018-5388.
  * CRLs that are not yet valid are now ignored to avoid problems in scenarios where expired
    certificates are removed from new CRLs and the clock on the host doing the revocation
    check is trailing behind that of the host issuing CRLs. Not doing this could result in
    accepting a revoked and expired certificate, if it's still valid according to the
    trailing clock but not contained anymore in not yet valid CRLs.
  * The issuer of fetched CRLs is now compared to the issuer of the checked certificate (#2608).
  * CRL validation results other than revocation (e.g. a skipped check because the CRL couldn't
    be fetched) are now stored also for intermediate CA certificates and not only for end-entity
    certificates, so a strict CRL policy can be enforced in such cases.
  * In compliance with RFC 4945, section 5.1.3.2, certificates used for IKE must now either
    not contain a keyUsage extension (like the ones generated by pki), or have at least one of the
    digitalSignature or nonRepudiation bits set.
  * New options for vici/swanctl allow forcing the local termination of an IKE_SA. This might be
    useful in situations where it's known the other end is not reachable anymore, or that it
    already removed the IKE_SA, so retransmitting a DELETE and waiting for a response would
    be pointless.
  * Waiting only a certain amount of time for a response (i.e. shorter than all retransmits
    would be) before destroying the IKE_SA is also possible by additionally specifying a
    timeout in the forced termination request.
  * When removing routes, the kernel-netlink plugin now checks if it tracks other routes for
    the same destination and replaces the installed route instead of just removing it. Same
    during installation, where existing routes previously weren't replaced. This should allow
    using traps with virtual IPs on Linux (#2162).
  * The dhcp plugin now only sends the client identifier DHCP option if the identity_lease
    setting is enabled (7b660944b6). It can also send identities of up to 255 bytes length,
    instead of the previous 64 bytes (30e886fe3b, 0e5b94d038). If a server address is
    configured, DHCP requests are now sent from port 67 instead of 68 to avoid ICMP port
    unreachables (becf027cd9).
  * The handling of faulty INVALID_KE_PAYLOAD notifies (e.g. one containing a DH group
    that wasn't proposed) during CREATE_CHILD_SA exchanges has been improved (#2536).
  * Roam events are now completely ignored for IKEv1 SAs (there is no MOBIKE to handle such
    changes properly).
  * ChaCha20/Poly1305 is now correctly proposed without key length (#2614). For compatibility with
    older releases the chacha20poly1305compat keyword may be included in proposals to also propose
    the algorithm with a key length (c58434aeff).
  * Configuration of hardware offload of IPsec SAs is now more flexible and allows a new
    setting (auto), which automatically uses it if the kernel and device both support it. If hw
    offload is set to yes and offloading is not supported, the CHILD_SA installation now fails.
  * The kernel-pfkey plugin optionally installs routes via internal interface (one with an IP
    in the local traffic selector). On FreeBSD, enabling this selects the correct source IP
    when sending packets from the gateway itself (e811659323).
  * SHA-2 based PRFs are supported in PKCS#8 files as generated by OpenSSL 1.1 (#2574).
  * The pki --verify tool may load CA certificates and CRLs from directories.
  * The IKE daemon now also switches to port 4500 if the remote port is not 500 (e.g. because the
    remote maps the response to a different port, as might happen on Azure), as long as the local
    port is 500 (85bfab621d).
  * Fixed an issue with DNS servers passed to NetworkManager in charon-nm (ee8c25516a).
  * Logged traffic selectors now always contain the protocol if either protocol or port are set
    (a36d8097ed).
  * Only the inbound SA/policy will be updated as reaction to IP address changes for rekeyed
    CHILD_SAs that are kept around.
  * The parser for strongswan.conf/swanctl.conf now accepts = characters in values without
    having to put the value in quotes (e.g. for Base64 encoded shared secrets).
    Notes for developers:
  * trap_manager_t: Trap policies are now unistalled by peer/child name and not the reqid.
  * No reqid is returned anymore when installing trap policies.
  * child_sa_t: A new state (CHILD_DELETED) is used for CHILD_SAs that have been deleted but
    not yet destroyed (after a rekeying CHILD_SAs are kept around for a while to process
    delayed packets).
    This way child_updown events are not triggered anymore for such SAs when an IKE_SA that
    has such CHILD_SAs assigned is deleted.
  - Version 5.6.2
  ===============
  * Fixed a DoS vulnerability in the parser for PKCS#1 RSASSA-PSS signatures that was caused
    by insufficient input validation. One of the configurable parameters in algorithm identifier
    structures for RSASSA-PSS signatures is the mask generation function (MGF). Only MGF1 is
    currently specified for this purpose. However, this in turn takes itself a parameter that
    specifies the underlying hash function. strongSwan's parser did not correctly handle the
    case of this parameter being absent, causing an undefined data read.
    This vulnerability has been registered as CVE-2018-6459.
  * When rekeying IKEv2 IKE_SAs the previously negotiated DH group will be reused, instead of
    using the first configured group, which avoids an additional exchange if the peer previously
    selected a different DH group via INVALID_KE_PAYLOAD notify. The same is also done when
    rekeying CHILD_SAs except for the first rekeying of the CHILD_SA that was created with the
    IKE_SA, where no DH group was negotiated yet.
    Also, the selected DH group is moved to the front in all sent proposals that contain it
    and all proposals that don't are moved to the back in order to convey the preference for
    this group to the peer.
  * Handling of MOBIKE task queuing has been improved. In particular, the response to an
    address update (with NAT-D payloads) is not ignored anymore if only an address list update
    or DPD is queued as that could prevent updating the UDP encapsulation in the kernel.
  * On Linux, roam events may optionally be triggered by changes to the routing rules, which
    can be useful if routing rules (instead of e.g. route metrics) are used to switch from one
    to another interface (i.e. from one to another routing table). Since routing rules are
    currently not evaluated when doing route lookups this is only useful if the kernel-based
    route lookup is used (4664992f7d).
  * The fallback drop policies installed to avoid traffic leaks when replacing addresses in
    installed policies are now replaced by temporary drop policies, which also prevent
    acquires because we currently delete and reinstall IPsec SAs to update their addresses
    (35ef1b032d).
  * Access X.509 certificates held in non-volatile storage of a TPM 2.0 referenced via the
    NV index.
    Adding the --keyid parameter to pki --print allows to print private keys or certificates
    stored in a smartcard or a TPM 2.0.
  * Fixed proposal selection if a peer incorrectly sends DH groups in the ESP proposal during
    IKE_AUTH and also if a DH group is configured in the local ESP proposal and charon.prefer
    configured_proposals is disabled (d058fd3c32).
  * The lookup for PSK secrets for IKEv1 has been improved for certain scenarios (see #2497
    for details).
  * MSKs received via RADIUS are now padded to 64 bytes to avoid compatibility issues with
    EAP-MSCHAPv2 and PRFs that have a block size &lt; 64 bytes (e.g. AES-XCBC-PRF-128, see
    73cbce6013).
  * The tpm_extendpcr command line tool extends a digest into a TPM PCR.
  * Ported the NetworkManager backend from the deprecated libnm-glib to libnm.
  * The save-keys debugging/development plugin saves IKE and/or ESP keys to files compatible
    with Wireshark.
  - Version 5.6.1
  ===============
  * Several algorithms were removed from the default ESP/AH and IKE proposals in compliance with
    RFC 8221 and RFC 8247, respectively. Removed from the default ESP/AH proposal were the
    3DES and Blowfish encryption algorithms and the HMAC-MD5 integrity algorithm. From the IKE
    default proposal the HMAC-MD5 integrity algorithm and the MODP-1024 Diffie-Hellman group
    were removed (the latter is significant for Windows clients in their default configuration).
    These algorithms may still be used in custom proposals.
  * Support for RSASSA-PSS signatures has been added. For compatibility with previous
    releases they are currently not used automatically, by default, to change that charon.rsa_pss
    may be enabled. To explicitly use or require such signatures during IKEv2 signature
    authentication (RFC 7427) ike:rsa/pss... authentication constraints may be used for specific
    connections (regardless of whether the strongswan.conf option above is enabled). Only the
    hash algorithm can be specified in such constraints, the MGF1 will be based on that hash
    and the salt length will equal the hash length (when verifying the salt length is not
    enforced).
    To enforce such signatures during PKI verification use rsa/pss... authentication constraints.
  * All pki commands that create certificates/CRLs can be made to sign with RSASSA-PSS instead
    of the classing PKCS#1 scheme with the --rsa-padding pss option. As with signatures during
    authentication, only the hash algorithm is configurable (via --digest option), the MGF1 will
    be based on that and the salt length will equal the hash length.
  * These signatures are supported by all RSA backends except pkcs11 (i.e. gmp, gcrypt, openssl).
    The gmp plugin requires the mgf1 plugin.
    Note that RSASSA-PSS algorithm identifiers and parameters in keys (public keys in
    certificates or private keys in PKCS#8 files) are currently not used as constraints.
  * The sec-updater tool checks for security updates in dpkg-based repositories
    (e.g. Debian/Ubuntu) and sets the security flags in the IMV policy database accordingly.
    Additionally for each new package version a SWID tag for the given OS and HW architecture
    is created and stored in the database.
  * Using the sec-updater.sh script template the lookup can be automated (e.g. via an hourly
    cron job).
  * When restarting an IKEv2 negotiation after receiving an INVALID_KE_PAYLOAD notify (or due
    to other reasons like too many retransmits) a new initiator SPI is allocated. This
    prevents issues caused by retransmits for IKE_SA_INIT messages.
  * Because the initiator SPI was previously reused when restarting the connection delayed
    responses for previous connection attempts were processed and might have caused fatal
    errors due to a failed DH negotiation or because of the internal retry counter in the
    ike-init task. For instance, if we proposed a DH group the responder rejected we
    might have later received delayed responses that either contained INVALID_KE_PAYLOAD
    notifies with the DH group we already switched to, or, if we retransmitted an
    IKE_SA_INIT with the requested group but then had to restart again, a KE payload with
    a group different from the one we proposed.
  * The introduction of file versions in the IMV database scheme broke file reference hash
    measurements. This has been fixed by creating generic product versions having an empty
    package name.
  * A new timeout option for the systime-fix plugin stops periodic system time checks after
    a while and enforces a certificate verification, closing or reauthenticating all SAs
    with invalid certificates.
  * The IKE event counters, previously only available via ipsec listcounters command, may
    now also be queried and reset via vici and the new swanctl --counters command. They
    are collected and provided by the optional counters plugin (enabled by default for
    backwards compatibility if the stroke plugin is built).
  * Class attributes received in RADIUS Access-Accept messages may optionally be added to
    RADIUS accounting messages (655924074b).
  * Basic support for systemd sockets has been added, which may be used for privilege separation
    (59db98fb94).
  * Inbound marks may optionally be installed in the SA again (was removed with 5.5.2) by
    enabling the mark_in_sa option in swanctl.conf.
  * The timeout of leases in pools configured via pool utility may be configured in other
    units than hours.
    INITIAL_CONTACT notifies are now only omitted if never is configured as uniqueness policy.
  * Outbound FWD policies for shunts are not installed anymore, by default (as is the case
    for other policies since 5.5.1).
  * Don't consider a DH group mismatch during CHILD_SA rekeying as failure as responder
    (e7276f78aa).
  * Handling of fragmented IPv4 and IPv6 packets in libipsec has been improved (e138003de9).
  * Trigger expire events for the correct IPsec SA in libipsec (6e861947a0).
  * A crash in CRL verification via openssl plugin using OpenSSL 1.1 has been fixed (78acaba6a1).
  * No hard-coded default proposals are passed from starter to the stroke plugin anymore (the
    IKE proposal used curve25519 since 5.5.2, which is an optional plugin).
  * A workaround for an issue with virtual IPs on macOS 10.13 (High Sierra) has been added
    (039b85dd43).
  * Handling of IKE_SA rekey collisions in charon-tkm has been fixed.
  * Instead of failing or just silently doing nothing unit tests may now warn about certain
    conditions (e.g. if a test was not executed due to external dependencies).</changelog>
  <changelog author="mmnelemane@suse.com" date="1585224000">- Fix for to resolve multiple definition of swanctl_dir (bsc #1164493)
  [+ 0006-Resolve-multiple-definition-of-swanctl_dir.patch]</changelog>
  <changelog author="mbuil@suse.com" date="1610712000">- Fix typo in README (bsc #1167880)
  [+ 0007-Fix-typo-in-README.patch ]</changelog>
  <changelog author="mbuil@suse.com" date="1611576000">- Fix FIPS bug (bsc #1180801)
  [+ 0008-gcrypt-Use-a-dummy-buffer-to-initialize-static-alloc.patch ]</changelog>
  <changelog author="mbuil@suse.com" date="1617019200">- Keep using ipsec as the main binary. Therefore, make strongswan.service point to it instead of swanctl</changelog>
  <changelog author="mbuil@suse.com" date="1617019201">- Information added in README about the rcstrongswan-starter</changelog>
  <changelog author="mbuil@suse.com" date="1617624000">- Add config to run ipsec on namespaces (bsc #1183670)</changelog>
  <changelog author="mt@suse.com" date="1619006400">- Add support for AES CCM aead algorithms to openssl plugin (cc/fips,bsc#1185363)
  [+ 0009-strongswan-openssl-aead-add-ccm-support.patch]</changelog>
  <changelog author="mt@suse.com" date="1620388800">- Replace AEAD AES CCM patch with upstream variant (cc/fips,bsc#1185363)
  [* 0009-strongswan-openssl-aead-add-ccm-support.patch]</changelog>
  <changelog author="hare@suse.de" date="1627646400">- Add auth_els plugin to support Marvell FC-SP encryption (jsc#SLE-20151)
  [* strongswan-marvell-auth-els.patch]</changelog>
  <changelog author="abergmann@suse.com" date="1634040000">- Fix integer overflow in gmp plugin (bsc#1191367, CVE-2021-41990)
  [* strongswan-5.6.1-5.9.3_gmp-rsa-ssa-salt-len.patch]
- Fix integer overflow when replacing certificates in cache (bsc#1191435, CVE-2021-41991)
  [* strongswan-4.4.1-5.9.3_cert-cache-random.patch]</changelog>
  <changelog author="meissner@suse.com" date="1643025600">- strongswan-5.5.0-5.9.4_eap_success-CVE-2021-45079.patch:
  Fixed authentication bypass in EAP authentication (CVE-2021-45079
  bsc#1194471)</changelog>
</package>
<package pkgid="d597923bf1e9c316ba4b2cbb28377212d8cbee305efafb0fdabdf23d61de17eb" name="strongswan-libs0" arch="aarch64">
  <version epoch="0" ver="5.8.2" rel="11.24.1"/>
  <changelog author="ndas@suse.de" date="1501502400">- Updated to strongSwan 5.3.5(bsc#1050691) providing the following changes:
  * Fixed a DoS vulnerability in the gmp plugin that was caused by insufficient input
    validation when verifying RSA signatures. More specifically, mpz_powm_sec() has two
    requirements regarding the passed exponent and modulus that the plugin did not
    enforce, if these are not met the calculation will result in a floating point exception
    that crashes the whole process.
    This vulnerability has been registered as CVE-2017-9022.
    Please refer to our blog for details.
  * Fixed a DoS vulnerability in the x509 plugin that was caused because the ASN.1 parser
    didn't handle ASN.1 CHOICE types properly, which could result in an infinite loop when
    parsing X.509 extensions that use such types.
    This vulnerability has been registered as CVE-2017-9023.
    Please refer to our blog for details.
  * The behavior during IKEv2 CHILD_SA rekeying has been changed in order to avoid
    traffic loss. When responding to a CREATE_CHILD_SA request to rekey a CHILD_SA
    the responder already has everything available to install and use the new CHILD_SA.
    However, this could lead to lost traffic as the initiator won't be able to process
    inbound packets until it processed the CREATE_CHILD_SA response and updated the
    inbound SA. To avoid this the responder now only installs the new inbound SA and
    delays installing the outbound SA until it receives the DELETE for the replaced CHILD_SA.
  * The messages transporting these DELETEs could reach the peer before packets sent
    with the deleted outbound SAs reach it. To reduce the chance of traffic loss due
    to this the inbound SA of the replaced CHILD_SA is not removed for a configurable
    amount of seconds (charon.delete_rekeyed_delay) after the DELETE has been processed.
  * The code base has been ported to Apple's ARM64 iOS platform, which required several
    changes regarding the use of variadic functions. This was necessary because the calling
    conventions for variadic and regular functions are different there.
    This means that assigning a non-variadic function to a variadic function pointer, as we
    did with our enumerator_t::enumerate() implementations and several callbacks, will
    result in crashes as the called function accesses the arguments differently than the
    caller provided them. To avoid this issue the enumerator_t interface has been changed
    and the signature of the callback functions for enumerator_create_filter() and two
    methods on linked_list_t have been changed. Refer to the developer notes below
    for details.
  * Adds support for fuzzing the certificate parser provided by the default plugins
    (x509, pem, gmp etc.) on Google's OSS-Fuzz infrastructure (or generally with
    libFuzzer). Several issues found while fuzzing these plugins were fixed.
  * Two new options have been added to charon's retransmission settings:
    retransmit_limit and retransmit_jitter. The former adds an upper limit to the
    calculated retransmission timeout, the latter randomly reduces it.
    Refer to Retransmission for details.
  * A bug in swanctl's --load-creds command was fixed that caused unencrypted
    private keys to get unloaded if the command was called multiple times.
    The load-key VICI command now returns the key ID of the loaded key on success.
  * The credential manager now enumerates local credential sets before global ones.
    This means certificates supplied by the peer will now be preferred over certificates
    with the same identity that may be locally stored (e.g. in the certificate cache).
  * Adds support for hardware offload of IPsec SAs as introduced by Linux 4.11 for
    specific hardware that supports this.
  * The pki tool loads the curve25519 plugin by default.
    [- 0006-Make-sure-the-modulus-is-odd-and-the-exponent-not-zero.patch,
  - 0007-asn1-parser-Fix-CHOICE-parsing.patch]
- libhydra is removed as all kernel plugins moved to libcharon</changelog>
  <changelog author="ndas@suse.de" date="1504612800">- fix "uintptr_t? undeclared" compilation error.
  [+0006-fix-compilation-error-by-adding-stdint.h.patch]</changelog>
  <changelog author="ndas@suse.de" date="1504612801">- Updated to strongSwan 5.6.0 providing the following changes:
  * Fixed a DoS vulnerability in the gmp plugin that was caused by insufficient input validation
    when verifying RSA signatures, which requires decryption with the operation m^e mod n,
    where m is the signature, and e and n are the exponent and modulus of the public key.
    The value m is an integer between 0 and n-1, however, the gmp plugin did not verify this.
    So if m equals n the calculation results in 0, in which case mpz_export() returns NULL.
    This result wasn't handled properly causing a null-pointer dereference.
    This vulnerability has been registered as CVE-2017-11185. (bsc#1051222)
  * New SWIMA IMC/IMV pair implements the draft-ietf-sacm-nea-swima-patnc Internet
    Draft and has been demonstrated at the IETF 99 Prague Hackathon.
  * The IMV database template has been adapted to achieve full compliance with the
    ISO 19770-2:2015 SWID tag standard.
  * The pt-tls-client can attach and use TPM 2.0 protected private keys via the --keyid parameter.
  * By default the /etc/swanctl/conf.d directory is created and *.conf files in it are included in the default
    swanctl.conf file.
  * The curl plugin now follows HTTP redirects (configurable via strongswan.conf).
  * The CHILD_SA rekeying was fixed in charon-tkm and the behavior is refined a bit more since 5.5.3
  * libtpmtss supports Intel's TSS2 Architecture Broker and Resource Manager interface (tcti-tabrmd).
  * more on https://wiki.strongswan.org/versions/66</changelog>
  <changelog author="mmnelemane@suse.com" date="1521028800">- Removed unused requires and macro calls(bsc#1083261)</changelog>
  <changelog author="mmnelemane@suse.com" date="1573646400">- Added patch to fix vulnerability: CVE-2018-16151,CVE-2018-16152 (bsc#1107874)
  - Insufficient input validation in gmp plugin
  [+ 0007-strongswan-5.3.1-5.6.0_gmp-pkcs1-verify.patch]</changelog>
  <changelog author="mmnelemane@suse.com" date="1573646401">- Added patch to fix vulnerability: CVE-2018-5388 (bsc#1094462)
  - Buffer Underflow in stroke_socket.c
  [+ 0008-strongswan-5.1.2-5.6.2_stroke_msg_len.patch]</changelog>
  <changelog author="mmnelemane@suse.com" date="1573646402">- Added patch to fix vulnerability: CVE-2018-10811 (bsc#1093536)
  - denial-of-service vulnerability
  [+ 0009-strongswan-5.5.0-5.6.2_skeyseed_init.patch]</changelog>
  <changelog author="mmnelemane@suse.com" date="1573732800">- Added patch to fix vulnerability: CVE-2018-17540 (bsc#1109845)
  [+ 0010-strongswan-4.4.0-5.7.0_gmp-pkcs1-overflow.patch]</changelog>
  <changelog author="mmnelemane@suse.com" date="1580212800">- Updated to version 5.8.2 (jsc#SLE-11370)
  - Dropped following patches due to irrelevance in the updated version:
    [- strongswan_modprobe_syslog.patch ]
    [- strongswan_fipsfilter.patch ]
    [- 0006-fix-compilation-error-by-adding-stdint.h.patch ]
    [- 0007-strongswan-5.3.1-5.6.0_gmp-pkcs1-verify.patch ]
    [- 0008-strongswan-5.1.2-5.6.2_stroke_msg_len.patch ]
    [- 0009-strongswan-5.5.0-5.6.2_skeyseed_init.patch ]
    [- 0010-strongswan-4.4.0-5.7.0_gmp-pkcs1-overflow.patch ]
  - Version 5.8.2
  ===============
  * Identity-based CA constraints, which enforce that the certificate chain of the remote
    peer contains a CA certificate with a specific identity, are supported via
    vici/swanctl.conf. This is similar to the existing CA constraints but doesn't require
    that the CA certificate is locally installed, for instance, intermediate CA certificates
    received from the peers. Wildcard identity matching (e.g. ..., OU=Research, CN=*) could
    also be used for the latter but requires trust in the intermediate CAs to only issue
    certificates with legitimate subject DNs (e.g. the "Sales" CA must not issue certificates
    with OU=Research). With the new constraint that's not necessary as long as a path length
    basic constraint (--pathlen for pki --issue) prevents intermediate CAs from issuing further
    intermediate CAs.
  * Intermediate CA certificates may now be sent in hash-and-URL encoding by configuring a
    base URL for the parent CA (#3234, swanctl/rw-hash-and-url-multi-level).
  * Implemented NIST SP-800-90A Deterministic Random Bit Generator (DRBG) based on AES-CTR
    and SHA2-HMAC modes. Currently used by the gmp and ntru plugins.
  * Random nonces sent in an OCSP requests are now expected in the corresponding OCSP responses.
  * The kernel-netlink plugin now ignores deprecated IPv6 addresses for MOBIKE. Whether temporary
    or permanent IPv6 addresses are included now depends on the charon.prefer_temporary_addrs
    setting (#3192).
  * Extended Sequence Numbers (ESN) are configured via PF_KEY if supported by the kernel.
  * The PF_KEY socket's receive buffer in the kernel-pfkey plugin is now cleared before sending
    requests, as many of the messages sent by the kernel are sent as broadcasts to all PF_KEY
    sockets. This is an issue if an external tool is used to manage SAs/policies unrelated to
    IPsec (#3225).
  * The vici plugin now uses unique section names for CHILD_SAs in child-updown events (7c74ce9190).
  * For individually deleted CHILD_SAs (in particular for IKEv1) the vici child-updown event
    now includes more information about the CHILD_SAs such as traffic statistics (#3198).
  * Custom loggers are correctly re-registered if log levels are changed via stroke loglevel (#3182).
  * Avoid lockups during startup on low entropy systems when using OpenSSL 1.1.1 (095a2c2eac).
  * Instead of failing later when setting a key, creating HMACs via openssl plugin now fails
    instantly if the underlying hash algorithm isn't supported (e.g. MD5 in FIPS-mode) so fallbacks
    to other plugins work properly (#3284).
  * Exponents of RSA keys read from TPM 2.0 via SAPI are correctly converted (8ee1242f1438).
  * Routing table IDs &gt; 255 are supported for custom routes on Linux.
  * To avoid races, the check for hardware offloading support in the kernel-netlink plugin is
    performed during initialization of the plugin (a605452c03).
  * The D-Bus config file for charon-nm is now installed in $(datadir)/dbus-1/system.d instead of
    $(sysconfdir)/dbus-1/system.d, which is intended for sysadmin overrides.
    INVALID_MAJOR_VERSION notifies are now correctly sent in messages of the same exchange type
    and with the same message ID as the request.
  * IKEv2 SAs are now immediately destroyed when sending or receiving INVALID_SYNTAX notifies
    in authenticated messages.
  * For developers working from the repository the configure script now aborts if GNU gperf is
    not found.
  - Version 5.8.1
  ===============
  * RDNs in DNs of X.509 certificates can now optionally be matched less strict. The global
    strongswan.conf option charon.rdn_matching takes two alternative values that cause the
    matching algorithm to either ignore the order of matched RDNs (reordered) or additionally
    (relaxed) accept DNs that contain more RDNs than configured (unmatched RDNs are treated
    like wildcard matches).
  * The updown plugin now passes the same interface to the script that is also used for the
    automatically installed routes, that is, the interface over which the peer is reached
    instead of the interface on which the local address is found (#3095).
  * TPM 2.0 contexts are now protected by a mutex to prevent issues if multiple IKE_SAs use
    the same private key concurrently (4b25885025).
  * Do a rekey check after the third QM message was received (#3060).
  * If available, explicit_bzero() is now used as memwipe() instead of our own implementation.
  * An .editorconfig file has been added, mainly so Github shows files with proper indentation
    (68346b6962).
  * The internal certificate of the load-tester plugin has been modified so it can again be
    used as end-entity cert with 5.6.3 and later (#3139).
  * The maximum data length of received COOKIE notifies (64 bytes) is now enforced (#3160).
  - Version 5.8.0
  ===============
  * The systemd service units have been renamed. The modern unit, which was called
    strongswan-swanctl, is now called strongswan (the previous name is configured as alias in
    the unit, for which a symlink is created when the unit is enabled). The legacy unit is now
    called strongswan-starter.
  * Support for XFRM interfaces (available since Linux 4.19) has been added, which are intended
    to replace VTI devices (they are similar but offer several advantages, for instance, they
    are not bound to an address or address family).
  * IPsec SAs and policies are associated with such interfaces via interface IDs that can be
    configured in swanctl.conf (dynamic IDs may optionally be allocated for each SA and even
    direction). It's possible to use separate interfaces for in- and outbound traffic (or
    only use an interface in one direction and regular policies in the other).
  * Interfaces may be created dynamically via updown/vici scripts, or statically before or after
    establishing the SAs. Routes must be added manually as needed (the daemon will not install
    any routes for outbound policies with an interface ID).
  * When moving XFRM interfaces to other network namespaces they retain access to the SAs and
    policies installed in the original namespace, which allows providing IPsec tunnels for
    processes in other network namespaces without giving them access to the IPsec keys or
    IKE credentials.
    More information can be found on the page about route-based VPNs.
  * Initiation of childless IKE_SAs is supported (RFC 6023). If enabled and supported by the
    responder, no CHILD_SA is established during IKE_AUTH. Instead, all CHILD_SAs are created
    with CREATE_CHILD_SA exchanges. This allows using a separate DH exchange even for the
    first CHILD_SA, which is otherwise created during IKE_AUTH with keys derived from the
    IKE_SA's key material.
  * The swanctl --initiate command may be used to initiate only the IKE_SA via --ike
    option if --child is omitted and the peer supports this extension.
  * The NetworkManager backend and plugin support IPv6.
  * The new wolfssl plugin is a wrapper around the wolfSSL crypto library. Thanks to Sean
    Parkinson of wolfSSL Inc. for the initial patch.
  * IKE SPIs may optionally be labeled via the charon.spi_mask|label options in
    strongswan.conf. This feature was extracted from charon-tkm, however, now applies the
    mask/label in network order.
  * The openssl plugin supports ChaCha20-Poly1305 when built with OpenSSL 1.1.0.
  * The PB-TNC finite state machine according to section 3.2 of RFC 5793 was not correctly
    implemented when sending either a CRETRY or SRETRY batch. These batches can only be sent
    in the "Decided" state and a CRETRY batch can immediately carry all messages usually
    transported by a CDATA batch. It is currently not possible to send a SRETRY batch since
    full-duplex mode for PT-TLS transport is not supported.
  * Instead of marking IPv6 virtual IPs as deprecated, the kernel-netlink plugin now uses
    address labels to avoid that such addresses are used for non-VPN traffic (00a953d090).
  * The agent plugin now creates sockets to the ssh/gpg-agent dynamically and does not keep
    them open, which otherwise might prevent the agent from getting terminated.
  * To avoid broadcast loops the forecast plugin now only reinjects packets that are marked
    or received from the configured interface.
  * UTF-8 encoded passwords are supported via EAP-MSCHAPv2, which internally uses an UTF-16LE
    encoding to calculate the NT hash (#3014).
  * Properly delete temporary drop policies (used when updating IP addresses of SAs) if manual
    priorities are used, which was broken since 5.6.2 (8e31d65730).
  * Avoid overwriting start_action when parsing the inactivity timeout in the vici plugin (#2954).
  * Fixed the automatic termination of reloaded vici connections with start_action=start,
    which was broken since 5.6.3 (71b22c250f).
  * The lookup for shared secrets for IKEv1 SAs via sql plugin should now work better
    (6ec9f68f32).
  * Fixed a race condition in the trap manager between installation and removal of a policy
    (69cbe2ca3f).
  * Compilation of the kernel-netlink plugin has been fixed on old kernels (&lt; 2.6.39), which
    was caused by the HW offload changes (c7f579fa17).
  * The IPsec stack detection and module loading in starter has been removed (it wasn't
    enforced anyway and loading modules doesn't seem necessary, also KLIPS hasn't been
    supported for a long time and PF_KEY will eventually be removed from the Linux kernel,
    ba817d2917).
  * Several IKEv2 protocol details are now handled more strictly: Unrequested virtual IPs are
    ignored, CFG_REPLY payloads are ignored if no CFG_REQUEST payloads were sent, a USE
    TRANSPORT_MODE notify received from the responder is checked against the local configuration.
  * The keys and certificates used by the scenarios in the testing environment are now generated
    dynamically. Running the testing/scripts/build-certs script after creating the base and root
    images uses the pki utility installed in the latter to create the keys and certificates for
    all the CAs and in some cases for individual scenarios. These credentials are stored in the
    source tree, not the image, so this has to be called only once even if the images are later
    rebuilt. The script automatically (re-)rebuilds the guest images as that generates fresh
    CRLs and signs the DNS zones. The only keys/certificates currently not generated are the
    very large ones used by the ikev2/rw-eap-tls-fragments scenario.
  - Version 5.7.2
  ===============
  * For RSA with PSS padding, the TPM 2.0 specification mandates the maximum salt length
    (as defined by the length of the key and hash). However, if the TPM is FIPS-168-4 compliant,
    the salt length equals the hash length. This is assumed for FIPS-140-2 compliant TPMs, but
    if that's not the case, it might be necessary to manually enable charon.plugins.tpm.fips_186_4
    if the TPM doesn't use the maximum salt length.
  * Directories for credentials loaded by swanctl are now accessed relative to the loaded
    swanctl.conf file, in particular, when loading it from a custom location via --file argument.
  * The base directory, which is used if no custom location for swanctl.conf is specified, is now
    also configurable at runtime via SWANCTL_DIR environment variable.
  * If RADIUS Accounting is enabled, the eap-radius plugin will add the session ID (Acct-Session-Id)
    to Access-Request messages, which e.g. simplifies associating database entries for IP leases and
    accounting with sessions (the session ID does not change when IKE_SAs are rekeyed, #2853).
  * All IP addresses assigned by a RADIUS server are included in Accounting-Stop messages even if
    the client did not claim them, allowing to release them early in case of connection errors (#2856).
  * Selectors installed on transport mode SAs by the kernel-netlink plugin are now updated if an
    IP address changes (e.g. via MOBIKE) and it was part of the selectors.
  * No deletes are sent anymore when a rekeyed CHILD_SA expires (#2815).
  * The bypass-lan plugin now tracks interfaces to handle subnets that move from one interface
    to another and properly update associated routes (#2820).
  * Only valid and expected inbound IKEv2 messages are used to update the timestamp of the
    last received message (previously, retransmits also triggered an update).
  * IKEv2 requests from responders are now ignored until the IKE_SA is fully established (e.g. if a
    DPD request from the peer arrives before the IKE_AUTH response does, 46bea1add9).
    Delayed IKE_SA_INIT responses with COOKIE notifies we already recevied are ignored, they caused
    another reset of the IKE_SA previously (#2837).
  * Active and queued Quick Mode tasks are now adopted if the peer reauthenticates an IKEv1 SA
    while creating lots of CHILD_SAs.
  * Newer versions of the FreeBSD kernel add an SADB_X_EXT_SA2 extension to SADB_ACQUIRE
    messages, which allows the kernel-pfkey plugin to determine the reqid of the policy even if it
    wasn't installed by the daemon previously (e.g. when using FreeBSD's if_ipsec(4) VTIs, which
    install policies themselves, 872b9b3e8d).
  * Added support for RSA signatures with SHA-256 and SHA-512 to the agent plugin. For older
    versions of ssh/gpg-agent that only support SHA-1, IKEv2 signature authentication has to be
    disabled via charon.signature_authentication.
  * The sshkey and agent plugins support Ed25519/Ed448 SSH keys and signatures.
  * The openssl plugin supports X25519/X448 Diffie-Hellman and Ed25519/Ed448 keys and
    signatures when built against OpenSSL 1.1.1.
  * Support for Ed25519, ChaCha20/Poly1305, SHA-3 and AES-CCM were added to the botan plugin.
  * The mysql plugin now properly handles database connections with transactions
    under heavy load (#2779).
  * IP addresses in ha pools are now distributed evenly among all segments (#2828).
  * Private key implementations may optionally provide a list of supported signature schemes,
    which, as described above, is used by the tpm plugin because for each key on a TPM 2.0 the
    hash algorithm and for RSA also the padding scheme is predefined.
  * The testing environment is now based on Debian 9 (stretch) by default. This required
    some changes, in particular, updating to FreeRADIUS 3.x (which forced us to abandon the
    TNC@FHH patches and scenarios, 2fbe44bef3) and removing FIPS-enabled versions of
    OpenSSL (the FIPS module only supports OpenSSL 1.0.2).
  * Most test scenarios were migrated to swanctl.
  - Version 5.7.1
  ===============
  * Fixes a vulnerability in the gmp plugin triggered by crafted certificates with RSA keys with
    very small moduli. When verifying signatures with such keys, the code patched with the fix
    for CVE-2018-16151/2 caused an integer underflow and subsequent heap buffer overflow
    that results in a crash of the daemon.
  * The vulnerability has been registered as CVE-2018-17540.
  - Version 5.7.0
  ===============
  * Fixes a potential authorization bypass vulnerability in the gmp plugin that was caused by a
    too lenient verification of PKCS#1 v1.5 signatures. Several flaws could be exploited by a
    Bleichenbacher-style attack to forge signatures for low-exponent keys (i.e. with e=3).
  * CVE-2018-16151 has been assigned to the problem of accepting random bytes after the OID
    of the hash function in such signatures, and CVE-2018-16152 has been assigned to the issue
    of not verifying that the parameters in the ASN.1 algorithmIdentitifer structure is empty.
    Other flaws that don't lead to a vulnerability directly (e.g. not checking for at least
    8 bytes of padding) have no separate CVE assigned.
  * Dots are not allowed anymore in section names in swanctl.conf and strongswan.conf.
    This mainly affects the configuration of file loggers. If the path for such a log file
    contains dots it now has to be configured in the new path setting within the arbitrarily
    renamed subsection in the filelog section.
  * Sections in swanctl.conf and strongswan.conf may now reference other sections. All settings
    and subsections from such a section are inherited. This allows to simplify configs as
    redundant information has only to be specified once and may then be included in other
    sections (see strongswan.conf for an example).
  * The originally selected IKE config (based on the IPs and IKE version) can now change
    if no matching algorithm proposal is found. This way the order of the configs doesn't
    matter that much anymore and it's easily possible to specify separate configs for
    clients that require weaker algorithms (instead of having to also add them in other
    configs that might be selected).
  * Support for Postquantum Preshared Keys for IKEv2 (draft-ietf-ipsecme-qr-ikev2) has been added.
    For an example refer to the swanctl/rw-cert-ppk scenario (or with EAP, or PSK authentication).
  * The new botan plugin is a wrapper around the Botan C++ crypto library.
    It requires a fairly recent build from Botan's master branch (or the upcoming 2.8.0 release).
    Thanks to René Korthaus and his team from Rohde &amp; Schwarz Cybersecurity for the initial
    patch and to Jack Lloyd for quickly adding missing functions to Botan's FFI (C89) interface.
  * Implementation of RFC 8412 "Software Inventory Message and Attributes (SWIMA) for PA-TNC".
  * SWIMA subscription option sets CLOSE_WRITE trigger on apt history.log file resulting in
    a ClientRetry PB-TNC batch to initialize a new measurement cycle. The new imv/imc-swima
    plugins replace the previous imv/imc-swid plugins, which were removed.
  * Added support for fuzzing the PA-TNC (RFC 5792) and PB-TNC (RFC 5793) NEA protocols
    on Google's OSS-Fuzz infrastructure.
  * Support for version 2 of Intel's TPM2-TSS TGC Software Stack. The presence of the
    in-kernel /dev/tpmrm0 resource manager is automatically detected.
  * The pki tool accepts a xmppAddr otherName as a subjectAlternativeName using the
    syntax --san xmppaddr:&lt;jid&gt;.
  * swanctl.conf supports the configuration of marks the in- and/or outbound SA should apply
    to packets after processing on Linux. Configuring such a mark for outbound SAs requires
    at least a 4.14 kernel. The ability to set a mask and configuring a mark/mask for
    inbound SAs will be added with the upcoming 4.19 kernel.
  * New options in swanctl.conf allow configuring how/whether DF, ECN and DS fields in the
    IP headers are copied during IPsec processing. Controlling this is currently only possible
    on Linux.
  * The handling of sequence numbers in IKEv1 DPDs has been improved (#2714).
  * To avoid conflicts, the dhcp plugin now only uses the DHCP server port if explicitly
    configured.
  - Version 5.6.3
  ===============
  * Fixed a DoS vulnerability in the IKEv2 key derivation if the openssl plugin is used in FIPS
    mode and HMAC-MD5 is negotiated as PRF.
    This vulnerability has been registered as CVE-2018-10811.
  * Fixed a vulnerability in the stroke plugin, which did not check the received length before
    reading a message from the socket. Unless a group is configured, root privileges are
    required to access that socket, so in the default configuration this shouldn't be an issue.
    This vulnerability has been registered as CVE-2018-5388.
  * CRLs that are not yet valid are now ignored to avoid problems in scenarios where expired
    certificates are removed from new CRLs and the clock on the host doing the revocation
    check is trailing behind that of the host issuing CRLs. Not doing this could result in
    accepting a revoked and expired certificate, if it's still valid according to the
    trailing clock but not contained anymore in not yet valid CRLs.
  * The issuer of fetched CRLs is now compared to the issuer of the checked certificate (#2608).
  * CRL validation results other than revocation (e.g. a skipped check because the CRL couldn't
    be fetched) are now stored also for intermediate CA certificates and not only for end-entity
    certificates, so a strict CRL policy can be enforced in such cases.
  * In compliance with RFC 4945, section 5.1.3.2, certificates used for IKE must now either
    not contain a keyUsage extension (like the ones generated by pki), or have at least one of the
    digitalSignature or nonRepudiation bits set.
  * New options for vici/swanctl allow forcing the local termination of an IKE_SA. This might be
    useful in situations where it's known the other end is not reachable anymore, or that it
    already removed the IKE_SA, so retransmitting a DELETE and waiting for a response would
    be pointless.
  * Waiting only a certain amount of time for a response (i.e. shorter than all retransmits
    would be) before destroying the IKE_SA is also possible by additionally specifying a
    timeout in the forced termination request.
  * When removing routes, the kernel-netlink plugin now checks if it tracks other routes for
    the same destination and replaces the installed route instead of just removing it. Same
    during installation, where existing routes previously weren't replaced. This should allow
    using traps with virtual IPs on Linux (#2162).
  * The dhcp plugin now only sends the client identifier DHCP option if the identity_lease
    setting is enabled (7b660944b6). It can also send identities of up to 255 bytes length,
    instead of the previous 64 bytes (30e886fe3b, 0e5b94d038). If a server address is
    configured, DHCP requests are now sent from port 67 instead of 68 to avoid ICMP port
    unreachables (becf027cd9).
  * The handling of faulty INVALID_KE_PAYLOAD notifies (e.g. one containing a DH group
    that wasn't proposed) during CREATE_CHILD_SA exchanges has been improved (#2536).
  * Roam events are now completely ignored for IKEv1 SAs (there is no MOBIKE to handle such
    changes properly).
  * ChaCha20/Poly1305 is now correctly proposed without key length (#2614). For compatibility with
    older releases the chacha20poly1305compat keyword may be included in proposals to also propose
    the algorithm with a key length (c58434aeff).
  * Configuration of hardware offload of IPsec SAs is now more flexible and allows a new
    setting (auto), which automatically uses it if the kernel and device both support it. If hw
    offload is set to yes and offloading is not supported, the CHILD_SA installation now fails.
  * The kernel-pfkey plugin optionally installs routes via internal interface (one with an IP
    in the local traffic selector). On FreeBSD, enabling this selects the correct source IP
    when sending packets from the gateway itself (e811659323).
  * SHA-2 based PRFs are supported in PKCS#8 files as generated by OpenSSL 1.1 (#2574).
  * The pki --verify tool may load CA certificates and CRLs from directories.
  * The IKE daemon now also switches to port 4500 if the remote port is not 500 (e.g. because the
    remote maps the response to a different port, as might happen on Azure), as long as the local
    port is 500 (85bfab621d).
  * Fixed an issue with DNS servers passed to NetworkManager in charon-nm (ee8c25516a).
  * Logged traffic selectors now always contain the protocol if either protocol or port are set
    (a36d8097ed).
  * Only the inbound SA/policy will be updated as reaction to IP address changes for rekeyed
    CHILD_SAs that are kept around.
  * The parser for strongswan.conf/swanctl.conf now accepts = characters in values without
    having to put the value in quotes (e.g. for Base64 encoded shared secrets).
    Notes for developers:
  * trap_manager_t: Trap policies are now unistalled by peer/child name and not the reqid.
  * No reqid is returned anymore when installing trap policies.
  * child_sa_t: A new state (CHILD_DELETED) is used for CHILD_SAs that have been deleted but
    not yet destroyed (after a rekeying CHILD_SAs are kept around for a while to process
    delayed packets).
    This way child_updown events are not triggered anymore for such SAs when an IKE_SA that
    has such CHILD_SAs assigned is deleted.
  - Version 5.6.2
  ===============
  * Fixed a DoS vulnerability in the parser for PKCS#1 RSASSA-PSS signatures that was caused
    by insufficient input validation. One of the configurable parameters in algorithm identifier
    structures for RSASSA-PSS signatures is the mask generation function (MGF). Only MGF1 is
    currently specified for this purpose. However, this in turn takes itself a parameter that
    specifies the underlying hash function. strongSwan's parser did not correctly handle the
    case of this parameter being absent, causing an undefined data read.
    This vulnerability has been registered as CVE-2018-6459.
  * When rekeying IKEv2 IKE_SAs the previously negotiated DH group will be reused, instead of
    using the first configured group, which avoids an additional exchange if the peer previously
    selected a different DH group via INVALID_KE_PAYLOAD notify. The same is also done when
    rekeying CHILD_SAs except for the first rekeying of the CHILD_SA that was created with the
    IKE_SA, where no DH group was negotiated yet.
    Also, the selected DH group is moved to the front in all sent proposals that contain it
    and all proposals that don't are moved to the back in order to convey the preference for
    this group to the peer.
  * Handling of MOBIKE task queuing has been improved. In particular, the response to an
    address update (with NAT-D payloads) is not ignored anymore if only an address list update
    or DPD is queued as that could prevent updating the UDP encapsulation in the kernel.
  * On Linux, roam events may optionally be triggered by changes to the routing rules, which
    can be useful if routing rules (instead of e.g. route metrics) are used to switch from one
    to another interface (i.e. from one to another routing table). Since routing rules are
    currently not evaluated when doing route lookups this is only useful if the kernel-based
    route lookup is used (4664992f7d).
  * The fallback drop policies installed to avoid traffic leaks when replacing addresses in
    installed policies are now replaced by temporary drop policies, which also prevent
    acquires because we currently delete and reinstall IPsec SAs to update their addresses
    (35ef1b032d).
  * Access X.509 certificates held in non-volatile storage of a TPM 2.0 referenced via the
    NV index.
    Adding the --keyid parameter to pki --print allows to print private keys or certificates
    stored in a smartcard or a TPM 2.0.
  * Fixed proposal selection if a peer incorrectly sends DH groups in the ESP proposal during
    IKE_AUTH and also if a DH group is configured in the local ESP proposal and charon.prefer
    configured_proposals is disabled (d058fd3c32).
  * The lookup for PSK secrets for IKEv1 has been improved for certain scenarios (see #2497
    for details).
  * MSKs received via RADIUS are now padded to 64 bytes to avoid compatibility issues with
    EAP-MSCHAPv2 and PRFs that have a block size &lt; 64 bytes (e.g. AES-XCBC-PRF-128, see
    73cbce6013).
  * The tpm_extendpcr command line tool extends a digest into a TPM PCR.
  * Ported the NetworkManager backend from the deprecated libnm-glib to libnm.
  * The save-keys debugging/development plugin saves IKE and/or ESP keys to files compatible
    with Wireshark.
  - Version 5.6.1
  ===============
  * Several algorithms were removed from the default ESP/AH and IKE proposals in compliance with
    RFC 8221 and RFC 8247, respectively. Removed from the default ESP/AH proposal were the
    3DES and Blowfish encryption algorithms and the HMAC-MD5 integrity algorithm. From the IKE
    default proposal the HMAC-MD5 integrity algorithm and the MODP-1024 Diffie-Hellman group
    were removed (the latter is significant for Windows clients in their default configuration).
    These algorithms may still be used in custom proposals.
  * Support for RSASSA-PSS signatures has been added. For compatibility with previous
    releases they are currently not used automatically, by default, to change that charon.rsa_pss
    may be enabled. To explicitly use or require such signatures during IKEv2 signature
    authentication (RFC 7427) ike:rsa/pss... authentication constraints may be used for specific
    connections (regardless of whether the strongswan.conf option above is enabled). Only the
    hash algorithm can be specified in such constraints, the MGF1 will be based on that hash
    and the salt length will equal the hash length (when verifying the salt length is not
    enforced).
    To enforce such signatures during PKI verification use rsa/pss... authentication constraints.
  * All pki commands that create certificates/CRLs can be made to sign with RSASSA-PSS instead
    of the classing PKCS#1 scheme with the --rsa-padding pss option. As with signatures during
    authentication, only the hash algorithm is configurable (via --digest option), the MGF1 will
    be based on that and the salt length will equal the hash length.
  * These signatures are supported by all RSA backends except pkcs11 (i.e. gmp, gcrypt, openssl).
    The gmp plugin requires the mgf1 plugin.
    Note that RSASSA-PSS algorithm identifiers and parameters in keys (public keys in
    certificates or private keys in PKCS#8 files) are currently not used as constraints.
  * The sec-updater tool checks for security updates in dpkg-based repositories
    (e.g. Debian/Ubuntu) and sets the security flags in the IMV policy database accordingly.
    Additionally for each new package version a SWID tag for the given OS and HW architecture
    is created and stored in the database.
  * Using the sec-updater.sh script template the lookup can be automated (e.g. via an hourly
    cron job).
  * When restarting an IKEv2 negotiation after receiving an INVALID_KE_PAYLOAD notify (or due
    to other reasons like too many retransmits) a new initiator SPI is allocated. This
    prevents issues caused by retransmits for IKE_SA_INIT messages.
  * Because the initiator SPI was previously reused when restarting the connection delayed
    responses for previous connection attempts were processed and might have caused fatal
    errors due to a failed DH negotiation or because of the internal retry counter in the
    ike-init task. For instance, if we proposed a DH group the responder rejected we
    might have later received delayed responses that either contained INVALID_KE_PAYLOAD
    notifies with the DH group we already switched to, or, if we retransmitted an
    IKE_SA_INIT with the requested group but then had to restart again, a KE payload with
    a group different from the one we proposed.
  * The introduction of file versions in the IMV database scheme broke file reference hash
    measurements. This has been fixed by creating generic product versions having an empty
    package name.
  * A new timeout option for the systime-fix plugin stops periodic system time checks after
    a while and enforces a certificate verification, closing or reauthenticating all SAs
    with invalid certificates.
  * The IKE event counters, previously only available via ipsec listcounters command, may
    now also be queried and reset via vici and the new swanctl --counters command. They
    are collected and provided by the optional counters plugin (enabled by default for
    backwards compatibility if the stroke plugin is built).
  * Class attributes received in RADIUS Access-Accept messages may optionally be added to
    RADIUS accounting messages (655924074b).
  * Basic support for systemd sockets has been added, which may be used for privilege separation
    (59db98fb94).
  * Inbound marks may optionally be installed in the SA again (was removed with 5.5.2) by
    enabling the mark_in_sa option in swanctl.conf.
  * The timeout of leases in pools configured via pool utility may be configured in other
    units than hours.
    INITIAL_CONTACT notifies are now only omitted if never is configured as uniqueness policy.
  * Outbound FWD policies for shunts are not installed anymore, by default (as is the case
    for other policies since 5.5.1).
  * Don't consider a DH group mismatch during CHILD_SA rekeying as failure as responder
    (e7276f78aa).
  * Handling of fragmented IPv4 and IPv6 packets in libipsec has been improved (e138003de9).
  * Trigger expire events for the correct IPsec SA in libipsec (6e861947a0).
  * A crash in CRL verification via openssl plugin using OpenSSL 1.1 has been fixed (78acaba6a1).
  * No hard-coded default proposals are passed from starter to the stroke plugin anymore (the
    IKE proposal used curve25519 since 5.5.2, which is an optional plugin).
  * A workaround for an issue with virtual IPs on macOS 10.13 (High Sierra) has been added
    (039b85dd43).
  * Handling of IKE_SA rekey collisions in charon-tkm has been fixed.
  * Instead of failing or just silently doing nothing unit tests may now warn about certain
    conditions (e.g. if a test was not executed due to external dependencies).</changelog>
  <changelog author="mmnelemane@suse.com" date="1585224000">- Fix for to resolve multiple definition of swanctl_dir (bsc #1164493)
  [+ 0006-Resolve-multiple-definition-of-swanctl_dir.patch]</changelog>
  <changelog author="mbuil@suse.com" date="1610712000">- Fix typo in README (bsc #1167880)
  [+ 0007-Fix-typo-in-README.patch ]</changelog>
  <changelog author="mbuil@suse.com" date="1611576000">- Fix FIPS bug (bsc #1180801)
  [+ 0008-gcrypt-Use-a-dummy-buffer-to-initialize-static-alloc.patch ]</changelog>
  <changelog author="mbuil@suse.com" date="1617019200">- Keep using ipsec as the main binary. Therefore, make strongswan.service point to it instead of swanctl</changelog>
  <changelog author="mbuil@suse.com" date="1617019201">- Information added in README about the rcstrongswan-starter</changelog>
  <changelog author="mbuil@suse.com" date="1617624000">- Add config to run ipsec on namespaces (bsc #1183670)</changelog>
  <changelog author="mt@suse.com" date="1619006400">- Add support for AES CCM aead algorithms to openssl plugin (cc/fips,bsc#1185363)
  [+ 0009-strongswan-openssl-aead-add-ccm-support.patch]</changelog>
  <changelog author="mt@suse.com" date="1620388800">- Replace AEAD AES CCM patch with upstream variant (cc/fips,bsc#1185363)
  [* 0009-strongswan-openssl-aead-add-ccm-support.patch]</changelog>
  <changelog author="hare@suse.de" date="1627646400">- Add auth_els plugin to support Marvell FC-SP encryption (jsc#SLE-20151)
  [* strongswan-marvell-auth-els.patch]</changelog>
  <changelog author="abergmann@suse.com" date="1634040000">- Fix integer overflow in gmp plugin (bsc#1191367, CVE-2021-41990)
  [* strongswan-5.6.1-5.9.3_gmp-rsa-ssa-salt-len.patch]
- Fix integer overflow when replacing certificates in cache (bsc#1191435, CVE-2021-41991)
  [* strongswan-4.4.1-5.9.3_cert-cache-random.patch]</changelog>
  <changelog author="meissner@suse.com" date="1643025600">- strongswan-5.5.0-5.9.4_eap_success-CVE-2021-45079.patch:
  Fixed authentication bypass in EAP authentication (CVE-2021-45079
  bsc#1194471)</changelog>
</package>
<package pkgid="5f00bcdf46c2823b28a3a9154ed37ca4c7221344cf88a2e712ddd3a22437b9ca" name="strongswan-libs0" arch="ppc64le">
  <version epoch="0" ver="5.8.2" rel="11.24.1"/>
  <changelog author="ndas@suse.de" date="1501502400">- Updated to strongSwan 5.3.5(bsc#1050691) providing the following changes:
  * Fixed a DoS vulnerability in the gmp plugin that was caused by insufficient input
    validation when verifying RSA signatures. More specifically, mpz_powm_sec() has two
    requirements regarding the passed exponent and modulus that the plugin did not
    enforce, if these are not met the calculation will result in a floating point exception
    that crashes the whole process.
    This vulnerability has been registered as CVE-2017-9022.
    Please refer to our blog for details.
  * Fixed a DoS vulnerability in the x509 plugin that was caused because the ASN.1 parser
    didn't handle ASN.1 CHOICE types properly, which could result in an infinite loop when
    parsing X.509 extensions that use such types.
    This vulnerability has been registered as CVE-2017-9023.
    Please refer to our blog for details.
  * The behavior during IKEv2 CHILD_SA rekeying has been changed in order to avoid
    traffic loss. When responding to a CREATE_CHILD_SA request to rekey a CHILD_SA
    the responder already has everything available to install and use the new CHILD_SA.
    However, this could lead to lost traffic as the initiator won't be able to process
    inbound packets until it processed the CREATE_CHILD_SA response and updated the
    inbound SA. To avoid this the responder now only installs the new inbound SA and
    delays installing the outbound SA until it receives the DELETE for the replaced CHILD_SA.
  * The messages transporting these DELETEs could reach the peer before packets sent
    with the deleted outbound SAs reach it. To reduce the chance of traffic loss due
    to this the inbound SA of the replaced CHILD_SA is not removed for a configurable
    amount of seconds (charon.delete_rekeyed_delay) after the DELETE has been processed.
  * The code base has been ported to Apple's ARM64 iOS platform, which required several
    changes regarding the use of variadic functions. This was necessary because the calling
    conventions for variadic and regular functions are different there.
    This means that assigning a non-variadic function to a variadic function pointer, as we
    did with our enumerator_t::enumerate() implementations and several callbacks, will
    result in crashes as the called function accesses the arguments differently than the
    caller provided them. To avoid this issue the enumerator_t interface has been changed
    and the signature of the callback functions for enumerator_create_filter() and two
    methods on linked_list_t have been changed. Refer to the developer notes below
    for details.
  * Adds support for fuzzing the certificate parser provided by the default plugins
    (x509, pem, gmp etc.) on Google's OSS-Fuzz infrastructure (or generally with
    libFuzzer). Several issues found while fuzzing these plugins were fixed.
  * Two new options have been added to charon's retransmission settings:
    retransmit_limit and retransmit_jitter. The former adds an upper limit to the
    calculated retransmission timeout, the latter randomly reduces it.
    Refer to Retransmission for details.
  * A bug in swanctl's --load-creds command was fixed that caused unencrypted
    private keys to get unloaded if the command was called multiple times.
    The load-key VICI command now returns the key ID of the loaded key on success.
  * The credential manager now enumerates local credential sets before global ones.
    This means certificates supplied by the peer will now be preferred over certificates
    with the same identity that may be locally stored (e.g. in the certificate cache).
  * Adds support for hardware offload of IPsec SAs as introduced by Linux 4.11 for
    specific hardware that supports this.
  * The pki tool loads the curve25519 plugin by default.
    [- 0006-Make-sure-the-modulus-is-odd-and-the-exponent-not-zero.patch,
  - 0007-asn1-parser-Fix-CHOICE-parsing.patch]
- libhydra is removed as all kernel plugins moved to libcharon</changelog>
  <changelog author="ndas@suse.de" date="1504612800">- fix "uintptr_t? undeclared" compilation error.
  [+0006-fix-compilation-error-by-adding-stdint.h.patch]</changelog>
  <changelog author="ndas@suse.de" date="1504612801">- Updated to strongSwan 5.6.0 providing the following changes:
  * Fixed a DoS vulnerability in the gmp plugin that was caused by insufficient input validation
    when verifying RSA signatures, which requires decryption with the operation m^e mod n,
    where m is the signature, and e and n are the exponent and modulus of the public key.
    The value m is an integer between 0 and n-1, however, the gmp plugin did not verify this.
    So if m equals n the calculation results in 0, in which case mpz_export() returns NULL.
    This result wasn't handled properly causing a null-pointer dereference.
    This vulnerability has been registered as CVE-2017-11185. (bsc#1051222)
  * New SWIMA IMC/IMV pair implements the draft-ietf-sacm-nea-swima-patnc Internet
    Draft and has been demonstrated at the IETF 99 Prague Hackathon.
  * The IMV database template has been adapted to achieve full compliance with the
    ISO 19770-2:2015 SWID tag standard.
  * The pt-tls-client can attach and use TPM 2.0 protected private keys via the --keyid parameter.
  * By default the /etc/swanctl/conf.d directory is created and *.conf files in it are included in the default
    swanctl.conf file.
  * The curl plugin now follows HTTP redirects (configurable via strongswan.conf).
  * The CHILD_SA rekeying was fixed in charon-tkm and the behavior is refined a bit more since 5.5.3
  * libtpmtss supports Intel's TSS2 Architecture Broker and Resource Manager interface (tcti-tabrmd).
  * more on https://wiki.strongswan.org/versions/66</changelog>
  <changelog author="mmnelemane@suse.com" date="1521028800">- Removed unused requires and macro calls(bsc#1083261)</changelog>
  <changelog author="mmnelemane@suse.com" date="1573646400">- Added patch to fix vulnerability: CVE-2018-16151,CVE-2018-16152 (bsc#1107874)
  - Insufficient input validation in gmp plugin
  [+ 0007-strongswan-5.3.1-5.6.0_gmp-pkcs1-verify.patch]</changelog>
  <changelog author="mmnelemane@suse.com" date="1573646401">- Added patch to fix vulnerability: CVE-2018-5388 (bsc#1094462)
  - Buffer Underflow in stroke_socket.c
  [+ 0008-strongswan-5.1.2-5.6.2_stroke_msg_len.patch]</changelog>
  <changelog author="mmnelemane@suse.com" date="1573646402">- Added patch to fix vulnerability: CVE-2018-10811 (bsc#1093536)
  - denial-of-service vulnerability
  [+ 0009-strongswan-5.5.0-5.6.2_skeyseed_init.patch]</changelog>
  <changelog author="mmnelemane@suse.com" date="1573732800">- Added patch to fix vulnerability: CVE-2018-17540 (bsc#1109845)
  [+ 0010-strongswan-4.4.0-5.7.0_gmp-pkcs1-overflow.patch]</changelog>
  <changelog author="mmnelemane@suse.com" date="1580212800">- Updated to version 5.8.2 (jsc#SLE-11370)
  - Dropped following patches due to irrelevance in the updated version:
    [- strongswan_modprobe_syslog.patch ]
    [- strongswan_fipsfilter.patch ]
    [- 0006-fix-compilation-error-by-adding-stdint.h.patch ]
    [- 0007-strongswan-5.3.1-5.6.0_gmp-pkcs1-verify.patch ]
    [- 0008-strongswan-5.1.2-5.6.2_stroke_msg_len.patch ]
    [- 0009-strongswan-5.5.0-5.6.2_skeyseed_init.patch ]
    [- 0010-strongswan-4.4.0-5.7.0_gmp-pkcs1-overflow.patch ]
  - Version 5.8.2
  ===============
  * Identity-based CA constraints, which enforce that the certificate chain of the remote
    peer contains a CA certificate with a specific identity, are supported via
    vici/swanctl.conf. This is similar to the existing CA constraints but doesn't require
    that the CA certificate is locally installed, for instance, intermediate CA certificates
    received from the peers. Wildcard identity matching (e.g. ..., OU=Research, CN=*) could
    also be used for the latter but requires trust in the intermediate CAs to only issue
    certificates with legitimate subject DNs (e.g. the "Sales" CA must not issue certificates
    with OU=Research). With the new constraint that's not necessary as long as a path length
    basic constraint (--pathlen for pki --issue) prevents intermediate CAs from issuing further
    intermediate CAs.
  * Intermediate CA certificates may now be sent in hash-and-URL encoding by configuring a
    base URL for the parent CA (#3234, swanctl/rw-hash-and-url-multi-level).
  * Implemented NIST SP-800-90A Deterministic Random Bit Generator (DRBG) based on AES-CTR
    and SHA2-HMAC modes. Currently used by the gmp and ntru plugins.
  * Random nonces sent in an OCSP requests are now expected in the corresponding OCSP responses.
  * The kernel-netlink plugin now ignores deprecated IPv6 addresses for MOBIKE. Whether temporary
    or permanent IPv6 addresses are included now depends on the charon.prefer_temporary_addrs
    setting (#3192).
  * Extended Sequence Numbers (ESN) are configured via PF_KEY if supported by the kernel.
  * The PF_KEY socket's receive buffer in the kernel-pfkey plugin is now cleared before sending
    requests, as many of the messages sent by the kernel are sent as broadcasts to all PF_KEY
    sockets. This is an issue if an external tool is used to manage SAs/policies unrelated to
    IPsec (#3225).
  * The vici plugin now uses unique section names for CHILD_SAs in child-updown events (7c74ce9190).
  * For individually deleted CHILD_SAs (in particular for IKEv1) the vici child-updown event
    now includes more information about the CHILD_SAs such as traffic statistics (#3198).
  * Custom loggers are correctly re-registered if log levels are changed via stroke loglevel (#3182).
  * Avoid lockups during startup on low entropy systems when using OpenSSL 1.1.1 (095a2c2eac).
  * Instead of failing later when setting a key, creating HMACs via openssl plugin now fails
    instantly if the underlying hash algorithm isn't supported (e.g. MD5 in FIPS-mode) so fallbacks
    to other plugins work properly (#3284).
  * Exponents of RSA keys read from TPM 2.0 via SAPI are correctly converted (8ee1242f1438).
  * Routing table IDs &gt; 255 are supported for custom routes on Linux.
  * To avoid races, the check for hardware offloading support in the kernel-netlink plugin is
    performed during initialization of the plugin (a605452c03).
  * The D-Bus config file for charon-nm is now installed in $(datadir)/dbus-1/system.d instead of
    $(sysconfdir)/dbus-1/system.d, which is intended for sysadmin overrides.
    INVALID_MAJOR_VERSION notifies are now correctly sent in messages of the same exchange type
    and with the same message ID as the request.
  * IKEv2 SAs are now immediately destroyed when sending or receiving INVALID_SYNTAX notifies
    in authenticated messages.
  * For developers working from the repository the configure script now aborts if GNU gperf is
    not found.
  - Version 5.8.1
  ===============
  * RDNs in DNs of X.509 certificates can now optionally be matched less strict. The global
    strongswan.conf option charon.rdn_matching takes two alternative values that cause the
    matching algorithm to either ignore the order of matched RDNs (reordered) or additionally
    (relaxed) accept DNs that contain more RDNs than configured (unmatched RDNs are treated
    like wildcard matches).
  * The updown plugin now passes the same interface to the script that is also used for the
    automatically installed routes, that is, the interface over which the peer is reached
    instead of the interface on which the local address is found (#3095).
  * TPM 2.0 contexts are now protected by a mutex to prevent issues if multiple IKE_SAs use
    the same private key concurrently (4b25885025).
  * Do a rekey check after the third QM message was received (#3060).
  * If available, explicit_bzero() is now used as memwipe() instead of our own implementation.
  * An .editorconfig file has been added, mainly so Github shows files with proper indentation
    (68346b6962).
  * The internal certificate of the load-tester plugin has been modified so it can again be
    used as end-entity cert with 5.6.3 and later (#3139).
  * The maximum data length of received COOKIE notifies (64 bytes) is now enforced (#3160).
  - Version 5.8.0
  ===============
  * The systemd service units have been renamed. The modern unit, which was called
    strongswan-swanctl, is now called strongswan (the previous name is configured as alias in
    the unit, for which a symlink is created when the unit is enabled). The legacy unit is now
    called strongswan-starter.
  * Support for XFRM interfaces (available since Linux 4.19) has been added, which are intended
    to replace VTI devices (they are similar but offer several advantages, for instance, they
    are not bound to an address or address family).
  * IPsec SAs and policies are associated with such interfaces via interface IDs that can be
    configured in swanctl.conf (dynamic IDs may optionally be allocated for each SA and even
    direction). It's possible to use separate interfaces for in- and outbound traffic (or
    only use an interface in one direction and regular policies in the other).
  * Interfaces may be created dynamically via updown/vici scripts, or statically before or after
    establishing the SAs. Routes must be added manually as needed (the daemon will not install
    any routes for outbound policies with an interface ID).
  * When moving XFRM interfaces to other network namespaces they retain access to the SAs and
    policies installed in the original namespace, which allows providing IPsec tunnels for
    processes in other network namespaces without giving them access to the IPsec keys or
    IKE credentials.
    More information can be found on the page about route-based VPNs.
  * Initiation of childless IKE_SAs is supported (RFC 6023). If enabled and supported by the
    responder, no CHILD_SA is established during IKE_AUTH. Instead, all CHILD_SAs are created
    with CREATE_CHILD_SA exchanges. This allows using a separate DH exchange even for the
    first CHILD_SA, which is otherwise created during IKE_AUTH with keys derived from the
    IKE_SA's key material.
  * The swanctl --initiate command may be used to initiate only the IKE_SA via --ike
    option if --child is omitted and the peer supports this extension.
  * The NetworkManager backend and plugin support IPv6.
  * The new wolfssl plugin is a wrapper around the wolfSSL crypto library. Thanks to Sean
    Parkinson of wolfSSL Inc. for the initial patch.
  * IKE SPIs may optionally be labeled via the charon.spi_mask|label options in
    strongswan.conf. This feature was extracted from charon-tkm, however, now applies the
    mask/label in network order.
  * The openssl plugin supports ChaCha20-Poly1305 when built with OpenSSL 1.1.0.
  * The PB-TNC finite state machine according to section 3.2 of RFC 5793 was not correctly
    implemented when sending either a CRETRY or SRETRY batch. These batches can only be sent
    in the "Decided" state and a CRETRY batch can immediately carry all messages usually
    transported by a CDATA batch. It is currently not possible to send a SRETRY batch since
    full-duplex mode for PT-TLS transport is not supported.
  * Instead of marking IPv6 virtual IPs as deprecated, the kernel-netlink plugin now uses
    address labels to avoid that such addresses are used for non-VPN traffic (00a953d090).
  * The agent plugin now creates sockets to the ssh/gpg-agent dynamically and does not keep
    them open, which otherwise might prevent the agent from getting terminated.
  * To avoid broadcast loops the forecast plugin now only reinjects packets that are marked
    or received from the configured interface.
  * UTF-8 encoded passwords are supported via EAP-MSCHAPv2, which internally uses an UTF-16LE
    encoding to calculate the NT hash (#3014).
  * Properly delete temporary drop policies (used when updating IP addresses of SAs) if manual
    priorities are used, which was broken since 5.6.2 (8e31d65730).
  * Avoid overwriting start_action when parsing the inactivity timeout in the vici plugin (#2954).
  * Fixed the automatic termination of reloaded vici connections with start_action=start,
    which was broken since 5.6.3 (71b22c250f).
  * The lookup for shared secrets for IKEv1 SAs via sql plugin should now work better
    (6ec9f68f32).
  * Fixed a race condition in the trap manager between installation and removal of a policy
    (69cbe2ca3f).
  * Compilation of the kernel-netlink plugin has been fixed on old kernels (&lt; 2.6.39), which
    was caused by the HW offload changes (c7f579fa17).
  * The IPsec stack detection and module loading in starter has been removed (it wasn't
    enforced anyway and loading modules doesn't seem necessary, also KLIPS hasn't been
    supported for a long time and PF_KEY will eventually be removed from the Linux kernel,
    ba817d2917).
  * Several IKEv2 protocol details are now handled more strictly: Unrequested virtual IPs are
    ignored, CFG_REPLY payloads are ignored if no CFG_REQUEST payloads were sent, a USE
    TRANSPORT_MODE notify received from the responder is checked against the local configuration.
  * The keys and certificates used by the scenarios in the testing environment are now generated
    dynamically. Running the testing/scripts/build-certs script after creating the base and root
    images uses the pki utility installed in the latter to create the keys and certificates for
    all the CAs and in some cases for individual scenarios. These credentials are stored in the
    source tree, not the image, so this has to be called only once even if the images are later
    rebuilt. The script automatically (re-)rebuilds the guest images as that generates fresh
    CRLs and signs the DNS zones. The only keys/certificates currently not generated are the
    very large ones used by the ikev2/rw-eap-tls-fragments scenario.
  - Version 5.7.2
  ===============
  * For RSA with PSS padding, the TPM 2.0 specification mandates the maximum salt length
    (as defined by the length of the key and hash). However, if the TPM is FIPS-168-4 compliant,
    the salt length equals the hash length. This is assumed for FIPS-140-2 compliant TPMs, but
    if that's not the case, it might be necessary to manually enable charon.plugins.tpm.fips_186_4
    if the TPM doesn't use the maximum salt length.
  * Directories for credentials loaded by swanctl are now accessed relative to the loaded
    swanctl.conf file, in particular, when loading it from a custom location via --file argument.
  * The base directory, which is used if no custom location for swanctl.conf is specified, is now
    also configurable at runtime via SWANCTL_DIR environment variable.
  * If RADIUS Accounting is enabled, the eap-radius plugin will add the session ID (Acct-Session-Id)
    to Access-Request messages, which e.g. simplifies associating database entries for IP leases and
    accounting with sessions (the session ID does not change when IKE_SAs are rekeyed, #2853).
  * All IP addresses assigned by a RADIUS server are included in Accounting-Stop messages even if
    the client did not claim them, allowing to release them early in case of connection errors (#2856).
  * Selectors installed on transport mode SAs by the kernel-netlink plugin are now updated if an
    IP address changes (e.g. via MOBIKE) and it was part of the selectors.
  * No deletes are sent anymore when a rekeyed CHILD_SA expires (#2815).
  * The bypass-lan plugin now tracks interfaces to handle subnets that move from one interface
    to another and properly update associated routes (#2820).
  * Only valid and expected inbound IKEv2 messages are used to update the timestamp of the
    last received message (previously, retransmits also triggered an update).
  * IKEv2 requests from responders are now ignored until the IKE_SA is fully established (e.g. if a
    DPD request from the peer arrives before the IKE_AUTH response does, 46bea1add9).
    Delayed IKE_SA_INIT responses with COOKIE notifies we already recevied are ignored, they caused
    another reset of the IKE_SA previously (#2837).
  * Active and queued Quick Mode tasks are now adopted if the peer reauthenticates an IKEv1 SA
    while creating lots of CHILD_SAs.
  * Newer versions of the FreeBSD kernel add an SADB_X_EXT_SA2 extension to SADB_ACQUIRE
    messages, which allows the kernel-pfkey plugin to determine the reqid of the policy even if it
    wasn't installed by the daemon previously (e.g. when using FreeBSD's if_ipsec(4) VTIs, which
    install policies themselves, 872b9b3e8d).
  * Added support for RSA signatures with SHA-256 and SHA-512 to the agent plugin. For older
    versions of ssh/gpg-agent that only support SHA-1, IKEv2 signature authentication has to be
    disabled via charon.signature_authentication.
  * The sshkey and agent plugins support Ed25519/Ed448 SSH keys and signatures.
  * The openssl plugin supports X25519/X448 Diffie-Hellman and Ed25519/Ed448 keys and
    signatures when built against OpenSSL 1.1.1.
  * Support for Ed25519, ChaCha20/Poly1305, SHA-3 and AES-CCM were added to the botan plugin.
  * The mysql plugin now properly handles database connections with transactions
    under heavy load (#2779).
  * IP addresses in ha pools are now distributed evenly among all segments (#2828).
  * Private key implementations may optionally provide a list of supported signature schemes,
    which, as described above, is used by the tpm plugin because for each key on a TPM 2.0 the
    hash algorithm and for RSA also the padding scheme is predefined.
  * The testing environment is now based on Debian 9 (stretch) by default. This required
    some changes, in particular, updating to FreeRADIUS 3.x (which forced us to abandon the
    TNC@FHH patches and scenarios, 2fbe44bef3) and removing FIPS-enabled versions of
    OpenSSL (the FIPS module only supports OpenSSL 1.0.2).
  * Most test scenarios were migrated to swanctl.
  - Version 5.7.1
  ===============
  * Fixes a vulnerability in the gmp plugin triggered by crafted certificates with RSA keys with
    very small moduli. When verifying signatures with such keys, the code patched with the fix
    for CVE-2018-16151/2 caused an integer underflow and subsequent heap buffer overflow
    that results in a crash of the daemon.
  * The vulnerability has been registered as CVE-2018-17540.
  - Version 5.7.0
  ===============
  * Fixes a potential authorization bypass vulnerability in the gmp plugin that was caused by a
    too lenient verification of PKCS#1 v1.5 signatures. Several flaws could be exploited by a
    Bleichenbacher-style attack to forge signatures for low-exponent keys (i.e. with e=3).
  * CVE-2018-16151 has been assigned to the problem of accepting random bytes after the OID
    of the hash function in such signatures, and CVE-2018-16152 has been assigned to the issue
    of not verifying that the parameters in the ASN.1 algorithmIdentitifer structure is empty.
    Other flaws that don't lead to a vulnerability directly (e.g. not checking for at least
    8 bytes of padding) have no separate CVE assigned.
  * Dots are not allowed anymore in section names in swanctl.conf and strongswan.conf.
    This mainly affects the configuration of file loggers. If the path for such a log file
    contains dots it now has to be configured in the new path setting within the arbitrarily
    renamed subsection in the filelog section.
  * Sections in swanctl.conf and strongswan.conf may now reference other sections. All settings
    and subsections from such a section are inherited. This allows to simplify configs as
    redundant information has only to be specified once and may then be included in other
    sections (see strongswan.conf for an example).
  * The originally selected IKE config (based on the IPs and IKE version) can now change
    if no matching algorithm proposal is found. This way the order of the configs doesn't
    matter that much anymore and it's easily possible to specify separate configs for
    clients that require weaker algorithms (instead of having to also add them in other
    configs that might be selected).
  * Support for Postquantum Preshared Keys for IKEv2 (draft-ietf-ipsecme-qr-ikev2) has been added.
    For an example refer to the swanctl/rw-cert-ppk scenario (or with EAP, or PSK authentication).
  * The new botan plugin is a wrapper around the Botan C++ crypto library.
    It requires a fairly recent build from Botan's master branch (or the upcoming 2.8.0 release).
    Thanks to René Korthaus and his team from Rohde &amp; Schwarz Cybersecurity for the initial
    patch and to Jack Lloyd for quickly adding missing functions to Botan's FFI (C89) interface.
  * Implementation of RFC 8412 "Software Inventory Message and Attributes (SWIMA) for PA-TNC".
  * SWIMA subscription option sets CLOSE_WRITE trigger on apt history.log file resulting in
    a ClientRetry PB-TNC batch to initialize a new measurement cycle. The new imv/imc-swima
    plugins replace the previous imv/imc-swid plugins, which were removed.
  * Added support for fuzzing the PA-TNC (RFC 5792) and PB-TNC (RFC 5793) NEA protocols
    on Google's OSS-Fuzz infrastructure.
  * Support for version 2 of Intel's TPM2-TSS TGC Software Stack. The presence of the
    in-kernel /dev/tpmrm0 resource manager is automatically detected.
  * The pki tool accepts a xmppAddr otherName as a subjectAlternativeName using the
    syntax --san xmppaddr:&lt;jid&gt;.
  * swanctl.conf supports the configuration of marks the in- and/or outbound SA should apply
    to packets after processing on Linux. Configuring such a mark for outbound SAs requires
    at least a 4.14 kernel. The ability to set a mask and configuring a mark/mask for
    inbound SAs will be added with the upcoming 4.19 kernel.
  * New options in swanctl.conf allow configuring how/whether DF, ECN and DS fields in the
    IP headers are copied during IPsec processing. Controlling this is currently only possible
    on Linux.
  * The handling of sequence numbers in IKEv1 DPDs has been improved (#2714).
  * To avoid conflicts, the dhcp plugin now only uses the DHCP server port if explicitly
    configured.
  - Version 5.6.3
  ===============
  * Fixed a DoS vulnerability in the IKEv2 key derivation if the openssl plugin is used in FIPS
    mode and HMAC-MD5 is negotiated as PRF.
    This vulnerability has been registered as CVE-2018-10811.
  * Fixed a vulnerability in the stroke plugin, which did not check the received length before
    reading a message from the socket. Unless a group is configured, root privileges are
    required to access that socket, so in the default configuration this shouldn't be an issue.
    This vulnerability has been registered as CVE-2018-5388.
  * CRLs that are not yet valid are now ignored to avoid problems in scenarios where expired
    certificates are removed from new CRLs and the clock on the host doing the revocation
    check is trailing behind that of the host issuing CRLs. Not doing this could result in
    accepting a revoked and expired certificate, if it's still valid according to the
    trailing clock but not contained anymore in not yet valid CRLs.
  * The issuer of fetched CRLs is now compared to the issuer of the checked certificate (#2608).
  * CRL validation results other than revocation (e.g. a skipped check because the CRL couldn't
    be fetched) are now stored also for intermediate CA certificates and not only for end-entity
    certificates, so a strict CRL policy can be enforced in such cases.
  * In compliance with RFC 4945, section 5.1.3.2, certificates used for IKE must now either
    not contain a keyUsage extension (like the ones generated by pki), or have at least one of the
    digitalSignature or nonRepudiation bits set.
  * New options for vici/swanctl allow forcing the local termination of an IKE_SA. This might be
    useful in situations where it's known the other end is not reachable anymore, or that it
    already removed the IKE_SA, so retransmitting a DELETE and waiting for a response would
    be pointless.
  * Waiting only a certain amount of time for a response (i.e. shorter than all retransmits
    would be) before destroying the IKE_SA is also possible by additionally specifying a
    timeout in the forced termination request.
  * When removing routes, the kernel-netlink plugin now checks if it tracks other routes for
    the same destination and replaces the installed route instead of just removing it. Same
    during installation, where existing routes previously weren't replaced. This should allow
    using traps with virtual IPs on Linux (#2162).
  * The dhcp plugin now only sends the client identifier DHCP option if the identity_lease
    setting is enabled (7b660944b6). It can also send identities of up to 255 bytes length,
    instead of the previous 64 bytes (30e886fe3b, 0e5b94d038). If a server address is
    configured, DHCP requests are now sent from port 67 instead of 68 to avoid ICMP port
    unreachables (becf027cd9).
  * The handling of faulty INVALID_KE_PAYLOAD notifies (e.g. one containing a DH group
    that wasn't proposed) during CREATE_CHILD_SA exchanges has been improved (#2536).
  * Roam events are now completely ignored for IKEv1 SAs (there is no MOBIKE to handle such
    changes properly).
  * ChaCha20/Poly1305 is now correctly proposed without key length (#2614). For compatibility with
    older releases the chacha20poly1305compat keyword may be included in proposals to also propose
    the algorithm with a key length (c58434aeff).
  * Configuration of hardware offload of IPsec SAs is now more flexible and allows a new
    setting (auto), which automatically uses it if the kernel and device both support it. If hw
    offload is set to yes and offloading is not supported, the CHILD_SA installation now fails.
  * The kernel-pfkey plugin optionally installs routes via internal interface (one with an IP
    in the local traffic selector). On FreeBSD, enabling this selects the correct source IP
    when sending packets from the gateway itself (e811659323).
  * SHA-2 based PRFs are supported in PKCS#8 files as generated by OpenSSL 1.1 (#2574).
  * The pki --verify tool may load CA certificates and CRLs from directories.
  * The IKE daemon now also switches to port 4500 if the remote port is not 500 (e.g. because the
    remote maps the response to a different port, as might happen on Azure), as long as the local
    port is 500 (85bfab621d).
  * Fixed an issue with DNS servers passed to NetworkManager in charon-nm (ee8c25516a).
  * Logged traffic selectors now always contain the protocol if either protocol or port are set
    (a36d8097ed).
  * Only the inbound SA/policy will be updated as reaction to IP address changes for rekeyed
    CHILD_SAs that are kept around.
  * The parser for strongswan.conf/swanctl.conf now accepts = characters in values without
    having to put the value in quotes (e.g. for Base64 encoded shared secrets).
    Notes for developers:
  * trap_manager_t: Trap policies are now unistalled by peer/child name and not the reqid.
  * No reqid is returned anymore when installing trap policies.
  * child_sa_t: A new state (CHILD_DELETED) is used for CHILD_SAs that have been deleted but
    not yet destroyed (after a rekeying CHILD_SAs are kept around for a while to process
    delayed packets).
    This way child_updown events are not triggered anymore for such SAs when an IKE_SA that
    has such CHILD_SAs assigned is deleted.
  - Version 5.6.2
  ===============
  * Fixed a DoS vulnerability in the parser for PKCS#1 RSASSA-PSS signatures that was caused
    by insufficient input validation. One of the configurable parameters in algorithm identifier
    structures for RSASSA-PSS signatures is the mask generation function (MGF). Only MGF1 is
    currently specified for this purpose. However, this in turn takes itself a parameter that
    specifies the underlying hash function. strongSwan's parser did not correctly handle the
    case of this parameter being absent, causing an undefined data read.
    This vulnerability has been registered as CVE-2018-6459.
  * When rekeying IKEv2 IKE_SAs the previously negotiated DH group will be reused, instead of
    using the first configured group, which avoids an additional exchange if the peer previously
    selected a different DH group via INVALID_KE_PAYLOAD notify. The same is also done when
    rekeying CHILD_SAs except for the first rekeying of the CHILD_SA that was created with the
    IKE_SA, where no DH group was negotiated yet.
    Also, the selected DH group is moved to the front in all sent proposals that contain it
    and all proposals that don't are moved to the back in order to convey the preference for
    this group to the peer.
  * Handling of MOBIKE task queuing has been improved. In particular, the response to an
    address update (with NAT-D payloads) is not ignored anymore if only an address list update
    or DPD is queued as that could prevent updating the UDP encapsulation in the kernel.
  * On Linux, roam events may optionally be triggered by changes to the routing rules, which
    can be useful if routing rules (instead of e.g. route metrics) are used to switch from one
    to another interface (i.e. from one to another routing table). Since routing rules are
    currently not evaluated when doing route lookups this is only useful if the kernel-based
    route lookup is used (4664992f7d).
  * The fallback drop policies installed to avoid traffic leaks when replacing addresses in
    installed policies are now replaced by temporary drop policies, which also prevent
    acquires because we currently delete and reinstall IPsec SAs to update their addresses
    (35ef1b032d).
  * Access X.509 certificates held in non-volatile storage of a TPM 2.0 referenced via the
    NV index.
    Adding the --keyid parameter to pki --print allows to print private keys or certificates
    stored in a smartcard or a TPM 2.0.
  * Fixed proposal selection if a peer incorrectly sends DH groups in the ESP proposal during
    IKE_AUTH and also if a DH group is configured in the local ESP proposal and charon.prefer
    configured_proposals is disabled (d058fd3c32).
  * The lookup for PSK secrets for IKEv1 has been improved for certain scenarios (see #2497
    for details).
  * MSKs received via RADIUS are now padded to 64 bytes to avoid compatibility issues with
    EAP-MSCHAPv2 and PRFs that have a block size &lt; 64 bytes (e.g. AES-XCBC-PRF-128, see
    73cbce6013).
  * The tpm_extendpcr command line tool extends a digest into a TPM PCR.
  * Ported the NetworkManager backend from the deprecated libnm-glib to libnm.
  * The save-keys debugging/development plugin saves IKE and/or ESP keys to files compatible
    with Wireshark.
  - Version 5.6.1
  ===============
  * Several algorithms were removed from the default ESP/AH and IKE proposals in compliance with
    RFC 8221 and RFC 8247, respectively. Removed from the default ESP/AH proposal were the
    3DES and Blowfish encryption algorithms and the HMAC-MD5 integrity algorithm. From the IKE
    default proposal the HMAC-MD5 integrity algorithm and the MODP-1024 Diffie-Hellman group
    were removed (the latter is significant for Windows clients in their default configuration).
    These algorithms may still be used in custom proposals.
  * Support for RSASSA-PSS signatures has been added. For compatibility with previous
    releases they are currently not used automatically, by default, to change that charon.rsa_pss
    may be enabled. To explicitly use or require such signatures during IKEv2 signature
    authentication (RFC 7427) ike:rsa/pss... authentication constraints may be used for specific
    connections (regardless of whether the strongswan.conf option above is enabled). Only the
    hash algorithm can be specified in such constraints, the MGF1 will be based on that hash
    and the salt length will equal the hash length (when verifying the salt length is not
    enforced).
    To enforce such signatures during PKI verification use rsa/pss... authentication constraints.
  * All pki commands that create certificates/CRLs can be made to sign with RSASSA-PSS instead
    of the classing PKCS#1 scheme with the --rsa-padding pss option. As with signatures during
    authentication, only the hash algorithm is configurable (via --digest option), the MGF1 will
    be based on that and the salt length will equal the hash length.
  * These signatures are supported by all RSA backends except pkcs11 (i.e. gmp, gcrypt, openssl).
    The gmp plugin requires the mgf1 plugin.
    Note that RSASSA-PSS algorithm identifiers and parameters in keys (public keys in
    certificates or private keys in PKCS#8 files) are currently not used as constraints.
  * The sec-updater tool checks for security updates in dpkg-based repositories
    (e.g. Debian/Ubuntu) and sets the security flags in the IMV policy database accordingly.
    Additionally for each new package version a SWID tag for the given OS and HW architecture
    is created and stored in the database.
  * Using the sec-updater.sh script template the lookup can be automated (e.g. via an hourly
    cron job).
  * When restarting an IKEv2 negotiation after receiving an INVALID_KE_PAYLOAD notify (or due
    to other reasons like too many retransmits) a new initiator SPI is allocated. This
    prevents issues caused by retransmits for IKE_SA_INIT messages.
  * Because the initiator SPI was previously reused when restarting the connection delayed
    responses for previous connection attempts were processed and might have caused fatal
    errors due to a failed DH negotiation or because of the internal retry counter in the
    ike-init task. For instance, if we proposed a DH group the responder rejected we
    might have later received delayed responses that either contained INVALID_KE_PAYLOAD
    notifies with the DH group we already switched to, or, if we retransmitted an
    IKE_SA_INIT with the requested group but then had to restart again, a KE payload with
    a group different from the one we proposed.
  * The introduction of file versions in the IMV database scheme broke file reference hash
    measurements. This has been fixed by creating generic product versions having an empty
    package name.
  * A new timeout option for the systime-fix plugin stops periodic system time checks after
    a while and enforces a certificate verification, closing or reauthenticating all SAs
    with invalid certificates.
  * The IKE event counters, previously only available via ipsec listcounters command, may
    now also be queried and reset via vici and the new swanctl --counters command. They
    are collected and provided by the optional counters plugin (enabled by default for
    backwards compatibility if the stroke plugin is built).
  * Class attributes received in RADIUS Access-Accept messages may optionally be added to
    RADIUS accounting messages (655924074b).
  * Basic support for systemd sockets has been added, which may be used for privilege separation
    (59db98fb94).
  * Inbound marks may optionally be installed in the SA again (was removed with 5.5.2) by
    enabling the mark_in_sa option in swanctl.conf.
  * The timeout of leases in pools configured via pool utility may be configured in other
    units than hours.
    INITIAL_CONTACT notifies are now only omitted if never is configured as uniqueness policy.
  * Outbound FWD policies for shunts are not installed anymore, by default (as is the case
    for other policies since 5.5.1).
  * Don't consider a DH group mismatch during CHILD_SA rekeying as failure as responder
    (e7276f78aa).
  * Handling of fragmented IPv4 and IPv6 packets in libipsec has been improved (e138003de9).
  * Trigger expire events for the correct IPsec SA in libipsec (6e861947a0).
  * A crash in CRL verification via openssl plugin using OpenSSL 1.1 has been fixed (78acaba6a1).
  * No hard-coded default proposals are passed from starter to the stroke plugin anymore (the
    IKE proposal used curve25519 since 5.5.2, which is an optional plugin).
  * A workaround for an issue with virtual IPs on macOS 10.13 (High Sierra) has been added
    (039b85dd43).
  * Handling of IKE_SA rekey collisions in charon-tkm has been fixed.
  * Instead of failing or just silently doing nothing unit tests may now warn about certain
    conditions (e.g. if a test was not executed due to external dependencies).</changelog>
  <changelog author="mmnelemane@suse.com" date="1585224000">- Fix for to resolve multiple definition of swanctl_dir (bsc #1164493)
  [+ 0006-Resolve-multiple-definition-of-swanctl_dir.patch]</changelog>
  <changelog author="mbuil@suse.com" date="1610712000">- Fix typo in README (bsc #1167880)
  [+ 0007-Fix-typo-in-README.patch ]</changelog>
  <changelog author="mbuil@suse.com" date="1611576000">- Fix FIPS bug (bsc #1180801)
  [+ 0008-gcrypt-Use-a-dummy-buffer-to-initialize-static-alloc.patch ]</changelog>
  <changelog author="mbuil@suse.com" date="1617019200">- Keep using ipsec as the main binary. Therefore, make strongswan.service point to it instead of swanctl</changelog>
  <changelog author="mbuil@suse.com" date="1617019201">- Information added in README about the rcstrongswan-starter</changelog>
  <changelog author="mbuil@suse.com" date="1617624000">- Add config to run ipsec on namespaces (bsc #1183670)</changelog>
  <changelog author="mt@suse.com" date="1619006400">- Add support for AES CCM aead algorithms to openssl plugin (cc/fips,bsc#1185363)
  [+ 0009-strongswan-openssl-aead-add-ccm-support.patch]</changelog>
  <changelog author="mt@suse.com" date="1620388800">- Replace AEAD AES CCM patch with upstream variant (cc/fips,bsc#1185363)
  [* 0009-strongswan-openssl-aead-add-ccm-support.patch]</changelog>
  <changelog author="hare@suse.de" date="1627646400">- Add auth_els plugin to support Marvell FC-SP encryption (jsc#SLE-20151)
  [* strongswan-marvell-auth-els.patch]</changelog>
  <changelog author="abergmann@suse.com" date="1634040000">- Fix integer overflow in gmp plugin (bsc#1191367, CVE-2021-41990)
  [* strongswan-5.6.1-5.9.3_gmp-rsa-ssa-salt-len.patch]
- Fix integer overflow when replacing certificates in cache (bsc#1191435, CVE-2021-41991)
  [* strongswan-4.4.1-5.9.3_cert-cache-random.patch]</changelog>
  <changelog author="meissner@suse.com" date="1643025600">- strongswan-5.5.0-5.9.4_eap_success-CVE-2021-45079.patch:
  Fixed authentication bypass in EAP authentication (CVE-2021-45079
  bsc#1194471)</changelog>
</package>
<package pkgid="40c09ed3b252dce9bc2cd82f8e1983948d9950779693eb9b41b6ab4f5c6f3b88" name="strongswan-libs0" arch="s390x">
  <version epoch="0" ver="5.8.2" rel="11.24.1"/>
  <changelog author="ndas@suse.de" date="1501502400">- Updated to strongSwan 5.3.5(bsc#1050691) providing the following changes:
  * Fixed a DoS vulnerability in the gmp plugin that was caused by insufficient input
    validation when verifying RSA signatures. More specifically, mpz_powm_sec() has two
    requirements regarding the passed exponent and modulus that the plugin did not
    enforce, if these are not met the calculation will result in a floating point exception
    that crashes the whole process.
    This vulnerability has been registered as CVE-2017-9022.
    Please refer to our blog for details.
  * Fixed a DoS vulnerability in the x509 plugin that was caused because the ASN.1 parser
    didn't handle ASN.1 CHOICE types properly, which could result in an infinite loop when
    parsing X.509 extensions that use such types.
    This vulnerability has been registered as CVE-2017-9023.
    Please refer to our blog for details.
  * The behavior during IKEv2 CHILD_SA rekeying has been changed in order to avoid
    traffic loss. When responding to a CREATE_CHILD_SA request to rekey a CHILD_SA
    the responder already has everything available to install and use the new CHILD_SA.
    However, this could lead to lost traffic as the initiator won't be able to process
    inbound packets until it processed the CREATE_CHILD_SA response and updated the
    inbound SA. To avoid this the responder now only installs the new inbound SA and
    delays installing the outbound SA until it receives the DELETE for the replaced CHILD_SA.
  * The messages transporting these DELETEs could reach the peer before packets sent
    with the deleted outbound SAs reach it. To reduce the chance of traffic loss due
    to this the inbound SA of the replaced CHILD_SA is not removed for a configurable
    amount of seconds (charon.delete_rekeyed_delay) after the DELETE has been processed.
  * The code base has been ported to Apple's ARM64 iOS platform, which required several
    changes regarding the use of variadic functions. This was necessary because the calling
    conventions for variadic and regular functions are different there.
    This means that assigning a non-variadic function to a variadic function pointer, as we
    did with our enumerator_t::enumerate() implementations and several callbacks, will
    result in crashes as the called function accesses the arguments differently than the
    caller provided them. To avoid this issue the enumerator_t interface has been changed
    and the signature of the callback functions for enumerator_create_filter() and two
    methods on linked_list_t have been changed. Refer to the developer notes below
    for details.
  * Adds support for fuzzing the certificate parser provided by the default plugins
    (x509, pem, gmp etc.) on Google's OSS-Fuzz infrastructure (or generally with
    libFuzzer). Several issues found while fuzzing these plugins were fixed.
  * Two new options have been added to charon's retransmission settings:
    retransmit_limit and retransmit_jitter. The former adds an upper limit to the
    calculated retransmission timeout, the latter randomly reduces it.
    Refer to Retransmission for details.
  * A bug in swanctl's --load-creds command was fixed that caused unencrypted
    private keys to get unloaded if the command was called multiple times.
    The load-key VICI command now returns the key ID of the loaded key on success.
  * The credential manager now enumerates local credential sets before global ones.
    This means certificates supplied by the peer will now be preferred over certificates
    with the same identity that may be locally stored (e.g. in the certificate cache).
  * Adds support for hardware offload of IPsec SAs as introduced by Linux 4.11 for
    specific hardware that supports this.
  * The pki tool loads the curve25519 plugin by default.
    [- 0006-Make-sure-the-modulus-is-odd-and-the-exponent-not-zero.patch,
  - 0007-asn1-parser-Fix-CHOICE-parsing.patch]
- libhydra is removed as all kernel plugins moved to libcharon</changelog>
  <changelog author="ndas@suse.de" date="1504612800">- fix "uintptr_t? undeclared" compilation error.
  [+0006-fix-compilation-error-by-adding-stdint.h.patch]</changelog>
  <changelog author="ndas@suse.de" date="1504612801">- Updated to strongSwan 5.6.0 providing the following changes:
  * Fixed a DoS vulnerability in the gmp plugin that was caused by insufficient input validation
    when verifying RSA signatures, which requires decryption with the operation m^e mod n,
    where m is the signature, and e and n are the exponent and modulus of the public key.
    The value m is an integer between 0 and n-1, however, the gmp plugin did not verify this.
    So if m equals n the calculation results in 0, in which case mpz_export() returns NULL.
    This result wasn't handled properly causing a null-pointer dereference.
    This vulnerability has been registered as CVE-2017-11185. (bsc#1051222)
  * New SWIMA IMC/IMV pair implements the draft-ietf-sacm-nea-swima-patnc Internet
    Draft and has been demonstrated at the IETF 99 Prague Hackathon.
  * The IMV database template has been adapted to achieve full compliance with the
    ISO 19770-2:2015 SWID tag standard.
  * The pt-tls-client can attach and use TPM 2.0 protected private keys via the --keyid parameter.
  * By default the /etc/swanctl/conf.d directory is created and *.conf files in it are included in the default
    swanctl.conf file.
  * The curl plugin now follows HTTP redirects (configurable via strongswan.conf).
  * The CHILD_SA rekeying was fixed in charon-tkm and the behavior is refined a bit more since 5.5.3
  * libtpmtss supports Intel's TSS2 Architecture Broker and Resource Manager interface (tcti-tabrmd).
  * more on https://wiki.strongswan.org/versions/66</changelog>
  <changelog author="mmnelemane@suse.com" date="1521028800">- Removed unused requires and macro calls(bsc#1083261)</changelog>
  <changelog author="mmnelemane@suse.com" date="1573646400">- Added patch to fix vulnerability: CVE-2018-16151,CVE-2018-16152 (bsc#1107874)
  - Insufficient input validation in gmp plugin
  [+ 0007-strongswan-5.3.1-5.6.0_gmp-pkcs1-verify.patch]</changelog>
  <changelog author="mmnelemane@suse.com" date="1573646401">- Added patch to fix vulnerability: CVE-2018-5388 (bsc#1094462)
  - Buffer Underflow in stroke_socket.c
  [+ 0008-strongswan-5.1.2-5.6.2_stroke_msg_len.patch]</changelog>
  <changelog author="mmnelemane@suse.com" date="1573646402">- Added patch to fix vulnerability: CVE-2018-10811 (bsc#1093536)
  - denial-of-service vulnerability
  [+ 0009-strongswan-5.5.0-5.6.2_skeyseed_init.patch]</changelog>
  <changelog author="mmnelemane@suse.com" date="1573732800">- Added patch to fix vulnerability: CVE-2018-17540 (bsc#1109845)
  [+ 0010-strongswan-4.4.0-5.7.0_gmp-pkcs1-overflow.patch]</changelog>
  <changelog author="mmnelemane@suse.com" date="1580212800">- Updated to version 5.8.2 (jsc#SLE-11370)
  - Dropped following patches due to irrelevance in the updated version:
    [- strongswan_modprobe_syslog.patch ]
    [- strongswan_fipsfilter.patch ]
    [- 0006-fix-compilation-error-by-adding-stdint.h.patch ]
    [- 0007-strongswan-5.3.1-5.6.0_gmp-pkcs1-verify.patch ]
    [- 0008-strongswan-5.1.2-5.6.2_stroke_msg_len.patch ]
    [- 0009-strongswan-5.5.0-5.6.2_skeyseed_init.patch ]
    [- 0010-strongswan-4.4.0-5.7.0_gmp-pkcs1-overflow.patch ]
  - Version 5.8.2
  ===============
  * Identity-based CA constraints, which enforce that the certificate chain of the remote
    peer contains a CA certificate with a specific identity, are supported via
    vici/swanctl.conf. This is similar to the existing CA constraints but doesn't require
    that the CA certificate is locally installed, for instance, intermediate CA certificates
    received from the peers. Wildcard identity matching (e.g. ..., OU=Research, CN=*) could
    also be used for the latter but requires trust in the intermediate CAs to only issue
    certificates with legitimate subject DNs (e.g. the "Sales" CA must not issue certificates
    with OU=Research). With the new constraint that's not necessary as long as a path length
    basic constraint (--pathlen for pki --issue) prevents intermediate CAs from issuing further
    intermediate CAs.
  * Intermediate CA certificates may now be sent in hash-and-URL encoding by configuring a
    base URL for the parent CA (#3234, swanctl/rw-hash-and-url-multi-level).
  * Implemented NIST SP-800-90A Deterministic Random Bit Generator (DRBG) based on AES-CTR
    and SHA2-HMAC modes. Currently used by the gmp and ntru plugins.
  * Random nonces sent in an OCSP requests are now expected in the corresponding OCSP responses.
  * The kernel-netlink plugin now ignores deprecated IPv6 addresses for MOBIKE. Whether temporary
    or permanent IPv6 addresses are included now depends on the charon.prefer_temporary_addrs
    setting (#3192).
  * Extended Sequence Numbers (ESN) are configured via PF_KEY if supported by the kernel.
  * The PF_KEY socket's receive buffer in the kernel-pfkey plugin is now cleared before sending
    requests, as many of the messages sent by the kernel are sent as broadcasts to all PF_KEY
    sockets. This is an issue if an external tool is used to manage SAs/policies unrelated to
    IPsec (#3225).
  * The vici plugin now uses unique section names for CHILD_SAs in child-updown events (7c74ce9190).
  * For individually deleted CHILD_SAs (in particular for IKEv1) the vici child-updown event
    now includes more information about the CHILD_SAs such as traffic statistics (#3198).
  * Custom loggers are correctly re-registered if log levels are changed via stroke loglevel (#3182).
  * Avoid lockups during startup on low entropy systems when using OpenSSL 1.1.1 (095a2c2eac).
  * Instead of failing later when setting a key, creating HMACs via openssl plugin now fails
    instantly if the underlying hash algorithm isn't supported (e.g. MD5 in FIPS-mode) so fallbacks
    to other plugins work properly (#3284).
  * Exponents of RSA keys read from TPM 2.0 via SAPI are correctly converted (8ee1242f1438).
  * Routing table IDs &gt; 255 are supported for custom routes on Linux.
  * To avoid races, the check for hardware offloading support in the kernel-netlink plugin is
    performed during initialization of the plugin (a605452c03).
  * The D-Bus config file for charon-nm is now installed in $(datadir)/dbus-1/system.d instead of
    $(sysconfdir)/dbus-1/system.d, which is intended for sysadmin overrides.
    INVALID_MAJOR_VERSION notifies are now correctly sent in messages of the same exchange type
    and with the same message ID as the request.
  * IKEv2 SAs are now immediately destroyed when sending or receiving INVALID_SYNTAX notifies
    in authenticated messages.
  * For developers working from the repository the configure script now aborts if GNU gperf is
    not found.
  - Version 5.8.1
  ===============
  * RDNs in DNs of X.509 certificates can now optionally be matched less strict. The global
    strongswan.conf option charon.rdn_matching takes two alternative values that cause the
    matching algorithm to either ignore the order of matched RDNs (reordered) or additionally
    (relaxed) accept DNs that contain more RDNs than configured (unmatched RDNs are treated
    like wildcard matches).
  * The updown plugin now passes the same interface to the script that is also used for the
    automatically installed routes, that is, the interface over which the peer is reached
    instead of the interface on which the local address is found (#3095).
  * TPM 2.0 contexts are now protected by a mutex to prevent issues if multiple IKE_SAs use
    the same private key concurrently (4b25885025).
  * Do a rekey check after the third QM message was received (#3060).
  * If available, explicit_bzero() is now used as memwipe() instead of our own implementation.
  * An .editorconfig file has been added, mainly so Github shows files with proper indentation
    (68346b6962).
  * The internal certificate of the load-tester plugin has been modified so it can again be
    used as end-entity cert with 5.6.3 and later (#3139).
  * The maximum data length of received COOKIE notifies (64 bytes) is now enforced (#3160).
  - Version 5.8.0
  ===============
  * The systemd service units have been renamed. The modern unit, which was called
    strongswan-swanctl, is now called strongswan (the previous name is configured as alias in
    the unit, for which a symlink is created when the unit is enabled). The legacy unit is now
    called strongswan-starter.
  * Support for XFRM interfaces (available since Linux 4.19) has been added, which are intended
    to replace VTI devices (they are similar but offer several advantages, for instance, they
    are not bound to an address or address family).
  * IPsec SAs and policies are associated with such interfaces via interface IDs that can be
    configured in swanctl.conf (dynamic IDs may optionally be allocated for each SA and even
    direction). It's possible to use separate interfaces for in- and outbound traffic (or
    only use an interface in one direction and regular policies in the other).
  * Interfaces may be created dynamically via updown/vici scripts, or statically before or after
    establishing the SAs. Routes must be added manually as needed (the daemon will not install
    any routes for outbound policies with an interface ID).
  * When moving XFRM interfaces to other network namespaces they retain access to the SAs and
    policies installed in the original namespace, which allows providing IPsec tunnels for
    processes in other network namespaces without giving them access to the IPsec keys or
    IKE credentials.
    More information can be found on the page about route-based VPNs.
  * Initiation of childless IKE_SAs is supported (RFC 6023). If enabled and supported by the
    responder, no CHILD_SA is established during IKE_AUTH. Instead, all CHILD_SAs are created
    with CREATE_CHILD_SA exchanges. This allows using a separate DH exchange even for the
    first CHILD_SA, which is otherwise created during IKE_AUTH with keys derived from the
    IKE_SA's key material.
  * The swanctl --initiate command may be used to initiate only the IKE_SA via --ike
    option if --child is omitted and the peer supports this extension.
  * The NetworkManager backend and plugin support IPv6.
  * The new wolfssl plugin is a wrapper around the wolfSSL crypto library. Thanks to Sean
    Parkinson of wolfSSL Inc. for the initial patch.
  * IKE SPIs may optionally be labeled via the charon.spi_mask|label options in
    strongswan.conf. This feature was extracted from charon-tkm, however, now applies the
    mask/label in network order.
  * The openssl plugin supports ChaCha20-Poly1305 when built with OpenSSL 1.1.0.
  * The PB-TNC finite state machine according to section 3.2 of RFC 5793 was not correctly
    implemented when sending either a CRETRY or SRETRY batch. These batches can only be sent
    in the "Decided" state and a CRETRY batch can immediately carry all messages usually
    transported by a CDATA batch. It is currently not possible to send a SRETRY batch since
    full-duplex mode for PT-TLS transport is not supported.
  * Instead of marking IPv6 virtual IPs as deprecated, the kernel-netlink plugin now uses
    address labels to avoid that such addresses are used for non-VPN traffic (00a953d090).
  * The agent plugin now creates sockets to the ssh/gpg-agent dynamically and does not keep
    them open, which otherwise might prevent the agent from getting terminated.
  * To avoid broadcast loops the forecast plugin now only reinjects packets that are marked
    or received from the configured interface.
  * UTF-8 encoded passwords are supported via EAP-MSCHAPv2, which internally uses an UTF-16LE
    encoding to calculate the NT hash (#3014).
  * Properly delete temporary drop policies (used when updating IP addresses of SAs) if manual
    priorities are used, which was broken since 5.6.2 (8e31d65730).
  * Avoid overwriting start_action when parsing the inactivity timeout in the vici plugin (#2954).
  * Fixed the automatic termination of reloaded vici connections with start_action=start,
    which was broken since 5.6.3 (71b22c250f).
  * The lookup for shared secrets for IKEv1 SAs via sql plugin should now work better
    (6ec9f68f32).
  * Fixed a race condition in the trap manager between installation and removal of a policy
    (69cbe2ca3f).
  * Compilation of the kernel-netlink plugin has been fixed on old kernels (&lt; 2.6.39), which
    was caused by the HW offload changes (c7f579fa17).
  * The IPsec stack detection and module loading in starter has been removed (it wasn't
    enforced anyway and loading modules doesn't seem necessary, also KLIPS hasn't been
    supported for a long time and PF_KEY will eventually be removed from the Linux kernel,
    ba817d2917).
  * Several IKEv2 protocol details are now handled more strictly: Unrequested virtual IPs are
    ignored, CFG_REPLY payloads are ignored if no CFG_REQUEST payloads were sent, a USE
    TRANSPORT_MODE notify received from the responder is checked against the local configuration.
  * The keys and certificates used by the scenarios in the testing environment are now generated
    dynamically. Running the testing/scripts/build-certs script after creating the base and root
    images uses the pki utility installed in the latter to create the keys and certificates for
    all the CAs and in some cases for individual scenarios. These credentials are stored in the
    source tree, not the image, so this has to be called only once even if the images are later
    rebuilt. The script automatically (re-)rebuilds the guest images as that generates fresh
    CRLs and signs the DNS zones. The only keys/certificates currently not generated are the
    very large ones used by the ikev2/rw-eap-tls-fragments scenario.
  - Version 5.7.2
  ===============
  * For RSA with PSS padding, the TPM 2.0 specification mandates the maximum salt length
    (as defined by the length of the key and hash). However, if the TPM is FIPS-168-4 compliant,
    the salt length equals the hash length. This is assumed for FIPS-140-2 compliant TPMs, but
    if that's not the case, it might be necessary to manually enable charon.plugins.tpm.fips_186_4
    if the TPM doesn't use the maximum salt length.
  * Directories for credentials loaded by swanctl are now accessed relative to the loaded
    swanctl.conf file, in particular, when loading it from a custom location via --file argument.
  * The base directory, which is used if no custom location for swanctl.conf is specified, is now
    also configurable at runtime via SWANCTL_DIR environment variable.
  * If RADIUS Accounting is enabled, the eap-radius plugin will add the session ID (Acct-Session-Id)
    to Access-Request messages, which e.g. simplifies associating database entries for IP leases and
    accounting with sessions (the session ID does not change when IKE_SAs are rekeyed, #2853).
  * All IP addresses assigned by a RADIUS server are included in Accounting-Stop messages even if
    the client did not claim them, allowing to release them early in case of connection errors (#2856).
  * Selectors installed on transport mode SAs by the kernel-netlink plugin are now updated if an
    IP address changes (e.g. via MOBIKE) and it was part of the selectors.
  * No deletes are sent anymore when a rekeyed CHILD_SA expires (#2815).
  * The bypass-lan plugin now tracks interfaces to handle subnets that move from one interface
    to another and properly update associated routes (#2820).
  * Only valid and expected inbound IKEv2 messages are used to update the timestamp of the
    last received message (previously, retransmits also triggered an update).
  * IKEv2 requests from responders are now ignored until the IKE_SA is fully established (e.g. if a
    DPD request from the peer arrives before the IKE_AUTH response does, 46bea1add9).
    Delayed IKE_SA_INIT responses with COOKIE notifies we already recevied are ignored, they caused
    another reset of the IKE_SA previously (#2837).
  * Active and queued Quick Mode tasks are now adopted if the peer reauthenticates an IKEv1 SA
    while creating lots of CHILD_SAs.
  * Newer versions of the FreeBSD kernel add an SADB_X_EXT_SA2 extension to SADB_ACQUIRE
    messages, which allows the kernel-pfkey plugin to determine the reqid of the policy even if it
    wasn't installed by the daemon previously (e.g. when using FreeBSD's if_ipsec(4) VTIs, which
    install policies themselves, 872b9b3e8d).
  * Added support for RSA signatures with SHA-256 and SHA-512 to the agent plugin. For older
    versions of ssh/gpg-agent that only support SHA-1, IKEv2 signature authentication has to be
    disabled via charon.signature_authentication.
  * The sshkey and agent plugins support Ed25519/Ed448 SSH keys and signatures.
  * The openssl plugin supports X25519/X448 Diffie-Hellman and Ed25519/Ed448 keys and
    signatures when built against OpenSSL 1.1.1.
  * Support for Ed25519, ChaCha20/Poly1305, SHA-3 and AES-CCM were added to the botan plugin.
  * The mysql plugin now properly handles database connections with transactions
    under heavy load (#2779).
  * IP addresses in ha pools are now distributed evenly among all segments (#2828).
  * Private key implementations may optionally provide a list of supported signature schemes,
    which, as described above, is used by the tpm plugin because for each key on a TPM 2.0 the
    hash algorithm and for RSA also the padding scheme is predefined.
  * The testing environment is now based on Debian 9 (stretch) by default. This required
    some changes, in particular, updating to FreeRADIUS 3.x (which forced us to abandon the
    TNC@FHH patches and scenarios, 2fbe44bef3) and removing FIPS-enabled versions of
    OpenSSL (the FIPS module only supports OpenSSL 1.0.2).
  * Most test scenarios were migrated to swanctl.
  - Version 5.7.1
  ===============
  * Fixes a vulnerability in the gmp plugin triggered by crafted certificates with RSA keys with
    very small moduli. When verifying signatures with such keys, the code patched with the fix
    for CVE-2018-16151/2 caused an integer underflow and subsequent heap buffer overflow
    that results in a crash of the daemon.
  * The vulnerability has been registered as CVE-2018-17540.
  - Version 5.7.0
  ===============
  * Fixes a potential authorization bypass vulnerability in the gmp plugin that was caused by a
    too lenient verification of PKCS#1 v1.5 signatures. Several flaws could be exploited by a
    Bleichenbacher-style attack to forge signatures for low-exponent keys (i.e. with e=3).
  * CVE-2018-16151 has been assigned to the problem of accepting random bytes after the OID
    of the hash function in such signatures, and CVE-2018-16152 has been assigned to the issue
    of not verifying that the parameters in the ASN.1 algorithmIdentitifer structure is empty.
    Other flaws that don't lead to a vulnerability directly (e.g. not checking for at least
    8 bytes of padding) have no separate CVE assigned.
  * Dots are not allowed anymore in section names in swanctl.conf and strongswan.conf.
    This mainly affects the configuration of file loggers. If the path for such a log file
    contains dots it now has to be configured in the new path setting within the arbitrarily
    renamed subsection in the filelog section.
  * Sections in swanctl.conf and strongswan.conf may now reference other sections. All settings
    and subsections from such a section are inherited. This allows to simplify configs as
    redundant information has only to be specified once and may then be included in other
    sections (see strongswan.conf for an example).
  * The originally selected IKE config (based on the IPs and IKE version) can now change
    if no matching algorithm proposal is found. This way the order of the configs doesn't
    matter that much anymore and it's easily possible to specify separate configs for
    clients that require weaker algorithms (instead of having to also add them in other
    configs that might be selected).
  * Support for Postquantum Preshared Keys for IKEv2 (draft-ietf-ipsecme-qr-ikev2) has been added.
    For an example refer to the swanctl/rw-cert-ppk scenario (or with EAP, or PSK authentication).
  * The new botan plugin is a wrapper around the Botan C++ crypto library.
    It requires a fairly recent build from Botan's master branch (or the upcoming 2.8.0 release).
    Thanks to René Korthaus and his team from Rohde &amp; Schwarz Cybersecurity for the initial
    patch and to Jack Lloyd for quickly adding missing functions to Botan's FFI (C89) interface.
  * Implementation of RFC 8412 "Software Inventory Message and Attributes (SWIMA) for PA-TNC".
  * SWIMA subscription option sets CLOSE_WRITE trigger on apt history.log file resulting in
    a ClientRetry PB-TNC batch to initialize a new measurement cycle. The new imv/imc-swima
    plugins replace the previous imv/imc-swid plugins, which were removed.
  * Added support for fuzzing the PA-TNC (RFC 5792) and PB-TNC (RFC 5793) NEA protocols
    on Google's OSS-Fuzz infrastructure.
  * Support for version 2 of Intel's TPM2-TSS TGC Software Stack. The presence of the
    in-kernel /dev/tpmrm0 resource manager is automatically detected.
  * The pki tool accepts a xmppAddr otherName as a subjectAlternativeName using the
    syntax --san xmppaddr:&lt;jid&gt;.
  * swanctl.conf supports the configuration of marks the in- and/or outbound SA should apply
    to packets after processing on Linux. Configuring such a mark for outbound SAs requires
    at least a 4.14 kernel. The ability to set a mask and configuring a mark/mask for
    inbound SAs will be added with the upcoming 4.19 kernel.
  * New options in swanctl.conf allow configuring how/whether DF, ECN and DS fields in the
    IP headers are copied during IPsec processing. Controlling this is currently only possible
    on Linux.
  * The handling of sequence numbers in IKEv1 DPDs has been improved (#2714).
  * To avoid conflicts, the dhcp plugin now only uses the DHCP server port if explicitly
    configured.
  - Version 5.6.3
  ===============
  * Fixed a DoS vulnerability in the IKEv2 key derivation if the openssl plugin is used in FIPS
    mode and HMAC-MD5 is negotiated as PRF.
    This vulnerability has been registered as CVE-2018-10811.
  * Fixed a vulnerability in the stroke plugin, which did not check the received length before
    reading a message from the socket. Unless a group is configured, root privileges are
    required to access that socket, so in the default configuration this shouldn't be an issue.
    This vulnerability has been registered as CVE-2018-5388.
  * CRLs that are not yet valid are now ignored to avoid problems in scenarios where expired
    certificates are removed from new CRLs and the clock on the host doing the revocation
    check is trailing behind that of the host issuing CRLs. Not doing this could result in
    accepting a revoked and expired certificate, if it's still valid according to the
    trailing clock but not contained anymore in not yet valid CRLs.
  * The issuer of fetched CRLs is now compared to the issuer of the checked certificate (#2608).
  * CRL validation results other than revocation (e.g. a skipped check because the CRL couldn't
    be fetched) are now stored also for intermediate CA certificates and not only for end-entity
    certificates, so a strict CRL policy can be enforced in such cases.
  * In compliance with RFC 4945, section 5.1.3.2, certificates used for IKE must now either
    not contain a keyUsage extension (like the ones generated by pki), or have at least one of the
    digitalSignature or nonRepudiation bits set.
  * New options for vici/swanctl allow forcing the local termination of an IKE_SA. This might be
    useful in situations where it's known the other end is not reachable anymore, or that it
    already removed the IKE_SA, so retransmitting a DELETE and waiting for a response would
    be pointless.
  * Waiting only a certain amount of time for a response (i.e. shorter than all retransmits
    would be) before destroying the IKE_SA is also possible by additionally specifying a
    timeout in the forced termination request.
  * When removing routes, the kernel-netlink plugin now checks if it tracks other routes for
    the same destination and replaces the installed route instead of just removing it. Same
    during installation, where existing routes previously weren't replaced. This should allow
    using traps with virtual IPs on Linux (#2162).
  * The dhcp plugin now only sends the client identifier DHCP option if the identity_lease
    setting is enabled (7b660944b6). It can also send identities of up to 255 bytes length,
    instead of the previous 64 bytes (30e886fe3b, 0e5b94d038). If a server address is
    configured, DHCP requests are now sent from port 67 instead of 68 to avoid ICMP port
    unreachables (becf027cd9).
  * The handling of faulty INVALID_KE_PAYLOAD notifies (e.g. one containing a DH group
    that wasn't proposed) during CREATE_CHILD_SA exchanges has been improved (#2536).
  * Roam events are now completely ignored for IKEv1 SAs (there is no MOBIKE to handle such
    changes properly).
  * ChaCha20/Poly1305 is now correctly proposed without key length (#2614). For compatibility with
    older releases the chacha20poly1305compat keyword may be included in proposals to also propose
    the algorithm with a key length (c58434aeff).
  * Configuration of hardware offload of IPsec SAs is now more flexible and allows a new
    setting (auto), which automatically uses it if the kernel and device both support it. If hw
    offload is set to yes and offloading is not supported, the CHILD_SA installation now fails.
  * The kernel-pfkey plugin optionally installs routes via internal interface (one with an IP
    in the local traffic selector). On FreeBSD, enabling this selects the correct source IP
    when sending packets from the gateway itself (e811659323).
  * SHA-2 based PRFs are supported in PKCS#8 files as generated by OpenSSL 1.1 (#2574).
  * The pki --verify tool may load CA certificates and CRLs from directories.
  * The IKE daemon now also switches to port 4500 if the remote port is not 500 (e.g. because the
    remote maps the response to a different port, as might happen on Azure), as long as the local
    port is 500 (85bfab621d).
  * Fixed an issue with DNS servers passed to NetworkManager in charon-nm (ee8c25516a).
  * Logged traffic selectors now always contain the protocol if either protocol or port are set
    (a36d8097ed).
  * Only the inbound SA/policy will be updated as reaction to IP address changes for rekeyed
    CHILD_SAs that are kept around.
  * The parser for strongswan.conf/swanctl.conf now accepts = characters in values without
    having to put the value in quotes (e.g. for Base64 encoded shared secrets).
    Notes for developers:
  * trap_manager_t: Trap policies are now unistalled by peer/child name and not the reqid.
  * No reqid is returned anymore when installing trap policies.
  * child_sa_t: A new state (CHILD_DELETED) is used for CHILD_SAs that have been deleted but
    not yet destroyed (after a rekeying CHILD_SAs are kept around for a while to process
    delayed packets).
    This way child_updown events are not triggered anymore for such SAs when an IKE_SA that
    has such CHILD_SAs assigned is deleted.
  - Version 5.6.2
  ===============
  * Fixed a DoS vulnerability in the parser for PKCS#1 RSASSA-PSS signatures that was caused
    by insufficient input validation. One of the configurable parameters in algorithm identifier
    structures for RSASSA-PSS signatures is the mask generation function (MGF). Only MGF1 is
    currently specified for this purpose. However, this in turn takes itself a parameter that
    specifies the underlying hash function. strongSwan's parser did not correctly handle the
    case of this parameter being absent, causing an undefined data read.
    This vulnerability has been registered as CVE-2018-6459.
  * When rekeying IKEv2 IKE_SAs the previously negotiated DH group will be reused, instead of
    using the first configured group, which avoids an additional exchange if the peer previously
    selected a different DH group via INVALID_KE_PAYLOAD notify. The same is also done when
    rekeying CHILD_SAs except for the first rekeying of the CHILD_SA that was created with the
    IKE_SA, where no DH group was negotiated yet.
    Also, the selected DH group is moved to the front in all sent proposals that contain it
    and all proposals that don't are moved to the back in order to convey the preference for
    this group to the peer.
  * Handling of MOBIKE task queuing has been improved. In particular, the response to an
    address update (with NAT-D payloads) is not ignored anymore if only an address list update
    or DPD is queued as that could prevent updating the UDP encapsulation in the kernel.
  * On Linux, roam events may optionally be triggered by changes to the routing rules, which
    can be useful if routing rules (instead of e.g. route metrics) are used to switch from one
    to another interface (i.e. from one to another routing table). Since routing rules are
    currently not evaluated when doing route lookups this is only useful if the kernel-based
    route lookup is used (4664992f7d).
  * The fallback drop policies installed to avoid traffic leaks when replacing addresses in
    installed policies are now replaced by temporary drop policies, which also prevent
    acquires because we currently delete and reinstall IPsec SAs to update their addresses
    (35ef1b032d).
  * Access X.509 certificates held in non-volatile storage of a TPM 2.0 referenced via the
    NV index.
    Adding the --keyid parameter to pki --print allows to print private keys or certificates
    stored in a smartcard or a TPM 2.0.
  * Fixed proposal selection if a peer incorrectly sends DH groups in the ESP proposal during
    IKE_AUTH and also if a DH group is configured in the local ESP proposal and charon.prefer
    configured_proposals is disabled (d058fd3c32).
  * The lookup for PSK secrets for IKEv1 has been improved for certain scenarios (see #2497
    for details).
  * MSKs received via RADIUS are now padded to 64 bytes to avoid compatibility issues with
    EAP-MSCHAPv2 and PRFs that have a block size &lt; 64 bytes (e.g. AES-XCBC-PRF-128, see
    73cbce6013).
  * The tpm_extendpcr command line tool extends a digest into a TPM PCR.
  * Ported the NetworkManager backend from the deprecated libnm-glib to libnm.
  * The save-keys debugging/development plugin saves IKE and/or ESP keys to files compatible
    with Wireshark.
  - Version 5.6.1
  ===============
  * Several algorithms were removed from the default ESP/AH and IKE proposals in compliance with
    RFC 8221 and RFC 8247, respectively. Removed from the default ESP/AH proposal were the
    3DES and Blowfish encryption algorithms and the HMAC-MD5 integrity algorithm. From the IKE
    default proposal the HMAC-MD5 integrity algorithm and the MODP-1024 Diffie-Hellman group
    were removed (the latter is significant for Windows clients in their default configuration).
    These algorithms may still be used in custom proposals.
  * Support for RSASSA-PSS signatures has been added. For compatibility with previous
    releases they are currently not used automatically, by default, to change that charon.rsa_pss
    may be enabled. To explicitly use or require such signatures during IKEv2 signature
    authentication (RFC 7427) ike:rsa/pss... authentication constraints may be used for specific
    connections (regardless of whether the strongswan.conf option above is enabled). Only the
    hash algorithm can be specified in such constraints, the MGF1 will be based on that hash
    and the salt length will equal the hash length (when verifying the salt length is not
    enforced).
    To enforce such signatures during PKI verification use rsa/pss... authentication constraints.
  * All pki commands that create certificates/CRLs can be made to sign with RSASSA-PSS instead
    of the classing PKCS#1 scheme with the --rsa-padding pss option. As with signatures during
    authentication, only the hash algorithm is configurable (via --digest option), the MGF1 will
    be based on that and the salt length will equal the hash length.
  * These signatures are supported by all RSA backends except pkcs11 (i.e. gmp, gcrypt, openssl).
    The gmp plugin requires the mgf1 plugin.
    Note that RSASSA-PSS algorithm identifiers and parameters in keys (public keys in
    certificates or private keys in PKCS#8 files) are currently not used as constraints.
  * The sec-updater tool checks for security updates in dpkg-based repositories
    (e.g. Debian/Ubuntu) and sets the security flags in the IMV policy database accordingly.
    Additionally for each new package version a SWID tag for the given OS and HW architecture
    is created and stored in the database.
  * Using the sec-updater.sh script template the lookup can be automated (e.g. via an hourly
    cron job).
  * When restarting an IKEv2 negotiation after receiving an INVALID_KE_PAYLOAD notify (or due
    to other reasons like too many retransmits) a new initiator SPI is allocated. This
    prevents issues caused by retransmits for IKE_SA_INIT messages.
  * Because the initiator SPI was previously reused when restarting the connection delayed
    responses for previous connection attempts were processed and might have caused fatal
    errors due to a failed DH negotiation or because of the internal retry counter in the
    ike-init task. For instance, if we proposed a DH group the responder rejected we
    might have later received delayed responses that either contained INVALID_KE_PAYLOAD
    notifies with the DH group we already switched to, or, if we retransmitted an
    IKE_SA_INIT with the requested group but then had to restart again, a KE payload with
    a group different from the one we proposed.
  * The introduction of file versions in the IMV database scheme broke file reference hash
    measurements. This has been fixed by creating generic product versions having an empty
    package name.
  * A new timeout option for the systime-fix plugin stops periodic system time checks after
    a while and enforces a certificate verification, closing or reauthenticating all SAs
    with invalid certificates.
  * The IKE event counters, previously only available via ipsec listcounters command, may
    now also be queried and reset via vici and the new swanctl --counters command. They
    are collected and provided by the optional counters plugin (enabled by default for
    backwards compatibility if the stroke plugin is built).
  * Class attributes received in RADIUS Access-Accept messages may optionally be added to
    RADIUS accounting messages (655924074b).
  * Basic support for systemd sockets has been added, which may be used for privilege separation
    (59db98fb94).
  * Inbound marks may optionally be installed in the SA again (was removed with 5.5.2) by
    enabling the mark_in_sa option in swanctl.conf.
  * The timeout of leases in pools configured via pool utility may be configured in other
    units than hours.
    INITIAL_CONTACT notifies are now only omitted if never is configured as uniqueness policy.
  * Outbound FWD policies for shunts are not installed anymore, by default (as is the case
    for other policies since 5.5.1).
  * Don't consider a DH group mismatch during CHILD_SA rekeying as failure as responder
    (e7276f78aa).
  * Handling of fragmented IPv4 and IPv6 packets in libipsec has been improved (e138003de9).
  * Trigger expire events for the correct IPsec SA in libipsec (6e861947a0).
  * A crash in CRL verification via openssl plugin using OpenSSL 1.1 has been fixed (78acaba6a1).
  * No hard-coded default proposals are passed from starter to the stroke plugin anymore (the
    IKE proposal used curve25519 since 5.5.2, which is an optional plugin).
  * A workaround for an issue with virtual IPs on macOS 10.13 (High Sierra) has been added
    (039b85dd43).
  * Handling of IKE_SA rekey collisions in charon-tkm has been fixed.
  * Instead of failing or just silently doing nothing unit tests may now warn about certain
    conditions (e.g. if a test was not executed due to external dependencies).</changelog>
  <changelog author="mmnelemane@suse.com" date="1585224000">- Fix for to resolve multiple definition of swanctl_dir (bsc #1164493)
  [+ 0006-Resolve-multiple-definition-of-swanctl_dir.patch]</changelog>
  <changelog author="mbuil@suse.com" date="1610712000">- Fix typo in README (bsc #1167880)
  [+ 0007-Fix-typo-in-README.patch ]</changelog>
  <changelog author="mbuil@suse.com" date="1611576000">- Fix FIPS bug (bsc #1180801)
  [+ 0008-gcrypt-Use-a-dummy-buffer-to-initialize-static-alloc.patch ]</changelog>
  <changelog author="mbuil@suse.com" date="1617019200">- Keep using ipsec as the main binary. Therefore, make strongswan.service point to it instead of swanctl</changelog>
  <changelog author="mbuil@suse.com" date="1617019201">- Information added in README about the rcstrongswan-starter</changelog>
  <changelog author="mbuil@suse.com" date="1617624000">- Add config to run ipsec on namespaces (bsc #1183670)</changelog>
  <changelog author="mt@suse.com" date="1619006400">- Add support for AES CCM aead algorithms to openssl plugin (cc/fips,bsc#1185363)
  [+ 0009-strongswan-openssl-aead-add-ccm-support.patch]</changelog>
  <changelog author="mt@suse.com" date="1620388800">- Replace AEAD AES CCM patch with upstream variant (cc/fips,bsc#1185363)
  [* 0009-strongswan-openssl-aead-add-ccm-support.patch]</changelog>
  <changelog author="hare@suse.de" date="1627646400">- Add auth_els plugin to support Marvell FC-SP encryption (jsc#SLE-20151)
  [* strongswan-marvell-auth-els.patch]</changelog>
  <changelog author="abergmann@suse.com" date="1634040000">- Fix integer overflow in gmp plugin (bsc#1191367, CVE-2021-41990)
  [* strongswan-5.6.1-5.9.3_gmp-rsa-ssa-salt-len.patch]
- Fix integer overflow when replacing certificates in cache (bsc#1191435, CVE-2021-41991)
  [* strongswan-4.4.1-5.9.3_cert-cache-random.patch]</changelog>
  <changelog author="meissner@suse.com" date="1643025600">- strongswan-5.5.0-5.9.4_eap_success-CVE-2021-45079.patch:
  Fixed authentication bypass in EAP authentication (CVE-2021-45079
  bsc#1194471)</changelog>
</package>
<package pkgid="b9f6702dd53dbc47d4f82cb596d31db05570a52e703403f0c991642000508140" name="strongswan-libs0" arch="x86_64">
  <version epoch="0" ver="5.8.2" rel="11.24.1"/>
  <changelog author="ndas@suse.de" date="1501502400">- Updated to strongSwan 5.3.5(bsc#1050691) providing the following changes:
  * Fixed a DoS vulnerability in the gmp plugin that was caused by insufficient input
    validation when verifying RSA signatures. More specifically, mpz_powm_sec() has two
    requirements regarding the passed exponent and modulus that the plugin did not
    enforce, if these are not met the calculation will result in a floating point exception
    that crashes the whole process.
    This vulnerability has been registered as CVE-2017-9022.
    Please refer to our blog for details.
  * Fixed a DoS vulnerability in the x509 plugin that was caused because the ASN.1 parser
    didn't handle ASN.1 CHOICE types properly, which could result in an infinite loop when
    parsing X.509 extensions that use such types.
    This vulnerability has been registered as CVE-2017-9023.
    Please refer to our blog for details.
  * The behavior during IKEv2 CHILD_SA rekeying has been changed in order to avoid
    traffic loss. When responding to a CREATE_CHILD_SA request to rekey a CHILD_SA
    the responder already has everything available to install and use the new CHILD_SA.
    However, this could lead to lost traffic as the initiator won't be able to process
    inbound packets until it processed the CREATE_CHILD_SA response and updated the
    inbound SA. To avoid this the responder now only installs the new inbound SA and
    delays installing the outbound SA until it receives the DELETE for the replaced CHILD_SA.
  * The messages transporting these DELETEs could reach the peer before packets sent
    with the deleted outbound SAs reach it. To reduce the chance of traffic loss due
    to this the inbound SA of the replaced CHILD_SA is not removed for a configurable
    amount of seconds (charon.delete_rekeyed_delay) after the DELETE has been processed.
  * The code base has been ported to Apple's ARM64 iOS platform, which required several
    changes regarding the use of variadic functions. This was necessary because the calling
    conventions for variadic and regular functions are different there.
    This means that assigning a non-variadic function to a variadic function pointer, as we
    did with our enumerator_t::enumerate() implementations and several callbacks, will
    result in crashes as the called function accesses the arguments differently than the
    caller provided them. To avoid this issue the enumerator_t interface has been changed
    and the signature of the callback functions for enumerator_create_filter() and two
    methods on linked_list_t have been changed. Refer to the developer notes below
    for details.
  * Adds support for fuzzing the certificate parser provided by the default plugins
    (x509, pem, gmp etc.) on Google's OSS-Fuzz infrastructure (or generally with
    libFuzzer). Several issues found while fuzzing these plugins were fixed.
  * Two new options have been added to charon's retransmission settings:
    retransmit_limit and retransmit_jitter. The former adds an upper limit to the
    calculated retransmission timeout, the latter randomly reduces it.
    Refer to Retransmission for details.
  * A bug in swanctl's --load-creds command was fixed that caused unencrypted
    private keys to get unloaded if the command was called multiple times.
    The load-key VICI command now returns the key ID of the loaded key on success.
  * The credential manager now enumerates local credential sets before global ones.
    This means certificates supplied by the peer will now be preferred over certificates
    with the same identity that may be locally stored (e.g. in the certificate cache).
  * Adds support for hardware offload of IPsec SAs as introduced by Linux 4.11 for
    specific hardware that supports this.
  * The pki tool loads the curve25519 plugin by default.
    [- 0006-Make-sure-the-modulus-is-odd-and-the-exponent-not-zero.patch,
  - 0007-asn1-parser-Fix-CHOICE-parsing.patch]
- libhydra is removed as all kernel plugins moved to libcharon</changelog>
  <changelog author="ndas@suse.de" date="1504612800">- fix "uintptr_t? undeclared" compilation error.
  [+0006-fix-compilation-error-by-adding-stdint.h.patch]</changelog>
  <changelog author="ndas@suse.de" date="1504612801">- Updated to strongSwan 5.6.0 providing the following changes:
  * Fixed a DoS vulnerability in the gmp plugin that was caused by insufficient input validation
    when verifying RSA signatures, which requires decryption with the operation m^e mod n,
    where m is the signature, and e and n are the exponent and modulus of the public key.
    The value m is an integer between 0 and n-1, however, the gmp plugin did not verify this.
    So if m equals n the calculation results in 0, in which case mpz_export() returns NULL.
    This result wasn't handled properly causing a null-pointer dereference.
    This vulnerability has been registered as CVE-2017-11185. (bsc#1051222)
  * New SWIMA IMC/IMV pair implements the draft-ietf-sacm-nea-swima-patnc Internet
    Draft and has been demonstrated at the IETF 99 Prague Hackathon.
  * The IMV database template has been adapted to achieve full compliance with the
    ISO 19770-2:2015 SWID tag standard.
  * The pt-tls-client can attach and use TPM 2.0 protected private keys via the --keyid parameter.
  * By default the /etc/swanctl/conf.d directory is created and *.conf files in it are included in the default
    swanctl.conf file.
  * The curl plugin now follows HTTP redirects (configurable via strongswan.conf).
  * The CHILD_SA rekeying was fixed in charon-tkm and the behavior is refined a bit more since 5.5.3
  * libtpmtss supports Intel's TSS2 Architecture Broker and Resource Manager interface (tcti-tabrmd).
  * more on https://wiki.strongswan.org/versions/66</changelog>
  <changelog author="mmnelemane@suse.com" date="1521028800">- Removed unused requires and macro calls(bsc#1083261)</changelog>
  <changelog author="mmnelemane@suse.com" date="1573646400">- Added patch to fix vulnerability: CVE-2018-16151,CVE-2018-16152 (bsc#1107874)
  - Insufficient input validation in gmp plugin
  [+ 0007-strongswan-5.3.1-5.6.0_gmp-pkcs1-verify.patch]</changelog>
  <changelog author="mmnelemane@suse.com" date="1573646401">- Added patch to fix vulnerability: CVE-2018-5388 (bsc#1094462)
  - Buffer Underflow in stroke_socket.c
  [+ 0008-strongswan-5.1.2-5.6.2_stroke_msg_len.patch]</changelog>
  <changelog author="mmnelemane@suse.com" date="1573646402">- Added patch to fix vulnerability: CVE-2018-10811 (bsc#1093536)
  - denial-of-service vulnerability
  [+ 0009-strongswan-5.5.0-5.6.2_skeyseed_init.patch]</changelog>
  <changelog author="mmnelemane@suse.com" date="1573732800">- Added patch to fix vulnerability: CVE-2018-17540 (bsc#1109845)
  [+ 0010-strongswan-4.4.0-5.7.0_gmp-pkcs1-overflow.patch]</changelog>
  <changelog author="mmnelemane@suse.com" date="1580212800">- Updated to version 5.8.2 (jsc#SLE-11370)
  - Dropped following patches due to irrelevance in the updated version:
    [- strongswan_modprobe_syslog.patch ]
    [- strongswan_fipsfilter.patch ]
    [- 0006-fix-compilation-error-by-adding-stdint.h.patch ]
    [- 0007-strongswan-5.3.1-5.6.0_gmp-pkcs1-verify.patch ]
    [- 0008-strongswan-5.1.2-5.6.2_stroke_msg_len.patch ]
    [- 0009-strongswan-5.5.0-5.6.2_skeyseed_init.patch ]
    [- 0010-strongswan-4.4.0-5.7.0_gmp-pkcs1-overflow.patch ]
  - Version 5.8.2
  ===============
  * Identity-based CA constraints, which enforce that the certificate chain of the remote
    peer contains a CA certificate with a specific identity, are supported via
    vici/swanctl.conf. This is similar to the existing CA constraints but doesn't require
    that the CA certificate is locally installed, for instance, intermediate CA certificates
    received from the peers. Wildcard identity matching (e.g. ..., OU=Research, CN=*) could
    also be used for the latter but requires trust in the intermediate CAs to only issue
    certificates with legitimate subject DNs (e.g. the "Sales" CA must not issue certificates
    with OU=Research). With the new constraint that's not necessary as long as a path length
    basic constraint (--pathlen for pki --issue) prevents intermediate CAs from issuing further
    intermediate CAs.
  * Intermediate CA certificates may now be sent in hash-and-URL encoding by configuring a
    base URL for the parent CA (#3234, swanctl/rw-hash-and-url-multi-level).
  * Implemented NIST SP-800-90A Deterministic Random Bit Generator (DRBG) based on AES-CTR
    and SHA2-HMAC modes. Currently used by the gmp and ntru plugins.
  * Random nonces sent in an OCSP requests are now expected in the corresponding OCSP responses.
  * The kernel-netlink plugin now ignores deprecated IPv6 addresses for MOBIKE. Whether temporary
    or permanent IPv6 addresses are included now depends on the charon.prefer_temporary_addrs
    setting (#3192).
  * Extended Sequence Numbers (ESN) are configured via PF_KEY if supported by the kernel.
  * The PF_KEY socket's receive buffer in the kernel-pfkey plugin is now cleared before sending
    requests, as many of the messages sent by the kernel are sent as broadcasts to all PF_KEY
    sockets. This is an issue if an external tool is used to manage SAs/policies unrelated to
    IPsec (#3225).
  * The vici plugin now uses unique section names for CHILD_SAs in child-updown events (7c74ce9190).
  * For individually deleted CHILD_SAs (in particular for IKEv1) the vici child-updown event
    now includes more information about the CHILD_SAs such as traffic statistics (#3198).
  * Custom loggers are correctly re-registered if log levels are changed via stroke loglevel (#3182).
  * Avoid lockups during startup on low entropy systems when using OpenSSL 1.1.1 (095a2c2eac).
  * Instead of failing later when setting a key, creating HMACs via openssl plugin now fails
    instantly if the underlying hash algorithm isn't supported (e.g. MD5 in FIPS-mode) so fallbacks
    to other plugins work properly (#3284).
  * Exponents of RSA keys read from TPM 2.0 via SAPI are correctly converted (8ee1242f1438).
  * Routing table IDs &gt; 255 are supported for custom routes on Linux.
  * To avoid races, the check for hardware offloading support in the kernel-netlink plugin is
    performed during initialization of the plugin (a605452c03).
  * The D-Bus config file for charon-nm is now installed in $(datadir)/dbus-1/system.d instead of
    $(sysconfdir)/dbus-1/system.d, which is intended for sysadmin overrides.
    INVALID_MAJOR_VERSION notifies are now correctly sent in messages of the same exchange type
    and with the same message ID as the request.
  * IKEv2 SAs are now immediately destroyed when sending or receiving INVALID_SYNTAX notifies
    in authenticated messages.
  * For developers working from the repository the configure script now aborts if GNU gperf is
    not found.
  - Version 5.8.1
  ===============
  * RDNs in DNs of X.509 certificates can now optionally be matched less strict. The global
    strongswan.conf option charon.rdn_matching takes two alternative values that cause the
    matching algorithm to either ignore the order of matched RDNs (reordered) or additionally
    (relaxed) accept DNs that contain more RDNs than configured (unmatched RDNs are treated
    like wildcard matches).
  * The updown plugin now passes the same interface to the script that is also used for the
    automatically installed routes, that is, the interface over which the peer is reached
    instead of the interface on which the local address is found (#3095).
  * TPM 2.0 contexts are now protected by a mutex to prevent issues if multiple IKE_SAs use
    the same private key concurrently (4b25885025).
  * Do a rekey check after the third QM message was received (#3060).
  * If available, explicit_bzero() is now used as memwipe() instead of our own implementation.
  * An .editorconfig file has been added, mainly so Github shows files with proper indentation
    (68346b6962).
  * The internal certificate of the load-tester plugin has been modified so it can again be
    used as end-entity cert with 5.6.3 and later (#3139).
  * The maximum data length of received COOKIE notifies (64 bytes) is now enforced (#3160).
  - Version 5.8.0
  ===============
  * The systemd service units have been renamed. The modern unit, which was called
    strongswan-swanctl, is now called strongswan (the previous name is configured as alias in
    the unit, for which a symlink is created when the unit is enabled). The legacy unit is now
    called strongswan-starter.
  * Support for XFRM interfaces (available since Linux 4.19) has been added, which are intended
    to replace VTI devices (they are similar but offer several advantages, for instance, they
    are not bound to an address or address family).
  * IPsec SAs and policies are associated with such interfaces via interface IDs that can be
    configured in swanctl.conf (dynamic IDs may optionally be allocated for each SA and even
    direction). It's possible to use separate interfaces for in- and outbound traffic (or
    only use an interface in one direction and regular policies in the other).
  * Interfaces may be created dynamically via updown/vici scripts, or statically before or after
    establishing the SAs. Routes must be added manually as needed (the daemon will not install
    any routes for outbound policies with an interface ID).
  * When moving XFRM interfaces to other network namespaces they retain access to the SAs and
    policies installed in the original namespace, which allows providing IPsec tunnels for
    processes in other network namespaces without giving them access to the IPsec keys or
    IKE credentials.
    More information can be found on the page about route-based VPNs.
  * Initiation of childless IKE_SAs is supported (RFC 6023). If enabled and supported by the
    responder, no CHILD_SA is established during IKE_AUTH. Instead, all CHILD_SAs are created
    with CREATE_CHILD_SA exchanges. This allows using a separate DH exchange even for the
    first CHILD_SA, which is otherwise created during IKE_AUTH with keys derived from the
    IKE_SA's key material.
  * The swanctl --initiate command may be used to initiate only the IKE_SA via --ike
    option if --child is omitted and the peer supports this extension.
  * The NetworkManager backend and plugin support IPv6.
  * The new wolfssl plugin is a wrapper around the wolfSSL crypto library. Thanks to Sean
    Parkinson of wolfSSL Inc. for the initial patch.
  * IKE SPIs may optionally be labeled via the charon.spi_mask|label options in
    strongswan.conf. This feature was extracted from charon-tkm, however, now applies the
    mask/label in network order.
  * The openssl plugin supports ChaCha20-Poly1305 when built with OpenSSL 1.1.0.
  * The PB-TNC finite state machine according to section 3.2 of RFC 5793 was not correctly
    implemented when sending either a CRETRY or SRETRY batch. These batches can only be sent
    in the "Decided" state and a CRETRY batch can immediately carry all messages usually
    transported by a CDATA batch. It is currently not possible to send a SRETRY batch since
    full-duplex mode for PT-TLS transport is not supported.
  * Instead of marking IPv6 virtual IPs as deprecated, the kernel-netlink plugin now uses
    address labels to avoid that such addresses are used for non-VPN traffic (00a953d090).
  * The agent plugin now creates sockets to the ssh/gpg-agent dynamically and does not keep
    them open, which otherwise might prevent the agent from getting terminated.
  * To avoid broadcast loops the forecast plugin now only reinjects packets that are marked
    or received from the configured interface.
  * UTF-8 encoded passwords are supported via EAP-MSCHAPv2, which internally uses an UTF-16LE
    encoding to calculate the NT hash (#3014).
  * Properly delete temporary drop policies (used when updating IP addresses of SAs) if manual
    priorities are used, which was broken since 5.6.2 (8e31d65730).
  * Avoid overwriting start_action when parsing the inactivity timeout in the vici plugin (#2954).
  * Fixed the automatic termination of reloaded vici connections with start_action=start,
    which was broken since 5.6.3 (71b22c250f).
  * The lookup for shared secrets for IKEv1 SAs via sql plugin should now work better
    (6ec9f68f32).
  * Fixed a race condition in the trap manager between installation and removal of a policy
    (69cbe2ca3f).
  * Compilation of the kernel-netlink plugin has been fixed on old kernels (&lt; 2.6.39), which
    was caused by the HW offload changes (c7f579fa17).
  * The IPsec stack detection and module loading in starter has been removed (it wasn't
    enforced anyway and loading modules doesn't seem necessary, also KLIPS hasn't been
    supported for a long time and PF_KEY will eventually be removed from the Linux kernel,
    ba817d2917).
  * Several IKEv2 protocol details are now handled more strictly: Unrequested virtual IPs are
    ignored, CFG_REPLY payloads are ignored if no CFG_REQUEST payloads were sent, a USE
    TRANSPORT_MODE notify received from the responder is checked against the local configuration.
  * The keys and certificates used by the scenarios in the testing environment are now generated
    dynamically. Running the testing/scripts/build-certs script after creating the base and root
    images uses the pki utility installed in the latter to create the keys and certificates for
    all the CAs and in some cases for individual scenarios. These credentials are stored in the
    source tree, not the image, so this has to be called only once even if the images are later
    rebuilt. The script automatically (re-)rebuilds the guest images as that generates fresh
    CRLs and signs the DNS zones. The only keys/certificates currently not generated are the
    very large ones used by the ikev2/rw-eap-tls-fragments scenario.
  - Version 5.7.2
  ===============
  * For RSA with PSS padding, the TPM 2.0 specification mandates the maximum salt length
    (as defined by the length of the key and hash). However, if the TPM is FIPS-168-4 compliant,
    the salt length equals the hash length. This is assumed for FIPS-140-2 compliant TPMs, but
    if that's not the case, it might be necessary to manually enable charon.plugins.tpm.fips_186_4
    if the TPM doesn't use the maximum salt length.
  * Directories for credentials loaded by swanctl are now accessed relative to the loaded
    swanctl.conf file, in particular, when loading it from a custom location via --file argument.
  * The base directory, which is used if no custom location for swanctl.conf is specified, is now
    also configurable at runtime via SWANCTL_DIR environment variable.
  * If RADIUS Accounting is enabled, the eap-radius plugin will add the session ID (Acct-Session-Id)
    to Access-Request messages, which e.g. simplifies associating database entries for IP leases and
    accounting with sessions (the session ID does not change when IKE_SAs are rekeyed, #2853).
  * All IP addresses assigned by a RADIUS server are included in Accounting-Stop messages even if
    the client did not claim them, allowing to release them early in case of connection errors (#2856).
  * Selectors installed on transport mode SAs by the kernel-netlink plugin are now updated if an
    IP address changes (e.g. via MOBIKE) and it was part of the selectors.
  * No deletes are sent anymore when a rekeyed CHILD_SA expires (#2815).
  * The bypass-lan plugin now tracks interfaces to handle subnets that move from one interface
    to another and properly update associated routes (#2820).
  * Only valid and expected inbound IKEv2 messages are used to update the timestamp of the
    last received message (previously, retransmits also triggered an update).
  * IKEv2 requests from responders are now ignored until the IKE_SA is fully established (e.g. if a
    DPD request from the peer arrives before the IKE_AUTH response does, 46bea1add9).
    Delayed IKE_SA_INIT responses with COOKIE notifies we already recevied are ignored, they caused
    another reset of the IKE_SA previously (#2837).
  * Active and queued Quick Mode tasks are now adopted if the peer reauthenticates an IKEv1 SA
    while creating lots of CHILD_SAs.
  * Newer versions of the FreeBSD kernel add an SADB_X_EXT_SA2 extension to SADB_ACQUIRE
    messages, which allows the kernel-pfkey plugin to determine the reqid of the policy even if it
    wasn't installed by the daemon previously (e.g. when using FreeBSD's if_ipsec(4) VTIs, which
    install policies themselves, 872b9b3e8d).
  * Added support for RSA signatures with SHA-256 and SHA-512 to the agent plugin. For older
    versions of ssh/gpg-agent that only support SHA-1, IKEv2 signature authentication has to be
    disabled via charon.signature_authentication.
  * The sshkey and agent plugins support Ed25519/Ed448 SSH keys and signatures.
  * The openssl plugin supports X25519/X448 Diffie-Hellman and Ed25519/Ed448 keys and
    signatures when built against OpenSSL 1.1.1.
  * Support for Ed25519, ChaCha20/Poly1305, SHA-3 and AES-CCM were added to the botan plugin.
  * The mysql plugin now properly handles database connections with transactions
    under heavy load (#2779).
  * IP addresses in ha pools are now distributed evenly among all segments (#2828).
  * Private key implementations may optionally provide a list of supported signature schemes,
    which, as described above, is used by the tpm plugin because for each key on a TPM 2.0 the
    hash algorithm and for RSA also the padding scheme is predefined.
  * The testing environment is now based on Debian 9 (stretch) by default. This required
    some changes, in particular, updating to FreeRADIUS 3.x (which forced us to abandon the
    TNC@FHH patches and scenarios, 2fbe44bef3) and removing FIPS-enabled versions of
    OpenSSL (the FIPS module only supports OpenSSL 1.0.2).
  * Most test scenarios were migrated to swanctl.
  - Version 5.7.1
  ===============
  * Fixes a vulnerability in the gmp plugin triggered by crafted certificates with RSA keys with
    very small moduli. When verifying signatures with such keys, the code patched with the fix
    for CVE-2018-16151/2 caused an integer underflow and subsequent heap buffer overflow
    that results in a crash of the daemon.
  * The vulnerability has been registered as CVE-2018-17540.
  - Version 5.7.0
  ===============
  * Fixes a potential authorization bypass vulnerability in the gmp plugin that was caused by a
    too lenient verification of PKCS#1 v1.5 signatures. Several flaws could be exploited by a
    Bleichenbacher-style attack to forge signatures for low-exponent keys (i.e. with e=3).
  * CVE-2018-16151 has been assigned to the problem of accepting random bytes after the OID
    of the hash function in such signatures, and CVE-2018-16152 has been assigned to the issue
    of not verifying that the parameters in the ASN.1 algorithmIdentitifer structure is empty.
    Other flaws that don't lead to a vulnerability directly (e.g. not checking for at least
    8 bytes of padding) have no separate CVE assigned.
  * Dots are not allowed anymore in section names in swanctl.conf and strongswan.conf.
    This mainly affects the configuration of file loggers. If the path for such a log file
    contains dots it now has to be configured in the new path setting within the arbitrarily
    renamed subsection in the filelog section.
  * Sections in swanctl.conf and strongswan.conf may now reference other sections. All settings
    and subsections from such a section are inherited. This allows to simplify configs as
    redundant information has only to be specified once and may then be included in other
    sections (see strongswan.conf for an example).
  * The originally selected IKE config (based on the IPs and IKE version) can now change
    if no matching algorithm proposal is found. This way the order of the configs doesn't
    matter that much anymore and it's easily possible to specify separate configs for
    clients that require weaker algorithms (instead of having to also add them in other
    configs that might be selected).
  * Support for Postquantum Preshared Keys for IKEv2 (draft-ietf-ipsecme-qr-ikev2) has been added.
    For an example refer to the swanctl/rw-cert-ppk scenario (or with EAP, or PSK authentication).
  * The new botan plugin is a wrapper around the Botan C++ crypto library.
    It requires a fairly recent build from Botan's master branch (or the upcoming 2.8.0 release).
    Thanks to René Korthaus and his team from Rohde &amp; Schwarz Cybersecurity for the initial
    patch and to Jack Lloyd for quickly adding missing functions to Botan's FFI (C89) interface.
  * Implementation of RFC 8412 "Software Inventory Message and Attributes (SWIMA) for PA-TNC".
  * SWIMA subscription option sets CLOSE_WRITE trigger on apt history.log file resulting in
    a ClientRetry PB-TNC batch to initialize a new measurement cycle. The new imv/imc-swima
    plugins replace the previous imv/imc-swid plugins, which were removed.
  * Added support for fuzzing the PA-TNC (RFC 5792) and PB-TNC (RFC 5793) NEA protocols
    on Google's OSS-Fuzz infrastructure.
  * Support for version 2 of Intel's TPM2-TSS TGC Software Stack. The presence of the
    in-kernel /dev/tpmrm0 resource manager is automatically detected.
  * The pki tool accepts a xmppAddr otherName as a subjectAlternativeName using the
    syntax --san xmppaddr:&lt;jid&gt;.
  * swanctl.conf supports the configuration of marks the in- and/or outbound SA should apply
    to packets after processing on Linux. Configuring such a mark for outbound SAs requires
    at least a 4.14 kernel. The ability to set a mask and configuring a mark/mask for
    inbound SAs will be added with the upcoming 4.19 kernel.
  * New options in swanctl.conf allow configuring how/whether DF, ECN and DS fields in the
    IP headers are copied during IPsec processing. Controlling this is currently only possible
    on Linux.
  * The handling of sequence numbers in IKEv1 DPDs has been improved (#2714).
  * To avoid conflicts, the dhcp plugin now only uses the DHCP server port if explicitly
    configured.
  - Version 5.6.3
  ===============
  * Fixed a DoS vulnerability in the IKEv2 key derivation if the openssl plugin is used in FIPS
    mode and HMAC-MD5 is negotiated as PRF.
    This vulnerability has been registered as CVE-2018-10811.
  * Fixed a vulnerability in the stroke plugin, which did not check the received length before
    reading a message from the socket. Unless a group is configured, root privileges are
    required to access that socket, so in the default configuration this shouldn't be an issue.
    This vulnerability has been registered as CVE-2018-5388.
  * CRLs that are not yet valid are now ignored to avoid problems in scenarios where expired
    certificates are removed from new CRLs and the clock on the host doing the revocation
    check is trailing behind that of the host issuing CRLs. Not doing this could result in
    accepting a revoked and expired certificate, if it's still valid according to the
    trailing clock but not contained anymore in not yet valid CRLs.
  * The issuer of fetched CRLs is now compared to the issuer of the checked certificate (#2608).
  * CRL validation results other than revocation (e.g. a skipped check because the CRL couldn't
    be fetched) are now stored also for intermediate CA certificates and not only for end-entity
    certificates, so a strict CRL policy can be enforced in such cases.
  * In compliance with RFC 4945, section 5.1.3.2, certificates used for IKE must now either
    not contain a keyUsage extension (like the ones generated by pki), or have at least one of the
    digitalSignature or nonRepudiation bits set.
  * New options for vici/swanctl allow forcing the local termination of an IKE_SA. This might be
    useful in situations where it's known the other end is not reachable anymore, or that it
    already removed the IKE_SA, so retransmitting a DELETE and waiting for a response would
    be pointless.
  * Waiting only a certain amount of time for a response (i.e. shorter than all retransmits
    would be) before destroying the IKE_SA is also possible by additionally specifying a
    timeout in the forced termination request.
  * When removing routes, the kernel-netlink plugin now checks if it tracks other routes for
    the same destination and replaces the installed route instead of just removing it. Same
    during installation, where existing routes previously weren't replaced. This should allow
    using traps with virtual IPs on Linux (#2162).
  * The dhcp plugin now only sends the client identifier DHCP option if the identity_lease
    setting is enabled (7b660944b6). It can also send identities of up to 255 bytes length,
    instead of the previous 64 bytes (30e886fe3b, 0e5b94d038). If a server address is
    configured, DHCP requests are now sent from port 67 instead of 68 to avoid ICMP port
    unreachables (becf027cd9).
  * The handling of faulty INVALID_KE_PAYLOAD notifies (e.g. one containing a DH group
    that wasn't proposed) during CREATE_CHILD_SA exchanges has been improved (#2536).
  * Roam events are now completely ignored for IKEv1 SAs (there is no MOBIKE to handle such
    changes properly).
  * ChaCha20/Poly1305 is now correctly proposed without key length (#2614). For compatibility with
    older releases the chacha20poly1305compat keyword may be included in proposals to also propose
    the algorithm with a key length (c58434aeff).
  * Configuration of hardware offload of IPsec SAs is now more flexible and allows a new
    setting (auto), which automatically uses it if the kernel and device both support it. If hw
    offload is set to yes and offloading is not supported, the CHILD_SA installation now fails.
  * The kernel-pfkey plugin optionally installs routes via internal interface (one with an IP
    in the local traffic selector). On FreeBSD, enabling this selects the correct source IP
    when sending packets from the gateway itself (e811659323).
  * SHA-2 based PRFs are supported in PKCS#8 files as generated by OpenSSL 1.1 (#2574).
  * The pki --verify tool may load CA certificates and CRLs from directories.
  * The IKE daemon now also switches to port 4500 if the remote port is not 500 (e.g. because the
    remote maps the response to a different port, as might happen on Azure), as long as the local
    port is 500 (85bfab621d).
  * Fixed an issue with DNS servers passed to NetworkManager in charon-nm (ee8c25516a).
  * Logged traffic selectors now always contain the protocol if either protocol or port are set
    (a36d8097ed).
  * Only the inbound SA/policy will be updated as reaction to IP address changes for rekeyed
    CHILD_SAs that are kept around.
  * The parser for strongswan.conf/swanctl.conf now accepts = characters in values without
    having to put the value in quotes (e.g. for Base64 encoded shared secrets).
    Notes for developers:
  * trap_manager_t: Trap policies are now unistalled by peer/child name and not the reqid.
  * No reqid is returned anymore when installing trap policies.
  * child_sa_t: A new state (CHILD_DELETED) is used for CHILD_SAs that have been deleted but
    not yet destroyed (after a rekeying CHILD_SAs are kept around for a while to process
    delayed packets).
    This way child_updown events are not triggered anymore for such SAs when an IKE_SA that
    has such CHILD_SAs assigned is deleted.
  - Version 5.6.2
  ===============
  * Fixed a DoS vulnerability in the parser for PKCS#1 RSASSA-PSS signatures that was caused
    by insufficient input validation. One of the configurable parameters in algorithm identifier
    structures for RSASSA-PSS signatures is the mask generation function (MGF). Only MGF1 is
    currently specified for this purpose. However, this in turn takes itself a parameter that
    specifies the underlying hash function. strongSwan's parser did not correctly handle the
    case of this parameter being absent, causing an undefined data read.
    This vulnerability has been registered as CVE-2018-6459.
  * When rekeying IKEv2 IKE_SAs the previously negotiated DH group will be reused, instead of
    using the first configured group, which avoids an additional exchange if the peer previously
    selected a different DH group via INVALID_KE_PAYLOAD notify. The same is also done when
    rekeying CHILD_SAs except for the first rekeying of the CHILD_SA that was created with the
    IKE_SA, where no DH group was negotiated yet.
    Also, the selected DH group is moved to the front in all sent proposals that contain it
    and all proposals that don't are moved to the back in order to convey the preference for
    this group to the peer.
  * Handling of MOBIKE task queuing has been improved. In particular, the response to an
    address update (with NAT-D payloads) is not ignored anymore if only an address list update
    or DPD is queued as that could prevent updating the UDP encapsulation in the kernel.
  * On Linux, roam events may optionally be triggered by changes to the routing rules, which
    can be useful if routing rules (instead of e.g. route metrics) are used to switch from one
    to another interface (i.e. from one to another routing table). Since routing rules are
    currently not evaluated when doing route lookups this is only useful if the kernel-based
    route lookup is used (4664992f7d).
  * The fallback drop policies installed to avoid traffic leaks when replacing addresses in
    installed policies are now replaced by temporary drop policies, which also prevent
    acquires because we currently delete and reinstall IPsec SAs to update their addresses
    (35ef1b032d).
  * Access X.509 certificates held in non-volatile storage of a TPM 2.0 referenced via the
    NV index.
    Adding the --keyid parameter to pki --print allows to print private keys or certificates
    stored in a smartcard or a TPM 2.0.
  * Fixed proposal selection if a peer incorrectly sends DH groups in the ESP proposal during
    IKE_AUTH and also if a DH group is configured in the local ESP proposal and charon.prefer
    configured_proposals is disabled (d058fd3c32).
  * The lookup for PSK secrets for IKEv1 has been improved for certain scenarios (see #2497
    for details).
  * MSKs received via RADIUS are now padded to 64 bytes to avoid compatibility issues with
    EAP-MSCHAPv2 and PRFs that have a block size &lt; 64 bytes (e.g. AES-XCBC-PRF-128, see
    73cbce6013).
  * The tpm_extendpcr command line tool extends a digest into a TPM PCR.
  * Ported the NetworkManager backend from the deprecated libnm-glib to libnm.
  * The save-keys debugging/development plugin saves IKE and/or ESP keys to files compatible
    with Wireshark.
  - Version 5.6.1
  ===============
  * Several algorithms were removed from the default ESP/AH and IKE proposals in compliance with
    RFC 8221 and RFC 8247, respectively. Removed from the default ESP/AH proposal were the
    3DES and Blowfish encryption algorithms and the HMAC-MD5 integrity algorithm. From the IKE
    default proposal the HMAC-MD5 integrity algorithm and the MODP-1024 Diffie-Hellman group
    were removed (the latter is significant for Windows clients in their default configuration).
    These algorithms may still be used in custom proposals.
  * Support for RSASSA-PSS signatures has been added. For compatibility with previous
    releases they are currently not used automatically, by default, to change that charon.rsa_pss
    may be enabled. To explicitly use or require such signatures during IKEv2 signature
    authentication (RFC 7427) ike:rsa/pss... authentication constraints may be used for specific
    connections (regardless of whether the strongswan.conf option above is enabled). Only the
    hash algorithm can be specified in such constraints, the MGF1 will be based on that hash
    and the salt length will equal the hash length (when verifying the salt length is not
    enforced).
    To enforce such signatures during PKI verification use rsa/pss... authentication constraints.
  * All pki commands that create certificates/CRLs can be made to sign with RSASSA-PSS instead
    of the classing PKCS#1 scheme with the --rsa-padding pss option. As with signatures during
    authentication, only the hash algorithm is configurable (via --digest option), the MGF1 will
    be based on that and the salt length will equal the hash length.
  * These signatures are supported by all RSA backends except pkcs11 (i.e. gmp, gcrypt, openssl).
    The gmp plugin requires the mgf1 plugin.
    Note that RSASSA-PSS algorithm identifiers and parameters in keys (public keys in
    certificates or private keys in PKCS#8 files) are currently not used as constraints.
  * The sec-updater tool checks for security updates in dpkg-based repositories
    (e.g. Debian/Ubuntu) and sets the security flags in the IMV policy database accordingly.
    Additionally for each new package version a SWID tag for the given OS and HW architecture
    is created and stored in the database.
  * Using the sec-updater.sh script template the lookup can be automated (e.g. via an hourly
    cron job).
  * When restarting an IKEv2 negotiation after receiving an INVALID_KE_PAYLOAD notify (or due
    to other reasons like too many retransmits) a new initiator SPI is allocated. This
    prevents issues caused by retransmits for IKE_SA_INIT messages.
  * Because the initiator SPI was previously reused when restarting the connection delayed
    responses for previous connection attempts were processed and might have caused fatal
    errors due to a failed DH negotiation or because of the internal retry counter in the
    ike-init task. For instance, if we proposed a DH group the responder rejected we
    might have later received delayed responses that either contained INVALID_KE_PAYLOAD
    notifies with the DH group we already switched to, or, if we retransmitted an
    IKE_SA_INIT with the requested group but then had to restart again, a KE payload with
    a group different from the one we proposed.
  * The introduction of file versions in the IMV database scheme broke file reference hash
    measurements. This has been fixed by creating generic product versions having an empty
    package name.
  * A new timeout option for the systime-fix plugin stops periodic system time checks after
    a while and enforces a certificate verification, closing or reauthenticating all SAs
    with invalid certificates.
  * The IKE event counters, previously only available via ipsec listcounters command, may
    now also be queried and reset via vici and the new swanctl --counters command. They
    are collected and provided by the optional counters plugin (enabled by default for
    backwards compatibility if the stroke plugin is built).
  * Class attributes received in RADIUS Access-Accept messages may optionally be added to
    RADIUS accounting messages (655924074b).
  * Basic support for systemd sockets has been added, which may be used for privilege separation
    (59db98fb94).
  * Inbound marks may optionally be installed in the SA again (was removed with 5.5.2) by
    enabling the mark_in_sa option in swanctl.conf.
  * The timeout of leases in pools configured via pool utility may be configured in other
    units than hours.
    INITIAL_CONTACT notifies are now only omitted if never is configured as uniqueness policy.
  * Outbound FWD policies for shunts are not installed anymore, by default (as is the case
    for other policies since 5.5.1).
  * Don't consider a DH group mismatch during CHILD_SA rekeying as failure as responder
    (e7276f78aa).
  * Handling of fragmented IPv4 and IPv6 packets in libipsec has been improved (e138003de9).
  * Trigger expire events for the correct IPsec SA in libipsec (6e861947a0).
  * A crash in CRL verification via openssl plugin using OpenSSL 1.1 has been fixed (78acaba6a1).
  * No hard-coded default proposals are passed from starter to the stroke plugin anymore (the
    IKE proposal used curve25519 since 5.5.2, which is an optional plugin).
  * A workaround for an issue with virtual IPs on macOS 10.13 (High Sierra) has been added
    (039b85dd43).
  * Handling of IKE_SA rekey collisions in charon-tkm has been fixed.
  * Instead of failing or just silently doing nothing unit tests may now warn about certain
    conditions (e.g. if a test was not executed due to external dependencies).</changelog>
  <changelog author="mmnelemane@suse.com" date="1585224000">- Fix for to resolve multiple definition of swanctl_dir (bsc #1164493)
  [+ 0006-Resolve-multiple-definition-of-swanctl_dir.patch]</changelog>
  <changelog author="mbuil@suse.com" date="1610712000">- Fix typo in README (bsc #1167880)
  [+ 0007-Fix-typo-in-README.patch ]</changelog>
  <changelog author="mbuil@suse.com" date="1611576000">- Fix FIPS bug (bsc #1180801)
  [+ 0008-gcrypt-Use-a-dummy-buffer-to-initialize-static-alloc.patch ]</changelog>
  <changelog author="mbuil@suse.com" date="1617019200">- Keep using ipsec as the main binary. Therefore, make strongswan.service point to it instead of swanctl</changelog>
  <changelog author="mbuil@suse.com" date="1617019201">- Information added in README about the rcstrongswan-starter</changelog>
  <changelog author="mbuil@suse.com" date="1617624000">- Add config to run ipsec on namespaces (bsc #1183670)</changelog>
  <changelog author="mt@suse.com" date="1619006400">- Add support for AES CCM aead algorithms to openssl plugin (cc/fips,bsc#1185363)
  [+ 0009-strongswan-openssl-aead-add-ccm-support.patch]</changelog>
  <changelog author="mt@suse.com" date="1620388800">- Replace AEAD AES CCM patch with upstream variant (cc/fips,bsc#1185363)
  [* 0009-strongswan-openssl-aead-add-ccm-support.patch]</changelog>
  <changelog author="hare@suse.de" date="1627646400">- Add auth_els plugin to support Marvell FC-SP encryption (jsc#SLE-20151)
  [* strongswan-marvell-auth-els.patch]</changelog>
  <changelog author="abergmann@suse.com" date="1634040000">- Fix integer overflow in gmp plugin (bsc#1191367, CVE-2021-41990)
  [* strongswan-5.6.1-5.9.3_gmp-rsa-ssa-salt-len.patch]
- Fix integer overflow when replacing certificates in cache (bsc#1191435, CVE-2021-41991)
  [* strongswan-4.4.1-5.9.3_cert-cache-random.patch]</changelog>
  <changelog author="meissner@suse.com" date="1643025600">- strongswan-5.5.0-5.9.4_eap_success-CVE-2021-45079.patch:
  Fixed authentication bypass in EAP authentication (CVE-2021-45079
  bsc#1194471)</changelog>
</package>
<package pkgid="82ce51caa8d4e92dda8da0ef475911a14a1bbad5186cf5367743d4a319e9a963" name="strongswan-mysql" arch="aarch64">
  <version epoch="0" ver="5.8.2" rel="11.24.1"/>
  <changelog author="ndas@suse.de" date="1501502400">- Updated to strongSwan 5.3.5(bsc#1050691) providing the following changes:
  * Fixed a DoS vulnerability in the gmp plugin that was caused by insufficient input
    validation when verifying RSA signatures. More specifically, mpz_powm_sec() has two
    requirements regarding the passed exponent and modulus that the plugin did not
    enforce, if these are not met the calculation will result in a floating point exception
    that crashes the whole process.
    This vulnerability has been registered as CVE-2017-9022.
    Please refer to our blog for details.
  * Fixed a DoS vulnerability in the x509 plugin that was caused because the ASN.1 parser
    didn't handle ASN.1 CHOICE types properly, which could result in an infinite loop when
    parsing X.509 extensions that use such types.
    This vulnerability has been registered as CVE-2017-9023.
    Please refer to our blog for details.
  * The behavior during IKEv2 CHILD_SA rekeying has been changed in order to avoid
    traffic loss. When responding to a CREATE_CHILD_SA request to rekey a CHILD_SA
    the responder already has everything available to install and use the new CHILD_SA.
    However, this could lead to lost traffic as the initiator won't be able to process
    inbound packets until it processed the CREATE_CHILD_SA response and updated the
    inbound SA. To avoid this the responder now only installs the new inbound SA and
    delays installing the outbound SA until it receives the DELETE for the replaced CHILD_SA.
  * The messages transporting these DELETEs could reach the peer before packets sent
    with the deleted outbound SAs reach it. To reduce the chance of traffic loss due
    to this the inbound SA of the replaced CHILD_SA is not removed for a configurable
    amount of seconds (charon.delete_rekeyed_delay) after the DELETE has been processed.
  * The code base has been ported to Apple's ARM64 iOS platform, which required several
    changes regarding the use of variadic functions. This was necessary because the calling
    conventions for variadic and regular functions are different there.
    This means that assigning a non-variadic function to a variadic function pointer, as we
    did with our enumerator_t::enumerate() implementations and several callbacks, will
    result in crashes as the called function accesses the arguments differently than the
    caller provided them. To avoid this issue the enumerator_t interface has been changed
    and the signature of the callback functions for enumerator_create_filter() and two
    methods on linked_list_t have been changed. Refer to the developer notes below
    for details.
  * Adds support for fuzzing the certificate parser provided by the default plugins
    (x509, pem, gmp etc.) on Google's OSS-Fuzz infrastructure (or generally with
    libFuzzer). Several issues found while fuzzing these plugins were fixed.
  * Two new options have been added to charon's retransmission settings:
    retransmit_limit and retransmit_jitter. The former adds an upper limit to the
    calculated retransmission timeout, the latter randomly reduces it.
    Refer to Retransmission for details.
  * A bug in swanctl's --load-creds command was fixed that caused unencrypted
    private keys to get unloaded if the command was called multiple times.
    The load-key VICI command now returns the key ID of the loaded key on success.
  * The credential manager now enumerates local credential sets before global ones.
    This means certificates supplied by the peer will now be preferred over certificates
    with the same identity that may be locally stored (e.g. in the certificate cache).
  * Adds support for hardware offload of IPsec SAs as introduced by Linux 4.11 for
    specific hardware that supports this.
  * The pki tool loads the curve25519 plugin by default.
    [- 0006-Make-sure-the-modulus-is-odd-and-the-exponent-not-zero.patch,
  - 0007-asn1-parser-Fix-CHOICE-parsing.patch]
- libhydra is removed as all kernel plugins moved to libcharon</changelog>
  <changelog author="ndas@suse.de" date="1504612800">- fix "uintptr_t? undeclared" compilation error.
  [+0006-fix-compilation-error-by-adding-stdint.h.patch]</changelog>
  <changelog author="ndas@suse.de" date="1504612801">- Updated to strongSwan 5.6.0 providing the following changes:
  * Fixed a DoS vulnerability in the gmp plugin that was caused by insufficient input validation
    when verifying RSA signatures, which requires decryption with the operation m^e mod n,
    where m is the signature, and e and n are the exponent and modulus of the public key.
    The value m is an integer between 0 and n-1, however, the gmp plugin did not verify this.
    So if m equals n the calculation results in 0, in which case mpz_export() returns NULL.
    This result wasn't handled properly causing a null-pointer dereference.
    This vulnerability has been registered as CVE-2017-11185. (bsc#1051222)
  * New SWIMA IMC/IMV pair implements the draft-ietf-sacm-nea-swima-patnc Internet
    Draft and has been demonstrated at the IETF 99 Prague Hackathon.
  * The IMV database template has been adapted to achieve full compliance with the
    ISO 19770-2:2015 SWID tag standard.
  * The pt-tls-client can attach and use TPM 2.0 protected private keys via the --keyid parameter.
  * By default the /etc/swanctl/conf.d directory is created and *.conf files in it are included in the default
    swanctl.conf file.
  * The curl plugin now follows HTTP redirects (configurable via strongswan.conf).
  * The CHILD_SA rekeying was fixed in charon-tkm and the behavior is refined a bit more since 5.5.3
  * libtpmtss supports Intel's TSS2 Architecture Broker and Resource Manager interface (tcti-tabrmd).
  * more on https://wiki.strongswan.org/versions/66</changelog>
  <changelog author="mmnelemane@suse.com" date="1521028800">- Removed unused requires and macro calls(bsc#1083261)</changelog>
  <changelog author="mmnelemane@suse.com" date="1573646400">- Added patch to fix vulnerability: CVE-2018-16151,CVE-2018-16152 (bsc#1107874)
  - Insufficient input validation in gmp plugin
  [+ 0007-strongswan-5.3.1-5.6.0_gmp-pkcs1-verify.patch]</changelog>
  <changelog author="mmnelemane@suse.com" date="1573646401">- Added patch to fix vulnerability: CVE-2018-5388 (bsc#1094462)
  - Buffer Underflow in stroke_socket.c
  [+ 0008-strongswan-5.1.2-5.6.2_stroke_msg_len.patch]</changelog>
  <changelog author="mmnelemane@suse.com" date="1573646402">- Added patch to fix vulnerability: CVE-2018-10811 (bsc#1093536)
  - denial-of-service vulnerability
  [+ 0009-strongswan-5.5.0-5.6.2_skeyseed_init.patch]</changelog>
  <changelog author="mmnelemane@suse.com" date="1573732800">- Added patch to fix vulnerability: CVE-2018-17540 (bsc#1109845)
  [+ 0010-strongswan-4.4.0-5.7.0_gmp-pkcs1-overflow.patch]</changelog>
  <changelog author="mmnelemane@suse.com" date="1580212800">- Updated to version 5.8.2 (jsc#SLE-11370)
  - Dropped following patches due to irrelevance in the updated version:
    [- strongswan_modprobe_syslog.patch ]
    [- strongswan_fipsfilter.patch ]
    [- 0006-fix-compilation-error-by-adding-stdint.h.patch ]
    [- 0007-strongswan-5.3.1-5.6.0_gmp-pkcs1-verify.patch ]
    [- 0008-strongswan-5.1.2-5.6.2_stroke_msg_len.patch ]
    [- 0009-strongswan-5.5.0-5.6.2_skeyseed_init.patch ]
    [- 0010-strongswan-4.4.0-5.7.0_gmp-pkcs1-overflow.patch ]
  - Version 5.8.2
  ===============
  * Identity-based CA constraints, which enforce that the certificate chain of the remote
    peer contains a CA certificate with a specific identity, are supported via
    vici/swanctl.conf. This is similar to the existing CA constraints but doesn't require
    that the CA certificate is locally installed, for instance, intermediate CA certificates
    received from the peers. Wildcard identity matching (e.g. ..., OU=Research, CN=*) could
    also be used for the latter but requires trust in the intermediate CAs to only issue
    certificates with legitimate subject DNs (e.g. the "Sales" CA must not issue certificates
    with OU=Research). With the new constraint that's not necessary as long as a path length
    basic constraint (--pathlen for pki --issue) prevents intermediate CAs from issuing further
    intermediate CAs.
  * Intermediate CA certificates may now be sent in hash-and-URL encoding by configuring a
    base URL for the parent CA (#3234, swanctl/rw-hash-and-url-multi-level).
  * Implemented NIST SP-800-90A Deterministic Random Bit Generator (DRBG) based on AES-CTR
    and SHA2-HMAC modes. Currently used by the gmp and ntru plugins.
  * Random nonces sent in an OCSP requests are now expected in the corresponding OCSP responses.
  * The kernel-netlink plugin now ignores deprecated IPv6 addresses for MOBIKE. Whether temporary
    or permanent IPv6 addresses are included now depends on the charon.prefer_temporary_addrs
    setting (#3192).
  * Extended Sequence Numbers (ESN) are configured via PF_KEY if supported by the kernel.
  * The PF_KEY socket's receive buffer in the kernel-pfkey plugin is now cleared before sending
    requests, as many of the messages sent by the kernel are sent as broadcasts to all PF_KEY
    sockets. This is an issue if an external tool is used to manage SAs/policies unrelated to
    IPsec (#3225).
  * The vici plugin now uses unique section names for CHILD_SAs in child-updown events (7c74ce9190).
  * For individually deleted CHILD_SAs (in particular for IKEv1) the vici child-updown event
    now includes more information about the CHILD_SAs such as traffic statistics (#3198).
  * Custom loggers are correctly re-registered if log levels are changed via stroke loglevel (#3182).
  * Avoid lockups during startup on low entropy systems when using OpenSSL 1.1.1 (095a2c2eac).
  * Instead of failing later when setting a key, creating HMACs via openssl plugin now fails
    instantly if the underlying hash algorithm isn't supported (e.g. MD5 in FIPS-mode) so fallbacks
    to other plugins work properly (#3284).
  * Exponents of RSA keys read from TPM 2.0 via SAPI are correctly converted (8ee1242f1438).
  * Routing table IDs &gt; 255 are supported for custom routes on Linux.
  * To avoid races, the check for hardware offloading support in the kernel-netlink plugin is
    performed during initialization of the plugin (a605452c03).
  * The D-Bus config file for charon-nm is now installed in $(datadir)/dbus-1/system.d instead of
    $(sysconfdir)/dbus-1/system.d, which is intended for sysadmin overrides.
    INVALID_MAJOR_VERSION notifies are now correctly sent in messages of the same exchange type
    and with the same message ID as the request.
  * IKEv2 SAs are now immediately destroyed when sending or receiving INVALID_SYNTAX notifies
    in authenticated messages.
  * For developers working from the repository the configure script now aborts if GNU gperf is
    not found.
  - Version 5.8.1
  ===============
  * RDNs in DNs of X.509 certificates can now optionally be matched less strict. The global
    strongswan.conf option charon.rdn_matching takes two alternative values that cause the
    matching algorithm to either ignore the order of matched RDNs (reordered) or additionally
    (relaxed) accept DNs that contain more RDNs than configured (unmatched RDNs are treated
    like wildcard matches).
  * The updown plugin now passes the same interface to the script that is also used for the
    automatically installed routes, that is, the interface over which the peer is reached
    instead of the interface on which the local address is found (#3095).
  * TPM 2.0 contexts are now protected by a mutex to prevent issues if multiple IKE_SAs use
    the same private key concurrently (4b25885025).
  * Do a rekey check after the third QM message was received (#3060).
  * If available, explicit_bzero() is now used as memwipe() instead of our own implementation.
  * An .editorconfig file has been added, mainly so Github shows files with proper indentation
    (68346b6962).
  * The internal certificate of the load-tester plugin has been modified so it can again be
    used as end-entity cert with 5.6.3 and later (#3139).
  * The maximum data length of received COOKIE notifies (64 bytes) is now enforced (#3160).
  - Version 5.8.0
  ===============
  * The systemd service units have been renamed. The modern unit, which was called
    strongswan-swanctl, is now called strongswan (the previous name is configured as alias in
    the unit, for which a symlink is created when the unit is enabled). The legacy unit is now
    called strongswan-starter.
  * Support for XFRM interfaces (available since Linux 4.19) has been added, which are intended
    to replace VTI devices (they are similar but offer several advantages, for instance, they
    are not bound to an address or address family).
  * IPsec SAs and policies are associated with such interfaces via interface IDs that can be
    configured in swanctl.conf (dynamic IDs may optionally be allocated for each SA and even
    direction). It's possible to use separate interfaces for in- and outbound traffic (or
    only use an interface in one direction and regular policies in the other).
  * Interfaces may be created dynamically via updown/vici scripts, or statically before or after
    establishing the SAs. Routes must be added manually as needed (the daemon will not install
    any routes for outbound policies with an interface ID).
  * When moving XFRM interfaces to other network namespaces they retain access to the SAs and
    policies installed in the original namespace, which allows providing IPsec tunnels for
    processes in other network namespaces without giving them access to the IPsec keys or
    IKE credentials.
    More information can be found on the page about route-based VPNs.
  * Initiation of childless IKE_SAs is supported (RFC 6023). If enabled and supported by the
    responder, no CHILD_SA is established during IKE_AUTH. Instead, all CHILD_SAs are created
    with CREATE_CHILD_SA exchanges. This allows using a separate DH exchange even for the
    first CHILD_SA, which is otherwise created during IKE_AUTH with keys derived from the
    IKE_SA's key material.
  * The swanctl --initiate command may be used to initiate only the IKE_SA via --ike
    option if --child is omitted and the peer supports this extension.
  * The NetworkManager backend and plugin support IPv6.
  * The new wolfssl plugin is a wrapper around the wolfSSL crypto library. Thanks to Sean
    Parkinson of wolfSSL Inc. for the initial patch.
  * IKE SPIs may optionally be labeled via the charon.spi_mask|label options in
    strongswan.conf. This feature was extracted from charon-tkm, however, now applies the
    mask/label in network order.
  * The openssl plugin supports ChaCha20-Poly1305 when built with OpenSSL 1.1.0.
  * The PB-TNC finite state machine according to section 3.2 of RFC 5793 was not correctly
    implemented when sending either a CRETRY or SRETRY batch. These batches can only be sent
    in the "Decided" state and a CRETRY batch can immediately carry all messages usually
    transported by a CDATA batch. It is currently not possible to send a SRETRY batch since
    full-duplex mode for PT-TLS transport is not supported.
  * Instead of marking IPv6 virtual IPs as deprecated, the kernel-netlink plugin now uses
    address labels to avoid that such addresses are used for non-VPN traffic (00a953d090).
  * The agent plugin now creates sockets to the ssh/gpg-agent dynamically and does not keep
    them open, which otherwise might prevent the agent from getting terminated.
  * To avoid broadcast loops the forecast plugin now only reinjects packets that are marked
    or received from the configured interface.
  * UTF-8 encoded passwords are supported via EAP-MSCHAPv2, which internally uses an UTF-16LE
    encoding to calculate the NT hash (#3014).
  * Properly delete temporary drop policies (used when updating IP addresses of SAs) if manual
    priorities are used, which was broken since 5.6.2 (8e31d65730).
  * Avoid overwriting start_action when parsing the inactivity timeout in the vici plugin (#2954).
  * Fixed the automatic termination of reloaded vici connections with start_action=start,
    which was broken since 5.6.3 (71b22c250f).
  * The lookup for shared secrets for IKEv1 SAs via sql plugin should now work better
    (6ec9f68f32).
  * Fixed a race condition in the trap manager between installation and removal of a policy
    (69cbe2ca3f).
  * Compilation of the kernel-netlink plugin has been fixed on old kernels (&lt; 2.6.39), which
    was caused by the HW offload changes (c7f579fa17).
  * The IPsec stack detection and module loading in starter has been removed (it wasn't
    enforced anyway and loading modules doesn't seem necessary, also KLIPS hasn't been
    supported for a long time and PF_KEY will eventually be removed from the Linux kernel,
    ba817d2917).
  * Several IKEv2 protocol details are now handled more strictly: Unrequested virtual IPs are
    ignored, CFG_REPLY payloads are ignored if no CFG_REQUEST payloads were sent, a USE
    TRANSPORT_MODE notify received from the responder is checked against the local configuration.
  * The keys and certificates used by the scenarios in the testing environment are now generated
    dynamically. Running the testing/scripts/build-certs script after creating the base and root
    images uses the pki utility installed in the latter to create the keys and certificates for
    all the CAs and in some cases for individual scenarios. These credentials are stored in the
    source tree, not the image, so this has to be called only once even if the images are later
    rebuilt. The script automatically (re-)rebuilds the guest images as that generates fresh
    CRLs and signs the DNS zones. The only keys/certificates currently not generated are the
    very large ones used by the ikev2/rw-eap-tls-fragments scenario.
  - Version 5.7.2
  ===============
  * For RSA with PSS padding, the TPM 2.0 specification mandates the maximum salt length
    (as defined by the length of the key and hash). However, if the TPM is FIPS-168-4 compliant,
    the salt length equals the hash length. This is assumed for FIPS-140-2 compliant TPMs, but
    if that's not the case, it might be necessary to manually enable charon.plugins.tpm.fips_186_4
    if the TPM doesn't use the maximum salt length.
  * Directories for credentials loaded by swanctl are now accessed relative to the loaded
    swanctl.conf file, in particular, when loading it from a custom location via --file argument.
  * The base directory, which is used if no custom location for swanctl.conf is specified, is now
    also configurable at runtime via SWANCTL_DIR environment variable.
  * If RADIUS Accounting is enabled, the eap-radius plugin will add the session ID (Acct-Session-Id)
    to Access-Request messages, which e.g. simplifies associating database entries for IP leases and
    accounting with sessions (the session ID does not change when IKE_SAs are rekeyed, #2853).
  * All IP addresses assigned by a RADIUS server are included in Accounting-Stop messages even if
    the client did not claim them, allowing to release them early in case of connection errors (#2856).
  * Selectors installed on transport mode SAs by the kernel-netlink plugin are now updated if an
    IP address changes (e.g. via MOBIKE) and it was part of the selectors.
  * No deletes are sent anymore when a rekeyed CHILD_SA expires (#2815).
  * The bypass-lan plugin now tracks interfaces to handle subnets that move from one interface
    to another and properly update associated routes (#2820).
  * Only valid and expected inbound IKEv2 messages are used to update the timestamp of the
    last received message (previously, retransmits also triggered an update).
  * IKEv2 requests from responders are now ignored until the IKE_SA is fully established (e.g. if a
    DPD request from the peer arrives before the IKE_AUTH response does, 46bea1add9).
    Delayed IKE_SA_INIT responses with COOKIE notifies we already recevied are ignored, they caused
    another reset of the IKE_SA previously (#2837).
  * Active and queued Quick Mode tasks are now adopted if the peer reauthenticates an IKEv1 SA
    while creating lots of CHILD_SAs.
  * Newer versions of the FreeBSD kernel add an SADB_X_EXT_SA2 extension to SADB_ACQUIRE
    messages, which allows the kernel-pfkey plugin to determine the reqid of the policy even if it
    wasn't installed by the daemon previously (e.g. when using FreeBSD's if_ipsec(4) VTIs, which
    install policies themselves, 872b9b3e8d).
  * Added support for RSA signatures with SHA-256 and SHA-512 to the agent plugin. For older
    versions of ssh/gpg-agent that only support SHA-1, IKEv2 signature authentication has to be
    disabled via charon.signature_authentication.
  * The sshkey and agent plugins support Ed25519/Ed448 SSH keys and signatures.
  * The openssl plugin supports X25519/X448 Diffie-Hellman and Ed25519/Ed448 keys and
    signatures when built against OpenSSL 1.1.1.
  * Support for Ed25519, ChaCha20/Poly1305, SHA-3 and AES-CCM were added to the botan plugin.
  * The mysql plugin now properly handles database connections with transactions
    under heavy load (#2779).
  * IP addresses in ha pools are now distributed evenly among all segments (#2828).
  * Private key implementations may optionally provide a list of supported signature schemes,
    which, as described above, is used by the tpm plugin because for each key on a TPM 2.0 the
    hash algorithm and for RSA also the padding scheme is predefined.
  * The testing environment is now based on Debian 9 (stretch) by default. This required
    some changes, in particular, updating to FreeRADIUS 3.x (which forced us to abandon the
    TNC@FHH patches and scenarios, 2fbe44bef3) and removing FIPS-enabled versions of
    OpenSSL (the FIPS module only supports OpenSSL 1.0.2).
  * Most test scenarios were migrated to swanctl.
  - Version 5.7.1
  ===============
  * Fixes a vulnerability in the gmp plugin triggered by crafted certificates with RSA keys with
    very small moduli. When verifying signatures with such keys, the code patched with the fix
    for CVE-2018-16151/2 caused an integer underflow and subsequent heap buffer overflow
    that results in a crash of the daemon.
  * The vulnerability has been registered as CVE-2018-17540.
  - Version 5.7.0
  ===============
  * Fixes a potential authorization bypass vulnerability in the gmp plugin that was caused by a
    too lenient verification of PKCS#1 v1.5 signatures. Several flaws could be exploited by a
    Bleichenbacher-style attack to forge signatures for low-exponent keys (i.e. with e=3).
  * CVE-2018-16151 has been assigned to the problem of accepting random bytes after the OID
    of the hash function in such signatures, and CVE-2018-16152 has been assigned to the issue
    of not verifying that the parameters in the ASN.1 algorithmIdentitifer structure is empty.
    Other flaws that don't lead to a vulnerability directly (e.g. not checking for at least
    8 bytes of padding) have no separate CVE assigned.
  * Dots are not allowed anymore in section names in swanctl.conf and strongswan.conf.
    This mainly affects the configuration of file loggers. If the path for such a log file
    contains dots it now has to be configured in the new path setting within the arbitrarily
    renamed subsection in the filelog section.
  * Sections in swanctl.conf and strongswan.conf may now reference other sections. All settings
    and subsections from such a section are inherited. This allows to simplify configs as
    redundant information has only to be specified once and may then be included in other
    sections (see strongswan.conf for an example).
  * The originally selected IKE config (based on the IPs and IKE version) can now change
    if no matching algorithm proposal is found. This way the order of the configs doesn't
    matter that much anymore and it's easily possible to specify separate configs for
    clients that require weaker algorithms (instead of having to also add them in other
    configs that might be selected).
  * Support for Postquantum Preshared Keys for IKEv2 (draft-ietf-ipsecme-qr-ikev2) has been added.
    For an example refer to the swanctl/rw-cert-ppk scenario (or with EAP, or PSK authentication).
  * The new botan plugin is a wrapper around the Botan C++ crypto library.
    It requires a fairly recent build from Botan's master branch (or the upcoming 2.8.0 release).
    Thanks to René Korthaus and his team from Rohde &amp; Schwarz Cybersecurity for the initial
    patch and to Jack Lloyd for quickly adding missing functions to Botan's FFI (C89) interface.
  * Implementation of RFC 8412 "Software Inventory Message and Attributes (SWIMA) for PA-TNC".
  * SWIMA subscription option sets CLOSE_WRITE trigger on apt history.log file resulting in
    a ClientRetry PB-TNC batch to initialize a new measurement cycle. The new imv/imc-swima
    plugins replace the previous imv/imc-swid plugins, which were removed.
  * Added support for fuzzing the PA-TNC (RFC 5792) and PB-TNC (RFC 5793) NEA protocols
    on Google's OSS-Fuzz infrastructure.
  * Support for version 2 of Intel's TPM2-TSS TGC Software Stack. The presence of the
    in-kernel /dev/tpmrm0 resource manager is automatically detected.
  * The pki tool accepts a xmppAddr otherName as a subjectAlternativeName using the
    syntax --san xmppaddr:&lt;jid&gt;.
  * swanctl.conf supports the configuration of marks the in- and/or outbound SA should apply
    to packets after processing on Linux. Configuring such a mark for outbound SAs requires
    at least a 4.14 kernel. The ability to set a mask and configuring a mark/mask for
    inbound SAs will be added with the upcoming 4.19 kernel.
  * New options in swanctl.conf allow configuring how/whether DF, ECN and DS fields in the
    IP headers are copied during IPsec processing. Controlling this is currently only possible
    on Linux.
  * The handling of sequence numbers in IKEv1 DPDs has been improved (#2714).
  * To avoid conflicts, the dhcp plugin now only uses the DHCP server port if explicitly
    configured.
  - Version 5.6.3
  ===============
  * Fixed a DoS vulnerability in the IKEv2 key derivation if the openssl plugin is used in FIPS
    mode and HMAC-MD5 is negotiated as PRF.
    This vulnerability has been registered as CVE-2018-10811.
  * Fixed a vulnerability in the stroke plugin, which did not check the received length before
    reading a message from the socket. Unless a group is configured, root privileges are
    required to access that socket, so in the default configuration this shouldn't be an issue.
    This vulnerability has been registered as CVE-2018-5388.
  * CRLs that are not yet valid are now ignored to avoid problems in scenarios where expired
    certificates are removed from new CRLs and the clock on the host doing the revocation
    check is trailing behind that of the host issuing CRLs. Not doing this could result in
    accepting a revoked and expired certificate, if it's still valid according to the
    trailing clock but not contained anymore in not yet valid CRLs.
  * The issuer of fetched CRLs is now compared to the issuer of the checked certificate (#2608).
  * CRL validation results other than revocation (e.g. a skipped check because the CRL couldn't
    be fetched) are now stored also for intermediate CA certificates and not only for end-entity
    certificates, so a strict CRL policy can be enforced in such cases.
  * In compliance with RFC 4945, section 5.1.3.2, certificates used for IKE must now either
    not contain a keyUsage extension (like the ones generated by pki), or have at least one of the
    digitalSignature or nonRepudiation bits set.
  * New options for vici/swanctl allow forcing the local termination of an IKE_SA. This might be
    useful in situations where it's known the other end is not reachable anymore, or that it
    already removed the IKE_SA, so retransmitting a DELETE and waiting for a response would
    be pointless.
  * Waiting only a certain amount of time for a response (i.e. shorter than all retransmits
    would be) before destroying the IKE_SA is also possible by additionally specifying a
    timeout in the forced termination request.
  * When removing routes, the kernel-netlink plugin now checks if it tracks other routes for
    the same destination and replaces the installed route instead of just removing it. Same
    during installation, where existing routes previously weren't replaced. This should allow
    using traps with virtual IPs on Linux (#2162).
  * The dhcp plugin now only sends the client identifier DHCP option if the identity_lease
    setting is enabled (7b660944b6). It can also send identities of up to 255 bytes length,
    instead of the previous 64 bytes (30e886fe3b, 0e5b94d038). If a server address is
    configured, DHCP requests are now sent from port 67 instead of 68 to avoid ICMP port
    unreachables (becf027cd9).
  * The handling of faulty INVALID_KE_PAYLOAD notifies (e.g. one containing a DH group
    that wasn't proposed) during CREATE_CHILD_SA exchanges has been improved (#2536).
  * Roam events are now completely ignored for IKEv1 SAs (there is no MOBIKE to handle such
    changes properly).
  * ChaCha20/Poly1305 is now correctly proposed without key length (#2614). For compatibility with
    older releases the chacha20poly1305compat keyword may be included in proposals to also propose
    the algorithm with a key length (c58434aeff).
  * Configuration of hardware offload of IPsec SAs is now more flexible and allows a new
    setting (auto), which automatically uses it if the kernel and device both support it. If hw
    offload is set to yes and offloading is not supported, the CHILD_SA installation now fails.
  * The kernel-pfkey plugin optionally installs routes via internal interface (one with an IP
    in the local traffic selector). On FreeBSD, enabling this selects the correct source IP
    when sending packets from the gateway itself (e811659323).
  * SHA-2 based PRFs are supported in PKCS#8 files as generated by OpenSSL 1.1 (#2574).
  * The pki --verify tool may load CA certificates and CRLs from directories.
  * The IKE daemon now also switches to port 4500 if the remote port is not 500 (e.g. because the
    remote maps the response to a different port, as might happen on Azure), as long as the local
    port is 500 (85bfab621d).
  * Fixed an issue with DNS servers passed to NetworkManager in charon-nm (ee8c25516a).
  * Logged traffic selectors now always contain the protocol if either protocol or port are set
    (a36d8097ed).
  * Only the inbound SA/policy will be updated as reaction to IP address changes for rekeyed
    CHILD_SAs that are kept around.
  * The parser for strongswan.conf/swanctl.conf now accepts = characters in values without
    having to put the value in quotes (e.g. for Base64 encoded shared secrets).
    Notes for developers:
  * trap_manager_t: Trap policies are now unistalled by peer/child name and not the reqid.
  * No reqid is returned anymore when installing trap policies.
  * child_sa_t: A new state (CHILD_DELETED) is used for CHILD_SAs that have been deleted but
    not yet destroyed (after a rekeying CHILD_SAs are kept around for a while to process
    delayed packets).
    This way child_updown events are not triggered anymore for such SAs when an IKE_SA that
    has such CHILD_SAs assigned is deleted.
  - Version 5.6.2
  ===============
  * Fixed a DoS vulnerability in the parser for PKCS#1 RSASSA-PSS signatures that was caused
    by insufficient input validation. One of the configurable parameters in algorithm identifier
    structures for RSASSA-PSS signatures is the mask generation function (MGF). Only MGF1 is
    currently specified for this purpose. However, this in turn takes itself a parameter that
    specifies the underlying hash function. strongSwan's parser did not correctly handle the
    case of this parameter being absent, causing an undefined data read.
    This vulnerability has been registered as CVE-2018-6459.
  * When rekeying IKEv2 IKE_SAs the previously negotiated DH group will be reused, instead of
    using the first configured group, which avoids an additional exchange if the peer previously
    selected a different DH group via INVALID_KE_PAYLOAD notify. The same is also done when
    rekeying CHILD_SAs except for the first rekeying of the CHILD_SA that was created with the
    IKE_SA, where no DH group was negotiated yet.
    Also, the selected DH group is moved to the front in all sent proposals that contain it
    and all proposals that don't are moved to the back in order to convey the preference for
    this group to the peer.
  * Handling of MOBIKE task queuing has been improved. In particular, the response to an
    address update (with NAT-D payloads) is not ignored anymore if only an address list update
    or DPD is queued as that could prevent updating the UDP encapsulation in the kernel.
  * On Linux, roam events may optionally be triggered by changes to the routing rules, which
    can be useful if routing rules (instead of e.g. route metrics) are used to switch from one
    to another interface (i.e. from one to another routing table). Since routing rules are
    currently not evaluated when doing route lookups this is only useful if the kernel-based
    route lookup is used (4664992f7d).
  * The fallback drop policies installed to avoid traffic leaks when replacing addresses in
    installed policies are now replaced by temporary drop policies, which also prevent
    acquires because we currently delete and reinstall IPsec SAs to update their addresses
    (35ef1b032d).
  * Access X.509 certificates held in non-volatile storage of a TPM 2.0 referenced via the
    NV index.
    Adding the --keyid parameter to pki --print allows to print private keys or certificates
    stored in a smartcard or a TPM 2.0.
  * Fixed proposal selection if a peer incorrectly sends DH groups in the ESP proposal during
    IKE_AUTH and also if a DH group is configured in the local ESP proposal and charon.prefer
    configured_proposals is disabled (d058fd3c32).
  * The lookup for PSK secrets for IKEv1 has been improved for certain scenarios (see #2497
    for details).
  * MSKs received via RADIUS are now padded to 64 bytes to avoid compatibility issues with
    EAP-MSCHAPv2 and PRFs that have a block size &lt; 64 bytes (e.g. AES-XCBC-PRF-128, see
    73cbce6013).
  * The tpm_extendpcr command line tool extends a digest into a TPM PCR.
  * Ported the NetworkManager backend from the deprecated libnm-glib to libnm.
  * The save-keys debugging/development plugin saves IKE and/or ESP keys to files compatible
    with Wireshark.
  - Version 5.6.1
  ===============
  * Several algorithms were removed from the default ESP/AH and IKE proposals in compliance with
    RFC 8221 and RFC 8247, respectively. Removed from the default ESP/AH proposal were the
    3DES and Blowfish encryption algorithms and the HMAC-MD5 integrity algorithm. From the IKE
    default proposal the HMAC-MD5 integrity algorithm and the MODP-1024 Diffie-Hellman group
    were removed (the latter is significant for Windows clients in their default configuration).
    These algorithms may still be used in custom proposals.
  * Support for RSASSA-PSS signatures has been added. For compatibility with previous
    releases they are currently not used automatically, by default, to change that charon.rsa_pss
    may be enabled. To explicitly use or require such signatures during IKEv2 signature
    authentication (RFC 7427) ike:rsa/pss... authentication constraints may be used for specific
    connections (regardless of whether the strongswan.conf option above is enabled). Only the
    hash algorithm can be specified in such constraints, the MGF1 will be based on that hash
    and the salt length will equal the hash length (when verifying the salt length is not
    enforced).
    To enforce such signatures during PKI verification use rsa/pss... authentication constraints.
  * All pki commands that create certificates/CRLs can be made to sign with RSASSA-PSS instead
    of the classing PKCS#1 scheme with the --rsa-padding pss option. As with signatures during
    authentication, only the hash algorithm is configurable (via --digest option), the MGF1 will
    be based on that and the salt length will equal the hash length.
  * These signatures are supported by all RSA backends except pkcs11 (i.e. gmp, gcrypt, openssl).
    The gmp plugin requires the mgf1 plugin.
    Note that RSASSA-PSS algorithm identifiers and parameters in keys (public keys in
    certificates or private keys in PKCS#8 files) are currently not used as constraints.
  * The sec-updater tool checks for security updates in dpkg-based repositories
    (e.g. Debian/Ubuntu) and sets the security flags in the IMV policy database accordingly.
    Additionally for each new package version a SWID tag for the given OS and HW architecture
    is created and stored in the database.
  * Using the sec-updater.sh script template the lookup can be automated (e.g. via an hourly
    cron job).
  * When restarting an IKEv2 negotiation after receiving an INVALID_KE_PAYLOAD notify (or due
    to other reasons like too many retransmits) a new initiator SPI is allocated. This
    prevents issues caused by retransmits for IKE_SA_INIT messages.
  * Because the initiator SPI was previously reused when restarting the connection delayed
    responses for previous connection attempts were processed and might have caused fatal
    errors due to a failed DH negotiation or because of the internal retry counter in the
    ike-init task. For instance, if we proposed a DH group the responder rejected we
    might have later received delayed responses that either contained INVALID_KE_PAYLOAD
    notifies with the DH group we already switched to, or, if we retransmitted an
    IKE_SA_INIT with the requested group but then had to restart again, a KE payload with
    a group different from the one we proposed.
  * The introduction of file versions in the IMV database scheme broke file reference hash
    measurements. This has been fixed by creating generic product versions having an empty
    package name.
  * A new timeout option for the systime-fix plugin stops periodic system time checks after
    a while and enforces a certificate verification, closing or reauthenticating all SAs
    with invalid certificates.
  * The IKE event counters, previously only available via ipsec listcounters command, may
    now also be queried and reset via vici and the new swanctl --counters command. They
    are collected and provided by the optional counters plugin (enabled by default for
    backwards compatibility if the stroke plugin is built).
  * Class attributes received in RADIUS Access-Accept messages may optionally be added to
    RADIUS accounting messages (655924074b).
  * Basic support for systemd sockets has been added, which may be used for privilege separation
    (59db98fb94).
  * Inbound marks may optionally be installed in the SA again (was removed with 5.5.2) by
    enabling the mark_in_sa option in swanctl.conf.
  * The timeout of leases in pools configured via pool utility may be configured in other
    units than hours.
    INITIAL_CONTACT notifies are now only omitted if never is configured as uniqueness policy.
  * Outbound FWD policies for shunts are not installed anymore, by default (as is the case
    for other policies since 5.5.1).
  * Don't consider a DH group mismatch during CHILD_SA rekeying as failure as responder
    (e7276f78aa).
  * Handling of fragmented IPv4 and IPv6 packets in libipsec has been improved (e138003de9).
  * Trigger expire events for the correct IPsec SA in libipsec (6e861947a0).
  * A crash in CRL verification via openssl plugin using OpenSSL 1.1 has been fixed (78acaba6a1).
  * No hard-coded default proposals are passed from starter to the stroke plugin anymore (the
    IKE proposal used curve25519 since 5.5.2, which is an optional plugin).
  * A workaround for an issue with virtual IPs on macOS 10.13 (High Sierra) has been added
    (039b85dd43).
  * Handling of IKE_SA rekey collisions in charon-tkm has been fixed.
  * Instead of failing or just silently doing nothing unit tests may now warn about certain
    conditions (e.g. if a test was not executed due to external dependencies).</changelog>
  <changelog author="mmnelemane@suse.com" date="1585224000">- Fix for to resolve multiple definition of swanctl_dir (bsc #1164493)
  [+ 0006-Resolve-multiple-definition-of-swanctl_dir.patch]</changelog>
  <changelog author="mbuil@suse.com" date="1610712000">- Fix typo in README (bsc #1167880)
  [+ 0007-Fix-typo-in-README.patch ]</changelog>
  <changelog author="mbuil@suse.com" date="1611576000">- Fix FIPS bug (bsc #1180801)
  [+ 0008-gcrypt-Use-a-dummy-buffer-to-initialize-static-alloc.patch ]</changelog>
  <changelog author="mbuil@suse.com" date="1617019200">- Keep using ipsec as the main binary. Therefore, make strongswan.service point to it instead of swanctl</changelog>
  <changelog author="mbuil@suse.com" date="1617019201">- Information added in README about the rcstrongswan-starter</changelog>
  <changelog author="mbuil@suse.com" date="1617624000">- Add config to run ipsec on namespaces (bsc #1183670)</changelog>
  <changelog author="mt@suse.com" date="1619006400">- Add support for AES CCM aead algorithms to openssl plugin (cc/fips,bsc#1185363)
  [+ 0009-strongswan-openssl-aead-add-ccm-support.patch]</changelog>
  <changelog author="mt@suse.com" date="1620388800">- Replace AEAD AES CCM patch with upstream variant (cc/fips,bsc#1185363)
  [* 0009-strongswan-openssl-aead-add-ccm-support.patch]</changelog>
  <changelog author="hare@suse.de" date="1627646400">- Add auth_els plugin to support Marvell FC-SP encryption (jsc#SLE-20151)
  [* strongswan-marvell-auth-els.patch]</changelog>
  <changelog author="abergmann@suse.com" date="1634040000">- Fix integer overflow in gmp plugin (bsc#1191367, CVE-2021-41990)
  [* strongswan-5.6.1-5.9.3_gmp-rsa-ssa-salt-len.patch]
- Fix integer overflow when replacing certificates in cache (bsc#1191435, CVE-2021-41991)
  [* strongswan-4.4.1-5.9.3_cert-cache-random.patch]</changelog>
  <changelog author="meissner@suse.com" date="1643025600">- strongswan-5.5.0-5.9.4_eap_success-CVE-2021-45079.patch:
  Fixed authentication bypass in EAP authentication (CVE-2021-45079
  bsc#1194471)</changelog>
</package>
<package pkgid="96b13b51849d401a921bd2397e23a3c18f77e5b260e0309435e4e408a219000e" name="strongswan-mysql" arch="ppc64le">
  <version epoch="0" ver="5.8.2" rel="11.24.1"/>
  <changelog author="ndas@suse.de" date="1501502400">- Updated to strongSwan 5.3.5(bsc#1050691) providing the following changes:
  * Fixed a DoS vulnerability in the gmp plugin that was caused by insufficient input
    validation when verifying RSA signatures. More specifically, mpz_powm_sec() has two
    requirements regarding the passed exponent and modulus that the plugin did not
    enforce, if these are not met the calculation will result in a floating point exception
    that crashes the whole process.
    This vulnerability has been registered as CVE-2017-9022.
    Please refer to our blog for details.
  * Fixed a DoS vulnerability in the x509 plugin that was caused because the ASN.1 parser
    didn't handle ASN.1 CHOICE types properly, which could result in an infinite loop when
    parsing X.509 extensions that use such types.
    This vulnerability has been registered as CVE-2017-9023.
    Please refer to our blog for details.
  * The behavior during IKEv2 CHILD_SA rekeying has been changed in order to avoid
    traffic loss. When responding to a CREATE_CHILD_SA request to rekey a CHILD_SA
    the responder already has everything available to install and use the new CHILD_SA.
    However, this could lead to lost traffic as the initiator won't be able to process
    inbound packets until it processed the CREATE_CHILD_SA response and updated the
    inbound SA. To avoid this the responder now only installs the new inbound SA and
    delays installing the outbound SA until it receives the DELETE for the replaced CHILD_SA.
  * The messages transporting these DELETEs could reach the peer before packets sent
    with the deleted outbound SAs reach it. To reduce the chance of traffic loss due
    to this the inbound SA of the replaced CHILD_SA is not removed for a configurable
    amount of seconds (charon.delete_rekeyed_delay) after the DELETE has been processed.
  * The code base has been ported to Apple's ARM64 iOS platform, which required several
    changes regarding the use of variadic functions. This was necessary because the calling
    conventions for variadic and regular functions are different there.
    This means that assigning a non-variadic function to a variadic function pointer, as we
    did with our enumerator_t::enumerate() implementations and several callbacks, will
    result in crashes as the called function accesses the arguments differently than the
    caller provided them. To avoid this issue the enumerator_t interface has been changed
    and the signature of the callback functions for enumerator_create_filter() and two
    methods on linked_list_t have been changed. Refer to the developer notes below
    for details.
  * Adds support for fuzzing the certificate parser provided by the default plugins
    (x509, pem, gmp etc.) on Google's OSS-Fuzz infrastructure (or generally with
    libFuzzer). Several issues found while fuzzing these plugins were fixed.
  * Two new options have been added to charon's retransmission settings:
    retransmit_limit and retransmit_jitter. The former adds an upper limit to the
    calculated retransmission timeout, the latter randomly reduces it.
    Refer to Retransmission for details.
  * A bug in swanctl's --load-creds command was fixed that caused unencrypted
    private keys to get unloaded if the command was called multiple times.
    The load-key VICI command now returns the key ID of the loaded key on success.
  * The credential manager now enumerates local credential sets before global ones.
    This means certificates supplied by the peer will now be preferred over certificates
    with the same identity that may be locally stored (e.g. in the certificate cache).
  * Adds support for hardware offload of IPsec SAs as introduced by Linux 4.11 for
    specific hardware that supports this.
  * The pki tool loads the curve25519 plugin by default.
    [- 0006-Make-sure-the-modulus-is-odd-and-the-exponent-not-zero.patch,
  - 0007-asn1-parser-Fix-CHOICE-parsing.patch]
- libhydra is removed as all kernel plugins moved to libcharon</changelog>
  <changelog author="ndas@suse.de" date="1504612800">- fix "uintptr_t? undeclared" compilation error.
  [+0006-fix-compilation-error-by-adding-stdint.h.patch]</changelog>
  <changelog author="ndas@suse.de" date="1504612801">- Updated to strongSwan 5.6.0 providing the following changes:
  * Fixed a DoS vulnerability in the gmp plugin that was caused by insufficient input validation
    when verifying RSA signatures, which requires decryption with the operation m^e mod n,
    where m is the signature, and e and n are the exponent and modulus of the public key.
    The value m is an integer between 0 and n-1, however, the gmp plugin did not verify this.
    So if m equals n the calculation results in 0, in which case mpz_export() returns NULL.
    This result wasn't handled properly causing a null-pointer dereference.
    This vulnerability has been registered as CVE-2017-11185. (bsc#1051222)
  * New SWIMA IMC/IMV pair implements the draft-ietf-sacm-nea-swima-patnc Internet
    Draft and has been demonstrated at the IETF 99 Prague Hackathon.
  * The IMV database template has been adapted to achieve full compliance with the
    ISO 19770-2:2015 SWID tag standard.
  * The pt-tls-client can attach and use TPM 2.0 protected private keys via the --keyid parameter.
  * By default the /etc/swanctl/conf.d directory is created and *.conf files in it are included in the default
    swanctl.conf file.
  * The curl plugin now follows HTTP redirects (configurable via strongswan.conf).
  * The CHILD_SA rekeying was fixed in charon-tkm and the behavior is refined a bit more since 5.5.3
  * libtpmtss supports Intel's TSS2 Architecture Broker and Resource Manager interface (tcti-tabrmd).
  * more on https://wiki.strongswan.org/versions/66</changelog>
  <changelog author="mmnelemane@suse.com" date="1521028800">- Removed unused requires and macro calls(bsc#1083261)</changelog>
  <changelog author="mmnelemane@suse.com" date="1573646400">- Added patch to fix vulnerability: CVE-2018-16151,CVE-2018-16152 (bsc#1107874)
  - Insufficient input validation in gmp plugin
  [+ 0007-strongswan-5.3.1-5.6.0_gmp-pkcs1-verify.patch]</changelog>
  <changelog author="mmnelemane@suse.com" date="1573646401">- Added patch to fix vulnerability: CVE-2018-5388 (bsc#1094462)
  - Buffer Underflow in stroke_socket.c
  [+ 0008-strongswan-5.1.2-5.6.2_stroke_msg_len.patch]</changelog>
  <changelog author="mmnelemane@suse.com" date="1573646402">- Added patch to fix vulnerability: CVE-2018-10811 (bsc#1093536)
  - denial-of-service vulnerability
  [+ 0009-strongswan-5.5.0-5.6.2_skeyseed_init.patch]</changelog>
  <changelog author="mmnelemane@suse.com" date="1573732800">- Added patch to fix vulnerability: CVE-2018-17540 (bsc#1109845)
  [+ 0010-strongswan-4.4.0-5.7.0_gmp-pkcs1-overflow.patch]</changelog>
  <changelog author="mmnelemane@suse.com" date="1580212800">- Updated to version 5.8.2 (jsc#SLE-11370)
  - Dropped following patches due to irrelevance in the updated version:
    [- strongswan_modprobe_syslog.patch ]
    [- strongswan_fipsfilter.patch ]
    [- 0006-fix-compilation-error-by-adding-stdint.h.patch ]
    [- 0007-strongswan-5.3.1-5.6.0_gmp-pkcs1-verify.patch ]
    [- 0008-strongswan-5.1.2-5.6.2_stroke_msg_len.patch ]
    [- 0009-strongswan-5.5.0-5.6.2_skeyseed_init.patch ]
    [- 0010-strongswan-4.4.0-5.7.0_gmp-pkcs1-overflow.patch ]
  - Version 5.8.2
  ===============
  * Identity-based CA constraints, which enforce that the certificate chain of the remote
    peer contains a CA certificate with a specific identity, are supported via
    vici/swanctl.conf. This is similar to the existing CA constraints but doesn't require
    that the CA certificate is locally installed, for instance, intermediate CA certificates
    received from the peers. Wildcard identity matching (e.g. ..., OU=Research, CN=*) could
    also be used for the latter but requires trust in the intermediate CAs to only issue
    certificates with legitimate subject DNs (e.g. the "Sales" CA must not issue certificates
    with OU=Research). With the new constraint that's not necessary as long as a path length
    basic constraint (--pathlen for pki --issue) prevents intermediate CAs from issuing further
    intermediate CAs.
  * Intermediate CA certificates may now be sent in hash-and-URL encoding by configuring a
    base URL for the parent CA (#3234, swanctl/rw-hash-and-url-multi-level).
  * Implemented NIST SP-800-90A Deterministic Random Bit Generator (DRBG) based on AES-CTR
    and SHA2-HMAC modes. Currently used by the gmp and ntru plugins.
  * Random nonces sent in an OCSP requests are now expected in the corresponding OCSP responses.
  * The kernel-netlink plugin now ignores deprecated IPv6 addresses for MOBIKE. Whether temporary
    or permanent IPv6 addresses are included now depends on the charon.prefer_temporary_addrs
    setting (#3192).
  * Extended Sequence Numbers (ESN) are configured via PF_KEY if supported by the kernel.
  * The PF_KEY socket's receive buffer in the kernel-pfkey plugin is now cleared before sending
    requests, as many of the messages sent by the kernel are sent as broadcasts to all PF_KEY
    sockets. This is an issue if an external tool is used to manage SAs/policies unrelated to
    IPsec (#3225).
  * The vici plugin now uses unique section names for CHILD_SAs in child-updown events (7c74ce9190).
  * For individually deleted CHILD_SAs (in particular for IKEv1) the vici child-updown event
    now includes more information about the CHILD_SAs such as traffic statistics (#3198).
  * Custom loggers are correctly re-registered if log levels are changed via stroke loglevel (#3182).
  * Avoid lockups during startup on low entropy systems when using OpenSSL 1.1.1 (095a2c2eac).
  * Instead of failing later when setting a key, creating HMACs via openssl plugin now fails
    instantly if the underlying hash algorithm isn't supported (e.g. MD5 in FIPS-mode) so fallbacks
    to other plugins work properly (#3284).
  * Exponents of RSA keys read from TPM 2.0 via SAPI are correctly converted (8ee1242f1438).
  * Routing table IDs &gt; 255 are supported for custom routes on Linux.
  * To avoid races, the check for hardware offloading support in the kernel-netlink plugin is
    performed during initialization of the plugin (a605452c03).
  * The D-Bus config file for charon-nm is now installed in $(datadir)/dbus-1/system.d instead of
    $(sysconfdir)/dbus-1/system.d, which is intended for sysadmin overrides.
    INVALID_MAJOR_VERSION notifies are now correctly sent in messages of the same exchange type
    and with the same message ID as the request.
  * IKEv2 SAs are now immediately destroyed when sending or receiving INVALID_SYNTAX notifies
    in authenticated messages.
  * For developers working from the repository the configure script now aborts if GNU gperf is
    not found.
  - Version 5.8.1
  ===============
  * RDNs in DNs of X.509 certificates can now optionally be matched less strict. The global
    strongswan.conf option charon.rdn_matching takes two alternative values that cause the
    matching algorithm to either ignore the order of matched RDNs (reordered) or additionally
    (relaxed) accept DNs that contain more RDNs than configured (unmatched RDNs are treated
    like wildcard matches).
  * The updown plugin now passes the same interface to the script that is also used for the
    automatically installed routes, that is, the interface over which the peer is reached
    instead of the interface on which the local address is found (#3095).
  * TPM 2.0 contexts are now protected by a mutex to prevent issues if multiple IKE_SAs use
    the same private key concurrently (4b25885025).
  * Do a rekey check after the third QM message was received (#3060).
  * If available, explicit_bzero() is now used as memwipe() instead of our own implementation.
  * An .editorconfig file has been added, mainly so Github shows files with proper indentation
    (68346b6962).
  * The internal certificate of the load-tester plugin has been modified so it can again be
    used as end-entity cert with 5.6.3 and later (#3139).
  * The maximum data length of received COOKIE notifies (64 bytes) is now enforced (#3160).
  - Version 5.8.0
  ===============
  * The systemd service units have been renamed. The modern unit, which was called
    strongswan-swanctl, is now called strongswan (the previous name is configured as alias in
    the unit, for which a symlink is created when the unit is enabled). The legacy unit is now
    called strongswan-starter.
  * Support for XFRM interfaces (available since Linux 4.19) has been added, which are intended
    to replace VTI devices (they are similar but offer several advantages, for instance, they
    are not bound to an address or address family).
  * IPsec SAs and policies are associated with such interfaces via interface IDs that can be
    configured in swanctl.conf (dynamic IDs may optionally be allocated for each SA and even
    direction). It's possible to use separate interfaces for in- and outbound traffic (or
    only use an interface in one direction and regular policies in the other).
  * Interfaces may be created dynamically via updown/vici scripts, or statically before or after
    establishing the SAs. Routes must be added manually as needed (the daemon will not install
    any routes for outbound policies with an interface ID).
  * When moving XFRM interfaces to other network namespaces they retain access to the SAs and
    policies installed in the original namespace, which allows providing IPsec tunnels for
    processes in other network namespaces without giving them access to the IPsec keys or
    IKE credentials.
    More information can be found on the page about route-based VPNs.
  * Initiation of childless IKE_SAs is supported (RFC 6023). If enabled and supported by the
    responder, no CHILD_SA is established during IKE_AUTH. Instead, all CHILD_SAs are created
    with CREATE_CHILD_SA exchanges. This allows using a separate DH exchange even for the
    first CHILD_SA, which is otherwise created during IKE_AUTH with keys derived from the
    IKE_SA's key material.
  * The swanctl --initiate command may be used to initiate only the IKE_SA via --ike
    option if --child is omitted and the peer supports this extension.
  * The NetworkManager backend and plugin support IPv6.
  * The new wolfssl plugin is a wrapper around the wolfSSL crypto library. Thanks to Sean
    Parkinson of wolfSSL Inc. for the initial patch.
  * IKE SPIs may optionally be labeled via the charon.spi_mask|label options in
    strongswan.conf. This feature was extracted from charon-tkm, however, now applies the
    mask/label in network order.
  * The openssl plugin supports ChaCha20-Poly1305 when built with OpenSSL 1.1.0.
  * The PB-TNC finite state machine according to section 3.2 of RFC 5793 was not correctly
    implemented when sending either a CRETRY or SRETRY batch. These batches can only be sent
    in the "Decided" state and a CRETRY batch can immediately carry all messages usually
    transported by a CDATA batch. It is currently not possible to send a SRETRY batch since
    full-duplex mode for PT-TLS transport is not supported.
  * Instead of marking IPv6 virtual IPs as deprecated, the kernel-netlink plugin now uses
    address labels to avoid that such addresses are used for non-VPN traffic (00a953d090).
  * The agent plugin now creates sockets to the ssh/gpg-agent dynamically and does not keep
    them open, which otherwise might prevent the agent from getting terminated.
  * To avoid broadcast loops the forecast plugin now only reinjects packets that are marked
    or received from the configured interface.
  * UTF-8 encoded passwords are supported via EAP-MSCHAPv2, which internally uses an UTF-16LE
    encoding to calculate the NT hash (#3014).
  * Properly delete temporary drop policies (used when updating IP addresses of SAs) if manual
    priorities are used, which was broken since 5.6.2 (8e31d65730).
  * Avoid overwriting start_action when parsing the inactivity timeout in the vici plugin (#2954).
  * Fixed the automatic termination of reloaded vici connections with start_action=start,
    which was broken since 5.6.3 (71b22c250f).
  * The lookup for shared secrets for IKEv1 SAs via sql plugin should now work better
    (6ec9f68f32).
  * Fixed a race condition in the trap manager between installation and removal of a policy
    (69cbe2ca3f).
  * Compilation of the kernel-netlink plugin has been fixed on old kernels (&lt; 2.6.39), which
    was caused by the HW offload changes (c7f579fa17).
  * The IPsec stack detection and module loading in starter has been removed (it wasn't
    enforced anyway and loading modules doesn't seem necessary, also KLIPS hasn't been
    supported for a long time and PF_KEY will eventually be removed from the Linux kernel,
    ba817d2917).
  * Several IKEv2 protocol details are now handled more strictly: Unrequested virtual IPs are
    ignored, CFG_REPLY payloads are ignored if no CFG_REQUEST payloads were sent, a USE
    TRANSPORT_MODE notify received from the responder is checked against the local configuration.
  * The keys and certificates used by the scenarios in the testing environment are now generated
    dynamically. Running the testing/scripts/build-certs script after creating the base and root
    images uses the pki utility installed in the latter to create the keys and certificates for
    all the CAs and in some cases for individual scenarios. These credentials are stored in the
    source tree, not the image, so this has to be called only once even if the images are later
    rebuilt. The script automatically (re-)rebuilds the guest images as that generates fresh
    CRLs and signs the DNS zones. The only keys/certificates currently not generated are the
    very large ones used by the ikev2/rw-eap-tls-fragments scenario.
  - Version 5.7.2
  ===============
  * For RSA with PSS padding, the TPM 2.0 specification mandates the maximum salt length
    (as defined by the length of the key and hash). However, if the TPM is FIPS-168-4 compliant,
    the salt length equals the hash length. This is assumed for FIPS-140-2 compliant TPMs, but
    if that's not the case, it might be necessary to manually enable charon.plugins.tpm.fips_186_4
    if the TPM doesn't use the maximum salt length.
  * Directories for credentials loaded by swanctl are now accessed relative to the loaded
    swanctl.conf file, in particular, when loading it from a custom location via --file argument.
  * The base directory, which is used if no custom location for swanctl.conf is specified, is now
    also configurable at runtime via SWANCTL_DIR environment variable.
  * If RADIUS Accounting is enabled, the eap-radius plugin will add the session ID (Acct-Session-Id)
    to Access-Request messages, which e.g. simplifies associating database entries for IP leases and
    accounting with sessions (the session ID does not change when IKE_SAs are rekeyed, #2853).
  * All IP addresses assigned by a RADIUS server are included in Accounting-Stop messages even if
    the client did not claim them, allowing to release them early in case of connection errors (#2856).
  * Selectors installed on transport mode SAs by the kernel-netlink plugin are now updated if an
    IP address changes (e.g. via MOBIKE) and it was part of the selectors.
  * No deletes are sent anymore when a rekeyed CHILD_SA expires (#2815).
  * The bypass-lan plugin now tracks interfaces to handle subnets that move from one interface
    to another and properly update associated routes (#2820).
  * Only valid and expected inbound IKEv2 messages are used to update the timestamp of the
    last received message (previously, retransmits also triggered an update).
  * IKEv2 requests from responders are now ignored until the IKE_SA is fully established (e.g. if a
    DPD request from the peer arrives before the IKE_AUTH response does, 46bea1add9).
    Delayed IKE_SA_INIT responses with COOKIE notifies we already recevied are ignored, they caused
    another reset of the IKE_SA previously (#2837).
  * Active and queued Quick Mode tasks are now adopted if the peer reauthenticates an IKEv1 SA
    while creating lots of CHILD_SAs.
  * Newer versions of the FreeBSD kernel add an SADB_X_EXT_SA2 extension to SADB_ACQUIRE
    messages, which allows the kernel-pfkey plugin to determine the reqid of the policy even if it
    wasn't installed by the daemon previously (e.g. when using FreeBSD's if_ipsec(4) VTIs, which
    install policies themselves, 872b9b3e8d).
  * Added support for RSA signatures with SHA-256 and SHA-512 to the agent plugin. For older
    versions of ssh/gpg-agent that only support SHA-1, IKEv2 signature authentication has to be
    disabled via charon.signature_authentication.
  * The sshkey and agent plugins support Ed25519/Ed448 SSH keys and signatures.
  * The openssl plugin supports X25519/X448 Diffie-Hellman and Ed25519/Ed448 keys and
    signatures when built against OpenSSL 1.1.1.
  * Support for Ed25519, ChaCha20/Poly1305, SHA-3 and AES-CCM were added to the botan plugin.
  * The mysql plugin now properly handles database connections with transactions
    under heavy load (#2779).
  * IP addresses in ha pools are now distributed evenly among all segments (#2828).
  * Private key implementations may optionally provide a list of supported signature schemes,
    which, as described above, is used by the tpm plugin because for each key on a TPM 2.0 the
    hash algorithm and for RSA also the padding scheme is predefined.
  * The testing environment is now based on Debian 9 (stretch) by default. This required
    some changes, in particular, updating to FreeRADIUS 3.x (which forced us to abandon the
    TNC@FHH patches and scenarios, 2fbe44bef3) and removing FIPS-enabled versions of
    OpenSSL (the FIPS module only supports OpenSSL 1.0.2).
  * Most test scenarios were migrated to swanctl.
  - Version 5.7.1
  ===============
  * Fixes a vulnerability in the gmp plugin triggered by crafted certificates with RSA keys with
    very small moduli. When verifying signatures with such keys, the code patched with the fix
    for CVE-2018-16151/2 caused an integer underflow and subsequent heap buffer overflow
    that results in a crash of the daemon.
  * The vulnerability has been registered as CVE-2018-17540.
  - Version 5.7.0
  ===============
  * Fixes a potential authorization bypass vulnerability in the gmp plugin that was caused by a
    too lenient verification of PKCS#1 v1.5 signatures. Several flaws could be exploited by a
    Bleichenbacher-style attack to forge signatures for low-exponent keys (i.e. with e=3).
  * CVE-2018-16151 has been assigned to the problem of accepting random bytes after the OID
    of the hash function in such signatures, and CVE-2018-16152 has been assigned to the issue
    of not verifying that the parameters in the ASN.1 algorithmIdentitifer structure is empty.
    Other flaws that don't lead to a vulnerability directly (e.g. not checking for at least
    8 bytes of padding) have no separate CVE assigned.
  * Dots are not allowed anymore in section names in swanctl.conf and strongswan.conf.
    This mainly affects the configuration of file loggers. If the path for such a log file
    contains dots it now has to be configured in the new path setting within the arbitrarily
    renamed subsection in the filelog section.
  * Sections in swanctl.conf and strongswan.conf may now reference other sections. All settings
    and subsections from such a section are inherited. This allows to simplify configs as
    redundant information has only to be specified once and may then be included in other
    sections (see strongswan.conf for an example).
  * The originally selected IKE config (based on the IPs and IKE version) can now change
    if no matching algorithm proposal is found. This way the order of the configs doesn't
    matter that much anymore and it's easily possible to specify separate configs for
    clients that require weaker algorithms (instead of having to also add them in other
    configs that might be selected).
  * Support for Postquantum Preshared Keys for IKEv2 (draft-ietf-ipsecme-qr-ikev2) has been added.
    For an example refer to the swanctl/rw-cert-ppk scenario (or with EAP, or PSK authentication).
  * The new botan plugin is a wrapper around the Botan C++ crypto library.
    It requires a fairly recent build from Botan's master branch (or the upcoming 2.8.0 release).
    Thanks to René Korthaus and his team from Rohde &amp; Schwarz Cybersecurity for the initial
    patch and to Jack Lloyd for quickly adding missing functions to Botan's FFI (C89) interface.
  * Implementation of RFC 8412 "Software Inventory Message and Attributes (SWIMA) for PA-TNC".
  * SWIMA subscription option sets CLOSE_WRITE trigger on apt history.log file resulting in
    a ClientRetry PB-TNC batch to initialize a new measurement cycle. The new imv/imc-swima
    plugins replace the previous imv/imc-swid plugins, which were removed.
  * Added support for fuzzing the PA-TNC (RFC 5792) and PB-TNC (RFC 5793) NEA protocols
    on Google's OSS-Fuzz infrastructure.
  * Support for version 2 of Intel's TPM2-TSS TGC Software Stack. The presence of the
    in-kernel /dev/tpmrm0 resource manager is automatically detected.
  * The pki tool accepts a xmppAddr otherName as a subjectAlternativeName using the
    syntax --san xmppaddr:&lt;jid&gt;.
  * swanctl.conf supports the configuration of marks the in- and/or outbound SA should apply
    to packets after processing on Linux. Configuring such a mark for outbound SAs requires
    at least a 4.14 kernel. The ability to set a mask and configuring a mark/mask for
    inbound SAs will be added with the upcoming 4.19 kernel.
  * New options in swanctl.conf allow configuring how/whether DF, ECN and DS fields in the
    IP headers are copied during IPsec processing. Controlling this is currently only possible
    on Linux.
  * The handling of sequence numbers in IKEv1 DPDs has been improved (#2714).
  * To avoid conflicts, the dhcp plugin now only uses the DHCP server port if explicitly
    configured.
  - Version 5.6.3
  ===============
  * Fixed a DoS vulnerability in the IKEv2 key derivation if the openssl plugin is used in FIPS
    mode and HMAC-MD5 is negotiated as PRF.
    This vulnerability has been registered as CVE-2018-10811.
  * Fixed a vulnerability in the stroke plugin, which did not check the received length before
    reading a message from the socket. Unless a group is configured, root privileges are
    required to access that socket, so in the default configuration this shouldn't be an issue.
    This vulnerability has been registered as CVE-2018-5388.
  * CRLs that are not yet valid are now ignored to avoid problems in scenarios where expired
    certificates are removed from new CRLs and the clock on the host doing the revocation
    check is trailing behind that of the host issuing CRLs. Not doing this could result in
    accepting a revoked and expired certificate, if it's still valid according to the
    trailing clock but not contained anymore in not yet valid CRLs.
  * The issuer of fetched CRLs is now compared to the issuer of the checked certificate (#2608).
  * CRL validation results other than revocation (e.g. a skipped check because the CRL couldn't
    be fetched) are now stored also for intermediate CA certificates and not only for end-entity
    certificates, so a strict CRL policy can be enforced in such cases.
  * In compliance with RFC 4945, section 5.1.3.2, certificates used for IKE must now either
    not contain a keyUsage extension (like the ones generated by pki), or have at least one of the
    digitalSignature or nonRepudiation bits set.
  * New options for vici/swanctl allow forcing the local termination of an IKE_SA. This might be
    useful in situations where it's known the other end is not reachable anymore, or that it
    already removed the IKE_SA, so retransmitting a DELETE and waiting for a response would
    be pointless.
  * Waiting only a certain amount of time for a response (i.e. shorter than all retransmits
    would be) before destroying the IKE_SA is also possible by additionally specifying a
    timeout in the forced termination request.
  * When removing routes, the kernel-netlink plugin now checks if it tracks other routes for
    the same destination and replaces the installed route instead of just removing it. Same
    during installation, where existing routes previously weren't replaced. This should allow
    using traps with virtual IPs on Linux (#2162).
  * The dhcp plugin now only sends the client identifier DHCP option if the identity_lease
    setting is enabled (7b660944b6). It can also send identities of up to 255 bytes length,
    instead of the previous 64 bytes (30e886fe3b, 0e5b94d038). If a server address is
    configured, DHCP requests are now sent from port 67 instead of 68 to avoid ICMP port
    unreachables (becf027cd9).
  * The handling of faulty INVALID_KE_PAYLOAD notifies (e.g. one containing a DH group
    that wasn't proposed) during CREATE_CHILD_SA exchanges has been improved (#2536).
  * Roam events are now completely ignored for IKEv1 SAs (there is no MOBIKE to handle such
    changes properly).
  * ChaCha20/Poly1305 is now correctly proposed without key length (#2614). For compatibility with
    older releases the chacha20poly1305compat keyword may be included in proposals to also propose
    the algorithm with a key length (c58434aeff).
  * Configuration of hardware offload of IPsec SAs is now more flexible and allows a new
    setting (auto), which automatically uses it if the kernel and device both support it. If hw
    offload is set to yes and offloading is not supported, the CHILD_SA installation now fails.
  * The kernel-pfkey plugin optionally installs routes via internal interface (one with an IP
    in the local traffic selector). On FreeBSD, enabling this selects the correct source IP
    when sending packets from the gateway itself (e811659323).
  * SHA-2 based PRFs are supported in PKCS#8 files as generated by OpenSSL 1.1 (#2574).
  * The pki --verify tool may load CA certificates and CRLs from directories.
  * The IKE daemon now also switches to port 4500 if the remote port is not 500 (e.g. because the
    remote maps the response to a different port, as might happen on Azure), as long as the local
    port is 500 (85bfab621d).
  * Fixed an issue with DNS servers passed to NetworkManager in charon-nm (ee8c25516a).
  * Logged traffic selectors now always contain the protocol if either protocol or port are set
    (a36d8097ed).
  * Only the inbound SA/policy will be updated as reaction to IP address changes for rekeyed
    CHILD_SAs that are kept around.
  * The parser for strongswan.conf/swanctl.conf now accepts = characters in values without
    having to put the value in quotes (e.g. for Base64 encoded shared secrets).
    Notes for developers:
  * trap_manager_t: Trap policies are now unistalled by peer/child name and not the reqid.
  * No reqid is returned anymore when installing trap policies.
  * child_sa_t: A new state (CHILD_DELETED) is used for CHILD_SAs that have been deleted but
    not yet destroyed (after a rekeying CHILD_SAs are kept around for a while to process
    delayed packets).
    This way child_updown events are not triggered anymore for such SAs when an IKE_SA that
    has such CHILD_SAs assigned is deleted.
  - Version 5.6.2
  ===============
  * Fixed a DoS vulnerability in the parser for PKCS#1 RSASSA-PSS signatures that was caused
    by insufficient input validation. One of the configurable parameters in algorithm identifier
    structures for RSASSA-PSS signatures is the mask generation function (MGF). Only MGF1 is
    currently specified for this purpose. However, this in turn takes itself a parameter that
    specifies the underlying hash function. strongSwan's parser did not correctly handle the
    case of this parameter being absent, causing an undefined data read.
    This vulnerability has been registered as CVE-2018-6459.
  * When rekeying IKEv2 IKE_SAs the previously negotiated DH group will be reused, instead of
    using the first configured group, which avoids an additional exchange if the peer previously
    selected a different DH group via INVALID_KE_PAYLOAD notify. The same is also done when
    rekeying CHILD_SAs except for the first rekeying of the CHILD_SA that was created with the
    IKE_SA, where no DH group was negotiated yet.
    Also, the selected DH group is moved to the front in all sent proposals that contain it
    and all proposals that don't are moved to the back in order to convey the preference for
    this group to the peer.
  * Handling of MOBIKE task queuing has been improved. In particular, the response to an
    address update (with NAT-D payloads) is not ignored anymore if only an address list update
    or DPD is queued as that could prevent updating the UDP encapsulation in the kernel.
  * On Linux, roam events may optionally be triggered by changes to the routing rules, which
    can be useful if routing rules (instead of e.g. route metrics) are used to switch from one
    to another interface (i.e. from one to another routing table). Since routing rules are
    currently not evaluated when doing route lookups this is only useful if the kernel-based
    route lookup is used (4664992f7d).
  * The fallback drop policies installed to avoid traffic leaks when replacing addresses in
    installed policies are now replaced by temporary drop policies, which also prevent
    acquires because we currently delete and reinstall IPsec SAs to update their addresses
    (35ef1b032d).
  * Access X.509 certificates held in non-volatile storage of a TPM 2.0 referenced via the
    NV index.
    Adding the --keyid parameter to pki --print allows to print private keys or certificates
    stored in a smartcard or a TPM 2.0.
  * Fixed proposal selection if a peer incorrectly sends DH groups in the ESP proposal during
    IKE_AUTH and also if a DH group is configured in the local ESP proposal and charon.prefer
    configured_proposals is disabled (d058fd3c32).
  * The lookup for PSK secrets for IKEv1 has been improved for certain scenarios (see #2497
    for details).
  * MSKs received via RADIUS are now padded to 64 bytes to avoid compatibility issues with
    EAP-MSCHAPv2 and PRFs that have a block size &lt; 64 bytes (e.g. AES-XCBC-PRF-128, see
    73cbce6013).
  * The tpm_extendpcr command line tool extends a digest into a TPM PCR.
  * Ported the NetworkManager backend from the deprecated libnm-glib to libnm.
  * The save-keys debugging/development plugin saves IKE and/or ESP keys to files compatible
    with Wireshark.
  - Version 5.6.1
  ===============
  * Several algorithms were removed from the default ESP/AH and IKE proposals in compliance with
    RFC 8221 and RFC 8247, respectively. Removed from the default ESP/AH proposal were the
    3DES and Blowfish encryption algorithms and the HMAC-MD5 integrity algorithm. From the IKE
    default proposal the HMAC-MD5 integrity algorithm and the MODP-1024 Diffie-Hellman group
    were removed (the latter is significant for Windows clients in their default configuration).
    These algorithms may still be used in custom proposals.
  * Support for RSASSA-PSS signatures has been added. For compatibility with previous
    releases they are currently not used automatically, by default, to change that charon.rsa_pss
    may be enabled. To explicitly use or require such signatures during IKEv2 signature
    authentication (RFC 7427) ike:rsa/pss... authentication constraints may be used for specific
    connections (regardless of whether the strongswan.conf option above is enabled). Only the
    hash algorithm can be specified in such constraints, the MGF1 will be based on that hash
    and the salt length will equal the hash length (when verifying the salt length is not
    enforced).
    To enforce such signatures during PKI verification use rsa/pss... authentication constraints.
  * All pki commands that create certificates/CRLs can be made to sign with RSASSA-PSS instead
    of the classing PKCS#1 scheme with the --rsa-padding pss option. As with signatures during
    authentication, only the hash algorithm is configurable (via --digest option), the MGF1 will
    be based on that and the salt length will equal the hash length.
  * These signatures are supported by all RSA backends except pkcs11 (i.e. gmp, gcrypt, openssl).
    The gmp plugin requires the mgf1 plugin.
    Note that RSASSA-PSS algorithm identifiers and parameters in keys (public keys in
    certificates or private keys in PKCS#8 files) are currently not used as constraints.
  * The sec-updater tool checks for security updates in dpkg-based repositories
    (e.g. Debian/Ubuntu) and sets the security flags in the IMV policy database accordingly.
    Additionally for each new package version a SWID tag for the given OS and HW architecture
    is created and stored in the database.
  * Using the sec-updater.sh script template the lookup can be automated (e.g. via an hourly
    cron job).
  * When restarting an IKEv2 negotiation after receiving an INVALID_KE_PAYLOAD notify (or due
    to other reasons like too many retransmits) a new initiator SPI is allocated. This
    prevents issues caused by retransmits for IKE_SA_INIT messages.
  * Because the initiator SPI was previously reused when restarting the connection delayed
    responses for previous connection attempts were processed and might have caused fatal
    errors due to a failed DH negotiation or because of the internal retry counter in the
    ike-init task. For instance, if we proposed a DH group the responder rejected we
    might have later received delayed responses that either contained INVALID_KE_PAYLOAD
    notifies with the DH group we already switched to, or, if we retransmitted an
    IKE_SA_INIT with the requested group but then had to restart again, a KE payload with
    a group different from the one we proposed.
  * The introduction of file versions in the IMV database scheme broke file reference hash
    measurements. This has been fixed by creating generic product versions having an empty
    package name.
  * A new timeout option for the systime-fix plugin stops periodic system time checks after
    a while and enforces a certificate verification, closing or reauthenticating all SAs
    with invalid certificates.
  * The IKE event counters, previously only available via ipsec listcounters command, may
    now also be queried and reset via vici and the new swanctl --counters command. They
    are collected and provided by the optional counters plugin (enabled by default for
    backwards compatibility if the stroke plugin is built).
  * Class attributes received in RADIUS Access-Accept messages may optionally be added to
    RADIUS accounting messages (655924074b).
  * Basic support for systemd sockets has been added, which may be used for privilege separation
    (59db98fb94).
  * Inbound marks may optionally be installed in the SA again (was removed with 5.5.2) by
    enabling the mark_in_sa option in swanctl.conf.
  * The timeout of leases in pools configured via pool utility may be configured in other
    units than hours.
    INITIAL_CONTACT notifies are now only omitted if never is configured as uniqueness policy.
  * Outbound FWD policies for shunts are not installed anymore, by default (as is the case
    for other policies since 5.5.1).
  * Don't consider a DH group mismatch during CHILD_SA rekeying as failure as responder
    (e7276f78aa).
  * Handling of fragmented IPv4 and IPv6 packets in libipsec has been improved (e138003de9).
  * Trigger expire events for the correct IPsec SA in libipsec (6e861947a0).
  * A crash in CRL verification via openssl plugin using OpenSSL 1.1 has been fixed (78acaba6a1).
  * No hard-coded default proposals are passed from starter to the stroke plugin anymore (the
    IKE proposal used curve25519 since 5.5.2, which is an optional plugin).
  * A workaround for an issue with virtual IPs on macOS 10.13 (High Sierra) has been added
    (039b85dd43).
  * Handling of IKE_SA rekey collisions in charon-tkm has been fixed.
  * Instead of failing or just silently doing nothing unit tests may now warn about certain
    conditions (e.g. if a test was not executed due to external dependencies).</changelog>
  <changelog author="mmnelemane@suse.com" date="1585224000">- Fix for to resolve multiple definition of swanctl_dir (bsc #1164493)
  [+ 0006-Resolve-multiple-definition-of-swanctl_dir.patch]</changelog>
  <changelog author="mbuil@suse.com" date="1610712000">- Fix typo in README (bsc #1167880)
  [+ 0007-Fix-typo-in-README.patch ]</changelog>
  <changelog author="mbuil@suse.com" date="1611576000">- Fix FIPS bug (bsc #1180801)
  [+ 0008-gcrypt-Use-a-dummy-buffer-to-initialize-static-alloc.patch ]</changelog>
  <changelog author="mbuil@suse.com" date="1617019200">- Keep using ipsec as the main binary. Therefore, make strongswan.service point to it instead of swanctl</changelog>
  <changelog author="mbuil@suse.com" date="1617019201">- Information added in README about the rcstrongswan-starter</changelog>
  <changelog author="mbuil@suse.com" date="1617624000">- Add config to run ipsec on namespaces (bsc #1183670)</changelog>
  <changelog author="mt@suse.com" date="1619006400">- Add support for AES CCM aead algorithms to openssl plugin (cc/fips,bsc#1185363)
  [+ 0009-strongswan-openssl-aead-add-ccm-support.patch]</changelog>
  <changelog author="mt@suse.com" date="1620388800">- Replace AEAD AES CCM patch with upstream variant (cc/fips,bsc#1185363)
  [* 0009-strongswan-openssl-aead-add-ccm-support.patch]</changelog>
  <changelog author="hare@suse.de" date="1627646400">- Add auth_els plugin to support Marvell FC-SP encryption (jsc#SLE-20151)
  [* strongswan-marvell-auth-els.patch]</changelog>
  <changelog author="abergmann@suse.com" date="1634040000">- Fix integer overflow in gmp plugin (bsc#1191367, CVE-2021-41990)
  [* strongswan-5.6.1-5.9.3_gmp-rsa-ssa-salt-len.patch]
- Fix integer overflow when replacing certificates in cache (bsc#1191435, CVE-2021-41991)
  [* strongswan-4.4.1-5.9.3_cert-cache-random.patch]</changelog>
  <changelog author="meissner@suse.com" date="1643025600">- strongswan-5.5.0-5.9.4_eap_success-CVE-2021-45079.patch:
  Fixed authentication bypass in EAP authentication (CVE-2021-45079
  bsc#1194471)</changelog>
</package>
<package pkgid="41a49829759c483b5b6140fe6d353fe1887db61410a2ec265c00dab7f3fde5b9" name="strongswan-mysql" arch="s390x">
  <version epoch="0" ver="5.8.2" rel="11.24.1"/>
  <changelog author="ndas@suse.de" date="1501502400">- Updated to strongSwan 5.3.5(bsc#1050691) providing the following changes:
  * Fixed a DoS vulnerability in the gmp plugin that was caused by insufficient input
    validation when verifying RSA signatures. More specifically, mpz_powm_sec() has two
    requirements regarding the passed exponent and modulus that the plugin did not
    enforce, if these are not met the calculation will result in a floating point exception
    that crashes the whole process.
    This vulnerability has been registered as CVE-2017-9022.
    Please refer to our blog for details.
  * Fixed a DoS vulnerability in the x509 plugin that was caused because the ASN.1 parser
    didn't handle ASN.1 CHOICE types properly, which could result in an infinite loop when
    parsing X.509 extensions that use such types.
    This vulnerability has been registered as CVE-2017-9023.
    Please refer to our blog for details.
  * The behavior during IKEv2 CHILD_SA rekeying has been changed in order to avoid
    traffic loss. When responding to a CREATE_CHILD_SA request to rekey a CHILD_SA
    the responder already has everything available to install and use the new CHILD_SA.
    However, this could lead to lost traffic as the initiator won't be able to process
    inbound packets until it processed the CREATE_CHILD_SA response and updated the
    inbound SA. To avoid this the responder now only installs the new inbound SA and
    delays installing the outbound SA until it receives the DELETE for the replaced CHILD_SA.
  * The messages transporting these DELETEs could reach the peer before packets sent
    with the deleted outbound SAs reach it. To reduce the chance of traffic loss due
    to this the inbound SA of the replaced CHILD_SA is not removed for a configurable
    amount of seconds (charon.delete_rekeyed_delay) after the DELETE has been processed.
  * The code base has been ported to Apple's ARM64 iOS platform, which required several
    changes regarding the use of variadic functions. This was necessary because the calling
    conventions for variadic and regular functions are different there.
    This means that assigning a non-variadic function to a variadic function pointer, as we
    did with our enumerator_t::enumerate() implementations and several callbacks, will
    result in crashes as the called function accesses the arguments differently than the
    caller provided them. To avoid this issue the enumerator_t interface has been changed
    and the signature of the callback functions for enumerator_create_filter() and two
    methods on linked_list_t have been changed. Refer to the developer notes below
    for details.
  * Adds support for fuzzing the certificate parser provided by the default plugins
    (x509, pem, gmp etc.) on Google's OSS-Fuzz infrastructure (or generally with
    libFuzzer). Several issues found while fuzzing these plugins were fixed.
  * Two new options have been added to charon's retransmission settings:
    retransmit_limit and retransmit_jitter. The former adds an upper limit to the
    calculated retransmission timeout, the latter randomly reduces it.
    Refer to Retransmission for details.
  * A bug in swanctl's --load-creds command was fixed that caused unencrypted
    private keys to get unloaded if the command was called multiple times.
    The load-key VICI command now returns the key ID of the loaded key on success.
  * The credential manager now enumerates local credential sets before global ones.
    This means certificates supplied by the peer will now be preferred over certificates
    with the same identity that may be locally stored (e.g. in the certificate cache).
  * Adds support for hardware offload of IPsec SAs as introduced by Linux 4.11 for
    specific hardware that supports this.
  * The pki tool loads the curve25519 plugin by default.
    [- 0006-Make-sure-the-modulus-is-odd-and-the-exponent-not-zero.patch,
  - 0007-asn1-parser-Fix-CHOICE-parsing.patch]
- libhydra is removed as all kernel plugins moved to libcharon</changelog>
  <changelog author="ndas@suse.de" date="1504612800">- fix "uintptr_t? undeclared" compilation error.
  [+0006-fix-compilation-error-by-adding-stdint.h.patch]</changelog>
  <changelog author="ndas@suse.de" date="1504612801">- Updated to strongSwan 5.6.0 providing the following changes:
  * Fixed a DoS vulnerability in the gmp plugin that was caused by insufficient input validation
    when verifying RSA signatures, which requires decryption with the operation m^e mod n,
    where m is the signature, and e and n are the exponent and modulus of the public key.
    The value m is an integer between 0 and n-1, however, the gmp plugin did not verify this.
    So if m equals n the calculation results in 0, in which case mpz_export() returns NULL.
    This result wasn't handled properly causing a null-pointer dereference.
    This vulnerability has been registered as CVE-2017-11185. (bsc#1051222)
  * New SWIMA IMC/IMV pair implements the draft-ietf-sacm-nea-swima-patnc Internet
    Draft and has been demonstrated at the IETF 99 Prague Hackathon.
  * The IMV database template has been adapted to achieve full compliance with the
    ISO 19770-2:2015 SWID tag standard.
  * The pt-tls-client can attach and use TPM 2.0 protected private keys via the --keyid parameter.
  * By default the /etc/swanctl/conf.d directory is created and *.conf files in it are included in the default
    swanctl.conf file.
  * The curl plugin now follows HTTP redirects (configurable via strongswan.conf).
  * The CHILD_SA rekeying was fixed in charon-tkm and the behavior is refined a bit more since 5.5.3
  * libtpmtss supports Intel's TSS2 Architecture Broker and Resource Manager interface (tcti-tabrmd).
  * more on https://wiki.strongswan.org/versions/66</changelog>
  <changelog author="mmnelemane@suse.com" date="1521028800">- Removed unused requires and macro calls(bsc#1083261)</changelog>
  <changelog author="mmnelemane@suse.com" date="1573646400">- Added patch to fix vulnerability: CVE-2018-16151,CVE-2018-16152 (bsc#1107874)
  - Insufficient input validation in gmp plugin
  [+ 0007-strongswan-5.3.1-5.6.0_gmp-pkcs1-verify.patch]</changelog>
  <changelog author="mmnelemane@suse.com" date="1573646401">- Added patch to fix vulnerability: CVE-2018-5388 (bsc#1094462)
  - Buffer Underflow in stroke_socket.c
  [+ 0008-strongswan-5.1.2-5.6.2_stroke_msg_len.patch]</changelog>
  <changelog author="mmnelemane@suse.com" date="1573646402">- Added patch to fix vulnerability: CVE-2018-10811 (bsc#1093536)
  - denial-of-service vulnerability
  [+ 0009-strongswan-5.5.0-5.6.2_skeyseed_init.patch]</changelog>
  <changelog author="mmnelemane@suse.com" date="1573732800">- Added patch to fix vulnerability: CVE-2018-17540 (bsc#1109845)
  [+ 0010-strongswan-4.4.0-5.7.0_gmp-pkcs1-overflow.patch]</changelog>
  <changelog author="mmnelemane@suse.com" date="1580212800">- Updated to version 5.8.2 (jsc#SLE-11370)
  - Dropped following patches due to irrelevance in the updated version:
    [- strongswan_modprobe_syslog.patch ]
    [- strongswan_fipsfilter.patch ]
    [- 0006-fix-compilation-error-by-adding-stdint.h.patch ]
    [- 0007-strongswan-5.3.1-5.6.0_gmp-pkcs1-verify.patch ]
    [- 0008-strongswan-5.1.2-5.6.2_stroke_msg_len.patch ]
    [- 0009-strongswan-5.5.0-5.6.2_skeyseed_init.patch ]
    [- 0010-strongswan-4.4.0-5.7.0_gmp-pkcs1-overflow.patch ]
  - Version 5.8.2
  ===============
  * Identity-based CA constraints, which enforce that the certificate chain of the remote
    peer contains a CA certificate with a specific identity, are supported via
    vici/swanctl.conf. This is similar to the existing CA constraints but doesn't require
    that the CA certificate is locally installed, for instance, intermediate CA certificates
    received from the peers. Wildcard identity matching (e.g. ..., OU=Research, CN=*) could
    also be used for the latter but requires trust in the intermediate CAs to only issue
    certificates with legitimate subject DNs (e.g. the "Sales" CA must not issue certificates
    with OU=Research). With the new constraint that's not necessary as long as a path length
    basic constraint (--pathlen for pki --issue) prevents intermediate CAs from issuing further
    intermediate CAs.
  * Intermediate CA certificates may now be sent in hash-and-URL encoding by configuring a
    base URL for the parent CA (#3234, swanctl/rw-hash-and-url-multi-level).
  * Implemented NIST SP-800-90A Deterministic Random Bit Generator (DRBG) based on AES-CTR
    and SHA2-HMAC modes. Currently used by the gmp and ntru plugins.
  * Random nonces sent in an OCSP requests are now expected in the corresponding OCSP responses.
  * The kernel-netlink plugin now ignores deprecated IPv6 addresses for MOBIKE. Whether temporary
    or permanent IPv6 addresses are included now depends on the charon.prefer_temporary_addrs
    setting (#3192).
  * Extended Sequence Numbers (ESN) are configured via PF_KEY if supported by the kernel.
  * The PF_KEY socket's receive buffer in the kernel-pfkey plugin is now cleared before sending
    requests, as many of the messages sent by the kernel are sent as broadcasts to all PF_KEY
    sockets. This is an issue if an external tool is used to manage SAs/policies unrelated to
    IPsec (#3225).
  * The vici plugin now uses unique section names for CHILD_SAs in child-updown events (7c74ce9190).
  * For individually deleted CHILD_SAs (in particular for IKEv1) the vici child-updown event
    now includes more information about the CHILD_SAs such as traffic statistics (#3198).
  * Custom loggers are correctly re-registered if log levels are changed via stroke loglevel (#3182).
  * Avoid lockups during startup on low entropy systems when using OpenSSL 1.1.1 (095a2c2eac).
  * Instead of failing later when setting a key, creating HMACs via openssl plugin now fails
    instantly if the underlying hash algorithm isn't supported (e.g. MD5 in FIPS-mode) so fallbacks
    to other plugins work properly (#3284).
  * Exponents of RSA keys read from TPM 2.0 via SAPI are correctly converted (8ee1242f1438).
  * Routing table IDs &gt; 255 are supported for custom routes on Linux.
  * To avoid races, the check for hardware offloading support in the kernel-netlink plugin is
    performed during initialization of the plugin (a605452c03).
  * The D-Bus config file for charon-nm is now installed in $(datadir)/dbus-1/system.d instead of
    $(sysconfdir)/dbus-1/system.d, which is intended for sysadmin overrides.
    INVALID_MAJOR_VERSION notifies are now correctly sent in messages of the same exchange type
    and with the same message ID as the request.
  * IKEv2 SAs are now immediately destroyed when sending or receiving INVALID_SYNTAX notifies
    in authenticated messages.
  * For developers working from the repository the configure script now aborts if GNU gperf is
    not found.
  - Version 5.8.1
  ===============
  * RDNs in DNs of X.509 certificates can now optionally be matched less strict. The global
    strongswan.conf option charon.rdn_matching takes two alternative values that cause the
    matching algorithm to either ignore the order of matched RDNs (reordered) or additionally
    (relaxed) accept DNs that contain more RDNs than configured (unmatched RDNs are treated
    like wildcard matches).
  * The updown plugin now passes the same interface to the script that is also used for the
    automatically installed routes, that is, the interface over which the peer is reached
    instead of the interface on which the local address is found (#3095).
  * TPM 2.0 contexts are now protected by a mutex to prevent issues if multiple IKE_SAs use
    the same private key concurrently (4b25885025).
  * Do a rekey check after the third QM message was received (#3060).
  * If available, explicit_bzero() is now used as memwipe() instead of our own implementation.
  * An .editorconfig file has been added, mainly so Github shows files with proper indentation
    (68346b6962).
  * The internal certificate of the load-tester plugin has been modified so it can again be
    used as end-entity cert with 5.6.3 and later (#3139).
  * The maximum data length of received COOKIE notifies (64 bytes) is now enforced (#3160).
  - Version 5.8.0
  ===============
  * The systemd service units have been renamed. The modern unit, which was called
    strongswan-swanctl, is now called strongswan (the previous name is configured as alias in
    the unit, for which a symlink is created when the unit is enabled). The legacy unit is now
    called strongswan-starter.
  * Support for XFRM interfaces (available since Linux 4.19) has been added, which are intended
    to replace VTI devices (they are similar but offer several advantages, for instance, they
    are not bound to an address or address family).
  * IPsec SAs and policies are associated with such interfaces via interface IDs that can be
    configured in swanctl.conf (dynamic IDs may optionally be allocated for each SA and even
    direction). It's possible to use separate interfaces for in- and outbound traffic (or
    only use an interface in one direction and regular policies in the other).
  * Interfaces may be created dynamically via updown/vici scripts, or statically before or after
    establishing the SAs. Routes must be added manually as needed (the daemon will not install
    any routes for outbound policies with an interface ID).
  * When moving XFRM interfaces to other network namespaces they retain access to the SAs and
    policies installed in the original namespace, which allows providing IPsec tunnels for
    processes in other network namespaces without giving them access to the IPsec keys or
    IKE credentials.
    More information can be found on the page about route-based VPNs.
  * Initiation of childless IKE_SAs is supported (RFC 6023). If enabled and supported by the
    responder, no CHILD_SA is established during IKE_AUTH. Instead, all CHILD_SAs are created
    with CREATE_CHILD_SA exchanges. This allows using a separate DH exchange even for the
    first CHILD_SA, which is otherwise created during IKE_AUTH with keys derived from the
    IKE_SA's key material.
  * The swanctl --initiate command may be used to initiate only the IKE_SA via --ike
    option if --child is omitted and the peer supports this extension.
  * The NetworkManager backend and plugin support IPv6.
  * The new wolfssl plugin is a wrapper around the wolfSSL crypto library. Thanks to Sean
    Parkinson of wolfSSL Inc. for the initial patch.
  * IKE SPIs may optionally be labeled via the charon.spi_mask|label options in
    strongswan.conf. This feature was extracted from charon-tkm, however, now applies the
    mask/label in network order.
  * The openssl plugin supports ChaCha20-Poly1305 when built with OpenSSL 1.1.0.
  * The PB-TNC finite state machine according to section 3.2 of RFC 5793 was not correctly
    implemented when sending either a CRETRY or SRETRY batch. These batches can only be sent
    in the "Decided" state and a CRETRY batch can immediately carry all messages usually
    transported by a CDATA batch. It is currently not possible to send a SRETRY batch since
    full-duplex mode for PT-TLS transport is not supported.
  * Instead of marking IPv6 virtual IPs as deprecated, the kernel-netlink plugin now uses
    address labels to avoid that such addresses are used for non-VPN traffic (00a953d090).
  * The agent plugin now creates sockets to the ssh/gpg-agent dynamically and does not keep
    them open, which otherwise might prevent the agent from getting terminated.
  * To avoid broadcast loops the forecast plugin now only reinjects packets that are marked
    or received from the configured interface.
  * UTF-8 encoded passwords are supported via EAP-MSCHAPv2, which internally uses an UTF-16LE
    encoding to calculate the NT hash (#3014).
  * Properly delete temporary drop policies (used when updating IP addresses of SAs) if manual
    priorities are used, which was broken since 5.6.2 (8e31d65730).
  * Avoid overwriting start_action when parsing the inactivity timeout in the vici plugin (#2954).
  * Fixed the automatic termination of reloaded vici connections with start_action=start,
    which was broken since 5.6.3 (71b22c250f).
  * The lookup for shared secrets for IKEv1 SAs via sql plugin should now work better
    (6ec9f68f32).
  * Fixed a race condition in the trap manager between installation and removal of a policy
    (69cbe2ca3f).
  * Compilation of the kernel-netlink plugin has been fixed on old kernels (&lt; 2.6.39), which
    was caused by the HW offload changes (c7f579fa17).
  * The IPsec stack detection and module loading in starter has been removed (it wasn't
    enforced anyway and loading modules doesn't seem necessary, also KLIPS hasn't been
    supported for a long time and PF_KEY will eventually be removed from the Linux kernel,
    ba817d2917).
  * Several IKEv2 protocol details are now handled more strictly: Unrequested virtual IPs are
    ignored, CFG_REPLY payloads are ignored if no CFG_REQUEST payloads were sent, a USE
    TRANSPORT_MODE notify received from the responder is checked against the local configuration.
  * The keys and certificates used by the scenarios in the testing environment are now generated
    dynamically. Running the testing/scripts/build-certs script after creating the base and root
    images uses the pki utility installed in the latter to create the keys and certificates for
    all the CAs and in some cases for individual scenarios. These credentials are stored in the
    source tree, not the image, so this has to be called only once even if the images are later
    rebuilt. The script automatically (re-)rebuilds the guest images as that generates fresh
    CRLs and signs the DNS zones. The only keys/certificates currently not generated are the
    very large ones used by the ikev2/rw-eap-tls-fragments scenario.
  - Version 5.7.2
  ===============
  * For RSA with PSS padding, the TPM 2.0 specification mandates the maximum salt length
    (as defined by the length of the key and hash). However, if the TPM is FIPS-168-4 compliant,
    the salt length equals the hash length. This is assumed for FIPS-140-2 compliant TPMs, but
    if that's not the case, it might be necessary to manually enable charon.plugins.tpm.fips_186_4
    if the TPM doesn't use the maximum salt length.
  * Directories for credentials loaded by swanctl are now accessed relative to the loaded
    swanctl.conf file, in particular, when loading it from a custom location via --file argument.
  * The base directory, which is used if no custom location for swanctl.conf is specified, is now
    also configurable at runtime via SWANCTL_DIR environment variable.
  * If RADIUS Accounting is enabled, the eap-radius plugin will add the session ID (Acct-Session-Id)
    to Access-Request messages, which e.g. simplifies associating database entries for IP leases and
    accounting with sessions (the session ID does not change when IKE_SAs are rekeyed, #2853).
  * All IP addresses assigned by a RADIUS server are included in Accounting-Stop messages even if
    the client did not claim them, allowing to release them early in case of connection errors (#2856).
  * Selectors installed on transport mode SAs by the kernel-netlink plugin are now updated if an
    IP address changes (e.g. via MOBIKE) and it was part of the selectors.
  * No deletes are sent anymore when a rekeyed CHILD_SA expires (#2815).
  * The bypass-lan plugin now tracks interfaces to handle subnets that move from one interface
    to another and properly update associated routes (#2820).
  * Only valid and expected inbound IKEv2 messages are used to update the timestamp of the
    last received message (previously, retransmits also triggered an update).
  * IKEv2 requests from responders are now ignored until the IKE_SA is fully established (e.g. if a
    DPD request from the peer arrives before the IKE_AUTH response does, 46bea1add9).
    Delayed IKE_SA_INIT responses with COOKIE notifies we already recevied are ignored, they caused
    another reset of the IKE_SA previously (#2837).
  * Active and queued Quick Mode tasks are now adopted if the peer reauthenticates an IKEv1 SA
    while creating lots of CHILD_SAs.
  * Newer versions of the FreeBSD kernel add an SADB_X_EXT_SA2 extension to SADB_ACQUIRE
    messages, which allows the kernel-pfkey plugin to determine the reqid of the policy even if it
    wasn't installed by the daemon previously (e.g. when using FreeBSD's if_ipsec(4) VTIs, which
    install policies themselves, 872b9b3e8d).
  * Added support for RSA signatures with SHA-256 and SHA-512 to the agent plugin. For older
    versions of ssh/gpg-agent that only support SHA-1, IKEv2 signature authentication has to be
    disabled via charon.signature_authentication.
  * The sshkey and agent plugins support Ed25519/Ed448 SSH keys and signatures.
  * The openssl plugin supports X25519/X448 Diffie-Hellman and Ed25519/Ed448 keys and
    signatures when built against OpenSSL 1.1.1.
  * Support for Ed25519, ChaCha20/Poly1305, SHA-3 and AES-CCM were added to the botan plugin.
  * The mysql plugin now properly handles database connections with transactions
    under heavy load (#2779).
  * IP addresses in ha pools are now distributed evenly among all segments (#2828).
  * Private key implementations may optionally provide a list of supported signature schemes,
    which, as described above, is used by the tpm plugin because for each key on a TPM 2.0 the
    hash algorithm and for RSA also the padding scheme is predefined.
  * The testing environment is now based on Debian 9 (stretch) by default. This required
    some changes, in particular, updating to FreeRADIUS 3.x (which forced us to abandon the
    TNC@FHH patches and scenarios, 2fbe44bef3) and removing FIPS-enabled versions of
    OpenSSL (the FIPS module only supports OpenSSL 1.0.2).
  * Most test scenarios were migrated to swanctl.
  - Version 5.7.1
  ===============
  * Fixes a vulnerability in the gmp plugin triggered by crafted certificates with RSA keys with
    very small moduli. When verifying signatures with such keys, the code patched with the fix
    for CVE-2018-16151/2 caused an integer underflow and subsequent heap buffer overflow
    that results in a crash of the daemon.
  * The vulnerability has been registered as CVE-2018-17540.
  - Version 5.7.0
  ===============
  * Fixes a potential authorization bypass vulnerability in the gmp plugin that was caused by a
    too lenient verification of PKCS#1 v1.5 signatures. Several flaws could be exploited by a
    Bleichenbacher-style attack to forge signatures for low-exponent keys (i.e. with e=3).
  * CVE-2018-16151 has been assigned to the problem of accepting random bytes after the OID
    of the hash function in such signatures, and CVE-2018-16152 has been assigned to the issue
    of not verifying that the parameters in the ASN.1 algorithmIdentitifer structure is empty.
    Other flaws that don't lead to a vulnerability directly (e.g. not checking for at least
    8 bytes of padding) have no separate CVE assigned.
  * Dots are not allowed anymore in section names in swanctl.conf and strongswan.conf.
    This mainly affects the configuration of file loggers. If the path for such a log file
    contains dots it now has to be configured in the new path setting within the arbitrarily
    renamed subsection in the filelog section.
  * Sections in swanctl.conf and strongswan.conf may now reference other sections. All settings
    and subsections from such a section are inherited. This allows to simplify configs as
    redundant information has only to be specified once and may then be included in other
    sections (see strongswan.conf for an example).
  * The originally selected IKE config (based on the IPs and IKE version) can now change
    if no matching algorithm proposal is found. This way the order of the configs doesn't
    matter that much anymore and it's easily possible to specify separate configs for
    clients that require weaker algorithms (instead of having to also add them in other
    configs that might be selected).
  * Support for Postquantum Preshared Keys for IKEv2 (draft-ietf-ipsecme-qr-ikev2) has been added.
    For an example refer to the swanctl/rw-cert-ppk scenario (or with EAP, or PSK authentication).
  * The new botan plugin is a wrapper around the Botan C++ crypto library.
    It requires a fairly recent build from Botan's master branch (or the upcoming 2.8.0 release).
    Thanks to René Korthaus and his team from Rohde &amp; Schwarz Cybersecurity for the initial
    patch and to Jack Lloyd for quickly adding missing functions to Botan's FFI (C89) interface.
  * Implementation of RFC 8412 "Software Inventory Message and Attributes (SWIMA) for PA-TNC".
  * SWIMA subscription option sets CLOSE_WRITE trigger on apt history.log file resulting in
    a ClientRetry PB-TNC batch to initialize a new measurement cycle. The new imv/imc-swima
    plugins replace the previous imv/imc-swid plugins, which were removed.
  * Added support for fuzzing the PA-TNC (RFC 5792) and PB-TNC (RFC 5793) NEA protocols
    on Google's OSS-Fuzz infrastructure.
  * Support for version 2 of Intel's TPM2-TSS TGC Software Stack. The presence of the
    in-kernel /dev/tpmrm0 resource manager is automatically detected.
  * The pki tool accepts a xmppAddr otherName as a subjectAlternativeName using the
    syntax --san xmppaddr:&lt;jid&gt;.
  * swanctl.conf supports the configuration of marks the in- and/or outbound SA should apply
    to packets after processing on Linux. Configuring such a mark for outbound SAs requires
    at least a 4.14 kernel. The ability to set a mask and configuring a mark/mask for
    inbound SAs will be added with the upcoming 4.19 kernel.
  * New options in swanctl.conf allow configuring how/whether DF, ECN and DS fields in the
    IP headers are copied during IPsec processing. Controlling this is currently only possible
    on Linux.
  * The handling of sequence numbers in IKEv1 DPDs has been improved (#2714).
  * To avoid conflicts, the dhcp plugin now only uses the DHCP server port if explicitly
    configured.
  - Version 5.6.3
  ===============
  * Fixed a DoS vulnerability in the IKEv2 key derivation if the openssl plugin is used in FIPS
    mode and HMAC-MD5 is negotiated as PRF.
    This vulnerability has been registered as CVE-2018-10811.
  * Fixed a vulnerability in the stroke plugin, which did not check the received length before
    reading a message from the socket. Unless a group is configured, root privileges are
    required to access that socket, so in the default configuration this shouldn't be an issue.
    This vulnerability has been registered as CVE-2018-5388.
  * CRLs that are not yet valid are now ignored to avoid problems in scenarios where expired
    certificates are removed from new CRLs and the clock on the host doing the revocation
    check is trailing behind that of the host issuing CRLs. Not doing this could result in
    accepting a revoked and expired certificate, if it's still valid according to the
    trailing clock but not contained anymore in not yet valid CRLs.
  * The issuer of fetched CRLs is now compared to the issuer of the checked certificate (#2608).
  * CRL validation results other than revocation (e.g. a skipped check because the CRL couldn't
    be fetched) are now stored also for intermediate CA certificates and not only for end-entity
    certificates, so a strict CRL policy can be enforced in such cases.
  * In compliance with RFC 4945, section 5.1.3.2, certificates used for IKE must now either
    not contain a keyUsage extension (like the ones generated by pki), or have at least one of the
    digitalSignature or nonRepudiation bits set.
  * New options for vici/swanctl allow forcing the local termination of an IKE_SA. This might be
    useful in situations where it's known the other end is not reachable anymore, or that it
    already removed the IKE_SA, so retransmitting a DELETE and waiting for a response would
    be pointless.
  * Waiting only a certain amount of time for a response (i.e. shorter than all retransmits
    would be) before destroying the IKE_SA is also possible by additionally specifying a
    timeout in the forced termination request.
  * When removing routes, the kernel-netlink plugin now checks if it tracks other routes for
    the same destination and replaces the installed route instead of just removing it. Same
    during installation, where existing routes previously weren't replaced. This should allow
    using traps with virtual IPs on Linux (#2162).
  * The dhcp plugin now only sends the client identifier DHCP option if the identity_lease
    setting is enabled (7b660944b6). It can also send identities of up to 255 bytes length,
    instead of the previous 64 bytes (30e886fe3b, 0e5b94d038). If a server address is
    configured, DHCP requests are now sent from port 67 instead of 68 to avoid ICMP port
    unreachables (becf027cd9).
  * The handling of faulty INVALID_KE_PAYLOAD notifies (e.g. one containing a DH group
    that wasn't proposed) during CREATE_CHILD_SA exchanges has been improved (#2536).
  * Roam events are now completely ignored for IKEv1 SAs (there is no MOBIKE to handle such
    changes properly).
  * ChaCha20/Poly1305 is now correctly proposed without key length (#2614). For compatibility with
    older releases the chacha20poly1305compat keyword may be included in proposals to also propose
    the algorithm with a key length (c58434aeff).
  * Configuration of hardware offload of IPsec SAs is now more flexible and allows a new
    setting (auto), which automatically uses it if the kernel and device both support it. If hw
    offload is set to yes and offloading is not supported, the CHILD_SA installation now fails.
  * The kernel-pfkey plugin optionally installs routes via internal interface (one with an IP
    in the local traffic selector). On FreeBSD, enabling this selects the correct source IP
    when sending packets from the gateway itself (e811659323).
  * SHA-2 based PRFs are supported in PKCS#8 files as generated by OpenSSL 1.1 (#2574).
  * The pki --verify tool may load CA certificates and CRLs from directories.
  * The IKE daemon now also switches to port 4500 if the remote port is not 500 (e.g. because the
    remote maps the response to a different port, as might happen on Azure), as long as the local
    port is 500 (85bfab621d).
  * Fixed an issue with DNS servers passed to NetworkManager in charon-nm (ee8c25516a).
  * Logged traffic selectors now always contain the protocol if either protocol or port are set
    (a36d8097ed).
  * Only the inbound SA/policy will be updated as reaction to IP address changes for rekeyed
    CHILD_SAs that are kept around.
  * The parser for strongswan.conf/swanctl.conf now accepts = characters in values without
    having to put the value in quotes (e.g. for Base64 encoded shared secrets).
    Notes for developers:
  * trap_manager_t: Trap policies are now unistalled by peer/child name and not the reqid.
  * No reqid is returned anymore when installing trap policies.
  * child_sa_t: A new state (CHILD_DELETED) is used for CHILD_SAs that have been deleted but
    not yet destroyed (after a rekeying CHILD_SAs are kept around for a while to process
    delayed packets).
    This way child_updown events are not triggered anymore for such SAs when an IKE_SA that
    has such CHILD_SAs assigned is deleted.
  - Version 5.6.2
  ===============
  * Fixed a DoS vulnerability in the parser for PKCS#1 RSASSA-PSS signatures that was caused
    by insufficient input validation. One of the configurable parameters in algorithm identifier
    structures for RSASSA-PSS signatures is the mask generation function (MGF). Only MGF1 is
    currently specified for this purpose. However, this in turn takes itself a parameter that
    specifies the underlying hash function. strongSwan's parser did not correctly handle the
    case of this parameter being absent, causing an undefined data read.
    This vulnerability has been registered as CVE-2018-6459.
  * When rekeying IKEv2 IKE_SAs the previously negotiated DH group will be reused, instead of
    using the first configured group, which avoids an additional exchange if the peer previously
    selected a different DH group via INVALID_KE_PAYLOAD notify. The same is also done when
    rekeying CHILD_SAs except for the first rekeying of the CHILD_SA that was created with the
    IKE_SA, where no DH group was negotiated yet.
    Also, the selected DH group is moved to the front in all sent proposals that contain it
    and all proposals that don't are moved to the back in order to convey the preference for
    this group to the peer.
  * Handling of MOBIKE task queuing has been improved. In particular, the response to an
    address update (with NAT-D payloads) is not ignored anymore if only an address list update
    or DPD is queued as that could prevent updating the UDP encapsulation in the kernel.
  * On Linux, roam events may optionally be triggered by changes to the routing rules, which
    can be useful if routing rules (instead of e.g. route metrics) are used to switch from one
    to another interface (i.e. from one to another routing table). Since routing rules are
    currently not evaluated when doing route lookups this is only useful if the kernel-based
    route lookup is used (4664992f7d).
  * The fallback drop policies installed to avoid traffic leaks when replacing addresses in
    installed policies are now replaced by temporary drop policies, which also prevent
    acquires because we currently delete and reinstall IPsec SAs to update their addresses
    (35ef1b032d).
  * Access X.509 certificates held in non-volatile storage of a TPM 2.0 referenced via the
    NV index.
    Adding the --keyid parameter to pki --print allows to print private keys or certificates
    stored in a smartcard or a TPM 2.0.
  * Fixed proposal selection if a peer incorrectly sends DH groups in the ESP proposal during
    IKE_AUTH and also if a DH group is configured in the local ESP proposal and charon.prefer
    configured_proposals is disabled (d058fd3c32).
  * The lookup for PSK secrets for IKEv1 has been improved for certain scenarios (see #2497
    for details).
  * MSKs received via RADIUS are now padded to 64 bytes to avoid compatibility issues with
    EAP-MSCHAPv2 and PRFs that have a block size &lt; 64 bytes (e.g. AES-XCBC-PRF-128, see
    73cbce6013).
  * The tpm_extendpcr command line tool extends a digest into a TPM PCR.
  * Ported the NetworkManager backend from the deprecated libnm-glib to libnm.
  * The save-keys debugging/development plugin saves IKE and/or ESP keys to files compatible
    with Wireshark.
  - Version 5.6.1
  ===============
  * Several algorithms were removed from the default ESP/AH and IKE proposals in compliance with
    RFC 8221 and RFC 8247, respectively. Removed from the default ESP/AH proposal were the
    3DES and Blowfish encryption algorithms and the HMAC-MD5 integrity algorithm. From the IKE
    default proposal the HMAC-MD5 integrity algorithm and the MODP-1024 Diffie-Hellman group
    were removed (the latter is significant for Windows clients in their default configuration).
    These algorithms may still be used in custom proposals.
  * Support for RSASSA-PSS signatures has been added. For compatibility with previous
    releases they are currently not used automatically, by default, to change that charon.rsa_pss
    may be enabled. To explicitly use or require such signatures during IKEv2 signature
    authentication (RFC 7427) ike:rsa/pss... authentication constraints may be used for specific
    connections (regardless of whether the strongswan.conf option above is enabled). Only the
    hash algorithm can be specified in such constraints, the MGF1 will be based on that hash
    and the salt length will equal the hash length (when verifying the salt length is not
    enforced).
    To enforce such signatures during PKI verification use rsa/pss... authentication constraints.
  * All pki commands that create certificates/CRLs can be made to sign with RSASSA-PSS instead
    of the classing PKCS#1 scheme with the --rsa-padding pss option. As with signatures during
    authentication, only the hash algorithm is configurable (via --digest option), the MGF1 will
    be based on that and the salt length will equal the hash length.
  * These signatures are supported by all RSA backends except pkcs11 (i.e. gmp, gcrypt, openssl).
    The gmp plugin requires the mgf1 plugin.
    Note that RSASSA-PSS algorithm identifiers and parameters in keys (public keys in
    certificates or private keys in PKCS#8 files) are currently not used as constraints.
  * The sec-updater tool checks for security updates in dpkg-based repositories
    (e.g. Debian/Ubuntu) and sets the security flags in the IMV policy database accordingly.
    Additionally for each new package version a SWID tag for the given OS and HW architecture
    is created and stored in the database.
  * Using the sec-updater.sh script template the lookup can be automated (e.g. via an hourly
    cron job).
  * When restarting an IKEv2 negotiation after receiving an INVALID_KE_PAYLOAD notify (or due
    to other reasons like too many retransmits) a new initiator SPI is allocated. This
    prevents issues caused by retransmits for IKE_SA_INIT messages.
  * Because the initiator SPI was previously reused when restarting the connection delayed
    responses for previous connection attempts were processed and might have caused fatal
    errors due to a failed DH negotiation or because of the internal retry counter in the
    ike-init task. For instance, if we proposed a DH group the responder rejected we
    might have later received delayed responses that either contained INVALID_KE_PAYLOAD
    notifies with the DH group we already switched to, or, if we retransmitted an
    IKE_SA_INIT with the requested group but then had to restart again, a KE payload with
    a group different from the one we proposed.
  * The introduction of file versions in the IMV database scheme broke file reference hash
    measurements. This has been fixed by creating generic product versions having an empty
    package name.
  * A new timeout option for the systime-fix plugin stops periodic system time checks after
    a while and enforces a certificate verification, closing or reauthenticating all SAs
    with invalid certificates.
  * The IKE event counters, previously only available via ipsec listcounters command, may
    now also be queried and reset via vici and the new swanctl --counters command. They
    are collected and provided by the optional counters plugin (enabled by default for
    backwards compatibility if the stroke plugin is built).
  * Class attributes received in RADIUS Access-Accept messages may optionally be added to
    RADIUS accounting messages (655924074b).
  * Basic support for systemd sockets has been added, which may be used for privilege separation
    (59db98fb94).
  * Inbound marks may optionally be installed in the SA again (was removed with 5.5.2) by
    enabling the mark_in_sa option in swanctl.conf.
  * The timeout of leases in pools configured via pool utility may be configured in other
    units than hours.
    INITIAL_CONTACT notifies are now only omitted if never is configured as uniqueness policy.
  * Outbound FWD policies for shunts are not installed anymore, by default (as is the case
    for other policies since 5.5.1).
  * Don't consider a DH group mismatch during CHILD_SA rekeying as failure as responder
    (e7276f78aa).
  * Handling of fragmented IPv4 and IPv6 packets in libipsec has been improved (e138003de9).
  * Trigger expire events for the correct IPsec SA in libipsec (6e861947a0).
  * A crash in CRL verification via openssl plugin using OpenSSL 1.1 has been fixed (78acaba6a1).
  * No hard-coded default proposals are passed from starter to the stroke plugin anymore (the
    IKE proposal used curve25519 since 5.5.2, which is an optional plugin).
  * A workaround for an issue with virtual IPs on macOS 10.13 (High Sierra) has been added
    (039b85dd43).
  * Handling of IKE_SA rekey collisions in charon-tkm has been fixed.
  * Instead of failing or just silently doing nothing unit tests may now warn about certain
    conditions (e.g. if a test was not executed due to external dependencies).</changelog>
  <changelog author="mmnelemane@suse.com" date="1585224000">- Fix for to resolve multiple definition of swanctl_dir (bsc #1164493)
  [+ 0006-Resolve-multiple-definition-of-swanctl_dir.patch]</changelog>
  <changelog author="mbuil@suse.com" date="1610712000">- Fix typo in README (bsc #1167880)
  [+ 0007-Fix-typo-in-README.patch ]</changelog>
  <changelog author="mbuil@suse.com" date="1611576000">- Fix FIPS bug (bsc #1180801)
  [+ 0008-gcrypt-Use-a-dummy-buffer-to-initialize-static-alloc.patch ]</changelog>
  <changelog author="mbuil@suse.com" date="1617019200">- Keep using ipsec as the main binary. Therefore, make strongswan.service point to it instead of swanctl</changelog>
  <changelog author="mbuil@suse.com" date="1617019201">- Information added in README about the rcstrongswan-starter</changelog>
  <changelog author="mbuil@suse.com" date="1617624000">- Add config to run ipsec on namespaces (bsc #1183670)</changelog>
  <changelog author="mt@suse.com" date="1619006400">- Add support for AES CCM aead algorithms to openssl plugin (cc/fips,bsc#1185363)
  [+ 0009-strongswan-openssl-aead-add-ccm-support.patch]</changelog>
  <changelog author="mt@suse.com" date="1620388800">- Replace AEAD AES CCM patch with upstream variant (cc/fips,bsc#1185363)
  [* 0009-strongswan-openssl-aead-add-ccm-support.patch]</changelog>
  <changelog author="hare@suse.de" date="1627646400">- Add auth_els plugin to support Marvell FC-SP encryption (jsc#SLE-20151)
  [* strongswan-marvell-auth-els.patch]</changelog>
  <changelog author="abergmann@suse.com" date="1634040000">- Fix integer overflow in gmp plugin (bsc#1191367, CVE-2021-41990)
  [* strongswan-5.6.1-5.9.3_gmp-rsa-ssa-salt-len.patch]
- Fix integer overflow when replacing certificates in cache (bsc#1191435, CVE-2021-41991)
  [* strongswan-4.4.1-5.9.3_cert-cache-random.patch]</changelog>
  <changelog author="meissner@suse.com" date="1643025600">- strongswan-5.5.0-5.9.4_eap_success-CVE-2021-45079.patch:
  Fixed authentication bypass in EAP authentication (CVE-2021-45079
  bsc#1194471)</changelog>
</package>
<package pkgid="1f7329399e3e603cedee48fed8d7c58e73882414f8935d28d13202e3827325a5" name="strongswan-mysql" arch="x86_64">
  <version epoch="0" ver="5.8.2" rel="11.24.1"/>
  <changelog author="ndas@suse.de" date="1501502400">- Updated to strongSwan 5.3.5(bsc#1050691) providing the following changes:
  * Fixed a DoS vulnerability in the gmp plugin that was caused by insufficient input
    validation when verifying RSA signatures. More specifically, mpz_powm_sec() has two
    requirements regarding the passed exponent and modulus that the plugin did not
    enforce, if these are not met the calculation will result in a floating point exception
    that crashes the whole process.
    This vulnerability has been registered as CVE-2017-9022.
    Please refer to our blog for details.
  * Fixed a DoS vulnerability in the x509 plugin that was caused because the ASN.1 parser
    didn't handle ASN.1 CHOICE types properly, which could result in an infinite loop when
    parsing X.509 extensions that use such types.
    This vulnerability has been registered as CVE-2017-9023.
    Please refer to our blog for details.
  * The behavior during IKEv2 CHILD_SA rekeying has been changed in order to avoid
    traffic loss. When responding to a CREATE_CHILD_SA request to rekey a CHILD_SA
    the responder already has everything available to install and use the new CHILD_SA.
    However, this could lead to lost traffic as the initiator won't be able to process
    inbound packets until it processed the CREATE_CHILD_SA response and updated the
    inbound SA. To avoid this the responder now only installs the new inbound SA and
    delays installing the outbound SA until it receives the DELETE for the replaced CHILD_SA.
  * The messages transporting these DELETEs could reach the peer before packets sent
    with the deleted outbound SAs reach it. To reduce the chance of traffic loss due
    to this the inbound SA of the replaced CHILD_SA is not removed for a configurable
    amount of seconds (charon.delete_rekeyed_delay) after the DELETE has been processed.
  * The code base has been ported to Apple's ARM64 iOS platform, which required several
    changes regarding the use of variadic functions. This was necessary because the calling
    conventions for variadic and regular functions are different there.
    This means that assigning a non-variadic function to a variadic function pointer, as we
    did with our enumerator_t::enumerate() implementations and several callbacks, will
    result in crashes as the called function accesses the arguments differently than the
    caller provided them. To avoid this issue the enumerator_t interface has been changed
    and the signature of the callback functions for enumerator_create_filter() and two
    methods on linked_list_t have been changed. Refer to the developer notes below
    for details.
  * Adds support for fuzzing the certificate parser provided by the default plugins
    (x509, pem, gmp etc.) on Google's OSS-Fuzz infrastructure (or generally with
    libFuzzer). Several issues found while fuzzing these plugins were fixed.
  * Two new options have been added to charon's retransmission settings:
    retransmit_limit and retransmit_jitter. The former adds an upper limit to the
    calculated retransmission timeout, the latter randomly reduces it.
    Refer to Retransmission for details.
  * A bug in swanctl's --load-creds command was fixed that caused unencrypted
    private keys to get unloaded if the command was called multiple times.
    The load-key VICI command now returns the key ID of the loaded key on success.
  * The credential manager now enumerates local credential sets before global ones.
    This means certificates supplied by the peer will now be preferred over certificates
    with the same identity that may be locally stored (e.g. in the certificate cache).
  * Adds support for hardware offload of IPsec SAs as introduced by Linux 4.11 for
    specific hardware that supports this.
  * The pki tool loads the curve25519 plugin by default.
    [- 0006-Make-sure-the-modulus-is-odd-and-the-exponent-not-zero.patch,
  - 0007-asn1-parser-Fix-CHOICE-parsing.patch]
- libhydra is removed as all kernel plugins moved to libcharon</changelog>
  <changelog author="ndas@suse.de" date="1504612800">- fix "uintptr_t? undeclared" compilation error.
  [+0006-fix-compilation-error-by-adding-stdint.h.patch]</changelog>
  <changelog author="ndas@suse.de" date="1504612801">- Updated to strongSwan 5.6.0 providing the following changes:
  * Fixed a DoS vulnerability in the gmp plugin that was caused by insufficient input validation
    when verifying RSA signatures, which requires decryption with the operation m^e mod n,
    where m is the signature, and e and n are the exponent and modulus of the public key.
    The value m is an integer between 0 and n-1, however, the gmp plugin did not verify this.
    So if m equals n the calculation results in 0, in which case mpz_export() returns NULL.
    This result wasn't handled properly causing a null-pointer dereference.
    This vulnerability has been registered as CVE-2017-11185. (bsc#1051222)
  * New SWIMA IMC/IMV pair implements the draft-ietf-sacm-nea-swima-patnc Internet
    Draft and has been demonstrated at the IETF 99 Prague Hackathon.
  * The IMV database template has been adapted to achieve full compliance with the
    ISO 19770-2:2015 SWID tag standard.
  * The pt-tls-client can attach and use TPM 2.0 protected private keys via the --keyid parameter.
  * By default the /etc/swanctl/conf.d directory is created and *.conf files in it are included in the default
    swanctl.conf file.
  * The curl plugin now follows HTTP redirects (configurable via strongswan.conf).
  * The CHILD_SA rekeying was fixed in charon-tkm and the behavior is refined a bit more since 5.5.3
  * libtpmtss supports Intel's TSS2 Architecture Broker and Resource Manager interface (tcti-tabrmd).
  * more on https://wiki.strongswan.org/versions/66</changelog>
  <changelog author="mmnelemane@suse.com" date="1521028800">- Removed unused requires and macro calls(bsc#1083261)</changelog>
  <changelog author="mmnelemane@suse.com" date="1573646400">- Added patch to fix vulnerability: CVE-2018-16151,CVE-2018-16152 (bsc#1107874)
  - Insufficient input validation in gmp plugin
  [+ 0007-strongswan-5.3.1-5.6.0_gmp-pkcs1-verify.patch]</changelog>
  <changelog author="mmnelemane@suse.com" date="1573646401">- Added patch to fix vulnerability: CVE-2018-5388 (bsc#1094462)
  - Buffer Underflow in stroke_socket.c
  [+ 0008-strongswan-5.1.2-5.6.2_stroke_msg_len.patch]</changelog>
  <changelog author="mmnelemane@suse.com" date="1573646402">- Added patch to fix vulnerability: CVE-2018-10811 (bsc#1093536)
  - denial-of-service vulnerability
  [+ 0009-strongswan-5.5.0-5.6.2_skeyseed_init.patch]</changelog>
  <changelog author="mmnelemane@suse.com" date="1573732800">- Added patch to fix vulnerability: CVE-2018-17540 (bsc#1109845)
  [+ 0010-strongswan-4.4.0-5.7.0_gmp-pkcs1-overflow.patch]</changelog>
  <changelog author="mmnelemane@suse.com" date="1580212800">- Updated to version 5.8.2 (jsc#SLE-11370)
  - Dropped following patches due to irrelevance in the updated version:
    [- strongswan_modprobe_syslog.patch ]
    [- strongswan_fipsfilter.patch ]
    [- 0006-fix-compilation-error-by-adding-stdint.h.patch ]
    [- 0007-strongswan-5.3.1-5.6.0_gmp-pkcs1-verify.patch ]
    [- 0008-strongswan-5.1.2-5.6.2_stroke_msg_len.patch ]
    [- 0009-strongswan-5.5.0-5.6.2_skeyseed_init.patch ]
    [- 0010-strongswan-4.4.0-5.7.0_gmp-pkcs1-overflow.patch ]
  - Version 5.8.2
  ===============
  * Identity-based CA constraints, which enforce that the certificate chain of the remote
    peer contains a CA certificate with a specific identity, are supported via
    vici/swanctl.conf. This is similar to the existing CA constraints but doesn't require
    that the CA certificate is locally installed, for instance, intermediate CA certificates
    received from the peers. Wildcard identity matching (e.g. ..., OU=Research, CN=*) could
    also be used for the latter but requires trust in the intermediate CAs to only issue
    certificates with legitimate subject DNs (e.g. the "Sales" CA must not issue certificates
    with OU=Research). With the new constraint that's not necessary as long as a path length
    basic constraint (--pathlen for pki --issue) prevents intermediate CAs from issuing further
    intermediate CAs.
  * Intermediate CA certificates may now be sent in hash-and-URL encoding by configuring a
    base URL for the parent CA (#3234, swanctl/rw-hash-and-url-multi-level).
  * Implemented NIST SP-800-90A Deterministic Random Bit Generator (DRBG) based on AES-CTR
    and SHA2-HMAC modes. Currently used by the gmp and ntru plugins.
  * Random nonces sent in an OCSP requests are now expected in the corresponding OCSP responses.
  * The kernel-netlink plugin now ignores deprecated IPv6 addresses for MOBIKE. Whether temporary
    or permanent IPv6 addresses are included now depends on the charon.prefer_temporary_addrs
    setting (#3192).
  * Extended Sequence Numbers (ESN) are configured via PF_KEY if supported by the kernel.
  * The PF_KEY socket's receive buffer in the kernel-pfkey plugin is now cleared before sending
    requests, as many of the messages sent by the kernel are sent as broadcasts to all PF_KEY
    sockets. This is an issue if an external tool is used to manage SAs/policies unrelated to
    IPsec (#3225).
  * The vici plugin now uses unique section names for CHILD_SAs in child-updown events (7c74ce9190).
  * For individually deleted CHILD_SAs (in particular for IKEv1) the vici child-updown event
    now includes more information about the CHILD_SAs such as traffic statistics (#3198).
  * Custom loggers are correctly re-registered if log levels are changed via stroke loglevel (#3182).
  * Avoid lockups during startup on low entropy systems when using OpenSSL 1.1.1 (095a2c2eac).
  * Instead of failing later when setting a key, creating HMACs via openssl plugin now fails
    instantly if the underlying hash algorithm isn't supported (e.g. MD5 in FIPS-mode) so fallbacks
    to other plugins work properly (#3284).
  * Exponents of RSA keys read from TPM 2.0 via SAPI are correctly converted (8ee1242f1438).
  * Routing table IDs &gt; 255 are supported for custom routes on Linux.
  * To avoid races, the check for hardware offloading support in the kernel-netlink plugin is
    performed during initialization of the plugin (a605452c03).
  * The D-Bus config file for charon-nm is now installed in $(datadir)/dbus-1/system.d instead of
    $(sysconfdir)/dbus-1/system.d, which is intended for sysadmin overrides.
    INVALID_MAJOR_VERSION notifies are now correctly sent in messages of the same exchange type
    and with the same message ID as the request.
  * IKEv2 SAs are now immediately destroyed when sending or receiving INVALID_SYNTAX notifies
    in authenticated messages.
  * For developers working from the repository the configure script now aborts if GNU gperf is
    not found.
  - Version 5.8.1
  ===============
  * RDNs in DNs of X.509 certificates can now optionally be matched less strict. The global
    strongswan.conf option charon.rdn_matching takes two alternative values that cause the
    matching algorithm to either ignore the order of matched RDNs (reordered) or additionally
    (relaxed) accept DNs that contain more RDNs than configured (unmatched RDNs are treated
    like wildcard matches).
  * The updown plugin now passes the same interface to the script that is also used for the
    automatically installed routes, that is, the interface over which the peer is reached
    instead of the interface on which the local address is found (#3095).
  * TPM 2.0 contexts are now protected by a mutex to prevent issues if multiple IKE_SAs use
    the same private key concurrently (4b25885025).
  * Do a rekey check after the third QM message was received (#3060).
  * If available, explicit_bzero() is now used as memwipe() instead of our own implementation.
  * An .editorconfig file has been added, mainly so Github shows files with proper indentation
    (68346b6962).
  * The internal certificate of the load-tester plugin has been modified so it can again be
    used as end-entity cert with 5.6.3 and later (#3139).
  * The maximum data length of received COOKIE notifies (64 bytes) is now enforced (#3160).
  - Version 5.8.0
  ===============
  * The systemd service units have been renamed. The modern unit, which was called
    strongswan-swanctl, is now called strongswan (the previous name is configured as alias in
    the unit, for which a symlink is created when the unit is enabled). The legacy unit is now
    called strongswan-starter.
  * Support for XFRM interfaces (available since Linux 4.19) has been added, which are intended
    to replace VTI devices (they are similar but offer several advantages, for instance, they
    are not bound to an address or address family).
  * IPsec SAs and policies are associated with such interfaces via interface IDs that can be
    configured in swanctl.conf (dynamic IDs may optionally be allocated for each SA and even
    direction). It's possible to use separate interfaces for in- and outbound traffic (or
    only use an interface in one direction and regular policies in the other).
  * Interfaces may be created dynamically via updown/vici scripts, or statically before or after
    establishing the SAs. Routes must be added manually as needed (the daemon will not install
    any routes for outbound policies with an interface ID).
  * When moving XFRM interfaces to other network namespaces they retain access to the SAs and
    policies installed in the original namespace, which allows providing IPsec tunnels for
    processes in other network namespaces without giving them access to the IPsec keys or
    IKE credentials.
    More information can be found on the page about route-based VPNs.
  * Initiation of childless IKE_SAs is supported (RFC 6023). If enabled and supported by the
    responder, no CHILD_SA is established during IKE_AUTH. Instead, all CHILD_SAs are created
    with CREATE_CHILD_SA exchanges. This allows using a separate DH exchange even for the
    first CHILD_SA, which is otherwise created during IKE_AUTH with keys derived from the
    IKE_SA's key material.
  * The swanctl --initiate command may be used to initiate only the IKE_SA via --ike
    option if --child is omitted and the peer supports this extension.
  * The NetworkManager backend and plugin support IPv6.
  * The new wolfssl plugin is a wrapper around the wolfSSL crypto library. Thanks to Sean
    Parkinson of wolfSSL Inc. for the initial patch.
  * IKE SPIs may optionally be labeled via the charon.spi_mask|label options in
    strongswan.conf. This feature was extracted from charon-tkm, however, now applies the
    mask/label in network order.
  * The openssl plugin supports ChaCha20-Poly1305 when built with OpenSSL 1.1.0.
  * The PB-TNC finite state machine according to section 3.2 of RFC 5793 was not correctly
    implemented when sending either a CRETRY or SRETRY batch. These batches can only be sent
    in the "Decided" state and a CRETRY batch can immediately carry all messages usually
    transported by a CDATA batch. It is currently not possible to send a SRETRY batch since
    full-duplex mode for PT-TLS transport is not supported.
  * Instead of marking IPv6 virtual IPs as deprecated, the kernel-netlink plugin now uses
    address labels to avoid that such addresses are used for non-VPN traffic (00a953d090).
  * The agent plugin now creates sockets to the ssh/gpg-agent dynamically and does not keep
    them open, which otherwise might prevent the agent from getting terminated.
  * To avoid broadcast loops the forecast plugin now only reinjects packets that are marked
    or received from the configured interface.
  * UTF-8 encoded passwords are supported via EAP-MSCHAPv2, which internally uses an UTF-16LE
    encoding to calculate the NT hash (#3014).
  * Properly delete temporary drop policies (used when updating IP addresses of SAs) if manual
    priorities are used, which was broken since 5.6.2 (8e31d65730).
  * Avoid overwriting start_action when parsing the inactivity timeout in the vici plugin (#2954).
  * Fixed the automatic termination of reloaded vici connections with start_action=start,
    which was broken since 5.6.3 (71b22c250f).
  * The lookup for shared secrets for IKEv1 SAs via sql plugin should now work better
    (6ec9f68f32).
  * Fixed a race condition in the trap manager between installation and removal of a policy
    (69cbe2ca3f).
  * Compilation of the kernel-netlink plugin has been fixed on old kernels (&lt; 2.6.39), which
    was caused by the HW offload changes (c7f579fa17).
  * The IPsec stack detection and module loading in starter has been removed (it wasn't
    enforced anyway and loading modules doesn't seem necessary, also KLIPS hasn't been
    supported for a long time and PF_KEY will eventually be removed from the Linux kernel,
    ba817d2917).
  * Several IKEv2 protocol details are now handled more strictly: Unrequested virtual IPs are
    ignored, CFG_REPLY payloads are ignored if no CFG_REQUEST payloads were sent, a USE
    TRANSPORT_MODE notify received from the responder is checked against the local configuration.
  * The keys and certificates used by the scenarios in the testing environment are now generated
    dynamically. Running the testing/scripts/build-certs script after creating the base and root
    images uses the pki utility installed in the latter to create the keys and certificates for
    all the CAs and in some cases for individual scenarios. These credentials are stored in the
    source tree, not the image, so this has to be called only once even if the images are later
    rebuilt. The script automatically (re-)rebuilds the guest images as that generates fresh
    CRLs and signs the DNS zones. The only keys/certificates currently not generated are the
    very large ones used by the ikev2/rw-eap-tls-fragments scenario.
  - Version 5.7.2
  ===============
  * For RSA with PSS padding, the TPM 2.0 specification mandates the maximum salt length
    (as defined by the length of the key and hash). However, if the TPM is FIPS-168-4 compliant,
    the salt length equals the hash length. This is assumed for FIPS-140-2 compliant TPMs, but
    if that's not the case, it might be necessary to manually enable charon.plugins.tpm.fips_186_4
    if the TPM doesn't use the maximum salt length.
  * Directories for credentials loaded by swanctl are now accessed relative to the loaded
    swanctl.conf file, in particular, when loading it from a custom location via --file argument.
  * The base directory, which is used if no custom location for swanctl.conf is specified, is now
    also configurable at runtime via SWANCTL_DIR environment variable.
  * If RADIUS Accounting is enabled, the eap-radius plugin will add the session ID (Acct-Session-Id)
    to Access-Request messages, which e.g. simplifies associating database entries for IP leases and
    accounting with sessions (the session ID does not change when IKE_SAs are rekeyed, #2853).
  * All IP addresses assigned by a RADIUS server are included in Accounting-Stop messages even if
    the client did not claim them, allowing to release them early in case of connection errors (#2856).
  * Selectors installed on transport mode SAs by the kernel-netlink plugin are now updated if an
    IP address changes (e.g. via MOBIKE) and it was part of the selectors.
  * No deletes are sent anymore when a rekeyed CHILD_SA expires (#2815).
  * The bypass-lan plugin now tracks interfaces to handle subnets that move from one interface
    to another and properly update associated routes (#2820).
  * Only valid and expected inbound IKEv2 messages are used to update the timestamp of the
    last received message (previously, retransmits also triggered an update).
  * IKEv2 requests from responders are now ignored until the IKE_SA is fully established (e.g. if a
    DPD request from the peer arrives before the IKE_AUTH response does, 46bea1add9).
    Delayed IKE_SA_INIT responses with COOKIE notifies we already recevied are ignored, they caused
    another reset of the IKE_SA previously (#2837).
  * Active and queued Quick Mode tasks are now adopted if the peer reauthenticates an IKEv1 SA
    while creating lots of CHILD_SAs.
  * Newer versions of the FreeBSD kernel add an SADB_X_EXT_SA2 extension to SADB_ACQUIRE
    messages, which allows the kernel-pfkey plugin to determine the reqid of the policy even if it
    wasn't installed by the daemon previously (e.g. when using FreeBSD's if_ipsec(4) VTIs, which
    install policies themselves, 872b9b3e8d).
  * Added support for RSA signatures with SHA-256 and SHA-512 to the agent plugin. For older
    versions of ssh/gpg-agent that only support SHA-1, IKEv2 signature authentication has to be
    disabled via charon.signature_authentication.
  * The sshkey and agent plugins support Ed25519/Ed448 SSH keys and signatures.
  * The openssl plugin supports X25519/X448 Diffie-Hellman and Ed25519/Ed448 keys and
    signatures when built against OpenSSL 1.1.1.
  * Support for Ed25519, ChaCha20/Poly1305, SHA-3 and AES-CCM were added to the botan plugin.
  * The mysql plugin now properly handles database connections with transactions
    under heavy load (#2779).
  * IP addresses in ha pools are now distributed evenly among all segments (#2828).
  * Private key implementations may optionally provide a list of supported signature schemes,
    which, as described above, is used by the tpm plugin because for each key on a TPM 2.0 the
    hash algorithm and for RSA also the padding scheme is predefined.
  * The testing environment is now based on Debian 9 (stretch) by default. This required
    some changes, in particular, updating to FreeRADIUS 3.x (which forced us to abandon the
    TNC@FHH patches and scenarios, 2fbe44bef3) and removing FIPS-enabled versions of
    OpenSSL (the FIPS module only supports OpenSSL 1.0.2).
  * Most test scenarios were migrated to swanctl.
  - Version 5.7.1
  ===============
  * Fixes a vulnerability in the gmp plugin triggered by crafted certificates with RSA keys with
    very small moduli. When verifying signatures with such keys, the code patched with the fix
    for CVE-2018-16151/2 caused an integer underflow and subsequent heap buffer overflow
    that results in a crash of the daemon.
  * The vulnerability has been registered as CVE-2018-17540.
  - Version 5.7.0
  ===============
  * Fixes a potential authorization bypass vulnerability in the gmp plugin that was caused by a
    too lenient verification of PKCS#1 v1.5 signatures. Several flaws could be exploited by a
    Bleichenbacher-style attack to forge signatures for low-exponent keys (i.e. with e=3).
  * CVE-2018-16151 has been assigned to the problem of accepting random bytes after the OID
    of the hash function in such signatures, and CVE-2018-16152 has been assigned to the issue
    of not verifying that the parameters in the ASN.1 algorithmIdentitifer structure is empty.
    Other flaws that don't lead to a vulnerability directly (e.g. not checking for at least
    8 bytes of padding) have no separate CVE assigned.
  * Dots are not allowed anymore in section names in swanctl.conf and strongswan.conf.
    This mainly affects the configuration of file loggers. If the path for such a log file
    contains dots it now has to be configured in the new path setting within the arbitrarily
    renamed subsection in the filelog section.
  * Sections in swanctl.conf and strongswan.conf may now reference other sections. All settings
    and subsections from such a section are inherited. This allows to simplify configs as
    redundant information has only to be specified once and may then be included in other
    sections (see strongswan.conf for an example).
  * The originally selected IKE config (based on the IPs and IKE version) can now change
    if no matching algorithm proposal is found. This way the order of the configs doesn't
    matter that much anymore and it's easily possible to specify separate configs for
    clients that require weaker algorithms (instead of having to also add them in other
    configs that might be selected).
  * Support for Postquantum Preshared Keys for IKEv2 (draft-ietf-ipsecme-qr-ikev2) has been added.
    For an example refer to the swanctl/rw-cert-ppk scenario (or with EAP, or PSK authentication).
  * The new botan plugin is a wrapper around the Botan C++ crypto library.
    It requires a fairly recent build from Botan's master branch (or the upcoming 2.8.0 release).
    Thanks to René Korthaus and his team from Rohde &amp; Schwarz Cybersecurity for the initial
    patch and to Jack Lloyd for quickly adding missing functions to Botan's FFI (C89) interface.
  * Implementation of RFC 8412 "Software Inventory Message and Attributes (SWIMA) for PA-TNC".
  * SWIMA subscription option sets CLOSE_WRITE trigger on apt history.log file resulting in
    a ClientRetry PB-TNC batch to initialize a new measurement cycle. The new imv/imc-swima
    plugins replace the previous imv/imc-swid plugins, which were removed.
  * Added support for fuzzing the PA-TNC (RFC 5792) and PB-TNC (RFC 5793) NEA protocols
    on Google's OSS-Fuzz infrastructure.
  * Support for version 2 of Intel's TPM2-TSS TGC Software Stack. The presence of the
    in-kernel /dev/tpmrm0 resource manager is automatically detected.
  * The pki tool accepts a xmppAddr otherName as a subjectAlternativeName using the
    syntax --san xmppaddr:&lt;jid&gt;.
  * swanctl.conf supports the configuration of marks the in- and/or outbound SA should apply
    to packets after processing on Linux. Configuring such a mark for outbound SAs requires
    at least a 4.14 kernel. The ability to set a mask and configuring a mark/mask for
    inbound SAs will be added with the upcoming 4.19 kernel.
  * New options in swanctl.conf allow configuring how/whether DF, ECN and DS fields in the
    IP headers are copied during IPsec processing. Controlling this is currently only possible
    on Linux.
  * The handling of sequence numbers in IKEv1 DPDs has been improved (#2714).
  * To avoid conflicts, the dhcp plugin now only uses the DHCP server port if explicitly
    configured.
  - Version 5.6.3
  ===============
  * Fixed a DoS vulnerability in the IKEv2 key derivation if the openssl plugin is used in FIPS
    mode and HMAC-MD5 is negotiated as PRF.
    This vulnerability has been registered as CVE-2018-10811.
  * Fixed a vulnerability in the stroke plugin, which did not check the received length before
    reading a message from the socket. Unless a group is configured, root privileges are
    required to access that socket, so in the default configuration this shouldn't be an issue.
    This vulnerability has been registered as CVE-2018-5388.
  * CRLs that are not yet valid are now ignored to avoid problems in scenarios where expired
    certificates are removed from new CRLs and the clock on the host doing the revocation
    check is trailing behind that of the host issuing CRLs. Not doing this could result in
    accepting a revoked and expired certificate, if it's still valid according to the
    trailing clock but not contained anymore in not yet valid CRLs.
  * The issuer of fetched CRLs is now compared to the issuer of the checked certificate (#2608).
  * CRL validation results other than revocation (e.g. a skipped check because the CRL couldn't
    be fetched) are now stored also for intermediate CA certificates and not only for end-entity
    certificates, so a strict CRL policy can be enforced in such cases.
  * In compliance with RFC 4945, section 5.1.3.2, certificates used for IKE must now either
    not contain a keyUsage extension (like the ones generated by pki), or have at least one of the
    digitalSignature or nonRepudiation bits set.
  * New options for vici/swanctl allow forcing the local termination of an IKE_SA. This might be
    useful in situations where it's known the other end is not reachable anymore, or that it
    already removed the IKE_SA, so retransmitting a DELETE and waiting for a response would
    be pointless.
  * Waiting only a certain amount of time for a response (i.e. shorter than all retransmits
    would be) before destroying the IKE_SA is also possible by additionally specifying a
    timeout in the forced termination request.
  * When removing routes, the kernel-netlink plugin now checks if it tracks other routes for
    the same destination and replaces the installed route instead of just removing it. Same
    during installation, where existing routes previously weren't replaced. This should allow
    using traps with virtual IPs on Linux (#2162).
  * The dhcp plugin now only sends the client identifier DHCP option if the identity_lease
    setting is enabled (7b660944b6). It can also send identities of up to 255 bytes length,
    instead of the previous 64 bytes (30e886fe3b, 0e5b94d038). If a server address is
    configured, DHCP requests are now sent from port 67 instead of 68 to avoid ICMP port
    unreachables (becf027cd9).
  * The handling of faulty INVALID_KE_PAYLOAD notifies (e.g. one containing a DH group
    that wasn't proposed) during CREATE_CHILD_SA exchanges has been improved (#2536).
  * Roam events are now completely ignored for IKEv1 SAs (there is no MOBIKE to handle such
    changes properly).
  * ChaCha20/Poly1305 is now correctly proposed without key length (#2614). For compatibility with
    older releases the chacha20poly1305compat keyword may be included in proposals to also propose
    the algorithm with a key length (c58434aeff).
  * Configuration of hardware offload of IPsec SAs is now more flexible and allows a new
    setting (auto), which automatically uses it if the kernel and device both support it. If hw
    offload is set to yes and offloading is not supported, the CHILD_SA installation now fails.
  * The kernel-pfkey plugin optionally installs routes via internal interface (one with an IP
    in the local traffic selector). On FreeBSD, enabling this selects the correct source IP
    when sending packets from the gateway itself (e811659323).
  * SHA-2 based PRFs are supported in PKCS#8 files as generated by OpenSSL 1.1 (#2574).
  * The pki --verify tool may load CA certificates and CRLs from directories.
  * The IKE daemon now also switches to port 4500 if the remote port is not 500 (e.g. because the
    remote maps the response to a different port, as might happen on Azure), as long as the local
    port is 500 (85bfab621d).
  * Fixed an issue with DNS servers passed to NetworkManager in charon-nm (ee8c25516a).
  * Logged traffic selectors now always contain the protocol if either protocol or port are set
    (a36d8097ed).
  * Only the inbound SA/policy will be updated as reaction to IP address changes for rekeyed
    CHILD_SAs that are kept around.
  * The parser for strongswan.conf/swanctl.conf now accepts = characters in values without
    having to put the value in quotes (e.g. for Base64 encoded shared secrets).
    Notes for developers:
  * trap_manager_t: Trap policies are now unistalled by peer/child name and not the reqid.
  * No reqid is returned anymore when installing trap policies.
  * child_sa_t: A new state (CHILD_DELETED) is used for CHILD_SAs that have been deleted but
    not yet destroyed (after a rekeying CHILD_SAs are kept around for a while to process
    delayed packets).
    This way child_updown events are not triggered anymore for such SAs when an IKE_SA that
    has such CHILD_SAs assigned is deleted.
  - Version 5.6.2
  ===============
  * Fixed a DoS vulnerability in the parser for PKCS#1 RSASSA-PSS signatures that was caused
    by insufficient input validation. One of the configurable parameters in algorithm identifier
    structures for RSASSA-PSS signatures is the mask generation function (MGF). Only MGF1 is
    currently specified for this purpose. However, this in turn takes itself a parameter that
    specifies the underlying hash function. strongSwan's parser did not correctly handle the
    case of this parameter being absent, causing an undefined data read.
    This vulnerability has been registered as CVE-2018-6459.
  * When rekeying IKEv2 IKE_SAs the previously negotiated DH group will be reused, instead of
    using the first configured group, which avoids an additional exchange if the peer previously
    selected a different DH group via INVALID_KE_PAYLOAD notify. The same is also done when
    rekeying CHILD_SAs except for the first rekeying of the CHILD_SA that was created with the
    IKE_SA, where no DH group was negotiated yet.
    Also, the selected DH group is moved to the front in all sent proposals that contain it
    and all proposals that don't are moved to the back in order to convey the preference for
    this group to the peer.
  * Handling of MOBIKE task queuing has been improved. In particular, the response to an
    address update (with NAT-D payloads) is not ignored anymore if only an address list update
    or DPD is queued as that could prevent updating the UDP encapsulation in the kernel.
  * On Linux, roam events may optionally be triggered by changes to the routing rules, which
    can be useful if routing rules (instead of e.g. route metrics) are used to switch from one
    to another interface (i.e. from one to another routing table). Since routing rules are
    currently not evaluated when doing route lookups this is only useful if the kernel-based
    route lookup is used (4664992f7d).
  * The fallback drop policies installed to avoid traffic leaks when replacing addresses in
    installed policies are now replaced by temporary drop policies, which also prevent
    acquires because we currently delete and reinstall IPsec SAs to update their addresses
    (35ef1b032d).
  * Access X.509 certificates held in non-volatile storage of a TPM 2.0 referenced via the
    NV index.
    Adding the --keyid parameter to pki --print allows to print private keys or certificates
    stored in a smartcard or a TPM 2.0.
  * Fixed proposal selection if a peer incorrectly sends DH groups in the ESP proposal during
    IKE_AUTH and also if a DH group is configured in the local ESP proposal and charon.prefer
    configured_proposals is disabled (d058fd3c32).
  * The lookup for PSK secrets for IKEv1 has been improved for certain scenarios (see #2497
    for details).
  * MSKs received via RADIUS are now padded to 64 bytes to avoid compatibility issues with
    EAP-MSCHAPv2 and PRFs that have a block size &lt; 64 bytes (e.g. AES-XCBC-PRF-128, see
    73cbce6013).
  * The tpm_extendpcr command line tool extends a digest into a TPM PCR.
  * Ported the NetworkManager backend from the deprecated libnm-glib to libnm.
  * The save-keys debugging/development plugin saves IKE and/or ESP keys to files compatible
    with Wireshark.
  - Version 5.6.1
  ===============
  * Several algorithms were removed from the default ESP/AH and IKE proposals in compliance with
    RFC 8221 and RFC 8247, respectively. Removed from the default ESP/AH proposal were the
    3DES and Blowfish encryption algorithms and the HMAC-MD5 integrity algorithm. From the IKE
    default proposal the HMAC-MD5 integrity algorithm and the MODP-1024 Diffie-Hellman group
    were removed (the latter is significant for Windows clients in their default configuration).
    These algorithms may still be used in custom proposals.
  * Support for RSASSA-PSS signatures has been added. For compatibility with previous
    releases they are currently not used automatically, by default, to change that charon.rsa_pss
    may be enabled. To explicitly use or require such signatures during IKEv2 signature
    authentication (RFC 7427) ike:rsa/pss... authentication constraints may be used for specific
    connections (regardless of whether the strongswan.conf option above is enabled). Only the
    hash algorithm can be specified in such constraints, the MGF1 will be based on that hash
    and the salt length will equal the hash length (when verifying the salt length is not
    enforced).
    To enforce such signatures during PKI verification use rsa/pss... authentication constraints.
  * All pki commands that create certificates/CRLs can be made to sign with RSASSA-PSS instead
    of the classing PKCS#1 scheme with the --rsa-padding pss option. As with signatures during
    authentication, only the hash algorithm is configurable (via --digest option), the MGF1 will
    be based on that and the salt length will equal the hash length.
  * These signatures are supported by all RSA backends except pkcs11 (i.e. gmp, gcrypt, openssl).
    The gmp plugin requires the mgf1 plugin.
    Note that RSASSA-PSS algorithm identifiers and parameters in keys (public keys in
    certificates or private keys in PKCS#8 files) are currently not used as constraints.
  * The sec-updater tool checks for security updates in dpkg-based repositories
    (e.g. Debian/Ubuntu) and sets the security flags in the IMV policy database accordingly.
    Additionally for each new package version a SWID tag for the given OS and HW architecture
    is created and stored in the database.
  * Using the sec-updater.sh script template the lookup can be automated (e.g. via an hourly
    cron job).
  * When restarting an IKEv2 negotiation after receiving an INVALID_KE_PAYLOAD notify (or due
    to other reasons like too many retransmits) a new initiator SPI is allocated. This
    prevents issues caused by retransmits for IKE_SA_INIT messages.
  * Because the initiator SPI was previously reused when restarting the connection delayed
    responses for previous connection attempts were processed and might have caused fatal
    errors due to a failed DH negotiation or because of the internal retry counter in the
    ike-init task. For instance, if we proposed a DH group the responder rejected we
    might have later received delayed responses that either contained INVALID_KE_PAYLOAD
    notifies with the DH group we already switched to, or, if we retransmitted an
    IKE_SA_INIT with the requested group but then had to restart again, a KE payload with
    a group different from the one we proposed.
  * The introduction of file versions in the IMV database scheme broke file reference hash
    measurements. This has been fixed by creating generic product versions having an empty
    package name.
  * A new timeout option for the systime-fix plugin stops periodic system time checks after
    a while and enforces a certificate verification, closing or reauthenticating all SAs
    with invalid certificates.
  * The IKE event counters, previously only available via ipsec listcounters command, may
    now also be queried and reset via vici and the new swanctl --counters command. They
    are collected and provided by the optional counters plugin (enabled by default for
    backwards compatibility if the stroke plugin is built).
  * Class attributes received in RADIUS Access-Accept messages may optionally be added to
    RADIUS accounting messages (655924074b).
  * Basic support for systemd sockets has been added, which may be used for privilege separation
    (59db98fb94).
  * Inbound marks may optionally be installed in the SA again (was removed with 5.5.2) by
    enabling the mark_in_sa option in swanctl.conf.
  * The timeout of leases in pools configured via pool utility may be configured in other
    units than hours.
    INITIAL_CONTACT notifies are now only omitted if never is configured as uniqueness policy.
  * Outbound FWD policies for shunts are not installed anymore, by default (as is the case
    for other policies since 5.5.1).
  * Don't consider a DH group mismatch during CHILD_SA rekeying as failure as responder
    (e7276f78aa).
  * Handling of fragmented IPv4 and IPv6 packets in libipsec has been improved (e138003de9).
  * Trigger expire events for the correct IPsec SA in libipsec (6e861947a0).
  * A crash in CRL verification via openssl plugin using OpenSSL 1.1 has been fixed (78acaba6a1).
  * No hard-coded default proposals are passed from starter to the stroke plugin anymore (the
    IKE proposal used curve25519 since 5.5.2, which is an optional plugin).
  * A workaround for an issue with virtual IPs on macOS 10.13 (High Sierra) has been added
    (039b85dd43).
  * Handling of IKE_SA rekey collisions in charon-tkm has been fixed.
  * Instead of failing or just silently doing nothing unit tests may now warn about certain
    conditions (e.g. if a test was not executed due to external dependencies).</changelog>
  <changelog author="mmnelemane@suse.com" date="1585224000">- Fix for to resolve multiple definition of swanctl_dir (bsc #1164493)
  [+ 0006-Resolve-multiple-definition-of-swanctl_dir.patch]</changelog>
  <changelog author="mbuil@suse.com" date="1610712000">- Fix typo in README (bsc #1167880)
  [+ 0007-Fix-typo-in-README.patch ]</changelog>
  <changelog author="mbuil@suse.com" date="1611576000">- Fix FIPS bug (bsc #1180801)
  [+ 0008-gcrypt-Use-a-dummy-buffer-to-initialize-static-alloc.patch ]</changelog>
  <changelog author="mbuil@suse.com" date="1617019200">- Keep using ipsec as the main binary. Therefore, make strongswan.service point to it instead of swanctl</changelog>
  <changelog author="mbuil@suse.com" date="1617019201">- Information added in README about the rcstrongswan-starter</changelog>
  <changelog author="mbuil@suse.com" date="1617624000">- Add config to run ipsec on namespaces (bsc #1183670)</changelog>
  <changelog author="mt@suse.com" date="1619006400">- Add support for AES CCM aead algorithms to openssl plugin (cc/fips,bsc#1185363)
  [+ 0009-strongswan-openssl-aead-add-ccm-support.patch]</changelog>
  <changelog author="mt@suse.com" date="1620388800">- Replace AEAD AES CCM patch with upstream variant (cc/fips,bsc#1185363)
  [* 0009-strongswan-openssl-aead-add-ccm-support.patch]</changelog>
  <changelog author="hare@suse.de" date="1627646400">- Add auth_els plugin to support Marvell FC-SP encryption (jsc#SLE-20151)
  [* strongswan-marvell-auth-els.patch]</changelog>
  <changelog author="abergmann@suse.com" date="1634040000">- Fix integer overflow in gmp plugin (bsc#1191367, CVE-2021-41990)
  [* strongswan-5.6.1-5.9.3_gmp-rsa-ssa-salt-len.patch]
- Fix integer overflow when replacing certificates in cache (bsc#1191435, CVE-2021-41991)
  [* strongswan-4.4.1-5.9.3_cert-cache-random.patch]</changelog>
  <changelog author="meissner@suse.com" date="1643025600">- strongswan-5.5.0-5.9.4_eap_success-CVE-2021-45079.patch:
  Fixed authentication bypass in EAP authentication (CVE-2021-45079
  bsc#1194471)</changelog>
</package>
<package pkgid="8916dc06b1b6a801037f448d20136aed7257d88ee4b8dd56ea96ccc021cf338b" name="strongswan-nm" arch="aarch64">
  <version epoch="0" ver="5.8.2" rel="11.24.1"/>
  <changelog author="ndas@suse.de" date="1501502400">- Updated to strongSwan 5.3.5(bsc#1050691) providing the following changes:
  * Fixed a DoS vulnerability in the gmp plugin that was caused by insufficient input
    validation when verifying RSA signatures. More specifically, mpz_powm_sec() has two
    requirements regarding the passed exponent and modulus that the plugin did not
    enforce, if these are not met the calculation will result in a floating point exception
    that crashes the whole process.
    This vulnerability has been registered as CVE-2017-9022.
    Please refer to our blog for details.
  * Fixed a DoS vulnerability in the x509 plugin that was caused because the ASN.1 parser
    didn't handle ASN.1 CHOICE types properly, which could result in an infinite loop when
    parsing X.509 extensions that use such types.
    This vulnerability has been registered as CVE-2017-9023.
    Please refer to our blog for details.
  * The behavior during IKEv2 CHILD_SA rekeying has been changed in order to avoid
    traffic loss. When responding to a CREATE_CHILD_SA request to rekey a CHILD_SA
    the responder already has everything available to install and use the new CHILD_SA.
    However, this could lead to lost traffic as the initiator won't be able to process
    inbound packets until it processed the CREATE_CHILD_SA response and updated the
    inbound SA. To avoid this the responder now only installs the new inbound SA and
    delays installing the outbound SA until it receives the DELETE for the replaced CHILD_SA.
  * The messages transporting these DELETEs could reach the peer before packets sent
    with the deleted outbound SAs reach it. To reduce the chance of traffic loss due
    to this the inbound SA of the replaced CHILD_SA is not removed for a configurable
    amount of seconds (charon.delete_rekeyed_delay) after the DELETE has been processed.
  * The code base has been ported to Apple's ARM64 iOS platform, which required several
    changes regarding the use of variadic functions. This was necessary because the calling
    conventions for variadic and regular functions are different there.
    This means that assigning a non-variadic function to a variadic function pointer, as we
    did with our enumerator_t::enumerate() implementations and several callbacks, will
    result in crashes as the called function accesses the arguments differently than the
    caller provided them. To avoid this issue the enumerator_t interface has been changed
    and the signature of the callback functions for enumerator_create_filter() and two
    methods on linked_list_t have been changed. Refer to the developer notes below
    for details.
  * Adds support for fuzzing the certificate parser provided by the default plugins
    (x509, pem, gmp etc.) on Google's OSS-Fuzz infrastructure (or generally with
    libFuzzer). Several issues found while fuzzing these plugins were fixed.
  * Two new options have been added to charon's retransmission settings:
    retransmit_limit and retransmit_jitter. The former adds an upper limit to the
    calculated retransmission timeout, the latter randomly reduces it.
    Refer to Retransmission for details.
  * A bug in swanctl's --load-creds command was fixed that caused unencrypted
    private keys to get unloaded if the command was called multiple times.
    The load-key VICI command now returns the key ID of the loaded key on success.
  * The credential manager now enumerates local credential sets before global ones.
    This means certificates supplied by the peer will now be preferred over certificates
    with the same identity that may be locally stored (e.g. in the certificate cache).
  * Adds support for hardware offload of IPsec SAs as introduced by Linux 4.11 for
    specific hardware that supports this.
  * The pki tool loads the curve25519 plugin by default.
    [- 0006-Make-sure-the-modulus-is-odd-and-the-exponent-not-zero.patch,
  - 0007-asn1-parser-Fix-CHOICE-parsing.patch]
- libhydra is removed as all kernel plugins moved to libcharon</changelog>
  <changelog author="ndas@suse.de" date="1504612800">- fix "uintptr_t? undeclared" compilation error.
  [+0006-fix-compilation-error-by-adding-stdint.h.patch]</changelog>
  <changelog author="ndas@suse.de" date="1504612801">- Updated to strongSwan 5.6.0 providing the following changes:
  * Fixed a DoS vulnerability in the gmp plugin that was caused by insufficient input validation
    when verifying RSA signatures, which requires decryption with the operation m^e mod n,
    where m is the signature, and e and n are the exponent and modulus of the public key.
    The value m is an integer between 0 and n-1, however, the gmp plugin did not verify this.
    So if m equals n the calculation results in 0, in which case mpz_export() returns NULL.
    This result wasn't handled properly causing a null-pointer dereference.
    This vulnerability has been registered as CVE-2017-11185. (bsc#1051222)
  * New SWIMA IMC/IMV pair implements the draft-ietf-sacm-nea-swima-patnc Internet
    Draft and has been demonstrated at the IETF 99 Prague Hackathon.
  * The IMV database template has been adapted to achieve full compliance with the
    ISO 19770-2:2015 SWID tag standard.
  * The pt-tls-client can attach and use TPM 2.0 protected private keys via the --keyid parameter.
  * By default the /etc/swanctl/conf.d directory is created and *.conf files in it are included in the default
    swanctl.conf file.
  * The curl plugin now follows HTTP redirects (configurable via strongswan.conf).
  * The CHILD_SA rekeying was fixed in charon-tkm and the behavior is refined a bit more since 5.5.3
  * libtpmtss supports Intel's TSS2 Architecture Broker and Resource Manager interface (tcti-tabrmd).
  * more on https://wiki.strongswan.org/versions/66</changelog>
  <changelog author="mmnelemane@suse.com" date="1521028800">- Removed unused requires and macro calls(bsc#1083261)</changelog>
  <changelog author="mmnelemane@suse.com" date="1573646400">- Added patch to fix vulnerability: CVE-2018-16151,CVE-2018-16152 (bsc#1107874)
  - Insufficient input validation in gmp plugin
  [+ 0007-strongswan-5.3.1-5.6.0_gmp-pkcs1-verify.patch]</changelog>
  <changelog author="mmnelemane@suse.com" date="1573646401">- Added patch to fix vulnerability: CVE-2018-5388 (bsc#1094462)
  - Buffer Underflow in stroke_socket.c
  [+ 0008-strongswan-5.1.2-5.6.2_stroke_msg_len.patch]</changelog>
  <changelog author="mmnelemane@suse.com" date="1573646402">- Added patch to fix vulnerability: CVE-2018-10811 (bsc#1093536)
  - denial-of-service vulnerability
  [+ 0009-strongswan-5.5.0-5.6.2_skeyseed_init.patch]</changelog>
  <changelog author="mmnelemane@suse.com" date="1573732800">- Added patch to fix vulnerability: CVE-2018-17540 (bsc#1109845)
  [+ 0010-strongswan-4.4.0-5.7.0_gmp-pkcs1-overflow.patch]</changelog>
  <changelog author="mmnelemane@suse.com" date="1580212800">- Updated to version 5.8.2 (jsc#SLE-11370)
  - Dropped following patches due to irrelevance in the updated version:
    [- strongswan_modprobe_syslog.patch ]
    [- strongswan_fipsfilter.patch ]
    [- 0006-fix-compilation-error-by-adding-stdint.h.patch ]
    [- 0007-strongswan-5.3.1-5.6.0_gmp-pkcs1-verify.patch ]
    [- 0008-strongswan-5.1.2-5.6.2_stroke_msg_len.patch ]
    [- 0009-strongswan-5.5.0-5.6.2_skeyseed_init.patch ]
    [- 0010-strongswan-4.4.0-5.7.0_gmp-pkcs1-overflow.patch ]
  - Version 5.8.2
  ===============
  * Identity-based CA constraints, which enforce that the certificate chain of the remote
    peer contains a CA certificate with a specific identity, are supported via
    vici/swanctl.conf. This is similar to the existing CA constraints but doesn't require
    that the CA certificate is locally installed, for instance, intermediate CA certificates
    received from the peers. Wildcard identity matching (e.g. ..., OU=Research, CN=*) could
    also be used for the latter but requires trust in the intermediate CAs to only issue
    certificates with legitimate subject DNs (e.g. the "Sales" CA must not issue certificates
    with OU=Research). With the new constraint that's not necessary as long as a path length
    basic constraint (--pathlen for pki --issue) prevents intermediate CAs from issuing further
    intermediate CAs.
  * Intermediate CA certificates may now be sent in hash-and-URL encoding by configuring a
    base URL for the parent CA (#3234, swanctl/rw-hash-and-url-multi-level).
  * Implemented NIST SP-800-90A Deterministic Random Bit Generator (DRBG) based on AES-CTR
    and SHA2-HMAC modes. Currently used by the gmp and ntru plugins.
  * Random nonces sent in an OCSP requests are now expected in the corresponding OCSP responses.
  * The kernel-netlink plugin now ignores deprecated IPv6 addresses for MOBIKE. Whether temporary
    or permanent IPv6 addresses are included now depends on the charon.prefer_temporary_addrs
    setting (#3192).
  * Extended Sequence Numbers (ESN) are configured via PF_KEY if supported by the kernel.
  * The PF_KEY socket's receive buffer in the kernel-pfkey plugin is now cleared before sending
    requests, as many of the messages sent by the kernel are sent as broadcasts to all PF_KEY
    sockets. This is an issue if an external tool is used to manage SAs/policies unrelated to
    IPsec (#3225).
  * The vici plugin now uses unique section names for CHILD_SAs in child-updown events (7c74ce9190).
  * For individually deleted CHILD_SAs (in particular for IKEv1) the vici child-updown event
    now includes more information about the CHILD_SAs such as traffic statistics (#3198).
  * Custom loggers are correctly re-registered if log levels are changed via stroke loglevel (#3182).
  * Avoid lockups during startup on low entropy systems when using OpenSSL 1.1.1 (095a2c2eac).
  * Instead of failing later when setting a key, creating HMACs via openssl plugin now fails
    instantly if the underlying hash algorithm isn't supported (e.g. MD5 in FIPS-mode) so fallbacks
    to other plugins work properly (#3284).
  * Exponents of RSA keys read from TPM 2.0 via SAPI are correctly converted (8ee1242f1438).
  * Routing table IDs &gt; 255 are supported for custom routes on Linux.
  * To avoid races, the check for hardware offloading support in the kernel-netlink plugin is
    performed during initialization of the plugin (a605452c03).
  * The D-Bus config file for charon-nm is now installed in $(datadir)/dbus-1/system.d instead of
    $(sysconfdir)/dbus-1/system.d, which is intended for sysadmin overrides.
    INVALID_MAJOR_VERSION notifies are now correctly sent in messages of the same exchange type
    and with the same message ID as the request.
  * IKEv2 SAs are now immediately destroyed when sending or receiving INVALID_SYNTAX notifies
    in authenticated messages.
  * For developers working from the repository the configure script now aborts if GNU gperf is
    not found.
  - Version 5.8.1
  ===============
  * RDNs in DNs of X.509 certificates can now optionally be matched less strict. The global
    strongswan.conf option charon.rdn_matching takes two alternative values that cause the
    matching algorithm to either ignore the order of matched RDNs (reordered) or additionally
    (relaxed) accept DNs that contain more RDNs than configured (unmatched RDNs are treated
    like wildcard matches).
  * The updown plugin now passes the same interface to the script that is also used for the
    automatically installed routes, that is, the interface over which the peer is reached
    instead of the interface on which the local address is found (#3095).
  * TPM 2.0 contexts are now protected by a mutex to prevent issues if multiple IKE_SAs use
    the same private key concurrently (4b25885025).
  * Do a rekey check after the third QM message was received (#3060).
  * If available, explicit_bzero() is now used as memwipe() instead of our own implementation.
  * An .editorconfig file has been added, mainly so Github shows files with proper indentation
    (68346b6962).
  * The internal certificate of the load-tester plugin has been modified so it can again be
    used as end-entity cert with 5.6.3 and later (#3139).
  * The maximum data length of received COOKIE notifies (64 bytes) is now enforced (#3160).
  - Version 5.8.0
  ===============
  * The systemd service units have been renamed. The modern unit, which was called
    strongswan-swanctl, is now called strongswan (the previous name is configured as alias in
    the unit, for which a symlink is created when the unit is enabled). The legacy unit is now
    called strongswan-starter.
  * Support for XFRM interfaces (available since Linux 4.19) has been added, which are intended
    to replace VTI devices (they are similar but offer several advantages, for instance, they
    are not bound to an address or address family).
  * IPsec SAs and policies are associated with such interfaces via interface IDs that can be
    configured in swanctl.conf (dynamic IDs may optionally be allocated for each SA and even
    direction). It's possible to use separate interfaces for in- and outbound traffic (or
    only use an interface in one direction and regular policies in the other).
  * Interfaces may be created dynamically via updown/vici scripts, or statically before or after
    establishing the SAs. Routes must be added manually as needed (the daemon will not install
    any routes for outbound policies with an interface ID).
  * When moving XFRM interfaces to other network namespaces they retain access to the SAs and
    policies installed in the original namespace, which allows providing IPsec tunnels for
    processes in other network namespaces without giving them access to the IPsec keys or
    IKE credentials.
    More information can be found on the page about route-based VPNs.
  * Initiation of childless IKE_SAs is supported (RFC 6023). If enabled and supported by the
    responder, no CHILD_SA is established during IKE_AUTH. Instead, all CHILD_SAs are created
    with CREATE_CHILD_SA exchanges. This allows using a separate DH exchange even for the
    first CHILD_SA, which is otherwise created during IKE_AUTH with keys derived from the
    IKE_SA's key material.
  * The swanctl --initiate command may be used to initiate only the IKE_SA via --ike
    option if --child is omitted and the peer supports this extension.
  * The NetworkManager backend and plugin support IPv6.
  * The new wolfssl plugin is a wrapper around the wolfSSL crypto library. Thanks to Sean
    Parkinson of wolfSSL Inc. for the initial patch.
  * IKE SPIs may optionally be labeled via the charon.spi_mask|label options in
    strongswan.conf. This feature was extracted from charon-tkm, however, now applies the
    mask/label in network order.
  * The openssl plugin supports ChaCha20-Poly1305 when built with OpenSSL 1.1.0.
  * The PB-TNC finite state machine according to section 3.2 of RFC 5793 was not correctly
    implemented when sending either a CRETRY or SRETRY batch. These batches can only be sent
    in the "Decided" state and a CRETRY batch can immediately carry all messages usually
    transported by a CDATA batch. It is currently not possible to send a SRETRY batch since
    full-duplex mode for PT-TLS transport is not supported.
  * Instead of marking IPv6 virtual IPs as deprecated, the kernel-netlink plugin now uses
    address labels to avoid that such addresses are used for non-VPN traffic (00a953d090).
  * The agent plugin now creates sockets to the ssh/gpg-agent dynamically and does not keep
    them open, which otherwise might prevent the agent from getting terminated.
  * To avoid broadcast loops the forecast plugin now only reinjects packets that are marked
    or received from the configured interface.
  * UTF-8 encoded passwords are supported via EAP-MSCHAPv2, which internally uses an UTF-16LE
    encoding to calculate the NT hash (#3014).
  * Properly delete temporary drop policies (used when updating IP addresses of SAs) if manual
    priorities are used, which was broken since 5.6.2 (8e31d65730).
  * Avoid overwriting start_action when parsing the inactivity timeout in the vici plugin (#2954).
  * Fixed the automatic termination of reloaded vici connections with start_action=start,
    which was broken since 5.6.3 (71b22c250f).
  * The lookup for shared secrets for IKEv1 SAs via sql plugin should now work better
    (6ec9f68f32).
  * Fixed a race condition in the trap manager between installation and removal of a policy
    (69cbe2ca3f).
  * Compilation of the kernel-netlink plugin has been fixed on old kernels (&lt; 2.6.39), which
    was caused by the HW offload changes (c7f579fa17).
  * The IPsec stack detection and module loading in starter has been removed (it wasn't
    enforced anyway and loading modules doesn't seem necessary, also KLIPS hasn't been
    supported for a long time and PF_KEY will eventually be removed from the Linux kernel,
    ba817d2917).
  * Several IKEv2 protocol details are now handled more strictly: Unrequested virtual IPs are
    ignored, CFG_REPLY payloads are ignored if no CFG_REQUEST payloads were sent, a USE
    TRANSPORT_MODE notify received from the responder is checked against the local configuration.
  * The keys and certificates used by the scenarios in the testing environment are now generated
    dynamically. Running the testing/scripts/build-certs script after creating the base and root
    images uses the pki utility installed in the latter to create the keys and certificates for
    all the CAs and in some cases for individual scenarios. These credentials are stored in the
    source tree, not the image, so this has to be called only once even if the images are later
    rebuilt. The script automatically (re-)rebuilds the guest images as that generates fresh
    CRLs and signs the DNS zones. The only keys/certificates currently not generated are the
    very large ones used by the ikev2/rw-eap-tls-fragments scenario.
  - Version 5.7.2
  ===============
  * For RSA with PSS padding, the TPM 2.0 specification mandates the maximum salt length
    (as defined by the length of the key and hash). However, if the TPM is FIPS-168-4 compliant,
    the salt length equals the hash length. This is assumed for FIPS-140-2 compliant TPMs, but
    if that's not the case, it might be necessary to manually enable charon.plugins.tpm.fips_186_4
    if the TPM doesn't use the maximum salt length.
  * Directories for credentials loaded by swanctl are now accessed relative to the loaded
    swanctl.conf file, in particular, when loading it from a custom location via --file argument.
  * The base directory, which is used if no custom location for swanctl.conf is specified, is now
    also configurable at runtime via SWANCTL_DIR environment variable.
  * If RADIUS Accounting is enabled, the eap-radius plugin will add the session ID (Acct-Session-Id)
    to Access-Request messages, which e.g. simplifies associating database entries for IP leases and
    accounting with sessions (the session ID does not change when IKE_SAs are rekeyed, #2853).
  * All IP addresses assigned by a RADIUS server are included in Accounting-Stop messages even if
    the client did not claim them, allowing to release them early in case of connection errors (#2856).
  * Selectors installed on transport mode SAs by the kernel-netlink plugin are now updated if an
    IP address changes (e.g. via MOBIKE) and it was part of the selectors.
  * No deletes are sent anymore when a rekeyed CHILD_SA expires (#2815).
  * The bypass-lan plugin now tracks interfaces to handle subnets that move from one interface
    to another and properly update associated routes (#2820).
  * Only valid and expected inbound IKEv2 messages are used to update the timestamp of the
    last received message (previously, retransmits also triggered an update).
  * IKEv2 requests from responders are now ignored until the IKE_SA is fully established (e.g. if a
    DPD request from the peer arrives before the IKE_AUTH response does, 46bea1add9).
    Delayed IKE_SA_INIT responses with COOKIE notifies we already recevied are ignored, they caused
    another reset of the IKE_SA previously (#2837).
  * Active and queued Quick Mode tasks are now adopted if the peer reauthenticates an IKEv1 SA
    while creating lots of CHILD_SAs.
  * Newer versions of the FreeBSD kernel add an SADB_X_EXT_SA2 extension to SADB_ACQUIRE
    messages, which allows the kernel-pfkey plugin to determine the reqid of the policy even if it
    wasn't installed by the daemon previously (e.g. when using FreeBSD's if_ipsec(4) VTIs, which
    install policies themselves, 872b9b3e8d).
  * Added support for RSA signatures with SHA-256 and SHA-512 to the agent plugin. For older
    versions of ssh/gpg-agent that only support SHA-1, IKEv2 signature authentication has to be
    disabled via charon.signature_authentication.
  * The sshkey and agent plugins support Ed25519/Ed448 SSH keys and signatures.
  * The openssl plugin supports X25519/X448 Diffie-Hellman and Ed25519/Ed448 keys and
    signatures when built against OpenSSL 1.1.1.
  * Support for Ed25519, ChaCha20/Poly1305, SHA-3 and AES-CCM were added to the botan plugin.
  * The mysql plugin now properly handles database connections with transactions
    under heavy load (#2779).
  * IP addresses in ha pools are now distributed evenly among all segments (#2828).
  * Private key implementations may optionally provide a list of supported signature schemes,
    which, as described above, is used by the tpm plugin because for each key on a TPM 2.0 the
    hash algorithm and for RSA also the padding scheme is predefined.
  * The testing environment is now based on Debian 9 (stretch) by default. This required
    some changes, in particular, updating to FreeRADIUS 3.x (which forced us to abandon the
    TNC@FHH patches and scenarios, 2fbe44bef3) and removing FIPS-enabled versions of
    OpenSSL (the FIPS module only supports OpenSSL 1.0.2).
  * Most test scenarios were migrated to swanctl.
  - Version 5.7.1
  ===============
  * Fixes a vulnerability in the gmp plugin triggered by crafted certificates with RSA keys with
    very small moduli. When verifying signatures with such keys, the code patched with the fix
    for CVE-2018-16151/2 caused an integer underflow and subsequent heap buffer overflow
    that results in a crash of the daemon.
  * The vulnerability has been registered as CVE-2018-17540.
  - Version 5.7.0
  ===============
  * Fixes a potential authorization bypass vulnerability in the gmp plugin that was caused by a
    too lenient verification of PKCS#1 v1.5 signatures. Several flaws could be exploited by a
    Bleichenbacher-style attack to forge signatures for low-exponent keys (i.e. with e=3).
  * CVE-2018-16151 has been assigned to the problem of accepting random bytes after the OID
    of the hash function in such signatures, and CVE-2018-16152 has been assigned to the issue
    of not verifying that the parameters in the ASN.1 algorithmIdentitifer structure is empty.
    Other flaws that don't lead to a vulnerability directly (e.g. not checking for at least
    8 bytes of padding) have no separate CVE assigned.
  * Dots are not allowed anymore in section names in swanctl.conf and strongswan.conf.
    This mainly affects the configuration of file loggers. If the path for such a log file
    contains dots it now has to be configured in the new path setting within the arbitrarily
    renamed subsection in the filelog section.
  * Sections in swanctl.conf and strongswan.conf may now reference other sections. All settings
    and subsections from such a section are inherited. This allows to simplify configs as
    redundant information has only to be specified once and may then be included in other
    sections (see strongswan.conf for an example).
  * The originally selected IKE config (based on the IPs and IKE version) can now change
    if no matching algorithm proposal is found. This way the order of the configs doesn't
    matter that much anymore and it's easily possible to specify separate configs for
    clients that require weaker algorithms (instead of having to also add them in other
    configs that might be selected).
  * Support for Postquantum Preshared Keys for IKEv2 (draft-ietf-ipsecme-qr-ikev2) has been added.
    For an example refer to the swanctl/rw-cert-ppk scenario (or with EAP, or PSK authentication).
  * The new botan plugin is a wrapper around the Botan C++ crypto library.
    It requires a fairly recent build from Botan's master branch (or the upcoming 2.8.0 release).
    Thanks to René Korthaus and his team from Rohde &amp; Schwarz Cybersecurity for the initial
    patch and to Jack Lloyd for quickly adding missing functions to Botan's FFI (C89) interface.
  * Implementation of RFC 8412 "Software Inventory Message and Attributes (SWIMA) for PA-TNC".
  * SWIMA subscription option sets CLOSE_WRITE trigger on apt history.log file resulting in
    a ClientRetry PB-TNC batch to initialize a new measurement cycle. The new imv/imc-swima
    plugins replace the previous imv/imc-swid plugins, which were removed.
  * Added support for fuzzing the PA-TNC (RFC 5792) and PB-TNC (RFC 5793) NEA protocols
    on Google's OSS-Fuzz infrastructure.
  * Support for version 2 of Intel's TPM2-TSS TGC Software Stack. The presence of the
    in-kernel /dev/tpmrm0 resource manager is automatically detected.
  * The pki tool accepts a xmppAddr otherName as a subjectAlternativeName using the
    syntax --san xmppaddr:&lt;jid&gt;.
  * swanctl.conf supports the configuration of marks the in- and/or outbound SA should apply
    to packets after processing on Linux. Configuring such a mark for outbound SAs requires
    at least a 4.14 kernel. The ability to set a mask and configuring a mark/mask for
    inbound SAs will be added with the upcoming 4.19 kernel.
  * New options in swanctl.conf allow configuring how/whether DF, ECN and DS fields in the
    IP headers are copied during IPsec processing. Controlling this is currently only possible
    on Linux.
  * The handling of sequence numbers in IKEv1 DPDs has been improved (#2714).
  * To avoid conflicts, the dhcp plugin now only uses the DHCP server port if explicitly
    configured.
  - Version 5.6.3
  ===============
  * Fixed a DoS vulnerability in the IKEv2 key derivation if the openssl plugin is used in FIPS
    mode and HMAC-MD5 is negotiated as PRF.
    This vulnerability has been registered as CVE-2018-10811.
  * Fixed a vulnerability in the stroke plugin, which did not check the received length before
    reading a message from the socket. Unless a group is configured, root privileges are
    required to access that socket, so in the default configuration this shouldn't be an issue.
    This vulnerability has been registered as CVE-2018-5388.
  * CRLs that are not yet valid are now ignored to avoid problems in scenarios where expired
    certificates are removed from new CRLs and the clock on the host doing the revocation
    check is trailing behind that of the host issuing CRLs. Not doing this could result in
    accepting a revoked and expired certificate, if it's still valid according to the
    trailing clock but not contained anymore in not yet valid CRLs.
  * The issuer of fetched CRLs is now compared to the issuer of the checked certificate (#2608).
  * CRL validation results other than revocation (e.g. a skipped check because the CRL couldn't
    be fetched) are now stored also for intermediate CA certificates and not only for end-entity
    certificates, so a strict CRL policy can be enforced in such cases.
  * In compliance with RFC 4945, section 5.1.3.2, certificates used for IKE must now either
    not contain a keyUsage extension (like the ones generated by pki), or have at least one of the
    digitalSignature or nonRepudiation bits set.
  * New options for vici/swanctl allow forcing the local termination of an IKE_SA. This might be
    useful in situations where it's known the other end is not reachable anymore, or that it
    already removed the IKE_SA, so retransmitting a DELETE and waiting for a response would
    be pointless.
  * Waiting only a certain amount of time for a response (i.e. shorter than all retransmits
    would be) before destroying the IKE_SA is also possible by additionally specifying a
    timeout in the forced termination request.
  * When removing routes, the kernel-netlink plugin now checks if it tracks other routes for
    the same destination and replaces the installed route instead of just removing it. Same
    during installation, where existing routes previously weren't replaced. This should allow
    using traps with virtual IPs on Linux (#2162).
  * The dhcp plugin now only sends the client identifier DHCP option if the identity_lease
    setting is enabled (7b660944b6). It can also send identities of up to 255 bytes length,
    instead of the previous 64 bytes (30e886fe3b, 0e5b94d038). If a server address is
    configured, DHCP requests are now sent from port 67 instead of 68 to avoid ICMP port
    unreachables (becf027cd9).
  * The handling of faulty INVALID_KE_PAYLOAD notifies (e.g. one containing a DH group
    that wasn't proposed) during CREATE_CHILD_SA exchanges has been improved (#2536).
  * Roam events are now completely ignored for IKEv1 SAs (there is no MOBIKE to handle such
    changes properly).
  * ChaCha20/Poly1305 is now correctly proposed without key length (#2614). For compatibility with
    older releases the chacha20poly1305compat keyword may be included in proposals to also propose
    the algorithm with a key length (c58434aeff).
  * Configuration of hardware offload of IPsec SAs is now more flexible and allows a new
    setting (auto), which automatically uses it if the kernel and device both support it. If hw
    offload is set to yes and offloading is not supported, the CHILD_SA installation now fails.
  * The kernel-pfkey plugin optionally installs routes via internal interface (one with an IP
    in the local traffic selector). On FreeBSD, enabling this selects the correct source IP
    when sending packets from the gateway itself (e811659323).
  * SHA-2 based PRFs are supported in PKCS#8 files as generated by OpenSSL 1.1 (#2574).
  * The pki --verify tool may load CA certificates and CRLs from directories.
  * The IKE daemon now also switches to port 4500 if the remote port is not 500 (e.g. because the
    remote maps the response to a different port, as might happen on Azure), as long as the local
    port is 500 (85bfab621d).
  * Fixed an issue with DNS servers passed to NetworkManager in charon-nm (ee8c25516a).
  * Logged traffic selectors now always contain the protocol if either protocol or port are set
    (a36d8097ed).
  * Only the inbound SA/policy will be updated as reaction to IP address changes for rekeyed
    CHILD_SAs that are kept around.
  * The parser for strongswan.conf/swanctl.conf now accepts = characters in values without
    having to put the value in quotes (e.g. for Base64 encoded shared secrets).
    Notes for developers:
  * trap_manager_t: Trap policies are now unistalled by peer/child name and not the reqid.
  * No reqid is returned anymore when installing trap policies.
  * child_sa_t: A new state (CHILD_DELETED) is used for CHILD_SAs that have been deleted but
    not yet destroyed (after a rekeying CHILD_SAs are kept around for a while to process
    delayed packets).
    This way child_updown events are not triggered anymore for such SAs when an IKE_SA that
    has such CHILD_SAs assigned is deleted.
  - Version 5.6.2
  ===============
  * Fixed a DoS vulnerability in the parser for PKCS#1 RSASSA-PSS signatures that was caused
    by insufficient input validation. One of the configurable parameters in algorithm identifier
    structures for RSASSA-PSS signatures is the mask generation function (MGF). Only MGF1 is
    currently specified for this purpose. However, this in turn takes itself a parameter that
    specifies the underlying hash function. strongSwan's parser did not correctly handle the
    case of this parameter being absent, causing an undefined data read.
    This vulnerability has been registered as CVE-2018-6459.
  * When rekeying IKEv2 IKE_SAs the previously negotiated DH group will be reused, instead of
    using the first configured group, which avoids an additional exchange if the peer previously
    selected a different DH group via INVALID_KE_PAYLOAD notify. The same is also done when
    rekeying CHILD_SAs except for the first rekeying of the CHILD_SA that was created with the
    IKE_SA, where no DH group was negotiated yet.
    Also, the selected DH group is moved to the front in all sent proposals that contain it
    and all proposals that don't are moved to the back in order to convey the preference for
    this group to the peer.
  * Handling of MOBIKE task queuing has been improved. In particular, the response to an
    address update (with NAT-D payloads) is not ignored anymore if only an address list update
    or DPD is queued as that could prevent updating the UDP encapsulation in the kernel.
  * On Linux, roam events may optionally be triggered by changes to the routing rules, which
    can be useful if routing rules (instead of e.g. route metrics) are used to switch from one
    to another interface (i.e. from one to another routing table). Since routing rules are
    currently not evaluated when doing route lookups this is only useful if the kernel-based
    route lookup is used (4664992f7d).
  * The fallback drop policies installed to avoid traffic leaks when replacing addresses in
    installed policies are now replaced by temporary drop policies, which also prevent
    acquires because we currently delete and reinstall IPsec SAs to update their addresses
    (35ef1b032d).
  * Access X.509 certificates held in non-volatile storage of a TPM 2.0 referenced via the
    NV index.
    Adding the --keyid parameter to pki --print allows to print private keys or certificates
    stored in a smartcard or a TPM 2.0.
  * Fixed proposal selection if a peer incorrectly sends DH groups in the ESP proposal during
    IKE_AUTH and also if a DH group is configured in the local ESP proposal and charon.prefer
    configured_proposals is disabled (d058fd3c32).
  * The lookup for PSK secrets for IKEv1 has been improved for certain scenarios (see #2497
    for details).
  * MSKs received via RADIUS are now padded to 64 bytes to avoid compatibility issues with
    EAP-MSCHAPv2 and PRFs that have a block size &lt; 64 bytes (e.g. AES-XCBC-PRF-128, see
    73cbce6013).
  * The tpm_extendpcr command line tool extends a digest into a TPM PCR.
  * Ported the NetworkManager backend from the deprecated libnm-glib to libnm.
  * The save-keys debugging/development plugin saves IKE and/or ESP keys to files compatible
    with Wireshark.
  - Version 5.6.1
  ===============
  * Several algorithms were removed from the default ESP/AH and IKE proposals in compliance with
    RFC 8221 and RFC 8247, respectively. Removed from the default ESP/AH proposal were the
    3DES and Blowfish encryption algorithms and the HMAC-MD5 integrity algorithm. From the IKE
    default proposal the HMAC-MD5 integrity algorithm and the MODP-1024 Diffie-Hellman group
    were removed (the latter is significant for Windows clients in their default configuration).
    These algorithms may still be used in custom proposals.
  * Support for RSASSA-PSS signatures has been added. For compatibility with previous
    releases they are currently not used automatically, by default, to change that charon.rsa_pss
    may be enabled. To explicitly use or require such signatures during IKEv2 signature
    authentication (RFC 7427) ike:rsa/pss... authentication constraints may be used for specific
    connections (regardless of whether the strongswan.conf option above is enabled). Only the
    hash algorithm can be specified in such constraints, the MGF1 will be based on that hash
    and the salt length will equal the hash length (when verifying the salt length is not
    enforced).
    To enforce such signatures during PKI verification use rsa/pss... authentication constraints.
  * All pki commands that create certificates/CRLs can be made to sign with RSASSA-PSS instead
    of the classing PKCS#1 scheme with the --rsa-padding pss option. As with signatures during
    authentication, only the hash algorithm is configurable (via --digest option), the MGF1 will
    be based on that and the salt length will equal the hash length.
  * These signatures are supported by all RSA backends except pkcs11 (i.e. gmp, gcrypt, openssl).
    The gmp plugin requires the mgf1 plugin.
    Note that RSASSA-PSS algorithm identifiers and parameters in keys (public keys in
    certificates or private keys in PKCS#8 files) are currently not used as constraints.
  * The sec-updater tool checks for security updates in dpkg-based repositories
    (e.g. Debian/Ubuntu) and sets the security flags in the IMV policy database accordingly.
    Additionally for each new package version a SWID tag for the given OS and HW architecture
    is created and stored in the database.
  * Using the sec-updater.sh script template the lookup can be automated (e.g. via an hourly
    cron job).
  * When restarting an IKEv2 negotiation after receiving an INVALID_KE_PAYLOAD notify (or due
    to other reasons like too many retransmits) a new initiator SPI is allocated. This
    prevents issues caused by retransmits for IKE_SA_INIT messages.
  * Because the initiator SPI was previously reused when restarting the connection delayed
    responses for previous connection attempts were processed and might have caused fatal
    errors due to a failed DH negotiation or because of the internal retry counter in the
    ike-init task. For instance, if we proposed a DH group the responder rejected we
    might have later received delayed responses that either contained INVALID_KE_PAYLOAD
    notifies with the DH group we already switched to, or, if we retransmitted an
    IKE_SA_INIT with the requested group but then had to restart again, a KE payload with
    a group different from the one we proposed.
  * The introduction of file versions in the IMV database scheme broke file reference hash
    measurements. This has been fixed by creating generic product versions having an empty
    package name.
  * A new timeout option for the systime-fix plugin stops periodic system time checks after
    a while and enforces a certificate verification, closing or reauthenticating all SAs
    with invalid certificates.
  * The IKE event counters, previously only available via ipsec listcounters command, may
    now also be queried and reset via vici and the new swanctl --counters command. They
    are collected and provided by the optional counters plugin (enabled by default for
    backwards compatibility if the stroke plugin is built).
  * Class attributes received in RADIUS Access-Accept messages may optionally be added to
    RADIUS accounting messages (655924074b).
  * Basic support for systemd sockets has been added, which may be used for privilege separation
    (59db98fb94).
  * Inbound marks may optionally be installed in the SA again (was removed with 5.5.2) by
    enabling the mark_in_sa option in swanctl.conf.
  * The timeout of leases in pools configured via pool utility may be configured in other
    units than hours.
    INITIAL_CONTACT notifies are now only omitted if never is configured as uniqueness policy.
  * Outbound FWD policies for shunts are not installed anymore, by default (as is the case
    for other policies since 5.5.1).
  * Don't consider a DH group mismatch during CHILD_SA rekeying as failure as responder
    (e7276f78aa).
  * Handling of fragmented IPv4 and IPv6 packets in libipsec has been improved (e138003de9).
  * Trigger expire events for the correct IPsec SA in libipsec (6e861947a0).
  * A crash in CRL verification via openssl plugin using OpenSSL 1.1 has been fixed (78acaba6a1).
  * No hard-coded default proposals are passed from starter to the stroke plugin anymore (the
    IKE proposal used curve25519 since 5.5.2, which is an optional plugin).
  * A workaround for an issue with virtual IPs on macOS 10.13 (High Sierra) has been added
    (039b85dd43).
  * Handling of IKE_SA rekey collisions in charon-tkm has been fixed.
  * Instead of failing or just silently doing nothing unit tests may now warn about certain
    conditions (e.g. if a test was not executed due to external dependencies).</changelog>
  <changelog author="mmnelemane@suse.com" date="1585224000">- Fix for to resolve multiple definition of swanctl_dir (bsc #1164493)
  [+ 0006-Resolve-multiple-definition-of-swanctl_dir.patch]</changelog>
  <changelog author="mbuil@suse.com" date="1610712000">- Fix typo in README (bsc #1167880)
  [+ 0007-Fix-typo-in-README.patch ]</changelog>
  <changelog author="mbuil@suse.com" date="1611576000">- Fix FIPS bug (bsc #1180801)
  [+ 0008-gcrypt-Use-a-dummy-buffer-to-initialize-static-alloc.patch ]</changelog>
  <changelog author="mbuil@suse.com" date="1617019200">- Keep using ipsec as the main binary. Therefore, make strongswan.service point to it instead of swanctl</changelog>
  <changelog author="mbuil@suse.com" date="1617019201">- Information added in README about the rcstrongswan-starter</changelog>
  <changelog author="mbuil@suse.com" date="1617624000">- Add config to run ipsec on namespaces (bsc #1183670)</changelog>
  <changelog author="mt@suse.com" date="1619006400">- Add support for AES CCM aead algorithms to openssl plugin (cc/fips,bsc#1185363)
  [+ 0009-strongswan-openssl-aead-add-ccm-support.patch]</changelog>
  <changelog author="mt@suse.com" date="1620388800">- Replace AEAD AES CCM patch with upstream variant (cc/fips,bsc#1185363)
  [* 0009-strongswan-openssl-aead-add-ccm-support.patch]</changelog>
  <changelog author="hare@suse.de" date="1627646400">- Add auth_els plugin to support Marvell FC-SP encryption (jsc#SLE-20151)
  [* strongswan-marvell-auth-els.patch]</changelog>
  <changelog author="abergmann@suse.com" date="1634040000">- Fix integer overflow in gmp plugin (bsc#1191367, CVE-2021-41990)
  [* strongswan-5.6.1-5.9.3_gmp-rsa-ssa-salt-len.patch]
- Fix integer overflow when replacing certificates in cache (bsc#1191435, CVE-2021-41991)
  [* strongswan-4.4.1-5.9.3_cert-cache-random.patch]</changelog>
  <changelog author="meissner@suse.com" date="1643025600">- strongswan-5.5.0-5.9.4_eap_success-CVE-2021-45079.patch:
  Fixed authentication bypass in EAP authentication (CVE-2021-45079
  bsc#1194471)</changelog>
</package>
<package pkgid="33b15788bf4855e90f9c0ba85d0d567e90e927da9b2679499924953891d22a96" name="strongswan-nm" arch="ppc64le">
  <version epoch="0" ver="5.8.2" rel="11.24.1"/>
  <changelog author="ndas@suse.de" date="1501502400">- Updated to strongSwan 5.3.5(bsc#1050691) providing the following changes:
  * Fixed a DoS vulnerability in the gmp plugin that was caused by insufficient input
    validation when verifying RSA signatures. More specifically, mpz_powm_sec() has two
    requirements regarding the passed exponent and modulus that the plugin did not
    enforce, if these are not met the calculation will result in a floating point exception
    that crashes the whole process.
    This vulnerability has been registered as CVE-2017-9022.
    Please refer to our blog for details.
  * Fixed a DoS vulnerability in the x509 plugin that was caused because the ASN.1 parser
    didn't handle ASN.1 CHOICE types properly, which could result in an infinite loop when
    parsing X.509 extensions that use such types.
    This vulnerability has been registered as CVE-2017-9023.
    Please refer to our blog for details.
  * The behavior during IKEv2 CHILD_SA rekeying has been changed in order to avoid
    traffic loss. When responding to a CREATE_CHILD_SA request to rekey a CHILD_SA
    the responder already has everything available to install and use the new CHILD_SA.
    However, this could lead to lost traffic as the initiator won't be able to process
    inbound packets until it processed the CREATE_CHILD_SA response and updated the
    inbound SA. To avoid this the responder now only installs the new inbound SA and
    delays installing the outbound SA until it receives the DELETE for the replaced CHILD_SA.
  * The messages transporting these DELETEs could reach the peer before packets sent
    with the deleted outbound SAs reach it. To reduce the chance of traffic loss due
    to this the inbound SA of the replaced CHILD_SA is not removed for a configurable
    amount of seconds (charon.delete_rekeyed_delay) after the DELETE has been processed.
  * The code base has been ported to Apple's ARM64 iOS platform, which required several
    changes regarding the use of variadic functions. This was necessary because the calling
    conventions for variadic and regular functions are different there.
    This means that assigning a non-variadic function to a variadic function pointer, as we
    did with our enumerator_t::enumerate() implementations and several callbacks, will
    result in crashes as the called function accesses the arguments differently than the
    caller provided them. To avoid this issue the enumerator_t interface has been changed
    and the signature of the callback functions for enumerator_create_filter() and two
    methods on linked_list_t have been changed. Refer to the developer notes below
    for details.
  * Adds support for fuzzing the certificate parser provided by the default plugins
    (x509, pem, gmp etc.) on Google's OSS-Fuzz infrastructure (or generally with
    libFuzzer). Several issues found while fuzzing these plugins were fixed.
  * Two new options have been added to charon's retransmission settings:
    retransmit_limit and retransmit_jitter. The former adds an upper limit to the
    calculated retransmission timeout, the latter randomly reduces it.
    Refer to Retransmission for details.
  * A bug in swanctl's --load-creds command was fixed that caused unencrypted
    private keys to get unloaded if the command was called multiple times.
    The load-key VICI command now returns the key ID of the loaded key on success.
  * The credential manager now enumerates local credential sets before global ones.
    This means certificates supplied by the peer will now be preferred over certificates
    with the same identity that may be locally stored (e.g. in the certificate cache).
  * Adds support for hardware offload of IPsec SAs as introduced by Linux 4.11 for
    specific hardware that supports this.
  * The pki tool loads the curve25519 plugin by default.
    [- 0006-Make-sure-the-modulus-is-odd-and-the-exponent-not-zero.patch,
  - 0007-asn1-parser-Fix-CHOICE-parsing.patch]
- libhydra is removed as all kernel plugins moved to libcharon</changelog>
  <changelog author="ndas@suse.de" date="1504612800">- fix "uintptr_t? undeclared" compilation error.
  [+0006-fix-compilation-error-by-adding-stdint.h.patch]</changelog>
  <changelog author="ndas@suse.de" date="1504612801">- Updated to strongSwan 5.6.0 providing the following changes:
  * Fixed a DoS vulnerability in the gmp plugin that was caused by insufficient input validation
    when verifying RSA signatures, which requires decryption with the operation m^e mod n,
    where m is the signature, and e and n are the exponent and modulus of the public key.
    The value m is an integer between 0 and n-1, however, the gmp plugin did not verify this.
    So if m equals n the calculation results in 0, in which case mpz_export() returns NULL.
    This result wasn't handled properly causing a null-pointer dereference.
    This vulnerability has been registered as CVE-2017-11185. (bsc#1051222)
  * New SWIMA IMC/IMV pair implements the draft-ietf-sacm-nea-swima-patnc Internet
    Draft and has been demonstrated at the IETF 99 Prague Hackathon.
  * The IMV database template has been adapted to achieve full compliance with the
    ISO 19770-2:2015 SWID tag standard.
  * The pt-tls-client can attach and use TPM 2.0 protected private keys via the --keyid parameter.
  * By default the /etc/swanctl/conf.d directory is created and *.conf files in it are included in the default
    swanctl.conf file.
  * The curl plugin now follows HTTP redirects (configurable via strongswan.conf).
  * The CHILD_SA rekeying was fixed in charon-tkm and the behavior is refined a bit more since 5.5.3
  * libtpmtss supports Intel's TSS2 Architecture Broker and Resource Manager interface (tcti-tabrmd).
  * more on https://wiki.strongswan.org/versions/66</changelog>
  <changelog author="mmnelemane@suse.com" date="1521028800">- Removed unused requires and macro calls(bsc#1083261)</changelog>
  <changelog author="mmnelemane@suse.com" date="1573646400">- Added patch to fix vulnerability: CVE-2018-16151,CVE-2018-16152 (bsc#1107874)
  - Insufficient input validation in gmp plugin
  [+ 0007-strongswan-5.3.1-5.6.0_gmp-pkcs1-verify.patch]</changelog>
  <changelog author="mmnelemane@suse.com" date="1573646401">- Added patch to fix vulnerability: CVE-2018-5388 (bsc#1094462)
  - Buffer Underflow in stroke_socket.c
  [+ 0008-strongswan-5.1.2-5.6.2_stroke_msg_len.patch]</changelog>
  <changelog author="mmnelemane@suse.com" date="1573646402">- Added patch to fix vulnerability: CVE-2018-10811 (bsc#1093536)
  - denial-of-service vulnerability
  [+ 0009-strongswan-5.5.0-5.6.2_skeyseed_init.patch]</changelog>
  <changelog author="mmnelemane@suse.com" date="1573732800">- Added patch to fix vulnerability: CVE-2018-17540 (bsc#1109845)
  [+ 0010-strongswan-4.4.0-5.7.0_gmp-pkcs1-overflow.patch]</changelog>
  <changelog author="mmnelemane@suse.com" date="1580212800">- Updated to version 5.8.2 (jsc#SLE-11370)
  - Dropped following patches due to irrelevance in the updated version:
    [- strongswan_modprobe_syslog.patch ]
    [- strongswan_fipsfilter.patch ]
    [- 0006-fix-compilation-error-by-adding-stdint.h.patch ]
    [- 0007-strongswan-5.3.1-5.6.0_gmp-pkcs1-verify.patch ]
    [- 0008-strongswan-5.1.2-5.6.2_stroke_msg_len.patch ]
    [- 0009-strongswan-5.5.0-5.6.2_skeyseed_init.patch ]
    [- 0010-strongswan-4.4.0-5.7.0_gmp-pkcs1-overflow.patch ]
  - Version 5.8.2
  ===============
  * Identity-based CA constraints, which enforce that the certificate chain of the remote
    peer contains a CA certificate with a specific identity, are supported via
    vici/swanctl.conf. This is similar to the existing CA constraints but doesn't require
    that the CA certificate is locally installed, for instance, intermediate CA certificates
    received from the peers. Wildcard identity matching (e.g. ..., OU=Research, CN=*) could
    also be used for the latter but requires trust in the intermediate CAs to only issue
    certificates with legitimate subject DNs (e.g. the "Sales" CA must not issue certificates
    with OU=Research). With the new constraint that's not necessary as long as a path length
    basic constraint (--pathlen for pki --issue) prevents intermediate CAs from issuing further
    intermediate CAs.
  * Intermediate CA certificates may now be sent in hash-and-URL encoding by configuring a
    base URL for the parent CA (#3234, swanctl/rw-hash-and-url-multi-level).
  * Implemented NIST SP-800-90A Deterministic Random Bit Generator (DRBG) based on AES-CTR
    and SHA2-HMAC modes. Currently used by the gmp and ntru plugins.
  * Random nonces sent in an OCSP requests are now expected in the corresponding OCSP responses.
  * The kernel-netlink plugin now ignores deprecated IPv6 addresses for MOBIKE. Whether temporary
    or permanent IPv6 addresses are included now depends on the charon.prefer_temporary_addrs
    setting (#3192).
  * Extended Sequence Numbers (ESN) are configured via PF_KEY if supported by the kernel.
  * The PF_KEY socket's receive buffer in the kernel-pfkey plugin is now cleared before sending
    requests, as many of the messages sent by the kernel are sent as broadcasts to all PF_KEY
    sockets. This is an issue if an external tool is used to manage SAs/policies unrelated to
    IPsec (#3225).
  * The vici plugin now uses unique section names for CHILD_SAs in child-updown events (7c74ce9190).
  * For individually deleted CHILD_SAs (in particular for IKEv1) the vici child-updown event
    now includes more information about the CHILD_SAs such as traffic statistics (#3198).
  * Custom loggers are correctly re-registered if log levels are changed via stroke loglevel (#3182).
  * Avoid lockups during startup on low entropy systems when using OpenSSL 1.1.1 (095a2c2eac).
  * Instead of failing later when setting a key, creating HMACs via openssl plugin now fails
    instantly if the underlying hash algorithm isn't supported (e.g. MD5 in FIPS-mode) so fallbacks
    to other plugins work properly (#3284).
  * Exponents of RSA keys read from TPM 2.0 via SAPI are correctly converted (8ee1242f1438).
  * Routing table IDs &gt; 255 are supported for custom routes on Linux.
  * To avoid races, the check for hardware offloading support in the kernel-netlink plugin is
    performed during initialization of the plugin (a605452c03).
  * The D-Bus config file for charon-nm is now installed in $(datadir)/dbus-1/system.d instead of
    $(sysconfdir)/dbus-1/system.d, which is intended for sysadmin overrides.
    INVALID_MAJOR_VERSION notifies are now correctly sent in messages of the same exchange type
    and with the same message ID as the request.
  * IKEv2 SAs are now immediately destroyed when sending or receiving INVALID_SYNTAX notifies
    in authenticated messages.
  * For developers working from the repository the configure script now aborts if GNU gperf is
    not found.
  - Version 5.8.1
  ===============
  * RDNs in DNs of X.509 certificates can now optionally be matched less strict. The global
    strongswan.conf option charon.rdn_matching takes two alternative values that cause the
    matching algorithm to either ignore the order of matched RDNs (reordered) or additionally
    (relaxed) accept DNs that contain more RDNs than configured (unmatched RDNs are treated
    like wildcard matches).
  * The updown plugin now passes the same interface to the script that is also used for the
    automatically installed routes, that is, the interface over which the peer is reached
    instead of the interface on which the local address is found (#3095).
  * TPM 2.0 contexts are now protected by a mutex to prevent issues if multiple IKE_SAs use
    the same private key concurrently (4b25885025).
  * Do a rekey check after the third QM message was received (#3060).
  * If available, explicit_bzero() is now used as memwipe() instead of our own implementation.
  * An .editorconfig file has been added, mainly so Github shows files with proper indentation
    (68346b6962).
  * The internal certificate of the load-tester plugin has been modified so it can again be
    used as end-entity cert with 5.6.3 and later (#3139).
  * The maximum data length of received COOKIE notifies (64 bytes) is now enforced (#3160).
  - Version 5.8.0
  ===============
  * The systemd service units have been renamed. The modern unit, which was called
    strongswan-swanctl, is now called strongswan (the previous name is configured as alias in
    the unit, for which a symlink is created when the unit is enabled). The legacy unit is now
    called strongswan-starter.
  * Support for XFRM interfaces (available since Linux 4.19) has been added, which are intended
    to replace VTI devices (they are similar but offer several advantages, for instance, they
    are not bound to an address or address family).
  * IPsec SAs and policies are associated with such interfaces via interface IDs that can be
    configured in swanctl.conf (dynamic IDs may optionally be allocated for each SA and even
    direction). It's possible to use separate interfaces for in- and outbound traffic (or
    only use an interface in one direction and regular policies in the other).
  * Interfaces may be created dynamically via updown/vici scripts, or statically before or after
    establishing the SAs. Routes must be added manually as needed (the daemon will not install
    any routes for outbound policies with an interface ID).
  * When moving XFRM interfaces to other network namespaces they retain access to the SAs and
    policies installed in the original namespace, which allows providing IPsec tunnels for
    processes in other network namespaces without giving them access to the IPsec keys or
    IKE credentials.
    More information can be found on the page about route-based VPNs.
  * Initiation of childless IKE_SAs is supported (RFC 6023). If enabled and supported by the
    responder, no CHILD_SA is established during IKE_AUTH. Instead, all CHILD_SAs are created
    with CREATE_CHILD_SA exchanges. This allows using a separate DH exchange even for the
    first CHILD_SA, which is otherwise created during IKE_AUTH with keys derived from the
    IKE_SA's key material.
  * The swanctl --initiate command may be used to initiate only the IKE_SA via --ike
    option if --child is omitted and the peer supports this extension.
  * The NetworkManager backend and plugin support IPv6.
  * The new wolfssl plugin is a wrapper around the wolfSSL crypto library. Thanks to Sean
    Parkinson of wolfSSL Inc. for the initial patch.
  * IKE SPIs may optionally be labeled via the charon.spi_mask|label options in
    strongswan.conf. This feature was extracted from charon-tkm, however, now applies the
    mask/label in network order.
  * The openssl plugin supports ChaCha20-Poly1305 when built with OpenSSL 1.1.0.
  * The PB-TNC finite state machine according to section 3.2 of RFC 5793 was not correctly
    implemented when sending either a CRETRY or SRETRY batch. These batches can only be sent
    in the "Decided" state and a CRETRY batch can immediately carry all messages usually
    transported by a CDATA batch. It is currently not possible to send a SRETRY batch since
    full-duplex mode for PT-TLS transport is not supported.
  * Instead of marking IPv6 virtual IPs as deprecated, the kernel-netlink plugin now uses
    address labels to avoid that such addresses are used for non-VPN traffic (00a953d090).
  * The agent plugin now creates sockets to the ssh/gpg-agent dynamically and does not keep
    them open, which otherwise might prevent the agent from getting terminated.
  * To avoid broadcast loops the forecast plugin now only reinjects packets that are marked
    or received from the configured interface.
  * UTF-8 encoded passwords are supported via EAP-MSCHAPv2, which internally uses an UTF-16LE
    encoding to calculate the NT hash (#3014).
  * Properly delete temporary drop policies (used when updating IP addresses of SAs) if manual
    priorities are used, which was broken since 5.6.2 (8e31d65730).
  * Avoid overwriting start_action when parsing the inactivity timeout in the vici plugin (#2954).
  * Fixed the automatic termination of reloaded vici connections with start_action=start,
    which was broken since 5.6.3 (71b22c250f).
  * The lookup for shared secrets for IKEv1 SAs via sql plugin should now work better
    (6ec9f68f32).
  * Fixed a race condition in the trap manager between installation and removal of a policy
    (69cbe2ca3f).
  * Compilation of the kernel-netlink plugin has been fixed on old kernels (&lt; 2.6.39), which
    was caused by the HW offload changes (c7f579fa17).
  * The IPsec stack detection and module loading in starter has been removed (it wasn't
    enforced anyway and loading modules doesn't seem necessary, also KLIPS hasn't been
    supported for a long time and PF_KEY will eventually be removed from the Linux kernel,
    ba817d2917).
  * Several IKEv2 protocol details are now handled more strictly: Unrequested virtual IPs are
    ignored, CFG_REPLY payloads are ignored if no CFG_REQUEST payloads were sent, a USE
    TRANSPORT_MODE notify received from the responder is checked against the local configuration.
  * The keys and certificates used by the scenarios in the testing environment are now generated
    dynamically. Running the testing/scripts/build-certs script after creating the base and root
    images uses the pki utility installed in the latter to create the keys and certificates for
    all the CAs and in some cases for individual scenarios. These credentials are stored in the
    source tree, not the image, so this has to be called only once even if the images are later
    rebuilt. The script automatically (re-)rebuilds the guest images as that generates fresh
    CRLs and signs the DNS zones. The only keys/certificates currently not generated are the
    very large ones used by the ikev2/rw-eap-tls-fragments scenario.
  - Version 5.7.2
  ===============
  * For RSA with PSS padding, the TPM 2.0 specification mandates the maximum salt length
    (as defined by the length of the key and hash). However, if the TPM is FIPS-168-4 compliant,
    the salt length equals the hash length. This is assumed for FIPS-140-2 compliant TPMs, but
    if that's not the case, it might be necessary to manually enable charon.plugins.tpm.fips_186_4
    if the TPM doesn't use the maximum salt length.
  * Directories for credentials loaded by swanctl are now accessed relative to the loaded
    swanctl.conf file, in particular, when loading it from a custom location via --file argument.
  * The base directory, which is used if no custom location for swanctl.conf is specified, is now
    also configurable at runtime via SWANCTL_DIR environment variable.
  * If RADIUS Accounting is enabled, the eap-radius plugin will add the session ID (Acct-Session-Id)
    to Access-Request messages, which e.g. simplifies associating database entries for IP leases and
    accounting with sessions (the session ID does not change when IKE_SAs are rekeyed, #2853).
  * All IP addresses assigned by a RADIUS server are included in Accounting-Stop messages even if
    the client did not claim them, allowing to release them early in case of connection errors (#2856).
  * Selectors installed on transport mode SAs by the kernel-netlink plugin are now updated if an
    IP address changes (e.g. via MOBIKE) and it was part of the selectors.
  * No deletes are sent anymore when a rekeyed CHILD_SA expires (#2815).
  * The bypass-lan plugin now tracks interfaces to handle subnets that move from one interface
    to another and properly update associated routes (#2820).
  * Only valid and expected inbound IKEv2 messages are used to update the timestamp of the
    last received message (previously, retransmits also triggered an update).
  * IKEv2 requests from responders are now ignored until the IKE_SA is fully established (e.g. if a
    DPD request from the peer arrives before the IKE_AUTH response does, 46bea1add9).
    Delayed IKE_SA_INIT responses with COOKIE notifies we already recevied are ignored, they caused
    another reset of the IKE_SA previously (#2837).
  * Active and queued Quick Mode tasks are now adopted if the peer reauthenticates an IKEv1 SA
    while creating lots of CHILD_SAs.
  * Newer versions of the FreeBSD kernel add an SADB_X_EXT_SA2 extension to SADB_ACQUIRE
    messages, which allows the kernel-pfkey plugin to determine the reqid of the policy even if it
    wasn't installed by the daemon previously (e.g. when using FreeBSD's if_ipsec(4) VTIs, which
    install policies themselves, 872b9b3e8d).
  * Added support for RSA signatures with SHA-256 and SHA-512 to the agent plugin. For older
    versions of ssh/gpg-agent that only support SHA-1, IKEv2 signature authentication has to be
    disabled via charon.signature_authentication.
  * The sshkey and agent plugins support Ed25519/Ed448 SSH keys and signatures.
  * The openssl plugin supports X25519/X448 Diffie-Hellman and Ed25519/Ed448 keys and
    signatures when built against OpenSSL 1.1.1.
  * Support for Ed25519, ChaCha20/Poly1305, SHA-3 and AES-CCM were added to the botan plugin.
  * The mysql plugin now properly handles database connections with transactions
    under heavy load (#2779).
  * IP addresses in ha pools are now distributed evenly among all segments (#2828).
  * Private key implementations may optionally provide a list of supported signature schemes,
    which, as described above, is used by the tpm plugin because for each key on a TPM 2.0 the
    hash algorithm and for RSA also the padding scheme is predefined.
  * The testing environment is now based on Debian 9 (stretch) by default. This required
    some changes, in particular, updating to FreeRADIUS 3.x (which forced us to abandon the
    TNC@FHH patches and scenarios, 2fbe44bef3) and removing FIPS-enabled versions of
    OpenSSL (the FIPS module only supports OpenSSL 1.0.2).
  * Most test scenarios were migrated to swanctl.
  - Version 5.7.1
  ===============
  * Fixes a vulnerability in the gmp plugin triggered by crafted certificates with RSA keys with
    very small moduli. When verifying signatures with such keys, the code patched with the fix
    for CVE-2018-16151/2 caused an integer underflow and subsequent heap buffer overflow
    that results in a crash of the daemon.
  * The vulnerability has been registered as CVE-2018-17540.
  - Version 5.7.0
  ===============
  * Fixes a potential authorization bypass vulnerability in the gmp plugin that was caused by a
    too lenient verification of PKCS#1 v1.5 signatures. Several flaws could be exploited by a
    Bleichenbacher-style attack to forge signatures for low-exponent keys (i.e. with e=3).
  * CVE-2018-16151 has been assigned to the problem of accepting random bytes after the OID
    of the hash function in such signatures, and CVE-2018-16152 has been assigned to the issue
    of not verifying that the parameters in the ASN.1 algorithmIdentitifer structure is empty.
    Other flaws that don't lead to a vulnerability directly (e.g. not checking for at least
    8 bytes of padding) have no separate CVE assigned.
  * Dots are not allowed anymore in section names in swanctl.conf and strongswan.conf.
    This mainly affects the configuration of file loggers. If the path for such a log file
    contains dots it now has to be configured in the new path setting within the arbitrarily
    renamed subsection in the filelog section.
  * Sections in swanctl.conf and strongswan.conf may now reference other sections. All settings
    and subsections from such a section are inherited. This allows to simplify configs as
    redundant information has only to be specified once and may then be included in other
    sections (see strongswan.conf for an example).
  * The originally selected IKE config (based on the IPs and IKE version) can now change
    if no matching algorithm proposal is found. This way the order of the configs doesn't
    matter that much anymore and it's easily possible to specify separate configs for
    clients that require weaker algorithms (instead of having to also add them in other
    configs that might be selected).
  * Support for Postquantum Preshared Keys for IKEv2 (draft-ietf-ipsecme-qr-ikev2) has been added.
    For an example refer to the swanctl/rw-cert-ppk scenario (or with EAP, or PSK authentication).
  * The new botan plugin is a wrapper around the Botan C++ crypto library.
    It requires a fairly recent build from Botan's master branch (or the upcoming 2.8.0 release).
    Thanks to René Korthaus and his team from Rohde &amp; Schwarz Cybersecurity for the initial
    patch and to Jack Lloyd for quickly adding missing functions to Botan's FFI (C89) interface.
  * Implementation of RFC 8412 "Software Inventory Message and Attributes (SWIMA) for PA-TNC".
  * SWIMA subscription option sets CLOSE_WRITE trigger on apt history.log file resulting in
    a ClientRetry PB-TNC batch to initialize a new measurement cycle. The new imv/imc-swima
    plugins replace the previous imv/imc-swid plugins, which were removed.
  * Added support for fuzzing the PA-TNC (RFC 5792) and PB-TNC (RFC 5793) NEA protocols
    on Google's OSS-Fuzz infrastructure.
  * Support for version 2 of Intel's TPM2-TSS TGC Software Stack. The presence of the
    in-kernel /dev/tpmrm0 resource manager is automatically detected.
  * The pki tool accepts a xmppAddr otherName as a subjectAlternativeName using the
    syntax --san xmppaddr:&lt;jid&gt;.
  * swanctl.conf supports the configuration of marks the in- and/or outbound SA should apply
    to packets after processing on Linux. Configuring such a mark for outbound SAs requires
    at least a 4.14 kernel. The ability to set a mask and configuring a mark/mask for
    inbound SAs will be added with the upcoming 4.19 kernel.
  * New options in swanctl.conf allow configuring how/whether DF, ECN and DS fields in the
    IP headers are copied during IPsec processing. Controlling this is currently only possible
    on Linux.
  * The handling of sequence numbers in IKEv1 DPDs has been improved (#2714).
  * To avoid conflicts, the dhcp plugin now only uses the DHCP server port if explicitly
    configured.
  - Version 5.6.3
  ===============
  * Fixed a DoS vulnerability in the IKEv2 key derivation if the openssl plugin is used in FIPS
    mode and HMAC-MD5 is negotiated as PRF.
    This vulnerability has been registered as CVE-2018-10811.
  * Fixed a vulnerability in the stroke plugin, which did not check the received length before
    reading a message from the socket. Unless a group is configured, root privileges are
    required to access that socket, so in the default configuration this shouldn't be an issue.
    This vulnerability has been registered as CVE-2018-5388.
  * CRLs that are not yet valid are now ignored to avoid problems in scenarios where expired
    certificates are removed from new CRLs and the clock on the host doing the revocation
    check is trailing behind that of the host issuing CRLs. Not doing this could result in
    accepting a revoked and expired certificate, if it's still valid according to the
    trailing clock but not contained anymore in not yet valid CRLs.
  * The issuer of fetched CRLs is now compared to the issuer of the checked certificate (#2608).
  * CRL validation results other than revocation (e.g. a skipped check because the CRL couldn't
    be fetched) are now stored also for intermediate CA certificates and not only for end-entity
    certificates, so a strict CRL policy can be enforced in such cases.
  * In compliance with RFC 4945, section 5.1.3.2, certificates used for IKE must now either
    not contain a keyUsage extension (like the ones generated by pki), or have at least one of the
    digitalSignature or nonRepudiation bits set.
  * New options for vici/swanctl allow forcing the local termination of an IKE_SA. This might be
    useful in situations where it's known the other end is not reachable anymore, or that it
    already removed the IKE_SA, so retransmitting a DELETE and waiting for a response would
    be pointless.
  * Waiting only a certain amount of time for a response (i.e. shorter than all retransmits
    would be) before destroying the IKE_SA is also possible by additionally specifying a
    timeout in the forced termination request.
  * When removing routes, the kernel-netlink plugin now checks if it tracks other routes for
    the same destination and replaces the installed route instead of just removing it. Same
    during installation, where existing routes previously weren't replaced. This should allow
    using traps with virtual IPs on Linux (#2162).
  * The dhcp plugin now only sends the client identifier DHCP option if the identity_lease
    setting is enabled (7b660944b6). It can also send identities of up to 255 bytes length,
    instead of the previous 64 bytes (30e886fe3b, 0e5b94d038). If a server address is
    configured, DHCP requests are now sent from port 67 instead of 68 to avoid ICMP port
    unreachables (becf027cd9).
  * The handling of faulty INVALID_KE_PAYLOAD notifies (e.g. one containing a DH group
    that wasn't proposed) during CREATE_CHILD_SA exchanges has been improved (#2536).
  * Roam events are now completely ignored for IKEv1 SAs (there is no MOBIKE to handle such
    changes properly).
  * ChaCha20/Poly1305 is now correctly proposed without key length (#2614). For compatibility with
    older releases the chacha20poly1305compat keyword may be included in proposals to also propose
    the algorithm with a key length (c58434aeff).
  * Configuration of hardware offload of IPsec SAs is now more flexible and allows a new
    setting (auto), which automatically uses it if the kernel and device both support it. If hw
    offload is set to yes and offloading is not supported, the CHILD_SA installation now fails.
  * The kernel-pfkey plugin optionally installs routes via internal interface (one with an IP
    in the local traffic selector). On FreeBSD, enabling this selects the correct source IP
    when sending packets from the gateway itself (e811659323).
  * SHA-2 based PRFs are supported in PKCS#8 files as generated by OpenSSL 1.1 (#2574).
  * The pki --verify tool may load CA certificates and CRLs from directories.
  * The IKE daemon now also switches to port 4500 if the remote port is not 500 (e.g. because the
    remote maps the response to a different port, as might happen on Azure), as long as the local
    port is 500 (85bfab621d).
  * Fixed an issue with DNS servers passed to NetworkManager in charon-nm (ee8c25516a).
  * Logged traffic selectors now always contain the protocol if either protocol or port are set
    (a36d8097ed).
  * Only the inbound SA/policy will be updated as reaction to IP address changes for rekeyed
    CHILD_SAs that are kept around.
  * The parser for strongswan.conf/swanctl.conf now accepts = characters in values without
    having to put the value in quotes (e.g. for Base64 encoded shared secrets).
    Notes for developers:
  * trap_manager_t: Trap policies are now unistalled by peer/child name and not the reqid.
  * No reqid is returned anymore when installing trap policies.
  * child_sa_t: A new state (CHILD_DELETED) is used for CHILD_SAs that have been deleted but
    not yet destroyed (after a rekeying CHILD_SAs are kept around for a while to process
    delayed packets).
    This way child_updown events are not triggered anymore for such SAs when an IKE_SA that
    has such CHILD_SAs assigned is deleted.
  - Version 5.6.2
  ===============
  * Fixed a DoS vulnerability in the parser for PKCS#1 RSASSA-PSS signatures that was caused
    by insufficient input validation. One of the configurable parameters in algorithm identifier
    structures for RSASSA-PSS signatures is the mask generation function (MGF). Only MGF1 is
    currently specified for this purpose. However, this in turn takes itself a parameter that
    specifies the underlying hash function. strongSwan's parser did not correctly handle the
    case of this parameter being absent, causing an undefined data read.
    This vulnerability has been registered as CVE-2018-6459.
  * When rekeying IKEv2 IKE_SAs the previously negotiated DH group will be reused, instead of
    using the first configured group, which avoids an additional exchange if the peer previously
    selected a different DH group via INVALID_KE_PAYLOAD notify. The same is also done when
    rekeying CHILD_SAs except for the first rekeying of the CHILD_SA that was created with the
    IKE_SA, where no DH group was negotiated yet.
    Also, the selected DH group is moved to the front in all sent proposals that contain it
    and all proposals that don't are moved to the back in order to convey the preference for
    this group to the peer.
  * Handling of MOBIKE task queuing has been improved. In particular, the response to an
    address update (with NAT-D payloads) is not ignored anymore if only an address list update
    or DPD is queued as that could prevent updating the UDP encapsulation in the kernel.
  * On Linux, roam events may optionally be triggered by changes to the routing rules, which
    can be useful if routing rules (instead of e.g. route metrics) are used to switch from one
    to another interface (i.e. from one to another routing table). Since routing rules are
    currently not evaluated when doing route lookups this is only useful if the kernel-based
    route lookup is used (4664992f7d).
  * The fallback drop policies installed to avoid traffic leaks when replacing addresses in
    installed policies are now replaced by temporary drop policies, which also prevent
    acquires because we currently delete and reinstall IPsec SAs to update their addresses
    (35ef1b032d).
  * Access X.509 certificates held in non-volatile storage of a TPM 2.0 referenced via the
    NV index.
    Adding the --keyid parameter to pki --print allows to print private keys or certificates
    stored in a smartcard or a TPM 2.0.
  * Fixed proposal selection if a peer incorrectly sends DH groups in the ESP proposal during
    IKE_AUTH and also if a DH group is configured in the local ESP proposal and charon.prefer
    configured_proposals is disabled (d058fd3c32).
  * The lookup for PSK secrets for IKEv1 has been improved for certain scenarios (see #2497
    for details).
  * MSKs received via RADIUS are now padded to 64 bytes to avoid compatibility issues with
    EAP-MSCHAPv2 and PRFs that have a block size &lt; 64 bytes (e.g. AES-XCBC-PRF-128, see
    73cbce6013).
  * The tpm_extendpcr command line tool extends a digest into a TPM PCR.
  * Ported the NetworkManager backend from the deprecated libnm-glib to libnm.
  * The save-keys debugging/development plugin saves IKE and/or ESP keys to files compatible
    with Wireshark.
  - Version 5.6.1
  ===============
  * Several algorithms were removed from the default ESP/AH and IKE proposals in compliance with
    RFC 8221 and RFC 8247, respectively. Removed from the default ESP/AH proposal were the
    3DES and Blowfish encryption algorithms and the HMAC-MD5 integrity algorithm. From the IKE
    default proposal the HMAC-MD5 integrity algorithm and the MODP-1024 Diffie-Hellman group
    were removed (the latter is significant for Windows clients in their default configuration).
    These algorithms may still be used in custom proposals.
  * Support for RSASSA-PSS signatures has been added. For compatibility with previous
    releases they are currently not used automatically, by default, to change that charon.rsa_pss
    may be enabled. To explicitly use or require such signatures during IKEv2 signature
    authentication (RFC 7427) ike:rsa/pss... authentication constraints may be used for specific
    connections (regardless of whether the strongswan.conf option above is enabled). Only the
    hash algorithm can be specified in such constraints, the MGF1 will be based on that hash
    and the salt length will equal the hash length (when verifying the salt length is not
    enforced).
    To enforce such signatures during PKI verification use rsa/pss... authentication constraints.
  * All pki commands that create certificates/CRLs can be made to sign with RSASSA-PSS instead
    of the classing PKCS#1 scheme with the --rsa-padding pss option. As with signatures during
    authentication, only the hash algorithm is configurable (via --digest option), the MGF1 will
    be based on that and the salt length will equal the hash length.
  * These signatures are supported by all RSA backends except pkcs11 (i.e. gmp, gcrypt, openssl).
    The gmp plugin requires the mgf1 plugin.
    Note that RSASSA-PSS algorithm identifiers and parameters in keys (public keys in
    certificates or private keys in PKCS#8 files) are currently not used as constraints.
  * The sec-updater tool checks for security updates in dpkg-based repositories
    (e.g. Debian/Ubuntu) and sets the security flags in the IMV policy database accordingly.
    Additionally for each new package version a SWID tag for the given OS and HW architecture
    is created and stored in the database.
  * Using the sec-updater.sh script template the lookup can be automated (e.g. via an hourly
    cron job).
  * When restarting an IKEv2 negotiation after receiving an INVALID_KE_PAYLOAD notify (or due
    to other reasons like too many retransmits) a new initiator SPI is allocated. This
    prevents issues caused by retransmits for IKE_SA_INIT messages.
  * Because the initiator SPI was previously reused when restarting the connection delayed
    responses for previous connection attempts were processed and might have caused fatal
    errors due to a failed DH negotiation or because of the internal retry counter in the
    ike-init task. For instance, if we proposed a DH group the responder rejected we
    might have later received delayed responses that either contained INVALID_KE_PAYLOAD
    notifies with the DH group we already switched to, or, if we retransmitted an
    IKE_SA_INIT with the requested group but then had to restart again, a KE payload with
    a group different from the one we proposed.
  * The introduction of file versions in the IMV database scheme broke file reference hash
    measurements. This has been fixed by creating generic product versions having an empty
    package name.
  * A new timeout option for the systime-fix plugin stops periodic system time checks after
    a while and enforces a certificate verification, closing or reauthenticating all SAs
    with invalid certificates.
  * The IKE event counters, previously only available via ipsec listcounters command, may
    now also be queried and reset via vici and the new swanctl --counters command. They
    are collected and provided by the optional counters plugin (enabled by default for
    backwards compatibility if the stroke plugin is built).
  * Class attributes received in RADIUS Access-Accept messages may optionally be added to
    RADIUS accounting messages (655924074b).
  * Basic support for systemd sockets has been added, which may be used for privilege separation
    (59db98fb94).
  * Inbound marks may optionally be installed in the SA again (was removed with 5.5.2) by
    enabling the mark_in_sa option in swanctl.conf.
  * The timeout of leases in pools configured via pool utility may be configured in other
    units than hours.
    INITIAL_CONTACT notifies are now only omitted if never is configured as uniqueness policy.
  * Outbound FWD policies for shunts are not installed anymore, by default (as is the case
    for other policies since 5.5.1).
  * Don't consider a DH group mismatch during CHILD_SA rekeying as failure as responder
    (e7276f78aa).
  * Handling of fragmented IPv4 and IPv6 packets in libipsec has been improved (e138003de9).
  * Trigger expire events for the correct IPsec SA in libipsec (6e861947a0).
  * A crash in CRL verification via openssl plugin using OpenSSL 1.1 has been fixed (78acaba6a1).
  * No hard-coded default proposals are passed from starter to the stroke plugin anymore (the
    IKE proposal used curve25519 since 5.5.2, which is an optional plugin).
  * A workaround for an issue with virtual IPs on macOS 10.13 (High Sierra) has been added
    (039b85dd43).
  * Handling of IKE_SA rekey collisions in charon-tkm has been fixed.
  * Instead of failing or just silently doing nothing unit tests may now warn about certain
    conditions (e.g. if a test was not executed due to external dependencies).</changelog>
  <changelog author="mmnelemane@suse.com" date="1585224000">- Fix for to resolve multiple definition of swanctl_dir (bsc #1164493)
  [+ 0006-Resolve-multiple-definition-of-swanctl_dir.patch]</changelog>
  <changelog author="mbuil@suse.com" date="1610712000">- Fix typo in README (bsc #1167880)
  [+ 0007-Fix-typo-in-README.patch ]</changelog>
  <changelog author="mbuil@suse.com" date="1611576000">- Fix FIPS bug (bsc #1180801)
  [+ 0008-gcrypt-Use-a-dummy-buffer-to-initialize-static-alloc.patch ]</changelog>
  <changelog author="mbuil@suse.com" date="1617019200">- Keep using ipsec as the main binary. Therefore, make strongswan.service point to it instead of swanctl</changelog>
  <changelog author="mbuil@suse.com" date="1617019201">- Information added in README about the rcstrongswan-starter</changelog>
  <changelog author="mbuil@suse.com" date="1617624000">- Add config to run ipsec on namespaces (bsc #1183670)</changelog>
  <changelog author="mt@suse.com" date="1619006400">- Add support for AES CCM aead algorithms to openssl plugin (cc/fips,bsc#1185363)
  [+ 0009-strongswan-openssl-aead-add-ccm-support.patch]</changelog>
  <changelog author="mt@suse.com" date="1620388800">- Replace AEAD AES CCM patch with upstream variant (cc/fips,bsc#1185363)
  [* 0009-strongswan-openssl-aead-add-ccm-support.patch]</changelog>
  <changelog author="hare@suse.de" date="1627646400">- Add auth_els plugin to support Marvell FC-SP encryption (jsc#SLE-20151)
  [* strongswan-marvell-auth-els.patch]</changelog>
  <changelog author="abergmann@suse.com" date="1634040000">- Fix integer overflow in gmp plugin (bsc#1191367, CVE-2021-41990)
  [* strongswan-5.6.1-5.9.3_gmp-rsa-ssa-salt-len.patch]
- Fix integer overflow when replacing certificates in cache (bsc#1191435, CVE-2021-41991)
  [* strongswan-4.4.1-5.9.3_cert-cache-random.patch]</changelog>
  <changelog author="meissner@suse.com" date="1643025600">- strongswan-5.5.0-5.9.4_eap_success-CVE-2021-45079.patch:
  Fixed authentication bypass in EAP authentication (CVE-2021-45079
  bsc#1194471)</changelog>
</package>
<package pkgid="0d811cc4c0825cf69e4d508d3caf029be6fb2951ffa3bec91acc7b6b05adec30" name="strongswan-nm" arch="s390x">
  <version epoch="0" ver="5.8.2" rel="11.24.1"/>
  <changelog author="ndas@suse.de" date="1501502400">- Updated to strongSwan 5.3.5(bsc#1050691) providing the following changes:
  * Fixed a DoS vulnerability in the gmp plugin that was caused by insufficient input
    validation when verifying RSA signatures. More specifically, mpz_powm_sec() has two
    requirements regarding the passed exponent and modulus that the plugin did not
    enforce, if these are not met the calculation will result in a floating point exception
    that crashes the whole process.
    This vulnerability has been registered as CVE-2017-9022.
    Please refer to our blog for details.
  * Fixed a DoS vulnerability in the x509 plugin that was caused because the ASN.1 parser
    didn't handle ASN.1 CHOICE types properly, which could result in an infinite loop when
    parsing X.509 extensions that use such types.
    This vulnerability has been registered as CVE-2017-9023.
    Please refer to our blog for details.
  * The behavior during IKEv2 CHILD_SA rekeying has been changed in order to avoid
    traffic loss. When responding to a CREATE_CHILD_SA request to rekey a CHILD_SA
    the responder already has everything available to install and use the new CHILD_SA.
    However, this could lead to lost traffic as the initiator won't be able to process
    inbound packets until it processed the CREATE_CHILD_SA response and updated the
    inbound SA. To avoid this the responder now only installs the new inbound SA and
    delays installing the outbound SA until it receives the DELETE for the replaced CHILD_SA.
  * The messages transporting these DELETEs could reach the peer before packets sent
    with the deleted outbound SAs reach it. To reduce the chance of traffic loss due
    to this the inbound SA of the replaced CHILD_SA is not removed for a configurable
    amount of seconds (charon.delete_rekeyed_delay) after the DELETE has been processed.
  * The code base has been ported to Apple's ARM64 iOS platform, which required several
    changes regarding the use of variadic functions. This was necessary because the calling
    conventions for variadic and regular functions are different there.
    This means that assigning a non-variadic function to a variadic function pointer, as we
    did with our enumerator_t::enumerate() implementations and several callbacks, will
    result in crashes as the called function accesses the arguments differently than the
    caller provided them. To avoid this issue the enumerator_t interface has been changed
    and the signature of the callback functions for enumerator_create_filter() and two
    methods on linked_list_t have been changed. Refer to the developer notes below
    for details.
  * Adds support for fuzzing the certificate parser provided by the default plugins
    (x509, pem, gmp etc.) on Google's OSS-Fuzz infrastructure (or generally with
    libFuzzer). Several issues found while fuzzing these plugins were fixed.
  * Two new options have been added to charon's retransmission settings:
    retransmit_limit and retransmit_jitter. The former adds an upper limit to the
    calculated retransmission timeout, the latter randomly reduces it.
    Refer to Retransmission for details.
  * A bug in swanctl's --load-creds command was fixed that caused unencrypted
    private keys to get unloaded if the command was called multiple times.
    The load-key VICI command now returns the key ID of the loaded key on success.
  * The credential manager now enumerates local credential sets before global ones.
    This means certificates supplied by the peer will now be preferred over certificates
    with the same identity that may be locally stored (e.g. in the certificate cache).
  * Adds support for hardware offload of IPsec SAs as introduced by Linux 4.11 for
    specific hardware that supports this.
  * The pki tool loads the curve25519 plugin by default.
    [- 0006-Make-sure-the-modulus-is-odd-and-the-exponent-not-zero.patch,
  - 0007-asn1-parser-Fix-CHOICE-parsing.patch]
- libhydra is removed as all kernel plugins moved to libcharon</changelog>
  <changelog author="ndas@suse.de" date="1504612800">- fix "uintptr_t? undeclared" compilation error.
  [+0006-fix-compilation-error-by-adding-stdint.h.patch]</changelog>
  <changelog author="ndas@suse.de" date="1504612801">- Updated to strongSwan 5.6.0 providing the following changes:
  * Fixed a DoS vulnerability in the gmp plugin that was caused by insufficient input validation
    when verifying RSA signatures, which requires decryption with the operation m^e mod n,
    where m is the signature, and e and n are the exponent and modulus of the public key.
    The value m is an integer between 0 and n-1, however, the gmp plugin did not verify this.
    So if m equals n the calculation results in 0, in which case mpz_export() returns NULL.
    This result wasn't handled properly causing a null-pointer dereference.
    This vulnerability has been registered as CVE-2017-11185. (bsc#1051222)
  * New SWIMA IMC/IMV pair implements the draft-ietf-sacm-nea-swima-patnc Internet
    Draft and has been demonstrated at the IETF 99 Prague Hackathon.
  * The IMV database template has been adapted to achieve full compliance with the
    ISO 19770-2:2015 SWID tag standard.
  * The pt-tls-client can attach and use TPM 2.0 protected private keys via the --keyid parameter.
  * By default the /etc/swanctl/conf.d directory is created and *.conf files in it are included in the default
    swanctl.conf file.
  * The curl plugin now follows HTTP redirects (configurable via strongswan.conf).
  * The CHILD_SA rekeying was fixed in charon-tkm and the behavior is refined a bit more since 5.5.3
  * libtpmtss supports Intel's TSS2 Architecture Broker and Resource Manager interface (tcti-tabrmd).
  * more on https://wiki.strongswan.org/versions/66</changelog>
  <changelog author="mmnelemane@suse.com" date="1521028800">- Removed unused requires and macro calls(bsc#1083261)</changelog>
  <changelog author="mmnelemane@suse.com" date="1573646400">- Added patch to fix vulnerability: CVE-2018-16151,CVE-2018-16152 (bsc#1107874)
  - Insufficient input validation in gmp plugin
  [+ 0007-strongswan-5.3.1-5.6.0_gmp-pkcs1-verify.patch]</changelog>
  <changelog author="mmnelemane@suse.com" date="1573646401">- Added patch to fix vulnerability: CVE-2018-5388 (bsc#1094462)
  - Buffer Underflow in stroke_socket.c
  [+ 0008-strongswan-5.1.2-5.6.2_stroke_msg_len.patch]</changelog>
  <changelog author="mmnelemane@suse.com" date="1573646402">- Added patch to fix vulnerability: CVE-2018-10811 (bsc#1093536)
  - denial-of-service vulnerability
  [+ 0009-strongswan-5.5.0-5.6.2_skeyseed_init.patch]</changelog>
  <changelog author="mmnelemane@suse.com" date="1573732800">- Added patch to fix vulnerability: CVE-2018-17540 (bsc#1109845)
  [+ 0010-strongswan-4.4.0-5.7.0_gmp-pkcs1-overflow.patch]</changelog>
  <changelog author="mmnelemane@suse.com" date="1580212800">- Updated to version 5.8.2 (jsc#SLE-11370)
  - Dropped following patches due to irrelevance in the updated version:
    [- strongswan_modprobe_syslog.patch ]
    [- strongswan_fipsfilter.patch ]
    [- 0006-fix-compilation-error-by-adding-stdint.h.patch ]
    [- 0007-strongswan-5.3.1-5.6.0_gmp-pkcs1-verify.patch ]
    [- 0008-strongswan-5.1.2-5.6.2_stroke_msg_len.patch ]
    [- 0009-strongswan-5.5.0-5.6.2_skeyseed_init.patch ]
    [- 0010-strongswan-4.4.0-5.7.0_gmp-pkcs1-overflow.patch ]
  - Version 5.8.2
  ===============
  * Identity-based CA constraints, which enforce that the certificate chain of the remote
    peer contains a CA certificate with a specific identity, are supported via
    vici/swanctl.conf. This is similar to the existing CA constraints but doesn't require
    that the CA certificate is locally installed, for instance, intermediate CA certificates
    received from the peers. Wildcard identity matching (e.g. ..., OU=Research, CN=*) could
    also be used for the latter but requires trust in the intermediate CAs to only issue
    certificates with legitimate subject DNs (e.g. the "Sales" CA must not issue certificates
    with OU=Research). With the new constraint that's not necessary as long as a path length
    basic constraint (--pathlen for pki --issue) prevents intermediate CAs from issuing further
    intermediate CAs.
  * Intermediate CA certificates may now be sent in hash-and-URL encoding by configuring a
    base URL for the parent CA (#3234, swanctl/rw-hash-and-url-multi-level).
  * Implemented NIST SP-800-90A Deterministic Random Bit Generator (DRBG) based on AES-CTR
    and SHA2-HMAC modes. Currently used by the gmp and ntru plugins.
  * Random nonces sent in an OCSP requests are now expected in the corresponding OCSP responses.
  * The kernel-netlink plugin now ignores deprecated IPv6 addresses for MOBIKE. Whether temporary
    or permanent IPv6 addresses are included now depends on the charon.prefer_temporary_addrs
    setting (#3192).
  * Extended Sequence Numbers (ESN) are configured via PF_KEY if supported by the kernel.
  * The PF_KEY socket's receive buffer in the kernel-pfkey plugin is now cleared before sending
    requests, as many of the messages sent by the kernel are sent as broadcasts to all PF_KEY
    sockets. This is an issue if an external tool is used to manage SAs/policies unrelated to
    IPsec (#3225).
  * The vici plugin now uses unique section names for CHILD_SAs in child-updown events (7c74ce9190).
  * For individually deleted CHILD_SAs (in particular for IKEv1) the vici child-updown event
    now includes more information about the CHILD_SAs such as traffic statistics (#3198).
  * Custom loggers are correctly re-registered if log levels are changed via stroke loglevel (#3182).
  * Avoid lockups during startup on low entropy systems when using OpenSSL 1.1.1 (095a2c2eac).
  * Instead of failing later when setting a key, creating HMACs via openssl plugin now fails
    instantly if the underlying hash algorithm isn't supported (e.g. MD5 in FIPS-mode) so fallbacks
    to other plugins work properly (#3284).
  * Exponents of RSA keys read from TPM 2.0 via SAPI are correctly converted (8ee1242f1438).
  * Routing table IDs &gt; 255 are supported for custom routes on Linux.
  * To avoid races, the check for hardware offloading support in the kernel-netlink plugin is
    performed during initialization of the plugin (a605452c03).
  * The D-Bus config file for charon-nm is now installed in $(datadir)/dbus-1/system.d instead of
    $(sysconfdir)/dbus-1/system.d, which is intended for sysadmin overrides.
    INVALID_MAJOR_VERSION notifies are now correctly sent in messages of the same exchange type
    and with the same message ID as the request.
  * IKEv2 SAs are now immediately destroyed when sending or receiving INVALID_SYNTAX notifies
    in authenticated messages.
  * For developers working from the repository the configure script now aborts if GNU gperf is
    not found.
  - Version 5.8.1
  ===============
  * RDNs in DNs of X.509 certificates can now optionally be matched less strict. The global
    strongswan.conf option charon.rdn_matching takes two alternative values that cause the
    matching algorithm to either ignore the order of matched RDNs (reordered) or additionally
    (relaxed) accept DNs that contain more RDNs than configured (unmatched RDNs are treated
    like wildcard matches).
  * The updown plugin now passes the same interface to the script that is also used for the
    automatically installed routes, that is, the interface over which the peer is reached
    instead of the interface on which the local address is found (#3095).
  * TPM 2.0 contexts are now protected by a mutex to prevent issues if multiple IKE_SAs use
    the same private key concurrently (4b25885025).
  * Do a rekey check after the third QM message was received (#3060).
  * If available, explicit_bzero() is now used as memwipe() instead of our own implementation.
  * An .editorconfig file has been added, mainly so Github shows files with proper indentation
    (68346b6962).
  * The internal certificate of the load-tester plugin has been modified so it can again be
    used as end-entity cert with 5.6.3 and later (#3139).
  * The maximum data length of received COOKIE notifies (64 bytes) is now enforced (#3160).
  - Version 5.8.0
  ===============
  * The systemd service units have been renamed. The modern unit, which was called
    strongswan-swanctl, is now called strongswan (the previous name is configured as alias in
    the unit, for which a symlink is created when the unit is enabled). The legacy unit is now
    called strongswan-starter.
  * Support for XFRM interfaces (available since Linux 4.19) has been added, which are intended
    to replace VTI devices (they are similar but offer several advantages, for instance, they
    are not bound to an address or address family).
  * IPsec SAs and policies are associated with such interfaces via interface IDs that can be
    configured in swanctl.conf (dynamic IDs may optionally be allocated for each SA and even
    direction). It's possible to use separate interfaces for in- and outbound traffic (or
    only use an interface in one direction and regular policies in the other).
  * Interfaces may be created dynamically via updown/vici scripts, or statically before or after
    establishing the SAs. Routes must be added manually as needed (the daemon will not install
    any routes for outbound policies with an interface ID).
  * When moving XFRM interfaces to other network namespaces they retain access to the SAs and
    policies installed in the original namespace, which allows providing IPsec tunnels for
    processes in other network namespaces without giving them access to the IPsec keys or
    IKE credentials.
    More information can be found on the page about route-based VPNs.
  * Initiation of childless IKE_SAs is supported (RFC 6023). If enabled and supported by the
    responder, no CHILD_SA is established during IKE_AUTH. Instead, all CHILD_SAs are created
    with CREATE_CHILD_SA exchanges. This allows using a separate DH exchange even for the
    first CHILD_SA, which is otherwise created during IKE_AUTH with keys derived from the
    IKE_SA's key material.
  * The swanctl --initiate command may be used to initiate only the IKE_SA via --ike
    option if --child is omitted and the peer supports this extension.
  * The NetworkManager backend and plugin support IPv6.
  * The new wolfssl plugin is a wrapper around the wolfSSL crypto library. Thanks to Sean
    Parkinson of wolfSSL Inc. for the initial patch.
  * IKE SPIs may optionally be labeled via the charon.spi_mask|label options in
    strongswan.conf. This feature was extracted from charon-tkm, however, now applies the
    mask/label in network order.
  * The openssl plugin supports ChaCha20-Poly1305 when built with OpenSSL 1.1.0.
  * The PB-TNC finite state machine according to section 3.2 of RFC 5793 was not correctly
    implemented when sending either a CRETRY or SRETRY batch. These batches can only be sent
    in the "Decided" state and a CRETRY batch can immediately carry all messages usually
    transported by a CDATA batch. It is currently not possible to send a SRETRY batch since
    full-duplex mode for PT-TLS transport is not supported.
  * Instead of marking IPv6 virtual IPs as deprecated, the kernel-netlink plugin now uses
    address labels to avoid that such addresses are used for non-VPN traffic (00a953d090).
  * The agent plugin now creates sockets to the ssh/gpg-agent dynamically and does not keep
    them open, which otherwise might prevent the agent from getting terminated.
  * To avoid broadcast loops the forecast plugin now only reinjects packets that are marked
    or received from the configured interface.
  * UTF-8 encoded passwords are supported via EAP-MSCHAPv2, which internally uses an UTF-16LE
    encoding to calculate the NT hash (#3014).
  * Properly delete temporary drop policies (used when updating IP addresses of SAs) if manual
    priorities are used, which was broken since 5.6.2 (8e31d65730).
  * Avoid overwriting start_action when parsing the inactivity timeout in the vici plugin (#2954).
  * Fixed the automatic termination of reloaded vici connections with start_action=start,
    which was broken since 5.6.3 (71b22c250f).
  * The lookup for shared secrets for IKEv1 SAs via sql plugin should now work better
    (6ec9f68f32).
  * Fixed a race condition in the trap manager between installation and removal of a policy
    (69cbe2ca3f).
  * Compilation of the kernel-netlink plugin has been fixed on old kernels (&lt; 2.6.39), which
    was caused by the HW offload changes (c7f579fa17).
  * The IPsec stack detection and module loading in starter has been removed (it wasn't
    enforced anyway and loading modules doesn't seem necessary, also KLIPS hasn't been
    supported for a long time and PF_KEY will eventually be removed from the Linux kernel,
    ba817d2917).
  * Several IKEv2 protocol details are now handled more strictly: Unrequested virtual IPs are
    ignored, CFG_REPLY payloads are ignored if no CFG_REQUEST payloads were sent, a USE
    TRANSPORT_MODE notify received from the responder is checked against the local configuration.
  * The keys and certificates used by the scenarios in the testing environment are now generated
    dynamically. Running the testing/scripts/build-certs script after creating the base and root
    images uses the pki utility installed in the latter to create the keys and certificates for
    all the CAs and in some cases for individual scenarios. These credentials are stored in the
    source tree, not the image, so this has to be called only once even if the images are later
    rebuilt. The script automatically (re-)rebuilds the guest images as that generates fresh
    CRLs and signs the DNS zones. The only keys/certificates currently not generated are the
    very large ones used by the ikev2/rw-eap-tls-fragments scenario.
  - Version 5.7.2
  ===============
  * For RSA with PSS padding, the TPM 2.0 specification mandates the maximum salt length
    (as defined by the length of the key and hash). However, if the TPM is FIPS-168-4 compliant,
    the salt length equals the hash length. This is assumed for FIPS-140-2 compliant TPMs, but
    if that's not the case, it might be necessary to manually enable charon.plugins.tpm.fips_186_4
    if the TPM doesn't use the maximum salt length.
  * Directories for credentials loaded by swanctl are now accessed relative to the loaded
    swanctl.conf file, in particular, when loading it from a custom location via --file argument.
  * The base directory, which is used if no custom location for swanctl.conf is specified, is now
    also configurable at runtime via SWANCTL_DIR environment variable.
  * If RADIUS Accounting is enabled, the eap-radius plugin will add the session ID (Acct-Session-Id)
    to Access-Request messages, which e.g. simplifies associating database entries for IP leases and
    accounting with sessions (the session ID does not change when IKE_SAs are rekeyed, #2853).
  * All IP addresses assigned by a RADIUS server are included in Accounting-Stop messages even if
    the client did not claim them, allowing to release them early in case of connection errors (#2856).
  * Selectors installed on transport mode SAs by the kernel-netlink plugin are now updated if an
    IP address changes (e.g. via MOBIKE) and it was part of the selectors.
  * No deletes are sent anymore when a rekeyed CHILD_SA expires (#2815).
  * The bypass-lan plugin now tracks interfaces to handle subnets that move from one interface
    to another and properly update associated routes (#2820).
  * Only valid and expected inbound IKEv2 messages are used to update the timestamp of the
    last received message (previously, retransmits also triggered an update).
  * IKEv2 requests from responders are now ignored until the IKE_SA is fully established (e.g. if a
    DPD request from the peer arrives before the IKE_AUTH response does, 46bea1add9).
    Delayed IKE_SA_INIT responses with COOKIE notifies we already recevied are ignored, they caused
    another reset of the IKE_SA previously (#2837).
  * Active and queued Quick Mode tasks are now adopted if the peer reauthenticates an IKEv1 SA
    while creating lots of CHILD_SAs.
  * Newer versions of the FreeBSD kernel add an SADB_X_EXT_SA2 extension to SADB_ACQUIRE
    messages, which allows the kernel-pfkey plugin to determine the reqid of the policy even if it
    wasn't installed by the daemon previously (e.g. when using FreeBSD's if_ipsec(4) VTIs, which
    install policies themselves, 872b9b3e8d).
  * Added support for RSA signatures with SHA-256 and SHA-512 to the agent plugin. For older
    versions of ssh/gpg-agent that only support SHA-1, IKEv2 signature authentication has to be
    disabled via charon.signature_authentication.
  * The sshkey and agent plugins support Ed25519/Ed448 SSH keys and signatures.
  * The openssl plugin supports X25519/X448 Diffie-Hellman and Ed25519/Ed448 keys and
    signatures when built against OpenSSL 1.1.1.
  * Support for Ed25519, ChaCha20/Poly1305, SHA-3 and AES-CCM were added to the botan plugin.
  * The mysql plugin now properly handles database connections with transactions
    under heavy load (#2779).
  * IP addresses in ha pools are now distributed evenly among all segments (#2828).
  * Private key implementations may optionally provide a list of supported signature schemes,
    which, as described above, is used by the tpm plugin because for each key on a TPM 2.0 the
    hash algorithm and for RSA also the padding scheme is predefined.
  * The testing environment is now based on Debian 9 (stretch) by default. This required
    some changes, in particular, updating to FreeRADIUS 3.x (which forced us to abandon the
    TNC@FHH patches and scenarios, 2fbe44bef3) and removing FIPS-enabled versions of
    OpenSSL (the FIPS module only supports OpenSSL 1.0.2).
  * Most test scenarios were migrated to swanctl.
  - Version 5.7.1
  ===============
  * Fixes a vulnerability in the gmp plugin triggered by crafted certificates with RSA keys with
    very small moduli. When verifying signatures with such keys, the code patched with the fix
    for CVE-2018-16151/2 caused an integer underflow and subsequent heap buffer overflow
    that results in a crash of the daemon.
  * The vulnerability has been registered as CVE-2018-17540.
  - Version 5.7.0
  ===============
  * Fixes a potential authorization bypass vulnerability in the gmp plugin that was caused by a
    too lenient verification of PKCS#1 v1.5 signatures. Several flaws could be exploited by a
    Bleichenbacher-style attack to forge signatures for low-exponent keys (i.e. with e=3).
  * CVE-2018-16151 has been assigned to the problem of accepting random bytes after the OID
    of the hash function in such signatures, and CVE-2018-16152 has been assigned to the issue
    of not verifying that the parameters in the ASN.1 algorithmIdentitifer structure is empty.
    Other flaws that don't lead to a vulnerability directly (e.g. not checking for at least
    8 bytes of padding) have no separate CVE assigned.
  * Dots are not allowed anymore in section names in swanctl.conf and strongswan.conf.
    This mainly affects the configuration of file loggers. If the path for such a log file
    contains dots it now has to be configured in the new path setting within the arbitrarily
    renamed subsection in the filelog section.
  * Sections in swanctl.conf and strongswan.conf may now reference other sections. All settings
    and subsections from such a section are inherited. This allows to simplify configs as
    redundant information has only to be specified once and may then be included in other
    sections (see strongswan.conf for an example).
  * The originally selected IKE config (based on the IPs and IKE version) can now change
    if no matching algorithm proposal is found. This way the order of the configs doesn't
    matter that much anymore and it's easily possible to specify separate configs for
    clients that require weaker algorithms (instead of having to also add them in other
    configs that might be selected).
  * Support for Postquantum Preshared Keys for IKEv2 (draft-ietf-ipsecme-qr-ikev2) has been added.
    For an example refer to the swanctl/rw-cert-ppk scenario (or with EAP, or PSK authentication).
  * The new botan plugin is a wrapper around the Botan C++ crypto library.
    It requires a fairly recent build from Botan's master branch (or the upcoming 2.8.0 release).
    Thanks to René Korthaus and his team from Rohde &amp; Schwarz Cybersecurity for the initial
    patch and to Jack Lloyd for quickly adding missing functions to Botan's FFI (C89) interface.
  * Implementation of RFC 8412 "Software Inventory Message and Attributes (SWIMA) for PA-TNC".
  * SWIMA subscription option sets CLOSE_WRITE trigger on apt history.log file resulting in
    a ClientRetry PB-TNC batch to initialize a new measurement cycle. The new imv/imc-swima
    plugins replace the previous imv/imc-swid plugins, which were removed.
  * Added support for fuzzing the PA-TNC (RFC 5792) and PB-TNC (RFC 5793) NEA protocols
    on Google's OSS-Fuzz infrastructure.
  * Support for version 2 of Intel's TPM2-TSS TGC Software Stack. The presence of the
    in-kernel /dev/tpmrm0 resource manager is automatically detected.
  * The pki tool accepts a xmppAddr otherName as a subjectAlternativeName using the
    syntax --san xmppaddr:&lt;jid&gt;.
  * swanctl.conf supports the configuration of marks the in- and/or outbound SA should apply
    to packets after processing on Linux. Configuring such a mark for outbound SAs requires
    at least a 4.14 kernel. The ability to set a mask and configuring a mark/mask for
    inbound SAs will be added with the upcoming 4.19 kernel.
  * New options in swanctl.conf allow configuring how/whether DF, ECN and DS fields in the
    IP headers are copied during IPsec processing. Controlling this is currently only possible
    on Linux.
  * The handling of sequence numbers in IKEv1 DPDs has been improved (#2714).
  * To avoid conflicts, the dhcp plugin now only uses the DHCP server port if explicitly
    configured.
  - Version 5.6.3
  ===============
  * Fixed a DoS vulnerability in the IKEv2 key derivation if the openssl plugin is used in FIPS
    mode and HMAC-MD5 is negotiated as PRF.
    This vulnerability has been registered as CVE-2018-10811.
  * Fixed a vulnerability in the stroke plugin, which did not check the received length before
    reading a message from the socket. Unless a group is configured, root privileges are
    required to access that socket, so in the default configuration this shouldn't be an issue.
    This vulnerability has been registered as CVE-2018-5388.
  * CRLs that are not yet valid are now ignored to avoid problems in scenarios where expired
    certificates are removed from new CRLs and the clock on the host doing the revocation
    check is trailing behind that of the host issuing CRLs. Not doing this could result in
    accepting a revoked and expired certificate, if it's still valid according to the
    trailing clock but not contained anymore in not yet valid CRLs.
  * The issuer of fetched CRLs is now compared to the issuer of the checked certificate (#2608).
  * CRL validation results other than revocation (e.g. a skipped check because the CRL couldn't
    be fetched) are now stored also for intermediate CA certificates and not only for end-entity
    certificates, so a strict CRL policy can be enforced in such cases.
  * In compliance with RFC 4945, section 5.1.3.2, certificates used for IKE must now either
    not contain a keyUsage extension (like the ones generated by pki), or have at least one of the
    digitalSignature or nonRepudiation bits set.
  * New options for vici/swanctl allow forcing the local termination of an IKE_SA. This might be
    useful in situations where it's known the other end is not reachable anymore, or that it
    already removed the IKE_SA, so retransmitting a DELETE and waiting for a response would
    be pointless.
  * Waiting only a certain amount of time for a response (i.e. shorter than all retransmits
    would be) before destroying the IKE_SA is also possible by additionally specifying a
    timeout in the forced termination request.
  * When removing routes, the kernel-netlink plugin now checks if it tracks other routes for
    the same destination and replaces the installed route instead of just removing it. Same
    during installation, where existing routes previously weren't replaced. This should allow
    using traps with virtual IPs on Linux (#2162).
  * The dhcp plugin now only sends the client identifier DHCP option if the identity_lease
    setting is enabled (7b660944b6). It can also send identities of up to 255 bytes length,
    instead of the previous 64 bytes (30e886fe3b, 0e5b94d038). If a server address is
    configured, DHCP requests are now sent from port 67 instead of 68 to avoid ICMP port
    unreachables (becf027cd9).
  * The handling of faulty INVALID_KE_PAYLOAD notifies (e.g. one containing a DH group
    that wasn't proposed) during CREATE_CHILD_SA exchanges has been improved (#2536).
  * Roam events are now completely ignored for IKEv1 SAs (there is no MOBIKE to handle such
    changes properly).
  * ChaCha20/Poly1305 is now correctly proposed without key length (#2614). For compatibility with
    older releases the chacha20poly1305compat keyword may be included in proposals to also propose
    the algorithm with a key length (c58434aeff).
  * Configuration of hardware offload of IPsec SAs is now more flexible and allows a new
    setting (auto), which automatically uses it if the kernel and device both support it. If hw
    offload is set to yes and offloading is not supported, the CHILD_SA installation now fails.
  * The kernel-pfkey plugin optionally installs routes via internal interface (one with an IP
    in the local traffic selector). On FreeBSD, enabling this selects the correct source IP
    when sending packets from the gateway itself (e811659323).
  * SHA-2 based PRFs are supported in PKCS#8 files as generated by OpenSSL 1.1 (#2574).
  * The pki --verify tool may load CA certificates and CRLs from directories.
  * The IKE daemon now also switches to port 4500 if the remote port is not 500 (e.g. because the
    remote maps the response to a different port, as might happen on Azure), as long as the local
    port is 500 (85bfab621d).
  * Fixed an issue with DNS servers passed to NetworkManager in charon-nm (ee8c25516a).
  * Logged traffic selectors now always contain the protocol if either protocol or port are set
    (a36d8097ed).
  * Only the inbound SA/policy will be updated as reaction to IP address changes for rekeyed
    CHILD_SAs that are kept around.
  * The parser for strongswan.conf/swanctl.conf now accepts = characters in values without
    having to put the value in quotes (e.g. for Base64 encoded shared secrets).
    Notes for developers:
  * trap_manager_t: Trap policies are now unistalled by peer/child name and not the reqid.
  * No reqid is returned anymore when installing trap policies.
  * child_sa_t: A new state (CHILD_DELETED) is used for CHILD_SAs that have been deleted but
    not yet destroyed (after a rekeying CHILD_SAs are kept around for a while to process
    delayed packets).
    This way child_updown events are not triggered anymore for such SAs when an IKE_SA that
    has such CHILD_SAs assigned is deleted.
  - Version 5.6.2
  ===============
  * Fixed a DoS vulnerability in the parser for PKCS#1 RSASSA-PSS signatures that was caused
    by insufficient input validation. One of the configurable parameters in algorithm identifier
    structures for RSASSA-PSS signatures is the mask generation function (MGF). Only MGF1 is
    currently specified for this purpose. However, this in turn takes itself a parameter that
    specifies the underlying hash function. strongSwan's parser did not correctly handle the
    case of this parameter being absent, causing an undefined data read.
    This vulnerability has been registered as CVE-2018-6459.
  * When rekeying IKEv2 IKE_SAs the previously negotiated DH group will be reused, instead of
    using the first configured group, which avoids an additional exchange if the peer previously
    selected a different DH group via INVALID_KE_PAYLOAD notify. The same is also done when
    rekeying CHILD_SAs except for the first rekeying of the CHILD_SA that was created with the
    IKE_SA, where no DH group was negotiated yet.
    Also, the selected DH group is moved to the front in all sent proposals that contain it
    and all proposals that don't are moved to the back in order to convey the preference for
    this group to the peer.
  * Handling of MOBIKE task queuing has been improved. In particular, the response to an
    address update (with NAT-D payloads) is not ignored anymore if only an address list update
    or DPD is queued as that could prevent updating the UDP encapsulation in the kernel.
  * On Linux, roam events may optionally be triggered by changes to the routing rules, which
    can be useful if routing rules (instead of e.g. route metrics) are used to switch from one
    to another interface (i.e. from one to another routing table). Since routing rules are
    currently not evaluated when doing route lookups this is only useful if the kernel-based
    route lookup is used (4664992f7d).
  * The fallback drop policies installed to avoid traffic leaks when replacing addresses in
    installed policies are now replaced by temporary drop policies, which also prevent
    acquires because we currently delete and reinstall IPsec SAs to update their addresses
    (35ef1b032d).
  * Access X.509 certificates held in non-volatile storage of a TPM 2.0 referenced via the
    NV index.
    Adding the --keyid parameter to pki --print allows to print private keys or certificates
    stored in a smartcard or a TPM 2.0.
  * Fixed proposal selection if a peer incorrectly sends DH groups in the ESP proposal during
    IKE_AUTH and also if a DH group is configured in the local ESP proposal and charon.prefer
    configured_proposals is disabled (d058fd3c32).
  * The lookup for PSK secrets for IKEv1 has been improved for certain scenarios (see #2497
    for details).
  * MSKs received via RADIUS are now padded to 64 bytes to avoid compatibility issues with
    EAP-MSCHAPv2 and PRFs that have a block size &lt; 64 bytes (e.g. AES-XCBC-PRF-128, see
    73cbce6013).
  * The tpm_extendpcr command line tool extends a digest into a TPM PCR.
  * Ported the NetworkManager backend from the deprecated libnm-glib to libnm.
  * The save-keys debugging/development plugin saves IKE and/or ESP keys to files compatible
    with Wireshark.
  - Version 5.6.1
  ===============
  * Several algorithms were removed from the default ESP/AH and IKE proposals in compliance with
    RFC 8221 and RFC 8247, respectively. Removed from the default ESP/AH proposal were the
    3DES and Blowfish encryption algorithms and the HMAC-MD5 integrity algorithm. From the IKE
    default proposal the HMAC-MD5 integrity algorithm and the MODP-1024 Diffie-Hellman group
    were removed (the latter is significant for Windows clients in their default configuration).
    These algorithms may still be used in custom proposals.
  * Support for RSASSA-PSS signatures has been added. For compatibility with previous
    releases they are currently not used automatically, by default, to change that charon.rsa_pss
    may be enabled. To explicitly use or require such signatures during IKEv2 signature
    authentication (RFC 7427) ike:rsa/pss... authentication constraints may be used for specific
    connections (regardless of whether the strongswan.conf option above is enabled). Only the
    hash algorithm can be specified in such constraints, the MGF1 will be based on that hash
    and the salt length will equal the hash length (when verifying the salt length is not
    enforced).
    To enforce such signatures during PKI verification use rsa/pss... authentication constraints.
  * All pki commands that create certificates/CRLs can be made to sign with RSASSA-PSS instead
    of the classing PKCS#1 scheme with the --rsa-padding pss option. As with signatures during
    authentication, only the hash algorithm is configurable (via --digest option), the MGF1 will
    be based on that and the salt length will equal the hash length.
  * These signatures are supported by all RSA backends except pkcs11 (i.e. gmp, gcrypt, openssl).
    The gmp plugin requires the mgf1 plugin.
    Note that RSASSA-PSS algorithm identifiers and parameters in keys (public keys in
    certificates or private keys in PKCS#8 files) are currently not used as constraints.
  * The sec-updater tool checks for security updates in dpkg-based repositories
    (e.g. Debian/Ubuntu) and sets the security flags in the IMV policy database accordingly.
    Additionally for each new package version a SWID tag for the given OS and HW architecture
    is created and stored in the database.
  * Using the sec-updater.sh script template the lookup can be automated (e.g. via an hourly
    cron job).
  * When restarting an IKEv2 negotiation after receiving an INVALID_KE_PAYLOAD notify (or due
    to other reasons like too many retransmits) a new initiator SPI is allocated. This
    prevents issues caused by retransmits for IKE_SA_INIT messages.
  * Because the initiator SPI was previously reused when restarting the connection delayed
    responses for previous connection attempts were processed and might have caused fatal
    errors due to a failed DH negotiation or because of the internal retry counter in the
    ike-init task. For instance, if we proposed a DH group the responder rejected we
    might have later received delayed responses that either contained INVALID_KE_PAYLOAD
    notifies with the DH group we already switched to, or, if we retransmitted an
    IKE_SA_INIT with the requested group but then had to restart again, a KE payload with
    a group different from the one we proposed.
  * The introduction of file versions in the IMV database scheme broke file reference hash
    measurements. This has been fixed by creating generic product versions having an empty
    package name.
  * A new timeout option for the systime-fix plugin stops periodic system time checks after
    a while and enforces a certificate verification, closing or reauthenticating all SAs
    with invalid certificates.
  * The IKE event counters, previously only available via ipsec listcounters command, may
    now also be queried and reset via vici and the new swanctl --counters command. They
    are collected and provided by the optional counters plugin (enabled by default for
    backwards compatibility if the stroke plugin is built).
  * Class attributes received in RADIUS Access-Accept messages may optionally be added to
    RADIUS accounting messages (655924074b).
  * Basic support for systemd sockets has been added, which may be used for privilege separation
    (59db98fb94).
  * Inbound marks may optionally be installed in the SA again (was removed with 5.5.2) by
    enabling the mark_in_sa option in swanctl.conf.
  * The timeout of leases in pools configured via pool utility may be configured in other
    units than hours.
    INITIAL_CONTACT notifies are now only omitted if never is configured as uniqueness policy.
  * Outbound FWD policies for shunts are not installed anymore, by default (as is the case
    for other policies since 5.5.1).
  * Don't consider a DH group mismatch during CHILD_SA rekeying as failure as responder
    (e7276f78aa).
  * Handling of fragmented IPv4 and IPv6 packets in libipsec has been improved (e138003de9).
  * Trigger expire events for the correct IPsec SA in libipsec (6e861947a0).
  * A crash in CRL verification via openssl plugin using OpenSSL 1.1 has been fixed (78acaba6a1).
  * No hard-coded default proposals are passed from starter to the stroke plugin anymore (the
    IKE proposal used curve25519 since 5.5.2, which is an optional plugin).
  * A workaround for an issue with virtual IPs on macOS 10.13 (High Sierra) has been added
    (039b85dd43).
  * Handling of IKE_SA rekey collisions in charon-tkm has been fixed.
  * Instead of failing or just silently doing nothing unit tests may now warn about certain
    conditions (e.g. if a test was not executed due to external dependencies).</changelog>
  <changelog author="mmnelemane@suse.com" date="1585224000">- Fix for to resolve multiple definition of swanctl_dir (bsc #1164493)
  [+ 0006-Resolve-multiple-definition-of-swanctl_dir.patch]</changelog>
  <changelog author="mbuil@suse.com" date="1610712000">- Fix typo in README (bsc #1167880)
  [+ 0007-Fix-typo-in-README.patch ]</changelog>
  <changelog author="mbuil@suse.com" date="1611576000">- Fix FIPS bug (bsc #1180801)
  [+ 0008-gcrypt-Use-a-dummy-buffer-to-initialize-static-alloc.patch ]</changelog>
  <changelog author="mbuil@suse.com" date="1617019200">- Keep using ipsec as the main binary. Therefore, make strongswan.service point to it instead of swanctl</changelog>
  <changelog author="mbuil@suse.com" date="1617019201">- Information added in README about the rcstrongswan-starter</changelog>
  <changelog author="mbuil@suse.com" date="1617624000">- Add config to run ipsec on namespaces (bsc #1183670)</changelog>
  <changelog author="mt@suse.com" date="1619006400">- Add support for AES CCM aead algorithms to openssl plugin (cc/fips,bsc#1185363)
  [+ 0009-strongswan-openssl-aead-add-ccm-support.patch]</changelog>
  <changelog author="mt@suse.com" date="1620388800">- Replace AEAD AES CCM patch with upstream variant (cc/fips,bsc#1185363)
  [* 0009-strongswan-openssl-aead-add-ccm-support.patch]</changelog>
  <changelog author="hare@suse.de" date="1627646400">- Add auth_els plugin to support Marvell FC-SP encryption (jsc#SLE-20151)
  [* strongswan-marvell-auth-els.patch]</changelog>
  <changelog author="abergmann@suse.com" date="1634040000">- Fix integer overflow in gmp plugin (bsc#1191367, CVE-2021-41990)
  [* strongswan-5.6.1-5.9.3_gmp-rsa-ssa-salt-len.patch]
- Fix integer overflow when replacing certificates in cache (bsc#1191435, CVE-2021-41991)
  [* strongswan-4.4.1-5.9.3_cert-cache-random.patch]</changelog>
  <changelog author="meissner@suse.com" date="1643025600">- strongswan-5.5.0-5.9.4_eap_success-CVE-2021-45079.patch:
  Fixed authentication bypass in EAP authentication (CVE-2021-45079
  bsc#1194471)</changelog>
</package>
<package pkgid="65182db0f6a4836ec4c5a458d0b827bed6041d1c2109d00e5197c1bc14d44b18" name="strongswan-nm" arch="x86_64">
  <version epoch="0" ver="5.8.2" rel="11.24.1"/>
  <changelog author="ndas@suse.de" date="1501502400">- Updated to strongSwan 5.3.5(bsc#1050691) providing the following changes:
  * Fixed a DoS vulnerability in the gmp plugin that was caused by insufficient input
    validation when verifying RSA signatures. More specifically, mpz_powm_sec() has two
    requirements regarding the passed exponent and modulus that the plugin did not
    enforce, if these are not met the calculation will result in a floating point exception
    that crashes the whole process.
    This vulnerability has been registered as CVE-2017-9022.
    Please refer to our blog for details.
  * Fixed a DoS vulnerability in the x509 plugin that was caused because the ASN.1 parser
    didn't handle ASN.1 CHOICE types properly, which could result in an infinite loop when
    parsing X.509 extensions that use such types.
    This vulnerability has been registered as CVE-2017-9023.
    Please refer to our blog for details.
  * The behavior during IKEv2 CHILD_SA rekeying has been changed in order to avoid
    traffic loss. When responding to a CREATE_CHILD_SA request to rekey a CHILD_SA
    the responder already has everything available to install and use the new CHILD_SA.
    However, this could lead to lost traffic as the initiator won't be able to process
    inbound packets until it processed the CREATE_CHILD_SA response and updated the
    inbound SA. To avoid this the responder now only installs the new inbound SA and
    delays installing the outbound SA until it receives the DELETE for the replaced CHILD_SA.
  * The messages transporting these DELETEs could reach the peer before packets sent
    with the deleted outbound SAs reach it. To reduce the chance of traffic loss due
    to this the inbound SA of the replaced CHILD_SA is not removed for a configurable
    amount of seconds (charon.delete_rekeyed_delay) after the DELETE has been processed.
  * The code base has been ported to Apple's ARM64 iOS platform, which required several
    changes regarding the use of variadic functions. This was necessary because the calling
    conventions for variadic and regular functions are different there.
    This means that assigning a non-variadic function to a variadic function pointer, as we
    did with our enumerator_t::enumerate() implementations and several callbacks, will
    result in crashes as the called function accesses the arguments differently than the
    caller provided them. To avoid this issue the enumerator_t interface has been changed
    and the signature of the callback functions for enumerator_create_filter() and two
    methods on linked_list_t have been changed. Refer to the developer notes below
    for details.
  * Adds support for fuzzing the certificate parser provided by the default plugins
    (x509, pem, gmp etc.) on Google's OSS-Fuzz infrastructure (or generally with
    libFuzzer). Several issues found while fuzzing these plugins were fixed.
  * Two new options have been added to charon's retransmission settings:
    retransmit_limit and retransmit_jitter. The former adds an upper limit to the
    calculated retransmission timeout, the latter randomly reduces it.
    Refer to Retransmission for details.
  * A bug in swanctl's --load-creds command was fixed that caused unencrypted
    private keys to get unloaded if the command was called multiple times.
    The load-key VICI command now returns the key ID of the loaded key on success.
  * The credential manager now enumerates local credential sets before global ones.
    This means certificates supplied by the peer will now be preferred over certificates
    with the same identity that may be locally stored (e.g. in the certificate cache).
  * Adds support for hardware offload of IPsec SAs as introduced by Linux 4.11 for
    specific hardware that supports this.
  * The pki tool loads the curve25519 plugin by default.
    [- 0006-Make-sure-the-modulus-is-odd-and-the-exponent-not-zero.patch,
  - 0007-asn1-parser-Fix-CHOICE-parsing.patch]
- libhydra is removed as all kernel plugins moved to libcharon</changelog>
  <changelog author="ndas@suse.de" date="1504612800">- fix "uintptr_t? undeclared" compilation error.
  [+0006-fix-compilation-error-by-adding-stdint.h.patch]</changelog>
  <changelog author="ndas@suse.de" date="1504612801">- Updated to strongSwan 5.6.0 providing the following changes:
  * Fixed a DoS vulnerability in the gmp plugin that was caused by insufficient input validation
    when verifying RSA signatures, which requires decryption with the operation m^e mod n,
    where m is the signature, and e and n are the exponent and modulus of the public key.
    The value m is an integer between 0 and n-1, however, the gmp plugin did not verify this.
    So if m equals n the calculation results in 0, in which case mpz_export() returns NULL.
    This result wasn't handled properly causing a null-pointer dereference.
    This vulnerability has been registered as CVE-2017-11185. (bsc#1051222)
  * New SWIMA IMC/IMV pair implements the draft-ietf-sacm-nea-swima-patnc Internet
    Draft and has been demonstrated at the IETF 99 Prague Hackathon.
  * The IMV database template has been adapted to achieve full compliance with the
    ISO 19770-2:2015 SWID tag standard.
  * The pt-tls-client can attach and use TPM 2.0 protected private keys via the --keyid parameter.
  * By default the /etc/swanctl/conf.d directory is created and *.conf files in it are included in the default
    swanctl.conf file.
  * The curl plugin now follows HTTP redirects (configurable via strongswan.conf).
  * The CHILD_SA rekeying was fixed in charon-tkm and the behavior is refined a bit more since 5.5.3
  * libtpmtss supports Intel's TSS2 Architecture Broker and Resource Manager interface (tcti-tabrmd).
  * more on https://wiki.strongswan.org/versions/66</changelog>
  <changelog author="mmnelemane@suse.com" date="1521028800">- Removed unused requires and macro calls(bsc#1083261)</changelog>
  <changelog author="mmnelemane@suse.com" date="1573646400">- Added patch to fix vulnerability: CVE-2018-16151,CVE-2018-16152 (bsc#1107874)
  - Insufficient input validation in gmp plugin
  [+ 0007-strongswan-5.3.1-5.6.0_gmp-pkcs1-verify.patch]</changelog>
  <changelog author="mmnelemane@suse.com" date="1573646401">- Added patch to fix vulnerability: CVE-2018-5388 (bsc#1094462)
  - Buffer Underflow in stroke_socket.c
  [+ 0008-strongswan-5.1.2-5.6.2_stroke_msg_len.patch]</changelog>
  <changelog author="mmnelemane@suse.com" date="1573646402">- Added patch to fix vulnerability: CVE-2018-10811 (bsc#1093536)
  - denial-of-service vulnerability
  [+ 0009-strongswan-5.5.0-5.6.2_skeyseed_init.patch]</changelog>
  <changelog author="mmnelemane@suse.com" date="1573732800">- Added patch to fix vulnerability: CVE-2018-17540 (bsc#1109845)
  [+ 0010-strongswan-4.4.0-5.7.0_gmp-pkcs1-overflow.patch]</changelog>
  <changelog author="mmnelemane@suse.com" date="1580212800">- Updated to version 5.8.2 (jsc#SLE-11370)
  - Dropped following patches due to irrelevance in the updated version:
    [- strongswan_modprobe_syslog.patch ]
    [- strongswan_fipsfilter.patch ]
    [- 0006-fix-compilation-error-by-adding-stdint.h.patch ]
    [- 0007-strongswan-5.3.1-5.6.0_gmp-pkcs1-verify.patch ]
    [- 0008-strongswan-5.1.2-5.6.2_stroke_msg_len.patch ]
    [- 0009-strongswan-5.5.0-5.6.2_skeyseed_init.patch ]
    [- 0010-strongswan-4.4.0-5.7.0_gmp-pkcs1-overflow.patch ]
  - Version 5.8.2
  ===============
  * Identity-based CA constraints, which enforce that the certificate chain of the remote
    peer contains a CA certificate with a specific identity, are supported via
    vici/swanctl.conf. This is similar to the existing CA constraints but doesn't require
    that the CA certificate is locally installed, for instance, intermediate CA certificates
    received from the peers. Wildcard identity matching (e.g. ..., OU=Research, CN=*) could
    also be used for the latter but requires trust in the intermediate CAs to only issue
    certificates with legitimate subject DNs (e.g. the "Sales" CA must not issue certificates
    with OU=Research). With the new constraint that's not necessary as long as a path length
    basic constraint (--pathlen for pki --issue) prevents intermediate CAs from issuing further
    intermediate CAs.
  * Intermediate CA certificates may now be sent in hash-and-URL encoding by configuring a
    base URL for the parent CA (#3234, swanctl/rw-hash-and-url-multi-level).
  * Implemented NIST SP-800-90A Deterministic Random Bit Generator (DRBG) based on AES-CTR
    and SHA2-HMAC modes. Currently used by the gmp and ntru plugins.
  * Random nonces sent in an OCSP requests are now expected in the corresponding OCSP responses.
  * The kernel-netlink plugin now ignores deprecated IPv6 addresses for MOBIKE. Whether temporary
    or permanent IPv6 addresses are included now depends on the charon.prefer_temporary_addrs
    setting (#3192).
  * Extended Sequence Numbers (ESN) are configured via PF_KEY if supported by the kernel.
  * The PF_KEY socket's receive buffer in the kernel-pfkey plugin is now cleared before sending
    requests, as many of the messages sent by the kernel are sent as broadcasts to all PF_KEY
    sockets. This is an issue if an external tool is used to manage SAs/policies unrelated to
    IPsec (#3225).
  * The vici plugin now uses unique section names for CHILD_SAs in child-updown events (7c74ce9190).
  * For individually deleted CHILD_SAs (in particular for IKEv1) the vici child-updown event
    now includes more information about the CHILD_SAs such as traffic statistics (#3198).
  * Custom loggers are correctly re-registered if log levels are changed via stroke loglevel (#3182).
  * Avoid lockups during startup on low entropy systems when using OpenSSL 1.1.1 (095a2c2eac).
  * Instead of failing later when setting a key, creating HMACs via openssl plugin now fails
    instantly if the underlying hash algorithm isn't supported (e.g. MD5 in FIPS-mode) so fallbacks
    to other plugins work properly (#3284).
  * Exponents of RSA keys read from TPM 2.0 via SAPI are correctly converted (8ee1242f1438).
  * Routing table IDs &gt; 255 are supported for custom routes on Linux.
  * To avoid races, the check for hardware offloading support in the kernel-netlink plugin is
    performed during initialization of the plugin (a605452c03).
  * The D-Bus config file for charon-nm is now installed in $(datadir)/dbus-1/system.d instead of
    $(sysconfdir)/dbus-1/system.d, which is intended for sysadmin overrides.
    INVALID_MAJOR_VERSION notifies are now correctly sent in messages of the same exchange type
    and with the same message ID as the request.
  * IKEv2 SAs are now immediately destroyed when sending or receiving INVALID_SYNTAX notifies
    in authenticated messages.
  * For developers working from the repository the configure script now aborts if GNU gperf is
    not found.
  - Version 5.8.1
  ===============
  * RDNs in DNs of X.509 certificates can now optionally be matched less strict. The global
    strongswan.conf option charon.rdn_matching takes two alternative values that cause the
    matching algorithm to either ignore the order of matched RDNs (reordered) or additionally
    (relaxed) accept DNs that contain more RDNs than configured (unmatched RDNs are treated
    like wildcard matches).
  * The updown plugin now passes the same interface to the script that is also used for the
    automatically installed routes, that is, the interface over which the peer is reached
    instead of the interface on which the local address is found (#3095).
  * TPM 2.0 contexts are now protected by a mutex to prevent issues if multiple IKE_SAs use
    the same private key concurrently (4b25885025).
  * Do a rekey check after the third QM message was received (#3060).
  * If available, explicit_bzero() is now used as memwipe() instead of our own implementation.
  * An .editorconfig file has been added, mainly so Github shows files with proper indentation
    (68346b6962).
  * The internal certificate of the load-tester plugin has been modified so it can again be
    used as end-entity cert with 5.6.3 and later (#3139).
  * The maximum data length of received COOKIE notifies (64 bytes) is now enforced (#3160).
  - Version 5.8.0
  ===============
  * The systemd service units have been renamed. The modern unit, which was called
    strongswan-swanctl, is now called strongswan (the previous name is configured as alias in
    the unit, for which a symlink is created when the unit is enabled). The legacy unit is now
    called strongswan-starter.
  * Support for XFRM interfaces (available since Linux 4.19) has been added, which are intended
    to replace VTI devices (they are similar but offer several advantages, for instance, they
    are not bound to an address or address family).
  * IPsec SAs and policies are associated with such interfaces via interface IDs that can be
    configured in swanctl.conf (dynamic IDs may optionally be allocated for each SA and even
    direction). It's possible to use separate interfaces for in- and outbound traffic (or
    only use an interface in one direction and regular policies in the other).
  * Interfaces may be created dynamically via updown/vici scripts, or statically before or after
    establishing the SAs. Routes must be added manually as needed (the daemon will not install
    any routes for outbound policies with an interface ID).
  * When moving XFRM interfaces to other network namespaces they retain access to the SAs and
    policies installed in the original namespace, which allows providing IPsec tunnels for
    processes in other network namespaces without giving them access to the IPsec keys or
    IKE credentials.
    More information can be found on the page about route-based VPNs.
  * Initiation of childless IKE_SAs is supported (RFC 6023). If enabled and supported by the
    responder, no CHILD_SA is established during IKE_AUTH. Instead, all CHILD_SAs are created
    with CREATE_CHILD_SA exchanges. This allows using a separate DH exchange even for the
    first CHILD_SA, which is otherwise created during IKE_AUTH with keys derived from the
    IKE_SA's key material.
  * The swanctl --initiate command may be used to initiate only the IKE_SA via --ike
    option if --child is omitted and the peer supports this extension.
  * The NetworkManager backend and plugin support IPv6.
  * The new wolfssl plugin is a wrapper around the wolfSSL crypto library. Thanks to Sean
    Parkinson of wolfSSL Inc. for the initial patch.
  * IKE SPIs may optionally be labeled via the charon.spi_mask|label options in
    strongswan.conf. This feature was extracted from charon-tkm, however, now applies the
    mask/label in network order.
  * The openssl plugin supports ChaCha20-Poly1305 when built with OpenSSL 1.1.0.
  * The PB-TNC finite state machine according to section 3.2 of RFC 5793 was not correctly
    implemented when sending either a CRETRY or SRETRY batch. These batches can only be sent
    in the "Decided" state and a CRETRY batch can immediately carry all messages usually
    transported by a CDATA batch. It is currently not possible to send a SRETRY batch since
    full-duplex mode for PT-TLS transport is not supported.
  * Instead of marking IPv6 virtual IPs as deprecated, the kernel-netlink plugin now uses
    address labels to avoid that such addresses are used for non-VPN traffic (00a953d090).
  * The agent plugin now creates sockets to the ssh/gpg-agent dynamically and does not keep
    them open, which otherwise might prevent the agent from getting terminated.
  * To avoid broadcast loops the forecast plugin now only reinjects packets that are marked
    or received from the configured interface.
  * UTF-8 encoded passwords are supported via EAP-MSCHAPv2, which internally uses an UTF-16LE
    encoding to calculate the NT hash (#3014).
  * Properly delete temporary drop policies (used when updating IP addresses of SAs) if manual
    priorities are used, which was broken since 5.6.2 (8e31d65730).
  * Avoid overwriting start_action when parsing the inactivity timeout in the vici plugin (#2954).
  * Fixed the automatic termination of reloaded vici connections with start_action=start,
    which was broken since 5.6.3 (71b22c250f).
  * The lookup for shared secrets for IKEv1 SAs via sql plugin should now work better
    (6ec9f68f32).
  * Fixed a race condition in the trap manager between installation and removal of a policy
    (69cbe2ca3f).
  * Compilation of the kernel-netlink plugin has been fixed on old kernels (&lt; 2.6.39), which
    was caused by the HW offload changes (c7f579fa17).
  * The IPsec stack detection and module loading in starter has been removed (it wasn't
    enforced anyway and loading modules doesn't seem necessary, also KLIPS hasn't been
    supported for a long time and PF_KEY will eventually be removed from the Linux kernel,
    ba817d2917).
  * Several IKEv2 protocol details are now handled more strictly: Unrequested virtual IPs are
    ignored, CFG_REPLY payloads are ignored if no CFG_REQUEST payloads were sent, a USE
    TRANSPORT_MODE notify received from the responder is checked against the local configuration.
  * The keys and certificates used by the scenarios in the testing environment are now generated
    dynamically. Running the testing/scripts/build-certs script after creating the base and root
    images uses the pki utility installed in the latter to create the keys and certificates for
    all the CAs and in some cases for individual scenarios. These credentials are stored in the
    source tree, not the image, so this has to be called only once even if the images are later
    rebuilt. The script automatically (re-)rebuilds the guest images as that generates fresh
    CRLs and signs the DNS zones. The only keys/certificates currently not generated are the
    very large ones used by the ikev2/rw-eap-tls-fragments scenario.
  - Version 5.7.2
  ===============
  * For RSA with PSS padding, the TPM 2.0 specification mandates the maximum salt length
    (as defined by the length of the key and hash). However, if the TPM is FIPS-168-4 compliant,
    the salt length equals the hash length. This is assumed for FIPS-140-2 compliant TPMs, but
    if that's not the case, it might be necessary to manually enable charon.plugins.tpm.fips_186_4
    if the TPM doesn't use the maximum salt length.
  * Directories for credentials loaded by swanctl are now accessed relative to the loaded
    swanctl.conf file, in particular, when loading it from a custom location via --file argument.
  * The base directory, which is used if no custom location for swanctl.conf is specified, is now
    also configurable at runtime via SWANCTL_DIR environment variable.
  * If RADIUS Accounting is enabled, the eap-radius plugin will add the session ID (Acct-Session-Id)
    to Access-Request messages, which e.g. simplifies associating database entries for IP leases and
    accounting with sessions (the session ID does not change when IKE_SAs are rekeyed, #2853).
  * All IP addresses assigned by a RADIUS server are included in Accounting-Stop messages even if
    the client did not claim them, allowing to release them early in case of connection errors (#2856).
  * Selectors installed on transport mode SAs by the kernel-netlink plugin are now updated if an
    IP address changes (e.g. via MOBIKE) and it was part of the selectors.
  * No deletes are sent anymore when a rekeyed CHILD_SA expires (#2815).
  * The bypass-lan plugin now tracks interfaces to handle subnets that move from one interface
    to another and properly update associated routes (#2820).
  * Only valid and expected inbound IKEv2 messages are used to update the timestamp of the
    last received message (previously, retransmits also triggered an update).
  * IKEv2 requests from responders are now ignored until the IKE_SA is fully established (e.g. if a
    DPD request from the peer arrives before the IKE_AUTH response does, 46bea1add9).
    Delayed IKE_SA_INIT responses with COOKIE notifies we already recevied are ignored, they caused
    another reset of the IKE_SA previously (#2837).
  * Active and queued Quick Mode tasks are now adopted if the peer reauthenticates an IKEv1 SA
    while creating lots of CHILD_SAs.
  * Newer versions of the FreeBSD kernel add an SADB_X_EXT_SA2 extension to SADB_ACQUIRE
    messages, which allows the kernel-pfkey plugin to determine the reqid of the policy even if it
    wasn't installed by the daemon previously (e.g. when using FreeBSD's if_ipsec(4) VTIs, which
    install policies themselves, 872b9b3e8d).
  * Added support for RSA signatures with SHA-256 and SHA-512 to the agent plugin. For older
    versions of ssh/gpg-agent that only support SHA-1, IKEv2 signature authentication has to be
    disabled via charon.signature_authentication.
  * The sshkey and agent plugins support Ed25519/Ed448 SSH keys and signatures.
  * The openssl plugin supports X25519/X448 Diffie-Hellman and Ed25519/Ed448 keys and
    signatures when built against OpenSSL 1.1.1.
  * Support for Ed25519, ChaCha20/Poly1305, SHA-3 and AES-CCM were added to the botan plugin.
  * The mysql plugin now properly handles database connections with transactions
    under heavy load (#2779).
  * IP addresses in ha pools are now distributed evenly among all segments (#2828).
  * Private key implementations may optionally provide a list of supported signature schemes,
    which, as described above, is used by the tpm plugin because for each key on a TPM 2.0 the
    hash algorithm and for RSA also the padding scheme is predefined.
  * The testing environment is now based on Debian 9 (stretch) by default. This required
    some changes, in particular, updating to FreeRADIUS 3.x (which forced us to abandon the
    TNC@FHH patches and scenarios, 2fbe44bef3) and removing FIPS-enabled versions of
    OpenSSL (the FIPS module only supports OpenSSL 1.0.2).
  * Most test scenarios were migrated to swanctl.
  - Version 5.7.1
  ===============
  * Fixes a vulnerability in the gmp plugin triggered by crafted certificates with RSA keys with
    very small moduli. When verifying signatures with such keys, the code patched with the fix
    for CVE-2018-16151/2 caused an integer underflow and subsequent heap buffer overflow
    that results in a crash of the daemon.
  * The vulnerability has been registered as CVE-2018-17540.
  - Version 5.7.0
  ===============
  * Fixes a potential authorization bypass vulnerability in the gmp plugin that was caused by a
    too lenient verification of PKCS#1 v1.5 signatures. Several flaws could be exploited by a
    Bleichenbacher-style attack to forge signatures for low-exponent keys (i.e. with e=3).
  * CVE-2018-16151 has been assigned to the problem of accepting random bytes after the OID
    of the hash function in such signatures, and CVE-2018-16152 has been assigned to the issue
    of not verifying that the parameters in the ASN.1 algorithmIdentitifer structure is empty.
    Other flaws that don't lead to a vulnerability directly (e.g. not checking for at least
    8 bytes of padding) have no separate CVE assigned.
  * Dots are not allowed anymore in section names in swanctl.conf and strongswan.conf.
    This mainly affects the configuration of file loggers. If the path for such a log file
    contains dots it now has to be configured in the new path setting within the arbitrarily
    renamed subsection in the filelog section.
  * Sections in swanctl.conf and strongswan.conf may now reference other sections. All settings
    and subsections from such a section are inherited. This allows to simplify configs as
    redundant information has only to be specified once and may then be included in other
    sections (see strongswan.conf for an example).
  * The originally selected IKE config (based on the IPs and IKE version) can now change
    if no matching algorithm proposal is found. This way the order of the configs doesn't
    matter that much anymore and it's easily possible to specify separate configs for
    clients that require weaker algorithms (instead of having to also add them in other
    configs that might be selected).
  * Support for Postquantum Preshared Keys for IKEv2 (draft-ietf-ipsecme-qr-ikev2) has been added.
    For an example refer to the swanctl/rw-cert-ppk scenario (or with EAP, or PSK authentication).
  * The new botan plugin is a wrapper around the Botan C++ crypto library.
    It requires a fairly recent build from Botan's master branch (or the upcoming 2.8.0 release).
    Thanks to René Korthaus and his team from Rohde &amp; Schwarz Cybersecurity for the initial
    patch and to Jack Lloyd for quickly adding missing functions to Botan's FFI (C89) interface.
  * Implementation of RFC 8412 "Software Inventory Message and Attributes (SWIMA) for PA-TNC".
  * SWIMA subscription option sets CLOSE_WRITE trigger on apt history.log file resulting in
    a ClientRetry PB-TNC batch to initialize a new measurement cycle. The new imv/imc-swima
    plugins replace the previous imv/imc-swid plugins, which were removed.
  * Added support for fuzzing the PA-TNC (RFC 5792) and PB-TNC (RFC 5793) NEA protocols
    on Google's OSS-Fuzz infrastructure.
  * Support for version 2 of Intel's TPM2-TSS TGC Software Stack. The presence of the
    in-kernel /dev/tpmrm0 resource manager is automatically detected.
  * The pki tool accepts a xmppAddr otherName as a subjectAlternativeName using the
    syntax --san xmppaddr:&lt;jid&gt;.
  * swanctl.conf supports the configuration of marks the in- and/or outbound SA should apply
    to packets after processing on Linux. Configuring such a mark for outbound SAs requires
    at least a 4.14 kernel. The ability to set a mask and configuring a mark/mask for
    inbound SAs will be added with the upcoming 4.19 kernel.
  * New options in swanctl.conf allow configuring how/whether DF, ECN and DS fields in the
    IP headers are copied during IPsec processing. Controlling this is currently only possible
    on Linux.
  * The handling of sequence numbers in IKEv1 DPDs has been improved (#2714).
  * To avoid conflicts, the dhcp plugin now only uses the DHCP server port if explicitly
    configured.
  - Version 5.6.3
  ===============
  * Fixed a DoS vulnerability in the IKEv2 key derivation if the openssl plugin is used in FIPS
    mode and HMAC-MD5 is negotiated as PRF.
    This vulnerability has been registered as CVE-2018-10811.
  * Fixed a vulnerability in the stroke plugin, which did not check the received length before
    reading a message from the socket. Unless a group is configured, root privileges are
    required to access that socket, so in the default configuration this shouldn't be an issue.
    This vulnerability has been registered as CVE-2018-5388.
  * CRLs that are not yet valid are now ignored to avoid problems in scenarios where expired
    certificates are removed from new CRLs and the clock on the host doing the revocation
    check is trailing behind that of the host issuing CRLs. Not doing this could result in
    accepting a revoked and expired certificate, if it's still valid according to the
    trailing clock but not contained anymore in not yet valid CRLs.
  * The issuer of fetched CRLs is now compared to the issuer of the checked certificate (#2608).
  * CRL validation results other than revocation (e.g. a skipped check because the CRL couldn't
    be fetched) are now stored also for intermediate CA certificates and not only for end-entity
    certificates, so a strict CRL policy can be enforced in such cases.
  * In compliance with RFC 4945, section 5.1.3.2, certificates used for IKE must now either
    not contain a keyUsage extension (like the ones generated by pki), or have at least one of the
    digitalSignature or nonRepudiation bits set.
  * New options for vici/swanctl allow forcing the local termination of an IKE_SA. This might be
    useful in situations where it's known the other end is not reachable anymore, or that it
    already removed the IKE_SA, so retransmitting a DELETE and waiting for a response would
    be pointless.
  * Waiting only a certain amount of time for a response (i.e. shorter than all retransmits
    would be) before destroying the IKE_SA is also possible by additionally specifying a
    timeout in the forced termination request.
  * When removing routes, the kernel-netlink plugin now checks if it tracks other routes for
    the same destination and replaces the installed route instead of just removing it. Same
    during installation, where existing routes previously weren't replaced. This should allow
    using traps with virtual IPs on Linux (#2162).
  * The dhcp plugin now only sends the client identifier DHCP option if the identity_lease
    setting is enabled (7b660944b6). It can also send identities of up to 255 bytes length,
    instead of the previous 64 bytes (30e886fe3b, 0e5b94d038). If a server address is
    configured, DHCP requests are now sent from port 67 instead of 68 to avoid ICMP port
    unreachables (becf027cd9).
  * The handling of faulty INVALID_KE_PAYLOAD notifies (e.g. one containing a DH group
    that wasn't proposed) during CREATE_CHILD_SA exchanges has been improved (#2536).
  * Roam events are now completely ignored for IKEv1 SAs (there is no MOBIKE to handle such
    changes properly).
  * ChaCha20/Poly1305 is now correctly proposed without key length (#2614). For compatibility with
    older releases the chacha20poly1305compat keyword may be included in proposals to also propose
    the algorithm with a key length (c58434aeff).
  * Configuration of hardware offload of IPsec SAs is now more flexible and allows a new
    setting (auto), which automatically uses it if the kernel and device both support it. If hw
    offload is set to yes and offloading is not supported, the CHILD_SA installation now fails.
  * The kernel-pfkey plugin optionally installs routes via internal interface (one with an IP
    in the local traffic selector). On FreeBSD, enabling this selects the correct source IP
    when sending packets from the gateway itself (e811659323).
  * SHA-2 based PRFs are supported in PKCS#8 files as generated by OpenSSL 1.1 (#2574).
  * The pki --verify tool may load CA certificates and CRLs from directories.
  * The IKE daemon now also switches to port 4500 if the remote port is not 500 (e.g. because the
    remote maps the response to a different port, as might happen on Azure), as long as the local
    port is 500 (85bfab621d).
  * Fixed an issue with DNS servers passed to NetworkManager in charon-nm (ee8c25516a).
  * Logged traffic selectors now always contain the protocol if either protocol or port are set
    (a36d8097ed).
  * Only the inbound SA/policy will be updated as reaction to IP address changes for rekeyed
    CHILD_SAs that are kept around.
  * The parser for strongswan.conf/swanctl.conf now accepts = characters in values without
    having to put the value in quotes (e.g. for Base64 encoded shared secrets).
    Notes for developers:
  * trap_manager_t: Trap policies are now unistalled by peer/child name and not the reqid.
  * No reqid is returned anymore when installing trap policies.
  * child_sa_t: A new state (CHILD_DELETED) is used for CHILD_SAs that have been deleted but
    not yet destroyed (after a rekeying CHILD_SAs are kept around for a while to process
    delayed packets).
    This way child_updown events are not triggered anymore for such SAs when an IKE_SA that
    has such CHILD_SAs assigned is deleted.
  - Version 5.6.2
  ===============
  * Fixed a DoS vulnerability in the parser for PKCS#1 RSASSA-PSS signatures that was caused
    by insufficient input validation. One of the configurable parameters in algorithm identifier
    structures for RSASSA-PSS signatures is the mask generation function (MGF). Only MGF1 is
    currently specified for this purpose. However, this in turn takes itself a parameter that
    specifies the underlying hash function. strongSwan's parser did not correctly handle the
    case of this parameter being absent, causing an undefined data read.
    This vulnerability has been registered as CVE-2018-6459.
  * When rekeying IKEv2 IKE_SAs the previously negotiated DH group will be reused, instead of
    using the first configured group, which avoids an additional exchange if the peer previously
    selected a different DH group via INVALID_KE_PAYLOAD notify. The same is also done when
    rekeying CHILD_SAs except for the first rekeying of the CHILD_SA that was created with the
    IKE_SA, where no DH group was negotiated yet.
    Also, the selected DH group is moved to the front in all sent proposals that contain it
    and all proposals that don't are moved to the back in order to convey the preference for
    this group to the peer.
  * Handling of MOBIKE task queuing has been improved. In particular, the response to an
    address update (with NAT-D payloads) is not ignored anymore if only an address list update
    or DPD is queued as that could prevent updating the UDP encapsulation in the kernel.
  * On Linux, roam events may optionally be triggered by changes to the routing rules, which
    can be useful if routing rules (instead of e.g. route metrics) are used to switch from one
    to another interface (i.e. from one to another routing table). Since routing rules are
    currently not evaluated when doing route lookups this is only useful if the kernel-based
    route lookup is used (4664992f7d).
  * The fallback drop policies installed to avoid traffic leaks when replacing addresses in
    installed policies are now replaced by temporary drop policies, which also prevent
    acquires because we currently delete and reinstall IPsec SAs to update their addresses
    (35ef1b032d).
  * Access X.509 certificates held in non-volatile storage of a TPM 2.0 referenced via the
    NV index.
    Adding the --keyid parameter to pki --print allows to print private keys or certificates
    stored in a smartcard or a TPM 2.0.
  * Fixed proposal selection if a peer incorrectly sends DH groups in the ESP proposal during
    IKE_AUTH and also if a DH group is configured in the local ESP proposal and charon.prefer
    configured_proposals is disabled (d058fd3c32).
  * The lookup for PSK secrets for IKEv1 has been improved for certain scenarios (see #2497
    for details).
  * MSKs received via RADIUS are now padded to 64 bytes to avoid compatibility issues with
    EAP-MSCHAPv2 and PRFs that have a block size &lt; 64 bytes (e.g. AES-XCBC-PRF-128, see
    73cbce6013).
  * The tpm_extendpcr command line tool extends a digest into a TPM PCR.
  * Ported the NetworkManager backend from the deprecated libnm-glib to libnm.
  * The save-keys debugging/development plugin saves IKE and/or ESP keys to files compatible
    with Wireshark.
  - Version 5.6.1
  ===============
  * Several algorithms were removed from the default ESP/AH and IKE proposals in compliance with
    RFC 8221 and RFC 8247, respectively. Removed from the default ESP/AH proposal were the
    3DES and Blowfish encryption algorithms and the HMAC-MD5 integrity algorithm. From the IKE
    default proposal the HMAC-MD5 integrity algorithm and the MODP-1024 Diffie-Hellman group
    were removed (the latter is significant for Windows clients in their default configuration).
    These algorithms may still be used in custom proposals.
  * Support for RSASSA-PSS signatures has been added. For compatibility with previous
    releases they are currently not used automatically, by default, to change that charon.rsa_pss
    may be enabled. To explicitly use or require such signatures during IKEv2 signature
    authentication (RFC 7427) ike:rsa/pss... authentication constraints may be used for specific
    connections (regardless of whether the strongswan.conf option above is enabled). Only the
    hash algorithm can be specified in such constraints, the MGF1 will be based on that hash
    and the salt length will equal the hash length (when verifying the salt length is not
    enforced).
    To enforce such signatures during PKI verification use rsa/pss... authentication constraints.
  * All pki commands that create certificates/CRLs can be made to sign with RSASSA-PSS instead
    of the classing PKCS#1 scheme with the --rsa-padding pss option. As with signatures during
    authentication, only the hash algorithm is configurable (via --digest option), the MGF1 will
    be based on that and the salt length will equal the hash length.
  * These signatures are supported by all RSA backends except pkcs11 (i.e. gmp, gcrypt, openssl).
    The gmp plugin requires the mgf1 plugin.
    Note that RSASSA-PSS algorithm identifiers and parameters in keys (public keys in
    certificates or private keys in PKCS#8 files) are currently not used as constraints.
  * The sec-updater tool checks for security updates in dpkg-based repositories
    (e.g. Debian/Ubuntu) and sets the security flags in the IMV policy database accordingly.
    Additionally for each new package version a SWID tag for the given OS and HW architecture
    is created and stored in the database.
  * Using the sec-updater.sh script template the lookup can be automated (e.g. via an hourly
    cron job).
  * When restarting an IKEv2 negotiation after receiving an INVALID_KE_PAYLOAD notify (or due
    to other reasons like too many retransmits) a new initiator SPI is allocated. This
    prevents issues caused by retransmits for IKE_SA_INIT messages.
  * Because the initiator SPI was previously reused when restarting the connection delayed
    responses for previous connection attempts were processed and might have caused fatal
    errors due to a failed DH negotiation or because of the internal retry counter in the
    ike-init task. For instance, if we proposed a DH group the responder rejected we
    might have later received delayed responses that either contained INVALID_KE_PAYLOAD
    notifies with the DH group we already switched to, or, if we retransmitted an
    IKE_SA_INIT with the requested group but then had to restart again, a KE payload with
    a group different from the one we proposed.
  * The introduction of file versions in the IMV database scheme broke file reference hash
    measurements. This has been fixed by creating generic product versions having an empty
    package name.
  * A new timeout option for the systime-fix plugin stops periodic system time checks after
    a while and enforces a certificate verification, closing or reauthenticating all SAs
    with invalid certificates.
  * The IKE event counters, previously only available via ipsec listcounters command, may
    now also be queried and reset via vici and the new swanctl --counters command. They
    are collected and provided by the optional counters plugin (enabled by default for
    backwards compatibility if the stroke plugin is built).
  * Class attributes received in RADIUS Access-Accept messages may optionally be added to
    RADIUS accounting messages (655924074b).
  * Basic support for systemd sockets has been added, which may be used for privilege separation
    (59db98fb94).
  * Inbound marks may optionally be installed in the SA again (was removed with 5.5.2) by
    enabling the mark_in_sa option in swanctl.conf.
  * The timeout of leases in pools configured via pool utility may be configured in other
    units than hours.
    INITIAL_CONTACT notifies are now only omitted if never is configured as uniqueness policy.
  * Outbound FWD policies for shunts are not installed anymore, by default (as is the case
    for other policies since 5.5.1).
  * Don't consider a DH group mismatch during CHILD_SA rekeying as failure as responder
    (e7276f78aa).
  * Handling of fragmented IPv4 and IPv6 packets in libipsec has been improved (e138003de9).
  * Trigger expire events for the correct IPsec SA in libipsec (6e861947a0).
  * A crash in CRL verification via openssl plugin using OpenSSL 1.1 has been fixed (78acaba6a1).
  * No hard-coded default proposals are passed from starter to the stroke plugin anymore (the
    IKE proposal used curve25519 since 5.5.2, which is an optional plugin).
  * A workaround for an issue with virtual IPs on macOS 10.13 (High Sierra) has been added
    (039b85dd43).
  * Handling of IKE_SA rekey collisions in charon-tkm has been fixed.
  * Instead of failing or just silently doing nothing unit tests may now warn about certain
    conditions (e.g. if a test was not executed due to external dependencies).</changelog>
  <changelog author="mmnelemane@suse.com" date="1585224000">- Fix for to resolve multiple definition of swanctl_dir (bsc #1164493)
  [+ 0006-Resolve-multiple-definition-of-swanctl_dir.patch]</changelog>
  <changelog author="mbuil@suse.com" date="1610712000">- Fix typo in README (bsc #1167880)
  [+ 0007-Fix-typo-in-README.patch ]</changelog>
  <changelog author="mbuil@suse.com" date="1611576000">- Fix FIPS bug (bsc #1180801)
  [+ 0008-gcrypt-Use-a-dummy-buffer-to-initialize-static-alloc.patch ]</changelog>
  <changelog author="mbuil@suse.com" date="1617019200">- Keep using ipsec as the main binary. Therefore, make strongswan.service point to it instead of swanctl</changelog>
  <changelog author="mbuil@suse.com" date="1617019201">- Information added in README about the rcstrongswan-starter</changelog>
  <changelog author="mbuil@suse.com" date="1617624000">- Add config to run ipsec on namespaces (bsc #1183670)</changelog>
  <changelog author="mt@suse.com" date="1619006400">- Add support for AES CCM aead algorithms to openssl plugin (cc/fips,bsc#1185363)
  [+ 0009-strongswan-openssl-aead-add-ccm-support.patch]</changelog>
  <changelog author="mt@suse.com" date="1620388800">- Replace AEAD AES CCM patch with upstream variant (cc/fips,bsc#1185363)
  [* 0009-strongswan-openssl-aead-add-ccm-support.patch]</changelog>
  <changelog author="hare@suse.de" date="1627646400">- Add auth_els plugin to support Marvell FC-SP encryption (jsc#SLE-20151)
  [* strongswan-marvell-auth-els.patch]</changelog>
  <changelog author="abergmann@suse.com" date="1634040000">- Fix integer overflow in gmp plugin (bsc#1191367, CVE-2021-41990)
  [* strongswan-5.6.1-5.9.3_gmp-rsa-ssa-salt-len.patch]
- Fix integer overflow when replacing certificates in cache (bsc#1191435, CVE-2021-41991)
  [* strongswan-4.4.1-5.9.3_cert-cache-random.patch]</changelog>
  <changelog author="meissner@suse.com" date="1643025600">- strongswan-5.5.0-5.9.4_eap_success-CVE-2021-45079.patch:
  Fixed authentication bypass in EAP authentication (CVE-2021-45079
  bsc#1194471)</changelog>
</package>
<package pkgid="9919bf44011bcf5ce64ba2ad7031008a25c39b7ad335eb9c9d459a49c7ce0ebb" name="strongswan-sqlite" arch="aarch64">
  <version epoch="0" ver="5.8.2" rel="11.24.1"/>
  <changelog author="ndas@suse.de" date="1501502400">- Updated to strongSwan 5.3.5(bsc#1050691) providing the following changes:
  * Fixed a DoS vulnerability in the gmp plugin that was caused by insufficient input
    validation when verifying RSA signatures. More specifically, mpz_powm_sec() has two
    requirements regarding the passed exponent and modulus that the plugin did not
    enforce, if these are not met the calculation will result in a floating point exception
    that crashes the whole process.
    This vulnerability has been registered as CVE-2017-9022.
    Please refer to our blog for details.
  * Fixed a DoS vulnerability in the x509 plugin that was caused because the ASN.1 parser
    didn't handle ASN.1 CHOICE types properly, which could result in an infinite loop when
    parsing X.509 extensions that use such types.
    This vulnerability has been registered as CVE-2017-9023.
    Please refer to our blog for details.
  * The behavior during IKEv2 CHILD_SA rekeying has been changed in order to avoid
    traffic loss. When responding to a CREATE_CHILD_SA request to rekey a CHILD_SA
    the responder already has everything available to install and use the new CHILD_SA.
    However, this could lead to lost traffic as the initiator won't be able to process
    inbound packets until it processed the CREATE_CHILD_SA response and updated the
    inbound SA. To avoid this the responder now only installs the new inbound SA and
    delays installing the outbound SA until it receives the DELETE for the replaced CHILD_SA.
  * The messages transporting these DELETEs could reach the peer before packets sent
    with the deleted outbound SAs reach it. To reduce the chance of traffic loss due
    to this the inbound SA of the replaced CHILD_SA is not removed for a configurable
    amount of seconds (charon.delete_rekeyed_delay) after the DELETE has been processed.
  * The code base has been ported to Apple's ARM64 iOS platform, which required several
    changes regarding the use of variadic functions. This was necessary because the calling
    conventions for variadic and regular functions are different there.
    This means that assigning a non-variadic function to a variadic function pointer, as we
    did with our enumerator_t::enumerate() implementations and several callbacks, will
    result in crashes as the called function accesses the arguments differently than the
    caller provided them. To avoid this issue the enumerator_t interface has been changed
    and the signature of the callback functions for enumerator_create_filter() and two
    methods on linked_list_t have been changed. Refer to the developer notes below
    for details.
  * Adds support for fuzzing the certificate parser provided by the default plugins
    (x509, pem, gmp etc.) on Google's OSS-Fuzz infrastructure (or generally with
    libFuzzer). Several issues found while fuzzing these plugins were fixed.
  * Two new options have been added to charon's retransmission settings:
    retransmit_limit and retransmit_jitter. The former adds an upper limit to the
    calculated retransmission timeout, the latter randomly reduces it.
    Refer to Retransmission for details.
  * A bug in swanctl's --load-creds command was fixed that caused unencrypted
    private keys to get unloaded if the command was called multiple times.
    The load-key VICI command now returns the key ID of the loaded key on success.
  * The credential manager now enumerates local credential sets before global ones.
    This means certificates supplied by the peer will now be preferred over certificates
    with the same identity that may be locally stored (e.g. in the certificate cache).
  * Adds support for hardware offload of IPsec SAs as introduced by Linux 4.11 for
    specific hardware that supports this.
  * The pki tool loads the curve25519 plugin by default.
    [- 0006-Make-sure-the-modulus-is-odd-and-the-exponent-not-zero.patch,
  - 0007-asn1-parser-Fix-CHOICE-parsing.patch]
- libhydra is removed as all kernel plugins moved to libcharon</changelog>
  <changelog author="ndas@suse.de" date="1504612800">- fix "uintptr_t? undeclared" compilation error.
  [+0006-fix-compilation-error-by-adding-stdint.h.patch]</changelog>
  <changelog author="ndas@suse.de" date="1504612801">- Updated to strongSwan 5.6.0 providing the following changes:
  * Fixed a DoS vulnerability in the gmp plugin that was caused by insufficient input validation
    when verifying RSA signatures, which requires decryption with the operation m^e mod n,
    where m is the signature, and e and n are the exponent and modulus of the public key.
    The value m is an integer between 0 and n-1, however, the gmp plugin did not verify this.
    So if m equals n the calculation results in 0, in which case mpz_export() returns NULL.
    This result wasn't handled properly causing a null-pointer dereference.
    This vulnerability has been registered as CVE-2017-11185. (bsc#1051222)
  * New SWIMA IMC/IMV pair implements the draft-ietf-sacm-nea-swima-patnc Internet
    Draft and has been demonstrated at the IETF 99 Prague Hackathon.
  * The IMV database template has been adapted to achieve full compliance with the
    ISO 19770-2:2015 SWID tag standard.
  * The pt-tls-client can attach and use TPM 2.0 protected private keys via the --keyid parameter.
  * By default the /etc/swanctl/conf.d directory is created and *.conf files in it are included in the default
    swanctl.conf file.
  * The curl plugin now follows HTTP redirects (configurable via strongswan.conf).
  * The CHILD_SA rekeying was fixed in charon-tkm and the behavior is refined a bit more since 5.5.3
  * libtpmtss supports Intel's TSS2 Architecture Broker and Resource Manager interface (tcti-tabrmd).
  * more on https://wiki.strongswan.org/versions/66</changelog>
  <changelog author="mmnelemane@suse.com" date="1521028800">- Removed unused requires and macro calls(bsc#1083261)</changelog>
  <changelog author="mmnelemane@suse.com" date="1573646400">- Added patch to fix vulnerability: CVE-2018-16151,CVE-2018-16152 (bsc#1107874)
  - Insufficient input validation in gmp plugin
  [+ 0007-strongswan-5.3.1-5.6.0_gmp-pkcs1-verify.patch]</changelog>
  <changelog author="mmnelemane@suse.com" date="1573646401">- Added patch to fix vulnerability: CVE-2018-5388 (bsc#1094462)
  - Buffer Underflow in stroke_socket.c
  [+ 0008-strongswan-5.1.2-5.6.2_stroke_msg_len.patch]</changelog>
  <changelog author="mmnelemane@suse.com" date="1573646402">- Added patch to fix vulnerability: CVE-2018-10811 (bsc#1093536)
  - denial-of-service vulnerability
  [+ 0009-strongswan-5.5.0-5.6.2_skeyseed_init.patch]</changelog>
  <changelog author="mmnelemane@suse.com" date="1573732800">- Added patch to fix vulnerability: CVE-2018-17540 (bsc#1109845)
  [+ 0010-strongswan-4.4.0-5.7.0_gmp-pkcs1-overflow.patch]</changelog>
  <changelog author="mmnelemane@suse.com" date="1580212800">- Updated to version 5.8.2 (jsc#SLE-11370)
  - Dropped following patches due to irrelevance in the updated version:
    [- strongswan_modprobe_syslog.patch ]
    [- strongswan_fipsfilter.patch ]
    [- 0006-fix-compilation-error-by-adding-stdint.h.patch ]
    [- 0007-strongswan-5.3.1-5.6.0_gmp-pkcs1-verify.patch ]
    [- 0008-strongswan-5.1.2-5.6.2_stroke_msg_len.patch ]
    [- 0009-strongswan-5.5.0-5.6.2_skeyseed_init.patch ]
    [- 0010-strongswan-4.4.0-5.7.0_gmp-pkcs1-overflow.patch ]
  - Version 5.8.2
  ===============
  * Identity-based CA constraints, which enforce that the certificate chain of the remote
    peer contains a CA certificate with a specific identity, are supported via
    vici/swanctl.conf. This is similar to the existing CA constraints but doesn't require
    that the CA certificate is locally installed, for instance, intermediate CA certificates
    received from the peers. Wildcard identity matching (e.g. ..., OU=Research, CN=*) could
    also be used for the latter but requires trust in the intermediate CAs to only issue
    certificates with legitimate subject DNs (e.g. the "Sales" CA must not issue certificates
    with OU=Research). With the new constraint that's not necessary as long as a path length
    basic constraint (--pathlen for pki --issue) prevents intermediate CAs from issuing further
    intermediate CAs.
  * Intermediate CA certificates may now be sent in hash-and-URL encoding by configuring a
    base URL for the parent CA (#3234, swanctl/rw-hash-and-url-multi-level).
  * Implemented NIST SP-800-90A Deterministic Random Bit Generator (DRBG) based on AES-CTR
    and SHA2-HMAC modes. Currently used by the gmp and ntru plugins.
  * Random nonces sent in an OCSP requests are now expected in the corresponding OCSP responses.
  * The kernel-netlink plugin now ignores deprecated IPv6 addresses for MOBIKE. Whether temporary
    or permanent IPv6 addresses are included now depends on the charon.prefer_temporary_addrs
    setting (#3192).
  * Extended Sequence Numbers (ESN) are configured via PF_KEY if supported by the kernel.
  * The PF_KEY socket's receive buffer in the kernel-pfkey plugin is now cleared before sending
    requests, as many of the messages sent by the kernel are sent as broadcasts to all PF_KEY
    sockets. This is an issue if an external tool is used to manage SAs/policies unrelated to
    IPsec (#3225).
  * The vici plugin now uses unique section names for CHILD_SAs in child-updown events (7c74ce9190).
  * For individually deleted CHILD_SAs (in particular for IKEv1) the vici child-updown event
    now includes more information about the CHILD_SAs such as traffic statistics (#3198).
  * Custom loggers are correctly re-registered if log levels are changed via stroke loglevel (#3182).
  * Avoid lockups during startup on low entropy systems when using OpenSSL 1.1.1 (095a2c2eac).
  * Instead of failing later when setting a key, creating HMACs via openssl plugin now fails
    instantly if the underlying hash algorithm isn't supported (e.g. MD5 in FIPS-mode) so fallbacks
    to other plugins work properly (#3284).
  * Exponents of RSA keys read from TPM 2.0 via SAPI are correctly converted (8ee1242f1438).
  * Routing table IDs &gt; 255 are supported for custom routes on Linux.
  * To avoid races, the check for hardware offloading support in the kernel-netlink plugin is
    performed during initialization of the plugin (a605452c03).
  * The D-Bus config file for charon-nm is now installed in $(datadir)/dbus-1/system.d instead of
    $(sysconfdir)/dbus-1/system.d, which is intended for sysadmin overrides.
    INVALID_MAJOR_VERSION notifies are now correctly sent in messages of the same exchange type
    and with the same message ID as the request.
  * IKEv2 SAs are now immediately destroyed when sending or receiving INVALID_SYNTAX notifies
    in authenticated messages.
  * For developers working from the repository the configure script now aborts if GNU gperf is
    not found.
  - Version 5.8.1
  ===============
  * RDNs in DNs of X.509 certificates can now optionally be matched less strict. The global
    strongswan.conf option charon.rdn_matching takes two alternative values that cause the
    matching algorithm to either ignore the order of matched RDNs (reordered) or additionally
    (relaxed) accept DNs that contain more RDNs than configured (unmatched RDNs are treated
    like wildcard matches).
  * The updown plugin now passes the same interface to the script that is also used for the
    automatically installed routes, that is, the interface over which the peer is reached
    instead of the interface on which the local address is found (#3095).
  * TPM 2.0 contexts are now protected by a mutex to prevent issues if multiple IKE_SAs use
    the same private key concurrently (4b25885025).
  * Do a rekey check after the third QM message was received (#3060).
  * If available, explicit_bzero() is now used as memwipe() instead of our own implementation.
  * An .editorconfig file has been added, mainly so Github shows files with proper indentation
    (68346b6962).
  * The internal certificate of the load-tester plugin has been modified so it can again be
    used as end-entity cert with 5.6.3 and later (#3139).
  * The maximum data length of received COOKIE notifies (64 bytes) is now enforced (#3160).
  - Version 5.8.0
  ===============
  * The systemd service units have been renamed. The modern unit, which was called
    strongswan-swanctl, is now called strongswan (the previous name is configured as alias in
    the unit, for which a symlink is created when the unit is enabled). The legacy unit is now
    called strongswan-starter.
  * Support for XFRM interfaces (available since Linux 4.19) has been added, which are intended
    to replace VTI devices (they are similar but offer several advantages, for instance, they
    are not bound to an address or address family).
  * IPsec SAs and policies are associated with such interfaces via interface IDs that can be
    configured in swanctl.conf (dynamic IDs may optionally be allocated for each SA and even
    direction). It's possible to use separate interfaces for in- and outbound traffic (or
    only use an interface in one direction and regular policies in the other).
  * Interfaces may be created dynamically via updown/vici scripts, or statically before or after
    establishing the SAs. Routes must be added manually as needed (the daemon will not install
    any routes for outbound policies with an interface ID).
  * When moving XFRM interfaces to other network namespaces they retain access to the SAs and
    policies installed in the original namespace, which allows providing IPsec tunnels for
    processes in other network namespaces without giving them access to the IPsec keys or
    IKE credentials.
    More information can be found on the page about route-based VPNs.
  * Initiation of childless IKE_SAs is supported (RFC 6023). If enabled and supported by the
    responder, no CHILD_SA is established during IKE_AUTH. Instead, all CHILD_SAs are created
    with CREATE_CHILD_SA exchanges. This allows using a separate DH exchange even for the
    first CHILD_SA, which is otherwise created during IKE_AUTH with keys derived from the
    IKE_SA's key material.
  * The swanctl --initiate command may be used to initiate only the IKE_SA via --ike
    option if --child is omitted and the peer supports this extension.
  * The NetworkManager backend and plugin support IPv6.
  * The new wolfssl plugin is a wrapper around the wolfSSL crypto library. Thanks to Sean
    Parkinson of wolfSSL Inc. for the initial patch.
  * IKE SPIs may optionally be labeled via the charon.spi_mask|label options in
    strongswan.conf. This feature was extracted from charon-tkm, however, now applies the
    mask/label in network order.
  * The openssl plugin supports ChaCha20-Poly1305 when built with OpenSSL 1.1.0.
  * The PB-TNC finite state machine according to section 3.2 of RFC 5793 was not correctly
    implemented when sending either a CRETRY or SRETRY batch. These batches can only be sent
    in the "Decided" state and a CRETRY batch can immediately carry all messages usually
    transported by a CDATA batch. It is currently not possible to send a SRETRY batch since
    full-duplex mode for PT-TLS transport is not supported.
  * Instead of marking IPv6 virtual IPs as deprecated, the kernel-netlink plugin now uses
    address labels to avoid that such addresses are used for non-VPN traffic (00a953d090).
  * The agent plugin now creates sockets to the ssh/gpg-agent dynamically and does not keep
    them open, which otherwise might prevent the agent from getting terminated.
  * To avoid broadcast loops the forecast plugin now only reinjects packets that are marked
    or received from the configured interface.
  * UTF-8 encoded passwords are supported via EAP-MSCHAPv2, which internally uses an UTF-16LE
    encoding to calculate the NT hash (#3014).
  * Properly delete temporary drop policies (used when updating IP addresses of SAs) if manual
    priorities are used, which was broken since 5.6.2 (8e31d65730).
  * Avoid overwriting start_action when parsing the inactivity timeout in the vici plugin (#2954).
  * Fixed the automatic termination of reloaded vici connections with start_action=start,
    which was broken since 5.6.3 (71b22c250f).
  * The lookup for shared secrets for IKEv1 SAs via sql plugin should now work better
    (6ec9f68f32).
  * Fixed a race condition in the trap manager between installation and removal of a policy
    (69cbe2ca3f).
  * Compilation of the kernel-netlink plugin has been fixed on old kernels (&lt; 2.6.39), which
    was caused by the HW offload changes (c7f579fa17).
  * The IPsec stack detection and module loading in starter has been removed (it wasn't
    enforced anyway and loading modules doesn't seem necessary, also KLIPS hasn't been
    supported for a long time and PF_KEY will eventually be removed from the Linux kernel,
    ba817d2917).
  * Several IKEv2 protocol details are now handled more strictly: Unrequested virtual IPs are
    ignored, CFG_REPLY payloads are ignored if no CFG_REQUEST payloads were sent, a USE
    TRANSPORT_MODE notify received from the responder is checked against the local configuration.
  * The keys and certificates used by the scenarios in the testing environment are now generated
    dynamically. Running the testing/scripts/build-certs script after creating the base and root
    images uses the pki utility installed in the latter to create the keys and certificates for
    all the CAs and in some cases for individual scenarios. These credentials are stored in the
    source tree, not the image, so this has to be called only once even if the images are later
    rebuilt. The script automatically (re-)rebuilds the guest images as that generates fresh
    CRLs and signs the DNS zones. The only keys/certificates currently not generated are the
    very large ones used by the ikev2/rw-eap-tls-fragments scenario.
  - Version 5.7.2
  ===============
  * For RSA with PSS padding, the TPM 2.0 specification mandates the maximum salt length
    (as defined by the length of the key and hash). However, if the TPM is FIPS-168-4 compliant,
    the salt length equals the hash length. This is assumed for FIPS-140-2 compliant TPMs, but
    if that's not the case, it might be necessary to manually enable charon.plugins.tpm.fips_186_4
    if the TPM doesn't use the maximum salt length.
  * Directories for credentials loaded by swanctl are now accessed relative to the loaded
    swanctl.conf file, in particular, when loading it from a custom location via --file argument.
  * The base directory, which is used if no custom location for swanctl.conf is specified, is now
    also configurable at runtime via SWANCTL_DIR environment variable.
  * If RADIUS Accounting is enabled, the eap-radius plugin will add the session ID (Acct-Session-Id)
    to Access-Request messages, which e.g. simplifies associating database entries for IP leases and
    accounting with sessions (the session ID does not change when IKE_SAs are rekeyed, #2853).
  * All IP addresses assigned by a RADIUS server are included in Accounting-Stop messages even if
    the client did not claim them, allowing to release them early in case of connection errors (#2856).
  * Selectors installed on transport mode SAs by the kernel-netlink plugin are now updated if an
    IP address changes (e.g. via MOBIKE) and it was part of the selectors.
  * No deletes are sent anymore when a rekeyed CHILD_SA expires (#2815).
  * The bypass-lan plugin now tracks interfaces to handle subnets that move from one interface
    to another and properly update associated routes (#2820).
  * Only valid and expected inbound IKEv2 messages are used to update the timestamp of the
    last received message (previously, retransmits also triggered an update).
  * IKEv2 requests from responders are now ignored until the IKE_SA is fully established (e.g. if a
    DPD request from the peer arrives before the IKE_AUTH response does, 46bea1add9).
    Delayed IKE_SA_INIT responses with COOKIE notifies we already recevied are ignored, they caused
    another reset of the IKE_SA previously (#2837).
  * Active and queued Quick Mode tasks are now adopted if the peer reauthenticates an IKEv1 SA
    while creating lots of CHILD_SAs.
  * Newer versions of the FreeBSD kernel add an SADB_X_EXT_SA2 extension to SADB_ACQUIRE
    messages, which allows the kernel-pfkey plugin to determine the reqid of the policy even if it
    wasn't installed by the daemon previously (e.g. when using FreeBSD's if_ipsec(4) VTIs, which
    install policies themselves, 872b9b3e8d).
  * Added support for RSA signatures with SHA-256 and SHA-512 to the agent plugin. For older
    versions of ssh/gpg-agent that only support SHA-1, IKEv2 signature authentication has to be
    disabled via charon.signature_authentication.
  * The sshkey and agent plugins support Ed25519/Ed448 SSH keys and signatures.
  * The openssl plugin supports X25519/X448 Diffie-Hellman and Ed25519/Ed448 keys and
    signatures when built against OpenSSL 1.1.1.
  * Support for Ed25519, ChaCha20/Poly1305, SHA-3 and AES-CCM were added to the botan plugin.
  * The mysql plugin now properly handles database connections with transactions
    under heavy load (#2779).
  * IP addresses in ha pools are now distributed evenly among all segments (#2828).
  * Private key implementations may optionally provide a list of supported signature schemes,
    which, as described above, is used by the tpm plugin because for each key on a TPM 2.0 the
    hash algorithm and for RSA also the padding scheme is predefined.
  * The testing environment is now based on Debian 9 (stretch) by default. This required
    some changes, in particular, updating to FreeRADIUS 3.x (which forced us to abandon the
    TNC@FHH patches and scenarios, 2fbe44bef3) and removing FIPS-enabled versions of
    OpenSSL (the FIPS module only supports OpenSSL 1.0.2).
  * Most test scenarios were migrated to swanctl.
  - Version 5.7.1
  ===============
  * Fixes a vulnerability in the gmp plugin triggered by crafted certificates with RSA keys with
    very small moduli. When verifying signatures with such keys, the code patched with the fix
    for CVE-2018-16151/2 caused an integer underflow and subsequent heap buffer overflow
    that results in a crash of the daemon.
  * The vulnerability has been registered as CVE-2018-17540.
  - Version 5.7.0
  ===============
  * Fixes a potential authorization bypass vulnerability in the gmp plugin that was caused by a
    too lenient verification of PKCS#1 v1.5 signatures. Several flaws could be exploited by a
    Bleichenbacher-style attack to forge signatures for low-exponent keys (i.e. with e=3).
  * CVE-2018-16151 has been assigned to the problem of accepting random bytes after the OID
    of the hash function in such signatures, and CVE-2018-16152 has been assigned to the issue
    of not verifying that the parameters in the ASN.1 algorithmIdentitifer structure is empty.
    Other flaws that don't lead to a vulnerability directly (e.g. not checking for at least
    8 bytes of padding) have no separate CVE assigned.
  * Dots are not allowed anymore in section names in swanctl.conf and strongswan.conf.
    This mainly affects the configuration of file loggers. If the path for such a log file
    contains dots it now has to be configured in the new path setting within the arbitrarily
    renamed subsection in the filelog section.
  * Sections in swanctl.conf and strongswan.conf may now reference other sections. All settings
    and subsections from such a section are inherited. This allows to simplify configs as
    redundant information has only to be specified once and may then be included in other
    sections (see strongswan.conf for an example).
  * The originally selected IKE config (based on the IPs and IKE version) can now change
    if no matching algorithm proposal is found. This way the order of the configs doesn't
    matter that much anymore and it's easily possible to specify separate configs for
    clients that require weaker algorithms (instead of having to also add them in other
    configs that might be selected).
  * Support for Postquantum Preshared Keys for IKEv2 (draft-ietf-ipsecme-qr-ikev2) has been added.
    For an example refer to the swanctl/rw-cert-ppk scenario (or with EAP, or PSK authentication).
  * The new botan plugin is a wrapper around the Botan C++ crypto library.
    It requires a fairly recent build from Botan's master branch (or the upcoming 2.8.0 release).
    Thanks to René Korthaus and his team from Rohde &amp; Schwarz Cybersecurity for the initial
    patch and to Jack Lloyd for quickly adding missing functions to Botan's FFI (C89) interface.
  * Implementation of RFC 8412 "Software Inventory Message and Attributes (SWIMA) for PA-TNC".
  * SWIMA subscription option sets CLOSE_WRITE trigger on apt history.log file resulting in
    a ClientRetry PB-TNC batch to initialize a new measurement cycle. The new imv/imc-swima
    plugins replace the previous imv/imc-swid plugins, which were removed.
  * Added support for fuzzing the PA-TNC (RFC 5792) and PB-TNC (RFC 5793) NEA protocols
    on Google's OSS-Fuzz infrastructure.
  * Support for version 2 of Intel's TPM2-TSS TGC Software Stack. The presence of the
    in-kernel /dev/tpmrm0 resource manager is automatically detected.
  * The pki tool accepts a xmppAddr otherName as a subjectAlternativeName using the
    syntax --san xmppaddr:&lt;jid&gt;.
  * swanctl.conf supports the configuration of marks the in- and/or outbound SA should apply
    to packets after processing on Linux. Configuring such a mark for outbound SAs requires
    at least a 4.14 kernel. The ability to set a mask and configuring a mark/mask for
    inbound SAs will be added with the upcoming 4.19 kernel.
  * New options in swanctl.conf allow configuring how/whether DF, ECN and DS fields in the
    IP headers are copied during IPsec processing. Controlling this is currently only possible
    on Linux.
  * The handling of sequence numbers in IKEv1 DPDs has been improved (#2714).
  * To avoid conflicts, the dhcp plugin now only uses the DHCP server port if explicitly
    configured.
  - Version 5.6.3
  ===============
  * Fixed a DoS vulnerability in the IKEv2 key derivation if the openssl plugin is used in FIPS
    mode and HMAC-MD5 is negotiated as PRF.
    This vulnerability has been registered as CVE-2018-10811.
  * Fixed a vulnerability in the stroke plugin, which did not check the received length before
    reading a message from the socket. Unless a group is configured, root privileges are
    required to access that socket, so in the default configuration this shouldn't be an issue.
    This vulnerability has been registered as CVE-2018-5388.
  * CRLs that are not yet valid are now ignored to avoid problems in scenarios where expired
    certificates are removed from new CRLs and the clock on the host doing the revocation
    check is trailing behind that of the host issuing CRLs. Not doing this could result in
    accepting a revoked and expired certificate, if it's still valid according to the
    trailing clock but not contained anymore in not yet valid CRLs.
  * The issuer of fetched CRLs is now compared to the issuer of the checked certificate (#2608).
  * CRL validation results other than revocation (e.g. a skipped check because the CRL couldn't
    be fetched) are now stored also for intermediate CA certificates and not only for end-entity
    certificates, so a strict CRL policy can be enforced in such cases.
  * In compliance with RFC 4945, section 5.1.3.2, certificates used for IKE must now either
    not contain a keyUsage extension (like the ones generated by pki), or have at least one of the
    digitalSignature or nonRepudiation bits set.
  * New options for vici/swanctl allow forcing the local termination of an IKE_SA. This might be
    useful in situations where it's known the other end is not reachable anymore, or that it
    already removed the IKE_SA, so retransmitting a DELETE and waiting for a response would
    be pointless.
  * Waiting only a certain amount of time for a response (i.e. shorter than all retransmits
    would be) before destroying the IKE_SA is also possible by additionally specifying a
    timeout in the forced termination request.
  * When removing routes, the kernel-netlink plugin now checks if it tracks other routes for
    the same destination and replaces the installed route instead of just removing it. Same
    during installation, where existing routes previously weren't replaced. This should allow
    using traps with virtual IPs on Linux (#2162).
  * The dhcp plugin now only sends the client identifier DHCP option if the identity_lease
    setting is enabled (7b660944b6). It can also send identities of up to 255 bytes length,
    instead of the previous 64 bytes (30e886fe3b, 0e5b94d038). If a server address is
    configured, DHCP requests are now sent from port 67 instead of 68 to avoid ICMP port
    unreachables (becf027cd9).
  * The handling of faulty INVALID_KE_PAYLOAD notifies (e.g. one containing a DH group
    that wasn't proposed) during CREATE_CHILD_SA exchanges has been improved (#2536).
  * Roam events are now completely ignored for IKEv1 SAs (there is no MOBIKE to handle such
    changes properly).
  * ChaCha20/Poly1305 is now correctly proposed without key length (#2614). For compatibility with
    older releases the chacha20poly1305compat keyword may be included in proposals to also propose
    the algorithm with a key length (c58434aeff).
  * Configuration of hardware offload of IPsec SAs is now more flexible and allows a new
    setting (auto), which automatically uses it if the kernel and device both support it. If hw
    offload is set to yes and offloading is not supported, the CHILD_SA installation now fails.
  * The kernel-pfkey plugin optionally installs routes via internal interface (one with an IP
    in the local traffic selector). On FreeBSD, enabling this selects the correct source IP
    when sending packets from the gateway itself (e811659323).
  * SHA-2 based PRFs are supported in PKCS#8 files as generated by OpenSSL 1.1 (#2574).
  * The pki --verify tool may load CA certificates and CRLs from directories.
  * The IKE daemon now also switches to port 4500 if the remote port is not 500 (e.g. because the
    remote maps the response to a different port, as might happen on Azure), as long as the local
    port is 500 (85bfab621d).
  * Fixed an issue with DNS servers passed to NetworkManager in charon-nm (ee8c25516a).
  * Logged traffic selectors now always contain the protocol if either protocol or port are set
    (a36d8097ed).
  * Only the inbound SA/policy will be updated as reaction to IP address changes for rekeyed
    CHILD_SAs that are kept around.
  * The parser for strongswan.conf/swanctl.conf now accepts = characters in values without
    having to put the value in quotes (e.g. for Base64 encoded shared secrets).
    Notes for developers:
  * trap_manager_t: Trap policies are now unistalled by peer/child name and not the reqid.
  * No reqid is returned anymore when installing trap policies.
  * child_sa_t: A new state (CHILD_DELETED) is used for CHILD_SAs that have been deleted but
    not yet destroyed (after a rekeying CHILD_SAs are kept around for a while to process
    delayed packets).
    This way child_updown events are not triggered anymore for such SAs when an IKE_SA that
    has such CHILD_SAs assigned is deleted.
  - Version 5.6.2
  ===============
  * Fixed a DoS vulnerability in the parser for PKCS#1 RSASSA-PSS signatures that was caused
    by insufficient input validation. One of the configurable parameters in algorithm identifier
    structures for RSASSA-PSS signatures is the mask generation function (MGF). Only MGF1 is
    currently specified for this purpose. However, this in turn takes itself a parameter that
    specifies the underlying hash function. strongSwan's parser did not correctly handle the
    case of this parameter being absent, causing an undefined data read.
    This vulnerability has been registered as CVE-2018-6459.
  * When rekeying IKEv2 IKE_SAs the previously negotiated DH group will be reused, instead of
    using the first configured group, which avoids an additional exchange if the peer previously
    selected a different DH group via INVALID_KE_PAYLOAD notify. The same is also done when
    rekeying CHILD_SAs except for the first rekeying of the CHILD_SA that was created with the
    IKE_SA, where no DH group was negotiated yet.
    Also, the selected DH group is moved to the front in all sent proposals that contain it
    and all proposals that don't are moved to the back in order to convey the preference for
    this group to the peer.
  * Handling of MOBIKE task queuing has been improved. In particular, the response to an
    address update (with NAT-D payloads) is not ignored anymore if only an address list update
    or DPD is queued as that could prevent updating the UDP encapsulation in the kernel.
  * On Linux, roam events may optionally be triggered by changes to the routing rules, which
    can be useful if routing rules (instead of e.g. route metrics) are used to switch from one
    to another interface (i.e. from one to another routing table). Since routing rules are
    currently not evaluated when doing route lookups this is only useful if the kernel-based
    route lookup is used (4664992f7d).
  * The fallback drop policies installed to avoid traffic leaks when replacing addresses in
    installed policies are now replaced by temporary drop policies, which also prevent
    acquires because we currently delete and reinstall IPsec SAs to update their addresses
    (35ef1b032d).
  * Access X.509 certificates held in non-volatile storage of a TPM 2.0 referenced via the
    NV index.
    Adding the --keyid parameter to pki --print allows to print private keys or certificates
    stored in a smartcard or a TPM 2.0.
  * Fixed proposal selection if a peer incorrectly sends DH groups in the ESP proposal during
    IKE_AUTH and also if a DH group is configured in the local ESP proposal and charon.prefer
    configured_proposals is disabled (d058fd3c32).
  * The lookup for PSK secrets for IKEv1 has been improved for certain scenarios (see #2497
    for details).
  * MSKs received via RADIUS are now padded to 64 bytes to avoid compatibility issues with
    EAP-MSCHAPv2 and PRFs that have a block size &lt; 64 bytes (e.g. AES-XCBC-PRF-128, see
    73cbce6013).
  * The tpm_extendpcr command line tool extends a digest into a TPM PCR.
  * Ported the NetworkManager backend from the deprecated libnm-glib to libnm.
  * The save-keys debugging/development plugin saves IKE and/or ESP keys to files compatible
    with Wireshark.
  - Version 5.6.1
  ===============
  * Several algorithms were removed from the default ESP/AH and IKE proposals in compliance with
    RFC 8221 and RFC 8247, respectively. Removed from the default ESP/AH proposal were the
    3DES and Blowfish encryption algorithms and the HMAC-MD5 integrity algorithm. From the IKE
    default proposal the HMAC-MD5 integrity algorithm and the MODP-1024 Diffie-Hellman group
    were removed (the latter is significant for Windows clients in their default configuration).
    These algorithms may still be used in custom proposals.
  * Support for RSASSA-PSS signatures has been added. For compatibility with previous
    releases they are currently not used automatically, by default, to change that charon.rsa_pss
    may be enabled. To explicitly use or require such signatures during IKEv2 signature
    authentication (RFC 7427) ike:rsa/pss... authentication constraints may be used for specific
    connections (regardless of whether the strongswan.conf option above is enabled). Only the
    hash algorithm can be specified in such constraints, the MGF1 will be based on that hash
    and the salt length will equal the hash length (when verifying the salt length is not
    enforced).
    To enforce such signatures during PKI verification use rsa/pss... authentication constraints.
  * All pki commands that create certificates/CRLs can be made to sign with RSASSA-PSS instead
    of the classing PKCS#1 scheme with the --rsa-padding pss option. As with signatures during
    authentication, only the hash algorithm is configurable (via --digest option), the MGF1 will
    be based on that and the salt length will equal the hash length.
  * These signatures are supported by all RSA backends except pkcs11 (i.e. gmp, gcrypt, openssl).
    The gmp plugin requires the mgf1 plugin.
    Note that RSASSA-PSS algorithm identifiers and parameters in keys (public keys in
    certificates or private keys in PKCS#8 files) are currently not used as constraints.
  * The sec-updater tool checks for security updates in dpkg-based repositories
    (e.g. Debian/Ubuntu) and sets the security flags in the IMV policy database accordingly.
    Additionally for each new package version a SWID tag for the given OS and HW architecture
    is created and stored in the database.
  * Using the sec-updater.sh script template the lookup can be automated (e.g. via an hourly
    cron job).
  * When restarting an IKEv2 negotiation after receiving an INVALID_KE_PAYLOAD notify (or due
    to other reasons like too many retransmits) a new initiator SPI is allocated. This
    prevents issues caused by retransmits for IKE_SA_INIT messages.
  * Because the initiator SPI was previously reused when restarting the connection delayed
    responses for previous connection attempts were processed and might have caused fatal
    errors due to a failed DH negotiation or because of the internal retry counter in the
    ike-init task. For instance, if we proposed a DH group the responder rejected we
    might have later received delayed responses that either contained INVALID_KE_PAYLOAD
    notifies with the DH group we already switched to, or, if we retransmitted an
    IKE_SA_INIT with the requested group but then had to restart again, a KE payload with
    a group different from the one we proposed.
  * The introduction of file versions in the IMV database scheme broke file reference hash
    measurements. This has been fixed by creating generic product versions having an empty
    package name.
  * A new timeout option for the systime-fix plugin stops periodic system time checks after
    a while and enforces a certificate verification, closing or reauthenticating all SAs
    with invalid certificates.
  * The IKE event counters, previously only available via ipsec listcounters command, may
    now also be queried and reset via vici and the new swanctl --counters command. They
    are collected and provided by the optional counters plugin (enabled by default for
    backwards compatibility if the stroke plugin is built).
  * Class attributes received in RADIUS Access-Accept messages may optionally be added to
    RADIUS accounting messages (655924074b).
  * Basic support for systemd sockets has been added, which may be used for privilege separation
    (59db98fb94).
  * Inbound marks may optionally be installed in the SA again (was removed with 5.5.2) by
    enabling the mark_in_sa option in swanctl.conf.
  * The timeout of leases in pools configured via pool utility may be configured in other
    units than hours.
    INITIAL_CONTACT notifies are now only omitted if never is configured as uniqueness policy.
  * Outbound FWD policies for shunts are not installed anymore, by default (as is the case
    for other policies since 5.5.1).
  * Don't consider a DH group mismatch during CHILD_SA rekeying as failure as responder
    (e7276f78aa).
  * Handling of fragmented IPv4 and IPv6 packets in libipsec has been improved (e138003de9).
  * Trigger expire events for the correct IPsec SA in libipsec (6e861947a0).
  * A crash in CRL verification via openssl plugin using OpenSSL 1.1 has been fixed (78acaba6a1).
  * No hard-coded default proposals are passed from starter to the stroke plugin anymore (the
    IKE proposal used curve25519 since 5.5.2, which is an optional plugin).
  * A workaround for an issue with virtual IPs on macOS 10.13 (High Sierra) has been added
    (039b85dd43).
  * Handling of IKE_SA rekey collisions in charon-tkm has been fixed.
  * Instead of failing or just silently doing nothing unit tests may now warn about certain
    conditions (e.g. if a test was not executed due to external dependencies).</changelog>
  <changelog author="mmnelemane@suse.com" date="1585224000">- Fix for to resolve multiple definition of swanctl_dir (bsc #1164493)
  [+ 0006-Resolve-multiple-definition-of-swanctl_dir.patch]</changelog>
  <changelog author="mbuil@suse.com" date="1610712000">- Fix typo in README (bsc #1167880)
  [+ 0007-Fix-typo-in-README.patch ]</changelog>
  <changelog author="mbuil@suse.com" date="1611576000">- Fix FIPS bug (bsc #1180801)
  [+ 0008-gcrypt-Use-a-dummy-buffer-to-initialize-static-alloc.patch ]</changelog>
  <changelog author="mbuil@suse.com" date="1617019200">- Keep using ipsec as the main binary. Therefore, make strongswan.service point to it instead of swanctl</changelog>
  <changelog author="mbuil@suse.com" date="1617019201">- Information added in README about the rcstrongswan-starter</changelog>
  <changelog author="mbuil@suse.com" date="1617624000">- Add config to run ipsec on namespaces (bsc #1183670)</changelog>
  <changelog author="mt@suse.com" date="1619006400">- Add support for AES CCM aead algorithms to openssl plugin (cc/fips,bsc#1185363)
  [+ 0009-strongswan-openssl-aead-add-ccm-support.patch]</changelog>
  <changelog author="mt@suse.com" date="1620388800">- Replace AEAD AES CCM patch with upstream variant (cc/fips,bsc#1185363)
  [* 0009-strongswan-openssl-aead-add-ccm-support.patch]</changelog>
  <changelog author="hare@suse.de" date="1627646400">- Add auth_els plugin to support Marvell FC-SP encryption (jsc#SLE-20151)
  [* strongswan-marvell-auth-els.patch]</changelog>
  <changelog author="abergmann@suse.com" date="1634040000">- Fix integer overflow in gmp plugin (bsc#1191367, CVE-2021-41990)
  [* strongswan-5.6.1-5.9.3_gmp-rsa-ssa-salt-len.patch]
- Fix integer overflow when replacing certificates in cache (bsc#1191435, CVE-2021-41991)
  [* strongswan-4.4.1-5.9.3_cert-cache-random.patch]</changelog>
  <changelog author="meissner@suse.com" date="1643025600">- strongswan-5.5.0-5.9.4_eap_success-CVE-2021-45079.patch:
  Fixed authentication bypass in EAP authentication (CVE-2021-45079
  bsc#1194471)</changelog>
</package>
<package pkgid="5a857c06095c9aeab51e750f89aed849c0aaea7c5b57c4b778b6bc7f300df49a" name="strongswan-sqlite" arch="ppc64le">
  <version epoch="0" ver="5.8.2" rel="11.24.1"/>
  <changelog author="ndas@suse.de" date="1501502400">- Updated to strongSwan 5.3.5(bsc#1050691) providing the following changes:
  * Fixed a DoS vulnerability in the gmp plugin that was caused by insufficient input
    validation when verifying RSA signatures. More specifically, mpz_powm_sec() has two
    requirements regarding the passed exponent and modulus that the plugin did not
    enforce, if these are not met the calculation will result in a floating point exception
    that crashes the whole process.
    This vulnerability has been registered as CVE-2017-9022.
    Please refer to our blog for details.
  * Fixed a DoS vulnerability in the x509 plugin that was caused because the ASN.1 parser
    didn't handle ASN.1 CHOICE types properly, which could result in an infinite loop when
    parsing X.509 extensions that use such types.
    This vulnerability has been registered as CVE-2017-9023.
    Please refer to our blog for details.
  * The behavior during IKEv2 CHILD_SA rekeying has been changed in order to avoid
    traffic loss. When responding to a CREATE_CHILD_SA request to rekey a CHILD_SA
    the responder already has everything available to install and use the new CHILD_SA.
    However, this could lead to lost traffic as the initiator won't be able to process
    inbound packets until it processed the CREATE_CHILD_SA response and updated the
    inbound SA. To avoid this the responder now only installs the new inbound SA and
    delays installing the outbound SA until it receives the DELETE for the replaced CHILD_SA.
  * The messages transporting these DELETEs could reach the peer before packets sent
    with the deleted outbound SAs reach it. To reduce the chance of traffic loss due
    to this the inbound SA of the replaced CHILD_SA is not removed for a configurable
    amount of seconds (charon.delete_rekeyed_delay) after the DELETE has been processed.
  * The code base has been ported to Apple's ARM64 iOS platform, which required several
    changes regarding the use of variadic functions. This was necessary because the calling
    conventions for variadic and regular functions are different there.
    This means that assigning a non-variadic function to a variadic function pointer, as we
    did with our enumerator_t::enumerate() implementations and several callbacks, will
    result in crashes as the called function accesses the arguments differently than the
    caller provided them. To avoid this issue the enumerator_t interface has been changed
    and the signature of the callback functions for enumerator_create_filter() and two
    methods on linked_list_t have been changed. Refer to the developer notes below
    for details.
  * Adds support for fuzzing the certificate parser provided by the default plugins
    (x509, pem, gmp etc.) on Google's OSS-Fuzz infrastructure (or generally with
    libFuzzer). Several issues found while fuzzing these plugins were fixed.
  * Two new options have been added to charon's retransmission settings:
    retransmit_limit and retransmit_jitter. The former adds an upper limit to the
    calculated retransmission timeout, the latter randomly reduces it.
    Refer to Retransmission for details.
  * A bug in swanctl's --load-creds command was fixed that caused unencrypted
    private keys to get unloaded if the command was called multiple times.
    The load-key VICI command now returns the key ID of the loaded key on success.
  * The credential manager now enumerates local credential sets before global ones.
    This means certificates supplied by the peer will now be preferred over certificates
    with the same identity that may be locally stored (e.g. in the certificate cache).
  * Adds support for hardware offload of IPsec SAs as introduced by Linux 4.11 for
    specific hardware that supports this.
  * The pki tool loads the curve25519 plugin by default.
    [- 0006-Make-sure-the-modulus-is-odd-and-the-exponent-not-zero.patch,
  - 0007-asn1-parser-Fix-CHOICE-parsing.patch]
- libhydra is removed as all kernel plugins moved to libcharon</changelog>
  <changelog author="ndas@suse.de" date="1504612800">- fix "uintptr_t? undeclared" compilation error.
  [+0006-fix-compilation-error-by-adding-stdint.h.patch]</changelog>
  <changelog author="ndas@suse.de" date="1504612801">- Updated to strongSwan 5.6.0 providing the following changes:
  * Fixed a DoS vulnerability in the gmp plugin that was caused by insufficient input validation
    when verifying RSA signatures, which requires decryption with the operation m^e mod n,
    where m is the signature, and e and n are the exponent and modulus of the public key.
    The value m is an integer between 0 and n-1, however, the gmp plugin did not verify this.
    So if m equals n the calculation results in 0, in which case mpz_export() returns NULL.
    This result wasn't handled properly causing a null-pointer dereference.
    This vulnerability has been registered as CVE-2017-11185. (bsc#1051222)
  * New SWIMA IMC/IMV pair implements the draft-ietf-sacm-nea-swima-patnc Internet
    Draft and has been demonstrated at the IETF 99 Prague Hackathon.
  * The IMV database template has been adapted to achieve full compliance with the
    ISO 19770-2:2015 SWID tag standard.
  * The pt-tls-client can attach and use TPM 2.0 protected private keys via the --keyid parameter.
  * By default the /etc/swanctl/conf.d directory is created and *.conf files in it are included in the default
    swanctl.conf file.
  * The curl plugin now follows HTTP redirects (configurable via strongswan.conf).
  * The CHILD_SA rekeying was fixed in charon-tkm and the behavior is refined a bit more since 5.5.3
  * libtpmtss supports Intel's TSS2 Architecture Broker and Resource Manager interface (tcti-tabrmd).
  * more on https://wiki.strongswan.org/versions/66</changelog>
  <changelog author="mmnelemane@suse.com" date="1521028800">- Removed unused requires and macro calls(bsc#1083261)</changelog>
  <changelog author="mmnelemane@suse.com" date="1573646400">- Added patch to fix vulnerability: CVE-2018-16151,CVE-2018-16152 (bsc#1107874)
  - Insufficient input validation in gmp plugin
  [+ 0007-strongswan-5.3.1-5.6.0_gmp-pkcs1-verify.patch]</changelog>
  <changelog author="mmnelemane@suse.com" date="1573646401">- Added patch to fix vulnerability: CVE-2018-5388 (bsc#1094462)
  - Buffer Underflow in stroke_socket.c
  [+ 0008-strongswan-5.1.2-5.6.2_stroke_msg_len.patch]</changelog>
  <changelog author="mmnelemane@suse.com" date="1573646402">- Added patch to fix vulnerability: CVE-2018-10811 (bsc#1093536)
  - denial-of-service vulnerability
  [+ 0009-strongswan-5.5.0-5.6.2_skeyseed_init.patch]</changelog>
  <changelog author="mmnelemane@suse.com" date="1573732800">- Added patch to fix vulnerability: CVE-2018-17540 (bsc#1109845)
  [+ 0010-strongswan-4.4.0-5.7.0_gmp-pkcs1-overflow.patch]</changelog>
  <changelog author="mmnelemane@suse.com" date="1580212800">- Updated to version 5.8.2 (jsc#SLE-11370)
  - Dropped following patches due to irrelevance in the updated version:
    [- strongswan_modprobe_syslog.patch ]
    [- strongswan_fipsfilter.patch ]
    [- 0006-fix-compilation-error-by-adding-stdint.h.patch ]
    [- 0007-strongswan-5.3.1-5.6.0_gmp-pkcs1-verify.patch ]
    [- 0008-strongswan-5.1.2-5.6.2_stroke_msg_len.patch ]
    [- 0009-strongswan-5.5.0-5.6.2_skeyseed_init.patch ]
    [- 0010-strongswan-4.4.0-5.7.0_gmp-pkcs1-overflow.patch ]
  - Version 5.8.2
  ===============
  * Identity-based CA constraints, which enforce that the certificate chain of the remote
    peer contains a CA certificate with a specific identity, are supported via
    vici/swanctl.conf. This is similar to the existing CA constraints but doesn't require
    that the CA certificate is locally installed, for instance, intermediate CA certificates
    received from the peers. Wildcard identity matching (e.g. ..., OU=Research, CN=*) could
    also be used for the latter but requires trust in the intermediate CAs to only issue
    certificates with legitimate subject DNs (e.g. the "Sales" CA must not issue certificates
    with OU=Research). With the new constraint that's not necessary as long as a path length
    basic constraint (--pathlen for pki --issue) prevents intermediate CAs from issuing further
    intermediate CAs.
  * Intermediate CA certificates may now be sent in hash-and-URL encoding by configuring a
    base URL for the parent CA (#3234, swanctl/rw-hash-and-url-multi-level).
  * Implemented NIST SP-800-90A Deterministic Random Bit Generator (DRBG) based on AES-CTR
    and SHA2-HMAC modes. Currently used by the gmp and ntru plugins.
  * Random nonces sent in an OCSP requests are now expected in the corresponding OCSP responses.
  * The kernel-netlink plugin now ignores deprecated IPv6 addresses for MOBIKE. Whether temporary
    or permanent IPv6 addresses are included now depends on the charon.prefer_temporary_addrs
    setting (#3192).
  * Extended Sequence Numbers (ESN) are configured via PF_KEY if supported by the kernel.
  * The PF_KEY socket's receive buffer in the kernel-pfkey plugin is now cleared before sending
    requests, as many of the messages sent by the kernel are sent as broadcasts to all PF_KEY
    sockets. This is an issue if an external tool is used to manage SAs/policies unrelated to
    IPsec (#3225).
  * The vici plugin now uses unique section names for CHILD_SAs in child-updown events (7c74ce9190).
  * For individually deleted CHILD_SAs (in particular for IKEv1) the vici child-updown event
    now includes more information about the CHILD_SAs such as traffic statistics (#3198).
  * Custom loggers are correctly re-registered if log levels are changed via stroke loglevel (#3182).
  * Avoid lockups during startup on low entropy systems when using OpenSSL 1.1.1 (095a2c2eac).
  * Instead of failing later when setting a key, creating HMACs via openssl plugin now fails
    instantly if the underlying hash algorithm isn't supported (e.g. MD5 in FIPS-mode) so fallbacks
    to other plugins work properly (#3284).
  * Exponents of RSA keys read from TPM 2.0 via SAPI are correctly converted (8ee1242f1438).
  * Routing table IDs &gt; 255 are supported for custom routes on Linux.
  * To avoid races, the check for hardware offloading support in the kernel-netlink plugin is
    performed during initialization of the plugin (a605452c03).
  * The D-Bus config file for charon-nm is now installed in $(datadir)/dbus-1/system.d instead of
    $(sysconfdir)/dbus-1/system.d, which is intended for sysadmin overrides.
    INVALID_MAJOR_VERSION notifies are now correctly sent in messages of the same exchange type
    and with the same message ID as the request.
  * IKEv2 SAs are now immediately destroyed when sending or receiving INVALID_SYNTAX notifies
    in authenticated messages.
  * For developers working from the repository the configure script now aborts if GNU gperf is
    not found.
  - Version 5.8.1
  ===============
  * RDNs in DNs of X.509 certificates can now optionally be matched less strict. The global
    strongswan.conf option charon.rdn_matching takes two alternative values that cause the
    matching algorithm to either ignore the order of matched RDNs (reordered) or additionally
    (relaxed) accept DNs that contain more RDNs than configured (unmatched RDNs are treated
    like wildcard matches).
  * The updown plugin now passes the same interface to the script that is also used for the
    automatically installed routes, that is, the interface over which the peer is reached
    instead of the interface on which the local address is found (#3095).
  * TPM 2.0 contexts are now protected by a mutex to prevent issues if multiple IKE_SAs use
    the same private key concurrently (4b25885025).
  * Do a rekey check after the third QM message was received (#3060).
  * If available, explicit_bzero() is now used as memwipe() instead of our own implementation.
  * An .editorconfig file has been added, mainly so Github shows files with proper indentation
    (68346b6962).
  * The internal certificate of the load-tester plugin has been modified so it can again be
    used as end-entity cert with 5.6.3 and later (#3139).
  * The maximum data length of received COOKIE notifies (64 bytes) is now enforced (#3160).
  - Version 5.8.0
  ===============
  * The systemd service units have been renamed. The modern unit, which was called
    strongswan-swanctl, is now called strongswan (the previous name is configured as alias in
    the unit, for which a symlink is created when the unit is enabled). The legacy unit is now
    called strongswan-starter.
  * Support for XFRM interfaces (available since Linux 4.19) has been added, which are intended
    to replace VTI devices (they are similar but offer several advantages, for instance, they
    are not bound to an address or address family).
  * IPsec SAs and policies are associated with such interfaces via interface IDs that can be
    configured in swanctl.conf (dynamic IDs may optionally be allocated for each SA and even
    direction). It's possible to use separate interfaces for in- and outbound traffic (or
    only use an interface in one direction and regular policies in the other).
  * Interfaces may be created dynamically via updown/vici scripts, or statically before or after
    establishing the SAs. Routes must be added manually as needed (the daemon will not install
    any routes for outbound policies with an interface ID).
  * When moving XFRM interfaces to other network namespaces they retain access to the SAs and
    policies installed in the original namespace, which allows providing IPsec tunnels for
    processes in other network namespaces without giving them access to the IPsec keys or
    IKE credentials.
    More information can be found on the page about route-based VPNs.
  * Initiation of childless IKE_SAs is supported (RFC 6023). If enabled and supported by the
    responder, no CHILD_SA is established during IKE_AUTH. Instead, all CHILD_SAs are created
    with CREATE_CHILD_SA exchanges. This allows using a separate DH exchange even for the
    first CHILD_SA, which is otherwise created during IKE_AUTH with keys derived from the
    IKE_SA's key material.
  * The swanctl --initiate command may be used to initiate only the IKE_SA via --ike
    option if --child is omitted and the peer supports this extension.
  * The NetworkManager backend and plugin support IPv6.
  * The new wolfssl plugin is a wrapper around the wolfSSL crypto library. Thanks to Sean
    Parkinson of wolfSSL Inc. for the initial patch.
  * IKE SPIs may optionally be labeled via the charon.spi_mask|label options in
    strongswan.conf. This feature was extracted from charon-tkm, however, now applies the
    mask/label in network order.
  * The openssl plugin supports ChaCha20-Poly1305 when built with OpenSSL 1.1.0.
  * The PB-TNC finite state machine according to section 3.2 of RFC 5793 was not correctly
    implemented when sending either a CRETRY or SRETRY batch. These batches can only be sent
    in the "Decided" state and a CRETRY batch can immediately carry all messages usually
    transported by a CDATA batch. It is currently not possible to send a SRETRY batch since
    full-duplex mode for PT-TLS transport is not supported.
  * Instead of marking IPv6 virtual IPs as deprecated, the kernel-netlink plugin now uses
    address labels to avoid that such addresses are used for non-VPN traffic (00a953d090).
  * The agent plugin now creates sockets to the ssh/gpg-agent dynamically and does not keep
    them open, which otherwise might prevent the agent from getting terminated.
  * To avoid broadcast loops the forecast plugin now only reinjects packets that are marked
    or received from the configured interface.
  * UTF-8 encoded passwords are supported via EAP-MSCHAPv2, which internally uses an UTF-16LE
    encoding to calculate the NT hash (#3014).
  * Properly delete temporary drop policies (used when updating IP addresses of SAs) if manual
    priorities are used, which was broken since 5.6.2 (8e31d65730).
  * Avoid overwriting start_action when parsing the inactivity timeout in the vici plugin (#2954).
  * Fixed the automatic termination of reloaded vici connections with start_action=start,
    which was broken since 5.6.3 (71b22c250f).
  * The lookup for shared secrets for IKEv1 SAs via sql plugin should now work better
    (6ec9f68f32).
  * Fixed a race condition in the trap manager between installation and removal of a policy
    (69cbe2ca3f).
  * Compilation of the kernel-netlink plugin has been fixed on old kernels (&lt; 2.6.39), which
    was caused by the HW offload changes (c7f579fa17).
  * The IPsec stack detection and module loading in starter has been removed (it wasn't
    enforced anyway and loading modules doesn't seem necessary, also KLIPS hasn't been
    supported for a long time and PF_KEY will eventually be removed from the Linux kernel,
    ba817d2917).
  * Several IKEv2 protocol details are now handled more strictly: Unrequested virtual IPs are
    ignored, CFG_REPLY payloads are ignored if no CFG_REQUEST payloads were sent, a USE
    TRANSPORT_MODE notify received from the responder is checked against the local configuration.
  * The keys and certificates used by the scenarios in the testing environment are now generated
    dynamically. Running the testing/scripts/build-certs script after creating the base and root
    images uses the pki utility installed in the latter to create the keys and certificates for
    all the CAs and in some cases for individual scenarios. These credentials are stored in the
    source tree, not the image, so this has to be called only once even if the images are later
    rebuilt. The script automatically (re-)rebuilds the guest images as that generates fresh
    CRLs and signs the DNS zones. The only keys/certificates currently not generated are the
    very large ones used by the ikev2/rw-eap-tls-fragments scenario.
  - Version 5.7.2
  ===============
  * For RSA with PSS padding, the TPM 2.0 specification mandates the maximum salt length
    (as defined by the length of the key and hash). However, if the TPM is FIPS-168-4 compliant,
    the salt length equals the hash length. This is assumed for FIPS-140-2 compliant TPMs, but
    if that's not the case, it might be necessary to manually enable charon.plugins.tpm.fips_186_4
    if the TPM doesn't use the maximum salt length.
  * Directories for credentials loaded by swanctl are now accessed relative to the loaded
    swanctl.conf file, in particular, when loading it from a custom location via --file argument.
  * The base directory, which is used if no custom location for swanctl.conf is specified, is now
    also configurable at runtime via SWANCTL_DIR environment variable.
  * If RADIUS Accounting is enabled, the eap-radius plugin will add the session ID (Acct-Session-Id)
    to Access-Request messages, which e.g. simplifies associating database entries for IP leases and
    accounting with sessions (the session ID does not change when IKE_SAs are rekeyed, #2853).
  * All IP addresses assigned by a RADIUS server are included in Accounting-Stop messages even if
    the client did not claim them, allowing to release them early in case of connection errors (#2856).
  * Selectors installed on transport mode SAs by the kernel-netlink plugin are now updated if an
    IP address changes (e.g. via MOBIKE) and it was part of the selectors.
  * No deletes are sent anymore when a rekeyed CHILD_SA expires (#2815).
  * The bypass-lan plugin now tracks interfaces to handle subnets that move from one interface
    to another and properly update associated routes (#2820).
  * Only valid and expected inbound IKEv2 messages are used to update the timestamp of the
    last received message (previously, retransmits also triggered an update).
  * IKEv2 requests from responders are now ignored until the IKE_SA is fully established (e.g. if a
    DPD request from the peer arrives before the IKE_AUTH response does, 46bea1add9).
    Delayed IKE_SA_INIT responses with COOKIE notifies we already recevied are ignored, they caused
    another reset of the IKE_SA previously (#2837).
  * Active and queued Quick Mode tasks are now adopted if the peer reauthenticates an IKEv1 SA
    while creating lots of CHILD_SAs.
  * Newer versions of the FreeBSD kernel add an SADB_X_EXT_SA2 extension to SADB_ACQUIRE
    messages, which allows the kernel-pfkey plugin to determine the reqid of the policy even if it
    wasn't installed by the daemon previously (e.g. when using FreeBSD's if_ipsec(4) VTIs, which
    install policies themselves, 872b9b3e8d).
  * Added support for RSA signatures with SHA-256 and SHA-512 to the agent plugin. For older
    versions of ssh/gpg-agent that only support SHA-1, IKEv2 signature authentication has to be
    disabled via charon.signature_authentication.
  * The sshkey and agent plugins support Ed25519/Ed448 SSH keys and signatures.
  * The openssl plugin supports X25519/X448 Diffie-Hellman and Ed25519/Ed448 keys and
    signatures when built against OpenSSL 1.1.1.
  * Support for Ed25519, ChaCha20/Poly1305, SHA-3 and AES-CCM were added to the botan plugin.
  * The mysql plugin now properly handles database connections with transactions
    under heavy load (#2779).
  * IP addresses in ha pools are now distributed evenly among all segments (#2828).
  * Private key implementations may optionally provide a list of supported signature schemes,
    which, as described above, is used by the tpm plugin because for each key on a TPM 2.0 the
    hash algorithm and for RSA also the padding scheme is predefined.
  * The testing environment is now based on Debian 9 (stretch) by default. This required
    some changes, in particular, updating to FreeRADIUS 3.x (which forced us to abandon the
    TNC@FHH patches and scenarios, 2fbe44bef3) and removing FIPS-enabled versions of
    OpenSSL (the FIPS module only supports OpenSSL 1.0.2).
  * Most test scenarios were migrated to swanctl.
  - Version 5.7.1
  ===============
  * Fixes a vulnerability in the gmp plugin triggered by crafted certificates with RSA keys with
    very small moduli. When verifying signatures with such keys, the code patched with the fix
    for CVE-2018-16151/2 caused an integer underflow and subsequent heap buffer overflow
    that results in a crash of the daemon.
  * The vulnerability has been registered as CVE-2018-17540.
  - Version 5.7.0
  ===============
  * Fixes a potential authorization bypass vulnerability in the gmp plugin that was caused by a
    too lenient verification of PKCS#1 v1.5 signatures. Several flaws could be exploited by a
    Bleichenbacher-style attack to forge signatures for low-exponent keys (i.e. with e=3).
  * CVE-2018-16151 has been assigned to the problem of accepting random bytes after the OID
    of the hash function in such signatures, and CVE-2018-16152 has been assigned to the issue
    of not verifying that the parameters in the ASN.1 algorithmIdentitifer structure is empty.
    Other flaws that don't lead to a vulnerability directly (e.g. not checking for at least
    8 bytes of padding) have no separate CVE assigned.
  * Dots are not allowed anymore in section names in swanctl.conf and strongswan.conf.
    This mainly affects the configuration of file loggers. If the path for such a log file
    contains dots it now has to be configured in the new path setting within the arbitrarily
    renamed subsection in the filelog section.
  * Sections in swanctl.conf and strongswan.conf may now reference other sections. All settings
    and subsections from such a section are inherited. This allows to simplify configs as
    redundant information has only to be specified once and may then be included in other
    sections (see strongswan.conf for an example).
  * The originally selected IKE config (based on the IPs and IKE version) can now change
    if no matching algorithm proposal is found. This way the order of the configs doesn't
    matter that much anymore and it's easily possible to specify separate configs for
    clients that require weaker algorithms (instead of having to also add them in other
    configs that might be selected).
  * Support for Postquantum Preshared Keys for IKEv2 (draft-ietf-ipsecme-qr-ikev2) has been added.
    For an example refer to the swanctl/rw-cert-ppk scenario (or with EAP, or PSK authentication).
  * The new botan plugin is a wrapper around the Botan C++ crypto library.
    It requires a fairly recent build from Botan's master branch (or the upcoming 2.8.0 release).
    Thanks to René Korthaus and his team from Rohde &amp; Schwarz Cybersecurity for the initial
    patch and to Jack Lloyd for quickly adding missing functions to Botan's FFI (C89) interface.
  * Implementation of RFC 8412 "Software Inventory Message and Attributes (SWIMA) for PA-TNC".
  * SWIMA subscription option sets CLOSE_WRITE trigger on apt history.log file resulting in
    a ClientRetry PB-TNC batch to initialize a new measurement cycle. The new imv/imc-swima
    plugins replace the previous imv/imc-swid plugins, which were removed.
  * Added support for fuzzing the PA-TNC (RFC 5792) and PB-TNC (RFC 5793) NEA protocols
    on Google's OSS-Fuzz infrastructure.
  * Support for version 2 of Intel's TPM2-TSS TGC Software Stack. The presence of the
    in-kernel /dev/tpmrm0 resource manager is automatically detected.
  * The pki tool accepts a xmppAddr otherName as a subjectAlternativeName using the
    syntax --san xmppaddr:&lt;jid&gt;.
  * swanctl.conf supports the configuration of marks the in- and/or outbound SA should apply
    to packets after processing on Linux. Configuring such a mark for outbound SAs requires
    at least a 4.14 kernel. The ability to set a mask and configuring a mark/mask for
    inbound SAs will be added with the upcoming 4.19 kernel.
  * New options in swanctl.conf allow configuring how/whether DF, ECN and DS fields in the
    IP headers are copied during IPsec processing. Controlling this is currently only possible
    on Linux.
  * The handling of sequence numbers in IKEv1 DPDs has been improved (#2714).
  * To avoid conflicts, the dhcp plugin now only uses the DHCP server port if explicitly
    configured.
  - Version 5.6.3
  ===============
  * Fixed a DoS vulnerability in the IKEv2 key derivation if the openssl plugin is used in FIPS
    mode and HMAC-MD5 is negotiated as PRF.
    This vulnerability has been registered as CVE-2018-10811.
  * Fixed a vulnerability in the stroke plugin, which did not check the received length before
    reading a message from the socket. Unless a group is configured, root privileges are
    required to access that socket, so in the default configuration this shouldn't be an issue.
    This vulnerability has been registered as CVE-2018-5388.
  * CRLs that are not yet valid are now ignored to avoid problems in scenarios where expired
    certificates are removed from new CRLs and the clock on the host doing the revocation
    check is trailing behind that of the host issuing CRLs. Not doing this could result in
    accepting a revoked and expired certificate, if it's still valid according to the
    trailing clock but not contained anymore in not yet valid CRLs.
  * The issuer of fetched CRLs is now compared to the issuer of the checked certificate (#2608).
  * CRL validation results other than revocation (e.g. a skipped check because the CRL couldn't
    be fetched) are now stored also for intermediate CA certificates and not only for end-entity
    certificates, so a strict CRL policy can be enforced in such cases.
  * In compliance with RFC 4945, section 5.1.3.2, certificates used for IKE must now either
    not contain a keyUsage extension (like the ones generated by pki), or have at least one of the
    digitalSignature or nonRepudiation bits set.
  * New options for vici/swanctl allow forcing the local termination of an IKE_SA. This might be
    useful in situations where it's known the other end is not reachable anymore, or that it
    already removed the IKE_SA, so retransmitting a DELETE and waiting for a response would
    be pointless.
  * Waiting only a certain amount of time for a response (i.e. shorter than all retransmits
    would be) before destroying the IKE_SA is also possible by additionally specifying a
    timeout in the forced termination request.
  * When removing routes, the kernel-netlink plugin now checks if it tracks other routes for
    the same destination and replaces the installed route instead of just removing it. Same
    during installation, where existing routes previously weren't replaced. This should allow
    using traps with virtual IPs on Linux (#2162).
  * The dhcp plugin now only sends the client identifier DHCP option if the identity_lease
    setting is enabled (7b660944b6). It can also send identities of up to 255 bytes length,
    instead of the previous 64 bytes (30e886fe3b, 0e5b94d038). If a server address is
    configured, DHCP requests are now sent from port 67 instead of 68 to avoid ICMP port
    unreachables (becf027cd9).
  * The handling of faulty INVALID_KE_PAYLOAD notifies (e.g. one containing a DH group
    that wasn't proposed) during CREATE_CHILD_SA exchanges has been improved (#2536).
  * Roam events are now completely ignored for IKEv1 SAs (there is no MOBIKE to handle such
    changes properly).
  * ChaCha20/Poly1305 is now correctly proposed without key length (#2614). For compatibility with
    older releases the chacha20poly1305compat keyword may be included in proposals to also propose
    the algorithm with a key length (c58434aeff).
  * Configuration of hardware offload of IPsec SAs is now more flexible and allows a new
    setting (auto), which automatically uses it if the kernel and device both support it. If hw
    offload is set to yes and offloading is not supported, the CHILD_SA installation now fails.
  * The kernel-pfkey plugin optionally installs routes via internal interface (one with an IP
    in the local traffic selector). On FreeBSD, enabling this selects the correct source IP
    when sending packets from the gateway itself (e811659323).
  * SHA-2 based PRFs are supported in PKCS#8 files as generated by OpenSSL 1.1 (#2574).
  * The pki --verify tool may load CA certificates and CRLs from directories.
  * The IKE daemon now also switches to port 4500 if the remote port is not 500 (e.g. because the
    remote maps the response to a different port, as might happen on Azure), as long as the local
    port is 500 (85bfab621d).
  * Fixed an issue with DNS servers passed to NetworkManager in charon-nm (ee8c25516a).
  * Logged traffic selectors now always contain the protocol if either protocol or port are set
    (a36d8097ed).
  * Only the inbound SA/policy will be updated as reaction to IP address changes for rekeyed
    CHILD_SAs that are kept around.
  * The parser for strongswan.conf/swanctl.conf now accepts = characters in values without
    having to put the value in quotes (e.g. for Base64 encoded shared secrets).
    Notes for developers:
  * trap_manager_t: Trap policies are now unistalled by peer/child name and not the reqid.
  * No reqid is returned anymore when installing trap policies.
  * child_sa_t: A new state (CHILD_DELETED) is used for CHILD_SAs that have been deleted but
    not yet destroyed (after a rekeying CHILD_SAs are kept around for a while to process
    delayed packets).
    This way child_updown events are not triggered anymore for such SAs when an IKE_SA that
    has such CHILD_SAs assigned is deleted.
  - Version 5.6.2
  ===============
  * Fixed a DoS vulnerability in the parser for PKCS#1 RSASSA-PSS signatures that was caused
    by insufficient input validation. One of the configurable parameters in algorithm identifier
    structures for RSASSA-PSS signatures is the mask generation function (MGF). Only MGF1 is
    currently specified for this purpose. However, this in turn takes itself a parameter that
    specifies the underlying hash function. strongSwan's parser did not correctly handle the
    case of this parameter being absent, causing an undefined data read.
    This vulnerability has been registered as CVE-2018-6459.
  * When rekeying IKEv2 IKE_SAs the previously negotiated DH group will be reused, instead of
    using the first configured group, which avoids an additional exchange if the peer previously
    selected a different DH group via INVALID_KE_PAYLOAD notify. The same is also done when
    rekeying CHILD_SAs except for the first rekeying of the CHILD_SA that was created with the
    IKE_SA, where no DH group was negotiated yet.
    Also, the selected DH group is moved to the front in all sent proposals that contain it
    and all proposals that don't are moved to the back in order to convey the preference for
    this group to the peer.
  * Handling of MOBIKE task queuing has been improved. In particular, the response to an
    address update (with NAT-D payloads) is not ignored anymore if only an address list update
    or DPD is queued as that could prevent updating the UDP encapsulation in the kernel.
  * On Linux, roam events may optionally be triggered by changes to the routing rules, which
    can be useful if routing rules (instead of e.g. route metrics) are used to switch from one
    to another interface (i.e. from one to another routing table). Since routing rules are
    currently not evaluated when doing route lookups this is only useful if the kernel-based
    route lookup is used (4664992f7d).
  * The fallback drop policies installed to avoid traffic leaks when replacing addresses in
    installed policies are now replaced by temporary drop policies, which also prevent
    acquires because we currently delete and reinstall IPsec SAs to update their addresses
    (35ef1b032d).
  * Access X.509 certificates held in non-volatile storage of a TPM 2.0 referenced via the
    NV index.
    Adding the --keyid parameter to pki --print allows to print private keys or certificates
    stored in a smartcard or a TPM 2.0.
  * Fixed proposal selection if a peer incorrectly sends DH groups in the ESP proposal during
    IKE_AUTH and also if a DH group is configured in the local ESP proposal and charon.prefer
    configured_proposals is disabled (d058fd3c32).
  * The lookup for PSK secrets for IKEv1 has been improved for certain scenarios (see #2497
    for details).
  * MSKs received via RADIUS are now padded to 64 bytes to avoid compatibility issues with
    EAP-MSCHAPv2 and PRFs that have a block size &lt; 64 bytes (e.g. AES-XCBC-PRF-128, see
    73cbce6013).
  * The tpm_extendpcr command line tool extends a digest into a TPM PCR.
  * Ported the NetworkManager backend from the deprecated libnm-glib to libnm.
  * The save-keys debugging/development plugin saves IKE and/or ESP keys to files compatible
    with Wireshark.
  - Version 5.6.1
  ===============
  * Several algorithms were removed from the default ESP/AH and IKE proposals in compliance with
    RFC 8221 and RFC 8247, respectively. Removed from the default ESP/AH proposal were the
    3DES and Blowfish encryption algorithms and the HMAC-MD5 integrity algorithm. From the IKE
    default proposal the HMAC-MD5 integrity algorithm and the MODP-1024 Diffie-Hellman group
    were removed (the latter is significant for Windows clients in their default configuration).
    These algorithms may still be used in custom proposals.
  * Support for RSASSA-PSS signatures has been added. For compatibility with previous
    releases they are currently not used automatically, by default, to change that charon.rsa_pss
    may be enabled. To explicitly use or require such signatures during IKEv2 signature
    authentication (RFC 7427) ike:rsa/pss... authentication constraints may be used for specific
    connections (regardless of whether the strongswan.conf option above is enabled). Only the
    hash algorithm can be specified in such constraints, the MGF1 will be based on that hash
    and the salt length will equal the hash length (when verifying the salt length is not
    enforced).
    To enforce such signatures during PKI verification use rsa/pss... authentication constraints.
  * All pki commands that create certificates/CRLs can be made to sign with RSASSA-PSS instead
    of the classing PKCS#1 scheme with the --rsa-padding pss option. As with signatures during
    authentication, only the hash algorithm is configurable (via --digest option), the MGF1 will
    be based on that and the salt length will equal the hash length.
  * These signatures are supported by all RSA backends except pkcs11 (i.e. gmp, gcrypt, openssl).
    The gmp plugin requires the mgf1 plugin.
    Note that RSASSA-PSS algorithm identifiers and parameters in keys (public keys in
    certificates or private keys in PKCS#8 files) are currently not used as constraints.
  * The sec-updater tool checks for security updates in dpkg-based repositories
    (e.g. Debian/Ubuntu) and sets the security flags in the IMV policy database accordingly.
    Additionally for each new package version a SWID tag for the given OS and HW architecture
    is created and stored in the database.
  * Using the sec-updater.sh script template the lookup can be automated (e.g. via an hourly
    cron job).
  * When restarting an IKEv2 negotiation after receiving an INVALID_KE_PAYLOAD notify (or due
    to other reasons like too many retransmits) a new initiator SPI is allocated. This
    prevents issues caused by retransmits for IKE_SA_INIT messages.
  * Because the initiator SPI was previously reused when restarting the connection delayed
    responses for previous connection attempts were processed and might have caused fatal
    errors due to a failed DH negotiation or because of the internal retry counter in the
    ike-init task. For instance, if we proposed a DH group the responder rejected we
    might have later received delayed responses that either contained INVALID_KE_PAYLOAD
    notifies with the DH group we already switched to, or, if we retransmitted an
    IKE_SA_INIT with the requested group but then had to restart again, a KE payload with
    a group different from the one we proposed.
  * The introduction of file versions in the IMV database scheme broke file reference hash
    measurements. This has been fixed by creating generic product versions having an empty
    package name.
  * A new timeout option for the systime-fix plugin stops periodic system time checks after
    a while and enforces a certificate verification, closing or reauthenticating all SAs
    with invalid certificates.
  * The IKE event counters, previously only available via ipsec listcounters command, may
    now also be queried and reset via vici and the new swanctl --counters command. They
    are collected and provided by the optional counters plugin (enabled by default for
    backwards compatibility if the stroke plugin is built).
  * Class attributes received in RADIUS Access-Accept messages may optionally be added to
    RADIUS accounting messages (655924074b).
  * Basic support for systemd sockets has been added, which may be used for privilege separation
    (59db98fb94).
  * Inbound marks may optionally be installed in the SA again (was removed with 5.5.2) by
    enabling the mark_in_sa option in swanctl.conf.
  * The timeout of leases in pools configured via pool utility may be configured in other
    units than hours.
    INITIAL_CONTACT notifies are now only omitted if never is configured as uniqueness policy.
  * Outbound FWD policies for shunts are not installed anymore, by default (as is the case
    for other policies since 5.5.1).
  * Don't consider a DH group mismatch during CHILD_SA rekeying as failure as responder
    (e7276f78aa).
  * Handling of fragmented IPv4 and IPv6 packets in libipsec has been improved (e138003de9).
  * Trigger expire events for the correct IPsec SA in libipsec (6e861947a0).
  * A crash in CRL verification via openssl plugin using OpenSSL 1.1 has been fixed (78acaba6a1).
  * No hard-coded default proposals are passed from starter to the stroke plugin anymore (the
    IKE proposal used curve25519 since 5.5.2, which is an optional plugin).
  * A workaround for an issue with virtual IPs on macOS 10.13 (High Sierra) has been added
    (039b85dd43).
  * Handling of IKE_SA rekey collisions in charon-tkm has been fixed.
  * Instead of failing or just silently doing nothing unit tests may now warn about certain
    conditions (e.g. if a test was not executed due to external dependencies).</changelog>
  <changelog author="mmnelemane@suse.com" date="1585224000">- Fix for to resolve multiple definition of swanctl_dir (bsc #1164493)
  [+ 0006-Resolve-multiple-definition-of-swanctl_dir.patch]</changelog>
  <changelog author="mbuil@suse.com" date="1610712000">- Fix typo in README (bsc #1167880)
  [+ 0007-Fix-typo-in-README.patch ]</changelog>
  <changelog author="mbuil@suse.com" date="1611576000">- Fix FIPS bug (bsc #1180801)
  [+ 0008-gcrypt-Use-a-dummy-buffer-to-initialize-static-alloc.patch ]</changelog>
  <changelog author="mbuil@suse.com" date="1617019200">- Keep using ipsec as the main binary. Therefore, make strongswan.service point to it instead of swanctl</changelog>
  <changelog author="mbuil@suse.com" date="1617019201">- Information added in README about the rcstrongswan-starter</changelog>
  <changelog author="mbuil@suse.com" date="1617624000">- Add config to run ipsec on namespaces (bsc #1183670)</changelog>
  <changelog author="mt@suse.com" date="1619006400">- Add support for AES CCM aead algorithms to openssl plugin (cc/fips,bsc#1185363)
  [+ 0009-strongswan-openssl-aead-add-ccm-support.patch]</changelog>
  <changelog author="mt@suse.com" date="1620388800">- Replace AEAD AES CCM patch with upstream variant (cc/fips,bsc#1185363)
  [* 0009-strongswan-openssl-aead-add-ccm-support.patch]</changelog>
  <changelog author="hare@suse.de" date="1627646400">- Add auth_els plugin to support Marvell FC-SP encryption (jsc#SLE-20151)
  [* strongswan-marvell-auth-els.patch]</changelog>
  <changelog author="abergmann@suse.com" date="1634040000">- Fix integer overflow in gmp plugin (bsc#1191367, CVE-2021-41990)
  [* strongswan-5.6.1-5.9.3_gmp-rsa-ssa-salt-len.patch]
- Fix integer overflow when replacing certificates in cache (bsc#1191435, CVE-2021-41991)
  [* strongswan-4.4.1-5.9.3_cert-cache-random.patch]</changelog>
  <changelog author="meissner@suse.com" date="1643025600">- strongswan-5.5.0-5.9.4_eap_success-CVE-2021-45079.patch:
  Fixed authentication bypass in EAP authentication (CVE-2021-45079
  bsc#1194471)</changelog>
</package>
<package pkgid="abe61d3b647600a86aeef3d5f9783e51b531cc4bdcdad13c44799352b207eb65" name="strongswan-sqlite" arch="s390x">
  <version epoch="0" ver="5.8.2" rel="11.24.1"/>
  <changelog author="ndas@suse.de" date="1501502400">- Updated to strongSwan 5.3.5(bsc#1050691) providing the following changes:
  * Fixed a DoS vulnerability in the gmp plugin that was caused by insufficient input
    validation when verifying RSA signatures. More specifically, mpz_powm_sec() has two
    requirements regarding the passed exponent and modulus that the plugin did not
    enforce, if these are not met the calculation will result in a floating point exception
    that crashes the whole process.
    This vulnerability has been registered as CVE-2017-9022.
    Please refer to our blog for details.
  * Fixed a DoS vulnerability in the x509 plugin that was caused because the ASN.1 parser
    didn't handle ASN.1 CHOICE types properly, which could result in an infinite loop when
    parsing X.509 extensions that use such types.
    This vulnerability has been registered as CVE-2017-9023.
    Please refer to our blog for details.
  * The behavior during IKEv2 CHILD_SA rekeying has been changed in order to avoid
    traffic loss. When responding to a CREATE_CHILD_SA request to rekey a CHILD_SA
    the responder already has everything available to install and use the new CHILD_SA.
    However, this could lead to lost traffic as the initiator won't be able to process
    inbound packets until it processed the CREATE_CHILD_SA response and updated the
    inbound SA. To avoid this the responder now only installs the new inbound SA and
    delays installing the outbound SA until it receives the DELETE for the replaced CHILD_SA.
  * The messages transporting these DELETEs could reach the peer before packets sent
    with the deleted outbound SAs reach it. To reduce the chance of traffic loss due
    to this the inbound SA of the replaced CHILD_SA is not removed for a configurable
    amount of seconds (charon.delete_rekeyed_delay) after the DELETE has been processed.
  * The code base has been ported to Apple's ARM64 iOS platform, which required several
    changes regarding the use of variadic functions. This was necessary because the calling
    conventions for variadic and regular functions are different there.
    This means that assigning a non-variadic function to a variadic function pointer, as we
    did with our enumerator_t::enumerate() implementations and several callbacks, will
    result in crashes as the called function accesses the arguments differently than the
    caller provided them. To avoid this issue the enumerator_t interface has been changed
    and the signature of the callback functions for enumerator_create_filter() and two
    methods on linked_list_t have been changed. Refer to the developer notes below
    for details.
  * Adds support for fuzzing the certificate parser provided by the default plugins
    (x509, pem, gmp etc.) on Google's OSS-Fuzz infrastructure (or generally with
    libFuzzer). Several issues found while fuzzing these plugins were fixed.
  * Two new options have been added to charon's retransmission settings:
    retransmit_limit and retransmit_jitter. The former adds an upper limit to the
    calculated retransmission timeout, the latter randomly reduces it.
    Refer to Retransmission for details.
  * A bug in swanctl's --load-creds command was fixed that caused unencrypted
    private keys to get unloaded if the command was called multiple times.
    The load-key VICI command now returns the key ID of the loaded key on success.
  * The credential manager now enumerates local credential sets before global ones.
    This means certificates supplied by the peer will now be preferred over certificates
    with the same identity that may be locally stored (e.g. in the certificate cache).
  * Adds support for hardware offload of IPsec SAs as introduced by Linux 4.11 for
    specific hardware that supports this.
  * The pki tool loads the curve25519 plugin by default.
    [- 0006-Make-sure-the-modulus-is-odd-and-the-exponent-not-zero.patch,
  - 0007-asn1-parser-Fix-CHOICE-parsing.patch]
- libhydra is removed as all kernel plugins moved to libcharon</changelog>
  <changelog author="ndas@suse.de" date="1504612800">- fix "uintptr_t? undeclared" compilation error.
  [+0006-fix-compilation-error-by-adding-stdint.h.patch]</changelog>
  <changelog author="ndas@suse.de" date="1504612801">- Updated to strongSwan 5.6.0 providing the following changes:
  * Fixed a DoS vulnerability in the gmp plugin that was caused by insufficient input validation
    when verifying RSA signatures, which requires decryption with the operation m^e mod n,
    where m is the signature, and e and n are the exponent and modulus of the public key.
    The value m is an integer between 0 and n-1, however, the gmp plugin did not verify this.
    So if m equals n the calculation results in 0, in which case mpz_export() returns NULL.
    This result wasn't handled properly causing a null-pointer dereference.
    This vulnerability has been registered as CVE-2017-11185. (bsc#1051222)
  * New SWIMA IMC/IMV pair implements the draft-ietf-sacm-nea-swima-patnc Internet
    Draft and has been demonstrated at the IETF 99 Prague Hackathon.
  * The IMV database template has been adapted to achieve full compliance with the
    ISO 19770-2:2015 SWID tag standard.
  * The pt-tls-client can attach and use TPM 2.0 protected private keys via the --keyid parameter.
  * By default the /etc/swanctl/conf.d directory is created and *.conf files in it are included in the default
    swanctl.conf file.
  * The curl plugin now follows HTTP redirects (configurable via strongswan.conf).
  * The CHILD_SA rekeying was fixed in charon-tkm and the behavior is refined a bit more since 5.5.3
  * libtpmtss supports Intel's TSS2 Architecture Broker and Resource Manager interface (tcti-tabrmd).
  * more on https://wiki.strongswan.org/versions/66</changelog>
  <changelog author="mmnelemane@suse.com" date="1521028800">- Removed unused requires and macro calls(bsc#1083261)</changelog>
  <changelog author="mmnelemane@suse.com" date="1573646400">- Added patch to fix vulnerability: CVE-2018-16151,CVE-2018-16152 (bsc#1107874)
  - Insufficient input validation in gmp plugin
  [+ 0007-strongswan-5.3.1-5.6.0_gmp-pkcs1-verify.patch]</changelog>
  <changelog author="mmnelemane@suse.com" date="1573646401">- Added patch to fix vulnerability: CVE-2018-5388 (bsc#1094462)
  - Buffer Underflow in stroke_socket.c
  [+ 0008-strongswan-5.1.2-5.6.2_stroke_msg_len.patch]</changelog>
  <changelog author="mmnelemane@suse.com" date="1573646402">- Added patch to fix vulnerability: CVE-2018-10811 (bsc#1093536)
  - denial-of-service vulnerability
  [+ 0009-strongswan-5.5.0-5.6.2_skeyseed_init.patch]</changelog>
  <changelog author="mmnelemane@suse.com" date="1573732800">- Added patch to fix vulnerability: CVE-2018-17540 (bsc#1109845)
  [+ 0010-strongswan-4.4.0-5.7.0_gmp-pkcs1-overflow.patch]</changelog>
  <changelog author="mmnelemane@suse.com" date="1580212800">- Updated to version 5.8.2 (jsc#SLE-11370)
  - Dropped following patches due to irrelevance in the updated version:
    [- strongswan_modprobe_syslog.patch ]
    [- strongswan_fipsfilter.patch ]
    [- 0006-fix-compilation-error-by-adding-stdint.h.patch ]
    [- 0007-strongswan-5.3.1-5.6.0_gmp-pkcs1-verify.patch ]
    [- 0008-strongswan-5.1.2-5.6.2_stroke_msg_len.patch ]
    [- 0009-strongswan-5.5.0-5.6.2_skeyseed_init.patch ]
    [- 0010-strongswan-4.4.0-5.7.0_gmp-pkcs1-overflow.patch ]
  - Version 5.8.2
  ===============
  * Identity-based CA constraints, which enforce that the certificate chain of the remote
    peer contains a CA certificate with a specific identity, are supported via
    vici/swanctl.conf. This is similar to the existing CA constraints but doesn't require
    that the CA certificate is locally installed, for instance, intermediate CA certificates
    received from the peers. Wildcard identity matching (e.g. ..., OU=Research, CN=*) could
    also be used for the latter but requires trust in the intermediate CAs to only issue
    certificates with legitimate subject DNs (e.g. the "Sales" CA must not issue certificates
    with OU=Research). With the new constraint that's not necessary as long as a path length
    basic constraint (--pathlen for pki --issue) prevents intermediate CAs from issuing further
    intermediate CAs.
  * Intermediate CA certificates may now be sent in hash-and-URL encoding by configuring a
    base URL for the parent CA (#3234, swanctl/rw-hash-and-url-multi-level).
  * Implemented NIST SP-800-90A Deterministic Random Bit Generator (DRBG) based on AES-CTR
    and SHA2-HMAC modes. Currently used by the gmp and ntru plugins.
  * Random nonces sent in an OCSP requests are now expected in the corresponding OCSP responses.
  * The kernel-netlink plugin now ignores deprecated IPv6 addresses for MOBIKE. Whether temporary
    or permanent IPv6 addresses are included now depends on the charon.prefer_temporary_addrs
    setting (#3192).
  * Extended Sequence Numbers (ESN) are configured via PF_KEY if supported by the kernel.
  * The PF_KEY socket's receive buffer in the kernel-pfkey plugin is now cleared before sending
    requests, as many of the messages sent by the kernel are sent as broadcasts to all PF_KEY
    sockets. This is an issue if an external tool is used to manage SAs/policies unrelated to
    IPsec (#3225).
  * The vici plugin now uses unique section names for CHILD_SAs in child-updown events (7c74ce9190).
  * For individually deleted CHILD_SAs (in particular for IKEv1) the vici child-updown event
    now includes more information about the CHILD_SAs such as traffic statistics (#3198).
  * Custom loggers are correctly re-registered if log levels are changed via stroke loglevel (#3182).
  * Avoid lockups during startup on low entropy systems when using OpenSSL 1.1.1 (095a2c2eac).
  * Instead of failing later when setting a key, creating HMACs via openssl plugin now fails
    instantly if the underlying hash algorithm isn't supported (e.g. MD5 in FIPS-mode) so fallbacks
    to other plugins work properly (#3284).
  * Exponents of RSA keys read from TPM 2.0 via SAPI are correctly converted (8ee1242f1438).
  * Routing table IDs &gt; 255 are supported for custom routes on Linux.
  * To avoid races, the check for hardware offloading support in the kernel-netlink plugin is
    performed during initialization of the plugin (a605452c03).
  * The D-Bus config file for charon-nm is now installed in $(datadir)/dbus-1/system.d instead of
    $(sysconfdir)/dbus-1/system.d, which is intended for sysadmin overrides.
    INVALID_MAJOR_VERSION notifies are now correctly sent in messages of the same exchange type
    and with the same message ID as the request.
  * IKEv2 SAs are now immediately destroyed when sending or receiving INVALID_SYNTAX notifies
    in authenticated messages.
  * For developers working from the repository the configure script now aborts if GNU gperf is
    not found.
  - Version 5.8.1
  ===============
  * RDNs in DNs of X.509 certificates can now optionally be matched less strict. The global
    strongswan.conf option charon.rdn_matching takes two alternative values that cause the
    matching algorithm to either ignore the order of matched RDNs (reordered) or additionally
    (relaxed) accept DNs that contain more RDNs than configured (unmatched RDNs are treated
    like wildcard matches).
  * The updown plugin now passes the same interface to the script that is also used for the
    automatically installed routes, that is, the interface over which the peer is reached
    instead of the interface on which the local address is found (#3095).
  * TPM 2.0 contexts are now protected by a mutex to prevent issues if multiple IKE_SAs use
    the same private key concurrently (4b25885025).
  * Do a rekey check after the third QM message was received (#3060).
  * If available, explicit_bzero() is now used as memwipe() instead of our own implementation.
  * An .editorconfig file has been added, mainly so Github shows files with proper indentation
    (68346b6962).
  * The internal certificate of the load-tester plugin has been modified so it can again be
    used as end-entity cert with 5.6.3 and later (#3139).
  * The maximum data length of received COOKIE notifies (64 bytes) is now enforced (#3160).
  - Version 5.8.0
  ===============
  * The systemd service units have been renamed. The modern unit, which was called
    strongswan-swanctl, is now called strongswan (the previous name is configured as alias in
    the unit, for which a symlink is created when the unit is enabled). The legacy unit is now
    called strongswan-starter.
  * Support for XFRM interfaces (available since Linux 4.19) has been added, which are intended
    to replace VTI devices (they are similar but offer several advantages, for instance, they
    are not bound to an address or address family).
  * IPsec SAs and policies are associated with such interfaces via interface IDs that can be
    configured in swanctl.conf (dynamic IDs may optionally be allocated for each SA and even
    direction). It's possible to use separate interfaces for in- and outbound traffic (or
    only use an interface in one direction and regular policies in the other).
  * Interfaces may be created dynamically via updown/vici scripts, or statically before or after
    establishing the SAs. Routes must be added manually as needed (the daemon will not install
    any routes for outbound policies with an interface ID).
  * When moving XFRM interfaces to other network namespaces they retain access to the SAs and
    policies installed in the original namespace, which allows providing IPsec tunnels for
    processes in other network namespaces without giving them access to the IPsec keys or
    IKE credentials.
    More information can be found on the page about route-based VPNs.
  * Initiation of childless IKE_SAs is supported (RFC 6023). If enabled and supported by the
    responder, no CHILD_SA is established during IKE_AUTH. Instead, all CHILD_SAs are created
    with CREATE_CHILD_SA exchanges. This allows using a separate DH exchange even for the
    first CHILD_SA, which is otherwise created during IKE_AUTH with keys derived from the
    IKE_SA's key material.
  * The swanctl --initiate command may be used to initiate only the IKE_SA via --ike
    option if --child is omitted and the peer supports this extension.
  * The NetworkManager backend and plugin support IPv6.
  * The new wolfssl plugin is a wrapper around the wolfSSL crypto library. Thanks to Sean
    Parkinson of wolfSSL Inc. for the initial patch.
  * IKE SPIs may optionally be labeled via the charon.spi_mask|label options in
    strongswan.conf. This feature was extracted from charon-tkm, however, now applies the
    mask/label in network order.
  * The openssl plugin supports ChaCha20-Poly1305 when built with OpenSSL 1.1.0.
  * The PB-TNC finite state machine according to section 3.2 of RFC 5793 was not correctly
    implemented when sending either a CRETRY or SRETRY batch. These batches can only be sent
    in the "Decided" state and a CRETRY batch can immediately carry all messages usually
    transported by a CDATA batch. It is currently not possible to send a SRETRY batch since
    full-duplex mode for PT-TLS transport is not supported.
  * Instead of marking IPv6 virtual IPs as deprecated, the kernel-netlink plugin now uses
    address labels to avoid that such addresses are used for non-VPN traffic (00a953d090).
  * The agent plugin now creates sockets to the ssh/gpg-agent dynamically and does not keep
    them open, which otherwise might prevent the agent from getting terminated.
  * To avoid broadcast loops the forecast plugin now only reinjects packets that are marked
    or received from the configured interface.
  * UTF-8 encoded passwords are supported via EAP-MSCHAPv2, which internally uses an UTF-16LE
    encoding to calculate the NT hash (#3014).
  * Properly delete temporary drop policies (used when updating IP addresses of SAs) if manual
    priorities are used, which was broken since 5.6.2 (8e31d65730).
  * Avoid overwriting start_action when parsing the inactivity timeout in the vici plugin (#2954).
  * Fixed the automatic termination of reloaded vici connections with start_action=start,
    which was broken since 5.6.3 (71b22c250f).
  * The lookup for shared secrets for IKEv1 SAs via sql plugin should now work better
    (6ec9f68f32).
  * Fixed a race condition in the trap manager between installation and removal of a policy
    (69cbe2ca3f).
  * Compilation of the kernel-netlink plugin has been fixed on old kernels (&lt; 2.6.39), which
    was caused by the HW offload changes (c7f579fa17).
  * The IPsec stack detection and module loading in starter has been removed (it wasn't
    enforced anyway and loading modules doesn't seem necessary, also KLIPS hasn't been
    supported for a long time and PF_KEY will eventually be removed from the Linux kernel,
    ba817d2917).
  * Several IKEv2 protocol details are now handled more strictly: Unrequested virtual IPs are
    ignored, CFG_REPLY payloads are ignored if no CFG_REQUEST payloads were sent, a USE
    TRANSPORT_MODE notify received from the responder is checked against the local configuration.
  * The keys and certificates used by the scenarios in the testing environment are now generated
    dynamically. Running the testing/scripts/build-certs script after creating the base and root
    images uses the pki utility installed in the latter to create the keys and certificates for
    all the CAs and in some cases for individual scenarios. These credentials are stored in the
    source tree, not the image, so this has to be called only once even if the images are later
    rebuilt. The script automatically (re-)rebuilds the guest images as that generates fresh
    CRLs and signs the DNS zones. The only keys/certificates currently not generated are the
    very large ones used by the ikev2/rw-eap-tls-fragments scenario.
  - Version 5.7.2
  ===============
  * For RSA with PSS padding, the TPM 2.0 specification mandates the maximum salt length
    (as defined by the length of the key and hash). However, if the TPM is FIPS-168-4 compliant,
    the salt length equals the hash length. This is assumed for FIPS-140-2 compliant TPMs, but
    if that's not the case, it might be necessary to manually enable charon.plugins.tpm.fips_186_4
    if the TPM doesn't use the maximum salt length.
  * Directories for credentials loaded by swanctl are now accessed relative to the loaded
    swanctl.conf file, in particular, when loading it from a custom location via --file argument.
  * The base directory, which is used if no custom location for swanctl.conf is specified, is now
    also configurable at runtime via SWANCTL_DIR environment variable.
  * If RADIUS Accounting is enabled, the eap-radius plugin will add the session ID (Acct-Session-Id)
    to Access-Request messages, which e.g. simplifies associating database entries for IP leases and
    accounting with sessions (the session ID does not change when IKE_SAs are rekeyed, #2853).
  * All IP addresses assigned by a RADIUS server are included in Accounting-Stop messages even if
    the client did not claim them, allowing to release them early in case of connection errors (#2856).
  * Selectors installed on transport mode SAs by the kernel-netlink plugin are now updated if an
    IP address changes (e.g. via MOBIKE) and it was part of the selectors.
  * No deletes are sent anymore when a rekeyed CHILD_SA expires (#2815).
  * The bypass-lan plugin now tracks interfaces to handle subnets that move from one interface
    to another and properly update associated routes (#2820).
  * Only valid and expected inbound IKEv2 messages are used to update the timestamp of the
    last received message (previously, retransmits also triggered an update).
  * IKEv2 requests from responders are now ignored until the IKE_SA is fully established (e.g. if a
    DPD request from the peer arrives before the IKE_AUTH response does, 46bea1add9).
    Delayed IKE_SA_INIT responses with COOKIE notifies we already recevied are ignored, they caused
    another reset of the IKE_SA previously (#2837).
  * Active and queued Quick Mode tasks are now adopted if the peer reauthenticates an IKEv1 SA
    while creating lots of CHILD_SAs.
  * Newer versions of the FreeBSD kernel add an SADB_X_EXT_SA2 extension to SADB_ACQUIRE
    messages, which allows the kernel-pfkey plugin to determine the reqid of the policy even if it
    wasn't installed by the daemon previously (e.g. when using FreeBSD's if_ipsec(4) VTIs, which
    install policies themselves, 872b9b3e8d).
  * Added support for RSA signatures with SHA-256 and SHA-512 to the agent plugin. For older
    versions of ssh/gpg-agent that only support SHA-1, IKEv2 signature authentication has to be
    disabled via charon.signature_authentication.
  * The sshkey and agent plugins support Ed25519/Ed448 SSH keys and signatures.
  * The openssl plugin supports X25519/X448 Diffie-Hellman and Ed25519/Ed448 keys and
    signatures when built against OpenSSL 1.1.1.
  * Support for Ed25519, ChaCha20/Poly1305, SHA-3 and AES-CCM were added to the botan plugin.
  * The mysql plugin now properly handles database connections with transactions
    under heavy load (#2779).
  * IP addresses in ha pools are now distributed evenly among all segments (#2828).
  * Private key implementations may optionally provide a list of supported signature schemes,
    which, as described above, is used by the tpm plugin because for each key on a TPM 2.0 the
    hash algorithm and for RSA also the padding scheme is predefined.
  * The testing environment is now based on Debian 9 (stretch) by default. This required
    some changes, in particular, updating to FreeRADIUS 3.x (which forced us to abandon the
    TNC@FHH patches and scenarios, 2fbe44bef3) and removing FIPS-enabled versions of
    OpenSSL (the FIPS module only supports OpenSSL 1.0.2).
  * Most test scenarios were migrated to swanctl.
  - Version 5.7.1
  ===============
  * Fixes a vulnerability in the gmp plugin triggered by crafted certificates with RSA keys with
    very small moduli. When verifying signatures with such keys, the code patched with the fix
    for CVE-2018-16151/2 caused an integer underflow and subsequent heap buffer overflow
    that results in a crash of the daemon.
  * The vulnerability has been registered as CVE-2018-17540.
  - Version 5.7.0
  ===============
  * Fixes a potential authorization bypass vulnerability in the gmp plugin that was caused by a
    too lenient verification of PKCS#1 v1.5 signatures. Several flaws could be exploited by a
    Bleichenbacher-style attack to forge signatures for low-exponent keys (i.e. with e=3).
  * CVE-2018-16151 has been assigned to the problem of accepting random bytes after the OID
    of the hash function in such signatures, and CVE-2018-16152 has been assigned to the issue
    of not verifying that the parameters in the ASN.1 algorithmIdentitifer structure is empty.
    Other flaws that don't lead to a vulnerability directly (e.g. not checking for at least
    8 bytes of padding) have no separate CVE assigned.
  * Dots are not allowed anymore in section names in swanctl.conf and strongswan.conf.
    This mainly affects the configuration of file loggers. If the path for such a log file
    contains dots it now has to be configured in the new path setting within the arbitrarily
    renamed subsection in the filelog section.
  * Sections in swanctl.conf and strongswan.conf may now reference other sections. All settings
    and subsections from such a section are inherited. This allows to simplify configs as
    redundant information has only to be specified once and may then be included in other
    sections (see strongswan.conf for an example).
  * The originally selected IKE config (based on the IPs and IKE version) can now change
    if no matching algorithm proposal is found. This way the order of the configs doesn't
    matter that much anymore and it's easily possible to specify separate configs for
    clients that require weaker algorithms (instead of having to also add them in other
    configs that might be selected).
  * Support for Postquantum Preshared Keys for IKEv2 (draft-ietf-ipsecme-qr-ikev2) has been added.
    For an example refer to the swanctl/rw-cert-ppk scenario (or with EAP, or PSK authentication).
  * The new botan plugin is a wrapper around the Botan C++ crypto library.
    It requires a fairly recent build from Botan's master branch (or the upcoming 2.8.0 release).
    Thanks to René Korthaus and his team from Rohde &amp; Schwarz Cybersecurity for the initial
    patch and to Jack Lloyd for quickly adding missing functions to Botan's FFI (C89) interface.
  * Implementation of RFC 8412 "Software Inventory Message and Attributes (SWIMA) for PA-TNC".
  * SWIMA subscription option sets CLOSE_WRITE trigger on apt history.log file resulting in
    a ClientRetry PB-TNC batch to initialize a new measurement cycle. The new imv/imc-swima
    plugins replace the previous imv/imc-swid plugins, which were removed.
  * Added support for fuzzing the PA-TNC (RFC 5792) and PB-TNC (RFC 5793) NEA protocols
    on Google's OSS-Fuzz infrastructure.
  * Support for version 2 of Intel's TPM2-TSS TGC Software Stack. The presence of the
    in-kernel /dev/tpmrm0 resource manager is automatically detected.
  * The pki tool accepts a xmppAddr otherName as a subjectAlternativeName using the
    syntax --san xmppaddr:&lt;jid&gt;.
  * swanctl.conf supports the configuration of marks the in- and/or outbound SA should apply
    to packets after processing on Linux. Configuring such a mark for outbound SAs requires
    at least a 4.14 kernel. The ability to set a mask and configuring a mark/mask for
    inbound SAs will be added with the upcoming 4.19 kernel.
  * New options in swanctl.conf allow configuring how/whether DF, ECN and DS fields in the
    IP headers are copied during IPsec processing. Controlling this is currently only possible
    on Linux.
  * The handling of sequence numbers in IKEv1 DPDs has been improved (#2714).
  * To avoid conflicts, the dhcp plugin now only uses the DHCP server port if explicitly
    configured.
  - Version 5.6.3
  ===============
  * Fixed a DoS vulnerability in the IKEv2 key derivation if the openssl plugin is used in FIPS
    mode and HMAC-MD5 is negotiated as PRF.
    This vulnerability has been registered as CVE-2018-10811.
  * Fixed a vulnerability in the stroke plugin, which did not check the received length before
    reading a message from the socket. Unless a group is configured, root privileges are
    required to access that socket, so in the default configuration this shouldn't be an issue.
    This vulnerability has been registered as CVE-2018-5388.
  * CRLs that are not yet valid are now ignored to avoid problems in scenarios where expired
    certificates are removed from new CRLs and the clock on the host doing the revocation
    check is trailing behind that of the host issuing CRLs. Not doing this could result in
    accepting a revoked and expired certificate, if it's still valid according to the
    trailing clock but not contained anymore in not yet valid CRLs.
  * The issuer of fetched CRLs is now compared to the issuer of the checked certificate (#2608).
  * CRL validation results other than revocation (e.g. a skipped check because the CRL couldn't
    be fetched) are now stored also for intermediate CA certificates and not only for end-entity
    certificates, so a strict CRL policy can be enforced in such cases.
  * In compliance with RFC 4945, section 5.1.3.2, certificates used for IKE must now either
    not contain a keyUsage extension (like the ones generated by pki), or have at least one of the
    digitalSignature or nonRepudiation bits set.
  * New options for vici/swanctl allow forcing the local termination of an IKE_SA. This might be
    useful in situations where it's known the other end is not reachable anymore, or that it
    already removed the IKE_SA, so retransmitting a DELETE and waiting for a response would
    be pointless.
  * Waiting only a certain amount of time for a response (i.e. shorter than all retransmits
    would be) before destroying the IKE_SA is also possible by additionally specifying a
    timeout in the forced termination request.
  * When removing routes, the kernel-netlink plugin now checks if it tracks other routes for
    the same destination and replaces the installed route instead of just removing it. Same
    during installation, where existing routes previously weren't replaced. This should allow
    using traps with virtual IPs on Linux (#2162).
  * The dhcp plugin now only sends the client identifier DHCP option if the identity_lease
    setting is enabled (7b660944b6). It can also send identities of up to 255 bytes length,
    instead of the previous 64 bytes (30e886fe3b, 0e5b94d038). If a server address is
    configured, DHCP requests are now sent from port 67 instead of 68 to avoid ICMP port
    unreachables (becf027cd9).
  * The handling of faulty INVALID_KE_PAYLOAD notifies (e.g. one containing a DH group
    that wasn't proposed) during CREATE_CHILD_SA exchanges has been improved (#2536).
  * Roam events are now completely ignored for IKEv1 SAs (there is no MOBIKE to handle such
    changes properly).
  * ChaCha20/Poly1305 is now correctly proposed without key length (#2614). For compatibility with
    older releases the chacha20poly1305compat keyword may be included in proposals to also propose
    the algorithm with a key length (c58434aeff).
  * Configuration of hardware offload of IPsec SAs is now more flexible and allows a new
    setting (auto), which automatically uses it if the kernel and device both support it. If hw
    offload is set to yes and offloading is not supported, the CHILD_SA installation now fails.
  * The kernel-pfkey plugin optionally installs routes via internal interface (one with an IP
    in the local traffic selector). On FreeBSD, enabling this selects the correct source IP
    when sending packets from the gateway itself (e811659323).
  * SHA-2 based PRFs are supported in PKCS#8 files as generated by OpenSSL 1.1 (#2574).
  * The pki --verify tool may load CA certificates and CRLs from directories.
  * The IKE daemon now also switches to port 4500 if the remote port is not 500 (e.g. because the
    remote maps the response to a different port, as might happen on Azure), as long as the local
    port is 500 (85bfab621d).
  * Fixed an issue with DNS servers passed to NetworkManager in charon-nm (ee8c25516a).
  * Logged traffic selectors now always contain the protocol if either protocol or port are set
    (a36d8097ed).
  * Only the inbound SA/policy will be updated as reaction to IP address changes for rekeyed
    CHILD_SAs that are kept around.
  * The parser for strongswan.conf/swanctl.conf now accepts = characters in values without
    having to put the value in quotes (e.g. for Base64 encoded shared secrets).
    Notes for developers:
  * trap_manager_t: Trap policies are now unistalled by peer/child name and not the reqid.
  * No reqid is returned anymore when installing trap policies.
  * child_sa_t: A new state (CHILD_DELETED) is used for CHILD_SAs that have been deleted but
    not yet destroyed (after a rekeying CHILD_SAs are kept around for a while to process
    delayed packets).
    This way child_updown events are not triggered anymore for such SAs when an IKE_SA that
    has such CHILD_SAs assigned is deleted.
  - Version 5.6.2
  ===============
  * Fixed a DoS vulnerability in the parser for PKCS#1 RSASSA-PSS signatures that was caused
    by insufficient input validation. One of the configurable parameters in algorithm identifier
    structures for RSASSA-PSS signatures is the mask generation function (MGF). Only MGF1 is
    currently specified for this purpose. However, this in turn takes itself a parameter that
    specifies the underlying hash function. strongSwan's parser did not correctly handle the
    case of this parameter being absent, causing an undefined data read.
    This vulnerability has been registered as CVE-2018-6459.
  * When rekeying IKEv2 IKE_SAs the previously negotiated DH group will be reused, instead of
    using the first configured group, which avoids an additional exchange if the peer previously
    selected a different DH group via INVALID_KE_PAYLOAD notify. The same is also done when
    rekeying CHILD_SAs except for the first rekeying of the CHILD_SA that was created with the
    IKE_SA, where no DH group was negotiated yet.
    Also, the selected DH group is moved to the front in all sent proposals that contain it
    and all proposals that don't are moved to the back in order to convey the preference for
    this group to the peer.
  * Handling of MOBIKE task queuing has been improved. In particular, the response to an
    address update (with NAT-D payloads) is not ignored anymore if only an address list update
    or DPD is queued as that could prevent updating the UDP encapsulation in the kernel.
  * On Linux, roam events may optionally be triggered by changes to the routing rules, which
    can be useful if routing rules (instead of e.g. route metrics) are used to switch from one
    to another interface (i.e. from one to another routing table). Since routing rules are
    currently not evaluated when doing route lookups this is only useful if the kernel-based
    route lookup is used (4664992f7d).
  * The fallback drop policies installed to avoid traffic leaks when replacing addresses in
    installed policies are now replaced by temporary drop policies, which also prevent
    acquires because we currently delete and reinstall IPsec SAs to update their addresses
    (35ef1b032d).
  * Access X.509 certificates held in non-volatile storage of a TPM 2.0 referenced via the
    NV index.
    Adding the --keyid parameter to pki --print allows to print private keys or certificates
    stored in a smartcard or a TPM 2.0.
  * Fixed proposal selection if a peer incorrectly sends DH groups in the ESP proposal during
    IKE_AUTH and also if a DH group is configured in the local ESP proposal and charon.prefer
    configured_proposals is disabled (d058fd3c32).
  * The lookup for PSK secrets for IKEv1 has been improved for certain scenarios (see #2497
    for details).
  * MSKs received via RADIUS are now padded to 64 bytes to avoid compatibility issues with
    EAP-MSCHAPv2 and PRFs that have a block size &lt; 64 bytes (e.g. AES-XCBC-PRF-128, see
    73cbce6013).
  * The tpm_extendpcr command line tool extends a digest into a TPM PCR.
  * Ported the NetworkManager backend from the deprecated libnm-glib to libnm.
  * The save-keys debugging/development plugin saves IKE and/or ESP keys to files compatible
    with Wireshark.
  - Version 5.6.1
  ===============
  * Several algorithms were removed from the default ESP/AH and IKE proposals in compliance with
    RFC 8221 and RFC 8247, respectively. Removed from the default ESP/AH proposal were the
    3DES and Blowfish encryption algorithms and the HMAC-MD5 integrity algorithm. From the IKE
    default proposal the HMAC-MD5 integrity algorithm and the MODP-1024 Diffie-Hellman group
    were removed (the latter is significant for Windows clients in their default configuration).
    These algorithms may still be used in custom proposals.
  * Support for RSASSA-PSS signatures has been added. For compatibility with previous
    releases they are currently not used automatically, by default, to change that charon.rsa_pss
    may be enabled. To explicitly use or require such signatures during IKEv2 signature
    authentication (RFC 7427) ike:rsa/pss... authentication constraints may be used for specific
    connections (regardless of whether the strongswan.conf option above is enabled). Only the
    hash algorithm can be specified in such constraints, the MGF1 will be based on that hash
    and the salt length will equal the hash length (when verifying the salt length is not
    enforced).
    To enforce such signatures during PKI verification use rsa/pss... authentication constraints.
  * All pki commands that create certificates/CRLs can be made to sign with RSASSA-PSS instead
    of the classing PKCS#1 scheme with the --rsa-padding pss option. As with signatures during
    authentication, only the hash algorithm is configurable (via --digest option), the MGF1 will
    be based on that and the salt length will equal the hash length.
  * These signatures are supported by all RSA backends except pkcs11 (i.e. gmp, gcrypt, openssl).
    The gmp plugin requires the mgf1 plugin.
    Note that RSASSA-PSS algorithm identifiers and parameters in keys (public keys in
    certificates or private keys in PKCS#8 files) are currently not used as constraints.
  * The sec-updater tool checks for security updates in dpkg-based repositories
    (e.g. Debian/Ubuntu) and sets the security flags in the IMV policy database accordingly.
    Additionally for each new package version a SWID tag for the given OS and HW architecture
    is created and stored in the database.
  * Using the sec-updater.sh script template the lookup can be automated (e.g. via an hourly
    cron job).
  * When restarting an IKEv2 negotiation after receiving an INVALID_KE_PAYLOAD notify (or due
    to other reasons like too many retransmits) a new initiator SPI is allocated. This
    prevents issues caused by retransmits for IKE_SA_INIT messages.
  * Because the initiator SPI was previously reused when restarting the connection delayed
    responses for previous connection attempts were processed and might have caused fatal
    errors due to a failed DH negotiation or because of the internal retry counter in the
    ike-init task. For instance, if we proposed a DH group the responder rejected we
    might have later received delayed responses that either contained INVALID_KE_PAYLOAD
    notifies with the DH group we already switched to, or, if we retransmitted an
    IKE_SA_INIT with the requested group but then had to restart again, a KE payload with
    a group different from the one we proposed.
  * The introduction of file versions in the IMV database scheme broke file reference hash
    measurements. This has been fixed by creating generic product versions having an empty
    package name.
  * A new timeout option for the systime-fix plugin stops periodic system time checks after
    a while and enforces a certificate verification, closing or reauthenticating all SAs
    with invalid certificates.
  * The IKE event counters, previously only available via ipsec listcounters command, may
    now also be queried and reset via vici and the new swanctl --counters command. They
    are collected and provided by the optional counters plugin (enabled by default for
    backwards compatibility if the stroke plugin is built).
  * Class attributes received in RADIUS Access-Accept messages may optionally be added to
    RADIUS accounting messages (655924074b).
  * Basic support for systemd sockets has been added, which may be used for privilege separation
    (59db98fb94).
  * Inbound marks may optionally be installed in the SA again (was removed with 5.5.2) by
    enabling the mark_in_sa option in swanctl.conf.
  * The timeout of leases in pools configured via pool utility may be configured in other
    units than hours.
    INITIAL_CONTACT notifies are now only omitted if never is configured as uniqueness policy.
  * Outbound FWD policies for shunts are not installed anymore, by default (as is the case
    for other policies since 5.5.1).
  * Don't consider a DH group mismatch during CHILD_SA rekeying as failure as responder
    (e7276f78aa).
  * Handling of fragmented IPv4 and IPv6 packets in libipsec has been improved (e138003de9).
  * Trigger expire events for the correct IPsec SA in libipsec (6e861947a0).
  * A crash in CRL verification via openssl plugin using OpenSSL 1.1 has been fixed (78acaba6a1).
  * No hard-coded default proposals are passed from starter to the stroke plugin anymore (the
    IKE proposal used curve25519 since 5.5.2, which is an optional plugin).
  * A workaround for an issue with virtual IPs on macOS 10.13 (High Sierra) has been added
    (039b85dd43).
  * Handling of IKE_SA rekey collisions in charon-tkm has been fixed.
  * Instead of failing or just silently doing nothing unit tests may now warn about certain
    conditions (e.g. if a test was not executed due to external dependencies).</changelog>
  <changelog author="mmnelemane@suse.com" date="1585224000">- Fix for to resolve multiple definition of swanctl_dir (bsc #1164493)
  [+ 0006-Resolve-multiple-definition-of-swanctl_dir.patch]</changelog>
  <changelog author="mbuil@suse.com" date="1610712000">- Fix typo in README (bsc #1167880)
  [+ 0007-Fix-typo-in-README.patch ]</changelog>
  <changelog author="mbuil@suse.com" date="1611576000">- Fix FIPS bug (bsc #1180801)
  [+ 0008-gcrypt-Use-a-dummy-buffer-to-initialize-static-alloc.patch ]</changelog>
  <changelog author="mbuil@suse.com" date="1617019200">- Keep using ipsec as the main binary. Therefore, make strongswan.service point to it instead of swanctl</changelog>
  <changelog author="mbuil@suse.com" date="1617019201">- Information added in README about the rcstrongswan-starter</changelog>
  <changelog author="mbuil@suse.com" date="1617624000">- Add config to run ipsec on namespaces (bsc #1183670)</changelog>
  <changelog author="mt@suse.com" date="1619006400">- Add support for AES CCM aead algorithms to openssl plugin (cc/fips,bsc#1185363)
  [+ 0009-strongswan-openssl-aead-add-ccm-support.patch]</changelog>
  <changelog author="mt@suse.com" date="1620388800">- Replace AEAD AES CCM patch with upstream variant (cc/fips,bsc#1185363)
  [* 0009-strongswan-openssl-aead-add-ccm-support.patch]</changelog>
  <changelog author="hare@suse.de" date="1627646400">- Add auth_els plugin to support Marvell FC-SP encryption (jsc#SLE-20151)
  [* strongswan-marvell-auth-els.patch]</changelog>
  <changelog author="abergmann@suse.com" date="1634040000">- Fix integer overflow in gmp plugin (bsc#1191367, CVE-2021-41990)
  [* strongswan-5.6.1-5.9.3_gmp-rsa-ssa-salt-len.patch]
- Fix integer overflow when replacing certificates in cache (bsc#1191435, CVE-2021-41991)
  [* strongswan-4.4.1-5.9.3_cert-cache-random.patch]</changelog>
  <changelog author="meissner@suse.com" date="1643025600">- strongswan-5.5.0-5.9.4_eap_success-CVE-2021-45079.patch:
  Fixed authentication bypass in EAP authentication (CVE-2021-45079
  bsc#1194471)</changelog>
</package>
<package pkgid="310c682da3ec1395addd063a5ed41a9a781e7180113871e0b7b97d61994b1808" name="strongswan-sqlite" arch="x86_64">
  <version epoch="0" ver="5.8.2" rel="11.24.1"/>
  <changelog author="ndas@suse.de" date="1501502400">- Updated to strongSwan 5.3.5(bsc#1050691) providing the following changes:
  * Fixed a DoS vulnerability in the gmp plugin that was caused by insufficient input
    validation when verifying RSA signatures. More specifically, mpz_powm_sec() has two
    requirements regarding the passed exponent and modulus that the plugin did not
    enforce, if these are not met the calculation will result in a floating point exception
    that crashes the whole process.
    This vulnerability has been registered as CVE-2017-9022.
    Please refer to our blog for details.
  * Fixed a DoS vulnerability in the x509 plugin that was caused because the ASN.1 parser
    didn't handle ASN.1 CHOICE types properly, which could result in an infinite loop when
    parsing X.509 extensions that use such types.
    This vulnerability has been registered as CVE-2017-9023.
    Please refer to our blog for details.
  * The behavior during IKEv2 CHILD_SA rekeying has been changed in order to avoid
    traffic loss. When responding to a CREATE_CHILD_SA request to rekey a CHILD_SA
    the responder already has everything available to install and use the new CHILD_SA.
    However, this could lead to lost traffic as the initiator won't be able to process
    inbound packets until it processed the CREATE_CHILD_SA response and updated the
    inbound SA. To avoid this the responder now only installs the new inbound SA and
    delays installing the outbound SA until it receives the DELETE for the replaced CHILD_SA.
  * The messages transporting these DELETEs could reach the peer before packets sent
    with the deleted outbound SAs reach it. To reduce the chance of traffic loss due
    to this the inbound SA of the replaced CHILD_SA is not removed for a configurable
    amount of seconds (charon.delete_rekeyed_delay) after the DELETE has been processed.
  * The code base has been ported to Apple's ARM64 iOS platform, which required several
    changes regarding the use of variadic functions. This was necessary because the calling
    conventions for variadic and regular functions are different there.
    This means that assigning a non-variadic function to a variadic function pointer, as we
    did with our enumerator_t::enumerate() implementations and several callbacks, will
    result in crashes as the called function accesses the arguments differently than the
    caller provided them. To avoid this issue the enumerator_t interface has been changed
    and the signature of the callback functions for enumerator_create_filter() and two
    methods on linked_list_t have been changed. Refer to the developer notes below
    for details.
  * Adds support for fuzzing the certificate parser provided by the default plugins
    (x509, pem, gmp etc.) on Google's OSS-Fuzz infrastructure (or generally with
    libFuzzer). Several issues found while fuzzing these plugins were fixed.
  * Two new options have been added to charon's retransmission settings:
    retransmit_limit and retransmit_jitter. The former adds an upper limit to the
    calculated retransmission timeout, the latter randomly reduces it.
    Refer to Retransmission for details.
  * A bug in swanctl's --load-creds command was fixed that caused unencrypted
    private keys to get unloaded if the command was called multiple times.
    The load-key VICI command now returns the key ID of the loaded key on success.
  * The credential manager now enumerates local credential sets before global ones.
    This means certificates supplied by the peer will now be preferred over certificates
    with the same identity that may be locally stored (e.g. in the certificate cache).
  * Adds support for hardware offload of IPsec SAs as introduced by Linux 4.11 for
    specific hardware that supports this.
  * The pki tool loads the curve25519 plugin by default.
    [- 0006-Make-sure-the-modulus-is-odd-and-the-exponent-not-zero.patch,
  - 0007-asn1-parser-Fix-CHOICE-parsing.patch]
- libhydra is removed as all kernel plugins moved to libcharon</changelog>
  <changelog author="ndas@suse.de" date="1504612800">- fix "uintptr_t? undeclared" compilation error.
  [+0006-fix-compilation-error-by-adding-stdint.h.patch]</changelog>
  <changelog author="ndas@suse.de" date="1504612801">- Updated to strongSwan 5.6.0 providing the following changes:
  * Fixed a DoS vulnerability in the gmp plugin that was caused by insufficient input validation
    when verifying RSA signatures, which requires decryption with the operation m^e mod n,
    where m is the signature, and e and n are the exponent and modulus of the public key.
    The value m is an integer between 0 and n-1, however, the gmp plugin did not verify this.
    So if m equals n the calculation results in 0, in which case mpz_export() returns NULL.
    This result wasn't handled properly causing a null-pointer dereference.
    This vulnerability has been registered as CVE-2017-11185. (bsc#1051222)
  * New SWIMA IMC/IMV pair implements the draft-ietf-sacm-nea-swima-patnc Internet
    Draft and has been demonstrated at the IETF 99 Prague Hackathon.
  * The IMV database template has been adapted to achieve full compliance with the
    ISO 19770-2:2015 SWID tag standard.
  * The pt-tls-client can attach and use TPM 2.0 protected private keys via the --keyid parameter.
  * By default the /etc/swanctl/conf.d directory is created and *.conf files in it are included in the default
    swanctl.conf file.
  * The curl plugin now follows HTTP redirects (configurable via strongswan.conf).
  * The CHILD_SA rekeying was fixed in charon-tkm and the behavior is refined a bit more since 5.5.3
  * libtpmtss supports Intel's TSS2 Architecture Broker and Resource Manager interface (tcti-tabrmd).
  * more on https://wiki.strongswan.org/versions/66</changelog>
  <changelog author="mmnelemane@suse.com" date="1521028800">- Removed unused requires and macro calls(bsc#1083261)</changelog>
  <changelog author="mmnelemane@suse.com" date="1573646400">- Added patch to fix vulnerability: CVE-2018-16151,CVE-2018-16152 (bsc#1107874)
  - Insufficient input validation in gmp plugin
  [+ 0007-strongswan-5.3.1-5.6.0_gmp-pkcs1-verify.patch]</changelog>
  <changelog author="mmnelemane@suse.com" date="1573646401">- Added patch to fix vulnerability: CVE-2018-5388 (bsc#1094462)
  - Buffer Underflow in stroke_socket.c
  [+ 0008-strongswan-5.1.2-5.6.2_stroke_msg_len.patch]</changelog>
  <changelog author="mmnelemane@suse.com" date="1573646402">- Added patch to fix vulnerability: CVE-2018-10811 (bsc#1093536)
  - denial-of-service vulnerability
  [+ 0009-strongswan-5.5.0-5.6.2_skeyseed_init.patch]</changelog>
  <changelog author="mmnelemane@suse.com" date="1573732800">- Added patch to fix vulnerability: CVE-2018-17540 (bsc#1109845)
  [+ 0010-strongswan-4.4.0-5.7.0_gmp-pkcs1-overflow.patch]</changelog>
  <changelog author="mmnelemane@suse.com" date="1580212800">- Updated to version 5.8.2 (jsc#SLE-11370)
  - Dropped following patches due to irrelevance in the updated version:
    [- strongswan_modprobe_syslog.patch ]
    [- strongswan_fipsfilter.patch ]
    [- 0006-fix-compilation-error-by-adding-stdint.h.patch ]
    [- 0007-strongswan-5.3.1-5.6.0_gmp-pkcs1-verify.patch ]
    [- 0008-strongswan-5.1.2-5.6.2_stroke_msg_len.patch ]
    [- 0009-strongswan-5.5.0-5.6.2_skeyseed_init.patch ]
    [- 0010-strongswan-4.4.0-5.7.0_gmp-pkcs1-overflow.patch ]
  - Version 5.8.2
  ===============
  * Identity-based CA constraints, which enforce that the certificate chain of the remote
    peer contains a CA certificate with a specific identity, are supported via
    vici/swanctl.conf. This is similar to the existing CA constraints but doesn't require
    that the CA certificate is locally installed, for instance, intermediate CA certificates
    received from the peers. Wildcard identity matching (e.g. ..., OU=Research, CN=*) could
    also be used for the latter but requires trust in the intermediate CAs to only issue
    certificates with legitimate subject DNs (e.g. the "Sales" CA must not issue certificates
    with OU=Research). With the new constraint that's not necessary as long as a path length
    basic constraint (--pathlen for pki --issue) prevents intermediate CAs from issuing further
    intermediate CAs.
  * Intermediate CA certificates may now be sent in hash-and-URL encoding by configuring a
    base URL for the parent CA (#3234, swanctl/rw-hash-and-url-multi-level).
  * Implemented NIST SP-800-90A Deterministic Random Bit Generator (DRBG) based on AES-CTR
    and SHA2-HMAC modes. Currently used by the gmp and ntru plugins.
  * Random nonces sent in an OCSP requests are now expected in the corresponding OCSP responses.
  * The kernel-netlink plugin now ignores deprecated IPv6 addresses for MOBIKE. Whether temporary
    or permanent IPv6 addresses are included now depends on the charon.prefer_temporary_addrs
    setting (#3192).
  * Extended Sequence Numbers (ESN) are configured via PF_KEY if supported by the kernel.
  * The PF_KEY socket's receive buffer in the kernel-pfkey plugin is now cleared before sending
    requests, as many of the messages sent by the kernel are sent as broadcasts to all PF_KEY
    sockets. This is an issue if an external tool is used to manage SAs/policies unrelated to
    IPsec (#3225).
  * The vici plugin now uses unique section names for CHILD_SAs in child-updown events (7c74ce9190).
  * For individually deleted CHILD_SAs (in particular for IKEv1) the vici child-updown event
    now includes more information about the CHILD_SAs such as traffic statistics (#3198).
  * Custom loggers are correctly re-registered if log levels are changed via stroke loglevel (#3182).
  * Avoid lockups during startup on low entropy systems when using OpenSSL 1.1.1 (095a2c2eac).
  * Instead of failing later when setting a key, creating HMACs via openssl plugin now fails
    instantly if the underlying hash algorithm isn't supported (e.g. MD5 in FIPS-mode) so fallbacks
    to other plugins work properly (#3284).
  * Exponents of RSA keys read from TPM 2.0 via SAPI are correctly converted (8ee1242f1438).
  * Routing table IDs &gt; 255 are supported for custom routes on Linux.
  * To avoid races, the check for hardware offloading support in the kernel-netlink plugin is
    performed during initialization of the plugin (a605452c03).
  * The D-Bus config file for charon-nm is now installed in $(datadir)/dbus-1/system.d instead of
    $(sysconfdir)/dbus-1/system.d, which is intended for sysadmin overrides.
    INVALID_MAJOR_VERSION notifies are now correctly sent in messages of the same exchange type
    and with the same message ID as the request.
  * IKEv2 SAs are now immediately destroyed when sending or receiving INVALID_SYNTAX notifies
    in authenticated messages.
  * For developers working from the repository the configure script now aborts if GNU gperf is
    not found.
  - Version 5.8.1
  ===============
  * RDNs in DNs of X.509 certificates can now optionally be matched less strict. The global
    strongswan.conf option charon.rdn_matching takes two alternative values that cause the
    matching algorithm to either ignore the order of matched RDNs (reordered) or additionally
    (relaxed) accept DNs that contain more RDNs than configured (unmatched RDNs are treated
    like wildcard matches).
  * The updown plugin now passes the same interface to the script that is also used for the
    automatically installed routes, that is, the interface over which the peer is reached
    instead of the interface on which the local address is found (#3095).
  * TPM 2.0 contexts are now protected by a mutex to prevent issues if multiple IKE_SAs use
    the same private key concurrently (4b25885025).
  * Do a rekey check after the third QM message was received (#3060).
  * If available, explicit_bzero() is now used as memwipe() instead of our own implementation.
  * An .editorconfig file has been added, mainly so Github shows files with proper indentation
    (68346b6962).
  * The internal certificate of the load-tester plugin has been modified so it can again be
    used as end-entity cert with 5.6.3 and later (#3139).
  * The maximum data length of received COOKIE notifies (64 bytes) is now enforced (#3160).
  - Version 5.8.0
  ===============
  * The systemd service units have been renamed. The modern unit, which was called
    strongswan-swanctl, is now called strongswan (the previous name is configured as alias in
    the unit, for which a symlink is created when the unit is enabled). The legacy unit is now
    called strongswan-starter.
  * Support for XFRM interfaces (available since Linux 4.19) has been added, which are intended
    to replace VTI devices (they are similar but offer several advantages, for instance, they
    are not bound to an address or address family).
  * IPsec SAs and policies are associated with such interfaces via interface IDs that can be
    configured in swanctl.conf (dynamic IDs may optionally be allocated for each SA and even
    direction). It's possible to use separate interfaces for in- and outbound traffic (or
    only use an interface in one direction and regular policies in the other).
  * Interfaces may be created dynamically via updown/vici scripts, or statically before or after
    establishing the SAs. Routes must be added manually as needed (the daemon will not install
    any routes for outbound policies with an interface ID).
  * When moving XFRM interfaces to other network namespaces they retain access to the SAs and
    policies installed in the original namespace, which allows providing IPsec tunnels for
    processes in other network namespaces without giving them access to the IPsec keys or
    IKE credentials.
    More information can be found on the page about route-based VPNs.
  * Initiation of childless IKE_SAs is supported (RFC 6023). If enabled and supported by the
    responder, no CHILD_SA is established during IKE_AUTH. Instead, all CHILD_SAs are created
    with CREATE_CHILD_SA exchanges. This allows using a separate DH exchange even for the
    first CHILD_SA, which is otherwise created during IKE_AUTH with keys derived from the
    IKE_SA's key material.
  * The swanctl --initiate command may be used to initiate only the IKE_SA via --ike
    option if --child is omitted and the peer supports this extension.
  * The NetworkManager backend and plugin support IPv6.
  * The new wolfssl plugin is a wrapper around the wolfSSL crypto library. Thanks to Sean
    Parkinson of wolfSSL Inc. for the initial patch.
  * IKE SPIs may optionally be labeled via the charon.spi_mask|label options in
    strongswan.conf. This feature was extracted from charon-tkm, however, now applies the
    mask/label in network order.
  * The openssl plugin supports ChaCha20-Poly1305 when built with OpenSSL 1.1.0.
  * The PB-TNC finite state machine according to section 3.2 of RFC 5793 was not correctly
    implemented when sending either a CRETRY or SRETRY batch. These batches can only be sent
    in the "Decided" state and a CRETRY batch can immediately carry all messages usually
    transported by a CDATA batch. It is currently not possible to send a SRETRY batch since
    full-duplex mode for PT-TLS transport is not supported.
  * Instead of marking IPv6 virtual IPs as deprecated, the kernel-netlink plugin now uses
    address labels to avoid that such addresses are used for non-VPN traffic (00a953d090).
  * The agent plugin now creates sockets to the ssh/gpg-agent dynamically and does not keep
    them open, which otherwise might prevent the agent from getting terminated.
  * To avoid broadcast loops the forecast plugin now only reinjects packets that are marked
    or received from the configured interface.
  * UTF-8 encoded passwords are supported via EAP-MSCHAPv2, which internally uses an UTF-16LE
    encoding to calculate the NT hash (#3014).
  * Properly delete temporary drop policies (used when updating IP addresses of SAs) if manual
    priorities are used, which was broken since 5.6.2 (8e31d65730).
  * Avoid overwriting start_action when parsing the inactivity timeout in the vici plugin (#2954).
  * Fixed the automatic termination of reloaded vici connections with start_action=start,
    which was broken since 5.6.3 (71b22c250f).
  * The lookup for shared secrets for IKEv1 SAs via sql plugin should now work better
    (6ec9f68f32).
  * Fixed a race condition in the trap manager between installation and removal of a policy
    (69cbe2ca3f).
  * Compilation of the kernel-netlink plugin has been fixed on old kernels (&lt; 2.6.39), which
    was caused by the HW offload changes (c7f579fa17).
  * The IPsec stack detection and module loading in starter has been removed (it wasn't
    enforced anyway and loading modules doesn't seem necessary, also KLIPS hasn't been
    supported for a long time and PF_KEY will eventually be removed from the Linux kernel,
    ba817d2917).
  * Several IKEv2 protocol details are now handled more strictly: Unrequested virtual IPs are
    ignored, CFG_REPLY payloads are ignored if no CFG_REQUEST payloads were sent, a USE
    TRANSPORT_MODE notify received from the responder is checked against the local configuration.
  * The keys and certificates used by the scenarios in the testing environment are now generated
    dynamically. Running the testing/scripts/build-certs script after creating the base and root
    images uses the pki utility installed in the latter to create the keys and certificates for
    all the CAs and in some cases for individual scenarios. These credentials are stored in the
    source tree, not the image, so this has to be called only once even if the images are later
    rebuilt. The script automatically (re-)rebuilds the guest images as that generates fresh
    CRLs and signs the DNS zones. The only keys/certificates currently not generated are the
    very large ones used by the ikev2/rw-eap-tls-fragments scenario.
  - Version 5.7.2
  ===============
  * For RSA with PSS padding, the TPM 2.0 specification mandates the maximum salt length
    (as defined by the length of the key and hash). However, if the TPM is FIPS-168-4 compliant,
    the salt length equals the hash length. This is assumed for FIPS-140-2 compliant TPMs, but
    if that's not the case, it might be necessary to manually enable charon.plugins.tpm.fips_186_4
    if the TPM doesn't use the maximum salt length.
  * Directories for credentials loaded by swanctl are now accessed relative to the loaded
    swanctl.conf file, in particular, when loading it from a custom location via --file argument.
  * The base directory, which is used if no custom location for swanctl.conf is specified, is now
    also configurable at runtime via SWANCTL_DIR environment variable.
  * If RADIUS Accounting is enabled, the eap-radius plugin will add the session ID (Acct-Session-Id)
    to Access-Request messages, which e.g. simplifies associating database entries for IP leases and
    accounting with sessions (the session ID does not change when IKE_SAs are rekeyed, #2853).
  * All IP addresses assigned by a RADIUS server are included in Accounting-Stop messages even if
    the client did not claim them, allowing to release them early in case of connection errors (#2856).
  * Selectors installed on transport mode SAs by the kernel-netlink plugin are now updated if an
    IP address changes (e.g. via MOBIKE) and it was part of the selectors.
  * No deletes are sent anymore when a rekeyed CHILD_SA expires (#2815).
  * The bypass-lan plugin now tracks interfaces to handle subnets that move from one interface
    to another and properly update associated routes (#2820).
  * Only valid and expected inbound IKEv2 messages are used to update the timestamp of the
    last received message (previously, retransmits also triggered an update).
  * IKEv2 requests from responders are now ignored until the IKE_SA is fully established (e.g. if a
    DPD request from the peer arrives before the IKE_AUTH response does, 46bea1add9).
    Delayed IKE_SA_INIT responses with COOKIE notifies we already recevied are ignored, they caused
    another reset of the IKE_SA previously (#2837).
  * Active and queued Quick Mode tasks are now adopted if the peer reauthenticates an IKEv1 SA
    while creating lots of CHILD_SAs.
  * Newer versions of the FreeBSD kernel add an SADB_X_EXT_SA2 extension to SADB_ACQUIRE
    messages, which allows the kernel-pfkey plugin to determine the reqid of the policy even if it
    wasn't installed by the daemon previously (e.g. when using FreeBSD's if_ipsec(4) VTIs, which
    install policies themselves, 872b9b3e8d).
  * Added support for RSA signatures with SHA-256 and SHA-512 to the agent plugin. For older
    versions of ssh/gpg-agent that only support SHA-1, IKEv2 signature authentication has to be
    disabled via charon.signature_authentication.
  * The sshkey and agent plugins support Ed25519/Ed448 SSH keys and signatures.
  * The openssl plugin supports X25519/X448 Diffie-Hellman and Ed25519/Ed448 keys and
    signatures when built against OpenSSL 1.1.1.
  * Support for Ed25519, ChaCha20/Poly1305, SHA-3 and AES-CCM were added to the botan plugin.
  * The mysql plugin now properly handles database connections with transactions
    under heavy load (#2779).
  * IP addresses in ha pools are now distributed evenly among all segments (#2828).
  * Private key implementations may optionally provide a list of supported signature schemes,
    which, as described above, is used by the tpm plugin because for each key on a TPM 2.0 the
    hash algorithm and for RSA also the padding scheme is predefined.
  * The testing environment is now based on Debian 9 (stretch) by default. This required
    some changes, in particular, updating to FreeRADIUS 3.x (which forced us to abandon the
    TNC@FHH patches and scenarios, 2fbe44bef3) and removing FIPS-enabled versions of
    OpenSSL (the FIPS module only supports OpenSSL 1.0.2).
  * Most test scenarios were migrated to swanctl.
  - Version 5.7.1
  ===============
  * Fixes a vulnerability in the gmp plugin triggered by crafted certificates with RSA keys with
    very small moduli. When verifying signatures with such keys, the code patched with the fix
    for CVE-2018-16151/2 caused an integer underflow and subsequent heap buffer overflow
    that results in a crash of the daemon.
  * The vulnerability has been registered as CVE-2018-17540.
  - Version 5.7.0
  ===============
  * Fixes a potential authorization bypass vulnerability in the gmp plugin that was caused by a
    too lenient verification of PKCS#1 v1.5 signatures. Several flaws could be exploited by a
    Bleichenbacher-style attack to forge signatures for low-exponent keys (i.e. with e=3).
  * CVE-2018-16151 has been assigned to the problem of accepting random bytes after the OID
    of the hash function in such signatures, and CVE-2018-16152 has been assigned to the issue
    of not verifying that the parameters in the ASN.1 algorithmIdentitifer structure is empty.
    Other flaws that don't lead to a vulnerability directly (e.g. not checking for at least
    8 bytes of padding) have no separate CVE assigned.
  * Dots are not allowed anymore in section names in swanctl.conf and strongswan.conf.
    This mainly affects the configuration of file loggers. If the path for such a log file
    contains dots it now has to be configured in the new path setting within the arbitrarily
    renamed subsection in the filelog section.
  * Sections in swanctl.conf and strongswan.conf may now reference other sections. All settings
    and subsections from such a section are inherited. This allows to simplify configs as
    redundant information has only to be specified once and may then be included in other
    sections (see strongswan.conf for an example).
  * The originally selected IKE config (based on the IPs and IKE version) can now change
    if no matching algorithm proposal is found. This way the order of the configs doesn't
    matter that much anymore and it's easily possible to specify separate configs for
    clients that require weaker algorithms (instead of having to also add them in other
    configs that might be selected).
  * Support for Postquantum Preshared Keys for IKEv2 (draft-ietf-ipsecme-qr-ikev2) has been added.
    For an example refer to the swanctl/rw-cert-ppk scenario (or with EAP, or PSK authentication).
  * The new botan plugin is a wrapper around the Botan C++ crypto library.
    It requires a fairly recent build from Botan's master branch (or the upcoming 2.8.0 release).
    Thanks to René Korthaus and his team from Rohde &amp; Schwarz Cybersecurity for the initial
    patch and to Jack Lloyd for quickly adding missing functions to Botan's FFI (C89) interface.
  * Implementation of RFC 8412 "Software Inventory Message and Attributes (SWIMA) for PA-TNC".
  * SWIMA subscription option sets CLOSE_WRITE trigger on apt history.log file resulting in
    a ClientRetry PB-TNC batch to initialize a new measurement cycle. The new imv/imc-swima
    plugins replace the previous imv/imc-swid plugins, which were removed.
  * Added support for fuzzing the PA-TNC (RFC 5792) and PB-TNC (RFC 5793) NEA protocols
    on Google's OSS-Fuzz infrastructure.
  * Support for version 2 of Intel's TPM2-TSS TGC Software Stack. The presence of the
    in-kernel /dev/tpmrm0 resource manager is automatically detected.
  * The pki tool accepts a xmppAddr otherName as a subjectAlternativeName using the
    syntax --san xmppaddr:&lt;jid&gt;.
  * swanctl.conf supports the configuration of marks the in- and/or outbound SA should apply
    to packets after processing on Linux. Configuring such a mark for outbound SAs requires
    at least a 4.14 kernel. The ability to set a mask and configuring a mark/mask for
    inbound SAs will be added with the upcoming 4.19 kernel.
  * New options in swanctl.conf allow configuring how/whether DF, ECN and DS fields in the
    IP headers are copied during IPsec processing. Controlling this is currently only possible
    on Linux.
  * The handling of sequence numbers in IKEv1 DPDs has been improved (#2714).
  * To avoid conflicts, the dhcp plugin now only uses the DHCP server port if explicitly
    configured.
  - Version 5.6.3
  ===============
  * Fixed a DoS vulnerability in the IKEv2 key derivation if the openssl plugin is used in FIPS
    mode and HMAC-MD5 is negotiated as PRF.
    This vulnerability has been registered as CVE-2018-10811.
  * Fixed a vulnerability in the stroke plugin, which did not check the received length before
    reading a message from the socket. Unless a group is configured, root privileges are
    required to access that socket, so in the default configuration this shouldn't be an issue.
    This vulnerability has been registered as CVE-2018-5388.
  * CRLs that are not yet valid are now ignored to avoid problems in scenarios where expired
    certificates are removed from new CRLs and the clock on the host doing the revocation
    check is trailing behind that of the host issuing CRLs. Not doing this could result in
    accepting a revoked and expired certificate, if it's still valid according to the
    trailing clock but not contained anymore in not yet valid CRLs.
  * The issuer of fetched CRLs is now compared to the issuer of the checked certificate (#2608).
  * CRL validation results other than revocation (e.g. a skipped check because the CRL couldn't
    be fetched) are now stored also for intermediate CA certificates and not only for end-entity
    certificates, so a strict CRL policy can be enforced in such cases.
  * In compliance with RFC 4945, section 5.1.3.2, certificates used for IKE must now either
    not contain a keyUsage extension (like the ones generated by pki), or have at least one of the
    digitalSignature or nonRepudiation bits set.
  * New options for vici/swanctl allow forcing the local termination of an IKE_SA. This might be
    useful in situations where it's known the other end is not reachable anymore, or that it
    already removed the IKE_SA, so retransmitting a DELETE and waiting for a response would
    be pointless.
  * Waiting only a certain amount of time for a response (i.e. shorter than all retransmits
    would be) before destroying the IKE_SA is also possible by additionally specifying a
    timeout in the forced termination request.
  * When removing routes, the kernel-netlink plugin now checks if it tracks other routes for
    the same destination and replaces the installed route instead of just removing it. Same
    during installation, where existing routes previously weren't replaced. This should allow
    using traps with virtual IPs on Linux (#2162).
  * The dhcp plugin now only sends the client identifier DHCP option if the identity_lease
    setting is enabled (7b660944b6). It can also send identities of up to 255 bytes length,
    instead of the previous 64 bytes (30e886fe3b, 0e5b94d038). If a server address is
    configured, DHCP requests are now sent from port 67 instead of 68 to avoid ICMP port
    unreachables (becf027cd9).
  * The handling of faulty INVALID_KE_PAYLOAD notifies (e.g. one containing a DH group
    that wasn't proposed) during CREATE_CHILD_SA exchanges has been improved (#2536).
  * Roam events are now completely ignored for IKEv1 SAs (there is no MOBIKE to handle such
    changes properly).
  * ChaCha20/Poly1305 is now correctly proposed without key length (#2614). For compatibility with
    older releases the chacha20poly1305compat keyword may be included in proposals to also propose
    the algorithm with a key length (c58434aeff).
  * Configuration of hardware offload of IPsec SAs is now more flexible and allows a new
    setting (auto), which automatically uses it if the kernel and device both support it. If hw
    offload is set to yes and offloading is not supported, the CHILD_SA installation now fails.
  * The kernel-pfkey plugin optionally installs routes via internal interface (one with an IP
    in the local traffic selector). On FreeBSD, enabling this selects the correct source IP
    when sending packets from the gateway itself (e811659323).
  * SHA-2 based PRFs are supported in PKCS#8 files as generated by OpenSSL 1.1 (#2574).
  * The pki --verify tool may load CA certificates and CRLs from directories.
  * The IKE daemon now also switches to port 4500 if the remote port is not 500 (e.g. because the
    remote maps the response to a different port, as might happen on Azure), as long as the local
    port is 500 (85bfab621d).
  * Fixed an issue with DNS servers passed to NetworkManager in charon-nm (ee8c25516a).
  * Logged traffic selectors now always contain the protocol if either protocol or port are set
    (a36d8097ed).
  * Only the inbound SA/policy will be updated as reaction to IP address changes for rekeyed
    CHILD_SAs that are kept around.
  * The parser for strongswan.conf/swanctl.conf now accepts = characters in values without
    having to put the value in quotes (e.g. for Base64 encoded shared secrets).
    Notes for developers:
  * trap_manager_t: Trap policies are now unistalled by peer/child name and not the reqid.
  * No reqid is returned anymore when installing trap policies.
  * child_sa_t: A new state (CHILD_DELETED) is used for CHILD_SAs that have been deleted but
    not yet destroyed (after a rekeying CHILD_SAs are kept around for a while to process
    delayed packets).
    This way child_updown events are not triggered anymore for such SAs when an IKE_SA that
    has such CHILD_SAs assigned is deleted.
  - Version 5.6.2
  ===============
  * Fixed a DoS vulnerability in the parser for PKCS#1 RSASSA-PSS signatures that was caused
    by insufficient input validation. One of the configurable parameters in algorithm identifier
    structures for RSASSA-PSS signatures is the mask generation function (MGF). Only MGF1 is
    currently specified for this purpose. However, this in turn takes itself a parameter that
    specifies the underlying hash function. strongSwan's parser did not correctly handle the
    case of this parameter being absent, causing an undefined data read.
    This vulnerability has been registered as CVE-2018-6459.
  * When rekeying IKEv2 IKE_SAs the previously negotiated DH group will be reused, instead of
    using the first configured group, which avoids an additional exchange if the peer previously
    selected a different DH group via INVALID_KE_PAYLOAD notify. The same is also done when
    rekeying CHILD_SAs except for the first rekeying of the CHILD_SA that was created with the
    IKE_SA, where no DH group was negotiated yet.
    Also, the selected DH group is moved to the front in all sent proposals that contain it
    and all proposals that don't are moved to the back in order to convey the preference for
    this group to the peer.
  * Handling of MOBIKE task queuing has been improved. In particular, the response to an
    address update (with NAT-D payloads) is not ignored anymore if only an address list update
    or DPD is queued as that could prevent updating the UDP encapsulation in the kernel.
  * On Linux, roam events may optionally be triggered by changes to the routing rules, which
    can be useful if routing rules (instead of e.g. route metrics) are used to switch from one
    to another interface (i.e. from one to another routing table). Since routing rules are
    currently not evaluated when doing route lookups this is only useful if the kernel-based
    route lookup is used (4664992f7d).
  * The fallback drop policies installed to avoid traffic leaks when replacing addresses in
    installed policies are now replaced by temporary drop policies, which also prevent
    acquires because we currently delete and reinstall IPsec SAs to update their addresses
    (35ef1b032d).
  * Access X.509 certificates held in non-volatile storage of a TPM 2.0 referenced via the
    NV index.
    Adding the --keyid parameter to pki --print allows to print private keys or certificates
    stored in a smartcard or a TPM 2.0.
  * Fixed proposal selection if a peer incorrectly sends DH groups in the ESP proposal during
    IKE_AUTH and also if a DH group is configured in the local ESP proposal and charon.prefer
    configured_proposals is disabled (d058fd3c32).
  * The lookup for PSK secrets for IKEv1 has been improved for certain scenarios (see #2497
    for details).
  * MSKs received via RADIUS are now padded to 64 bytes to avoid compatibility issues with
    EAP-MSCHAPv2 and PRFs that have a block size &lt; 64 bytes (e.g. AES-XCBC-PRF-128, see
    73cbce6013).
  * The tpm_extendpcr command line tool extends a digest into a TPM PCR.
  * Ported the NetworkManager backend from the deprecated libnm-glib to libnm.
  * The save-keys debugging/development plugin saves IKE and/or ESP keys to files compatible
    with Wireshark.
  - Version 5.6.1
  ===============
  * Several algorithms were removed from the default ESP/AH and IKE proposals in compliance with
    RFC 8221 and RFC 8247, respectively. Removed from the default ESP/AH proposal were the
    3DES and Blowfish encryption algorithms and the HMAC-MD5 integrity algorithm. From the IKE
    default proposal the HMAC-MD5 integrity algorithm and the MODP-1024 Diffie-Hellman group
    were removed (the latter is significant for Windows clients in their default configuration).
    These algorithms may still be used in custom proposals.
  * Support for RSASSA-PSS signatures has been added. For compatibility with previous
    releases they are currently not used automatically, by default, to change that charon.rsa_pss
    may be enabled. To explicitly use or require such signatures during IKEv2 signature
    authentication (RFC 7427) ike:rsa/pss... authentication constraints may be used for specific
    connections (regardless of whether the strongswan.conf option above is enabled). Only the
    hash algorithm can be specified in such constraints, the MGF1 will be based on that hash
    and the salt length will equal the hash length (when verifying the salt length is not
    enforced).
    To enforce such signatures during PKI verification use rsa/pss... authentication constraints.
  * All pki commands that create certificates/CRLs can be made to sign with RSASSA-PSS instead
    of the classing PKCS#1 scheme with the --rsa-padding pss option. As with signatures during
    authentication, only the hash algorithm is configurable (via --digest option), the MGF1 will
    be based on that and the salt length will equal the hash length.
  * These signatures are supported by all RSA backends except pkcs11 (i.e. gmp, gcrypt, openssl).
    The gmp plugin requires the mgf1 plugin.
    Note that RSASSA-PSS algorithm identifiers and parameters in keys (public keys in
    certificates or private keys in PKCS#8 files) are currently not used as constraints.
  * The sec-updater tool checks for security updates in dpkg-based repositories
    (e.g. Debian/Ubuntu) and sets the security flags in the IMV policy database accordingly.
    Additionally for each new package version a SWID tag for the given OS and HW architecture
    is created and stored in the database.
  * Using the sec-updater.sh script template the lookup can be automated (e.g. via an hourly
    cron job).
  * When restarting an IKEv2 negotiation after receiving an INVALID_KE_PAYLOAD notify (or due
    to other reasons like too many retransmits) a new initiator SPI is allocated. This
    prevents issues caused by retransmits for IKE_SA_INIT messages.
  * Because the initiator SPI was previously reused when restarting the connection delayed
    responses for previous connection attempts were processed and might have caused fatal
    errors due to a failed DH negotiation or because of the internal retry counter in the
    ike-init task. For instance, if we proposed a DH group the responder rejected we
    might have later received delayed responses that either contained INVALID_KE_PAYLOAD
    notifies with the DH group we already switched to, or, if we retransmitted an
    IKE_SA_INIT with the requested group but then had to restart again, a KE payload with
    a group different from the one we proposed.
  * The introduction of file versions in the IMV database scheme broke file reference hash
    measurements. This has been fixed by creating generic product versions having an empty
    package name.
  * A new timeout option for the systime-fix plugin stops periodic system time checks after
    a while and enforces a certificate verification, closing or reauthenticating all SAs
    with invalid certificates.
  * The IKE event counters, previously only available via ipsec listcounters command, may
    now also be queried and reset via vici and the new swanctl --counters command. They
    are collected and provided by the optional counters plugin (enabled by default for
    backwards compatibility if the stroke plugin is built).
  * Class attributes received in RADIUS Access-Accept messages may optionally be added to
    RADIUS accounting messages (655924074b).
  * Basic support for systemd sockets has been added, which may be used for privilege separation
    (59db98fb94).
  * Inbound marks may optionally be installed in the SA again (was removed with 5.5.2) by
    enabling the mark_in_sa option in swanctl.conf.
  * The timeout of leases in pools configured via pool utility may be configured in other
    units than hours.
    INITIAL_CONTACT notifies are now only omitted if never is configured as uniqueness policy.
  * Outbound FWD policies for shunts are not installed anymore, by default (as is the case
    for other policies since 5.5.1).
  * Don't consider a DH group mismatch during CHILD_SA rekeying as failure as responder
    (e7276f78aa).
  * Handling of fragmented IPv4 and IPv6 packets in libipsec has been improved (e138003de9).
  * Trigger expire events for the correct IPsec SA in libipsec (6e861947a0).
  * A crash in CRL verification via openssl plugin using OpenSSL 1.1 has been fixed (78acaba6a1).
  * No hard-coded default proposals are passed from starter to the stroke plugin anymore (the
    IKE proposal used curve25519 since 5.5.2, which is an optional plugin).
  * A workaround for an issue with virtual IPs on macOS 10.13 (High Sierra) has been added
    (039b85dd43).
  * Handling of IKE_SA rekey collisions in charon-tkm has been fixed.
  * Instead of failing or just silently doing nothing unit tests may now warn about certain
    conditions (e.g. if a test was not executed due to external dependencies).</changelog>
  <changelog author="mmnelemane@suse.com" date="1585224000">- Fix for to resolve multiple definition of swanctl_dir (bsc #1164493)
  [+ 0006-Resolve-multiple-definition-of-swanctl_dir.patch]</changelog>
  <changelog author="mbuil@suse.com" date="1610712000">- Fix typo in README (bsc #1167880)
  [+ 0007-Fix-typo-in-README.patch ]</changelog>
  <changelog author="mbuil@suse.com" date="1611576000">- Fix FIPS bug (bsc #1180801)
  [+ 0008-gcrypt-Use-a-dummy-buffer-to-initialize-static-alloc.patch ]</changelog>
  <changelog author="mbuil@suse.com" date="1617019200">- Keep using ipsec as the main binary. Therefore, make strongswan.service point to it instead of swanctl</changelog>
  <changelog author="mbuil@suse.com" date="1617019201">- Information added in README about the rcstrongswan-starter</changelog>
  <changelog author="mbuil@suse.com" date="1617624000">- Add config to run ipsec on namespaces (bsc #1183670)</changelog>
  <changelog author="mt@suse.com" date="1619006400">- Add support for AES CCM aead algorithms to openssl plugin (cc/fips,bsc#1185363)
  [+ 0009-strongswan-openssl-aead-add-ccm-support.patch]</changelog>
  <changelog author="mt@suse.com" date="1620388800">- Replace AEAD AES CCM patch with upstream variant (cc/fips,bsc#1185363)
  [* 0009-strongswan-openssl-aead-add-ccm-support.patch]</changelog>
  <changelog author="hare@suse.de" date="1627646400">- Add auth_els plugin to support Marvell FC-SP encryption (jsc#SLE-20151)
  [* strongswan-marvell-auth-els.patch]</changelog>
  <changelog author="abergmann@suse.com" date="1634040000">- Fix integer overflow in gmp plugin (bsc#1191367, CVE-2021-41990)
  [* strongswan-5.6.1-5.9.3_gmp-rsa-ssa-salt-len.patch]
- Fix integer overflow when replacing certificates in cache (bsc#1191435, CVE-2021-41991)
  [* strongswan-4.4.1-5.9.3_cert-cache-random.patch]</changelog>
  <changelog author="meissner@suse.com" date="1643025600">- strongswan-5.5.0-5.9.4_eap_success-CVE-2021-45079.patch:
  Fixed authentication bypass in EAP authentication (CVE-2021-45079
  bsc#1194471)</changelog>
</package>
<package pkgid="063baf1a8b9cc9dd56b0d1b6fffcf64daa413d1a6a16ad4e90a7cfda0912633a" name="sysstat" arch="aarch64">
  <version epoch="0" ver="12.0.2" rel="3.33.1"/>
  <changelog author="ro@suse.de" date="1464091200">- skip libsensors on s390/s390x</changelog>
  <changelog author="tchvatal@suse.com" date="1487505600">- Update to 11.4.3 release
  * check the CHANGES file for detailed informations, too long
- Refresh patches:
  * sysstat-8.0.4-sysconfdir.diff
  * sysstat-8.1.6-sa1sa2lock.diff
- Remove patch that was converted to sed:
  * sysstat-9.0.4-no-build-date.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1490961600">- Properly specify you want to be started by multi-user.target
  bsc#1031674</changelog>
  <changelog author="mpluskal@suse.com" date="1509624000">- Update to version 11.6.1
  * See provided CHANGES for detailed list of changes
- Refresh patches:
  * sysstat-8.0.4-pagesize.diff
  * sysstat-8.0.4-sysconfdir.diff
  * sysstat-8.1.6-sa1sa2lock.diff
- Drop no longer needed
  * sysstat-8.0.4-sysconfdir.diff</changelog>
  <changelog author="fcrozat@suse.com" date="1524744000">- Remove Requires on update-desktop-files on subpackage, it is
  useless.</changelog>
  <changelog author="tchvatal@suse.com" date="1524830400">- Version update to 11.6.3:
  * A possible crash related to the new binary format used by sar, which could
    happen when buffers needed to be reallocated to accomodate more devices
    added to the system,
  * The %CPU value displayed by pidstat for processes using more than 100%
    of a core.</changelog>
  <changelog author="tchvatal@suse.com" date="1529582400">- Version update to 11.6.4:
  * The number of decimal places used by sysstat commands (sar, cifsiostat, iostat, mpstat and pidstat),
  * The network interfaces, block devices and filesystems for which statistics shall be displayed by sar or sadf.</changelog>
  <changelog author="tchvatal@suse.com" date="1534248000">- Update to 11.6.5:
  * sadf: SVG: Display graphs for swap utilization in packed mode.
  * sadf: SVG: Don't take into account activities with no graphs when
    calculating canvas height.
  * sadf: SVG: Don't insert a gap in SVG output if an activity is not
    displayed.
  * sadf: SVG: Fix possible negative value in graphs coordinates.</changelog>
  <changelog author="tchvatal@suse.com" date="1534248001">- Version update to 12.0.1:
  * sadf: SVG: Remove id tag from individual graphs. Use activities
    identification numbers for id tags.
  * sadf: SVG: Add new option "showtoc", which can be used to display
    the list of activities for which there are graphs ("table of
    contents").
  * sadf: SVG: Improve output for softnet activity: Add a discontinuity in
    graph when corresponding CPU is marked offline.
  * sadf: SVG: Improve function used to assess SVG canvas height.
  * sadf: SVG: Fix core dumped on buffers reallocation.
  * sar/sadf: Devices list management code refactoring.
  * sa_conv.c: Use write_all() function instead of write() to handle possible
    signal interruptions.
  * spec file updated: No longer create a debug package.
  * Remove many warnings from gcc v7/v8.
  * README file updated.
  * Manual pages updated.</changelog>
  <changelog author="tchvatal@suse.com" date="1539691200">- Up to 12.0.2: (fate#326576, bsc#1089883)
  * This version mainly includes bugfixes
- Dropped patches for SLE-12, fixed upstream:
  * sysstat-10.2.1-iostat-sar-util.patch
  * sysstat-10.2.1-sar-ifutil.patch
  * sysstat-10.2.6-fix-json-with-file-utc-time.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1543320000">- Security fixes:
  * The remap_struct function in sa_common.c has an out-of-bounds
    read during a memmove call [CVE-2018-19416, bsc#1117001]
  * The remap_struct function in sa_common.c has an out-of-bounds read
    during a memset call [CVE-2018-19517, bsc#1117260]
  * Added patch sysstat-12.0.2-CVE-2018-19416-and-CVE-2018-19517.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1561377600">- Fix scaling issue with mtab symlinks and automounter [bsc#1138767]
  * Added sysstat-mtab-symlinks-and-automounter.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1563883200">- Remove deprecated Require gettext and require gettext-runtime only
  during build [bsc#1142470]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1568116800">- Security fix: [bsc#1150114, CVE-2019-16167]
  * Memory corruption due to an Integer Overflow in remap_struct()
    in sa_common.c
  * Added sysstat-CVE-2019-16167.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1572436800">- Enable log information on service start/stop [bsc#1144923, jsc#SLE-5958]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1576152000">- Security fix: [bsc#1159104, CVE-2019-19725]
  * Double free in check_file_actlst in sa_common.c
- Add sysstat-CVE-2019-19725.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1600430400">- Fix average iowait output of sar [bsc#1174227]
  * The iowait value reported by the kernel can also decrement as
    a result of inaccurate iowait tracking. Waiting on IO can be
    first accounted as iowait but then instead as idle. Therefore
    if the idle value during the same period did not decrease then
    consider this is a problem with the iowait reporting and correct
    the previous value according to the new reading. Otherwise, treat
    this as CPU coming back online.
- Add patch sysstat-iowait-decr.patch</changelog>
  <changelog author="kukuk@suse.com" date="1601726400">- Don't hard require systemd, it works without,too. (bsc#1186827)</changelog>
  <changelog author="pmonreal@suse.com" date="1602849600">- Fix iostat -y switch results [bsc#1177747]
- Add sysstat-12.1.6-iostat-y-option.diff</changelog>
  <changelog author="david.anes@suse.com" date="1643889600">- Fix possible segfault in read_task_stats() [bsc#1194679]
- Add sysstat-fix-segfault-in-read_task_stats.patch</changelog>
</package>
<package pkgid="b0ef5bde66f90e662adb294964541f49b93e1c526c409d156c06670036cce141" name="sysstat" arch="ppc64le">
  <version epoch="0" ver="12.0.2" rel="3.33.1"/>
  <changelog author="ro@suse.de" date="1464091200">- skip libsensors on s390/s390x</changelog>
  <changelog author="tchvatal@suse.com" date="1487505600">- Update to 11.4.3 release
  * check the CHANGES file for detailed informations, too long
- Refresh patches:
  * sysstat-8.0.4-sysconfdir.diff
  * sysstat-8.1.6-sa1sa2lock.diff
- Remove patch that was converted to sed:
  * sysstat-9.0.4-no-build-date.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1490961600">- Properly specify you want to be started by multi-user.target
  bsc#1031674</changelog>
  <changelog author="mpluskal@suse.com" date="1509624000">- Update to version 11.6.1
  * See provided CHANGES for detailed list of changes
- Refresh patches:
  * sysstat-8.0.4-pagesize.diff
  * sysstat-8.0.4-sysconfdir.diff
  * sysstat-8.1.6-sa1sa2lock.diff
- Drop no longer needed
  * sysstat-8.0.4-sysconfdir.diff</changelog>
  <changelog author="fcrozat@suse.com" date="1524744000">- Remove Requires on update-desktop-files on subpackage, it is
  useless.</changelog>
  <changelog author="tchvatal@suse.com" date="1524830400">- Version update to 11.6.3:
  * A possible crash related to the new binary format used by sar, which could
    happen when buffers needed to be reallocated to accomodate more devices
    added to the system,
  * The %CPU value displayed by pidstat for processes using more than 100%
    of a core.</changelog>
  <changelog author="tchvatal@suse.com" date="1529582400">- Version update to 11.6.4:
  * The number of decimal places used by sysstat commands (sar, cifsiostat, iostat, mpstat and pidstat),
  * The network interfaces, block devices and filesystems for which statistics shall be displayed by sar or sadf.</changelog>
  <changelog author="tchvatal@suse.com" date="1534248000">- Update to 11.6.5:
  * sadf: SVG: Display graphs for swap utilization in packed mode.
  * sadf: SVG: Don't take into account activities with no graphs when
    calculating canvas height.
  * sadf: SVG: Don't insert a gap in SVG output if an activity is not
    displayed.
  * sadf: SVG: Fix possible negative value in graphs coordinates.</changelog>
  <changelog author="tchvatal@suse.com" date="1534248001">- Version update to 12.0.1:
  * sadf: SVG: Remove id tag from individual graphs. Use activities
    identification numbers for id tags.
  * sadf: SVG: Add new option "showtoc", which can be used to display
    the list of activities for which there are graphs ("table of
    contents").
  * sadf: SVG: Improve output for softnet activity: Add a discontinuity in
    graph when corresponding CPU is marked offline.
  * sadf: SVG: Improve function used to assess SVG canvas height.
  * sadf: SVG: Fix core dumped on buffers reallocation.
  * sar/sadf: Devices list management code refactoring.
  * sa_conv.c: Use write_all() function instead of write() to handle possible
    signal interruptions.
  * spec file updated: No longer create a debug package.
  * Remove many warnings from gcc v7/v8.
  * README file updated.
  * Manual pages updated.</changelog>
  <changelog author="tchvatal@suse.com" date="1539691200">- Up to 12.0.2: (fate#326576, bsc#1089883)
  * This version mainly includes bugfixes
- Dropped patches for SLE-12, fixed upstream:
  * sysstat-10.2.1-iostat-sar-util.patch
  * sysstat-10.2.1-sar-ifutil.patch
  * sysstat-10.2.6-fix-json-with-file-utc-time.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1543320000">- Security fixes:
  * The remap_struct function in sa_common.c has an out-of-bounds
    read during a memmove call [CVE-2018-19416, bsc#1117001]
  * The remap_struct function in sa_common.c has an out-of-bounds read
    during a memset call [CVE-2018-19517, bsc#1117260]
  * Added patch sysstat-12.0.2-CVE-2018-19416-and-CVE-2018-19517.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1561377600">- Fix scaling issue with mtab symlinks and automounter [bsc#1138767]
  * Added sysstat-mtab-symlinks-and-automounter.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1563883200">- Remove deprecated Require gettext and require gettext-runtime only
  during build [bsc#1142470]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1568116800">- Security fix: [bsc#1150114, CVE-2019-16167]
  * Memory corruption due to an Integer Overflow in remap_struct()
    in sa_common.c
  * Added sysstat-CVE-2019-16167.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1572436800">- Enable log information on service start/stop [bsc#1144923, jsc#SLE-5958]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1576152000">- Security fix: [bsc#1159104, CVE-2019-19725]
  * Double free in check_file_actlst in sa_common.c
- Add sysstat-CVE-2019-19725.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1600430400">- Fix average iowait output of sar [bsc#1174227]
  * The iowait value reported by the kernel can also decrement as
    a result of inaccurate iowait tracking. Waiting on IO can be
    first accounted as iowait but then instead as idle. Therefore
    if the idle value during the same period did not decrease then
    consider this is a problem with the iowait reporting and correct
    the previous value according to the new reading. Otherwise, treat
    this as CPU coming back online.
- Add patch sysstat-iowait-decr.patch</changelog>
  <changelog author="kukuk@suse.com" date="1601726400">- Don't hard require systemd, it works without,too. (bsc#1186827)</changelog>
  <changelog author="pmonreal@suse.com" date="1602849600">- Fix iostat -y switch results [bsc#1177747]
- Add sysstat-12.1.6-iostat-y-option.diff</changelog>
  <changelog author="david.anes@suse.com" date="1643889600">- Fix possible segfault in read_task_stats() [bsc#1194679]
- Add sysstat-fix-segfault-in-read_task_stats.patch</changelog>
</package>
<package pkgid="c2bb03f88ddfb02482bddaba0822a44408ff106a5423ab225a43f2233906ffc9" name="sysstat" arch="s390x">
  <version epoch="0" ver="12.0.2" rel="3.33.1"/>
  <changelog author="ro@suse.de" date="1464091200">- skip libsensors on s390/s390x</changelog>
  <changelog author="tchvatal@suse.com" date="1487505600">- Update to 11.4.3 release
  * check the CHANGES file for detailed informations, too long
- Refresh patches:
  * sysstat-8.0.4-sysconfdir.diff
  * sysstat-8.1.6-sa1sa2lock.diff
- Remove patch that was converted to sed:
  * sysstat-9.0.4-no-build-date.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1490961600">- Properly specify you want to be started by multi-user.target
  bsc#1031674</changelog>
  <changelog author="mpluskal@suse.com" date="1509624000">- Update to version 11.6.1
  * See provided CHANGES for detailed list of changes
- Refresh patches:
  * sysstat-8.0.4-pagesize.diff
  * sysstat-8.0.4-sysconfdir.diff
  * sysstat-8.1.6-sa1sa2lock.diff
- Drop no longer needed
  * sysstat-8.0.4-sysconfdir.diff</changelog>
  <changelog author="fcrozat@suse.com" date="1524744000">- Remove Requires on update-desktop-files on subpackage, it is
  useless.</changelog>
  <changelog author="tchvatal@suse.com" date="1524830400">- Version update to 11.6.3:
  * A possible crash related to the new binary format used by sar, which could
    happen when buffers needed to be reallocated to accomodate more devices
    added to the system,
  * The %CPU value displayed by pidstat for processes using more than 100%
    of a core.</changelog>
  <changelog author="tchvatal@suse.com" date="1529582400">- Version update to 11.6.4:
  * The number of decimal places used by sysstat commands (sar, cifsiostat, iostat, mpstat and pidstat),
  * The network interfaces, block devices and filesystems for which statistics shall be displayed by sar or sadf.</changelog>
  <changelog author="tchvatal@suse.com" date="1534248000">- Update to 11.6.5:
  * sadf: SVG: Display graphs for swap utilization in packed mode.
  * sadf: SVG: Don't take into account activities with no graphs when
    calculating canvas height.
  * sadf: SVG: Don't insert a gap in SVG output if an activity is not
    displayed.
  * sadf: SVG: Fix possible negative value in graphs coordinates.</changelog>
  <changelog author="tchvatal@suse.com" date="1534248001">- Version update to 12.0.1:
  * sadf: SVG: Remove id tag from individual graphs. Use activities
    identification numbers for id tags.
  * sadf: SVG: Add new option "showtoc", which can be used to display
    the list of activities for which there are graphs ("table of
    contents").
  * sadf: SVG: Improve output for softnet activity: Add a discontinuity in
    graph when corresponding CPU is marked offline.
  * sadf: SVG: Improve function used to assess SVG canvas height.
  * sadf: SVG: Fix core dumped on buffers reallocation.
  * sar/sadf: Devices list management code refactoring.
  * sa_conv.c: Use write_all() function instead of write() to handle possible
    signal interruptions.
  * spec file updated: No longer create a debug package.
  * Remove many warnings from gcc v7/v8.
  * README file updated.
  * Manual pages updated.</changelog>
  <changelog author="tchvatal@suse.com" date="1539691200">- Up to 12.0.2: (fate#326576, bsc#1089883)
  * This version mainly includes bugfixes
- Dropped patches for SLE-12, fixed upstream:
  * sysstat-10.2.1-iostat-sar-util.patch
  * sysstat-10.2.1-sar-ifutil.patch
  * sysstat-10.2.6-fix-json-with-file-utc-time.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1543320000">- Security fixes:
  * The remap_struct function in sa_common.c has an out-of-bounds
    read during a memmove call [CVE-2018-19416, bsc#1117001]
  * The remap_struct function in sa_common.c has an out-of-bounds read
    during a memset call [CVE-2018-19517, bsc#1117260]
  * Added patch sysstat-12.0.2-CVE-2018-19416-and-CVE-2018-19517.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1561377600">- Fix scaling issue with mtab symlinks and automounter [bsc#1138767]
  * Added sysstat-mtab-symlinks-and-automounter.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1563883200">- Remove deprecated Require gettext and require gettext-runtime only
  during build [bsc#1142470]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1568116800">- Security fix: [bsc#1150114, CVE-2019-16167]
  * Memory corruption due to an Integer Overflow in remap_struct()
    in sa_common.c
  * Added sysstat-CVE-2019-16167.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1572436800">- Enable log information on service start/stop [bsc#1144923, jsc#SLE-5958]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1576152000">- Security fix: [bsc#1159104, CVE-2019-19725]
  * Double free in check_file_actlst in sa_common.c
- Add sysstat-CVE-2019-19725.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1600430400">- Fix average iowait output of sar [bsc#1174227]
  * The iowait value reported by the kernel can also decrement as
    a result of inaccurate iowait tracking. Waiting on IO can be
    first accounted as iowait but then instead as idle. Therefore
    if the idle value during the same period did not decrease then
    consider this is a problem with the iowait reporting and correct
    the previous value according to the new reading. Otherwise, treat
    this as CPU coming back online.
- Add patch sysstat-iowait-decr.patch</changelog>
  <changelog author="kukuk@suse.com" date="1601726400">- Don't hard require systemd, it works without,too. (bsc#1186827)</changelog>
  <changelog author="pmonreal@suse.com" date="1602849600">- Fix iostat -y switch results [bsc#1177747]
- Add sysstat-12.1.6-iostat-y-option.diff</changelog>
  <changelog author="david.anes@suse.com" date="1643889600">- Fix possible segfault in read_task_stats() [bsc#1194679]
- Add sysstat-fix-segfault-in-read_task_stats.patch</changelog>
</package>
<package pkgid="3cfd91f00ce6b516adf52a8427fb1549bf96336c2df3f51ac0b7bb558756a95e" name="sysstat" arch="src">
  <version epoch="0" ver="12.0.2" rel="3.33.1"/>
  <changelog author="ro@suse.de" date="1464091200">- skip libsensors on s390/s390x</changelog>
  <changelog author="tchvatal@suse.com" date="1487505600">- Update to 11.4.3 release
  * check the CHANGES file for detailed informations, too long
- Refresh patches:
  * sysstat-8.0.4-sysconfdir.diff
  * sysstat-8.1.6-sa1sa2lock.diff
- Remove patch that was converted to sed:
  * sysstat-9.0.4-no-build-date.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1490961600">- Properly specify you want to be started by multi-user.target
  bsc#1031674</changelog>
  <changelog author="mpluskal@suse.com" date="1509624000">- Update to version 11.6.1
  * See provided CHANGES for detailed list of changes
- Refresh patches:
  * sysstat-8.0.4-pagesize.diff
  * sysstat-8.0.4-sysconfdir.diff
  * sysstat-8.1.6-sa1sa2lock.diff
- Drop no longer needed
  * sysstat-8.0.4-sysconfdir.diff</changelog>
  <changelog author="fcrozat@suse.com" date="1524744000">- Remove Requires on update-desktop-files on subpackage, it is
  useless.</changelog>
  <changelog author="tchvatal@suse.com" date="1524830400">- Version update to 11.6.3:
  * A possible crash related to the new binary format used by sar, which could
    happen when buffers needed to be reallocated to accomodate more devices
    added to the system,
  * The %CPU value displayed by pidstat for processes using more than 100%
    of a core.</changelog>
  <changelog author="tchvatal@suse.com" date="1529582400">- Version update to 11.6.4:
  * The number of decimal places used by sysstat commands (sar, cifsiostat, iostat, mpstat and pidstat),
  * The network interfaces, block devices and filesystems for which statistics shall be displayed by sar or sadf.</changelog>
  <changelog author="tchvatal@suse.com" date="1534248000">- Update to 11.6.5:
  * sadf: SVG: Display graphs for swap utilization in packed mode.
  * sadf: SVG: Don't take into account activities with no graphs when
    calculating canvas height.
  * sadf: SVG: Don't insert a gap in SVG output if an activity is not
    displayed.
  * sadf: SVG: Fix possible negative value in graphs coordinates.</changelog>
  <changelog author="tchvatal@suse.com" date="1534248001">- Version update to 12.0.1:
  * sadf: SVG: Remove id tag from individual graphs. Use activities
    identification numbers for id tags.
  * sadf: SVG: Add new option "showtoc", which can be used to display
    the list of activities for which there are graphs ("table of
    contents").
  * sadf: SVG: Improve output for softnet activity: Add a discontinuity in
    graph when corresponding CPU is marked offline.
  * sadf: SVG: Improve function used to assess SVG canvas height.
  * sadf: SVG: Fix core dumped on buffers reallocation.
  * sar/sadf: Devices list management code refactoring.
  * sa_conv.c: Use write_all() function instead of write() to handle possible
    signal interruptions.
  * spec file updated: No longer create a debug package.
  * Remove many warnings from gcc v7/v8.
  * README file updated.
  * Manual pages updated.</changelog>
  <changelog author="tchvatal@suse.com" date="1539691200">- Up to 12.0.2: (fate#326576, bsc#1089883)
  * This version mainly includes bugfixes
- Dropped patches for SLE-12, fixed upstream:
  * sysstat-10.2.1-iostat-sar-util.patch
  * sysstat-10.2.1-sar-ifutil.patch
  * sysstat-10.2.6-fix-json-with-file-utc-time.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1543320000">- Security fixes:
  * The remap_struct function in sa_common.c has an out-of-bounds
    read during a memmove call [CVE-2018-19416, bsc#1117001]
  * The remap_struct function in sa_common.c has an out-of-bounds read
    during a memset call [CVE-2018-19517, bsc#1117260]
  * Added patch sysstat-12.0.2-CVE-2018-19416-and-CVE-2018-19517.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1561377600">- Fix scaling issue with mtab symlinks and automounter [bsc#1138767]
  * Added sysstat-mtab-symlinks-and-automounter.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1563883200">- Remove deprecated Require gettext and require gettext-runtime only
  during build [bsc#1142470]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1568116800">- Security fix: [bsc#1150114, CVE-2019-16167]
  * Memory corruption due to an Integer Overflow in remap_struct()
    in sa_common.c
  * Added sysstat-CVE-2019-16167.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1572436800">- Enable log information on service start/stop [bsc#1144923, jsc#SLE-5958]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1576152000">- Security fix: [bsc#1159104, CVE-2019-19725]
  * Double free in check_file_actlst in sa_common.c
- Add sysstat-CVE-2019-19725.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1600430400">- Fix average iowait output of sar [bsc#1174227]
  * The iowait value reported by the kernel can also decrement as
    a result of inaccurate iowait tracking. Waiting on IO can be
    first accounted as iowait but then instead as idle. Therefore
    if the idle value during the same period did not decrease then
    consider this is a problem with the iowait reporting and correct
    the previous value according to the new reading. Otherwise, treat
    this as CPU coming back online.
- Add patch sysstat-iowait-decr.patch</changelog>
  <changelog author="kukuk@suse.com" date="1601726400">- Don't hard require systemd, it works without,too. (bsc#1186827)</changelog>
  <changelog author="pmonreal@suse.com" date="1602849600">- Fix iostat -y switch results [bsc#1177747]
- Add sysstat-12.1.6-iostat-y-option.diff</changelog>
  <changelog author="david.anes@suse.com" date="1643889600">- Fix possible segfault in read_task_stats() [bsc#1194679]
- Add sysstat-fix-segfault-in-read_task_stats.patch</changelog>
</package>
<package pkgid="38620fe56089a1e9cf6cdc265d7864b2793a12b015474a0a435aa124cd5c13b5" name="sysstat" arch="x86_64">
  <version epoch="0" ver="12.0.2" rel="3.33.1"/>
  <changelog author="ro@suse.de" date="1464091200">- skip libsensors on s390/s390x</changelog>
  <changelog author="tchvatal@suse.com" date="1487505600">- Update to 11.4.3 release
  * check the CHANGES file for detailed informations, too long
- Refresh patches:
  * sysstat-8.0.4-sysconfdir.diff
  * sysstat-8.1.6-sa1sa2lock.diff
- Remove patch that was converted to sed:
  * sysstat-9.0.4-no-build-date.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1490961600">- Properly specify you want to be started by multi-user.target
  bsc#1031674</changelog>
  <changelog author="mpluskal@suse.com" date="1509624000">- Update to version 11.6.1
  * See provided CHANGES for detailed list of changes
- Refresh patches:
  * sysstat-8.0.4-pagesize.diff
  * sysstat-8.0.4-sysconfdir.diff
  * sysstat-8.1.6-sa1sa2lock.diff
- Drop no longer needed
  * sysstat-8.0.4-sysconfdir.diff</changelog>
  <changelog author="fcrozat@suse.com" date="1524744000">- Remove Requires on update-desktop-files on subpackage, it is
  useless.</changelog>
  <changelog author="tchvatal@suse.com" date="1524830400">- Version update to 11.6.3:
  * A possible crash related to the new binary format used by sar, which could
    happen when buffers needed to be reallocated to accomodate more devices
    added to the system,
  * The %CPU value displayed by pidstat for processes using more than 100%
    of a core.</changelog>
  <changelog author="tchvatal@suse.com" date="1529582400">- Version update to 11.6.4:
  * The number of decimal places used by sysstat commands (sar, cifsiostat, iostat, mpstat and pidstat),
  * The network interfaces, block devices and filesystems for which statistics shall be displayed by sar or sadf.</changelog>
  <changelog author="tchvatal@suse.com" date="1534248000">- Update to 11.6.5:
  * sadf: SVG: Display graphs for swap utilization in packed mode.
  * sadf: SVG: Don't take into account activities with no graphs when
    calculating canvas height.
  * sadf: SVG: Don't insert a gap in SVG output if an activity is not
    displayed.
  * sadf: SVG: Fix possible negative value in graphs coordinates.</changelog>
  <changelog author="tchvatal@suse.com" date="1534248001">- Version update to 12.0.1:
  * sadf: SVG: Remove id tag from individual graphs. Use activities
    identification numbers for id tags.
  * sadf: SVG: Add new option "showtoc", which can be used to display
    the list of activities for which there are graphs ("table of
    contents").
  * sadf: SVG: Improve output for softnet activity: Add a discontinuity in
    graph when corresponding CPU is marked offline.
  * sadf: SVG: Improve function used to assess SVG canvas height.
  * sadf: SVG: Fix core dumped on buffers reallocation.
  * sar/sadf: Devices list management code refactoring.
  * sa_conv.c: Use write_all() function instead of write() to handle possible
    signal interruptions.
  * spec file updated: No longer create a debug package.
  * Remove many warnings from gcc v7/v8.
  * README file updated.
  * Manual pages updated.</changelog>
  <changelog author="tchvatal@suse.com" date="1539691200">- Up to 12.0.2: (fate#326576, bsc#1089883)
  * This version mainly includes bugfixes
- Dropped patches for SLE-12, fixed upstream:
  * sysstat-10.2.1-iostat-sar-util.patch
  * sysstat-10.2.1-sar-ifutil.patch
  * sysstat-10.2.6-fix-json-with-file-utc-time.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1543320000">- Security fixes:
  * The remap_struct function in sa_common.c has an out-of-bounds
    read during a memmove call [CVE-2018-19416, bsc#1117001]
  * The remap_struct function in sa_common.c has an out-of-bounds read
    during a memset call [CVE-2018-19517, bsc#1117260]
  * Added patch sysstat-12.0.2-CVE-2018-19416-and-CVE-2018-19517.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1561377600">- Fix scaling issue with mtab symlinks and automounter [bsc#1138767]
  * Added sysstat-mtab-symlinks-and-automounter.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1563883200">- Remove deprecated Require gettext and require gettext-runtime only
  during build [bsc#1142470]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1568116800">- Security fix: [bsc#1150114, CVE-2019-16167]
  * Memory corruption due to an Integer Overflow in remap_struct()
    in sa_common.c
  * Added sysstat-CVE-2019-16167.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1572436800">- Enable log information on service start/stop [bsc#1144923, jsc#SLE-5958]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1576152000">- Security fix: [bsc#1159104, CVE-2019-19725]
  * Double free in check_file_actlst in sa_common.c
- Add sysstat-CVE-2019-19725.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1600430400">- Fix average iowait output of sar [bsc#1174227]
  * The iowait value reported by the kernel can also decrement as
    a result of inaccurate iowait tracking. Waiting on IO can be
    first accounted as iowait but then instead as idle. Therefore
    if the idle value during the same period did not decrease then
    consider this is a problem with the iowait reporting and correct
    the previous value according to the new reading. Otherwise, treat
    this as CPU coming back online.
- Add patch sysstat-iowait-decr.patch</changelog>
  <changelog author="kukuk@suse.com" date="1601726400">- Don't hard require systemd, it works without,too. (bsc#1186827)</changelog>
  <changelog author="pmonreal@suse.com" date="1602849600">- Fix iostat -y switch results [bsc#1177747]
- Add sysstat-12.1.6-iostat-y-option.diff</changelog>
  <changelog author="david.anes@suse.com" date="1643889600">- Fix possible segfault in read_task_stats() [bsc#1194679]
- Add sysstat-fix-segfault-in-read_task_stats.patch</changelog>
</package>
<package pkgid="5dc3c483a11d4968055429c728d8760792b88e0f563268eb974d6f4e5c505304" name="sysstat-isag" arch="aarch64">
  <version epoch="0" ver="12.0.2" rel="3.33.1"/>
  <changelog author="ro@suse.de" date="1464091200">- skip libsensors on s390/s390x</changelog>
  <changelog author="tchvatal@suse.com" date="1487505600">- Update to 11.4.3 release
  * check the CHANGES file for detailed informations, too long
- Refresh patches:
  * sysstat-8.0.4-sysconfdir.diff
  * sysstat-8.1.6-sa1sa2lock.diff
- Remove patch that was converted to sed:
  * sysstat-9.0.4-no-build-date.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1490961600">- Properly specify you want to be started by multi-user.target
  bsc#1031674</changelog>
  <changelog author="mpluskal@suse.com" date="1509624000">- Update to version 11.6.1
  * See provided CHANGES for detailed list of changes
- Refresh patches:
  * sysstat-8.0.4-pagesize.diff
  * sysstat-8.0.4-sysconfdir.diff
  * sysstat-8.1.6-sa1sa2lock.diff
- Drop no longer needed
  * sysstat-8.0.4-sysconfdir.diff</changelog>
  <changelog author="fcrozat@suse.com" date="1524744000">- Remove Requires on update-desktop-files on subpackage, it is
  useless.</changelog>
  <changelog author="tchvatal@suse.com" date="1524830400">- Version update to 11.6.3:
  * A possible crash related to the new binary format used by sar, which could
    happen when buffers needed to be reallocated to accomodate more devices
    added to the system,
  * The %CPU value displayed by pidstat for processes using more than 100%
    of a core.</changelog>
  <changelog author="tchvatal@suse.com" date="1529582400">- Version update to 11.6.4:
  * The number of decimal places used by sysstat commands (sar, cifsiostat, iostat, mpstat and pidstat),
  * The network interfaces, block devices and filesystems for which statistics shall be displayed by sar or sadf.</changelog>
  <changelog author="tchvatal@suse.com" date="1534248000">- Update to 11.6.5:
  * sadf: SVG: Display graphs for swap utilization in packed mode.
  * sadf: SVG: Don't take into account activities with no graphs when
    calculating canvas height.
  * sadf: SVG: Don't insert a gap in SVG output if an activity is not
    displayed.
  * sadf: SVG: Fix possible negative value in graphs coordinates.</changelog>
  <changelog author="tchvatal@suse.com" date="1534248001">- Version update to 12.0.1:
  * sadf: SVG: Remove id tag from individual graphs. Use activities
    identification numbers for id tags.
  * sadf: SVG: Add new option "showtoc", which can be used to display
    the list of activities for which there are graphs ("table of
    contents").
  * sadf: SVG: Improve output for softnet activity: Add a discontinuity in
    graph when corresponding CPU is marked offline.
  * sadf: SVG: Improve function used to assess SVG canvas height.
  * sadf: SVG: Fix core dumped on buffers reallocation.
  * sar/sadf: Devices list management code refactoring.
  * sa_conv.c: Use write_all() function instead of write() to handle possible
    signal interruptions.
  * spec file updated: No longer create a debug package.
  * Remove many warnings from gcc v7/v8.
  * README file updated.
  * Manual pages updated.</changelog>
  <changelog author="tchvatal@suse.com" date="1539691200">- Up to 12.0.2: (fate#326576, bsc#1089883)
  * This version mainly includes bugfixes
- Dropped patches for SLE-12, fixed upstream:
  * sysstat-10.2.1-iostat-sar-util.patch
  * sysstat-10.2.1-sar-ifutil.patch
  * sysstat-10.2.6-fix-json-with-file-utc-time.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1543320000">- Security fixes:
  * The remap_struct function in sa_common.c has an out-of-bounds
    read during a memmove call [CVE-2018-19416, bsc#1117001]
  * The remap_struct function in sa_common.c has an out-of-bounds read
    during a memset call [CVE-2018-19517, bsc#1117260]
  * Added patch sysstat-12.0.2-CVE-2018-19416-and-CVE-2018-19517.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1561377600">- Fix scaling issue with mtab symlinks and automounter [bsc#1138767]
  * Added sysstat-mtab-symlinks-and-automounter.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1563883200">- Remove deprecated Require gettext and require gettext-runtime only
  during build [bsc#1142470]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1568116800">- Security fix: [bsc#1150114, CVE-2019-16167]
  * Memory corruption due to an Integer Overflow in remap_struct()
    in sa_common.c
  * Added sysstat-CVE-2019-16167.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1572436800">- Enable log information on service start/stop [bsc#1144923, jsc#SLE-5958]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1576152000">- Security fix: [bsc#1159104, CVE-2019-19725]
  * Double free in check_file_actlst in sa_common.c
- Add sysstat-CVE-2019-19725.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1600430400">- Fix average iowait output of sar [bsc#1174227]
  * The iowait value reported by the kernel can also decrement as
    a result of inaccurate iowait tracking. Waiting on IO can be
    first accounted as iowait but then instead as idle. Therefore
    if the idle value during the same period did not decrease then
    consider this is a problem with the iowait reporting and correct
    the previous value according to the new reading. Otherwise, treat
    this as CPU coming back online.
- Add patch sysstat-iowait-decr.patch</changelog>
  <changelog author="kukuk@suse.com" date="1601726400">- Don't hard require systemd, it works without,too. (bsc#1186827)</changelog>
  <changelog author="pmonreal@suse.com" date="1602849600">- Fix iostat -y switch results [bsc#1177747]
- Add sysstat-12.1.6-iostat-y-option.diff</changelog>
  <changelog author="david.anes@suse.com" date="1643889600">- Fix possible segfault in read_task_stats() [bsc#1194679]
- Add sysstat-fix-segfault-in-read_task_stats.patch</changelog>
</package>
<package pkgid="c07cd32afd85d746a27942dd4d0c927f805cb061442cf862bd5929be8caf6262" name="sysstat-isag" arch="ppc64le">
  <version epoch="0" ver="12.0.2" rel="3.33.1"/>
  <changelog author="ro@suse.de" date="1464091200">- skip libsensors on s390/s390x</changelog>
  <changelog author="tchvatal@suse.com" date="1487505600">- Update to 11.4.3 release
  * check the CHANGES file for detailed informations, too long
- Refresh patches:
  * sysstat-8.0.4-sysconfdir.diff
  * sysstat-8.1.6-sa1sa2lock.diff
- Remove patch that was converted to sed:
  * sysstat-9.0.4-no-build-date.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1490961600">- Properly specify you want to be started by multi-user.target
  bsc#1031674</changelog>
  <changelog author="mpluskal@suse.com" date="1509624000">- Update to version 11.6.1
  * See provided CHANGES for detailed list of changes
- Refresh patches:
  * sysstat-8.0.4-pagesize.diff
  * sysstat-8.0.4-sysconfdir.diff
  * sysstat-8.1.6-sa1sa2lock.diff
- Drop no longer needed
  * sysstat-8.0.4-sysconfdir.diff</changelog>
  <changelog author="fcrozat@suse.com" date="1524744000">- Remove Requires on update-desktop-files on subpackage, it is
  useless.</changelog>
  <changelog author="tchvatal@suse.com" date="1524830400">- Version update to 11.6.3:
  * A possible crash related to the new binary format used by sar, which could
    happen when buffers needed to be reallocated to accomodate more devices
    added to the system,
  * The %CPU value displayed by pidstat for processes using more than 100%
    of a core.</changelog>
  <changelog author="tchvatal@suse.com" date="1529582400">- Version update to 11.6.4:
  * The number of decimal places used by sysstat commands (sar, cifsiostat, iostat, mpstat and pidstat),
  * The network interfaces, block devices and filesystems for which statistics shall be displayed by sar or sadf.</changelog>
  <changelog author="tchvatal@suse.com" date="1534248000">- Update to 11.6.5:
  * sadf: SVG: Display graphs for swap utilization in packed mode.
  * sadf: SVG: Don't take into account activities with no graphs when
    calculating canvas height.
  * sadf: SVG: Don't insert a gap in SVG output if an activity is not
    displayed.
  * sadf: SVG: Fix possible negative value in graphs coordinates.</changelog>
  <changelog author="tchvatal@suse.com" date="1534248001">- Version update to 12.0.1:
  * sadf: SVG: Remove id tag from individual graphs. Use activities
    identification numbers for id tags.
  * sadf: SVG: Add new option "showtoc", which can be used to display
    the list of activities for which there are graphs ("table of
    contents").
  * sadf: SVG: Improve output for softnet activity: Add a discontinuity in
    graph when corresponding CPU is marked offline.
  * sadf: SVG: Improve function used to assess SVG canvas height.
  * sadf: SVG: Fix core dumped on buffers reallocation.
  * sar/sadf: Devices list management code refactoring.
  * sa_conv.c: Use write_all() function instead of write() to handle possible
    signal interruptions.
  * spec file updated: No longer create a debug package.
  * Remove many warnings from gcc v7/v8.
  * README file updated.
  * Manual pages updated.</changelog>
  <changelog author="tchvatal@suse.com" date="1539691200">- Up to 12.0.2: (fate#326576, bsc#1089883)
  * This version mainly includes bugfixes
- Dropped patches for SLE-12, fixed upstream:
  * sysstat-10.2.1-iostat-sar-util.patch
  * sysstat-10.2.1-sar-ifutil.patch
  * sysstat-10.2.6-fix-json-with-file-utc-time.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1543320000">- Security fixes:
  * The remap_struct function in sa_common.c has an out-of-bounds
    read during a memmove call [CVE-2018-19416, bsc#1117001]
  * The remap_struct function in sa_common.c has an out-of-bounds read
    during a memset call [CVE-2018-19517, bsc#1117260]
  * Added patch sysstat-12.0.2-CVE-2018-19416-and-CVE-2018-19517.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1561377600">- Fix scaling issue with mtab symlinks and automounter [bsc#1138767]
  * Added sysstat-mtab-symlinks-and-automounter.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1563883200">- Remove deprecated Require gettext and require gettext-runtime only
  during build [bsc#1142470]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1568116800">- Security fix: [bsc#1150114, CVE-2019-16167]
  * Memory corruption due to an Integer Overflow in remap_struct()
    in sa_common.c
  * Added sysstat-CVE-2019-16167.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1572436800">- Enable log information on service start/stop [bsc#1144923, jsc#SLE-5958]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1576152000">- Security fix: [bsc#1159104, CVE-2019-19725]
  * Double free in check_file_actlst in sa_common.c
- Add sysstat-CVE-2019-19725.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1600430400">- Fix average iowait output of sar [bsc#1174227]
  * The iowait value reported by the kernel can also decrement as
    a result of inaccurate iowait tracking. Waiting on IO can be
    first accounted as iowait but then instead as idle. Therefore
    if the idle value during the same period did not decrease then
    consider this is a problem with the iowait reporting and correct
    the previous value according to the new reading. Otherwise, treat
    this as CPU coming back online.
- Add patch sysstat-iowait-decr.patch</changelog>
  <changelog author="kukuk@suse.com" date="1601726400">- Don't hard require systemd, it works without,too. (bsc#1186827)</changelog>
  <changelog author="pmonreal@suse.com" date="1602849600">- Fix iostat -y switch results [bsc#1177747]
- Add sysstat-12.1.6-iostat-y-option.diff</changelog>
  <changelog author="david.anes@suse.com" date="1643889600">- Fix possible segfault in read_task_stats() [bsc#1194679]
- Add sysstat-fix-segfault-in-read_task_stats.patch</changelog>
</package>
<package pkgid="fecab7b2c27ed24eb6c26c888174f4ef83d924cdd6c5221001849d0fbe5b23f5" name="sysstat-isag" arch="s390x">
  <version epoch="0" ver="12.0.2" rel="3.33.1"/>
  <changelog author="ro@suse.de" date="1464091200">- skip libsensors on s390/s390x</changelog>
  <changelog author="tchvatal@suse.com" date="1487505600">- Update to 11.4.3 release
  * check the CHANGES file for detailed informations, too long
- Refresh patches:
  * sysstat-8.0.4-sysconfdir.diff
  * sysstat-8.1.6-sa1sa2lock.diff
- Remove patch that was converted to sed:
  * sysstat-9.0.4-no-build-date.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1490961600">- Properly specify you want to be started by multi-user.target
  bsc#1031674</changelog>
  <changelog author="mpluskal@suse.com" date="1509624000">- Update to version 11.6.1
  * See provided CHANGES for detailed list of changes
- Refresh patches:
  * sysstat-8.0.4-pagesize.diff
  * sysstat-8.0.4-sysconfdir.diff
  * sysstat-8.1.6-sa1sa2lock.diff
- Drop no longer needed
  * sysstat-8.0.4-sysconfdir.diff</changelog>
  <changelog author="fcrozat@suse.com" date="1524744000">- Remove Requires on update-desktop-files on subpackage, it is
  useless.</changelog>
  <changelog author="tchvatal@suse.com" date="1524830400">- Version update to 11.6.3:
  * A possible crash related to the new binary format used by sar, which could
    happen when buffers needed to be reallocated to accomodate more devices
    added to the system,
  * The %CPU value displayed by pidstat for processes using more than 100%
    of a core.</changelog>
  <changelog author="tchvatal@suse.com" date="1529582400">- Version update to 11.6.4:
  * The number of decimal places used by sysstat commands (sar, cifsiostat, iostat, mpstat and pidstat),
  * The network interfaces, block devices and filesystems for which statistics shall be displayed by sar or sadf.</changelog>
  <changelog author="tchvatal@suse.com" date="1534248000">- Update to 11.6.5:
  * sadf: SVG: Display graphs for swap utilization in packed mode.
  * sadf: SVG: Don't take into account activities with no graphs when
    calculating canvas height.
  * sadf: SVG: Don't insert a gap in SVG output if an activity is not
    displayed.
  * sadf: SVG: Fix possible negative value in graphs coordinates.</changelog>
  <changelog author="tchvatal@suse.com" date="1534248001">- Version update to 12.0.1:
  * sadf: SVG: Remove id tag from individual graphs. Use activities
    identification numbers for id tags.
  * sadf: SVG: Add new option "showtoc", which can be used to display
    the list of activities for which there are graphs ("table of
    contents").
  * sadf: SVG: Improve output for softnet activity: Add a discontinuity in
    graph when corresponding CPU is marked offline.
  * sadf: SVG: Improve function used to assess SVG canvas height.
  * sadf: SVG: Fix core dumped on buffers reallocation.
  * sar/sadf: Devices list management code refactoring.
  * sa_conv.c: Use write_all() function instead of write() to handle possible
    signal interruptions.
  * spec file updated: No longer create a debug package.
  * Remove many warnings from gcc v7/v8.
  * README file updated.
  * Manual pages updated.</changelog>
  <changelog author="tchvatal@suse.com" date="1539691200">- Up to 12.0.2: (fate#326576, bsc#1089883)
  * This version mainly includes bugfixes
- Dropped patches for SLE-12, fixed upstream:
  * sysstat-10.2.1-iostat-sar-util.patch
  * sysstat-10.2.1-sar-ifutil.patch
  * sysstat-10.2.6-fix-json-with-file-utc-time.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1543320000">- Security fixes:
  * The remap_struct function in sa_common.c has an out-of-bounds
    read during a memmove call [CVE-2018-19416, bsc#1117001]
  * The remap_struct function in sa_common.c has an out-of-bounds read
    during a memset call [CVE-2018-19517, bsc#1117260]
  * Added patch sysstat-12.0.2-CVE-2018-19416-and-CVE-2018-19517.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1561377600">- Fix scaling issue with mtab symlinks and automounter [bsc#1138767]
  * Added sysstat-mtab-symlinks-and-automounter.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1563883200">- Remove deprecated Require gettext and require gettext-runtime only
  during build [bsc#1142470]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1568116800">- Security fix: [bsc#1150114, CVE-2019-16167]
  * Memory corruption due to an Integer Overflow in remap_struct()
    in sa_common.c
  * Added sysstat-CVE-2019-16167.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1572436800">- Enable log information on service start/stop [bsc#1144923, jsc#SLE-5958]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1576152000">- Security fix: [bsc#1159104, CVE-2019-19725]
  * Double free in check_file_actlst in sa_common.c
- Add sysstat-CVE-2019-19725.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1600430400">- Fix average iowait output of sar [bsc#1174227]
  * The iowait value reported by the kernel can also decrement as
    a result of inaccurate iowait tracking. Waiting on IO can be
    first accounted as iowait but then instead as idle. Therefore
    if the idle value during the same period did not decrease then
    consider this is a problem with the iowait reporting and correct
    the previous value according to the new reading. Otherwise, treat
    this as CPU coming back online.
- Add patch sysstat-iowait-decr.patch</changelog>
  <changelog author="kukuk@suse.com" date="1601726400">- Don't hard require systemd, it works without,too. (bsc#1186827)</changelog>
  <changelog author="pmonreal@suse.com" date="1602849600">- Fix iostat -y switch results [bsc#1177747]
- Add sysstat-12.1.6-iostat-y-option.diff</changelog>
  <changelog author="david.anes@suse.com" date="1643889600">- Fix possible segfault in read_task_stats() [bsc#1194679]
- Add sysstat-fix-segfault-in-read_task_stats.patch</changelog>
</package>
<package pkgid="da6140922c4bfafefa832ca676c464ba63924eebec93d8446cc841cebdb7c250" name="sysstat-isag" arch="x86_64">
  <version epoch="0" ver="12.0.2" rel="3.33.1"/>
  <changelog author="ro@suse.de" date="1464091200">- skip libsensors on s390/s390x</changelog>
  <changelog author="tchvatal@suse.com" date="1487505600">- Update to 11.4.3 release
  * check the CHANGES file for detailed informations, too long
- Refresh patches:
  * sysstat-8.0.4-sysconfdir.diff
  * sysstat-8.1.6-sa1sa2lock.diff
- Remove patch that was converted to sed:
  * sysstat-9.0.4-no-build-date.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1490961600">- Properly specify you want to be started by multi-user.target
  bsc#1031674</changelog>
  <changelog author="mpluskal@suse.com" date="1509624000">- Update to version 11.6.1
  * See provided CHANGES for detailed list of changes
- Refresh patches:
  * sysstat-8.0.4-pagesize.diff
  * sysstat-8.0.4-sysconfdir.diff
  * sysstat-8.1.6-sa1sa2lock.diff
- Drop no longer needed
  * sysstat-8.0.4-sysconfdir.diff</changelog>
  <changelog author="fcrozat@suse.com" date="1524744000">- Remove Requires on update-desktop-files on subpackage, it is
  useless.</changelog>
  <changelog author="tchvatal@suse.com" date="1524830400">- Version update to 11.6.3:
  * A possible crash related to the new binary format used by sar, which could
    happen when buffers needed to be reallocated to accomodate more devices
    added to the system,
  * The %CPU value displayed by pidstat for processes using more than 100%
    of a core.</changelog>
  <changelog author="tchvatal@suse.com" date="1529582400">- Version update to 11.6.4:
  * The number of decimal places used by sysstat commands (sar, cifsiostat, iostat, mpstat and pidstat),
  * The network interfaces, block devices and filesystems for which statistics shall be displayed by sar or sadf.</changelog>
  <changelog author="tchvatal@suse.com" date="1534248000">- Update to 11.6.5:
  * sadf: SVG: Display graphs for swap utilization in packed mode.
  * sadf: SVG: Don't take into account activities with no graphs when
    calculating canvas height.
  * sadf: SVG: Don't insert a gap in SVG output if an activity is not
    displayed.
  * sadf: SVG: Fix possible negative value in graphs coordinates.</changelog>
  <changelog author="tchvatal@suse.com" date="1534248001">- Version update to 12.0.1:
  * sadf: SVG: Remove id tag from individual graphs. Use activities
    identification numbers for id tags.
  * sadf: SVG: Add new option "showtoc", which can be used to display
    the list of activities for which there are graphs ("table of
    contents").
  * sadf: SVG: Improve output for softnet activity: Add a discontinuity in
    graph when corresponding CPU is marked offline.
  * sadf: SVG: Improve function used to assess SVG canvas height.
  * sadf: SVG: Fix core dumped on buffers reallocation.
  * sar/sadf: Devices list management code refactoring.
  * sa_conv.c: Use write_all() function instead of write() to handle possible
    signal interruptions.
  * spec file updated: No longer create a debug package.
  * Remove many warnings from gcc v7/v8.
  * README file updated.
  * Manual pages updated.</changelog>
  <changelog author="tchvatal@suse.com" date="1539691200">- Up to 12.0.2: (fate#326576, bsc#1089883)
  * This version mainly includes bugfixes
- Dropped patches for SLE-12, fixed upstream:
  * sysstat-10.2.1-iostat-sar-util.patch
  * sysstat-10.2.1-sar-ifutil.patch
  * sysstat-10.2.6-fix-json-with-file-utc-time.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1543320000">- Security fixes:
  * The remap_struct function in sa_common.c has an out-of-bounds
    read during a memmove call [CVE-2018-19416, bsc#1117001]
  * The remap_struct function in sa_common.c has an out-of-bounds read
    during a memset call [CVE-2018-19517, bsc#1117260]
  * Added patch sysstat-12.0.2-CVE-2018-19416-and-CVE-2018-19517.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1561377600">- Fix scaling issue with mtab symlinks and automounter [bsc#1138767]
  * Added sysstat-mtab-symlinks-and-automounter.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1563883200">- Remove deprecated Require gettext and require gettext-runtime only
  during build [bsc#1142470]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1568116800">- Security fix: [bsc#1150114, CVE-2019-16167]
  * Memory corruption due to an Integer Overflow in remap_struct()
    in sa_common.c
  * Added sysstat-CVE-2019-16167.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1572436800">- Enable log information on service start/stop [bsc#1144923, jsc#SLE-5958]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1576152000">- Security fix: [bsc#1159104, CVE-2019-19725]
  * Double free in check_file_actlst in sa_common.c
- Add sysstat-CVE-2019-19725.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1600430400">- Fix average iowait output of sar [bsc#1174227]
  * The iowait value reported by the kernel can also decrement as
    a result of inaccurate iowait tracking. Waiting on IO can be
    first accounted as iowait but then instead as idle. Therefore
    if the idle value during the same period did not decrease then
    consider this is a problem with the iowait reporting and correct
    the previous value according to the new reading. Otherwise, treat
    this as CPU coming back online.
- Add patch sysstat-iowait-decr.patch</changelog>
  <changelog author="kukuk@suse.com" date="1601726400">- Don't hard require systemd, it works without,too. (bsc#1186827)</changelog>
  <changelog author="pmonreal@suse.com" date="1602849600">- Fix iostat -y switch results [bsc#1177747]
- Add sysstat-12.1.6-iostat-y-option.diff</changelog>
  <changelog author="david.anes@suse.com" date="1643889600">- Fix possible segfault in read_task_stats() [bsc#1194679]
- Add sysstat-fix-segfault-in-read_task_stats.patch</changelog>
</package>
<package pkgid="aab27aa956a99de31cfc5928e1480b2cacdbe4e17c1f802d8ef224d390b4ffb4" name="systemd" arch="src">
  <version epoch="0" ver="234" rel="24.105.1"/>
  <changelog author="fbui@suse.com" date="1621512000">- Expect 644 permissions for /usr/lib/udev/compat-symlink-generation (bsc#1185807)</changelog>
  <changelog author="fbui@suse.com" date="1622116800">- udev requires systemd in its %post (bsc#1185958)
  udevadm, called in udev's %post, requires libsystemd-shared-xxx.so.</changelog>
  <changelog author="fbui@suse.com" date="1623844800">- Import commit 93910b81b809729afa7ff9529b45b1e67f229232
  c289e1e5ae sysusers: use the usual comment style
  f11535886f test/TEST-21-SYSUSERS: add tests for new functionality
  2f2bfa731c sysusers: allow admin/runtime overrides to command-line config
  dbd190cd3b basic/strv: add function to insert items at position
  3c7b4c67fa sysusers: allow the shell to be specified
  f316974ebe man: reformat table in sysusers.d(5)
  24113b7f00 sysusers: take configuration as positional arguments
  8232e059d8 sysusers: emit a bit more info at debug level when locking fails
  461356cfe9 sysusers: allow force reusing existing user/group IDs (#8037)
  dd9349e71a sysusers: ensure GID in uid:gid syntax exists
  5e0ab33e59 sysusers: make ADD_GROUP always create a group
  0dd4a69687 test: add TEST-21-SYSUSERS test
  4dea8a2774 sysuser: use OrderedHashmap
  de09744500 sysusers: allow uid:gid in sysusers.conf files
  9271c17657 meson: "conf.get(condition)" fails if condition was not defined
  These commits implement the option '--replace' for systemd-sysusers
  so %sysusers_create_package can be introduced in SLE and packages
  can rely on this rpm macro without wondering whether the macro is
  available on the different target the package is submitted to.</changelog>
  <changelog author="fbui@suse.com" date="1624017600">- Import commit f6f87c1cb4119c41f6fb93702e03cec794829b7c
  d7ed4af259 mount-util: shorten the loop a bit (#7545)
  cdf9cbb509 mount-util: do not use the official MAX_HANDLE_SZ (#7523)
  bbcc63a032 mount-util: tape over name_to_handle_at() flakiness (#7517) (bsc#1184761)
  d44adc63ab test: fix test-mount-util when handling duplicate mounts on the same location
  7c74260899 mount-util: fix bad indenting
  c4ef3248e2 mount-util: EOVERFLOW might have other causes than buffer size issues
  3f3eb23ccb mount-util: fix error propagation in fd_fdinfo_mnt_id()
  9f170ee221 mount-util: drop exponential buffer growing in name_to_handle_at_loop()
  5c709e7b31 udev: port udev_has_devtmpfs() to use path_get_mnt_id()
  ac57cefcb9 mount-util: add new path_get_mnt_id() call that queries the mnt ID of a path
  e49d88b898 mount-util: add name_to_handle_at_loop() wrapper around name_to_handle_at()
  060b1db043 core: fix output (logging) for mount units (#7603) (bsc#1187400)</changelog>
  <changelog author="fbui@suse.com" date="1624017601">- Create /run/lock/subsys again (bsc#1187292)
  The creation of this directory was mistakenly dropped when
  'filesystem' package took the initialization of the generic paths
  over.
  Paths under /run/lock are still managed by systemd for lack of
  better place.</changelog>
  <changelog author="aherrmann@suse.com" date="1625227200">- Added fix for bsc#1184994 to skip udev rules if 'elevator=' is used</changelog>
  <changelog author="fbui@suse.com" date="1625745600">- Added patches to fix CVE-2021-33910 (bsc#1188063)
  Added 1001-unit-name-tighten-checks-for-building-valid-unit-nam.patch
  Added 1002-unit-name-generate-a-clear-error-code-when-convertin.patch
  Added 1003-basic-unit-name-do-not-use-strdupa-on-a-path.patch
  Added 1004-basic-unit-name-adjust-comments.patch
  These patches will be moved to the git repo once the bug will become
  public.</changelog>
  <changelog author="fbui@suse.com" date="1626436800">- Allow the systemd sysusers config files to be overriden during
  system installation (bsc#1171962).
- While at it, add a comment to explain why we don't use
  %sysusers_create in %pre and why it should be safe in %post.</changelog>
  <changelog author="fbui@suse.com" date="1627560000">- Avoid the error message when udev is updated due to udev being
  already active when the sockets are started again (bsc#1188291)</changelog>
  <changelog author="fbui@suse.com" date="1630670400">- Make sure the versions of both udev and systemd packages are always the same (bsc#1189480)</changelog>
  <changelog author="mwilck@suse.com" date="1631275200">- Update 60-io-scheduler.rules (jsc#SLE-21032, bsc#1134353)
  * rules weren't applied to dm devices (multipath), fix it
    (bsc#1188713)
  * ignore obsolete "elevator" kernel parameter (bsc#1184994, bsc#1190234)
    ("elevator" did falsely overide settings even for blk-mq, fixed).</changelog>
  <changelog author="fbui@suse.com" date="1631707200">- Import commit dc982a577e6d3eea8832083f470e48f6fbf227cc
  ddc6c90310 basic/unit-name: adjust comments
  390bc4e04f basic/unit-name: do not use strdupa() on a path (bsc#1188063 CVE-2021-33910)
  b83b235cac unit-name: generate a clear error code when converting an overly long fs path to a unit name
  4fd60931a5 unit-name: tighten checks for building valid unit names
  513c103faf manager: reexecute on SIGRTMIN+25, user instances only
  ff761f71a9 logind: terminate cleanly on SIGTERM/SIGINT (bsc#1188018)
  b236f23d9d units: make fsck/grows/makefs/makeswap units conflict against shutdown.target
- Dropped 1001-unit-name-tighten-checks-for-building-valid-unit-nam.patch
  Dropped 1002-unit-name-generate-a-clear-error-code-when-convertin.patch
  Dropped 1003-basic-unit-name-do-not-use-strdupa-on-a-path.patch
  Dropped 1004-basic-unit-name-adjust-comments.patch
  These patches have been merged in branch SUSE/v234.</changelog>
  <changelog author="fbui@suse.com" date="1634644800">- Import commit 5acd9826521306d7b312826135afe491bd889a29
  df05d5b906 shutdown: Reduce log level of unmounts (bsc#1191252)
  31f2b51c18 umount: Don't bother remounting api and ro filesystems read-only
  4914963481 umount: Provide the same mount flags too when remounting read-only
  04463997a7 umount: Decide whether to remount read-only earlier
  143aed644f umount: Add more asserts and remove some unused arguments
  09c7ad555d umount: Fix memory leak
  1899743f50 shutdown: explicitly set a log target in shutdown.c
  a66287c2fe test: add tests for mount_option_mangle()
  036077c2a0 mount-util: add mount_option_mangle()
  e90a30bc86 dissect: automatically mark partitions read-only that have a read-only file system
  b09a5f1835 build-sys: require libmount &gt;= 2.30 (#6795)
  2679668b86 systemd-shutdown: use log_set_prohibit_ipc(true)
  32625253bc rationalize interface for opening/closing logging
  46774b1d21 pid1: when we can't log to journal, remember our fallback log target
  cd994c1e81 log: remove LOG_TARGET_SAFE pseudo log target
  8d4ec9ec2e log: add brief comment for log_set_open_when_needed() and log_set_always_reopen_console()
  a914dd2003 pid1: make use of new "prohibit_ipc" logging flag in PID 1 (bsc#1189803)
  496668c670 log: add new "prohibit_ipc" flag to logging system
  9df8261e38 log: make log_set_upgrade_syslog_to_journal() take effect immediately
  15b3fcf953 mount-util: fix fd_is_mount_point() when both the parent and directory are network fs (bsc#1190984)
  1898f668dd core: rework how we connect to the bus (bsc#1190325)
  22a4287477 dbus: split up bus_done() into seperate functions
  42ce096d80 machine-id-setup: generate machine-id from DMI product ID on Amazon EC2
  39ea02b718 virt: detect Amazon EC2 Nitro instance (bsc#1190440)
  ef0253c6e5 virt: if we detect Xen by DMI, trust that over CPUID</changelog>
  <changelog author="fbui@suse.com" date="1635249600">- Import commit d126915ede24b052216ca940155ea5531970aa95
  f2cf0ac034 busctl: use usec granularity for the timestamp printed by the busctl monitor command (jsc#SLE-21862 jsc#SLE-18102 jsc#SLE-18103)</changelog>
  <changelog author="mwilck@suse.com" date="1636459200">- Fix IO scheduler udev rules
  * 60-io-scheduler.rules: don't use BFQ for real multiqueue devices
    (jsc#SLE-21032, bsc#1192161)
  * 60-io-scheduler.rules: use "none" for multipath components
    (bsc#1192161)</changelog>
  <changelog author="fbui@suse.com" date="1636459201">- Import commit 43e57122ef9856db4ec4a8a2758bc8f73d2d1835
  1a6747aa01 umount: show correct error message
  e4b8a01ca5 core/umount: fix unitialized fields in MountPoint in dm_list_get()</changelog>
  <changelog author="fbui@suse.com" date="1636459202">- Add 0001-core-prevent-bus_init_api-from-being-called-recursiv.patch</changelog>
  <changelog author="fbui@suse.com" date="1639396800">- Import commit d38785e9adcf79c9729b94ef9f21185dd5a6d35f
  e1e30f53f2 Revert "core: rework how we connect to the bus" (bsc#1193521 bsc#1193481)
  3463e3178c sleep-config: partitions can't be deleted, only files can
  e9e021b3b9 shared/sleep-config: exclude zram devices from hibernation candidates
- Drop 0001-core-prevent-bus_init_api-from-being-called-recursiv.patch
  This patch is no more needed since it was a follow-up for "core: rework how we
  connect to the bus", which has been reverted.</changelog>
  <changelog author="mwilck@suse.com" date="1640001600">* 60-io-scheduler.rules: add rules for virtual devices
    (boo#1193759)
  * 60-io-scheduler.rules: enforce "none" for loop devices
    (boo#1193759)</changelog>
  <changelog author="fbui@suse.com" date="1643198400">- Import commit c46bcb2df93c802f43e240ceb96eaf28027808a8
  28e379cc21 systemctl: exit with 1 if no unit files found (bsc#1193841)</changelog>
</package>
<package pkgid="f54b44ab2c69e7d20a184bc08b97ea5a7f15df7d41b6045928205ae66a1556c7" name="systemd" arch="src">
  <version epoch="0" ver="246.16" rel="150300.7.39.1"/>
  <changelog author="fbui@suse.com" date="1626868800">- Import commit 8d8f5fc31eece95644b299b784bbfb8f836d0108 (merge of v246.15)
  cfd14c6537 basic/unit-name: do not use strdupa() on a path (bsc#1188063 CVE-2021-33910)
  7b6b7abf46 unit-name: generate a clear error code when converting an overly long fs path to a unit name
  [...]
  For a complete list of changes, visit:
  https://github.com/openSUSE/systemd/compare/b9e4f4c71159b216a16f1c5121134aee2654be56...8d8f5fc31eece95644b299b784bbfb8f836d0108
- Drop 6000-unit-name-generate-a-clear-error-code-when-convertin.patch
  and 6001-basic-unit-name-do-not-use-strdupa-on-a-path.patch as they
  were merged in v246.15.
- Drop 6002-basic-unit-name-adjust-comments.patch as it was merged in
  branch SUSE/v246.</changelog>
  <changelog author="fbui@suse.com" date="1627560000">- Avoid the error message when udev is updated due to udev being
  already active when the sockets are started again (bsc#1188291)</changelog>
  <changelog author="fbui@suse.com" date="1630497600">- Import commit f5c33d9f82d3d782d28938df9ff09484360c540d (merge of v246.16)
  For a complete list of changes, visit:
  https://github.com/openSUSE/systemd/compare/8d8f5fc31eece95644b299b784bbfb8f836d0108...f5c33d9f82d3d782d28938df9ff09484360c540d</changelog>
  <changelog author="fbui@suse.com" date="1630670400">- Make sure the versions of both udev and systemd packages are always the same (bsc#1189480)</changelog>
  <changelog author="martin.wilck@suse.com" date="1631275200">- Update 60-io-scheduler.rules (jsc#SLE-21032, bsc#1134353)
  * rules weren't applied to dm devices (multipath), fix it
    (bsc#1188713)
  * ignore obsolete "elevator" kernel parameter (bsc#1184994)
    ("elevator" did falsely overide settings even for blk-mq, fixed).
  * remove support for single-queue block IO which the kernel doesn't
    support any more.</changelog>
  <changelog author="fbui@suse.com" date="1631275201">- Drop 1007-tmpfiles-follow-SUSE-policies.patch
  Since most of the tmpfiles config files shipped by upstream are
  ignored (see previous commit "Drop most of the tmpfiles that deal
  with generic paths"), this patch is no more relevant.</changelog>
  <changelog author="fbui@suse.com" date="1631707200">- Import commit 263f7076bc77475045193653a785bbdc0457b5c6
  239e0ce5e7 journalctl: never fail at flushing when the flushed flag is set (bsc#1188588)
  0db7e590e1 manager: reexecute on SIGRTMIN+25, user instances only
  ef8afc4545 core: Make sure cgroup_oom_queue is flushed on manager exit
  f794e01080 cgroup: do 'catchup' for unit cgroup inotify watch files
  54369b7660 manager: Fix HW watchdog when systemd starts before driver loaded (bsc#1189446)
  1d0524bd54 pid1: various minor watchdog modernizations</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Enable support for Portable Services (jsc#SLE-21694)
  Will be released in Leap only.</changelog>
  <changelog author="fbui@suse.com" date="1635336000">- Import commit 5d20af26eee6507bfa9fdb6e5dd4bfc187e3399e
  37e021ee84 mount-util: fix fd_is_mount_point() when both the parent and directory are network fs (bsc#1190984)
  2aee16afd0 mountpoint-util: rebreak some comments
  962e487cb4 virt: Support detection for ARM64 Hyper-V guests (bsc#1186071)
  8545a66afd Use BIOS characteristics to distinguish EC2 bare-metal from VMs
  03311b59c3 machine-id-setup: generate machine-id from DMI product ID on Amazon EC2
  0fc3118a67 id128-util: use common implementation of helper to get/validate product ID
  83bfa06ebc virt: detect Amazon EC2 Nitro instance (bsc#1190440)
  e8b8df3ed9 core: move several source files to src/shared</changelog>
  <changelog author="fbui@suse.com" date="1635422400">- Import commit f2f061f1da064bfd47e2201967a854bb9281ca5b
  98e87fc3fd busctl: use usec granularity for the timestamp printed by the busctl monitor command (jsc#SLE-17798)</changelog>
  <changelog author="mwilck@suse.com" date="1636459200">- Fix IO scheduler udev rules
  * 60-io-scheduler.rules: don't use BFQ for real multiqueue devices
    (jsc#SLE-21032, bsc#1192161)
  * 60-io-scheduler.rules: use "none" for multipath components
    (bsc#1192161)</changelog>
  <changelog author="fbui@suse.com" date="1639396800">- Import commit 34eba0c28cb02d15fdbf55ce28bdfa56142ae4d1
  0a8cb60af6 Bump the max number of inodes for /dev to a million (bsc#1192858)
  848c9207cb Bump the max number of inodes for /dev to 128k (bsc#1192858)
  ea44eb34f2 sleep: don't skip resume device with low priority/available space (bsc#1192423)
  9325a68316 test: use kbd-mode-map we ship in one more test case
  8ff379e11d test-keymap-util: always use kbd-model-map we ship</changelog>
  <changelog author="mwilck@suse.com" date="1640001600">* 60-io-scheduler.rules: add rules for virtual devices
    (boo#1193759)
  * 60-io-scheduler.rules: enforce "none" for loop devices
    (boo#1193759)</changelog>
  <changelog author="fbui@suse.com" date="1641297600">- Suppress PAM warning when the credentials for user@.service service are
  established (bsc#1190515)
  systemd-user PAM service needs to define a default implementation of
  pam_setcred() otherwise the fallback (defined by /etc/pam.d/other) is used,
  which consists of pam_warn.so + pam_deny.so, and will throw a warning each
  time a user logs in.
  The new default simply consists in calling pam_deny.so alone.</changelog>
  <changelog author="fbui@suse.com" date="1641470400">- Import commit 3850086c6580291188fe574ad37c8026012894fb
  c0505cbb8d tmpfiles: 'st' may have been used uninitialized
  d3f7c9e806 macro: add new helper RET_NERRNO()
  4a95baa5de rm-rf: optionally fsync() after removing directory tree
  dd8137a589 rm-rf: refactor rm_rf_children(), split out body of directory iteration loop
  3f8765ed2c rm-rf: fstatat() might fail if containing dir has limited access mode, patch that too
  87d39407b7 btrfs-util: add helper that abstracts "might be btrfs subvol?" check
  71ed335c7a rm-rf: add new flag REMOVE_CHMOD
  611376f830 rules: don't ignore Xen virtual interfaces anymore (bsc#1178561)
  All these commits except the last one (611376f830) are preparation for
  CVE-2021-3997.
- Drop 0001-rules-don-t-ignore-Xen-interfaces-anymore.patch
  It's been merged in the git repo (commit 611376f830).</changelog>
  <changelog author="fbui@suse.com" date="1641470401">- Added patches to fix CVE-2021-3997 (bsc#1194178)
  5000-shared-rm_rf-refactor-rm_rf_children_inner-to-shorte.patch
  5001-shared-rm_rf-refactor-rm_rf-to-shorten-code-a-bit.patch
  5002-shared-rm-rf-loop-over-nested-directories-instead-of.patch
  These patches will be moved to the git repo once the bug will become
  public.</changelog>
  <changelog author="fbui@suse.com" date="1641816000">- Add 1009-drop-or-soften-deprecation-warnings.patch (bsc#1193086)</changelog>
  <changelog author="fbui@suse.com" date="1643198400">- resolved: disable DNSSEC until the following issue is solved:
  https://github.com/systemd/systemd/issues/10579
- resolved: disable fallback DNS servers and fail when no DNS server info could
  be obtained from the links. It's better to let the sysadmin know that
  something is likely misconfigured rather than silently handing over the DNS
  queries to Google or Cloudflare.
- resolved: DNSSEC support (build) requires openssl therefore document this
  build dependency in systemd-network sub-package.</changelog>
  <changelog author="fbui@suse.com" date="1643371200">- Import commit 6a96632f26f20a68578f9d620a593ceab2a0e3b6
  c4aa40982c shared/rm-rf: loop over nested directories instead of instead of recursing (CVE-2021-3997 bsc#1194178)
  ae13ea6511 shared/rm_rf: refactor rm_rf() to shorten code a bit
  3266d7f5c8 shared/rm_rf: refactor rm_rf_children_inner() to shorten code a bit
- Drop 5000-shared-rm_rf-refactor-rm_rf_children_inner-to-shorte.patch
  Drop 5001-shared-rm_rf-refactor-rm_rf-to-shorten-code-a-bit.patch
  Drop 5002-shared-rm-rf-loop-over-nested-directories-instead-of.patch
  They have been merged into 'SUSE/v246' branch.</changelog>
  <changelog author="fbui@suse.com" date="1643889600">- Import commit 773652879446a81689c39aea23a486627992409b
  a76263ced9 meson: allow extra net naming schemes to be defined during configuration
  301bf4f1bf meson: drop the list of valid net naming schemes
  b89924793d netif-naming: inline one iterator variable
  da4a4df29c udev: fix potential memleak
  d60486bf1b udev: allow onboard index up to 65535
  ac2baecc84 udev: use snprintf_ok()
  8aad315c7c udev: fix potential infinite loop
  471ea73eb0 udev: make dev_pci_slot() return earlier when PCI bridge is found
  69b7c9a6bd udev: use uint32_t for hotplug_slot
  cdd0e89c0e udev: split out logic of parsing s390 PCI slots
  84e1a91baa udev: it is not necessary that the path is readable
  03548e8d0e udev: add missing initialization to fix freeing invalid address
  772f964bf6 udev: fix slot based network names on s390
  c5071cf699 tree-wide: fix typo
  06640d06df net_id: fix newly added naming scheme name
  58f9592f1f udev/net_id: don't generate slot based names if multiple devices might claim the same slot (bsc#1192637)
  df9e240c92 udev/net_id: parse _SUN ACPI index as a signed integer
  cfcaddfa74 localectl: don't omit keymaps files that are symlinks (bsc#1191826)
- Add 6000-udev-net_id-add-debug-logging-for-construction-of-de.patch</changelog>
</package>
<package pkgid="0a5412b9ab5fe8331678356f3f3055c796ac1e25d72835b74c08f5ac6ed5874a" name="systemd-bash-completion" arch="noarch">
  <version epoch="0" ver="234" rel="24.105.1"/>
  <changelog author="fbui@suse.com" date="1621512000">- Expect 644 permissions for /usr/lib/udev/compat-symlink-generation (bsc#1185807)</changelog>
  <changelog author="fbui@suse.com" date="1622116800">- udev requires systemd in its %post (bsc#1185958)
  udevadm, called in udev's %post, requires libsystemd-shared-xxx.so.</changelog>
  <changelog author="fbui@suse.com" date="1623844800">- Import commit 93910b81b809729afa7ff9529b45b1e67f229232
  c289e1e5ae sysusers: use the usual comment style
  f11535886f test/TEST-21-SYSUSERS: add tests for new functionality
  2f2bfa731c sysusers: allow admin/runtime overrides to command-line config
  dbd190cd3b basic/strv: add function to insert items at position
  3c7b4c67fa sysusers: allow the shell to be specified
  f316974ebe man: reformat table in sysusers.d(5)
  24113b7f00 sysusers: take configuration as positional arguments
  8232e059d8 sysusers: emit a bit more info at debug level when locking fails
  461356cfe9 sysusers: allow force reusing existing user/group IDs (#8037)
  dd9349e71a sysusers: ensure GID in uid:gid syntax exists
  5e0ab33e59 sysusers: make ADD_GROUP always create a group
  0dd4a69687 test: add TEST-21-SYSUSERS test
  4dea8a2774 sysuser: use OrderedHashmap
  de09744500 sysusers: allow uid:gid in sysusers.conf files
  9271c17657 meson: "conf.get(condition)" fails if condition was not defined
  These commits implement the option '--replace' for systemd-sysusers
  so %sysusers_create_package can be introduced in SLE and packages
  can rely on this rpm macro without wondering whether the macro is
  available on the different target the package is submitted to.</changelog>
  <changelog author="fbui@suse.com" date="1624017600">- Import commit f6f87c1cb4119c41f6fb93702e03cec794829b7c
  d7ed4af259 mount-util: shorten the loop a bit (#7545)
  cdf9cbb509 mount-util: do not use the official MAX_HANDLE_SZ (#7523)
  bbcc63a032 mount-util: tape over name_to_handle_at() flakiness (#7517) (bsc#1184761)
  d44adc63ab test: fix test-mount-util when handling duplicate mounts on the same location
  7c74260899 mount-util: fix bad indenting
  c4ef3248e2 mount-util: EOVERFLOW might have other causes than buffer size issues
  3f3eb23ccb mount-util: fix error propagation in fd_fdinfo_mnt_id()
  9f170ee221 mount-util: drop exponential buffer growing in name_to_handle_at_loop()
  5c709e7b31 udev: port udev_has_devtmpfs() to use path_get_mnt_id()
  ac57cefcb9 mount-util: add new path_get_mnt_id() call that queries the mnt ID of a path
  e49d88b898 mount-util: add name_to_handle_at_loop() wrapper around name_to_handle_at()
  060b1db043 core: fix output (logging) for mount units (#7603) (bsc#1187400)</changelog>
  <changelog author="fbui@suse.com" date="1624017601">- Create /run/lock/subsys again (bsc#1187292)
  The creation of this directory was mistakenly dropped when
  'filesystem' package took the initialization of the generic paths
  over.
  Paths under /run/lock are still managed by systemd for lack of
  better place.</changelog>
  <changelog author="aherrmann@suse.com" date="1625227200">- Added fix for bsc#1184994 to skip udev rules if 'elevator=' is used</changelog>
  <changelog author="fbui@suse.com" date="1625745600">- Added patches to fix CVE-2021-33910 (bsc#1188063)
  Added 1001-unit-name-tighten-checks-for-building-valid-unit-nam.patch
  Added 1002-unit-name-generate-a-clear-error-code-when-convertin.patch
  Added 1003-basic-unit-name-do-not-use-strdupa-on-a-path.patch
  Added 1004-basic-unit-name-adjust-comments.patch
  These patches will be moved to the git repo once the bug will become
  public.</changelog>
  <changelog author="fbui@suse.com" date="1626436800">- Allow the systemd sysusers config files to be overriden during
  system installation (bsc#1171962).
- While at it, add a comment to explain why we don't use
  %sysusers_create in %pre and why it should be safe in %post.</changelog>
  <changelog author="fbui@suse.com" date="1627560000">- Avoid the error message when udev is updated due to udev being
  already active when the sockets are started again (bsc#1188291)</changelog>
  <changelog author="fbui@suse.com" date="1630670400">- Make sure the versions of both udev and systemd packages are always the same (bsc#1189480)</changelog>
  <changelog author="mwilck@suse.com" date="1631275200">- Update 60-io-scheduler.rules (jsc#SLE-21032, bsc#1134353)
  * rules weren't applied to dm devices (multipath), fix it
    (bsc#1188713)
  * ignore obsolete "elevator" kernel parameter (bsc#1184994, bsc#1190234)
    ("elevator" did falsely overide settings even for blk-mq, fixed).</changelog>
  <changelog author="fbui@suse.com" date="1631707200">- Import commit dc982a577e6d3eea8832083f470e48f6fbf227cc
  ddc6c90310 basic/unit-name: adjust comments
  390bc4e04f basic/unit-name: do not use strdupa() on a path (bsc#1188063 CVE-2021-33910)
  b83b235cac unit-name: generate a clear error code when converting an overly long fs path to a unit name
  4fd60931a5 unit-name: tighten checks for building valid unit names
  513c103faf manager: reexecute on SIGRTMIN+25, user instances only
  ff761f71a9 logind: terminate cleanly on SIGTERM/SIGINT (bsc#1188018)
  b236f23d9d units: make fsck/grows/makefs/makeswap units conflict against shutdown.target
- Dropped 1001-unit-name-tighten-checks-for-building-valid-unit-nam.patch
  Dropped 1002-unit-name-generate-a-clear-error-code-when-convertin.patch
  Dropped 1003-basic-unit-name-do-not-use-strdupa-on-a-path.patch
  Dropped 1004-basic-unit-name-adjust-comments.patch
  These patches have been merged in branch SUSE/v234.</changelog>
  <changelog author="fbui@suse.com" date="1634644800">- Import commit 5acd9826521306d7b312826135afe491bd889a29
  df05d5b906 shutdown: Reduce log level of unmounts (bsc#1191252)
  31f2b51c18 umount: Don't bother remounting api and ro filesystems read-only
  4914963481 umount: Provide the same mount flags too when remounting read-only
  04463997a7 umount: Decide whether to remount read-only earlier
  143aed644f umount: Add more asserts and remove some unused arguments
  09c7ad555d umount: Fix memory leak
  1899743f50 shutdown: explicitly set a log target in shutdown.c
  a66287c2fe test: add tests for mount_option_mangle()
  036077c2a0 mount-util: add mount_option_mangle()
  e90a30bc86 dissect: automatically mark partitions read-only that have a read-only file system
  b09a5f1835 build-sys: require libmount &gt;= 2.30 (#6795)
  2679668b86 systemd-shutdown: use log_set_prohibit_ipc(true)
  32625253bc rationalize interface for opening/closing logging
  46774b1d21 pid1: when we can't log to journal, remember our fallback log target
  cd994c1e81 log: remove LOG_TARGET_SAFE pseudo log target
  8d4ec9ec2e log: add brief comment for log_set_open_when_needed() and log_set_always_reopen_console()
  a914dd2003 pid1: make use of new "prohibit_ipc" logging flag in PID 1 (bsc#1189803)
  496668c670 log: add new "prohibit_ipc" flag to logging system
  9df8261e38 log: make log_set_upgrade_syslog_to_journal() take effect immediately
  15b3fcf953 mount-util: fix fd_is_mount_point() when both the parent and directory are network fs (bsc#1190984)
  1898f668dd core: rework how we connect to the bus (bsc#1190325)
  22a4287477 dbus: split up bus_done() into seperate functions
  42ce096d80 machine-id-setup: generate machine-id from DMI product ID on Amazon EC2
  39ea02b718 virt: detect Amazon EC2 Nitro instance (bsc#1190440)
  ef0253c6e5 virt: if we detect Xen by DMI, trust that over CPUID</changelog>
  <changelog author="fbui@suse.com" date="1635249600">- Import commit d126915ede24b052216ca940155ea5531970aa95
  f2cf0ac034 busctl: use usec granularity for the timestamp printed by the busctl monitor command (jsc#SLE-21862 jsc#SLE-18102 jsc#SLE-18103)</changelog>
  <changelog author="mwilck@suse.com" date="1636459200">- Fix IO scheduler udev rules
  * 60-io-scheduler.rules: don't use BFQ for real multiqueue devices
    (jsc#SLE-21032, bsc#1192161)
  * 60-io-scheduler.rules: use "none" for multipath components
    (bsc#1192161)</changelog>
  <changelog author="fbui@suse.com" date="1636459201">- Import commit 43e57122ef9856db4ec4a8a2758bc8f73d2d1835
  1a6747aa01 umount: show correct error message
  e4b8a01ca5 core/umount: fix unitialized fields in MountPoint in dm_list_get()</changelog>
  <changelog author="fbui@suse.com" date="1636459202">- Add 0001-core-prevent-bus_init_api-from-being-called-recursiv.patch</changelog>
  <changelog author="fbui@suse.com" date="1639396800">- Import commit d38785e9adcf79c9729b94ef9f21185dd5a6d35f
  e1e30f53f2 Revert "core: rework how we connect to the bus" (bsc#1193521 bsc#1193481)
  3463e3178c sleep-config: partitions can't be deleted, only files can
  e9e021b3b9 shared/sleep-config: exclude zram devices from hibernation candidates
- Drop 0001-core-prevent-bus_init_api-from-being-called-recursiv.patch
  This patch is no more needed since it was a follow-up for "core: rework how we
  connect to the bus", which has been reverted.</changelog>
  <changelog author="mwilck@suse.com" date="1640001600">* 60-io-scheduler.rules: add rules for virtual devices
    (boo#1193759)
  * 60-io-scheduler.rules: enforce "none" for loop devices
    (boo#1193759)</changelog>
  <changelog author="fbui@suse.com" date="1643198400">- Import commit c46bcb2df93c802f43e240ceb96eaf28027808a8
  28e379cc21 systemctl: exit with 1 if no unit files found (bsc#1193841)</changelog>
</package>
<package pkgid="4bb977c36a026f61cbb4ed8fd7b35785dd8ceab90e362ab3ce83295888da2b66" name="systemd-logger" arch="aarch64">
  <version epoch="0" ver="246.16" rel="150300.7.39.1"/>
  <changelog author="fbui@suse.com" date="1626868800">- Import commit 8d8f5fc31eece95644b299b784bbfb8f836d0108 (merge of v246.15)
  cfd14c6537 basic/unit-name: do not use strdupa() on a path (bsc#1188063 CVE-2021-33910)
  7b6b7abf46 unit-name: generate a clear error code when converting an overly long fs path to a unit name
  [...]
  For a complete list of changes, visit:
  https://github.com/openSUSE/systemd/compare/b9e4f4c71159b216a16f1c5121134aee2654be56...8d8f5fc31eece95644b299b784bbfb8f836d0108
- Drop 6000-unit-name-generate-a-clear-error-code-when-convertin.patch
  and 6001-basic-unit-name-do-not-use-strdupa-on-a-path.patch as they
  were merged in v246.15.
- Drop 6002-basic-unit-name-adjust-comments.patch as it was merged in
  branch SUSE/v246.</changelog>
  <changelog author="fbui@suse.com" date="1627560000">- Avoid the error message when udev is updated due to udev being
  already active when the sockets are started again (bsc#1188291)</changelog>
  <changelog author="fbui@suse.com" date="1630497600">- Import commit f5c33d9f82d3d782d28938df9ff09484360c540d (merge of v246.16)
  For a complete list of changes, visit:
  https://github.com/openSUSE/systemd/compare/8d8f5fc31eece95644b299b784bbfb8f836d0108...f5c33d9f82d3d782d28938df9ff09484360c540d</changelog>
  <changelog author="fbui@suse.com" date="1630670400">- Make sure the versions of both udev and systemd packages are always the same (bsc#1189480)</changelog>
  <changelog author="martin.wilck@suse.com" date="1631275200">- Update 60-io-scheduler.rules (jsc#SLE-21032, bsc#1134353)
  * rules weren't applied to dm devices (multipath), fix it
    (bsc#1188713)
  * ignore obsolete "elevator" kernel parameter (bsc#1184994)
    ("elevator" did falsely overide settings even for blk-mq, fixed).
  * remove support for single-queue block IO which the kernel doesn't
    support any more.</changelog>
  <changelog author="fbui@suse.com" date="1631275201">- Drop 1007-tmpfiles-follow-SUSE-policies.patch
  Since most of the tmpfiles config files shipped by upstream are
  ignored (see previous commit "Drop most of the tmpfiles that deal
  with generic paths"), this patch is no more relevant.</changelog>
  <changelog author="fbui@suse.com" date="1631707200">- Import commit 263f7076bc77475045193653a785bbdc0457b5c6
  239e0ce5e7 journalctl: never fail at flushing when the flushed flag is set (bsc#1188588)
  0db7e590e1 manager: reexecute on SIGRTMIN+25, user instances only
  ef8afc4545 core: Make sure cgroup_oom_queue is flushed on manager exit
  f794e01080 cgroup: do 'catchup' for unit cgroup inotify watch files
  54369b7660 manager: Fix HW watchdog when systemd starts before driver loaded (bsc#1189446)
  1d0524bd54 pid1: various minor watchdog modernizations</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Enable support for Portable Services (jsc#SLE-21694)
  Will be released in Leap only.</changelog>
  <changelog author="fbui@suse.com" date="1635336000">- Import commit 5d20af26eee6507bfa9fdb6e5dd4bfc187e3399e
  37e021ee84 mount-util: fix fd_is_mount_point() when both the parent and directory are network fs (bsc#1190984)
  2aee16afd0 mountpoint-util: rebreak some comments
  962e487cb4 virt: Support detection for ARM64 Hyper-V guests (bsc#1186071)
  8545a66afd Use BIOS characteristics to distinguish EC2 bare-metal from VMs
  03311b59c3 machine-id-setup: generate machine-id from DMI product ID on Amazon EC2
  0fc3118a67 id128-util: use common implementation of helper to get/validate product ID
  83bfa06ebc virt: detect Amazon EC2 Nitro instance (bsc#1190440)
  e8b8df3ed9 core: move several source files to src/shared</changelog>
  <changelog author="fbui@suse.com" date="1635422400">- Import commit f2f061f1da064bfd47e2201967a854bb9281ca5b
  98e87fc3fd busctl: use usec granularity for the timestamp printed by the busctl monitor command (jsc#SLE-17798)</changelog>
  <changelog author="mwilck@suse.com" date="1636459200">- Fix IO scheduler udev rules
  * 60-io-scheduler.rules: don't use BFQ for real multiqueue devices
    (jsc#SLE-21032, bsc#1192161)
  * 60-io-scheduler.rules: use "none" for multipath components
    (bsc#1192161)</changelog>
  <changelog author="fbui@suse.com" date="1639396800">- Import commit 34eba0c28cb02d15fdbf55ce28bdfa56142ae4d1
  0a8cb60af6 Bump the max number of inodes for /dev to a million (bsc#1192858)
  848c9207cb Bump the max number of inodes for /dev to 128k (bsc#1192858)
  ea44eb34f2 sleep: don't skip resume device with low priority/available space (bsc#1192423)
  9325a68316 test: use kbd-mode-map we ship in one more test case
  8ff379e11d test-keymap-util: always use kbd-model-map we ship</changelog>
  <changelog author="mwilck@suse.com" date="1640001600">* 60-io-scheduler.rules: add rules for virtual devices
    (boo#1193759)
  * 60-io-scheduler.rules: enforce "none" for loop devices
    (boo#1193759)</changelog>
  <changelog author="fbui@suse.com" date="1641297600">- Suppress PAM warning when the credentials for user@.service service are
  established (bsc#1190515)
  systemd-user PAM service needs to define a default implementation of
  pam_setcred() otherwise the fallback (defined by /etc/pam.d/other) is used,
  which consists of pam_warn.so + pam_deny.so, and will throw a warning each
  time a user logs in.
  The new default simply consists in calling pam_deny.so alone.</changelog>
  <changelog author="fbui@suse.com" date="1641470400">- Import commit 3850086c6580291188fe574ad37c8026012894fb
  c0505cbb8d tmpfiles: 'st' may have been used uninitialized
  d3f7c9e806 macro: add new helper RET_NERRNO()
  4a95baa5de rm-rf: optionally fsync() after removing directory tree
  dd8137a589 rm-rf: refactor rm_rf_children(), split out body of directory iteration loop
  3f8765ed2c rm-rf: fstatat() might fail if containing dir has limited access mode, patch that too
  87d39407b7 btrfs-util: add helper that abstracts "might be btrfs subvol?" check
  71ed335c7a rm-rf: add new flag REMOVE_CHMOD
  611376f830 rules: don't ignore Xen virtual interfaces anymore (bsc#1178561)
  All these commits except the last one (611376f830) are preparation for
  CVE-2021-3997.
- Drop 0001-rules-don-t-ignore-Xen-interfaces-anymore.patch
  It's been merged in the git repo (commit 611376f830).</changelog>
  <changelog author="fbui@suse.com" date="1641470401">- Added patches to fix CVE-2021-3997 (bsc#1194178)
  5000-shared-rm_rf-refactor-rm_rf_children_inner-to-shorte.patch
  5001-shared-rm_rf-refactor-rm_rf-to-shorten-code-a-bit.patch
  5002-shared-rm-rf-loop-over-nested-directories-instead-of.patch
  These patches will be moved to the git repo once the bug will become
  public.</changelog>
  <changelog author="fbui@suse.com" date="1641816000">- Add 1009-drop-or-soften-deprecation-warnings.patch (bsc#1193086)</changelog>
  <changelog author="fbui@suse.com" date="1643198400">- resolved: disable DNSSEC until the following issue is solved:
  https://github.com/systemd/systemd/issues/10579
- resolved: disable fallback DNS servers and fail when no DNS server info could
  be obtained from the links. It's better to let the sysadmin know that
  something is likely misconfigured rather than silently handing over the DNS
  queries to Google or Cloudflare.
- resolved: DNSSEC support (build) requires openssl therefore document this
  build dependency in systemd-network sub-package.</changelog>
  <changelog author="fbui@suse.com" date="1643371200">- Import commit 6a96632f26f20a68578f9d620a593ceab2a0e3b6
  c4aa40982c shared/rm-rf: loop over nested directories instead of instead of recursing (CVE-2021-3997 bsc#1194178)
  ae13ea6511 shared/rm_rf: refactor rm_rf() to shorten code a bit
  3266d7f5c8 shared/rm_rf: refactor rm_rf_children_inner() to shorten code a bit
- Drop 5000-shared-rm_rf-refactor-rm_rf_children_inner-to-shorte.patch
  Drop 5001-shared-rm_rf-refactor-rm_rf-to-shorten-code-a-bit.patch
  Drop 5002-shared-rm-rf-loop-over-nested-directories-instead-of.patch
  They have been merged into 'SUSE/v246' branch.</changelog>
  <changelog author="fbui@suse.com" date="1643889600">- Import commit 773652879446a81689c39aea23a486627992409b
  a76263ced9 meson: allow extra net naming schemes to be defined during configuration
  301bf4f1bf meson: drop the list of valid net naming schemes
  b89924793d netif-naming: inline one iterator variable
  da4a4df29c udev: fix potential memleak
  d60486bf1b udev: allow onboard index up to 65535
  ac2baecc84 udev: use snprintf_ok()
  8aad315c7c udev: fix potential infinite loop
  471ea73eb0 udev: make dev_pci_slot() return earlier when PCI bridge is found
  69b7c9a6bd udev: use uint32_t for hotplug_slot
  cdd0e89c0e udev: split out logic of parsing s390 PCI slots
  84e1a91baa udev: it is not necessary that the path is readable
  03548e8d0e udev: add missing initialization to fix freeing invalid address
  772f964bf6 udev: fix slot based network names on s390
  c5071cf699 tree-wide: fix typo
  06640d06df net_id: fix newly added naming scheme name
  58f9592f1f udev/net_id: don't generate slot based names if multiple devices might claim the same slot (bsc#1192637)
  df9e240c92 udev/net_id: parse _SUN ACPI index as a signed integer
  cfcaddfa74 localectl: don't omit keymaps files that are symlinks (bsc#1191826)
- Add 6000-udev-net_id-add-debug-logging-for-construction-of-de.patch</changelog>
</package>
<package pkgid="197454fef6281923b11a64328671ea59d1750eb452ae5a4484d914d8924de16e" name="systemd-logger" arch="ppc64le">
  <version epoch="0" ver="246.16" rel="150300.7.39.1"/>
  <changelog author="fbui@suse.com" date="1626868800">- Import commit 8d8f5fc31eece95644b299b784bbfb8f836d0108 (merge of v246.15)
  cfd14c6537 basic/unit-name: do not use strdupa() on a path (bsc#1188063 CVE-2021-33910)
  7b6b7abf46 unit-name: generate a clear error code when converting an overly long fs path to a unit name
  [...]
  For a complete list of changes, visit:
  https://github.com/openSUSE/systemd/compare/b9e4f4c71159b216a16f1c5121134aee2654be56...8d8f5fc31eece95644b299b784bbfb8f836d0108
- Drop 6000-unit-name-generate-a-clear-error-code-when-convertin.patch
  and 6001-basic-unit-name-do-not-use-strdupa-on-a-path.patch as they
  were merged in v246.15.
- Drop 6002-basic-unit-name-adjust-comments.patch as it was merged in
  branch SUSE/v246.</changelog>
  <changelog author="fbui@suse.com" date="1627560000">- Avoid the error message when udev is updated due to udev being
  already active when the sockets are started again (bsc#1188291)</changelog>
  <changelog author="fbui@suse.com" date="1630497600">- Import commit f5c33d9f82d3d782d28938df9ff09484360c540d (merge of v246.16)
  For a complete list of changes, visit:
  https://github.com/openSUSE/systemd/compare/8d8f5fc31eece95644b299b784bbfb8f836d0108...f5c33d9f82d3d782d28938df9ff09484360c540d</changelog>
  <changelog author="fbui@suse.com" date="1630670400">- Make sure the versions of both udev and systemd packages are always the same (bsc#1189480)</changelog>
  <changelog author="martin.wilck@suse.com" date="1631275200">- Update 60-io-scheduler.rules (jsc#SLE-21032, bsc#1134353)
  * rules weren't applied to dm devices (multipath), fix it
    (bsc#1188713)
  * ignore obsolete "elevator" kernel parameter (bsc#1184994)
    ("elevator" did falsely overide settings even for blk-mq, fixed).
  * remove support for single-queue block IO which the kernel doesn't
    support any more.</changelog>
  <changelog author="fbui@suse.com" date="1631275201">- Drop 1007-tmpfiles-follow-SUSE-policies.patch
  Since most of the tmpfiles config files shipped by upstream are
  ignored (see previous commit "Drop most of the tmpfiles that deal
  with generic paths"), this patch is no more relevant.</changelog>
  <changelog author="fbui@suse.com" date="1631707200">- Import commit 263f7076bc77475045193653a785bbdc0457b5c6
  239e0ce5e7 journalctl: never fail at flushing when the flushed flag is set (bsc#1188588)
  0db7e590e1 manager: reexecute on SIGRTMIN+25, user instances only
  ef8afc4545 core: Make sure cgroup_oom_queue is flushed on manager exit
  f794e01080 cgroup: do 'catchup' for unit cgroup inotify watch files
  54369b7660 manager: Fix HW watchdog when systemd starts before driver loaded (bsc#1189446)
  1d0524bd54 pid1: various minor watchdog modernizations</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Enable support for Portable Services (jsc#SLE-21694)
  Will be released in Leap only.</changelog>
  <changelog author="fbui@suse.com" date="1635336000">- Import commit 5d20af26eee6507bfa9fdb6e5dd4bfc187e3399e
  37e021ee84 mount-util: fix fd_is_mount_point() when both the parent and directory are network fs (bsc#1190984)
  2aee16afd0 mountpoint-util: rebreak some comments
  962e487cb4 virt: Support detection for ARM64 Hyper-V guests (bsc#1186071)
  8545a66afd Use BIOS characteristics to distinguish EC2 bare-metal from VMs
  03311b59c3 machine-id-setup: generate machine-id from DMI product ID on Amazon EC2
  0fc3118a67 id128-util: use common implementation of helper to get/validate product ID
  83bfa06ebc virt: detect Amazon EC2 Nitro instance (bsc#1190440)
  e8b8df3ed9 core: move several source files to src/shared</changelog>
  <changelog author="fbui@suse.com" date="1635422400">- Import commit f2f061f1da064bfd47e2201967a854bb9281ca5b
  98e87fc3fd busctl: use usec granularity for the timestamp printed by the busctl monitor command (jsc#SLE-17798)</changelog>
  <changelog author="mwilck@suse.com" date="1636459200">- Fix IO scheduler udev rules
  * 60-io-scheduler.rules: don't use BFQ for real multiqueue devices
    (jsc#SLE-21032, bsc#1192161)
  * 60-io-scheduler.rules: use "none" for multipath components
    (bsc#1192161)</changelog>
  <changelog author="fbui@suse.com" date="1639396800">- Import commit 34eba0c28cb02d15fdbf55ce28bdfa56142ae4d1
  0a8cb60af6 Bump the max number of inodes for /dev to a million (bsc#1192858)
  848c9207cb Bump the max number of inodes for /dev to 128k (bsc#1192858)
  ea44eb34f2 sleep: don't skip resume device with low priority/available space (bsc#1192423)
  9325a68316 test: use kbd-mode-map we ship in one more test case
  8ff379e11d test-keymap-util: always use kbd-model-map we ship</changelog>
  <changelog author="mwilck@suse.com" date="1640001600">* 60-io-scheduler.rules: add rules for virtual devices
    (boo#1193759)
  * 60-io-scheduler.rules: enforce "none" for loop devices
    (boo#1193759)</changelog>
  <changelog author="fbui@suse.com" date="1641297600">- Suppress PAM warning when the credentials for user@.service service are
  established (bsc#1190515)
  systemd-user PAM service needs to define a default implementation of
  pam_setcred() otherwise the fallback (defined by /etc/pam.d/other) is used,
  which consists of pam_warn.so + pam_deny.so, and will throw a warning each
  time a user logs in.
  The new default simply consists in calling pam_deny.so alone.</changelog>
  <changelog author="fbui@suse.com" date="1641470400">- Import commit 3850086c6580291188fe574ad37c8026012894fb
  c0505cbb8d tmpfiles: 'st' may have been used uninitialized
  d3f7c9e806 macro: add new helper RET_NERRNO()
  4a95baa5de rm-rf: optionally fsync() after removing directory tree
  dd8137a589 rm-rf: refactor rm_rf_children(), split out body of directory iteration loop
  3f8765ed2c rm-rf: fstatat() might fail if containing dir has limited access mode, patch that too
  87d39407b7 btrfs-util: add helper that abstracts "might be btrfs subvol?" check
  71ed335c7a rm-rf: add new flag REMOVE_CHMOD
  611376f830 rules: don't ignore Xen virtual interfaces anymore (bsc#1178561)
  All these commits except the last one (611376f830) are preparation for
  CVE-2021-3997.
- Drop 0001-rules-don-t-ignore-Xen-interfaces-anymore.patch
  It's been merged in the git repo (commit 611376f830).</changelog>
  <changelog author="fbui@suse.com" date="1641470401">- Added patches to fix CVE-2021-3997 (bsc#1194178)
  5000-shared-rm_rf-refactor-rm_rf_children_inner-to-shorte.patch
  5001-shared-rm_rf-refactor-rm_rf-to-shorten-code-a-bit.patch
  5002-shared-rm-rf-loop-over-nested-directories-instead-of.patch
  These patches will be moved to the git repo once the bug will become
  public.</changelog>
  <changelog author="fbui@suse.com" date="1641816000">- Add 1009-drop-or-soften-deprecation-warnings.patch (bsc#1193086)</changelog>
  <changelog author="fbui@suse.com" date="1643198400">- resolved: disable DNSSEC until the following issue is solved:
  https://github.com/systemd/systemd/issues/10579
- resolved: disable fallback DNS servers and fail when no DNS server info could
  be obtained from the links. It's better to let the sysadmin know that
  something is likely misconfigured rather than silently handing over the DNS
  queries to Google or Cloudflare.
- resolved: DNSSEC support (build) requires openssl therefore document this
  build dependency in systemd-network sub-package.</changelog>
  <changelog author="fbui@suse.com" date="1643371200">- Import commit 6a96632f26f20a68578f9d620a593ceab2a0e3b6
  c4aa40982c shared/rm-rf: loop over nested directories instead of instead of recursing (CVE-2021-3997 bsc#1194178)
  ae13ea6511 shared/rm_rf: refactor rm_rf() to shorten code a bit
  3266d7f5c8 shared/rm_rf: refactor rm_rf_children_inner() to shorten code a bit
- Drop 5000-shared-rm_rf-refactor-rm_rf_children_inner-to-shorte.patch
  Drop 5001-shared-rm_rf-refactor-rm_rf-to-shorten-code-a-bit.patch
  Drop 5002-shared-rm-rf-loop-over-nested-directories-instead-of.patch
  They have been merged into 'SUSE/v246' branch.</changelog>
  <changelog author="fbui@suse.com" date="1643889600">- Import commit 773652879446a81689c39aea23a486627992409b
  a76263ced9 meson: allow extra net naming schemes to be defined during configuration
  301bf4f1bf meson: drop the list of valid net naming schemes
  b89924793d netif-naming: inline one iterator variable
  da4a4df29c udev: fix potential memleak
  d60486bf1b udev: allow onboard index up to 65535
  ac2baecc84 udev: use snprintf_ok()
  8aad315c7c udev: fix potential infinite loop
  471ea73eb0 udev: make dev_pci_slot() return earlier when PCI bridge is found
  69b7c9a6bd udev: use uint32_t for hotplug_slot
  cdd0e89c0e udev: split out logic of parsing s390 PCI slots
  84e1a91baa udev: it is not necessary that the path is readable
  03548e8d0e udev: add missing initialization to fix freeing invalid address
  772f964bf6 udev: fix slot based network names on s390
  c5071cf699 tree-wide: fix typo
  06640d06df net_id: fix newly added naming scheme name
  58f9592f1f udev/net_id: don't generate slot based names if multiple devices might claim the same slot (bsc#1192637)
  df9e240c92 udev/net_id: parse _SUN ACPI index as a signed integer
  cfcaddfa74 localectl: don't omit keymaps files that are symlinks (bsc#1191826)
- Add 6000-udev-net_id-add-debug-logging-for-construction-of-de.patch</changelog>
</package>
<package pkgid="29c7f0b77394273951dda1b7cc0049a6fda1d9007451363e666d6636a94fb29a" name="systemd-logger" arch="s390x">
  <version epoch="0" ver="246.16" rel="150300.7.39.1"/>
  <changelog author="fbui@suse.com" date="1626868800">- Import commit 8d8f5fc31eece95644b299b784bbfb8f836d0108 (merge of v246.15)
  cfd14c6537 basic/unit-name: do not use strdupa() on a path (bsc#1188063 CVE-2021-33910)
  7b6b7abf46 unit-name: generate a clear error code when converting an overly long fs path to a unit name
  [...]
  For a complete list of changes, visit:
  https://github.com/openSUSE/systemd/compare/b9e4f4c71159b216a16f1c5121134aee2654be56...8d8f5fc31eece95644b299b784bbfb8f836d0108
- Drop 6000-unit-name-generate-a-clear-error-code-when-convertin.patch
  and 6001-basic-unit-name-do-not-use-strdupa-on-a-path.patch as they
  were merged in v246.15.
- Drop 6002-basic-unit-name-adjust-comments.patch as it was merged in
  branch SUSE/v246.</changelog>
  <changelog author="fbui@suse.com" date="1627560000">- Avoid the error message when udev is updated due to udev being
  already active when the sockets are started again (bsc#1188291)</changelog>
  <changelog author="fbui@suse.com" date="1630497600">- Import commit f5c33d9f82d3d782d28938df9ff09484360c540d (merge of v246.16)
  For a complete list of changes, visit:
  https://github.com/openSUSE/systemd/compare/8d8f5fc31eece95644b299b784bbfb8f836d0108...f5c33d9f82d3d782d28938df9ff09484360c540d</changelog>
  <changelog author="fbui@suse.com" date="1630670400">- Make sure the versions of both udev and systemd packages are always the same (bsc#1189480)</changelog>
  <changelog author="martin.wilck@suse.com" date="1631275200">- Update 60-io-scheduler.rules (jsc#SLE-21032, bsc#1134353)
  * rules weren't applied to dm devices (multipath), fix it
    (bsc#1188713)
  * ignore obsolete "elevator" kernel parameter (bsc#1184994)
    ("elevator" did falsely overide settings even for blk-mq, fixed).
  * remove support for single-queue block IO which the kernel doesn't
    support any more.</changelog>
  <changelog author="fbui@suse.com" date="1631275201">- Drop 1007-tmpfiles-follow-SUSE-policies.patch
  Since most of the tmpfiles config files shipped by upstream are
  ignored (see previous commit "Drop most of the tmpfiles that deal
  with generic paths"), this patch is no more relevant.</changelog>
  <changelog author="fbui@suse.com" date="1631707200">- Import commit 263f7076bc77475045193653a785bbdc0457b5c6
  239e0ce5e7 journalctl: never fail at flushing when the flushed flag is set (bsc#1188588)
  0db7e590e1 manager: reexecute on SIGRTMIN+25, user instances only
  ef8afc4545 core: Make sure cgroup_oom_queue is flushed on manager exit
  f794e01080 cgroup: do 'catchup' for unit cgroup inotify watch files
  54369b7660 manager: Fix HW watchdog when systemd starts before driver loaded (bsc#1189446)
  1d0524bd54 pid1: various minor watchdog modernizations</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Enable support for Portable Services (jsc#SLE-21694)
  Will be released in Leap only.</changelog>
  <changelog author="fbui@suse.com" date="1635336000">- Import commit 5d20af26eee6507bfa9fdb6e5dd4bfc187e3399e
  37e021ee84 mount-util: fix fd_is_mount_point() when both the parent and directory are network fs (bsc#1190984)
  2aee16afd0 mountpoint-util: rebreak some comments
  962e487cb4 virt: Support detection for ARM64 Hyper-V guests (bsc#1186071)
  8545a66afd Use BIOS characteristics to distinguish EC2 bare-metal from VMs
  03311b59c3 machine-id-setup: generate machine-id from DMI product ID on Amazon EC2
  0fc3118a67 id128-util: use common implementation of helper to get/validate product ID
  83bfa06ebc virt: detect Amazon EC2 Nitro instance (bsc#1190440)
  e8b8df3ed9 core: move several source files to src/shared</changelog>
  <changelog author="fbui@suse.com" date="1635422400">- Import commit f2f061f1da064bfd47e2201967a854bb9281ca5b
  98e87fc3fd busctl: use usec granularity for the timestamp printed by the busctl monitor command (jsc#SLE-17798)</changelog>
  <changelog author="mwilck@suse.com" date="1636459200">- Fix IO scheduler udev rules
  * 60-io-scheduler.rules: don't use BFQ for real multiqueue devices
    (jsc#SLE-21032, bsc#1192161)
  * 60-io-scheduler.rules: use "none" for multipath components
    (bsc#1192161)</changelog>
  <changelog author="fbui@suse.com" date="1639396800">- Import commit 34eba0c28cb02d15fdbf55ce28bdfa56142ae4d1
  0a8cb60af6 Bump the max number of inodes for /dev to a million (bsc#1192858)
  848c9207cb Bump the max number of inodes for /dev to 128k (bsc#1192858)
  ea44eb34f2 sleep: don't skip resume device with low priority/available space (bsc#1192423)
  9325a68316 test: use kbd-mode-map we ship in one more test case
  8ff379e11d test-keymap-util: always use kbd-model-map we ship</changelog>
  <changelog author="mwilck@suse.com" date="1640001600">* 60-io-scheduler.rules: add rules for virtual devices
    (boo#1193759)
  * 60-io-scheduler.rules: enforce "none" for loop devices
    (boo#1193759)</changelog>
  <changelog author="fbui@suse.com" date="1641297600">- Suppress PAM warning when the credentials for user@.service service are
  established (bsc#1190515)
  systemd-user PAM service needs to define a default implementation of
  pam_setcred() otherwise the fallback (defined by /etc/pam.d/other) is used,
  which consists of pam_warn.so + pam_deny.so, and will throw a warning each
  time a user logs in.
  The new default simply consists in calling pam_deny.so alone.</changelog>
  <changelog author="fbui@suse.com" date="1641470400">- Import commit 3850086c6580291188fe574ad37c8026012894fb
  c0505cbb8d tmpfiles: 'st' may have been used uninitialized
  d3f7c9e806 macro: add new helper RET_NERRNO()
  4a95baa5de rm-rf: optionally fsync() after removing directory tree
  dd8137a589 rm-rf: refactor rm_rf_children(), split out body of directory iteration loop
  3f8765ed2c rm-rf: fstatat() might fail if containing dir has limited access mode, patch that too
  87d39407b7 btrfs-util: add helper that abstracts "might be btrfs subvol?" check
  71ed335c7a rm-rf: add new flag REMOVE_CHMOD
  611376f830 rules: don't ignore Xen virtual interfaces anymore (bsc#1178561)
  All these commits except the last one (611376f830) are preparation for
  CVE-2021-3997.
- Drop 0001-rules-don-t-ignore-Xen-interfaces-anymore.patch
  It's been merged in the git repo (commit 611376f830).</changelog>
  <changelog author="fbui@suse.com" date="1641470401">- Added patches to fix CVE-2021-3997 (bsc#1194178)
  5000-shared-rm_rf-refactor-rm_rf_children_inner-to-shorte.patch
  5001-shared-rm_rf-refactor-rm_rf-to-shorten-code-a-bit.patch
  5002-shared-rm-rf-loop-over-nested-directories-instead-of.patch
  These patches will be moved to the git repo once the bug will become
  public.</changelog>
  <changelog author="fbui@suse.com" date="1641816000">- Add 1009-drop-or-soften-deprecation-warnings.patch (bsc#1193086)</changelog>
  <changelog author="fbui@suse.com" date="1643198400">- resolved: disable DNSSEC until the following issue is solved:
  https://github.com/systemd/systemd/issues/10579
- resolved: disable fallback DNS servers and fail when no DNS server info could
  be obtained from the links. It's better to let the sysadmin know that
  something is likely misconfigured rather than silently handing over the DNS
  queries to Google or Cloudflare.
- resolved: DNSSEC support (build) requires openssl therefore document this
  build dependency in systemd-network sub-package.</changelog>
  <changelog author="fbui@suse.com" date="1643371200">- Import commit 6a96632f26f20a68578f9d620a593ceab2a0e3b6
  c4aa40982c shared/rm-rf: loop over nested directories instead of instead of recursing (CVE-2021-3997 bsc#1194178)
  ae13ea6511 shared/rm_rf: refactor rm_rf() to shorten code a bit
  3266d7f5c8 shared/rm_rf: refactor rm_rf_children_inner() to shorten code a bit
- Drop 5000-shared-rm_rf-refactor-rm_rf_children_inner-to-shorte.patch
  Drop 5001-shared-rm_rf-refactor-rm_rf-to-shorten-code-a-bit.patch
  Drop 5002-shared-rm-rf-loop-over-nested-directories-instead-of.patch
  They have been merged into 'SUSE/v246' branch.</changelog>
  <changelog author="fbui@suse.com" date="1643889600">- Import commit 773652879446a81689c39aea23a486627992409b
  a76263ced9 meson: allow extra net naming schemes to be defined during configuration
  301bf4f1bf meson: drop the list of valid net naming schemes
  b89924793d netif-naming: inline one iterator variable
  da4a4df29c udev: fix potential memleak
  d60486bf1b udev: allow onboard index up to 65535
  ac2baecc84 udev: use snprintf_ok()
  8aad315c7c udev: fix potential infinite loop
  471ea73eb0 udev: make dev_pci_slot() return earlier when PCI bridge is found
  69b7c9a6bd udev: use uint32_t for hotplug_slot
  cdd0e89c0e udev: split out logic of parsing s390 PCI slots
  84e1a91baa udev: it is not necessary that the path is readable
  03548e8d0e udev: add missing initialization to fix freeing invalid address
  772f964bf6 udev: fix slot based network names on s390
  c5071cf699 tree-wide: fix typo
  06640d06df net_id: fix newly added naming scheme name
  58f9592f1f udev/net_id: don't generate slot based names if multiple devices might claim the same slot (bsc#1192637)
  df9e240c92 udev/net_id: parse _SUN ACPI index as a signed integer
  cfcaddfa74 localectl: don't omit keymaps files that are symlinks (bsc#1191826)
- Add 6000-udev-net_id-add-debug-logging-for-construction-of-de.patch</changelog>
</package>
<package pkgid="ea52ddd1c56d134e25e165ac88f3ad69ae51d2d15dc055e037587a442127f289" name="systemd-logger" arch="x86_64">
  <version epoch="0" ver="246.16" rel="150300.7.39.1"/>
  <changelog author="fbui@suse.com" date="1626868800">- Import commit 8d8f5fc31eece95644b299b784bbfb8f836d0108 (merge of v246.15)
  cfd14c6537 basic/unit-name: do not use strdupa() on a path (bsc#1188063 CVE-2021-33910)
  7b6b7abf46 unit-name: generate a clear error code when converting an overly long fs path to a unit name
  [...]
  For a complete list of changes, visit:
  https://github.com/openSUSE/systemd/compare/b9e4f4c71159b216a16f1c5121134aee2654be56...8d8f5fc31eece95644b299b784bbfb8f836d0108
- Drop 6000-unit-name-generate-a-clear-error-code-when-convertin.patch
  and 6001-basic-unit-name-do-not-use-strdupa-on-a-path.patch as they
  were merged in v246.15.
- Drop 6002-basic-unit-name-adjust-comments.patch as it was merged in
  branch SUSE/v246.</changelog>
  <changelog author="fbui@suse.com" date="1627560000">- Avoid the error message when udev is updated due to udev being
  already active when the sockets are started again (bsc#1188291)</changelog>
  <changelog author="fbui@suse.com" date="1630497600">- Import commit f5c33d9f82d3d782d28938df9ff09484360c540d (merge of v246.16)
  For a complete list of changes, visit:
  https://github.com/openSUSE/systemd/compare/8d8f5fc31eece95644b299b784bbfb8f836d0108...f5c33d9f82d3d782d28938df9ff09484360c540d</changelog>
  <changelog author="fbui@suse.com" date="1630670400">- Make sure the versions of both udev and systemd packages are always the same (bsc#1189480)</changelog>
  <changelog author="martin.wilck@suse.com" date="1631275200">- Update 60-io-scheduler.rules (jsc#SLE-21032, bsc#1134353)
  * rules weren't applied to dm devices (multipath), fix it
    (bsc#1188713)
  * ignore obsolete "elevator" kernel parameter (bsc#1184994)
    ("elevator" did falsely overide settings even for blk-mq, fixed).
  * remove support for single-queue block IO which the kernel doesn't
    support any more.</changelog>
  <changelog author="fbui@suse.com" date="1631275201">- Drop 1007-tmpfiles-follow-SUSE-policies.patch
  Since most of the tmpfiles config files shipped by upstream are
  ignored (see previous commit "Drop most of the tmpfiles that deal
  with generic paths"), this patch is no more relevant.</changelog>
  <changelog author="fbui@suse.com" date="1631707200">- Import commit 263f7076bc77475045193653a785bbdc0457b5c6
  239e0ce5e7 journalctl: never fail at flushing when the flushed flag is set (bsc#1188588)
  0db7e590e1 manager: reexecute on SIGRTMIN+25, user instances only
  ef8afc4545 core: Make sure cgroup_oom_queue is flushed on manager exit
  f794e01080 cgroup: do 'catchup' for unit cgroup inotify watch files
  54369b7660 manager: Fix HW watchdog when systemd starts before driver loaded (bsc#1189446)
  1d0524bd54 pid1: various minor watchdog modernizations</changelog>
  <changelog author="fbui@suse.com" date="1632398400">- Enable support for Portable Services (jsc#SLE-21694)
  Will be released in Leap only.</changelog>
  <changelog author="fbui@suse.com" date="1635336000">- Import commit 5d20af26eee6507bfa9fdb6e5dd4bfc187e3399e
  37e021ee84 mount-util: fix fd_is_mount_point() when both the parent and directory are network fs (bsc#1190984)
  2aee16afd0 mountpoint-util: rebreak some comments
  962e487cb4 virt: Support detection for ARM64 Hyper-V guests (bsc#1186071)
  8545a66afd Use BIOS characteristics to distinguish EC2 bare-metal from VMs
  03311b59c3 machine-id-setup: generate machine-id from DMI product ID on Amazon EC2
  0fc3118a67 id128-util: use common implementation of helper to get/validate product ID
  83bfa06ebc virt: detect Amazon EC2 Nitro instance (bsc#1190440)
  e8b8df3ed9 core: move several source files to src/shared</changelog>
  <changelog author="fbui@suse.com" date="1635422400">- Import commit f2f061f1da064bfd47e2201967a854bb9281ca5b
  98e87fc3fd busctl: use usec granularity for the timestamp printed by the busctl monitor command (jsc#SLE-17798)</changelog>
  <changelog author="mwilck@suse.com" date="1636459200">- Fix IO scheduler udev rules
  * 60-io-scheduler.rules: don't use BFQ for real multiqueue devices
    (jsc#SLE-21032, bsc#1192161)
  * 60-io-scheduler.rules: use "none" for multipath components
    (bsc#1192161)</changelog>
  <changelog author="fbui@suse.com" date="1639396800">- Import commit 34eba0c28cb02d15fdbf55ce28bdfa56142ae4d1
  0a8cb60af6 Bump the max number of inodes for /dev to a million (bsc#1192858)
  848c9207cb Bump the max number of inodes for /dev to 128k (bsc#1192858)
  ea44eb34f2 sleep: don't skip resume device with low priority/available space (bsc#1192423)
  9325a68316 test: use kbd-mode-map we ship in one more test case
  8ff379e11d test-keymap-util: always use kbd-model-map we ship</changelog>
  <changelog author="mwilck@suse.com" date="1640001600">* 60-io-scheduler.rules: add rules for virtual devices
    (boo#1193759)
  * 60-io-scheduler.rules: enforce "none" for loop devices
    (boo#1193759)</changelog>
  <changelog author="fbui@suse.com" date="1641297600">- Suppress PAM warning when the credentials for user@.service service are
  established (bsc#1190515)
  systemd-user PAM service needs to define a default implementation of
  pam_setcred() otherwise the fallback (defined by /etc/pam.d/other) is used,
  which consists of pam_warn.so + pam_deny.so, and will throw a warning each
  time a user logs in.
  The new default simply consists in calling pam_deny.so alone.</changelog>
  <changelog author="fbui@suse.com" date="1641470400">- Import commit 3850086c6580291188fe574ad37c8026012894fb
  c0505cbb8d tmpfiles: 'st' may have been used uninitialized
  d3f7c9e806 macro: add new helper RET_NERRNO()
  4a95baa5de rm-rf: optionally fsync() after removing directory tree
  dd8137a589 rm-rf: refactor rm_rf_children(), split out body of directory iteration loop
  3f8765ed2c rm-rf: fstatat() might fail if containing dir has limited access mode, patch that too
  87d39407b7 btrfs-util: add helper that abstracts "might be btrfs subvol?" check
  71ed335c7a rm-rf: add new flag REMOVE_CHMOD
  611376f830 rules: don't ignore Xen virtual interfaces anymore (bsc#1178561)
  All these commits except the last one (611376f830) are preparation for
  CVE-2021-3997.
- Drop 0001-rules-don-t-ignore-Xen-interfaces-anymore.patch
  It's been merged in the git repo (commit 611376f830).</changelog>
  <changelog author="fbui@suse.com" date="1641470401">- Added patches to fix CVE-2021-3997 (bsc#1194178)
  5000-shared-rm_rf-refactor-rm_rf_children_inner-to-shorte.patch
  5001-shared-rm_rf-refactor-rm_rf-to-shorten-code-a-bit.patch
  5002-shared-rm-rf-loop-over-nested-directories-instead-of.patch
  These patches will be moved to the git repo once the bug will become
  public.</changelog>
  <changelog author="fbui@suse.com" date="1641816000">- Add 1009-drop-or-soften-deprecation-warnings.patch (bsc#1193086)</changelog>
  <changelog author="fbui@suse.com" date="1643198400">- resolved: disable DNSSEC until the following issue is solved:
  https://github.com/systemd/systemd/issues/10579
- resolved: disable fallback DNS servers and fail when no DNS server info could
  be obtained from the links. It's better to let the sysadmin know that
  something is likely misconfigured rather than silently handing over the DNS
  queries to Google or Cloudflare.
- resolved: DNSSEC support (build) requires openssl therefore document this
  build dependency in systemd-network sub-package.</changelog>
  <changelog author="fbui@suse.com" date="1643371200">- Import commit 6a96632f26f20a68578f9d620a593ceab2a0e3b6
  c4aa40982c shared/rm-rf: loop over nested directories instead of instead of recursing (CVE-2021-3997 bsc#1194178)
  ae13ea6511 shared/rm_rf: refactor rm_rf() to shorten code a bit
  3266d7f5c8 shared/rm_rf: refactor rm_rf_children_inner() to shorten code a bit
- Drop 5000-shared-rm_rf-refactor-rm_rf_children_inner-to-shorte.patch
  Drop 5001-shared-rm_rf-refactor-rm_rf-to-shorten-code-a-bit.patch
  Drop 5002-shared-rm-rf-loop-over-nested-directories-instead-of.patch
  They have been merged into 'SUSE/v246' branch.</changelog>
  <changelog author="fbui@suse.com" date="1643889600">- Import commit 773652879446a81689c39aea23a486627992409b
  a76263ced9 meson: allow extra net naming schemes to be defined during configuration
  301bf4f1bf meson: drop the list of valid net naming schemes
  b89924793d netif-naming: inline one iterator variable
  da4a4df29c udev: fix potential memleak
  d60486bf1b udev: allow onboard index up to 65535
  ac2baecc84 udev: use snprintf_ok()
  8aad315c7c udev: fix potential infinite loop
  471ea73eb0 udev: make dev_pci_slot() return earlier when PCI bridge is found
  69b7c9a6bd udev: use uint32_t for hotplug_slot
  cdd0e89c0e udev: split out logic of parsing s390 PCI slots
  84e1a91baa udev: it is not necessary that the path is readable
  03548e8d0e udev: add missing initialization to fix freeing invalid address
  772f964bf6 udev: fix slot based network names on s390
  c5071cf699 tree-wide: fix typo
  06640d06df net_id: fix newly added naming scheme name
  58f9592f1f udev/net_id: don't generate slot based names if multiple devices might claim the same slot (bsc#1192637)
  df9e240c92 udev/net_id: parse _SUN ACPI index as a signed integer
  cfcaddfa74 localectl: don't omit keymaps files that are symlinks (bsc#1191826)
- Add 6000-udev-net_id-add-debug-logging-for-construction-of-de.patch</changelog>
</package>
<package pkgid="756f4f55b24d6b05d21364f6e4adf189de0bbb88fc832126a62d247ea9d87bfd" name="telnet" arch="aarch64">
  <version epoch="0" ver="1.2" rel="3.3.1"/>
  <changelog author="vcizek@novell.com" date="1309435200">- exit cleanly, when hostalias cannot be resolved (bnc#700229)
- made manpage more clear about the -b option</changelog>
  <changelog author="vcizek@suse.com" date="1322136000">- added -ltinfo instead of -lncurses</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1325505600">- removed telnet-bsd-1.2-tinfo.patch
  Replacing -lncurses with -ltinfo doesn't seem to be required and
  it actually breaks builds
- refresh telnet-bsd-1.2-suppress_hostname.patch
- remove makros from patch names
- use makros for configure, make and make install</changelog>
  <changelog author="idonmez@suse.com" date="1365163200">- Add Source URL, see https://en.opensuse.org/SourceUrls</changelog>
  <changelog author="kstreitova@suse.com" date="1412337600">- spec-cleaner used for cleaning the specfile up
- "export NO_BRP_STRIP_DEBUG=true" removed from specfile</changelog>
  <changelog author="kstreitova@suse.com" date="1412596800">- url was repaired</changelog>
  <changelog author="kstreitova@suse.com" date="1413374400">- added telnet-bsd-1.2-fix-infinite-loop.patch that fixes the
  generating an infinite loop (bnc#898481)</changelog>
  <changelog author="dimstar@opensuse.org" date="1486036800">- Switch to ncurses6: use ncurses6-config to find the correct
  CFLAGS and libraries.</changelog>
  <changelog author="aliouliaki@suse.com" date="1497614400">- Removed xinetd service
- Added telnet@.service and telnet.socket
- Cleanup of telnet.spec</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639742400">- Update Source location to use Gentoo mirror, fixes bsc#1129925</changelog>
</package>
<package pkgid="a76e2a2d62adac0725ce55f3bef7e1e3c4b1247a789719316e38c97047400787" name="telnet" arch="ppc64le">
  <version epoch="0" ver="1.2" rel="3.3.1"/>
  <changelog author="vcizek@novell.com" date="1309435200">- exit cleanly, when hostalias cannot be resolved (bnc#700229)
- made manpage more clear about the -b option</changelog>
  <changelog author="vcizek@suse.com" date="1322136000">- added -ltinfo instead of -lncurses</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1325505600">- removed telnet-bsd-1.2-tinfo.patch
  Replacing -lncurses with -ltinfo doesn't seem to be required and
  it actually breaks builds
- refresh telnet-bsd-1.2-suppress_hostname.patch
- remove makros from patch names
- use makros for configure, make and make install</changelog>
  <changelog author="idonmez@suse.com" date="1365163200">- Add Source URL, see https://en.opensuse.org/SourceUrls</changelog>
  <changelog author="kstreitova@suse.com" date="1412337600">- spec-cleaner used for cleaning the specfile up
- "export NO_BRP_STRIP_DEBUG=true" removed from specfile</changelog>
  <changelog author="kstreitova@suse.com" date="1412596800">- url was repaired</changelog>
  <changelog author="kstreitova@suse.com" date="1413374400">- added telnet-bsd-1.2-fix-infinite-loop.patch that fixes the
  generating an infinite loop (bnc#898481)</changelog>
  <changelog author="dimstar@opensuse.org" date="1486036800">- Switch to ncurses6: use ncurses6-config to find the correct
  CFLAGS and libraries.</changelog>
  <changelog author="aliouliaki@suse.com" date="1497614400">- Removed xinetd service
- Added telnet@.service and telnet.socket
- Cleanup of telnet.spec</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639742400">- Update Source location to use Gentoo mirror, fixes bsc#1129925</changelog>
</package>
<package pkgid="3982547c471ff2698687f9e90ff442a9b2d2b2425449a8d9c40fc8df497c1856" name="telnet" arch="s390x">
  <version epoch="0" ver="1.2" rel="3.3.1"/>
  <changelog author="vcizek@novell.com" date="1309435200">- exit cleanly, when hostalias cannot be resolved (bnc#700229)
- made manpage more clear about the -b option</changelog>
  <changelog author="vcizek@suse.com" date="1322136000">- added -ltinfo instead of -lncurses</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1325505600">- removed telnet-bsd-1.2-tinfo.patch
  Replacing -lncurses with -ltinfo doesn't seem to be required and
  it actually breaks builds
- refresh telnet-bsd-1.2-suppress_hostname.patch
- remove makros from patch names
- use makros for configure, make and make install</changelog>
  <changelog author="idonmez@suse.com" date="1365163200">- Add Source URL, see https://en.opensuse.org/SourceUrls</changelog>
  <changelog author="kstreitova@suse.com" date="1412337600">- spec-cleaner used for cleaning the specfile up
- "export NO_BRP_STRIP_DEBUG=true" removed from specfile</changelog>
  <changelog author="kstreitova@suse.com" date="1412596800">- url was repaired</changelog>
  <changelog author="kstreitova@suse.com" date="1413374400">- added telnet-bsd-1.2-fix-infinite-loop.patch that fixes the
  generating an infinite loop (bnc#898481)</changelog>
  <changelog author="dimstar@opensuse.org" date="1486036800">- Switch to ncurses6: use ncurses6-config to find the correct
  CFLAGS and libraries.</changelog>
  <changelog author="aliouliaki@suse.com" date="1497614400">- Removed xinetd service
- Added telnet@.service and telnet.socket
- Cleanup of telnet.spec</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639742400">- Update Source location to use Gentoo mirror, fixes bsc#1129925</changelog>
</package>
<package pkgid="05c47c9f606b90f71d012df68f8045fac2ddef5f6ec3da2d96d2799a6eae28ee" name="telnet" arch="src">
  <version epoch="0" ver="1.2" rel="3.3.1"/>
  <changelog author="mls@suse.de" date="1138190400">- converted neededforbuild to BuildRequires</changelog>
  <changelog author="kssingvo@suse.de" date="1148040000">- added option -H to suppress hostname (bugzilla#175376)</changelog>
  <changelog author="mskibbe@suse.de" date="1165233600">- fix Bug #224847(telnet man page does not mention DEFAULT for
  .telnetrc)</changelog>
  <changelog author="mskibbe@suse.de" date="1172836800">- telnet-server : Support for FATE #300687: Ports for SuSEfirewall
  added via packages (#250570)</changelog>
  <changelog author="dmueller@suse.de" date="1175169600">- add ncurses-devel BuildRequires</changelog>
  <changelog author="mskibbe@suse.de" date="1199707200">- Bug 351197 - several packages use wrong dir for SuSEfirewall2
  services files</changelog>
  <changelog author="jsrain@suse.cz" date="1207742400">- fixed description for ports information for SuSEfirewall
  (bnc #373969)</changelog>
  <changelog author="cthiel@suse.de" date="1220097600">- fix build with latests ncurses</changelog>
  <changelog author="crrodriguez@suse.de" date="1242993600">- do not use gethostbyname(3) but getaddrinfo(3) patch by Ulrich Drepper.</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1254312000">- telnet-server does require xinetd</changelog>
  <changelog author="vcizek@novell.com" date="1309435200">- exit cleanly, when hostalias cannot be resolved (bnc#700229)
- made manpage more clear about the -b option</changelog>
  <changelog author="vcizek@suse.com" date="1322136000">- added -ltinfo instead of -lncurses</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1325505600">- removed telnet-bsd-1.2-tinfo.patch
  Replacing -lncurses with -ltinfo doesn't seem to be required and
  it actually breaks builds
- refresh telnet-bsd-1.2-suppress_hostname.patch
- remove makros from patch names
- use makros for configure, make and make install</changelog>
  <changelog author="idonmez@suse.com" date="1365163200">- Add Source URL, see https://en.opensuse.org/SourceUrls</changelog>
  <changelog author="kstreitova@suse.com" date="1412337600">- spec-cleaner used for cleaning the specfile up
- "export NO_BRP_STRIP_DEBUG=true" removed from specfile</changelog>
  <changelog author="kstreitova@suse.com" date="1412596800">- url was repaired</changelog>
  <changelog author="kstreitova@suse.com" date="1413374400">- added telnet-bsd-1.2-fix-infinite-loop.patch that fixes the
  generating an infinite loop (bnc#898481)</changelog>
  <changelog author="dimstar@opensuse.org" date="1486036800">- Switch to ncurses6: use ncurses6-config to find the correct
  CFLAGS and libraries.</changelog>
  <changelog author="aliouliaki@suse.com" date="1497614400">- Removed xinetd service
- Added telnet@.service and telnet.socket
- Cleanup of telnet.spec</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639742400">- Update Source location to use Gentoo mirror, fixes bsc#1129925</changelog>
</package>
<package pkgid="01a86bca113c4743a60c146c5ce623755f7fa074bc5484c0ecf173ed7ea362bd" name="telnet" arch="x86_64">
  <version epoch="0" ver="1.2" rel="3.3.1"/>
  <changelog author="vcizek@novell.com" date="1309435200">- exit cleanly, when hostalias cannot be resolved (bnc#700229)
- made manpage more clear about the -b option</changelog>
  <changelog author="vcizek@suse.com" date="1322136000">- added -ltinfo instead of -lncurses</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1325505600">- removed telnet-bsd-1.2-tinfo.patch
  Replacing -lncurses with -ltinfo doesn't seem to be required and
  it actually breaks builds
- refresh telnet-bsd-1.2-suppress_hostname.patch
- remove makros from patch names
- use makros for configure, make and make install</changelog>
  <changelog author="idonmez@suse.com" date="1365163200">- Add Source URL, see https://en.opensuse.org/SourceUrls</changelog>
  <changelog author="kstreitova@suse.com" date="1412337600">- spec-cleaner used for cleaning the specfile up
- "export NO_BRP_STRIP_DEBUG=true" removed from specfile</changelog>
  <changelog author="kstreitova@suse.com" date="1412596800">- url was repaired</changelog>
  <changelog author="kstreitova@suse.com" date="1413374400">- added telnet-bsd-1.2-fix-infinite-loop.patch that fixes the
  generating an infinite loop (bnc#898481)</changelog>
  <changelog author="dimstar@opensuse.org" date="1486036800">- Switch to ncurses6: use ncurses6-config to find the correct
  CFLAGS and libraries.</changelog>
  <changelog author="aliouliaki@suse.com" date="1497614400">- Removed xinetd service
- Added telnet@.service and telnet.socket
- Cleanup of telnet.spec</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639742400">- Update Source location to use Gentoo mirror, fixes bsc#1129925</changelog>
</package>
<package pkgid="b82db3ce38273c3a02dc32dab7b6899868b54da42c2c1569a87ac87424c9f1fe" name="telnet-server" arch="aarch64">
  <version epoch="0" ver="1.2" rel="3.3.1"/>
  <changelog author="vcizek@novell.com" date="1309435200">- exit cleanly, when hostalias cannot be resolved (bnc#700229)
- made manpage more clear about the -b option</changelog>
  <changelog author="vcizek@suse.com" date="1322136000">- added -ltinfo instead of -lncurses</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1325505600">- removed telnet-bsd-1.2-tinfo.patch
  Replacing -lncurses with -ltinfo doesn't seem to be required and
  it actually breaks builds
- refresh telnet-bsd-1.2-suppress_hostname.patch
- remove makros from patch names
- use makros for configure, make and make install</changelog>
  <changelog author="idonmez@suse.com" date="1365163200">- Add Source URL, see https://en.opensuse.org/SourceUrls</changelog>
  <changelog author="kstreitova@suse.com" date="1412337600">- spec-cleaner used for cleaning the specfile up
- "export NO_BRP_STRIP_DEBUG=true" removed from specfile</changelog>
  <changelog author="kstreitova@suse.com" date="1412596800">- url was repaired</changelog>
  <changelog author="kstreitova@suse.com" date="1413374400">- added telnet-bsd-1.2-fix-infinite-loop.patch that fixes the
  generating an infinite loop (bnc#898481)</changelog>
  <changelog author="dimstar@opensuse.org" date="1486036800">- Switch to ncurses6: use ncurses6-config to find the correct
  CFLAGS and libraries.</changelog>
  <changelog author="aliouliaki@suse.com" date="1497614400">- Removed xinetd service
- Added telnet@.service and telnet.socket
- Cleanup of telnet.spec</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639742400">- Update Source location to use Gentoo mirror, fixes bsc#1129925</changelog>
</package>
<package pkgid="09459290950f12fe5372a736251495bc2160338e18937a57f6e2884d00af6ec2" name="telnet-server" arch="ppc64le">
  <version epoch="0" ver="1.2" rel="3.3.1"/>
  <changelog author="vcizek@novell.com" date="1309435200">- exit cleanly, when hostalias cannot be resolved (bnc#700229)
- made manpage more clear about the -b option</changelog>
  <changelog author="vcizek@suse.com" date="1322136000">- added -ltinfo instead of -lncurses</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1325505600">- removed telnet-bsd-1.2-tinfo.patch
  Replacing -lncurses with -ltinfo doesn't seem to be required and
  it actually breaks builds
- refresh telnet-bsd-1.2-suppress_hostname.patch
- remove makros from patch names
- use makros for configure, make and make install</changelog>
  <changelog author="idonmez@suse.com" date="1365163200">- Add Source URL, see https://en.opensuse.org/SourceUrls</changelog>
  <changelog author="kstreitova@suse.com" date="1412337600">- spec-cleaner used for cleaning the specfile up
- "export NO_BRP_STRIP_DEBUG=true" removed from specfile</changelog>
  <changelog author="kstreitova@suse.com" date="1412596800">- url was repaired</changelog>
  <changelog author="kstreitova@suse.com" date="1413374400">- added telnet-bsd-1.2-fix-infinite-loop.patch that fixes the
  generating an infinite loop (bnc#898481)</changelog>
  <changelog author="dimstar@opensuse.org" date="1486036800">- Switch to ncurses6: use ncurses6-config to find the correct
  CFLAGS and libraries.</changelog>
  <changelog author="aliouliaki@suse.com" date="1497614400">- Removed xinetd service
- Added telnet@.service and telnet.socket
- Cleanup of telnet.spec</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639742400">- Update Source location to use Gentoo mirror, fixes bsc#1129925</changelog>
</package>
<package pkgid="443574f8d24f9b59930a90ac900ce3a4a8f6f81ff965e5c716e09cc1b46d9c05" name="telnet-server" arch="s390x">
  <version epoch="0" ver="1.2" rel="3.3.1"/>
  <changelog author="vcizek@novell.com" date="1309435200">- exit cleanly, when hostalias cannot be resolved (bnc#700229)
- made manpage more clear about the -b option</changelog>
  <changelog author="vcizek@suse.com" date="1322136000">- added -ltinfo instead of -lncurses</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1325505600">- removed telnet-bsd-1.2-tinfo.patch
  Replacing -lncurses with -ltinfo doesn't seem to be required and
  it actually breaks builds
- refresh telnet-bsd-1.2-suppress_hostname.patch
- remove makros from patch names
- use makros for configure, make and make install</changelog>
  <changelog author="idonmez@suse.com" date="1365163200">- Add Source URL, see https://en.opensuse.org/SourceUrls</changelog>
  <changelog author="kstreitova@suse.com" date="1412337600">- spec-cleaner used for cleaning the specfile up
- "export NO_BRP_STRIP_DEBUG=true" removed from specfile</changelog>
  <changelog author="kstreitova@suse.com" date="1412596800">- url was repaired</changelog>
  <changelog author="kstreitova@suse.com" date="1413374400">- added telnet-bsd-1.2-fix-infinite-loop.patch that fixes the
  generating an infinite loop (bnc#898481)</changelog>
  <changelog author="dimstar@opensuse.org" date="1486036800">- Switch to ncurses6: use ncurses6-config to find the correct
  CFLAGS and libraries.</changelog>
  <changelog author="aliouliaki@suse.com" date="1497614400">- Removed xinetd service
- Added telnet@.service and telnet.socket
- Cleanup of telnet.spec</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639742400">- Update Source location to use Gentoo mirror, fixes bsc#1129925</changelog>
</package>
<package pkgid="5c788bd54ee57c1a5ec14b6ad0d00390b6c82c16cd1ccd0377a199af85bb349e" name="telnet-server" arch="x86_64">
  <version epoch="0" ver="1.2" rel="3.3.1"/>
  <changelog author="vcizek@novell.com" date="1309435200">- exit cleanly, when hostalias cannot be resolved (bnc#700229)
- made manpage more clear about the -b option</changelog>
  <changelog author="vcizek@suse.com" date="1322136000">- added -ltinfo instead of -lncurses</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1325505600">- removed telnet-bsd-1.2-tinfo.patch
  Replacing -lncurses with -ltinfo doesn't seem to be required and
  it actually breaks builds
- refresh telnet-bsd-1.2-suppress_hostname.patch
- remove makros from patch names
- use makros for configure, make and make install</changelog>
  <changelog author="idonmez@suse.com" date="1365163200">- Add Source URL, see https://en.opensuse.org/SourceUrls</changelog>
  <changelog author="kstreitova@suse.com" date="1412337600">- spec-cleaner used for cleaning the specfile up
- "export NO_BRP_STRIP_DEBUG=true" removed from specfile</changelog>
  <changelog author="kstreitova@suse.com" date="1412596800">- url was repaired</changelog>
  <changelog author="kstreitova@suse.com" date="1413374400">- added telnet-bsd-1.2-fix-infinite-loop.patch that fixes the
  generating an infinite loop (bnc#898481)</changelog>
  <changelog author="dimstar@opensuse.org" date="1486036800">- Switch to ncurses6: use ncurses6-config to find the correct
  CFLAGS and libraries.</changelog>
  <changelog author="aliouliaki@suse.com" date="1497614400">- Removed xinetd service
- Added telnet@.service and telnet.socket
- Cleanup of telnet.spec</changelog>
  <changelog author="danilo.spinella@suse.com" date="1639742400">- Update Source location to use Gentoo mirror, fixes bsc#1129925</changelog>
</package>
<package pkgid="88161356cae3ee793f389b3fb0f38934102f21e8a76e2961df7fc39a4ed10d4b" name="tiff" arch="aarch64">
  <version epoch="0" ver="4.0.9" rel="45.5.1"/>
  <changelog author="fstrba@suse.com" date="1511956800">- Upgrade to upstream release 4.0.9
  * Changes in the software configuration:
    + test/Makefile.am: Add some tests for tiff2bw.
    + .appveyor.yml, .travis.yml, build/travis-ci: apply patches
    0001-ci-Travis-script-improvements.patch and
    0002-ci-Invoke-helper-script-via-shell.patch by Roger Leigh
    + .travis.yml, build/travis-ci: new files from
    0001-ci-Add-Travis-support-for-Linux-builds-with-Autoconf.patch
    by Roger Leigh. This patch adds support for the Travis-CI
    service.
    + .appveyor.yml: new file from
    0002-ci-Add-AppVeyor-support.patch by Roger Leigh (sent to
    mailing list on 2017-06-08) This patch adds a .appveyor.yml
    file to the top-level. This allows one to opt in to having a
    branch built on Windows with Cygwin, MinGW and MSVC
    automatically when a branch is pushed to GitHub, GitLab,
    BitBucket or any other supported git hosting service.
    + CMakeLists.txt, test/CMakeLists.txt,
    test/TiffTestCommon.cmake: apply patch
    0001-cmake-Improve-Cygwin-and-MingGW-test-support.patch from
    Roger Leigh. This patch makes the CMake build system support
    running the tests with MinGW or  Cygwin.
    + test/tiffcp-lzw-compat.sh, test/images/quad-lzw-compat.tiff:
    new files to test old-style LZW decompression
    + test/common.sh, Makefile.am, CMakeList.txt: updated with above
    + test/Makefile.am: add missing reference to
    images/quad-lzw-compat.tiff to fix "make distcheck". Patch by
    Roger Leigh
    + nmake.opt: support a DEBUG=1 option, so as to adjust OPTFLAGS
    and use /MDd runtime in debug mode.
  * Changes in libtiff:
    + libtiff/tif_color.c: TIFFYCbCrToRGBInit(): stricter clamping
    to avoid int32 overflow in TIFFYCbCrtoRGB(). Fixes
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1844
    + libtiff/tif_getimage.c: initYCbCrConversion(): stricter
    validation for refBlackWhite coefficients values. To avoid
    invalid float-&gt;int32 conversion (when refBlackWhite[0] ==
    2147483648.f) Fixes
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1907
    + libtiff/tif_dirinfo.c, tif_dirread.c: add
    _TIFFCheckFieldIsValidForCodec(), and use it in
    TIFFReadDirectory() so as to ignore fields whose tag is a
    codec-specified tag but this codec is not enabled. This avoids
    TIFFGetField() to behave differently depending on whether the
    codec is enabled or not, and thus can avoid stack based buffer
    overflows in a number of TIFF utilities such as tiffsplit,
    tiffcmp, thumbnail, etc. Patch derived from
    0063-Handle-properly-CODEC-specific-tags.patch
    (http://bugzilla.maptools.org/show_bug.cgi?id=2580) by Raphaël
    Hertzog.
    Fixes: http://bugzilla.maptools.org/show_bug.cgi?id=2580
    http://bugzilla.maptools.org/show_bug.cgi?id=2693
    http://bugzilla.maptools.org/show_bug.cgi?id=2625
    (CVE-2016-10095, bsc#1017690)
    http://bugzilla.maptools.org/show_bug.cgi?id=2564
    (CVE-2015-7554, bsc#960341)
    http://bugzilla.maptools.org/show_bug.cgi?id=2561
    (CVE-2016-5318, bsc#983436)
    http://bugzilla.maptools.org/show_bug.cgi?id=2499
    (CVE-2014-8128, bsc#969783)
    http://bugzilla.maptools.org/show_bug.cgi?id=2441
    http://bugzilla.maptools.org/show_bug.cgi?id=2433
    + libtiff/tif_swab.c: if DISABLE_CHECK_TIFFSWABMACROS is
    defined, do not do the #ifdef TIFFSwabXXX checks. Make it
    easier for GDAL to rename the symbols of its internal libtiff
    copy.
    + libtiff/tif_dirread.c: fix regression of libtiff 4.0.8 in
    ChopUpSingleUncompressedStrip() regarding update of newly
    single-strip uncompressed files whose bytecount is 0. Before
    the change of 2016-12-03, the condition bytecount==0 used to
    trigger an early exit/disabling of strip chop. Re-introduce
    that in update mode. Otherwise this cause later incorrect
    setting for the value of StripByCounts/StripOffsets.
    (https://trac.osgeo.org/gdal/ticket/6924)
    + libtiff/tif_dirread.c: TIFFFetchStripThing(): limit the
    number of items read in StripOffsets/StripByteCounts tags to
    the number of strips to avoid excessive memory allocation.
    Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2215
    + libtiff/tif_getimage.c: avoid many (harmless) unsigned int
    overflows.
    + libtiff/tif_fax3.c: avoid unsigned int overflow in
    Fax3Encode2DRow(). Could potentially be a bug with huge rows.
    + libtiff/tif_jpeg.c: avoid (harmless) unsigned int overflow on
    tiled images.
    + libtiff/tif_dirread.c: avoid unsigned int overflow in
    EstimateStripByteCounts() and BYTECOUNTLOOKSBAD when file is
    too short.
    + libtiff/tif_predict.c: decorate legitimate functions where
    unsigned int overflow occur with
    TIFF_NOSANITIZE_UNSIGNED_INT_OVERFLOW
    + libtiff/tif_dirread.c: avoid unsigned int overflow in
    EstimateStripByteCounts()
    + libtiff/tiffiop.h: add TIFF_NOSANITIZE_UNSIGNED_INT_OVERFLOW
    macro to disable CLang warnings raised by
  - fsanitize=undefined,unsigned-integer-overflow
    + libtiff/tif_jpeg.c: add anti-denial of service measure to
    avoid excessive CPU consumption on progressive JPEGs with a
    huge number of scans. See
    http://www.libjpeg-turbo.org/pmwiki/uploads/About/TwoIssueswiththeJPEGStandard.pdf
    Note: only affects libtiff since 2014-12-29 where support of
    non-baseline JPEG was added.
    + libtiff/tif_jpeg.c: error out at decoding time if anticipated
    libjpeg memory allocation is above 100 MB. libjpeg in case of
    multiple scans, which is allowed even in baseline JPEG, if
    components are spread over several scans and not
    interleavedin a single one, needs to allocate memory (or
    backing store) for the whole strip/tile. See
    http://www.libjpeg-turbo.org/pmwiki/uploads/About/TwoIssueswiththeJPEGStandard.pdf
    This limitation may be overriden by setting the
    LIBTIFF_ALLOW_LARGE_LIBJPEG_MEM_ALLOC environment variable, or
    recompiling libtiff with a custom value of
    TIFF_LIBJPEG_LARGEST_MEM_ALLOC macro.
    + libtiff/tif_jbig.c: fix memory leak in error code path of
    JBIGDecode()
    Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2706
    (CVE-2017-9936, bsc#1046073)
    + libtiff/tif_dirread.c: in TIFFReadDirEntryFloat(), check that
    a double value can fit in a float before casting.
    + libtiff/tiffiop.h, libtiff/tif_jpeg.c, libtiff/tif_jpeg_12.c,
    libtiff/tif_read.c: make TIFFReadScanline() works in
    CHUNKY_STRIP_READ_SUPPORT mode with JPEG stream with multiple
    scans. Also make configurable through a
    LIBTIFF_JPEG_MAX_ALLOWED_SCAN_NUMBER environment variable the
    maximum number of scans allowed. Defaults to 100.
    + libtiff/tif_read.c: TIFFFillTile(): add limitation to the
    number of bytes read in case td_stripbytecount[strip] is
    bigger than reasonable, so as to avoid excessive memory
    allocation (similarly to what was done for TIFFFileStrip() on
    2017-05-10)
    + libtiff/tif_getimage.c: use
    _TIFFReadEncodedStripAndAllocBuffer(). Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2708 and
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2433
    + libtiff/tif_read.c, tiffiop.h: add a
    _TIFFReadEncodedStripAndAllocBuffer() function, variant of
    TIFFReadEncodedStrip() that allocates the decoded buffer only
    after a first successful TIFFFillStrip(). This avoids
    excessive memory allocation on corrupted files.
    + libtiff/tif_dirwrite.c: in TIFFWriteDirectoryTagCheckedXXXX()
    functions associated with LONG8/SLONG8 data type, replace
    assertion that the file is BigTIFF, by a non-fatal error.
    Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2712
    + libtiff/tif_read.c: TIFFStartTile(): set tif_rawcc to
    tif_rawdataloaded when it is set. Similarly to
    TIFFStartStrip(). This issue was revealed by the change of
    2017-06-30 in TIFFFileTile(), limiting the number of bytes
    read. But it could probably have been hit too in
    CHUNKY_STRIP_READ_SUPPORT mode previously. Fixes
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2454
    + libtiff/tif_error.c, tif_warning.c: correctly use va_list
    when both an old-style and new-style warning/error handlers
    are installed. Patch by Paavo Helde (sent on the mailing list)
    + libtiff/tif_getimage.c: use _TIFFReadTileAndAllocBuffer().
    Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2470
    + libtiff/tif_read.c, tiffiop.h: add a
    _TIFFReadEncodedTileAndAllocBuffer() and
    _TIFFReadTileAndAllocBuffer() variants of
    TIFFReadEncodedTile() and TIFFReadTile() that allocates the
    decoded buffer only after a first successful TIFFFillTile().
    This avoids excessive memory allocation on corrupted files.
    + libtiff/tif_pixarlog.c: avoid excessive memory allocation on
    decoding when RowsPerStrip tag is not defined (and thus
    td_rowsperstrip == UINT_MAX) Fixes
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2554
    + libtiff/tif_lzw.c: fix 4.0.8 regression in the decoding of
    old-style LZW compressed files.
    + libtiff/tif_lzw.c: fix potential out-of-buffer read on 1-byte
    LZW strips. Crashing issue only on memory mapped files, where
    the strip offset is the last byte of the file, and the file
    size is a multiple of one page size on the CPU architecture
    (typically 4096)
    + libtiff/tif_dir.c: avoid potential null pointer dereference
    in _TIFFVGetField() on corrupted TIFFTAG_NUMBEROFINKS tag
    instance.
    Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2713
    + tools/tiff2pdf.c: prevent heap buffer overflow write in "Raw"
    mode on PlanarConfig=Contig input images. Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2715
    + libtiff/tif_read.c: TIFFFillStrip() / TIFFFillTile().
    Complementary fix for
    http://bugzilla.maptools.org/show_bug.cgi?id=2708 in the
    isMapped() case, so as to avoid excessive memory allocation
    when we need a temporary buffer but the file is truncated.
    + libtiff/tif_read.c: in TIFFFetchStripThing(), only grow the
    arrays that hold StripOffsets/StripByteCounts, when they are
    smaller than the expected number of striles, up to 1 million
    striles, and error out beyond. Can be tweaked by setting the
    environment variable LIBTIFF_STRILE_ARRAY_MAX_RESIZE_COUNT.
    This partially goes against a change added on 2002-12-17 to
    accept those arrays of wrong sizes, but is needed to avoid
    denial of services. Fixes
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2350
    + libtiff/tif_read.c: add protection against excessive memory
    allocation attempts in TIFFReadDirEntryArray() on short files.
    Effective for mmap'ed case. And non-mmap'ed case, but
    restricted to 64bit builds. Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2675
    (CVE-2017-12944, bsc#1054594)
    + libtiff/tif_luv.c: LogLuvInitState(): avoid excessive memory
    allocation when RowsPerStrip tag is missing. Fixes
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2683
    + libtiff/tif_getimage.c: gtTileContig() and gtTileSeparate():
    properly break from loops on error when stoponerr is set,
    instead of going on iterating on row based loop.
    + libtiff/tif_getimage.c: fix fromskew computation when
    to-be-skipped pixel number is not a multiple of the horizontal
    subsampling, and also in some other cases. Impact
    putcontig8bitYCbCr44tile, putcontig8bitYCbCr42tile,
    putcontig8bitYCbCr41tile, putcontig8bitYCbCr21tile and
    putcontig8bitYCbCr12tile Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2637 and
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2691
    + libtiff/tif_luv.c: further reduce memory requirements for
    temporary buffer when RowsPerStrip &gt;= image_length in
    LogLuvInitState() and LogL16InitState(). Fixes
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2700
    + libtiff/tif_dirwrite.c: replace assertion related to not
    finding the SubIFD tag by runtime check (in
    TIFFWriteDirectorySec()) Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2727
    + libtiff/tif_dirwrite.c: replace assertion to tag value not
    fitting on uint32 when selecting the value of SubIFD tag by
    runtime check (in TIFFWriteDirectoryTagSubifd()). Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2728
    + libtiff/tif_jpeg.c: accept reading the last strip of a JPEG
    compressed file if the codestream height is larger than the
    truncated height of the strip. Emit a warning in this
    situation since this is non compliant.
    + libtiff/tiffiop.h, tif_aux.c: redirect SeekOK() macro to a
    _TIFFSeekoK() function that checks if the offset is not
    bigger than INT64_MAX, so as to avoid a -1 error return code
    of TIFFSeekFile() to match a required seek to UINT64_MAX/-1.
    Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2726
    + libtiff/tif_dirread.c: add NULL check to avoid likely false
    positive null-pointer dereference warning by CLang Static
    Analyzer.
    + libtiff/libtiff.def: add TIFFReadRGBAStripExt and
    TIFFReadRGBATileExt Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2735
    + libtiff/tif_jpeg.c: add compatibility with libjpeg-turbo
    1.5.2 that honours max_memory_to_use &gt; 0. Cf
    https://github.com/libjpeg-turbo/libjpeg-turbo/issues/162
    + libtiff/tif_getimage.c: avoid floating point division by zero
    in initCIELabConversion() Fixes
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=3733
  * Changes in the tools:
    + tools/tiff2pdf.c: prevent heap buffer overflow write in "Raw"
    mode on PlanarConfig=Contig input images. Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2715
    + tools/tiffset.c: fix setting a single value for the
    ExtraSamples tag (and other tags with variable number of
    values). So 'tiffset -s ExtraSamples 1 X'. This only worked
    when setting 2 or more values, but not just one.
    + tools/fax2tiff.c (_FAX_Client_Data): Pass FAX_Client_Data as
    the client data. This client data is not used at all at the
    moment, but it makes the most sense. Issue that the value of
    client_data.fd was passed where a pointer is expected.
    + tools/tiff2pdf.c (t2p_sample_realize_palette): Fix possible
    arithmetic overflow in bounds checking code and eliminate
    comparison between signed and unsigned type.
    + tools/tiff2bw.c (main): Free memory allocated in the tiff2bw
    program. This is in response to the report associated with
    CVE-2017-16232, bsc#1069213 but does not solve the extremely
    high memory usage with the associated POC file.</changelog>
  <changelog author="dimstar@opensuse.org" date="1513857600">- Fix check section:
  + Make sure to get back to the right directory after chdir to
    'tools', or we can't run the 2nd test suite.
  + Fix typo: the tests are located in a directory called 'test',
    not 'tests'.</changelog>
  <changelog author="mvetter@suse.com" date="1518782400">- bsc#1046077: Add tiff-4.0.9-bsc1046077-CVE-2017-9935.patch
  Fix Heap-based buffer overflow in t2p_write_pdf</changelog>
  <changelog author="mvetter@suse.com" date="1519128000">- bsc#1081690: Add tiff-4.0.9-bsc1081690-CVE-2018-5784.patch
  Fix uncontrolled resource consumption in TIFFSetDirectory</changelog>
  <changelog author="pgajdos@suse.com" date="1526385600">- security update
  * CVE-2018-10963 [bsc#1092949]
    + tiff-CVE-2018-10963.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1526644800">- security update
  * CVE-2017-18013 [bsc#1074317]
    + tiff-CVE-2017-18013.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1528113600">- security update
  * CVE-2018-7456 [bsc#1082825]
    + tiff-CVE-2018-7456.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1528113601">- security update
  * CVE-2017-11613 [bsc#1082332]
    + tiff-CVE-2017-11613.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1528200000">- security update
  * CVE-2018-8905 [bsc#1086408]
    + tiff-CVE-2018-8905.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1534334400">- security update
  * CVE-2018-10779 [bsc#1092480]
    + tiff-CVE-2018-10779.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1539777600">- security update
  * CVE-2018-17100 [bsc#1108637]
    + tiff-CVE-2018-17100.patch
  * CVE-2018-17101 [bsc#1108627]
    + tiff-CVE-2018-17101.patch
  * CVE-2018-17795 [bsc#1110358]
    % tiff-4.0.9-bsc1046077-CVE-2017-9935.patch renamed to
    tiff-CVE-2017-9935,CVE-2018-17795.patch
  * CVE-2018-16335 [bsc#1106853]
    % tiff-CVE-2017-11613.patch renamed to
    tiff-CVE-2017-11613,CVE-2018-16335,15209.patch
- add a possibility to build with ASAN</changelog>
  <changelog author="pgajdos@suse.com" date="1542024000">- asan_build: build ASAN included
- debug_build: build more suitable for debugging</changelog>
  <changelog author="pgajdos@suse.com" date="1542024001">- security update
  * CVE-2018-18661 [bsc#1113672]
    + tiff-CVE-2018-18661.patch
  * CVE-2018-18557 [bsc#1113094]
    + tiff-CVE-2018-18557.patch
  * CVE-2018-12900 [bsc#1099257]
    + tiff-CVE-2018-12900.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1542628800">- security update
  * CVE-2018-19210 [bsc#1115717]
    + tiff-CVE-2018-19210.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1548849600">- extend tiff-CVE-2018-19210.patch and rename it to
  tiff-CVE-2018-17000,19210.patch [bsc#1108606c#11]
  * solves CVE-2018-19210 [bsc#1115717] and CVE-2018-17000 [bsc#1108606]</changelog>
  <changelog author="mvetter@suse.com" date="1549281600">- security update
  * CVE-2019-6128 [bsc#1121626]
    + tiff-CVE-2019-6128.patch</changelog>
  <changelog author="mvetter@suse.com" date="1549972800">- security update
  * CVE-2019-7663 [bsc#1125113]
    + tiff-CVE-2019-7663.patch</changelog>
  <changelog author="mvetter@suse.com" date="1573041600">- security update: Fix integer overflow in _TIFFCheckMalloc()
  * CVE-2019-14973 [bsc#1146608]
    + tiff-CVE-2019-14973.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1573041601">- security update: amend patch to fix test
- modified patches
  % tiff-CVE-2019-14973.patch (refreshed)</changelog>
  <changelog author="mvetter@suse.com" date="1642420800">- security update: Fix buffer overwrite
  * CVE-2019-17546[bsc#1154365]
    + tiff-CVE-2019-17546.patch
- security update: Fix heap based buffer overflow in pal2rgb
  * CVE-2017-17095[bsc#1071031]
    + tiff-CVE-2017-17095.patch
- security update: Fix OOB in _TIFFmemcpy
  * CVE-2022-22844[bsc#1194539]
    + tiff-CVE-2022-22844.patch
- security update: Fix memory allocation failure in tif_read.c
  * CVE-2020-35521[bsc#1182808] CVE-2020-35522[bsc#1182809]
    + tiff-CVE-2020-35521,CVE-2020-35522.patch
- security update: Fix DOS via invertImage()
  * CVE-2020-19131[bsc#1190312]
    + tiff-CVE-2020-19131.patch
- security update: Fix heap-based buffer overflow in TIFF2PDF tool
  * CVE-2020-35524[bsc#1182812]
    + tiff-CVE-2020-35524.patch
- security update: Fix integer overflow in tif_getimage
  * CVE-2020-35523 [bsc#1182811]
    + tiff-CVE-2020-35523.patch</changelog>
</package>
<package pkgid="3a1dce067bf95a3cb2169a921206a22b190100dadaa8ea4dbf0727ba493eeebc" name="tiff" arch="ppc64le">
  <version epoch="0" ver="4.0.9" rel="45.5.1"/>
  <changelog author="fstrba@suse.com" date="1511956800">- Upgrade to upstream release 4.0.9
  * Changes in the software configuration:
    + test/Makefile.am: Add some tests for tiff2bw.
    + .appveyor.yml, .travis.yml, build/travis-ci: apply patches
    0001-ci-Travis-script-improvements.patch and
    0002-ci-Invoke-helper-script-via-shell.patch by Roger Leigh
    + .travis.yml, build/travis-ci: new files from
    0001-ci-Add-Travis-support-for-Linux-builds-with-Autoconf.patch
    by Roger Leigh. This patch adds support for the Travis-CI
    service.
    + .appveyor.yml: new file from
    0002-ci-Add-AppVeyor-support.patch by Roger Leigh (sent to
    mailing list on 2017-06-08) This patch adds a .appveyor.yml
    file to the top-level. This allows one to opt in to having a
    branch built on Windows with Cygwin, MinGW and MSVC
    automatically when a branch is pushed to GitHub, GitLab,
    BitBucket or any other supported git hosting service.
    + CMakeLists.txt, test/CMakeLists.txt,
    test/TiffTestCommon.cmake: apply patch
    0001-cmake-Improve-Cygwin-and-MingGW-test-support.patch from
    Roger Leigh. This patch makes the CMake build system support
    running the tests with MinGW or  Cygwin.
    + test/tiffcp-lzw-compat.sh, test/images/quad-lzw-compat.tiff:
    new files to test old-style LZW decompression
    + test/common.sh, Makefile.am, CMakeList.txt: updated with above
    + test/Makefile.am: add missing reference to
    images/quad-lzw-compat.tiff to fix "make distcheck". Patch by
    Roger Leigh
    + nmake.opt: support a DEBUG=1 option, so as to adjust OPTFLAGS
    and use /MDd runtime in debug mode.
  * Changes in libtiff:
    + libtiff/tif_color.c: TIFFYCbCrToRGBInit(): stricter clamping
    to avoid int32 overflow in TIFFYCbCrtoRGB(). Fixes
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1844
    + libtiff/tif_getimage.c: initYCbCrConversion(): stricter
    validation for refBlackWhite coefficients values. To avoid
    invalid float-&gt;int32 conversion (when refBlackWhite[0] ==
    2147483648.f) Fixes
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1907
    + libtiff/tif_dirinfo.c, tif_dirread.c: add
    _TIFFCheckFieldIsValidForCodec(), and use it in
    TIFFReadDirectory() so as to ignore fields whose tag is a
    codec-specified tag but this codec is not enabled. This avoids
    TIFFGetField() to behave differently depending on whether the
    codec is enabled or not, and thus can avoid stack based buffer
    overflows in a number of TIFF utilities such as tiffsplit,
    tiffcmp, thumbnail, etc. Patch derived from
    0063-Handle-properly-CODEC-specific-tags.patch
    (http://bugzilla.maptools.org/show_bug.cgi?id=2580) by Raphaël
    Hertzog.
    Fixes: http://bugzilla.maptools.org/show_bug.cgi?id=2580
    http://bugzilla.maptools.org/show_bug.cgi?id=2693
    http://bugzilla.maptools.org/show_bug.cgi?id=2625
    (CVE-2016-10095, bsc#1017690)
    http://bugzilla.maptools.org/show_bug.cgi?id=2564
    (CVE-2015-7554, bsc#960341)
    http://bugzilla.maptools.org/show_bug.cgi?id=2561
    (CVE-2016-5318, bsc#983436)
    http://bugzilla.maptools.org/show_bug.cgi?id=2499
    (CVE-2014-8128, bsc#969783)
    http://bugzilla.maptools.org/show_bug.cgi?id=2441
    http://bugzilla.maptools.org/show_bug.cgi?id=2433
    + libtiff/tif_swab.c: if DISABLE_CHECK_TIFFSWABMACROS is
    defined, do not do the #ifdef TIFFSwabXXX checks. Make it
    easier for GDAL to rename the symbols of its internal libtiff
    copy.
    + libtiff/tif_dirread.c: fix regression of libtiff 4.0.8 in
    ChopUpSingleUncompressedStrip() regarding update of newly
    single-strip uncompressed files whose bytecount is 0. Before
    the change of 2016-12-03, the condition bytecount==0 used to
    trigger an early exit/disabling of strip chop. Re-introduce
    that in update mode. Otherwise this cause later incorrect
    setting for the value of StripByCounts/StripOffsets.
    (https://trac.osgeo.org/gdal/ticket/6924)
    + libtiff/tif_dirread.c: TIFFFetchStripThing(): limit the
    number of items read in StripOffsets/StripByteCounts tags to
    the number of strips to avoid excessive memory allocation.
    Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2215
    + libtiff/tif_getimage.c: avoid many (harmless) unsigned int
    overflows.
    + libtiff/tif_fax3.c: avoid unsigned int overflow in
    Fax3Encode2DRow(). Could potentially be a bug with huge rows.
    + libtiff/tif_jpeg.c: avoid (harmless) unsigned int overflow on
    tiled images.
    + libtiff/tif_dirread.c: avoid unsigned int overflow in
    EstimateStripByteCounts() and BYTECOUNTLOOKSBAD when file is
    too short.
    + libtiff/tif_predict.c: decorate legitimate functions where
    unsigned int overflow occur with
    TIFF_NOSANITIZE_UNSIGNED_INT_OVERFLOW
    + libtiff/tif_dirread.c: avoid unsigned int overflow in
    EstimateStripByteCounts()
    + libtiff/tiffiop.h: add TIFF_NOSANITIZE_UNSIGNED_INT_OVERFLOW
    macro to disable CLang warnings raised by
  - fsanitize=undefined,unsigned-integer-overflow
    + libtiff/tif_jpeg.c: add anti-denial of service measure to
    avoid excessive CPU consumption on progressive JPEGs with a
    huge number of scans. See
    http://www.libjpeg-turbo.org/pmwiki/uploads/About/TwoIssueswiththeJPEGStandard.pdf
    Note: only affects libtiff since 2014-12-29 where support of
    non-baseline JPEG was added.
    + libtiff/tif_jpeg.c: error out at decoding time if anticipated
    libjpeg memory allocation is above 100 MB. libjpeg in case of
    multiple scans, which is allowed even in baseline JPEG, if
    components are spread over several scans and not
    interleavedin a single one, needs to allocate memory (or
    backing store) for the whole strip/tile. See
    http://www.libjpeg-turbo.org/pmwiki/uploads/About/TwoIssueswiththeJPEGStandard.pdf
    This limitation may be overriden by setting the
    LIBTIFF_ALLOW_LARGE_LIBJPEG_MEM_ALLOC environment variable, or
    recompiling libtiff with a custom value of
    TIFF_LIBJPEG_LARGEST_MEM_ALLOC macro.
    + libtiff/tif_jbig.c: fix memory leak in error code path of
    JBIGDecode()
    Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2706
    (CVE-2017-9936, bsc#1046073)
    + libtiff/tif_dirread.c: in TIFFReadDirEntryFloat(), check that
    a double value can fit in a float before casting.
    + libtiff/tiffiop.h, libtiff/tif_jpeg.c, libtiff/tif_jpeg_12.c,
    libtiff/tif_read.c: make TIFFReadScanline() works in
    CHUNKY_STRIP_READ_SUPPORT mode with JPEG stream with multiple
    scans. Also make configurable through a
    LIBTIFF_JPEG_MAX_ALLOWED_SCAN_NUMBER environment variable the
    maximum number of scans allowed. Defaults to 100.
    + libtiff/tif_read.c: TIFFFillTile(): add limitation to the
    number of bytes read in case td_stripbytecount[strip] is
    bigger than reasonable, so as to avoid excessive memory
    allocation (similarly to what was done for TIFFFileStrip() on
    2017-05-10)
    + libtiff/tif_getimage.c: use
    _TIFFReadEncodedStripAndAllocBuffer(). Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2708 and
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2433
    + libtiff/tif_read.c, tiffiop.h: add a
    _TIFFReadEncodedStripAndAllocBuffer() function, variant of
    TIFFReadEncodedStrip() that allocates the decoded buffer only
    after a first successful TIFFFillStrip(). This avoids
    excessive memory allocation on corrupted files.
    + libtiff/tif_dirwrite.c: in TIFFWriteDirectoryTagCheckedXXXX()
    functions associated with LONG8/SLONG8 data type, replace
    assertion that the file is BigTIFF, by a non-fatal error.
    Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2712
    + libtiff/tif_read.c: TIFFStartTile(): set tif_rawcc to
    tif_rawdataloaded when it is set. Similarly to
    TIFFStartStrip(). This issue was revealed by the change of
    2017-06-30 in TIFFFileTile(), limiting the number of bytes
    read. But it could probably have been hit too in
    CHUNKY_STRIP_READ_SUPPORT mode previously. Fixes
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2454
    + libtiff/tif_error.c, tif_warning.c: correctly use va_list
    when both an old-style and new-style warning/error handlers
    are installed. Patch by Paavo Helde (sent on the mailing list)
    + libtiff/tif_getimage.c: use _TIFFReadTileAndAllocBuffer().
    Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2470
    + libtiff/tif_read.c, tiffiop.h: add a
    _TIFFReadEncodedTileAndAllocBuffer() and
    _TIFFReadTileAndAllocBuffer() variants of
    TIFFReadEncodedTile() and TIFFReadTile() that allocates the
    decoded buffer only after a first successful TIFFFillTile().
    This avoids excessive memory allocation on corrupted files.
    + libtiff/tif_pixarlog.c: avoid excessive memory allocation on
    decoding when RowsPerStrip tag is not defined (and thus
    td_rowsperstrip == UINT_MAX) Fixes
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2554
    + libtiff/tif_lzw.c: fix 4.0.8 regression in the decoding of
    old-style LZW compressed files.
    + libtiff/tif_lzw.c: fix potential out-of-buffer read on 1-byte
    LZW strips. Crashing issue only on memory mapped files, where
    the strip offset is the last byte of the file, and the file
    size is a multiple of one page size on the CPU architecture
    (typically 4096)
    + libtiff/tif_dir.c: avoid potential null pointer dereference
    in _TIFFVGetField() on corrupted TIFFTAG_NUMBEROFINKS tag
    instance.
    Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2713
    + tools/tiff2pdf.c: prevent heap buffer overflow write in "Raw"
    mode on PlanarConfig=Contig input images. Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2715
    + libtiff/tif_read.c: TIFFFillStrip() / TIFFFillTile().
    Complementary fix for
    http://bugzilla.maptools.org/show_bug.cgi?id=2708 in the
    isMapped() case, so as to avoid excessive memory allocation
    when we need a temporary buffer but the file is truncated.
    + libtiff/tif_read.c: in TIFFFetchStripThing(), only grow the
    arrays that hold StripOffsets/StripByteCounts, when they are
    smaller than the expected number of striles, up to 1 million
    striles, and error out beyond. Can be tweaked by setting the
    environment variable LIBTIFF_STRILE_ARRAY_MAX_RESIZE_COUNT.
    This partially goes against a change added on 2002-12-17 to
    accept those arrays of wrong sizes, but is needed to avoid
    denial of services. Fixes
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2350
    + libtiff/tif_read.c: add protection against excessive memory
    allocation attempts in TIFFReadDirEntryArray() on short files.
    Effective for mmap'ed case. And non-mmap'ed case, but
    restricted to 64bit builds. Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2675
    (CVE-2017-12944, bsc#1054594)
    + libtiff/tif_luv.c: LogLuvInitState(): avoid excessive memory
    allocation when RowsPerStrip tag is missing. Fixes
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2683
    + libtiff/tif_getimage.c: gtTileContig() and gtTileSeparate():
    properly break from loops on error when stoponerr is set,
    instead of going on iterating on row based loop.
    + libtiff/tif_getimage.c: fix fromskew computation when
    to-be-skipped pixel number is not a multiple of the horizontal
    subsampling, and also in some other cases. Impact
    putcontig8bitYCbCr44tile, putcontig8bitYCbCr42tile,
    putcontig8bitYCbCr41tile, putcontig8bitYCbCr21tile and
    putcontig8bitYCbCr12tile Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2637 and
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2691
    + libtiff/tif_luv.c: further reduce memory requirements for
    temporary buffer when RowsPerStrip &gt;= image_length in
    LogLuvInitState() and LogL16InitState(). Fixes
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2700
    + libtiff/tif_dirwrite.c: replace assertion related to not
    finding the SubIFD tag by runtime check (in
    TIFFWriteDirectorySec()) Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2727
    + libtiff/tif_dirwrite.c: replace assertion to tag value not
    fitting on uint32 when selecting the value of SubIFD tag by
    runtime check (in TIFFWriteDirectoryTagSubifd()). Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2728
    + libtiff/tif_jpeg.c: accept reading the last strip of a JPEG
    compressed file if the codestream height is larger than the
    truncated height of the strip. Emit a warning in this
    situation since this is non compliant.
    + libtiff/tiffiop.h, tif_aux.c: redirect SeekOK() macro to a
    _TIFFSeekoK() function that checks if the offset is not
    bigger than INT64_MAX, so as to avoid a -1 error return code
    of TIFFSeekFile() to match a required seek to UINT64_MAX/-1.
    Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2726
    + libtiff/tif_dirread.c: add NULL check to avoid likely false
    positive null-pointer dereference warning by CLang Static
    Analyzer.
    + libtiff/libtiff.def: add TIFFReadRGBAStripExt and
    TIFFReadRGBATileExt Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2735
    + libtiff/tif_jpeg.c: add compatibility with libjpeg-turbo
    1.5.2 that honours max_memory_to_use &gt; 0. Cf
    https://github.com/libjpeg-turbo/libjpeg-turbo/issues/162
    + libtiff/tif_getimage.c: avoid floating point division by zero
    in initCIELabConversion() Fixes
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=3733
  * Changes in the tools:
    + tools/tiff2pdf.c: prevent heap buffer overflow write in "Raw"
    mode on PlanarConfig=Contig input images. Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2715
    + tools/tiffset.c: fix setting a single value for the
    ExtraSamples tag (and other tags with variable number of
    values). So 'tiffset -s ExtraSamples 1 X'. This only worked
    when setting 2 or more values, but not just one.
    + tools/fax2tiff.c (_FAX_Client_Data): Pass FAX_Client_Data as
    the client data. This client data is not used at all at the
    moment, but it makes the most sense. Issue that the value of
    client_data.fd was passed where a pointer is expected.
    + tools/tiff2pdf.c (t2p_sample_realize_palette): Fix possible
    arithmetic overflow in bounds checking code and eliminate
    comparison between signed and unsigned type.
    + tools/tiff2bw.c (main): Free memory allocated in the tiff2bw
    program. This is in response to the report associated with
    CVE-2017-16232, bsc#1069213 but does not solve the extremely
    high memory usage with the associated POC file.</changelog>
  <changelog author="dimstar@opensuse.org" date="1513857600">- Fix check section:
  + Make sure to get back to the right directory after chdir to
    'tools', or we can't run the 2nd test suite.
  + Fix typo: the tests are located in a directory called 'test',
    not 'tests'.</changelog>
  <changelog author="mvetter@suse.com" date="1518782400">- bsc#1046077: Add tiff-4.0.9-bsc1046077-CVE-2017-9935.patch
  Fix Heap-based buffer overflow in t2p_write_pdf</changelog>
  <changelog author="mvetter@suse.com" date="1519128000">- bsc#1081690: Add tiff-4.0.9-bsc1081690-CVE-2018-5784.patch
  Fix uncontrolled resource consumption in TIFFSetDirectory</changelog>
  <changelog author="pgajdos@suse.com" date="1526385600">- security update
  * CVE-2018-10963 [bsc#1092949]
    + tiff-CVE-2018-10963.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1526644800">- security update
  * CVE-2017-18013 [bsc#1074317]
    + tiff-CVE-2017-18013.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1528113600">- security update
  * CVE-2018-7456 [bsc#1082825]
    + tiff-CVE-2018-7456.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1528113601">- security update
  * CVE-2017-11613 [bsc#1082332]
    + tiff-CVE-2017-11613.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1528200000">- security update
  * CVE-2018-8905 [bsc#1086408]
    + tiff-CVE-2018-8905.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1534334400">- security update
  * CVE-2018-10779 [bsc#1092480]
    + tiff-CVE-2018-10779.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1539777600">- security update
  * CVE-2018-17100 [bsc#1108637]
    + tiff-CVE-2018-17100.patch
  * CVE-2018-17101 [bsc#1108627]
    + tiff-CVE-2018-17101.patch
  * CVE-2018-17795 [bsc#1110358]
    % tiff-4.0.9-bsc1046077-CVE-2017-9935.patch renamed to
    tiff-CVE-2017-9935,CVE-2018-17795.patch
  * CVE-2018-16335 [bsc#1106853]
    % tiff-CVE-2017-11613.patch renamed to
    tiff-CVE-2017-11613,CVE-2018-16335,15209.patch
- add a possibility to build with ASAN</changelog>
  <changelog author="pgajdos@suse.com" date="1542024000">- asan_build: build ASAN included
- debug_build: build more suitable for debugging</changelog>
  <changelog author="pgajdos@suse.com" date="1542024001">- security update
  * CVE-2018-18661 [bsc#1113672]
    + tiff-CVE-2018-18661.patch
  * CVE-2018-18557 [bsc#1113094]
    + tiff-CVE-2018-18557.patch
  * CVE-2018-12900 [bsc#1099257]
    + tiff-CVE-2018-12900.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1542628800">- security update
  * CVE-2018-19210 [bsc#1115717]
    + tiff-CVE-2018-19210.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1548849600">- extend tiff-CVE-2018-19210.patch and rename it to
  tiff-CVE-2018-17000,19210.patch [bsc#1108606c#11]
  * solves CVE-2018-19210 [bsc#1115717] and CVE-2018-17000 [bsc#1108606]</changelog>
  <changelog author="mvetter@suse.com" date="1549281600">- security update
  * CVE-2019-6128 [bsc#1121626]
    + tiff-CVE-2019-6128.patch</changelog>
  <changelog author="mvetter@suse.com" date="1549972800">- security update
  * CVE-2019-7663 [bsc#1125113]
    + tiff-CVE-2019-7663.patch</changelog>
  <changelog author="mvetter@suse.com" date="1573041600">- security update: Fix integer overflow in _TIFFCheckMalloc()
  * CVE-2019-14973 [bsc#1146608]
    + tiff-CVE-2019-14973.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1573041601">- security update: amend patch to fix test
- modified patches
  % tiff-CVE-2019-14973.patch (refreshed)</changelog>
  <changelog author="mvetter@suse.com" date="1642420800">- security update: Fix buffer overwrite
  * CVE-2019-17546[bsc#1154365]
    + tiff-CVE-2019-17546.patch
- security update: Fix heap based buffer overflow in pal2rgb
  * CVE-2017-17095[bsc#1071031]
    + tiff-CVE-2017-17095.patch
- security update: Fix OOB in _TIFFmemcpy
  * CVE-2022-22844[bsc#1194539]
    + tiff-CVE-2022-22844.patch
- security update: Fix memory allocation failure in tif_read.c
  * CVE-2020-35521[bsc#1182808] CVE-2020-35522[bsc#1182809]
    + tiff-CVE-2020-35521,CVE-2020-35522.patch
- security update: Fix DOS via invertImage()
  * CVE-2020-19131[bsc#1190312]
    + tiff-CVE-2020-19131.patch
- security update: Fix heap-based buffer overflow in TIFF2PDF tool
  * CVE-2020-35524[bsc#1182812]
    + tiff-CVE-2020-35524.patch
- security update: Fix integer overflow in tif_getimage
  * CVE-2020-35523 [bsc#1182811]
    + tiff-CVE-2020-35523.patch</changelog>
</package>
<package pkgid="40ef69ae2db8fe3755332ccdabbad0dad59398e49d85273e8cb99a96fa2d7290" name="tiff" arch="s390x">
  <version epoch="0" ver="4.0.9" rel="45.5.1"/>
  <changelog author="fstrba@suse.com" date="1511956800">- Upgrade to upstream release 4.0.9
  * Changes in the software configuration:
    + test/Makefile.am: Add some tests for tiff2bw.
    + .appveyor.yml, .travis.yml, build/travis-ci: apply patches
    0001-ci-Travis-script-improvements.patch and
    0002-ci-Invoke-helper-script-via-shell.patch by Roger Leigh
    + .travis.yml, build/travis-ci: new files from
    0001-ci-Add-Travis-support-for-Linux-builds-with-Autoconf.patch
    by Roger Leigh. This patch adds support for the Travis-CI
    service.
    + .appveyor.yml: new file from
    0002-ci-Add-AppVeyor-support.patch by Roger Leigh (sent to
    mailing list on 2017-06-08) This patch adds a .appveyor.yml
    file to the top-level. This allows one to opt in to having a
    branch built on Windows with Cygwin, MinGW and MSVC
    automatically when a branch is pushed to GitHub, GitLab,
    BitBucket or any other supported git hosting service.
    + CMakeLists.txt, test/CMakeLists.txt,
    test/TiffTestCommon.cmake: apply patch
    0001-cmake-Improve-Cygwin-and-MingGW-test-support.patch from
    Roger Leigh. This patch makes the CMake build system support
    running the tests with MinGW or  Cygwin.
    + test/tiffcp-lzw-compat.sh, test/images/quad-lzw-compat.tiff:
    new files to test old-style LZW decompression
    + test/common.sh, Makefile.am, CMakeList.txt: updated with above
    + test/Makefile.am: add missing reference to
    images/quad-lzw-compat.tiff to fix "make distcheck". Patch by
    Roger Leigh
    + nmake.opt: support a DEBUG=1 option, so as to adjust OPTFLAGS
    and use /MDd runtime in debug mode.
  * Changes in libtiff:
    + libtiff/tif_color.c: TIFFYCbCrToRGBInit(): stricter clamping
    to avoid int32 overflow in TIFFYCbCrtoRGB(). Fixes
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1844
    + libtiff/tif_getimage.c: initYCbCrConversion(): stricter
    validation for refBlackWhite coefficients values. To avoid
    invalid float-&gt;int32 conversion (when refBlackWhite[0] ==
    2147483648.f) Fixes
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1907
    + libtiff/tif_dirinfo.c, tif_dirread.c: add
    _TIFFCheckFieldIsValidForCodec(), and use it in
    TIFFReadDirectory() so as to ignore fields whose tag is a
    codec-specified tag but this codec is not enabled. This avoids
    TIFFGetField() to behave differently depending on whether the
    codec is enabled or not, and thus can avoid stack based buffer
    overflows in a number of TIFF utilities such as tiffsplit,
    tiffcmp, thumbnail, etc. Patch derived from
    0063-Handle-properly-CODEC-specific-tags.patch
    (http://bugzilla.maptools.org/show_bug.cgi?id=2580) by Raphaël
    Hertzog.
    Fixes: http://bugzilla.maptools.org/show_bug.cgi?id=2580
    http://bugzilla.maptools.org/show_bug.cgi?id=2693
    http://bugzilla.maptools.org/show_bug.cgi?id=2625
    (CVE-2016-10095, bsc#1017690)
    http://bugzilla.maptools.org/show_bug.cgi?id=2564
    (CVE-2015-7554, bsc#960341)
    http://bugzilla.maptools.org/show_bug.cgi?id=2561
    (CVE-2016-5318, bsc#983436)
    http://bugzilla.maptools.org/show_bug.cgi?id=2499
    (CVE-2014-8128, bsc#969783)
    http://bugzilla.maptools.org/show_bug.cgi?id=2441
    http://bugzilla.maptools.org/show_bug.cgi?id=2433
    + libtiff/tif_swab.c: if DISABLE_CHECK_TIFFSWABMACROS is
    defined, do not do the #ifdef TIFFSwabXXX checks. Make it
    easier for GDAL to rename the symbols of its internal libtiff
    copy.
    + libtiff/tif_dirread.c: fix regression of libtiff 4.0.8 in
    ChopUpSingleUncompressedStrip() regarding update of newly
    single-strip uncompressed files whose bytecount is 0. Before
    the change of 2016-12-03, the condition bytecount==0 used to
    trigger an early exit/disabling of strip chop. Re-introduce
    that in update mode. Otherwise this cause later incorrect
    setting for the value of StripByCounts/StripOffsets.
    (https://trac.osgeo.org/gdal/ticket/6924)
    + libtiff/tif_dirread.c: TIFFFetchStripThing(): limit the
    number of items read in StripOffsets/StripByteCounts tags to
    the number of strips to avoid excessive memory allocation.
    Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2215
    + libtiff/tif_getimage.c: avoid many (harmless) unsigned int
    overflows.
    + libtiff/tif_fax3.c: avoid unsigned int overflow in
    Fax3Encode2DRow(). Could potentially be a bug with huge rows.
    + libtiff/tif_jpeg.c: avoid (harmless) unsigned int overflow on
    tiled images.
    + libtiff/tif_dirread.c: avoid unsigned int overflow in
    EstimateStripByteCounts() and BYTECOUNTLOOKSBAD when file is
    too short.
    + libtiff/tif_predict.c: decorate legitimate functions where
    unsigned int overflow occur with
    TIFF_NOSANITIZE_UNSIGNED_INT_OVERFLOW
    + libtiff/tif_dirread.c: avoid unsigned int overflow in
    EstimateStripByteCounts()
    + libtiff/tiffiop.h: add TIFF_NOSANITIZE_UNSIGNED_INT_OVERFLOW
    macro to disable CLang warnings raised by
  - fsanitize=undefined,unsigned-integer-overflow
    + libtiff/tif_jpeg.c: add anti-denial of service measure to
    avoid excessive CPU consumption on progressive JPEGs with a
    huge number of scans. See
    http://www.libjpeg-turbo.org/pmwiki/uploads/About/TwoIssueswiththeJPEGStandard.pdf
    Note: only affects libtiff since 2014-12-29 where support of
    non-baseline JPEG was added.
    + libtiff/tif_jpeg.c: error out at decoding time if anticipated
    libjpeg memory allocation is above 100 MB. libjpeg in case of
    multiple scans, which is allowed even in baseline JPEG, if
    components are spread over several scans and not
    interleavedin a single one, needs to allocate memory (or
    backing store) for the whole strip/tile. See
    http://www.libjpeg-turbo.org/pmwiki/uploads/About/TwoIssueswiththeJPEGStandard.pdf
    This limitation may be overriden by setting the
    LIBTIFF_ALLOW_LARGE_LIBJPEG_MEM_ALLOC environment variable, or
    recompiling libtiff with a custom value of
    TIFF_LIBJPEG_LARGEST_MEM_ALLOC macro.
    + libtiff/tif_jbig.c: fix memory leak in error code path of
    JBIGDecode()
    Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2706
    (CVE-2017-9936, bsc#1046073)
    + libtiff/tif_dirread.c: in TIFFReadDirEntryFloat(), check that
    a double value can fit in a float before casting.
    + libtiff/tiffiop.h, libtiff/tif_jpeg.c, libtiff/tif_jpeg_12.c,
    libtiff/tif_read.c: make TIFFReadScanline() works in
    CHUNKY_STRIP_READ_SUPPORT mode with JPEG stream with multiple
    scans. Also make configurable through a
    LIBTIFF_JPEG_MAX_ALLOWED_SCAN_NUMBER environment variable the
    maximum number of scans allowed. Defaults to 100.
    + libtiff/tif_read.c: TIFFFillTile(): add limitation to the
    number of bytes read in case td_stripbytecount[strip] is
    bigger than reasonable, so as to avoid excessive memory
    allocation (similarly to what was done for TIFFFileStrip() on
    2017-05-10)
    + libtiff/tif_getimage.c: use
    _TIFFReadEncodedStripAndAllocBuffer(). Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2708 and
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2433
    + libtiff/tif_read.c, tiffiop.h: add a
    _TIFFReadEncodedStripAndAllocBuffer() function, variant of
    TIFFReadEncodedStrip() that allocates the decoded buffer only
    after a first successful TIFFFillStrip(). This avoids
    excessive memory allocation on corrupted files.
    + libtiff/tif_dirwrite.c: in TIFFWriteDirectoryTagCheckedXXXX()
    functions associated with LONG8/SLONG8 data type, replace
    assertion that the file is BigTIFF, by a non-fatal error.
    Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2712
    + libtiff/tif_read.c: TIFFStartTile(): set tif_rawcc to
    tif_rawdataloaded when it is set. Similarly to
    TIFFStartStrip(). This issue was revealed by the change of
    2017-06-30 in TIFFFileTile(), limiting the number of bytes
    read. But it could probably have been hit too in
    CHUNKY_STRIP_READ_SUPPORT mode previously. Fixes
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2454
    + libtiff/tif_error.c, tif_warning.c: correctly use va_list
    when both an old-style and new-style warning/error handlers
    are installed. Patch by Paavo Helde (sent on the mailing list)
    + libtiff/tif_getimage.c: use _TIFFReadTileAndAllocBuffer().
    Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2470
    + libtiff/tif_read.c, tiffiop.h: add a
    _TIFFReadEncodedTileAndAllocBuffer() and
    _TIFFReadTileAndAllocBuffer() variants of
    TIFFReadEncodedTile() and TIFFReadTile() that allocates the
    decoded buffer only after a first successful TIFFFillTile().
    This avoids excessive memory allocation on corrupted files.
    + libtiff/tif_pixarlog.c: avoid excessive memory allocation on
    decoding when RowsPerStrip tag is not defined (and thus
    td_rowsperstrip == UINT_MAX) Fixes
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2554
    + libtiff/tif_lzw.c: fix 4.0.8 regression in the decoding of
    old-style LZW compressed files.
    + libtiff/tif_lzw.c: fix potential out-of-buffer read on 1-byte
    LZW strips. Crashing issue only on memory mapped files, where
    the strip offset is the last byte of the file, and the file
    size is a multiple of one page size on the CPU architecture
    (typically 4096)
    + libtiff/tif_dir.c: avoid potential null pointer dereference
    in _TIFFVGetField() on corrupted TIFFTAG_NUMBEROFINKS tag
    instance.
    Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2713
    + tools/tiff2pdf.c: prevent heap buffer overflow write in "Raw"
    mode on PlanarConfig=Contig input images. Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2715
    + libtiff/tif_read.c: TIFFFillStrip() / TIFFFillTile().
    Complementary fix for
    http://bugzilla.maptools.org/show_bug.cgi?id=2708 in the
    isMapped() case, so as to avoid excessive memory allocation
    when we need a temporary buffer but the file is truncated.
    + libtiff/tif_read.c: in TIFFFetchStripThing(), only grow the
    arrays that hold StripOffsets/StripByteCounts, when they are
    smaller than the expected number of striles, up to 1 million
    striles, and error out beyond. Can be tweaked by setting the
    environment variable LIBTIFF_STRILE_ARRAY_MAX_RESIZE_COUNT.
    This partially goes against a change added on 2002-12-17 to
    accept those arrays of wrong sizes, but is needed to avoid
    denial of services. Fixes
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2350
    + libtiff/tif_read.c: add protection against excessive memory
    allocation attempts in TIFFReadDirEntryArray() on short files.
    Effective for mmap'ed case. And non-mmap'ed case, but
    restricted to 64bit builds. Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2675
    (CVE-2017-12944, bsc#1054594)
    + libtiff/tif_luv.c: LogLuvInitState(): avoid excessive memory
    allocation when RowsPerStrip tag is missing. Fixes
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2683
    + libtiff/tif_getimage.c: gtTileContig() and gtTileSeparate():
    properly break from loops on error when stoponerr is set,
    instead of going on iterating on row based loop.
    + libtiff/tif_getimage.c: fix fromskew computation when
    to-be-skipped pixel number is not a multiple of the horizontal
    subsampling, and also in some other cases. Impact
    putcontig8bitYCbCr44tile, putcontig8bitYCbCr42tile,
    putcontig8bitYCbCr41tile, putcontig8bitYCbCr21tile and
    putcontig8bitYCbCr12tile Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2637 and
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2691
    + libtiff/tif_luv.c: further reduce memory requirements for
    temporary buffer when RowsPerStrip &gt;= image_length in
    LogLuvInitState() and LogL16InitState(). Fixes
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2700
    + libtiff/tif_dirwrite.c: replace assertion related to not
    finding the SubIFD tag by runtime check (in
    TIFFWriteDirectorySec()) Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2727
    + libtiff/tif_dirwrite.c: replace assertion to tag value not
    fitting on uint32 when selecting the value of SubIFD tag by
    runtime check (in TIFFWriteDirectoryTagSubifd()). Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2728
    + libtiff/tif_jpeg.c: accept reading the last strip of a JPEG
    compressed file if the codestream height is larger than the
    truncated height of the strip. Emit a warning in this
    situation since this is non compliant.
    + libtiff/tiffiop.h, tif_aux.c: redirect SeekOK() macro to a
    _TIFFSeekoK() function that checks if the offset is not
    bigger than INT64_MAX, so as to avoid a -1 error return code
    of TIFFSeekFile() to match a required seek to UINT64_MAX/-1.
    Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2726
    + libtiff/tif_dirread.c: add NULL check to avoid likely false
    positive null-pointer dereference warning by CLang Static
    Analyzer.
    + libtiff/libtiff.def: add TIFFReadRGBAStripExt and
    TIFFReadRGBATileExt Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2735
    + libtiff/tif_jpeg.c: add compatibility with libjpeg-turbo
    1.5.2 that honours max_memory_to_use &gt; 0. Cf
    https://github.com/libjpeg-turbo/libjpeg-turbo/issues/162
    + libtiff/tif_getimage.c: avoid floating point division by zero
    in initCIELabConversion() Fixes
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=3733
  * Changes in the tools:
    + tools/tiff2pdf.c: prevent heap buffer overflow write in "Raw"
    mode on PlanarConfig=Contig input images. Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2715
    + tools/tiffset.c: fix setting a single value for the
    ExtraSamples tag (and other tags with variable number of
    values). So 'tiffset -s ExtraSamples 1 X'. This only worked
    when setting 2 or more values, but not just one.
    + tools/fax2tiff.c (_FAX_Client_Data): Pass FAX_Client_Data as
    the client data. This client data is not used at all at the
    moment, but it makes the most sense. Issue that the value of
    client_data.fd was passed where a pointer is expected.
    + tools/tiff2pdf.c (t2p_sample_realize_palette): Fix possible
    arithmetic overflow in bounds checking code and eliminate
    comparison between signed and unsigned type.
    + tools/tiff2bw.c (main): Free memory allocated in the tiff2bw
    program. This is in response to the report associated with
    CVE-2017-16232, bsc#1069213 but does not solve the extremely
    high memory usage with the associated POC file.</changelog>
  <changelog author="dimstar@opensuse.org" date="1513857600">- Fix check section:
  + Make sure to get back to the right directory after chdir to
    'tools', or we can't run the 2nd test suite.
  + Fix typo: the tests are located in a directory called 'test',
    not 'tests'.</changelog>
  <changelog author="mvetter@suse.com" date="1518782400">- bsc#1046077: Add tiff-4.0.9-bsc1046077-CVE-2017-9935.patch
  Fix Heap-based buffer overflow in t2p_write_pdf</changelog>
  <changelog author="mvetter@suse.com" date="1519128000">- bsc#1081690: Add tiff-4.0.9-bsc1081690-CVE-2018-5784.patch
  Fix uncontrolled resource consumption in TIFFSetDirectory</changelog>
  <changelog author="pgajdos@suse.com" date="1526385600">- security update
  * CVE-2018-10963 [bsc#1092949]
    + tiff-CVE-2018-10963.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1526644800">- security update
  * CVE-2017-18013 [bsc#1074317]
    + tiff-CVE-2017-18013.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1528113600">- security update
  * CVE-2018-7456 [bsc#1082825]
    + tiff-CVE-2018-7456.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1528113601">- security update
  * CVE-2017-11613 [bsc#1082332]
    + tiff-CVE-2017-11613.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1528200000">- security update
  * CVE-2018-8905 [bsc#1086408]
    + tiff-CVE-2018-8905.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1534334400">- security update
  * CVE-2018-10779 [bsc#1092480]
    + tiff-CVE-2018-10779.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1539777600">- security update
  * CVE-2018-17100 [bsc#1108637]
    + tiff-CVE-2018-17100.patch
  * CVE-2018-17101 [bsc#1108627]
    + tiff-CVE-2018-17101.patch
  * CVE-2018-17795 [bsc#1110358]
    % tiff-4.0.9-bsc1046077-CVE-2017-9935.patch renamed to
    tiff-CVE-2017-9935,CVE-2018-17795.patch
  * CVE-2018-16335 [bsc#1106853]
    % tiff-CVE-2017-11613.patch renamed to
    tiff-CVE-2017-11613,CVE-2018-16335,15209.patch
- add a possibility to build with ASAN</changelog>
  <changelog author="pgajdos@suse.com" date="1542024000">- asan_build: build ASAN included
- debug_build: build more suitable for debugging</changelog>
  <changelog author="pgajdos@suse.com" date="1542024001">- security update
  * CVE-2018-18661 [bsc#1113672]
    + tiff-CVE-2018-18661.patch
  * CVE-2018-18557 [bsc#1113094]
    + tiff-CVE-2018-18557.patch
  * CVE-2018-12900 [bsc#1099257]
    + tiff-CVE-2018-12900.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1542628800">- security update
  * CVE-2018-19210 [bsc#1115717]
    + tiff-CVE-2018-19210.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1548849600">- extend tiff-CVE-2018-19210.patch and rename it to
  tiff-CVE-2018-17000,19210.patch [bsc#1108606c#11]
  * solves CVE-2018-19210 [bsc#1115717] and CVE-2018-17000 [bsc#1108606]</changelog>
  <changelog author="mvetter@suse.com" date="1549281600">- security update
  * CVE-2019-6128 [bsc#1121626]
    + tiff-CVE-2019-6128.patch</changelog>
  <changelog author="mvetter@suse.com" date="1549972800">- security update
  * CVE-2019-7663 [bsc#1125113]
    + tiff-CVE-2019-7663.patch</changelog>
  <changelog author="mvetter@suse.com" date="1573041600">- security update: Fix integer overflow in _TIFFCheckMalloc()
  * CVE-2019-14973 [bsc#1146608]
    + tiff-CVE-2019-14973.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1573041601">- security update: amend patch to fix test
- modified patches
  % tiff-CVE-2019-14973.patch (refreshed)</changelog>
  <changelog author="mvetter@suse.com" date="1642420800">- security update: Fix buffer overwrite
  * CVE-2019-17546[bsc#1154365]
    + tiff-CVE-2019-17546.patch
- security update: Fix heap based buffer overflow in pal2rgb
  * CVE-2017-17095[bsc#1071031]
    + tiff-CVE-2017-17095.patch
- security update: Fix OOB in _TIFFmemcpy
  * CVE-2022-22844[bsc#1194539]
    + tiff-CVE-2022-22844.patch
- security update: Fix memory allocation failure in tif_read.c
  * CVE-2020-35521[bsc#1182808] CVE-2020-35522[bsc#1182809]
    + tiff-CVE-2020-35521,CVE-2020-35522.patch
- security update: Fix DOS via invertImage()
  * CVE-2020-19131[bsc#1190312]
    + tiff-CVE-2020-19131.patch
- security update: Fix heap-based buffer overflow in TIFF2PDF tool
  * CVE-2020-35524[bsc#1182812]
    + tiff-CVE-2020-35524.patch
- security update: Fix integer overflow in tif_getimage
  * CVE-2020-35523 [bsc#1182811]
    + tiff-CVE-2020-35523.patch</changelog>
</package>
<package pkgid="e25ea8e5e2f0b633e154e187459d886414e5e39f18467e3eb85d66c3d2359740" name="tiff" arch="src">
  <version epoch="0" ver="4.0.9" rel="45.5.1"/>
  <changelog author="fstrba@suse.com" date="1511956800">- Upgrade to upstream release 4.0.9
  * Changes in the software configuration:
    + test/Makefile.am: Add some tests for tiff2bw.
    + .appveyor.yml, .travis.yml, build/travis-ci: apply patches
    0001-ci-Travis-script-improvements.patch and
    0002-ci-Invoke-helper-script-via-shell.patch by Roger Leigh
    + .travis.yml, build/travis-ci: new files from
    0001-ci-Add-Travis-support-for-Linux-builds-with-Autoconf.patch
    by Roger Leigh. This patch adds support for the Travis-CI
    service.
    + .appveyor.yml: new file from
    0002-ci-Add-AppVeyor-support.patch by Roger Leigh (sent to
    mailing list on 2017-06-08) This patch adds a .appveyor.yml
    file to the top-level. This allows one to opt in to having a
    branch built on Windows with Cygwin, MinGW and MSVC
    automatically when a branch is pushed to GitHub, GitLab,
    BitBucket or any other supported git hosting service.
    + CMakeLists.txt, test/CMakeLists.txt,
    test/TiffTestCommon.cmake: apply patch
    0001-cmake-Improve-Cygwin-and-MingGW-test-support.patch from
    Roger Leigh. This patch makes the CMake build system support
    running the tests with MinGW or  Cygwin.
    + test/tiffcp-lzw-compat.sh, test/images/quad-lzw-compat.tiff:
    new files to test old-style LZW decompression
    + test/common.sh, Makefile.am, CMakeList.txt: updated with above
    + test/Makefile.am: add missing reference to
    images/quad-lzw-compat.tiff to fix "make distcheck". Patch by
    Roger Leigh
    + nmake.opt: support a DEBUG=1 option, so as to adjust OPTFLAGS
    and use /MDd runtime in debug mode.
  * Changes in libtiff:
    + libtiff/tif_color.c: TIFFYCbCrToRGBInit(): stricter clamping
    to avoid int32 overflow in TIFFYCbCrtoRGB(). Fixes
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1844
    + libtiff/tif_getimage.c: initYCbCrConversion(): stricter
    validation for refBlackWhite coefficients values. To avoid
    invalid float-&gt;int32 conversion (when refBlackWhite[0] ==
    2147483648.f) Fixes
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1907
    + libtiff/tif_dirinfo.c, tif_dirread.c: add
    _TIFFCheckFieldIsValidForCodec(), and use it in
    TIFFReadDirectory() so as to ignore fields whose tag is a
    codec-specified tag but this codec is not enabled. This avoids
    TIFFGetField() to behave differently depending on whether the
    codec is enabled or not, and thus can avoid stack based buffer
    overflows in a number of TIFF utilities such as tiffsplit,
    tiffcmp, thumbnail, etc. Patch derived from
    0063-Handle-properly-CODEC-specific-tags.patch
    (http://bugzilla.maptools.org/show_bug.cgi?id=2580) by Raphaël
    Hertzog.
    Fixes: http://bugzilla.maptools.org/show_bug.cgi?id=2580
    http://bugzilla.maptools.org/show_bug.cgi?id=2693
    http://bugzilla.maptools.org/show_bug.cgi?id=2625
    (CVE-2016-10095, bsc#1017690)
    http://bugzilla.maptools.org/show_bug.cgi?id=2564
    (CVE-2015-7554, bsc#960341)
    http://bugzilla.maptools.org/show_bug.cgi?id=2561
    (CVE-2016-5318, bsc#983436)
    http://bugzilla.maptools.org/show_bug.cgi?id=2499
    (CVE-2014-8128, bsc#969783)
    http://bugzilla.maptools.org/show_bug.cgi?id=2441
    http://bugzilla.maptools.org/show_bug.cgi?id=2433
    + libtiff/tif_swab.c: if DISABLE_CHECK_TIFFSWABMACROS is
    defined, do not do the #ifdef TIFFSwabXXX checks. Make it
    easier for GDAL to rename the symbols of its internal libtiff
    copy.
    + libtiff/tif_dirread.c: fix regression of libtiff 4.0.8 in
    ChopUpSingleUncompressedStrip() regarding update of newly
    single-strip uncompressed files whose bytecount is 0. Before
    the change of 2016-12-03, the condition bytecount==0 used to
    trigger an early exit/disabling of strip chop. Re-introduce
    that in update mode. Otherwise this cause later incorrect
    setting for the value of StripByCounts/StripOffsets.
    (https://trac.osgeo.org/gdal/ticket/6924)
    + libtiff/tif_dirread.c: TIFFFetchStripThing(): limit the
    number of items read in StripOffsets/StripByteCounts tags to
    the number of strips to avoid excessive memory allocation.
    Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2215
    + libtiff/tif_getimage.c: avoid many (harmless) unsigned int
    overflows.
    + libtiff/tif_fax3.c: avoid unsigned int overflow in
    Fax3Encode2DRow(). Could potentially be a bug with huge rows.
    + libtiff/tif_jpeg.c: avoid (harmless) unsigned int overflow on
    tiled images.
    + libtiff/tif_dirread.c: avoid unsigned int overflow in
    EstimateStripByteCounts() and BYTECOUNTLOOKSBAD when file is
    too short.
    + libtiff/tif_predict.c: decorate legitimate functions where
    unsigned int overflow occur with
    TIFF_NOSANITIZE_UNSIGNED_INT_OVERFLOW
    + libtiff/tif_dirread.c: avoid unsigned int overflow in
    EstimateStripByteCounts()
    + libtiff/tiffiop.h: add TIFF_NOSANITIZE_UNSIGNED_INT_OVERFLOW
    macro to disable CLang warnings raised by
  - fsanitize=undefined,unsigned-integer-overflow
    + libtiff/tif_jpeg.c: add anti-denial of service measure to
    avoid excessive CPU consumption on progressive JPEGs with a
    huge number of scans. See
    http://www.libjpeg-turbo.org/pmwiki/uploads/About/TwoIssueswiththeJPEGStandard.pdf
    Note: only affects libtiff since 2014-12-29 where support of
    non-baseline JPEG was added.
    + libtiff/tif_jpeg.c: error out at decoding time if anticipated
    libjpeg memory allocation is above 100 MB. libjpeg in case of
    multiple scans, which is allowed even in baseline JPEG, if
    components are spread over several scans and not
    interleavedin a single one, needs to allocate memory (or
    backing store) for the whole strip/tile. See
    http://www.libjpeg-turbo.org/pmwiki/uploads/About/TwoIssueswiththeJPEGStandard.pdf
    This limitation may be overriden by setting the
    LIBTIFF_ALLOW_LARGE_LIBJPEG_MEM_ALLOC environment variable, or
    recompiling libtiff with a custom value of
    TIFF_LIBJPEG_LARGEST_MEM_ALLOC macro.
    + libtiff/tif_jbig.c: fix memory leak in error code path of
    JBIGDecode()
    Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2706
    (CVE-2017-9936, bsc#1046073)
    + libtiff/tif_dirread.c: in TIFFReadDirEntryFloat(), check that
    a double value can fit in a float before casting.
    + libtiff/tiffiop.h, libtiff/tif_jpeg.c, libtiff/tif_jpeg_12.c,
    libtiff/tif_read.c: make TIFFReadScanline() works in
    CHUNKY_STRIP_READ_SUPPORT mode with JPEG stream with multiple
    scans. Also make configurable through a
    LIBTIFF_JPEG_MAX_ALLOWED_SCAN_NUMBER environment variable the
    maximum number of scans allowed. Defaults to 100.
    + libtiff/tif_read.c: TIFFFillTile(): add limitation to the
    number of bytes read in case td_stripbytecount[strip] is
    bigger than reasonable, so as to avoid excessive memory
    allocation (similarly to what was done for TIFFFileStrip() on
    2017-05-10)
    + libtiff/tif_getimage.c: use
    _TIFFReadEncodedStripAndAllocBuffer(). Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2708 and
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2433
    + libtiff/tif_read.c, tiffiop.h: add a
    _TIFFReadEncodedStripAndAllocBuffer() function, variant of
    TIFFReadEncodedStrip() that allocates the decoded buffer only
    after a first successful TIFFFillStrip(). This avoids
    excessive memory allocation on corrupted files.
    + libtiff/tif_dirwrite.c: in TIFFWriteDirectoryTagCheckedXXXX()
    functions associated with LONG8/SLONG8 data type, replace
    assertion that the file is BigTIFF, by a non-fatal error.
    Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2712
    + libtiff/tif_read.c: TIFFStartTile(): set tif_rawcc to
    tif_rawdataloaded when it is set. Similarly to
    TIFFStartStrip(). This issue was revealed by the change of
    2017-06-30 in TIFFFileTile(), limiting the number of bytes
    read. But it could probably have been hit too in
    CHUNKY_STRIP_READ_SUPPORT mode previously. Fixes
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2454
    + libtiff/tif_error.c, tif_warning.c: correctly use va_list
    when both an old-style and new-style warning/error handlers
    are installed. Patch by Paavo Helde (sent on the mailing list)
    + libtiff/tif_getimage.c: use _TIFFReadTileAndAllocBuffer().
    Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2470
    + libtiff/tif_read.c, tiffiop.h: add a
    _TIFFReadEncodedTileAndAllocBuffer() and
    _TIFFReadTileAndAllocBuffer() variants of
    TIFFReadEncodedTile() and TIFFReadTile() that allocates the
    decoded buffer only after a first successful TIFFFillTile().
    This avoids excessive memory allocation on corrupted files.
    + libtiff/tif_pixarlog.c: avoid excessive memory allocation on
    decoding when RowsPerStrip tag is not defined (and thus
    td_rowsperstrip == UINT_MAX) Fixes
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2554
    + libtiff/tif_lzw.c: fix 4.0.8 regression in the decoding of
    old-style LZW compressed files.
    + libtiff/tif_lzw.c: fix potential out-of-buffer read on 1-byte
    LZW strips. Crashing issue only on memory mapped files, where
    the strip offset is the last byte of the file, and the file
    size is a multiple of one page size on the CPU architecture
    (typically 4096)
    + libtiff/tif_dir.c: avoid potential null pointer dereference
    in _TIFFVGetField() on corrupted TIFFTAG_NUMBEROFINKS tag
    instance.
    Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2713
    + tools/tiff2pdf.c: prevent heap buffer overflow write in "Raw"
    mode on PlanarConfig=Contig input images. Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2715
    + libtiff/tif_read.c: TIFFFillStrip() / TIFFFillTile().
    Complementary fix for
    http://bugzilla.maptools.org/show_bug.cgi?id=2708 in the
    isMapped() case, so as to avoid excessive memory allocation
    when we need a temporary buffer but the file is truncated.
    + libtiff/tif_read.c: in TIFFFetchStripThing(), only grow the
    arrays that hold StripOffsets/StripByteCounts, when they are
    smaller than the expected number of striles, up to 1 million
    striles, and error out beyond. Can be tweaked by setting the
    environment variable LIBTIFF_STRILE_ARRAY_MAX_RESIZE_COUNT.
    This partially goes against a change added on 2002-12-17 to
    accept those arrays of wrong sizes, but is needed to avoid
    denial of services. Fixes
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2350
    + libtiff/tif_read.c: add protection against excessive memory
    allocation attempts in TIFFReadDirEntryArray() on short files.
    Effective for mmap'ed case. And non-mmap'ed case, but
    restricted to 64bit builds. Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2675
    (CVE-2017-12944, bsc#1054594)
    + libtiff/tif_luv.c: LogLuvInitState(): avoid excessive memory
    allocation when RowsPerStrip tag is missing. Fixes
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2683
    + libtiff/tif_getimage.c: gtTileContig() and gtTileSeparate():
    properly break from loops on error when stoponerr is set,
    instead of going on iterating on row based loop.
    + libtiff/tif_getimage.c: fix fromskew computation when
    to-be-skipped pixel number is not a multiple of the horizontal
    subsampling, and also in some other cases. Impact
    putcontig8bitYCbCr44tile, putcontig8bitYCbCr42tile,
    putcontig8bitYCbCr41tile, putcontig8bitYCbCr21tile and
    putcontig8bitYCbCr12tile Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2637 and
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2691
    + libtiff/tif_luv.c: further reduce memory requirements for
    temporary buffer when RowsPerStrip &gt;= image_length in
    LogLuvInitState() and LogL16InitState(). Fixes
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2700
    + libtiff/tif_dirwrite.c: replace assertion related to not
    finding the SubIFD tag by runtime check (in
    TIFFWriteDirectorySec()) Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2727
    + libtiff/tif_dirwrite.c: replace assertion to tag value not
    fitting on uint32 when selecting the value of SubIFD tag by
    runtime check (in TIFFWriteDirectoryTagSubifd()). Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2728
    + libtiff/tif_jpeg.c: accept reading the last strip of a JPEG
    compressed file if the codestream height is larger than the
    truncated height of the strip. Emit a warning in this
    situation since this is non compliant.
    + libtiff/tiffiop.h, tif_aux.c: redirect SeekOK() macro to a
    _TIFFSeekoK() function that checks if the offset is not
    bigger than INT64_MAX, so as to avoid a -1 error return code
    of TIFFSeekFile() to match a required seek to UINT64_MAX/-1.
    Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2726
    + libtiff/tif_dirread.c: add NULL check to avoid likely false
    positive null-pointer dereference warning by CLang Static
    Analyzer.
    + libtiff/libtiff.def: add TIFFReadRGBAStripExt and
    TIFFReadRGBATileExt Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2735
    + libtiff/tif_jpeg.c: add compatibility with libjpeg-turbo
    1.5.2 that honours max_memory_to_use &gt; 0. Cf
    https://github.com/libjpeg-turbo/libjpeg-turbo/issues/162
    + libtiff/tif_getimage.c: avoid floating point division by zero
    in initCIELabConversion() Fixes
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=3733
  * Changes in the tools:
    + tools/tiff2pdf.c: prevent heap buffer overflow write in "Raw"
    mode on PlanarConfig=Contig input images. Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2715
    + tools/tiffset.c: fix setting a single value for the
    ExtraSamples tag (and other tags with variable number of
    values). So 'tiffset -s ExtraSamples 1 X'. This only worked
    when setting 2 or more values, but not just one.
    + tools/fax2tiff.c (_FAX_Client_Data): Pass FAX_Client_Data as
    the client data. This client data is not used at all at the
    moment, but it makes the most sense. Issue that the value of
    client_data.fd was passed where a pointer is expected.
    + tools/tiff2pdf.c (t2p_sample_realize_palette): Fix possible
    arithmetic overflow in bounds checking code and eliminate
    comparison between signed and unsigned type.
    + tools/tiff2bw.c (main): Free memory allocated in the tiff2bw
    program. This is in response to the report associated with
    CVE-2017-16232, bsc#1069213 but does not solve the extremely
    high memory usage with the associated POC file.</changelog>
  <changelog author="dimstar@opensuse.org" date="1513857600">- Fix check section:
  + Make sure to get back to the right directory after chdir to
    'tools', or we can't run the 2nd test suite.
  + Fix typo: the tests are located in a directory called 'test',
    not 'tests'.</changelog>
  <changelog author="mvetter@suse.com" date="1518782400">- bsc#1046077: Add tiff-4.0.9-bsc1046077-CVE-2017-9935.patch
  Fix Heap-based buffer overflow in t2p_write_pdf</changelog>
  <changelog author="mvetter@suse.com" date="1519128000">- bsc#1081690: Add tiff-4.0.9-bsc1081690-CVE-2018-5784.patch
  Fix uncontrolled resource consumption in TIFFSetDirectory</changelog>
  <changelog author="pgajdos@suse.com" date="1526385600">- security update
  * CVE-2018-10963 [bsc#1092949]
    + tiff-CVE-2018-10963.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1526644800">- security update
  * CVE-2017-18013 [bsc#1074317]
    + tiff-CVE-2017-18013.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1528113600">- security update
  * CVE-2018-7456 [bsc#1082825]
    + tiff-CVE-2018-7456.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1528113601">- security update
  * CVE-2017-11613 [bsc#1082332]
    + tiff-CVE-2017-11613.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1528200000">- security update
  * CVE-2018-8905 [bsc#1086408]
    + tiff-CVE-2018-8905.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1534334400">- security update
  * CVE-2018-10779 [bsc#1092480]
    + tiff-CVE-2018-10779.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1539777600">- security update
  * CVE-2018-17100 [bsc#1108637]
    + tiff-CVE-2018-17100.patch
  * CVE-2018-17101 [bsc#1108627]
    + tiff-CVE-2018-17101.patch
  * CVE-2018-17795 [bsc#1110358]
    % tiff-4.0.9-bsc1046077-CVE-2017-9935.patch renamed to
    tiff-CVE-2017-9935,CVE-2018-17795.patch
  * CVE-2018-16335 [bsc#1106853]
    % tiff-CVE-2017-11613.patch renamed to
    tiff-CVE-2017-11613,CVE-2018-16335,15209.patch
- add a possibility to build with ASAN</changelog>
  <changelog author="pgajdos@suse.com" date="1542024000">- asan_build: build ASAN included
- debug_build: build more suitable for debugging</changelog>
  <changelog author="pgajdos@suse.com" date="1542024001">- security update
  * CVE-2018-18661 [bsc#1113672]
    + tiff-CVE-2018-18661.patch
  * CVE-2018-18557 [bsc#1113094]
    + tiff-CVE-2018-18557.patch
  * CVE-2018-12900 [bsc#1099257]
    + tiff-CVE-2018-12900.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1542628800">- security update
  * CVE-2018-19210 [bsc#1115717]
    + tiff-CVE-2018-19210.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1548849600">- extend tiff-CVE-2018-19210.patch and rename it to
  tiff-CVE-2018-17000,19210.patch [bsc#1108606c#11]
  * solves CVE-2018-19210 [bsc#1115717] and CVE-2018-17000 [bsc#1108606]</changelog>
  <changelog author="mvetter@suse.com" date="1549281600">- security update
  * CVE-2019-6128 [bsc#1121626]
    + tiff-CVE-2019-6128.patch</changelog>
  <changelog author="mvetter@suse.com" date="1549972800">- security update
  * CVE-2019-7663 [bsc#1125113]
    + tiff-CVE-2019-7663.patch</changelog>
  <changelog author="mvetter@suse.com" date="1573041600">- security update: Fix integer overflow in _TIFFCheckMalloc()
  * CVE-2019-14973 [bsc#1146608]
    + tiff-CVE-2019-14973.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1573041601">- security update: amend patch to fix test
- modified patches
  % tiff-CVE-2019-14973.patch (refreshed)</changelog>
  <changelog author="mvetter@suse.com" date="1642420800">- security update: Fix buffer overwrite
  * CVE-2019-17546[bsc#1154365]
    + tiff-CVE-2019-17546.patch
- security update: Fix heap based buffer overflow in pal2rgb
  * CVE-2017-17095[bsc#1071031]
    + tiff-CVE-2017-17095.patch
- security update: Fix OOB in _TIFFmemcpy
  * CVE-2022-22844[bsc#1194539]
    + tiff-CVE-2022-22844.patch
- security update: Fix memory allocation failure in tif_read.c
  * CVE-2020-35521[bsc#1182808] CVE-2020-35522[bsc#1182809]
    + tiff-CVE-2020-35521,CVE-2020-35522.patch
- security update: Fix DOS via invertImage()
  * CVE-2020-19131[bsc#1190312]
    + tiff-CVE-2020-19131.patch
- security update: Fix heap-based buffer overflow in TIFF2PDF tool
  * CVE-2020-35524[bsc#1182812]
    + tiff-CVE-2020-35524.patch
- security update: Fix integer overflow in tif_getimage
  * CVE-2020-35523 [bsc#1182811]
    + tiff-CVE-2020-35523.patch</changelog>
</package>
<package pkgid="867b0f6ba17c5c49d1d3740ac6b77ab0e9ef22882c50d9cb351c2c1de44711a5" name="tiff" arch="x86_64">
  <version epoch="0" ver="4.0.9" rel="45.5.1"/>
  <changelog author="fstrba@suse.com" date="1511956800">- Upgrade to upstream release 4.0.9
  * Changes in the software configuration:
    + test/Makefile.am: Add some tests for tiff2bw.
    + .appveyor.yml, .travis.yml, build/travis-ci: apply patches
    0001-ci-Travis-script-improvements.patch and
    0002-ci-Invoke-helper-script-via-shell.patch by Roger Leigh
    + .travis.yml, build/travis-ci: new files from
    0001-ci-Add-Travis-support-for-Linux-builds-with-Autoconf.patch
    by Roger Leigh. This patch adds support for the Travis-CI
    service.
    + .appveyor.yml: new file from
    0002-ci-Add-AppVeyor-support.patch by Roger Leigh (sent to
    mailing list on 2017-06-08) This patch adds a .appveyor.yml
    file to the top-level. This allows one to opt in to having a
    branch built on Windows with Cygwin, MinGW and MSVC
    automatically when a branch is pushed to GitHub, GitLab,
    BitBucket or any other supported git hosting service.
    + CMakeLists.txt, test/CMakeLists.txt,
    test/TiffTestCommon.cmake: apply patch
    0001-cmake-Improve-Cygwin-and-MingGW-test-support.patch from
    Roger Leigh. This patch makes the CMake build system support
    running the tests with MinGW or  Cygwin.
    + test/tiffcp-lzw-compat.sh, test/images/quad-lzw-compat.tiff:
    new files to test old-style LZW decompression
    + test/common.sh, Makefile.am, CMakeList.txt: updated with above
    + test/Makefile.am: add missing reference to
    images/quad-lzw-compat.tiff to fix "make distcheck". Patch by
    Roger Leigh
    + nmake.opt: support a DEBUG=1 option, so as to adjust OPTFLAGS
    and use /MDd runtime in debug mode.
  * Changes in libtiff:
    + libtiff/tif_color.c: TIFFYCbCrToRGBInit(): stricter clamping
    to avoid int32 overflow in TIFFYCbCrtoRGB(). Fixes
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1844
    + libtiff/tif_getimage.c: initYCbCrConversion(): stricter
    validation for refBlackWhite coefficients values. To avoid
    invalid float-&gt;int32 conversion (when refBlackWhite[0] ==
    2147483648.f) Fixes
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1907
    + libtiff/tif_dirinfo.c, tif_dirread.c: add
    _TIFFCheckFieldIsValidForCodec(), and use it in
    TIFFReadDirectory() so as to ignore fields whose tag is a
    codec-specified tag but this codec is not enabled. This avoids
    TIFFGetField() to behave differently depending on whether the
    codec is enabled or not, and thus can avoid stack based buffer
    overflows in a number of TIFF utilities such as tiffsplit,
    tiffcmp, thumbnail, etc. Patch derived from
    0063-Handle-properly-CODEC-specific-tags.patch
    (http://bugzilla.maptools.org/show_bug.cgi?id=2580) by Raphaël
    Hertzog.
    Fixes: http://bugzilla.maptools.org/show_bug.cgi?id=2580
    http://bugzilla.maptools.org/show_bug.cgi?id=2693
    http://bugzilla.maptools.org/show_bug.cgi?id=2625
    (CVE-2016-10095, bsc#1017690)
    http://bugzilla.maptools.org/show_bug.cgi?id=2564
    (CVE-2015-7554, bsc#960341)
    http://bugzilla.maptools.org/show_bug.cgi?id=2561
    (CVE-2016-5318, bsc#983436)
    http://bugzilla.maptools.org/show_bug.cgi?id=2499
    (CVE-2014-8128, bsc#969783)
    http://bugzilla.maptools.org/show_bug.cgi?id=2441
    http://bugzilla.maptools.org/show_bug.cgi?id=2433
    + libtiff/tif_swab.c: if DISABLE_CHECK_TIFFSWABMACROS is
    defined, do not do the #ifdef TIFFSwabXXX checks. Make it
    easier for GDAL to rename the symbols of its internal libtiff
    copy.
    + libtiff/tif_dirread.c: fix regression of libtiff 4.0.8 in
    ChopUpSingleUncompressedStrip() regarding update of newly
    single-strip uncompressed files whose bytecount is 0. Before
    the change of 2016-12-03, the condition bytecount==0 used to
    trigger an early exit/disabling of strip chop. Re-introduce
    that in update mode. Otherwise this cause later incorrect
    setting for the value of StripByCounts/StripOffsets.
    (https://trac.osgeo.org/gdal/ticket/6924)
    + libtiff/tif_dirread.c: TIFFFetchStripThing(): limit the
    number of items read in StripOffsets/StripByteCounts tags to
    the number of strips to avoid excessive memory allocation.
    Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2215
    + libtiff/tif_getimage.c: avoid many (harmless) unsigned int
    overflows.
    + libtiff/tif_fax3.c: avoid unsigned int overflow in
    Fax3Encode2DRow(). Could potentially be a bug with huge rows.
    + libtiff/tif_jpeg.c: avoid (harmless) unsigned int overflow on
    tiled images.
    + libtiff/tif_dirread.c: avoid unsigned int overflow in
    EstimateStripByteCounts() and BYTECOUNTLOOKSBAD when file is
    too short.
    + libtiff/tif_predict.c: decorate legitimate functions where
    unsigned int overflow occur with
    TIFF_NOSANITIZE_UNSIGNED_INT_OVERFLOW
    + libtiff/tif_dirread.c: avoid unsigned int overflow in
    EstimateStripByteCounts()
    + libtiff/tiffiop.h: add TIFF_NOSANITIZE_UNSIGNED_INT_OVERFLOW
    macro to disable CLang warnings raised by
  - fsanitize=undefined,unsigned-integer-overflow
    + libtiff/tif_jpeg.c: add anti-denial of service measure to
    avoid excessive CPU consumption on progressive JPEGs with a
    huge number of scans. See
    http://www.libjpeg-turbo.org/pmwiki/uploads/About/TwoIssueswiththeJPEGStandard.pdf
    Note: only affects libtiff since 2014-12-29 where support of
    non-baseline JPEG was added.
    + libtiff/tif_jpeg.c: error out at decoding time if anticipated
    libjpeg memory allocation is above 100 MB. libjpeg in case of
    multiple scans, which is allowed even in baseline JPEG, if
    components are spread over several scans and not
    interleavedin a single one, needs to allocate memory (or
    backing store) for the whole strip/tile. See
    http://www.libjpeg-turbo.org/pmwiki/uploads/About/TwoIssueswiththeJPEGStandard.pdf
    This limitation may be overriden by setting the
    LIBTIFF_ALLOW_LARGE_LIBJPEG_MEM_ALLOC environment variable, or
    recompiling libtiff with a custom value of
    TIFF_LIBJPEG_LARGEST_MEM_ALLOC macro.
    + libtiff/tif_jbig.c: fix memory leak in error code path of
    JBIGDecode()
    Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2706
    (CVE-2017-9936, bsc#1046073)
    + libtiff/tif_dirread.c: in TIFFReadDirEntryFloat(), check that
    a double value can fit in a float before casting.
    + libtiff/tiffiop.h, libtiff/tif_jpeg.c, libtiff/tif_jpeg_12.c,
    libtiff/tif_read.c: make TIFFReadScanline() works in
    CHUNKY_STRIP_READ_SUPPORT mode with JPEG stream with multiple
    scans. Also make configurable through a
    LIBTIFF_JPEG_MAX_ALLOWED_SCAN_NUMBER environment variable the
    maximum number of scans allowed. Defaults to 100.
    + libtiff/tif_read.c: TIFFFillTile(): add limitation to the
    number of bytes read in case td_stripbytecount[strip] is
    bigger than reasonable, so as to avoid excessive memory
    allocation (similarly to what was done for TIFFFileStrip() on
    2017-05-10)
    + libtiff/tif_getimage.c: use
    _TIFFReadEncodedStripAndAllocBuffer(). Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2708 and
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2433
    + libtiff/tif_read.c, tiffiop.h: add a
    _TIFFReadEncodedStripAndAllocBuffer() function, variant of
    TIFFReadEncodedStrip() that allocates the decoded buffer only
    after a first successful TIFFFillStrip(). This avoids
    excessive memory allocation on corrupted files.
    + libtiff/tif_dirwrite.c: in TIFFWriteDirectoryTagCheckedXXXX()
    functions associated with LONG8/SLONG8 data type, replace
    assertion that the file is BigTIFF, by a non-fatal error.
    Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2712
    + libtiff/tif_read.c: TIFFStartTile(): set tif_rawcc to
    tif_rawdataloaded when it is set. Similarly to
    TIFFStartStrip(). This issue was revealed by the change of
    2017-06-30 in TIFFFileTile(), limiting the number of bytes
    read. But it could probably have been hit too in
    CHUNKY_STRIP_READ_SUPPORT mode previously. Fixes
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2454
    + libtiff/tif_error.c, tif_warning.c: correctly use va_list
    when both an old-style and new-style warning/error handlers
    are installed. Patch by Paavo Helde (sent on the mailing list)
    + libtiff/tif_getimage.c: use _TIFFReadTileAndAllocBuffer().
    Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2470
    + libtiff/tif_read.c, tiffiop.h: add a
    _TIFFReadEncodedTileAndAllocBuffer() and
    _TIFFReadTileAndAllocBuffer() variants of
    TIFFReadEncodedTile() and TIFFReadTile() that allocates the
    decoded buffer only after a first successful TIFFFillTile().
    This avoids excessive memory allocation on corrupted files.
    + libtiff/tif_pixarlog.c: avoid excessive memory allocation on
    decoding when RowsPerStrip tag is not defined (and thus
    td_rowsperstrip == UINT_MAX) Fixes
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2554
    + libtiff/tif_lzw.c: fix 4.0.8 regression in the decoding of
    old-style LZW compressed files.
    + libtiff/tif_lzw.c: fix potential out-of-buffer read on 1-byte
    LZW strips. Crashing issue only on memory mapped files, where
    the strip offset is the last byte of the file, and the file
    size is a multiple of one page size on the CPU architecture
    (typically 4096)
    + libtiff/tif_dir.c: avoid potential null pointer dereference
    in _TIFFVGetField() on corrupted TIFFTAG_NUMBEROFINKS tag
    instance.
    Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2713
    + tools/tiff2pdf.c: prevent heap buffer overflow write in "Raw"
    mode on PlanarConfig=Contig input images. Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2715
    + libtiff/tif_read.c: TIFFFillStrip() / TIFFFillTile().
    Complementary fix for
    http://bugzilla.maptools.org/show_bug.cgi?id=2708 in the
    isMapped() case, so as to avoid excessive memory allocation
    when we need a temporary buffer but the file is truncated.
    + libtiff/tif_read.c: in TIFFFetchStripThing(), only grow the
    arrays that hold StripOffsets/StripByteCounts, when they are
    smaller than the expected number of striles, up to 1 million
    striles, and error out beyond. Can be tweaked by setting the
    environment variable LIBTIFF_STRILE_ARRAY_MAX_RESIZE_COUNT.
    This partially goes against a change added on 2002-12-17 to
    accept those arrays of wrong sizes, but is needed to avoid
    denial of services. Fixes
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2350
    + libtiff/tif_read.c: add protection against excessive memory
    allocation attempts in TIFFReadDirEntryArray() on short files.
    Effective for mmap'ed case. And non-mmap'ed case, but
    restricted to 64bit builds. Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2675
    (CVE-2017-12944, bsc#1054594)
    + libtiff/tif_luv.c: LogLuvInitState(): avoid excessive memory
    allocation when RowsPerStrip tag is missing. Fixes
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2683
    + libtiff/tif_getimage.c: gtTileContig() and gtTileSeparate():
    properly break from loops on error when stoponerr is set,
    instead of going on iterating on row based loop.
    + libtiff/tif_getimage.c: fix fromskew computation when
    to-be-skipped pixel number is not a multiple of the horizontal
    subsampling, and also in some other cases. Impact
    putcontig8bitYCbCr44tile, putcontig8bitYCbCr42tile,
    putcontig8bitYCbCr41tile, putcontig8bitYCbCr21tile and
    putcontig8bitYCbCr12tile Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2637 and
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2691
    + libtiff/tif_luv.c: further reduce memory requirements for
    temporary buffer when RowsPerStrip &gt;= image_length in
    LogLuvInitState() and LogL16InitState(). Fixes
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2700
    + libtiff/tif_dirwrite.c: replace assertion related to not
    finding the SubIFD tag by runtime check (in
    TIFFWriteDirectorySec()) Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2727
    + libtiff/tif_dirwrite.c: replace assertion to tag value not
    fitting on uint32 when selecting the value of SubIFD tag by
    runtime check (in TIFFWriteDirectoryTagSubifd()). Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2728
    + libtiff/tif_jpeg.c: accept reading the last strip of a JPEG
    compressed file if the codestream height is larger than the
    truncated height of the strip. Emit a warning in this
    situation since this is non compliant.
    + libtiff/tiffiop.h, tif_aux.c: redirect SeekOK() macro to a
    _TIFFSeekoK() function that checks if the offset is not
    bigger than INT64_MAX, so as to avoid a -1 error return code
    of TIFFSeekFile() to match a required seek to UINT64_MAX/-1.
    Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2726
    + libtiff/tif_dirread.c: add NULL check to avoid likely false
    positive null-pointer dereference warning by CLang Static
    Analyzer.
    + libtiff/libtiff.def: add TIFFReadRGBAStripExt and
    TIFFReadRGBATileExt Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2735
    + libtiff/tif_jpeg.c: add compatibility with libjpeg-turbo
    1.5.2 that honours max_memory_to_use &gt; 0. Cf
    https://github.com/libjpeg-turbo/libjpeg-turbo/issues/162
    + libtiff/tif_getimage.c: avoid floating point division by zero
    in initCIELabConversion() Fixes
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=3733
  * Changes in the tools:
    + tools/tiff2pdf.c: prevent heap buffer overflow write in "Raw"
    mode on PlanarConfig=Contig input images. Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2715
    + tools/tiffset.c: fix setting a single value for the
    ExtraSamples tag (and other tags with variable number of
    values). So 'tiffset -s ExtraSamples 1 X'. This only worked
    when setting 2 or more values, but not just one.
    + tools/fax2tiff.c (_FAX_Client_Data): Pass FAX_Client_Data as
    the client data. This client data is not used at all at the
    moment, but it makes the most sense. Issue that the value of
    client_data.fd was passed where a pointer is expected.
    + tools/tiff2pdf.c (t2p_sample_realize_palette): Fix possible
    arithmetic overflow in bounds checking code and eliminate
    comparison between signed and unsigned type.
    + tools/tiff2bw.c (main): Free memory allocated in the tiff2bw
    program. This is in response to the report associated with
    CVE-2017-16232, bsc#1069213 but does not solve the extremely
    high memory usage with the associated POC file.</changelog>
  <changelog author="dimstar@opensuse.org" date="1513857600">- Fix check section:
  + Make sure to get back to the right directory after chdir to
    'tools', or we can't run the 2nd test suite.
  + Fix typo: the tests are located in a directory called 'test',
    not 'tests'.</changelog>
  <changelog author="mvetter@suse.com" date="1518782400">- bsc#1046077: Add tiff-4.0.9-bsc1046077-CVE-2017-9935.patch
  Fix Heap-based buffer overflow in t2p_write_pdf</changelog>
  <changelog author="mvetter@suse.com" date="1519128000">- bsc#1081690: Add tiff-4.0.9-bsc1081690-CVE-2018-5784.patch
  Fix uncontrolled resource consumption in TIFFSetDirectory</changelog>
  <changelog author="pgajdos@suse.com" date="1526385600">- security update
  * CVE-2018-10963 [bsc#1092949]
    + tiff-CVE-2018-10963.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1526644800">- security update
  * CVE-2017-18013 [bsc#1074317]
    + tiff-CVE-2017-18013.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1528113600">- security update
  * CVE-2018-7456 [bsc#1082825]
    + tiff-CVE-2018-7456.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1528113601">- security update
  * CVE-2017-11613 [bsc#1082332]
    + tiff-CVE-2017-11613.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1528200000">- security update
  * CVE-2018-8905 [bsc#1086408]
    + tiff-CVE-2018-8905.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1534334400">- security update
  * CVE-2018-10779 [bsc#1092480]
    + tiff-CVE-2018-10779.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1539777600">- security update
  * CVE-2018-17100 [bsc#1108637]
    + tiff-CVE-2018-17100.patch
  * CVE-2018-17101 [bsc#1108627]
    + tiff-CVE-2018-17101.patch
  * CVE-2018-17795 [bsc#1110358]
    % tiff-4.0.9-bsc1046077-CVE-2017-9935.patch renamed to
    tiff-CVE-2017-9935,CVE-2018-17795.patch
  * CVE-2018-16335 [bsc#1106853]
    % tiff-CVE-2017-11613.patch renamed to
    tiff-CVE-2017-11613,CVE-2018-16335,15209.patch
- add a possibility to build with ASAN</changelog>
  <changelog author="pgajdos@suse.com" date="1542024000">- asan_build: build ASAN included
- debug_build: build more suitable for debugging</changelog>
  <changelog author="pgajdos@suse.com" date="1542024001">- security update
  * CVE-2018-18661 [bsc#1113672]
    + tiff-CVE-2018-18661.patch
  * CVE-2018-18557 [bsc#1113094]
    + tiff-CVE-2018-18557.patch
  * CVE-2018-12900 [bsc#1099257]
    + tiff-CVE-2018-12900.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1542628800">- security update
  * CVE-2018-19210 [bsc#1115717]
    + tiff-CVE-2018-19210.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1548849600">- extend tiff-CVE-2018-19210.patch and rename it to
  tiff-CVE-2018-17000,19210.patch [bsc#1108606c#11]
  * solves CVE-2018-19210 [bsc#1115717] and CVE-2018-17000 [bsc#1108606]</changelog>
  <changelog author="mvetter@suse.com" date="1549281600">- security update
  * CVE-2019-6128 [bsc#1121626]
    + tiff-CVE-2019-6128.patch</changelog>
  <changelog author="mvetter@suse.com" date="1549972800">- security update
  * CVE-2019-7663 [bsc#1125113]
    + tiff-CVE-2019-7663.patch</changelog>
  <changelog author="mvetter@suse.com" date="1573041600">- security update: Fix integer overflow in _TIFFCheckMalloc()
  * CVE-2019-14973 [bsc#1146608]
    + tiff-CVE-2019-14973.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1573041601">- security update: amend patch to fix test
- modified patches
  % tiff-CVE-2019-14973.patch (refreshed)</changelog>
  <changelog author="mvetter@suse.com" date="1642420800">- security update: Fix buffer overwrite
  * CVE-2019-17546[bsc#1154365]
    + tiff-CVE-2019-17546.patch
- security update: Fix heap based buffer overflow in pal2rgb
  * CVE-2017-17095[bsc#1071031]
    + tiff-CVE-2017-17095.patch
- security update: Fix OOB in _TIFFmemcpy
  * CVE-2022-22844[bsc#1194539]
    + tiff-CVE-2022-22844.patch
- security update: Fix memory allocation failure in tif_read.c
  * CVE-2020-35521[bsc#1182808] CVE-2020-35522[bsc#1182809]
    + tiff-CVE-2020-35521,CVE-2020-35522.patch
- security update: Fix DOS via invertImage()
  * CVE-2020-19131[bsc#1190312]
    + tiff-CVE-2020-19131.patch
- security update: Fix heap-based buffer overflow in TIFF2PDF tool
  * CVE-2020-35524[bsc#1182812]
    + tiff-CVE-2020-35524.patch
- security update: Fix integer overflow in tif_getimage
  * CVE-2020-35523 [bsc#1182811]
    + tiff-CVE-2020-35523.patch</changelog>
</package>
<package pkgid="04763024c339cbe3919bede5df2f5dbacda38aa114ebd73c660631c440b676cd" name="tomcat" arch="noarch">
  <version epoch="0" ver="9.0.36" rel="16.1"/>
  <changelog author="malbu@suse.com" date="1577448000">- Update to Tomcat 9.0.30. See changelog at
  http://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.30_(markt)
- Fixed CVEs:
  - CVE-2019-0221 (bsc#1136085)
  - CVE-2019-10072 (bsc#1139924)
  - CVE-2019-12418 (bsc#1159723)
  - CVE-2019-17563 (bsc#1159729)
- Removed patch:
  * tomcat-9.0-JDTCompiler-java.patch
    + It was not applied</changelog>
  <changelog author="malbu@suse.com" date="1579262400">- Change build to always use Java 1.8 (bsc#1161025).</changelog>
  <changelog author="fstrba@suse.com" date="1579521600">- Change back the build to build with any Java &gt;= 1.8
- Added patch:
  * tomcat-9.0.30-java8compat.patch
    + Cast java.nio.ByteBuffer and java.nio.CharBuffer to
    java.nio.Buffer in order to avoid calling Java 9+ APIs
    (functions with co-variant return types)
- Renamed patch:
  * tomcat-9.0-disable-osgi-build.patch
  - &gt; tomcat-9.0-osgi-build.patch
    + Do not disable, but fix OSGi build since we have now
    aqute-bnd</changelog>
  <changelog author="malbu@suse.com" date="1580299200">- Modified patch:
  * tomcat-9.0.30-java8compat.patch
    + add missing casts (bsc#1162081)</changelog>
  <changelog author="fstrba@suse.com" date="1582632000">- Update to Tomcat 9.0.31. See changelog at
  http://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.30_(markt)
- Fixed CVEs:
  * CVE-2019-17569 (bsc#1164825)
  * CVE-2020-1935 (bsc#1164860)
  * CVE-2020-1938 (bsc#1164692)
- Modified patch
  * tomcat-9.0.30-java8compat.patch
  - &gt; tomcat-9.0.31-java8compat.patch
    + Adapt to changed context</changelog>
  <changelog author="malbu@suse.com" date="1582891200">- Change default value of AJP connector secretRequired to false
- Added patch:
  * tomcat-9.0.31-secretRequired-default.patch</changelog>
  <changelog author="malbu@suse.com" date="1585569600">- Update to Tomcat 9.0.33. See changelog at
  http://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.33_(markt)
- Notable fix: corrected a regression in the improvements to HTTP
  header parsing (bsc#1167438)
- Rebased patches:
  * tomcat-9.0-javadoc.patch
  * tomcat-9.0-osgi-build.patch
  * tomcat-9.0.31-java8compat.patch</changelog>
  <changelog author="javier@opensuse.org" date="1586520000">- Update to Tomcat 9.0.34. See changelog at
  https://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.34_(markt)
- Notable changes:
  * Add support for default values when using ${...} property
    replacement in configuration files. Based on a pull request
    provided by Bernd Bohmann.
  * When configuring an HTTP Connector, warn if the encoding
    specified for URIEncoding is not a superset of US-ASCII as
    required by RFC 7230.
  * Replace the system property
    org.apache.tomcat.util.buf.UDecoder.ALLOW_ENCODED_SLASH with
    the Connector attribute encodedSolidusHandling that adds an
    additional option to pass the %2f sequence through to the
    application without decoding it in addition to rejecting such
    sequences and decoding such sequences.</changelog>
  <changelog author="malbu@suse.com" date="1590494400">- Update to Tomcat 9.0.35. See changelog at
  https://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.35_(markt)
- Fixed CVEs:
  - CVE-2020-9484 (bsc#1171928)
- Rebased patches:
  * tomcat-9.0-javadoc.patch
  * tomcat-9.0-osgi-build.patch
  * tomcat-9.0.31-java8compat.patch</changelog>
  <changelog author="fstrba@suse.com" date="1593172800">- Update to Tomcat 9.0.36. See changelog at
  https://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.36_(markt)
- Fixed CVEs:
  CVE-2020-11996 (bsc#1173389)</changelog>
  <changelog author="malbu@suse.com" date="1594987200">- Fixed CVEs:
  * CVE-2020-13934 (bsc#1174121)
  * CVE-2020-13935 (bsc#1174117)
- Added patches:
  * tomcat-9.0-CVE-2020-13934.patch
  * tomcat-9.0-CVE-2020-13935.patch
- Rebased patches:
  * tomcat-9.0.31-java8compat.patch</changelog>
  <changelog author="malbu@suse.com" date="1595505600">- Fix tomcat-servlet-4_0-api package alternatives to use
  /usr/share/java/servlet.jar instead of /usr/share/java/tomcat-servlet.jar.
  Keep /usr/share/java/tomcat-servlet.jar symlink for compatibility.
  (bsc#1092163)
- Don't give write permissions for the tomcat group on files and
  directories where it's not needed (bsc#1172562)
- Change tomcat.pid location from /var/run to /run (bsc#1173103)
- Use %tmpfiles_create macro in %post instead of calling
  systemd-tmpfiles directly</changelog>
  <changelog author="malbu@suse.com" date="1602590400">- Fix CVE-2020-13943 (bsc#1177582)
- Added patch:
  * tomcat-9.0-CVE-2020-13943.patch</changelog>
  <changelog author="malbu@suse.com" date="1604491200">- Fix typo in tomcat-webapps %postun that caused /examples
  context to remain in server.xml when package was removed
- Remove tomcat-9.0.init and /usr/lib/tmpfiles.d/tomcat.conf from
  package. They're not used anymore becuse of systemd (bsc#1178396)</changelog>
  <changelog author="amehmood@suse.com" date="1608033600">- Fix HTTP/2 request header mix-up: CVE-2020-17527 (bsc#1179602)
- Added patch:
  * tomcat-9.0-CVE-2020-17527.patch</changelog>
  <changelog author="amehmood@suse.com" date="1612872000">- Log if file access is blocked due to symlinks: CVE-2021-24122 (bsc#1180947)
- Added patch:
  * tomcat-9.0-CVE-2021-24122.patch</changelog>
  <changelog author="amehmood@suse.com" date="1615982400">- Fixed CVEs:
  * CVE-2021-25122: Apache Tomcat h2c request mix-up (bsc#1182912)
  * CVE-2021-25329: Complete fix for CVE-2020-9484 (bsc#1182909)
- Added patches:
  * tomcat-9.0-CVE-2021-25122.patch
  * tomcat-9.0-CVE-2021-25329.patch</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1635336000">- Fixed CVEs:
  * CVE-2021-41079: Validate incoming TLS packet (bsc#1190558)
- Added patches:
  * tomcat-9.0-CVE-2021-41079.patch</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1635508800">- Fixed CVEs:
  * CVE-2021-30640: Escape parameters in JNDI Realm queries (bsc#1188279)
  * CVE-2021-33037: Process T-E header from both HTTP 1.0 and HTTP 1.1. clients (bsc#1188278)
- Added patches:
  * tomcat-9.0-CVE-2021-30640.patch
  * tomcat-9.0-CVE-2021-33037.patch</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1639137600">- Fix NPE in JNDIRealm, when userRoleAttribute is not set (bsc#1193569)
- Added patch:
  * tomcat-9.0-NPE-JNDIRealm.patch</changelog>
</package>
<package pkgid="a3eba249f2e7642d10b1441e87e8fd2dd36c1e7f2d7566216630d7b80c59a3a8" name="tomcat" arch="src">
  <version epoch="0" ver="9.0.36" rel="16.1"/>
  <changelog author="malbu@suse.com" date="1577448000">- Update to Tomcat 9.0.30. See changelog at
  http://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.30_(markt)
- Fixed CVEs:
  - CVE-2019-0221 (bsc#1136085)
  - CVE-2019-10072 (bsc#1139924)
  - CVE-2019-12418 (bsc#1159723)
  - CVE-2019-17563 (bsc#1159729)
- Removed patch:
  * tomcat-9.0-JDTCompiler-java.patch
    + It was not applied</changelog>
  <changelog author="malbu@suse.com" date="1579262400">- Change build to always use Java 1.8 (bsc#1161025).</changelog>
  <changelog author="fstrba@suse.com" date="1579521600">- Change back the build to build with any Java &gt;= 1.8
- Added patch:
  * tomcat-9.0.30-java8compat.patch
    + Cast java.nio.ByteBuffer and java.nio.CharBuffer to
    java.nio.Buffer in order to avoid calling Java 9+ APIs
    (functions with co-variant return types)
- Renamed patch:
  * tomcat-9.0-disable-osgi-build.patch
  - &gt; tomcat-9.0-osgi-build.patch
    + Do not disable, but fix OSGi build since we have now
    aqute-bnd</changelog>
  <changelog author="malbu@suse.com" date="1580299200">- Modified patch:
  * tomcat-9.0.30-java8compat.patch
    + add missing casts (bsc#1162081)</changelog>
  <changelog author="fstrba@suse.com" date="1582632000">- Update to Tomcat 9.0.31. See changelog at
  http://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.30_(markt)
- Fixed CVEs:
  * CVE-2019-17569 (bsc#1164825)
  * CVE-2020-1935 (bsc#1164860)
  * CVE-2020-1938 (bsc#1164692)
- Modified patch
  * tomcat-9.0.30-java8compat.patch
  - &gt; tomcat-9.0.31-java8compat.patch
    + Adapt to changed context</changelog>
  <changelog author="malbu@suse.com" date="1582891200">- Change default value of AJP connector secretRequired to false
- Added patch:
  * tomcat-9.0.31-secretRequired-default.patch</changelog>
  <changelog author="malbu@suse.com" date="1585569600">- Update to Tomcat 9.0.33. See changelog at
  http://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.33_(markt)
- Notable fix: corrected a regression in the improvements to HTTP
  header parsing (bsc#1167438)
- Rebased patches:
  * tomcat-9.0-javadoc.patch
  * tomcat-9.0-osgi-build.patch
  * tomcat-9.0.31-java8compat.patch</changelog>
  <changelog author="javier@opensuse.org" date="1586520000">- Update to Tomcat 9.0.34. See changelog at
  https://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.34_(markt)
- Notable changes:
  * Add support for default values when using ${...} property
    replacement in configuration files. Based on a pull request
    provided by Bernd Bohmann.
  * When configuring an HTTP Connector, warn if the encoding
    specified for URIEncoding is not a superset of US-ASCII as
    required by RFC 7230.
  * Replace the system property
    org.apache.tomcat.util.buf.UDecoder.ALLOW_ENCODED_SLASH with
    the Connector attribute encodedSolidusHandling that adds an
    additional option to pass the %2f sequence through to the
    application without decoding it in addition to rejecting such
    sequences and decoding such sequences.</changelog>
  <changelog author="malbu@suse.com" date="1590494400">- Update to Tomcat 9.0.35. See changelog at
  https://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.35_(markt)
- Fixed CVEs:
  - CVE-2020-9484 (bsc#1171928)
- Rebased patches:
  * tomcat-9.0-javadoc.patch
  * tomcat-9.0-osgi-build.patch
  * tomcat-9.0.31-java8compat.patch</changelog>
  <changelog author="fstrba@suse.com" date="1593172800">- Update to Tomcat 9.0.36. See changelog at
  https://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.36_(markt)
- Fixed CVEs:
  CVE-2020-11996 (bsc#1173389)</changelog>
  <changelog author="malbu@suse.com" date="1594987200">- Fixed CVEs:
  * CVE-2020-13934 (bsc#1174121)
  * CVE-2020-13935 (bsc#1174117)
- Added patches:
  * tomcat-9.0-CVE-2020-13934.patch
  * tomcat-9.0-CVE-2020-13935.patch
- Rebased patches:
  * tomcat-9.0.31-java8compat.patch</changelog>
  <changelog author="malbu@suse.com" date="1595505600">- Fix tomcat-servlet-4_0-api package alternatives to use
  /usr/share/java/servlet.jar instead of /usr/share/java/tomcat-servlet.jar.
  Keep /usr/share/java/tomcat-servlet.jar symlink for compatibility.
  (bsc#1092163)
- Don't give write permissions for the tomcat group on files and
  directories where it's not needed (bsc#1172562)
- Change tomcat.pid location from /var/run to /run (bsc#1173103)
- Use %tmpfiles_create macro in %post instead of calling
  systemd-tmpfiles directly</changelog>
  <changelog author="malbu@suse.com" date="1602590400">- Fix CVE-2020-13943 (bsc#1177582)
- Added patch:
  * tomcat-9.0-CVE-2020-13943.patch</changelog>
  <changelog author="malbu@suse.com" date="1604491200">- Fix typo in tomcat-webapps %postun that caused /examples
  context to remain in server.xml when package was removed
- Remove tomcat-9.0.init and /usr/lib/tmpfiles.d/tomcat.conf from
  package. They're not used anymore becuse of systemd (bsc#1178396)</changelog>
  <changelog author="amehmood@suse.com" date="1608033600">- Fix HTTP/2 request header mix-up: CVE-2020-17527 (bsc#1179602)
- Added patch:
  * tomcat-9.0-CVE-2020-17527.patch</changelog>
  <changelog author="amehmood@suse.com" date="1612872000">- Log if file access is blocked due to symlinks: CVE-2021-24122 (bsc#1180947)
- Added patch:
  * tomcat-9.0-CVE-2021-24122.patch</changelog>
  <changelog author="amehmood@suse.com" date="1615982400">- Fixed CVEs:
  * CVE-2021-25122: Apache Tomcat h2c request mix-up (bsc#1182912)
  * CVE-2021-25329: Complete fix for CVE-2020-9484 (bsc#1182909)
- Added patches:
  * tomcat-9.0-CVE-2021-25122.patch
  * tomcat-9.0-CVE-2021-25329.patch</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1635336000">- Fixed CVEs:
  * CVE-2021-41079: Validate incoming TLS packet (bsc#1190558)
- Added patches:
  * tomcat-9.0-CVE-2021-41079.patch</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1635508800">- Fixed CVEs:
  * CVE-2021-30640: Escape parameters in JNDI Realm queries (bsc#1188279)
  * CVE-2021-33037: Process T-E header from both HTTP 1.0 and HTTP 1.1. clients (bsc#1188278)
- Added patches:
  * tomcat-9.0-CVE-2021-30640.patch
  * tomcat-9.0-CVE-2021-33037.patch</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1639137600">- Fix NPE in JNDIRealm, when userRoleAttribute is not set (bsc#1193569)
- Added patch:
  * tomcat-9.0-NPE-JNDIRealm.patch</changelog>
</package>
<package pkgid="9809ef7e7b867c28f7cc9391b639c817e39903d080ae3335763c92885bfbb515" name="tomcat-admin-webapps" arch="noarch">
  <version epoch="0" ver="9.0.36" rel="16.1"/>
  <changelog author="malbu@suse.com" date="1577448000">- Update to Tomcat 9.0.30. See changelog at
  http://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.30_(markt)
- Fixed CVEs:
  - CVE-2019-0221 (bsc#1136085)
  - CVE-2019-10072 (bsc#1139924)
  - CVE-2019-12418 (bsc#1159723)
  - CVE-2019-17563 (bsc#1159729)
- Removed patch:
  * tomcat-9.0-JDTCompiler-java.patch
    + It was not applied</changelog>
  <changelog author="malbu@suse.com" date="1579262400">- Change build to always use Java 1.8 (bsc#1161025).</changelog>
  <changelog author="fstrba@suse.com" date="1579521600">- Change back the build to build with any Java &gt;= 1.8
- Added patch:
  * tomcat-9.0.30-java8compat.patch
    + Cast java.nio.ByteBuffer and java.nio.CharBuffer to
    java.nio.Buffer in order to avoid calling Java 9+ APIs
    (functions with co-variant return types)
- Renamed patch:
  * tomcat-9.0-disable-osgi-build.patch
  - &gt; tomcat-9.0-osgi-build.patch
    + Do not disable, but fix OSGi build since we have now
    aqute-bnd</changelog>
  <changelog author="malbu@suse.com" date="1580299200">- Modified patch:
  * tomcat-9.0.30-java8compat.patch
    + add missing casts (bsc#1162081)</changelog>
  <changelog author="fstrba@suse.com" date="1582632000">- Update to Tomcat 9.0.31. See changelog at
  http://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.30_(markt)
- Fixed CVEs:
  * CVE-2019-17569 (bsc#1164825)
  * CVE-2020-1935 (bsc#1164860)
  * CVE-2020-1938 (bsc#1164692)
- Modified patch
  * tomcat-9.0.30-java8compat.patch
  - &gt; tomcat-9.0.31-java8compat.patch
    + Adapt to changed context</changelog>
  <changelog author="malbu@suse.com" date="1582891200">- Change default value of AJP connector secretRequired to false
- Added patch:
  * tomcat-9.0.31-secretRequired-default.patch</changelog>
  <changelog author="malbu@suse.com" date="1585569600">- Update to Tomcat 9.0.33. See changelog at
  http://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.33_(markt)
- Notable fix: corrected a regression in the improvements to HTTP
  header parsing (bsc#1167438)
- Rebased patches:
  * tomcat-9.0-javadoc.patch
  * tomcat-9.0-osgi-build.patch
  * tomcat-9.0.31-java8compat.patch</changelog>
  <changelog author="javier@opensuse.org" date="1586520000">- Update to Tomcat 9.0.34. See changelog at
  https://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.34_(markt)
- Notable changes:
  * Add support for default values when using ${...} property
    replacement in configuration files. Based on a pull request
    provided by Bernd Bohmann.
  * When configuring an HTTP Connector, warn if the encoding
    specified for URIEncoding is not a superset of US-ASCII as
    required by RFC 7230.
  * Replace the system property
    org.apache.tomcat.util.buf.UDecoder.ALLOW_ENCODED_SLASH with
    the Connector attribute encodedSolidusHandling that adds an
    additional option to pass the %2f sequence through to the
    application without decoding it in addition to rejecting such
    sequences and decoding such sequences.</changelog>
  <changelog author="malbu@suse.com" date="1590494400">- Update to Tomcat 9.0.35. See changelog at
  https://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.35_(markt)
- Fixed CVEs:
  - CVE-2020-9484 (bsc#1171928)
- Rebased patches:
  * tomcat-9.0-javadoc.patch
  * tomcat-9.0-osgi-build.patch
  * tomcat-9.0.31-java8compat.patch</changelog>
  <changelog author="fstrba@suse.com" date="1593172800">- Update to Tomcat 9.0.36. See changelog at
  https://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.36_(markt)
- Fixed CVEs:
  CVE-2020-11996 (bsc#1173389)</changelog>
  <changelog author="malbu@suse.com" date="1594987200">- Fixed CVEs:
  * CVE-2020-13934 (bsc#1174121)
  * CVE-2020-13935 (bsc#1174117)
- Added patches:
  * tomcat-9.0-CVE-2020-13934.patch
  * tomcat-9.0-CVE-2020-13935.patch
- Rebased patches:
  * tomcat-9.0.31-java8compat.patch</changelog>
  <changelog author="malbu@suse.com" date="1595505600">- Fix tomcat-servlet-4_0-api package alternatives to use
  /usr/share/java/servlet.jar instead of /usr/share/java/tomcat-servlet.jar.
  Keep /usr/share/java/tomcat-servlet.jar symlink for compatibility.
  (bsc#1092163)
- Don't give write permissions for the tomcat group on files and
  directories where it's not needed (bsc#1172562)
- Change tomcat.pid location from /var/run to /run (bsc#1173103)
- Use %tmpfiles_create macro in %post instead of calling
  systemd-tmpfiles directly</changelog>
  <changelog author="malbu@suse.com" date="1602590400">- Fix CVE-2020-13943 (bsc#1177582)
- Added patch:
  * tomcat-9.0-CVE-2020-13943.patch</changelog>
  <changelog author="malbu@suse.com" date="1604491200">- Fix typo in tomcat-webapps %postun that caused /examples
  context to remain in server.xml when package was removed
- Remove tomcat-9.0.init and /usr/lib/tmpfiles.d/tomcat.conf from
  package. They're not used anymore becuse of systemd (bsc#1178396)</changelog>
  <changelog author="amehmood@suse.com" date="1608033600">- Fix HTTP/2 request header mix-up: CVE-2020-17527 (bsc#1179602)
- Added patch:
  * tomcat-9.0-CVE-2020-17527.patch</changelog>
  <changelog author="amehmood@suse.com" date="1612872000">- Log if file access is blocked due to symlinks: CVE-2021-24122 (bsc#1180947)
- Added patch:
  * tomcat-9.0-CVE-2021-24122.patch</changelog>
  <changelog author="amehmood@suse.com" date="1615982400">- Fixed CVEs:
  * CVE-2021-25122: Apache Tomcat h2c request mix-up (bsc#1182912)
  * CVE-2021-25329: Complete fix for CVE-2020-9484 (bsc#1182909)
- Added patches:
  * tomcat-9.0-CVE-2021-25122.patch
  * tomcat-9.0-CVE-2021-25329.patch</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1635336000">- Fixed CVEs:
  * CVE-2021-41079: Validate incoming TLS packet (bsc#1190558)
- Added patches:
  * tomcat-9.0-CVE-2021-41079.patch</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1635508800">- Fixed CVEs:
  * CVE-2021-30640: Escape parameters in JNDI Realm queries (bsc#1188279)
  * CVE-2021-33037: Process T-E header from both HTTP 1.0 and HTTP 1.1. clients (bsc#1188278)
- Added patches:
  * tomcat-9.0-CVE-2021-30640.patch
  * tomcat-9.0-CVE-2021-33037.patch</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1639137600">- Fix NPE in JNDIRealm, when userRoleAttribute is not set (bsc#1193569)
- Added patch:
  * tomcat-9.0-NPE-JNDIRealm.patch</changelog>
</package>
<package pkgid="eb75f40d3a2c18693f24daa56ff589036ed02bd151aa5cd6777ef7feb7836ca8" name="tomcat-docs-webapp" arch="noarch">
  <version epoch="0" ver="9.0.36" rel="16.1"/>
  <changelog author="malbu@suse.com" date="1577448000">- Update to Tomcat 9.0.30. See changelog at
  http://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.30_(markt)
- Fixed CVEs:
  - CVE-2019-0221 (bsc#1136085)
  - CVE-2019-10072 (bsc#1139924)
  - CVE-2019-12418 (bsc#1159723)
  - CVE-2019-17563 (bsc#1159729)
- Removed patch:
  * tomcat-9.0-JDTCompiler-java.patch
    + It was not applied</changelog>
  <changelog author="malbu@suse.com" date="1579262400">- Change build to always use Java 1.8 (bsc#1161025).</changelog>
  <changelog author="fstrba@suse.com" date="1579521600">- Change back the build to build with any Java &gt;= 1.8
- Added patch:
  * tomcat-9.0.30-java8compat.patch
    + Cast java.nio.ByteBuffer and java.nio.CharBuffer to
    java.nio.Buffer in order to avoid calling Java 9+ APIs
    (functions with co-variant return types)
- Renamed patch:
  * tomcat-9.0-disable-osgi-build.patch
  - &gt; tomcat-9.0-osgi-build.patch
    + Do not disable, but fix OSGi build since we have now
    aqute-bnd</changelog>
  <changelog author="malbu@suse.com" date="1580299200">- Modified patch:
  * tomcat-9.0.30-java8compat.patch
    + add missing casts (bsc#1162081)</changelog>
  <changelog author="fstrba@suse.com" date="1582632000">- Update to Tomcat 9.0.31. See changelog at
  http://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.30_(markt)
- Fixed CVEs:
  * CVE-2019-17569 (bsc#1164825)
  * CVE-2020-1935 (bsc#1164860)
  * CVE-2020-1938 (bsc#1164692)
- Modified patch
  * tomcat-9.0.30-java8compat.patch
  - &gt; tomcat-9.0.31-java8compat.patch
    + Adapt to changed context</changelog>
  <changelog author="malbu@suse.com" date="1582891200">- Change default value of AJP connector secretRequired to false
- Added patch:
  * tomcat-9.0.31-secretRequired-default.patch</changelog>
  <changelog author="malbu@suse.com" date="1585569600">- Update to Tomcat 9.0.33. See changelog at
  http://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.33_(markt)
- Notable fix: corrected a regression in the improvements to HTTP
  header parsing (bsc#1167438)
- Rebased patches:
  * tomcat-9.0-javadoc.patch
  * tomcat-9.0-osgi-build.patch
  * tomcat-9.0.31-java8compat.patch</changelog>
  <changelog author="javier@opensuse.org" date="1586520000">- Update to Tomcat 9.0.34. See changelog at
  https://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.34_(markt)
- Notable changes:
  * Add support for default values when using ${...} property
    replacement in configuration files. Based on a pull request
    provided by Bernd Bohmann.
  * When configuring an HTTP Connector, warn if the encoding
    specified for URIEncoding is not a superset of US-ASCII as
    required by RFC 7230.
  * Replace the system property
    org.apache.tomcat.util.buf.UDecoder.ALLOW_ENCODED_SLASH with
    the Connector attribute encodedSolidusHandling that adds an
    additional option to pass the %2f sequence through to the
    application without decoding it in addition to rejecting such
    sequences and decoding such sequences.</changelog>
  <changelog author="malbu@suse.com" date="1590494400">- Update to Tomcat 9.0.35. See changelog at
  https://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.35_(markt)
- Fixed CVEs:
  - CVE-2020-9484 (bsc#1171928)
- Rebased patches:
  * tomcat-9.0-javadoc.patch
  * tomcat-9.0-osgi-build.patch
  * tomcat-9.0.31-java8compat.patch</changelog>
  <changelog author="fstrba@suse.com" date="1593172800">- Update to Tomcat 9.0.36. See changelog at
  https://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.36_(markt)
- Fixed CVEs:
  CVE-2020-11996 (bsc#1173389)</changelog>
  <changelog author="malbu@suse.com" date="1594987200">- Fixed CVEs:
  * CVE-2020-13934 (bsc#1174121)
  * CVE-2020-13935 (bsc#1174117)
- Added patches:
  * tomcat-9.0-CVE-2020-13934.patch
  * tomcat-9.0-CVE-2020-13935.patch
- Rebased patches:
  * tomcat-9.0.31-java8compat.patch</changelog>
  <changelog author="malbu@suse.com" date="1595505600">- Fix tomcat-servlet-4_0-api package alternatives to use
  /usr/share/java/servlet.jar instead of /usr/share/java/tomcat-servlet.jar.
  Keep /usr/share/java/tomcat-servlet.jar symlink for compatibility.
  (bsc#1092163)
- Don't give write permissions for the tomcat group on files and
  directories where it's not needed (bsc#1172562)
- Change tomcat.pid location from /var/run to /run (bsc#1173103)
- Use %tmpfiles_create macro in %post instead of calling
  systemd-tmpfiles directly</changelog>
  <changelog author="malbu@suse.com" date="1602590400">- Fix CVE-2020-13943 (bsc#1177582)
- Added patch:
  * tomcat-9.0-CVE-2020-13943.patch</changelog>
  <changelog author="malbu@suse.com" date="1604491200">- Fix typo in tomcat-webapps %postun that caused /examples
  context to remain in server.xml when package was removed
- Remove tomcat-9.0.init and /usr/lib/tmpfiles.d/tomcat.conf from
  package. They're not used anymore becuse of systemd (bsc#1178396)</changelog>
  <changelog author="amehmood@suse.com" date="1608033600">- Fix HTTP/2 request header mix-up: CVE-2020-17527 (bsc#1179602)
- Added patch:
  * tomcat-9.0-CVE-2020-17527.patch</changelog>
  <changelog author="amehmood@suse.com" date="1612872000">- Log if file access is blocked due to symlinks: CVE-2021-24122 (bsc#1180947)
- Added patch:
  * tomcat-9.0-CVE-2021-24122.patch</changelog>
  <changelog author="amehmood@suse.com" date="1615982400">- Fixed CVEs:
  * CVE-2021-25122: Apache Tomcat h2c request mix-up (bsc#1182912)
  * CVE-2021-25329: Complete fix for CVE-2020-9484 (bsc#1182909)
- Added patches:
  * tomcat-9.0-CVE-2021-25122.patch
  * tomcat-9.0-CVE-2021-25329.patch</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1635336000">- Fixed CVEs:
  * CVE-2021-41079: Validate incoming TLS packet (bsc#1190558)
- Added patches:
  * tomcat-9.0-CVE-2021-41079.patch</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1635508800">- Fixed CVEs:
  * CVE-2021-30640: Escape parameters in JNDI Realm queries (bsc#1188279)
  * CVE-2021-33037: Process T-E header from both HTTP 1.0 and HTTP 1.1. clients (bsc#1188278)
- Added patches:
  * tomcat-9.0-CVE-2021-30640.patch
  * tomcat-9.0-CVE-2021-33037.patch</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1639137600">- Fix NPE in JNDIRealm, when userRoleAttribute is not set (bsc#1193569)
- Added patch:
  * tomcat-9.0-NPE-JNDIRealm.patch</changelog>
</package>
<package pkgid="57b8cde42d435222943894ca6214c9cfc3fb66281b32aeff763f2ea600853e3e" name="tomcat-el-3_0-api" arch="noarch">
  <version epoch="0" ver="9.0.36" rel="16.1"/>
  <changelog author="malbu@suse.com" date="1577448000">- Update to Tomcat 9.0.30. See changelog at
  http://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.30_(markt)
- Fixed CVEs:
  - CVE-2019-0221 (bsc#1136085)
  - CVE-2019-10072 (bsc#1139924)
  - CVE-2019-12418 (bsc#1159723)
  - CVE-2019-17563 (bsc#1159729)
- Removed patch:
  * tomcat-9.0-JDTCompiler-java.patch
    + It was not applied</changelog>
  <changelog author="malbu@suse.com" date="1579262400">- Change build to always use Java 1.8 (bsc#1161025).</changelog>
  <changelog author="fstrba@suse.com" date="1579521600">- Change back the build to build with any Java &gt;= 1.8
- Added patch:
  * tomcat-9.0.30-java8compat.patch
    + Cast java.nio.ByteBuffer and java.nio.CharBuffer to
    java.nio.Buffer in order to avoid calling Java 9+ APIs
    (functions with co-variant return types)
- Renamed patch:
  * tomcat-9.0-disable-osgi-build.patch
  - &gt; tomcat-9.0-osgi-build.patch
    + Do not disable, but fix OSGi build since we have now
    aqute-bnd</changelog>
  <changelog author="malbu@suse.com" date="1580299200">- Modified patch:
  * tomcat-9.0.30-java8compat.patch
    + add missing casts (bsc#1162081)</changelog>
  <changelog author="fstrba@suse.com" date="1582632000">- Update to Tomcat 9.0.31. See changelog at
  http://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.30_(markt)
- Fixed CVEs:
  * CVE-2019-17569 (bsc#1164825)
  * CVE-2020-1935 (bsc#1164860)
  * CVE-2020-1938 (bsc#1164692)
- Modified patch
  * tomcat-9.0.30-java8compat.patch
  - &gt; tomcat-9.0.31-java8compat.patch
    + Adapt to changed context</changelog>
  <changelog author="malbu@suse.com" date="1582891200">- Change default value of AJP connector secretRequired to false
- Added patch:
  * tomcat-9.0.31-secretRequired-default.patch</changelog>
  <changelog author="malbu@suse.com" date="1585569600">- Update to Tomcat 9.0.33. See changelog at
  http://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.33_(markt)
- Notable fix: corrected a regression in the improvements to HTTP
  header parsing (bsc#1167438)
- Rebased patches:
  * tomcat-9.0-javadoc.patch
  * tomcat-9.0-osgi-build.patch
  * tomcat-9.0.31-java8compat.patch</changelog>
  <changelog author="javier@opensuse.org" date="1586520000">- Update to Tomcat 9.0.34. See changelog at
  https://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.34_(markt)
- Notable changes:
  * Add support for default values when using ${...} property
    replacement in configuration files. Based on a pull request
    provided by Bernd Bohmann.
  * When configuring an HTTP Connector, warn if the encoding
    specified for URIEncoding is not a superset of US-ASCII as
    required by RFC 7230.
  * Replace the system property
    org.apache.tomcat.util.buf.UDecoder.ALLOW_ENCODED_SLASH with
    the Connector attribute encodedSolidusHandling that adds an
    additional option to pass the %2f sequence through to the
    application without decoding it in addition to rejecting such
    sequences and decoding such sequences.</changelog>
  <changelog author="malbu@suse.com" date="1590494400">- Update to Tomcat 9.0.35. See changelog at
  https://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.35_(markt)
- Fixed CVEs:
  - CVE-2020-9484 (bsc#1171928)
- Rebased patches:
  * tomcat-9.0-javadoc.patch
  * tomcat-9.0-osgi-build.patch
  * tomcat-9.0.31-java8compat.patch</changelog>
  <changelog author="fstrba@suse.com" date="1593172800">- Update to Tomcat 9.0.36. See changelog at
  https://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.36_(markt)
- Fixed CVEs:
  CVE-2020-11996 (bsc#1173389)</changelog>
  <changelog author="malbu@suse.com" date="1594987200">- Fixed CVEs:
  * CVE-2020-13934 (bsc#1174121)
  * CVE-2020-13935 (bsc#1174117)
- Added patches:
  * tomcat-9.0-CVE-2020-13934.patch
  * tomcat-9.0-CVE-2020-13935.patch
- Rebased patches:
  * tomcat-9.0.31-java8compat.patch</changelog>
  <changelog author="malbu@suse.com" date="1595505600">- Fix tomcat-servlet-4_0-api package alternatives to use
  /usr/share/java/servlet.jar instead of /usr/share/java/tomcat-servlet.jar.
  Keep /usr/share/java/tomcat-servlet.jar symlink for compatibility.
  (bsc#1092163)
- Don't give write permissions for the tomcat group on files and
  directories where it's not needed (bsc#1172562)
- Change tomcat.pid location from /var/run to /run (bsc#1173103)
- Use %tmpfiles_create macro in %post instead of calling
  systemd-tmpfiles directly</changelog>
  <changelog author="malbu@suse.com" date="1602590400">- Fix CVE-2020-13943 (bsc#1177582)
- Added patch:
  * tomcat-9.0-CVE-2020-13943.patch</changelog>
  <changelog author="malbu@suse.com" date="1604491200">- Fix typo in tomcat-webapps %postun that caused /examples
  context to remain in server.xml when package was removed
- Remove tomcat-9.0.init and /usr/lib/tmpfiles.d/tomcat.conf from
  package. They're not used anymore becuse of systemd (bsc#1178396)</changelog>
  <changelog author="amehmood@suse.com" date="1608033600">- Fix HTTP/2 request header mix-up: CVE-2020-17527 (bsc#1179602)
- Added patch:
  * tomcat-9.0-CVE-2020-17527.patch</changelog>
  <changelog author="amehmood@suse.com" date="1612872000">- Log if file access is blocked due to symlinks: CVE-2021-24122 (bsc#1180947)
- Added patch:
  * tomcat-9.0-CVE-2021-24122.patch</changelog>
  <changelog author="amehmood@suse.com" date="1615982400">- Fixed CVEs:
  * CVE-2021-25122: Apache Tomcat h2c request mix-up (bsc#1182912)
  * CVE-2021-25329: Complete fix for CVE-2020-9484 (bsc#1182909)
- Added patches:
  * tomcat-9.0-CVE-2021-25122.patch
  * tomcat-9.0-CVE-2021-25329.patch</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1635336000">- Fixed CVEs:
  * CVE-2021-41079: Validate incoming TLS packet (bsc#1190558)
- Added patches:
  * tomcat-9.0-CVE-2021-41079.patch</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1635508800">- Fixed CVEs:
  * CVE-2021-30640: Escape parameters in JNDI Realm queries (bsc#1188279)
  * CVE-2021-33037: Process T-E header from both HTTP 1.0 and HTTP 1.1. clients (bsc#1188278)
- Added patches:
  * tomcat-9.0-CVE-2021-30640.patch
  * tomcat-9.0-CVE-2021-33037.patch</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1639137600">- Fix NPE in JNDIRealm, when userRoleAttribute is not set (bsc#1193569)
- Added patch:
  * tomcat-9.0-NPE-JNDIRealm.patch</changelog>
</package>
<package pkgid="ebc4e75393aa83d3b6f38f695e1f2b154f0dbde90a3505cf9c04ef0181614c4a" name="tomcat-embed" arch="noarch">
  <version epoch="0" ver="9.0.36" rel="16.1"/>
  <changelog author="malbu@suse.com" date="1577448000">- Update to Tomcat 9.0.30. See changelog at
  http://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.30_(markt)
- Fixed CVEs:
  - CVE-2019-0221 (bsc#1136085)
  - CVE-2019-10072 (bsc#1139924)
  - CVE-2019-12418 (bsc#1159723)
  - CVE-2019-17563 (bsc#1159729)
- Removed patch:
  * tomcat-9.0-JDTCompiler-java.patch
    + It was not applied</changelog>
  <changelog author="malbu@suse.com" date="1579262400">- Change build to always use Java 1.8 (bsc#1161025).</changelog>
  <changelog author="fstrba@suse.com" date="1579521600">- Change back the build to build with any Java &gt;= 1.8
- Added patch:
  * tomcat-9.0.30-java8compat.patch
    + Cast java.nio.ByteBuffer and java.nio.CharBuffer to
    java.nio.Buffer in order to avoid calling Java 9+ APIs
    (functions with co-variant return types)
- Renamed patch:
  * tomcat-9.0-disable-osgi-build.patch
  - &gt; tomcat-9.0-osgi-build.patch
    + Do not disable, but fix OSGi build since we have now
    aqute-bnd</changelog>
  <changelog author="malbu@suse.com" date="1580299200">- Modified patch:
  * tomcat-9.0.30-java8compat.patch
    + add missing casts (bsc#1162081)</changelog>
  <changelog author="fstrba@suse.com" date="1582632000">- Update to Tomcat 9.0.31. See changelog at
  http://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.30_(markt)
- Fixed CVEs:
  * CVE-2019-17569 (bsc#1164825)
  * CVE-2020-1935 (bsc#1164860)
  * CVE-2020-1938 (bsc#1164692)
- Modified patch
  * tomcat-9.0.30-java8compat.patch
  - &gt; tomcat-9.0.31-java8compat.patch
    + Adapt to changed context</changelog>
  <changelog author="malbu@suse.com" date="1582891200">- Change default value of AJP connector secretRequired to false
- Added patch:
  * tomcat-9.0.31-secretRequired-default.patch</changelog>
  <changelog author="malbu@suse.com" date="1585569600">- Update to Tomcat 9.0.33. See changelog at
  http://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.33_(markt)
- Notable fix: corrected a regression in the improvements to HTTP
  header parsing (bsc#1167438)
- Rebased patches:
  * tomcat-9.0-javadoc.patch
  * tomcat-9.0-osgi-build.patch
  * tomcat-9.0.31-java8compat.patch</changelog>
  <changelog author="javier@opensuse.org" date="1586520000">- Update to Tomcat 9.0.34. See changelog at
  https://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.34_(markt)
- Notable changes:
  * Add support for default values when using ${...} property
    replacement in configuration files. Based on a pull request
    provided by Bernd Bohmann.
  * When configuring an HTTP Connector, warn if the encoding
    specified for URIEncoding is not a superset of US-ASCII as
    required by RFC 7230.
  * Replace the system property
    org.apache.tomcat.util.buf.UDecoder.ALLOW_ENCODED_SLASH with
    the Connector attribute encodedSolidusHandling that adds an
    additional option to pass the %2f sequence through to the
    application without decoding it in addition to rejecting such
    sequences and decoding such sequences.</changelog>
  <changelog author="malbu@suse.com" date="1590494400">- Update to Tomcat 9.0.35. See changelog at
  https://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.35_(markt)
- Fixed CVEs:
  - CVE-2020-9484 (bsc#1171928)
- Rebased patches:
  * tomcat-9.0-javadoc.patch
  * tomcat-9.0-osgi-build.patch
  * tomcat-9.0.31-java8compat.patch</changelog>
  <changelog author="fstrba@suse.com" date="1593172800">- Update to Tomcat 9.0.36. See changelog at
  https://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.36_(markt)
- Fixed CVEs:
  CVE-2020-11996 (bsc#1173389)</changelog>
  <changelog author="malbu@suse.com" date="1594987200">- Fixed CVEs:
  * CVE-2020-13934 (bsc#1174121)
  * CVE-2020-13935 (bsc#1174117)
- Added patches:
  * tomcat-9.0-CVE-2020-13934.patch
  * tomcat-9.0-CVE-2020-13935.patch
- Rebased patches:
  * tomcat-9.0.31-java8compat.patch</changelog>
  <changelog author="malbu@suse.com" date="1595505600">- Fix tomcat-servlet-4_0-api package alternatives to use
  /usr/share/java/servlet.jar instead of /usr/share/java/tomcat-servlet.jar.
  Keep /usr/share/java/tomcat-servlet.jar symlink for compatibility.
  (bsc#1092163)
- Don't give write permissions for the tomcat group on files and
  directories where it's not needed (bsc#1172562)
- Change tomcat.pid location from /var/run to /run (bsc#1173103)
- Use %tmpfiles_create macro in %post instead of calling
  systemd-tmpfiles directly</changelog>
  <changelog author="malbu@suse.com" date="1602590400">- Fix CVE-2020-13943 (bsc#1177582)
- Added patch:
  * tomcat-9.0-CVE-2020-13943.patch</changelog>
  <changelog author="malbu@suse.com" date="1604491200">- Fix typo in tomcat-webapps %postun that caused /examples
  context to remain in server.xml when package was removed
- Remove tomcat-9.0.init and /usr/lib/tmpfiles.d/tomcat.conf from
  package. They're not used anymore becuse of systemd (bsc#1178396)</changelog>
  <changelog author="amehmood@suse.com" date="1608033600">- Fix HTTP/2 request header mix-up: CVE-2020-17527 (bsc#1179602)
- Added patch:
  * tomcat-9.0-CVE-2020-17527.patch</changelog>
  <changelog author="amehmood@suse.com" date="1612872000">- Log if file access is blocked due to symlinks: CVE-2021-24122 (bsc#1180947)
- Added patch:
  * tomcat-9.0-CVE-2021-24122.patch</changelog>
  <changelog author="amehmood@suse.com" date="1615982400">- Fixed CVEs:
  * CVE-2021-25122: Apache Tomcat h2c request mix-up (bsc#1182912)
  * CVE-2021-25329: Complete fix for CVE-2020-9484 (bsc#1182909)
- Added patches:
  * tomcat-9.0-CVE-2021-25122.patch
  * tomcat-9.0-CVE-2021-25329.patch</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1635336000">- Fixed CVEs:
  * CVE-2021-41079: Validate incoming TLS packet (bsc#1190558)
- Added patches:
  * tomcat-9.0-CVE-2021-41079.patch</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1635508800">- Fixed CVEs:
  * CVE-2021-30640: Escape parameters in JNDI Realm queries (bsc#1188279)
  * CVE-2021-33037: Process T-E header from both HTTP 1.0 and HTTP 1.1. clients (bsc#1188278)
- Added patches:
  * tomcat-9.0-CVE-2021-30640.patch
  * tomcat-9.0-CVE-2021-33037.patch</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1639137600">- Fix NPE in JNDIRealm, when userRoleAttribute is not set (bsc#1193569)
- Added patch:
  * tomcat-9.0-NPE-JNDIRealm.patch</changelog>
</package>
<package pkgid="5eb8d61191fcfa1b43c820de6922775d809a401c341a490406556499d0e592e7" name="tomcat-javadoc" arch="noarch">
  <version epoch="0" ver="9.0.36" rel="16.1"/>
  <changelog author="malbu@suse.com" date="1577448000">- Update to Tomcat 9.0.30. See changelog at
  http://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.30_(markt)
- Fixed CVEs:
  - CVE-2019-0221 (bsc#1136085)
  - CVE-2019-10072 (bsc#1139924)
  - CVE-2019-12418 (bsc#1159723)
  - CVE-2019-17563 (bsc#1159729)
- Removed patch:
  * tomcat-9.0-JDTCompiler-java.patch
    + It was not applied</changelog>
  <changelog author="malbu@suse.com" date="1579262400">- Change build to always use Java 1.8 (bsc#1161025).</changelog>
  <changelog author="fstrba@suse.com" date="1579521600">- Change back the build to build with any Java &gt;= 1.8
- Added patch:
  * tomcat-9.0.30-java8compat.patch
    + Cast java.nio.ByteBuffer and java.nio.CharBuffer to
    java.nio.Buffer in order to avoid calling Java 9+ APIs
    (functions with co-variant return types)
- Renamed patch:
  * tomcat-9.0-disable-osgi-build.patch
  - &gt; tomcat-9.0-osgi-build.patch
    + Do not disable, but fix OSGi build since we have now
    aqute-bnd</changelog>
  <changelog author="malbu@suse.com" date="1580299200">- Modified patch:
  * tomcat-9.0.30-java8compat.patch
    + add missing casts (bsc#1162081)</changelog>
  <changelog author="fstrba@suse.com" date="1582632000">- Update to Tomcat 9.0.31. See changelog at
  http://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.30_(markt)
- Fixed CVEs:
  * CVE-2019-17569 (bsc#1164825)
  * CVE-2020-1935 (bsc#1164860)
  * CVE-2020-1938 (bsc#1164692)
- Modified patch
  * tomcat-9.0.30-java8compat.patch
  - &gt; tomcat-9.0.31-java8compat.patch
    + Adapt to changed context</changelog>
  <changelog author="malbu@suse.com" date="1582891200">- Change default value of AJP connector secretRequired to false
- Added patch:
  * tomcat-9.0.31-secretRequired-default.patch</changelog>
  <changelog author="malbu@suse.com" date="1585569600">- Update to Tomcat 9.0.33. See changelog at
  http://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.33_(markt)
- Notable fix: corrected a regression in the improvements to HTTP
  header parsing (bsc#1167438)
- Rebased patches:
  * tomcat-9.0-javadoc.patch
  * tomcat-9.0-osgi-build.patch
  * tomcat-9.0.31-java8compat.patch</changelog>
  <changelog author="javier@opensuse.org" date="1586520000">- Update to Tomcat 9.0.34. See changelog at
  https://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.34_(markt)
- Notable changes:
  * Add support for default values when using ${...} property
    replacement in configuration files. Based on a pull request
    provided by Bernd Bohmann.
  * When configuring an HTTP Connector, warn if the encoding
    specified for URIEncoding is not a superset of US-ASCII as
    required by RFC 7230.
  * Replace the system property
    org.apache.tomcat.util.buf.UDecoder.ALLOW_ENCODED_SLASH with
    the Connector attribute encodedSolidusHandling that adds an
    additional option to pass the %2f sequence through to the
    application without decoding it in addition to rejecting such
    sequences and decoding such sequences.</changelog>
  <changelog author="malbu@suse.com" date="1590494400">- Update to Tomcat 9.0.35. See changelog at
  https://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.35_(markt)
- Fixed CVEs:
  - CVE-2020-9484 (bsc#1171928)
- Rebased patches:
  * tomcat-9.0-javadoc.patch
  * tomcat-9.0-osgi-build.patch
  * tomcat-9.0.31-java8compat.patch</changelog>
  <changelog author="fstrba@suse.com" date="1593172800">- Update to Tomcat 9.0.36. See changelog at
  https://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.36_(markt)
- Fixed CVEs:
  CVE-2020-11996 (bsc#1173389)</changelog>
  <changelog author="malbu@suse.com" date="1594987200">- Fixed CVEs:
  * CVE-2020-13934 (bsc#1174121)
  * CVE-2020-13935 (bsc#1174117)
- Added patches:
  * tomcat-9.0-CVE-2020-13934.patch
  * tomcat-9.0-CVE-2020-13935.patch
- Rebased patches:
  * tomcat-9.0.31-java8compat.patch</changelog>
  <changelog author="malbu@suse.com" date="1595505600">- Fix tomcat-servlet-4_0-api package alternatives to use
  /usr/share/java/servlet.jar instead of /usr/share/java/tomcat-servlet.jar.
  Keep /usr/share/java/tomcat-servlet.jar symlink for compatibility.
  (bsc#1092163)
- Don't give write permissions for the tomcat group on files and
  directories where it's not needed (bsc#1172562)
- Change tomcat.pid location from /var/run to /run (bsc#1173103)
- Use %tmpfiles_create macro in %post instead of calling
  systemd-tmpfiles directly</changelog>
  <changelog author="malbu@suse.com" date="1602590400">- Fix CVE-2020-13943 (bsc#1177582)
- Added patch:
  * tomcat-9.0-CVE-2020-13943.patch</changelog>
  <changelog author="malbu@suse.com" date="1604491200">- Fix typo in tomcat-webapps %postun that caused /examples
  context to remain in server.xml when package was removed
- Remove tomcat-9.0.init and /usr/lib/tmpfiles.d/tomcat.conf from
  package. They're not used anymore becuse of systemd (bsc#1178396)</changelog>
  <changelog author="amehmood@suse.com" date="1608033600">- Fix HTTP/2 request header mix-up: CVE-2020-17527 (bsc#1179602)
- Added patch:
  * tomcat-9.0-CVE-2020-17527.patch</changelog>
  <changelog author="amehmood@suse.com" date="1612872000">- Log if file access is blocked due to symlinks: CVE-2021-24122 (bsc#1180947)
- Added patch:
  * tomcat-9.0-CVE-2021-24122.patch</changelog>
  <changelog author="amehmood@suse.com" date="1615982400">- Fixed CVEs:
  * CVE-2021-25122: Apache Tomcat h2c request mix-up (bsc#1182912)
  * CVE-2021-25329: Complete fix for CVE-2020-9484 (bsc#1182909)
- Added patches:
  * tomcat-9.0-CVE-2021-25122.patch
  * tomcat-9.0-CVE-2021-25329.patch</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1635336000">- Fixed CVEs:
  * CVE-2021-41079: Validate incoming TLS packet (bsc#1190558)
- Added patches:
  * tomcat-9.0-CVE-2021-41079.patch</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1635508800">- Fixed CVEs:
  * CVE-2021-30640: Escape parameters in JNDI Realm queries (bsc#1188279)
  * CVE-2021-33037: Process T-E header from both HTTP 1.0 and HTTP 1.1. clients (bsc#1188278)
- Added patches:
  * tomcat-9.0-CVE-2021-30640.patch
  * tomcat-9.0-CVE-2021-33037.patch</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1639137600">- Fix NPE in JNDIRealm, when userRoleAttribute is not set (bsc#1193569)
- Added patch:
  * tomcat-9.0-NPE-JNDIRealm.patch</changelog>
</package>
<package pkgid="8a572a2ef4f4f27ca5358078edc6ad0c7684052c34bb66a477be17ae2da1b570" name="tomcat-jsp-2_3-api" arch="noarch">
  <version epoch="0" ver="9.0.36" rel="16.1"/>
  <changelog author="malbu@suse.com" date="1577448000">- Update to Tomcat 9.0.30. See changelog at
  http://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.30_(markt)
- Fixed CVEs:
  - CVE-2019-0221 (bsc#1136085)
  - CVE-2019-10072 (bsc#1139924)
  - CVE-2019-12418 (bsc#1159723)
  - CVE-2019-17563 (bsc#1159729)
- Removed patch:
  * tomcat-9.0-JDTCompiler-java.patch
    + It was not applied</changelog>
  <changelog author="malbu@suse.com" date="1579262400">- Change build to always use Java 1.8 (bsc#1161025).</changelog>
  <changelog author="fstrba@suse.com" date="1579521600">- Change back the build to build with any Java &gt;= 1.8
- Added patch:
  * tomcat-9.0.30-java8compat.patch
    + Cast java.nio.ByteBuffer and java.nio.CharBuffer to
    java.nio.Buffer in order to avoid calling Java 9+ APIs
    (functions with co-variant return types)
- Renamed patch:
  * tomcat-9.0-disable-osgi-build.patch
  - &gt; tomcat-9.0-osgi-build.patch
    + Do not disable, but fix OSGi build since we have now
    aqute-bnd</changelog>
  <changelog author="malbu@suse.com" date="1580299200">- Modified patch:
  * tomcat-9.0.30-java8compat.patch
    + add missing casts (bsc#1162081)</changelog>
  <changelog author="fstrba@suse.com" date="1582632000">- Update to Tomcat 9.0.31. See changelog at
  http://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.30_(markt)
- Fixed CVEs:
  * CVE-2019-17569 (bsc#1164825)
  * CVE-2020-1935 (bsc#1164860)
  * CVE-2020-1938 (bsc#1164692)
- Modified patch
  * tomcat-9.0.30-java8compat.patch
  - &gt; tomcat-9.0.31-java8compat.patch
    + Adapt to changed context</changelog>
  <changelog author="malbu@suse.com" date="1582891200">- Change default value of AJP connector secretRequired to false
- Added patch:
  * tomcat-9.0.31-secretRequired-default.patch</changelog>
  <changelog author="malbu@suse.com" date="1585569600">- Update to Tomcat 9.0.33. See changelog at
  http://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.33_(markt)
- Notable fix: corrected a regression in the improvements to HTTP
  header parsing (bsc#1167438)
- Rebased patches:
  * tomcat-9.0-javadoc.patch
  * tomcat-9.0-osgi-build.patch
  * tomcat-9.0.31-java8compat.patch</changelog>
  <changelog author="javier@opensuse.org" date="1586520000">- Update to Tomcat 9.0.34. See changelog at
  https://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.34_(markt)
- Notable changes:
  * Add support for default values when using ${...} property
    replacement in configuration files. Based on a pull request
    provided by Bernd Bohmann.
  * When configuring an HTTP Connector, warn if the encoding
    specified for URIEncoding is not a superset of US-ASCII as
    required by RFC 7230.
  * Replace the system property
    org.apache.tomcat.util.buf.UDecoder.ALLOW_ENCODED_SLASH with
    the Connector attribute encodedSolidusHandling that adds an
    additional option to pass the %2f sequence through to the
    application without decoding it in addition to rejecting such
    sequences and decoding such sequences.</changelog>
  <changelog author="malbu@suse.com" date="1590494400">- Update to Tomcat 9.0.35. See changelog at
  https://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.35_(markt)
- Fixed CVEs:
  - CVE-2020-9484 (bsc#1171928)
- Rebased patches:
  * tomcat-9.0-javadoc.patch
  * tomcat-9.0-osgi-build.patch
  * tomcat-9.0.31-java8compat.patch</changelog>
  <changelog author="fstrba@suse.com" date="1593172800">- Update to Tomcat 9.0.36. See changelog at
  https://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.36_(markt)
- Fixed CVEs:
  CVE-2020-11996 (bsc#1173389)</changelog>
  <changelog author="malbu@suse.com" date="1594987200">- Fixed CVEs:
  * CVE-2020-13934 (bsc#1174121)
  * CVE-2020-13935 (bsc#1174117)
- Added patches:
  * tomcat-9.0-CVE-2020-13934.patch
  * tomcat-9.0-CVE-2020-13935.patch
- Rebased patches:
  * tomcat-9.0.31-java8compat.patch</changelog>
  <changelog author="malbu@suse.com" date="1595505600">- Fix tomcat-servlet-4_0-api package alternatives to use
  /usr/share/java/servlet.jar instead of /usr/share/java/tomcat-servlet.jar.
  Keep /usr/share/java/tomcat-servlet.jar symlink for compatibility.
  (bsc#1092163)
- Don't give write permissions for the tomcat group on files and
  directories where it's not needed (bsc#1172562)
- Change tomcat.pid location from /var/run to /run (bsc#1173103)
- Use %tmpfiles_create macro in %post instead of calling
  systemd-tmpfiles directly</changelog>
  <changelog author="malbu@suse.com" date="1602590400">- Fix CVE-2020-13943 (bsc#1177582)
- Added patch:
  * tomcat-9.0-CVE-2020-13943.patch</changelog>
  <changelog author="malbu@suse.com" date="1604491200">- Fix typo in tomcat-webapps %postun that caused /examples
  context to remain in server.xml when package was removed
- Remove tomcat-9.0.init and /usr/lib/tmpfiles.d/tomcat.conf from
  package. They're not used anymore becuse of systemd (bsc#1178396)</changelog>
  <changelog author="amehmood@suse.com" date="1608033600">- Fix HTTP/2 request header mix-up: CVE-2020-17527 (bsc#1179602)
- Added patch:
  * tomcat-9.0-CVE-2020-17527.patch</changelog>
  <changelog author="amehmood@suse.com" date="1612872000">- Log if file access is blocked due to symlinks: CVE-2021-24122 (bsc#1180947)
- Added patch:
  * tomcat-9.0-CVE-2021-24122.patch</changelog>
  <changelog author="amehmood@suse.com" date="1615982400">- Fixed CVEs:
  * CVE-2021-25122: Apache Tomcat h2c request mix-up (bsc#1182912)
  * CVE-2021-25329: Complete fix for CVE-2020-9484 (bsc#1182909)
- Added patches:
  * tomcat-9.0-CVE-2021-25122.patch
  * tomcat-9.0-CVE-2021-25329.patch</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1635336000">- Fixed CVEs:
  * CVE-2021-41079: Validate incoming TLS packet (bsc#1190558)
- Added patches:
  * tomcat-9.0-CVE-2021-41079.patch</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1635508800">- Fixed CVEs:
  * CVE-2021-30640: Escape parameters in JNDI Realm queries (bsc#1188279)
  * CVE-2021-33037: Process T-E header from both HTTP 1.0 and HTTP 1.1. clients (bsc#1188278)
- Added patches:
  * tomcat-9.0-CVE-2021-30640.patch
  * tomcat-9.0-CVE-2021-33037.patch</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1639137600">- Fix NPE in JNDIRealm, when userRoleAttribute is not set (bsc#1193569)
- Added patch:
  * tomcat-9.0-NPE-JNDIRealm.patch</changelog>
</package>
<package pkgid="679e0de1c9f063fb5def79e784983ea4e45130368c15091accf458c6f1a11919" name="tomcat-jsvc" arch="noarch">
  <version epoch="0" ver="9.0.36" rel="16.1"/>
  <changelog author="malbu@suse.com" date="1577448000">- Update to Tomcat 9.0.30. See changelog at
  http://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.30_(markt)
- Fixed CVEs:
  - CVE-2019-0221 (bsc#1136085)
  - CVE-2019-10072 (bsc#1139924)
  - CVE-2019-12418 (bsc#1159723)
  - CVE-2019-17563 (bsc#1159729)
- Removed patch:
  * tomcat-9.0-JDTCompiler-java.patch
    + It was not applied</changelog>
  <changelog author="malbu@suse.com" date="1579262400">- Change build to always use Java 1.8 (bsc#1161025).</changelog>
  <changelog author="fstrba@suse.com" date="1579521600">- Change back the build to build with any Java &gt;= 1.8
- Added patch:
  * tomcat-9.0.30-java8compat.patch
    + Cast java.nio.ByteBuffer and java.nio.CharBuffer to
    java.nio.Buffer in order to avoid calling Java 9+ APIs
    (functions with co-variant return types)
- Renamed patch:
  * tomcat-9.0-disable-osgi-build.patch
  - &gt; tomcat-9.0-osgi-build.patch
    + Do not disable, but fix OSGi build since we have now
    aqute-bnd</changelog>
  <changelog author="malbu@suse.com" date="1580299200">- Modified patch:
  * tomcat-9.0.30-java8compat.patch
    + add missing casts (bsc#1162081)</changelog>
  <changelog author="fstrba@suse.com" date="1582632000">- Update to Tomcat 9.0.31. See changelog at
  http://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.30_(markt)
- Fixed CVEs:
  * CVE-2019-17569 (bsc#1164825)
  * CVE-2020-1935 (bsc#1164860)
  * CVE-2020-1938 (bsc#1164692)
- Modified patch
  * tomcat-9.0.30-java8compat.patch
  - &gt; tomcat-9.0.31-java8compat.patch
    + Adapt to changed context</changelog>
  <changelog author="malbu@suse.com" date="1582891200">- Change default value of AJP connector secretRequired to false
- Added patch:
  * tomcat-9.0.31-secretRequired-default.patch</changelog>
  <changelog author="malbu@suse.com" date="1585569600">- Update to Tomcat 9.0.33. See changelog at
  http://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.33_(markt)
- Notable fix: corrected a regression in the improvements to HTTP
  header parsing (bsc#1167438)
- Rebased patches:
  * tomcat-9.0-javadoc.patch
  * tomcat-9.0-osgi-build.patch
  * tomcat-9.0.31-java8compat.patch</changelog>
  <changelog author="javier@opensuse.org" date="1586520000">- Update to Tomcat 9.0.34. See changelog at
  https://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.34_(markt)
- Notable changes:
  * Add support for default values when using ${...} property
    replacement in configuration files. Based on a pull request
    provided by Bernd Bohmann.
  * When configuring an HTTP Connector, warn if the encoding
    specified for URIEncoding is not a superset of US-ASCII as
    required by RFC 7230.
  * Replace the system property
    org.apache.tomcat.util.buf.UDecoder.ALLOW_ENCODED_SLASH with
    the Connector attribute encodedSolidusHandling that adds an
    additional option to pass the %2f sequence through to the
    application without decoding it in addition to rejecting such
    sequences and decoding such sequences.</changelog>
  <changelog author="malbu@suse.com" date="1590494400">- Update to Tomcat 9.0.35. See changelog at
  https://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.35_(markt)
- Fixed CVEs:
  - CVE-2020-9484 (bsc#1171928)
- Rebased patches:
  * tomcat-9.0-javadoc.patch
  * tomcat-9.0-osgi-build.patch
  * tomcat-9.0.31-java8compat.patch</changelog>
  <changelog author="fstrba@suse.com" date="1593172800">- Update to Tomcat 9.0.36. See changelog at
  https://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.36_(markt)
- Fixed CVEs:
  CVE-2020-11996 (bsc#1173389)</changelog>
  <changelog author="malbu@suse.com" date="1594987200">- Fixed CVEs:
  * CVE-2020-13934 (bsc#1174121)
  * CVE-2020-13935 (bsc#1174117)
- Added patches:
  * tomcat-9.0-CVE-2020-13934.patch
  * tomcat-9.0-CVE-2020-13935.patch
- Rebased patches:
  * tomcat-9.0.31-java8compat.patch</changelog>
  <changelog author="malbu@suse.com" date="1595505600">- Fix tomcat-servlet-4_0-api package alternatives to use
  /usr/share/java/servlet.jar instead of /usr/share/java/tomcat-servlet.jar.
  Keep /usr/share/java/tomcat-servlet.jar symlink for compatibility.
  (bsc#1092163)
- Don't give write permissions for the tomcat group on files and
  directories where it's not needed (bsc#1172562)
- Change tomcat.pid location from /var/run to /run (bsc#1173103)
- Use %tmpfiles_create macro in %post instead of calling
  systemd-tmpfiles directly</changelog>
  <changelog author="malbu@suse.com" date="1602590400">- Fix CVE-2020-13943 (bsc#1177582)
- Added patch:
  * tomcat-9.0-CVE-2020-13943.patch</changelog>
  <changelog author="malbu@suse.com" date="1604491200">- Fix typo in tomcat-webapps %postun that caused /examples
  context to remain in server.xml when package was removed
- Remove tomcat-9.0.init and /usr/lib/tmpfiles.d/tomcat.conf from
  package. They're not used anymore becuse of systemd (bsc#1178396)</changelog>
  <changelog author="amehmood@suse.com" date="1608033600">- Fix HTTP/2 request header mix-up: CVE-2020-17527 (bsc#1179602)
- Added patch:
  * tomcat-9.0-CVE-2020-17527.patch</changelog>
  <changelog author="amehmood@suse.com" date="1612872000">- Log if file access is blocked due to symlinks: CVE-2021-24122 (bsc#1180947)
- Added patch:
  * tomcat-9.0-CVE-2021-24122.patch</changelog>
  <changelog author="amehmood@suse.com" date="1615982400">- Fixed CVEs:
  * CVE-2021-25122: Apache Tomcat h2c request mix-up (bsc#1182912)
  * CVE-2021-25329: Complete fix for CVE-2020-9484 (bsc#1182909)
- Added patches:
  * tomcat-9.0-CVE-2021-25122.patch
  * tomcat-9.0-CVE-2021-25329.patch</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1635336000">- Fixed CVEs:
  * CVE-2021-41079: Validate incoming TLS packet (bsc#1190558)
- Added patches:
  * tomcat-9.0-CVE-2021-41079.patch</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1635508800">- Fixed CVEs:
  * CVE-2021-30640: Escape parameters in JNDI Realm queries (bsc#1188279)
  * CVE-2021-33037: Process T-E header from both HTTP 1.0 and HTTP 1.1. clients (bsc#1188278)
- Added patches:
  * tomcat-9.0-CVE-2021-30640.patch
  * tomcat-9.0-CVE-2021-33037.patch</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1639137600">- Fix NPE in JNDIRealm, when userRoleAttribute is not set (bsc#1193569)
- Added patch:
  * tomcat-9.0-NPE-JNDIRealm.patch</changelog>
</package>
<package pkgid="76c7634ac100c4f6c71454818a60ef5085e4a223dbe7a903654340129ae776c7" name="tomcat-lib" arch="noarch">
  <version epoch="0" ver="9.0.36" rel="16.1"/>
  <changelog author="malbu@suse.com" date="1577448000">- Update to Tomcat 9.0.30. See changelog at
  http://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.30_(markt)
- Fixed CVEs:
  - CVE-2019-0221 (bsc#1136085)
  - CVE-2019-10072 (bsc#1139924)
  - CVE-2019-12418 (bsc#1159723)
  - CVE-2019-17563 (bsc#1159729)
- Removed patch:
  * tomcat-9.0-JDTCompiler-java.patch
    + It was not applied</changelog>
  <changelog author="malbu@suse.com" date="1579262400">- Change build to always use Java 1.8 (bsc#1161025).</changelog>
  <changelog author="fstrba@suse.com" date="1579521600">- Change back the build to build with any Java &gt;= 1.8
- Added patch:
  * tomcat-9.0.30-java8compat.patch
    + Cast java.nio.ByteBuffer and java.nio.CharBuffer to
    java.nio.Buffer in order to avoid calling Java 9+ APIs
    (functions with co-variant return types)
- Renamed patch:
  * tomcat-9.0-disable-osgi-build.patch
  - &gt; tomcat-9.0-osgi-build.patch
    + Do not disable, but fix OSGi build since we have now
    aqute-bnd</changelog>
  <changelog author="malbu@suse.com" date="1580299200">- Modified patch:
  * tomcat-9.0.30-java8compat.patch
    + add missing casts (bsc#1162081)</changelog>
  <changelog author="fstrba@suse.com" date="1582632000">- Update to Tomcat 9.0.31. See changelog at
  http://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.30_(markt)
- Fixed CVEs:
  * CVE-2019-17569 (bsc#1164825)
  * CVE-2020-1935 (bsc#1164860)
  * CVE-2020-1938 (bsc#1164692)
- Modified patch
  * tomcat-9.0.30-java8compat.patch
  - &gt; tomcat-9.0.31-java8compat.patch
    + Adapt to changed context</changelog>
  <changelog author="malbu@suse.com" date="1582891200">- Change default value of AJP connector secretRequired to false
- Added patch:
  * tomcat-9.0.31-secretRequired-default.patch</changelog>
  <changelog author="malbu@suse.com" date="1585569600">- Update to Tomcat 9.0.33. See changelog at
  http://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.33_(markt)
- Notable fix: corrected a regression in the improvements to HTTP
  header parsing (bsc#1167438)
- Rebased patches:
  * tomcat-9.0-javadoc.patch
  * tomcat-9.0-osgi-build.patch
  * tomcat-9.0.31-java8compat.patch</changelog>
  <changelog author="javier@opensuse.org" date="1586520000">- Update to Tomcat 9.0.34. See changelog at
  https://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.34_(markt)
- Notable changes:
  * Add support for default values when using ${...} property
    replacement in configuration files. Based on a pull request
    provided by Bernd Bohmann.
  * When configuring an HTTP Connector, warn if the encoding
    specified for URIEncoding is not a superset of US-ASCII as
    required by RFC 7230.
  * Replace the system property
    org.apache.tomcat.util.buf.UDecoder.ALLOW_ENCODED_SLASH with
    the Connector attribute encodedSolidusHandling that adds an
    additional option to pass the %2f sequence through to the
    application without decoding it in addition to rejecting such
    sequences and decoding such sequences.</changelog>
  <changelog author="malbu@suse.com" date="1590494400">- Update to Tomcat 9.0.35. See changelog at
  https://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.35_(markt)
- Fixed CVEs:
  - CVE-2020-9484 (bsc#1171928)
- Rebased patches:
  * tomcat-9.0-javadoc.patch
  * tomcat-9.0-osgi-build.patch
  * tomcat-9.0.31-java8compat.patch</changelog>
  <changelog author="fstrba@suse.com" date="1593172800">- Update to Tomcat 9.0.36. See changelog at
  https://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.36_(markt)
- Fixed CVEs:
  CVE-2020-11996 (bsc#1173389)</changelog>
  <changelog author="malbu@suse.com" date="1594987200">- Fixed CVEs:
  * CVE-2020-13934 (bsc#1174121)
  * CVE-2020-13935 (bsc#1174117)
- Added patches:
  * tomcat-9.0-CVE-2020-13934.patch
  * tomcat-9.0-CVE-2020-13935.patch
- Rebased patches:
  * tomcat-9.0.31-java8compat.patch</changelog>
  <changelog author="malbu@suse.com" date="1595505600">- Fix tomcat-servlet-4_0-api package alternatives to use
  /usr/share/java/servlet.jar instead of /usr/share/java/tomcat-servlet.jar.
  Keep /usr/share/java/tomcat-servlet.jar symlink for compatibility.
  (bsc#1092163)
- Don't give write permissions for the tomcat group on files and
  directories where it's not needed (bsc#1172562)
- Change tomcat.pid location from /var/run to /run (bsc#1173103)
- Use %tmpfiles_create macro in %post instead of calling
  systemd-tmpfiles directly</changelog>
  <changelog author="malbu@suse.com" date="1602590400">- Fix CVE-2020-13943 (bsc#1177582)
- Added patch:
  * tomcat-9.0-CVE-2020-13943.patch</changelog>
  <changelog author="malbu@suse.com" date="1604491200">- Fix typo in tomcat-webapps %postun that caused /examples
  context to remain in server.xml when package was removed
- Remove tomcat-9.0.init and /usr/lib/tmpfiles.d/tomcat.conf from
  package. They're not used anymore becuse of systemd (bsc#1178396)</changelog>
  <changelog author="amehmood@suse.com" date="1608033600">- Fix HTTP/2 request header mix-up: CVE-2020-17527 (bsc#1179602)
- Added patch:
  * tomcat-9.0-CVE-2020-17527.patch</changelog>
  <changelog author="amehmood@suse.com" date="1612872000">- Log if file access is blocked due to symlinks: CVE-2021-24122 (bsc#1180947)
- Added patch:
  * tomcat-9.0-CVE-2021-24122.patch</changelog>
  <changelog author="amehmood@suse.com" date="1615982400">- Fixed CVEs:
  * CVE-2021-25122: Apache Tomcat h2c request mix-up (bsc#1182912)
  * CVE-2021-25329: Complete fix for CVE-2020-9484 (bsc#1182909)
- Added patches:
  * tomcat-9.0-CVE-2021-25122.patch
  * tomcat-9.0-CVE-2021-25329.patch</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1635336000">- Fixed CVEs:
  * CVE-2021-41079: Validate incoming TLS packet (bsc#1190558)
- Added patches:
  * tomcat-9.0-CVE-2021-41079.patch</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1635508800">- Fixed CVEs:
  * CVE-2021-30640: Escape parameters in JNDI Realm queries (bsc#1188279)
  * CVE-2021-33037: Process T-E header from both HTTP 1.0 and HTTP 1.1. clients (bsc#1188278)
- Added patches:
  * tomcat-9.0-CVE-2021-30640.patch
  * tomcat-9.0-CVE-2021-33037.patch</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1639137600">- Fix NPE in JNDIRealm, when userRoleAttribute is not set (bsc#1193569)
- Added patch:
  * tomcat-9.0-NPE-JNDIRealm.patch</changelog>
</package>
<package pkgid="3407105bf570d80c312a0b114a55c0f1fdff2015159c7de3cbbcb5813cc20c38" name="tomcat-servlet-4_0-api" arch="noarch">
  <version epoch="0" ver="9.0.36" rel="16.1"/>
  <changelog author="malbu@suse.com" date="1577448000">- Update to Tomcat 9.0.30. See changelog at
  http://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.30_(markt)
- Fixed CVEs:
  - CVE-2019-0221 (bsc#1136085)
  - CVE-2019-10072 (bsc#1139924)
  - CVE-2019-12418 (bsc#1159723)
  - CVE-2019-17563 (bsc#1159729)
- Removed patch:
  * tomcat-9.0-JDTCompiler-java.patch
    + It was not applied</changelog>
  <changelog author="malbu@suse.com" date="1579262400">- Change build to always use Java 1.8 (bsc#1161025).</changelog>
  <changelog author="fstrba@suse.com" date="1579521600">- Change back the build to build with any Java &gt;= 1.8
- Added patch:
  * tomcat-9.0.30-java8compat.patch
    + Cast java.nio.ByteBuffer and java.nio.CharBuffer to
    java.nio.Buffer in order to avoid calling Java 9+ APIs
    (functions with co-variant return types)
- Renamed patch:
  * tomcat-9.0-disable-osgi-build.patch
  - &gt; tomcat-9.0-osgi-build.patch
    + Do not disable, but fix OSGi build since we have now
    aqute-bnd</changelog>
  <changelog author="malbu@suse.com" date="1580299200">- Modified patch:
  * tomcat-9.0.30-java8compat.patch
    + add missing casts (bsc#1162081)</changelog>
  <changelog author="fstrba@suse.com" date="1582632000">- Update to Tomcat 9.0.31. See changelog at
  http://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.30_(markt)
- Fixed CVEs:
  * CVE-2019-17569 (bsc#1164825)
  * CVE-2020-1935 (bsc#1164860)
  * CVE-2020-1938 (bsc#1164692)
- Modified patch
  * tomcat-9.0.30-java8compat.patch
  - &gt; tomcat-9.0.31-java8compat.patch
    + Adapt to changed context</changelog>
  <changelog author="malbu@suse.com" date="1582891200">- Change default value of AJP connector secretRequired to false
- Added patch:
  * tomcat-9.0.31-secretRequired-default.patch</changelog>
  <changelog author="malbu@suse.com" date="1585569600">- Update to Tomcat 9.0.33. See changelog at
  http://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.33_(markt)
- Notable fix: corrected a regression in the improvements to HTTP
  header parsing (bsc#1167438)
- Rebased patches:
  * tomcat-9.0-javadoc.patch
  * tomcat-9.0-osgi-build.patch
  * tomcat-9.0.31-java8compat.patch</changelog>
  <changelog author="javier@opensuse.org" date="1586520000">- Update to Tomcat 9.0.34. See changelog at
  https://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.34_(markt)
- Notable changes:
  * Add support for default values when using ${...} property
    replacement in configuration files. Based on a pull request
    provided by Bernd Bohmann.
  * When configuring an HTTP Connector, warn if the encoding
    specified for URIEncoding is not a superset of US-ASCII as
    required by RFC 7230.
  * Replace the system property
    org.apache.tomcat.util.buf.UDecoder.ALLOW_ENCODED_SLASH with
    the Connector attribute encodedSolidusHandling that adds an
    additional option to pass the %2f sequence through to the
    application without decoding it in addition to rejecting such
    sequences and decoding such sequences.</changelog>
  <changelog author="malbu@suse.com" date="1590494400">- Update to Tomcat 9.0.35. See changelog at
  https://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.35_(markt)
- Fixed CVEs:
  - CVE-2020-9484 (bsc#1171928)
- Rebased patches:
  * tomcat-9.0-javadoc.patch
  * tomcat-9.0-osgi-build.patch
  * tomcat-9.0.31-java8compat.patch</changelog>
  <changelog author="fstrba@suse.com" date="1593172800">- Update to Tomcat 9.0.36. See changelog at
  https://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.36_(markt)
- Fixed CVEs:
  CVE-2020-11996 (bsc#1173389)</changelog>
  <changelog author="malbu@suse.com" date="1594987200">- Fixed CVEs:
  * CVE-2020-13934 (bsc#1174121)
  * CVE-2020-13935 (bsc#1174117)
- Added patches:
  * tomcat-9.0-CVE-2020-13934.patch
  * tomcat-9.0-CVE-2020-13935.patch
- Rebased patches:
  * tomcat-9.0.31-java8compat.patch</changelog>
  <changelog author="malbu@suse.com" date="1595505600">- Fix tomcat-servlet-4_0-api package alternatives to use
  /usr/share/java/servlet.jar instead of /usr/share/java/tomcat-servlet.jar.
  Keep /usr/share/java/tomcat-servlet.jar symlink for compatibility.
  (bsc#1092163)
- Don't give write permissions for the tomcat group on files and
  directories where it's not needed (bsc#1172562)
- Change tomcat.pid location from /var/run to /run (bsc#1173103)
- Use %tmpfiles_create macro in %post instead of calling
  systemd-tmpfiles directly</changelog>
  <changelog author="malbu@suse.com" date="1602590400">- Fix CVE-2020-13943 (bsc#1177582)
- Added patch:
  * tomcat-9.0-CVE-2020-13943.patch</changelog>
  <changelog author="malbu@suse.com" date="1604491200">- Fix typo in tomcat-webapps %postun that caused /examples
  context to remain in server.xml when package was removed
- Remove tomcat-9.0.init and /usr/lib/tmpfiles.d/tomcat.conf from
  package. They're not used anymore becuse of systemd (bsc#1178396)</changelog>
  <changelog author="amehmood@suse.com" date="1608033600">- Fix HTTP/2 request header mix-up: CVE-2020-17527 (bsc#1179602)
- Added patch:
  * tomcat-9.0-CVE-2020-17527.patch</changelog>
  <changelog author="amehmood@suse.com" date="1612872000">- Log if file access is blocked due to symlinks: CVE-2021-24122 (bsc#1180947)
- Added patch:
  * tomcat-9.0-CVE-2021-24122.patch</changelog>
  <changelog author="amehmood@suse.com" date="1615982400">- Fixed CVEs:
  * CVE-2021-25122: Apache Tomcat h2c request mix-up (bsc#1182912)
  * CVE-2021-25329: Complete fix for CVE-2020-9484 (bsc#1182909)
- Added patches:
  * tomcat-9.0-CVE-2021-25122.patch
  * tomcat-9.0-CVE-2021-25329.patch</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1635336000">- Fixed CVEs:
  * CVE-2021-41079: Validate incoming TLS packet (bsc#1190558)
- Added patches:
  * tomcat-9.0-CVE-2021-41079.patch</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1635508800">- Fixed CVEs:
  * CVE-2021-30640: Escape parameters in JNDI Realm queries (bsc#1188279)
  * CVE-2021-33037: Process T-E header from both HTTP 1.0 and HTTP 1.1. clients (bsc#1188278)
- Added patches:
  * tomcat-9.0-CVE-2021-30640.patch
  * tomcat-9.0-CVE-2021-33037.patch</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1639137600">- Fix NPE in JNDIRealm, when userRoleAttribute is not set (bsc#1193569)
- Added patch:
  * tomcat-9.0-NPE-JNDIRealm.patch</changelog>
</package>
<package pkgid="cf463de9b05b5d95d730597a14c5758ec2b4e29121964d6cb4fba30491c6f6f8" name="tomcat-webapps" arch="noarch">
  <version epoch="0" ver="9.0.36" rel="16.1"/>
  <changelog author="malbu@suse.com" date="1577448000">- Update to Tomcat 9.0.30. See changelog at
  http://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.30_(markt)
- Fixed CVEs:
  - CVE-2019-0221 (bsc#1136085)
  - CVE-2019-10072 (bsc#1139924)
  - CVE-2019-12418 (bsc#1159723)
  - CVE-2019-17563 (bsc#1159729)
- Removed patch:
  * tomcat-9.0-JDTCompiler-java.patch
    + It was not applied</changelog>
  <changelog author="malbu@suse.com" date="1579262400">- Change build to always use Java 1.8 (bsc#1161025).</changelog>
  <changelog author="fstrba@suse.com" date="1579521600">- Change back the build to build with any Java &gt;= 1.8
- Added patch:
  * tomcat-9.0.30-java8compat.patch
    + Cast java.nio.ByteBuffer and java.nio.CharBuffer to
    java.nio.Buffer in order to avoid calling Java 9+ APIs
    (functions with co-variant return types)
- Renamed patch:
  * tomcat-9.0-disable-osgi-build.patch
  - &gt; tomcat-9.0-osgi-build.patch
    + Do not disable, but fix OSGi build since we have now
    aqute-bnd</changelog>
  <changelog author="malbu@suse.com" date="1580299200">- Modified patch:
  * tomcat-9.0.30-java8compat.patch
    + add missing casts (bsc#1162081)</changelog>
  <changelog author="fstrba@suse.com" date="1582632000">- Update to Tomcat 9.0.31. See changelog at
  http://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.30_(markt)
- Fixed CVEs:
  * CVE-2019-17569 (bsc#1164825)
  * CVE-2020-1935 (bsc#1164860)
  * CVE-2020-1938 (bsc#1164692)
- Modified patch
  * tomcat-9.0.30-java8compat.patch
  - &gt; tomcat-9.0.31-java8compat.patch
    + Adapt to changed context</changelog>
  <changelog author="malbu@suse.com" date="1582891200">- Change default value of AJP connector secretRequired to false
- Added patch:
  * tomcat-9.0.31-secretRequired-default.patch</changelog>
  <changelog author="malbu@suse.com" date="1585569600">- Update to Tomcat 9.0.33. See changelog at
  http://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.33_(markt)
- Notable fix: corrected a regression in the improvements to HTTP
  header parsing (bsc#1167438)
- Rebased patches:
  * tomcat-9.0-javadoc.patch
  * tomcat-9.0-osgi-build.patch
  * tomcat-9.0.31-java8compat.patch</changelog>
  <changelog author="javier@opensuse.org" date="1586520000">- Update to Tomcat 9.0.34. See changelog at
  https://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.34_(markt)
- Notable changes:
  * Add support for default values when using ${...} property
    replacement in configuration files. Based on a pull request
    provided by Bernd Bohmann.
  * When configuring an HTTP Connector, warn if the encoding
    specified for URIEncoding is not a superset of US-ASCII as
    required by RFC 7230.
  * Replace the system property
    org.apache.tomcat.util.buf.UDecoder.ALLOW_ENCODED_SLASH with
    the Connector attribute encodedSolidusHandling that adds an
    additional option to pass the %2f sequence through to the
    application without decoding it in addition to rejecting such
    sequences and decoding such sequences.</changelog>
  <changelog author="malbu@suse.com" date="1590494400">- Update to Tomcat 9.0.35. See changelog at
  https://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.35_(markt)
- Fixed CVEs:
  - CVE-2020-9484 (bsc#1171928)
- Rebased patches:
  * tomcat-9.0-javadoc.patch
  * tomcat-9.0-osgi-build.patch
  * tomcat-9.0.31-java8compat.patch</changelog>
  <changelog author="fstrba@suse.com" date="1593172800">- Update to Tomcat 9.0.36. See changelog at
  https://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.36_(markt)
- Fixed CVEs:
  CVE-2020-11996 (bsc#1173389)</changelog>
  <changelog author="malbu@suse.com" date="1594987200">- Fixed CVEs:
  * CVE-2020-13934 (bsc#1174121)
  * CVE-2020-13935 (bsc#1174117)
- Added patches:
  * tomcat-9.0-CVE-2020-13934.patch
  * tomcat-9.0-CVE-2020-13935.patch
- Rebased patches:
  * tomcat-9.0.31-java8compat.patch</changelog>
  <changelog author="malbu@suse.com" date="1595505600">- Fix tomcat-servlet-4_0-api package alternatives to use
  /usr/share/java/servlet.jar instead of /usr/share/java/tomcat-servlet.jar.
  Keep /usr/share/java/tomcat-servlet.jar symlink for compatibility.
  (bsc#1092163)
- Don't give write permissions for the tomcat group on files and
  directories where it's not needed (bsc#1172562)
- Change tomcat.pid location from /var/run to /run (bsc#1173103)
- Use %tmpfiles_create macro in %post instead of calling
  systemd-tmpfiles directly</changelog>
  <changelog author="malbu@suse.com" date="1602590400">- Fix CVE-2020-13943 (bsc#1177582)
- Added patch:
  * tomcat-9.0-CVE-2020-13943.patch</changelog>
  <changelog author="malbu@suse.com" date="1604491200">- Fix typo in tomcat-webapps %postun that caused /examples
  context to remain in server.xml when package was removed
- Remove tomcat-9.0.init and /usr/lib/tmpfiles.d/tomcat.conf from
  package. They're not used anymore becuse of systemd (bsc#1178396)</changelog>
  <changelog author="amehmood@suse.com" date="1608033600">- Fix HTTP/2 request header mix-up: CVE-2020-17527 (bsc#1179602)
- Added patch:
  * tomcat-9.0-CVE-2020-17527.patch</changelog>
  <changelog author="amehmood@suse.com" date="1612872000">- Log if file access is blocked due to symlinks: CVE-2021-24122 (bsc#1180947)
- Added patch:
  * tomcat-9.0-CVE-2021-24122.patch</changelog>
  <changelog author="amehmood@suse.com" date="1615982400">- Fixed CVEs:
  * CVE-2021-25122: Apache Tomcat h2c request mix-up (bsc#1182912)
  * CVE-2021-25329: Complete fix for CVE-2020-9484 (bsc#1182909)
- Added patches:
  * tomcat-9.0-CVE-2021-25122.patch
  * tomcat-9.0-CVE-2021-25329.patch</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1635336000">- Fixed CVEs:
  * CVE-2021-41079: Validate incoming TLS packet (bsc#1190558)
- Added patches:
  * tomcat-9.0-CVE-2021-41079.patch</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1635508800">- Fixed CVEs:
  * CVE-2021-30640: Escape parameters in JNDI Realm queries (bsc#1188279)
  * CVE-2021-33037: Process T-E header from both HTTP 1.0 and HTTP 1.1. clients (bsc#1188278)
- Added patches:
  * tomcat-9.0-CVE-2021-30640.patch
  * tomcat-9.0-CVE-2021-33037.patch</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1639137600">- Fix NPE in JNDIRealm, when userRoleAttribute is not set (bsc#1193569)
- Added patch:
  * tomcat-9.0-NPE-JNDIRealm.patch</changelog>
</package>
<package pkgid="62054c8378d738e02e93ae91c6bed7807af4c4ee52a783a182a05876067e9add" name="typelib-1_0-Polkit-1_0" arch="aarch64">
  <version epoch="0" ver="0.116" rel="3.9.1"/>
  <changelog author="antoine.belvire@laposte.net" date="1438862400">- Update to 0.113:
  * Fix CVE-2015-4625
  * Fix CVE-2015-3256
  * Fix CVE-2015-3255
  * Fix CVE-2015-3218
  * On systemd-213 and later, the ?active? state is shared across
    all sessions of an user, instead of being tracked separately
  * pkexec: when not given a program to execute, runs the users?
    shell by default
- Remove polkit-no-kded-leak.patch (upstreamed)</changelog>
  <changelog author="meissner@suse.com" date="1448539200">- polkit-revert-session-magic.patch: revert a session detection change
  that could lead to sessions not being detected as active due to
  a systemd bug. bsc#954139</changelog>
  <changelog author="fbui@suse.com" date="1465300800">- systemd.pc is shipped by systemd main package (bsc#983167)
  Strangely polkit wants systemd.pc to detect that the target system
  is running systemd even if its configured to build systemd support...</changelog>
  <changelog author="fbui@suse.com" date="1465387200">- Use pkgconfig() instead of requiring systemd package names directly.</changelog>
  <changelog author="lnussel@suse.de" date="1497355200">- Use gettext as fallback to get potential distro translations for
  polkit actions. Similar mechnism as used for desktop file
  translations. That way it's possible to use weblate to add
  additional translations that are not provided by upstream
  (polkit-gettext.patch).</changelog>
  <changelog author="dimstar@opensuse.org" date="1502798400">- Add polkit-itstools.patch: Add gettext support for .policy files.</changelog>
  <changelog author="dimstar@opensuse.org" date="1519819200">- Modernize spec-file by calling spec-cleaner</changelog>
  <changelog author="schwab@suse.de" date="1519905600">- pkexec.patch: pkexec: allow --version and --help even if not setuid</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1523275200">- Update to version 0.114:
  + Port to mozjs 52, the latest version of the firefox JavaScript
    engine.
  + Add gettext support for policy files.
  + Fixes for various memory leaks.
  + Updated translations.
- Update keyring with Ray Strode &lt;halfline@gmail.com&gt; public key.
- Drop with_systemd define and all conditionals and
  polkit-no-systemd.patch and ConsoleKit BuildRequires, we only
  support systemd now.
- Drop upstream fixed polkit-itstools.patch.
- Rebase pkexec.patch with quilt.
- Add gcc-c++ and pkgconfig(mozjs-52) BuildRequires: New
  dependencies.
- Drop conditional pkgconfig(mozjs-17.0) and pkgconfig(mozjs185):
  no longer supported.
- Drop autoconf and automake BuildRequires: They are implicit via
  libtool BuildRequires.
- Replace glib2-devel and gobject-introspection-devel with their
  pkgconfig counterparts: pkgconfig(gio-unix-2.0),
  pkgconfig(gmodule-2.0) and pkgconfig(gobject-introspection-1.0).
- Add polkit-jsauthority-pass-format-string.patch: jsauthority:
  pass "%s" format string to remaining report function, patch from
  upstream git, adding missed commit (bgo#105865).
- Drop polkit-revert-session-magic.patch: Upstream systemd bug is
  since a long time fixed (gh#systemd#58) (boo#954139).</changelog>
  <changelog author="meissner@suse.com" date="1531310400">- Update to version 0.115:
  - Fix CVE-2018-1116: Trusting client-supplied UID (bsc#1099031)
  - jsauthority: pass "%s" format string to remaining report function
    (obsoletes polkit-jsauthority-pass-format-string.patch)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1534507200">- Add polkit-fix-possible-resource-leak.patch: Fix possible
  resource leak found by static analyzer.
- Add polkit-fix-leaking-zombie-child-processes.patch: polkitd: fix
  zombie not reaped when js spawned process timed out (fdo#106021).</changelog>
  <changelog author="meissner@suse.com" date="1545307200">- polkit-CVE-2018-19788.patch: Fixed handling of UIDs over MAX_UINT
  (bsc#1118277 CVE-2018-19788)</changelog>
  <changelog author="mvetter@suse.com" date="1556280000">- bsc#1130588: Require shadow instead of old pwdutils
- User proper Requires(pre)/Requires(post) for permissions and
  shadow</changelog>
  <changelog author="dimstar@opensuse.org" date="1557489600">- Use systemd_ordering instead of systemd_requires: strictly
  speaking, polkit does not require systemd to be present. Just
  that when we install on a system with systemd (e.g outside
  containers) we would want systemd to be present before
  installing polkit. Help also reduce a cycle without special hacks
  in systemd.spec.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1559131200">- Update to version 0.116:
  + Leaking zombie child processes.
  + Possible resource leak found by static analyzer.
  + Output messages tuneup.
  + Sanity fixes.
  + pkttyagent tty echo disabled on SIGINT.
  + HACKING: add link to Code of Conduct.
  + polkitbackend: comment typos fix.
  + configure.ac: fix detection of systemd with cgroups v2.
  + CVE-2018-19788 High UIDs overflow fix.
  + CVE-2019-6133 Slowfork vulnerability fix.
  + Allow unset process-uid.
  + Port the JS authority to mozjs-60.
  + Use JS_EncodeStringToUTF8.
  + Updated translations.
- Replace pkgconfig(mozjs-52) with pkgconfig(mozjs-60)
  BuildRequires following upstreams changes.
- Drop patches fixed upstream:
  + polkit-fix-possible-resource-leak.patch
  + polkit-fix-leaking-zombie-child-processes.patch
  + polkit-CVE-2018-19788.patch
- Refresh patches with quilt.</changelog>
  <changelog author="meissner@suse.com" date="1570536000">- polkit-keyinit.patch: add pam_keyinit to the polkit configuration (bsc#1144053)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1575028800">- Fix usage of libexecdir instead of prefix/lib where applicable.</changelog>
  <changelog author="meissner@suse.com" date="1622116800">- CVE-2021-3560: fixed a local privilege escalation using polkit_system_bus_name_get_creds_sync()
  (bsc#1186497)
  CVE-2021-3560.patch</changelog>
  <changelog author="meissner@suse.com" date="1642075200">- CVE-2021-4034: fixed a local privilege escalation in pkexec (bsc#1194568)
  added CVE-2021-4034-pkexec-fix.patch</changelog>
  <changelog author="rfrohl@suse.com" date="1644235200">- CVE-2021-4115: fixed a denial of service via file descriptor leak (bsc#1195542)
  added CVE-2021-4115.patch</changelog>
</package>
<package pkgid="61d84bc20195c12ce89d317fb05e25ad201e480c71e167768d9e0515e6f264dd" name="typelib-1_0-Polkit-1_0" arch="ppc64le">
  <version epoch="0" ver="0.116" rel="3.9.1"/>
  <changelog author="antoine.belvire@laposte.net" date="1438862400">- Update to 0.113:
  * Fix CVE-2015-4625
  * Fix CVE-2015-3256
  * Fix CVE-2015-3255
  * Fix CVE-2015-3218
  * On systemd-213 and later, the ?active? state is shared across
    all sessions of an user, instead of being tracked separately
  * pkexec: when not given a program to execute, runs the users?
    shell by default
- Remove polkit-no-kded-leak.patch (upstreamed)</changelog>
  <changelog author="meissner@suse.com" date="1448539200">- polkit-revert-session-magic.patch: revert a session detection change
  that could lead to sessions not being detected as active due to
  a systemd bug. bsc#954139</changelog>
  <changelog author="fbui@suse.com" date="1465300800">- systemd.pc is shipped by systemd main package (bsc#983167)
  Strangely polkit wants systemd.pc to detect that the target system
  is running systemd even if its configured to build systemd support...</changelog>
  <changelog author="fbui@suse.com" date="1465387200">- Use pkgconfig() instead of requiring systemd package names directly.</changelog>
  <changelog author="lnussel@suse.de" date="1497355200">- Use gettext as fallback to get potential distro translations for
  polkit actions. Similar mechnism as used for desktop file
  translations. That way it's possible to use weblate to add
  additional translations that are not provided by upstream
  (polkit-gettext.patch).</changelog>
  <changelog author="dimstar@opensuse.org" date="1502798400">- Add polkit-itstools.patch: Add gettext support for .policy files.</changelog>
  <changelog author="dimstar@opensuse.org" date="1519819200">- Modernize spec-file by calling spec-cleaner</changelog>
  <changelog author="schwab@suse.de" date="1519905600">- pkexec.patch: pkexec: allow --version and --help even if not setuid</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1523275200">- Update to version 0.114:
  + Port to mozjs 52, the latest version of the firefox JavaScript
    engine.
  + Add gettext support for policy files.
  + Fixes for various memory leaks.
  + Updated translations.
- Update keyring with Ray Strode &lt;halfline@gmail.com&gt; public key.
- Drop with_systemd define and all conditionals and
  polkit-no-systemd.patch and ConsoleKit BuildRequires, we only
  support systemd now.
- Drop upstream fixed polkit-itstools.patch.
- Rebase pkexec.patch with quilt.
- Add gcc-c++ and pkgconfig(mozjs-52) BuildRequires: New
  dependencies.
- Drop conditional pkgconfig(mozjs-17.0) and pkgconfig(mozjs185):
  no longer supported.
- Drop autoconf and automake BuildRequires: They are implicit via
  libtool BuildRequires.
- Replace glib2-devel and gobject-introspection-devel with their
  pkgconfig counterparts: pkgconfig(gio-unix-2.0),
  pkgconfig(gmodule-2.0) and pkgconfig(gobject-introspection-1.0).
- Add polkit-jsauthority-pass-format-string.patch: jsauthority:
  pass "%s" format string to remaining report function, patch from
  upstream git, adding missed commit (bgo#105865).
- Drop polkit-revert-session-magic.patch: Upstream systemd bug is
  since a long time fixed (gh#systemd#58) (boo#954139).</changelog>
  <changelog author="meissner@suse.com" date="1531310400">- Update to version 0.115:
  - Fix CVE-2018-1116: Trusting client-supplied UID (bsc#1099031)
  - jsauthority: pass "%s" format string to remaining report function
    (obsoletes polkit-jsauthority-pass-format-string.patch)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1534507200">- Add polkit-fix-possible-resource-leak.patch: Fix possible
  resource leak found by static analyzer.
- Add polkit-fix-leaking-zombie-child-processes.patch: polkitd: fix
  zombie not reaped when js spawned process timed out (fdo#106021).</changelog>
  <changelog author="meissner@suse.com" date="1545307200">- polkit-CVE-2018-19788.patch: Fixed handling of UIDs over MAX_UINT
  (bsc#1118277 CVE-2018-19788)</changelog>
  <changelog author="mvetter@suse.com" date="1556280000">- bsc#1130588: Require shadow instead of old pwdutils
- User proper Requires(pre)/Requires(post) for permissions and
  shadow</changelog>
  <changelog author="dimstar@opensuse.org" date="1557489600">- Use systemd_ordering instead of systemd_requires: strictly
  speaking, polkit does not require systemd to be present. Just
  that when we install on a system with systemd (e.g outside
  containers) we would want systemd to be present before
  installing polkit. Help also reduce a cycle without special hacks
  in systemd.spec.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1559131200">- Update to version 0.116:
  + Leaking zombie child processes.
  + Possible resource leak found by static analyzer.
  + Output messages tuneup.
  + Sanity fixes.
  + pkttyagent tty echo disabled on SIGINT.
  + HACKING: add link to Code of Conduct.
  + polkitbackend: comment typos fix.
  + configure.ac: fix detection of systemd with cgroups v2.
  + CVE-2018-19788 High UIDs overflow fix.
  + CVE-2019-6133 Slowfork vulnerability fix.
  + Allow unset process-uid.
  + Port the JS authority to mozjs-60.
  + Use JS_EncodeStringToUTF8.
  + Updated translations.
- Replace pkgconfig(mozjs-52) with pkgconfig(mozjs-60)
  BuildRequires following upstreams changes.
- Drop patches fixed upstream:
  + polkit-fix-possible-resource-leak.patch
  + polkit-fix-leaking-zombie-child-processes.patch
  + polkit-CVE-2018-19788.patch
- Refresh patches with quilt.</changelog>
  <changelog author="meissner@suse.com" date="1570536000">- polkit-keyinit.patch: add pam_keyinit to the polkit configuration (bsc#1144053)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1575028800">- Fix usage of libexecdir instead of prefix/lib where applicable.</changelog>
  <changelog author="meissner@suse.com" date="1622116800">- CVE-2021-3560: fixed a local privilege escalation using polkit_system_bus_name_get_creds_sync()
  (bsc#1186497)
  CVE-2021-3560.patch</changelog>
  <changelog author="meissner@suse.com" date="1642075200">- CVE-2021-4034: fixed a local privilege escalation in pkexec (bsc#1194568)
  added CVE-2021-4034-pkexec-fix.patch</changelog>
  <changelog author="rfrohl@suse.com" date="1644235200">- CVE-2021-4115: fixed a denial of service via file descriptor leak (bsc#1195542)
  added CVE-2021-4115.patch</changelog>
</package>
<package pkgid="af33c50d96b5536711afe99f1f80a2e1c47f204fd1f0fee0825904119a760a3e" name="typelib-1_0-Polkit-1_0" arch="s390x">
  <version epoch="0" ver="0.116" rel="3.9.1"/>
  <changelog author="antoine.belvire@laposte.net" date="1438862400">- Update to 0.113:
  * Fix CVE-2015-4625
  * Fix CVE-2015-3256
  * Fix CVE-2015-3255
  * Fix CVE-2015-3218
  * On systemd-213 and later, the ?active? state is shared across
    all sessions of an user, instead of being tracked separately
  * pkexec: when not given a program to execute, runs the users?
    shell by default
- Remove polkit-no-kded-leak.patch (upstreamed)</changelog>
  <changelog author="meissner@suse.com" date="1448539200">- polkit-revert-session-magic.patch: revert a session detection change
  that could lead to sessions not being detected as active due to
  a systemd bug. bsc#954139</changelog>
  <changelog author="fbui@suse.com" date="1465300800">- systemd.pc is shipped by systemd main package (bsc#983167)
  Strangely polkit wants systemd.pc to detect that the target system
  is running systemd even if its configured to build systemd support...</changelog>
  <changelog author="fbui@suse.com" date="1465387200">- Use pkgconfig() instead of requiring systemd package names directly.</changelog>
  <changelog author="lnussel@suse.de" date="1497355200">- Use gettext as fallback to get potential distro translations for
  polkit actions. Similar mechnism as used for desktop file
  translations. That way it's possible to use weblate to add
  additional translations that are not provided by upstream
  (polkit-gettext.patch).</changelog>
  <changelog author="dimstar@opensuse.org" date="1502798400">- Add polkit-itstools.patch: Add gettext support for .policy files.</changelog>
  <changelog author="dimstar@opensuse.org" date="1519819200">- Modernize spec-file by calling spec-cleaner</changelog>
  <changelog author="schwab@suse.de" date="1519905600">- pkexec.patch: pkexec: allow --version and --help even if not setuid</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1523275200">- Update to version 0.114:
  + Port to mozjs 52, the latest version of the firefox JavaScript
    engine.
  + Add gettext support for policy files.
  + Fixes for various memory leaks.
  + Updated translations.
- Update keyring with Ray Strode &lt;halfline@gmail.com&gt; public key.
- Drop with_systemd define and all conditionals and
  polkit-no-systemd.patch and ConsoleKit BuildRequires, we only
  support systemd now.
- Drop upstream fixed polkit-itstools.patch.
- Rebase pkexec.patch with quilt.
- Add gcc-c++ and pkgconfig(mozjs-52) BuildRequires: New
  dependencies.
- Drop conditional pkgconfig(mozjs-17.0) and pkgconfig(mozjs185):
  no longer supported.
- Drop autoconf and automake BuildRequires: They are implicit via
  libtool BuildRequires.
- Replace glib2-devel and gobject-introspection-devel with their
  pkgconfig counterparts: pkgconfig(gio-unix-2.0),
  pkgconfig(gmodule-2.0) and pkgconfig(gobject-introspection-1.0).
- Add polkit-jsauthority-pass-format-string.patch: jsauthority:
  pass "%s" format string to remaining report function, patch from
  upstream git, adding missed commit (bgo#105865).
- Drop polkit-revert-session-magic.patch: Upstream systemd bug is
  since a long time fixed (gh#systemd#58) (boo#954139).</changelog>
  <changelog author="meissner@suse.com" date="1531310400">- Update to version 0.115:
  - Fix CVE-2018-1116: Trusting client-supplied UID (bsc#1099031)
  - jsauthority: pass "%s" format string to remaining report function
    (obsoletes polkit-jsauthority-pass-format-string.patch)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1534507200">- Add polkit-fix-possible-resource-leak.patch: Fix possible
  resource leak found by static analyzer.
- Add polkit-fix-leaking-zombie-child-processes.patch: polkitd: fix
  zombie not reaped when js spawned process timed out (fdo#106021).</changelog>
  <changelog author="meissner@suse.com" date="1545307200">- polkit-CVE-2018-19788.patch: Fixed handling of UIDs over MAX_UINT
  (bsc#1118277 CVE-2018-19788)</changelog>
  <changelog author="mvetter@suse.com" date="1556280000">- bsc#1130588: Require shadow instead of old pwdutils
- User proper Requires(pre)/Requires(post) for permissions and
  shadow</changelog>
  <changelog author="dimstar@opensuse.org" date="1557489600">- Use systemd_ordering instead of systemd_requires: strictly
  speaking, polkit does not require systemd to be present. Just
  that when we install on a system with systemd (e.g outside
  containers) we would want systemd to be present before
  installing polkit. Help also reduce a cycle without special hacks
  in systemd.spec.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1559131200">- Update to version 0.116:
  + Leaking zombie child processes.
  + Possible resource leak found by static analyzer.
  + Output messages tuneup.
  + Sanity fixes.
  + pkttyagent tty echo disabled on SIGINT.
  + HACKING: add link to Code of Conduct.
  + polkitbackend: comment typos fix.
  + configure.ac: fix detection of systemd with cgroups v2.
  + CVE-2018-19788 High UIDs overflow fix.
  + CVE-2019-6133 Slowfork vulnerability fix.
  + Allow unset process-uid.
  + Port the JS authority to mozjs-60.
  + Use JS_EncodeStringToUTF8.
  + Updated translations.
- Replace pkgconfig(mozjs-52) with pkgconfig(mozjs-60)
  BuildRequires following upstreams changes.
- Drop patches fixed upstream:
  + polkit-fix-possible-resource-leak.patch
  + polkit-fix-leaking-zombie-child-processes.patch
  + polkit-CVE-2018-19788.patch
- Refresh patches with quilt.</changelog>
  <changelog author="meissner@suse.com" date="1570536000">- polkit-keyinit.patch: add pam_keyinit to the polkit configuration (bsc#1144053)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1575028800">- Fix usage of libexecdir instead of prefix/lib where applicable.</changelog>
  <changelog author="meissner@suse.com" date="1622116800">- CVE-2021-3560: fixed a local privilege escalation using polkit_system_bus_name_get_creds_sync()
  (bsc#1186497)
  CVE-2021-3560.patch</changelog>
  <changelog author="meissner@suse.com" date="1642075200">- CVE-2021-4034: fixed a local privilege escalation in pkexec (bsc#1194568)
  added CVE-2021-4034-pkexec-fix.patch</changelog>
  <changelog author="rfrohl@suse.com" date="1644235200">- CVE-2021-4115: fixed a denial of service via file descriptor leak (bsc#1195542)
  added CVE-2021-4115.patch</changelog>
</package>
<package pkgid="00d6335a29edca2e8c8b8171f256c4bc0b3aab184e585d6f792089cae94bf1e6" name="typelib-1_0-Polkit-1_0" arch="x86_64">
  <version epoch="0" ver="0.116" rel="3.9.1"/>
  <changelog author="antoine.belvire@laposte.net" date="1438862400">- Update to 0.113:
  * Fix CVE-2015-4625
  * Fix CVE-2015-3256
  * Fix CVE-2015-3255
  * Fix CVE-2015-3218
  * On systemd-213 and later, the ?active? state is shared across
    all sessions of an user, instead of being tracked separately
  * pkexec: when not given a program to execute, runs the users?
    shell by default
- Remove polkit-no-kded-leak.patch (upstreamed)</changelog>
  <changelog author="meissner@suse.com" date="1448539200">- polkit-revert-session-magic.patch: revert a session detection change
  that could lead to sessions not being detected as active due to
  a systemd bug. bsc#954139</changelog>
  <changelog author="fbui@suse.com" date="1465300800">- systemd.pc is shipped by systemd main package (bsc#983167)
  Strangely polkit wants systemd.pc to detect that the target system
  is running systemd even if its configured to build systemd support...</changelog>
  <changelog author="fbui@suse.com" date="1465387200">- Use pkgconfig() instead of requiring systemd package names directly.</changelog>
  <changelog author="lnussel@suse.de" date="1497355200">- Use gettext as fallback to get potential distro translations for
  polkit actions. Similar mechnism as used for desktop file
  translations. That way it's possible to use weblate to add
  additional translations that are not provided by upstream
  (polkit-gettext.patch).</changelog>
  <changelog author="dimstar@opensuse.org" date="1502798400">- Add polkit-itstools.patch: Add gettext support for .policy files.</changelog>
  <changelog author="dimstar@opensuse.org" date="1519819200">- Modernize spec-file by calling spec-cleaner</changelog>
  <changelog author="schwab@suse.de" date="1519905600">- pkexec.patch: pkexec: allow --version and --help even if not setuid</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1523275200">- Update to version 0.114:
  + Port to mozjs 52, the latest version of the firefox JavaScript
    engine.
  + Add gettext support for policy files.
  + Fixes for various memory leaks.
  + Updated translations.
- Update keyring with Ray Strode &lt;halfline@gmail.com&gt; public key.
- Drop with_systemd define and all conditionals and
  polkit-no-systemd.patch and ConsoleKit BuildRequires, we only
  support systemd now.
- Drop upstream fixed polkit-itstools.patch.
- Rebase pkexec.patch with quilt.
- Add gcc-c++ and pkgconfig(mozjs-52) BuildRequires: New
  dependencies.
- Drop conditional pkgconfig(mozjs-17.0) and pkgconfig(mozjs185):
  no longer supported.
- Drop autoconf and automake BuildRequires: They are implicit via
  libtool BuildRequires.
- Replace glib2-devel and gobject-introspection-devel with their
  pkgconfig counterparts: pkgconfig(gio-unix-2.0),
  pkgconfig(gmodule-2.0) and pkgconfig(gobject-introspection-1.0).
- Add polkit-jsauthority-pass-format-string.patch: jsauthority:
  pass "%s" format string to remaining report function, patch from
  upstream git, adding missed commit (bgo#105865).
- Drop polkit-revert-session-magic.patch: Upstream systemd bug is
  since a long time fixed (gh#systemd#58) (boo#954139).</changelog>
  <changelog author="meissner@suse.com" date="1531310400">- Update to version 0.115:
  - Fix CVE-2018-1116: Trusting client-supplied UID (bsc#1099031)
  - jsauthority: pass "%s" format string to remaining report function
    (obsoletes polkit-jsauthority-pass-format-string.patch)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1534507200">- Add polkit-fix-possible-resource-leak.patch: Fix possible
  resource leak found by static analyzer.
- Add polkit-fix-leaking-zombie-child-processes.patch: polkitd: fix
  zombie not reaped when js spawned process timed out (fdo#106021).</changelog>
  <changelog author="meissner@suse.com" date="1545307200">- polkit-CVE-2018-19788.patch: Fixed handling of UIDs over MAX_UINT
  (bsc#1118277 CVE-2018-19788)</changelog>
  <changelog author="mvetter@suse.com" date="1556280000">- bsc#1130588: Require shadow instead of old pwdutils
- User proper Requires(pre)/Requires(post) for permissions and
  shadow</changelog>
  <changelog author="dimstar@opensuse.org" date="1557489600">- Use systemd_ordering instead of systemd_requires: strictly
  speaking, polkit does not require systemd to be present. Just
  that when we install on a system with systemd (e.g outside
  containers) we would want systemd to be present before
  installing polkit. Help also reduce a cycle without special hacks
  in systemd.spec.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1559131200">- Update to version 0.116:
  + Leaking zombie child processes.
  + Possible resource leak found by static analyzer.
  + Output messages tuneup.
  + Sanity fixes.
  + pkttyagent tty echo disabled on SIGINT.
  + HACKING: add link to Code of Conduct.
  + polkitbackend: comment typos fix.
  + configure.ac: fix detection of systemd with cgroups v2.
  + CVE-2018-19788 High UIDs overflow fix.
  + CVE-2019-6133 Slowfork vulnerability fix.
  + Allow unset process-uid.
  + Port the JS authority to mozjs-60.
  + Use JS_EncodeStringToUTF8.
  + Updated translations.
- Replace pkgconfig(mozjs-52) with pkgconfig(mozjs-60)
  BuildRequires following upstreams changes.
- Drop patches fixed upstream:
  + polkit-fix-possible-resource-leak.patch
  + polkit-fix-leaking-zombie-child-processes.patch
  + polkit-CVE-2018-19788.patch
- Refresh patches with quilt.</changelog>
  <changelog author="meissner@suse.com" date="1570536000">- polkit-keyinit.patch: add pam_keyinit to the polkit configuration (bsc#1144053)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1575028800">- Fix usage of libexecdir instead of prefix/lib where applicable.</changelog>
  <changelog author="meissner@suse.com" date="1622116800">- CVE-2021-3560: fixed a local privilege escalation using polkit_system_bus_name_get_creds_sync()
  (bsc#1186497)
  CVE-2021-3560.patch</changelog>
  <changelog author="meissner@suse.com" date="1642075200">- CVE-2021-4034: fixed a local privilege escalation in pkexec (bsc#1194568)
  added CVE-2021-4034-pkexec-fix.patch</changelog>
  <changelog author="rfrohl@suse.com" date="1644235200">- CVE-2021-4115: fixed a denial of service via file descriptor leak (bsc#1195542)
  added CVE-2021-4115.patch</changelog>
</package>
<package pkgid="49a16c1c80c9732de1387e5d06ac093a4906b060b43de904a273710b1f7cf956" name="ucode-intel" arch="src">
  <version epoch="0" ver="20220207" rel="10.1"/>
  <changelog author="meissner@suse.com" date="1552564800">- Update to 20190312 release (bsc#1129231)
  - Processor             Identifier     Version       Products
  - Model        Stepping F-MO-S/PI      Old-&gt;New
  - ---- new platforms ----------------------------------------
  - AML-Y22      H0       6-8e-9/10           0000009e Core Gen8 Mobile
  - WHL-U        W0       6-8e-b/d0           000000a4 Core Gen8 Mobile
  - WHL-U        V0       6-8e-d/94           000000b2 Core Gen8 Mobile
  - CFL-S        P0       6-9e-c/22           000000a2 Core Gen9 Desktop
  - CFL-H        R0       6-9e-d/22           000000b0 Core Gen9 Mobile
  - ---- updated platforms ------------------------------------
  - HSX-E/EP     Cx/M1    6-3f-2/6f 0000003d-&gt;00000041 Core Gen4 X series; Xeon E5 v3
  - HSX-EX       E0       6-3f-4/80 00000012-&gt;00000013 Xeon E7 v3
  - SKX-SP       H0/M0/U0 6-55-4/b7 0200004d-&gt;0000005a Xeon Scalable
  - SKX-D        M1       6-55-4/b7 0200004d-&gt;0000005a Xeon D-21xx
  - BDX-DE       V1       6-56-2/10 00000017-&gt;00000019 Xeon D-1520/40
  - BDX-DE       V2/3     6-56-3/10 07000013-&gt;07000016 Xeon D-1518/19/21/27/28/31/33/37/41/48, Pentium D1507/08/09/17/19
  - BDX-DE       Y0       6-56-4/10 0f000012-&gt;0f000014 Xeon D-1557/59/67/71/77/81/87
  - BDX-NS       A0       6-56-5/10 0e00000a-&gt;0e00000c Xeon D-1513N/23/33/43/53
  - APL          D0       6-5c-9/03 00000032-&gt;00000036 Pentium N/J4xxx, Celeron N/J3xxx, Atom x5/7-E39xx
  - APL          E0       6-5c-a/03 0000000c-&gt;00000010 Atom x5/7-E39xx
  - GLK          B0       6-7a-1/01 00000028-&gt;0000002c Pentium Silver N/J5xxx, Celeron N/J4xxx
  - KBL-U/Y      H0       6-8e-9/c0 0000008e-&gt;0000009a Core Gen7 Mobile
  - CFL-U43e     D0       6-8e-a/c0 00000096-&gt;0000009e Core Gen8 Mobile
  - KBL-H/S/E3   B0       6-9e-9/2a 0000008e-&gt;0000009a Core Gen7; Xeon E3 v6
  - CFL-H/S/E3   U0       6-9e-a/22 00000096-&gt;000000aa Core Gen8 Desktop, Mobile, Xeon E
  - CFL-S B0 6-9e-b/02 0000008e-&gt;000000aa Core Gen8</changelog>
  <changelog author="meissner@suse.com" date="1557230400">- Intel QSR 2019.1 Microcode release (bsc#1111331 CVE-2018-12126
  CVE-2018-12130 CVE-2018-12127 CVE-2019-11091)
  - Processor             Identifier     Version       Products
  - Model        Stepping F-MO-S/PI      Old-&gt;New
  - ---- new platforms ----------------------------------------
  - CLX-SP       B1       6-55-7/bf           05000021 Xeon Scalable Gen2
  - ---- updated platforms ------------------------------------
  - SNB          D2/G1/Q0 6-2a-7/12 0000002e-&gt;0000002f Core Gen2
  - IVB          E1/L1    6-3a-9/12 00000020-&gt;00000021 Core Gen3
  - HSW          C0       6-3c-3/32 00000025-&gt;00000027 Core Gen4
  - BDW-U/Y      E0/F0    6-3d-4/c0 0000002b-&gt;0000002d Core Gen5
  - IVB-E/EP     C1/M1/S1 6-3e-4/ed 0000042e-&gt;0000042f Core Gen3 X Series; Xeon E5 v2
  - IVB-EX       D1       6-3e-7/ed 00000714-&gt;00000715 Xeon E7 v2
  - HSX-E/EP     Cx/M1    6-3f-2/6f 00000041-&gt;00000043 Core Gen4 X series; Xeon E5 v3
  - HSX-EX       E0       6-3f-4/80 00000013-&gt;00000014 Xeon E7 v3
  - HSW-U        C0/D0    6-45-1/72 00000024-&gt;00000025 Core Gen4
  - HSW-H        C0       6-46-1/32 0000001a-&gt;0000001b Core Gen4
  - BDW-H/E3     E0/G0    6-47-1/22 0000001e-&gt;00000020 Core Gen5
  - SKL-U/Y      D0/K1    6-4e-3/c0 000000c6-&gt;000000cc Core Gen6
  - SKX-SP       H0/M0/U0 6-55-4/b7 0200005a-&gt;0000005e Xeon Scalable
  - SKX-D        M1       6-55-4/b7 0200005a-&gt;0000005e Xeon D-21xx
  - BDX-DE       V1       6-56-2/10 00000019-&gt;0000001a Xeon D-1520/40
  - BDX-DE       V2/3     6-56-3/10 07000016-&gt;07000017 Xeon D-1518/19/21/27/28/31/33/37/41/48, Pentium D1507/08/09/17/19
  - BDX-DE       Y0       6-56-4/10 0f000014-&gt;0f000015 Xeon D-1557/59/67/71/77/81/87
  - BDX-NS       A0       6-56-5/10 0e00000c-&gt;0e00000d Xeon D-1513N/23/33/43/53
  - APL          D0       6-5c-9/03 00000036-&gt;00000038 Pentium N/J4xxx, Celeron N/J3xxx, Atom x5/7-E39xx
  - SKL-H/S      R0/N0    6-5e-3/36 000000c6-&gt;000000cc Core Gen6; Xeon E3 v5
  - DNV          B0       6-5f-1/01 00000024-&gt;0000002e Atom Processor C Series
  - GLK          B0       6-7a-1/01 0000002c-&gt;0000002e Pentium Silver N/J5xxx, Celeron N/J4xxx
  - AML-Y22      H0       6-8e-9/10 0000009e-&gt;000000b4 Core Gen8 Mobile
  - KBL-U/Y      H0       6-8e-9/c0 0000009a-&gt;000000b4 Core Gen7 Mobile
  - CFL-U43e     D0       6-8e-a/c0 0000009e-&gt;000000b4 Core Gen8 Mobile
  - WHL-U        W0       6-8e-b/d0 000000a4-&gt;000000b8 Core Gen8 Mobile
  - WHL-U        V0       6-8e-d/94 000000b2-&gt;000000b8 Core Gen8 Mobile
  - KBL-G/H/S/E3 B0       6-9e-9/2a 0000009a-&gt;000000b4 Core Gen7; Xeon E3 v6
  - CFL-H/S/E3   U0       6-9e-a/22 000000aa-&gt;000000b4 Core Gen8 Desktop, Mobile, Xeon E
  - CFL-S        B0       6-9e-b/02 000000aa-&gt;000000b4 Core Gen8
  - CFL-H/S      P0       6-9e-c/22 000000a2-&gt;000000ae Core Gen9
  - CFL-H        R0       6-9e-d/22 000000b0-&gt;000000b8 Core Gen9 Mobile</changelog>
  <changelog author="meissner@suse.com" date="1557921600">- updated to official QSR 2019. Microcode release (bsc#1111331
  CVE-2018-12126 CVE-2018-12130 CVE-2018-12127 CVE-2019-11091)
  - --- new platforms ----------------------------------------
  VLV          C0       6-37-8/02           00000838 Atom Z series
  VLV          C0       6-37-8/0C           00000838 Celeron N2xxx, Pentium N35xx
  VLV          D0       6-37-9/0F           0000090c Atom E38xx
  CHV          C0       6-4c-3/01           00000368 Atom X series
  CHV          D0       6-4c-4/01           00000411 Atom X series
  Readded what missing in last update:
  BDX-ML       B0/M0/R0 6-4f-1/ef 0b00002e-&gt;00000036 Xeon E5/E7 v4; Core i7-69xx/68xx</changelog>
  <changelog author="meissner@suse.com" date="1563364800">- Updated to 20190618 release (bsc#1111331 CVE-2018-12126 CVE-2018-12130 CVE-2018-12127 CVE-2019-11091)
  - --- updated platforms ------------------------------------
  SNB-E/EN/EP  C1/M0    6-2d-6/6d 0000061d-&gt;0000061f Xeon E3/E5, Core X
  SNB-E/EN/EP  C2/M1    6-2d-7/6d 00000714-&gt;00000718 Xeon E3/E5, Core X</changelog>
  <changelog author="meissner@suse.com" date="1568894400">- Updated to 20190918 bugfix release (bsc#1151232 bsc#1138185)
  Processor             Identifier     Version       Products
  Model        Stepping F-MO-S/PI      Old-&gt;New
  - --- updated platforms ------------------------------------
  BDW-U/Y      E0/F0    6-3d-4/c0 0000002d-&gt;0000002e Core Gen5
  HSX-EX       E0       6-3f-4/80 00000014-&gt;00000016 Xeon E7 v3
  BDW-H/E3     E0/G0    6-47-1/22 00000020-&gt;00000021 Core Gen5
  BDX-ML       B0/M0/R0 6-4f-1/ef 0b000036-&gt;0b000038 Xeon E5/E7 v4; Core i7-69xx/68xx
  BDX-DE       V1       6-56-2/10 0000001a-&gt;0000001c Xeon D-1520/40
  BDX-DE       V2/3     6-56-3/10 07000017-&gt;07000019 Xeon D-1518/19/21/27/28/31/33/37/41/48, Pentium D1507/08/09/17/19
  BDX-DE       Y0       6-56-4/10 0f000015-&gt;0f000017 Xeon D-1557/59/67/71/77/81/87
  BDX-NS       A0       6-56-5/10 0e00000d-&gt;0e00000f Xeon D-1513N/23/33/43/53
  SKX-SP       H0/M0/U0 6-55-4/b7 0200005e-&gt;00000064 Xeon Scalable
  SKX-D        M1       6-55-4/b7 0200005e-&gt;00000064 Xeon D-21xx
  CLX-SP       B1       6-55-7/bf 05000021-&gt;0500002b Xeon Scalable Gen2</changelog>
  <changelog author="meissner@suse.com" date="1573041600">- Updated to 20191112 security release (bsc#1155988)
  - Processor             Identifier     Version       Products
  - Model        Stepping F-MO-S/PI      Old-&gt;New
  - ---- new platforms ----------------------------------------
  - CML-U62      A0       6-a6-0/80           000000c6 Core Gen10 Mobile
  - CNL-U        D0       6-66-3/80           0000002a Core Gen8 Mobile
  - SKX-SP       B1       6-55-3/97           01000150 Xeon Scalable
  - ICL U/Y      D1       6-7e-5/80           00000046 Core Gen10 Mobile
  - ---- updated platforms ------------------------------------
  - SKL U/Y      D0       6-4e-3/c0 000000cc-&gt;000000d4 Core Gen6 Mobile
  - SKL H/S/E3   R0/N0    6-5e-3/36 000000cc-&gt;000000d4 Core Gen6
  - AML-Y22      H0       6-8e-9/10 000000b4-&gt;000000c6 Core Gen8 Mobile
  - KBL-U/Y      H0       6-8e-9/c0 000000b4-&gt;000000c6 Core Gen7 Mobile
  - CFL-U43e     D0       6-8e-a/c0 000000b4-&gt;000000c6 Core Gen8 Mobile
  - WHL-U        W0       6-8e-b/d0 000000b8-&gt;000000c6 Core Gen8 Mobile
  - AML-Y        V0       6-8e-c/94 000000b8-&gt;000000c6 Core Gen10 Mobile
  - CML-U42      V0       6-8e-c/94 000000b8-&gt;000000c6 Core Gen10 Mobile
  - WHL-U        V0       6-8e-c/94 000000b8-&gt;000000c6 Core Gen8 Mobile
  - KBL-G/X      H0       6-9e-9/2a 000000b4-&gt;000000c6 Core Gen7/Gen8
  - KBL-H/S/E3   B0       6-9e-9/2a 000000b4-&gt;000000c6 Core Gen7; Xeon E3 v6
  - CFL-H/S/E3   U0       6-9e-a/22 000000b4-&gt;000000c6 Core Gen8 Desktop, Mobile, Xeon E
  - CFL-S        B0       6-9e-b/02 000000b4-&gt;000000c6 Core Gen8
  - CFL-H        R0       6-9e-d/22 000000b8-&gt;000000c6 Core Gen9 Mobile
- Includes security fixes for:
  - CVE-2019-11135: Added feature allowing to disable TSX RTM (bsc#1139073)
  - CVE-2019-11139: A CPU microcode only fix for Voltage modulation issues (bsc#1141035)</changelog>
  <changelog author="meissner@suse.com" date="1573646400">- Updated to 20191112 official security release (bsc#1155988)
  - Processor             Identifier     Version       Products
  - Model        Stepping F-MO-S/PI      Old-&gt;New
  - ---- new platforms ----------------------------------------
  - AVN          B0/C0    6-4d-8/01           0000012d Atom C2xxx
  - CNL-U        D0       6-66-3/80           0000002a Core Gen8 Mobile
  - SKX-SP       B1       6-55-3/97           01000151 Xeon Scalable
  - CLX-SP       B0       6-55-6/bf           0400002c Xeon Scalable Gen2
  - GLK-R        R0       6-7a-8/01           00000016 Pentium J5040/N5030, Celeron J4125/J4025/N4020/N4120
  - ICL-U/Y      D1       6-7e-5/80           00000046 Core Gen10 Mobile
  - CML-U62      A0       6-a6-0/80           000000c6 Core Gen10 Mobile
  - ---- updated platforms ------------------------------------
  - SKL-U/Y      D0       6-4e-3/c0 000000cc-&gt;000000d4 Core Gen6 Mobile
  - SKX-SP       H0/M0/U0 6-55-4/b7 02000064-&gt;02000065 Xeon Scalable
  - SKX-D        M1       6-55-4/b7 02000064-&gt;02000065 Xeon D-21xx
  - CLX-SP       B1       6-55-7/bf 0500002b-&gt;0500002c Xeon Scalable Gen2
  - SKL-H/S/E3   R0/N0    6-5e-3/36 000000cc-&gt;000000d4 Core Gen6
  - GLK          B0       6-7a-1/01 0000002e-&gt;00000032 Pentium J5005/N5000, Celeron J4005/J4105/N4000/N4100
  - AML-Y22      H0       6-8e-9/10 000000b4-&gt;000000c6 Core Gen8 Mobile
  - KBL-U/Y      H0       6-8e-9/c0 000000b4-&gt;000000c6 Core Gen7 Mobile
  - CFL-U43e     D0       6-8e-a/c0 000000b4-&gt;000000c6 Core Gen8 Mobile
  - WHL-U        W0       6-8e-b/d0 000000b8-&gt;000000c6 Core Gen8 Mobile
  - AML-Y        V0       6-8e-c/94 000000b8-&gt;000000c6 Core Gen10 Mobile
  - CML-U42      V0       6-8e-c/94 000000b8-&gt;000000c6 Core Gen10 Mobile
  - WHL-U        V0       6-8e-c/94 000000b8-&gt;000000c6 Core Gen8 Mobile
  - KBL-G/X      H0       6-9e-9/2a 000000b4-&gt;000000c6 Core Gen7/Gen8
  - KBL-H/S/E3   B0       6-9e-9/2a 000000b4-&gt;000000c6 Core Gen7; Xeon E3 v6
  - CFL-H/S/E3   U0       6-9e-a/22 000000b4-&gt;000000c6 Core Gen8 Desktop, Mobile, Xeon E
  - CFL-S        B0       6-9e-b/02 000000b4-&gt;000000c6 Core Gen8
  - CFL-H        R0       6-9e-d/22 000000b8-&gt;000000c6 Core Gen9 Mobile
  - ---- removed platforms ------------------------------------
  - CFL-H/S      P0       6-9e-c/22 000000a2           Core Gen9
- Includes security fixes for:
  - CVE-2019-11135: Added feature allowing to disable TSX RTM (bsc#1139073)
  - CVE-2019-11139: A CPU microcode only fix for Voltage modulation issues (bsc#1141035)</changelog>
  <changelog author="meissner@suse.com" date="1574164800">- Updated to 20191115 release (bsc#1157004)
  - Processor             Identifier     Version       Products
  - Model        Stepping F-MO-S/PI      Old-&gt;New
  - ---- updated platforms ------------------------------------
  - SKL-U/Y      D0       6-4e-3/c0 000000d4-&gt;000000d6 Core Gen6 Mobile
  - SKL-U23e     K1       6-4e-3/c0 000000d4-&gt;000000d6 Core Gen6 Mobile
  - SKL-H/S/E3   N0/R0/S0 6-5e-3/36 000000d4-&gt;000000d6 Core Gen6
  - AML-Y22      H0       6-8e-9/10 000000c6-&gt;000000ca Core Gen8 Mobile
  - KBL-U/Y      H0       6-8e-9/c0 000000c6-&gt;000000ca Core Gen7 Mobile
  - KBL-U23e     J1       6-8e-9/c0 000000c6-&gt;000000ca Core Gen7 Mobile
  - CFL-U43e     D0       6-8e-a/c0 000000c6-&gt;000000ca Core Gen8 Mobile
  - KBL-R U      Y0       6-8e-a/c0 000000c6-&gt;000000ca Core Gen8 Mobile
  - WHL-U        W0       6-8e-b/d0 000000c6-&gt;000000ca Core Gen8 Mobile
  - AML-Y42      V0       6-8e-c/94 000000c6-&gt;000000ca Core Gen10 Mobile
  - WHL-U        V0       6-8e-c/94 000000c6-&gt;000000ca Core Gen8 Mobile
  - CML-U42      V0       6-8e-c/94 000000c6-&gt;000000ca Core Gen10 Mobile
  - KBL-G/H/S/X/E3 B0     6-9e-9/2a 000000c6-&gt;000000ca Core Gen7 Desktop, Mobile, Xeon E3 v6
  - CFL-H/S/E3   U0       6-9e-a/22 000000c6-&gt;000000ca Core Gen8 Desktop, Mobile, Xeon E
  - CFL-S        B0       6-9e-b/02 000000c6-&gt;000000ca Core Gen8
  - CFL-S        P0       6-9e-c/22 000000c6-&gt;000000ca Core Gen9 Desktop
  - CFL-H/S/E3   R0       6-9e-d/22 000000c6-&gt;000000ca Core Gen9 Desktop, Mobile, Xeon E
  - CML-U62      A0       6-a6-0/80 000000c6-&gt;000000ca Core Gen10 Mobile
- Updated to 20191113 release
  - Processor             Identifier     Version       Products
  - Model        Stepping F-MO-S/PI      Old-&gt;New
  - ---- updated platforms ------------------------------------
  - CFL-S        P0       6-9e-c/22 000000a2-&gt;000000c6 Core Gen9 Desktop</changelog>
  <changelog author="meissner@suse.com" date="1579089600">- reverted the entry below to 02000064 due to occasional faults (bsc#1160478)
  - SKX-SP       H0/M0/U0 6-55-4/b7 02000064-&gt;02000065 Xeon Scalable</changelog>
  <changelog author="meissner@suse.com" date="1587470400">- updated skylake microcode to the current version. (bsc#1169570)
  - 02000064-&gt;02006901</changelog>
  <changelog author="meissner@suse.com" date="1591185600">- Updated Intel CPU Microcode to 20200602 (prerelease) (bsc#1172466)
  Fixes for:
  - CVE-2020-0543: Fixed a side channel attack against special registers
    which could have resulted in leaking of read values to cores other
    than the one which called it.  This attack is known as Special Register
    Buffer Data Sampling (SRBDS) or "CrossTalk" (bsc#1154824).
  - CVE-2020-0548,CVE-2020-0549: Additional ucode updates were supplied to
    mitigate the Vector Register and L1D Eviction Sampling aka "CacheOutAttack"
    attacks. (bsc#1156353)
  == 20200602_DEMO Release ==
  - - Updates upon 20200520 release --
  Processor             Identifier     Version       Products
  Model        Stepping F-MO-S/PI      Old-&gt;New
  - --- new platforms ----------------------------------------
  - --- updated platforms ------------------------------------
  HSW          C0       6-3c-3/32 00000027-&gt;00000028 Core Gen4
  BDW-U/Y      E0/F0    6-3d-4/c0 0000002e-&gt;0000002f Core Gen5
  HSW-U        C0/D0    6-45-1/72 00000025-&gt;00000026 Core Gen4
  HSW-H        C0       6-46-1/32 0000001b-&gt;0000001c Core Gen4
  BDW-H/E3     E0/G0    6-47-1/22 00000021-&gt;00000022 Core Gen5
  SKL-U/Y      D0       6-4e-3/c0 000000d6-&gt;000000dc Core Gen6 Mobile
  SKL-U23e     K1       6-4e-3/c0 000000d6-&gt;000000dc Core Gen6 Mobile
  SKX-SP       B1       6-55-3/97 01000151-&gt;01000157 Xeon Scalable
  SKX-SP       H0/M0/U0 6-55-4/b7 02000065-&gt;02006906 Xeon Scalable
  SKX-D        M1       6-55-4/b7 02000065-&gt;02006906 Xeon D-21xx
  CLX-SP       B0       6-55-6/bf 0400002c-&gt;04002f01 Xeon Scalable Gen2
  CLX-SP       B1       6-55-7/bf 0500002c-&gt;04002f01 Xeon Scalable Gen2
  SKL-H/S      R0/N0    6-5e-3/36 000000d6-&gt;000000dc Core Gen6; Xeon E3 v5
  AML-Y22      H0       6-8e-9/10 000000ca-&gt;000000d6 Core Gen8 Mobile
  KBL-U/Y      H0       6-8e-9/c0 000000ca-&gt;000000d6 Core Gen7 Mobile
  CFL-U43e     D0       6-8e-a/c0 000000ca-&gt;000000d6 Core Gen8 Mobile
  WHL-U        W0       6-8e-b/d0 000000ca-&gt;000000d6 Core Gen8 Mobile
  AML-Y42      V0       6-8e-c/94 000000ca-&gt;000000d6 Core Gen10 Mobile
  CML-Y42      V0       6-8e-c/94 000000ca-&gt;000000d6 Core Gen10 Mobile
  WHL-U        V0       6-8e-c/94 000000ca-&gt;000000d6 Core Gen8 Mobile
  KBL-G/H/S/E3 B0       6-9e-9/2a 000000ca-&gt;000000d6 Core Gen7; Xeon E3 v6
  CFL-H/S/E3   U0       6-9e-a/22 000000ca-&gt;000000d6 Core Gen8 Desktop, Mobile, Xeon E
  CFL-S        B0       6-9e-b/02 000000ca-&gt;000000d6 Core Gen8
  CFL-H/S      P0       6-9e-c/22 000000ca-&gt;000000d6 Core Gen9
  CFL-H        R0       6-9e-d/22 000000ca-&gt;000000d6 Core Gen9 Mobile
- Updated Intel CPU Microcode to 20200520
  Processor             Identifier     Version       Products
  Model        Stepping F-MO-S/PI      Old-&gt;New
  - --- new platforms ----------------------------------------
  - --- updated platforms ------------------------------------
  SNB-E/EN/EP  C1/M0    6-2d-6/6d 0000061f-&gt;00000621 Xeon E3/E5, Core X
  SNB-E/EN/EP  C2/M1    6-2d-7/6d 00000718-&gt;0000071a Xeon E3/E5, Core X</changelog>
  <changelog author="meissner@suse.com" date="1592222400">- Updated Intel CPU Microcode to 20200609 official release (bsc#1172466)
  - no changes to 20200602 prerelease</changelog>
  <changelog author="meissner@suse.com" date="1592395200">- Updated Intel CPU Microcode to 20200616 official release (bsc#1172856)
  - revert 06-4e-03 Skylake U/Y, U23e ucode back to 000000d6 release
  - revert 06-5e-03 Skylake H/S ucode back to 000000d6 release,
    as both cause stability issues.  (bsc#1172856)</changelog>
  <changelog author="meissner@suse.com" date="1604491200">- Updated Intel CPU Microcode to 20201027 prerelease (bsc#1170446)
  - CVE-2020-8695: Fixed Intel RAPL sidechannel attack (SGX)
  [#] New Platforms:
  | Processor      | Stepping | F-M-S/PI    | Old Ver  | New Ver  | Products
  |:---------------|:---------|:------------|:---------|:---------|:---------
  | TGL            | B1       | 06-8c-01/80 |          | 00000068 | Core Gen11 Mobile
  | CPX-SP         | A1       | 06-55-0b/bf |          | 0700001e | Xeon Scalable Gen3
  | CML-H          | R1       | 06-a5-02/20 |          | 000000e0 | Core Gen10 Mobile
  | CML-S62        | G1       | 06-a5-03/22 |          | 000000e0 | Core Gen10
  | CML-S102       | Q0       | 06-a5-05/22 |          | 000000e0 | Core Gen10
  | CML-U62 V2     | K0       | 06-a6-01/80 |          | 000000e0 | Core Gen10 Mobile
  [#] Updated Platforms:
  | Processor      | Stepping | F-M-S/PI    | Old Ver  | New Ver  | Products
  |:---------------|:---------|:------------|:---------|:---------|:---------
  | GKL-R          | R0       | 06-7a-08/01 | 00000016 | 00000018 | Pentium J5040/N5030, Celeron J4125/J4025/N4020/N4120
  | SKL-U/Y        | D0       | 06-4e-03/c0 | 000000d6 | 000000e2 | Core Gen6 Mobile
  | SKL-U23e       | K1       | 06-4e-03/c0 | 000000d6 | 000000e2 | Core Gen6 Mobile
  | APL            | D0       | 06-5c-09/03 | 00000038 | 00000040 | Pentium N/J4xxx, Celeron N/J3xxx, Atom x5/7-E39xx
  | APL            | E0       | 06-5c-0a/03 | 00000016 | 0000001e | Atom x5-E39xx
  | SKL-H/S        | R0/N0    | 06-5e-03/36 | 000000d6 | 000000e2 | Core Gen6; Xeon E3 v5
  | HSX-E/EP       | Cx/M1    | 06-3f-02/6f | 00000043 | 00000044 | Core Gen4 X series; Xeon E5 v3
  | SKX-SP         | B1       | 06-55-03/97 | 01000157 | 01000159 | Xeon Scalable
  | SKX-SP         | H0/M0/U0 | 06-55-04/b7 | 02006906 | 02006a08 | Xeon Scalable
  | SKX-D          | M1       | 06-55-04/b7 | 02006906 | 02006a08 | Xeon D-21xx
  | CLX-SP         | B0       | 06-55-06/bf | 04002f01 | 04003003 | Xeon Scalable Gen2
  | CLX-SP         | B1       | 06-55-07/bf | 05002f01 | 05003003 | Xeon Scalable Gen2
  | ICL-U/Y        | D1       | 06-7e-05/80 | 00000078 | 000000a0 | Core Gen10 Mobile
  | AML-Y22        | H0       | 06-8e-09/10 | 000000d6 | 000000de | Core Gen8 Mobile
  | KBL-U/Y        | H0       | 06-8e-09/c0 | 000000d6 | 000000de | Core Gen7 Mobile
  | CFL-U43e       | D0       | 06-8e-0a/c0 | 000000d6 | 000000e0 | Core Gen8 Mobile
  | WHL-U          | W0       | 06-8e-0b/d0 | 000000d6 | 000000de | Core Gen8 Mobile
  | AML-Y42        | V0       | 06-8e-0c/94 | 000000d6 | 000000de | Core Gen10 Mobile
  | CML-Y42        | V0       | 06-8e-0c/94 | 000000d6 | 000000de | Core Gen10 Mobile
  | WHL-U          | V0       | 06-8e-0c/94 | 000000d6 | 000000de | Core Gen8 Mobile
  | KBL-G/H/S/E3   | B0       | 06-9e-09/2a | 000000d6 | 000000de | Core Gen7; Xeon E3 v6
  | CFL-H/S/E3     | U0       | 06-9e-0a/22 | 000000d6 | 000000de | Core Gen8 Desktop, Mobile, Xeon E
  | CFL-S          | B0       | 06-9e-0b/02 | 000000d6 | 000000de | Core Gen8
  | CFL-H/S        | P0       | 06-9e-0c/22 | 000000d6 | 000000de | Core Gen9
  | CFL-H          | R0       | 06-9e-0d/22 | 000000d6 | 000000de | Core Gen9 Mobile
  | CML-U62        | A0       | 06-a6-00/80 | 000000ca | 000000e0 | Core Gen10 Mobile</changelog>
  <changelog author="meissner@suse.com" date="1605096000">- Updated Intel CPU Microcode to 20201110 official release.
  - CVE-2020-8695: Fixed Intel RAPL sidechannel attack (SGX) (bsc#1170446)
  - CVE-2020-8698: Fixed Fast Store Forward Predictor INTEL-SA-00381 (bsc#1173594)
  - CVE-2020-8696: Vector Register Sampling Active INTEL-SA-00381 (bsc#1173592)
- Releasenotes:
  - Security updates for [INTEL-SA-00381](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00381.html).
  - Security updates for [INTEL-SA-00389](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00389.html).
  - Update for functional issues. Refer to [Second Generation Intel Xeon Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338848) for details.
  - Update for functional issues. Refer to [Intel Xeon Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/613537) for details.
  - Update for functional issues. Refer to [Intel Xeon Processor E5 v3 Product Family Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/xeon-e5-v3-spec-update.html?wapkw=processor+spec+update+e5) for details.
  - Update for functional issues. Refer to [10th Gen Intel Core? Processor Families Specification Update](https://www.intel.com/content/www/us/en/products/docs/processors/core/10th-gen-core-families-specification-update.html) for details.
  - Update for functional issues. Refer to [8th and 9th Gen Intel Core? Processor Family Spec Update](https://www.intel.com/content/www/us/en/products/docs/processors/core/8th-gen-core-spec-update.html) for details.
  - Update for functional issues. Refer to [7th Gen and 8th Gen (U Quad-Core) Intel Processor Families Specification Update](https://www.intel.com/content/www/us/en/processors/core/7th-gen-core-family-spec-update.html) for details.
  - Update for functional issues. Refer to [6th Gen Intel Processor Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/332689) for details.
  - Update for functional issues. Refer to [Intel Xeon E3-1200 v6 Processor Family Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/xeon-e3-1200v6-spec-update.html) for details.
  - Update for functional issues. Refer to [Intel Xeon E-2100 and E-2200 Processor Family Specification Update](https://www.intel.com/content/www/us/en/products/docs/processors/xeon/xeon-e-2100-specification-update.html) for details.
  [#]## New Platforms
  | Processor      | Stepping | F-M-S/PI    | Old Ver  | New Ver  | Products
  |:---------------|:---------|:------------|:---------|:---------|:---------
  | CPX-SP         | A1       | 06-55-0b/bf |          | 0700001e | Xeon Scalable Gen3
  | LKF            | B2/B3    | 06-8a-01/10 |          | 00000028 | Core w/Hybrid Technology
  | TGL            | B1       | 06-8c-01/80 |          | 00000068 | Core Gen11 Mobile
  | CML-H          | R1       | 06-a5-02/20 |          | 000000e0 | Core Gen10 Mobile
  | CML-S62        | G1       | 06-a5-03/22 |          | 000000e0 | Core Gen10
  | CML-S102       | Q0       | 06-a5-05/22 |          | 000000e0 | Core Gen10
  | CML-U62 V2     | K0       | 06-a6-01/80 |          | 000000e0 | Core Gen10 Mobile
  [#]## Updated Platforms
  | Processor      | Stepping | F-M-S/PI    | Old Ver  | New Ver  | Products
  |:---------------|:---------|:------------|:---------|:---------|:---------
  | HSX-E/EP       | Cx/M1    | 06-3f-02/6f | 00000043 | 00000044 | Core Gen4 X series; Xeon E5 v3
  | SKL-U/Y        | D0       | 06-4e-03/c0 | 000000d6 | 000000e2 | Core Gen6 Mobile
  | SKL-U23e       | K1       | 06-4e-03/c0 | 000000d6 | 000000e2 | Core Gen6 Mobile
  | SKX-SP         | B1       | 06-55-03/97 | 01000157 | 01000159 | Xeon Scalable
  | SKX-SP         | H0/M0/U0 | 06-55-04/b7 | 02006906 | 02006a08 | Xeon Scalable
  | SKX-D          | M1       | 06-55-04/b7 | 02006906 | 02006a08 | Xeon D-21xx
  | CLX-SP         | B0       | 06-55-06/bf | 04002f01 | 04003003 | Xeon Scalable Gen2
  | CLX-SP         | B1       | 06-55-07/bf | 05002f01 | 05003003 | Xeon Scalable Gen2
  | APL            | D0       | 06-5c-09/03 | 00000038 | 00000040 | Pentium N/J4xxx, Celeron N/J3xxx, Atom x5/7-E39xx
  | APL            | E0       | 06-5c-0a/03 | 00000016 | 0000001e | Atom x5-E39xx
  | SKL-H/S        | R0/N0    | 06-5e-03/36 | 000000d6 | 000000e2 | Core Gen6; Xeon E3 v5
  | GKL-R          | R0       | 06-7a-08/01 | 00000016 | 00000018 | Pentium J5040/N5030, Celeron J4125/J4025/N4020/N4120
  | ICL-U/Y        | D1       | 06-7e-05/80 | 00000078 | 000000a0 | Core Gen10 Mobile
  | AML-Y22        | H0       | 06-8e-09/10 | 000000d6 | 000000de | Core Gen8 Mobile
  | KBL-U/Y        | H0       | 06-8e-09/c0 | 000000d6 | 000000de | Core Gen7 Mobile
  | CFL-U43e       | D0       | 06-8e-0a/c0 | 000000d6 | 000000e0 | Core Gen8 Mobile
  | WHL-U          | W0       | 06-8e-0b/d0 | 000000d6 | 000000de | Core Gen8 Mobile
  | AML-Y42        | V0       | 06-8e-0c/94 | 000000d6 | 000000de | Core Gen10 Mobile
  | CML-Y42        | V0       | 06-8e-0c/94 | 000000d6 | 000000de | Core Gen10 Mobile
  | WHL-U          | V0       | 06-8e-0c/94 | 000000d6 | 000000de | Core Gen8 Mobile
  | KBL-G/H/S/E3   | B0       | 06-9e-09/2a | 000000d6 | 000000de | Core Gen7; Xeon E3 v6
  | CFL-H/S/E3     | U0       | 06-9e-0a/22 | 000000d6 | 000000de | Core Gen8 Desktop, Mobile, Xeon E
  | CFL-S          | B0       | 06-9e-0b/02 | 000000d6 | 000000de | Core Gen8
  | CFL-H/S        | P0       | 06-9e-0c/22 | 000000d6 | 000000de | Core Gen9
  | CFL-H          | R0       | 06-9e-0d/22 | 000000d6 | 000000de | Core Gen9 Mobile
  | CML-U62        | A0       | 06-a6-00/80 | 000000ca | 000000e0 | Core Gen10 Mobile</changelog>
  <changelog author="meissner@suse.com" date="1605787200">- Updated Intel CPU Microcode to 20201118 official release. (bsc#1178971)
  - Removed TGL/06-8c-01/80 due to functional issues with some OEM platforms.</changelog>
  <changelog author="meissner@suse.com" date="1607342400">- Reverted 3 microcodes back to 20200616 release level after regression reports. (bsc#1179224)
  - SKX-SP         | H0/M0/U0 | 06-55-04/b7 | 02006906 | Xeon Scalable
  - SKX-D          | M1       | 06-55-04/b7 | 02006906 | Xeon D-21xx
  - CLX-SP         | B0       | 06-55-06/bf | 04002f01 | Xeon Scalable Gen2
  - CLX-SP         | B1       | 06-55-07/bf | 05002f01 | Xeon Scalable Gen2</changelog>
  <changelog author="meissner@suse.com" date="1613563200">- Updated Intel CPU Microcode to 20210216 official release. (bsc#1178971 bsc#1179224)
  | Processor      | Stepping | F-M-S/PI    | Old Ver  | New Ver  | Products
  |:---------------|:---------|:------------|:---------|:---------|:---------
  | SKX-SP         | H0/M0/U0 | 06-55-04/b7 | 02006a08 | 02006a0a | Xeon Scalable
  | SKX-D          | M1       | 06-55-04/b7 | 02006a08 | 02006a0a | Xeon D-21xx
  | CLX-SP         | B0       | 06-55-06/bf | 04003003 | 04003006 | Xeon Scalable Gen2
  | CLX-SP         | B1       | 06-55-07/bf | 05003003 | 05003006 | Xeon Scalable Gen2</changelog>
  <changelog author="meissner@suse.com" date="1623153600">- Updated to Intel CPU Microcode 20210525 release.
  - CVE-2020-24513: A domain bypass transient execution vulnerability was discovered on some Intel Atom processors that use a micro-architectural incident channel. (INTEL-SA-00465 bsc#1179833)
    See also: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00465.html
  - CVE-2020-24511: The IBRS feature to mitigate Spectre variant 2 transient execution side channel vulnerabilities may not fully prevent non-root (guest) branches from controlling the branch predictions of the root (host) (INTEL-SA-00464 bsc#1179836)
    See also https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00464.html)
  - CVE-2020-24512: Fixed trivial data value cache-lines such as all-zero value cache-lines may lead to changes in cache-allocation or write-back behavior for such cache-lines (bsc#1179837 INTEL-SA-00464)
    See also https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00464.html)
  - CVE-2020-24489: Fixed Intel VT-d device pass through potential local privilege escalation (INTEL-SA-00442 bsc#1179839)
    See also https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00442.html
- Update for functional issues. Refer to [Third Generation Intel Xeon Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/637780)for details.
- Update for functional issues. Refer to [Second Generation Intel Xeon Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338848) for details.
- Update for functional issues. Refer to [Intel Xeon Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/613537) for details.
- Update for functional issues. Refer to [Intel Xeon Processor D-1500, D-1500 NS and D-1600 NS Spec Update](https://www.intel.com/content/www/us/en/products/docs/processors/xeon/xeon-d-1500-specification-update.html) for details.
- Update for functional issues. Refer to [Intel Xeon E7-8800 and E7-4800 v3 Processor Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/xeon-e7-v3-spec-update.html) for details.
- Update for functional issues. Refer to [Intel Xeon Processor E5 v3 Product Family Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/xeon-e5-v3-spec-update.html?wapkw=processor+spec+update+e5) for details.
- Update for functional issues. Refer to [10th Gen Intel Core Processor Families Specification Update](https://www.intel.com/content/www/us/en/products/docs/processors/core/10th-gen-core-families-specification-update.html) for details.
- Update for functional issues. Refer to [8th and 9th Gen Intel Core Processor Family Spec Update](https://www.intel.com/content/www/us/en/products/docs/processors/core/8th-gen-core-spec-update.html) for details.
- Update for functional issues. Refer to [7th Gen and 8th Gen (U Quad-Core) Intel Processor Families Specification Update](https://www.intel.com/content/www/us/en/processors/core/7th-gen-core-family-spec-update.html) for details.
- Update for functional issues. Refer to [6th Gen Intel Processor Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/332689) for details.
- Update for functional issues. Refer to [Intel Xeon E3-1200 v6 Processor Family Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/xeon-e3-1200v6-spec-update.html) for details.
- Update for functional issues. Refer to [Intel Xeon E-2100 and E-2200 Processor Family Specification Update](https://www.intel.com/content/www/us/en/products/docs/processors/xeon/xeon-e-2100-specification-update.html) for details.
- New platforms:
  | Processor      | Stepping | F-M-S/PI    | Old Ver  | New Ver  | Products
  |:---------------|:---------|:------------|:---------|:---------|:---------
  | CLX-SP         | A0       | 06-55-05/b7 |          | 03000010 | Xeon Scalable Gen2
  | ICX-SP         | C0       | 06-6a-05/87 |          | 0c0002f0 | Xeon Scalable Gen3
  | ICX-SP         | D0       | 06-6a-06/87 |          | 0d0002a0 | Xeon Scalable Gen3
  | SNR            | B0       | 06-86-04/01 |          | 0b00000f | Atom P59xxB
  | SNR            | B1       | 06-86-05/01 |          | 0b00000f | Atom P59xxB
  | TGL            | B1       | 06-8c-01/80 |          | 00000088 | Core Gen11 Mobile
  | TGL-R          | C0       | 06-8c-02/c2 |          | 00000016 | Core Gen11 Mobile
  | TGL-H          | R0       | 06-8d-01/c2 |          | 0000002c | Core Gen11 Mobile
  | EHL            | B1       | 06-96-01/01 |          | 00000011 | Pentium J6426/N6415, Celeron J6412/J6413/N6210/N6211, Atom x6000E
  | JSL            | A0/A1    | 06-9c-00/01 |          | 0000001d | Pentium N6000/N6005, Celeron N4500/N4505/N5100/N5105
  | RKL-S          | B0       | 06-a7-01/02 |          | 00000040 | Core Gen11
- Updated platforms:
  | Processor      | Stepping | F-M-S/PI    | Old Ver  | New Ver  | Products
  |:---------------|:---------|:------------|:---------|:---------|:---------
  | HSX-E/EP       | Cx/M1    | 06-3f-02/6f | 00000044 | 00000046 | Core Gen4 X series; Xeon E5 v3
  | HSX-EX         | E0       | 06-3f-04/80 | 00000016 | 00000019 | Xeon E7 v3
  | SKL-U/Y        | D0       | 06-4e-03/c0 | 000000e2 | 000000ea | Core Gen6 Mobile
  | SKL-U23e       | K1       | 06-4e-03/c0 | 000000e2 | 000000ea | Core Gen6 Mobile
  | BDX-ML         | B0/M0/R0 | 06-4f-01/ef | 0b000038 | 0b00003e | Xeon E5/E7 v4; Core i7-69xx/68xx
  | SKX-SP         | B1       | 06-55-03/97 | 01000159 | 0100015b | Xeon Scalable
  | SKX-SP         | H0/M0/U0 | 06-55-04/b7 | 02006a0a | 02006b06 | Xeon Scalable
  | SKX-D          | M1       | 06-55-04/b7 | 02006a0a | 02006b06 | Xeon D-21xx
  | CLX-SP         | B0       | 06-55-06/bf | 04003006 | 04003102 | Xeon Scalable Gen2
  | CLX-SP         | B1       | 06-55-07/bf | 05003006 | 05003102 | Xeon Scalable Gen2
  | CPX-SP         | A1       | 06-55-0b/bf | 0700001e | 07002302 | Xeon Scalable Gen3
  | BDX-DE         | V2/V3    | 06-56-03/10 | 07000019 | 0700001b | Xeon D-1518/19/21/27/28/31/33/37/41/48, Pentium D1507/08/09/17/19
  | BDX-DE         | Y0       | 06-56-04/10 | 0f000017 | 0f000019 | Xeon D-1557/59/67/71/77/81/87
  | BDX-NS         | A0       | 06-56-05/10 | 0e00000f | 0e000012 | Xeon D-1513N/23/33/43/53
  | APL            | D0       | 06-5c-09/03 | 00000040 | 00000044 | Pentium N/J4xxx, Celeron N/J3xxx, Atom x5/7-E39xx
  | APL            | E0       | 06-5c-0a/03 | 0000001e | 00000020 | Atom x5-E39xx
  | SKL-H/S        | R0/N0    | 06-5e-03/36 | 000000e2 | 000000ea | Core Gen6; Xeon E3 v5
  | DNV            | B0       | 06-5f-01/01 | 0000002e | 00000034 | Atom C Series
  | GLK            | B0       | 06-7a-01/01 | 00000034 | 00000036 | Pentium Silver N/J5xxx, Celeron N/J4xxx
  | GKL-R          | R0       | 06-7a-08/01 | 00000018 | 0000001a | Pentium J5040/N5030, Celeron J4125/J4025/N4020/N4120
  | ICL-U/Y        | D1       | 06-7e-05/80 | 000000a0 | 000000a6 | Core Gen10 Mobile
  | LKF            | B2/B3    | 06-8a-01/10 | 00000028 | 0000002a | Core w/Hybrid Technology
  | AML-Y22        | H0       | 06-8e-09/10 | 000000de | 000000ea | Core Gen8 Mobile
  | KBL-U/Y        | H0       | 06-8e-09/c0 | 000000de | 000000ea | Core Gen7 Mobile
  | CFL-U43e       | D0       | 06-8e-0a/c0 | 000000e0 | 000000ea | Core Gen8 Mobile
  | WHL-U          | W0       | 06-8e-0b/d0 | 000000de | 000000ea | Core Gen8 Mobile
  | AML-Y42        | V0       | 06-8e-0c/94 | 000000de | 000000ea | Core Gen10 Mobile
  | CML-Y42        | V0       | 06-8e-0c/94 | 000000de | 000000ea | Core Gen10 Mobile
  | WHL-U          | V0       | 06-8e-0c/94 | 000000de | 000000ea | Core Gen8 Mobile
  | KBL-G/H/S/E3   | B0       | 06-9e-09/2a | 000000de | 000000ea | Core Gen7; Xeon E3 v6
  | CFL-H/S/E3     | U0       | 06-9e-0a/22 | 000000de | 000000ea | Core Gen8 Desktop, Mobile, Xeon E
  | CFL-S          | B0       | 06-9e-0b/02 | 000000de | 000000ea | Core Gen8
  | CFL-H/S        | P0       | 06-9e-0c/22 | 000000de | 000000ea | Core Gen9
  | CFL-H          | R0       | 06-9e-0d/22 | 000000de | 000000ea | Core Gen9 Mobile
  | CML-H          | R1       | 06-a5-02/20 | 000000e0 | 000000ea | Core Gen10 Mobile
  | CML-S62        | G1       | 06-a5-03/22 | 000000e0 | 000000ea | Core Gen10
  | CML-S102       | Q0       | 06-a5-05/22 | 000000e0 | 000000ec | Core Gen10
  | CML-U62        | A0       | 06-a6-00/80 | 000000e0 | 000000e8 | Core Gen10 Mobile
  | CML-U62 V2     | K0       | 06-a6-01/80 | 000000e0 | 000000ea | Core Gen10 Mobile</changelog>
  <changelog author="meissner@suse.com" date="1644494400">- Updated to Intel CPU Microcode 20220207 release.
  - CVE-2021-0146: Fixed a potential security vulnerability in some Intel Processors may allow escalation of privilege (bsc#1192615)
  - CVE-2021-0127: Intel Processor Breakpoint Control Flow (bsc#1195779)
  - CVE-2021-0145: Fast store forward predictor - Cross Domain Training (bsc#1195780)
  - CVE-2021-33120: Out of bounds read for some Intel Atom processors (bsc#1195781)
  - Security updates for [INTEL-SA-00528](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00528.html)
  - Security updates for [INTEL-SA-00532](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00532.html)
  - Update for functional issues. Refer to [Third Generation Intel Xeon Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/637780) for details.
  - Update for functional issues. Refer to [Second Generation Intel Xeon Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338848) for details.
  - Update for functional issues. Refer to [Intel Xeon Processor Scalable Family Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/scalable/xeon-scalable-spec-update.html?wapkw=processor+specification+update) for details.
  - Update for functional issues. Refer to [11th Generation Intel Core" Processor Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/631123) for details.
  - Update for functional issues. Refer to [11th Generation Intel Core" Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/634808) for details.
  - Update for functional issues. Refer to [10th Gen Intel Core" Processor Families Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/341079) for details.
  - Update for functional issues. Refer to [10th Generation Intel Core" Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/615213) for details.
  - Update for functional issues. Refer to [8th Generation Intel Core" Processor Families Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338025) for details.
  - Update for functional issues. Refer to [8th Gen Intel Core" Processor Family Spec Update](https://www.intel.com/content/www/us/en/products/docs/processors/core/8th-gen-core-family-spec-update.html?wapkw=processor+specification+update) for details.
  - Update for functional issues. Refer to [7th and 8th Generation Intel Core" Processor Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/334663) for details.
  - Update for functional issues. Refer to [6th Generation Intel Processor Family Specification Update](https://www.intel.com/content/www/us/en/processors/core/desktop-6th-gen-core-family-spec-update.html) for details.
  - Update for functional issues. Refer to [Intel Pentium Silver and Intel Celeron Processors](https://www.intel.com/content/www/us/en/products/docs/processors/pentium/silver-celeron-spec-update.html?wapkw=processor+specification+update) for details.</changelog>
</package>
<package pkgid="e7729712af48380d6863ef1f9212af503edd777fb1143bb431cfc2a406c48a30" name="ucode-intel" arch="x86_64">
  <version epoch="0" ver="20220207" rel="10.1"/>
  <changelog author="meissner@suse.com" date="1552564800">- Update to 20190312 release (bsc#1129231)
  - Processor             Identifier     Version       Products
  - Model        Stepping F-MO-S/PI      Old-&gt;New
  - ---- new platforms ----------------------------------------
  - AML-Y22      H0       6-8e-9/10           0000009e Core Gen8 Mobile
  - WHL-U        W0       6-8e-b/d0           000000a4 Core Gen8 Mobile
  - WHL-U        V0       6-8e-d/94           000000b2 Core Gen8 Mobile
  - CFL-S        P0       6-9e-c/22           000000a2 Core Gen9 Desktop
  - CFL-H        R0       6-9e-d/22           000000b0 Core Gen9 Mobile
  - ---- updated platforms ------------------------------------
  - HSX-E/EP     Cx/M1    6-3f-2/6f 0000003d-&gt;00000041 Core Gen4 X series; Xeon E5 v3
  - HSX-EX       E0       6-3f-4/80 00000012-&gt;00000013 Xeon E7 v3
  - SKX-SP       H0/M0/U0 6-55-4/b7 0200004d-&gt;0000005a Xeon Scalable
  - SKX-D        M1       6-55-4/b7 0200004d-&gt;0000005a Xeon D-21xx
  - BDX-DE       V1       6-56-2/10 00000017-&gt;00000019 Xeon D-1520/40
  - BDX-DE       V2/3     6-56-3/10 07000013-&gt;07000016 Xeon D-1518/19/21/27/28/31/33/37/41/48, Pentium D1507/08/09/17/19
  - BDX-DE       Y0       6-56-4/10 0f000012-&gt;0f000014 Xeon D-1557/59/67/71/77/81/87
  - BDX-NS       A0       6-56-5/10 0e00000a-&gt;0e00000c Xeon D-1513N/23/33/43/53
  - APL          D0       6-5c-9/03 00000032-&gt;00000036 Pentium N/J4xxx, Celeron N/J3xxx, Atom x5/7-E39xx
  - APL          E0       6-5c-a/03 0000000c-&gt;00000010 Atom x5/7-E39xx
  - GLK          B0       6-7a-1/01 00000028-&gt;0000002c Pentium Silver N/J5xxx, Celeron N/J4xxx
  - KBL-U/Y      H0       6-8e-9/c0 0000008e-&gt;0000009a Core Gen7 Mobile
  - CFL-U43e     D0       6-8e-a/c0 00000096-&gt;0000009e Core Gen8 Mobile
  - KBL-H/S/E3   B0       6-9e-9/2a 0000008e-&gt;0000009a Core Gen7; Xeon E3 v6
  - CFL-H/S/E3   U0       6-9e-a/22 00000096-&gt;000000aa Core Gen8 Desktop, Mobile, Xeon E
  - CFL-S B0 6-9e-b/02 0000008e-&gt;000000aa Core Gen8</changelog>
  <changelog author="meissner@suse.com" date="1557230400">- Intel QSR 2019.1 Microcode release (bsc#1111331 CVE-2018-12126
  CVE-2018-12130 CVE-2018-12127 CVE-2019-11091)
  - Processor             Identifier     Version       Products
  - Model        Stepping F-MO-S/PI      Old-&gt;New
  - ---- new platforms ----------------------------------------
  - CLX-SP       B1       6-55-7/bf           05000021 Xeon Scalable Gen2
  - ---- updated platforms ------------------------------------
  - SNB          D2/G1/Q0 6-2a-7/12 0000002e-&gt;0000002f Core Gen2
  - IVB          E1/L1    6-3a-9/12 00000020-&gt;00000021 Core Gen3
  - HSW          C0       6-3c-3/32 00000025-&gt;00000027 Core Gen4
  - BDW-U/Y      E0/F0    6-3d-4/c0 0000002b-&gt;0000002d Core Gen5
  - IVB-E/EP     C1/M1/S1 6-3e-4/ed 0000042e-&gt;0000042f Core Gen3 X Series; Xeon E5 v2
  - IVB-EX       D1       6-3e-7/ed 00000714-&gt;00000715 Xeon E7 v2
  - HSX-E/EP     Cx/M1    6-3f-2/6f 00000041-&gt;00000043 Core Gen4 X series; Xeon E5 v3
  - HSX-EX       E0       6-3f-4/80 00000013-&gt;00000014 Xeon E7 v3
  - HSW-U        C0/D0    6-45-1/72 00000024-&gt;00000025 Core Gen4
  - HSW-H        C0       6-46-1/32 0000001a-&gt;0000001b Core Gen4
  - BDW-H/E3     E0/G0    6-47-1/22 0000001e-&gt;00000020 Core Gen5
  - SKL-U/Y      D0/K1    6-4e-3/c0 000000c6-&gt;000000cc Core Gen6
  - SKX-SP       H0/M0/U0 6-55-4/b7 0200005a-&gt;0000005e Xeon Scalable
  - SKX-D        M1       6-55-4/b7 0200005a-&gt;0000005e Xeon D-21xx
  - BDX-DE       V1       6-56-2/10 00000019-&gt;0000001a Xeon D-1520/40
  - BDX-DE       V2/3     6-56-3/10 07000016-&gt;07000017 Xeon D-1518/19/21/27/28/31/33/37/41/48, Pentium D1507/08/09/17/19
  - BDX-DE       Y0       6-56-4/10 0f000014-&gt;0f000015 Xeon D-1557/59/67/71/77/81/87
  - BDX-NS       A0       6-56-5/10 0e00000c-&gt;0e00000d Xeon D-1513N/23/33/43/53
  - APL          D0       6-5c-9/03 00000036-&gt;00000038 Pentium N/J4xxx, Celeron N/J3xxx, Atom x5/7-E39xx
  - SKL-H/S      R0/N0    6-5e-3/36 000000c6-&gt;000000cc Core Gen6; Xeon E3 v5
  - DNV          B0       6-5f-1/01 00000024-&gt;0000002e Atom Processor C Series
  - GLK          B0       6-7a-1/01 0000002c-&gt;0000002e Pentium Silver N/J5xxx, Celeron N/J4xxx
  - AML-Y22      H0       6-8e-9/10 0000009e-&gt;000000b4 Core Gen8 Mobile
  - KBL-U/Y      H0       6-8e-9/c0 0000009a-&gt;000000b4 Core Gen7 Mobile
  - CFL-U43e     D0       6-8e-a/c0 0000009e-&gt;000000b4 Core Gen8 Mobile
  - WHL-U        W0       6-8e-b/d0 000000a4-&gt;000000b8 Core Gen8 Mobile
  - WHL-U        V0       6-8e-d/94 000000b2-&gt;000000b8 Core Gen8 Mobile
  - KBL-G/H/S/E3 B0       6-9e-9/2a 0000009a-&gt;000000b4 Core Gen7; Xeon E3 v6
  - CFL-H/S/E3   U0       6-9e-a/22 000000aa-&gt;000000b4 Core Gen8 Desktop, Mobile, Xeon E
  - CFL-S        B0       6-9e-b/02 000000aa-&gt;000000b4 Core Gen8
  - CFL-H/S      P0       6-9e-c/22 000000a2-&gt;000000ae Core Gen9
  - CFL-H        R0       6-9e-d/22 000000b0-&gt;000000b8 Core Gen9 Mobile</changelog>
  <changelog author="meissner@suse.com" date="1557921600">- updated to official QSR 2019. Microcode release (bsc#1111331
  CVE-2018-12126 CVE-2018-12130 CVE-2018-12127 CVE-2019-11091)
  - --- new platforms ----------------------------------------
  VLV          C0       6-37-8/02           00000838 Atom Z series
  VLV          C0       6-37-8/0C           00000838 Celeron N2xxx, Pentium N35xx
  VLV          D0       6-37-9/0F           0000090c Atom E38xx
  CHV          C0       6-4c-3/01           00000368 Atom X series
  CHV          D0       6-4c-4/01           00000411 Atom X series
  Readded what missing in last update:
  BDX-ML       B0/M0/R0 6-4f-1/ef 0b00002e-&gt;00000036 Xeon E5/E7 v4; Core i7-69xx/68xx</changelog>
  <changelog author="meissner@suse.com" date="1563364800">- Updated to 20190618 release (bsc#1111331 CVE-2018-12126 CVE-2018-12130 CVE-2018-12127 CVE-2019-11091)
  - --- updated platforms ------------------------------------
  SNB-E/EN/EP  C1/M0    6-2d-6/6d 0000061d-&gt;0000061f Xeon E3/E5, Core X
  SNB-E/EN/EP  C2/M1    6-2d-7/6d 00000714-&gt;00000718 Xeon E3/E5, Core X</changelog>
  <changelog author="meissner@suse.com" date="1568894400">- Updated to 20190918 bugfix release (bsc#1151232 bsc#1138185)
  Processor             Identifier     Version       Products
  Model        Stepping F-MO-S/PI      Old-&gt;New
  - --- updated platforms ------------------------------------
  BDW-U/Y      E0/F0    6-3d-4/c0 0000002d-&gt;0000002e Core Gen5
  HSX-EX       E0       6-3f-4/80 00000014-&gt;00000016 Xeon E7 v3
  BDW-H/E3     E0/G0    6-47-1/22 00000020-&gt;00000021 Core Gen5
  BDX-ML       B0/M0/R0 6-4f-1/ef 0b000036-&gt;0b000038 Xeon E5/E7 v4; Core i7-69xx/68xx
  BDX-DE       V1       6-56-2/10 0000001a-&gt;0000001c Xeon D-1520/40
  BDX-DE       V2/3     6-56-3/10 07000017-&gt;07000019 Xeon D-1518/19/21/27/28/31/33/37/41/48, Pentium D1507/08/09/17/19
  BDX-DE       Y0       6-56-4/10 0f000015-&gt;0f000017 Xeon D-1557/59/67/71/77/81/87
  BDX-NS       A0       6-56-5/10 0e00000d-&gt;0e00000f Xeon D-1513N/23/33/43/53
  SKX-SP       H0/M0/U0 6-55-4/b7 0200005e-&gt;00000064 Xeon Scalable
  SKX-D        M1       6-55-4/b7 0200005e-&gt;00000064 Xeon D-21xx
  CLX-SP       B1       6-55-7/bf 05000021-&gt;0500002b Xeon Scalable Gen2</changelog>
  <changelog author="meissner@suse.com" date="1573041600">- Updated to 20191112 security release (bsc#1155988)
  - Processor             Identifier     Version       Products
  - Model        Stepping F-MO-S/PI      Old-&gt;New
  - ---- new platforms ----------------------------------------
  - CML-U62      A0       6-a6-0/80           000000c6 Core Gen10 Mobile
  - CNL-U        D0       6-66-3/80           0000002a Core Gen8 Mobile
  - SKX-SP       B1       6-55-3/97           01000150 Xeon Scalable
  - ICL U/Y      D1       6-7e-5/80           00000046 Core Gen10 Mobile
  - ---- updated platforms ------------------------------------
  - SKL U/Y      D0       6-4e-3/c0 000000cc-&gt;000000d4 Core Gen6 Mobile
  - SKL H/S/E3   R0/N0    6-5e-3/36 000000cc-&gt;000000d4 Core Gen6
  - AML-Y22      H0       6-8e-9/10 000000b4-&gt;000000c6 Core Gen8 Mobile
  - KBL-U/Y      H0       6-8e-9/c0 000000b4-&gt;000000c6 Core Gen7 Mobile
  - CFL-U43e     D0       6-8e-a/c0 000000b4-&gt;000000c6 Core Gen8 Mobile
  - WHL-U        W0       6-8e-b/d0 000000b8-&gt;000000c6 Core Gen8 Mobile
  - AML-Y        V0       6-8e-c/94 000000b8-&gt;000000c6 Core Gen10 Mobile
  - CML-U42      V0       6-8e-c/94 000000b8-&gt;000000c6 Core Gen10 Mobile
  - WHL-U        V0       6-8e-c/94 000000b8-&gt;000000c6 Core Gen8 Mobile
  - KBL-G/X      H0       6-9e-9/2a 000000b4-&gt;000000c6 Core Gen7/Gen8
  - KBL-H/S/E3   B0       6-9e-9/2a 000000b4-&gt;000000c6 Core Gen7; Xeon E3 v6
  - CFL-H/S/E3   U0       6-9e-a/22 000000b4-&gt;000000c6 Core Gen8 Desktop, Mobile, Xeon E
  - CFL-S        B0       6-9e-b/02 000000b4-&gt;000000c6 Core Gen8
  - CFL-H        R0       6-9e-d/22 000000b8-&gt;000000c6 Core Gen9 Mobile
- Includes security fixes for:
  - CVE-2019-11135: Added feature allowing to disable TSX RTM (bsc#1139073)
  - CVE-2019-11139: A CPU microcode only fix for Voltage modulation issues (bsc#1141035)</changelog>
  <changelog author="meissner@suse.com" date="1573646400">- Updated to 20191112 official security release (bsc#1155988)
  - Processor             Identifier     Version       Products
  - Model        Stepping F-MO-S/PI      Old-&gt;New
  - ---- new platforms ----------------------------------------
  - AVN          B0/C0    6-4d-8/01           0000012d Atom C2xxx
  - CNL-U        D0       6-66-3/80           0000002a Core Gen8 Mobile
  - SKX-SP       B1       6-55-3/97           01000151 Xeon Scalable
  - CLX-SP       B0       6-55-6/bf           0400002c Xeon Scalable Gen2
  - GLK-R        R0       6-7a-8/01           00000016 Pentium J5040/N5030, Celeron J4125/J4025/N4020/N4120
  - ICL-U/Y      D1       6-7e-5/80           00000046 Core Gen10 Mobile
  - CML-U62      A0       6-a6-0/80           000000c6 Core Gen10 Mobile
  - ---- updated platforms ------------------------------------
  - SKL-U/Y      D0       6-4e-3/c0 000000cc-&gt;000000d4 Core Gen6 Mobile
  - SKX-SP       H0/M0/U0 6-55-4/b7 02000064-&gt;02000065 Xeon Scalable
  - SKX-D        M1       6-55-4/b7 02000064-&gt;02000065 Xeon D-21xx
  - CLX-SP       B1       6-55-7/bf 0500002b-&gt;0500002c Xeon Scalable Gen2
  - SKL-H/S/E3   R0/N0    6-5e-3/36 000000cc-&gt;000000d4 Core Gen6
  - GLK          B0       6-7a-1/01 0000002e-&gt;00000032 Pentium J5005/N5000, Celeron J4005/J4105/N4000/N4100
  - AML-Y22      H0       6-8e-9/10 000000b4-&gt;000000c6 Core Gen8 Mobile
  - KBL-U/Y      H0       6-8e-9/c0 000000b4-&gt;000000c6 Core Gen7 Mobile
  - CFL-U43e     D0       6-8e-a/c0 000000b4-&gt;000000c6 Core Gen8 Mobile
  - WHL-U        W0       6-8e-b/d0 000000b8-&gt;000000c6 Core Gen8 Mobile
  - AML-Y        V0       6-8e-c/94 000000b8-&gt;000000c6 Core Gen10 Mobile
  - CML-U42      V0       6-8e-c/94 000000b8-&gt;000000c6 Core Gen10 Mobile
  - WHL-U        V0       6-8e-c/94 000000b8-&gt;000000c6 Core Gen8 Mobile
  - KBL-G/X      H0       6-9e-9/2a 000000b4-&gt;000000c6 Core Gen7/Gen8
  - KBL-H/S/E3   B0       6-9e-9/2a 000000b4-&gt;000000c6 Core Gen7; Xeon E3 v6
  - CFL-H/S/E3   U0       6-9e-a/22 000000b4-&gt;000000c6 Core Gen8 Desktop, Mobile, Xeon E
  - CFL-S        B0       6-9e-b/02 000000b4-&gt;000000c6 Core Gen8
  - CFL-H        R0       6-9e-d/22 000000b8-&gt;000000c6 Core Gen9 Mobile
  - ---- removed platforms ------------------------------------
  - CFL-H/S      P0       6-9e-c/22 000000a2           Core Gen9
- Includes security fixes for:
  - CVE-2019-11135: Added feature allowing to disable TSX RTM (bsc#1139073)
  - CVE-2019-11139: A CPU microcode only fix for Voltage modulation issues (bsc#1141035)</changelog>
  <changelog author="meissner@suse.com" date="1574164800">- Updated to 20191115 release (bsc#1157004)
  - Processor             Identifier     Version       Products
  - Model        Stepping F-MO-S/PI      Old-&gt;New
  - ---- updated platforms ------------------------------------
  - SKL-U/Y      D0       6-4e-3/c0 000000d4-&gt;000000d6 Core Gen6 Mobile
  - SKL-U23e     K1       6-4e-3/c0 000000d4-&gt;000000d6 Core Gen6 Mobile
  - SKL-H/S/E3   N0/R0/S0 6-5e-3/36 000000d4-&gt;000000d6 Core Gen6
  - AML-Y22      H0       6-8e-9/10 000000c6-&gt;000000ca Core Gen8 Mobile
  - KBL-U/Y      H0       6-8e-9/c0 000000c6-&gt;000000ca Core Gen7 Mobile
  - KBL-U23e     J1       6-8e-9/c0 000000c6-&gt;000000ca Core Gen7 Mobile
  - CFL-U43e     D0       6-8e-a/c0 000000c6-&gt;000000ca Core Gen8 Mobile
  - KBL-R U      Y0       6-8e-a/c0 000000c6-&gt;000000ca Core Gen8 Mobile
  - WHL-U        W0       6-8e-b/d0 000000c6-&gt;000000ca Core Gen8 Mobile
  - AML-Y42      V0       6-8e-c/94 000000c6-&gt;000000ca Core Gen10 Mobile
  - WHL-U        V0       6-8e-c/94 000000c6-&gt;000000ca Core Gen8 Mobile
  - CML-U42      V0       6-8e-c/94 000000c6-&gt;000000ca Core Gen10 Mobile
  - KBL-G/H/S/X/E3 B0     6-9e-9/2a 000000c6-&gt;000000ca Core Gen7 Desktop, Mobile, Xeon E3 v6
  - CFL-H/S/E3   U0       6-9e-a/22 000000c6-&gt;000000ca Core Gen8 Desktop, Mobile, Xeon E
  - CFL-S        B0       6-9e-b/02 000000c6-&gt;000000ca Core Gen8
  - CFL-S        P0       6-9e-c/22 000000c6-&gt;000000ca Core Gen9 Desktop
  - CFL-H/S/E3   R0       6-9e-d/22 000000c6-&gt;000000ca Core Gen9 Desktop, Mobile, Xeon E
  - CML-U62      A0       6-a6-0/80 000000c6-&gt;000000ca Core Gen10 Mobile
- Updated to 20191113 release
  - Processor             Identifier     Version       Products
  - Model        Stepping F-MO-S/PI      Old-&gt;New
  - ---- updated platforms ------------------------------------
  - CFL-S        P0       6-9e-c/22 000000a2-&gt;000000c6 Core Gen9 Desktop</changelog>
  <changelog author="meissner@suse.com" date="1579089600">- reverted the entry below to 02000064 due to occasional faults (bsc#1160478)
  - SKX-SP       H0/M0/U0 6-55-4/b7 02000064-&gt;02000065 Xeon Scalable</changelog>
  <changelog author="meissner@suse.com" date="1587470400">- updated skylake microcode to the current version. (bsc#1169570)
  - 02000064-&gt;02006901</changelog>
  <changelog author="meissner@suse.com" date="1591185600">- Updated Intel CPU Microcode to 20200602 (prerelease) (bsc#1172466)
  Fixes for:
  - CVE-2020-0543: Fixed a side channel attack against special registers
    which could have resulted in leaking of read values to cores other
    than the one which called it.  This attack is known as Special Register
    Buffer Data Sampling (SRBDS) or "CrossTalk" (bsc#1154824).
  - CVE-2020-0548,CVE-2020-0549: Additional ucode updates were supplied to
    mitigate the Vector Register and L1D Eviction Sampling aka "CacheOutAttack"
    attacks. (bsc#1156353)
  == 20200602_DEMO Release ==
  - - Updates upon 20200520 release --
  Processor             Identifier     Version       Products
  Model        Stepping F-MO-S/PI      Old-&gt;New
  - --- new platforms ----------------------------------------
  - --- updated platforms ------------------------------------
  HSW          C0       6-3c-3/32 00000027-&gt;00000028 Core Gen4
  BDW-U/Y      E0/F0    6-3d-4/c0 0000002e-&gt;0000002f Core Gen5
  HSW-U        C0/D0    6-45-1/72 00000025-&gt;00000026 Core Gen4
  HSW-H        C0       6-46-1/32 0000001b-&gt;0000001c Core Gen4
  BDW-H/E3     E0/G0    6-47-1/22 00000021-&gt;00000022 Core Gen5
  SKL-U/Y      D0       6-4e-3/c0 000000d6-&gt;000000dc Core Gen6 Mobile
  SKL-U23e     K1       6-4e-3/c0 000000d6-&gt;000000dc Core Gen6 Mobile
  SKX-SP       B1       6-55-3/97 01000151-&gt;01000157 Xeon Scalable
  SKX-SP       H0/M0/U0 6-55-4/b7 02000065-&gt;02006906 Xeon Scalable
  SKX-D        M1       6-55-4/b7 02000065-&gt;02006906 Xeon D-21xx
  CLX-SP       B0       6-55-6/bf 0400002c-&gt;04002f01 Xeon Scalable Gen2
  CLX-SP       B1       6-55-7/bf 0500002c-&gt;04002f01 Xeon Scalable Gen2
  SKL-H/S      R0/N0    6-5e-3/36 000000d6-&gt;000000dc Core Gen6; Xeon E3 v5
  AML-Y22      H0       6-8e-9/10 000000ca-&gt;000000d6 Core Gen8 Mobile
  KBL-U/Y      H0       6-8e-9/c0 000000ca-&gt;000000d6 Core Gen7 Mobile
  CFL-U43e     D0       6-8e-a/c0 000000ca-&gt;000000d6 Core Gen8 Mobile
  WHL-U        W0       6-8e-b/d0 000000ca-&gt;000000d6 Core Gen8 Mobile
  AML-Y42      V0       6-8e-c/94 000000ca-&gt;000000d6 Core Gen10 Mobile
  CML-Y42      V0       6-8e-c/94 000000ca-&gt;000000d6 Core Gen10 Mobile
  WHL-U        V0       6-8e-c/94 000000ca-&gt;000000d6 Core Gen8 Mobile
  KBL-G/H/S/E3 B0       6-9e-9/2a 000000ca-&gt;000000d6 Core Gen7; Xeon E3 v6
  CFL-H/S/E3   U0       6-9e-a/22 000000ca-&gt;000000d6 Core Gen8 Desktop, Mobile, Xeon E
  CFL-S        B0       6-9e-b/02 000000ca-&gt;000000d6 Core Gen8
  CFL-H/S      P0       6-9e-c/22 000000ca-&gt;000000d6 Core Gen9
  CFL-H        R0       6-9e-d/22 000000ca-&gt;000000d6 Core Gen9 Mobile
- Updated Intel CPU Microcode to 20200520
  Processor             Identifier     Version       Products
  Model        Stepping F-MO-S/PI      Old-&gt;New
  - --- new platforms ----------------------------------------
  - --- updated platforms ------------------------------------
  SNB-E/EN/EP  C1/M0    6-2d-6/6d 0000061f-&gt;00000621 Xeon E3/E5, Core X
  SNB-E/EN/EP  C2/M1    6-2d-7/6d 00000718-&gt;0000071a Xeon E3/E5, Core X</changelog>
  <changelog author="meissner@suse.com" date="1592222400">- Updated Intel CPU Microcode to 20200609 official release (bsc#1172466)
  - no changes to 20200602 prerelease</changelog>
  <changelog author="meissner@suse.com" date="1592395200">- Updated Intel CPU Microcode to 20200616 official release (bsc#1172856)
  - revert 06-4e-03 Skylake U/Y, U23e ucode back to 000000d6 release
  - revert 06-5e-03 Skylake H/S ucode back to 000000d6 release,
    as both cause stability issues.  (bsc#1172856)</changelog>
  <changelog author="meissner@suse.com" date="1604491200">- Updated Intel CPU Microcode to 20201027 prerelease (bsc#1170446)
  - CVE-2020-8695: Fixed Intel RAPL sidechannel attack (SGX)
  [#] New Platforms:
  | Processor      | Stepping | F-M-S/PI    | Old Ver  | New Ver  | Products
  |:---------------|:---------|:------------|:---------|:---------|:---------
  | TGL            | B1       | 06-8c-01/80 |          | 00000068 | Core Gen11 Mobile
  | CPX-SP         | A1       | 06-55-0b/bf |          | 0700001e | Xeon Scalable Gen3
  | CML-H          | R1       | 06-a5-02/20 |          | 000000e0 | Core Gen10 Mobile
  | CML-S62        | G1       | 06-a5-03/22 |          | 000000e0 | Core Gen10
  | CML-S102       | Q0       | 06-a5-05/22 |          | 000000e0 | Core Gen10
  | CML-U62 V2     | K0       | 06-a6-01/80 |          | 000000e0 | Core Gen10 Mobile
  [#] Updated Platforms:
  | Processor      | Stepping | F-M-S/PI    | Old Ver  | New Ver  | Products
  |:---------------|:---------|:------------|:---------|:---------|:---------
  | GKL-R          | R0       | 06-7a-08/01 | 00000016 | 00000018 | Pentium J5040/N5030, Celeron J4125/J4025/N4020/N4120
  | SKL-U/Y        | D0       | 06-4e-03/c0 | 000000d6 | 000000e2 | Core Gen6 Mobile
  | SKL-U23e       | K1       | 06-4e-03/c0 | 000000d6 | 000000e2 | Core Gen6 Mobile
  | APL            | D0       | 06-5c-09/03 | 00000038 | 00000040 | Pentium N/J4xxx, Celeron N/J3xxx, Atom x5/7-E39xx
  | APL            | E0       | 06-5c-0a/03 | 00000016 | 0000001e | Atom x5-E39xx
  | SKL-H/S        | R0/N0    | 06-5e-03/36 | 000000d6 | 000000e2 | Core Gen6; Xeon E3 v5
  | HSX-E/EP       | Cx/M1    | 06-3f-02/6f | 00000043 | 00000044 | Core Gen4 X series; Xeon E5 v3
  | SKX-SP         | B1       | 06-55-03/97 | 01000157 | 01000159 | Xeon Scalable
  | SKX-SP         | H0/M0/U0 | 06-55-04/b7 | 02006906 | 02006a08 | Xeon Scalable
  | SKX-D          | M1       | 06-55-04/b7 | 02006906 | 02006a08 | Xeon D-21xx
  | CLX-SP         | B0       | 06-55-06/bf | 04002f01 | 04003003 | Xeon Scalable Gen2
  | CLX-SP         | B1       | 06-55-07/bf | 05002f01 | 05003003 | Xeon Scalable Gen2
  | ICL-U/Y        | D1       | 06-7e-05/80 | 00000078 | 000000a0 | Core Gen10 Mobile
  | AML-Y22        | H0       | 06-8e-09/10 | 000000d6 | 000000de | Core Gen8 Mobile
  | KBL-U/Y        | H0       | 06-8e-09/c0 | 000000d6 | 000000de | Core Gen7 Mobile
  | CFL-U43e       | D0       | 06-8e-0a/c0 | 000000d6 | 000000e0 | Core Gen8 Mobile
  | WHL-U          | W0       | 06-8e-0b/d0 | 000000d6 | 000000de | Core Gen8 Mobile
  | AML-Y42        | V0       | 06-8e-0c/94 | 000000d6 | 000000de | Core Gen10 Mobile
  | CML-Y42        | V0       | 06-8e-0c/94 | 000000d6 | 000000de | Core Gen10 Mobile
  | WHL-U          | V0       | 06-8e-0c/94 | 000000d6 | 000000de | Core Gen8 Mobile
  | KBL-G/H/S/E3   | B0       | 06-9e-09/2a | 000000d6 | 000000de | Core Gen7; Xeon E3 v6
  | CFL-H/S/E3     | U0       | 06-9e-0a/22 | 000000d6 | 000000de | Core Gen8 Desktop, Mobile, Xeon E
  | CFL-S          | B0       | 06-9e-0b/02 | 000000d6 | 000000de | Core Gen8
  | CFL-H/S        | P0       | 06-9e-0c/22 | 000000d6 | 000000de | Core Gen9
  | CFL-H          | R0       | 06-9e-0d/22 | 000000d6 | 000000de | Core Gen9 Mobile
  | CML-U62        | A0       | 06-a6-00/80 | 000000ca | 000000e0 | Core Gen10 Mobile</changelog>
  <changelog author="meissner@suse.com" date="1605096000">- Updated Intel CPU Microcode to 20201110 official release.
  - CVE-2020-8695: Fixed Intel RAPL sidechannel attack (SGX) (bsc#1170446)
  - CVE-2020-8698: Fixed Fast Store Forward Predictor INTEL-SA-00381 (bsc#1173594)
  - CVE-2020-8696: Vector Register Sampling Active INTEL-SA-00381 (bsc#1173592)
- Releasenotes:
  - Security updates for [INTEL-SA-00381](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00381.html).
  - Security updates for [INTEL-SA-00389](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00389.html).
  - Update for functional issues. Refer to [Second Generation Intel Xeon Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338848) for details.
  - Update for functional issues. Refer to [Intel Xeon Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/613537) for details.
  - Update for functional issues. Refer to [Intel Xeon Processor E5 v3 Product Family Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/xeon-e5-v3-spec-update.html?wapkw=processor+spec+update+e5) for details.
  - Update for functional issues. Refer to [10th Gen Intel Core? Processor Families Specification Update](https://www.intel.com/content/www/us/en/products/docs/processors/core/10th-gen-core-families-specification-update.html) for details.
  - Update for functional issues. Refer to [8th and 9th Gen Intel Core? Processor Family Spec Update](https://www.intel.com/content/www/us/en/products/docs/processors/core/8th-gen-core-spec-update.html) for details.
  - Update for functional issues. Refer to [7th Gen and 8th Gen (U Quad-Core) Intel Processor Families Specification Update](https://www.intel.com/content/www/us/en/processors/core/7th-gen-core-family-spec-update.html) for details.
  - Update for functional issues. Refer to [6th Gen Intel Processor Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/332689) for details.
  - Update for functional issues. Refer to [Intel Xeon E3-1200 v6 Processor Family Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/xeon-e3-1200v6-spec-update.html) for details.
  - Update for functional issues. Refer to [Intel Xeon E-2100 and E-2200 Processor Family Specification Update](https://www.intel.com/content/www/us/en/products/docs/processors/xeon/xeon-e-2100-specification-update.html) for details.
  [#]## New Platforms
  | Processor      | Stepping | F-M-S/PI    | Old Ver  | New Ver  | Products
  |:---------------|:---------|:------------|:---------|:---------|:---------
  | CPX-SP         | A1       | 06-55-0b/bf |          | 0700001e | Xeon Scalable Gen3
  | LKF            | B2/B3    | 06-8a-01/10 |          | 00000028 | Core w/Hybrid Technology
  | TGL            | B1       | 06-8c-01/80 |          | 00000068 | Core Gen11 Mobile
  | CML-H          | R1       | 06-a5-02/20 |          | 000000e0 | Core Gen10 Mobile
  | CML-S62        | G1       | 06-a5-03/22 |          | 000000e0 | Core Gen10
  | CML-S102       | Q0       | 06-a5-05/22 |          | 000000e0 | Core Gen10
  | CML-U62 V2     | K0       | 06-a6-01/80 |          | 000000e0 | Core Gen10 Mobile
  [#]## Updated Platforms
  | Processor      | Stepping | F-M-S/PI    | Old Ver  | New Ver  | Products
  |:---------------|:---------|:------------|:---------|:---------|:---------
  | HSX-E/EP       | Cx/M1    | 06-3f-02/6f | 00000043 | 00000044 | Core Gen4 X series; Xeon E5 v3
  | SKL-U/Y        | D0       | 06-4e-03/c0 | 000000d6 | 000000e2 | Core Gen6 Mobile
  | SKL-U23e       | K1       | 06-4e-03/c0 | 000000d6 | 000000e2 | Core Gen6 Mobile
  | SKX-SP         | B1       | 06-55-03/97 | 01000157 | 01000159 | Xeon Scalable
  | SKX-SP         | H0/M0/U0 | 06-55-04/b7 | 02006906 | 02006a08 | Xeon Scalable
  | SKX-D          | M1       | 06-55-04/b7 | 02006906 | 02006a08 | Xeon D-21xx
  | CLX-SP         | B0       | 06-55-06/bf | 04002f01 | 04003003 | Xeon Scalable Gen2
  | CLX-SP         | B1       | 06-55-07/bf | 05002f01 | 05003003 | Xeon Scalable Gen2
  | APL            | D0       | 06-5c-09/03 | 00000038 | 00000040 | Pentium N/J4xxx, Celeron N/J3xxx, Atom x5/7-E39xx
  | APL            | E0       | 06-5c-0a/03 | 00000016 | 0000001e | Atom x5-E39xx
  | SKL-H/S        | R0/N0    | 06-5e-03/36 | 000000d6 | 000000e2 | Core Gen6; Xeon E3 v5
  | GKL-R          | R0       | 06-7a-08/01 | 00000016 | 00000018 | Pentium J5040/N5030, Celeron J4125/J4025/N4020/N4120
  | ICL-U/Y        | D1       | 06-7e-05/80 | 00000078 | 000000a0 | Core Gen10 Mobile
  | AML-Y22        | H0       | 06-8e-09/10 | 000000d6 | 000000de | Core Gen8 Mobile
  | KBL-U/Y        | H0       | 06-8e-09/c0 | 000000d6 | 000000de | Core Gen7 Mobile
  | CFL-U43e       | D0       | 06-8e-0a/c0 | 000000d6 | 000000e0 | Core Gen8 Mobile
  | WHL-U          | W0       | 06-8e-0b/d0 | 000000d6 | 000000de | Core Gen8 Mobile
  | AML-Y42        | V0       | 06-8e-0c/94 | 000000d6 | 000000de | Core Gen10 Mobile
  | CML-Y42        | V0       | 06-8e-0c/94 | 000000d6 | 000000de | Core Gen10 Mobile
  | WHL-U          | V0       | 06-8e-0c/94 | 000000d6 | 000000de | Core Gen8 Mobile
  | KBL-G/H/S/E3   | B0       | 06-9e-09/2a | 000000d6 | 000000de | Core Gen7; Xeon E3 v6
  | CFL-H/S/E3     | U0       | 06-9e-0a/22 | 000000d6 | 000000de | Core Gen8 Desktop, Mobile, Xeon E
  | CFL-S          | B0       | 06-9e-0b/02 | 000000d6 | 000000de | Core Gen8
  | CFL-H/S        | P0       | 06-9e-0c/22 | 000000d6 | 000000de | Core Gen9
  | CFL-H          | R0       | 06-9e-0d/22 | 000000d6 | 000000de | Core Gen9 Mobile
  | CML-U62        | A0       | 06-a6-00/80 | 000000ca | 000000e0 | Core Gen10 Mobile</changelog>
  <changelog author="meissner@suse.com" date="1605787200">- Updated Intel CPU Microcode to 20201118 official release. (bsc#1178971)
  - Removed TGL/06-8c-01/80 due to functional issues with some OEM platforms.</changelog>
  <changelog author="meissner@suse.com" date="1607342400">- Reverted 3 microcodes back to 20200616 release level after regression reports. (bsc#1179224)
  - SKX-SP         | H0/M0/U0 | 06-55-04/b7 | 02006906 | Xeon Scalable
  - SKX-D          | M1       | 06-55-04/b7 | 02006906 | Xeon D-21xx
  - CLX-SP         | B0       | 06-55-06/bf | 04002f01 | Xeon Scalable Gen2
  - CLX-SP         | B1       | 06-55-07/bf | 05002f01 | Xeon Scalable Gen2</changelog>
  <changelog author="meissner@suse.com" date="1613563200">- Updated Intel CPU Microcode to 20210216 official release. (bsc#1178971 bsc#1179224)
  | Processor      | Stepping | F-M-S/PI    | Old Ver  | New Ver  | Products
  |:---------------|:---------|:------------|:---------|:---------|:---------
  | SKX-SP         | H0/M0/U0 | 06-55-04/b7 | 02006a08 | 02006a0a | Xeon Scalable
  | SKX-D          | M1       | 06-55-04/b7 | 02006a08 | 02006a0a | Xeon D-21xx
  | CLX-SP         | B0       | 06-55-06/bf | 04003003 | 04003006 | Xeon Scalable Gen2
  | CLX-SP         | B1       | 06-55-07/bf | 05003003 | 05003006 | Xeon Scalable Gen2</changelog>
  <changelog author="meissner@suse.com" date="1623153600">- Updated to Intel CPU Microcode 20210525 release.
  - CVE-2020-24513: A domain bypass transient execution vulnerability was discovered on some Intel Atom processors that use a micro-architectural incident channel. (INTEL-SA-00465 bsc#1179833)
    See also: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00465.html
  - CVE-2020-24511: The IBRS feature to mitigate Spectre variant 2 transient execution side channel vulnerabilities may not fully prevent non-root (guest) branches from controlling the branch predictions of the root (host) (INTEL-SA-00464 bsc#1179836)
    See also https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00464.html)
  - CVE-2020-24512: Fixed trivial data value cache-lines such as all-zero value cache-lines may lead to changes in cache-allocation or write-back behavior for such cache-lines (bsc#1179837 INTEL-SA-00464)
    See also https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00464.html)
  - CVE-2020-24489: Fixed Intel VT-d device pass through potential local privilege escalation (INTEL-SA-00442 bsc#1179839)
    See also https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00442.html
- Update for functional issues. Refer to [Third Generation Intel Xeon Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/637780)for details.
- Update for functional issues. Refer to [Second Generation Intel Xeon Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338848) for details.
- Update for functional issues. Refer to [Intel Xeon Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/613537) for details.
- Update for functional issues. Refer to [Intel Xeon Processor D-1500, D-1500 NS and D-1600 NS Spec Update](https://www.intel.com/content/www/us/en/products/docs/processors/xeon/xeon-d-1500-specification-update.html) for details.
- Update for functional issues. Refer to [Intel Xeon E7-8800 and E7-4800 v3 Processor Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/xeon-e7-v3-spec-update.html) for details.
- Update for functional issues. Refer to [Intel Xeon Processor E5 v3 Product Family Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/xeon-e5-v3-spec-update.html?wapkw=processor+spec+update+e5) for details.
- Update for functional issues. Refer to [10th Gen Intel Core Processor Families Specification Update](https://www.intel.com/content/www/us/en/products/docs/processors/core/10th-gen-core-families-specification-update.html) for details.
- Update for functional issues. Refer to [8th and 9th Gen Intel Core Processor Family Spec Update](https://www.intel.com/content/www/us/en/products/docs/processors/core/8th-gen-core-spec-update.html) for details.
- Update for functional issues. Refer to [7th Gen and 8th Gen (U Quad-Core) Intel Processor Families Specification Update](https://www.intel.com/content/www/us/en/processors/core/7th-gen-core-family-spec-update.html) for details.
- Update for functional issues. Refer to [6th Gen Intel Processor Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/332689) for details.
- Update for functional issues. Refer to [Intel Xeon E3-1200 v6 Processor Family Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/xeon-e3-1200v6-spec-update.html) for details.
- Update for functional issues. Refer to [Intel Xeon E-2100 and E-2200 Processor Family Specification Update](https://www.intel.com/content/www/us/en/products/docs/processors/xeon/xeon-e-2100-specification-update.html) for details.
- New platforms:
  | Processor      | Stepping | F-M-S/PI    | Old Ver  | New Ver  | Products
  |:---------------|:---------|:------------|:---------|:---------|:---------
  | CLX-SP         | A0       | 06-55-05/b7 |          | 03000010 | Xeon Scalable Gen2
  | ICX-SP         | C0       | 06-6a-05/87 |          | 0c0002f0 | Xeon Scalable Gen3
  | ICX-SP         | D0       | 06-6a-06/87 |          | 0d0002a0 | Xeon Scalable Gen3
  | SNR            | B0       | 06-86-04/01 |          | 0b00000f | Atom P59xxB
  | SNR            | B1       | 06-86-05/01 |          | 0b00000f | Atom P59xxB
  | TGL            | B1       | 06-8c-01/80 |          | 00000088 | Core Gen11 Mobile
  | TGL-R          | C0       | 06-8c-02/c2 |          | 00000016 | Core Gen11 Mobile
  | TGL-H          | R0       | 06-8d-01/c2 |          | 0000002c | Core Gen11 Mobile
  | EHL            | B1       | 06-96-01/01 |          | 00000011 | Pentium J6426/N6415, Celeron J6412/J6413/N6210/N6211, Atom x6000E
  | JSL            | A0/A1    | 06-9c-00/01 |          | 0000001d | Pentium N6000/N6005, Celeron N4500/N4505/N5100/N5105
  | RKL-S          | B0       | 06-a7-01/02 |          | 00000040 | Core Gen11
- Updated platforms:
  | Processor      | Stepping | F-M-S/PI    | Old Ver  | New Ver  | Products
  |:---------------|:---------|:------------|:---------|:---------|:---------
  | HSX-E/EP       | Cx/M1    | 06-3f-02/6f | 00000044 | 00000046 | Core Gen4 X series; Xeon E5 v3
  | HSX-EX         | E0       | 06-3f-04/80 | 00000016 | 00000019 | Xeon E7 v3
  | SKL-U/Y        | D0       | 06-4e-03/c0 | 000000e2 | 000000ea | Core Gen6 Mobile
  | SKL-U23e       | K1       | 06-4e-03/c0 | 000000e2 | 000000ea | Core Gen6 Mobile
  | BDX-ML         | B0/M0/R0 | 06-4f-01/ef | 0b000038 | 0b00003e | Xeon E5/E7 v4; Core i7-69xx/68xx
  | SKX-SP         | B1       | 06-55-03/97 | 01000159 | 0100015b | Xeon Scalable
  | SKX-SP         | H0/M0/U0 | 06-55-04/b7 | 02006a0a | 02006b06 | Xeon Scalable
  | SKX-D          | M1       | 06-55-04/b7 | 02006a0a | 02006b06 | Xeon D-21xx
  | CLX-SP         | B0       | 06-55-06/bf | 04003006 | 04003102 | Xeon Scalable Gen2
  | CLX-SP         | B1       | 06-55-07/bf | 05003006 | 05003102 | Xeon Scalable Gen2
  | CPX-SP         | A1       | 06-55-0b/bf | 0700001e | 07002302 | Xeon Scalable Gen3
  | BDX-DE         | V2/V3    | 06-56-03/10 | 07000019 | 0700001b | Xeon D-1518/19/21/27/28/31/33/37/41/48, Pentium D1507/08/09/17/19
  | BDX-DE         | Y0       | 06-56-04/10 | 0f000017 | 0f000019 | Xeon D-1557/59/67/71/77/81/87
  | BDX-NS         | A0       | 06-56-05/10 | 0e00000f | 0e000012 | Xeon D-1513N/23/33/43/53
  | APL            | D0       | 06-5c-09/03 | 00000040 | 00000044 | Pentium N/J4xxx, Celeron N/J3xxx, Atom x5/7-E39xx
  | APL            | E0       | 06-5c-0a/03 | 0000001e | 00000020 | Atom x5-E39xx
  | SKL-H/S        | R0/N0    | 06-5e-03/36 | 000000e2 | 000000ea | Core Gen6; Xeon E3 v5
  | DNV            | B0       | 06-5f-01/01 | 0000002e | 00000034 | Atom C Series
  | GLK            | B0       | 06-7a-01/01 | 00000034 | 00000036 | Pentium Silver N/J5xxx, Celeron N/J4xxx
  | GKL-R          | R0       | 06-7a-08/01 | 00000018 | 0000001a | Pentium J5040/N5030, Celeron J4125/J4025/N4020/N4120
  | ICL-U/Y        | D1       | 06-7e-05/80 | 000000a0 | 000000a6 | Core Gen10 Mobile
  | LKF            | B2/B3    | 06-8a-01/10 | 00000028 | 0000002a | Core w/Hybrid Technology
  | AML-Y22        | H0       | 06-8e-09/10 | 000000de | 000000ea | Core Gen8 Mobile
  | KBL-U/Y        | H0       | 06-8e-09/c0 | 000000de | 000000ea | Core Gen7 Mobile
  | CFL-U43e       | D0       | 06-8e-0a/c0 | 000000e0 | 000000ea | Core Gen8 Mobile
  | WHL-U          | W0       | 06-8e-0b/d0 | 000000de | 000000ea | Core Gen8 Mobile
  | AML-Y42        | V0       | 06-8e-0c/94 | 000000de | 000000ea | Core Gen10 Mobile
  | CML-Y42        | V0       | 06-8e-0c/94 | 000000de | 000000ea | Core Gen10 Mobile
  | WHL-U          | V0       | 06-8e-0c/94 | 000000de | 000000ea | Core Gen8 Mobile
  | KBL-G/H/S/E3   | B0       | 06-9e-09/2a | 000000de | 000000ea | Core Gen7; Xeon E3 v6
  | CFL-H/S/E3     | U0       | 06-9e-0a/22 | 000000de | 000000ea | Core Gen8 Desktop, Mobile, Xeon E
  | CFL-S          | B0       | 06-9e-0b/02 | 000000de | 000000ea | Core Gen8
  | CFL-H/S        | P0       | 06-9e-0c/22 | 000000de | 000000ea | Core Gen9
  | CFL-H          | R0       | 06-9e-0d/22 | 000000de | 000000ea | Core Gen9 Mobile
  | CML-H          | R1       | 06-a5-02/20 | 000000e0 | 000000ea | Core Gen10 Mobile
  | CML-S62        | G1       | 06-a5-03/22 | 000000e0 | 000000ea | Core Gen10
  | CML-S102       | Q0       | 06-a5-05/22 | 000000e0 | 000000ec | Core Gen10
  | CML-U62        | A0       | 06-a6-00/80 | 000000e0 | 000000e8 | Core Gen10 Mobile
  | CML-U62 V2     | K0       | 06-a6-01/80 | 000000e0 | 000000ea | Core Gen10 Mobile</changelog>
  <changelog author="meissner@suse.com" date="1644494400">- Updated to Intel CPU Microcode 20220207 release.
  - CVE-2021-0146: Fixed a potential security vulnerability in some Intel Processors may allow escalation of privilege (bsc#1192615)
  - CVE-2021-0127: Intel Processor Breakpoint Control Flow (bsc#1195779)
  - CVE-2021-0145: Fast store forward predictor - Cross Domain Training (bsc#1195780)
  - CVE-2021-33120: Out of bounds read for some Intel Atom processors (bsc#1195781)
  - Security updates for [INTEL-SA-00528](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00528.html)
  - Security updates for [INTEL-SA-00532](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00532.html)
  - Update for functional issues. Refer to [Third Generation Intel Xeon Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/637780) for details.
  - Update for functional issues. Refer to [Second Generation Intel Xeon Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338848) for details.
  - Update for functional issues. Refer to [Intel Xeon Processor Scalable Family Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/scalable/xeon-scalable-spec-update.html?wapkw=processor+specification+update) for details.
  - Update for functional issues. Refer to [11th Generation Intel Core" Processor Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/631123) for details.
  - Update for functional issues. Refer to [11th Generation Intel Core" Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/634808) for details.
  - Update for functional issues. Refer to [10th Gen Intel Core" Processor Families Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/341079) for details.
  - Update for functional issues. Refer to [10th Generation Intel Core" Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/615213) for details.
  - Update for functional issues. Refer to [8th Generation Intel Core" Processor Families Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338025) for details.
  - Update for functional issues. Refer to [8th Gen Intel Core" Processor Family Spec Update](https://www.intel.com/content/www/us/en/products/docs/processors/core/8th-gen-core-family-spec-update.html?wapkw=processor+specification+update) for details.
  - Update for functional issues. Refer to [7th and 8th Generation Intel Core" Processor Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/334663) for details.
  - Update for functional issues. Refer to [6th Generation Intel Processor Family Specification Update](https://www.intel.com/content/www/us/en/processors/core/desktop-6th-gen-core-family-spec-update.html) for details.
  - Update for functional issues. Refer to [Intel Pentium Silver and Intel Celeron Processors](https://www.intel.com/content/www/us/en/products/docs/processors/pentium/silver-celeron-spec-update.html?wapkw=processor+specification+update) for details.</changelog>
</package>
<package pkgid="6a40c9e8a6fe9fb9cf415400657941a7e2bd873a629f1ffd1d8d051fa2490edd" name="unbound" arch="aarch64">
  <version epoch="0" ver="1.6.8" rel="10.6.1"/>
  <changelog author="michael@stroeder.com" date="1497441600">- update to 1.6.3
  Bug Fixes
- Fix #1280: Unbound fails assert when response from authoritative
  contains malformed qname. When 0x20 caps-for-id is enabled, when
  assertions are not enabled the malformed qname is handled correctly.</changelog>
  <changelog author="michael@stroeder.com" date="1498564800">- update to 1.6.4
  Features:
- Implemented trust anchor signaling using key tag query.
- unbound-checkconf -o allows query of dnstap config variables.
  Also unbound-control get_option.  Also for dnscrypt.
- unbound.h exports the shm stats structures.  They use
  type long long and no ifdefs, and ub_ before the typenames.
- Implemented opportunistic IPsec support module (ipsecmod).
- Added redirect-bogus.patch to contrib directory.
- Support for the ED25519 algorithm with openssl (from openssl 1.1.1).
- renumbering B-Root's IPv6 address to 2001:500:200::b.
- Fix #1276: [dnscrypt] add XChaCha20-Poly1305 cipher.
- Fix #1277: disable domain ratelimit by setting value to 0.
- Added fastrpz patch to contrib
  Bug Fixes:
- Added ECS unit test (from Manu Bretelle).
- ECS documentation fix (from Manu Bretelle).
- Fix #1252: more indentation inconsistencies.
- Fix #1253: unused variable in edns-subnet/addrtree.c:getbit().
- Fix #1254: clarify ratelimit-{for,below}-domain (from Manu Bretelle).
- iana portlist update
- Based on #1257: check parse limit before t increment in sldns RR
  string parse routine.
- Fix #1258: Windows 10 X64 unbound 1.6.2 service will not start.
  and fix that 64bit getting installed in C:\Program Files (x86).
- Fix #1259: "--disable-ecdsa" argument overwritten
  by "#ifdef SHA256_DIGEST_LENGTH@daemon/remote.c".
- iana portlist update
- Added test for leak of stub information.
- Fix sldns wire2str printout of RR type CAA tags.
- Fix sldns int16_data parse.
- Fix sldns parse and printout of TSIG RRs.
- sldns SMIMEA and AVC definitions, same as getdns definitions.
- Fix tcp-mss failure printout text.
- Set SO_REUSEADDR on outgoing tcp connections to fix the bind before
  connect limited tcp connections.  With the option tcp connections
  can share the same source port (for different destinations).
- Add 'c' to getopt() in testbound.
- Adjust servfail by iterator to not store in cache when serve-expired
  is enabled, to avoid overwriting useful information there.
- Fix queries for nameservers under a stub leaking to the internet.
- document trust-anchor-signaling in example config file.
- updated configure, dependencies and flex output.
- better module memory lookup, fix of unbound-control shm names for
  module memory printout of statistics.
- Fix type AVC sldns rrdef.
- Some whitespace fixup.
- Fix #1265: contrib/unbound.service contains hardcoded path.
- Fix #1265 to use /bin/kill.
- Fix #1267: Libunbound validator/val_secalgo.c uses obsolete APIs,
  and compatibility with BoringSSL.
- Fix #1268: SIGSEGV after log_reopen.
- exec_prefix is by default equal to prefix.
- printout localzone for duplicate local-zone warnings.
- Fix assertion for low buffer size and big edns payload when worker
  overrides udpsize.
- Support for openssl EVP_DigestVerify.
- Fix #1269: inconsistent use of built-in local zones with views.
- Add defaults for new local-zone trees added to views using
  unbound-control.
- Fix #1273: cachedb.c doesn't compile with -Wextra.
- If MSG_FASTOPEN gives EPIPE fallthrough to try normal tcp write.
- Also use global local-zones when there is a matching view that does
  not have any local-zone specified.
- Fix fastopen EPIPE fallthrough to perform connect.
- Fix #1274: automatically trim chroot path from dnscrypt key/cert paths
  (from Manu Bretelle).
- Fix #1275: cached data in cachedb is never used.
- Fix that unbound-control can set val_clean_additional and
  val_permissive_mode.
- Add dnscrypt XChaCha20 tests.
- Detect chacha for dnscrypt at configure time.
- dnscrypt unit tests with chacha.
- Added domain name based ECS whitelist.
- Fix #1278: Incomplete wildcard proof.
- Fix #1279: Memory leak on reload when python module is enabled.
- Fix #1280: Unbound fails assert when response from authoritative
  contains malformed qname.  When 0x20 caps-for-id is enabled, when
  assertions are not enabled the malformed qname is handled correctly.
- More fixes in depth for buffer checks in 0x20 qname checks.
- Fix stub zone queries leaking to the internet for
  harden-referral-path ns checks.
- Fix query for refetch_glue of stub leaking to internet.
- Fix #1301: memory leak in respip and tests.
- Free callback in edns-subnetmod on exit and restart.
- Fix memory leak in sldns_buffer_new_frm_data.
- Fix memory leak in dnscrypt config read.
- Fix dnscrypt chacha cert support ifdefs.
- Fix dnscrypt chacha cert unit test escapes in grep.
- Fix to unlock view in view test.
- Fix warning in pythonmod under clang compiler.
- Fix lintian typo.
- Fix #1316: heap read buffer overflow in parse_edns_options.</changelog>
  <changelog author="jengelh@inai.de" date="1502193600">- RPM group fix. Do not suppress user/group creation problems.
  Replace %__ type macro indirections.</changelog>
  <changelog author="michael@stroeder.com" date="1503316800">- update to 1.6.5
  * Fix install of trust anchor when two anchors are present, makes both
    valid.  Checks hash of DS but not signature of new key.  This fixes
    installs between sep11 and oct11 2017.</changelog>
  <changelog author="michael@stroeder.com" date="1504526400">- update to 1.6.6
  Features:
- unbound-control dump_infra prints port number for address if not 53.
- Fix #1344: RFC6761-reserved domains: test. and invalid.
- Fix #1349: allow suppression of pidfiles (from Daniel Kahn Gillmor).
  With the -p option unbound does not create a pidfile.
- Added stats for queries that have been ratelimited by domain
  recursion.
- Patch to show DNSCrypt status in help output, from Carsten
  Strotmann.
- Fix #1407: Add ECS options check to unbound-checkconf.
- Fix #1415: [dnscrypt] shared secret cache, patch from
  Manu Bretelle.
  Bug Fixes:
- fixup of dnscrypt_cert_chacha test (from Manu Bretelle).
- First fix for zero b64 and hex text zone format in sldns.
- Better fixup of dnscrypt_cert_chacha test for different escapes.
- Fix that infra cache host hash does not change after reconfig.
- Fix python example0 return module wait instead of error for pass.
- enhancement for hardened-tls for DNS over TLS.  Removed duplicated
  security settings.
- Fix for unbound-checkconf, check ipsecmod-hook if ipsecmod is turned
  on.
- Fix #1331: libunbound segfault in threaded mode when context is
  deleted.
- Fix pythonmod link line option flag.
- Fix openssl 1.1.0 load of ssl error strings from ssl init.
- Fix 1332: Bump verbosity of failed chown'ing of the control socket.
- Redirect all localhost names to localhost address for RFC6761.
- Fix #1350: make cachedb backend configurable (from JINMEI Tatuya).
- Fix tests to use .tdir (from Manu Bretelle) instead of .tpkg.
- upgrade aclocal(pkg.m4 0.29.1), config.guess(2016-10-02),
  config.sub(2016-09-05).
- annotate case statement fallthrough for gcc 7.1.1.
- flex output from flex 2.6.1.
- snprintf of thread number does not warn about truncated string.
- squelch TCP fast open error on FreeBSD when kernel has it disabled,
  unless verbosity is high.
- remove warning from windows compile.
- Fix compile with libnettle
- Fix DSA configure switch (--disable dsa) for libnettle and libnss.
- Fix #1365: Add Ed25519 support using libnettle.
- Fix #1394: mix of serve-expired and response-ip could cause a crash.
- Remove unused iter_env member (ip6arpa_dname)
- Do not reset rrset.bogus stats when called using stats_noreset.
- Do not add rrset_bogus and query ratelimiting stats per thread, these
  module stats are global.
- Fix #1397: Recursive DS lookups for AS112 zones names should recurse.
- Fix #1398: make cachedb secret configurable.
- Remove spaces from Makefile.
- Fix issue on macOX 10.10 where TCP fast open is detected but not
  implemented causing TCP to fail. The fix allows fallback to regular
  TCP in this case and is also more robust for cases where connectx()
  fails for some reason.
- Fix #1402: squelch invalid argument error for fd_set_block on windows.
- Fix to reclaim tcp handler when it is closed due to dnscrypt buffer
  allocation failure.
- Fix #1415: patch to free dnscrypt environment on reload.
- iana portlist update
- Small fixes for the shared secret cache patch.
- Fix WKS records on kvm autobuild host, with default protobyname
  entries for udp and tcp.
- Fix #1414: fix segfault on parse failure and log_replies.
- zero qinfo in handle_request, this zeroes local_alias and also the
  qname member.
- new keys and certs for dnscrypt tests.
- fixup WKS test on buildhost without servicebyname.
- updated contrib/fastrpz.patch to apply with configparser changes.
- Fix 1416: qname-minimisation breaks TLSA lookups with CNAMEs.
- Fix #1424: cachedb:testframe is not thread safe.
- Fix #1417: [dnscrypt] shared secret cache counters, and works when
  dnscrypt is not enabled.  And cache size configuration option.
- Fix #1418: [ip ratelimit] initialize slabhash using
  ip-ratelimit-slabs.
- Recommend 1472 buffer size in unbound.conf</changelog>
  <changelog author="michael@stroeder.com" date="1507636800">- update to 1.6.7
  Features:
- Set trust-anchor-signaling default to yes
- Fix #1440: [dnscrypt] client nonce cache.
- Fix #1435: Please allow UDP to be disabled separately upstream and
  downstream.
  Bug fixes:
- Fix that looping modules always stop the query, and don't pass
  control.
- Fix unbound-host to report error for DNSSEC state of failed lookups.
- Spelling fixes, from Josh Soref.
- Fix #1400: allowing use of global cache on ECS-forwarding unless
  always-forward.
- use a cachedb answer even if it's "expired" when serve-expired is yes
  (patch from Jinmei Tatuya).
- trigger refetching of the answer in that case (this will bypass
  cachedb lookup)
- allow storing a 0-TTL answer from cachedb in the in-memory message
  cache when serve-expired is yes
- Fix DNSCACHE_STORE_ZEROTTL to be bigger than 0xffff.
- Log name of looping module
- Fix #1450: Generate again patch contrib/aaaa-filter-iterator.patch
  (by Danilo G. Baio).
- Fix param unused warning for windows exportsymbol compile.
- Use RCODE from A query on DNS64 synthesized answer.
- Fix trust-anchor-signaling works in libunbound.
- Fix spelling in unbound-control man page.</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="cbosdonnat@suse.com" date="1512129600">- Use python3 instead of python2 (fate#323526)</changelog>
  <changelog author="michael@stroeder.com" date="1516363200">- update to 1.6.8 (bsc#1076963)
  patch for CVE-2017-15105: vulnerability in the processing of
  wildcard synthesized NSEC records.</changelog>
  <changelog author="dmueller@suse.com" date="1539691200">- adjust for root KSK rollover (bsc#1112009, bsc#1004165)</changelog>
  <changelog author="kbabioch@suse.com" date="1539691201">- Disabled DLV configuration by default (bsc#1055060)
- Updated the DNSSEC root trust anchor due to KSK roll over (bsc#1112009)</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1542283200">- Migrated from cron to systemd timers (bsc#1115417)</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1546603200">- Use systemd-tmpfiles to create /var/lib/unbound/root.key
  to avoid transactional update breakage (bsc#1111383)</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1551960000">- Remove old pwdutils dependency and add shadow to cover both useradd
  and groupadd as suggested in (bsc#1126757)</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1556020800">- Add systemd require in unbound-anchor to reflect new dependency (due to systemd-timers)</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1592913600">- Avoid amplifying an incoming query to a large number of queries
  Resolves CVE-2020-12662 CVE-2020-12663 (bsc#1171889)
  [ + unbound-1.6.8-amplifying-an-incoming-query.patch ]</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1592913601">- Avoid shell code execution after receiving a specially crafted answer
  Resolves CVE-2019-18934 (bsc#1157268)
  [ + patch_cve_2019-18934.patch ]</changelog>
  <changelog author="werner@suse.de" date="1642420800">- Add patches
  * bsc1185382_CVE-2019-25031_f8875527.patch
    bsc#1185382 for CVE-2019-25031
    configuration injection in create_unbound_ad_servers.sh upon a successful man-in-the-middle attack
  * bsc1185383.4_CVE-2019-25032.3_226298bb.patch
    bsc#1185383 for CVE-2019-25032
    integer overflow in the regional allocator via regional_alloc
    bsc#1185384 for CVE-2019-25033
    integer overflow in the regional allocator via the ALIGN_UP macro
  * bsc1185385_CVE-2019-25034_a3545867.patch
    bsc#1185385 for CVE-2019-25034
    integer overflow in sldns_str2wire_dname_buf_origin, leading to an out-of-bounds write
  * bsc1185386.7_CVE-2019-25035.6_fa23ee8f.patch
    bsc#1185386 for CVE-2019-25035
    out-of-bounds write in sldns_bget_token_par
    bsc#1185387 for CVE-2019-25036
    assertion failure and denial of service in synth_cname
  * bsc1185391.2_CVE-2019-25040.1_2d444a50.patch
    bsc#1185391 for CVE-2019-25040
    infinite loop via a compressed name in dname_pkt_copy
    bsc#1185392 for CVE-2019-25041
    assertion failure via a compressed name in dname_pkt_copy
  * bsc1185389.90_CVE-2019-25038.9_02080f6b.patch
    bsc#1185389 for CVE-2019-25038
    integer overflow in a size calculation in dnscrypt/dnscrypt.c
    bsc#1185390 for CVE-2019-25039
    integer overflow in a size calculation in respip/respip.c
  * bsc1185388_CVE-2019-25037_d2eb78e8.patch
    bsc#1185388 for CVE-2019-25037
    assertion failure and denial of service in dname_pkt_copy via an invalid packet
  * bsc1185393_CVE-2019-25042_6c3a0b54.patch
    bsc#1185393 for CVE-2019-25042
    out-of-bounds write via a compressed name in rdata_copy
- Correct indentation in patch unbound-1.6.8-amplifying-an-incoming-query.patch
  to make it fit to above patches</changelog>
  <changelog author="werner@suse.de" date="1642593600">- Add patch bsc1179191_CVE-2020-28935_19f8f4d9.patch to really fix
  bsc#1179191 CVE-2020-28935: unbound: symbolic link traversal when
  writing PID file</changelog>
  <changelog author="werner@suse.de" date="1642593601">- Import changes from OBS for dlv.isc.org.key, root.anchor, and
  root.key to fix bsc#1112033</changelog>
</package>
<package pkgid="03eb75607ffd7aea01b38fa72dbb3e1f58f17f9c376dcee8daa7221e5d58ef08" name="unbound" arch="ppc64le">
  <version epoch="0" ver="1.6.8" rel="10.6.1"/>
  <changelog author="michael@stroeder.com" date="1497441600">- update to 1.6.3
  Bug Fixes
- Fix #1280: Unbound fails assert when response from authoritative
  contains malformed qname. When 0x20 caps-for-id is enabled, when
  assertions are not enabled the malformed qname is handled correctly.</changelog>
  <changelog author="michael@stroeder.com" date="1498564800">- update to 1.6.4
  Features:
- Implemented trust anchor signaling using key tag query.
- unbound-checkconf -o allows query of dnstap config variables.
  Also unbound-control get_option.  Also for dnscrypt.
- unbound.h exports the shm stats structures.  They use
  type long long and no ifdefs, and ub_ before the typenames.
- Implemented opportunistic IPsec support module (ipsecmod).
- Added redirect-bogus.patch to contrib directory.
- Support for the ED25519 algorithm with openssl (from openssl 1.1.1).
- renumbering B-Root's IPv6 address to 2001:500:200::b.
- Fix #1276: [dnscrypt] add XChaCha20-Poly1305 cipher.
- Fix #1277: disable domain ratelimit by setting value to 0.
- Added fastrpz patch to contrib
  Bug Fixes:
- Added ECS unit test (from Manu Bretelle).
- ECS documentation fix (from Manu Bretelle).
- Fix #1252: more indentation inconsistencies.
- Fix #1253: unused variable in edns-subnet/addrtree.c:getbit().
- Fix #1254: clarify ratelimit-{for,below}-domain (from Manu Bretelle).
- iana portlist update
- Based on #1257: check parse limit before t increment in sldns RR
  string parse routine.
- Fix #1258: Windows 10 X64 unbound 1.6.2 service will not start.
  and fix that 64bit getting installed in C:\Program Files (x86).
- Fix #1259: "--disable-ecdsa" argument overwritten
  by "#ifdef SHA256_DIGEST_LENGTH@daemon/remote.c".
- iana portlist update
- Added test for leak of stub information.
- Fix sldns wire2str printout of RR type CAA tags.
- Fix sldns int16_data parse.
- Fix sldns parse and printout of TSIG RRs.
- sldns SMIMEA and AVC definitions, same as getdns definitions.
- Fix tcp-mss failure printout text.
- Set SO_REUSEADDR on outgoing tcp connections to fix the bind before
  connect limited tcp connections.  With the option tcp connections
  can share the same source port (for different destinations).
- Add 'c' to getopt() in testbound.
- Adjust servfail by iterator to not store in cache when serve-expired
  is enabled, to avoid overwriting useful information there.
- Fix queries for nameservers under a stub leaking to the internet.
- document trust-anchor-signaling in example config file.
- updated configure, dependencies and flex output.
- better module memory lookup, fix of unbound-control shm names for
  module memory printout of statistics.
- Fix type AVC sldns rrdef.
- Some whitespace fixup.
- Fix #1265: contrib/unbound.service contains hardcoded path.
- Fix #1265 to use /bin/kill.
- Fix #1267: Libunbound validator/val_secalgo.c uses obsolete APIs,
  and compatibility with BoringSSL.
- Fix #1268: SIGSEGV after log_reopen.
- exec_prefix is by default equal to prefix.
- printout localzone for duplicate local-zone warnings.
- Fix assertion for low buffer size and big edns payload when worker
  overrides udpsize.
- Support for openssl EVP_DigestVerify.
- Fix #1269: inconsistent use of built-in local zones with views.
- Add defaults for new local-zone trees added to views using
  unbound-control.
- Fix #1273: cachedb.c doesn't compile with -Wextra.
- If MSG_FASTOPEN gives EPIPE fallthrough to try normal tcp write.
- Also use global local-zones when there is a matching view that does
  not have any local-zone specified.
- Fix fastopen EPIPE fallthrough to perform connect.
- Fix #1274: automatically trim chroot path from dnscrypt key/cert paths
  (from Manu Bretelle).
- Fix #1275: cached data in cachedb is never used.
- Fix that unbound-control can set val_clean_additional and
  val_permissive_mode.
- Add dnscrypt XChaCha20 tests.
- Detect chacha for dnscrypt at configure time.
- dnscrypt unit tests with chacha.
- Added domain name based ECS whitelist.
- Fix #1278: Incomplete wildcard proof.
- Fix #1279: Memory leak on reload when python module is enabled.
- Fix #1280: Unbound fails assert when response from authoritative
  contains malformed qname.  When 0x20 caps-for-id is enabled, when
  assertions are not enabled the malformed qname is handled correctly.
- More fixes in depth for buffer checks in 0x20 qname checks.
- Fix stub zone queries leaking to the internet for
  harden-referral-path ns checks.
- Fix query for refetch_glue of stub leaking to internet.
- Fix #1301: memory leak in respip and tests.
- Free callback in edns-subnetmod on exit and restart.
- Fix memory leak in sldns_buffer_new_frm_data.
- Fix memory leak in dnscrypt config read.
- Fix dnscrypt chacha cert support ifdefs.
- Fix dnscrypt chacha cert unit test escapes in grep.
- Fix to unlock view in view test.
- Fix warning in pythonmod under clang compiler.
- Fix lintian typo.
- Fix #1316: heap read buffer overflow in parse_edns_options.</changelog>
  <changelog author="jengelh@inai.de" date="1502193600">- RPM group fix. Do not suppress user/group creation problems.
  Replace %__ type macro indirections.</changelog>
  <changelog author="michael@stroeder.com" date="1503316800">- update to 1.6.5
  * Fix install of trust anchor when two anchors are present, makes both
    valid.  Checks hash of DS but not signature of new key.  This fixes
    installs between sep11 and oct11 2017.</changelog>
  <changelog author="michael@stroeder.com" date="1504526400">- update to 1.6.6
  Features:
- unbound-control dump_infra prints port number for address if not 53.
- Fix #1344: RFC6761-reserved domains: test. and invalid.
- Fix #1349: allow suppression of pidfiles (from Daniel Kahn Gillmor).
  With the -p option unbound does not create a pidfile.
- Added stats for queries that have been ratelimited by domain
  recursion.
- Patch to show DNSCrypt status in help output, from Carsten
  Strotmann.
- Fix #1407: Add ECS options check to unbound-checkconf.
- Fix #1415: [dnscrypt] shared secret cache, patch from
  Manu Bretelle.
  Bug Fixes:
- fixup of dnscrypt_cert_chacha test (from Manu Bretelle).
- First fix for zero b64 and hex text zone format in sldns.
- Better fixup of dnscrypt_cert_chacha test for different escapes.
- Fix that infra cache host hash does not change after reconfig.
- Fix python example0 return module wait instead of error for pass.
- enhancement for hardened-tls for DNS over TLS.  Removed duplicated
  security settings.
- Fix for unbound-checkconf, check ipsecmod-hook if ipsecmod is turned
  on.
- Fix #1331: libunbound segfault in threaded mode when context is
  deleted.
- Fix pythonmod link line option flag.
- Fix openssl 1.1.0 load of ssl error strings from ssl init.
- Fix 1332: Bump verbosity of failed chown'ing of the control socket.
- Redirect all localhost names to localhost address for RFC6761.
- Fix #1350: make cachedb backend configurable (from JINMEI Tatuya).
- Fix tests to use .tdir (from Manu Bretelle) instead of .tpkg.
- upgrade aclocal(pkg.m4 0.29.1), config.guess(2016-10-02),
  config.sub(2016-09-05).
- annotate case statement fallthrough for gcc 7.1.1.
- flex output from flex 2.6.1.
- snprintf of thread number does not warn about truncated string.
- squelch TCP fast open error on FreeBSD when kernel has it disabled,
  unless verbosity is high.
- remove warning from windows compile.
- Fix compile with libnettle
- Fix DSA configure switch (--disable dsa) for libnettle and libnss.
- Fix #1365: Add Ed25519 support using libnettle.
- Fix #1394: mix of serve-expired and response-ip could cause a crash.
- Remove unused iter_env member (ip6arpa_dname)
- Do not reset rrset.bogus stats when called using stats_noreset.
- Do not add rrset_bogus and query ratelimiting stats per thread, these
  module stats are global.
- Fix #1397: Recursive DS lookups for AS112 zones names should recurse.
- Fix #1398: make cachedb secret configurable.
- Remove spaces from Makefile.
- Fix issue on macOX 10.10 where TCP fast open is detected but not
  implemented causing TCP to fail. The fix allows fallback to regular
  TCP in this case and is also more robust for cases where connectx()
  fails for some reason.
- Fix #1402: squelch invalid argument error for fd_set_block on windows.
- Fix to reclaim tcp handler when it is closed due to dnscrypt buffer
  allocation failure.
- Fix #1415: patch to free dnscrypt environment on reload.
- iana portlist update
- Small fixes for the shared secret cache patch.
- Fix WKS records on kvm autobuild host, with default protobyname
  entries for udp and tcp.
- Fix #1414: fix segfault on parse failure and log_replies.
- zero qinfo in handle_request, this zeroes local_alias and also the
  qname member.
- new keys and certs for dnscrypt tests.
- fixup WKS test on buildhost without servicebyname.
- updated contrib/fastrpz.patch to apply with configparser changes.
- Fix 1416: qname-minimisation breaks TLSA lookups with CNAMEs.
- Fix #1424: cachedb:testframe is not thread safe.
- Fix #1417: [dnscrypt] shared secret cache counters, and works when
  dnscrypt is not enabled.  And cache size configuration option.
- Fix #1418: [ip ratelimit] initialize slabhash using
  ip-ratelimit-slabs.
- Recommend 1472 buffer size in unbound.conf</changelog>
  <changelog author="michael@stroeder.com" date="1507636800">- update to 1.6.7
  Features:
- Set trust-anchor-signaling default to yes
- Fix #1440: [dnscrypt] client nonce cache.
- Fix #1435: Please allow UDP to be disabled separately upstream and
  downstream.
  Bug fixes:
- Fix that looping modules always stop the query, and don't pass
  control.
- Fix unbound-host to report error for DNSSEC state of failed lookups.
- Spelling fixes, from Josh Soref.
- Fix #1400: allowing use of global cache on ECS-forwarding unless
  always-forward.
- use a cachedb answer even if it's "expired" when serve-expired is yes
  (patch from Jinmei Tatuya).
- trigger refetching of the answer in that case (this will bypass
  cachedb lookup)
- allow storing a 0-TTL answer from cachedb in the in-memory message
  cache when serve-expired is yes
- Fix DNSCACHE_STORE_ZEROTTL to be bigger than 0xffff.
- Log name of looping module
- Fix #1450: Generate again patch contrib/aaaa-filter-iterator.patch
  (by Danilo G. Baio).
- Fix param unused warning for windows exportsymbol compile.
- Use RCODE from A query on DNS64 synthesized answer.
- Fix trust-anchor-signaling works in libunbound.
- Fix spelling in unbound-control man page.</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="cbosdonnat@suse.com" date="1512129600">- Use python3 instead of python2 (fate#323526)</changelog>
  <changelog author="michael@stroeder.com" date="1516363200">- update to 1.6.8 (bsc#1076963)
  patch for CVE-2017-15105: vulnerability in the processing of
  wildcard synthesized NSEC records.</changelog>
  <changelog author="dmueller@suse.com" date="1539691200">- adjust for root KSK rollover (bsc#1112009, bsc#1004165)</changelog>
  <changelog author="kbabioch@suse.com" date="1539691201">- Disabled DLV configuration by default (bsc#1055060)
- Updated the DNSSEC root trust anchor due to KSK roll over (bsc#1112009)</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1542283200">- Migrated from cron to systemd timers (bsc#1115417)</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1546603200">- Use systemd-tmpfiles to create /var/lib/unbound/root.key
  to avoid transactional update breakage (bsc#1111383)</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1551960000">- Remove old pwdutils dependency and add shadow to cover both useradd
  and groupadd as suggested in (bsc#1126757)</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1556020800">- Add systemd require in unbound-anchor to reflect new dependency (due to systemd-timers)</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1592913600">- Avoid amplifying an incoming query to a large number of queries
  Resolves CVE-2020-12662 CVE-2020-12663 (bsc#1171889)
  [ + unbound-1.6.8-amplifying-an-incoming-query.patch ]</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1592913601">- Avoid shell code execution after receiving a specially crafted answer
  Resolves CVE-2019-18934 (bsc#1157268)
  [ + patch_cve_2019-18934.patch ]</changelog>
  <changelog author="werner@suse.de" date="1642420800">- Add patches
  * bsc1185382_CVE-2019-25031_f8875527.patch
    bsc#1185382 for CVE-2019-25031
    configuration injection in create_unbound_ad_servers.sh upon a successful man-in-the-middle attack
  * bsc1185383.4_CVE-2019-25032.3_226298bb.patch
    bsc#1185383 for CVE-2019-25032
    integer overflow in the regional allocator via regional_alloc
    bsc#1185384 for CVE-2019-25033
    integer overflow in the regional allocator via the ALIGN_UP macro
  * bsc1185385_CVE-2019-25034_a3545867.patch
    bsc#1185385 for CVE-2019-25034
    integer overflow in sldns_str2wire_dname_buf_origin, leading to an out-of-bounds write
  * bsc1185386.7_CVE-2019-25035.6_fa23ee8f.patch
    bsc#1185386 for CVE-2019-25035
    out-of-bounds write in sldns_bget_token_par
    bsc#1185387 for CVE-2019-25036
    assertion failure and denial of service in synth_cname
  * bsc1185391.2_CVE-2019-25040.1_2d444a50.patch
    bsc#1185391 for CVE-2019-25040
    infinite loop via a compressed name in dname_pkt_copy
    bsc#1185392 for CVE-2019-25041
    assertion failure via a compressed name in dname_pkt_copy
  * bsc1185389.90_CVE-2019-25038.9_02080f6b.patch
    bsc#1185389 for CVE-2019-25038
    integer overflow in a size calculation in dnscrypt/dnscrypt.c
    bsc#1185390 for CVE-2019-25039
    integer overflow in a size calculation in respip/respip.c
  * bsc1185388_CVE-2019-25037_d2eb78e8.patch
    bsc#1185388 for CVE-2019-25037
    assertion failure and denial of service in dname_pkt_copy via an invalid packet
  * bsc1185393_CVE-2019-25042_6c3a0b54.patch
    bsc#1185393 for CVE-2019-25042
    out-of-bounds write via a compressed name in rdata_copy
- Correct indentation in patch unbound-1.6.8-amplifying-an-incoming-query.patch
  to make it fit to above patches</changelog>
  <changelog author="werner@suse.de" date="1642593600">- Add patch bsc1179191_CVE-2020-28935_19f8f4d9.patch to really fix
  bsc#1179191 CVE-2020-28935: unbound: symbolic link traversal when
  writing PID file</changelog>
  <changelog author="werner@suse.de" date="1642593601">- Import changes from OBS for dlv.isc.org.key, root.anchor, and
  root.key to fix bsc#1112033</changelog>
</package>
<package pkgid="7cf8b616bbf750375c8c45c2dd0c58b2814856a805d1cc266e72b57ecbfa6b1f" name="unbound" arch="s390x">
  <version epoch="0" ver="1.6.8" rel="10.6.1"/>
  <changelog author="michael@stroeder.com" date="1497441600">- update to 1.6.3
  Bug Fixes
- Fix #1280: Unbound fails assert when response from authoritative
  contains malformed qname. When 0x20 caps-for-id is enabled, when
  assertions are not enabled the malformed qname is handled correctly.</changelog>
  <changelog author="michael@stroeder.com" date="1498564800">- update to 1.6.4
  Features:
- Implemented trust anchor signaling using key tag query.
- unbound-checkconf -o allows query of dnstap config variables.
  Also unbound-control get_option.  Also for dnscrypt.
- unbound.h exports the shm stats structures.  They use
  type long long and no ifdefs, and ub_ before the typenames.
- Implemented opportunistic IPsec support module (ipsecmod).
- Added redirect-bogus.patch to contrib directory.
- Support for the ED25519 algorithm with openssl (from openssl 1.1.1).
- renumbering B-Root's IPv6 address to 2001:500:200::b.
- Fix #1276: [dnscrypt] add XChaCha20-Poly1305 cipher.
- Fix #1277: disable domain ratelimit by setting value to 0.
- Added fastrpz patch to contrib
  Bug Fixes:
- Added ECS unit test (from Manu Bretelle).
- ECS documentation fix (from Manu Bretelle).
- Fix #1252: more indentation inconsistencies.
- Fix #1253: unused variable in edns-subnet/addrtree.c:getbit().
- Fix #1254: clarify ratelimit-{for,below}-domain (from Manu Bretelle).
- iana portlist update
- Based on #1257: check parse limit before t increment in sldns RR
  string parse routine.
- Fix #1258: Windows 10 X64 unbound 1.6.2 service will not start.
  and fix that 64bit getting installed in C:\Program Files (x86).
- Fix #1259: "--disable-ecdsa" argument overwritten
  by "#ifdef SHA256_DIGEST_LENGTH@daemon/remote.c".
- iana portlist update
- Added test for leak of stub information.
- Fix sldns wire2str printout of RR type CAA tags.
- Fix sldns int16_data parse.
- Fix sldns parse and printout of TSIG RRs.
- sldns SMIMEA and AVC definitions, same as getdns definitions.
- Fix tcp-mss failure printout text.
- Set SO_REUSEADDR on outgoing tcp connections to fix the bind before
  connect limited tcp connections.  With the option tcp connections
  can share the same source port (for different destinations).
- Add 'c' to getopt() in testbound.
- Adjust servfail by iterator to not store in cache when serve-expired
  is enabled, to avoid overwriting useful information there.
- Fix queries for nameservers under a stub leaking to the internet.
- document trust-anchor-signaling in example config file.
- updated configure, dependencies and flex output.
- better module memory lookup, fix of unbound-control shm names for
  module memory printout of statistics.
- Fix type AVC sldns rrdef.
- Some whitespace fixup.
- Fix #1265: contrib/unbound.service contains hardcoded path.
- Fix #1265 to use /bin/kill.
- Fix #1267: Libunbound validator/val_secalgo.c uses obsolete APIs,
  and compatibility with BoringSSL.
- Fix #1268: SIGSEGV after log_reopen.
- exec_prefix is by default equal to prefix.
- printout localzone for duplicate local-zone warnings.
- Fix assertion for low buffer size and big edns payload when worker
  overrides udpsize.
- Support for openssl EVP_DigestVerify.
- Fix #1269: inconsistent use of built-in local zones with views.
- Add defaults for new local-zone trees added to views using
  unbound-control.
- Fix #1273: cachedb.c doesn't compile with -Wextra.
- If MSG_FASTOPEN gives EPIPE fallthrough to try normal tcp write.
- Also use global local-zones when there is a matching view that does
  not have any local-zone specified.
- Fix fastopen EPIPE fallthrough to perform connect.
- Fix #1274: automatically trim chroot path from dnscrypt key/cert paths
  (from Manu Bretelle).
- Fix #1275: cached data in cachedb is never used.
- Fix that unbound-control can set val_clean_additional and
  val_permissive_mode.
- Add dnscrypt XChaCha20 tests.
- Detect chacha for dnscrypt at configure time.
- dnscrypt unit tests with chacha.
- Added domain name based ECS whitelist.
- Fix #1278: Incomplete wildcard proof.
- Fix #1279: Memory leak on reload when python module is enabled.
- Fix #1280: Unbound fails assert when response from authoritative
  contains malformed qname.  When 0x20 caps-for-id is enabled, when
  assertions are not enabled the malformed qname is handled correctly.
- More fixes in depth for buffer checks in 0x20 qname checks.
- Fix stub zone queries leaking to the internet for
  harden-referral-path ns checks.
- Fix query for refetch_glue of stub leaking to internet.
- Fix #1301: memory leak in respip and tests.
- Free callback in edns-subnetmod on exit and restart.
- Fix memory leak in sldns_buffer_new_frm_data.
- Fix memory leak in dnscrypt config read.
- Fix dnscrypt chacha cert support ifdefs.
- Fix dnscrypt chacha cert unit test escapes in grep.
- Fix to unlock view in view test.
- Fix warning in pythonmod under clang compiler.
- Fix lintian typo.
- Fix #1316: heap read buffer overflow in parse_edns_options.</changelog>
  <changelog author="jengelh@inai.de" date="1502193600">- RPM group fix. Do not suppress user/group creation problems.
  Replace %__ type macro indirections.</changelog>
  <changelog author="michael@stroeder.com" date="1503316800">- update to 1.6.5
  * Fix install of trust anchor when two anchors are present, makes both
    valid.  Checks hash of DS but not signature of new key.  This fixes
    installs between sep11 and oct11 2017.</changelog>
  <changelog author="michael@stroeder.com" date="1504526400">- update to 1.6.6
  Features:
- unbound-control dump_infra prints port number for address if not 53.
- Fix #1344: RFC6761-reserved domains: test. and invalid.
- Fix #1349: allow suppression of pidfiles (from Daniel Kahn Gillmor).
  With the -p option unbound does not create a pidfile.
- Added stats for queries that have been ratelimited by domain
  recursion.
- Patch to show DNSCrypt status in help output, from Carsten
  Strotmann.
- Fix #1407: Add ECS options check to unbound-checkconf.
- Fix #1415: [dnscrypt] shared secret cache, patch from
  Manu Bretelle.
  Bug Fixes:
- fixup of dnscrypt_cert_chacha test (from Manu Bretelle).
- First fix for zero b64 and hex text zone format in sldns.
- Better fixup of dnscrypt_cert_chacha test for different escapes.
- Fix that infra cache host hash does not change after reconfig.
- Fix python example0 return module wait instead of error for pass.
- enhancement for hardened-tls for DNS over TLS.  Removed duplicated
  security settings.
- Fix for unbound-checkconf, check ipsecmod-hook if ipsecmod is turned
  on.
- Fix #1331: libunbound segfault in threaded mode when context is
  deleted.
- Fix pythonmod link line option flag.
- Fix openssl 1.1.0 load of ssl error strings from ssl init.
- Fix 1332: Bump verbosity of failed chown'ing of the control socket.
- Redirect all localhost names to localhost address for RFC6761.
- Fix #1350: make cachedb backend configurable (from JINMEI Tatuya).
- Fix tests to use .tdir (from Manu Bretelle) instead of .tpkg.
- upgrade aclocal(pkg.m4 0.29.1), config.guess(2016-10-02),
  config.sub(2016-09-05).
- annotate case statement fallthrough for gcc 7.1.1.
- flex output from flex 2.6.1.
- snprintf of thread number does not warn about truncated string.
- squelch TCP fast open error on FreeBSD when kernel has it disabled,
  unless verbosity is high.
- remove warning from windows compile.
- Fix compile with libnettle
- Fix DSA configure switch (--disable dsa) for libnettle and libnss.
- Fix #1365: Add Ed25519 support using libnettle.
- Fix #1394: mix of serve-expired and response-ip could cause a crash.
- Remove unused iter_env member (ip6arpa_dname)
- Do not reset rrset.bogus stats when called using stats_noreset.
- Do not add rrset_bogus and query ratelimiting stats per thread, these
  module stats are global.
- Fix #1397: Recursive DS lookups for AS112 zones names should recurse.
- Fix #1398: make cachedb secret configurable.
- Remove spaces from Makefile.
- Fix issue on macOX 10.10 where TCP fast open is detected but not
  implemented causing TCP to fail. The fix allows fallback to regular
  TCP in this case and is also more robust for cases where connectx()
  fails for some reason.
- Fix #1402: squelch invalid argument error for fd_set_block on windows.
- Fix to reclaim tcp handler when it is closed due to dnscrypt buffer
  allocation failure.
- Fix #1415: patch to free dnscrypt environment on reload.
- iana portlist update
- Small fixes for the shared secret cache patch.
- Fix WKS records on kvm autobuild host, with default protobyname
  entries for udp and tcp.
- Fix #1414: fix segfault on parse failure and log_replies.
- zero qinfo in handle_request, this zeroes local_alias and also the
  qname member.
- new keys and certs for dnscrypt tests.
- fixup WKS test on buildhost without servicebyname.
- updated contrib/fastrpz.patch to apply with configparser changes.
- Fix 1416: qname-minimisation breaks TLSA lookups with CNAMEs.
- Fix #1424: cachedb:testframe is not thread safe.
- Fix #1417: [dnscrypt] shared secret cache counters, and works when
  dnscrypt is not enabled.  And cache size configuration option.
- Fix #1418: [ip ratelimit] initialize slabhash using
  ip-ratelimit-slabs.
- Recommend 1472 buffer size in unbound.conf</changelog>
  <changelog author="michael@stroeder.com" date="1507636800">- update to 1.6.7
  Features:
- Set trust-anchor-signaling default to yes
- Fix #1440: [dnscrypt] client nonce cache.
- Fix #1435: Please allow UDP to be disabled separately upstream and
  downstream.
  Bug fixes:
- Fix that looping modules always stop the query, and don't pass
  control.
- Fix unbound-host to report error for DNSSEC state of failed lookups.
- Spelling fixes, from Josh Soref.
- Fix #1400: allowing use of global cache on ECS-forwarding unless
  always-forward.
- use a cachedb answer even if it's "expired" when serve-expired is yes
  (patch from Jinmei Tatuya).
- trigger refetching of the answer in that case (this will bypass
  cachedb lookup)
- allow storing a 0-TTL answer from cachedb in the in-memory message
  cache when serve-expired is yes
- Fix DNSCACHE_STORE_ZEROTTL to be bigger than 0xffff.
- Log name of looping module
- Fix #1450: Generate again patch contrib/aaaa-filter-iterator.patch
  (by Danilo G. Baio).
- Fix param unused warning for windows exportsymbol compile.
- Use RCODE from A query on DNS64 synthesized answer.
- Fix trust-anchor-signaling works in libunbound.
- Fix spelling in unbound-control man page.</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="cbosdonnat@suse.com" date="1512129600">- Use python3 instead of python2 (fate#323526)</changelog>
  <changelog author="michael@stroeder.com" date="1516363200">- update to 1.6.8 (bsc#1076963)
  patch for CVE-2017-15105: vulnerability in the processing of
  wildcard synthesized NSEC records.</changelog>
  <changelog author="dmueller@suse.com" date="1539691200">- adjust for root KSK rollover (bsc#1112009, bsc#1004165)</changelog>
  <changelog author="kbabioch@suse.com" date="1539691201">- Disabled DLV configuration by default (bsc#1055060)
- Updated the DNSSEC root trust anchor due to KSK roll over (bsc#1112009)</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1542283200">- Migrated from cron to systemd timers (bsc#1115417)</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1546603200">- Use systemd-tmpfiles to create /var/lib/unbound/root.key
  to avoid transactional update breakage (bsc#1111383)</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1551960000">- Remove old pwdutils dependency and add shadow to cover both useradd
  and groupadd as suggested in (bsc#1126757)</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1556020800">- Add systemd require in unbound-anchor to reflect new dependency (due to systemd-timers)</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1592913600">- Avoid amplifying an incoming query to a large number of queries
  Resolves CVE-2020-12662 CVE-2020-12663 (bsc#1171889)
  [ + unbound-1.6.8-amplifying-an-incoming-query.patch ]</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1592913601">- Avoid shell code execution after receiving a specially crafted answer
  Resolves CVE-2019-18934 (bsc#1157268)
  [ + patch_cve_2019-18934.patch ]</changelog>
  <changelog author="werner@suse.de" date="1642420800">- Add patches
  * bsc1185382_CVE-2019-25031_f8875527.patch
    bsc#1185382 for CVE-2019-25031
    configuration injection in create_unbound_ad_servers.sh upon a successful man-in-the-middle attack
  * bsc1185383.4_CVE-2019-25032.3_226298bb.patch
    bsc#1185383 for CVE-2019-25032
    integer overflow in the regional allocator via regional_alloc
    bsc#1185384 for CVE-2019-25033
    integer overflow in the regional allocator via the ALIGN_UP macro
  * bsc1185385_CVE-2019-25034_a3545867.patch
    bsc#1185385 for CVE-2019-25034
    integer overflow in sldns_str2wire_dname_buf_origin, leading to an out-of-bounds write
  * bsc1185386.7_CVE-2019-25035.6_fa23ee8f.patch
    bsc#1185386 for CVE-2019-25035
    out-of-bounds write in sldns_bget_token_par
    bsc#1185387 for CVE-2019-25036
    assertion failure and denial of service in synth_cname
  * bsc1185391.2_CVE-2019-25040.1_2d444a50.patch
    bsc#1185391 for CVE-2019-25040
    infinite loop via a compressed name in dname_pkt_copy
    bsc#1185392 for CVE-2019-25041
    assertion failure via a compressed name in dname_pkt_copy
  * bsc1185389.90_CVE-2019-25038.9_02080f6b.patch
    bsc#1185389 for CVE-2019-25038
    integer overflow in a size calculation in dnscrypt/dnscrypt.c
    bsc#1185390 for CVE-2019-25039
    integer overflow in a size calculation in respip/respip.c
  * bsc1185388_CVE-2019-25037_d2eb78e8.patch
    bsc#1185388 for CVE-2019-25037
    assertion failure and denial of service in dname_pkt_copy via an invalid packet
  * bsc1185393_CVE-2019-25042_6c3a0b54.patch
    bsc#1185393 for CVE-2019-25042
    out-of-bounds write via a compressed name in rdata_copy
- Correct indentation in patch unbound-1.6.8-amplifying-an-incoming-query.patch
  to make it fit to above patches</changelog>
  <changelog author="werner@suse.de" date="1642593600">- Add patch bsc1179191_CVE-2020-28935_19f8f4d9.patch to really fix
  bsc#1179191 CVE-2020-28935: unbound: symbolic link traversal when
  writing PID file</changelog>
  <changelog author="werner@suse.de" date="1642593601">- Import changes from OBS for dlv.isc.org.key, root.anchor, and
  root.key to fix bsc#1112033</changelog>
</package>
<package pkgid="eba6b40c9c226043a612ce9bd2ba4c832a243847df59efb59cd0608c8992063f" name="unbound" arch="src">
  <version epoch="0" ver="1.6.8" rel="10.6.1"/>
  <changelog author="michael@stroeder.com" date="1497441600">- update to 1.6.3
  Bug Fixes
- Fix #1280: Unbound fails assert when response from authoritative
  contains malformed qname. When 0x20 caps-for-id is enabled, when
  assertions are not enabled the malformed qname is handled correctly.</changelog>
  <changelog author="michael@stroeder.com" date="1498564800">- update to 1.6.4
  Features:
- Implemented trust anchor signaling using key tag query.
- unbound-checkconf -o allows query of dnstap config variables.
  Also unbound-control get_option.  Also for dnscrypt.
- unbound.h exports the shm stats structures.  They use
  type long long and no ifdefs, and ub_ before the typenames.
- Implemented opportunistic IPsec support module (ipsecmod).
- Added redirect-bogus.patch to contrib directory.
- Support for the ED25519 algorithm with openssl (from openssl 1.1.1).
- renumbering B-Root's IPv6 address to 2001:500:200::b.
- Fix #1276: [dnscrypt] add XChaCha20-Poly1305 cipher.
- Fix #1277: disable domain ratelimit by setting value to 0.
- Added fastrpz patch to contrib
  Bug Fixes:
- Added ECS unit test (from Manu Bretelle).
- ECS documentation fix (from Manu Bretelle).
- Fix #1252: more indentation inconsistencies.
- Fix #1253: unused variable in edns-subnet/addrtree.c:getbit().
- Fix #1254: clarify ratelimit-{for,below}-domain (from Manu Bretelle).
- iana portlist update
- Based on #1257: check parse limit before t increment in sldns RR
  string parse routine.
- Fix #1258: Windows 10 X64 unbound 1.6.2 service will not start.
  and fix that 64bit getting installed in C:\Program Files (x86).
- Fix #1259: "--disable-ecdsa" argument overwritten
  by "#ifdef SHA256_DIGEST_LENGTH@daemon/remote.c".
- iana portlist update
- Added test for leak of stub information.
- Fix sldns wire2str printout of RR type CAA tags.
- Fix sldns int16_data parse.
- Fix sldns parse and printout of TSIG RRs.
- sldns SMIMEA and AVC definitions, same as getdns definitions.
- Fix tcp-mss failure printout text.
- Set SO_REUSEADDR on outgoing tcp connections to fix the bind before
  connect limited tcp connections.  With the option tcp connections
  can share the same source port (for different destinations).
- Add 'c' to getopt() in testbound.
- Adjust servfail by iterator to not store in cache when serve-expired
  is enabled, to avoid overwriting useful information there.
- Fix queries for nameservers under a stub leaking to the internet.
- document trust-anchor-signaling in example config file.
- updated configure, dependencies and flex output.
- better module memory lookup, fix of unbound-control shm names for
  module memory printout of statistics.
- Fix type AVC sldns rrdef.
- Some whitespace fixup.
- Fix #1265: contrib/unbound.service contains hardcoded path.
- Fix #1265 to use /bin/kill.
- Fix #1267: Libunbound validator/val_secalgo.c uses obsolete APIs,
  and compatibility with BoringSSL.
- Fix #1268: SIGSEGV after log_reopen.
- exec_prefix is by default equal to prefix.
- printout localzone for duplicate local-zone warnings.
- Fix assertion for low buffer size and big edns payload when worker
  overrides udpsize.
- Support for openssl EVP_DigestVerify.
- Fix #1269: inconsistent use of built-in local zones with views.
- Add defaults for new local-zone trees added to views using
  unbound-control.
- Fix #1273: cachedb.c doesn't compile with -Wextra.
- If MSG_FASTOPEN gives EPIPE fallthrough to try normal tcp write.
- Also use global local-zones when there is a matching view that does
  not have any local-zone specified.
- Fix fastopen EPIPE fallthrough to perform connect.
- Fix #1274: automatically trim chroot path from dnscrypt key/cert paths
  (from Manu Bretelle).
- Fix #1275: cached data in cachedb is never used.
- Fix that unbound-control can set val_clean_additional and
  val_permissive_mode.
- Add dnscrypt XChaCha20 tests.
- Detect chacha for dnscrypt at configure time.
- dnscrypt unit tests with chacha.
- Added domain name based ECS whitelist.
- Fix #1278: Incomplete wildcard proof.
- Fix #1279: Memory leak on reload when python module is enabled.
- Fix #1280: Unbound fails assert when response from authoritative
  contains malformed qname.  When 0x20 caps-for-id is enabled, when
  assertions are not enabled the malformed qname is handled correctly.
- More fixes in depth for buffer checks in 0x20 qname checks.
- Fix stub zone queries leaking to the internet for
  harden-referral-path ns checks.
- Fix query for refetch_glue of stub leaking to internet.
- Fix #1301: memory leak in respip and tests.
- Free callback in edns-subnetmod on exit and restart.
- Fix memory leak in sldns_buffer_new_frm_data.
- Fix memory leak in dnscrypt config read.
- Fix dnscrypt chacha cert support ifdefs.
- Fix dnscrypt chacha cert unit test escapes in grep.
- Fix to unlock view in view test.
- Fix warning in pythonmod under clang compiler.
- Fix lintian typo.
- Fix #1316: heap read buffer overflow in parse_edns_options.</changelog>
  <changelog author="jengelh@inai.de" date="1502193600">- RPM group fix. Do not suppress user/group creation problems.
  Replace %__ type macro indirections.</changelog>
  <changelog author="michael@stroeder.com" date="1503316800">- update to 1.6.5
  * Fix install of trust anchor when two anchors are present, makes both
    valid.  Checks hash of DS but not signature of new key.  This fixes
    installs between sep11 and oct11 2017.</changelog>
  <changelog author="michael@stroeder.com" date="1504526400">- update to 1.6.6
  Features:
- unbound-control dump_infra prints port number for address if not 53.
- Fix #1344: RFC6761-reserved domains: test. and invalid.
- Fix #1349: allow suppression of pidfiles (from Daniel Kahn Gillmor).
  With the -p option unbound does not create a pidfile.
- Added stats for queries that have been ratelimited by domain
  recursion.
- Patch to show DNSCrypt status in help output, from Carsten
  Strotmann.
- Fix #1407: Add ECS options check to unbound-checkconf.
- Fix #1415: [dnscrypt] shared secret cache, patch from
  Manu Bretelle.
  Bug Fixes:
- fixup of dnscrypt_cert_chacha test (from Manu Bretelle).
- First fix for zero b64 and hex text zone format in sldns.
- Better fixup of dnscrypt_cert_chacha test for different escapes.
- Fix that infra cache host hash does not change after reconfig.
- Fix python example0 return module wait instead of error for pass.
- enhancement for hardened-tls for DNS over TLS.  Removed duplicated
  security settings.
- Fix for unbound-checkconf, check ipsecmod-hook if ipsecmod is turned
  on.
- Fix #1331: libunbound segfault in threaded mode when context is
  deleted.
- Fix pythonmod link line option flag.
- Fix openssl 1.1.0 load of ssl error strings from ssl init.
- Fix 1332: Bump verbosity of failed chown'ing of the control socket.
- Redirect all localhost names to localhost address for RFC6761.
- Fix #1350: make cachedb backend configurable (from JINMEI Tatuya).
- Fix tests to use .tdir (from Manu Bretelle) instead of .tpkg.
- upgrade aclocal(pkg.m4 0.29.1), config.guess(2016-10-02),
  config.sub(2016-09-05).
- annotate case statement fallthrough for gcc 7.1.1.
- flex output from flex 2.6.1.
- snprintf of thread number does not warn about truncated string.
- squelch TCP fast open error on FreeBSD when kernel has it disabled,
  unless verbosity is high.
- remove warning from windows compile.
- Fix compile with libnettle
- Fix DSA configure switch (--disable dsa) for libnettle and libnss.
- Fix #1365: Add Ed25519 support using libnettle.
- Fix #1394: mix of serve-expired and response-ip could cause a crash.
- Remove unused iter_env member (ip6arpa_dname)
- Do not reset rrset.bogus stats when called using stats_noreset.
- Do not add rrset_bogus and query ratelimiting stats per thread, these
  module stats are global.
- Fix #1397: Recursive DS lookups for AS112 zones names should recurse.
- Fix #1398: make cachedb secret configurable.
- Remove spaces from Makefile.
- Fix issue on macOX 10.10 where TCP fast open is detected but not
  implemented causing TCP to fail. The fix allows fallback to regular
  TCP in this case and is also more robust for cases where connectx()
  fails for some reason.
- Fix #1402: squelch invalid argument error for fd_set_block on windows.
- Fix to reclaim tcp handler when it is closed due to dnscrypt buffer
  allocation failure.
- Fix #1415: patch to free dnscrypt environment on reload.
- iana portlist update
- Small fixes for the shared secret cache patch.
- Fix WKS records on kvm autobuild host, with default protobyname
  entries for udp and tcp.
- Fix #1414: fix segfault on parse failure and log_replies.
- zero qinfo in handle_request, this zeroes local_alias and also the
  qname member.
- new keys and certs for dnscrypt tests.
- fixup WKS test on buildhost without servicebyname.
- updated contrib/fastrpz.patch to apply with configparser changes.
- Fix 1416: qname-minimisation breaks TLSA lookups with CNAMEs.
- Fix #1424: cachedb:testframe is not thread safe.
- Fix #1417: [dnscrypt] shared secret cache counters, and works when
  dnscrypt is not enabled.  And cache size configuration option.
- Fix #1418: [ip ratelimit] initialize slabhash using
  ip-ratelimit-slabs.
- Recommend 1472 buffer size in unbound.conf</changelog>
  <changelog author="michael@stroeder.com" date="1507636800">- update to 1.6.7
  Features:
- Set trust-anchor-signaling default to yes
- Fix #1440: [dnscrypt] client nonce cache.
- Fix #1435: Please allow UDP to be disabled separately upstream and
  downstream.
  Bug fixes:
- Fix that looping modules always stop the query, and don't pass
  control.
- Fix unbound-host to report error for DNSSEC state of failed lookups.
- Spelling fixes, from Josh Soref.
- Fix #1400: allowing use of global cache on ECS-forwarding unless
  always-forward.
- use a cachedb answer even if it's "expired" when serve-expired is yes
  (patch from Jinmei Tatuya).
- trigger refetching of the answer in that case (this will bypass
  cachedb lookup)
- allow storing a 0-TTL answer from cachedb in the in-memory message
  cache when serve-expired is yes
- Fix DNSCACHE_STORE_ZEROTTL to be bigger than 0xffff.
- Log name of looping module
- Fix #1450: Generate again patch contrib/aaaa-filter-iterator.patch
  (by Danilo G. Baio).
- Fix param unused warning for windows exportsymbol compile.
- Use RCODE from A query on DNS64 synthesized answer.
- Fix trust-anchor-signaling works in libunbound.
- Fix spelling in unbound-control man page.</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="cbosdonnat@suse.com" date="1512129600">- Use python3 instead of python2 (fate#323526)</changelog>
  <changelog author="michael@stroeder.com" date="1516363200">- update to 1.6.8 (bsc#1076963)
  patch for CVE-2017-15105: vulnerability in the processing of
  wildcard synthesized NSEC records.</changelog>
  <changelog author="dmueller@suse.com" date="1539691200">- adjust for root KSK rollover (bsc#1112009, bsc#1004165)</changelog>
  <changelog author="kbabioch@suse.com" date="1539691201">- Disabled DLV configuration by default (bsc#1055060)
- Updated the DNSSEC root trust anchor due to KSK roll over (bsc#1112009)</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1542283200">- Migrated from cron to systemd timers (bsc#1115417)</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1546603200">- Use systemd-tmpfiles to create /var/lib/unbound/root.key
  to avoid transactional update breakage (bsc#1111383)</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1551960000">- Remove old pwdutils dependency and add shadow to cover both useradd
  and groupadd as suggested in (bsc#1126757)</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1556020800">- Add systemd require in unbound-anchor to reflect new dependency (due to systemd-timers)</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1592913600">- Avoid amplifying an incoming query to a large number of queries
  Resolves CVE-2020-12662 CVE-2020-12663 (bsc#1171889)
  [ + unbound-1.6.8-amplifying-an-incoming-query.patch ]</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1592913601">- Avoid shell code execution after receiving a specially crafted answer
  Resolves CVE-2019-18934 (bsc#1157268)
  [ + patch_cve_2019-18934.patch ]</changelog>
  <changelog author="werner@suse.de" date="1642420800">- Add patches
  * bsc1185382_CVE-2019-25031_f8875527.patch
    bsc#1185382 for CVE-2019-25031
    configuration injection in create_unbound_ad_servers.sh upon a successful man-in-the-middle attack
  * bsc1185383.4_CVE-2019-25032.3_226298bb.patch
    bsc#1185383 for CVE-2019-25032
    integer overflow in the regional allocator via regional_alloc
    bsc#1185384 for CVE-2019-25033
    integer overflow in the regional allocator via the ALIGN_UP macro
  * bsc1185385_CVE-2019-25034_a3545867.patch
    bsc#1185385 for CVE-2019-25034
    integer overflow in sldns_str2wire_dname_buf_origin, leading to an out-of-bounds write
  * bsc1185386.7_CVE-2019-25035.6_fa23ee8f.patch
    bsc#1185386 for CVE-2019-25035
    out-of-bounds write in sldns_bget_token_par
    bsc#1185387 for CVE-2019-25036
    assertion failure and denial of service in synth_cname
  * bsc1185391.2_CVE-2019-25040.1_2d444a50.patch
    bsc#1185391 for CVE-2019-25040
    infinite loop via a compressed name in dname_pkt_copy
    bsc#1185392 for CVE-2019-25041
    assertion failure via a compressed name in dname_pkt_copy
  * bsc1185389.90_CVE-2019-25038.9_02080f6b.patch
    bsc#1185389 for CVE-2019-25038
    integer overflow in a size calculation in dnscrypt/dnscrypt.c
    bsc#1185390 for CVE-2019-25039
    integer overflow in a size calculation in respip/respip.c
  * bsc1185388_CVE-2019-25037_d2eb78e8.patch
    bsc#1185388 for CVE-2019-25037
    assertion failure and denial of service in dname_pkt_copy via an invalid packet
  * bsc1185393_CVE-2019-25042_6c3a0b54.patch
    bsc#1185393 for CVE-2019-25042
    out-of-bounds write via a compressed name in rdata_copy
- Correct indentation in patch unbound-1.6.8-amplifying-an-incoming-query.patch
  to make it fit to above patches</changelog>
  <changelog author="werner@suse.de" date="1642593600">- Add patch bsc1179191_CVE-2020-28935_19f8f4d9.patch to really fix
  bsc#1179191 CVE-2020-28935: unbound: symbolic link traversal when
  writing PID file</changelog>
  <changelog author="werner@suse.de" date="1642593601">- Import changes from OBS for dlv.isc.org.key, root.anchor, and
  root.key to fix bsc#1112033</changelog>
</package>
<package pkgid="31eac4f41fc3336349df4f8572e3c52e440379ddea0c246d5d09dd7939366f83" name="unbound" arch="x86_64">
  <version epoch="0" ver="1.6.8" rel="10.6.1"/>
  <changelog author="michael@stroeder.com" date="1497441600">- update to 1.6.3
  Bug Fixes
- Fix #1280: Unbound fails assert when response from authoritative
  contains malformed qname. When 0x20 caps-for-id is enabled, when
  assertions are not enabled the malformed qname is handled correctly.</changelog>
  <changelog author="michael@stroeder.com" date="1498564800">- update to 1.6.4
  Features:
- Implemented trust anchor signaling using key tag query.
- unbound-checkconf -o allows query of dnstap config variables.
  Also unbound-control get_option.  Also for dnscrypt.
- unbound.h exports the shm stats structures.  They use
  type long long and no ifdefs, and ub_ before the typenames.
- Implemented opportunistic IPsec support module (ipsecmod).
- Added redirect-bogus.patch to contrib directory.
- Support for the ED25519 algorithm with openssl (from openssl 1.1.1).
- renumbering B-Root's IPv6 address to 2001:500:200::b.
- Fix #1276: [dnscrypt] add XChaCha20-Poly1305 cipher.
- Fix #1277: disable domain ratelimit by setting value to 0.
- Added fastrpz patch to contrib
  Bug Fixes:
- Added ECS unit test (from Manu Bretelle).
- ECS documentation fix (from Manu Bretelle).
- Fix #1252: more indentation inconsistencies.
- Fix #1253: unused variable in edns-subnet/addrtree.c:getbit().
- Fix #1254: clarify ratelimit-{for,below}-domain (from Manu Bretelle).
- iana portlist update
- Based on #1257: check parse limit before t increment in sldns RR
  string parse routine.
- Fix #1258: Windows 10 X64 unbound 1.6.2 service will not start.
  and fix that 64bit getting installed in C:\Program Files (x86).
- Fix #1259: "--disable-ecdsa" argument overwritten
  by "#ifdef SHA256_DIGEST_LENGTH@daemon/remote.c".
- iana portlist update
- Added test for leak of stub information.
- Fix sldns wire2str printout of RR type CAA tags.
- Fix sldns int16_data parse.
- Fix sldns parse and printout of TSIG RRs.
- sldns SMIMEA and AVC definitions, same as getdns definitions.
- Fix tcp-mss failure printout text.
- Set SO_REUSEADDR on outgoing tcp connections to fix the bind before
  connect limited tcp connections.  With the option tcp connections
  can share the same source port (for different destinations).
- Add 'c' to getopt() in testbound.
- Adjust servfail by iterator to not store in cache when serve-expired
  is enabled, to avoid overwriting useful information there.
- Fix queries for nameservers under a stub leaking to the internet.
- document trust-anchor-signaling in example config file.
- updated configure, dependencies and flex output.
- better module memory lookup, fix of unbound-control shm names for
  module memory printout of statistics.
- Fix type AVC sldns rrdef.
- Some whitespace fixup.
- Fix #1265: contrib/unbound.service contains hardcoded path.
- Fix #1265 to use /bin/kill.
- Fix #1267: Libunbound validator/val_secalgo.c uses obsolete APIs,
  and compatibility with BoringSSL.
- Fix #1268: SIGSEGV after log_reopen.
- exec_prefix is by default equal to prefix.
- printout localzone for duplicate local-zone warnings.
- Fix assertion for low buffer size and big edns payload when worker
  overrides udpsize.
- Support for openssl EVP_DigestVerify.
- Fix #1269: inconsistent use of built-in local zones with views.
- Add defaults for new local-zone trees added to views using
  unbound-control.
- Fix #1273: cachedb.c doesn't compile with -Wextra.
- If MSG_FASTOPEN gives EPIPE fallthrough to try normal tcp write.
- Also use global local-zones when there is a matching view that does
  not have any local-zone specified.
- Fix fastopen EPIPE fallthrough to perform connect.
- Fix #1274: automatically trim chroot path from dnscrypt key/cert paths
  (from Manu Bretelle).
- Fix #1275: cached data in cachedb is never used.
- Fix that unbound-control can set val_clean_additional and
  val_permissive_mode.
- Add dnscrypt XChaCha20 tests.
- Detect chacha for dnscrypt at configure time.
- dnscrypt unit tests with chacha.
- Added domain name based ECS whitelist.
- Fix #1278: Incomplete wildcard proof.
- Fix #1279: Memory leak on reload when python module is enabled.
- Fix #1280: Unbound fails assert when response from authoritative
  contains malformed qname.  When 0x20 caps-for-id is enabled, when
  assertions are not enabled the malformed qname is handled correctly.
- More fixes in depth for buffer checks in 0x20 qname checks.
- Fix stub zone queries leaking to the internet for
  harden-referral-path ns checks.
- Fix query for refetch_glue of stub leaking to internet.
- Fix #1301: memory leak in respip and tests.
- Free callback in edns-subnetmod on exit and restart.
- Fix memory leak in sldns_buffer_new_frm_data.
- Fix memory leak in dnscrypt config read.
- Fix dnscrypt chacha cert support ifdefs.
- Fix dnscrypt chacha cert unit test escapes in grep.
- Fix to unlock view in view test.
- Fix warning in pythonmod under clang compiler.
- Fix lintian typo.
- Fix #1316: heap read buffer overflow in parse_edns_options.</changelog>
  <changelog author="jengelh@inai.de" date="1502193600">- RPM group fix. Do not suppress user/group creation problems.
  Replace %__ type macro indirections.</changelog>
  <changelog author="michael@stroeder.com" date="1503316800">- update to 1.6.5
  * Fix install of trust anchor when two anchors are present, makes both
    valid.  Checks hash of DS but not signature of new key.  This fixes
    installs between sep11 and oct11 2017.</changelog>
  <changelog author="michael@stroeder.com" date="1504526400">- update to 1.6.6
  Features:
- unbound-control dump_infra prints port number for address if not 53.
- Fix #1344: RFC6761-reserved domains: test. and invalid.
- Fix #1349: allow suppression of pidfiles (from Daniel Kahn Gillmor).
  With the -p option unbound does not create a pidfile.
- Added stats for queries that have been ratelimited by domain
  recursion.
- Patch to show DNSCrypt status in help output, from Carsten
  Strotmann.
- Fix #1407: Add ECS options check to unbound-checkconf.
- Fix #1415: [dnscrypt] shared secret cache, patch from
  Manu Bretelle.
  Bug Fixes:
- fixup of dnscrypt_cert_chacha test (from Manu Bretelle).
- First fix for zero b64 and hex text zone format in sldns.
- Better fixup of dnscrypt_cert_chacha test for different escapes.
- Fix that infra cache host hash does not change after reconfig.
- Fix python example0 return module wait instead of error for pass.
- enhancement for hardened-tls for DNS over TLS.  Removed duplicated
  security settings.
- Fix for unbound-checkconf, check ipsecmod-hook if ipsecmod is turned
  on.
- Fix #1331: libunbound segfault in threaded mode when context is
  deleted.
- Fix pythonmod link line option flag.
- Fix openssl 1.1.0 load of ssl error strings from ssl init.
- Fix 1332: Bump verbosity of failed chown'ing of the control socket.
- Redirect all localhost names to localhost address for RFC6761.
- Fix #1350: make cachedb backend configurable (from JINMEI Tatuya).
- Fix tests to use .tdir (from Manu Bretelle) instead of .tpkg.
- upgrade aclocal(pkg.m4 0.29.1), config.guess(2016-10-02),
  config.sub(2016-09-05).
- annotate case statement fallthrough for gcc 7.1.1.
- flex output from flex 2.6.1.
- snprintf of thread number does not warn about truncated string.
- squelch TCP fast open error on FreeBSD when kernel has it disabled,
  unless verbosity is high.
- remove warning from windows compile.
- Fix compile with libnettle
- Fix DSA configure switch (--disable dsa) for libnettle and libnss.
- Fix #1365: Add Ed25519 support using libnettle.
- Fix #1394: mix of serve-expired and response-ip could cause a crash.
- Remove unused iter_env member (ip6arpa_dname)
- Do not reset rrset.bogus stats when called using stats_noreset.
- Do not add rrset_bogus and query ratelimiting stats per thread, these
  module stats are global.
- Fix #1397: Recursive DS lookups for AS112 zones names should recurse.
- Fix #1398: make cachedb secret configurable.
- Remove spaces from Makefile.
- Fix issue on macOX 10.10 where TCP fast open is detected but not
  implemented causing TCP to fail. The fix allows fallback to regular
  TCP in this case and is also more robust for cases where connectx()
  fails for some reason.
- Fix #1402: squelch invalid argument error for fd_set_block on windows.
- Fix to reclaim tcp handler when it is closed due to dnscrypt buffer
  allocation failure.
- Fix #1415: patch to free dnscrypt environment on reload.
- iana portlist update
- Small fixes for the shared secret cache patch.
- Fix WKS records on kvm autobuild host, with default protobyname
  entries for udp and tcp.
- Fix #1414: fix segfault on parse failure and log_replies.
- zero qinfo in handle_request, this zeroes local_alias and also the
  qname member.
- new keys and certs for dnscrypt tests.
- fixup WKS test on buildhost without servicebyname.
- updated contrib/fastrpz.patch to apply with configparser changes.
- Fix 1416: qname-minimisation breaks TLSA lookups with CNAMEs.
- Fix #1424: cachedb:testframe is not thread safe.
- Fix #1417: [dnscrypt] shared secret cache counters, and works when
  dnscrypt is not enabled.  And cache size configuration option.
- Fix #1418: [ip ratelimit] initialize slabhash using
  ip-ratelimit-slabs.
- Recommend 1472 buffer size in unbound.conf</changelog>
  <changelog author="michael@stroeder.com" date="1507636800">- update to 1.6.7
  Features:
- Set trust-anchor-signaling default to yes
- Fix #1440: [dnscrypt] client nonce cache.
- Fix #1435: Please allow UDP to be disabled separately upstream and
  downstream.
  Bug fixes:
- Fix that looping modules always stop the query, and don't pass
  control.
- Fix unbound-host to report error for DNSSEC state of failed lookups.
- Spelling fixes, from Josh Soref.
- Fix #1400: allowing use of global cache on ECS-forwarding unless
  always-forward.
- use a cachedb answer even if it's "expired" when serve-expired is yes
  (patch from Jinmei Tatuya).
- trigger refetching of the answer in that case (this will bypass
  cachedb lookup)
- allow storing a 0-TTL answer from cachedb in the in-memory message
  cache when serve-expired is yes
- Fix DNSCACHE_STORE_ZEROTTL to be bigger than 0xffff.
- Log name of looping module
- Fix #1450: Generate again patch contrib/aaaa-filter-iterator.patch
  (by Danilo G. Baio).
- Fix param unused warning for windows exportsymbol compile.
- Use RCODE from A query on DNS64 synthesized answer.
- Fix trust-anchor-signaling works in libunbound.
- Fix spelling in unbound-control man page.</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="cbosdonnat@suse.com" date="1512129600">- Use python3 instead of python2 (fate#323526)</changelog>
  <changelog author="michael@stroeder.com" date="1516363200">- update to 1.6.8 (bsc#1076963)
  patch for CVE-2017-15105: vulnerability in the processing of
  wildcard synthesized NSEC records.</changelog>
  <changelog author="dmueller@suse.com" date="1539691200">- adjust for root KSK rollover (bsc#1112009, bsc#1004165)</changelog>
  <changelog author="kbabioch@suse.com" date="1539691201">- Disabled DLV configuration by default (bsc#1055060)
- Updated the DNSSEC root trust anchor due to KSK roll over (bsc#1112009)</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1542283200">- Migrated from cron to systemd timers (bsc#1115417)</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1546603200">- Use systemd-tmpfiles to create /var/lib/unbound/root.key
  to avoid transactional update breakage (bsc#1111383)</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1551960000">- Remove old pwdutils dependency and add shadow to cover both useradd
  and groupadd as suggested in (bsc#1126757)</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1556020800">- Add systemd require in unbound-anchor to reflect new dependency (due to systemd-timers)</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1592913600">- Avoid amplifying an incoming query to a large number of queries
  Resolves CVE-2020-12662 CVE-2020-12663 (bsc#1171889)
  [ + unbound-1.6.8-amplifying-an-incoming-query.patch ]</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1592913601">- Avoid shell code execution after receiving a specially crafted answer
  Resolves CVE-2019-18934 (bsc#1157268)
  [ + patch_cve_2019-18934.patch ]</changelog>
  <changelog author="werner@suse.de" date="1642420800">- Add patches
  * bsc1185382_CVE-2019-25031_f8875527.patch
    bsc#1185382 for CVE-2019-25031
    configuration injection in create_unbound_ad_servers.sh upon a successful man-in-the-middle attack
  * bsc1185383.4_CVE-2019-25032.3_226298bb.patch
    bsc#1185383 for CVE-2019-25032
    integer overflow in the regional allocator via regional_alloc
    bsc#1185384 for CVE-2019-25033
    integer overflow in the regional allocator via the ALIGN_UP macro
  * bsc1185385_CVE-2019-25034_a3545867.patch
    bsc#1185385 for CVE-2019-25034
    integer overflow in sldns_str2wire_dname_buf_origin, leading to an out-of-bounds write
  * bsc1185386.7_CVE-2019-25035.6_fa23ee8f.patch
    bsc#1185386 for CVE-2019-25035
    out-of-bounds write in sldns_bget_token_par
    bsc#1185387 for CVE-2019-25036
    assertion failure and denial of service in synth_cname
  * bsc1185391.2_CVE-2019-25040.1_2d444a50.patch
    bsc#1185391 for CVE-2019-25040
    infinite loop via a compressed name in dname_pkt_copy
    bsc#1185392 for CVE-2019-25041
    assertion failure via a compressed name in dname_pkt_copy
  * bsc1185389.90_CVE-2019-25038.9_02080f6b.patch
    bsc#1185389 for CVE-2019-25038
    integer overflow in a size calculation in dnscrypt/dnscrypt.c
    bsc#1185390 for CVE-2019-25039
    integer overflow in a size calculation in respip/respip.c
  * bsc1185388_CVE-2019-25037_d2eb78e8.patch
    bsc#1185388 for CVE-2019-25037
    assertion failure and denial of service in dname_pkt_copy via an invalid packet
  * bsc1185393_CVE-2019-25042_6c3a0b54.patch
    bsc#1185393 for CVE-2019-25042
    out-of-bounds write via a compressed name in rdata_copy
- Correct indentation in patch unbound-1.6.8-amplifying-an-incoming-query.patch
  to make it fit to above patches</changelog>
  <changelog author="werner@suse.de" date="1642593600">- Add patch bsc1179191_CVE-2020-28935_19f8f4d9.patch to really fix
  bsc#1179191 CVE-2020-28935: unbound: symbolic link traversal when
  writing PID file</changelog>
  <changelog author="werner@suse.de" date="1642593601">- Import changes from OBS for dlv.isc.org.key, root.anchor, and
  root.key to fix bsc#1112033</changelog>
</package>
<package pkgid="cd396e1f76dbf5fc171a5d49ef6befa32be59d67abb20e320164194775eb0fe5" name="unbound-anchor" arch="aarch64">
  <version epoch="0" ver="1.6.8" rel="10.6.1"/>
  <changelog author="michael@stroeder.com" date="1497441600">- update to 1.6.3
  Bug Fixes
- Fix #1280: Unbound fails assert when response from authoritative
  contains malformed qname. When 0x20 caps-for-id is enabled, when
  assertions are not enabled the malformed qname is handled correctly.</changelog>
  <changelog author="michael@stroeder.com" date="1498564800">- update to 1.6.4
  Features:
- Implemented trust anchor signaling using key tag query.
- unbound-checkconf -o allows query of dnstap config variables.
  Also unbound-control get_option.  Also for dnscrypt.
- unbound.h exports the shm stats structures.  They use
  type long long and no ifdefs, and ub_ before the typenames.
- Implemented opportunistic IPsec support module (ipsecmod).
- Added redirect-bogus.patch to contrib directory.
- Support for the ED25519 algorithm with openssl (from openssl 1.1.1).
- renumbering B-Root's IPv6 address to 2001:500:200::b.
- Fix #1276: [dnscrypt] add XChaCha20-Poly1305 cipher.
- Fix #1277: disable domain ratelimit by setting value to 0.
- Added fastrpz patch to contrib
  Bug Fixes:
- Added ECS unit test (from Manu Bretelle).
- ECS documentation fix (from Manu Bretelle).
- Fix #1252: more indentation inconsistencies.
- Fix #1253: unused variable in edns-subnet/addrtree.c:getbit().
- Fix #1254: clarify ratelimit-{for,below}-domain (from Manu Bretelle).
- iana portlist update
- Based on #1257: check parse limit before t increment in sldns RR
  string parse routine.
- Fix #1258: Windows 10 X64 unbound 1.6.2 service will not start.
  and fix that 64bit getting installed in C:\Program Files (x86).
- Fix #1259: "--disable-ecdsa" argument overwritten
  by "#ifdef SHA256_DIGEST_LENGTH@daemon/remote.c".
- iana portlist update
- Added test for leak of stub information.
- Fix sldns wire2str printout of RR type CAA tags.
- Fix sldns int16_data parse.
- Fix sldns parse and printout of TSIG RRs.
- sldns SMIMEA and AVC definitions, same as getdns definitions.
- Fix tcp-mss failure printout text.
- Set SO_REUSEADDR on outgoing tcp connections to fix the bind before
  connect limited tcp connections.  With the option tcp connections
  can share the same source port (for different destinations).
- Add 'c' to getopt() in testbound.
- Adjust servfail by iterator to not store in cache when serve-expired
  is enabled, to avoid overwriting useful information there.
- Fix queries for nameservers under a stub leaking to the internet.
- document trust-anchor-signaling in example config file.
- updated configure, dependencies and flex output.
- better module memory lookup, fix of unbound-control shm names for
  module memory printout of statistics.
- Fix type AVC sldns rrdef.
- Some whitespace fixup.
- Fix #1265: contrib/unbound.service contains hardcoded path.
- Fix #1265 to use /bin/kill.
- Fix #1267: Libunbound validator/val_secalgo.c uses obsolete APIs,
  and compatibility with BoringSSL.
- Fix #1268: SIGSEGV after log_reopen.
- exec_prefix is by default equal to prefix.
- printout localzone for duplicate local-zone warnings.
- Fix assertion for low buffer size and big edns payload when worker
  overrides udpsize.
- Support for openssl EVP_DigestVerify.
- Fix #1269: inconsistent use of built-in local zones with views.
- Add defaults for new local-zone trees added to views using
  unbound-control.
- Fix #1273: cachedb.c doesn't compile with -Wextra.
- If MSG_FASTOPEN gives EPIPE fallthrough to try normal tcp write.
- Also use global local-zones when there is a matching view that does
  not have any local-zone specified.
- Fix fastopen EPIPE fallthrough to perform connect.
- Fix #1274: automatically trim chroot path from dnscrypt key/cert paths
  (from Manu Bretelle).
- Fix #1275: cached data in cachedb is never used.
- Fix that unbound-control can set val_clean_additional and
  val_permissive_mode.
- Add dnscrypt XChaCha20 tests.
- Detect chacha for dnscrypt at configure time.
- dnscrypt unit tests with chacha.
- Added domain name based ECS whitelist.
- Fix #1278: Incomplete wildcard proof.
- Fix #1279: Memory leak on reload when python module is enabled.
- Fix #1280: Unbound fails assert when response from authoritative
  contains malformed qname.  When 0x20 caps-for-id is enabled, when
  assertions are not enabled the malformed qname is handled correctly.
- More fixes in depth for buffer checks in 0x20 qname checks.
- Fix stub zone queries leaking to the internet for
  harden-referral-path ns checks.
- Fix query for refetch_glue of stub leaking to internet.
- Fix #1301: memory leak in respip and tests.
- Free callback in edns-subnetmod on exit and restart.
- Fix memory leak in sldns_buffer_new_frm_data.
- Fix memory leak in dnscrypt config read.
- Fix dnscrypt chacha cert support ifdefs.
- Fix dnscrypt chacha cert unit test escapes in grep.
- Fix to unlock view in view test.
- Fix warning in pythonmod under clang compiler.
- Fix lintian typo.
- Fix #1316: heap read buffer overflow in parse_edns_options.</changelog>
  <changelog author="jengelh@inai.de" date="1502193600">- RPM group fix. Do not suppress user/group creation problems.
  Replace %__ type macro indirections.</changelog>
  <changelog author="michael@stroeder.com" date="1503316800">- update to 1.6.5
  * Fix install of trust anchor when two anchors are present, makes both
    valid.  Checks hash of DS but not signature of new key.  This fixes
    installs between sep11 and oct11 2017.</changelog>
  <changelog author="michael@stroeder.com" date="1504526400">- update to 1.6.6
  Features:
- unbound-control dump_infra prints port number for address if not 53.
- Fix #1344: RFC6761-reserved domains: test. and invalid.
- Fix #1349: allow suppression of pidfiles (from Daniel Kahn Gillmor).
  With the -p option unbound does not create a pidfile.
- Added stats for queries that have been ratelimited by domain
  recursion.
- Patch to show DNSCrypt status in help output, from Carsten
  Strotmann.
- Fix #1407: Add ECS options check to unbound-checkconf.
- Fix #1415: [dnscrypt] shared secret cache, patch from
  Manu Bretelle.
  Bug Fixes:
- fixup of dnscrypt_cert_chacha test (from Manu Bretelle).
- First fix for zero b64 and hex text zone format in sldns.
- Better fixup of dnscrypt_cert_chacha test for different escapes.
- Fix that infra cache host hash does not change after reconfig.
- Fix python example0 return module wait instead of error for pass.
- enhancement for hardened-tls for DNS over TLS.  Removed duplicated
  security settings.
- Fix for unbound-checkconf, check ipsecmod-hook if ipsecmod is turned
  on.
- Fix #1331: libunbound segfault in threaded mode when context is
  deleted.
- Fix pythonmod link line option flag.
- Fix openssl 1.1.0 load of ssl error strings from ssl init.
- Fix 1332: Bump verbosity of failed chown'ing of the control socket.
- Redirect all localhost names to localhost address for RFC6761.
- Fix #1350: make cachedb backend configurable (from JINMEI Tatuya).
- Fix tests to use .tdir (from Manu Bretelle) instead of .tpkg.
- upgrade aclocal(pkg.m4 0.29.1), config.guess(2016-10-02),
  config.sub(2016-09-05).
- annotate case statement fallthrough for gcc 7.1.1.
- flex output from flex 2.6.1.
- snprintf of thread number does not warn about truncated string.
- squelch TCP fast open error on FreeBSD when kernel has it disabled,
  unless verbosity is high.
- remove warning from windows compile.
- Fix compile with libnettle
- Fix DSA configure switch (--disable dsa) for libnettle and libnss.
- Fix #1365: Add Ed25519 support using libnettle.
- Fix #1394: mix of serve-expired and response-ip could cause a crash.
- Remove unused iter_env member (ip6arpa_dname)
- Do not reset rrset.bogus stats when called using stats_noreset.
- Do not add rrset_bogus and query ratelimiting stats per thread, these
  module stats are global.
- Fix #1397: Recursive DS lookups for AS112 zones names should recurse.
- Fix #1398: make cachedb secret configurable.
- Remove spaces from Makefile.
- Fix issue on macOX 10.10 where TCP fast open is detected but not
  implemented causing TCP to fail. The fix allows fallback to regular
  TCP in this case and is also more robust for cases where connectx()
  fails for some reason.
- Fix #1402: squelch invalid argument error for fd_set_block on windows.
- Fix to reclaim tcp handler when it is closed due to dnscrypt buffer
  allocation failure.
- Fix #1415: patch to free dnscrypt environment on reload.
- iana portlist update
- Small fixes for the shared secret cache patch.
- Fix WKS records on kvm autobuild host, with default protobyname
  entries for udp and tcp.
- Fix #1414: fix segfault on parse failure and log_replies.
- zero qinfo in handle_request, this zeroes local_alias and also the
  qname member.
- new keys and certs for dnscrypt tests.
- fixup WKS test on buildhost without servicebyname.
- updated contrib/fastrpz.patch to apply with configparser changes.
- Fix 1416: qname-minimisation breaks TLSA lookups with CNAMEs.
- Fix #1424: cachedb:testframe is not thread safe.
- Fix #1417: [dnscrypt] shared secret cache counters, and works when
  dnscrypt is not enabled.  And cache size configuration option.
- Fix #1418: [ip ratelimit] initialize slabhash using
  ip-ratelimit-slabs.
- Recommend 1472 buffer size in unbound.conf</changelog>
  <changelog author="michael@stroeder.com" date="1507636800">- update to 1.6.7
  Features:
- Set trust-anchor-signaling default to yes
- Fix #1440: [dnscrypt] client nonce cache.
- Fix #1435: Please allow UDP to be disabled separately upstream and
  downstream.
  Bug fixes:
- Fix that looping modules always stop the query, and don't pass
  control.
- Fix unbound-host to report error for DNSSEC state of failed lookups.
- Spelling fixes, from Josh Soref.
- Fix #1400: allowing use of global cache on ECS-forwarding unless
  always-forward.
- use a cachedb answer even if it's "expired" when serve-expired is yes
  (patch from Jinmei Tatuya).
- trigger refetching of the answer in that case (this will bypass
  cachedb lookup)
- allow storing a 0-TTL answer from cachedb in the in-memory message
  cache when serve-expired is yes
- Fix DNSCACHE_STORE_ZEROTTL to be bigger than 0xffff.
- Log name of looping module
- Fix #1450: Generate again patch contrib/aaaa-filter-iterator.patch
  (by Danilo G. Baio).
- Fix param unused warning for windows exportsymbol compile.
- Use RCODE from A query on DNS64 synthesized answer.
- Fix trust-anchor-signaling works in libunbound.
- Fix spelling in unbound-control man page.</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="cbosdonnat@suse.com" date="1512129600">- Use python3 instead of python2 (fate#323526)</changelog>
  <changelog author="michael@stroeder.com" date="1516363200">- update to 1.6.8 (bsc#1076963)
  patch for CVE-2017-15105: vulnerability in the processing of
  wildcard synthesized NSEC records.</changelog>
  <changelog author="dmueller@suse.com" date="1539691200">- adjust for root KSK rollover (bsc#1112009, bsc#1004165)</changelog>
  <changelog author="kbabioch@suse.com" date="1539691201">- Disabled DLV configuration by default (bsc#1055060)
- Updated the DNSSEC root trust anchor due to KSK roll over (bsc#1112009)</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1542283200">- Migrated from cron to systemd timers (bsc#1115417)</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1546603200">- Use systemd-tmpfiles to create /var/lib/unbound/root.key
  to avoid transactional update breakage (bsc#1111383)</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1551960000">- Remove old pwdutils dependency and add shadow to cover both useradd
  and groupadd as suggested in (bsc#1126757)</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1556020800">- Add systemd require in unbound-anchor to reflect new dependency (due to systemd-timers)</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1592913600">- Avoid amplifying an incoming query to a large number of queries
  Resolves CVE-2020-12662 CVE-2020-12663 (bsc#1171889)
  [ + unbound-1.6.8-amplifying-an-incoming-query.patch ]</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1592913601">- Avoid shell code execution after receiving a specially crafted answer
  Resolves CVE-2019-18934 (bsc#1157268)
  [ + patch_cve_2019-18934.patch ]</changelog>
  <changelog author="werner@suse.de" date="1642420800">- Add patches
  * bsc1185382_CVE-2019-25031_f8875527.patch
    bsc#1185382 for CVE-2019-25031
    configuration injection in create_unbound_ad_servers.sh upon a successful man-in-the-middle attack
  * bsc1185383.4_CVE-2019-25032.3_226298bb.patch
    bsc#1185383 for CVE-2019-25032
    integer overflow in the regional allocator via regional_alloc
    bsc#1185384 for CVE-2019-25033
    integer overflow in the regional allocator via the ALIGN_UP macro
  * bsc1185385_CVE-2019-25034_a3545867.patch
    bsc#1185385 for CVE-2019-25034
    integer overflow in sldns_str2wire_dname_buf_origin, leading to an out-of-bounds write
  * bsc1185386.7_CVE-2019-25035.6_fa23ee8f.patch
    bsc#1185386 for CVE-2019-25035
    out-of-bounds write in sldns_bget_token_par
    bsc#1185387 for CVE-2019-25036
    assertion failure and denial of service in synth_cname
  * bsc1185391.2_CVE-2019-25040.1_2d444a50.patch
    bsc#1185391 for CVE-2019-25040
    infinite loop via a compressed name in dname_pkt_copy
    bsc#1185392 for CVE-2019-25041
    assertion failure via a compressed name in dname_pkt_copy
  * bsc1185389.90_CVE-2019-25038.9_02080f6b.patch
    bsc#1185389 for CVE-2019-25038
    integer overflow in a size calculation in dnscrypt/dnscrypt.c
    bsc#1185390 for CVE-2019-25039
    integer overflow in a size calculation in respip/respip.c
  * bsc1185388_CVE-2019-25037_d2eb78e8.patch
    bsc#1185388 for CVE-2019-25037
    assertion failure and denial of service in dname_pkt_copy via an invalid packet
  * bsc1185393_CVE-2019-25042_6c3a0b54.patch
    bsc#1185393 for CVE-2019-25042
    out-of-bounds write via a compressed name in rdata_copy
- Correct indentation in patch unbound-1.6.8-amplifying-an-incoming-query.patch
  to make it fit to above patches</changelog>
  <changelog author="werner@suse.de" date="1642593600">- Add patch bsc1179191_CVE-2020-28935_19f8f4d9.patch to really fix
  bsc#1179191 CVE-2020-28935: unbound: symbolic link traversal when
  writing PID file</changelog>
  <changelog author="werner@suse.de" date="1642593601">- Import changes from OBS for dlv.isc.org.key, root.anchor, and
  root.key to fix bsc#1112033</changelog>
</package>
<package pkgid="f0880940da92e22469090c977c1264e3c33fb90d2e19f38e0909a1e0f951cd23" name="unbound-anchor" arch="ppc64le">
  <version epoch="0" ver="1.6.8" rel="10.6.1"/>
  <changelog author="michael@stroeder.com" date="1497441600">- update to 1.6.3
  Bug Fixes
- Fix #1280: Unbound fails assert when response from authoritative
  contains malformed qname. When 0x20 caps-for-id is enabled, when
  assertions are not enabled the malformed qname is handled correctly.</changelog>
  <changelog author="michael@stroeder.com" date="1498564800">- update to 1.6.4
  Features:
- Implemented trust anchor signaling using key tag query.
- unbound-checkconf -o allows query of dnstap config variables.
  Also unbound-control get_option.  Also for dnscrypt.
- unbound.h exports the shm stats structures.  They use
  type long long and no ifdefs, and ub_ before the typenames.
- Implemented opportunistic IPsec support module (ipsecmod).
- Added redirect-bogus.patch to contrib directory.
- Support for the ED25519 algorithm with openssl (from openssl 1.1.1).
- renumbering B-Root's IPv6 address to 2001:500:200::b.
- Fix #1276: [dnscrypt] add XChaCha20-Poly1305 cipher.
- Fix #1277: disable domain ratelimit by setting value to 0.
- Added fastrpz patch to contrib
  Bug Fixes:
- Added ECS unit test (from Manu Bretelle).
- ECS documentation fix (from Manu Bretelle).
- Fix #1252: more indentation inconsistencies.
- Fix #1253: unused variable in edns-subnet/addrtree.c:getbit().
- Fix #1254: clarify ratelimit-{for,below}-domain (from Manu Bretelle).
- iana portlist update
- Based on #1257: check parse limit before t increment in sldns RR
  string parse routine.
- Fix #1258: Windows 10 X64 unbound 1.6.2 service will not start.
  and fix that 64bit getting installed in C:\Program Files (x86).
- Fix #1259: "--disable-ecdsa" argument overwritten
  by "#ifdef SHA256_DIGEST_LENGTH@daemon/remote.c".
- iana portlist update
- Added test for leak of stub information.
- Fix sldns wire2str printout of RR type CAA tags.
- Fix sldns int16_data parse.
- Fix sldns parse and printout of TSIG RRs.
- sldns SMIMEA and AVC definitions, same as getdns definitions.
- Fix tcp-mss failure printout text.
- Set SO_REUSEADDR on outgoing tcp connections to fix the bind before
  connect limited tcp connections.  With the option tcp connections
  can share the same source port (for different destinations).
- Add 'c' to getopt() in testbound.
- Adjust servfail by iterator to not store in cache when serve-expired
  is enabled, to avoid overwriting useful information there.
- Fix queries for nameservers under a stub leaking to the internet.
- document trust-anchor-signaling in example config file.
- updated configure, dependencies and flex output.
- better module memory lookup, fix of unbound-control shm names for
  module memory printout of statistics.
- Fix type AVC sldns rrdef.
- Some whitespace fixup.
- Fix #1265: contrib/unbound.service contains hardcoded path.
- Fix #1265 to use /bin/kill.
- Fix #1267: Libunbound validator/val_secalgo.c uses obsolete APIs,
  and compatibility with BoringSSL.
- Fix #1268: SIGSEGV after log_reopen.
- exec_prefix is by default equal to prefix.
- printout localzone for duplicate local-zone warnings.
- Fix assertion for low buffer size and big edns payload when worker
  overrides udpsize.
- Support for openssl EVP_DigestVerify.
- Fix #1269: inconsistent use of built-in local zones with views.
- Add defaults for new local-zone trees added to views using
  unbound-control.
- Fix #1273: cachedb.c doesn't compile with -Wextra.
- If MSG_FASTOPEN gives EPIPE fallthrough to try normal tcp write.
- Also use global local-zones when there is a matching view that does
  not have any local-zone specified.
- Fix fastopen EPIPE fallthrough to perform connect.
- Fix #1274: automatically trim chroot path from dnscrypt key/cert paths
  (from Manu Bretelle).
- Fix #1275: cached data in cachedb is never used.
- Fix that unbound-control can set val_clean_additional and
  val_permissive_mode.
- Add dnscrypt XChaCha20 tests.
- Detect chacha for dnscrypt at configure time.
- dnscrypt unit tests with chacha.
- Added domain name based ECS whitelist.
- Fix #1278: Incomplete wildcard proof.
- Fix #1279: Memory leak on reload when python module is enabled.
- Fix #1280: Unbound fails assert when response from authoritative
  contains malformed qname.  When 0x20 caps-for-id is enabled, when
  assertions are not enabled the malformed qname is handled correctly.
- More fixes in depth for buffer checks in 0x20 qname checks.
- Fix stub zone queries leaking to the internet for
  harden-referral-path ns checks.
- Fix query for refetch_glue of stub leaking to internet.
- Fix #1301: memory leak in respip and tests.
- Free callback in edns-subnetmod on exit and restart.
- Fix memory leak in sldns_buffer_new_frm_data.
- Fix memory leak in dnscrypt config read.
- Fix dnscrypt chacha cert support ifdefs.
- Fix dnscrypt chacha cert unit test escapes in grep.
- Fix to unlock view in view test.
- Fix warning in pythonmod under clang compiler.
- Fix lintian typo.
- Fix #1316: heap read buffer overflow in parse_edns_options.</changelog>
  <changelog author="jengelh@inai.de" date="1502193600">- RPM group fix. Do not suppress user/group creation problems.
  Replace %__ type macro indirections.</changelog>
  <changelog author="michael@stroeder.com" date="1503316800">- update to 1.6.5
  * Fix install of trust anchor when two anchors are present, makes both
    valid.  Checks hash of DS but not signature of new key.  This fixes
    installs between sep11 and oct11 2017.</changelog>
  <changelog author="michael@stroeder.com" date="1504526400">- update to 1.6.6
  Features:
- unbound-control dump_infra prints port number for address if not 53.
- Fix #1344: RFC6761-reserved domains: test. and invalid.
- Fix #1349: allow suppression of pidfiles (from Daniel Kahn Gillmor).
  With the -p option unbound does not create a pidfile.
- Added stats for queries that have been ratelimited by domain
  recursion.
- Patch to show DNSCrypt status in help output, from Carsten
  Strotmann.
- Fix #1407: Add ECS options check to unbound-checkconf.
- Fix #1415: [dnscrypt] shared secret cache, patch from
  Manu Bretelle.
  Bug Fixes:
- fixup of dnscrypt_cert_chacha test (from Manu Bretelle).
- First fix for zero b64 and hex text zone format in sldns.
- Better fixup of dnscrypt_cert_chacha test for different escapes.
- Fix that infra cache host hash does not change after reconfig.
- Fix python example0 return module wait instead of error for pass.
- enhancement for hardened-tls for DNS over TLS.  Removed duplicated
  security settings.
- Fix for unbound-checkconf, check ipsecmod-hook if ipsecmod is turned
  on.
- Fix #1331: libunbound segfault in threaded mode when context is
  deleted.
- Fix pythonmod link line option flag.
- Fix openssl 1.1.0 load of ssl error strings from ssl init.
- Fix 1332: Bump verbosity of failed chown'ing of the control socket.
- Redirect all localhost names to localhost address for RFC6761.
- Fix #1350: make cachedb backend configurable (from JINMEI Tatuya).
- Fix tests to use .tdir (from Manu Bretelle) instead of .tpkg.
- upgrade aclocal(pkg.m4 0.29.1), config.guess(2016-10-02),
  config.sub(2016-09-05).
- annotate case statement fallthrough for gcc 7.1.1.
- flex output from flex 2.6.1.
- snprintf of thread number does not warn about truncated string.
- squelch TCP fast open error on FreeBSD when kernel has it disabled,
  unless verbosity is high.
- remove warning from windows compile.
- Fix compile with libnettle
- Fix DSA configure switch (--disable dsa) for libnettle and libnss.
- Fix #1365: Add Ed25519 support using libnettle.
- Fix #1394: mix of serve-expired and response-ip could cause a crash.
- Remove unused iter_env member (ip6arpa_dname)
- Do not reset rrset.bogus stats when called using stats_noreset.
- Do not add rrset_bogus and query ratelimiting stats per thread, these
  module stats are global.
- Fix #1397: Recursive DS lookups for AS112 zones names should recurse.
- Fix #1398: make cachedb secret configurable.
- Remove spaces from Makefile.
- Fix issue on macOX 10.10 where TCP fast open is detected but not
  implemented causing TCP to fail. The fix allows fallback to regular
  TCP in this case and is also more robust for cases where connectx()
  fails for some reason.
- Fix #1402: squelch invalid argument error for fd_set_block on windows.
- Fix to reclaim tcp handler when it is closed due to dnscrypt buffer
  allocation failure.
- Fix #1415: patch to free dnscrypt environment on reload.
- iana portlist update
- Small fixes for the shared secret cache patch.
- Fix WKS records on kvm autobuild host, with default protobyname
  entries for udp and tcp.
- Fix #1414: fix segfault on parse failure and log_replies.
- zero qinfo in handle_request, this zeroes local_alias and also the
  qname member.
- new keys and certs for dnscrypt tests.
- fixup WKS test on buildhost without servicebyname.
- updated contrib/fastrpz.patch to apply with configparser changes.
- Fix 1416: qname-minimisation breaks TLSA lookups with CNAMEs.
- Fix #1424: cachedb:testframe is not thread safe.
- Fix #1417: [dnscrypt] shared secret cache counters, and works when
  dnscrypt is not enabled.  And cache size configuration option.
- Fix #1418: [ip ratelimit] initialize slabhash using
  ip-ratelimit-slabs.
- Recommend 1472 buffer size in unbound.conf</changelog>
  <changelog author="michael@stroeder.com" date="1507636800">- update to 1.6.7
  Features:
- Set trust-anchor-signaling default to yes
- Fix #1440: [dnscrypt] client nonce cache.
- Fix #1435: Please allow UDP to be disabled separately upstream and
  downstream.
  Bug fixes:
- Fix that looping modules always stop the query, and don't pass
  control.
- Fix unbound-host to report error for DNSSEC state of failed lookups.
- Spelling fixes, from Josh Soref.
- Fix #1400: allowing use of global cache on ECS-forwarding unless
  always-forward.
- use a cachedb answer even if it's "expired" when serve-expired is yes
  (patch from Jinmei Tatuya).
- trigger refetching of the answer in that case (this will bypass
  cachedb lookup)
- allow storing a 0-TTL answer from cachedb in the in-memory message
  cache when serve-expired is yes
- Fix DNSCACHE_STORE_ZEROTTL to be bigger than 0xffff.
- Log name of looping module
- Fix #1450: Generate again patch contrib/aaaa-filter-iterator.patch
  (by Danilo G. Baio).
- Fix param unused warning for windows exportsymbol compile.
- Use RCODE from A query on DNS64 synthesized answer.
- Fix trust-anchor-signaling works in libunbound.
- Fix spelling in unbound-control man page.</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="cbosdonnat@suse.com" date="1512129600">- Use python3 instead of python2 (fate#323526)</changelog>
  <changelog author="michael@stroeder.com" date="1516363200">- update to 1.6.8 (bsc#1076963)
  patch for CVE-2017-15105: vulnerability in the processing of
  wildcard synthesized NSEC records.</changelog>
  <changelog author="dmueller@suse.com" date="1539691200">- adjust for root KSK rollover (bsc#1112009, bsc#1004165)</changelog>
  <changelog author="kbabioch@suse.com" date="1539691201">- Disabled DLV configuration by default (bsc#1055060)
- Updated the DNSSEC root trust anchor due to KSK roll over (bsc#1112009)</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1542283200">- Migrated from cron to systemd timers (bsc#1115417)</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1546603200">- Use systemd-tmpfiles to create /var/lib/unbound/root.key
  to avoid transactional update breakage (bsc#1111383)</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1551960000">- Remove old pwdutils dependency and add shadow to cover both useradd
  and groupadd as suggested in (bsc#1126757)</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1556020800">- Add systemd require in unbound-anchor to reflect new dependency (due to systemd-timers)</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1592913600">- Avoid amplifying an incoming query to a large number of queries
  Resolves CVE-2020-12662 CVE-2020-12663 (bsc#1171889)
  [ + unbound-1.6.8-amplifying-an-incoming-query.patch ]</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1592913601">- Avoid shell code execution after receiving a specially crafted answer
  Resolves CVE-2019-18934 (bsc#1157268)
  [ + patch_cve_2019-18934.patch ]</changelog>
  <changelog author="werner@suse.de" date="1642420800">- Add patches
  * bsc1185382_CVE-2019-25031_f8875527.patch
    bsc#1185382 for CVE-2019-25031
    configuration injection in create_unbound_ad_servers.sh upon a successful man-in-the-middle attack
  * bsc1185383.4_CVE-2019-25032.3_226298bb.patch
    bsc#1185383 for CVE-2019-25032
    integer overflow in the regional allocator via regional_alloc
    bsc#1185384 for CVE-2019-25033
    integer overflow in the regional allocator via the ALIGN_UP macro
  * bsc1185385_CVE-2019-25034_a3545867.patch
    bsc#1185385 for CVE-2019-25034
    integer overflow in sldns_str2wire_dname_buf_origin, leading to an out-of-bounds write
  * bsc1185386.7_CVE-2019-25035.6_fa23ee8f.patch
    bsc#1185386 for CVE-2019-25035
    out-of-bounds write in sldns_bget_token_par
    bsc#1185387 for CVE-2019-25036
    assertion failure and denial of service in synth_cname
  * bsc1185391.2_CVE-2019-25040.1_2d444a50.patch
    bsc#1185391 for CVE-2019-25040
    infinite loop via a compressed name in dname_pkt_copy
    bsc#1185392 for CVE-2019-25041
    assertion failure via a compressed name in dname_pkt_copy
  * bsc1185389.90_CVE-2019-25038.9_02080f6b.patch
    bsc#1185389 for CVE-2019-25038
    integer overflow in a size calculation in dnscrypt/dnscrypt.c
    bsc#1185390 for CVE-2019-25039
    integer overflow in a size calculation in respip/respip.c
  * bsc1185388_CVE-2019-25037_d2eb78e8.patch
    bsc#1185388 for CVE-2019-25037
    assertion failure and denial of service in dname_pkt_copy via an invalid packet
  * bsc1185393_CVE-2019-25042_6c3a0b54.patch
    bsc#1185393 for CVE-2019-25042
    out-of-bounds write via a compressed name in rdata_copy
- Correct indentation in patch unbound-1.6.8-amplifying-an-incoming-query.patch
  to make it fit to above patches</changelog>
  <changelog author="werner@suse.de" date="1642593600">- Add patch bsc1179191_CVE-2020-28935_19f8f4d9.patch to really fix
  bsc#1179191 CVE-2020-28935: unbound: symbolic link traversal when
  writing PID file</changelog>
  <changelog author="werner@suse.de" date="1642593601">- Import changes from OBS for dlv.isc.org.key, root.anchor, and
  root.key to fix bsc#1112033</changelog>
</package>
<package pkgid="6d9d9b2baf1f14cb60f691b17bcc6ee767a756486aab5dd49aca5d2ba74f38e8" name="unbound-anchor" arch="s390x">
  <version epoch="0" ver="1.6.8" rel="10.6.1"/>
  <changelog author="michael@stroeder.com" date="1497441600">- update to 1.6.3
  Bug Fixes
- Fix #1280: Unbound fails assert when response from authoritative
  contains malformed qname. When 0x20 caps-for-id is enabled, when
  assertions are not enabled the malformed qname is handled correctly.</changelog>
  <changelog author="michael@stroeder.com" date="1498564800">- update to 1.6.4
  Features:
- Implemented trust anchor signaling using key tag query.
- unbound-checkconf -o allows query of dnstap config variables.
  Also unbound-control get_option.  Also for dnscrypt.
- unbound.h exports the shm stats structures.  They use
  type long long and no ifdefs, and ub_ before the typenames.
- Implemented opportunistic IPsec support module (ipsecmod).
- Added redirect-bogus.patch to contrib directory.
- Support for the ED25519 algorithm with openssl (from openssl 1.1.1).
- renumbering B-Root's IPv6 address to 2001:500:200::b.
- Fix #1276: [dnscrypt] add XChaCha20-Poly1305 cipher.
- Fix #1277: disable domain ratelimit by setting value to 0.
- Added fastrpz patch to contrib
  Bug Fixes:
- Added ECS unit test (from Manu Bretelle).
- ECS documentation fix (from Manu Bretelle).
- Fix #1252: more indentation inconsistencies.
- Fix #1253: unused variable in edns-subnet/addrtree.c:getbit().
- Fix #1254: clarify ratelimit-{for,below}-domain (from Manu Bretelle).
- iana portlist update
- Based on #1257: check parse limit before t increment in sldns RR
  string parse routine.
- Fix #1258: Windows 10 X64 unbound 1.6.2 service will not start.
  and fix that 64bit getting installed in C:\Program Files (x86).
- Fix #1259: "--disable-ecdsa" argument overwritten
  by "#ifdef SHA256_DIGEST_LENGTH@daemon/remote.c".
- iana portlist update
- Added test for leak of stub information.
- Fix sldns wire2str printout of RR type CAA tags.
- Fix sldns int16_data parse.
- Fix sldns parse and printout of TSIG RRs.
- sldns SMIMEA and AVC definitions, same as getdns definitions.
- Fix tcp-mss failure printout text.
- Set SO_REUSEADDR on outgoing tcp connections to fix the bind before
  connect limited tcp connections.  With the option tcp connections
  can share the same source port (for different destinations).
- Add 'c' to getopt() in testbound.
- Adjust servfail by iterator to not store in cache when serve-expired
  is enabled, to avoid overwriting useful information there.
- Fix queries for nameservers under a stub leaking to the internet.
- document trust-anchor-signaling in example config file.
- updated configure, dependencies and flex output.
- better module memory lookup, fix of unbound-control shm names for
  module memory printout of statistics.
- Fix type AVC sldns rrdef.
- Some whitespace fixup.
- Fix #1265: contrib/unbound.service contains hardcoded path.
- Fix #1265 to use /bin/kill.
- Fix #1267: Libunbound validator/val_secalgo.c uses obsolete APIs,
  and compatibility with BoringSSL.
- Fix #1268: SIGSEGV after log_reopen.
- exec_prefix is by default equal to prefix.
- printout localzone for duplicate local-zone warnings.
- Fix assertion for low buffer size and big edns payload when worker
  overrides udpsize.
- Support for openssl EVP_DigestVerify.
- Fix #1269: inconsistent use of built-in local zones with views.
- Add defaults for new local-zone trees added to views using
  unbound-control.
- Fix #1273: cachedb.c doesn't compile with -Wextra.
- If MSG_FASTOPEN gives EPIPE fallthrough to try normal tcp write.
- Also use global local-zones when there is a matching view that does
  not have any local-zone specified.
- Fix fastopen EPIPE fallthrough to perform connect.
- Fix #1274: automatically trim chroot path from dnscrypt key/cert paths
  (from Manu Bretelle).
- Fix #1275: cached data in cachedb is never used.
- Fix that unbound-control can set val_clean_additional and
  val_permissive_mode.
- Add dnscrypt XChaCha20 tests.
- Detect chacha for dnscrypt at configure time.
- dnscrypt unit tests with chacha.
- Added domain name based ECS whitelist.
- Fix #1278: Incomplete wildcard proof.
- Fix #1279: Memory leak on reload when python module is enabled.
- Fix #1280: Unbound fails assert when response from authoritative
  contains malformed qname.  When 0x20 caps-for-id is enabled, when
  assertions are not enabled the malformed qname is handled correctly.
- More fixes in depth for buffer checks in 0x20 qname checks.
- Fix stub zone queries leaking to the internet for
  harden-referral-path ns checks.
- Fix query for refetch_glue of stub leaking to internet.
- Fix #1301: memory leak in respip and tests.
- Free callback in edns-subnetmod on exit and restart.
- Fix memory leak in sldns_buffer_new_frm_data.
- Fix memory leak in dnscrypt config read.
- Fix dnscrypt chacha cert support ifdefs.
- Fix dnscrypt chacha cert unit test escapes in grep.
- Fix to unlock view in view test.
- Fix warning in pythonmod under clang compiler.
- Fix lintian typo.
- Fix #1316: heap read buffer overflow in parse_edns_options.</changelog>
  <changelog author="jengelh@inai.de" date="1502193600">- RPM group fix. Do not suppress user/group creation problems.
  Replace %__ type macro indirections.</changelog>
  <changelog author="michael@stroeder.com" date="1503316800">- update to 1.6.5
  * Fix install of trust anchor when two anchors are present, makes both
    valid.  Checks hash of DS but not signature of new key.  This fixes
    installs between sep11 and oct11 2017.</changelog>
  <changelog author="michael@stroeder.com" date="1504526400">- update to 1.6.6
  Features:
- unbound-control dump_infra prints port number for address if not 53.
- Fix #1344: RFC6761-reserved domains: test. and invalid.
- Fix #1349: allow suppression of pidfiles (from Daniel Kahn Gillmor).
  With the -p option unbound does not create a pidfile.
- Added stats for queries that have been ratelimited by domain
  recursion.
- Patch to show DNSCrypt status in help output, from Carsten
  Strotmann.
- Fix #1407: Add ECS options check to unbound-checkconf.
- Fix #1415: [dnscrypt] shared secret cache, patch from
  Manu Bretelle.
  Bug Fixes:
- fixup of dnscrypt_cert_chacha test (from Manu Bretelle).
- First fix for zero b64 and hex text zone format in sldns.
- Better fixup of dnscrypt_cert_chacha test for different escapes.
- Fix that infra cache host hash does not change after reconfig.
- Fix python example0 return module wait instead of error for pass.
- enhancement for hardened-tls for DNS over TLS.  Removed duplicated
  security settings.
- Fix for unbound-checkconf, check ipsecmod-hook if ipsecmod is turned
  on.
- Fix #1331: libunbound segfault in threaded mode when context is
  deleted.
- Fix pythonmod link line option flag.
- Fix openssl 1.1.0 load of ssl error strings from ssl init.
- Fix 1332: Bump verbosity of failed chown'ing of the control socket.
- Redirect all localhost names to localhost address for RFC6761.
- Fix #1350: make cachedb backend configurable (from JINMEI Tatuya).
- Fix tests to use .tdir (from Manu Bretelle) instead of .tpkg.
- upgrade aclocal(pkg.m4 0.29.1), config.guess(2016-10-02),
  config.sub(2016-09-05).
- annotate case statement fallthrough for gcc 7.1.1.
- flex output from flex 2.6.1.
- snprintf of thread number does not warn about truncated string.
- squelch TCP fast open error on FreeBSD when kernel has it disabled,
  unless verbosity is high.
- remove warning from windows compile.
- Fix compile with libnettle
- Fix DSA configure switch (--disable dsa) for libnettle and libnss.
- Fix #1365: Add Ed25519 support using libnettle.
- Fix #1394: mix of serve-expired and response-ip could cause a crash.
- Remove unused iter_env member (ip6arpa_dname)
- Do not reset rrset.bogus stats when called using stats_noreset.
- Do not add rrset_bogus and query ratelimiting stats per thread, these
  module stats are global.
- Fix #1397: Recursive DS lookups for AS112 zones names should recurse.
- Fix #1398: make cachedb secret configurable.
- Remove spaces from Makefile.
- Fix issue on macOX 10.10 where TCP fast open is detected but not
  implemented causing TCP to fail. The fix allows fallback to regular
  TCP in this case and is also more robust for cases where connectx()
  fails for some reason.
- Fix #1402: squelch invalid argument error for fd_set_block on windows.
- Fix to reclaim tcp handler when it is closed due to dnscrypt buffer
  allocation failure.
- Fix #1415: patch to free dnscrypt environment on reload.
- iana portlist update
- Small fixes for the shared secret cache patch.
- Fix WKS records on kvm autobuild host, with default protobyname
  entries for udp and tcp.
- Fix #1414: fix segfault on parse failure and log_replies.
- zero qinfo in handle_request, this zeroes local_alias and also the
  qname member.
- new keys and certs for dnscrypt tests.
- fixup WKS test on buildhost without servicebyname.
- updated contrib/fastrpz.patch to apply with configparser changes.
- Fix 1416: qname-minimisation breaks TLSA lookups with CNAMEs.
- Fix #1424: cachedb:testframe is not thread safe.
- Fix #1417: [dnscrypt] shared secret cache counters, and works when
  dnscrypt is not enabled.  And cache size configuration option.
- Fix #1418: [ip ratelimit] initialize slabhash using
  ip-ratelimit-slabs.
- Recommend 1472 buffer size in unbound.conf</changelog>
  <changelog author="michael@stroeder.com" date="1507636800">- update to 1.6.7
  Features:
- Set trust-anchor-signaling default to yes
- Fix #1440: [dnscrypt] client nonce cache.
- Fix #1435: Please allow UDP to be disabled separately upstream and
  downstream.
  Bug fixes:
- Fix that looping modules always stop the query, and don't pass
  control.
- Fix unbound-host to report error for DNSSEC state of failed lookups.
- Spelling fixes, from Josh Soref.
- Fix #1400: allowing use of global cache on ECS-forwarding unless
  always-forward.
- use a cachedb answer even if it's "expired" when serve-expired is yes
  (patch from Jinmei Tatuya).
- trigger refetching of the answer in that case (this will bypass
  cachedb lookup)
- allow storing a 0-TTL answer from cachedb in the in-memory message
  cache when serve-expired is yes
- Fix DNSCACHE_STORE_ZEROTTL to be bigger than 0xffff.
- Log name of looping module
- Fix #1450: Generate again patch contrib/aaaa-filter-iterator.patch
  (by Danilo G. Baio).
- Fix param unused warning for windows exportsymbol compile.
- Use RCODE from A query on DNS64 synthesized answer.
- Fix trust-anchor-signaling works in libunbound.
- Fix spelling in unbound-control man page.</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="cbosdonnat@suse.com" date="1512129600">- Use python3 instead of python2 (fate#323526)</changelog>
  <changelog author="michael@stroeder.com" date="1516363200">- update to 1.6.8 (bsc#1076963)
  patch for CVE-2017-15105: vulnerability in the processing of
  wildcard synthesized NSEC records.</changelog>
  <changelog author="dmueller@suse.com" date="1539691200">- adjust for root KSK rollover (bsc#1112009, bsc#1004165)</changelog>
  <changelog author="kbabioch@suse.com" date="1539691201">- Disabled DLV configuration by default (bsc#1055060)
- Updated the DNSSEC root trust anchor due to KSK roll over (bsc#1112009)</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1542283200">- Migrated from cron to systemd timers (bsc#1115417)</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1546603200">- Use systemd-tmpfiles to create /var/lib/unbound/root.key
  to avoid transactional update breakage (bsc#1111383)</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1551960000">- Remove old pwdutils dependency and add shadow to cover both useradd
  and groupadd as suggested in (bsc#1126757)</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1556020800">- Add systemd require in unbound-anchor to reflect new dependency (due to systemd-timers)</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1592913600">- Avoid amplifying an incoming query to a large number of queries
  Resolves CVE-2020-12662 CVE-2020-12663 (bsc#1171889)
  [ + unbound-1.6.8-amplifying-an-incoming-query.patch ]</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1592913601">- Avoid shell code execution after receiving a specially crafted answer
  Resolves CVE-2019-18934 (bsc#1157268)
  [ + patch_cve_2019-18934.patch ]</changelog>
  <changelog author="werner@suse.de" date="1642420800">- Add patches
  * bsc1185382_CVE-2019-25031_f8875527.patch
    bsc#1185382 for CVE-2019-25031
    configuration injection in create_unbound_ad_servers.sh upon a successful man-in-the-middle attack
  * bsc1185383.4_CVE-2019-25032.3_226298bb.patch
    bsc#1185383 for CVE-2019-25032
    integer overflow in the regional allocator via regional_alloc
    bsc#1185384 for CVE-2019-25033
    integer overflow in the regional allocator via the ALIGN_UP macro
  * bsc1185385_CVE-2019-25034_a3545867.patch
    bsc#1185385 for CVE-2019-25034
    integer overflow in sldns_str2wire_dname_buf_origin, leading to an out-of-bounds write
  * bsc1185386.7_CVE-2019-25035.6_fa23ee8f.patch
    bsc#1185386 for CVE-2019-25035
    out-of-bounds write in sldns_bget_token_par
    bsc#1185387 for CVE-2019-25036
    assertion failure and denial of service in synth_cname
  * bsc1185391.2_CVE-2019-25040.1_2d444a50.patch
    bsc#1185391 for CVE-2019-25040
    infinite loop via a compressed name in dname_pkt_copy
    bsc#1185392 for CVE-2019-25041
    assertion failure via a compressed name in dname_pkt_copy
  * bsc1185389.90_CVE-2019-25038.9_02080f6b.patch
    bsc#1185389 for CVE-2019-25038
    integer overflow in a size calculation in dnscrypt/dnscrypt.c
    bsc#1185390 for CVE-2019-25039
    integer overflow in a size calculation in respip/respip.c
  * bsc1185388_CVE-2019-25037_d2eb78e8.patch
    bsc#1185388 for CVE-2019-25037
    assertion failure and denial of service in dname_pkt_copy via an invalid packet
  * bsc1185393_CVE-2019-25042_6c3a0b54.patch
    bsc#1185393 for CVE-2019-25042
    out-of-bounds write via a compressed name in rdata_copy
- Correct indentation in patch unbound-1.6.8-amplifying-an-incoming-query.patch
  to make it fit to above patches</changelog>
  <changelog author="werner@suse.de" date="1642593600">- Add patch bsc1179191_CVE-2020-28935_19f8f4d9.patch to really fix
  bsc#1179191 CVE-2020-28935: unbound: symbolic link traversal when
  writing PID file</changelog>
  <changelog author="werner@suse.de" date="1642593601">- Import changes from OBS for dlv.isc.org.key, root.anchor, and
  root.key to fix bsc#1112033</changelog>
</package>
<package pkgid="5f3a1366107b9a34dccbb26ae59e53a2eed6aa222cf693471ec7f74318e80e28" name="unbound-anchor" arch="x86_64">
  <version epoch="0" ver="1.6.8" rel="10.6.1"/>
  <changelog author="michael@stroeder.com" date="1497441600">- update to 1.6.3
  Bug Fixes
- Fix #1280: Unbound fails assert when response from authoritative
  contains malformed qname. When 0x20 caps-for-id is enabled, when
  assertions are not enabled the malformed qname is handled correctly.</changelog>
  <changelog author="michael@stroeder.com" date="1498564800">- update to 1.6.4
  Features:
- Implemented trust anchor signaling using key tag query.
- unbound-checkconf -o allows query of dnstap config variables.
  Also unbound-control get_option.  Also for dnscrypt.
- unbound.h exports the shm stats structures.  They use
  type long long and no ifdefs, and ub_ before the typenames.
- Implemented opportunistic IPsec support module (ipsecmod).
- Added redirect-bogus.patch to contrib directory.
- Support for the ED25519 algorithm with openssl (from openssl 1.1.1).
- renumbering B-Root's IPv6 address to 2001:500:200::b.
- Fix #1276: [dnscrypt] add XChaCha20-Poly1305 cipher.
- Fix #1277: disable domain ratelimit by setting value to 0.
- Added fastrpz patch to contrib
  Bug Fixes:
- Added ECS unit test (from Manu Bretelle).
- ECS documentation fix (from Manu Bretelle).
- Fix #1252: more indentation inconsistencies.
- Fix #1253: unused variable in edns-subnet/addrtree.c:getbit().
- Fix #1254: clarify ratelimit-{for,below}-domain (from Manu Bretelle).
- iana portlist update
- Based on #1257: check parse limit before t increment in sldns RR
  string parse routine.
- Fix #1258: Windows 10 X64 unbound 1.6.2 service will not start.
  and fix that 64bit getting installed in C:\Program Files (x86).
- Fix #1259: "--disable-ecdsa" argument overwritten
  by "#ifdef SHA256_DIGEST_LENGTH@daemon/remote.c".
- iana portlist update
- Added test for leak of stub information.
- Fix sldns wire2str printout of RR type CAA tags.
- Fix sldns int16_data parse.
- Fix sldns parse and printout of TSIG RRs.
- sldns SMIMEA and AVC definitions, same as getdns definitions.
- Fix tcp-mss failure printout text.
- Set SO_REUSEADDR on outgoing tcp connections to fix the bind before
  connect limited tcp connections.  With the option tcp connections
  can share the same source port (for different destinations).
- Add 'c' to getopt() in testbound.
- Adjust servfail by iterator to not store in cache when serve-expired
  is enabled, to avoid overwriting useful information there.
- Fix queries for nameservers under a stub leaking to the internet.
- document trust-anchor-signaling in example config file.
- updated configure, dependencies and flex output.
- better module memory lookup, fix of unbound-control shm names for
  module memory printout of statistics.
- Fix type AVC sldns rrdef.
- Some whitespace fixup.
- Fix #1265: contrib/unbound.service contains hardcoded path.
- Fix #1265 to use /bin/kill.
- Fix #1267: Libunbound validator/val_secalgo.c uses obsolete APIs,
  and compatibility with BoringSSL.
- Fix #1268: SIGSEGV after log_reopen.
- exec_prefix is by default equal to prefix.
- printout localzone for duplicate local-zone warnings.
- Fix assertion for low buffer size and big edns payload when worker
  overrides udpsize.
- Support for openssl EVP_DigestVerify.
- Fix #1269: inconsistent use of built-in local zones with views.
- Add defaults for new local-zone trees added to views using
  unbound-control.
- Fix #1273: cachedb.c doesn't compile with -Wextra.
- If MSG_FASTOPEN gives EPIPE fallthrough to try normal tcp write.
- Also use global local-zones when there is a matching view that does
  not have any local-zone specified.
- Fix fastopen EPIPE fallthrough to perform connect.
- Fix #1274: automatically trim chroot path from dnscrypt key/cert paths
  (from Manu Bretelle).
- Fix #1275: cached data in cachedb is never used.
- Fix that unbound-control can set val_clean_additional and
  val_permissive_mode.
- Add dnscrypt XChaCha20 tests.
- Detect chacha for dnscrypt at configure time.
- dnscrypt unit tests with chacha.
- Added domain name based ECS whitelist.
- Fix #1278: Incomplete wildcard proof.
- Fix #1279: Memory leak on reload when python module is enabled.
- Fix #1280: Unbound fails assert when response from authoritative
  contains malformed qname.  When 0x20 caps-for-id is enabled, when
  assertions are not enabled the malformed qname is handled correctly.
- More fixes in depth for buffer checks in 0x20 qname checks.
- Fix stub zone queries leaking to the internet for
  harden-referral-path ns checks.
- Fix query for refetch_glue of stub leaking to internet.
- Fix #1301: memory leak in respip and tests.
- Free callback in edns-subnetmod on exit and restart.
- Fix memory leak in sldns_buffer_new_frm_data.
- Fix memory leak in dnscrypt config read.
- Fix dnscrypt chacha cert support ifdefs.
- Fix dnscrypt chacha cert unit test escapes in grep.
- Fix to unlock view in view test.
- Fix warning in pythonmod under clang compiler.
- Fix lintian typo.
- Fix #1316: heap read buffer overflow in parse_edns_options.</changelog>
  <changelog author="jengelh@inai.de" date="1502193600">- RPM group fix. Do not suppress user/group creation problems.
  Replace %__ type macro indirections.</changelog>
  <changelog author="michael@stroeder.com" date="1503316800">- update to 1.6.5
  * Fix install of trust anchor when two anchors are present, makes both
    valid.  Checks hash of DS but not signature of new key.  This fixes
    installs between sep11 and oct11 2017.</changelog>
  <changelog author="michael@stroeder.com" date="1504526400">- update to 1.6.6
  Features:
- unbound-control dump_infra prints port number for address if not 53.
- Fix #1344: RFC6761-reserved domains: test. and invalid.
- Fix #1349: allow suppression of pidfiles (from Daniel Kahn Gillmor).
  With the -p option unbound does not create a pidfile.
- Added stats for queries that have been ratelimited by domain
  recursion.
- Patch to show DNSCrypt status in help output, from Carsten
  Strotmann.
- Fix #1407: Add ECS options check to unbound-checkconf.
- Fix #1415: [dnscrypt] shared secret cache, patch from
  Manu Bretelle.
  Bug Fixes:
- fixup of dnscrypt_cert_chacha test (from Manu Bretelle).
- First fix for zero b64 and hex text zone format in sldns.
- Better fixup of dnscrypt_cert_chacha test for different escapes.
- Fix that infra cache host hash does not change after reconfig.
- Fix python example0 return module wait instead of error for pass.
- enhancement for hardened-tls for DNS over TLS.  Removed duplicated
  security settings.
- Fix for unbound-checkconf, check ipsecmod-hook if ipsecmod is turned
  on.
- Fix #1331: libunbound segfault in threaded mode when context is
  deleted.
- Fix pythonmod link line option flag.
- Fix openssl 1.1.0 load of ssl error strings from ssl init.
- Fix 1332: Bump verbosity of failed chown'ing of the control socket.
- Redirect all localhost names to localhost address for RFC6761.
- Fix #1350: make cachedb backend configurable (from JINMEI Tatuya).
- Fix tests to use .tdir (from Manu Bretelle) instead of .tpkg.
- upgrade aclocal(pkg.m4 0.29.1), config.guess(2016-10-02),
  config.sub(2016-09-05).
- annotate case statement fallthrough for gcc 7.1.1.
- flex output from flex 2.6.1.
- snprintf of thread number does not warn about truncated string.
- squelch TCP fast open error on FreeBSD when kernel has it disabled,
  unless verbosity is high.
- remove warning from windows compile.
- Fix compile with libnettle
- Fix DSA configure switch (--disable dsa) for libnettle and libnss.
- Fix #1365: Add Ed25519 support using libnettle.
- Fix #1394: mix of serve-expired and response-ip could cause a crash.
- Remove unused iter_env member (ip6arpa_dname)
- Do not reset rrset.bogus stats when called using stats_noreset.
- Do not add rrset_bogus and query ratelimiting stats per thread, these
  module stats are global.
- Fix #1397: Recursive DS lookups for AS112 zones names should recurse.
- Fix #1398: make cachedb secret configurable.
- Remove spaces from Makefile.
- Fix issue on macOX 10.10 where TCP fast open is detected but not
  implemented causing TCP to fail. The fix allows fallback to regular
  TCP in this case and is also more robust for cases where connectx()
  fails for some reason.
- Fix #1402: squelch invalid argument error for fd_set_block on windows.
- Fix to reclaim tcp handler when it is closed due to dnscrypt buffer
  allocation failure.
- Fix #1415: patch to free dnscrypt environment on reload.
- iana portlist update
- Small fixes for the shared secret cache patch.
- Fix WKS records on kvm autobuild host, with default protobyname
  entries for udp and tcp.
- Fix #1414: fix segfault on parse failure and log_replies.
- zero qinfo in handle_request, this zeroes local_alias and also the
  qname member.
- new keys and certs for dnscrypt tests.
- fixup WKS test on buildhost without servicebyname.
- updated contrib/fastrpz.patch to apply with configparser changes.
- Fix 1416: qname-minimisation breaks TLSA lookups with CNAMEs.
- Fix #1424: cachedb:testframe is not thread safe.
- Fix #1417: [dnscrypt] shared secret cache counters, and works when
  dnscrypt is not enabled.  And cache size configuration option.
- Fix #1418: [ip ratelimit] initialize slabhash using
  ip-ratelimit-slabs.
- Recommend 1472 buffer size in unbound.conf</changelog>
  <changelog author="michael@stroeder.com" date="1507636800">- update to 1.6.7
  Features:
- Set trust-anchor-signaling default to yes
- Fix #1440: [dnscrypt] client nonce cache.
- Fix #1435: Please allow UDP to be disabled separately upstream and
  downstream.
  Bug fixes:
- Fix that looping modules always stop the query, and don't pass
  control.
- Fix unbound-host to report error for DNSSEC state of failed lookups.
- Spelling fixes, from Josh Soref.
- Fix #1400: allowing use of global cache on ECS-forwarding unless
  always-forward.
- use a cachedb answer even if it's "expired" when serve-expired is yes
  (patch from Jinmei Tatuya).
- trigger refetching of the answer in that case (this will bypass
  cachedb lookup)
- allow storing a 0-TTL answer from cachedb in the in-memory message
  cache when serve-expired is yes
- Fix DNSCACHE_STORE_ZEROTTL to be bigger than 0xffff.
- Log name of looping module
- Fix #1450: Generate again patch contrib/aaaa-filter-iterator.patch
  (by Danilo G. Baio).
- Fix param unused warning for windows exportsymbol compile.
- Use RCODE from A query on DNS64 synthesized answer.
- Fix trust-anchor-signaling works in libunbound.
- Fix spelling in unbound-control man page.</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="cbosdonnat@suse.com" date="1512129600">- Use python3 instead of python2 (fate#323526)</changelog>
  <changelog author="michael@stroeder.com" date="1516363200">- update to 1.6.8 (bsc#1076963)
  patch for CVE-2017-15105: vulnerability in the processing of
  wildcard synthesized NSEC records.</changelog>
  <changelog author="dmueller@suse.com" date="1539691200">- adjust for root KSK rollover (bsc#1112009, bsc#1004165)</changelog>
  <changelog author="kbabioch@suse.com" date="1539691201">- Disabled DLV configuration by default (bsc#1055060)
- Updated the DNSSEC root trust anchor due to KSK roll over (bsc#1112009)</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1542283200">- Migrated from cron to systemd timers (bsc#1115417)</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1546603200">- Use systemd-tmpfiles to create /var/lib/unbound/root.key
  to avoid transactional update breakage (bsc#1111383)</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1551960000">- Remove old pwdutils dependency and add shadow to cover both useradd
  and groupadd as suggested in (bsc#1126757)</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1556020800">- Add systemd require in unbound-anchor to reflect new dependency (due to systemd-timers)</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1592913600">- Avoid amplifying an incoming query to a large number of queries
  Resolves CVE-2020-12662 CVE-2020-12663 (bsc#1171889)
  [ + unbound-1.6.8-amplifying-an-incoming-query.patch ]</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1592913601">- Avoid shell code execution after receiving a specially crafted answer
  Resolves CVE-2019-18934 (bsc#1157268)
  [ + patch_cve_2019-18934.patch ]</changelog>
  <changelog author="werner@suse.de" date="1642420800">- Add patches
  * bsc1185382_CVE-2019-25031_f8875527.patch
    bsc#1185382 for CVE-2019-25031
    configuration injection in create_unbound_ad_servers.sh upon a successful man-in-the-middle attack
  * bsc1185383.4_CVE-2019-25032.3_226298bb.patch
    bsc#1185383 for CVE-2019-25032
    integer overflow in the regional allocator via regional_alloc
    bsc#1185384 for CVE-2019-25033
    integer overflow in the regional allocator via the ALIGN_UP macro
  * bsc1185385_CVE-2019-25034_a3545867.patch
    bsc#1185385 for CVE-2019-25034
    integer overflow in sldns_str2wire_dname_buf_origin, leading to an out-of-bounds write
  * bsc1185386.7_CVE-2019-25035.6_fa23ee8f.patch
    bsc#1185386 for CVE-2019-25035
    out-of-bounds write in sldns_bget_token_par
    bsc#1185387 for CVE-2019-25036
    assertion failure and denial of service in synth_cname
  * bsc1185391.2_CVE-2019-25040.1_2d444a50.patch
    bsc#1185391 for CVE-2019-25040
    infinite loop via a compressed name in dname_pkt_copy
    bsc#1185392 for CVE-2019-25041
    assertion failure via a compressed name in dname_pkt_copy
  * bsc1185389.90_CVE-2019-25038.9_02080f6b.patch
    bsc#1185389 for CVE-2019-25038
    integer overflow in a size calculation in dnscrypt/dnscrypt.c
    bsc#1185390 for CVE-2019-25039
    integer overflow in a size calculation in respip/respip.c
  * bsc1185388_CVE-2019-25037_d2eb78e8.patch
    bsc#1185388 for CVE-2019-25037
    assertion failure and denial of service in dname_pkt_copy via an invalid packet
  * bsc1185393_CVE-2019-25042_6c3a0b54.patch
    bsc#1185393 for CVE-2019-25042
    out-of-bounds write via a compressed name in rdata_copy
- Correct indentation in patch unbound-1.6.8-amplifying-an-incoming-query.patch
  to make it fit to above patches</changelog>
  <changelog author="werner@suse.de" date="1642593600">- Add patch bsc1179191_CVE-2020-28935_19f8f4d9.patch to really fix
  bsc#1179191 CVE-2020-28935: unbound: symbolic link traversal when
  writing PID file</changelog>
  <changelog author="werner@suse.de" date="1642593601">- Import changes from OBS for dlv.isc.org.key, root.anchor, and
  root.key to fix bsc#1112033</changelog>
</package>
<package pkgid="eaa84cf23d8190b90ee8c33dd310c528cace9925db03319ad2ff805026a893d4" name="unbound-devel" arch="aarch64">
  <version epoch="0" ver="1.6.8" rel="10.6.1"/>
  <changelog author="michael@stroeder.com" date="1497441600">- update to 1.6.3
  Bug Fixes
- Fix #1280: Unbound fails assert when response from authoritative
  contains malformed qname. When 0x20 caps-for-id is enabled, when
  assertions are not enabled the malformed qname is handled correctly.</changelog>
  <changelog author="michael@stroeder.com" date="1498564800">- update to 1.6.4
  Features:
- Implemented trust anchor signaling using key tag query.
- unbound-checkconf -o allows query of dnstap config variables.
  Also unbound-control get_option.  Also for dnscrypt.
- unbound.h exports the shm stats structures.  They use
  type long long and no ifdefs, and ub_ before the typenames.
- Implemented opportunistic IPsec support module (ipsecmod).
- Added redirect-bogus.patch to contrib directory.
- Support for the ED25519 algorithm with openssl (from openssl 1.1.1).
- renumbering B-Root's IPv6 address to 2001:500:200::b.
- Fix #1276: [dnscrypt] add XChaCha20-Poly1305 cipher.
- Fix #1277: disable domain ratelimit by setting value to 0.
- Added fastrpz patch to contrib
  Bug Fixes:
- Added ECS unit test (from Manu Bretelle).
- ECS documentation fix (from Manu Bretelle).
- Fix #1252: more indentation inconsistencies.
- Fix #1253: unused variable in edns-subnet/addrtree.c:getbit().
- Fix #1254: clarify ratelimit-{for,below}-domain (from Manu Bretelle).
- iana portlist update
- Based on #1257: check parse limit before t increment in sldns RR
  string parse routine.
- Fix #1258: Windows 10 X64 unbound 1.6.2 service will not start.
  and fix that 64bit getting installed in C:\Program Files (x86).
- Fix #1259: "--disable-ecdsa" argument overwritten
  by "#ifdef SHA256_DIGEST_LENGTH@daemon/remote.c".
- iana portlist update
- Added test for leak of stub information.
- Fix sldns wire2str printout of RR type CAA tags.
- Fix sldns int16_data parse.
- Fix sldns parse and printout of TSIG RRs.
- sldns SMIMEA and AVC definitions, same as getdns definitions.
- Fix tcp-mss failure printout text.
- Set SO_REUSEADDR on outgoing tcp connections to fix the bind before
  connect limited tcp connections.  With the option tcp connections
  can share the same source port (for different destinations).
- Add 'c' to getopt() in testbound.
- Adjust servfail by iterator to not store in cache when serve-expired
  is enabled, to avoid overwriting useful information there.
- Fix queries for nameservers under a stub leaking to the internet.
- document trust-anchor-signaling in example config file.
- updated configure, dependencies and flex output.
- better module memory lookup, fix of unbound-control shm names for
  module memory printout of statistics.
- Fix type AVC sldns rrdef.
- Some whitespace fixup.
- Fix #1265: contrib/unbound.service contains hardcoded path.
- Fix #1265 to use /bin/kill.
- Fix #1267: Libunbound validator/val_secalgo.c uses obsolete APIs,
  and compatibility with BoringSSL.
- Fix #1268: SIGSEGV after log_reopen.
- exec_prefix is by default equal to prefix.
- printout localzone for duplicate local-zone warnings.
- Fix assertion for low buffer size and big edns payload when worker
  overrides udpsize.
- Support for openssl EVP_DigestVerify.
- Fix #1269: inconsistent use of built-in local zones with views.
- Add defaults for new local-zone trees added to views using
  unbound-control.
- Fix #1273: cachedb.c doesn't compile with -Wextra.
- If MSG_FASTOPEN gives EPIPE fallthrough to try normal tcp write.
- Also use global local-zones when there is a matching view that does
  not have any local-zone specified.
- Fix fastopen EPIPE fallthrough to perform connect.
- Fix #1274: automatically trim chroot path from dnscrypt key/cert paths
  (from Manu Bretelle).
- Fix #1275: cached data in cachedb is never used.
- Fix that unbound-control can set val_clean_additional and
  val_permissive_mode.
- Add dnscrypt XChaCha20 tests.
- Detect chacha for dnscrypt at configure time.
- dnscrypt unit tests with chacha.
- Added domain name based ECS whitelist.
- Fix #1278: Incomplete wildcard proof.
- Fix #1279: Memory leak on reload when python module is enabled.
- Fix #1280: Unbound fails assert when response from authoritative
  contains malformed qname.  When 0x20 caps-for-id is enabled, when
  assertions are not enabled the malformed qname is handled correctly.
- More fixes in depth for buffer checks in 0x20 qname checks.
- Fix stub zone queries leaking to the internet for
  harden-referral-path ns checks.
- Fix query for refetch_glue of stub leaking to internet.
- Fix #1301: memory leak in respip and tests.
- Free callback in edns-subnetmod on exit and restart.
- Fix memory leak in sldns_buffer_new_frm_data.
- Fix memory leak in dnscrypt config read.
- Fix dnscrypt chacha cert support ifdefs.
- Fix dnscrypt chacha cert unit test escapes in grep.
- Fix to unlock view in view test.
- Fix warning in pythonmod under clang compiler.
- Fix lintian typo.
- Fix #1316: heap read buffer overflow in parse_edns_options.</changelog>
  <changelog author="jengelh@inai.de" date="1502193600">- RPM group fix. Do not suppress user/group creation problems.
  Replace %__ type macro indirections.</changelog>
  <changelog author="michael@stroeder.com" date="1503316800">- update to 1.6.5
  * Fix install of trust anchor when two anchors are present, makes both
    valid.  Checks hash of DS but not signature of new key.  This fixes
    installs between sep11 and oct11 2017.</changelog>
  <changelog author="michael@stroeder.com" date="1504526400">- update to 1.6.6
  Features:
- unbound-control dump_infra prints port number for address if not 53.
- Fix #1344: RFC6761-reserved domains: test. and invalid.
- Fix #1349: allow suppression of pidfiles (from Daniel Kahn Gillmor).
  With the -p option unbound does not create a pidfile.
- Added stats for queries that have been ratelimited by domain
  recursion.
- Patch to show DNSCrypt status in help output, from Carsten
  Strotmann.
- Fix #1407: Add ECS options check to unbound-checkconf.
- Fix #1415: [dnscrypt] shared secret cache, patch from
  Manu Bretelle.
  Bug Fixes:
- fixup of dnscrypt_cert_chacha test (from Manu Bretelle).
- First fix for zero b64 and hex text zone format in sldns.
- Better fixup of dnscrypt_cert_chacha test for different escapes.
- Fix that infra cache host hash does not change after reconfig.
- Fix python example0 return module wait instead of error for pass.
- enhancement for hardened-tls for DNS over TLS.  Removed duplicated
  security settings.
- Fix for unbound-checkconf, check ipsecmod-hook if ipsecmod is turned
  on.
- Fix #1331: libunbound segfault in threaded mode when context is
  deleted.
- Fix pythonmod link line option flag.
- Fix openssl 1.1.0 load of ssl error strings from ssl init.
- Fix 1332: Bump verbosity of failed chown'ing of the control socket.
- Redirect all localhost names to localhost address for RFC6761.
- Fix #1350: make cachedb backend configurable (from JINMEI Tatuya).
- Fix tests to use .tdir (from Manu Bretelle) instead of .tpkg.
- upgrade aclocal(pkg.m4 0.29.1), config.guess(2016-10-02),
  config.sub(2016-09-05).
- annotate case statement fallthrough for gcc 7.1.1.
- flex output from flex 2.6.1.
- snprintf of thread number does not warn about truncated string.
- squelch TCP fast open error on FreeBSD when kernel has it disabled,
  unless verbosity is high.
- remove warning from windows compile.
- Fix compile with libnettle
- Fix DSA configure switch (--disable dsa) for libnettle and libnss.
- Fix #1365: Add Ed25519 support using libnettle.
- Fix #1394: mix of serve-expired and response-ip could cause a crash.
- Remove unused iter_env member (ip6arpa_dname)
- Do not reset rrset.bogus stats when called using stats_noreset.
- Do not add rrset_bogus and query ratelimiting stats per thread, these
  module stats are global.
- Fix #1397: Recursive DS lookups for AS112 zones names should recurse.
- Fix #1398: make cachedb secret configurable.
- Remove spaces from Makefile.
- Fix issue on macOX 10.10 where TCP fast open is detected but not
  implemented causing TCP to fail. The fix allows fallback to regular
  TCP in this case and is also more robust for cases where connectx()
  fails for some reason.
- Fix #1402: squelch invalid argument error for fd_set_block on windows.
- Fix to reclaim tcp handler when it is closed due to dnscrypt buffer
  allocation failure.
- Fix #1415: patch to free dnscrypt environment on reload.
- iana portlist update
- Small fixes for the shared secret cache patch.
- Fix WKS records on kvm autobuild host, with default protobyname
  entries for udp and tcp.
- Fix #1414: fix segfault on parse failure and log_replies.
- zero qinfo in handle_request, this zeroes local_alias and also the
  qname member.
- new keys and certs for dnscrypt tests.
- fixup WKS test on buildhost without servicebyname.
- updated contrib/fastrpz.patch to apply with configparser changes.
- Fix 1416: qname-minimisation breaks TLSA lookups with CNAMEs.
- Fix #1424: cachedb:testframe is not thread safe.
- Fix #1417: [dnscrypt] shared secret cache counters, and works when
  dnscrypt is not enabled.  And cache size configuration option.
- Fix #1418: [ip ratelimit] initialize slabhash using
  ip-ratelimit-slabs.
- Recommend 1472 buffer size in unbound.conf</changelog>
  <changelog author="michael@stroeder.com" date="1507636800">- update to 1.6.7
  Features:
- Set trust-anchor-signaling default to yes
- Fix #1440: [dnscrypt] client nonce cache.
- Fix #1435: Please allow UDP to be disabled separately upstream and
  downstream.
  Bug fixes:
- Fix that looping modules always stop the query, and don't pass
  control.
- Fix unbound-host to report error for DNSSEC state of failed lookups.
- Spelling fixes, from Josh Soref.
- Fix #1400: allowing use of global cache on ECS-forwarding unless
  always-forward.
- use a cachedb answer even if it's "expired" when serve-expired is yes
  (patch from Jinmei Tatuya).
- trigger refetching of the answer in that case (this will bypass
  cachedb lookup)
- allow storing a 0-TTL answer from cachedb in the in-memory message
  cache when serve-expired is yes
- Fix DNSCACHE_STORE_ZEROTTL to be bigger than 0xffff.
- Log name of looping module
- Fix #1450: Generate again patch contrib/aaaa-filter-iterator.patch
  (by Danilo G. Baio).
- Fix param unused warning for windows exportsymbol compile.
- Use RCODE from A query on DNS64 synthesized answer.
- Fix trust-anchor-signaling works in libunbound.
- Fix spelling in unbound-control man page.</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="cbosdonnat@suse.com" date="1512129600">- Use python3 instead of python2 (fate#323526)</changelog>
  <changelog author="michael@stroeder.com" date="1516363200">- update to 1.6.8 (bsc#1076963)
  patch for CVE-2017-15105: vulnerability in the processing of
  wildcard synthesized NSEC records.</changelog>
  <changelog author="dmueller@suse.com" date="1539691200">- adjust for root KSK rollover (bsc#1112009, bsc#1004165)</changelog>
  <changelog author="kbabioch@suse.com" date="1539691201">- Disabled DLV configuration by default (bsc#1055060)
- Updated the DNSSEC root trust anchor due to KSK roll over (bsc#1112009)</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1542283200">- Migrated from cron to systemd timers (bsc#1115417)</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1546603200">- Use systemd-tmpfiles to create /var/lib/unbound/root.key
  to avoid transactional update breakage (bsc#1111383)</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1551960000">- Remove old pwdutils dependency and add shadow to cover both useradd
  and groupadd as suggested in (bsc#1126757)</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1556020800">- Add systemd require in unbound-anchor to reflect new dependency (due to systemd-timers)</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1592913600">- Avoid amplifying an incoming query to a large number of queries
  Resolves CVE-2020-12662 CVE-2020-12663 (bsc#1171889)
  [ + unbound-1.6.8-amplifying-an-incoming-query.patch ]</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1592913601">- Avoid shell code execution after receiving a specially crafted answer
  Resolves CVE-2019-18934 (bsc#1157268)
  [ + patch_cve_2019-18934.patch ]</changelog>
  <changelog author="werner@suse.de" date="1642420800">- Add patches
  * bsc1185382_CVE-2019-25031_f8875527.patch
    bsc#1185382 for CVE-2019-25031
    configuration injection in create_unbound_ad_servers.sh upon a successful man-in-the-middle attack
  * bsc1185383.4_CVE-2019-25032.3_226298bb.patch
    bsc#1185383 for CVE-2019-25032
    integer overflow in the regional allocator via regional_alloc
    bsc#1185384 for CVE-2019-25033
    integer overflow in the regional allocator via the ALIGN_UP macro
  * bsc1185385_CVE-2019-25034_a3545867.patch
    bsc#1185385 for CVE-2019-25034
    integer overflow in sldns_str2wire_dname_buf_origin, leading to an out-of-bounds write
  * bsc1185386.7_CVE-2019-25035.6_fa23ee8f.patch
    bsc#1185386 for CVE-2019-25035
    out-of-bounds write in sldns_bget_token_par
    bsc#1185387 for CVE-2019-25036
    assertion failure and denial of service in synth_cname
  * bsc1185391.2_CVE-2019-25040.1_2d444a50.patch
    bsc#1185391 for CVE-2019-25040
    infinite loop via a compressed name in dname_pkt_copy
    bsc#1185392 for CVE-2019-25041
    assertion failure via a compressed name in dname_pkt_copy
  * bsc1185389.90_CVE-2019-25038.9_02080f6b.patch
    bsc#1185389 for CVE-2019-25038
    integer overflow in a size calculation in dnscrypt/dnscrypt.c
    bsc#1185390 for CVE-2019-25039
    integer overflow in a size calculation in respip/respip.c
  * bsc1185388_CVE-2019-25037_d2eb78e8.patch
    bsc#1185388 for CVE-2019-25037
    assertion failure and denial of service in dname_pkt_copy via an invalid packet
  * bsc1185393_CVE-2019-25042_6c3a0b54.patch
    bsc#1185393 for CVE-2019-25042
    out-of-bounds write via a compressed name in rdata_copy
- Correct indentation in patch unbound-1.6.8-amplifying-an-incoming-query.patch
  to make it fit to above patches</changelog>
  <changelog author="werner@suse.de" date="1642593600">- Add patch bsc1179191_CVE-2020-28935_19f8f4d9.patch to really fix
  bsc#1179191 CVE-2020-28935: unbound: symbolic link traversal when
  writing PID file</changelog>
  <changelog author="werner@suse.de" date="1642593601">- Import changes from OBS for dlv.isc.org.key, root.anchor, and
  root.key to fix bsc#1112033</changelog>
</package>
<package pkgid="73f82d0f0ae4653216cafefeb8d69ac1e5fc0df8cd7324bb00f0fdc0ea1bc5c5" name="unbound-devel" arch="ppc64le">
  <version epoch="0" ver="1.6.8" rel="10.6.1"/>
  <changelog author="michael@stroeder.com" date="1497441600">- update to 1.6.3
  Bug Fixes
- Fix #1280: Unbound fails assert when response from authoritative
  contains malformed qname. When 0x20 caps-for-id is enabled, when
  assertions are not enabled the malformed qname is handled correctly.</changelog>
  <changelog author="michael@stroeder.com" date="1498564800">- update to 1.6.4
  Features:
- Implemented trust anchor signaling using key tag query.
- unbound-checkconf -o allows query of dnstap config variables.
  Also unbound-control get_option.  Also for dnscrypt.
- unbound.h exports the shm stats structures.  They use
  type long long and no ifdefs, and ub_ before the typenames.
- Implemented opportunistic IPsec support module (ipsecmod).
- Added redirect-bogus.patch to contrib directory.
- Support for the ED25519 algorithm with openssl (from openssl 1.1.1).
- renumbering B-Root's IPv6 address to 2001:500:200::b.
- Fix #1276: [dnscrypt] add XChaCha20-Poly1305 cipher.
- Fix #1277: disable domain ratelimit by setting value to 0.
- Added fastrpz patch to contrib
  Bug Fixes:
- Added ECS unit test (from Manu Bretelle).
- ECS documentation fix (from Manu Bretelle).
- Fix #1252: more indentation inconsistencies.
- Fix #1253: unused variable in edns-subnet/addrtree.c:getbit().
- Fix #1254: clarify ratelimit-{for,below}-domain (from Manu Bretelle).
- iana portlist update
- Based on #1257: check parse limit before t increment in sldns RR
  string parse routine.
- Fix #1258: Windows 10 X64 unbound 1.6.2 service will not start.
  and fix that 64bit getting installed in C:\Program Files (x86).
- Fix #1259: "--disable-ecdsa" argument overwritten
  by "#ifdef SHA256_DIGEST_LENGTH@daemon/remote.c".
- iana portlist update
- Added test for leak of stub information.
- Fix sldns wire2str printout of RR type CAA tags.
- Fix sldns int16_data parse.
- Fix sldns parse and printout of TSIG RRs.
- sldns SMIMEA and AVC definitions, same as getdns definitions.
- Fix tcp-mss failure printout text.
- Set SO_REUSEADDR on outgoing tcp connections to fix the bind before
  connect limited tcp connections.  With the option tcp connections
  can share the same source port (for different destinations).
- Add 'c' to getopt() in testbound.
- Adjust servfail by iterator to not store in cache when serve-expired
  is enabled, to avoid overwriting useful information there.
- Fix queries for nameservers under a stub leaking to the internet.
- document trust-anchor-signaling in example config file.
- updated configure, dependencies and flex output.
- better module memory lookup, fix of unbound-control shm names for
  module memory printout of statistics.
- Fix type AVC sldns rrdef.
- Some whitespace fixup.
- Fix #1265: contrib/unbound.service contains hardcoded path.
- Fix #1265 to use /bin/kill.
- Fix #1267: Libunbound validator/val_secalgo.c uses obsolete APIs,
  and compatibility with BoringSSL.
- Fix #1268: SIGSEGV after log_reopen.
- exec_prefix is by default equal to prefix.
- printout localzone for duplicate local-zone warnings.
- Fix assertion for low buffer size and big edns payload when worker
  overrides udpsize.
- Support for openssl EVP_DigestVerify.
- Fix #1269: inconsistent use of built-in local zones with views.
- Add defaults for new local-zone trees added to views using
  unbound-control.
- Fix #1273: cachedb.c doesn't compile with -Wextra.
- If MSG_FASTOPEN gives EPIPE fallthrough to try normal tcp write.
- Also use global local-zones when there is a matching view that does
  not have any local-zone specified.
- Fix fastopen EPIPE fallthrough to perform connect.
- Fix #1274: automatically trim chroot path from dnscrypt key/cert paths
  (from Manu Bretelle).
- Fix #1275: cached data in cachedb is never used.
- Fix that unbound-control can set val_clean_additional and
  val_permissive_mode.
- Add dnscrypt XChaCha20 tests.
- Detect chacha for dnscrypt at configure time.
- dnscrypt unit tests with chacha.
- Added domain name based ECS whitelist.
- Fix #1278: Incomplete wildcard proof.
- Fix #1279: Memory leak on reload when python module is enabled.
- Fix #1280: Unbound fails assert when response from authoritative
  contains malformed qname.  When 0x20 caps-for-id is enabled, when
  assertions are not enabled the malformed qname is handled correctly.
- More fixes in depth for buffer checks in 0x20 qname checks.
- Fix stub zone queries leaking to the internet for
  harden-referral-path ns checks.
- Fix query for refetch_glue of stub leaking to internet.
- Fix #1301: memory leak in respip and tests.
- Free callback in edns-subnetmod on exit and restart.
- Fix memory leak in sldns_buffer_new_frm_data.
- Fix memory leak in dnscrypt config read.
- Fix dnscrypt chacha cert support ifdefs.
- Fix dnscrypt chacha cert unit test escapes in grep.
- Fix to unlock view in view test.
- Fix warning in pythonmod under clang compiler.
- Fix lintian typo.
- Fix #1316: heap read buffer overflow in parse_edns_options.</changelog>
  <changelog author="jengelh@inai.de" date="1502193600">- RPM group fix. Do not suppress user/group creation problems.
  Replace %__ type macro indirections.</changelog>
  <changelog author="michael@stroeder.com" date="1503316800">- update to 1.6.5
  * Fix install of trust anchor when two anchors are present, makes both
    valid.  Checks hash of DS but not signature of new key.  This fixes
    installs between sep11 and oct11 2017.</changelog>
  <changelog author="michael@stroeder.com" date="1504526400">- update to 1.6.6
  Features:
- unbound-control dump_infra prints port number for address if not 53.
- Fix #1344: RFC6761-reserved domains: test. and invalid.
- Fix #1349: allow suppression of pidfiles (from Daniel Kahn Gillmor).
  With the -p option unbound does not create a pidfile.
- Added stats for queries that have been ratelimited by domain
  recursion.
- Patch to show DNSCrypt status in help output, from Carsten
  Strotmann.
- Fix #1407: Add ECS options check to unbound-checkconf.
- Fix #1415: [dnscrypt] shared secret cache, patch from
  Manu Bretelle.
  Bug Fixes:
- fixup of dnscrypt_cert_chacha test (from Manu Bretelle).
- First fix for zero b64 and hex text zone format in sldns.
- Better fixup of dnscrypt_cert_chacha test for different escapes.
- Fix that infra cache host hash does not change after reconfig.
- Fix python example0 return module wait instead of error for pass.
- enhancement for hardened-tls for DNS over TLS.  Removed duplicated
  security settings.
- Fix for unbound-checkconf, check ipsecmod-hook if ipsecmod is turned
  on.
- Fix #1331: libunbound segfault in threaded mode when context is
  deleted.
- Fix pythonmod link line option flag.
- Fix openssl 1.1.0 load of ssl error strings from ssl init.
- Fix 1332: Bump verbosity of failed chown'ing of the control socket.
- Redirect all localhost names to localhost address for RFC6761.
- Fix #1350: make cachedb backend configurable (from JINMEI Tatuya).
- Fix tests to use .tdir (from Manu Bretelle) instead of .tpkg.
- upgrade aclocal(pkg.m4 0.29.1), config.guess(2016-10-02),
  config.sub(2016-09-05).
- annotate case statement fallthrough for gcc 7.1.1.
- flex output from flex 2.6.1.
- snprintf of thread number does not warn about truncated string.
- squelch TCP fast open error on FreeBSD when kernel has it disabled,
  unless verbosity is high.
- remove warning from windows compile.
- Fix compile with libnettle
- Fix DSA configure switch (--disable dsa) for libnettle and libnss.
- Fix #1365: Add Ed25519 support using libnettle.
- Fix #1394: mix of serve-expired and response-ip could cause a crash.
- Remove unused iter_env member (ip6arpa_dname)
- Do not reset rrset.bogus stats when called using stats_noreset.
- Do not add rrset_bogus and query ratelimiting stats per thread, these
  module stats are global.
- Fix #1397: Recursive DS lookups for AS112 zones names should recurse.
- Fix #1398: make cachedb secret configurable.
- Remove spaces from Makefile.
- Fix issue on macOX 10.10 where TCP fast open is detected but not
  implemented causing TCP to fail. The fix allows fallback to regular
  TCP in this case and is also more robust for cases where connectx()
  fails for some reason.
- Fix #1402: squelch invalid argument error for fd_set_block on windows.
- Fix to reclaim tcp handler when it is closed due to dnscrypt buffer
  allocation failure.
- Fix #1415: patch to free dnscrypt environment on reload.
- iana portlist update
- Small fixes for the shared secret cache patch.
- Fix WKS records on kvm autobuild host, with default protobyname
  entries for udp and tcp.
- Fix #1414: fix segfault on parse failure and log_replies.
- zero qinfo in handle_request, this zeroes local_alias and also the
  qname member.
- new keys and certs for dnscrypt tests.
- fixup WKS test on buildhost without servicebyname.
- updated contrib/fastrpz.patch to apply with configparser changes.
- Fix 1416: qname-minimisation breaks TLSA lookups with CNAMEs.
- Fix #1424: cachedb:testframe is not thread safe.
- Fix #1417: [dnscrypt] shared secret cache counters, and works when
  dnscrypt is not enabled.  And cache size configuration option.
- Fix #1418: [ip ratelimit] initialize slabhash using
  ip-ratelimit-slabs.
- Recommend 1472 buffer size in unbound.conf</changelog>
  <changelog author="michael@stroeder.com" date="1507636800">- update to 1.6.7
  Features:
- Set trust-anchor-signaling default to yes
- Fix #1440: [dnscrypt] client nonce cache.
- Fix #1435: Please allow UDP to be disabled separately upstream and
  downstream.
  Bug fixes:
- Fix that looping modules always stop the query, and don't pass
  control.
- Fix unbound-host to report error for DNSSEC state of failed lookups.
- Spelling fixes, from Josh Soref.
- Fix #1400: allowing use of global cache on ECS-forwarding unless
  always-forward.
- use a cachedb answer even if it's "expired" when serve-expired is yes
  (patch from Jinmei Tatuya).
- trigger refetching of the answer in that case (this will bypass
  cachedb lookup)
- allow storing a 0-TTL answer from cachedb in the in-memory message
  cache when serve-expired is yes
- Fix DNSCACHE_STORE_ZEROTTL to be bigger than 0xffff.
- Log name of looping module
- Fix #1450: Generate again patch contrib/aaaa-filter-iterator.patch
  (by Danilo G. Baio).
- Fix param unused warning for windows exportsymbol compile.
- Use RCODE from A query on DNS64 synthesized answer.
- Fix trust-anchor-signaling works in libunbound.
- Fix spelling in unbound-control man page.</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="cbosdonnat@suse.com" date="1512129600">- Use python3 instead of python2 (fate#323526)</changelog>
  <changelog author="michael@stroeder.com" date="1516363200">- update to 1.6.8 (bsc#1076963)
  patch for CVE-2017-15105: vulnerability in the processing of
  wildcard synthesized NSEC records.</changelog>
  <changelog author="dmueller@suse.com" date="1539691200">- adjust for root KSK rollover (bsc#1112009, bsc#1004165)</changelog>
  <changelog author="kbabioch@suse.com" date="1539691201">- Disabled DLV configuration by default (bsc#1055060)
- Updated the DNSSEC root trust anchor due to KSK roll over (bsc#1112009)</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1542283200">- Migrated from cron to systemd timers (bsc#1115417)</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1546603200">- Use systemd-tmpfiles to create /var/lib/unbound/root.key
  to avoid transactional update breakage (bsc#1111383)</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1551960000">- Remove old pwdutils dependency and add shadow to cover both useradd
  and groupadd as suggested in (bsc#1126757)</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1556020800">- Add systemd require in unbound-anchor to reflect new dependency (due to systemd-timers)</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1592913600">- Avoid amplifying an incoming query to a large number of queries
  Resolves CVE-2020-12662 CVE-2020-12663 (bsc#1171889)
  [ + unbound-1.6.8-amplifying-an-incoming-query.patch ]</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1592913601">- Avoid shell code execution after receiving a specially crafted answer
  Resolves CVE-2019-18934 (bsc#1157268)
  [ + patch_cve_2019-18934.patch ]</changelog>
  <changelog author="werner@suse.de" date="1642420800">- Add patches
  * bsc1185382_CVE-2019-25031_f8875527.patch
    bsc#1185382 for CVE-2019-25031
    configuration injection in create_unbound_ad_servers.sh upon a successful man-in-the-middle attack
  * bsc1185383.4_CVE-2019-25032.3_226298bb.patch
    bsc#1185383 for CVE-2019-25032
    integer overflow in the regional allocator via regional_alloc
    bsc#1185384 for CVE-2019-25033
    integer overflow in the regional allocator via the ALIGN_UP macro
  * bsc1185385_CVE-2019-25034_a3545867.patch
    bsc#1185385 for CVE-2019-25034
    integer overflow in sldns_str2wire_dname_buf_origin, leading to an out-of-bounds write
  * bsc1185386.7_CVE-2019-25035.6_fa23ee8f.patch
    bsc#1185386 for CVE-2019-25035
    out-of-bounds write in sldns_bget_token_par
    bsc#1185387 for CVE-2019-25036
    assertion failure and denial of service in synth_cname
  * bsc1185391.2_CVE-2019-25040.1_2d444a50.patch
    bsc#1185391 for CVE-2019-25040
    infinite loop via a compressed name in dname_pkt_copy
    bsc#1185392 for CVE-2019-25041
    assertion failure via a compressed name in dname_pkt_copy
  * bsc1185389.90_CVE-2019-25038.9_02080f6b.patch
    bsc#1185389 for CVE-2019-25038
    integer overflow in a size calculation in dnscrypt/dnscrypt.c
    bsc#1185390 for CVE-2019-25039
    integer overflow in a size calculation in respip/respip.c
  * bsc1185388_CVE-2019-25037_d2eb78e8.patch
    bsc#1185388 for CVE-2019-25037
    assertion failure and denial of service in dname_pkt_copy via an invalid packet
  * bsc1185393_CVE-2019-25042_6c3a0b54.patch
    bsc#1185393 for CVE-2019-25042
    out-of-bounds write via a compressed name in rdata_copy
- Correct indentation in patch unbound-1.6.8-amplifying-an-incoming-query.patch
  to make it fit to above patches</changelog>
  <changelog author="werner@suse.de" date="1642593600">- Add patch bsc1179191_CVE-2020-28935_19f8f4d9.patch to really fix
  bsc#1179191 CVE-2020-28935: unbound: symbolic link traversal when
  writing PID file</changelog>
  <changelog author="werner@suse.de" date="1642593601">- Import changes from OBS for dlv.isc.org.key, root.anchor, and
  root.key to fix bsc#1112033</changelog>
</package>
<package pkgid="75f9961aacecfa8ea2e1e8883a4bffac890291b4b20f511771d28977b3cdc9d4" name="unbound-devel" arch="s390x">
  <version epoch="0" ver="1.6.8" rel="10.6.1"/>
  <changelog author="michael@stroeder.com" date="1497441600">- update to 1.6.3
  Bug Fixes
- Fix #1280: Unbound fails assert when response from authoritative
  contains malformed qname. When 0x20 caps-for-id is enabled, when
  assertions are not enabled the malformed qname is handled correctly.</changelog>
  <changelog author="michael@stroeder.com" date="1498564800">- update to 1.6.4
  Features:
- Implemented trust anchor signaling using key tag query.
- unbound-checkconf -o allows query of dnstap config variables.
  Also unbound-control get_option.  Also for dnscrypt.
- unbound.h exports the shm stats structures.  They use
  type long long and no ifdefs, and ub_ before the typenames.
- Implemented opportunistic IPsec support module (ipsecmod).
- Added redirect-bogus.patch to contrib directory.
- Support for the ED25519 algorithm with openssl (from openssl 1.1.1).
- renumbering B-Root's IPv6 address to 2001:500:200::b.
- Fix #1276: [dnscrypt] add XChaCha20-Poly1305 cipher.
- Fix #1277: disable domain ratelimit by setting value to 0.
- Added fastrpz patch to contrib
  Bug Fixes:
- Added ECS unit test (from Manu Bretelle).
- ECS documentation fix (from Manu Bretelle).
- Fix #1252: more indentation inconsistencies.
- Fix #1253: unused variable in edns-subnet/addrtree.c:getbit().
- Fix #1254: clarify ratelimit-{for,below}-domain (from Manu Bretelle).
- iana portlist update
- Based on #1257: check parse limit before t increment in sldns RR
  string parse routine.
- Fix #1258: Windows 10 X64 unbound 1.6.2 service will not start.
  and fix that 64bit getting installed in C:\Program Files (x86).
- Fix #1259: "--disable-ecdsa" argument overwritten
  by "#ifdef SHA256_DIGEST_LENGTH@daemon/remote.c".
- iana portlist update
- Added test for leak of stub information.
- Fix sldns wire2str printout of RR type CAA tags.
- Fix sldns int16_data parse.
- Fix sldns parse and printout of TSIG RRs.
- sldns SMIMEA and AVC definitions, same as getdns definitions.
- Fix tcp-mss failure printout text.
- Set SO_REUSEADDR on outgoing tcp connections to fix the bind before
  connect limited tcp connections.  With the option tcp connections
  can share the same source port (for different destinations).
- Add 'c' to getopt() in testbound.
- Adjust servfail by iterator to not store in cache when serve-expired
  is enabled, to avoid overwriting useful information there.
- Fix queries for nameservers under a stub leaking to the internet.
- document trust-anchor-signaling in example config file.
- updated configure, dependencies and flex output.
- better module memory lookup, fix of unbound-control shm names for
  module memory printout of statistics.
- Fix type AVC sldns rrdef.
- Some whitespace fixup.
- Fix #1265: contrib/unbound.service contains hardcoded path.
- Fix #1265 to use /bin/kill.
- Fix #1267: Libunbound validator/val_secalgo.c uses obsolete APIs,
  and compatibility with BoringSSL.
- Fix #1268: SIGSEGV after log_reopen.
- exec_prefix is by default equal to prefix.
- printout localzone for duplicate local-zone warnings.
- Fix assertion for low buffer size and big edns payload when worker
  overrides udpsize.
- Support for openssl EVP_DigestVerify.
- Fix #1269: inconsistent use of built-in local zones with views.
- Add defaults for new local-zone trees added to views using
  unbound-control.
- Fix #1273: cachedb.c doesn't compile with -Wextra.
- If MSG_FASTOPEN gives EPIPE fallthrough to try normal tcp write.
- Also use global local-zones when there is a matching view that does
  not have any local-zone specified.
- Fix fastopen EPIPE fallthrough to perform connect.
- Fix #1274: automatically trim chroot path from dnscrypt key/cert paths
  (from Manu Bretelle).
- Fix #1275: cached data in cachedb is never used.
- Fix that unbound-control can set val_clean_additional and
  val_permissive_mode.
- Add dnscrypt XChaCha20 tests.
- Detect chacha for dnscrypt at configure time.
- dnscrypt unit tests with chacha.
- Added domain name based ECS whitelist.
- Fix #1278: Incomplete wildcard proof.
- Fix #1279: Memory leak on reload when python module is enabled.
- Fix #1280: Unbound fails assert when response from authoritative
  contains malformed qname.  When 0x20 caps-for-id is enabled, when
  assertions are not enabled the malformed qname is handled correctly.
- More fixes in depth for buffer checks in 0x20 qname checks.
- Fix stub zone queries leaking to the internet for
  harden-referral-path ns checks.
- Fix query for refetch_glue of stub leaking to internet.
- Fix #1301: memory leak in respip and tests.
- Free callback in edns-subnetmod on exit and restart.
- Fix memory leak in sldns_buffer_new_frm_data.
- Fix memory leak in dnscrypt config read.
- Fix dnscrypt chacha cert support ifdefs.
- Fix dnscrypt chacha cert unit test escapes in grep.
- Fix to unlock view in view test.
- Fix warning in pythonmod under clang compiler.
- Fix lintian typo.
- Fix #1316: heap read buffer overflow in parse_edns_options.</changelog>
  <changelog author="jengelh@inai.de" date="1502193600">- RPM group fix. Do not suppress user/group creation problems.
  Replace %__ type macro indirections.</changelog>
  <changelog author="michael@stroeder.com" date="1503316800">- update to 1.6.5
  * Fix install of trust anchor when two anchors are present, makes both
    valid.  Checks hash of DS but not signature of new key.  This fixes
    installs between sep11 and oct11 2017.</changelog>
  <changelog author="michael@stroeder.com" date="1504526400">- update to 1.6.6
  Features:
- unbound-control dump_infra prints port number for address if not 53.
- Fix #1344: RFC6761-reserved domains: test. and invalid.
- Fix #1349: allow suppression of pidfiles (from Daniel Kahn Gillmor).
  With the -p option unbound does not create a pidfile.
- Added stats for queries that have been ratelimited by domain
  recursion.
- Patch to show DNSCrypt status in help output, from Carsten
  Strotmann.
- Fix #1407: Add ECS options check to unbound-checkconf.
- Fix #1415: [dnscrypt] shared secret cache, patch from
  Manu Bretelle.
  Bug Fixes:
- fixup of dnscrypt_cert_chacha test (from Manu Bretelle).
- First fix for zero b64 and hex text zone format in sldns.
- Better fixup of dnscrypt_cert_chacha test for different escapes.
- Fix that infra cache host hash does not change after reconfig.
- Fix python example0 return module wait instead of error for pass.
- enhancement for hardened-tls for DNS over TLS.  Removed duplicated
  security settings.
- Fix for unbound-checkconf, check ipsecmod-hook if ipsecmod is turned
  on.
- Fix #1331: libunbound segfault in threaded mode when context is
  deleted.
- Fix pythonmod link line option flag.
- Fix openssl 1.1.0 load of ssl error strings from ssl init.
- Fix 1332: Bump verbosity of failed chown'ing of the control socket.
- Redirect all localhost names to localhost address for RFC6761.
- Fix #1350: make cachedb backend configurable (from JINMEI Tatuya).
- Fix tests to use .tdir (from Manu Bretelle) instead of .tpkg.
- upgrade aclocal(pkg.m4 0.29.1), config.guess(2016-10-02),
  config.sub(2016-09-05).
- annotate case statement fallthrough for gcc 7.1.1.
- flex output from flex 2.6.1.
- snprintf of thread number does not warn about truncated string.
- squelch TCP fast open error on FreeBSD when kernel has it disabled,
  unless verbosity is high.
- remove warning from windows compile.
- Fix compile with libnettle
- Fix DSA configure switch (--disable dsa) for libnettle and libnss.
- Fix #1365: Add Ed25519 support using libnettle.
- Fix #1394: mix of serve-expired and response-ip could cause a crash.
- Remove unused iter_env member (ip6arpa_dname)
- Do not reset rrset.bogus stats when called using stats_noreset.
- Do not add rrset_bogus and query ratelimiting stats per thread, these
  module stats are global.
- Fix #1397: Recursive DS lookups for AS112 zones names should recurse.
- Fix #1398: make cachedb secret configurable.
- Remove spaces from Makefile.
- Fix issue on macOX 10.10 where TCP fast open is detected but not
  implemented causing TCP to fail. The fix allows fallback to regular
  TCP in this case and is also more robust for cases where connectx()
  fails for some reason.
- Fix #1402: squelch invalid argument error for fd_set_block on windows.
- Fix to reclaim tcp handler when it is closed due to dnscrypt buffer
  allocation failure.
- Fix #1415: patch to free dnscrypt environment on reload.
- iana portlist update
- Small fixes for the shared secret cache patch.
- Fix WKS records on kvm autobuild host, with default protobyname
  entries for udp and tcp.
- Fix #1414: fix segfault on parse failure and log_replies.
- zero qinfo in handle_request, this zeroes local_alias and also the
  qname member.
- new keys and certs for dnscrypt tests.
- fixup WKS test on buildhost without servicebyname.
- updated contrib/fastrpz.patch to apply with configparser changes.
- Fix 1416: qname-minimisation breaks TLSA lookups with CNAMEs.
- Fix #1424: cachedb:testframe is not thread safe.
- Fix #1417: [dnscrypt] shared secret cache counters, and works when
  dnscrypt is not enabled.  And cache size configuration option.
- Fix #1418: [ip ratelimit] initialize slabhash using
  ip-ratelimit-slabs.
- Recommend 1472 buffer size in unbound.conf</changelog>
  <changelog author="michael@stroeder.com" date="1507636800">- update to 1.6.7
  Features:
- Set trust-anchor-signaling default to yes
- Fix #1440: [dnscrypt] client nonce cache.
- Fix #1435: Please allow UDP to be disabled separately upstream and
  downstream.
  Bug fixes:
- Fix that looping modules always stop the query, and don't pass
  control.
- Fix unbound-host to report error for DNSSEC state of failed lookups.
- Spelling fixes, from Josh Soref.
- Fix #1400: allowing use of global cache on ECS-forwarding unless
  always-forward.
- use a cachedb answer even if it's "expired" when serve-expired is yes
  (patch from Jinmei Tatuya).
- trigger refetching of the answer in that case (this will bypass
  cachedb lookup)
- allow storing a 0-TTL answer from cachedb in the in-memory message
  cache when serve-expired is yes
- Fix DNSCACHE_STORE_ZEROTTL to be bigger than 0xffff.
- Log name of looping module
- Fix #1450: Generate again patch contrib/aaaa-filter-iterator.patch
  (by Danilo G. Baio).
- Fix param unused warning for windows exportsymbol compile.
- Use RCODE from A query on DNS64 synthesized answer.
- Fix trust-anchor-signaling works in libunbound.
- Fix spelling in unbound-control man page.</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="cbosdonnat@suse.com" date="1512129600">- Use python3 instead of python2 (fate#323526)</changelog>
  <changelog author="michael@stroeder.com" date="1516363200">- update to 1.6.8 (bsc#1076963)
  patch for CVE-2017-15105: vulnerability in the processing of
  wildcard synthesized NSEC records.</changelog>
  <changelog author="dmueller@suse.com" date="1539691200">- adjust for root KSK rollover (bsc#1112009, bsc#1004165)</changelog>
  <changelog author="kbabioch@suse.com" date="1539691201">- Disabled DLV configuration by default (bsc#1055060)
- Updated the DNSSEC root trust anchor due to KSK roll over (bsc#1112009)</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1542283200">- Migrated from cron to systemd timers (bsc#1115417)</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1546603200">- Use systemd-tmpfiles to create /var/lib/unbound/root.key
  to avoid transactional update breakage (bsc#1111383)</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1551960000">- Remove old pwdutils dependency and add shadow to cover both useradd
  and groupadd as suggested in (bsc#1126757)</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1556020800">- Add systemd require in unbound-anchor to reflect new dependency (due to systemd-timers)</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1592913600">- Avoid amplifying an incoming query to a large number of queries
  Resolves CVE-2020-12662 CVE-2020-12663 (bsc#1171889)
  [ + unbound-1.6.8-amplifying-an-incoming-query.patch ]</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1592913601">- Avoid shell code execution after receiving a specially crafted answer
  Resolves CVE-2019-18934 (bsc#1157268)
  [ + patch_cve_2019-18934.patch ]</changelog>
  <changelog author="werner@suse.de" date="1642420800">- Add patches
  * bsc1185382_CVE-2019-25031_f8875527.patch
    bsc#1185382 for CVE-2019-25031
    configuration injection in create_unbound_ad_servers.sh upon a successful man-in-the-middle attack
  * bsc1185383.4_CVE-2019-25032.3_226298bb.patch
    bsc#1185383 for CVE-2019-25032
    integer overflow in the regional allocator via regional_alloc
    bsc#1185384 for CVE-2019-25033
    integer overflow in the regional allocator via the ALIGN_UP macro
  * bsc1185385_CVE-2019-25034_a3545867.patch
    bsc#1185385 for CVE-2019-25034
    integer overflow in sldns_str2wire_dname_buf_origin, leading to an out-of-bounds write
  * bsc1185386.7_CVE-2019-25035.6_fa23ee8f.patch
    bsc#1185386 for CVE-2019-25035
    out-of-bounds write in sldns_bget_token_par
    bsc#1185387 for CVE-2019-25036
    assertion failure and denial of service in synth_cname
  * bsc1185391.2_CVE-2019-25040.1_2d444a50.patch
    bsc#1185391 for CVE-2019-25040
    infinite loop via a compressed name in dname_pkt_copy
    bsc#1185392 for CVE-2019-25041
    assertion failure via a compressed name in dname_pkt_copy
  * bsc1185389.90_CVE-2019-25038.9_02080f6b.patch
    bsc#1185389 for CVE-2019-25038
    integer overflow in a size calculation in dnscrypt/dnscrypt.c
    bsc#1185390 for CVE-2019-25039
    integer overflow in a size calculation in respip/respip.c
  * bsc1185388_CVE-2019-25037_d2eb78e8.patch
    bsc#1185388 for CVE-2019-25037
    assertion failure and denial of service in dname_pkt_copy via an invalid packet
  * bsc1185393_CVE-2019-25042_6c3a0b54.patch
    bsc#1185393 for CVE-2019-25042
    out-of-bounds write via a compressed name in rdata_copy
- Correct indentation in patch unbound-1.6.8-amplifying-an-incoming-query.patch
  to make it fit to above patches</changelog>
  <changelog author="werner@suse.de" date="1642593600">- Add patch bsc1179191_CVE-2020-28935_19f8f4d9.patch to really fix
  bsc#1179191 CVE-2020-28935: unbound: symbolic link traversal when
  writing PID file</changelog>
  <changelog author="werner@suse.de" date="1642593601">- Import changes from OBS for dlv.isc.org.key, root.anchor, and
  root.key to fix bsc#1112033</changelog>
</package>
<package pkgid="fea6cb829bea3cbe4380fdf176187170f714d21838f0b835adb6498600e9a443" name="unbound-devel" arch="x86_64">
  <version epoch="0" ver="1.6.8" rel="10.6.1"/>
  <changelog author="michael@stroeder.com" date="1497441600">- update to 1.6.3
  Bug Fixes
- Fix #1280: Unbound fails assert when response from authoritative
  contains malformed qname. When 0x20 caps-for-id is enabled, when
  assertions are not enabled the malformed qname is handled correctly.</changelog>
  <changelog author="michael@stroeder.com" date="1498564800">- update to 1.6.4
  Features:
- Implemented trust anchor signaling using key tag query.
- unbound-checkconf -o allows query of dnstap config variables.
  Also unbound-control get_option.  Also for dnscrypt.
- unbound.h exports the shm stats structures.  They use
  type long long and no ifdefs, and ub_ before the typenames.
- Implemented opportunistic IPsec support module (ipsecmod).
- Added redirect-bogus.patch to contrib directory.
- Support for the ED25519 algorithm with openssl (from openssl 1.1.1).
- renumbering B-Root's IPv6 address to 2001:500:200::b.
- Fix #1276: [dnscrypt] add XChaCha20-Poly1305 cipher.
- Fix #1277: disable domain ratelimit by setting value to 0.
- Added fastrpz patch to contrib
  Bug Fixes:
- Added ECS unit test (from Manu Bretelle).
- ECS documentation fix (from Manu Bretelle).
- Fix #1252: more indentation inconsistencies.
- Fix #1253: unused variable in edns-subnet/addrtree.c:getbit().
- Fix #1254: clarify ratelimit-{for,below}-domain (from Manu Bretelle).
- iana portlist update
- Based on #1257: check parse limit before t increment in sldns RR
  string parse routine.
- Fix #1258: Windows 10 X64 unbound 1.6.2 service will not start.
  and fix that 64bit getting installed in C:\Program Files (x86).
- Fix #1259: "--disable-ecdsa" argument overwritten
  by "#ifdef SHA256_DIGEST_LENGTH@daemon/remote.c".
- iana portlist update
- Added test for leak of stub information.
- Fix sldns wire2str printout of RR type CAA tags.
- Fix sldns int16_data parse.
- Fix sldns parse and printout of TSIG RRs.
- sldns SMIMEA and AVC definitions, same as getdns definitions.
- Fix tcp-mss failure printout text.
- Set SO_REUSEADDR on outgoing tcp connections to fix the bind before
  connect limited tcp connections.  With the option tcp connections
  can share the same source port (for different destinations).
- Add 'c' to getopt() in testbound.
- Adjust servfail by iterator to not store in cache when serve-expired
  is enabled, to avoid overwriting useful information there.
- Fix queries for nameservers under a stub leaking to the internet.
- document trust-anchor-signaling in example config file.
- updated configure, dependencies and flex output.
- better module memory lookup, fix of unbound-control shm names for
  module memory printout of statistics.
- Fix type AVC sldns rrdef.
- Some whitespace fixup.
- Fix #1265: contrib/unbound.service contains hardcoded path.
- Fix #1265 to use /bin/kill.
- Fix #1267: Libunbound validator/val_secalgo.c uses obsolete APIs,
  and compatibility with BoringSSL.
- Fix #1268: SIGSEGV after log_reopen.
- exec_prefix is by default equal to prefix.
- printout localzone for duplicate local-zone warnings.
- Fix assertion for low buffer size and big edns payload when worker
  overrides udpsize.
- Support for openssl EVP_DigestVerify.
- Fix #1269: inconsistent use of built-in local zones with views.
- Add defaults for new local-zone trees added to views using
  unbound-control.
- Fix #1273: cachedb.c doesn't compile with -Wextra.
- If MSG_FASTOPEN gives EPIPE fallthrough to try normal tcp write.
- Also use global local-zones when there is a matching view that does
  not have any local-zone specified.
- Fix fastopen EPIPE fallthrough to perform connect.
- Fix #1274: automatically trim chroot path from dnscrypt key/cert paths
  (from Manu Bretelle).
- Fix #1275: cached data in cachedb is never used.
- Fix that unbound-control can set val_clean_additional and
  val_permissive_mode.
- Add dnscrypt XChaCha20 tests.
- Detect chacha for dnscrypt at configure time.
- dnscrypt unit tests with chacha.
- Added domain name based ECS whitelist.
- Fix #1278: Incomplete wildcard proof.
- Fix #1279: Memory leak on reload when python module is enabled.
- Fix #1280: Unbound fails assert when response from authoritative
  contains malformed qname.  When 0x20 caps-for-id is enabled, when
  assertions are not enabled the malformed qname is handled correctly.
- More fixes in depth for buffer checks in 0x20 qname checks.
- Fix stub zone queries leaking to the internet for
  harden-referral-path ns checks.
- Fix query for refetch_glue of stub leaking to internet.
- Fix #1301: memory leak in respip and tests.
- Free callback in edns-subnetmod on exit and restart.
- Fix memory leak in sldns_buffer_new_frm_data.
- Fix memory leak in dnscrypt config read.
- Fix dnscrypt chacha cert support ifdefs.
- Fix dnscrypt chacha cert unit test escapes in grep.
- Fix to unlock view in view test.
- Fix warning in pythonmod under clang compiler.
- Fix lintian typo.
- Fix #1316: heap read buffer overflow in parse_edns_options.</changelog>
  <changelog author="jengelh@inai.de" date="1502193600">- RPM group fix. Do not suppress user/group creation problems.
  Replace %__ type macro indirections.</changelog>
  <changelog author="michael@stroeder.com" date="1503316800">- update to 1.6.5
  * Fix install of trust anchor when two anchors are present, makes both
    valid.  Checks hash of DS but not signature of new key.  This fixes
    installs between sep11 and oct11 2017.</changelog>
  <changelog author="michael@stroeder.com" date="1504526400">- update to 1.6.6
  Features:
- unbound-control dump_infra prints port number for address if not 53.
- Fix #1344: RFC6761-reserved domains: test. and invalid.
- Fix #1349: allow suppression of pidfiles (from Daniel Kahn Gillmor).
  With the -p option unbound does not create a pidfile.
- Added stats for queries that have been ratelimited by domain
  recursion.
- Patch to show DNSCrypt status in help output, from Carsten
  Strotmann.
- Fix #1407: Add ECS options check to unbound-checkconf.
- Fix #1415: [dnscrypt] shared secret cache, patch from
  Manu Bretelle.
  Bug Fixes:
- fixup of dnscrypt_cert_chacha test (from Manu Bretelle).
- First fix for zero b64 and hex text zone format in sldns.
- Better fixup of dnscrypt_cert_chacha test for different escapes.
- Fix that infra cache host hash does not change after reconfig.
- Fix python example0 return module wait instead of error for pass.
- enhancement for hardened-tls for DNS over TLS.  Removed duplicated
  security settings.
- Fix for unbound-checkconf, check ipsecmod-hook if ipsecmod is turned
  on.
- Fix #1331: libunbound segfault in threaded mode when context is
  deleted.
- Fix pythonmod link line option flag.
- Fix openssl 1.1.0 load of ssl error strings from ssl init.
- Fix 1332: Bump verbosity of failed chown'ing of the control socket.
- Redirect all localhost names to localhost address for RFC6761.
- Fix #1350: make cachedb backend configurable (from JINMEI Tatuya).
- Fix tests to use .tdir (from Manu Bretelle) instead of .tpkg.
- upgrade aclocal(pkg.m4 0.29.1), config.guess(2016-10-02),
  config.sub(2016-09-05).
- annotate case statement fallthrough for gcc 7.1.1.
- flex output from flex 2.6.1.
- snprintf of thread number does not warn about truncated string.
- squelch TCP fast open error on FreeBSD when kernel has it disabled,
  unless verbosity is high.
- remove warning from windows compile.
- Fix compile with libnettle
- Fix DSA configure switch (--disable dsa) for libnettle and libnss.
- Fix #1365: Add Ed25519 support using libnettle.
- Fix #1394: mix of serve-expired and response-ip could cause a crash.
- Remove unused iter_env member (ip6arpa_dname)
- Do not reset rrset.bogus stats when called using stats_noreset.
- Do not add rrset_bogus and query ratelimiting stats per thread, these
  module stats are global.
- Fix #1397: Recursive DS lookups for AS112 zones names should recurse.
- Fix #1398: make cachedb secret configurable.
- Remove spaces from Makefile.
- Fix issue on macOX 10.10 where TCP fast open is detected but not
  implemented causing TCP to fail. The fix allows fallback to regular
  TCP in this case and is also more robust for cases where connectx()
  fails for some reason.
- Fix #1402: squelch invalid argument error for fd_set_block on windows.
- Fix to reclaim tcp handler when it is closed due to dnscrypt buffer
  allocation failure.
- Fix #1415: patch to free dnscrypt environment on reload.
- iana portlist update
- Small fixes for the shared secret cache patch.
- Fix WKS records on kvm autobuild host, with default protobyname
  entries for udp and tcp.
- Fix #1414: fix segfault on parse failure and log_replies.
- zero qinfo in handle_request, this zeroes local_alias and also the
  qname member.
- new keys and certs for dnscrypt tests.
- fixup WKS test on buildhost without servicebyname.
- updated contrib/fastrpz.patch to apply with configparser changes.
- Fix 1416: qname-minimisation breaks TLSA lookups with CNAMEs.
- Fix #1424: cachedb:testframe is not thread safe.
- Fix #1417: [dnscrypt] shared secret cache counters, and works when
  dnscrypt is not enabled.  And cache size configuration option.
- Fix #1418: [ip ratelimit] initialize slabhash using
  ip-ratelimit-slabs.
- Recommend 1472 buffer size in unbound.conf</changelog>
  <changelog author="michael@stroeder.com" date="1507636800">- update to 1.6.7
  Features:
- Set trust-anchor-signaling default to yes
- Fix #1440: [dnscrypt] client nonce cache.
- Fix #1435: Please allow UDP to be disabled separately upstream and
  downstream.
  Bug fixes:
- Fix that looping modules always stop the query, and don't pass
  control.
- Fix unbound-host to report error for DNSSEC state of failed lookups.
- Spelling fixes, from Josh Soref.
- Fix #1400: allowing use of global cache on ECS-forwarding unless
  always-forward.
- use a cachedb answer even if it's "expired" when serve-expired is yes
  (patch from Jinmei Tatuya).
- trigger refetching of the answer in that case (this will bypass
  cachedb lookup)
- allow storing a 0-TTL answer from cachedb in the in-memory message
  cache when serve-expired is yes
- Fix DNSCACHE_STORE_ZEROTTL to be bigger than 0xffff.
- Log name of looping module
- Fix #1450: Generate again patch contrib/aaaa-filter-iterator.patch
  (by Danilo G. Baio).
- Fix param unused warning for windows exportsymbol compile.
- Use RCODE from A query on DNS64 synthesized answer.
- Fix trust-anchor-signaling works in libunbound.
- Fix spelling in unbound-control man page.</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="cbosdonnat@suse.com" date="1512129600">- Use python3 instead of python2 (fate#323526)</changelog>
  <changelog author="michael@stroeder.com" date="1516363200">- update to 1.6.8 (bsc#1076963)
  patch for CVE-2017-15105: vulnerability in the processing of
  wildcard synthesized NSEC records.</changelog>
  <changelog author="dmueller@suse.com" date="1539691200">- adjust for root KSK rollover (bsc#1112009, bsc#1004165)</changelog>
  <changelog author="kbabioch@suse.com" date="1539691201">- Disabled DLV configuration by default (bsc#1055060)
- Updated the DNSSEC root trust anchor due to KSK roll over (bsc#1112009)</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1542283200">- Migrated from cron to systemd timers (bsc#1115417)</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1546603200">- Use systemd-tmpfiles to create /var/lib/unbound/root.key
  to avoid transactional update breakage (bsc#1111383)</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1551960000">- Remove old pwdutils dependency and add shadow to cover both useradd
  and groupadd as suggested in (bsc#1126757)</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1556020800">- Add systemd require in unbound-anchor to reflect new dependency (due to systemd-timers)</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1592913600">- Avoid amplifying an incoming query to a large number of queries
  Resolves CVE-2020-12662 CVE-2020-12663 (bsc#1171889)
  [ + unbound-1.6.8-amplifying-an-incoming-query.patch ]</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1592913601">- Avoid shell code execution after receiving a specially crafted answer
  Resolves CVE-2019-18934 (bsc#1157268)
  [ + patch_cve_2019-18934.patch ]</changelog>
  <changelog author="werner@suse.de" date="1642420800">- Add patches
  * bsc1185382_CVE-2019-25031_f8875527.patch
    bsc#1185382 for CVE-2019-25031
    configuration injection in create_unbound_ad_servers.sh upon a successful man-in-the-middle attack
  * bsc1185383.4_CVE-2019-25032.3_226298bb.patch
    bsc#1185383 for CVE-2019-25032
    integer overflow in the regional allocator via regional_alloc
    bsc#1185384 for CVE-2019-25033
    integer overflow in the regional allocator via the ALIGN_UP macro
  * bsc1185385_CVE-2019-25034_a3545867.patch
    bsc#1185385 for CVE-2019-25034
    integer overflow in sldns_str2wire_dname_buf_origin, leading to an out-of-bounds write
  * bsc1185386.7_CVE-2019-25035.6_fa23ee8f.patch
    bsc#1185386 for CVE-2019-25035
    out-of-bounds write in sldns_bget_token_par
    bsc#1185387 for CVE-2019-25036
    assertion failure and denial of service in synth_cname
  * bsc1185391.2_CVE-2019-25040.1_2d444a50.patch
    bsc#1185391 for CVE-2019-25040
    infinite loop via a compressed name in dname_pkt_copy
    bsc#1185392 for CVE-2019-25041
    assertion failure via a compressed name in dname_pkt_copy
  * bsc1185389.90_CVE-2019-25038.9_02080f6b.patch
    bsc#1185389 for CVE-2019-25038
    integer overflow in a size calculation in dnscrypt/dnscrypt.c
    bsc#1185390 for CVE-2019-25039
    integer overflow in a size calculation in respip/respip.c
  * bsc1185388_CVE-2019-25037_d2eb78e8.patch
    bsc#1185388 for CVE-2019-25037
    assertion failure and denial of service in dname_pkt_copy via an invalid packet
  * bsc1185393_CVE-2019-25042_6c3a0b54.patch
    bsc#1185393 for CVE-2019-25042
    out-of-bounds write via a compressed name in rdata_copy
- Correct indentation in patch unbound-1.6.8-amplifying-an-incoming-query.patch
  to make it fit to above patches</changelog>
  <changelog author="werner@suse.de" date="1642593600">- Add patch bsc1179191_CVE-2020-28935_19f8f4d9.patch to really fix
  bsc#1179191 CVE-2020-28935: unbound: symbolic link traversal when
  writing PID file</changelog>
  <changelog author="werner@suse.de" date="1642593601">- Import changes from OBS for dlv.isc.org.key, root.anchor, and
  root.key to fix bsc#1112033</changelog>
</package>
<package pkgid="d9454a5e6eb09ff454474a873247873a355043a569c29c12f390164d7a5d8be7" name="unbound-munin" arch="noarch">
  <version epoch="0" ver="1.6.8" rel="10.6.1"/>
  <changelog author="michael@stroeder.com" date="1497441600">- update to 1.6.3
  Bug Fixes
- Fix #1280: Unbound fails assert when response from authoritative
  contains malformed qname. When 0x20 caps-for-id is enabled, when
  assertions are not enabled the malformed qname is handled correctly.</changelog>
  <changelog author="michael@stroeder.com" date="1498564800">- update to 1.6.4
  Features:
- Implemented trust anchor signaling using key tag query.
- unbound-checkconf -o allows query of dnstap config variables.
  Also unbound-control get_option.  Also for dnscrypt.
- unbound.h exports the shm stats structures.  They use
  type long long and no ifdefs, and ub_ before the typenames.
- Implemented opportunistic IPsec support module (ipsecmod).
- Added redirect-bogus.patch to contrib directory.
- Support for the ED25519 algorithm with openssl (from openssl 1.1.1).
- renumbering B-Root's IPv6 address to 2001:500:200::b.
- Fix #1276: [dnscrypt] add XChaCha20-Poly1305 cipher.
- Fix #1277: disable domain ratelimit by setting value to 0.
- Added fastrpz patch to contrib
  Bug Fixes:
- Added ECS unit test (from Manu Bretelle).
- ECS documentation fix (from Manu Bretelle).
- Fix #1252: more indentation inconsistencies.
- Fix #1253: unused variable in edns-subnet/addrtree.c:getbit().
- Fix #1254: clarify ratelimit-{for,below}-domain (from Manu Bretelle).
- iana portlist update
- Based on #1257: check parse limit before t increment in sldns RR
  string parse routine.
- Fix #1258: Windows 10 X64 unbound 1.6.2 service will not start.
  and fix that 64bit getting installed in C:\Program Files (x86).
- Fix #1259: "--disable-ecdsa" argument overwritten
  by "#ifdef SHA256_DIGEST_LENGTH@daemon/remote.c".
- iana portlist update
- Added test for leak of stub information.
- Fix sldns wire2str printout of RR type CAA tags.
- Fix sldns int16_data parse.
- Fix sldns parse and printout of TSIG RRs.
- sldns SMIMEA and AVC definitions, same as getdns definitions.
- Fix tcp-mss failure printout text.
- Set SO_REUSEADDR on outgoing tcp connections to fix the bind before
  connect limited tcp connections.  With the option tcp connections
  can share the same source port (for different destinations).
- Add 'c' to getopt() in testbound.
- Adjust servfail by iterator to not store in cache when serve-expired
  is enabled, to avoid overwriting useful information there.
- Fix queries for nameservers under a stub leaking to the internet.
- document trust-anchor-signaling in example config file.
- updated configure, dependencies and flex output.
- better module memory lookup, fix of unbound-control shm names for
  module memory printout of statistics.
- Fix type AVC sldns rrdef.
- Some whitespace fixup.
- Fix #1265: contrib/unbound.service contains hardcoded path.
- Fix #1265 to use /bin/kill.
- Fix #1267: Libunbound validator/val_secalgo.c uses obsolete APIs,
  and compatibility with BoringSSL.
- Fix #1268: SIGSEGV after log_reopen.
- exec_prefix is by default equal to prefix.
- printout localzone for duplicate local-zone warnings.
- Fix assertion for low buffer size and big edns payload when worker
  overrides udpsize.
- Support for openssl EVP_DigestVerify.
- Fix #1269: inconsistent use of built-in local zones with views.
- Add defaults for new local-zone trees added to views using
  unbound-control.
- Fix #1273: cachedb.c doesn't compile with -Wextra.
- If MSG_FASTOPEN gives EPIPE fallthrough to try normal tcp write.
- Also use global local-zones when there is a matching view that does
  not have any local-zone specified.
- Fix fastopen EPIPE fallthrough to perform connect.
- Fix #1274: automatically trim chroot path from dnscrypt key/cert paths
  (from Manu Bretelle).
- Fix #1275: cached data in cachedb is never used.
- Fix that unbound-control can set val_clean_additional and
  val_permissive_mode.
- Add dnscrypt XChaCha20 tests.
- Detect chacha for dnscrypt at configure time.
- dnscrypt unit tests with chacha.
- Added domain name based ECS whitelist.
- Fix #1278: Incomplete wildcard proof.
- Fix #1279: Memory leak on reload when python module is enabled.
- Fix #1280: Unbound fails assert when response from authoritative
  contains malformed qname.  When 0x20 caps-for-id is enabled, when
  assertions are not enabled the malformed qname is handled correctly.
- More fixes in depth for buffer checks in 0x20 qname checks.
- Fix stub zone queries leaking to the internet for
  harden-referral-path ns checks.
- Fix query for refetch_glue of stub leaking to internet.
- Fix #1301: memory leak in respip and tests.
- Free callback in edns-subnetmod on exit and restart.
- Fix memory leak in sldns_buffer_new_frm_data.
- Fix memory leak in dnscrypt config read.
- Fix dnscrypt chacha cert support ifdefs.
- Fix dnscrypt chacha cert unit test escapes in grep.
- Fix to unlock view in view test.
- Fix warning in pythonmod under clang compiler.
- Fix lintian typo.
- Fix #1316: heap read buffer overflow in parse_edns_options.</changelog>
  <changelog author="jengelh@inai.de" date="1502193600">- RPM group fix. Do not suppress user/group creation problems.
  Replace %__ type macro indirections.</changelog>
  <changelog author="michael@stroeder.com" date="1503316800">- update to 1.6.5
  * Fix install of trust anchor when two anchors are present, makes both
    valid.  Checks hash of DS but not signature of new key.  This fixes
    installs between sep11 and oct11 2017.</changelog>
  <changelog author="michael@stroeder.com" date="1504526400">- update to 1.6.6
  Features:
- unbound-control dump_infra prints port number for address if not 53.
- Fix #1344: RFC6761-reserved domains: test. and invalid.
- Fix #1349: allow suppression of pidfiles (from Daniel Kahn Gillmor).
  With the -p option unbound does not create a pidfile.
- Added stats for queries that have been ratelimited by domain
  recursion.
- Patch to show DNSCrypt status in help output, from Carsten
  Strotmann.
- Fix #1407: Add ECS options check to unbound-checkconf.
- Fix #1415: [dnscrypt] shared secret cache, patch from
  Manu Bretelle.
  Bug Fixes:
- fixup of dnscrypt_cert_chacha test (from Manu Bretelle).
- First fix for zero b64 and hex text zone format in sldns.
- Better fixup of dnscrypt_cert_chacha test for different escapes.
- Fix that infra cache host hash does not change after reconfig.
- Fix python example0 return module wait instead of error for pass.
- enhancement for hardened-tls for DNS over TLS.  Removed duplicated
  security settings.
- Fix for unbound-checkconf, check ipsecmod-hook if ipsecmod is turned
  on.
- Fix #1331: libunbound segfault in threaded mode when context is
  deleted.
- Fix pythonmod link line option flag.
- Fix openssl 1.1.0 load of ssl error strings from ssl init.
- Fix 1332: Bump verbosity of failed chown'ing of the control socket.
- Redirect all localhost names to localhost address for RFC6761.
- Fix #1350: make cachedb backend configurable (from JINMEI Tatuya).
- Fix tests to use .tdir (from Manu Bretelle) instead of .tpkg.
- upgrade aclocal(pkg.m4 0.29.1), config.guess(2016-10-02),
  config.sub(2016-09-05).
- annotate case statement fallthrough for gcc 7.1.1.
- flex output from flex 2.6.1.
- snprintf of thread number does not warn about truncated string.
- squelch TCP fast open error on FreeBSD when kernel has it disabled,
  unless verbosity is high.
- remove warning from windows compile.
- Fix compile with libnettle
- Fix DSA configure switch (--disable dsa) for libnettle and libnss.
- Fix #1365: Add Ed25519 support using libnettle.
- Fix #1394: mix of serve-expired and response-ip could cause a crash.
- Remove unused iter_env member (ip6arpa_dname)
- Do not reset rrset.bogus stats when called using stats_noreset.
- Do not add rrset_bogus and query ratelimiting stats per thread, these
  module stats are global.
- Fix #1397: Recursive DS lookups for AS112 zones names should recurse.
- Fix #1398: make cachedb secret configurable.
- Remove spaces from Makefile.
- Fix issue on macOX 10.10 where TCP fast open is detected but not
  implemented causing TCP to fail. The fix allows fallback to regular
  TCP in this case and is also more robust for cases where connectx()
  fails for some reason.
- Fix #1402: squelch invalid argument error for fd_set_block on windows.
- Fix to reclaim tcp handler when it is closed due to dnscrypt buffer
  allocation failure.
- Fix #1415: patch to free dnscrypt environment on reload.
- iana portlist update
- Small fixes for the shared secret cache patch.
- Fix WKS records on kvm autobuild host, with default protobyname
  entries for udp and tcp.
- Fix #1414: fix segfault on parse failure and log_replies.
- zero qinfo in handle_request, this zeroes local_alias and also the
  qname member.
- new keys and certs for dnscrypt tests.
- fixup WKS test on buildhost without servicebyname.
- updated contrib/fastrpz.patch to apply with configparser changes.
- Fix 1416: qname-minimisation breaks TLSA lookups with CNAMEs.
- Fix #1424: cachedb:testframe is not thread safe.
- Fix #1417: [dnscrypt] shared secret cache counters, and works when
  dnscrypt is not enabled.  And cache size configuration option.
- Fix #1418: [ip ratelimit] initialize slabhash using
  ip-ratelimit-slabs.
- Recommend 1472 buffer size in unbound.conf</changelog>
  <changelog author="michael@stroeder.com" date="1507636800">- update to 1.6.7
  Features:
- Set trust-anchor-signaling default to yes
- Fix #1440: [dnscrypt] client nonce cache.
- Fix #1435: Please allow UDP to be disabled separately upstream and
  downstream.
  Bug fixes:
- Fix that looping modules always stop the query, and don't pass
  control.
- Fix unbound-host to report error for DNSSEC state of failed lookups.
- Spelling fixes, from Josh Soref.
- Fix #1400: allowing use of global cache on ECS-forwarding unless
  always-forward.
- use a cachedb answer even if it's "expired" when serve-expired is yes
  (patch from Jinmei Tatuya).
- trigger refetching of the answer in that case (this will bypass
  cachedb lookup)
- allow storing a 0-TTL answer from cachedb in the in-memory message
  cache when serve-expired is yes
- Fix DNSCACHE_STORE_ZEROTTL to be bigger than 0xffff.
- Log name of looping module
- Fix #1450: Generate again patch contrib/aaaa-filter-iterator.patch
  (by Danilo G. Baio).
- Fix param unused warning for windows exportsymbol compile.
- Use RCODE from A query on DNS64 synthesized answer.
- Fix trust-anchor-signaling works in libunbound.
- Fix spelling in unbound-control man page.</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="cbosdonnat@suse.com" date="1512129600">- Use python3 instead of python2 (fate#323526)</changelog>
  <changelog author="michael@stroeder.com" date="1516363200">- update to 1.6.8 (bsc#1076963)
  patch for CVE-2017-15105: vulnerability in the processing of
  wildcard synthesized NSEC records.</changelog>
  <changelog author="dmueller@suse.com" date="1539691200">- adjust for root KSK rollover (bsc#1112009, bsc#1004165)</changelog>
  <changelog author="kbabioch@suse.com" date="1539691201">- Disabled DLV configuration by default (bsc#1055060)
- Updated the DNSSEC root trust anchor due to KSK roll over (bsc#1112009)</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1542283200">- Migrated from cron to systemd timers (bsc#1115417)</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1546603200">- Use systemd-tmpfiles to create /var/lib/unbound/root.key
  to avoid transactional update breakage (bsc#1111383)</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1551960000">- Remove old pwdutils dependency and add shadow to cover both useradd
  and groupadd as suggested in (bsc#1126757)</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1556020800">- Add systemd require in unbound-anchor to reflect new dependency (due to systemd-timers)</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1592913600">- Avoid amplifying an incoming query to a large number of queries
  Resolves CVE-2020-12662 CVE-2020-12663 (bsc#1171889)
  [ + unbound-1.6.8-amplifying-an-incoming-query.patch ]</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1592913601">- Avoid shell code execution after receiving a specially crafted answer
  Resolves CVE-2019-18934 (bsc#1157268)
  [ + patch_cve_2019-18934.patch ]</changelog>
  <changelog author="werner@suse.de" date="1642420800">- Add patches
  * bsc1185382_CVE-2019-25031_f8875527.patch
    bsc#1185382 for CVE-2019-25031
    configuration injection in create_unbound_ad_servers.sh upon a successful man-in-the-middle attack
  * bsc1185383.4_CVE-2019-25032.3_226298bb.patch
    bsc#1185383 for CVE-2019-25032
    integer overflow in the regional allocator via regional_alloc
    bsc#1185384 for CVE-2019-25033
    integer overflow in the regional allocator via the ALIGN_UP macro
  * bsc1185385_CVE-2019-25034_a3545867.patch
    bsc#1185385 for CVE-2019-25034
    integer overflow in sldns_str2wire_dname_buf_origin, leading to an out-of-bounds write
  * bsc1185386.7_CVE-2019-25035.6_fa23ee8f.patch
    bsc#1185386 for CVE-2019-25035
    out-of-bounds write in sldns_bget_token_par
    bsc#1185387 for CVE-2019-25036
    assertion failure and denial of service in synth_cname
  * bsc1185391.2_CVE-2019-25040.1_2d444a50.patch
    bsc#1185391 for CVE-2019-25040
    infinite loop via a compressed name in dname_pkt_copy
    bsc#1185392 for CVE-2019-25041
    assertion failure via a compressed name in dname_pkt_copy
  * bsc1185389.90_CVE-2019-25038.9_02080f6b.patch
    bsc#1185389 for CVE-2019-25038
    integer overflow in a size calculation in dnscrypt/dnscrypt.c
    bsc#1185390 for CVE-2019-25039
    integer overflow in a size calculation in respip/respip.c
  * bsc1185388_CVE-2019-25037_d2eb78e8.patch
    bsc#1185388 for CVE-2019-25037
    assertion failure and denial of service in dname_pkt_copy via an invalid packet
  * bsc1185393_CVE-2019-25042_6c3a0b54.patch
    bsc#1185393 for CVE-2019-25042
    out-of-bounds write via a compressed name in rdata_copy
- Correct indentation in patch unbound-1.6.8-amplifying-an-incoming-query.patch
  to make it fit to above patches</changelog>
  <changelog author="werner@suse.de" date="1642593600">- Add patch bsc1179191_CVE-2020-28935_19f8f4d9.patch to really fix
  bsc#1179191 CVE-2020-28935: unbound: symbolic link traversal when
  writing PID file</changelog>
  <changelog author="werner@suse.de" date="1642593601">- Import changes from OBS for dlv.isc.org.key, root.anchor, and
  root.key to fix bsc#1112033</changelog>
</package>
<package pkgid="4423e83bb0f9cf9fba52b2315ea79c5db7bc3c45e09b530dd7063ce88b576bbe" name="unbound-python" arch="aarch64">
  <version epoch="0" ver="1.6.8" rel="10.6.1"/>
  <changelog author="michael@stroeder.com" date="1497441600">- update to 1.6.3
  Bug Fixes
- Fix #1280: Unbound fails assert when response from authoritative
  contains malformed qname. When 0x20 caps-for-id is enabled, when
  assertions are not enabled the malformed qname is handled correctly.</changelog>
  <changelog author="michael@stroeder.com" date="1498564800">- update to 1.6.4
  Features:
- Implemented trust anchor signaling using key tag query.
- unbound-checkconf -o allows query of dnstap config variables.
  Also unbound-control get_option.  Also for dnscrypt.
- unbound.h exports the shm stats structures.  They use
  type long long and no ifdefs, and ub_ before the typenames.
- Implemented opportunistic IPsec support module (ipsecmod).
- Added redirect-bogus.patch to contrib directory.
- Support for the ED25519 algorithm with openssl (from openssl 1.1.1).
- renumbering B-Root's IPv6 address to 2001:500:200::b.
- Fix #1276: [dnscrypt] add XChaCha20-Poly1305 cipher.
- Fix #1277: disable domain ratelimit by setting value to 0.
- Added fastrpz patch to contrib
  Bug Fixes:
- Added ECS unit test (from Manu Bretelle).
- ECS documentation fix (from Manu Bretelle).
- Fix #1252: more indentation inconsistencies.
- Fix #1253: unused variable in edns-subnet/addrtree.c:getbit().
- Fix #1254: clarify ratelimit-{for,below}-domain (from Manu Bretelle).
- iana portlist update
- Based on #1257: check parse limit before t increment in sldns RR
  string parse routine.
- Fix #1258: Windows 10 X64 unbound 1.6.2 service will not start.
  and fix that 64bit getting installed in C:\Program Files (x86).
- Fix #1259: "--disable-ecdsa" argument overwritten
  by "#ifdef SHA256_DIGEST_LENGTH@daemon/remote.c".
- iana portlist update
- Added test for leak of stub information.
- Fix sldns wire2str printout of RR type CAA tags.
- Fix sldns int16_data parse.
- Fix sldns parse and printout of TSIG RRs.
- sldns SMIMEA and AVC definitions, same as getdns definitions.
- Fix tcp-mss failure printout text.
- Set SO_REUSEADDR on outgoing tcp connections to fix the bind before
  connect limited tcp connections.  With the option tcp connections
  can share the same source port (for different destinations).
- Add 'c' to getopt() in testbound.
- Adjust servfail by iterator to not store in cache when serve-expired
  is enabled, to avoid overwriting useful information there.
- Fix queries for nameservers under a stub leaking to the internet.
- document trust-anchor-signaling in example config file.
- updated configure, dependencies and flex output.
- better module memory lookup, fix of unbound-control shm names for
  module memory printout of statistics.
- Fix type AVC sldns rrdef.
- Some whitespace fixup.
- Fix #1265: contrib/unbound.service contains hardcoded path.
- Fix #1265 to use /bin/kill.
- Fix #1267: Libunbound validator/val_secalgo.c uses obsolete APIs,
  and compatibility with BoringSSL.
- Fix #1268: SIGSEGV after log_reopen.
- exec_prefix is by default equal to prefix.
- printout localzone for duplicate local-zone warnings.
- Fix assertion for low buffer size and big edns payload when worker
  overrides udpsize.
- Support for openssl EVP_DigestVerify.
- Fix #1269: inconsistent use of built-in local zones with views.
- Add defaults for new local-zone trees added to views using
  unbound-control.
- Fix #1273: cachedb.c doesn't compile with -Wextra.
- If MSG_FASTOPEN gives EPIPE fallthrough to try normal tcp write.
- Also use global local-zones when there is a matching view that does
  not have any local-zone specified.
- Fix fastopen EPIPE fallthrough to perform connect.
- Fix #1274: automatically trim chroot path from dnscrypt key/cert paths
  (from Manu Bretelle).
- Fix #1275: cached data in cachedb is never used.
- Fix that unbound-control can set val_clean_additional and
  val_permissive_mode.
- Add dnscrypt XChaCha20 tests.
- Detect chacha for dnscrypt at configure time.
- dnscrypt unit tests with chacha.
- Added domain name based ECS whitelist.
- Fix #1278: Incomplete wildcard proof.
- Fix #1279: Memory leak on reload when python module is enabled.
- Fix #1280: Unbound fails assert when response from authoritative
  contains malformed qname.  When 0x20 caps-for-id is enabled, when
  assertions are not enabled the malformed qname is handled correctly.
- More fixes in depth for buffer checks in 0x20 qname checks.
- Fix stub zone queries leaking to the internet for
  harden-referral-path ns checks.
- Fix query for refetch_glue of stub leaking to internet.
- Fix #1301: memory leak in respip and tests.
- Free callback in edns-subnetmod on exit and restart.
- Fix memory leak in sldns_buffer_new_frm_data.
- Fix memory leak in dnscrypt config read.
- Fix dnscrypt chacha cert support ifdefs.
- Fix dnscrypt chacha cert unit test escapes in grep.
- Fix to unlock view in view test.
- Fix warning in pythonmod under clang compiler.
- Fix lintian typo.
- Fix #1316: heap read buffer overflow in parse_edns_options.</changelog>
  <changelog author="jengelh@inai.de" date="1502193600">- RPM group fix. Do not suppress user/group creation problems.
  Replace %__ type macro indirections.</changelog>
  <changelog author="michael@stroeder.com" date="1503316800">- update to 1.6.5
  * Fix install of trust anchor when two anchors are present, makes both
    valid.  Checks hash of DS but not signature of new key.  This fixes
    installs between sep11 and oct11 2017.</changelog>
  <changelog author="michael@stroeder.com" date="1504526400">- update to 1.6.6
  Features:
- unbound-control dump_infra prints port number for address if not 53.
- Fix #1344: RFC6761-reserved domains: test. and invalid.
- Fix #1349: allow suppression of pidfiles (from Daniel Kahn Gillmor).
  With the -p option unbound does not create a pidfile.
- Added stats for queries that have been ratelimited by domain
  recursion.
- Patch to show DNSCrypt status in help output, from Carsten
  Strotmann.
- Fix #1407: Add ECS options check to unbound-checkconf.
- Fix #1415: [dnscrypt] shared secret cache, patch from
  Manu Bretelle.
  Bug Fixes:
- fixup of dnscrypt_cert_chacha test (from Manu Bretelle).
- First fix for zero b64 and hex text zone format in sldns.
- Better fixup of dnscrypt_cert_chacha test for different escapes.
- Fix that infra cache host hash does not change after reconfig.
- Fix python example0 return module wait instead of error for pass.
- enhancement for hardened-tls for DNS over TLS.  Removed duplicated
  security settings.
- Fix for unbound-checkconf, check ipsecmod-hook if ipsecmod is turned
  on.
- Fix #1331: libunbound segfault in threaded mode when context is
  deleted.
- Fix pythonmod link line option flag.
- Fix openssl 1.1.0 load of ssl error strings from ssl init.
- Fix 1332: Bump verbosity of failed chown'ing of the control socket.
- Redirect all localhost names to localhost address for RFC6761.
- Fix #1350: make cachedb backend configurable (from JINMEI Tatuya).
- Fix tests to use .tdir (from Manu Bretelle) instead of .tpkg.
- upgrade aclocal(pkg.m4 0.29.1), config.guess(2016-10-02),
  config.sub(2016-09-05).
- annotate case statement fallthrough for gcc 7.1.1.
- flex output from flex 2.6.1.
- snprintf of thread number does not warn about truncated string.
- squelch TCP fast open error on FreeBSD when kernel has it disabled,
  unless verbosity is high.
- remove warning from windows compile.
- Fix compile with libnettle
- Fix DSA configure switch (--disable dsa) for libnettle and libnss.
- Fix #1365: Add Ed25519 support using libnettle.
- Fix #1394: mix of serve-expired and response-ip could cause a crash.
- Remove unused iter_env member (ip6arpa_dname)
- Do not reset rrset.bogus stats when called using stats_noreset.
- Do not add rrset_bogus and query ratelimiting stats per thread, these
  module stats are global.
- Fix #1397: Recursive DS lookups for AS112 zones names should recurse.
- Fix #1398: make cachedb secret configurable.
- Remove spaces from Makefile.
- Fix issue on macOX 10.10 where TCP fast open is detected but not
  implemented causing TCP to fail. The fix allows fallback to regular
  TCP in this case and is also more robust for cases where connectx()
  fails for some reason.
- Fix #1402: squelch invalid argument error for fd_set_block on windows.
- Fix to reclaim tcp handler when it is closed due to dnscrypt buffer
  allocation failure.
- Fix #1415: patch to free dnscrypt environment on reload.
- iana portlist update
- Small fixes for the shared secret cache patch.
- Fix WKS records on kvm autobuild host, with default protobyname
  entries for udp and tcp.
- Fix #1414: fix segfault on parse failure and log_replies.
- zero qinfo in handle_request, this zeroes local_alias and also the
  qname member.
- new keys and certs for dnscrypt tests.
- fixup WKS test on buildhost without servicebyname.
- updated contrib/fastrpz.patch to apply with configparser changes.
- Fix 1416: qname-minimisation breaks TLSA lookups with CNAMEs.
- Fix #1424: cachedb:testframe is not thread safe.
- Fix #1417: [dnscrypt] shared secret cache counters, and works when
  dnscrypt is not enabled.  And cache size configuration option.
- Fix #1418: [ip ratelimit] initialize slabhash using
  ip-ratelimit-slabs.
- Recommend 1472 buffer size in unbound.conf</changelog>
  <changelog author="michael@stroeder.com" date="1507636800">- update to 1.6.7
  Features:
- Set trust-anchor-signaling default to yes
- Fix #1440: [dnscrypt] client nonce cache.
- Fix #1435: Please allow UDP to be disabled separately upstream and
  downstream.
  Bug fixes:
- Fix that looping modules always stop the query, and don't pass
  control.
- Fix unbound-host to report error for DNSSEC state of failed lookups.
- Spelling fixes, from Josh Soref.
- Fix #1400: allowing use of global cache on ECS-forwarding unless
  always-forward.
- use a cachedb answer even if it's "expired" when serve-expired is yes
  (patch from Jinmei Tatuya).
- trigger refetching of the answer in that case (this will bypass
  cachedb lookup)
- allow storing a 0-TTL answer from cachedb in the in-memory message
  cache when serve-expired is yes
- Fix DNSCACHE_STORE_ZEROTTL to be bigger than 0xffff.
- Log name of looping module
- Fix #1450: Generate again patch contrib/aaaa-filter-iterator.patch
  (by Danilo G. Baio).
- Fix param unused warning for windows exportsymbol compile.
- Use RCODE from A query on DNS64 synthesized answer.
- Fix trust-anchor-signaling works in libunbound.
- Fix spelling in unbound-control man page.</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="cbosdonnat@suse.com" date="1512129600">- Use python3 instead of python2 (fate#323526)</changelog>
  <changelog author="michael@stroeder.com" date="1516363200">- update to 1.6.8 (bsc#1076963)
  patch for CVE-2017-15105: vulnerability in the processing of
  wildcard synthesized NSEC records.</changelog>
  <changelog author="dmueller@suse.com" date="1539691200">- adjust for root KSK rollover (bsc#1112009, bsc#1004165)</changelog>
  <changelog author="kbabioch@suse.com" date="1539691201">- Disabled DLV configuration by default (bsc#1055060)
- Updated the DNSSEC root trust anchor due to KSK roll over (bsc#1112009)</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1542283200">- Migrated from cron to systemd timers (bsc#1115417)</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1546603200">- Use systemd-tmpfiles to create /var/lib/unbound/root.key
  to avoid transactional update breakage (bsc#1111383)</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1551960000">- Remove old pwdutils dependency and add shadow to cover both useradd
  and groupadd as suggested in (bsc#1126757)</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1556020800">- Add systemd require in unbound-anchor to reflect new dependency (due to systemd-timers)</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1592913600">- Avoid amplifying an incoming query to a large number of queries
  Resolves CVE-2020-12662 CVE-2020-12663 (bsc#1171889)
  [ + unbound-1.6.8-amplifying-an-incoming-query.patch ]</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1592913601">- Avoid shell code execution after receiving a specially crafted answer
  Resolves CVE-2019-18934 (bsc#1157268)
  [ + patch_cve_2019-18934.patch ]</changelog>
  <changelog author="werner@suse.de" date="1642420800">- Add patches
  * bsc1185382_CVE-2019-25031_f8875527.patch
    bsc#1185382 for CVE-2019-25031
    configuration injection in create_unbound_ad_servers.sh upon a successful man-in-the-middle attack
  * bsc1185383.4_CVE-2019-25032.3_226298bb.patch
    bsc#1185383 for CVE-2019-25032
    integer overflow in the regional allocator via regional_alloc
    bsc#1185384 for CVE-2019-25033
    integer overflow in the regional allocator via the ALIGN_UP macro
  * bsc1185385_CVE-2019-25034_a3545867.patch
    bsc#1185385 for CVE-2019-25034
    integer overflow in sldns_str2wire_dname_buf_origin, leading to an out-of-bounds write
  * bsc1185386.7_CVE-2019-25035.6_fa23ee8f.patch
    bsc#1185386 for CVE-2019-25035
    out-of-bounds write in sldns_bget_token_par
    bsc#1185387 for CVE-2019-25036
    assertion failure and denial of service in synth_cname
  * bsc1185391.2_CVE-2019-25040.1_2d444a50.patch
    bsc#1185391 for CVE-2019-25040
    infinite loop via a compressed name in dname_pkt_copy
    bsc#1185392 for CVE-2019-25041
    assertion failure via a compressed name in dname_pkt_copy
  * bsc1185389.90_CVE-2019-25038.9_02080f6b.patch
    bsc#1185389 for CVE-2019-25038
    integer overflow in a size calculation in dnscrypt/dnscrypt.c
    bsc#1185390 for CVE-2019-25039
    integer overflow in a size calculation in respip/respip.c
  * bsc1185388_CVE-2019-25037_d2eb78e8.patch
    bsc#1185388 for CVE-2019-25037
    assertion failure and denial of service in dname_pkt_copy via an invalid packet
  * bsc1185393_CVE-2019-25042_6c3a0b54.patch
    bsc#1185393 for CVE-2019-25042
    out-of-bounds write via a compressed name in rdata_copy
- Correct indentation in patch unbound-1.6.8-amplifying-an-incoming-query.patch
  to make it fit to above patches</changelog>
  <changelog author="werner@suse.de" date="1642593600">- Add patch bsc1179191_CVE-2020-28935_19f8f4d9.patch to really fix
  bsc#1179191 CVE-2020-28935: unbound: symbolic link traversal when
  writing PID file</changelog>
  <changelog author="werner@suse.de" date="1642593601">- Import changes from OBS for dlv.isc.org.key, root.anchor, and
  root.key to fix bsc#1112033</changelog>
</package>
<package pkgid="087327dd6c9d6167c66d4994ad962816f8530339bebd13ce11720d3911379bbf" name="unbound-python" arch="ppc64le">
  <version epoch="0" ver="1.6.8" rel="10.6.1"/>
  <changelog author="michael@stroeder.com" date="1497441600">- update to 1.6.3
  Bug Fixes
- Fix #1280: Unbound fails assert when response from authoritative
  contains malformed qname. When 0x20 caps-for-id is enabled, when
  assertions are not enabled the malformed qname is handled correctly.</changelog>
  <changelog author="michael@stroeder.com" date="1498564800">- update to 1.6.4
  Features:
- Implemented trust anchor signaling using key tag query.
- unbound-checkconf -o allows query of dnstap config variables.
  Also unbound-control get_option.  Also for dnscrypt.
- unbound.h exports the shm stats structures.  They use
  type long long and no ifdefs, and ub_ before the typenames.
- Implemented opportunistic IPsec support module (ipsecmod).
- Added redirect-bogus.patch to contrib directory.
- Support for the ED25519 algorithm with openssl (from openssl 1.1.1).
- renumbering B-Root's IPv6 address to 2001:500:200::b.
- Fix #1276: [dnscrypt] add XChaCha20-Poly1305 cipher.
- Fix #1277: disable domain ratelimit by setting value to 0.
- Added fastrpz patch to contrib
  Bug Fixes:
- Added ECS unit test (from Manu Bretelle).
- ECS documentation fix (from Manu Bretelle).
- Fix #1252: more indentation inconsistencies.
- Fix #1253: unused variable in edns-subnet/addrtree.c:getbit().
- Fix #1254: clarify ratelimit-{for,below}-domain (from Manu Bretelle).
- iana portlist update
- Based on #1257: check parse limit before t increment in sldns RR
  string parse routine.
- Fix #1258: Windows 10 X64 unbound 1.6.2 service will not start.
  and fix that 64bit getting installed in C:\Program Files (x86).
- Fix #1259: "--disable-ecdsa" argument overwritten
  by "#ifdef SHA256_DIGEST_LENGTH@daemon/remote.c".
- iana portlist update
- Added test for leak of stub information.
- Fix sldns wire2str printout of RR type CAA tags.
- Fix sldns int16_data parse.
- Fix sldns parse and printout of TSIG RRs.
- sldns SMIMEA and AVC definitions, same as getdns definitions.
- Fix tcp-mss failure printout text.
- Set SO_REUSEADDR on outgoing tcp connections to fix the bind before
  connect limited tcp connections.  With the option tcp connections
  can share the same source port (for different destinations).
- Add 'c' to getopt() in testbound.
- Adjust servfail by iterator to not store in cache when serve-expired
  is enabled, to avoid overwriting useful information there.
- Fix queries for nameservers under a stub leaking to the internet.
- document trust-anchor-signaling in example config file.
- updated configure, dependencies and flex output.
- better module memory lookup, fix of unbound-control shm names for
  module memory printout of statistics.
- Fix type AVC sldns rrdef.
- Some whitespace fixup.
- Fix #1265: contrib/unbound.service contains hardcoded path.
- Fix #1265 to use /bin/kill.
- Fix #1267: Libunbound validator/val_secalgo.c uses obsolete APIs,
  and compatibility with BoringSSL.
- Fix #1268: SIGSEGV after log_reopen.
- exec_prefix is by default equal to prefix.
- printout localzone for duplicate local-zone warnings.
- Fix assertion for low buffer size and big edns payload when worker
  overrides udpsize.
- Support for openssl EVP_DigestVerify.
- Fix #1269: inconsistent use of built-in local zones with views.
- Add defaults for new local-zone trees added to views using
  unbound-control.
- Fix #1273: cachedb.c doesn't compile with -Wextra.
- If MSG_FASTOPEN gives EPIPE fallthrough to try normal tcp write.
- Also use global local-zones when there is a matching view that does
  not have any local-zone specified.
- Fix fastopen EPIPE fallthrough to perform connect.
- Fix #1274: automatically trim chroot path from dnscrypt key/cert paths
  (from Manu Bretelle).
- Fix #1275: cached data in cachedb is never used.
- Fix that unbound-control can set val_clean_additional and
  val_permissive_mode.
- Add dnscrypt XChaCha20 tests.
- Detect chacha for dnscrypt at configure time.
- dnscrypt unit tests with chacha.
- Added domain name based ECS whitelist.
- Fix #1278: Incomplete wildcard proof.
- Fix #1279: Memory leak on reload when python module is enabled.
- Fix #1280: Unbound fails assert when response from authoritative
  contains malformed qname.  When 0x20 caps-for-id is enabled, when
  assertions are not enabled the malformed qname is handled correctly.
- More fixes in depth for buffer checks in 0x20 qname checks.
- Fix stub zone queries leaking to the internet for
  harden-referral-path ns checks.
- Fix query for refetch_glue of stub leaking to internet.
- Fix #1301: memory leak in respip and tests.
- Free callback in edns-subnetmod on exit and restart.
- Fix memory leak in sldns_buffer_new_frm_data.
- Fix memory leak in dnscrypt config read.
- Fix dnscrypt chacha cert support ifdefs.
- Fix dnscrypt chacha cert unit test escapes in grep.
- Fix to unlock view in view test.
- Fix warning in pythonmod under clang compiler.
- Fix lintian typo.
- Fix #1316: heap read buffer overflow in parse_edns_options.</changelog>
  <changelog author="jengelh@inai.de" date="1502193600">- RPM group fix. Do not suppress user/group creation problems.
  Replace %__ type macro indirections.</changelog>
  <changelog author="michael@stroeder.com" date="1503316800">- update to 1.6.5
  * Fix install of trust anchor when two anchors are present, makes both
    valid.  Checks hash of DS but not signature of new key.  This fixes
    installs between sep11 and oct11 2017.</changelog>
  <changelog author="michael@stroeder.com" date="1504526400">- update to 1.6.6
  Features:
- unbound-control dump_infra prints port number for address if not 53.
- Fix #1344: RFC6761-reserved domains: test. and invalid.
- Fix #1349: allow suppression of pidfiles (from Daniel Kahn Gillmor).
  With the -p option unbound does not create a pidfile.
- Added stats for queries that have been ratelimited by domain
  recursion.
- Patch to show DNSCrypt status in help output, from Carsten
  Strotmann.
- Fix #1407: Add ECS options check to unbound-checkconf.
- Fix #1415: [dnscrypt] shared secret cache, patch from
  Manu Bretelle.
  Bug Fixes:
- fixup of dnscrypt_cert_chacha test (from Manu Bretelle).
- First fix for zero b64 and hex text zone format in sldns.
- Better fixup of dnscrypt_cert_chacha test for different escapes.
- Fix that infra cache host hash does not change after reconfig.
- Fix python example0 return module wait instead of error for pass.
- enhancement for hardened-tls for DNS over TLS.  Removed duplicated
  security settings.
- Fix for unbound-checkconf, check ipsecmod-hook if ipsecmod is turned
  on.
- Fix #1331: libunbound segfault in threaded mode when context is
  deleted.
- Fix pythonmod link line option flag.
- Fix openssl 1.1.0 load of ssl error strings from ssl init.
- Fix 1332: Bump verbosity of failed chown'ing of the control socket.
- Redirect all localhost names to localhost address for RFC6761.
- Fix #1350: make cachedb backend configurable (from JINMEI Tatuya).
- Fix tests to use .tdir (from Manu Bretelle) instead of .tpkg.
- upgrade aclocal(pkg.m4 0.29.1), config.guess(2016-10-02),
  config.sub(2016-09-05).
- annotate case statement fallthrough for gcc 7.1.1.
- flex output from flex 2.6.1.
- snprintf of thread number does not warn about truncated string.
- squelch TCP fast open error on FreeBSD when kernel has it disabled,
  unless verbosity is high.
- remove warning from windows compile.
- Fix compile with libnettle
- Fix DSA configure switch (--disable dsa) for libnettle and libnss.
- Fix #1365: Add Ed25519 support using libnettle.
- Fix #1394: mix of serve-expired and response-ip could cause a crash.
- Remove unused iter_env member (ip6arpa_dname)
- Do not reset rrset.bogus stats when called using stats_noreset.
- Do not add rrset_bogus and query ratelimiting stats per thread, these
  module stats are global.
- Fix #1397: Recursive DS lookups for AS112 zones names should recurse.
- Fix #1398: make cachedb secret configurable.
- Remove spaces from Makefile.
- Fix issue on macOX 10.10 where TCP fast open is detected but not
  implemented causing TCP to fail. The fix allows fallback to regular
  TCP in this case and is also more robust for cases where connectx()
  fails for some reason.
- Fix #1402: squelch invalid argument error for fd_set_block on windows.
- Fix to reclaim tcp handler when it is closed due to dnscrypt buffer
  allocation failure.
- Fix #1415: patch to free dnscrypt environment on reload.
- iana portlist update
- Small fixes for the shared secret cache patch.
- Fix WKS records on kvm autobuild host, with default protobyname
  entries for udp and tcp.
- Fix #1414: fix segfault on parse failure and log_replies.
- zero qinfo in handle_request, this zeroes local_alias and also the
  qname member.
- new keys and certs for dnscrypt tests.
- fixup WKS test on buildhost without servicebyname.
- updated contrib/fastrpz.patch to apply with configparser changes.
- Fix 1416: qname-minimisation breaks TLSA lookups with CNAMEs.
- Fix #1424: cachedb:testframe is not thread safe.
- Fix #1417: [dnscrypt] shared secret cache counters, and works when
  dnscrypt is not enabled.  And cache size configuration option.
- Fix #1418: [ip ratelimit] initialize slabhash using
  ip-ratelimit-slabs.
- Recommend 1472 buffer size in unbound.conf</changelog>
  <changelog author="michael@stroeder.com" date="1507636800">- update to 1.6.7
  Features:
- Set trust-anchor-signaling default to yes
- Fix #1440: [dnscrypt] client nonce cache.
- Fix #1435: Please allow UDP to be disabled separately upstream and
  downstream.
  Bug fixes:
- Fix that looping modules always stop the query, and don't pass
  control.
- Fix unbound-host to report error for DNSSEC state of failed lookups.
- Spelling fixes, from Josh Soref.
- Fix #1400: allowing use of global cache on ECS-forwarding unless
  always-forward.
- use a cachedb answer even if it's "expired" when serve-expired is yes
  (patch from Jinmei Tatuya).
- trigger refetching of the answer in that case (this will bypass
  cachedb lookup)
- allow storing a 0-TTL answer from cachedb in the in-memory message
  cache when serve-expired is yes
- Fix DNSCACHE_STORE_ZEROTTL to be bigger than 0xffff.
- Log name of looping module
- Fix #1450: Generate again patch contrib/aaaa-filter-iterator.patch
  (by Danilo G. Baio).
- Fix param unused warning for windows exportsymbol compile.
- Use RCODE from A query on DNS64 synthesized answer.
- Fix trust-anchor-signaling works in libunbound.
- Fix spelling in unbound-control man page.</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="cbosdonnat@suse.com" date="1512129600">- Use python3 instead of python2 (fate#323526)</changelog>
  <changelog author="michael@stroeder.com" date="1516363200">- update to 1.6.8 (bsc#1076963)
  patch for CVE-2017-15105: vulnerability in the processing of
  wildcard synthesized NSEC records.</changelog>
  <changelog author="dmueller@suse.com" date="1539691200">- adjust for root KSK rollover (bsc#1112009, bsc#1004165)</changelog>
  <changelog author="kbabioch@suse.com" date="1539691201">- Disabled DLV configuration by default (bsc#1055060)
- Updated the DNSSEC root trust anchor due to KSK roll over (bsc#1112009)</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1542283200">- Migrated from cron to systemd timers (bsc#1115417)</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1546603200">- Use systemd-tmpfiles to create /var/lib/unbound/root.key
  to avoid transactional update breakage (bsc#1111383)</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1551960000">- Remove old pwdutils dependency and add shadow to cover both useradd
  and groupadd as suggested in (bsc#1126757)</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1556020800">- Add systemd require in unbound-anchor to reflect new dependency (due to systemd-timers)</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1592913600">- Avoid amplifying an incoming query to a large number of queries
  Resolves CVE-2020-12662 CVE-2020-12663 (bsc#1171889)
  [ + unbound-1.6.8-amplifying-an-incoming-query.patch ]</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1592913601">- Avoid shell code execution after receiving a specially crafted answer
  Resolves CVE-2019-18934 (bsc#1157268)
  [ + patch_cve_2019-18934.patch ]</changelog>
  <changelog author="werner@suse.de" date="1642420800">- Add patches
  * bsc1185382_CVE-2019-25031_f8875527.patch
    bsc#1185382 for CVE-2019-25031
    configuration injection in create_unbound_ad_servers.sh upon a successful man-in-the-middle attack
  * bsc1185383.4_CVE-2019-25032.3_226298bb.patch
    bsc#1185383 for CVE-2019-25032
    integer overflow in the regional allocator via regional_alloc
    bsc#1185384 for CVE-2019-25033
    integer overflow in the regional allocator via the ALIGN_UP macro
  * bsc1185385_CVE-2019-25034_a3545867.patch
    bsc#1185385 for CVE-2019-25034
    integer overflow in sldns_str2wire_dname_buf_origin, leading to an out-of-bounds write
  * bsc1185386.7_CVE-2019-25035.6_fa23ee8f.patch
    bsc#1185386 for CVE-2019-25035
    out-of-bounds write in sldns_bget_token_par
    bsc#1185387 for CVE-2019-25036
    assertion failure and denial of service in synth_cname
  * bsc1185391.2_CVE-2019-25040.1_2d444a50.patch
    bsc#1185391 for CVE-2019-25040
    infinite loop via a compressed name in dname_pkt_copy
    bsc#1185392 for CVE-2019-25041
    assertion failure via a compressed name in dname_pkt_copy
  * bsc1185389.90_CVE-2019-25038.9_02080f6b.patch
    bsc#1185389 for CVE-2019-25038
    integer overflow in a size calculation in dnscrypt/dnscrypt.c
    bsc#1185390 for CVE-2019-25039
    integer overflow in a size calculation in respip/respip.c
  * bsc1185388_CVE-2019-25037_d2eb78e8.patch
    bsc#1185388 for CVE-2019-25037
    assertion failure and denial of service in dname_pkt_copy via an invalid packet
  * bsc1185393_CVE-2019-25042_6c3a0b54.patch
    bsc#1185393 for CVE-2019-25042
    out-of-bounds write via a compressed name in rdata_copy
- Correct indentation in patch unbound-1.6.8-amplifying-an-incoming-query.patch
  to make it fit to above patches</changelog>
  <changelog author="werner@suse.de" date="1642593600">- Add patch bsc1179191_CVE-2020-28935_19f8f4d9.patch to really fix
  bsc#1179191 CVE-2020-28935: unbound: symbolic link traversal when
  writing PID file</changelog>
  <changelog author="werner@suse.de" date="1642593601">- Import changes from OBS for dlv.isc.org.key, root.anchor, and
  root.key to fix bsc#1112033</changelog>
</package>
<package pkgid="117c88ea0e899bda671c7122b95220838d7a58854c463c398e4c7a9ffbb97e94" name="unbound-python" arch="s390x">
  <version epoch="0" ver="1.6.8" rel="10.6.1"/>
  <changelog author="michael@stroeder.com" date="1497441600">- update to 1.6.3
  Bug Fixes
- Fix #1280: Unbound fails assert when response from authoritative
  contains malformed qname. When 0x20 caps-for-id is enabled, when
  assertions are not enabled the malformed qname is handled correctly.</changelog>
  <changelog author="michael@stroeder.com" date="1498564800">- update to 1.6.4
  Features:
- Implemented trust anchor signaling using key tag query.
- unbound-checkconf -o allows query of dnstap config variables.
  Also unbound-control get_option.  Also for dnscrypt.
- unbound.h exports the shm stats structures.  They use
  type long long and no ifdefs, and ub_ before the typenames.
- Implemented opportunistic IPsec support module (ipsecmod).
- Added redirect-bogus.patch to contrib directory.
- Support for the ED25519 algorithm with openssl (from openssl 1.1.1).
- renumbering B-Root's IPv6 address to 2001:500:200::b.
- Fix #1276: [dnscrypt] add XChaCha20-Poly1305 cipher.
- Fix #1277: disable domain ratelimit by setting value to 0.
- Added fastrpz patch to contrib
  Bug Fixes:
- Added ECS unit test (from Manu Bretelle).
- ECS documentation fix (from Manu Bretelle).
- Fix #1252: more indentation inconsistencies.
- Fix #1253: unused variable in edns-subnet/addrtree.c:getbit().
- Fix #1254: clarify ratelimit-{for,below}-domain (from Manu Bretelle).
- iana portlist update
- Based on #1257: check parse limit before t increment in sldns RR
  string parse routine.
- Fix #1258: Windows 10 X64 unbound 1.6.2 service will not start.
  and fix that 64bit getting installed in C:\Program Files (x86).
- Fix #1259: "--disable-ecdsa" argument overwritten
  by "#ifdef SHA256_DIGEST_LENGTH@daemon/remote.c".
- iana portlist update
- Added test for leak of stub information.
- Fix sldns wire2str printout of RR type CAA tags.
- Fix sldns int16_data parse.
- Fix sldns parse and printout of TSIG RRs.
- sldns SMIMEA and AVC definitions, same as getdns definitions.
- Fix tcp-mss failure printout text.
- Set SO_REUSEADDR on outgoing tcp connections to fix the bind before
  connect limited tcp connections.  With the option tcp connections
  can share the same source port (for different destinations).
- Add 'c' to getopt() in testbound.
- Adjust servfail by iterator to not store in cache when serve-expired
  is enabled, to avoid overwriting useful information there.
- Fix queries for nameservers under a stub leaking to the internet.
- document trust-anchor-signaling in example config file.
- updated configure, dependencies and flex output.
- better module memory lookup, fix of unbound-control shm names for
  module memory printout of statistics.
- Fix type AVC sldns rrdef.
- Some whitespace fixup.
- Fix #1265: contrib/unbound.service contains hardcoded path.
- Fix #1265 to use /bin/kill.
- Fix #1267: Libunbound validator/val_secalgo.c uses obsolete APIs,
  and compatibility with BoringSSL.
- Fix #1268: SIGSEGV after log_reopen.
- exec_prefix is by default equal to prefix.
- printout localzone for duplicate local-zone warnings.
- Fix assertion for low buffer size and big edns payload when worker
  overrides udpsize.
- Support for openssl EVP_DigestVerify.
- Fix #1269: inconsistent use of built-in local zones with views.
- Add defaults for new local-zone trees added to views using
  unbound-control.
- Fix #1273: cachedb.c doesn't compile with -Wextra.
- If MSG_FASTOPEN gives EPIPE fallthrough to try normal tcp write.
- Also use global local-zones when there is a matching view that does
  not have any local-zone specified.
- Fix fastopen EPIPE fallthrough to perform connect.
- Fix #1274: automatically trim chroot path from dnscrypt key/cert paths
  (from Manu Bretelle).
- Fix #1275: cached data in cachedb is never used.
- Fix that unbound-control can set val_clean_additional and
  val_permissive_mode.
- Add dnscrypt XChaCha20 tests.
- Detect chacha for dnscrypt at configure time.
- dnscrypt unit tests with chacha.
- Added domain name based ECS whitelist.
- Fix #1278: Incomplete wildcard proof.
- Fix #1279: Memory leak on reload when python module is enabled.
- Fix #1280: Unbound fails assert when response from authoritative
  contains malformed qname.  When 0x20 caps-for-id is enabled, when
  assertions are not enabled the malformed qname is handled correctly.
- More fixes in depth for buffer checks in 0x20 qname checks.
- Fix stub zone queries leaking to the internet for
  harden-referral-path ns checks.
- Fix query for refetch_glue of stub leaking to internet.
- Fix #1301: memory leak in respip and tests.
- Free callback in edns-subnetmod on exit and restart.
- Fix memory leak in sldns_buffer_new_frm_data.
- Fix memory leak in dnscrypt config read.
- Fix dnscrypt chacha cert support ifdefs.
- Fix dnscrypt chacha cert unit test escapes in grep.
- Fix to unlock view in view test.
- Fix warning in pythonmod under clang compiler.
- Fix lintian typo.
- Fix #1316: heap read buffer overflow in parse_edns_options.</changelog>
  <changelog author="jengelh@inai.de" date="1502193600">- RPM group fix. Do not suppress user/group creation problems.
  Replace %__ type macro indirections.</changelog>
  <changelog author="michael@stroeder.com" date="1503316800">- update to 1.6.5
  * Fix install of trust anchor when two anchors are present, makes both
    valid.  Checks hash of DS but not signature of new key.  This fixes
    installs between sep11 and oct11 2017.</changelog>
  <changelog author="michael@stroeder.com" date="1504526400">- update to 1.6.6
  Features:
- unbound-control dump_infra prints port number for address if not 53.
- Fix #1344: RFC6761-reserved domains: test. and invalid.
- Fix #1349: allow suppression of pidfiles (from Daniel Kahn Gillmor).
  With the -p option unbound does not create a pidfile.
- Added stats for queries that have been ratelimited by domain
  recursion.
- Patch to show DNSCrypt status in help output, from Carsten
  Strotmann.
- Fix #1407: Add ECS options check to unbound-checkconf.
- Fix #1415: [dnscrypt] shared secret cache, patch from
  Manu Bretelle.
  Bug Fixes:
- fixup of dnscrypt_cert_chacha test (from Manu Bretelle).
- First fix for zero b64 and hex text zone format in sldns.
- Better fixup of dnscrypt_cert_chacha test for different escapes.
- Fix that infra cache host hash does not change after reconfig.
- Fix python example0 return module wait instead of error for pass.
- enhancement for hardened-tls for DNS over TLS.  Removed duplicated
  security settings.
- Fix for unbound-checkconf, check ipsecmod-hook if ipsecmod is turned
  on.
- Fix #1331: libunbound segfault in threaded mode when context is
  deleted.
- Fix pythonmod link line option flag.
- Fix openssl 1.1.0 load of ssl error strings from ssl init.
- Fix 1332: Bump verbosity of failed chown'ing of the control socket.
- Redirect all localhost names to localhost address for RFC6761.
- Fix #1350: make cachedb backend configurable (from JINMEI Tatuya).
- Fix tests to use .tdir (from Manu Bretelle) instead of .tpkg.
- upgrade aclocal(pkg.m4 0.29.1), config.guess(2016-10-02),
  config.sub(2016-09-05).
- annotate case statement fallthrough for gcc 7.1.1.
- flex output from flex 2.6.1.
- snprintf of thread number does not warn about truncated string.
- squelch TCP fast open error on FreeBSD when kernel has it disabled,
  unless verbosity is high.
- remove warning from windows compile.
- Fix compile with libnettle
- Fix DSA configure switch (--disable dsa) for libnettle and libnss.
- Fix #1365: Add Ed25519 support using libnettle.
- Fix #1394: mix of serve-expired and response-ip could cause a crash.
- Remove unused iter_env member (ip6arpa_dname)
- Do not reset rrset.bogus stats when called using stats_noreset.
- Do not add rrset_bogus and query ratelimiting stats per thread, these
  module stats are global.
- Fix #1397: Recursive DS lookups for AS112 zones names should recurse.
- Fix #1398: make cachedb secret configurable.
- Remove spaces from Makefile.
- Fix issue on macOX 10.10 where TCP fast open is detected but not
  implemented causing TCP to fail. The fix allows fallback to regular
  TCP in this case and is also more robust for cases where connectx()
  fails for some reason.
- Fix #1402: squelch invalid argument error for fd_set_block on windows.
- Fix to reclaim tcp handler when it is closed due to dnscrypt buffer
  allocation failure.
- Fix #1415: patch to free dnscrypt environment on reload.
- iana portlist update
- Small fixes for the shared secret cache patch.
- Fix WKS records on kvm autobuild host, with default protobyname
  entries for udp and tcp.
- Fix #1414: fix segfault on parse failure and log_replies.
- zero qinfo in handle_request, this zeroes local_alias and also the
  qname member.
- new keys and certs for dnscrypt tests.
- fixup WKS test on buildhost without servicebyname.
- updated contrib/fastrpz.patch to apply with configparser changes.
- Fix 1416: qname-minimisation breaks TLSA lookups with CNAMEs.
- Fix #1424: cachedb:testframe is not thread safe.
- Fix #1417: [dnscrypt] shared secret cache counters, and works when
  dnscrypt is not enabled.  And cache size configuration option.
- Fix #1418: [ip ratelimit] initialize slabhash using
  ip-ratelimit-slabs.
- Recommend 1472 buffer size in unbound.conf</changelog>
  <changelog author="michael@stroeder.com" date="1507636800">- update to 1.6.7
  Features:
- Set trust-anchor-signaling default to yes
- Fix #1440: [dnscrypt] client nonce cache.
- Fix #1435: Please allow UDP to be disabled separately upstream and
  downstream.
  Bug fixes:
- Fix that looping modules always stop the query, and don't pass
  control.
- Fix unbound-host to report error for DNSSEC state of failed lookups.
- Spelling fixes, from Josh Soref.
- Fix #1400: allowing use of global cache on ECS-forwarding unless
  always-forward.
- use a cachedb answer even if it's "expired" when serve-expired is yes
  (patch from Jinmei Tatuya).
- trigger refetching of the answer in that case (this will bypass
  cachedb lookup)
- allow storing a 0-TTL answer from cachedb in the in-memory message
  cache when serve-expired is yes
- Fix DNSCACHE_STORE_ZEROTTL to be bigger than 0xffff.
- Log name of looping module
- Fix #1450: Generate again patch contrib/aaaa-filter-iterator.patch
  (by Danilo G. Baio).
- Fix param unused warning for windows exportsymbol compile.
- Use RCODE from A query on DNS64 synthesized answer.
- Fix trust-anchor-signaling works in libunbound.
- Fix spelling in unbound-control man page.</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="cbosdonnat@suse.com" date="1512129600">- Use python3 instead of python2 (fate#323526)</changelog>
  <changelog author="michael@stroeder.com" date="1516363200">- update to 1.6.8 (bsc#1076963)
  patch for CVE-2017-15105: vulnerability in the processing of
  wildcard synthesized NSEC records.</changelog>
  <changelog author="dmueller@suse.com" date="1539691200">- adjust for root KSK rollover (bsc#1112009, bsc#1004165)</changelog>
  <changelog author="kbabioch@suse.com" date="1539691201">- Disabled DLV configuration by default (bsc#1055060)
- Updated the DNSSEC root trust anchor due to KSK roll over (bsc#1112009)</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1542283200">- Migrated from cron to systemd timers (bsc#1115417)</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1546603200">- Use systemd-tmpfiles to create /var/lib/unbound/root.key
  to avoid transactional update breakage (bsc#1111383)</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1551960000">- Remove old pwdutils dependency and add shadow to cover both useradd
  and groupadd as suggested in (bsc#1126757)</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1556020800">- Add systemd require in unbound-anchor to reflect new dependency (due to systemd-timers)</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1592913600">- Avoid amplifying an incoming query to a large number of queries
  Resolves CVE-2020-12662 CVE-2020-12663 (bsc#1171889)
  [ + unbound-1.6.8-amplifying-an-incoming-query.patch ]</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1592913601">- Avoid shell code execution after receiving a specially crafted answer
  Resolves CVE-2019-18934 (bsc#1157268)
  [ + patch_cve_2019-18934.patch ]</changelog>
  <changelog author="werner@suse.de" date="1642420800">- Add patches
  * bsc1185382_CVE-2019-25031_f8875527.patch
    bsc#1185382 for CVE-2019-25031
    configuration injection in create_unbound_ad_servers.sh upon a successful man-in-the-middle attack
  * bsc1185383.4_CVE-2019-25032.3_226298bb.patch
    bsc#1185383 for CVE-2019-25032
    integer overflow in the regional allocator via regional_alloc
    bsc#1185384 for CVE-2019-25033
    integer overflow in the regional allocator via the ALIGN_UP macro
  * bsc1185385_CVE-2019-25034_a3545867.patch
    bsc#1185385 for CVE-2019-25034
    integer overflow in sldns_str2wire_dname_buf_origin, leading to an out-of-bounds write
  * bsc1185386.7_CVE-2019-25035.6_fa23ee8f.patch
    bsc#1185386 for CVE-2019-25035
    out-of-bounds write in sldns_bget_token_par
    bsc#1185387 for CVE-2019-25036
    assertion failure and denial of service in synth_cname
  * bsc1185391.2_CVE-2019-25040.1_2d444a50.patch
    bsc#1185391 for CVE-2019-25040
    infinite loop via a compressed name in dname_pkt_copy
    bsc#1185392 for CVE-2019-25041
    assertion failure via a compressed name in dname_pkt_copy
  * bsc1185389.90_CVE-2019-25038.9_02080f6b.patch
    bsc#1185389 for CVE-2019-25038
    integer overflow in a size calculation in dnscrypt/dnscrypt.c
    bsc#1185390 for CVE-2019-25039
    integer overflow in a size calculation in respip/respip.c
  * bsc1185388_CVE-2019-25037_d2eb78e8.patch
    bsc#1185388 for CVE-2019-25037
    assertion failure and denial of service in dname_pkt_copy via an invalid packet
  * bsc1185393_CVE-2019-25042_6c3a0b54.patch
    bsc#1185393 for CVE-2019-25042
    out-of-bounds write via a compressed name in rdata_copy
- Correct indentation in patch unbound-1.6.8-amplifying-an-incoming-query.patch
  to make it fit to above patches</changelog>
  <changelog author="werner@suse.de" date="1642593600">- Add patch bsc1179191_CVE-2020-28935_19f8f4d9.patch to really fix
  bsc#1179191 CVE-2020-28935: unbound: symbolic link traversal when
  writing PID file</changelog>
  <changelog author="werner@suse.de" date="1642593601">- Import changes from OBS for dlv.isc.org.key, root.anchor, and
  root.key to fix bsc#1112033</changelog>
</package>
<package pkgid="9d198f1853f58c09b05b7f5a3d6fc0ad504adc5a1283d83c4c4b90c5b85be42c" name="unbound-python" arch="x86_64">
  <version epoch="0" ver="1.6.8" rel="10.6.1"/>
  <changelog author="michael@stroeder.com" date="1497441600">- update to 1.6.3
  Bug Fixes
- Fix #1280: Unbound fails assert when response from authoritative
  contains malformed qname. When 0x20 caps-for-id is enabled, when
  assertions are not enabled the malformed qname is handled correctly.</changelog>
  <changelog author="michael@stroeder.com" date="1498564800">- update to 1.6.4
  Features:
- Implemented trust anchor signaling using key tag query.
- unbound-checkconf -o allows query of dnstap config variables.
  Also unbound-control get_option.  Also for dnscrypt.
- unbound.h exports the shm stats structures.  They use
  type long long and no ifdefs, and ub_ before the typenames.
- Implemented opportunistic IPsec support module (ipsecmod).
- Added redirect-bogus.patch to contrib directory.
- Support for the ED25519 algorithm with openssl (from openssl 1.1.1).
- renumbering B-Root's IPv6 address to 2001:500:200::b.
- Fix #1276: [dnscrypt] add XChaCha20-Poly1305 cipher.
- Fix #1277: disable domain ratelimit by setting value to 0.
- Added fastrpz patch to contrib
  Bug Fixes:
- Added ECS unit test (from Manu Bretelle).
- ECS documentation fix (from Manu Bretelle).
- Fix #1252: more indentation inconsistencies.
- Fix #1253: unused variable in edns-subnet/addrtree.c:getbit().
- Fix #1254: clarify ratelimit-{for,below}-domain (from Manu Bretelle).
- iana portlist update
- Based on #1257: check parse limit before t increment in sldns RR
  string parse routine.
- Fix #1258: Windows 10 X64 unbound 1.6.2 service will not start.
  and fix that 64bit getting installed in C:\Program Files (x86).
- Fix #1259: "--disable-ecdsa" argument overwritten
  by "#ifdef SHA256_DIGEST_LENGTH@daemon/remote.c".
- iana portlist update
- Added test for leak of stub information.
- Fix sldns wire2str printout of RR type CAA tags.
- Fix sldns int16_data parse.
- Fix sldns parse and printout of TSIG RRs.
- sldns SMIMEA and AVC definitions, same as getdns definitions.
- Fix tcp-mss failure printout text.
- Set SO_REUSEADDR on outgoing tcp connections to fix the bind before
  connect limited tcp connections.  With the option tcp connections
  can share the same source port (for different destinations).
- Add 'c' to getopt() in testbound.
- Adjust servfail by iterator to not store in cache when serve-expired
  is enabled, to avoid overwriting useful information there.
- Fix queries for nameservers under a stub leaking to the internet.
- document trust-anchor-signaling in example config file.
- updated configure, dependencies and flex output.
- better module memory lookup, fix of unbound-control shm names for
  module memory printout of statistics.
- Fix type AVC sldns rrdef.
- Some whitespace fixup.
- Fix #1265: contrib/unbound.service contains hardcoded path.
- Fix #1265 to use /bin/kill.
- Fix #1267: Libunbound validator/val_secalgo.c uses obsolete APIs,
  and compatibility with BoringSSL.
- Fix #1268: SIGSEGV after log_reopen.
- exec_prefix is by default equal to prefix.
- printout localzone for duplicate local-zone warnings.
- Fix assertion for low buffer size and big edns payload when worker
  overrides udpsize.
- Support for openssl EVP_DigestVerify.
- Fix #1269: inconsistent use of built-in local zones with views.
- Add defaults for new local-zone trees added to views using
  unbound-control.
- Fix #1273: cachedb.c doesn't compile with -Wextra.
- If MSG_FASTOPEN gives EPIPE fallthrough to try normal tcp write.
- Also use global local-zones when there is a matching view that does
  not have any local-zone specified.
- Fix fastopen EPIPE fallthrough to perform connect.
- Fix #1274: automatically trim chroot path from dnscrypt key/cert paths
  (from Manu Bretelle).
- Fix #1275: cached data in cachedb is never used.
- Fix that unbound-control can set val_clean_additional and
  val_permissive_mode.
- Add dnscrypt XChaCha20 tests.
- Detect chacha for dnscrypt at configure time.
- dnscrypt unit tests with chacha.
- Added domain name based ECS whitelist.
- Fix #1278: Incomplete wildcard proof.
- Fix #1279: Memory leak on reload when python module is enabled.
- Fix #1280: Unbound fails assert when response from authoritative
  contains malformed qname.  When 0x20 caps-for-id is enabled, when
  assertions are not enabled the malformed qname is handled correctly.
- More fixes in depth for buffer checks in 0x20 qname checks.
- Fix stub zone queries leaking to the internet for
  harden-referral-path ns checks.
- Fix query for refetch_glue of stub leaking to internet.
- Fix #1301: memory leak in respip and tests.
- Free callback in edns-subnetmod on exit and restart.
- Fix memory leak in sldns_buffer_new_frm_data.
- Fix memory leak in dnscrypt config read.
- Fix dnscrypt chacha cert support ifdefs.
- Fix dnscrypt chacha cert unit test escapes in grep.
- Fix to unlock view in view test.
- Fix warning in pythonmod under clang compiler.
- Fix lintian typo.
- Fix #1316: heap read buffer overflow in parse_edns_options.</changelog>
  <changelog author="jengelh@inai.de" date="1502193600">- RPM group fix. Do not suppress user/group creation problems.
  Replace %__ type macro indirections.</changelog>
  <changelog author="michael@stroeder.com" date="1503316800">- update to 1.6.5
  * Fix install of trust anchor when two anchors are present, makes both
    valid.  Checks hash of DS but not signature of new key.  This fixes
    installs between sep11 and oct11 2017.</changelog>
  <changelog author="michael@stroeder.com" date="1504526400">- update to 1.6.6
  Features:
- unbound-control dump_infra prints port number for address if not 53.
- Fix #1344: RFC6761-reserved domains: test. and invalid.
- Fix #1349: allow suppression of pidfiles (from Daniel Kahn Gillmor).
  With the -p option unbound does not create a pidfile.
- Added stats for queries that have been ratelimited by domain
  recursion.
- Patch to show DNSCrypt status in help output, from Carsten
  Strotmann.
- Fix #1407: Add ECS options check to unbound-checkconf.
- Fix #1415: [dnscrypt] shared secret cache, patch from
  Manu Bretelle.
  Bug Fixes:
- fixup of dnscrypt_cert_chacha test (from Manu Bretelle).
- First fix for zero b64 and hex text zone format in sldns.
- Better fixup of dnscrypt_cert_chacha test for different escapes.
- Fix that infra cache host hash does not change after reconfig.
- Fix python example0 return module wait instead of error for pass.
- enhancement for hardened-tls for DNS over TLS.  Removed duplicated
  security settings.
- Fix for unbound-checkconf, check ipsecmod-hook if ipsecmod is turned
  on.
- Fix #1331: libunbound segfault in threaded mode when context is
  deleted.
- Fix pythonmod link line option flag.
- Fix openssl 1.1.0 load of ssl error strings from ssl init.
- Fix 1332: Bump verbosity of failed chown'ing of the control socket.
- Redirect all localhost names to localhost address for RFC6761.
- Fix #1350: make cachedb backend configurable (from JINMEI Tatuya).
- Fix tests to use .tdir (from Manu Bretelle) instead of .tpkg.
- upgrade aclocal(pkg.m4 0.29.1), config.guess(2016-10-02),
  config.sub(2016-09-05).
- annotate case statement fallthrough for gcc 7.1.1.
- flex output from flex 2.6.1.
- snprintf of thread number does not warn about truncated string.
- squelch TCP fast open error on FreeBSD when kernel has it disabled,
  unless verbosity is high.
- remove warning from windows compile.
- Fix compile with libnettle
- Fix DSA configure switch (--disable dsa) for libnettle and libnss.
- Fix #1365: Add Ed25519 support using libnettle.
- Fix #1394: mix of serve-expired and response-ip could cause a crash.
- Remove unused iter_env member (ip6arpa_dname)
- Do not reset rrset.bogus stats when called using stats_noreset.
- Do not add rrset_bogus and query ratelimiting stats per thread, these
  module stats are global.
- Fix #1397: Recursive DS lookups for AS112 zones names should recurse.
- Fix #1398: make cachedb secret configurable.
- Remove spaces from Makefile.
- Fix issue on macOX 10.10 where TCP fast open is detected but not
  implemented causing TCP to fail. The fix allows fallback to regular
  TCP in this case and is also more robust for cases where connectx()
  fails for some reason.
- Fix #1402: squelch invalid argument error for fd_set_block on windows.
- Fix to reclaim tcp handler when it is closed due to dnscrypt buffer
  allocation failure.
- Fix #1415: patch to free dnscrypt environment on reload.
- iana portlist update
- Small fixes for the shared secret cache patch.
- Fix WKS records on kvm autobuild host, with default protobyname
  entries for udp and tcp.
- Fix #1414: fix segfault on parse failure and log_replies.
- zero qinfo in handle_request, this zeroes local_alias and also the
  qname member.
- new keys and certs for dnscrypt tests.
- fixup WKS test on buildhost without servicebyname.
- updated contrib/fastrpz.patch to apply with configparser changes.
- Fix 1416: qname-minimisation breaks TLSA lookups with CNAMEs.
- Fix #1424: cachedb:testframe is not thread safe.
- Fix #1417: [dnscrypt] shared secret cache counters, and works when
  dnscrypt is not enabled.  And cache size configuration option.
- Fix #1418: [ip ratelimit] initialize slabhash using
  ip-ratelimit-slabs.
- Recommend 1472 buffer size in unbound.conf</changelog>
  <changelog author="michael@stroeder.com" date="1507636800">- update to 1.6.7
  Features:
- Set trust-anchor-signaling default to yes
- Fix #1440: [dnscrypt] client nonce cache.
- Fix #1435: Please allow UDP to be disabled separately upstream and
  downstream.
  Bug fixes:
- Fix that looping modules always stop the query, and don't pass
  control.
- Fix unbound-host to report error for DNSSEC state of failed lookups.
- Spelling fixes, from Josh Soref.
- Fix #1400: allowing use of global cache on ECS-forwarding unless
  always-forward.
- use a cachedb answer even if it's "expired" when serve-expired is yes
  (patch from Jinmei Tatuya).
- trigger refetching of the answer in that case (this will bypass
  cachedb lookup)
- allow storing a 0-TTL answer from cachedb in the in-memory message
  cache when serve-expired is yes
- Fix DNSCACHE_STORE_ZEROTTL to be bigger than 0xffff.
- Log name of looping module
- Fix #1450: Generate again patch contrib/aaaa-filter-iterator.patch
  (by Danilo G. Baio).
- Fix param unused warning for windows exportsymbol compile.
- Use RCODE from A query on DNS64 synthesized answer.
- Fix trust-anchor-signaling works in libunbound.
- Fix spelling in unbound-control man page.</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="cbosdonnat@suse.com" date="1512129600">- Use python3 instead of python2 (fate#323526)</changelog>
  <changelog author="michael@stroeder.com" date="1516363200">- update to 1.6.8 (bsc#1076963)
  patch for CVE-2017-15105: vulnerability in the processing of
  wildcard synthesized NSEC records.</changelog>
  <changelog author="dmueller@suse.com" date="1539691200">- adjust for root KSK rollover (bsc#1112009, bsc#1004165)</changelog>
  <changelog author="kbabioch@suse.com" date="1539691201">- Disabled DLV configuration by default (bsc#1055060)
- Updated the DNSSEC root trust anchor due to KSK roll over (bsc#1112009)</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1542283200">- Migrated from cron to systemd timers (bsc#1115417)</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1546603200">- Use systemd-tmpfiles to create /var/lib/unbound/root.key
  to avoid transactional update breakage (bsc#1111383)</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1551960000">- Remove old pwdutils dependency and add shadow to cover both useradd
  and groupadd as suggested in (bsc#1126757)</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1556020800">- Add systemd require in unbound-anchor to reflect new dependency (due to systemd-timers)</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1592913600">- Avoid amplifying an incoming query to a large number of queries
  Resolves CVE-2020-12662 CVE-2020-12663 (bsc#1171889)
  [ + unbound-1.6.8-amplifying-an-incoming-query.patch ]</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1592913601">- Avoid shell code execution after receiving a specially crafted answer
  Resolves CVE-2019-18934 (bsc#1157268)
  [ + patch_cve_2019-18934.patch ]</changelog>
  <changelog author="werner@suse.de" date="1642420800">- Add patches
  * bsc1185382_CVE-2019-25031_f8875527.patch
    bsc#1185382 for CVE-2019-25031
    configuration injection in create_unbound_ad_servers.sh upon a successful man-in-the-middle attack
  * bsc1185383.4_CVE-2019-25032.3_226298bb.patch
    bsc#1185383 for CVE-2019-25032
    integer overflow in the regional allocator via regional_alloc
    bsc#1185384 for CVE-2019-25033
    integer overflow in the regional allocator via the ALIGN_UP macro
  * bsc1185385_CVE-2019-25034_a3545867.patch
    bsc#1185385 for CVE-2019-25034
    integer overflow in sldns_str2wire_dname_buf_origin, leading to an out-of-bounds write
  * bsc1185386.7_CVE-2019-25035.6_fa23ee8f.patch
    bsc#1185386 for CVE-2019-25035
    out-of-bounds write in sldns_bget_token_par
    bsc#1185387 for CVE-2019-25036
    assertion failure and denial of service in synth_cname
  * bsc1185391.2_CVE-2019-25040.1_2d444a50.patch
    bsc#1185391 for CVE-2019-25040
    infinite loop via a compressed name in dname_pkt_copy
    bsc#1185392 for CVE-2019-25041
    assertion failure via a compressed name in dname_pkt_copy
  * bsc1185389.90_CVE-2019-25038.9_02080f6b.patch
    bsc#1185389 for CVE-2019-25038
    integer overflow in a size calculation in dnscrypt/dnscrypt.c
    bsc#1185390 for CVE-2019-25039
    integer overflow in a size calculation in respip/respip.c
  * bsc1185388_CVE-2019-25037_d2eb78e8.patch
    bsc#1185388 for CVE-2019-25037
    assertion failure and denial of service in dname_pkt_copy via an invalid packet
  * bsc1185393_CVE-2019-25042_6c3a0b54.patch
    bsc#1185393 for CVE-2019-25042
    out-of-bounds write via a compressed name in rdata_copy
- Correct indentation in patch unbound-1.6.8-amplifying-an-incoming-query.patch
  to make it fit to above patches</changelog>
  <changelog author="werner@suse.de" date="1642593600">- Add patch bsc1179191_CVE-2020-28935_19f8f4d9.patch to really fix
  bsc#1179191 CVE-2020-28935: unbound: symbolic link traversal when
  writing PID file</changelog>
  <changelog author="werner@suse.de" date="1642593601">- Import changes from OBS for dlv.isc.org.key, root.anchor, and
  root.key to fix bsc#1112033</changelog>
</package>
<package pkgid="0cc90cef4abcbb16b4589bb7cfdfff60eb11cc59d02aafbba429f93285819abb" name="update-test-affects-package-manager" arch="aarch64">
  <version epoch="0" ver="5.1" rel="33.2"/>
  <changelog author="lchiquitto@suse.de" date="1408622400">- improve description of packages and fix content of README files
- some minor fixes and clean-ups in the spec file</changelog>
  <changelog author="bbrunner@suse.com" date="1421668800">- Version bump</changelog>
  <changelog author="ro@suse.de" date="1423051200">- drop noarch
- add baselibs.conf</changelog>
  <changelog author="bbrunner@suse.com" date="1423051201">- moved 32bit-testpackage into separate subpackage</changelog>
  <changelog author="meissner@suse.com" date="1446033600">- renamed from update-test-trival to update-test-trivial</changelog>
  <changelog author="bbrunner@suse.com" date="1464004800">- Version bump (bsc#981107)</changelog>
  <changelog author="bbrunner@suse.com" date="1513771200">- Added subpackage which fails during update</changelog>
  <changelog author="bbrunner@suse.com" date="1525348800">- Version bump (bsc#1070228)</changelog>
  <changelog author="mkravec@suse.com" date="1552996800">- Break broken package for all platforms</changelog>
  <changelog author="gboiko@suse.com" date="1587038400">- Add a retracted update test case</changelog>
</package>
<package pkgid="94a6a52cea22d5dcecfed49d88e13fcf57f5c65ebb63b2bdd5dddcf93dc891c8" name="update-test-affects-package-manager" arch="ppc64le">
  <version epoch="0" ver="5.1" rel="33.2"/>
  <changelog author="lchiquitto@suse.de" date="1408622400">- improve description of packages and fix content of README files
- some minor fixes and clean-ups in the spec file</changelog>
  <changelog author="bbrunner@suse.com" date="1421668800">- Version bump</changelog>
  <changelog author="ro@suse.de" date="1423051200">- drop noarch
- add baselibs.conf</changelog>
  <changelog author="bbrunner@suse.com" date="1423051201">- moved 32bit-testpackage into separate subpackage</changelog>
  <changelog author="meissner@suse.com" date="1446033600">- renamed from update-test-trival to update-test-trivial</changelog>
  <changelog author="bbrunner@suse.com" date="1464004800">- Version bump (bsc#981107)</changelog>
  <changelog author="bbrunner@suse.com" date="1513771200">- Added subpackage which fails during update</changelog>
  <changelog author="bbrunner@suse.com" date="1525348800">- Version bump (bsc#1070228)</changelog>
  <changelog author="mkravec@suse.com" date="1552996800">- Break broken package for all platforms</changelog>
  <changelog author="gboiko@suse.com" date="1587038400">- Add a retracted update test case</changelog>
</package>
<package pkgid="a2c8d7b7b381dc377953f670e7cf8a3a12c1004e378114b114da0269b57a6ef8" name="update-test-affects-package-manager" arch="s390x">
  <version epoch="0" ver="5.1" rel="33.2"/>
  <changelog author="lchiquitto@suse.de" date="1408622400">- improve description of packages and fix content of README files
- some minor fixes and clean-ups in the spec file</changelog>
  <changelog author="bbrunner@suse.com" date="1421668800">- Version bump</changelog>
  <changelog author="ro@suse.de" date="1423051200">- drop noarch
- add baselibs.conf</changelog>
  <changelog author="bbrunner@suse.com" date="1423051201">- moved 32bit-testpackage into separate subpackage</changelog>
  <changelog author="meissner@suse.com" date="1446033600">- renamed from update-test-trival to update-test-trivial</changelog>
  <changelog author="bbrunner@suse.com" date="1464004800">- Version bump (bsc#981107)</changelog>
  <changelog author="bbrunner@suse.com" date="1513771200">- Added subpackage which fails during update</changelog>
  <changelog author="bbrunner@suse.com" date="1525348800">- Version bump (bsc#1070228)</changelog>
  <changelog author="mkravec@suse.com" date="1552996800">- Break broken package for all platforms</changelog>
  <changelog author="gboiko@suse.com" date="1587038400">- Add a retracted update test case</changelog>
</package>
<package pkgid="b30701eb358b95cabf7a724565bab263629b1dccdec9b50cb2113a0e34b9f6de" name="update-test-affects-package-manager" arch="x86_64">
  <version epoch="0" ver="5.1" rel="33.2"/>
  <changelog author="lchiquitto@suse.de" date="1408622400">- improve description of packages and fix content of README files
- some minor fixes and clean-ups in the spec file</changelog>
  <changelog author="bbrunner@suse.com" date="1421668800">- Version bump</changelog>
  <changelog author="ro@suse.de" date="1423051200">- drop noarch
- add baselibs.conf</changelog>
  <changelog author="bbrunner@suse.com" date="1423051201">- moved 32bit-testpackage into separate subpackage</changelog>
  <changelog author="meissner@suse.com" date="1446033600">- renamed from update-test-trival to update-test-trivial</changelog>
  <changelog author="bbrunner@suse.com" date="1464004800">- Version bump (bsc#981107)</changelog>
  <changelog author="bbrunner@suse.com" date="1513771200">- Added subpackage which fails during update</changelog>
  <changelog author="bbrunner@suse.com" date="1525348800">- Version bump (bsc#1070228)</changelog>
  <changelog author="mkravec@suse.com" date="1552996800">- Break broken package for all platforms</changelog>
  <changelog author="gboiko@suse.com" date="1587038400">- Add a retracted update test case</changelog>
</package>
<package pkgid="936b132357eec750fdceda7fbc85915cc7d246948d145f44f485f822e38dcd11" name="update-test-feature" arch="aarch64">
  <version epoch="0" ver="5.1" rel="33.2"/>
  <changelog author="lchiquitto@suse.de" date="1408622400">- improve description of packages and fix content of README files
- some minor fixes and clean-ups in the spec file</changelog>
  <changelog author="bbrunner@suse.com" date="1421668800">- Version bump</changelog>
  <changelog author="ro@suse.de" date="1423051200">- drop noarch
- add baselibs.conf</changelog>
  <changelog author="bbrunner@suse.com" date="1423051201">- moved 32bit-testpackage into separate subpackage</changelog>
  <changelog author="meissner@suse.com" date="1446033600">- renamed from update-test-trival to update-test-trivial</changelog>
  <changelog author="bbrunner@suse.com" date="1464004800">- Version bump (bsc#981107)</changelog>
  <changelog author="bbrunner@suse.com" date="1513771200">- Added subpackage which fails during update</changelog>
  <changelog author="bbrunner@suse.com" date="1525348800">- Version bump (bsc#1070228)</changelog>
  <changelog author="mkravec@suse.com" date="1552996800">- Break broken package for all platforms</changelog>
  <changelog author="gboiko@suse.com" date="1587038400">- Add a retracted update test case</changelog>
</package>
<package pkgid="9c089d4edcb85c0f41c8babe0dd6e1a0c076c3cde8af72520952eea8b6907a8a" name="update-test-feature" arch="ppc64le">
  <version epoch="0" ver="5.1" rel="33.2"/>
  <changelog author="lchiquitto@suse.de" date="1408622400">- improve description of packages and fix content of README files
- some minor fixes and clean-ups in the spec file</changelog>
  <changelog author="bbrunner@suse.com" date="1421668800">- Version bump</changelog>
  <changelog author="ro@suse.de" date="1423051200">- drop noarch
- add baselibs.conf</changelog>
  <changelog author="bbrunner@suse.com" date="1423051201">- moved 32bit-testpackage into separate subpackage</changelog>
  <changelog author="meissner@suse.com" date="1446033600">- renamed from update-test-trival to update-test-trivial</changelog>
  <changelog author="bbrunner@suse.com" date="1464004800">- Version bump (bsc#981107)</changelog>
  <changelog author="bbrunner@suse.com" date="1513771200">- Added subpackage which fails during update</changelog>
  <changelog author="bbrunner@suse.com" date="1525348800">- Version bump (bsc#1070228)</changelog>
  <changelog author="mkravec@suse.com" date="1552996800">- Break broken package for all platforms</changelog>
  <changelog author="gboiko@suse.com" date="1587038400">- Add a retracted update test case</changelog>
</package>
<package pkgid="8cf1369ba934b4808b1f7dcd364346428a2a7be3cb11c642e79f58d2edfdf2a2" name="update-test-feature" arch="s390x">
  <version epoch="0" ver="5.1" rel="33.2"/>
  <changelog author="lchiquitto@suse.de" date="1408622400">- improve description of packages and fix content of README files
- some minor fixes and clean-ups in the spec file</changelog>
  <changelog author="bbrunner@suse.com" date="1421668800">- Version bump</changelog>
  <changelog author="ro@suse.de" date="1423051200">- drop noarch
- add baselibs.conf</changelog>
  <changelog author="bbrunner@suse.com" date="1423051201">- moved 32bit-testpackage into separate subpackage</changelog>
  <changelog author="meissner@suse.com" date="1446033600">- renamed from update-test-trival to update-test-trivial</changelog>
  <changelog author="bbrunner@suse.com" date="1464004800">- Version bump (bsc#981107)</changelog>
  <changelog author="bbrunner@suse.com" date="1513771200">- Added subpackage which fails during update</changelog>
  <changelog author="bbrunner@suse.com" date="1525348800">- Version bump (bsc#1070228)</changelog>
  <changelog author="mkravec@suse.com" date="1552996800">- Break broken package for all platforms</changelog>
  <changelog author="gboiko@suse.com" date="1587038400">- Add a retracted update test case</changelog>
</package>
<package pkgid="b375858f1f1251030eb68091802949049322be630e5a3f3f02fad84ce70892eb" name="update-test-feature" arch="x86_64">
  <version epoch="0" ver="5.1" rel="33.2"/>
  <changelog author="lchiquitto@suse.de" date="1408622400">- improve description of packages and fix content of README files
- some minor fixes and clean-ups in the spec file</changelog>
  <changelog author="bbrunner@suse.com" date="1421668800">- Version bump</changelog>
  <changelog author="ro@suse.de" date="1423051200">- drop noarch
- add baselibs.conf</changelog>
  <changelog author="bbrunner@suse.com" date="1423051201">- moved 32bit-testpackage into separate subpackage</changelog>
  <changelog author="meissner@suse.com" date="1446033600">- renamed from update-test-trival to update-test-trivial</changelog>
  <changelog author="bbrunner@suse.com" date="1464004800">- Version bump (bsc#981107)</changelog>
  <changelog author="bbrunner@suse.com" date="1513771200">- Added subpackage which fails during update</changelog>
  <changelog author="bbrunner@suse.com" date="1525348800">- Version bump (bsc#1070228)</changelog>
  <changelog author="mkravec@suse.com" date="1552996800">- Break broken package for all platforms</changelog>
  <changelog author="gboiko@suse.com" date="1587038400">- Add a retracted update test case</changelog>
</package>
<package pkgid="386cde06b85dc0b91b5a473ac160c06cac8c5a01f20516855e77ee94d4a2a7d5" name="update-test-interactive" arch="aarch64">
  <version epoch="0" ver="5.1" rel="33.2"/>
  <changelog author="lchiquitto@suse.de" date="1408622400">- improve description of packages and fix content of README files
- some minor fixes and clean-ups in the spec file</changelog>
  <changelog author="bbrunner@suse.com" date="1421668800">- Version bump</changelog>
  <changelog author="ro@suse.de" date="1423051200">- drop noarch
- add baselibs.conf</changelog>
  <changelog author="bbrunner@suse.com" date="1423051201">- moved 32bit-testpackage into separate subpackage</changelog>
  <changelog author="meissner@suse.com" date="1446033600">- renamed from update-test-trival to update-test-trivial</changelog>
  <changelog author="bbrunner@suse.com" date="1464004800">- Version bump (bsc#981107)</changelog>
  <changelog author="bbrunner@suse.com" date="1513771200">- Added subpackage which fails during update</changelog>
  <changelog author="bbrunner@suse.com" date="1525348800">- Version bump (bsc#1070228)</changelog>
  <changelog author="mkravec@suse.com" date="1552996800">- Break broken package for all platforms</changelog>
  <changelog author="gboiko@suse.com" date="1587038400">- Add a retracted update test case</changelog>
</package>
<package pkgid="e98b74fc56e107acd182370d1393661d7c4b429481f7bf5f003e7023b1ef102a" name="update-test-interactive" arch="ppc64le">
  <version epoch="0" ver="5.1" rel="33.2"/>
  <changelog author="lchiquitto@suse.de" date="1408622400">- improve description of packages and fix content of README files
- some minor fixes and clean-ups in the spec file</changelog>
  <changelog author="bbrunner@suse.com" date="1421668800">- Version bump</changelog>
  <changelog author="ro@suse.de" date="1423051200">- drop noarch
- add baselibs.conf</changelog>
  <changelog author="bbrunner@suse.com" date="1423051201">- moved 32bit-testpackage into separate subpackage</changelog>
  <changelog author="meissner@suse.com" date="1446033600">- renamed from update-test-trival to update-test-trivial</changelog>
  <changelog author="bbrunner@suse.com" date="1464004800">- Version bump (bsc#981107)</changelog>
  <changelog author="bbrunner@suse.com" date="1513771200">- Added subpackage which fails during update</changelog>
  <changelog author="bbrunner@suse.com" date="1525348800">- Version bump (bsc#1070228)</changelog>
  <changelog author="mkravec@suse.com" date="1552996800">- Break broken package for all platforms</changelog>
  <changelog author="gboiko@suse.com" date="1587038400">- Add a retracted update test case</changelog>
</package>
<package pkgid="e15fed7902a0b65bac04a3605698cc7f755e748e6e12ea34117bf204fecb1935" name="update-test-interactive" arch="s390x">
  <version epoch="0" ver="5.1" rel="33.2"/>
  <changelog author="lchiquitto@suse.de" date="1408622400">- improve description of packages and fix content of README files
- some minor fixes and clean-ups in the spec file</changelog>
  <changelog author="bbrunner@suse.com" date="1421668800">- Version bump</changelog>
  <changelog author="ro@suse.de" date="1423051200">- drop noarch
- add baselibs.conf</changelog>
  <changelog author="bbrunner@suse.com" date="1423051201">- moved 32bit-testpackage into separate subpackage</changelog>
  <changelog author="meissner@suse.com" date="1446033600">- renamed from update-test-trival to update-test-trivial</changelog>
  <changelog author="bbrunner@suse.com" date="1464004800">- Version bump (bsc#981107)</changelog>
  <changelog author="bbrunner@suse.com" date="1513771200">- Added subpackage which fails during update</changelog>
  <changelog author="bbrunner@suse.com" date="1525348800">- Version bump (bsc#1070228)</changelog>
  <changelog author="mkravec@suse.com" date="1552996800">- Break broken package for all platforms</changelog>
  <changelog author="gboiko@suse.com" date="1587038400">- Add a retracted update test case</changelog>
</package>
<package pkgid="f2211a27237a471cf6f558c22e63119d6e3a30af1d065be3697e53714d105ff3" name="update-test-interactive" arch="x86_64">
  <version epoch="0" ver="5.1" rel="33.2"/>
  <changelog author="lchiquitto@suse.de" date="1408622400">- improve description of packages and fix content of README files
- some minor fixes and clean-ups in the spec file</changelog>
  <changelog author="bbrunner@suse.com" date="1421668800">- Version bump</changelog>
  <changelog author="ro@suse.de" date="1423051200">- drop noarch
- add baselibs.conf</changelog>
  <changelog author="bbrunner@suse.com" date="1423051201">- moved 32bit-testpackage into separate subpackage</changelog>
  <changelog author="meissner@suse.com" date="1446033600">- renamed from update-test-trival to update-test-trivial</changelog>
  <changelog author="bbrunner@suse.com" date="1464004800">- Version bump (bsc#981107)</changelog>
  <changelog author="bbrunner@suse.com" date="1513771200">- Added subpackage which fails during update</changelog>
  <changelog author="bbrunner@suse.com" date="1525348800">- Version bump (bsc#1070228)</changelog>
  <changelog author="mkravec@suse.com" date="1552996800">- Break broken package for all platforms</changelog>
  <changelog author="gboiko@suse.com" date="1587038400">- Add a retracted update test case</changelog>
</package>
<package pkgid="d65336baca04e0944e884c1e40bcfb3d49697394d4ec8c8ce17248eddc9a2fb5" name="update-test-optional" arch="aarch64">
  <version epoch="0" ver="5.1" rel="33.2"/>
  <changelog author="lchiquitto@suse.de" date="1408622400">- improve description of packages and fix content of README files
- some minor fixes and clean-ups in the spec file</changelog>
  <changelog author="bbrunner@suse.com" date="1421668800">- Version bump</changelog>
  <changelog author="ro@suse.de" date="1423051200">- drop noarch
- add baselibs.conf</changelog>
  <changelog author="bbrunner@suse.com" date="1423051201">- moved 32bit-testpackage into separate subpackage</changelog>
  <changelog author="meissner@suse.com" date="1446033600">- renamed from update-test-trival to update-test-trivial</changelog>
  <changelog author="bbrunner@suse.com" date="1464004800">- Version bump (bsc#981107)</changelog>
  <changelog author="bbrunner@suse.com" date="1513771200">- Added subpackage which fails during update</changelog>
  <changelog author="bbrunner@suse.com" date="1525348800">- Version bump (bsc#1070228)</changelog>
  <changelog author="mkravec@suse.com" date="1552996800">- Break broken package for all platforms</changelog>
  <changelog author="gboiko@suse.com" date="1587038400">- Add a retracted update test case</changelog>
</package>
<package pkgid="26d5881b38c9247a64f9ad62e0ca0805b4a9075f260726555236eb890ab22498" name="update-test-optional" arch="ppc64le">
  <version epoch="0" ver="5.1" rel="33.2"/>
  <changelog author="lchiquitto@suse.de" date="1408622400">- improve description of packages and fix content of README files
- some minor fixes and clean-ups in the spec file</changelog>
  <changelog author="bbrunner@suse.com" date="1421668800">- Version bump</changelog>
  <changelog author="ro@suse.de" date="1423051200">- drop noarch
- add baselibs.conf</changelog>
  <changelog author="bbrunner@suse.com" date="1423051201">- moved 32bit-testpackage into separate subpackage</changelog>
  <changelog author="meissner@suse.com" date="1446033600">- renamed from update-test-trival to update-test-trivial</changelog>
  <changelog author="bbrunner@suse.com" date="1464004800">- Version bump (bsc#981107)</changelog>
  <changelog author="bbrunner@suse.com" date="1513771200">- Added subpackage which fails during update</changelog>
  <changelog author="bbrunner@suse.com" date="1525348800">- Version bump (bsc#1070228)</changelog>
  <changelog author="mkravec@suse.com" date="1552996800">- Break broken package for all platforms</changelog>
  <changelog author="gboiko@suse.com" date="1587038400">- Add a retracted update test case</changelog>
</package>
<package pkgid="71402fdec9601b1d810fd43cb53e9e39f1e16c73f1c3bc862bff2a4a2073ff3d" name="update-test-optional" arch="s390x">
  <version epoch="0" ver="5.1" rel="33.2"/>
  <changelog author="lchiquitto@suse.de" date="1408622400">- improve description of packages and fix content of README files
- some minor fixes and clean-ups in the spec file</changelog>
  <changelog author="bbrunner@suse.com" date="1421668800">- Version bump</changelog>
  <changelog author="ro@suse.de" date="1423051200">- drop noarch
- add baselibs.conf</changelog>
  <changelog author="bbrunner@suse.com" date="1423051201">- moved 32bit-testpackage into separate subpackage</changelog>
  <changelog author="meissner@suse.com" date="1446033600">- renamed from update-test-trival to update-test-trivial</changelog>
  <changelog author="bbrunner@suse.com" date="1464004800">- Version bump (bsc#981107)</changelog>
  <changelog author="bbrunner@suse.com" date="1513771200">- Added subpackage which fails during update</changelog>
  <changelog author="bbrunner@suse.com" date="1525348800">- Version bump (bsc#1070228)</changelog>
  <changelog author="mkravec@suse.com" date="1552996800">- Break broken package for all platforms</changelog>
  <changelog author="gboiko@suse.com" date="1587038400">- Add a retracted update test case</changelog>
</package>
<package pkgid="b40ea677c146f8494f954531b5eac29bd88912386069039fbf7c397bdad7a41d" name="update-test-optional" arch="x86_64">
  <version epoch="0" ver="5.1" rel="33.2"/>
  <changelog author="lchiquitto@suse.de" date="1408622400">- improve description of packages and fix content of README files
- some minor fixes and clean-ups in the spec file</changelog>
  <changelog author="bbrunner@suse.com" date="1421668800">- Version bump</changelog>
  <changelog author="ro@suse.de" date="1423051200">- drop noarch
- add baselibs.conf</changelog>
  <changelog author="bbrunner@suse.com" date="1423051201">- moved 32bit-testpackage into separate subpackage</changelog>
  <changelog author="meissner@suse.com" date="1446033600">- renamed from update-test-trival to update-test-trivial</changelog>
  <changelog author="bbrunner@suse.com" date="1464004800">- Version bump (bsc#981107)</changelog>
  <changelog author="bbrunner@suse.com" date="1513771200">- Added subpackage which fails during update</changelog>
  <changelog author="bbrunner@suse.com" date="1525348800">- Version bump (bsc#1070228)</changelog>
  <changelog author="mkravec@suse.com" date="1552996800">- Break broken package for all platforms</changelog>
  <changelog author="gboiko@suse.com" date="1587038400">- Add a retracted update test case</changelog>
</package>
<package pkgid="86c34c1c18eaaebdd443bf95c2f36af5631316a702bca4968e0148afa645d2ae" name="update-test-reboot-needed" arch="aarch64">
  <version epoch="0" ver="5.1" rel="33.2"/>
  <changelog author="lchiquitto@suse.de" date="1408622400">- improve description of packages and fix content of README files
- some minor fixes and clean-ups in the spec file</changelog>
  <changelog author="bbrunner@suse.com" date="1421668800">- Version bump</changelog>
  <changelog author="ro@suse.de" date="1423051200">- drop noarch
- add baselibs.conf</changelog>
  <changelog author="bbrunner@suse.com" date="1423051201">- moved 32bit-testpackage into separate subpackage</changelog>
  <changelog author="meissner@suse.com" date="1446033600">- renamed from update-test-trival to update-test-trivial</changelog>
  <changelog author="bbrunner@suse.com" date="1464004800">- Version bump (bsc#981107)</changelog>
  <changelog author="bbrunner@suse.com" date="1513771200">- Added subpackage which fails during update</changelog>
  <changelog author="bbrunner@suse.com" date="1525348800">- Version bump (bsc#1070228)</changelog>
  <changelog author="mkravec@suse.com" date="1552996800">- Break broken package for all platforms</changelog>
  <changelog author="gboiko@suse.com" date="1587038400">- Add a retracted update test case</changelog>
</package>
<package pkgid="05fcecd964ee507ec413eff7d053a5b3212458c449691a8170e246d4cb8a5b47" name="update-test-reboot-needed" arch="ppc64le">
  <version epoch="0" ver="5.1" rel="33.2"/>
  <changelog author="lchiquitto@suse.de" date="1408622400">- improve description of packages and fix content of README files
- some minor fixes and clean-ups in the spec file</changelog>
  <changelog author="bbrunner@suse.com" date="1421668800">- Version bump</changelog>
  <changelog author="ro@suse.de" date="1423051200">- drop noarch
- add baselibs.conf</changelog>
  <changelog author="bbrunner@suse.com" date="1423051201">- moved 32bit-testpackage into separate subpackage</changelog>
  <changelog author="meissner@suse.com" date="1446033600">- renamed from update-test-trival to update-test-trivial</changelog>
  <changelog author="bbrunner@suse.com" date="1464004800">- Version bump (bsc#981107)</changelog>
  <changelog author="bbrunner@suse.com" date="1513771200">- Added subpackage which fails during update</changelog>
  <changelog author="bbrunner@suse.com" date="1525348800">- Version bump (bsc#1070228)</changelog>
  <changelog author="mkravec@suse.com" date="1552996800">- Break broken package for all platforms</changelog>
  <changelog author="gboiko@suse.com" date="1587038400">- Add a retracted update test case</changelog>
</package>
<package pkgid="d235e952c02b3fbb7802cb3a6a850238b884adfd72705e61bbddfcb383951aad" name="update-test-reboot-needed" arch="s390x">
  <version epoch="0" ver="5.1" rel="33.2"/>
  <changelog author="lchiquitto@suse.de" date="1408622400">- improve description of packages and fix content of README files
- some minor fixes and clean-ups in the spec file</changelog>
  <changelog author="bbrunner@suse.com" date="1421668800">- Version bump</changelog>
  <changelog author="ro@suse.de" date="1423051200">- drop noarch
- add baselibs.conf</changelog>
  <changelog author="bbrunner@suse.com" date="1423051201">- moved 32bit-testpackage into separate subpackage</changelog>
  <changelog author="meissner@suse.com" date="1446033600">- renamed from update-test-trival to update-test-trivial</changelog>
  <changelog author="bbrunner@suse.com" date="1464004800">- Version bump (bsc#981107)</changelog>
  <changelog author="bbrunner@suse.com" date="1513771200">- Added subpackage which fails during update</changelog>
  <changelog author="bbrunner@suse.com" date="1525348800">- Version bump (bsc#1070228)</changelog>
  <changelog author="mkravec@suse.com" date="1552996800">- Break broken package for all platforms</changelog>
  <changelog author="gboiko@suse.com" date="1587038400">- Add a retracted update test case</changelog>
</package>
<package pkgid="09f0465f6e500c6467f1c0e0865a268c0259386198a18c833b5f4049126212c2" name="update-test-reboot-needed" arch="x86_64">
  <version epoch="0" ver="5.1" rel="33.2"/>
  <changelog author="lchiquitto@suse.de" date="1408622400">- improve description of packages and fix content of README files
- some minor fixes and clean-ups in the spec file</changelog>
  <changelog author="bbrunner@suse.com" date="1421668800">- Version bump</changelog>
  <changelog author="ro@suse.de" date="1423051200">- drop noarch
- add baselibs.conf</changelog>
  <changelog author="bbrunner@suse.com" date="1423051201">- moved 32bit-testpackage into separate subpackage</changelog>
  <changelog author="meissner@suse.com" date="1446033600">- renamed from update-test-trival to update-test-trivial</changelog>
  <changelog author="bbrunner@suse.com" date="1464004800">- Version bump (bsc#981107)</changelog>
  <changelog author="bbrunner@suse.com" date="1513771200">- Added subpackage which fails during update</changelog>
  <changelog author="bbrunner@suse.com" date="1525348800">- Version bump (bsc#1070228)</changelog>
  <changelog author="mkravec@suse.com" date="1552996800">- Break broken package for all platforms</changelog>
  <changelog author="gboiko@suse.com" date="1587038400">- Add a retracted update test case</changelog>
</package>
<package pkgid="2186879022216400067055502648193d5a3158f0a0982abd9bca0c5db066e818" name="update-test-relogin-suggested" arch="aarch64">
  <version epoch="0" ver="5.1" rel="33.2"/>
  <changelog author="lchiquitto@suse.de" date="1408622400">- improve description of packages and fix content of README files
- some minor fixes and clean-ups in the spec file</changelog>
  <changelog author="bbrunner@suse.com" date="1421668800">- Version bump</changelog>
  <changelog author="ro@suse.de" date="1423051200">- drop noarch
- add baselibs.conf</changelog>
  <changelog author="bbrunner@suse.com" date="1423051201">- moved 32bit-testpackage into separate subpackage</changelog>
  <changelog author="meissner@suse.com" date="1446033600">- renamed from update-test-trival to update-test-trivial</changelog>
  <changelog author="bbrunner@suse.com" date="1464004800">- Version bump (bsc#981107)</changelog>
  <changelog author="bbrunner@suse.com" date="1513771200">- Added subpackage which fails during update</changelog>
  <changelog author="bbrunner@suse.com" date="1525348800">- Version bump (bsc#1070228)</changelog>
  <changelog author="mkravec@suse.com" date="1552996800">- Break broken package for all platforms</changelog>
  <changelog author="gboiko@suse.com" date="1587038400">- Add a retracted update test case</changelog>
</package>
<package pkgid="61a0b5530d8f1cc9e0f15f9a7ad32c61a4ee010a4bdc91a850fd88b485f831d8" name="update-test-relogin-suggested" arch="ppc64le">
  <version epoch="0" ver="5.1" rel="33.2"/>
  <changelog author="lchiquitto@suse.de" date="1408622400">- improve description of packages and fix content of README files
- some minor fixes and clean-ups in the spec file</changelog>
  <changelog author="bbrunner@suse.com" date="1421668800">- Version bump</changelog>
  <changelog author="ro@suse.de" date="1423051200">- drop noarch
- add baselibs.conf</changelog>
  <changelog author="bbrunner@suse.com" date="1423051201">- moved 32bit-testpackage into separate subpackage</changelog>
  <changelog author="meissner@suse.com" date="1446033600">- renamed from update-test-trival to update-test-trivial</changelog>
  <changelog author="bbrunner@suse.com" date="1464004800">- Version bump (bsc#981107)</changelog>
  <changelog author="bbrunner@suse.com" date="1513771200">- Added subpackage which fails during update</changelog>
  <changelog author="bbrunner@suse.com" date="1525348800">- Version bump (bsc#1070228)</changelog>
  <changelog author="mkravec@suse.com" date="1552996800">- Break broken package for all platforms</changelog>
  <changelog author="gboiko@suse.com" date="1587038400">- Add a retracted update test case</changelog>
</package>
<package pkgid="f9c0dfd9522a6b375beb1f970839dac2ac1e87d01eb6d89d954e86e0a2d7a7d6" name="update-test-relogin-suggested" arch="s390x">
  <version epoch="0" ver="5.1" rel="33.2"/>
  <changelog author="lchiquitto@suse.de" date="1408622400">- improve description of packages and fix content of README files
- some minor fixes and clean-ups in the spec file</changelog>
  <changelog author="bbrunner@suse.com" date="1421668800">- Version bump</changelog>
  <changelog author="ro@suse.de" date="1423051200">- drop noarch
- add baselibs.conf</changelog>
  <changelog author="bbrunner@suse.com" date="1423051201">- moved 32bit-testpackage into separate subpackage</changelog>
  <changelog author="meissner@suse.com" date="1446033600">- renamed from update-test-trival to update-test-trivial</changelog>
  <changelog author="bbrunner@suse.com" date="1464004800">- Version bump (bsc#981107)</changelog>
  <changelog author="bbrunner@suse.com" date="1513771200">- Added subpackage which fails during update</changelog>
  <changelog author="bbrunner@suse.com" date="1525348800">- Version bump (bsc#1070228)</changelog>
  <changelog author="mkravec@suse.com" date="1552996800">- Break broken package for all platforms</changelog>
  <changelog author="gboiko@suse.com" date="1587038400">- Add a retracted update test case</changelog>
</package>
<package pkgid="eb849e6327ae792ea23519f6d18eba3eeae03c7c9813c9243bc0459643b751b2" name="update-test-relogin-suggested" arch="x86_64">
  <version epoch="0" ver="5.1" rel="33.2"/>
  <changelog author="lchiquitto@suse.de" date="1408622400">- improve description of packages and fix content of README files
- some minor fixes and clean-ups in the spec file</changelog>
  <changelog author="bbrunner@suse.com" date="1421668800">- Version bump</changelog>
  <changelog author="ro@suse.de" date="1423051200">- drop noarch
- add baselibs.conf</changelog>
  <changelog author="bbrunner@suse.com" date="1423051201">- moved 32bit-testpackage into separate subpackage</changelog>
  <changelog author="meissner@suse.com" date="1446033600">- renamed from update-test-trival to update-test-trivial</changelog>
  <changelog author="bbrunner@suse.com" date="1464004800">- Version bump (bsc#981107)</changelog>
  <changelog author="bbrunner@suse.com" date="1513771200">- Added subpackage which fails during update</changelog>
  <changelog author="bbrunner@suse.com" date="1525348800">- Version bump (bsc#1070228)</changelog>
  <changelog author="mkravec@suse.com" date="1552996800">- Break broken package for all platforms</changelog>
  <changelog author="gboiko@suse.com" date="1587038400">- Add a retracted update test case</changelog>
</package>
<package pkgid="3390900bdd675ccdffa1cb7545ba719f4619a2a3d7f4b7b895d000f89a523e9b" name="update-test-retracted" arch="aarch64">
  <version epoch="0" ver="5.1" rel="33.2"/>
  <changelog author="lchiquitto@suse.de" date="1408622400">- improve description of packages and fix content of README files
- some minor fixes and clean-ups in the spec file</changelog>
  <changelog author="bbrunner@suse.com" date="1421668800">- Version bump</changelog>
  <changelog author="ro@suse.de" date="1423051200">- drop noarch
- add baselibs.conf</changelog>
  <changelog author="bbrunner@suse.com" date="1423051201">- moved 32bit-testpackage into separate subpackage</changelog>
  <changelog author="meissner@suse.com" date="1446033600">- renamed from update-test-trival to update-test-trivial</changelog>
  <changelog author="bbrunner@suse.com" date="1464004800">- Version bump (bsc#981107)</changelog>
  <changelog author="bbrunner@suse.com" date="1513771200">- Added subpackage which fails during update</changelog>
  <changelog author="bbrunner@suse.com" date="1525348800">- Version bump (bsc#1070228)</changelog>
  <changelog author="mkravec@suse.com" date="1552996800">- Break broken package for all platforms</changelog>
  <changelog author="gboiko@suse.com" date="1587038400">- Add a retracted update test case</changelog>
</package>
<package pkgid="f98514f9fbc9f08b9115a0392925cc0193b03dd16032e9c86b000068b6c6bc44" name="update-test-retracted" arch="ppc64le">
  <version epoch="0" ver="5.1" rel="33.2"/>
  <changelog author="lchiquitto@suse.de" date="1408622400">- improve description of packages and fix content of README files
- some minor fixes and clean-ups in the spec file</changelog>
  <changelog author="bbrunner@suse.com" date="1421668800">- Version bump</changelog>
  <changelog author="ro@suse.de" date="1423051200">- drop noarch
- add baselibs.conf</changelog>
  <changelog author="bbrunner@suse.com" date="1423051201">- moved 32bit-testpackage into separate subpackage</changelog>
  <changelog author="meissner@suse.com" date="1446033600">- renamed from update-test-trival to update-test-trivial</changelog>
  <changelog author="bbrunner@suse.com" date="1464004800">- Version bump (bsc#981107)</changelog>
  <changelog author="bbrunner@suse.com" date="1513771200">- Added subpackage which fails during update</changelog>
  <changelog author="bbrunner@suse.com" date="1525348800">- Version bump (bsc#1070228)</changelog>
  <changelog author="mkravec@suse.com" date="1552996800">- Break broken package for all platforms</changelog>
  <changelog author="gboiko@suse.com" date="1587038400">- Add a retracted update test case</changelog>
</package>
<package pkgid="6f10efef0bec9c06b7b52d33017bdfa6d956dd2c1bae605654b64400c13921cd" name="update-test-retracted" arch="s390x">
  <version epoch="0" ver="5.1" rel="33.2"/>
  <changelog author="lchiquitto@suse.de" date="1408622400">- improve description of packages and fix content of README files
- some minor fixes and clean-ups in the spec file</changelog>
  <changelog author="bbrunner@suse.com" date="1421668800">- Version bump</changelog>
  <changelog author="ro@suse.de" date="1423051200">- drop noarch
- add baselibs.conf</changelog>
  <changelog author="bbrunner@suse.com" date="1423051201">- moved 32bit-testpackage into separate subpackage</changelog>
  <changelog author="meissner@suse.com" date="1446033600">- renamed from update-test-trival to update-test-trivial</changelog>
  <changelog author="bbrunner@suse.com" date="1464004800">- Version bump (bsc#981107)</changelog>
  <changelog author="bbrunner@suse.com" date="1513771200">- Added subpackage which fails during update</changelog>
  <changelog author="bbrunner@suse.com" date="1525348800">- Version bump (bsc#1070228)</changelog>
  <changelog author="mkravec@suse.com" date="1552996800">- Break broken package for all platforms</changelog>
  <changelog author="gboiko@suse.com" date="1587038400">- Add a retracted update test case</changelog>
</package>
<package pkgid="8118d242d7b0b3a5805a35f16b53832720c795f1bb166dcc35398adbbccd73e3" name="update-test-retracted" arch="x86_64">
  <version epoch="0" ver="5.1" rel="33.2"/>
  <changelog author="lchiquitto@suse.de" date="1408622400">- improve description of packages and fix content of README files
- some minor fixes and clean-ups in the spec file</changelog>
  <changelog author="bbrunner@suse.com" date="1421668800">- Version bump</changelog>
  <changelog author="ro@suse.de" date="1423051200">- drop noarch
- add baselibs.conf</changelog>
  <changelog author="bbrunner@suse.com" date="1423051201">- moved 32bit-testpackage into separate subpackage</changelog>
  <changelog author="meissner@suse.com" date="1446033600">- renamed from update-test-trival to update-test-trivial</changelog>
  <changelog author="bbrunner@suse.com" date="1464004800">- Version bump (bsc#981107)</changelog>
  <changelog author="bbrunner@suse.com" date="1513771200">- Added subpackage which fails during update</changelog>
  <changelog author="bbrunner@suse.com" date="1525348800">- Version bump (bsc#1070228)</changelog>
  <changelog author="mkravec@suse.com" date="1552996800">- Break broken package for all platforms</changelog>
  <changelog author="gboiko@suse.com" date="1587038400">- Add a retracted update test case</changelog>
</package>
<package pkgid="bfb3bd1354417b1dedf759d5e3baa32c8d35760d24e8014aa94fb7f28e2d2d4a" name="update-test-security" arch="aarch64">
  <version epoch="0" ver="5.1" rel="33.2"/>
  <changelog author="lchiquitto@suse.de" date="1408622400">- improve description of packages and fix content of README files
- some minor fixes and clean-ups in the spec file</changelog>
  <changelog author="bbrunner@suse.com" date="1421668800">- Version bump</changelog>
  <changelog author="ro@suse.de" date="1423051200">- drop noarch
- add baselibs.conf</changelog>
  <changelog author="bbrunner@suse.com" date="1423051201">- moved 32bit-testpackage into separate subpackage</changelog>
  <changelog author="meissner@suse.com" date="1446033600">- renamed from update-test-trival to update-test-trivial</changelog>
  <changelog author="bbrunner@suse.com" date="1464004800">- Version bump (bsc#981107)</changelog>
  <changelog author="bbrunner@suse.com" date="1513771200">- Added subpackage which fails during update</changelog>
  <changelog author="bbrunner@suse.com" date="1525348800">- Version bump (bsc#1070228)</changelog>
  <changelog author="mkravec@suse.com" date="1552996800">- Break broken package for all platforms</changelog>
  <changelog author="gboiko@suse.com" date="1587038400">- Add a retracted update test case</changelog>
</package>
<package pkgid="c665e68a747b95d889725e6b33b2b992adb7909b0fe86f6aaeb1950661b3d306" name="update-test-security" arch="ppc64le">
  <version epoch="0" ver="5.1" rel="33.2"/>
  <changelog author="lchiquitto@suse.de" date="1408622400">- improve description of packages and fix content of README files
- some minor fixes and clean-ups in the spec file</changelog>
  <changelog author="bbrunner@suse.com" date="1421668800">- Version bump</changelog>
  <changelog author="ro@suse.de" date="1423051200">- drop noarch
- add baselibs.conf</changelog>
  <changelog author="bbrunner@suse.com" date="1423051201">- moved 32bit-testpackage into separate subpackage</changelog>
  <changelog author="meissner@suse.com" date="1446033600">- renamed from update-test-trival to update-test-trivial</changelog>
  <changelog author="bbrunner@suse.com" date="1464004800">- Version bump (bsc#981107)</changelog>
  <changelog author="bbrunner@suse.com" date="1513771200">- Added subpackage which fails during update</changelog>
  <changelog author="bbrunner@suse.com" date="1525348800">- Version bump (bsc#1070228)</changelog>
  <changelog author="mkravec@suse.com" date="1552996800">- Break broken package for all platforms</changelog>
  <changelog author="gboiko@suse.com" date="1587038400">- Add a retracted update test case</changelog>
</package>
<package pkgid="69a7d9c0cc85ecf9e1ebc14980c4f70f44db1e427bae7e1f09e0676eaadc2eca" name="update-test-security" arch="s390x">
  <version epoch="0" ver="5.1" rel="33.2"/>
  <changelog author="lchiquitto@suse.de" date="1408622400">- improve description of packages and fix content of README files
- some minor fixes and clean-ups in the spec file</changelog>
  <changelog author="bbrunner@suse.com" date="1421668800">- Version bump</changelog>
  <changelog author="ro@suse.de" date="1423051200">- drop noarch
- add baselibs.conf</changelog>
  <changelog author="bbrunner@suse.com" date="1423051201">- moved 32bit-testpackage into separate subpackage</changelog>
  <changelog author="meissner@suse.com" date="1446033600">- renamed from update-test-trival to update-test-trivial</changelog>
  <changelog author="bbrunner@suse.com" date="1464004800">- Version bump (bsc#981107)</changelog>
  <changelog author="bbrunner@suse.com" date="1513771200">- Added subpackage which fails during update</changelog>
  <changelog author="bbrunner@suse.com" date="1525348800">- Version bump (bsc#1070228)</changelog>
  <changelog author="mkravec@suse.com" date="1552996800">- Break broken package for all platforms</changelog>
  <changelog author="gboiko@suse.com" date="1587038400">- Add a retracted update test case</changelog>
</package>
<package pkgid="85b096976235af18d085a52cbfa1d31c40336e6120c396b3feafb264c09ef1ce" name="update-test-security" arch="x86_64">
  <version epoch="0" ver="5.1" rel="33.2"/>
  <changelog author="lchiquitto@suse.de" date="1408622400">- improve description of packages and fix content of README files
- some minor fixes and clean-ups in the spec file</changelog>
  <changelog author="bbrunner@suse.com" date="1421668800">- Version bump</changelog>
  <changelog author="ro@suse.de" date="1423051200">- drop noarch
- add baselibs.conf</changelog>
  <changelog author="bbrunner@suse.com" date="1423051201">- moved 32bit-testpackage into separate subpackage</changelog>
  <changelog author="meissner@suse.com" date="1446033600">- renamed from update-test-trival to update-test-trivial</changelog>
  <changelog author="bbrunner@suse.com" date="1464004800">- Version bump (bsc#981107)</changelog>
  <changelog author="bbrunner@suse.com" date="1513771200">- Added subpackage which fails during update</changelog>
  <changelog author="bbrunner@suse.com" date="1525348800">- Version bump (bsc#1070228)</changelog>
  <changelog author="mkravec@suse.com" date="1552996800">- Break broken package for all platforms</changelog>
  <changelog author="gboiko@suse.com" date="1587038400">- Add a retracted update test case</changelog>
</package>
<package pkgid="90d1f56d00597f8625ddf09ab029279ca9b34b2f8b5e8f539120ea12dc44591d" name="update-test-trivial" arch="aarch64">
  <version epoch="0" ver="5.1" rel="33.2"/>
  <changelog author="lchiquitto@suse.de" date="1408622400">- improve description of packages and fix content of README files
- some minor fixes and clean-ups in the spec file</changelog>
  <changelog author="bbrunner@suse.com" date="1421668800">- Version bump</changelog>
  <changelog author="ro@suse.de" date="1423051200">- drop noarch
- add baselibs.conf</changelog>
  <changelog author="bbrunner@suse.com" date="1423051201">- moved 32bit-testpackage into separate subpackage</changelog>
  <changelog author="meissner@suse.com" date="1446033600">- renamed from update-test-trival to update-test-trivial</changelog>
  <changelog author="bbrunner@suse.com" date="1464004800">- Version bump (bsc#981107)</changelog>
  <changelog author="bbrunner@suse.com" date="1513771200">- Added subpackage which fails during update</changelog>
  <changelog author="bbrunner@suse.com" date="1525348800">- Version bump (bsc#1070228)</changelog>
  <changelog author="mkravec@suse.com" date="1552996800">- Break broken package for all platforms</changelog>
  <changelog author="gboiko@suse.com" date="1587038400">- Add a retracted update test case</changelog>
</package>
<package pkgid="9c89e582ec2412ed71228ee814639d434437d943d70969f2617d7fd8c657b828" name="update-test-trivial" arch="ppc64le">
  <version epoch="0" ver="5.1" rel="33.2"/>
  <changelog author="lchiquitto@suse.de" date="1408622400">- improve description of packages and fix content of README files
- some minor fixes and clean-ups in the spec file</changelog>
  <changelog author="bbrunner@suse.com" date="1421668800">- Version bump</changelog>
  <changelog author="ro@suse.de" date="1423051200">- drop noarch
- add baselibs.conf</changelog>
  <changelog author="bbrunner@suse.com" date="1423051201">- moved 32bit-testpackage into separate subpackage</changelog>
  <changelog author="meissner@suse.com" date="1446033600">- renamed from update-test-trival to update-test-trivial</changelog>
  <changelog author="bbrunner@suse.com" date="1464004800">- Version bump (bsc#981107)</changelog>
  <changelog author="bbrunner@suse.com" date="1513771200">- Added subpackage which fails during update</changelog>
  <changelog author="bbrunner@suse.com" date="1525348800">- Version bump (bsc#1070228)</changelog>
  <changelog author="mkravec@suse.com" date="1552996800">- Break broken package for all platforms</changelog>
  <changelog author="gboiko@suse.com" date="1587038400">- Add a retracted update test case</changelog>
</package>
<package pkgid="4c3b803fba52b7331e423c50a9d44a83c43622800b19bce787372e751c9ec62d" name="update-test-trivial" arch="s390x">
  <version epoch="0" ver="5.1" rel="33.2"/>
  <changelog author="lchiquitto@suse.de" date="1408622400">- improve description of packages and fix content of README files
- some minor fixes and clean-ups in the spec file</changelog>
  <changelog author="bbrunner@suse.com" date="1421668800">- Version bump</changelog>
  <changelog author="ro@suse.de" date="1423051200">- drop noarch
- add baselibs.conf</changelog>
  <changelog author="bbrunner@suse.com" date="1423051201">- moved 32bit-testpackage into separate subpackage</changelog>
  <changelog author="meissner@suse.com" date="1446033600">- renamed from update-test-trival to update-test-trivial</changelog>
  <changelog author="bbrunner@suse.com" date="1464004800">- Version bump (bsc#981107)</changelog>
  <changelog author="bbrunner@suse.com" date="1513771200">- Added subpackage which fails during update</changelog>
  <changelog author="bbrunner@suse.com" date="1525348800">- Version bump (bsc#1070228)</changelog>
  <changelog author="mkravec@suse.com" date="1552996800">- Break broken package for all platforms</changelog>
  <changelog author="gboiko@suse.com" date="1587038400">- Add a retracted update test case</changelog>
</package>
<package pkgid="e9587bfd9f057a667ac4323142b8565e61530af82f3e396ff329de4d1e67c858" name="update-test-trivial" arch="src">
  <version epoch="0" ver="5.1" rel="33.2"/>
  <changelog author="hmuelle@suse.de" date="1161172800">- created initial update-test-trival package for testing our update
  stack</changelog>
  <changelog author="mvidner@suse.cz" date="1162987200">- Added subpackages to test other kinds of patches.
- 1.1</changelog>
  <changelog author="hmuelle@suse.de" date="1165233600">- Fixed specfile to avoid locale issues (Müller -&gt; Mueller)</changelog>
  <changelog author="hmuelle@suse.de" date="1169035200">- Fixed specfile and downgrade version to 1.2
  99.9 is reserved for "universal updates testing" during beta
  cycles</changelog>
  <changelog author="lrupp@suse.de" date="1171540800">- specfile rewrite:
  + create the documentation files inline:
    (add version, release and date)
  + use get_version_number.sh and get_release_number.sh
    for "easier" preparing mbuild numbers
- version 1.3-0</changelog>
  <changelog author="dmueller@suse.de" date="1241524800">- add relogin-suggested subpackage</changelog>
  <changelog author="dmueller@suse.de" date="1267185600">- add feature subpackage</changelog>
  <changelog author="lchiquitto@suse.de" date="1408622400">- improve description of packages and fix content of README files
- some minor fixes and clean-ups in the spec file</changelog>
  <changelog author="bbrunner@suse.com" date="1421668800">- Version bump</changelog>
  <changelog author="ro@suse.de" date="1423051200">- drop noarch
- add baselibs.conf</changelog>
  <changelog author="bbrunner@suse.com" date="1423051201">- moved 32bit-testpackage into separate subpackage</changelog>
  <changelog author="meissner@suse.com" date="1446033600">- renamed from update-test-trival to update-test-trivial</changelog>
  <changelog author="bbrunner@suse.com" date="1464004800">- Version bump (bsc#981107)</changelog>
  <changelog author="bbrunner@suse.com" date="1513771200">- Added subpackage which fails during update</changelog>
  <changelog author="bbrunner@suse.com" date="1525348800">- Version bump (bsc#1070228)</changelog>
  <changelog author="mkravec@suse.com" date="1552996800">- Break broken package for all platforms</changelog>
  <changelog author="gboiko@suse.com" date="1587038400">- Add a retracted update test case</changelog>
</package>
<package pkgid="e219dd6c3a92ccb691bafe7cfbd338d61160dc33e1470fe266e8f2dc57be4b60" name="update-test-trivial" arch="x86_64">
  <version epoch="0" ver="5.1" rel="33.2"/>
  <changelog author="lchiquitto@suse.de" date="1408622400">- improve description of packages and fix content of README files
- some minor fixes and clean-ups in the spec file</changelog>
  <changelog author="bbrunner@suse.com" date="1421668800">- Version bump</changelog>
  <changelog author="ro@suse.de" date="1423051200">- drop noarch
- add baselibs.conf</changelog>
  <changelog author="bbrunner@suse.com" date="1423051201">- moved 32bit-testpackage into separate subpackage</changelog>
  <changelog author="meissner@suse.com" date="1446033600">- renamed from update-test-trival to update-test-trivial</changelog>
  <changelog author="bbrunner@suse.com" date="1464004800">- Version bump (bsc#981107)</changelog>
  <changelog author="bbrunner@suse.com" date="1513771200">- Added subpackage which fails during update</changelog>
  <changelog author="bbrunner@suse.com" date="1525348800">- Version bump (bsc#1070228)</changelog>
  <changelog author="mkravec@suse.com" date="1552996800">- Break broken package for all platforms</changelog>
  <changelog author="gboiko@suse.com" date="1587038400">- Add a retracted update test case</changelog>
</package>
<package pkgid="0c41a6910146abf07be3d30408bd60ed3881db73e80912349fbd8866d8309f85" name="virglrenderer" arch="src">
  <version epoch="0" ver="0.6.0" rel="4.9.1"/>
  <changelog author="lma@suse.com" date="1460462400">- Initial package, based upon virglrenderer upstream sources
  (git tag: 0.5.0)</changelog>
  <changelog author="lma@suse.com" date="1460548800">- Fixed epoxy dependency</changelog>
  <changelog author="brogers@suse.com" date="1460635200">- Fixed url in spec file</changelog>
  <changelog author="brogers@suse.com" date="1464782400">- Refine BuildRequires tags</changelog>
  <changelog author="brogers@suse.com" date="1464955200">- Further tweaks to package layout, including splitting out
  the test server into it's own package.</changelog>
  <changelog author="lma@suse.com" date="1487332800">- Address various security issues
  * Fix null pointer dereference in vrend_clear (CVE-2017-5937 bsc#1024232)
  0001-48f67f60-renderer-fix-NULL-pointer-deref-in-vrend_clear.patch
  * Fix host memory leak issue in virgl_resource_attach_backing (CVE-2016-10214 bsc#1024244)
  0002-40b0e781-renderer-fix-a-leak-in-resource-attach.patch
  * Fix memory leak in int blit context (CVE-2017-5993 bsc#1025505)
  0003-6eb13f7a-vrend-fix-memory-leak-in-int-blit-context.patch
  * Fix heap overflow in vertex elements state create (CVE-2017-5994 bsc#1025507)
  0004-114688c5-renderer-fix-heap-overflow-in-vertex-elements-state-.patch
  * Fix a stack overflow in set framebuffer state (CVE-2017-5957 bsc#1024993)
  0005-926b9b34-vrend-fix-a-stack-overflow-in-set-framebuffer-state.patch</changelog>
  <changelog author="lma@suse.com" date="1487937600">- Update package to 0.6.0
  The following patches will be removed:
  0001-48f67f60-renderer-fix-NULL-pointer-deref-in-vrend_clear.patch
  0002-40b0e781-renderer-fix-a-leak-in-resource-attach.patch
  0003-6eb13f7a-vrend-fix-memory-leak-in-int-blit-context.patch
  0004-114688c5-renderer-fix-heap-overflow-in-vertex-elements-state-.patch
  0005-926b9b34-vrend-fix-a-stack-overflow-in-set-framebuffer-state.patch
  All of the removed patches were already included in 0.6.0,
  So we dont need them any more.</changelog>
  <changelog author="jengelh@inai.de" date="1488456000">- Fix RPM groups</changelog>
  <changelog author="lma@suse.com" date="1489147200">- Fix memory leak in vertex elements state create (CVE-2017-6386 bsc#1027376)
  0001-737c3350-renderer-fix-memory-leak-in-vertex-elements-state-cr.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1509537600">- Clean up spec file with spec-cleaner
- Use source url
- Add gpg signature
- Make building more verbose
- Explicitly require python2</changelog>
  <changelog author="lma@suse.com" date="1576843200">- Add 4 security fixes
  * Check resource creation more thoroughly (CVE-2019-18388 bsc#1159479)
  0002-5d03711-vrend-Keep-the-max-texture-sizes-in-the-vrend_state.patch
  0003-0d9a2c8-vrend-Check-resource-creation-more-thoroughly.patch
  * check info formats in blits (CVE-2019-18390 bsc#1159478)
  0004-24f67de-vrend-check-info-formats-in-blits.patch
  * check transfer bounds for negative values too (CVE-2019-18389 bsc#1159482)
  0005-cbc8d8b-vrend-check-transfer-bounds-for-negative-values-too-.patch
  * check transfer iov holds enough data for the data upload (CVE-2019-18391 bsc#1159486)
  0006-2abeb18-vrend-check-that-the-transfer-iov-holds-enough-data-.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1642420800">- security update
- added patches
  fix CVE-2022-0175 [bsc#1194601], VUL-0: CVE-2022-0175: virglrenderer: Missing initialization of res-&gt;ptr
  + virglrenderer-CVE-2022-0175.patch</changelog>
  <changelog author="mvetter@suse.com" date="1643803200">- security update
  * Fix OOB in read_transfer_data() (CVE-2022-0135 bsc#1195389)
    Add 0007-95e581fd-vrend-fix-oob-read_transfer_data.patch</changelog>
</package>
<package pkgid="3f4ae8e2460c10f669992fce7fb0ed917b3f430fde894937ca987b533e46c6d5" name="vsftpd" arch="aarch64">
  <version epoch="0" ver="3.0.3" rel="12.6.1"/>
  <changelog author="kukuk@suse.de" date="1493726400">- Adjust to new system user/group RPMs</changelog>
  <changelog author="psimons@suse.com" date="1496232000">- Explicitly depend on OpenSSL version 1.0.x since vsftpd doesn't
  compile against the API provided by newer versions.</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1497268800">- Fix build against OpenSSL 1.1. Remove lock on 1.0.x libs
  adds vsftpd-3.0.3-build-with-openssl-1.1.patch
  (bsc#1042673)</changelog>
  <changelog author="tchvatal@suse.com" date="1497441600">- Conditionally install xinetd service only on older releases
  * On current distributions we support the same functionality
    via systemd socket activation</changelog>
  <changelog author="psimons@suse.com" date="1504785600">- Add "vsftpd-die-with-session.patch" to fix a bug in vsftpd that
  would cause SSL protocol errors, aborting the connection, whenever
  system errors occurred that were supposed to be non-fatal.
  [bsc#1044292]
- Add "vsftpd-mdtm-in-utc.patch" to fix interoperability issue with
  various ftp clients that arose when vsftpd is configured with
  option "use_localtime=YES". Basically, it's fine to use local time
  stamps in directory listings, but responding to MDTM commands with
  any time zone other than UTC directly violates RFC3659 and leads
  FTP clients to misinterpret the file's time stamp. [bsc#1024961]
- Add "vsftpd-append-seek-pipe.patch" to allow the FTP server to
  append to a file system pipe. [bsc#1048427]
- Add "vsftpd-3.0.3-address_space_limit.patch" to create the new
  configuration option "address_space_limit", which determines the
  memory limit vsftpd configures for its own process (given in
  bytes). The previously hard-coded limit (100 MB) may not be
  sufficient for vsftpd servers running with certain PAM modules
  enabled, and in such cases administrators may wish to raise the
  limit to match their system's requirements. [bsc#1042137]
- Don't rely on the vsf_findlibs.sh script to figure out the list
  of libraries the build needs to link. The script is wildly
  unreliable and it's hard to predict what results it will produce.
  Also, the results it *does* produce are invisble in the build
  log. We stumbled across this issue when vsftpd suddendly had
  build failures on i586 platforms because the script decided to
  try and link "-lnsl" even though the library was neither
  installed nor required.
- Drop the explicit specification of the LDFLAGS and LINK variables
  from the call to make. The value of LDFLAGS we passed is the
  default anyway and giving LINK has no effect since it's not used
  anywhere in the Makefile.</changelog>
  <changelog author="tchvatal@suse.com" date="1513166400">- Make sure to also require group nobody and user ftp bsc#1070653</changelog>
  <changelog author="vcizek@suse.com" date="1522756800">- Add firewalld service file (bsc#1083705)</changelog>
  <changelog author="psimons@suse.com" date="1524657600">- vsftpd-enable-syscalls-needed-by-sle15.patch: Enable wait4(),
  sysinfo(), and shutdown() syscalls in seccomp sandbox. These are
  required for the daemon to work properly on SLE-15. [bsc#1089088,
  bsc#1180314]</changelog>
  <changelog author="psimons@suse.com" date="1526472000">- Don't start/stop parameterized systemd units in pre/post actions.
  These units cannot be used without an explicit parameter and
  attempts to do so lead to a confusing "failed to try-restart"
  error message. [bsc#1093179, bsc#1010177]</changelog>
  <changelog author="psimons@suse.com" date="1529582400">- Apply "vsftpd-support-dsa-only-setups.patch" to disable the
  problematic default setting for rsa_cert_file. Upstream
  initializes that value to "/usr/share/ssl/certs/vsftpd.pem" and
  vsftpd won't start up if that file does not exist (or if it does
  not contain an RSA certificate). Therefore, users who copy a DSA
  certificate into that location or properly configure a DSA
  certificate via dsa_cert_file without explicitly disabling the
  RSA certificate won't be able to start vsftpd. [bsc#975538]</changelog>
  <changelog author="psimons@suse.com" date="1530187200">- Extend "vsftpd-3.0.3-address_space_limit.patch" to mention the
  new 'address_space_limit' option in the installed vsftpd.conf(5)
  man page. [bsc#1075060]</changelog>
  <changelog author="suse-beta@cboltz.de" date="1540296000">- firewall-macros should be BuildRequires, not Requires(post)
  (the macro gets expanded during package build)</changelog>
  <changelog author="dimstar@opensuse.org" date="1560340800">- BuildRequire pkgconfig(systemd) instead of systemd: allow OBS to
  shortcut the build queues by allowing usage of systemd-mini</changelog>
  <changelog author="psimons@suse.com" date="1560859200">- Apply "vsftpd-avoid-bogus-ssl-write.patch" to fix a segmentation
  fault that occurred while trying to write to an invalid TLS
  context. [bsc#1125951]</changelog>
  <changelog author="josef.moellers@suse.com" date="1575547200">- Add pam_keyinit.so to PAM config file.
  [vsftpd.pam, bsc#1144062]</changelog>
  <changelog author="dimstar@opensuse.org" date="1597838400">- Use %{_prefix}/lib instead of misused %{_libexecdir}.</changelog>
  <changelog author="psimons@suse.com" date="1605268800">- Apply "0001-Introduce-TLSv1.1-and-TLSv1.2-options.patch" and
  "0001-When-handling-FEAT-command-check-ssl_tlsv1_1-and-ssl.patch",
  which add the "ssl_tlsv1_1" and "ssl_tlsv1_2" options to the
  configuration file. Both options default to true. [SLE-4182]</changelog>
  <changelog author="idonmez@suse.com" date="1606996800">- Add seccomp-fixes.patch to allow getdents64 syscall in seccomp
  sandbox, fixes bsc#1179553
  Also in the same patch, fix the architecture offset from 4 to 5,
  this change was documented in https://lore.kernel.org/patchwork/patch/554803/</changelog>
  <changelog author="psimons@suse.com" date="1624363200">- OpenSSL was updated to version 1.1.1 in SLE-15-SP2, adding
  support for the TLSv1.3 protocol. As a consequence, some SLE-15
  applications that link OpenSSL for TLS support -- like vsftpd --,
  gained the ability to use the newer TLS protocol, which created
  interoperability problems with FTP clients in some cases. To
  remedy the situation, "0001-Introduce-TLSv1.3-option.patch" was
  applied in a forked SLE-15-SP2 version of vsftpd. The patch adds
  the configuration option "ssl_tlsv1_3" that system administrators
  can use to disable TLSv1.3 support on their servers.
  [bsc#1187188]</changelog>
  <changelog author="psimons@suse.com" date="1640088000">- Fix several issues related to SSL/TLS support [bsc#1021387]:
  * vsftpd-openlog-force.patch fixes a logic error in the way the
    force option for syslog's openlog() call was handled.
  * vsftpd-seccomp-ssl.patch allows stat() to be called, which is
    required during SSL initialization by RAND_load_file().
  * vsftpd-seccomp-wait4.patch allows wait4() to be called so that
    the broker can wait for its child processes.
- Add "vsftpd-seccomp-getrandom.patch" to fix a seccomp failure that
  used to occur in FIPS mode when SSL is enabled. [bsc#1052900]
- Fix seccomp bug where the process would hang trying access
  syslog. [bnc#971784]</changelog>
</package>
<package pkgid="fcc260a100ffe1648a938089ee1bf9a0bffb553f2d2d38d796001c5fe5326ea2" name="vsftpd" arch="ppc64le">
  <version epoch="0" ver="3.0.3" rel="12.6.1"/>
  <changelog author="kukuk@suse.de" date="1493726400">- Adjust to new system user/group RPMs</changelog>
  <changelog author="psimons@suse.com" date="1496232000">- Explicitly depend on OpenSSL version 1.0.x since vsftpd doesn't
  compile against the API provided by newer versions.</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1497268800">- Fix build against OpenSSL 1.1. Remove lock on 1.0.x libs
  adds vsftpd-3.0.3-build-with-openssl-1.1.patch
  (bsc#1042673)</changelog>
  <changelog author="tchvatal@suse.com" date="1497441600">- Conditionally install xinetd service only on older releases
  * On current distributions we support the same functionality
    via systemd socket activation</changelog>
  <changelog author="psimons@suse.com" date="1504785600">- Add "vsftpd-die-with-session.patch" to fix a bug in vsftpd that
  would cause SSL protocol errors, aborting the connection, whenever
  system errors occurred that were supposed to be non-fatal.
  [bsc#1044292]
- Add "vsftpd-mdtm-in-utc.patch" to fix interoperability issue with
  various ftp clients that arose when vsftpd is configured with
  option "use_localtime=YES". Basically, it's fine to use local time
  stamps in directory listings, but responding to MDTM commands with
  any time zone other than UTC directly violates RFC3659 and leads
  FTP clients to misinterpret the file's time stamp. [bsc#1024961]
- Add "vsftpd-append-seek-pipe.patch" to allow the FTP server to
  append to a file system pipe. [bsc#1048427]
- Add "vsftpd-3.0.3-address_space_limit.patch" to create the new
  configuration option "address_space_limit", which determines the
  memory limit vsftpd configures for its own process (given in
  bytes). The previously hard-coded limit (100 MB) may not be
  sufficient for vsftpd servers running with certain PAM modules
  enabled, and in such cases administrators may wish to raise the
  limit to match their system's requirements. [bsc#1042137]
- Don't rely on the vsf_findlibs.sh script to figure out the list
  of libraries the build needs to link. The script is wildly
  unreliable and it's hard to predict what results it will produce.
  Also, the results it *does* produce are invisble in the build
  log. We stumbled across this issue when vsftpd suddendly had
  build failures on i586 platforms because the script decided to
  try and link "-lnsl" even though the library was neither
  installed nor required.
- Drop the explicit specification of the LDFLAGS and LINK variables
  from the call to make. The value of LDFLAGS we passed is the
  default anyway and giving LINK has no effect since it's not used
  anywhere in the Makefile.</changelog>
  <changelog author="tchvatal@suse.com" date="1513166400">- Make sure to also require group nobody and user ftp bsc#1070653</changelog>
  <changelog author="vcizek@suse.com" date="1522756800">- Add firewalld service file (bsc#1083705)</changelog>
  <changelog author="psimons@suse.com" date="1524657600">- vsftpd-enable-syscalls-needed-by-sle15.patch: Enable wait4(),
  sysinfo(), and shutdown() syscalls in seccomp sandbox. These are
  required for the daemon to work properly on SLE-15. [bsc#1089088,
  bsc#1180314]</changelog>
  <changelog author="psimons@suse.com" date="1526472000">- Don't start/stop parameterized systemd units in pre/post actions.
  These units cannot be used without an explicit parameter and
  attempts to do so lead to a confusing "failed to try-restart"
  error message. [bsc#1093179, bsc#1010177]</changelog>
  <changelog author="psimons@suse.com" date="1529582400">- Apply "vsftpd-support-dsa-only-setups.patch" to disable the
  problematic default setting for rsa_cert_file. Upstream
  initializes that value to "/usr/share/ssl/certs/vsftpd.pem" and
  vsftpd won't start up if that file does not exist (or if it does
  not contain an RSA certificate). Therefore, users who copy a DSA
  certificate into that location or properly configure a DSA
  certificate via dsa_cert_file without explicitly disabling the
  RSA certificate won't be able to start vsftpd. [bsc#975538]</changelog>
  <changelog author="psimons@suse.com" date="1530187200">- Extend "vsftpd-3.0.3-address_space_limit.patch" to mention the
  new 'address_space_limit' option in the installed vsftpd.conf(5)
  man page. [bsc#1075060]</changelog>
  <changelog author="suse-beta@cboltz.de" date="1540296000">- firewall-macros should be BuildRequires, not Requires(post)
  (the macro gets expanded during package build)</changelog>
  <changelog author="dimstar@opensuse.org" date="1560340800">- BuildRequire pkgconfig(systemd) instead of systemd: allow OBS to
  shortcut the build queues by allowing usage of systemd-mini</changelog>
  <changelog author="psimons@suse.com" date="1560859200">- Apply "vsftpd-avoid-bogus-ssl-write.patch" to fix a segmentation
  fault that occurred while trying to write to an invalid TLS
  context. [bsc#1125951]</changelog>
  <changelog author="josef.moellers@suse.com" date="1575547200">- Add pam_keyinit.so to PAM config file.
  [vsftpd.pam, bsc#1144062]</changelog>
  <changelog author="dimstar@opensuse.org" date="1597838400">- Use %{_prefix}/lib instead of misused %{_libexecdir}.</changelog>
  <changelog author="psimons@suse.com" date="1605268800">- Apply "0001-Introduce-TLSv1.1-and-TLSv1.2-options.patch" and
  "0001-When-handling-FEAT-command-check-ssl_tlsv1_1-and-ssl.patch",
  which add the "ssl_tlsv1_1" and "ssl_tlsv1_2" options to the
  configuration file. Both options default to true. [SLE-4182]</changelog>
  <changelog author="idonmez@suse.com" date="1606996800">- Add seccomp-fixes.patch to allow getdents64 syscall in seccomp
  sandbox, fixes bsc#1179553
  Also in the same patch, fix the architecture offset from 4 to 5,
  this change was documented in https://lore.kernel.org/patchwork/patch/554803/</changelog>
  <changelog author="psimons@suse.com" date="1624363200">- OpenSSL was updated to version 1.1.1 in SLE-15-SP2, adding
  support for the TLSv1.3 protocol. As a consequence, some SLE-15
  applications that link OpenSSL for TLS support -- like vsftpd --,
  gained the ability to use the newer TLS protocol, which created
  interoperability problems with FTP clients in some cases. To
  remedy the situation, "0001-Introduce-TLSv1.3-option.patch" was
  applied in a forked SLE-15-SP2 version of vsftpd. The patch adds
  the configuration option "ssl_tlsv1_3" that system administrators
  can use to disable TLSv1.3 support on their servers.
  [bsc#1187188]</changelog>
  <changelog author="psimons@suse.com" date="1640088000">- Fix several issues related to SSL/TLS support [bsc#1021387]:
  * vsftpd-openlog-force.patch fixes a logic error in the way the
    force option for syslog's openlog() call was handled.
  * vsftpd-seccomp-ssl.patch allows stat() to be called, which is
    required during SSL initialization by RAND_load_file().
  * vsftpd-seccomp-wait4.patch allows wait4() to be called so that
    the broker can wait for its child processes.
- Add "vsftpd-seccomp-getrandom.patch" to fix a seccomp failure that
  used to occur in FIPS mode when SSL is enabled. [bsc#1052900]
- Fix seccomp bug where the process would hang trying access
  syslog. [bnc#971784]</changelog>
</package>
<package pkgid="ebeb04952dcddaf9cd75e392bb17a07b42ca64b2b394c7864923ca3a02543be9" name="vsftpd" arch="src">
  <version epoch="0" ver="3.0.3" rel="12.6.1"/>
  <changelog author="kukuk@suse.de" date="1493726400">- Adjust to new system user/group RPMs</changelog>
  <changelog author="psimons@suse.com" date="1496232000">- Explicitly depend on OpenSSL version 1.0.x since vsftpd doesn't
  compile against the API provided by newer versions.</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1497268800">- Fix build against OpenSSL 1.1. Remove lock on 1.0.x libs
  adds vsftpd-3.0.3-build-with-openssl-1.1.patch
  (bsc#1042673)</changelog>
  <changelog author="tchvatal@suse.com" date="1497441600">- Conditionally install xinetd service only on older releases
  * On current distributions we support the same functionality
    via systemd socket activation</changelog>
  <changelog author="psimons@suse.com" date="1504785600">- Add "vsftpd-die-with-session.patch" to fix a bug in vsftpd that
  would cause SSL protocol errors, aborting the connection, whenever
  system errors occurred that were supposed to be non-fatal.
  [bsc#1044292]
- Add "vsftpd-mdtm-in-utc.patch" to fix interoperability issue with
  various ftp clients that arose when vsftpd is configured with
  option "use_localtime=YES". Basically, it's fine to use local time
  stamps in directory listings, but responding to MDTM commands with
  any time zone other than UTC directly violates RFC3659 and leads
  FTP clients to misinterpret the file's time stamp. [bsc#1024961]
- Add "vsftpd-append-seek-pipe.patch" to allow the FTP server to
  append to a file system pipe. [bsc#1048427]
- Add "vsftpd-3.0.3-address_space_limit.patch" to create the new
  configuration option "address_space_limit", which determines the
  memory limit vsftpd configures for its own process (given in
  bytes). The previously hard-coded limit (100 MB) may not be
  sufficient for vsftpd servers running with certain PAM modules
  enabled, and in such cases administrators may wish to raise the
  limit to match their system's requirements. [bsc#1042137]
- Don't rely on the vsf_findlibs.sh script to figure out the list
  of libraries the build needs to link. The script is wildly
  unreliable and it's hard to predict what results it will produce.
  Also, the results it *does* produce are invisble in the build
  log. We stumbled across this issue when vsftpd suddendly had
  build failures on i586 platforms because the script decided to
  try and link "-lnsl" even though the library was neither
  installed nor required.
- Drop the explicit specification of the LDFLAGS and LINK variables
  from the call to make. The value of LDFLAGS we passed is the
  default anyway and giving LINK has no effect since it's not used
  anywhere in the Makefile.</changelog>
  <changelog author="tchvatal@suse.com" date="1513166400">- Make sure to also require group nobody and user ftp bsc#1070653</changelog>
  <changelog author="vcizek@suse.com" date="1522756800">- Add firewalld service file (bsc#1083705)</changelog>
  <changelog author="psimons@suse.com" date="1524657600">- vsftpd-enable-syscalls-needed-by-sle15.patch: Enable wait4(),
  sysinfo(), and shutdown() syscalls in seccomp sandbox. These are
  required for the daemon to work properly on SLE-15. [bsc#1089088,
  bsc#1180314]</changelog>
  <changelog author="psimons@suse.com" date="1526472000">- Don't start/stop parameterized systemd units in pre/post actions.
  These units cannot be used without an explicit parameter and
  attempts to do so lead to a confusing "failed to try-restart"
  error message. [bsc#1093179, bsc#1010177]</changelog>
  <changelog author="psimons@suse.com" date="1529582400">- Apply "vsftpd-support-dsa-only-setups.patch" to disable the
  problematic default setting for rsa_cert_file. Upstream
  initializes that value to "/usr/share/ssl/certs/vsftpd.pem" and
  vsftpd won't start up if that file does not exist (or if it does
  not contain an RSA certificate). Therefore, users who copy a DSA
  certificate into that location or properly configure a DSA
  certificate via dsa_cert_file without explicitly disabling the
  RSA certificate won't be able to start vsftpd. [bsc#975538]</changelog>
  <changelog author="psimons@suse.com" date="1530187200">- Extend "vsftpd-3.0.3-address_space_limit.patch" to mention the
  new 'address_space_limit' option in the installed vsftpd.conf(5)
  man page. [bsc#1075060]</changelog>
  <changelog author="suse-beta@cboltz.de" date="1540296000">- firewall-macros should be BuildRequires, not Requires(post)
  (the macro gets expanded during package build)</changelog>
  <changelog author="dimstar@opensuse.org" date="1560340800">- BuildRequire pkgconfig(systemd) instead of systemd: allow OBS to
  shortcut the build queues by allowing usage of systemd-mini</changelog>
  <changelog author="psimons@suse.com" date="1560859200">- Apply "vsftpd-avoid-bogus-ssl-write.patch" to fix a segmentation
  fault that occurred while trying to write to an invalid TLS
  context. [bsc#1125951]</changelog>
  <changelog author="josef.moellers@suse.com" date="1575547200">- Add pam_keyinit.so to PAM config file.
  [vsftpd.pam, bsc#1144062]</changelog>
  <changelog author="dimstar@opensuse.org" date="1597838400">- Use %{_prefix}/lib instead of misused %{_libexecdir}.</changelog>
  <changelog author="psimons@suse.com" date="1605268800">- Apply "0001-Introduce-TLSv1.1-and-TLSv1.2-options.patch" and
  "0001-When-handling-FEAT-command-check-ssl_tlsv1_1-and-ssl.patch",
  which add the "ssl_tlsv1_1" and "ssl_tlsv1_2" options to the
  configuration file. Both options default to true. [SLE-4182]</changelog>
  <changelog author="idonmez@suse.com" date="1606996800">- Add seccomp-fixes.patch to allow getdents64 syscall in seccomp
  sandbox, fixes bsc#1179553
  Also in the same patch, fix the architecture offset from 4 to 5,
  this change was documented in https://lore.kernel.org/patchwork/patch/554803/</changelog>
  <changelog author="psimons@suse.com" date="1624363200">- OpenSSL was updated to version 1.1.1 in SLE-15-SP2, adding
  support for the TLSv1.3 protocol. As a consequence, some SLE-15
  applications that link OpenSSL for TLS support -- like vsftpd --,
  gained the ability to use the newer TLS protocol, which created
  interoperability problems with FTP clients in some cases. To
  remedy the situation, "0001-Introduce-TLSv1.3-option.patch" was
  applied in a forked SLE-15-SP2 version of vsftpd. The patch adds
  the configuration option "ssl_tlsv1_3" that system administrators
  can use to disable TLSv1.3 support on their servers.
  [bsc#1187188]</changelog>
  <changelog author="psimons@suse.com" date="1640088000">- Fix several issues related to SSL/TLS support [bsc#1021387]:
  * vsftpd-openlog-force.patch fixes a logic error in the way the
    force option for syslog's openlog() call was handled.
  * vsftpd-seccomp-ssl.patch allows stat() to be called, which is
    required during SSL initialization by RAND_load_file().
  * vsftpd-seccomp-wait4.patch allows wait4() to be called so that
    the broker can wait for its child processes.
- Add "vsftpd-seccomp-getrandom.patch" to fix a seccomp failure that
  used to occur in FIPS mode when SSL is enabled. [bsc#1052900]
- Fix seccomp bug where the process would hang trying access
  syslog. [bnc#971784]</changelog>
</package>
<package pkgid="d84e3223458f18716af5c3df046e8ec6254a34adbac758f4e5eb9be2b8fb340a" name="vsftpd" arch="x86_64">
  <version epoch="0" ver="3.0.3" rel="12.6.1"/>
  <changelog author="kukuk@suse.de" date="1493726400">- Adjust to new system user/group RPMs</changelog>
  <changelog author="psimons@suse.com" date="1496232000">- Explicitly depend on OpenSSL version 1.0.x since vsftpd doesn't
  compile against the API provided by newer versions.</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1497268800">- Fix build against OpenSSL 1.1. Remove lock on 1.0.x libs
  adds vsftpd-3.0.3-build-with-openssl-1.1.patch
  (bsc#1042673)</changelog>
  <changelog author="tchvatal@suse.com" date="1497441600">- Conditionally install xinetd service only on older releases
  * On current distributions we support the same functionality
    via systemd socket activation</changelog>
  <changelog author="psimons@suse.com" date="1504785600">- Add "vsftpd-die-with-session.patch" to fix a bug in vsftpd that
  would cause SSL protocol errors, aborting the connection, whenever
  system errors occurred that were supposed to be non-fatal.
  [bsc#1044292]
- Add "vsftpd-mdtm-in-utc.patch" to fix interoperability issue with
  various ftp clients that arose when vsftpd is configured with
  option "use_localtime=YES". Basically, it's fine to use local time
  stamps in directory listings, but responding to MDTM commands with
  any time zone other than UTC directly violates RFC3659 and leads
  FTP clients to misinterpret the file's time stamp. [bsc#1024961]
- Add "vsftpd-append-seek-pipe.patch" to allow the FTP server to
  append to a file system pipe. [bsc#1048427]
- Add "vsftpd-3.0.3-address_space_limit.patch" to create the new
  configuration option "address_space_limit", which determines the
  memory limit vsftpd configures for its own process (given in
  bytes). The previously hard-coded limit (100 MB) may not be
  sufficient for vsftpd servers running with certain PAM modules
  enabled, and in such cases administrators may wish to raise the
  limit to match their system's requirements. [bsc#1042137]
- Don't rely on the vsf_findlibs.sh script to figure out the list
  of libraries the build needs to link. The script is wildly
  unreliable and it's hard to predict what results it will produce.
  Also, the results it *does* produce are invisble in the build
  log. We stumbled across this issue when vsftpd suddendly had
  build failures on i586 platforms because the script decided to
  try and link "-lnsl" even though the library was neither
  installed nor required.
- Drop the explicit specification of the LDFLAGS and LINK variables
  from the call to make. The value of LDFLAGS we passed is the
  default anyway and giving LINK has no effect since it's not used
  anywhere in the Makefile.</changelog>
  <changelog author="tchvatal@suse.com" date="1513166400">- Make sure to also require group nobody and user ftp bsc#1070653</changelog>
  <changelog author="vcizek@suse.com" date="1522756800">- Add firewalld service file (bsc#1083705)</changelog>
  <changelog author="psimons@suse.com" date="1524657600">- vsftpd-enable-syscalls-needed-by-sle15.patch: Enable wait4(),
  sysinfo(), and shutdown() syscalls in seccomp sandbox. These are
  required for the daemon to work properly on SLE-15. [bsc#1089088,
  bsc#1180314]</changelog>
  <changelog author="psimons@suse.com" date="1526472000">- Don't start/stop parameterized systemd units in pre/post actions.
  These units cannot be used without an explicit parameter and
  attempts to do so lead to a confusing "failed to try-restart"
  error message. [bsc#1093179, bsc#1010177]</changelog>
  <changelog author="psimons@suse.com" date="1529582400">- Apply "vsftpd-support-dsa-only-setups.patch" to disable the
  problematic default setting for rsa_cert_file. Upstream
  initializes that value to "/usr/share/ssl/certs/vsftpd.pem" and
  vsftpd won't start up if that file does not exist (or if it does
  not contain an RSA certificate). Therefore, users who copy a DSA
  certificate into that location or properly configure a DSA
  certificate via dsa_cert_file without explicitly disabling the
  RSA certificate won't be able to start vsftpd. [bsc#975538]</changelog>
  <changelog author="psimons@suse.com" date="1530187200">- Extend "vsftpd-3.0.3-address_space_limit.patch" to mention the
  new 'address_space_limit' option in the installed vsftpd.conf(5)
  man page. [bsc#1075060]</changelog>
  <changelog author="suse-beta@cboltz.de" date="1540296000">- firewall-macros should be BuildRequires, not Requires(post)
  (the macro gets expanded during package build)</changelog>
  <changelog author="dimstar@opensuse.org" date="1560340800">- BuildRequire pkgconfig(systemd) instead of systemd: allow OBS to
  shortcut the build queues by allowing usage of systemd-mini</changelog>
  <changelog author="psimons@suse.com" date="1560859200">- Apply "vsftpd-avoid-bogus-ssl-write.patch" to fix a segmentation
  fault that occurred while trying to write to an invalid TLS
  context. [bsc#1125951]</changelog>
  <changelog author="josef.moellers@suse.com" date="1575547200">- Add pam_keyinit.so to PAM config file.
  [vsftpd.pam, bsc#1144062]</changelog>
  <changelog author="dimstar@opensuse.org" date="1597838400">- Use %{_prefix}/lib instead of misused %{_libexecdir}.</changelog>
  <changelog author="psimons@suse.com" date="1605268800">- Apply "0001-Introduce-TLSv1.1-and-TLSv1.2-options.patch" and
  "0001-When-handling-FEAT-command-check-ssl_tlsv1_1-and-ssl.patch",
  which add the "ssl_tlsv1_1" and "ssl_tlsv1_2" options to the
  configuration file. Both options default to true. [SLE-4182]</changelog>
  <changelog author="idonmez@suse.com" date="1606996800">- Add seccomp-fixes.patch to allow getdents64 syscall in seccomp
  sandbox, fixes bsc#1179553
  Also in the same patch, fix the architecture offset from 4 to 5,
  this change was documented in https://lore.kernel.org/patchwork/patch/554803/</changelog>
  <changelog author="psimons@suse.com" date="1624363200">- OpenSSL was updated to version 1.1.1 in SLE-15-SP2, adding
  support for the TLSv1.3 protocol. As a consequence, some SLE-15
  applications that link OpenSSL for TLS support -- like vsftpd --,
  gained the ability to use the newer TLS protocol, which created
  interoperability problems with FTP clients in some cases. To
  remedy the situation, "0001-Introduce-TLSv1.3-option.patch" was
  applied in a forked SLE-15-SP2 version of vsftpd. The patch adds
  the configuration option "ssl_tlsv1_3" that system administrators
  can use to disable TLSv1.3 support on their servers.
  [bsc#1187188]</changelog>
  <changelog author="psimons@suse.com" date="1640088000">- Fix several issues related to SSL/TLS support [bsc#1021387]:
  * vsftpd-openlog-force.patch fixes a logic error in the way the
    force option for syslog's openlog() call was handled.
  * vsftpd-seccomp-ssl.patch allows stat() to be called, which is
    required during SSL initialization by RAND_load_file().
  * vsftpd-seccomp-wait4.patch allows wait4() to be called so that
    the broker can wait for its child processes.
- Add "vsftpd-seccomp-getrandom.patch" to fix a seccomp failure that
  used to occur in FIPS mode when SSL is enabled. [bsc#1052900]
- Fix seccomp bug where the process would hang trying access
  syslog. [bnc#971784]</changelog>
</package>
<package pkgid="d3ca2c53331a689ffe53715e8ed0c2b600542cd61c279dd64a0975b2c1eb7393" name="webkit2gtk3" arch="src">
  <version epoch="0" ver="2.34.3" rel="23.3"/>
  <changelog author="mgorse@suse.com" date="1600084800">- Update to version 2.30.0:
  + Fix NTLM authentication.
  + Don't try to use SHM on wayland with older wpebackend-fdo.
  + Fix the build due to seccomp.h header not found.
  + Security fixes: CVE-2020-9947, CVE-2020-9948, CVE-2020-9951,
  CVE-2021-1817, CVE-2021-1820, CVE-2021-1825, CVE-2021-1826,
  CVE-2021-30661.
- Drop seccomp-build-fix.patch and wpe-shm-check.patch: fixed
  upstream.</changelog>
  <changelog author="mgorse@suse.com" date="1600776000">- Update to version 2.30.1:
  + Bring back the environment variable to force single process
    mode when PSON is disabled.
  + Fix downloads started by an ephemeral web context.
  + Updated translations.</changelog>
  <changelog author="mgorse@suse.com" date="1601467200">- Enable c_loop on aarch64: currently needed for compilation to
  succeed with JIT disabled. Also disable sampling profiler, since
  it conflicts with c_loop (boo#1177087).</changelog>
  <changelog author="dimstar@opensuse.org" date="1603454400">- Update to version 2.30.2:
  + Fix scrolling when smooth scrolling is enabled in async
    scrolling mode.
  + Fix WebSocket requests with same-site cookies.
  + Fix TLS certificate information for service workers.
  + Handle chassis type when its value is quoted.
  + Fix the build with ENABLE_MEDIA_STREAM enabled and
    ENABLE_WEB_RTC_DISABLED.
  + Fix the build with ENABLE_GAMEPAD enabled.
  + Fix several crashes and rendering issues.</changelog>
  <changelog author="mgorse@suse.com" date="1606046400">- Update to version 2.30.3 (boo#1179122 boo#1179451):
  + Add new build option USE(64KB_PAGE_BLOCK).
  + Fix backdrop filters with rounded borders.
  + Fix scrolling iframes when async scrolling is enabled.
  + Allow applications to handle drag and drop on the web view
    again.
  + Update Outlook user agent quirk.
  + Fix the build with video support disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2020-13584, CVE-2020-9983, CVE-2020-13543.
- Drop webkit2gtk3-fdo-soname.patch: fixed upstream.
- Rebase webkit-process.patch.</changelog>
  <changelog author="dimstar@opensuse.org" date="1606910400">- 0001-ICU-68.1-no-longer-exposes-FALSE-and-TRUE-macros-by-.patch:
  ICU 68.1 no longer exposes FALSE and TRUE macros by default.</changelog>
  <changelog author="mgorse@suse.com" date="1606996800">- Add old-wayland-scanner.patch for 15.0: support older
  wayland-scanner. ALso renumber patches to group 15.0-specific
  patches together.
- Have the libwebkit2gtk package require libjavascriptcoregtk of
  the same version (boo#1171531).</changelog>
  <changelog author="dimstar@opensuse.org" date="1608033600">- Update to version 2.30.4:
  + Fix text data sent with WebSockets when using libsoup &lt; 2.68.
  + Fix the rendering on Raspberry Pi 3 using the proprietary video
    driver.
  + Fix clipping of descedant layers of a mask layer.
  + Fix the build with ICU 68.1.
- Drop upstream merged patch:
  + 0001-ICU-68.1-no-longer-exposes-FALSE-and-TRUE-macros-by-.patch</changelog>
  <changelog author="badshah400@gmail.com" date="1611057600">- Add webkit-font-scaling.patch: Fix system font scaling not
  applied to 'font-size: XXXpt'; patch taken from upstream and
  rebased to apply cleanly
  (https://bugs.webkit.org/show_bug.cgi?id=218450).
- Pass `-q` to setup to disable printing long list of files
  extracted from source tarball.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1611144000">- Add gir-multilib.patch: Fix multilib conflict in gir files.
- Disable gold linker for ppc64le</changelog>
  <changelog author="mgorse@suse.com" date="1613217600">- Update to version 2.30.5 (boo#1182286):
  + Bring back the WebKitPluginProcess installation that was
    removed by mistake.
  + Fix RunLoop objects leaked in worker threads.
  + Fix aarch64 llint build with JIT disabled.
  + Use Internet Explorer quirk for Google Docs.
  + Security fixes: CVE-2020-13558.
- Drop gir-multilib.patch: fixed upstream.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1613736000">- Update _constraints for armv6/armv7 (bsc#1182719)</changelog>
  <changelog author="mgorse@suse.com" date="1617710400">- Update to version 2.32.0 (boo#1184155):
  + Fix the authentication request port when URL omits the port.
  + Fix iframe scrolling when main frame is scrolled in async
    scrolling mode.
  + Stop using g_memdup.
  + Show a warning message when overriding signal handler for
    threading suspension.
  - Fix the build on RISC-V with GCC 11.
  - Fix several crashes and rendering issues.
  + Security fixes: CVE-2021-1788, CVE-2021-1844, CVE-2021-1871,
  CVE-2021-30682.
  + Changes in version 2.30.6 (boo#1184262):
  + Update user agent quirks again for Google Docs and Google Drive.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2020-27918, CVE-2020-29623, CVE-2021-1765,
  CVE-2021-1789, CVE-2021-1799, CVE-2021-1801, CVE-2021-1870,
  CVE-2021-21806.
- Remove webkit-font-scaling.patch: contained in upstream
- Drop original SLE 15 support from the spec. Drop
  webkit-process.patch and old-wayland-scanner.patch; they are not
  needed for SP2.
- Pass ENABLE_GAMEPAD=OFF to cmake, since we don't have manette.
- Add glproto-devel to BuildRequires: now needed for the build on
  SLE 15.</changelog>
  <changelog author="mgorse@suse.com" date="1618228800">- Per discussion with maintenance, let's not remove features that
  customers could possibly be using:
- Add webkit2gtk3-restore-npapi.patch: restore NPAPI plugin
  support. Reverts webkit#215503.</changelog>
  <changelog author="mgorse@suse.com" date="1627300800">- Update to version 2.32.3 (boo#1188697):
  + Properly set the cookies settings after a network process
    crash.
  + Fix accessibility tree after a cross site navigation with PSON
    enabled.
  + Ensure WebKitScriptWorld::window-object-cleared signal is
    always emitted.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2021-21775, CVE-2021-21779, CVE-2021-30663,
  CVE-2021-30665, CVE-2021-30689, CVE-2021-30720, CVE-2021-30734,
  CVE-2021-30744, CVE-2021-30749, CVE-2021-30795, CVE-2021-30797,
  CVE-2021-30799.
  + Changes in version 2.32.2:
  + Improve calculation of initial WebKitWebView size.
  + Fix kinetic scrolling on touchpad with async scrolling off.
  + Fix a crash on empty drag operation in X11.
  + Fix rendering on HiDPI /4k screen and scaling.
  + Handle null native surface for for surfaceless rendering.
  + Fix JavaScriptCore crash on 32-bit big endian systems.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2021-30758.
  + Changes in version 2.32.1:
  + Support building against the Musl C library.
  + Support building against ICU version 69 or newer.
  + Improve handling of Media Capture devices.
  + Improve WebAudio playback.
  + Improve video orientation handling.
  + Improve seeking support for MSE playback.
  + Improve flush support in EME decryptors.
  + Fix HTTP status codes for requests done through a custom URI
    handler.
  + Fix the Bubblewrap sandbox in certain 32-bit systems.
  + Fix inconsistencies between the WebKitWebView.is-muted property
    state and values returned by
    webkit_web_view_is_playing_audio().
  + Fix the build with ENABLE_VIDEO=OFF.
  + Fix wrong timestamps for long-lived cookies.
  + Fix UI process crash when failing to load favicons.
  + Fix several crashes and rendering issues.
  + Updated translations.
- Fix webkit2gtk3-restore-npapi.patch to install the plugin
    process.
- Disable WPE renderer: our FDO backend is now too old.</changelog>
  <changelog author="mgorse@suse.com" date="1632225600">- Update to version 2.32.4 (boo#1190701):
  + Do not append .asc extension to downloaded text/plain files.
  + Fix several crashes and rendering issues.
  +  + Security fixes: CVE-2021-30848, CVE-2021-30849, CVE-2021-30858,
  +  CVE-2021-30809, CVE-2021-30836.
- Enable LTO; disabling it is no longer necessary.</changelog>
  <changelog author="mgorse@suse.com" date="1634904000">- Add webkit2gtk3-CVE-2021-42762.patch: update seccomp rules with
  latest changes from flatpak (boo#1191937 CVE-2021-42762).</changelog>
  <changelog author="mgorse@suse.com" date="1635422400">- Update to version 2.34.1 (boo#1191937):
  + Update user agent browser versions.
  + Fix a crash with GTK &gt;= 3.24.30.
  + Fix a crash when loading videos on reddit.
  + Fix file type detection when application calls
    g_desktop_app_info_set_as_default_for_extension() passing html.
  + Security fixes: CVE-2021-42762.
  + Changes in version 2.34.0 (boo#1192063):
  + Add support for CSS Scroll Snap.
  + Add support for date and datetime-local input elements.
  + Add support for display capture.
  + Add support for ICC color management.
  * Add support color-schemes CSS property.
  + Add multi-track support to MSE media backend.
  + Add new API to handle web process unresponsiveness.
  + Add API to disable CORS on a web view for particular domains.
  + Add new API to access/modify capture devices states.
  + Add new API to configure the memory pressure handler.
  +  + Security fixes: CVE-2021-30846, CVE-2021-30851, CVE-2021-30818,
  +  CVE-2021-30823, CVE-2021-30884, CVE-2021-30888, CVE-2021-30889,
  +  CVE-2021-30897.
- Rebase no-forsed-sse.patch and webkit2gtk3-restore-npapi.patch.
- Add fix-warnings.patch: silence return-type warnings.
- Add webkit2gtk3-link-fix.patch: fix the build.
- Add webkitgtk-memfd-build-fix.patch: build fix for glibc 2.26.
- Drop webkit2gtk3-CVE-2021-42762.patch: fixed upstream.
- Add pkgconfig(lcms2) BuildRequires: new dependency.
- Pass -DUSE_SOUP2=ON to cmake.
- Compile with gcc 10. Build fails with gcc 7.</changelog>
  <changelog author="mgorse@suse.com" date="1637323200">- Increase disk space in _constraints; attempt to fix build
  failure.</changelog>
  <changelog author="mgorse@suse.com" date="1640260800">- Update to version 2.34.3 (boo#1194019):
  + Make audio tools (like mixers) display the actual name of the
    application producing sound, instead of a generic one.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2021-30887, CVE-2021-30890.
- Increase disk space in _constraints again. Attempt to fix "no
  space left on device" during clamav check.</changelog>
</package>
<package pkgid="f420073791779a425e42e72dcba839345eb87bb68cee8eb173d52037ab9c20b7" name="xerces-j2" arch="src">
  <version epoch="0" ver="2.11.0" rel="4.3.1"/>
  <changelog author="dbornkessel@suse.de" date="1178107200">- added unzip to BuildRequires</changelog>
  <changelog author="prusnak@suse.cz" date="1201089600">- removed comma between symbols in PreReq</changelog>
  <changelog author="coolo@suse.de" date="1204286400">- adding prereq for xml-apis and xml-resolver</changelog>
  <changelog author="mvyskocil@suse.cz" date="1226491200">- use gcj for build as this version is not compatible with INM Java6
- added a jpackage-utils to BuildRequires</changelog>
  <changelog author="mvyskocil@suse.cz" date="1250510400">- fixed bnc#530717: VUL-0: xerces-j2: XML parsing vulnerability
- Removed non used patch xerces-build.patch
- Fixed some rpmlint warnings and errors
- Removed javadoc postinstall scripts
- Removed %%release from subpackages requires</changelog>
  <changelog author="mvyskocil@suse.cz" date="1283428800">- ignore antlr(-java) to reduce build cycles</changelog>
  <changelog author="mvyskocil@suse.cz" date="1284379200">- remove unecessary xerces-j2-build.patch</changelog>
  <changelog author="mvyskocil@suse.cz" date="1285070400">- use antlr-bootstrap for javadoc build</changelog>
  <changelog author="mvyskocil@suse.cz" date="1300104000">- build ignore openjdk</changelog>
  <changelog author="andrea.turrini@gmail.com" date="1316174400">- fixed typos in xerces-j2.spec</changelog>
  <changelog author="mvyskocil@suse.com" date="1357905600">- removed the -boostrap package</changelog>
  <changelog author="mvyskocil@suse.com" date="1377259200">- drop javadoc packages
- drop antlr-bootstrap from BR as javadoc is not built</changelog>
  <changelog author="tchvatal@suse.com" date="1378728000">- Move from jpackage-utils to javapackage-tools</changelog>
  <changelog author="tchvatal@suse.com" date="1402056000">- Version bump to 2.11.0:
  * This release expands on Xerces' experimental support for XML
    Schema 1.1 by providing implementations for the simplified
    complex type restriction rules (also known as subsumption),
    xs:override and a few other XML Schema 1.1 features. This
    release also introduces experimental support for XML Schema
    Component Designators (SCD). It fixes several bugs which were
    present in Xerces-J 2.10.0 and also includes a few other minor
    enhancements.
  * As of this release, Xerces and Xalan now share a common
    serialization codebase. The DOM Level 3 serialization support
    which was in Xerces was migrated into the Xalan serializer and
    Xerces' native serializer was deprecated. In this release we
    also upgraded the xml-commons resolver to v1.2 (which provides
    support for OASIS XML Catalogs v1.1), introduced a few minor
    features and fixed several bugs.
- Obsoleted patches no longer needed:
  * xerces-j2-parsing.patch
  * xerces-j2-2.8.1_new_unsupported_dom_methods.patch
  * xerces-build.patch
  * xerces-j2-gcj-switch-constants-bug.patch
  * java150_build.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1405944000">- Sort out update-alternatives</changelog>
  <changelog author="tchvatal@suse.com" date="1405944001">- Fixup man page permissions</changelog>
  <changelog author="tchvatal@suse.com" date="1455192000">- Add patches for bnc#814241 upstream#1616
  * arrays-doubling.patch
  * scan-pseudo-attribute.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1495195200">- BuildIgnore more main java versions to stick to gcj</changelog>
  <changelog author="fstrba@suse.com" date="1507032000">- Added patch:
  * xerces-2_11_0-jdk7.patch
    + Dummy implementation of the getContentDocument() in common
    DOM API, in order to be able to build with jdk &gt;= 1.6
- Specify java source and target level 1.6 and don't depend on gcj</changelog>
  <changelog author="david.anes@suse.com" date="1644580800">- Fix infinite loop within Apache XercesJ xml parser (bsc#1195108,
  CVE-2022-23437)
  * Added patch xerces-j2-CVE-2022-23437.patch</changelog>
</package>
<package pkgid="41a831de2e2451c55a262ba52dee0c6b20facfd3d710f398fd9abd4af6bb3aa5" name="xerces-j2" arch="noarch">
  <version epoch="0" ver="2.12.0" rel="3.3.1"/>
  <changelog author="tchvatal@suse.com" date="1455192000">- Add patches for bnc#814241 upstream#1616
  * arrays-doubling.patch
  * scan-pseudo-attribute.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1495195200">- BuildIgnore more main java versions to stick to gcj</changelog>
  <changelog author="fstrba@suse.com" date="1507032000">- Added patch:
  * xerces-2_11_0-jdk7.patch
    + Dummy implementation of the getContentDocument() in common
    DOM API, in order to be able to build with jdk &gt;= 1.6
- Specify java source and target level 1.6 and don't depend on gcj</changelog>
  <changelog author="fstrba@suse.com" date="1544097600">- Upgrade to version 2.12.0
  * This release expands on Xerces-J's experimental support for
    XML Schema 1.1 by providing a fully compliant XML Schema 1.1
    implementation. It fixes several bugs which were present in
    Xerces-J 2.11.0 and also includes a few other enhancements and
    performance improvements.
    + add: Report all id/idref problems when validating XML against
    DTD or XML Schema.
    + add: Implemented improvements to XML Schema 1.1 CTA
    implementation and inheritable attributes.
    + update: Implemented improved error/warning message reporting
    for various XML Schema use cases.
    + update: Implemented few performance enhancements (affecting
    parsing/validation latency and memory footprint) to the
    implementation.
    + fix: Fixed minor bugs in Xerces-J's regex support in XML
    Schema &lt;pattern&gt; facet.
    + fix: Implemented various fixes to XML Schema 1.1
    assert/assertion implementation.
    + fix: Fixed possible security issue: an implementation of the
    NamedNodeMapImpl class in the JAXP component did not limit the
    amount of memory allocated when creating object instance from
    a serialized form. A specially-crafted input could cause a
    java application to use an excessive amount of memory when
    deserialized.
    + fix: Implemented minor and major fixes in certain areas, to
    XML Schema 1.0 and 1.1 implementations.
    + fix: Fixed the issue related to, XIncludeTextReader doesn't
    handle null Content Types properly.
    + fix: Fixed minor problems in the DOM (Level 3 Core)
    implementation.
    + fix: Fixed few errors related to Xerces-J's build component.
    + fix: Solved a minor bug in SoftReferenceSymbolTable
    implementation component.
    + fix: Fixed various bugs and made various improvements.
- Removed patches:
  * arrays-doubling.patch
  * scan-pseudo-attribute.patch
    + integrated upstream
- Added patches:
  * xerces-j2-build.patch
    + Don't use the bundled xml-apis, but depend on an existing
    package
    + Don't use custom taglets and ant tasks
- Do not bundle the xml-apis and xml-resolver and stop using
  alternatives
- Install as a maven artifact</changelog>
  <changelog author="jengelh@inai.de" date="1544529600">- Remove rhetorics from description, and then compact its verbose
  grammar.
- Do away with xargs when find has some better options.</changelog>
  <changelog author="fstrba@suse.com" date="1549022400">- Added patch:
  * xerces-j2-manifest.patch
  - add OSGi metadata required by Eclipse</changelog>
  <changelog author="fstrba@suse.com" date="1549368000">- BuildIgnore oneself to avoid unresolved cycle</changelog>
  <changelog author="fstrba@suse.com" date="1554811200">- BuildIgnore another provider of this package to avoid unresolved
  cycle</changelog>
  <changelog author="fstrba@suse.com" date="1555502400">- Remove bogus dependency</changelog>
  <changelog author="david.anes@suse.com" date="1644580800">- Fix infinite loop within Apache XercesJ xml parser (bsc#1195108,
  CVE-2022-23437)
  * Added patch xerces-j2-CVE-2022-23437.patch</changelog>
</package>
<package pkgid="04f50f7fc40703e89aa76a0e22c4a847ffbbee30bbbb787616eafed8adc5d72a" name="xerces-j2" arch="src">
  <version epoch="0" ver="2.12.0" rel="3.3.1"/>
  <changelog author="mvyskocil@suse.cz" date="1284379200">- remove unecessary xerces-j2-build.patch</changelog>
  <changelog author="mvyskocil@suse.cz" date="1285070400">- use antlr-bootstrap for javadoc build</changelog>
  <changelog author="mvyskocil@suse.cz" date="1300104000">- build ignore openjdk</changelog>
  <changelog author="andrea.turrini@gmail.com" date="1316174400">- fixed typos in xerces-j2.spec</changelog>
  <changelog author="mvyskocil@suse.com" date="1357905600">- removed the -boostrap package</changelog>
  <changelog author="mvyskocil@suse.com" date="1377259200">- drop javadoc packages
- drop antlr-bootstrap from BR as javadoc is not built</changelog>
  <changelog author="tchvatal@suse.com" date="1378728000">- Move from jpackage-utils to javapackage-tools</changelog>
  <changelog author="tchvatal@suse.com" date="1402056000">- Version bump to 2.11.0:
  * This release expands on Xerces' experimental support for XML
    Schema 1.1 by providing implementations for the simplified
    complex type restriction rules (also known as subsumption),
    xs:override and a few other XML Schema 1.1 features. This
    release also introduces experimental support for XML Schema
    Component Designators (SCD). It fixes several bugs which were
    present in Xerces-J 2.10.0 and also includes a few other minor
    enhancements.
  * As of this release, Xerces and Xalan now share a common
    serialization codebase. The DOM Level 3 serialization support
    which was in Xerces was migrated into the Xalan serializer and
    Xerces' native serializer was deprecated. In this release we
    also upgraded the xml-commons resolver to v1.2 (which provides
    support for OASIS XML Catalogs v1.1), introduced a few minor
    features and fixed several bugs.
- Obsoleted patches no longer needed:
  * xerces-j2-parsing.patch
  * xerces-j2-2.8.1_new_unsupported_dom_methods.patch
  * xerces-build.patch
  * xerces-j2-gcj-switch-constants-bug.patch
  * java150_build.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1405944000">- Sort out update-alternatives</changelog>
  <changelog author="tchvatal@suse.com" date="1405944001">- Fixup man page permissions</changelog>
  <changelog author="tchvatal@suse.com" date="1455192000">- Add patches for bnc#814241 upstream#1616
  * arrays-doubling.patch
  * scan-pseudo-attribute.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1495195200">- BuildIgnore more main java versions to stick to gcj</changelog>
  <changelog author="fstrba@suse.com" date="1507032000">- Added patch:
  * xerces-2_11_0-jdk7.patch
    + Dummy implementation of the getContentDocument() in common
    DOM API, in order to be able to build with jdk &gt;= 1.6
- Specify java source and target level 1.6 and don't depend on gcj</changelog>
  <changelog author="fstrba@suse.com" date="1544097600">- Upgrade to version 2.12.0
  * This release expands on Xerces-J's experimental support for
    XML Schema 1.1 by providing a fully compliant XML Schema 1.1
    implementation. It fixes several bugs which were present in
    Xerces-J 2.11.0 and also includes a few other enhancements and
    performance improvements.
    + add: Report all id/idref problems when validating XML against
    DTD or XML Schema.
    + add: Implemented improvements to XML Schema 1.1 CTA
    implementation and inheritable attributes.
    + update: Implemented improved error/warning message reporting
    for various XML Schema use cases.
    + update: Implemented few performance enhancements (affecting
    parsing/validation latency and memory footprint) to the
    implementation.
    + fix: Fixed minor bugs in Xerces-J's regex support in XML
    Schema &lt;pattern&gt; facet.
    + fix: Implemented various fixes to XML Schema 1.1
    assert/assertion implementation.
    + fix: Fixed possible security issue: an implementation of the
    NamedNodeMapImpl class in the JAXP component did not limit the
    amount of memory allocated when creating object instance from
    a serialized form. A specially-crafted input could cause a
    java application to use an excessive amount of memory when
    deserialized.
    + fix: Implemented minor and major fixes in certain areas, to
    XML Schema 1.0 and 1.1 implementations.
    + fix: Fixed the issue related to, XIncludeTextReader doesn't
    handle null Content Types properly.
    + fix: Fixed minor problems in the DOM (Level 3 Core)
    implementation.
    + fix: Fixed few errors related to Xerces-J's build component.
    + fix: Solved a minor bug in SoftReferenceSymbolTable
    implementation component.
    + fix: Fixed various bugs and made various improvements.
- Removed patches:
  * arrays-doubling.patch
  * scan-pseudo-attribute.patch
    + integrated upstream
- Added patches:
  * xerces-j2-build.patch
    + Don't use the bundled xml-apis, but depend on an existing
    package
    + Don't use custom taglets and ant tasks
- Do not bundle the xml-apis and xml-resolver and stop using
  alternatives
- Install as a maven artifact</changelog>
  <changelog author="jengelh@inai.de" date="1544529600">- Remove rhetorics from description, and then compact its verbose
  grammar.
- Do away with xargs when find has some better options.</changelog>
  <changelog author="fstrba@suse.com" date="1549022400">- Added patch:
  * xerces-j2-manifest.patch
  - add OSGi metadata required by Eclipse</changelog>
  <changelog author="fstrba@suse.com" date="1549368000">- BuildIgnore oneself to avoid unresolved cycle</changelog>
  <changelog author="fstrba@suse.com" date="1554811200">- BuildIgnore another provider of this package to avoid unresolved
  cycle</changelog>
  <changelog author="fstrba@suse.com" date="1555502400">- Remove bogus dependency</changelog>
  <changelog author="david.anes@suse.com" date="1644580800">- Fix infinite loop within Apache XercesJ xml parser (bsc#1195108,
  CVE-2022-23437)
  * Added patch xerces-j2-CVE-2022-23437.patch</changelog>
</package>
<package pkgid="2d588e08b3fe1bbf087de5da2b81a784dffc89a55f16029912cf549f4bfb2375" name="xerces-j2-demo" arch="noarch">
  <version epoch="0" ver="2.12.0" rel="3.3.1"/>
  <changelog author="tchvatal@suse.com" date="1455192000">- Add patches for bnc#814241 upstream#1616
  * arrays-doubling.patch
  * scan-pseudo-attribute.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1495195200">- BuildIgnore more main java versions to stick to gcj</changelog>
  <changelog author="fstrba@suse.com" date="1507032000">- Added patch:
  * xerces-2_11_0-jdk7.patch
    + Dummy implementation of the getContentDocument() in common
    DOM API, in order to be able to build with jdk &gt;= 1.6
- Specify java source and target level 1.6 and don't depend on gcj</changelog>
  <changelog author="fstrba@suse.com" date="1544097600">- Upgrade to version 2.12.0
  * This release expands on Xerces-J's experimental support for
    XML Schema 1.1 by providing a fully compliant XML Schema 1.1
    implementation. It fixes several bugs which were present in
    Xerces-J 2.11.0 and also includes a few other enhancements and
    performance improvements.
    + add: Report all id/idref problems when validating XML against
    DTD or XML Schema.
    + add: Implemented improvements to XML Schema 1.1 CTA
    implementation and inheritable attributes.
    + update: Implemented improved error/warning message reporting
    for various XML Schema use cases.
    + update: Implemented few performance enhancements (affecting
    parsing/validation latency and memory footprint) to the
    implementation.
    + fix: Fixed minor bugs in Xerces-J's regex support in XML
    Schema &lt;pattern&gt; facet.
    + fix: Implemented various fixes to XML Schema 1.1
    assert/assertion implementation.
    + fix: Fixed possible security issue: an implementation of the
    NamedNodeMapImpl class in the JAXP component did not limit the
    amount of memory allocated when creating object instance from
    a serialized form. A specially-crafted input could cause a
    java application to use an excessive amount of memory when
    deserialized.
    + fix: Implemented minor and major fixes in certain areas, to
    XML Schema 1.0 and 1.1 implementations.
    + fix: Fixed the issue related to, XIncludeTextReader doesn't
    handle null Content Types properly.
    + fix: Fixed minor problems in the DOM (Level 3 Core)
    implementation.
    + fix: Fixed few errors related to Xerces-J's build component.
    + fix: Solved a minor bug in SoftReferenceSymbolTable
    implementation component.
    + fix: Fixed various bugs and made various improvements.
- Removed patches:
  * arrays-doubling.patch
  * scan-pseudo-attribute.patch
    + integrated upstream
- Added patches:
  * xerces-j2-build.patch
    + Don't use the bundled xml-apis, but depend on an existing
    package
    + Don't use custom taglets and ant tasks
- Do not bundle the xml-apis and xml-resolver and stop using
  alternatives
- Install as a maven artifact</changelog>
  <changelog author="jengelh@inai.de" date="1544529600">- Remove rhetorics from description, and then compact its verbose
  grammar.
- Do away with xargs when find has some better options.</changelog>
  <changelog author="fstrba@suse.com" date="1549022400">- Added patch:
  * xerces-j2-manifest.patch
  - add OSGi metadata required by Eclipse</changelog>
  <changelog author="fstrba@suse.com" date="1549368000">- BuildIgnore oneself to avoid unresolved cycle</changelog>
  <changelog author="fstrba@suse.com" date="1554811200">- BuildIgnore another provider of this package to avoid unresolved
  cycle</changelog>
  <changelog author="fstrba@suse.com" date="1555502400">- Remove bogus dependency</changelog>
  <changelog author="david.anes@suse.com" date="1644580800">- Fix infinite loop within Apache XercesJ xml parser (bsc#1195108,
  CVE-2022-23437)
  * Added patch xerces-j2-CVE-2022-23437.patch</changelog>
</package>
<package pkgid="f6254a45c67baa8aab29a6135bbc68fbecc63dfb23054076967234507a71866f" name="xerces-j2-javadoc" arch="noarch">
  <version epoch="0" ver="2.12.0" rel="3.3.1"/>
  <changelog author="tchvatal@suse.com" date="1455192000">- Add patches for bnc#814241 upstream#1616
  * arrays-doubling.patch
  * scan-pseudo-attribute.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1495195200">- BuildIgnore more main java versions to stick to gcj</changelog>
  <changelog author="fstrba@suse.com" date="1507032000">- Added patch:
  * xerces-2_11_0-jdk7.patch
    + Dummy implementation of the getContentDocument() in common
    DOM API, in order to be able to build with jdk &gt;= 1.6
- Specify java source and target level 1.6 and don't depend on gcj</changelog>
  <changelog author="fstrba@suse.com" date="1544097600">- Upgrade to version 2.12.0
  * This release expands on Xerces-J's experimental support for
    XML Schema 1.1 by providing a fully compliant XML Schema 1.1
    implementation. It fixes several bugs which were present in
    Xerces-J 2.11.0 and also includes a few other enhancements and
    performance improvements.
    + add: Report all id/idref problems when validating XML against
    DTD or XML Schema.
    + add: Implemented improvements to XML Schema 1.1 CTA
    implementation and inheritable attributes.
    + update: Implemented improved error/warning message reporting
    for various XML Schema use cases.
    + update: Implemented few performance enhancements (affecting
    parsing/validation latency and memory footprint) to the
    implementation.
    + fix: Fixed minor bugs in Xerces-J's regex support in XML
    Schema &lt;pattern&gt; facet.
    + fix: Implemented various fixes to XML Schema 1.1
    assert/assertion implementation.
    + fix: Fixed possible security issue: an implementation of the
    NamedNodeMapImpl class in the JAXP component did not limit the
    amount of memory allocated when creating object instance from
    a serialized form. A specially-crafted input could cause a
    java application to use an excessive amount of memory when
    deserialized.
    + fix: Implemented minor and major fixes in certain areas, to
    XML Schema 1.0 and 1.1 implementations.
    + fix: Fixed the issue related to, XIncludeTextReader doesn't
    handle null Content Types properly.
    + fix: Fixed minor problems in the DOM (Level 3 Core)
    implementation.
    + fix: Fixed few errors related to Xerces-J's build component.
    + fix: Solved a minor bug in SoftReferenceSymbolTable
    implementation component.
    + fix: Fixed various bugs and made various improvements.
- Removed patches:
  * arrays-doubling.patch
  * scan-pseudo-attribute.patch
    + integrated upstream
- Added patches:
  * xerces-j2-build.patch
    + Don't use the bundled xml-apis, but depend on an existing
    package
    + Don't use custom taglets and ant tasks
- Do not bundle the xml-apis and xml-resolver and stop using
  alternatives
- Install as a maven artifact</changelog>
  <changelog author="jengelh@inai.de" date="1544529600">- Remove rhetorics from description, and then compact its verbose
  grammar.
- Do away with xargs when find has some better options.</changelog>
  <changelog author="fstrba@suse.com" date="1549022400">- Added patch:
  * xerces-j2-manifest.patch
  - add OSGi metadata required by Eclipse</changelog>
  <changelog author="fstrba@suse.com" date="1549368000">- BuildIgnore oneself to avoid unresolved cycle</changelog>
  <changelog author="fstrba@suse.com" date="1554811200">- BuildIgnore another provider of this package to avoid unresolved
  cycle</changelog>
  <changelog author="fstrba@suse.com" date="1555502400">- Remove bogus dependency</changelog>
  <changelog author="david.anes@suse.com" date="1644580800">- Fix infinite loop within Apache XercesJ xml parser (bsc#1195108,
  CVE-2022-23437)
  * Added patch xerces-j2-CVE-2022-23437.patch</changelog>
</package>
<package pkgid="4475a59da35062dc82dd9de22b8b7798cc46f206fc0963cf20ff920fd6215db0" name="xerces-j2-scripts" arch="noarch">
  <version epoch="0" ver="2.11.0" rel="4.3.1"/>
  <changelog author="mvyskocil@suse.com" date="1357905600">- removed the -boostrap package</changelog>
  <changelog author="mvyskocil@suse.com" date="1377259200">- drop javadoc packages
- drop antlr-bootstrap from BR as javadoc is not built</changelog>
  <changelog author="tchvatal@suse.com" date="1378728000">- Move from jpackage-utils to javapackage-tools</changelog>
  <changelog author="tchvatal@suse.com" date="1402056000">- Version bump to 2.11.0:
  * This release expands on Xerces' experimental support for XML
    Schema 1.1 by providing implementations for the simplified
    complex type restriction rules (also known as subsumption),
    xs:override and a few other XML Schema 1.1 features. This
    release also introduces experimental support for XML Schema
    Component Designators (SCD). It fixes several bugs which were
    present in Xerces-J 2.10.0 and also includes a few other minor
    enhancements.
  * As of this release, Xerces and Xalan now share a common
    serialization codebase. The DOM Level 3 serialization support
    which was in Xerces was migrated into the Xalan serializer and
    Xerces' native serializer was deprecated. In this release we
    also upgraded the xml-commons resolver to v1.2 (which provides
    support for OASIS XML Catalogs v1.1), introduced a few minor
    features and fixed several bugs.
- Obsoleted patches no longer needed:
  * xerces-j2-parsing.patch
  * xerces-j2-2.8.1_new_unsupported_dom_methods.patch
  * xerces-build.patch
  * xerces-j2-gcj-switch-constants-bug.patch
  * java150_build.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1405944000">- Sort out update-alternatives</changelog>
  <changelog author="tchvatal@suse.com" date="1405944001">- Fixup man page permissions</changelog>
  <changelog author="tchvatal@suse.com" date="1455192000">- Add patches for bnc#814241 upstream#1616
  * arrays-doubling.patch
  * scan-pseudo-attribute.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1495195200">- BuildIgnore more main java versions to stick to gcj</changelog>
  <changelog author="fstrba@suse.com" date="1507032000">- Added patch:
  * xerces-2_11_0-jdk7.patch
    + Dummy implementation of the getContentDocument() in common
    DOM API, in order to be able to build with jdk &gt;= 1.6
- Specify java source and target level 1.6 and don't depend on gcj</changelog>
  <changelog author="david.anes@suse.com" date="1644580800">- Fix infinite loop within Apache XercesJ xml parser (bsc#1195108,
  CVE-2022-23437)
  * Added patch xerces-j2-CVE-2022-23437.patch</changelog>
</package>
<package pkgid="be1fbf819ab45b33713b85f9d64e2229ece46462c6dba069d6afcbcaedae95dc" name="xerces-j2-xml-apis" arch="noarch">
  <version epoch="0" ver="2.11.0" rel="4.3.1"/>
  <changelog author="mvyskocil@suse.com" date="1357905600">- removed the -boostrap package</changelog>
  <changelog author="mvyskocil@suse.com" date="1377259200">- drop javadoc packages
- drop antlr-bootstrap from BR as javadoc is not built</changelog>
  <changelog author="tchvatal@suse.com" date="1378728000">- Move from jpackage-utils to javapackage-tools</changelog>
  <changelog author="tchvatal@suse.com" date="1402056000">- Version bump to 2.11.0:
  * This release expands on Xerces' experimental support for XML
    Schema 1.1 by providing implementations for the simplified
    complex type restriction rules (also known as subsumption),
    xs:override and a few other XML Schema 1.1 features. This
    release also introduces experimental support for XML Schema
    Component Designators (SCD). It fixes several bugs which were
    present in Xerces-J 2.10.0 and also includes a few other minor
    enhancements.
  * As of this release, Xerces and Xalan now share a common
    serialization codebase. The DOM Level 3 serialization support
    which was in Xerces was migrated into the Xalan serializer and
    Xerces' native serializer was deprecated. In this release we
    also upgraded the xml-commons resolver to v1.2 (which provides
    support for OASIS XML Catalogs v1.1), introduced a few minor
    features and fixed several bugs.
- Obsoleted patches no longer needed:
  * xerces-j2-parsing.patch
  * xerces-j2-2.8.1_new_unsupported_dom_methods.patch
  * xerces-build.patch
  * xerces-j2-gcj-switch-constants-bug.patch
  * java150_build.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1405944000">- Sort out update-alternatives</changelog>
  <changelog author="tchvatal@suse.com" date="1405944001">- Fixup man page permissions</changelog>
  <changelog author="tchvatal@suse.com" date="1455192000">- Add patches for bnc#814241 upstream#1616
  * arrays-doubling.patch
  * scan-pseudo-attribute.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1495195200">- BuildIgnore more main java versions to stick to gcj</changelog>
  <changelog author="fstrba@suse.com" date="1507032000">- Added patch:
  * xerces-2_11_0-jdk7.patch
    + Dummy implementation of the getContentDocument() in common
    DOM API, in order to be able to build with jdk &gt;= 1.6
- Specify java source and target level 1.6 and don't depend on gcj</changelog>
  <changelog author="david.anes@suse.com" date="1644580800">- Fix infinite loop within Apache XercesJ xml parser (bsc#1195108,
  CVE-2022-23437)
  * Added patch xerces-j2-CVE-2022-23437.patch</changelog>
</package>
<package pkgid="abb4b5ede488a0441df2e04f1787e2ffdab7a5e4703ef92eb2c3c2da1e8171a5" name="xerces-j2-xml-resolver" arch="noarch">
  <version epoch="0" ver="2.11.0" rel="4.3.1"/>
  <changelog author="mvyskocil@suse.com" date="1357905600">- removed the -boostrap package</changelog>
  <changelog author="mvyskocil@suse.com" date="1377259200">- drop javadoc packages
- drop antlr-bootstrap from BR as javadoc is not built</changelog>
  <changelog author="tchvatal@suse.com" date="1378728000">- Move from jpackage-utils to javapackage-tools</changelog>
  <changelog author="tchvatal@suse.com" date="1402056000">- Version bump to 2.11.0:
  * This release expands on Xerces' experimental support for XML
    Schema 1.1 by providing implementations for the simplified
    complex type restriction rules (also known as subsumption),
    xs:override and a few other XML Schema 1.1 features. This
    release also introduces experimental support for XML Schema
    Component Designators (SCD). It fixes several bugs which were
    present in Xerces-J 2.10.0 and also includes a few other minor
    enhancements.
  * As of this release, Xerces and Xalan now share a common
    serialization codebase. The DOM Level 3 serialization support
    which was in Xerces was migrated into the Xalan serializer and
    Xerces' native serializer was deprecated. In this release we
    also upgraded the xml-commons resolver to v1.2 (which provides
    support for OASIS XML Catalogs v1.1), introduced a few minor
    features and fixed several bugs.
- Obsoleted patches no longer needed:
  * xerces-j2-parsing.patch
  * xerces-j2-2.8.1_new_unsupported_dom_methods.patch
  * xerces-build.patch
  * xerces-j2-gcj-switch-constants-bug.patch
  * java150_build.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1405944000">- Sort out update-alternatives</changelog>
  <changelog author="tchvatal@suse.com" date="1405944001">- Fixup man page permissions</changelog>
  <changelog author="tchvatal@suse.com" date="1455192000">- Add patches for bnc#814241 upstream#1616
  * arrays-doubling.patch
  * scan-pseudo-attribute.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1495195200">- BuildIgnore more main java versions to stick to gcj</changelog>
  <changelog author="fstrba@suse.com" date="1507032000">- Added patch:
  * xerces-2_11_0-jdk7.patch
    + Dummy implementation of the getContentDocument() in common
    DOM API, in order to be able to build with jdk &gt;= 1.6
- Specify java source and target level 1.6 and don't depend on gcj</changelog>
  <changelog author="david.anes@suse.com" date="1644580800">- Fix infinite loop within Apache XercesJ xml parser (bsc#1195108,
  CVE-2022-23437)
  * Added patch xerces-j2-CVE-2022-23437.patch</changelog>
</package>
<package pkgid="2971b35cb5c978c9e397fb95bbfa3eae46992b689e7a74fa4404fbbfad6ce89d" name="xmltooling" arch="src">
  <version epoch="0" ver="1.6.4" rel="3.6.1"/>
  <changelog author="kstreitova@suse.com" date="1437739200">- initial revision</changelog>
  <changelog author="kstreitova@suse.com" date="1437998400">- use spec-cleaner
- package cleaning
- add xmltooling-1.5.5-doxygen_timestamp.patch to remove timestamps
  in a documentation generated by Doxygen and avoid RPMLINT warnings
  (file-contains-date-and-time).</changelog>
  <changelog author="kstreitova@suse.com" date="1438257600">- adjust Summary in the specfile
- remove unused conditionals</changelog>
  <changelog author="mpluskal@suse.com" date="1438776000">- Add gpg signature</changelog>
  <changelog author="kstreitova@suse.com" date="1441627200">- update to xmltooling 1.5.6
  * [CPPXT-105] - PKIX revocation checking calls OpenSSL's
    X509_verify_cert in an unsupported way (breaks with OpenSSL
    1.0.1p/1.0.2d and later)</changelog>
  <changelog author="adam.majer@suse.de" date="1486036800">- use individual libboost-*-devel packages instead of boost-devel</changelog>
  <changelog author="jengelh@inai.de" date="1486814400">- Update RPM groups</changelog>
  <changelog author="kstreitova@suse.com" date="1505995200">- update to 1.6.0
  * [CPPXT-108] - Potential nullpointer dereference in
    InlineCredential::getKeyInfo
  * [CPPXT-109] - XSECCryptoX509CRL::loadX509CRLPEM() can read past
    unterminated buffer
- update soname for libxmltooling library from 6 to 7
- add version for boost-devel buildrequires
- add %{opensaml_version} macro
- run spec-cleaner</changelog>
  <changelog author="vcizek@suse.com" date="1510228800">- add upstream patches to support building with openssl 1.1 (bsc#1067419)
  * 0023-CPPXT-110-OpenSSL-1.1-removes-BIO_s_file_internal.patch
  * 0011-CPPXT-110-Clean-up-some-collateral-damage-from-previ.patch
  * 0005-CPPXT-110-OpenSSL-1.1-removes-BIO_s_file_internal.patch
  * 0026-CPPXT-110-OpenSSL-1.1-library-names-have-changes.patch
  * 0027-Commit-a-xmltoolingtest.vcxproj.user.patch
  * 0010-CPPXT-110-Start-to-add-tests-to-exercise-XSEC-paths-.patch
  * 0003-CPPXT-110-OpenSSL-1.1-makes-DSA-opaque.patch
  * 0002-CPPXT-110-Add-new-OpenSSL-support-files-to-Unix-buil.patch
  * 0012-CPPXT-110-Add-test-path-for-RSA-loadXXXBigNums.patch
  * 0009-CPPXT-110-Start-to-add-tests-to-exercise-XSEC-paths-.patch
  * 0020-CPPXT-110-Add-new-OpenSSL-support-files-to-Unix-buil.patch
  * 0024-CPPXT-110-OpenSSL-1.1-internalizes-locking.patch
  * 0006-CPPXT-110-OpenSSL-1.1-internalizes-locking.patch
  * 0028-CPPXT-110-OpenSSL-1.1-OpenSSL1.1-changes-to-newly-in.patch
  * 0025-CPPXT-110-OpenSSL-1.1-Fix-some-signatures-and-names.patch
  * 0016-CPPXT-110-Round-trip-verify-test-for-OpenSSLCryptoKe.patch
  * 0021-CPPXT-110-OpenSSL-1.1-makes-DSA-opaque.patch
  * 0007-Unwind-previous.patch
  * 0013-CPPXT-110-Used-Named-curves-for-EC-testing.patch
  * 0030-CPPXT-110-OpenSSL-1.1-New-build-mechanisms.patch
  * 0031-Missed-file-for-OpenSSL1.1-support.patch
  * 0029-CPPXT-110-OpenSSL-1.1-Cleanup-tests.patch
  * 0022-CPPXT-110-OpenSSL-1.1-makes-EVP_PKEY-opaque.patch
  * 0017-CPPXT-110-Inverted-parameters-to-TSM_ASSERT-in-DSA-t.patch
  * 0008-CPPXT-110-Checkin-prototypical-vcxproj.user-file-for.patch
  * 0019-CPPXT-110-OpenSSL-1.1-makes-X509_STORE_CTX-and-X509_.patch
  * 0001-CPPXT-110-OpenSSL-1.1-makes-X509_STORE_CTX-and-X509_.patch
  * 0018-CPPXT-110-Test-for-OpenSSL-part-of-ExplicitKeyTrustE.patch
  * 0004-CPPXT-110-OpenSSL-1.1-makes-EVP_PKEY-opaque.patch
  * 0015-CPPXT-110-test-for-code-changes-to-OpenSSLCryptoKeyE.patch
  * 0014-CPPXT-110-test-for-code-changes-to-OpenSSLCryptoKeyD.patch</changelog>
  <changelog author="kstreitova@suse.com" date="1510747200">- update to 1.6.2
  * 1.6.2:
    [CPPXT-124] - Regression caused by CPPXT-116
  * 1.6.1:
    [CPPXT-107] - Issues compiling with Boost and VC15</changelog>
  <changelog author="kstreitova@suse.com" date="1516017600">- update to 1.6.3
  * [CPPXT-127] - DTD-defined entities can be added to XML without
    breaking signature [CVE-2018-0486], [bsc#1075975]
- 'Url' -&gt; 'URL'</changelog>
  <changelog author="kstreitova@suse.com" date="1519819200">- update to 1.6.4
  * [CPPXT-128] - Additional nodes can be added to XML without
    breaking signature [bsc#1083247] [CVE-2018-0489]</changelog>
  <changelog author="kstreitova@suse.com" date="1553169600">- add xmltooling-1.6.4-CVE-2019-9628.patch to fix a security bug
  where XML parser class fails to trap exceptions on malformed XML
  declaration [bsc#1129537] [CVE-2019-9628]</changelog>
  <changelog author="kstreitova@suse.com" date="1591358400">- add xmltooling-1.6.4-fix_build_openssl_111.patch to fix build
  with openSSL 1.1.1 [bsc#1172351]</changelog>
</package>
<package pkgid="3d1665c106da4d2c03def3ae5465b772949c3c7b12431d9183587f806d1a41dc" name="xorg-x11-server" arch="src">
  <version epoch="0" ver="1.20.3" rel="22.5.42.1"/>
  <changelog author="sndirsch@suse.com" date="1567425600">- added patches required for NVIDIA's PRIME render offload support,
  which is available since release 435.xx (jira#SLE-8470)
  0001-xsync-Add-resource-inside-of-SyncCreate-export-SyncC.patch,
  0002-GLX-Add-a-per-client-vendor-mapping.patch,
  0003-GLX-Use-the-sending-client-for-looking-up-XID-s.patch,
  0004-GLX-Add-a-function-to-change-a-clients-vendor-list.patch,
  0005-GLX-Set-GlxServerExports-major-minor-Version.patch</changelog>
  <changelog author="fcrozat@suse.com" date="1575028800">- Build XWayland also on s390.</changelog>
  <changelog author="sndirsch@suse.com" date="1582804800">- specfile: reenabled XFree86-VidModeExtension (boo#1164020)</changelog>
  <changelog author="sndirsch@suse.com" date="1588766400">- provide/obsoletes cirrus and ast usermode driver also on openSUSE
  (jsc#SLE-12127)</changelog>
  <changelog author="sndirsch@suse.com" date="1596110400">- U_FixForZDI-11426.patch
  * Leak of uninitialized heap memory form the X server to clients
    on pixmap allocation (ZDI-CAN-11426, CVE-2020-14347, bsc#1174633)</changelog>
  <changelog author="tiwai@suse.de" date="1596628800">- u_xkb-CVE-2020-14345.patch:
  * Fix XKB out-of-bounds access privilege escalation vulnerability
    (CVE-2020-14345, bsc#1174635, ZDI-CAN-11428)
- u_xichangehierarchy-CVE-2020-14346.patch:
  * Fix XIChangeHierarchy integer underflow privilege escalation
    vulnerability (CVE-2020-14346, bsc#1174638, ZDI-CAN-11429)</changelog>
  <changelog author="sndirsch@suse.com" date="1598356800">- U_0003-Fix-XkbSelectEvents-integer-underflow.patch
  * Fix XkbSelectEvents() integer underflow
    [CVE-2020-14361 / ZDI-CAN 11573, boo#1174910]
- U_0004-Fix-XRecordRegisterClients-Integer-underflow.patch
  * Fix XRecordRegisterClients() Integer underflow
    [CVE-2020-14362 / ZDI-CAN-11574, boo#1174913]</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- U_present-wnmd-Fix-use-after-free-on-CRTC-removal.patch
  * fix crash in XWayland when undocking laptop (bsc#1176015)
- U_present-wnmd-Relax-assertion-on-CRTC-on-abort_vblank.patch
  * fix for Xwayland abort in Present code (bsc#1176015)
- U_xwayland-Avoid-a-crash-on-pointer-enter-with-a-grab.patch,
  U_xwayland-Check-status-in-GBM-pixmap-creation.patch,
  U_xwayland-Do-not-free-a-NULL-GBM-bo.patch,
  U_xwayland-Update-screen-pixmap-on-output-resize.patch
  * various xwayland crashes fixes from 1.20 branch (bsc#1176015)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- U_xkbsetdeviceinfo.patch (bsc#1177596, ZDI-CAN-11839/CVE-2020-25712)
  * fix for Heap-based Buffer Overflow Privilege Escalation
    Vulnerability</changelog>
  <changelog author="sndirsch@suse.com" date="1605787200">- update U_xkbsetdeviceinfo.patch
  * fixed broken patch (bsc#1177596, comment#18, ZDI-CAN-11839/CVE-2020-25712)</changelog>
  <changelog author="sndirsch@suse.com" date="1605787201">- u_xkb-CVE-2020-14360.patch
  * Avoid out of bounds memory accesses on too short request
    (ZDI-CAN-11572/CVE-2020-14360, bsc#1174908)</changelog>
  <changelog author="dmueller@suse.com" date="1614600000">- add U_hw_do-not-include-sys-io-with-glibc.patch (bsc#1182884)</changelog>
  <changelog author="sndirsch@suse.com" date="1614859200">- U_modesetting-Fix-broken-manpage-in-autoconf-build.patch
  * modesetting: Fix broken manpage in autoconf build (boo#1182510)</changelog>
  <changelog author="sndirsch@suse.com" date="1618228800">- U_Fix-XChangeFeedbackControl-request-underflow.patch
  * Fix XChangeFeedbackControl() request underflow (CVE-2021-3472,
    ZDI-CAN-1259, bsc#1180128)</changelog>
  <changelog author="yu.daike@suse.com" date="1618401600">- U_xwayland-Do-not-crash-if-gbm_bo_create-fails.patch
  * xwayland: Do not crash if gbm_bo_create() fails (boo#1184072) (boo#1184543)</changelog>
  <changelog author="sndirsch@suse.com" date="1618401601">- U_build-glx-Lower-gl-version-to-work-with-libglvnd.patch,
  U_meson-Fix-another-reference-to-gl-9.2.0.patch
  * fix build on sle15-sp3 with updated libglvnd/Mesa and their
    new pkgconfig files
    (https://gitlab.freedesktop.org/xorg/xserver/-/issues/893)</changelog>
  <changelog author="yu.daike@suse.com" date="1621339200">- U_xwayland-glamor-gbm-Handle-DRM_FORMAT_MOD_INVALID-gracefully.patch
  * xwayland: Fix invisible window produced by Xwayland
    (boo#1186092, boo#1184906)</changelog>
  <changelog author="patrik.jakobsson@suse.com" date="1623672000">- u_modesetting-Fix-dirty-updates-for-sw-rotation.patch
  * Fixes broken rotation support for DRM drivers without hardware
    rotation support or direct vram access (bsc#1182955)</changelog>
  <changelog author="sndirsch@suse.com" date="1637841600">- U_rendercompositeglyphs.patch
  * X.Org Server SProcRenderCompositeGlyphs Out-Of-Bounds Access
    Privilege Escalation Vulnerability [CVE-2021-4008, ZDI-CAN-14192]
    (boo#1193030)</changelog>
  <changelog author="sndirsch@suse.com" date="1639483200">- U_xfixes-Fix-out-of-bounds-access-in-ProcXFixesCreateP.patch
  * CVE-2021-4009/ZDI-CAN-14950 (bsc#1190487)
    The handler for the CreatePointerBarrier request of the XFixes
    extension does not properly validate the request length leading
    to out of bounds memory write.
- U_Xext-Fix-out-of-bounds-access-in-SProcScreenSaverSus.patch
  * CVE-2021-4010/ZDI-CAN-14951 (bsc#1190488)
    The handler for the Suspend request of the Screen Saver extension
    does not properly validate the request length leading to out of
    bounds memory write.
- U_record-Fix-out-of-bounds-access-in-SwapCreateRegiste.patch
  * CVE-2021-4011/ZDI-CAN-14952 (bsc#1190489)
    The handlers for the RecordCreateContext and RecordRegisterClients
    requests of the Record extension do not properly validate the request
    length leading to out of bounds memory write.</changelog>
</package>
<package pkgid="06d5043ebcdbe6d15923833666ae2722ee02cb58b1d36022661d17c4a5868d57" name="xorg-x11-server-wayland" arch="aarch64">
  <version epoch="0" ver="1.20.3" rel="22.5.42.1"/>
  <changelog author="sndirsch@suse.com" date="1567425600">- added patches required for NVIDIA's PRIME render offload support,
  which is available since release 435.xx (jira#SLE-8470)
  0001-xsync-Add-resource-inside-of-SyncCreate-export-SyncC.patch,
  0002-GLX-Add-a-per-client-vendor-mapping.patch,
  0003-GLX-Use-the-sending-client-for-looking-up-XID-s.patch,
  0004-GLX-Add-a-function-to-change-a-clients-vendor-list.patch,
  0005-GLX-Set-GlxServerExports-major-minor-Version.patch</changelog>
  <changelog author="fcrozat@suse.com" date="1575028800">- Build XWayland also on s390.</changelog>
  <changelog author="sndirsch@suse.com" date="1582804800">- specfile: reenabled XFree86-VidModeExtension (boo#1164020)</changelog>
  <changelog author="sndirsch@suse.com" date="1588766400">- provide/obsoletes cirrus and ast usermode driver also on openSUSE
  (jsc#SLE-12127)</changelog>
  <changelog author="sndirsch@suse.com" date="1596110400">- U_FixForZDI-11426.patch
  * Leak of uninitialized heap memory form the X server to clients
    on pixmap allocation (ZDI-CAN-11426, CVE-2020-14347, bsc#1174633)</changelog>
  <changelog author="tiwai@suse.de" date="1596628800">- u_xkb-CVE-2020-14345.patch:
  * Fix XKB out-of-bounds access privilege escalation vulnerability
    (CVE-2020-14345, bsc#1174635, ZDI-CAN-11428)
- u_xichangehierarchy-CVE-2020-14346.patch:
  * Fix XIChangeHierarchy integer underflow privilege escalation
    vulnerability (CVE-2020-14346, bsc#1174638, ZDI-CAN-11429)</changelog>
  <changelog author="sndirsch@suse.com" date="1598356800">- U_0003-Fix-XkbSelectEvents-integer-underflow.patch
  * Fix XkbSelectEvents() integer underflow
    [CVE-2020-14361 / ZDI-CAN 11573, boo#1174910]
- U_0004-Fix-XRecordRegisterClients-Integer-underflow.patch
  * Fix XRecordRegisterClients() Integer underflow
    [CVE-2020-14362 / ZDI-CAN-11574, boo#1174913]</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- U_present-wnmd-Fix-use-after-free-on-CRTC-removal.patch
  * fix crash in XWayland when undocking laptop (bsc#1176015)
- U_present-wnmd-Relax-assertion-on-CRTC-on-abort_vblank.patch
  * fix for Xwayland abort in Present code (bsc#1176015)
- U_xwayland-Avoid-a-crash-on-pointer-enter-with-a-grab.patch,
  U_xwayland-Check-status-in-GBM-pixmap-creation.patch,
  U_xwayland-Do-not-free-a-NULL-GBM-bo.patch,
  U_xwayland-Update-screen-pixmap-on-output-resize.patch
  * various xwayland crashes fixes from 1.20 branch (bsc#1176015)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- U_xkbsetdeviceinfo.patch (bsc#1177596, ZDI-CAN-11839/CVE-2020-25712)
  * fix for Heap-based Buffer Overflow Privilege Escalation
    Vulnerability</changelog>
  <changelog author="sndirsch@suse.com" date="1605787200">- update U_xkbsetdeviceinfo.patch
  * fixed broken patch (bsc#1177596, comment#18, ZDI-CAN-11839/CVE-2020-25712)</changelog>
  <changelog author="sndirsch@suse.com" date="1605787201">- u_xkb-CVE-2020-14360.patch
  * Avoid out of bounds memory accesses on too short request
    (ZDI-CAN-11572/CVE-2020-14360, bsc#1174908)</changelog>
  <changelog author="dmueller@suse.com" date="1614600000">- add U_hw_do-not-include-sys-io-with-glibc.patch (bsc#1182884)</changelog>
  <changelog author="sndirsch@suse.com" date="1614859200">- U_modesetting-Fix-broken-manpage-in-autoconf-build.patch
  * modesetting: Fix broken manpage in autoconf build (boo#1182510)</changelog>
  <changelog author="sndirsch@suse.com" date="1618228800">- U_Fix-XChangeFeedbackControl-request-underflow.patch
  * Fix XChangeFeedbackControl() request underflow (CVE-2021-3472,
    ZDI-CAN-1259, bsc#1180128)</changelog>
  <changelog author="yu.daike@suse.com" date="1618401600">- U_xwayland-Do-not-crash-if-gbm_bo_create-fails.patch
  * xwayland: Do not crash if gbm_bo_create() fails (boo#1184072) (boo#1184543)</changelog>
  <changelog author="sndirsch@suse.com" date="1618401601">- U_build-glx-Lower-gl-version-to-work-with-libglvnd.patch,
  U_meson-Fix-another-reference-to-gl-9.2.0.patch
  * fix build on sle15-sp3 with updated libglvnd/Mesa and their
    new pkgconfig files
    (https://gitlab.freedesktop.org/xorg/xserver/-/issues/893)</changelog>
  <changelog author="yu.daike@suse.com" date="1621339200">- U_xwayland-glamor-gbm-Handle-DRM_FORMAT_MOD_INVALID-gracefully.patch
  * xwayland: Fix invisible window produced by Xwayland
    (boo#1186092, boo#1184906)</changelog>
  <changelog author="patrik.jakobsson@suse.com" date="1623672000">- u_modesetting-Fix-dirty-updates-for-sw-rotation.patch
  * Fixes broken rotation support for DRM drivers without hardware
    rotation support or direct vram access (bsc#1182955)</changelog>
  <changelog author="sndirsch@suse.com" date="1637841600">- U_rendercompositeglyphs.patch
  * X.Org Server SProcRenderCompositeGlyphs Out-Of-Bounds Access
    Privilege Escalation Vulnerability [CVE-2021-4008, ZDI-CAN-14192]
    (boo#1193030)</changelog>
  <changelog author="sndirsch@suse.com" date="1639483200">- U_xfixes-Fix-out-of-bounds-access-in-ProcXFixesCreateP.patch
  * CVE-2021-4009/ZDI-CAN-14950 (bsc#1190487)
    The handler for the CreatePointerBarrier request of the XFixes
    extension does not properly validate the request length leading
    to out of bounds memory write.
- U_Xext-Fix-out-of-bounds-access-in-SProcScreenSaverSus.patch
  * CVE-2021-4010/ZDI-CAN-14951 (bsc#1190488)
    The handler for the Suspend request of the Screen Saver extension
    does not properly validate the request length leading to out of
    bounds memory write.
- U_record-Fix-out-of-bounds-access-in-SwapCreateRegiste.patch
  * CVE-2021-4011/ZDI-CAN-14952 (bsc#1190489)
    The handlers for the RecordCreateContext and RecordRegisterClients
    requests of the Record extension do not properly validate the request
    length leading to out of bounds memory write.</changelog>
</package>
<package pkgid="2a5b533bf79fe37c94435a51d4e2ce4a287ad397c81fd33a1643cc0bad2ebd45" name="xorg-x11-server-wayland" arch="ppc64le">
  <version epoch="0" ver="1.20.3" rel="22.5.42.1"/>
  <changelog author="sndirsch@suse.com" date="1567425600">- added patches required for NVIDIA's PRIME render offload support,
  which is available since release 435.xx (jira#SLE-8470)
  0001-xsync-Add-resource-inside-of-SyncCreate-export-SyncC.patch,
  0002-GLX-Add-a-per-client-vendor-mapping.patch,
  0003-GLX-Use-the-sending-client-for-looking-up-XID-s.patch,
  0004-GLX-Add-a-function-to-change-a-clients-vendor-list.patch,
  0005-GLX-Set-GlxServerExports-major-minor-Version.patch</changelog>
  <changelog author="fcrozat@suse.com" date="1575028800">- Build XWayland also on s390.</changelog>
  <changelog author="sndirsch@suse.com" date="1582804800">- specfile: reenabled XFree86-VidModeExtension (boo#1164020)</changelog>
  <changelog author="sndirsch@suse.com" date="1588766400">- provide/obsoletes cirrus and ast usermode driver also on openSUSE
  (jsc#SLE-12127)</changelog>
  <changelog author="sndirsch@suse.com" date="1596110400">- U_FixForZDI-11426.patch
  * Leak of uninitialized heap memory form the X server to clients
    on pixmap allocation (ZDI-CAN-11426, CVE-2020-14347, bsc#1174633)</changelog>
  <changelog author="tiwai@suse.de" date="1596628800">- u_xkb-CVE-2020-14345.patch:
  * Fix XKB out-of-bounds access privilege escalation vulnerability
    (CVE-2020-14345, bsc#1174635, ZDI-CAN-11428)
- u_xichangehierarchy-CVE-2020-14346.patch:
  * Fix XIChangeHierarchy integer underflow privilege escalation
    vulnerability (CVE-2020-14346, bsc#1174638, ZDI-CAN-11429)</changelog>
  <changelog author="sndirsch@suse.com" date="1598356800">- U_0003-Fix-XkbSelectEvents-integer-underflow.patch
  * Fix XkbSelectEvents() integer underflow
    [CVE-2020-14361 / ZDI-CAN 11573, boo#1174910]
- U_0004-Fix-XRecordRegisterClients-Integer-underflow.patch
  * Fix XRecordRegisterClients() Integer underflow
    [CVE-2020-14362 / ZDI-CAN-11574, boo#1174913]</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- U_present-wnmd-Fix-use-after-free-on-CRTC-removal.patch
  * fix crash in XWayland when undocking laptop (bsc#1176015)
- U_present-wnmd-Relax-assertion-on-CRTC-on-abort_vblank.patch
  * fix for Xwayland abort in Present code (bsc#1176015)
- U_xwayland-Avoid-a-crash-on-pointer-enter-with-a-grab.patch,
  U_xwayland-Check-status-in-GBM-pixmap-creation.patch,
  U_xwayland-Do-not-free-a-NULL-GBM-bo.patch,
  U_xwayland-Update-screen-pixmap-on-output-resize.patch
  * various xwayland crashes fixes from 1.20 branch (bsc#1176015)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- U_xkbsetdeviceinfo.patch (bsc#1177596, ZDI-CAN-11839/CVE-2020-25712)
  * fix for Heap-based Buffer Overflow Privilege Escalation
    Vulnerability</changelog>
  <changelog author="sndirsch@suse.com" date="1605787200">- update U_xkbsetdeviceinfo.patch
  * fixed broken patch (bsc#1177596, comment#18, ZDI-CAN-11839/CVE-2020-25712)</changelog>
  <changelog author="sndirsch@suse.com" date="1605787201">- u_xkb-CVE-2020-14360.patch
  * Avoid out of bounds memory accesses on too short request
    (ZDI-CAN-11572/CVE-2020-14360, bsc#1174908)</changelog>
  <changelog author="dmueller@suse.com" date="1614600000">- add U_hw_do-not-include-sys-io-with-glibc.patch (bsc#1182884)</changelog>
  <changelog author="sndirsch@suse.com" date="1614859200">- U_modesetting-Fix-broken-manpage-in-autoconf-build.patch
  * modesetting: Fix broken manpage in autoconf build (boo#1182510)</changelog>
  <changelog author="sndirsch@suse.com" date="1618228800">- U_Fix-XChangeFeedbackControl-request-underflow.patch
  * Fix XChangeFeedbackControl() request underflow (CVE-2021-3472,
    ZDI-CAN-1259, bsc#1180128)</changelog>
  <changelog author="yu.daike@suse.com" date="1618401600">- U_xwayland-Do-not-crash-if-gbm_bo_create-fails.patch
  * xwayland: Do not crash if gbm_bo_create() fails (boo#1184072) (boo#1184543)</changelog>
  <changelog author="sndirsch@suse.com" date="1618401601">- U_build-glx-Lower-gl-version-to-work-with-libglvnd.patch,
  U_meson-Fix-another-reference-to-gl-9.2.0.patch
  * fix build on sle15-sp3 with updated libglvnd/Mesa and their
    new pkgconfig files
    (https://gitlab.freedesktop.org/xorg/xserver/-/issues/893)</changelog>
  <changelog author="yu.daike@suse.com" date="1621339200">- U_xwayland-glamor-gbm-Handle-DRM_FORMAT_MOD_INVALID-gracefully.patch
  * xwayland: Fix invisible window produced by Xwayland
    (boo#1186092, boo#1184906)</changelog>
  <changelog author="patrik.jakobsson@suse.com" date="1623672000">- u_modesetting-Fix-dirty-updates-for-sw-rotation.patch
  * Fixes broken rotation support for DRM drivers without hardware
    rotation support or direct vram access (bsc#1182955)</changelog>
  <changelog author="sndirsch@suse.com" date="1637841600">- U_rendercompositeglyphs.patch
  * X.Org Server SProcRenderCompositeGlyphs Out-Of-Bounds Access
    Privilege Escalation Vulnerability [CVE-2021-4008, ZDI-CAN-14192]
    (boo#1193030)</changelog>
  <changelog author="sndirsch@suse.com" date="1639483200">- U_xfixes-Fix-out-of-bounds-access-in-ProcXFixesCreateP.patch
  * CVE-2021-4009/ZDI-CAN-14950 (bsc#1190487)
    The handler for the CreatePointerBarrier request of the XFixes
    extension does not properly validate the request length leading
    to out of bounds memory write.
- U_Xext-Fix-out-of-bounds-access-in-SProcScreenSaverSus.patch
  * CVE-2021-4010/ZDI-CAN-14951 (bsc#1190488)
    The handler for the Suspend request of the Screen Saver extension
    does not properly validate the request length leading to out of
    bounds memory write.
- U_record-Fix-out-of-bounds-access-in-SwapCreateRegiste.patch
  * CVE-2021-4011/ZDI-CAN-14952 (bsc#1190489)
    The handlers for the RecordCreateContext and RecordRegisterClients
    requests of the Record extension do not properly validate the request
    length leading to out of bounds memory write.</changelog>
</package>
<package pkgid="8d86dd7e5200e102c3a04d7aa6a1dcd8628ab022a312db2006a90665d8db102d" name="xorg-x11-server-wayland" arch="s390x">
  <version epoch="0" ver="1.20.3" rel="22.5.42.1"/>
  <changelog author="sndirsch@suse.com" date="1567425600">- added patches required for NVIDIA's PRIME render offload support,
  which is available since release 435.xx (jira#SLE-8470)
  0001-xsync-Add-resource-inside-of-SyncCreate-export-SyncC.patch,
  0002-GLX-Add-a-per-client-vendor-mapping.patch,
  0003-GLX-Use-the-sending-client-for-looking-up-XID-s.patch,
  0004-GLX-Add-a-function-to-change-a-clients-vendor-list.patch,
  0005-GLX-Set-GlxServerExports-major-minor-Version.patch</changelog>
  <changelog author="fcrozat@suse.com" date="1575028800">- Build XWayland also on s390.</changelog>
  <changelog author="sndirsch@suse.com" date="1582804800">- specfile: reenabled XFree86-VidModeExtension (boo#1164020)</changelog>
  <changelog author="sndirsch@suse.com" date="1588766400">- provide/obsoletes cirrus and ast usermode driver also on openSUSE
  (jsc#SLE-12127)</changelog>
  <changelog author="sndirsch@suse.com" date="1596110400">- U_FixForZDI-11426.patch
  * Leak of uninitialized heap memory form the X server to clients
    on pixmap allocation (ZDI-CAN-11426, CVE-2020-14347, bsc#1174633)</changelog>
  <changelog author="tiwai@suse.de" date="1596628800">- u_xkb-CVE-2020-14345.patch:
  * Fix XKB out-of-bounds access privilege escalation vulnerability
    (CVE-2020-14345, bsc#1174635, ZDI-CAN-11428)
- u_xichangehierarchy-CVE-2020-14346.patch:
  * Fix XIChangeHierarchy integer underflow privilege escalation
    vulnerability (CVE-2020-14346, bsc#1174638, ZDI-CAN-11429)</changelog>
  <changelog author="sndirsch@suse.com" date="1598356800">- U_0003-Fix-XkbSelectEvents-integer-underflow.patch
  * Fix XkbSelectEvents() integer underflow
    [CVE-2020-14361 / ZDI-CAN 11573, boo#1174910]
- U_0004-Fix-XRecordRegisterClients-Integer-underflow.patch
  * Fix XRecordRegisterClients() Integer underflow
    [CVE-2020-14362 / ZDI-CAN-11574, boo#1174913]</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- U_present-wnmd-Fix-use-after-free-on-CRTC-removal.patch
  * fix crash in XWayland when undocking laptop (bsc#1176015)
- U_present-wnmd-Relax-assertion-on-CRTC-on-abort_vblank.patch
  * fix for Xwayland abort in Present code (bsc#1176015)
- U_xwayland-Avoid-a-crash-on-pointer-enter-with-a-grab.patch,
  U_xwayland-Check-status-in-GBM-pixmap-creation.patch,
  U_xwayland-Do-not-free-a-NULL-GBM-bo.patch,
  U_xwayland-Update-screen-pixmap-on-output-resize.patch
  * various xwayland crashes fixes from 1.20 branch (bsc#1176015)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- U_xkbsetdeviceinfo.patch (bsc#1177596, ZDI-CAN-11839/CVE-2020-25712)
  * fix for Heap-based Buffer Overflow Privilege Escalation
    Vulnerability</changelog>
  <changelog author="sndirsch@suse.com" date="1605787200">- update U_xkbsetdeviceinfo.patch
  * fixed broken patch (bsc#1177596, comment#18, ZDI-CAN-11839/CVE-2020-25712)</changelog>
  <changelog author="sndirsch@suse.com" date="1605787201">- u_xkb-CVE-2020-14360.patch
  * Avoid out of bounds memory accesses on too short request
    (ZDI-CAN-11572/CVE-2020-14360, bsc#1174908)</changelog>
  <changelog author="dmueller@suse.com" date="1614600000">- add U_hw_do-not-include-sys-io-with-glibc.patch (bsc#1182884)</changelog>
  <changelog author="sndirsch@suse.com" date="1614859200">- U_modesetting-Fix-broken-manpage-in-autoconf-build.patch
  * modesetting: Fix broken manpage in autoconf build (boo#1182510)</changelog>
  <changelog author="sndirsch@suse.com" date="1618228800">- U_Fix-XChangeFeedbackControl-request-underflow.patch
  * Fix XChangeFeedbackControl() request underflow (CVE-2021-3472,
    ZDI-CAN-1259, bsc#1180128)</changelog>
  <changelog author="yu.daike@suse.com" date="1618401600">- U_xwayland-Do-not-crash-if-gbm_bo_create-fails.patch
  * xwayland: Do not crash if gbm_bo_create() fails (boo#1184072) (boo#1184543)</changelog>
  <changelog author="sndirsch@suse.com" date="1618401601">- U_build-glx-Lower-gl-version-to-work-with-libglvnd.patch,
  U_meson-Fix-another-reference-to-gl-9.2.0.patch
  * fix build on sle15-sp3 with updated libglvnd/Mesa and their
    new pkgconfig files
    (https://gitlab.freedesktop.org/xorg/xserver/-/issues/893)</changelog>
  <changelog author="yu.daike@suse.com" date="1621339200">- U_xwayland-glamor-gbm-Handle-DRM_FORMAT_MOD_INVALID-gracefully.patch
  * xwayland: Fix invisible window produced by Xwayland
    (boo#1186092, boo#1184906)</changelog>
  <changelog author="patrik.jakobsson@suse.com" date="1623672000">- u_modesetting-Fix-dirty-updates-for-sw-rotation.patch
  * Fixes broken rotation support for DRM drivers without hardware
    rotation support or direct vram access (bsc#1182955)</changelog>
  <changelog author="sndirsch@suse.com" date="1637841600">- U_rendercompositeglyphs.patch
  * X.Org Server SProcRenderCompositeGlyphs Out-Of-Bounds Access
    Privilege Escalation Vulnerability [CVE-2021-4008, ZDI-CAN-14192]
    (boo#1193030)</changelog>
  <changelog author="sndirsch@suse.com" date="1639483200">- U_xfixes-Fix-out-of-bounds-access-in-ProcXFixesCreateP.patch
  * CVE-2021-4009/ZDI-CAN-14950 (bsc#1190487)
    The handler for the CreatePointerBarrier request of the XFixes
    extension does not properly validate the request length leading
    to out of bounds memory write.
- U_Xext-Fix-out-of-bounds-access-in-SProcScreenSaverSus.patch
  * CVE-2021-4010/ZDI-CAN-14951 (bsc#1190488)
    The handler for the Suspend request of the Screen Saver extension
    does not properly validate the request length leading to out of
    bounds memory write.
- U_record-Fix-out-of-bounds-access-in-SwapCreateRegiste.patch
  * CVE-2021-4011/ZDI-CAN-14952 (bsc#1190489)
    The handlers for the RecordCreateContext and RecordRegisterClients
    requests of the Record extension do not properly validate the request
    length leading to out of bounds memory write.</changelog>
</package>
<package pkgid="f9be26e66e5d7b5c154e70cd96108b19e5f3d3b7db607e80dae800b7df5df72d" name="xorg-x11-server-wayland" arch="x86_64">
  <version epoch="0" ver="1.20.3" rel="22.5.42.1"/>
  <changelog author="sndirsch@suse.com" date="1567425600">- added patches required for NVIDIA's PRIME render offload support,
  which is available since release 435.xx (jira#SLE-8470)
  0001-xsync-Add-resource-inside-of-SyncCreate-export-SyncC.patch,
  0002-GLX-Add-a-per-client-vendor-mapping.patch,
  0003-GLX-Use-the-sending-client-for-looking-up-XID-s.patch,
  0004-GLX-Add-a-function-to-change-a-clients-vendor-list.patch,
  0005-GLX-Set-GlxServerExports-major-minor-Version.patch</changelog>
  <changelog author="fcrozat@suse.com" date="1575028800">- Build XWayland also on s390.</changelog>
  <changelog author="sndirsch@suse.com" date="1582804800">- specfile: reenabled XFree86-VidModeExtension (boo#1164020)</changelog>
  <changelog author="sndirsch@suse.com" date="1588766400">- provide/obsoletes cirrus and ast usermode driver also on openSUSE
  (jsc#SLE-12127)</changelog>
  <changelog author="sndirsch@suse.com" date="1596110400">- U_FixForZDI-11426.patch
  * Leak of uninitialized heap memory form the X server to clients
    on pixmap allocation (ZDI-CAN-11426, CVE-2020-14347, bsc#1174633)</changelog>
  <changelog author="tiwai@suse.de" date="1596628800">- u_xkb-CVE-2020-14345.patch:
  * Fix XKB out-of-bounds access privilege escalation vulnerability
    (CVE-2020-14345, bsc#1174635, ZDI-CAN-11428)
- u_xichangehierarchy-CVE-2020-14346.patch:
  * Fix XIChangeHierarchy integer underflow privilege escalation
    vulnerability (CVE-2020-14346, bsc#1174638, ZDI-CAN-11429)</changelog>
  <changelog author="sndirsch@suse.com" date="1598356800">- U_0003-Fix-XkbSelectEvents-integer-underflow.patch
  * Fix XkbSelectEvents() integer underflow
    [CVE-2020-14361 / ZDI-CAN 11573, boo#1174910]
- U_0004-Fix-XRecordRegisterClients-Integer-underflow.patch
  * Fix XRecordRegisterClients() Integer underflow
    [CVE-2020-14362 / ZDI-CAN-11574, boo#1174913]</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- U_present-wnmd-Fix-use-after-free-on-CRTC-removal.patch
  * fix crash in XWayland when undocking laptop (bsc#1176015)
- U_present-wnmd-Relax-assertion-on-CRTC-on-abort_vblank.patch
  * fix for Xwayland abort in Present code (bsc#1176015)
- U_xwayland-Avoid-a-crash-on-pointer-enter-with-a-grab.patch,
  U_xwayland-Check-status-in-GBM-pixmap-creation.patch,
  U_xwayland-Do-not-free-a-NULL-GBM-bo.patch,
  U_xwayland-Update-screen-pixmap-on-output-resize.patch
  * various xwayland crashes fixes from 1.20 branch (bsc#1176015)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- U_xkbsetdeviceinfo.patch (bsc#1177596, ZDI-CAN-11839/CVE-2020-25712)
  * fix for Heap-based Buffer Overflow Privilege Escalation
    Vulnerability</changelog>
  <changelog author="sndirsch@suse.com" date="1605787200">- update U_xkbsetdeviceinfo.patch
  * fixed broken patch (bsc#1177596, comment#18, ZDI-CAN-11839/CVE-2020-25712)</changelog>
  <changelog author="sndirsch@suse.com" date="1605787201">- u_xkb-CVE-2020-14360.patch
  * Avoid out of bounds memory accesses on too short request
    (ZDI-CAN-11572/CVE-2020-14360, bsc#1174908)</changelog>
  <changelog author="dmueller@suse.com" date="1614600000">- add U_hw_do-not-include-sys-io-with-glibc.patch (bsc#1182884)</changelog>
  <changelog author="sndirsch@suse.com" date="1614859200">- U_modesetting-Fix-broken-manpage-in-autoconf-build.patch
  * modesetting: Fix broken manpage in autoconf build (boo#1182510)</changelog>
  <changelog author="sndirsch@suse.com" date="1618228800">- U_Fix-XChangeFeedbackControl-request-underflow.patch
  * Fix XChangeFeedbackControl() request underflow (CVE-2021-3472,
    ZDI-CAN-1259, bsc#1180128)</changelog>
  <changelog author="yu.daike@suse.com" date="1618401600">- U_xwayland-Do-not-crash-if-gbm_bo_create-fails.patch
  * xwayland: Do not crash if gbm_bo_create() fails (boo#1184072) (boo#1184543)</changelog>
  <changelog author="sndirsch@suse.com" date="1618401601">- U_build-glx-Lower-gl-version-to-work-with-libglvnd.patch,
  U_meson-Fix-another-reference-to-gl-9.2.0.patch
  * fix build on sle15-sp3 with updated libglvnd/Mesa and their
    new pkgconfig files
    (https://gitlab.freedesktop.org/xorg/xserver/-/issues/893)</changelog>
  <changelog author="yu.daike@suse.com" date="1621339200">- U_xwayland-glamor-gbm-Handle-DRM_FORMAT_MOD_INVALID-gracefully.patch
  * xwayland: Fix invisible window produced by Xwayland
    (boo#1186092, boo#1184906)</changelog>
  <changelog author="patrik.jakobsson@suse.com" date="1623672000">- u_modesetting-Fix-dirty-updates-for-sw-rotation.patch
  * Fixes broken rotation support for DRM drivers without hardware
    rotation support or direct vram access (bsc#1182955)</changelog>
  <changelog author="sndirsch@suse.com" date="1637841600">- U_rendercompositeglyphs.patch
  * X.Org Server SProcRenderCompositeGlyphs Out-Of-Bounds Access
    Privilege Escalation Vulnerability [CVE-2021-4008, ZDI-CAN-14192]
    (boo#1193030)</changelog>
  <changelog author="sndirsch@suse.com" date="1639483200">- U_xfixes-Fix-out-of-bounds-access-in-ProcXFixesCreateP.patch
  * CVE-2021-4009/ZDI-CAN-14950 (bsc#1190487)
    The handler for the CreatePointerBarrier request of the XFixes
    extension does not properly validate the request length leading
    to out of bounds memory write.
- U_Xext-Fix-out-of-bounds-access-in-SProcScreenSaverSus.patch
  * CVE-2021-4010/ZDI-CAN-14951 (bsc#1190488)
    The handler for the Suspend request of the Screen Saver extension
    does not properly validate the request length leading to out of
    bounds memory write.
- U_record-Fix-out-of-bounds-access-in-SwapCreateRegiste.patch
  * CVE-2021-4011/ZDI-CAN-14952 (bsc#1190489)
    The handlers for the RecordCreateContext and RecordRegisterClients
    requests of the Record extension do not properly validate the request
    length leading to out of bounds memory write.</changelog>
</package>
<package pkgid="8dd11c889956750b50ef4705de056f0311911f7560af6d52552035262e3ff24d" name="xrdp" arch="aarch64">
  <version epoch="0" ver="0.9.13.1" rel="4.12.1"/>
  <changelog author="fezhang@suse.com" date="1537963200">- Update to version 0.9.8
  + New features
  - Add TLSv1.3 support #1193
  + Deprecation notice
  - TLSv1 and TLSv1.1 are removed from the default config.
    Current default is TLSv1.2 and TLSv1.3
  + Bug fixes
  - Ensure unmount redirected drive on fatal X error #1140
  + Other changes
  - Pulseaudio modules has been removed from xrdp source tree
  - Pass pulse socket name via environment variable #1198
- Update xrdp-fate318398-change-expired-password.patch: Use
  configured values instead of hardcoded ones in login_wnd inputs</changelog>
  <changelog author="fezhang@suse.com" date="1545912000">- Update to version 0.9.9
  + New features
  - Disconnection by idle timeout (requires xorgxrdp v0.2.9 or
    later) #1227
  + Bug fixes
  - Fix xrdp-chansrv crashes caused in drive redirection #1202
    [#1225]
  - Fix build with FDK AAC v2 #1257
  - Do not enable RemoteApp if the INFO_RAIL flag is not set
    (RDP-RDP proxy) #1253
  + Other changes
  - Add Spanish Latin Amarican keyboard #1237 #1240 #1244
  - Dynamic channel improvements #1222 #1224
  - Remove some deprecated sesman session types #1232
  - Refactoring and cleanups
  + Known issues
  - FreeRDP 2.0.0-rc4 or later might not able to connect to xrdp
    due to xrdp's bad-mannered behaviour, add `+glyph-cache`
    option to FreeRDP to connect #1266
  - Audio redirection by MP3 codec doesn't sound with some
    client, use AAC instead #965
  + Refresh xrdp-default-config.patch</changelog>
  <changelog author="fezhang@suse.com" date="1556539200">- Update to version 0.9.10 (jsc#SLE-5926)
  + New features
  - Restrict outbound (server-&gt;client) clipboard transfer,
    configured in `sesman.ini` #1298
  + Bug fixes
  - Fix libscp v1 not setting width but height twice #1293
  - Fix reconnecting to session causes duplicate drive entries
    in fuse fs #1299
  - Fix default_wm and reconnect_sh refer wrong path after sesman
    caught SIGUP #1315 #1331
  - Shutdown xrdp more responsively #1325
  - Improve remote file lookup in drive redirection #996 #1327
  - Overwriting &amp; appending to existing files now supported #1327
  + Other changes
  - Add Danish Keyboard #1290
  - Put xrdp- prefix to some executables appear in man page #1313
  - Replace some URLs from SF.net to xrdp.org #1313
  + Known issues
  - FreeRDP 2.0.0-rc4 or later might not able to connect to xrdp
    due to xrdp's bad-mannered behaviour, add `+glyph-cache`
    option to FreeRDP to connect #1266
  - Audio redirection by MP3 codec doesn't sound with some
    client, use AAC instead #965</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1564142400">- Removal of SuSEfirewall2 service, since SuSEfirewall2 has been
  replaced by firewalld, see:
  https://lists.opensuse.org/opensuse-factory/2019-01/msg00490.html</changelog>
  <changelog author="fezhang@suse.com" date="1565006400">- Update xrdp-pam.patch: Include the pam_keyinit.so module in
  /etc/pam.d/xrdp-sesman to support the kernel keyrings
  (boo#1144064).</changelog>
  <changelog author="fezhang@suse.com" date="1568116800">- Add xrdp-systemd-services.patch: Let systemd handle the daemons,
  fix daemon start failures (boo#1138954, boo#1144327).</changelog>
  <changelog author="fezhang@suse.com" date="1568635200">- Update to version 0.9.11 (jsc#SLE-9612)
  + New features
  - Suppress output (do not draw screen when client window is
    minimized) #1330
  - Audio input (microphone) redirection compatible with
    MS-RDPEAI #1369
  - Now xrdp can listen on more than one port #1124 #1366
  + Bug fixes
  - Fix the issue audio redirection sometimes sounds with long
    delay #1363
  - Check term event for more responsive shutdown #1372
  + Known issues
  - FreeRDP 2.0.0-rc4 or later might not able to connect to xrdp
    due to xrdp's bad-mannered behaviour, add +glyph-cache option
    to FreeRDP to connect #1266
  - Audio redirection by MP3 codec doesn't sound with some
    client, use AAC instead #965
- Rebase xrdp-avahi.diff, worked around stdint.h definitions
- Rebase xrdp-fate319683-allow-vnc-resizing.patch</changelog>
  <changelog author="yfjiang@suse.com" date="1573646400">- Make mkpamrules additionally support SUSE's usage of
  /usr/etc/pam.d (boo#1156094, gh#neutrinolabs/xrdp!1442):
  * xrdp-mkpamrules-support-usr-etc-distconfdir.patch
  https://lists.opensuse.org/opensuse-factory/2019-08/msg00113.html</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1581163200">- Build with --enable-vsock so xrdp can be used with hyper-v
  enhanced session mode.</changelog>
  <changelog author="fzhang.foss@gmail.com" date="1583928000">- Update xrdp-avahi.diff: Fix implicit definitions errors.</changelog>
  <changelog author="fzhang.foss@gmail.com" date="1584014400">- Update to version 0.9.13
  + Bug fixes: some regressions on drive redirection #1469 #1487
    [#1505] #1507
  + Support mousex button 8/9 #1478
- Update to version 0.9.12
  + Bug fixes
  - Fix "The log reference is NULL" error when sesman startup
    [#1425]
  - Fix behavior when shmem_id changes #1439
  - Make vsock config accept -1 for cid and port #1441
  - Cleanup refresh rect and check stream bounds #1437
  - Significant improvements in drive redirection #1449
  + Other changes
  - Proprietary microphone redirection via rdpsnd is now default
    off RDP compatible microphone redirection is on instead #1427
  - Skip connecting to chansrv when no channels enabled #1393
  - Add openSUSE's pam rules (boo#1156094, #1442)
  - Do not terminate xrdp daemon when caught SIGHUP #1319
- Known issues
  + FreeRDP 2.0.0-rc4 or later might not able to connect to xrdp
    due to xrdp's bad-mannered behaviour, add `+glyph-cache` option
    to FreeRDP to connect #1266
  + Audio redirection by MP3 codec doesn't sound with some client,
    use AAC instead #965
- Drop xrdp-mkpamrules-support-usr-etc-distconfdir.patch: Fixed
  upstream</changelog>
  <changelog author="qkzhu@suse.com" date="1585051200">- Update xrdp-bsc965647-allow-admin-choose-desktop.patch:
  Add `export XDG_SESSION_TYPE=x11` in startwm.sh for SLE, since
  lacking this variable in GNOME 3.34 causes GNOME crash (bsc#1159257).</changelog>
  <changelog author="qkzhu@suse.com" date="1585051201">- Update xrdp-bsc965647-allow-admin-choose-desktop.patch:
  + Set the default session to GNOME Session for SLE.
  + Update the variables to launch SLE-Classic Session.
  (bsc#1166746).</changelog>
  <changelog author="yfjiang@suse.com" date="1587729600">- Enable SLE only patches for Leap (jsc#SLE-11850).</changelog>
  <changelog author="dimstar@opensuse.org" date="1592395200">- Use %{_libexecdir} to install the legacy initscript actions to.</changelog>
  <changelog author="yfjiang@suse.com" date="1593691200">- Update to version 0.9.13.1
  + This is a security fix release that includes fixes for the
    following local buffer overflow vulnerability (bsc#1173580):
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-4044
- Rebase xrdp-fate318398-change-expired-password.patch</changelog>
  <changelog author="yfjiang@suse.com" date="1594382400">- Update xrdp.keyring according to:
  https://github.com/neutrinolabs/xrdp/issues/1627</changelog>
  <changelog author="yfjiang@suse.com" date="1597147200">- Update xrdp-bsc965647-allow-admin-choose-desktop.patch:
  + Fallback the session to icewm when a selected desktop
    environment is not found (bsc#1171415)
  + Support plasma session for Leap 15.2
  + Give more informative comments in start_wm.sh</changelog>
  <changelog author="yfjiang@suse.com" date="1604923200">- Introduce more buffer protection fixes (jsc#SLE-11518):
  + Add xrdp-memory-allocation-security-fix.patch
  + Add xrdp-remove-unecessary-gmalloc.patch
  + Add xrdp-safe-data-chunk-reassembly.patch
- Make the serial number of SLE patches on the bottom</changelog>
  <changelog author="yu.daike@suse.com" date="1628596800">- Fix crash in xrdp-fate318398-change-expired-password.patch (bsc#1187258)</changelog>
</package>
<package pkgid="28119b7609b4bbe0e3c19228b08215ff82d54a746d4598e24582145d1eb8881a" name="xrdp" arch="ppc64le">
  <version epoch="0" ver="0.9.13.1" rel="4.12.1"/>
  <changelog author="fezhang@suse.com" date="1537963200">- Update to version 0.9.8
  + New features
  - Add TLSv1.3 support #1193
  + Deprecation notice
  - TLSv1 and TLSv1.1 are removed from the default config.
    Current default is TLSv1.2 and TLSv1.3
  + Bug fixes
  - Ensure unmount redirected drive on fatal X error #1140
  + Other changes
  - Pulseaudio modules has been removed from xrdp source tree
  - Pass pulse socket name via environment variable #1198
- Update xrdp-fate318398-change-expired-password.patch: Use
  configured values instead of hardcoded ones in login_wnd inputs</changelog>
  <changelog author="fezhang@suse.com" date="1545912000">- Update to version 0.9.9
  + New features
  - Disconnection by idle timeout (requires xorgxrdp v0.2.9 or
    later) #1227
  + Bug fixes
  - Fix xrdp-chansrv crashes caused in drive redirection #1202
    [#1225]
  - Fix build with FDK AAC v2 #1257
  - Do not enable RemoteApp if the INFO_RAIL flag is not set
    (RDP-RDP proxy) #1253
  + Other changes
  - Add Spanish Latin Amarican keyboard #1237 #1240 #1244
  - Dynamic channel improvements #1222 #1224
  - Remove some deprecated sesman session types #1232
  - Refactoring and cleanups
  + Known issues
  - FreeRDP 2.0.0-rc4 or later might not able to connect to xrdp
    due to xrdp's bad-mannered behaviour, add `+glyph-cache`
    option to FreeRDP to connect #1266
  - Audio redirection by MP3 codec doesn't sound with some
    client, use AAC instead #965
  + Refresh xrdp-default-config.patch</changelog>
  <changelog author="fezhang@suse.com" date="1556539200">- Update to version 0.9.10 (jsc#SLE-5926)
  + New features
  - Restrict outbound (server-&gt;client) clipboard transfer,
    configured in `sesman.ini` #1298
  + Bug fixes
  - Fix libscp v1 not setting width but height twice #1293
  - Fix reconnecting to session causes duplicate drive entries
    in fuse fs #1299
  - Fix default_wm and reconnect_sh refer wrong path after sesman
    caught SIGUP #1315 #1331
  - Shutdown xrdp more responsively #1325
  - Improve remote file lookup in drive redirection #996 #1327
  - Overwriting &amp; appending to existing files now supported #1327
  + Other changes
  - Add Danish Keyboard #1290
  - Put xrdp- prefix to some executables appear in man page #1313
  - Replace some URLs from SF.net to xrdp.org #1313
  + Known issues
  - FreeRDP 2.0.0-rc4 or later might not able to connect to xrdp
    due to xrdp's bad-mannered behaviour, add `+glyph-cache`
    option to FreeRDP to connect #1266
  - Audio redirection by MP3 codec doesn't sound with some
    client, use AAC instead #965</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1564142400">- Removal of SuSEfirewall2 service, since SuSEfirewall2 has been
  replaced by firewalld, see:
  https://lists.opensuse.org/opensuse-factory/2019-01/msg00490.html</changelog>
  <changelog author="fezhang@suse.com" date="1565006400">- Update xrdp-pam.patch: Include the pam_keyinit.so module in
  /etc/pam.d/xrdp-sesman to support the kernel keyrings
  (boo#1144064).</changelog>
  <changelog author="fezhang@suse.com" date="1568116800">- Add xrdp-systemd-services.patch: Let systemd handle the daemons,
  fix daemon start failures (boo#1138954, boo#1144327).</changelog>
  <changelog author="fezhang@suse.com" date="1568635200">- Update to version 0.9.11 (jsc#SLE-9612)
  + New features
  - Suppress output (do not draw screen when client window is
    minimized) #1330
  - Audio input (microphone) redirection compatible with
    MS-RDPEAI #1369
  - Now xrdp can listen on more than one port #1124 #1366
  + Bug fixes
  - Fix the issue audio redirection sometimes sounds with long
    delay #1363
  - Check term event for more responsive shutdown #1372
  + Known issues
  - FreeRDP 2.0.0-rc4 or later might not able to connect to xrdp
    due to xrdp's bad-mannered behaviour, add +glyph-cache option
    to FreeRDP to connect #1266
  - Audio redirection by MP3 codec doesn't sound with some
    client, use AAC instead #965
- Rebase xrdp-avahi.diff, worked around stdint.h definitions
- Rebase xrdp-fate319683-allow-vnc-resizing.patch</changelog>
  <changelog author="yfjiang@suse.com" date="1573646400">- Make mkpamrules additionally support SUSE's usage of
  /usr/etc/pam.d (boo#1156094, gh#neutrinolabs/xrdp!1442):
  * xrdp-mkpamrules-support-usr-etc-distconfdir.patch
  https://lists.opensuse.org/opensuse-factory/2019-08/msg00113.html</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1581163200">- Build with --enable-vsock so xrdp can be used with hyper-v
  enhanced session mode.</changelog>
  <changelog author="fzhang.foss@gmail.com" date="1583928000">- Update xrdp-avahi.diff: Fix implicit definitions errors.</changelog>
  <changelog author="fzhang.foss@gmail.com" date="1584014400">- Update to version 0.9.13
  + Bug fixes: some regressions on drive redirection #1469 #1487
    [#1505] #1507
  + Support mousex button 8/9 #1478
- Update to version 0.9.12
  + Bug fixes
  - Fix "The log reference is NULL" error when sesman startup
    [#1425]
  - Fix behavior when shmem_id changes #1439
  - Make vsock config accept -1 for cid and port #1441
  - Cleanup refresh rect and check stream bounds #1437
  - Significant improvements in drive redirection #1449
  + Other changes
  - Proprietary microphone redirection via rdpsnd is now default
    off RDP compatible microphone redirection is on instead #1427
  - Skip connecting to chansrv when no channels enabled #1393
  - Add openSUSE's pam rules (boo#1156094, #1442)
  - Do not terminate xrdp daemon when caught SIGHUP #1319
- Known issues
  + FreeRDP 2.0.0-rc4 or later might not able to connect to xrdp
    due to xrdp's bad-mannered behaviour, add `+glyph-cache` option
    to FreeRDP to connect #1266
  + Audio redirection by MP3 codec doesn't sound with some client,
    use AAC instead #965
- Drop xrdp-mkpamrules-support-usr-etc-distconfdir.patch: Fixed
  upstream</changelog>
  <changelog author="qkzhu@suse.com" date="1585051200">- Update xrdp-bsc965647-allow-admin-choose-desktop.patch:
  Add `export XDG_SESSION_TYPE=x11` in startwm.sh for SLE, since
  lacking this variable in GNOME 3.34 causes GNOME crash (bsc#1159257).</changelog>
  <changelog author="qkzhu@suse.com" date="1585051201">- Update xrdp-bsc965647-allow-admin-choose-desktop.patch:
  + Set the default session to GNOME Session for SLE.
  + Update the variables to launch SLE-Classic Session.
  (bsc#1166746).</changelog>
  <changelog author="yfjiang@suse.com" date="1587729600">- Enable SLE only patches for Leap (jsc#SLE-11850).</changelog>
  <changelog author="dimstar@opensuse.org" date="1592395200">- Use %{_libexecdir} to install the legacy initscript actions to.</changelog>
  <changelog author="yfjiang@suse.com" date="1593691200">- Update to version 0.9.13.1
  + This is a security fix release that includes fixes for the
    following local buffer overflow vulnerability (bsc#1173580):
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-4044
- Rebase xrdp-fate318398-change-expired-password.patch</changelog>
  <changelog author="yfjiang@suse.com" date="1594382400">- Update xrdp.keyring according to:
  https://github.com/neutrinolabs/xrdp/issues/1627</changelog>
  <changelog author="yfjiang@suse.com" date="1597147200">- Update xrdp-bsc965647-allow-admin-choose-desktop.patch:
  + Fallback the session to icewm when a selected desktop
    environment is not found (bsc#1171415)
  + Support plasma session for Leap 15.2
  + Give more informative comments in start_wm.sh</changelog>
  <changelog author="yfjiang@suse.com" date="1604923200">- Introduce more buffer protection fixes (jsc#SLE-11518):
  + Add xrdp-memory-allocation-security-fix.patch
  + Add xrdp-remove-unecessary-gmalloc.patch
  + Add xrdp-safe-data-chunk-reassembly.patch
- Make the serial number of SLE patches on the bottom</changelog>
  <changelog author="yu.daike@suse.com" date="1628596800">- Fix crash in xrdp-fate318398-change-expired-password.patch (bsc#1187258)</changelog>
</package>
<package pkgid="790bb9f56f4dddaa0c884b9350f37c471c6eb8ba1b62fe4d16dbc8e42f6a46eb" name="xrdp" arch="s390x">
  <version epoch="0" ver="0.9.13.1" rel="4.12.1"/>
  <changelog author="fezhang@suse.com" date="1537963200">- Update to version 0.9.8
  + New features
  - Add TLSv1.3 support #1193
  + Deprecation notice
  - TLSv1 and TLSv1.1 are removed from the default config.
    Current default is TLSv1.2 and TLSv1.3
  + Bug fixes
  - Ensure unmount redirected drive on fatal X error #1140
  + Other changes
  - Pulseaudio modules has been removed from xrdp source tree
  - Pass pulse socket name via environment variable #1198
- Update xrdp-fate318398-change-expired-password.patch: Use
  configured values instead of hardcoded ones in login_wnd inputs</changelog>
  <changelog author="fezhang@suse.com" date="1545912000">- Update to version 0.9.9
  + New features
  - Disconnection by idle timeout (requires xorgxrdp v0.2.9 or
    later) #1227
  + Bug fixes
  - Fix xrdp-chansrv crashes caused in drive redirection #1202
    [#1225]
  - Fix build with FDK AAC v2 #1257
  - Do not enable RemoteApp if the INFO_RAIL flag is not set
    (RDP-RDP proxy) #1253
  + Other changes
  - Add Spanish Latin Amarican keyboard #1237 #1240 #1244
  - Dynamic channel improvements #1222 #1224
  - Remove some deprecated sesman session types #1232
  - Refactoring and cleanups
  + Known issues
  - FreeRDP 2.0.0-rc4 or later might not able to connect to xrdp
    due to xrdp's bad-mannered behaviour, add `+glyph-cache`
    option to FreeRDP to connect #1266
  - Audio redirection by MP3 codec doesn't sound with some
    client, use AAC instead #965
  + Refresh xrdp-default-config.patch</changelog>
  <changelog author="fezhang@suse.com" date="1556539200">- Update to version 0.9.10 (jsc#SLE-5926)
  + New features
  - Restrict outbound (server-&gt;client) clipboard transfer,
    configured in `sesman.ini` #1298
  + Bug fixes
  - Fix libscp v1 not setting width but height twice #1293
  - Fix reconnecting to session causes duplicate drive entries
    in fuse fs #1299
  - Fix default_wm and reconnect_sh refer wrong path after sesman
    caught SIGUP #1315 #1331
  - Shutdown xrdp more responsively #1325
  - Improve remote file lookup in drive redirection #996 #1327
  - Overwriting &amp; appending to existing files now supported #1327
  + Other changes
  - Add Danish Keyboard #1290
  - Put xrdp- prefix to some executables appear in man page #1313
  - Replace some URLs from SF.net to xrdp.org #1313
  + Known issues
  - FreeRDP 2.0.0-rc4 or later might not able to connect to xrdp
    due to xrdp's bad-mannered behaviour, add `+glyph-cache`
    option to FreeRDP to connect #1266
  - Audio redirection by MP3 codec doesn't sound with some
    client, use AAC instead #965</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1564142400">- Removal of SuSEfirewall2 service, since SuSEfirewall2 has been
  replaced by firewalld, see:
  https://lists.opensuse.org/opensuse-factory/2019-01/msg00490.html</changelog>
  <changelog author="fezhang@suse.com" date="1565006400">- Update xrdp-pam.patch: Include the pam_keyinit.so module in
  /etc/pam.d/xrdp-sesman to support the kernel keyrings
  (boo#1144064).</changelog>
  <changelog author="fezhang@suse.com" date="1568116800">- Add xrdp-systemd-services.patch: Let systemd handle the daemons,
  fix daemon start failures (boo#1138954, boo#1144327).</changelog>
  <changelog author="fezhang@suse.com" date="1568635200">- Update to version 0.9.11 (jsc#SLE-9612)
  + New features
  - Suppress output (do not draw screen when client window is
    minimized) #1330
  - Audio input (microphone) redirection compatible with
    MS-RDPEAI #1369
  - Now xrdp can listen on more than one port #1124 #1366
  + Bug fixes
  - Fix the issue audio redirection sometimes sounds with long
    delay #1363
  - Check term event for more responsive shutdown #1372
  + Known issues
  - FreeRDP 2.0.0-rc4 or later might not able to connect to xrdp
    due to xrdp's bad-mannered behaviour, add +glyph-cache option
    to FreeRDP to connect #1266
  - Audio redirection by MP3 codec doesn't sound with some
    client, use AAC instead #965
- Rebase xrdp-avahi.diff, worked around stdint.h definitions
- Rebase xrdp-fate319683-allow-vnc-resizing.patch</changelog>
  <changelog author="yfjiang@suse.com" date="1573646400">- Make mkpamrules additionally support SUSE's usage of
  /usr/etc/pam.d (boo#1156094, gh#neutrinolabs/xrdp!1442):
  * xrdp-mkpamrules-support-usr-etc-distconfdir.patch
  https://lists.opensuse.org/opensuse-factory/2019-08/msg00113.html</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1581163200">- Build with --enable-vsock so xrdp can be used with hyper-v
  enhanced session mode.</changelog>
  <changelog author="fzhang.foss@gmail.com" date="1583928000">- Update xrdp-avahi.diff: Fix implicit definitions errors.</changelog>
  <changelog author="fzhang.foss@gmail.com" date="1584014400">- Update to version 0.9.13
  + Bug fixes: some regressions on drive redirection #1469 #1487
    [#1505] #1507
  + Support mousex button 8/9 #1478
- Update to version 0.9.12
  + Bug fixes
  - Fix "The log reference is NULL" error when sesman startup
    [#1425]
  - Fix behavior when shmem_id changes #1439
  - Make vsock config accept -1 for cid and port #1441
  - Cleanup refresh rect and check stream bounds #1437
  - Significant improvements in drive redirection #1449
  + Other changes
  - Proprietary microphone redirection via rdpsnd is now default
    off RDP compatible microphone redirection is on instead #1427
  - Skip connecting to chansrv when no channels enabled #1393
  - Add openSUSE's pam rules (boo#1156094, #1442)
  - Do not terminate xrdp daemon when caught SIGHUP #1319
- Known issues
  + FreeRDP 2.0.0-rc4 or later might not able to connect to xrdp
    due to xrdp's bad-mannered behaviour, add `+glyph-cache` option
    to FreeRDP to connect #1266
  + Audio redirection by MP3 codec doesn't sound with some client,
    use AAC instead #965
- Drop xrdp-mkpamrules-support-usr-etc-distconfdir.patch: Fixed
  upstream</changelog>
  <changelog author="qkzhu@suse.com" date="1585051200">- Update xrdp-bsc965647-allow-admin-choose-desktop.patch:
  Add `export XDG_SESSION_TYPE=x11` in startwm.sh for SLE, since
  lacking this variable in GNOME 3.34 causes GNOME crash (bsc#1159257).</changelog>
  <changelog author="qkzhu@suse.com" date="1585051201">- Update xrdp-bsc965647-allow-admin-choose-desktop.patch:
  + Set the default session to GNOME Session for SLE.
  + Update the variables to launch SLE-Classic Session.
  (bsc#1166746).</changelog>
  <changelog author="yfjiang@suse.com" date="1587729600">- Enable SLE only patches for Leap (jsc#SLE-11850).</changelog>
  <changelog author="dimstar@opensuse.org" date="1592395200">- Use %{_libexecdir} to install the legacy initscript actions to.</changelog>
  <changelog author="yfjiang@suse.com" date="1593691200">- Update to version 0.9.13.1
  + This is a security fix release that includes fixes for the
    following local buffer overflow vulnerability (bsc#1173580):
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-4044
- Rebase xrdp-fate318398-change-expired-password.patch</changelog>
  <changelog author="yfjiang@suse.com" date="1594382400">- Update xrdp.keyring according to:
  https://github.com/neutrinolabs/xrdp/issues/1627</changelog>
  <changelog author="yfjiang@suse.com" date="1597147200">- Update xrdp-bsc965647-allow-admin-choose-desktop.patch:
  + Fallback the session to icewm when a selected desktop
    environment is not found (bsc#1171415)
  + Support plasma session for Leap 15.2
  + Give more informative comments in start_wm.sh</changelog>
  <changelog author="yfjiang@suse.com" date="1604923200">- Introduce more buffer protection fixes (jsc#SLE-11518):
  + Add xrdp-memory-allocation-security-fix.patch
  + Add xrdp-remove-unecessary-gmalloc.patch
  + Add xrdp-safe-data-chunk-reassembly.patch
- Make the serial number of SLE patches on the bottom</changelog>
  <changelog author="yu.daike@suse.com" date="1628596800">- Fix crash in xrdp-fate318398-change-expired-password.patch (bsc#1187258)</changelog>
</package>
<package pkgid="892056122ad44aa80b5f70a3941dde0a1e2ab05b9a43b27b095d4f7785dfdf17" name="xrdp" arch="src">
  <version epoch="0" ver="0.9.13.1" rel="4.12.1"/>
  <changelog author="fezhang@suse.com" date="1537963200">- Update to version 0.9.8
  + New features
  - Add TLSv1.3 support #1193
  + Deprecation notice
  - TLSv1 and TLSv1.1 are removed from the default config.
    Current default is TLSv1.2 and TLSv1.3
  + Bug fixes
  - Ensure unmount redirected drive on fatal X error #1140
  + Other changes
  - Pulseaudio modules has been removed from xrdp source tree
  - Pass pulse socket name via environment variable #1198
- Update xrdp-fate318398-change-expired-password.patch: Use
  configured values instead of hardcoded ones in login_wnd inputs</changelog>
  <changelog author="fezhang@suse.com" date="1545912000">- Update to version 0.9.9
  + New features
  - Disconnection by idle timeout (requires xorgxrdp v0.2.9 or
    later) #1227
  + Bug fixes
  - Fix xrdp-chansrv crashes caused in drive redirection #1202
    [#1225]
  - Fix build with FDK AAC v2 #1257
  - Do not enable RemoteApp if the INFO_RAIL flag is not set
    (RDP-RDP proxy) #1253
  + Other changes
  - Add Spanish Latin Amarican keyboard #1237 #1240 #1244
  - Dynamic channel improvements #1222 #1224
  - Remove some deprecated sesman session types #1232
  - Refactoring and cleanups
  + Known issues
  - FreeRDP 2.0.0-rc4 or later might not able to connect to xrdp
    due to xrdp's bad-mannered behaviour, add `+glyph-cache`
    option to FreeRDP to connect #1266
  - Audio redirection by MP3 codec doesn't sound with some
    client, use AAC instead #965
  + Refresh xrdp-default-config.patch</changelog>
  <changelog author="fezhang@suse.com" date="1556539200">- Update to version 0.9.10 (jsc#SLE-5926)
  + New features
  - Restrict outbound (server-&gt;client) clipboard transfer,
    configured in `sesman.ini` #1298
  + Bug fixes
  - Fix libscp v1 not setting width but height twice #1293
  - Fix reconnecting to session causes duplicate drive entries
    in fuse fs #1299
  - Fix default_wm and reconnect_sh refer wrong path after sesman
    caught SIGUP #1315 #1331
  - Shutdown xrdp more responsively #1325
  - Improve remote file lookup in drive redirection #996 #1327
  - Overwriting &amp; appending to existing files now supported #1327
  + Other changes
  - Add Danish Keyboard #1290
  - Put xrdp- prefix to some executables appear in man page #1313
  - Replace some URLs from SF.net to xrdp.org #1313
  + Known issues
  - FreeRDP 2.0.0-rc4 or later might not able to connect to xrdp
    due to xrdp's bad-mannered behaviour, add `+glyph-cache`
    option to FreeRDP to connect #1266
  - Audio redirection by MP3 codec doesn't sound with some
    client, use AAC instead #965</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1564142400">- Removal of SuSEfirewall2 service, since SuSEfirewall2 has been
  replaced by firewalld, see:
  https://lists.opensuse.org/opensuse-factory/2019-01/msg00490.html</changelog>
  <changelog author="fezhang@suse.com" date="1565006400">- Update xrdp-pam.patch: Include the pam_keyinit.so module in
  /etc/pam.d/xrdp-sesman to support the kernel keyrings
  (boo#1144064).</changelog>
  <changelog author="fezhang@suse.com" date="1568116800">- Add xrdp-systemd-services.patch: Let systemd handle the daemons,
  fix daemon start failures (boo#1138954, boo#1144327).</changelog>
  <changelog author="fezhang@suse.com" date="1568635200">- Update to version 0.9.11 (jsc#SLE-9612)
  + New features
  - Suppress output (do not draw screen when client window is
    minimized) #1330
  - Audio input (microphone) redirection compatible with
    MS-RDPEAI #1369
  - Now xrdp can listen on more than one port #1124 #1366
  + Bug fixes
  - Fix the issue audio redirection sometimes sounds with long
    delay #1363
  - Check term event for more responsive shutdown #1372
  + Known issues
  - FreeRDP 2.0.0-rc4 or later might not able to connect to xrdp
    due to xrdp's bad-mannered behaviour, add +glyph-cache option
    to FreeRDP to connect #1266
  - Audio redirection by MP3 codec doesn't sound with some
    client, use AAC instead #965
- Rebase xrdp-avahi.diff, worked around stdint.h definitions
- Rebase xrdp-fate319683-allow-vnc-resizing.patch</changelog>
  <changelog author="yfjiang@suse.com" date="1573646400">- Make mkpamrules additionally support SUSE's usage of
  /usr/etc/pam.d (boo#1156094, gh#neutrinolabs/xrdp!1442):
  * xrdp-mkpamrules-support-usr-etc-distconfdir.patch
  https://lists.opensuse.org/opensuse-factory/2019-08/msg00113.html</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1581163200">- Build with --enable-vsock so xrdp can be used with hyper-v
  enhanced session mode.</changelog>
  <changelog author="fzhang.foss@gmail.com" date="1583928000">- Update xrdp-avahi.diff: Fix implicit definitions errors.</changelog>
  <changelog author="fzhang.foss@gmail.com" date="1584014400">- Update to version 0.9.13
  + Bug fixes: some regressions on drive redirection #1469 #1487
    [#1505] #1507
  + Support mousex button 8/9 #1478
- Update to version 0.9.12
  + Bug fixes
  - Fix "The log reference is NULL" error when sesman startup
    [#1425]
  - Fix behavior when shmem_id changes #1439
  - Make vsock config accept -1 for cid and port #1441
  - Cleanup refresh rect and check stream bounds #1437
  - Significant improvements in drive redirection #1449
  + Other changes
  - Proprietary microphone redirection via rdpsnd is now default
    off RDP compatible microphone redirection is on instead #1427
  - Skip connecting to chansrv when no channels enabled #1393
  - Add openSUSE's pam rules (boo#1156094, #1442)
  - Do not terminate xrdp daemon when caught SIGHUP #1319
- Known issues
  + FreeRDP 2.0.0-rc4 or later might not able to connect to xrdp
    due to xrdp's bad-mannered behaviour, add `+glyph-cache` option
    to FreeRDP to connect #1266
  + Audio redirection by MP3 codec doesn't sound with some client,
    use AAC instead #965
- Drop xrdp-mkpamrules-support-usr-etc-distconfdir.patch: Fixed
  upstream</changelog>
  <changelog author="qkzhu@suse.com" date="1585051200">- Update xrdp-bsc965647-allow-admin-choose-desktop.patch:
  Add `export XDG_SESSION_TYPE=x11` in startwm.sh for SLE, since
  lacking this variable in GNOME 3.34 causes GNOME crash (bsc#1159257).</changelog>
  <changelog author="qkzhu@suse.com" date="1585051201">- Update xrdp-bsc965647-allow-admin-choose-desktop.patch:
  + Set the default session to GNOME Session for SLE.
  + Update the variables to launch SLE-Classic Session.
  (bsc#1166746).</changelog>
  <changelog author="yfjiang@suse.com" date="1587729600">- Enable SLE only patches for Leap (jsc#SLE-11850).</changelog>
  <changelog author="dimstar@opensuse.org" date="1592395200">- Use %{_libexecdir} to install the legacy initscript actions to.</changelog>
  <changelog author="yfjiang@suse.com" date="1593691200">- Update to version 0.9.13.1
  + This is a security fix release that includes fixes for the
    following local buffer overflow vulnerability (bsc#1173580):
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-4044
- Rebase xrdp-fate318398-change-expired-password.patch</changelog>
  <changelog author="yfjiang@suse.com" date="1594382400">- Update xrdp.keyring according to:
  https://github.com/neutrinolabs/xrdp/issues/1627</changelog>
  <changelog author="yfjiang@suse.com" date="1597147200">- Update xrdp-bsc965647-allow-admin-choose-desktop.patch:
  + Fallback the session to icewm when a selected desktop
    environment is not found (bsc#1171415)
  + Support plasma session for Leap 15.2
  + Give more informative comments in start_wm.sh</changelog>
  <changelog author="yfjiang@suse.com" date="1604923200">- Introduce more buffer protection fixes (jsc#SLE-11518):
  + Add xrdp-memory-allocation-security-fix.patch
  + Add xrdp-remove-unecessary-gmalloc.patch
  + Add xrdp-safe-data-chunk-reassembly.patch
- Make the serial number of SLE patches on the bottom</changelog>
  <changelog author="yu.daike@suse.com" date="1628596800">- Fix crash in xrdp-fate318398-change-expired-password.patch (bsc#1187258)</changelog>
</package>
<package pkgid="e5aa9752fa18700748fbb65ac31d5a1ca4d54a9a6fe5112850f66c141c0ea43a" name="xrdp" arch="x86_64">
  <version epoch="0" ver="0.9.13.1" rel="4.12.1"/>
  <changelog author="fezhang@suse.com" date="1537963200">- Update to version 0.9.8
  + New features
  - Add TLSv1.3 support #1193
  + Deprecation notice
  - TLSv1 and TLSv1.1 are removed from the default config.
    Current default is TLSv1.2 and TLSv1.3
  + Bug fixes
  - Ensure unmount redirected drive on fatal X error #1140
  + Other changes
  - Pulseaudio modules has been removed from xrdp source tree
  - Pass pulse socket name via environment variable #1198
- Update xrdp-fate318398-change-expired-password.patch: Use
  configured values instead of hardcoded ones in login_wnd inputs</changelog>
  <changelog author="fezhang@suse.com" date="1545912000">- Update to version 0.9.9
  + New features
  - Disconnection by idle timeout (requires xorgxrdp v0.2.9 or
    later) #1227
  + Bug fixes
  - Fix xrdp-chansrv crashes caused in drive redirection #1202
    [#1225]
  - Fix build with FDK AAC v2 #1257
  - Do not enable RemoteApp if the INFO_RAIL flag is not set
    (RDP-RDP proxy) #1253
  + Other changes
  - Add Spanish Latin Amarican keyboard #1237 #1240 #1244
  - Dynamic channel improvements #1222 #1224
  - Remove some deprecated sesman session types #1232
  - Refactoring and cleanups
  + Known issues
  - FreeRDP 2.0.0-rc4 or later might not able to connect to xrdp
    due to xrdp's bad-mannered behaviour, add `+glyph-cache`
    option to FreeRDP to connect #1266
  - Audio redirection by MP3 codec doesn't sound with some
    client, use AAC instead #965
  + Refresh xrdp-default-config.patch</changelog>
  <changelog author="fezhang@suse.com" date="1556539200">- Update to version 0.9.10 (jsc#SLE-5926)
  + New features
  - Restrict outbound (server-&gt;client) clipboard transfer,
    configured in `sesman.ini` #1298
  + Bug fixes
  - Fix libscp v1 not setting width but height twice #1293
  - Fix reconnecting to session causes duplicate drive entries
    in fuse fs #1299
  - Fix default_wm and reconnect_sh refer wrong path after sesman
    caught SIGUP #1315 #1331
  - Shutdown xrdp more responsively #1325
  - Improve remote file lookup in drive redirection #996 #1327
  - Overwriting &amp; appending to existing files now supported #1327
  + Other changes
  - Add Danish Keyboard #1290
  - Put xrdp- prefix to some executables appear in man page #1313
  - Replace some URLs from SF.net to xrdp.org #1313
  + Known issues
  - FreeRDP 2.0.0-rc4 or later might not able to connect to xrdp
    due to xrdp's bad-mannered behaviour, add `+glyph-cache`
    option to FreeRDP to connect #1266
  - Audio redirection by MP3 codec doesn't sound with some
    client, use AAC instead #965</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1564142400">- Removal of SuSEfirewall2 service, since SuSEfirewall2 has been
  replaced by firewalld, see:
  https://lists.opensuse.org/opensuse-factory/2019-01/msg00490.html</changelog>
  <changelog author="fezhang@suse.com" date="1565006400">- Update xrdp-pam.patch: Include the pam_keyinit.so module in
  /etc/pam.d/xrdp-sesman to support the kernel keyrings
  (boo#1144064).</changelog>
  <changelog author="fezhang@suse.com" date="1568116800">- Add xrdp-systemd-services.patch: Let systemd handle the daemons,
  fix daemon start failures (boo#1138954, boo#1144327).</changelog>
  <changelog author="fezhang@suse.com" date="1568635200">- Update to version 0.9.11 (jsc#SLE-9612)
  + New features
  - Suppress output (do not draw screen when client window is
    minimized) #1330
  - Audio input (microphone) redirection compatible with
    MS-RDPEAI #1369
  - Now xrdp can listen on more than one port #1124 #1366
  + Bug fixes
  - Fix the issue audio redirection sometimes sounds with long
    delay #1363
  - Check term event for more responsive shutdown #1372
  + Known issues
  - FreeRDP 2.0.0-rc4 or later might not able to connect to xrdp
    due to xrdp's bad-mannered behaviour, add +glyph-cache option
    to FreeRDP to connect #1266
  - Audio redirection by MP3 codec doesn't sound with some
    client, use AAC instead #965
- Rebase xrdp-avahi.diff, worked around stdint.h definitions
- Rebase xrdp-fate319683-allow-vnc-resizing.patch</changelog>
  <changelog author="yfjiang@suse.com" date="1573646400">- Make mkpamrules additionally support SUSE's usage of
  /usr/etc/pam.d (boo#1156094, gh#neutrinolabs/xrdp!1442):
  * xrdp-mkpamrules-support-usr-etc-distconfdir.patch
  https://lists.opensuse.org/opensuse-factory/2019-08/msg00113.html</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1581163200">- Build with --enable-vsock so xrdp can be used with hyper-v
  enhanced session mode.</changelog>
  <changelog author="fzhang.foss@gmail.com" date="1583928000">- Update xrdp-avahi.diff: Fix implicit definitions errors.</changelog>
  <changelog author="fzhang.foss@gmail.com" date="1584014400">- Update to version 0.9.13
  + Bug fixes: some regressions on drive redirection #1469 #1487
    [#1505] #1507
  + Support mousex button 8/9 #1478
- Update to version 0.9.12
  + Bug fixes
  - Fix "The log reference is NULL" error when sesman startup
    [#1425]
  - Fix behavior when shmem_id changes #1439
  - Make vsock config accept -1 for cid and port #1441
  - Cleanup refresh rect and check stream bounds #1437
  - Significant improvements in drive redirection #1449
  + Other changes
  - Proprietary microphone redirection via rdpsnd is now default
    off RDP compatible microphone redirection is on instead #1427
  - Skip connecting to chansrv when no channels enabled #1393
  - Add openSUSE's pam rules (boo#1156094, #1442)
  - Do not terminate xrdp daemon when caught SIGHUP #1319
- Known issues
  + FreeRDP 2.0.0-rc4 or later might not able to connect to xrdp
    due to xrdp's bad-mannered behaviour, add `+glyph-cache` option
    to FreeRDP to connect #1266
  + Audio redirection by MP3 codec doesn't sound with some client,
    use AAC instead #965
- Drop xrdp-mkpamrules-support-usr-etc-distconfdir.patch: Fixed
  upstream</changelog>
  <changelog author="qkzhu@suse.com" date="1585051200">- Update xrdp-bsc965647-allow-admin-choose-desktop.patch:
  Add `export XDG_SESSION_TYPE=x11` in startwm.sh for SLE, since
  lacking this variable in GNOME 3.34 causes GNOME crash (bsc#1159257).</changelog>
  <changelog author="qkzhu@suse.com" date="1585051201">- Update xrdp-bsc965647-allow-admin-choose-desktop.patch:
  + Set the default session to GNOME Session for SLE.
  + Update the variables to launch SLE-Classic Session.
  (bsc#1166746).</changelog>
  <changelog author="yfjiang@suse.com" date="1587729600">- Enable SLE only patches for Leap (jsc#SLE-11850).</changelog>
  <changelog author="dimstar@opensuse.org" date="1592395200">- Use %{_libexecdir} to install the legacy initscript actions to.</changelog>
  <changelog author="yfjiang@suse.com" date="1593691200">- Update to version 0.9.13.1
  + This is a security fix release that includes fixes for the
    following local buffer overflow vulnerability (bsc#1173580):
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-4044
- Rebase xrdp-fate318398-change-expired-password.patch</changelog>
  <changelog author="yfjiang@suse.com" date="1594382400">- Update xrdp.keyring according to:
  https://github.com/neutrinolabs/xrdp/issues/1627</changelog>
  <changelog author="yfjiang@suse.com" date="1597147200">- Update xrdp-bsc965647-allow-admin-choose-desktop.patch:
  + Fallback the session to icewm when a selected desktop
    environment is not found (bsc#1171415)
  + Support plasma session for Leap 15.2
  + Give more informative comments in start_wm.sh</changelog>
  <changelog author="yfjiang@suse.com" date="1604923200">- Introduce more buffer protection fixes (jsc#SLE-11518):
  + Add xrdp-memory-allocation-security-fix.patch
  + Add xrdp-remove-unecessary-gmalloc.patch
  + Add xrdp-safe-data-chunk-reassembly.patch
- Make the serial number of SLE patches on the bottom</changelog>
  <changelog author="yu.daike@suse.com" date="1628596800">- Fix crash in xrdp-fate318398-change-expired-password.patch (bsc#1187258)</changelog>
</package>
<package pkgid="8190e9c7e061059195e68cbab8a0a2227f67391f36444050fce6cd9e17adfd6a" name="xrdp-devel" arch="aarch64">
  <version epoch="0" ver="0.9.13.1" rel="4.12.1"/>
  <changelog author="fezhang@suse.com" date="1537963200">- Update to version 0.9.8
  + New features
  - Add TLSv1.3 support #1193
  + Deprecation notice
  - TLSv1 and TLSv1.1 are removed from the default config.
    Current default is TLSv1.2 and TLSv1.3
  + Bug fixes
  - Ensure unmount redirected drive on fatal X error #1140
  + Other changes
  - Pulseaudio modules has been removed from xrdp source tree
  - Pass pulse socket name via environment variable #1198
- Update xrdp-fate318398-change-expired-password.patch: Use
  configured values instead of hardcoded ones in login_wnd inputs</changelog>
  <changelog author="fezhang@suse.com" date="1545912000">- Update to version 0.9.9
  + New features
  - Disconnection by idle timeout (requires xorgxrdp v0.2.9 or
    later) #1227
  + Bug fixes
  - Fix xrdp-chansrv crashes caused in drive redirection #1202
    [#1225]
  - Fix build with FDK AAC v2 #1257
  - Do not enable RemoteApp if the INFO_RAIL flag is not set
    (RDP-RDP proxy) #1253
  + Other changes
  - Add Spanish Latin Amarican keyboard #1237 #1240 #1244
  - Dynamic channel improvements #1222 #1224
  - Remove some deprecated sesman session types #1232
  - Refactoring and cleanups
  + Known issues
  - FreeRDP 2.0.0-rc4 or later might not able to connect to xrdp
    due to xrdp's bad-mannered behaviour, add `+glyph-cache`
    option to FreeRDP to connect #1266
  - Audio redirection by MP3 codec doesn't sound with some
    client, use AAC instead #965
  + Refresh xrdp-default-config.patch</changelog>
  <changelog author="fezhang@suse.com" date="1556539200">- Update to version 0.9.10 (jsc#SLE-5926)
  + New features
  - Restrict outbound (server-&gt;client) clipboard transfer,
    configured in `sesman.ini` #1298
  + Bug fixes
  - Fix libscp v1 not setting width but height twice #1293
  - Fix reconnecting to session causes duplicate drive entries
    in fuse fs #1299
  - Fix default_wm and reconnect_sh refer wrong path after sesman
    caught SIGUP #1315 #1331
  - Shutdown xrdp more responsively #1325
  - Improve remote file lookup in drive redirection #996 #1327
  - Overwriting &amp; appending to existing files now supported #1327
  + Other changes
  - Add Danish Keyboard #1290
  - Put xrdp- prefix to some executables appear in man page #1313
  - Replace some URLs from SF.net to xrdp.org #1313
  + Known issues
  - FreeRDP 2.0.0-rc4 or later might not able to connect to xrdp
    due to xrdp's bad-mannered behaviour, add `+glyph-cache`
    option to FreeRDP to connect #1266
  - Audio redirection by MP3 codec doesn't sound with some
    client, use AAC instead #965</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1564142400">- Removal of SuSEfirewall2 service, since SuSEfirewall2 has been
  replaced by firewalld, see:
  https://lists.opensuse.org/opensuse-factory/2019-01/msg00490.html</changelog>
  <changelog author="fezhang@suse.com" date="1565006400">- Update xrdp-pam.patch: Include the pam_keyinit.so module in
  /etc/pam.d/xrdp-sesman to support the kernel keyrings
  (boo#1144064).</changelog>
  <changelog author="fezhang@suse.com" date="1568116800">- Add xrdp-systemd-services.patch: Let systemd handle the daemons,
  fix daemon start failures (boo#1138954, boo#1144327).</changelog>
  <changelog author="fezhang@suse.com" date="1568635200">- Update to version 0.9.11 (jsc#SLE-9612)
  + New features
  - Suppress output (do not draw screen when client window is
    minimized) #1330
  - Audio input (microphone) redirection compatible with
    MS-RDPEAI #1369
  - Now xrdp can listen on more than one port #1124 #1366
  + Bug fixes
  - Fix the issue audio redirection sometimes sounds with long
    delay #1363
  - Check term event for more responsive shutdown #1372
  + Known issues
  - FreeRDP 2.0.0-rc4 or later might not able to connect to xrdp
    due to xrdp's bad-mannered behaviour, add +glyph-cache option
    to FreeRDP to connect #1266
  - Audio redirection by MP3 codec doesn't sound with some
    client, use AAC instead #965
- Rebase xrdp-avahi.diff, worked around stdint.h definitions
- Rebase xrdp-fate319683-allow-vnc-resizing.patch</changelog>
  <changelog author="yfjiang@suse.com" date="1573646400">- Make mkpamrules additionally support SUSE's usage of
  /usr/etc/pam.d (boo#1156094, gh#neutrinolabs/xrdp!1442):
  * xrdp-mkpamrules-support-usr-etc-distconfdir.patch
  https://lists.opensuse.org/opensuse-factory/2019-08/msg00113.html</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1581163200">- Build with --enable-vsock so xrdp can be used with hyper-v
  enhanced session mode.</changelog>
  <changelog author="fzhang.foss@gmail.com" date="1583928000">- Update xrdp-avahi.diff: Fix implicit definitions errors.</changelog>
  <changelog author="fzhang.foss@gmail.com" date="1584014400">- Update to version 0.9.13
  + Bug fixes: some regressions on drive redirection #1469 #1487
    [#1505] #1507
  + Support mousex button 8/9 #1478
- Update to version 0.9.12
  + Bug fixes
  - Fix "The log reference is NULL" error when sesman startup
    [#1425]
  - Fix behavior when shmem_id changes #1439
  - Make vsock config accept -1 for cid and port #1441
  - Cleanup refresh rect and check stream bounds #1437
  - Significant improvements in drive redirection #1449
  + Other changes
  - Proprietary microphone redirection via rdpsnd is now default
    off RDP compatible microphone redirection is on instead #1427
  - Skip connecting to chansrv when no channels enabled #1393
  - Add openSUSE's pam rules (boo#1156094, #1442)
  - Do not terminate xrdp daemon when caught SIGHUP #1319
- Known issues
  + FreeRDP 2.0.0-rc4 or later might not able to connect to xrdp
    due to xrdp's bad-mannered behaviour, add `+glyph-cache` option
    to FreeRDP to connect #1266
  + Audio redirection by MP3 codec doesn't sound with some client,
    use AAC instead #965
- Drop xrdp-mkpamrules-support-usr-etc-distconfdir.patch: Fixed
  upstream</changelog>
  <changelog author="qkzhu@suse.com" date="1585051200">- Update xrdp-bsc965647-allow-admin-choose-desktop.patch:
  Add `export XDG_SESSION_TYPE=x11` in startwm.sh for SLE, since
  lacking this variable in GNOME 3.34 causes GNOME crash (bsc#1159257).</changelog>
  <changelog author="qkzhu@suse.com" date="1585051201">- Update xrdp-bsc965647-allow-admin-choose-desktop.patch:
  + Set the default session to GNOME Session for SLE.
  + Update the variables to launch SLE-Classic Session.
  (bsc#1166746).</changelog>
  <changelog author="yfjiang@suse.com" date="1587729600">- Enable SLE only patches for Leap (jsc#SLE-11850).</changelog>
  <changelog author="dimstar@opensuse.org" date="1592395200">- Use %{_libexecdir} to install the legacy initscript actions to.</changelog>
  <changelog author="yfjiang@suse.com" date="1593691200">- Update to version 0.9.13.1
  + This is a security fix release that includes fixes for the
    following local buffer overflow vulnerability (bsc#1173580):
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-4044
- Rebase xrdp-fate318398-change-expired-password.patch</changelog>
  <changelog author="yfjiang@suse.com" date="1594382400">- Update xrdp.keyring according to:
  https://github.com/neutrinolabs/xrdp/issues/1627</changelog>
  <changelog author="yfjiang@suse.com" date="1597147200">- Update xrdp-bsc965647-allow-admin-choose-desktop.patch:
  + Fallback the session to icewm when a selected desktop
    environment is not found (bsc#1171415)
  + Support plasma session for Leap 15.2
  + Give more informative comments in start_wm.sh</changelog>
  <changelog author="yfjiang@suse.com" date="1604923200">- Introduce more buffer protection fixes (jsc#SLE-11518):
  + Add xrdp-memory-allocation-security-fix.patch
  + Add xrdp-remove-unecessary-gmalloc.patch
  + Add xrdp-safe-data-chunk-reassembly.patch
- Make the serial number of SLE patches on the bottom</changelog>
  <changelog author="yu.daike@suse.com" date="1628596800">- Fix crash in xrdp-fate318398-change-expired-password.patch (bsc#1187258)</changelog>
</package>
<package pkgid="53f3b251570bc517ed976fb93b18f84b18f05b60cbbc5ecc41227bf0db64d25b" name="xrdp-devel" arch="ppc64le">
  <version epoch="0" ver="0.9.13.1" rel="4.12.1"/>
  <changelog author="fezhang@suse.com" date="1537963200">- Update to version 0.9.8
  + New features
  - Add TLSv1.3 support #1193
  + Deprecation notice
  - TLSv1 and TLSv1.1 are removed from the default config.
    Current default is TLSv1.2 and TLSv1.3
  + Bug fixes
  - Ensure unmount redirected drive on fatal X error #1140
  + Other changes
  - Pulseaudio modules has been removed from xrdp source tree
  - Pass pulse socket name via environment variable #1198
- Update xrdp-fate318398-change-expired-password.patch: Use
  configured values instead of hardcoded ones in login_wnd inputs</changelog>
  <changelog author="fezhang@suse.com" date="1545912000">- Update to version 0.9.9
  + New features
  - Disconnection by idle timeout (requires xorgxrdp v0.2.9 or
    later) #1227
  + Bug fixes
  - Fix xrdp-chansrv crashes caused in drive redirection #1202
    [#1225]
  - Fix build with FDK AAC v2 #1257
  - Do not enable RemoteApp if the INFO_RAIL flag is not set
    (RDP-RDP proxy) #1253
  + Other changes
  - Add Spanish Latin Amarican keyboard #1237 #1240 #1244
  - Dynamic channel improvements #1222 #1224
  - Remove some deprecated sesman session types #1232
  - Refactoring and cleanups
  + Known issues
  - FreeRDP 2.0.0-rc4 or later might not able to connect to xrdp
    due to xrdp's bad-mannered behaviour, add `+glyph-cache`
    option to FreeRDP to connect #1266
  - Audio redirection by MP3 codec doesn't sound with some
    client, use AAC instead #965
  + Refresh xrdp-default-config.patch</changelog>
  <changelog author="fezhang@suse.com" date="1556539200">- Update to version 0.9.10 (jsc#SLE-5926)
  + New features
  - Restrict outbound (server-&gt;client) clipboard transfer,
    configured in `sesman.ini` #1298
  + Bug fixes
  - Fix libscp v1 not setting width but height twice #1293
  - Fix reconnecting to session causes duplicate drive entries
    in fuse fs #1299
  - Fix default_wm and reconnect_sh refer wrong path after sesman
    caught SIGUP #1315 #1331
  - Shutdown xrdp more responsively #1325
  - Improve remote file lookup in drive redirection #996 #1327
  - Overwriting &amp; appending to existing files now supported #1327
  + Other changes
  - Add Danish Keyboard #1290
  - Put xrdp- prefix to some executables appear in man page #1313
  - Replace some URLs from SF.net to xrdp.org #1313
  + Known issues
  - FreeRDP 2.0.0-rc4 or later might not able to connect to xrdp
    due to xrdp's bad-mannered behaviour, add `+glyph-cache`
    option to FreeRDP to connect #1266
  - Audio redirection by MP3 codec doesn't sound with some
    client, use AAC instead #965</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1564142400">- Removal of SuSEfirewall2 service, since SuSEfirewall2 has been
  replaced by firewalld, see:
  https://lists.opensuse.org/opensuse-factory/2019-01/msg00490.html</changelog>
  <changelog author="fezhang@suse.com" date="1565006400">- Update xrdp-pam.patch: Include the pam_keyinit.so module in
  /etc/pam.d/xrdp-sesman to support the kernel keyrings
  (boo#1144064).</changelog>
  <changelog author="fezhang@suse.com" date="1568116800">- Add xrdp-systemd-services.patch: Let systemd handle the daemons,
  fix daemon start failures (boo#1138954, boo#1144327).</changelog>
  <changelog author="fezhang@suse.com" date="1568635200">- Update to version 0.9.11 (jsc#SLE-9612)
  + New features
  - Suppress output (do not draw screen when client window is
    minimized) #1330
  - Audio input (microphone) redirection compatible with
    MS-RDPEAI #1369
  - Now xrdp can listen on more than one port #1124 #1366
  + Bug fixes
  - Fix the issue audio redirection sometimes sounds with long
    delay #1363
  - Check term event for more responsive shutdown #1372
  + Known issues
  - FreeRDP 2.0.0-rc4 or later might not able to connect to xrdp
    due to xrdp's bad-mannered behaviour, add +glyph-cache option
    to FreeRDP to connect #1266
  - Audio redirection by MP3 codec doesn't sound with some
    client, use AAC instead #965
- Rebase xrdp-avahi.diff, worked around stdint.h definitions
- Rebase xrdp-fate319683-allow-vnc-resizing.patch</changelog>
  <changelog author="yfjiang@suse.com" date="1573646400">- Make mkpamrules additionally support SUSE's usage of
  /usr/etc/pam.d (boo#1156094, gh#neutrinolabs/xrdp!1442):
  * xrdp-mkpamrules-support-usr-etc-distconfdir.patch
  https://lists.opensuse.org/opensuse-factory/2019-08/msg00113.html</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1581163200">- Build with --enable-vsock so xrdp can be used with hyper-v
  enhanced session mode.</changelog>
  <changelog author="fzhang.foss@gmail.com" date="1583928000">- Update xrdp-avahi.diff: Fix implicit definitions errors.</changelog>
  <changelog author="fzhang.foss@gmail.com" date="1584014400">- Update to version 0.9.13
  + Bug fixes: some regressions on drive redirection #1469 #1487
    [#1505] #1507
  + Support mousex button 8/9 #1478
- Update to version 0.9.12
  + Bug fixes
  - Fix "The log reference is NULL" error when sesman startup
    [#1425]
  - Fix behavior when shmem_id changes #1439
  - Make vsock config accept -1 for cid and port #1441
  - Cleanup refresh rect and check stream bounds #1437
  - Significant improvements in drive redirection #1449
  + Other changes
  - Proprietary microphone redirection via rdpsnd is now default
    off RDP compatible microphone redirection is on instead #1427
  - Skip connecting to chansrv when no channels enabled #1393
  - Add openSUSE's pam rules (boo#1156094, #1442)
  - Do not terminate xrdp daemon when caught SIGHUP #1319
- Known issues
  + FreeRDP 2.0.0-rc4 or later might not able to connect to xrdp
    due to xrdp's bad-mannered behaviour, add `+glyph-cache` option
    to FreeRDP to connect #1266
  + Audio redirection by MP3 codec doesn't sound with some client,
    use AAC instead #965
- Drop xrdp-mkpamrules-support-usr-etc-distconfdir.patch: Fixed
  upstream</changelog>
  <changelog author="qkzhu@suse.com" date="1585051200">- Update xrdp-bsc965647-allow-admin-choose-desktop.patch:
  Add `export XDG_SESSION_TYPE=x11` in startwm.sh for SLE, since
  lacking this variable in GNOME 3.34 causes GNOME crash (bsc#1159257).</changelog>
  <changelog author="qkzhu@suse.com" date="1585051201">- Update xrdp-bsc965647-allow-admin-choose-desktop.patch:
  + Set the default session to GNOME Session for SLE.
  + Update the variables to launch SLE-Classic Session.
  (bsc#1166746).</changelog>
  <changelog author="yfjiang@suse.com" date="1587729600">- Enable SLE only patches for Leap (jsc#SLE-11850).</changelog>
  <changelog author="dimstar@opensuse.org" date="1592395200">- Use %{_libexecdir} to install the legacy initscript actions to.</changelog>
  <changelog author="yfjiang@suse.com" date="1593691200">- Update to version 0.9.13.1
  + This is a security fix release that includes fixes for the
    following local buffer overflow vulnerability (bsc#1173580):
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-4044
- Rebase xrdp-fate318398-change-expired-password.patch</changelog>
  <changelog author="yfjiang@suse.com" date="1594382400">- Update xrdp.keyring according to:
  https://github.com/neutrinolabs/xrdp/issues/1627</changelog>
  <changelog author="yfjiang@suse.com" date="1597147200">- Update xrdp-bsc965647-allow-admin-choose-desktop.patch:
  + Fallback the session to icewm when a selected desktop
    environment is not found (bsc#1171415)
  + Support plasma session for Leap 15.2
  + Give more informative comments in start_wm.sh</changelog>
  <changelog author="yfjiang@suse.com" date="1604923200">- Introduce more buffer protection fixes (jsc#SLE-11518):
  + Add xrdp-memory-allocation-security-fix.patch
  + Add xrdp-remove-unecessary-gmalloc.patch
  + Add xrdp-safe-data-chunk-reassembly.patch
- Make the serial number of SLE patches on the bottom</changelog>
  <changelog author="yu.daike@suse.com" date="1628596800">- Fix crash in xrdp-fate318398-change-expired-password.patch (bsc#1187258)</changelog>
</package>
<package pkgid="7fcaec65c08868c317b4beb8f5f122ac2e0eb7da8ae209fc85931086ef8bd146" name="xrdp-devel" arch="s390x">
  <version epoch="0" ver="0.9.13.1" rel="4.12.1"/>
  <changelog author="fezhang@suse.com" date="1537963200">- Update to version 0.9.8
  + New features
  - Add TLSv1.3 support #1193
  + Deprecation notice
  - TLSv1 and TLSv1.1 are removed from the default config.
    Current default is TLSv1.2 and TLSv1.3
  + Bug fixes
  - Ensure unmount redirected drive on fatal X error #1140
  + Other changes
  - Pulseaudio modules has been removed from xrdp source tree
  - Pass pulse socket name via environment variable #1198
- Update xrdp-fate318398-change-expired-password.patch: Use
  configured values instead of hardcoded ones in login_wnd inputs</changelog>
  <changelog author="fezhang@suse.com" date="1545912000">- Update to version 0.9.9
  + New features
  - Disconnection by idle timeout (requires xorgxrdp v0.2.9 or
    later) #1227
  + Bug fixes
  - Fix xrdp-chansrv crashes caused in drive redirection #1202
    [#1225]
  - Fix build with FDK AAC v2 #1257
  - Do not enable RemoteApp if the INFO_RAIL flag is not set
    (RDP-RDP proxy) #1253
  + Other changes
  - Add Spanish Latin Amarican keyboard #1237 #1240 #1244
  - Dynamic channel improvements #1222 #1224
  - Remove some deprecated sesman session types #1232
  - Refactoring and cleanups
  + Known issues
  - FreeRDP 2.0.0-rc4 or later might not able to connect to xrdp
    due to xrdp's bad-mannered behaviour, add `+glyph-cache`
    option to FreeRDP to connect #1266
  - Audio redirection by MP3 codec doesn't sound with some
    client, use AAC instead #965
  + Refresh xrdp-default-config.patch</changelog>
  <changelog author="fezhang@suse.com" date="1556539200">- Update to version 0.9.10 (jsc#SLE-5926)
  + New features
  - Restrict outbound (server-&gt;client) clipboard transfer,
    configured in `sesman.ini` #1298
  + Bug fixes
  - Fix libscp v1 not setting width but height twice #1293
  - Fix reconnecting to session causes duplicate drive entries
    in fuse fs #1299
  - Fix default_wm and reconnect_sh refer wrong path after sesman
    caught SIGUP #1315 #1331
  - Shutdown xrdp more responsively #1325
  - Improve remote file lookup in drive redirection #996 #1327
  - Overwriting &amp; appending to existing files now supported #1327
  + Other changes
  - Add Danish Keyboard #1290
  - Put xrdp- prefix to some executables appear in man page #1313
  - Replace some URLs from SF.net to xrdp.org #1313
  + Known issues
  - FreeRDP 2.0.0-rc4 or later might not able to connect to xrdp
    due to xrdp's bad-mannered behaviour, add `+glyph-cache`
    option to FreeRDP to connect #1266
  - Audio redirection by MP3 codec doesn't sound with some
    client, use AAC instead #965</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1564142400">- Removal of SuSEfirewall2 service, since SuSEfirewall2 has been
  replaced by firewalld, see:
  https://lists.opensuse.org/opensuse-factory/2019-01/msg00490.html</changelog>
  <changelog author="fezhang@suse.com" date="1565006400">- Update xrdp-pam.patch: Include the pam_keyinit.so module in
  /etc/pam.d/xrdp-sesman to support the kernel keyrings
  (boo#1144064).</changelog>
  <changelog author="fezhang@suse.com" date="1568116800">- Add xrdp-systemd-services.patch: Let systemd handle the daemons,
  fix daemon start failures (boo#1138954, boo#1144327).</changelog>
  <changelog author="fezhang@suse.com" date="1568635200">- Update to version 0.9.11 (jsc#SLE-9612)
  + New features
  - Suppress output (do not draw screen when client window is
    minimized) #1330
  - Audio input (microphone) redirection compatible with
    MS-RDPEAI #1369
  - Now xrdp can listen on more than one port #1124 #1366
  + Bug fixes
  - Fix the issue audio redirection sometimes sounds with long
    delay #1363
  - Check term event for more responsive shutdown #1372
  + Known issues
  - FreeRDP 2.0.0-rc4 or later might not able to connect to xrdp
    due to xrdp's bad-mannered behaviour, add +glyph-cache option
    to FreeRDP to connect #1266
  - Audio redirection by MP3 codec doesn't sound with some
    client, use AAC instead #965
- Rebase xrdp-avahi.diff, worked around stdint.h definitions
- Rebase xrdp-fate319683-allow-vnc-resizing.patch</changelog>
  <changelog author="yfjiang@suse.com" date="1573646400">- Make mkpamrules additionally support SUSE's usage of
  /usr/etc/pam.d (boo#1156094, gh#neutrinolabs/xrdp!1442):
  * xrdp-mkpamrules-support-usr-etc-distconfdir.patch
  https://lists.opensuse.org/opensuse-factory/2019-08/msg00113.html</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1581163200">- Build with --enable-vsock so xrdp can be used with hyper-v
  enhanced session mode.</changelog>
  <changelog author="fzhang.foss@gmail.com" date="1583928000">- Update xrdp-avahi.diff: Fix implicit definitions errors.</changelog>
  <changelog author="fzhang.foss@gmail.com" date="1584014400">- Update to version 0.9.13
  + Bug fixes: some regressions on drive redirection #1469 #1487
    [#1505] #1507
  + Support mousex button 8/9 #1478
- Update to version 0.9.12
  + Bug fixes
  - Fix "The log reference is NULL" error when sesman startup
    [#1425]
  - Fix behavior when shmem_id changes #1439
  - Make vsock config accept -1 for cid and port #1441
  - Cleanup refresh rect and check stream bounds #1437
  - Significant improvements in drive redirection #1449
  + Other changes
  - Proprietary microphone redirection via rdpsnd is now default
    off RDP compatible microphone redirection is on instead #1427
  - Skip connecting to chansrv when no channels enabled #1393
  - Add openSUSE's pam rules (boo#1156094, #1442)
  - Do not terminate xrdp daemon when caught SIGHUP #1319
- Known issues
  + FreeRDP 2.0.0-rc4 or later might not able to connect to xrdp
    due to xrdp's bad-mannered behaviour, add `+glyph-cache` option
    to FreeRDP to connect #1266
  + Audio redirection by MP3 codec doesn't sound with some client,
    use AAC instead #965
- Drop xrdp-mkpamrules-support-usr-etc-distconfdir.patch: Fixed
  upstream</changelog>
  <changelog author="qkzhu@suse.com" date="1585051200">- Update xrdp-bsc965647-allow-admin-choose-desktop.patch:
  Add `export XDG_SESSION_TYPE=x11` in startwm.sh for SLE, since
  lacking this variable in GNOME 3.34 causes GNOME crash (bsc#1159257).</changelog>
  <changelog author="qkzhu@suse.com" date="1585051201">- Update xrdp-bsc965647-allow-admin-choose-desktop.patch:
  + Set the default session to GNOME Session for SLE.
  + Update the variables to launch SLE-Classic Session.
  (bsc#1166746).</changelog>
  <changelog author="yfjiang@suse.com" date="1587729600">- Enable SLE only patches for Leap (jsc#SLE-11850).</changelog>
  <changelog author="dimstar@opensuse.org" date="1592395200">- Use %{_libexecdir} to install the legacy initscript actions to.</changelog>
  <changelog author="yfjiang@suse.com" date="1593691200">- Update to version 0.9.13.1
  + This is a security fix release that includes fixes for the
    following local buffer overflow vulnerability (bsc#1173580):
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-4044
- Rebase xrdp-fate318398-change-expired-password.patch</changelog>
  <changelog author="yfjiang@suse.com" date="1594382400">- Update xrdp.keyring according to:
  https://github.com/neutrinolabs/xrdp/issues/1627</changelog>
  <changelog author="yfjiang@suse.com" date="1597147200">- Update xrdp-bsc965647-allow-admin-choose-desktop.patch:
  + Fallback the session to icewm when a selected desktop
    environment is not found (bsc#1171415)
  + Support plasma session for Leap 15.2
  + Give more informative comments in start_wm.sh</changelog>
  <changelog author="yfjiang@suse.com" date="1604923200">- Introduce more buffer protection fixes (jsc#SLE-11518):
  + Add xrdp-memory-allocation-security-fix.patch
  + Add xrdp-remove-unecessary-gmalloc.patch
  + Add xrdp-safe-data-chunk-reassembly.patch
- Make the serial number of SLE patches on the bottom</changelog>
  <changelog author="yu.daike@suse.com" date="1628596800">- Fix crash in xrdp-fate318398-change-expired-password.patch (bsc#1187258)</changelog>
</package>
<package pkgid="1309e50c31149ae68c6de131e1f5c05bea7ee500b51f3c5e759363fb696c54a4" name="xrdp-devel" arch="x86_64">
  <version epoch="0" ver="0.9.13.1" rel="4.12.1"/>
  <changelog author="fezhang@suse.com" date="1537963200">- Update to version 0.9.8
  + New features
  - Add TLSv1.3 support #1193
  + Deprecation notice
  - TLSv1 and TLSv1.1 are removed from the default config.
    Current default is TLSv1.2 and TLSv1.3
  + Bug fixes
  - Ensure unmount redirected drive on fatal X error #1140
  + Other changes
  - Pulseaudio modules has been removed from xrdp source tree
  - Pass pulse socket name via environment variable #1198
- Update xrdp-fate318398-change-expired-password.patch: Use
  configured values instead of hardcoded ones in login_wnd inputs</changelog>
  <changelog author="fezhang@suse.com" date="1545912000">- Update to version 0.9.9
  + New features
  - Disconnection by idle timeout (requires xorgxrdp v0.2.9 or
    later) #1227
  + Bug fixes
  - Fix xrdp-chansrv crashes caused in drive redirection #1202
    [#1225]
  - Fix build with FDK AAC v2 #1257
  - Do not enable RemoteApp if the INFO_RAIL flag is not set
    (RDP-RDP proxy) #1253
  + Other changes
  - Add Spanish Latin Amarican keyboard #1237 #1240 #1244
  - Dynamic channel improvements #1222 #1224
  - Remove some deprecated sesman session types #1232
  - Refactoring and cleanups
  + Known issues
  - FreeRDP 2.0.0-rc4 or later might not able to connect to xrdp
    due to xrdp's bad-mannered behaviour, add `+glyph-cache`
    option to FreeRDP to connect #1266
  - Audio redirection by MP3 codec doesn't sound with some
    client, use AAC instead #965
  + Refresh xrdp-default-config.patch</changelog>
  <changelog author="fezhang@suse.com" date="1556539200">- Update to version 0.9.10 (jsc#SLE-5926)
  + New features
  - Restrict outbound (server-&gt;client) clipboard transfer,
    configured in `sesman.ini` #1298
  + Bug fixes
  - Fix libscp v1 not setting width but height twice #1293
  - Fix reconnecting to session causes duplicate drive entries
    in fuse fs #1299
  - Fix default_wm and reconnect_sh refer wrong path after sesman
    caught SIGUP #1315 #1331
  - Shutdown xrdp more responsively #1325
  - Improve remote file lookup in drive redirection #996 #1327
  - Overwriting &amp; appending to existing files now supported #1327
  + Other changes
  - Add Danish Keyboard #1290
  - Put xrdp- prefix to some executables appear in man page #1313
  - Replace some URLs from SF.net to xrdp.org #1313
  + Known issues
  - FreeRDP 2.0.0-rc4 or later might not able to connect to xrdp
    due to xrdp's bad-mannered behaviour, add `+glyph-cache`
    option to FreeRDP to connect #1266
  - Audio redirection by MP3 codec doesn't sound with some
    client, use AAC instead #965</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1564142400">- Removal of SuSEfirewall2 service, since SuSEfirewall2 has been
  replaced by firewalld, see:
  https://lists.opensuse.org/opensuse-factory/2019-01/msg00490.html</changelog>
  <changelog author="fezhang@suse.com" date="1565006400">- Update xrdp-pam.patch: Include the pam_keyinit.so module in
  /etc/pam.d/xrdp-sesman to support the kernel keyrings
  (boo#1144064).</changelog>
  <changelog author="fezhang@suse.com" date="1568116800">- Add xrdp-systemd-services.patch: Let systemd handle the daemons,
  fix daemon start failures (boo#1138954, boo#1144327).</changelog>
  <changelog author="fezhang@suse.com" date="1568635200">- Update to version 0.9.11 (jsc#SLE-9612)
  + New features
  - Suppress output (do not draw screen when client window is
    minimized) #1330
  - Audio input (microphone) redirection compatible with
    MS-RDPEAI #1369
  - Now xrdp can listen on more than one port #1124 #1366
  + Bug fixes
  - Fix the issue audio redirection sometimes sounds with long
    delay #1363
  - Check term event for more responsive shutdown #1372
  + Known issues
  - FreeRDP 2.0.0-rc4 or later might not able to connect to xrdp
    due to xrdp's bad-mannered behaviour, add +glyph-cache option
    to FreeRDP to connect #1266
  - Audio redirection by MP3 codec doesn't sound with some
    client, use AAC instead #965
- Rebase xrdp-avahi.diff, worked around stdint.h definitions
- Rebase xrdp-fate319683-allow-vnc-resizing.patch</changelog>
  <changelog author="yfjiang@suse.com" date="1573646400">- Make mkpamrules additionally support SUSE's usage of
  /usr/etc/pam.d (boo#1156094, gh#neutrinolabs/xrdp!1442):
  * xrdp-mkpamrules-support-usr-etc-distconfdir.patch
  https://lists.opensuse.org/opensuse-factory/2019-08/msg00113.html</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1581163200">- Build with --enable-vsock so xrdp can be used with hyper-v
  enhanced session mode.</changelog>
  <changelog author="fzhang.foss@gmail.com" date="1583928000">- Update xrdp-avahi.diff: Fix implicit definitions errors.</changelog>
  <changelog author="fzhang.foss@gmail.com" date="1584014400">- Update to version 0.9.13
  + Bug fixes: some regressions on drive redirection #1469 #1487
    [#1505] #1507
  + Support mousex button 8/9 #1478
- Update to version 0.9.12
  + Bug fixes
  - Fix "The log reference is NULL" error when sesman startup
    [#1425]
  - Fix behavior when shmem_id changes #1439
  - Make vsock config accept -1 for cid and port #1441
  - Cleanup refresh rect and check stream bounds #1437
  - Significant improvements in drive redirection #1449
  + Other changes
  - Proprietary microphone redirection via rdpsnd is now default
    off RDP compatible microphone redirection is on instead #1427
  - Skip connecting to chansrv when no channels enabled #1393
  - Add openSUSE's pam rules (boo#1156094, #1442)
  - Do not terminate xrdp daemon when caught SIGHUP #1319
- Known issues
  + FreeRDP 2.0.0-rc4 or later might not able to connect to xrdp
    due to xrdp's bad-mannered behaviour, add `+glyph-cache` option
    to FreeRDP to connect #1266
  + Audio redirection by MP3 codec doesn't sound with some client,
    use AAC instead #965
- Drop xrdp-mkpamrules-support-usr-etc-distconfdir.patch: Fixed
  upstream</changelog>
  <changelog author="qkzhu@suse.com" date="1585051200">- Update xrdp-bsc965647-allow-admin-choose-desktop.patch:
  Add `export XDG_SESSION_TYPE=x11` in startwm.sh for SLE, since
  lacking this variable in GNOME 3.34 causes GNOME crash (bsc#1159257).</changelog>
  <changelog author="qkzhu@suse.com" date="1585051201">- Update xrdp-bsc965647-allow-admin-choose-desktop.patch:
  + Set the default session to GNOME Session for SLE.
  + Update the variables to launch SLE-Classic Session.
  (bsc#1166746).</changelog>
  <changelog author="yfjiang@suse.com" date="1587729600">- Enable SLE only patches for Leap (jsc#SLE-11850).</changelog>
  <changelog author="dimstar@opensuse.org" date="1592395200">- Use %{_libexecdir} to install the legacy initscript actions to.</changelog>
  <changelog author="yfjiang@suse.com" date="1593691200">- Update to version 0.9.13.1
  + This is a security fix release that includes fixes for the
    following local buffer overflow vulnerability (bsc#1173580):
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-4044
- Rebase xrdp-fate318398-change-expired-password.patch</changelog>
  <changelog author="yfjiang@suse.com" date="1594382400">- Update xrdp.keyring according to:
  https://github.com/neutrinolabs/xrdp/issues/1627</changelog>
  <changelog author="yfjiang@suse.com" date="1597147200">- Update xrdp-bsc965647-allow-admin-choose-desktop.patch:
  + Fallback the session to icewm when a selected desktop
    environment is not found (bsc#1171415)
  + Support plasma session for Leap 15.2
  + Give more informative comments in start_wm.sh</changelog>
  <changelog author="yfjiang@suse.com" date="1604923200">- Introduce more buffer protection fixes (jsc#SLE-11518):
  + Add xrdp-memory-allocation-security-fix.patch
  + Add xrdp-remove-unecessary-gmalloc.patch
  + Add xrdp-safe-data-chunk-reassembly.patch
- Make the serial number of SLE patches on the bottom</changelog>
  <changelog author="yu.daike@suse.com" date="1628596800">- Fix crash in xrdp-fate318398-change-expired-password.patch (bsc#1187258)</changelog>
</package>
<package pkgid="3a210268070d3eac3133f5f04fe7244b800bd652497a89cc8bae201d0d4c0220" name="zxing-cpp" arch="src">
  <version epoch="0" ver="1.2.0" rel="9.7.1"/>
  <changelog author="lbeltrame@kde.org" date="1558094400">- Initial package for openSUSE
- Add upstream patch to add proper installability and library
  versioning:
  * fix-library-installation-and-versioning.patch</changelog>
  <changelog author="lbeltrame@kde.org" date="1558526400">- Fixup URL and Source</changelog>
  <changelog author="jengelh@inai.de" date="1558612800">- Trim metadata redundancies from description.</changelog>
  <changelog author="mliska@suse.cz" date="1575547200">- Add add-missing-includes-of-stdexcept-header.patch
  in order to fix boo#1158377.</changelog>
  <changelog author="christophe@krop.fr" date="1597579200">- Update to 1.1.0
  * Add Python binding
  * Bug fixes from upstream XZing project
  * Many performance improvements for 1D readers
  * More meta-data exported when reading specific format
  * Minor bug fixes and improvements for corner cases
  * Improve DataMatrix encoder
  * Add interface to simplify basic usage
  * WASM API to support pixels array as input
  * Few minor bug fixes
  * A new and (hopefully) 'future proof' single ReadBarcode entry point
    into the decoding functionality.
  * The LuminanceSource based API is now deprecated but still compiles.
  * A new BarcodeFormats flag type to specify the set of barcodes to look for.
  * Deprecated unrelyable Result::resultPoints in favor of well defined
    Result::position.
  * Deprecated Result::metadata() -&gt; ORIENTATION in favor
    of Result::orientation.
  * New Binarizer enum in DecodeHints to specify the binarizer for
    the ReadBarcode API.
  * New DecodeHints::isPure property to speed up detection for
    'pure' input use-cases.
  * New 'unified' CMake structure to build (most) of the project from
    the top-level project.
  * New ZXingReader and ZXingWriter example code also meant for distributing.
  * New simplified and consistent Python API (breaking change)
  * ReedSolomon error detection code 2x speedup.
  * Enable basic MaxiCode support.
  * Fix coutry-code metatdata decoding for UPC/EAN codes.
  * Slightly improved QRCode detection for rotated symbols.
  * Faster PDF417 decoder.
  * Lots of minor code readability and general cleanup improvements.
- Drop patches:
  * add-missing-includes-of-stdexcept-header.patch
  * fix-library-installation-and-versioning.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1599220800">- Add fix for pkg-config file so the version and library are set properly
  in the resulting .pc file:
  * fix-pkg-config-file.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1603454400">- Add baselibs.conf</changelog>
  <changelog author="sflees@suse.de" date="1610712000">- Use %cmake_build instead of %make_jobs
- Shouldn't need -DBUILD_SHARED_LIBRARY=ON</changelog>
  <changelog author="christophe@krop.fr" date="1612872000">- Update to 1.1.1. No changelog available.
- Drop fix-pkg-config-file.patch. Merged upstream
- Add 0001-Fix-build-with-GCC-11.patch to fix GCC 11 build
  issues (boo#1181915)</changelog>
  <changelog author="rpm@fthiessen.de" date="1622289600">- Update to 1.2.0
  * new BarcodeFormat names, old ones are deprecated
  * new ZXingQtCamReader demo app based on QtMultimedia and QtQuick
  * new QRCode reader, faster and better support for rotated symbols
  * added Structured Append support for DataMatrix, Aztec and MaxiCode
  * added DMRE support for DataMatrix
  * switch to the reimplemented 1D detectors, about 5x faster
  * a lot faster and more capable isPure detection for all 2D codes
  * 20% faster ReedSolomon error correcting
  * PDF417 is faster and supports flipped symbols
  * reduced false positive rate for UPC/EAN barcodes and improved
    Add-On symbol handling
  * proper ECI handling in all 2D barcodes
  * much improved python wrapper
  * deprecate the use of ResultMetadata
- Add cmake-check-system-first.patch
- Drop upstream merged 0001-Fix-build-with-GCC-11.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635940800">- Use the updated cmake3-full package instead of cmake on SLE12
- Do not build examples on SLE12
- Only build blackbox tests on TW</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636113600">- Do not build examples to avoid a cycle with QT5Multimedia</changelog>
  <changelog author="danilo.spinella@suse.com" date="1642593600">- Update stb_image/stb_image_write to include the fixes for
  the following CVEs:
  CVE-2021-28021, bsc#1191743
  CVE-2021-42715, bsc#1191942
  CVE-2021-42716, bsc#1191944
  * 269.patch</changelog>
</package>
<package pkgid="2988e84cd57c6ca3878789b70aeb351deebd6ee865d85130060c685705e0db8a" name="zxing-cpp-devel" arch="aarch64">
  <version epoch="0" ver="1.2.0" rel="9.7.1"/>
  <changelog author="lbeltrame@kde.org" date="1558094400">- Initial package for openSUSE
- Add upstream patch to add proper installability and library
  versioning:
  * fix-library-installation-and-versioning.patch</changelog>
  <changelog author="lbeltrame@kde.org" date="1558526400">- Fixup URL and Source</changelog>
  <changelog author="jengelh@inai.de" date="1558612800">- Trim metadata redundancies from description.</changelog>
  <changelog author="mliska@suse.cz" date="1575547200">- Add add-missing-includes-of-stdexcept-header.patch
  in order to fix boo#1158377.</changelog>
  <changelog author="christophe@krop.fr" date="1597579200">- Update to 1.1.0
  * Add Python binding
  * Bug fixes from upstream XZing project
  * Many performance improvements for 1D readers
  * More meta-data exported when reading specific format
  * Minor bug fixes and improvements for corner cases
  * Improve DataMatrix encoder
  * Add interface to simplify basic usage
  * WASM API to support pixels array as input
  * Few minor bug fixes
  * A new and (hopefully) 'future proof' single ReadBarcode entry point
    into the decoding functionality.
  * The LuminanceSource based API is now deprecated but still compiles.
  * A new BarcodeFormats flag type to specify the set of barcodes to look for.
  * Deprecated unrelyable Result::resultPoints in favor of well defined
    Result::position.
  * Deprecated Result::metadata() -&gt; ORIENTATION in favor
    of Result::orientation.
  * New Binarizer enum in DecodeHints to specify the binarizer for
    the ReadBarcode API.
  * New DecodeHints::isPure property to speed up detection for
    'pure' input use-cases.
  * New 'unified' CMake structure to build (most) of the project from
    the top-level project.
  * New ZXingReader and ZXingWriter example code also meant for distributing.
  * New simplified and consistent Python API (breaking change)
  * ReedSolomon error detection code 2x speedup.
  * Enable basic MaxiCode support.
  * Fix coutry-code metatdata decoding for UPC/EAN codes.
  * Slightly improved QRCode detection for rotated symbols.
  * Faster PDF417 decoder.
  * Lots of minor code readability and general cleanup improvements.
- Drop patches:
  * add-missing-includes-of-stdexcept-header.patch
  * fix-library-installation-and-versioning.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1599220800">- Add fix for pkg-config file so the version and library are set properly
  in the resulting .pc file:
  * fix-pkg-config-file.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1603454400">- Add baselibs.conf</changelog>
  <changelog author="sflees@suse.de" date="1610712000">- Use %cmake_build instead of %make_jobs
- Shouldn't need -DBUILD_SHARED_LIBRARY=ON</changelog>
  <changelog author="christophe@krop.fr" date="1612872000">- Update to 1.1.1. No changelog available.
- Drop fix-pkg-config-file.patch. Merged upstream
- Add 0001-Fix-build-with-GCC-11.patch to fix GCC 11 build
  issues (boo#1181915)</changelog>
  <changelog author="rpm@fthiessen.de" date="1622289600">- Update to 1.2.0
  * new BarcodeFormat names, old ones are deprecated
  * new ZXingQtCamReader demo app based on QtMultimedia and QtQuick
  * new QRCode reader, faster and better support for rotated symbols
  * added Structured Append support for DataMatrix, Aztec and MaxiCode
  * added DMRE support for DataMatrix
  * switch to the reimplemented 1D detectors, about 5x faster
  * a lot faster and more capable isPure detection for all 2D codes
  * 20% faster ReedSolomon error correcting
  * PDF417 is faster and supports flipped symbols
  * reduced false positive rate for UPC/EAN barcodes and improved
    Add-On symbol handling
  * proper ECI handling in all 2D barcodes
  * much improved python wrapper
  * deprecate the use of ResultMetadata
- Add cmake-check-system-first.patch
- Drop upstream merged 0001-Fix-build-with-GCC-11.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635940800">- Use the updated cmake3-full package instead of cmake on SLE12
- Do not build examples on SLE12
- Only build blackbox tests on TW</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636113600">- Do not build examples to avoid a cycle with QT5Multimedia</changelog>
  <changelog author="danilo.spinella@suse.com" date="1642593600">- Update stb_image/stb_image_write to include the fixes for
  the following CVEs:
  CVE-2021-28021, bsc#1191743
  CVE-2021-42715, bsc#1191942
  CVE-2021-42716, bsc#1191944
  * 269.patch</changelog>
</package>
<package pkgid="3d91a1053b1d3ca6d8d44a6dd814cc72896aad1ebe696d4f95dbcdce406809fc" name="zxing-cpp-devel" arch="ppc64le">
  <version epoch="0" ver="1.2.0" rel="9.7.1"/>
  <changelog author="lbeltrame@kde.org" date="1558094400">- Initial package for openSUSE
- Add upstream patch to add proper installability and library
  versioning:
  * fix-library-installation-and-versioning.patch</changelog>
  <changelog author="lbeltrame@kde.org" date="1558526400">- Fixup URL and Source</changelog>
  <changelog author="jengelh@inai.de" date="1558612800">- Trim metadata redundancies from description.</changelog>
  <changelog author="mliska@suse.cz" date="1575547200">- Add add-missing-includes-of-stdexcept-header.patch
  in order to fix boo#1158377.</changelog>
  <changelog author="christophe@krop.fr" date="1597579200">- Update to 1.1.0
  * Add Python binding
  * Bug fixes from upstream XZing project
  * Many performance improvements for 1D readers
  * More meta-data exported when reading specific format
  * Minor bug fixes and improvements for corner cases
  * Improve DataMatrix encoder
  * Add interface to simplify basic usage
  * WASM API to support pixels array as input
  * Few minor bug fixes
  * A new and (hopefully) 'future proof' single ReadBarcode entry point
    into the decoding functionality.
  * The LuminanceSource based API is now deprecated but still compiles.
  * A new BarcodeFormats flag type to specify the set of barcodes to look for.
  * Deprecated unrelyable Result::resultPoints in favor of well defined
    Result::position.
  * Deprecated Result::metadata() -&gt; ORIENTATION in favor
    of Result::orientation.
  * New Binarizer enum in DecodeHints to specify the binarizer for
    the ReadBarcode API.
  * New DecodeHints::isPure property to speed up detection for
    'pure' input use-cases.
  * New 'unified' CMake structure to build (most) of the project from
    the top-level project.
  * New ZXingReader and ZXingWriter example code also meant for distributing.
  * New simplified and consistent Python API (breaking change)
  * ReedSolomon error detection code 2x speedup.
  * Enable basic MaxiCode support.
  * Fix coutry-code metatdata decoding for UPC/EAN codes.
  * Slightly improved QRCode detection for rotated symbols.
  * Faster PDF417 decoder.
  * Lots of minor code readability and general cleanup improvements.
- Drop patches:
  * add-missing-includes-of-stdexcept-header.patch
  * fix-library-installation-and-versioning.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1599220800">- Add fix for pkg-config file so the version and library are set properly
  in the resulting .pc file:
  * fix-pkg-config-file.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1603454400">- Add baselibs.conf</changelog>
  <changelog author="sflees@suse.de" date="1610712000">- Use %cmake_build instead of %make_jobs
- Shouldn't need -DBUILD_SHARED_LIBRARY=ON</changelog>
  <changelog author="christophe@krop.fr" date="1612872000">- Update to 1.1.1. No changelog available.
- Drop fix-pkg-config-file.patch. Merged upstream
- Add 0001-Fix-build-with-GCC-11.patch to fix GCC 11 build
  issues (boo#1181915)</changelog>
  <changelog author="rpm@fthiessen.de" date="1622289600">- Update to 1.2.0
  * new BarcodeFormat names, old ones are deprecated
  * new ZXingQtCamReader demo app based on QtMultimedia and QtQuick
  * new QRCode reader, faster and better support for rotated symbols
  * added Structured Append support for DataMatrix, Aztec and MaxiCode
  * added DMRE support for DataMatrix
  * switch to the reimplemented 1D detectors, about 5x faster
  * a lot faster and more capable isPure detection for all 2D codes
  * 20% faster ReedSolomon error correcting
  * PDF417 is faster and supports flipped symbols
  * reduced false positive rate for UPC/EAN barcodes and improved
    Add-On symbol handling
  * proper ECI handling in all 2D barcodes
  * much improved python wrapper
  * deprecate the use of ResultMetadata
- Add cmake-check-system-first.patch
- Drop upstream merged 0001-Fix-build-with-GCC-11.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635940800">- Use the updated cmake3-full package instead of cmake on SLE12
- Do not build examples on SLE12
- Only build blackbox tests on TW</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636113600">- Do not build examples to avoid a cycle with QT5Multimedia</changelog>
  <changelog author="danilo.spinella@suse.com" date="1642593600">- Update stb_image/stb_image_write to include the fixes for
  the following CVEs:
  CVE-2021-28021, bsc#1191743
  CVE-2021-42715, bsc#1191942
  CVE-2021-42716, bsc#1191944
  * 269.patch</changelog>
</package>
<package pkgid="fe8564d8723c45f03b8efe032ab3408bef71881a199dc625a36a16dd91b5f4d9" name="zxing-cpp-devel" arch="s390x">
  <version epoch="0" ver="1.2.0" rel="9.7.1"/>
  <changelog author="lbeltrame@kde.org" date="1558094400">- Initial package for openSUSE
- Add upstream patch to add proper installability and library
  versioning:
  * fix-library-installation-and-versioning.patch</changelog>
  <changelog author="lbeltrame@kde.org" date="1558526400">- Fixup URL and Source</changelog>
  <changelog author="jengelh@inai.de" date="1558612800">- Trim metadata redundancies from description.</changelog>
  <changelog author="mliska@suse.cz" date="1575547200">- Add add-missing-includes-of-stdexcept-header.patch
  in order to fix boo#1158377.</changelog>
  <changelog author="christophe@krop.fr" date="1597579200">- Update to 1.1.0
  * Add Python binding
  * Bug fixes from upstream XZing project
  * Many performance improvements for 1D readers
  * More meta-data exported when reading specific format
  * Minor bug fixes and improvements for corner cases
  * Improve DataMatrix encoder
  * Add interface to simplify basic usage
  * WASM API to support pixels array as input
  * Few minor bug fixes
  * A new and (hopefully) 'future proof' single ReadBarcode entry point
    into the decoding functionality.
  * The LuminanceSource based API is now deprecated but still compiles.
  * A new BarcodeFormats flag type to specify the set of barcodes to look for.
  * Deprecated unrelyable Result::resultPoints in favor of well defined
    Result::position.
  * Deprecated Result::metadata() -&gt; ORIENTATION in favor
    of Result::orientation.
  * New Binarizer enum in DecodeHints to specify the binarizer for
    the ReadBarcode API.
  * New DecodeHints::isPure property to speed up detection for
    'pure' input use-cases.
  * New 'unified' CMake structure to build (most) of the project from
    the top-level project.
  * New ZXingReader and ZXingWriter example code also meant for distributing.
  * New simplified and consistent Python API (breaking change)
  * ReedSolomon error detection code 2x speedup.
  * Enable basic MaxiCode support.
  * Fix coutry-code metatdata decoding for UPC/EAN codes.
  * Slightly improved QRCode detection for rotated symbols.
  * Faster PDF417 decoder.
  * Lots of minor code readability and general cleanup improvements.
- Drop patches:
  * add-missing-includes-of-stdexcept-header.patch
  * fix-library-installation-and-versioning.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1599220800">- Add fix for pkg-config file so the version and library are set properly
  in the resulting .pc file:
  * fix-pkg-config-file.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1603454400">- Add baselibs.conf</changelog>
  <changelog author="sflees@suse.de" date="1610712000">- Use %cmake_build instead of %make_jobs
- Shouldn't need -DBUILD_SHARED_LIBRARY=ON</changelog>
  <changelog author="christophe@krop.fr" date="1612872000">- Update to 1.1.1. No changelog available.
- Drop fix-pkg-config-file.patch. Merged upstream
- Add 0001-Fix-build-with-GCC-11.patch to fix GCC 11 build
  issues (boo#1181915)</changelog>
  <changelog author="rpm@fthiessen.de" date="1622289600">- Update to 1.2.0
  * new BarcodeFormat names, old ones are deprecated
  * new ZXingQtCamReader demo app based on QtMultimedia and QtQuick
  * new QRCode reader, faster and better support for rotated symbols
  * added Structured Append support for DataMatrix, Aztec and MaxiCode
  * added DMRE support for DataMatrix
  * switch to the reimplemented 1D detectors, about 5x faster
  * a lot faster and more capable isPure detection for all 2D codes
  * 20% faster ReedSolomon error correcting
  * PDF417 is faster and supports flipped symbols
  * reduced false positive rate for UPC/EAN barcodes and improved
    Add-On symbol handling
  * proper ECI handling in all 2D barcodes
  * much improved python wrapper
  * deprecate the use of ResultMetadata
- Add cmake-check-system-first.patch
- Drop upstream merged 0001-Fix-build-with-GCC-11.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635940800">- Use the updated cmake3-full package instead of cmake on SLE12
- Do not build examples on SLE12
- Only build blackbox tests on TW</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636113600">- Do not build examples to avoid a cycle with QT5Multimedia</changelog>
  <changelog author="danilo.spinella@suse.com" date="1642593600">- Update stb_image/stb_image_write to include the fixes for
  the following CVEs:
  CVE-2021-28021, bsc#1191743
  CVE-2021-42715, bsc#1191942
  CVE-2021-42716, bsc#1191944
  * 269.patch</changelog>
</package>
<package pkgid="bd7047a77112cb43104862c92d20e3630abd2ca9eb0bef9596459af6753cd210" name="zxing-cpp-devel" arch="x86_64">
  <version epoch="0" ver="1.2.0" rel="9.7.1"/>
  <changelog author="lbeltrame@kde.org" date="1558094400">- Initial package for openSUSE
- Add upstream patch to add proper installability and library
  versioning:
  * fix-library-installation-and-versioning.patch</changelog>
  <changelog author="lbeltrame@kde.org" date="1558526400">- Fixup URL and Source</changelog>
  <changelog author="jengelh@inai.de" date="1558612800">- Trim metadata redundancies from description.</changelog>
  <changelog author="mliska@suse.cz" date="1575547200">- Add add-missing-includes-of-stdexcept-header.patch
  in order to fix boo#1158377.</changelog>
  <changelog author="christophe@krop.fr" date="1597579200">- Update to 1.1.0
  * Add Python binding
  * Bug fixes from upstream XZing project
  * Many performance improvements for 1D readers
  * More meta-data exported when reading specific format
  * Minor bug fixes and improvements for corner cases
  * Improve DataMatrix encoder
  * Add interface to simplify basic usage
  * WASM API to support pixels array as input
  * Few minor bug fixes
  * A new and (hopefully) 'future proof' single ReadBarcode entry point
    into the decoding functionality.
  * The LuminanceSource based API is now deprecated but still compiles.
  * A new BarcodeFormats flag type to specify the set of barcodes to look for.
  * Deprecated unrelyable Result::resultPoints in favor of well defined
    Result::position.
  * Deprecated Result::metadata() -&gt; ORIENTATION in favor
    of Result::orientation.
  * New Binarizer enum in DecodeHints to specify the binarizer for
    the ReadBarcode API.
  * New DecodeHints::isPure property to speed up detection for
    'pure' input use-cases.
  * New 'unified' CMake structure to build (most) of the project from
    the top-level project.
  * New ZXingReader and ZXingWriter example code also meant for distributing.
  * New simplified and consistent Python API (breaking change)
  * ReedSolomon error detection code 2x speedup.
  * Enable basic MaxiCode support.
  * Fix coutry-code metatdata decoding for UPC/EAN codes.
  * Slightly improved QRCode detection for rotated symbols.
  * Faster PDF417 decoder.
  * Lots of minor code readability and general cleanup improvements.
- Drop patches:
  * add-missing-includes-of-stdexcept-header.patch
  * fix-library-installation-and-versioning.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1599220800">- Add fix for pkg-config file so the version and library are set properly
  in the resulting .pc file:
  * fix-pkg-config-file.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1603454400">- Add baselibs.conf</changelog>
  <changelog author="sflees@suse.de" date="1610712000">- Use %cmake_build instead of %make_jobs
- Shouldn't need -DBUILD_SHARED_LIBRARY=ON</changelog>
  <changelog author="christophe@krop.fr" date="1612872000">- Update to 1.1.1. No changelog available.
- Drop fix-pkg-config-file.patch. Merged upstream
- Add 0001-Fix-build-with-GCC-11.patch to fix GCC 11 build
  issues (boo#1181915)</changelog>
  <changelog author="rpm@fthiessen.de" date="1622289600">- Update to 1.2.0
  * new BarcodeFormat names, old ones are deprecated
  * new ZXingQtCamReader demo app based on QtMultimedia and QtQuick
  * new QRCode reader, faster and better support for rotated symbols
  * added Structured Append support for DataMatrix, Aztec and MaxiCode
  * added DMRE support for DataMatrix
  * switch to the reimplemented 1D detectors, about 5x faster
  * a lot faster and more capable isPure detection for all 2D codes
  * 20% faster ReedSolomon error correcting
  * PDF417 is faster and supports flipped symbols
  * reduced false positive rate for UPC/EAN barcodes and improved
    Add-On symbol handling
  * proper ECI handling in all 2D barcodes
  * much improved python wrapper
  * deprecate the use of ResultMetadata
- Add cmake-check-system-first.patch
- Drop upstream merged 0001-Fix-build-with-GCC-11.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1635940800">- Use the updated cmake3-full package instead of cmake on SLE12
- Do not build examples on SLE12
- Only build blackbox tests on TW</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636113600">- Do not build examples to avoid a cycle with QT5Multimedia</changelog>
  <changelog author="danilo.spinella@suse.com" date="1642593600">- Update stb_image/stb_image_write to include the fixes for
  the following CVEs:
  CVE-2021-28021, bsc#1191743
  CVE-2021-42715, bsc#1191942
  CVE-2021-42716, bsc#1191944
  * 269.patch</changelog>
</package>
</otherdata>